From e4a993c5815e88e9a01e5b5129594f58fe5b1941 Mon Sep 17 00:00:00 2001 From: ridiculousfish Date: Sun, 31 Jan 2021 13:52:19 -0800 Subject: [PATCH] Use xar-based workflow for creating Mac packages As spotted in #7656, macOS installer files built on Big Sur fail signature verification on macOS 10.11. This is because Big Sur productsign no longer supplies the SHA-1 hash, and 10.11 does not know how to read the SHA-256 hash. Replace the productsign flow with a flow based on http://users.wfu.edu/cottrell/productsign/productsign_linux.html . This uses the xar tool to digitally sign the installer packages, with both SHA-1 and SHA-256 hashes. The xar tool is somewhat tricky to build, so is checked in (as binary!) compiled for Mac. To build a Mac package, run make_pkg.sh (which invokes the signing flow) followed by mac_notarize.sh which adds the notarization. --- build_tools/bin/README.txt | 1 + build_tools/bin/mac_xar_116 | Bin 0 -> 140016 bytes build_tools/mac_sign_package.sh | 122 ++++++++++++++++++++++++++++++++ build_tools/make_pkg.sh | 14 +++- 4 files changed, 134 insertions(+), 3 deletions(-) create mode 100644 build_tools/bin/README.txt create mode 100755 build_tools/bin/mac_xar_116 create mode 100755 build_tools/mac_sign_package.sh diff --git a/build_tools/bin/README.txt b/build_tools/bin/README.txt new file mode 100644 index 000000000..bd718e937 --- /dev/null +++ b/build_tools/bin/README.txt @@ -0,0 +1 @@ +mac_xar_116 is http://mackyle.github.io/xar/, compiled for Mac. It is used by mac_sign_package.sh as a replacement for productsign. diff --git a/build_tools/bin/mac_xar_116 b/build_tools/bin/mac_xar_116 new file mode 100755 index 0000000000000000000000000000000000000000..591d9971506120a9de7a2c839bd508e9724b237d GIT binary patch literal 140016 zcmeFadw5hu^7uUi41}A5N)!|{YS5r^i5ew9BqNE;=tNOK0VP2r2w4yoW)u}LI2q-5 zJj%MFtcv1#LswUH7ey3I1QO6y5mC7);0<~lFDP;mgn2*JJu{i0-~Il6&-*^l`;R_` zbGoX!x~jUmy1GxFGw<*J?ocb2%iY}Nay8@c82%Olh`MrGaO>*KpP#>qiow1?r6Wr( zzf_=2|8qAj{%%S5Lz|N5`qhVVNtQj3%3sT5m5Pecm}#NL`iJxDPea0~ z?nuK=%A!~LzZS0Q^gTBf6;nguYp13`hx0phx?A%*Ra?X5N|jR;vXcB7|8Gpm| zN$BDH&g*0NomOfHq@4L*6Inr2RD^H1Y5Wb>RgAx3>?B=os_*C-hTno@MJXT7Ba^@Q ziPC&Zd_#Q|124T~i18NuK}%Acq^7L@OP0ldQ$E~*`-+O|CpB74%D>OAk7mL@@RRzf z|D=0fN)@Re8XFtN>cuB{UCaZX^mVN4b>i|CuRL#vALx5OvzeNG2xnu zsW(r&cG853$)PF#Bfr@)h~z)`rRqwNq3&8DH_87hDz3XGbWN)CTlwa!GV;wyl1TZ# z=~+>6?bOE6^;>>9^@iW@q?*DuQ@#waZc*%J;!!Yg$;G850plG&o4JH`=gFE(m*p;1 z7F;GT$f|n_0rkWO`f#15%jTa&l!qVTa%Fj&xmLF`F{BfyoUW#w4JS8qNx3b5gH099 zKh;L+nneBP(i=YGe}{-BT{-;Gq^nnW>Xcp+#$Vg(x|=6lM_K+mor2+Eob%2@7cRaMX4wKkZP}OGtr=F zy<4c2YE0Qv1^%$W9~Suk-U7q?*4I@XD%4j;yIuZB4u7MwT%%S9cvS4i zquegJ^Ib6{VD0f+2dX+%sHIQ_t;rqy_QhHL=$cS#zvavFTUqh8eyh3P8km)4BZaGc z<%SzPVBoiJqf#Ptn%`~}v~TJlB0Vnjz4meE8e^`e^1cb z*~sKd-xa=LzM(_>v%Xbqa`~-YJ}cq3J->_*7L-fZMxL6zJCShtor2u40G(xPDK3?V zFX~89(wbijAZVXm)vG*c?NzS`kT#v+?tr&si!YLJd++JW-lE!h2`$VjdhH)>*KO{W z?wd}ap?SKYK5*Z3qA=U!w>IY2suy`w1LxIn&ad@b(Rth~k=|;EF5p(~^4It+XQ2?t z&63p3oYc)CZmbn0qRwKG(C=iwCQUewC=hg_qLzA@hO8|OK3>*d3e1JsQ7q9YWZh{L#(cnnN)4S$o7`{-rhUr2WNj zx1UWFyg``M+@FQXg+!SNi3d-?}Ma$SgP38&c#-Q}v`JCHT zT9c@nI^5?iZGdlV>me=AsY#M(t+!?l^1%E6w5IV;`#l~-$?dKAo8Y2rywR8C#`1g& zxZd-QAY((>eN1?AMTpOMdVrQ|D@99j1aHmLros!5#+DoOOB#)vucq&$bA@xwV-PO7 z33F<-2Ou9-y~$fsz+LP~kO|KmVRAD}7L7^K9c$>ucx&1V-J{Z)?YT55faUq_S*lz} zm3q(3TH3xwh8~$Rh$CqkW>MX64t1jSDsS|DVHjB^9_I2!?~szSc<0Yzyk$~NP49pY z)h((L544lfhNk{*i@lm$&9&Mmhu!Qo!NzV)s$5_gqQQ9oxzNHo|>* zjqphJrVK!B$!gkIG(Oc!f2LW49q+BVUId7W#J1bm_*HheS#iF{{ZB(e)d~iRYy@LvagwV(CvRlyz1$l5+`}1W4Wy_X`aw^pqs~L zxj1LETvV{S_I`$Xj;A}9*u{Vr1yjv0IiLj(dTaj4UFyOVMm%* zJKKwiR={RIkuqTSZ>gpp;dYf++a;1mD)Xd;^Jt+eZ-l>j`vUIr*ZB*xbER!>2}7YX zlAJ&(5UJ0KKZcgp=teEuCAD-4ZaH2W+N!*8kJcheXfOeEd=mN#Vnl00MS!kKg0>sb z>3}Xtf<82$V*wQ>LA4s>jjldHo22w?^VM(Om2jD zTUf+i2HD`*!aY`U#h&1wD)(?pXE>Um5J4W#*{Y!O*!)UBI>N7acS z8J@6~XqCTCosGu@>?5iR8J@$19y`vyRBr63kW}}qwi@UI2KrzUx(2A&tlS()_OsF~O-a zJXWe4;di?Bx<-WWx)#Ek+Rza}r(0JbR4u0opS8QXNW^xBeSW(ivHG@bw@V$HB?CKr z2?@w*#8vjm(w&~*NLb8H{R&HE|5oxa!u(jDWT%g zrh%nYRj;(tQ%Gk~>1-ylTzEb%i1`{3K9Sb8j7YU+gYnyQMHE8Z&mKbDGM%M+Yc7X* zsil0?2gd~Mr^Js-tYvp|37;#x+rj4^G{-5!XQs4Sc9Pa+rskhT2z?a(RYS{TBid`k zC@T1>_f>lDm$i-0JGa4?^Zs33FAxiE4)-F-4V@0(nUAI9ySSscelM*ME6E5h5_^| zg&xWMNHZmT!5+_20PavBwq4DgE8K>=SL7})HgH+ie(18;P`h=HW{+^^*+`m-?e*4#m);LnZuM6*`}P$KxrHWs-!s zLal{Ubk1?or16w%O!FtFo8K+X_bQJaKp-`lV(0m7M=#6l{&gyd&jhR%pZXIk;vf4WGI`G<3F9v4jTUnpC1~wn zuHJK@F-Oh$2r1K))u0L$Fy?RR&nu}T^GbgWYfz6Phm=pI9N&alB*VmhQ>p%@9Gy@_ zLLpV(Vzn2r8ng)xu@cq|;>|$_d{#Xq);EA-IW!Tp7Yn1Z=pJv)MX)l$jYtXixY!$s zjP`1jmMONJB!%vt&<|tmf$=V^Vnt=1u5y>tJu)^_c8W(Qtzd)S&aRj*60QsNX9xzV zOqX0+ENv!A;d1pVV+g0~l|pA9FC+O#zkRlJ!vj8=B%g}!z*#3fqBRX2C)tTpa6hRd zJk-r2IoHX|x<@;SC)Sk8O@l%;BuTYXQ)Qo_sn&(OFe*J16vR%f7o>T7CegQ_m- z2F4vehAQ6xXC3`*61``HpxdO;8x8v1B>EH3Fy8vG$Zy&_JK5$Npdv-nsp$#{sS8M>cEp_|1Vx z?x)D`lz2mFzS;4Ru~BB9nOhe9&Rg>e34&zK_h`=bLF)(ASu<#vnK$F=eyg7BS=B-( zz4|>z$8dY$4rPyHMYfynie zn;#Hg3fSk-jI?oevW<@pYhz|!yj9TBZ3ZGMvtsATwujU8(ucHFUnHqdx@pHoi|)EI zY0dw7yqWhnODh7lcw*$24lF zkXlh$_Y+u_LJ=%{K}z1}1Dv^HATOXmTTF;jQF*>5YCHm8d}YPuhx-a+UtI~4vdZnW zEAH~;@4CwwG)sWoA^~zUo+7MCDCkJ>nKElHOVWUSqITA5B8_zIHKMGwN&?`w`nHsw z93wp$m!53&mixepx6Gs>K`qp(%$ks!7jIr>eIJN4WHDLBpOARc?_yMGmYOK$L7j?{ zr^3N%kRVxO!rW~IBp~M=D_Sp>$VPSI_qh^~psJa~k#Y%*RuVi-!rpLznHK(|Z5e9gx39{JZ^_>rZ%z$j+FcKj z3E8AxdqU?2oSB(b{zetH9rDO$K8q9$7lU|fzDFV^t+n)~aIaMXsA3y{N>p6SHBuCX zrz@1R$CE=HclcNaRC4v9p8ZvKX$>97Kz^zk#Y7=`@D>RJ&Rl`0et#9J@bQctDT957 zEK{9j{Gle9Y~6GzHJG~Wlm&y;+jI% z2Avby%yC-srf$;4 znVKg9?<9b-XTwrvb1c@9J^9V~wXrU{WCb-}hCM_GGN6dM5@4okAw5r)iAvHf{m$af z+Js{*|Am(NB!l&9E`|#;lC>ph{iJ@8rfts+rdGfnh9Ct;v#bqTKT@-XnpN%!6_jgY zcOzwwG-Hr_SESy;HOq z40ANCCJ-0oHbEX^ke{WIUx2h1D{xxSFAcx{2sEmpt0ViGd+$7pw19kYdPgoMMNe#_ zkq?BAQ!tcK6l)F%o~a(Sp^-i)^GLg%oFFuM0g`tv9?(U5z^(fj-HUK@W|Kw(mf$<1 zL|SdbPraGeV&920+WYE!V;p9cq`m{Ux?E!;2afmNu^R$HUy1kCFUbdL0s5x256t@2 zEfpg>`B#IErJ100C}@45b|OZwaGUq;p7a+C=iy1q-MH7%CvhNb_bLSFGW$I$^XTR^ zN#)6tLPM<8fx=ZKR@^&qqhW`0smG!A7jE!IuYg5~wS!g!d<7~6y05Y}f(zAQlJ*y; zO!DSAm?Wn>rZ9zQ|KT28QN6=e(u?kUu~RQ&$WJbkT78&ay8T6){T6&08NY)z_M`+p zr>MA>##E3|#={w&G&Zs?$9wx~arU~%=gr5;Uj0%^z>BMjM|dw-?RVyXD_-#G2mZ)g zUzy=_FRklIMP}gYWr8PE-%mjttS3!bTi6G2iq^=zQ*iMSTA+JG=vxfcViMZecsNQbjMjH{3flvrd6ba(@*1G*Xn0)UJ>%1Zejx_NM2%NzaGK zdaK;Na@Z9#vLog-Wp@g+EH9HBH)1~IX-j5J4st&$M71%lq|~wM)zjw?K)c|^7iw@H;v_N^oML3E_!&0QJs7DO0B`goJliz(s3f$>Ty+AC z#g=N+4s|tEm|4z6dRM5et)G9X?{=9H(Ay^l44P$Ys29z?KS=ny;*Lf)CZ76pwY9u8|7pjKULoXx7w24YjzHLgF4mqP8njPqP$U|dNpT#! zBSmGxRW$H%BN{LsxQjujeb01(>mJ<-J0x#ks5K(*)7qxEEQ?lIe?`{m>aK zMi$5zac<7c$6BKx9nCXxgS7*B@wJkUJpYqu-s5_jh@T*UhYjEg05Umhf7qfP;O!qt z9`9lHNA=i598${5qXJK;8wLm)y(K5<;K}SMtIOadX`#9gtpj#>o}>-^1xQ5M$m+z_ z%ME`&op^ek=b38R9o(WiK_g3(uj&3mGKx4`3`Mc?xM{^r8z3qhmORS0+do<=j?&uS zuWW7jDF3XLa_-T^kBs}Cz3}Grj^IBS{jp9wwou0ar>m+o4>Dl0 zt91+^AU~llqGpiu2?WH<3}U}}Rm8JBXX;vv4B0DK#~=$@zr>cBE&L7|C+-{TNyiRF zv)@fdCKy(qmxvOuIyN@RFnC`>gh9D5DBuZEO1y8y`)tn(rVefYi7{twihV89cTxp; zp9~r+&E-y_X>5mt>miH$ zwKUNLh+=~?di-NU@nD)_Izq+h7V4Q^__v`5YYMU8Z9>sCL$Uh|#gHV0oju+{D5s#S z5I${=DCo`@ZwODFMrU`Yl=b3?IG zQ;5JqQFYzO5}l}T{toiXGlW_%`#U`EOfx)-^173wuFm{g|eZuJDSHPAHGvqD|wuBVF|+sd`C9 z)hA5V>(W(6u<*1I-4-y6+N4_>;G(te<*~0bl*=_lU!R{+u0)9P%VV_}L$LCnsk9+tD4r!5n-K94;iZICfJ1wY6l%xWOz&be7sD=4Ue zk~HS2qXn^5<(@}ARCGp^Nq%)qD2z$>nDx=C>?s>p2+~5;G3BxQusf1)EN>1Dr&{DN z)xQa&SjUWsY>BCTbGr81;_6qH$A)I~+FuRP&@|E2V(VkeW4$tnZZJf>G!Z`1br?Pn zbg~DDD>wxksY0^7LWY3T{zQ%Qbk&#ka>=h9;=5d(h+-o~#_s>YBvJRAL^ovV^L$3x z)~1oSSyvflhf=l5UmklZqp!ZwGn?nBG|@tcVvjH~B{3_+oUwnCd}HFjM*3mZ?@H1gj$ z(%cuZkU_La3%Kk=w8$=xZAEWt#AS0-uXRsCK)Bw15(=EJYngW4rrozRp#-S z4>b4>HD1)6aSAQwmB;>REV(p|a0F3U9-C_rk0&`g1^)!Gw3rQy*dQ^0Q`91tfwXxC zfKv_kaGHs3v(hM2k>)T3EeXf5SH9KiUzjGpAJ(z+O?uipNp5G)tkzxE;$)B!s*IiU z@`glW-o`|tBY*cXldRm7NDSJXNQ~$DIe%w?-$%K{r-{TVl=ptZgMMi1K1w9YDX;rD zk*EOoE`Qg8yNvRmz{%fY?(2Y`@L3{pK78(m&(FXfhi)?01JFFj^*QiE`THB~|Nr%u zK+gZ0wkwc#`u`xa*zy0AS3hhbw8hwB8a9%9JIVLCB%l9)6MHLcCHV7`_}ndx?Q8%q zJOqDXk}g&52wmwm9OUyv;-Lfd`u;@XndH^x{`KU&z~%44!^*P3=>|UYYl9b>1pF@l zGLdlNiNsud^#uNU@|Qm1euxqCDyu*_?(7s)O7bL|^)fxb_oc+!f^Y^*PNm0Q0j}%I z$@HNdlmC_7kDybun()n`RA)qvf7SsPIZ>$7MfN#`5+qxHEqpgJqiwsy3H95i54c}# zR+DK~a>#u!$J_nZewy7t!htBraiNx@Xt3m9vbXNz4Es-TQAK5J zg=1tpC#}b`1~@=~X-~S}0EY>%I8(Y?4Pu5M(h+B@0sc#XgHqC629Vg>=rqNK>La1* zpV@7v8N@GwI4xEEC&*8;yukGHB#po-~pjdciXK7*p3HhRcB`^ajij|CWv!V4VD?;Ab^d5sgD7U)xbkZ zcR0lWIR%tKd4vHzCp?>k+})pQJ8Td{-^?EV)FAe2HYr6K3^0cyp^e@CvH=DJn2xaX z4KOUgbgY(dIMZ0!1UOD(*V~Ca6qOMPaDJmL8SZcF9vu#Pm!w% zQXM+o0Q>7l%PIR_Z-Cb}0bXu^vo$cK1Zy3cuNO4|<{97yfQ|F@(FWLxlO$C=Q>`E3 zsQ}ea65#nMpqwQKcrn066RtPF8-+3*3EwopI|SGxRsA^wd`y78Or!k8AXW?Ff)w?1 z1KcA(f2QMA8pNp_+Grf{ml)tkfQ?bB&;aih;DwnZD90d{HDS@#0Dlzf(#!^b+Njk& zp*@InAo|PzhXQQ0#cBhbC6s+qiu}s}pVE}6?s?PzKM~5beJulYACak9$N?TN>WX=A_x1IdfhrFgJ zuZCKmsB^BD2SS|g-Kx&kxB7_L0B-$O>1qK7xc51i9*F$XY)U>afHn_J;@=kD=p}B5 zY|j&CnDw+%FrtIp4O>lK`oL$Mf~6Nzw~xtw6Wd!Aw_brfikegGpA|noX59n&)(Q zCZX#Enx&y*fy&{69`dZsSuR@2Y2#3K@?8AOkeV|r`#%=sR@H_YqLiF9J1R+aA51Lm zJW`9S?9|wQD?s?I_f!a+oQgS@>u(Yy>f=+mK&>6E{8>||$h?c)D6_pbq zuYQ(Tubx36mRCc;ak5d4XnX|)Pwmf|>~=LdnbB2KPU|brTEnaTmBZHato2*5M`hW1 zf8pwIFYHtEkyM_sT7Axqw0Aq)kR^7L?5H(WhyDw9H{N1rub9LgM~*vcTiVnX6^C#= zTt!Y}$phe3ooI>k12udhPxl+r-1krtmIDkw=4?M&xWiY#c?z7_3=GKyK__YVu9x2K zD33xbWn0mz!_C*q2I}cNI7PmX@{D{=_7^PU0^ZV(;dCA>Vh_`TyuMt@gWDNgx2i2~ zh#aM>%?n9SNN4i&-zhj>H#}^K(3~+rtnH0HsRzr9C5HAUP1_K3CN9F0IsR&n`juHR z^~v9a=~guh<^gx9zQ6Y*U>x&iqzCOWwX#kgwmzx&1YvBg2sWpO^dWWjcCQ9mD#x2S z-GV)ligRWf%VC*~Djzh*L%h*}y6#rB^Fw&pMIYRtd*pONn%XTOF?NCBUtRQ1ux{CB z#$NU`&hAa_q`7WXN2d5a0WC1BOFWa7_QFNC#C)waxx=(HNm{}u<+aAwiQ!7arMa%A zIY!(faEsAcwyW9yrXu*+xk*Mvl%*F1j+ftdTds?y=3pyPo!F7L({0tR6drlRE zZ0?;7f-FQ1;9Ulfs{R$~lXaSAU798$G^cBt9?--dGfZC61hNt9KoIAIzUR?2=xN>H z7x76zXD6X{_Kg#1m*><>j`3kUH@`t+3fZI%p?-DIW#GkGhkeV%TlxVc15K4#xv4$MY6>7|#%5QGIrV21~juzv~639t1#!@lx6 zWgEnaZ#i1WnkkVPU%5gP{E-eX+)gjt+mpaXIZ-D09{ian0*3D?ERP~Y5$NWp-&3}hPk%q z%OK+$Q}#69XNY|3HwOJlgcgH-z#|8OCJo(RC0f<;3WVNg)5}y0_M^5zShznVgTl#v zM4|!l_Q7kDJSNLy3;mSmG+BevH*Xlj)m#Cly68JNyTd2xW91=DyH%CTHnRv&sR5p2 zq;+f5>Yx>#hdoY25mh4UA(5A(hr;#oqjaa92fn4?a}UGMGWcWJ==%nH>hmcYb9?ydS9gNem<61?ak@P%(_rL4Ua0#ecK=iKRD4Js(OsK?H*xG4Ofp2! zx75?8ChLAc!_RM`0M2iZBG_+I7DzfTdZ;-HSl8(J7r__F5wha(&{`{0pVt!!CIHo2 zUmMi5nrvb%Z9)p0dX){SI3In?8L`t*z!f@2Tx-H&-5mjYMsFPMJMlZlTb3FM9N{qC zGVO%hvB0m`Pv-&OjKkp<>Dv=&ix(S8^S=vP6Ib)r9&cGP`qAVHy=O3NiE2AWstxR| zyZ>DVxZVD_aX3w(^41UwT~W4)yDp-YP-p3yP5*}6DT;_F`s8g?deWX)8?b}9y#w|j z&a6)BV0*^G!{6`H-l05{I!Zku)o55(xm#pHAyk{o=+o=Pnp*Y~45#Ob!bXra=$j(X z-xEKN^JAxp*>@94WpvQ`H*)I~-LC5-TfZ-(noi8@vf46hn`(cK?nVZbbm}#)Y3<}R z{T19I(js-KPV4pSba+uobINogHWi1+ixhR%DrC#hzY1{>%ZT4b zPe` zKgMD-IidF$H>cwTVwJl{|AKaS0eqQ?mK*^`30$2Zm8fSI90#$VbUaH$StNs#>rhD= z?NRgOzMBZ_6f9y!^*b{bnk65u`Rs!gy%%|uWL@>A6dPK1CAJ}$4w9-oHpVPlr?5a*pNk0%YCr)lMJ&55v) zEX1S8wwPwr&^3%Zc~1IwXs}eA*N5A`qmeSA0ya)>=-@o&nz0BSCTMEOY3o7c(U=m?vawQ#ZuN4}T9<2Cg1I_X8}<#|9r{G4QG|1bLN4aZayUgElyfR>~|Lj*J!&{Jv9O#;dVbYB|e2uRZ7+tQ#10MW~_8}xY#&)78Ld5zc~ z8wNsqk9<~3lFs+qXrqR5Wt0j=k1X&=Q%pfGQm7;JgNr@ zi{iW4D}ZF@aVf>`rByb1MDdG-rl>-F0L|g<>-Ss3){+MMtpiBZ-$>-G`3v)|?!E@q z+DPTC`KyM>>(c6eTlPO{#aSK)s-rCPr+m0Y&f}@Sh%_igw|7FSkyC2}DW1iM3wmZqPVNiS<1LVj&6lN>xC6veKVGbQ8B6Z%kTZ#pwIz zS0$ZZ*0G2p1jQmnTaiL!yj>6yNoOpy!z+`yHu}El`g&%qzjB|tC)KcvE+-yTd4~I} zReWH<@tj6p=X1&q1bHhxaz6vj=Y6GPE5G%zzwY~H7u?mQrO%o1tF^{AyGy&eFIq&t zAU*NBgM~j%y%EAtE4Mrwu8X(uzOv5WdK2``e9o|gRs#C|b=#Xow)giZ>V$j(hE((54~LEo87S;5Sr}RLKDW1g9y3H4nforB3-`-TnmC$QC=HyNz6%> zYOmB?#rggLJe~5^U}={x@ot&5!xuT|nrxkp$t6SQ#q8*VG{jOu=*L z-Fa+8EGV%jzTr!(id7wyRm5g9^FAR&gx^ga@RZ-omf>SXPjT|gr3HJ~T72^!s>txX zf-3{zvLuaNCQkYy&nHUsd(78^j(@_`)LRp&XO}T;>gvrdj4~eoHs~ahm2cYVtrrB11kjv8x;7QgzW0hUWR^u9W+jJJl}HPl#9UGx%!?(ivC z@#m|=icR-_u$|uJVcw*x#GCLIz5fFvFyR{|R^LT|E#RwQCC+rOSln6>uo%}Y_qMCm zwE&jz!%7n--85+mU)dVlFfePvb+)HFHGEb}y*rw*yG^9>oGM$bxRagTQB-jXCLhqY z>Q7s7zQoYpqX}fAr7fCO7b(PtF8f%U~)4=5~0A z3t_AkydpF@WyU&H4Mxm3NzeZjeD<)>dgN|bPu587AJnyg#p+ET00f1n?McXI97**4 z^d<>S7HwwJCd|z2=!GcW6S57OOa|wf;PuSCDh(>pVoH9t6)vLuGhCY}&t?&OwVx1u z@A9l4>1Hjrg@60A)40w>MB<}>Z*yf@m&meZp@>kbcS)N+qwj0ArM9RVgJRaxfo{XI zjb_}U*8M{ioxyaxGKoI`MDID4)IoV-AhX}k+{8~uqx9+tCsnsNy{$Q95UGK7GnA@FoJqv8TD}L z9wsh+^^0!K95{avT(ovtFElgUWalncDK+?h4_iw{xmnaPjye`poR9mo@1>ElHu;-D zn)nY|boX*i=`QjdA{5rKl;eeF`B=+^m`0|wbJ#Ev9X)i8ezj>nH0qHzBn;HEU!>mU zR<4h8B@^QdG54=XDXuper4c&J?%HZN!ZHD#;E#0Mf2BkiI_nkb;iPJ#VsF7D*>x$| zQXgy0qk>QNSbr70*)mIhto2QQGX%O`>>>GCw-$OBEElNEE%RQd+z@4~5ZL4!IQ*ju zp$=Hl1+HWz)m(^I1R_r@0z@|O6gi*1GB@Ze?V(;miRVzWnj)nFQ<`l`rGeVwQ^i|DP>_M64q&?E-eXU67EeO`uQjx^7$^9g6H|U?*2%u@6`Lqr-Ab!oYapp5L~K2xb^7~ zzL}~`9+3SCS0Rm8z^N@u#n8#@;AdvB;&} z^BK*wRg8Rlv7dDU{I2~nhf~Gw3(tAfwW8r{#gyRLg8e8OpjN!F0YzA zLd9s%7n$LAd1o(%?=GKrQt9Ba-u0e6D|P9%(!pplyk6JazFIR9f zRAs(t4>Z<~p7hx>{AwnQW9+6HB_m_}G*cE#1e|3?hywlM#N?4`0Mbbf`ggW`P%_|* z8m&JOxkW8_oCb8SjRIjex9YrWthPn+9=|tw5g@4t{dIaFzeP<>)As=BeYNe_y1J~f zR@2R$$P^~?rK@QokbfGV+dSNt_uYBz`yX(yHbk~HA4}In=Zh~F zkMtLQ==Wamp}g!JaAr)$wI9b!dMw`xMM?KvGmrJz1FS8QWR{38>`R0_s{U0`wR9RY ze&}kxej2_(YSRPXvh5fjCdQxXK|*^*v6`?%-}F(H+z93>t|Ur!`xbiHuiwn%L$sKH zw=?tTpp4C{B-?#>Usdi%wOpKob{#(-Np3#%OhGFz!pQJG+1C(VKz077cLOn#%;gN$~Qh^9KYM zz%l@a#f&72Te%Wl;Np$muBkYKJZ`VZ=*5)5nYEv?S@TS2q^wrDk2I1(I5BU^+qO&3>#H zum`DA!iXE?nlU>%^Z~2QE zKfPnOAc&~;-gM(cHwJ7+Y$b0>^Tk=dKRg@?CLICBg4{C#LWAW4kIl*v975+`cn#{JZUPiq1FuYul=>Yz3NJYyb$gceIPm$3=^~I_3 z*W}mM@STRKzreNOSNX=c5T7b^$ICw*_$P885#kFY1t-_w zMD{nIdW4J;me=3=BlXkc9inU4(*bf073Zyx4sTFBv<@Lw7M>fjQUm3>0}PbTdZ4WN zH?SfZ{xFIcCpMLiSWXGmjC!7;l4 zG)n0*Qg#w4mresE{e3y4@!o3r%XG#I{L?5!{$?Y@83-W{xb6j8*vT8sp@tn5n*<8$ zz0o7N(K0ym*K*6sgIrRbgMjv2P2?WNoM%i)(&j-(x~(&|c)MlF7Fl8o-g~+d1~0i| zZ{t&k=Wu=SCX>L~x*B#VU26{t>Tqy~T&A@Q#6Qs&EnvMD z(MebV`KPHk3|@a{YL~hX8xS3|RXxMKKT%5$<=$9S)oggFbtrzUFY;urc02YVW9twb zefX?xRkIPTR~N44t5I1f@ia=Xxjia=Tvapv?HF*T=T2uvkyYM!xK=giIG|JX#ZIjx zLl$Rvp3xJq-^i7TgkwlRZY4owc&$oP$p%8?0zvb+BaLi7Z=cZ2m&jL@BTF{y#wgUs zBj#$7f;v-Q#)F?WP`0nGlwH9^Y_AA3|7b9%3=rE&2hZ};Zj?gKmUm&0Fg{)+h<%-?AKCZoo#y)M`CYS<$r--b{F zHRFOG03(D*_nd@zduVPkB5nsvv(nQfi*7WbcgrP!)!fiZP{s-PbW=onH#%A5lkY-u z5U4G95PoTZ>qsi6*xoB_^?M@!WD3*lP84>wZb_Y|dC8bfL7HnO279Ej=l!IX($1gT zP%&CtV!aTeLZ}pv(z{p-U?R!+60s%!RR`Vs@FDk2N2-JWq|rVnFL71Ff^RPcX7SpQ z%k{c^Avxf^bZgx6x}e1QZkNUw?=`oPiOZ7{XW0fU?~hzRn3!?BpFFW7cQhZM87|UB zt}n(W*#}v#B@^2Y=;vo`_JM+CFf_VR?iX?|TWrzMsher3n|a(YysEkIp*Hy-n7vF4 zD>0n@IZq5})wAroxt%&otI{I$8K3@@FNNNV9)U_8+(c(nqr_UgP5a3UM(C$@QgTI} z+9wy;!MC+cNpYCErD-`iI7+^N#=YOocK{_esdrHXa|SBeHTp$<@WXP1nYFQdo#hC> zq-Cm_l`Aho*-;I&G#j7wnXmh*5?f0Xf0SlLI=?%qJRfqDhK;8c(&^Ng7k3<(^9BoJU>`@ zz!cmYg6?HvY#yH_Ri0kMm)OM6s4ZrX+598UwZA`&It4%Ksda~1Ls14ml3FH&2<_md zBEPzc`*axXKp_?&zh$tB^#hSpS$mAlVyjV8msvAAaVu6XwPxm2wU8B=T95QT`@$SP zf+8#f-5b&tU~fXT5_hUx>vzu;1@dcsg(hBvI;0K32PohFhe)j*RawHY0Uwp+N@SUg zk>*QW#V*%tt}aB5lGS5DwfhdJgr5zU3`kFLS(ut zw2?Vnvkg=>1RPES@l^-y2&x^-;qCFc8{%zLUqc`6R9d)q`g`%eOJ|k!6SWJQ>A@+VN3;>1U*WMdnctq;hp0vFBC^|#Q1KfyQZMK@!YDDMw`4E6jmo(K;Rk^V z-}XkQ!zb0BLa!ddakRW_RJ($ef6CG_lODQC-MeuGO%z38`TS$4^}YV~4`yT{j-M{( zUS25T7wr7eSl^*2)-SUT##WHgCY6vjgW5?p3okKHXTmU%ON1}0{GMP@&7Djg!-L(w z@fW`3_g=bIS7XNZTXO}gPR1Y7L9y$z#+g>eJrc|=EpexqiCz<*FBbg5bmIz`xNo zils(xb>%=)gX2xq5XRLoW+UKJIzfuFP4V4iagHf2r>G4WO-%EslQEa>2VLq&NrdR5 zCMWNT)mVK;u*L>zM6w{6l{)Jg;}sMP>?KvD(x;C86Z&k1@Ah~PCwt%{f zN>IM7DLbiiDcXJ1tyl@0orulE_w|90k3h+e>wKnvf)5wH}cLgSQ#*ZiE-`b^{(m!Y|bF071YqR$y|% z*9P36!F&VWDY#NINT`1U%3lNR{dGRed0wQ5%;@cs@4OZGl8wx1td^6kHls@JSfw*%QdD$U|YyKt9LS)6-|y@$ZMC5{SkEAvG)l~4_^CiPGK3Wdo zA`$6y7Bcy&2e?8(sHY9`+huF33ti#!eFRK2iM9zA5ZY7ABeApvAE3+n z-M7u<#dQLpoI1dXgDQDQzJf@M~CeojtCJm8aF$?jf-G0*4EPOyrBfpDryd>Z9 zqZ$0FT_=79jR<0T{SBHR(@@&9rGkee$Q?fW~0+crFV1|f#IefZddo~CEt(q zl(GjNu{Vp$`|Y44}RNYgy@2_GE2Q3d@=cad+02dv!z{p92*S?v(n z^vT_Iq1M%XU4$HBo8Kzq{NE?)U$~+ylATd=X!n)S%WDV^Ct9-%p7NDoRE`XjZyc@>A- zY7#v zSC~<{L)GVN(RypqcBr`&Q;}qc`ks<3a)n;1An@@J`kfhzI5jbkN$-)znS^D5DN_)z zIYbB==49IUN~grU!ebnb?B`Kv436%EaGrbHclgkNOF9IQ8iTMWQa zk=fpwnNqNMfy60T@QpM%W1c#mZAr#sPl>0eaj!#bLUobb?klDo6Lj;92N@~q$G;1u zw`P`b=QmM=gEM0R>9B}nzTdTGK~kl`LS)Zaz`H67{mvp;nyPOe*9@ZPP>@*rZeM7G zX2+rx~ct^cfHE))OB%WQy&ae`&kDj0m_q>yH@=)Ilg{N#3A4EmN^aUrQ1PnrPi?3r zxer#BK*`9!?<#t8jGPfza6OAkJ&?ap|2kVFlf91ob%-9Mr_?2F#mA;G*?bl+(Z>$> zT?c;hOMg#wwcidD`wKUQe~9yz=B2c>1`p-8CR1Q$rDA#HKm%$!nxZp((Bem$qz@#| zJ&GM}#!H`!@uDU?lI%;Ss>p4AHC{O^iCmY#i+Qx|7t8hvJ{4v|4w)?pr1a$%{}+9^hK^77<^6ENftCVGIgmQO2Liu$h z6+P$5vQOZI{cncF%Z}IJ!+>1*{KomH?7Bl78GFj)cz6vi;7iwB>%^Df#q!NAM^CWx-whNg) z8NxZp8y^79Thk!D$WIzH!Mni6{$nuHk{Ci%a=5@?>)#|QZP)WRNfO4Hu`uAgq64=3 zVG-3EC4m$8JoP0bPJ0Y;A$UX6nJ!@8la4p$&dGiV-%8JNW8jCo*ucLOsM-i^Q8;U@o+TDXchX;|B*(kKhMzUuQZHCuK`PIbQ~J-(>QwS&}#8Mj}B_Q z^){$jj>3(a7aOJLv%P91-_K%SQO1Eoq=1QxgN?+)fPH0-o=*;$-|h&t6dk7#6A#2r zq_!kqk`3^%{GvXA!uLbxNjNJ>hO=PdFGRWH2!6c<*G+JFnKZ3NsGA zvPyi#Vm5ZtnNh&LJ2&kx$y+CT+_nt+o=sn3-x0uMt`?7xDP6siCpI1TrNEGg(4=zN;td$L>3VPmK^NzOcd-N^8OsDTZk~OWKcY31{ z$NA}s9qLE)MI+g#>ikS2c#{Tuqczf=ytl>ct$$~>lHZ>}ugS9i&E{_WdU=gg2+UJb z&pgN_`Y}m2sG}jq;M!#8`$P(EH;2xqB2`wCpUQE-x`4Gob#0-==)_Mm2y0HAxYVAx zx+7&vi5C!f+|%Tv1*vIHj^2HYqZ!pkK8=tU8fN{aGm<~r%e!Dsft;Kaxpto_g4Cwg z$80jmch&VtL%oK5iOx(N15Tg78x@;(FJRWDz8bo0zpU|zzG z{Zn+J@INx~4!`)#)6VK&dWCk^tO@f|C+UONa*Q!`G!OT~Q08b}d5-<6Y@NtfAv+M{ zAY0WO8Pn{N$b`HXT3MsX{*o&+$?weVBiP8vbZOaY`N?*@ggT@)llq&Vp^L5%%kyys z+1;?0X?j?nDT{d$Y|o`i&{=Xm==uA_Q}@WDHGUn{pU!^ua!H8a*EDI~T#x44hgHjP#303vwFv;&FaEvP5iWz3uP*R`?c*Ld&XQ zfn0cQ=Dc1jca|*|+m@ORsY?3&Llp8lEwumX zmSg+q88Kyk?O`!!FiVuR0gIUu*0L+ZFy~opH5@`c*>$=34EZQai&oO@?3Kw0YWD1j zpCspN6KgR{yD+~^*U%x(ahbS8xl98z?Y;lf6a(FJgl?*&6g?C-4aFazz3KggAOnCdQ0E;5jLz*D}Ai= zcyGL`U>UYJ=35P=Yw1AF>e5M8J>kIGP;yuJqvD!`PkzLfO=^Cm^RKlfR$cXv?yNeF zz(LLXPA&M+wf4u5)Ro+IW|q&pd{t!ML2u0=kdmPdj_f-WI^Jn<0%sWml`SGc_lCqa zwcU-L8U-^ZVG+MU3!+xVS#dU6!#)Pv66_~Z zH9N_yBx~X)*1mI^dta#qOhhc)8S>s0Ecj@4yR&==f_i=YTlSJ;Uo#wpVZTu;Z#o03 zgia`~-rJmayg0WYb#f1@`BgF9IWCOmPpWoe6cR4bi`>Cb(aE+Xjn#K+rs`3U!(0Yfr zbMTOW?ba@_9Fxi~JJ-Cx4Xc#3Wp*!?DXV!4VhQ{nu4pQpus z_imT#S<+q3LQ9$eoqbtep!@nV_m0TE7U3r)m3vI54Wp2wpW2L?LF;Vnwj^lvq5W7L z)kp+HZq{BrEvgz`u6m0#^d4*(p%}T;`Q6O?CSw2-Ndmc)C6G)(GA)fbk$Xn!jm#>M zkEL>h`V2Z!o=VykS!ql^;5-$PS$SX%-m=70j9^~hrMu$1F(w~Q;8mn9!eJ{j?^<=C z+&cvqXr^0L8O5rWGF1uT(^6u-=l8I2gS?E{P36-}YH-u>y3eJ%nK(a@2VTS9J|G_uDWiAr2ptqDDKckl4J@H$E#eFP)%6pneMvM3G=?0#< ztO*U*&ZGB+&y=2%PWnPS&&r^iM+e$@7`Y|gDfF`jY2V>_$&9-QIppegbK9RMzd+gj zJ-&nG4v&x@W)43WuWIDGUKAF-cl~dCWx~#FWL#_**XvJ{z36iWxg+~L-aFsMhpM`b z@IF!JjmQ9^>$QXSrAva=DaJv2i-Ue8SnQN^&AG5Pt~r=2S@M+|`Ao7l1k$~#U9;eQ zS>oV=Bas@RqYD7@1Ayiydv>S~2NJ3r0zGU5+=6CxD_9EYajkXO26yF zuuqPisuM==%y83eSm|LSBO~@Ed8)cdM5&cvc8Wi8sQHwx;`1_IXtt{PNVOhw$=f&b zE>vdXF?5K3*0;P-kek>@mz*DbmUa*DDKF>M$y(Sf|^Rw^XZWO{Pempvbbzv{7c- z=%*jS+2IW;hd72(C>Q2CE@7J6t72c7RRXQ6rP{{i)h}@qn}nPqvU(x~eu$g=&9N(z zQ%ZUt;j6 zKBzZZ(F%i!s=_NHn2{NhbDKx1H6PH-eBPy(!FZX(5KckLXX+zk`7w2AsO8uOmcI=w z=9&q1ZZ+7djw4u4%Oi)@C?G>ZKRUCcHB!}f?v{(?^wF1SZ!YvR9)CKyoE{Q8%#gt3 z%@II+r0elAYGhap;7;#a&0kB!|K+TZ-&rQ?k$MiF=T~ot!JO>M_ZrV*`W;83UKE=< z*-w&3Aq=|)vbA-|3A(NSwGpF(U7SVyz8(%st5JZVDY1qDqgvjfnGeonp1)cBAo@B5 zT{IX++->YUgy~7J^sl(aw2-#aBN8mZiH(cBBsli<2%M$$P zu#B8SQJ1b~@yjU%KJin})>Mi0i`s%b?8tUi*GE|o;m9X@qdO6`)Q#F()hVFkuS=J2 z0~oB_ChrxnwC}z_e!S6nM}YdceezRvG&w?zq*6*YGGRGQG!1bAm50&RDsuA4q4uA(K@>-Oxw;?^ zsrd!iWzvqSKr?=sR_-}`DUu*_LcK>5mpIe=xMOE9s3QA%gxib8`B29eHkXF@*%J!9 zMxjM8?cqPY;qW_NpH)m9XReHis=Sof9}NT1Q-0jLY3HD_Dl~?Y+n(Am`dq~|H98(j zgg8#$^1FvGtcC4z`3+1VUd%*+hYrMf^&!?gK_X4qp`v4@M{A9+fK zv8(DhU%9+;@snx?tH{32-g`zXVNKIDI2HUkVVC$Q@+qG)wns>UL~EVx9WYcH^P@$zjB6; z-y;{1M3ZLWn|`B3e!5~76`KfjoCtIajvxX(DS{=vHYL!#83J`VOrVXorvzF=%Y0cP zb~_;jml2cb2!A2Zz+3vA`3nJ6m_1?Pft_&lj(aWdrs{mhB|oyF$#`DJNeCv*FY>ZZ6J!4f|DSu$eYRgFa{=VqYuG zJMBjzHd2a0Y3XGTbn_|nTR)=rgNPh^W*@P};V$x&P&SUt*aXQsjs}xj7nmKbB@3~N z`s_BCo0)sudTujkZf$rofs=GIbu(4Bkl?^dVz=K~rXA9mF9T2(1!&MmYe0P8q*fm* z-1?ECaXi8$8We1LUoP6*dY4XYg(W*-3p%VAHnI`y6lB2#I^j#G5Yk%>GqY*@{}A^s z@KF}m|NjO81OzuI*l4}13L2Ckpixl4L=xO+qEtkw0usW803nIVhKquL0cE>gORZLW zv86YQy;9pMwO)c!z)QW=D)k2S#uHb?ODlLIzxU_Nvztu_w*9{Tuh%~>m_5%tGiT16 zIdkUB%$a#MlaH+hhPW@X0OsYQ1j+w_M*ow^B0qD7(fd6LoDl+dzmp!pUhGjkjU7R} z{Cg@DJ|EKW7)w$k?4P~rokn)m{(aR0iVqRxoPi9k-a!mmAo@7O&kKr9Qo0Q^n(z$` z8H%{u5+=dPQI&p|d+jSk!e7d&KKG6UWKa^fE$R12idtBs=eRMM9cWwq`T%M8S}$?S zhA{6Q1{zoT_rF2u-#p9;i&jW@=DU)kMd7%aLgA`}k5OD;1Wt{0gH=4=MJLw#{k6ae zM@q}g94Z+yj>JI*!`k#sSJ!z-sqxzj@sPVA(EKD9s$%;LkvSxQs*;#MI< zP3`bj_tzBrbvQ6pXjiwgkgN+R{z?+PkLZ13=@6|tlm<)qSj+2n4*OYQime`_GSWqP z5#$*M7B%DL26BJaRxh#4(mHx}dFS#-b^I=AUEkZeRD=z#qf~b?1H4WFxQ>gpsO+c> zYO{;lsHe7oNTb;`!tc^O(4#jP)W@SFa<&HZoM}{k&9RWo=>d^!X4RRF8N0SQEKd&t z%j#D65?pnh)y~(VVjOo1XhvoNSNOkd6lj1z?9Cb=9#%eITLd_(0nuNDkqUA@TxG9?ODVl8n-{|{PO1Dew!IS-{skl4KIB#;COEc~RfUf%jW5nCX3uh1H|uL#40#;Zhoe6h{|M5`E}xo>@~*lTlR+}E;)aKv@tFlYF5oK?ELIcWY6 zlhTawe!M6{X6(~gY4++I#`v~6uot{j)XK5HU}D4N8RUb@%>!(MN!taDPbcwb zPg()pZt?gn$4=7o2mzwm8a=iwz7QdJI6Umb=(zH+uayPQdnugge`h^2N-WQZGlnd1c|T>ybU3|AKyVa3Xfa+5kJ^vcv5R(Zlb+f+xxBG!yG=!!sOVaD zWI51)CBDopwUy#03@=(Dt-^ZsY9XJ##y6qIP%D}S9c!&4|6&q7xI#tm^73Jh-#UYg z8t#U$sNm`zF6GIFZZN9=WZ3Q9!{`U2*I4W9P%|V7J>IExUZnms+G@-iMx&3ST-DUf z@+3`Z?&pz>c3tbT+a5TMD&D&S{4~TwGQ~>Q(KyqDKUb{}MWx{V<0^-DK`$3KO08p4 zrs?ZwUbYfAR``&b=Z>RnWj}rv?NH$@Z&Ev~Yfqjlr?{(lN{$J~r#~gD@@R|^8|>co zUSy!8l&$w$jQ1*!&MQFa&LSPHaHZ49nZC`bR*_a7V_UuZy6HdvY7z43J84mMkh^3L zY0@S|J&{r;V5EA#h#L1#SF?Yq4=JcP_sk3p(HZonzO>5`wBz<%R4z%P~wM;GWtx#^Kbd=JM@_s$|8W?RD@$xqI+jbyU9Q+Y;dG>U`f0f3=PHYu{9J|USIG3Ml=>B#fcKMn zbYLLXqF9a*^x7II0epkQ zEi<(kI5Ss)o3C~;>wK@~yt3F68T$zr=HoenwS-IFUM{rQH!7i;icuh&)9uy4pZ^1en@rFy)7Lx~n6l9k?-n4t&@>a{#rx@;Ra$nj-}mHxK%Yt;E|cH+>0A6?iBD$B48d&Z)YY7ID|J;Q z^i-pV5yb3y+0HQ6WF`s^Sx@8VTP%Xi3Ac7{JN%(=98|9e(N~&1%&5cp&oz0?J4GX1 z{hB=QdyZvd&X_v!Nlw&V4PS)NwN*GVF+UtEp$u!7A?C=pLyJr_m8L(l)GGAM-gLk> zk~t6{znN@&QFFTD)jiG_+{Q1|!&zRgNFm4Jj$g@MK6^f}GhXr;@tyI+ihQx&bq*BH zvIP{2_l_480J}~0+p2j=ojX%u)EaB#9PbWI=qQOB2DehP{3O~4S&Sbe(vK*M9gT$L zdijR*EbnIcf`H{ptkceb6dmuwqy|2;;;N-~;ctM?a*W|c3a zE*WW;=Xj(1#Ql}{HcLDa$xqijt*Ld)*(od$`l0y2;-NVA?))?lE>lHg6Yw8MYa^RV znTE$Vt2};U%ksQHbZT)+B#(K|v>_oV4X(bK&QsR1RMV$b{{ZHMSdM+raF4gw2*f0P zhIk3?C>4h~Px1oqRcvv-|3h3G){r3q|GJ7qb4~^BS^DOd&U+q9w`usJAz%{3X#A6T zdT2LnW%1rgnDwN0o1yHjrn*$bp~R*`<+5C_9|f?jj|O`tdMs!6xHt0z8vY>A9`4YB z^CEBx7u(NThi#^>j{6$6lvm_P?GO#Nm!~`XLDc_R`C1}O&GCcAgeYZdSehplk8*My zDV4tMPK4R?P^!h}g|GC^7fT=-2R2_R1DKu;Nl)j)uc^6Qj>V@jE@bozk0G+iWaLX& z3wd&TlYa+YF&s)BN*BhloSUp3VcaIBoYs!@?2w4q)8W_$Y}-x63SoSugbt%1-P#yw zc_n=IO)B0tl|R?s{~2PV76SF@EUB{degb=@TP!zFz;U!WXG>r9efH24rrth=L)33P zl!lV8!4>Ap-oIVH4z9vdriKr5+^{teorNH4^Y9HBtWpve&E;);N^6oY1WjpG1ERZF zD{@w(q6_e+-EPFN(Jy<;sXI$?|FeEvYXoaoul?Z2>S*Ugiexo8>X^WJW zS-P6@l^T&F&6<}n6|qL!s79UM_Ke?%VPmDdvs%3eR6qtN)yvGh+NEs`D*r#2SL)*O zNXKg$RfS_uqOj>M8FwGSd5^+=HpgtyC~G#&9#!zJqYyPre3|DR4gDN}hJK8|8LrQF zYFFk#wCTT14K91iR#ty%P2kuvorxUwtoevfg!wXOU{ zTg$RGYoZiCUDKEGmu__eoMVugI|7LZob|K!P(G!;1~tnNlPIy4+F&coZV`H(QT&0v-1C5KCa z;(vIQn)Wb#fi7MYQj*<%l2Ed*uJ=`PH0_@0ZId8Kn0Ax6pS(LfMIjN7*zlQAGMQqTxf?=_PLzVFu%yy z1XM}4svcLLJzhNoNfHt>axm#H`VFKwU)*8k@sq7%?emUC6rm5xPgoAVH!QcP#e=zTm}mFana+J9CaKf?yPuNJc?sF7|)kqvae zq@R?vTsx9+j_EJ))947!XFn)8(%Q><*O$DoieRAY!3$Zd%&7PvAdziuxV(0Z4RqW@ zVrb~(y_wTm21^l?m>gkOHA?C0f0B@zbbS()C zD|$1SW*<3(jK5*NtOF?`V5X1~og9IAd6Ht@1(UzD%xNk0cCBpss+E@Tl7vDNeOmzL+@l%aEk1LV&HCzU6J@z>ubOvilh9 z+P%%xjEXRZTp{K+KP%;246(jlye(xHkMXWTP@z!?LdKVFwRhUl9BB!z8jmh_%Mi>_ zzs@X_B~V20qvnHX;367W?N}B+3{qG+xJHyGX5fqUW!YwkX%h?Ohn91jkV{Za0u%X{ zE8^8Twq|seqm0N1~QUqr! zSAuY{f5lVYrIo_87^BzLSiJzKlIK}BYxka%bWMR7lmpM_{YvdVcs@T~E3a4;u87w` z@NRE8#TYT~vROLnnb;=pmzH3cw}S$-*s9)0(tTbl0zgu4CJ8Fy3q#ubUHzmDcb((` zYw2(F56azPKLd90bMO55;n!+H(o8CIBGWWt#D@ZJY#O9yxH!ZWJWd_!Kjm)uS+q@?H<5)0O zCzwpmSm}KNPXgpLjKHCQzOUoivjlS3DuxFtuX1^%eum+_)jP($)G4oXnf8iXy@{e# zN42sL!qCmkIo`}AvzvL~NcRSb>Kh~(^&&PyaP`lLj!oaF*xwm0E{@yd-DRL{&i=^2 zEwXT$hspj)6n^~|aQ25L4$VmEE}~W{>gz;taV)e=@IGaaiVCR3uTi^dj=jrkFpyhl z>1y`rzAIe>5?#TK-rGMMTH7?Clxt*RnU*yxsp6)*kOEE10dAWjS8;l}PrB`gqzN zZ|6+QYd4Orc!H5!M*_F8te~x+;WU5pW+nSM$ux%$Ta3S}by=+pLq@xi8u^Y6$G;MC z%o%wn#M%|})icNz&mO`88jUy0kl2!4aJ3Etuy(20BkC@{s{xo&Au^BksSTErHBe5( znZ($<%X=Gabl)2_n-Q-A)X>3C#D@V2>I& zQAa~_n9;J>vBu z?PtnbckBq`U=oQ|n1^cVy5O*)5dZO@3V28MR%s72WtxUm#8%gk5nCLu``fsAa;Bbi z3yl22q#2e@*YE1ZLN7(`uKHjWf=wlt=W_0mZi3k*S+A8{-)nlH#(G_0T+lUSEuRjHUXj5D-K?4DHJL#+v*O!R zi1R?K^*Kb~LF}fqdxWl_ckU4qkc|Fak<~mEF`S0Xp=;K9O&|E}mt*a^)hnZyT7&K( zBfXs)oYy)z^!_o8Ols@F5G`X#2y(4gGjbPx_gj+V-QI_PFbq*m=yK<~Ztx0pD(6p? zGf`OSC*9_f23NHhM!w4EO4mo5f~(ME>0<7DM-sDx?%*v=`V_|Wo*R08tYllg_4-IQ z-K<#;*C{;@HEHjdJJkjvx^xA~RChg>%Z+-^D>|{-NE25KgEg_~E0TC9?Dh_AlRdE8 zJ|D%v{kR9dMB(W_b#?q3kEt7sc6-A~%gdk$Ni17~Sg3U|UtgOl#ex|&O^wdBn=Qr+ z?(cd$W6WBuA>Z&GFPW@e@KvkNwjYVm9SH3TP^?R#I9w>=6>HEKzaa(6MR_l|5pEv@)r+9IEmCwY);4dKxro*;)_q>HC;vIUE!HqIwg;q>wgUf`HFIdJSYbBJy zRoh7}hS;XEjyflL-S_(pvD}iAe9jjZrO{`%P+Z@Fv2A8tCyqMUXcO7!QLN2xpzgrP zB8T_3X+FLKHTWtFMxV-oP^rFsyc)6>=Y*Pd4oN3n*y?)}W?Q;fyc1m8tX-!U%hoV> z!nc~seAfR{>mQD9zxDI*SupPqm8c7i{!T*Hz1#joI#Jy=+S+RHM4{7SxEG^&WgjI5 zpUoVevik^6JVFI^EMOZlt8uEy$)$ZW?@%Q~44)EdP|uA@gI`d)Qh=%SkG+Onyh;pi zn`0>d;2IrtOVkBWutR)w1xVIrB?8?_AD#FRSB}Jhn9Hb+akMb{-w%Bg-f1$`r5H-_RsFG`aRdA^|I8R*_y34pmStCGs z%rvy_Rq!jalA3p|h^#)V%*o!fmsn+*k1gfW(qnr_b~vkuanHTrTu&b_T~plte4B1= zlIu2Np^tBbvzWE*s?dZNzQ5q*@)}WC;howOK;88DEWFLvJVr>_cmq1xq#t&B120u< zDdQXo*OO$_BmRgS9`;yp)mY2)1aoQ5Eb<+XWvs;L*0>kky{3$(-j~3j%>78ZWRRC@ zbzndlzqCfsC2W>)dA@SAH5ID~n!y3lK*1XvBV{cKf8H zn6TZ(2K3qr(+TT;E1l4j($;*A7?ic+7V+>%-QAb`6W($f4rRoy@aq`GzoldR9+Etf zuFCiNDBJMUmu=u4lWP@NgXM1n_~R6enNX2R2HV?j5pH!buLt#G`eDpddl~cG@QZn% z+O<7o+O(7|jJ`%Lo}7%z>rp%dCB2RoWu33AW#0+W31x}%T!oKZKx56 z^0z5WeQxabWg~^`MR5DY+~$f|;1}~l9@E8mdwHtJs-Gmbb}q7nx-iS`d%J!L54N8H zx%}MwS6bgY?<*O)=;iMd^IN}9pQDD1xpRxr(dmJIg9z_lGxY%%nyI;uoWJD0<}d&3 zznnYZ)6&Us6X=91b!kX7g zy(V}ENd!rMio{mEvll6YYYuYRH3Jtv2ZdnG!rV(h+(;D!72 z#Rxg5K~+s#~Z;wh4c$PC3bEd)Xc32{D8?)HZz7T}Sf;W+0R&BZQW|wy+uzWK*Ux((ebS4Ua z4jS(+Apkf25nH{lzs5ssD^00$L(h1Bq`T<`5i(J$9l(S^_%|6NeKL2iemY->3 z=sH>|qh;y;V4rS>alD2Jj2BIAYdP zC7*}m$yGHH1CP1;1jKiKkxll$aBY)8v^-uPDvM8Nt@%Z|dc4{8V{{JUIL54Ew*Gj7 zG!D`TW<&UPyGTsgfrF0wP?F=jC*VY-Bgp}r&oy@jlaMfBdeeCuo207IXEmt}+zL*Zcyz>Qb z1PI_yU2u)eRR%SE;wP(^agEGcS(MLF;;5dO5vX{kw`EnOd3<|i+5EEhC(!sk8i%q< z!wzKg7>F;bh*#uRWHAG)VDX3hMGn=lrpwRGPsELDJ(7Qx%->j{=H({&PbfHe{l8S> z*c6sEmNELX6aR`gjcT{OL_B9ERlllj;jxb`y9h=%a~E)hF6u}ZOh?(qDEO3jPG2|h zG4Fu;rFojY{>8hfT=aiL|JMCFDn3Z@+_RHht`18-d`i2t@U^tHG+sL-r(!Hxhi$6! zURG=QR>))I>D*u>TX=HWFuu|hX|0H{W-rt?DH-eKWm&K2#&xaJs#7P3rt@#}Zg#|& zqlka`zfte~ej1k46@Jx!b2K9vuSz z`QAubynIM*dDh3p?T0bUo-DRA&ay@HaF66Ba|S<*(v>OK>kp*Pl+CYv1N_6$QWxnJ z6S}lUzWErd-UW9!%`uS*nYLJI72VQd!s@;NXTrX6zG;ip=Rw{pTe(l42jOx88G6Bs z-c9xfULgW@dzB)IZ$xVVc%82y#g{vU`YmP`NV127;oGStcs!O~?04J{Lh! zZg%RP{RE((;N+>l?9^)Fo= zK{s6A{2gSV`DRVUSY}qWBW0o&?rPvXGvanp5MyZB8h+^Kn)rDySbL`KYtv$ku5VJaMj(+E`>G$M{(Lb}6iY={e-B*A zA}E71DqJek-DH9jYs#^NnGr5@@jhIZQnIEY zt1TN7%Dd#e4&zz7th&%fmz!K}M-tuTCilTonD+IXjGqh^EI;J#Fs?;MvnaD-Nmc-t z%f#Rhu2;eVKO>=T`5yeLdtUD{irE`QIqi5m#b$_a7e`y)!I1kt9yj~p^V9`75?7Pk z7isFU_(%cL} zn=?ukmMs4U1*KJYzHo+@kuJ{B1+&9=;u{dL^zA1xYJ(`NC|yQ%^3;4Cr*lsDb^*#y z+Xh*$U|gcuw5%RFQRpEF0g*L{`umW5DyXs2KZY_hiy7Y&g%_|8AfbGU!bICUyd`=p z(Gtu*5sgNXU_QW`wx{>6*5zWlvTDBkpQ<&l=M3+6(6?W`qQ9Yg_Gp}FT~cPp-%Z#} zFkgGtqQGYd2qmqZ|3ew z@jcdA!Zf>5#dF24iKd2c>1$jDXgbjQ za&Ler>U@n$SNCA9nW~6)ce5_vlYiW9ta`$AODNXWOtS84UUUpUf^MI@&YEBSJ#NBb zm!xP#d(KiSPS%_wG{c*xG90}ly}yxH_Xbhs;q)T!VSAn+(_R-)@A2-ih#lTWa@n*v z?PK-7aQ36GtC;7#gWdQP6=%P>QgJ)P*-_TF(wrS|jpOX^zn|vpGC14Y=5T!f52X>Ob-s?Jo!+zSDHBV-oaHqXiL}jIG}OGz z3gX`x#VW>r9vyKWR~U|m_nhwUc{ygqgAmQ)$+y8JLx`^__qg19Q@Pu>Ci$Z6&Mv03 zbYN$%@&RNuhrVn9^dqgEO>fJkX3ncTLnzl%1?qOkO|EX5FWW7BxDCf1U$J;#Ac~5> zYu4T6%0_ogD4+MPd`<(n_{lPJ5$zu>v{m)Ne_!Uxr0+JvQZ$E#gD*WJ@Gr^3$kTQN z0>tAMTBicn=9snqD=$2b03m6lt_u>Oo^Y+;D4ub62C?KAIX2V zto;vPNM8P^Z}FPAf8f1*w&dk>N&6&?I7XmU%?$X1coeeI=8Gh#c<{2}yM$S>PQ&H@BMCP_Xk$l^|z`22B#|4sKlAl9wI}RbAALi!0;+N&b z2D(XiIDUgzmU=iZfB(67zAahFqfl2)m<5F#{aaE=v3<=GaF6wAK9`NP5?s}$r}%`T zFnY&cvw)0XRkSj**+{c(Uc&pt6lRWE@#K8L(`E+ae7tNMMlKTaIc-zy<`&1T^b?bC zl_hjv!ondpmHJ6iBgJSJ>`5HDDme6C%D0O&p?uOdDR66J!i?>tlhpVEepLjK&ZV!) zt$-~(D`MO@U?1f=IetY>aqJi|i{{zEVz76E;pyYhyvc&2&>RAq{Z0L}_{b5EJ1@2V zqCLtf$5NB5huz+sJ}lyWG}bMpA8m0q9)I9PD5*rg*y(jF7S4`ejakB%ehY^Is9ts3 zY(_0}uoy74yRs{lsqH3W)0FrdOaEpKOnv`e$~6_du!nIDamJy#g-f*wIE|s%CP7y> z?DE*+BAV}!MIvFh_ldD&vmxpWB9WyUp*q?=MpTsMU!-9YCh$*ybR8{>^(QGk^pvl& zVVJA+lIStI7c;mjNw(tq;3`*?xAS@RyLfJUg@9I|F;l?;AMlo46eE?9sNV)`6|&4ucnyVrolxw!5a}a4Z_TWO%6_qIH!Z?Y=I*1AQ8lE zlSh%pb#pJ<%0jI@+icUeK@LyzFNNb%UdnZCx3>vMu4{edy7qiBL2jr$Tx2~oMpbF% z`uN@6b4s>1tND+5xZfUnk_T_XeGLGK1Ke+8u7-k zfxuhuqtlU@pDOG5mX)Q>*bA1om;;K6pXHZ%fgV^-fPkLSCtR6lC~jaz#<>)V?zf5S zFh3)Dm8036GHQv9$UZJbaMed_UZ~Ako>QBjg&owMn;bw-OBxNo0j<-{`^{id1`R7a zbRhg`3qD?{mK*mHKW0=MZ>@om#TfDVwOCk>cz21+_+d_9j&6p_cQ|fYqB@r-VTmry zb*a9h$X0KyOXp3^NI#8|K&sCo6`P~7#Bk$MOHZFsD|q=C=|{Qr1ulxT#YD&)Kb9E$ zu0vQ}6^ZH)`HY^vF8$|cP$4uH(c)EsobNuN+&73Xi=Q^6n8k1=Fgws0uM?$G@6s!d zz$CYNKlh`4=>OizFJ8j=V$tenu|W14TTC(NgcdsdMJ#{5rWbF@^){d8aNox-r>c^# zrssZkD9;k-yTtk4tt4u>hQn-}TjE^8oxX9k!q5A+j=ZUMTz<68 zy1?zN`biY_10A!AjXZ%;t?}06}DF|@Txd5qley=a-mS+8}1$V z0xRdAd0mp2pUpSMgQZDcKb^|@0UYzbFT{!F99>OS`fpy}?_O(%Y6b78DR=P{-tA(& z?`)Dc?)xo|U?d13u2qG<(z{O7>XXDJu@74wD@qgftyHORdBb>H9DAjB-fdq@=i*D`@BNHj>{Tu)Dy;gTPsS)3xPR3B3`14e{(4~H9kXV zuZ0Y*PAs=`^fZ=iYxe1cQy3du_{Ft=2R{#}_AIikn zq7!~*g|`w5)AXHk*;Vgu5f#1G`PuFEtl#FSA-(Qy&w92vc+U^-LsnM47I;saOU2Wx zSAH5;(Y(02xaGkIc+sPA0q9R$V(2l`9(srZG?iP?NBZ#_@&K!d-_XjBo66}5snnD$ zG5A9oGyTD)KhPRw@dwo@wD`CP{u!#PLB*W1EzU1h+Fax+de;w33mg%==Tq-J_v%i2 z#gO-qm#vy63foZ35~S6ZIJoLp2&H}Ay!fCSRI#C|SM|8S%;4&8@~Sxg;8VoX*>tsF zIB`oWKXR?SB~NAB4QQzy^d011HX5K4o$J&F!PRkS^~p(JOIbVuuNZg7s#X)c zLLoGV(|+o7iNb1Hi7KfDBnz)@R;*nXi=y++COJaW7g^qpNGAse@3~*Mldjw)7I`=J zCNncQKBR1D29G<(+T8ojgNFQ<_)Et8liHChsG4OXdtdJ&Rl}vGQ?8&&*Erj7iZWh1XHj*IhUF)(e~8NIxMdm;*jN zM|IF6%--XA-9gVk{KlvT10R1R2`jTBrHb3$+(j^Chk>$7ZFdDK!co($-C)5G5U*?;qF#+z(= z^IQMTy%}$E?9Dp=&AN;?A$#*p|IPIoZ;I^AZT_3ujyKhKN@&cB`LDjx@hW)l&fF%w zTkO9p?DTG+y_@g9JG|4oL+ss^{=3inrz;H3K~1{gYm)!&pSV*_2Tw{aU{oGa2)7JpDdS``=!2wnHl)lF0LD8tCzCDzPS z+duax@osMrSg;}5p5{34onggBoa- zJfQiWzP!tntU+4&_=_pVHNsG~4l^=SrUsc)v;SvxQU`yHX@<_1=VSng!k6&LzF9;TC2y zD^(>~LR+UA-gAGthNbgzRKu(TlQT6%&K~9hY-Vq4|B%)J1J-P?#4A4bkXFFW^q?0X9je5CW&kjf?R@0B3FKT>P!%g#*mu~5~^jHnNc@6xVMrxl-rt8_lVTj}TNqiZZBgHUEo$elF5#_(yY$JkR{G>z9D^$@i>G}j;z zQbV^w8{MA`dwk}nto0TSF}v?PN%6^lQ2&=x&N^?`?`e!g;dtwNe3+d_@Ac!EiH%gs zfAg4LVf4n3uXyDfY5{lbcU^GR!>$~84Ggd%f~zFk%DkD({7NUSbftWF6&B~UnPk1_ z$ii23mv^&EZ)8n!8Rn8fuP)=UgN_Y6b*3YF4oF3VuC;~LMtq6Gr}DELy0JdGoKEN} z-OK5wg>3W7?}`WiIVGsURd-M+ukAS3lFR~7%Is)JC%;J~MM43S#k*kN&xmmByPHRt zd#2CaZ}R9fqyey_LOYa>#$(x@5AO=m8e+U@X+#T@AW`_ZPk)$4AJK_`9f-co6BbnJ zfDBo_j3%b@t?;XKmejG+E^G)}Wi5Tj2AjUEOujS34La+EFjS;11IL{1FsO!JW zaCHkn%}2Ru>}|A2#^MjXqwR9+Sa0;PU1rxh7|-IQX3&S|fMn;>&-T^9_uTT+q|w%s zx6$LCLY1i}_oGto`j_CU#q>;+Y%5iN$OgDQ-p4c%V?{>HE@J3_H*ZoeTnUXhRq-96 zMB%Ig$?_g=i%YQTbKVg>-^cV@i>6DHtrSJWt8dMBId1lI+~J~&{T$2u=(Qp%QFxIb zUG1V*KiY#O^!~I!aqNk*2g$0x6(roUK)aT$3B@!QS)7 z*owfkwoPap#=U9bm7k(~1Hl_M5COVXhHeVGT)6bVc#q;Z`y3zR@SOm@vMf%@v}Xlx zmNi6b4c5y}*?FP0A(8+r(q4@3nhJP%iiIwta`JB+4GCatCjpYsjDSzM<1| zF*_CR&x*}#xL@z7?}m^oSRQxSVr%%(?Eb5wO$5E8c(?ifIZ3%BA|!f$1e^4F2!(pX zj~37P7{SXV_VUmLn4H$}w|Fnv6M}kF!zrSEL95%bQ#mb>jp8HQQ22j&lZ=vP)U+H$ z*sj~?^}1VzU-NuM68u@UpSI8Y8iRrN2P);tP*RlPVOC3XkvhpofP{T(19f-#5IAk1 zoe#6b`!S?Xa*l1ccN0)~d_gM|KEaBBqAqnbw_S`7>p2_B+%ALNt)IFucCh2YjUi^$ zaPp?3kgq|SVUKGMNKSKrvBFB%>?z)~>)_&*PX@rFO%(4ty;FNNcY=d;0cyM(dhdae zXp5*sQX=)quhe!<_U;zUb*=PGy}F;r4%s{G*9^_Kp@l^56mU9nF>z)XN)CV9%XaVQ zzV<6WZDl!z^rb}y3g@>us$MCnyNj~#-!lBc$@FhN9} ztfpX*r~vX4gU_6!p8;d^qwf2A(ZBtZjtxXDmgZ!us@jM_5tpN7oZY;Wsmx9YO|Rnq z{L4Z%_{Y`y8L*}%y;6#ZXr=VeG>nr87WXfpZ9(^Wy+e0a>CWbZS({W@>>m_gIsIX8 zF8ET*r21I%9w_iGp-Ih{;;x)=^QKohFKJ-gD_?B>uV(E zu?a{QleedL zI;OW>gZPTr>22GonS<0q4!Q}x3JS+>5aRT%dr=x1(`Cj&eV;d`f9@TlYN(U1q3)&w z`iU;zQsG+nAzif8wBQmc;)`*064=}ErpgSY_y*N zi}|^CH6(Z~hpQIcqa;4CtK>M1ivn)(x^alx{t|S5YQeJME#?%g%iSK z|G~9vEv-e#-r-(OVlOBP$8vOkvTlp(X$soeWX*5eZruxc;_NkJyr%`A)0{Ke!#t^B zVta$z!kc!7f=`Aw?F@zc?sa0R=q>`Pi(;JBG;A34;NnCrV!Vi6FT=TUm+HpRLEX!f z;8U=Pg7_>Id<71`FGf#O!HL56nD)tq=MD`9jIRtY48pV|8*cBTFmC&j-tX~FfViY? zad--9yPh)&-gDmUaL*ey(t=$mr0w;6_u|-R9H1QgVbkfHx;X}$j^k-1bcm0@%GiY@ zEFa{(f0%~OY+M9)8FYMeukx&9l2d8vlY$*55=??qdz=5ElxZ*`T}nJ%%F6$)l-S-) zJM;R!muiGfUS6#CN=`qv2V!TsNXf_^tU0`#j#s}+Xc~*iT`W_@4E<*A0v-2xMA6IM z^Dd;;uFcb(Bz1cf_x|7~@|hiOHT%$EJPV9y6CwQ^HRfCRn#g`QlYYI2Mxrx~<9Xnf z;7;glgQb2lo!UsacDj-9l=m1px-=x2pJn2T23QYHjZ-t%QxtgdI@3Pww~3Y>in-Em z^3G)2S*Hw061J((KJOh3ZFK3x&}(Oq8aW$*oVj~|2KwlNAd$u>c6f5t|F*k)a>h*R zImb}H+;$Rt?$p#K@-m!Z41(n|s&ELDlTQqK35_rR$FV0zPw{RagiM7H`eoZV{$~pv zc@#^9yz6+yKtDE*ZRpKx|9+@N4EvgGqVO?I{f&!;G6qU_by#rKTL?MKIP_S4P$o+e zB8>~%T=Z(zP=tuwCMSqB1Rq8YR=v^-Qbw4`fNB_e`KjTOD^`jqi z(SP-$KN##Nx!*-^_M>0)qwjLjfAFI>6V2xL%0~h_WmmG@{sikO)0w9v5At`j^(-&; z{xiIv9x6i3q&yiD4Kwoj1thAQ#}90zv?51kA*KT&j5!a4T?wF9%(_+Pl(dH2SVzqBT)}P%8JxC!#T=_&REdO`qxH2i0zI+_2q_N%mRHg91ll1r|FyF zBk4Boo8kDMWPCHcP}Ha|Ovb#Djgffg_{^0Fp-wc0=Z00^tu}!Cy~}99hReMe6v8S_+PFi+k*C_$Yxe6;U(Q+w9NS@2*gZc4Ms zd>IL`C%gNc_^ZJVW1M5X9Jwpgq}Wc~&EUc~nR5{3g~Wz9*N-mF3Fw<0gZp1$+>kN) zh`09VR^jMy_MG8W0`$OtRF#)kl}0WW8{Nqh27pnw!Mj}QOh8i!_IR^)`3K$`z%Iz@8SVAl(MA6 zKuZUH6f}xIllYDgk?%>4Vf~EeJ;(cy7ZtHn+=4|9UBQ)AoKqefP4n&Vx10XXIDKmH zd6%e9ebt)|2G^(T91-6SU%l;f%=lLCc{Tv$P~G*De4C!)KEqxeWCWPt3 z&D>SZERJhEba57EmGo7^=7Tln(Uu#u#~9G)sivD2nigS){{!{Ua$Uf8w-Tbd;HJgFieHREYs68QBOKR*(`T1|Q>MFw69T>jjEL5=X&; zww}}mshi&R3H4HkXGF3?R=S<^F>ip_lsWdSUE5VFFmcB-JXX4nQDr^+Zq=NH125%H z4_1jN1ZfoffQbWb6w5q)45Q;{Fj16$wK4i78wlb!S-#W!CG~=$9;p9){jBr5K_Z_; ztjT@FlGcizP#tL;i_ytm$JQmXEE$& zwKOMq-494N?$LesJ`h}W9!*gi+dA%nd-pvWT&)j6aS?w&Pr9BXyEs;wUCfQm+2Q#g z4${_?nz+^|D$OA-3_TC$s9*6lEf<}~XW)#I9)aR5tH)3j?#_{1$XV7(o!4CsWr@K* z=f_*8Q6Y!Z|6AH>C>i1g1+P1U9K|c{w~YAvQITSuHlaRV+&JNVXa6^3Upl0}w|xIM{q-i-i}0p2_MYw=!9|Ob-X9bz8J*kK z24Q7<#h9P-6aB~V!G=)z*!P3i|6V$D*cQ&|b1O#qun)O=;>h52qf`wDU)jFzoll+! zt~#U_UU2PCe)7(~;Hobh`~)!UTh)i9L_dn8PX<>P^;SWpd6b?Xp8s^XdTU8;Nmfx? z4%y1$w>Sb$JF_FnBjNIRG-qV_*pGtO4>f9@%cO=DmoLqVr8y;(G|J~_3CDe}e$O~c zNmD54nQ%BB9T4tP)T$$6hdOGk&|(b4&_l0DgN{Xv&WNjQE< z4sUbvgtQc{WJz|8rjo%*}rZ(ztekeSWqFSyFzfIO{evRvnNu&ukBShYHTT`rAoMa zIC@YC^R%knwpCCv?9)V379G)(2capo*VU>mTe<(}vlz?G*td93JnTI|7szBnyd)=k z97a`EaMc`gAn*52m0@^@+l5hF%U(VcewlmuQ(m@R4D44B+h6jIp#zogRTsx@&ty@r zK=Q=S2`}nCVIS2I2|JEjw(U^|iG%zd{#wv@VdKw1bpX`D=$N-2FnhRsBH!9`=B%my2KmuuGq&XJ*;yc=AN<{ z3Nmy^zGOU>)*;J5E*&z^MenaevNCnZv`dYrRs49&rHaYUiHRo(#K4PNl5-gQYY0VIr%nZ$NE3i(IGaeL-au8 zd*sLI5UM6oS<`xqEN`iDWF_Tot|-*5s^G5)qwp1ZHH>lCo!%> z@vNDSyWnE=wPhPY4q$5H>9EUDyOl3Mm=pzR=$y`YWGI)k2(pV zkaU)2y+<;4FmG5{mZfgHpNs5MsrvUzrHyKnJuHtQK@>VC`i*dt|QpKO|J-_D9J%?o+jiY|+DV3Ln%5i!R5ts=PO zG2WYe?D>RQ!q*ptLBZEpmV~?;Gjl8+<6WD2UYzGOreW@XH+Z}^gWuGN99!gH+dlNO zo9U55_gNUYMQ{%bvn}jxVUC6UEbMRL!4~FPc!-6AEIiD@JPVJo@JI`fwlHMjaTX4- z@B|C;TDdtaHNH!Ej-P_(=8lh;h7emZQ*zei!40X!V(K7S{SzQd<)AhywJi) z7G7-OB^F+4;ZzGRw{V(;Gc25G;VcVhTUc#jjfL|pthKPt!UhW)EsR>Y(89$QUTxu0 z3$L|sg@xByxXQxoEnH*a*DUs=-?i}j7XHA(br$~E!k=1r zhlT4c{Dp;TDdtaHNH!Ej-P_(=8lh;h7emZQ*zei!40X!V(K7S{SzQd<)AhywJi) z7G7-OB^F+4;ZzGRw{RL^dE%%DKgE;VhkiaO5LjC?8vCp5O^lP83PCRknj`2LK}!T} z6Z9=X4+y$j5FQ)tHTqh88_UM+H9G|{w`;FKI|kamE$A>oUl(+WAlzNsYsv&I7E~#y zPS8?8vjvSs^S51Y=>$y@G)>S%LEn*4d$yoE1&tPTpP+m}w+YM9f@B%A4HBfCg|>cz zUK11$^ogL4u*PbFsL-~z1!)G=_Nt&Ug0>5~K+qF{<_Ov>h+Dn_ZTAYgMUb49YMx`l z(Wb92*1Rj|`+~BW7q{Ic=ww0qtXj>vg02-bO^}?HY8DEbC+J2&GX?!r(4~Sl3Mv=$ zgrIW;?G`jf(7`OPwCMm`%}_x@1QiK7LeOkMxq{XR>MiI_L7%biRP%_S4+JFzd4hsk zBY8#8SV3}Hs+lF|Q9-K&=>S~Kj|JT==m9~$60}{=j|F`!=r%!eiEq16&=^6h1YIHM zYC+2cH3<5VplU&X5j0IuQqaYM`m_Gk78Z1>pz(r!Dc+wZXtSV`1pPx$NKl)g!vyL0 zcw2u#K^dPt1mz3b`x(&bg5DK$o}kwSO&6rkeAF}vdP>k5L0bgfF6cf%zY}zqpoavl z7xc8C9|(F?(9MG07xXnj?SfVa3QC?A3OY(qt)PB*F!?O%d4cWQe}&@qDKfm2f; z=s7`W3VK{nSkOa)W(d+5*qT~FzY!$o?zW!_`k|oj3SvSPXj?02tDx%zy(nm@proKi zL7xb!5!6pTd4?dZm9$+VXt<#B1r-S@67&^8rwf`TXtXs4iT zLAwQgf=g1(XM)}nbg(qnn}YNOleU)xeIn=?L48>UXxkjX^}^ld?vg1#>3DnZu?x>nF)K?y;1g1#?kwxBx&T`uTuL6Zb+6*N)M^McM6v`f%v zL3;(|3(8?dpzUZud4dKB8ZM}xpmBl%f-V&F5teNY*ZiXY1T_kJRnSU7+Xbx^^n{=v z3EC{^EJ`Y&9eM1?zP)>$d~nYmNANgEi8B617K|LwyYI~F!&#A@ z**&sJ!HRFj-^fv!@3VLx%6Ln8#hLGW@P1_H_g~3;-;?)6o!%FpJE5d>;(6h+^Dii` zxbUJ$U%7blB~vcFZ0c7pubfpiJ5oKTX70TCwF~O%8?I_>iZ(A?w0OzYBS(!s^|Zp% z&lofI;$w`yJGOz`?=XfrlJA zXz*cQ$~)ZQJ>ttp9(D9Fp<|Cbe#p=hPRt*6(#gXMMw}v&-24BZ!_UvSdMb<3RgIC# zXe1C>9Br(uiUw-uHbn!~b891k*>f8sRnhv!C4q&J##!}EkwAT2q(H9xs^&K}F9^(TUeHj$W1y;jK|^DtscCL~ogpn~YMwQ_zN#ru6RB+w zN_%6;Ya*4iBaJB%{DeGK)i%$L1W0&w1ay_Pk*2Ch0f`$xSU10*sd7OiP*-1&Dk;#= zSl>`Ex6Wm=hZK(4)T(jrtmdewnIDNX6hsyiHMee#duobAo9E8Xq`9E7aZZyl!mn7< z+&KkCiGbQjU0`-)w33<skm~$ekZ*_f| zWLnp6qJWswV0@&B>pe7oQoVhSM@9OF^YZ@li)}7gO=Ik@) z2l^FAOdNAVjghOG5x1rg2w;5k0;uTMIZ1P!2%b}iFw73sR5sOwqDvYg6ldvDRiS+k zfUJ(H1?F5mw;?c#V057N>IId7#a9RVT~af*DKxjPDOy=q6$#Z>TLov=N1EzRjE0)) zsF+^O4rLb6QS^lRy6W1wRT3qoSU^g6R#2dRloEMrH9J%=v?|op5UHA5JvTDjXihcI z0SNAQ0My{=4&MP%7i9FX?(z+78nJjmtu=IMV`F_|XwlqgO{lV|p%L+|&L7sV>#N4d zoaS0YAhI~sy=j9pQ|(}#^*|LWt6NxEJ9l=-B?4}axQrPke*to;(~(x`=k?#480Ok z*7~~ICF#8N2&p9#rB34JR7|M*dgqo$?+4{eA<}fePua!&v|5u4`rVA=jz)FXjunR+r)Mz!Y^II5Sd)>LQC6 z6Ej9j*KH4s8qcy2f{kWk`$3g#v5k?2%3S^2nMOnv~QIIxhtU)sM9M)kdGgDp2(q}4& zet`wE3vHN5n;MtYL_$Qmah}drKdY&}HWH1Pj5gKOH`mVYq){vDmMo}mj6ev3a2KJ<}95p(#ZPUYs zYuk*GMtvsTx-}6A(SrJg;x&otDx=M^;r!t(B_ZQRI>Ao~%=pkqYsSiG2wS)*%J`;+ zOBd?5R3**nS9x|QT5kmyq73z)W=V$G=y0nA3#v)KU@lV-=u4xr*bD1JG8>wNxV|CM zh=mRr8Ob~JUSAb(1eOkUWfSyZT+=0$=d7^&FA#9*!k&^TD1 zW}g?NrdiTLvXn=SIDNz@rP$AcAGvtw$T783`vv+IRE0YKO|TiFZ<||9l&Zi@9MefB zFF}1RSzt6BS5Sqv=v%Nj{ni1cZeZRImEQ|fsXL=uY^b8Cm;P@#_Vs>vWOQew>x?IA zc%-=MGSZ|g7qaPAjho4&rP(Q*%7qb_*Eb`Z1JQ*cX@!)0>X)hJ{1Ktc>Ko^$dP0?{ zyz1d88SEBShDOyusXjsD`bsU`H^5K#W0r|5>`%_*NYv&bh-b$5XH{_MeS1*~)zo2S zZMS$PR?e;UiI3QvpbC3CG<0rgZZ&f}l(3U$Y3ER7Ez&U?CA&X4vmz)6aWXPn#S|1| zDt#Du@!SRo(fHuc#XFQpe$y}`dqL%VI%%bbF|njuY9})fNU?TysG+ivXC~g_67v|k zibxn9>Xt$Zr;};&MiJ5zdU640elyIR3#W2uf0rE5@GTN{#8F&nKy`Dp?iDk;4< zls{{39TWRu>c$HynS<|73G>2w6NB_@HpEOYy`a)z5)ThCMUxIhW)^gZDRiPp7&-F9 z;XX7f4UIlA6p2=i2ra_eh@{goe0PUOGO1;iQ`8tLP-sUWU}-*AcWzbR!aiGLfTofE zfiaUxD|~(o@2+?(4)KuTPXh{dMGee}0ARh*m77>Yb1#t6rsmqHc+K1HP<60Wqr+`$q5!5yV;$nYWH?pVDw?%XcbU^{%j}^}au|p^WChhV*=JPd z2-Mk@2wjn~Gmo84VQvXxTn3iTgHvV!Hcl<Ypku0^~tC~c$D#j`%lM&43SrPOBDU7|C)x52n zW5uO2jq`DKE-+P;m0Kr;kftmYn$(ExI9ru*FJ#VChTJ-_zXaH~ps5S%FRDvP$ME!e zn(@MzBhr20>8^>b#u){WvA)|ug;JcluB^>020N40vUEw6v%8f-D@9{tW?f7J)uveP z|8_1WYKuM64aWJ}(Co;6og5j`!Q5~z9HFFz6 zvnsU^MawoVSum@f1Qj(VhsjftkpJ~Ytn5xWKOa8KXYRSB*xuKz+rF$DGtU#t@2gIQnTjA-JjJcW{ zPiiWeuh~SqQqvrNK6c=GrqnUw7;UVlr?XODU*)f%Ysp?LX9G=DV)9nYafkg!edCyw zCqYsUDMTNMZx5(*yOjf^Wp4DuZU<{aNyLXhL&kwJ=U8wex$a^7k!oF zZxkr^{|B;SwEuTfV&9W&L;u_ugj(j-vp zbJms_eJ5q!9Z(3m*eIkcnB7H3ch*hmCBzI8OkJg4XcnFEGPECkydR$4fI)FV?*Zxa zb%5FEsmi2BirFT%rolSxj38Dv!nz5G#9RDv#&AljX!lG;F-k?1PVYNvfZR_k_uDOU z8tlMg(w#QacGd8Z?N<#CX~SxGXz|qttaw^0DVr#)6j>R6U796>#BoAyZ89$-y}&QX zV{}=jtN;5Sw(6 z_56ZuM||Ab?5&}1$A>0eG`Vc5On|vnOiA|J&SM%Z1!assVDU^bWDzc^(J0_dB{=0e zR@YVWadn{!-D)i%yRnNAntpV(RW%2spGknmYFa2#xxnq{TQBh4FC3S`@LpC<2Zc_6O!_+93@mYR zZEd~wk<$It%sg8|O7~qv*aXn>XE=BWfs@@YklF)QMIFX1T%l4C6xAz5g=>dQ{}HA$ z<3kfA+=|soiR%!)dx<)nkIkse^fozAR^J(=Yt~HP6e@U;c6JMKFkG_X%Z_Ukw$jAO#f+u(8LUZaTmqVO-D}eI-ybYH(5LN`80)freRvZ zGeqh2kBl|l1F{Rbm=j@M1iO6o#iAPPLVg)tM?h8yY~yQOol_T?ORZelg}_iP={V@8 z(}F#1W$m|YsPe2L`vo0KR~cS1wr7;FDW@rmBYFRgC`ZZx2r04M&@$|qjHQ+CXwi}g ztGA(0rV{bDQfvmZ|DM*Y?iaQ+X+YC6y$a>4jeIkD*l_LhrKUmdw`0E39Z4uuurLFH zs07jJ2YLEUVZ&2w;$#tRgne_>+DbotB;ULX?KW} zBD2S3@RnuK>bZ;kDG?8B39(VrZKGFo_47ceO?Xo>-7UQx^6FOhQ}TB}2~00>ors}p z?rPmt$)r)cco3oLVG6_S3nM57G`D$b`Lp=c#)MyRd1}3gj>v2i;gR)}vCb?R$k3o5 zKVbR3)}mnX1_Mz1qmSBVUPuLywn0<8{EsxH*B;e2jr9y; z6N*jI>)F-yfEAk1vF7g^c?+5;8}`!H-E07KE38%_Y~f5##&K3Px%G78^f>N-^w{!c zmHHbEOK)v*yNFFzpN>u8ae6)=5|%1iW0z$lTdN5J%XJLfBkfSFlWVX%5b7q|Dz!E+ z?^W;?)N~{>D03V;&h56Ey1(>`)6qlZ*6KzE{~?vbt>Ds^=zFPGzLSSEqfd(VjRS7i zO-7OWPihXapmNUKsxwpQGJe^+T^tI?H0|zfXej2XU*P`l^>Tvm2TBuMa?u2~QtIYJ zYm{_oZ7r{-Fb#6Pyj>Ew*UB=XCgMEs(kpgkA38e}$RFCoc2@pHmxS3|I+;Cap8mrI zx%R0?_=(J36%SH2j9y+mxfq)Kbu^!(suTe>MkJ8R>`x;L+)6+oy`UOMt)m8LQdS?Upit(r6drp)p{nM_My&UaHFmKz zm7uDIRdl5k-HtmruvwE)bt4%28&!EqpwyhA#gUG*tU@co(sjh9StqTKHdP&Vw(C;< z37L#dzpSdQH>ZhCS-A&oLfY|0*&)HYX;Y^dVcU6BoK>V)HqGiQ_>KqD~ysBf&DolzIud!rPYIb!&{ z4CO}}8|&&rGh2SiDPCGBDrg9p>&nJYm$p+={z2Fl_cG%93P%1uuUVTr;KTJHsIf-6!-j*yJ4d zYMjH|GIX>a#kzpazXRq}5&P$c)pKBzb|Rfmd-DMiAipdL;`bCPy=Wq-jA>@^n+$3G zFP2cPF0^a;Hot3bS3N&NNFJ9;mPV)MJ!Qm6e(Ue&sZB>@gPC&->7^!jI>QM|S|Mm< zlXVm(JQ`Dx58sCa!#T*p`JYJH~ag9_@~#MY}tj*;z|=Y!D5{Re%G6=1>v-ghPxlhGTLHaluUm zq0}KhprkaYgt~^3R0Wdga9R)!;NJV*eKWg~*0iTRIX$OuEbE(l@B97czMpyXX5@EO zoU(G!BJg%nAq&{6Mllhw`IZ(%BXk#u_o2#Nl?g9#PR}CCCvPw1`zV4gP6(M({TEcy zcmlMM3W~*PF*gb;3Mv=HURI;LB0*ef%C%aX%pzP~=k|eqKT^F34?pDiPeefG@fDy_9zi4pP@GqX^YJ;CF!}@;j&A~1IE}y{bG*oL{y2esGjiM4~TDX|Y9Yog6G+htc9;$9|u;>agP_W5*wPWNw@$*2NpR~JP`m-e5yTqW1(eKoDg7JF5N1Qu`?#xGL_8&Zfpxv%P+kKTMza;n12$VV9NPfG8SI| zbSokEDB>o+c$7|MXdI?2krd4`uqb}q;%kc_Wv5c;b26rAFxfG&7=E^@iDu0|#uhV@ z5-mgg%3_38IK?h7RV8%J7Tl^7_xC8w_g`8mmi?%hJNT^rSJIGgwvC&B$ekl$&ttLg zxk6IsCoepl7*<6@`mmHV`}5*?H{E_T(Io%-(X!hUB|)v;%O=~GD1SMlCs)iJ;T@|Z zhW#5Ut8pOo;&X%|a2Af6@r)@d`GaI=cLc9^hc_oFVRVUi) zI%d}(Z`I4LpkgAcyULn|VbwONMvSSO4lQVB&&6nmU@_ep+O(O&zb-VG=7z%zh$$R` zDgBa)#j!I4r|ps)!DmADYgwg}LGpHLrF2x+eR)koaZTOErZx3zYF0JX3GKK!aaO9r z@2IHwnhhRx4YlK<(>>YR1^$g$j9<;dE~_+|iDPf$;MP5{+(HkNCJ2dLpNma$Vk1wf zq~BrWOtL+R_eywHy{dM>gd31K2$T}R=wxM>Myibawnb%&%N8xdTPBgr`28WcaM&Ib z-4I?vbt@=4dfc-urY1BR`J<`YAeUuT14Ox881q7>aUL$FL@Jq*C{#en4W%WC(voOX z$?D3I^_3-?w(-mb33OxlW*XN5=WnVKJPqS}tE_gU=5unMD4sm4K133Eh5)M69E6&V zngHM;2)RDa$;9|c(-4|=$>$l|#Bo&&9hH~4a22Q|hOu})HbHSHd4Fdi2gH3ERy$>i z{?0p$E97WU(TOjGFRfU#tOB;K+8Ex@*c8Uqf||9PHm@&M>rV7=gSVH_z$PDc;VmuB z=;+=8a5~EuglZw@N&b8k#{l`T2)DLZz~-iU{Il`MEFkSrRtB5cD{%Kb&7Nq`#0yha zR*t{%hyGzOlFG%oS3kZn3zL6C_7mdHQu+F*U#tDwE-9^*&3v z(MsDHCt}rO$|9pMR&8v`3Cmdt7wg^Jl&9DI746S1>Yyb+vxt?~U}p7~o@ zr5RTgoTsJf{SBN3(reaomd|^JvO5pJL8H?jkJ4Tv5dNOO8AQuUGT`~9eDi`9s>J0K zcMfZad;LC4nG>k(_+{D-7abR{D>{{GCBu>{P67qF#A+1W$a}II3A!U9YSI;PT zjkkoD<+Rv*5~&uMUK4(P0ADW`fmg?{{U>3Q_{_j6IZcSN=x4@enVl3G?9EAf5{)-! zqNLOf;r*G3^IE=9#b?xF4lA5m?ym$SSDuw8%o}aT6Jog90?m%yj%C4feCL=}JlUMI z@oFxyf$q2QnI+%`5^TEoA~^oW=f#Q2;)u885|7{nL+rH_g`2>PZ#2_Z%n8jhvMBJ_ zn2|P$C`<_)8gb6|o(;FR`1H=@=KzyMxIWKow8YS%-_l8CvVd;YBrL z`Q{f+ue_El!}@uNT>@Tk8ZT6vPqeqhT5|dxuaCig4&O}@?JSE*FI9CIKJ#iGD(=u&)pc zOLPCYxMB0Ub)Y6HiVrF``kP`|JS)OZtQl|N+U1@el+q~Rw;^zi!?h@R+%)1qt7B(U zkPt4jX!+F@r4@_tr>UZ%Qv7TiKgsYk#cJ9yrVpciOF1gq(FB*=UI=MijY+xa$9T+#`KJq=wfZ)m37^Gd4ozVV!8_2~79 zl$oS8r|c51UAm-rE&4<;$L8syUtJuKMU52^I0-1nLeL#Oq*C|=k1Llgr4t;gb**Hz>Dd}|^2$y$KvjS$?`2*xY;;X1ns0)Nv4 zuy8XJ6mNmRSGM5Cwi6J#%7);#ZGe**2yWO3aHs=}fewtj2aKiorMabhp%5OpF=Gy>v z_CjdVePA@)2cbLegM!~89{di5xgSCY?g#j@hoRu2J_w!e1LK@WAh6*PFt$E|mD`Vb z?T5f2#FFm5Fb8(bw`}~80sIx^7TV- z%Hv?ne;lCxAQ;X;2t0KVg75^uFP?zFqC;TZeh303PXavfBn0L?h2?n~LI!>n&pZl& zzdZ`@>j5m&3jpuE2!Z+^0o?a8gue850Jj~3z>kjMb$SH~_WcClwO7HI^BTa+K?p_% z!Egrw{^9Q-5PThA#T#I(djsGN#0^9EA;Euy(402`t~>$32TmY=Z$s$l+W^0O4~&c6 z$3MjP5frTZ7=rsg2IIAl0iGU(;G9pO;H^)vET_OookA!09T+oz2XF!rK83)wp8~X> zhQQmWA^27N*3iAEP6dq6=K%x0QD7Jc(B*zR$q39k%YfN4@Ow-D!{ciF`kygD8WGlA zlgHl4_WC?_m+foWJ~odQwm0Un*RXwCp7hbp#nGI{9%s9g$G(B>d-CM3%DXR*J<9R# z%43&J9N_*u`3E_Ee;#`q+n>y1$8X4qeLCA~^5l^OvqYUN-D?CzLXp9K9(yl%+(*dK+2Cim|LzkmXAN2tN$v?r{B)i zzs&NB@8;?&S^fdnt9HM%PhnnEJ=A;vx}-*p|4=36)Hk@?eNygJGCSB_B^OKkT}s{| z!Z>AbF7IRW)3RnjGoTsJ z3}^;41DXNNfM!55pc&8%Xa+O`ngPv#WGy|Fe z&46Y=GoTsJ3}^;41DXNNfM!55pc&8%Xa+O`ngPv#W*JX7?&|tGp=LY!nlL+M#f()lIe~xo?;9wmij+noXvPC z;}wic8LJqtV{Bsl8e}UKw<59+!83!5P zWPF$LH;kiU z8yUAVwlJm`cQf9~cqd~o<9^0NjL$L-Fuub0I^zk(Va5*`KV_VBmE>tU;~d7z7|R%! zF;+9KW8A{HgYia2m+>aXZpM2UA7DJdc$o1y#+MjhWgKFBhw%f(j~Id9i!NfE#prUo zzKOA$@gBwp7!NQWW_*tECB|17hZx^s{DAQzM&SOUh;bI<#fUw+{PGX zOfq&d{wd=fjQ2A3F&%I`y8!}v$|Z5pzd zGd}-aDQBLLcs}bdVaz-u^`$?MsPerbB-2;&5Poll($$A%Kr^5j&Gy|Fe&46Y= zGoTsJ3}^;41DXNNfM!55pc&8%Xa+O`ngPv#W zGy|Fe&46Y=GoTsJ3}^;41DXNNfM!55pc&8%Xa+O`ngPwg@0WoYmsWL^%}y=bT+=nR zaPz7yHL1eX>{Q{#RsO%GRb6MH@=xZ$j;D>9?WmAF2>z(;M=T(Kn z;k0W;+QX5y_Hb*)bfVBTc$yERN7|#7i=XbQSgpV$v|PDqOv7akzPRjh#q2RyqwmkS-jjt)p}xJ$;;EO)}<^WwvLjwIW$b z6;Gh&#O6<6Qpr`!stVU_X$;rKTCKEOA4{6?u+>Q!Ez7Y`cs5k!7&fP(rfX4z)vRA% z8?I^E8g3zyQQerUPKf$#%~d9?4hp)%*QR5;MeH_T%z%cba6aMX?7W;YOHJ6v}s*9Mzx4IyHc)Awr&IcVRKXcvL-v0w&SL|h_pS1 za0~K?wA&tznodVdB-JYoW;$&-ZrE{!vQH|TcUz7~vtP>SF}6dg9hP!B<;0S13nfb0 zBdqmYuf>eT$uK|$v)OjU#XcsaNZccH&{x=ruxoXSU_(kvlvqjE*+og6%+|KV;)0-I zrA%W`r5sU8*Y?sJ6*?|9CD#?8l3|w854%ZhHq(}(zK0YMGak1i6uei6ZPA!up-)OJ zakEu8e!r9xw(y3-QnEV)qep}kx6`7)1A%j@!chxjN-sN>C9{7IW~qdqQvO4f3g)hg zcamgP_+b)SBC2#FEOK#1rKn2K6%>J!uDC$mLbB`@%A`jM>RR^-(N0;?GlV3sI|c5S za>f<>99ELxxQysw*eR%=X@zDLQ)om947 zC1#|#kL6Z}!}og%yjB$BFe|WI4ae;ycCpxCSeNSHKm(qF(>=xtHnA_*3@>xfN53K8U+GT3CJI1sSqh-V=cg&puTmYLp_ zoyxHZE#ZWf$fV6y5qZ!LBFCj6Pa#T11DPe9;G}23`0-c*`&qUOQ|%I7zc3<1D-mfE zRT))c0>@PBWF}Eyw5G)6>lR`=cOpGfYKgUop0-ztN!f?=Nh$4GGNpc!RZ~1nLdxrt zj|fq8$bupvW?az{kCC7n;-C`Zd?|-mp?bNKQf{S@n35W1*~@A~DLO6D>_=Hvqhr@u zm>n{e)1X-Axl4~wB>k?WS186fOrKOb%xu3BWyub+7|n=+9%0cd=m0BPsA*7DjKTvHBlc=&jqJ&mq8z3>0Fw>&79urbhr86i*iYeSuNI@ja!b$Vw8i` z#v(2Ur5bci_9w4RIPh=8o?3PX-D50Yq25}wt{%3mHq&jZqR~1vHR#RK`=##7(yB7| zXX)12cDwYR!>nzvI;bcz!+M-zsL}SwL;==Y30qE02G}g?P;WbHHVBs+tM+3IvdORc zD(ul?%^BCKu`@~GfYPrQ5o@y(qfC3phrq_%#MA1&aaNy{{&63vm z-(!Cfb8_{srH_X9;g2^6-+iyk+IgUgQw?a|P}{xv1=o!0wA43QWIn<;GtaTee-=*%6)hOyH35&EW2rLw&(hQ=^|2911kw zAKd;M<6~p@^5;X{#*Zg0EG(QpYHXZ-%J?Yw^|Ir^4+1l8H)b?WD|#VtoAF%1 zKL<)z_7wCOkI!88*_0QGx{X+65gyZuirz6|jZXUfqPvY5EiKc|z4p;ScWA|mJl@gsErje!tseGp(egrMSb11>`hp>-wxudXu-_zDdm>i?Pp?E~5e ev=98>^a1Rm0UR^xRF;=twRF*vtClPlD)>(tB$v_v literal 0 HcmV?d00001 diff --git a/build_tools/mac_sign_package.sh b/build_tools/mac_sign_package.sh new file mode 100755 index 000000000..12d4272ee --- /dev/null +++ b/build_tools/mac_sign_package.sh @@ -0,0 +1,122 @@ +#!/usr/bin/env bash + +# This codesigns a Mac .pkg (installer) file. +# Normally we could use `productsign` but that no longer produces +# installers compatible with 10.11. +# See https://github.com/fish-shell/fish-shell/issues/7656 +# +# So instead we use the flow described here: +# http://users.wfu.edu/cottrell/productsign/productsign_linux.html +# +# This script expects the following: +# +# 1. A variable $MAC_PRODUCTSIGN_CERTS_DIR pointing at a directory containing files cert00, cert01, cert02 +# 2. A variable $MAC_PRODUCTSIGN_P12_FILE containing the "Mac Developer ID Installer" keychain item, exported as p12. See below. + +die() { echo "$*" 1>&2 ; exit 1; } + +# Exit on error. +set -e + +# Our input package file. +INPUT_PKG=$(realpath $1) +test -f "$INPUT_PKG" || die "${INPUT_PKG} not a valid package" + +# Find where our mac_xar_116 binary is. +XAR_116="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"/bin/mac_xar_116 + +# Here's what we need to be set. +test -f "${MAC_PRODUCTSIGN_P12_FILE}" || die "MAC_PRODUCTSIGN_P12_FILE not set or not a p12 file" +test -d "${MAC_PRODUCTSIGN_CERTS_DIR}" || die "MAC_PRODUCTSIGN_CERTS_DIR not set or not a directory" +test -f "${MAC_PRODUCTSIGN_CERTS_DIR}/cert00" \ + && test -f "${MAC_PRODUCTSIGN_CERTS_DIR}/cert01" \ + && test -f "${MAC_PRODUCTSIGN_CERTS_DIR}/cert02" \ + || die "MAC_PRODUCTSIGN_CERTS_DIR does not contain cert00, cert01, cert02" +test -x "${XAR_116}" || die "mac_xar_116 binary not found or executable at ${XAR_116}" + +TMP=$(mktemp -d) +KEYFILE="${TMP}/key.pem" +DIGFILE="${TMP}/digestinfo.dat" +SIGFILE="${TMP}/signature.dat" + +set -x + +openssl pkcs12 -in "${MAC_PRODUCTSIGN_P12_FILE}" -nodes | openssl rsa -out "${KEYFILE}" +test -f "${KEYFILE}" || die "openssl did not create key.pem" +SIGSIZE=$(openssl dgst -sign "${KEYFILE}" -binary < /dev/null | wc -c | xargs) + +# Prepare data for signing. +${XAR_116} --sign -f ${INPUT_PKG} --digestinfo-to-sign "${DIGFILE}" \ + --sig-size "${SIGSIZE}" \ + --cert-loc "${MAC_PRODUCTSIGN_CERTS_DIR}/cert00" \ + --cert-loc "${MAC_PRODUCTSIGN_CERTS_DIR}/cert01" \ + --cert-loc "${MAC_PRODUCTSIGN_CERTS_DIR}/cert02" + +# Create the signature. +openssl rsautl -sign -inkey "${KEYFILE}" -in "${DIGFILE}" -out "${SIGFILE}" + +# Add it to the archive, in place, then move it back. +${XAR_116} --inject-sig "${SIGFILE}" -f "${INPUT_PKG}" + +# Remove all our junk. +rm -rf "${TMP}" + +# Check the signature! +pkgutil --check-signature "${INPUT_PKG}" + +# The following is taken from http://users.wfu.edu/cottrell/productsign/productsign_linux.html +# Saved here for posterity. + +# Signing a Mac OS X package on Linux + +# Premises + +# You are a software developer who's at home on Linux but you want to produce builds of your software for other platforms, including Mac OS X. +# You've already figured out cross-compilation. And in regard to OS X you've figured out how to build a (flat) pkg file on Linux – or if not, you can do so quite quickly by looking at the bomutils doc: https://github.com/hogliux/bomutils. +# You are grudgingly willing to pay the Apple tax (the fee for becoming a registered developer) so that you can get a certificate with which to sign your package, in order that your gentle users don't get off-putting messages from Gatekeeper. +# But you're wondering how to sign your package without having to use Apple's productsign on a Mac. +# If you match on all points, we're in business! Here's the drill as I have figured it out. You will need: openssl, recent xar (see below), and one-time access to an actual Mac. + +# Procedure + +# Step 0: Build your program and create an OS X pkg file (xar archive). This you will do (on Linux) whenever you want to create a new release or snapshot. + +# Step 1: This is a one-time step to be performed on a Mac. There may be a way around it, but I'm not aware of one. Please let me know if you're cleverer than I when it comes to certificates and all that. But anyway, follow the Apple directions for installing your developer certificate(s) on OS X, and use productsign to sign your package on the Mac – just this once! (Copy it across from Linux.) And then, before leaving the Mac, open Keychain Access and find your developer cert, the one with "Developer ID Installer" in its title (it should have a private key tucked under it). Highlight it and select "Export items" under the File menu to save as a p12 file. Copy your signed package and the exported p12 file (let's say it's called certs.p12) to your Linux box. + +# Step 2: Back on Linux you're going to need a reasonably recent version of xar, specifically 1.6.1 or higher to support signing. Arch Linux installs xar 1.6.1 if you do pacman -S xar. Fedora's dnf install xar gets version 1.5, which won't do the job. I don't know about other distros, but if need be you can find the source for xar 1.6.1 at http://mackyle.github.io/xar/. Anyway, here's another one-time step: you'll extract the certs you need from the pkg file that you signed on the Mac, and the private key from the p12 file you exported from Keychain Access. (You'll need the passphrase that you set on the p12 when exporting it, so I hope you haven't forgotten that.) + +# I'll assume (unimaginatively) that your package is called foo.pkg. + +# # extract the certs from signed foo.pkg +# mkdir certs +# xar -f foo.pkg --extract-certs certs +# You should find certs00, certs01 and probably certs02 in the certs directory. Perhaps more. + +# # extract the private key from certs.p12 (requires passphrase) +# openssl pkcs12 -in certs.p12 -nodes | openssl rsa -out key.pem +# At this point you have the materials to sign future versions of your package natively on Linux. I'll now assume that a new unsigned foo.pkg is sitting in a directory containing the key.pem generated above and also the certs subdirectory created above. So now (with many thanks to mackyle!) you do: + +# PKG=foo.pkg + +# # determine the size of the signature +# : | openssl dgst -sign key.pem -binary | wc -c > siglen.txt + +# # prepare data for signing -- may have to adjust depending +# # on the contents of the certs subdir in your case +# xar --sign -f $PKG --digestinfo-to-sign digestinfo.dat \ +# --sig-size `cat siglen.txt` \ +# --cert-loc certs/cert00 \ +# --cert-loc certs/cert01 \ +# --cert-loc certs/cert02 + +# # create the signature +# openssl rsautl -sign -inkey key.pem -in digestinfo.dat \ +# -out signature.dat + +# # stuff it into the archive +# xar --inject-sig signature.dat -f $PKG + +# # and clean up +# rm -f signature.dat digestinfo.dat siglen.txt +# From this point on, just build your package on Linux and sign it on Linux using xar along with the certs and key that you got from the Mac. + diff --git a/build_tools/make_pkg.sh b/build_tools/make_pkg.sh index 326c8d7af..ad3fd4f44 100755 --- a/build_tools/make_pkg.sh +++ b/build_tools/make_pkg.sh @@ -17,10 +17,9 @@ set -x #Exit on error set -e -# Respect MAC_CODESIGN_ID and MAC_PRODUCTSIGN_ID, or default for ad-hoc. +# Respect MAC_CODESIGN_ID, or default for ad-hoc. # Note the :- means "or default" and the following - is the value. MAC_CODESIGN_ID=${MAC_CODESIGN_ID:--} -MAC_PRODUCTSIGN_ID=${MAC_PRODUCTSIGN_ID:--} PKGDIR=$(mktemp -d) @@ -31,7 +30,16 @@ mkdir -p "$PKGDIR/build" "$PKGDIR/root" "$PKGDIR/intermediates" "$PKGDIR/dst" { cd "$PKGDIR/build" && cmake -DMAC_INJECT_GET_TASK_ALLOW=OFF -DCMAKE_BUILD_TYPE=RelWithDebInfo -DWITH_GETTEXT=OFF -DCMAKE_OSX_ARCHITECTURES='arm64;x86_64' -DMAC_CODESIGN_ID="${MAC_CODESIGN_ID}" "$SRC_DIR" && make VERBOSE=1 -j 12 && env DESTDIR="$PKGDIR/root/" make install; } pkgbuild --scripts "$SRC_DIR/build_tools/osx_package_scripts" --root "$PKGDIR/root/" --identifier 'com.ridiculousfish.fish-shell-pkg' --version "$VERSION" "$PKGDIR/intermediates/fish.pkg" productbuild --package-path "$PKGDIR/intermediates" --distribution "$SRC_DIR/build_tools/osx_distribution.xml" --resources "$SRC_DIR/build_tools/osx_package_resources/" "$OUTPUT_PATH/fish-$VERSION.pkg" -productsign --sign "${MAC_PRODUCTSIGN_ID}" "$OUTPUT_PATH/fish-$VERSION.pkg" "$OUTPUT_PATH/fish-$VERSION-signed.pkg" && mv "$OUTPUT_PATH/fish-$VERSION-signed.pkg" "$OUTPUT_PATH/fish-$VERSION.pkg" + +# Here is the historical way to sign the installer package. +# But when run on macOS 11.1, the resulting installers don't work on 10.11. +# So we have our own script instead. See issue #7656. +# Also see https://developer.apple.com/forums/thread/664842 +# If/when productsign is fixed to support 10.11, we can switch back to this. +# MAC_PRODUCTSIGN_ID=${MAC_PRODUCTSIGN_ID:--} +# productsign --sign "${MAC_PRODUCTSIGN_ID}" "$OUTPUT_PATH/fish-$VERSION.pkg" "$OUTPUT_PATH/fish-$VERSION-signed.pkg" && mv "$OUTPUT_PATH/fish-$VERSION-signed.pkg" "$OUTPUT_PATH/fish-$VERSION.pkg" + +"$SRC_DIR/build_tools/mac_sign_package.sh" "$OUTPUT_PATH/fish-$VERSION.pkg" # Make the app { cd "$PKGDIR/build" && make signed_fish_macapp && zip -r "$OUTPUT_PATH/fish-$VERSION.app.zip" fish.app; }