From 11555fa551b240fd130613ea7a4b765212f6f4f3 Mon Sep 17 00:00:00 2001
From: emancipator
Date: Mon, 21 Nov 2022 17:28:13 +0800
Subject: [PATCH] fix CVE-2022-45047
(cherry picked from commit 7cf5e7e4c84936deedd907a0dca7f331ba5b1fa4)
---
...ependency-on-native-tomcat-APR-libra.patch | 28 +-
CVE-2021-30129-1.patch | 1116 -----------------
CVE-2021-30129-2.patch | 161 ---
CVE-2021-30129-3.patch | 408 ------
apache-sshd-2.2.0-src.tar.gz | Bin 1280311 -> 0 bytes
apache-sshd-2.9.2-src.tar.gz | Bin 0 -> 1743627 bytes
apache-sshd-javadoc.patch | 241 ++++
apache-sshd.spec | 19 +-
8 files changed, 265 insertions(+), 1708 deletions(-)
delete mode 100644 CVE-2021-30129-1.patch
delete mode 100644 CVE-2021-30129-2.patch
delete mode 100644 CVE-2021-30129-3.patch
delete mode 100644 apache-sshd-2.2.0-src.tar.gz
create mode 100644 apache-sshd-2.9.2-src.tar.gz
create mode 100644 apache-sshd-javadoc.patch
diff --git a/0001-Avoid-optional-dependency-on-native-tomcat-APR-libra.patch b/0001-Avoid-optional-dependency-on-native-tomcat-APR-libra.patch
index 6006344..f1a3b44 100644
--- a/0001-Avoid-optional-dependency-on-native-tomcat-APR-libra.patch
+++ b/0001-Avoid-optional-dependency-on-native-tomcat-APR-libra.patch
@@ -14,9 +14,9 @@ diff --git a/pom.xml b/pom.xml
index 867ca88..7c29678 100644
--- a/pom.xml
+++ b/pom.xml
-@@ -397,11 +397,6 @@
+@@ -428,11 +428,6 @@
mina-core
- 2.0.19
+ 2.0.23
-
- tomcat
@@ -30,19 +30,19 @@ diff --git a/sshd-core/pom.xml b/sshd-core/pom.xml
index 6171c5c..73a43a7 100644
--- a/sshd-core/pom.xml
+++ b/sshd-core/pom.xml
-@@ -44,12 +44,6 @@
- ${project.version}
+@@ -43,12 +43,6 @@
--
+
- tomcat
- tomcat-apr
- true
-
-
-
+-
org.bouncycastle
bcpg-jdk15on
+ true
diff --git a/sshd-core/src/main/java/org/apache/sshd/agent/local/ProxyAgentFactory.java b/sshd-core/src/main/java/org/apache/sshd/agent/local/ProxyAgentFactory.java
index ab19539..5757e68 100644
--- a/sshd-core/src/main/java/org/apache/sshd/agent/local/ProxyAgentFactory.java
@@ -54,24 +54,24 @@ index ab19539..5757e68 100644
-import org.apache.sshd.agent.unix.AprLibrary;
-import org.apache.sshd.agent.unix.UnixAgentFactory;
import org.apache.sshd.common.FactoryManager;
- import org.apache.sshd.common.NamedFactory;
import org.apache.sshd.common.PropertyResolver;
-@@ -53,9 +51,7 @@ public class ProxyAgentFactory implements SshAgentFactory {
+ import org.apache.sshd.common.channel.ChannelFactory;
+@@ -51,9 +49,7 @@ public class ProxyAgentFactory implements SshAgentFactory {
@Override
- public List> getChannelForwardingFactories(FactoryManager manager) {
+ public List getChannelForwardingFactories(FactoryManager manager) {
- return isPreferredUnixAgent(manager)
-- ? UnixAgentFactory.DEFAULT_FORWARDING_CHANNELS
-- : LocalAgentFactory.DEFAULT_FORWARDING_CHANNELS;
+- ? UnixAgentFactory.DEFAULT_FORWARDING_CHANNELS
+- : LocalAgentFactory.DEFAULT_FORWARDING_CHANNELS;
+ return LocalAgentFactory.DEFAULT_FORWARDING_CHANNELS;
}
@Override
-@@ -106,16 +102,6 @@ public class ProxyAgentFactory implements SshAgentFactory {
+@@ -104,16 +100,6 @@ public class ProxyAgentFactory implements SshAgentFactory {
}
public static boolean isPreferredUnixAgent(PropertyResolver resolver) {
-- if (PropertyResolverUtils.getBooleanProperty(resolver, PREFER_UNIX_AGENT, OsUtils.isUNIX())) {
+- if (CoreModuleProperties.PREFER_UNIX_AGENT.getRequired(resolver)) {
- try {
- if (AprLibrary.getInstance() != null) {
- return true;
@@ -103,5 +103,3 @@ index 5395ceb..f456263 100644
--
2.20.1
-
-
diff --git a/CVE-2021-30129-1.patch b/CVE-2021-30129-1.patch
deleted file mode 100644
index a6148be..0000000
--- a/CVE-2021-30129-1.patch
+++ /dev/null
@@ -1,1116 +0,0 @@
-From 68c780f2e746eedb714ff6e17c6815fbffddeff6 Mon Sep 17 00:00:00 2001
-From: Guillaume Nodet
-Date: Fri, 17 Jul 2020 11:33:21 +0200
-Subject: [PATCH 1/1] [SSHD-1035] Move property definitions tocommon locations
-
----
- .../java/org/apache/sshd/common/Property.java | 408 +++++++++++
- .../sshd/core/CoreModuleProperties.java | 681 ++++++++++++++++++
- 2 files changed, 1089 insertions(+)
- create mode 100644 sshd-common/src/main/java/org/apache/sshd/common/Property.java
- create mode 100644 sshd-core/src/main/java/org/apache/sshd/core/CoreModuleProperties.java
-
-diff --git a/sshd-common/src/main/java/org/apache/sshd/common/Property.java b/sshd-common/src/main/java/org/apache/sshd/common/Property.java
-new file mode 100644
-index 0000000..f5ad335
---- /dev/null
-+++ b/sshd-common/src/main/java/org/apache/sshd/common/Property.java
-@@ -0,0 +1,408 @@
-+/*
-+ * Licensed to the Apache Software Foundation (ASF) under one
-+ * or more contributor license agreements. See the NOTICE file
-+ * distributed with this work for additional information
-+ * regarding copyright ownership. The ASF licenses this file
-+ * to you under the Apache License, Version 2.0 (the
-+ * "License"); you may not use this file except in compliance
-+ * with the License. You may obtain a copy of the License at
-+ *
-+ * http://www.apache.org/licenses/LICENSE-2.0
-+ *
-+ * Unless required by applicable law or agreed to in writing,
-+ * software distributed under the License is distributed on an
-+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-+ * KIND, either express or implied. See the License for the
-+ * specific language governing permissions and limitations
-+ * under the License.
-+ */
-+package org.apache.sshd.common;
-+
-+import java.nio.charset.Charset;
-+import java.time.Duration;
-+import java.util.Arrays;
-+import java.util.Objects;
-+import java.util.Optional;
-+import java.util.function.Consumer;
-+
-+/**
-+ * Property definition.
-+ *
-+ * @author Apache MINA SSHD Project
-+ */
-+public interface Property {
-+
-+ static Property string(String name) {
-+ return new StringProperty(name);
-+ }
-+
-+ static Property string(String name, String def) {
-+ return new StringProperty(name, def);
-+ }
-+
-+ static Property bool(String name) {
-+ return new BooleanProperty(name);
-+ }
-+
-+ static Property bool(String name, boolean def) {
-+ return new BooleanProperty(name, def);
-+ }
-+
-+ static Property integer(String name) {
-+ return new IntProperty(name);
-+ }
-+
-+ static Property integer(String name, int def) {
-+ return new IntProperty(name, def);
-+ }
-+
-+ // CHECKSTYLE:OFF
-+ static Property long_(String name) {
-+ return new LongProperty(name);
-+ }
-+
-+ static Property long_(String name, long def) {
-+ return new LongProperty(name, def);
-+ }
-+
-+ static > Property enum_(String name, Class type) {
-+ return new EnumProperty<>(name, type);
-+ }
-+
-+ static > Property enum_(String name, Class type, T def) {
-+ return new EnumProperty<>(name, type, def);
-+ }
-+ // CHECKSTYLE:ON
-+
-+ static Property duration(String name) {
-+ return new DurationProperty(name);
-+ }
-+
-+ static Property duration(String name, Duration def) {
-+ return new DurationProperty(name, def);
-+ }
-+
-+ static Property durationSec(String name) {
-+ return new DurationInSecondsProperty(name);
-+ }
-+
-+ static Property durationSec(String name, Duration def) {
-+ return new DurationInSecondsProperty(name, def);
-+ }
-+
-+ static Property charset(String name) {
-+ return new CharsetProperty(name);
-+ }
-+
-+ static Property charset(String name, Charset def) {
-+ return new CharsetProperty(name, def);
-+ }
-+
-+ static Property object(String name) {
-+ return new ObjectProperty(name);
-+ }
-+
-+ static Property object(String name, Object def) {
-+ return new ObjectProperty(name, def);
-+ }
-+
-+ static Property validating(Property prop, Consumer validator) {
-+ return new Validating<>(prop, validator);
-+ }
-+
-+ abstract class BaseProperty implements Property {
-+
-+ private final String name;
-+ private final T defaultValue;
-+
-+ public BaseProperty(String name) {
-+ this(name, null);
-+ }
-+
-+ public BaseProperty(String name, T defaultValue) {
-+ this.name = Objects.requireNonNull(name, "No name provided");
-+ this.defaultValue = defaultValue;
-+ }
-+
-+ @Override
-+ public String getName() {
-+ return name;
-+ }
-+
-+ @Override
-+ public Optional getDefault() {
-+ return Optional.ofNullable(defaultValue);
-+ }
-+
-+ @Override
-+ public T getRequiredDefault() {
-+ return getDefault().get();
-+ }
-+
-+ @Override
-+ public Optional get(PropertyResolver resolver) {
-+ Object propValue = PropertyResolverUtils.resolvePropertyValue(resolver, name);
-+ return propValue != null ? Optional.of(fromStorage(propValue)) : getDefault();
-+ }
-+
-+ @Override
-+ public T getRequired(PropertyResolver resolver) {
-+ return get(resolver).get();
-+ }
-+
-+ @Override
-+ public T getOrNull(PropertyResolver resolver) {
-+ return get(resolver).orElse(null);
-+ }
-+
-+ @Override
-+ public void set(PropertyResolver resolver, T value) {
-+ PropertyResolverUtils.updateProperty(resolver, name, toStorage(value));
-+ }
-+
-+ @Override
-+ public void remove(PropertyResolver resolver) {
-+ PropertyResolverUtils.updateProperty(resolver, name, null);
-+ }
-+
-+ protected Object toStorage(T value) {
-+ return value;
-+ }
-+
-+ protected abstract T fromStorage(Object value);
-+
-+ @Override
-+ public String toString() {
-+ return "Property[" + name + "]";
-+ }
-+ }
-+
-+ class DurationProperty extends BaseProperty {
-+
-+ public DurationProperty(String name) {
-+ super(name);
-+ }
-+
-+ public DurationProperty(String name, Duration def) {
-+ super(name, def);
-+ }
-+
-+ @Override
-+ protected Object toStorage(Duration value) {
-+ return value != null ? value.toMillis() : null;
-+ }
-+
-+ @Override
-+ protected Duration fromStorage(Object value) {
-+ Long val = PropertyResolverUtils.toLong(value);
-+ return val != null ? Duration.ofMillis(val) : null;
-+ }
-+ }
-+
-+ class DurationInSecondsProperty extends DurationProperty {
-+ public DurationInSecondsProperty(String name) {
-+ super(name);
-+ }
-+
-+ public DurationInSecondsProperty(String name, Duration def) {
-+ super(name, def);
-+ }
-+
-+ @Override
-+ protected Object toStorage(Duration value) {
-+ return value != null ? value.toMillis() / 1_000 : null;
-+ }
-+
-+ @Override
-+ protected Duration fromStorage(Object value) {
-+ Long val = PropertyResolverUtils.toLong(value);
-+ return val != null ? Duration.ofSeconds(val) : null;
-+ }
-+ }
-+
-+ class StringProperty extends BaseProperty {
-+
-+ public StringProperty(String name) {
-+ super(name);
-+ }
-+
-+ public StringProperty(String name, String def) {
-+ super(name, def);
-+ }
-+
-+ @Override
-+ protected String fromStorage(Object value) {
-+ return value != null ? value.toString() : null;
-+ }
-+ }
-+
-+ class BooleanProperty extends BaseProperty {
-+
-+ public BooleanProperty(String name) {
-+ super(name);
-+ }
-+
-+ public BooleanProperty(String name, Boolean defaultValue) {
-+ super(name, defaultValue);
-+ }
-+
-+ @Override
-+ protected Boolean fromStorage(Object value) {
-+ return PropertyResolverUtils.toBoolean(value);
-+ }
-+
-+ }
-+
-+ class LongProperty extends BaseProperty {
-+
-+ public LongProperty(String name) {
-+ super(name);
-+ }
-+
-+ public LongProperty(String name, Long defaultValue) {
-+ super(name, defaultValue);
-+ }
-+
-+ @Override
-+ protected Long fromStorage(Object value) {
-+ return PropertyResolverUtils.toLong(value);
-+ }
-+ }
-+
-+ class IntProperty extends BaseProperty {
-+
-+ public IntProperty(String name) {
-+ super(name);
-+ }
-+
-+ public IntProperty(String name, Integer defaultValue) {
-+ super(name, defaultValue);
-+ }
-+
-+ @Override
-+ protected Integer fromStorage(Object value) {
-+ return PropertyResolverUtils.toInteger(value);
-+ }
-+ }
-+
-+ class CharsetProperty extends BaseProperty {
-+
-+ public CharsetProperty(String name) {
-+ super(name);
-+ }
-+
-+ public CharsetProperty(String name, Charset defaultValue) {
-+ super(name, defaultValue);
-+ }
-+
-+ @Override
-+ protected Charset fromStorage(Object value) {
-+ return PropertyResolverUtils.toCharset(value);
-+ }
-+ }
-+
-+ class ObjectProperty extends BaseProperty {
-+
-+ public ObjectProperty(String name) {
-+ super(name);
-+ }
-+
-+ public ObjectProperty(String name, Object defaultValue) {
-+ super(name, defaultValue);
-+ }
-+
-+ @Override
-+ protected Object fromStorage(Object value) {
-+ return value;
-+ }
-+ }
-+
-+ class EnumProperty> extends BaseProperty {
-+
-+ private final Class type;
-+
-+ public EnumProperty(String name, Class type) {
-+ super(name);
-+ this.type = Objects.requireNonNull(type, "type is required");
-+ }
-+
-+ public EnumProperty(String name, Class type, T def) {
-+ super(name, def);
-+ this.type = Objects.requireNonNull(type, "type is required");
-+ }
-+
-+ @Override
-+ protected T fromStorage(Object value) {
-+ return PropertyResolverUtils.toEnum(type, value, false, Arrays.asList(type.getEnumConstants()));
-+ }
-+ }
-+
-+ class Validating implements Property {
-+ private final Property delegate;
-+ private final Consumer validator;
-+
-+ public Validating(Property delegate, Consumer validator) {
-+ this.delegate = delegate;
-+ this.validator = validator;
-+ }
-+
-+ @Override
-+ public String getName() {
-+ return delegate.getName();
-+ }
-+
-+ @Override
-+ public Optional getDefault() {
-+ return delegate.getDefault();
-+ }
-+
-+ @Override
-+ public T getRequiredDefault() {
-+ return delegate.getRequiredDefault();
-+ }
-+
-+ @Override
-+ public Optional get(PropertyResolver resolver) {
-+ Optional t = delegate.get(resolver);
-+ t.ifPresent(validator);
-+ return t;
-+ }
-+
-+ @Override
-+ public T getRequired(PropertyResolver resolver) {
-+ return get(resolver).get();
-+ }
-+
-+ @Override
-+ public T getOrNull(PropertyResolver resolver) {
-+ return get(resolver).orElse(null);
-+ }
-+
-+ @Override
-+ public void set(PropertyResolver resolver, T value) {
-+ validator.accept(value);
-+ delegate.set(resolver, value);
-+ }
-+
-+ @Override
-+ public void remove(PropertyResolver resolver) {
-+ delegate.remove(resolver);
-+ }
-+ }
-+
-+ String getName();
-+
-+ Optional getDefault();
-+
-+ T getRequiredDefault();
-+
-+ Optional get(PropertyResolver resolver);
-+
-+ T getRequired(PropertyResolver resolver);
-+
-+ T getOrNull(PropertyResolver resolver);
-+
-+ void set(PropertyResolver resolver, T value);
-+
-+ void remove(PropertyResolver resolver);
-+}
-diff --git a/sshd-core/src/main/java/org/apache/sshd/core/CoreModuleProperties.java b/sshd-core/src/main/java/org/apache/sshd/core/CoreModuleProperties.java
-new file mode 100644
-index 0000000..9e9b2d2
---- /dev/null
-+++ b/sshd-core/src/main/java/org/apache/sshd/core/CoreModuleProperties.java
-@@ -0,0 +1,681 @@
-+/*
-+ * Licensed to the Apache Software Foundation (ASF) under one
-+ * or more contributor license agreements. See the NOTICE file
-+ * distributed with this work for additional information
-+ * regarding copyright ownership. The ASF licenses this file
-+ * to you under the Apache License, Version 2.0 (the
-+ * "License"); you may not use this file except in compliance
-+ * with the License. You may obtain a copy of the License at
-+ *
-+ * http://www.apache.org/licenses/LICENSE-2.0
-+ *
-+ * Unless required by applicable law or agreed to in writing,
-+ * software distributed under the License is distributed on an
-+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-+ * KIND, either express or implied. See the License for the
-+ * specific language governing permissions and limitations
-+ * under the License.
-+ */
-+package org.apache.sshd.core;
-+
-+import java.io.IOException;
-+import java.nio.charset.Charset;
-+import java.time.Duration;
-+
-+import org.apache.sshd.client.config.keys.ClientIdentityLoader;
-+import org.apache.sshd.common.Property;
-+import org.apache.sshd.common.channel.Channel;
-+import org.apache.sshd.common.session.Session;
-+import org.apache.sshd.common.util.OsUtils;
-+import org.apache.sshd.common.util.ValidateUtils;
-+import org.apache.sshd.common.util.io.IoUtils;
-+import org.apache.sshd.common.util.net.SshdSocketAddress;
-+import org.apache.sshd.server.auth.WelcomeBannerPhase;
-+import org.apache.sshd.server.channel.ChannelDataReceiver;
-+
-+/**
-+ * Configurable properties for sshd-core.
-+ *
-+ * @author Apache MINA SSHD Project
-+ */
-+public final class CoreModuleProperties {
-+
-+ /**
-+ * Value that can be set in order to control the type of authentication channel being requested when forwarding a
-+ * PTY session.
-+ */
-+ public static final Property PROXY_AUTH_CHANNEL_TYPE
-+ = Property.string("ssh-agent-factory-proxy-auth-channel-type", "auth-agent-req@openssh.com");
-+
-+ /**
-+ * See {@link org.apache.sshd.agent.local.ProxyAgentFactory#getChannelForwardingFactories}
-+ */
-+ public static final Property PREFER_UNIX_AGENT
-+ = Property.bool("ssh-prefer-unix-agent", OsUtils.isUNIX());
-+
-+ /**
-+ * Value that can be set on the {@link org.apache.sshd.common.FactoryManager} or the session to configure the
-+ * channel open timeout value (millis).
-+ */
-+ public static final Property CHANNEL_OPEN_TIMEOUT
-+ = Property.duration("ssh-agent-server-channel-open-timeout", Duration.ofSeconds(30));
-+
-+ /**
-+ * Value used to configure the type of proxy forwarding channel to be used. See also
-+ * https://tools.ietf.org/html/draft-ietf-secsh-agent-02
-+ */
-+ public static final Property PROXY_CHANNEL_TYPE
-+ = Property.string("ssh-agent-server-channel-proxy-type", "auth-agent@openssh.com");
-+
-+ /**
-+ * Property that can be set on the {@link Session} in order to control the authentication timeout (millis).
-+ */
-+ public static final Property AUTH_SOCKET_TIMEOUT
-+ = Property.duration("ssh-agent-server-proxy-auth-socket-timeout", Duration.ofHours(1));
-+
-+ public static final int DEFAULT_FORWARDER_BUF_SIZE = 1024;
-+ public static final int MIN_FORWARDER_BUF_SIZE = 127;
-+ public static final int MAX_FORWARDER_BUF_SIZE = 32767;
-+
-+ /**
-+ * Property that can be set on the factory manager in order to control the buffer size used to forward data from the
-+ * established channel
-+ *
-+ * @see #MIN_FORWARDER_BUF_SIZE
-+ * @see #MAX_FORWARDER_BUF_SIZE
-+ * @see #DEFAULT_FORWARDER_BUF_SIZE
-+ */
-+ public static final Property FORWARDER_BUFFER_SIZE
-+ = Property.integer("channel-agent-fwd-buf-size", DEFAULT_FORWARDER_BUF_SIZE);
-+ /**
-+ * Ordered comma separated list of authentications methods. Authentications methods accepted by the server will be
-+ * tried in the given order. If not configured or {@code null}/empty, then the session's
-+ * {@link org.apache.sshd.client.ClientAuthenticationManager#getUserAuthFactories()} is used as-is
-+ */
-+ public static final Property PREFERRED_AUTHS
-+ = Property.string("preferred-auths");
-+
-+ /**
-+ * Specifies the number of interactive prompts before giving up. The argument to this keyword must be an integer.
-+ */
-+ public static final Property PASSWORD_PROMPTS
-+ = Property.integer("password-prompts", 3);
-+
-+ /**
-+ * Key used to retrieve the value of the client identification string. If set, then it is appended to the
-+ * (standard) "SSH-2.0-" prefix. Otherwise a default is sent that consists of "SSH-2.0-" plus
-+ * the current SSHD artifact name and version in uppercase - e.g., "SSH-2.0-APACHE-SSHD-1.0.0"
-+ */
-+ public static final Property CLIENT_IDENTIFICATION
-+ = Property.string("client-identification");
-+
-+ /**
-+ * Whether to send the identification string immediately upon session connection being established or wait for the
-+ * server's identification before sending our own.
-+ *
-+ * @see RFC 4253 - section 4.2 - Protocol Version
-+ * Exchange
-+ */
-+ public static final Property SEND_IMMEDIATE_IDENTIFICATION
-+ = Property.bool("send-immediate-identification", true);
-+ /**
-+ * Whether to send {@code SSH_MSG_KEXINIT} immediately after sending the client identification string or wait until
-+ * the severer's one has been received.
-+ *
-+ * @see #SEND_IMMEDIATE_IDENTIFICATION
-+ */
-+ public static final Property SEND_IMMEDIATE_KEXINIT
-+ = Property.bool("send-immediate-kex-init", true);
-+
-+ /**
-+ * Key used to set the heartbeat interval in milliseconds (0 to disable = default)
-+ */
-+ public static final Property HEARTBEAT_INTERVAL
-+ = Property.duration("heartbeat-interval", Duration.ZERO);
-+
-+ /**
-+ * Key used to check the heartbeat request that should be sent to the server
-+ */
-+ public static final Property HEARTBEAT_REQUEST
-+ = Property.string("heartbeat-request", "keepalive@sshd.apache.org");
-+
-+ /**
-+ * Key used to indicate that the heartbeat request is also expecting a reply - time in milliseconds to wait
-+ * for the reply. If non-positive then no reply is expected (nor requested).
-+ */
-+ public static final Property HEARTBEAT_REPLY_WAIT
-+ = Property.durationSec("heartbeat-reply-wait", Duration.ZERO);
-+
-+ /**
-+ * Whether to ignore invalid identities files when pre-initializing the client session
-+ *
-+ * @see ClientIdentityLoader#isValidLocation(org.apache.sshd.common.NamedResource)
-+ */
-+ public static final Property IGNORE_INVALID_IDENTITIES
-+ = Property.bool("ignore-invalid-identities", true);
-+
-+ /**
-+ * Defines if we should abort in case we encounter an invalid (e.g. expired) openssh certificate.
-+ */
-+ public static final Property ABORT_ON_INVALID_CERTIFICATE
-+ = Property.bool("abort-on-invalid-certificate", false);
-+
-+ /**
-+ * As per RFC-4256:
-+ *
-+ * The language tag is deprecated and SHOULD be the empty string. It may be removed in a future revision of this
-+ * specification. Instead, the server SHOULD select the language to be used based on the tags communicated during
-+ * key exchange
-+ */
-+ public static final Property INTERACTIVE_LANGUAGE_TAG
-+ = Property.string("kb-client-interactive-language-tag", "");
-+
-+ /**
-+ * As per RFC-4256:
-+ *
-+ * The submethods field is included so the user can give a hint of which actual methods he wants to use. It is a
-+ * comma-separated list of authentication submethods (software or hardware) that the user prefers. If the client has
-+ * knowledge of the submethods preferred by the user, presumably through a configuration setting, it MAY use the
-+ * submethods field to pass this information to the server. Otherwise, it MUST send the empty string.
-+ *
-+ * The actual names of the submethods is something the user and the server need to agree upon.
-+ *
-+ * Server interpretation of the submethods field is implementation- dependent.
-+ */
-+ public static final Property INTERACTIVE_SUBMETHODS
-+ = Property.string("kb-client-interactive-sub-methods", "");
-+
-+ /**
-+ * Configure whether reply for the "exec" request is required
-+ */
-+ public static final Property REQUEST_EXEC_REPLY
-+ = Property.bool("channel-exec-want-reply", false);
-+
-+ /**
-+ * On some platforms, a call to {@ode System.in.read(new byte[65536], 0, 32768)} always throws an
-+ * {@link IOException}. So we need to protect against that and chunk the call into smaller calls. This problem was
-+ * found on Windows, JDK 1.6.0_03-b05.
-+ */
-+ public static final Property INPUT_STREAM_PUMP_CHUNK_SIZE
-+ = Property.integer("stdin-pump-chunk-size", 1024);
-+
-+ /**
-+ * Configure whether reply for the "shell" request is required
-+ */
-+ public static final Property REQUEST_SHELL_REPLY
-+ = Property.bool("channel-shell-want-reply", false);
-+
-+ /**
-+ * Configure whether reply for the "subsystem&quoot; request is required
-+ *
-+ *
-+ * Default value for {@link #REQUEST_SUBSYSTEM_REPLY} - according to
-+ * RFC4254 section 6.5:
-+ *
-+ *
-+ * It is RECOMMENDED that the reply to these messages be requested and checked.
-+ *
-+ */
-+ public static final Property REQUEST_SUBSYSTEM_REPLY
-+ = Property.bool("channel-subsystem-want-reply", true);
-+
-+ public static final Property PROP_DHGEX_CLIENT_MIN_KEY
-+ = Property.integer("dhgex-client-min");
-+
-+ public static final Property PROP_DHGEX_CLIENT_MAX_KEY
-+ = Property.integer("dhgex-client-max");
-+
-+ public static final Property PROP_DHGEX_CLIENT_PRF_KEY
-+ = Property.integer("dhgex-client-prf");
-+ /**
-+ * Key used to retrieve the value of the channel window size in the configuration properties map.
-+ */
-+ public static final Property WINDOW_SIZE
-+ = Property.long_("window-size", 0x200000L);
-+
-+ /**
-+ * Key used to retrieve timeout (msec.) to wait for data to become available when reading from a channel. If not set
-+ * or non-positive then infinite value is assumed
-+ */
-+ public static final Property WINDOW_TIMEOUT
-+ = Property.duration("window-timeout", Duration.ZERO);
-+
-+ /**
-+ * Key used to retrieve the value of the maximum packet size in the configuration properties map.
-+ */
-+ public static final Property MAX_PACKET_SIZE
-+ = Property.long_("packet-size", 0x8000L);
-+
-+ /**
-+ * A safety value that is designed to avoid an attack that uses large channel packet sizes
-+ */
-+ public static final Property LIMIT_PACKET_SIZE
-+ = Property.long_("max-packet-size", Integer.MAX_VALUE / 4L);
-+
-+ /**
-+ * Number of NIO worker threads to use.
-+ */
-+ public static final Property NIO_WORKERS
-+ = Property.validating(Property.integer("nio-workers", Runtime.getRuntime().availableProcessors() + 1),
-+ w -> ValidateUtils.checkTrue(w > 0, "Number of NIO workers must be positive: %d", w));
-+ /**
-+ * Key used to retrieve the value of the timeout after which it will close the connection if the other side has not
-+ * been authenticated - in milliseconds.
-+ */
-+ public static final Property AUTH_TIMEOUT
-+ = Property.duration("auth-timeout", Duration.ofMinutes(2));
-+
-+ /**
-+ * Key used to retrieve the value of idle timeout after which it will close the connection - in milliseconds.
-+ */
-+ public static final Property IDLE_TIMEOUT
-+ = Property.duration("idle-timeout", Duration.ofMinutes(10));
-+
-+ /**
-+ * Key used to retrieve the value of the socket read timeout for NIO2 session implementation - in milliseconds.
-+ */
-+ public static final Property NIO2_READ_TIMEOUT
-+ = Property.duration("nio2-read-timeout", IDLE_TIMEOUT.getRequiredDefault().plus(Duration.ofSeconds(15L)));
-+
-+ /**
-+ * Minimum NIO2 write wait timeout for a single outgoing packet - in milliseconds
-+ */
-+ public static final Property NIO2_MIN_WRITE_TIMEOUT
-+ = Property.duration("nio2-min-write-timeout", Duration.ofSeconds(30L));
-+
-+ /**
-+ * Key used to retrieve the value of the disconnect timeout which is used when a disconnection is attempted. If the
-+ * disconnect message has not been sent before the timeout, the underlying socket will be forcibly closed - in
-+ * milliseconds.
-+ */
-+ public static final Property DISCONNECT_TIMEOUT
-+ = Property.duration("disconnect-timeout", Duration.ofSeconds(10));
-+
-+ /**
-+ * Key used to configure the timeout used when writing a close request on a channel. If the message can not be
-+ * written before the specified timeout elapses, the channel will be immediately closed. In milliseconds.
-+ */
-+ public static final Property CHANNEL_CLOSE_TIMEOUT
-+ = Property.duration("channel-close-timeout", Duration.ofSeconds(5));
-+
-+ /**
-+ * Timeout (milliseconds) to wait for client / server stop request if immediate stop requested.
-+ */
-+ public static final Property STOP_WAIT_TIME
-+ = Property.duration("stop-wait-time", Duration.ofMinutes(1));
-+
-+ /**
-+ * Socket backlog. See {@link java.nio.channels.AsynchronousServerSocketChannel#bind(java.net.SocketAddress, int)}
-+ */
-+ public static final Property SOCKET_BACKLOG
-+ = Property.integer("socket-backlog", 0);
-+
-+ /**
-+ * Socket keep-alive. See {@link java.net.StandardSocketOptions#SO_KEEPALIVE}
-+ */
-+ public static final Property SOCKET_KEEPALIVE
-+ = Property.bool("socket-keepalive", false);
-+
-+ /**
-+ * Socket send buffer size. See {@link java.net.StandardSocketOptions#SO_SNDBUF}
-+ */
-+ public static final Property SOCKET_SNDBUF
-+ = Property.integer("socket-sndbuf");
-+
-+ /**
-+ * Socket receive buffer size. See {@link java.net.StandardSocketOptions#SO_RCVBUF}
-+ */
-+ public static final Property SOCKET_RCVBUF
-+ = Property.integer("socket-rcvbuf");
-+
-+ /**
-+ * Socket reuse address. See {@link java.net.StandardSocketOptions#SO_REUSEADDR}
-+ */
-+ public static final Property SOCKET_REUSEADDR
-+ = Property.bool("socket-reuseaddr", true);
-+ /**
-+ * Socket linger. See {@link java.net.StandardSocketOptions#SO_LINGER}
-+ */
-+ public static final Property SOCKET_LINGER
-+ = Property.integer("socket-linger", -1);
-+
-+ /**
-+ * Socket tcp no-delay. See {@link java.net.StandardSocketOptions#TCP_NODELAY}
-+ */
-+ public static final Property TCP_NODELAY
-+ = Property.bool("tcp-nodelay", false);
-+
-+ /**
-+ * Read buffer size for NIO2 sessions See {@link org.apache.sshd.common.io.nio2.Nio2Session}
-+ */
-+ public static final Property NIO2_READ_BUFFER_SIZE
-+ = Property.integer("nio2-read-buf-size", 32 * 1024);
-+
-+ /**
-+ * Maximum allowed size of the initial identification text sent during the handshake
-+ */
-+ public static final Property MAX_IDENTIFICATION_SIZE
-+ = Property.integer("max-identification-size", 16 * 1024);
-+
-+ /**
-+ * Key re-exchange will be automatically performed after the session has sent or received the given amount of bytes.
-+ * If non-positive, then disabled.
-+ */
-+ public static final Property REKEY_BYTES_LIMIT
-+ = Property.long_("rekey-bytes-limit", 1024L * 1024L * 1024L); // 1GB
-+
-+ /**
-+ * Key re-exchange will be automatically performed after the specified amount of time has elapsed since the last key
-+ * exchange - in milliseconds. If non-positive then disabled.
-+ *
-+ * @see RFC4253 section 9
-+ */
-+ public static final Property REKEY_TIME_LIMIT
-+ = Property.duration("rekey-time-limit", Duration.ofHours(1));
-+
-+ /**
-+ * Key re-exchange will be automatically performed after the specified number of packets has been exchanged -
-+ * positive 64-bit value. If non-positive then disabled.
-+ *
-+ * @see RFC4344 section 3.1
-+ */
-+ public static final Property REKEY_PACKETS_LIMIT
-+ = Property.long_("rekey-packets-limit", 1L << 31);
-+
-+ /**
-+ * Key re-exchange will be automatically performed after the specified number of cipher blocks has been processed -
-+ * positive 64-bit value. If non-positive then disabled. The default is calculated according to
-+ * RFC4344 section 3.2
-+ */
-+ public static final Property REKEY_BLOCKS_LIMIT
-+ = Property.long_("rekey-blocks-limit", 0L);
-+
-+ /**
-+ * Average number of packets to be skipped before an {@code SSH_MSG_IGNORE} message is inserted in the stream. If
-+ * non-positive, then feature is disabled
-+ *
-+ * @see #IGNORE_MESSAGE_VARIANCE
-+ * @see RFC4251 section 9.3.1
-+ */
-+ public static final Property IGNORE_MESSAGE_FREQUENCY
-+ = Property.long_("ignore-message-frequency", 1024L);
-+
-+ /**
-+ * The variance to be used around the configured {@link #IGNORE_MESSAGE_FREQUENCY} value in order to avoid insertion
-+ * at a set frequency. If zero, then exact frequency is used. If negative, then the absolute value is
-+ * used. If greater or equal to the frequency, then assumed to be zero - i.e., no variance
-+ *
-+ * @see RFC4251 section 9.3.1
-+ */
-+ public static final Property IGNORE_MESSAGE_VARIANCE
-+ = Property.integer("ignore-message-variance", 32);
-+
-+ /**
-+ * Minimum size of {@code SSH_MSG_IGNORE} payload to send if feature enabled. If non-positive then no message is
-+ * sent. Otherwise, the actual size is between this size and twice its value
-+ *
-+ * @see RFC4251 section 9.3.1
-+ */
-+ public static final Property IGNORE_MESSAGE_SIZE
-+ = Property.integer("ignore-message-size", 16);
-+
-+ /**
-+ * The request type of agent forwarding. The value may be {@value #AGENT_FORWARDING_TYPE_IETF} or
-+ * {@value #AGENT_FORWARDING_TYPE_OPENSSH}.
-+ */
-+ public static final String AGENT_FORWARDING_TYPE = "agent-fw-auth-type";
-+
-+ /**
-+ * The agent forwarding type defined by IETF (https://tools.ietf.org/html/draft-ietf-secsh-agent-02).
-+ */
-+ public static final String AGENT_FORWARDING_TYPE_IETF = "auth-agent-req";
-+
-+ /**
-+ * The agent forwarding type defined by OpenSSH.
-+ */
-+ public static final String AGENT_FORWARDING_TYPE_OPENSSH = "auth-agent-req@openssh.com";
-+
-+ /**
-+ * Configure max. wait time (millis) to wait for space to become available
-+ */
-+ public static final Property WAIT_FOR_SPACE_TIMEOUT
-+ = Property.duration("channel-output-wait-for-space-timeout", Duration.ofSeconds(30L));
-+
-+ /**
-+ * Used to configure the timeout (milliseconds) for receiving a response for the forwarding request
-+ */
-+ public static final Property FORWARD_REQUEST_TIMEOUT
-+ = Property.duration("tcpip-forward-request-timeout", Duration.ofSeconds(15L));
-+
-+ /**
-+ * Property that can be used to configure max. allowed concurrent active channels
-+ *
-+ * @see org.apache.sshd.common.session.ConnectionService#registerChannel(Channel)
-+ */
-+ public static final Property MAX_CONCURRENT_CHANNELS
-+ = Property.integer("max-sshd-channels", Integer.MAX_VALUE);
-+
-+ /**
-+ * RFC4254 does not clearly specify how to handle {@code SSH_MSG_CHANNEL_DATA} and
-+ * {@code SSH_MSG_CHANNEL_EXTENDED_DATA} received through an unknown channel. Therefore, we provide a configurable
-+ * approach to it with the default set to ignore it.
-+ */
-+ public static final Property SEND_REPLY_FOR_CHANNEL_DATA
-+ = Property.bool("send-unknown-channel-data-reply", false);
-+
-+ /**
-+ * Key used to retrieve the value in the configuration properties map of the maximum number of failed authentication
-+ * requests before the server closes the connection.
-+ */
-+ public static final Property MAX_AUTH_REQUESTS
-+ = Property.integer("max-auth-requests", 20);
-+
-+ /**
-+ * Key used to retrieve the value of welcome banner that will be displayed when a user connects to the server. If
-+ * {@code null}/empty then no banner will be sent. The value can be one of the following:
-+ *
-+ *
-+ *
A {@link java.io.File} or {@link java.nio.file.Path}, in which case its contents will be transmitted.
-+ * Note: if the file is empty or does not exits, no banner will be transmitted.
-+ *
-+ *
-+ *
-+ *
A {@link java.net.URI} or a string starting with "file:/", in which case it will be converted to a
-+ * {@link java.nio.file.Path} and handled accordingly.
-+ *
-+ *
-+ *
-+ *
A string containing a special value indicator - e.g., {@link #AUTO_WELCOME_BANNER_VALUE}, in which case the
-+ * relevant banner content will be generated.
-+ *
-+ *
-+ *
-+ *
Any other object whose {@code toString()} value yields a non empty string will be used as the banner
-+ * contents.
-+ *
-+ *
-+ *
-+ * @see RFC-4252 section 5.4
-+ */
-+ public static final Property WELCOME_BANNER
-+ = Property.object("welcome-banner");
-+
-+ /**
-+ * Special value that can be set for the {@link #WELCOME_BANNER} property indicating that the server should generate
-+ * a banner consisting of the random art of the server's keys (if any are provided). If no server keys are
-+ * available, then no banner will be sent
-+ */
-+ public static final String AUTO_WELCOME_BANNER_VALUE = "#auto-welcome-banner";
-+
-+ /**
-+ * Key used to denote the language code for the welcome banner (if such a banner is configured).
-+ */
-+ public static final Property WELCOME_BANNER_LANGUAGE
-+ = Property.string("welcome-banner-language", "en");
-+
-+ /**
-+ * The {@link WelcomeBannerPhase} value - either as an enum or a string
-+ */
-+ public static final Property WELCOME_BANNER_PHASE
-+ = Property.enum_("welcome-banner-phase", WelcomeBannerPhase.class, WelcomeBannerPhase.IMMEDIATE);
-+
-+ /**
-+ * The charset to use if the configured welcome banner points to a file - if not specified (either as a string or a
-+ * {@link java.nio.charset.Charset} then the local default is used.
-+ */
-+ public static final Property WELCOME_BANNER_CHARSET
-+ = Property.charset("welcome-banner-charset", Charset.defaultCharset());
-+
-+ /**
-+ * This key is used when configuring multi-step authentications. The value needs to be a blank separated list of
-+ * comma separated list of authentication method names. For example, an argument of
-+ * publickey,password publickey,keyboard-interactive would require the user to complete public key
-+ * authentication, followed by either password or keyboard interactive authentication. Only methods that are next in
-+ * one or more lists are offered at each stage, so for this example, it would not be possible to attempt password or
-+ * keyboard-interactive authentication before public key.
-+ */
-+ public static final Property AUTH_METHODS
-+ = Property.string("auth-methods");
-+
-+ /**
-+ * Key used to retrieve the value of the maximum concurrent open session count per username. If not set, then
-+ * unlimited
-+ */
-+ public static final Property MAX_CONCURRENT_SESSIONS
-+ = Property.integer("max-concurrent-sessions");
-+
-+ /**
-+ * Key used to retrieve any extra lines to be sent during initial protocol handshake before the
-+ * identification. The configured string value should use {@value #SERVER_EXTRA_IDENT_LINES_SEPARATOR} character to
-+ * denote line breaks
-+ */
-+ public static final Property SERVER_EXTRA_IDENTIFICATION_LINES
-+ = Property.string("server-extra-identification-lines");
-+
-+ /**
-+ * Separator used in the {@link #SERVER_EXTRA_IDENTIFICATION_LINES} configuration string to indicate new line break
-+ */
-+ public static final char SERVER_EXTRA_IDENT_LINES_SEPARATOR = '|';
-+
-+ /**
-+ * Key used to retrieve the value of the server identification string. If set, then it is appended to the
-+ * (standard) "SSH-2.0-" prefix. Otherwise a default is sent that consists of "SSH-2.0-" plus
-+ * the current SSHD artifact name and version in uppercase - e.g., "SSH-2.0-APACHE-SSHD-1.0.0"
-+ */
-+ public static final Property SERVER_IDENTIFICATION
-+ = Property.string("server-identification");
-+
-+ /**
-+ * Key used to configure the timeout used when receiving a close request on a channel to wait until the command
-+ * cleanly exits after setting an EOF on the input stream.
-+ */
-+ public static final Property COMMAND_EXIT_TIMEOUT
-+ = Property.duration("command-exit-timeout", Duration.ofMillis(5L));
-+
-+ /**
-+ * A URL pointing to the moduli file. If not specified, the default internal file will be used.
-+ */
-+ public static final Property MODULI_URL
-+ = Property.string("moduli-url");
-+
-+ /**
-+ * See {@link org.apache.sshd.server.auth.keyboard.DefaultKeyboardInteractiveAuthenticator}.
-+ */
-+ public static final Property KB_SERVER_INTERACTIVE_NAME
-+ = Property.string("kb-server-interactive-name", "Password authentication");
-+
-+ /**
-+ * See {@link org.apache.sshd.server.auth.keyboard.DefaultKeyboardInteractiveAuthenticator}.
-+ */
-+ public static final Property KB_SERVER_INTERACTIVE_INSTRUCTION
-+ = Property.string("kb-server-interactive-instruction", "");
-+
-+ /**
-+ * See {@link org.apache.sshd.server.auth.keyboard.DefaultKeyboardInteractiveAuthenticator}.
-+ */
-+ public static final Property KB_SERVER_INTERACTIVE_LANG
-+ = Property.string("kb-server-interactive-language", "en-US");
-+
-+ /**
-+ * See {@link org.apache.sshd.server.auth.keyboard.DefaultKeyboardInteractiveAuthenticator}.
-+ */
-+ public static final Property KB_SERVER_INTERACTIVE_PROMPT
-+ = Property.string("kb-server-interactive-prompt", "Password: ");
-+
-+ /**
-+ * See {@link org.apache.sshd.server.auth.keyboard.DefaultKeyboardInteractiveAuthenticator}.
-+ */
-+ public static final Property KB_SERVER_INTERACTIVE_ECHO_PROMPT
-+ = Property.bool("kb-server-interactive-echo-prompt", false);
-+
-+ /**
-+ * Maximum amount of extended (a.k.a. STDERR) data allowed to be accumulated until a {@link ChannelDataReceiver} for
-+ * the data is registered
-+ */
-+ public static final Property MAX_EXTDATA_BUFSIZE
-+ = Property.integer("channel-session-max-extdata-bufsize", 0);
-+
-+ /**
-+ * See {@link org.apache.sshd.server.kex.DHGEXServer}.
-+ */
-+ public static final Property PROP_DHGEX_SERVER_MIN_KEY
-+ = Property.integer("dhgex-server-min");
-+
-+ /**
-+ * See {@link org.apache.sshd.server.kex.DHGEXServer}.
-+ */
-+ public static final Property PROP_DHGEX_SERVER_MAX_KEY
-+ = Property.integer("dhgex-server-max");
-+ /**
-+ * Value used by the {@link org.apache.sshd.server.shell.InvertedShellWrapper} to control the "busy-wait"
-+ * sleep time (millis) on the pumping loop if nothing was pumped - must be positive .
-+ */
-+ public static final Property PUMP_SLEEP_TIME
-+ = Property.duration("inverted-shell-wrapper-pump-sleep", Duration.ofMillis(1));
-+
-+ /**
-+ * Value used by the {@link org.apache.sshd.server.shell.InvertedShellWrapper} to control copy buffer size.
-+ */
-+ public static final Property BUFFER_SIZE
-+ = Property.integer("inverted-shell-wrapper-buffer-size", IoUtils.DEFAULT_COPY_SIZE);
-+
-+ /**
-+ * Configuration value for the {@link org.apache.sshd.server.x11.X11ForwardSupport} to control the channel open
-+ * timeout.
-+ */
-+ public static final Property X11_OPEN_TIMEOUT
-+ = Property.duration("x11-fwd-open-timeout", Duration.ofSeconds(30L));
-+
-+ /**
-+ * Configuration value for the {@link org.apache.sshd.server.x11.X11ForwardSupport} to control from which X11
-+ * display number to start looking for a free value.
-+ */
-+ public static final Property X11_DISPLAY_OFFSET
-+ = Property.integer("x11-fwd-display-offset", 10);
-+
-+ /**
-+ * Configuration value for the {@link org.apache.sshd.server.x11.X11ForwardSupport} to control up to which (but not
-+ * including) X11 display number to look or a free value.
-+ */
-+ public static final Property X11_MAX_DISPLAYS
-+ = Property.integer("x11-fwd-max-display", 1000);
-+
-+ /**
-+ * Configuration value for the {@link org.apache.sshd.server.x11.X11ForwardSupport} to control the base port number
-+ * for the X11 display number socket binding.
-+ */
-+ public static final Property X11_BASE_PORT
-+ = Property.integer("x11-fwd-base-port", 6000);
-+
-+ /**
-+ * Configuration value for the {@link org.apache.sshd.server.x11.X11ForwardSupport} to control the host used to bind
-+ * to for the X11 display when looking for a free port.
-+ */
-+ public static final Property X11_BIND_HOST
-+ = Property.string("x11-fwd-bind-host", SshdSocketAddress.LOCALHOST_IPV4);
-+
-+ private CoreModuleProperties() {
-+ // private
-+ }
-+
-+}
---
-2.27.0
-
diff --git a/CVE-2021-30129-2.patch b/CVE-2021-30129-2.patch
deleted file mode 100644
index 8138582..0000000
--- a/CVE-2021-30129-2.patch
+++ /dev/null
@@ -1,161 +0,0 @@
-From 5b5bd1dcfa0c2fc250e079e1ebcd643b51f735eb Mon Sep 17 00:00:00 2001
-From: Lyor Goldstein
-Date: Fri, 26 Feb 2021 06:54:43 +0200
-Subject: [PATCH] [SSHD-1125] Added option to require immediate close of
- channel in command ExitCallback invocation
-
----
- .../org/apache/sshd/server/ExitCallback.java | 27 +++++++++++++++++--
- .../sshd/server/channel/ChannelSession.java | 10 +++----
- .../sshd/util/test/BogusExitCallback.java | 12 ++++++---
- .../server/subsystem/sftp/SftpSubsystem.java | 6 +++--
- 4 files changed, 43 insertions(+), 12 deletions(-)
-
-diff --git a/sshd-core/src/main/java/org/apache/sshd/server/ExitCallback.java b/sshd-core/src/main/java/org/apache/sshd/server/ExitCallback.java
-index dfa55be..eb1bca1 100644
---- a/sshd-core/src/main/java/org/apache/sshd/server/ExitCallback.java
-+++ b/sshd-core/src/main/java/org/apache/sshd/server/ExitCallback.java
-@@ -30,7 +30,17 @@ public interface ExitCallback {
- * @param exitValue the exit value
- */
- default void onExit(int exitValue) {
-- onExit(exitValue, "");
-+ onExit(exitValue, false);
-+ }
-+
-+ /**
-+ * Informs the SSH server that the shell has exited
-+ *
-+ * @param exitValue the exit value
-+ * @param closeImmediately whether to also terminate the channel immediately or do a graceful close.
-+ */
-+ default void onExit(int exitValue, boolean closeImmediately) {
-+ onExit(exitValue, "", closeImmediately);
- }
-
- /**
-@@ -39,5 +49,18 @@ public interface ExitCallback {
- * @param exitValue the exit value
- * @param exitMessage exit value description
- */
-- void onExit(int exitValue, String exitMessage);
-+ default void onExit(int exitValue, String exitMessage) {
-+ onExit(exitValue, exitMessage, false);
-+ }
-+
-+ /**
-+ *
-+ * Informs the SSH client/server that the shell has exited
-+ *
-+ * @param exitValue the exit value
-+ * @param exitMessage exit value description
-+ * @param closeImmediately whether to also terminate the channel immediately or do a graceful close.
-+ */
-+ void onExit(int exitValue, String exitMessage, boolean closeImmediately);
-+
- }
-diff --git a/sshd-core/src/main/java/org/apache/sshd/server/channel/ChannelSession.java b/sshd-core/src/main/java/org/apache/sshd/server/channel/ChannelSession.java
-index e54e0e4..484b4f0 100644
---- a/sshd-core/src/main/java/org/apache/sshd/server/channel/ChannelSession.java
-+++ b/sshd-core/src/main/java/org/apache/sshd/server/channel/ChannelSession.java
-@@ -684,9 +684,9 @@ public class ChannelSession extends AbstractServerChannel {
- tempBuffer = null;
- doWriteData(buffer.array(), buffer.rpos(), buffer.available());
- }
-- command.setExitCallback((exitValue, exitMessage) -> {
-+ command.setExitCallback((exitValue, exitMessage, closeImmediately) -> {
- try {
-- closeShell(exitValue);
-+ closeShell(exitValue, closeImmediately);
- if (log.isDebugEnabled()) {
- log.debug("onExit({}) code={} message='{}' shell closed", ChannelSession.this, exitValue, exitMessage);
- }
-@@ -798,9 +798,9 @@ public class ChannelSession extends AbstractServerChannel {
- return env;
- }
-
-- protected void closeShell(int exitValue) throws IOException {
-+ protected void closeShell(int exitValue, boolean closeImmediately) throws IOException {
- if (log.isDebugEnabled()) {
-- log.debug("closeShell({}) exit code={}", this, exitValue);
-+ log.debug("closeShell({}) exit code={}, immediate={}", this, exitValue, closeImmediately);
- }
-
- if (!isClosing()) {
-@@ -810,7 +810,7 @@ public class ChannelSession extends AbstractServerChannel {
- sendEof();
- sendExitStatus(exitValue);
- commandExitFuture.setClosed();
-- close(false);
-+ close(closeImmediately);
- } else {
- commandExitFuture.setClosed();
- }
-diff --git a/sshd-core/src/test/java/org/apache/sshd/util/test/BogusExitCallback.java b/sshd-core/src/test/java/org/apache/sshd/util/test/BogusExitCallback.java
-index a4f1ff6..9de602a 100644
---- a/sshd-core/src/test/java/org/apache/sshd/util/test/BogusExitCallback.java
-+++ b/sshd-core/src/test/java/org/apache/sshd/util/test/BogusExitCallback.java
-@@ -25,21 +25,23 @@ public class BogusExitCallback implements ExitCallback {
- private boolean exited;
- private int exitValue;
- private String exitMessage;
-+ private boolean closeImmediately;
-
- public BogusExitCallback() {
- super();
- }
-
- @Override
-- public void onExit(int exitValue) {
-- onExit(exitValue, String.valueOf(exitValue));
-+ public void onExit(int exitValue, boolean closeImmediately) {
-+ onExit(exitValue, String.valueOf(exitValue), closeImmediately);
- }
-
- @Override
-- public void onExit(int exitValue, String exitMessage) {
-+ public void onExit(int exitValue, String exitMessage, boolean closeImmediately) {
- this.exited = true;
- this.exitValue = exitValue;
- this.exitMessage = exitMessage;
-+ this.closeImmediately = closeImmediately;
- }
-
- public boolean isExited() {
-@@ -53,4 +55,8 @@ public class BogusExitCallback implements ExitCallback {
- public String getExitMessage() {
- return exitMessage;
- }
-+
-+ public boolean isCloseImmediately() {
-+ return closeImmediately;
-+ }
- }
-diff --git a/sshd-sftp/src/main/java/org/apache/sshd/server/subsystem/sftp/SftpSubsystem.java b/sshd-sftp/src/main/java/org/apache/sshd/server/subsystem/sftp/SftpSubsystem.java
-index 66a0ced..c18b55e 100644
---- a/sshd-sftp/src/main/java/org/apache/sshd/server/subsystem/sftp/SftpSubsystem.java
-+++ b/sshd-sftp/src/main/java/org/apache/sshd/server/subsystem/sftp/SftpSubsystem.java
-@@ -299,6 +299,7 @@ public class SftpSubsystem
-
- @Override
- public void run() {
-+ int exitCode = 0;
- try {
- while (true) {
- Buffer buffer = requests.take();
-@@ -318,10 +319,11 @@ public class SftpSubsystem
- if (log.isDebugEnabled()) {
- log.debug("run(" + session + ") caught exception details", t);
- }
-+ exitCode = -1;
- }
- } finally {
- closeAllHandles();
-- callback.onExit(0);
-+ callback.onExit(exitCode, exitCode != 0);
- }
- }
-
---
-2.27.0
-
diff --git a/CVE-2021-30129-3.patch b/CVE-2021-30129-3.patch
deleted file mode 100644
index 722ea2b..0000000
--- a/CVE-2021-30129-3.patch
+++ /dev/null
@@ -1,408 +0,0 @@
-From f9b2f236e6a663011b50bd7e9a41ec90e6b94831 Mon Sep 17 00:00:00 2001
-From: Lyor Goldstein
-Date: Thu, 25 Feb 2021 21:05:49 +0200
-Subject: [PATCH] [SSHD-1125] Added mechanism to throttle pending write
- requests in BufferedIoOutputStream
-
----
- .../channel/BufferedIoOutputStream.java | 187 ++++++++++++++++--
- .../SshChannelBufferedOutputException.java | 41 ++++
- .../sshd/core/CoreModuleProperties.java | 19 ++
- .../sshd/util/test/AsyncEchoShellFactory.java | 13 +-
- .../server/subsystem/sftp/SftpSubsystem.java | 3 +-
- 5 files changed, 243 insertions(+), 20 deletions(-)
- create mode 100644 sshd-core/src/main/java/org/apache/sshd/common/channel/exception/SshChannelBufferedOutputException.java
-
-diff --git a/sshd-core/src/main/java/org/apache/sshd/common/channel/BufferedIoOutputStream.java b/sshd-core/src/main/java/org/apache/sshd/common/channel/BufferedIoOutputStream.java
-index 1cb75aa..c95a449 100644
---- a/sshd-core/src/main/java/org/apache/sshd/common/channel/BufferedIoOutputStream.java
-+++ b/sshd-core/src/main/java/org/apache/sshd/common/channel/BufferedIoOutputStream.java
-@@ -20,29 +20,55 @@ package org.apache.sshd.common.channel;
-
- import java.io.EOFException;
- import java.io.IOException;
-+import java.time.Duration;
-+import java.util.Objects;
- import java.util.Queue;
- import java.util.concurrent.ConcurrentLinkedQueue;
-+import java.util.concurrent.atomic.AtomicInteger;
-+import java.util.concurrent.atomic.AtomicLong;
- import java.util.concurrent.atomic.AtomicReference;
-
- import org.apache.sshd.common.Closeable;
-+import org.apache.sshd.common.PropertyResolver;
-+import org.apache.sshd.common.channel.exception.SshChannelBufferedOutputException;
- import org.apache.sshd.common.future.SshFutureListener;
- import org.apache.sshd.common.io.IoOutputStream;
- import org.apache.sshd.common.io.IoWriteFuture;
-+import org.apache.sshd.common.util.GenericUtils;
-+import org.apache.sshd.common.util.ValidateUtils;
- import org.apache.sshd.common.util.buffer.Buffer;
- import org.apache.sshd.common.util.closeable.AbstractInnerCloseable;
-+import org.apache.sshd.core.CoreModuleProperties;
-
- /**
- * An {@link IoOutputStream} capable of queuing write requests
- */
- public class BufferedIoOutputStream extends AbstractInnerCloseable implements IoOutputStream {
-+ protected final Object id;
-+ protected final int channelId;
-+ protected final int maxPendingBytesCount;
-+ protected final Duration maxWaitForPendingWrites;
- protected final IoOutputStream out;
-+ protected final AtomicInteger pendingBytesCount = new AtomicInteger();
-+ protected final AtomicLong writtenBytesCount = new AtomicLong();
- protected final Queue writes = new ConcurrentLinkedQueue<>();
- protected final AtomicReference currentWrite = new AtomicReference<>();
-- protected final Object id;
-+ protected final AtomicReference pendingException = new AtomicReference<>();
-
-- public BufferedIoOutputStream(Object id, IoOutputStream out) {
-- this.out = out;
-- this.id = id;
-+ public BufferedIoOutputStream(Object id, int channelId, IoOutputStream out, PropertyResolver resolver) {
-+ this(id, channelId, out, CoreModuleProperties.BUFFERED_IO_OUTPUT_MAX_PENDING_WRITE_SIZE.getRequired(resolver),
-+ CoreModuleProperties.BUFFERED_IO_OUTPUT_MAX_PENDING_WRITE_WAIT.getRequired(resolver));
-+ }
-+
-+ public BufferedIoOutputStream(
-+ Object id, int channelId, IoOutputStream out, int maxPendingBytesCount,
-+ Duration maxWaitForPendingWrites) {
-+ this.id = Objects.requireNonNull(id, "No stream identifier provided");
-+ this.channelId = channelId;
-+ this.out = Objects.requireNonNull(out, "No delegate output stream provided");
-+ this.maxPendingBytesCount = maxPendingBytesCount;
-+ ValidateUtils.checkTrue(maxPendingBytesCount > 0, "Invalid max. pending bytes count: %d", maxPendingBytesCount);
-+ this.maxWaitForPendingWrites = Objects.requireNonNull(maxWaitForPendingWrites, "No max. pending time value provided");
- }
-
- public Object getId() {
-@@ -52,26 +78,114 @@ public class BufferedIoOutputStream extends AbstractInnerCloseable implements Io
- @Override
- public IoWriteFuture writePacket(Buffer buffer) throws IOException {
- if (isClosing()) {
-- throw new EOFException("Closed");
-+ throw new EOFException("Closed/ing - state=" + state);
- }
-
-+ waitForAvailableWriteSpace(buffer.available());
-+
- IoWriteFutureImpl future = new IoWriteFutureImpl(getId(), buffer);
- writes.add(future);
- startWriting();
- return future;
- }
-
-+ protected void waitForAvailableWriteSpace(int requiredSize) throws IOException {
-+ /*
-+ * NOTE: this code allows a single pending write to give this mechanism "the slip" and
-+ * exit the loop "unscathed" even though there is a pending exception. However, the goal
-+ * here is to avoid an OOM by having an unlimited accumulation of pending write requests
-+ * due to fact that the peer is not consuming the sent data. Please note that the pending
-+ * exception is "sticky" - i.e., the next write attempt will fail. This also means that if
-+ * the write request that "got away" was the last one by chance and it was consumed by the
-+ * peer there will be no exception thrown - which is also fine since as mentioned the goal
-+ * is not to enforce a strict limit on the pending bytes size but rather on the accumulation
-+ * of the pending write requests.
-+ *
-+ * We could have counted pending requests rather than bytes. However, we also want to avoid
-+ * having a large amount of data pending consumption by the peer as well. This code strikes
-+ * such a balance by allowing a single pending request to exceed the limit, but at the same
-+ * time prevents too many bytes from pending by having a bunch of pending requests that while
-+ * below the imposed number limit may cumulatively represent a lot of pending bytes.
-+ */
-+
-+ long expireTime = System.currentTimeMillis() + maxWaitForPendingWrites.toMillis();
-+ synchronized (pendingBytesCount) {
-+ for (int count = pendingBytesCount.get();
-+ /*
-+ * The (count > 0) condition is put in place to allow a single pending
-+ * write to exceed the maxPendingBytesCount as long as there are no
-+ * other pending ones.
-+ */
-+ (count > 0)
-+ // Not already over the limit or about to be over it
-+ && ((count + requiredSize) > maxPendingBytesCount)
-+ // No pending exception signaled
-+ && (pendingException.get() == null);
-+ count = pendingBytesCount.get()) {
-+ long remTime = expireTime - System.currentTimeMillis();
-+ if (remTime <= 0L) {
-+ pendingException.compareAndSet(null,
-+ new SshChannelBufferedOutputException(
-+ channelId,
-+ "Max. pending write timeout expired after " + writtenBytesCount + " bytes"));
-+ throw pendingException.get();
-+ }
-+
-+ try {
-+ pendingBytesCount.wait(remTime);
-+ } catch (InterruptedException e) {
-+ pendingException.compareAndSet(null,
-+ new SshChannelBufferedOutputException(
-+ channelId,
-+ "Waiting for pending writes interrupted after " + writtenBytesCount + " bytes"));
-+ throw pendingException.get();
-+ }
-+ }
-+
-+ IOException e = pendingException.get();
-+ if (e != null) {
-+ throw e;
-+ }
-+
-+ pendingBytesCount.addAndGet(requiredSize);
-+ }
-+ }
-+
- protected void startWriting() throws IOException {
- IoWriteFutureImpl future = writes.peek();
-+ // No more pending requests
- if (future == null) {
- return;
- }
-
-+ // Don't try to write any further if pending exception signaled
-+ Throwable pendingError = pendingException.get();
-+ if (pendingError != null) {
-+ log.error("startWriting({})[{}] propagate to {} write requests pending error={}[{}]",
-+ getId(), out, writes.size(), getClass().getSimpleName(), pendingError.getMessage());
-+
-+ IoWriteFutureImpl currentFuture = currentWrite.getAndSet(null);
-+ for (IoWriteFutureImpl pendingWrite : writes) {
-+ // Checking reference by design
-+ if (GenericUtils.isSameReference(pendingWrite, currentFuture)) {
-+ continue; // will be taken care of when its listener is eventually called
-+ }
-+
-+ future.setValue(pendingError);
-+ }
-+
-+ writes.clear();
-+ return;
-+ }
-+
-+ // Cannot honor this request yet since other pending one incomplete
- if (!currentWrite.compareAndSet(null, future)) {
- return;
- }
-
-- out.writePacket(future.getBuffer()).addListener(new SshFutureListener() {
-+ Buffer buffer = future.getBuffer();
-+ int bufferSize = buffer.available();
-+ out.writePacket(buffer).addListener(new SshFutureListener() {
- @Override
- public void operationComplete(IoWriteFuture f) {
- if (f.isWritten()) {
-@@ -79,32 +193,71 @@ public class BufferedIoOutputStream extends AbstractInnerCloseable implements Io
- } else {
- future.setValue(f.getException());
- }
-- finishWrite();
-+ finishWrite(future, bufferSize);
-+ }
-+ });
-+ }
-+
-+ protected void finishWrite(IoWriteFutureImpl future, int bufferSize) {
-+ /*
-+ * Update the pending bytes count only if successfully written,
-+ * otherwise signal an error
-+ */
-+ if (future.isWritten()) {
-+ long writtenSize = writtenBytesCount.addAndGet(bufferSize);
-+ int stillPending;
-+ synchronized (pendingBytesCount) {
-+ stillPending = pendingBytesCount.addAndGet(0 - bufferSize);
-+ pendingBytesCount.notifyAll();
- }
-
-- @SuppressWarnings("synthetic-access")
-- private void finishWrite() {
-+ /*
-+ * NOTE: since the pending exception is updated outside the synchronized block
-+ * a pending write could be successfully enqueued, however this is acceptable
-+ * - see comment in waitForAvailableWriteSpace
-+ */
-+ if (stillPending < 0) {
-+ log.error("finishWrite({})[{}] - pending byte counts underflow ({}) after {} bytes", getId(), out, stillPending,
-+ writtenSize);
-+ pendingException.compareAndSet(null,
-+ new SshChannelBufferedOutputException(channelId, "Pending byte counts underflow"));
-+ }
-+ } else {
-+ Throwable t = future.getException();
-+ if (t instanceof SshChannelBufferedOutputException) {
-+ pendingException.compareAndSet(null, (SshChannelBufferedOutputException) t);
-+ } else {
-+ pendingException.compareAndSet(null, new SshChannelBufferedOutputException(channelId, t));
-+ }
-+
-+ // In case someone waiting so that they can detect the exception
-+ synchronized (pendingBytesCount) {
-+ pendingBytesCount.notifyAll();
-+ }
-+ }
-+
- writes.remove(future);
- currentWrite.compareAndSet(future, null);
- try {
- startWriting();
- } catch (IOException e) {
-- log.error("finishWrite({}) failed ({}) re-start writing", out, e.getClass().getSimpleName());
-+ if (e instanceof SshChannelBufferedOutputException) {
-+ pendingException.compareAndSet(null, (SshChannelBufferedOutputException) e);
-+ } else {
-+ pendingException.compareAndSet(null, new SshChannelBufferedOutputException(channelId, e));
-+ }
-+ log.error("finishWrite({})[{}] failed ({}) re-start writing: {}",
-+ getId(), out, e.getClass().getSimpleName(), e.getMessage(), e);
- }
- }
-- });
-- }
-
- @Override
- protected Closeable getInnerCloseable() {
-- return builder()
-- .when(getId(), writes)
-- .close(out)
-- .build();
-+ return builder().when(getId(), writes).close(out).build();
- }
-
- @Override
- public String toString() {
-- return getClass().getSimpleName() + "[" + out + "]";
-+ return getClass().getSimpleName() + "(" + getId() + ")[" + out + "]";
- }
- }
-diff --git a/sshd-core/src/main/java/org/apache/sshd/common/channel/exception/SshChannelBufferedOutputException.java b/sshd-core/src/main/java/org/apache/sshd/common/channel/exception/SshChannelBufferedOutputException.java
-new file mode 100644
-index 0000000..97e6105
---- /dev/null
-+++ b/sshd-core/src/main/java/org/apache/sshd/common/channel/exception/SshChannelBufferedOutputException.java
-@@ -0,0 +1,41 @@
-+/*
-+ * Licensed to the Apache Software Foundation (ASF) under one
-+ * or more contributor license agreements. See the NOTICE file
-+ * distributed with this work for additional information
-+ * regarding copyright ownership. The ASF licenses this file
-+ * to you under the Apache License, Version 2.0 (the
-+ * "License"); you may not use this file except in compliance
-+ * with the License. You may obtain a copy of the License at
-+ *
-+ * http://www.apache.org/licenses/LICENSE-2.0
-+ *
-+ * Unless required by applicable law or agreed to in writing,
-+ * software distributed under the License is distributed on an
-+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-+ * KIND, either express or implied. See the License for the
-+ * specific language governing permissions and limitations
-+ * under the License.
-+ */
-+
-+package org.apache.sshd.common.channel.exception;
-+
-+/**
-+ * Used by the {@code BufferedIoOutputStream} to signal a non-recoverable error
-+ *
-+ * @author Apache MINA SSHD Project
-+ */
-+public class SshChannelBufferedOutputException extends SshChannelException {
-+ private static final long serialVersionUID = -8663890657820958046L;
-+
-+ public SshChannelBufferedOutputException(int channelId, String message) {
-+ this(channelId, message, null);
-+ }
-+
-+ public SshChannelBufferedOutputException(int channelId, Throwable cause) {
-+ this(channelId, cause.getMessage(), cause);
-+ }
-+
-+ public SshChannelBufferedOutputException(int channelId, String message, Throwable cause) {
-+ super(channelId, message, cause);
-+ }
-+}
-diff --git a/sshd-core/src/main/java/org/apache/sshd/core/CoreModuleProperties.java b/sshd-core/src/main/java/org/apache/sshd/core/CoreModuleProperties.java
-index 9e9b2d2..0d122e5 100644
---- a/sshd-core/src/main/java/org/apache/sshd/core/CoreModuleProperties.java
-+++ b/sshd-core/src/main/java/org/apache/sshd/core/CoreModuleProperties.java
-@@ -24,6 +24,7 @@ import java.time.Duration;
-
- import org.apache.sshd.client.config.keys.ClientIdentityLoader;
- import org.apache.sshd.common.Property;
-+import org.apache.sshd.common.SshConstants;
- import org.apache.sshd.common.channel.Channel;
- import org.apache.sshd.common.session.Session;
- import org.apache.sshd.common.util.OsUtils;
-@@ -240,6 +241,24 @@ public final class CoreModuleProperties {
- public static final Property WINDOW_TIMEOUT
- = Property.duration("window-timeout", Duration.ZERO);
-
-+ /**
-+ * Key used when creating a {@code BufferedIoOutputStream} in order to specify max. allowed unwritten pending bytes.
-+ * If this value is exceeded then the code waits up to {@link #BUFFERED_IO_OUTPUT_MAX_PENDING_WRITE_WAIT} for the
-+ * pending data to be written and thus make room for the new request.
-+ */
-+ public static final Property BUFFERED_IO_OUTPUT_MAX_PENDING_WRITE_SIZE
-+ = Property.integer("buffered-io-output-max-pending-write-size",
-+ SshConstants.SSH_REQUIRED_PAYLOAD_PACKET_LENGTH_SUPPORT * 8);
-+
-+ /**
-+ * Key used when creating a {@code BufferedIoOutputStream} in order to specify max. wait time (msec.) for pending
-+ * writes to be completed before enqueuing a new request
-+ *
-+ * @see #BUFFERED_IO_OUTPUT_MAX_PENDING_WRITE_SIZE
-+ */
-+ public static final Property BUFFERED_IO_OUTPUT_MAX_PENDING_WRITE_WAIT
-+ = Property.duration("buffered-io-output-max-pending-write-wait", Duration.ofSeconds(30L));
-+
- /**
- * Key used to retrieve the value of the maximum packet size in the configuration properties map.
- */
-diff --git a/sshd-core/src/test/java/org/apache/sshd/util/test/AsyncEchoShellFactory.java b/sshd-core/src/test/java/org/apache/sshd/util/test/AsyncEchoShellFactory.java
-index de9dbf4..465ff83 100644
---- a/sshd-core/src/test/java/org/apache/sshd/util/test/AsyncEchoShellFactory.java
-+++ b/sshd-core/src/test/java/org/apache/sshd/util/test/AsyncEchoShellFactory.java
-@@ -99,12 +99,21 @@ public class AsyncEchoShellFactory implements ShellFactory {
-
- @Override
- public void setIoOutputStream(IoOutputStream out) {
-- this.out = new BufferedIoOutputStream("STDOUT", out);
-+ this.out = wrapOutputStream("SHELL-STDOUT", out);
- }
-
- @Override
- public void setIoErrorStream(IoOutputStream err) {
-- this.err = new BufferedIoOutputStream("STDERR", err);
-+ this.err = wrapOutputStream("SHELL-STDERR", err);
-+ }
-+
-+ protected BufferedIoOutputStream wrapOutputStream(String prefix, IoOutputStream stream) {
-+ if (stream instanceof BufferedIoOutputStream) {
-+ return (BufferedIoOutputStream) stream;
-+ }
-+
-+ int channelId = session.getId();
-+ return new BufferedIoOutputStream(prefix + "@" + channelId, channelId, stream, session);
- }
-
- @Override
-diff --git a/sshd-sftp/src/main/java/org/apache/sshd/server/subsystem/sftp/SftpSubsystem.java b/sshd-sftp/src/main/java/org/apache/sshd/server/subsystem/sftp/SftpSubsystem.java
-index 66a0ced..15201ec 100644
---- a/sshd-sftp/src/main/java/org/apache/sshd/server/subsystem/sftp/SftpSubsystem.java
-+++ b/sshd-sftp/src/main/java/org/apache/sshd/server/subsystem/sftp/SftpSubsystem.java
-@@ -256,7 +256,8 @@ public class SftpSubsystem
-
- @Override
- public void setIoOutputStream(IoOutputStream out) {
-- this.out = new BufferedIoOutputStream("sftp out buffer", out);
-+ int channelId = channelSession.getId();
-+ this.out = new BufferedIoOutputStream("sftp-out@" + channelId, channelId, out, channelSession);
- }
-
- @Override
---
-2.27.0
-
diff --git a/apache-sshd-2.2.0-src.tar.gz b/apache-sshd-2.2.0-src.tar.gz
deleted file mode 100644
index d4fe2cf21daca0d95b9115a0fc112438ce927f6b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001
literal 1280311
zcmV)FK)=5qiwFP!000000PMY4)1ye1E!xlgiZr{ASSItJV^(IDd7eQC-k9e>fB^C9
zuOhOltGX(yPvz<%Kj#C8s
z6O3XcN&VYT#P9o>|1-SSEm=O7SdCL&Z2$aopO2O0fAV|&awC6v{qMfc{~;v*NA~}<
z)xYWnzu*1@g1|rQ|1I!evj3Nl{tHg<`|VG{1oFfF-va-2`)AWIOyhs%2EX6_6o&t>
z|2M&ZoBgwCESukE2EW_>7)-+C5Bq-${CC^GE8gqhJHhX_KSGc{#{W0L|A_tjDaniF
z-`(K%+aLQZ0YB{jE$|EU3-tf$(^%=v*!>TE2aLcliT}I3|Na$5aNbeD8bwfq#x~VgKJh|9@V8%>Um6zu*2J3op(1
zd-ec-zy8As;>Z5aH^Coa{YO#q$NK-B@Ga*5^)(mE&uft_#rE@@tm|Aa$y)sEdd$x#
zjMG2w$PE8HFU_88#V^%deeX{BzX;!C{r{Ws|Bv%Of`9b>Kd%48zx@P%iw^j|eE$FW
z3s^x?%%5z@{>gTgJL3yKX+rc9t6QA*^?l%8ENe53|LZ5Mc&DGC`;+xC?U&E*$S?3O
zFu;9$pcuFR^;5lV^ZLJ_FK+PVbH6kblr8Uhn*iX<42czAzRwyg$8bo2g4M0OmFx3K
zh|E~vdS19A)o@3k#)m^Wf+8U#MzbqD@(QW|A?_SzgY;67y?cDZ1mr+_Uc1UkEAx);
zwD=rl#uraVk@fW;WAjdj7HH^v@7aRt0L-Ho0_1%>K%EP;H7e$t*LRx`4$A=J-7p;8
z_Qd^^GjQB62K1@<;!5xmae6G)!4MFhzFp2!mU(yRUC?4-->Bzl#`Dt+e5eA62tqOl
z`&^JE$cYmj8jVD6Z9+!daf85Rwq8`qY&o}liqwP-0kT+yT%
zuO0Dj3<xNko6?6M-6+yyn_k#aZ%QwCzm6*`;}
zJKZG!j}y;eBzx9sR_Ts#4K3@YaOc#9=k3}wUZsiDyt0P0VeJm8P;t~H+i5!Aq_Ak
zTQ&t3-LlLdjozN|Oy{T9vESKEte^RmJcFCVKAvz9qB(5&3?YL33u^`J(FY|Dlwk9@
z8%7(CC#dKb6wEkz=k$*qhnF=6N}3Dfx*YfC#_dy2@AACB$VDtP<^tz1W5|F-
z*%cm26KYZ>y%Dhp=3}r1kebJ`F!y-YLq|Xch`c}P#6z6LnpUVpj_w6O7Skm}wpppC
za}inH;WFA|-QB2m(-h<4n#`c^$5gP46x`n0L4#T0TaD{+Nl4gFpj+R&cV844?qKWa
zC-4xmE|qU40YBprM{J0s!yS+EGbu$bd(yl(Ct%WT4?L^9mISt9cQU;1A!5L%b`?iH
zG=$z3h@OHn51ZiNNnhz`J+k$7kSzt5S;EdcYxy-q5mf_dOYie>K~dqWNqhn8(VOUe
zEXMD>k9NEJ@&f@g3QCkq%=J;0Ox_ie&0adefbq(Pdp^CVE<)0gbsu~yq-z?M
z67Js&q&a&Sg~2YxwzqkOA}W)FnpsbTtc(|k|xxws^a8I;6$8ZxTaGHeYFufsU1m#6sHm4di^
z3*Hn8cS?oWR&i>Oh6)+tLrnk_%=mP{I2Vv;0=G2=l}u2esuWRP
zo_7<|z-YzwG8NhEXg!}#V0*E?qBi8ygM!jPO@&!~LNqIrj=5XRE12js$hmMQ48KrzLI-;BnhnH&F_DWYaUNXMNNH9p9I)hAuykbt3Sls+qY87+eY(!_
zA?+`WV#4PmE~yD1rpdutZ|>`}DKo6JFMhe%FYz%y!Zc@TPBWj`?oV)!gicO9Gr_P`
z8Wgf6lDQ^N
z>Wg&tBp^jMEXZ3NW
z-2*g9*ySo9t2tM#^m*}$qN*r`J{{rG)0?B=I-lP8(=NC&b({VPKN(^xZaG}o-u94z
z$i?KyxW59*a52@*oSnzG_aM|g3mZDL#9E%m^c1pla`F{5vb8a8pNnS+Jj5pV1zd{=
zy$WsE>QanU-E2jXc(ckH6iKu5h6>A-3(kgEVBRx|21^xhOJ>;C>x^4Vk$7Ofy@+%+
zC5Jlk#~EJl5Ah5w7e4!kLj+<3IgHCV3=35q``ARD9q&!x}NR(@r4;oFev6#GYA^
z7VG_FOXZTqc;r3`kr97-FIFVAJcrxS22~D@JDSY5<$WpLXp%0=y#d+V)b!n#@L+mx
z!K?Fm{xmB}&NBvB?yk&7Z=l8Ptst8ET?FCT(mexW%hRz8Cb|Fyo!IEPk@DG8mP{qA
zMdutZEK(`WHA}t<{ZM2A$t{k^F(m2pu7UBxztsJSvtpY8QfE~U)temlCiTzTy?YuZ
zo1;a~_xCrQ8e$`V#%ko6fvhs;3JR_2zSatc-1@09eG7mC!o5f>_RI$i75xba5qOC|E6`5=k9M8bZ^LRYLR;KiX7E2;{
zNn&W$6$}>4A@=?LJ}ni0->R8%n=KMNnox}_18}y!Fl?~bcHrM+q@XeK8D*Wg#487L
zv(SfSyQ)i^mEzk_=g-{KL!3{kbR4}YnRo*?HY!hU))utrT)SIKoMwdMzM4t~x`Q9B
z%_s$W&sH4Yry$6sJkGBkA>KYKDmttI(C}qujm$=NNt&oM-178cr1`Q7P0-Cw1!kFDu+rj0TPJD_?Wj^%|XLGITikQa{XXKQs~&EE<1!wTN0Y+6f1
zDf**hz=y5s_sG>{BxX}s=kISo|Ez`JXH~yN_DR+gvrK~!IU<`ar)kc*9rirQmc5W!4W;rmag}1%_aYc
z)K!RZ_(RY2^nO{VAc_pY+^n=u1;{jeka)YEyJXh2YOd9OetK3gHJ4L(t!k3@MJ9_c
z!f>irF0>wqHiu>&Kt`wq)f`r|+O9`u4OYV#Z0FltWANeloz*7RnOV9J>m#*=G-R9>
z#1eU&2Cox~OJIl|NjL8dpXqGPI1%Ga41WY%NSKE3(Fpu8WDKLEdL_)9%j#kq>S5E;
ziNWRy(h-=+H!b`HgMqj
zT{vgK8pO=1QX?$1t+pvH;cl*bqipI{c?lEO*4I&xo$lmOaWfq
zg5XAgQ>9&!hNZ$=It?q8!Vk++UackcipDS9_?p#4@wl{g@VSScXm|HP3GjN6rB%i9
zQQ+-;dk_8Mfk*^c40NlBu6GG=
zugp|4O3*+q(GK83Aysn>nk=;ZR2L@IoI`{dz12jc$eim;h8l(ek)2xXj(D6JwLg_n~--0ctV1c|uPf5Yf
z)LL!wu4jlmQjMi`#NVE`N8wNYTgE8iC=O%y7!D}md$ZbiiY@9}tO<&zmGW^!!mq9^
zD2xt!*i&7^_QvbmFvRQS8iKT1AD!3NqX!7!6}pdp?a0KxXgMYO71ZF}=Y0-zYv+k9
z>a9g1QD6istS8*)N?MXC6>s7zS`ZINm1`@_7MCHVy6z9`xFjcfEC?DFBMEt3$c({c
zyxkeK(*-QTbHLtZ$ndQ(9kfrtfSfzGcSHvkD~8agdmm6F?7Cz2p-9Fa{vlpw;m|WG
zZ2Hrx=sx1;E`&JmxkoOHJ
zgdI9O1xj*=nPSbNv&Y2RA-Ed{mkL1#cWiuyE*{~08RatTDSg*j;0dpzOHr~N->bI}
z*Cn8SzKOr7t|6|o>&=ZfvfW27ZEHP)DPR{hr~Tg+&T6G0YH-`C7yS
zMp}NZlS9|Xlb+z?ULkeXV{d)zn;cSanqFJ5NI`b%FdQ*EI3g_zPx}i@POn6VS3pt(
z@v1`PFlaBV$InCqH-^dZkH`l1#m-Qb=D^6LpPLAJo~G;Sw$7{!*%Nxq90CHdbUP0t
zgC0&R61nw!9Bu{Ef!0Z2a@E}($#0p-Z)qz-pssnYv}x&t!t=yUO-iN=usPr|72?_1
za|aVDm1`Tc!;J~kC4_wxp|4(?xnx<)gt(v@L;KV`kXH6;SOg_PDd3Ik1h#aC741Z?-2{fFu|&=0
zHlA!EhDT_RqGtQ4ZP)$Yk+vP-(bMnv${V~7driejkW|>>0ZXi28>m-ijDvpF(pYA0
z3vPQy$U#1Bh?X-A8+5$1$BSeF8-Fb2@sMMvb3#aQh$p}$MR+G#Rmv`WvE{bK;k42D
zxP;!Ph#R_*!y~4>k#Itd%P7-LDRN)gX5pdR0bLxxku`N^Tj_|vx(Y5FQg08+8$MTB
zJ6#2FN8|_+BWMgmi%kD@-%;coS{*+ES9;?tpgDglb6e)&F@ofLX%PLT!B;8#0*f)Q
zJn2CzAz77Bu#ESCu_)k?zww*jaEv;M`Oy=iPKc@I!zTz0!Bfwx_ck3>C?|;5l_pQL
zSjf8G)1VnqmqjH4C_(GMesaUlB0N8Kf942K!kRRp?G@&`v&iL)ZX*9h^C~RF${t}g
zhLojSfbTPj4xn1$8&Pg*9o|3kpXQBpX+G|fmb3K{L(IA$XHfO6y=IJN(kZ42!`@0o
zZr`4~U`HlEY;)#lmy^BL@D6W2UFHy;gysYb5cBa)t*}B;?3$K54u(opkAICP6&MP=
zN8M3fz}DT&5el-5ev#3O?xB&TpfQbC{T+u-t4GNqh4ASabM6Bru^f)Os=@^j_0CLl
zQwxyX=ZDyuVn+*WH9hGMD|?8A7s-L`&$vIo@|TegkP3zaUUfy0kAZo}ulsNxLa6+V
zM)aNCsuPl4s!E0
z8dz-ME2mkhn^r6N!=9%#y%8uyq0zGzIh|L^M8iR$AlH*02M3d0C1N<2Z#>^0M?wi9
z37m*G*xMsdZUQ{Lxs11^HtO(V|L>YQ}f#6Jp0qF~vo89x$T=fh^CUxXZou
z;qG;pm$yqWT$EZyC3fQFv!Jl|_tW8lKk?Cd1HNwR3nu@cZTWxiz{C%H6Z{e4{|JTs
zWBecc5&!=d_!jYBf%_RH$e*jZLVuoLA8wuflC0VHzVjdWg6|*y|B?WJ{$uD
z7Wn)4f57Sr_xD@?7(_(~p@5TFL(!&KxmuWKoQz`*_t@%kbrTOBTwXVo#9J^d#@OD3
z+RlBqnaz@R3Q$p{tS9N^FYB_%(IeW2&b|$&DOSq0$+sUs+msx)xGH38J&R5FkHIkD
zFVQeR=q<-%{Q#~7MY!|Mn|YglR7FD%XYa33vEK}a0e>3}Yg9%MPD5e%DpVX74$aGX
zL`Mcc%6#fxk0dyXT^l2U3AnGf&3qwgN1$^~B{NlY|HuM`J3czHQa=5l6raD3iutm|
z$o;jk8Oe;pqp-K`p!3cE(tk=!7hkj;Pv??|3fbgqA+NXUO751Uo#z_;-P*WjMN?
zoa*!sMXWow9#iB^6+m@AI=VnxvN(5C0r7j~rZ-2)gsOVhU2EBn!Lo`{2N;ME>>0|x1!~6
znL=bbgP+FR!mR0T6q(@&Ol8?4kZ-5C;fU9JpoN{ZFp@-dC5>jh)_ck(oFam)OJ{!q
z{#3-2|94FHH=X-?kHGJXKLYAR}Mt)>~eh2&k_#cKNy!?;v^K5RJky@$dd%;$
z1{#=EpRMRai{`V;f?d~jXGUZy^V9>T24>zXb0cgJB!;q-mUrElt$yheeHHZ<;84-D
zuxTQeXlBfV>p73q=!`Jn6_}2>d9P&JSjN}+nOvexZ
zbIc8HbRAs;ET1fydEkqeC?%jO$W7OJ)mS-4W7OJwl7!_}XgylVJ3F>_I^65~!;_eU
z))U09Qfo#Hu%E)(B-YYD=Sytc=1fpj#FpD&L}jaCbf{2dem){Ms&RqD+-LGfZ
zW{VJ$zP19#YaEs;>Rv7yPa~)+fyKNxSwdUsK!9A&3Vqjma*11WoHu>qaZiHesmhjQ=
z7yzyVgHa9r0x{{@yPdBg1>GwSV96e2v%4jkO|D0!CEV?py%%#1PTGBXm8U~ZafSu}
zCpgQ4_z@I6jOZt;
zd`M7pvG-tzFNlj9jNz?`-RmsC2lxIyc^@PXF
z{hec$wl0O{gSXx5G>3cEB36@|iM3?Jzam=chk=#z84%c~QlhA4?5UfEn6SDHi93TM
zE$wP2;~WXjMq97>^`iC!+!2?lQHAR_>v9~>pK?IQ{pUW-VIght=uy61BXe!{>)Avf
zSK|0iS>zoNV^96uV$nVEcZI1#bzkClZP8B~h}%bO)8XK*+*@;R_@;=}o=Vt^n=8d98$dqfLE777%ad0!idW
zLgY7Xq_C`LDUporip{_?QeVk{6?HWmGbhO6i1BNEW$u(~@xkomOL^r3dXw-N!nPkqcSH+@TXt?F
z0hO3TOAmR4i@=rHLZ!iaN*8qwI*Hgpyki*zeO8tj%Yuo}Pz|D8Rwx8(Y`WqtGnsP&
zOg=c?nLxng61rRxHK|1fSC8j(Ika>KG0S=%cWJ7$gK0Y7BX?7r;)S=3v}}*0E(|DN
z-Mh{MR&j_FI(?)dZ!_tSpvQ0GkD&j4?Eim1e53t;?BA>We(eAMq3{RLe<(>}|ET|d
z)c<`G{7d`)|1ITz1N|jk(HvMq)NnyyIE7~pA2#?CSFh-OSjwzvoMdR-;@y3mDST^o
zRHrUnnD6Z4&_K+d*_O!fp
z{gUCykvnkeIHW$%dbudetb_*yb9hicOfNWz6jLhqZ$btNSF>NJ+=t0k0b(jH$BKXh
z8S%R`O9_=L`Le;Xg2m+QR&IUm6*V{Wac?#OtfEk1H@
z9F{dm^PQoR1<6zLY}nc~9u$P;$QNZr8IRLIy*4{;SFZ@bpH298Q6T3TtM@sXs|YvO
zP@E3+QI!29Pi6Jd1yMaIlfX;TC_aIxp+DAyG6c8Z(ORG>>FpxP%Q!ksryXaulMXLBD8%hc>mFPkf|f`f=DizU3r?Gb*zlhX_4x&;ERK`TcI6kcu}e({7LKVTI;G1HIO8
zL^di~1Cp7*Ys*w&roEx+GejsRMi!WFzL@KuSStXucA4N0JZI_I!IMmPR^&Z_1$&erUr(Y#9sn>-R{_!1EhjW@N`{JupcfJ`5Cd*0
z^8oj$f48nT;NIST`oz7g0ue^LI(5Vr%O?n2l5(3Vnk|vBAm{F&<_AqQWj1@S&Bm|2
zWW*^7x;-H-57NuqCDN%p$j+coQ;#1YfNA-rJYPguNz78z2@W~K92mJx@X~mt8JZ3+
ziHbZB>1lp3KZf&eiG`XIp#}(M9Kb1BQ9OwAqnBFXPZ%s9-#lRTN8tZI&j0v+_@42f
zB1Z`VxqV3t!jESB8T$qK1^W^G`KI^-@PFj<=O6NaNb(2&{}%Yy;y*yId?_}v7p;y|
z?TA>GkrVfzS;om3QCRQ*C*k$k<}4a7DZ)^L01Np;kV!SPw#@f-hyPkV6&U+(v;VP)X2>>U5!uys=D7{?c@im}+J
zW_6wt!j}f<0<|R58${TXGaK*e^Kbnt%>mcvhu*ZTv#K1EacmuEoKxvc<%CRSuzz9p
zz*lPjH;ua|{9!ALtrrYocFuXw{c`6DiX+zCm)}`Z$K^xA7PdRMuGU?Ev2P&7on{VR
z^s6A;_wWRn0A`8%xD|HyUI;5acM$bSyyu-i{R#L}+$`shozEZmr}$&=KkCQ+?{~uY
zCCi7n7?)#s#y;+|hlAizaat9b
zPe_H6(!zRXWj~}XcNJSRJvtr)PmJQEw+ic#d(bI
zr#~yD~wsS-C_tRM58o{yW>@{GKcp!|8A2x
zhs$A%B(1_EFw40Y!7;E#5K#YYMWa7TP-AaKgq%IRz#@BsCy1O0H18GrXq}@*
zDsb4(FhWW+iYMT%NFnR;V2TW=p=uQ$iiI0T)u|csgP?Lg~k9TY+uGuN(aUnXv>~VFwn8%%|lT+P~IaC8G(s0x<
zF11TU8eo*ZY}2KtDtuaUsUQ-0OWFqVP@%i%LLDv|yjXPV^J!idn
zlJ0WEoe66zTZJ0P+=Yl8
z0XwSGE0x`BL{lBk_M>&K%|wC)EFPX6Jg~w8&&Gdik`hhKj?CEZb&Hfk06nL~@`M}w
zOe}HvXbk5w8Sm*E*4#jk=ct`3yubKVm-(y$pKt56s>rcwQCLg8T3|qtrxbAtw|@4a
zR(R`TCk8jos<#90<}|<{ZBAm=w^M&dv-p`r%eEJIOF7L)jjZYucm;0UGa*-~?KZgm
zUD!11;&L!eaHbsI;LLVo^`@RFWUQzxTDVg%?QS@(RjKZDQ-HKx`Q9}P#2G3s-c;=THQ;X=?~o%f
z&72DMv^>M0g^_3(%-k9}5zlES(jQmc!Vc%|LiB=}gMnPJ0kAgENXdSZHF9=IQ>Rc0
zc2s`b_PNI+gTaROa#x83{?tqN;fD_Vfq%dsL;vCbsQ=&}`tMudd+I-d`f#Lr{n8E;F4UITp}I;<_nohmPZXALu-VIPZPBLE*YwxU55a-X9tm>P55L
z?>Y7vLsG@VbR(Hm=WIKGW;9F*dxhvW7Y+KjnR(mFZ>YGxu6%|xw}Zt*uaEv3sWg)1
zK6>POnPTR-5QRAoFBX6*Yykg=k1
zjpM2>=zVw7WpDu*$`f^wG7|TMmx|LSShl9WEJM5D9jHuUMDQYF#9chTp-Q}zbg~AMw>b2Z=7o(2oOOg`gQ%^=o|F-TK_~(Vs
z>|Yzx9>!F8S|c8*K&YYyS-eRLY#H_ofOh}
z1m$p;P`OhQA-r=HEC9wdZm})Kn!I2rdMhe&zKLd}>#Zjp!bfpDla3%N0jzl}KP$xv
zOXZzqEuE6QN5(9mi^J{KiP78~%<8Z(9!Bl_3`{yeyKTYmx=&>HP-bNtWJ$40x4f4b
zu{`d&na@x01|0iSgY3l=KMGM!%#{K24sFC#mJyGok=mv{F8)y-zq`wRTZNb?M&-7Aw<(?uqJqD#}Jg?<-m^88+oe(onl4k=C-iGR+KNMgFpKhov
zz!;EHqaR-?$+bUMlK)HI$p6{dfPa4z><6amSQ&Xk0`ujp-^7rd;Gw_iXnIUph1?%c
zU(StgO}P!Oh{;inR&fC_5sspMysvVT#FXRSMJi#AFNv8|SR7L14BK*A$8nDQS{kq;
z$3-Wg{kXMD`m`Mi7&p$(>@0ixv0$@%=?7Gtzivf7U(ai#ukG}b0t2Sd*6EZ(f5
zlt*RK^b%w8+JNk9h;AI};QL9lAN>CZ|NoBs|F7o){ow!K1%Ckkk5D-Nga3ag{Hy$5
z3%>0EKwqiLrZo;iBoF-50Ls;}?b37~2Bm#2jAP2QQ;qOUv-SKQBxNB%lj*xbeAYAf
z`Nwob3U%EmysLp1CV&`al+E1W<{UlNMG
zoaw{VEC2TiMZn)@6n#x7Qvcc*sWO(aQ&)RK1g~DRHAQS(Gs}UN(GZp@F!Z;6Ig(SH
zjx2QPn6W$74E#YT-PW3vp1Xg@m*h%PzCZMhWFMUWA&vG-Nl?@h?-}@LK!m9ekK>+_
zXW%#H5I(}-qXRi@ZxVa6@h!t&4RJYT=2P=E#JIy7>C09J?0J8jfPhEkbL5ni4BvMO
z)TqMKEwE8YRLxOzCmCi2s|@sdemxN9%afwYuQ_86X2lPzdjS35Z-(-6p?hiCM(m6k
zg6c&Af5@cc#Z7K2kZ;7$?i87Z1c8a#JQA)yU&QbTtA;Is2`**ePZaqw{>#Mi55fO_od5IP@V(Ff!QmVE^N!B&
zO#k43-vQsB|Dm5Bf8+eeANk+k1i$nApMNj>{CLVQ^gkAUu0@}Gsrvk4_AifoOujzy
z5ibw+LlJI$99fy1!2*{OD!E-JwZpMh?kC@p0z?KUQt^^Jau@X!5^;X4qEM)Vsg=B3^2Jo7-2`yS5nRZZX
zIwSTE#fK-_zUy4Gv73BTDK82}mDD_zO>sayh&>^7=J{cb_R15C2p)!-P}4k_
zgcpi#4I)pvxv)XZ^L>>wwIA_n^EVmX!iF28;ZV-YGH}xbFg6NbeA^EnmO9RXolEGj
z#RW&}t>wyVK4WG)I#r(8ppPC}N3ZwW(#NK2^-g9M6R^HTy6T@QF7jX{gK7XpdcJK^
zyoayDxLUa-R+8eBx!&gLJ}}9m!X6)_+1?#OAw7YIPM{u)qC6wR$?6&DTXA6J(*d2D
zcjl=>5=o~sb&1!B^+&L;7J6Tswqg4ReN}b^kdhd08|St`cDr9AuS?0OSJa-t?|HB8
z?&G=FY!h(LGS^D`mX)@`xlN<=$}+3<8w6zV&9}iTc&jyb^Fn?&*zQR<6*^S>Ivx|L
z@`Xd?3k!plc8lS=P_&2a(xyRqr`+toap6WaLeRU;>G#L{l(U^#7DsZ2!TI~u6r5*T
zMz#<-ec#X~&BvUD9&ZM-ZAmZCJ8)LBSo8I2$Fxdc4S%g{trXtm&qvf%HLtx6x6H2a
zfpWx45pd&p%=y?G+Mk~p27G;JnAxqqK6mqRSdrA^>|NvN%7UN*x|Wqaw8TrJ>*b#c
zWqgJgSaR#svM#=Fr9NM8&g9r>1Zsnx{o5g0;jcYvk-4T5{@DB$H*BmR@
z17WOSneT0$_eu%4bSA}lJ+{F<)~a~-Z4Og?JIN~{El!DC_g+23Wz{^+e1Am5`bH&Y
zq=kW7;DXt4Ah5ZHA9jcZsl2q9dbBT|>&w9FjdX$U*8aXJ5396KNopQlk=6t<=?Jc)
zcd|&r!~n>-VuqCe7#UxH$1VaSPv&P-zi|kyQ%n6IK?_
z@*q-Ri#dFe1yI6K4VhZBV|?;N0-Bi86&k3eEEVNliWWz&(6&)QQ0V&z1}0^1P~M4Z!fPubD!kqQ01cCIhJ0%ngDpe
z`tV-eOXW@7tkK&9S(1CT!f%BWLreX7$P+Cc&`okEgYIKwPwxhmO`ftONOQMz;CLxl
za0Xg(D)L%1$aDy=jGw@gqM+DWIhZJ4Yc=&F)Tc-{=c~AJqhq0Y@KF)cEd~a3WPF3T
zW^Pb)tlP$8hJ2es-Vsr)E<%NhD2$iw*ZIrg=ZX!COK^2=v-D(j$w372NqfWSdxJU~
zGqcyEKUsOJpa+>`cQYGGGOi<-+nGXVdqEvx#*FG9I1|H0XqD6JMcEenE
zKE#5&$+hFwkf}drX-ZIzx#f|MX3a3#F%HID0rH+)B`ojIMe67->4!SM)=X5M2N3O+-sB81RoCI{|-9HvYLchzFANR)DVtf$t
zm$uWNX)Dj65IwrS#v(H0R~^KghubQjIY~Hn=AM#(hn>L@9s@c&l0$HhcR2HLt>dgT
zA6*m}uhzZsvV0#yJ^jL7_xHV}u42^T6ft|H14wA2rp#d^%qw9GwyfMPKk~iL#)}+&@(4qQx
zkh>g{?ZQDgEs6re;udu|VFz~j4Fh64}_&!zL;o`CzXv)gC<#P4>AbW1#7hp|t?F9xHQ+Zw;wSeWS2D*F~@
zHJ|Ag0h_{j6j34V1g$ZEb{xj>)RBsCZT3Z>Z_ai5Wh(i*Wgg6)>fXtSAsGmQN(wO4
zm=tMbYv6untb7191pu$|MU?sMyL$_HVvI|#))+#uo>>Eg8}4;=+3439!t-7C7T$KU
zrM5q!<1(pIqGeL8u}+kUI0wpv0wMHn7#-YxGtI{3)aeElv6ZdYCj%CsOBNl
zQ?aI6$A=@p>Swiow$JFp1n?99LEEVx{f+CjynsxIxnJ}iePM=o-f6ZQk4UUZaZi%;aDpc6lOzNiK*nz^DyBHeJo4}nfcHdS7sb6n$%m;apvDPQ_o7V|!8!27
zs@}dp2Z-K84F?JPKJ);aLT0}Y1#vTCFUoN067DutajB_^KGG6KMZ(p<)?8E;Xe!&t
zrsS%KI`)Ndn)8{~-5nhURS+@98lyN(v&xog{4qUJLFHuY_N>~gySYukH`%T6^R_BG
zN}%I(!e+V1cOV}GaCH;=*~$!l%MXij%xV)HYM~vKz7hUGpG5o=-u)Z3wIby}4&}?7
z0R_Q)RL>oF`L79&vm9#4Kz2|8G4d#m3Gc3yIw{1gY-018Naz^*W{8ND{C2k6)l)W@
zM8v?408C{@_wM1E@ErO^I>{|U27V_;z2h-yPaTByISl3x=n-V?l~Js36#i!gj-k6M
zxFR5=4LBq#YcdxZP$N!i0;yqTMP}GlUBy~GHS?Hx)NiMIRf0p4rH(ILob*c6Xjo~W
zPa2c>|JZxe_~*$oZJ5mg0>~hU3Nv!E2~L0{O`E35mOX8frrDdic1hASOS82}qacWa
z;DRfIySP3m?hYajwQ(VdK&2|qme9ZmZHPLA>^pDuup;$tIN&OMT53H
z4M0N3uh-3uv|P%HDlb@_(s+q77gM!6LPi^B!b-
zTFYJ&0+&c#cNkIK=0s6W8=G~QG}OMm-U56?-3)1QuIAfWG;JYu&~EWH67>K~=aXcZ
zR@xv`veXHMmQ|e(n#z0%*fZJtW|&
zF!dp;Y|m#UkznbOOjX55YRe(jgtwq&^v6#3UI4L%>Je+c;{ib}THX1k#s&(u&K4%4
z@Z4B;^(_aTX`!bMiKtD5)3oY!7Ln0u*~rTGrwwbZ&W(9IbphU4FSY~I>@8`xS+%0D
zw{i18!mA}-&g5~1TNy7TxXMfH4pnJTxxxe
z=@D~(?#YSNra>NJ;>6Kfu`aT7Tb7qRFY<#VhPsR<6~J;+hX{m~T@A7rj2`7ZFo&kC
zaU}~#J6-hWF3D0W7_#*L&m_V`|IxC$k<+k&!?=eU*utL1u>PKgK`4*Pjiur`^kqmx2l
zMxlbh6RpkURkogtw_igI(1b9-hCiE*1-_bPAUG}nZ@o%ZE|u0B(Xl6f*g~~<5}6_w
zj;NGI>yFFL&1vd)>Fp!kUJ2-N+lw}EaNQipeNzS`qwJ*{6|B{A9gUmqCY3ryu{N6v
zBSx#$U?t?@vZQQlwc_DvTd1_6GwU;x?e%rH{51nOT!ez$pVVvArQp;NlSSEY`Yq5Vb-e7hFsiSb3&7fV?PONBbg&)?`LtRxncAfrEG!_+
zjR2C3JRKL?gd&%bzHExAoKqNKJB=Lg&c+6^1~gsmuvurqMmjW5Hes0y3`u(A@B0LS
zJpLzrg0$dIpa4*^ut$=?&J(!bop5)bEI2T!nUPotrb{>vA(rK()0$k(UQx{3E@K_!dbaynxtaFX;}
zT&w`-sGmtt8?s|it``n2N|8vwRBr^u!Lmy>k!?~P8->0kBsm9XeLwQ-E>Seh@jyWW
z&j5;gz=z`@PO4i@E*5EEq^3+mxd$35G_Av$^PEX;)ospE89pV8LQQQkROge5iW#E=
z#KSZPrP^0ic&uP^an%{wjuV>cU_3*Lj$?8&nfHf8cSO>GRJq-t15ecq%5)9uI++AC
zK&&Nut-u<`8j7i{z6#6B#>m=C45k%HH6AGoacLy|01=ELMWbL8BM6_ghM=%mj1++K
zAZW(Zp}tYpbGBi2+8ctTH?^JBZ4zs@)n+EbjHnxMRl0Js2Q|k`Q*fv??g%X+FoCda
zJEKlV5gU1b2}U(Ji5z)8#J(@P;0$0YOD>Nd!xml}29)OK%
zRJCoqps)yq2Od342CS&Go6YXHJNMHmI(IY{Vlv4x1=#{kR`11p-R|dRIvWQm;B3*K
z<~e9($&RhDdWn_VM5j7Mh**5L&eBHDZ}nzPR_ie82(pJV#x`+uK{p#y37QIkUSun%
zw|(4pQQ5i8(Sn15-E~b&CdJt9Qn(FQh?2%0PgEZXdzOo66tFZeN`
ztQw4yC<3{m#WvH^vk8Wh)DV-gwy+&ITee3t!)OJvR*5U9=6OY7Gd3AbfQ8noEW7KE
zS~T5-LZY^34O)*Y3asLd5gDoyh?U-^sRlTT*M(0oW6efbahlSIRc_%vk{2!Bb4DYg
zm)ND#$NYL)YuR`)AM!dW7xs7-+YvNitJqPtbiS)s3~gm9+S)Y70p0?tj!&>#xK^(-
ztudNqE{#$Q6vpF?11l>BA4R^GvQjZ?i)yg!bWzsE+L35XH6Gr0gawd7cgBxP+hB1<
zXBDkelNl2SbaO8yGpJ@3BhWNkEt`(eJ@P2{Izl5iGn(&YXFb
zKy(UCf;lbot$IE;a43-B)!67riD$85;HgucQ_wct$U!BCx8$1&J8)K_PQ=gKP_QZ%
zn_j;T)Ix1zz3zf(E+%sn3y6`RgQz#6hgjV04;G;2H}hawQ+>cx$1T4*?ZH_eon&~$
z59cK84YtFy>lU3g2sTv~&alEOx5#%o7>yBq7Izpk5twGLW%@t{ujjK~KQVZ6h+APy
zB^_I9bJ#SBYBOrolU2HI2_si=Qe5+^Avw|muc90UHbrO6YQU(Qq?qNj+oq+Z=&(pk
zoN1Rmec=ote@deZheKOqYOd;7$5TK;p@+6E%bCkAXBxXDT~6ZR&84+XcFp!!+&E?+
z{oX5?DCbQl9}fI>RInVG&NQPpjcXx7ByhT&(2cp30-~qq+FCFcG#-~NzF&ykMw@rF
zOuMoRTmFIsI{t8?IlAi^&TPyCxmy?s9!>Dx
zW`bxVX$xQQ{#4G_2(8T)5|QCfyI7@OgO%Bu&3qdGvk{DyRppi=oaps<3Uau1YruAg
zZ~;zBhMbRBziE0~vLP0YER@*BlqpA>zH2X~STg}q!|i3J*fF|hlJ%%RCSb3_26L~$
zutFkl*df`jLK0krVRryF%DENIM7xLB)Y3!SDh{j`3f~)b^wL?_C5lBEOBv;seb4+*
zn{{C}L-NvScW}+hNJZorBN~NsnyLk5BQm211LCPjg=lloXz{6CnzKBFOeh9R#$S2?
zmhpyM^jHRGYgO=PY+GJpb&wH6qT@BTl>0m&AdQ~vF<6yS!)EFbeWRaa)8=3_+q4Lh
z?3=z7RWrKT)DWQ|I$qe5XEste#TrZ|;FJV5%{6VC&U8W3cGRYqgLpiQ5PQo)Mx7)Q
zIZ5U^O<5qEe&5#uY&qNvqqd1!y++!_(s%?^#eA`L#wjoBAg|6WQ%zyQDbguxiybal
zDbyyYQ`0MCY!VOVGq0oQa15%G!gdL~d{tB&49q3&Qrw{wcXxN!;uI(pcP-A~E~U6z
zad&rjcXxMZhME7{-LtRzxH);r$$N5hlN(BOsK_t6Zi{whs#d@3*T3>)@y1A#WHRt+
z8F3XgF|rR(OQj3oizmijnpauuOA;NfwGsP@mr8YbwBOWlal=GNStDUHYHsH9=-|ts
z64_2L(~1a(70g*X+caG)MXwvf#Wj<5$_ODE9F%0-4jFmuUQC&p6UukPRnVy*GXqg=
ziDpx<66bfUiLHy6Tj}g<;j5Q^BfQw_JMuu4v#>ihQVg<2Rgv*I6mEmfhig*ZnVR$k
z>q>KKuG9F<6Axc}u$Z-HwNTMKl!Jq+64Bm7g_q>~^mxaY@&A2K7OVXeMCco)8X>h&
z8j2-B__-mI^Y^U&crFM3m-^~x4y86L9>UwN+9MXXPn_DL9G&sxbxrHI;m|@bSLM<5
z{m{$?ltu2{Wor-eq}AYvq@ru8i5>`c?Py0By&$`Tg>
z1*qvW;Is17-dyyC83D2j$!@^BS1$Lq7TY{l&|2|!>4YoSC7*PSkSW3^OC%%N^dXf8
zwAVwXTtOX+oXpj$E3pYSD~)SoVWuN53GK4;n#4ROk?D-r{3ux#>741wD&FcZ9V%03
z_QdGe%yTmd_l*qG-}+{;r-uU7C9o4?!!l&V#h7l=f3@6mpA*j)o~%N4>_yHMJPhWc
zf|AEd!mJKRYolhM6tI~QE{l7@{3O(riBM)>OcRkw!(N0F)Tl-Kxe}C9Wf}{;Vi2=M
z4Rm=OF)bY&90b0n+{CYaOPBJ-F+R^Jp9nNGrySM^(O*=@;R~)0>vt1zr;Qdvch8Tg
zF^j2~l5K}S|3!0E-DsL08JfB()38#SqriXieTVL>P442_lAk=u{6^z4YGdz15%Ub;
zCeU0R&NiAB_g~YO`sM@PVbXbYnjpB&!Y~PR#D?Z5E9Y*DZ#;58=f035MQ&H(eC1+R
z@AI{^;;?S=wg2A0$lvOpiZ`ZZ)iqAtL`#xNtTO*>TS|{MxT=Wf9-bc~U}|Cq#eK-D
zHEADnseEfW*j}c}SH;HS{kw$4mx}Q}NQ$qpa!eoCs2B8h?Q34goPRA()hW${U`_uw
zm8PGnQ3p%an(MMP7#wYyh;|bP{57N+=HmuJOD39ITK)CS61
z1;f84(xzbz!F&N1ZAlJ_tEPCTNN1g(C0kxgAUyxi?>2|O6f3W|ro9_^>ZKb{+sOWX
z2SO9B<*y%G6-f?cKt&;lbg|)(7s?wBq&DpdEWk;0_1>iiOom4Vcz*k4=U34#j-Q6t
zY7wZ&5OI{r^H^9hQkC~QaiYAeoTTRzk+_^Wv+{e{?CRM$jQ`A@wp|j2vfc{jL=aOr
z`x5ntJxa+Ex5xmqG3?lR>GBD?;k)VyDH2=CdE^6EW3^Y$1!nv7@2WVv4wV!rMOPL5
zSS3|7G?^`}Zj0@$p^wnX5@-wwNx2E82_zl%r1hFo*1|0b5o`+s=jx!!at!`R-ZM7h
zEnE*=m~0Q7fg$Mz%G^|;Npggesp}efNag6K1f+EnvR_N^ng|)Bxajf(ifz>%)Yd{m
zNaQcso*)}W5SP3m)(^4Qf4&!H#bPxvG`47WEPWO3#CJI6jX^4_|afMwD%~j!58<#BW}CKP6>9F*T#Mx|OmD=J4F_15((z;_-@JF@BtP
z3LZlz9MwyAg8RN#Feq6LaAl368ZVFg^fI`5k$(o35U=r<5e14gv#Q${=EEID(uH97
zttFxw^x4nm$f{&br#f%|NL!0i;=m+wn5tR9WyKV;={OMs3OyeS8@H-OhLyqM?2e0<
z8Hda}VLHS>`4Ww9x8{yY#UZK=(WZxSxQ|AWup(Y~3ajHj$Z8TiwX`Zqt>Uq`KU@gK6fcqTP4q+LbVJP
zvJ|-UTX(OC_M}!)8wmecbsSfvte=1NX=wMa$*6Q^@1evTS+}%l%0R%5%UoZ42>oFP@krN+gHHh?%xtlqr*
zvzV$#x<22B+h&+a_cS&7#Z9qfSA(nU_zHx6JdnaP!fg=3xF?#l?*DA&&*T?S#|*+SIQNX|%tfV9G#Su+!Nz
zGMHcI=S*z<@yz-uKk(^oa>_E}8moTDx0n5W$tPT;?K;_(uvx#1Hwv*($N^dvT_#cZ
z!GMgY*jJPDQc#wikRQ6W<%6mgoi+=9zPtfpOEnjvJ6oH6E@)li~7rHgGs)Mz|Elw@^nXVZ#s%1owZrjwA47~Nz0Wg%!D`oyAB)4
zQ`PYRkyS3)SW>(8zq0g^;+?bQkdwch!dd&w{z?xF?xL6N*6gI`(Ik|j;v`NB~EHBDJQH$da>gE*k
zT!wl30#TPb@w}tuv|=f(8!;SJ3I67(ho~0E`$ayEQ<|Y%(hwG9BJ&qQvjTsyUekN&
zDsZ|4Q5mfqZ~R%jEf{Z8X$`|W$*BoId(=7tQ&~NtN*7rXT;;{cGr(q~5%G;l+`CWO95eOkpl_-XW
zqHip9WY0+B2^X=cncm_G6B65t%}DR|TXNN-V3=hYdYM{EP_Wf3Aufzq_56
zos^{0COq)K`NJ_$&?Wl#pOCIIf`jyziPUFfpO0UvkwRnKvrWo6x
zSr{R$I)(oyl+c`k1fvbrPVA>vsgR*iBUEaQAg^q-zN(RL4Np5CDYE)631{5ajtM-
z$^5TPl|4*#@P&gG!|%Fv-aIrq>ceN8iO9YI4Nsq=C0DA8Cp&Ws)|}!+nj@P&jFp}Y
zW+F!^q|JX5o4k^6J<(33$>HHYWT5Dp$M4^nMhn(X+ncx
z=8O8H+EBt=-FopT9t%?w&TD`270A)LZ3pa9c6nlH(&UNttET2V?4AZTpf^>`I@U|1
z+yoC=py>P2q?>5)i0g|?dtgw<*+@%%Ue+vcdws{j>SF&AE8(QkbO23szF{kSh{2GS
zpCHNKr%IF%-!ina!;Cb*GjFZL4AhC2RV*q;t8T`Y-DE;q%?V#kBPOE4PsT~C+p;3;
z714tc?a3(9I+2Z@^gY)cc4j5b6!drmQAO21;}>~1x!`J?
zzs6BcQmUYCS-aZ|Dy>BQkc`{X=Tq%+7ezJWNAXJj!I9L$OIIoWCE8R%L!^c;$GsXM
z-*VwA!8rrheI`>{oo%8=#Y{r{c5Dg-Mf>U3UHcy5Z_v;ejoAa9Vk&!RGE
zL5iAE(Q$}``ubL}=tk@TR-X}y(g>TKx5o6RUp`(Vp*9VG|Hd
z5Y3$x%H$1&Dn4a8bw|1Oe0pG*Y3pKZ=!#hx9rF1d>!1eG4%8Kf6kJj?4yxogggRRS
zl~99ef;C%#toXL$g(+p7;5sjtgDzE^0Kdp3(X{u+Y!iX82FME
z)T?5q7krfp*iJYI2!tf+kO194yE}1^+nBe!^Imz|zU%z>?Rr_&{uWa5opH4EPHy85
zC|ZW#1I3*bR7%_?@XrkU`}z!|{3iIV<>2K4@FvW0nlxff4gHHv`g-VjIT3PLEOH5XJ#X|o#cN~Sr75oz1d5TQ
zop#jfQ>%R9yqOdD78}--zqvVL@Wj)*xWu0ANUIWK6S7u&=NUH$_6^FIp?y>au;*55
za323tKxE~&E{;@=n5-bDYiuvoQPpw&EJ)f!S~KiOUjMGM%r1fSlj=gLYK-_z6Gz|s
z;-smm5ZMZgEd;u1D3-$QV!L~W|IO2g076I!-5Vi49e9K+Lz#SI)G47;$tK}h9%qe>
zxOtf(tdW&%@kd>b$W5aXo2S0)Ln&~vxlotiWo|dOZeq!A`9%)o6U1&tOH!j`cfC$%
z;IU|GI$d9(e$O-QF@}y8q_bfE3T;oSkwnihSIlx2%t=?NQEKm5O3!uDY^@mi^CafJ
zY)k`=OkJZ>>|0Y0T7mG2Lq*#RtbY+<-$>P#Gz@d=s+(Xo+n(wo87grXyk(XR`-GwY
z@W`C~1Txtl<9tDaiMU~FRZBZc5c>8A8?_
zG6Ro2RcD1QrkYbxDc&X+N|^Y8{gP2D!Yg;x#TDaATJkhr;^B@OY!BJmi>xU)+o3_a
z`qlC6F8Zsa8$<2K&K%-&vE|SfWT*cY6@nHOi?g;V=C%P8uZW=k#>?wk0)PdC57+5N
zI_%EzHlbH@3-gX*LmC1D-ZX;v<_$sSAX3h}N!LrCQj~r8aE_*Xd3Z2zo)oQ(_&+lp
z{+hKfqJ_@gNJba!8p;Eu892x?`^aoJ{ddK-hgFAxHT-MW!O}|moee9^S|kUfk*LT5eWqnDNM9mF$QUj|{@YyL4``yA
zppdwA{dku;<27njk4U^tp4*4te>kQ7P%e+k?2=dM=CVhp^4h+llweWe>%Jzz|5UbC
zzr<=h3FPuwl1FlliP4cxh!RJnXwvtyP~&vsx<$$ThgNA^L@TS>fg}-c@wE*ex>A4L
zq(~i(OAw|~aQlMw-gU`nc_y$r?v71RjOmp*=#vgp5IL1WQv+*YlU#4M%*Z{EHSKL1
zWA5mQwcz8$1{9_Ki7EKpseb5J603|@T3|MwVmOoy#U(YYvFsVGa{_mQLQU+PW#GEF
zF0OW{j}q-4t)5{_TRJx4T2vmRM)xL(pR8whO^qBFqqyjt+N>^8#FGx!3C3^DdYMTP
z@#csFJ`Q&bw7H+JcgzH<)8#UJxvaItUj_DKrv&ydAp`jSfEzJ$zSx|sDLSZ@&|Ud4
zYtRz6mf(%>l^>^H#xn#_2ioRp9hP;Ltc1tBkP#!gGaq-2Q-47h|E*`&lU
z;|i3e?$2!oJ5X%8mvGEYuN7Q=i!ZTt5Tmdq)L-IY+sv9a=RS))=cVL@Z7wJIztW%n@s#x?+Oq!W(i`HOC2=Hf*7Tdmc!VQLQV=mNbfahEC!br}
zr_NO_$yqPs8jPf!r+R2GFEFJ;uSDnJnwEfn&J0jxj^1~tH~d7ygwL~8Ijq?WA!N6(
zrZn`i2B>rUl!rA%Vg2oIGBHJHq!Il*o9$vuxlT|KdM2H3@SaCNcnmP(_3vW+HH4uT
zT$Gu~YctJl&H5ByUE8E!U6W!*GWoFW^;{
zR0vmu9gJ~8K`?->749RSSGmowKtWuj88naS{8B!icpq9;(Z1I9l
zI%~vFdesvzWls{LK3hhMT{+2_499^JY>Ph)SPPQZtni-rb3yDCX1R0gisuhz#%4u5
zQHGrKQSN2v>A5gp2LEvUQ4xTXnfT(msUT=Th#QM%fwhHJScVqeRIWx}zMlNAED=R8
ztJS(j+lHFhJ~3MR9F|XCwKNmifi&9#A?LTjvz$T&vEWe<3yEaOmyYhQ8T+HrMkxGd
zPN6i|n7GS&%YhqLzwxA?S9MOt^h9UoqEefsgg3YuvyQxM*l{|P7hO3DSJo88we4+6
z|H@!}mG|9dP$$8^iY@YLFQc+I-)!n3jT7(GFY;Mt^~q-wS{Esy|Lk2lLpjrQbDgM<
z;jr>TSh%ggMNSC!e{-a8GqVZx*L-6mHiGs<<=D^~?|;P=-W{Y;IPcv{{5QtRJpVwz
z&yJ6r9x7OFN2fwU4lG=GP7`H&c5NY+jar?la*_IBomJm>9KQVy
zwM}xx?!g=AIA^Pq#p63IradK1ONbjmlA~o0
zRDk~nS0pnpMVu)Y^^yJst@X~?F}m1h!@A)wL6pt6-&$QQrU?}YLGxed7{4Tn8*m3{
zN4XadFYpk|{o^~sK6DWcSvFOF&Jx9~iY*{rlC4&YGtM@gk8G{<7^i0G2=jc`iEs&O
za_&
z^aQR-YtEWoQAUj}?XhQvlHnkkrds(I41-GLzrt*hbeArYXPWi0k!W`h0j6l_s*S4*
z{QVP6G-Q+xaN1d9&>1r)Aomk(9i>^O0OAI`FwBy|pLW^(Ovl8`FkdD9cyYD1v;Q*p
z;WN;t)_nrS}vLu$!9Z|grOAvi)GCmb;vsa?`x+|wjt3Y2=#Q_sB4_%r3-
zNrXlsqko{675A^iYSN{MtOmwQy7s+&QWfFbzpURes{(Ga5z*~uP_I+m6-{_237u9>
zx1c7eGZfLNT!Nlyk=qQDHe3k8C_xRml)o)lxjb`
z0*TUx;&8QLEs!X4)+$zJi^HLGj1RW3H^XUgfH4^L_YwJgXkQ
zEUON674&q7G(2wF!dbrLJEhoMG+IPKAzzkdIBy803H>4EcC4j~aAwPD!1XC}$HliK
zo4>L99;WjKAQELUu<%-2Rr8WazV`81b_{Fc7J|q8FpJMNV
z>n-|?=QGuyoOz!nWOLrLR~fRyqdB(ueWvc6rs^H9I;yb-IYMN4JY
zs17ht*NEcykDbpAHnPn?Z(7RhPmrGq{GPMt{_)4m|(V!A>hPp$l;
zlY_=cL}$-H16@xu?7Nb!g{#N%)oe$}r+htUX-hsQ$4q>rId(6ykvb!smxb9F+(1yU
zUQGGY7^1ZNlKV49pO9{kSXHk!0;vf%)+z=8Vc1lZ@s995(vn3U79l(F>^G-M5wwzT
zMZ2Rm1}cxd3+y75+l}-{v>T&8AzJAAkEOa{*SW?>j|8JMiOh1lMr7o3LIn9GUY3B%qy5h$zGddgb{%3&_D>C{#ioOoKZKjZaxl4
z!wC9)O_(>Uxp_Sima8xSCbv+B8df)r5Yr$&Q_EUZ{vaNbj4b0!*EIfVO73t%;`QzM
zVl}*NVnwPVe}A;_X7gt3m%x3^X3Iqh&L5Y^%P;~uAM!k2b!Xe*cqtyZxi{3IsM*42fpK~uo~=L}q63z4gI`5;30
z%$~-cw+e#2^|F>a9cO6?iqgwEl$EPf#=&MghdJ5wNnB9wfA0=?3>EsQgMISxc)I&s
zEbHgl-cyJ&65-pC*4C7TjNx6Fs)i0Qwhs`!dj~+;JteZ0iRQrr%FtU)#nUU(oUV62
z1~Wy;o%|%@vhF3*gnmdD5?wO{?A#zd-q`cYr@sGNv~Ai%7s_c&mWMU+WagF_>3@ih
zr-DD$Vg1I?%vwyMY2B1wU$E9B{X4wTB_b$|#5Q=c{x;d>jo8?3b4o!`1LYlHfX4MKfYyVKtvw5fSfDkmA
z5fi!_ic7#+UM>LFGCYqRN@H_W;MnO~S8
zXU|}7^_8?qqV7*v#->BIkgZc*;m#z?)-@0vi(>!7GRR^hk&Y2+(<#KzrjEer5sn6r
zasv-20Db_9^zVG(VA)f)X{={27!8nh>`#Cxu{@eKM)cn;Oc8C=55U`>nw;xeksJ4g~oVtb;yAnd)FK)9AOsah8Iw2*v77>S`-;vD{=&Bazs(6U(7|jHHq6
z#XQoy@H+9--_C98B&BXDrk)G3q|CZFOB6a@)OG_-yd4*mFK!&K|?N;)&WRLF#4e*R0U%wr{P{
zY_Aqzb9T>4^gc#R;4zFY=Pr40M&PXUadH+iJ}b6LqDzqD+vt71n&1tR1sq18KCdQx
z-UD}DiY|BRMk!7BA&6V(r(&1U0LhrwuB(-sc%{6zJHCU{0Q;#N=e6VMw1DgHR{eB2
zKnhB1@|UnvQuj%=-&+9#O1S~|qdiY?R##pbr-0K3Ceav&o`>Ah@YAiQn6s)@&{M(e
z+T#{1rr=5TV&G^KAdCXsrF;GQc6RWA-izN9k>@h7INKiiaj#&tdzY_t1Cq`T*ni{q
z+vH%o3|lp-yXBkdeD>e@o>6N2@|NJocwZCn79{{2Mg(bno=)~6Xg
z=1#*BUOa?gbYb*p19{3Jb6ckkvtsAjb}xQ9ZwTk7+awrw)Qesf;@>V$h2I%=LFYI<
z?k5BQyIk*`2f_X1pB~d$ke5KEymf-MH~6P0-Oo=dW9P)zNx9xbqln(q#8%yhS||J(
zzbR8szjvMcn6#4FuICrEuD!7F2xIT%@3}9_R{mgAtAJ5IuuvYPXYsK0hh0}Q2w2(c
zIx3aBwsVR7a4%Ql)O$7=(X;selqKr%^w{P1hCha?a+bp`Sq@na?t81RBV&;v3j51`W$Xm13skyNltT|r$r||yYv#v7#bJRYo-q$oXmRDe_S~Yp3+plYMKFC$b
z#PF{7&gh`eTfb6*u-VJVYR}zwE6}3A$**?;|A0}A0WNaiZ8o;8Lv*Vgp61Uat_aM6RnHu#n`)zyDGDd2}j@ZQ_t^Gf^G{uU>I-*&UM+4OYjN-=rz4^C5T>PQS9kb7+iCR0(tFrYjYp2VQWQr
zDwjphame4Y)qWHNydBI|IXV4sQ$iAXS!V<6j)H0dFF1KV3&?3&b2}GGVjnJ#6N}^^
zwTP}Ak>`aZ6ZZ`W%f#}<`N#{w$X
z(6RfYcQ?lPrRbp9B;b>0^@pE#Mcn)%z~3r<$Lnbo01iSOWD@gw@#ysdGKu{jLuOND
zd(ZY*K=k|}=jSjQHVF6x9Y+9adX&L8VTcso>p^0Iha;8oz}3~y?Oy-4$2`9W(Y-Xa
zypK`PT~zJStmw-d_$^*-r|lNiY0(kbKi>@i4!`#ru>zbot!lPhRwkV~j=7eqcT4i>
zPZwwT52BN1-|v_z*aDchfsJ`@eIG`(pI4I!KD&0MzT2`|cPzF3YdjOB3BDtqCcb}}
zP2LCm9VN+uL0qa`2bB}&Vq$ky0N@)Ax#u(b6%oZL1t>6v4fLX$2h2Lm1CQPG`oDAJ
z%?-r7e4agM%twg1dEDZCx+l0%1l-9@k0*q-`o*{@3yXxGjoM-DI0+*r&JTBD+fVbp?qljmEz1e-Q(XEUDAYT*T
zr7VhvshHqWicgL=eYrfp{`Xn%b67&KNmaJT+^^RH(HBct;H&>8g&sitEg!6L872l=
zxkjY;+-|Hj%Kj)atQ~anduL!1$SvIU6?jjb&1v72GXZ_9Dq7{dJ>aY$idwlX{^|+n
zD`Eq7*488TK3&xcd-mc1KpzFC-M89VCR+jb+P#TR{*_PD38GI-y&u=`1W5Zh0Z>jBEFDCL@y11Gx!M-s#=|Es=CVhtv)XP5*@@3R&ix%#-pl@n44>%H2nFfKMC%S{
z>M_-1-pO|xQT5Hl8CAN+?-TYGyV(1Rj3G@aFLv14oD*W;kR0
zxEu6W{qVYNI^EcXPT;=>J&=q-1`9^v=JE0hz$Z=XMV+g)PPQ3;O!0tpb5V9}e)_2O69FqA9(`x`6QR8*h
zUn+c{n^S81_9SPN*y}R;>eSPD=wIr0m$CNz9>2^GVFY=k3ZTA*VCst2ubt)_(joSo
zzYVr|-g01_ck(`={Lj!6dakXOiE2CF@znfRUDEtcE9it*&5m$9
zuRbR*0igNO9K);E=wHUo!q2wWfa4souEVU^fSdB1G;;SdOwoBmv0J-tO0UsJ6VuPV
zbFojCOCB}AdZXz32qYi!vX=rnKz$Xq&5Lk++ynPch9H7nIyPTl`~hybR(@wOx;>Dm
zqMDW+(@#Oj!~6Kj!G0DdWIe5oBG3C!pN|Z53$7If=Vpzb`n`;``oCro^nimO+17y<
zyPyl$+Rp`|Q8D1LT#n}!pQv-$fXJ=fsbU%#AmDZ^&kxMx8*r8K(3|_XqGbG9VJYGFM*#3O@2}D0tcl=R$*mt`0`R7Lv=nkH{JI6E;)A?xlgFF+Pu1Z}|Q^}JW~0uK1pM2{{E1MY<_tU7$>cTR7VJ@+Yr*Y{BgCQZMd
zkA5X|4!sjOAH42B{wx>mx+uB6C64s(3Lc*j2%mK7&ebl?^cLO%j;A9|PP0L;rIVMv
zkUl4@qteyx5@5{5r;u!E@haf)s28|S2Wj>iu&P*XM43A01M{3udW;b`HUu%ITh+U61vt19>5lKLkk9Mj&kEiz4fXgMEiczu4;Jv8n
z)@$VAKIBhmz9mgTL~OO~1#C>W^-4_2u|>NATYL`2JF8eo
ze>*s>+Qo3nIl5H?r#DDNr@k-kbNyy#v6m&3(kZE~+NBYpA*;qiOW=TIz=i9TRQ8U4
zp(8t-=r3+TFRAa_sF>I+D{f1ss%m9p8N?we@_d?{q`$hrN#5eMx*{Y>FS9Q%-FGgl
zqO}Iba}}%dUqE;6w@yU(f&}LyNxAXg@4is$*M6h4*mKAgcG{L>#Qxw&^
zs6JXuz~EGszh5goqZhp^bySVKcZg8AyD9{G%-#Jf+BZTTC~j@PYJY~=)yTBfe{N)|
zZV@QWEOI0(T1obm7BLOHx;Uilc@u~X=8B*7ycp6R7u7P%m=O{y9t}^l#KsQHZrHW2
z4t~h%ZuES2mdHY35got@Og%dewMblP3}(4rGkh>O-Z)#IA(2wJuk4~sDsXV6n!a3e
zD6&hGESh;xT%9r6pkc=YgMfK>2qc;mwXtz_{$OT*k|-4a}|rI(Y$NT69Dg{^HiD0NNiag
zn1fRj{m&tI&Q2;e3oDC=*4digne*uVfyxo4{>@bWiwShj8T-*6osn*I`BYEW9?#$h
zyXyy3*|&fk0iCFEK_}Wx7Nc^ql4gc#7z6T6*Zj7s?3y2fr$rin=;our%L_}s$Xz?L
zAJ{hNJw~o15T7LVox->fbR2d1(K&h?~%^r~KV3C=1CpSQz*SztDWZ#h1aW)AJ-^x881!
z@05OgdR|!a4TvEu4-kRd*|mTuhVGD)OUb
z_b_qR4^A0iV_G+M36^(;;wv
zgnl@NoSEs8mCeRscR$6Oqb_o?iKXsa3&^tiyJQ{Fj#qNVSZ-c&p)Uwt7$`#i1-W+h
z@+KEYLsI)kkBn6LRp4Y1T*;=7Ziv-c5ZraBt!KSudxf8BXQEnmHdz`^H;P0z6dgQ$
z`~8y;M5niw?hL(4EZ1E3l|S)4#KMC{48rgiL^7zDt0p~nb+vz#JfCgTUY^P%e$(&M
z(jT)5I+iWd9Uqf0XVh?)dhTO~+Q4|mbcpyY*3|ugfyJ{83<@lBTi&)ex?gZ}z&B!u
z?Or6;@Xrx{Sc?5yD20iZ>=MH5JOg&%oKv=2WU%Wib!vAc{jI`u2|HHxAM5@7JVq0;
zI}iT+$g55QLlQqISa7JgCY>$;%ufIaco8D61RDOA-~Mugdo5?Yb(%(&(rc*
z)K$}8YF7`86}bMh>U=*ONlf|6S-+W&v*6D^4e?IV#cC0im#ik9v9k`?XOek7d2Gv~5$Ms#}hF&I{Y`EZkz-CYIZR5M@T!1gY^ePJcXUebS#`|9-D3
z!p3Oex%MH=O5R&`J95(4?YHk%pkXacK)Fw3VnwVDrnG6JdLh=V_i3Y7mm7Ov$Mp84TiS6nk@Un$0Z>aZ@1EOc1Jz1THjUNuIv9{ftz5
z8dZn5+_Mos0xV5{EET3Sil|Z2ILV-l$c|vpk<_hQWbMpt1?nzeqEvC=YNeRx+#AzE
z?U4)?ygG52X=RT`0g^>$aurRNpFw6+3@%UoN|d;9;Gqro1okKkwe^8viz90%$FsGK
za6MSnVy5lK&GU_p*gzFzkhiS)S>UqD_j0Z+43!NJVa}veTjp
zx%EG}F^w1St_Y6o$hp@)P>xY|qB>S6dhlcBGB+!wBYkEQ(S?59m
zFgp#PsINV_QQe92lSx6OW%u`Zv9ST_X{j2xI9~?%cpJF~__*EPY_Na25OB$Tha!{v
z&V}elK;j!i0WU8iCDoV~_RM@gT?Or=_c;{aofwtdy|3i5&^LnrB|bA<@L;n|k7Qja
zJ#$?Xwv4{VUP|JPBAXv1{W6*vs8X@c|JfB`V*hHzpnd=WHBtHXnL??5^CgmedyEJ@
zB7JiV9M|!2d|Tm-e^bSf?ajA8vi)g(iS!e
zj`pDbB<3V#h=|vHIKKI`K>bF0dV*FqxM=Une}T=Uh=g77tVcvz-w4It-M1Qp)(SwL
zW($3$*n;N$oTP;EKG#3Qd0^O!Vfb?J_{b2+pbk@37ReAjLCw0Ag(boi)HxvvzdfU0>w0{stO5BaO2Auvq^N)KM0!#A-ck@7j=
z`conR+12&Cj)#+-imCWyqjA&r9
z50B+4DI4e^eASkdBB7I;AP{8pfl+x{;WtHM;Ow*IoIYLX~`#$qOyWbpdSsOHAqQwX1vTqsZY?_Fd3O{-+)oXx#lF!H5{cD+9%TC}TO+OATN5C|R-e
z*9;{Z5O$Wre|&6(Tt9)#kIWcdKYQr$(8PsyDU>CID|M*3kesBMZ2q0ME9(ck~@?zDUXcc@cHWD=3}*=(6D!)12BZ~8zdWLYE~tg*Tk_`Em;_Qm@`lsa#{JHMKqe|;Dn`hyqB0jzGUdK+LB6iH=&iZ3X%
zCyv-M+R*L3(YcbVUztotdeYrBs!z=MiikN%l@>Bowk-K7)I8-k;(ar^ETkyqeMp>u
z{PCo{*bfDU#e9(TZJRHhqNi#~e{Bq1^`32VM6?t3r0iCo?2?hZH?SXCd!yOx4tiy3
zDLneBXXEc`C$n;bDnNqm{Cz878qIUe!yNWe)tMUPvT-v?Yph-q9BX|>n
zXpNr#;jlod`Iys2X@KC@E8;7-vccdenL%nc-{k>|XWXL}56_?{%=$NuJw#N--feZPqef
z`~1e(aur&y2m^#41PTNY{T~Tm5Rj%A0P;q+zbyI&1*sR&x7*Y{>$Um$`IDu0AisQZz;F8&0=N
zFAQ7a+!GEMOS+?FieyLZEFRKG2RhE;E=3HAdPM7<2MSU*I3lR7!DQ_(E4`84seom`
zW{*|a$`PsLqNYRGTrF6wj!AxQ_N~dqi;d}71O=m9rV5^uYf++QtM4Q)5CncDQJfWG
zVZ7NZb(qQdMn&O?nZp3xXGkGpE^5fmSf_N%Qaa@MsGV3Z{aRX2IxZ#n_*F;ckSMpi
zA{zGj#|EJal$=kjaJAXNZ<(Y6z7cnp
z1`{-TLc5rk^D1oU^S~~t3M;JxsiUXluYE8mUV)$@$B(Kt2K6ysZ00!YbB#s$@F0_j_RJDGFHk@?s7
z5v=@Lp)N18wL!cLs2#c$*H{7(0eG`F$M>%<<0XaWdE}Po-d1Oxp0Is#a*aJ2ms;^!
ztlOkbv(@Rxn|!EL(s^@c6AyP;b=5@e`gR#tyF`@A8tw}-Oc}F^>e|u-Rlp(L%zz;!
z9#?#doAFhe$&7Hgkj`uNBPI>^gqlg~l4yHkNPYYV^dy$7d*RQhS;G?rM#qyz=KGVi
zvJ~OMu2a6u%kPu?XQ(sB;&f5TP_`c?B!lz6gr}OB=tFJ1j~tjpCbH`QcI5dD%%C|T
zbB|y^Km#~0_0m6r`6XZaJ<6&2KcV}ZzFkejAzu{5TSnnI8Cd_JxU$6sY|{Ud*4ioJlS?k+L$|GIGlWAWND)0P<=`CEpurpE
zJWK1R5sL6K*qtpcbLyI6ok=)x=)~lc{p7rb?oex4bAd27;zEIG`cpWKBaP4RtPXI7
z$ETKI0(#U!HQIMa-GgNei-g&@Z24No8D6hz49i`4r6eU8Xt-2QJ>VHHW4W&@;GLMB
zP2s@8Vk?_49&-ZwCXEBtgMf^;0iQA*pZ)6xv7H7<(#;i1dj2+`qvqXk5uj1rJK04JKcXWRT{GQIC
zOWm{ybRQH)Q3hLfa3j`z)7Kq4DMlHN$|3J-T@HE8B6?t5F+g%-U001
zNUpV+D$}!rp*>lFt#FvcVb_oXAjofhV6W^r>5)U!b-#M*1G$HqA!K=s7?OY-v?+dD
zWU0!7HwJ14;m!X9qz>*&3=QhKo3s9HN23femtHT_&ki)Z7gl$1tP6+~HDKO}SXZc@
z*3q=<5jr5&SkS{xL`g%I9{oeFG@ZRf@<&;A;8F3p&PA>U7-pqBl!LZ+<+2)E(6hjU8G{8{=ahJ0;-Ar-GsuLBf4tXjF6Dxsn#~
z_ovu%(y$T(xvIgvOZT72CiHukgoDmn!ZM~YSiJ2O7RV~G$Ddqq-S^H;@WT~i2vjGx
zQQ3ljTJq(R#!jNaLc7ohZaHj!S?|Gx7=BvXv2*8X#U;iuXvf<8QcUIu^!~dQT}f6q
zYPon8`6onk43dS{R`m@GI+0Vf3xyG2MqYMYjJ~{vUq|2{n%v75)Ke28JvcMlJ>}3y
z5okyrj%=c*Y2kG;F`t(7MVus?dH3B&p0-ai6mN$KYR|}*SXAl);QT_j
zJ9hvc3)1{N_dpq&lT2dDqw#uG$MU$M#;dDZc)_x1OOUB(U$ujG=ae)RXQS}^RqX*K
zNLsN`7~e;%7~9dtczW>(kH)#Tn}@KLb9g4xvqK;2c+d_YsB#sISZQvOfPl(mCFf#)V0F}9fTImBYp$u-r)9J(F~feFqciQIN+-D%l+#LF{lmnp=~
zLTS*RUlD$7TfJ0X&yfLKXeuDqB>Gd^DrRkL^Ox|vCH%(swb3iR-3N(h
z7AFeI?yIdR@jLk{TKmC@G3o-&O_Drv(@m#*OrmtMvn8|mO5|P$*@QY8INRjh%w|n>
zd`qWSOlwe8MQd!@
zwO_k;PwhmX;!VF*2JKhSUxUGjom@@|0HYt|l+($MKr?uHOypMBIzn7E#FG!3yD8_)CuQN`Rne*e)VKP-gQ&7s9;1?0pThu
zLW?sGlB>wXOc7GMA6>=*AJ%_$ZfO?XNXb0{vK|YCWFSx7t^t><2_DWQyy6~Z8NU}-
zGv*8#8No*DRFhDCcS@;tQv8lrlimx=RsZc9mOO^u?`(N$U*gr9zF)J&
zgtxWAHru6aps@=Ag1&VXhr!x?t=`BfGq@I{Z}CH-9pIyUi{ZzFf>xO*H@vmCD3Zjh
zL!ZL~4)aaePz30jpO6lALsbcMh6Ksdpqv8V@(+E+t07f*_{`L{j>ac<5;Y6ERNw2}
z3S57BD%6=}@un47AMR|>GP%PQkwuE{4Exte)J(y#rvjqNA)G(Uza`D|?e+di4nVtU
z_(Sx+?N8LSY%)YqysBoNX>Sr%EJJ~Pc&D|7`U{I2y6K~5t+fa?C2{0o=Xj?^mA{^G
zfc9cQSSDEOD66ZO!)7|{jh!c5h<)~{diL`0+3|R1y9NFMLAe84NcUKa0G(@Bj%Nx+j07FXGVX4D08y|8+n^Sg
zh(^`tEA;1X!KUuBbx6~`av&ZL-xB>TmWlKB@@2Sl#aHO8`lXaA(c+_E(dg?O-O!tU
z0Um2Sx$V=r+s5VhsbdPKB`H9fL3s!(K=*kba8(ztSU%wKu?JQdR?mO}5e5=O3Eygt
zX0HXlVr<8Uc;mgwJ?OJqJoefXqhd?Lb8ova2`)!XfSWFxpnV0&rRgFzMh=z*gpM*p
zGXK8+aWQ|(rI6E4ia_}8yp3~8;VYW9X1T^h=34%FtH+K2P+C-$wf0hL_cW-FFY}E_
zNs142sllgbQr~R>V_hDEk$~Ll;0rKeB<+jQId2P&!&5Xm!Ysq`$iY0pi6>?Ge0Hr}
ziu}v)VZ(%zVUD~W#qO?VFx`*ggr4S}874j`#5_u^Jc^IBn
zf5NnS0@vWVbeszD&h}iFV!;Qd^HF<20l|#@?-Y)Q5~-7=wzd
z?cv1jp@bpbVdNzCJ{XJJI8xg^V-}O?T)NV9P
zS#YMd0|W~8P7UxDcTtO0rR=*|O3SCBZmHI0rO>HKupW;wjx8?jcLQCV#0@U!anTSI
zY557nk+*U=OHLt3MFrV2=V%5;4kA7!aB!84)t)m{4pxV$taO6`5pj2ENf9U0@1@NIjD^nCDvN3Fe4b!7D(s7Og$w#CG5Je*lM?)6&VfgMB>s*Ow3X=
z=lbI}?VTex_XNnL!vgzS0T}skrwm&K(2#H~P6dTYiyuF&VDNooP!D_tlG_gIrkM;6
z)yO7L+#yugR;ZgQ_~gwQDlHuqpb62vhlVK73O$|2Q6B`Y9tEg3wBzF!#B^e+dIy
zBIA|a7wEWP$}d|bQr;08_Hc4jK&O2p^Zc!9t~S0IWVhnEWlLa)Rfc8xb8_T&Z2DF0
zM9QeoYW(4m`1W8Qsz+bFCK43_(djn^OGDZw%u}p2j)XVZ##$-!&yva?$IyzdF+t1k
z!DuHmSYs4SqI(b;SalOUDLa=(Y9NbWOQ;d79Z<7;IEjxM^3DWSlYGzzZeEIDAchgv
z+0=R*qN@n{K$2`|ix$?Q8NBo{c*Jr96MOfu@U=LZmheVE$kApYMU#lKyw%(DHvw01
zMCUbhbi0`Koog9h)WlzR11vYJn8SNON7^9>jy0>2p<3tsdDE_voP%yZB;c#=dJ9n+
zm~HXeem)CV9GK+xTTiV+ZHY9n0_LOVd6z|BI}eV?sv#@h1S=Ea4PsC(dZ6^VU2zK;
zT0>Zz+*ngAr_WDF`h6&lN)IU*8e0*eeZ8TKFQv7)&~iA5yT3_|!aM!Jlx?U0A-T%X
z%@1HQ)s*pNnu}VOLe3z@-HI)`%84UTenAR5J!%yG$gD8s!$D3uW*OD0hDy}69?)}!
z7uEM=E%)(t4Q*?k;Dj7nvpp@Y+dGD!Ywc^+0w}!}`iQv=(5B2?VnQeJ9bjDNgc#@8
zu`|ixbDf*F;h$~aQ}GO*hoK7oO=^bz}9>f+Z_h?*Ju4deC_+!cMLcQAiHRpH)>P
zZ4CZN5JIb9@{`B=ON7hE83?Tk*
zE;y}8reKHukUq<;9vvkf5DPHOIQ3Squnak*+pIC&YgP2qOx%pMS>$PTUuOk07?WKc
zGmHbl`(Ew$=Jl-F#i}!PQHqR5h}a0ZV%E?i+XDXN{a=T>N&T@F0W%75Wj^$jywHN4`i?Vi+5@?HNz?5T^F&Qs{6
zC4G3o!B=$KT4k7r?Pe!MW_9ZT^*k~&3-gvqX;&*AQ>^=q(g{^|QU`gR@1ct1{I{kw
zrsvR7+HA=XRTHLgudQCsM6CmJz{;x=5jRZ)q3Js?p{RT@R4>k4GB2VE*&|AyOI(gs
z%c1=W@oPA;eW4zs0dT~D{aN(`0LSmkz<-2BQKFRu0FA*l^atEA7X{7CX>zg-jFmn!
zCxfhfM2wn|M$_~}iA>mw){J^&PmrU}5uBReJ6nmisZ9=uGVCT;i6~7DGLg&c64fqq
z`|L0R`Mx{S2tmI$9N?{(9;9`J0`*N=Q8iwnM-3N49On0+#Tk6s*Z0KIiqdEG8?a+)
z$;t9;O6P2mu#P`10!^Rw?XJd)f-I=hYg)0J(H1Jpxwal*eVh%IzN`1bjlr3q@I8yQ
zzw!^5F^3?xH+G|{AzLOl`BZD)spU!q%VpFg;ba%NVm<8vUhOb54)HM*s~ju?hV6h{
z&nNP3{1vy>L5IjmM9vy{#K=t-X~P?qje&ga?{J!2X)&y*@m1jOk}Dyl@9TBjA7)jI
zFpe$1nmbZdMz2qYM(;Oln3iUmvC$>N2#L)VesZu1oNX>NimFOxABk%ejbOavRy`~V
z;-p>9{lGO*%hgu!flGD`PIMAO^Sg%a7#gg6*3PLLA{uo7Vbj~0TLe*qx*5mAIAM5}
zv!)%>Sb^Fja1NVa!_D+o+Ft+w_Zi5a!7XK_XZx4o&iZ8rptxLG-k5uhf7qRmKNTav
zTWq0eP$wpuUzGU$&e#RD?2S1`h~ed~)NT-G)DU(tY@!&Hxg>KWYZA%+C*@0Tj6lED
zcIa$g!U^?Mqtf1W23R2YW~cpcjk~YGZ4Y#5btp~hx;KJD6x5qKum#DE94;1{?*j1!=Ri6Z?s()ddV%1$+e4%
zKc9XSoT2&-8rq6Zk-e!>7cT
zlcl4Xfu4ioUk0jO{ukE>fc-#VOhH&K^1BPN-7(Fz!dIlHlcgdrI+s@bfh7|Y985WE
zim$#>hOOI;A>|(#Gaz|uQ8bBdojNot%3i4MibFY{?6r{qWcoT2?7PK0sh9R>R
zqO#EmVDMjw;RI~qwtaPyg$yNLdM!ktEVyxxxzQ%hZ8R7L2W<6Q#NK&tRSm>$Ll?ZjQBb$q4a5CDFBVOr(`g&$g(o)UUYo#oC
zuE9#NrQ!2N0rPP~J#a)-Zotc`;4xm9&{+IaRt~QIZOq%SLL1ZIViyGWbhVgU!EFw_
zaUO5y??ZB&&-c+KMIou?;8^EzmQY~&$ThLz^P6|mX$P`LHx15Q*bHXTL51gRJ{d`k
z%oFTGzH@lLR!gFF?E8Iyra1u2#JfLKOIbY!2NxTA!#})``$tNuB~v2}N(T#wr|>?{
zDYG}>pcK--LDuKxr!~4L+7KNgi9-%Y+*}hIQu22XyZUx~r%n7M9N^alDo^}mP8%Yp
zFp$;6A}@-x=3&Aln?s*4rt8K0jeoHVwCEbibt%rltA(gP1qG-CCMK;Cj~9?PUdQw?
z&UtGGb|9$BQ=;4Ag}1?ZgFcrnm6jN?lCyv{NiC>W*;=AzV8oC5@hCZQbHNEI13Zhz
z1*92;KgTA65`Q_?L$f-6`Lt@O7N2-6`0`{nZwQ^b3C3;zXw^8Haf(WFy2_ZD(Eic7Imd8d-lcHAvH#8mZ}*?k91
z0mGm{vbOs!7;EShP2z4{hP_l20|RP?#}}3TptR_DiP~-I
z%VnkGRd->71+azTh!kiJCiA%d?#uENj2O;Vt;g((35K<(g!XJVor{h#xwB{>BPl30
zQq}mlVpF=on~!mIR|K;;UN=P`HdkYItC&Y`fG)%8azHr8FrQs4q*M?I*p{N;TLwyC
z?BpU>p*ZCoOXqzP6VjcwiK~DW%Dp*3z1YuB9ue)?23yzVOvX0+=)`Rq47m{?0~(o>
zZEkQHzIR5kE2H9vN^T##%g#NV+*vDyHK{O6T~%WEJ_m26fo`(SV3dw(@nJ)ks%p9t
zU$d~@upTj9Q7YV=bf?fLKR)tos@vvn39N~;onPfsT4$JK@GJL$Zvtf%?6?&V4T@?`
zWm%XvZ!1q-A#`j*2uz$bHD=(-cy+#xCfBVi+}EIpHn)W|sf9Upc4n!rmJCJ%G8(g(
zRb+>%JVK~AVqpch|CaUhz!(-Syn?@lu?kw}Fo^Df3}&6Bc83GVU14
zc*RN`#5JYum@^^Mt1Yx3fJb(rt>1MUfYhu(d2TyqTRKPp8rXmDL
zM1%1tm#nbMk{(t=%|HJpsV%Y#mR|zEsSMBn(mzH2k8SZEXo1x~x5c`C!<^NBZBZq{Jh(L_Ne=Q)*d)Uv%@u;`5ba(fRmJTDA2E$*=Ub6
zz`&wUNSeFOGac)k6)RkSu6f}0Fw%@7fFmA8;bYq3iKF_*w5w}V&>}@>%5}e6u;ju0
z0Oa`;;!aGBRIRmjb8V(OslmhDvT^QAr$C40OAl)P0
z+%RmrEY|ElKV2)f0A02-1v`1eY>F;JPW+L{>>_Unr_d;&c4B~e%AWlK3Tpfn15N!k
zi|w%K$b>Bru3&o#%1W#G7;TOA`HD4EwgC;JmCi^N|9IRglCr7#nSb&EYPJ+DpStnR
zDf_FBk-=#4gB?pf?*>a$;BVK}5-OHP-%av;fW(yz*4CBHUGK
zduz~)uq;k&B^tFfuda=X