From 5078dfcc646fadd316e0831941fe9bdbecee04fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C5=81ukasz=20Duda?= Date: Mon, 10 May 2021 18:48:58 +0200 Subject: [PATCH] [mbedtls] update to 2.25 (#6555) List of changes: - modified Autotools, CMake and Android build systems - increased heap size as new version requires additional 64B - replaced deprecated API (mbedtls_ecdsa_sign_det) - removed workaround with defining mbedtls_ecp_restart_ctx --- Android.mk | 545 +- include/openthread/coap_secure.h | 3 +- include/openthread/instance.h | 2 +- script/update-makefiles.py | 4 +- src/core/api/coap_secure_api.cpp | 4 +- src/core/coap/coap_secure.hpp | 4 +- .../config/openthread-core-default-config.h | 4 +- src/core/crypto/ecdsa.cpp | 6 + src/core/meshcop/dtls.cpp | 5 +- src/core/meshcop/dtls.hpp | 4 +- third_party/mbedtls/BUILD.gn | 11 +- third_party/mbedtls/CMakeLists.txt | 3 + third_party/mbedtls/Makefile.am | 61 +- third_party/mbedtls/README.md | 4 +- third_party/mbedtls/mbedtls-config.h | 6 - .../mbedtls/repo/.github/issue_template.md | 4 +- .../repo/.github/pull_request_template.md | 5 +- third_party/mbedtls/repo/.gitignore | 40 +- third_party/mbedtls/repo/.globalrc | 3 + third_party/mbedtls/repo/.pylint | 425 - third_party/mbedtls/repo/.pylintrc | 72 + third_party/mbedtls/repo/.travis.yml | 75 +- third_party/mbedtls/repo/3rdparty/.gitignore | 1 + .../mbedtls/repo/3rdparty/CMakeLists.txt | 17 + .../mbedtls/repo/3rdparty/Makefile.inc | 2 + .../mbedtls/repo/3rdparty/everest/.gitignore | 2 + .../repo/3rdparty/everest/CMakeLists.txt | 28 + .../repo/3rdparty/everest/Makefile.inc | 6 + .../mbedtls/repo/3rdparty/everest/README.md | 5 + .../everest/include/everest/Hacl_Curve25519.h | 21 + .../everest/include/everest/everest.h | 234 + .../everest/include/everest/kremlib.h | 29 + .../include/everest/kremlib/FStar_UInt128.h | 124 + ...64_FStar_UInt32_FStar_UInt16_FStar_UInt8.h | 280 + .../include/everest/kremlin/c_endianness.h | 204 + .../everest/kremlin/internal/builtin.h | 16 + .../everest/kremlin/internal/callconv.h | 46 + .../include/everest/kremlin/internal/compat.h | 34 + .../include/everest/kremlin/internal/debug.h | 57 + .../include/everest/kremlin/internal/target.h | 102 + .../include/everest/kremlin/internal/types.h | 61 + .../everest/kremlin/internal/wasmsupport.h | 5 + .../include/everest/vs2010/Hacl_Curve25519.h | 21 + .../everest/include/everest/vs2010/inttypes.h | 36 + .../everest/include/everest/vs2010/stdbool.h | 31 + .../3rdparty/everest/include/everest/x25519.h | 190 + .../everest/library/Hacl_Curve25519.c | 760 ++ .../everest/library/Hacl_Curve25519_joined.c | 41 + .../repo/3rdparty/everest/library/everest.c | 107 + .../library/kremlib/FStar_UInt128_extracted.c | 413 + ...64_FStar_UInt32_FStar_UInt16_FStar_UInt8.c | 100 + .../everest/library/legacy/Hacl_Curve25519.c | 805 ++ .../repo/3rdparty/everest/library/x25519.c | 186 + third_party/mbedtls/repo/CMakeLists.txt | 166 +- third_party/mbedtls/repo/CONTRIBUTING.md | 37 +- third_party/mbedtls/repo/ChangeLog | 1010 +- .../mbedtls/repo/ChangeLog.d/00README.md | 88 + third_party/mbedtls/repo/LICENSE | 204 +- third_party/mbedtls/repo/Makefile | 48 +- third_party/mbedtls/repo/README.md | 120 +- third_party/mbedtls/repo/apache-2.0.txt | 202 - third_party/mbedtls/repo/circle.yml | 44 - .../repo/configs/config-ccm-psk-tls1_2.h | 4 +- .../mbedtls/repo/configs/config-mini-tls1_1.h | 4 +- .../mbedtls/repo/configs/config-no-entropy.h | 6 +- .../mbedtls/repo/configs/config-psa-crypto.h | 3371 +++++ .../mbedtls/repo/configs/config-suite-b.h | 4 +- .../repo/configs/config-symmetric-only.h | 99 + .../mbedtls/repo/configs/config-thread.h | 4 +- third_party/mbedtls/repo/dco.txt | 37 + third_party/mbedtls/repo/docs/.gitignore | 3 + .../repo/docs/PSACryptoDriverModelSpec.pdf | Bin 0 -> 565092 bytes .../mbedtls/repo/docs/architecture/Makefile | 26 + .../mbed-crypto-storage-specification.md | 316 + .../testing/driver-interface-test-strategy.md | 115 + .../architecture/testing/invasive-testing.md | 367 + .../architecture/testing/test-framework.md | 58 + .../docs/architecture/tls13-experimental.md | 49 + .../mbedtls/repo/docs/getting_started.md | 894 ++ .../mbedtls/repo/docs/proposed/Makefile | 25 + third_party/mbedtls/repo/docs/proposed/README | 4 + .../proposed/psa-conditional-inclusion-c.md | 238 + .../proposed/psa-driver-developer-guide.md | 45 + .../proposed/psa-driver-integration-guide.md | 45 + .../docs/proposed/psa-driver-interface.md | 790 ++ .../mbedtls/repo/doxygen/input/doc_encdec.h | 4 +- .../mbedtls/repo/doxygen/input/doc_hashing.h | 4 +- .../mbedtls/repo/doxygen/input/doc_mainpage.h | 6 +- .../mbedtls/repo/doxygen/input/doc_rng.h | 4 +- .../mbedtls/repo/doxygen/input/doc_ssltls.h | 4 +- .../mbedtls/repo/doxygen/input/doc_tcpip.h | 4 +- .../mbedtls/repo/doxygen/input/doc_x509.h | 4 +- .../mbedtls/repo/doxygen/mbedtls.doxyfile | 4 +- .../mbedtls/repo/include/CMakeLists.txt | 8 +- .../mbedtls/repo/include/mbedtls/aes.h | 79 +- .../mbedtls/repo/include/mbedtls/aesni.h | 58 +- .../mbedtls/repo/include/mbedtls/arc4.h | 10 +- .../mbedtls/repo/include/mbedtls/aria.h | 103 +- .../mbedtls/repo/include/mbedtls/asn1.h | 397 +- .../mbedtls/repo/include/mbedtls/asn1write.h | 68 +- .../mbedtls/repo/include/mbedtls/base64.h | 13 +- .../mbedtls/repo/include/mbedtls/bignum.h | 822 +- .../mbedtls/repo/include/mbedtls/blowfish.h | 143 +- .../mbedtls/repo/include/mbedtls/bn_mul.h | 63 +- .../mbedtls/repo/include/mbedtls/camellia.h | 214 +- .../mbedtls/repo/include/mbedtls/ccm.h | 122 +- .../mbedtls/repo/include/mbedtls/certs.h | 250 +- .../mbedtls/repo/include/mbedtls/chacha20.h | 55 +- .../mbedtls/repo/include/mbedtls/chachapoly.h | 94 +- .../repo/include/mbedtls/check_config.h | 221 +- .../mbedtls/repo/include/mbedtls/cipher.h | 522 +- .../repo/include/mbedtls/cipher_internal.h | 35 +- .../mbedtls/repo/include/mbedtls/cmac.h | 12 +- .../mbedtls/repo/include/mbedtls/compat-1.3.h | 16 +- .../mbedtls/repo/include/mbedtls/config.h | 810 +- .../mbedtls/repo/include/mbedtls/config_psa.h | 335 + .../mbedtls/repo/include/mbedtls/ctr_drbg.h | 349 +- .../mbedtls/repo/include/mbedtls/debug.h | 47 +- .../mbedtls/repo/include/mbedtls/des.h | 10 +- .../mbedtls/repo/include/mbedtls/dhm.h | 180 +- .../mbedtls/repo/include/mbedtls/ecdh.h | 269 +- .../mbedtls/repo/include/mbedtls/ecdsa.h | 346 +- .../mbedtls/repo/include/mbedtls/ecjpake.h | 156 +- .../mbedtls/repo/include/mbedtls/ecp.h | 653 +- .../repo/include/mbedtls/ecp_internal.h | 18 +- .../mbedtls/repo/include/mbedtls/entropy.h | 14 +- .../repo/include/mbedtls/entropy_poll.h | 6 +- .../mbedtls/repo/include/mbedtls/error.h | 59 +- .../mbedtls/repo/include/mbedtls/gcm.h | 107 +- .../mbedtls/repo/include/mbedtls/havege.h | 17 +- .../mbedtls/repo/include/mbedtls/hkdf.h | 32 +- .../mbedtls/repo/include/mbedtls/hmac_drbg.h | 318 +- third_party/mbedtls/repo/include/mbedtls/md.h | 14 +- .../mbedtls/repo/include/mbedtls/md2.h | 10 +- .../mbedtls/repo/include/mbedtls/md4.h | 10 +- .../mbedtls/repo/include/mbedtls/md5.h | 10 +- .../repo/include/mbedtls/md_internal.h | 45 +- .../include/mbedtls/memory_buffer_alloc.h | 6 +- .../mbedtls/repo/include/mbedtls/net.h | 11 +- .../repo/include/mbedtls/net_sockets.h | 15 +- .../mbedtls/repo/include/mbedtls/nist_kw.h | 12 +- .../mbedtls/repo/include/mbedtls/oid.h | 72 +- .../mbedtls/repo/include/mbedtls/padlock.h | 48 +- .../mbedtls/repo/include/mbedtls/pem.h | 40 +- third_party/mbedtls/repo/include/mbedtls/pk.h | 299 +- .../repo/include/mbedtls/pk_internal.h | 12 +- .../mbedtls/repo/include/mbedtls/pkcs11.h | 129 +- .../mbedtls/repo/include/mbedtls/pkcs12.h | 20 +- .../mbedtls/repo/include/mbedtls/pkcs5.h | 22 +- .../mbedtls/repo/include/mbedtls/platform.h | 64 +- .../repo/include/mbedtls/platform_time.h | 6 +- .../repo/include/mbedtls/platform_util.h | 97 +- .../mbedtls/repo/include/mbedtls/poly1305.h | 52 +- .../mbedtls/repo/include/mbedtls/psa_util.h | 422 + .../mbedtls/repo/include/mbedtls/ripemd160.h | 12 +- .../mbedtls/repo/include/mbedtls/rsa.h | 551 +- .../repo/include/mbedtls/rsa_internal.h | 8 +- .../mbedtls/repo/include/mbedtls/sha1.h | 71 +- .../mbedtls/repo/include/mbedtls/sha256.h | 98 +- .../mbedtls/repo/include/mbedtls/sha512.h | 119 +- .../mbedtls/repo/include/mbedtls/ssl.h | 1326 +- .../mbedtls/repo/include/mbedtls/ssl_cache.h | 17 +- .../repo/include/mbedtls/ssl_ciphersuites.h | 78 +- .../mbedtls/repo/include/mbedtls/ssl_cookie.h | 14 +- .../repo/include/mbedtls/ssl_internal.h | 621 +- .../mbedtls/repo/include/mbedtls/ssl_ticket.h | 20 +- .../mbedtls/repo/include/mbedtls/threading.h | 6 +- .../mbedtls/repo/include/mbedtls/timing.h | 6 +- .../mbedtls/repo/include/mbedtls/version.h | 14 +- .../mbedtls/repo/include/mbedtls/x509.h | 80 +- .../mbedtls/repo/include/mbedtls/x509_crl.h | 12 +- .../mbedtls/repo/include/mbedtls/x509_crt.h | 453 +- .../mbedtls/repo/include/mbedtls/x509_csr.h | 16 +- .../mbedtls/repo/include/mbedtls/xtea.h | 10 +- third_party/mbedtls/repo/include/psa/crypto.h | 3751 ++++++ .../repo/include/psa/crypto_accel_driver.h | 823 ++ .../mbedtls/repo/include/psa/crypto_compat.h | 359 + .../mbedtls/repo/include/psa/crypto_config.h | 78 + .../repo/include/psa/crypto_driver_common.h | 54 + .../repo/include/psa/crypto_entropy_driver.h | 108 + .../mbedtls/repo/include/psa/crypto_extra.h | 656 + .../repo/include/psa/crypto_platform.h | 84 + .../repo/include/psa/crypto_se_driver.h | 1392 ++ .../mbedtls/repo/include/psa/crypto_sizes.h | 747 ++ .../mbedtls/repo/include/psa/crypto_struct.h | 498 + .../mbedtls/repo/include/psa/crypto_types.h | 395 + .../mbedtls/repo/include/psa/crypto_values.h | 1882 +++ .../mbedtls/repo/library/CMakeLists.txt | 110 +- third_party/mbedtls/repo/library/Makefile | 149 +- third_party/mbedtls/repo/library/aes.c | 391 +- third_party/mbedtls/repo/library/aesni.c | 10 +- third_party/mbedtls/repo/library/arc4.c | 10 +- third_party/mbedtls/repo/library/aria.c | 67 +- third_party/mbedtls/repo/library/asn1parse.c | 222 +- third_party/mbedtls/repo/library/asn1write.c | 177 +- third_party/mbedtls/repo/library/base64.c | 10 +- third_party/mbedtls/repo/library/bignum.c | 797 +- third_party/mbedtls/repo/library/blowfish.c | 68 +- third_party/mbedtls/repo/library/camellia.c | 80 +- third_party/mbedtls/repo/library/ccm.c | 121 +- third_party/mbedtls/repo/library/certs.c | 2016 ++- third_party/mbedtls/repo/library/chacha20.c | 76 +- third_party/mbedtls/repo/library/chachapoly.c | 139 +- .../repo/library/check_crypto_config.h | 72 + third_party/mbedtls/repo/library/cipher.c | 690 +- .../mbedtls/repo/library/cipher_wrap.c | 174 +- third_party/mbedtls/repo/library/cmac.c | 31 +- third_party/mbedtls/repo/library/common.h | 53 + third_party/mbedtls/repo/library/ctr_drbg.c | 430 +- third_party/mbedtls/repo/library/debug.c | 125 +- third_party/mbedtls/repo/library/des.c | 117 +- third_party/mbedtls/repo/library/dhm.c | 155 +- third_party/mbedtls/repo/library/ecdh.c | 519 +- third_party/mbedtls/repo/library/ecdsa.c | 261 +- third_party/mbedtls/repo/library/ecjpake.c | 85 +- third_party/mbedtls/repo/library/ecp.c | 1353 +- third_party/mbedtls/repo/library/ecp_curves.c | 118 +- third_party/mbedtls/repo/library/entropy.c | 33 +- .../mbedtls/repo/library/entropy_poll.c | 111 +- third_party/mbedtls/repo/library/error.c | 1366 +- third_party/mbedtls/repo/library/gcm.c | 196 +- third_party/mbedtls/repo/library/havege.c | 32 +- third_party/mbedtls/repo/library/hkdf.c | 19 +- third_party/mbedtls/repo/library/hmac_drbg.c | 261 +- third_party/mbedtls/repo/library/md.c | 505 +- third_party/mbedtls/repo/library/md2.c | 23 +- third_party/mbedtls/repo/library/md4.c | 202 +- third_party/mbedtls/repo/library/md5.c | 225 +- third_party/mbedtls/repo/library/md_wrap.c | 586 - .../repo/library/memory_buffer_alloc.c | 10 +- .../mbedtls/repo/library/net_sockets.c | 50 +- third_party/mbedtls/repo/library/nist_kw.c | 17 +- third_party/mbedtls/repo/library/oid.c | 126 +- third_party/mbedtls/repo/library/padlock.c | 14 +- third_party/mbedtls/repo/library/pem.c | 31 +- third_party/mbedtls/repo/library/pk.c | 189 +- third_party/mbedtls/repo/library/pk_wrap.c | 382 +- third_party/mbedtls/repo/library/pkcs11.c | 4 +- third_party/mbedtls/repo/library/pkcs12.c | 21 +- third_party/mbedtls/repo/library/pkcs5.c | 98 +- third_party/mbedtls/repo/library/pkparse.c | 214 +- third_party/mbedtls/repo/library/pkwrite.c | 162 +- third_party/mbedtls/repo/library/platform.c | 86 +- .../mbedtls/repo/library/platform_util.c | 20 +- third_party/mbedtls/repo/library/poly1305.c | 74 +- third_party/mbedtls/repo/library/psa_crypto.c | 6706 ++++++++++ .../mbedtls/repo/library/psa_crypto_core.h | 211 + .../repo/library/psa_crypto_driver_wrappers.c | 993 ++ .../repo/library/psa_crypto_driver_wrappers.h | 124 + .../repo/library/psa_crypto_invasive.h | 77 + .../mbedtls/repo/library/psa_crypto_its.h | 149 + .../mbedtls/repo/library/psa_crypto_se.c | 383 + .../mbedtls/repo/library/psa_crypto_se.h | 187 + .../library/psa_crypto_service_integration.h | 39 + .../repo/library/psa_crypto_slot_management.c | 478 + .../repo/library/psa_crypto_slot_management.h | 229 + .../mbedtls/repo/library/psa_crypto_storage.c | 523 + .../mbedtls/repo/library/psa_crypto_storage.h | 389 + .../mbedtls/repo/library/psa_its_file.c | 259 + third_party/mbedtls/repo/library/ripemd160.c | 275 +- third_party/mbedtls/repo/library/rsa.c | 557 +- .../mbedtls/repo/library/rsa_internal.c | 10 +- third_party/mbedtls/repo/library/sha1.c | 295 +- third_party/mbedtls/repo/library/sha256.c | 150 +- third_party/mbedtls/repo/library/sha512.c | 211 +- third_party/mbedtls/repo/library/ssl_cache.c | 72 +- .../mbedtls/repo/library/ssl_ciphersuites.c | 71 +- third_party/mbedtls/repo/library/ssl_cli.c | 1958 ++- third_party/mbedtls/repo/library/ssl_cookie.c | 21 +- .../mbedtls/repo/library/ssl_invasive.h | 100 + third_party/mbedtls/repo/library/ssl_msg.c | 6037 +++++++++ third_party/mbedtls/repo/library/ssl_srv.c | 720 +- third_party/mbedtls/repo/library/ssl_ticket.c | 226 +- third_party/mbedtls/repo/library/ssl_tls.c | 9213 ++++++-------- .../mbedtls/repo/library/ssl_tls13_keys.c | 349 + .../mbedtls/repo/library/ssl_tls13_keys.h | 274 + third_party/mbedtls/repo/library/threading.c | 14 +- third_party/mbedtls/repo/library/timing.c | 13 +- third_party/mbedtls/repo/library/version.c | 10 +- .../mbedtls/repo/library/version_features.c | 104 +- third_party/mbedtls/repo/library/x509.c | 115 +- .../mbedtls/repo/library/x509_create.c | 21 +- third_party/mbedtls/repo/library/x509_crl.c | 41 +- third_party/mbedtls/repo/library/x509_crt.c | 959 +- third_party/mbedtls/repo/library/x509_csr.c | 36 +- .../mbedtls/repo/library/x509write_crt.c | 295 +- .../mbedtls/repo/library/x509write_csr.c | 203 +- third_party/mbedtls/repo/library/xtea.c | 10 +- third_party/mbedtls/repo/programs/.gitignore | 15 +- .../mbedtls/repo/programs/CMakeLists.txt | 6 +- third_party/mbedtls/repo/programs/Makefile | 155 +- third_party/mbedtls/repo/programs/README.md | 2 - .../mbedtls/repo/programs/aes/CMakeLists.txt | 14 +- .../mbedtls/repo/programs/aes/aescrypt2.c | 21 +- .../repo/programs/aes/crypt_and_hash.c | 22 +- .../mbedtls/repo/programs/fuzz/.gitignore | 10 + .../mbedtls/repo/programs/fuzz/CMakeLists.txt | 51 + .../mbedtls/repo/programs/fuzz/Makefile | 74 + .../mbedtls/repo/programs/fuzz/README.md | 68 + .../mbedtls/repo/programs/fuzz/common.c | 96 + .../mbedtls/repo/programs/fuzz/common.h | 19 + .../repo/programs/fuzz/corpuses/client | Bin 0 -> 4037 bytes .../repo/programs/fuzz/corpuses/dtlsclient | Bin 0 -> 4058 bytes .../repo/programs/fuzz/corpuses/dtlsserver | Bin 0 -> 1189 bytes .../repo/programs/fuzz/corpuses/server | Bin 0 -> 675 bytes .../mbedtls/repo/programs/fuzz/fuzz_client.c | 177 + .../repo/programs/fuzz/fuzz_client.options | 2 + .../repo/programs/fuzz/fuzz_dtlsclient.c | 123 + .../programs/fuzz/fuzz_dtlsclient.options | 2 + .../repo/programs/fuzz/fuzz_dtlsserver.c | 148 + .../programs/fuzz/fuzz_dtlsserver.options | 2 + .../mbedtls/repo/programs/fuzz/fuzz_privkey.c | 75 + .../repo/programs/fuzz/fuzz_privkey.options | 2 + .../mbedtls/repo/programs/fuzz/fuzz_pubkey.c | 75 + .../repo/programs/fuzz/fuzz_pubkey.options | 2 + .../mbedtls/repo/programs/fuzz/fuzz_server.c | 189 + .../repo/programs/fuzz/fuzz_server.options | 2 + .../mbedtls/repo/programs/fuzz/fuzz_x509crl.c | 22 + .../repo/programs/fuzz/fuzz_x509crl.options | 2 + .../mbedtls/repo/programs/fuzz/fuzz_x509crt.c | 22 + .../repo/programs/fuzz/fuzz_x509crt.options | 2 + .../mbedtls/repo/programs/fuzz/fuzz_x509csr.c | 22 + .../repo/programs/fuzz/fuzz_x509csr.options | 2 + .../mbedtls/repo/programs/fuzz/onefile.c | 60 + .../mbedtls/repo/programs/hash/CMakeLists.txt | 14 +- .../mbedtls/repo/programs/hash/generic_sum.c | 17 +- .../mbedtls/repo/programs/hash/hello.c | 13 +- .../mbedtls/repo/programs/pkey/CMakeLists.txt | 90 +- .../mbedtls/repo/programs/pkey/dh_client.c | 11 +- .../mbedtls/repo/programs/pkey/dh_genprime.c | 12 +- .../mbedtls/repo/programs/pkey/dh_server.c | 11 +- .../repo/programs/pkey/ecdh_curve25519.c | 16 +- .../mbedtls/repo/programs/pkey/ecdsa.c | 12 +- .../mbedtls/repo/programs/pkey/gen_key.c | 27 +- .../mbedtls/repo/programs/pkey/key_app.c | 18 +- .../repo/programs/pkey/key_app_writer.c | 25 +- .../mbedtls/repo/programs/pkey/mpi_demo.c | 11 +- .../mbedtls/repo/programs/pkey/pk_decrypt.c | 23 +- .../mbedtls/repo/programs/pkey/pk_encrypt.c | 17 +- .../mbedtls/repo/programs/pkey/pk_sign.c | 15 +- .../mbedtls/repo/programs/pkey/pk_verify.c | 17 +- .../mbedtls/repo/programs/pkey/rsa_decrypt.c | 14 +- .../mbedtls/repo/programs/pkey/rsa_encrypt.c | 10 +- .../mbedtls/repo/programs/pkey/rsa_genkey.c | 25 +- .../mbedtls/repo/programs/pkey/rsa_sign.c | 14 +- .../mbedtls/repo/programs/pkey/rsa_sign_pss.c | 13 +- .../mbedtls/repo/programs/pkey/rsa_verify.c | 17 +- .../repo/programs/pkey/rsa_verify_pss.c | 12 +- .../mbedtls/repo/programs/psa/CMakeLists.txt | 21 + .../repo/programs/psa/crypto_examples.c | 331 + .../repo/programs/psa/key_ladder_demo.c | 698 + .../repo/programs/psa/key_ladder_demo.sh | 65 + .../repo/programs/psa/psa_constant_names.c | 327 + .../psa/psa_constant_names_generated.c | 399 + .../repo/programs/random/CMakeLists.txt | 18 +- .../repo/programs/random/gen_entropy.c | 17 +- .../programs/random/gen_random_ctr_drbg.c | 15 +- .../repo/programs/random/gen_random_havege.c | 15 +- .../mbedtls/repo/programs/ssl/CMakeLists.txt | 62 +- .../mbedtls/repo/programs/ssl/dtls_client.c | 19 +- .../mbedtls/repo/programs/ssl/dtls_server.c | 19 +- .../mbedtls/repo/programs/ssl/mini_client.c | 37 +- .../mbedtls/repo/programs/ssl/ssl_client1.c | 14 +- .../mbedtls/repo/programs/ssl/ssl_client2.c | 1802 ++- .../repo/programs/ssl/ssl_context_info.c | 1112 ++ .../repo/programs/ssl/ssl_fork_server.c | 15 +- .../repo/programs/ssl/ssl_mail_client.c | 41 +- .../repo/programs/ssl/ssl_pthread_server.c | 14 +- .../mbedtls/repo/programs/ssl/ssl_server.c | 14 +- .../mbedtls/repo/programs/ssl/ssl_server2.c | 1694 ++- .../mbedtls/repo/programs/test/CMakeLists.txt | 38 +- .../mbedtls/repo/programs/test/benchmark.c | 177 +- .../programs/test/cmake_subproject/.gitignore | 3 + .../test/cmake_subproject/CMakeLists.txt | 23 + .../test/cmake_subproject/cmake_subproject.c | 54 + .../repo/programs/test/cpp_dummy_build.cpp | 11 +- .../programs/test/query_compile_time_config.c | 54 + .../mbedtls/repo/programs/test/query_config.c | 2777 ++++ .../mbedtls/repo/programs/test/selftest.c | 94 +- .../repo/programs/test/ssl_cert_test.c | 261 - .../mbedtls/repo/programs/test/udp_proxy.c | 140 +- .../repo/programs/test/udp_proxy_wrapper.sh | 15 + .../mbedtls/repo/programs/test/zeroize.c | 21 +- .../mbedtls/repo/programs/util/CMakeLists.txt | 16 +- .../mbedtls/repo/programs/util/pem2der.c | 11 +- .../mbedtls/repo/programs/util/strerror.c | 14 +- .../mbedtls/repo/programs/wince_main.c | 4 +- .../mbedtls/repo/programs/x509/CMakeLists.txt | 28 +- .../mbedtls/repo/programs/x509/cert_app.c | 22 +- .../mbedtls/repo/programs/x509/cert_req.c | 94 +- .../mbedtls/repo/programs/x509/cert_write.c | 62 +- .../mbedtls/repo/programs/x509/crl_app.c | 10 +- .../mbedtls/repo/programs/x509/req_app.c | 10 +- third_party/mbedtls/repo/scripts/abi_check.py | 461 +- .../mbedtls/repo/scripts/apidoc_full.sh | 17 +- .../repo/scripts/assemble_changelog.py | 503 + .../mbedtls/repo/scripts/bump_version.sh | 18 +- third_party/mbedtls/repo/scripts/config.pl | 316 +- third_party/mbedtls/repo/scripts/config.py | 534 + .../mbedtls/repo/scripts/data_files/error.fmt | 110 +- .../repo/scripts/data_files/query_config.fmt | 137 + .../scripts/data_files/rename-1.3-2.0.txt | 6 +- .../scripts/data_files/version_features.fmt | 14 +- .../data_files/vs2010-app-template.vcxproj | 37 +- .../data_files/vs2010-main-template.vcxproj | 33 +- .../scripts/data_files/vs6-main-template.dsp | 20 +- third_party/mbedtls/repo/scripts/ecc-heap.sh | 19 +- third_party/mbedtls/repo/scripts/footprint.sh | 23 +- .../mbedtls/repo/scripts/generate_errors.pl | 55 +- .../mbedtls/repo/scripts/generate_features.pl | 14 + .../repo/scripts/generate_psa_constants.py | 423 + .../repo/scripts/generate_query_config.pl | 90 + .../repo/scripts/generate_visualc_files.pl | 101 +- .../mbedtls/repo/scripts/massif_max.pl | 15 + third_party/mbedtls/repo/scripts/memory.sh | 19 +- .../mbedtls/repo/scripts/output_env.sh | 153 +- third_party/mbedtls/repo/scripts/rename.pl | 15 +- .../repo/scripts/tmp_ignore_makefiles.sh | 15 + .../mbedtls/repo/scripts/windows_msbuild.bat | 20 + third_party/mbedtls/repo/tests/.gitignore | 6 + third_party/mbedtls/repo/tests/CMakeLists.txt | 77 +- third_party/mbedtls/repo/tests/Makefile | 73 +- .../mbedtls/repo/tests/compat-in-docker.sh | 63 + third_party/mbedtls/repo/tests/compat.sh | 81 +- .../configs/config-wrapper-malloc-0-null.h | 37 + .../mbedtls/repo/tests/context-info.sh | 448 + .../mbedtls/repo/tests/data_files/Makefile | 282 +- .../repo/tests/data_files/Readme-x509.txt | 2 +- .../repo/tests/data_files/base64/cli_cid.txt | 2 + .../data_files/base64/cli_ciphersuite.txt | 2 + .../repo/tests/data_files/base64/cli_def.txt | 2 + .../tests/data_files/base64/cli_min_cfg.txt | 2 + .../tests/data_files/base64/cli_no_alpn.txt | 3 + .../data_files/base64/cli_no_keep_cert.txt | 2 + .../tests/data_files/base64/cli_no_mfl.txt | 2 + .../data_files/base64/cli_no_packing.txt | 2 + .../tests/data_files/base64/def_b64_ff.bin | 5 + .../data_files/base64/def_b64_too_big_1.txt | 2 + .../data_files/base64/def_b64_too_big_2.txt | 2 + .../data_files/base64/def_b64_too_big_3.txt | 2 + .../tests/data_files/base64/def_bad_b64.txt | 2 + .../repo/tests/data_files/base64/empty.txt | 0 .../repo/tests/data_files/base64/mfl_1024.txt | 2 + .../tests/data_files/base64/mtu_10000.txt | 2 + .../repo/tests/data_files/base64/srv_cid.txt | 2 + .../data_files/base64/srv_ciphersuite.txt | 2 + .../repo/tests/data_files/base64/srv_def.txt | 2 + .../tests/data_files/base64/srv_min_cfg.txt | 2 + .../tests/data_files/base64/srv_no_alpn.txt | 2 + .../data_files/base64/srv_no_keep_cert.txt | 2 + .../tests/data_files/base64/srv_no_mfl.txt | 2 + .../data_files/base64/srv_no_packing.txt | 2 + .../repo/tests/data_files/base64/v2.19.1.txt | 2 + .../repo/tests/data_files/bitstring-in-dn.pem | 102 +- .../tests/data_files/cert_example_multi.crt | 93 +- .../data_files/cert_example_wildcard.crt | 91 +- .../repo/tests/data_files/cert_md2.crt | 91 +- .../repo/tests/data_files/cert_md2.csr | 16 + .../repo/tests/data_files/cert_md4.crt | 89 +- .../repo/tests/data_files/cert_md4.csr | 16 + .../repo/tests/data_files/cert_md5.crt | 89 +- .../repo/tests/data_files/cert_md5.csr | 16 + .../repo/tests/data_files/cert_sha1.crt | 89 +- .../repo/tests/data_files/cert_sha224.crt | 91 +- .../repo/tests/data_files/cert_sha256.crt | 91 +- .../repo/tests/data_files/cert_sha384.crt | 91 +- .../repo/tests/data_files/cert_sha512.crt | 91 +- .../repo/tests/data_files/cli-rsa-sha1.crt | 14 +- .../data_files/cli-rsa-sha256-badalg.crt.der | Bin 0 -> 835 bytes .../repo/tests/data_files/cli-rsa-sha256.crt | 14 +- .../tests/data_files/cli-rsa-sha256.crt.der | Bin 0 -> 835 bytes .../tests/data_files/cli-rsa-sha256.key.der | Bin 0 -> 1192 bytes .../repo/tests/data_files/cli-rsa.key.der | Bin 0 -> 1192 bytes .../mbedtls/repo/tests/data_files/cli2.crt | 23 +- .../repo/tests/data_files/cli2.crt.der | Bin 0 -> 483 bytes .../repo/tests/data_files/cli2.key.der | Bin 0 -> 121 bytes .../data_files/crl-futureRevocationDate.pem | 11 + .../mbedtls/repo/tests/data_files/crl.pem | 18 +- .../tests/data_files/crl_cat_ecfut-rsa.pem | 18 +- .../repo/tests/data_files/dir-maxpath/long.sh | 15 + .../repo/tests/data_files/ec_256_long_prv.pem | 5 + .../tests/data_files/ec_521_short_prv.pem | 7 + .../repo/tests/data_files/enco-ca-prstr.pem | 25 +- .../tests/data_files/enco-cert-utf8str.pem | 23 +- .../repo/tests/data_files/multiple_san.crt | 12 + .../data_files/non-ascii-string-in-issuer.crt | 22 + .../mbedtls/repo/tests/data_files/print_c.pl | 16 + .../tests/data_files/rsa_pkcs1_1024_clear.pem | 26 +- .../tests/data_files/server1-ms.req.sha256 | 16 + .../tests/data_files/server1.cert_type.crt | 14 +- .../data_files/server1.cert_type_noauthid.crt | 16 +- .../mbedtls/repo/tests/data_files/server1.crt | 14 +- .../repo/tests/data_files/server1.crt.der | Bin 0 -> 835 bytes .../mbedtls/repo/tests/data_files/server1.der | Bin 0 -> 835 bytes .../tests/data_files/server1.key_usage.crt | 16 +- .../data_files/server1.key_usage_noauthid.crt | 16 +- .../tests/data_files/server1.noauthid.crt | 14 +- .../tests/data_files/server1.req.cert_type | 14 +- .../data_files/server1.req.cert_type_empty | 17 + .../tests/data_files/server1.req.key_usage | 14 +- .../data_files/server1.req.key_usage_empty | 17 + .../repo/tests/data_files/server1.req.ku-ct | 14 +- .../repo/tests/data_files/server1.v1.crt | 16 +- .../repo/tests/data_files/server1_ca.crt | 43 +- .../data_files/server1_pathlen_int_max-1.crt | 20 + .../data_files/server1_pathlen_int_max.crt | 20 + .../repo/tests/data_files/server2-badsign.crt | 20 +- .../repo/tests/data_files/server2-sha256.crt | 16 +- .../tests/data_files/server2-sha256.crt.der | Bin 0 -> 827 bytes .../mbedtls/repo/tests/data_files/server2.crt | 16 +- .../repo/tests/data_files/server2.crt.der | Bin 0 -> 827 bytes .../mbedtls/repo/tests/data_files/server2.der | Bin 0 -> 827 bytes .../repo/tests/data_files/server2.key.der | Bin 0 -> 1192 bytes .../repo/tests/data_files/server2.key.enc | 30 + .../repo/tests/data_files/server5-fan.crt | 10 + .../tests/data_files/server5-othername.crt | 11 + .../tests/data_files/server5-ss-forgeca.crt | 6 +- .../data_files/server5-tricky-ip-san.crt | 11 + .../server5-unsupported_othername.crt | 12 + .../repo/tests/data_files/server5.crt.der | Bin 0 -> 547 bytes .../repo/tests/data_files/server5.key.der | Bin 0 -> 121 bytes .../repo/tests/data_files/server5.key.enc | 8 + .../repo/tests/data_files/server5.req.ku.sha1 | 6 +- .../tests/data_files/test-ca-alt-good.crt | 44 +- .../repo/tests/data_files/test-ca-alt.crt | 30 +- .../repo/tests/data_files/test-ca-alt.csr | 24 +- .../repo/tests/data_files/test-ca-alt.key | 50 +- .../tests/data_files/test-ca-any_policy.crt | 19 + .../data_files/test-ca-any_policy_ec.crt | 12 + .../test-ca-any_policy_with_qualifier.crt | 20 + .../test-ca-any_policy_with_qualifier_ec.crt | 13 + .../tests/data_files/test-ca-good-alt.crt | 44 +- .../tests/data_files/test-ca-multi_policy.crt | 19 + .../data_files/test-ca-multi_policy_ec.crt | 12 + .../repo/tests/data_files/test-ca-sha1.crt | 14 +- .../tests/data_files/test-ca-sha1.crt.der | Bin 0 -> 837 bytes .../repo/tests/data_files/test-ca-sha256.crt | 14 +- .../tests/data_files/test-ca-sha256.crt.der | Bin 0 -> 837 bytes .../data_files/test-ca-unsupported_policy.crt | 19 + .../test-ca-unsupported_policy_ec.crt | 12 + .../mbedtls/repo/tests/data_files/test-ca.crt | 14 +- .../repo/tests/data_files/test-ca.crt.der | Bin 0 -> 837 bytes .../mbedtls/repo/tests/data_files/test-ca.der | Bin 0 -> 837 bytes .../repo/tests/data_files/test-ca.key.der | Bin 0 -> 1192 bytes .../repo/tests/data_files/test-ca.opensslconf | 49 + .../repo/tests/data_files/test-ca.server1.db | 2 + .../data_files/test-ca.server1.future-crl.db | 2 + .../test-ca.server1.future-crl.opensslconf | 18 + .../data_files/test-ca.server1.opensslconf | 2 +- .../repo/tests/data_files/test-ca2.crt | 24 +- .../repo/tests/data_files/test-ca2.crt.der | Bin 0 -> 520 bytes .../repo/tests/data_files/test-ca2.key.der | Bin 0 -> 167 bytes .../repo/tests/data_files/test-ca2.key.enc | 9 + .../repo/tests/data_files/test-ca_cat12.crt | 14 +- .../repo/tests/data_files/test-ca_cat21.crt | 14 +- .../tests/data_files/test-ca_printable.crt | 26 +- .../tests/data_files/test-ca_uppercase.crt | 21 +- .../repo/tests/data_files/test-ca_utf8.crt | 21 +- .../repo/tests/docker/bionic/Dockerfile | 166 + .../repo/tests/git-scripts/pre-commit.sh | 34 + .../repo/tests/git-scripts/pre-push.sh | 30 +- .../repo/tests/include/test/constant_flow.h | 81 + .../repo/tests/include/test/drivers/cipher.h | 180 + .../include/test/drivers/key_management.h | 78 + .../tests/include/test/drivers/signature.h | 82 + .../repo/tests/include/test/drivers/size.h | 95 + .../tests/include/test/drivers/test_driver.h | 30 + .../mbedtls/repo/tests/include/test/helpers.h | 193 + .../mbedtls/repo/tests/include/test/macros.h | 136 + .../tests/include/test/psa_crypto_helpers.h | 134 + .../repo/tests/include/test/psa_helpers.h | 36 + .../mbedtls/repo/tests/include/test/random.h | 105 + .../mbedtls/repo/tests/make-in-docker.sh | 29 + .../repo/tests/scripts/all-in-docker.sh | 35 + third_party/mbedtls/repo/tests/scripts/all.sh | 2782 +++- .../repo/tests/scripts/analyze_outcomes.py | 131 + .../repo/tests/scripts/basic-build-test.sh | 105 +- .../repo/tests/scripts/basic-in-docker.sh | 45 + .../repo/tests/scripts/check-doxy-blocks.pl | 15 + .../mbedtls/repo/tests/scripts/check-files.py | 235 - .../tests/scripts/check-generated-files.sh | 49 +- .../mbedtls/repo/tests/scripts/check-names.sh | 72 +- .../repo/tests/scripts/check-python-files.sh | 25 +- .../mbedtls/repo/tests/scripts/check_files.py | 354 + .../repo/tests/scripts/check_test_cases.py | 192 + .../mbedtls/repo/tests/scripts/curves.pl | 109 +- .../repo/tests/scripts/depends-hashes.pl | 36 +- .../repo/tests/scripts/depends-pkalgs.pl | 24 +- .../mbedtls/repo/tests/scripts/docker_env.sh | 98 + .../mbedtls/repo/tests/scripts/doxygen.sh | 15 + .../repo/tests/scripts/gen_ctr_drbg.pl | 15 + .../repo/tests/scripts/gen_gcm_decrypt.pl | 15 + .../repo/tests/scripts/gen_gcm_encrypt.pl | 15 + .../scripts/gen_pkcs1_v21_sign_verify.pl | 14 + .../repo/tests/scripts/generate-afl-tests.sh | 15 + .../repo/tests/scripts/generate_test_code.py | 36 +- .../repo/tests/scripts/key-exchanges.pl | 20 +- .../repo/tests/scripts/list-enum-consts.pl | 20 +- .../repo/tests/scripts/list-identifiers.sh | 50 +- .../mbedtls/repo/tests/scripts/list-macros.sh | 25 +- .../repo/tests/scripts/list-symbols.sh | 36 +- .../repo/tests/scripts/mbedtls_test.py | 52 +- .../tests/scripts/psa_collect_statuses.py | 140 + .../mbedtls/repo/tests/scripts/recursion.pl | 15 + .../repo/tests/scripts/run-test-suites.pl | 111 +- .../mbedtls/repo/tests/scripts/tcp_client.pl | 15 + .../repo/tests/scripts/test-ref-configs.pl | 37 +- .../repo/tests/scripts/test_config_script.py | 186 + .../tests/scripts/test_generate_test_code.py | 20 +- .../tests/scripts/test_psa_constant_names.py | 474 + .../repo/tests/scripts/test_zeroize.gdb | 31 +- .../repo/tests/scripts/travis-log-failure.sh | 15 +- .../mbedtls/repo/tests/src/drivers/cipher.c | 611 + .../repo/tests/src/drivers/key_management.c | 355 + .../repo/tests/src/drivers/signature.c | 291 + .../mbedtls/repo/tests/src/drivers/size.c | 42 + third_party/mbedtls/repo/tests/src/helpers.c | 246 + third_party/mbedtls/repo/tests/src/random.c | 135 + .../mbedtls/repo/tests/ssl-opt-in-docker.sh | 63 + third_party/mbedtls/repo/tests/ssl-opt.sh | 2821 +++- .../repo/tests/suites/helpers.function | 691 +- .../repo/tests/suites/host_test.function | 231 +- .../repo/tests/suites/main_test.function | 70 +- .../repo/tests/suites/target_test.function | 69 +- .../repo/tests/suites/test_suite_aes.function | 368 +- .../tests/suites/test_suite_aes.rest.data | 6 + .../tests/suites/test_suite_arc4.function | 9 +- .../repo/tests/suites/test_suite_aria.data | 17 +- .../tests/suites/test_suite_aria.function | 411 +- .../tests/suites/test_suite_asn1parse.data | 632 + .../suites/test_suite_asn1parse.function | 793 ++ .../tests/suites/test_suite_asn1write.data | 359 +- .../suites/test_suite_asn1write.function | 439 +- .../tests/suites/test_suite_base64.function | 4 +- .../tests/suites/test_suite_blowfish.data | 26 +- .../tests/suites/test_suite_blowfish.function | 193 +- .../tests/suites/test_suite_camellia.data | 22 +- .../tests/suites/test_suite_camellia.function | 194 +- .../repo/tests/suites/test_suite_ccm.data | 14 +- .../repo/tests/suites/test_suite_ccm.function | 331 +- .../tests/suites/test_suite_chacha20.function | 120 +- .../suites/test_suite_chachapoly.function | 252 +- .../tests/suites/test_suite_cipher.aes.data | 200 +- .../tests/suites/test_suite_cipher.arc4.data | 14 +- .../tests/suites/test_suite_cipher.aria.data | 3 + .../suites/test_suite_cipher.blowfish.data | 172 +- .../suites/test_suite_cipher.camellia.data | 280 +- .../tests/suites/test_suite_cipher.ccm.data | 623 +- .../suites/test_suite_cipher.chacha20.data | 4 - .../suites/test_suite_cipher.chachapoly.data | 6 +- .../tests/suites/test_suite_cipher.des.data | 138 +- .../tests/suites/test_suite_cipher.function | 1075 +- .../tests/suites/test_suite_cipher.gcm.data | 4096 +++++- .../tests/suites/test_suite_cipher.misc.data | 5 + .../suites/test_suite_cipher.nist_kw.data | 278 + .../tests/suites/test_suite_cipher.null.data | 6 +- .../suites/test_suite_cipher.padding.data | 3 - .../tests/suites/test_suite_ctr_drbg.data | 384 +- .../tests/suites/test_suite_ctr_drbg.function | 105 +- .../repo/tests/suites/test_suite_debug.data | 4 +- .../repo/tests/suites/test_suite_des.function | 39 +- .../repo/tests/suites/test_suite_dhm.data | 13 +- .../repo/tests/suites/test_suite_dhm.function | 172 +- .../repo/tests/suites/test_suite_ecdh.data | 38 + .../tests/suites/test_suite_ecdh.function | 418 +- .../repo/tests/suites/test_suite_ecdsa.data | 123 +- .../tests/suites/test_suite_ecdsa.function | 284 +- .../repo/tests/suites/test_suite_ecjpake.data | 6 + .../tests/suites/test_suite_ecjpake.function | 121 + .../repo/tests/suites/test_suite_ecp.data | 140 +- .../repo/tests/suites/test_suite_ecp.function | 525 +- .../repo/tests/suites/test_suite_entropy.data | 43 +- .../tests/suites/test_suite_entropy.function | 206 +- .../suites/test_suite_gcm.aes128_de.data | 336 +- .../suites/test_suite_gcm.aes128_en.data | 336 +- .../suites/test_suite_gcm.aes192_de.data | 336 +- .../suites/test_suite_gcm.aes192_en.data | 336 +- .../suites/test_suite_gcm.aes256_de.data | 336 +- .../suites/test_suite_gcm.aes256_en.data | 336 +- .../repo/tests/suites/test_suite_gcm.function | 183 +- .../tests/suites/test_suite_gcm.misc.data | 5 + .../tests/suites/test_suite_hkdf.function | 43 +- .../suites/test_suite_hmac_drbg.function | 58 +- .../suites/test_suite_hmac_drbg.misc.data | 28 +- .../test_suite_hmac_drbg.no_reseed.data | 120 +- .../suites/test_suite_hmac_drbg.nopr.data | 120 +- .../tests/suites/test_suite_hmac_drbg.pr.data | 120 +- .../repo/tests/suites/test_suite_md.data | 74 +- .../repo/tests/suites/test_suite_md.function | 55 +- .../repo/tests/suites/test_suite_mdx.function | 20 +- .../test_suite_memory_buffer_alloc.data | 6 +- .../test_suite_memory_buffer_alloc.function | 30 +- .../repo/tests/suites/test_suite_mpi.data | 293 +- .../repo/tests/suites/test_suite_mpi.function | 564 +- .../repo/tests/suites/test_suite_nist_kw.data | 4 +- .../tests/suites/test_suite_nist_kw.function | 77 +- .../repo/tests/suites/test_suite_oid.data | 91 + .../repo/tests/suites/test_suite_oid.function | 109 + .../repo/tests/suites/test_suite_pk.data | 156 +- .../repo/tests/suites/test_suite_pk.function | 765 +- .../tests/suites/test_suite_pkcs1_v15.data | 96 + .../suites/test_suite_pkcs1_v15.function | 226 +- .../tests/suites/test_suite_pkcs1_v21.data | 12 +- .../suites/test_suite_pkcs1_v21.function | 87 +- .../repo/tests/suites/test_suite_pkcs5.data | 10 +- .../tests/suites/test_suite_pkcs5.function | 5 +- .../repo/tests/suites/test_suite_pkparse.data | 145 +- .../tests/suites/test_suite_pkparse.function | 15 +- .../repo/tests/suites/test_suite_pkwrite.data | 8 + .../tests/suites/test_suite_pkwrite.function | 24 +- .../tests/suites/test_suite_poly1305.function | 106 +- .../tests/suites/test_suite_psa_crypto.data | 2815 ++++ .../suites/test_suite_psa_crypto.function | 5876 +++++++++ ...test_suite_psa_crypto_driver_wrappers.data | 187 + ..._suite_psa_crypto_driver_wrappers.function | 813 ++ .../suites/test_suite_psa_crypto_entropy.data | 18 + .../test_suite_psa_crypto_entropy.function | 116 + .../suites/test_suite_psa_crypto_hash.data | 587 + .../test_suite_psa_crypto_hash.function | 104 + .../suites/test_suite_psa_crypto_init.data | 66 + .../test_suite_psa_crypto_init.function | 291 + .../test_suite_psa_crypto_metadata.data | 306 + .../test_suite_psa_crypto_metadata.function | 535 + .../test_suite_psa_crypto_persistent_key.data | 115 + ...t_suite_psa_crypto_persistent_key.function | 326 + .../test_suite_psa_crypto_se_driver_hal.data | 187 + ...st_suite_psa_crypto_se_driver_hal.function | 1546 +++ ..._suite_psa_crypto_se_driver_hal_mocks.data | 59 + ...te_psa_crypto_se_driver_hal_mocks.function | 685 + ...test_suite_psa_crypto_slot_management.data | 208 + ..._suite_psa_crypto_slot_management.function | 1111 ++ .../repo/tests/suites/test_suite_psa_its.data | 65 + .../tests/suites/test_suite_psa_its.function | 233 + .../repo/tests/suites/test_suite_rsa.data | 48 +- .../repo/tests/suites/test_suite_rsa.function | 622 +- .../repo/tests/suites/test_suite_shax.data | 34 +- .../tests/suites/test_suite_shax.function | 179 +- .../repo/tests/suites/test_suite_ssl.data | 10626 ++++++++++++++++ .../repo/tests/suites/test_suite_ssl.function | 4495 +++++++ .../repo/tests/suites/test_suite_timing.data | 54 +- .../tests/suites/test_suite_timing.function | 403 +- .../repo/tests/suites/test_suite_version.data | 4 +- .../tests/suites/test_suite_version.function | 2 +- .../tests/suites/test_suite_x509parse.data | 1982 ++- .../suites/test_suite_x509parse.function | 443 +- .../tests/suites/test_suite_x509write.data | 53 +- .../suites/test_suite_x509write.function | 161 +- .../tests/suites/test_suite_xtea.function | 19 +- .../repo/visualc/VS2010/aescrypt2.vcxproj | 31 +- .../repo/visualc/VS2010/benchmark.vcxproj | 31 +- .../repo/visualc/VS2010/cert_app.vcxproj | 31 +- .../repo/visualc/VS2010/cert_req.vcxproj | 31 +- .../repo/visualc/VS2010/cert_write.vcxproj | 31 +- .../repo/visualc/VS2010/crl_app.vcxproj | 31 +- .../visualc/VS2010/crypt_and_hash.vcxproj | 31 +- ...t_test.vcxproj => crypto_examples.vcxproj} | 37 +- .../repo/visualc/VS2010/dh_client.vcxproj | 31 +- .../repo/visualc/VS2010/dh_genprime.vcxproj | 31 +- .../repo/visualc/VS2010/dh_server.vcxproj | 31 +- .../repo/visualc/VS2010/dtls_client.vcxproj | 31 +- .../repo/visualc/VS2010/dtls_server.vcxproj | 31 +- .../visualc/VS2010/ecdh_curve25519.vcxproj | 31 +- .../mbedtls/repo/visualc/VS2010/ecdsa.vcxproj | 31 +- .../repo/visualc/VS2010/gen_entropy.vcxproj | 31 +- .../repo/visualc/VS2010/gen_key.vcxproj | 31 +- .../VS2010/gen_random_ctr_drbg.vcxproj | 31 +- .../visualc/VS2010/gen_random_havege.vcxproj | 31 +- .../repo/visualc/VS2010/generic_sum.vcxproj | 31 +- .../mbedtls/repo/visualc/VS2010/hello.vcxproj | 31 +- .../repo/visualc/VS2010/key_app.vcxproj | 31 +- .../visualc/VS2010/key_app_writer.vcxproj | 31 +- .../visualc/VS2010/key_ladder_demo.vcxproj | 167 + .../mbedtls/repo/visualc/VS2010/mbedTLS.sln | 326 +- .../repo/visualc/VS2010/mbedTLS.vcxproj | 88 +- .../repo/visualc/VS2010/mini_client.vcxproj | 31 +- .../repo/visualc/VS2010/mpi_demo.vcxproj | 31 +- .../repo/visualc/VS2010/pem2der.vcxproj | 31 +- .../repo/visualc/VS2010/pk_decrypt.vcxproj | 31 +- .../repo/visualc/VS2010/pk_encrypt.vcxproj | 31 +- .../repo/visualc/VS2010/pk_sign.vcxproj | 31 +- .../repo/visualc/VS2010/pk_verify.vcxproj | 31 +- .../visualc/VS2010/psa_constant_names.vcxproj | 167 + .../VS2010/query_compile_time_config.vcxproj | 168 + .../repo/visualc/VS2010/req_app.vcxproj | 31 +- .../repo/visualc/VS2010/rsa_decrypt.vcxproj | 31 +- .../repo/visualc/VS2010/rsa_encrypt.vcxproj | 31 +- .../repo/visualc/VS2010/rsa_genkey.vcxproj | 31 +- .../repo/visualc/VS2010/rsa_sign.vcxproj | 31 +- .../repo/visualc/VS2010/rsa_sign_pss.vcxproj | 31 +- .../repo/visualc/VS2010/rsa_verify.vcxproj | 31 +- .../visualc/VS2010/rsa_verify_pss.vcxproj | 31 +- .../repo/visualc/VS2010/selftest.vcxproj | 31 +- .../repo/visualc/VS2010/ssl_client1.vcxproj | 31 +- .../repo/visualc/VS2010/ssl_client2.vcxproj | 32 +- .../visualc/VS2010/ssl_context_info.vcxproj | 167 + .../visualc/VS2010/ssl_fork_server.vcxproj | 31 +- .../visualc/VS2010/ssl_mail_client.vcxproj | 31 +- .../repo/visualc/VS2010/ssl_server.vcxproj | 31 +- .../repo/visualc/VS2010/ssl_server2.vcxproj | 32 +- .../repo/visualc/VS2010/strerror.vcxproj | 31 +- .../repo/visualc/VS2010/udp_proxy.vcxproj | 31 +- .../repo/visualc/VS2010/zeroize.vcxproj | 31 +- 802 files changed, 146629 insertions(+), 25938 deletions(-) create mode 100644 third_party/mbedtls/repo/.globalrc delete mode 100644 third_party/mbedtls/repo/.pylint create mode 100644 third_party/mbedtls/repo/.pylintrc create mode 100644 third_party/mbedtls/repo/3rdparty/.gitignore create mode 100644 third_party/mbedtls/repo/3rdparty/CMakeLists.txt create mode 100644 third_party/mbedtls/repo/3rdparty/Makefile.inc create mode 100644 third_party/mbedtls/repo/3rdparty/everest/.gitignore create mode 100644 third_party/mbedtls/repo/3rdparty/everest/CMakeLists.txt create mode 100644 third_party/mbedtls/repo/3rdparty/everest/Makefile.inc create mode 100644 third_party/mbedtls/repo/3rdparty/everest/README.md create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/Hacl_Curve25519.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/everest.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlib.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlib/FStar_UInt128.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlib/FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/c_endianness.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/builtin.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/callconv.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/compat.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/debug.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/target.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/types.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/wasmsupport.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/vs2010/Hacl_Curve25519.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/vs2010/inttypes.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/vs2010/stdbool.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/include/everest/x25519.h create mode 100644 third_party/mbedtls/repo/3rdparty/everest/library/Hacl_Curve25519.c create mode 100644 third_party/mbedtls/repo/3rdparty/everest/library/Hacl_Curve25519_joined.c create mode 100644 third_party/mbedtls/repo/3rdparty/everest/library/everest.c create mode 100644 third_party/mbedtls/repo/3rdparty/everest/library/kremlib/FStar_UInt128_extracted.c create mode 100644 third_party/mbedtls/repo/3rdparty/everest/library/kremlib/FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8.c create mode 100644 third_party/mbedtls/repo/3rdparty/everest/library/legacy/Hacl_Curve25519.c create mode 100644 third_party/mbedtls/repo/3rdparty/everest/library/x25519.c create mode 100644 third_party/mbedtls/repo/ChangeLog.d/00README.md delete mode 100644 third_party/mbedtls/repo/apache-2.0.txt delete mode 100644 third_party/mbedtls/repo/circle.yml create mode 100644 third_party/mbedtls/repo/configs/config-psa-crypto.h create mode 100644 third_party/mbedtls/repo/configs/config-symmetric-only.h create mode 100644 third_party/mbedtls/repo/dco.txt create mode 100644 third_party/mbedtls/repo/docs/.gitignore create mode 100644 third_party/mbedtls/repo/docs/PSACryptoDriverModelSpec.pdf create mode 100644 third_party/mbedtls/repo/docs/architecture/Makefile create mode 100644 third_party/mbedtls/repo/docs/architecture/mbed-crypto-storage-specification.md create mode 100644 third_party/mbedtls/repo/docs/architecture/testing/driver-interface-test-strategy.md create mode 100644 third_party/mbedtls/repo/docs/architecture/testing/invasive-testing.md create mode 100644 third_party/mbedtls/repo/docs/architecture/testing/test-framework.md create mode 100644 third_party/mbedtls/repo/docs/architecture/tls13-experimental.md create mode 100644 third_party/mbedtls/repo/docs/getting_started.md create mode 100644 third_party/mbedtls/repo/docs/proposed/Makefile create mode 100644 third_party/mbedtls/repo/docs/proposed/README create mode 100644 third_party/mbedtls/repo/docs/proposed/psa-conditional-inclusion-c.md create mode 100644 third_party/mbedtls/repo/docs/proposed/psa-driver-developer-guide.md create mode 100644 third_party/mbedtls/repo/docs/proposed/psa-driver-integration-guide.md create mode 100644 third_party/mbedtls/repo/docs/proposed/psa-driver-interface.md create mode 100644 third_party/mbedtls/repo/include/mbedtls/config_psa.h create mode 100644 third_party/mbedtls/repo/include/mbedtls/psa_util.h create mode 100644 third_party/mbedtls/repo/include/psa/crypto.h create mode 100644 third_party/mbedtls/repo/include/psa/crypto_accel_driver.h create mode 100644 third_party/mbedtls/repo/include/psa/crypto_compat.h create mode 100644 third_party/mbedtls/repo/include/psa/crypto_config.h create mode 100644 third_party/mbedtls/repo/include/psa/crypto_driver_common.h create mode 100644 third_party/mbedtls/repo/include/psa/crypto_entropy_driver.h create mode 100644 third_party/mbedtls/repo/include/psa/crypto_extra.h create mode 100644 third_party/mbedtls/repo/include/psa/crypto_platform.h create mode 100644 third_party/mbedtls/repo/include/psa/crypto_se_driver.h create mode 100644 third_party/mbedtls/repo/include/psa/crypto_sizes.h create mode 100644 third_party/mbedtls/repo/include/psa/crypto_struct.h create mode 100644 third_party/mbedtls/repo/include/psa/crypto_types.h create mode 100644 third_party/mbedtls/repo/include/psa/crypto_values.h create mode 100644 third_party/mbedtls/repo/library/check_crypto_config.h create mode 100644 third_party/mbedtls/repo/library/common.h delete mode 100644 third_party/mbedtls/repo/library/md_wrap.c create mode 100644 third_party/mbedtls/repo/library/psa_crypto.c create mode 100644 third_party/mbedtls/repo/library/psa_crypto_core.h create mode 100644 third_party/mbedtls/repo/library/psa_crypto_driver_wrappers.c create mode 100644 third_party/mbedtls/repo/library/psa_crypto_driver_wrappers.h create mode 100644 third_party/mbedtls/repo/library/psa_crypto_invasive.h create mode 100644 third_party/mbedtls/repo/library/psa_crypto_its.h create mode 100644 third_party/mbedtls/repo/library/psa_crypto_se.c create mode 100644 third_party/mbedtls/repo/library/psa_crypto_se.h create mode 100644 third_party/mbedtls/repo/library/psa_crypto_service_integration.h create mode 100644 third_party/mbedtls/repo/library/psa_crypto_slot_management.c create mode 100644 third_party/mbedtls/repo/library/psa_crypto_slot_management.h create mode 100644 third_party/mbedtls/repo/library/psa_crypto_storage.c create mode 100644 third_party/mbedtls/repo/library/psa_crypto_storage.h create mode 100644 third_party/mbedtls/repo/library/psa_its_file.c create mode 100644 third_party/mbedtls/repo/library/ssl_invasive.h create mode 100644 third_party/mbedtls/repo/library/ssl_msg.c create mode 100644 third_party/mbedtls/repo/library/ssl_tls13_keys.c create mode 100644 third_party/mbedtls/repo/library/ssl_tls13_keys.h create mode 100644 third_party/mbedtls/repo/programs/fuzz/.gitignore create mode 100644 third_party/mbedtls/repo/programs/fuzz/CMakeLists.txt create mode 100644 third_party/mbedtls/repo/programs/fuzz/Makefile create mode 100644 third_party/mbedtls/repo/programs/fuzz/README.md create mode 100644 third_party/mbedtls/repo/programs/fuzz/common.c create mode 100644 third_party/mbedtls/repo/programs/fuzz/common.h create mode 100644 third_party/mbedtls/repo/programs/fuzz/corpuses/client create mode 100644 third_party/mbedtls/repo/programs/fuzz/corpuses/dtlsclient create mode 100644 third_party/mbedtls/repo/programs/fuzz/corpuses/dtlsserver create mode 100644 third_party/mbedtls/repo/programs/fuzz/corpuses/server create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_client.c create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_client.options create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_dtlsclient.c create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_dtlsclient.options create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_dtlsserver.c create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_dtlsserver.options create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_privkey.c create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_privkey.options create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_pubkey.c create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_pubkey.options create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_server.c create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_server.options create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_x509crl.c create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_x509crl.options create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_x509crt.c create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_x509crt.options create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_x509csr.c create mode 100644 third_party/mbedtls/repo/programs/fuzz/fuzz_x509csr.options create mode 100644 third_party/mbedtls/repo/programs/fuzz/onefile.c create mode 100644 third_party/mbedtls/repo/programs/psa/CMakeLists.txt create mode 100644 third_party/mbedtls/repo/programs/psa/crypto_examples.c create mode 100644 third_party/mbedtls/repo/programs/psa/key_ladder_demo.c create mode 100755 third_party/mbedtls/repo/programs/psa/key_ladder_demo.sh create mode 100644 third_party/mbedtls/repo/programs/psa/psa_constant_names.c create mode 100644 third_party/mbedtls/repo/programs/psa/psa_constant_names_generated.c create mode 100644 third_party/mbedtls/repo/programs/ssl/ssl_context_info.c create mode 100644 third_party/mbedtls/repo/programs/test/cmake_subproject/.gitignore create mode 100644 third_party/mbedtls/repo/programs/test/cmake_subproject/CMakeLists.txt create mode 100644 third_party/mbedtls/repo/programs/test/cmake_subproject/cmake_subproject.c create mode 100644 third_party/mbedtls/repo/programs/test/query_compile_time_config.c create mode 100644 third_party/mbedtls/repo/programs/test/query_config.c delete mode 100644 third_party/mbedtls/repo/programs/test/ssl_cert_test.c create mode 100755 third_party/mbedtls/repo/scripts/assemble_changelog.py create mode 100755 third_party/mbedtls/repo/scripts/config.py create mode 100644 third_party/mbedtls/repo/scripts/data_files/query_config.fmt create mode 100755 third_party/mbedtls/repo/scripts/generate_psa_constants.py create mode 100755 third_party/mbedtls/repo/scripts/generate_query_config.pl create mode 100644 third_party/mbedtls/repo/scripts/windows_msbuild.bat create mode 100755 third_party/mbedtls/repo/tests/compat-in-docker.sh create mode 100644 third_party/mbedtls/repo/tests/configs/config-wrapper-malloc-0-null.h create mode 100755 third_party/mbedtls/repo/tests/context-info.sh create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/cli_cid.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/cli_ciphersuite.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/cli_def.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/cli_min_cfg.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/cli_no_alpn.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/cli_no_keep_cert.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/cli_no_mfl.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/cli_no_packing.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/def_b64_ff.bin create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/def_b64_too_big_1.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/def_b64_too_big_2.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/def_b64_too_big_3.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/def_bad_b64.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/empty.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/mfl_1024.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/mtu_10000.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/srv_cid.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/srv_ciphersuite.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/srv_def.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/srv_min_cfg.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/srv_no_alpn.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/srv_no_keep_cert.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/srv_no_mfl.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/srv_no_packing.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/base64/v2.19.1.txt create mode 100644 third_party/mbedtls/repo/tests/data_files/cert_md2.csr create mode 100644 third_party/mbedtls/repo/tests/data_files/cert_md4.csr create mode 100644 third_party/mbedtls/repo/tests/data_files/cert_md5.csr create mode 100644 third_party/mbedtls/repo/tests/data_files/cli-rsa-sha256-badalg.crt.der create mode 100644 third_party/mbedtls/repo/tests/data_files/cli-rsa-sha256.crt.der create mode 100644 third_party/mbedtls/repo/tests/data_files/cli-rsa-sha256.key.der create mode 100644 third_party/mbedtls/repo/tests/data_files/cli-rsa.key.der create mode 100644 third_party/mbedtls/repo/tests/data_files/cli2.crt.der create mode 100644 third_party/mbedtls/repo/tests/data_files/cli2.key.der create mode 100644 third_party/mbedtls/repo/tests/data_files/crl-futureRevocationDate.pem create mode 100644 third_party/mbedtls/repo/tests/data_files/ec_256_long_prv.pem create mode 100644 third_party/mbedtls/repo/tests/data_files/ec_521_short_prv.pem create mode 100644 third_party/mbedtls/repo/tests/data_files/multiple_san.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/non-ascii-string-in-issuer.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/server1-ms.req.sha256 create mode 100644 third_party/mbedtls/repo/tests/data_files/server1.crt.der create mode 100644 third_party/mbedtls/repo/tests/data_files/server1.der create mode 100644 third_party/mbedtls/repo/tests/data_files/server1.req.cert_type_empty create mode 100644 third_party/mbedtls/repo/tests/data_files/server1.req.key_usage_empty create mode 100644 third_party/mbedtls/repo/tests/data_files/server1_pathlen_int_max-1.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/server1_pathlen_int_max.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/server2-sha256.crt.der create mode 100644 third_party/mbedtls/repo/tests/data_files/server2.crt.der create mode 100644 third_party/mbedtls/repo/tests/data_files/server2.der create mode 100644 third_party/mbedtls/repo/tests/data_files/server2.key.der create mode 100644 third_party/mbedtls/repo/tests/data_files/server2.key.enc create mode 100644 third_party/mbedtls/repo/tests/data_files/server5-fan.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/server5-othername.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/server5-tricky-ip-san.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/server5-unsupported_othername.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/server5.crt.der create mode 100644 third_party/mbedtls/repo/tests/data_files/server5.key.der create mode 100644 third_party/mbedtls/repo/tests/data_files/server5.key.enc create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca-any_policy.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca-any_policy_ec.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca-any_policy_with_qualifier.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca-any_policy_with_qualifier_ec.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca-multi_policy.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca-multi_policy_ec.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca-sha1.crt.der create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca-sha256.crt.der create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca-unsupported_policy.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca-unsupported_policy_ec.crt create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca.crt.der create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca.der create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca.key.der create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca.server1.db create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca.server1.future-crl.db create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca.server1.future-crl.opensslconf create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca2.crt.der create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca2.key.der create mode 100644 third_party/mbedtls/repo/tests/data_files/test-ca2.key.enc create mode 100644 third_party/mbedtls/repo/tests/docker/bionic/Dockerfile create mode 100755 third_party/mbedtls/repo/tests/git-scripts/pre-commit.sh create mode 100644 third_party/mbedtls/repo/tests/include/test/constant_flow.h create mode 100644 third_party/mbedtls/repo/tests/include/test/drivers/cipher.h create mode 100644 third_party/mbedtls/repo/tests/include/test/drivers/key_management.h create mode 100644 third_party/mbedtls/repo/tests/include/test/drivers/signature.h create mode 100644 third_party/mbedtls/repo/tests/include/test/drivers/size.h create mode 100644 third_party/mbedtls/repo/tests/include/test/drivers/test_driver.h create mode 100644 third_party/mbedtls/repo/tests/include/test/helpers.h create mode 100644 third_party/mbedtls/repo/tests/include/test/macros.h create mode 100644 third_party/mbedtls/repo/tests/include/test/psa_crypto_helpers.h create mode 100644 third_party/mbedtls/repo/tests/include/test/psa_helpers.h create mode 100644 third_party/mbedtls/repo/tests/include/test/random.h create mode 100755 third_party/mbedtls/repo/tests/make-in-docker.sh create mode 100755 third_party/mbedtls/repo/tests/scripts/all-in-docker.sh create mode 100755 third_party/mbedtls/repo/tests/scripts/analyze_outcomes.py create mode 100755 third_party/mbedtls/repo/tests/scripts/basic-in-docker.sh delete mode 100755 third_party/mbedtls/repo/tests/scripts/check-files.py create mode 100755 third_party/mbedtls/repo/tests/scripts/check_files.py create mode 100755 third_party/mbedtls/repo/tests/scripts/check_test_cases.py create mode 100755 third_party/mbedtls/repo/tests/scripts/docker_env.sh create mode 100755 third_party/mbedtls/repo/tests/scripts/psa_collect_statuses.py create mode 100755 third_party/mbedtls/repo/tests/scripts/test_config_script.py create mode 100755 third_party/mbedtls/repo/tests/scripts/test_psa_constant_names.py create mode 100644 third_party/mbedtls/repo/tests/src/drivers/cipher.c create mode 100644 third_party/mbedtls/repo/tests/src/drivers/key_management.c create mode 100644 third_party/mbedtls/repo/tests/src/drivers/signature.c create mode 100644 third_party/mbedtls/repo/tests/src/drivers/size.c create mode 100644 third_party/mbedtls/repo/tests/src/helpers.c create mode 100644 third_party/mbedtls/repo/tests/src/random.c create mode 100755 third_party/mbedtls/repo/tests/ssl-opt-in-docker.sh create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_asn1parse.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_asn1parse.function create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_cipher.aria.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_cipher.misc.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_cipher.nist_kw.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_gcm.misc.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_oid.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_oid.function create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto.function create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_driver_wrappers.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_driver_wrappers.function create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_entropy.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_entropy.function create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_hash.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_hash.function create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_init.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_init.function create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_metadata.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_metadata.function create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_persistent_key.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_persistent_key.function create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_se_driver_hal.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_se_driver_hal.function create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_se_driver_hal_mocks.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_se_driver_hal_mocks.function create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_slot_management.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_crypto_slot_management.function create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_its.data create mode 100644 third_party/mbedtls/repo/tests/suites/test_suite_psa_its.function rename third_party/mbedtls/repo/visualc/VS2010/{ssl_cert_test.vcxproj => crypto_examples.vcxproj} (82%) create mode 100644 third_party/mbedtls/repo/visualc/VS2010/key_ladder_demo.vcxproj create mode 100644 third_party/mbedtls/repo/visualc/VS2010/psa_constant_names.vcxproj create mode 100644 third_party/mbedtls/repo/visualc/VS2010/query_compile_time_config.vcxproj create mode 100644 third_party/mbedtls/repo/visualc/VS2010/ssl_context_info.vcxproj diff --git a/Android.mk b/Android.mk index f2b340b0b..c9594d4d5 100644 --- a/Android.mk +++ b/Android.mk @@ -123,6 +123,7 @@ LOCAL_C_INCLUDES := \ $(LOCAL_PATH)/third_party \ $(LOCAL_PATH)/third_party/mbedtls \ $(LOCAL_PATH)/third_party/mbedtls/repo/include \ + $(LOCAL_PATH)/third_party/mbedtls/repo/library \ $(NULL) LOCAL_CFLAGS := \ @@ -155,255 +156,301 @@ LOCAL_CFLAGS += \ $(NULL) endif -LOCAL_SRC_FILES := \ - src/core/api/backbone_router_api.cpp \ - src/core/api/backbone_router_ftd_api.cpp \ - src/core/api/border_agent_api.cpp \ - src/core/api/border_router_api.cpp \ - src/core/api/channel_manager_api.cpp \ - src/core/api/channel_monitor_api.cpp \ - src/core/api/child_supervision_api.cpp \ - src/core/api/coap_api.cpp \ - src/core/api/coap_secure_api.cpp \ - src/core/api/commissioner_api.cpp \ - src/core/api/crypto_api.cpp \ - src/core/api/dataset_api.cpp \ - src/core/api/dataset_ftd_api.cpp \ - src/core/api/dataset_updater_api.cpp \ - src/core/api/diags_api.cpp \ - src/core/api/dns_api.cpp \ - src/core/api/dns_server_api.cpp \ - src/core/api/entropy_api.cpp \ - src/core/api/error_api.cpp \ - src/core/api/heap_api.cpp \ - src/core/api/icmp6_api.cpp \ - src/core/api/instance_api.cpp \ - src/core/api/ip6_api.cpp \ - src/core/api/jam_detection_api.cpp \ - src/core/api/joiner_api.cpp \ - src/core/api/link_api.cpp \ - src/core/api/link_metrics_api.cpp \ - src/core/api/link_raw_api.cpp \ - src/core/api/logging_api.cpp \ - src/core/api/message_api.cpp \ - src/core/api/multi_radio_api.cpp \ - src/core/api/netdata_api.cpp \ - src/core/api/netdiag_api.cpp \ - src/core/api/network_time_api.cpp \ - src/core/api/ping_sender_api.cpp \ - src/core/api/random_crypto_api.cpp \ - src/core/api/random_noncrypto_api.cpp \ - src/core/api/server_api.cpp \ - src/core/api/sntp_api.cpp \ - src/core/api/srp_client_api.cpp \ - src/core/api/srp_client_buffers_api.cpp \ - src/core/api/srp_server_api.cpp \ - src/core/api/tasklet_api.cpp \ - src/core/api/thread_api.cpp \ - src/core/api/thread_ftd_api.cpp \ - src/core/api/udp_api.cpp \ - src/core/backbone_router/backbone_tmf.cpp \ - src/core/backbone_router/bbr_leader.cpp \ - src/core/backbone_router/bbr_local.cpp \ - src/core/backbone_router/bbr_manager.cpp \ - src/core/backbone_router/multicast_listeners_table.cpp \ - src/core/backbone_router/ndproxy_table.cpp \ - src/core/border_router/infra_if_platform.cpp \ - src/core/border_router/router_advertisement.cpp \ - src/core/border_router/routing_manager.cpp \ - src/core/coap/coap.cpp \ - src/core/coap/coap_message.cpp \ - src/core/coap/coap_secure.cpp \ - src/core/common/crc16.cpp \ - src/core/common/error.cpp \ - src/core/common/instance.cpp \ - src/core/common/logging.cpp \ - src/core/common/message.cpp \ - src/core/common/notifier.cpp \ - src/core/common/random_manager.cpp \ - src/core/common/settings.cpp \ - src/core/common/string.cpp \ - src/core/common/tasklet.cpp \ - src/core/common/time_ticker.cpp \ - src/core/common/timer.cpp \ - src/core/common/tlvs.cpp \ - src/core/common/trickle_timer.cpp \ - src/core/crypto/aes_ccm.cpp \ - src/core/crypto/aes_ecb.cpp \ - src/core/crypto/ecdsa.cpp \ - src/core/crypto/hkdf_sha256.cpp \ - src/core/crypto/hmac_sha256.cpp \ - src/core/crypto/mbedtls.cpp \ - src/core/crypto/pbkdf2_cmac.cpp \ - src/core/crypto/sha256.cpp \ - src/core/diags/factory_diags.cpp \ - src/core/mac/channel_mask.cpp \ - src/core/mac/data_poll_handler.cpp \ - src/core/mac/data_poll_sender.cpp \ - src/core/mac/link_raw.cpp \ - src/core/mac/mac.cpp \ - src/core/mac/mac_filter.cpp \ - src/core/mac/mac_frame.cpp \ - src/core/mac/mac_links.cpp \ - src/core/mac/mac_types.cpp \ - src/core/mac/sub_mac.cpp \ - src/core/mac/sub_mac_callbacks.cpp \ - src/core/meshcop/announce_begin_client.cpp \ - src/core/meshcop/border_agent.cpp \ - src/core/meshcop/commissioner.cpp \ - src/core/meshcop/dataset.cpp \ - src/core/meshcop/dataset_local.cpp \ - src/core/meshcop/dataset_manager.cpp \ - src/core/meshcop/dataset_manager_ftd.cpp \ - src/core/meshcop/dataset_updater.cpp \ - src/core/meshcop/dtls.cpp \ - src/core/meshcop/energy_scan_client.cpp \ - src/core/meshcop/joiner.cpp \ - src/core/meshcop/joiner_router.cpp \ - src/core/meshcop/meshcop.cpp \ - src/core/meshcop/meshcop_leader.cpp \ - src/core/meshcop/meshcop_tlvs.cpp \ - src/core/meshcop/panid_query_client.cpp \ - src/core/meshcop/timestamp.cpp \ - src/core/net/checksum.cpp \ - src/core/net/dhcp6_client.cpp \ - src/core/net/dhcp6_server.cpp \ - src/core/net/dns_client.cpp \ - src/core/net/dns_types.cpp \ - src/core/net/dnssd_server.cpp \ - src/core/net/icmp6.cpp \ - src/core/net/ip4_address.cpp \ - src/core/net/ip6.cpp \ - src/core/net/ip6_address.cpp \ - src/core/net/ip6_filter.cpp \ - src/core/net/ip6_headers.cpp \ - src/core/net/ip6_mpl.cpp \ - src/core/net/nd_agent.cpp \ - src/core/net/netif.cpp \ - src/core/net/sntp_client.cpp \ - src/core/net/socket.cpp \ - src/core/net/srp_client.cpp \ - src/core/net/srp_server.cpp \ - src/core/net/udp6.cpp \ - src/core/radio/radio.cpp \ - src/core/radio/radio_callbacks.cpp \ - src/core/radio/radio_platform.cpp \ - src/core/radio/trel_interface.cpp \ - src/core/radio/trel_link.cpp \ - src/core/radio/trel_packet.cpp \ - src/core/thread/address_resolver.cpp \ - src/core/thread/announce_begin_server.cpp \ - src/core/thread/announce_sender.cpp \ - src/core/thread/child_table.cpp \ - src/core/thread/csl_tx_scheduler.cpp \ - src/core/thread/discover_scanner.cpp \ - src/core/thread/dua_manager.cpp \ - src/core/thread/energy_scan_server.cpp \ - src/core/thread/indirect_sender.cpp \ - src/core/thread/key_manager.cpp \ - src/core/thread/link_metrics.cpp \ - src/core/thread/link_quality.cpp \ - src/core/thread/lowpan.cpp \ - src/core/thread/mesh_forwarder.cpp \ - src/core/thread/mesh_forwarder_ftd.cpp \ - src/core/thread/mesh_forwarder_mtd.cpp \ - src/core/thread/mle.cpp \ - src/core/thread/mle_router.cpp \ - src/core/thread/mle_types.cpp \ - src/core/thread/mlr_manager.cpp \ - src/core/thread/neighbor_table.cpp \ - src/core/thread/network_data.cpp \ - src/core/thread/network_data_leader.cpp \ - src/core/thread/network_data_leader_ftd.cpp \ - src/core/thread/network_data_local.cpp \ - src/core/thread/network_data_notifier.cpp \ - src/core/thread/network_data_service.cpp \ - src/core/thread/network_diagnostic.cpp \ - src/core/thread/panid_query_server.cpp \ - src/core/thread/radio_selector.cpp \ - src/core/thread/router_table.cpp \ - src/core/thread/src_match_controller.cpp \ - src/core/thread/thread_netif.cpp \ - src/core/thread/time_sync_service.cpp \ - src/core/thread/tmf.cpp \ - src/core/thread/topology.cpp \ - src/core/thread/uri_paths.cpp \ - src/core/utils/channel_manager.cpp \ - src/core/utils/channel_monitor.cpp \ - src/core/utils/child_supervision.cpp \ - src/core/utils/flash.cpp \ - src/core/utils/heap.cpp \ - src/core/utils/jam_detector.cpp \ - src/core/utils/lookup_table.cpp \ - src/core/utils/otns.cpp \ - src/core/utils/parse_cmdline.cpp \ - src/core/utils/ping_sender.cpp \ - src/core/utils/slaac_address.cpp \ - src/core/utils/srp_client_buffers.cpp \ - src/lib/hdlc/hdlc.cpp \ - src/lib/platform/exit_code.c \ - src/lib/spinel/spinel.c \ - src/lib/spinel/spinel_decoder.cpp \ - src/lib/spinel/spinel_encoder.cpp \ - src/lib/url/url.cpp \ - src/posix/platform/alarm.cpp \ - src/posix/platform/backbone.cpp \ - src/posix/platform/daemon.cpp \ - src/posix/platform/entropy.cpp \ - src/posix/platform/hdlc_interface.cpp \ - src/posix/platform/infra_if.cpp \ - src/posix/platform/logging.cpp \ - src/posix/platform/memory.cpp \ - src/posix/platform/misc.cpp \ - src/posix/platform/multicast_routing.cpp \ - src/posix/platform/netif.cpp \ - src/posix/platform/radio.cpp \ - src/posix/platform/radio_url.cpp \ - src/posix/platform/settings.cpp \ - src/posix/platform/spi_interface.cpp \ - src/posix/platform/system.cpp \ - src/posix/platform/udp.cpp \ - third_party/mbedtls/repo/library/aes.c \ - third_party/mbedtls/repo/library/asn1parse.c \ - third_party/mbedtls/repo/library/asn1write.c \ - third_party/mbedtls/repo/library/base64.c \ - third_party/mbedtls/repo/library/bignum.c \ - third_party/mbedtls/repo/library/ccm.c \ - third_party/mbedtls/repo/library/cipher.c \ - third_party/mbedtls/repo/library/cipher_wrap.c \ - third_party/mbedtls/repo/library/cmac.c \ - third_party/mbedtls/repo/library/ctr_drbg.c \ - third_party/mbedtls/repo/library/debug.c \ - third_party/mbedtls/repo/library/ecdh.c \ - third_party/mbedtls/repo/library/ecdsa.c \ - third_party/mbedtls/repo/library/ecjpake.c \ - third_party/mbedtls/repo/library/ecp.c \ - third_party/mbedtls/repo/library/ecp_curves.c \ - third_party/mbedtls/repo/library/entropy.c \ - third_party/mbedtls/repo/library/entropy_poll.c \ - third_party/mbedtls/repo/library/hmac_drbg.c \ - third_party/mbedtls/repo/library/md.c \ - third_party/mbedtls/repo/library/md_wrap.c \ - third_party/mbedtls/repo/library/memory_buffer_alloc.c \ - third_party/mbedtls/repo/library/oid.c \ - third_party/mbedtls/repo/library/pem.c \ - third_party/mbedtls/repo/library/pk.c \ - third_party/mbedtls/repo/library/pk_wrap.c \ - third_party/mbedtls/repo/library/pkparse.c \ - third_party/mbedtls/repo/library/pkwrite.c \ - third_party/mbedtls/repo/library/platform.c \ - third_party/mbedtls/repo/library/platform_util.c \ - third_party/mbedtls/repo/library/sha256.c \ - third_party/mbedtls/repo/library/ssl_ciphersuites.c \ - third_party/mbedtls/repo/library/ssl_cli.c \ - third_party/mbedtls/repo/library/ssl_cookie.c \ - third_party/mbedtls/repo/library/ssl_srv.c \ - third_party/mbedtls/repo/library/ssl_ticket.c \ - third_party/mbedtls/repo/library/ssl_tls.c \ - third_party/mbedtls/repo/library/threading.c \ - third_party/mbedtls/repo/library/x509.c \ - third_party/mbedtls/repo/library/x509_crt.c \ - $(OPENTHREAD_PROJECT_SRC_FILES) \ +LOCAL_SRC_FILES := \ + src/core/api/backbone_router_api.cpp \ + src/core/api/backbone_router_ftd_api.cpp \ + src/core/api/border_agent_api.cpp \ + src/core/api/border_router_api.cpp \ + src/core/api/channel_manager_api.cpp \ + src/core/api/channel_monitor_api.cpp \ + src/core/api/child_supervision_api.cpp \ + src/core/api/coap_api.cpp \ + src/core/api/coap_secure_api.cpp \ + src/core/api/commissioner_api.cpp \ + src/core/api/crypto_api.cpp \ + src/core/api/dataset_api.cpp \ + src/core/api/dataset_ftd_api.cpp \ + src/core/api/dataset_updater_api.cpp \ + src/core/api/diags_api.cpp \ + src/core/api/dns_api.cpp \ + src/core/api/dns_server_api.cpp \ + src/core/api/entropy_api.cpp \ + src/core/api/error_api.cpp \ + src/core/api/heap_api.cpp \ + src/core/api/icmp6_api.cpp \ + src/core/api/instance_api.cpp \ + src/core/api/ip6_api.cpp \ + src/core/api/jam_detection_api.cpp \ + src/core/api/joiner_api.cpp \ + src/core/api/link_api.cpp \ + src/core/api/link_metrics_api.cpp \ + src/core/api/link_raw_api.cpp \ + src/core/api/logging_api.cpp \ + src/core/api/message_api.cpp \ + src/core/api/multi_radio_api.cpp \ + src/core/api/netdata_api.cpp \ + src/core/api/netdiag_api.cpp \ + src/core/api/network_time_api.cpp \ + src/core/api/ping_sender_api.cpp \ + src/core/api/random_crypto_api.cpp \ + src/core/api/random_noncrypto_api.cpp \ + src/core/api/server_api.cpp \ + src/core/api/sntp_api.cpp \ + src/core/api/srp_client_api.cpp \ + src/core/api/srp_client_buffers_api.cpp \ + src/core/api/srp_server_api.cpp \ + src/core/api/tasklet_api.cpp \ + src/core/api/thread_api.cpp \ + src/core/api/thread_ftd_api.cpp \ + src/core/api/udp_api.cpp \ + src/core/backbone_router/backbone_tmf.cpp \ + src/core/backbone_router/bbr_leader.cpp \ + src/core/backbone_router/bbr_local.cpp \ + src/core/backbone_router/bbr_manager.cpp \ + src/core/backbone_router/multicast_listeners_table.cpp \ + src/core/backbone_router/ndproxy_table.cpp \ + src/core/border_router/infra_if_platform.cpp \ + src/core/border_router/router_advertisement.cpp \ + src/core/border_router/routing_manager.cpp \ + src/core/coap/coap.cpp \ + src/core/coap/coap_message.cpp \ + src/core/coap/coap_secure.cpp \ + src/core/common/crc16.cpp \ + src/core/common/error.cpp \ + src/core/common/instance.cpp \ + src/core/common/logging.cpp \ + src/core/common/message.cpp \ + src/core/common/notifier.cpp \ + src/core/common/random_manager.cpp \ + src/core/common/settings.cpp \ + src/core/common/string.cpp \ + src/core/common/tasklet.cpp \ + src/core/common/time_ticker.cpp \ + src/core/common/timer.cpp \ + src/core/common/tlvs.cpp \ + src/core/common/trickle_timer.cpp \ + src/core/crypto/aes_ccm.cpp \ + src/core/crypto/aes_ecb.cpp \ + src/core/crypto/ecdsa.cpp \ + src/core/crypto/hkdf_sha256.cpp \ + src/core/crypto/hmac_sha256.cpp \ + src/core/crypto/mbedtls.cpp \ + src/core/crypto/pbkdf2_cmac.cpp \ + src/core/crypto/sha256.cpp \ + src/core/diags/factory_diags.cpp \ + src/core/mac/channel_mask.cpp \ + src/core/mac/data_poll_handler.cpp \ + src/core/mac/data_poll_sender.cpp \ + src/core/mac/link_raw.cpp \ + src/core/mac/mac.cpp \ + src/core/mac/mac_filter.cpp \ + src/core/mac/mac_frame.cpp \ + src/core/mac/mac_links.cpp \ + src/core/mac/mac_types.cpp \ + src/core/mac/sub_mac.cpp \ + src/core/mac/sub_mac_callbacks.cpp \ + src/core/meshcop/announce_begin_client.cpp \ + src/core/meshcop/border_agent.cpp \ + src/core/meshcop/commissioner.cpp \ + src/core/meshcop/dataset.cpp \ + src/core/meshcop/dataset_local.cpp \ + src/core/meshcop/dataset_manager.cpp \ + src/core/meshcop/dataset_manager_ftd.cpp \ + src/core/meshcop/dataset_updater.cpp \ + src/core/meshcop/dtls.cpp \ + src/core/meshcop/energy_scan_client.cpp \ + src/core/meshcop/joiner.cpp \ + src/core/meshcop/joiner_router.cpp \ + src/core/meshcop/meshcop.cpp \ + src/core/meshcop/meshcop_leader.cpp \ + src/core/meshcop/meshcop_tlvs.cpp \ + src/core/meshcop/panid_query_client.cpp \ + src/core/meshcop/timestamp.cpp \ + src/core/net/checksum.cpp \ + src/core/net/dhcp6_client.cpp \ + src/core/net/dhcp6_server.cpp \ + src/core/net/dns_client.cpp \ + src/core/net/dns_types.cpp \ + src/core/net/dnssd_server.cpp \ + src/core/net/icmp6.cpp \ + src/core/net/ip4_address.cpp \ + src/core/net/ip6.cpp \ + src/core/net/ip6_address.cpp \ + src/core/net/ip6_filter.cpp \ + src/core/net/ip6_headers.cpp \ + src/core/net/ip6_mpl.cpp \ + src/core/net/nd_agent.cpp \ + src/core/net/netif.cpp \ + src/core/net/sntp_client.cpp \ + src/core/net/socket.cpp \ + src/core/net/srp_client.cpp \ + src/core/net/srp_server.cpp \ + src/core/net/udp6.cpp \ + src/core/radio/radio.cpp \ + src/core/radio/radio_callbacks.cpp \ + src/core/radio/radio_platform.cpp \ + src/core/radio/trel_interface.cpp \ + src/core/radio/trel_link.cpp \ + src/core/radio/trel_packet.cpp \ + src/core/thread/address_resolver.cpp \ + src/core/thread/announce_begin_server.cpp \ + src/core/thread/announce_sender.cpp \ + src/core/thread/child_table.cpp \ + src/core/thread/csl_tx_scheduler.cpp \ + src/core/thread/discover_scanner.cpp \ + src/core/thread/dua_manager.cpp \ + src/core/thread/energy_scan_server.cpp \ + src/core/thread/indirect_sender.cpp \ + src/core/thread/key_manager.cpp \ + src/core/thread/link_metrics.cpp \ + src/core/thread/link_quality.cpp \ + src/core/thread/lowpan.cpp \ + src/core/thread/mesh_forwarder.cpp \ + src/core/thread/mesh_forwarder_ftd.cpp \ + src/core/thread/mesh_forwarder_mtd.cpp \ + src/core/thread/mle.cpp \ + src/core/thread/mle_router.cpp \ + src/core/thread/mle_types.cpp \ + src/core/thread/mlr_manager.cpp \ + src/core/thread/neighbor_table.cpp \ + src/core/thread/network_data.cpp \ + src/core/thread/network_data_leader.cpp \ + src/core/thread/network_data_leader_ftd.cpp \ + src/core/thread/network_data_local.cpp \ + src/core/thread/network_data_notifier.cpp \ + src/core/thread/network_data_service.cpp \ + src/core/thread/network_diagnostic.cpp \ + src/core/thread/panid_query_server.cpp \ + src/core/thread/radio_selector.cpp \ + src/core/thread/router_table.cpp \ + src/core/thread/src_match_controller.cpp \ + src/core/thread/thread_netif.cpp \ + src/core/thread/time_sync_service.cpp \ + src/core/thread/tmf.cpp \ + src/core/thread/topology.cpp \ + src/core/thread/uri_paths.cpp \ + src/core/utils/channel_manager.cpp \ + src/core/utils/channel_monitor.cpp \ + src/core/utils/child_supervision.cpp \ + src/core/utils/flash.cpp \ + src/core/utils/heap.cpp \ + src/core/utils/jam_detector.cpp \ + src/core/utils/lookup_table.cpp \ + src/core/utils/otns.cpp \ + src/core/utils/parse_cmdline.cpp \ + src/core/utils/ping_sender.cpp \ + src/core/utils/slaac_address.cpp \ + src/core/utils/srp_client_buffers.cpp \ + src/lib/hdlc/hdlc.cpp \ + src/lib/platform/exit_code.c \ + src/lib/spinel/spinel.c \ + src/lib/spinel/spinel_decoder.cpp \ + src/lib/spinel/spinel_encoder.cpp \ + src/lib/url/url.cpp \ + src/posix/platform/alarm.cpp \ + src/posix/platform/backbone.cpp \ + src/posix/platform/daemon.cpp \ + src/posix/platform/entropy.cpp \ + src/posix/platform/hdlc_interface.cpp \ + src/posix/platform/infra_if.cpp \ + src/posix/platform/logging.cpp \ + src/posix/platform/memory.cpp \ + src/posix/platform/misc.cpp \ + src/posix/platform/multicast_routing.cpp \ + src/posix/platform/netif.cpp \ + src/posix/platform/radio.cpp \ + src/posix/platform/radio_url.cpp \ + src/posix/platform/settings.cpp \ + src/posix/platform/spi_interface.cpp \ + src/posix/platform/system.cpp \ + src/posix/platform/udp.cpp \ + third_party/mbedtls/repo/library/aes.c \ + third_party/mbedtls/repo/library/aesni.c \ + third_party/mbedtls/repo/library/arc4.c \ + third_party/mbedtls/repo/library/aria.c \ + third_party/mbedtls/repo/library/asn1parse.c \ + third_party/mbedtls/repo/library/asn1write.c \ + third_party/mbedtls/repo/library/base64.c \ + third_party/mbedtls/repo/library/bignum.c \ + third_party/mbedtls/repo/library/blowfish.c \ + third_party/mbedtls/repo/library/camellia.c \ + third_party/mbedtls/repo/library/ccm.c \ + third_party/mbedtls/repo/library/certs.c \ + third_party/mbedtls/repo/library/chacha20.c \ + third_party/mbedtls/repo/library/chachapoly.c \ + third_party/mbedtls/repo/library/cipher.c \ + third_party/mbedtls/repo/library/cipher_wrap.c \ + third_party/mbedtls/repo/library/cmac.c \ + third_party/mbedtls/repo/library/ctr_drbg.c \ + third_party/mbedtls/repo/library/debug.c \ + third_party/mbedtls/repo/library/des.c \ + third_party/mbedtls/repo/library/dhm.c \ + third_party/mbedtls/repo/library/ecdh.c \ + third_party/mbedtls/repo/library/ecdsa.c \ + third_party/mbedtls/repo/library/ecjpake.c \ + third_party/mbedtls/repo/library/ecp.c \ + third_party/mbedtls/repo/library/ecp_curves.c \ + third_party/mbedtls/repo/library/entropy.c \ + third_party/mbedtls/repo/library/entropy_poll.c \ + third_party/mbedtls/repo/library/error.c \ + third_party/mbedtls/repo/library/gcm.c \ + third_party/mbedtls/repo/library/havege.c \ + third_party/mbedtls/repo/library/hkdf.c \ + third_party/mbedtls/repo/library/hmac_drbg.c \ + third_party/mbedtls/repo/library/md.c \ + third_party/mbedtls/repo/library/md2.c \ + third_party/mbedtls/repo/library/md4.c \ + third_party/mbedtls/repo/library/md5.c \ + third_party/mbedtls/repo/library/memory_buffer_alloc.c \ + third_party/mbedtls/repo/library/net_sockets.c \ + third_party/mbedtls/repo/library/nist_kw.c \ + third_party/mbedtls/repo/library/oid.c \ + third_party/mbedtls/repo/library/padlock.c \ + third_party/mbedtls/repo/library/pem.c \ + third_party/mbedtls/repo/library/pk.c \ + third_party/mbedtls/repo/library/pk_wrap.c \ + third_party/mbedtls/repo/library/pkcs11.c \ + third_party/mbedtls/repo/library/pkcs12.c \ + third_party/mbedtls/repo/library/pkcs5.c \ + third_party/mbedtls/repo/library/pkparse.c \ + third_party/mbedtls/repo/library/pkwrite.c \ + third_party/mbedtls/repo/library/platform.c \ + third_party/mbedtls/repo/library/platform_util.c \ + third_party/mbedtls/repo/library/poly1305.c \ + third_party/mbedtls/repo/library/psa_crypto.c \ + third_party/mbedtls/repo/library/psa_crypto_driver_wrappers.c \ + third_party/mbedtls/repo/library/psa_crypto_se.c \ + third_party/mbedtls/repo/library/psa_crypto_slot_management.c \ + third_party/mbedtls/repo/library/psa_crypto_storage.c \ + third_party/mbedtls/repo/library/psa_its_file.c \ + third_party/mbedtls/repo/library/ripemd160.c \ + third_party/mbedtls/repo/library/rsa.c \ + third_party/mbedtls/repo/library/rsa_internal.c \ + third_party/mbedtls/repo/library/sha1.c \ + third_party/mbedtls/repo/library/sha256.c \ + third_party/mbedtls/repo/library/sha512.c \ + third_party/mbedtls/repo/library/ssl_cache.c \ + third_party/mbedtls/repo/library/ssl_ciphersuites.c \ + third_party/mbedtls/repo/library/ssl_cli.c \ + third_party/mbedtls/repo/library/ssl_cookie.c \ + third_party/mbedtls/repo/library/ssl_msg.c \ + third_party/mbedtls/repo/library/ssl_srv.c \ + third_party/mbedtls/repo/library/ssl_ticket.c \ + third_party/mbedtls/repo/library/ssl_tls.c \ + third_party/mbedtls/repo/library/ssl_tls13_keys.c \ + third_party/mbedtls/repo/library/threading.c \ + third_party/mbedtls/repo/library/timing.c \ + third_party/mbedtls/repo/library/version.c \ + third_party/mbedtls/repo/library/version_features.c \ + third_party/mbedtls/repo/library/x509.c \ + third_party/mbedtls/repo/library/x509_create.c \ + third_party/mbedtls/repo/library/x509_crl.c \ + third_party/mbedtls/repo/library/x509_crt.c \ + third_party/mbedtls/repo/library/x509_csr.c \ + third_party/mbedtls/repo/library/x509write_crt.c \ + third_party/mbedtls/repo/library/x509write_csr.c \ + third_party/mbedtls/repo/library/xtea.c \ + $(OPENTHREAD_PROJECT_SRC_FILES) \ $(NULL) include $(BUILD_STATIC_LIBRARY) diff --git a/include/openthread/coap_secure.h b/include/openthread/coap_secure.h index b30d22846..5cb6bd9a0 100644 --- a/include/openthread/coap_secure.h +++ b/include/openthread/coap_secure.h @@ -117,7 +117,8 @@ void otCoapSecureSetPsk(otInstance * aInstance, /** * This method returns the peer x509 certificate base64 encoded. * - * @note This function requires the build-time feature `MBEDTLS_BASE64_C` to be enabled. + * @note This function requires the build-time features `MBEDTLS_BASE64_C` and + * `MBEDTLS_SSL_KEEP_PEER_CERTIFICATE` to be enabled. * * @param[in] aInstance A pointer to an OpenThread instance. * @param[out] aPeerCert A pointer to the base64 encoded certificate buffer. diff --git a/include/openthread/instance.h b/include/openthread/instance.h index 1981e9c62..bc17d0e52 100644 --- a/include/openthread/instance.h +++ b/include/openthread/instance.h @@ -53,7 +53,7 @@ extern "C" { * @note This number versions both OpenThread platform and user APIs. * */ -#define OPENTHREAD_API_VERSION (111) +#define OPENTHREAD_API_VERSION (112) /** * @addtogroup api-instance diff --git a/script/update-makefiles.py b/script/update-makefiles.py index 4d0c4d78b..2cd45d3b8 100755 --- a/script/update-makefiles.py +++ b/script/update-makefiles.py @@ -152,8 +152,8 @@ print("Updated " + include_build_gn_file) android_mk_file = "./Android.mk" -formatted_list = [" {:<55} \\\n".format(file_name) for file_name in core_cpp_files] -start_string = "LOCAL_SRC_FILES := \\\n" +formatted_list = [" {:<63} \\\n".format(file_name) for file_name in core_cpp_files] +start_string = "LOCAL_SRC_FILES := \\\n" end_string = " src/lib/hdlc/hdlc.cpp" update_build_file(android_mk_file, start_string, end_string, formatted_list) diff --git a/src/core/api/coap_secure_api.cpp b/src/core/api/coap_secure_api.cpp index 0159df65f..cde7725b0 100644 --- a/src/core/api/coap_secure_api.cpp +++ b/src/core/api/coap_secure_api.cpp @@ -93,7 +93,7 @@ void otCoapSecureSetPsk(otInstance * aInstance, } #endif // MBEDTLS_KEY_EXCHANGE_PSK_ENABLED -#ifdef MBEDTLS_BASE64_C +#if defined(MBEDTLS_BASE64_C) && defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) otError otCoapSecureGetPeerCertificateBase64(otInstance * aInstance, unsigned char *aPeerCert, size_t * aCertLength, @@ -103,7 +103,7 @@ otError otCoapSecureGetPeerCertificateBase64(otInstance * aInstance, return instance.GetApplicationCoapSecure().GetPeerCertificateBase64(aPeerCert, aCertLength, aCertBufferSize); } -#endif // MBEDTLS_BASE64_C +#endif // defined(MBEDTLS_BASE64_C) && defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) void otCoapSecureSetSslAuthMode(otInstance *aInstance, bool aVerifyPeerCertificate) { diff --git a/src/core/coap/coap_secure.hpp b/src/core/coap/coap_secure.hpp index 8b712e504..cd01ada6b 100644 --- a/src/core/coap/coap_secure.hpp +++ b/src/core/coap/coap_secure.hpp @@ -238,7 +238,7 @@ public: } #endif // MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED -#ifdef MBEDTLS_BASE64_C +#if defined(MBEDTLS_BASE64_C) && defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) /** * This method returns the peer x509 certificate base64 encoded. * @@ -256,7 +256,7 @@ public: { return mDtls.GetPeerCertificateBase64(aPeerCert, aCertLength, aCertBufferSize); } -#endif // MBEDTLS_BASE64_C +#endif // defined(MBEDTLS_BASE64_C) && defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) /** * This method sets the connected callback to indicate, when a Client connect to the CoAP Secure server. diff --git a/src/core/config/openthread-core-default-config.h b/src/core/config/openthread-core-default-config.h index d2508758d..60e518a48 100644 --- a/src/core/config/openthread-core-default-config.h +++ b/src/core/config/openthread-core-default-config.h @@ -270,9 +270,9 @@ // Internal heap doesn't support size larger than 64K bytes. #define OPENTHREAD_CONFIG_HEAP_INTERNAL_SIZE (63 * 1024) #elif OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE -#define OPENTHREAD_CONFIG_HEAP_INTERNAL_SIZE (3072 * sizeof(void *)) +#define OPENTHREAD_CONFIG_HEAP_INTERNAL_SIZE (3136 * sizeof(void *)) #else -#define OPENTHREAD_CONFIG_HEAP_INTERNAL_SIZE (1568 * sizeof(void *)) +#define OPENTHREAD_CONFIG_HEAP_INTERNAL_SIZE (1616 * sizeof(void *)) #endif #endif diff --git a/src/core/crypto/ecdsa.cpp b/src/core/crypto/ecdsa.cpp index 08248b551..b66371d17 100644 --- a/src/core/crypto/ecdsa.cpp +++ b/src/core/crypto/ecdsa.cpp @@ -40,6 +40,7 @@ #include #include #include +#include #include "common/code_utils.hpp" #include "common/debug.hpp" @@ -134,8 +135,13 @@ Error P256::KeyPair::Sign(const Sha256::Hash &aHash, Signature &aSignature) cons ret = mbedtls_ecdsa_from_keypair(&ecdsa, keypair); VerifyOrExit(ret == 0, error = MbedTls::MapError(ret)); +#if (MBEDTLS_VERSION_NUMBER >= 0x02130000) + ret = mbedtls_ecdsa_sign_det_ext(&ecdsa.grp, &r, &s, &ecdsa.d, aHash.GetBytes(), Sha256::Hash::kSize, + MBEDTLS_MD_SHA256, mbedtls_ctr_drbg_random, Random::Crypto::MbedTlsContextGet()); +#else ret = mbedtls_ecdsa_sign_det(&ecdsa.grp, &r, &s, &ecdsa.d, aHash.GetBytes(), Sha256::Hash::kSize, MBEDTLS_MD_SHA256); +#endif VerifyOrExit(ret == 0, error = MbedTls::MapError(ret)); OT_ASSERT(mbedtls_mpi_size(&r) <= kMpiSize); diff --git a/src/core/meshcop/dtls.cpp b/src/core/meshcop/dtls.cpp index f198082af..c661b410e 100644 --- a/src/core/meshcop/dtls.cpp +++ b/src/core/meshcop/dtls.cpp @@ -503,8 +503,7 @@ void Dtls::SetPreSharedKey(const uint8_t *aPsk, uint16_t aPskLength, const uint8 } #endif -#ifdef MBEDTLS_BASE64_C - +#if defined(MBEDTLS_BASE64_C) && defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) Error Dtls::GetPeerCertificateBase64(unsigned char *aPeerCert, size_t *aCertLength, size_t aCertBufferSize) { Error error = kErrorNone; @@ -518,8 +517,8 @@ Error Dtls::GetPeerCertificateBase64(unsigned char *aPeerCert, size_t *aCertLeng exit: return error; } +#endif // defined(MBEDTLS_BASE64_C) && defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) -#endif #endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE #ifdef MBEDTLS_SSL_SRV_C diff --git a/src/core/meshcop/dtls.hpp b/src/core/meshcop/dtls.hpp index a032c96b6..37a592fb5 100644 --- a/src/core/meshcop/dtls.hpp +++ b/src/core/meshcop/dtls.hpp @@ -262,7 +262,7 @@ public: void SetCaCertificateChain(const uint8_t *aX509CaCertificateChain, uint32_t aX509CaCertChainLength); #endif // MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED -#ifdef MBEDTLS_BASE64_C +#if defined(MBEDTLS_BASE64_C) && defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) /** * This method returns the peer x509 certificate base64 encoded. * @@ -278,7 +278,7 @@ public: * */ Error GetPeerCertificateBase64(unsigned char *aPeerCert, size_t *aCertLength, size_t aCertBufferSize); -#endif +#endif // defined(MBEDTLS_BASE64_C) && defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) /** * This method set the authentication mode for a dtls connection. diff --git a/third_party/mbedtls/BUILD.gn b/third_party/mbedtls/BUILD.gn index d93fc6abc..66cac5d56 100644 --- a/third_party/mbedtls/BUILD.gn +++ b/third_party/mbedtls/BUILD.gn @@ -37,6 +37,7 @@ config("mbedtls_config") { include_dirs = [ ".", "repo/include", + "repo/library", ] defines = [ "MBEDTLS_CONFIG_FILE=\"${mbedtls_config_file}\"" ] @@ -66,6 +67,7 @@ static_library("mbedtls") { "repo/include/mbedtls/cmac.h", "repo/include/mbedtls/compat-1.3.h", "repo/include/mbedtls/config.h", + "repo/include/mbedtls/config_psa.h", "repo/include/mbedtls/ctr_drbg.h", "repo/include/mbedtls/debug.h", "repo/include/mbedtls/des.h", @@ -160,7 +162,6 @@ static_library("mbedtls") { "repo/library/md2.c", "repo/library/md4.c", "repo/library/md5.c", - "repo/library/md_wrap.c", "repo/library/memory_buffer_alloc.c", "repo/library/net_sockets.c", "repo/library/nist_kw.c", @@ -177,6 +178,12 @@ static_library("mbedtls") { "repo/library/platform.c", "repo/library/platform_util.c", "repo/library/poly1305.c", + "repo/library/psa_crypto.c", + "repo/library/psa_crypto_driver_wrappers.c", + "repo/library/psa_crypto_se.c", + "repo/library/psa_crypto_slot_management.c", + "repo/library/psa_crypto_storage.c", + "repo/library/psa_its_file.c", "repo/library/ripemd160.c", "repo/library/rsa.c", "repo/library/rsa_internal.c", @@ -187,9 +194,11 @@ static_library("mbedtls") { "repo/library/ssl_ciphersuites.c", "repo/library/ssl_cli.c", "repo/library/ssl_cookie.c", + "repo/library/ssl_msg.c", "repo/library/ssl_srv.c", "repo/library/ssl_ticket.c", "repo/library/ssl_tls.c", + "repo/library/ssl_tls13_keys.c", "repo/library/threading.c", "repo/library/timing.c", "repo/library/version.c", diff --git a/third_party/mbedtls/CMakeLists.txt b/third_party/mbedtls/CMakeLists.txt index 8831952c0..9715bf4e3 100644 --- a/third_party/mbedtls/CMakeLists.txt +++ b/third_party/mbedtls/CMakeLists.txt @@ -42,6 +42,9 @@ if(UNIFDEF_EXE) endif() find_program(SED_EXE sed) +string(REPLACE "-Wconversion" "" CMAKE_C_FLAGS "${CMAKE_C_FLAGS}") +string(REPLACE "-Wconversion" "" CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}") + add_subdirectory(repo) if(UNIFDEFALL_EXE AND SED_EXE AND UNIFDEF_VERSION VERSION_GREATER_EQUAL 2.10) diff --git a/third_party/mbedtls/Makefile.am b/third_party/mbedtls/Makefile.am index 0ec7f74e0..cf620316a 100644 --- a/third_party/mbedtls/Makefile.am +++ b/third_party/mbedtls/Makefile.am @@ -49,16 +49,28 @@ libmbedcrypto_a_CPPFLAGS = \ libmbedcrypto_a_SOURCES = \ repo/library/aes.c \ + repo/library/aesni.c \ + repo/library/arc4.c \ + repo/library/aria.c \ repo/library/asn1parse.c \ repo/library/asn1write.c \ repo/library/base64.c \ repo/library/bignum.c \ + repo/library/blowfish.c \ + repo/library/camellia.c \ repo/library/ccm.c \ + repo/library/certs.c \ + repo/library/chacha20.c \ + repo/library/chachapoly.c \ + repo/library/check_crypto_config.h \ repo/library/cipher.c \ repo/library/cipher_wrap.c \ repo/library/cmac.c \ + repo/library/common.h \ repo/library/ctr_drbg.c \ repo/library/debug.c \ + repo/library/des.c \ + repo/library/dhm.c \ repo/library/ecdh.c \ repo/library/ecdsa.c \ repo/library/ecjpake.c \ @@ -66,28 +78,73 @@ libmbedcrypto_a_SOURCES = \ repo/library/ecp_curves.c \ repo/library/entropy.c \ repo/library/entropy_poll.c \ + repo/library/error.c \ + repo/library/gcm.c \ + repo/library/havege.c \ + repo/library/hkdf.c \ repo/library/hmac_drbg.c \ repo/library/md.c \ - repo/library/md_wrap.c \ + repo/library/md2.c \ + repo/library/md4.c \ + repo/library/md5.c \ repo/library/memory_buffer_alloc.c \ + repo/library/net_sockets.c \ + repo/library/nist_kw.c \ repo/library/oid.c \ + repo/library/padlock.c \ repo/library/pem.c \ repo/library/pk.c \ repo/library/pk_wrap.c \ + repo/library/pkcs11.c \ + repo/library/pkcs12.c \ + repo/library/pkcs5.c \ repo/library/pkparse.c \ repo/library/pkwrite.c \ repo/library/platform.c \ repo/library/platform_util.c \ + repo/library/poly1305.c \ + repo/library/psa_crypto.c \ + repo/library/psa_crypto_core.h \ + repo/library/psa_crypto_driver_wrappers.c \ + repo/library/psa_crypto_driver_wrappers.h \ + repo/library/psa_crypto_invasive.h \ + repo/library/psa_crypto_its.h \ + repo/library/psa_crypto_se.c \ + repo/library/psa_crypto_se.h \ + repo/library/psa_crypto_slot_management.c \ + repo/library/psa_crypto_slot_management.h \ + repo/library/psa_crypto_storage.c \ + repo/library/psa_crypto_storage.h \ + repo/library/psa_its_file.c \ + repo/library/ripemd160.c \ + repo/library/rsa.c \ + repo/library/rsa_internal.c \ + repo/library/sha1.c \ repo/library/sha256.c \ - repo/library/ssl_cookie.c \ + repo/library/sha512.c \ + repo/library/ssl_cache.c \ repo/library/ssl_ciphersuites.c \ repo/library/ssl_cli.c \ + repo/library/ssl_cookie.c \ + repo/library/ssl_invasive.h \ + repo/library/ssl_msg.c \ repo/library/ssl_srv.c \ repo/library/ssl_ticket.c \ repo/library/ssl_tls.c \ + repo/library/ssl_tls13_keys.c \ + repo/library/ssl_tls13_keys.h \ repo/library/threading.c \ + repo/library/timing.c \ + repo/library/version.c \ + repo/library/version_features.c \ repo/library/x509.c \ + repo/library/x509_create.c \ + repo/library/x509_crl.c \ repo/library/x509_crt.c \ + repo/library/x509_csr.c \ + repo/library/x509write_crt.c \ + repo/library/x509write_csr.c \ + repo/library/xtea.c \ $(NULL) libmbedcrypto_radio_a_CPPFLAGS = \ diff --git a/third_party/mbedtls/README.md b/third_party/mbedtls/README.md index 85d4f2a77..48dec5402 100644 --- a/third_party/mbedtls/README.md +++ b/third_party/mbedtls/README.md @@ -2,11 +2,11 @@ ## URL -https://github.com/ARMmbed/mbedtls/releases/tag/mbedtls-2.14.0 +https://github.com/ARMmbed/mbedtls/releases/tag/mbedtls-2.25.0 ## Version -2.14.0 +2.25.0 ## License diff --git a/third_party/mbedtls/mbedtls-config.h b/third_party/mbedtls/mbedtls-config.h index 579328b12..619cfd74f 100644 --- a/third_party/mbedtls/mbedtls-config.h +++ b/third_party/mbedtls/mbedtls-config.h @@ -96,8 +96,6 @@ #define MBEDTLS_PEM_PARSE_C #define MBEDTLS_X509_USE_C #define MBEDTLS_X509_CRT_PARSE_C -#define MBEDTLS_X509_USE_C -#define MBEDTLS_X509_CRT_PARSE_C #endif #if OPENTHREAD_CONFIG_ECDSA_ENABLE @@ -138,10 +136,6 @@ #include MBEDTLS_USER_CONFIG_FILE #endif -#if defined(MBEDTLS_ECP_ALT) && !defined(MBEDTLS_ECP_RESTARTABLE) -typedef void mbedtls_ecp_restart_ctx; -#endif - #include "mbedtls/check_config.h" #endif /* MBEDTLS_CONFIG_H */ diff --git a/third_party/mbedtls/repo/.github/issue_template.md b/third_party/mbedtls/repo/.github/issue_template.md index 7c3135351..18b87fca8 100644 --- a/third_party/mbedtls/repo/.github/issue_template.md +++ b/third_party/mbedtls/repo/.github/issue_template.md @@ -1,7 +1,7 @@ Note: This is just a template, so feel free to use/remove the unnecessary things ### Description -- Type: Bug | Enhancement\Feature Request | Question +- Type: Bug | Enhancement\Feature Request - Priority: Blocker | Major | Minor --------------------------------------------------------------- @@ -38,4 +38,4 @@ Version: ## Question -**Please first check for answers in the [Mbed TLS knowledge Base](https://tls.mbed.org/kb), and preferably file an issue in the [Mbed TLS support forum](https://forums.mbed.com/c/mbed-tls)** +**Please first check for answers in the [Mbed TLS knowledge Base](https://tls.mbed.org/kb). If you can't find the answer you're looking for then please use the [Mbed TLS mailing list](https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls)** diff --git a/third_party/mbedtls/repo/.github/pull_request_template.md b/third_party/mbedtls/repo/.github/pull_request_template.md index 485b54195..c5804436a 100644 --- a/third_party/mbedtls/repo/.github/pull_request_template.md +++ b/third_party/mbedtls/repo/.github/pull_request_template.md @@ -1,8 +1,5 @@ Notes: -* Pull requests cannot be accepted until: -- The submitter has [accepted the online agreement here with a click through](https://developer.mbed.org/contributor_agreement/) - or for companies or those that do not wish to create an mbed account, a slightly different agreement can be found [here](https://www.mbed.com/en/about-mbed/contributor-license-agreements/) -- The PR follows the [mbed TLS coding standards](https://tls.mbed.org/kb/development/mbedtls-coding-standards) +* Pull requests cannot be accepted until the PR follows the [contributing guidelines](../CONTRIBUTING.md). In particular, each commit must have at least one `Signed-off-by:` line from the committer to certify that the contribution is made under the terms of the [Developer Certificate of Origin](../dco.txt). * This is just a template, so feel free to use/remove the unnecessary things ## Description A few sentences describing the overall goals of the pull request's commits. diff --git a/third_party/mbedtls/repo/.gitignore b/third_party/mbedtls/repo/.gitignore index f40064d5b..39cdc4ea5 100644 --- a/third_party/mbedtls/repo/.gitignore +++ b/third_party/mbedtls/repo/.gitignore @@ -1,8 +1,20 @@ +# Random seed file created by test scripts and sample programs +seedfile + +# CMake build artifacts: CMakeCache.txt CMakeFiles CTestTestfile.cmake cmake_install.cmake Testing +# CMake generates *.dir/ folders for in-tree builds (used by MSVC projects), ignore all of those: +*.dir/ +# MSVC files generated by CMake: +/*.sln +/*.vcxproj +/*.filters + +# Test coverage build artifacts: Coverage *.gcno *.gcda @@ -10,11 +22,6 @@ Coverage # generated by scripts/memory.sh massif-* -# MSVC files generated by CMake: -/*.sln -/*.vcxproj -/*.filters - # MSVC build artifacts: *.exe *.pdb @@ -26,3 +33,26 @@ massif-* # CMake generates *.dir/ folders for in-tree builds (used by MSVC projects), ignore all of those: *.dir/ + +# Microsoft CMake extension for Visual Studio Code generates a build directory by default +/build/ + +# Visual Studio artifacts +/visualc/VS2010/.localhistory/ +/visualc/VS2010/.vs/ +/visualc/VS2010/Debug/ +/visualc/VS2010/Release/ +/visualc/VS2010/*.vcxproj.filters +/visualc/VS2010/*.vcxproj.user + +# Generated documentation: +/apidoc + +# Editor navigation files: +/GPATH +/GRTAGS +/GSYMS +/GTAGS +/TAGS +/cscope*.out +/tags diff --git a/third_party/mbedtls/repo/.globalrc b/third_party/mbedtls/repo/.globalrc new file mode 100644 index 000000000..01b2ea5a3 --- /dev/null +++ b/third_party/mbedtls/repo/.globalrc @@ -0,0 +1,3 @@ +default:\ + :langmap=c\:.c.h.function:\ + diff --git a/third_party/mbedtls/repo/.pylint b/third_party/mbedtls/repo/.pylint deleted file mode 100644 index 934f30be5..000000000 --- a/third_party/mbedtls/repo/.pylint +++ /dev/null @@ -1,425 +0,0 @@ -[MASTER] - -# A comma-separated list of package or module names from where C extensions may -# be loaded. Extensions are loading into the active Python interpreter and may -# run arbitrary code -extension-pkg-whitelist= - -# Add files or directories to the blacklist. They should be base names, not -# paths. -ignore=CVS - -# Add files or directories matching the regex patterns to the blacklist. The -# regex matches against base names, not paths. -ignore-patterns= - -# Python code to execute, usually for sys.path manipulation such as -# pygtk.require(). -#init-hook= - -# Use multiple processes to speed up Pylint. -jobs=1 - -# List of plugins (as comma separated values of python modules names) to load, -# usually to register additional checkers. -load-plugins= - -# Pickle collected data for later comparisons. -persistent=yes - -# Specify a configuration file. -#rcfile= - -# Allow loading of arbitrary C extensions. Extensions are imported into the -# active Python interpreter and may run arbitrary code. -unsafe-load-any-extension=no - - -[MESSAGES CONTROL] - -# Only show warnings with the listed confidence levels. Leave empty to show -# all. Valid levels: HIGH, INFERENCE, INFERENCE_FAILURE, UNDEFINED -confidence= - -# Disable the message, report, category or checker with the given id(s). You -# can either give multiple identifiers separated by comma (,) or put this -# option multiple times (only on the command line, not in the configuration -# file where it should appear only once).You can also use "--disable=all" to -# disable everything first and then reenable specific checks. For example, if -# you want to run only the similarities checker, you can use "--disable=all -# --enable=similarities". If you want to run only the classes checker, but have -# no Warning level messages displayed, use"--disable=all --enable=classes -# --disable=W" -disable=print-statement,parameter-unpacking,unpacking-in-except,old-raise-syntax,backtick,long-suffix,old-ne-operator,old-octal-literal,import-star-module-level,raw-checker-failed,bad-inline-option,locally-disabled,locally-enabled,file-ignored,suppressed-message,useless-suppression,deprecated-pragma,apply-builtin,basestring-builtin,buffer-builtin,cmp-builtin,coerce-builtin,execfile-builtin,file-builtin,long-builtin,raw_input-builtin,reduce-builtin,standarderror-builtin,unicode-builtin,xrange-builtin,coerce-method,delslice-method,getslice-method,setslice-method,no-absolute-import,old-division,dict-iter-method,dict-view-method,next-method-called,metaclass-assignment,indexing-exception,raising-string,reload-builtin,oct-method,hex-method,nonzero-method,cmp-method,input-builtin,round-builtin,intern-builtin,unichr-builtin,map-builtin-not-iterating,zip-builtin-not-iterating,range-builtin-not-iterating,filter-builtin-not-iterating,using-cmp-argument,eq-without-hash,div-method,idiv-method,rdiv-method,exception-message-attribute,invalid-str-codec,sys-max-int,bad-python3-import,deprecated-string-function,deprecated-str-translate-call - -# Enable the message, report, category or checker with the given id(s). You can -# either give multiple identifier separated by comma (,) or put this option -# multiple time (only on the command line, not in the configuration file where -# it should appear only once). See also the "--disable" option for examples. -enable= - - -[REPORTS] - -# Python expression which should return a note less than 10 (10 is the highest -# note). You have access to the variables errors warning, statement which -# respectively contain the number of errors / warnings messages and the total -# number of statements analyzed. This is used by the global evaluation report -# (RP0004). -evaluation=10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10) - -# Template used to display messages. This is a python new-style format string -# used to format the message information. See doc for all details -#msg-template= - -# Set the output format. Available formats are text, parseable, colorized, json -# and msvs (visual studio).You can also give a reporter class, eg -# mypackage.mymodule.MyReporterClass. -output-format=text - -# Tells whether to display a full report or only the messages -reports=no - -# Activate the evaluation score. -score=yes - - -[REFACTORING] - -# Maximum number of nested blocks for function / method body -max-nested-blocks=5 - - -[SIMILARITIES] - -# Ignore comments when computing similarities. -ignore-comments=yes - -# Ignore docstrings when computing similarities. -ignore-docstrings=yes - -# Ignore imports when computing similarities. -ignore-imports=no - -# Minimum lines number of a similarity. -min-similarity-lines=4 - - -[FORMAT] - -# Expected format of line ending, e.g. empty (any line ending), LF or CRLF. -expected-line-ending-format= - -# Regexp for a line that is allowed to be longer than the limit. -ignore-long-lines=^\s*(# )??$ - -# Number of spaces of indent required inside a hanging or continued line. -indent-after-paren=4 - -# String used as indentation unit. This is usually " " (4 spaces) or "\t" (1 -# tab). -indent-string=' ' - -# Maximum number of characters on a single line. -max-line-length=79 - -# Maximum number of lines in a module -max-module-lines=2000 - -# List of optional constructs for which whitespace checking is disabled. `dict- -# separator` is used to allow tabulation in dicts, etc.: {1 : 1,\n222: 2}. -# `trailing-comma` allows a space between comma and closing bracket: (a, ). -# `empty-line` allows space-only lines. -no-space-check=trailing-comma,dict-separator - -# Allow the body of a class to be on the same line as the declaration if body -# contains single statement. -single-line-class-stmt=no - -# Allow the body of an if to be on the same line as the test if there is no -# else. -single-line-if-stmt=no - - -[BASIC] - -# Naming hint for argument names -argument-name-hint=(([a-z][a-z0-9_]{2,30})|(_[a-z0-9_]*))$ - -# Regular expression matching correct argument names -argument-rgx=(([a-z][a-z0-9_]{2,30})|(_[a-z0-9_]*))$ - -# Naming hint for attribute names -attr-name-hint=(([a-z][a-z0-9_]{2,30})|(_[a-z0-9_]*))$ - -# Regular expression matching correct attribute names -attr-rgx=(([a-z][a-z0-9_]{2,30})|(_[a-z0-9_]*))$ - -# Bad variable names which should always be refused, separated by a comma -bad-names=foo,bar,baz,toto,tutu,tata - -# Naming hint for class attribute names -class-attribute-name-hint=([A-Za-z_][A-Za-z0-9_]{2,30}|(__.*__))$ - -# Regular expression matching correct class attribute names -class-attribute-rgx=([A-Za-z_][A-Za-z0-9_]{2,30}|(__.*__))$ - -# Naming hint for class names -class-name-hint=[A-Z_][a-zA-Z0-9]+$ - -# Regular expression matching correct class names -class-rgx=[A-Z_][a-zA-Z0-9]+$ - -# Naming hint for constant names -const-name-hint=(([A-Z_][A-Z0-9_]*)|(__.*__))$ - -# Regular expression matching correct constant names -const-rgx=(([A-Z_][A-Z0-9_]*)|(__.*__))$ - -# Minimum line length for functions/classes that require docstrings, shorter -# ones are exempt. -docstring-min-length=-1 - -# Naming hint for function names -function-name-hint=(([a-z][a-z0-9_]{2,30})|(_[a-z0-9_]*))$ - -# Regular expression matching correct function names -function-rgx=(([a-z][a-z0-9_]{2,30})|(_[a-z0-9_]*))$ - -# Good variable names which should always be accepted, separated by a comma -good-names=i,j,k,ex,Run,_ - -# Include a hint for the correct naming format with invalid-name -include-naming-hint=no - -# Naming hint for inline iteration names -inlinevar-name-hint=[A-Za-z_][A-Za-z0-9_]*$ - -# Regular expression matching correct inline iteration names -inlinevar-rgx=[A-Za-z_][A-Za-z0-9_]*$ - -# Naming hint for method names -method-name-hint=(([a-z][a-z0-9_]{2,30})|(_[a-z0-9_]*))$ - -# Regular expression matching correct method names -method-rgx=(([a-z][a-z0-9_]{2,30})|(_[a-z0-9_]*))$ - -# Naming hint for module names -module-name-hint=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$ - -# Regular expression matching correct module names -module-rgx=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$ - -# Colon-delimited sets of names that determine each other's naming style when -# the name regexes allow several styles. -name-group= - -# Regular expression which should only match function or class names that do -# not require a docstring. -no-docstring-rgx=^_ - -# List of decorators that produce properties, such as abc.abstractproperty. Add -# to this list to register other decorators that produce valid properties. -property-classes=abc.abstractproperty - -# Naming hint for variable names -variable-name-hint=(([a-z][a-z0-9_]{2,30})|(_[a-z0-9_]*))$ - -# Regular expression matching correct variable names -variable-rgx=(([a-z][a-z0-9_]{2,30})|(_[a-z0-9_]*))$ - - -[TYPECHECK] - -# List of decorators that produce context managers, such as -# contextlib.contextmanager. Add to this list to register other decorators that -# produce valid context managers. -contextmanager-decorators=contextlib.contextmanager - -# List of members which are set dynamically and missed by pylint inference -# system, and so shouldn't trigger E1101 when accessed. Python regular -# expressions are accepted. -generated-members= - -# Tells whether missing members accessed in mixin class should be ignored. A -# mixin class is detected if its name ends with "mixin" (case insensitive). -ignore-mixin-members=yes - -# This flag controls whether pylint should warn about no-member and similar -# checks whenever an opaque object is returned when inferring. The inference -# can return multiple potential results while evaluating a Python object, but -# some branches might not be evaluated, which results in partial inference. In -# that case, it might be useful to still emit no-member and other checks for -# the rest of the inferred objects. -ignore-on-opaque-inference=yes - -# List of class names for which member attributes should not be checked (useful -# for classes with dynamically set attributes). This supports the use of -# qualified names. -ignored-classes=optparse.Values,thread._local,_thread._local - -# List of module names for which member attributes should not be checked -# (useful for modules/projects where namespaces are manipulated during runtime -# and thus existing member attributes cannot be deduced by static analysis. It -# supports qualified module names, as well as Unix pattern matching. -ignored-modules= - -# Show a hint with possible names when a member name was not found. The aspect -# of finding the hint is based on edit distance. -missing-member-hint=yes - -# The minimum edit distance a name should have in order to be considered a -# similar match for a missing member name. -missing-member-hint-distance=1 - -# The total number of similar names that should be taken in consideration when -# showing a hint for a missing member. -missing-member-max-choices=1 - - -[VARIABLES] - -# List of additional names supposed to be defined in builtins. Remember that -# you should avoid to define new builtins when possible. -additional-builtins= - -# Tells whether unused global variables should be treated as a violation. -allow-global-unused-variables=yes - -# List of strings which can identify a callback function by name. A callback -# name must start or end with one of those strings. -callbacks=cb_,_cb - -# A regular expression matching the name of dummy variables (i.e. expectedly -# not used). -dummy-variables-rgx=_+$|(_[a-zA-Z0-9_]*[a-zA-Z0-9]+?$)|dummy|^ignored_|^unused_ - -# Argument names that match this expression will be ignored. Default to name -# with leading underscore -ignored-argument-names=_.*|^ignored_|^unused_ - -# Tells whether we should check for unused import in __init__ files. -init-import=no - -# List of qualified module names which can have objects that can redefine -# builtins. -redefining-builtins-modules=six.moves,future.builtins - - -[SPELLING] - -# Spelling dictionary name. Available dictionaries: none. To make it working -# install python-enchant package. -spelling-dict= - -# List of comma separated words that should not be checked. -spelling-ignore-words= - -# A path to a file that contains private dictionary; one word per line. -spelling-private-dict-file= - -# Tells whether to store unknown words to indicated private dictionary in -# --spelling-private-dict-file option instead of raising a message. -spelling-store-unknown-words=no - - -[MISCELLANEOUS] - -# List of note tags to take in consideration, separated by a comma. -notes=FIXME,XXX,TODO - - -[LOGGING] - -# Logging modules to check that the string format arguments are in logging -# function parameter format -logging-modules=logging - - -[CLASSES] - -# List of method names used to declare (i.e. assign) instance attributes. -defining-attr-methods=__init__,__new__,setUp - -# List of member names, which should be excluded from the protected access -# warning. -exclude-protected=_asdict,_fields,_replace,_source,_make - -# List of valid names for the first argument in a class method. -valid-classmethod-first-arg=cls - -# List of valid names for the first argument in a metaclass class method. -valid-metaclass-classmethod-first-arg=mcs - - -[DESIGN] - -# Maximum number of arguments for function / method -max-args=5 - -# Maximum number of attributes for a class (see R0902). -max-attributes=7 - -# Maximum number of boolean expressions in a if statement -max-bool-expr=5 - -# Maximum number of branch for function / method body -max-branches=12 - -# Maximum number of locals for function / method body -max-locals=15 - -# Maximum number of parents for a class (see R0901). -max-parents=7 - -# Maximum number of public methods for a class (see R0904). -max-public-methods=20 - -# Maximum number of return / yield for function / method body -max-returns=6 - -# Maximum number of statements in function / method body -max-statements=50 - -# Minimum number of public methods for a class (see R0903). -min-public-methods=2 - - -[IMPORTS] - -# Allow wildcard imports from modules that define __all__. -allow-wildcard-with-all=no - -# Analyse import fallback blocks. This can be used to support both Python 2 and -# 3 compatible code, which means that the block might have code that exists -# only in one or another interpreter, leading to false positives when analysed. -analyse-fallback-blocks=no - -# Deprecated modules which should not be used, separated by a comma -deprecated-modules=regsub,TERMIOS,Bastion,rexec - -# Create a graph of external dependencies in the given file (report RP0402 must -# not be disabled) -ext-import-graph= - -# Create a graph of every (i.e. internal and external) dependencies in the -# given file (report RP0402 must not be disabled) -import-graph= - -# Create a graph of internal dependencies in the given file (report RP0402 must -# not be disabled) -int-import-graph= - -# Force import order to recognize a module as part of the standard -# compatibility libraries. -known-standard-library= - -# Force import order to recognize a module as part of a third party library. -known-third-party=enchant - - -[EXCEPTIONS] - -# Exceptions that will emit a warning when being caught. Defaults to -# "Exception" -overgeneral-exceptions=Exception diff --git a/third_party/mbedtls/repo/.pylintrc b/third_party/mbedtls/repo/.pylintrc new file mode 100644 index 000000000..ad25a7ca1 --- /dev/null +++ b/third_party/mbedtls/repo/.pylintrc @@ -0,0 +1,72 @@ +[BASIC] +# We're ok with short funtion argument names. +# [invalid-name] +argument-rgx=[a-z_][a-z0-9_]*$ + +# Allow filter and map. +# [bad-builtin] +bad-functions=input + +# We prefer docstrings, but we don't require them on all functions. +# Require them only on long functions (for some value of long). +# [missing-docstring] +docstring-min-length=10 + +# Allow longer methods than the default. +# [invalid-name] +method-rgx=[a-z_][a-z0-9_]{2,35}$ + +# Allow module names containing a dash (but no underscore or uppercase letter). +# They are whole programs, not meant to be included by another module. +# [invalid-name] +module-rgx=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+)|[a-z][-0-9a-z]+)$ + +# Some functions don't need docstrings. +# [missing-docstring] +no-docstring-rgx=(run_)?main$ + +# We're ok with short local or global variable names. +# [invalid-name] +variable-rgx=[a-z_][a-z0-9_]*$ + +[DESIGN] +# Allow more than the default 7 attributes. +# [too-many-instance-attributes] +max-attributes=15 + +[FORMAT] +# Allow longer modules than the default recommended maximum. +# [too-many-lines] +max-module-lines=2000 + +[MESSAGES CONTROL] +# * locally-disabled, locally-enabled: If we disable or enable a message +# locally, it's by design. There's no need to clutter the Pylint output +# with this information. +# * logging-format-interpolation: Pylint warns about things like +# ``log.info('...'.format(...))``. It insists on ``log.info('...', ...)``. +# This is of minor utility (mainly a performance gain when there are +# many messages that use formatting and are below the log level). +# Some versions of Pylint (including 1.8, which is the version on +# Ubuntu 18.04) only recognize old-style format strings using '%', +# and complain about something like ``log.info('{}', foo)`` with +# logging-too-many-args (Pylint supports new-style formatting if +# declared globally with logging_format_style under [LOGGING] but +# this requires Pylint >=2.2). +# * no-else-return: Allow the perfectly reasonable idiom +# if condition1: +# return value1 +# else: +# return value2 +# * unnecessary-pass: If we take the trouble of adding a line with "pass", +# it's because we think the code is clearer that way. +disable=locally-disabled,locally-enabled,logging-format-interpolation,no-else-return,unnecessary-pass + +[REPORTS] +# Don't diplay statistics. Just the facts. +reports=no + +[VARIABLES] +# Allow unused variables if their name starts with an underscore. +# [unused-argument] +dummy-variables-rgx=_.* diff --git a/third_party/mbedtls/repo/.travis.yml b/third_party/mbedtls/repo/.travis.yml index 4d23652c6..76cb1c537 100644 --- a/third_party/mbedtls/repo/.travis.yml +++ b/third_party/mbedtls/repo/.travis.yml @@ -1,40 +1,69 @@ language: c -compiler: -- clang -- gcc +compiler: gcc sudo: false cache: ccache -script: -- tests/scripts/recursion.pl library/*.c -- tests/scripts/check-generated-files.sh -- tests/scripts/check-doxy-blocks.pl -- tests/scripts/check-names.sh -- tests/scripts/check-files.py -- tests/scripts/doxygen.sh -- cmake -D CMAKE_BUILD_TYPE:String="Check" . -- make -- make test -- programs/test/selftest -- OSSL_NO_DTLS=1 tests/compat.sh -- tests/ssl-opt.sh -e '\(DTLS\|SCSV\).*openssl' -- tests/scripts/test-ref-configs.pl -- tests/scripts/curves.pl -- tests/scripts/key-exchanges.pl + +jobs: + include: + - name: basic checks and reference configurations + addons: + apt: + packages: + - gnutls-bin + - doxygen + - graphviz + - gcc-arm-none-eabi + - libnewlib-arm-none-eabi + language: python # Needed to get pip for Python 3 + python: 3.5 # version from Ubuntu 16.04 + install: + - pip install pylint==2.4.4 + script: + - tests/scripts/all.sh -k 'check_*' + - tests/scripts/all.sh -k test_default_out_of_box + - tests/scripts/test-ref-configs.pl + - tests/scripts/all.sh -k build_arm_none_eabi_gcc_arm5vte build_arm_none_eabi_gcc_m0plus + + - name: full configuration + script: + - tests/scripts/all.sh -k test_full_cmake_gcc_asan + + - name: macOS + os: osx + compiler: clang + script: + - tests/scripts/all.sh -k test_default_out_of_box + + - name: Windows + os: windows + before_install: + - choco install python --version=3.5.4 + env: + # Add the directory where the Choco package goes + - PATH=/c/Python35:/c/Python35/Scripts:$PATH + script: + - type python; python --version + - python scripts/generate_psa_constants.py + # Logs appear out of sequence on Windows. Give time to catch up. + - sleep 5 + - scripts/windows_msbuild.bat v141 # Visual Studio 2017 + after_failure: - tests/scripts/travis-log-failure.sh + env: global: - secure: "barHldniAfXyoWOD/vcO+E6/Xm4fmcaUoC9BeKW+LwsHqlDMLvugaJnmLXkSpkbYhVL61Hzf3bo0KPJn88AFc5Rkf8oYHPjH4adMnVXkf3B9ghHCgznqHsAH3choo6tnPxaFgOwOYmLGb382nQxfE5lUdvnM/W/psQjWt66A1+k=" + - SEED=1 + - secure: "FrI5d2s+ckckC17T66c8jm2jV6i2DkBPU5nyWzwbedjmEBeocREfQLd/x8yKpPzLDz7ghOvr+/GQvsPPn0dVkGlNzm3Q+hGHc/ujnASuUtGrcuMM+0ALnJ3k4rFr9xEvjJeWb4SmhJO5UCAZYvTItW4k7+bj9L+R6lt3TzQbXzg=" addons: apt: packages: - - doxygen - - graphviz + - gnutls-bin coverity_scan: project: name: "ARMmbed/mbedtls" - notification_email: p.j.bakker@polarssl.org + notification_email: support-mbedtls@arm.com build_command_prepend: build_command: make branch_pattern: coverity_scan diff --git a/third_party/mbedtls/repo/3rdparty/.gitignore b/third_party/mbedtls/repo/3rdparty/.gitignore new file mode 100644 index 000000000..5fc607b9e --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/.gitignore @@ -0,0 +1 @@ +/Makefile diff --git a/third_party/mbedtls/repo/3rdparty/CMakeLists.txt b/third_party/mbedtls/repo/3rdparty/CMakeLists.txt new file mode 100644 index 000000000..18945e52e --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/CMakeLists.txt @@ -0,0 +1,17 @@ +list (APPEND thirdparty_src) +list (APPEND thirdparty_lib) +list (APPEND thirdparty_inc_public) +list (APPEND thirdparty_inc) +list (APPEND thirdparty_def) + +execute_process(COMMAND ${MBEDTLS_PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/../scripts/config.py -f ${CMAKE_CURRENT_SOURCE_DIR}/../include/mbedtls/config.h get MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED RESULT_VARIABLE result) + +if(${result} EQUAL 0) + add_subdirectory(everest) +endif() + +set(thirdparty_src ${thirdparty_src} PARENT_SCOPE) +set(thirdparty_lib ${thirdparty_lib} PARENT_SCOPE) +set(thirdparty_inc_public ${thirdparty_inc_public} PARENT_SCOPE) +set(thirdparty_inc ${thirdparty_inc} PARENT_SCOPE) +set(thirdparty_def ${thirdparty_def} PARENT_SCOPE) diff --git a/third_party/mbedtls/repo/3rdparty/Makefile.inc b/third_party/mbedtls/repo/3rdparty/Makefile.inc new file mode 100644 index 000000000..0ed85af51 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/Makefile.inc @@ -0,0 +1,2 @@ +THIRDPARTY_DIR = $(dir $(lastword $(MAKEFILE_LIST))) +include $(THIRDPARTY_DIR)/everest/Makefile.inc diff --git a/third_party/mbedtls/repo/3rdparty/everest/.gitignore b/third_party/mbedtls/repo/3rdparty/everest/.gitignore new file mode 100644 index 000000000..6eb25f66a --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/.gitignore @@ -0,0 +1,2 @@ +*.o +Makefile diff --git a/third_party/mbedtls/repo/3rdparty/everest/CMakeLists.txt b/third_party/mbedtls/repo/3rdparty/everest/CMakeLists.txt new file mode 100644 index 000000000..d81d995f1 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/CMakeLists.txt @@ -0,0 +1,28 @@ +list (APPEND everest_src) +list (APPEND everest_inc_public) +list (APPEND everest_inc) +list (APPEND everest_def) + +set(everest_src + ${CMAKE_CURRENT_SOURCE_DIR}/library/everest.c + ${CMAKE_CURRENT_SOURCE_DIR}/library/x25519.c + ${CMAKE_CURRENT_SOURCE_DIR}/library/Hacl_Curve25519_joined.c +) + +list(APPEND everest_inc_public ${CMAKE_CURRENT_SOURCE_DIR}/include) +list(APPEND everest_inc ${CMAKE_CURRENT_SOURCE_DIR}/include/everest ${CMAKE_CURRENT_SOURCE_DIR}/include/everest/kremlib) + +if(INSTALL_MBEDTLS_HEADERS) + + install(DIRECTORY include/everest + DESTINATION include + FILE_PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ + DIRECTORY_PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE + FILES_MATCHING PATTERN "*.h") + +endif(INSTALL_MBEDTLS_HEADERS) + +set(thirdparty_src ${thirdparty_src} ${everest_src} PARENT_SCOPE) +set(thirdparty_inc_public ${thirdparty_inc_public} ${everest_inc_public} PARENT_SCOPE) +set(thirdparty_inc ${thirdparty_inc} ${everest_inc} PARENT_SCOPE) +set(thirdparty_def ${thirdparty_def} ${everest_def} PARENT_SCOPE) diff --git a/third_party/mbedtls/repo/3rdparty/everest/Makefile.inc b/third_party/mbedtls/repo/3rdparty/everest/Makefile.inc new file mode 100644 index 000000000..77a6b4965 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/Makefile.inc @@ -0,0 +1,6 @@ +THIRDPARTY_INCLUDES+=-I../3rdparty/everest/include -I../3rdparty/everest/include/everest -I../3rdparty/everest/include/everest/kremlib + +THIRDPARTY_CRYPTO_OBJECTS+= \ + ../3rdparty/everest/library/everest.o \ + ../3rdparty/everest/library/x25519.o \ + ../3rdparty/everest/library/Hacl_Curve25519_joined.o diff --git a/third_party/mbedtls/repo/3rdparty/everest/README.md b/third_party/mbedtls/repo/3rdparty/everest/README.md new file mode 100644 index 000000000..0e2546662 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/README.md @@ -0,0 +1,5 @@ +The files in this directory stem from [Project Everest](https://project-everest.github.io/) and are distributed under the Apache 2.0 license. + +This is a formally verified implementation of Curve25519-based handshakes. The C code is automatically derived from the (verified) [original implementation](https://github.com/project-everest/hacl-star/tree/master/code/curve25519) in the [F* language](https://github.com/fstarlang/fstar) by [KreMLin](https://github.com/fstarlang/kremlin). In addition to the improved safety and security of the implementation, it is also significantly faster than the default implementation of Curve25519 in mbedTLS. + +The caveat is that not all platforms are supported, although the version in `everest/library/legacy` should work on most systems. The main issue is that some platforms do not provide a 128-bit integer type and KreMLin therefore has to use additional (also verified) code to simulate them, resulting in less of a performance gain overall. Explictly supported platforms are currently `x86` and `x86_64` using gcc or clang, and Visual C (2010 and later). diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/Hacl_Curve25519.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/Hacl_Curve25519.h new file mode 100644 index 000000000..e3f5ba44b --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/Hacl_Curve25519.h @@ -0,0 +1,21 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +/* This file was generated by KreMLin + * KreMLin invocation: /mnt/e/everest/verify/kremlin/krml -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -fbuiltin-uint128 -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -I /mnt/e/everest/verify/hacl-star/code/lib/kremlin -I /mnt/e/everest/verify/kremlin/kremlib/compat -I /mnt/e/everest/verify/hacl-star/specs -I /mnt/e/everest/verify/hacl-star/specs/old -I . -ccopt -march=native -verbose -ldopt -flto -tmpdir x25519-c -I ../bignum -bundle Hacl.Curve25519=* -minimal -add-include "kremlib.h" -skip-compilation x25519-c/out.krml -o x25519-c/Hacl_Curve25519.c + * F* version: 059db0c8 + * KreMLin version: 916c37ac + */ + + + +#ifndef __Hacl_Curve25519_H +#define __Hacl_Curve25519_H + + +#include "kremlib.h" + +void Hacl_Curve25519_crypto_scalarmult(uint8_t *mypublic, uint8_t *secret, uint8_t *basepoint); + +#define __Hacl_Curve25519_H_DEFINED +#endif diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/everest.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/everest.h new file mode 100644 index 000000000..58065001f --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/everest.h @@ -0,0 +1,234 @@ +/* + * Interface to code from Project Everest + * + * Copyright 2016-2018 INRIA and Microsoft Corporation + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * This file is part of Mbed TLS (https://tls.mbed.org). + */ + +#ifndef MBEDTLS_EVEREST_H +#define MBEDTLS_EVEREST_H + +#include "everest/x25519.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Defines the source of the imported EC key. + */ +typedef enum +{ + MBEDTLS_EVEREST_ECDH_OURS, /**< Our key. */ + MBEDTLS_EVEREST_ECDH_THEIRS, /**< The key of the peer. */ +} mbedtls_everest_ecdh_side; + +typedef struct { + mbedtls_x25519_context ctx; +} mbedtls_ecdh_context_everest; + + +/** + * \brief This function sets up the ECDH context with the information + * given. + * + * This function should be called after mbedtls_ecdh_init() but + * before mbedtls_ecdh_make_params(). There is no need to call + * this function before mbedtls_ecdh_read_params(). + * + * This is the first function used by a TLS server for ECDHE + * ciphersuites. + * + * \param ctx The ECDH context to set up. + * \param grp_id The group id of the group to set up the context for. + * + * \return \c 0 on success. + */ +int mbedtls_everest_setup( mbedtls_ecdh_context_everest *ctx, int grp_id ); + +/** + * \brief This function frees a context. + * + * \param ctx The context to free. + */ +void mbedtls_everest_free( mbedtls_ecdh_context_everest *ctx ); + +/** + * \brief This function generates a public key and a TLS + * ServerKeyExchange payload. + * + * This is the second function used by a TLS server for ECDHE + * ciphersuites. (It is called after mbedtls_ecdh_setup().) + * + * \note This function assumes that the ECP group (grp) of the + * \p ctx context has already been properly set, + * for example, using mbedtls_ecp_group_load(). + * + * \see ecp.h + * + * \param ctx The ECDH context. + * \param olen The number of characters written. + * \param buf The destination buffer. + * \param blen The length of the destination buffer. + * \param f_rng The RNG function. + * \param p_rng The RNG context. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_everest_make_params( mbedtls_ecdh_context_everest *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int( *f_rng )( void *, unsigned char *, size_t ), + void *p_rng ); + +/** + * \brief This function parses and processes a TLS ServerKeyExhange + * payload. + * + * This is the first function used by a TLS client for ECDHE + * ciphersuites. + * + * \see ecp.h + * + * \param ctx The ECDH context. + * \param buf The pointer to the start of the input buffer. + * \param end The address for one Byte past the end of the buffer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + * + */ +int mbedtls_everest_read_params( mbedtls_ecdh_context_everest *ctx, + const unsigned char **buf, const unsigned char *end ); + +/** + * \brief This function parses and processes a TLS ServerKeyExhange + * payload. + * + * This is the first function used by a TLS client for ECDHE + * ciphersuites. + * + * \see ecp.h + * + * \param ctx The ECDH context. + * \param buf The pointer to the start of the input buffer. + * \param end The address for one Byte past the end of the buffer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + * + */ +int mbedtls_everest_read_params( mbedtls_ecdh_context_everest *ctx, + const unsigned char **buf, const unsigned char *end ); + +/** + * \brief This function sets up an ECDH context from an EC key. + * + * It is used by clients and servers in place of the + * ServerKeyEchange for static ECDH, and imports ECDH + * parameters from the EC key information of a certificate. + * + * \see ecp.h + * + * \param ctx The ECDH context to set up. + * \param key The EC key to use. + * \param side Defines the source of the key: 1: Our key, or + * 0: The key of the peer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + * + */ +int mbedtls_everest_get_params( mbedtls_ecdh_context_everest *ctx, const mbedtls_ecp_keypair *key, + mbedtls_everest_ecdh_side side ); + +/** + * \brief This function generates a public key and a TLS + * ClientKeyExchange payload. + * + * This is the second function used by a TLS client for ECDH(E) + * ciphersuites. + * + * \see ecp.h + * + * \param ctx The ECDH context. + * \param olen The number of Bytes written. + * \param buf The destination buffer. + * \param blen The size of the destination buffer. + * \param f_rng The RNG function. + * \param p_rng The RNG context. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_everest_make_public( mbedtls_ecdh_context_everest *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int( *f_rng )( void *, unsigned char *, size_t ), + void *p_rng ); + +/** + * \brief This function parses and processes a TLS ClientKeyExchange + * payload. + * + * This is the third function used by a TLS server for ECDH(E) + * ciphersuites. (It is called after mbedtls_ecdh_setup() and + * mbedtls_ecdh_make_params().) + * + * \see ecp.h + * + * \param ctx The ECDH context. + * \param buf The start of the input buffer. + * \param blen The length of the input buffer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_everest_read_public( mbedtls_ecdh_context_everest *ctx, + const unsigned char *buf, size_t blen ); + +/** + * \brief This function derives and exports the shared secret. + * + * This is the last function used by both TLS client + * and servers. + * + * \note If \p f_rng is not NULL, it is used to implement + * countermeasures against side-channel attacks. + * For more information, see mbedtls_ecp_mul(). + * + * \see ecp.h + * + * \param ctx The ECDH context. + * \param olen The number of Bytes written. + * \param buf The destination buffer. + * \param blen The length of the destination buffer. + * \param f_rng The RNG function. + * \param p_rng The RNG context. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_everest_calc_secret( mbedtls_ecdh_context_everest *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int( *f_rng )( void *, unsigned char *, size_t ), + void *p_rng ); + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_EVEREST_H */ diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlib.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlib.h new file mode 100644 index 000000000..f06663f09 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlib.h @@ -0,0 +1,29 @@ +/* + * Copyright 2016-2018 INRIA and Microsoft Corporation + * + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * This file is part of Mbed TLS (https://tls.mbed.org) and + * originated from Project Everest (https://project-everest.github.io/) + */ + +#ifndef __KREMLIB_H +#define __KREMLIB_H + +#include "kremlin/internal/target.h" +#include "kremlin/internal/types.h" +#include "kremlin/c_endianness.h" + +#endif /* __KREMLIB_H */ diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlib/FStar_UInt128.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlib/FStar_UInt128.h new file mode 100644 index 000000000..d71c8820b --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlib/FStar_UInt128.h @@ -0,0 +1,124 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +/* This file was generated by KreMLin + * KreMLin invocation: ../krml -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrB9w -minimal -fparentheses -fcurly-braces -fno-shadow -header copyright-header.txt -minimal -tmpdir dist/uint128 -skip-compilation -extract-uints -add-include -add-include -add-include "kremlin/internal/types.h" -bundle FStar.UInt128=* extracted/prims.krml extracted/FStar_Pervasives_Native.krml extracted/FStar_Pervasives.krml extracted/FStar_Mul.krml extracted/FStar_Squash.krml extracted/FStar_Classical.krml extracted/FStar_StrongExcludedMiddle.krml extracted/FStar_FunctionalExtensionality.krml extracted/FStar_List_Tot_Base.krml extracted/FStar_List_Tot_Properties.krml extracted/FStar_List_Tot.krml extracted/FStar_Seq_Base.krml extracted/FStar_Seq_Properties.krml extracted/FStar_Seq.krml extracted/FStar_Math_Lib.krml extracted/FStar_Math_Lemmas.krml extracted/FStar_BitVector.krml extracted/FStar_UInt.krml extracted/FStar_UInt32.krml extracted/FStar_Int.krml extracted/FStar_Int16.krml extracted/FStar_Preorder.krml extracted/FStar_Ghost.krml extracted/FStar_ErasedLogic.krml extracted/FStar_UInt64.krml extracted/FStar_Set.krml extracted/FStar_PropositionalExtensionality.krml extracted/FStar_PredicateExtensionality.krml extracted/FStar_TSet.krml extracted/FStar_Monotonic_Heap.krml extracted/FStar_Heap.krml extracted/FStar_Map.krml extracted/FStar_Monotonic_HyperHeap.krml extracted/FStar_Monotonic_HyperStack.krml extracted/FStar_HyperStack.krml extracted/FStar_Monotonic_Witnessed.krml extracted/FStar_HyperStack_ST.krml extracted/FStar_HyperStack_All.krml extracted/FStar_Date.krml extracted/FStar_Universe.krml extracted/FStar_GSet.krml extracted/FStar_ModifiesGen.krml extracted/LowStar_Monotonic_Buffer.krml extracted/LowStar_Buffer.krml extracted/Spec_Loops.krml extracted/LowStar_BufferOps.krml extracted/C_Loops.krml extracted/FStar_UInt8.krml extracted/FStar_Kremlin_Endianness.krml extracted/FStar_UInt63.krml extracted/FStar_Exn.krml extracted/FStar_ST.krml extracted/FStar_All.krml extracted/FStar_Dyn.krml extracted/FStar_Int63.krml extracted/FStar_Int64.krml extracted/FStar_Int32.krml extracted/FStar_Int8.krml extracted/FStar_UInt16.krml extracted/FStar_Int_Cast.krml extracted/FStar_UInt128.krml extracted/C_Endianness.krml extracted/FStar_List.krml extracted/FStar_Float.krml extracted/FStar_IO.krml extracted/C.krml extracted/FStar_Char.krml extracted/FStar_String.krml extracted/LowStar_Modifies.krml extracted/C_String.krml extracted/FStar_Bytes.krml extracted/FStar_HyperStack_IO.krml extracted/C_Failure.krml extracted/TestLib.krml extracted/FStar_Int_Cast_Full.krml + * F* version: 059db0c8 + * KreMLin version: 916c37ac + */ + + + +#ifndef __FStar_UInt128_H +#define __FStar_UInt128_H + + +#include +#include +#include "kremlin/internal/types.h" + +uint64_t FStar_UInt128___proj__Mkuint128__item__low(FStar_UInt128_uint128 projectee); + +uint64_t FStar_UInt128___proj__Mkuint128__item__high(FStar_UInt128_uint128 projectee); + +typedef FStar_UInt128_uint128 FStar_UInt128_t; + +FStar_UInt128_uint128 FStar_UInt128_add(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +FStar_UInt128_uint128 +FStar_UInt128_add_underspec(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +FStar_UInt128_uint128 FStar_UInt128_add_mod(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +FStar_UInt128_uint128 FStar_UInt128_sub(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +FStar_UInt128_uint128 +FStar_UInt128_sub_underspec(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +FStar_UInt128_uint128 FStar_UInt128_sub_mod(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +FStar_UInt128_uint128 FStar_UInt128_logand(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +FStar_UInt128_uint128 FStar_UInt128_logxor(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +FStar_UInt128_uint128 FStar_UInt128_logor(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +FStar_UInt128_uint128 FStar_UInt128_lognot(FStar_UInt128_uint128 a); + +FStar_UInt128_uint128 FStar_UInt128_shift_left(FStar_UInt128_uint128 a, uint32_t s); + +FStar_UInt128_uint128 FStar_UInt128_shift_right(FStar_UInt128_uint128 a, uint32_t s); + +bool FStar_UInt128_eq(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +bool FStar_UInt128_gt(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +bool FStar_UInt128_lt(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +bool FStar_UInt128_gte(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +bool FStar_UInt128_lte(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +FStar_UInt128_uint128 FStar_UInt128_eq_mask(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +FStar_UInt128_uint128 FStar_UInt128_gte_mask(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b); + +FStar_UInt128_uint128 FStar_UInt128_uint64_to_uint128(uint64_t a); + +uint64_t FStar_UInt128_uint128_to_uint64(FStar_UInt128_uint128 a); + +extern FStar_UInt128_uint128 +(*FStar_UInt128_op_Plus_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +extern FStar_UInt128_uint128 +(*FStar_UInt128_op_Plus_Question_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +extern FStar_UInt128_uint128 +(*FStar_UInt128_op_Plus_Percent_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +extern FStar_UInt128_uint128 +(*FStar_UInt128_op_Subtraction_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +extern FStar_UInt128_uint128 +(*FStar_UInt128_op_Subtraction_Question_Hat)( + FStar_UInt128_uint128 x0, + FStar_UInt128_uint128 x1 +); + +extern FStar_UInt128_uint128 +(*FStar_UInt128_op_Subtraction_Percent_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +extern FStar_UInt128_uint128 +(*FStar_UInt128_op_Amp_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +extern FStar_UInt128_uint128 +(*FStar_UInt128_op_Hat_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +extern FStar_UInt128_uint128 +(*FStar_UInt128_op_Bar_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +extern FStar_UInt128_uint128 +(*FStar_UInt128_op_Less_Less_Hat)(FStar_UInt128_uint128 x0, uint32_t x1); + +extern FStar_UInt128_uint128 +(*FStar_UInt128_op_Greater_Greater_Hat)(FStar_UInt128_uint128 x0, uint32_t x1); + +extern bool (*FStar_UInt128_op_Equals_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +extern bool +(*FStar_UInt128_op_Greater_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +extern bool (*FStar_UInt128_op_Less_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +extern bool +(*FStar_UInt128_op_Greater_Equals_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +extern bool +(*FStar_UInt128_op_Less_Equals_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +FStar_UInt128_uint128 FStar_UInt128_mul32(uint64_t x, uint32_t y); + +FStar_UInt128_uint128 FStar_UInt128_mul_wide(uint64_t x, uint64_t y); + +#define __FStar_UInt128_H_DEFINED +#endif diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlib/FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlib/FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8.h new file mode 100644 index 000000000..21560c4a5 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlib/FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8.h @@ -0,0 +1,280 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +/* This file was generated by KreMLin + * KreMLin invocation: ../krml -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrB9w -minimal -fparentheses -fcurly-braces -fno-shadow -header copyright-header.txt -minimal -tmpdir dist/minimal -skip-compilation -extract-uints -add-include -add-include -add-include "kremlin/internal/compat.h" -add-include "kremlin/internal/types.h" -bundle FStar.UInt64+FStar.UInt32+FStar.UInt16+FStar.UInt8=* extracted/prims.krml extracted/FStar_Pervasives_Native.krml extracted/FStar_Pervasives.krml extracted/FStar_Mul.krml extracted/FStar_Squash.krml extracted/FStar_Classical.krml extracted/FStar_StrongExcludedMiddle.krml extracted/FStar_FunctionalExtensionality.krml extracted/FStar_List_Tot_Base.krml extracted/FStar_List_Tot_Properties.krml extracted/FStar_List_Tot.krml extracted/FStar_Seq_Base.krml extracted/FStar_Seq_Properties.krml extracted/FStar_Seq.krml extracted/FStar_Math_Lib.krml extracted/FStar_Math_Lemmas.krml extracted/FStar_BitVector.krml extracted/FStar_UInt.krml extracted/FStar_UInt32.krml extracted/FStar_Int.krml extracted/FStar_Int16.krml extracted/FStar_Preorder.krml extracted/FStar_Ghost.krml extracted/FStar_ErasedLogic.krml extracted/FStar_UInt64.krml extracted/FStar_Set.krml extracted/FStar_PropositionalExtensionality.krml extracted/FStar_PredicateExtensionality.krml extracted/FStar_TSet.krml extracted/FStar_Monotonic_Heap.krml extracted/FStar_Heap.krml extracted/FStar_Map.krml extracted/FStar_Monotonic_HyperHeap.krml extracted/FStar_Monotonic_HyperStack.krml extracted/FStar_HyperStack.krml extracted/FStar_Monotonic_Witnessed.krml extracted/FStar_HyperStack_ST.krml extracted/FStar_HyperStack_All.krml extracted/FStar_Date.krml extracted/FStar_Universe.krml extracted/FStar_GSet.krml extracted/FStar_ModifiesGen.krml extracted/LowStar_Monotonic_Buffer.krml extracted/LowStar_Buffer.krml extracted/Spec_Loops.krml extracted/LowStar_BufferOps.krml extracted/C_Loops.krml extracted/FStar_UInt8.krml extracted/FStar_Kremlin_Endianness.krml extracted/FStar_UInt63.krml extracted/FStar_Exn.krml extracted/FStar_ST.krml extracted/FStar_All.krml extracted/FStar_Dyn.krml extracted/FStar_Int63.krml extracted/FStar_Int64.krml extracted/FStar_Int32.krml extracted/FStar_Int8.krml extracted/FStar_UInt16.krml extracted/FStar_Int_Cast.krml extracted/FStar_UInt128.krml extracted/C_Endianness.krml extracted/FStar_List.krml extracted/FStar_Float.krml extracted/FStar_IO.krml extracted/C.krml extracted/FStar_Char.krml extracted/FStar_String.krml extracted/LowStar_Modifies.krml extracted/C_String.krml extracted/FStar_Bytes.krml extracted/FStar_HyperStack_IO.krml extracted/C_Failure.krml extracted/TestLib.krml extracted/FStar_Int_Cast_Full.krml + * F* version: 059db0c8 + * KreMLin version: 916c37ac + */ + + + +#ifndef __FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8_H +#define __FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8_H + + +#include +#include +#include "kremlin/internal/compat.h" +#include "kremlin/internal/types.h" + +extern Prims_int FStar_UInt64_n; + +extern Prims_int FStar_UInt64_v(uint64_t x0); + +extern uint64_t FStar_UInt64_uint_to_t(Prims_int x0); + +extern uint64_t FStar_UInt64_add(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_add_underspec(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_add_mod(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_sub(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_sub_underspec(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_sub_mod(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_mul(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_mul_underspec(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_mul_mod(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_mul_div(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_div(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_rem(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_logand(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_logxor(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_logor(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_lognot(uint64_t x0); + +extern uint64_t FStar_UInt64_shift_right(uint64_t x0, uint32_t x1); + +extern uint64_t FStar_UInt64_shift_left(uint64_t x0, uint32_t x1); + +extern bool FStar_UInt64_eq(uint64_t x0, uint64_t x1); + +extern bool FStar_UInt64_gt(uint64_t x0, uint64_t x1); + +extern bool FStar_UInt64_gte(uint64_t x0, uint64_t x1); + +extern bool FStar_UInt64_lt(uint64_t x0, uint64_t x1); + +extern bool FStar_UInt64_lte(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_minus(uint64_t x0); + +extern uint32_t FStar_UInt64_n_minus_one; + +uint64_t FStar_UInt64_eq_mask(uint64_t a, uint64_t b); + +uint64_t FStar_UInt64_gte_mask(uint64_t a, uint64_t b); + +extern Prims_string FStar_UInt64_to_string(uint64_t x0); + +extern uint64_t FStar_UInt64_of_string(Prims_string x0); + +extern Prims_int FStar_UInt32_n; + +extern Prims_int FStar_UInt32_v(uint32_t x0); + +extern uint32_t FStar_UInt32_uint_to_t(Prims_int x0); + +extern uint32_t FStar_UInt32_add(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_add_underspec(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_add_mod(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_sub(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_sub_underspec(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_sub_mod(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_mul(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_mul_underspec(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_mul_mod(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_mul_div(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_div(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_rem(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_logand(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_logxor(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_logor(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_lognot(uint32_t x0); + +extern uint32_t FStar_UInt32_shift_right(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_shift_left(uint32_t x0, uint32_t x1); + +extern bool FStar_UInt32_eq(uint32_t x0, uint32_t x1); + +extern bool FStar_UInt32_gt(uint32_t x0, uint32_t x1); + +extern bool FStar_UInt32_gte(uint32_t x0, uint32_t x1); + +extern bool FStar_UInt32_lt(uint32_t x0, uint32_t x1); + +extern bool FStar_UInt32_lte(uint32_t x0, uint32_t x1); + +extern uint32_t FStar_UInt32_minus(uint32_t x0); + +extern uint32_t FStar_UInt32_n_minus_one; + +uint32_t FStar_UInt32_eq_mask(uint32_t a, uint32_t b); + +uint32_t FStar_UInt32_gte_mask(uint32_t a, uint32_t b); + +extern Prims_string FStar_UInt32_to_string(uint32_t x0); + +extern uint32_t FStar_UInt32_of_string(Prims_string x0); + +extern Prims_int FStar_UInt16_n; + +extern Prims_int FStar_UInt16_v(uint16_t x0); + +extern uint16_t FStar_UInt16_uint_to_t(Prims_int x0); + +extern uint16_t FStar_UInt16_add(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_add_underspec(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_add_mod(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_sub(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_sub_underspec(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_sub_mod(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_mul(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_mul_underspec(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_mul_mod(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_mul_div(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_div(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_rem(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_logand(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_logxor(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_logor(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_lognot(uint16_t x0); + +extern uint16_t FStar_UInt16_shift_right(uint16_t x0, uint32_t x1); + +extern uint16_t FStar_UInt16_shift_left(uint16_t x0, uint32_t x1); + +extern bool FStar_UInt16_eq(uint16_t x0, uint16_t x1); + +extern bool FStar_UInt16_gt(uint16_t x0, uint16_t x1); + +extern bool FStar_UInt16_gte(uint16_t x0, uint16_t x1); + +extern bool FStar_UInt16_lt(uint16_t x0, uint16_t x1); + +extern bool FStar_UInt16_lte(uint16_t x0, uint16_t x1); + +extern uint16_t FStar_UInt16_minus(uint16_t x0); + +extern uint32_t FStar_UInt16_n_minus_one; + +uint16_t FStar_UInt16_eq_mask(uint16_t a, uint16_t b); + +uint16_t FStar_UInt16_gte_mask(uint16_t a, uint16_t b); + +extern Prims_string FStar_UInt16_to_string(uint16_t x0); + +extern uint16_t FStar_UInt16_of_string(Prims_string x0); + +extern Prims_int FStar_UInt8_n; + +extern Prims_int FStar_UInt8_v(uint8_t x0); + +extern uint8_t FStar_UInt8_uint_to_t(Prims_int x0); + +extern uint8_t FStar_UInt8_add(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_add_underspec(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_add_mod(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_sub(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_sub_underspec(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_sub_mod(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_mul(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_mul_underspec(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_mul_mod(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_mul_div(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_div(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_rem(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_logand(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_logxor(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_logor(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_lognot(uint8_t x0); + +extern uint8_t FStar_UInt8_shift_right(uint8_t x0, uint32_t x1); + +extern uint8_t FStar_UInt8_shift_left(uint8_t x0, uint32_t x1); + +extern bool FStar_UInt8_eq(uint8_t x0, uint8_t x1); + +extern bool FStar_UInt8_gt(uint8_t x0, uint8_t x1); + +extern bool FStar_UInt8_gte(uint8_t x0, uint8_t x1); + +extern bool FStar_UInt8_lt(uint8_t x0, uint8_t x1); + +extern bool FStar_UInt8_lte(uint8_t x0, uint8_t x1); + +extern uint8_t FStar_UInt8_minus(uint8_t x0); + +extern uint32_t FStar_UInt8_n_minus_one; + +uint8_t FStar_UInt8_eq_mask(uint8_t a, uint8_t b); + +uint8_t FStar_UInt8_gte_mask(uint8_t a, uint8_t b); + +extern Prims_string FStar_UInt8_to_string(uint8_t x0); + +extern uint8_t FStar_UInt8_of_string(Prims_string x0); + +typedef uint8_t FStar_UInt8_byte; + +#define __FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8_H_DEFINED +#endif diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/c_endianness.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/c_endianness.h new file mode 100644 index 000000000..5cfde5d9e --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/c_endianness.h @@ -0,0 +1,204 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +#ifndef __KREMLIN_ENDIAN_H +#define __KREMLIN_ENDIAN_H + +#include +#include + +/******************************************************************************/ +/* Implementing C.fst (part 2: endian-ness macros) */ +/******************************************************************************/ + +/* ... for Linux */ +#if defined(__linux__) || defined(__CYGWIN__) +# include + +/* ... for OSX */ +#elif defined(__APPLE__) +# include +# define htole64(x) OSSwapHostToLittleInt64(x) +# define le64toh(x) OSSwapLittleToHostInt64(x) +# define htobe64(x) OSSwapHostToBigInt64(x) +# define be64toh(x) OSSwapBigToHostInt64(x) + +# define htole16(x) OSSwapHostToLittleInt16(x) +# define le16toh(x) OSSwapLittleToHostInt16(x) +# define htobe16(x) OSSwapHostToBigInt16(x) +# define be16toh(x) OSSwapBigToHostInt16(x) + +# define htole32(x) OSSwapHostToLittleInt32(x) +# define le32toh(x) OSSwapLittleToHostInt32(x) +# define htobe32(x) OSSwapHostToBigInt32(x) +# define be32toh(x) OSSwapBigToHostInt32(x) + +/* ... for Solaris */ +#elif defined(__sun__) +# include +# define htole64(x) LE_64(x) +# define le64toh(x) LE_64(x) +# define htobe64(x) BE_64(x) +# define be64toh(x) BE_64(x) + +# define htole16(x) LE_16(x) +# define le16toh(x) LE_16(x) +# define htobe16(x) BE_16(x) +# define be16toh(x) BE_16(x) + +# define htole32(x) LE_32(x) +# define le32toh(x) LE_32(x) +# define htobe32(x) BE_32(x) +# define be32toh(x) BE_32(x) + +/* ... for the BSDs */ +#elif defined(__FreeBSD__) || defined(__NetBSD__) || defined(__DragonFly__) +# include +#elif defined(__OpenBSD__) +# include + +/* ... for Windows (MSVC)... not targeting XBOX 360! */ +#elif defined(_MSC_VER) + +# include +# define htobe16(x) _byteswap_ushort(x) +# define htole16(x) (x) +# define be16toh(x) _byteswap_ushort(x) +# define le16toh(x) (x) + +# define htobe32(x) _byteswap_ulong(x) +# define htole32(x) (x) +# define be32toh(x) _byteswap_ulong(x) +# define le32toh(x) (x) + +# define htobe64(x) _byteswap_uint64(x) +# define htole64(x) (x) +# define be64toh(x) _byteswap_uint64(x) +# define le64toh(x) (x) + +/* ... for Windows (GCC-like, e.g. mingw or clang) */ +#elif (defined(_WIN32) || defined(_WIN64)) && \ + (defined(__GNUC__) || defined(__clang__)) + +# define htobe16(x) __builtin_bswap16(x) +# define htole16(x) (x) +# define be16toh(x) __builtin_bswap16(x) +# define le16toh(x) (x) + +# define htobe32(x) __builtin_bswap32(x) +# define htole32(x) (x) +# define be32toh(x) __builtin_bswap32(x) +# define le32toh(x) (x) + +# define htobe64(x) __builtin_bswap64(x) +# define htole64(x) (x) +# define be64toh(x) __builtin_bswap64(x) +# define le64toh(x) (x) + +/* ... generic big-endian fallback code */ +#elif defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ + +/* byte swapping code inspired by: + * https://github.com/rweather/arduinolibs/blob/master/libraries/Crypto/utility/EndianUtil.h + * */ + +# define htobe32(x) (x) +# define be32toh(x) (x) +# define htole32(x) \ + (__extension__({ \ + uint32_t _temp = (x); \ + ((_temp >> 24) & 0x000000FF) | ((_temp >> 8) & 0x0000FF00) | \ + ((_temp << 8) & 0x00FF0000) | ((_temp << 24) & 0xFF000000); \ + })) +# define le32toh(x) (htole32((x))) + +# define htobe64(x) (x) +# define be64toh(x) (x) +# define htole64(x) \ + (__extension__({ \ + uint64_t __temp = (x); \ + uint32_t __low = htobe32((uint32_t)__temp); \ + uint32_t __high = htobe32((uint32_t)(__temp >> 32)); \ + (((uint64_t)__low) << 32) | __high; \ + })) +# define le64toh(x) (htole64((x))) + +/* ... generic little-endian fallback code */ +#elif defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ + +# define htole32(x) (x) +# define le32toh(x) (x) +# define htobe32(x) \ + (__extension__({ \ + uint32_t _temp = (x); \ + ((_temp >> 24) & 0x000000FF) | ((_temp >> 8) & 0x0000FF00) | \ + ((_temp << 8) & 0x00FF0000) | ((_temp << 24) & 0xFF000000); \ + })) +# define be32toh(x) (htobe32((x))) + +# define htole64(x) (x) +# define le64toh(x) (x) +# define htobe64(x) \ + (__extension__({ \ + uint64_t __temp = (x); \ + uint32_t __low = htobe32((uint32_t)__temp); \ + uint32_t __high = htobe32((uint32_t)(__temp >> 32)); \ + (((uint64_t)__low) << 32) | __high; \ + })) +# define be64toh(x) (htobe64((x))) + +/* ... couldn't determine endian-ness of the target platform */ +#else +# error "Please define __BYTE_ORDER__!" + +#endif /* defined(__linux__) || ... */ + +/* Loads and stores. These avoid undefined behavior due to unaligned memory + * accesses, via memcpy. */ + +inline static uint16_t load16(uint8_t *b) { + uint16_t x; + memcpy(&x, b, 2); + return x; +} + +inline static uint32_t load32(uint8_t *b) { + uint32_t x; + memcpy(&x, b, 4); + return x; +} + +inline static uint64_t load64(uint8_t *b) { + uint64_t x; + memcpy(&x, b, 8); + return x; +} + +inline static void store16(uint8_t *b, uint16_t i) { + memcpy(b, &i, 2); +} + +inline static void store32(uint8_t *b, uint32_t i) { + memcpy(b, &i, 4); +} + +inline static void store64(uint8_t *b, uint64_t i) { + memcpy(b, &i, 8); +} + +#define load16_le(b) (le16toh(load16(b))) +#define store16_le(b, i) (store16(b, htole16(i))) +#define load16_be(b) (be16toh(load16(b))) +#define store16_be(b, i) (store16(b, htobe16(i))) + +#define load32_le(b) (le32toh(load32(b))) +#define store32_le(b, i) (store32(b, htole32(i))) +#define load32_be(b) (be32toh(load32(b))) +#define store32_be(b, i) (store32(b, htobe32(i))) + +#define load64_le(b) (le64toh(load64(b))) +#define store64_le(b, i) (store64(b, htole64(i))) +#define load64_be(b) (be64toh(load64(b))) +#define store64_be(b, i) (store64(b, htobe64(i))) + +#endif diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/builtin.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/builtin.h new file mode 100644 index 000000000..219b26686 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/builtin.h @@ -0,0 +1,16 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +#ifndef __KREMLIN_BUILTIN_H +#define __KREMLIN_BUILTIN_H + +/* For alloca, when using KreMLin's -falloca */ +#if (defined(_WIN32) || defined(_WIN64)) +# include +#endif + +/* If some globals need to be initialized before the main, then kremlin will + * generate and try to link last a function with this type: */ +void kremlinit_globals(void); + +#endif diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/callconv.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/callconv.h new file mode 100644 index 000000000..bf631ff46 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/callconv.h @@ -0,0 +1,46 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +#ifndef __KREMLIN_CALLCONV_H +#define __KREMLIN_CALLCONV_H + +/******************************************************************************/ +/* Some macros to ease compatibility */ +/******************************************************************************/ + +/* We want to generate __cdecl safely without worrying about it being undefined. + * When using MSVC, these are always defined. When using MinGW, these are + * defined too. They have no meaning for other platforms, so we define them to + * be empty macros in other situations. */ +#ifndef _MSC_VER +#ifndef __cdecl +#define __cdecl +#endif +#ifndef __stdcall +#define __stdcall +#endif +#ifndef __fastcall +#define __fastcall +#endif +#endif + +/* Since KreMLin emits the inline keyword unconditionally, we follow the + * guidelines at https://gcc.gnu.org/onlinedocs/gcc/Inline.html and make this + * __inline__ to ensure the code compiles with -std=c90 and earlier. */ +#ifdef __GNUC__ +# define inline __inline__ +#endif + +/* GCC-specific attribute syntax; everyone else gets the standard C inline + * attribute. */ +#ifdef __GNU_C__ +# ifndef __clang__ +# define force_inline inline __attribute__((always_inline)) +# else +# define force_inline inline +# endif +#else +# define force_inline inline +#endif + +#endif diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/compat.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/compat.h new file mode 100644 index 000000000..a5b8889da --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/compat.h @@ -0,0 +1,34 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +#ifndef KRML_COMPAT_H +#define KRML_COMPAT_H + +#include + +/* A series of macros that define C implementations of types that are not Low*, + * to facilitate porting programs to Low*. */ + +typedef const char *Prims_string; + +typedef struct { + uint32_t length; + const char *data; +} FStar_Bytes_bytes; + +typedef int32_t Prims_pos, Prims_nat, Prims_nonzero, Prims_int, + krml_checked_int_t; + +#define RETURN_OR(x) \ + do { \ + int64_t __ret = x; \ + if (__ret < INT32_MIN || INT32_MAX < __ret) { \ + KRML_HOST_PRINTF( \ + "Prims.{int,nat,pos} integer overflow at %s:%d\n", __FILE__, \ + __LINE__); \ + KRML_HOST_EXIT(252); \ + } \ + return (int32_t)__ret; \ + } while (0) + +#endif diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/debug.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/debug.h new file mode 100644 index 000000000..44ac22cd6 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/debug.h @@ -0,0 +1,57 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +#ifndef __KREMLIN_DEBUG_H +#define __KREMLIN_DEBUG_H + +#include + +#include "kremlin/internal/target.h" + +/******************************************************************************/ +/* Debugging helpers - intended only for KreMLin developers */ +/******************************************************************************/ + +/* In support of "-wasm -d force-c": we might need this function to be + * forward-declared, because the dependency on WasmSupport appears very late, + * after SimplifyWasm, and sadly, after the topological order has been done. */ +void WasmSupport_check_buffer_size(uint32_t s); + +/* A series of GCC atrocities to trace function calls (kremlin's [-d c-calls] + * option). Useful when trying to debug, say, Wasm, to compare traces. */ +/* clang-format off */ +#ifdef __GNUC__ +#define KRML_FORMAT(X) _Generic((X), \ + uint8_t : "0x%08" PRIx8, \ + uint16_t: "0x%08" PRIx16, \ + uint32_t: "0x%08" PRIx32, \ + uint64_t: "0x%08" PRIx64, \ + int8_t : "0x%08" PRIx8, \ + int16_t : "0x%08" PRIx16, \ + int32_t : "0x%08" PRIx32, \ + int64_t : "0x%08" PRIx64, \ + default : "%s") + +#define KRML_FORMAT_ARG(X) _Generic((X), \ + uint8_t : X, \ + uint16_t: X, \ + uint32_t: X, \ + uint64_t: X, \ + int8_t : X, \ + int16_t : X, \ + int32_t : X, \ + int64_t : X, \ + default : "unknown") +/* clang-format on */ + +# define KRML_DEBUG_RETURN(X) \ + ({ \ + __auto_type _ret = (X); \ + KRML_HOST_PRINTF("returning: "); \ + KRML_HOST_PRINTF(KRML_FORMAT(_ret), KRML_FORMAT_ARG(_ret)); \ + KRML_HOST_PRINTF(" \n"); \ + _ret; \ + }) +#endif + +#endif diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/target.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/target.h new file mode 100644 index 000000000..b552f52b0 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/target.h @@ -0,0 +1,102 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +#ifndef __KREMLIN_TARGET_H +#define __KREMLIN_TARGET_H + +#include +#include +#include +#include +#include + +#include "kremlin/internal/callconv.h" + +/******************************************************************************/ +/* Macros that KreMLin will generate. */ +/******************************************************************************/ + +/* For "bare" targets that do not have a C stdlib, the user might want to use + * [-add-early-include '"mydefinitions.h"'] and override these. */ +#ifndef KRML_HOST_PRINTF +# define KRML_HOST_PRINTF printf +#endif + +#if ( \ + (defined __STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) && \ + (!(defined KRML_HOST_EPRINTF))) +# define KRML_HOST_EPRINTF(...) fprintf(stderr, __VA_ARGS__) +#endif + +#ifndef KRML_HOST_EXIT +# define KRML_HOST_EXIT exit +#endif + +#ifndef KRML_HOST_MALLOC +# define KRML_HOST_MALLOC malloc +#endif + +#ifndef KRML_HOST_CALLOC +# define KRML_HOST_CALLOC calloc +#endif + +#ifndef KRML_HOST_FREE +# define KRML_HOST_FREE free +#endif + +#ifndef KRML_HOST_TIME + +# include + +/* Prims_nat not yet in scope */ +inline static int32_t krml_time() { + return (int32_t)time(NULL); +} + +# define KRML_HOST_TIME krml_time +#endif + +/* In statement position, exiting is easy. */ +#define KRML_EXIT \ + do { \ + KRML_HOST_PRINTF("Unimplemented function at %s:%d\n", __FILE__, __LINE__); \ + KRML_HOST_EXIT(254); \ + } while (0) + +/* In expression position, use the comma-operator and a malloc to return an + * expression of the right size. KreMLin passes t as the parameter to the macro. + */ +#define KRML_EABORT(t, msg) \ + (KRML_HOST_PRINTF("KreMLin abort at %s:%d\n%s\n", __FILE__, __LINE__, msg), \ + KRML_HOST_EXIT(255), *((t *)KRML_HOST_MALLOC(sizeof(t)))) + +/* In FStar.Buffer.fst, the size of arrays is uint32_t, but it's a number of + * *elements*. Do an ugly, run-time check (some of which KreMLin can eliminate). + */ + +#ifdef __GNUC__ +# define _KRML_CHECK_SIZE_PRAGMA \ + _Pragma("GCC diagnostic ignored \"-Wtype-limits\"") +#else +# define _KRML_CHECK_SIZE_PRAGMA +#endif + +#define KRML_CHECK_SIZE(size_elt, sz) \ + do { \ + _KRML_CHECK_SIZE_PRAGMA \ + if (((size_t)(sz)) > ((size_t)(SIZE_MAX / (size_elt)))) { \ + KRML_HOST_PRINTF( \ + "Maximum allocatable size exceeded, aborting before overflow at " \ + "%s:%d\n", \ + __FILE__, __LINE__); \ + KRML_HOST_EXIT(253); \ + } \ + } while (0) + +#if defined(_MSC_VER) && _MSC_VER < 1900 +# define KRML_HOST_SNPRINTF(buf, sz, fmt, arg) _snprintf_s(buf, sz, _TRUNCATE, fmt, arg) +#else +# define KRML_HOST_SNPRINTF(buf, sz, fmt, arg) snprintf(buf, sz, fmt, arg) +#endif + +#endif diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/types.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/types.h new file mode 100644 index 000000000..b936f00db --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/types.h @@ -0,0 +1,61 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +#ifndef KRML_TYPES_H +#define KRML_TYPES_H + +#include +#include +#include + +/* Types which are either abstract, meaning that have to be implemented in C, or + * which are models, meaning that they are swapped out at compile-time for + * hand-written C types (in which case they're marked as noextract). */ + +typedef uint64_t FStar_UInt64_t, FStar_UInt64_t_; +typedef int64_t FStar_Int64_t, FStar_Int64_t_; +typedef uint32_t FStar_UInt32_t, FStar_UInt32_t_; +typedef int32_t FStar_Int32_t, FStar_Int32_t_; +typedef uint16_t FStar_UInt16_t, FStar_UInt16_t_; +typedef int16_t FStar_Int16_t, FStar_Int16_t_; +typedef uint8_t FStar_UInt8_t, FStar_UInt8_t_; +typedef int8_t FStar_Int8_t, FStar_Int8_t_; + +/* Only useful when building Kremlib, because it's in the dependency graph of + * FStar.Int.Cast. */ +typedef uint64_t FStar_UInt63_t, FStar_UInt63_t_; +typedef int64_t FStar_Int63_t, FStar_Int63_t_; + +typedef double FStar_Float_float; +typedef uint32_t FStar_Char_char; +typedef FILE *FStar_IO_fd_read, *FStar_IO_fd_write; + +typedef void *FStar_Dyn_dyn; + +typedef const char *C_String_t, *C_String_t_; + +typedef int exit_code; +typedef FILE *channel; + +typedef unsigned long long TestLib_cycles; + +typedef uint64_t FStar_Date_dateTime, FStar_Date_timeSpan; + +/* The uint128 type is a special case since we offer several implementations of + * it, depending on the compiler and whether the user wants the verified + * implementation or not. */ +#if !defined(KRML_VERIFIED_UINT128) && defined(_MSC_VER) && defined(_M_X64) +# include +typedef __m128i FStar_UInt128_uint128; +#elif !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) +typedef unsigned __int128 FStar_UInt128_uint128; +#else +typedef struct FStar_UInt128_uint128_s { + uint64_t low; + uint64_t high; +} FStar_UInt128_uint128; +#endif + +typedef FStar_UInt128_uint128 FStar_UInt128_t, FStar_UInt128_t_, uint128_t; + +#endif diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/wasmsupport.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/wasmsupport.h new file mode 100644 index 000000000..b44fa3f75 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/kremlin/internal/wasmsupport.h @@ -0,0 +1,5 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +/* This file is automatically included when compiling with -wasm -d force-c */ +#define WasmSupport_check_buffer_size(X) diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/vs2010/Hacl_Curve25519.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/vs2010/Hacl_Curve25519.h new file mode 100644 index 000000000..27ebe0794 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/vs2010/Hacl_Curve25519.h @@ -0,0 +1,21 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +/* This file was generated by KreMLin + * KreMLin invocation: /mnt/e/everest/verify/kremlin/krml -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -I /mnt/e/everest/verify/hacl-star/code/lib/kremlin -I /mnt/e/everest/verify/kremlin/kremlib/compat -I /mnt/e/everest/verify/hacl-star/specs -I /mnt/e/everest/verify/hacl-star/specs/old -I . -ccopt -march=native -verbose -ldopt -flto -tmpdir x25519-c -I ../bignum -bundle Hacl.Curve25519=* -minimal -add-include "kremlib.h" -skip-compilation x25519-c/out.krml -o x25519-c/Hacl_Curve25519.c + * F* version: 059db0c8 + * KreMLin version: 916c37ac + */ + + + +#ifndef __Hacl_Curve25519_H +#define __Hacl_Curve25519_H + + +#include "kremlib.h" + +void Hacl_Curve25519_crypto_scalarmult(uint8_t *mypublic, uint8_t *secret, uint8_t *basepoint); + +#define __Hacl_Curve25519_H_DEFINED +#endif diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/vs2010/inttypes.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/vs2010/inttypes.h new file mode 100644 index 000000000..d53f87f21 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/vs2010/inttypes.h @@ -0,0 +1,36 @@ +/* + * Custom inttypes.h for VS2010 KreMLin requires these definitions, + * but VS2010 doesn't provide them. + * + * Copyright 2016-2018 INRIA and Microsoft Corporation + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * This file is part of mbed TLS (https://tls.mbed.org) + */ + +#ifndef _INTTYPES_H_VS2010 +#define _INTTYPES_H_VS2010 + +#include + +#ifdef _MSC_VER +#define inline __inline +#endif + +/* VS2010 unsigned long == 8 bytes */ + +#define PRIu64 "I64u" + +#endif diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/vs2010/stdbool.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/vs2010/stdbool.h new file mode 100644 index 000000000..5b7039c4f --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/vs2010/stdbool.h @@ -0,0 +1,31 @@ +/* + * Custom stdbool.h for VS2010 KreMLin requires these definitions, + * but VS2010 doesn't provide them. + * + * Copyright 2016-2018 INRIA and Microsoft Corporation + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * This file is part of mbed TLS (https://tls.mbed.org) + */ + +#ifndef _STDBOOL_H_VS2010 +#define _STDBOOL_H_VS2010 + +typedef int bool; + +static bool true = 1; +static bool false = 0; + +#endif diff --git a/third_party/mbedtls/repo/3rdparty/everest/include/everest/x25519.h b/third_party/mbedtls/repo/3rdparty/everest/include/everest/x25519.h new file mode 100644 index 000000000..7a973dcf0 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/include/everest/x25519.h @@ -0,0 +1,190 @@ +/* + * ECDH with curve-optimized implementation multiplexing + * + * Copyright 2016-2018 INRIA and Microsoft Corporation + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * This file is part of mbed TLS (https://tls.mbed.org) + */ + +#ifndef MBEDTLS_X25519_H +#define MBEDTLS_X25519_H + +#ifdef __cplusplus +extern "C" { +#endif + +#define MBEDTLS_ECP_TLS_CURVE25519 0x1d +#define MBEDTLS_X25519_KEY_SIZE_BYTES 32 + +/** + * Defines the source of the imported EC key. + */ +typedef enum +{ + MBEDTLS_X25519_ECDH_OURS, /**< Our key. */ + MBEDTLS_X25519_ECDH_THEIRS, /**< The key of the peer. */ +} mbedtls_x25519_ecdh_side; + +/** + * \brief The x25519 context structure. + */ +typedef struct +{ + unsigned char our_secret[MBEDTLS_X25519_KEY_SIZE_BYTES]; + unsigned char peer_point[MBEDTLS_X25519_KEY_SIZE_BYTES]; +} mbedtls_x25519_context; + +/** + * \brief This function initializes an x25519 context. + * + * \param ctx The x25519 context to initialize. + */ +void mbedtls_x25519_init( mbedtls_x25519_context *ctx ); + +/** + * \brief This function frees a context. + * + * \param ctx The context to free. + */ +void mbedtls_x25519_free( mbedtls_x25519_context *ctx ); + +/** + * \brief This function generates a public key and a TLS + * ServerKeyExchange payload. + * + * This is the first function used by a TLS server for x25519. + * + * + * \param ctx The x25519 context. + * \param olen The number of characters written. + * \param buf The destination buffer. + * \param blen The length of the destination buffer. + * \param f_rng The RNG function. + * \param p_rng The RNG context. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_x25519_make_params( mbedtls_x25519_context *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int( *f_rng )(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function parses and processes a TLS ServerKeyExchange + * payload. + * + * + * \param ctx The x25519 context. + * \param buf The pointer to the start of the input buffer. + * \param end The address for one Byte past the end of the buffer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + * + */ +int mbedtls_x25519_read_params( mbedtls_x25519_context *ctx, + const unsigned char **buf, const unsigned char *end ); + +/** + * \brief This function sets up an x25519 context from an EC key. + * + * It is used by clients and servers in place of the + * ServerKeyEchange for static ECDH, and imports ECDH + * parameters from the EC key information of a certificate. + * + * \see ecp.h + * + * \param ctx The x25519 context to set up. + * \param key The EC key to use. + * \param side Defines the source of the key: 1: Our key, or + * 0: The key of the peer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + * + */ +int mbedtls_x25519_get_params( mbedtls_x25519_context *ctx, const mbedtls_ecp_keypair *key, + mbedtls_x25519_ecdh_side side ); + +/** + * \brief This function derives and exports the shared secret. + * + * This is the last function used by both TLS client + * and servers. + * + * + * \param ctx The x25519 context. + * \param olen The number of Bytes written. + * \param buf The destination buffer. + * \param blen The length of the destination buffer. + * \param f_rng The RNG function. + * \param p_rng The RNG context. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_x25519_calc_secret( mbedtls_x25519_context *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int( *f_rng )(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function generates a public key and a TLS + * ClientKeyExchange payload. + * + * This is the second function used by a TLS client for x25519. + * + * \see ecp.h + * + * \param ctx The x25519 context. + * \param olen The number of Bytes written. + * \param buf The destination buffer. + * \param blen The size of the destination buffer. + * \param f_rng The RNG function. + * \param p_rng The RNG context. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_x25519_make_public( mbedtls_x25519_context *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int( *f_rng )(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function parses and processes a TLS ClientKeyExchange + * payload. + * + * This is the second function used by a TLS server for x25519. + * + * \see ecp.h + * + * \param ctx The x25519 context. + * \param buf The start of the input buffer. + * \param blen The length of the input buffer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_x25519_read_public( mbedtls_x25519_context *ctx, + const unsigned char *buf, size_t blen ); + +#ifdef __cplusplus +} +#endif + +#endif /* x25519.h */ diff --git a/third_party/mbedtls/repo/3rdparty/everest/library/Hacl_Curve25519.c b/third_party/mbedtls/repo/3rdparty/everest/library/Hacl_Curve25519.c new file mode 100644 index 000000000..450b9f8dd --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/library/Hacl_Curve25519.c @@ -0,0 +1,760 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +/* This file was generated by KreMLin + * KreMLin invocation: /mnt/e/everest/verify/kremlin/krml -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -fbuiltin-uint128 -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -I /mnt/e/everest/verify/hacl-star/code/lib/kremlin -I /mnt/e/everest/verify/kremlin/kremlib/compat -I /mnt/e/everest/verify/hacl-star/specs -I /mnt/e/everest/verify/hacl-star/specs/old -I . -ccopt -march=native -verbose -ldopt -flto -tmpdir x25519-c -I ../bignum -bundle Hacl.Curve25519=* -minimal -add-include "kremlib.h" -skip-compilation x25519-c/out.krml -o x25519-c/Hacl_Curve25519.c + * F* version: 059db0c8 + * KreMLin version: 916c37ac + */ + + +#include "Hacl_Curve25519.h" + +extern uint64_t FStar_UInt64_eq_mask(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_gte_mask(uint64_t x0, uint64_t x1); + +extern uint128_t FStar_UInt128_add(uint128_t x0, uint128_t x1); + +extern uint128_t FStar_UInt128_add_mod(uint128_t x0, uint128_t x1); + +extern uint128_t FStar_UInt128_logand(uint128_t x0, uint128_t x1); + +extern uint128_t FStar_UInt128_shift_right(uint128_t x0, uint32_t x1); + +extern uint128_t FStar_UInt128_uint64_to_uint128(uint64_t x0); + +extern uint64_t FStar_UInt128_uint128_to_uint64(uint128_t x0); + +extern uint128_t FStar_UInt128_mul_wide(uint64_t x0, uint64_t x1); + +static void Hacl_Bignum_Modulo_carry_top(uint64_t *b) +{ + uint64_t b4 = b[4U]; + uint64_t b0 = b[0U]; + uint64_t b4_ = b4 & (uint64_t)0x7ffffffffffffU; + uint64_t b0_ = b0 + (uint64_t)19U * (b4 >> (uint32_t)51U); + b[4U] = b4_; + b[0U] = b0_; +} + +inline static void Hacl_Bignum_Fproduct_copy_from_wide_(uint64_t *output, uint128_t *input) +{ + uint32_t i; + for (i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U) + { + uint128_t xi = input[i]; + output[i] = (uint64_t)xi; + } +} + +inline static void +Hacl_Bignum_Fproduct_sum_scalar_multiplication_(uint128_t *output, uint64_t *input, uint64_t s) +{ + uint32_t i; + for (i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U) + { + uint128_t xi = output[i]; + uint64_t yi = input[i]; + output[i] = xi + (uint128_t)yi * s; + } +} + +inline static void Hacl_Bignum_Fproduct_carry_wide_(uint128_t *tmp) +{ + uint32_t i; + for (i = (uint32_t)0U; i < (uint32_t)4U; i = i + (uint32_t)1U) + { + uint32_t ctr = i; + uint128_t tctr = tmp[ctr]; + uint128_t tctrp1 = tmp[ctr + (uint32_t)1U]; + uint64_t r0 = (uint64_t)tctr & (uint64_t)0x7ffffffffffffU; + uint128_t c = tctr >> (uint32_t)51U; + tmp[ctr] = (uint128_t)r0; + tmp[ctr + (uint32_t)1U] = tctrp1 + c; + } +} + +inline static void Hacl_Bignum_Fmul_shift_reduce(uint64_t *output) +{ + uint64_t tmp = output[4U]; + uint64_t b0; + { + uint32_t i; + for (i = (uint32_t)0U; i < (uint32_t)4U; i = i + (uint32_t)1U) + { + uint32_t ctr = (uint32_t)5U - i - (uint32_t)1U; + uint64_t z = output[ctr - (uint32_t)1U]; + output[ctr] = z; + } + } + output[0U] = tmp; + b0 = output[0U]; + output[0U] = (uint64_t)19U * b0; +} + +static void +Hacl_Bignum_Fmul_mul_shift_reduce_(uint128_t *output, uint64_t *input, uint64_t *input2) +{ + uint32_t i; + uint64_t input2i; + { + uint32_t i0; + for (i0 = (uint32_t)0U; i0 < (uint32_t)4U; i0 = i0 + (uint32_t)1U) + { + uint64_t input2i0 = input2[i0]; + Hacl_Bignum_Fproduct_sum_scalar_multiplication_(output, input, input2i0); + Hacl_Bignum_Fmul_shift_reduce(input); + } + } + i = (uint32_t)4U; + input2i = input2[i]; + Hacl_Bignum_Fproduct_sum_scalar_multiplication_(output, input, input2i); +} + +inline static void Hacl_Bignum_Fmul_fmul(uint64_t *output, uint64_t *input, uint64_t *input2) +{ + uint64_t tmp[5U] = { 0U }; + memcpy(tmp, input, (uint32_t)5U * sizeof input[0U]); + KRML_CHECK_SIZE(sizeof (uint128_t), (uint32_t)5U); + { + uint128_t t[5U]; + { + uint32_t _i; + for (_i = 0U; _i < (uint32_t)5U; ++_i) + t[_i] = (uint128_t)(uint64_t)0U; + } + { + uint128_t b4; + uint128_t b0; + uint128_t b4_; + uint128_t b0_; + uint64_t i0; + uint64_t i1; + uint64_t i0_; + uint64_t i1_; + Hacl_Bignum_Fmul_mul_shift_reduce_(t, tmp, input2); + Hacl_Bignum_Fproduct_carry_wide_(t); + b4 = t[4U]; + b0 = t[0U]; + b4_ = b4 & (uint128_t)(uint64_t)0x7ffffffffffffU; + b0_ = b0 + (uint128_t)(uint64_t)19U * (uint64_t)(b4 >> (uint32_t)51U); + t[4U] = b4_; + t[0U] = b0_; + Hacl_Bignum_Fproduct_copy_from_wide_(output, t); + i0 = output[0U]; + i1 = output[1U]; + i0_ = i0 & (uint64_t)0x7ffffffffffffU; + i1_ = i1 + (i0 >> (uint32_t)51U); + output[0U] = i0_; + output[1U] = i1_; + } + } +} + +inline static void Hacl_Bignum_Fsquare_fsquare__(uint128_t *tmp, uint64_t *output) +{ + uint64_t r0 = output[0U]; + uint64_t r1 = output[1U]; + uint64_t r2 = output[2U]; + uint64_t r3 = output[3U]; + uint64_t r4 = output[4U]; + uint64_t d0 = r0 * (uint64_t)2U; + uint64_t d1 = r1 * (uint64_t)2U; + uint64_t d2 = r2 * (uint64_t)2U * (uint64_t)19U; + uint64_t d419 = r4 * (uint64_t)19U; + uint64_t d4 = d419 * (uint64_t)2U; + uint128_t s0 = (uint128_t)r0 * r0 + (uint128_t)d4 * r1 + (uint128_t)d2 * r3; + uint128_t s1 = (uint128_t)d0 * r1 + (uint128_t)d4 * r2 + (uint128_t)(r3 * (uint64_t)19U) * r3; + uint128_t s2 = (uint128_t)d0 * r2 + (uint128_t)r1 * r1 + (uint128_t)d4 * r3; + uint128_t s3 = (uint128_t)d0 * r3 + (uint128_t)d1 * r2 + (uint128_t)r4 * d419; + uint128_t s4 = (uint128_t)d0 * r4 + (uint128_t)d1 * r3 + (uint128_t)r2 * r2; + tmp[0U] = s0; + tmp[1U] = s1; + tmp[2U] = s2; + tmp[3U] = s3; + tmp[4U] = s4; +} + +inline static void Hacl_Bignum_Fsquare_fsquare_(uint128_t *tmp, uint64_t *output) +{ + uint128_t b4; + uint128_t b0; + uint128_t b4_; + uint128_t b0_; + uint64_t i0; + uint64_t i1; + uint64_t i0_; + uint64_t i1_; + Hacl_Bignum_Fsquare_fsquare__(tmp, output); + Hacl_Bignum_Fproduct_carry_wide_(tmp); + b4 = tmp[4U]; + b0 = tmp[0U]; + b4_ = b4 & (uint128_t)(uint64_t)0x7ffffffffffffU; + b0_ = b0 + (uint128_t)(uint64_t)19U * (uint64_t)(b4 >> (uint32_t)51U); + tmp[4U] = b4_; + tmp[0U] = b0_; + Hacl_Bignum_Fproduct_copy_from_wide_(output, tmp); + i0 = output[0U]; + i1 = output[1U]; + i0_ = i0 & (uint64_t)0x7ffffffffffffU; + i1_ = i1 + (i0 >> (uint32_t)51U); + output[0U] = i0_; + output[1U] = i1_; +} + +static void +Hacl_Bignum_Fsquare_fsquare_times_(uint64_t *input, uint128_t *tmp, uint32_t count1) +{ + uint32_t i; + Hacl_Bignum_Fsquare_fsquare_(tmp, input); + for (i = (uint32_t)1U; i < count1; i = i + (uint32_t)1U) + Hacl_Bignum_Fsquare_fsquare_(tmp, input); +} + +inline static void +Hacl_Bignum_Fsquare_fsquare_times(uint64_t *output, uint64_t *input, uint32_t count1) +{ + KRML_CHECK_SIZE(sizeof (uint128_t), (uint32_t)5U); + { + uint128_t t[5U]; + { + uint32_t _i; + for (_i = 0U; _i < (uint32_t)5U; ++_i) + t[_i] = (uint128_t)(uint64_t)0U; + } + memcpy(output, input, (uint32_t)5U * sizeof input[0U]); + Hacl_Bignum_Fsquare_fsquare_times_(output, t, count1); + } +} + +inline static void Hacl_Bignum_Fsquare_fsquare_times_inplace(uint64_t *output, uint32_t count1) +{ + KRML_CHECK_SIZE(sizeof (uint128_t), (uint32_t)5U); + { + uint128_t t[5U]; + { + uint32_t _i; + for (_i = 0U; _i < (uint32_t)5U; ++_i) + t[_i] = (uint128_t)(uint64_t)0U; + } + Hacl_Bignum_Fsquare_fsquare_times_(output, t, count1); + } +} + +inline static void Hacl_Bignum_Crecip_crecip(uint64_t *out, uint64_t *z) +{ + uint64_t buf[20U] = { 0U }; + uint64_t *a0 = buf; + uint64_t *t00 = buf + (uint32_t)5U; + uint64_t *b0 = buf + (uint32_t)10U; + uint64_t *t01; + uint64_t *b1; + uint64_t *c0; + uint64_t *a; + uint64_t *t0; + uint64_t *b; + uint64_t *c; + Hacl_Bignum_Fsquare_fsquare_times(a0, z, (uint32_t)1U); + Hacl_Bignum_Fsquare_fsquare_times(t00, a0, (uint32_t)2U); + Hacl_Bignum_Fmul_fmul(b0, t00, z); + Hacl_Bignum_Fmul_fmul(a0, b0, a0); + Hacl_Bignum_Fsquare_fsquare_times(t00, a0, (uint32_t)1U); + Hacl_Bignum_Fmul_fmul(b0, t00, b0); + Hacl_Bignum_Fsquare_fsquare_times(t00, b0, (uint32_t)5U); + t01 = buf + (uint32_t)5U; + b1 = buf + (uint32_t)10U; + c0 = buf + (uint32_t)15U; + Hacl_Bignum_Fmul_fmul(b1, t01, b1); + Hacl_Bignum_Fsquare_fsquare_times(t01, b1, (uint32_t)10U); + Hacl_Bignum_Fmul_fmul(c0, t01, b1); + Hacl_Bignum_Fsquare_fsquare_times(t01, c0, (uint32_t)20U); + Hacl_Bignum_Fmul_fmul(t01, t01, c0); + Hacl_Bignum_Fsquare_fsquare_times_inplace(t01, (uint32_t)10U); + Hacl_Bignum_Fmul_fmul(b1, t01, b1); + Hacl_Bignum_Fsquare_fsquare_times(t01, b1, (uint32_t)50U); + a = buf; + t0 = buf + (uint32_t)5U; + b = buf + (uint32_t)10U; + c = buf + (uint32_t)15U; + Hacl_Bignum_Fmul_fmul(c, t0, b); + Hacl_Bignum_Fsquare_fsquare_times(t0, c, (uint32_t)100U); + Hacl_Bignum_Fmul_fmul(t0, t0, c); + Hacl_Bignum_Fsquare_fsquare_times_inplace(t0, (uint32_t)50U); + Hacl_Bignum_Fmul_fmul(t0, t0, b); + Hacl_Bignum_Fsquare_fsquare_times_inplace(t0, (uint32_t)5U); + Hacl_Bignum_Fmul_fmul(out, t0, a); +} + +inline static void Hacl_Bignum_fsum(uint64_t *a, uint64_t *b) +{ + uint32_t i; + for (i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U) + { + uint64_t xi = a[i]; + uint64_t yi = b[i]; + a[i] = xi + yi; + } +} + +inline static void Hacl_Bignum_fdifference(uint64_t *a, uint64_t *b) +{ + uint64_t tmp[5U] = { 0U }; + uint64_t b0; + uint64_t b1; + uint64_t b2; + uint64_t b3; + uint64_t b4; + memcpy(tmp, b, (uint32_t)5U * sizeof b[0U]); + b0 = tmp[0U]; + b1 = tmp[1U]; + b2 = tmp[2U]; + b3 = tmp[3U]; + b4 = tmp[4U]; + tmp[0U] = b0 + (uint64_t)0x3fffffffffff68U; + tmp[1U] = b1 + (uint64_t)0x3ffffffffffff8U; + tmp[2U] = b2 + (uint64_t)0x3ffffffffffff8U; + tmp[3U] = b3 + (uint64_t)0x3ffffffffffff8U; + tmp[4U] = b4 + (uint64_t)0x3ffffffffffff8U; + { + uint32_t i; + for (i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U) + { + uint64_t xi = a[i]; + uint64_t yi = tmp[i]; + a[i] = yi - xi; + } + } +} + +inline static void Hacl_Bignum_fscalar(uint64_t *output, uint64_t *b, uint64_t s) +{ + KRML_CHECK_SIZE(sizeof (uint128_t), (uint32_t)5U); + { + uint128_t tmp[5U]; + { + uint32_t _i; + for (_i = 0U; _i < (uint32_t)5U; ++_i) + tmp[_i] = (uint128_t)(uint64_t)0U; + } + { + uint128_t b4; + uint128_t b0; + uint128_t b4_; + uint128_t b0_; + { + uint32_t i; + for (i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U) + { + uint64_t xi = b[i]; + tmp[i] = (uint128_t)xi * s; + } + } + Hacl_Bignum_Fproduct_carry_wide_(tmp); + b4 = tmp[4U]; + b0 = tmp[0U]; + b4_ = b4 & (uint128_t)(uint64_t)0x7ffffffffffffU; + b0_ = b0 + (uint128_t)(uint64_t)19U * (uint64_t)(b4 >> (uint32_t)51U); + tmp[4U] = b4_; + tmp[0U] = b0_; + Hacl_Bignum_Fproduct_copy_from_wide_(output, tmp); + } + } +} + +inline static void Hacl_Bignum_fmul(uint64_t *output, uint64_t *a, uint64_t *b) +{ + Hacl_Bignum_Fmul_fmul(output, a, b); +} + +inline static void Hacl_Bignum_crecip(uint64_t *output, uint64_t *input) +{ + Hacl_Bignum_Crecip_crecip(output, input); +} + +static void +Hacl_EC_Point_swap_conditional_step(uint64_t *a, uint64_t *b, uint64_t swap1, uint32_t ctr) +{ + uint32_t i = ctr - (uint32_t)1U; + uint64_t ai = a[i]; + uint64_t bi = b[i]; + uint64_t x = swap1 & (ai ^ bi); + uint64_t ai1 = ai ^ x; + uint64_t bi1 = bi ^ x; + a[i] = ai1; + b[i] = bi1; +} + +static void +Hacl_EC_Point_swap_conditional_(uint64_t *a, uint64_t *b, uint64_t swap1, uint32_t ctr) +{ + if (!(ctr == (uint32_t)0U)) + { + uint32_t i; + Hacl_EC_Point_swap_conditional_step(a, b, swap1, ctr); + i = ctr - (uint32_t)1U; + Hacl_EC_Point_swap_conditional_(a, b, swap1, i); + } +} + +static void Hacl_EC_Point_swap_conditional(uint64_t *a, uint64_t *b, uint64_t iswap) +{ + uint64_t swap1 = (uint64_t)0U - iswap; + Hacl_EC_Point_swap_conditional_(a, b, swap1, (uint32_t)5U); + Hacl_EC_Point_swap_conditional_(a + (uint32_t)5U, b + (uint32_t)5U, swap1, (uint32_t)5U); +} + +static void Hacl_EC_Point_copy(uint64_t *output, uint64_t *input) +{ + memcpy(output, input, (uint32_t)5U * sizeof input[0U]); + memcpy(output + (uint32_t)5U, + input + (uint32_t)5U, + (uint32_t)5U * sizeof (input + (uint32_t)5U)[0U]); +} + +static void Hacl_EC_Format_fexpand(uint64_t *output, uint8_t *input) +{ + uint64_t i0 = load64_le(input); + uint8_t *x00 = input + (uint32_t)6U; + uint64_t i1 = load64_le(x00); + uint8_t *x01 = input + (uint32_t)12U; + uint64_t i2 = load64_le(x01); + uint8_t *x02 = input + (uint32_t)19U; + uint64_t i3 = load64_le(x02); + uint8_t *x0 = input + (uint32_t)24U; + uint64_t i4 = load64_le(x0); + uint64_t output0 = i0 & (uint64_t)0x7ffffffffffffU; + uint64_t output1 = i1 >> (uint32_t)3U & (uint64_t)0x7ffffffffffffU; + uint64_t output2 = i2 >> (uint32_t)6U & (uint64_t)0x7ffffffffffffU; + uint64_t output3 = i3 >> (uint32_t)1U & (uint64_t)0x7ffffffffffffU; + uint64_t output4 = i4 >> (uint32_t)12U & (uint64_t)0x7ffffffffffffU; + output[0U] = output0; + output[1U] = output1; + output[2U] = output2; + output[3U] = output3; + output[4U] = output4; +} + +static void Hacl_EC_Format_fcontract_first_carry_pass(uint64_t *input) +{ + uint64_t t0 = input[0U]; + uint64_t t1 = input[1U]; + uint64_t t2 = input[2U]; + uint64_t t3 = input[3U]; + uint64_t t4 = input[4U]; + uint64_t t1_ = t1 + (t0 >> (uint32_t)51U); + uint64_t t0_ = t0 & (uint64_t)0x7ffffffffffffU; + uint64_t t2_ = t2 + (t1_ >> (uint32_t)51U); + uint64_t t1__ = t1_ & (uint64_t)0x7ffffffffffffU; + uint64_t t3_ = t3 + (t2_ >> (uint32_t)51U); + uint64_t t2__ = t2_ & (uint64_t)0x7ffffffffffffU; + uint64_t t4_ = t4 + (t3_ >> (uint32_t)51U); + uint64_t t3__ = t3_ & (uint64_t)0x7ffffffffffffU; + input[0U] = t0_; + input[1U] = t1__; + input[2U] = t2__; + input[3U] = t3__; + input[4U] = t4_; +} + +static void Hacl_EC_Format_fcontract_first_carry_full(uint64_t *input) +{ + Hacl_EC_Format_fcontract_first_carry_pass(input); + Hacl_Bignum_Modulo_carry_top(input); +} + +static void Hacl_EC_Format_fcontract_second_carry_pass(uint64_t *input) +{ + uint64_t t0 = input[0U]; + uint64_t t1 = input[1U]; + uint64_t t2 = input[2U]; + uint64_t t3 = input[3U]; + uint64_t t4 = input[4U]; + uint64_t t1_ = t1 + (t0 >> (uint32_t)51U); + uint64_t t0_ = t0 & (uint64_t)0x7ffffffffffffU; + uint64_t t2_ = t2 + (t1_ >> (uint32_t)51U); + uint64_t t1__ = t1_ & (uint64_t)0x7ffffffffffffU; + uint64_t t3_ = t3 + (t2_ >> (uint32_t)51U); + uint64_t t2__ = t2_ & (uint64_t)0x7ffffffffffffU; + uint64_t t4_ = t4 + (t3_ >> (uint32_t)51U); + uint64_t t3__ = t3_ & (uint64_t)0x7ffffffffffffU; + input[0U] = t0_; + input[1U] = t1__; + input[2U] = t2__; + input[3U] = t3__; + input[4U] = t4_; +} + +static void Hacl_EC_Format_fcontract_second_carry_full(uint64_t *input) +{ + uint64_t i0; + uint64_t i1; + uint64_t i0_; + uint64_t i1_; + Hacl_EC_Format_fcontract_second_carry_pass(input); + Hacl_Bignum_Modulo_carry_top(input); + i0 = input[0U]; + i1 = input[1U]; + i0_ = i0 & (uint64_t)0x7ffffffffffffU; + i1_ = i1 + (i0 >> (uint32_t)51U); + input[0U] = i0_; + input[1U] = i1_; +} + +static void Hacl_EC_Format_fcontract_trim(uint64_t *input) +{ + uint64_t a0 = input[0U]; + uint64_t a1 = input[1U]; + uint64_t a2 = input[2U]; + uint64_t a3 = input[3U]; + uint64_t a4 = input[4U]; + uint64_t mask0 = FStar_UInt64_gte_mask(a0, (uint64_t)0x7ffffffffffedU); + uint64_t mask1 = FStar_UInt64_eq_mask(a1, (uint64_t)0x7ffffffffffffU); + uint64_t mask2 = FStar_UInt64_eq_mask(a2, (uint64_t)0x7ffffffffffffU); + uint64_t mask3 = FStar_UInt64_eq_mask(a3, (uint64_t)0x7ffffffffffffU); + uint64_t mask4 = FStar_UInt64_eq_mask(a4, (uint64_t)0x7ffffffffffffU); + uint64_t mask = (((mask0 & mask1) & mask2) & mask3) & mask4; + uint64_t a0_ = a0 - ((uint64_t)0x7ffffffffffedU & mask); + uint64_t a1_ = a1 - ((uint64_t)0x7ffffffffffffU & mask); + uint64_t a2_ = a2 - ((uint64_t)0x7ffffffffffffU & mask); + uint64_t a3_ = a3 - ((uint64_t)0x7ffffffffffffU & mask); + uint64_t a4_ = a4 - ((uint64_t)0x7ffffffffffffU & mask); + input[0U] = a0_; + input[1U] = a1_; + input[2U] = a2_; + input[3U] = a3_; + input[4U] = a4_; +} + +static void Hacl_EC_Format_fcontract_store(uint8_t *output, uint64_t *input) +{ + uint64_t t0 = input[0U]; + uint64_t t1 = input[1U]; + uint64_t t2 = input[2U]; + uint64_t t3 = input[3U]; + uint64_t t4 = input[4U]; + uint64_t o0 = t1 << (uint32_t)51U | t0; + uint64_t o1 = t2 << (uint32_t)38U | t1 >> (uint32_t)13U; + uint64_t o2 = t3 << (uint32_t)25U | t2 >> (uint32_t)26U; + uint64_t o3 = t4 << (uint32_t)12U | t3 >> (uint32_t)39U; + uint8_t *b0 = output; + uint8_t *b1 = output + (uint32_t)8U; + uint8_t *b2 = output + (uint32_t)16U; + uint8_t *b3 = output + (uint32_t)24U; + store64_le(b0, o0); + store64_le(b1, o1); + store64_le(b2, o2); + store64_le(b3, o3); +} + +static void Hacl_EC_Format_fcontract(uint8_t *output, uint64_t *input) +{ + Hacl_EC_Format_fcontract_first_carry_full(input); + Hacl_EC_Format_fcontract_second_carry_full(input); + Hacl_EC_Format_fcontract_trim(input); + Hacl_EC_Format_fcontract_store(output, input); +} + +static void Hacl_EC_Format_scalar_of_point(uint8_t *scalar, uint64_t *point) +{ + uint64_t *x = point; + uint64_t *z = point + (uint32_t)5U; + uint64_t buf[10U] = { 0U }; + uint64_t *zmone = buf; + uint64_t *sc = buf + (uint32_t)5U; + Hacl_Bignum_crecip(zmone, z); + Hacl_Bignum_fmul(sc, x, zmone); + Hacl_EC_Format_fcontract(scalar, sc); +} + +static void +Hacl_EC_AddAndDouble_fmonty( + uint64_t *pp, + uint64_t *ppq, + uint64_t *p, + uint64_t *pq, + uint64_t *qmqp +) +{ + uint64_t *qx = qmqp; + uint64_t *x2 = pp; + uint64_t *z2 = pp + (uint32_t)5U; + uint64_t *x3 = ppq; + uint64_t *z3 = ppq + (uint32_t)5U; + uint64_t *x = p; + uint64_t *z = p + (uint32_t)5U; + uint64_t *xprime = pq; + uint64_t *zprime = pq + (uint32_t)5U; + uint64_t buf[40U] = { 0U }; + uint64_t *origx = buf; + uint64_t *origxprime0 = buf + (uint32_t)5U; + uint64_t *xxprime0 = buf + (uint32_t)25U; + uint64_t *zzprime0 = buf + (uint32_t)30U; + uint64_t *origxprime; + uint64_t *xx0; + uint64_t *zz0; + uint64_t *xxprime; + uint64_t *zzprime; + uint64_t *zzzprime; + uint64_t *zzz; + uint64_t *xx; + uint64_t *zz; + uint64_t scalar; + memcpy(origx, x, (uint32_t)5U * sizeof x[0U]); + Hacl_Bignum_fsum(x, z); + Hacl_Bignum_fdifference(z, origx); + memcpy(origxprime0, xprime, (uint32_t)5U * sizeof xprime[0U]); + Hacl_Bignum_fsum(xprime, zprime); + Hacl_Bignum_fdifference(zprime, origxprime0); + Hacl_Bignum_fmul(xxprime0, xprime, z); + Hacl_Bignum_fmul(zzprime0, x, zprime); + origxprime = buf + (uint32_t)5U; + xx0 = buf + (uint32_t)15U; + zz0 = buf + (uint32_t)20U; + xxprime = buf + (uint32_t)25U; + zzprime = buf + (uint32_t)30U; + zzzprime = buf + (uint32_t)35U; + memcpy(origxprime, xxprime, (uint32_t)5U * sizeof xxprime[0U]); + Hacl_Bignum_fsum(xxprime, zzprime); + Hacl_Bignum_fdifference(zzprime, origxprime); + Hacl_Bignum_Fsquare_fsquare_times(x3, xxprime, (uint32_t)1U); + Hacl_Bignum_Fsquare_fsquare_times(zzzprime, zzprime, (uint32_t)1U); + Hacl_Bignum_fmul(z3, zzzprime, qx); + Hacl_Bignum_Fsquare_fsquare_times(xx0, x, (uint32_t)1U); + Hacl_Bignum_Fsquare_fsquare_times(zz0, z, (uint32_t)1U); + zzz = buf + (uint32_t)10U; + xx = buf + (uint32_t)15U; + zz = buf + (uint32_t)20U; + Hacl_Bignum_fmul(x2, xx, zz); + Hacl_Bignum_fdifference(zz, xx); + scalar = (uint64_t)121665U; + Hacl_Bignum_fscalar(zzz, zz, scalar); + Hacl_Bignum_fsum(zzz, xx); + Hacl_Bignum_fmul(z2, zzz, zz); +} + +static void +Hacl_EC_Ladder_SmallLoop_cmult_small_loop_step( + uint64_t *nq, + uint64_t *nqpq, + uint64_t *nq2, + uint64_t *nqpq2, + uint64_t *q, + uint8_t byt +) +{ + uint64_t bit0 = (uint64_t)(byt >> (uint32_t)7U); + uint64_t bit; + Hacl_EC_Point_swap_conditional(nq, nqpq, bit0); + Hacl_EC_AddAndDouble_fmonty(nq2, nqpq2, nq, nqpq, q); + bit = (uint64_t)(byt >> (uint32_t)7U); + Hacl_EC_Point_swap_conditional(nq2, nqpq2, bit); +} + +static void +Hacl_EC_Ladder_SmallLoop_cmult_small_loop_double_step( + uint64_t *nq, + uint64_t *nqpq, + uint64_t *nq2, + uint64_t *nqpq2, + uint64_t *q, + uint8_t byt +) +{ + uint8_t byt1; + Hacl_EC_Ladder_SmallLoop_cmult_small_loop_step(nq, nqpq, nq2, nqpq2, q, byt); + byt1 = byt << (uint32_t)1U; + Hacl_EC_Ladder_SmallLoop_cmult_small_loop_step(nq2, nqpq2, nq, nqpq, q, byt1); +} + +static void +Hacl_EC_Ladder_SmallLoop_cmult_small_loop( + uint64_t *nq, + uint64_t *nqpq, + uint64_t *nq2, + uint64_t *nqpq2, + uint64_t *q, + uint8_t byt, + uint32_t i +) +{ + if (!(i == (uint32_t)0U)) + { + uint32_t i_ = i - (uint32_t)1U; + uint8_t byt_; + Hacl_EC_Ladder_SmallLoop_cmult_small_loop_double_step(nq, nqpq, nq2, nqpq2, q, byt); + byt_ = byt << (uint32_t)2U; + Hacl_EC_Ladder_SmallLoop_cmult_small_loop(nq, nqpq, nq2, nqpq2, q, byt_, i_); + } +} + +static void +Hacl_EC_Ladder_BigLoop_cmult_big_loop( + uint8_t *n1, + uint64_t *nq, + uint64_t *nqpq, + uint64_t *nq2, + uint64_t *nqpq2, + uint64_t *q, + uint32_t i +) +{ + if (!(i == (uint32_t)0U)) + { + uint32_t i1 = i - (uint32_t)1U; + uint8_t byte = n1[i1]; + Hacl_EC_Ladder_SmallLoop_cmult_small_loop(nq, nqpq, nq2, nqpq2, q, byte, (uint32_t)4U); + Hacl_EC_Ladder_BigLoop_cmult_big_loop(n1, nq, nqpq, nq2, nqpq2, q, i1); + } +} + +static void Hacl_EC_Ladder_cmult(uint64_t *result, uint8_t *n1, uint64_t *q) +{ + uint64_t point_buf[40U] = { 0U }; + uint64_t *nq = point_buf; + uint64_t *nqpq = point_buf + (uint32_t)10U; + uint64_t *nq2 = point_buf + (uint32_t)20U; + uint64_t *nqpq2 = point_buf + (uint32_t)30U; + Hacl_EC_Point_copy(nqpq, q); + nq[0U] = (uint64_t)1U; + Hacl_EC_Ladder_BigLoop_cmult_big_loop(n1, nq, nqpq, nq2, nqpq2, q, (uint32_t)32U); + Hacl_EC_Point_copy(result, nq); +} + +void Hacl_Curve25519_crypto_scalarmult(uint8_t *mypublic, uint8_t *secret, uint8_t *basepoint) +{ + uint64_t buf0[10U] = { 0U }; + uint64_t *x0 = buf0; + uint64_t *z = buf0 + (uint32_t)5U; + uint64_t *q; + Hacl_EC_Format_fexpand(x0, basepoint); + z[0U] = (uint64_t)1U; + q = buf0; + { + uint8_t e[32U] = { 0U }; + uint8_t e0; + uint8_t e31; + uint8_t e01; + uint8_t e311; + uint8_t e312; + uint8_t *scalar; + memcpy(e, secret, (uint32_t)32U * sizeof secret[0U]); + e0 = e[0U]; + e31 = e[31U]; + e01 = e0 & (uint8_t)248U; + e311 = e31 & (uint8_t)127U; + e312 = e311 | (uint8_t)64U; + e[0U] = e01; + e[31U] = e312; + scalar = e; + { + uint64_t buf[15U] = { 0U }; + uint64_t *nq = buf; + uint64_t *x = nq; + x[0U] = (uint64_t)1U; + Hacl_EC_Ladder_cmult(nq, scalar, q); + Hacl_EC_Format_scalar_of_point(mypublic, nq); + } + } +} + diff --git a/third_party/mbedtls/repo/3rdparty/everest/library/Hacl_Curve25519_joined.c b/third_party/mbedtls/repo/3rdparty/everest/library/Hacl_Curve25519_joined.c new file mode 100644 index 000000000..ee62be1ce --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/library/Hacl_Curve25519_joined.c @@ -0,0 +1,41 @@ +/* + * Interface to code from Project Everest + * + * Copyright 2016-2018 INRIA and Microsoft Corporation + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * This file is part of mbed TLS (https://tls.mbed.org) + */ + +#include "common.h" + +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) + +#if defined(__SIZEOF_INT128__) && (__SIZEOF_INT128__ == 16) +#define MBEDTLS_HAVE_INT128 +#endif + +#if defined(MBEDTLS_HAVE_INT128) +#include "Hacl_Curve25519.c" +#else +#define KRML_VERIFIED_UINT128 +#include "kremlib/FStar_UInt128_extracted.c" +#include "legacy/Hacl_Curve25519.c" +#endif + +#include "kremlib/FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8.c" + +#endif /* defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) */ + diff --git a/third_party/mbedtls/repo/3rdparty/everest/library/everest.c b/third_party/mbedtls/repo/3rdparty/everest/library/everest.c new file mode 100644 index 000000000..82c4e03ad --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/library/everest.c @@ -0,0 +1,107 @@ +/* + * Interface to code from Project Everest + * + * Copyright 2016-2018 INRIA and Microsoft Corporation + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * This file is part of Mbed TLS (https://tls.mbed.org). + */ + +#include "common.h" + +#include + +#include "mbedtls/ecdh.h" + +#include "everest/x25519.h" +#include "everest/everest.h" + +#if defined(MBEDTLS_PLATFORM_C) +#include "mbedtls/platform.h" +#else +#define mbedtls_calloc calloc +#define mbedtls_free free +#endif + +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) + +int mbedtls_everest_setup( mbedtls_ecdh_context_everest *ctx, int grp_id ) +{ + if( grp_id != MBEDTLS_ECP_DP_CURVE25519 ) + return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; + mbedtls_x25519_init( &ctx->ctx ); + return 0; +} + +void mbedtls_everest_free( mbedtls_ecdh_context_everest *ctx ) +{ + mbedtls_x25519_free( &ctx->ctx ); +} + +int mbedtls_everest_make_params( mbedtls_ecdh_context_everest *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int( *f_rng )( void *, unsigned char *, size_t ), + void *p_rng ) +{ + mbedtls_x25519_context *x25519_ctx = &ctx->ctx; + return mbedtls_x25519_make_params( x25519_ctx, olen, buf, blen, f_rng, p_rng ); +} + +int mbedtls_everest_read_params( mbedtls_ecdh_context_everest *ctx, + const unsigned char **buf, + const unsigned char *end ) +{ + mbedtls_x25519_context *x25519_ctx = &ctx->ctx; + return mbedtls_x25519_read_params( x25519_ctx, buf, end ); +} + +int mbedtls_everest_get_params( mbedtls_ecdh_context_everest *ctx, + const mbedtls_ecp_keypair *key, + mbedtls_everest_ecdh_side side ) +{ + mbedtls_x25519_context *x25519_ctx = &ctx->ctx; + mbedtls_x25519_ecdh_side s = side == MBEDTLS_EVEREST_ECDH_OURS ? + MBEDTLS_X25519_ECDH_OURS : + MBEDTLS_X25519_ECDH_THEIRS; + return mbedtls_x25519_get_params( x25519_ctx, key, s ); +} + +int mbedtls_everest_make_public( mbedtls_ecdh_context_everest *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int( *f_rng )( void *, unsigned char *, size_t ), + void *p_rng ) +{ + mbedtls_x25519_context *x25519_ctx = &ctx->ctx; + return mbedtls_x25519_make_public( x25519_ctx, olen, buf, blen, f_rng, p_rng ); +} + +int mbedtls_everest_read_public( mbedtls_ecdh_context_everest *ctx, + const unsigned char *buf, size_t blen ) +{ + mbedtls_x25519_context *x25519_ctx = &ctx->ctx; + return mbedtls_x25519_read_public ( x25519_ctx, buf, blen ); +} + +int mbedtls_everest_calc_secret( mbedtls_ecdh_context_everest *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int( *f_rng )( void *, unsigned char *, size_t ), + void *p_rng ) +{ + mbedtls_x25519_context *x25519_ctx = &ctx->ctx; + return mbedtls_x25519_calc_secret( x25519_ctx, olen, buf, blen, f_rng, p_rng ); +} + +#endif /* MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED */ + diff --git a/third_party/mbedtls/repo/3rdparty/everest/library/kremlib/FStar_UInt128_extracted.c b/third_party/mbedtls/repo/3rdparty/everest/library/kremlib/FStar_UInt128_extracted.c new file mode 100644 index 000000000..1060515d9 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/library/kremlib/FStar_UInt128_extracted.c @@ -0,0 +1,413 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +/* This file was generated by KreMLin + * KreMLin invocation: ../krml -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrB9w -minimal -fparentheses -fcurly-braces -fno-shadow -header copyright-header.txt -minimal -tmpdir extracted -warn-error +9+11 -skip-compilation -extract-uints -add-include -add-include "kremlib.h" -add-include "kremlin/internal/compat.h" extracted/prims.krml extracted/FStar_Pervasives_Native.krml extracted/FStar_Pervasives.krml extracted/FStar_Mul.krml extracted/FStar_Squash.krml extracted/FStar_Classical.krml extracted/FStar_StrongExcludedMiddle.krml extracted/FStar_FunctionalExtensionality.krml extracted/FStar_List_Tot_Base.krml extracted/FStar_List_Tot_Properties.krml extracted/FStar_List_Tot.krml extracted/FStar_Seq_Base.krml extracted/FStar_Seq_Properties.krml extracted/FStar_Seq.krml extracted/FStar_Math_Lib.krml extracted/FStar_Math_Lemmas.krml extracted/FStar_BitVector.krml extracted/FStar_UInt.krml extracted/FStar_UInt32.krml extracted/FStar_Int.krml extracted/FStar_Int16.krml extracted/FStar_Preorder.krml extracted/FStar_Ghost.krml extracted/FStar_ErasedLogic.krml extracted/FStar_UInt64.krml extracted/FStar_Set.krml extracted/FStar_PropositionalExtensionality.krml extracted/FStar_PredicateExtensionality.krml extracted/FStar_TSet.krml extracted/FStar_Monotonic_Heap.krml extracted/FStar_Heap.krml extracted/FStar_Map.krml extracted/FStar_Monotonic_HyperHeap.krml extracted/FStar_Monotonic_HyperStack.krml extracted/FStar_HyperStack.krml extracted/FStar_Monotonic_Witnessed.krml extracted/FStar_HyperStack_ST.krml extracted/FStar_HyperStack_All.krml extracted/FStar_Date.krml extracted/FStar_Universe.krml extracted/FStar_GSet.krml extracted/FStar_ModifiesGen.krml extracted/LowStar_Monotonic_Buffer.krml extracted/LowStar_Buffer.krml extracted/Spec_Loops.krml extracted/LowStar_BufferOps.krml extracted/C_Loops.krml extracted/FStar_UInt8.krml extracted/FStar_Kremlin_Endianness.krml extracted/FStar_UInt63.krml extracted/FStar_Exn.krml extracted/FStar_ST.krml extracted/FStar_All.krml extracted/FStar_Dyn.krml extracted/FStar_Int63.krml extracted/FStar_Int64.krml extracted/FStar_Int32.krml extracted/FStar_Int8.krml extracted/FStar_UInt16.krml extracted/FStar_Int_Cast.krml extracted/FStar_UInt128.krml extracted/C_Endianness.krml extracted/FStar_List.krml extracted/FStar_Float.krml extracted/FStar_IO.krml extracted/C.krml extracted/FStar_Char.krml extracted/FStar_String.krml extracted/LowStar_Modifies.krml extracted/C_String.krml extracted/FStar_Bytes.krml extracted/FStar_HyperStack_IO.krml extracted/C_Failure.krml extracted/TestLib.krml extracted/FStar_Int_Cast_Full.krml + * F* version: 059db0c8 + * KreMLin version: 916c37ac + */ + + +#include "FStar_UInt128.h" +#include "kremlin/c_endianness.h" +#include "FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8.h" + +uint64_t FStar_UInt128___proj__Mkuint128__item__low(FStar_UInt128_uint128 projectee) +{ + return projectee.low; +} + +uint64_t FStar_UInt128___proj__Mkuint128__item__high(FStar_UInt128_uint128 projectee) +{ + return projectee.high; +} + +static uint64_t FStar_UInt128_constant_time_carry(uint64_t a, uint64_t b) +{ + return (a ^ ((a ^ b) | ((a - b) ^ b))) >> (uint32_t)63U; +} + +static uint64_t FStar_UInt128_carry(uint64_t a, uint64_t b) +{ + return FStar_UInt128_constant_time_carry(a, b); +} + +FStar_UInt128_uint128 FStar_UInt128_add(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + FStar_UInt128_uint128 + flat = { a.low + b.low, a.high + b.high + FStar_UInt128_carry(a.low + b.low, b.low) }; + return flat; +} + +FStar_UInt128_uint128 +FStar_UInt128_add_underspec(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + FStar_UInt128_uint128 + flat = { a.low + b.low, a.high + b.high + FStar_UInt128_carry(a.low + b.low, b.low) }; + return flat; +} + +FStar_UInt128_uint128 FStar_UInt128_add_mod(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + FStar_UInt128_uint128 + flat = { a.low + b.low, a.high + b.high + FStar_UInt128_carry(a.low + b.low, b.low) }; + return flat; +} + +FStar_UInt128_uint128 FStar_UInt128_sub(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + FStar_UInt128_uint128 + flat = { a.low - b.low, a.high - b.high - FStar_UInt128_carry(a.low, a.low - b.low) }; + return flat; +} + +FStar_UInt128_uint128 +FStar_UInt128_sub_underspec(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + FStar_UInt128_uint128 + flat = { a.low - b.low, a.high - b.high - FStar_UInt128_carry(a.low, a.low - b.low) }; + return flat; +} + +static FStar_UInt128_uint128 +FStar_UInt128_sub_mod_impl(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + FStar_UInt128_uint128 + flat = { a.low - b.low, a.high - b.high - FStar_UInt128_carry(a.low, a.low - b.low) }; + return flat; +} + +FStar_UInt128_uint128 FStar_UInt128_sub_mod(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + return FStar_UInt128_sub_mod_impl(a, b); +} + +FStar_UInt128_uint128 FStar_UInt128_logand(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + FStar_UInt128_uint128 flat = { a.low & b.low, a.high & b.high }; + return flat; +} + +FStar_UInt128_uint128 FStar_UInt128_logxor(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + FStar_UInt128_uint128 flat = { a.low ^ b.low, a.high ^ b.high }; + return flat; +} + +FStar_UInt128_uint128 FStar_UInt128_logor(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + FStar_UInt128_uint128 flat = { a.low | b.low, a.high | b.high }; + return flat; +} + +FStar_UInt128_uint128 FStar_UInt128_lognot(FStar_UInt128_uint128 a) +{ + FStar_UInt128_uint128 flat = { ~a.low, ~a.high }; + return flat; +} + +static uint32_t FStar_UInt128_u32_64 = (uint32_t)64U; + +static uint64_t FStar_UInt128_add_u64_shift_left(uint64_t hi, uint64_t lo, uint32_t s) +{ + return (hi << s) + (lo >> (FStar_UInt128_u32_64 - s)); +} + +static uint64_t FStar_UInt128_add_u64_shift_left_respec(uint64_t hi, uint64_t lo, uint32_t s) +{ + return FStar_UInt128_add_u64_shift_left(hi, lo, s); +} + +static FStar_UInt128_uint128 +FStar_UInt128_shift_left_small(FStar_UInt128_uint128 a, uint32_t s) +{ + if (s == (uint32_t)0U) + { + return a; + } + else + { + FStar_UInt128_uint128 + flat = { a.low << s, FStar_UInt128_add_u64_shift_left_respec(a.high, a.low, s) }; + return flat; + } +} + +static FStar_UInt128_uint128 +FStar_UInt128_shift_left_large(FStar_UInt128_uint128 a, uint32_t s) +{ + FStar_UInt128_uint128 flat = { (uint64_t)0U, a.low << (s - FStar_UInt128_u32_64) }; + return flat; +} + +FStar_UInt128_uint128 FStar_UInt128_shift_left(FStar_UInt128_uint128 a, uint32_t s) +{ + if (s < FStar_UInt128_u32_64) + { + return FStar_UInt128_shift_left_small(a, s); + } + else + { + return FStar_UInt128_shift_left_large(a, s); + } +} + +static uint64_t FStar_UInt128_add_u64_shift_right(uint64_t hi, uint64_t lo, uint32_t s) +{ + return (lo >> s) + (hi << (FStar_UInt128_u32_64 - s)); +} + +static uint64_t FStar_UInt128_add_u64_shift_right_respec(uint64_t hi, uint64_t lo, uint32_t s) +{ + return FStar_UInt128_add_u64_shift_right(hi, lo, s); +} + +static FStar_UInt128_uint128 +FStar_UInt128_shift_right_small(FStar_UInt128_uint128 a, uint32_t s) +{ + if (s == (uint32_t)0U) + { + return a; + } + else + { + FStar_UInt128_uint128 + flat = { FStar_UInt128_add_u64_shift_right_respec(a.high, a.low, s), a.high >> s }; + return flat; + } +} + +static FStar_UInt128_uint128 +FStar_UInt128_shift_right_large(FStar_UInt128_uint128 a, uint32_t s) +{ + FStar_UInt128_uint128 flat = { a.high >> (s - FStar_UInt128_u32_64), (uint64_t)0U }; + return flat; +} + +FStar_UInt128_uint128 FStar_UInt128_shift_right(FStar_UInt128_uint128 a, uint32_t s) +{ + if (s < FStar_UInt128_u32_64) + { + return FStar_UInt128_shift_right_small(a, s); + } + else + { + return FStar_UInt128_shift_right_large(a, s); + } +} + +bool FStar_UInt128_eq(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + return a.low == b.low && a.high == b.high; +} + +bool FStar_UInt128_gt(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + return a.high > b.high || (a.high == b.high && a.low > b.low); +} + +bool FStar_UInt128_lt(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + return a.high < b.high || (a.high == b.high && a.low < b.low); +} + +bool FStar_UInt128_gte(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + return a.high > b.high || (a.high == b.high && a.low >= b.low); +} + +bool FStar_UInt128_lte(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + return a.high < b.high || (a.high == b.high && a.low <= b.low); +} + +FStar_UInt128_uint128 FStar_UInt128_eq_mask(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + FStar_UInt128_uint128 + flat = + { + FStar_UInt64_eq_mask(a.low, + b.low) + & FStar_UInt64_eq_mask(a.high, b.high), + FStar_UInt64_eq_mask(a.low, + b.low) + & FStar_UInt64_eq_mask(a.high, b.high) + }; + return flat; +} + +FStar_UInt128_uint128 FStar_UInt128_gte_mask(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b) +{ + FStar_UInt128_uint128 + flat = + { + (FStar_UInt64_gte_mask(a.high, b.high) & ~FStar_UInt64_eq_mask(a.high, b.high)) + | (FStar_UInt64_eq_mask(a.high, b.high) & FStar_UInt64_gte_mask(a.low, b.low)), + (FStar_UInt64_gte_mask(a.high, b.high) & ~FStar_UInt64_eq_mask(a.high, b.high)) + | (FStar_UInt64_eq_mask(a.high, b.high) & FStar_UInt64_gte_mask(a.low, b.low)) + }; + return flat; +} + +FStar_UInt128_uint128 FStar_UInt128_uint64_to_uint128(uint64_t a) +{ + FStar_UInt128_uint128 flat = { a, (uint64_t)0U }; + return flat; +} + +uint64_t FStar_UInt128_uint128_to_uint64(FStar_UInt128_uint128 a) +{ + return a.low; +} + +FStar_UInt128_uint128 +(*FStar_UInt128_op_Plus_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1) = + FStar_UInt128_add; + +FStar_UInt128_uint128 +(*FStar_UInt128_op_Plus_Question_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1) = + FStar_UInt128_add_underspec; + +FStar_UInt128_uint128 +(*FStar_UInt128_op_Plus_Percent_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1) = + FStar_UInt128_add_mod; + +FStar_UInt128_uint128 +(*FStar_UInt128_op_Subtraction_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1) = + FStar_UInt128_sub; + +FStar_UInt128_uint128 +(*FStar_UInt128_op_Subtraction_Question_Hat)( + FStar_UInt128_uint128 x0, + FStar_UInt128_uint128 x1 +) = FStar_UInt128_sub_underspec; + +FStar_UInt128_uint128 +(*FStar_UInt128_op_Subtraction_Percent_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1) = + FStar_UInt128_sub_mod; + +FStar_UInt128_uint128 +(*FStar_UInt128_op_Amp_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1) = + FStar_UInt128_logand; + +FStar_UInt128_uint128 +(*FStar_UInt128_op_Hat_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1) = + FStar_UInt128_logxor; + +FStar_UInt128_uint128 +(*FStar_UInt128_op_Bar_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1) = + FStar_UInt128_logor; + +FStar_UInt128_uint128 +(*FStar_UInt128_op_Less_Less_Hat)(FStar_UInt128_uint128 x0, uint32_t x1) = + FStar_UInt128_shift_left; + +FStar_UInt128_uint128 +(*FStar_UInt128_op_Greater_Greater_Hat)(FStar_UInt128_uint128 x0, uint32_t x1) = + FStar_UInt128_shift_right; + +bool +(*FStar_UInt128_op_Equals_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1) = + FStar_UInt128_eq; + +bool +(*FStar_UInt128_op_Greater_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1) = + FStar_UInt128_gt; + +bool +(*FStar_UInt128_op_Less_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1) = + FStar_UInt128_lt; + +bool +(*FStar_UInt128_op_Greater_Equals_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1) = + FStar_UInt128_gte; + +bool +(*FStar_UInt128_op_Less_Equals_Hat)(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1) = + FStar_UInt128_lte; + +static uint64_t FStar_UInt128_u64_mod_32(uint64_t a) +{ + return a & (uint64_t)0xffffffffU; +} + +static uint32_t FStar_UInt128_u32_32 = (uint32_t)32U; + +static uint64_t FStar_UInt128_u32_combine(uint64_t hi, uint64_t lo) +{ + return lo + (hi << FStar_UInt128_u32_32); +} + +FStar_UInt128_uint128 FStar_UInt128_mul32(uint64_t x, uint32_t y) +{ + FStar_UInt128_uint128 + flat = + { + FStar_UInt128_u32_combine((x >> FStar_UInt128_u32_32) + * (uint64_t)y + + (FStar_UInt128_u64_mod_32(x) * (uint64_t)y >> FStar_UInt128_u32_32), + FStar_UInt128_u64_mod_32(FStar_UInt128_u64_mod_32(x) * (uint64_t)y)), + ((x >> FStar_UInt128_u32_32) + * (uint64_t)y + + (FStar_UInt128_u64_mod_32(x) * (uint64_t)y >> FStar_UInt128_u32_32)) + >> FStar_UInt128_u32_32 + }; + return flat; +} + +typedef struct K___uint64_t_uint64_t_uint64_t_uint64_t_s +{ + uint64_t fst; + uint64_t snd; + uint64_t thd; + uint64_t f3; +} +K___uint64_t_uint64_t_uint64_t_uint64_t; + +static K___uint64_t_uint64_t_uint64_t_uint64_t +FStar_UInt128_mul_wide_impl_t_(uint64_t x, uint64_t y) +{ + K___uint64_t_uint64_t_uint64_t_uint64_t + flat = + { + FStar_UInt128_u64_mod_32(x), + FStar_UInt128_u64_mod_32(FStar_UInt128_u64_mod_32(x) * FStar_UInt128_u64_mod_32(y)), + x + >> FStar_UInt128_u32_32, + (x >> FStar_UInt128_u32_32) + * FStar_UInt128_u64_mod_32(y) + + (FStar_UInt128_u64_mod_32(x) * FStar_UInt128_u64_mod_32(y) >> FStar_UInt128_u32_32) + }; + return flat; +} + +static uint64_t FStar_UInt128_u32_combine_(uint64_t hi, uint64_t lo) +{ + return lo + (hi << FStar_UInt128_u32_32); +} + +static FStar_UInt128_uint128 FStar_UInt128_mul_wide_impl(uint64_t x, uint64_t y) +{ + K___uint64_t_uint64_t_uint64_t_uint64_t scrut = FStar_UInt128_mul_wide_impl_t_(x, y); + uint64_t u1 = scrut.fst; + uint64_t w3 = scrut.snd; + uint64_t x_ = scrut.thd; + uint64_t t_ = scrut.f3; + FStar_UInt128_uint128 + flat = + { + FStar_UInt128_u32_combine_(u1 * (y >> FStar_UInt128_u32_32) + FStar_UInt128_u64_mod_32(t_), + w3), + x_ + * (y >> FStar_UInt128_u32_32) + + (t_ >> FStar_UInt128_u32_32) + + ((u1 * (y >> FStar_UInt128_u32_32) + FStar_UInt128_u64_mod_32(t_)) >> FStar_UInt128_u32_32) + }; + return flat; +} + +FStar_UInt128_uint128 FStar_UInt128_mul_wide(uint64_t x, uint64_t y) +{ + return FStar_UInt128_mul_wide_impl(x, y); +} + diff --git a/third_party/mbedtls/repo/3rdparty/everest/library/kremlib/FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8.c b/third_party/mbedtls/repo/3rdparty/everest/library/kremlib/FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8.c new file mode 100644 index 000000000..08265248f --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/library/kremlib/FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8.c @@ -0,0 +1,100 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +/* This file was generated by KreMLin + * KreMLin invocation: ../krml -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrB9w -minimal -fparentheses -fcurly-braces -fno-shadow -header copyright-header.txt -minimal -tmpdir dist/minimal -skip-compilation -extract-uints -add-include -add-include -add-include "kremlin/internal/compat.h" -add-include "kremlin/internal/types.h" -bundle FStar.UInt64+FStar.UInt32+FStar.UInt16+FStar.UInt8=* extracted/prims.krml extracted/FStar_Pervasives_Native.krml extracted/FStar_Pervasives.krml extracted/FStar_Mul.krml extracted/FStar_Squash.krml extracted/FStar_Classical.krml extracted/FStar_StrongExcludedMiddle.krml extracted/FStar_FunctionalExtensionality.krml extracted/FStar_List_Tot_Base.krml extracted/FStar_List_Tot_Properties.krml extracted/FStar_List_Tot.krml extracted/FStar_Seq_Base.krml extracted/FStar_Seq_Properties.krml extracted/FStar_Seq.krml extracted/FStar_Math_Lib.krml extracted/FStar_Math_Lemmas.krml extracted/FStar_BitVector.krml extracted/FStar_UInt.krml extracted/FStar_UInt32.krml extracted/FStar_Int.krml extracted/FStar_Int16.krml extracted/FStar_Preorder.krml extracted/FStar_Ghost.krml extracted/FStar_ErasedLogic.krml extracted/FStar_UInt64.krml extracted/FStar_Set.krml extracted/FStar_PropositionalExtensionality.krml extracted/FStar_PredicateExtensionality.krml extracted/FStar_TSet.krml extracted/FStar_Monotonic_Heap.krml extracted/FStar_Heap.krml extracted/FStar_Map.krml extracted/FStar_Monotonic_HyperHeap.krml extracted/FStar_Monotonic_HyperStack.krml extracted/FStar_HyperStack.krml extracted/FStar_Monotonic_Witnessed.krml extracted/FStar_HyperStack_ST.krml extracted/FStar_HyperStack_All.krml extracted/FStar_Date.krml extracted/FStar_Universe.krml extracted/FStar_GSet.krml extracted/FStar_ModifiesGen.krml extracted/LowStar_Monotonic_Buffer.krml extracted/LowStar_Buffer.krml extracted/Spec_Loops.krml extracted/LowStar_BufferOps.krml extracted/C_Loops.krml extracted/FStar_UInt8.krml extracted/FStar_Kremlin_Endianness.krml extracted/FStar_UInt63.krml extracted/FStar_Exn.krml extracted/FStar_ST.krml extracted/FStar_All.krml extracted/FStar_Dyn.krml extracted/FStar_Int63.krml extracted/FStar_Int64.krml extracted/FStar_Int32.krml extracted/FStar_Int8.krml extracted/FStar_UInt16.krml extracted/FStar_Int_Cast.krml extracted/FStar_UInt128.krml extracted/C_Endianness.krml extracted/FStar_List.krml extracted/FStar_Float.krml extracted/FStar_IO.krml extracted/C.krml extracted/FStar_Char.krml extracted/FStar_String.krml extracted/LowStar_Modifies.krml extracted/C_String.krml extracted/FStar_Bytes.krml extracted/FStar_HyperStack_IO.krml extracted/C_Failure.krml extracted/TestLib.krml extracted/FStar_Int_Cast_Full.krml + * F* version: 059db0c8 + * KreMLin version: 916c37ac + */ + + +#include "FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8.h" + +uint64_t FStar_UInt64_eq_mask(uint64_t a, uint64_t b) +{ + uint64_t x = a ^ b; + uint64_t minus_x = ~x + (uint64_t)1U; + uint64_t x_or_minus_x = x | minus_x; + uint64_t xnx = x_or_minus_x >> (uint32_t)63U; + return xnx - (uint64_t)1U; +} + +uint64_t FStar_UInt64_gte_mask(uint64_t a, uint64_t b) +{ + uint64_t x = a; + uint64_t y = b; + uint64_t x_xor_y = x ^ y; + uint64_t x_sub_y = x - y; + uint64_t x_sub_y_xor_y = x_sub_y ^ y; + uint64_t q = x_xor_y | x_sub_y_xor_y; + uint64_t x_xor_q = x ^ q; + uint64_t x_xor_q_ = x_xor_q >> (uint32_t)63U; + return x_xor_q_ - (uint64_t)1U; +} + +uint32_t FStar_UInt32_eq_mask(uint32_t a, uint32_t b) +{ + uint32_t x = a ^ b; + uint32_t minus_x = ~x + (uint32_t)1U; + uint32_t x_or_minus_x = x | minus_x; + uint32_t xnx = x_or_minus_x >> (uint32_t)31U; + return xnx - (uint32_t)1U; +} + +uint32_t FStar_UInt32_gte_mask(uint32_t a, uint32_t b) +{ + uint32_t x = a; + uint32_t y = b; + uint32_t x_xor_y = x ^ y; + uint32_t x_sub_y = x - y; + uint32_t x_sub_y_xor_y = x_sub_y ^ y; + uint32_t q = x_xor_y | x_sub_y_xor_y; + uint32_t x_xor_q = x ^ q; + uint32_t x_xor_q_ = x_xor_q >> (uint32_t)31U; + return x_xor_q_ - (uint32_t)1U; +} + +uint16_t FStar_UInt16_eq_mask(uint16_t a, uint16_t b) +{ + uint16_t x = a ^ b; + uint16_t minus_x = ~x + (uint16_t)1U; + uint16_t x_or_minus_x = x | minus_x; + uint16_t xnx = x_or_minus_x >> (uint32_t)15U; + return xnx - (uint16_t)1U; +} + +uint16_t FStar_UInt16_gte_mask(uint16_t a, uint16_t b) +{ + uint16_t x = a; + uint16_t y = b; + uint16_t x_xor_y = x ^ y; + uint16_t x_sub_y = x - y; + uint16_t x_sub_y_xor_y = x_sub_y ^ y; + uint16_t q = x_xor_y | x_sub_y_xor_y; + uint16_t x_xor_q = x ^ q; + uint16_t x_xor_q_ = x_xor_q >> (uint32_t)15U; + return x_xor_q_ - (uint16_t)1U; +} + +uint8_t FStar_UInt8_eq_mask(uint8_t a, uint8_t b) +{ + uint8_t x = a ^ b; + uint8_t minus_x = ~x + (uint8_t)1U; + uint8_t x_or_minus_x = x | minus_x; + uint8_t xnx = x_or_minus_x >> (uint32_t)7U; + return xnx - (uint8_t)1U; +} + +uint8_t FStar_UInt8_gte_mask(uint8_t a, uint8_t b) +{ + uint8_t x = a; + uint8_t y = b; + uint8_t x_xor_y = x ^ y; + uint8_t x_sub_y = x - y; + uint8_t x_sub_y_xor_y = x_sub_y ^ y; + uint8_t q = x_xor_y | x_sub_y_xor_y; + uint8_t x_xor_q = x ^ q; + uint8_t x_xor_q_ = x_xor_q >> (uint32_t)7U; + return x_xor_q_ - (uint8_t)1U; +} + diff --git a/third_party/mbedtls/repo/3rdparty/everest/library/legacy/Hacl_Curve25519.c b/third_party/mbedtls/repo/3rdparty/everest/library/legacy/Hacl_Curve25519.c new file mode 100644 index 000000000..babebe4f1 --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/library/legacy/Hacl_Curve25519.c @@ -0,0 +1,805 @@ +/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved. + Licensed under the Apache 2.0 License. */ + +/* This file was generated by KreMLin + * KreMLin invocation: /mnt/e/everest/verify/kremlin/krml -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -I /mnt/e/everest/verify/hacl-star/code/lib/kremlin -I /mnt/e/everest/verify/kremlin/kremlib/compat -I /mnt/e/everest/verify/hacl-star/specs -I /mnt/e/everest/verify/hacl-star/specs/old -I . -ccopt -march=native -verbose -ldopt -flto -tmpdir x25519-c -I ../bignum -bundle Hacl.Curve25519=* -minimal -add-include "kremlib.h" -skip-compilation x25519-c/out.krml -o x25519-c/Hacl_Curve25519.c + * F* version: 059db0c8 + * KreMLin version: 916c37ac + */ + + +#include "Hacl_Curve25519.h" + +extern uint64_t FStar_UInt64_eq_mask(uint64_t x0, uint64_t x1); + +extern uint64_t FStar_UInt64_gte_mask(uint64_t x0, uint64_t x1); + +extern FStar_UInt128_uint128 +FStar_UInt128_add(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +extern FStar_UInt128_uint128 +FStar_UInt128_add_mod(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +extern FStar_UInt128_uint128 +FStar_UInt128_logand(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1); + +extern FStar_UInt128_uint128 FStar_UInt128_shift_right(FStar_UInt128_uint128 x0, uint32_t x1); + +extern FStar_UInt128_uint128 FStar_UInt128_uint64_to_uint128(uint64_t x0); + +extern uint64_t FStar_UInt128_uint128_to_uint64(FStar_UInt128_uint128 x0); + +extern FStar_UInt128_uint128 FStar_UInt128_mul_wide(uint64_t x0, uint64_t x1); + +static void Hacl_Bignum_Modulo_carry_top(uint64_t *b) +{ + uint64_t b4 = b[4U]; + uint64_t b0 = b[0U]; + uint64_t b4_ = b4 & (uint64_t)0x7ffffffffffffU; + uint64_t b0_ = b0 + (uint64_t)19U * (b4 >> (uint32_t)51U); + b[4U] = b4_; + b[0U] = b0_; +} + +inline static void +Hacl_Bignum_Fproduct_copy_from_wide_(uint64_t *output, FStar_UInt128_uint128 *input) +{ + uint32_t i; + for (i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U) + { + FStar_UInt128_uint128 xi = input[i]; + output[i] = FStar_UInt128_uint128_to_uint64(xi); + } +} + +inline static void +Hacl_Bignum_Fproduct_sum_scalar_multiplication_( + FStar_UInt128_uint128 *output, + uint64_t *input, + uint64_t s +) +{ + uint32_t i; + for (i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U) + { + FStar_UInt128_uint128 xi = output[i]; + uint64_t yi = input[i]; + output[i] = FStar_UInt128_add_mod(xi, FStar_UInt128_mul_wide(yi, s)); + } +} + +inline static void Hacl_Bignum_Fproduct_carry_wide_(FStar_UInt128_uint128 *tmp) +{ + uint32_t i; + for (i = (uint32_t)0U; i < (uint32_t)4U; i = i + (uint32_t)1U) + { + uint32_t ctr = i; + FStar_UInt128_uint128 tctr = tmp[ctr]; + FStar_UInt128_uint128 tctrp1 = tmp[ctr + (uint32_t)1U]; + uint64_t r0 = FStar_UInt128_uint128_to_uint64(tctr) & (uint64_t)0x7ffffffffffffU; + FStar_UInt128_uint128 c = FStar_UInt128_shift_right(tctr, (uint32_t)51U); + tmp[ctr] = FStar_UInt128_uint64_to_uint128(r0); + tmp[ctr + (uint32_t)1U] = FStar_UInt128_add(tctrp1, c); + } +} + +inline static void Hacl_Bignum_Fmul_shift_reduce(uint64_t *output) +{ + uint64_t tmp = output[4U]; + uint64_t b0; + { + uint32_t i; + for (i = (uint32_t)0U; i < (uint32_t)4U; i = i + (uint32_t)1U) + { + uint32_t ctr = (uint32_t)5U - i - (uint32_t)1U; + uint64_t z = output[ctr - (uint32_t)1U]; + output[ctr] = z; + } + } + output[0U] = tmp; + b0 = output[0U]; + output[0U] = (uint64_t)19U * b0; +} + +static void +Hacl_Bignum_Fmul_mul_shift_reduce_( + FStar_UInt128_uint128 *output, + uint64_t *input, + uint64_t *input2 +) +{ + uint32_t i; + uint64_t input2i; + { + uint32_t i0; + for (i0 = (uint32_t)0U; i0 < (uint32_t)4U; i0 = i0 + (uint32_t)1U) + { + uint64_t input2i0 = input2[i0]; + Hacl_Bignum_Fproduct_sum_scalar_multiplication_(output, input, input2i0); + Hacl_Bignum_Fmul_shift_reduce(input); + } + } + i = (uint32_t)4U; + input2i = input2[i]; + Hacl_Bignum_Fproduct_sum_scalar_multiplication_(output, input, input2i); +} + +inline static void Hacl_Bignum_Fmul_fmul(uint64_t *output, uint64_t *input, uint64_t *input2) +{ + uint64_t tmp[5U] = { 0U }; + memcpy(tmp, input, (uint32_t)5U * sizeof input[0U]); + KRML_CHECK_SIZE(sizeof (FStar_UInt128_uint128), (uint32_t)5U); + { + FStar_UInt128_uint128 t[5U]; + { + uint32_t _i; + for (_i = 0U; _i < (uint32_t)5U; ++_i) + t[_i] = FStar_UInt128_uint64_to_uint128((uint64_t)0U); + } + { + FStar_UInt128_uint128 b4; + FStar_UInt128_uint128 b0; + FStar_UInt128_uint128 b4_; + FStar_UInt128_uint128 b0_; + uint64_t i0; + uint64_t i1; + uint64_t i0_; + uint64_t i1_; + Hacl_Bignum_Fmul_mul_shift_reduce_(t, tmp, input2); + Hacl_Bignum_Fproduct_carry_wide_(t); + b4 = t[4U]; + b0 = t[0U]; + b4_ = FStar_UInt128_logand(b4, FStar_UInt128_uint64_to_uint128((uint64_t)0x7ffffffffffffU)); + b0_ = + FStar_UInt128_add(b0, + FStar_UInt128_mul_wide((uint64_t)19U, + FStar_UInt128_uint128_to_uint64(FStar_UInt128_shift_right(b4, (uint32_t)51U)))); + t[4U] = b4_; + t[0U] = b0_; + Hacl_Bignum_Fproduct_copy_from_wide_(output, t); + i0 = output[0U]; + i1 = output[1U]; + i0_ = i0 & (uint64_t)0x7ffffffffffffU; + i1_ = i1 + (i0 >> (uint32_t)51U); + output[0U] = i0_; + output[1U] = i1_; + } + } +} + +inline static void Hacl_Bignum_Fsquare_fsquare__(FStar_UInt128_uint128 *tmp, uint64_t *output) +{ + uint64_t r0 = output[0U]; + uint64_t r1 = output[1U]; + uint64_t r2 = output[2U]; + uint64_t r3 = output[3U]; + uint64_t r4 = output[4U]; + uint64_t d0 = r0 * (uint64_t)2U; + uint64_t d1 = r1 * (uint64_t)2U; + uint64_t d2 = r2 * (uint64_t)2U * (uint64_t)19U; + uint64_t d419 = r4 * (uint64_t)19U; + uint64_t d4 = d419 * (uint64_t)2U; + FStar_UInt128_uint128 + s0 = + FStar_UInt128_add(FStar_UInt128_add(FStar_UInt128_mul_wide(r0, r0), + FStar_UInt128_mul_wide(d4, r1)), + FStar_UInt128_mul_wide(d2, r3)); + FStar_UInt128_uint128 + s1 = + FStar_UInt128_add(FStar_UInt128_add(FStar_UInt128_mul_wide(d0, r1), + FStar_UInt128_mul_wide(d4, r2)), + FStar_UInt128_mul_wide(r3 * (uint64_t)19U, r3)); + FStar_UInt128_uint128 + s2 = + FStar_UInt128_add(FStar_UInt128_add(FStar_UInt128_mul_wide(d0, r2), + FStar_UInt128_mul_wide(r1, r1)), + FStar_UInt128_mul_wide(d4, r3)); + FStar_UInt128_uint128 + s3 = + FStar_UInt128_add(FStar_UInt128_add(FStar_UInt128_mul_wide(d0, r3), + FStar_UInt128_mul_wide(d1, r2)), + FStar_UInt128_mul_wide(r4, d419)); + FStar_UInt128_uint128 + s4 = + FStar_UInt128_add(FStar_UInt128_add(FStar_UInt128_mul_wide(d0, r4), + FStar_UInt128_mul_wide(d1, r3)), + FStar_UInt128_mul_wide(r2, r2)); + tmp[0U] = s0; + tmp[1U] = s1; + tmp[2U] = s2; + tmp[3U] = s3; + tmp[4U] = s4; +} + +inline static void Hacl_Bignum_Fsquare_fsquare_(FStar_UInt128_uint128 *tmp, uint64_t *output) +{ + FStar_UInt128_uint128 b4; + FStar_UInt128_uint128 b0; + FStar_UInt128_uint128 b4_; + FStar_UInt128_uint128 b0_; + uint64_t i0; + uint64_t i1; + uint64_t i0_; + uint64_t i1_; + Hacl_Bignum_Fsquare_fsquare__(tmp, output); + Hacl_Bignum_Fproduct_carry_wide_(tmp); + b4 = tmp[4U]; + b0 = tmp[0U]; + b4_ = FStar_UInt128_logand(b4, FStar_UInt128_uint64_to_uint128((uint64_t)0x7ffffffffffffU)); + b0_ = + FStar_UInt128_add(b0, + FStar_UInt128_mul_wide((uint64_t)19U, + FStar_UInt128_uint128_to_uint64(FStar_UInt128_shift_right(b4, (uint32_t)51U)))); + tmp[4U] = b4_; + tmp[0U] = b0_; + Hacl_Bignum_Fproduct_copy_from_wide_(output, tmp); + i0 = output[0U]; + i1 = output[1U]; + i0_ = i0 & (uint64_t)0x7ffffffffffffU; + i1_ = i1 + (i0 >> (uint32_t)51U); + output[0U] = i0_; + output[1U] = i1_; +} + +static void +Hacl_Bignum_Fsquare_fsquare_times_( + uint64_t *input, + FStar_UInt128_uint128 *tmp, + uint32_t count1 +) +{ + uint32_t i; + Hacl_Bignum_Fsquare_fsquare_(tmp, input); + for (i = (uint32_t)1U; i < count1; i = i + (uint32_t)1U) + Hacl_Bignum_Fsquare_fsquare_(tmp, input); +} + +inline static void +Hacl_Bignum_Fsquare_fsquare_times(uint64_t *output, uint64_t *input, uint32_t count1) +{ + KRML_CHECK_SIZE(sizeof (FStar_UInt128_uint128), (uint32_t)5U); + { + FStar_UInt128_uint128 t[5U]; + { + uint32_t _i; + for (_i = 0U; _i < (uint32_t)5U; ++_i) + t[_i] = FStar_UInt128_uint64_to_uint128((uint64_t)0U); + } + memcpy(output, input, (uint32_t)5U * sizeof input[0U]); + Hacl_Bignum_Fsquare_fsquare_times_(output, t, count1); + } +} + +inline static void Hacl_Bignum_Fsquare_fsquare_times_inplace(uint64_t *output, uint32_t count1) +{ + KRML_CHECK_SIZE(sizeof (FStar_UInt128_uint128), (uint32_t)5U); + { + FStar_UInt128_uint128 t[5U]; + { + uint32_t _i; + for (_i = 0U; _i < (uint32_t)5U; ++_i) + t[_i] = FStar_UInt128_uint64_to_uint128((uint64_t)0U); + } + Hacl_Bignum_Fsquare_fsquare_times_(output, t, count1); + } +} + +inline static void Hacl_Bignum_Crecip_crecip(uint64_t *out, uint64_t *z) +{ + uint64_t buf[20U] = { 0U }; + uint64_t *a0 = buf; + uint64_t *t00 = buf + (uint32_t)5U; + uint64_t *b0 = buf + (uint32_t)10U; + uint64_t *t01; + uint64_t *b1; + uint64_t *c0; + uint64_t *a; + uint64_t *t0; + uint64_t *b; + uint64_t *c; + Hacl_Bignum_Fsquare_fsquare_times(a0, z, (uint32_t)1U); + Hacl_Bignum_Fsquare_fsquare_times(t00, a0, (uint32_t)2U); + Hacl_Bignum_Fmul_fmul(b0, t00, z); + Hacl_Bignum_Fmul_fmul(a0, b0, a0); + Hacl_Bignum_Fsquare_fsquare_times(t00, a0, (uint32_t)1U); + Hacl_Bignum_Fmul_fmul(b0, t00, b0); + Hacl_Bignum_Fsquare_fsquare_times(t00, b0, (uint32_t)5U); + t01 = buf + (uint32_t)5U; + b1 = buf + (uint32_t)10U; + c0 = buf + (uint32_t)15U; + Hacl_Bignum_Fmul_fmul(b1, t01, b1); + Hacl_Bignum_Fsquare_fsquare_times(t01, b1, (uint32_t)10U); + Hacl_Bignum_Fmul_fmul(c0, t01, b1); + Hacl_Bignum_Fsquare_fsquare_times(t01, c0, (uint32_t)20U); + Hacl_Bignum_Fmul_fmul(t01, t01, c0); + Hacl_Bignum_Fsquare_fsquare_times_inplace(t01, (uint32_t)10U); + Hacl_Bignum_Fmul_fmul(b1, t01, b1); + Hacl_Bignum_Fsquare_fsquare_times(t01, b1, (uint32_t)50U); + a = buf; + t0 = buf + (uint32_t)5U; + b = buf + (uint32_t)10U; + c = buf + (uint32_t)15U; + Hacl_Bignum_Fmul_fmul(c, t0, b); + Hacl_Bignum_Fsquare_fsquare_times(t0, c, (uint32_t)100U); + Hacl_Bignum_Fmul_fmul(t0, t0, c); + Hacl_Bignum_Fsquare_fsquare_times_inplace(t0, (uint32_t)50U); + Hacl_Bignum_Fmul_fmul(t0, t0, b); + Hacl_Bignum_Fsquare_fsquare_times_inplace(t0, (uint32_t)5U); + Hacl_Bignum_Fmul_fmul(out, t0, a); +} + +inline static void Hacl_Bignum_fsum(uint64_t *a, uint64_t *b) +{ + uint32_t i; + for (i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U) + { + uint64_t xi = a[i]; + uint64_t yi = b[i]; + a[i] = xi + yi; + } +} + +inline static void Hacl_Bignum_fdifference(uint64_t *a, uint64_t *b) +{ + uint64_t tmp[5U] = { 0U }; + uint64_t b0; + uint64_t b1; + uint64_t b2; + uint64_t b3; + uint64_t b4; + memcpy(tmp, b, (uint32_t)5U * sizeof b[0U]); + b0 = tmp[0U]; + b1 = tmp[1U]; + b2 = tmp[2U]; + b3 = tmp[3U]; + b4 = tmp[4U]; + tmp[0U] = b0 + (uint64_t)0x3fffffffffff68U; + tmp[1U] = b1 + (uint64_t)0x3ffffffffffff8U; + tmp[2U] = b2 + (uint64_t)0x3ffffffffffff8U; + tmp[3U] = b3 + (uint64_t)0x3ffffffffffff8U; + tmp[4U] = b4 + (uint64_t)0x3ffffffffffff8U; + { + uint32_t i; + for (i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U) + { + uint64_t xi = a[i]; + uint64_t yi = tmp[i]; + a[i] = yi - xi; + } + } +} + +inline static void Hacl_Bignum_fscalar(uint64_t *output, uint64_t *b, uint64_t s) +{ + KRML_CHECK_SIZE(sizeof (FStar_UInt128_uint128), (uint32_t)5U); + { + FStar_UInt128_uint128 tmp[5U]; + { + uint32_t _i; + for (_i = 0U; _i < (uint32_t)5U; ++_i) + tmp[_i] = FStar_UInt128_uint64_to_uint128((uint64_t)0U); + } + { + FStar_UInt128_uint128 b4; + FStar_UInt128_uint128 b0; + FStar_UInt128_uint128 b4_; + FStar_UInt128_uint128 b0_; + { + uint32_t i; + for (i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U) + { + uint64_t xi = b[i]; + tmp[i] = FStar_UInt128_mul_wide(xi, s); + } + } + Hacl_Bignum_Fproduct_carry_wide_(tmp); + b4 = tmp[4U]; + b0 = tmp[0U]; + b4_ = FStar_UInt128_logand(b4, FStar_UInt128_uint64_to_uint128((uint64_t)0x7ffffffffffffU)); + b0_ = + FStar_UInt128_add(b0, + FStar_UInt128_mul_wide((uint64_t)19U, + FStar_UInt128_uint128_to_uint64(FStar_UInt128_shift_right(b4, (uint32_t)51U)))); + tmp[4U] = b4_; + tmp[0U] = b0_; + Hacl_Bignum_Fproduct_copy_from_wide_(output, tmp); + } + } +} + +inline static void Hacl_Bignum_fmul(uint64_t *output, uint64_t *a, uint64_t *b) +{ + Hacl_Bignum_Fmul_fmul(output, a, b); +} + +inline static void Hacl_Bignum_crecip(uint64_t *output, uint64_t *input) +{ + Hacl_Bignum_Crecip_crecip(output, input); +} + +static void +Hacl_EC_Point_swap_conditional_step(uint64_t *a, uint64_t *b, uint64_t swap1, uint32_t ctr) +{ + uint32_t i = ctr - (uint32_t)1U; + uint64_t ai = a[i]; + uint64_t bi = b[i]; + uint64_t x = swap1 & (ai ^ bi); + uint64_t ai1 = ai ^ x; + uint64_t bi1 = bi ^ x; + a[i] = ai1; + b[i] = bi1; +} + +static void +Hacl_EC_Point_swap_conditional_(uint64_t *a, uint64_t *b, uint64_t swap1, uint32_t ctr) +{ + if (!(ctr == (uint32_t)0U)) + { + uint32_t i; + Hacl_EC_Point_swap_conditional_step(a, b, swap1, ctr); + i = ctr - (uint32_t)1U; + Hacl_EC_Point_swap_conditional_(a, b, swap1, i); + } +} + +static void Hacl_EC_Point_swap_conditional(uint64_t *a, uint64_t *b, uint64_t iswap) +{ + uint64_t swap1 = (uint64_t)0U - iswap; + Hacl_EC_Point_swap_conditional_(a, b, swap1, (uint32_t)5U); + Hacl_EC_Point_swap_conditional_(a + (uint32_t)5U, b + (uint32_t)5U, swap1, (uint32_t)5U); +} + +static void Hacl_EC_Point_copy(uint64_t *output, uint64_t *input) +{ + memcpy(output, input, (uint32_t)5U * sizeof input[0U]); + memcpy(output + (uint32_t)5U, + input + (uint32_t)5U, + (uint32_t)5U * sizeof (input + (uint32_t)5U)[0U]); +} + +static void Hacl_EC_Format_fexpand(uint64_t *output, uint8_t *input) +{ + uint64_t i0 = load64_le(input); + uint8_t *x00 = input + (uint32_t)6U; + uint64_t i1 = load64_le(x00); + uint8_t *x01 = input + (uint32_t)12U; + uint64_t i2 = load64_le(x01); + uint8_t *x02 = input + (uint32_t)19U; + uint64_t i3 = load64_le(x02); + uint8_t *x0 = input + (uint32_t)24U; + uint64_t i4 = load64_le(x0); + uint64_t output0 = i0 & (uint64_t)0x7ffffffffffffU; + uint64_t output1 = i1 >> (uint32_t)3U & (uint64_t)0x7ffffffffffffU; + uint64_t output2 = i2 >> (uint32_t)6U & (uint64_t)0x7ffffffffffffU; + uint64_t output3 = i3 >> (uint32_t)1U & (uint64_t)0x7ffffffffffffU; + uint64_t output4 = i4 >> (uint32_t)12U & (uint64_t)0x7ffffffffffffU; + output[0U] = output0; + output[1U] = output1; + output[2U] = output2; + output[3U] = output3; + output[4U] = output4; +} + +static void Hacl_EC_Format_fcontract_first_carry_pass(uint64_t *input) +{ + uint64_t t0 = input[0U]; + uint64_t t1 = input[1U]; + uint64_t t2 = input[2U]; + uint64_t t3 = input[3U]; + uint64_t t4 = input[4U]; + uint64_t t1_ = t1 + (t0 >> (uint32_t)51U); + uint64_t t0_ = t0 & (uint64_t)0x7ffffffffffffU; + uint64_t t2_ = t2 + (t1_ >> (uint32_t)51U); + uint64_t t1__ = t1_ & (uint64_t)0x7ffffffffffffU; + uint64_t t3_ = t3 + (t2_ >> (uint32_t)51U); + uint64_t t2__ = t2_ & (uint64_t)0x7ffffffffffffU; + uint64_t t4_ = t4 + (t3_ >> (uint32_t)51U); + uint64_t t3__ = t3_ & (uint64_t)0x7ffffffffffffU; + input[0U] = t0_; + input[1U] = t1__; + input[2U] = t2__; + input[3U] = t3__; + input[4U] = t4_; +} + +static void Hacl_EC_Format_fcontract_first_carry_full(uint64_t *input) +{ + Hacl_EC_Format_fcontract_first_carry_pass(input); + Hacl_Bignum_Modulo_carry_top(input); +} + +static void Hacl_EC_Format_fcontract_second_carry_pass(uint64_t *input) +{ + uint64_t t0 = input[0U]; + uint64_t t1 = input[1U]; + uint64_t t2 = input[2U]; + uint64_t t3 = input[3U]; + uint64_t t4 = input[4U]; + uint64_t t1_ = t1 + (t0 >> (uint32_t)51U); + uint64_t t0_ = t0 & (uint64_t)0x7ffffffffffffU; + uint64_t t2_ = t2 + (t1_ >> (uint32_t)51U); + uint64_t t1__ = t1_ & (uint64_t)0x7ffffffffffffU; + uint64_t t3_ = t3 + (t2_ >> (uint32_t)51U); + uint64_t t2__ = t2_ & (uint64_t)0x7ffffffffffffU; + uint64_t t4_ = t4 + (t3_ >> (uint32_t)51U); + uint64_t t3__ = t3_ & (uint64_t)0x7ffffffffffffU; + input[0U] = t0_; + input[1U] = t1__; + input[2U] = t2__; + input[3U] = t3__; + input[4U] = t4_; +} + +static void Hacl_EC_Format_fcontract_second_carry_full(uint64_t *input) +{ + uint64_t i0; + uint64_t i1; + uint64_t i0_; + uint64_t i1_; + Hacl_EC_Format_fcontract_second_carry_pass(input); + Hacl_Bignum_Modulo_carry_top(input); + i0 = input[0U]; + i1 = input[1U]; + i0_ = i0 & (uint64_t)0x7ffffffffffffU; + i1_ = i1 + (i0 >> (uint32_t)51U); + input[0U] = i0_; + input[1U] = i1_; +} + +static void Hacl_EC_Format_fcontract_trim(uint64_t *input) +{ + uint64_t a0 = input[0U]; + uint64_t a1 = input[1U]; + uint64_t a2 = input[2U]; + uint64_t a3 = input[3U]; + uint64_t a4 = input[4U]; + uint64_t mask0 = FStar_UInt64_gte_mask(a0, (uint64_t)0x7ffffffffffedU); + uint64_t mask1 = FStar_UInt64_eq_mask(a1, (uint64_t)0x7ffffffffffffU); + uint64_t mask2 = FStar_UInt64_eq_mask(a2, (uint64_t)0x7ffffffffffffU); + uint64_t mask3 = FStar_UInt64_eq_mask(a3, (uint64_t)0x7ffffffffffffU); + uint64_t mask4 = FStar_UInt64_eq_mask(a4, (uint64_t)0x7ffffffffffffU); + uint64_t mask = (((mask0 & mask1) & mask2) & mask3) & mask4; + uint64_t a0_ = a0 - ((uint64_t)0x7ffffffffffedU & mask); + uint64_t a1_ = a1 - ((uint64_t)0x7ffffffffffffU & mask); + uint64_t a2_ = a2 - ((uint64_t)0x7ffffffffffffU & mask); + uint64_t a3_ = a3 - ((uint64_t)0x7ffffffffffffU & mask); + uint64_t a4_ = a4 - ((uint64_t)0x7ffffffffffffU & mask); + input[0U] = a0_; + input[1U] = a1_; + input[2U] = a2_; + input[3U] = a3_; + input[4U] = a4_; +} + +static void Hacl_EC_Format_fcontract_store(uint8_t *output, uint64_t *input) +{ + uint64_t t0 = input[0U]; + uint64_t t1 = input[1U]; + uint64_t t2 = input[2U]; + uint64_t t3 = input[3U]; + uint64_t t4 = input[4U]; + uint64_t o0 = t1 << (uint32_t)51U | t0; + uint64_t o1 = t2 << (uint32_t)38U | t1 >> (uint32_t)13U; + uint64_t o2 = t3 << (uint32_t)25U | t2 >> (uint32_t)26U; + uint64_t o3 = t4 << (uint32_t)12U | t3 >> (uint32_t)39U; + uint8_t *b0 = output; + uint8_t *b1 = output + (uint32_t)8U; + uint8_t *b2 = output + (uint32_t)16U; + uint8_t *b3 = output + (uint32_t)24U; + store64_le(b0, o0); + store64_le(b1, o1); + store64_le(b2, o2); + store64_le(b3, o3); +} + +static void Hacl_EC_Format_fcontract(uint8_t *output, uint64_t *input) +{ + Hacl_EC_Format_fcontract_first_carry_full(input); + Hacl_EC_Format_fcontract_second_carry_full(input); + Hacl_EC_Format_fcontract_trim(input); + Hacl_EC_Format_fcontract_store(output, input); +} + +static void Hacl_EC_Format_scalar_of_point(uint8_t *scalar, uint64_t *point) +{ + uint64_t *x = point; + uint64_t *z = point + (uint32_t)5U; + uint64_t buf[10U] = { 0U }; + uint64_t *zmone = buf; + uint64_t *sc = buf + (uint32_t)5U; + Hacl_Bignum_crecip(zmone, z); + Hacl_Bignum_fmul(sc, x, zmone); + Hacl_EC_Format_fcontract(scalar, sc); +} + +static void +Hacl_EC_AddAndDouble_fmonty( + uint64_t *pp, + uint64_t *ppq, + uint64_t *p, + uint64_t *pq, + uint64_t *qmqp +) +{ + uint64_t *qx = qmqp; + uint64_t *x2 = pp; + uint64_t *z2 = pp + (uint32_t)5U; + uint64_t *x3 = ppq; + uint64_t *z3 = ppq + (uint32_t)5U; + uint64_t *x = p; + uint64_t *z = p + (uint32_t)5U; + uint64_t *xprime = pq; + uint64_t *zprime = pq + (uint32_t)5U; + uint64_t buf[40U] = { 0U }; + uint64_t *origx = buf; + uint64_t *origxprime0 = buf + (uint32_t)5U; + uint64_t *xxprime0 = buf + (uint32_t)25U; + uint64_t *zzprime0 = buf + (uint32_t)30U; + uint64_t *origxprime; + uint64_t *xx0; + uint64_t *zz0; + uint64_t *xxprime; + uint64_t *zzprime; + uint64_t *zzzprime; + uint64_t *zzz; + uint64_t *xx; + uint64_t *zz; + uint64_t scalar; + memcpy(origx, x, (uint32_t)5U * sizeof x[0U]); + Hacl_Bignum_fsum(x, z); + Hacl_Bignum_fdifference(z, origx); + memcpy(origxprime0, xprime, (uint32_t)5U * sizeof xprime[0U]); + Hacl_Bignum_fsum(xprime, zprime); + Hacl_Bignum_fdifference(zprime, origxprime0); + Hacl_Bignum_fmul(xxprime0, xprime, z); + Hacl_Bignum_fmul(zzprime0, x, zprime); + origxprime = buf + (uint32_t)5U; + xx0 = buf + (uint32_t)15U; + zz0 = buf + (uint32_t)20U; + xxprime = buf + (uint32_t)25U; + zzprime = buf + (uint32_t)30U; + zzzprime = buf + (uint32_t)35U; + memcpy(origxprime, xxprime, (uint32_t)5U * sizeof xxprime[0U]); + Hacl_Bignum_fsum(xxprime, zzprime); + Hacl_Bignum_fdifference(zzprime, origxprime); + Hacl_Bignum_Fsquare_fsquare_times(x3, xxprime, (uint32_t)1U); + Hacl_Bignum_Fsquare_fsquare_times(zzzprime, zzprime, (uint32_t)1U); + Hacl_Bignum_fmul(z3, zzzprime, qx); + Hacl_Bignum_Fsquare_fsquare_times(xx0, x, (uint32_t)1U); + Hacl_Bignum_Fsquare_fsquare_times(zz0, z, (uint32_t)1U); + zzz = buf + (uint32_t)10U; + xx = buf + (uint32_t)15U; + zz = buf + (uint32_t)20U; + Hacl_Bignum_fmul(x2, xx, zz); + Hacl_Bignum_fdifference(zz, xx); + scalar = (uint64_t)121665U; + Hacl_Bignum_fscalar(zzz, zz, scalar); + Hacl_Bignum_fsum(zzz, xx); + Hacl_Bignum_fmul(z2, zzz, zz); +} + +static void +Hacl_EC_Ladder_SmallLoop_cmult_small_loop_step( + uint64_t *nq, + uint64_t *nqpq, + uint64_t *nq2, + uint64_t *nqpq2, + uint64_t *q, + uint8_t byt +) +{ + uint64_t bit0 = (uint64_t)(byt >> (uint32_t)7U); + uint64_t bit; + Hacl_EC_Point_swap_conditional(nq, nqpq, bit0); + Hacl_EC_AddAndDouble_fmonty(nq2, nqpq2, nq, nqpq, q); + bit = (uint64_t)(byt >> (uint32_t)7U); + Hacl_EC_Point_swap_conditional(nq2, nqpq2, bit); +} + +static void +Hacl_EC_Ladder_SmallLoop_cmult_small_loop_double_step( + uint64_t *nq, + uint64_t *nqpq, + uint64_t *nq2, + uint64_t *nqpq2, + uint64_t *q, + uint8_t byt +) +{ + uint8_t byt1; + Hacl_EC_Ladder_SmallLoop_cmult_small_loop_step(nq, nqpq, nq2, nqpq2, q, byt); + byt1 = byt << (uint32_t)1U; + Hacl_EC_Ladder_SmallLoop_cmult_small_loop_step(nq2, nqpq2, nq, nqpq, q, byt1); +} + +static void +Hacl_EC_Ladder_SmallLoop_cmult_small_loop( + uint64_t *nq, + uint64_t *nqpq, + uint64_t *nq2, + uint64_t *nqpq2, + uint64_t *q, + uint8_t byt, + uint32_t i +) +{ + if (!(i == (uint32_t)0U)) + { + uint32_t i_ = i - (uint32_t)1U; + uint8_t byt_; + Hacl_EC_Ladder_SmallLoop_cmult_small_loop_double_step(nq, nqpq, nq2, nqpq2, q, byt); + byt_ = byt << (uint32_t)2U; + Hacl_EC_Ladder_SmallLoop_cmult_small_loop(nq, nqpq, nq2, nqpq2, q, byt_, i_); + } +} + +static void +Hacl_EC_Ladder_BigLoop_cmult_big_loop( + uint8_t *n1, + uint64_t *nq, + uint64_t *nqpq, + uint64_t *nq2, + uint64_t *nqpq2, + uint64_t *q, + uint32_t i +) +{ + if (!(i == (uint32_t)0U)) + { + uint32_t i1 = i - (uint32_t)1U; + uint8_t byte = n1[i1]; + Hacl_EC_Ladder_SmallLoop_cmult_small_loop(nq, nqpq, nq2, nqpq2, q, byte, (uint32_t)4U); + Hacl_EC_Ladder_BigLoop_cmult_big_loop(n1, nq, nqpq, nq2, nqpq2, q, i1); + } +} + +static void Hacl_EC_Ladder_cmult(uint64_t *result, uint8_t *n1, uint64_t *q) +{ + uint64_t point_buf[40U] = { 0U }; + uint64_t *nq = point_buf; + uint64_t *nqpq = point_buf + (uint32_t)10U; + uint64_t *nq2 = point_buf + (uint32_t)20U; + uint64_t *nqpq2 = point_buf + (uint32_t)30U; + Hacl_EC_Point_copy(nqpq, q); + nq[0U] = (uint64_t)1U; + Hacl_EC_Ladder_BigLoop_cmult_big_loop(n1, nq, nqpq, nq2, nqpq2, q, (uint32_t)32U); + Hacl_EC_Point_copy(result, nq); +} + +void Hacl_Curve25519_crypto_scalarmult(uint8_t *mypublic, uint8_t *secret, uint8_t *basepoint) +{ + uint64_t buf0[10U] = { 0U }; + uint64_t *x0 = buf0; + uint64_t *z = buf0 + (uint32_t)5U; + uint64_t *q; + Hacl_EC_Format_fexpand(x0, basepoint); + z[0U] = (uint64_t)1U; + q = buf0; + { + uint8_t e[32U] = { 0U }; + uint8_t e0; + uint8_t e31; + uint8_t e01; + uint8_t e311; + uint8_t e312; + uint8_t *scalar; + memcpy(e, secret, (uint32_t)32U * sizeof secret[0U]); + e0 = e[0U]; + e31 = e[31U]; + e01 = e0 & (uint8_t)248U; + e311 = e31 & (uint8_t)127U; + e312 = e311 | (uint8_t)64U; + e[0U] = e01; + e[31U] = e312; + scalar = e; + { + uint64_t buf[15U] = { 0U }; + uint64_t *nq = buf; + uint64_t *x = nq; + x[0U] = (uint64_t)1U; + Hacl_EC_Ladder_cmult(nq, scalar, q); + Hacl_EC_Format_scalar_of_point(mypublic, nq); + } + } +} + diff --git a/third_party/mbedtls/repo/3rdparty/everest/library/x25519.c b/third_party/mbedtls/repo/3rdparty/everest/library/x25519.c new file mode 100644 index 000000000..9faa9ab7d --- /dev/null +++ b/third_party/mbedtls/repo/3rdparty/everest/library/x25519.c @@ -0,0 +1,186 @@ +/* + * ECDH with curve-optimized implementation multiplexing + * + * Copyright 2016-2018 INRIA and Microsoft Corporation + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * This file is part of mbed TLS (https://tls.mbed.org) + */ + +#include "common.h" + +#if defined(MBEDTLS_ECDH_C) && defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) + +#include + +#if !(defined(__SIZEOF_INT128__) && (__SIZEOF_INT128__ == 16)) +#define KRML_VERIFIED_UINT128 +#endif + +#include +#include + +#include "x25519.h" + +#include + +/* + * Initialize context + */ +void mbedtls_x25519_init( mbedtls_x25519_context *ctx ) +{ + mbedtls_platform_zeroize( ctx, sizeof( mbedtls_x25519_context ) ); +} + +/* + * Free context + */ +void mbedtls_x25519_free( mbedtls_x25519_context *ctx ) +{ + if( ctx == NULL ) + return; + + mbedtls_platform_zeroize( ctx->our_secret, MBEDTLS_X25519_KEY_SIZE_BYTES ); + mbedtls_platform_zeroize( ctx->peer_point, MBEDTLS_X25519_KEY_SIZE_BYTES ); +} + +int mbedtls_x25519_make_params( mbedtls_x25519_context *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int( *f_rng )(void *, unsigned char *, size_t), + void *p_rng ) +{ + int ret = 0; + + uint8_t base[MBEDTLS_X25519_KEY_SIZE_BYTES] = {0}; + + if( ( ret = f_rng( p_rng, ctx->our_secret, MBEDTLS_X25519_KEY_SIZE_BYTES ) ) != 0 ) + return ret; + + *olen = MBEDTLS_X25519_KEY_SIZE_BYTES + 4; + if( blen < *olen ) + return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); + + *buf++ = MBEDTLS_ECP_TLS_NAMED_CURVE; + *buf++ = MBEDTLS_ECP_TLS_CURVE25519 >> 8; + *buf++ = MBEDTLS_ECP_TLS_CURVE25519 & 0xFF; + *buf++ = MBEDTLS_X25519_KEY_SIZE_BYTES; + + base[0] = 9; + Hacl_Curve25519_crypto_scalarmult( buf, ctx->our_secret, base ); + + base[0] = 0; + if( memcmp( buf, base, MBEDTLS_X25519_KEY_SIZE_BYTES) == 0 ) + return MBEDTLS_ERR_ECP_RANDOM_FAILED; + + return( 0 ); +} + +int mbedtls_x25519_read_params( mbedtls_x25519_context *ctx, + const unsigned char **buf, const unsigned char *end ) +{ + if( end - *buf < MBEDTLS_X25519_KEY_SIZE_BYTES + 1 ) + return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); + + if( ( *(*buf)++ != MBEDTLS_X25519_KEY_SIZE_BYTES ) ) + return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); + + memcpy( ctx->peer_point, *buf, MBEDTLS_X25519_KEY_SIZE_BYTES ); + *buf += MBEDTLS_X25519_KEY_SIZE_BYTES; + return( 0 ); +} + +int mbedtls_x25519_get_params( mbedtls_x25519_context *ctx, const mbedtls_ecp_keypair *key, + mbedtls_x25519_ecdh_side side ) +{ + size_t olen = 0; + + switch( side ) { + case MBEDTLS_X25519_ECDH_THEIRS: + return mbedtls_ecp_point_write_binary( &key->grp, &key->Q, MBEDTLS_ECP_PF_COMPRESSED, &olen, ctx->peer_point, MBEDTLS_X25519_KEY_SIZE_BYTES ); + case MBEDTLS_X25519_ECDH_OURS: + return mbedtls_mpi_write_binary_le( &key->d, ctx->our_secret, MBEDTLS_X25519_KEY_SIZE_BYTES ); + default: + return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); + } +} + +int mbedtls_x25519_calc_secret( mbedtls_x25519_context *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int( *f_rng )(void *, unsigned char *, size_t), + void *p_rng ) +{ + /* f_rng and p_rng are not used here because this implementation does not + need blinding since it has constant trace. */ + (( void )f_rng); + (( void )p_rng); + + *olen = MBEDTLS_X25519_KEY_SIZE_BYTES; + + if( blen < *olen ) + return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); + + Hacl_Curve25519_crypto_scalarmult( buf, ctx->our_secret, ctx->peer_point); + + /* Wipe the DH secret and don't let the peer chose a small subgroup point */ + mbedtls_platform_zeroize( ctx->our_secret, MBEDTLS_X25519_KEY_SIZE_BYTES ); + + if( memcmp( buf, ctx->our_secret, MBEDTLS_X25519_KEY_SIZE_BYTES) == 0 ) + return MBEDTLS_ERR_ECP_RANDOM_FAILED; + + return( 0 ); +} + +int mbedtls_x25519_make_public( mbedtls_x25519_context *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int( *f_rng )(void *, unsigned char *, size_t), + void *p_rng ) +{ + int ret = 0; + unsigned char base[MBEDTLS_X25519_KEY_SIZE_BYTES] = { 0 }; + + if( ctx == NULL ) + return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); + + if( ( ret = f_rng( p_rng, ctx->our_secret, MBEDTLS_X25519_KEY_SIZE_BYTES ) ) != 0 ) + return ret; + + *olen = MBEDTLS_X25519_KEY_SIZE_BYTES + 1; + if( blen < *olen ) + return(MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL); + *buf++ = MBEDTLS_X25519_KEY_SIZE_BYTES; + + base[0] = 9; + Hacl_Curve25519_crypto_scalarmult( buf, ctx->our_secret, base ); + + base[0] = 0; + if( memcmp( buf, base, MBEDTLS_X25519_KEY_SIZE_BYTES ) == 0 ) + return MBEDTLS_ERR_ECP_RANDOM_FAILED; + + return( ret ); +} + +int mbedtls_x25519_read_public( mbedtls_x25519_context *ctx, + const unsigned char *buf, size_t blen ) +{ + if( blen < MBEDTLS_X25519_KEY_SIZE_BYTES + 1 ) + return(MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL); + if( (*buf++ != MBEDTLS_X25519_KEY_SIZE_BYTES) ) + return(MBEDTLS_ERR_ECP_BAD_INPUT_DATA); + memcpy( ctx->peer_point, buf, MBEDTLS_X25519_KEY_SIZE_BYTES ); + return( 0 ); +} + + +#endif /* MBEDTLS_ECDH_C && MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED */ diff --git a/third_party/mbedtls/repo/CMakeLists.txt b/third_party/mbedtls/repo/CMakeLists.txt index 99bf31f1f..ac24bf41b 100644 --- a/third_party/mbedtls/repo/CMakeLists.txt +++ b/third_party/mbedtls/repo/CMakeLists.txt @@ -1,16 +1,42 @@ -cmake_minimum_required(VERSION 2.6) +# +# CMake build system design considerations: +# +# - Include directories: +# + Do not define include directories globally using the include_directories +# command but rather at the target level using the +# target_include_directories command. That way, it is easier to guarantee +# that targets are built using the proper list of include directories. +# + Use the PUBLIC and PRIVATE keywords to specifiy the scope of include +# directories. That way, a target linking to a library (using the +# target_link_librairies command) inherits from the library PUBLIC include +# directories and not from the PRIVATE ones. +# + Note: there is currently one remaining include_directories command in the +# CMake files. It is related to ZLIB support which is planned to be removed. +# When the support is removed, the associated include_directories command +# will be removed as well as this note. +# - MBEDTLS_TARGET_PREFIX: CMake targets are designed to be alterable by calling +# CMake in order to avoid target name clashes, via the use of +# MBEDTLS_TARGET_PREFIX. The value of this variable is prefixed to the +# mbedtls, mbedx509, mbedcrypto and apidoc targets. +# + +cmake_minimum_required(VERSION 2.8.12) if(TEST_CPP) project("mbed TLS" C CXX) else() project("mbed TLS" C) endif() +# Set the project root directory. +set(MBEDTLS_DIR ${CMAKE_CURRENT_SOURCE_DIR}) + option(USE_PKCS11_HELPER_LIBRARY "Build mbed TLS with the pkcs11-helper library." OFF) option(ENABLE_ZLIB_SUPPORT "Build mbed TLS with zlib library." OFF) option(ENABLE_PROGRAMS "Build mbed TLS programs." ON) option(UNSAFE_BUILD "Allow unsafe builds. These builds ARE NOT SECURE." OFF) +option(MBEDTLS_FATAL_WARNINGS "Compiler warnings treated as errors" ON) string(REGEX MATCH "Clang" CMAKE_COMPILER_IS_CLANG "${CMAKE_C_COMPILER_ID}") string(REGEX MATCH "GNU" CMAKE_COMPILER_IS_GNU "${CMAKE_C_COMPILER_ID}") @@ -46,19 +72,30 @@ set(CTR_DRBG_128_BIT_KEY_WARNING "${WARNING_BORDER}" "${CTR_DRBG_128_BIT_KEY_WARN_L3}" "${WARNING_BORDER}") -find_package(PythonInterp) -find_package(Perl) -if(PERL_FOUND) +# Python 3 is only needed here to check for configuration warnings. +if(NOT CMAKE_VERSION VERSION_LESS 3.15.0) + set(Python3_FIND_STRATEGY LOCATION) + find_package(Python3 COMPONENTS Interpreter) + if(Python3_Interpreter_FOUND) + set(MBEDTLS_PYTHON_EXECUTABLE ${Python3_EXECUTABLE}) + endif() +else() + find_package(PythonInterp 3) + if(PYTHONINTERP_FOUND) + set(MBEDTLS_PYTHON_EXECUTABLE ${PYTHON_EXECUTABLE}) + endif() +endif() +if(MBEDTLS_PYTHON_EXECUTABLE) # If 128-bit keys are configured for CTR_DRBG, display an appropriate warning - execute_process(COMMAND ${PERL_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/scripts/config.pl -f ${CMAKE_CURRENT_SOURCE_DIR}/include/mbedtls/config.h get MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + execute_process(COMMAND ${MBEDTLS_PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/scripts/config.py -f ${CMAKE_CURRENT_SOURCE_DIR}/include/mbedtls/config.h get MBEDTLS_CTR_DRBG_USE_128_BIT_KEY RESULT_VARIABLE result) if(${result} EQUAL 0) message(WARNING ${CTR_DRBG_128_BIT_KEY_WARNING}) endif() # If NULL Entropy is configured, display an appropriate warning - execute_process(COMMAND ${PERL_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/scripts/config.pl -f ${CMAKE_CURRENT_SOURCE_DIR}/include/mbedtls/config.h get MBEDTLS_TEST_NULL_ENTROPY + execute_process(COMMAND ${MBEDTLS_PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/scripts/config.py -f ${CMAKE_CURRENT_SOURCE_DIR}/include/mbedtls/config.h get MBEDTLS_TEST_NULL_ENTROPY RESULT_VARIABLE result) if(${result} EQUAL 0) message(WARNING ${NULL_ENTROPY_WARNING}) @@ -79,16 +116,25 @@ option: \n\ endif() endif() -set(CMAKE_BUILD_TYPE ${CMAKE_BUILD_TYPE} - CACHE STRING "Choose the type of build: None Debug Release Coverage ASan ASanDbg MemSan MemSanDbg Check CheckFull" - FORCE) +# If this is the root project add longer list of available CMAKE_BUILD_TYPE values +if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR) + set(CMAKE_BUILD_TYPE ${CMAKE_BUILD_TYPE} + CACHE STRING "Choose the type of build: None Debug Release Coverage ASan ASanDbg MemSan MemSanDbg Check CheckFull" + FORCE) +endif() # Create a symbolic link from ${base_name} in the binary directory # to the corresponding path in the source directory. function(link_to_source base_name) # Get OS dependent path to use in `execute_process` - file(TO_NATIVE_PATH "${CMAKE_CURRENT_BINARY_DIR}/${base_name}" link) - file(TO_NATIVE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/${base_name}" target) + if (CMAKE_HOST_WIN32) + #mklink is an internal command of cmd.exe it can only work with \ + string(REPLACE "/" "\\" link "${CMAKE_CURRENT_BINARY_DIR}/${base_name}") + string(REPLACE "/" "\\" target "${CMAKE_CURRENT_SOURCE_DIR}/${base_name}") + else() + set(link "${CMAKE_CURRENT_BINARY_DIR}/${base_name}") + set(target "${CMAKE_CURRENT_SOURCE_DIR}/${base_name}") + endif() if (NOT EXISTS ${link}) if (CMAKE_HOST_UNIX) @@ -113,37 +159,48 @@ endfunction(link_to_source) string(REGEX MATCH "Clang" CMAKE_COMPILER_IS_CLANG "${CMAKE_C_COMPILER_ID}") +include(CheckCCompilerFlag) + if(CMAKE_COMPILER_IS_GNU) # some warnings we want are not available with old GCC versions # note: starting with CMake 2.8 we could use CMAKE_C_COMPILER_VERSION execute_process(COMMAND ${CMAKE_C_COMPILER} -dumpversion OUTPUT_VARIABLE GCC_VERSION) - set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -W -Wdeclaration-after-statement -Wwrite-strings") + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -Wwrite-strings") + if (GCC_VERSION VERSION_GREATER 4.3 OR GCC_VERSION VERSION_EQUAL 4.3) + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wvla") + endif() if (GCC_VERSION VERSION_GREATER 4.5 OR GCC_VERSION VERSION_EQUAL 4.5) set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wlogical-op") endif() if (GCC_VERSION VERSION_GREATER 4.8 OR GCC_VERSION VERSION_EQUAL 4.8) set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wshadow") endif() + if (GCC_VERSION VERSION_GREATER 5.0) + CHECK_C_COMPILER_FLAG("-Wformat-signedness" C_COMPILER_SUPPORTS_WFORMAT_SIGNEDNESS) + if(C_COMPILER_SUPPORTS_WFORMAT_SIGNEDNESS) + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wformat-signedness") + endif() + endif() set(CMAKE_C_FLAGS_RELEASE "-O2") set(CMAKE_C_FLAGS_DEBUG "-O0 -g3") set(CMAKE_C_FLAGS_COVERAGE "-O0 -g3 --coverage") - set(CMAKE_C_FLAGS_ASAN "-Werror -fsanitize=address -fno-common -O3") - set(CMAKE_C_FLAGS_ASANDBG "-Werror -fsanitize=address -fno-common -O1 -g3 -fno-omit-frame-pointer -fno-optimize-sibling-calls ") - set(CMAKE_C_FLAGS_CHECK "-Werror -Os") + set(CMAKE_C_FLAGS_ASAN "-fsanitize=address -fno-common -fsanitize=undefined -fno-sanitize-recover=all -O3") + set(CMAKE_C_FLAGS_ASANDBG "-fsanitize=address -fno-common -fsanitize=undefined -fno-sanitize-recover=all -O1 -g3 -fno-omit-frame-pointer -fno-optimize-sibling-calls") + set(CMAKE_C_FLAGS_CHECK "-Os") set(CMAKE_C_FLAGS_CHECKFULL "${CMAKE_C_FLAGS_CHECK} -Wcast-qual") endif(CMAKE_COMPILER_IS_GNU) if(CMAKE_COMPILER_IS_CLANG) - set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -W -Wdeclaration-after-statement -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow") + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow -Wvla") set(CMAKE_C_FLAGS_RELEASE "-O2") set(CMAKE_C_FLAGS_DEBUG "-O0 -g3") set(CMAKE_C_FLAGS_COVERAGE "-O0 -g3 --coverage") - set(CMAKE_C_FLAGS_ASAN "-Werror -fsanitize=address -fno-common -fsanitize=undefined -fno-sanitize-recover=all -O3") - set(CMAKE_C_FLAGS_ASANDBG "-Werror -fsanitize=address -fno-common -fsanitize=undefined -fno-sanitize-recover=all -O1 -g3 -fno-omit-frame-pointer -fno-optimize-sibling-calls ") - set(CMAKE_C_FLAGS_MEMSAN "-Werror -fsanitize=memory -O3") - set(CMAKE_C_FLAGS_MEMSANDBG "-Werror -fsanitize=memory -O1 -g3 -fno-omit-frame-pointer -fno-optimize-sibling-calls -fsanitize-memory-track-origins=2") - set(CMAKE_C_FLAGS_CHECK "-Werror -Os") + set(CMAKE_C_FLAGS_ASAN "-fsanitize=address -fno-common -fsanitize=undefined -fno-sanitize-recover=all -O3") + set(CMAKE_C_FLAGS_ASANDBG "-fsanitize=address -fno-common -fsanitize=undefined -fno-sanitize-recover=all -O1 -g3 -fno-omit-frame-pointer -fno-optimize-sibling-calls") + set(CMAKE_C_FLAGS_MEMSAN "-fsanitize=memory -O3") + set(CMAKE_C_FLAGS_MEMSANDBG "-fsanitize=memory -O1 -g3 -fno-omit-frame-pointer -fno-optimize-sibling-calls -fsanitize-memory-track-origins=2") + set(CMAKE_C_FLAGS_CHECK "-Os") endif(CMAKE_COMPILER_IS_CLANG) if(CMAKE_COMPILER_IS_IAR) @@ -151,11 +208,25 @@ if(CMAKE_COMPILER_IS_IAR) endif(CMAKE_COMPILER_IS_IAR) if(CMAKE_COMPILER_IS_MSVC) - # Strictest warnings, and treat as errors + # Strictest warnings set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} /W3") - set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} /WX") endif(CMAKE_COMPILER_IS_MSVC) +if(MBEDTLS_FATAL_WARNINGS) + if(CMAKE_COMPILER_IS_MSVC) + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} /WX") + endif(CMAKE_COMPILER_IS_MSVC) + + if(CMAKE_COMPILER_IS_CLANG OR CMAKE_COMPILER_IS_GNU) + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Werror") + if(UNSAFE_BUILD) + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-error=cpp") + set(CMAKE_C_FLAGS_ASAN "${CMAKE_C_FLAGS_ASAN} -Wno-error=cpp") + set(CMAKE_C_FLAGS_ASANDBG "${CMAKE_C_FLAGS_ASANDBG} -Wno-error=cpp") + endif(UNSAFE_BUILD) + endif(CMAKE_COMPILER_IS_CLANG OR CMAKE_COMPILER_IS_GNU) +endif(MBEDTLS_FATAL_WARNINGS) + if(CMAKE_BUILD_TYPE STREQUAL "Coverage") if(CMAKE_COMPILER_IS_GNU OR CMAKE_COMPILER_IS_CLANG) set(CMAKE_SHARED_LINKER_FLAGS "--coverage") @@ -167,8 +238,6 @@ else() set(LIB_INSTALL_DIR lib) endif() -include_directories(include/) - if(ENABLE_ZLIB_SUPPORT) find_package(ZLIB) @@ -177,14 +246,41 @@ if(ENABLE_ZLIB_SUPPORT) endif(ZLIB_FOUND) endif(ENABLE_ZLIB_SUPPORT) -add_subdirectory(library) add_subdirectory(include) +add_subdirectory(3rdparty) +list(APPEND libs ${thirdparty_lib}) + +add_subdirectory(library) + +# +# The C files in tests/src directory contain test code shared among test suites +# and programs. This shared test code is compiled and linked to test suites and +# programs objects as a set of compiled objects. The compiled objects are NOT +# built into a library that the test suite and program objects would link +# against as they link against the mbedcrypto, mbedx509 and mbedtls libraries. +# The reason is that such library is expected to have mutual dependencies with +# the aforementioned libraries and that there is as of today no portable way of +# handling such dependencies (only toolchain specific solutions). +# +# Thus the below definition of the `mbedtls_test` CMake library of objects +# target. This library of objects is used by tests and programs CMake files +# to define the test executables. +# +if(ENABLE_TESTING OR ENABLE_PROGRAMS) + file(GLOB MBEDTLS_TEST_FILES ${CMAKE_CURRENT_SOURCE_DIR}/tests/src/*.c ${CMAKE_CURRENT_SOURCE_DIR}/tests/src/drivers/*.c) + add_library(mbedtls_test OBJECT ${MBEDTLS_TEST_FILES}) + target_include_directories(mbedtls_test + PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/tests/include + PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/include + PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/library) +endif() + if(ENABLE_PROGRAMS) add_subdirectory(programs) endif() -ADD_CUSTOM_TARGET(apidoc +ADD_CUSTOM_TARGET(${MBEDTLS_TARGET_PREFIX}apidoc COMMAND doxygen mbedtls.doxyfile WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/doxygen) @@ -222,13 +318,13 @@ if(ENABLE_TESTING) COMMAND mv DartConfiguration.tcl.bak DartConfiguration.tcl ) endif(UNIX) -endif() -# Make scripts needed for testing available in an out-of-source build. -if (NOT ${CMAKE_CURRENT_BINARY_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR}) - link_to_source(scripts) - # Copy (don't link) DartConfiguration.tcl, needed for memcheck, to - # keep things simple with the sed commands in the memcheck target. - configure_file(${CMAKE_CURRENT_SOURCE_DIR}/DartConfiguration.tcl - ${CMAKE_CURRENT_BINARY_DIR}/DartConfiguration.tcl COPYONLY) + # Make scripts needed for testing available in an out-of-source build. + if (NOT ${CMAKE_CURRENT_BINARY_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR}) + link_to_source(scripts) + # Copy (don't link) DartConfiguration.tcl, needed for memcheck, to + # keep things simple with the sed commands in the memcheck target. + configure_file(${CMAKE_CURRENT_SOURCE_DIR}/DartConfiguration.tcl + ${CMAKE_CURRENT_BINARY_DIR}/DartConfiguration.tcl COPYONLY) + endif() endif() diff --git a/third_party/mbedtls/repo/CONTRIBUTING.md b/third_party/mbedtls/repo/CONTRIBUTING.md index 3433ed001..9b02ba56c 100644 --- a/third_party/mbedtls/repo/CONTRIBUTING.md +++ b/third_party/mbedtls/repo/CONTRIBUTING.md @@ -5,11 +5,6 @@ We gratefully accept bug reports and contributions from the community. There are - As with any open source project, contributions will be reviewed by the project team and community and may need some modifications to be accepted. - The contribution should not break API or ABI, unless there is a real justification for that. If there is an API change, the contribution, if accepted, will be merged only when there will be a major release. -Contributor License Agreement (CLA) ------------------------------------ -- All contributions, whether large or small, require a Contributor's License Agreement (CLA) to be accepted. This is because source code can possibly fall under copyright law and we need your consent to share in the ownership of the copyright. -- To accept the Contributor’s License Agreement (CLA), individual contributors can do this by creating an Mbed account and [accepting the online agreement here with a click through](https://developer.mbed.org/contributor_agreement/). Alternatively, for contributions from corporations, or those that do not wish to create an Mbed account, a slightly different agreement can be found [here](https://www.mbed.com/en/about-mbed/contributor-license-agreements/). This agreement should be signed and returned to Arm as described in the instructions given. - Coding Standards ---------------- - We would ask that contributions conform to [our coding standards](https://tls.mbed.org/kb/development/mbedtls-coding-standards), and that contributions are fully tested before submission, as mentioned in the [Tests](#tests) and [Continuous Integration](#continuous-integration-tests) sections. @@ -19,12 +14,13 @@ Coding Standards Making a Contribution --------------------- -1. [Check for open issues](https://github.com/ARMmbed/mbedtls/issues) or [start a discussion](https://tls.mbed.org/discussions) around a feature idea or a bug. +1. [Check for open issues](https://github.com/ARMmbed/mbedtls/issues) or [start a discussion](https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls) around a feature idea or a bug. 1. Fork the [Mbed TLS repository on GitHub](https://github.com/ARMmbed/mbedtls) to start making your changes. As a general rule, you should use the ["development" branch](https://github.com/ARMmbed/mbedtls/tree/development) as a basis. 1. Write a test which shows that the bug was fixed or that the feature works as expected. 1. Send a pull request (PR) and work with us until it gets merged and published. Contributions may need some modifications, so a few rounds of review and fixing may be necessary. We will include your name in the ChangeLog :) 1. For quick merging, the contribution should be short, and concentrated on a single feature or topic. The larger the contribution is, the longer it would take to review it and merge it. -1. Mbed TLS is released under the Apache license, and as such, all the added files should include the Apache license header. +1. All new files should include the [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html) standard license header where possible. +1. Ensure that each commit has at least one `Signed-off-by:` line from the committer. If anyone else contributes to the commit, they should also add their own `Signed-off-by:` line. By adding this line, contributor(s) certify that the contribution is made under the terms of the [Developer Certificate of Origin](dco.txt). The contribution licensing is described in the [License section of the README](README.md#License). API/ABI Compatibility --------------------- @@ -46,19 +42,15 @@ Mbed TLS maintains several LTS (Long Term Support) branches, which are maintaine When backporting to these branches please observe the following rules: - 1. Any change to the library which changes the API or ABI cannot be backported. - - 2. All bug fixes that correct a defect that is also present in an LTS branch must be backported to that LTS branch. If a bug fix introduces a change to the API such as a new function, the fix should be reworked to avoid the API change. API changes without very strong justification are unlikely to be accepted. - - 3. If a contribution is a new feature or enhancement, no backporting is required. Exceptions to this may be addtional test cases or quality improvements such as changes to build or test scripts. +1. Any change to the library which changes the API or ABI cannot be backported. +1. All bug fixes that correct a defect that is also present in an LTS branch must be backported to that LTS branch. If a bug fix introduces a change to the API such as a new function, the fix should be reworked to avoid the API change. API changes without very strong justification are unlikely to be accepted. +1. If a contribution is a new feature or enhancement, no backporting is required. Exceptions to this may be additional test cases or quality improvements such as changes to build or test scripts. It would be highly appreciated if contributions are backported to LTS branches in addition to the [development branch](https://github.com/ARMmbed/mbedtls/tree/development) by contributors. Currently maintained LTS branches are: - -1. [mbedtls-2.1](https://github.com/ARMmbed/mbedtls/tree/mbedtls-2.1) - -2. [mbedtls-2.7](https://github.com/ARMmbed/mbedtls/tree/mbedtls-2.7) +1. [mbedtls-2.7](https://github.com/ARMmbed/mbedtls/tree/mbedtls-2.7) +1. [mbedtls-2.16](https://github.com/ARMmbed/mbedtls/tree/mbedtls-2.16) Tests @@ -84,12 +76,7 @@ Documentation Mbed TLS is well documented, but if you think documentation is needed, speak out! 1. All interfaces should be documented through Doxygen. New APIs should introduce Doxygen documentation. - -2. Complex parts in the code should include comments. - -3. If needed, a Readme file is advised. - -4. If a [Knowledge Base (KB)](https://tls.mbed.org/kb) article should be added, write this as a comment in the PR description. - -5. A [ChangeLog](https://github.com/ARMmbed/mbedtls/blob/development/ChangeLog) entry should be added for this contribution. - +1. Complex parts in the code should include comments. +1. If needed, a Readme file is advised. +1. If a [Knowledge Base (KB)](https://tls.mbed.org/kb) article should be added, write this as a comment in the PR description. +1. A [ChangeLog](https://github.com/ARMmbed/mbedtls/blob/development/ChangeLog.d/00README.md) entry should be added for this contribution. diff --git a/third_party/mbedtls/repo/ChangeLog b/third_party/mbedtls/repo/ChangeLog index 8f0e8c1c7..fb231aa69 100644 --- a/third_party/mbedtls/repo/ChangeLog +++ b/third_party/mbedtls/repo/ChangeLog @@ -1,5 +1,1005 @@ mbed TLS ChangeLog (Sorted per branch, date) += mbed TLS 2.25.0 branch released 2020-12-11 + +API changes + * The numerical values of the PSA Crypto API macros have been updated to + conform to version 1.0.0 of the specification. + * PSA_ALG_STREAM_CIPHER replaces PSA_ALG_CHACHA20 and PSA_ALG_ARC4. + The underlying stream cipher is determined by the key type + (PSA_KEY_TYPE_CHACHA20 or PSA_KEY_TYPE_ARC4). + * The functions mbedtls_cipher_auth_encrypt() and + mbedtls_cipher_auth_decrypt() no longer accept NIST_KW contexts, + as they have no way to check if the output buffer is large enough. + Please use mbedtls_cipher_auth_encrypt_ext() and + mbedtls_cipher_auth_decrypt_ext() instead. Credit to OSS-Fuzz and + Cryptofuzz. Fixes #3665. + +Requirement changes + * Update the minimum required CMake version to 2.8.12. This silences a + warning on CMake 3.19.0. #3801 + +New deprecations + * PSA_KEY_TYPE_CHACHA20 and PSA_KEY_TYPE_ARC4 have been deprecated. + Use PSA_ALG_STREAM_CIPHER instead. + * The functions mbedtls_cipher_auth_encrypt() and + mbedtls_cipher_auth_decrypt() are deprecated in favour of the new + functions mbedtls_cipher_auth_encrypt_ext() and + mbedtls_cipher_auth_decrypt_ext(). Please note that with AEAD ciphers, + these new functions always append the tag to the ciphertext, and include + the tag in the ciphertext length. + +Features + * Partial implementation of the new PSA Crypto accelerator APIs. (Symmetric + ciphers, asymmetric signing/verification and key generation, validate_key + entry point, and export_public_key interface.) + * Add support for ECB to the PSA cipher API. + * In PSA, allow using a key declared with a base key agreement algorithm + in combined key agreement and derivation operations, as long as the key + agreement algorithm in use matches the algorithm the key was declared with. + This is currently non-standard behaviour, but expected to make it into a + future revision of the PSA Crypto standard. + * Add MBEDTLS_TARGET_PREFIX CMake variable, which is prefixed to the mbedtls, + mbedcrypto, mbedx509 and apidoc CMake target names. This can be used by + external CMake projects that include this one to avoid CMake target name + clashes. The default value of this variable is "", so default target names + are unchanged. + * Add support for DTLS-SRTP as defined in RFC 5764. Contributed by Johan + Pascal, improved by Ron Eldor. + * In the PSA API, it is no longer necessary to open persistent keys: + operations now accept the key identifier. The type psa_key_handle_t is now + identical to psa_key_id_t instead of being platform-defined. This bridges + the last major gap to compliance with the PSA Cryptography specification + version 1.0.0. Opening persistent keys is still supported for backward + compatibility, but will be deprecated and later removed in future + releases. + * PSA_AEAD_NONCE_LENGTH, PSA_AEAD_NONCE_MAX_SIZE, PSA_CIPHER_IV_LENGTH and + PSA_CIPHER_IV_MAX_SIZE macros have been added as defined in version + 1.0.0 of the PSA Crypto API specification. + +Security + * The functions mbedtls_cipher_auth_encrypt() and + mbedtls_cipher_auth_decrypt() would write past the minimum documented + size of the output buffer when used with NIST_KW. As a result, code using + those functions as documented with NIST_KW could have a buffer overwrite + of up to 15 bytes, with consequences ranging up to arbitrary code + execution depending on the location of the output buffer. + * Limit the size of calculations performed by mbedtls_mpi_exp_mod to + MBEDTLS_MPI_MAX_SIZE to prevent a potential denial of service when + generating Diffie-Hellman key pairs. Credit to OSS-Fuzz. + * A failure of the random generator was ignored in mbedtls_mpi_fill_random(), + which is how most uses of randomization in asymmetric cryptography + (including key generation, intermediate value randomization and blinding) + are implemented. This could cause failures or the silent use of non-random + values. A random generator can fail if it needs reseeding and cannot not + obtain entropy, or due to an internal failure (which, for Mbed TLS's own + CTR_DRBG or HMAC_DRBG, can only happen due to a misconfiguration). + * Fix a compliance issue whereby we were not checking the tag on the + algorithm parameters (only the size) when comparing the signature in the + description part of the cert to the real signature. This meant that a + NULL algorithm parameters entry would look identical to an array of REAL + (size zero) to the library and thus the certificate would be considered + valid. However, if the parameters do not match in *any* way then the + certificate should be considered invalid, and indeed OpenSSL marks these + certs as invalid when mbedtls did not. + Many thanks to guidovranken who found this issue via differential fuzzing + and reported it in #3629. + * Zeroising of local buffers and variables which are used for calculations + in mbedtls_pkcs5_pbkdf2_hmac(), mbedtls_internal_sha*_process(), + mbedtls_internal_md*_process() and mbedtls_internal_ripemd160_process() + functions to erase sensitive data from memory. Reported by + Johan Malmgren and Johan Uppman Bruce from Sectra. + +Bugfix + * Fix an invalid (but nonzero) return code from mbedtls_pk_parse_subpubkey() + when the input has trailing garbage. Fixes #2512. + * Fix build failure in configurations where MBEDTLS_USE_PSA_CRYPTO is + enabled but ECDSA is disabled. Contributed by jdurkop. Fixes #3294. + * Include the psa_constant_names generated source code in the source tree + instead of generating it at build time. Fixes #3524. + * Fix rsa_prepare_blinding() to retry when the blinding value is not + invertible (mod N), instead of returning MBEDTLS_ERR_RSA_RNG_FAILED. This + addresses a regression but is rare in practice (approx. 1 in 2/sqrt(N)). + Found by Synopsys Coverity, fix contributed by Peter Kolbus (Garmin). + Fixes #3647. + * Use socklen_t on Android and other POSIX-compliant system + * Fix the build when the macro _GNU_SOURCE is defined to a non-empty value. + Fix #3432. + * Consistently return PSA_ERROR_INVALID_ARGUMENT on invalid cipher input + sizes (instead of PSA_ERROR_BAD_STATE in some cases) to make the + psa_cipher_* functions compliant with the PSA Crypto API specification. + * mbedtls_ecp_curve_list() now lists Curve25519 and Curve448 under the names + "x25519" and "x448". These curves support ECDH but not ECDSA. If you need + only the curves that support ECDSA, filter the list with + mbedtls_ecdsa_can_do(). + * Fix psa_generate_key() returning an error when asked to generate + an ECC key pair on Curve25519 or secp244k1. + * Fix psa_key_derivation_output_key() to allow the output of a combined key + agreement and subsequent key derivation operation to be used as a key + inside of the PSA Crypto core. + * Fix handling of EOF against 0xff bytes and on platforms with unsigned + chars. Fixes a build failure on platforms where char is unsigned. Fixes + #3794. + * Fix an off-by-one error in the additional data length check for + CCM, which allowed encryption with a non-standard length field. + Fixes #3719. + * Correct the default IV size for mbedtls_cipher_info_t structures using + MBEDTLS_MODE_ECB to 0, since ECB mode ciphers don't use IVs. + * Make arc4random_buf available on NetBSD and OpenBSD when _POSIX_C_SOURCE is + defined. Fix contributed in #3571. + * Fix conditions for including string.h in error.c. Fixes #3866. + * psa_set_key_id() now also sets the lifetime to persistent for keys located + in a secure element. + * Attempting to create a volatile key with a non-zero key identifier now + fails. Previously the key identifier was just ignored when creating a + volatile key. + * Attempting to create or register a key with a key identifier in the vendor + range now fails. + * Fix build failures on GCC 11. Fixes #3782. + * Add missing arguments of debug message in mbedtls_ssl_decrypt_buf. + * Fix a memory leak in mbedtls_mpi_sub_abs() when the result was negative + (an error condition) and the second operand was aliased to the result. + * Fix a case in elliptic curve arithmetic where an out-of-memory condition + could go undetected, resulting in an incorrect result. + * In CTR_DRBG and HMAC_DRBG, don't reset the reseed interval in seed(). + Fixes #2927. + * In PEM writing functions, fill the trailing part of the buffer with null + bytes. This guarantees that the corresponding parsing function can read + the buffer back, which was the case for mbedtls_x509write_{crt,csr}_pem + until this property was inadvertently broken in Mbed TLS 2.19.0. + Fixes #3682. + * Fix a build failure that occurred with the MBEDTLS_AES_SETKEY_DEC_ALT + option on. In this configuration key management methods that are required + for MBEDTLS_CIPHER_MODE_XTS were excluded from the build and made it fail. + Fixes #3818. Reported by John Stroebel. + +Changes + * Reduce stack usage significantly during sliding window exponentiation. + Reported in #3591 and fix contributed in #3592 by Daniel Otte. + * The PSA persistent storage format is updated to always store the key bits + attribute. No automatic upgrade path is provided. Previously stored keys + must be erased, or manually upgraded based on the key storage format + specification (docs/architecture/mbed-crypto-storage-specification.md). + Fixes #3740. + * Remove the zeroization of a pointer variable in AES rounds. It was valid + but spurious and misleading since it looked like a mistaken attempt to + zeroize the pointed-to buffer. Reported by Antonio de la Piedra, CEA + Leti, France. + += mbed TLS 2.24.0 branch released 2020-09-01 + +API changes + * In the PSA API, rename the types of elliptic curve and Diffie-Hellman + group families to psa_ecc_family_t and psa_dh_family_t, in line with the + PSA Crypto API specification version 1.0.0. + Rename associated macros as well: + PSA_ECC_CURVE_xxx renamed to PSA_ECC_FAMILY_xxx + PSA_DH_GROUP_xxx renamed to PSA_DH_FAMILY_xxx + PSA_KEY_TYPE_GET_CURVE renamed to to PSA_KEY_TYPE_ECC_GET_FAMILY + PSA_KEY_TYPE_GET_GROUP renamed to PSA_KEY_TYPE_DH_GET_FAMILY + +Default behavior changes + * Stop storing persistent information about externally stored keys created + through PSA Crypto with a volatile lifetime. Reported in #3288 and + contributed by Steven Cooreman in #3382. + +Features + * The new function mbedtls_ecp_write_key() exports private ECC keys back to + a byte buffer. It is the inverse of the existing mbedtls_ecp_read_key(). + * Support building on e2k (Elbrus) architecture: correctly enable + -Wformat-signedness, and fix the code that causes signed-one-bit-field + and sign-compare warnings. Contributed by makise-homura (Igor Molchanov) + . + +Security + * Fix a vulnerability in the verification of X.509 certificates when + matching the expected common name (the cn argument of + mbedtls_x509_crt_verify()) with the actual certificate name: when the + subjecAltName extension is present, the expected name was compared to any + name in that extension regardless of its type. This means that an + attacker could for example impersonate a 4-bytes or 16-byte domain by + getting a certificate for the corresponding IPv4 or IPv6 (this would + require the attacker to control that IP address, though). Similar attacks + using other subjectAltName name types might be possible. Found and + reported by kFYatek in #3498. + * When checking X.509 CRLs, a certificate was only considered as revoked if + its revocationDate was in the past according to the local clock if + available. In particular, on builds without MBEDTLS_HAVE_TIME_DATE, + certificates were never considered as revoked. On builds with + MBEDTLS_HAVE_TIME_DATE, an attacker able to control the local clock (for + example, an untrusted OS attacking a secure enclave) could prevent + revocation of certificates via CRLs. Fixed by no longer checking the + revocationDate field, in accordance with RFC 5280. Reported by + yuemonangong in #3340. Reported independently and fixed by + Raoul Strackx and Jethro Beekman in #3433. + * In (D)TLS record decryption, when using a CBC ciphersuites without the + Encrypt-then-Mac extension, use constant code flow memory access patterns + to extract and check the MAC. This is an improvement to the existing + countermeasure against Lucky 13 attacks. The previous countermeasure was + effective against network-based attackers, but less so against local + attackers. The new countermeasure defends against local attackers, even + if they have access to fine-grained measurements. In particular, this + fixes a local Lucky 13 cache attack found and reported by Tuba Yavuz, + Farhaan Fowze, Ken (Yihan) Bai, Grant Hernandez, and Kevin Butler + (University of Florida) and Dave Tian (Purdue University). + * Fix side channel in RSA private key operations and static (finite-field) + Diffie-Hellman. An adversary with precise enough timing and memory access + information (typically an untrusted operating system attacking a secure + enclave) could bypass an existing counter-measure (base blinding) and + potentially fully recover the private key. + * Fix a 1-byte buffer overread in mbedtls_x509_crl_parse_der(). + Credit to OSS-Fuzz for detecting the problem and to Philippe Antoine + for pinpointing the problematic code. + * Zeroising of plaintext buffers in mbedtls_ssl_read() to erase unused + application data from memory. Reported in #689 by + Johan Uppman Bruce of Sectra. + +Bugfix + * Library files installed after a CMake build no longer have execute + permission. + * Use local labels in mbedtls_padlock_has_support() to fix an invalid symbol + redefinition if the function is inlined. + Reported in #3451 and fix contributed in #3452 by okhowang. + * Fix the endianness of Curve25519 keys imported/exported through the PSA + APIs. psa_import_key and psa_export_key will now correctly expect/output + Montgomery keys in little-endian as defined by RFC7748. Contributed by + Steven Cooreman in #3425. + * Fix build errors when the only enabled elliptic curves are Montgomery + curves. Raised by signpainter in #941 and by Taiki-San in #1412. This + also fixes missing declarations reported by Steven Cooreman in #1147. + * Fix self-test failure when the only enabled short Weierstrass elliptic + curve is secp192k1. Fixes #2017. + * PSA key import will now correctly import a Curve25519/Curve448 public key + instead of erroring out. Contributed by Steven Cooreman in #3492. + * Use arc4random_buf on NetBSD instead of rand implementation with cyclical + lower bits. Fix contributed in #3540. + * Fix a memory leak in mbedtls_md_setup() when using HMAC under low memory + conditions. Reported and fix suggested by Guido Vranken in #3486. + * Fix bug in redirection of unit test outputs on platforms where stdout is + defined as a macro. First reported in #2311 and fix contributed in #3528. + +Changes + * Only pass -Wformat-signedness to versions of GCC that support it. Reported + in #3478 and fix contributed in #3479 by okhowang. + * Reduce the stack consumption of mbedtls_x509write_csr_der() which + previously could lead to stack overflow on constrained devices. + Contributed by Doru Gucea and Simon Leet in #3464. + * Undefine the ASSERT macro before defining it locally, in case it is defined + in a platform header. Contributed by Abdelatif Guettouche in #3557. + * Update copyright notices to use Linux Foundation guidance. As a result, + the copyright of contributors other than Arm is now acknowledged, and the + years of publishing are no longer tracked in the source files. This also + eliminates the need for the lines declaring the files to be part of + MbedTLS. Fixes #3457. + * Add the command line parameter key_pwd to the ssl_client2 and ssl_server2 + example applications which allows to provide a password for the key file + specified through the existing key_file argument. This allows the use of + these applications with password-protected key files. Analogously but for + ssl_server2 only, add the command line parameter key_pwd2 which allows to + set a password for the key file provided through the existing key_file2 + argument. + += mbed TLS 2.23.0 branch released 2020-07-01 + +Default behavior changes + * In the experimental PSA secure element interface, change the encoding of + key lifetimes to encode a persistence level and the location. Although C + prototypes do not effectively change, code calling + psa_register_se_driver() must be modified to pass the driver's location + instead of the keys' lifetime. If the library is upgraded on an existing + device, keys created with the old lifetime value will not be readable or + removable through Mbed TLS after the upgrade. + +Features + * New functions in the error module return constant strings for + high- and low-level error codes, complementing mbedtls_strerror() + which constructs a string for any error code, including compound + ones, but requires a writable buffer. Contributed by Gaurav Aggarwal + in #3176. + * The new utility programs/ssl/ssl_context_info prints a human-readable + dump of an SSL context saved with mbedtls_ssl_context_save(). + * Add support for midipix, a POSIX layer for Microsoft Windows. + * Add new mbedtls_x509_crt_parse_der_with_ext_cb() routine which allows + parsing unsupported certificate extensions via user provided callback. + Contributed by Nicola Di Lieto in #3243 as + a solution to #3241. + * Pass the "certificate policies" extension to the callback supplied to + mbedtls_x509_crt_parse_der_with_ext_cb() if it contains unsupported + policies (#3419). + * Added support to entropy_poll for the kern.arandom syscall supported on + some BSD systems. Contributed by Nia Alarie in #3423. + * Add support for Windows 2000 in net_sockets. Contributed by opatomic. #3239 + +Security + * Fix a side channel vulnerability in modular exponentiation that could + reveal an RSA private key used in a secure enclave. Noticed by Sangho Lee, + Ming-Wei Shih, Prasun Gera, Taesoo Kim and Hyesoon Kim (Georgia Institute + of Technology); and Marcus Peinado (Microsoft Research). Reported by Raoul + Strackx (Fortanix) in #3394. + * Fix side channel in mbedtls_ecp_check_pub_priv() and + mbedtls_pk_parse_key() / mbedtls_pk_parse_keyfile() (when loading a + private key that didn't include the uncompressed public key), as well as + mbedtls_ecp_mul() / mbedtls_ecp_mul_restartable() when called with a NULL + f_rng argument. An attacker with access to precise enough timing and + memory access information (typically an untrusted operating system + attacking a secure enclave) could fully recover the ECC private key. + Found and reported by Alejandro Cabrera Aldaya and Billy Brumley. + * Fix issue in Lucky 13 counter-measure that could make it ineffective when + hardware accelerators were used (using one of the MBEDTLS_SHAxxx_ALT + macros). This would cause the original Lucky 13 attack to be possible in + those configurations, allowing an active network attacker to recover + plaintext after repeated timing measurements under some conditions. + Reported and fix suggested by Luc Perneel in #3246. + +Bugfix + * Fix the Visual Studio Release x64 build configuration for mbedtls itself. + Completes a previous fix in Mbed TLS 2.19 that only fixed the build for + the example programs. Reported in #1430 and fix contributed by irwir. + * Fix undefined behavior in X.509 certificate parsing if the + pathLenConstraint basic constraint value is equal to INT_MAX. + The actual effect with almost every compiler is the intended + behavior, so this is unlikely to be exploitable anywhere. #3192 + * Fix issue with a detected HW accelerated record error not being exposed + due to shadowed variable. Contributed by Sander Visser in #3310. + * Avoid NULL pointer dereferencing if mbedtls_ssl_free() is called with a + NULL pointer argument. Contributed by Sander Visser in #3312. + * Fix potential linker errors on dual world platforms by inlining + mbedtls_gcc_group_to_psa(). This allows the pk.c module to link separately + from psa_crypto.c. Fixes #3300. + * Remove dead code in X.509 certificate parsing. Contributed by irwir in + #2855. + * Include asn1.h in error.c. Fixes #3328 reported by David Hu. + * Fix potential memory leaks in ecp_randomize_jac() and ecp_randomize_mxz() + when PRNG function fails. Contributed by Jonas Lejeune in #3318. + * Remove unused macros from MSVC projects. Reported in #3297 and fix + submitted in #3333 by irwir. + * Add additional bounds checks in ssl_write_client_hello() preventing + output buffer overflow if the configuration declared a buffer that was + too small. + * Set _POSIX_C_SOURCE to at least 200112L in C99 code. Reported in #3420 and + fix submitted in #3421 by Nia Alarie. + * Fix building library/net_sockets.c and the ssl_mail_client program on + NetBSD. Contributed by Nia Alarie in #3422. + * Fix false positive uninitialised variable reported by cpp-check. + Contributed by Sander Visser in #3311. + * Update iv and len context pointers manually when reallocating buffers + using the MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH feature. This caused issues + when receiving a connection with CID, when these fields were shifted + in ssl_parse_record_header(). + +Changes + * Fix warnings about signedness issues in format strings. The build is now + clean of -Wformat-signedness warnings. Contributed by Kenneth Soerensen + in #3153. + * Fix minor performance issue in operations on Curve25519 caused by using a + suboptimal modular reduction in one place. Found and fix contributed by + Aurelien Jarno in #3209. + * Combine identical cases in switch statements in md.c. Contributed + by irwir in #3208. + * Simplify a bounds check in ssl_write_certificate_request(). Contributed + by irwir in #3150. + * Unify the example programs termination to call mbedtls_exit() instead of + using a return command. This has been done to enable customization of the + behavior in bare metal environments. + * Fix mbedtls_x509_dn_gets to escape non-ASCII characters as "?". + Contributed by Koh M. Nakagawa in #3326. + * Use FindPython3 when cmake version >= 3.15.0 + * Abort the ClientHello writing function as soon as some extension doesn't + fit into the record buffer. Previously, such extensions were silently + dropped. As a consequence, the TLS handshake now fails when the output + buffer is not large enough to hold the ClientHello. + * The unit tests now rely on header files in tests/include/test and source + files in tests/src. When building with make or cmake, the files in + tests/src are compiled and the resulting object linked into each test + executable. + * The ECP module, enabled by `MBEDTLS_ECP_C`, now depends on + `MBEDTLS_CTR_DRBG_C` or `MBEDTLS_HMAC_DRBG_C` for some side-channel + coutermeasures. If side channels are not a concern, this dependency can + be avoided by enabling the new option `MBEDTLS_ECP_NO_INTERNAL_RNG`. + * Align MSVC error flag with GCC and Clang. Contributed by Carlos Gomes + Martinho. #3147 + * Remove superfluous assignment in mbedtls_ssl_parse_certificate(). Reported + in #3182 and fix submitted by irwir. #3217 + * Fix typo in XTS tests. Reported and fix submitted by Kxuan. #3319 + += mbed TLS 2.22.0 branch released 2020-04-14 + +New deprecations + * Deprecate MBEDTLS_SSL_HW_RECORD_ACCEL that enables function hooks in the + SSL module for hardware acceleration of individual records. + * Deprecate mbedtls_ssl_get_max_frag_len() in favour of + mbedtls_ssl_get_output_max_frag_len() and + mbedtls_ssl_get_input_max_frag_len() to be more precise about which max + fragment length is desired. + +Security + * Fix issue in DTLS handling of new associations with the same parameters + (RFC 6347 section 4.2.8): an attacker able to send forged UDP packets to + the server could cause it to drop established associations with + legitimate clients, resulting in a Denial of Service. This could only + happen when MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE was enabled in config.h + (which it is by default). + * Fix side channel in ECC code that allowed an adversary with access to + precise enough timing and memory access information (typically an + untrusted operating system attacking a secure enclave) to fully recover + an ECDSA private key. Found and reported by Alejandro Cabrera Aldaya, + Billy Brumley and Cesar Pereida Garcia. CVE-2020-10932 + * Fix a potentially remotely exploitable buffer overread in a + DTLS client when parsing the Hello Verify Request message. + +Features + * The new build option MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH automatically + resizes the I/O buffers before and after handshakes, reducing the memory + consumption during application data transfer. + +Bugfix + * Fix compilation failure when both MBEDTLS_SSL_PROTO_DTLS and + MBEDTLS_SSL_HW_RECORD_ACCEL are enabled. + * Remove a spurious check in ssl_parse_client_psk_identity that triggered + a warning with some compilers. Fix contributed by irwir in #2856. + * Fix a function name in a debug message. Contributed by Ercan Ozturk in + #3013. + +Changes + * Mbed Crypto is no longer a Git submodule. The crypto part of the library + is back directly in the present repository. + * Split mbedtls_ssl_get_max_frag_len() into + mbedtls_ssl_get_output_max_frag_len() and + mbedtls_ssl_get_input_max_frag_len() to ensure that a sufficient input + buffer is allocated by the server (if MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH + is defined), regardless of what MFL was configured for it. + += mbed TLS 2.21.0 branch released 2020-02-20 + +New deprecations + * Deprecate MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO that enables parsing + SSLv2 ClientHello messages. + * Deprecate MBEDTLS_SSL_PROTO_SSL3 that enables support for SSLv3. + * Deprecate for MBEDTLS_PKCS11_C, the wrapper around the pkcs11-helper + library which allows TLS authentication to use keys stored in a + PKCS#11 token such as a smartcard. + +Security + * Fix potential memory overread when performing an ECDSA signature + operation. The overread only happens with cryptographically low + probability (of the order of 2^-n where n is the bitsize of the curve) + unless the RNG is broken, and could result in information disclosure or + denial of service (application crash or extra resource consumption). + Found by Auke Zeilstra and Peter Schwabe, using static analysis. + * To avoid a side channel vulnerability when parsing an RSA private key, + read all the CRT parameters from the DER structure rather than + reconstructing them. Found by Alejandro Cabrera Aldaya and Billy Bob + Brumley. Reported and fix contributed by Jack Lloyd. + ARMmbed/mbed-crypto#352 + +Features + * The new build option MBEDTLS_SHA512_NO_SHA384 allows building SHA-512 + support without SHA-384. + +API changes + * Change the encoding of key types and curves in the PSA API. The new + values are aligned with the upcoming release of the PSA Crypto API + specification version 1.0.0. The main change which may break some + existing code is that elliptic curve key types no longer encode the + exact curve: a psa_ecc_curve_t or psa_key_type_t value only encodes + a curve family and the key size determines the exact curve (for example, + PSA_ECC_CURVE_SECP_R1 with 256 bits is P256R1). ARMmbed/mbed-crypto#330 + +Bugfix + * Fix an unchecked call to mbedtls_md() in the x509write module. + * Fix build failure with MBEDTLS_ZLIB_SUPPORT enabled. Reported by + Jack Lloyd in #2859. Fix submitted by jiblime in #2963. + * Fix some false-positive uninitialized variable warnings in X.509. Fix + contributed by apple-ihack-geek in #2663. + * Fix a possible error code mangling in psa_mac_verify_finish() when + a cryptographic accelerator fails. ARMmbed/mbed-crypto#345 + * Fix a bug in mbedtls_pk_parse_key() that would cause it to accept some + RSA keys that would later be rejected by functions expecting private + keys. Found by Catena cyber using oss-fuzz (issue 20467). + * Fix a bug in mbedtls_pk_parse_key() that would cause it to + accept some RSA keys with invalid values by silently fixing those values. + += mbed TLS 2.20.0 branch released 2020-01-15 + +Default behavior changes + * The initial seeding of a CTR_DRBG instance makes a second call to the + entropy function to obtain entropy for a nonce if the entropy size is less + than 3/2 times the key size. In case you want to disable the extra call to + grab entropy, you can call mbedtls_ctr_drbg_set_nonce_len() to force the + nonce length to 0. + +Security + * Enforce that mbedtls_entropy_func() gathers a total of + MBEDTLS_ENTROPY_BLOCK_SIZE bytes or more from strong sources. In the + default configuration, on a platform with a single entropy source, the + entropy module formerly only grabbed 32 bytes, which is good enough for + security if the source is genuinely strong, but less than the expected 64 + bytes (size of the entropy accumulator). + * Zeroize local variables in mbedtls_internal_aes_encrypt() and + mbedtls_internal_aes_decrypt() before exiting the function. The value of + these variables can be used to recover the last round key. To follow best + practice and to limit the impact of buffer overread vulnerabilities (like + Heartbleed) we need to zeroize them before exiting the function. + Issue reported by Tuba Yavuz, Farhaan Fowze, Ken (Yihang) Bai, + Grant Hernandez, and Kevin Butler (University of Florida) and + Dave Tian (Purdue University). + * Fix side channel vulnerability in ECDSA. Our bignum implementation is not + constant time/constant trace, so side channel attacks can retrieve the + blinded value, factor it (as it is smaller than RSA keys and not guaranteed + to have only large prime factors), and then, by brute force, recover the + key. Reported by Alejandro Cabrera Aldaya and Billy Brumley. + * Fix side channel vulnerability in ECDSA key generation. Obtaining precise + timings on the comparison in the key generation enabled the attacker to + learn leading bits of the ephemeral key used during ECDSA signatures and to + recover the private key. Reported by Jeremy Dubeuf. + * Catch failure of AES functions in mbedtls_ctr_drbg_random(). Uncaught + failures could happen with alternative implementations of AES. Bug + reported and fix proposed by Johan Uppman Bruce and Christoffer Lauri, + Sectra. + +Features + * Key derivation inputs in the PSA API can now either come from a key object + or from a buffer regardless of the step type. + * The CTR_DRBG module can grab a nonce from the entropy source during the + initial seeding. The default nonce length is chosen based on the key size + to achieve the security strength defined by NIST SP 800-90A. You can + change it with mbedtls_ctr_drbg_set_nonce_len(). + * Add ENUMERATED tag support to the ASN.1 module. Contributed by + msopiha-linaro in ARMmbed/mbed-crypto#307. + +API changes + * In the PSA API, forbid zero-length keys. To pass a zero-length input to a + key derivation function, use a buffer instead (this is now always + possible). + * Rename psa_asymmetric_sign() to psa_sign_hash() and + psa_asymmetric_verify() to psa_verify_hash(). + +Bugfix + * Fix an incorrect size in a debugging message. Reported and fix + submitted by irwir. Fixes #2717. + * Fix an unused variable warning when compiling without DTLS. + Reported and fix submitted by irwir. Fixes #2800. + * Remove a useless assignment. Reported and fix submitted by irwir. + Fixes #2801. + * Fix a buffer overflow in the PSA HMAC code when using a long key with an + unsupported algorithm. Fixes ARMmbed/mbed-crypto#254. + * Fix mbedtls_asn1_get_int to support any number of leading zeros. Credit + to OSS-Fuzz for finding a bug in an intermediate version of the fix. + * Fix mbedtls_asn1_get_bitstring_null to correctly parse bitstrings of at + most 2 bytes. + * mbedtls_ctr_drbg_set_entropy_len() and + mbedtls_hmac_drbg_set_entropy_len() now work if you call them before + mbedtls_ctr_drbg_seed() or mbedtls_hmac_drbg_seed(). + +Changes + * Remove the technical possibility to define custom mbedtls_md_info + structures, which was exposed only in an internal header. + * psa_close_key(0) and psa_destroy_key(0) now succeed (doing nothing, as + before). + * Variables containing error codes are now initialized to an error code + rather than success, so that coding mistakes or memory corruption tends to + cause functions to return this error code rather than a success. There are + no known instances where this changes the behavior of the library: this is + merely a robustness improvement. ARMmbed/mbed-crypto#323 + * Remove a useless call to mbedtls_ecp_group_free(). Contributed by + Alexander Krizhanovsky in ARMmbed/mbed-crypto#210. + * Speed up PBKDF2 by caching the digest calculation. Contributed by Jack + Lloyd and Fortanix Inc in ARMmbed/mbed-crypto#277. + * Small performance improvement of mbedtls_mpi_div_mpi(). Contributed by + Alexander Krizhanovsky in ARMmbed/mbed-crypto#308. + += mbed TLS 2.19.1 branch released 2019-09-16 + +Features + * Declare include headers as PUBLIC to propagate to CMake project consumers + Contributed by Zachary J. Fields in PR #2949. + * Add nss_keylog to ssl_client2 and ssl_server2, enabling easier analysis of + TLS sessions with tools like Wireshark. + +API Changes + * Make client_random and server_random const in + mbedtls_ssl_export_keys_ext_t, so that the key exporter is discouraged + from modifying the client/server hello. + +Bugfix + * Fix some false-positive uninitialized variable warnings in crypto. Fix + contributed by apple-ihack-geek in #2663. + += mbed TLS 2.19.0 branch released 2019-09-06 + +Security + * Fix a missing error detection in ECJPAKE. This could have caused a + predictable shared secret if a hardware accelerator failed and the other + side of the key exchange had a similar bug. + * When writing a private EC key, use a constant size for the private + value, as specified in RFC 5915. Previously, the value was written + as an ASN.1 INTEGER, which caused the size of the key to leak + about 1 bit of information on average and could cause the value to be + 1 byte too large for the output buffer. + * The deterministic ECDSA calculation reused the scheme's HMAC-DRBG to + implement blinding. Because of this for the same key and message the same + blinding value was generated. This reduced the effectiveness of the + countermeasure and leaked information about the private key through side + channels. Reported by Jack Lloyd. + +Features + * Add new API functions mbedtls_ssl_session_save() and + mbedtls_ssl_session_load() to allow serializing a session, for example to + store it in non-volatile storage, and later using it for TLS session + resumption. + * Add a new API function mbedtls_ssl_check_record() to allow checking that + an incoming record is valid, authentic and has not been seen before. This + feature can be used alongside Connection ID and SSL context serialisation. + The feature is enabled at compile-time by MBEDTLS_SSL_RECORD_CHECKING + option. + * New implementation of X25519 (ECDH using Curve25519) from Project Everest + (https://project-everest.github.io/). It can be enabled at compile time + with MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED. This implementation is formally + verified and significantly faster, but is only supported on x86 platforms + (32-bit and 64-bit) using GCC, Clang or Visual Studio. Contributed by + Christoph Wintersteiger from Microsoft Research. + * Add mbedtls_net_close(), enabling the building of forking servers where + the parent process closes the client socket and continue accepting, and + the child process closes the listening socket and handles the client + socket. Contributed by Robert Larsen in #2803. + +API Changes + * Add DER-encoded test CRTs to library/certs.c, allowing + the example programs ssl_server2 and ssl_client2 to be run + if MBEDTLS_FS_IO and MBEDTLS_PEM_PARSE_C are unset. Fixes #2254. + * The HAVEGE state type now uses uint32_t elements instead of int. + * The functions mbedtls_ecp_curve_list() and mbedtls_ecp_grp_id_list() now + list all curves for which at least one of ECDH or ECDSA is supported, not + just curves for which both are supported. Call mbedtls_ecdsa_can_do() or + mbedtls_ecdh_can_do() on each result to check whether each algorithm is + supported. + * The new function mbedtls_ecdsa_sign_det_ext() is similar to + mbedtls_ecdsa_sign_det() but allows passing an external RNG for the + purpose of blinding. + +New deprecations + * Deprecate mbedtls_ecdsa_sign_det() in favor of a functions that can take an + RNG function as an input. + * Calling mbedtls_ecdsa_write_signature() with NULL as the f_rng argument + is now deprecated. + +Bugfix + * Fix missing bounds checks in X.509 parsing functions that could + lead to successful parsing of ill-formed X.509 CRTs. Fixes #2437. + * Fix multiple X.509 functions previously returning ASN.1 low-level error + codes to always wrap these codes into X.509 high level error codes before + returning. Fixes #2431. + * Fix to allow building test suites with any warning that detects unused + functions. Fixes #1628. + * Fix typo in net_would_block(). Fixes #528 reported by github-monoculture. + * Remove redundant include file in timing.c. Fixes #2640 reported by irwir. + * Fix build failure when building with mingw on Windows by including + stdarg.h where needed. Fixes #2656. + * Fix Visual Studio Release x64 build configuration by inheriting + PlatformToolset from the project configuration. Fixes #1430 reported by + irwir. + * Enable Suite B with subset of ECP curves. Make sure the code compiles even + if some curves are not defined. Fixes #1591 reported by dbedev. + * Fix misuse of signed arithmetic in the HAVEGE module. #2598 + * Avoid use of statically sized stack buffers for certificate writing. + This previously limited the maximum size of DER encoded certificates + in mbedtls_x509write_crt_der() to 2Kb. Reported by soccerGB in #2631. + * Fix partial zeroing in x509_get_other_name. Found and fixed by ekse, #2716. + * Update test certificates that were about to expire. Reported by + Bernhard M. Wiedemann in #2357. + * Fix the build on ARMv5TE in ARM mode to not use assembly instructions + that are only available in Thumb mode. Fix contributed by Aurelien Jarno + in #2169. + * Fix propagation of restart contexts in restartable EC operations. + This could previously lead to segmentation faults in builds using an + address-sanitizer and enabling but not using MBEDTLS_ECP_RESTARTABLE. + * Fix memory leak in in mpi_miller_rabin(). Contributed by + Jens Wiklander in #2363 + * Improve code clarity in x509_crt module, removing false-positive + uninitialized variable warnings on some recent toolchains (GCC8, etc). + Discovered and fixed by Andy Gross (Linaro), #2392. + * Fix bug in endianness conversion in bignum module. This lead to + functionally incorrect code on bigendian systems which don't have + __BYTE_ORDER__ defined. Reported by Brendan Shanks. Fixes #2622. + +Changes + * Replace multiple uses of MD2 by SHA-256 in X.509 test suite. Fixes #821. + * Make it easier to define MBEDTLS_PARAM_FAILED as assert (which config.h + suggests). #2671 + * Make `make clean` clean all programs always. Fixes #1862. + * Add a Dockerfile and helper scripts (all-in-docker.sh, basic-in-docker.sh, + docker-env.sh) to simplify running test suites on a Linux host. Contributed + by Peter Kolbus (Garmin). + * Add `reproducible` option to `ssl_client2` and `ssl_server2` to enable + test runs without variability. Contributed by Philippe Antoine (Catena + cyber) in #2681. + * Extended .gitignore to ignore Visual Studio artifacts. Fixed by ConfusedSushi. + * Adds fuzz targets, especially for continuous fuzzing with OSS-Fuzz. + Contributed by Philippe Antoine (Catena cyber). + * Remove the crypto part of the library from Mbed TLS. The crypto + code and tests are now only available via Mbed Crypto, which + Mbed TLS references as a Git submodule. + += mbed TLS 2.18.1 branch released 2019-07-12 + +Bugfix + * Fix build failure when building with mingw on Windows by including + stdarg.h where needed. Fixes #2656. + +Changes + * Enable building of Mbed TLS as a CMake subproject. Suggested and fixed by + Ashley Duncan in #2609. + += mbed TLS 2.18.0 branch released 2019-06-11 + +Features + * Add the Any Policy certificate policy oid, as defined in + rfc 5280 section 4.2.1.4. + * It is now possible to use NIST key wrap mode via the mbedtls_cipher API. + Contributed by Jack Lloyd and Fortanix Inc. + * Add the Wi-SUN Field Area Network (FAN) device extended key usage. + * Add the oid certificate policy x509 extension. + * It is now possible to perform RSA PKCS v1.5 signatures with RIPEMD-160 digest. + Contributed by Jack Lloyd and Fortanix Inc. + * Extend the MBEDTLS_SSL_EXPORT_KEYS to export the handshake randbytes, + and the used tls-prf. + * Add public API for tls-prf function, according to requested enum. + * Add support for parsing otherName entries in the Subject Alternative Name + X.509 certificate extension, specifically type hardware module name, + as defined in RFC 4108 section 5. + * Add support for parsing certificate policies extension, as defined in + RFC 5280 section 4.2.1.4. Currently, only the "Any Policy" policy is + supported. + * List all SAN types in the subject_alt_names field of the certificate. + Resolves #459. + * Add support for draft-05 of the Connection ID extension, as specified + in https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05. + The Connection ID extension allows to keep DTLS connections beyond the + lifetime of the underlying transport by adding a connection identifier + to the DTLS record header. This identifier can be used to associated an + incoming record with the correct connection data even after the peer has + changed its IP or port. The feature is enabled at compile-time by setting + MBEDTLS_SSL_DTLS_CONNECTION_ID (disabled by default), and at run-time + through the new APIs mbedtls_ssl_conf_cid() and mbedtls_ssl_set_cid(). + + +API Changes + * Extend the MBEDTLS_SSL_EXPORT_KEYS to export the handshake randbytes, + and the used tls-prf. + * Add public API for tls-prf function, according to requested enum. + +Bugfix + * Fix private key DER output in the key_app_writer example. File contents + were shifted by one byte, creating an invalid ASN.1 tag. Fixed by + Christian Walther in #2239. + * Fix potential memory leak in X.509 self test. Found and fixed by + Junhwan Park, #2106. + * Reduce stack usage of hkdf tests. Fixes #2195. + * Fix 1-byte buffer overflow in mbedtls_mpi_write_string() when + used with negative inputs. Found by Guido Vranken in #2404. Credit to + OSS-Fuzz. + * Fix bugs in the AEAD test suite which would be exposed by ciphers which + either used both encrypt and decrypt key schedules, or which perform padding. + GCM and CCM were not affected. Fixed by Jack Lloyd. + * Fix incorrect default port number in ssl_mail_client example's usage. + Found and fixed by irwir. #2337 + * Add psa_util.h to test/cpp_dummy_build to fix build_default_make_gcc_and_cxx. + Fixed by Peter Kolbus (Garmin). #2579 + * Add missing parentheses around parameters in the definition of the + public macro MBEDTLS_X509_ID_FLAG. This could lead to invalid evaluation + in case operators binding less strongly than subtraction were used + for the parameter. + * Add a check for MBEDTLS_X509_CRL_PARSE_C in ssl_server2, guarding the crl + sni entry parameter. Reported by inestlerode in #560. + * Set the next sequence of the subject_alt_name to NULL when deleting + sequence on failure. Found and fix suggested by Philippe Antoine. + Credit to OSS-Fuzz. + +Changes + * Server's RSA certificate in certs.c was SHA-1 signed. In the default + mbedTLS configuration only SHA-2 signed certificates are accepted. + This certificate is used in the demo server programs, which lead the + client programs to fail at the peer's certificate verification + due to an unacceptable hash signature. The certificate has been + updated to one that is SHA-256 signed. Fix contributed by + Illya Gerasymchuk. + * Return from various debugging routines immediately if the + provided SSL context is unset. + * Remove dead code from bignum.c in the default configuration. + Found by Coverity, reported and fixed by Peter Kolbus (Garmin). Fixes #2309. + * Add test for minimal value of MBEDTLS_MPI_WINDOW_SIZE to all.sh. + Contributed by Peter Kolbus (Garmin). + * Change wording in the `mbedtls_ssl_conf_max_frag_len()`'s documentation to + improve clarity. Fixes #2258. + += mbed TLS 2.17.0 branch released 2019-03-19 + +Features + * Add a new X.509 API call `mbedtls_x509_parse_der_nocopy()` + which allows copy-less parsing of DER encoded X.509 CRTs, + at the cost of additional lifetime constraints on the input + buffer, but at the benefit of reduced RAM consumption. + * Add a new function mbedtls_asn1_write_named_bitstring() to write ASN.1 + named bitstring in DER as required by RFC 5280 Appendix B. + * Add MBEDTLS_REMOVE_3DES_CIPHERSUITES to allow removing 3DES ciphersuites + from the default list (enabled by default). See + https://sweet32.info/SWEET32_CCS16.pdf. + +API Changes + * Add a new X.509 API call `mbedtls_x509_parse_der_nocopy()`. + See the Features section for more information. + * Allow to opt in to the removal the API mbedtls_ssl_get_peer_cert() + for the benefit of saving RAM, by disabling the new compile-time + option MBEDTLS_SSL_KEEP_PEER_CERTIFICATE (enabled by default for + API stability). Disabling this option makes mbedtls_ssl_get_peer_cert() + always return NULL, and removes the peer_cert field from the + mbedtls_ssl_session structure which otherwise stores the peer's + certificate. + +Security + * Make mbedtls_ecdh_get_params return an error if the second key + belongs to a different group from the first. Before, if an application + passed keys that belonged to different group, the first key's data was + interpreted according to the second group, which could lead to either + an error or a meaningless output from mbedtls_ecdh_get_params. In the + latter case, this could expose at most 5 bits of the private key. + +Bugfix + * Fix a compilation issue with mbedtls_ecp_restart_ctx not being defined + when MBEDTLS_ECP_ALT is defined. Reported by jwhui. Fixes #2242. + * Run the AD too long test only if MBEDTLS_CCM_ALT is not defined. + Raised as a comment in #1996. + * Reduce the stack consumption of mbedtls_mpi_fill_random() which could + previously lead to a stack overflow on constrained targets. + * Add `MBEDTLS_SELF_TEST` for the mbedtls_self_test functions + in the header files, which missed the precompilation check. #971 + * Fix returning the value 1 when mbedtls_ecdsa_genkey failed. + * Remove a duplicate #include in a sample program. Fixed by Masashi Honma #2326. + * Remove the mbedtls namespacing from the header file, to fix a "file not found" + build error. Fixed by Haijun Gu #2319. + * Fix signed-to-unsigned integer conversion warning + in X.509 module. Fixes #2212. + * Reduce stack usage of `mpi_write_hlp()` by eliminating recursion. + Fixes #2190. + * Fix false failure in all.sh when backup files exist in include/mbedtls + (e.g. config.h.bak). Fixed by Peter Kolbus (Garmin) #2407. + * Ensure that unused bits are zero when writing ASN.1 bitstrings when using + mbedtls_asn1_write_bitstring(). + * Fix issue when writing the named bitstrings in KeyUsage and NsCertType + extensions in CSRs and CRTs that caused these bitstrings to not be encoded + correctly as trailing zeroes were not accounted for as unused bits in the + leading content octet. Fixes #1610. + +Changes + * Reduce RAM consumption during session renegotiation by not storing + the peer CRT chain and session ticket twice. + * Include configuration file in all header files that use configuration, + instead of relying on other header files that they include. + Inserted as an enhancement for #1371 + * Add support for alternative CSR headers, as used by Microsoft and defined + in RFC 7468. Found by Michael Ernst. Fixes #767. + * Correct many misspellings. Fixed by MisterDA #2371. + * Provide an abstraction of vsnprintf to allow alternative implementations + for platforms that don't provide it. Based on contributions by Joris Aerts + and Nathaniel Wesley Filardo. + * Fix clobber list in MIPS assembly for large integer multiplication. + Previously, this could lead to functionally incorrect assembly being + produced by some optimizing compilers, showing up as failures in + e.g. RSA or ECC signature operations. Reported in #1722, fix suggested + by Aurelien Jarno and submitted by Jeffrey Martin. + * Reduce the complexity of the timing tests. They were assuming more than the + underlying OS actually guarantees. + * Fix configuration queries in ssl-opt.h. #2030 + * Ensure that ssl-opt.h can be run in OS X. #2029 + * Re-enable certain interoperability tests in ssl-opt.sh which had previously + been disabled for lack of a sufficiently recent version of GnuTLS on the CI. + * Ciphersuites based on 3DES now have the lowest priority by default when + they are enabled. + += mbed TLS 2.16.0 branch released 2018-12-21 + +Features + * Add a new config.h option of MBEDTLS_CHECK_PARAMS that enables validation + of parameters in the API. This allows detection of obvious misuses of the + API, such as passing NULL pointers. The API of existing functions hasn't + changed, but requirements on parameters have been made more explicit in + the documentation. See the corresponding API documentation for each + function to see for which parameter values it is defined. This feature is + disabled by default. See its API documentation in config.h for additional + steps you have to take when enabling it. + +API Changes + * The following functions in the random generator modules have been + deprecated and replaced as shown below. The new functions change + the return type from void to int to allow returning error codes when + using MBEDTLS__ALT for the underlying AES or message digest + primitive. Fixes #1798. + mbedtls_ctr_drbg_update() -> mbedtls_ctr_drbg_update_ret() + mbedtls_hmac_drbg_update() -> mbedtls_hmac_drbg_update_ret() + * Extend ECDH interface to enable alternative implementations. + * Deprecate error codes of the form MBEDTLS_ERR_xxx_INVALID_KEY_LENGTH for + ARIA, CAMELLIA and Blowfish. These error codes will be replaced by + the more generic per-module error codes MBEDTLS_ERR_xxx_BAD_INPUT_DATA. + * Additional parameter validation checks have been added for the following + modules - AES, ARIA, Blowfish, CAMELLIA, CCM, GCM, DHM, ECP, ECDSA, ECDH, + ECJPAKE, SHA, Chacha20 and Poly1305, cipher, pk, RSA, and MPI. + Where modules have had parameter validation added, existing parameter + checks may have changed. Some modules, such as Chacha20 had existing + parameter validation whereas other modules had little. This has now been + changed so that the same level of validation is present in all modules, and + that it is now optional with the MBEDTLS_CHECK_PARAMS flag which by default + is off. That means that checks which were previously present by default + will no longer be. + +New deprecations + * Deprecate mbedtls_ctr_drbg_update and mbedtls_hmac_drbg_update + in favor of functions that can return an error code. + +Bugfix + * Fix for Clang, which was reporting a warning for the bignum.c inline + assembly for AMD64 targets creating string literals greater than those + permitted by the ISO C99 standard. Found by Aaron Jones. Fixes #482. + * Fix runtime error in `mbedtls_platform_entropy_poll()` when run + through qemu user emulation. Reported and fix suggested by randombit + in #1212. Fixes #1212. + * Fix an unsafe bounds check when restoring an SSL session from a ticket. + This could lead to a buffer overflow, but only in case ticket authentication + was broken. Reported and fix suggested by Guido Vranken in #659. + * Add explicit integer to enumeration type casts to example program + programs/pkey/gen_key which previously led to compilation failure + on some toolchains. Reported by phoenixmcallister. Fixes #2170. + * Fix double initialization of ECC hardware that made some accelerators + hang. + * Clarify documentation of mbedtls_ssl_set_own_cert() regarding the absence + of check for certificate/key matching. Reported by Attila Molnar, #507. + + = mbed TLS 2.15.1 branch released 2018-11-30 + + Changes + * Update the Mbed Crypto submodule to version 0.1.0b2. + + = mbed TLS 2.15.0 branch released 2018-11-23 + + Features + * Add an experimental build option, USE_CRYPTO_SUBMODULE, to enable use of + Mbed Crypto as the source of the cryptography implementation. + * Add an experimental configuration option, MBEDTLS_PSA_CRYPTO_C, to enable + the PSA Crypto API from Mbed Crypto when additionally used with the + USE_CRYPTO_SUBMODULE build option. + + Changes + * Add unit tests for AES-GCM when called through mbedtls_cipher_auth_xxx() + from the cipher abstraction layer. Fixes #2198. + += mbed TLS 2.14.1 branch released 2018-11-30 + +Security + * Fix timing variations and memory access variations in RSA PKCS#1 v1.5 + decryption that could lead to a Bleichenbacher-style padding oracle + attack. In TLS, this affects servers that accept ciphersuites based on + RSA decryption (i.e. ciphersuites whose name contains RSA but not + (EC)DH(E)). Discovered by Eyal Ronen (Weizmann Institute), Robert Gillham + (University of Adelaide), Daniel Genkin (University of Michigan), + Adi Shamir (Weizmann Institute), David Wong (NCC Group), and Yuval Yarom + (University of Adelaide, Data61). The attack is described in more detail + in the paper available here: http://cat.eyalro.net/cat.pdf CVE-2018-19608 + * In mbedtls_mpi_write_binary(), don't leak the exact size of the number + via branching and memory access patterns. An attacker who could submit + a plaintext for RSA PKCS#1 v1.5 decryption but only observe the timing + of the decryption and not its result could nonetheless decrypt RSA + plaintexts and forge RSA signatures. Other asymmetric algorithms may + have been similarly vulnerable. Reported by Eyal Ronen, Robert Gillham, + Daniel Genkin, Adi Shamir, David Wong and Yuval Yarom. + * Wipe sensitive buffers on the stack in the CTR_DRBG and HMAC_DRBG + modules. + +API Changes + * The new functions mbedtls_ctr_drbg_update_ret() and + mbedtls_hmac_drbg_update_ret() are similar to mbedtls_ctr_drbg_update() + and mbedtls_hmac_drbg_update() respectively, but the new functions + report errors whereas the old functions return void. We recommend that + applications use the new functions. + = mbed TLS 2.14.0 branch released 2018-11-19 Security @@ -223,7 +1223,7 @@ Security 1.2, that allowed a local attacker, able to execute code on the local machine as well as manipulate network packets, to partially recover the plaintext of messages under some conditions by using a cache attack - targetting an internal MD/SHA buffer. With TLS or if + targeting an internal MD/SHA buffer. With TLS or if mbedtls_ssl_conf_dtls_badmac_limit() was used, the attack only worked if the same secret (for example a HTTP Cookie) has been repeatedly sent over connections manipulated by the attacker. Connections using GCM or CCM @@ -1109,7 +2109,7 @@ Bugfix * Fix potential build failures related to the 'apidoc' target, introduced in the previous patch release. Found by Robert Scheck. #390 #391 * Fix issue in Makefile that prevented building using armar. #386 - * Fix memory leak that occured only when ECJPAKE was enabled and ECDHE and + * Fix memory leak that occurred only when ECJPAKE was enabled and ECDHE and ECDSA was disabled in config.h . The leak didn't occur by default. * Fix an issue that caused valid certificates to be rejected whenever an expired or not yet valid certificate was parsed before a valid certificate @@ -1351,7 +2351,7 @@ API Changes You now need to link to all of them if you use TLS for example. * All public identifiers moved to the mbedtls_* or MBEDTLS_* namespace. Some names have been further changed to make them more consistent. - Migration helpers scripts/rename.pl and include/mbedlts/compat-1.3.h are + Migration helpers scripts/rename.pl and include/mbedtls/compat-1.3.h are provided. Full list of renamings in scripts/data_files/rename-1.3-2.0.txt * Renamings of fields inside structures, not covered by the previous list: mbedtls_cipher_info_t.key_length -> key_bitlen @@ -1406,7 +2406,7 @@ API Changes * net_accept() gained new arguments for the size of the client_ip buffer. * In the threading layer, mbedtls_mutex_init() and mbedtls_mutex_free() now return void. - * ecdsa_write_signature() gained an addtional md_alg argument and + * ecdsa_write_signature() gained an additional md_alg argument and ecdsa_write_signature_det() was deprecated. * pk_sign() no longer accepts md_alg == POLARSSL_MD_NONE with ECDSA. * Last argument of x509_crt_check_key_usage() and @@ -2941,7 +3941,7 @@ XySSL ChangeLog not swapped on PadLock; also fixed compilation on older versions of gcc (bug reported by David Barrett) * Correctly handle the case in padlock_xcryptcbc() when input or - ouput data is non-aligned by falling back to the software + output data is non-aligned by falling back to the software implementation, as VIA Nehemiah cannot handle non-aligned buffers * Fixed a memory leak in x509parse_crt() which was reported by Greg Robson-Garth; some x509write.c fixes by Pascal Vizeli, thanks to diff --git a/third_party/mbedtls/repo/ChangeLog.d/00README.md b/third_party/mbedtls/repo/ChangeLog.d/00README.md new file mode 100644 index 000000000..d2ea73d1c --- /dev/null +++ b/third_party/mbedtls/repo/ChangeLog.d/00README.md @@ -0,0 +1,88 @@ +# Pending changelog entry directory + +This directory contains changelog entries that have not yet been merged +to the changelog file ([`../ChangeLog`](../ChangeLog)). + +## What requires a changelog entry? + +Write a changelog entry if there is a user-visible change. This includes: + +* Bug fixes in the library or in sample programs: fixing a security hole, + fixing broken behavior, fixing the build in some configuration or on some + platform, etc. +* New features in the library, new sample programs, or new platform support. +* Changes in existing behavior. These should be rare. Changes in features + that are documented as experimental may or may not be announced, depending + on the extent of the change and how widely we expect the feature to be used. + +We generally don't include changelog entries for: + +* Documentation improvements. +* Performance improvements, unless they are particularly significant. +* Changes to parts of the code base that users don't interact with directly, + such as test code and test data. + +Until Mbed TLS 2.24.0, we required changelog entries in more cases. +Looking at older changelog entries is good practice for how to write a +changelog entry, but not for deciding whether to write one. + +## Changelog entry file format + +A changelog entry file must have the extension `*.txt` and must have the +following format: + +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +Security + * Change description. + * Another change description. + +Features + * Yet another change description. This is a long change description that + spans multiple lines. + * Yet again another change description. + +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The permitted changelog entry categories are as follows: + + + API changes + Default behavior changes + Requirement changes + New deprecations + Removals + Features + Security + Bugfix + Changes + +Use “Changes” for anything that doesn't fit in the other categories. + +## How to write a changelog entry + +Each entry starts with three spaces, an asterisk and a space. Continuation +lines start with 5 spaces. Lines wrap at 79 characters. + +Write full English sentences with proper capitalization and punctuation. Use +the present tense. Use the imperative where applicable. For example: “Fix a +bug in mbedtls_xxx() ….” + +Include GitHub issue numbers where relevant. Use the format “#1234” for an +Mbed TLS issue. Add other external references such as CVE numbers where +applicable. + +Credit bug reporters where applicable. + +**Explain why, not how**. Remember that the audience is the users of the +library, not its developers. In particular, for a bug fix, explain the +consequences of the bug, not how the bug was fixed. For a new feature, explain +why one might be interested in the feature. For an API change or a deprecation, +explain how to update existing applications. + +See [existing entries](../ChangeLog) for examples. + +## How `ChangeLog` is updated + +Run [`../scripts/assemble_changelog.py`](../scripts/assemble_changelog.py) +from a Git working copy +to move the entries from files in `ChangeLog.d` to the main `ChangeLog` file. diff --git a/third_party/mbedtls/repo/LICENSE b/third_party/mbedtls/repo/LICENSE index 546a8e631..d64569567 100644 --- a/third_party/mbedtls/repo/LICENSE +++ b/third_party/mbedtls/repo/LICENSE @@ -1,2 +1,202 @@ -Unless specifically indicated otherwise in a file, files are licensed -under the Apache 2.0 license, as can be found in: apache-2.0.txt + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/third_party/mbedtls/repo/Makefile b/third_party/mbedtls/repo/Makefile index f4c0a0021..9344e71d9 100644 --- a/third_party/mbedtls/repo/Makefile +++ b/third_party/mbedtls/repo/Makefile @@ -1,4 +1,3 @@ - DESTDIR=/usr/local PREFIX=mbedtls_ @@ -11,19 +10,24 @@ all: programs tests no_test: programs -programs: lib +programs: lib mbedtls_test $(MAKE) -C programs lib: $(MAKE) -C library -tests: lib +tests: lib mbedtls_test $(MAKE) -C tests +mbedtls_test: + $(MAKE) -C tests mbedtls_test + ifndef WINDOWS install: no_test mkdir -p $(DESTDIR)/include/mbedtls cp -rp include/mbedtls $(DESTDIR)/include + mkdir -p $(DESTDIR)/include/psa + cp -rp include/psa $(DESTDIR)/include mkdir -p $(DESTDIR)/lib cp -RP library/libmbedtls.* $(DESTDIR)/lib @@ -41,6 +45,7 @@ install: no_test uninstall: rm -rf $(DESTDIR)/include/mbedtls + rm -rf $(DESTDIR)/include/psa rm -f $(DESTDIR)/lib/libmbedtls.* rm -f $(DESTDIR)/lib/libmbedx509.* rm -f $(DESTDIR)/lib/libmbedcrypto.* @@ -73,11 +78,11 @@ post_build: ifndef WINDOWS # If 128-bit keys are configured for CTR_DRBG, display an appropriate warning - -scripts/config.pl get MBEDTLS_CTR_DRBG_USE_128_BIT_KEY && ([ $$? -eq 0 ]) && \ + -scripts/config.py get MBEDTLS_CTR_DRBG_USE_128_BIT_KEY && ([ $$? -eq 0 ]) && \ echo '$(CTR_DRBG_128_BIT_KEY_WARNING)' # If NULL Entropy is configured, display an appropriate warning - -scripts/config.pl get MBEDTLS_TEST_NULL_ENTROPY && ([ $$? -eq 0 ]) && \ + -scripts/config.py get MBEDTLS_TEST_NULL_ENTROPY && ([ $$? -eq 0 ]) && \ echo '$(NULL_ENTROPY_WARNING)' endif @@ -106,11 +111,11 @@ covtest: lcov: rm -rf Coverage lcov --capture --initial --directory library -o files.info - lcov --capture --directory library -o tests.info - lcov --add-tracefile files.info --add-tracefile tests.info -o all.info - lcov --remove all.info -o final.info '*.h' + lcov --rc lcov_branch_coverage=1 --capture --directory library -o tests.info + lcov --rc lcov_branch_coverage=1 --add-tracefile files.info --add-tracefile tests.info -o all.info + lcov --rc lcov_branch_coverage=1 --remove all.info -o final.info '*.h' gendesc tests/Descriptions.txt -o descriptions - genhtml --title "mbed TLS" --description-file descriptions --keep-descriptions --legend --no-branch-coverage -o Coverage final.info + genhtml --title "mbed TLS" --description-file descriptions --keep-descriptions --legend --branch-coverage -o Coverage final.info rm -f files.info tests.info all.info final.info descriptions apidoc: @@ -120,3 +125,28 @@ apidoc: apidoc_clean: rm -rf apidoc endif + +## Editor navigation files +C_SOURCE_FILES = $(wildcard \ + 3rdparty/*/include/*/*.h 3rdparty/*/include/*/*/*.h 3rdparty/*/include/*/*/*/*.h \ + 3rdparty/*/*.c 3rdparty/*/*/*.c 3rdparty/*/*/*/*.c 3rdparty/*/*/*/*/*.c \ + include/*/*.h \ + library/*.[hc] \ + programs/*/*.[hc] \ + tests/include/*/*.h tests/include/*/*/*.h \ + tests/src/*.c tests/src/*/*.c \ + tests/suites/*.function \ +) +# Exuberant-ctags invocation. Other ctags implementations may require different options. +CTAGS = ctags --langmap=c:+.h.function -o +tags: $(C_SOURCE_FILES) + $(CTAGS) $@ $(C_SOURCE_FILES) +TAGS: $(C_SOURCE_FILES) + etags -o $@ $(C_SOURCE_FILES) +global: GPATH GRTAGS GSYMS GTAGS +GPATH GRTAGS GSYMS GTAGS: $(C_SOURCE_FILES) + ls $(C_SOURCE_FILES) | gtags -f - --gtagsconf .globalrc +cscope: cscope.in.out cscope.po.out cscope.out +cscope.in.out cscope.po.out cscope.out: $(C_SOURCE_FILES) + cscope -bq -u -Iinclude -Ilibrary $(patsubst %,-I%,$(wildcard 3rdparty/*/include)) -Itests/include $(C_SOURCE_FILES) +.PHONY: cscope global diff --git a/third_party/mbedtls/repo/README.md b/third_party/mbedtls/repo/README.md index d7a0e9d6b..ac2a6ab44 100644 --- a/third_party/mbedtls/repo/README.md +++ b/third_party/mbedtls/repo/README.md @@ -1,13 +1,30 @@ README for Mbed TLS =================== +Mbed TLS is a C library that implements cryptographic primitives, X.509 certificate manipulation and the SSL/TLS and DTLS protocols. Its small code footprint makes it suitable for embedded systems. + +Mbed TLS includes a reference implementation of the [PSA Cryptography API](#psa-cryptography-api). This is currently a preview for evaluation purposes only. + Configuration ------------- -Mbed TLS should build out of the box on most systems. Some platform specific options are available in the fully documented configuration file `include/mbedtls/config.h`, which is also the place where features can be selected. This file can be edited manually, or in a more programmatic way using the Perl script `scripts/config.pl` (use `--help` for usage instructions). +Mbed TLS should build out of the box on most systems. Some platform specific options are available in the fully documented configuration file `include/mbedtls/config.h`, which is also the place where features can be selected. This file can be edited manually, or in a more programmatic way using the Python 3 script `scripts/config.py` (use `--help` for usage instructions). Compiler options can be set using conventional environment variables such as `CC` and `CFLAGS` when using the Make and CMake build system (see below). +We provide some non-standard configurations focused on specific use cases in the `configs/` directory. You can read more about those in `configs/README.txt` + +Documentation +------------- + +Documentation for the Mbed TLS interfaces in the default library configuration is available as part of the [Mbed TLS documentation](https://tls.mbed.org/api/). + +To generate a local copy of the library documentation in HTML format, tailored to your compile-time configuration: + +1. Make sure that [Doxygen](http://www.doxygen.nl/) is installed. We use version 1.8.11 but slightly older or more recent versions should work. +1. Run `make apidoc`. +1. Browse `apidoc/index.html` or `apidoc/modules.html`. + Compiling --------- @@ -15,12 +32,21 @@ There are currently three active build systems used within Mbed TLS releases: - GNU Make - CMake -- Microsoft Visual Studio (Microsoft Visual Studio 2010 or later) +- Microsoft Visual Studio (Microsoft Visual Studio 2013 or later) The main systems used for development are CMake and GNU Make. Those systems are always complete and up-to-date. The others should reflect all changes present in the CMake and Make build system, although features may not be ported there automatically. The Make and CMake build systems create three libraries: libmbedcrypto, libmbedx509, and libmbedtls. Note that libmbedtls depends on libmbedx509 and libmbedcrypto, and libmbedx509 depends on libmbedcrypto. As a result, some linkers will expect flags to be in a specific order, for example the GNU linker wants `-lmbedtls -lmbedx509 -lmbedcrypto`. Also, when loading shared libraries using dlopen(), you'll need to load libmbedcrypto first, then libmbedx509, before you can load libmbedtls. +### Tool versions + +You need the following tools to build the library with the provided makefiles: + +* GNU Make or a build tool that CMake supports. +* A C99 toolchain (compiler, linker, archiver). We actively test with GCC 5.4, Clang 3.8, IAR8 and Visual Studio 2013. More recent versions should work. Slightly older versions may work. +* Python 3 to generate the test code. +* Perl to run the tests. + ### Make We require GNU Make. To build the library and the sample programs, GNU Make and a C compiler are sufficient. Some of the more advanced build targets require some Unix/Linux tools. @@ -35,7 +61,7 @@ In order to run the tests, enter: make check -The tests need Perl to be built and run. If you don't have Perl installed, you can skip building the tests with: +The tests need Python to be built and Perl to be run. If you don't have one of them installed, you can skip building the tests with: make no_test @@ -47,7 +73,7 @@ In order to build for a Windows platform, you should use `WINDOWS_BUILD=1` if th Setting the variable `SHARED` in your environment will build shared libraries in addition to the static libraries. Setting `DEBUG` gives you a debug build. You can override `CFLAGS` and `LDFLAGS` by setting them in your environment or on the make command line; compiler warning options may be overridden separately using `WARNING_CFLAGS`. Some directory-specific options (for example, `-I` directives) are still preserved. -Please note that setting `CFLAGS` overrides its default value of `-O2` and setting `WARNING_CFLAGS` overrides its default value (starting with `-Wall -W`), so if you just want to add some warning options to the default ones, you can do so by setting `CFLAGS=-O2 -Werror` for example. Setting `WARNING_CFLAGS` is useful when you want to get rid of its default content (for example because your compiler doesn't accept `-Wall` as an option). Directory-specific options cannot be overriden from the command line. +Please note that setting `CFLAGS` overrides its default value of `-O2` and setting `WARNING_CFLAGS` overrides its default value (starting with `-Wall -Wextra`), so if you just want to add some warning options to the default ones, you can do so by setting `CFLAGS=-O2 -Werror` for example. Setting `WARNING_CFLAGS` is useful when you want to get rid of its default content (for example because your compiler doesn't accept `-Wall` as an option). Directory-specific options cannot be overridden from the command line. Depending on your platform, you might run into some issues. Please check the Makefiles in `library/`, `programs/` and `tests/` for options to manually add or remove for specific platforms. You can also check [the Mbed TLS Knowledge Base](https://tls.mbed.org/kb) for articles on your platform or issue. @@ -59,13 +85,13 @@ In order to build the source using CMake in a separate directory (recommended), mkdir /path/to/build_dir && cd /path/to/build_dir cmake /path/to/mbedtls_source - make + cmake --build . In order to run the tests, enter: - make test + ctest -The test suites need Perl to be built. If you don't have Perl installed, you'll want to disable the test suites with: +The test suites need Python to be built and Perl to be executed. If you don't have one of these installed, you'll want to disable the test suites with: cmake -DENABLE_TESTING=Off /path/to/mbedtls_source @@ -129,21 +155,28 @@ Regarding variables, also note that if you set CFLAGS when invoking cmake, your value of CFLAGS doesn't override the content provided by cmake (depending on the build mode as seen above), it's merely prepended to it. +#### Mbed TLS as a subproject + +Mbed TLS supports being built as a CMake subproject. One can +use `add_subdirectory()` from a parent CMake project to include Mbed TLS as a +subproject. + ### Microsoft Visual Studio The build files for Microsoft Visual Studio are generated for Visual Studio 2010. -The solution file `mbedTLS.sln` contains all the basic projects needed to build the library and all the programs. The files in tests are not generated and compiled, as these need a perl environment as well. However, the selftest program in `programs/test/` is still available. +The solution file `mbedTLS.sln` contains all the basic projects needed to build the library and all the programs. The files in tests are not generated and compiled, as these need Python and perl environments as well. However, the selftest program in `programs/test/` is still available. Example programs ---------------- -We've included example programs for a lot of different features and uses in [`programs/`](programs/README.md). Most programs only focus on a single feature or usage scenario, so keep that in mind when copying parts of the code. +We've included example programs for a lot of different features and uses in [`programs/`](programs/README.md). +Please note that the goal of these sample programs is to demonstrate specific features of the library, and the code may need to be adapted to build a real-world application. Tests ----- -Mbed TLS includes an elaborate test suite in `tests/` that initially requires Perl to generate the tests files (e.g. `test\_suite\_mpi.c`). These files are generated from a `function file` (e.g. `suites/test\_suite\_mpi.function`) and a `data file` (e.g. `suites/test\_suite\_mpi.data`). The `function file` contains the test functions. The `data file` contains the test cases, specified as parameters that will be passed to the test function. +Mbed TLS includes an elaborate test suite in `tests/` that initially requires Python to generate the tests files (e.g. `test\_suite\_mpi.c`). These files are generated from a `function file` (e.g. `suites/test\_suite\_mpi.function`) and a `data file` (e.g. `suites/test\_suite\_mpi.data`). The `function file` contains the test functions. The `data file` contains the test cases, specified as parameters that will be passed to the test function. For machines with a Unix shell and OpenSSL (and optionally GnuTLS) installed, additional test scripts are available: @@ -153,11 +186,6 @@ For machines with a Unix shell and OpenSSL (and optionally GnuTLS) installed, ad - `tests/scripts/key-exchanges.pl` test builds in configurations with a single key exchange enabled - `tests/scripts/all.sh` runs a combination of the above tests, plus some more, with various build options (such as ASan, full `config.h`, etc). -Configurations --------------- - -We provide some non-standard configurations focused on specific use cases in the `configs/` directory. You can read more about those in `configs/README.txt` - Porting Mbed TLS ---------------- @@ -167,21 +195,53 @@ Mbed TLS can be ported to many different architectures, OS's and platforms. Befo - [What external dependencies does Mbed TLS rely on?](https://tls.mbed.org/kb/development/what-external-dependencies-does-mbedtls-rely-on) - [How do I configure Mbed TLS](https://tls.mbed.org/kb/compiling-and-building/how-do-i-configure-mbedtls) +PSA cryptography API +-------------------- + +### PSA API design + +Arm's [Platform Security Architecture (PSA)](https://developer.arm.com/architectures/security-architectures/platform-security-architecture) is a holistic set of threat models, security analyses, hardware and firmware architecture specifications, and an open source firmware reference implementation. PSA provides a recipe, based on industry best practice, that allows security to be consistently designed in, at both a hardware and firmware level. + +The [PSA cryptography API](https://armmbed.github.io/mbed-crypto/psa/#application-programming-interface) provides access to a set of cryptographic primitives. It has a dual purpose. First, it can be used in a PSA-compliant platform to build services, such as secure boot, secure storage and secure communication. Second, it can also be used independently of other PSA components on any platform. + +The design goals of the PSA cryptography API include: + +* The API distinguishes caller memory from internal memory, which allows the library to be implemented in an isolated space for additional security. Library calls can be implemented as direct function calls if isolation is not desired, and as remote procedure calls if isolation is desired. +* The structure of internal data is hidden to the application, which allows substituting alternative implementations at build time or run time, for example, in order to take advantage of hardware accelerators. +* All access to the keys happens through key identifiers, which allows support for external cryptoprocessors that is transparent to applications. +* The interface to algorithms is generic, favoring algorithm agility. +* The interface is designed to be easy to use and hard to accidentally misuse. + +Arm welcomes feedback on the design of the API. If you think something could be improved, please open an issue on our Github repository. Alternatively, if you prefer to provide your feedback privately, please email us at [`mbed-crypto@arm.com`](mailto:mbed-crypto@arm.com). All feedback received by email is treated confidentially. + +### PSA API documentation + +A browsable copy of the PSA Cryptography API documents is available on the [PSA cryptography interfaces documentation portal](https://armmbed.github.io/mbed-crypto/psa/#application-programming-interface) in [PDF](https://armmbed.github.io/mbed-crypto/PSA_Cryptography_API_Specification.pdf) and [HTML](https://armmbed.github.io/mbed-crypto/html/index.html) formats. + +### PSA implementation in Mbed TLS + +Mbed TLS includes a reference implementation of the PSA Cryptography API. +This implementation is not yet as mature as the rest of the library. Some parts of the code have not been reviewed as thoroughly, and some parts of the PSA implementation are not yet well optimized for code size. + +The X.509 and TLS code can use PSA cryptography for a limited subset of operations. To enable this support, activate the compilation option `MBEDTLS_USE_PSA_CRYPTO` in `config.h`. + +There are currently a few deviations where the library does not yet implement the latest version of the specification. Please refer to the [compliance issues on Github](https://github.com/ARMmbed/mbed-crypto/labels/compliance) for an up-to-date list. + +### Upcoming features + +Future releases of this library will include: + +* A driver programming interface, which makes it possible to use hardware accelerators instead of the default software implementation for chosen algorithms. +* Support for external keys to be stored and manipulated exclusively in a separate cryptoprocessor. +* A configuration mechanism to compile only the algorithms you need for your application. +* A wider set of cryptographic algorithms. + +License +------- + +Unless specifically indicated otherwise in a file, Mbed TLS files are provided under the [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html) license. See the [LICENSE](LICENSE) file for the full text of this license. Contributors must accept that their contributions are made under both the Apache-2.0 AND [GPL-2.0-or-later](https://spdx.org/licenses/GPL-2.0-or-later.html) licenses. This enables LTS (Long Term Support) branches of the software to be provided under either the Apache-2.0 OR GPL-2.0-or-later licenses. + Contributing ------------ -We gratefully accept bug reports and contributions from the community. There are some requirements we need to fulfill in order to be able to integrate contributions: - -- All contributions, whether large or small require a Contributor's License Agreement (CLA) to be accepted. This is because source code can possibly fall under copyright law and we need your consent to share in the ownership of the copyright. -- We would ask that contributions conform to [our coding standards](https://tls.mbed.org/kb/development/mbedtls-coding-standards), and that contributions should be fully tested before submission. -- As with any open source project, contributions will be reviewed by the project team and community and may need some modifications to be accepted. - -To accept the Contributor’s Licence Agreement (CLA), individual contributors can do this by creating an Mbed account and [accepting the online agreement here with a click through](https://os.mbed.com/contributor_agreement/). Alternatively, for contributions from corporations, or those that do not wish to create an Mbed account, a slightly different agreement can be found [here](https://www.mbed.com/en/about-mbed/contributor-license-agreements/). This agreement should be signed and returned to Arm as described in the instructions given. - -### Making a Contribution - -1. [Check for open issues](https://github.com/ARMmbed/mbedtls/issues) or [start a discussion](https://forums.mbed.com/c/mbed-tls) around a feature idea or a bug. -2. Fork the [Mbed TLS repository on GitHub](https://github.com/ARMmbed/mbedtls) to start making your changes. As a general rule, you should use the "development" branch as a basis. -3. Write a test which shows that the bug was fixed or that the feature works as expected. -4. Send a pull request and bug us until it gets merged and published. Contributions may need some modifications, so work with us to get your change accepted. We will include your name in the ChangeLog :) - +We gratefully accept bug reports and contributions from the community. Please see the [contributing guidelines](CONTRIBUTING.md) for details on how to do this. diff --git a/third_party/mbedtls/repo/apache-2.0.txt b/third_party/mbedtls/repo/apache-2.0.txt deleted file mode 100644 index d64569567..000000000 --- a/third_party/mbedtls/repo/apache-2.0.txt +++ /dev/null @@ -1,202 +0,0 @@ - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. diff --git a/third_party/mbedtls/repo/circle.yml b/third_party/mbedtls/repo/circle.yml deleted file mode 100644 index eaed02a81..000000000 --- a/third_party/mbedtls/repo/circle.yml +++ /dev/null @@ -1,44 +0,0 @@ -# Purpose: -# - To test and prove that a new commit in the mbed TLS repository builds -# and integrates with mbed-os properly. -# AND -# - To test and prove that the current development head of mbed TLS builds -# and integrates with the current mbed-os master branch. -# -# The script fetches all the prerequisites and builds the mbed TLS 'tls-client' -# example. This script is triggered by every commit and once each night and the -# exact behaviour depends on how it was triggered: -# - If it is a nightly build then it builds the mbed TLS development head with -# mbed-os master. -# - If it was triggered by the commit, then it builds the example with mbed TLS -# at that commit and mbed-os at the commit pointed by mbed-os.lib in the -# example repository. - -test: - override: - - cd ../mbed-os-example-tls/tls-client/ && mbed compile -m K64F -t GCC_ARM -c - -dependencies: - pre: - # Install gcc-arm - - cd .. && wget "https://launchpad.net/gcc-arm-embedded/4.9/4.9-2015-q3-update/+download/gcc-arm-none-eabi-4_9-2015q3-20150921-linux.tar.bz2" - - cd .. && tar -xvjf gcc-arm-none-eabi-4_9-2015q3-20150921-linux.tar.bz2 - - ln -s ../gcc-arm-none-eabi-4_9-2015q3/bin/* ../bin/ - # Install mbed-cli - - cd ../ && git clone https://github.com/ARMmbed/mbed-cli.git - - cd ../mbed-cli && sudo -H pip install -e . - # Get the sample application - - cd ../ && git clone git@github.com:ARMmbed/mbed-os-example-tls.git - # Get mbed-os - - cd ../mbed-os-example-tls/tls-client && mbed deploy - # Update mbed-os to master only if it is a nightly build - - > - if [ -n "${RUN_NIGHTLY_BUILD}" ]; then - cd ../mbed-os-example-tls/tls-client/mbed-os/ && mbed update master; - fi - # Import mbedtls current revision - - ln -s ../../../../../../../mbedtls/ ../mbed-os-example-tls/tls-client/mbed-os/features/mbedtls/importer/TARGET_IGNORE/mbedtls - - cd ../mbed-os-example-tls/tls-client/mbed-os/features/mbedtls/importer/ && make - override: - # Install the missing python packages - - cd ../mbed-os-example-tls/tls-client/mbed-os/ && sudo -H pip install -r requirements.txt diff --git a/third_party/mbedtls/repo/configs/config-ccm-psk-tls1_2.h b/third_party/mbedtls/repo/configs/config-ccm-psk-tls1_2.h index c9b58dd53..c58d150d9 100644 --- a/third_party/mbedtls/repo/configs/config-ccm-psk-tls1_2.h +++ b/third_party/mbedtls/repo/configs/config-ccm-psk-tls1_2.h @@ -4,7 +4,7 @@ * \brief Minimal configuration for TLS 1.2 with PSK and AES-CCM ciphersuites */ /* - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved + * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 * * Licensed under the Apache License, Version 2.0 (the "License"); you may @@ -18,8 +18,6 @@ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) */ /* * Minimal configuration for TLS 1.2 with PSK and AES-CCM ciphersuites diff --git a/third_party/mbedtls/repo/configs/config-mini-tls1_1.h b/third_party/mbedtls/repo/configs/config-mini-tls1_1.h index 013bc0300..638c1e260 100644 --- a/third_party/mbedtls/repo/configs/config-mini-tls1_1.h +++ b/third_party/mbedtls/repo/configs/config-mini-tls1_1.h @@ -4,7 +4,7 @@ * \brief Minimal configuration for TLS 1.1 (RFC 4346) */ /* - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved + * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 * * Licensed under the Apache License, Version 2.0 (the "License"); you may @@ -18,8 +18,6 @@ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) */ /* * Minimal configuration for TLS 1.1 (RFC 4346), implementing only the diff --git a/third_party/mbedtls/repo/configs/config-no-entropy.h b/third_party/mbedtls/repo/configs/config-no-entropy.h index 7d34ad52e..04c1213f9 100644 --- a/third_party/mbedtls/repo/configs/config-no-entropy.h +++ b/third_party/mbedtls/repo/configs/config-no-entropy.h @@ -4,7 +4,7 @@ * \brief Minimal configuration of features that do not require an entropy source */ /* - * Copyright (C) 2016, ARM Limited, All Rights Reserved + * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 * * Licensed under the Apache License, Version 2.0 (the "License"); you may @@ -18,8 +18,6 @@ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) */ /* * Minimal configuration of features that do not require an entropy source @@ -87,6 +85,6 @@ /* Miscellaneous options */ #define MBEDTLS_AES_ROM_TABLES -#include "check_config.h" +#include "mbedtls/check_config.h" #endif /* MBEDTLS_CONFIG_H */ diff --git a/third_party/mbedtls/repo/configs/config-psa-crypto.h b/third_party/mbedtls/repo/configs/config-psa-crypto.h new file mode 100644 index 000000000..b98fc9cde --- /dev/null +++ b/third_party/mbedtls/repo/configs/config-psa-crypto.h @@ -0,0 +1,3371 @@ +/** + * \file config.h + * + * \brief Configuration options (set of defines) + * + * This set of compile-time options may be used to enable + * or disable features selectively, and reduce the global + * memory footprint. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CONFIG_H +#define MBEDTLS_CONFIG_H + +#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE) +#define _CRT_SECURE_NO_DEPRECATE 1 +#endif + +/** + * \name SECTION: System support + * + * This section sets system specific settings. + * \{ + */ + +/** + * \def MBEDTLS_HAVE_ASM + * + * The compiler has support for asm(). + * + * Requires support for asm() in compiler. + * + * Used in: + * library/aria.c + * library/timing.c + * include/mbedtls/bn_mul.h + * + * Required by: + * MBEDTLS_AESNI_C + * MBEDTLS_PADLOCK_C + * + * Comment to disable the use of assembly code. + */ +#define MBEDTLS_HAVE_ASM + +/** + * \def MBEDTLS_NO_UDBL_DIVISION + * + * The platform lacks support for double-width integer division (64-bit + * division on a 32-bit platform, 128-bit division on a 64-bit platform). + * + * Used in: + * include/mbedtls/bignum.h + * library/bignum.c + * + * The bignum code uses double-width division to speed up some operations. + * Double-width division is often implemented in software that needs to + * be linked with the program. The presence of a double-width integer + * type is usually detected automatically through preprocessor macros, + * but the automatic detection cannot know whether the code needs to + * and can be linked with an implementation of division for that type. + * By default division is assumed to be usable if the type is present. + * Uncomment this option to prevent the use of double-width division. + * + * Note that division for the native integer type is always required. + * Furthermore, a 64-bit type is always required even on a 32-bit + * platform, but it need not support multiplication or division. In some + * cases it is also desirable to disable some double-width operations. For + * example, if double-width division is implemented in software, disabling + * it can reduce code size in some embedded targets. + */ +//#define MBEDTLS_NO_UDBL_DIVISION + +/** + * \def MBEDTLS_NO_64BIT_MULTIPLICATION + * + * The platform lacks support for 32x32 -> 64-bit multiplication. + * + * Used in: + * library/poly1305.c + * + * Some parts of the library may use multiplication of two unsigned 32-bit + * operands with a 64-bit result in order to speed up computations. On some + * platforms, this is not available in hardware and has to be implemented in + * software, usually in a library provided by the toolchain. + * + * Sometimes it is not desirable to have to link to that library. This option + * removes the dependency of that library on platforms that lack a hardware + * 64-bit multiplier by embedding a software implementation in Mbed TLS. + * + * Note that depending on the compiler, this may decrease performance compared + * to using the library function provided by the toolchain. + */ +//#define MBEDTLS_NO_64BIT_MULTIPLICATION + +/** + * \def MBEDTLS_HAVE_SSE2 + * + * CPU supports SSE2 instruction set. + * + * Uncomment if the CPU supports SSE2 (IA-32 specific). + */ +//#define MBEDTLS_HAVE_SSE2 + +/** + * \def MBEDTLS_HAVE_TIME + * + * System has time.h and time(). + * The time does not need to be correct, only time differences are used, + * by contrast with MBEDTLS_HAVE_TIME_DATE + * + * Defining MBEDTLS_HAVE_TIME allows you to specify MBEDTLS_PLATFORM_TIME_ALT, + * MBEDTLS_PLATFORM_TIME_MACRO, MBEDTLS_PLATFORM_TIME_TYPE_MACRO and + * MBEDTLS_PLATFORM_STD_TIME. + * + * Comment if your system does not support time functions + */ +#define MBEDTLS_HAVE_TIME + +/** + * \def MBEDTLS_HAVE_TIME_DATE + * + * System has time.h, time(), and an implementation for + * mbedtls_platform_gmtime_r() (see below). + * The time needs to be correct (not necessarily very accurate, but at least + * the date should be correct). This is used to verify the validity period of + * X.509 certificates. + * + * Comment if your system does not have a correct clock. + * + * \note mbedtls_platform_gmtime_r() is an abstraction in platform_util.h that + * behaves similarly to the gmtime_r() function from the C standard. Refer to + * the documentation for mbedtls_platform_gmtime_r() for more information. + * + * \note It is possible to configure an implementation for + * mbedtls_platform_gmtime_r() at compile-time by using the macro + * MBEDTLS_PLATFORM_GMTIME_R_ALT. + */ +#define MBEDTLS_HAVE_TIME_DATE + +/** + * \def MBEDTLS_PLATFORM_MEMORY + * + * Enable the memory allocation layer. + * + * By default mbed TLS uses the system-provided calloc() and free(). + * This allows different allocators (self-implemented or provided) to be + * provided to the platform abstraction layer. + * + * Enabling MBEDTLS_PLATFORM_MEMORY without the + * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide + * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and + * free() function pointer at runtime. + * + * Enabling MBEDTLS_PLATFORM_MEMORY and specifying + * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the + * alternate function at compile time. + * + * Requires: MBEDTLS_PLATFORM_C + * + * Enable this layer to allow use of alternative memory allocators. + */ +//#define MBEDTLS_PLATFORM_MEMORY + +/** + * \def MBEDTLS_PLATFORM_NO_STD_FUNCTIONS + * + * Do not assign standard functions in the platform layer (e.g. calloc() to + * MBEDTLS_PLATFORM_STD_CALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF) + * + * This makes sure there are no linking errors on platforms that do not support + * these functions. You will HAVE to provide alternatives, either at runtime + * via the platform_set_xxx() functions or at compile time by setting + * the MBEDTLS_PLATFORM_STD_XXX defines, or enabling a + * MBEDTLS_PLATFORM_XXX_MACRO. + * + * Requires: MBEDTLS_PLATFORM_C + * + * Uncomment to prevent default assignment of standard functions in the + * platform layer. + */ +//#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS + +/** + * \def MBEDTLS_PLATFORM_EXIT_ALT + * + * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let mbed TLS support the + * function in the platform abstraction layer. + * + * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, mbed TLS will + * provide a function "mbedtls_platform_set_printf()" that allows you to set an + * alternative printf function pointer. + * + * All these define require MBEDTLS_PLATFORM_C to be defined! + * + * \note MBEDTLS_PLATFORM_SNPRINTF_ALT is required on Windows; + * it will be enabled automatically by check_config.h + * + * \warning MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as + * MBEDTLS_PLATFORM_XXX_MACRO! + * + * Requires: MBEDTLS_PLATFORM_TIME_ALT requires MBEDTLS_HAVE_TIME + * + * Uncomment a macro to enable alternate implementation of specific base + * platform function + */ +//#define MBEDTLS_PLATFORM_EXIT_ALT +//#define MBEDTLS_PLATFORM_TIME_ALT +//#define MBEDTLS_PLATFORM_FPRINTF_ALT +//#define MBEDTLS_PLATFORM_PRINTF_ALT +//#define MBEDTLS_PLATFORM_SNPRINTF_ALT +//#define MBEDTLS_PLATFORM_VSNPRINTF_ALT +//#define MBEDTLS_PLATFORM_NV_SEED_ALT +//#define MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT + +/** + * \def MBEDTLS_DEPRECATED_WARNING + * + * Mark deprecated functions so that they generate a warning if used. + * Functions deprecated in one version will usually be removed in the next + * version. You can enable this to help you prepare the transition to a new + * major version by making sure your code is not using these functions. + * + * This only works with GCC and Clang. With other compilers, you may want to + * use MBEDTLS_DEPRECATED_REMOVED + * + * Uncomment to get warnings on using deprecated functions. + */ +//#define MBEDTLS_DEPRECATED_WARNING + +/** + * \def MBEDTLS_DEPRECATED_REMOVED + * + * Remove deprecated functions so that they generate an error if used. + * Functions deprecated in one version will usually be removed in the next + * version. You can enable this to help you prepare the transition to a new + * major version by making sure your code is not using these functions. + * + * Uncomment to get errors on using deprecated functions. + */ +//#define MBEDTLS_DEPRECATED_REMOVED + +/** + * \def MBEDTLS_CHECK_PARAMS + * + * This configuration option controls whether the library validates more of + * the parameters passed to it. + * + * When this flag is not defined, the library only attempts to validate an + * input parameter if: (1) they may come from the outside world (such as the + * network, the filesystem, etc.) or (2) not validating them could result in + * internal memory errors such as overflowing a buffer controlled by the + * library. On the other hand, it doesn't attempt to validate parameters whose + * values are fully controlled by the application (such as pointers). + * + * When this flag is defined, the library additionally attempts to validate + * parameters that are fully controlled by the application, and should always + * be valid if the application code is fully correct and trusted. + * + * For example, when a function accepts as input a pointer to a buffer that may + * contain untrusted data, and its documentation mentions that this pointer + * must not be NULL: + * - the pointer is checked to be non-NULL only if this option is enabled + * - the content of the buffer is always validated + * + * When this flag is defined, if a library function receives a parameter that + * is invalid, it will: + * - invoke the macro MBEDTLS_PARAM_FAILED() which by default expands to a + * call to the function mbedtls_param_failed() + * - immediately return (with a specific error code unless the function + * returns void and can't communicate an error). + * + * When defining this flag, you also need to: + * - either provide a definition of the function mbedtls_param_failed() in + * your application (see platform_util.h for its prototype) as the library + * calls that function, but does not provide a default definition for it, + * - or provide a different definition of the macro MBEDTLS_PARAM_FAILED() + * below if the above mechanism is not flexible enough to suit your needs. + * See the documentation of this macro later in this file. + * + * Uncomment to enable validation of application-controlled parameters. + */ +//#define MBEDTLS_CHECK_PARAMS + +/* \} name SECTION: System support */ + +/** + * \name SECTION: mbed TLS feature support + * + * This section sets support for features that are or are not needed + * within the modules that are enabled. + * \{ + */ + +/** + * \def MBEDTLS_TIMING_ALT + * + * Uncomment to provide your own alternate implementation for mbedtls_timing_hardclock(), + * mbedtls_timing_get_timer(), mbedtls_set_alarm(), mbedtls_set/get_delay() + * + * Only works if you have MBEDTLS_TIMING_C enabled. + * + * You will need to provide a header "timing_alt.h" and an implementation at + * compile time. + */ +//#define MBEDTLS_TIMING_ALT + +/** + * \def MBEDTLS_AES_ALT + * + * MBEDTLS__MODULE_NAME__ALT: Uncomment a macro to let mbed TLS use your + * alternate core implementation of a symmetric crypto, an arithmetic or hash + * module (e.g. platform specific assembly optimized implementations). Keep + * in mind that the function prototypes should remain the same. + * + * This replaces the whole module. If you only want to replace one of the + * functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. + * + * Example: In case you uncomment MBEDTLS_AES_ALT, mbed TLS will no longer + * provide the "struct mbedtls_aes_context" definition and omit the base + * function declarations and implementations. "aes_alt.h" will be included from + * "aes.h" to include the new function definitions. + * + * Uncomment a macro to enable alternate implementation of the corresponding + * module. + * + * \warning MD2, MD4, MD5, ARC4, DES and SHA-1 are considered weak and their + * use constitutes a security risk. If possible, we recommend + * avoiding dependencies on them, and considering stronger message + * digests and ciphers instead. + * + */ +//#define MBEDTLS_AES_ALT +//#define MBEDTLS_ARC4_ALT +//#define MBEDTLS_ARIA_ALT +//#define MBEDTLS_BLOWFISH_ALT +//#define MBEDTLS_CAMELLIA_ALT +//#define MBEDTLS_CCM_ALT +//#define MBEDTLS_CHACHA20_ALT +//#define MBEDTLS_CHACHAPOLY_ALT +//#define MBEDTLS_CMAC_ALT +//#define MBEDTLS_DES_ALT +//#define MBEDTLS_DHM_ALT +//#define MBEDTLS_ECJPAKE_ALT +//#define MBEDTLS_GCM_ALT +//#define MBEDTLS_NIST_KW_ALT +//#define MBEDTLS_MD2_ALT +//#define MBEDTLS_MD4_ALT +//#define MBEDTLS_MD5_ALT +//#define MBEDTLS_POLY1305_ALT +//#define MBEDTLS_RIPEMD160_ALT +//#define MBEDTLS_RSA_ALT +//#define MBEDTLS_SHA1_ALT +//#define MBEDTLS_SHA256_ALT +//#define MBEDTLS_SHA512_ALT +//#define MBEDTLS_XTEA_ALT + +/* + * When replacing the elliptic curve module, pleace consider, that it is + * implemented with two .c files: + * - ecp.c + * - ecp_curves.c + * You can replace them very much like all the other MBEDTLS__MODULE_NAME__ALT + * macros as described above. The only difference is that you have to make sure + * that you provide functionality for both .c files. + */ +//#define MBEDTLS_ECP_ALT + +/** + * \def MBEDTLS_MD2_PROCESS_ALT + * + * MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use you + * alternate core implementation of symmetric crypto or hash function. Keep in + * mind that function prototypes should remain the same. + * + * This replaces only one function. The header file from mbed TLS is still + * used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. + * + * Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, mbed TLS will + * no longer provide the mbedtls_sha1_process() function, but it will still provide + * the other function (using your mbedtls_sha1_process() function) and the definition + * of mbedtls_sha1_context, so your implementation of mbedtls_sha1_process must be compatible + * with this definition. + * + * \note Because of a signature change, the core AES encryption and decryption routines are + * currently named mbedtls_aes_internal_encrypt and mbedtls_aes_internal_decrypt, + * respectively. When setting up alternative implementations, these functions should + * be overridden, but the wrapper functions mbedtls_aes_decrypt and mbedtls_aes_encrypt + * must stay untouched. + * + * \note If you use the AES_xxx_ALT macros, then is is recommended to also set + * MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES + * tables. + * + * Uncomment a macro to enable alternate implementation of the corresponding + * function. + * + * \warning MD2, MD4, MD5, DES and SHA-1 are considered weak and their use + * constitutes a security risk. If possible, we recommend avoiding + * dependencies on them, and considering stronger message digests + * and ciphers instead. + * + */ +//#define MBEDTLS_MD2_PROCESS_ALT +//#define MBEDTLS_MD4_PROCESS_ALT +//#define MBEDTLS_MD5_PROCESS_ALT +//#define MBEDTLS_RIPEMD160_PROCESS_ALT +//#define MBEDTLS_SHA1_PROCESS_ALT +//#define MBEDTLS_SHA256_PROCESS_ALT +//#define MBEDTLS_SHA512_PROCESS_ALT +//#define MBEDTLS_DES_SETKEY_ALT +//#define MBEDTLS_DES_CRYPT_ECB_ALT +//#define MBEDTLS_DES3_CRYPT_ECB_ALT +//#define MBEDTLS_AES_SETKEY_ENC_ALT +//#define MBEDTLS_AES_SETKEY_DEC_ALT +//#define MBEDTLS_AES_ENCRYPT_ALT +//#define MBEDTLS_AES_DECRYPT_ALT +//#define MBEDTLS_ECDH_GEN_PUBLIC_ALT +//#define MBEDTLS_ECDH_COMPUTE_SHARED_ALT +//#define MBEDTLS_ECDSA_VERIFY_ALT +//#define MBEDTLS_ECDSA_SIGN_ALT +//#define MBEDTLS_ECDSA_GENKEY_ALT + +/** + * \def MBEDTLS_ECP_INTERNAL_ALT + * + * Expose a part of the internal interface of the Elliptic Curve Point module. + * + * MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your + * alternative core implementation of elliptic curve arithmetic. Keep in mind + * that function prototypes should remain the same. + * + * This partially replaces one function. The header file from mbed TLS is still + * used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation + * is still present and it is used for group structures not supported by the + * alternative. + * + * Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT + * and implementing the following functions: + * unsigned char mbedtls_internal_ecp_grp_capable( + * const mbedtls_ecp_group *grp ) + * int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) + * void mbedtls_internal_ecp_free( const mbedtls_ecp_group *grp ) + * The mbedtls_internal_ecp_grp_capable function should return 1 if the + * replacement functions implement arithmetic for the given group and 0 + * otherwise. + * The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_free are + * called before and after each point operation and provide an opportunity to + * implement optimized set up and tear down instructions. + * + * Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and + * MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac + * function, but will use your mbedtls_internal_ecp_double_jac if the group is + * supported (your mbedtls_internal_ecp_grp_capable function returns 1 when + * receives it as an argument). If the group is not supported then the original + * implementation is used. The other functions and the definition of + * mbedtls_ecp_group and mbedtls_ecp_point will not change, so your + * implementation of mbedtls_internal_ecp_double_jac and + * mbedtls_internal_ecp_grp_capable must be compatible with this definition. + * + * Uncomment a macro to enable alternate implementation of the corresponding + * function. + */ +/* Required for all the functions in this section */ +//#define MBEDTLS_ECP_INTERNAL_ALT +/* Support for Weierstrass curves with Jacobi representation */ +//#define MBEDTLS_ECP_RANDOMIZE_JAC_ALT +//#define MBEDTLS_ECP_ADD_MIXED_ALT +//#define MBEDTLS_ECP_DOUBLE_JAC_ALT +//#define MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT +//#define MBEDTLS_ECP_NORMALIZE_JAC_ALT +/* Support for curves with Montgomery arithmetic */ +//#define MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT +//#define MBEDTLS_ECP_RANDOMIZE_MXZ_ALT +//#define MBEDTLS_ECP_NORMALIZE_MXZ_ALT + +/** + * \def MBEDTLS_TEST_NULL_ENTROPY + * + * Enables testing and use of mbed TLS without any configured entropy sources. + * This permits use of the library on platforms before an entropy source has + * been integrated (see for example the MBEDTLS_ENTROPY_HARDWARE_ALT or the + * MBEDTLS_ENTROPY_NV_SEED switches). + * + * WARNING! This switch MUST be disabled in production builds, and is suitable + * only for development. + * Enabling the switch negates any security provided by the library. + * + * Requires MBEDTLS_ENTROPY_C, MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES + * + */ +//#define MBEDTLS_TEST_NULL_ENTROPY + +/** + * \def MBEDTLS_ENTROPY_HARDWARE_ALT + * + * Uncomment this macro to let mbed TLS use your own implementation of a + * hardware entropy collector. + * + * Your function must be called \c mbedtls_hardware_poll(), have the same + * prototype as declared in entropy_poll.h, and accept NULL as first argument. + * + * Uncomment to use your own hardware entropy collector. + */ +//#define MBEDTLS_ENTROPY_HARDWARE_ALT + +/** + * \def MBEDTLS_AES_ROM_TABLES + * + * Use precomputed AES tables stored in ROM. + * + * Uncomment this macro to use precomputed AES tables stored in ROM. + * Comment this macro to generate AES tables in RAM at runtime. + * + * Tradeoff: Using precomputed ROM tables reduces RAM usage by ~8kb + * (or ~2kb if \c MBEDTLS_AES_FEWER_TABLES is used) and reduces the + * initialization time before the first AES operation can be performed. + * It comes at the cost of additional ~8kb ROM use (resp. ~2kb if \c + * MBEDTLS_AES_FEWER_TABLES below is used), and potentially degraded + * performance if ROM access is slower than RAM access. + * + * This option is independent of \c MBEDTLS_AES_FEWER_TABLES. + * + */ +//#define MBEDTLS_AES_ROM_TABLES + +/** + * \def MBEDTLS_AES_FEWER_TABLES + * + * Use less ROM/RAM for AES tables. + * + * Uncommenting this macro omits 75% of the AES tables from + * ROM / RAM (depending on the value of \c MBEDTLS_AES_ROM_TABLES) + * by computing their values on the fly during operations + * (the tables are entry-wise rotations of one another). + * + * Tradeoff: Uncommenting this reduces the RAM / ROM footprint + * by ~6kb but at the cost of more arithmetic operations during + * runtime. Specifically, one has to compare 4 accesses within + * different tables to 4 accesses with additional arithmetic + * operations within the same table. The performance gain/loss + * depends on the system and memory details. + * + * This option is independent of \c MBEDTLS_AES_ROM_TABLES. + * + */ +//#define MBEDTLS_AES_FEWER_TABLES + +/** + * \def MBEDTLS_CAMELLIA_SMALL_MEMORY + * + * Use less ROM for the Camellia implementation (saves about 768 bytes). + * + * Uncomment this macro to use less memory for Camellia. + */ +//#define MBEDTLS_CAMELLIA_SMALL_MEMORY + +/** + * \def MBEDTLS_CIPHER_MODE_CBC + * + * Enable Cipher Block Chaining mode (CBC) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_CBC + +/** + * \def MBEDTLS_CIPHER_MODE_CFB + * + * Enable Cipher Feedback mode (CFB) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_CFB + +/** + * \def MBEDTLS_CIPHER_MODE_CTR + * + * Enable Counter Block Cipher mode (CTR) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_CTR + +/** + * \def MBEDTLS_CIPHER_MODE_OFB + * + * Enable Output Feedback mode (OFB) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_OFB + +/** + * \def MBEDTLS_CIPHER_MODE_XTS + * + * Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES. + */ +#define MBEDTLS_CIPHER_MODE_XTS + +/** + * \def MBEDTLS_CIPHER_NULL_CIPHER + * + * Enable NULL cipher. + * Warning: Only do so when you know what you are doing. This allows for + * encryption or channels without any security! + * + * Requires MBEDTLS_ENABLE_WEAK_CIPHERSUITES as well to enable + * the following ciphersuites: + * MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA + * MBEDTLS_TLS_RSA_WITH_NULL_SHA256 + * MBEDTLS_TLS_RSA_WITH_NULL_SHA + * MBEDTLS_TLS_RSA_WITH_NULL_MD5 + * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA + * MBEDTLS_TLS_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_PSK_WITH_NULL_SHA + * + * Uncomment this macro to enable the NULL cipher and ciphersuites + */ +//#define MBEDTLS_CIPHER_NULL_CIPHER + +/** + * \def MBEDTLS_CIPHER_PADDING_PKCS7 + * + * MBEDTLS_CIPHER_PADDING_XXX: Uncomment or comment macros to add support for + * specific padding modes in the cipher layer with cipher modes that support + * padding (e.g. CBC) + * + * If you disable all padding modes, only full blocks can be used with CBC. + * + * Enable padding modes in the cipher layer. + */ +#define MBEDTLS_CIPHER_PADDING_PKCS7 +#define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS +#define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN +#define MBEDTLS_CIPHER_PADDING_ZEROS + +/** + * \def MBEDTLS_ENABLE_WEAK_CIPHERSUITES + * + * Enable weak ciphersuites in SSL / TLS. + * Warning: Only do so when you know what you are doing. This allows for + * channels with virtually no security at all! + * + * This enables the following ciphersuites: + * MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA + * + * Uncomment this macro to enable weak ciphersuites + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers instead. + */ +//#define MBEDTLS_ENABLE_WEAK_CIPHERSUITES + +/** + * \def MBEDTLS_REMOVE_ARC4_CIPHERSUITES + * + * Remove RC4 ciphersuites by default in SSL / TLS. + * This flag removes the ciphersuites based on RC4 from the default list as + * returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible to + * enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including them + * explicitly. + * + * Uncomment this macro to remove RC4 ciphersuites by default. + */ +#define MBEDTLS_REMOVE_ARC4_CIPHERSUITES + +/** + * \def MBEDTLS_ECP_DP_SECP192R1_ENABLED + * + * MBEDTLS_ECP_XXXX_ENABLED: Enables specific curves within the Elliptic Curve + * module. By default all supported curves are enabled. + * + * Comment macros to disable the curve and functions for it + */ +#define MBEDTLS_ECP_DP_SECP192R1_ENABLED +#define MBEDTLS_ECP_DP_SECP224R1_ENABLED +#define MBEDTLS_ECP_DP_SECP256R1_ENABLED +#define MBEDTLS_ECP_DP_SECP384R1_ENABLED +#define MBEDTLS_ECP_DP_SECP521R1_ENABLED +#define MBEDTLS_ECP_DP_SECP192K1_ENABLED +#define MBEDTLS_ECP_DP_SECP224K1_ENABLED +#define MBEDTLS_ECP_DP_SECP256K1_ENABLED +#define MBEDTLS_ECP_DP_BP256R1_ENABLED +#define MBEDTLS_ECP_DP_BP384R1_ENABLED +#define MBEDTLS_ECP_DP_BP512R1_ENABLED +#define MBEDTLS_ECP_DP_CURVE25519_ENABLED +#define MBEDTLS_ECP_DP_CURVE448_ENABLED + +/** + * \def MBEDTLS_ECP_NIST_OPTIM + * + * Enable specific 'modulo p' routines for each NIST prime. + * Depending on the prime and architecture, makes operations 4 to 8 times + * faster on the corresponding curve. + * + * Comment this macro to disable NIST curves optimisation. + */ +#define MBEDTLS_ECP_NIST_OPTIM + +/** + * \def MBEDTLS_ECP_RESTARTABLE + * + * Enable "non-blocking" ECC operations that can return early and be resumed. + * + * This allows various functions to pause by returning + * #MBEDTLS_ERR_ECP_IN_PROGRESS (or, for functions in the SSL module, + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS) and then be called later again in + * order to further progress and eventually complete their operation. This is + * controlled through mbedtls_ecp_set_max_ops() which limits the maximum + * number of ECC operations a function may perform before pausing; see + * mbedtls_ecp_set_max_ops() for more information. + * + * This is useful in non-threaded environments if you want to avoid blocking + * for too long on ECC (and, hence, X.509 or SSL/TLS) operations. + * + * Uncomment this macro to enable restartable ECC computations. + * + * \note This option only works with the default software implementation of + * elliptic curve functionality. It is incompatible with + * MBEDTLS_ECP_ALT, MBEDTLS_ECDH_XXX_ALT and MBEDTLS_ECDSA_XXX_ALT. + */ +//#define MBEDTLS_ECP_RESTARTABLE + +/** + * \def MBEDTLS_ECDSA_DETERMINISTIC + * + * Enable deterministic ECDSA (RFC 6979). + * Standard ECDSA is "fragile" in the sense that lack of entropy when signing + * may result in a compromise of the long-term signing key. This is avoided by + * the deterministic variant. + * + * Requires: MBEDTLS_HMAC_DRBG_C + * + * Comment this macro to disable deterministic ECDSA. + */ +#define MBEDTLS_ECDSA_DETERMINISTIC + +/** + * \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED + * + * Enable the PSK based ciphersuite modes in SSL / TLS. + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED + * + * Enable the DHE-PSK based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_DHM_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA + * + * \warning Using DHE constitutes a security risk as it + * is not possible to validate custom DH parameters. + * If possible, it is recommended users should consider + * preferring other methods of key exchange. + * See dhm.h for more details. + * + */ +#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED + * + * Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED + * + * Enable the RSA-PSK based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED + * + * Enable the RSA-only based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 + */ +#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED + * + * Enable the DHE-RSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_DHM_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA + * + * \warning Using DHE constitutes a security risk as it + * is not possible to validate custom DH parameters. + * If possible, it is recommended users should consider + * preferring other methods of key exchange. + * See dhm.h for more details. + * + */ +#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED + * + * Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED + * + * Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C, + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED + * + * Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + */ +#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED + * + * Enable the ECDH-RSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 + */ +#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED + * + * Enable the ECJPAKE based ciphersuite modes in SSL / TLS. + * + * \warning This is currently experimental. EC J-PAKE support is based on the + * Thread v1.0.0 specification; incompatible changes to the specification + * might still happen. For this reason, this is disabled by default. + * + * Requires: MBEDTLS_ECJPAKE_C + * MBEDTLS_SHA256_C + * MBEDTLS_ECP_DP_SECP256R1_ENABLED + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 + */ +//#define MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED + +/** + * \def MBEDTLS_PK_PARSE_EC_EXTENDED + * + * Enhance support for reading EC keys using variants of SEC1 not allowed by + * RFC 5915 and RFC 5480. + * + * Currently this means parsing the SpecifiedECDomain choice of EC + * parameters (only known groups are supported, not arbitrary domains, to + * avoid validation issues). + * + * Disable if you only need to support RFC 5915 + 5480 key formats. + */ +#define MBEDTLS_PK_PARSE_EC_EXTENDED + +/** + * \def MBEDTLS_ERROR_STRERROR_DUMMY + * + * Enable a dummy error function to make use of mbedtls_strerror() in + * third party libraries easier when MBEDTLS_ERROR_C is disabled + * (no effect when MBEDTLS_ERROR_C is enabled). + * + * You can safely disable this if MBEDTLS_ERROR_C is enabled, or if you're + * not using mbedtls_strerror() or error_strerror() in your application. + * + * Disable if you run into name conflicts and want to really remove the + * mbedtls_strerror() + */ +#define MBEDTLS_ERROR_STRERROR_DUMMY + +/** + * \def MBEDTLS_GENPRIME + * + * Enable the prime-number generation code. + * + * Requires: MBEDTLS_BIGNUM_C + */ +#define MBEDTLS_GENPRIME + +/** + * \def MBEDTLS_FS_IO + * + * Enable functions that use the filesystem. + */ +#define MBEDTLS_FS_IO + +/** + * \def MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES + * + * Do not add default entropy sources. These are the platform specific, + * mbedtls_timing_hardclock and HAVEGE based poll functions. + * + * This is useful to have more control over the added entropy sources in an + * application. + * + * Uncomment this macro to prevent loading of default entropy functions. + */ +//#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES + +/** + * \def MBEDTLS_NO_PLATFORM_ENTROPY + * + * Do not use built-in platform entropy functions. + * This is useful if your platform does not support + * standards like the /dev/urandom or Windows CryptoAPI. + * + * Uncomment this macro to disable the built-in platform entropy functions. + */ +//#define MBEDTLS_NO_PLATFORM_ENTROPY + +/** + * \def MBEDTLS_ENTROPY_FORCE_SHA256 + * + * Force the entropy accumulator to use a SHA-256 accumulator instead of the + * default SHA-512 based one (if both are available). + * + * Requires: MBEDTLS_SHA256_C + * + * On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option + * if you have performance concerns. + * + * This option is only useful if both MBEDTLS_SHA256_C and + * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used. + */ +//#define MBEDTLS_ENTROPY_FORCE_SHA256 + +/** + * \def MBEDTLS_ENTROPY_NV_SEED + * + * Enable the non-volatile (NV) seed file-based entropy source. + * (Also enables the NV seed read/write functions in the platform layer) + * + * This is crucial (if not required) on systems that do not have a + * cryptographic entropy source (in hardware or kernel) available. + * + * Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C + * + * \note The read/write functions that are used by the entropy source are + * determined in the platform layer, and can be modified at runtime and/or + * compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used. + * + * \note If you use the default implementation functions that read a seedfile + * with regular fopen(), please make sure you make a seedfile with the + * proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at + * least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from + * and written to or you will get an entropy source error! The default + * implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE + * bytes from the file. + * + * \note The entropy collector will write to the seed file before entropy is + * given to an external source, to update it. + */ +//#define MBEDTLS_ENTROPY_NV_SEED + +/* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER + * + * Enable key identifiers that encode a key owner identifier. + * + * This is only meaningful when building the library as part of a + * multi-client service. When you activate this option, you must provide an + * implementation of the type mbedtls_key_owner_id_t and a translation from + * mbedtls_svc_key_id_t to file name in all the storage backends that you + * you wish to support. + * + * Note that this option is meant for internal use only and may be removed + * without notice. + */ +//#define MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER + +/** + * \def MBEDTLS_MEMORY_DEBUG + * + * Enable debugging of buffer allocator memory issues. Automatically prints + * (to stderr) all (fatal) messages on memory allocation issues. Enables + * function for 'debug output' of allocated memory. + * + * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C + * + * Uncomment this macro to let the buffer allocator print out error messages. + */ +//#define MBEDTLS_MEMORY_DEBUG + +/** + * \def MBEDTLS_MEMORY_BACKTRACE + * + * Include backtrace information with each allocated block. + * + * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C + * GLIBC-compatible backtrace() an backtrace_symbols() support + * + * Uncomment this macro to include backtrace information + */ +//#define MBEDTLS_MEMORY_BACKTRACE + +/** + * \def MBEDTLS_PK_RSA_ALT_SUPPORT + * + * Support external private RSA keys (eg from a HSM) in the PK layer. + * + * Comment this macro to disable support for external private RSA keys. + */ +#define MBEDTLS_PK_RSA_ALT_SUPPORT + +/** + * \def MBEDTLS_PKCS1_V15 + * + * Enable support for PKCS#1 v1.5 encoding. + * + * Requires: MBEDTLS_RSA_C + * + * This enables support for PKCS#1 v1.5 operations. + */ +#define MBEDTLS_PKCS1_V15 + +/** + * \def MBEDTLS_PKCS1_V21 + * + * Enable support for PKCS#1 v2.1 encoding. + * + * Requires: MBEDTLS_MD_C, MBEDTLS_RSA_C + * + * This enables support for RSAES-OAEP and RSASSA-PSS operations. + */ +#define MBEDTLS_PKCS1_V21 + +/** + * \def MBEDTLS_PSA_CRYPTO_SPM + * + * When MBEDTLS_PSA_CRYPTO_SPM is defined, the code is built for SPM (Secure + * Partition Manager) integration which separates the code into two parts: a + * NSPE (Non-Secure Process Environment) and an SPE (Secure Process + * Environment). + * + * Module: library/psa_crypto.c + * Requires: MBEDTLS_PSA_CRYPTO_C + * + */ +//#define MBEDTLS_PSA_CRYPTO_SPM + +/** + * \def MBEDTLS_PSA_INJECT_ENTROPY + * + * Enable support for entropy injection at first boot. This feature is + * required on systems that do not have a built-in entropy source (TRNG). + * This feature is currently not supported on systems that have a built-in + * entropy source. + * + * Requires: MBEDTLS_PSA_CRYPTO_STORAGE_C, MBEDTLS_ENTROPY_NV_SEED + * + */ +//#define MBEDTLS_PSA_INJECT_ENTROPY + +/** + * \def MBEDTLS_RSA_NO_CRT + * + * Do not use the Chinese Remainder Theorem + * for the RSA private operation. + * + * Uncomment this macro to disable the use of CRT in RSA. + * + */ +//#define MBEDTLS_RSA_NO_CRT + +/** + * \def MBEDTLS_SELF_TEST + * + * Enable the checkup functions (*_self_test). + */ +#define MBEDTLS_SELF_TEST + +/** + * \def MBEDTLS_SHA256_SMALLER + * + * Enable an implementation of SHA-256 that has lower ROM footprint but also + * lower performance. + * + * The default implementation is meant to be a reasonnable compromise between + * performance and size. This version optimizes more aggressively for size at + * the expense of performance. Eg on Cortex-M4 it reduces the size of + * mbedtls_sha256_process() from ~2KB to ~0.5KB for a performance hit of about + * 30%. + * + * Uncomment to enable the smaller implementation of SHA256. + */ +//#define MBEDTLS_SHA256_SMALLER + +/** + * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES + * + * Enable sending of alert messages in case of encountered errors as per RFC. + * If you choose not to send the alert messages, mbed TLS can still communicate + * with other servers, only debugging of failures is harder. + * + * The advantage of not sending alert messages, is that no information is given + * about reasons for failures thus preventing adversaries of gaining intel. + * + * Enable sending of all alert messages + */ +#define MBEDTLS_SSL_ALL_ALERT_MESSAGES + +/** + * \def MBEDTLS_SSL_ASYNC_PRIVATE + * + * Enable asynchronous external private key operations in SSL. This allows + * you to configure an SSL connection to call an external cryptographic + * module to perform private key operations instead of performing the + * operation inside the library. + * + */ +//#define MBEDTLS_SSL_ASYNC_PRIVATE + +/** + * \def MBEDTLS_SSL_DEBUG_ALL + * + * Enable the debug messages in SSL module for all issues. + * Debug messages have been disabled in some places to prevent timing + * attacks due to (unbalanced) debugging function calls. + * + * If you need all error reporting you should enable this during debugging, + * but remove this for production servers that should log as well. + * + * Uncomment this macro to report all debug messages on errors introducing + * a timing side-channel. + * + */ +//#define MBEDTLS_SSL_DEBUG_ALL + +/** \def MBEDTLS_SSL_ENCRYPT_THEN_MAC + * + * Enable support for Encrypt-then-MAC, RFC 7366. + * + * This allows peers that both support it to use a more robust protection for + * ciphersuites using CBC, providing deep resistance against timing attacks + * on the padding or underlying cipher. + * + * This only affects CBC ciphersuites, and is useless if none is defined. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1 or + * MBEDTLS_SSL_PROTO_TLS1_1 or + * MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this macro to disable support for Encrypt-then-MAC + */ +#define MBEDTLS_SSL_ENCRYPT_THEN_MAC + +/** \def MBEDTLS_SSL_EXTENDED_MASTER_SECRET + * + * Enable support for Extended Master Secret, aka Session Hash + * (draft-ietf-tls-session-hash-02). + * + * This was introduced as "the proper fix" to the Triple Handshake familiy of + * attacks, but it is recommended to always use it (even if you disable + * renegotiation), since it actually fixes a more fundamental issue in the + * original SSL/TLS design, and has implications beyond Triple Handshake. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1 or + * MBEDTLS_SSL_PROTO_TLS1_1 or + * MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this macro to disable support for Extended Master Secret. + */ +#define MBEDTLS_SSL_EXTENDED_MASTER_SECRET + +/** + * \def MBEDTLS_SSL_FALLBACK_SCSV + * + * Enable support for FALLBACK_SCSV (draft-ietf-tls-downgrade-scsv-00). + * + * For servers, it is recommended to always enable this, unless you support + * only one version of TLS, or know for sure that none of your clients + * implements a fallback strategy. + * + * For clients, you only need this if you're using a fallback strategy, which + * is not recommended in the first place, unless you absolutely need it to + * interoperate with buggy (version-intolerant) servers. + * + * Comment this macro to disable support for FALLBACK_SCSV + */ +#define MBEDTLS_SSL_FALLBACK_SCSV + +/** + * \def MBEDTLS_SSL_HW_RECORD_ACCEL + * + * Enable hooking functions in SSL module for hardware acceleration of + * individual records. + * + * Uncomment this macro to enable hooking functions. + */ +//#define MBEDTLS_SSL_HW_RECORD_ACCEL + +/** + * \def MBEDTLS_SSL_CBC_RECORD_SPLITTING + * + * Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0. + * + * This is a countermeasure to the BEAST attack, which also minimizes the risk + * of interoperability issues compared to sending 0-length records. + * + * Comment this macro to disable 1/n-1 record splitting. + */ +#define MBEDTLS_SSL_CBC_RECORD_SPLITTING + +/** + * \def MBEDTLS_SSL_RENEGOTIATION + * + * Enable support for TLS renegotiation. + * + * The two main uses of renegotiation are (1) refresh keys on long-lived + * connections and (2) client authentication after the initial handshake. + * If you don't need renegotiation, it's probably better to disable it, since + * it has been associated with security issues in the past and is easy to + * misuse/misunderstand. + * + * Comment this to disable support for renegotiation. + * + * \note Even if this option is disabled, both client and server are aware + * of the Renegotiation Indication Extension (RFC 5746) used to + * prevent the SSL renegotiation attack (see RFC 5746 Sect. 1). + * (See \c mbedtls_ssl_conf_legacy_renegotiation for the + * configuration of this extension). + * + */ +#define MBEDTLS_SSL_RENEGOTIATION + +/** + * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO + * + * Enable support for receiving and parsing SSLv2 Client Hello messages for the + * SSL Server module (MBEDTLS_SSL_SRV_C). + * + * Uncomment this macro to enable support for SSLv2 Client Hello messages. + */ +//#define MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO + +/** + * \def MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE + * + * Pick the ciphersuite according to the client's preferences rather than ours + * in the SSL Server module (MBEDTLS_SSL_SRV_C). + * + * Uncomment this macro to respect client's ciphersuite order + */ +//#define MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE + +/** + * \def MBEDTLS_SSL_MAX_FRAGMENT_LENGTH + * + * Enable support for RFC 6066 max_fragment_length extension in SSL. + * + * Comment this macro to disable support for the max_fragment_length extension + */ +#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH + +/** + * \def MBEDTLS_SSL_PROTO_SSL3 + * + * Enable support for SSL 3.0. + * + * Requires: MBEDTLS_MD5_C + * MBEDTLS_SHA1_C + * + * Comment this macro to disable support for SSL 3.0 + */ +//#define MBEDTLS_SSL_PROTO_SSL3 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1 + * + * Enable support for TLS 1.0. + * + * Requires: MBEDTLS_MD5_C + * MBEDTLS_SHA1_C + * + * Comment this macro to disable support for TLS 1.0 + */ +#define MBEDTLS_SSL_PROTO_TLS1 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1_1 + * + * Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled). + * + * Requires: MBEDTLS_MD5_C + * MBEDTLS_SHA1_C + * + * Comment this macro to disable support for TLS 1.1 / DTLS 1.0 + */ +#define MBEDTLS_SSL_PROTO_TLS1_1 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1_2 + * + * Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled). + * + * Requires: MBEDTLS_SHA1_C or MBEDTLS_SHA256_C or MBEDTLS_SHA512_C + * (Depends on ciphersuites) + * + * Comment this macro to disable support for TLS 1.2 / DTLS 1.2 + */ +#define MBEDTLS_SSL_PROTO_TLS1_2 + +/** + * \def MBEDTLS_SSL_PROTO_DTLS + * + * Enable support for DTLS (all available versions). + * + * Enable this and MBEDTLS_SSL_PROTO_TLS1_1 to enable DTLS 1.0, + * and/or this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1_1 + * or MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this macro to disable support for DTLS + */ +#define MBEDTLS_SSL_PROTO_DTLS + +/** + * \def MBEDTLS_SSL_ALPN + * + * Enable support for RFC 7301 Application Layer Protocol Negotiation. + * + * Comment this macro to disable support for ALPN. + */ +#define MBEDTLS_SSL_ALPN + +/** + * \def MBEDTLS_SSL_DTLS_ANTI_REPLAY + * + * Enable support for the anti-replay mechanism in DTLS. + * + * Requires: MBEDTLS_SSL_TLS_C + * MBEDTLS_SSL_PROTO_DTLS + * + * \warning Disabling this is often a security risk! + * See mbedtls_ssl_conf_dtls_anti_replay() for details. + * + * Comment this to disable anti-replay in DTLS. + */ +#define MBEDTLS_SSL_DTLS_ANTI_REPLAY + +/** + * \def MBEDTLS_SSL_DTLS_HELLO_VERIFY + * + * Enable support for HelloVerifyRequest on DTLS servers. + * + * This feature is highly recommended to prevent DTLS servers being used as + * amplifiers in DoS attacks against other hosts. It should always be enabled + * unless you know for sure amplification cannot be a problem in the + * environment in which your server operates. + * + * \warning Disabling this can ba a security risk! (see above) + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + * + * Comment this to disable support for HelloVerifyRequest. + */ +#define MBEDTLS_SSL_DTLS_HELLO_VERIFY + +/** + * \def MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE + * + * Enable server-side support for clients that reconnect from the same port. + * + * Some clients unexpectedly close the connection and try to reconnect using the + * same source port. This needs special support from the server to handle the + * new connection securely, as described in section 4.2.8 of RFC 6347. This + * flag enables that support. + * + * Requires: MBEDTLS_SSL_DTLS_HELLO_VERIFY + * + * Comment this to disable support for clients reusing the source port. + */ +#define MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE + +/** + * \def MBEDTLS_SSL_DTLS_BADMAC_LIMIT + * + * Enable support for a limit of records with bad MAC. + * + * See mbedtls_ssl_conf_dtls_badmac_limit(). + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + */ +#define MBEDTLS_SSL_DTLS_BADMAC_LIMIT + +/** + * \def MBEDTLS_SSL_SESSION_TICKETS + * + * Enable support for RFC 5077 session tickets in SSL. + * Client-side, provides full support for session tickets (maintenance of a + * session store remains the responsibility of the application, though). + * Server-side, you also need to provide callbacks for writing and parsing + * tickets, including authenticated encryption and key management. Example + * callbacks are provided by MBEDTLS_SSL_TICKET_C. + * + * Comment this macro to disable support for SSL session tickets + */ +#define MBEDTLS_SSL_SESSION_TICKETS + +/** + * \def MBEDTLS_SSL_EXPORT_KEYS + * + * Enable support for exporting key block and master secret. + * This is required for certain users of TLS, e.g. EAP-TLS. + * + * Comment this macro to disable support for key export + */ +#define MBEDTLS_SSL_EXPORT_KEYS + +/** + * \def MBEDTLS_SSL_SERVER_NAME_INDICATION + * + * Enable support for RFC 6066 server name indication (SNI) in SSL. + * + * Requires: MBEDTLS_X509_CRT_PARSE_C + * + * Comment this macro to disable support for server name indication in SSL + */ +#define MBEDTLS_SSL_SERVER_NAME_INDICATION + +/** + * \def MBEDTLS_SSL_TRUNCATED_HMAC + * + * Enable support for RFC 6066 truncated HMAC in SSL. + * + * Comment this macro to disable support for truncated HMAC in SSL + */ +#define MBEDTLS_SSL_TRUNCATED_HMAC + +/** + * \def MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT + * + * Fallback to old (pre-2.7), non-conforming implementation of the truncated + * HMAC extension which also truncates the HMAC key. Note that this option is + * only meant for a transitory upgrade period and is likely to be removed in + * a future version of the library. + * + * \warning The old implementation is non-compliant and has a security weakness + * (2^80 brute force attack on the HMAC key used for a single, + * uninterrupted connection). This should only be enabled temporarily + * when (1) the use of truncated HMAC is essential in order to save + * bandwidth, and (2) the peer is an Mbed TLS stack that doesn't use + * the fixed implementation yet (pre-2.7). + * + * \deprecated This option is deprecated and will likely be removed in a + * future version of Mbed TLS. + * + * Uncomment to fallback to old, non-compliant truncated HMAC implementation. + * + * Requires: MBEDTLS_SSL_TRUNCATED_HMAC + */ +//#define MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT + +/** + * \def MBEDTLS_THREADING_ALT + * + * Provide your own alternate threading implementation. + * + * Requires: MBEDTLS_THREADING_C + * + * Uncomment this to allow your own alternate threading implementation. + */ +//#define MBEDTLS_THREADING_ALT + +/** + * \def MBEDTLS_THREADING_PTHREAD + * + * Enable the pthread wrapper layer for the threading layer. + * + * Requires: MBEDTLS_THREADING_C + * + * Uncomment this to enable pthread mutexes. + */ +//#define MBEDTLS_THREADING_PTHREAD + +/** + * \def MBEDTLS_USE_PSA_CRYPTO + * + * Make the X.509 and TLS library use PSA for cryptographic operations, see + * #MBEDTLS_PSA_CRYPTO_C. + * + * Note: this option is still in progress, the full X.509 and TLS modules are + * not covered yet, but parts that are not ported to PSA yet will still work + * as usual, so enabling this option should not break backwards compatibility. + * + * \warning Support for PSA is still an experimental feature. + * Any public API that depends on this option may change + * at any time until this warning is removed. + * + * Requires: MBEDTLS_PSA_CRYPTO_C. + */ +//#define MBEDTLS_USE_PSA_CRYPTO + +/** + * \def MBEDTLS_VERSION_FEATURES + * + * Allow run-time checking of compile-time enabled features. Thus allowing users + * to check at run-time if the library is for instance compiled with threading + * support via mbedtls_version_check_feature(). + * + * Requires: MBEDTLS_VERSION_C + * + * Comment this to disable run-time checking and save ROM space + */ +#define MBEDTLS_VERSION_FEATURES + +/** + * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 + * + * If set, the X509 parser will not break-off when parsing an X509 certificate + * and encountering an extension in a v1 or v2 certificate. + * + * Uncomment to prevent an error. + */ +//#define MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 + +/** + * \def MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION + * + * If set, the X509 parser will not break-off when parsing an X509 certificate + * and encountering an unknown critical extension. + * + * \warning Depending on your PKI use, enabling this can be a security risk! + * + * Uncomment to prevent an error. + */ +//#define MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION + +/** + * \def MBEDTLS_X509_CHECK_KEY_USAGE + * + * Enable verification of the keyUsage extension (CA and leaf certificates). + * + * Disabling this avoids problems with mis-issued and/or misused + * (intermediate) CA and leaf certificates. + * + * \warning Depending on your PKI use, disabling this can be a security risk! + * + * Comment to skip keyUsage checking for both CA and leaf certificates. + */ +#define MBEDTLS_X509_CHECK_KEY_USAGE + +/** + * \def MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE + * + * Enable verification of the extendedKeyUsage extension (leaf certificates). + * + * Disabling this avoids problems with mis-issued and/or misused certificates. + * + * \warning Depending on your PKI use, disabling this can be a security risk! + * + * Comment to skip extendedKeyUsage checking for certificates. + */ +#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE + +/** + * \def MBEDTLS_X509_RSASSA_PSS_SUPPORT + * + * Enable parsing and verification of X.509 certificates, CRLs and CSRS + * signed with RSASSA-PSS (aka PKCS#1 v2.1). + * + * Comment this macro to disallow using RSASSA-PSS in certificates. + */ +#define MBEDTLS_X509_RSASSA_PSS_SUPPORT + +/** + * \def MBEDTLS_ZLIB_SUPPORT + * + * If set, the SSL/TLS module uses ZLIB to support compression and + * decompression of packet data. + * + * \warning TLS-level compression MAY REDUCE SECURITY! See for example the + * CRIME attack. Before enabling this option, you should examine with care if + * CRIME or similar exploits may be applicable to your use case. + * + * \note Currently compression can't be used with DTLS. + * + * \deprecated This feature is deprecated and will be removed + * in the next major revision of the library. + * + * Used in: library/ssl_tls.c + * library/ssl_cli.c + * library/ssl_srv.c + * + * This feature requires zlib library and headers to be present. + * + * Uncomment to enable use of ZLIB + */ +//#define MBEDTLS_ZLIB_SUPPORT +/* \} name SECTION: mbed TLS feature support */ + +/** + * \name SECTION: mbed TLS modules + * + * This section enables or disables entire modules in mbed TLS + * \{ + */ + +/** + * \def MBEDTLS_AESNI_C + * + * Enable AES-NI support on x86-64. + * + * Module: library/aesni.c + * Caller: library/aes.c + * + * Requires: MBEDTLS_HAVE_ASM + * + * This modules adds support for the AES-NI instructions on x86-64 + */ +#define MBEDTLS_AESNI_C + +/** + * \def MBEDTLS_AES_C + * + * Enable the AES block cipher. + * + * Module: library/aes.c + * Caller: library/cipher.c + * library/pem.c + * library/ctr_drbg.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA + * + * PEM_PARSE uses AES for decrypting encrypted keys. + */ +#define MBEDTLS_AES_C + +/** + * \def MBEDTLS_ARC4_C + * + * Enable the ARCFOUR stream cipher. + * + * Module: library/arc4.c + * Caller: library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 + * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA + * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. If possible, we recommend avoidng dependencies on + * it, and considering stronger ciphers instead. + * + */ +#define MBEDTLS_ARC4_C + +/** + * \def MBEDTLS_ASN1_PARSE_C + * + * Enable the generic ASN1 parser. + * + * Module: library/asn1.c + * Caller: library/x509.c + * library/dhm.c + * library/pkcs12.c + * library/pkcs5.c + * library/pkparse.c + */ +#define MBEDTLS_ASN1_PARSE_C + +/** + * \def MBEDTLS_ASN1_WRITE_C + * + * Enable the generic ASN1 writer. + * + * Module: library/asn1write.c + * Caller: library/ecdsa.c + * library/pkwrite.c + * library/x509_create.c + * library/x509write_crt.c + * library/x509write_csr.c + */ +#define MBEDTLS_ASN1_WRITE_C + +/** + * \def MBEDTLS_BASE64_C + * + * Enable the Base64 module. + * + * Module: library/base64.c + * Caller: library/pem.c + * + * This module is required for PEM support (required by X.509). + */ +#define MBEDTLS_BASE64_C + +/** + * \def MBEDTLS_BIGNUM_C + * + * Enable the multi-precision integer library. + * + * Module: library/bignum.c + * Caller: library/dhm.c + * library/ecp.c + * library/ecdsa.c + * library/rsa.c + * library/rsa_internal.c + * library/ssl_tls.c + * + * This module is required for RSA, DHM and ECC (ECDH, ECDSA) support. + */ +#define MBEDTLS_BIGNUM_C + +/** + * \def MBEDTLS_BLOWFISH_C + * + * Enable the Blowfish block cipher. + * + * Module: library/blowfish.c + */ +#define MBEDTLS_BLOWFISH_C + +/** + * \def MBEDTLS_CAMELLIA_C + * + * Enable the Camellia block cipher. + * + * Module: library/camellia.c + * Caller: library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 + */ +#define MBEDTLS_CAMELLIA_C + +/** + * \def MBEDTLS_ARIA_C + * + * Enable the ARIA block cipher. + * + * Module: library/aria.c + * Caller: library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * + * MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384 + */ +//#define MBEDTLS_ARIA_C + +/** + * \def MBEDTLS_CCM_C + * + * Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher. + * + * Module: library/ccm.c + * + * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C + * + * This module enables the AES-CCM ciphersuites, if other requisites are + * enabled as well. + */ +#define MBEDTLS_CCM_C + +/** + * \def MBEDTLS_CERTS_C + * + * Enable the test certificates. + * + * Module: library/certs.c + * Caller: + * + * This module is used for testing (ssl_client/server). + */ +#define MBEDTLS_CERTS_C + +/** + * \def MBEDTLS_CHACHA20_C + * + * Enable the ChaCha20 stream cipher. + * + * Module: library/chacha20.c + */ +#define MBEDTLS_CHACHA20_C + +/** + * \def MBEDTLS_CHACHAPOLY_C + * + * Enable the ChaCha20-Poly1305 AEAD algorithm. + * + * Module: library/chachapoly.c + * + * This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C + */ +#define MBEDTLS_CHACHAPOLY_C + +/** + * \def MBEDTLS_CIPHER_C + * + * Enable the generic cipher layer. + * + * Module: library/cipher.c + * Caller: library/ssl_tls.c + * + * Uncomment to enable generic cipher wrappers. + */ +#define MBEDTLS_CIPHER_C + +/** + * \def MBEDTLS_CMAC_C + * + * Enable the CMAC (Cipher-based Message Authentication Code) mode for block + * ciphers. + * + * Module: library/cmac.c + * + * Requires: MBEDTLS_AES_C or MBEDTLS_DES_C + * + */ +#define MBEDTLS_CMAC_C + +/** + * \def MBEDTLS_CTR_DRBG_C + * + * Enable the CTR_DRBG AES-based random generator. + * The CTR_DRBG generator uses AES-256 by default. + * To use AES-128 instead, enable MBEDTLS_CTR_DRBG_USE_128_BIT_KEY below. + * + * Module: library/ctr_drbg.c + * Caller: + * + * Requires: MBEDTLS_AES_C + * + * This module provides the CTR_DRBG AES random number generator. + */ +#define MBEDTLS_CTR_DRBG_C + +/** + * \def MBEDTLS_DEBUG_C + * + * Enable the debug functions. + * + * Module: library/debug.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * + * This module provides debugging functions. + */ +#define MBEDTLS_DEBUG_C + +/** + * \def MBEDTLS_DES_C + * + * Enable the DES block cipher. + * + * Module: library/des.c + * Caller: library/pem.c + * library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA + * + * PEM_PARSE uses DES/3DES for decrypting encrypted keys. + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers instead. + */ +#define MBEDTLS_DES_C + +/** + * \def MBEDTLS_DHM_C + * + * Enable the Diffie-Hellman-Merkle module. + * + * Module: library/dhm.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * + * This module is used by the following key exchanges: + * DHE-RSA, DHE-PSK + * + * \warning Using DHE constitutes a security risk as it + * is not possible to validate custom DH parameters. + * If possible, it is recommended users should consider + * preferring other methods of key exchange. + * See dhm.h for more details. + * + */ +#define MBEDTLS_DHM_C + +/** + * \def MBEDTLS_ECDH_C + * + * Enable the elliptic curve Diffie-Hellman library. + * + * Module: library/ecdh.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * + * This module is used by the following key exchanges: + * ECDHE-ECDSA, ECDHE-RSA, DHE-PSK + * + * Requires: MBEDTLS_ECP_C + */ +#define MBEDTLS_ECDH_C + +/** + * \def MBEDTLS_ECDSA_C + * + * Enable the elliptic curve DSA library. + * + * Module: library/ecdsa.c + * Caller: + * + * This module is used by the following key exchanges: + * ECDHE-ECDSA + * + * Requires: MBEDTLS_ECP_C, MBEDTLS_ASN1_WRITE_C, MBEDTLS_ASN1_PARSE_C + */ +#define MBEDTLS_ECDSA_C + +/** + * \def MBEDTLS_ECJPAKE_C + * + * Enable the elliptic curve J-PAKE library. + * + * \warning This is currently experimental. EC J-PAKE support is based on the + * Thread v1.0.0 specification; incompatible changes to the specification + * might still happen. For this reason, this is disabled by default. + * + * Module: library/ecjpake.c + * Caller: + * + * This module is used by the following key exchanges: + * ECJPAKE + * + * Requires: MBEDTLS_ECP_C, MBEDTLS_MD_C + */ +//#define MBEDTLS_ECJPAKE_C + +/** + * \def MBEDTLS_ECP_C + * + * Enable the elliptic curve over GF(p) library. + * + * Module: library/ecp.c + * Caller: library/ecdh.c + * library/ecdsa.c + * library/ecjpake.c + * + * Requires: MBEDTLS_BIGNUM_C and at least one MBEDTLS_ECP_DP_XXX_ENABLED + */ +#define MBEDTLS_ECP_C + +/** + * \def MBEDTLS_ENTROPY_C + * + * Enable the platform-specific entropy code. + * + * Module: library/entropy.c + * Caller: + * + * Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C + * + * This module provides a generic entropy pool + */ +#define MBEDTLS_ENTROPY_C + +/** + * \def MBEDTLS_ERROR_C + * + * Enable error code to error string conversion. + * + * Module: library/error.c + * Caller: + * + * This module enables mbedtls_strerror(). + */ +#define MBEDTLS_ERROR_C + +/** + * \def MBEDTLS_GCM_C + * + * Enable the Galois/Counter Mode (GCM) for AES. + * + * Module: library/gcm.c + * + * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C + * + * This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other + * requisites are enabled as well. + */ +#define MBEDTLS_GCM_C + +/** + * \def MBEDTLS_HAVEGE_C + * + * Enable the HAVEGE random generator. + * + * Warning: the HAVEGE random generator is not suitable for virtualized + * environments + * + * Warning: the HAVEGE random generator is dependent on timing and specific + * processor traits. It is therefore not advised to use HAVEGE as + * your applications primary random generator or primary entropy pool + * input. As a secondary input to your entropy pool, it IS able add + * the (limited) extra entropy it provides. + * + * Module: library/havege.c + * Caller: + * + * Requires: MBEDTLS_TIMING_C + * + * Uncomment to enable the HAVEGE random generator. + */ +//#define MBEDTLS_HAVEGE_C + +/** + * \def MBEDTLS_HKDF_C + * + * Enable the HKDF algorithm (RFC 5869). + * + * Module: library/hkdf.c + * Caller: + * + * Requires: MBEDTLS_MD_C + * + * This module adds support for the Hashed Message Authentication Code + * (HMAC)-based key derivation function (HKDF). + */ +#define MBEDTLS_HKDF_C + +/** + * \def MBEDTLS_HMAC_DRBG_C + * + * Enable the HMAC_DRBG random generator. + * + * Module: library/hmac_drbg.c + * Caller: + * + * Requires: MBEDTLS_MD_C + * + * Uncomment to enable the HMAC_DRBG random number geerator. + */ +#define MBEDTLS_HMAC_DRBG_C + +/** + * \def MBEDTLS_NIST_KW_C + * + * Enable the Key Wrapping mode for 128-bit block ciphers, + * as defined in NIST SP 800-38F. Only KW and KWP modes + * are supported. At the moment, only AES is approved by NIST. + * + * Module: library/nist_kw.c + * + * Requires: MBEDTLS_AES_C and MBEDTLS_CIPHER_C + */ +//#define MBEDTLS_NIST_KW_C + +/** + * \def MBEDTLS_MD_C + * + * Enable the generic message digest layer. + * + * Module: library/md.c + * Caller: + * + * Uncomment to enable generic message digest wrappers. + */ +#define MBEDTLS_MD_C + +/** + * \def MBEDTLS_MD2_C + * + * Enable the MD2 hash algorithm. + * + * Module: library/md2.c + * Caller: + * + * Uncomment to enable support for (rare) MD2-signed X.509 certs. + * + * \warning MD2 is considered a weak message digest and its use constitutes a + * security risk. If possible, we recommend avoiding dependencies on + * it, and considering stronger message digests instead. + * + */ +//#define MBEDTLS_MD2_C + +/** + * \def MBEDTLS_MD4_C + * + * Enable the MD4 hash algorithm. + * + * Module: library/md4.c + * Caller: + * + * Uncomment to enable support for (rare) MD4-signed X.509 certs. + * + * \warning MD4 is considered a weak message digest and its use constitutes a + * security risk. If possible, we recommend avoiding dependencies on + * it, and considering stronger message digests instead. + * + */ +//#define MBEDTLS_MD4_C + +/** + * \def MBEDTLS_MD5_C + * + * Enable the MD5 hash algorithm. + * + * Module: library/md5.c + * Caller: library/md.c + * library/pem.c + * library/ssl_tls.c + * + * This module is required for SSL/TLS up to version 1.1, and for TLS 1.2 + * depending on the handshake parameters. Further, it is used for checking + * MD5-signed certificates, and for PBKDF1 when decrypting PEM-encoded + * encrypted keys. + * + * \warning MD5 is considered a weak message digest and its use constitutes a + * security risk. If possible, we recommend avoiding dependencies on + * it, and considering stronger message digests instead. + * + */ +#define MBEDTLS_MD5_C + +/** + * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C + * + * Enable the buffer allocator implementation that makes use of a (stack) + * based buffer to 'allocate' dynamic memory. (replaces calloc() and free() + * calls) + * + * Module: library/memory_buffer_alloc.c + * + * Requires: MBEDTLS_PLATFORM_C + * MBEDTLS_PLATFORM_MEMORY (to use it within mbed TLS) + * + * Enable this module to enable the buffer memory allocator. + */ +//#define MBEDTLS_MEMORY_BUFFER_ALLOC_C + +/** + * \def MBEDTLS_NET_C + * + * Enable the TCP and UDP over IPv6/IPv4 networking routines. + * + * \note This module only works on POSIX/Unix (including Linux, BSD and OS X) + * and Windows. For other platforms, you'll want to disable it, and write your + * own networking callbacks to be passed to \c mbedtls_ssl_set_bio(). + * + * \note See also our Knowledge Base article about porting to a new + * environment: + * https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS + * + * Module: library/net_sockets.c + * + * This module provides networking routines. + */ +#define MBEDTLS_NET_C + +/** + * \def MBEDTLS_OID_C + * + * Enable the OID database. + * + * Module: library/oid.c + * Caller: library/asn1write.c + * library/pkcs5.c + * library/pkparse.c + * library/pkwrite.c + * library/rsa.c + * library/x509.c + * library/x509_create.c + * library/x509_crl.c + * library/x509_crt.c + * library/x509_csr.c + * library/x509write_crt.c + * library/x509write_csr.c + * + * This modules translates between OIDs and internal values. + */ +#define MBEDTLS_OID_C + +/** + * \def MBEDTLS_PADLOCK_C + * + * Enable VIA Padlock support on x86. + * + * Module: library/padlock.c + * Caller: library/aes.c + * + * Requires: MBEDTLS_HAVE_ASM + * + * This modules adds support for the VIA PadLock on x86. + */ +#define MBEDTLS_PADLOCK_C + +/** + * \def MBEDTLS_PEM_PARSE_C + * + * Enable PEM decoding / parsing. + * + * Module: library/pem.c + * Caller: library/dhm.c + * library/pkparse.c + * library/x509_crl.c + * library/x509_crt.c + * library/x509_csr.c + * + * Requires: MBEDTLS_BASE64_C + * + * This modules adds support for decoding / parsing PEM files. + */ +#define MBEDTLS_PEM_PARSE_C + +/** + * \def MBEDTLS_PEM_WRITE_C + * + * Enable PEM encoding / writing. + * + * Module: library/pem.c + * Caller: library/pkwrite.c + * library/x509write_crt.c + * library/x509write_csr.c + * + * Requires: MBEDTLS_BASE64_C + * + * This modules adds support for encoding / writing PEM files. + */ +#define MBEDTLS_PEM_WRITE_C + +/** + * \def MBEDTLS_PK_C + * + * Enable the generic public (asymetric) key layer. + * + * Module: library/pk.c + * Caller: library/ssl_tls.c + * library/ssl_cli.c + * library/ssl_srv.c + * + * Requires: MBEDTLS_RSA_C or MBEDTLS_ECP_C + * + * Uncomment to enable generic public key wrappers. + */ +#define MBEDTLS_PK_C + +/** + * \def MBEDTLS_PK_PARSE_C + * + * Enable the generic public (asymetric) key parser. + * + * Module: library/pkparse.c + * Caller: library/x509_crt.c + * library/x509_csr.c + * + * Requires: MBEDTLS_PK_C + * + * Uncomment to enable generic public key parse functions. + */ +#define MBEDTLS_PK_PARSE_C + +/** + * \def MBEDTLS_PK_WRITE_C + * + * Enable the generic public (asymetric) key writer. + * + * Module: library/pkwrite.c + * Caller: library/x509write.c + * + * Requires: MBEDTLS_PK_C + * + * Uncomment to enable generic public key write functions. + */ +#define MBEDTLS_PK_WRITE_C + +/** + * \def MBEDTLS_PKCS5_C + * + * Enable PKCS#5 functions. + * + * Module: library/pkcs5.c + * + * Requires: MBEDTLS_MD_C + * + * This module adds support for the PKCS#5 functions. + */ +#define MBEDTLS_PKCS5_C + +/** + * \def MBEDTLS_PKCS11_C + * + * Enable wrapper for PKCS#11 smartcard support. + * + * Module: library/pkcs11.c + * Caller: library/pk.c + * + * Requires: MBEDTLS_PK_C + * + * This module enables SSL/TLS PKCS #11 smartcard support. + * Requires the presence of the PKCS#11 helper library (libpkcs11-helper) + */ +//#define MBEDTLS_PKCS11_C + +/** + * \def MBEDTLS_PKCS12_C + * + * Enable PKCS#12 PBE functions. + * Adds algorithms for parsing PKCS#8 encrypted private keys + * + * Module: library/pkcs12.c + * Caller: library/pkparse.c + * + * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_CIPHER_C, MBEDTLS_MD_C + * Can use: MBEDTLS_ARC4_C + * + * This module enables PKCS#12 functions. + */ +#define MBEDTLS_PKCS12_C + +/** + * \def MBEDTLS_PLATFORM_C + * + * Enable the platform abstraction layer that allows you to re-assign + * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit(). + * + * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT + * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned + * above to be specified at runtime or compile time respectively. + * + * \note This abstraction layer must be enabled on Windows (including MSYS2) + * as other module rely on it for a fixed snprintf implementation. + * + * Module: library/platform.c + * Caller: Most other .c files + * + * This module enables abstraction of common (libc) functions. + */ +#define MBEDTLS_PLATFORM_C + +/** + * \def MBEDTLS_POLY1305_C + * + * Enable the Poly1305 MAC algorithm. + * + * Module: library/poly1305.c + * Caller: library/chachapoly.c + */ +#define MBEDTLS_POLY1305_C + +/** + * \def MBEDTLS_PSA_CRYPTO_C + * + * Enable the Platform Security Architecture cryptography API. + * + * Module: library/psa_crypto.c + * + * Requires: MBEDTLS_CTR_DRBG_C, MBEDTLS_ENTROPY_C + * + */ +#define MBEDTLS_PSA_CRYPTO_C + +/** + * \def MBEDTLS_PSA_CRYPTO_STORAGE_C + * + * Enable the Platform Security Architecture persistent key storage. + * + * Module: library/psa_crypto_storage.c + * + * Requires: MBEDTLS_PSA_CRYPTO_C, + * either MBEDTLS_PSA_ITS_FILE_C or a native implementation of + * the PSA ITS interface + */ +#define MBEDTLS_PSA_CRYPTO_STORAGE_C + +/** + * \def MBEDTLS_PSA_ITS_FILE_C + * + * Enable the emulation of the Platform Security Architecture + * Internal Trusted Storage (PSA ITS) over files. + * + * Module: library/psa_its_file.c + * + * Requires: MBEDTLS_FS_IO + */ +#define MBEDTLS_PSA_ITS_FILE_C + +/** + * \def MBEDTLS_RIPEMD160_C + * + * Enable the RIPEMD-160 hash algorithm. + * + * Module: library/ripemd160.c + * Caller: library/md.c + * + */ +#define MBEDTLS_RIPEMD160_C + +/** + * \def MBEDTLS_RSA_C + * + * Enable the RSA public-key cryptosystem. + * + * Module: library/rsa.c + * library/rsa_internal.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * library/x509.c + * + * This module is used by the following key exchanges: + * RSA, DHE-RSA, ECDHE-RSA, RSA-PSK + * + * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C + */ +#define MBEDTLS_RSA_C + +/** + * \def MBEDTLS_SHA1_C + * + * Enable the SHA1 cryptographic hash algorithm. + * + * Module: library/sha1.c + * Caller: library/md.c + * library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * library/x509write_crt.c + * + * This module is required for SSL/TLS up to version 1.1, for TLS 1.2 + * depending on the handshake parameters, and for SHA1-signed certificates. + * + * \warning SHA-1 is considered a weak message digest and its use constitutes + * a security risk. If possible, we recommend avoiding dependencies + * on it, and considering stronger message digests instead. + * + */ +#define MBEDTLS_SHA1_C + +/** + * \def MBEDTLS_SHA256_C + * + * Enable the SHA-224 and SHA-256 cryptographic hash algorithms. + * + * Module: library/sha256.c + * Caller: library/entropy.c + * library/md.c + * library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * + * This module adds support for SHA-224 and SHA-256. + * This module is required for the SSL/TLS 1.2 PRF function. + */ +#define MBEDTLS_SHA256_C + +/** + * \def MBEDTLS_SHA512_C + * + * Enable the SHA-384 and SHA-512 cryptographic hash algorithms. + * + * Module: library/sha512.c + * Caller: library/entropy.c + * library/md.c + * library/ssl_cli.c + * library/ssl_srv.c + * + * This module adds support for SHA-384 and SHA-512. + */ +#define MBEDTLS_SHA512_C + +/** + * \def MBEDTLS_SSL_CACHE_C + * + * Enable simple SSL cache implementation. + * + * Module: library/ssl_cache.c + * Caller: + * + * Requires: MBEDTLS_SSL_CACHE_C + */ +#define MBEDTLS_SSL_CACHE_C + +/** + * \def MBEDTLS_SSL_COOKIE_C + * + * Enable basic implementation of DTLS cookies for hello verification. + * + * Module: library/ssl_cookie.c + * Caller: + */ +#define MBEDTLS_SSL_COOKIE_C + +/** + * \def MBEDTLS_SSL_TICKET_C + * + * Enable an implementation of TLS server-side callbacks for session tickets. + * + * Module: library/ssl_ticket.c + * Caller: + * + * Requires: MBEDTLS_CIPHER_C + */ +#define MBEDTLS_SSL_TICKET_C + +/** + * \def MBEDTLS_SSL_CLI_C + * + * Enable the SSL/TLS client code. + * + * Module: library/ssl_cli.c + * Caller: + * + * Requires: MBEDTLS_SSL_TLS_C + * + * This module is required for SSL/TLS client support. + */ +#define MBEDTLS_SSL_CLI_C + +/** + * \def MBEDTLS_SSL_SRV_C + * + * Enable the SSL/TLS server code. + * + * Module: library/ssl_srv.c + * Caller: + * + * Requires: MBEDTLS_SSL_TLS_C + * + * This module is required for SSL/TLS server support. + */ +#define MBEDTLS_SSL_SRV_C + +/** + * \def MBEDTLS_SSL_TLS_C + * + * Enable the generic SSL/TLS code. + * + * Module: library/ssl_tls.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * + * Requires: MBEDTLS_CIPHER_C, MBEDTLS_MD_C + * and at least one of the MBEDTLS_SSL_PROTO_XXX defines + * + * This module is required for SSL/TLS. + */ +#define MBEDTLS_SSL_TLS_C + +/** + * \def MBEDTLS_THREADING_C + * + * Enable the threading abstraction layer. + * By default mbed TLS assumes it is used in a non-threaded environment or that + * contexts are not shared between threads. If you do intend to use contexts + * between threads, you will need to enable this layer to prevent race + * conditions. See also our Knowledge Base article about threading: + * https://tls.mbed.org/kb/development/thread-safety-and-multi-threading + * + * Module: library/threading.c + * + * This allows different threading implementations (self-implemented or + * provided). + * + * You will have to enable either MBEDTLS_THREADING_ALT or + * MBEDTLS_THREADING_PTHREAD. + * + * Enable this layer to allow use of mutexes within mbed TLS + */ +//#define MBEDTLS_THREADING_C + +/** + * \def MBEDTLS_TIMING_C + * + * Enable the semi-portable timing interface. + * + * \note The provided implementation only works on POSIX/Unix (including Linux, + * BSD and OS X) and Windows. On other platforms, you can either disable that + * module and provide your own implementations of the callbacks needed by + * \c mbedtls_ssl_set_timer_cb() for DTLS, or leave it enabled and provide + * your own implementation of the whole module by setting + * \c MBEDTLS_TIMING_ALT in the current file. + * + * \note See also our Knowledge Base article about porting to a new + * environment: + * https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS + * + * Module: library/timing.c + * Caller: library/havege.c + * + * This module is used by the HAVEGE random number generator. + */ +#define MBEDTLS_TIMING_C + +/** + * \def MBEDTLS_VERSION_C + * + * Enable run-time version information. + * + * Module: library/version.c + * + * This module provides run-time version information. + */ +#define MBEDTLS_VERSION_C + +/** + * \def MBEDTLS_X509_USE_C + * + * Enable X.509 core for using certificates. + * + * Module: library/x509.c + * Caller: library/x509_crl.c + * library/x509_crt.c + * library/x509_csr.c + * + * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, + * MBEDTLS_PK_PARSE_C + * + * This module is required for the X.509 parsing modules. + */ +#define MBEDTLS_X509_USE_C + +/** + * \def MBEDTLS_X509_CRT_PARSE_C + * + * Enable X.509 certificate parsing. + * + * Module: library/x509_crt.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * + * Requires: MBEDTLS_X509_USE_C + * + * This module is required for X.509 certificate parsing. + */ +#define MBEDTLS_X509_CRT_PARSE_C + +/** + * \def MBEDTLS_X509_CRL_PARSE_C + * + * Enable X.509 CRL parsing. + * + * Module: library/x509_crl.c + * Caller: library/x509_crt.c + * + * Requires: MBEDTLS_X509_USE_C + * + * This module is required for X.509 CRL parsing. + */ +#define MBEDTLS_X509_CRL_PARSE_C + +/** + * \def MBEDTLS_X509_CSR_PARSE_C + * + * Enable X.509 Certificate Signing Request (CSR) parsing. + * + * Module: library/x509_csr.c + * Caller: library/x509_crt_write.c + * + * Requires: MBEDTLS_X509_USE_C + * + * This module is used for reading X.509 certificate request. + */ +#define MBEDTLS_X509_CSR_PARSE_C + +/** + * \def MBEDTLS_X509_CREATE_C + * + * Enable X.509 core for creating certificates. + * + * Module: library/x509_create.c + * + * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_WRITE_C + * + * This module is the basis for creating X.509 certificates and CSRs. + */ +#define MBEDTLS_X509_CREATE_C + +/** + * \def MBEDTLS_X509_CRT_WRITE_C + * + * Enable creating X.509 certificates. + * + * Module: library/x509_crt_write.c + * + * Requires: MBEDTLS_X509_CREATE_C + * + * This module is required for X.509 certificate creation. + */ +#define MBEDTLS_X509_CRT_WRITE_C + +/** + * \def MBEDTLS_X509_CSR_WRITE_C + * + * Enable creating X.509 Certificate Signing Requests (CSR). + * + * Module: library/x509_csr_write.c + * + * Requires: MBEDTLS_X509_CREATE_C + * + * This module is required for X.509 certificate request writing. + */ +#define MBEDTLS_X509_CSR_WRITE_C + +/** + * \def MBEDTLS_XTEA_C + * + * Enable the XTEA block cipher. + * + * Module: library/xtea.c + * Caller: + */ +#define MBEDTLS_XTEA_C + +/* \} name SECTION: mbed TLS modules */ + +/** + * \name SECTION: Module configuration options + * + * This section allows for the setting of module specific sizes and + * configuration options. The default values are already present in the + * relevant header files and should suffice for the regular use cases. + * + * Our advice is to enable options and change their values here + * only if you have a good reason and know the consequences. + * + * Please check the respective header file for documentation on these + * parameters (to prevent duplicate documentation). + * \{ + */ + +/* MPI / BIGNUM options */ +//#define MBEDTLS_MPI_WINDOW_SIZE 6 /**< Maximum windows size used. */ +//#define MBEDTLS_MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */ + +/* CTR_DRBG options */ +//#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48 /**< Amount of entropy used per seed by default (48 with SHA-512, 32 with SHA-256) */ +//#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ +//#define MBEDTLS_CTR_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ +//#define MBEDTLS_CTR_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ +//#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ +//#define MBEDTLS_CTR_DRBG_USE_128_BIT_KEY /**< Use 128-bit key for CTR_DRBG - may reduce security (see ctr_drbg.h) */ + +/* HMAC_DRBG options */ +//#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ +//#define MBEDTLS_HMAC_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ +//#define MBEDTLS_HMAC_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ +//#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ + +/* ECP options */ +//#define MBEDTLS_ECP_MAX_BITS 521 /**< Maximum bit size of groups */ +//#define MBEDTLS_ECP_WINDOW_SIZE 6 /**< Maximum window size used */ +//#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */ + +/* Entropy options */ +//#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */ +//#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */ +//#define MBEDTLS_ENTROPY_MIN_HARDWARE 32 /**< Default minimum number of bytes required for the hardware entropy source mbedtls_hardware_poll() before entropy is released */ + +/* Memory buffer allocator options */ +//#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of this value */ + +/* Platform options */ +//#define MBEDTLS_PLATFORM_STD_MEM_HDR /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */ +//#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_FREE free /**< Default free to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ +//#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< Default printf to use, can be undefined */ +/* Note: your snprintf must correctly zero-terminate the buffer! */ +//#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< Default snprintf to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS 0 /**< Default exit value to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE 1 /**< Default exit value to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_NV_SEED_READ mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" /**< Seed file to read/write with default implementation */ + +/* To Use Function Macros MBEDTLS_PLATFORM_C must be enabled */ +/* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */ +//#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_TIME_MACRO time /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ +//#define MBEDTLS_PLATFORM_TIME_TYPE_MACRO time_t /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ +//#define MBEDTLS_PLATFORM_FPRINTF_MACRO fprintf /**< Default fprintf macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_PRINTF_MACRO printf /**< Default printf macro to use, can be undefined */ +/* Note: your snprintf must correctly zero-terminate the buffer! */ +//#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf /**< Default snprintf macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_VSNPRINTF_MACRO vsnprintf /**< Default vsnprintf macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ + +/** + * \brief This macro is invoked by the library when an invalid parameter + * is detected that is only checked with MBEDTLS_CHECK_PARAMS + * (see the documentation of that option for context). + * + * When you leave this undefined here, a default definition is + * provided that invokes the function mbedtls_param_failed(), + * which is declared in platform_util.h for the benefit of the + * library, but that you need to define in your application. + * + * When you define this here, this replaces the default + * definition in platform_util.h (which no longer declares the + * function mbedtls_param_failed()) and it is your responsibility + * to make sure this macro expands to something suitable (in + * particular, that all the necessary declarations are visible + * from within the library - you can ensure that by providing + * them in this file next to the macro definition). + * + * Note that you may define this macro to expand to nothing, in + * which case you don't have to worry about declarations or + * definitions. However, you will then be notified about invalid + * parameters only in non-void functions, and void function will + * just silently return early on invalid parameters, which + * partially negates the benefits of enabling + * #MBEDTLS_CHECK_PARAMS in the first place, so is discouraged. + * + * \param cond The expression that should evaluate to true, but doesn't. + */ +//#define MBEDTLS_PARAM_FAILED( cond ) assert( cond ) + +/* SSL Cache options */ +//#define MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT 86400 /**< 1 day */ +//#define MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /**< Maximum entries in cache */ + +/* SSL options */ + +/** \def MBEDTLS_SSL_MAX_CONTENT_LEN + * + * Maximum length (in bytes) of incoming and outgoing plaintext fragments. + * + * This determines the size of both the incoming and outgoing TLS I/O buffers + * in such a way that both are capable of holding the specified amount of + * plaintext data, regardless of the protection mechanism used. + * + * To configure incoming and outgoing I/O buffers separately, use + * #MBEDTLS_SSL_IN_CONTENT_LEN and #MBEDTLS_SSL_OUT_CONTENT_LEN, + * which overwrite the value set by this option. + * + * \note When using a value less than the default of 16KB on the client, it is + * recommended to use the Maximum Fragment Length (MFL) extension to + * inform the server about this limitation. On the server, there + * is no supported, standardized way of informing the client about + * restriction on the maximum size of incoming messages, and unless + * the limitation has been communicated by other means, it is recommended + * to only change the outgoing buffer size #MBEDTLS_SSL_OUT_CONTENT_LEN + * while keeping the default value of 16KB for the incoming buffer. + * + * Uncomment to set the maximum plaintext size of both + * incoming and outgoing I/O buffers. + */ +//#define MBEDTLS_SSL_MAX_CONTENT_LEN 16384 + +/** \def MBEDTLS_SSL_IN_CONTENT_LEN + * + * Maximum length (in bytes) of incoming plaintext fragments. + * + * This determines the size of the incoming TLS I/O buffer in such a way + * that it is capable of holding the specified amount of plaintext data, + * regardless of the protection mechanism used. + * + * If this option is undefined, it inherits its value from + * #MBEDTLS_SSL_MAX_CONTENT_LEN. + * + * \note When using a value less than the default of 16KB on the client, it is + * recommended to use the Maximum Fragment Length (MFL) extension to + * inform the server about this limitation. On the server, there + * is no supported, standardized way of informing the client about + * restriction on the maximum size of incoming messages, and unless + * the limitation has been communicated by other means, it is recommended + * to only change the outgoing buffer size #MBEDTLS_SSL_OUT_CONTENT_LEN + * while keeping the default value of 16KB for the incoming buffer. + * + * Uncomment to set the maximum plaintext size of the incoming I/O buffer + * independently of the outgoing I/O buffer. + */ +//#define MBEDTLS_SSL_IN_CONTENT_LEN 16384 + +/** \def MBEDTLS_SSL_OUT_CONTENT_LEN + * + * Maximum length (in bytes) of outgoing plaintext fragments. + * + * This determines the size of the outgoing TLS I/O buffer in such a way + * that it is capable of holding the specified amount of plaintext data, + * regardless of the protection mechanism used. + * + * If this option undefined, it inherits its value from + * #MBEDTLS_SSL_MAX_CONTENT_LEN. + * + * It is possible to save RAM by setting a smaller outward buffer, while keeping + * the default inward 16384 byte buffer to conform to the TLS specification. + * + * The minimum required outward buffer size is determined by the handshake + * protocol's usage. Handshaking will fail if the outward buffer is too small. + * The specific size requirement depends on the configured ciphers and any + * certificate data which is sent during the handshake. + * + * Uncomment to set the maximum plaintext size of the outgoing I/O buffer + * independently of the incoming I/O buffer. + */ +//#define MBEDTLS_SSL_OUT_CONTENT_LEN 16384 + +/** \def MBEDTLS_SSL_DTLS_MAX_BUFFERING + * + * Maximum number of heap-allocated bytes for the purpose of + * DTLS handshake message reassembly and future message buffering. + * + * This should be at least 9/8 * MBEDTLSSL_IN_CONTENT_LEN + * to account for a reassembled handshake message of maximum size, + * together with its reassembly bitmap. + * + * A value of 2 * MBEDTLS_SSL_IN_CONTENT_LEN (32768 by default) + * should be sufficient for all practical situations as it allows + * to reassembly a large handshake message (such as a certificate) + * while buffering multiple smaller handshake messages. + * + */ +//#define MBEDTLS_SSL_DTLS_MAX_BUFFERING 32768 + +//#define MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME 86400 /**< Lifetime of session tickets (if enabled) */ +//#define MBEDTLS_PSK_MAX_LEN 32 /**< Max size of TLS pre-shared keys, in bytes (default 256 bits) */ +//#define MBEDTLS_SSL_COOKIE_TIMEOUT 60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */ + +/** + * Complete list of ciphersuites to use, in order of preference. + * + * \warning No dependency checking is done on that field! This option can only + * be used to restrict the set of available ciphersuites. It is your + * responsibility to make sure the needed modules are active. + * + * Use this to save a few hundred bytes of ROM (default ordering of all + * available ciphersuites) and a few to a few hundred bytes of RAM. + * + * The value below is only an example, not the default. + */ +//#define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + +/* X509 options */ +//#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */ +//#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 /**< Maximum length of a path/filename string in bytes including the null terminator character ('\0'). */ + +/** + * Allow SHA-1 in the default TLS configuration for certificate signing. + * Without this build-time option, SHA-1 support must be activated explicitly + * through mbedtls_ssl_conf_cert_profile. Turning on this option is not + * recommended because of it is possible to generate SHA-1 collisions, however + * this may be safe for legacy infrastructure where additional controls apply. + * + * \warning SHA-1 is considered a weak message digest and its use constitutes + * a security risk. If possible, we recommend avoiding dependencies + * on it, and considering stronger message digests instead. + * + */ +// #define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES + +/** + * Allow SHA-1 in the default TLS configuration for TLS 1.2 handshake + * signature and ciphersuite selection. Without this build-time option, SHA-1 + * support must be activated explicitly through mbedtls_ssl_conf_sig_hashes. + * The use of SHA-1 in TLS <= 1.1 and in HMAC-SHA-1 is always allowed by + * default. At the time of writing, there is no practical attack on the use + * of SHA-1 in handshake signatures, hence this option is turned on by default + * to preserve compatibility with existing peers, but the general + * warning applies nonetheless: + * + * \warning SHA-1 is considered a weak message digest and its use constitutes + * a security risk. If possible, we recommend avoiding dependencies + * on it, and considering stronger message digests instead. + * + */ +#define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE + +/** + * Uncomment the macro to let mbed TLS use your alternate implementation of + * mbedtls_platform_zeroize(). This replaces the default implementation in + * platform_util.c. + * + * mbedtls_platform_zeroize() is a widely used function across the library to + * zero a block of memory. The implementation is expected to be secure in the + * sense that it has been written to prevent the compiler from removing calls + * to mbedtls_platform_zeroize() as part of redundant code elimination + * optimizations. However, it is difficult to guarantee that calls to + * mbedtls_platform_zeroize() will not be optimized by the compiler as older + * versions of the C language standards do not provide a secure implementation + * of memset(). Therefore, MBEDTLS_PLATFORM_ZEROIZE_ALT enables users to + * configure their own implementation of mbedtls_platform_zeroize(), for + * example by using directives specific to their compiler, features from newer + * C standards (e.g using memset_s() in C11) or calling a secure memset() from + * their system (e.g explicit_bzero() in BSD). + */ +//#define MBEDTLS_PLATFORM_ZEROIZE_ALT + +/** + * Uncomment the macro to let Mbed TLS use your alternate implementation of + * mbedtls_platform_gmtime_r(). This replaces the default implementation in + * platform_util.c. + * + * gmtime() is not a thread-safe function as defined in the C standard. The + * library will try to use safer implementations of this function, such as + * gmtime_r() when available. However, if Mbed TLS cannot identify the target + * system, the implementation of mbedtls_platform_gmtime_r() will default to + * using the standard gmtime(). In this case, calls from the library to + * gmtime() will be guarded by the global mutex mbedtls_threading_gmtime_mutex + * if MBEDTLS_THREADING_C is enabled. We recommend that calls from outside the + * library are also guarded with this mutex to avoid race conditions. However, + * if the macro MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, Mbed TLS will + * unconditionally use the implementation for mbedtls_platform_gmtime_r() + * supplied at compile time. + */ +//#define MBEDTLS_PLATFORM_GMTIME_R_ALT + +/* \} name SECTION: Customisation configuration options */ + +/* Target and application specific configurations + * + * Allow user to override any previous default. + * + */ +#if defined(MBEDTLS_USER_CONFIG_FILE) +#include MBEDTLS_USER_CONFIG_FILE +#endif + +#include "mbedtls/check_config.h" + +#endif /* MBEDTLS_CONFIG_H */ diff --git a/third_party/mbedtls/repo/configs/config-suite-b.h b/third_party/mbedtls/repo/configs/config-suite-b.h index 18e2c4036..6eb03a97e 100644 --- a/third_party/mbedtls/repo/configs/config-suite-b.h +++ b/third_party/mbedtls/repo/configs/config-suite-b.h @@ -4,7 +4,7 @@ * \brief Minimal configuration for TLS NSA Suite B Profile (RFC 6460) */ /* - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved + * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 * * Licensed under the Apache License, Version 2.0 (the "License"); you may @@ -18,8 +18,6 @@ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) */ /* * Minimal configuration for TLS NSA Suite B Profile (RFC 6460) diff --git a/third_party/mbedtls/repo/configs/config-symmetric-only.h b/third_party/mbedtls/repo/configs/config-symmetric-only.h new file mode 100644 index 000000000..f05a0d7cb --- /dev/null +++ b/third_party/mbedtls/repo/configs/config-symmetric-only.h @@ -0,0 +1,99 @@ +/** + * \file config-symmetric-only.h + * + * \brief Configuration without any asymmetric cryptography. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CONFIG_H +#define MBEDTLS_CONFIG_H + +/* System support */ +//#define MBEDTLS_HAVE_ASM +#define MBEDTLS_HAVE_TIME +#define MBEDTLS_HAVE_TIME_DATE + +/* Mbed Crypto feature support */ +#define MBEDTLS_CIPHER_MODE_CBC +#define MBEDTLS_CIPHER_MODE_CFB +#define MBEDTLS_CIPHER_MODE_CTR +#define MBEDTLS_CIPHER_MODE_OFB +#define MBEDTLS_CIPHER_MODE_XTS +#define MBEDTLS_CIPHER_PADDING_PKCS7 +#define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS +#define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN +#define MBEDTLS_CIPHER_PADDING_ZEROS +#define MBEDTLS_ERROR_STRERROR_DUMMY +#define MBEDTLS_FS_IO +#define MBEDTLS_ENTROPY_NV_SEED +#define MBEDTLS_SELF_TEST +#define MBEDTLS_USE_PSA_CRYPTO +#define MBEDTLS_VERSION_FEATURES + +/* Mbed Crypto modules */ +#define MBEDTLS_AES_C +#define MBEDTLS_ARC4_C +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C +#define MBEDTLS_BASE64_C +#define MBEDTLS_BLOWFISH_C +#define MBEDTLS_CAMELLIA_C +#define MBEDTLS_ARIA_C +#define MBEDTLS_CCM_C +#define MBEDTLS_CHACHA20_C +#define MBEDTLS_CHACHAPOLY_C +#define MBEDTLS_CIPHER_C +#define MBEDTLS_CMAC_C +#define MBEDTLS_CTR_DRBG_C +#define MBEDTLS_DES_C +#define MBEDTLS_ENTROPY_C +#define MBEDTLS_ERROR_C +#define MBEDTLS_GCM_C +//#define MBEDTLS_HAVEGE_C +#define MBEDTLS_HKDF_C +#define MBEDTLS_HMAC_DRBG_C +#define MBEDTLS_NIST_KW_C +#define MBEDTLS_MD_C +#define MBEDTLS_MD2_C +#define MBEDTLS_MD4_C +#define MBEDTLS_MD5_C +#define MBEDTLS_OID_C +#define MBEDTLS_PEM_PARSE_C +#define MBEDTLS_PEM_WRITE_C +#define MBEDTLS_PKCS5_C +#define MBEDTLS_PKCS12_C +#define MBEDTLS_PLATFORM_C +#define MBEDTLS_POLY1305_C +#define MBEDTLS_PSA_CRYPTO_C +#define MBEDTLS_PSA_CRYPTO_SE_C +#define MBEDTLS_PSA_CRYPTO_STORAGE_C +#define MBEDTLS_PSA_ITS_FILE_C +#define MBEDTLS_RIPEMD160_C +#define MBEDTLS_SHA1_C +#define MBEDTLS_SHA256_C +#define MBEDTLS_SHA512_C +//#define MBEDTLS_THREADING_C +#define MBEDTLS_TIMING_C +#define MBEDTLS_VERSION_C +#define MBEDTLS_XTEA_C + +#include "mbedtls/config_psa.h" + +#include "check_config.h" + +#endif /* MBEDTLS_CONFIG_H */ diff --git a/third_party/mbedtls/repo/configs/config-thread.h b/third_party/mbedtls/repo/configs/config-thread.h index 25db16bf0..47dd5e222 100644 --- a/third_party/mbedtls/repo/configs/config-thread.h +++ b/third_party/mbedtls/repo/configs/config-thread.h @@ -4,7 +4,7 @@ * \brief Minimal configuration for using TLS as part of Thread */ /* - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved + * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 * * Licensed under the Apache License, Version 2.0 (the "License"); you may @@ -18,8 +18,6 @@ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) */ /* diff --git a/third_party/mbedtls/repo/dco.txt b/third_party/mbedtls/repo/dco.txt new file mode 100644 index 000000000..8201f9921 --- /dev/null +++ b/third_party/mbedtls/repo/dco.txt @@ -0,0 +1,37 @@ +Developer Certificate of Origin +Version 1.1 + +Copyright (C) 2004, 2006 The Linux Foundation and its contributors. +1 Letterman Drive +Suite D4700 +San Francisco, CA, 94129 + +Everyone is permitted to copy and distribute verbatim copies of this +license document, but changing it is not allowed. + + +Developer's Certificate of Origin 1.1 + +By making a contribution to this project, I certify that: + +(a) The contribution was created in whole or in part by me and I + have the right to submit it under the open source license + indicated in the file; or + +(b) The contribution is based upon previous work that, to the best + of my knowledge, is covered under an appropriate open source + license and I have the right under that license to submit that + work with modifications, whether created in whole or in part + by me, under the same open source license (unless I am + permitted to submit under a different license), as indicated + in the file; or + +(c) The contribution was provided directly to me by some other + person who certified (a), (b) or (c) and I have not modified + it. + +(d) I understand and agree that this project and the contribution + are public and that a record of the contribution (including all + personal information I submit with it, including my sign-off) is + maintained indefinitely and may be redistributed consistent with + this project or the open source license(s) involved. diff --git a/third_party/mbedtls/repo/docs/.gitignore b/third_party/mbedtls/repo/docs/.gitignore new file mode 100644 index 000000000..33ae5acf6 --- /dev/null +++ b/third_party/mbedtls/repo/docs/.gitignore @@ -0,0 +1,3 @@ +*.html +*.pdf +!PSACryptoDriverModelSpec.pdf diff --git a/third_party/mbedtls/repo/docs/PSACryptoDriverModelSpec.pdf b/third_party/mbedtls/repo/docs/PSACryptoDriverModelSpec.pdf new file mode 100644 index 0000000000000000000000000000000000000000..cf11380e840184071cdf3b55ae11d7f67b389e8e GIT binary patch literal 565092 zcmeFYWppL6vMy$3W@ct)W@ct)W@e9>Va&|T%*-A$Gc(&`d$yf9_ucz)lXF(yN&Y1( zTK%J1t-V{SmOj;2r6N}nlb~m2V22_9wLH2G!$QPF!9|mJGWJD2Hpk>S}e!XaNtd=$`n_4+M;ynHAs+ylw?C@q|yWA zNz-z6lg+wJs)<6^)L?obqp=YzZ^RuK3dy4!-cR4h=M$=}YCa5DSuW)23R5=JK z);b_Gc$E>Pa4={UFom(Qbrmk%=qw+mR5}&T9x17vGa+atkYq(*q##P_RG?cp?$G0b zAl4035nhGge95RvDZneVT%dLWqv7mw3?P;4LYXy>Xh57HP@sGeGrCp>8%8iodBPD> z$K+S=4ZP|QSzd&~DOD(TT0xfEM9N6;0b1CI$E+l}OmG?vh0%4sT2N?oV2w&t6B_A} z*Rdo}LIHYO$0EE+Xg1zE@@a>y=wHEWcz zMAc{$430{v0sBFzDJZK#eU2>Rk?E<%aGy+e(TRvw1zUI(n;%d)g*6)Z=7_0q1kLjv z4+o(5`HK(r?fDKDzr%Lv>*wzXG~Og%`ThTNczIGV?^EVso7Ny$j$!wHl@04eK;qxJ zcdQ(!L`dSNo4=OL)a?o4CcTk9E=BgYhy9j~Q1>|#@*Iwlheq(~U2^{pIL`X{tlXe}xUnjtB`(B2Nx;ou_ zq~aXaUY-Cnre;3?l$Ay*xD>5{uecKezkVo zvwlM#8~+o#>l$6iw8+4k%HUae=GGj{7F%cFHuE|n6e9Q#EAWPSz(&pW3J@C$THH+7 zscYq)d*@c_TPGzBCt92@I-B8i*N*I;&K@29#*acRfSgu)zJ99vTPcDs2()N$SZ0tO zd#)+vFXMU*ylC3FFk7!qbi7J-&@5c zw196Xtqb~W@J8SMe)xBYqu}LuJ7|Ovp0bMro$P^>HfTr^yd8Mw+Q5D3&j?WCc!!jZ zRi68j+F?2-$u~tkTVAilwj&{wF*Xf7TOqGSh-0BJ{@{{Ap+#9x>;)6|fYzz|l$0fu zSJ@}Gv%<_>mwMPucFZ+-u51}s;vEM@$5!fOhqH9)Y?4ZLah5u29S<30S^izhJw`s*FaWqvUgW~eHc&d*3DZ>hSIU~f1FCZ5!%DDE2Ak!Zp1-u&Siuv1cJxkh;YOvq=l)JG}L$<;%?@i&9r_r#+?uy z8>97WI*!fvLV+y237M=mF`7Z%jz~Of0X>8SG=QUl1OoG`Wb(t%11|XeP;sl@@oX4aatUf~ko}4hMaE!z|Txh-7d;0g0mi7mz~1@v3iW z30`r2L28T{MMjITkcrDklOH^Aheg98D2gml69NP@WiX0=V?Zld=wq8d=N0 zN8W~_7$RbG0eJyPFBA*}J+0_q0jZJDAkb%Yl2X*-i8@hGM5~$;8ND<(BNGq<80?G^ z6Idc?BqkOpw2}yjQ%J};Fuv5NPKJmu2M8QYQ@A%YOw&F&)da&>t8UZJv_c|N932oE z5hNIwuni~}mt=P%K*eZgq0zEdUV)Kbb5Mw~8xa*&E);CFIF_>r5mI9>3S}hSEzqpV zBT1`5uve8Trow_#_y3!13=AVbc z(UjBy$MNQU{xeIbou1^QCiR#!k;@r^^WtU9n+zj zcL%dlqPSBHQRfM8w!KSx+B>7C6^1Momec{KCP@!`X4wXIbAQ<1_|I}RGUwE9b5C~J zZ_aLP*ucumQVzQ;I0kdl6D_eH__3HxV8aPr`PUdf%ep|;l!+jBbmG2Xlp7C8it zTC`d;ZNabJ);I4OIImsWPxJkzk-VsiFT0UlB8Wd#tz%zeczR3=t7J6h!8;JwcslI0 zQ<~g-F~30=_sO&E)w1l{9!uLRiJ*wtwIG3Si%^MJQKs~CnAh>EnatfPz{w$-qUJ`Pfc-@!r!8B>K)x0KMfw@Y)+66q1c~Rd8D49{d!bgvc^o10`$2Chp?~ z?mOPJ-hma7=uU`eT~EtBg4*cBtk*B5Zf%rq zU0~Z+t{v7_?fxz?g>PQICA3~gH9vrQaaz6MF#j+y?o<9HP;7ZQdkY*nRF1p}7}pYw8rYhcM(Q zIU1<$Gw(fVwt;WFLxKkJO@F5;wsdE1lacl-;Fb3^HdCXBXUd8NJ>GaMjzSe(-lE;g zCJ>@~PGryVJ!Z_XbgPDjdqX(KM{K<(^;a0|lyNP1|X5n-q>sQ;+sTA*x zWs@-XV_M9dZ}+^ocQ=h`*~i0(0;E=lt}?31FzRd59oJ&>R!5*zxo#+>xeF!xApET{b6Z6!28*JxoX#nvG{8yMlZeZ z{_<1)Q_}^jbcha;C-)ot_Be3vp8=kYiS7RZz_YM({<{GG*S2=V<%aA1)I49;Ly;yE zhgW(=yWVa0ogp{0k2@{KQ&hfrpN(bBO5oFXQoU!I?sg}Bjvt13?c1~XTn%qE=bvr zEP`DqODsq+j!A|s;aKi8BFOB8J#5T@#-D?=@E~r4r{V> zdrb!|rE!gtZh1G+{A^8}Z_Lf=vW7_9UKnbgQ6MnDP%x~uOWeOm9E||25XSvm1V#{U zJT;W(p&{o%YXHqX74s0eUy@`L*E~|FrxYtpx*<$P0@492DSClYDi_NWx}an{ZW((0 zC^lA_%?Sk)X`PqC&1f35>_iI0xRX0xi`YnsB$?hwX{Inp7vgR3;0=&R&! zy@_pxrPka;SJ2=xF$HkwC8{5AFoc=xK!HRkFa-NhPmnPAFf2q`6CD^-YAa;Cef%G2 ztYtH8@X)LeB_r)w7OZ8vbmTURX)LT|1SRCs>0RB9u=wAjpKrIv#k}uNUw6KqE|pUoP zbX*;0OW6}vx6|J}S8Hmy8GFsOoju)<9$A;ijX`d2nhAmW;Rm0o2x~S{7u<2|2S`Mk8s&?P_Yh@Pai9$y`?;fn*9=tPqskiN+^?r&^hkT4reIC}dKPVo2`*^PU zU~Y~V&W@Y7GF{c19IIaN;}tx7RP>!lw#_MW%v>=2enR;pkKMt;7syWL(MjHBy?3`C zZ{K05Ue(CI*Q%nAKAum>6|ahar#Z9aR8K$swbdeAP>FPYV?O0{uZH(0oke{Xq*t$u zAp-ryTx!*kR9cM@IjfpXxp&AaFImj=A6JWd@i)!0z#De?$Dhf&xAaE=*1gT1CAB-Y z(_X~^)ojnaOMk-vf(Vfo@_uFj3wp@4@Nc!DKH6RZYQs&Ul1ijSf-r&Wn5G>MU3NLa#iVIa8ZCdB_<{^8 zymFr1pU?B6yNqo}J`T3#8tQD`-kJXNi5$Mo`S{`a0aM#@(aM+EqNh5sr1h^X^Co!y z-RZCGy%*y-3!Y}yRTI-F5AxO?3b^50UmNncbXhPlH1&q_Q+HkPAd2Aw5rJRd^oCcI ziHAKtm(q?5s_o_g{R?~X*IyR-!E&WO8zr4nYE_teS>){*Y~`r@3~!UykfBLy4_5=;K=u`n%8^c9vl2dRcSZ=XJqAI{_kFk|MW_* zu(AIS;3WEAdnMu$izcvte;$y?z|@O<5KF zr3~@E&zO02m7!NnD?o&|qhKdz6Jk2TBmBJkwMGxA4J>_tU|(4RQUV|RDJ^gR(0&aY z0l8S|Gff&r*$v{3Ep8p(dGu1HlFu=A&5QOczBkzl!k|8u$$m&&lC;mtE?$LN&1HA_ zFR!j-_wDq<2c`zYiD`KYBGm9T!4~9T_*&>lwQszHAm^zma=5k>GE$eA_5BMivM~L( z{pr7aJFIN~wia2{n1Dn?!9`t3`AtDp!AVg``B`02!;kgqL>Ty8L0v&*!Kq4Prob;i zt66|q<&8ifd@x`xV2BoTr;%*B7-qcm$)0jWI-Ymn=+R>3UuNiL;m}1EgX(~q;*jc~ zq?IFAouFOZU>9QH9}Zc7u;JKN*})uGFgzhah~>x`aDc2Gn7seRu-G~Nd03pB|GBIF z8)`)WnlvvZeVij!55R#a8#XdSNCOe_VB9@Q4vq4a~z>aI|`Y z-aF7W!RO2-oWUk3P1i$4wmVXZM!Sq$pIroqm@QRHLpyiglK3E)-2pjxb`7Ow$PzWd z)n7a8SV)vUl8S@`Ng5`zxDoEhFcfK6$UH*^j2#CeX?y(7%3Pid3$uZY5IrT&{eEr# zt|-VNA5$^vV?Fh)D9ElVg7;qqU6>w zD5djJNP{Gb5=Yn8&xs|)-W!qL%gv6@=UAmOK{3XVpy>{+;yA!k9h zV!$_NhY-a!?6UUoYYBJFL^v~zc$ps1P_Q%Xd_J4xVZ^Vw=m)xC6$8>JhxnT5UkE-1 zl-Q;EFfog=W1=!MYg$PohqG(;RJ*V10F@nfp6>*Nqb-Y*;v+HnWD^vmBZ}+J6;_Gl z&3;K{0R>;EM;zpmf<6-f2s;;?hPRfQ?e}N$a^TPUZa@2hRd{k8NV_d7VwQ$tHv@Or zr)?K&^baonbskkmja}yiVs=4{6J6PI-c*BK&58I=n9|>ck#!sa9)N&ele#@W$UN-wgV~+840{_;P;DTmE7+JGD=aJVA8fz)7pf7?Z4+OR8a(1ZEzgz4>`;q%kzBa;R~m+b4>|r6 z?n_yB;iAp-{h$sv{P_S7#R-dL=JL*&Um}@Dd7C)!ZtIbLQnx2Taz#^q5LA-eq$)$h z{`ugEB{9+`$rW+b64|`vrqRULW{27#^Ju4S7SpX`Wb9n@b{{f^RGSgE4d<`7slKJK z{6lKRF=6VvC9(|>m{f{Z0~eC;XzR-A5Hs##h>>hGPOFOrncYv%TWz2^ncuh>k`z0<{9?G8%O!aXThWka z*z=M&#b-Oy5ILk=*@g zC3KBBPS1i1Xu%a~o-4o=Z}VQ!&qAp?2ma|9dKKPkgS=Ybt-JyKq|j%hp18w#0ExEU zG;THR(1Ca(BU|_*MDJxWs%SAPe`$rLua1Lge4}-?T%#N@6+u8(sT7WDhxUmbK9=H5A$S3$@brzcN;C)vRa<(;nP_`%3nwQaJQgHiH& z`P1di?<%U8)nR|5Z;*+Rw77pp3{DpAe}Nbr|2GgLOV@Fe32l7u9WB6(;P4%1E5Xh! zjpAmr#~pQws5D7ON_1?bJ^v<*0UkKH67!s-WbDT}_gP^4d_4qe&}K8EZ zL0aQb%Y`BB5OqgbvE%St;T!26rU4HV)*EdvLD$e7!&zHbOIT2_Us8~44f8+8u8DwD zvVEl1?Lm^^F6nx%WWc)zmsC+kb+>qIRHJ4ZW-7gR z#n}Nw^XD@|L`=Wj*ymVIj=XaF{j6Q`W1cR0-eeuBy()6{A1cB}OHI-bQHgG$2S&8CK4boRsIIXT!(-%jp!F$YxVUdl-y^Mz2!ugL>=|dOGUp=+of!G0Gg!$EUke zlPkUzrzoeKBodQnMulzkqr#>iZOr3tZO6P0WG1~bXHK`kHK=`_4IC-+WP1U(b$m3& zIpmtQ2?G!fPA)RE@QtAe<4;j1BBGJuew_u22m+6x0t!bdkBv$9O=N!O)DX>9eR9Qg zd0Qx1-?+Cg)xwC5!mlzrDg0Z6viqAhsr*~{Ra*BLcJ*V%gd0yX?}jiL(9f10j8>udFg|L~4+k4g zYC`4P4QsGuW&SU=*q|HchV?$Lg6V%pZ8!f#X%col6tFV##g#>{eJ3rhC;;02jalK< zhl*2v=6!^q>^N9zU9a_&+Za%LgAjDv*1XKGPw=;wo2&f#dC?4Au=>voT`jvoOycpo zPdCT55VBYHlMh_8&Xi?Hc0X{-a?qbAFe+c%^ix}(ya+6nRmGP=UTp2EHy;!Pg;DG@ zb(BJ*ZeEBki0JD?H_v5Y^?g(MT}a}D>~coKp>6*&52L?<9b$n5)VE<~giMDQ`4c7Q89M_Jb(WFu-;T=1gk z`u@~Dv@lvU{F(|x)U6>^ICdOWA@XhadK^`z@{L#v61JJ;iaE)^;|Fm^F4GX7Rlbl_ z2b&%f@v>=&SnVaM5Y)1RIuZ;vX1^X#Eh?Dl?y{M14_nexSohWs>m0KO3w`%cAwQsY z5C$6OG|G--5Y0fj)ON)&RA1&Tnhccc;6DDG0Rm@`Q6=fk0jEPQhVc7jd!~fNh<6I; zTTcsudYE>*MZ2$^&dKYu){0`VemO2BQj}x7s0q7fx1*t(K70`2Q9{|Qu{78VZkba{ z$RevrMtt(k1lbz=QnNRA?1%)V=mlA*-!<@w(3VOxDx`>&R9ThMM-j|t28rd1Jq%is z;s-WKSsJaRXaHXn+Pg}fi2|KGV7=v_s{)+>MXQrswHUq^G4)nIPv;?srHV-EqDbne zU&%W@)U1Nd5HCd+;?0d!nmSDDS$03!O3Z2*V&P|re#MJvF@(;P3^qkUGFsdgb)%8G zCoQnN9j<~`e{7Q%GNynR5yE;=k}0Tb!NbJgPtPbfsarwAlQ)XQ=mcvMoGuThK>ZJ%6DL5vqjqaw+txraL7;<8q3bkcUfPGM+ML_O_G{%TXm4E<#4sF>=JEUP78a+!XfCYnE2vn zn=gw6ZiocRyzfd#&XRF-RvL2wZ&UVtYbN1B;Iknxgu_Z>Ky zQB+zK-vqR>XyZgEPD&>q{lvrIzHF8sm=@M=N*z+xP13{-05XgXzC>mH&%_E!@m3|1-ME!p_CgT{b!8Lq+L8O_ z>-QJt3L{2M)RTgY1`w&36M=q|ilS&kYU_}R#OjOc0MGT$Yxc4u)_Yj`^vEAK4By_| z9r3R;r0^IsY_ttYpbUk#3b<6q%Ic(2==J zED3+`3lCC3O`=91L+*Yqin6KYY7k>Fw26xSbDCEH-4$wexr6wNaivGuh_>{=!h*=S zAIxeoD3}~Ql*wGa6q~G>d~THSpcD!#4c~K|pPjOfOEt*UI!I5}L{yN*tBRYTGOAl} z*S2b7MG3q9$|a~<=0_flfnN3Wf?Dknbw#XcBn`TUM0!Tnh2SK6SOS?OL^>k62^3M~+eaPVxuVp-jd!uJMUV@v+=%dD* zSY8JXxMU$t8}dvJC{~44rZSk?19Gckiprz}F0_ScST@->UY?fpEHzEo^0EO_EG{ZI ze{IEFJyWa%13cN{;xjQX9owT%T);21&HhkaG_TA_JZs0 zP<6B5q1JBoIhF##sag0oOg!N!i9&G_ngH~9mBDH2@#Y4?HR!x>Y9UN4C6d6opadw! z2-0<0cPWk;2%6*9*uF|Msy!wXwIFj-Y=1Q5{%C>dH)#8#3Bw7$)qyD@@KrguC@v8~ zz2(+$%g)1S<71~|C@6qS^%vO3$?nwYMstgQQd?l3w|7e0UMZu1L2s{rpevv}YV+qs zbv=jSpOLb^M-^P=_CDuZzk8nYX}{lZraxH>-u>n-##{WqzFu2lyla@m zIKR6#?fQE=`+B?j0Fjycf97Ui$Ey=K^96c(Ke!aX-VFo0ecrxiIXU}FH5uf)JZWgAU?*hNa1qM+6&l@)KAD|P40VD^b0w5GF z34z-IA0HnOD2B7U8^oQSeYV`2IJIKc3py?In*nPs@f^p_6Gw^T#0jDV5qt>Vc#mAi zD~Xz-2E8esilR@xc5RFT06*UR?-#&JAjg)YgFsLB2a_#H|L&LhC*XBUlP$mFc30$L zld=O<6ZMlUEDLLZZ7oX8d2Q|DOU?K5jDdtBV#v16$#ZB<(AST(3QJ~D1Zm!&jq(FBXC^ZsR0;OH zfQqJTAnxc{G_FeM07MY204MI7U^!z`Uxejw5NqcjHxk_gkzoT_w-IY`&Lv6tdULuL zjV8JQk#!J|9oLbeF;?)gxbp7<+IC}jx2yvx^#`{DUe0;BViMT4HOTlbGY(89E4UVDpCZw0s~tf`>14Rry%Ss z8g0FK{yMZBZvhCuvmF`HDltBJ&hO8qiBP}mf`L{vUv0xRRo&+8$b05j$!6`eWvlKP z<*Ea_O*KxddfaA}guQxkTa~izN<}T14QOp!)PV!5;aQP-IJj()-y+sD$mVzFS{ zU!ghCl6YPuFPsn78{?7gSbL(m&ElrLnN#$by~2(YTn^Vn*3ixwl%#=q2v;HjzEiLT z*vqMKnixKEKmt2n#FE~cVNwa@9y}33%*cL16%QqchL>~ufSV!643voYb+U#$w@Ni3 z(%%EPq|HO4z;$RjDX$>odiLzA7}zo)Yz=W(CPOctG#Mn$ZoxuV2T5gdWDNrAt?PSHbEu$Q;TM>`gS@WE__`%H6bI*AR1C=0q|q&;t{RZFv!FBwgnn z0wHNRg5UCMXT9R3qRxwvC*ecFBsJ};n9EeiA8X;S7NS6%L_zwAe2im7*vE44_oaVS zQ?w?oi5eh!^B=!-^p67ow*iLRu4^hS4xcJTKhY3R!yz$t`8Z17u>3{Wnv>P#f+PZ=x5_@YwiB}5qmy-R?1%Vxe$ckRu zFsnt|64~FM8}7M94_x6jVxLu%gQg?@xUNb0$BkAwDH|x<1~p~sW#4gas!Nu0mnEA& zQg-mOK0@T2vf|${I*j?gPHw>Q4h!I~rkx;PmG8U#PV~zy&Wj&_D?EWhh(LT_FtNWR#z*_VeXq1~OV47PZ80X#ubfsH%yJ_TZqMNAP zz=KwU0A8&cvJ!Q}gt28z*EXzW7ty$mVA_a3X0jDC+J+fp&xo;QK-bo*W#`Mh%a6(R zf3Bu`Y0|nhZ(P25sX|L=@lK+jy|VqVp1Uv-0JZ2&k?)hSn|~m(Q`bilyRhp0{sw|O zO}G4KQftGZ4PWQ_WFMn^Zux_F^A_t3%i z{!&y?mRUt9i&e!a(!>5FQG_MWXhzE^^K#UWuP_w?bHhtSEzvIBhn<3j>WF1l15#|T zwKEygiSGak-YOK@7|v*!;?Rk`|5ccrFJw=W=3BzkdEw?a*$ZM77F=vZnIl{&wPk7V zCLRX%&J%w+Dr$C84KqbDee+69Q`=`g*h0r4t!=wQ>t7AqE7Mg(cMKXV9chf^p{0?$ zq5*-~6}uF^iw?P&gRm-{bn34jEVS)=HE%-uq`t;IY!|pPileScP+HxR(nW>f-{C%C z8ex|YTgR)4vt4r1HTx5p5LRJEuP3duZzHTUzo?TzZei402|Uy)yG2392<2dHJg$qJ z`Zi^`6R4O$H@{@tl*(OJTirS)E@@}rj;pY9AQg(_0uHHb05pf3MwC5PB8M9OMrL% z7EMv{_fv}`3VcO%x5WMUbFz&^>1nR0CceJC^V@xt&xL-{#}$$z2N`Lf(qk;*_bBqR zXP%3k+pYQ(Gf_%%?Km~TbmcuUwy4N)Z?-2X!RhPp3Kc=xOFZWnB$}t@B7-sA?xoox zAFCEA$L?^HK~Ny79H0+tb4H*SZrOu&5;0BDTv`p$hRuCz6)f%HI3c2@r!s5+u%ki)N-8T_mBUrt`)J^%$?2VavSTYf_dWzDpPs+C0bF&3kQe z*1i<>fQ3x;0{<1v{CCFt|Cw+;C-=VyAuw|>{oBW&bG39Gw>Z!O=Iigb%nDY?WYUj& zOK*70gn}Jrx4IxDl1)jPj#bo}|9s}+x;rnMV1bAo9~>NX`u&mO*%iCTbUf4xmu}gs zPz%@2bC`OXUCU-lcsy@Nns?Y3^)5+MVSNdqqT@)w{qwygPq*s1`^UlJ`vx#OPk3mO zay@*VIGX)Q>IH1i?(J-7{{^%A?frQW@c9O~<3z@RXzt%lNZ0)H1^U%<`Wt?b#s@tA z`%t5Zg9e868GL(+IE!w}Oq+l}ZP1{X_adhH#^a}$I8w83j5tvnXb1YKxI&|Nw!TJ~ zj5*(T-Am2xaN~VfmPyyO` z@|v;A+hq`KDyP zz}^t01v}{}TcCn|Xfl^mnVGa9uY;T9S651HtEsEyj4XkgyJ*U;k>X%#DXVya?oN;0 zQBcdJ!L!1q#(YKTAb%tdOwAA*b-|&t*ZLi|!H&k3J`VZ5Z?Z^F0b+_vmY55GMkVzX zQ>z5(a&f;$#q_}GKutVFdgrkn)%@ah$7tH8(}p0nE_r)(d~>x{ll4qiHGdH3oJ)sp z`?kp+N2rau%?f)3oCv&XPflG_1trZG{N8lX^x+gy1yYj4Urjxu=vtmzd#Yb_V7ZLQe! zD~~5gDOsV?0qM(6l|>*72wdA%32)UvQRAJkfJ`!&6uH+m0JL%59reYsm!%;?oo~yB z3yDzZc`v&iXrq<(tMdqR0CmS=79@&EBo!}LE#2#|4h0Y!m*3U1 zUj6kSp_nIE#_~7`*x4d&X&Ow9xFTAnLNL30<~{@t{9qo0c+u%=ahO^GU;PdEr1}r( z=Ek|`p_arS=pE)G3gO_vWb8YmEeUkR*QQ4_pHy7{w|0!_tD8`1zLKUk9M2eg{abfrLfFVGLtQ* z4IAHOash0P;j!9?KE6zxDgz@h`hLv4%N+Xy;hNDA#t7TiBo~^opnb-tB z4f8{#2`E18+7y?>Uaeui3`xPqkf@hCL_A4&LCf(WYp|j}fY0-@I|A={2^8AQh2MRW zV%RN@!jMLIa;mlyMMhl+u2*4VkI!p3X2PKDq4swP)&=F4_UEEnP~%S>wxYII4Izh* zF`Tv5se&sn7L!NNW=#?wMUvzDn+%}`=oZMmelfO=y(^ad9?EToc*fc3IjA$H>(J4( z9Yo-_2L)5{Trh+L-a|FN8$If&#fc4^n;-4D6{m4$OxARdXiUndul74$M&>;FJu(aK z%zBB0i(cvU*RlB!oP9BM;QcdIT>J^rTB}_ymT9Vi)~mm8U^dr4dWtrg^xOnMS|=!j zq3}lc6gJb2GWwG=qJXrjs5_PrHGY@W5qAC%cv0pAmXP?)0`Iw`xBpNib;jC~An9*V zY8hUhoibJ&A<8r?c8nIBH25;wMFFNAyy1dpQgL-LX~S|k-D{tr9(FHu%`2%PM4r+U zip$*lc+jIOE3Q}1f|oVvCS7h+TTd?NXD)sROLG3IueHx=#{I`MIyr+Qz}iddKt5&Q z#_$Ah025tOut?eF-80CJqLcOo%z>R!mf%G%D3oAvO-$;E5BU^MDUm;4j#R@dX3b?x zv0Fqwo3J!b!At;eye#**Kae@>NOZ}bE>zDHw50KuIN&8_1d$b}}3D zxrAXSrLDN|cZtiI{DNbTRu&x&OF>8I+bn9qIVPMc&fUgP&Dw^)#j%`>Y~Fr)LC(9D z(kbj|4)!bZlNRvoP)$o^D>dXNf=>ov2^+#@T=W%`hZQu10J)y&03wX!pAW>zH^6L! z@t96TnE#&g`H%9yj>P3^$T}W#!1evjFgge3F_=y! zyrj3!B7sHQ;c(r$6>j9mCJqp9t=G89=%;)QVk{f0ZZxfb*BlKExG!I^(6jy%CO z0AN6( z=lK5slhz0GW!!+ENmH&O`z3$xb^5*a5_ig`k)(lLT>2=63};y)xTt;2Ss9IaS{|VR z=Gi;H$}C&s;a~PPOjbz}f5=rHwp|Z{{p!$~9)(b@FE1vTv6gvpv;9sNCpc&@Mp=j{ zXYOAhZ(Fvhy_6V>A7x9u!a+A*pb1y^eq7lYGl1m{NDfLK9V(B9&CUy)H%|81+)k3n#E3v=`uQM1J!Nui1pJ$gQDWUR13gydvY`Np{FC z0zLkT$?LwrX2fN^E}1VUdol#x1%gNz4+-OX7>k9N2$>pOJ6}(j(GBC(N~^rE@TM8C zh6(N(F($XQ+o}{Q6RGMyv;dp+Y7Uic+L(+1O7PJo6jzr&>738ark>tgZTBXpOGpI8 zz!Momp7W%Q6Q2^A2`n79(AvNUqQoQ#miP)qIrv6N%X9tMxMRrXc)lp$Ky7T1HMEzDweWX;|flt{`2>p$Awzr$GDf zdHtL70XOs*pEs^|Qv8p)A8Fa#XBH51FCyUVIYDSnt#RHqm#7dtA%$l<08~^evd(fa zG9W6+9(=DbbTZUEor$4Uk;*#Dv2FrVa|;q~5iBjqu+fl)-vjP^1q7lSrlu#v)nxRK z`lkAWLzM5!7UCi7aJ|Pf%iT#_zPvY)Ri}lGRrhIqJ_;;v$lu=0VO1me@=4BhDL#`Og`wK%Yk zgQqWqB#(*id6!g{K$@?49b)**dMVA-`P1i$(sQx|meA_fPRnU3s?SXea{SqVU?p-) zM$%vI!@#E46+Hz4q7J6rn0=3SP6&G2flax0CMCWV4fNT2jhR#0GR55(OTKTUJ?RYAkF_&k z2@vP&(VJCMiWk=3kx}2GmwOLtlu;$6DiT(C%s7d<=TLWL9S3gip{~7x@x&Qkq;r|gI)cTwGZf@!Z z!>Hwn$~9jk@n8@HwRwI+}hI0jfj)wuPkEi=Bi}wBI;=GiloT@j4(2@a{NvE{73m;qwCEMVuRj_@!msj zSD75N^$LZ@A=YIH!pgp~ic`oD7EI;NrmAQ(en>7?G&6O|!@3tAS?R<2kCIwjloU2* zuJz0bRW!~fN_+GI4RDUaXgOh#HtHfi++Z^^q(E|FAt{hBpPAs4V&B_dUyr?|&*rDLENExUHh6C+-&+N^ljrU8fP~YKQ7l@F5A6xM2hV_#Mf3X9q17~Mu|B^K;mvr;We+rg$}!_$KJI@4LOe z@6Dba-}|evkS~50->v>$@5?^QBY#`G^xWAmf2XrPY(6^N{)#gMf$v6i&olsU^FMm` z{RO|#`uXL~+g=O3)o!Uvx}j1QP6v;i+e_uIfzpY!#uk6#xbgyZkGk`wwKBkKL^RuuR;W^Hyd zYI*r{MvC@g{_XR1cX+)g!81xEPZ%3GV`_PXnaYKA%Me<*!PwD4Y2)(>ZLFDydIza>it7=&&v%%A$Ya_!*lMF6Tbs4 zJp0@ABx&1eGNQk?>XhbU;!%oHmNE4U|HBH-|NiA4b7`r+Akgyr_{?j){c3w(tLEEw zSoC1XaO;oO9~u#zy5EnUV|`k?{rcj5@0jg;Ev|t*xw*awdY(_A7xBG+=SZOW((r-K zgJZkkAGh63=3`uwHBbM#>94DuH-US#E~k#cz27sZtM#`bivFbj?g`hsf_oo2-|VmJl6N4h^A`q^7B+_{@gC^RH3<^=1R(_Wty07x`;Fa%${swjL|rB0H}qN5DEV zHFs-uL^pnZ*#COhR<*q3jAFcB2EhIt)kN}XgBmeFD-W&FULJg zF#f9pb-#y38AZ#0i|iHeqn9_E9^8bROu=jZy(`{2?!TH=yR2Bd@n-u7bg{W@&dmG* z2k>UYW@cjQ(GBuxs(y^hDM%VkW2z8bm;eB{^)C~*fcKOn(Uq|u@PVJR^a*FwyWeR=mXu7jLPNc>1*v8IM1N0(_T!$ncs)25Zz4yeudG{SIFr4onlMQZzJd8HLg5mTAZ_ zp6EOEzP!{k$)FW)kR?iOoJ@L1x#L>vI`F)faD)E5+wgf#m!iPG_mn6P%`!I5&?Ij84%_9S= z&sfeSj6O}@WAjJ5j@B;d5yoIkm#=_Y@!6kW8qxdZoZ`a}=Y*ooKT$LcgmJs*@d&-*q`xp;P zFcYdp`#m_#CQ;&a2E|uM!h&-h%^kxA+IjksO0=y@vWqUCl5y7d=hLA4RGjQ%TuJ)Z zsnEztXZD^oVXrELhs?X57k3Lgy6}o$$x5}?v7p`I`pl8R9kz$Fii%tV*R~(Vyk4wB zN@ja^e>f6ZRxm($7->wFlZqCrv~Y?ZUw1OKz{rN;>!fp+LLbh*8~k1pWz0HeK8jWY z;9^8!r#@inl`xxzr)4+9+jD7qsi|18tit1l-K7&C!UVen!4%{2-W^wKO11O<3gmY8;C1viM`J4AY@;=@3$o&ybFp>-a)BMTvj&Hb8MGQzSbclI5D8n z>#Th1Kp8jr?vmT>mMWHs%!-l_QJgqALBalswoUsOk zL%iR5*ND^gEB|!RZ7DADJjU>_+u5_q5A#%d=vTM}`j;AZgWUN{C^3czY2ZXSR7 z3TV+tdM^f93as^sICJqQqTSRQAhm?MW1j z1o(e~&wqop{}xIAui6FSX(Ddle}wCEmR~F|2uX8#)TlTf3m2*VcvJf zHEFls+1!-*{pWTmG1X);f_A1Aih&QAD(FcV#bcoIaN5vIo%heF@Lkw z0fKvPP5KU#S4WB(b!G8^ZjAPFa{71>=66cabQbOGJ>kRORj$E$FT;tPV3D-)xn+`A zH1!70njW#I?_reOfrsxZ`{QGpJvs$>X$_K>=6-!NfpN#0W%qxsPp%!1ZhZN;Kup-S z`+$T-p>5>?Ba1T_C7*;K@0^CWL0nfgh@Cs}vmGmwPT{cH$l%PA_NUUsmy8)_deObp zOjcxLTe1(oNqit|A|anazbcux6m@QRg`~F>*&6uCx%t70`j949j578tpRL(DH0h zBLMz+s`TL8Fo9ZMCi3*|bc$(|`Xcw(o>v-#qpHIEShN-k&Pf0wnwFV$#cC_~D!S}m zkXvbJ45o()(!Mt)elOQ(Po{m6^Ubr)!A7Q8w)y|;!RwP4mcpAB zX~e$?{Cb6^HICkuD=Ssmj^)=BuaeZfhdXJ3an2(!y}OK>eQVswNs<$rpU9QjJC?Ul zh(Q5?TZ)BhW!r+N;i>qSG_y~)SlOadrIDtoFUNs5_D03REB;%6DwOVPMgqi9S` zuX=eZM9W9naywLG>325yRSM?gMK8MbvHq6q9j%?}6lTOw`C)aG7B;w){d?=km+q0H z2MqenGk4Yl# zgtcg?ZC-WsF%1bmI#hYw1Q^RypoMne;aI|(19C<^+JmNIiP@Q2evK98WqX92d5?>4(>M&@6_*!&#-pr| z@OeCHnI)wyHSw-J4RX=^z1jbsM;&$_XS4yQX49Jd5?i1gCxe_kT|X>1MOti2?S z`Vc6W|IS)C;wN!^6}^?ekkXaP>5Gf~ELJSQ)KOeZ8eDu&o z-dOop%7k=j1vdpZ3gCtSA8<&c#G5MZzijP39{9q>bbEI~v%~<0=t8(H4Lin(wR)Bw zR(?HJ`YGCda3ZhF55gXTRUq1>GVxgaxLHgHzXkWQH&AVquU-~T9>+rdnA}|x1W5a& zK;n~uk*`kWxA^Y2^>46BPLNCwL_bJytW?a<(7sT#9v<-D=%@>i;a*1Bcgm+wiPRu9 zQ2c5~7URt?*<7pWU9JT;F@evW#7EB12-ZkURI^0wiYL7FlV<(hLAY#%{&w64Y+;uY z9#$U-lj!B+wEHNKLUxa4H0>xH!RJxd_ELIVeQn|FV7D?nY{uFNAm@x12YFZU<92oB ztnOlA7A3FtW$KWm7ySA4!*oqa?2EvCsV#SR1X$N5CJ-(=1coLNoVO+?jdr_HlY1K8 z*^t5p$LbE!4@gj!j-6l@Tg!}M^YH5Al&!?ZG?YPtX;A@f`Ir6?#wYAPkmN)%yXypc zk+r!}I$;}Ec6ROV{B(J<1g4pkj2<>^rD8VS;KCWR zybz1>&&6%71?wG6*7dfXrP@j;tPK1*gt8bwd#MyYF%HZru32F0`6L~tzPy|_cmVjL z>y5qf-rPvB>iw`NfA#Bj$QPqGledJ(;&7dA)L#1sbj=7BeGDz3i4GO`$|wgUGWSv( z65zm=SGK?j#%s4$XE{kScM3IY<=85kk}3)7j$H>hF?a7+f@zuyM{FJw8y zlL~Oszk(REsgHotDceD41L1F~A`kZacc9F@-G6buX}J9Tp=QecQ;W~?WM*Goc!J;b z5y0Uo1TdGCbB<^?&B}jgD*za0Kpn!NDF}+x3;uZ@fJFbyO2KVF_d#wl`)K2P*&>Vo z=l7jbmH)x#o2$Esc}!&^KpzBNLGUmK2zmzf0wji%|0nH8E^(4w-<(eXmVx1b%m~RP zW|;R45(kS+U0~NBPi+om(M9T*;m3l`Ac<2))uA581sO0oLDoOhp zJsf6#Awj!s!ied41$`BFzOcKD7Q{L0R^MsQlhRxh*n4HoN0Mey=hMi8(d&Yvd}U~f z21P=biGjUX(vE6-Eo>`Pn3F>=S{H0T!8qC)e)%nFwND~l&+=s8%Wz?oE3rp(gcmjA zd{pM~B{z=zPF>6hYOxyi?|W5}u&?!f;}*-!?asj$-9|^s(J;GXRJMSzs=nQe|Dy|f*LRK`C6N^Jp?s_a-7oyp(o)Bi0{#^8KZhC zu0;1yUoOW&!e6Mm3R+XtNG4Sn#3GsRlyozji2Ih-G?d!Bl7{O`(r%4=1Yc~dOhv6p zzel;4CS1-xhM+IV^wy+*r2{JLXRnF*be5a8kJF3hK)#R~nYrhK0_TN|eI z4(Nc(&2_L#-0!W;#I3$IWr^z|g#04;`625?T??y*L%Uy6U*Sk}*N+X3m60}<=5d?A z$sLLymY>WRmaOS;j{6K0;zlPz9%)!Q^8+edw4{QMxpavaeV)$yKxq}y#W@Fcxlu#I zZ$AZytl`)7>pnp7JxoekKn)HB9=4F{S(l3sNQaJ`ebG^o$Hdni8g{xoee4w!V(-zS zqd~BW>xTGt^IBpzZGAIQbMys{&LuFFtZ4h`AYM$mVwWyZ9lz*TMJvQ$hN6w9)i!+;MBbGu{XOU9Zfpc}n5h@R<~zS^+0X$B0*|2=$b) zjEeU3vqTqT{5QO-mh?Wcd#w4v!1ZKhAx%~?X16P>VtIpJ5Doc$$QeJkvmYpX>)AbD zTPGH_KlJJ7>d)&!On*w#RN}LWpflujtEH6!$1;QOKrHzt4hTvZf~*~UlH%b6SC3x- zp>QV6U;i0X@-DiHlcqKJL=l}aMjH~hm0 z<5x4{81RyNx}Fa&p~stR1vgBE>veF}QB6p4%!y|Clh#)@veZl<*L8#whc$mD!I}f) zbib;tl?PsnT4sEyhez&Upxe70aQ)%55S+0`>(S2L8?e+J1)LK4-J)(3)eCN@w1ggG zeHkQPUqt~9*JpuS2lWYI0!)K1%R-fr7lL*M-tDC%XWS-n9<$&2mRklibH%MA>9a9* zwLYv;;Zw#PPr~);TiaZH!@G%Rb8ze!)Vs4EZ4~eJi0uf{Dflu@9L7H}Q-wwu5z+eO z@KfNS%YEO}vRz$6Z%6!+{L-zDg;a(RMT{cFjjx3~nGoGL_d%&N#WXS3fbE@++DIZa-fIc-M0vq3GU_AiD_M2iVLEXjSjy=vHW*S6ZVl@^?)BV^+$ z^zaHa9zz&a>g{b!KHPWL2q~6K!>}ySXmHaK?t6_P_Q;Z;wogy2(*4_7%pzZ_bTPp` z97lJ{ zH$F|ReLUT*{ww9ec~u7dEmB~eb5#Qo z$h1cj_>ymM^S^Q~00IF{&fq3wp;>4Hw)oSkGk{s})M2I~S^G_T0zm0EiOJu1JFq?i zU#GntkP8C4X3J%OIF7}k|8g2aw*uHU&6K~PVbycWcWNj6X82>=q1a5Sr4lY}EWgJ`(;891S^^EOEfZZ#nUZwxwD&!NF} zcE<9Tw!#rY@*sxD=uj-j;P#RH>ZS>uOsnIu{DA5*N=pWPFf~BhbhsO{m5NFbUB5t0 zYJD|2AvC8TPjHf%@J-W)%k+vnOktWeU@%+;B9~hJJ;S=xwb{i=t&T28EtCzx7Y9Be+@sQLP zp0pQ}>s7Tdjt6RP0=ZAgKp#$wE;**Z&^2!5dPoILQd{hi^XAW&oq@Aeuz3Ntw6r`N z|6vJU8Cho529TbRTJx`z;qco)4?sc&BrT|7s2}A^l5nmCPPe{gplk|`Mfd@yuKX%HqH4jj9x--AQSIg={5 z51xPtK)uhyQl4%3(oIBrzKu^7l=|&Tpf_zej`lcB)4n7vpQV0Rf-|MEBg`-roEG{{ z0nk=Pqnk;=-aQcoeb8v{aPQ@AjI#XlzI4{gv#=(z#&#B#gHCKdyfCxUM%~?XSNXOOtuTw#TuS>n!GHL=665c`1 z{rXJS@pFLHvkpg{$&b}OzpbhPs>*!re!l@4@Z082=8(dZ)@Xl!90O3O?HU+~gv;2v zvPWp;I7tf)rPqZ})U0j+J@Hx0MPVCvCBQ9TDTjB{2+JWyQf7deSg(p+_*~TjQl~hK zVYjsMyq;R8skHZPVSHjQH3}CGtcDxEQp&i(C`+fjK-S|lGtu$Pz}vq9y61T5(Q=@x zO`4|*{5|_WX_&GqQI3RB4v}-)uOvLA#|0qoG{W9cyA8qLn%|>6uwR2=(bLc7ngfWE zO&W#3nNws4yeru?2AAzSb-%qU9g4rbFroW)+&621KCv(V+wDT|ycOv1bbOjT(R7>v zkyK!|h;v7xyWr{8jEer#YeCk79C_MvfMuo)li&PcDk3_XeWOr_a(%M&jZC=TG~a@av!113wu@TO;4)n}1w;d?C))x9 z?JhG402)`O`&I;OQRGjzGzj*bDZBylW(se7y7;y~ZzNYMfFGd4L(qC5P#4hmjWnwu z1+W=<1RMqOn7j-*IdZt^jV3Rg246^pd%ChXMfWtX|LH&i?F8#0?UPf$Nzl(Dh+BWZ z3!+9dT|bj-n?_<&Ee(Rj{sa7+)^nuCeO7tro>;)8Nd!5=m%nA--0cw?0IZ$jGB_~- zhvuj0U!BC5m}k>n_l)9!KQ-7-$J zPKc~HA^z(dNeb)!kivtR8H2)JP5f98N>MQrx`J7A?#KU=W+wh0t^cQSK)4weB2`9h z`14ek>R){8G_rO zD+lM(2ObI~NF~6Pe${F|3_4Ab;_l7Rq_uih7k2QOXocF^|I;M=e>=S&Zx~QKK8O`e zke*yV3C6e_;k|`DsnWwi(VLF)frtHwOmRuSiN^ES_MTlCoOibaeZq*(`F+#TQ~EkX zKASRdws14?)}{~8qJB&haV&k)(O0;6T%)mczTDAU{g^jU6yFIxc54$?e9om@qgS{A z%+Xut;7feD>AT)SQT-UM(XCBQ#ItY(l!e=jERcbty+9R?Uk&1lIXAyjhdU&z;eH23 zj;nXt8|UC1TryO@-lsk$hrNMBkh;)3xctd^f@HqN)q2Kz|*8K6q zRq@jLo*gd>$(DiVVAM-kX^ipKsdiP;6-JwLJ1jVNz>t48)>3h_TZrlG=<6w37>WY5eux!4H z#k~*t40CC;89Jio$TF$+EVY%ehSTMZmIH3Gt-hS+ioq{6#}D)4v0zS(;YIeNLT&j0 zVF%s-?wk;WWN^y)VGeMa5E}RO z)eacS4Y2Rr@Chh}I!!RcC5)PEu&c-?`Z`pZ)ZFZTD7C%t#2DjEfK3M=7N`}XAL?AO z;E0f*d@0Fw;&fsvQ7(?H7&{n7*m%4$3?9{y!EdJ!EyCEBB3+7{%8Pu})V&$Rt{C;& zRRJX&Jio3iza+QIp3ug3EApiNq43UvGMZHlx0t!+Qy*UFa=S=`F6yQd2E!Q~^E|Kd z{$>LI`Ak)k&dJByA*udDVd4;Rm}WM_~a$p$4u6WRE&MjfO*I+x=+?fx8Lqc@61Ku>2ih=+}V6yly=3oXs@^>`K}mo!iV-YvyxTq7fO?hF<~c70^4{um=4*!A1Zsp zuHJlQLyz(O!1T)*Z}awR-rAe{fob4?6VW(p;fd%5wV!gKq*hrhDVKj$I0+xP%_lI= zJy^P-)y5)Bq1~vr_oIGr<{pIt$TZx$(>YBI4mi$WQ?d$_h!dh`~B`w zrlf@QYTk`bncf>!M)U!k#bdV$UPha^R+dLzS5~g$V0er=E{-2d8RC`Z)YNau_U3Cg zmR^zJI3#k9UFzQL4E$D@jTz|feDrhBfJ71S3%!?bWEX8e zDt+1Et5!vI*Nk+L0{yV4vz}XDyFO~LdB^#X=dDX-c?)Uf=MJ|&%Vm`}5mQ4>n28yP z21F{0W9UJr;+(%YDGy&Eh$5q0Dp(snl*$9MQPavMhKzEl&>TsgcGUgH?WH;AO0~CP z^7=$*xUnGkLJLr{hwQ!dpT@8x@;1>cK#O{Cdx7VsK~?%h_~AgQqFfjl<&slH$E+3e z?Ur7viVbNaR>@eG4$@;TRw=HI%y(^5);!?Q0cN=Z9`{sB+rz6-1%9b9gr~z&a(Z`N zEhL6tvKxDqx)0|YQq6r?=z}8+%4qa*wr#att}? zg~>H#SvjqrwQWi2ySmfUqa>~1vB1=>msMj7Yk!_+x11!67RueC<+FQLvEyN$f z(!0M1)rAV7$Kzh!+mL$sDJ@|w`^Wl<0GmY17QfYFSop(m$Szb>9kjl)m_FIE2#(L! zkKoIJSlB~?boI}>)WbL0a>3(Pg`FwYU>@tHG~CZl=eNMm1k+q;dr4PN`12b5;5(GD ztbIwI9y|inZoHRE=wUP72(60D#A)XbP4FeLXH{+e%Ld;^f^jY*B&fXuBUq=5qQIzF z(`}Ja9;IP&oU6cVjPWyg{21WYArn`7x*zxB1waQGSMuU<44CJ-VWS26bcDYkqE=Tx z>p2{v;wxNv?oh?dJXhO!_}DAlTPS{No@?S0r8lW)#69rJmmVkkGYKg;xJ>Rue+8Ns zs{l<1sVJxWv5&N7q%t0yUe@x^63&GkTZmyc@Kwy`@&35H?iZQE7;5d?S3`3CaA$5s z$Wj#Mgj0#OtTYH8ByQzOOjoBxY^>so(NQmI<113V{KpiJp$LKL$hHt zw7e?6yC+M|KjN98W%5mh0xumEBDsoTInO;9(GrpRB78pT2XJzJJwhMd1%Cd0=Tllj_dQe zpE7d3oiFARspz?9a-_?pC|cKZXClfd6tqj~To|BS5Xl$)cqQ4QfavI1{Dcr4p0w4{ z&v)WEqpR7|^J*TdX8?r2$Slj?y!5UW_*zM!ap}R7TtgX*Fa54F-;%~qSSPQ+|L9X# z?jGC@1w5w7mP1h>P_oX!-kR*((WChe6NOAoyw2^h1Pku)f<&3P6rAbRCA^n%#9P@e z_v($zJ?&%eOPjEsjy!kqLGuvL-v6n`AQGL$9F+C0dMq@&gQC&BNV+AE91+BPXT@2~ zP;iFj2g}h|5Wx!xX?kHDObkSPo$Z@nlR(aR;de7RmYjA(T~2g>S7po{$NC#PcGM1KFfQmt@0iehgzn7q&4r>hO(<3~0 zHxV;)apKw*B(VYMYKgw*4U>>@00R(Se2ag?AEut*9$;GFbrx=ba>xKob(wtoUg=4g zzQb(#y(tVTz?k5ss7*jgW`HGMxRE%GLFbR9PXo{2_;S;iHWF`5BiDY+he;&9mZ| zWZQrJ1|Z`=)M_SWQCv7n)<0)5-F%zeS_~5{U1$cj`AaRGDF{A zEBqwe=33Ifxxv#$ec~9ZI5KV1j!(tJcQZ+56!9v*{N3;1-PK(%r+GSy1S#drCBTI= z5vR-*i5ltCe&7S*g`1~8;?u|N1s_fx;}vc*;sB;}RImnu*lr=YD}dvFv(w^iE6y-! zyIJ-@*Zwk_NX-m;65j|jz%5!xnBWdqOneo=!@H5=#XKfz~zituP_&a## zwhbYzS&nCnw=k6g5))PMUWW8Vu9}Pj-xxD6$ORd-(q&~C7KM8(AZVZ^mTdK~u0ZE< z2nt(7eH7LwUZtB9zq;D%ETi2iQo|$7wb(h>i|YdgjsuShOcXg!R?axKv0yyij9^n0 z^Qk@6ENouvVvBoEI~S^>IUmxlNZJiApp(l<4cPli_o;fzN+(CO97EKtYM&=n*ZF>A z)Cgg7Ht-2oc3^P<{Q1rKwv}<~7QV*W(?XKy1)khC0!Z^Gjkvz6omg6P{jyTfPDq*Z zD_LJ}u&5`d2MU+#xfm`BH;pWj-4?;U!gV{f0ayu^l6mf&pxxtz1 zlZN=|se(dgHm=sHHKT4AZ6x(UB&mQ~qvKS4D`GooU{l-`0Kw77kQUIeX5yrzoQ^vz z8Kex6RqYrB>@H+V>(Cjk-!g~Kxv#q-w;US!q>C!ebcTmQ%+k-a-eXdGZ*=Ch<@th$e!uH(#UQ#S#_r=oNBiL~9b^fjw;49%q$auPUB^t%sx&L@J}j!IYK; zmQ?r|22)z`vjVb(dt|m~URH*h*BSM_p{14GF2yvuQdsppf$aJAgo2l%7_J8W69H#T8-F!tg!}4 z+)rus@5S5qAd^}x1>vJy!m#$s;XN(W3J6zl;lo@4mf@GwEUBllE43pqtdwfN(Oz8L zVl|Fs{b0DOc8_#ci>eLtmoE)#YcicC020l>#ga4VzURr|x;}Ojj5ROWXQ{7)wqfjE z3@11T*T(wjbrT+p`i`GR*>_|~(28T>_#_JhsDI3Q!f3FxxDKXR(x8wxx)lA-j zzgSg%t(rh3TIe54Z6fkf*~2Gugz0R?c~p`I9O2zL%0;!majTfkl%@iL1JqAR(^MV$ zsoFtx9KA5lKIn4Dkyg!Tlo*7A-h=pb%!9;1b}nh638KMiWs64f`A(W2lN- z=HkrIs>rup>*(nB zWSH_*ZK0YvNMQ&M=&K^Nb3nzy@ry9F?N*g^LJxXnFFvMg{^Y#YXF+69u0`Sq$j4fV zy)UbPnnWss;yM`EY6*OYWvy}d_k5~qlV5a@?5G3uLDe*;xwPe>inz8vs?j&5>&m4h z{6u0hUo2i%Ve4u}+KIdcP7x!cIE}#vY4ktRTmmxqezzs+iSxge}*zLd}YIS+1SeO;$ zpC>sP*B896uM1t}u)4JS9?{1UcGQWS?*d)LSFds1pT`So$?g{Ve9GZ!NPrAwCB`_{ zgVB)Mn=Ov*GiBXsc0cE$MNjGZVXZfORhW_YGL@_n*d~c#hH{2LLIGUOD#^~C(}R@H z@<=8DMz;LQ)oakooyDklk7KG>mWm3=%nz&dz1n>yk6x&*$W6K&jlDP%EXEke>pg#L zVZRa-tIxudzRBlv9qVVavSZ3BQO;JikaHC02oXq76SM%RUQX-Ap1;3F(eB@`244Z!GZ{CnU2)9f8Ga) zs{-&2>g>~KV)K6l>P)lYulH#pmfaDY=bL>1T$;?4zB>}ANld0w-@>SG5LOcyytz9G zmL~cCcN+s(HHE#9tn6Rx1X6(+9w2yT3akUx{}tzu#|$$k5~LM>-baA(5M25lPMj-N zWbOa_wv*@iclH5Aff-%{+NV=jAmT}l`xob#bS2Z6b>=(>5<-*@2x%_s{#Jbu)tpR) zrnGh{9h>3XxBK*CY$o~k%{~J4Mnb}W$RZ}U?Z*(&Itayoy)iAr^H(XKL<)>ZbBfZQ z*LZb@jpIS2`^H>Z;Q-ij&n|cN!QMqHRyc`43<5sxo^QjucTB|arlc67&u`2BRTNkD z?qSIB6zH<7)^P8*9`Ebt$jB@o{_rIV(eo9`Yqncdm*%M*kJK@~g{F!-MpQlXZb!}(X z4AWOvd%Rb?`&7Ywa1D1n?)vp4{p03$g1+$e3qM}Cq?o|-2+=zp$a^mC(f#gSq@7q= z1crX2>~b2(IiClgkITv7#mIePZJm>^Y!e;si3}W6Q(8CPD;(h)n3tHej25QMQx4je zfFgeBswuu68Q4IL%ufSla`$G+NdE_3?`xXWM}BNNS=Ebmf34VXqU_2Lq89Cgu(Kv) zW*+Q5=F8!nk?>tq{T`BV?GLl-eqJ?u;9a0}<+Z-Nq=<8!+Em-)q8S+1;I!**t(ncHB-kyjJ1W4T+p*eQw(V((!7^}#!5{$*gIa6cu3jkfzxkJq5&K^ z%BtXFSzm=I=ch$%dJa^|d7iBM#b}>X^#He>(x`*NWnCq5aOE0Mi!z!kMigx&TG*4s zmX2dC26mXeWet2yfORZ35>*l>eY0#!X>_$hHj(H zLnL@iILf`0B${e15ehsF5XfZWq)B1U02* zqT}6&WKj(uGHh@Kub@h%pfpg5Jz-RuY*8xr2l(|kuMds3T8R?NI-3IBd%Fy1*#i{b15bL@TA*1Us-1WU2Aa0_`j1k-%3H#Yybwzo zK-1)%!a4$vIF-JFp!l~hK`eg$Dho3%vH`GXCNiwA!<5`msPcU~l39RZy-vcB!Z5H5v0xj8h#qMcyQ&|=W$C|H78K7LLQCu8t0kZETl{Uiazkz2bzbhJNBE_7-4RU^!;9EQ$|5sa z(@X)vySqO+i0Y#fjpaikVT=qcXAtW@cFuAQn91Tu@E?+chtwneOLZ(^6qw1P);R0E z_jN`QUsEY;5>tnkbi>JK_zPugnq`qaRfzStOa_zOvmgTlI8f@9F~fYY&+3CwT!IeF z!cl{r<*RyfyPh47G#-q>mtF`@=Hy$l6*+!p(!Xj}XKhP#W%bW33e|Tt5)TwY^-GA} zO=59lgBeE;khCVgG{~fu`UW<&Gyr~Dnri%-3#>?biKl8D{gA!+J?SBr^{Iduw+i-q z+G!2$rGOt_&jCn$bptMHS(!|PTA|+!-^GZ%vuQ(3x7&xW4~6*Zb_v-JnR=~fBT4HF zOuX9<=_(wGN^ou&Jwm++9yc{t_a2I^6_V8lv!vZ5b`}`RngbDZ{NU`g(u$`|@bQ*3 z@{>J1^|+YoTkq8>>i~!BIcBaVN2fe@?67*HkSM(W>o}rm2mV>*DBlqlQif2pzXkM z7r*)JEQGQZbd<~>#K}xxrVu#k+-6xa$CU%{|6MLH`x3!4)7irm!~rj7(IEoSW{(;* zdFeEw0t*ATJ%jNk37jc0o)ggfk1r>&-OR@NtpiBDmHLnQD@R=#Tv1qLH?xsoJ5FE{Q`JCUDPCp!!aZxdrkqiiRhjD zXD0l;l)$2bY-84B{K>(!_m0BM&I={<*brVG+hgcqORlyytMuw zhy8PY?HwugAfeC1Js3TVppY5yh6Te3MVXI z&V$`uUp<+dyB1`|>Yo|h6IApmEX2yEZObg8264chL1AM%x_n*toB#mPcezSj3j4H1 zT}$4^+I@}I>%~EtFDq1c{Wz9%qDtD;!W_>_*F+&qpJBD>NI4GFhzymbdFvv>dxZR0 zpJSv?58!rVq2Fj}WTK;{Xe{n}*BV!{(b^mw7kg)}R%Cs}!!3c`w63O{lQE$jYnPxQ zPdc+H?L%waQ%%qOp6Bl@0Nx;;L{x4%!>K>z%cph4?2n@2ln4dtfg z!s}o*HgCSW4;V}dvoOa!o@)WgPcv}T4b2xCU(-wqIa-Bol`$36Bu%mVY2ZtXm}f#i z#9{Wc>jt&QUt2!C`286{Thk+5_1C^9F0h>;Ra(yGB*}D_D7`ph+G!?qtZG3~DcKPM z&!MA+g){&}l7|!$>9@ipku-kB745jfZ`mVOOMIH&-uaB)`HtfU7HMBcJfUUEszs%r zVQuk*&b7OBc2>Mb#?;Mz@%m0!%mK=-N{pQ&R2Qi8co%*Qse#X~-VM;|d_U+8@spvy zO4_*JD~OKgaS{ki`oHyWX=_WEiBJO7}bxNs_+SF7J|D4e<7}LPPrW^ znt;ovOb2`-FiD{Nb5PZ!WzFcwf@Y(*LU&zKSm7T+P|ld|0!bXYubqEepvR_`Wqv~wKPV&Un{AoWfr@G zy5x*6ocm<+o08mAweFuPf&Y^Wa#csr9uv}6q%Dq`KDdIrK7%d3YxbBF_SA!ZMC)dH zk8dGYPU;)-Ud)Cmt3EozK;-QyYeX79rX1AdZFVt;^d|d31fFQJWf{>VLBGlL!l2qT ziTnPo_UPG5{|B{2OrhiNI=N>_owCC}F#s_>LI3wRT{M$y`=;;Wzhnczb)b2?%V4_xMX#UeCGZ`q| zRj)eD_gs#aaMy2=D6_ruZ0z^C-(G{Ss*I!=p~BKpSUu-+%bcT8nlzal_&0PR3;n}T z_`TALD;@;m%RhQr%iOS9AAWS&26vH#*ByLxXklEF#D^-a9rW@m-NT=@6Gr%j zrp9{b6SK}|zPe}ZkQnP?oL0Ht$YgX~b$%Mh>gi(fQSb#b`KG72&X+fpYrt;0PE8Lh zY7dxh-+M~u(wD1tR_>k{Z@>Ml!Z+*3g=Kde?AdyLUqZiVj+?NrRc_*_$J?qMA{eDM zms&fQBu>8F=JC5G7lm4S7MU3*(B@ruw=Ztdz?00?eUYIa)z%c*LwI}N(1RrB@umHV zcPg(ZEcM#9)xpN(S=6b0uH#-YeO8A35~WN-C5K1Z+oVLAT@F;nzG7SFx2MS@6~_5i zb%;_ooQtiz@3G3hc0GOvCA*4pFdqD5+@pq!P#$x0%zL4JzqE_b>z`B)itj#szGxt{ z>h`^xWnmjiqL^`yAECX^z3KmR{Mzb z?C(>0F)u57ao#T%9yzQL(IP*LXH@KQ8V|XDJp~$hA2E1RJ#ACk`*r!BC0oDVkKX)Y zTZLiilWez$%T)P>rf%Jjp$_IsF57O&sA*DJ849e^vO@2&w9@wb?OlJY4qmyp{bVU6 z>8$GdYx;#UmrYU!w|+eN^Rv_wCW_)8Q#R308J%?4PG5cNr#8p%Q>32S`&89`aRD*9P08{x@){pztlVYHD~+M`lqjA4BOt|jVw0#zgScJ;sxbk z(8(t?4QH*kR~Jc!_b;LM`dqX+ESuHzn|#&cP5baB-60|d%U(O_msf9+fJ#PZbG+7~~sk$+HdM?PtfM)(FlVV@G^ zh?Dq_)hO+yD-NRaB(VLa4oU$aOiVqCb6`KYgXar)JrD$&le+BbI>XzyE$msOeP9h=hZl>1?sQ17DH zu_jk+_g2oYMnc*}7YpMj)|BucO?Uu$!J%3J8d%D!DX-^FCb(+|+QTGi8pm8cIE zez6}k_J{V}cT*jzSn|i~vGqGPqWr9y8`Wxxa^;Um_Fk&ZmERac?vj=N?rySUvWfXD7aL)6qREMn3xRer5)(Zn@a0x+~K!#qvZN z^@>Ny&RfD0cQ(dZNSjk%1@;U)QZWJIVy!|q0u&jdSW*2# zwQG%NmF&wD+t^Ewk~=NcYj%r?Ns&?WSBJPhX%!puuhnkMNVNPb2BSDwu^Y z=t;^ub=+r6B%*!k!XGLehQ*i6bBmB9Me3bNt<6pj8!deQGId{t!pJ;KiVw`eX3ez|e2qhy713Je;@f$m5jXP6aO4rbxUuXj>qYe57{q z$Ga9I#Crv%Vz=(--Po0?vvTW>CwutIlrJ5=qt?2XzK9WFk{Q~+bNA^tM@$;h4=lJ^ zCw-@J9N%7K@pXlbxTd{<)Xrt~GFMlPm^^O~E!Vj}|Jdik^9h*&8#{J*e*CzpvuW== zx*gxtO1?v=`BR!i%8-mG_lUG!O6QJ-;)Pl0c-WHlrF@0-sS*wv9sfR*Hhl7uoL++1 zhvzXHw(YoyzO#BwrD#d_ib#lbD~AtA|@~ zU{@F6ucGeGIZ^lTe$VkR*24vi=z{+RSL|Aim?1Q&q7;8o-lb%*RN<7ZC)Ufu#@6!}4GplC2iC^G_QEe_zbKqIc=#9a z`61s6+6EV_F4zh_KZOFTDGOH90{>=yLQ-|7lIre%oHLHQQ&{<`TQz09YI=GjRcc)r zwoh1Nod5f>7N0+q&yT+$Qi@}L$bK<=`0$q|;agjN?uh+V40CgXD`=N+ym2xG$0xuq zwO}sHrB9dy+}VZZl*1efF3KyYIgOt*K%!h4#0TLj`p`k>jLy;U`b=Y=?Hi(!F+-;8QLaL@*bnc2MPEgWw{nP(^p?IX zMjM(VwAxFfX$xVc*NMc8XQ)+K?WgM=5;qW|_igVxbZGOEFJ>#OPaumXEhKVeSM9s? zRlj|g7kl2Jr- z8@HXSuQJ^1d8g&Roz(KM3d0@F^_4$cyTz}1L=kuT`eBP%)U6*@SoNJt_Rv|?!TVva zL9Gp&WtgmmcDn2@iQ9YfvvIU>)N+$iyX0GHeci_uu~U@v*)Cb4DtC}51Qt;=iMlKi;V4V*oNmV2%9(`*k*m^b^Rg3!loDJBKmX{Bb$FaWSe~J_i()>KXv%HU0Fje zmGIx)ocruty=2OZ>=&ksRM9_#Y8tBUl6Ry(wHTL$eM3XbOi^Z0KS?~cM3}OpTFFzA z7rvSH$Xou!=1mRWsU2CTkwre$jjZAQ{x0X4SG8ZgK6LTW zqHu;;=$SLYY>wAbTgMhWw$&}Hoa*1`DZu7Yxc(WBAR}7$)|okyYYCu^P=>p z+um^I{m}HKe8}D^`K}o6vR%{H=bB}#K9!S|Fb!9%sqYVuE5uz4gg{Zdkcs9+H7DHc zj){9m{CN7oqxzabyx#%*-i%26#JPy%p36*+i~Yhs)UR7!cfdg8X1~dft&4S~gF0MU zNoRKdSWKt&p47Tkopxa@My8{eL!XC(H~XzzvU=|=>t7-vu6g34+=QmPTNa!p8n1OO zZZ}zbVBVdtyRTK`7_W`Lb8`FST7!q8=4FVST%4F`W@Y=^&9x79FMG86nfI%O!oM8- z>1+4tGIX`~`{pxFi;K&YAG=kZH&?vm7kO+{((6D4_&egsn!3zW1Fp&o9@Z^8roBBh zeHY96*OXI7r4H?1m84UpYRQsiZFuEfAG2@umza||c1me$>+k!tE6f{^Py(&4&O570Qo2s-BrE z#wap!M4-cMf9&2ixkUA`tdRO;znd$nu7A0usO)3d{fuJ>E6&7iP=4I(1fA16)F5xF zxZE&p?f*yFTZYBeH0#14c!0s(0t`-Ymx16G+}%C6yA19Y+=9CV2m~M8AvnR^9fIdf zp7-6?-e-U3`t~`0mQ+{WUDdW)s#mAlO73P(XL}8DM~rM_e#ENbO~DCq)~G0TieSfx zqZrB0WGk{bnQ2c)u2f5sN>u76RN<)T*h9C_w>y=C>Hy&?bQ-7AgKNZV_U5}{E?DEu%;^>j zoEpN_EDu6)bH~46&D8xH{ETzowA9QuY()RR>A+EJ!Ra$jKDIKnyim;r8yny>exS#} zTtnCk#dwbWL1C`<7epe^us79)rIHY-*g}clMA`7=JN3v|kA21l;(Y^E2BZb4Jd^+ggF;|45uWEavY}D@{APQOPl=n2~eyE>~drpNQE8Q8RK*-t-DA z{fEW89XO?FTQ@5I1F`4}WI_5vXzgc@&uzA&`nqS!t_vk?+$&9+HEtf&ZMNh3K00$$ zf8x7rSS&RMl}4l-A1h}JNnejHG~2qCU*`5|xdWOWE9VS9yxLr9vIN{ZYgQkd9@N?g zxII-GXpSFOc)xw zBV1`0|I6HFEg+!jsdClu^Q+CZW@VSo%iLBiUcl{@CX2`1qf*%G(Vgb^uA~2d^Ztv? z|M%woC+GjYdH>1Dcr1o&;}GijRQbzL|Mlof^S@hDaZ^xv`VHNju9%wlW$qAarrSN# z%+tSSX8kqu2x?~2ePvpgcWdQ*IQtFM%pWh%4Ei6k@;_|-f6B`Lu=W2XEC0h*ZE{&9 zA4c#m!_~iLrv1&d|J|Bm^q2kZqbRA<>)<8Em!gi1{?b#FEVP&V+l4}vSLg{N*O5Z^ z0X@wXf=q$A=~Lz`8a3Tl93xUH2ew=0^7`GiT}RwE@=Z&%aqw>1{LfkBPYYs)QE@n? zMu~_PDN$pcI4&ZCABFSZ-#J?Ew z!owrqJtsCUthsIfQ;nSJ6~6yeBeuGIY2=hsvu)zBhYt%z9Y!`hAW!49wAX~)Sd4L7 zQN_1oX(V2G*=@1v%7KYpw>2I;tLs}TG406h*K@h*m@ue#Y_;#V)MM)!_ng}h7vS59 zw%*KzSNFBlB08PECB>)@_^-JB^3m4oo2YhsU}HV%=7!uX-#$0Ds;tjimk? zK;vIZXuv4^ONkIec4Ja4vqm(p`N-eDOj9%fS;PM*5erqKK9%twCBAA%de)~_-j6n< zj#}6J7YP5fnUO!P?Q%3#R_2c~8h9)%VKY|Wv^Uqg>hJY-j(hiN?RG~ZojW|Q3N>hk zG%UzHnlVc3_iS#f{wAgo?uP6AZ|mJB`VF*>FRzOWWIS$$QXRiM-)IJ$d5!j*+&`}e z{MZ#H~H{w#19F=(e>wXQVQYdZL%@ZWZiF6 z2?noRuOIcTJu{7Z!Usk7V{QIKC0~q8c%X4oAYXbQ+RpcNhG-u#yDEY)3+S<05bUrB#%&0gupei!xvKS1_WN@D)_ zlptS)MYxb>&?Dr%Cj2}2w|n_>#J$KnvvIxmt@E5dnUeh%=#nQ^@8OcC>Q-;!0WAirf7&-Bv+RJ*N_0Wv>dHm z(Z}Fl*Gq4(nd?8s9T6K1KyPO{M&MqaA+|}H`(SZxhHe^ysS7lfb-7b|2oZ4+uKXEN zOCN&uNFhSHlYK(rAc8ek#S!5k0-tDzT+09gpKJ@&=HmMg=h@MkRn4uwu=0PoTl4o) z9AnX(!8DnU@n}CAhg&`Sr9xIt!!0}%!ye&?SNYuwcfQNoWv7-l^yNNIc3C90l_kEu zEO7X{$o{nZL`lD-s!ge=z5K;NX4u&X>q_I*PcW5Qsx!~}Q?VZR)XjSM4k5lndhA%1 zg=##Uu!_vRc1#(ZS(W4pDd4i5btLM??t9VPC&QbKI1u7h_pi;J#8t)>1plQ9h-&!<_ z(y-}BCI7Ff-zdn!ET3n|*OVlO%r^B@|D;`Tl-yVo+|YcEJdYsQ8~R=bf4zi&~65Mi3ySY!Qw{K*kkg*jNy{!m|cd9^BG|R3ePbUCx|nMD6FKeHnfdRj2zd5aLC&RJyX9tfpB#yqBS z(n$6^!70gm5!^OQd{|gumg3M!wN>hrVsMay-*^b^F;~baf(nXi@97`(&LSr&tIHG* zzJ0kHnlvL(&;DU0M<-Y2B$PDF1t;k?)D^y6UhYCR6MWkqJN9V~w7KTRMvrFM#1I>Q z7O^=0b}|Z6{qCS4c{BIBzX1i%we9Kfx)yx=NROZ5y&;Hk1q_+$E=jvcIO1!u&fJrB zKDtu=xv0QSpBj-j@^M)&zFaAz;i}|SXmfDImIM}#Gs^`@=AIr=-OK8}%ZW6I4pTsB|SxV4c&=z4DzM97kxE|?=(;M<(1yFdM#)_C#l{(4s(KxKbalghur z+w>7dIP=+U_BK>~3(aIEkj(np0K$R3k#RV`3ZG%xy&!AaT#H4pV?^7RJA!o&8AHyE zda1Ht_var&p`AEI^jLK7Xt|rV*BN-S+-OGJG?W@(P_&h&{Jfg0B7-@a1l*M3fu*f) z?7wZ_|Jg&JX>m?~5&(MtsLjLjDM_TMYEnE>>)4}#{3g(+Z;8g2dCM}3MwvQh@za3o zMC0dXditgIX(0ReMreVz$nr>>2qijQ4_Hl06K{7QBsGWsc5a&cyGm=Ve(Zz%&pPNK zD~tOw#8S-9*}L=lY}u_6WyKp_#`c@jpB+*ozW9Vx$OJ`w9`2@y} zz+X!gu?1GAbfE_|9ytqb699;`*&P@8sj&r0SqKKo)veVSHG}XJy~4LA!7S-44E}bm zEW~-_G6U_y*D<>IjkW~JUbMkPJ&gYRcon=1iO!<_tpzlZH;#8|UzoBVgT#5d92?Rv zOzD=d7X>W?a4yP55YA%qNN}?dy0KZ2&bH$s@>&N%@3onKVw)U>3attZR9qg{{<%d| zAafj%29d>frCDqN??p17t9IUZ>2F`0zX975Ka;%H@T{UKz_hfh>;rgD7%D4V5DltB zR^Z_hT*BYGongT2sQe6CzlsueJqzU6>3Ue;)f3p5#f+Q%UO)H92f~!b@R4&@)aN~S8>d`@gG=clURqb^?gM_XdbjvN^ z_GtY|5;z3>&ReHsqlb88tbT!9^4yk#8@D=yFp1=rBQYF|__{ zOHxCkB44jsn720=l<_th8ny1Rh)`7&Ihw7q42N9Qvch%#+cex%>&~LGFM!uOjTatT zKpE0bukwR{xpR8L2&22r&CD~;o5cF>yj6eWT{c#4`KqxyI9GAXiQf6MYQzh(a_!4M zeT{>5nDHlvS1!N;+F??kLaKk}I>I~+=N%S4f^6)uh(J};D~yiX*-KH`?SB#dSFEM6 z{D@C>f=hyW+})t+^qe8+;o1xNps$B6H$FC`2jS{HEF#q-AXu9@@66KFZy-kl@i(n0 zu2b5*y0`1uTu1GTnuQZiEjAk$s$&YzGtZoL-=&fx7>$c(`((E37(|+E%xkFWZTQA# zMzqN@6L@8mKagH6IY~h6jg5)}$AZ)a^f;k0XXYHtH1`S@enmH)+dud{#m@?;+#37{ zP3H-v$}cm52ie9N=KHAiHubJkm3_LmhB+MfcPH7G=$c*k=4vZ=C*g*YOSgo*zc$mI zq#>$X8Ol9MZDhHGlx&kR!MfGE7h}A@lMH1ev0a9fOsDq-@#Kni4g(Z?S5A)>g4Z>9 zQla4v2wJBDE77!)U(^=s+s}Hjx1-@`+Wkm732_xxjYdD1thrVx&g4f%w9w7UW{#y> zbOq1Ri#i}-=+oJh-;=q0FN@D)VEWbtX(0Z_AF*M5*rJW|p2k3O(C^c@>|w0M4vh0W zysq(ST%fiPJg;rtJ}&&*RXj3u>XTTXM@yq}9ieBAkxz4!ruc)(t;V$s zTYL3hq6ehNGs>rzfMJ0hlMG==h+f<_@_W|m>txoh!m(gW^DmX`8!1J;SoUPP!?$q} z+M0s`;#o=2JXO1_e^6~x80u*}OC`MqCFvFY60Hhx@ZVa4k<%9G`agXnQXi;SZlDFP zVQgH)Cgm^{;rfTq(@At!vqCnBsk?NS)xccbvh>-jn2wRLDmZkptlKMe{j}Xg#j-7! z79_;GNU_YDM8w6O!cZLtCCk0`CGVq}*ek)6J`ied+2K&maYfw@+T1f;)nOEzDx`!_(L7Sft*H88zL5)& zAxK?4!%|k;c`s`+gORK;u2-tiz>yb(E*uyo-m;y{nrE-cJFfS8vnue`aU~DDpsa`p z>N!LAmg+kZR%ZE`;-x1t9_n_&IPWh>tw`!M56Fu-B-I!N;wzyW;|p(^-@2|I)3vT8 zvL3#3uV8qji{>uo8BRY@-Vk)n$tBt?-`3>&02ZK*2O8hazM&kA3h&v=aVG~c zDsvU(tu{`R+0fk-&k(vo!sX7auq`yvjw|}P#Lgqq^|>~376d2nDe|;_@;s;bs_>~% zj@Fh<&Zuu&8%%z!C+Q@bSGSebemjnWUv-lGvGD0te5jL%Q>a_j`EI;B%Atnn?UHIp z0iVs#?He~4M;{inA#$d7hL>=bi%uXIpNEA<;Fv#=x#D?=vON(owgnGbPxwbI=d#N% z*c8>P8=Dl_zLOH=O|=u6Qhc4rQ9EkmtC_mPxO?+OG?;IB2&m$UKCkJ}yL!TS%&-pY zVo!pVKhacX-WT_K>+WZ-!XK10!e|F<*;xo~^iRpGXKphNE;Cb=nBTG_B?kOBTgHT$ zYp__fhz1VJmD|P?)xUC}Il13cdf~il=7Vpc{Yolx0OyNe`Gf1si9U&^i_(mp zvvSGMh$mu7sbRBG+o1gn`ht|$}19o4zq1qyef%?wEw_htFV=&m>@yw+F~lLlg<1Mbg{^SXCa;IMHwjOIR=VeUL*k^d_7)?eMv7qc?@$leev&n z*`5{h@p_SGA24ErB^4CF3kq=h7obXZ1%^<43s3{dskZMUHIt#TAV72qFM2-@nH_h% z-wIg@DzjU6R;NY_K{7=EfS4%pZ`upC@Ux;I z1y$VkMF`qjY?um6}za_a@YDUY|)*AQb=1r2xizBey5?72wb5M;uQyL`SKQ?;=mO3g1sRM z{lxQIm1bLm^Chn&J{aJdV0`zLF@ zj*}A#V#%K;Hj+DX`SlYExANy{W$%LVy((B<-(3%b@AtOTW(kE)!JxfD^o%@FQ1Ku_ zFS#|y+v@~%o&Q3V+V}y-rdxrdh;1tR9ni7w!fWvJj8rX6`Ta)`Nc`%i!gEP9N^|S` zn>ne0WX2p{o-3S=KP2R0mMhb__g-8z@p1uIQsfg5L@#6wd&E%TLvCcdcLhiJf%ieW zv`^yC?O4(9jN7{GGV4AYJZpq<_3r{;gfp}qZ0yqdaHG#vI>kLk9~igNs54W8jES=cX=P*(H(+*B!QjE;aqO~)A!4RIPYjrbOG-8bwj;9gZ;bO@crsLoM zbNkN>i4O3mGPKaniT2aW;hvCzCem!dP z0~dX}z%F#?Kb=y61=`&dUJQTgd^$H|P?jvQWV4yw?ENIbz89zU@2Ntr1lfomA56W%r<}E!BfROLqx=MXZJFJ;2no$cz#Pr~ z7A|p*UJteF6Tw`RbXDpcO0&$qX5+6Tgm7Xl97A8sMo81So>5sG(x?CoZ>D8a=}_XdCAl56ytDgD}) zuKpFKpto9cf6b6r?r1I>xIMzCZjBQ!&MjSs*=|}cPeUP_z~cFuolTh@Sx!QYEK8Bz zP-GxRGv_JWy|GkgJlC*%yD>n&OK$bmM z&pb4&&|s2fnOe&%mdDN<8#yru+A?GCV~)b3y(5(4Gt>HrLf$Jq5c-|+loX%E1&Hsk zI6{F%Z{2qVm`U9cZ6vJ!j<{S_Rkx`$dO-|mTJi6t09|MO*YwrvZ;=G`<%V8wj0+I2i zoc5Y13ry$fGA{D@q2Xz~VbsY;c}X%fXVC4&o?xx^f*WZqQt^nC%YL6Z(efL*1bT*t zxEO6eNcoM{8y^ayuU&5nR7}ctLq6=!cgZ&PF>GSd2zq%K$gPx?t;S!*W=2qn>1u?Gd zxtf5^aNE33ouUM7<2Dm9;Wz#(TtlUm%4jaNQ>^Ll6nOL8#hAF~zJV71F$p`VMdznP zl9$DlZ-40cwE2&1+EMu4l~yNB#9_LP-1SgwPDI7IcW$5!UbKj@m3a-*aDL#2)l;$2 zZh%;;e&@0QJF4`yAv6ZmGqA8T{Po7-` zJn`|pX|Anxa&DFjb&g1%ZAfsu`C9g11K`ZFS3gWSRlW#zQVUOa((rk&5klMCs14CK z?LJOo*5_YPZxtOPMP4T$LgFqN0Dg8U&YWe1p5L1;KIgBVi-WfFJ*)zm*ns!cNTmww z1>dr$50QtE%0U*UX6TPH_r|aNJE=CueRLdmmSqCu|M1q^`}GKNqS7SXP#3zF?F0CG z*5<~`sO+4AJKFM;EJN0u-K+c}A7urCAJ{hvpC}g}UDt z*hgTWY@_o%+F8Ou_?O-?LGItQQU0t7dTyNjjb)(S!6>f42y6<96@{X3!Kkq z;erWXg}Tj)t86Iphaa+yRkj1j&9bghWzZP{g}Q|+D5^)gQSZkizJfSUL;GMfA`lcM zjkjm*HeD4lfp)R(asyE(^`Oq%&?!Iky4b~NoEOk|0AopI3+6&?tef_aslvSDomyK( zuR@OJovIK=)VX;pfG{7^D-unvP6lfWfwEm3@YPASpYu*Z!UOlaAEVsz)sdn6>rhCH zpZndJj)+73A7&&l?~9y5XvmfHq{@EA7u>MTeQb-0kxlaUvo(ey*bpqfB! z{D-c|PGa?IPN=jQnd#L8C3~4B5%3GxSMUO#m%V&i5ho_Fjm6un%5)$*}TwOaQ*U(~G>f3kp9zsBzf!lj>q%a}Zl>3#K*(oMuC++@II!Ud6vm$Jn~ zE6Www^5%?8>Be<7MZ^3bCyrx`Sd9LR)FjuL;uCbxPxq#&0rph=8U9JU*Dtp=(^VE; zl53sLo%98u#=^Pd*i-u=>9IvSgzcQlY4FE+dc4;sqoa&XXmABIdf5{t9wLmVK=zY_ z_~2eVz7a~90nzWwL0LozNHc8Aa|fDCL0R&mL7AOKYg38cpW?x~XrF1#R{Euqd4P3h z&Uev&dop-bPyr=#qe1zg%(Z$rdw!s=9{#Ni|62P?H&i_TRu+2%3wh|G3v-~&-f;5@rc-JTH(>RqktjFLw5mjtF0PiQKf#rA4Ap@U#xk%y`>M=Ai5R3HOP-xCH6jQHDT^Z1-p1QgF2s3&%^kZrn`*^yAhr|> ztL>0paB_!UV+NnemM?DA3@dWg>~o|EmtRjb_ZHAy6*ehSmqzzDttoyx^6_fD_Yi?~ z5J*3SN88U(jou(1!NI1fub|`$@9ZpDI8myVa5=Q-qH-~86i{!o&dwf%e~H;vDt!1^ zAW6Nva!a3#Bisn|?Jqz`7n~^A#T`{De5$)SF~lhK$f>Uk7-Qj4tG9 z;%}wamE|~DT~^gLna&coc!DG)onB<_sBjEHDNm5<)D7ghcXCY~H$&$hnCnSTF?{q}LpP#?|yAdw)it zS*JN0iUWPuX4cBWMD)pz^+sAVd;57-2*H6pl9{s&ef|c%E!5(7PbPa@PnJ&G3xs{U zZpwG;1nBwZ}FnRQXxXPlHky6}DtH);bs%Z$?_bKv`iViH|AvWuP_a>+78d4OLo!}5k$wyI)BH@fh zL_RxHC#~?DRqi-3Bm_tOI(U(o&ARJ`_kg+!T+-Iqp`ybH7LMN&KUxu!4g@kMgRxr? zFRLO}Ilm@P{WcQMG{($1_&v|BjLt}onX}_m4=AxKfq0Nnbn*%i{XuT1=qX@b4ZxJal9ASGBd^iM;^23K6`u(E`&xb~GxGVEPSUZpx5rGPWTp z-c0n4%=LSIt*S^p4xk^w&T!Nhy`#F!OxHl%=7q_NTKq&Mg!~CTESL!IFfzb4hnMmx zhU#ZBs7Av*G4~)RJQeC54%VK_S4MgjT*fYU0Z=?7wtSK=4Y|x-Hs*=F2i^!0VA(7t zLsu1`vd=M8Tgieo%GqHYxSiKXFat}|_e!UzWOH!~&-87I=6gRZF0;}l5x4o9?A>RE z6h%iv3JSs`{I}M1XdjJtsji^H)7fFs&){=G(I6*xP6ZsShqBbHjy*+fKL(C@x9IJ@ z8$N<{L1$mChb7opV|`NWWb9MqM)t}?77HB&`JRfStnkNtQ86r!O@6FgoknX zdO-IG*^M{f&J+ip<0Pwc2KJ~VhSNtV?lqa7hWAV zZAQsAqWR$!9Iw4Bazwj#?iHrLr8}9vC}=EpRdijhxKPKuea$8h1_j4X51vJ&^ZIQt zzM+)Hl_Xny_@SKRklxZ7Pa9<>V60c$v%n(0z(N928Z@3rWaBduIRQ`(qXg934(S@O7hq)A4S4}`go@dJ!`BTyYOjQgiq>_Q+88l zDKM$+Sws3@sr%Q}f&-rPRB_|OXBvN(LhfoWt{wRc=yB^{uZ&O}j+~bPIcK&wq z(H1n0z)%f;V;6e#u8S;_e=65f9v;I^VqO4?hPvk?^MaHH6sjP)QfDKZ(c0ytr|c43T{r1okD z67_~vtLk^iXR=~cOpkKB!5-Tz^Z@Ez{3_4uX;;(xE-=+gxSM3Wpa+m8k3_Rb0X0cK zNfT7Vd9ID2yG)bfs%NnIKhaLn`JIG;Q341)2p-8-soI+)1@zbb89h;Ds-Fl!_HF3% z+}$l_!7|Upe@7m(U=;&;mpBz3%%dV!fG(8^1Q}D_@LBCe_UyM%hzMR)sqe?gZ@^-a zOtMS9EHKQdIJi*X1c^CDT~NS*924S_Lt_%BO08mKDJ~KZ(hXT}KgPsP4Q^ROr)CY7 z2a)`sF6Z|VJ1Du0Pc3{^8Lao+-+%F{(8$-^l8mkr_`O4~mOOM(L-~5c2QPjITQ5pd zIO&DL_Sh1xb)3wnn{nQ^l~A!Wg+&TBiW0?Jv(rB|k7A}a^B65eISf}8Jy ztq&^;Sio%1I@R)^R3th~)g!fDCvl;KJV-v?@(@^*gqX8MD__iuhpacT4T#rPg(kNv zJ%x0ak>!5!+@NSu1z0S>zvuoTJro6(nK-g8^>VlFa{qvo(8aLoJfYp?Bv-SlKu{gh z1L7$0(0VU594cNemp*FjbXHX4F4b35xefhs$lql%(WH0uF`>IEk;QY{$1|m;z>@sbj(=mvUFZWXzeDa&1#Uu z!p@Bcm#|zc=%1_twz|nt5n?PckPi1af2oF-@xvVgnw$@fbQ}d;y;Q-ed(> zpaAH+fERd2G!CCVcT-T5sd^uilD9$+Wgk;nnD*Ob0SDz3pPFPaRgQ+~2t{i0(!O*? zgl}AmjAMyQY07yvJI9l>r<3^|jOBcom~~*g;0K=b56H>!Oh#Qsdi2Y0wbFf0;=q@^ zrk=DP8bZquoxLy~;H;GA)lAGSlX6+G(7I@`-Z=;f6XKJpm?_Fc_yWNO1L7y9AMe3K zQs+bIjit)>3AIw9XMQk5zVZ2~@iN|>(p7y-(^xd}eITjGjG@6RVm8dDZ0fTgTloT5 z^Q-TdJ+Qq=>1gA89Pa77QQAI=ZYNW72c$r2gDa18gsS)YZ@(gcxL@M!9(!8WX*4pCCA7@e!i;?w5UnGnofm zJH$QYK&2VKbE9$fy*&G0_%#D)2Dpb@EI}Cu1fZaQ3!&qp{Z#v?$`RTzyFPV$!lY;D zDZ+559iCY`lr?4c3@P2stzE2QQCulZ4zF8J+^kpX=YBJ7MR8jKZ89F+<-`)!De*NX$)`*u5bcg-|d=wQ3D0@(kzMZ7k)cJ(#2Q1+a;1vGyALLT;Tr0@PL*+>=%bsdrCV;I4HxddU8XCrTv6F3}|371R`Q5@^GYA);@t=HI*%ldf1@YI>2yTfmVi8+qOh_UA9m9|6vGFU= z=s_P`LGEJR^5-t7jq($Pu*byBL0_n${Jw)hUk-g;)8$(R{yspfAQXv94sjm;1VM+U zhYvxgL1e-aD0Y9@8(KH>d2hC3b3L_myyRZqZ#NYPe9LRqvn-)X$QmfH+{dO1Uru( zS(oohJ0SH`rERrZiaruw!`no6li_vFZ!(yszpYwzCI3SFvgE2kt@roa0U8Lc&+x`G zMyHQ%RyDX>IT^9XA|mZHTK*YyPO?MV_@R&Z9ihkFRLTeB&8vC=N*a4|&wVaM+4SH7 z@27oS2d6ro$m}HvzuXnj)UT;he1>|Ey2?lrTmM)2J+WU}PswbFPg9Zvi4_~{V3ZO}GDSpy+CP+Fv7|v;yv2!Jj0X}AIA}9CRbpFA%RoLi{r(ny zhX3qqc7jM$ay1=9z0Eu2*!h>nT{WZ{ zUUVNsy~zmR9IGpY9fg*>Flz1^)<y2OY%(v^E3Iltd>AGdz1WP!sE(pac3AF&Sq0R!kq4>>JP?fVz*5a<~N^ z%Dj)Mn9t+;rCQ)Obb#*|o}@SANo0HpjVhCBfoi3PRMyjr6V~Cr%zU&}*t|VNAjM1+ zm(Yo|fB3|OiCw}ZnY85afwEqLM$Swrh zoDlu^uYa(o(SNxl%pLORcGS%U@fgqbh9w95k>qlmu0_`j@6j;KW?o3{Y}Uznuj|(^ zhp+3G3th|C4NZg&co_RFD)FJazc60wgan|6UvTKpFxa`hC)K^J+uT^!a&3MjAg=+0 zRD<~RYiRveZQQ_F)u5##=tW^>GrAfgT_O%iHTgCd4c)~S5wMt>Q>DJwqJpxDrJes}DE2(7U z1nd?cc<^$n*9OBY#Vjk)71EAn*3)!I(R{wmA?m(ZRQ{fEy*H_3O`=b9EN)pknuG3z z6Bn_Yl+-9)x4RwCK$Oj$Lnj_NUoS&oe!Sg0np!*xnc4OJxtYvG&oA2SZCMFr^Unkr z+TlvFQ)5-&WTynq9Q_eT>Vvu#xIM2f9>rG2t$cc^GluR4ac%Y{hNebr_1ZtFf#1Xr ziLO?lk7#0bgL)?{GQ>dhSB;*R9$~lfQ5X}p9_n9^01dA1|HrwNC|0b0y(@s`0TaEFEXk`4`pKKQ`T2*q_`(8^H z+_r3rRo3JbPMrk)jZ1k7!urc^d#Ns(=+@HC;Fl{OWS6UNzRy7E6A{!+_eT+}TExYS zcfav;mOsEe*`uah$MGb&LPyXO&JfXEhLsl|qzuNe<6$imj-FhiRBhg@(31d%z0TcG zSqLOY$mkp4&lZ-ridb<_o(C!u->6U!c~1b=S|2Kyb3>06xnV%C2U)Skb%e7$9ECE4 zjSbeAfKrG2e4y$Do_>W2XZi6byQR`NQN+AKEwuaycrU?>p&TNm7$dmft$-(rj_*jB|K%58 z^vp4(Z>e)4BY%O+1GwcVbyXAP?)b+kpkzw}xoJ3NIM%5fndeq5%PKI}V1Js%)gN=a z0{o@|<~I;J-q$j%!_KNY>i1BhMw#O0UCH=Cy)yWreZylr5KU1t@Yle1I4<>|fIXgK zmmJvf>c*>;?{~+4-2%@241=~F)D5qUk~}vn7Z$ z@NjFqMIAlEiNDpRoSqdER2@jtlnvrz+rKLg5Y6nDSS6~6cTgECtL$c4*%S@g6Gl@2 zk0NE>u`d)_gB{6#`*M6CFbZwu&-Hb3D>mTUJhnJEiz$ z7{-zAVYi2goCvV|w?jZtv8DWOUFTc5AJvS*1U!mHack(;f?ODbuQ7h3524kECH9`i zh)A)AU+6xss9`lP5+>XE8WJs3Z;`^BQ#&=wEbSuQ#_#~`l<62dM8$-*H~z#8N)(36 z6j2?T!~O6|Mrv&rN~IR%S&v3n&%L}-rt?`66v5W?9pL${W}GEO8h;)3hWZ9gk$74X zYyXyTzS9Um@^te%l#I7JZq=qgmoV<7o3BGNx8+SGGB{w2U@7Qv-bBL$Hfid@kQFzX zP0)#N_*~4{)JimEifJPOgE&F@uMdFsJ&C8>1d*)Kii{HE%s^gr-gbA6B(BcrDyvja z=L5r_8~4ZUsgqRLp&Nb^{R)?-1a_zc0DPpq$aL*1_izC)E-8Up3c_X|EHl4xWca*oC)A~g3}SsKT-&U-k@*^*L589b3Y`rwJqgowV_W|N0^-o`qwKX@VcC{`H(8~t z>cs9O3Cmu4jf-ien)k3;Ahw;aiS zxj|eRj1!P(!vp=!z+vJ+RIhj2LBMx4gpQ0|>J7PUyT9&s#I);S37r&Qz2x0p%__}) zhU-&8TR|3x4yGX|EgDie)G+14_AGfB>2)MgMT z8NOaD_Dv|wA1%Y^-||fKmIf*{jBuSNmEi6)8fDxg=qgPRi-biG3pF*0u{9R5i#2q0 z2p$^#W0$OG72@phN&D=w-qg^#zv--HMRz06B}MM-eP&Tu=w5QxhspuvmLi5j--J1j z&BHZ{%>j8`Cqq_$-6#&(8@^Lr9#f|zjDl>{AskZ=`#xWx?x4I>vg`2=#vzPk9Og`z zN{r+gnME6H@HjSh@1}IECOJ))ar$df=#tMwXib|d0iz-$zT#mM_mD~1cw?{CLDn%4 zo}tseRWwZo!Hs}1FMe7ihCdyc_MEe|*qC>d#!Yd4)yFY3K>%wned)q_;h)9lMhox$ z18D`ZKV-fe?5ts2YU4cxIZJI!rXWf!-*$7FO=}~_XR8IpN{#m=YcDNSTM%1}MauIc zVX|SGQ&r2cHiQr=@y8@(fp%Sj`Ln(7`k3uHgqaNJL`_SW@hP)E!6+}l_V;dhy=GN! zrfehrvIoh$+E@JyP%1Tl)kgur@OrQuRPYFT*Cl}h4AjFx0l4|0K)rQ))c{-={i)gF zH;Jt{F_nDy!7RKj(1%Ur`uB5zrNNe>iIO$+Lq|S{E71n!G zb0>rPw|^t5@t9|;Q+<7;L??e&yA*i!J{ihC6i~Q|n`+*1eaKeL@GnWxU}i~K@0p6%!07ij3#QwW$v7}jrg%OabwmKBzC!IfjegNZ{ac`Alu8`mOV zk$EMCW79d5@PKY^oVRO(6}CxM0?J~?F{Nyi9u%jt8gq>T;85Z~9w+DMgrMG(XV?#9 zTmm?zq@a+7j_E;!oMVNA^WdNTB(985Wwf|@A{mFeP^_$We)d!McWn1)c1Ur zpe^Tc(?aFGLXEQsf;((twBLH^<^o%bvukxH`k6%qwGjNV^8_l=QTXqF-o%Rm4efs9 zzOO95ijlaL4tFm_rqZSyh_>_r%;VJ~wNNN9c`syWn^eL9f_^frqhp0kfM!~E*h-I_? zNls#q-);1eWId7f{6{>wnJUq3M)S5=>1O1Z07CrcZtm3A=4gQero^TK=!Z5{xHW*C zwiozY6nRvEz~eOjZAt9|=BPV(-uL2ry3{AdmTT|VAAvcQ{Z%o?u}(TgyzkWXEqNU0XIw->91|5^j+4Qo+Dno-(>rJ4AX>;ZQI!` ztNws&r)=!sqo0DQn2Z%xDzo6E7Pqonc!UuZS_b**WnC3e6ICYp90&de=E2hHLH;Fl z5$Cei{7iC>dz`IBEr_V#ImpN6`zc@|h$`&-`X!s7lSX*In-Gei!H^5vwPmWXq6>{? z?_ab`aH%WQ35516Ee}=-RsGjwB!%=nAL0b>M5O+387ZjpZNM}CKvF+DxlE?Gg5N-y zcbv~V&yaWIn>^G#BK_p?K$vl)OF~faIM%5e-ydyfvhp}W#kPT%QhiE3mCQ@vhY~UC z^?F*>$UEI{gSmF@>n`RbJ`H?&3%Hx8LQ8rz$5D<@vi-UXweR5nqU){0qWYr7UulMB z$f3I%6p$`yNeMwZL^`CKp}Rr4MUX~Dq+{rAq)R$PLh>H`zQ6am@!Y>=&ps>mo-?!0 zoV7lCom>^h#pIDApQ;!cHPnfBW4Y|>5bwGLzp+%OXt9OLwqM@8i^=6spDL)q;egeZ zm~I#UrG@KlF8k(uvQ5cG?g0_C*uqjRbJou*LkM6^wd-E}pU5>}iOT1nCFjEdLttWD znMhM_9~=`-MUky-K>L|~Ww>u&my!wwBH)McqCqF=YaCBkQQ(FrB^ zIk2c_>Kyur9RufA34YrqNBgl&@&C|cCvTNoO6`A`_|sGQLd_VDzqxdXfWM_8`)~85 zWpk)iTAa*Bt!yZn&A^h>Bdf^&lygj^_I$XczE96-!8f4PZTk6;COo%#>@=}HG6p8utK01D`M4{a9e zLGeEGxzR~Kzze-C_cZbA?UVF*f{3Q>{)31%_5DO=W87ucL@X2+&*k7O`7X<5mqwtP2x8J1!-ljvNhiTtUEhxy8|0{;$jOR0MD*7faveCG z2)Yi8yIfmEa;5FdoVTA;qhCdmWoi!nm;l~-A}u6pR9N}MxMn+3MzpVASI{I;CYtCl zvJN&i{ch(wnehXi87)f-duk=QUHd<jkJCWXW}n(L%Tet76i=5& zBwI%h9{lq5`#dms=jtk2sE?YJTALUTiOZ+RWz>6tIx$I$J5G*}6q>n6cRfhe=hVN> zjlYFdBSdiA4zQfBa7FJldMC{%{{i^uhkG3Erht80iIHhF z7@EOdl^%K!QnHyrmDSHW$7SWGIY%{omSyFsS&VYS-YbKTgO$3O&xr#tN@yxB=-!Ie z8WiQd`l6f2^X(uR*sLlmQHiDgm7^h6bIbh`#_9qNyO#T>x8LUNC(+SK0t2_6 z+`Ki;{9{yQ%_N3tKZb~D!A)UTX7NM)(%1>zo?FxtJorFl``#zjiRCuN1L*lLl=A*o z{W4i`EV%r@oQ(9H!oF-0PyLeqd!O~rWcABxJ(-^sP??2*PTGdnEor(L>lW$vKD7;D z-$;VaTQ%Cjr^L!K0?xSP3fix z?CiXsqU>e5S*Wi~Ux-G?Iv2fMU>MIqRi zdQTiz(~ay+>W_`+z@P&4R>$UwL1uCDMCqdL^nJt*(PYh|3yS4_uaD1PUV4P+`$w+(s?OTdF6NT5a+s!>=QeI zLxh!Qte)OW;oWE}f=x&O75$cs4V@W_kGG9t590HH8z)v6PwfXG2itXc^se`Wom?`d~aip$QP z_U0)Rwi2W9Da^;}Vnvl98^NGwniSf-v{5H~E4*7myDQtJqQX4?`4E_B;%yb8JZft& z?94>3SJXFDy@>VjD?0HA8n|cLH1TzT)%L~sH0_Q892{2dT5QEy2<+)(1>IX^uEk78 zNWC$*w*WYb8gqc7@EOXups|~isw_+JyzuNaYw)J5(V8YoqW+e{dy*!5Hz@REN?$s-UMZs65LraT7%69-4CIandwG|j z+t}<}Kqb|U$O?nwbSk{HDQoNMHLxad1B%4wtUhgpO$r6wfHZ zuQ5mm20v1JC9(R$wJ{7B6olhNM6Fac`qjR;7As?5EJ_&H)SnN04wvhu#7$ii*!&xu z$cSUUgpY}P-mmC86vG`J`{Ol`3coe;3*XAw+-cqTN|~atqgo#c-J=|LNA)MC|DM28 z3vw0a7_S79!x0&7|0g;87RP+LJ|lyzHVt0sX3Ri_pp~Ztj*ct`#|8aG`H_*)mCuaN z)xL&Dp!M65m-kI!BGpB?Or0UtaEx_CBx{d580nnIRz)T8J-W*J*bw4@$~KTmL(iD- zXD-O?O(R4UOSCYQu~RJQo_cW__Vp(i6mEYP>}RKFI-cC00J*|5(7fIUQiFiVdQZJd z%UTiXRBzI-Cv-k32~*3eXN7{f;>k|iOG*WBF73Bsrwv8DULa#*|6MN$G6tx-(AvhJ z|A^;gwfN{Q)&VwC#-Pl#TtlIjgBfxR#3)B_vS#wgy*gBN#@k=e5yLcbD?+c5R`F1B zphR%~NW|;9+Q~C|E|(9N2|(H%=94VEqZ8ccfQLk1?b}q3l3wtftVJaASQ?&k>&_3} zIny7HU=l3X%6A!l1QLWr7aJeWw)!ekndBX>IfRs%#`wTHp9jqc+@f6z{5*OLaXR6j zJz~(T_tMR$MRZd6E9v;-Dh44siJ-nW+gKI-F`Hjp!rp9=e|xj7QZbkbNPK0pe*0#$ z;Y+qZ1Y&CVX0#?sMd&MAnei(oQr&<0IDnjP>hK%u_0rJw;|z-0t2rH*imza7uCHpA1NaVa^^Qh;1>c=Ge~VO8TTD9J%eh+mwq_23%}{KUiPB~CwEx|j z3OVQDDp%U#QNI3@4gK`H7|XwNH!L=eOE59+45xA!7o4Vrkz>jep8G_*?Ne&KW|}Cn zZ+aNW2#N20L3hza*U8CkC#q72HpIDm-Da|cdz6D~0xeLTvjqvhG@3@CPTpO>#wRGJ zN~<^Vu}~5vi;9)yUN6hU*;mk)Mk_l?=1Ja{x|+%Kj1#AwC=gnQ6RD@KsuWs#FvPUY z!@~J8yAr+}_70VjsC-PcfoFQ-e7oOo#L;Z^e#cyv+Zp{*LUDQDJoGSqKB zu7fx>g=%=~b8svi=TToI&hx;ry!BnM%%3v#*mlDO%=G$DMl8GG{4yl1E>0Xf*#eIx zJQIrf3@J6Vx|r^c9s8;n?;U+fbumn+w3;Xg$Vuwc5PENrBsha|QM!QHcycrV0yM>* z8;U@%qF$2mQ1KK6Z49wsf3*hl5Z+!SvlN`&llZeN;8_Xq%-0rT9i+Y&X)Fn6^dv@4 z1x}kYW-f|!40A4WwVoKJinMY%w~!|>PkJs4%%B$x2p<5301d#92%y26>j`c#yWmg< zH4Vjh0DjrT#C~IvmR}t9sDJ(gBo;dBC1HPhl4&-Jsznwq?8HBS4-h>v;xV#vhb4fB z2Q|@4u}oE_;XCga)I_hufQ%;DPLXsu^Z6JMPl^8m@E8ByaL^R z2g-Ctrs8bKUVM+fy)UVWB8MgTpE^>!`La}ChW}dbzz!C1w&%(_d5+iF@fi3yBl4k| z@yz*wJD|E5JvB}W7sahg$o}1by zgH+(Ms;FAi-)aPgIm^Ds!zjXKwf&i@>wz@>r3mTY5&`9={_>JmljULUffk$W0n$}d zdC??H+eiGLwcslnL(Nut^J$_#G@>D<_JbNLBr%tP_!(L43LRr5*~HSiB=5&S^&+q5 zcwvLDD6gL3*U!Nx!g;Enene-7Qi^+PhI+sA$2xegu&Ig37Ogvu1K@uycpLP9RHXM z-`?FOX6b|N(mXf$1l2qOJUxcQQ5640A#egrDPHH&R`LfiO)RG>h6_}aen3|Z(03tB zwYjM4c~LKr!vRSi6ARVDWoj%=fO!_hOV{P_y3P)dgdK;37_ukp1 z>9!P;tCx!XB*U{3TfhMBqGkhm4h9CrH}{%Qq55ME3PN_+=&L~4*cP*8GWAFYWb|sI zwE0(oq8D<721s3%eLe^voc8B5E#7qv0JiiMfoWF60iDMV8%u1s>}w$RydySpR-UL& z-=QAkOA@PGG3K-S^_b1WjK~W&3nf_30;Ujb5(;$Lrj3Rf z*JM%hGcNN!*~-LWCbjOf!^`=}Xt)8G0K@__Kb&Mx@;By=hVjSMo9lArQu6cXP!40% z=TZ)TkyV3c5OZUC&JDsY>X6+_B+qZuiBDU`VHa%*b{$(_ivh1CHV!X$Vx}c;_b-e| zMN_$b!dc1L)~3>~?tiS=CRU;sF0*^Cj3GcyYVV>!P{|Yi5Cgdc{{DF!j%Aps-Bv?S z=JO(ZZtB1LJ*GPEj%Bo~{wRW40}Zn=hX`2jLk#G=;nBN$Hm_C|5H|Ryj8nzDhYG5<{}C6D6zc`aLhe~T=svYOvV7<6L1f@Yi7vnp{N`?3K!V-}4y;;6jIT%ui|lLw zmwQKNsm?#Zn$1D26ODwXRg3jvi%9^`!|K%Z1qRNk<@zpaY&p~2YWo3r$B@MaDftme|v>@oUb<* zrxJ*-jYstWc+~t<(DO~6alU}8xMa`?(CE!w#yg8Z;w0GF>$nNC&$o;Oq=Bf)lNuoL zud$K{1WLYJ0Rq9xl0!XieUd|jK74gdq-bwnMEs9bC$LJK0nr_T!@d9FD&ODd6X`q$ zFe{gn-NFpP`|SGA7?e7 zF-Rq1n?~{OoKnJHGxFo?a5eK17(%d0^=FPGJ-ziqNw=!!d0+dYC4YPFGH_ivl4>9J zRkE|@!Q{YOtx+|OaT;sG(1<*a!?0N{=6JOtQ52PpnOiIc#|3AiFSGl*HrbxoE*MeFE&kOs4|8ICpStkNb ziZrz~&n{?9#c*r#&S346q1$gd=mIyf9}bG1TZrDDtf<%E;aY}XlewbZ$Da1SOA3pR zHzPWZb{8O>lW=U{k<+ms)(VaPu_@T#IGyTem<{~uXZmdZ zKPIUEnRtS10Q5x9kK#qj>i_Z_fL7Vi1+rLR$u9cBe#qChh5b!||AT}WvO0Y8ZUP3u z4OmE=IrFft0Pq&Hiump@pxP-g2tQyD03Wjk@G+u(S^xiV%Q67B-1+_=xTRC)#N=Ws zOjFIjhzzzn2kzjel;`XdVW+d z?C!{;M|B)G0W76=*OmVTeV)h^GxgUMj|9fRM3SC(BLF7? zY)}F={ulJo{^tD)m`MIf8{s|OFISG2=a;qrZ$Jj2Z00et$q_NUv{*ZldHU?~e)A%v z$#F7~7NSgsN7hTvO4(UL>QV>e&iRG9C z0>Io!kwGbKCcbE|!WWCV^3$aS?3k274`BU)}-Sy~K0L_Wm1Kr7@e*7twG z3_WkSg`gFA_u`vV%rHOL4M@v2S}ku4Yki+O5>xFlj?u7Hkwx^LgraLkBGYMokAFqn z@LsDQuj*kU8dEK=7J8B7bm6K^lKViZ4D(J__q+j;&bp6VU7=-auoFOxwK=*d@eHtM z4gA5lLH0q{bp+$+#;Xwm+E3lQTJnHSiC*2Cn8x4eYI!``wj@tnVM_e7ADT_lVdX(S~- zV)1d*<*yUj7>D|Xj*KM8bBdHX2_5&Q<9#pM{Kvl?F<*noUH{mF>?otRYByBZ1$Xu* z9Sc+W975i96xop>>-J)69DXvr$aLydW$Qde##aFr`EK1Q^@4R=@n>AfAz>Q*-I&=F zzDg+n6|abuNgg<;O}x4sfGOxjXCam<;vWIU2^8OaDEyKbOm4{$mcOggjx$Aw^&zA* zQE#kYCDD1aTrx4AvZ8sd4?=5Mr%(s^^F4!Eq=F zH7%QPC7bV)X;i%Fo4f49&fW8r_?w!bo!xt$F)bvUL$&!PibF2u%brEI@|mAdAT7 zwlH|(^5CkMy?LLF7&|2(^`&>`eG?NYMO~W`EVtF{-J(zUGx4&?35>gedgPJ&pA6wi zyHk7IU}e3jfu!fKoAbG;x6TAy{jwg@7X5FUp4l7M$bR2==AcHx%o}|j7a^b87KDn0 zeeirj$gxIwMi=DEe506<%sr2g`*%H&#*{TEj`8iQR(g{Our@JU{ci2JwvhP~mr@`p zl;jSoFG*57xQs~*Iqtl|_0}2wp)YtdT^3W(eJTs`U>K&XZI$`W1wiyxG>HN+nVA5b zg4iaIULhSF53T679{5+E;u2?~bZY}!S-9hs2UaK?Y-@QiiC3ps=-dM2coNm$v#pI= zLvGdIA2b{8)&sv~>3Uy97J=mcXEthk30|w>fAqUV!lZvR;rd-hF%o{lP!VGflh%s- z==fVZg`!|Q7^p|_PBMT~gUxx%V9qHiMx1-hDa_i8Onw%;sM5+l}A1q;HO)-zkCv zZ1m&t3%5A0X1bDo!EIBu1ljM=C4P{q5BT8Sw z43l2_Bfo)IV$FeH@K4_9CYU~mUj2sT5UGsY3U5~9`T9E0dSICWZV19U_A1iNNy9`| zYLH(Gf>4ykp1Rby4Dp$usE$1TMbOVry?HfXh3`NHzF||sYV)&)>rnd<%GdL=hEI(>poe2qR#(W>U=xSg zj*B{@R_+W=#o0kZksz2Vs){jYmQM9E!HmzLKRY;;x~Z26h(fv)ramSzCdd? z`6g>gf|NXtuxLa6QhEq>Cbim2g%n?$E&l@&Yw^A;3G#b)D3x0RFUteEu%t=D}p5q6Meo1BTpq!Px zyhXc-1qvj;5uk{GdNb>tWMMzlA{MXHtm@B$L zIrrrB>9)w0?jh~XzwsopLq-Tss60&93Rgo-2YA<8e3sThdyQT2;KLl1fm=xiu@q<66t2HfK1M5#bmdO0j zOu$%!H-Cc{9!u-YkGVFwWmc#mL%((J!ZfZ z6yOzvs2c`KZYr`MVUjm3U3xYkOAx1xB%h~|QO#?srSIf~WhL06j6y>@_;l;DV+aT{ zhF%lh96zJfCtT54s?Ay zAQ?tA5c2C{F4pacr}n3|x83wSMdALPwK&ZFd#hq%SjPKP#5z(>QC5 z)5ghC=HfQ)FNEB9S!i*+7Z^tRbi&Q=Bgzh2>Qv~s zP|&J5hSEJPGi9@W06giCmnoy+@mgx5@M*KBX{-6=AYafIw9m~sx@n5qBRAS98MrzE zH0~iEQK~E7wR)(-={+sQz<`}NOP?Nwt&2Y>KGht<(C?;c!*vX*2o0%e8Q86e4NWtl6WkxUn_;ro7y{j{fFU((@-9p!)KI>qfv3<}^}!lQ|y>rwmtNa2LW2Qo-TAg=rjCwsfN z^=st7u1+fYc|+yEB^%<<^S`Tbvfu;@iVwTxhY%a|FwCOw{V>&=xh^b(LfU4=HgIc# zS0PmqmZD;rKqgiCM5o|S^>x8msp6Oa2Jv~tKjqOrhBkulO#UHtO-bPeVFAvm=QNIgsZR*TYwYarvUvCqAxI29zDQHgk&y00rRbR?}?%x|QuI6kozx0GdI-amN+f)}O$OE(Y8>ZoUgz)cfUQzI)FD(o9jxiu^Ar@^dg6((m zodl=~T1+sQz2Cfc=f)4<$s|s@?g;(OOQF^wthNjUCk4q+d>b>QCR3o_DT4!gzvc0U zaM*{6m)fv1P{gbAm3oR3ag9#4zK**_f`cNUe1&bfsWf)M*3<^A*2&b9EcaAW`f1qh-Y|A3;1O}An=)Hpd-r}1ROYxw^+OH z`IM;3njIv#3I2BsG@HZIH(%?t3TEq9k`XA;ivsl3vY1I&Es(Kgk$^g8if;SxRCF@p#0da5t4yiQrR{qQ-IvV~_f` zgzNK-I+_-$sKyCRkdC6!ZZ?#%&a*Sj;`C3DZuajU-}uvig72^*%D@{X`+$%ptGENy z>XS}U3Ks=Ul6;`oX&~FDzfr=mQo$?=U==IhzyDg878HEiO4n2a3V$P?%amx^ovramWxDhP87IlpYY4~( zA!BS{@qt#v3u2(4$v=po^n`+>O=L(t>}xwjYKrL z+a*{IG?+pk-{ZH?CstyZloPbMK(pDE!K4yLJp<1$-%-HHBvJWNZB>v669vBe8eTRg zeuh)Ygh{0mHQVVrgADeJ=6A@=4+)54AJy?COh5D%FgS_CgAugUXuI*ooQ(?uaL~IT zKb*zQ(M+fMH)vC`F0NvDsc>MRrRa@y0p%|7pK9NL>SL%SA?f2A(jGO&C)T`3j4J2C;4)^iI89A1hQw$HIn7uBr zeyvCsi;wtG7S03nmLC)Kq>_rZQNk;^G`WZN3kgTo3)S>>NaBc!^$o!*ycL+?rxP4p z#`AT}JiSRUr{a8-nqKYP0m7kuF#H6IlHqR=hg*U=-*NV1S<(6=BEkU0H4x5cwM@!f zLs28#$254xpp(F$HJx%KFEipICM!mgCW-+p5iJ7555~kpro!hWDw`g`TJQ_ZO}n~#JxI2LCCQ781now zi)9UTO_+tESe^xvUVY?dVy?#T~|-xCJ%_wx?wjCSJ^$n;7_kaeWsv58HZ>ft7v}u1`r4ZJ>#%|AS!1 z9sS$9R3DD>H~;VRQl)Q{DrqL@jGe~W7h2jBmT&k?YK7)Ejr^3bsfntgw?Lhx2mK zX)FJ{{MO~@Z3{hVZ@}Le3JXP(Sh{e1uyDVI;p7|%MN$W_OsD>XCQ^BX-X^3*c!o06 zfVmWs+N@e+zvW+w&(2{1$`HI%1Oh5rP$e>E z9T>kU0a+&)1(19i)s4GzhGZ1ItDT+sbu7mwtk$`KW;q>vY-&zE;%EWsi;XqE-hFi$ zYHv;uWp7Tw&Y~4(ACu=@Fb{`M1Y0mi*MtHRD0}df(+F~M6wH?x$fSZVfbTrHKHSv& z+}t0IQ`h}GlF~xn1}wT;+~5Wa)9}IROe{j945pU{VC}OTgfGtzoSvqaNzw=?8;Z#!QSy;zy8d1iz25SM9swZ>44%>pOUOftzY1y z*N)2{YV~$!-M?L>EFcsLzMVU-&TDLbYDG@BYUOzq?G^(U<*%|`^SU(#Nf23YtzjrP zX&=%Zs%HfOMs`7}EA*5U`?3nUN5*KEz9mef5#rXQoKc8QdCMq|T?a;RC8T}N3fX2v z#XF4u{K?mpoVK*%AtEgls-MR#u*?yYaO@7!A}ug)->Lzw+NK*;>YW(z2}-3bJ{G>i zv@bK$6UYII2bGEbHK3L}=p^`iZBhJ2R9!8a*N-6_h&@XyQ9FIKWYX>SLaG z#2t5v^C*K4jNrKQC?Bm~8gOSLQ14EvDE;Cx0r& zmdTbyQ!13<322;G??gzYY?rgq(LP|p%gC8DT}Dka>Vq7GYQIK{QHt|)vXF1WnQo8B zz9NNGzY_8=P~}Z5QU<-;D8(t#J4szdZ39pG3yCGgABH$Jb1cXijyE_QuMQDE{xh?) zB+X28Tg{%LibgBTI{pO%4z0x!(OKM+#3UFZFBU1Rd{Kyd_=f?f#dTMaLRx{a2)QV? z2g%IV`=3L}r#~b>2Le=^dr)X!vFcqVvok|}_sj0H5S#-nEgbxmyup;Im-GdOcDdwo z*3ab$T?i$r`Qy$FahBZDyg7J7?Q)d~Y1#3evCj>=&<9#ZVWD1CggL*!uM~DJFfY#y z&8GVWMy@f=v%AsvT3&nhdikqKRJYfRocr8(<(x)6^)GN-=yhQ%h^F&M>(H(9jD^-) z7zM1m<|?03W&wsGnBBunbB6-^IYzDl`H+8h`n*P^pl(Li6g%G?NmftGuKBER6IrCq z9z8odspvGIJ=uvoazuPS5wiGoh#)kdh@MOQ+dgI;p9oDi#w1edOtV>Bul>-%OT0+B z9@GTnrlxQOEZSOYhGE{&VX7`EXdEH}Dxif2zU{-jyiDNPu~wnQV;`WRRiGsfo zvWILiH?kJPQrwQlGOF2x%Zxnp%yx!ZN6oCn?yU)bX`pls%MVX!CvucuK3#{1o+LSzHSBs_1UvZYJ_bG zAI-%8Ch{4Hq8hO}x*Kc8De#h3pn6Zli%J;$yt9{}?hTU}?3*Wth6Pz;9(^g`G2G@n zfuKU>Yb5JRtx6n!ae}ZdtDM>#1IHMq+`IZe<+8lioFz4`vzYFqZ^677c(M86*41A>bBH1%mgWkht#;G^i@Dy5%obtu~T3jw=| z$h4`kV5&}iL*I8yA@<`2j+ZB740QBeXn^i9vwFA)3H*fo)k`TVa3n6Ic_VY^(IX?M*3kh8+{qD+bs|Q0 z3>r5=bRMNc3JC?qKQSRa$9>rwpb>d8&o3XPV#4HKv3UBlOShz~2=XoFwX<0@@Ar7L zZ_g>yAiFBIJA^%6v_CMfURJk1Tp4fQ{0(^gq=r;X*y56nOL>Mw{L=a|5645(@y|Lw z#!|CG%DqM5@?9t&6>%wS?j~2I^Wgh?1Me-Gh_`}P-Liq8kkRpHY9OLpEQfBeU|3)j zOkLJEjA!PSU!{pCg0#@yy>fa-FXdiZMv>Z2Ms~*WE&`vh_AM*kWd0pP=|}<;Zdyu-K8hOk?Ql#AK`=27ne~|*+8lz8 zGl|jFv6CgSOb99#1{w~DsX)i6Cm!RbJWboq8Fq!R&IZBYE-8vA_P$!z4T|39riv+k zqpH`?uSC!>ch|^>#oZ2PCtI z>5*o@!+F%0Ayuu{$$#qQoj#HycAVY$E2&Yo#Kqq9j7=A!JG|N>^%h!>oc)P&%-J9> zt&ny$ER^y7_>o-gRUVFEf*C3qyRDo|S~!l6g=^tB4+<8Vmh;1l&--i*u43T9Y&j7m@3@w)_+@Bwt5hx{@>KV}92ip3;PuwS-$n*f$9*TRT*Irw z_Q5VBk>u#|-_)}-+$I+sa+XFQE+zGpv5kv<-Bn*S@~1PzJZS@G#r`criv>_l4+V|? zJi{Bb$`ZUO$cxWGaU`0AsGggbt9nl`wc#s{5QOCq)~3RXLvj_KEpYcW?^(ovVa1L3 zZ$)D`LKS1(*@Va!VM^~v2L;Rk=&>r~b~F0NBZNF(onPE}l_E})6^RwH8ow|8zJ7b) zO2MkveGE#10&W`lsJ6k+ig(5-%3q>cqw!8q5v4(z5|3Em3mvC3Y!^GHkLcC4{$=y& zGY!7B&lS!heI~WnzH%#%@Uc&^I@KY;(I4T1zs5mMQpbh|{B0WN0;OS0&k56DvOTVA z&f@+xUHwbZbL+vFS0vMKl+dSX+qIa34bguQGZ;Q6{*!_j{j8KAk%SRZttp%*J(-;^ zO|Ztq1=oS1S{2m&^==_<2HT8hOol=UwtwlHXhUeWt~JHAblv7`y57e^H1`8a%QgeE zk>2=%VAvr-fTP(Zqti}>mWVEI-9@B4_hW5g(Vs56PNcIU@nT0#tW(6P%f!KXV|KYj z$B@pWrUCB?T(h8EOZED1fh40DIpx%I~zxT@Ti3rHeFqJ!T$<}?Neb+VP!2-uWF z{g-kT!L^nUX8|)09=KZKI581^z>tgVQy05n-js?g zftWk4r@jC#+nXZ}>LO&8+vK?PD?$|1q=llh=aEG@sTU z-txnyU0=87R2N8#W#PEE8{}*hOdSMSkfP1se`6cZq-#r!-qU&(eGckaNoJMFYt{#S zsnN86QENmK6BD-QT}~ZpmBw8!n5$*Ny*^xR3UznxA-D0>k22m9OX@*4hU{cD7Ut zLteVvf#)TYBa-a+XT90XE~*I0FTTZXWjJ!U#A+zS4Zuw16_affAn(8S)&iGi2mNoY?g1R}$)4Jt&Fg}U?uHHA+wHoavE^f%d z#z0-HhU~Y_f$6kCK8UUod4652OK>F%P%nktAepT!WEzZ*yMkL57decSWZ8B``?KNI z-_U$}mY*y^Y1ONeHY%N|;+t%03g+vdc4St;! zX#z!rhFS!(+!2kV`%V+nDtd372exM2l_H_rAQ)b}nu75p-JjrX(DZe{!gWnzSfBjm zJ3TybDQ3od^g_na>a+dAWT%4Av9z!7h4}{A4ku$@7iF|q++WM&D6tl+^RE;>R*B?EF zEBdH?RqwD9EmV)uoCp0eLkwmj>i7atp5}Kj$Lq0n0TVNPE*^9@U&$opF3b=DDi_d_ z`w^_jCAO_b4;m{?ycQ#eOArnC8qzP->&oWuW3tixE31UO)WP7Z2gO_(X`6YLZMw}J zK}Jj1h_*?u?U)kDM?4^P*r``B#4td@p_#7m$+u`hiNV+W)$>L)5*R`3EiY%*zd>!k zdOSf7MM~L3<>s__9MOB*dASxouAq$XQh{;t&KA|+bBT*H&R`7C`#e%|fAM@jqyo&XX&&|bc$@tptxRe23z1l=V>5F( zOHY;RJFCMK(|O_7+gAh?e0GGI{`~HPrx`|nM}*kA&Aqk-*C|s?VOsud?Rk2FlqH|} zD7?Ww9!44v;=xW$5ACpv5jlg7a19965PLgl>@$|D00OYc#1EeC8vVWR`GUnB znz{;=*A5GUyawzMrJ5dzy$Oq@8?4dP`>X0HZ|P}QeaF;N$QQ%6TVTy73N*f~7u+!| z74cOPz6sN~5lvZzT5E@e5?Ev@cmjid68Dw2)cb|N-kx`@9`GIAK1g~dh_T?UvD!{9`V26bW|_7 z>z`6;F4`&}JW6;|2)rx{UzDrh4|Jn5*f99Y516mKo<>igcgff)Xao<)puc$dJ=}@^ zQ<)3`9OL4)@ij{nO)>G~FWNFKVsr@u&N7=9bOK3Yba9AYzN1zhsj=nQ3h$1VQp&&m z%l%3PzLEdqZvx8e`INrVrn^$(pRFj;gZ-x!qRRe-kFJilb9+c{(Rz>eO}39|(jX{f zIec~*x=o|f{6BDJ@Ashb{Ff>da#y?s5z$|?uB)UQc1i-_DjkF z!y@QYf8=j0phkdKCj(CENc4>sD;EL*Su=-ei!(cExQ(-iQ)C3K+(_|TRY8^QFdtfp zJW|I4EWsMQ)FSgCGFEQS5v+DF&vMprhNiWqm<<|GJp`yoI{5{%iJrhKrHqVqkNw)v zsaaMn&{c?(WGx$C+1E5nL7LW-*ZeQs!gTUO?PuAp$+!|V1!Z6vThdLa&45XIyNZ4K zsTNi@8q=Odofo>Y)gEt?$|^8nVp>_Bs7S%3{SlV#KsbCCI98kFq5fhAtJA0#lzA%4 zFPyEkp1SbT!QZwsGx4h_QQbZ*|^HAwR4S$l!g_SrzYt_NRD+uiKeowp-Any1@CCa2O1e)b2FJG602FVRrFM-+1hVZ&vc zmeSQdf>NLidu2Wm{hv%^>+xH~H@i8C7oJc7ZBw-0~e)7R&qU7Dp7 zsj0*JR5MCWHA@VvdG}?u6l*<_gP#|0$X~1jvpKZVJ8>4IAJi;_udX=iJ*5ON91omm z;&kKK!`G9J@K{VbJdp3F8F4|qg9@qqa^epHc2_Vh7P%{wQ6D!=hjxAo3J(m}qw6si zP|Q#3aNi>=ru%hm)+z*i>|CZEbxe4Jb%F(&`|l7`d5LxQ$RiBuvBVlk@8;@>)~v-6 z`rmt#n$a9uGn{qzL&6_7IkfA<9vGHvD-iLsS}jQ`)^@GK9YD@@iPcTOWaKIzmV@Z> zac^hsnOpcOYv9i@K!MUDYMk(smtY0!Ra&OJFs}%c63VP%#uuzlAXWu(N1vq9%?E1& zi3)i0?Q8xG8t&ooU0E+& z5d}p|`-jn0=j+ColS!0$yv6th%OH^Lw!&}@Rqojf$)6?+HfP7_Hjcqs!|2`?pk+T|Rkg&gK( zh)AX#?>-xnVjt&Mst2ESUFUr+KNsT4#mj+qLzyArtOw|gnTNay5a-k{B^!0Qo~<(Ce)ax!Ho z!Ex}nfQ*OkCTB$8cV#c%E&P zJOm*OOR=L-MSN491qbt7?a63DGW5jH4k*tg6`gb{c-f7ya4T%K~Sl zvszVN49rCv{HTGQyM2c3rt2_nKrya68tt2PSTt{oL*aKn^if>Vc>J+xppMG6&noyu?B5zF^V{KUSmYtn6W-d41>W?kPRr07GR z9i2%URV?RIrx``hd+@pY?n%uFMxj%E9nL=>mlN>uVbhYG6U1QU=AJ*e!7dD=YW9QE z@80O}PF%#&eQFi6OgVPDjWHO%FtB;u^aw9}Qo7aoFn$qhM!6hZ>Ei@3KAin9y)M1uzj4udE75ZoPt6I_D31&4tIcXuBM?(XjH z5-hm8>)-_2dEf85d-qmt-KuZ*Zr#78&p9nqBj@RJy8G8R@f5zy>ctp-Xq*=sGUmh` z%7~2agx9Y;^cmC~i%1TDOce@4p?q^RMGmbv=owKhiOQMB9y0-vFcOV$qZuO}FVfg{ zFE0%cj{c8I)vQvs6VTgaGjd(_5PjplknKI83t!;EWX@y^qYm(sxi8sL_t$hyZRGM@3i6(a_9Lhh=3$Q!WPURUSL@S#Dqw|6>MJ>N zw+`eJ{^yHr$X{nz{~j(h;4rcd9K^i(R(Og{H~IG?jAD^T!UE{ z$;1m+dhF~VIlyfyBX%|w5H3`6>LFv81Kc7DqI!6y!!;ub%IE4(f@XY(s;q?Q-oUof z4>`sm(W89*t9;6dB#9Xh&K6bSr!7O`NBMfj)pK~}Q}Jx;ANS-VMII*P`gKf!B{vp+ z#|cFOxd})mC>u5+aq*>07o%l306&Q8rTXW$e#-Y>-)=R6r1f_TAz5!QF8bbxfw6=; zxmX@a;I}8Asi)oGp(n-HgSS`V2VJ-X9QUYlvqSE@h-vtG_^lsgM?c737T*58ZBb5` z6*zPUH{!47!te(4iod7c39pGJi)8;e2akq%qr?Qtd>S;Aq(2V}lk5*9AD2TASj=zP=f{3iBXXFlV`k|9(tO0G@@dvDT@%Oc7`RNcH0 z8t+hWY)51*O(nDXPN-2h3sg&6t&Fez7pK#Vgxh1NQI^jk&)&HACky>02~uvlpzAeh zT7bW|3!wpl{9ex~`3B2_XUJo)%O4yj+$&j@(sTkGaapQWmVMiRW()2m9pE9Vx0A0L z`?miy%*WqNQD9gkByOz?;Fa{sPdb)u#7Ze*E9D1LMSj-pQ8AI2-oTasLLm%LG8SX( z<)Bi>2iW!;4;=Ouj^_`Mz;0Uy)#k*;k(sAS1JYI$ejU%QMB^Fp%u!sgV*{Vti8?Zc z06Whn6%;*`K*Pvk|FG`9%au&G9J#w10pRcmA+ubV_{j$}@q_nL&7*6Fa~BW-0UacE zxvbt#;*VZR`G8G+oCVGTjuaE|ug%Awd-N|ecFwozJ0a4yaEeI^QMrQfuX=llxulF3 zX0TE77aZQ30VsYEpewuh53kQoiu#nvS5MjBZYVv0f0$EX&jv^G6+4ucx2rj>Zsn${ z#JY)P?(R6w{O8|TQRKe2;(7b!9c_m$l69N8YSSIwec1IT7XhH1$G+wkhx~vvwzQB>~UU?}I4cf^xvx^Cj;j>+SC^R$$|m+v^|8(IfGB=?gd4?hI72)y2RHAyqp%;kWC zDZ^e*Za(bE5c_H*(3Lh{rR+oDtsP98>F-dS+}9x9uSpC>cLj+g?`n4!Y}k8Vf1oP> zl^#UKIVi~`Xy?4i!c_r=+2dHrsI#XAZK8_Qq_YR$FYxfNwL$MF5U&yKtb!;bMFMxj zjmN=2?Td%~N+p!xdqq{8K@%4+x1A$>^ECfQ7iZlmioxK99D+93HP2{l7{Dnw2yJTHs57h?vQxkdX`3F4#fY4&Rax1bo2X0at5U~;^? z{?A#9sWiCF6Mwwf_U(N)sn!;f;Vg3$G$p0+&sB!Whh*T~UKnVcU1FV?6pvtg# zx9tNQm9fdIdH#e0pIlAA7&Ht`RJ38a3v^!Cbc)XmSk#MH&>`-`Ym@l*Z|B)mx%byj zZ!A%T8GS4p`nlF5HIYe}<|KzcAEwgac})3-u9gDA*wHC!`x|Spk?RiWC>$-p@%rN1 zKHar}L&Lt!a|SSQ^JN3BI%vVq|;eQDssP5P}C}mi!;g3|G*A2U_q}98|HB} zZKQ(X-XfCNRqv2acfgG!4;iMz_A$YVOYEg^7*rMyE^!R+Cq%*`gmd8~Y`GLk9qwm- z=r#GA7?*`bFw0Mc<6{yBHro!=0mtcFLze`{hA{!b zzq1v!(8T7LQh!NHS2JN7WKMv2xDKbI;J)Nobb{hAzlf$pnCyr%;D{o&%s^V%%zL9~ zQ)*p`0v)BoeECxnzP|Rv3jM(dq6BztQ7Z@kUHZ{wqM;I7Wtq;wDiE&nvuWnu6h-%E z_JffgRlDDbLT?oOJ~^?EeS7P*Xd(+WtUyw$!hISvb~?=AYSjZ1AP((W0&C{A<>b(g zTwoJ96X#$gf)?-h2PY^fK*tJ;B`6=;6CG7~;=ElIX(Is}9?8PvXuRX=GtHC3VD2&A zhf0aIw4~7HRo#oUJeQy0N1y$dP&}F~);O5i&B*0A|tjTXk7QQWr#sXcY z%teJp7Sg8bE)>b}XO#DLFr2N`+nUi$F@~aimRD7Q^+$Min=p?Fi zM0s+wpW86Pg0%Lg3DmM$d)Ril%)@-VBjis&ERa2e6&jyQUnos3AAU4w`*PFCWF+$2 zXe?yLTrzJH2YI1upi(+~(xyG^+6r79?d#nzt7yT>gw&7GDk~ zmZINs<4k%+s`AD0l5iRoAKs20=SA-^hI&Txmq-?_fdv+fPyXHh*uaoyqvc$xP#^SB zdHk$MWpoLh?(HqhZw{G@$QngcpUSTM^QmF+ThQ4eK?@&LqV3}m*w4-Ry$h12sdN=q zg67v9jx+)Ee5l-P*-B`eb#jzRfCvXvp?3$vF$oulZDiIy4GE*1mIqxm;+gRwq z_%^eV#r8g-Ja_}CAmWmRd(tv5l-eK2+?;Uv1|r6|9RJZAP@6^`R_My7C=zamzqY#^0I)=3AJP;9YpR zN$_uB<6Y?GZp#Y}v^u|2hU`aVm0I{1tF=dohCBB%0@pzRh^8kcgEAzTCM(>zU*J>7 zcGQ|1a2ffc*p*%a@50IBUlVmW;PYR|zo53Z@y;Uiwm*yYEAM%lsj z0;qnmC%*`DmF zW##L`1y0#>39gXk7!Mhe4C5{f^NuUY@Gk~vzQz{MWfBf^Nk5?R`(X(YH^(+vG+Y7t z@-M6=Pm*E|LG<>Is)kJWl)CZ{+;fp zt0AAP#bpO5U!d&&HD9pPJqln_)@k|l{Xi^^H-b-d@Ky8KBR=OenF?3IfP~NiwwjmH1whT1&`mrZXVQR|fuc2#>cdlwpBR z`szAX`c2xcCt=rJCC7&}K<3XnccVVeXjI4-!ZB_;Eu4CM?(-_bh<4zL{SgJHw4X1r zb=zIojxI7iB&dQ=G%lFt_eOQ)F^z|bIgMvDB0A=3pA#7u-uaR{p$L#`dbdQ5H_|~e zApqdfq+neTDjX%4NauW`OspeoJMt}j9@!Ij)hJTAv3&(tyx4A}Mx03&Jf>OS!LeAY z&yt05(#$=7E7AEoc~bu4QuP%MMRRwFeej^=aQIm@u=fHh+^p)y>Wce{^1|)6N1TA* zGqUO)eai<8T+Y1`07?bM)FUp7qDE{aEBsmwVpvRExeB3_a$Su;6*UEoIlZ9qH=%gj zOVksZdyq*{^@rl_jo~O6KQW5P2LuL5!|u2Q3446QpNkF|%Ctd@0JJqsit z-rtzD4Gp`j&|%{XkZXKET%g!=o=JgkR{p8|C9sxgkEPChUp|k>0gF+hf28tNFW`g_ zVk~wSo5bnRx`mB=-HYT8gh(7bMVHHanQ)Pkff0t4-X! zk$9*gqTac?yX@$t2KM(K!;BXe+{i1{?*p1&gQj=AvJ}7ID(ITQo&&U*$%Sa@xX}n@ zhU>4XbeD)klaVaasVNXGVes?S=?GWEmYyd>RcVYhcT<@>aDR15;OWqnDv2R}tTMiT zB5}dU4HsmpQlZs_zJ_a*;8ZFPkj<6NA~zKq(@Ut?cm=B+N9KipKt51N#s=6w(orC zhR|5wicK~ttI)kTgqgR{WLqXN=t$EWjVMW2Yc|<8-qw^Ah?LHoQ>@IR!uEio7Xpl9 z2}%)CkLlr}V8nvp8U>y`RLOMvV~(`Ho|<5+GJ zGpnrZuiTDNopC}bPa-sfV8=h^B}cPAT?zS1wkQew0K=${_ zIxsCfyn2Ye=#p+WPXDkG-AB5GO>4pH8&jeGsf=Sie{Hr_C77pc>~|Gb^Luh+D|&?K7^rBlFm#-m6O>cbd`yk<0DU-mR{%GwoQ7{;#9^{thQV|=oq4{K5v78TkqA05{9va1^HkU2rdZdX8}qaWa*=4f;@TvNW443aYr@gu@Dz zmlu7>a=^V58?(T+<7LIEdl`Q{k%OMsyB9+OBXlL$wmu8UU(m3*=lfPqFF($rnlW)X zuOHuL0bA>3h}k4o-f6*abFR4$S+~m6aIZm7K%N*ubJ6#-krb#JZQCzlA;x7I@J4jj zzq**?9NL8;N~?bop|8_SJ_Zy!u0FlMTJREk{m+igYOvs~qpZf@^v%+LuH~-3cJ_16 z7o6VRQ&SAuHy5B;8(C}kLtf$U`fGlgk(?_M$Zjp)BHPk=w6ZanN#+!sAcR2E)5kwT z)j+uhGlY{WBX?eqH(!1nx%U{+MKI=prVi;nAbj&OH~^0;4!MUdpFev{(Zh&wO$)5w zk*}S;nwa++HK=c@UBC#5~F@dEz@OT?!l{C_JM)F;XI& z;SwKQ3LAE6Sc8eX9{u;kQ!%i~WYp?7)qDGx%rlw-#m#Yop2@O#04~v&XgOoVSps)i z+?xF@I^n-oZgUaYzT%!}NtYhh$Cos3DeieouSe-I438bO8xDG=P zy?+kr$vTbmJ&U40OK@U)9S1pD4uKw+k~J5xka5PKfZ?=Gk%5Z4Bk`9U89{}jiS!A& z6h^$81J*?(;oeivZ9dqwiLijt<(=0G+_j1my!#7xQXS`a4sVqM7Yoo}gOAwk-j6PY z=7E9e6hbRcsZW*-E%KbP8*;A5l{yx8PiY&8nuiD*udT@#w#@yE1H#fs(mYrJHO%DYf zv^x|R($E5E70OoJ);&#@(7@Sin&wkKz{av&0=J^m!@jJiR;Z~-3BPdb?3%-p`8c#hp#XKMQJS%#``|ksWDU?`Y z-vd0>TMiy)v9!9-o#WFd_1&2HwvcMexj||$A{-= zbGr+B8rmkS*o~GavwFcfw)|MPtsE!^b8#ElAz@5aahO_Y2jtl;ntz()(w@%_&#oDl z#g>=B;<+B|FHLqKJ)ud78=^u$iB_VsZ&cd6^ui3P!Zsa+e2ZY-M->=q(lQY|9x^LN zzDv@gPOSBoX1Ad)*z!%6AI9~t8UnPfQ#M76lJF9dVz39c-8}rpMVA9><$v5Q0gMK@ zMaGJjviyWkzeX7D?Ud)T(3C>o{<(qmqn%>VmEfy!U{YwZV>}ngcJtf5&2VtveT{c# zO(C!PXufzk@-_EhtX#25gx``H_O3eGL`Uv8c!M(Ejz~|%MMgL}+LF|uI_iRXL=pq% zyYxJ9-m2z7B+|&)X8adBHqbY8|C#n!TDC%}6aN~mpS)_a;=h?DhPd;$RU(*eOek?j zA8-91i38YEEg22#C$#DIomqsmE1}gUowfGT_A-o})n-`b5gLL1B_po{evV#OmW;PN zW}EWOL{&36Bq2^-?!t zJdHn5?+iXKvetY;M=7xvXrtWq{nW};exl33*518yJqvxM8 za1Spn1WR9l1=((Jcb!!-Ea00!kNdX}q< zkWn6*Ev$O$gItOjF@ zSIBh(7lu}M_zT!D_IF)@_Ug{(ngrX|O28`*vRsF95xtTqnnJ&r`-mB@A3qbCpUxYK!@WeDvdSAY*iAl@2*2SB7 za1~HBVng33X)#M0zUo|7ESx?IvnTg~x9TVZfIgiiV3}e|?>o4UfvWFwcN+V(ZzUCS zopZKz96VYAHZq`<22sCSfTs71+e&{!)2`pvXg3^tKPv#XB_1TdktkQsjO%{v;vUl) zsH?hHAdFP-?svg8YY#pyIBiX2_x>F( zV%m}L{QwHGwKUY(buFmIPh#=uyWuGbWD)CSJP!XO1N8x&5{~lz#Fbam91a2=kM?(f zGxgx!TA$vAEFG*yIVy%_9&9_dzqPlkr%ol*6l6blojk>Oq^%%9wt<1Yt(t?+ALjP+ z@oO=uSD|-bbO}jTVSz1Gr^J8Kp#Lq;UF)t?i&8vT((Dar6slUhmkZ1?6eu+wPFi?q zC!~b$o+Hi>!DKCTXePSM{44Z<%{E!kaduYo@|R+}ox=`xcm=L!Y66{A)4!*6;kim# zIc_jIpHZg?{Eq_)0BonhSRMV&sBum{OqZ*211!vsFV5ZDE7bh&_i86Kli<1B2Xo#S zPeA}%q3VFtlzOp3IpD<3DieC9mDwn@UbZ45-`o6z&w8J6h4S;l$ecy6{0OiXAt$fj zy=WL8cS9`Y;L-hLs{F1YLhVa@w^VzJ9z%B%-(O49F;{irdMD%%2S4bqQ5T;UP(`wi zS<1T^d5>zZ&mWnqry~(K1|Hv6$y-%tkCEtaKD6qc;kj~61*Zv_)O^wJEp%epv4Y-t z(iu%P%IYy%WLOJ-G}J)(V~lHU_JN{HxqMAD&Y6axETNIuPJJP79t(hvRk5bAa7zkJ zPZO6T;YTjpYgfKh+VAnu2Ly`Wl{W^HgChRA`j=1 zmxGMcASZB1p3S2=J>CIThKuVM%0ebG;tecPe?it75qe*)GUQEV9`E*f2{G~DhBJji z=1%M%F+t!`#jR?YLbV%p+t(}NM<|#t*ye_V7kq60yP+jrCBp$(hRd-#=bQPef4pr6 zjm({h5%mf%|6A8)wkfxC&rjeSVNx%PSSNHUZ)G^=-!*!P#8XM$Ikl3BW<+Wo zw=ei{kpb~hy4;i4Sd-bN#7zk*FHr+a1!L1nSZGBT6}IZT^iM@xqBAZ=9`N)K17Q|M>^V%eJ{8Xv5v| zU`%YO+emOMAwAHZx9(RMd5^g%1(mK@>oHDZQFGG!hbgJ>$PZ)W!Y~hX z0W%ihVtk-PqVIa1b~dgWYOe=KjJU7D{PJ9+*H11wke}{pDtg*Rd-L@r$cYCmdKVno zmi~^>`Rm8lI!Z+<3oh)x-5iw2cK2jV?5&`nI|&1+!ePTlf9{U`X9Im?EQe(+gtMAZ zudFx6oi7YdXAj?~Jy;KihNFnA*IxBotC@vF%-P)zn!N73C5MbvXaWHD(^3(fUn->nM!tvr^@% zpc~O5vb4*+n`JkCi96I%{W9En6H0xJS?h(p+r>cHS?e5SC<7?M{me=s?!`ZMfk@@DAs? zw59`UhxB&Y$xV=J3;S04jC0O9io(4@MKflc=eS{0?&on0^wM`hbTwA>KW1v2j%x^| zI@E!MP&5L*+r`iYyj$%pn59a#X!i>Dp|4?~9<$boD_Sux{kaP=(wHlZ;NBCBUVf50 z&RhD}Ffs@!`qO3QSk3u&-CiSul>yRoFOxMW&(qhzt!hPU@<^PT`W?d#QccD!(4u+A zNW(+_kX;TZEtbMn(1WN-#Y^ zlxLmaj4l+{H56=GAh-VzI6%Yt@Oc;iW1)zQ{UDbjEmMIe1=U#+i8B# z6%Mm=`nT|gTPDb^3b3){#DmQ&TjQgOW@uaq4g|jmFGI$gO?(*g{^w`gXhNzkqz49j z(xyj7`NX)70l|l;%zwN47`UY-U}6l}N`PjNxm4#LY>)PC2Cm*B6(35o!I zpNIgZev%&e^?)&Rfi*fup5lCe-us$t%(S(#E6G=+BJ=TQ-(cnuPdy>?(UGWSPTC{T zp+O-102_JWi7!1B$L6Qc>Tehqr8i+ne1#6(u0^Ipo`WAJWS?(joKSljJJW`E9y*%w zgl6ZOX$-!c>{sshbXrP!Zb!|VZV!)Bc20NQVJJ(VCXl1MPOr%c5eWxNIsXYXH@o&f z9k?$pe}UGeY|*?G+S?op>9Y-U@|tumPL4k$5+PbUb>-#-D9?Jk(MpBz^YQiHZ??(a z-qV3U-P7@jyYZYWn(97#g@ssi9^p@A8Z^VfdVyL&o!ODMse^n@#!^MpgV0Lt1X41{X&|J9{9 z%}iTuc6g!sbJ%JCiF6W^y1Ca2C2!aZ#dEh=7~_Kl+T4MJGa6sUISfqqx z)5Kk?Xf=NG&RCB5p03H1pg)kRWLOK2i$P1eA|nL%l=VpInrvVDpurbv%r9P?oCE(*(yP zvk9IRkuGF09@G**khhbwV%^Ul%8H@G2NgIPAlUsYW;5an&q~9ECJ{A?3~Sy;{Q|v! zCoR)(4tLEFAYDgQ*)0*@lDNyCl7rsAqlt0wrs|MT6MxqUa>IhePQ6Q9QnDHZ=T(+s zEUQW$wG-e_@6d!Wqvq=NxuiDpWycJ02hab4R$GM3j!`O?7wwhEV(o9^5qa&YEOwu(7SJ;6E=m zITs_itkgH^8As6mZgR*Si8Iczn|t!eih!)f0C*P`>c!!NqfO#6x|}AbOgv&-Sv7n1 zbUgaK!%n=3@F)uN0gOEX5(Q95-8K`%)znXsNBhmaYjp`UNS%&%ufMi*$&F86s4U(6 zyE(AVxB>w~+n15RxFO}rBXFx+^GVr_$;d~2l{_JipPmb4DG%C7O$#FCVBUw^#Gj5Q zjOSwBM_2_?x4}Em_B4iWO;eBEsOaVc+NjDr*qwb^HI3h7Oi3ofE4W+mvlh$WI)+ZX zB(Z*oUO?QllxMrAu5UYqtX6LmbL(7gnosB@?&-ZgE88q+pj=!L4(a)P>l&k7-L7Qj ztkd)9-!bqQ1;p`=Ec z)SZxzt;TJa^V`WySF3izw$+@>e~$iYs~MCXTdR3hlvb(THduA4k1v!yYI7Qt?OV@z zRkT*A-8WpVt_w7APo9nc@VNfpBiDX-+^?<+Hn~im{r^E;IKH|MzNLF^z&gfhj6(aT ze+A8<7;7O6L*aL2TzOmPG46s8Vd}AIh*?cs{q5&0!$KcZ-|AFB59K50d4{`j@W1Q{ za>-*Hgp_-7L;?gvJJ<@;aC5ysZj68_6y-bTW0p2};qv=zj=lcsu+7w1BBIH~k_i~` zRTvJJtj+VF!vBU^lKsnbb=&upw{w7S%_5wvdiCfxWWf+ob+8~6c}@^D0F1)9k(+Sx zR(hy()&mZA8P-C9=hCEl2x+^VRzcqqS&LpxBSktwQ5(d2f9k3f4gT8gj{{AUsd^x` z^UUJThO0^<2jTW_4DlbXvYK#(tF`<@@c+2HL7pTqM{kJE(N920`v)rwngH?R_?-pa z2NDReI8sRaw=9C%kktbm%o~yejsDX(xa*iab96om<=_a{xFpx=(?UvY=pzs*H-xw$ zp)KtInWuI>OEL1d^nF8C(`9u)8w0}ky?1Sxb?L#po8!tYS)4(HSt0ON{x5itQh_Y$ z2}08{n-?G!B%2b4gI5(@Q(+OQp&1GSLLwQm0-*L;B{w4mn>PW#p_yWf8T#Cza>diKot*tCA{n@Y$3LUtb^yyak!)Cq`@d;6KAwL zlCOlA&6z3-mBH0wu)O!e8ydYca44e#ke{E7-|{`96G+&6E2?3T6H*SR3#hUv`IAN9 z(aR@kI}JbZWhG0GxQ_1kn}eMk{FPE}k$-e!>2UYY=*d#a*%4K9IoNfFM-x`N8qJTt zdyMTsUs45&((l^4!_9l-GQ@szvz#5FWzsB)Sb#+QFys4;+(cj^9GfT#mDVS6!v9*r zJv@}FpsV=`Gvii>^(o=><=Q_5CaIQ~R<;+D;f2=3a&R7$6_w6G_L8ppQ%r8S)>3V7 zHVSzr71qX8@yPqT?ej4GF2X?g4#MMIf+02chi0S6y7LsZ6U}U#{ZRVGezE9jcWH7$ z=5^e9g#-mm?SdD!ogaQX)xUmP!F%a&?Rhh_--pW4u%5FaWaj?r#M!MsGAN z^#L?L6gmyIgE50?c_69Ki#rL1Kh4kbs+Vt zHSuB58ipPBx@y(8{e8zDu0dau?I#wA8hAfsC%t!FqY##tj~(d~c4PD28rblC2&^>{ zQ!%UkF+E2?@yyjbO)9INDIFKWqNKO;iE;|g2i@OUkZ1q=O2!X<4_96;QwCSxQ30i* zfjJpaK?MBT>_jZW@x{57!K3RC|a zPITp7YyGcO`dpM@Cd9=BuQ2!JNNZM3yz7X&xyaXI{DxRKWbphg z1>l$A;q>&P2<*6fT)8tSId3}mPCIY%dUZB9uy=9lYH3}qWNIptZP7J@!jx96z45(N zRf-lg6D6wr=crSCZlU!5-c?hp)UN;guIgk^cK+XYRiaMyz6GlX?GFZJTh^Rj6@^uE zHw~$s>N5*gkJ^j|^pjfyb*>NreSrkP z&Jd_!5u;La!Hx{A9{}n`8^$t&F~hzap7}(x-?}#@d0zW%2%8{AbX-p-7|@kps6G){wy6+)}xf*4H2jbg?5@(^nlNU z7XH#Ay6czw5t!A^WC@CWb{f2m%i^5^6}bDay@O-^AqYoyg&21HBhPFLh{Y;S(`;u& zw;X#e^ILuE&q^Mv=T2G&Q=mUxixHpXs)a95nNuC5|9Rqh-Wyv|tqvG`&eSdm3Jc6C zVW%yywVz#Mlj;WFetUvLW%jT1yI;Dj0PHQn!V2~UkZh`+`9}&*&oBDhF@XH z!}t+}Xex^nt@IiNzv@gfMS3K8bqShy2lpl>lGh}66-gHq#)z|*OGOJ!`Xk@vs5b=V zFZ)loT2{Ct0{dhPlG_6a%xe0Gg#2#{SCj}#V;F>WXPSF4MI-HC znXu3$3iL5VwNOD;5u4O&T9c;2mtHeFd1xlw`G_d%QdzeXpY9?B0#crwR1S*>VPE!7 zZNt=Y^RdWT@SKhjRH$2PO|t19WDP628z8MXD~**Yyc>TfOV6?S`06npVvu#7?q zkW8xqlda6{bKI?)L7avmHFW1*bf@Yg;0+nxHj~TKNL&w;^>K~*sveCB-iTPg%qO#V#n?(NfQ`=gl|U32^1#OF*&6zc~qG|lvI%d<=D=ZuP>6B8*G&5(`+RC8uYwx&LS1+k-%+YD7l4)hmtgY2X zr>+1cU~*)j z&JohCE5Htz93QCr0eRLH5Ccq357hmH21L7f9jw!hSDi3KpIfuWiZwL zCw@G!i09S+mW%(tFg*;r`d(i!2JJZJw*q1M=f6Nc3GJ#|DTYAr_4R?a2Qy6;BjnN{tG${GFN^b z-0ih^x!L_6Ao1j)d-e$;qor(iH|uUi>0Dj*JU^>$wtjqYJy~Fv=t6fvykuz+CG$mzi%DcD z2!6`-(8kNEe z7nWjXnnABeBu@yZR6)1f;Y$K*3(S@iZEGyDpWK+d%jBlEMSp_lX9)WIwso}bWXPZ5 znb%IHPVyiZX^QVd?Glf*(~nsO)5N+kkAoH0i9!XlFd;|C7v||q{eSRWt5M|{XJbQY zJ=$3dE1N;@Bb`Qal00Vulr>_m!JM8vRkL)G~~QObuIA`RImDF)3m zg5;EP&7(<>K3rmZIIDv08T8U6yUu!ImUNh%Rn_xCc9&06KP7xhMO`4(Zz80SVp(57(XQsJd9{Aix6CW z|7j=uOPYX*jm)5%rG4P|GOPhlX3JUfx51S6A0m*VB+20RFXE5J!0PVNb#ZVg`SvHi zHzDH^afx5?RvTYQGY1;q#EWgeglavxCgyLzkxZu3U3+?I z+;yXPnvfC|7!p&?GD`!r@S0UA(ffRr2|`YdxmRt!%#TwFDmVYq=tZ2ZP1gDXrq1NU9LqPaQ5HTcms2H37PjEnm_9 zWt!aH+l1n!)F?}%D?EfdLYg~B(l4VOA)5N=3a*kZu5!#sv;w)hHn?#SLpP3~L1m_3 z5rMtUKo@Yt(A|HG<)(^Ao-vYlw*!3Z`2Vr{AMZmzJvM^;%PAd_Imw>!`wg$ro;TkD z+F+bON+_~YFof?vl{ou@0$pMwhM+>Bmde*qC%`SoV}HRb@9TX$Zx|R_gNTB{6iW|> z-`;X0LyA6G*Z&Haxm)9<1ma+uZ|Q~;U^UWJ?UZ{+dZbPlT$H!#gI@L|-t zCRDYuW>!9dATF*#g6K@0JJvS z=|@4<-Ht8B`v^&OeryBwP75f446TT3wRmnCCbU~zQ}{-^kX)j;1GK)fT?F z?r`ACMv*t1zQP#3cUPhRD5wF}YM4lI98PSK$s%of5vDCrs_*D{(7zDbI=j{qczL^G z5a;b*S^X^gr#9)b;uwZG;z^%jRT??QzWFYY62+nZ5V7Gs_mr|Q7QPk}(NTe9@#=@W z{yxSSP-;zT6Rjoh6Pd2Yyza%nLA+Fv+q>W_Y*G)BuLcTEY3^-Je>g*|h1Bsi-`t8C^H?$D7-npJf>P zN){9f@V_aCvhM)Un#UDB%lBoV_O^y1R+`yusTUjuG6rR7Uwv;@ypanJ-D1K&&8gPQ z3xcup-EvU^xfSa52k`o`u7>QF{047G`hgFDj7oR2jw-YJU%-)c`TYTas7pc9*WM1b z<`mKzGR2%yWX1QwV~}sB9<4fFNTe&kT+^8jwE1$l#TWZ|Uw%Cg-Ji5cONR(EUZQ6G zj`FQ?rBG~%_Sr%+VXzD=x8>ZMua+Dqisc+LK|oYWlHMobqtee!rtK`6RhCN_K_?^H zTrRjJvsjT`Vwq@(B__3sD8uK1(qUbFK(X*K_NcF z=H*(vfyomR;G;;95;1(Uy=7po?oPwv_t6{FbrPodL~D{Z6Xx+`6^ljv2o3rZ9$E3o zTlPI7dwYG|hUe_``?g+Zo=UQCST~ z0MD1G@FI%^SBOt-VAsKPBvf0=B9SIa}->ojm9_u_G?C)ogX+eL?{D-j^gYW zSZ?|oy#8Ua%Hij)#%oV3)Fx$9CkD(dA(0vjokuw=;(HMhx&s6g7Ogr5VcgcGQT!8t zoJQQ-px!9xpItZ5@OffA`j1i(j?CaBpZ_s+S~F@9I)1_(_jjBotp04hPYG7cRk*Ac zE2=3Jh_=GcRDX8l*Tz@+x1YwYIP*>0l_vxnkrl!}hv;r-QYqz4i7cb;+Yc+J&-q6m z>$5b8p+BMI-FT zGC&d%lM}U@+cauu7;Qp1oN_=@P)Qp0v?)#rd~6% zee|<^X|rue-l5$Zbl{j3^-tvKuX|4~TQHhefw}<=$%^bhv*Lu+V5f+8)}%;hMw<=- za7IK#v|bPt9g%QwM#L-i#)p_V(56`4Q3&=6!H1UQ><_@?)??$i z%tuOm0Y^0%(AcQL#H@^?hI!|%;R?!shJ@K(2K9az*ZgL2Ryr1Vc9*clipj$f;QwxU zG13_~tawJI$RI#&pvi5?%fvQLrFooihPHktA91w|+40s%Q&Q09&X*d&!v*UoT=+Gp z;;*PBhcI@MJx2|Cr2EarW7ml*5vp5CWq97z`s~9Q3{#SanPc>RQ(L1{CZv+EvkJi|ofO#tI0M`1Ocu|~b+saWqZ~;a&^U5A3E`JZ zVs~~@EK|=9qlPq6hzRXPhnRlwZ=pybXfu=nu&+X&@Q>sCRBn8;(V~f+mF&2-F!vB# zYPCn>L|`yJ^NDv;`U8FkbMmqQ#nk0^*+RWyc4~OEfyo9m(IG0CDsT#ZsL6~YI~Y=T z2s83=4NG%*zNE-fpae?>lkkiYf=r-*YQA{y!UmrGZRm1Mpe+7~$wu;rAfzDi(@03+ zbdC=*r{nbJEY|zKx>92UAN~5qo6?+XrD}CwXm^+#3qa)QD<&6c--bF_ORNuY5>N0P z%ul=|gaT-J@Jq^xkO8y{4hHG9M!kRwdn!=34YsOn4ipvgQJ@5WwAmPJKG&D7eJ9ta zS`r8ts)tWQ9S2j_wd?6lhPruCMVd&mQbHq00;3g<(zDb$MDzn2nhH{2Soi&x1PHqd zaRv*&8IP#KF^#gRZn93>DQK7PDgg0qx#Yh2cXpNOZ~P+ii+3CBkOqXc6CCE07MZ2| zuhgCikVpJ79&|!JPW#klEC81k);e$L;MYyuGGQ`aPr1VNnDBeUN?`G3WLp zQumfwb#&R$w{ef)Ci_xG77UQf{k)XrW5n_WTj8*@N7&HWi#;4AeDll9I-UF9B50eG z@NSQ4L@?dmw}ZR~xtgkf@X{)H=(xiw2~~ABog#wV>vZ5Tqz6~$B7F+T#UYoK5K}ce zZ5?S)W_F{-n0a_+IZ;qxN94}PvEIv9t3inAt=&HyeBLfmv}K$4&YAf%oKYrV|p9r0qBx`=l%-e^Pr6A)`z=C~Xl;o9O4)S3j?QsD;`TL9L36u2V4W_POJA2A$D{{bI((aQ%ghw>90<^3s^_R{BcFw8{yr+l3 zbE!V=w{iR5=MPAJYZoT=#u&dSm}pL8?Qw~>_+592C3LT9I>&V{+1J-;yZjX=ILxSa zIFrqG$%LA}+&ca@;@&bUt|bT%4i?;HZ~}xd6I_B@aCdiicMT-CySoR6puuHu4;Gxk z-5mludGGu7?B6}Rd)_(s%&qQ{u6r4}d#b9dk|YT=K3@&jENu8C`kr^y-EWfw`<}Dq zv{#2KyoeYz+DJ0Mu9-{jxUckpUh|4DN=(uLw(=gcv*V$LWrsLqF|K< z{oB!+jpa|aHoiTjCITWCV>O3819#K7`f8jH{q+%UGM$$>wXRkA=}dql6b@;PqRd*Pj`Fj0!!9JsgR5rHh-YHYz>%vaRwP#D zyEpTY*PqXjnFkbdp40XmoU6JU%5RSP26N~koS{KB|Nr0w6Gs#yUP8HscY8PD---K6 ze_lNRpc+sTL7bqy7kf7f)RS)i_tyf*_uUK&}(=-VJ8|U&i1o?~TVRsP>^( zkH1;7zML2@CK&U5wxJy+#<`Y4CIDG4czhekOpu`JDNrBwU=tI3&M~mY{g+{MlgxNVrokn^rzX8Kn(cXwXZJk#%TzEJoscTJGyxv?kc zZ5-PfjWHK1V$=g}ICflzLLm5*}1c)+|8Dkc@-uVz8QJ_lw8H#Cj4yUx8k_&o&Yb zV)3U)1gbdZK+HK8?d;Ly2fP%yx)x^eU4Q#1{+5JYjksbla&`{TYO!oueV%VEqlB4^ zd`~@qRTYJ)4V~Cg!2;T0z^P1En?A4(5$BJP&lbv@bj8L?z0k;jk0r}v_Yc;4JLIuk zlv_wOa>_LUOkYIeQ^MH-k|fjQUTZQg=h&AZ#5TW<%Sw7M)7AQx)uc5&e~f(+;ElvPD7m<~bC|)sqtC(j82% zITdSaImH60;)FyN?V4PfyCmArWA}N1OC0FQ)qcIr4|T$f@w`x%Ik`{P7Qc#L4K~lm z>z1z7LMyFkYggtl=l$cymkjFY5fucnlj)y>8~kcF6)?{B?_QvZ>GVJHTaJf0&o?^X zYD1%a5_vNh9)cdeoA9BKTLD~{T{t8K9+2}-mXn)b4vJvA6f1Lg%0%-ak7R?Gp?D3k zU(J}=&M69o_6cRp!%8ovdc%1d;mFVlTcW0vKX!6%P>T%`VJF(9u?&p8A6JKF)wAsR zY9)ki)IW;A7dG^ChiY(MauqJoPm>!LhUk4JBt)0s-tS|iNIny##Ti%}(fhME9Qm@R z*Tc9g9x+1pPt@>tHuJq5?~6ZM7U2&MZ}gtzfK@LH3nygc?V)FIBuXO86Ran2S@l=2qI8~H`QmL2*eVVT>MbJVGx`xMx= z-o(8@`c~v6gB&_sB)Ue+k4e=l*$+o><#^tSwojN{VwJDjsoy3!i+dPM_<7f{B-&Gx z>*pT#EN;qsXEZN*1AKIsUh=#b+pl9d_*|Qq(NtF1iB%VvEBj4zBK!RWSS!qq=yQDJ z(ir~Vl2rFa&s!2`OEB@j_O?D@tqN&*NBPT`!v?ZwTyFC=)vaG7yEyr7AnIq*=m6BE&LXKTr3vy8OBe?XXR@+B#)p0!cL5oZMhU=4QEm`Ab`?MN^P-eEj%Do#7 zCwCn(!W)mu)FkeLBzTUYV3O7yQ5JgXJ!gAxq_yM&SJot-9J%VD-D?!%+p>o7`F(TF zb2ugdIhcg7)_2P_ZdSN;%4GQu*ZU_Huv7TN@wuY#k}I!Ye$wX@VQD%QD*cAxHx)cN znw~)RnQy0W>U#kLLl8efCw5XKhoPT)W&xv?;1O zHE&6XEG-@gEA*sA;QOuh@%m2Pc}jUK>Z}OrhMX?88yabZ@+spweAPGe{^5L|#G)5o zW43y$n2-$TyuS;O{S6t7bd<0k0{6)Z?dyHy}(#F zgUO`D`l&a2h_!cgwrw`iZn@S|bHny7KoH}wabbm&q;pRSOr;WsAxjQb`%Whd&ONc7 zm<&~9K znIfVU>DvgDNX{Om(s&z7{gUaesTshY0-&#dXTz>m5ZVyb7dIXeyl~4T-R6P01O51mO6V z-a39K$+kVLe!2d;7+)(i_g=GwlFTO`JZ#Qp3n$m?sOw0$L~pUrV#{&7HWFUaZ^NTqK-2|IYaREX4K`d0=ERE7prhG*n0u=8TE-g9m9 zmOjoIDnb{^NrbCU20LLtS&(9S3xo|>WAPyX!Yz=Cfk#iY?o;CVFx+V^NTu3SvcHi+ z15JS&Ba%an$tLOY>DnZjW{-G##%FAG&zjMu1eE4lS~ug$bdM{rcjMfFFT>pmlu)2}PAJ~~U;N<@D1KRieME<^ z&Ue$MpbQEN{e-`9>pW`9hZH!sg^5$=r~KLAaF7S&%k@V9cMCsaFCg z6B6Dl48kUhT5$Y4VwukEiK_RSyD$OzgT2?Cme$v2 z%#pmGZ_R3Qu&P4CyAJOk&R!8s-rliIU^)y6zC8K6Jj&@CZd4lboNE{oaKU^CzOM}2 z(?Wec^8fRC$AIgeW>ZQ-!>^ZdE@ZlMT@Fn&4Q6umv~bLzBj#z?Vi}(UOk{kE0J%6H z(ub0)R;GPm5+ph$r3=QCeHN8OCH*{hFGgZ=*%lb6&dW6;DrNLB_i*Fm3!Hv}ku-3Y zp(~#bR7IBkMw*1P?}Z%pH@)XO`E^_nmeS8~*gjMX^7&Y}v3H_PbVp{$W zPG(V{!Im?q3AcqG)?gd5J43mlH~O$gBJ$Sl3Cx&KHo4hbh^$fXc*uV^iZ-1eS2MaL zPxp4qhA-{XN9AqqkP6DZ!UEJBsl_H(f?(zy_vt#G@*~8lFgcgSLIW-|JOwEYvp}d4 zhW10zFt?x!VF@;B+HOl0uEmHF3aM?LXjuDTO7833eR#_+YebO81DWq7R@LnzZr!z` znS?_1vD_REOpU)oB|c&yO1;gD0p;l19h$AF=@r^N4$JmE=mA&}Zdhssu?PW#v)y_( zqF?e;ZNb7Q`^k*^!NP$TKK%GV$BlTE6=X9ikuF1JKPT7%JdgHOICAcxOtNz-OhRbn zDyJ{>VU*+r9m$U(Sv64c(#*`IYSC2K zpAeRy9dgXM0xSsR`N3=;*Vh`ibEtWUKKO#G^lo_??X`>5q>RYpJgnkZ;vg_Tusz?qr{< zWz|r-OgsfPYT)qKnX&ZrhM++y_{`X~tq~TEDnQw@ud(GvF=dchJb=^q@huwiY7%2( z0D1toKNa-M?`{e}rPs(Dc}n#=QSxo1p)KW)_r}Dizftq9x}GQ6ziht)$M3#mgNkx2W+9%hjPH zI0&`g{XEm|X_cbhXKoI>m~&>pX1-Bl%=)6@!v;Wk6Zty~GuvK9zbL7IN-Y6DKdeg9 zj#d~3FMHD;1t2R@si|&=#4fH7~Yv%X?a7=QuS{pfQuOGJMx_zcKihn4%nFOB1pJnl*d?r%>zZ72hVtM2JnPxL5L3@v zB4&TNaTF)@MdStf8XJ!L3Bpt&5y`+3s1yuc!zb^LY5bw>?!+imu3sGePQ$0~8Al}0 zU081_UUaNuKuBDd&M>IXOQ1rehnJHBTjDaN0pM2_Mmp@1Cf zg-O)e6MDi;@m}^88FSQU<<$KdnPJOiY=yF*J#_>Wuj;2hqGYgBCiye@G^IU&A|lL% zOuzf6#dHaVX~RwXD~6{ROwA~YYxgp$=c;-hzx^<3i?V9>4H3b9SVzEu83ND70YW*=jX8cq4-qHc=p`IN&L2^x9w9GWb#EmF%nOZkt3HcP8uQw%bqBk- z+VUHZkR*b%NN%x?4l60epj&pbieb}A8q(cyK)0{F?+EYot$$C!0|Um1yGiWx)I;^o z`|vC$6141#OiXO2xp*`hgAj~Jqrj@HK=!e z2dWAVJYw&WLJmF9##OI^zz85FzBk=Qbr@D~1}60OxzV~g(VX#Ye_aY>m8$L1BT`w% z1G&V#lG5ptR8hB(9I@<32a7>##)bEiv#)i!X|keci4}%3ex!jd!46hnEsf+KLT(Va zNWf!|_8Q=-$qfUTaR#0iAc{)KC?iKwp1`!OB(RG-#(=sw5dbxry>uerW9>i}yD`P% zzEBXchc16gxQk*6;|QE%GLq-8zUbc8wB0ZUk{M1ESNyZ{88v<2O~k-p&GgukAokT) zQ}$V|Mers~20%5m(ZNmXG%HX~27b({B4Q-@yz6=fAfLr>@jBIG>0IfoydyFl?w$7v z?xFX3+vuD3Uar&y*kS{C$3i794c3Sxt4%VzLCB3(+kC_IuBM7?d} z>pHb1jNIm!7#&lTvQ^Pr7({WuUn;HDKqW4_z7h5!SgOA16_K_odDuqWdNB@tgHjK^ z->$4IX*$oX-l{a@lXI>O%;aqHSQ>cSN^HdvQU2mI4EoJWMJ(AJ_+eyAi#U;PptF?8 z_mdp(cpW9J%ZbkvTF@~bR(<^^{oBAvTr1>QmmP4-W3*|9eeQh&wN{Nz_j7bbO@wU! zN+$X8MK?>v+|g;hwjTe+rklr43?cTju#QuKdOGadg;j`iypG0euY`w2M7f}e*Qy@S z;&l2>JmT<_O-GO4xTbBC#f>N&O3x^TD32Ukv9M~CW&aPNt!_}u?P7jrF-TFGK%?(t z`$u6DhM|^`p7%lmm&u+d7P#!jId5jef}>7TwVuB5*7Uf-`bSFlXI+JxeNd4u7z@H4 zCGHMKyeJ9r0)>*-fb)r^+?CWfr9X`MmieUsi_74$?ehD}@=|Q?>{edy2V^|;K#9sY zZ*|Y--G5J%%4-tUSfxIUh{)Hud}tpgkx-`EpjrDM#m&92`26OI&T!%rdK+!SF(|mn zPiTs3SmiHyT3)qKSbcVQ7k@CO~-cqjqZ`-Jhe{>}??L zSNLhW2H#im5iOMYji39$u#2V+u)6%$S8oA`AEqWgC_9$CtJ+32fmiFyHT1Ye)dwEQ zJjK>i*WKMCxOhg|H#54U#!tN( zUC6rHqD z$c5t%%^CI|cj0b|7{R7Yn-Ehao1O$bCzl`J8Te^PtK|ub*|hFq=|24WEnsnovq4}aY?#m1#ggC%gMi^MlpWLkV0D1BTVT0?F60aTk} zyk;ITo|x#+bm2G!hb6i&&GWWi6CEg2%IAteN+ga~BDGQ7F**(R^ecZ7dTgRLo%Ux` zIMIIDnu)Sr3C9K;>CgV1K(YdTE~da8nv^4#8G%&xf8}wWf)#u}RgriYgU5dY8VOhp z;Ip!Q>UK?6!eL5JRwC#6hrgKEg+?Yud-C2D%nSR>Y>}=+Hk$6~`vM2D37woz`$LVh z0-1jQ1RMlBs8Jb1Rq!J6*rZjz+sqG34)79)@=*d=kj+D9jTS(idn)e*0`J}C4BSBW z{kK0$Xc~1ZHcs7(KLJizj8MhhPsIdpvsn91ddMPfC5b@7i$Xj*aAJ2Gj3_PC)UG~` zX*`f67oQ$`%<7cW+YJmc_my*Ab7;f*c7=-39kY7m4`=({ZL}GtJV@itv>DL@SQ;C- z9LS5O#L~+YEIk1!KHFVyHGFIXg#nUo(~+bMy)|I6r~*5S>9&P-&$l z39mr_P;z`@2c|Pe@UmAVMZ^_>3uk=bZ@4{%>PEsd=wV5Ri~Kkbu1(vH{z;+LQzOh# zs3_aZ9kLit9tWr3yuDFg(hJA6O%ZGdCx#i%P=nelf~^g`HAqZ}WDAw&6>!n%>t4u+Frv&65I(jFkDN?5EYxr_>>Y+Q_M z0ze0<4XlZ43iAtF7Ga^ZW4gz1G67QBCq?Z3RYPQjJOUZ2@B>!!lI_22p|8cco#)6- z6;*A81dVbYv%;X%F;|C{mb*MY;U%E-_pdygSEu@7^FywYn!4EG_Mx%a7etGB(b|R z7yai?hX%zy(J3$ z6ZEtq0n6ToVN@ZQo`D87rSUUg>_-l`@e&8Vejf;YbWqI-hD=KL5T{Oh7YbD-lA+3-_@#E(v+*r(gh&CV)^dsGU{9Od8WBz1TAG7R9E zzxP;MzdmeUgA3q1=W}@D-;AGcv$AV65A*zvoFY1ni_2;}@s3C^TD%P|ETJU9H6@?^ zZPv{SvkwL&-r+H2d;mbI_tHA_I!>}=9itD>6H$@O@1ov zLzkngYw=^hev_X#Fg^wsX@6zL)_B4v+rTHw04+}b&LEEwgFiYUVI4J|wnro}zn>xo zo1hP2@vj&z<1;#UlUJE%LvQ$d%3~YUo$IaZy^udX$8Bm#^Bxril}SqnJdc$J1I-^Qv}ymEC&Vk--(HW0wL+xVv-ef6e@1#)pZpWo*Fm7C_@902h2~6esfn6B&4` zXt@}XCI`GG*?>#Ht8t?+8y$hBO<2e!vcl4 z$>`f2e*F%hNls!HnAt^E?|5$CD0&k?>ok2a31cy0j+}^$v9V-v`zE&=Fp!e^6h0&0 z;v`e(hrUCP`nV=JePDWpjEu#0934Q@WTzN(J>wh0VjOA!-r6^M|2_Dp1k{yXQYkC) z?z3;&I%O}LOSkH;gx|(V3s~m3!@8s47|HJzv2~<(lJmF;cH$-D7PY!a{>c`%P^faN zmLni1c(7h80yTVJ1vv(wvDpOkf7QY+5nD7kSm1`A$MfH@V4=KPmUy`me4!PDO;2Mp ztzcxxH9ntk7IZ7N8EAmRbTAK_DdnY0R=y}FkeF}k4w4%OfmEU+El1%7M9_{>SmgfvG3mY!AQC+{_ z;aoyB`-R>MbH(|Nmy1k2Nt(XZn#I^2{HubnI9Z#@@UUcVXF}^hvgH%=crL(JJWalI zW{k=1$p^@sYAEg+dw>#Q!Cs*|DgP1W7HDp9m)4H_tSR{iV`I)t*UAF*>l z66i`Xg<9fJsde_TYFaKC&xM-MV0<12Mnz&6v8Z(C$>6>fn3$zVWY3;OrohVf)xI>i zuqgeBhpF?&Gz7eobCDv;w-IR*a@#oQSI?C_t*wj7xIr0Ym**(52%=snQ_D>|)8$E; zePCq@wF+hFYYf4ItO0t*0Mx67Th=evkPnS2&UmJpG8Zr3N<*ify@Bkq*jqR8M5h3~ zJFy!ghnt|la|6w4O5P-vgAXRL^^#P2GIwaO8B!lt$URWpf0l-teTV{N3GGwRYf$u& zRg>&RQao{*!TNqoWJiQkDOmw6?xpkWlXJy7IV2GS=VYF6-o}DBwsA^7gTkQ|AUva4 zz9cY$gEI~2Pzcw$E-^K$d(=lpTp#4S`EC;&iHqTaJ<-3E_Ag=l{1H%{6X?zObCvuQ zW*E4b?jUp3GGz^;;VAXWrm@8-u(7M+C_E&I30i7>q7qg?1^AF;CeDS>%9y2yqx%^T)Uo=RHg-ZE2PNTbbfOKJhA zAN05-1ejm*`fwY7m{HBil(_Jebe@J2nHMmfUP!sgd%&@!;A>7(Y#93-qF>}n zKqYOgdM;aZ`hdrHLPyqm=tfz-krXc zt-$$hk;LvG+irMOxlFE7Fl)2=cKyX#BRqg52Gs&ZyF)^!=x9euBOXCl^KNTY1!E^& z@0>?3t~es-W-H+PoEU+H5lp%?pJ|&AZ9#u4`s?Y&fD8xQ?+QMQu>(b&G~_Pk(YG`o zum!4pug>!Mb|r zoS9cfDFf8yBf08|rgR|5qDC!1EqmOsIHqzX4XV8LX;+?UL?U?~fnP-mV?pGr<)g0E zoR7m&EHaOYbT@R@RT~q*kswzSb^tf%nfP%CjLXcqDXaHO_OB7~*F(s4;p`^r`Yt|S z^v#eb5d*1M2^)%~z*l_|=Hi`qE)n(-3V~$r!tHZ0TdbBP|7brEwkc9=xJ4N#gBEa1 z01k*RV8h;8Qlya6h)n{ zRLcc*Br&XlOe?yPh6`X$cfH#nm0t1Xe{1PrWWCd;IYAZRiiw~!A6iMu-DLbx zbRnI8U8~W2Hjr_g|2uXD{d&AgB($JnBIgU4azrK13xAjMw|HN8XCshpQ5+5?Vh6qE z3f25Po$jO4iWQ7;feV>@yUEY9tNPGPJKPSZ4C5=O=z*t#F2~I>VbD_UeSG#h@LaVi zsq%(3&Mmw&6zIv<{MlBFvqYR;exNrhJXE0`1aUOtMdhI1CrKZ}+IT>@Q}N$uyg9Ya z&r11Fx=OcW-KN-5M}8TQ(P~@^t_itk*S~ckFOEQs92`$y12S>M>&PC@G_ezVWtQJBJoI<2&!Dd zA1)z1Dv)YpSww?KwxSEk9WyS8EPIjGT|2Zrhp~`rvG0NeN!w@#+6gRK)DshN1Gl;% zF5o$$Uzq)b6YH922a&zz^=D!N!iQ)FB1-NvoMI7#|KP9z7Lr@(L!*u{T)ZN!DW+(9 z0axxJ>}v*Ji2mUdS>ywGwr5i^AeQvg|E1CPQ9y@E3%SlW{i(HL0_ApE_?MeF7G$ur zhw2{U8th}r*!O_IEApuLJ5F2+XL<2kLKbBeeRrZ{ze!Ih;wP zRekju8$lejH{h~3L@jrWFpB$YDkEy={M)K}A}KDv$<76pLYp>@r)*M+UgZO=y3D2` zfqWtM73a|QuaDjDn+wYM9PgX0g~ zylrp;h7?Q2zm+F_<=C;WOg&0IE&}4pMz+GS(Pxzf#zFRQD}E0H7M|dEQIwcaT&dd~Ae31y33+qvo9|v&4>P z`Eaqp<2NCw6YG%$Jj%FVW0NGlu!M!nIL?NZpggP+Q_g}}Qf9!&q5%0|6;kVVocw>5ST zK3w5SV)O3f=1g*SvYmR?nRb8%WP53oDN)zETJpp)j0 zreA!^cIk`dp~$}$|6DVVgw#SthX}k+DBjKDLfzve2pwAgvgrS1xfTDc@GlE6 zI65Gpo)g8p4oWshg7C{{5Xgncf|ArLE(Bf!?vE40z-Tz&T^mOSgmowdgiq5PA=c;e8>?K*DSd(#y3!{7KYgg(JI3 zrKFfC%B&Y^;DT9?94W{ns@Bi%L4Ca*hkf6!{5te$_~d^qP`|Xr$4sI;yBXZy*Csjd zhMZ{pIHjha^r05h_(3Vp&t-Xzn`d2&SAB&w*1BUv1UNEu$OsRL<)(@F`?6LLh96aUi*Q=l@1sTvujtJ^v z{d|D5E8{Q}PaiA}<&T$VL_W-)Ahi9%zRa2OyICY(vpG!fc$p39!#u;rUpcjP_DsL~ zJNd~fF6?g|D4yJbI8PxvHJZ%;Ta)!#9*uv7MW1BV|CbJe+)X!sLQz}UFf-8FVF-8% z`Q_B#iooX!9ZVVUbn6-u?&j0Oaf|-+3g6}@jKQG-i_nI!Z?djfAYZE!z<7%u8>c_u z{}(9DgGxepf-3i9MEi>}nM&!_vvLXyofs=&E@x4LF;m=eEhsJ=o$lOXc&7xqtqMVh zx*mCc0n7cX3(2xse`p1ANQ<#F5b4*a@^Gty3M1lr#l5X zy_F7S@HpYQGgJ`cUy0WfQ{1vye&E&qRSNP1ZQl(xaq0Xw2>{>0RU3TQ@+;5Q79YEk z6r}r@HbH)d_19inX82fH?MSarHk63E(AeFG#yG(`&9P8Lf70)3#=C4yOB(^1&1n}% z`(~7geC_>cIIcQFxtgDXMX)0mZ>Y#@a@LI1BdpsWOC*&dz0jdjRyz9ITN~rx?AMI- z=d_1l01hlQwhY?}l?3(5zlAYcJR{RFWh;V79j^%Luh;6*FvaN2i)({P>zdQ@0rsfe z8@mj%ne7HLL>9ZIKE&-hk z=3MDE9W8BIHFn)|K29Eu`paP*01v=XBRZE4)9J*#%~NnJKm+t~hu3Ra11M4Y*I2&P z$*TjU@Aq-~ioocz&}ZGzvYgRI&T-biI__;peXFm_dD!J?oAP6PLpH!i2tb2fbJl64 ztiFLzmo*;wfj^GJu(}>y&p5_y7{6VwESSr-|=1MEl z(G|li5BuDwBfn7lgyl;;{$^2cqwK(UG|%(^3r}IR&mf4?VB+a-d3oWf3Hj~r_ed0; zqfzhhZjnS~58xF~fv==dnmjPB>E6I31U(1*vzAL3BB(0Px zF#%_<#$?)YuQTHGo{*+VPfJx4A3*O)h`af5eU}Klh~_dgT=dlB6JHmVIWb1VGF=Rt zW~2HpaVy}i6yW3^|6HJWGz>gt{3vv7d4CcJGj;S*%#` zbzV3bHXU=$V~QyX;C=VA0eFG&Vnm(&~m(!M2~+vbZ>e#gXi`TOHa zbK_OHE0BRtjSZ0i)IX1S^!wvecSB5-Q};s|waP4^U39`?hmt(6^#w!ydhc0Zi59<+ zmOm2;k7VwkAyZlkjf9~Z36Kr}=`C3f$i{IcZ3W>zIt+2wUf2wUY23D>{+C3#0(fb; zlCQB^d4h&--b6N1nX~Cbbz5-zUAU1Ad~}is$Wj+NO}udDDcfKZEJVs<`}V0;Bs2i-!2&gu~EtM@SQZ+kb>!u|GKa#zeCMmAmDa+ z>Pv6`7Q)PO{yKB!_b(J392$OjE~wCgczP*ljF5|s-xF8S!!Imo18YtG7!@Vt9YAJqt)KXA>q}lkX_`5wv^TK>m!BU0~W~UEkP1V;b z%f?S2m%}PNI}-b!#CCE(37r`SE5X(pmFT7!1Md-Azwnf4m7Nny)iH15^;b0^*flt@ z5hFy7gE!bR7U2ZbGP^VR%Dr1b9`D}G7|VVREtG7({(A0j zlHQ!utAxmu)(JzWM&?nai5k{2atg4)UQ%YjKHt4Zjd}lT%@mGzlX3?C=@Qe-aMUxX zdLuE6h5>zrw5}*86_eF?kuE8C$EuAE;+TSbWJP4|e&!e_qn-duBXCYcS&Zk3Dh4fx zC`RhgJ*9pA3!9}`B$dFf3>xns zzsnm^kD;;X3Gv{ZmN(TdYiIINBDgwC0#!(n7Nl62EgjTqIDC1mF^SILJfXN*Qb-@q zynO+ACvu+nT$T8ptu>tS%YK3ODMUXfEw)>&XL6qS`PIf)o74Ets7Ofq2Fp-$pXf6q z7KGP7A`1$& z5Wm&kUK2UPaG6H>=kiRC6i@qmng4VB3;+8$FsjSmk$FK>XZjJyQj^%|SDeL~0Y|G? zZO*`Xa<>SMA!M(W{y75QlRK@kNNF?4Ool#>>AfN!eS6Vk#Fk>K>D~JIqOqU-}_4jxM1cU*Mu_{x4hw^KA9_#@0suxF$EM5B2LRG zP+0Cz-P;Z^`;QAG_*Sc1=Vd+SFvaG(u4ePm>LbaWJpRS`n=GnnjLeCQpOjNX9Ovgk z6BOM}{UO|ZM35)Kb>^35p`6FwpV@bP;V>3^YldLWL>kVMM&iaGj%{9fLI`poERLIU%|Rc=PO- z!NQf$_xJP5<7Ci3n476AX{hTOI)1}ikY*PY@B@-MNB?-QG>>5laEAVBmJto$*!KP| zli}}C+ZJcD$+J4MW!#aX~S)iw;KY$+*+TxCs5|QgLT5SKn2cn&i zI}+hm?$m9_QJz>Tg9iCjD%jx~lQ9>uvr;Z#?!-)?GH1pe!ALpF2j~Yt-^Uh`9_2jr zPp&p3w@a~|p z>)9p~b~&Q!vfguW=5=FvgSFJciHqiC05RdAu`Tw~(@|{~B&G?J8%_rNc zlB&6e#*8NQnR)9aZ3dkRGn+=+s+6j^AB{^*>dW)i%i4B26?WEYiDhbX{Vz+$HGMDE z)(BE+X9g~HT^xTUE@|WIR2bW+*;YkVsns=>H>uCfmoI6n=~P(T%-L3DRH@ZB{#emx zXx11#nRE7O{67Q7oqg(8*65o#M^FA^kfGUQ^kmi9r+H=VzXki8pK4bG=$kP|PyS<& zp;=+{WXAcaVMXA71N>ru&G%7jBMmc#F>z~En#+-SBZDXQVBi*!sgoZm2jLY*@dGqi zhtDMHLg4dd5H$AbfocJ!)ax8(B7~E5H|k|z^3`TVfv@6?UXG;yO>pf4hT#iZX#u&)tSV?ltSx%??Lsn@Q)rz533Q?4|K<++yn9zq!?Cx-;9%=`| z?Gv59`Chp+1YmY0$j`>ok7oiSxi5s-D6cyXzS*_D+7U^Yj&%Fw`MkCp@?2n0$|XWe zW#IBS#+n7C8%5oLv2mfbB|y}lQ(Yv?9LY_>U^6}0vijp<(K#633CD>`fwp6w zI@Z2EEx|C3NKVnja<83p#`hJeV<>oiZHlBWfX2;6v*H-?O1b|2v;ZK#cmaEsmU_WX z5av62tyua74BzJr$}iuH*pn+b59^_|?ROWXoO`Nh!=~|Z+;P+s>;A?__3|?^6>C*a zQZVg1RwSNK%XBYS4@mYq4@B&&x8J3^fEp9hTAsaWY~ary>W~bnfOMqJ&pk;cZT9? zs(zgts0HqKCGv#~TpM(@!rj|Rp%2lfuJSoH91GCQ^66*EtnoM(8;w@Z7;zTwTGK(W zyT9+*Tx8cWpwZbX@K|H=*@JHjzZgD{IL;IVYMGO3DJKcDZ8LRzJ(MdK0yp3<9x!7q zuwKZ@qir!eaIp>K;EA1)DNub(j3>vJ|g-E^WG)~<8 zltv@8CU8N}NiZ^}s3i%zv)}NTBl-1>7*&{eFp3s9i>_i6`zW+`95PH}*lBPes}N~o z291nPoZQ@=$&WyTHMA^HyQ>#rlH|+4qaXpE>7aVJ9!)j zb^*kA{jbDkpl;85gj5pfnq}F<0-t4Jz&t6Ta$30V+l5w1yF)94K}31KHyeSZ@ks%& z&lZ|sC2TAWw!P^d#&1>gaY_2X2`z}2XMa?Qdh{0I$Z*ZdPQ-A883 z?)3_F!X{4}J0MJ`Jo`;4Uq97E-L}4j>^?qJrLTuP*sXTWxxT7L{%y(Xm6yq|xmlGk zj?WgSx3a6G+8_Rs(`zl0;dDDFVeFeVOKU|_Ni{lTmDMXL8)bJ(FJYXSHOpwFS4lNH z{2{BCQZ~x!wphZrJZqNOYO9j!w@_Tv#z=#IrNh>RezmNZnsC;dq&wy?{>(AvP{J7E z5eZo}_G~6xWB7j$R)u&}Kvu0in~B%{W6<2QnP|-}#3K{3`rm>lAs%gzReR57lC}RB zH1hNyTq6td2!*Wvw_tXNM=500%F}~*?LP+1JUxik^g=vRA*=tFz&~BD$*2~BcH1Nf zOh%;)m?h8TC`Eh&rg%Tk^#qylq$fQE@j;Fw)>Oe=ZrzZA*5YH~pP z<3-tITsb26#0|(ENSVeo#6NF(64R}^_6yGKD+N@!uWl)Sw;KK#De1`6n0B>1b?*O&4nJon@I7a02SO&h|wD6?ZO7G3e(U@K{+gV)+1JR8X*jJhj&kkP#kYkyR3NT2~xQfbUw^)jFg;MD8{1WNb?_ltb z>0)Wc7+D4;3JGx;AS|UJ)s9HjiXP*yA|1c|#ERxmU}`lUc0t!heUU9I5+K-EPii;O7QZ07})X z?tP7k7-?$nMUVTX=z4mgo~O;(RwyzQP|8sW?FCCAf0Sn?Y`%wI>ELR#@2B0^?JrZK z6Mz9Q$;aKF6XYsXZY5UT!|P^oS&^ln<@Jq6CN`-+t5f$&Jtb_@b_3-*SV-cpUps(u z1V)m@VV~N7*#j+o_O%Gl?DR!LFxfSM)tGQ1=0^eCXV@m51&a3rP*-s={CXS`Zs0rT zJ-XIlbhup|v<+7lr!eJ+?;?+A7RzCpc)8MLhHNVlF`q1|QMgoC=4dkvb56TyoF{8_3aP-jO3kwiqsRON_xbs z4qK7DJ(@8CMN=JQ`cW7Qre(!onKb@N{ib{pdo2u4u0{1P##%4nRNL5HvnNH#|3!cu z7mm}Yb9etJ$9s~FAZ{V1%$1NoZtLc^bY$}Nu<&+hClQ*ReIdD(8{Pjq6E zFa2p$KSH_8Sq(e?V1FRjuQ>S}vQ|XCmINSV#9YSp(FFF!J{Aal-&qGo z`;Jmq5;Geh%6{&xHFYf~p>U2v7BGy-5|ja}7AMNUXKgqleMwl9N`XhYdI7tJg8#rP ztio{efEC-)TvcvZ%7Xd=SFEDWK2wgYruW@3GQnfJ81(#vJC!r%%!#8Wm`s*EsE?%h zCgVBgp%$o=6W-sCdGGt_D;9i~q$}^8Y(d%E6LmuRYm_*a9U}{SB^|Wtg0qE9qT1`D z^bGY~4d?Ixz=619{(F8(TSmE;-gkty7gZlHW<&wByyPjs3x^g>!Bqr$AdqVPJiXCgxPyNXrr_-Pb0mIuu{mgO z=cQL}7p@qKvxm0++%`{WUAb|)Ob7z=h%OT1vWBxx_%q9pu-R9xI>qhYh=P4CRQAD! zj26%R8bE-rihS~t{HCitTtZB6a-t~gC(L2YQdY7&G}#%k9VImU^y8K zzck-QfAJmJsUT>3c{Ldbf+sL`?O&uU>*oJr{^IKs{w|bsF7o~X*QPJXQ4i0));B*# ze~ah5e5-+>& zi0I7)0$WA6fYvs-RZ2Nv47F^?Olq8qQvW>OZ$vEaV|DwGw?jaGJhpZF?V0;79S=>} zdJ#;drZt1em!)DF(s?~uj{m{kTL<;=ERUkW`QRGd-8HzoB@o;-xVu|$3+`@#;7)MY z;4Z=4-R&;lb56Z;>)oo~eg8g++RyAvcTe}sZtqBUkI9#{uS}9&h%{LPGG(RHL6gkG zO3H8rt@<(;xh*t%ndNU@A5Q2=5HO-ccXn#7hIIP9M_Qo$t-bw^wsm;k=M<9$Y6X!DP*X+kDY;ho0Z3Ld62Av1)t*%6n|?#I?)X z9S({45A5L|WoTBo&ymId-ay4!;lcQH&DT%!kFzOT%=8wD&?a9>0_}9)w{1 zUBrv$R+Csf)*yS@1h)I}L%yf&!++!`cj~wk#VK$`PC^K=G+g_$UcZ}b$4@g5cB?5F zeD3$+*7kMyO!2`YLCK z;R2J^pc*rVfbifGU%`42p($|P0Mjt>fcxXsB}=u|jX(~@!^h97jlQhL(=|{2!=7e? z#aJi6_I%w0Nikoi(N?ad>ki#65tz?{toWVEr8C7K#1|1`Oq*QP)2IS|!o%tzfc}u* zv=4-l!ftSIY2xl(WQq)UcapT_U^L59ZBjVeZz3o#YhGoI69l`=22>OM3`}^0Vi;BYy#PJv$zy#UF$z$)oMM$mqo_|}TpK!D-$)JIZLVy~l z>R1h6Ql1(8G$R~1ytTi@7{fDUbp|MEEbk&%d%-gd7lnp9MmSAjrUmOWevI18yYDNv zx|4RCi>q`3ACLqcZO?>PqbvoPI&B*72){3mJ@wbLxl-4ps(J9r2Imi&tiEq>vyCI; z;1U|S_lVM1xUGL>tNuivGIx&MgNuvm*<<8nX(o1zhz$F&1u@E&etJANCKt7ulaIJ( z$Jz{%uXO_~wXSSKn4qsA7-IDtdl?ruTOAR(uqqez+#z@%rGM(&&aFq3HOB%Joep4e zopP{)SFD~ZgyRzCYlxB=+PZbFuLMhU_TUj3ssD4Ye>?wY0x(B%!-x9<59ZNhgkWS2 zxsMn<*|w4EpKtXKH&UW*8n}82|EkFDDi|hm?%&+pMXtdabWQ`*aAkXXFcG6^R%3#B zzX5v#j4DdcBC)Jg+M8z7P}G%f)z-qxI8wsZl$GL9G=`Zn-I(2SUUOTT*gl zCVTOx)n>$`?&uKoG3DqQneio;CmF&H>*`1JvdgMHs}7g&JZ0Q(UW=~fyN6~xg} zTZGBrX+C>sIq(+X@C9IV0L94@^E9#OCbL0_Z1;5PWLD!dmu|1P0IkwVf>9ZO%pKCZ z5guaTKK$6*yP3eN7zx;O0j6lU-56xdigj3O%<##d;FH~=hu{$GYHVmEHfZPE@vAxE z)IO!(p*s4U)q1w_Jk6MUKEQ`VmqV`BA*l=G;H_#x5!U(@qVgOr$uVqHIVCtGU6a>l zg}8W`kH8aI{yfpbzVga}!QafOK=vlH-SIIz;UHlrgo)lk|EvmI0(Q2mNvx9GrZd82 z38$`Z{zrJPo`Pgbzo#9dyir2Qu?PI8YjzgRUAueW&v|ol)tL63LR&;8ZyD~IhVR!5 zbl%J1=^?t0E;UmhtCQO^%j=-DTdz+ndQaeo?Wp|=8P+!oZCh~I*0&4g(|=K9T%QoX zV+7F25b5gM7TT^^843d=3r^tau$ZW<3D1bVpFZZ`na!#^lG}ZSS5L{jKJfzm<(=3V zQ(Yo;nW9?Tt$=5iS<71OYAkZzhvI7uuth$acxcD))6rQ?-QS>+7ZF&BSvhV2;1< zP}l8*%RV8Ze}DY0gJSu4B@uQ3s(Ox`n^$atTwv#)Nv;yxU2|*Oj4TpX4 zpM;(Ct=YOLvm_W0DzMy}+5u(aj`G%y=G1IG7gqit0^C0u+R(Z(-w$lhIvQF4(h-As zbLR*29N*~IPAscv=()0%&---`{SNHs3TEJuZq5Ix8DOF4XxnUE{Gv^^eFp3J2ed#o zizJv{6)$e+OZpkG`t8boo|}^I$8;}%I~WrUy{VsB>j!pNLGUE;4~Ny)r4`H+=>Wh2 z0V1E(*yq>YJu`iV(Zal9@tVa!4cJ0_b9>Xz&squymWfxWzwtM$&q$q%3n8hC$e>U4 zRbU4X56L3Wk)-_RY^6bg9WaBmon&-weUn!zb3>e=u8=yxKh}lxY9THaWByvxk_2p5 z&1r^cqyuBGBpX!Dt^-a7axr=WL1PQR@C;go6-x{*Xyb3f$R`kX{jN6pxO~+H6sEsK zPb3j@QI9@?yq$7#6727oHNuY*as(qSD4?Dny3De=n~1%lL--6)<0w!BgJ70+8Yamu zL6mu9{L@nyRlQIOtyu`4`g)o5y=zFFk2Qu z7!0v9aeICtC~>2P;v6K!c;boAg5m%JjKKiKO+qBm608hPQ>6 zy)^G=SM&xsNW_&%h8eSZwcsQ;Ry8Zh&X2LR9=agOK5Idi(q64Te*oegrk;<@Bi6L{NrNbJbY>Vg--xy@1?+T z!|%6v)q?dAMg;;$Fs(iLeE^wJCn##wY666_J>v) z1)KUt`yl=^-_aovUZJm=`gpe{2GLpZdkdwdW<=~tL zI~zYisL`jQ02Tovn@7wn=cvsw_dHgx&wvx;h4aF{^Q%bC0dLGrWbxFYpkBI-!6H6% znz|>=5JZ39E=KZpBs}o9?=J;hRepv>9enxXSSRSYjDe zx}?)G$~ij2#o7s%Q6IpY3v#h!-T>)`%@(DXq4`wq;J(PrB+H4d$Qcspc$>lBpi_L} z5DaY_9)|%z{o7x(2G>N$y&pvKiT*fDU_=OYPIb_Vxv4xf0~6CLaD3(7KJ>glwD6;W zXiQvZTA>MfnJGUBW9kEomd)CghlPgWO&aISTgai4(qJ-1j;o{P5ltif*jDxAsn|FC zohjj~_5?3d`Lr|K2pAiVQJfI5UH5|vv+#oL3kkWxgYYly; zVs-qH0DC|3b><~w9KE$>5DIBnu1jeEZ7a;i*l*D&?ty%som%+R#cfq(733fqD6k1K zrA<1M2=}?~c)hXvpiQl^Ve{8FIpZ$B>21%qQ{!hy5SnuvY3S%=f+eueSf-8+@7sHhl0*5xjfrJz(4-t^GYU@MsRsnDiApa3iDQfzcYD%WW8KZ5UeIU zjyUTgS6s)(wQ4dFhF9LHoHJwJuO3GG!EWz~$_Jx_V+1|Nry)CZ2hRcV`4=$x9}`5C zC4*gyN3LV9s#v%H#zSr>5MvZ<%$U@Z{)D|lIq9&c~Pq=bU z5WSe%hrKM(j`6CobT6tcL%z3I#?O#8&|Se?SM%ajzj$8 z;J1>l1_};A{pJip)}0vU@RvAVl|A%;{@)|$m^7%SsQqHDN_+uAs)?|_2Qo2(EW_1J zrrf$fANydC1yI0YcGvTBZeHBjDLZ@}WsnQ&5S(B6Va^@;r1zkvZKxX*OHytr&y2hn2CPzB$x()#YrW@~TNFlr%TuwTKpj=coIRs$d3&t~+%v=`>~kx17ytL6ab z5K0xC?_g8DtcLiQ&6-h_!pE0rK(EW(#B`NUiZ19h>=m?pbF_!fh!lg_Eh6Gq3wC9? zfNT;5F|RG~CoiDYwk+aMzcAhxIfmO<);YLhbAgKKK5NeGXF6#!ltj`g<9wp)SaxVv z;E2vghoST=-peP>U^0_iP)07qaY)NS6;g&ytLeSpqNR8B6}hN{tXu1#7z9qfXoW)# z$O7~@K_yTduUMt!BdRvVt>6-R#dm*~$9L7U>zKnD00|d{rx^Z~4m|4;>8l)cw#;nm z=$5c&h^Yx)M!UAG+uv{2V-8uh4qCKK9(up4FCD2fKd$*@9~dIWNo8@|>(as6YK#y; zBWJysV9VzHeR&wkC?KYTa$vv9#u_P|Hfo(r<&}bQFqZ|ZCE6}qwUh39cj}_Cfj5ch zr{c#lCxyq^fV#qfMb&dMQ=?{f)NjF+FYyewT2WBmWjLyH0F$R73{NCRpE6_!@pZMM zV%F(Gh|fha@pZyXK^45quDTE zFrli?Ovu|T2Eu3YIk(}FI-0bsjV2teP~?LgPI%5Sh>seXgLe0ThC*35{#4Pv#c zX{U+rWiV9rl`;*iMQG*xpe;**|IuDMuakakxPpSOBK@KL5)ygu`(T9-<9&bUk5NAR zCC%Tuu?`Xq9=sYfve|K<1C~g-tgjBgtA%Sc7B!>NMOoKL)~0jN>h9y99#*=-@N96v zk>H8cHtbCpUeO^;2dfdnMu&c5Kl3L{UzVT1VT2;}#s3DjE@Q@Al%#aLyUJ$$Pok8@ z#v-up{n6bzy%4ds1l54}rt_E*=@v}#1aNw9y$PYSicHLgUTz@Fl5nrvsN9=AzFhvg z+v*mAo$ES2OlmH}pL&Vlk}#~sivfM8rv0M+^-x6lqs0-O8b$6PpRVnPz>B;YT+d5h zI)*1Ormu}+_AzzKfTQT8SNHwooU}~qt%@=n*_fm-o(Clq4W`P)+7SU%qE_@pY54@O zOT-{xO9uD3Q+73nLFp%8JUKvj;!J8o#woK z$GO?^#C>>IQ(&MP3fGJ)XT6NGy*y??m1s=g*WQmn^i z)QU$(RypqAMbz%(Ray4AQV@I`9$R#v9`*u!BT!A@2@RSu=)nF6Q#d!QvsC_RLIYfk zKJuYBajTIMjx8#7O}cZdwO4a#Ar;nkdh%t|LOpCaREV`^)b3noacMEa@oFIjWzaD# z@MvY7vW+E%CObClhY>TNRyj5(tB*774a2*PC5alC!oy8p{KMjo9oRSxp{8j>R>9^P z{|LZKN@fNfu%@O}@(o+9NStAXn<2p=OwJJr^^K6HT_J-^lIF0%ef0#NTjpzHl<#;Y zr1!K7o&_U{a+w6?m=ze~EF+ruui-Cb&P5>@k-0{bGtNSSp1&6-vvUP=yz;j+%2s@~ zNbt)rPNr48JLtr3pbO>7ll@1?#?@&0t1xwM-A0j9DzUjVA$pHZfgo`LWDa$~!}BMh zN#|iImI~nwb&P`cbmGeu7#3E3c?7b{Bnze)4dQ&_n}sJgQ(Z6v19%9$pM#dZkm^27 z#+(QCV+mNF=^Ax!eY#4_dyIV#=F0N5pIfDhA3xFMkMdfDs_`v~$Ualp#Oq2!3skt+ z`PdR$zYbJyKnPRwFzcAC!`kZ!)>TquT)&wWEdn@ECPRL&eo=$%u{ZfA`%F8A zwFC{jZP&T<47@w6ZWSL1Vq)(gj}KT2a|Ij=yxM|7Z*x$Ofp)#ChHv%mnmTw6Qei9; zx&8z6fO@8ka*{=KAOGm!^CG`2+H| zm}cRM8!k?#Rr&R4`5*b^TUO0pWHZRk$;y!Jn8AIie8Ro zZ$IgYo#`E+(aEC}ku&BLawKk+cXzlzsd@kdX9SxCftg~p-LWr=9RZ$TZE7SMrOh>F$cAc+;Ad?mdDh2Jr~C0kuBQxx@T z-kHMr?0mOUab{r_@QO|ADAjW0T;CmCn=Na?v%A?nqn-N;cvM}vQdpk)7=H3i>;`Bo zrgxMA0gKiTNA*tlKlvhykLVRvHQ`mW`Kr|d#k2n^Hne@Muo_(nZF?xiVDS}BdH1;5 z9M#(a*Q5n^+C4k$U%jz&yHZQd99@z3O6`cDUkc_swh+Y!XB5~rz{1-^sYZ5RSPbTZ z% z)c!@mF8@dT-l^^$%J3}K^bx+yh3M99AbkZS2~)FD(@+TTVOxV za*NkF}R=L zT#V+Y%g(jt^D7+h*S5L&#GeGONV$Y~mmgj#>0YQq=57D@6sD}DJy@r#&AlvtxwCCa z0c@fge*NKa9vV`nEHd=9zMVJl{e%f_I`Cr2csp<6OK_|9-zK`W|81hHV*M`@U5f_Q z(YcaEO=qoA8_QYi^5$}t#(LZa)t)(v1x-Y)QUl9R)_}Ee;?B912A>w;c+ybq&ZX5N zpO(OQ(j@SuvC`nz(j8A)tlhaaY-&@tVMJFE@09EnJO22~1OZTX6AmVsur4nWY(9~!9vCvk~zFt*AxmRTY0cB7H(*%4j zzY;QE9d}+fiki>ZXMeh7;x_+n;qlaX%14=Q5a5Nrbiv`aVMegcKm6S~f z8D1aC_pTd!Prfz%6`W>^fKw^B?rBl`3K^*e2Kv6*Ykc*5ygt1unGLR8or@QMaNvzh zB800WHzRUmzlC_TqN{AlrIW%@!774ty<%GEPH#4t;G|T{XxB!}Y}1(|1Xjd1EYTgP z(sH4-JWWl%!MyNY9vEC@VUKtLPBahdf1|%Znm%fFy{3#<+xgD1nSe13N~%<=@`;ED zLm>z2WczE4Wxa-CD?VXvQ>+UVQ@I6YH>mz9>d^rPb)rEBv>O-sGdp#^3R6^Eur@z& zWpWX+J);LOq3y`gL{Lm_4U^Rgi}$pf#jrOM_+0&#FWc#>L^D~Z9@D?-g{S0r9TEux<KbMcQ16y+4IXGmT;8Dj5CAMgmmCc>COMvjx;x-wg4fBl(g{SNgVcinzm zf4A#e0zB;j8vXZu(&3eVi`$K{~EI!b6z9LW>;& zzoG;*0iH|pdITc!A|CgB*;&kl{~h--njLIhgg00nF;YDsqQoH98tfx% zYtm_sf7I^hO5^T>+kqT(lLicw=IVpx>lt_`({vMRP-3{BY~I6uY-UuEKcP&aITi;c zUtSKsi0_w76g}s_epjnDK6~oaiccuR@Qm!%RLV{Mywqr5=oS+Pqpl<6?OA?V8ohA| zG+c_sAw!w$=D`<`*gx4TR{0X%9_Qa~D<Qp-;KO8QXkwbaF5@uzpY38d|_{u`v@f z6TheU_~4l2jBQMv%!pZ-x!8#R`GaGUFt>6tb|7YwurhEm7Be=o{bmd&AOQDoDsD@e zs@As494N1+dcyidln|Jr;RU*?R(^QAObpF#4UL6T@WL^P3&mD6aT&zek87Ufed-N6 z$q3M8(+6%$$V7zEq~L<##e4b^kPg2CbfWX!Cf$$qqut1bZhBU|5|0uv)krzvzI$K$ zZNC|Z%&l5)t=inbF&|{;C=jvuuXGlgIUsBJ9hcRn$W3O>65TLTuGq#$6Oa-FEO%|s zI?As4c8#lN#rO$|bK(zSjaP`QvrN(ZCUVQ5za%GfD>#36!vHp1AUW|=7 zscs#&$5HGzYA9Rerp@9O%fU|Z@oiqrQsSXB0@I zs%TVe*bwBbhLiqM?PK){pHewlcYVSB;klvD-i#CEyDHaxvDULOYR0GvL!I$aeuFf;rzAAV7>Qm(b-3k+ zlIqv5LkKMWhz{w*Eq`CLQ>gwNeB_~OBBip;Ap86I+*Q^O&9yYY1w^>y&& z_($=}cDKe^Gnwg!rRG1N5Hd#Hf(ScGc_~oR!;oq2>w3opxY?1H_0z1}(|&H?G$};a zmZI)BVIBsI2-oFhfM14THcQ*L=Nff#6_)504oB@HQQ9-3@$i=OJDsDkJ)LyT2YQ;} zQS_F*MSKQGCyGtdejFF?BEm52tqNcfDDUyx+-!L55tQVM)i{^pQv=?Z>i{Y(^+!7f zHt6|U<)J*LU1U0Ue%5~aZ~_K|2zs?zDOF0PUz_1*LugX5YH5f|m(9C5xcV5#^$%R` z+WzhiXfiMpc_Rb8xzG$>5Y#1>0us4?sPs7Vs*VWH*c;GW1ceg>(q_rV1)@>vk1N+u z9x9f~)JgMNA?U{^Me8>yP6HLY)3{*3Z){Z-3DQKf~Qsyu4c><)B5x0 zR#CCbhIUo+PI8T)cP=Emfftgg_RgnBlOXSkW(cF^q}%bFYw32$n6=eC$-LUr`6GB$ zQ89}^%mutRNd%|qr~4=#1B!PtQk|z_Tg>u8)LB9Yp_mt+OcVzL9#BjbAY)vm-#ICE z9Lx8)L{{#$F7(m)S07bT#egg?cK^P!vY{_uoP+}A1H(H>y$kw)d;uvVSr%H!5(&zSISy-;PG#Vk_rd8bb%R z3tm|SAWYk2720h~pY!c}qF!l^w;D$;9Q-$7e`C5?YHV-{&7?|=aWK$;J?L~sf?&|h&X4qhBOfhaF$Fjb*xwmxL&LGkS@EfTsg1Z#)w75fyTp-9u(uY^FTp3c1 z{34GgB^fx_#Oc$$inqtpXeluzwmQZM;?J)(RkmFd z7chky0X*WZDIiDMp?qLnx!Fykdj9#_v&3A*Ar9ms8?C2=(YV=aE8erjN)_unHif=x ziDQZ>F~&IXSmptbC6h^ahRh{3nnMOj*4L9yf;a=Q^${M>-NRX5|G~f7EeAw9#!2MQ z*HAA4BfP8Sw|1^FHEBch1_lIMalnUmQ2e!d;I#sG<#6U)23XM ze0Z&xsrx@=aRLQcvtGDb+k^G9Oi$v zaIDmCR3N&Rw^**|Se`EFl)AM)6Lrwa6_uMCQX7*mJkRb{s`}PHmiFl}ydG{;5}uZP zQbc%}oz~-jncb;m^mTqLoz^3GJv>)yt4NzyxoWo1RU17jao71&S-R^y+xnh)(_Esf zHhWa!p`%h+dg!duR#EalW@1*BZaS;9R)o*1Tr|__s`VX}xas^4nTen5AnR3x-5yJe zI+~vW_P)Hc*8{L;ai`YOvGhFKR)4g&pv4=kX!w0p&-&HkMy<3%^Lci&k`NHCLep|! z;$5z3J)PIXOSPg7o|oB;N+e%^_5V$t|3}FGdwKo~^8Z?%|B_t8Qc__VGq9+`^%eQx%k#Um5%DIXtf0KZkCw;|5LOM+X_`aN|(1gNuQ}<3L<(fb!Vi@t1-9m|C1pLT2T$u!Q;9ljf$I4h#+W2o@VwHZiny92LH zL7EqS3;62W{y2rCS1dJJsuzBXFA#7O51b!UqYGD194e97Qm!GNPt_7h$@r+SQWf`2 z3rX*CKZIMshRbmqf|(>u=dP)(gg-Y%DY9;e(M`+O)ZpW4O?cUG96dkbMU0CJEC@YU zeYlG7`IQK&N#urVKq;))?Y=AVmHMGB#3*!dezr2~yNpDEj#S6`n(@t8fE4;?$-GHz ze@FG8)ebj+%^YCh!-7=LihF5D=Lly-BBL`Jbf)qagJ12Z?Kjo6_8d-R_vuW?!XSwOeNMzRnmw5dT7DuRrwgQ9SW7A@g>CfO!akn zjxx0>KkO-uw7c66-WG<`nLuLA}eB_6k)awY?boJ zs;d9AoQ3h-JNh6LHBh-LP&r$i+``20b$ppNfbCLe!$J4IxBJ)GVaUbd3~;SbMK#9_ z&sjloNqSBSFUJB?HMm?AJ@%~z?sFn6w9GoSH5p9e|*n1*e7)K z^i0j|FkS;&S7^)T=UHrr@Q*BoEB2l>ca|VGQqT0>9!d?SVJLgpPoeEI#VPLCT-i9} zxqN(E2Ek6}##(-g&{8%Hz^DayKJt@8fZZp3*P29!@(?_RUwd32*J31AvpbDmogAL; z1yxA(J9i+Q9>Sb>2ukg))XQa1Sn_B%AbGel)x~?RDYef%l6!H&+~H%M-_z>vc>a8L zmbVxF?lE%z$m6NzCCIXbMIp@z$#sO48&-#-lx7{%}ed!5fqBv z&Yz#akGB&T^#J>6Iq>fLFacPp#p$qL5%*{Jdf)Qfp#{8KPV6T}nZ@C2(|CHPu*f5| zN`-dMYc~crTP(efM7J^d?$NEMFx*qAdzUHJJ6E$+Zmddm>wGk>`l{rt>UIdEjZev? z9zLV5(!bqXlQYgj)tw8^6s#Q>b*mG$1bw^g4fRM=3}??|FfYR~r>2I`e#N*sc$E5q zlGRCa8CL1^`>REMoLcAy_NWcA+|k~D7t^5aq{W^%$5dRCy`kyGr7OUcJB9t-3uiu@ z50_$J5tBavXO8A@6KNELpW98LZ4?y964*kvp-#eZmJy*=*1+urCHD^AlyjJ17lr8% zNSkICjX6~})a2Hu6~u=(G?(cw&?S+4yF&fI5q4YqsGPK~^!8x+u_=P~AY0G%ZInj3 z{!>`NH+kbQzWT!Qhq(lH7)ly0`V~cw7^{bNOWQ(ij*08+&kjkRq2S{>>}kyu_tFyG zjkQrw-mG3)ke|%5Zc5i-L!X&9F!|lbeDE3;2vB?6%7ohlzAD|Ji%KXo?#aKVH#l)c#tuQl_qw~~ukhl~Z*@t!l#8?)hsGp1#@eKY+ z1`_p@JK2CT4wU;i_Nm?%RB6u}Vla_DL(xuVh)t%K_i==ZNV~()M>yi)$1DeJQ=-SL zeD@vi!k)hVmsG=nzE`S^rzVRPbeui2WkgVfdxe%URDIiQ-;^NEQ!|A12yWbXmt&-J zqfSv>aU=Q0^5U0coqpo+c2mR6rhS;R`_rdk2l>BYE9iZZh0&I-rZQ(SK5?20fi3q@ zb(0FL!<=iV7dqTBOxI%&hwNqkaa1c0fpP7dE!&PwRM6uMc>=kknoFePw?VXDKG#ts zP$)Oq41GiP*Cn_-+xX4zJZ7z4b($-fn*LW{W7VCN2Gew9$!1xf+#ntPFPnt&qIYim z#%ZIE?#78I*D&i)dAFtjXs!0xLFgCN4+s+ZDbVLK4-m5b_>jspyJVbB^40fX^JID% zip^zisdRl><)0(1zr5w|Pdnxpcwmb;Jh9@=b&wn$TF^_1Up%R$rq9vS$0Pf6UEvol z2x$G&e(X$zL+XV!$oEIUP`c)SrOrM%nzFyXk;Zl{KDe{J7Pjzuu;?vaD<>-O-3;;T z;M5bGq*x_ZMKp{3q9OZXtuywQj8mk2_qQ*Bht&{?zzVZ8p@l1|eZFJhj z!cs#nhX@7PuC4Z#;NcwjN=dgjy>b2rO8CG8e^+{O<{?^Ud>Qq%>ff1Fa#e<8NI&mS zMjS8Jcbb<+N={G{DAp-IAqE>4!xI#D1s{74(9PBSf)rRX&knpHa3xXetC40bCi<-Y zhlHOc#Vz}q%8QW@VVHM29eb#cSCvx+fc8KWiq{01|jpc5_3S8eE1LWPk=2Mo)L(MSy$O>8J4Ga`gAY_%l*{n z$j`$&vl&e|aUF9_2ao%QOhLx{RCpTsRQIBihQsCrGI{fTP(WYcnWXvX)+WnSxu2HG zoV}@6V?a?udAdZaeGn3b)foVZ_+72zUA}lO^1)&U_L86WagEhbufCn zsZlT)33QIAnn;CWurTjA2^!xY5)esoGJkk>nD?jR39sWV8y{T!t_i1g+VjD6OYDhi zWMPkE(f27jjL#oBAGhOtR-!>7iTFez{Es52UT^6pAX2lKZHn~JB5(J zNa8m`ojT)yI_g>HLjvvu8 zg;{=~{QhH>p&)}hA7FLEOj24**`=|6twr z4D`mMpjhMvo+l2yjgD{Ft=h_6D$J`*idM6ZCU16&#BEsP4t`Gbi;7t(&O>D7^V0C? z`|66&Dg^<`iGK# zp)dXieO)-7R;Ehr`Fui};1G1Jfk)#%q`VM#4+5|aCy;VN1M!W+sgyl|6_o`(F!|z8 zw0rDu50S;s;R6aI=s?;{q}ply?mX*!+=$xCQy};2j1I5dPC^x*LSTi&0j*l$S1^1U(FDz|7A%P4h20#*xq*8KLwmGj~NRTQ_Hvj zXXy$#a!AwYSspN^8v`B-ZMh_k(X;ydNg9JDF;k2Nt4X}SE>-L7LByHrtKV&Lr-xhb zs1abH=1MM?KDEqCeij$OX*GvBr1M!HidM)+w5i;Q6ICl~c)!jE)&6Q>xZG82ByDMx zq}2CtT2v>*jkb7?q=v2Yaoj6gn*p z&<`<7VTvK!QJV4kA`b|5jpE?V+=U!LOc#pXst#>r22(0HGc}7E80ONfl%5Ih>n=Yt z#c5u;=l;+``am{(Ng2;uKSV-m-Z>7d^8;OJU|5O*$yHRAY;pg%IU_+0@N%xY)XD|= z-nb`svsbe16VQ2BfYX4ad;z*l%8xvCB1%d5>)^n}M7j*R#ppbtAjqI^tt!M;!^hNc z7?G5C4%cGjpsTM54j)}?7ta_Y{;p&82>ZRfN+v|?4FBNyxho)YK_Kn(8*KF36@U*|kxd}&EH1n3cK_a93^_k&rF+$Jgwn2&7L$a3@*)JG2U6@-OyeY$VQTHNnw5CB2Oi#Dr zLONwU_ixk$KU#sdJ*U&gWHRgn23*f5HTeR&yKAD_B4lR?JPqU^j6#e_gJHPWrkDgZ zXc~lpw>cPw-a?`;;15nPfqf5|&Gl=?kB?F+sRYIf#!v@kNGD=ovhj*aVf@cCxm1yS zPUikMZUJi%hM{Nj$Zt5;%U`nhXG0&Zr5Vs$)Oo$Z-6iDRx)kYdA*h8!r63d&_s>Pf z?D(WkH@f|0xgV9|5>%@2mdO?FY~O}bzT_kl)dJtjuq+d+oSE_`JLTqDJ-7;1OMGi=TJa_qlzPR#%W9_BKwZi zAYk7PlXj_`bPVx1@jysvdX6Mt#!3B`yzvmnL;`^`&cq@ZMywb;jDpoB>44<7yvuNB zq1-s}fTGBQ4>GBUMa(WA#G$P~j@(v*RC~PFKLQT|2XB!CL`i`Gw(x?}kxM2&?_YSI<>hWBv42rlSJW>%gnl^aKDP zkIBG3ktO6m2S~BxBYUF91Pw9XKc97+%x3lA3p^i3H@YJq@KYXw_szmZk0 z%7Ce%*_1fw?0rtZZ-Zzb?uk9 zCYxd0lnWj%8^C?4^a25UXjYB(gso8)HXd8pPhu;wp41<@Rx_XC0LOB3-XZB_U`d`B z?%TM8DwS;YY&vQ}!W<_auIRh$G61&IDoQX~!#9=Ec;|(~tlU6Fwdu)-sBQ^X3NOlS z3^^B(^#OVcD**cpZ&vC^LRoQX!OBdIBIc_xt%2)=pZl<vpHOOs&a&itZx zzD!{mgSU6my~J0m$5tg~L9J0vY(3{i(l5dq$aLJ7k|<-5EU@+c!iqMr0bSDa>GOEE zn^mL9v@cTuWzlj**Unh#90 zkuqA(rHR3hiE>3q@B70)c`h3gXmGBv?pas@#oI)D%`Mv>pZP@~v?*e>qoJ~u?ev@c zy$$|eb77+v%smd0mwAf*j)%g7mUBG&d8e(6pBWp^BGu+oqB{M($X%S=R0#e3g-5?) z*)UOKzFI}~3Mz|wQio7$G03m-iq_cicAU4p?H9*guMkfRjCL;Hy)jCM5pYP%xD0y6 zxWRgVv$9>ioF5J4D72~AY_30_ z(#C6*czy}YE-Uk}L|3Z;&k_YI@ox{C`~z}4^5is(S82OPa;W)G?%!kl%b(YuXzPv^ z#THkv*pR2vQ;M+x&EI!7eQFWZKAdu09`DS4wLYA8!gPLDw@FULNicGtVkc$;duZc` zj8U-z3=#ct0$#Ga2^LO9edSmyBLsA4bL1>ICuMNfMDvFc`JKN7RsWw2$WAHK?jab-k$b~SAOn9``nY5w7|>C$cItnjl9HmniQj-Rq#jdY z%F$8=t^XIAIQHL>TDY4R&{JB#XkT+N4&_I@Vma4W-u>O}k~rq&qitk&+o3L3`U#W% zJv3E%#oM@BNgFBbt&U09KwTE|b#^T0*UEdsFA8V5Xx38tyxwDyVP25$6KAiF?y}4X zwN>H9UdZ3)2Bi8=FCAe<*Vrk&>_5*|k_rzPb&zzvQVp10+HqjI>&L;{0W#63r-JuNW542H$pqEByv7D zW@+=8nAmMFc~Z&Nfss8LZc+HIuzLCL=dswVDa=P*3>y!Gw^jO=5h2=#ANRU&RlxA+ zO*gT&xvBR;+nvUym58_s<1xSZNbO%L*U*^9E}IM`{V&GeI;^VTTl|*h&>UJy;s8?8 zA|>73CDPr}AQFc@bVx`Yx;eCzc<2&PN=jO!k(AKiM!)xY@BQ8PeV+FpW|+O!n!Wez zGqY#bXVyN>GUEmpj&?v+JV?4%RmTp8=RQUhYar-(G-|eV4m|Y~lHPip!u+>(MU_@K z(vHT}!o>VRLK8W5N8j@vSv(HCfEden^;*rOXl`cG#XLSj5v8``$GaJz-dM_4lZFux zQYNeg!${z!{n=BC`Fs*Ik?+iYC&1n_%>HNH5Wg6_UOZ~J!VqMYfxE7&49xqhRrR&s zGg(fhcgr;2uh0#=GpLoTsq`Ewmvu4%BIpN6C_^9g=Z%23lXy`)2EBROHIF@ zK$;wRu7@%e-bgc8{Q~1qrP^avXk=M?e3MCm9kI9;Y?ttMu_RJN^KH}eN5DX;;!N&C znX)-gU$ZNv@v%H4dbkwe<$4zZE1?@#;;R+YNmuqzu?|J&_$W$l#|QGr6M+3lLS5(-3192-NU9B zy-ORL*Gf6DeoGdd9MHr2!W3d?9sktXh6IFoXU%y;lt(&>;f+J3@~qfI3fFB}aiB@K z`@_bnL&D}dzR5FLMo7HjibZ>hX|xd2#f2pGM_&8ZRn5_3T!LoP;ExOvr)od;aS6`p zp8vv#!cpK`3X_SDDRxbId6G2JvZ~436J1D0PQ&KerQ$V#Wn1m@0mOj1>{;#|sTOVg zcG1hP$ASbt`^811)5<8q0OTfO-HBv@ZimICoZ#gU748=&kP9*F^YYL95TfPlMzY98 zXk4_aMHzIG{qf8pAe?uTwrBCvVA!A%Vwj$602QL1wgL+908N`3`SfP_0KIrb&*x;j zhQ5-Z{rtctw097jQUw_cRb_8eq1?SkSQQ63lk07=}hIf|w7sph$IQy=>pm_^LrtQK;p zqdV~{-p~D|CFD?OxknV-;{C|ftEy|*3oUn_)?~`W5Ua8)()&^BPQi=(5wH50)3*FsdyE2{X=76_X zJ6zezqA-CtZN-!D)~7k_arCjEC&im(D7zUZ#x?uL%_ov(le_=k!RftU%uh!V_E3@%dZpvV$Tj*2DX`d#I3g$tXe zot7q!D7LCO&Rg(eHS?p0NsYJ(z)*$5*;# zx}`Mrh({hz+iYn&(~#)Kpi{i#%?+?E*wqj$5qYSt^#z*qXBqHhYzlG}yE5JJ)@@0D z3+P!ARJ9#AgA@gn-w=rONK{d4Da@}wxY-Yu%=Mr#&;LSL&Yys`|LPaYIY$Oc3r-Vp z*xM_V7G zH&Owx7DcbA&{-?oV^&75X-9)KU+@2(u>2*0`~}2#R&e8i2}DG8x~xGKYu*X4g|wqI z@0H(`C`h;xTY5k(&`DTM!u`)att6fKOD3Nt_9@qM5laQ!8$2Wy7horY^NRj zx@{m01pYr1orNmw+v~w;4`yBiB0KgcjUzQyYHg9gul(>LL2&&PAP$2t+kC6*3`LF8 z-3POe$wU|Sj%l5cf<8?Km$Xg;h$6kR^@MXWH^7FKLZJ6Ige{Gzu^`Ad6*M#CMLzjPD^fLAOp#|;-!PWVX z{I#K6xB3Vxtcf7U9V6soCrg3LGS+^p z|DwlxAVbsQ&-Jol+zEVo&f$Ez^2BGcovN;WJWyq+N)NpF zWdAb^Jwx>(_#`2kHPMopQ4h@(%{lWi>WpYcv~CWxbq_9~G|2koxw|YoN%>0$X(LAB z3gZ*raz45xv=R1st~J|`>uXrxw?Wi$TRP`aT4Dnu2dmxOj@e^(nsCi7>1S7t;8>}2 z-XxUt#QtJwyPkGc;!-}k{Q_|6h!-nwg%D`4m~VJpml0F_QFSC~YUPh@F7FYl!2(^w zS1rPkR8Q%Y6*Vh6j>S^S9_bPqZhO+CjWC1LMs~p%g#kTr~iD z$)lF9G6RZu=vkX21lvcf&-!tv%XMoq=4Yb&7Frjq42r-mtmhS+$+hwrOU>3a?b*h! z=TbcO9R*%4%#_Pkbx7ExtaoHU6X$0hy!x@y+-dp4QMX|CF)w?%lIpm^zN4(=3pJic zLgC&+PmO6ZD)oN*SgJTgHk$;pt8j9rk9fT>)cH(imP#rZE|v~y;a)NZu@)MOzGJq) zJ3!<^9qYe$=LQ7~Hq5$!MI6pT?v&WZptP@*>#tHZYi90tbRyT7b)ClVMT}9?Cx^>m zPQoCYETS%X)6Yt5sl!U;vz4O1(mZfk3m>|dyRqi4Aku3(QZ=Yr-N7TCAH^MzkatjN zT(=HWs(ipw)#$yYZ5tpNxx!;DFNBo0Gbl6E$Mf-!u~UYBJA8fo)cOc{@rEkyo3>hVi#jfhPV^8DB}Qkynx zJ;h;5hRUR0{nEOijYP#H0>uiQ&@n^hvEcVwn7DlU=81rf^HeR-t(Ynq z`@*^|aoUwOI8HW9!-6Meypvlu-TgrfIv2YVv2d==%s79Grd~>dA?Zu2?S56~lTX5l z59e`k3bg9#1)dWcM8vlE>EZSB$Ho~(G;wwKzZhb-zyO1cbyF-?-&MNiAtI_%{))#@_nf{}F#olniH&Je~^w{=tsz6urpdqLAkf9p-OmX8y zJQtJBNT+0ZINqa-=V7h@=Qt@&Aiz}V6%c74J#yoYn zHV{+khnJ4dO2nB!y*#p3K*|yHYz82=E#?M4ec+0->BOYa|64+T}&LS<8UUg78o zZ!|=AMHogsYV5(hj?Loo3S2K&6#5-Pc&)9C9RZ=h@by|`wGv{o;_AjuYa80hlcP3j z7$lN0OI*M@-6eqv{!FFvix#cYqRGQjtuDd8GL9~VmdCOug*N>h&TNZAr}j?f+09Sk0vakQXoSG)GV#ecPW*X_Zp=G`-9sJqjlXv>T?j*S#+KDp1TwmCU0(X-GD)k}c`qwdXJ z!Jp&UOmUxRJhq#f9p?G3KWBV)K-+&}#6^iImJ?;3h2IgwTjn7q>OQlKJKY1`uGMm6 z>XGWD18dtUuykJHpOQ?^DMMx>!4l=WNpM7* zfeYt#ZtcCyrHmY7Ql-9_5_ymFfoAua=6gHUuN2N0v!Y-Yvh>2kA!X<)MN$;@FgAIg z93&hyo6?H7-%sQ@)fZlt*ki9?7(!9;fW)?xzNnvq`%wqex>0dDZJ+F5kj&~^VITkA z90x^I7p#Osl2YGkc>;&`pGWd|(yf4RP8TX3DN=509GfYyVT?;14H#O_&t=CW6dCiV ztcaoS3LR5;7H~J-5EYUVlZHM>%Q|^49KyJl4T{~5gyOz#s-ZbirPk$UCI|{wEY!WY z;nIANN@5ekyFIEy2;Q2c2w=o{?jOu2-_95-uS6Cp5vPZG3yrC@FPdZxh95*e@Q`U8 z(ZaD{MMb%Apn4Mg+uT*i&clWytdW=WgY0|^kC;%?G8L1F)>LK=Qk{89f}TfE4i;ZC zv>skr%$-of=q%R(osW_I8N$jHNk>zuwiC0eh;#84^u-sggu=l!v##8o&gXtFR_ns^vZpHC-f`<*34U*(4_e4 zBywDqu@Jiy^qHDdxMWibegqjSslR%ytq%OSK2Ki|OhN3{F1PXI?=$>C$-!l=>>4cD{u{XvjD=Ds&#lRzcn;J(eGEX2>nZ zrUq^?Zxq4&iWE#HBaWgoJ)BwpbM!O&o>GpH2nT*kx5V7Wp$r;m;}AI|w8{Q$b<<{u zvsBCGqiQ*!bBb9;r(|fe{aYG~VHAfrpZVUD@MH3Wl&!ZknbiYA42I?=1W3O|m5hHA zdTGNb>o03$dn{08zb_0MWI_zg6xwMpyLl+K%{TuzA**4l9E5u7kE9de5Y$^yh!*&m zt8_W^DJ`A*JT%F4C{KET-&s1k#G6DKJ!iDJ9z=ZJNJ8Nv!juPB1CZd)4uYjL+FxVh zTGC?5>{YVR14Rs!e~mom_ee%pGgxPYt@;oWk)-|l@i9(ST9=uB9t-wLE(ZlyD|tDY zC)fc0sMx6Gm`IA-BIG!d3-(UgOG?r(nvR*G)-@{x>2s+u5Ftu#WB`UU#t>xk5>prj zNind07Ug3(cLiBEk{X#Yv3!PiHNBV% z-bsM^Uo-5vO4Fi8^r;_VxM8?i@G4TqHuPa8W;SSGoX4zFtrEI+{nDI|+{B3~tz zaMH*vZiU1&V(&hz`Oct5tQ!~Ee)`~fMMgm9EAp?7zzp6+3b0_EvjL;hr`Cm6;Ui0! zs&Ijc!@{E=agm=x!qr09tVt`$?k83F(jv@NxNd&bnlVrV3O?@OW~rZ#oG?JI9y>Qn zjl5qbKE|oShpQO9@au7Cmh$riN+EnM!}k_U606C88Tt&S1$u)hn4k(j+jqF1T8JbD zTKW@I3)JPG)Eowz05V%mqNuiNE=NQ!JXy?ETNWOf%8(cu0Y}7Cy@6B$QItfE+C0r=z0(5LycK=$ZC$tF#dn zCDEnW0CnO<(5-&mklRI_RlEZP_Bf!tTIIf464Bs!Bb!e1_9|8q91AVQ|i`@?TP%Gv=?dAIEx$C(!U}k{_I}9&h}Bs?fYdQ%NSMKpO(A#eTguO1G~YNt07wznOtqJs+i!TTo#! z1u_D1fFn`-qH#>8_|6f@bkWF&2+r`2ZF)H_eAcKMRy$HjK3XmF z8PP4dXJ-Tl%VYNHQq}JXyq?3mo0uB_lw9iTO&xxT{fr|?P5f{ zezC?DkW{|$L&u1by5m!r>QE1jD9>=I8vEM)AaIt<>oq=IkIjLzZ@Okz=|*{Fd2z$) zO+c8L;b~sxbpVrVNK5kgPLka~$$)p?9DRmR0&ikg{N!0l?uvI$uBvaA%bdT+sU14Y zVPvXT_>;v5mZoTDz#tjc0gT4&+4-=T+Gz3*(K}H)G1iL$8!Il@lIRNYQQMvhed#r* z=xk@`Q}|L6g~@*X0f%}J)~o9)YgMS6@7t(gSE$@^N#DDCbil%zZH9`e8OFvQd(MM_ z2bt0#eY)rhYk?)C4ioyb>wGMgj3(nGj_`wokeJGHOKgJx_)l!Qn^HW7pFW&R9sF>( z@lH=SF`3lXlhag&&!jUrOD4toaLDK13~LAt5Hw?mTR~MoZn8_aMc~&n>+GO4DwXm1 ztk@O;dFI(%p2dmqzIGCScBT9OKNnilh)|ZYd?tWw%ztzr_$M=@lT&;}09j-5;TfYW zrX8VfA&7*S_#($-3Bh~nn-!c>1h%b@e0j!DnKAi=3YVe$)$=1dMwS{b4ttLEr8Rr) z><+dV!R#t6Gv;e%2qsOWDsu`nt71t1M}(cC{?7{>dkTP&lYpTr=By~J$8;T1ybDG8Dls)>>y{3Jy_*EQ@kP5j}H`M}s* z-NAG}okv&pEWEQvLICxLj{vBLAIMZPjQ3No(73z@B=P~3P3dMTkNQD%{U)_1a+XE3 zwsZkW^Jgg#k=(I)wI^A*imXu}dXIqNec1qo0gHgg@1(@?gF=D*JE7?*F) zc;W{4F_cA_o&#CqACo=5y}omz%e~*@aJ@jkDi$fu9g-LF?Kb(e71=SzNw0V< zXBY2qeLapU_|Iom1k`g(3AC#4XIRDS8==;h?E*OA7&pZo9Nya&f^6FGazL_jT~Wsc zYfiaE2jTq`4p-9XIa2?Y`vw=->5!|v)w!7p1&XL z6B}1!wlDbHoYFFoph4u$w#uMIB+0V6{LLVeaD{qLmn#%b-@ z31-yHb=O{68v}*Qz41t^&4b za4Ek~Q+T2uHT9oHn6LT$wDwVp9aGiD(I=oX;iZ&2NRnZG-tL zjcF|`{%`eMc>PRH*EZIe5m^Y zKjS)Bkl#eP-aC)SD$m`)-C~yTlEzX9aELQ5Az1bdRb^3SPK_haDHtjv`nA%yrV)nw z>p3OxLGwTAwOB*Em20XxR`H$zSOYHp{qF3s84vV4Ju^tiZM6zhUh1^T@dl_4AVD~3 z^t!f%MC6D5@voSB$3iqfP1sS=?z-djrz>FL)<6D(ch=j%=>p6G<5xXyTgmC!xGcpL zswO$d>-N3MK^@H2?SOmtQJ}OgO?E}~C+44IRQ*h84~m<0NNH0abfD>h2{65$Cfnyn z4;EVrCj1P`Vniz5OQGXK;=DYcw$N(( zY7@nX(l`jVV7DhAZVS8qk(e#pWp%tkjP_K&^SJ0?l8hmKC+%uA-RHZzo2{J|!tcEg zG~9E?GKVkcmW!>TcSR{kn{YBoYJUx9u8S~93KE^yn5k#>y7r!U>YuNR4h@SfJrp+8 z3)#To-cDCyM(T+|illWT$JTd^~F>LFJYEW#jZ*cT= z^2PLZw&&lA)+Yj@4;IY+kmN}K0v&N4=^nVebq{IA7cEV@tYZ9az_I^|4o%xA4XB(t z&22w*3$9t3imwu#j=YP#mx}ZEE(2Sd30_qP#(A8F$c%CDgZP_S#bm~+Fb8j10JTe^ z)7=a}pHR53^CzST;(5FDP;Xw6;f)YTuKWfwX7ZEOX)5m(wFK|8Nt~ekPK66aKWP1j zgI)3>qNC_5pZuBfjxwYvc+g5qFR)+vur?*Z1=gN*b~WA5_b3T!1wvodkRb4=EP zf^>*-y2r)iXtpW>Kg#s9li{|l_$1*hVp-E&imicauKe$RvWm?MHvejS*qQWfa?#O(*26^oL}ZcY~4PMJNt?9%^)obuj5g5hs=KoetIIRk-g_*wC|2gHc;MOnsG*x+Xg$Ev*tsDU-*doQlAKW?c!!4i zgJyD^u0EpT;~^%wd6Q^`pF$4}M(QIm&1#eZYH&+PUAh@VVIGCL^U8^sy|pu#f1Qj` zG*dQL3UD>X?7OQ72Z&?%jkjHe)cO8utqgw6=PKru+Cxyjf%ryLAe*&*f$PG|kbcB) zgSJgM?t7}Y6S}-RNpTqfi zbRvPA|5qVQ^)@;SRcA02iSNAa%0Lg{d}55KYuo~*@W$3)-;3V#VSM6C9v1mH7pqlY zPAkjQN#F?G0B~eWD?jZ7$7C zqGG`bTW0yyK{9hvK@=_9vIAuj^Fq1u??&0vH*Xupi5RO}$)uqbecCBy4c55Cvw<*s z7qClf0L=ciO3-M!hx2edu0^hSwEc3&eF_88MDtvazf!~PiRO19GAgsL(f437vU@8) z3N-;la)9!LW{3``)f6-sJ==AIJxc|ott|g6PFJ*T1@xP!%v$}^!J;wY69l!&+{?Bm zzaC9@2W$vlkhYpq4Q7m`!*}AjF>oC)ef?uM)mhh7W(Tx=i3BUc1AcZRM zfxcZlE!Ua&KVPKXD{&{NxL4Dwwmd;3m8dbcOef$etec;zlod6m6gU7pi-kqGy+GOJ zq!%f(I3-Ikt7Z}6N~Y?GQhu!EBXRu?$JA6L(8n=R(~ZlH|xicokjokN6rFw#KcLs zutn~8tSvG+uNBi2eF7E;2+z3#`gsiSvaD=Iziz+>xpe4B$B@^mTz%Ekaj@>6BO9i* z2zVh+I@KgkI_T>Yzb{X$ulqhcn42~ zLMs&}D6M0D<%*>6H zLhn`8wZ#ob3w&;#*A(J|$38Vu2GCJHcn0Tym;%Vpp@WOS~SZ}6WxYxoUV+%~r) z2R?A1d^5qxhy;2V_6SOAbuq|58S)`|yhkEjfr{9zJOT>tskrjr8G}BIt$Ad0K zpOGTJ*u<+-tNO0F0Ls6``=^#uW_OM(%N|+N6YD*DowilFNA=R;TEg)^_P2EfUc4C;dQE>!TaW`-;|T(+t@6Bnn(E#Q z_IQsxd;REC{@Y=+U&N0awo$b?diTukn-nea%_B3Hkk={~#NJ_oc=ZZSu99~l8xK10 zpBH=*Ca7OLL)$grL~|yyXF`8+g65pQ17Hba1?p{sC_a0^A-V3jX!|Ci_d2}~0wtpZ zsdS#BP}%S`{iL-BaRGCjtYJ=r<~Z=`-D0RU?SdjvF3Lyo%Yg^dJW*shoaoJqB3l9a;Q$+Le{oExG~p3pePANcB{Z41 z7yxX+mgp?ZN@0<3u2J4lTA_+MB1pW4Ty$Y2Xb{-wc`sHJp;&j{1?|`eo&y*I#H;Dx zCy?3!x<6_6IA#;{Axj9Bpn(MPmhwx0fG`69ikE#y|ATaJaYGaxjQ{OM^wp5S+6%;| z=?;J*`VIhGLRR40-*ebgmZv?i56)deUyzJ{I6JHc$8S-#e{qX)w6|$R+RB}GLOeUH z@L{R_3XNcIvnb#7#VxIqQw^BQ{v`tFV_L?6y{Gn0%NqBRWV6GA!b|Ob1CZ*}Z|pvM z>r}1v>aL}w-Y34*fVJv+^;$5;Z!x6EdnN1SIRJ<=V||KJ6ZhQwgSy1PkJ)~DcSF|J zpkd(f*xW?Dy2RNeiV|O*Mec1z8(?B=Zoo$)?CtDy_|YysX(t;!wr4`S z&SJMLz#6%@RrH5X?DW1#3Ln-#VNI!hE)NIx&3UaBKlu>ug#UzNuY4Ve^+uvy>56}@T;nq$sKUKfsCb=hj!B@9Gr2LsH`3qG4B;?r zm|*>bozj{n2jy^&BqQ~Uh;hi>>};zjBX`5+0rXHSy0TzgcV98LBus~!JG8)g*eEN_e8FEh!fWnWvR9T#jfIv(r^p&*uhjfe@YH;%vX1F)p9u>dN3{m^Fs#s@c!te9ili&N;{Jj2*zQK&s(nHP^a7k04F16$0 zQ=#nJ$BmT1e>i5r<<@JL_Ee*y8BHYFpjj*A3iv~=H#b#}SZbVj=)o#TSCA0(u4M53hdR$?8BvrgT9Xocul{<9o*>qtR=(QTg`LNfECt zvpn9}=Z$J`zC@@C=)p0>?cUi}$}Y+Q9fB9!AK)cauV5tOr#}H52K(rId$WEGPLf&= zctz=U%ofLX%ywclZYX=>j7}RawL$_>c8|}b&1N)7&zKi#e4i%skOrF)L(&{i`r3W&XzQLI0VZuT7;Nt;jG!ndzWEAUDDWhZTmr z-$j2|Q>d7vp?r@-_(Y#rj65(zU@N=&Rq`Fqz3bq^d-#6MVWhqo`<*(~ALggf=3p(% z9u+Ylrc^(Ch^aNFl}Z3ElUyJNd5l{2s|pB`bxUu!bkYXKpO?v*hm&;PH$L4~O0cBFyh8XzKz zM1?ezW73I7?NSIf&+!8wdQUu_7W1ZX*?o+hdY$HR{^Lrv@Gn{u1OyV zArS@sK*bP7XZMP~6-(uL#M+^sx~kipMFU}pfEYQ8PV*HD+f)x`_?c<7BKhx;2+Z$V z=@v@F$9X3jDSaa2{FCzQRI*BJ3>KoqZpa=uwI^aN3lI+v0c+BjAcda2>Itc_*l%2N3UQ zmnuzNXF}Kqh?WGLNZMd&-W2C!)D`~UO2vjz{+KI~@g!M0^eSNLuhlay*8OtHp zKA*>yasL;w9AZsng7A=PytHri34S;C#uFG?l z@jh<<#uNJWsAC2dfR}~IaJA}r-@wt4qnXiITxog7tP21?kk2T;C;I-g4lJjeC%|W* zFFzXidSt^R6&5*b9_4=2xNiI8=ooEcVSHg*G#xf+*n>)S;#b3z)Fp7h;i$!q6x~zu z*?KThAJR_D%+mQVVBn%piJ^_&z2xe-%(qZx%$_2`WLL217?XzgXErj101)~+0cE*W z#|OV}V9&^RrD$&Cldz>icDSBUcKcdZ4%s%l2ZJ|>q+UW;0uB_`_7K_iwxY){+n!2piB#GvSRUGPr2*#4>PlC-9Jq1-0h zJ2%a6&sf?t6SYwk?DwhiV$3e5Tl-EP;8?wYX0mr1IvX z%`XtK=rjRX#mm~Bw6;_ZBqh1Y2CN2CZFdbSUROQr60OKtoJj<+RWcGqFh;)Ql&@~H zaO_wu@`K|ytr|}vtW`T>!{QC54izbHh~4qUrXKA_PJTyP{=qdR4b(X{lfGsYSK++M zE=_^(toMQ5xwA2<=<}-g5=qtz*B1#HQ=eIX1qLUc?pUSvo%08BIAqvWXof%y}>SRWZAO@bMc160RA)U<{_ zLG+AnH24E%4)~&v6Jf4%zp=Mh1M~(in?KQZWq*duXG0Y6u}H|pN%W(~F5;tT^Qb;s zXF7{{6tZ@WW_Ei!mF76X+5P45g8Mu(-xZk%@c8w9!=j1o1vFo14RGK^MMzH_MqlCd zTC8cNt+^q`3ha9=(s$eqg-LC$ZbI(d4Y9AAY*{*Q?@JCMqXQ`kaG4kr-+U_|h>~OM z{RX=)2!{idSRD@yIi?&Cc?3v5q^uoLuSE4CMFDFTfZ-!Ff?f;WXuNGcGYer(;5rrh zn1H&av?4zc3gblq51z7I=CZWCbdfG;j264Gs)p_JF;ue*KAe8eP#f0CE{QY@F(Lt+ zeykYp4AU@91eme{F2_%XBNwN_p27tITqhUyrAXV>W;^z&**GP#+`iVARD%~VBhqF; z<+gzfSj>Hk1UgS-Drqg&K^2@QWGxS<_#Zpoqjli8 zxCA9IbT$tm3&_{a=kX@OTjT-2_dWxVy3P~xbxn5xA8W;}En>GRPkMqqkoio5_m6gAcx){TB*e+??m)2Ddg zY(cBM343<~2JQRj{@lUcU{hsNvlgHOydX{K@sxm?zA@PF2P2Die^*oboGEi1F-gU` z*@6r!p_c+uEGtA2L)V)-{sk_|YzP&@WvZm1<4@t*$|; z=`G;N4$g46Z|{5Oue{b@$1*kGAZIr|_DDD6=x2^01mjC^gFyhAce%PDU0i-r$L{Ej!-P`}jyF4nBHlS&J0?yZjHar%DA^PWL9n0L=D6W2{6 zDNHja=+mlH!!x?)=@43jyY4Owf9Y|r=tU%o2b=32CiA?v`#?p2q7AFwQsi+Tyxi&n zdqNm$2bS|*hxHPfDU!zi`=`is<}2?J|-rQU_O%KEdiXTW!PoQE3uJB;#TYt_@^ZRxP_8h z>h61DPA)YKIn%FiybHI+^<_CmopacIK?J-xf%v7x zE;niHy%%O35q;v zzJIX;MV&O)KOFJ9#{Wl;`~=3hsV0^jh)6g2wJeo}UFYqU@eavMGD-KvN%JJ|z=+$5 z$Wgy!3WwuWFx}%Lh{b>Sh*#`?;Ul*(_xOnA^HCEhFvf5JSVv(wfP(-W$vr;ujI{Y5 zJ~CN$zk~tcBZcKpnS%y`GpLA5tX_xCPBh5g%s?lA?k61RwumpmH%7La_rHQW&YScL z;QO!Vja~hK^j|v{jm|^|5E5=gzRmr>XKt$tbVRnA|2m?`l!LU`7TH>`Q%NTMi4=5#{GNwex%CXMri&c#oBtqbw06pc%y1$uvO%Oa zN@5!voXNPM@Rl~v+j?1U^!uTci!(Vc*I(@x<4|Q&deBZ~lN~`uu+0oKOIRDQm~mgL z8Td_4aEvK7X^8{im54Frv%Q!4+q-0#fG7MSA)af3X^<0xYT(2W7#?dHK}ne#!vH73 zu?}z|$9iAv*}ZxntKz4U)AZ)2V(h3VKX5J64T~5b+YB38 zDwV1ims9~hMRkj*b&6ynus5Uk$#>R`SpXB+j7$HEiA2<(ZaSZ#YcZ_9Yd6a`z>{fO zxL{p9)}jX35>>=IfiyurIpL6J-&v)87q4pjDCjRkxa-1D#=Al8yQ0rQ;5f#hA7432 z6r*sxxwtLhT1)z;nL-{wYr(YucC-WXhccc~b^at08-PW6*di*?RB&D=Ix@#<{u;ft zjwX#gzEidPLTm%SAO!h7g_w`XcF^!@u}NQQfBk$b^@*YT7*=At&lzii)woVq%|k4q zSS@PgL8#9R6x`*$XvsYwG;EUs^qLmM z&z4p`%0_3$Jaz6T8jko@08w<4luOT5)Y8kUe>$LE%=YCullC;o0x9bmT|slUGQeRM zkM}d|G6jKdhrCPm*s^^fyf-o!P1;PamdRx;&Z|SZOA8_yUb`SDm6|r~TpOP%4enQ} zrR43h`a<^oKNv}I+kY?;xuE}!kv!94jUwhxT^H)I-j)T%U*Rrm37ISn37H(T*dFEK z;uxa_!TJ=(41hdwAn_K-I;JXntC~~Z<=dxP)OP+yHOJmp)^y`6<$&{a*v|gT=oyrN$mO~T+2wvQJ{q2hAYo3+n6jrWhF@TS-8oq8U zyatiy)<|Gc!|0z2zBnNH`F+wc~iEc6nxs;PlQs!KNX2#nqpm6UoGiK_Z8bQz{5%_7HiP7Ef@dKpAmNN#=LpbA#8qI+#_{IrrM+nZBn@CGZ8J!dGyC0Bv*8$wXPqrs+3<^Tpp$JY7LneV2kbh zs+fAE!XT>ANtY9|T+Gk$0;?nvgNpkB4a0Q&b(~z&=8lAr9sk+57UtMIH-cxC?v_xf{z*Rk~WpQYe zPF9n=z(M9M15?CXz#JAkW<=>1C%LnEDA!8;S9xZluZ_WcwctfkM=CqzuiFzE17Kn$ zOTvO@2`#`3e-X>JK4RKsN>2HYn7M(!xv|7eG?_BQxbXUzjBSmML-(i~6|!U*u{&c> z09C2h?7G4^i=DA&U&BfBsMgHJtppRdXcjgBXN=S=)J-%EdW6^xr!UCPqj=>jJz;mPg^08@c)cfV2 z9$YXW!*I~<#9L&;aL^*quWA~&L4&_uId##kMtcVlyeuQhLnKtm?g=-o2IhVep7z*r zz7zqRQri$B0A<VR znpq&5`B?|oncIK?Hiq->1jL({g^{S;-gMF^RejkzuOb1<$-*tbopWb1C(#5{_hnEt z623hu`gm`|q??(vUa6^lPlv^U8!#dWMeT+FwTW&6dOYW8L^$)zrM3XZDsb#30BkTd zz^f3|pqGBSL8w4Yw3u$jNMGc=iO$Cw~QyFxEy%ACcV>b z#TBZ|26Y|aEv~f*JI{0{sBq!~RRliYlHReUk=gw;3g{2&3;nY?2kaNsM)DSO8~foF z=6L+8?vgg=?JuHss==i84BT1UzK?X~MHn{48h-(_%NoOsPQ-7{J zA)K&Kx25o-&QRfieQMw+cFjW#UXvh^4iRzukU?L<8WgE@N(^<$qZm|ji^I{M+(=6Y;6?9Dis>BU3+Bs?%)37ULnLXvzut`&GA-vhp+(PvG7gB!;dbM7mMBrKFLT2Bo`GN#nad&+q--_=|J**=OxDmpgM}ue(kr8ilW!9{H1= za>U$4S9R-cO(x28{f(#cs+#h!{&E0U>}glEZwKIa>SuOt@+mJfp<*N8)55l|5x1-5 zfo;pNuhDt~fEoEe2Ckt*{zQy_5YGK)&7zz2H&$x0B5W7SzGmk-K!4agMA&czfd-20 zmWuw-d0F3i)__oAr(LTAZF9gL%TzoE*@Cp->;>BLZ*Tfz^g6*_DnRVupT>cIyC=W| z01CaEJ^#cGu=h%3svpbAw$OUBFW1$Qvl@&U?=^TRsfI^!q@)Mmhu})DChn+ zZOP|yALOg~hCiHN!(iy7M26fYgLM@@pck!WF=~Pit)#t1)&EMorFGGZeT`@kV6gN% z{pF2mnfl7oZS}fF*9!IQ|6mx1*;4=Mud*BV(lYm|sv;&&|NcEv{g=D1bAzRums=6N z8Cs}dd<{3dh~%E!hwRA@pv`bhtA z4h;K`GJUAdd6oN5Fe{7~J60Vt{a7oERir8m0r8_X;2CzzjGU&=b?r-gU17*wyX8GD z{9a`8I%&^)oN=p(RkNUU=UlxlTjIA8;TVC?ny3A8p517B&s?W1iyl36=jz3aUYjYtGU$aUZs**AJeMGEt z;hO{5`4>B<32^c^1%jLU`{nF`V&>QwQ|H+9vJQF2k#Q=Fi77Z%)S7HeR)0ME;Gs1k!szd7H^pC zSHhp=*2%U1s>=1rd*aH)9;nLg{Ot43DPz;K!X40$siGK(@?)Qn{9PsJL5sA7mO~8 z(H6?Ynz0*X$r}?&9#`j8rO9|a7afq9W8j|Q#ZYCXz7(J7l8{&}JkP8uWsD_{bJp??J;#vD7R9D^R~e1|{q z;;MDrmOxBpZR;c#S{WxaQ#pPL&_o~o*TWo{2o)7TA0gmHI{#XTH2Iew@JrXXFH@Kt zh22~7WS;256yKw~bWB&MfA-I7QeE*qv%6dT|4PWmL9L+{dQ{AbuE2nD_o>7*YL!hr*aOiHn@u-(?zsuFe; z84mL2KYfnQ19TEV8e;zr1Il0TniI(Yjx+L7cRH_ofGrTBY~a}zq7L!E4HQ}9s)gSN zG<*_T;K^=Q{0}8y*b>N&JH5Bx)YXeFozo%v-;{v3|Dgmt5Xw+#+G0=evb+`D0Z&&> zbx9o1e}xwU;>!byT<&TM6Fhi&y3Z@<#{~UuJQ@GIS+AuW_gt4d=#C>7Ii&9yB@(=2 zEt>Kdu2jmMxRv)$dsey;J1wJ2%?`N&MbJnf$=kbAw(#73L^qhaZ`&&L+{gvFquXm- zLdY}|y1cMCQ10>DrKK^VvhG? zG&6brybh~e6#%FNQ-$s-+{L6dM-=M~TR6lJ@XHzYT&_EN2AlalvSE#36^2sCVW!1MjwvS5`$$dsy%CiPFI5}UOy@}ff2rad!&gwc zCOor{#k1hEhBGF^kZ^OE%QT({q!c3v0#kkT zj#8X?(>gLO+GKdjGbKV1q;9h6xA$d0R~&!t>WMPUuvq>KIGmKj9&Y0$mmU!|aHn^5 z6LyDv3~n_?+NNkyf(Ge%MAGHSg7jZ~6iiB+iVce|(50w!%(@hOFdS+q^d|1!60?&^ zH3T;l=$c^V5rRlweQf{t0YddW+>Tk}mZzDEP7NW`Usy5Q9}S1NO1;%kOnz0TB{&=P z@32gK*t46#61Q7uockh`1ofF<#-T0qqTAfICyGh=20^-Qij!72VvQ4=`mo=$`#NrS zFg-;p+NyC|%pwb-ZlwV8Lp^QURV1wfK6U{_eOp0MuL~ZMDO%=`DH=-;F}$LxpG;$t zj6-}v@-@6>NSfc5O9rZAF^3$l)(h=M3FB;r;+O45)1g}L+bCScmGfm%fv|vYWE}&` zI=MIiep;3XQ7`_7jCR_%I~rCQjPu_Xosk0z|7n^=bOGvQ4d}78H>k?9mx%x#BU&k; z`Dx$sKw+4DK7QN-;1@%w0CEG`lfYaFf=?Uzs>fbWrV`;IQxJ?QOVx1 zcWBxxiJ?Uq<@7-4CS&S^#ARP-#9Vk^NIq>gfU=?BK$J#U8JQgj%K+S{o!x`~zoOPw z-T|hmP(Fbcpmh<#G{IouY9tf|H42Y%4)ByIYig-)c$g4jgUw>fy_!Yg2-38> zmepxV*FIS)R4cXdCgF=VE_hOu&ZCs!%6)K@kuFnED~+GQDvqUvFxj1^swC`f?$03k zAC76eyvnxWdzt? zfwsa9`p+qNu$WbW=B13fwaB;cP$4f7yK_MU_Tw&$eee)F$*QPYdC=2D1VNP|00KDj zLTiS|#Yrda2ojb73?m1(z|-L!I8%$RPb@X$!vk{bhmOc(0@d%Cd`b$yClhU_00!li_4rmhu{G8%P#aHz^Y1oX~T9aD%ZE%C%avggh4g#za_ zdnG@9P(FofPEyzFF08=|8cJK+Ql;fzS5On)I?+wbj2*!c23p&FUk$Xfw=SuwpOFh( z^gA|KD>|adB3~03zR*IZyAb;-0NN(d@;XNYpMkAF=1f;lrXGhevP#9 z^@M4=ukrP@PAZ@QDb8aR2WcU6S30dUrL#B|SM80ZEf!p}yEngaB@q6mXAp&pSTmwK zT?|n1D4kl2D^WZ?<{C;BHV&#fEF=ImK|xVb<>RxzihC{G`~^(VJIg3|nYCJXzb?te zjS*mwLmKHVFzH)tVus(e;XL#<;ENB8aZPB!5CnvJm82jmBMELWQ9 zC%<2+b8dO`9yI&BZ=v=<{qttY)(`;0!>on#+Q^I?X8d`-QuBj4nn_;hq-F^s75QB5 zpJikk2e-~#dK0Q!MG1f8i@6Y5G%P#(Fs50GJyiP<|H&tFK<92tN4eL4)%4zG`;V%AGD6CMlPW+w{)WG*JluyQvR8naGl({f|g@!sB35 zePq|ryuDt{4yEU!zlF!cOPXZ{L-TBVW_^C5z6XM^QJ%1(CC&QqS$&?m4m2p; z33a^>ztSoce-d|Dh`h||`${FETNP1(qr^8g1dsRPR}y6MVDGW=;ZM4m#~Xqk)NA4* zCjGBt0lXR9Pkp!GTj0!^rjl^8DfT7?VTWd24I$yxxfXE>b-KWut z;fi=GcSb;E@0TOHjXrvmp)Y!4Xf$1WpD&86a5l%Pv?3+D4u%Eh$kNFHweWP2Njm(J zK`)Z4J+&riOeacaqCH^jyl%Ri!MuyfUhA9%oKY| z#x8SknlxC4l=3Y*0x!=MlFo?^91A2j# zYU)>Yr;IlP-<3GP;+xlDXE2Ib;xgm;uo#gj`i6JF&(j)U`P-662#$$DPR0*bR}J&%eWjYzOmg9Y+aC&YIG?4^3uJ+oq>A} zn2G@_ZHC9W+951)xyo#90epR+kyAs^+z!6lmO?^dcehTQlL!I!ad`1}<)SaX*Pw#$ z${3`O_XF_G?`BH9|AvpYZUm=V7a%#%(XG=zGq&BDCAEU2xA79z(T#A>Y|Kk&|8!O+ z6Q8yqvc1)sMZgA3QTzc*0?!4L`R2Nr)Me#5Yn=q8dgIyqf-10#jZr~Z z84=2~ofjy^Pd4?KH<4VpfzeRlX~$8B4jyVN<{TUU+TC_E^ThE#h*; zm3^z>77=Xi2U*yrR2KR3%LuVdAeE{^O4-*v%aE%a)H%R|Pu&%2$+q8%wJR(R;-MdN zpX@6rEnq`J!$$GieF(`q7xpJ2{~7naROdZfnH2a8?&cb`%2J532zK5reB8V zFUP9eb6oo+3S9o8Gp!-I_FFT7+>cSlmOs`vF5EKtk|5pMm#XU+&jeAZHd=+YH9ZZnyDE zx%Qw4k1UCdchEBSgq>Xc)*>2jk?`_kQ>M@(3ppjuFt7PRC?cHtDw(?bJSe zOD1RcB6ENY^^RNz20=Max%e7eNWw1Ksii~lhXM>|LuP*81I2UbSc?=-FvD-?3MWcm zDD_}?kJRIgEPlkcM!YH}JYN*n#6C^(+FCC&n!)6L-NSCrUK?|)Gi*Gn0^}i8JpYV+ zGXnz+w#hhK_aMp8Kl6^0NA= z(r}662t>3;7Bljs8jmMsSbF7m?E_ohx`!^2km##;1)>A9 zwA~qC5gk;Fop0DK-3ddqA<3W!1|jVSdsWN#5=wn?hdqg}gQ64EBN4|$&F@BAO22+* z#i#4pMV+mUZyHmM4WpfCYv$P^%!Ob8ulK41jAT4GYb$gn`d{C#VqI@v6|LTWY1$#Y z{EhhmVtM*nNw*q;R9?!)`I+R7KUpZ(G-5q?pvAKz;RzyoNR)L&U7T{5CV87pK+&(` zG>MImkpt(5i>fU?b`>2`&mzEQ!j_1QxpvfGvW>E!JOpV+KXVocJy=14wz2By)EVZf_Y#1ww(x9_YOCKlACq+2wD5Iz-ik*x1Z|BWE z?|pa2_v(Ul@HM}>gES#ifqx;q%>ES-%(P%z;*a|gk|Cpo(kgPtCY{-V2`}pmy&2-C z%u*yu=28REGMq3fJ%+Dn2bp`8m+_*VeUvQk8WGocs)xjoORE=F!({W2xCeg{#(wL=}Ej2SqJ%6GA9=amY>^ zElC7a`erZAGx=W@H0o#LumubRMMlnMe-_){-RdP2mCoVHmYay>Nfwd?$pd4bt#Ey+ z)11N3+7&JsJl-i<~Jlx@%=&uyjja-r0tHIv<;$>+t`?yT> z_WECw?G5UX*k3ZLyOc{(oinPMM~3Vi>KVne+68goj0(t&fi%U+bwF=dEpDsI8l}aa zeQ(BDBKMCnqbo8lmO|;piikiFE@U_yF3^;czbQwhzbh3^&uk(jk70ax>>8zf&?^bT z%?WY;k@YTICF8Uny?$Q51GlzlZQR*G2D zz1y6z4)+YM_RrLdYmXs_Ng(q3icD3_{be6nDsAy~aa_B|UyTT7B*Brg$Pu2V#nI2akgbCqg+-G&!1v^A^xw?+eOf3Tq_Zm1|3SLoSi(Q8iWm$4&d>OZALe= znevobJQ~RIH(~j+iSFtQl+`XX?T_e|?D&_&W4~Th3F&X6o^Rn}elnxWPyTSf>x;OLyh-u)Z6L2#w* zYkZ6kBeP^zY}Ls;14M9}jZAUo#C06M!HcQfOdZ!MjP#@P6Ct6^sL6=$DN+2ZtHP8i z3NAtLtM3K=OO_(|Vw;mK{@{z}4G5xSs|bbq-O%y?%F9hh+SbQN#nTz;KEA+#ZOv8i zHH{o=(CaJcI%0fz0BN5$I7sYh0pKQ*xWhtQ<+&ttB=lTF%phJGr_RMMnPq>)-lH$P z*Le(6hWt&xCv4DLx_vHgu^v@Lah~`S2E)JX-)%fr?|Q;aSfE~c)nk3dM1_c|pb-P( zXe2pzjnMtI9Gu0xWnxtEPGnbXHG(MEVVg#g^sjO<{IfAqGB4$=b-y$Pq( z_YC-r6P(gBl&*FvD?9MS?tskQK9tO;Lfji-{opM{zv&(j8N@w2R*TY7l{{{|LThpA zsEaEY!1AQ9_<_p(R_|7`T32lIxaPFP=wo2-r145dv7T>8^u#eJkVPc2NUTh*cg1)` zzESUI7>Aqf#kkRed4thPM!%j<^2lDzDQUue{Rgz%?u-x}XWiswpn22shd*&`z_pt# z+L+^iY(5J9s4oPA{u{HQtuYxup}*DhUE-d9wMm+(tD8|AS7l@Nrm*runYwIT<%jnY z9~^tfKYnm$JpHOlnVY4p+oD(efmxDBJ46oV9($;xN`L#|m{gB1WC$=@-l^Vw_@Jf3 zwE)c6b#(;-1&iIk?{8ak60spGt?Z0EyrG6h`RGDyR%-()^=4%iW8E;D%;`d4o2_hL zD4#TEW1VBeJ}Gk-Fe$i4*f-!j|2DzGUd#uz74QxWir3=L0v>LpIRXq*V%%@#@+P`* zb8>IS>=03|gZ(*lt+aCIf{1Q-fTMyHVm4K+a;K}W-@N^kEyPWpV663J&G`3JJhuO#`;&aqG))refC{rrk_mvwxIwg)>$BK`Fm>fzDX=e zdkm9dr)KX8aEa6Pgx>BilGduND_m|J#pb$(2f-cM~`xQKPEYgTy zIEL7}cR2!ETX${B;1|^7*UJx?ZhwgA`0*m2vH#Hz&1Bd7b+CSW&_$Cfbf#_if@Hto zt>>M>ql`hJH5SEzl&+}2x8-$k7qWlEVDk3ssntVKoWFLGQ9}>@u-$-;0QsKB=j6_W z?~(dLLXZ|Y!29v0;Ry%RbeUuJ;sveW86l#XwJRGbJ?TbWmX0F@Ph{63B-!THTVd!? zzgqCMBNMpwmoADqI#oU_VjT91B0;miE--w~+mvD>dG?yulfJC37Y3YwymW#ukQ!lwgHr_ z(cuG1d&iaXgpF(!E`c$rx3=7&LzcoFIuZ%RgdEaNY{Bvo=n@5R!t-R59rVI7n=E(I zM{;iAfuF{KNOY|b((r!B`enX?R1tkT{Z;Y2Y#m@w9hqk;Ez_d2IA>Atk~E>| z#)z2^$B)Z({2WhN5G(xkjw_Zfit#1-F!u8W6m8P^Q&74(jOgU~v}X2sx>S*6y}pOk z^HoVAj(VD6OPaPJw@E=Br1RzzaPTXToLhFX5uJsKr(!=kb&6V)wB?-!n#!k*dae0U zrJ}r@yDOYVO}Sjo;l9KNg#3QB1FD;!bqht$?u*&_=r(U)AV!O>=#4gGXg=f}TkCcY z`Gr3Z;Wmc4KY54JQHk=t<&&Ub#egk}bhx%+XLx+0A>)7+=*ye(#0!nSP>wNyP6{C)VJT|ZL^bld|C zLZj{t(e3dsH={C`{}AO!@gzs!FJZY|Ti?JvCzjQ!NDH9#71RpA5*&42U72?AO)sSi z6cFp_>M%V*rfPP1Z7RtkhiLjhQ(bj^Jzws9?pQ3dnjLf_yZC_p@F#`ba;{nYBKzeV zaS&x>JU8j4b4clFQf7r{)N>cAwGP-_Jr1Ug_nf=j`T!=zmq5+2Hm#H=c{$AQgvs1s zzMrL+jW{G2ms-C2^LmXGNT^+e(S-#ayR=28+&X&-E7YIKhZ}T~GNfP~>=G(uomvtJ z*WdB)f!bLwiEZrP7 z+{hx`J68v`ridTl`3j(QaifU-Rsy~Csl}$6-qnwLcQ%ISe#H{SO;m?ncW(f*yJA7r zn988tJk`gfe39}%%+RDIQ3x@mzz#dFXBjf^wMF-T%;@KfvRf~HJ=Re^Au7DAyE)7< zQ4FsdyJzq@33JG6p5ywP{#&zEzKO6voj?fFktrO}=cYGSD4De;Hz;aOD`=6?VNqdv zD3$1MR(iUA^0TxL(6knijpWLX$}%L|>agbjcu@Mb3f1*Z5oZL6Fa4aR3~Ahn3&k_^ z@>zrHjq5-1FjT84o4`98wM{#;;JOgPoO+qBAo;g-1Zm3>CWY`L8+L2|;#h-yV9J<@ z=A80^wQlUR`SO5?lYDsmd!%ttI1K~-zzf#i;1t?A=FXIabfL}RJYE|L{e#qV<<1wl zzfT4evPbaNqr99nnNyGwN0LGYbURg{?@)|;i!bfO-BXJaZ}28T+QOUCIy;H2KAG;M z5xNi~90$d413`uf&A;)2;{x?{n;1o3XOIuYl(O8HC~_<%YHV;i7K#;5<*u?l8VBBJ1=1)E`&qKS5VV&EdY!SjlEgKsLZNTy&q-DA zNYF$rA__Q+UkCS^_-Klb^9@0VA)@7?`d!b~a7#~$U#@OnVeo3#&KYBW)lZ7YaXm}6 zsv~p%@iXfvc($kT?^3I_VM=Xx&ET9TL=vi4Ir{s!;&01!g4=oP-*IwT<2_tP#}$my za>b_(uK{4Pnz*#|`?h0YgQReR4#goE_1fs{`S1E4IU}v<4LjOCK_NhPrKI%y_VGQP z$kT6~(l2Ijv>k4Moiek(jM?2GgOg`J{f2DnKEoQDHq>7$@dZ7>sjj@XU7AFeMbiX!`-;?U-}$uvkvEAnyuVi*b#knDpyFIh{dV(tQ?pgN z`8oDgNd12GoAa4+kARUxNKnzK_efd|0*eCfr;H_=D}v!2myHfG^R_3rCHBv{FTYGM zJEVESnqaaPkVPxpmD?{+n0crI=0am>T?XBW;1FhQ|7oT%J9OZmuGfg@WOA+bwP;9m z)jGwlhUK#FdB6n|wIPp~^f6wac}o~Fd=F)bbxIieGQMcT0*4yUVc{9YVITF=Hg77l zzzzCoN^MG-y#p{sTdKerWQTH!6Io*HI))?ph9ztVHASrmX2reSYGRc-hP6qpp~Is$ zHNU>ar9Qj~gv5$xm)bHpm?<(ZFw25S>KHPD4`rt%KIY{*djhd6TQCsajyc84LH%wCOt9#o5-X=+*KU9{p#-{b#QC*D3ko~^5J_; zt9g*F@@;im3nY;9>VWy1v07nfLP)dZ6JlzBosB&tl*1u6?ksCw z)(`s!L~45;WxSWj!JSj3f*;F@G{IV3mh*UhFY081soi1`Q{ictNo;xN{C}mxGz|Qm z=y6d@|JF)uhW^N=W5$r9C%z-sq?^)NQ?$;ja7UJT|Jc>v*Jj3VTio($6SC7TsHXF& zl#qlf6+1hx347YZK>0BqcDAi7gNB;?RW8`Fy@C8jXd)s;n`J_v3qk2#oShxv@jX_u zsadACEe(CP(UigyDM?Yfo%xp&@_6|O#=t=)<5CqrD*b55UaXW?hTImlXmlkA&){+R zS5jvlY1(P|Cg>{c(_6B2Tz3j~HoVK4$}J`WY7Z;Mtms#?`FQQTYH{*rUKQrH_}EXw^xBPE^w zxtpbJ05Y9fkO%bev zkFpfPeRphTE2yBH!K7`fJyftqA2_8`w8Fm7(L0(tcvy=in3XsW9>=-=j?7v%nMBYc(JTA zn-iaL>Hfv#xjxCzZ}3=6$7aax5WeAs?Szr+g- znAg3uz8|KmO(~nWOg4g}c?cwuUA`I8yd{-~ zGdSX}q&VD_LPV$hN9%e&Idm9?*lNs&r#TG!V{_M5&X;h8#|lyDD8^aAz&ZAuSw||} zMY+gspjToBR%P+U%bV4a>4BcHWNCzF-;L>uqk5<_~OrWS7y7(G==o z*9j%(Tp}ux>sgSNepxgonJ~n-9_KB;(C<>2-g?YSGzb6evO-L}n+q~JETu1tviz{@ zX73dRsQ(Zs2j3m-XQc!j2P0Q$L{y@sJ0+1K-#aCVtC3lV2}r%61&nWzr+2Dla+!ou zyNi9lA~KRowR!l;!13)B8tV1vHk&YdJY>U_RAFW(UO)lN=lS(2T5g7bnv)X60$ZK) z!Vx3+eL~Kqs@4?UdC0(ffedcV@t|HhF=BHqgpmXxPUGiptx*lZz!Ps+1RCX$I99J`JWge+!%=B+Wvo7ER2<{3mM8JZ#}od8ff%qke1O zx!yl-T?fh<%TO1$UtHibb4RcGCO?o@vL!X?2|kT8ZLm-n)xC6FHt+P4 z6hW&ZX?Q0A-oBwrX3Pn?Z0yk3tcpv=q<95IqJtEL+CgKj#Kkv1IeZ|PjuXM)U3v(J z$)I}+4bNOc!^ZcqN!mo7<$iewHyk`<9h3bbX~ai2yiic>n3!+Thf3SdED+867nH4U+ zz$@=ijCWMXUX4iUP>|gqsrv_uVBWY7?*bldQi&RZbs1l8DSlEGoX~F6yxrq?$sb@} zP=Ge^HbvIMS6baeFiZb3qxkq&x3oKEsAG)UMVS7javNqy?*PlatwEId<`K~^?iwlT z%WKRYEuFq4dxN6n<^QQVC;By8Ek*7A6EhU1SM+A6Lnh0L=n)uyFN=s{tRVZLa5yn%f0E8I7wA zYa+1~GoB%G2i|9cF^~NqBR0hk(p*d@G6kWHGp)vm%If#d#W(U-9|jIFk44fIvuqy8 z8XC*_3N3SRj0Ls=*V{7h>cQi+B>r)Y`CU-LICw3*`@h(L$D^%m)(8;V_ofH`AM(DD z99OT_6MXM)%=SK?UIr(7)<|JB_P2K)3~iz-Ba-xZ^{n>7(Ixq>$a@cpC5%#;tS&Kh zj-mw;R6iUL8sADVd|sr6eRTIPR;?oS=jcx|cXTl&3sy&lZi)qtygi84(6G)gKr>k> zndPISJ!|iEP0Xm*cqF66L2)bI^Ftd|L0Xmk&X>d;v!C}E5aF#u<3Yni>%ei#r^751 zcl%MJGy}hhQrUR&%A#}~WG0{fWJ50e_mI|j-cd^8q0f0qmSvcHQI5q@pyA=HQsXvB z#+)3cC}KD3VViBRj1M9l@1uhF9g_+%_ZG8n_S~`Z60z@-zB2>OYs4^eiYjWGzB)7+|VEWYL}?IWIkK}&d)NfLskp@oj+Q;1S}~5 z&n35z=%o`l;LXu#79^T!{&}SN#HV+lZlmP;&qtz@M>eow9Wqtu?`Wf3q}9H?CAUv8 zED)qA*WbjM+o(^d`6qW>zy9Mye|yrls-I;$Y~4Qidg-F!G>{S?X53}_b|)>@ZPePf zhjMs0J340+6JRzjW&Tj0)vqb~D)l$)mG@wLbdE%o^CAD=n`X{1%so8vi(P zrk5poI~qD5NA&}ZHA2_}TlkX-+kQE`yU!^O2?n7sbI-cc>5fc}e7jM9&GekehOLBE z*rXNqEx0T4c#99BR*Jv{b7oslO{tQ3S2J!$-gd|N?H0jm>hoH>y2O$LY%m50*ED)? znVlJ~YXedyoxVg>-EabVYfK%DfP;EyE#ch;(a#A6<%cGg^t!ze-eH-`6bNd;jSd6cA z)h!8%(%BxE6oXreP64*nm&{I2xlBz6cm zOa|MSJgc(V6|FJ%L7NON61Vl3OP`cfSnM{mcf}qPJ!O!ZXXfos5`#b~n0MlD&<(!_ z@3poRjVgQiqupQ^i+1AAa+TXKWsDdsN=)imzbb`S7JPq^n!X>PKa&t7xjL@= zQDxrFOotxQPmh!Xh7q>;?NQ5OO-O1a99;40l)K)scFZmAg5!V8zW3#gATH9kMY4aa zp$FKRrAtq{=a}Uw;E%7Urvk4O9j&&WSp5jiOJVLXM| z#%JH>%Myr0a`p_|2@ijSQ0tDRtV^9EEEs~0VfA@y-??z%Vl3~FHjn5YX{nO^N8XA} zqoGy=4bqe<+GsLaOeM2fi0&@O#Y9?t%v54XUeJAaDCH?WO|mt%eT7HPSP=gWEKG#N z6QA6sdtEKIIog^$MwvR;N#~q6U^q=V?u4p&PmCYP_Z7NYW@r zC=$?G*-+@jm+9Hqhov)G2UBqxl3A3Iv@*Uxh4O08*vp0E)NH-Oj)ye3zA z1ug6Qgq)kUO?v9pZEj4X>dGFntU%yr^rY^BdcT#C$DZAm?)k`(K#B zu0O`=$vfe{<&p{Oj)&Q;KF_cWoSq_ilXuTfPO(b>my@oi>-DZb;`}lXw)6IsR=#&^ z=bgVV1{}`*-!-Fb*$2L^mL*b>GfR`QMrGKE`9yD@~ zPd7DHm*UJF8tKOxidt4rO}l;i3)3L}OaZ-K__NghlM%2TI`Bw@DD!9fiG=%Es&?{$ z2+nw*zjq3jh%NRNb?#H;?#K^*1c{nOkXiIDdBCFYUE!<7@Yvz-Qgh ze0~aHmNgJ!1fRU6GmigLM^LZ&dHa~QL}*t`GA-I#zK4jS>3cj$StV!q=7C<(V$^$-to^<}eFv+Gf~1AB+cv>~vtrCYf>xf|C@%1!I@v zv&?D)G1~pFX5#^Pd%(4Io5701%w*hwz-Wz#uG-wp8@tEtMf9W^?IczK?l)WJ6T%;^)G=afqu`SbwAOlPV?X}1pCT>h5IV{C!ac$kZIC~ z)IyR!d#MUve@gd|!ydQZ^gupzK&(p?d`Ys`&+`a-KWd;8JQA^IaZz09hY}-$#6otd z-~3e%ML_~V;7KyE-R;Z2ry8azRMJ?)8+9efhf=oEPAb8e)fAl6hvCbDis=_&hb&8K zUN@09vlEO`WTeSgpg93<#+Ju#84=2YDKT^wuFp*>iz@rvQSn{;RkpB|IU!t=caJD0 z56tYr2&5~0@!u#5M%l85sLlhCNU9t+H(^KQva_v@Y&5)!FALzGC`BdAEx#zF8v#dk zJyDe^_#_bPE2TaAX0*E$s0srbCg^gpt}JCRRAz`Cp51_M&#cnNh}OWtwYa77grvP7!qSgz(huz&K`y64j9Qoi^4LS zR%>Z)3|UzA{VY==GszmyQL}NgKZ6`o?ZurlxSUMFR^ukP_L|>acgD=C3QQ|d(Vma2 za+>@^Uf+3w82VcD+r;iyfGu`LKe=O<|2QLkmabBlm$!^(S<|dO=z?UCFj-8K1}uB@ z5|iA}(G=OtF1h%niVVtev+cdJL_M^yNNbw(;(&Ekawd?qtEx+KQ+T7ywtktE6#UVS z*Q1HS28=YsDZi&0n9GfYk}FWBU7n^AN_2D?CM5fvid!S>n`W=H_sQiixf<2d9oe(M zfvmx&4KTO>gzJlSFjSP|iYb+#a{LVKSvXOgClOAon*CzseG1O9d&3`)Hr^rY3bi2Q zQFZfMm*to9nMp!Q7(U7VNHi$jL*q;TSkrfDHL8+EOOuLv_+`ZVGt$EB>mf<=XXU(j zRGw*kaQ}%X%_8r~_bod97VdxHqj@157+o6_r(u~7c%0OlYdo0zcu>hQnO?95pPwoc zN?-YNS&ZkCTST~{>GiM|w(^6b_tHXa>1C*L@7Is&o28``XV0G<3qe3i<_H0Z>Gp8*+b;uPK=f(gz1%2{wb8 zn&7d@?~=wYYfcC=C1_P!FN~Ml;$jFW_JgZ&-?ulRGolFU#Qpnv7L4?woQp( zEI+Dcer#Xt-qKXLQp9rYwdo&-{jweL+X!!gfS?XV)bO;1Gf+n8$wP5WvdF?@{4t=n znXWHFaj^)LdW{Q#S=@f0cIK}z`bq$rdndBouR>7X@upZu8{b~<4})^L*7Xp%TDGKZ z$~8OBn1$xYCibZbWM)OA{k8Bhy3LMI1iGLmuLRt6%({OShi^JN{*25X=Psjy(^K-r z%|W5YqB*IIxW>IiQAN){5Y&=*!`Uk2=%BEfp{niqiZh+9x_ZEIc>htb(axw`6OTpf z)!7PWY$|(RGKjcM(lD1*D%6kj>cIPN6Z?9~CC(AiM=B2RN)+nE#`2S3RV1f$@6ZKN zSq88hbX?v|osqQr!a2+?IJJP7nrmHzt*ri>n)7|o-MOXhOufSvI&coIvu}y;w3zZ> zVlc{xK;+v}VmJTfl;+GkEBrZuTURwF+6d?--EXF16{8OTFRDklr?0!J#lLSv4XcS? zQ;gdNy>CLTwB;>4(iXa@64U5zFYD+7eFoF&ohNKSH(h@Kqw6blnzL_RwfGHCRGO$J zV!R0$2=L?{S6xYqAbgOG`}X=ah#qpKy_fc&Aem0T|FpvC$2qU}>3)-cx)#p!F)D3+ z*Q%%kOVDK50O~m9k?nw5L?MPBuV7J9LH+1v8I#fc(2L__H;Z$`UBvs7gsEZGb{1k< zsD2fIa`p>}L_niv4gBOYRyns;+ze|(S=;c7pDq7Fu)85m=F_acyQVbbA|^Dwrc9HA zlxeox@_X@Yaz3FEaq5?<-C9QAwL$$jZrubvEMSx|8+D}!o+<{T+KhbfrHK^!Q zC0a;x{4ZLXRvtT}8dZF8%JTNC;~b<)_;at$<63Jr20Vr4-lWplaEpVODyA~h602Tq zZ>#)GfgbYy{JcF`r9?Z#_s?L2mCsJa_|edrXU`8e@5uZqRrd+aMfGnP*#1!;^P>X3 zz5Qc_*qYuv9nLHzo8AL-%iV11$7dn9^HucSGBiqO5$*IJie5au+SHFawgm!^$lTv^ zx7r~Vaq#SzUtI60zIy_qIHK6BF$N0(c|eOo@&r#mp-nhDZ8OXZL>>615fEn$Suw^= z>E3H~XI}b$X|+g&)F5c-F^2M=mA|gCUs+QU;-Y{VlO8M6%Muv~9wrbRn4xi^y&KVv z6n)>K{7%pEh5ygF(C}_YzQr)YvUcPk)b;tV9{czKLlb0Q*b;xLTw0|(uRx5BfG~5l zWWVo}^NMqGUh>9+8jHQIjYWGhTfgmWEoZ7Tiw_-0ehz|;P|C~?e3ET7yNtq%|85B_ z>yFeiD$xc#y^~X1L(0##AZ;m>H5IEHm?78{WTVmON*ur^q&Xms;nz}XH)>scYhST( zX=9wBwJb#JQRWf;)7c|$@cZq8pMyZQ;MSq7nO zTUtLbe&I!(=E`3DA{D)AL|4N2_HNYw3nu=hg{|CD_E-aEOXNt6^$)t$C5^kQ%*0g~ z{t}x8Pe?z10=JEio0!9z5f+l`df+oO88v6g!S%qeA6ke}OuBv+5;?Q^4}1?S1QWHm z&-G!N7r88`Z;->7gN+*&BLD^pRkKsn>)uI2T%)E&{>}3mG)|R@78)xzF?Z?Y)2~e% zA6aDm_O-Im;?5V=f)3Z#vOjOGxxB)o!fj6_z-YF|u- z;4of9Yk!gTBfNnv>$3B$m$B3*DLfvu9vu4nXXP;T7tYjApB<)$`3nQbZS^JJ*qnPO-7MwXj2FXVHu{wkSXLT)w%!($uQfgw{r`A-3!q4wCQNW} zhrwZRrw4bJ!QFju9o(UDcXxLm+;yOF*TDyO26u<+@B8oeb|W@6_IB?sqC4K~%FHL< zhVH8BswcBvaWt%Yv$u_$ziU~RzMdC=^+IE*9LB97Fq&2CeTd?mVG!;;Auw1X`2_26xl=S-;tuzK(xySD$>p&Pc)@FH^WKA^{bVsbAmiZ)Yl z=-LI3pQCa|mtAWSsC)jq(2@fyIY-OCsA+gn5%Z3e5c9TxpmVX|b;pDMsAxaGUC(?Y zuH&0^Y~9HIkFsFFhVRi>0`ElpLAS(;9LyONl!=?xCVyZcN6Trirg2I%=qoG z#TBxz2^#m~E3}B+ekMkN>@z@$48`^!3b#49}Sw(}+ht{zAv5MLCLEOX^By5OPTceC&Q%2NmapF-ak!M`G6O#3YvTUDTQ?*M4WeyZm~YY zguq@H4GGwBL#Kma<`Y(e?sY9i*DMA)e~ombtgM0nE3yi8SfC9FZz39+t%)Y3j!)fm z1g_Kxj;`|Lxi|R4uz-mCVp*mo$On)9gUKsL-3Hp;d0&QbWF)!{EhUvZQjbJ+`*u9_ z3XQI0H1_vkvk`kM@A+O08 z{i}|laK&q)xQ9LOOc}~2s^@Z`W2*o5f=vQ@{=zT?ib?MOxA6pcDf0!a+_bSoUPb4F z;&OU3nu%Q|X!Gf3hWoV_rWOTWZF{>ur?i+|!>TuUe%R`4?A$AcZr@XD{56kN-?`_4 zIni4X{zg@nIayr_e+IsumXx~Fr)8reGT;+i_>CTyk`8#uqdv+iaAbj>e`Mv+mi3)} zuIO8N4m*unsvfDR4!kF-P9A8e`k#ZZ5=K!o`c54$H(d)@`8|700H;v|5*|hl0Ympu zgcBECtH@;orw#(!|Fl$?dsQ40jZ>8c1y&wIxus=0coL>%lHaFgTmAE7ZOtTiNz1PL zNGPempH^bx0R-4_z#K90Y`gF>a)_TY@hsRd{Ret*#g+qc0gT1CxrbiIb0%hnU$ZR)3AUsMy-ze7&x$0$esWO+ueWPmWxkAWcb7(s-) zak7#lmaxC7^Wvc9s%+^pRyPSIw~_^c(LA)8skZhP(w(%y*S!V2Z7SvO8f@D%C zraSn=N;=5wT{f0s!GHP|TX1*my>mn+U`|5YS@zHBCi)AiiPUaK72q4fi};;WDRfCW zz({q(<l~qL; z7Lz|axRnO$O#Z6-l*B=`rsuti%1=L@fpI^Qbi74muPTyLRtprZS6krCuGIoaKFA-^ zZD3ttFYziKI{1%2MbZUd^H%vlaM{0AGT?7I46HmwTGI`2y+$rXwgZX{C9-pBwXA!C z4hq-?tk}#(1YEj}&m{NT{i|!+T28$OWsJOB21da!#XtDG`_T=iGRZ4peXw(9PdiR6@cW1LE@jG>)XKhXdMs^> zy9&-lZyuF-D4d*J`}Vcu5=kFJGq3(H(^jgqI}1=XT?l(nhB`>GKe1U_MJZe@zjLT) zF5szRt{*dB0@mmvgY>n_=M9 z(xdTGS*_mM{G~;sf6;1L2jzREku`^Hb!qiNQ*&mE#_vU|6&;4}m1fq>Hr1&W3k=s& z2IDDbwF~d7XSJmoR2e$!=$L)4w6RXHt!}7RuW$a^qA|Gmb6E%b zd!?1Nx^4B(>XiL^%qW<^9+SEUl`}bDuzjW;W{}qKyN@dE=kmL#x(kM_v z9oAPN2R@wQMJYZd$9ubEY(xI0g(gBumjgy`BcO)lQ}LT~J*0Gmwo>$N-U^P!3(~ znQ0ATR6v_m0W24u;xg?r2hqaM8&ad!YKKbjpJzTf%|K5Spp*JSNM;-;!8<(o83S#@ z0PK*Wrz%c0XOO7QKcGQ`9ND5|pGumip$?2fPr?bkek1b_a!?!m2vvo0RgSkTz={Y^ z$bC!_nR@WbkX(O-P~9nn0snx@H#=;-4{^+bqK@m@Vv6bOl7)_5w23b5XW71Q`Hw{h-h?P>=NzaM5bq7=U>e1184R@{E@RN<@%^-zM{WV6DWMsF4OsM z=2gCM@3nUB$eJVz?JQ72^6>4D{eYWdid$hpyNRQSZJ^M{pE7ZqAfX?R1u|^2@EwpT z$sC>^ct9Q^-yEV~vQ44EaGHJG!Ia?x(i!-6YAO3qnfVTw!r_$S$O_{bo-n~K_!OOq z=<2e-iCB+EiIPt*HUU98Ro4;e0yk^1wKJ@lu{ryFFoc(l2$qh2sd&~AYj(8c6a7y3}aglT9@Ndq_ z6o`F@6%Z32DcOfJ5y@ZV?Pzp0cdCRQenwu^T$y6IWeor5>|xp57&ob_%FxZz^nN>V za1p_mif9|(8DK2-!pls+gh;A>jVA~~b-2KQD8eN&!!+~3bBIq1#-*&hWUgO3ZYZS< zq1@y81#u#vgbV)}JfRxfD2c@#cQnQcJ67s2JcVQDKLxvDzP-Z^YqbN8AbS9`TJMla zotBv9B{r}SY*2D$t)YU>gbto1{d3VJWGYC{Gxjp6KR)nt4ro(u9{CNE0VAQwI2avy z+5|$^$Vu>@$xIWOiOsJIMdPV*T_38xg!!YkC34tAJ0f+1F}s+VT~Y5B9=&u-b?5wcQ=GM z>A^k(F^Fku4?QK0KRQjs`*Hlk?`x;>? zGelDVVZ3sZEO@oEYmj^pS~*`+P9}~W^)im?Jb8>o_6|!8e$EA$x^CejwE~;rpe_7@9 zLMz6ZUGYm9f6tp`cF3uwS^i~}*GsJ!XLZ#sWgMS3%jhT`SEJS&d|y4S?SHrWnw(gn z>_mSGTxO}?-!Wa`))rJqO-S0`Gu7tN)>lZ)NZLOzUE$I8RY)yJ+CMVY=GD$sNUccP z|2x0t(%Re*okMRyGrl@{?ba}nL+?&AzA<|3-hiANnk3Sqkvg1Yc5T|uug$5LI-O*8 zYsw>_t)ZB@^xLU#Rz`CCY{ki|Wi6MX)#ASuM{Q`Da^~HP|BTxHw~GJ1`Tt%k?)cfD zlUMzkK7DK2H~?CMqV6B@ziR!D=x7zWq-s;0UAm)&{eOG>7qd*&Je%tOj@!Su|HbNm zV6foi)x4(9(5g9p_CGI{W$-Pm9Umz0xUaVVzchwv+u5i7$=bg+Z~yhbD7H_Q|A~1% zE3Z!Z6R-2XiguCur*r?_uKm|{yZ?8@#vX2{=tdAXW^`k(*8e=FkCq)t>YuRvd!zRM zFGMyT-mD@vUeC&+e`YlQgBW?Kf6DgnE!%x`?EW8$G{nO51|KK5R9L;bK0qhr3GuC2 zdYPvUtO?REMywIm&1Z@bUGqcL1QCVCi?=(e*;dbg9LD+8kVNxXq+bx=`O8txO` z`&TUWwhbw2k?PPQg$IMCpjM@HRuhu3hk#nz_Bxi;muYM)9QSeKs%~&QT=orG_m2SR z$d+kfmR%zmbZr6wZQqRp@g*MiQ2UY#YHNTxvIIcEa?BA#ZU+->T=|op{JD5j$!^Sqd#~E)ufVmv4Ce zc{ir}7!dtD8M{bCvGk>SVVYIdN{Fq$P2L0VlNSAX=f3eFyO|E{a7XJMa4AEELg6m) z7Q1Gs08nS{BAc~kwtr6$pKvv}<;+7C>pwwPosmXM8)^M@029&WB;O=da0+y~jBUeI z+DgD?O|?xpYgxpdSNZ;*lNw(d?#Y9{u@Ll9A|5W%i&K6D(~?KH9o{qhu=T2J z5ZoEx!|NRj%E1TDr5#1%214aF99hIJvNPPKiw%3y$z_>uXJH3lxK)Oanv3teiEsl{r? zV4-XVd#6g*AUea^%FnY2$*EERLbfvfgGHr1HnF|QW{N1~*LpysS=kXtzmu&ITxdp0 zw!lttyoz9Z;qBzHW+gfL!?Dws#^x*dKhfAoyI@WBw4(l1U2SHA#kK!wV6x*4GyfD4 zkttk2wsrlZ=^3G|JhYp(T^)D(D-3-VdshgTmR_>;&n<%D0f40A-vs;3h~?T}_0MZc zQg4J<_-Hj-Wlh!acqaWN(;Mlxl)S8I@Q)o{(bG~z zN2h7@arh=3J-c(qE*GV0T{$=o7}9Rm+n97zFJ(h14sB{1Fr1d5x4OGAyVQ@}Atp0V znE5VPYlxt4jD03VW!?i{<6sd~k90Eux_!IFUP}^X9ehIsYbOQ+xC`;T#Ir|DuOQ*s zMKePrsHrdor&;<$269U(2FfCh7(aMW|s4k;sM48F5DRtoZ_eO?t>E_*EUAu zOEUs+)i4lf>hi^jcn6F`RD_{NG2BS!_dEO0O4F{>j!gIvOxw+UFWK^=Rr==^7#mN~ zS~00f$yF=^^HN?#{xRx^J*y2X_At6Dq3~IB*^v9oa@zym{SED_$zH)ruh6>Uk|owU zY85T*6NQZ5Dfj0pvK6WL^>I%MMPVgZBE&xUB;G|4ID+piOTp_hGKe^iJsc1lqNrbT z`qXKp@fg;fY(cim25(+ZtMC!o{j(42DX01U7?DK!Abjr4 zF)sx$*w#yGYW}CU15?*d{D@_Hg?#5}aM%TK*ygN+@aahevXyL*a86c&f7WJpl{ptU zMh{Pbbrv{=aSzXm+?1{FpqFzZV}{@!{2LE#j<`eL$hR4Whg;WA?CO8j+kS54&RKH9uz{xGC8a3;`LO(HNlu^{| zO_c7V5lk&~;iL7BJ4q_fYomREWq}aVJ9}i$Jd+Av@9Em@`(7(Q$~{W~TQAoT`SQv7 zYax|zEJS_-!gufLqTu0E0pjFm)ZF~XXj+wmDO74XM^u)>k+*h0iL!CK%ayq6@+8(# zxj)SyW_}m6mMo#Owk~;%i;p&LnM(z_j0`aPTet&6ae{4|d%uj!j}baMtnI!0e0CrR zm)m*f3w=svk9513_&vn$6l1N0kdou6yK-LHCr<|Yl;tt@u3xmt zO2P*i|B%dXPkb1nS8ZfvdZTP0ui>uwend5b{rg3`Z(D=*F&uso+WqHXrf|+l9kv7Q zt;+5wd2Eb4dKR>v)2$LAey4YFxb<%S8n*kVqF9@yA^8Fa+|zO(2#Zu0yp`iB3eFHI zoZE7r=%%LP^(IXQpVvEJ;l;T{OFN&Hz>tQFKgp9)CbNJP;o0geL2N)rM(0VW z5ufSJy+2%7`}Ujc7=R$*GmD>Sh|Cl{9XOROqzP|j+?LvyXb=11m+sdHzTinuxPTZS z!cZm@ZTEv7eCblC@5$b$G07Sg6y1Ek)2Cm~}>`BT?M0 zI|3}Hwvl-E_iUykULgKH<7HWoD;06`_VBXHOmA%C$Q7pF}ZFCrFTpgBe_C|f?{dxC*@O)V?7GlOV zu|wI6s`08U9*XBhH+imvnWVnipu8+MKM*$35-mLshn#g^V9T>*m#ztUDahFDb11|m zYdK*bDy9r2_qtKnV#OS?03brL)5xbz&iO=U(zkuVezxVX_>}cqA`X-EhcFg8jXvkM zVCggcu6bW6EVwRUMSo5E0}S1dA(D@NT9_LE+&1e=AAw4N}w`gRFZ!dE|XG}XfBW&3^X2z8TV&@AgTc?DoL|zP&P-ui#B9X zdH@{C5=?mOk4odM0u$1_{slt!y4ul^NV-(hrJL&eD=ukm1E393u>S`C`FW9%EyIFK z{J?Guye`LOz&rubB2ll2n}?)Gs6i5B)OU)M-Wng>!|Z@C1y$;8Ki0Mk>!}J@b24rG_WJ@aJP2d-Y2N_`+MuJarr^3*$RaZj zE`nfwgp-d5$yM+#{}FczaiQ1jxh)dE!x2JEkj7-RTrKEmsi&8t;-Ok&@U zaXCb@F_XjZl${V8NXzYLueC`9<|>bIU1xC!czbOSmOcDN<_Y5bpig61*tV1-^6m@m8l@Y<_zKqHa+$(;rI@2 zN7Lw^_oVb?aw0b75}1udq+jnK4!tws6|2c|Bmc_zaz!l=aGahGo@CntrvU{HuS5R( z1Xu`HRSSg}5VCx!f@BOS7!b~y3=zszIXo=1w@^4w6cBnT4b1V^4=hFGA?8H-Lnq*j zqkFvA?W$zzdJ-};<&02PKp^jgEbU*TL!K3BukI7jMKF992^!yiuthjm?2m%fO#w=4 zRAfHAh?BVjn0^)s-4P5p>_SuxnW3YW&0#*LQrahC8blbxiQ(1-F)_z#`mV>T0b8rC z`t3~tLM$;N?Eq+&eW|{H!71Zl`}vHX!G2sGlAPV~;i`&C2kci@%avVQW>440;yMz(aX? z0e)2hLHq!)qZ2cWJBCCw{;+cGe23!)La3sMSc9|bYqX8CPgJw!+8ec7;MUSJoYOkf zV=@{IX?NV^s)h3WiTmOjD0nd3gvQwd`gXx3TH-}^xmKTCBgsFUl^7%J_-G#hW08Fd zY(dsV^U!G{$`0|#(f|Qi{o|YTwUTI-QeJJMrr_ZSXtZMVgz~==MNvUvJ;n-)EdWeR zUj8juyBq>%M6agCcvywr8mOsxO;Q{>Nh^{8v?9w3BUp572=t_cs(=ergW1u=#V=ul ze*NlvinJll2*5Qh{SCQx?rfpl^Uw9?WG~1r%3EwaFYZW~Lt?``pmroieGW>ij{dqN zgRUw^E0h8(`B8^aTPxK0a~7)3Q3tOwjHOv^s(Auhtghi}l$bq(+Fc7IF?}^WhS=3u zAGJ~mTfYHy69=Rc?C&C%0{$rVsHPwxrx|Bdh93vjrOR_#X2Z1(uFixV!06679ExXjny18_cz#{)ub8KRLd-6QYNbzJ^RV2-}?J5w!T_Jfa~>hpxj zpA$FAAC&<^xxcs^^CKa9kHv3_gZ5+C)Vo0ISk!f)e+#5`i`2b z>G|NhUstAa<1AhGHM^cH?DSTWKhtk6`%t9BZ`>^3^T)zwe;V57iCPf_9PeOJC%skD zgs^Ltit!%{W13R+dsliiI2RiH7y}O4O6w%aqjOm3xpbcfkgp~RV!{7hoa~K~EQq4y*GPXdl8L;y61cIivTQoCNRnKqmXE&WVo|&G4 zk7nQb;T{;q=59TPbePsS2uUCeVA2lrBCk51-+N4$s^!}T4`V23Xf6sTq+HWLZz8H> z&WFz8C&t5CO>>oY~D(D@w%@xZk%jcGB|w%&KY0yNE(pNh6>O=#5A2k1&;A?FM!Wv zFU8p@#NXPQ#AIrZUre{bf9(vCAMi|iRQk%vTC(ZgpOScIBO;2zurowwXK@_m?f)k_ z)&%Qn3%fOpg>q~q$!Fvi1Cgr11H?~uC|>q>Q4>UQ`O`w2eh6i@|2*@{e0Da= zo1H*4dyI;jprJm+a4`xv6($srEg3R7##)Pf&icl)e{cXfr%hZpBD`oBfAI{SL%Qg7 z-KDW8`;w$1+z~lz(4@18?(s9CFk6Od;l=-=ICpvf!i)7L&K2UmgV}nH*7lRtM_D}N zpR!je?!QcC)(^A#0<8>(=G^I@$~eW#Ja-uWK#6NY`+QX?6;$^qA2IptxQi|7jml+~ zqaP7|{Bw@@Wx&0`4I&KA3kJvQr$c&h-Z?4|)ZptZ!zFY}E8^_R7$uJmCmsL_8Zv{B zhDRk451ukpzIJ`4g_K(~Q+5*c!9wRv6A#!e42vS)`KybQMa~%YhTKj|KDB5D!Ly4- zBJMxhL4U5m1K}`H)6Ka zZd|!(uh}~?A{7%dMus;!YoA_inUQVn>Eghk@{%w{`WLt>q`@@2Z5M_EdDBAd@g{`@ z$6z%ILjecd#b!+ZtR5aU1@ex+Ii0rXm0qS)>{g6suH{Gna7Vx1wf6wJ_uCgS9jEbH zFUTy5xAi3y=7qvLrs2}dD6^>i#HBC6m&V8kUkIdkwjBaX7@8;{x#|a zPt`~ffV{mbr3sY8s5DwKY>5N?e_><+8u4Am*z__+-!L5R0!!HGq#%j)>yj;Dq(S3I zIA%0Bl(mna>CHTPRZ_7jArzUkT==!@&~LBSv_^IUnr1hN?T6B$Joagywb zEr<(?jK{oL5a=wMQd*MjF;=**-aXKG*PZ!mut1{)C7$Y;z!`g1>XcR0MW|%iH>@%2 z>G|~{A(r)9JOZi&|0hcLCm>S1-y2shp6)~VW>)UwbkBPj@s#D2a!>HA2EH%S1SA|t zmQ3(u%XhKQ@BQrK;`_mj(bt$%%;gWP4mKrAbmK87>eP1XLsf+kAC@Hsy({xcx+$jz zQCg@Kp`FOG2K$MqY54;A30FngHamP427B;EvcfI648eKRMlaWKpZT`QjP7&~h<=kR z|@7(>4$ajWl@*3K^xIBT0qzR_l#?ZQ861gyiJhSS>Fg^n1 zEE`}*c6-6uSgemzIVzVjX)u(+zxCLDvNDwbAT|kLvJ$@ z5L`Gyp+mlfz{PQ{b5)^g=4^A{|AFh}_hBfg(!}1YA+Y@m;obyu+Y9qPI^Kd@oH!5{ zEpyM|0hb985O6EkEfVC717L^V999j0&7#=s5Upyz!mF!Ky#1& z6#r~r_u1m}_6zALF<#RNH*L;7xiYyOJt8lGus!0+rs07IhyIq0(_1h=a#QV^hF{5z z1Wc<96umneMoqnLS}x3;p@`B})`lhpW5i4K^Z%TuNq|h-wuBr7=g?|sCyuvLhzq_S z;*Lo&6X`XQ_N+%SAJ2*T2V;3}UHnZX-|5hLwnHTOD~Ek?XCksB!)mHpN{{}GmAAo5 zTgs`{E0X%t`l=+y`)c89DafR%uD9A5nS3v=kBdsdGFQqFTx)^y>h2qNzSedTH@d+9 zwF{1*8G40FB8{;T{b*A>w^wKCBqtwiD67bVaW(wW*?|h z=pmn39guOFAcPYgyi?=NQ)kEoa=vT)1E-@F8lHxY4Tv3eX|GN)OXMqi9P;vZZ=hd2 z9vAoYW=;mHGlS&~lHk`<+BnQg_?(N5lX4z5x1(v^>S9h8r4V zp}ge68w81+Y$0ONDmbpZ)GQ(5Y397pEJb2>p*)qwn?vl2UQ4%k=(T?DFLv)h{(f&A zyLa#*5=pnE6M5kz2bjasZBkh;Jb*5o!!f8|2r;4fx7KjM04il9YKw~E&E9U7t*K{# z5wH+#0{~8pgj=_Vl+e2kE)NDpX!UIaRzohsRbZ(_9|boYZ~mqTqG`G0ji$vp*;i>} z8o;czF(tD(r?`U`=8>kCdzA~ErqsU&QapyHu!TToFAG78g_1=Xj$u6rC>y7J`m?4h zQ*HjI0L*UQfpOIO<>62|BJ$;tD;ilV9q=-T0vOU+O%|IQ740C&-Q#qavN2aA(H4SkQq_YFGM3U+7iekSj}F8GAG?v;3u!9}^Ik zsK+GK$Q454bZlpy<|}6o_d3DYKegvymbYTInn8GZ&DKfJmn2Y=mbW4^n^8S|DHppu zeadkjpa@x)l*qCer zG9}Y20vpp$4sZoB)fr6Ng4{aOX=_lec(&@&4l!q^|4IdU6o#j$WC# z;(mru?X0C>PW}*S5El$_d6Uh|0(2PDy?|7x=%v)X3CT`@@vg4}MtYa4_*@ir%K|F|=A;dg|?rY#RJ*{3c~ zKHuYLW_B#U)e}@=oTTXjc(c_Pz-Ygg#w+Cad+b%wG(fdg&Z8Kq3b#b37AAwEji|*d7C=38d!f_aF3eV~vc6K}*vZY#sjhiSTvpGT!LPIxRnP`0YK&`W{UvJjES;kK%Juk){+VU*Di ze|Y9Xd_S~a2lt5K+($|Sn=Vtlz= z-t6+UHop+ld+N^&RFJeIAXB$zo2zboNEo&q$v@7nV#ZhJ^{?!PU6<#dX~4|!SxsG} zGx@kP;1*uYPRgxvl?u2#rVQ_}B8}@Gh@#>+mv{33%{i9dg@WXs?doDW@esW{eQDgW zR8}zSOPR`tvNBonG{vQzjZu%JUUQBL7R0#ia3#~RH;+@oZ(Lj4*(-s-yAsz#geW6z z6{Ar&d|8+;U^`NisxGoDDswMr|rMD z{^EwmvsR_ zi9vALEK$82#c1YzO)%tH{CoLa-`h~`KftAcpJv#30p)3jZYD}!+`{1O+hJ?%Wk?TE z$cBp9uz2WP#(yM$iDwgU`m*c?RK1R_`K44Cxs!N!?iWXB{ME zEB>yZh;{KV)i&|a9;mKx8`}AEr~BK*L_Pqp$%5M~wnZMLx)wqJ{}6pZ9d~#A8kZj> zyR3xV10MfLawNYp8cn!_ToTHKM}OvT`+#EQ-TELqbvwVfWAY$Lh3=IC!r-^T7J)2szc!iL2lF{d!$k!Wr9E;9KD}$ccm!RUO}wGj*`Kuzqc;> zOOOGxMcI!T7gT(zCU&uGM>GL*wrhgKX(=|Nft`f|>xP@`M3ezVXnK8{dUcxbwal>j zpA8)9Rn;iVI#ab~zBwgByyej1dw*s)Pb_==N^U){rvDc|qaP?petxZ<;ZU}RJcMU2PS#p$pVn|g3ML6N$E_u`n05yGAtdg-8e;~Ne#;;Xi;wqBqMJzo$04s( z+;QQFf19~=ZX27c=<~GbpU(N+oZoDio2oG1x3E1)rHL_wW__uaHsQKfWvSNSh`FRe z@i34`pOS>_giswu@jnW0;3uGPP@^ZaEp6-hbm+J2s|Io5IG3hH5#O^Hk8MbuZ#;hJ z5WBbVuf+6FY;SAi4#x^%AN~04zCp?VehDAKwngr;TRS2z&F`sSN8sma9w4~w=)PNf zxkj~nhG`u}IBFw=>caJY`@-)@USs!aNi>a#ip%w0jPC)0N$-E8Q*_<6?{Ue8vwO|) z6^Hfht^C!1Z;uYPDF4JCOjvIBy6pjT0D+W6Uo6J)F#gl=*2b)NhOn`d@l<>ko0e{|uM&e*B*(bkuk2I|&B9N_brYD5@9> z@-$7Gh#Avz$drs7ql+8m>RWrqjP~eY@EG|Nr%Nc@7u|ved-?*l6kU{L-J??}1v(2{ zUOo(EO4}tP`_w(c9?8DgO$P36eK_KiM+Ogk$qOX6*iCXS!(&VczG3^(n@7(ce|nLx zWMD;0>?S0jKCOsrXP>Z#is|ripPJmD7H;b5y9{UShCO}kCIy+K{lF-%uRG0pu0C3; zqdifN*8cb`!IcBpwSD9tS39B}Nz&NO#4yL(Zo|XJ!J1COU+7@0{}LN=X-qG6!w;l~ zss@ZMdVt{@WsFMd`VL z1%0q;D|HYYmU*q?2VoBkhA$KNwgB9|vUg8EfH)&5emD+SPd_|4;SckCOhzR;Dd%a> zJH4A!Y~Hm&3x`Fv5u-v;%lk#P0i!}MLy2*2(%df-Tr@d9wr^(DoEDYeN@x?j+37FA zIQ8R_e;||oPdwiULG-$D$>04}+#ja|vVyA#hLAe`f+W>gSzrrr>{XXcFqrp^)B6gN z+tZJd)z?Pc)9cwfpW4^Pa38_d)O2uz_hAuBvNt>LotfV5x=C7`M&zUrQrk25_H6&- z7WOtLXYjaJl(KsI9;Onu{*fPO-NkNSwQSH^0KarPD~(-_eQsbU9*Un~f!`tl`4004h~Mku96ALO3IFeTnQBDkIP6 z%xN!G!r(c2aDO69k-n;>z*Qye#2K2ec4kSO*zGN~?{89%ONA~dK3obz_A6GxFzMam zh?APcQetM3k8!+>EntZtI&&12;5;) z5CTQpu$|@c#ASY*&o&!UfDqb%qQ|uc4-|?Q5O)2Z-a=PoD|N)1{$>9}a0zf;zJt4; z1$My!`N20*zc%d54|==b=QZR9`E2+#g1r1+z}8IO{2&2Zb?}3nr?TxHR-l9BFz5DmL2WPvJ*{ZB(%*sDHl$ucL7cCm2miq_mi(k=Oo6mSp<)vZ^Vba`Ze(tGx zXqcp~B~po@Bfyz%*3~$4MmAnr09vjC%MRG$S$U9N>VRLPwG@yly)Am@Z*8sx#l63{ z&T=`an(tsjjMqDO8~9{Mn-8HLM*A2G_8)uh8qXu{dgv9!e&N>(T9RQ`G`rsSHf9l* zvnU|SvQD*m4Mcy*a2l(Jxegw7LENd|PBE})^fO+0>EdbMGo{GH)J$+uDO3S9Uyf24 zLy6YRpOK+xO=-@0R{MUeeByCZtZZ7QqgQ_%P@zi6Cf1+SdQXEE`7)o^3cdUg%0hR9 zzR4;@I|A8w$AxuKDT7h1gWlLI77O9Mo6RR_=AfmcGd#aDem#XrJZ=@goYYKN^tV8G zf4YK>^O_mmLyL8zN>dg(;Kcrl0D+;<#ubH z+yoC}AJ)F1v{O~jE@&f2NT&!n_sFOJ?NQQT+*Dc*@j zh2kDU9H7J5Pqgh8c{TklpjHrEB);e-@R*>kKd5Cx8ek4)b49ijN7rVaU_z*V*V~N0 zPgU{WJ}H&H7T(SWQroecL#&@55(r_o0t@NVpnQXGfa8?sJ%jtA-`93qfVw$?S-Ob6 zAW^C5_yW{8wBtSn?3V#2k_MUlIw1%ZZkFD`6f}~r{>p zuzk|&io*E&GyLj#FlOJ}ru)Lj9UJEeNrczmgV0Xp8G(6JYmaaJQgE7O`tiO^Sz=s3 zRF2J}YYQ%QBW8cdunhzuIF@GWC1r7S#!4kX96%*{UT+gLE^u_P8_t3exlr6#_hpcA zI{h*oL%2qH;h5Rbhupa91NV@nBloFydu-BaHQ>)r5gvk-j* zh{kY!cEz7cs)2nUun1K_Xd1WQjCUy=`BKbDul%4kx2NF&p4j)2g$3HUMEQqxk*-RU z=zh!CcBzSenYF;jd{BywNLkf`!JxT>8btuLZ@MD1KrO!oKNtkh-4#=Ea4v zrpWiAIM4*8a=E}j|KuaP$7z^C+4XP;^ZOcFgN4Xs32p=213JVV56oG^z{P!3Enz~K zoa0R4x_p+(DSoEf>qVNXLUe1t*QfM~?4^5mpilYMuQ!z1TWEu;T^Rz;TLL{H(Vvk_ zUC9UT&ybjE1*2l3%iwm)KS+^khH^fuTCHXUZ#)zEhD}w_ zMrG#SmIrjJ=d~U+Zq$ReoTmI6WXLjo-({4Aj|~~EMJ&ph}2Xz%knxV<#2mZ4*`|* zX6Ep(-f6A5E?@x@AxnI~b70P9xv5+cVq=UccX-C@p9E2yvG7e2Z+q zxmL9gt_mOBfu3bK;=cNdwC8vW!V(kYW*sy2O|P^1beQKUz}gBOZdJjxBD8%gN^o(rhgR>o)m?knxKDBSev;A~<;k_jCtF2T>!PLZ4ATpCg5a-0dpx_l9nyqPNq?36J|H=pw2C!0FddD7yzOq_3I?F;OBsJFoc$uA))HSQklSadDXUxd4 zzCkY_?R?TT0h$~Kqm*>6=O*RB>_ z=2IULPv6(BGQ+bRGhYk6CTqhL2Jj!)4dnq#mWm=(#IxR45t<2q`hL&G$$Ug`tDc^^~8C)C(J^FS7G|S3T#Cfo-0`Q@bCUGTLIjN66&lwwTqe-)d36*CN zowpUiS?2v-7jLkEUej8i4S{2HV@#9AU|#jBz5(qh)!HWW+=`Xi@T|)gWqGQihZSN1JA!CuDZ2> zjcLj5+zW$6|CYF8io~_G$9o3&KVpNWj`(LgHE(2+Z@IByH zwZ7bl@Ly%d;lJ|s!94K?wP+gw@EXfS1>UG9b@%0!T68{P+<*Nr1*dXWg3Ea36MtyyH83{C6P8^?4X!dND zDL}VNpBl$Q*98n43@ChcIc@M4Dc%G1IBf!=_!XY5{rk=Oi6cz=cjz?lPmtVJ>OyJ> zl!*pSy3uy$oVFBV=w9w%{@5%Bwu)t+F8P5P-hT!oH{+gyZ`5CRr54QA~Cj;*IQn`J%Qq_<~q@TybDl+z{L(?%nt zBV*33QVf*Z$pa`ma-OI_@Sr~H|L3$HdKr>faEmhxr4EMQ2V~1gV0Z%*5Zr>5{Yzx{ z(nphCgn?QI^ZMwYl`KMo7gvVX_V38+1CrNKWq%Gg0oj6$sWA}hJowYl+9u7QY#-Vl3V}4{#iLtDlO{r%-mQ|Ms&mYZ~rD9Nhm0 zac>=0*Yf0x1_Hq$SO`vljXS|DSa5f@;I?s>AVGq=69^LA-9314cX!`xg58yK&dj~@ z-n)PN=G{BP2Uy+J^{wjewV``eSJg6RvR>@5ia1g$Wqpk7Yg9)foPyD?*R8OMJn&EF zD%WV}ckb*VoU_(60UjaI9Vl&dm%fN?5pX(bZ)t;yv5wBf!ruOAmrhy592)PZS)znI>veIPxlH1N3&{a)g_+4 z)&(FZ3Za7o$vPvenM3c4r~i>j*=A_^)e93YJ(4xNWB$(eBO~%M@4BV1a|5g>Ac>{R zd(5ZbsMr(0-(9yswk7#*OlG`|iUU^6N4#V52VD8YCV*s)w;_ZTcAo7t)-VA-BZYO`>0O4&&4B}2iLme=EPq6gKVUrTn^gbQ3%ZUkXZje84!`FI>(YgH|!g?Ud|#>iSerchcwPQl}H zBc)Bp!`=v(DfTn6Y?Re|1*J-;(i3p26ef!YsZ7NIl>Dde@271 zOoSW%=4tCrUG0(pNzP5uoN}bw18Jp2CY|uDyZ@-iaKkqDPvZSCop#Wej{flb)eB%9 z+o>yE5_m#d(D8-aC&2*o+TWeRY!OE{^4Z^&*EpEB8SXJw#1wffZ^69TV-&)=NZO)L zc6$I;E}o>r%P5KE%m(kdW%mJt%A3DB^8C^)@VBHzxp&u?PSnfoe>gOzJ%-)3-kw2G zTvr{B{kKS-12!2oV44PAmI7>n{|IWe3Mk;mth`Fv(slL#B;F>?@wTQqQ5sKAZ;xiA zm1$vDaXDF4naOp|r1R8i)leDR?@rr|rum0(IjQEFMYZ<;O{0G|tsnl40AHHP`;=;3 zh0Tm$hNW=8P@C_5NM8A$BGykwiE@%sI1HeiPFA;O@+Y&UNR1xs63t@jzx+%7QMZuJ z!vbelL$$s=N~FOKycuqqv81|KtS&F9ZKxP)rvAE&jEAm7T2nl7zNGY|iq5KYu%wjH zD^U$p{OwRj;!+cLW~(`4NIO|gNvNv0l$-}mwNOJ#Ef=lKUOcS0v>c^K$2vFIeG~E7 ziBf}_^TNs#skKj!D(-U}9>bMgK{^{m)3DG}VurS}Cicz1d!ni!8OG-oVWhWcke?b- zioszW>)533)lc8>%e04|8s%2$nh@U!VS|YGOcQ=0i^NNHipo2$$A|~_G?pWN>eUOS zWp}gY7Xxer^cCopDO)I$7l8?x3jBB2=?rN{v@pjMv0#_rtqIu|Iv@@9H}=ORVzBdd zc-WOujmztj%LHsMFh;wj&Iqm@=Yx-@L zM2913b^x&Qz20Iw>HNl~7xlBM*@*M-l?q-mwC(3ehI13G2qK_E`~4{|GSyrX#9O{b z)sb16tXPy5vM-GsGvAWTKRi-26i7pQYrq!)gmAAAz8!W} zPsTyCtygVKqoMh@yz7t5^RXq!TS*z7+N_nh4h1iGP29I~u5hlALUMfQlB7|kSP-Pf zdkFltBud}Mh8E!ihr+vw?Wf9JBe3jpomyBhy=3~HhqOY#(wW=e4QG;j@JC@s4tk+oZTLpD96cE+>VOE#-6yb#ySlLQTqAb-O|M<>DgeI zA69x@6RI4q`@Up*yi(}B4C|IJQ$Z}2?o~$X?hx525+<3O-xIK`hk%nXWXSD^2p2Qw zFGTg^$%K6l39}EsQs$InS9x!4+(@Coa5@wVVLEZVHJC9UJd+{MnAi=)>dD0?u;uwe zf&`+mk;1a(mA)V{mM@Y`o;7%M`#T#u0)=F+Oc1|Kyg_2YUQGXIV|I5GR|8_ z8mpp9mlW+}AuGMa>)d8guWe z)mBh$q+uIHlA6(F^9u5rH@7MMLUKJN=bhO*Tg&9cNM`7Y02}$PH(Mk4?d(iaAARMy z21S;m>r8G5J>hc9O7!+EXd-UsbeJygEAg-bNL=1wqlm%~;;~K_ksspv{VMpEC$v9R zBZfliJs(1=ms#b^^Z{Y>tM}l{k2ZHOB?PmdzmskuV35$nYQ7 zM3YLz8gV0Vm1xe=8C7(hUA@uXUy-}AG{92{!ZsJ?gZ)xK`r;SQ=TjzD7aYqppDe^D$+Eg4g zya)ASL?jmS-X^RSYOu}=y&hfHkvvp_Ow=?k(>&z6(kx%NiowCz=ZzOlX%8?wyZY_V zpDPGL#SZsb{noAW>Gb+f_Nz|93<}(Sf?l*uap#K0g*Fu3z9)Z0U?qTo-XEQv{G5%f zG>@LT@#2{hszM;RIO*eW(K|`JS-n7PMhR0Wa6Ehy{60GHRrqVJZD3s8vsW*Q19cGB=1a{gUan?}$ z3;u(n2R);BJxy6g=#we+M+S*%uGxdSBy)0?oBn#597Zdr=Aqb7v&o|^=R^w3(L8Gs z;e=2#N8sU9Ne&{TuE7Iarh&x4$jnjJb3i9S-YjiDdO$~~q$j?nthXcSJUU0Xpvnw3 zcn-0KbsAo(v;;e{>7y!P7D$y_{kA5CJ&N$#al1(Cd|t2U^6_tiT=ix{yG@=Jmj{X; zts8)(QWcM^ekTi0b&DN~$}T#^Mlu{WMPC?aD)R~IRi~1y7M106iY;Y0Y>Sc@XR7nH z>s5!7tWuS2tskGPJ*pqA>-k0JYBojT zjA~W+boHuzNyUrGYC6SMGNudq3`<{4y{c@OlTP}o+cfL(h9SoPGO^C4BI#tNx=p)Y zV;Ew!pwGBeV(Rr@OB}6k)2inhhL|m^GAyN=dezw2C!PG)65WO&b_=VFOD(2e4K`;< zCo9!$I`#jxL_vn75Yzig8`7kco@yV>dW>O+(Zb(EpKPzfNWSz?!`3IBfQWRbuFK5_ z25v95uE<0Zb4QD=rnvo{!OUCMO@|z4P>;6*iAgJUl1vwddnn%%1i=sLXm9-aolF1HCPg!l{28Mih{@1?Wfh@wF`7ep+0=J^s^^8+#Fy4&qGCDt6=FHPA z4@T@@q`1EMkbAo=V`0fGrlXt7j2cyMx%!qSETu+f!@|UBQ?>~8HAV)QuyDXT^qq+f z+#waP$6CCeBWrrEB)Y}a@rBEE?KvCgqeUFll@dGCy5m5P?mVd9v#WLmgPx|(>m0^T zEgE}ggr%SA+uJ6<^nC&eR8VhEOy@l6k{iHh`u)(`im@xH9zb@4QqUf9h(^qa0?PE8 zGAbH~!aRcwpQl&%`wd8nL)HU4qT%}g8}p2 zZ|lVsggvo_>=)Q4HxxgUv$uje{cgeM*YEm1(^_mIR7vTd3lv>|Cblz=&P zktB2ooFq0)dk?UoIeYauM*rj;a>$G83BBSU_^pnl>V)mLbCxSfH2$rc< zYHvg-P(}C}$Twe&qMMtZ3HnNcteMkE3N7W72w=SAt0k|qF+ZJZhU`hAXI}&AoM@!0 z9S=W4ZX1W}Wu?Es`Z3PL;-&ec1iv3w=5TMw0XDw5nb?&ClN^;>u@|D+Bh*>(_9%Er zwG{jKFx0#dS6?(lNxVBo%B`@!jaI)f6tIY=|eDztZ2~%(V%(%x1 z#^kYm=+;H9dM5_fuXnX7s9_7_+61mXGqgaQ-3er8S>nZHO9)D2HCj&zR^B%_HZBw3;a$8bqwqKm-@MTD4aOfX zr^(jTcpIDXhG43Kg>K?TY%Ls1&q$Ya()6fR0@L{-l@?Jft^_YwQ5bd@@itYGN?M=A zRv&%^E1EE9A8XV&u+%?v@X`>~{``xYPq&F(BIgaS&8lScUQ;$kr5NFx!J?hbvSKAi zRuNxn=~uAhpu-zJTG*%QJB} zsQ#O$m-cCwAmsXR);DT?Y06sj{tmlDpbV=%`{n6amj3ACIA9=Bs4za+3vClXD}pl? zO@F4gS11uXIY=yfB&w<@)Tjcq%`8nhDpmomHVuUv*YiuhPyM-~ML~aqzHb4-%2%_# z)Y@As^zbw_`~|yMUo`pPC(LRn-ubFFWMOHFC70>tV$b2R<-DsK{x29$FHaY1Aqkt4 z1HY=57ah+>6+u}a1-o~~zg%^$`GKxWvO97O9)JJ67EV3X@$XiEmVh*k8alE2MQMy`4f%)lsw+vwOaH>cyEBkLC-m2H?Ru}FQk)@M z=l?wMKf7H2|6J|=1N^^dwf_%$ zjsKq2{y*$B{(DyY|FGBikE{Lv=N91qI?-}Lka4Nd^uE?6JLzPq+DE%yVHoniAwCKD z<&O-K;To5`rj>1qrAP#IM8nB{=vw(gdo_B)9GB5$>eqn_I>^CBzdlmRHF&-?xUX^#=`f$w1Bz1aWh>xyc26cnj?3HYJsF6=UbZ%)z!Raol4vA~wgCTz9 zLd;N@n0=_s16h!`A>Y{#A?6f$OCwZ!Fc3An!AjbO%q3yC&edfEef`9c2|4uJR6n?W zq9~Hg#RI%u_#9+&kcsO_DpdnnH2Bl0iOfDGu+h5KfD&5Zd{A0iDR$d`q>hE~Vex** z_CmOnlrErmfX%{|cN6)zBfFEgjI&O_nKTd>b!8qADS@!Lk4?g52A9ck`!z*w^j;A# z6&;YpI+wQ$Tt>3e4sRqFOXKk}+>m+C>1H9OEFm*_{Q_Tryfm^iW&?_yGtsn7>mu3b-1n?%@x-FpP-n$z6PoqofrO+#ebIeP znM@nPhPh|WFB>$W+2k(JHl?fkxaUSBm8jMvusoHVrzD|(Xs**~FB*#HF$I01<&Jz! zz5ruBR0J%AF=kEz8{mzFD%2rC>B#XVET&hwT2nu|u@XN`L|J}3rH#5txrsj=$jQfRy%S!i&dj{{6jO3F} z-@YVe2sWsQ^<%ZNCvX(IVSea1*?2)CiX*KwJdRTCCg2;KmeV}1DZ`7*pZ7fLNqJ>*Z@wq5b{ll^-@A_egdxfhc!t%rGvr+T|{}$3s zx`}t?XXi0d^B5QUCo$-a(08jf#FH@8LcRAUA=lKifE<#)syR4wDUeE_IUQ(r|%p^+M14d!|qm9|?O>lc!p9rd|`} zT2fOb%2rJPev0^!V^iIem?v2BD41>|w{VfK&iEG?JJXo3IgIa$6@7j>mnv}U(o{6Y zG;HGCq(7K#_|~L&84Wq_{mz1RHYjZ7NAFwvue>NKq1^0;*y-_OqD~;)UL&boaWN&h z_(=UE2~Qb&f^8F0vAvtrO-+0GhEaw3cA~F_T!CA5FSg1PjTzMrnQm8TUA*XCLPYM0 z?>#jKE9pKObr!CT5he}uO-ODYPO~${@K<)Re%ldDl{oUZtnPQSZz{ir?mhVPm;mWq zMQ4DT*%lvHfrFT#C~j~JM&H&06o^NY_$bg!N|fVr#qdaQiJ9P$07 z#koGU9_rMn z_U|d~e59Q76xs{!<8ZcYqqw&=c0tUu7=;8C`@bLi)plPczOGsSPJ0k{O!;eQUvaJ> zAgJZgZJ$2_rm%71Cm%d<^S1SN1+shYSm>uhc*C)+ithfW?&9p?pqaYRJ3=*G7Hwo# zA@PwLMT9p*M=8-VNAOd5rP==XWDb)%BHqSjU!)szVXmla^J`I;lSo=tp{Aap{j8Kk zUju_ATswJcwsbROD*XbHsY23x*Ht)TE5Fhk-hJd59mrqD9W*HmDYpdgnKWgeyZ;(; zYG-Y6Y4zFcskI}vhZ*LoEvv;@PJ>x`>J-!-E;+Tt^pfOphx>q?7B0I=TL zR{w~3wXxuNnUF-TZ}I~J9;{ke{qbEU4Q+6H5~-S^gO6X=2>*oO)s$9np#vnqqbV^q zE!(Q~EwiRs;D|XMfAHR{TrU^d%LF5dvKg4W308NFWZ$G_W@FmM*Xycs*`QbE85%(@B4RzbFui?;sd;AqDr4W`7x{&_D>2%3+>etX_2j^sE-MF%*YCUV8~S%hU~r7 zlWv*|3)90ToA5%$p&J&)3=h(*b2K`{(9+7UcV5|hE-Ql1dhUqry5V0k_pp7!BH2;|LI^!7!i z46GMH+2nvT7e05k>=!RIghB_<2L|wFIkqJg&3(GMr=^qUY>@O~yR!QHQ4Hi%c`JDF znf5vz?W9Nw7kC}JUqUdtlYG6KDhn1qFx~~JsnRCmI5&LExL8I>G5G;69l(45zKvlX zYTNzVN7CngXn&r-Q#_f9?2$E+CJ;wXVvG}7or9&?2R2|)At^@)nIJl!UT9!-qXdQS znTMc|PB@xDFGFkevd-PRcHTqLPBpk0t0!AEd6MHY9y*3n8kkYavZz;N7YwTeP4J9MDsvqiUQykBh*N=87g2&*L}U5GVHr!&_*UdR zz)!5^5&nK+rzRyE642x^{URX4I_-zWL}bcKzO9X^0C}pnU-I?O9iApVv^Y3!zHI@n zfmu;m0fAlwIR72nIpFPvre&aJ9q5K%5U5D$8Jx<*ZN+5GA%cC&G?vTAZnppo$ zkg)Xue2c%aT@T!Az(I$`Y_vVz-x&SQ9ZHO?7!)sg`og$(^c7A+C*13fDma{IvF?zj znNKgnCCE2={+zc%f4Pw?Qu}z`i-D}N*CFhzQVeg$1P@jgDKNe6^SG>|#g0$nS4#yh z!(2Fdv8pA=ArLA1SrQ;^*L|LweYT=ZmDHwxjlyrXSA%$}fDoH#IQ~qZ00i-Dq=BB( zzo1xP7YNe!!3spOvu}x-4)Z=w<1ew;`wdI~2>QFuJ^!0cvi;j4wS)+}NbjoPXI4kx zF8%3-eYOP&{aycnXylFQyP<o%S_Nri>;aN zpfdZddWh*N_an%|R4MnUsT~(YP!%j%ZW&pKXxqDN2vkfeE4({HYrNHVb$A~2vJo}w zr5JgRHQx@i&rwrFU3E?7Uf~RRabu}reMt#Z%01x@-1zg|w;=0k>>ubN$4Y2k-@Y5# zw!r;$5IwYUlJzGw86(1t^iRNvM!gIx>I(wH+AqoGqyR4_!=eyK8*mN`)?Adn14RzP zUH^ix-S8U(byckkxv$rYU~q?stWf^`N`&{+Teu>o+{DbEWUs14{{xW-xBkNr6RR=5 z;4;6VQ4US8ELbJ3ZlU$Dx9~b`b@T=$r5#K_vsMK~l-p7X8DYUGBn_{*&-oF@es1H#;WGfb9Tpn&LR87RSfMee zv0G8s^_YiyOHo(hZTJz@S9l{Dd9LgB^LJOyqT^e*UpAX1rqF7Sd2vAI%A}Pn3pt2V zUv7Wh_ZH5@6MJH|6pKdoG8 zzzke>J{0?t%^Nt79xUpc)Z?jTp5K{%BbnXeXkk#Plh)A7(1(eUtn&5IdFNNVVY156 zJqgiQFn{F@PRVvHVpjil4m5cDN{KvcQzjs518_C!(=q1nVV?I0mysS*@upmSK5)p| zykywIk8;;mU?r;X_WIIM75$?^8k)Xjg}6>ZCvAHq>eF!y?x!wk3w_-2!V1r z`CIrO>c`gQr~bHjpz8rEPyM2<DV^b%uMKZf%&ou2`_!Rz$yk zbD8T~&#>rElv2GI!NR>G48QEy78KrE8fXrLNYflc0{Y09ZIngcS?pw9r^D2+i-qOm zUp{>3{N)4@+eVGRO5L$iK8&Bu=c>7}yuPk@u@eg2XS;0{=Q+tB;zsKYQBU>%(W90mbc zdKusb=k+X!Ug!;JmmYIZY{(U(==e8&nTCbm%=6=b6W5Uh0LMt5FMsZ(_VPR8jGTo@ z!{;cn#7cyHb>yztRv9M23IvVH$cmM4EIyjQq}f%SnA z>Lcz$@DrlDO3)tm<+~e?U5vN#q~{}4f{|^`*$`LC=J(fp(Y?}N-plXloEky=`$JO> zB($kH(RF&+oMBHJIA7UQQbqG)o~Kr67ewtkzq#g?put8Mr&Kv+Y+iUw#h=&;39yXXV~q#n9xH-N4*)+tu<~Vwnw_37;q#bKDgFaG3a`HTdP^FjXHEMky?$R5f4 zQj=QJE3qJ=wch>QIZu!iKh?2FMMHe~S)O|z8$+_nR=Ee(r;B&A$MlIi<`a%t^Q1|G zK&lp7wSZkIm9A6I`<|V2Oj!IPes7jAX*&Duc#*A7R{^x0 zY5wQp;m}fR8ut;_8upamqGq4@F)wD@*?i(%%lVJa0>0D3s64@Jm3nu;%yraecFc$N0j|T6GFDzMndK7xOIztjS?Zx$G(4&6=6RrO(2{H)ZE!EcRWrjYTZm zw|(84TR{U31s(=H!hZv6m;%k){XqM*z^>u7mNMT_=A~G#Sn`8pYBSUJJPR{4YuX}< zkj>_3tu{UmO&kjjkrPzQR<_~T%TMx4&99wxJ7J#7!ZoUqIF5OBhHK=3goUq}SsA0+ z3^;wI*0MU6TMVPWFEbQ>5xI|@9VP`hlXdurPI9Wbe!GH$?!|pjMzL2()S{FG|I8sH zOe9}_C-hEQYEPhsx5;Cf_O%C9!|G3=QU!NiQ?0S;g<7y0GP9dOWA&yJWoFWf|Da2# zXj~zBJ1zs-@ed#|yg!9ArPS%}@}o+8?1xs9r&dG##Cq>Z$skcVCN)|^*NBW@LZ+LP z8&7h>A;ds_<`tJv-k)M5t%g}IZE056F`Krml?l3vA%#FRVv@~5{++a_~E;LtTk`joOC%Z7ce26$dtSlOI=EnXI6oekD zPjm=X9d6NCa+@HOt|{ti$tYQ@BX}Qdy?3#Yy8#yXGDA1Elc2cSUVNqx2WXQtzIuM7RNp3SP&u+J|(7PL%op+C{2Wxeq z)CAy}@l?ok0;P;O&^kaHJHi5=cQYKh-USRT?6fk$ATWL>dL{>9k4`WNHo{$Jq# z1(I@;eANs`)XFmKp(l88K(Xf%Ht%JW^zSrsh<*wnEgR}?G}LopRN2k;yG@PU>7xgh z_^LkTR?f|XB$e+G{IK@Y&o^sW_*<7jJ<%if#%;_F{tV^O0~wPT0xcGwWDlg$w1gb8 z6L_5{c}y7KV%l1wfp7r5Lrmbq$4Q4sLH=;tRZh>7ll!61P;2 zztWe?vZ2VjMA2q+&=~}*vyn!Mazi0rhZ7NOb_VyInUSFs@5W7gBU=#OaIT7cJWPul z-b!8Y%DvW2P%BX2Mz!U7B{zdZt7YYveD)#MUW zE(e9N!|R{LHBE!7Odj1P^EE%O*4E`s5nk}LlG~X_$<-bVsz=ltpjE|#Uj+`K<99W> zN{pD}=TJlvG`VGZfZ;qjp90}gpv97&V#Dv7ChAzfUjkz9m7#59QCI-5}m zVoe~A>nO3^Fy?S_!x@oA4n#`TS%h1-E~2Fn#fR(`EopJB3$v4I!qvVJA>~MtUG4jH zQT6Tzk8Q&gXVs>xXW|c-3h^*3j`hd0U-n$)z6r~jcMg<`0>D;^=t|Vo%6Fgnz|oV^ z*e0VPcRPhNU$tWOhuCm0t-C#zn!RfGp=_^y+h+mH23~Bi<00B9L*sO+|CQt6XwqAk zUBa)PPLzcb1*EEUJOV8b-;~49i(4aju`7v$%Max~i)NoW;D9d=`m_0Zqd*bcBKCS!&O*mm0a13557URW(1^hdj;b{{eTAQipu8j ziFW@@+*$QfKpO;^J`Z;V*{WCHNT7)OA!s04LsNkco%TnzCaya0AEkKklTt3brX(}H znY_nQFterlO^(dW5wq_!GVn(yN0$CzabM1$3ZxE+T+1`L} zhqR8O*hw%dGU^T_w=OP+QX!o5CfQKsF|txGa}^x!Zb+U2oaU(w@-n}pse-r3U_m40 zzG-A*qfI!h@a?byp@Yi;j`$e$EH(crQ+n>tyWR|ei%3xVW}M<>khLU1bdRYDQP`z| zAGI_$(A?EaL=f881b~}fYe2+$XG~Sr3v%ea$TyFxX~7D^iGPD7Y5u0fp#H;@(I0OU zF4Mh$BO$VY%{*_af+Hykq%b2dXG%9tp8llJYM3tfnb5cVI1JdQ(?*E_!Wi@xurcwH z<#NPgctFONZs^=z{-~>qewviR@HG@fP_&(XAm1GMYj-{AE+u2h zuQT_t2rl04r7ROd!#Yn*hU?J>SDr@kcveb;h7l`AJA=yMt`#b1rt>}0(R+-Z`Gybt znQ?(FORIp`3_bMI^0F{o;MpRuMdwPs`3B689Oy-v68Lr8fTsblM64UfmS-%5)(m$s zf?3WIo$do{(d|A@rB?jW%yv@}q)YUNYqPP@(T-w_3BgTcdT0H#pYIgB?^BdUb=YP=$wr<=Jeo4=6V1ps(WS}>E-as(n3+)9yfAxCwZ2x$t7naHA z#rWrdCMQ5s=MwMGIF+8R9Fg<9IUbA*#d0XfZU_)t0p6G%-TZR3t-aZ$ z5P`qdOK&*u)Ftr;yWSdaoZZR+4A+^y!D#c8P*wAsTJG4jTASCSWNl=+TgBJy#yPpO zSg$rgjLZ!LdJXuN3(4)|Lkh2k+`KA5PfA=6v*zxSScvGfgl-J{`+P)&ESrG=kZJhy z>9>Nu>QPNnBohr)vvvoHwhcsiMo=*+DEB5C0Iw%RU}^Dy3Bno~GJ7X}tj0O+U5jS~ zr}A5#L3Uus72F@ryA|m)G@6^J4!qNrsqKWSw#jK=SHREsGj9SkZ9Xq8jTKtBEF z+_^kTWabPizRQB$KBfv)Mq?Z{nZIQbZD^jmt*-Xlr8aJ~WO+wo(GzH3bXr%^6FaIi zi263ZB7D=pPYzsojH^e9ncRWr%l_QPwm*lh@LVobxl(h2AV>zs`OB?1uFby;iTddC zU{pRb*1QMQuu%iBNOD_*t_3_E-TS@F2xEK{L(O^*ohiG+py6v`8A>Yc*o*gt?H`_o z6ZXor^L{!uy!RR>4>b~j1`EtWZ@)n>RY+gTtCG(hRUVc}?R+_@;@Hxrh?6&1JwhYO z6enVOH(V3A2e1>DvTV)vCJ0?;;0|_v|s3)_^e2b3X zFv`0k0@D#S?vdV-OWe!R;NHec{xS>6nse)nTROpHCDKWYRcH(ZkE?rqI4*ueThJrt z`+@$8l<*wjp3!E!^z(DL;M)W3)Ss^~XKhEGy^ZHT28ham;t{?N1oI(sCg*;~Z9eW2 z?hLwWL}Syrl7Nj}#bq1wVg6a*CDP|XX~9$saQAU~YxBGP>7O`IQ1 zgyI&%o3M7(@xKq|XUy^Z0t-d;ely(=p5ynn%SA??rP&vp)XyT~`E!X;+^=gNfj@B# znbJp<1kBO}vwz+dz#xes{w^nmh1F-1cDOV4eWM_m2){O-U6L=$Q-jR;L+7h!m@#Jr z7B^UeDh@idJ4&*=#fd$1w(FBe^xHQNh4C|_sqIJ4Rs@yt3;sn!v;jbl^0 zR_`%N`kFRt#NPGT%@bW7^tm3M{8?#mqQ5>dyhb;nQ|DJmavsO2S~OnPT141~ME9!m zG(1f+2VI>M3pbdaNB7*9~zu>g! zwKC4Svk4{l)NZ!_#01LpCd=a+93Y-)M+8BbTh_c9>B%L$FRtX#AQXt)0x3D z>H5>4J+i6YCnsk|QzP3yC3|BlWNtPtG8VEwC4PQnW>pWcDH*e-g0YpUi8C^@ii@%H zUzCsbj<(3me}4bP!HUeRs4A|>^wHABRNlzel#GUn8SG?aU}6cjFm*I=0e>=bHZ^cE zb#O7YGcjcXe=?)}2cc+WZYu9$Yi#OB_HRO@?9A-NEKQurxY_@7MH!h{M8w{mOos)i zaI>?Ky?@WHhs>;O>SXWYXkzL__NSkUj`k)hrp{zKWXy_UAIX4rad&446=y*0U+v0V z0F?VLX@bBPGPA6yow>6G85ai^D+@3XOB-jP2h1OB0DzdOiTx*2WPt0RnQ_lZ@R5q! z;VoThRd*O5$rD$$sf8VXHV_F;7jFN2^0~o2hx$bkoq?*@tU!!dESzLOB>L0s9+WQo z<#$hZLm&=j6ng(;c7s5d&M?{YlMI-Xb7sRl>&jGh6zn}U% zuwg#wOy;az&Obw$6(3AshJ-4i#FuX13rtkHr@lU*rsuob_am8{;i>CSEd)fq9%FTs z&6ECybUjmzNw5I6uXD495AMSSn(zgyJ-NS)3@_BHz76_4)5(8w3xh_mxUL$4`F`@r z@Z|epd6RXOet3Ho+Ye}Dt)C`2>Y*8jQyK)b8p4A+LDb$ejd;e@ve6p$LN0JBXHEXz zhv+dQ`{CtRjKiW*AK1Ldu0@F%J*PQiz3@tCsSi%2r6M^jXGy9|T{M`9R?yNf95Pq_ z(Y<2`*C#m0u3#GE)y6A6l5Nc~uHMcUouQR{6)L-F}!rKre zAO==zjp`1E`x&YiK@-9)(ASKtT4(LJGPp3mS%P`5mn@$de8w&Zff@Lg)xAjlVKKYZ zM|Gtx<4qwsgP?Us93&Y;ZdjA%kqUufnh?wkLI<|#puf0w~*{-+bVI=pibWF}u?6QY}V zKf?=Q0R-#p7nXii5G9wnomy@jqYJJ3;94O@OqleU(w^GrG^`U9x?CRbkRr@gd)FS| zKBv7ZeA%&stNY;S7GnOqO{(avc;o@#2M{cuje%P;G95#^J=_oK41bwojSk@|e`gZKc4sS$O>h?bC3o>;gzw@-R#oyFURx zst8(K17)1rR}km}Y1@XC`W<5aC2eMlu;b2J1?G!HAynVzIR0=r6f!ARXw{y}+S-}! zDpQ8)t4=SA!lA|=Z2g-<`^cwQiNj>-{lbaDSTqS#eczbN23n>I>%{!!w8`^dg1U$N z=MX!GSV9v&d*C3w`4C4AewxQHv309M4Y0uvWHhNXl`UL##DC~--WW0*=4POUX;CVh zVtDyZ=T#vELEl`8Co8s@YMexD%tnSWevkgu%Zi9PpJG$8<3I54HGkmMsK%z1rZGWi zA#ujw(~ot{+ON8uq)cN>0fe;%vsrh9^d$`zTZRgQ$-K4i`uD1Og}>Ct|G_f=_%8cW z!t#jzMBs%n^O05u-d}SxU*-Qlv^!TtSXSJ99_U}Rv%*JIsE-&-a;P?Cs93dpO&`d( z^=Vi$2`8|gaE8DP|3%CH7XJJf9BzT_jZXhy66SOZ{tVYFn#L=g{-gx|l^;o?8%W`% zioCf>-jPLk>_#6!z^vhqy&j$i25ui!r#HhU8EAw5mGOI(sjhxo51INaosTBNDS+x` z!kKD(0g==Rr~fxv6Ou*>buB$9P7;n`+%g^}i%fEKzd;XN)8x{{x51x^!>R<(cLKsy zsL~Se!z);CjHyO`P)3u#>q#}nPj2hK_t>FH8VS-!@Mzd~sB(i096jHG?_6o^qw^28 z)~S6XeK8Wyk{7LLHF&zLkM}NkqMdwKG@gW~%TXq{DBNtDtcUf|PZyo%zO-;I*PWKT zxScr9$-9*`S&!Yen5Q91Z5a85xHg<$s|l zGNTM7P?OmJx~KD}dj)^Gw*hpoti`&p#kCpep7oPQ+O+@8((~y<_oV=CDHDuMS$$XCUyPW}q=Mr*`9_=A-v7 z7W?MZE?m^S^>7U|{*~hF`0MFc5#YO$VS~)4!)uL@4&H~E(+bx=om23uyDMSTUGdCx zBJrvS{N+jf<>~Me7z^(sFc$PbV_5;la(GaY^<;Ggj79qq7|WYKV+rXvJSzU(T-;t> zTv75b7NN~_?d9PWC7VaZ|3Y!dlQ>{80F%kj<*sDv&sffZu`E6UW6Ao{Lr%ZC;1Zn* zr}0dPK0?k7FY4pWP6fdH8(=2>!`$+RdCEZGac1`q^Y4-w1I8z-3k?jv|Ktq;VE>sL z(l?iQ!wXjjPoeu~t_%On^#(B4b@#wr1D%^Puzj*Z(P+@$V@?O(0A`;p-#EX`p=rIA z%57)PYaWc>T}#nW!lZnQnuycSedInVFaj_g(OomlmEJd(6F5;($+Rx7ZoiNIdZgTw zJT24VozcIDFRNcXTh1i@y3G1rb^B}h^1a@+ypY8JzMpXz1|93NqxotU2<%$?{r;A< zB;oDGTU}%6jkoUj*n4Y=hN6mwLl`J5C2_KKTo0f4&~V*zqYkKximIacYQ<*W+7N9i z%^$_QI`X+o{=w(&wfm33SdqIy7uP(m9H_FD%#Xz>BLigY`cSg!JqUeEk^HoS; zQpx0TRhzD`7zG`9U4e$FrY=BcYtTJD| zNXK0Hf{rhB9;bDgD&YAz@o6xw)?V~zW< z%2eUfz7B>M4L?@>&PW}Js^qZiwun_yUh@N8p(^yYd`8GlHD?If3fE74(#pJS_3(2f z`9%CfP;Rw4edcu>^?{obAx(${uA1Aw3!pXOdNqiIBDs@*{Iq-RSB(}-NB=|Zx0E(< z=?rpK(t+i<0{6yG?KVu>^sMbQtCu^k%dp7HE_+I`WYuQ^&s0oeGAduN4;G!D>6Of7 zPQ$mwK4}gd;2BDxXewMF3CS$JwJg5{4N(LepKCmQCr+A1?Sld_l+JMy(Me< zA7uS?TvXrp2aHNHATdLCcStjYl_+t;JqTYffMfU>7_0okKR6VE|i8A(Bnb31z%{7 z7^{ zk}0<@5m9n*A5D*QudHrQ0BO}v_;Qu3folvVR*5NzXF1QHn-wO5FKfG8Y@4lv(kj*d zIw!}oCb>Pf#bDn(v{@*%zO*{>VX3-+`}ze+^Y_t!))kEh|KLwZ>~7J-yir5Ne|YIX z_z>S-db8*5Mdk;zH)AMZ2z)a%^w$_%^{*MZ52^b^8TH zhDoy=djH2!y+FBhGL&3FvwcKeQ{;cR5SQ$dasVyYv_(pJeSW^f>sVA{%EbY%7e;;( z(ph4l$!OXQ_!Q{0B;>N9tCGyK?kZEQ!%H=LC7r!vaIEkdb2z(=Wq-a+3bfv-le;mt z5fRaSRYFfy0>%JDvYi&7k4PvawPJ6KWc8y(}g>&W9)$Cs!%xpc4-a%%bm%NN8R`w0A5}hTmt3ms% zuPg;aO1S&Pqj~Qw^%?d2T$ne-%1(TUrLCKp4o~7&4|Ur9QHESDFpbXdTX&z(Q$ zrHW&M9ebGgmcZpL+ML7$54lgayjT6AQlO^6D}h&d_WG{^J(c=J$Xe`U7w~%D>*=gK z&H-N|PwU`LSx!KeT(s>w))5>s$MRZeC*}-a*F>XS)&vd zNQL#CHCEQ}y};$CKhL*<=ckT;J#h-V{ zWA+K-)#7zhZZ0$UWh1%B9~%8Bu&G-0@gTtUsc*Nt$lpJ4BFggE=5cql?|Ie!ekA4% zlzSZ%0`HJ>rd(k9Vca|Lu@v4vL|(HXvQ&uvLDUdb`?+q1R-lY16~F#{>>2*0%us94 zCeBJGmWg@KCg=9`cell`^D`dn@Kwqb2b1~FdIGR|X84`Rw|EWi*9@y?Kg7wm$B${O zH*c{Tf;B!eu!PRlNu{u42sPzNAE4}mzf2evG{1tBq6cuQjxPhy(d?|`hq&~nyYzIO zWaqU#>X}xp!Y|)WUnZY(6c&zK?6uze-Nx?H#JE@{N8?Fvn@IaCLEZ5jY;<1?OnJm; zsrCe~e>n8qyv9E3@;VuLW<2V%C+YY@t_%uk_fnP<^ zn<9%8vp%yEw&A9L^hlMKBJhz!LlrZbPBs`TC?r0;EryM|_;)?1NWVIOoQcJD1lc#o z`(r`O_G#bjV=(pXT;ffzJx%AA*p`@P<-6dm4(>w-yYJpv%riZUx<&$1muSeUp#190bF=G)9sWgIbF&UGWiwHyePwYrnX5GavWR&r zFu*?!%6>}ijBz`74Ou2=>1+k-l-vsmsCfFuFs0%{Qwby^Wd(WR{^5wcE(u!#{0yuBaeBy&ZUOQdq`z&7WSVjb22gXx z5N;1fU(SA~N0-lX7Ky0^XjYYiM407IyYxk_Un^@yMLqEv{HL>_#y4^LIdP(;sJWr4 zE&*?o%|PUngov8C_ToQ%x{Mod-KQ`5xaPz!U)GGCJ6Y?l^A)iv!a`VkN;l3rsZ>QP z!w5!<_pO-_qySv zKMKC3>u!TiI%W~j6CWGZA0OMzzm5ECzcW0{y2-?ZA*FxjZf7Ikp=F^toS&p#w`(me zgnDDJ?`>B^Y&d(e3`*kOd`%=lpNvtgvUjhAHu>@Jj(J=)zorhPZ;i#Vq4u!#nH?3#7ArP; z7DvmkU;B3RXeJYnz%y$X=^ZxNg6Glt{G6fRs=vjjvhVrGbm_SIs0g4OwmqNM>>ab_ zY5;A_;>sfwfv4vENCtZ{v)SU=DkcJiX#Y-;wXFPSRSFTi0WDL>Z!Z6 z^EvX}L@aLU9{emCQZSN+wDv;(<0vFx6yMX8sPU3|$xflBSWstFiX@}P*8h`QOi}1% zTQ06&qVxOo)l>h3z!UamI2fAseLk2nwCVi`EX-=nIuZ>Ji?$*|5aJLvpb^bpl^vJ< zSQNDe=Fi=FBKUDA_!MoNbdsaPO213RuIHpV_6LofRWdGL@8xM7q{^;{Er(|_`H%*r zYqsj~;`sY_(l5y!pSv`NENShTrPMR4$Il-K zrX^6*FB!FF;(Q!;rD5)`&?NU& zG{4+sB=}H$-}~LBtlViPEqT7|m$!^NXiPgK8+#&jgbeL;0K~LA%0hy#zz4?t?TN4b zB0(&1o?m;+O*GqaRO%yA;zamZ3uz@KphGGa=52!x<*II!0*@tud$NrU>-6_tv))4M z;T8h1rLb`&MT@Q=Z}CuAip$Ll)Ey$G!{cET@Rwr-InR*z2O)%chxl+V{Anej0)8MP~J;6uF!wyn?|@YQmB%)$4l`xa#$q9GFrUesS% z76dMaS%bk==pwiyg8HBqN^9pxURvhnwY*qwcLvq&i+B95Q=a4=u2R^jDJkYLwH@eD z(1B5KBf(tOOT47cN{TQmKVf^7T!E3qIe0SSepva3`r0>J$(O0OqT|KQY$Xv9G~f|b zx1U!@%+SV4u}2=CGT^0uV!io4qPiVrK8_?$?CK@8eaNa4PvF$X(#;(OGEyI1-qd>= zBQU@}jlfym8w^q3B%hzpzpQ;A;e5X%Z>wgnV3CLTxHuUdwVuvL)+;G37M<_ItQINO zMH zwMF1diKezKQ-{}z)K`FP4!(-K{X)pK$Iih}7<$WJ6NpXvaF{ z4Lma;2D@pS(O;>zgT7%wKUJRUI&bH%ozgn_V&e2zG?I!s6O4Z%a6>B#e|7FqvSuBsoxqTN`v>|U$ak#2c9mnmt5SDm*Wah$XHN&o zD5jl-O>Ej!Qmtb-xtGm}b`q$EHY$`-ZDR$wR;AKC42XFICu;NkzzU4U zo+(jKU0?+_O^7=yKB7?QpAv{*`G1fVl+Yf;is)a-=cs97_p*M{Lq>%WWupR>8D`H! zM|6KRl8M%m`CZs$bmYN=$}#4-5Q~E@P-aT+jDOYgq@Kt&gmBpS7D1od#{Vw0kt)_s z1u6@05*I<2kX^Y13_%7n;z_|ZbNh-=?F7h;CSa*ASS%Uf4cNnktu)Twm&O`nD8 z6r&>=kyz&)HmwFy!luATK@i@FsVajF65d{kIt9IkG1$)MYlj1Rb0H@3>*nHk5W;?? zfZl}v)7x6v4YTk)WHPaig=J%?f}u#W01xPUDxEn+YMmw+alxf&DdabYpYG1)p zifrsh195O@g_kC~Tq#u{cIN`S0<&%}$2&1n9WbV}EeS`l;nH~cag@Rz&md`*cOL8y zKP`pD;i{;n6#Y!uHESN?@UTaeG|7#a+>NszxZ`^l;};teYv(%&GwOAG))ZqBq_jAH zzw90+1BTq4@DI&cypkEt+obBJ91odwX)8vuXe98#=9mWh^5)LkY@TyVv|!?z^MxCU zrmdKw?OQg2%yqY!7t~pxJAAC(LF6WG!@#;2G0<*` zkj1`z8qME_PH(NW(gi=7Ux`8AV*A_6brN(Zv}s_VjuV`k$Zv=lXyob8LrH>=mK$k#j3^znsWYEdjez0x*N;BlX zOTS50D@db;o=jxM3}nW6-kiioxztzvuG~=gyg{WH-RB&Cc^S`j%-_OB3GtEKz}f9_ z0RmamOoW1;WNoZ^o|nfHQL&|GACcauzPGCl-W;-_F$o;>iS%+6?Wg&^Ln?B>Q|U9RZMBT3A?r70TS<|a$j_FF==k?Yt9&K0(281cUQnLculwCjv}gN%TDNw|gJzL6 zF8NAt4o(MG_KPtzYwuvqffj=n`=8IBL>!&4wt9t|Q;SkB z+RqC6NRm>YgJN={H<5!zX%dW8ySPsuKJxPThul}Q#`!&~2~%oZUmKQ-ALzX1C_YK<8y7zbIlsi-PRMM2<=f&Yj5ev<5c z`PC>Wmk5jdXg+{tU*#;S<$M8!Dsds|VgttTO>$_Trrcjo;2t+S&P_UX z;1FVIyhVMpx?q%c=I<~bh>TfUmH_cmd%^8c=&sA^AT%OCP6D!^O1G`exX!htYs6^I zx0ZYqm(^mpPsn+6AtXRXLpe}~)OI0abmS(W05OknUiXc;n z@9a`BVCcjD%4Z4uC|r#5(J7LgL@0)ZB( ziy!V_I41`jpL%~qqlG4g7jiqnCn;4dR^Ws;u}Myd+x0h~uY0bDfiu>HU4i-o(?ZUW zWtbd%87PiBm&8ExG93wb%`&yeyWqY>wNn*e>)XJkmiFTYT|_lF^J!R$0Y%^bGr!Z?|L0iF_H|g8))x z6yRo{5)RCne zJSo+DU-WZ9J~{S`x5|1#)xHhq7cT7dXZ-u)0d#}sN)`e9Nd0=rG#0s22uT#pX1`M^b{LOzfWaxR_aFd`HJV!joKv$LpbgE-O?*{J|g*7I*?R3J|~q{e7CX-|97}6 z*F5*-=ce)Nf1?}GIT_MZfy0sBEUWh${;^Ppt>$m>HJ?^AM`Cj@6A`%C6?~y9g-1L3 zs5>}*Lk1#Agmm!1pZJzS)273Dgte)C5hPRRQnAdEz8pI1C`u9$wM8A)^#Vz*aH4b{ z2QxTtkqFVv!xNhCg%KE$?a$6}@o&5L$*8vk*Hh#7|Gcs6$(NIP)4ZXT04AkAeKYh7 zsu%ks9~WOHa)XSziiDKfREpg?V;!Lt>MXW`=C^<-DQ;7b#G)2qIIUWFE#6^m6fO#S zEpB7l$BNk90_Fx@OCrY9oHFZhb?l&VJ^id@&*8hL*@PsM-Y(hrXA9A9|FIv7G6)fM zd`@%&WfL0vF9Omj#&EI;YyE3RN7eM3`0^_U4U~<5CFJv6|G`uz0*-o%?ICIFQ3et< z3Q||ms-?Fwy&kk5tl3KHXHw=eIH?CIM7{=f3(3y6Z7UX1WGdfQZ~3Lc7Nh>x`?$M}T9|6=`h!6`leGy} zuR?RQiBI?_DE7MAFs2G3ctbH4s#ai0aaGElfmMw|dM3MhBI) z!%1D3A1T~~IgUVamUj#*8zI59wB*-~+qCHxjw;>V+HP~v*z;FKOJzcL4yRpxzu^d_ zcb~k&QRbK|=qEFpG~+Luju!uD-!4wsQ#9_`Rbk~oobxAwgX$u`>%s(o;A7jUb*2md zSYvJai?J+p_EFm9n|RAMo+yQ){yVzXK!Nm;xz*W3NI~yyV}qfbnRTyOo97SH zUp8Th5|GY3Ch5>-(0%lHiMVj=i@>eA=UG9y$HY0xwRoRESY}fv^ad%hewfg^7DO3L zJRK1*zshl#^)M3L1?aymT=|QpKjs}>s(C7Irl{?>eBTIjdZ*1SzU_Js^)Y{r63u2b z{!L4Ve2$xEjr|3_*Wh%|$L|ue)rQp0Bo1uo&o1zrRAyK8KLj2$Nef>Nb1yDBhb8bRdR|>&r$M*8oW8gU@Fd^Vmc3Y-gaRBXzYYlVB zZ{YvL;5QUN;VHi8JGUKf86=Kh-D)Xuaib8I&M>Wg5kO0{8tQ<|Zy$#JEAK~TL^ z8q1PNwJz%p^!qqDX~*GE)R!|#3tRWM+2^U&K{M9X-%SZ}&Ik4z!xxtI)M0C9nX4Jg zrd6a(e(D7SU5X2P!pLK7VBYRs?qJP(y^3|*?04kV1|+DP{CLdkCY&JpEmF40dre+~ zRhHSe=`F8UeZ~RWnnMoD?0IH`31R2UESQK_A!=9B$BP_D z#+glSBL(KQ{qX{zfoT8kjy$H?!Z)C1N>DDv1&h59OXoU+y$?&bU4Qr&awN_7_|g4K zc7s`o^abr~MDvkVkPeOL%ixU#ZC1keIz%1JN@@T?}pbV94wDRpf?WHu9RURs6QNDACN%Sl zb$7{&l8eG6{$4F>2%d5b-OG3--*&VLFTy? zdveE9vi5wIZQ6(|ldXt!pKJ;ak4h%$=DVk)K++`1gu2Xv&Sf>l%hC zoYRg|pX>Tjl}pv;!-ZMQHX9pQOjCBKY!4efYK%IQ!k#f<#QA1B!Ckvur*6w5pM9Kd+gCAykBgKU>TfVVbaKS6o*Rw6@dUPxT(?TG1Zn|@+X=kq%r0w8yH6fGd ztNlMwB9V6G6YAXSwQ54@Rv49*1+O3{WY@r4gS7kRQvS;7{RIVUR;9OS?YJ)jApNG! zE%*{3D*J@omH6`to#QE!6+;mpED{l%d`<%)!wCy;Am-Tdt7X^eJ!66}|4k|)G{j~^ zkV3HYVIevn>DyGC1t=X*#VmxT5Q*q+d7$AA%w*Ja7e=`DRJtQc?LbJf1ucXgM?T0w zh{GnR)>WtXh6z%Hnp{M#SKjwrhENuVh;igxA#kMedmpV<^rg?M=Z4B0zaO7jsaS@9 zaXG`adS&6=U?fR6SV^sP0wW!=N0*ex$ijg-_FiZ8xQ9^{E>NHnI7VuM^RoscV~g9- zlVi9GkjcYxE$HV^Nc3 zWGH-ZMZ$|u(%WPdu23*zGt2oYMj_m9p~C9HLC@A0$_XgGrJcrOL9C1a3dU)7JDsS< zQZk284A}$f75{7)9;2#|Dxa-yXu}ErRH}cspf|9XVxwKCOQMRri~OSy$XQ{FtEHe- zVRcWaFN4`oK8H~XVPyb#BMk>uw)Mam({?0J1~>ytIDtMZ|JP^bK%X^m?$ATZ4Ij-1 z%7K=5b0Q$M(Ti_|Y)BH(PRhJw%MnJ(%r-*u6}LeWAG&(w(IOksDR-_O~;W)36KsU(ts9sDIx5Am^8 z&Nn}~l?!OqSFS1;f9G>;=sLyr3XxF|-)YD>m|>rX@F$yEBs@|3-Iy%8!gbyOSW!!l zfRXTPropd`l(P{_iwi;eDNdVhlD;hg`xF*ePt2#xmRoG7_#PbOIXEeXG!#Th2@1am zr5M|pEcVz?<(;m=MTj7><6!KwRQ}3_zA}mde(jMwR!d?93=QA>Xhzm(#>{2H$R;fa z$}2(F9s6;XBgj3B9eErdg)G2c6U&s1p5&F4V(1^>Qe@4olLkiYESh38V;)MP4?UZ9 zEBk@WJD4{5>w9(y1#qkyaj_CR(jw<66e$QuK1ggCD!Ar97`tF`X)$0WdI4wZJc|8c z!SY7XH9;X3RzojVL-v%MJQ|%`KFLfYQ~Z1Tv&xtsg(cuz;(Pk-%JOA+bkjkCnoh%j z|4#ivd%twCkixQW-~auX*pCY-v?Cm%n?e$xVaxPjlGh1*+S4D0(^GOvunoRdiHj64 zT1+!WIORKp#?wV+BamTOlk_xLNgY$}w4O6E>pA?d_i#n*=-ZjBiXdgp1`=KGw#9xD z-eFsMd4Hg)*6sD^EebtNQi;-V$4g55Y~zVR|@Tc`vwT z^?jmApUOwK7SI_#dxGn9g+CeIbc-mZHc9B|fB{&Gu)th7ntJkkM<+LX-b;f1QSzq$8TkjC z2W(UH(d1{TFrxyY`z%KYyGy4Q1U@wqn^X{GrKMx^L)S3>%hycy=vZj37_x~9wO`$I zA@oaTSfte7C!lyI3hV0^hsSS~(zq0~8LC{Y**U%PawIoW4pb{s`<0o&QgnRRFa;`t zOR$leR+=7;zRgqMzK|nfKSPr84`_YP=A9<#iB$^oP$<4NqwYG-Eb=L7Z!*j&M~k!{ z=oLo;PudGB{wMKT#EU%RS`E^L`kj|Vuc-A&4Dt9Ww9}odUtN4rSI<<^Wu4GYQ3oPL zxZ}$RFO{FRVySt&jFV&Akp?u-mnK;flgpQ8mCfub z)+~YgDXT8AOeX^(ca4&rELK!TxMirUpXS<~ixq3$Yc#H#zq=_T3c8`8BuIRjpw(^; z|5#s1;oFn#ZP?qRBKXP2kXvO0fexE!k#G)gl3@JgxU}9wQrhaN6=ebCvb0W#DfAc6 zXQ%P~NLU5)4~5kF@YN>n0RqJg3s}@M*J{6$?8`X`T2?3IWDTcNAhL!@Nf6l%8M6)J zAw@Dxfh*s=iHH=@^Ol;4O>ka}I?-5-RSuozHR-3YC+ z&2&~j_Mzbi5X$i~2jHI>24be2f0Q2-K9+Uh%~}Jyf&vKhk0qW@f8zEVPaPPSW*oU& zxuHiGMv2m_1fij}j@Y6AQiV&`J5#nax zK!cnjT%-YQzxYPT9B-G^D}Yd2@(Nt5!9eOFHGYR%AIQ2-bEd=D*JK`TBzBw&%Q)uJ z->=$`mgyID6(8$&$Z&+-i?2seS0~y5L>3wt*fESkyr_g1nWu{BEE$sh+y^tvAHbxH zg1`=ca|yMU@O1_ns{vzFpGLWlG7O=P#i6sQ;CaplaiDi5wDbvMeAy4K{!g+&a|}&6zM9H60g*j|CAZz z;pS8RH<+p{LuC(jNQr4(jV%Z%sZA`jKwl016CgnA{f)>uI8=5a_{tvvkp15%iZ;;# zcK8^WBM5E+o0VSFu+*8;sFp|!%u3~n0o*m94e((rZQQ?!3TdPxBEgrsMs-64q@3i? zBj#5zut|Arrlb_&rE^;XA!}xp5L=KAogm=|OwgLQNkcyzF?<@8X^3>*lrxNS82S__ z@G0TJfhoGh#&G7<=Ve2r#Vay=HED|#Z3#A)P27PvkzvH*^bF|)H_ThUzh4C=*pXw6 zZSPrfMb;rcnA*%Xb@IGQb5L@u%>-uoNQj$s6A$t^oo#$;OZx9V{?;SL&z4cPwPtx& z$hZJ~S(CXnse%xCd|Wa_a?%yN?Z(3U>n@Yg~%H}3g0 z7>Cg`(gi++ZWe&geK_YeR2szQ`{kHVJ!QDW=hbA3PGttCTkUWdzc6hdn0`IX`9anp zHqXdEAAKKA%e?1U2QwQ(BpjFuVkL=3g9X{9_Z$VVl2(&kJ*$RRe*ZuhA@ES!Hx=xf z3hP%HhwxbTJ{O-Km$d zyhl6}dX2X%GX|kCB$C>e8RLeDtFcP{m+)5Vb<4Bu0|+qML(^LWnnKf!qCA1a0sMvv z2n{RIN1*iI?btd6SoOn+n@;?AYLdOo@2QQqaws6Dd&E z6TWiE=BtIgeiW|%H=Hkt^_AH7FlXF;V7NRsDmT4rS}?EgZ?lJsfGWD|@EKobt0$5p zYufkfAZST9%^*#wuFua!1OZks5fk`o)Kgh`_Nn;$3GygLk+T7Iq_fWpmbMJ81}Or_ z>e%O08EB&YT>JOvYA=ZhLB3%t4M@|MulYa^Dqel6sqA zt^|vAE6!WHe8`ERP%(GDuyP@D!FBnckxX`^14itEZqz&F8#N|U6~<*R5*(nLtqPcX zebRH1vBxR=qhC}+n(CwOV@6DqQn2bU{ywO1uNr>UHtY(lxEXu0t$6vpQq+$Bs-rH) zq^k78RM4|y>IKKXvj}qhezz>U$y}HA{1biM5iNuPOiP+Gd&(y9QxayYM${UnaZbSi zPVDNtS72ghB(1#m>sD4q&=HHtG173OD#|fZIUz!Zd6m= zoRr}~%Cv)F#txwGX^gH)nQLnmStOezEu`nLK}oUH1khOFWPU0qy#l5fsYZANm5IQq zWd-;RJ%!23+IV5c+9U;N6fLtr!+|{9)!2i|ufnpEE_mD_jGKnk*{d6vAfy^tD#m)V z>Uht~ib`>IO1T%)!^5o<5~M+Y6FpJEA2;t(TtOobzq#hT-lUz66kr_#MURPUdV;h- zQR3qQaN@bGDaUT}9#}N+r%Rjy+xnqgW-{Xplz89Ya0UP0@XX)_2^HV)ZOvX*=E&f+ z8X77c5FPjEzno-Tnkb@wg7^SI;AYp~@C5`n*)v}*C9k0zfj2 zU*D<|KLz)>vS&O8HlI!r)*yd_fX6XCx{AGl7Tj(qruw@j_eVj}C5X&v3~ zKR}6JRxY!jDJR{ZGK&6{Z;1FOgT84m(>Q;4AYfyC!^J+8811FHEbL{zwPtdpDfzbi zxKH<}ZYFR435Y}L^12J53x53beSV;;Yg07nfS|@a@;UF5-0pQOn%}<+dABTfBl>UxNd#)2CO_wATu0L)RnCp3Nj2CDf4_AMm-&!}k z3X2YwXAhT}+$dt(xaH>}%h@0|^#np2(xN-tP`TS=xy5axSyHVvqI)V#rvLVf^*>0$ zkFK&Cr3{a{Rla}zK?tweycIP-BYU(6zt~0{*N7KuJisU)$S!lU}6xr^HoW4a122mhcq;;HL~o^ub2MwY*!VRqi`34}VHh?K_3|DXf< zG+zwy6a@z$BGCW?5R>JKQ!7RFDkr#pj?L*2y|P+8GUe@CYhl-E0t0es-tOZa!!oaT z6Q;751uwE*{*&^aHP=p2h_qod0D-a9wU z@5ehWdPmq~PC2?3ueA@$#Qke2W9_0@oQY!^JHPBD%VU z`nn;W=~WoXU;-|mL}+0d(DMIx-KG`Swt(VFfZ~aB7e2O?&*uCwD$TR;CH@W;)XzED z1KsvCdJ!(BcT@rZ2>xG+1GOIuOK+fC1(D8(KiX9aF5^3#(l&|Gc>j5f``)b}ZD{!$ zKux5$m&}3c=EN}ONQH^w;&oanSWSmpqR{aX!QT}|cPbqoqvi3(bRPJOGM ztw=flzBmOnV4_9;i8x~P4o)Fv=9y^O&bSzsoWQWQ(#!v(-l7AuWNM}v7^ob%qYvtx zrPh>Nvm1w9VAVw^vCAr6C}YNfxKV;J9hs@mu?!Z+*erc*!Gn*g0`Q^+p;z$#uUlTT z$fc*OKa87yaCghlwnNUe z98>A432Ja=xMlnv@qbwoWW4eEy}H(@f)Y1oM7;6e(eT|W$4l7bze_Z=82E7ht5dVB z8EQZP?Qhgc!=?)8W$ABpbRBnzu}IL6QvFvW^_KB{^7I2V*gj4ldznScFinfN z%_R}LQPNwQBJ9g1QCL`M_vaB4VBMTRxYRr`wnb=l!PGfnFG6|R$_FVg^w16HQ`xA3 z7$XC^f8&GNomw|;&hpdc{0Vqi%@Y#KOKX7h3S~xj@ogKAXAc-?w>cJG!8#g&ip{PA{&Cm3(bw-iRjho*czNJ zS1VBXg5x7+R8aKiK`%YEx5pqo;_c2$c1z?|kJ&FXls*&xevgx$@0%d}2>?{MVgv%- z+9zO}V!Y;7sIk$M>7>o0>+(Q=ZR1KWIJO`+J>`lvgl+>Z^;PPo#>k|XUDjwq+WJ}j>3k}zI_UA|!1Yr~|D8Ie&((*WUND z5t>4C@6w@kcPLo7hWfp{W`n|a{rlP<2tHhZ1Gk9clV3}nqv1={KBH*tlas82Hb1wJ zJ>^zq9b>;2K}Ph6<5m+hqws2NGC|ZNaWpFKPLh}tyCc}B%b7&!;YGUNf7>JX{_?VL zm$&d)kROeQqv#@wnKf-kNHLF{`5hbK4eMq6j>4GjO954})|v)pnTP1|vyP@Zt8G=- z*0YE85A5GT&E$RpVWn{6`$* z7|3z@kJ?CGyZkGw6yL;dK24pf^t5WsxnzH}7z6fF&VdpBwe_2?`zRh~Odr32%x`XM zSCjaHV~}UuSMj=g4+ouJtnmYEQBM#XEWFBDaAxK#xOmm9ovCfK(THj%3q+21S$0ss zEvdx82jgdj?x}KSxn@B@jw`CNT;6jOP{g3t*gSOUI1Hv*0pYdmO_{H1?0>yfhx&>2?SNFI!+T4#MQ^zrA_9359Lo_$5g>RsyhiYEQ*-^n zEe|6&A?Uwd#=bj~6XFHA!>>)iO{q%l5O9I!)GPd-m$HdWy2g$gb1C>PRCwzW2kk`c zu{-NL3hiX^vHKy~D^DLpPytGSPJR3aT+Q9`P6mLT(om>DTr}3)iw?YoFa4qa6M_BW_aV0>Ird$q zsgtoUqL%zjQeuEC`PoUL1C=KBoU?zfNe9`0gfERM4K8z^>tF#+(EKKaALG6eB{@EL zE$lfI<_wPeV)$gmg4>V+@2oNom3;}jTa5AI$jnvN=`FNxO)-nFAt2~$O%(jQ(R0*fC#ye?Ph zLT=*GD+5{DE;wr;WM@rmfiTfvnzh#n0xcUNzs<~LXFynLIVZ$eh@^hLiu4>=w*$I6H@xc`+2u95QfB8mMAYo7Z^VywxXr`brr^ozwm%_{SC5lv*;V#| z4?ljH@w{pK=mz?Bi{I|D?D>o`8kch~xlHTA85-lwF@gULk zBOvnYmzAq8eWIHH2TJ6R_A-P-dhA!eptBmb7WH|+(ftsty7Ipw!1T)hIsZ<5jK98` zrIfSr6yN*VnAj`<6uLn3G{B>T&egRhfM+s4c<9(7TSlBA5b05)&UpF>KKw@}ym->f$NP;K^Vq*PDhenETlTshQ zEc-vf9RCCxTtR@W_zjC}m?;bhN9*qa=BfP27Jsbvj6LeZ*srTSgOqDPBEYrAML1iN zM%KM1;LHDj4@VSOOa2f4oleZ10)|A1+`+3bu^OvoOU5LF&XB0{KQf0+qR@X<=V^l% zK)VUX{Eugo6l=-&|Hq;Z#nzNm~Zt=Q^ z4KQRoJMjc^pcN^%b1Q9k5_4W-+GUrDCJK}-xatEC48UNa8M3R8hFSSAZ7tF+)uS3?p z&OG84ad@>A9`g_x3FU=M@lDXFTaYkB@IBG%SNos{{3V_$3+h${V6 zcP^0>Q_+{s<~^=_e&aV3Cr!7?{QJFAg=WPzuQ{j86Q2?*k`l95az>2yxMxr6O@b}v zf#^b|IvbJ-d54HL=L*eCO^xj4C%-CBR)F2`u*x#ry!od7*(2!&t?wGW*sEWUcuEVg zLq!QPnx1z2nvyaf9GWP`TFX-Akrk&J{6Q&sOpU7I#mVPxb<%D}(VUkve#B2lLC?I| zJPoBYeob+1k5u(<5Rjhs*0V`Fd>93g4hLe}L<08%)w*5HO~NB2!@e_e)W;$oQdD9& zlE%z|tv_Tlo>ktt_hJ~~YTkVaoF=k5LyOzOv%2ig|1`v7l;ZGrZacjK-jI9jraH$g zFzeZc@e6=Ce0wB4MvIqMPcW%tt=*$-wh6d3si7F+Sv1*-On<@sU%{7u{D#8+eh;+1 zU8XyqWdzlP|KgOH?33y!DuR?pa9yWK0nx=(xK1i_@Efnq>GH{!q{Ttv z@WHr9WuyAD!AP0Y?_BAPZ&LIeA1DYU+05?hna2A!kSh<&?BR)vys&pI&i>gO1!0xx z9phFzk1h);^vUt-g|^&h2Q!)utVOg;H(7Tl4T1xqp;||cWz5?n>Ufyhh(!X7lG`v{{RyJ67vn?| zbYQZ%YdyTv#zy*2_V&OplN%=_t{Sz7etrchAQ597b zXMtXXXBzg|K{Fx6sK=ay*GeSIQ=K(OC5q+)v8KbVv5qu;_Eyh8gNX%&zuAANFd;eFY-BI zDBx>e+!iUeVvid;w&c&gOLeR%!sfPDxn3#T3{le+))G)Su{`k~kW8ImWRFo$w{lR? zBXt44Eruez94m2R%^CFFwDqGD)T-z3C|C29wK9^4(d^Z{>ajztz^Q85DVgnW_z7$U zaYn7Q%gM7Kk2eMvFGl4vHlP&&l)2Pd+o|zor3i>&Oa(h?66in3`fn1ci7kp*~3!J<=*5%{;>bh z5CaYK*zheol04~J92Ec#5o^|*841X;tu58(R!6c!zUco>V+0RcRQ^}FGEjMEuUX@2 z-ZV=zVpgo5GvbS)GLdNc6LtgH5uwKD&Lh&xDUtF#Zjr|5VvcDS7m~NdYUq(K%1}25 z%jw_AO|$+aJ1slGjFZy-4-R3q;IxqUU`MjS7NvhKO72J!G|%J4{>Gq(I@*yW1JJ%5 z&|a7Q=VLW-^s{-Ua7JHG>Ou_5lsk{!_l8she8JuQZ}G;?#_b2)csC?&f`bHDNfmk& z3mtr5YOv^<<6-Jw@>b+p(AF2G9O(l$u%tk?@rr%Qod_fm$C}l>&3GX2rQ|$_RwyR)jq*P-M}7#pZS{ zz&a=!Q^eMf1iZ39zRhVR-)l~cW|Rly8@1>NB((Nwbn{V9fSowZje`_gEI7z!xu=6r zmZh!;Z6(5Wr~9rsXeux`Sp2WKrqSnPeSdcVs}Gmdj(M&cagKw)fYlY<&nrP(5p*opPLIHC&IgQld2D z2Dxz(fX(FZ*`mZ#j_(3EC|jR5FgqW@$p1=CoVlpJ^g0oiiheK|oE&EYsD#FWBhRQ@ zwRBR{h%vYDgWSXkV7RD_qhUiWjXcP!by7QJ(1`z@-a<>wWe zrqm^zUa)h2T?v~-b5D>2rB(7GYk<^dK68pM$qmN;758BrOUj615rFrTB8Uch!jMF+ ze{TCqH8DqNK7PWE@b@3T-}}@IT$r*!BWFFMN+<1@SbTRrSX*hrt{^f^Xp%?q787%L zwhBBXENYM8@*SBCz4C!QgwtFZ>cS6DUng$^Ly8y?!(G^(LZ``L-n2kA{uXNKZ4gB@%6ikNK?dBnzQv5T7Pse%ckpt1C(*`^Q>NC0 z5=pepaO;|5&*Ka4g(uYX%O(hE zoAjY}tojWy5V=TCKCOfeBB!ND&r0x*q-b^cKe58Sw5DwDAMLe5+zTYkMD-gx45EUl zE41f)s9i?6VD2$hsGW^I68_he4PXjP+FnbWaf$W}yhw_EK7pwPK2CBQf7R3w(vF!N z=|dL-r)H?+s%ao)FAXqNBaytl5KpxZW9%8bXRDk-TZ@YRVNcq_w}#8hrazME10Ow5 zGV8P|B^J_tZ?c>us%c=MaD(-NbJL{*oai0K@Ui^DhIv?K27{muyX}$Zx-hMqK z>F1Lm#Jkbb@!PI|^ zi5s8D14*I$9#xxu5KU3LNI#+bAX;iLGX`D%TL88(d6|wOBjAzXyuXu{VhixEtbEy| zuU5t`-Ps9wj98|d=3ZbTf3ljV-lnzJE|R=#2AvzLf>MMym_&Kq^V;ua+cC!Z1Hx*h zZ$@3p1N7M*;!+n4xGZ+WDngM`_jEFfhy0X4XNjQ+`kDvsq#p;q%T5!`Apwe}e3Osh zjotn@Z$K@g96$a_c--k8`t3`gJ&?gKmnf4hEu>c!ovF1+gs~i_M(9h^crz4-R@MMj zGgvemwIg8zF;(-I7PrIV%~KR9?pX32)=~2q;#>}vH*DpZdows2p}Khtc%|d- znu?NQ^BZvQ3uPZu;hQ@e%*cQRfLN=vG7zJ!@-Co?Cusmi40!giDR8KgW8z}t4DNNu z)PG>zAjdc7RGsqRQE7}I?{pz2GCO zbv*khv4?QTKEcd(xgLmY&pr~(hTt>ldd1LgDVCJ~az~rQJrFPi`U6Zhv(SiXj+{ui ztt5K$qUk(LaU?vHAJS1hL*s*DTt3HB)NdUbI=tdeeXt9BCn$6<(uwvsM4r_E+5YqP zChPBa-*yo3J$0?46x$WrijR)s*zK-T@u^L>?{if@796`G+CeW;7(OtJ_uF54fC}Iu zL--dEsdP`v0{dG3!6Ri^GpCnlom_sTZg~0|kve)$T&T0N3CY<^sVAtSOH}HHx zCoEyVfvYWoVjPz6c!V6gc4LK_^jia$1&V^qB4NK7|7BiaX1>CZNlzs82Xb9Zv#MN7)}2st-=5(vp%#H8%>I1lnIN3QkqRCIlznLPopj758XCA zz}cll6{xh9_$%yliYKgaq|1{&r>qvD7pP_O69Qn3J~BSIPgHBk2=(vBUpbq-G`#GS zJ+33gVrL1M1-i%5ncM;OJHdZL0GwS8JnHsX#!;3$8M!3JC}CVL#S>w^?DCHFryBy_ zBgMUGAj;Y0z^sWkP5MBC%qCzzS`D}|wY0{6n1Bw!fO(Vn5Wcywx6Wf?6x?+(Oq0Z8 zjWy5&nd7iXUw%H!xz_cbIu+(!x>_SO#{-|!fC6r4|8WA$VmK<>c+x_<5KgHoyh)Yo zS_sE9KPFbkkszNJ9+U;lrfH>Ivebg>0W|4^?yta&%2I?c|2@pH1(@|w0?Zy;eFx{d zvcgBe{^S6Yq_=CXM%k-6(h`g*jNY)xJ;4;3hi_l3S+Ko8T~3p;@0!maHia8=NLPvg zBMQu(Vz7{S6loe}w)7OQ5E#$|Y<>#vePB8ja6T#X3d67jY0O-!x#Qlnw+JvZV$P}G zzyR?8{D?V>$#k`bq=9b|m@=UT{DuCE4IqIjV7xpwKSKs-rQkeCgMV*$M*RQrGZYxN z1W^Xqk!i99ts;ys^DZFSUI?OckN)dr)B!JJGN26M#Y~K_0z2ZXI|c9_utgl@*W{>f z!uJyl`z_xintz+K1A+6y>i_jJNf5z!uD}>7A6EFxZ}D|<bTK(odj&5^zm{J^) z$*}wKUr6N6sp(%xq+N6*OZ*cK!&~4O7OLloQ1{O4>Ipt(BFy+sBKR|7hTTwNwLDxJCPnGFL1o~Sw2$+!fC7= z>h#%+sw=m!EU>REwQ>kJd0v&+v?vnll(@zfd;TI;y@5(1W$HVk{J2{;?CyOL$e;B?b4(#>hT zx7O+<U48nr)24Fo*~O3B{k5h2%ckk`15=wGmB-Ni`BX1J zJXne8;Yv-C7@$Cy1RNf*8O#B8M%H%P;~#1j%?4i3ofVdJM|>o$stI7w_XZu*)s$8e zweh%=Vm;&0Ja@2hjNdeNMJ7xk*xU})x`OY+am9ZzgJ*Xi)mHhwwV%q2A)_UrvZ>kH z!xM$>!^CWOy2U>^v?~I*nZ4}NYFEA1Xb;g!LRV^HyUK9Z%59_G`?$M`2OAOXSGe=MxluQ&%$0s`bPRfQmU9@eFVNG5Xxl?z|_q5}!bFwp+(!@4r(%x=obR`Qz zTz2IIaG(2y^x_F+PLZ8})v<9h%GZy_rRRI{$ErY9ZC6oS0PNKF&H=!XP^KN#(3kU! zX&lmJBlDxe*-CJyI8eTK@*pF|BLK^h80oUmE`TKgP6^FiySkoWWdNdbOCBUn5UD`a z^h$A_alP399|58_n1@5rF=4Y&jEZ>w4MX9EB+C_%*H0kTLakuSZE~VzgH488_~bWN zzg(FjpFi*RT+qjDNp^WbRDgj$CQdu3RwDg>Iuok)4r)^XvO?s*Rb{dN&9do1WaEkg zpl!2>0a$_$fR=L~h{;F^e3C}@0=cM6A0k`dBwJMiNhEAR486AR$U;WRoXO1c(;IYv z%ok}GZC8x;|Aj~}+W(KX1^)3XJ1>8jsR8^-9fn_tn4K%_9_pz5Qu$-yFFa!#fEAK# z;b(aG|7g9}JRhKECg|(ri2l+uG#Gt=o=N}z(KE%2{||abFIfsmF+KYSW+$24JyrFR zTi5Qg|9~NB9SUak6Mld5izoTY`$O%TSTe-h!)Pr(eD8=~rb+L6kzu@cr_DCL7O0>3 zx6Q3TNt>X%+em_2ok$X+fFDf!AWtr`&db1m`3D}SPduyP!wxb4;T~S&#n&8TyZ3R~ zp^#l!D|QPG$4g-a&P9(*AcD*}DR!VHDq_ z<(p*(^PNBI!;O8~DQ9}*{3z^ctadlv^$_kD6_cDM5C;`d_Rx$aZXC9qp z{*AW$GmuFlq_Ar8Bozj615ye?gqu~k%vBJz{tOTM)TZOu)uYXCmU4?RT!++$s3o-Y z(KX3!jT_yQo7PI~Tio+kver|b@8Zn9gj*gs6BNaiciK_X;7V??!EoC-1PG61GRiwS z3!$B4k}zE6J3TguSh?OHczCV-L&`P8!#G0Ouy@ZBv2Kz%c#b*OsR~T<4f~f>amB+I ziaC)SV5&gG4(gVZg_7ag!wpP9(a_pdYq{ta7qJDS0MD_zK?v=d2^1c#tq2bjZC5m0 zE1Z<&?(^&ugW)!{rj>W*L=|D>6#Md!OWdWReftDxy%xc}(EOr?Hlqf?1*W>Wg20V9YF6Nl91VoCe%rQ-?PLE3dTR!b?l@)n<4|qYi=)jhfFV`c2 zwe=`VAlD-Xvy^*vB+~@GbZ({V|I(TPs_2jN^|MS<_glW^rqPzzq_upabyxd>>EY+l zd&>wrKg-c*gc=ACEnnw<<bg@f*lr}+k_0qn#KpP-YNufYM#5J4^pdcUkI^mC!R$v5PC7kBELnI zo?Oq##_1S6Uc3G1(MNYN$rqe#QmX)SBAfh|IXRcqOZt|jM3SRG_(IS-yh0mdQ?8Ar zx%V}#R`R-&#d{-Uzd~pIzV~3uv7rS7zDhM<)wYx(WRed5TlW$)7Ls+S+jmAi+T z(B67>Um%ID?`4pd0Qo5IAAl{e_2X{{K~)C7bRIR8HWO)WDBlZSM9_?Lmeg@F{{F1e zh0m8V7G&6V-{nMiFFDFJ{Wb|#LA{#u6UnPzLD3=&ImPH5yNF!bX9f+su^$toN^th` zo$0CkQIeVbi} z4DtXgL)%T`__yl9OtkY(_q)du)$Q{gGI$T$Mtt7qW#BUgSUKK5f0u!ixEhq*c=V7T z)Kqikqq(G`+2=GLBpeUOEiCB_W1q_i)*ClZr+S|N1q+Wdj!h~+GuxwVn`s!Z>HKd6 zr@^x69IY3>&F*#;sCgQAV|y%-j_PYeo82N{JvuMbEN9UrsMBUw*$Bd`(N$>EiZO1dXLL(5jeqM~ zE-KLV4->c~AU&_l{KpeGSz>qs07G#$6Xv-IM3yIF0*I3H^#Z$kPN6~g*HyQGf<*v6 zgKHpQqN=OwwHKpR=srPR(9i$_UKmVe>Nz%>$VZfCLH;^v*HQ$9N0%!1MMxKn2`ka=dH$s1_iZ)-m`JfGwHb zbiVRR{EIKW@@91YR2~QK7}WrWAlN03N6I+uBGK~OpG}%nn4mbegOxy*PnrO3SRxX zPPHag-=oTdCyGy~>aVeOe4_bP)0|IKNge`;zki7Ult$q2Bu+!`W!SHbO~%+o+t5y% z;mK1Dpc)>1VBq*GbJ2DrFq*%=qCdhp@r3CtV{>Vo-22B!&9*bR{sUDLqc(&A0S}+Y zN093@k4!GR0Dy{Dt3&d1o?}qIPirr`->dE0vD5s`J$a6UEkMDv?(03xKG9r{Y`gc< zeBVrUn%%&1!{CFo{mav`hg#MdP3S%9w1K@0neHP%kPRc)GR;SK0a(SV?hkmyu}Q7d zy!6gde(aQR+b>c53n0ax>+!&DUZ>t(7EpdGBeh(oehE}bmw`{dmp!ZrZvJNg_u&{u zA87nN(KnrX*)=bqgFq)2z(8+1*Zqd0HaQl7Er`uw4qN_O9~)&NxomqbHvqLNcEMEZ}k;Gy=Ye4D)p_!4L*bKy`UeV7fjL6at?leRB26l@LJ<-Iw z=2o?UT+P1JhF%f)?G6~w{-Q@g8Mn-G97Jir3ibEVY(hF(eE0-lXs;Khn*43l2WO+j zzG{AA;pP}@7ifDdnJ#MLor-wj#j~5yVj%g=bnehdvCN9OMm}BitHP}@6Sm6VhGQ1) z@-b;Pfb86!&U%|2Zx^rtULmVs9FCf?>k-Qv63)&YdY|u8<|QK6U6K2~RVMl@`JLNx z9(wSSxXkAsjYuk|MRx_`%yIiL)kzz=B3CLCBhtvov!2Qs8f_r;_j2bdoi17}s&&t( zAnEF{HxT2`bAA&Ag#ACn?->2+5m^Uwy_#G9hXJ(S^qf*1zzjIdCmJ_^#e(3zfffB?Dw3j)CJb?qXH$ZT95kEHQOseLUN9*AKJlM2M4 zw@g!e8LytI$Wm=HRqAu`$Q4Z2M^gR4BTU{>J?9G#{CeWs>IfJ6IJX@INa!q;I08lX z8&Lyl7yXoQtECts@FtFjYLZHb?S%rHCm3`pqOMPT2uHMAQ-x2`96|UTyjqKyk1{PD z-iL}@m1-V5FeqHjd>hk|D)GtT{MIozgyjwUB-`oMp#~6)9#CgbJfaSv1p?_Mt)II| zhI>CL3{p16wjWTP>4_&6@KKA!S8>D5+LUk7M?i`M&PKN=6Iu4zC%57rFCzxy@?dr6 z#k0TZ#YWPC zfrJKTwp7bj-FTnG-zr>hyjcTM8jM*sBV$K-BoiM~DH)(wM<4b+8hq_lr2Yo0z!VqG z3p}KoIGMPMI`?4IfqV#MA7e<~xEtTrtHkgF&i~5~#FWB1FcJJ45S}l94;WNNlxF~q z*Vn&oqPquy{zCv!9xM|rG!z;6reUzsZ}`X>fC=NRcx=a~1-AmfOKFwGZO6VJZE zMEPelQQG#73q}t~=!KDLYI#bPsL!rZ%#Z6afB;g<;B7eue{in{@CSppS^vQwe4t)| zB|NuCYY9=dV0VbYbk)M+i8vHYQAM+p2oMw-kRdpD_0oJST^@i10OlYly9D| ztT1YaSgKNdALl^}Y|3tEy<_=R$&p)DS4G}opyS>Voqel#Q77ObxuBfJ#w{@R1FwUe z<3H=~H~!o=qs;uHMg8OCTC)xscLdGVPsIvlk#ftSRUiJ0(n)x(F|GXhYip{&kjGHE zA3USOY)Ux~IrcMY@0t1-jlW|1(hBo>6ns}R`Bg5cXzdkb;KCDBv?T)3)PN$Issg2H8DIua#_W`Ce*K^E1L*b}bp&x}e5=hrD5oJYw-Bi~5s3 zd(I5G+LAxc3()t=P&*9Gp^~JC3{nlUZuNXZyzPv9-B85D%+k=y8)-l& zn$>M4B$rFWLqa3#Oy%=0wN$Pl4R)=in=kwqTjU!S`y}691$RluetE4s%-}!5TR7jg zVF8nV0ojR?*==j>mQ4uk59;O4u7m;8SG;3a#b;lL7Ry1(JMcblD{p=`V_4fXModF; zjQ2=8PnE7eh=Vf6ZY7W^T-=*4pHWlpbhM9wLm#QprDhPQp+?Fu6L8mOxmG&K;yiwH^()HV1R-LBgFx{(- zT31BHEIw|tF)&p`qpE9I(kiix@*}mbzRI9jpy2$YM6RE4$PeJx7!5iHTuAcVhB_AX zJ>EBpgT_F`6xU-B%$gynLsisY8^CZdR`pW!rMe!s9|!TjW;d^MJz;l1T0~w%bT|0>i9bH<;~um z2Mjd&Y5m8Fn0B7}3|iS8N7pIZUGLwdjfuQ^|Gc{3!`uddj3RxUt(&>aG2*r$H<~ z8jL;BWjqy)L@tLx>58IKPpCW;kc?tJo9hx840qDe63p#uUf3wW#1-r0a!)(9;l-RdQ=P##W#uQ zUBz_r@CjKpV0J4Ju<*zW5a$lYMvbt)KRL#YWw^uf2w5cxnmYq}O5-4}y3|b)hdu;0 zhepm*0Z9x4n%4i`uB6`mU2*c7^hX7(_CH%`{Twif09*bwQeumd)3VGcBOMBmV0LUn zlfmm<;;TDCU1G5Y4pQjFE%hyV& zWpv0M<6aNraM&RCe}Vde!u_;#HAxFjD0e|6`0k~1Ooyz{CZI8+crDWDmtBzh9WXOm zEGn}OtlWB@%KN>&#u8nIRG<6qz$i$8G%tr~NLq11-(ybw6F~NledA@Ps?5!HI2~ZV zgnBlIe0LZ}Ds!T+&bJS0G%1?QBjbe7Pm)<@HVhb}b-)ED^ITV1DgWs#tt0C4%V(;_ zrA*+LI-P|HrRPm6S0udlBI1z&&Uaz8Kv;U-sWKBT7J}!R*-Cj_vi$Jb!1#A~e;=De zqVzdayjL9f8K=QgDQnq_)OW<%cX5O6vdq0wN|hzNB6E!9c#(SEVJ*Ap@r!E^RS81} zHZe7T=-CEwas8tn+@J%hQToVic8VFIZBDU4=ogLEA6%P5u8X6h%5}~Z5pvMDIa-^zgB$j`vkR=C3$}%7M53jK@LAhIYK|YHS#_#ri5w4+ z>1tUf6nds#7%V-hdK)jW^R>TuORZbLvu)qTwuzIwValzc?6PPd^m~+_lv<$F=qq1k zCV70V_eIu=Tbv&Vrj*xbI;+lZy=WTNlJixqec)12#F9CBh&+u4D?22dC(0s0C8tvm zP*Sm-NGVcn#vt%nd>UuG#5dgOq^f-~WRI3P#Af6WC)D5jit>F&#s*J&4Y#F6cEgV> z;b&MgG0Od;EuiI@*|qDp;3&xs zYppog8;R|=QV^Ma-Kbn2^&jekgT)=H<PGZq_86L^_|wB~ zW8-`EHFwWC16Lyd=@XJYwTfPv*#OfO=%Qx|AH2yILYcODYFL_k&7WG+fBp~w`M{eh zF$7=wJw$X4tmD#fdyUYX_e?RwI4kP&hwLWE!)p7b?q`YmejUm_%7gzAj8o&XNB4ef zR;z+O#D=WcbSR6+19e=pzo-iberxo}9R96h!robe_g@XY#~ccP5Uu99N&E5pRR~>% z+kefGUh|8v*F8-21_2%5#dzfRMfQNbzik1PwU$o%P=hKd6J+`H?H}b9z9^_sl4$af z7*|3a7^J%W>P(?R;uz z2sp0%@JemKvI{1WKJSo4y`Q+J=`sr}G)tjxJ$p>_syGZV&Kx?I+M$lz6AZm)37s__ zqe$m2g$%h;JViR&LtGaGO!yraQU4Q^t)bpQ#KT0#*$n=LuTI;B}oRHgr%Nz zxGD^p!2F7NHFpZrZosU{|n@aK6!i0|x(MXw<7L%;n}Wa0|+q zx^?0mYc-Qls`@0AlB_(aE?snU zN_6T8DMM0fr@A<`e67d5Dz@ObCMpj23{mf;$90kl$CoD5T?O^W_muP!*%QDTefM!1 z)gIG>Y=8EFXHb-+wn1I2<;q}Xbv2DXHlPXx$kj)-!EIXfJQQ)@5#*JkS14+vF)$0@MC=LAr9l7>?oY72b6g%H2ieo0X; zu{a_1PCCMg;PK?xbOCjdnqHzFdmJ!-1jw2oFLxk}a+n@`{>FTMX9nVeVvpO#jV+)q zan?&5VF&%|;1sN)MlDeKAZ!};d7S(kAU7iLfbY>I@#B;prPxaH1a<1M_V0?qgAiSg zAy(HYNFB!}i>ss&awr2)RJoqORHp*vG~23()c@$F-U2i0rpq;K3bjcS(~@E*a!Lp; zEO$4n=4>A6}defAFx;i7HBw zOy$rh^^P)$>q$ZA?&tqO?^M$e;=gaRz8lY`j+)WaZi!K2R3EhG0Fwf;=Yu>a;V&Hh zXoAwbiBcr>iM|fsaz*sOQ&l$9Gt?mo(dJ?UJm{b*Zp zfX^x&ng5)X%c;TN6Q$Vzpt6{AVj(NHP2GKnEOb6gu{OphwOpyT@_;ArQQ3KizT z-a^7-lLom_erw>W$-XU0%wA=7*J5^TJbCTK(Ul*GRmLu~@?}q7ZRA)nJiT<fGAb%;gv)^b#kDRpLMcw@@g2o~ z?WDu(fbVb+u|<=N09faW1@Y@i8uIl+Dh0*aw}SL_w+Ww38QRf@v}~1oBk}rp(lg?cdIz z#21bCTrzpsPkK+vUhiU7X8ib z+w4>JeX7R`N(?pFL+$kOZyeY2l2lju6oQ_i^OBy7B%Yn%Xnp*ZR&W~TwIr(UERvb* zi7+*&u$$L5ck5TEUzaa3|4qLYt!jCw-O;0a?*veU|d7oCYlOLLJHCgod6j6n;_X zSqqvVGC&S?i;ZJ5vGrAIk)0NH!0)x2uDi5#Z}~28_-E;O^F60Fm(BBq?FnSE>0iz0 zJ%wnXX*;LCL{h2XMcu0ErV&_rq-V^{p%;5os)O^<%Z@;Edi(eV+?u@e!^!CG!&w8KW^0^FXM|>md=Fy(>;4WE0 zo=L7fEtDtZVt+^fvL}+Af>gifdgIfJ6JZ|M<$Z$md-fci>%Hd`HspKXEA^Z!-3bQe zw|voS8Q%NUj|+;iUXCQwPUjR5$99^Y64yYcQt-i6byp8|Z1yz^!!ik-X`NS z4gNOf87=%x53=T6X&`wbwDIQ^;69vE!y@mLQN41yussj|v2LbCvC=;jv!9|LcIJ_V zb3THX{nA=lUh0iV&SNQ|Q;UqqsMvOeg=ntuWH7lrHra~NW3HMZ%jjhRi^2|XhaC~Z ziYAZ*UA_~o2mM{+m@FF#W>gN*@ao%|xOVay1e;+P?pSAmT9!WQx-_#G)Q3LeM*-I&+%J?je~4X)o-0NUwH-A}qA$75T`8 zaV3aixF$NKG}sX#!V{{dZ3V;4T`3)^oZ6)@9_Dt$6NCy^{r}eL-aa-m?xZENs z0&4E&3LiD2=;LC#r$ar6y#xA~B;LAt$XaS0RAs~kq9pG0cJ<)fAG&C@dw<-{_@e*H z5NYhe)=4EgKZ|9|CG*jmm(Rw<)oJoVuNdbUbhA#ESl8l9e?1sP^r4n)+iY1{m`GY% zuJDo>;lrB9Rr%=7pP1Qj2j#vc!gTQk9sZOWS>fM(YT92lXH_26$cEQ#-(|Qf?iv&t zHEbi#y`E4Q3-#PV1~U`7_EG+HINfoPVHRry-|ki~9OP%ZC&%z{8T#n;qxRaQmwNPP zPkQ_gv4c=<6`$65N3+mOFQkm1+i~e?rlr`|nGF&TCO>@3rwP?zd1Y`R$3>v^=Ak2G z;f^5froA4LnjZDxct0L3Za1{SMf=*cWz~TL?9ujnw!>vi+e{u#_Oq`sh4l^P!~4T= z2Nim5KV~lM6ROH;de!B=61ol$^(ojM`p>k!COtlILQ8z0_y6MA5$Y)WTi^yORTtMN zz!uK}0v30qGvt;(g{HV}3Ybg0t4U8jlDiW1)dgz5 z;E5x)C2>9P370($c$f_3hqc!4gzO&%(kG4*^T{Zw)K;0_n4%b~S5ivSAu>wQ2K_@i z6GT>(A~kz(7GW0&f2mDyQw$*^MW>ViFtKotrB%$3-hnFhU4duiaGn0ZVwUi8rKXq$ zFa!VvY&_K%-f&=LRO!aX1)}RPq|Dp(K!HupjzHD&%iUig`ZSfL#JE4m zUh21r-t<3Kjw*V^3H?D=G@>jT4;3`cYP(6gtyDq+S68R{gPu9w3@`F*J$6GW+$Ad> zFvwQ4`;ntUmbobRv3ihT<6-a>M_>*DeN=Kx9ejfJrEYmN>CI%4AfmD=D*{kA#U>Yz9A8hGfvzOwE2q%+##B~10S2>dVrUC@&} zST8BkLww$mo6wK5dtOdrnJX4S+OT%scyAD$ws@XQ27(jc4`7!K9-d>x8y zOocl4s6?FB&?1h=D-AfEybAJ)jk^x`vs0;%&&WKbQ>~D1$~*EPfspEnxzI0C-^ViC}M zg1oW|;?DO*UJa>XZZEovC^O1H)zBX$q>y@w75Kg;uy;Ba{=0YNihomnNGhGkkE~1i z^jckvoAnn_ud!gzezcEo4J;dpWBHR~og*2(E-ClS+9J9jM>WB z^?rvU)OpG(cNhGk+8wmsH}U%wR_;Ymwb#M~X_X_WY;{r8nh(FrQ@0mTKJ3X55Q>M~ zCe}^Lq==-8C5Wk${ty`m*Jw#88_p1ubG7Aw2tagTDVDujEM7{_ZIY~o2$lKliB)U7 zGQ4rHMX(d32-OB!&T^ey_&B203%rOU;n2sdcG5W>aAGoCG_~6ihZa{)^5+k)^520> zPQLk2Dw%D(;Vg6M+c?aC;uWb;V(XMPJ!5~&y4h#`8YT?o8feY;qWNXaj_FDA4 z_1yDcM(Zskd1XJx|6Cpj%#l^Pdu<(?{a!z{(lAn^$(D;ik+gD%-JCuDEg`qK26-9n zky-e~M9*gCM9x{|G7I|@iT&q?{BQZ+ogHJo$|V*Je3ALb=x>&Xx9o?AO1VEZOX3Jx z33gTEI(?H9UNYLuH*I0cI_Y*IX|J`9kDS1p=w&(6c`GlNbZKHW0Qx)PV_@LlTns(Z#Yij^5#3!qpD@=ERO&iGu8#p0k_TVEw?$x+u zS1E?O=^7u!u;P;x6#E5a#UlKX3>L+%C9~(%F=P1!RNBeR-t@y(N|Hy#(Sdl1DSzV0 zF)6*h*22Wc+pd3%;h%_PG#g>)npapm*rI3vz^{JEh1;7ov0dg)Z1K|uy| zD?K*IM(K75NHJ}?W9w5+3B1?i5#c}dcv5#^1-(bx(QgnxMdMK+Nhoqg)Te1_(^zzQ zdur@T@%2E~GC5*BUPl&Hgd}sG^a^+O94xoOXlH`G#Qm%|<4!~L=pRoy3+a#B6Mh?F(*3B%@{%ID zI`qE5_k%x>9K4Q4-m|}@pvVMfZT#0yLnUm0Ml`pgTO8<6hO>0O_!Kc*;$P(-$H!$J z|J(}SI?(m{**0PIwEvfxHfOD<$|@x0(x#>2ec-u}kP*1j0*q@Jw(#syKg&g-1N4I-$12 z6%Js=d^*Sst=Udo2m}kj%9N^N| zSY4k6M%LS-+!ubP73N6W*AthL@1p(a?dd^+TuZ{Zf~Vp^O_GHK6?j6ZyQbGVpzE9T zTOS!)T5D?+^G#lBWzlK957xDcErFrgxxZ2*qJt~&suf(vaNNy%z8@8NUT!XgkYE44 zuv6S5wnM*uM)xyHB71$v?K&g)r0u42R*02vu!m0Qd6y$%=E063T0}^iSAs*h9!xHw zzmx1~C{H9`D_(SEmgPn96fT``P;j5F_AU`)e#pwrRARp>v?ityrwzY4H~yFpZ5Kpn z8G9U&Ufp?ja=WPIWxKUcX7<2)nPCUD*EeZ}+*Vu19Um%9vmCB)hZVhQ$<9h=YK$Q^ z(~aB~=R5N*EgZD-e~6w8DF?{f+z+Zo1%c6L6^YyZROX5`HOvuBQ@(p0dvwv!i^J_la>^+&|lCW5<( z7Z=b&R@$wikRe=)^9Z8LVK2pvm^CGv$c;%lp}Rrooi>HBDj(7q?hgFuSX%k|3-y-y zFDi;*+kGR8TiFG*EuTxxayO2M47y)%g{2FAS6yA4m)9%sjHlYJ&?>xrrLAhyL%LH}=~+@lo@|hROyVoyGoMb);NrA!bHMoL1reMo-H;Vd2o8LuDNKS!G=Uhq?&Qajl`5+*(?2QeP9ApQl+p1yNQ>bM*HP^=HHnTiodR1olMU#rfof)EuemnI90S)I>E8G4YZeo~$?>KQ(o5b@)h zRi|r^CtO827>})gxiW4^QCSo8*U*S*wCSj&=5|}9AnCT6&y5r{T&w*9dMWp}G-|7X;;YSvgJAwqHed|94T5tr_+yR3k?GZG^ zvx`6hu%mzAbN)$U_QY(geJC(QFmCn%j#1APA%*`G@Z9Bf9O3*Zb&;)m3%9}@S5Pf_ znkjaUZIiBzrBQqL$7RpL6OH-ZYMclfn0&QtHXuFIlsC7D8v?Y`EF~uwHhU9b^#aj+ z5%HzJ@d9EsNMw8OB*IYghxfcG=wdkJ0ne&c(b8pfqm733Gu=xOzo2+|LFSNe?k;NSU>*qL=(}Yeiep}+@^^T!TOA|h#u&)5IeJpKl(i2p=nOZjz>{+7ApK;~U^NnsI5p%=G=_vOyg%`Kf6F;GuU+KG2>f4GYYkYOK ziXWBaX)IDL3Fr~N%MWcVlI9mjgOTRe0|xQGdfv74Q<+H#CnykR;>>@r|Cq&-yQPmxjtI>=6$6+3G@HbbwZA8PkCC8&#Al=u~ z&Cb8<5~SGD2?7lQ#W(HrvQ9(v6~86i<+QW1$)_`XFCj%6P1A#Lh)I};`pxeYA6JI+ ziIOlg6nZFHX!bh-&Lf{Ue&06*sW6R)M?|7J)y!srGLLJOqwZCYQ&Tg&GKwDB8WGWl z*bO;G>PNq}7SH5-Zj(#vMme&>&ZCt<&hbXiuW3LjzF<7pGeeRnq#hnHrkVHx6$D#rQVMGu~}{ufZuYkKs-wE8)TX9)4>> zr`qVYVnuR|F3sRpR+W)Hjq<7)$;^zfO`<0P5eI$~LV$zF*?=35&Z*q7!I+hv_D1cFykjMV*BZ148pl z*W^Xu7es9C5>+;*l&^k~_LqEQK`Lg}a>zP7KR`u-CCv}!*)#(;+2!YCb(U>7u-ZTK zqFxQQ_RS}YP~#9sncIOZjj<*CHZF;X9W!Fe)FD!Z zbXH$IC?*+#n}d8A_4cq&OuU=*7A{Rjj<}V)@YjlbUA{La=>4))q{85&fqcsPqM zi-;Z(=B{fU3X;52b)19<>TUVX)S8#XyCG2}Z4f=B#;qP$NaJ+Rn}0pfM(^IiuOzf|a( z^8*7xq~h@o^v)Zlh(r<>acuMV7Iy}SNF5b;quE%CVLeovs$O*c(=jBrEYz;YQNh}!Of2W7aje6-TVGW%rVy^}HI z&v2!eY}0+aMM`Vfzta6~^0SPnnsZ^_Fm~sC<|@9~VzijB`s!ED|3}g|4 z#N*1BRG;T8!R(f^^+ydRfC4B3pH2zdY*ZqoV(X zU`|+TN(La5&ut7^vY&mR5fjZ4h=&UXO`B~E)^di+Pf=|()E2Vz@}-o|ZVY}6Q!U0k zA7t}$WkEsE&|p+I?VfHswa*;JCg4j!*>%)5!2uYx#~dF0{6W{>>#nuhHvnKK-tk?K zs(gW>W34H{>#xq4U!7koJ7<>N7<6qfj07TG{sO4rz`b$vCE=<8`1PcW8=M^SCKj}o zO!#8UYiG0~D~k1CqNDfMLQNsVXvp{@vOkBfoG%dps@zKAk)MjkJ#k&n+A5QG2p+kk z>lt+==!!G(gGv5@v%LlXUzGZ|(_$G#PhKS43M$V=;{DICVtz+i(Sc0vk`OsT-=RrH z+Ha4*N37N)BdhwP2qnQM0X zx40HYl*{1pbnfk=&p88Q&S_;HK{WagK8U~jX_Docy70g!)%bFVG@F~8&Ig@;$rmKhIfQa0VdXw_JaosWrM@)5$hyyY~ z4=uMpQZP>e-|J1O8-9xB{PNllgb?IA&#!kc$?|S-JDLk&;-lqj0PS~NpUY-+0y3|C zdFY>a!ifz`8$Hl*Do#8=ogqQ2sPtzwzh8*1iI;z*CVoL(Nm3S((yWhSyj<+h?t2Ql z%#Rg{5Tyijy#G{|t=q*!9+G4qsQaifB6)Kc`}Q3DHWqylc~B>8`ySih>&OhLSEQLsu7J05&oK2U#_RM#!z;Z^uv{6dnE*~`}(a~!}x4y8{i&2X`G>%wc z!#A62t+(4DbW{)B1kc9u){_Hnj9wdb|Da~I!sSur*R3j+x9sd4&4OKcS&~uH=QHYi z7@ZYtMq6+9>P|89)%<&VdNQJL^iT)_gmUl>4eO=WjvZY+DQLXg)tFWW=XT zQ$a~=Sqc>_DATtu+!NhWmCiUhH&c#NB`7x;vN6@@=GM{>4xktdA3B!Gou=o({mB*S zvF-6Vn54vmebtZiF-G5Gs-e7JQAynXM!G4iqr~?jtf<|Z@t*P|D5McZ>z-cUP*@|G zlHKrCJR`kG*8)P>rXedJpD-di5x8e4t~@$$#8165$$x6rslqo6qhhEX?YDX|#Hf-) z6nzr&hz){~COrL)Qm>sO@o7!6@%LLObA6xTEs7VRW;v`IE0PRTp+zzV9~bi6O;&xZYPrlV^+{ zOtHTFs3CRsc0_PQcj;tqJ?ehN$Ohdj9`bb{Yf9eOPCU4a7xLM*Lo zGhv+2Kh00_Z1du;;QgivcP(PS+%pZ*1Up8!D#=`t=&Es3oFP)0xIIW5{Zb-q*@ekE z#t$TS$?SM4;Ef~_Z~hARIX>cxEM|(pVxxbouk}k$_;ewD;M`F}Y1P9<)$rirdH@Of zo+Vu0R9qPr?MLRqKHpIBNnK^iYjDC7{xPX>JiZ^Hmx$@r5zzDV)>NUl3{F!RP2exORl_ zA(+*xVBDlZpqwDC{N=~Cpz(_9OUtw%+V06nntds4&g2UUV>0wt+5~iAJ`RS0Ic(~5 zrY8p3uyHBOX<%^@L@&ch9=`d`r>O?hv;i}X2lphKY(Gy`S4D#0P)whC$mIkQYATdaAJ3I=!1K$jRYCofv&2&=Ig~PVAV1&}8IW|(@e#WBA zcaKdmk8#Gp*!7kB1zK<9p^al4nw@r7Ct_vG#34WvpdK3E6M0A9QOMy*t9jGowg?f|z1$3NR`&F7;#?#5e-(A`KGEiPxMp#n+blG*!?3#oPXApne z7fJ^MHX3gMMWQix`B(PpwO%=8BF(OM$=Fl z9!E^X6k5sEU-1qE;vdRkRTb1QT>7<*7%pY4qKWlg3bAmfyhy$-{jRp|K%{NvKs_7A zDADj!X9+_f`I7!1{E-A>y<0zfitvy1DRMjK!KA|7q7b8crXIw4#bLn>BC=fG`zA0l zwpd^Kfnwo9_Zg@BkFrP59JO_PU|9@cKT8rRhoMVGP0YApEBq+NCMjJm+DS^eJLGUG ztJ=c4cGdGIO@Jhzi*sj#%zu|VISqIE?5W#Wso#L+4iSr8S95kTGYPo$LhuPxU1Q@> z3E=%94;Vn@FgK%=dAIv2?!e(tb6co;xbliBx1rQ&@Jgf`#^EA1EIc(x^>=aAS)U0^ zG~Eb)^@>1A8q3iN6}Ab)QTGdHlTV?HbB6bs#rI(&FDj>y%6GN6FMycBP7wI6`A^WP zdcV!JEin0=p!2;odiq94EP%|6{}QGXN2$MZr_ny1SIJKhyDe2SUW7*KCkX$s0K5&+ z&FGDm$oc#e%m03%f;}NmW#?{nZI=L9pp!pfka~ge1dY;rifELc_{_4>F4zamg~RxT zUf_aReDxHub)!l?yH1agdmHx-zBV7&9;)Q^Ug+x{zy%pw;Lzso(T09Jv7`u|o(k#s zG|mqRki#^C0U;U_KWRVt(Qsd*L`b8jUG${ur!ezPs(%80acYwnj8WUgD&jvAXBm+~ z=MDk_mCDK~sOqGuXBF4esKv6jX3VRIgif5mvWXtf-k;yN*g3WZiS`4X42PdRNDV!ZR4(uA|jE z=XSWV1wLs*x09LY8J>~r0eh~n!bb)#Y+-ocml84%jE zMO{xR3#*`o4#5#)=kQc6kn|Z4v4bGNJ+7~oS!~h<1b{KNg{98`I?-SB)qkT8nM6gn z2E6-d6huZ$z74>a9g_?0WGncDpm7oJzy!aGEj-uympC7$)6yU!G6d-dG%g|t5=O4S zvq6g5G7th2jiVChYGsqsZK4wUrE`v>K~w@0QuR9s4uAxJmp9kPU#DtKr&#Icconf* zzQc{Kid>&_1c=JNg#Gf}x_V%+f@rG|LH%VN7MK?vV5t0O{ju^ml`Zdu6$lKjmrdXu zjG-!30<#8m^I`1I54wu(8arXX{>5-I`ZVa@=DGwa;3z7Ir zng4eULPgGNqo%RyBO&Oc%H?E~+mD4S@Hj3q2@BxoH|#(p^zltTjWlG$@Vu?4VSemH<|z_DJ8pst}-^}QDZ zUM^$nBR7?!sC8flSQ}UH|6kL?3m~2lo~wNzQp_uQyC#|>E5W$*?z^98aYsdz zitVk^?GA^bC{kxa2=&D#=n?KHK!;-F3JLV02fb%mD^x$2cQ)9-4_8+RtN*Q~Lq{bP z=+j1_EK0|R0gUSi(cKKgBAN2}tGn_ng!)DRm>d`6@7t?G19iUHBIAiUM(dc{BGdFX zSG(w!NuWyk1VTO$hHUW$!(Z|XK>z*=(n|uj3)`h${g>0(VN6!Ttne+?m z(*sW4Ub-(M7Z+?DmZh-?pPz$*Ch#ALJSKE(1Ni!LJXOpSAu9o{13W)6Hi-k3EI*W% z6j6q$W1#eEgyA;maXZ5~aXV&4SnQm9du~p;z@+Qfu{NdlGQ@vb)(C?i=Cs5t`pY@r zI3@YlHri!Bvlf5LuUMdqUmET^%5pWH^CtHOx4go@0<-ma zMmrqZ&YOAw9eZE87hC|#ehu(=Sn+$(;m%yW&3dq1zo(QtiF$tC&kjjkvxdKmfNmUt zmnHP1ROG7b{6gYAjJUT0rMIJyHJI{Y!3>%*!d055kdohac*YDIe_xG2EJUOPxvnW5 z09{x-5I)EEMUt7>`4C@uI2u&tq7Z6cazPp9T*DU+$E4JK+pLgz86S~;)WsV1aQuU@ z%YWY8iKqp*CUVujLalkD-zMU7CA602=W_;Z85cjY#tf4HyE$K873??>Nwjt!nd=3Q zi5D9{@dMN^Jw85X+@y`J;}?6P78^PuzWl0whHW%HS1zMqfB?X>e})2<+`{_}YSZfe zGxSeHtqct(C9stad!H{CjQRXv<%31%9s=AiHuzT#0kHXvu5Mgg*Ao_oE`MxI@!yww zMZ#mP^TCaYTpgO9&}2j5H(BB>$gbj`Q;ZLkMf|(*^4^7cGd2A^FQBYbxRK|*geY&Drc|izO}0k&znDf zqt`7xwW#wfudkfFt6OSUZK#|*wQzd+whEA?vw4P@9rdM;y1{QwkGk6B8-CH(^Ha~2 z-EYm$mF=pt^Cf@2spys-S*UoH^EGgepN=}XU$3nFKOyf|*7zG-#!pur-2WeuPbnXo zuDv#4QtFuV6!!@zv9;bpQpBP5(kazWQ!V0<7`59Fio=;x*KH15MVxYCm|fuJE+&_W3;-PKRn z&sW5l&FyespzecNUf{-M(oJc;$f;lkKy=Fw#zo@W-2A4G*65n{krcR9u(D*N*L zl6l11s&63Q2+abxPZ)q{?`rZHL=8Z$*amHmF*B@0cq?^NF&b_`|W51-LQ<}x2lgx1ol~nQl zYoPsRV!osPVY zfpy6!D9GKkz}pQnK37%Jh@k*rIy)}YI zY>!i93TfY7+`9I`eP6r~?FK$*Jxjm`A5nbaLx=gaG^=mGbvbo8Fi>X;}5AKWuK7BAQg zzc^=gB$TFqPW;azXmf92$4-;~?7K=`M|oGU7cI*~q?N^G39JQ)0kuySbUVvnSIYqL1x(}m!vKsu7V?X&) z2qf~3=tt~hKtqzBIFtkK;EkKXG@AlyO$U%e%^Ou~508B>1ufzz2+qfddp3f<`cKVa z<~^RtsmcWhMl1HuiR8k1G#r1t9~zfSLy;Hz^X%5ehio;;EuY877bH<@M^3}1Yz-$d z_;45nugPev%r-8P<4TyVCn2^%{Vt5znLv#BduRx)1Jvp{v^>Vy(p)i??!tQss<>sM zY7aw|1xp@_I^ze(L}ye1O$G|Iy>`D&GJ|)Aqk*>`UDjuvCOXt&CMY!wCw2-t4#s-{ zj3*LC)*izm%qG^?`}h`bxcP#v6TpkJ;gXfZRGa#N-A7jPoihn<+yknhyxKGTdv2bx z)HR7Qz8m&D!yl6u`#Bo+co9EuOvG&8VOYH(ppzrPMi6W#bYU9KJ@?G9PGK7M87V~rjSo+aMy zieRR?*~kf5>8Xmurlalt_2CM#0dQdw?Zdc5tZP09m4zUx%8#7hK)g@Om5R*G7=-`6 zMuoULbbdL5n6D6)Rp?w6SN5elgGsEhqK>+D=MVzH_T&3O*Q{yuOyWTkzze%{$m`;# zOsns5RcJq3rq&4W{d1bS65P^{S}W4@ICtS;Q>l)F=NiRK6%1|${Rn~{_-4B) zwJ0s93?Qc=(><2Hs{!xd-L1GbxiEr-`bQ)+Zg=^Ys`_lmYZU8IL+C!k%NOmwan6Fi zEO~WUr!*vAgSNjOxKT4U1Uz5emi0`$3OXZ6m#7HG&9TO;?a-?B?d(DYZ~EkzX<+0@ z4M4iKGJM;8PUJ}PYzRuVXb|_}^IP>&ikc|9bFE}obu-FJ#vav5AJifyYJQ{<2=Dy?(V(4JCB%WFk@h{q41__)AwG4*+G9)<>jS_XL9{ca)r`7$%rXgw+r`NO^b z-FQrlM(}C~Cx#IbLtE<7&~z4u*O5cooMwCSUo~`WKWkpfn`6s%rkTzQ%Hoq*i?R%e z?j2hpOLgpM!d$7n6Ptmhovt@OkfC;c!tn~9TU^U^Jf4!v8)#T6z;KcGq}muB>dY4y zZi8K}tJPkZBNCI4&&_k6oNPNd_~Lj&&hrBm6IWt#(!XecD=aEg^zSI>Z&woN5{dSL zR3|6n{=oo@E}CC&5_Q#t5G!Xt7!M;&Y~$1g}|_(RoBg0 zLV(0Yy&2{&e6q8}-g% zb%R8k6nps&^^dU2HSmmcv9zVQQpA`@iCv>wZzDDDmQP>_m`vw8XV*Jrz=A$N6|d2D@2-4r5WW!*;Pf+&|P z#$BD3QH;0ejeO6`i5%$AR1-L+f($FK?*3Qi6)Bh7fh_-Gp4#%hfIMXeGxy z3F_ABYd`O($V|S(_6h0?r?2Tb#};QTY7#yPVDf)z&vu zV!RIL2MEex&0;sj*kP78E4}|_Jo*=-%QZeP{C(AA-bxQ(Zup%xYroqA+r;+-rSL=NAsTcd;2%Ri05#ac(}Pwl?bll z*b%^e<}#319SF0x{nE$25NA7gUi+z|n!TL+iFq6EgOY%h+kh4wLM7_tQ2DDlG%fSU-C=rE62sg*oyxgN8q-B|^?B0}MW%c&z z>=gTN8+K-$H((IDZg+O}!|mR=uWR)~u&n(39VeDcgJPL~E+8>CJh^Ixac3Qz(|rPA z9K0czCuzGOV%O!v_<)35X56ILiA~@KWs$;w!?gX;59(7G;``@5p20|AM2S8Ut_gD? z3$uV>SXcwrH=^9+y6$wyJNa?vyw);Y%3;v3d%OM;AvuoO4)6m2%`O{y%b5Vyq(?DQ>}L zB|0;kv!MZ|Um1y)cD{lHs@bjFoJcouXA#R`}DH~l5VdPqfsB^== zgn><~=CC1a-_T>7+q3Giq2tI?tYx+ME8Z*?&ao|||Nj}sCa~-?#mR_FwyVO8OdAk? z?lWN(1|wBo(Fkcq_s5ZbwUQk+4J&Dt(#Pc7F1o5;E^Wk>NNCVi+&%q%vrMS6R^Ju| z6xX4#(bVY$e4wvrdU?#m6V#~t>}dg^j|uZAge9$QzfI=s(1ft!7k=i_J zvF`eYL@F0{vl`(o@B`!bB6^i+(U5bKi=clnv7VJhg{FX< z!d*c=G`;}T=yYs%QQ5=ZCErg!k+iJ#;cuq z6a|AN#^64tI)=Dd6t@&3jnyT7c9XwjzvVVLxBZLA!pW-US1M2CT!MbY@s zf}*~17>%WrKFlf18vz3Tjx9fCZA2dUeW;8)4E=UdmHyG9$m$Rmjiup_fBHf(GsVDW zsIm}mkb%3c9cfU;ipCmQR26ynj~qv$+5}4!!t#QSkn{sGLYh7Lc#XUVm1UKpy!kup zJs?=gRt?Q4+`EkF5|x;-L+>ZEg|uverJ_y5nrl}LgRLX1iE4f%7eg$Q&QtJuQF_bQ zH4SF^b5IaL#TkTT(;))f9;Rk_O_NwOsUe?X3ikcvMVAHFV4~9?jlk>KXLzaf9x^vc z6__MU=h1ASdUR1)Rxdu_CIT)&2|*ZQrP*Aet0&9k?K#r>9X+uaVO%3Z0T zYmYz0U>=R-4`Hh4WXl1kKS-tV@Qk6EcoPO?g_f0^6{bDXoEJ^T4MmAsr20e~`}pzD zKNN$E!mj-Ocx{fo5|bfKML}jpA6DZto;O^e+T%W=v#gC2il`#spc?%Ab1&-&5_=$n z{|#kuL>na9>~r@9pERbHV~Z*Zj-$)alwl%Zh=68f%ONwtCNU&Rw@ZY>`B7ujnS?yn z=fcp~xCIhYUr1$es(lW9u@9$#AQ7k~9y+RwUp1u+tOnwjG1BO-0u7GdaE!xX8W*dx;3(m5=@~I%Bi-XpdvckCG6QIE z?@z&dI=1l<_r2AIz=v$cn({lMg(jp!YQ+V&yD_C(kC}d_il~D{Hs^c*E&)uR z5YoEEvy>Tws@efw5wYF(qsOBd5FHI&a7G*F~Q-h6K&lT}63Jbn$0+q~BQvB`Ahp|NoN zK+?4*GTQwiGD_a^1HM-t*>>ZloqWS|tlq+dkIY`boP?kL_V$`r-Zs7kV*OwCz(|zx zzb7bG8xJa3PJy#iP9C)O?mpNxE_+Ky55w=Nig@e4wyQn!zTH1YMg{zxCK!-w?2nA* zJrVaZz|XD1PqB^0|Mczes%g6P(Anae{<2zPlxhjMf4l3Lnt7e)ET*tI$Ff*o zi>C^HS(k#p>rkwf+eHAHo>xwU#V4DG{*yQ7)v-12uC7;as(-aMF=ty<_qw)KZ_9NV zZEt@5FY9a!fhR9Ebby@YfP{fx(e{EeBgULv<`TF28w~8z+aZMMdB;ZfF57^z!@?6T zw#^$pXKdSBZr%3$K&)ElOuxI2sw@N8KQRlOU3_-N zzvMtkf4IvXN0&hn8c}OJTlKf~E1unwqchg(hA#;IORRwZLv+Ja<_*A8x(CV8wQbn? z9Tq3?R>uP&MzN}lE(X+__QB{fD@C! zjZf$@eR8!ZSCOaC%KqdmXV7tq7XwN`o6yrDcA!Kc$>6_0xHT%Xq1#womkJ-cGYdMi zY^aULFPu%r9i(bD`=>$YhNd#Otq_tH2FLyCUaGCWy?M7BGg5#np|R8&OuP-Q5bk^s ztX2aP#^GKQTWTDFC(wB%EwS=5M4gGr#I6)*gnp{k&mHj!Dd`=N#p>aecyKD;biduI zwRycVt~%FdY1o~={w9ir?8mW7c>Mf^c!uKDR}>j+diD8j-}_qSi|z5I)@S?Q$lba@ zd5ArZ)!HNi_}To&o8B+cZ*T3lmDfukMPn7J!(?8-rJZN?W~7N^^mbvP}U~9yo&)7ocv(M(2G4g?HX0!c zCrPRjDC^XQyVQGeDcx~Z z@mqzPCDp0lE7|g}2jd@_MliGER>LZLp&&T<_GBQ?wThqJp?6ZycJGNqMA`(OI^G|H z_OL$5t5?pXeGS15bFKg^yrt4<&&j^T{mNi2ZS12MTkA|^Hm2SC?1_w9SIYEeGG!hs zh)+NOFcy*TTV17Tm>1#LoqQrF+`;d&@aa~f?UZf)O`-041{EOH-+{6%j`hY#EcSY9 z5?|(~jjaLQR%k8}V?f~}oLVB${ZG@@feSn|=evQZYg1VDh=_g~?XQWPsQO-h7M)0QRT7?ZXtvnoZ>RLeI}Os8AMcZ409isQyatp7H7W3lpX;(ioFT!GhKbED()k z@daH4Qm#}l5vZ_!V9cBQcVb9Rw)KLKLcB&$3_`DN{*L+l-*2V3e#Al@v%)+%@k)sd zA(||jmRs)_#r}|R&5*4iwK(jD`yPj%>M@C9dxKkRxAFaekuK5%%p7cu=9j`k9Lrk) z^Cwm2aEUoVW!2PR)x&nt(4>h(WATg<90!sHk0@|VHq(Uy8&@L1w!!R9!Gd-Xv`mGM zQU1nDW@(stq{C&jBF`ly!F!|6>ID&9;W2F>WuEczAM6zfP5Nj?YlPUav)bwML1};d zcGJ+15XUTyh^RkSL(hMCKuv%71ur>ugFX*#sgv5|gM+^Y@$}XaB!IP|h#WUZjx8DA zoFUKBywsXQQ=cmQbvs|qgX4l4S)&zyeL}Kh#qk|Dkh5P|TaY~SFgPa3!8p4K*~Q0x zVr@h?nY$D`lEdK*jTfQcAjv1d+j-YDW_nsTQTy1V>X{=6gM7KZnu+63Igp|t$z6)x+9 z_9oVKfY@~V4cwlQp(Nl@I{=RyMDpo+2WPdby(5701qK`3E1?s5B?EQXMS;h9%4V#k za>Fj5O=k|<&c01TmaU6vr647`V&>#Cn?0qdC}0auk89g=i%2U%ldoUq*%wKl!$1IE z$CUGv7^GQijQ(RwOC5c!=jun1m_~{IRxYC?T?n1-Ub!mQszoKnS#HGO2jo3S7(r~M z88MrYWWx&_veKW+%TmxQoa0v92Ji57Jd4{e{hk)1yp@J+(dOJ}c2FDEILcIp@k zeN0>Zg>{ZSUp@SsVFI6XxL}^~Eyw~5EaX>(NYuh;c3@%HE;tV`?0*p;JalxS@#bSF zb?VwG415|Y_60Sz3P*_;;<*M1k$4B)&2+AB6vxnR9`q7n*yk4sTmPH&a>Rl6h;Y-1 zqbcJb)_$_>V8~aSDz;|v$@jeF^B#Fcf2=A8<0}ZK(;;8|fcLR*L3lt!MsO?drru!W zqS|q_)Ks|$@DpBBjbE2i{J#1ve!ZNKl-GxSqH?I`)u7kd>mjJzi#!zE#o5W zN|TDRV;47e9#`UVH7IEw{+_Bs^ZJTs6K~grR!7I%AYolf-z~#7@+!@x)e!=vO5*VY zzunMrfLhG@kP>-S#|BBqa>$h?HC-iZ)K$v|#!B=vMX&Btgu+(2MzKeFYsG({3BQRK zZoCKbkE>GE3wKSftFBS`kNKv@OZmORyiIUG6RPhpeK-LBcx%;*l><}TuHkqlW5_=H zjdJooI94aKHl~9lTdrx4eh@Za`^%iyUNc3NGc{81Ob6_xiT&`fKZb-*B z99mw8nQoULg5ik=dw-rNs{6gWev&k8$(oQbxUd4l85eHFjfR$F~#HZ8m(?5l7( zK+5kmq&(Ua2&}h3?}maZGaI`=o0IbULP;TzH)oNQ2xGVC5ERJoW(%irN|k*yj?mZX z;Nq21JV~wjJZWJQiv7)FIA5VfA_|6YpPoh0|dhcgz{h)~l|?_nATD}7Zu0J3M)bblbIw07X)hkNfJ z#xF@F0g5P+54?YHDV6`WUM}$cDV3`6u0WLAV=4wV;~BjO`ZdRJd6fz%YnYxx9g+A= zw&x^E{gffUs`RtrYac}lX)TuRBN(vhtRRCgM7Q5jP{%Ua$RB`sZ2m}7v{$irV7-=tM=GFC?$myRWf>i((f-< zQ*RcJ&}(v60c0)>!_Ak{C%b{6b?Jf_--?`w$Wv?%=M-j*5{$+z$De2tZ&~%B+5F0_pxzXu;hxU zP33H0m6_*LK>@xEV&&##6*yB6T4N<%Rk%~gGf&Q{w{0jQJU(VB78qojlk4gLYZYe3 zMbtmf|3H7RW@jp0`T<*h1XXY*!phUFr_yk2uX=+BFnGGt@@x{8n>R*m)#kD~tFjB# zmFT<50S|e<&EB7uANZ8Z8`phTa{}0rRqL1=ZlAE9nlqa!6VkVA8Z%b-85j}J*c+rdjBKnVW*j6J_~_WAAo^)941HP@{! z)9N6MN%c&a3qPXuPMhA^HCJSuIi$hVPVg(X6P2-;tY z5zJ?b0}SxuTS3Y)g?>jRc)Nm4ZE`ASB869aSv)GV!!t#2esZ%zjyy9RU1iF+fsREH zY7@oZG=lMVyG|WxP6?-qkqXYpC}_HhloOVZ6>x#~X{kx4Ak`5nG`H=$oXF9+C{||1 z$S4_1;O2=XTLT^&12415d-S!=l@N&ESEhDwDE)kyqg+SJg%NLG^+rg5Af*`Wr#Rqy z5#&9RGjZgM9Dq$gfPm7=jjCg7OI6z}k0Knj1`P1EKURbzGVEv;`6~Qf9 zUhDBDC&R}}j5Bn_g+goatH--Va#pF$C~0-bgvXOa&o^)ft~4S8b8<^+39t)J!Z4)h zykI%tnEpXbqzAGR!ND|ltg$c|3{?J!yDWIx+BlAHD=&eN62C6{8f@=}a$NIk{Xk)6Tg*36R5!;Fx@ z;?@PAh}iub?jNEZT#UZ)avcwZK@`dv3z_V2fK6qqqB+-jsGjO^ zIX(UC=g!c8+9`{Q!7HG}dV{X zZkS{QlR$AT7aA`^I~JP2j4)gY&^FOpaq>lkTpxd%GV>;8dW5@M;T9(rC{J-=u+h|> z<&2jHsC~>weLjfcz#{B4TY1oR12Cg>lXiQGhBcNyhAu0KC z=eHorCg1Zl{4QOL;?9nIi!>Ji z#r1F$Qg76h*Q&UmhUykKB^V%|?qOjSQ zt>*XwSE;f07Q7#xVPGR$MIttHd;wqoNP_;u3E-qSF|fVRU9yBYjy1L${w&CoNq(>5 zX9RtgKcnWihnXnBB1FLUXH{krfrz?IkiN+%NX zxVt28`UY^U_pa$>rf);^^S<}9ix)Hl4wdb_aCx@2ZS`mQY9|4w6=9zg13{2aDKpn2 z68Z+#XFiD;^$k-gck%SIqxeD{s_cXn(VPga7~{g#&$teAIq!pKsLMZ$$J}`|0UjqB zuqH_IRTO1F(iUn9b@w@rcJ)lcu+wT%P8>|#MmpqKHG~D`Q;`1S`v8dq`?(S@!;8G% z3WA@+Z@}rfIE|?TZ+|f-DgeW3{sC}$#ZjIjS$o|6t3Z9Q$hf4`mG=)Q{wf;<@@o&6 z(S^TeABw2fCtn7#srr+5UVhjl{abNjQW4>#xHb!0X1%jT_w2VSPL}hG6mx_B<)l4O znc{X9s7xUX@FhA6mXO!@UV32?kdoAw8<`_EwI89igYiS35v0SP+egP1*rUUc1f$d&gFSW$0$A;jsGJQh zFrurbi4P$smzxZXT=j)3njgIq3Z*}}Awd)5LnB%t3yMpOU6Wx{EnN60R@Mis04{5B z7VlEkZHl*@meVDZe={wY9eIdk0*M~qJk|b~6h;xDC~xxNyMoTJ_YxjmA#1F2D>9j) zU-L)$zQAn~fqs~Fu0&BLUFk8DLdHSX!@s{>1Jg=q;xdskCf^*sZ(z2;h1j!r9^kc% zbf8Db;k37V`CRVFTff^Fm7kT@=#1M${>trF)3SzYP<~`8%Ej-U2eTz&Ehu%Y@eyBb zYST0h8UodkiJlWIH3c$^iYU3)!GdD2lvqTxD86r+Y1b-sVg9uU0xlYD{^Qtr=(S%ngE;TYT@5uVhUsK-d8D*E#dGCJk?{UOfgGK-(8>;+}+ zpOVk`2KNzXyew3%Tq_W_=6rTSMW(a&XIvdlE=SR`H-1a2Up>V;D*lue2JQY0!R{^A z`WYBo7ImtS0@+^LnuExtQ7OTl377nW!KP`eI=jnD*jmy6r0g(87_tAdkjTd>qcJ29 zna5r|x7;@yT1qpjqGoRFJ4W?!*tu)(7Y%6V6h1mjRa&~KT3{05B0l}x;-PbpZMVS4 zT6+80K{B&Mi*JscVmUlu{SRS#cZx50iPlWv=U^kcEyY~KrYc^kJJi_*9dhNFOv-*? zr-=7-)GPPNRvB(2d1Kvs9Q5UT4oO@3v01O9E;lezhwE8SLvv11oKyJIoI~y|#bL#es z>ZjacjwS-mRSsddv>tu&7TPH{sEYqZ+*=35wRCTz!9oZD4nqhbSa62`!7U-UyA7^E z2X{#b2~6<8J&@q8gANb|2u^T!cO4w=&N=V-ec!#ezQ69RdaI_^+H^nbSxwEJ-Llu} z_Ve+y^j|lSj3?4o?Jhk%2?`sFAm(YH*6>8`;6$CwQ&-haRqcmDTyFeVtUoTRWx+(j zZrwjX^fMXe3s9IDWX<8XH^W&deL%2ulvR4lD+GFJHr@7vJ?@HqZ1QJaVy5$bs{C6* z67rr%A!dunk7tJW;H_7XBC+3X;VR=VVX>iZ9qvTi@(;$2FZ+H?V=}}b=VVq?<}Q*j z1O4OQE4I8!MkY`{{LSj>Ge6paC;<-p6C*a-yGx%weLO3Vjsb=x{6_7_y*>}OuC)Gsf3Y8q zRxEUUk~m4n2v$NI{^n%q7OBKQ2ogMW{!Dbfk0pRui57&kVtJx9?MQzQ`T0n#%whgZbLwO>IFKgH7+WTL82CDZ9K<+z?MW z);9L9i9Hbvh6;&kFem8ji3sQrQ!*{xdNJk$sFV%B*zANk8w7oXt8$V1ojp{E zjdPpBQ3YS@KrZ)f;mPQPKTZwu*687@LaF$^ozlTy^5FL7QX5G><|TCnCvCa zNI(2Rip9ifigG3|RLSXDSWUgSgM$lOf)KxjC#tGiRZTzq3+8Msa-@Il9F5 z4Ae^JS{yQAL!8C%{Pu7Rb5d|1sqhzCgXfHoDp=2O-Wk#HrG|d@ZJ4g(N)B2A9VZT} zb(lJAX9F3R{@LLiw@kj*QsOGO%jWY#(H3f!&0LN3_%$NNk?@Q%Cbh)DMFItw7hhcn zML>@;eFob_Q#LAu<0+bP_SB?0ZN*a*aQ{NCr?;F=x)~zp*a?f2n4mlDI^k6yC2N&m zHbJ*9mzQ>Nk`wmY0}g}IMXB@fQJ+Fns~AN<9^gKKpOr9~dTvq22%ckAy^Ejz5PN207CPp*#b{Qa zWpG$#$Q?s&Ifq#VuayjXDg|<0Xn2+RI~Ubp(Lowlxs0K(7saoQTSDb9v-uI-&f1qz zzOE%8gmSfyWB%o(tkcg&lVo(RZ!uPJQADzDF)WbtFOzX!ylkmZdf5R~96gkaCHFgf z*v(#n^Wz&Dw;3ebk50f8bN2}>>H%Z;hvv5~?jwSxlDmx2AUs&T(ST0I*%d>Kq=>Td zr96}KMQ2OJRgV%)YGP=}N&E(PD?jCt8{(L)fO8L6CfQ&ebjj8BUs=%gTMKz3vND-a zX*3axa3Qi+-VQOM+h!d+d${0*OgxFVZl0Fcl*aCrH1-D4Xd|&F)5}B>A0m!aiV?@` zCIDvcvWJ8KAGjE~?D0&@FT05jE%Q^DJ02C4ZIvF#2d!Rj(2UMupP=bDj z!xU8UPI7k- zXo4$hW^E5Ner*;4tVbGVyN5gTe(bChLl3oysH=ZIA%m`*9a9d%+g zUy{a2cFhcQdSYmE&xpX`JJfnJaeqoC9toQ1)0T2{@{SNY|Fx2$^LilC#=niD)BUU! z-}W}>#fmLDzAfIX#^)2fxsgfZfBp&oLOiY#P9RLRw0koY0E=~w!9tS2{g~^LJBgk} z1s0r-ug1fWv$nU={Q9lkjblC%fSv;MTR@Ki`W^o?BVSj995UjW)0rbL`{%xAlvW$s zBevTMqNk3$4zgOywD^uSM$O=Uy5;i6bzX3N&P{1t0blqFdKJOB_h<|AC01<1>V8Xe z!YqU#TFCj5+?*jf&c)q1+rRtl1MRBuQJ}iLgwL@hhmyoGOLU*8cGQ3I*%i@Df&nPd000pHnA@~p)BY?z#4`u3}g|H8?^H%5B7sz;kZHevuz35tU_@E92 zGC$efTHy=oQDmqgN+U;wImX>AQStzVIbp}FmU4#zrI+B%4V-^PDCZR!PRzhYM{-;GkX8(}ekf#IIc?;^SxNb{dCm{t; z&y8n7ivWo4fd%d@^gO}GXntFmv-;Ra@q8?6ERp6$nH7QriXQ5FW9$Q3NZ(t$LeF33 ze8#*-_S1}cyghptf{4CWl#-&P3Ajy*o<{H2A|}E9h7+!i zu>IQ$2CgzuEMO1mKnAB-?9JN?o=+?D?aMb8RY5CaZw|Whf{F4L#1{VsiX)n71Fk<5 zovaK#j`Sr612iU}AqQRJE2K91*FR^X0y}wzlOA870{rkQH97rSJFbtcrCR)3`>&58 zl$YW6$PlVPzJsnzyjv8S&Oz72-H;{q;xgd%JK$vX=7J{+&@mgf9N{%zC%cT|af3?4vZe);D)V+p&B`>*G*EZS zaZl~I{;3uPB~{a+DsK29i?~d*J@5e)$9MV`7@ak6J$n8L1&zpq&6aN-s`t3-5 zsA4+jWc^C-=l%20X5o2xtNjc1DZlgm3zw{GQL}?c<0%OK`86XSU=w=YY%oC4f|cq$ zPtiiZ?RPHv>(agfcX1MgH{mtif#qZm{bF}Xj{qZQ*R4ki*@b=jb2Q2$)n9Ak{pdF8J0Gl_mJ|}I5cOWfw$T3YUDcJ_ zQrFshZ_BZr&DqzdJEHL7z3MDFFV(Z=Nf!CYhvWgue9#w9apO;3y_6P7e_Qbb=OOaL z$=Z{z^b00$!UY6BnRSys30=@t5(WQ!hzyP8VbW**u_Dqm^zHrFsN?w%>C+PG2v0QM zPiA`inIqro=XmYWaW>bC7y~ua~nu@pM2GRT=5>O z`0Q0`(%5Lmqe;@Io_6xgVn=*T&zdK?2RtEA>GVXG#*;aQDWXKg8BNT|+~?(m$dg$@ z0#8KaCjI*!Q*1-^!t9UsSDx5K!V88jA5Uf%yrSgeH|x&o8cyacu_wA`7b^w{tZJ$m z(LFXAOQ_u=!vxX}0_3;<&{uY>tPgmKg9HXCoIN)h6)2rDgqODlJP#`EfI&!y;p<@5{hA5N=id5@ruku*>?5A@#ld2!xS@#0#E zhT<=0=gvDB^v>JRA|6zkEd_AV$b%9Gz1j~n=R#4TbM2Xfd&H*H3qvawFnvKI1kJLe zlg9GcD*?!U(rX2qJa_Tdubp>!awNfdr%A|a7X>vUdMlE0cs7y^i$$&X4RT)n z4XLwA@0->s@ME^-IK9UbKMQWh6X>d+VEXwgpkeW3Bz)v-V#i`oYk$+6meY#am=1w3 zzk=#LHXtZXRxOj_PQ6XY|BO(rrk>oTdYB=7^(eg`G3xwc3nT4)RiIVJh%8lB)l{O# zrwFm-ReKaToA3G-e`b>wF=TcBNSU@d#67$J&L$3knYi*@TVJ7*-7@k4oaF$1-5yo+ z9iPk}IWo1IsUHNC%uMa_r%y`XN5K0LyC#YiQ=HwV-=i*E_g z((b>nGOiZ4KPBY1t~w`PA>7o+v4`rdr>MkN(pwd|F6b@n``wOhM-uqEvSuX&F*v6FE1Qls1%@yzx(p@ zuL=5|qK(slm|1No?K4r0SIyLat4D$D9W6GpORs-6nro_iW8v#|$!d&LCA>Ue`w^x4 zeUX%kw-(?g2Tf~v@~52VkVu8UvsQ{bd6sHr9M;N{mOIPM4qE_Mxy5t^>vH^>4O($O4vhwNrEae@Uy^2?}sK7V%=+Ns4qJ8@7cTU8V`={B7W39 zW$kE|jt1>gig+S-yp0-ER{+wlfrTF2xV;&8fN7Y$CO3nKdK65`p=p&qkA z8JwE#uR2pLWOQBN?y=#C_hZNSHBG!TO~gZVDdYL`-aLJB#q(|{#u}l5(D*C-GgT-l zO9tHS{wbYymGJ0UK!F{Imf&_;s!*?HKocG+$S9RzeQ9R%?*Z8fjV_)NT+Xvj5Xz*tHNRz<@YGA9l@7Sk zPphAkucS||88Y-I`c+fG7V2a;E#({9nKR65mdt;T2JY8VPrQ9?cKO+gqJ(}?UNUVC zv|QBuMP)#FY5}CRXJ`A5zV*DA8B=*zZ_N1ps~)AK6o21`hcKG$WcllreKEs_o zJ20>9D|f1d}Zg6=f)`6zUq5ckLYtD;_an_e z-8_aCm{x+%o}abH;+RxZRBt-IS;_U>Dq^^;?G+F7Ea1B^qErVOk>ue{ZnanFn8Z6Q zWtx<{dQmN0MP$*z7)3JDWIXPrhwD6;f#bM*k|b@nD{ea-i?T!+OSZUB zU7VY=wfL%3Hf+QS=(#2(?#;61UDgWcDT?D+ANkAesuyb>Er0Nf4VU6She~^~_bPmt zrZt1xc#2}7!8ULa8MQfI0`7?*+BpsdS%p}A;-(SV^yS*8&u9G4uxtXpm83{Ew9tTOqA{@uV$T|$2-!Hv5SrC8@G|)>4ELPk-H1w>JmX#2eL8=pI==<+Y zJb_haip3f{L@@qbJD6_JLTc<9+G^M(mnp=Z^cWAZlm*%Cv4|>q@I=B`@g}*Y4XEw6 zCQ8>clnpy{%vXn=dkd9VDrm~s)C>Hrz2{x@dlT{_D;FMvM%1S9b8tXKdid`BobK%K z5&c@pi5cx&K(E$XJLc8cLrd=?j(gJd!|sm)>u`8}i*01MdGopd;#v5MjX$+$tt_$a z=6HhoFz|jy{F1lf7}j@-LS|k_bhI>3r5;YWv>PjQwrJnjb+ss8*mbCDv1$EB@Um&O ztN$yy)ZN*%{v+_%##+_?6-ad@wz0oOu)1i~{pEz8<&9lOi^mOX+_swDVwvZE$ju5s z2`r}nipNtKF?*!{zYC-2J*=t!nuysWo-+C`iTUU~ys7`1h}olHC-yG-253_oOxBP?sa# zm<099zkAmt&;0guPepOR!l%huBVTFV?t5?LHyOEx>94)F{x`~Tn!XBsO*)2MleEvQ zXT~`A$VEZ5vqR1{l{}bz-g}s(43=db0j;L>LaVke_Z+ESoR7Kk#W{5wF52Q1Fw+O% zq&m!e-iqUU1>nj6t+FhNydUyb2|Gsonaw8nOUGIP2|9{v<06#8=l+3Kd=hRmnzu%veYwnZQR#FW@Aq@q|<7YLdyQ9SlZcW8zY5=OF+H2JII)1Zz8Lk~1JOq`9{PC&4$E|X$_ z+`?b&@wCh7Zx);yomSYb;^8tYw$=<0r7=)Ld=xo}H8c8?`4-cF?!Iz#MJJzh!Kx2F z5c|F4P^z1TsVJ|To4(ZQ1#;!mu~jD#Ca<|e81)uz?=u=8%e;z4pu=H&)z&Gw zDdZ~7evIZu{7TNKO_7jbVAfdF#vXO>UVnNPUp}OlaLwM>UU_0`%6+h(5U?MuEgMb7MJijUm!62 z>a2qW?}`zx(IHlcmF+$D)2h$2KhSNbez0Vb1L-%W1RkaA9HE8vlhNdJ{}z}OgdXI` zppQpyZ#3;5tn?U z-iYp8U01oAw@wE`+mh~Nt4k8+dnyx^og#MAI$_67&>rzBIOkiF$CiR_M$65OX^<1@xvy~7zy8P{LJYG$0>{i6zF4B{(S z<&Ql^deufqaOS{vI*R94EKAHAafb%iL6+(buzBVAFN%mARcB;6?LFqbkbEc1aJ-7R z;dCjXnwP79&TRg8_GyFWg}#%VfJ#dhrB{gNIojX>in)Ov2R1iwr5#tif3{*KaCH_?tHBO=`nVKTNv21eyY>|M|7%NvT6NC z5VL8ussAhfzx7h|7QPa-jQ=HJZQ(0j``;2I7QSz5|64-G!dI&Hza{uBeBS|w#r}7M zr-iRf?SD%USX{rU{eO#=yN0sbNUAy7g|zYQ%h}_R{MB>ndPb_SdQRo`W16ivv63`M zv#iUyMm=gr&8+3_U_%t4yFuxunpezyoU9msGY@L0EOjYZD`BdD-ziB?T#0a>wZ}m- zMXFZxLuhH0FAv6X_)(*xFk+bNh?c2}h9t15C-Df`+6~VG<+Z~_BnfyP#n?+p3zJ0jwrR2VfvDKyD7stMR(`3x;uPZ|jLb|U z%BBIqJOtO6NE=yWhTqd8DT(uj?q6~6>>nz2>1|7Ruluy^F#Arwo5F)gH!d*30Jl)mG~hA>?YcGWT!;`u273CC+*TzR(*-+i>K{Q z@nV<-e-wh4zOijMuJUPyfQSW%0KdVvP(tu%Ulh05a?&$UYwhwIFT6!lqlElc>U2@8iv{7wTU*{6_u6KkCjDCbmt<)^PbY zub~B7b1Dp4XwFtZzOf#OG?x#~4$BR1SXZk2m_PFTL z;AGk*_Q&}2Bio8QevuE+$1#U_6LT#5b6QGw?#FLObZ?Q3Gg>sn;Yoo%^<~3eDm{N$ zEp{#&qh@KVl<+9BWIW%ZEDY!l(za!P=WY6^sei|pTeb*_;-jfLqt-*N*N>rjH`05I zFMQ@)@|pH4Cgw6hywT)pZX?;EP!UMe3)~`~kboR^yx-ALxP#Ue5A~-85qQxh|FFfK z79O0;I(p$;`Pq35$G<0M8Yc?z0kVg7t))S`h7+BU9IDQzF6I_{_-Ex7^=#)W&BzH&4MBDka|xYiV41<_h< z;&~R9I$mvdSq)p`GYSnM=H-b#a&(7D2N1QU{2oGTV1&nsFP*(0JM6*gAYwJ(=tZ(*c27Ozlijz0jNdZ2#(A2L57G!yhVwVBQBF~(BynO! zsgmqMLR8c&4?cl=b{hH?!bt?E=6R!s+gq8FryjAoqHBxYVHT|E^!Zu9$1*#EvSMOp z=kwoWc>>oODp8X=drun!nYPh{nwu?KG9b{>dH1WcrU7#t&(^Yyy`N{oi!)^#u*H3^ zpG&I~Ckals_yX5wvvjo?Gs2YtGP@He9xGQAhieljLe97NUUg@FQk+yf=Zv)grZNCq zD$vgMe6T8*#^ZgAWRv=ng{Q9ly>B=hKCq{+kn!_YCRy;SjK?g}%aHW~u^c@4 z^`+pd-nvUC&5hVsf!g^TzSz2;qYg$6n>K6SB!MQk+<;rdj!D$lR2N?b5c4xm-8lCi z(b)^U-@WgX6N#}8*?qXoeO3~fdorAo;;F9WDDi0JG+wLqBb-#ohXZ9FZ@f9_?^f!Y znjIH2s~tnKRBTNnp3>JGVJQ{0hV`03a4)P@qLOzWW_rBFqA?Mahim=y;$lrzkY=4S zC(~deuB5hcle=O3O;oK#K-d)Yo*wVh#dpY))!X-b)ir*=%#&%9 z1JC=^Rc(jK`LD3{Z=!2-&+&$u_*z}xv$D$}qd?A3vp&{|QPFXehCs8KoMg!xOu}Bs z;h0)Wr25euKBw+>Thja@S=hm~q)df(Y-%VN4lZFU(^qm{Vcn|Iy6V#p5;vrb$y z%sfoeoOQeD6y2G>_q1K)Y)aNXzsppl2Exj8!FtSYDul04T|!VFCHSW~5XIEi3rFlm z`Uc>7z5=n7+5AaKM;u;E*g&yM`;lS?w-eAG0PP_>>Bc)*fiQss08w~xrmAN-I6JIc z{sE@2ZtNtREkp{sXCkOI0I>Xx3Hiq;58Jfs#SxNXmtipNnBJ%^I%fS*eRS0UW;sVagS6+6>obLRrhr#p2y z?;Y5@+aj>DgpSXxElaME<4z2wUH+{oGQMkF=1Co@BLTzfqO;odHUfd!5Z%{%j92qa zB@)0(_DU4T4!#mRRI`l-Ft0|t}8Nd_pthAABmHz{P;-kH%%!6z}0KpG5Mp-IeOPc0RM& zu=vK4F$&O8-%&gSgMLPI}Q|^cpJo55Bq_ZmhH!UfN(4W?8w^@{&OIn zWnjWSr!(u#t8p2Y1vhKZaB5OUPH4KV2-e%^sm7zerXBT3O*(CvFp7%sH$`>0?|j-C zmKL9Wvn9+ZzVkOX6jS6*_<04qK;HBFK0^EZ+jGhnXpB=Q;f18+u}_a}rjk8V@en<~ z(6|bYJsfj*$NX1@b9Rc&Q0w`mYZ0N zCMrkZ)ue4V?{g9?3a4l+7Q1TIm@!k(6-3qPvibZjt|mb)OQj{qT})c2HSN@I;R_U@ zxai8LIttaxILq2>jYFJaE6DHtsa}d^jpj-(uW7i5qU4Z2fZf6HiB#B4MsS8wy=>pc zDkBGw8n`KLG$@9Ql;1yyD)^67CD%2xeX#J2Fk~e+u1D}opDJI*Wht+8Yi<70cInUiZqQi zp|=Uc^3-HM0bNNyD=?MmEoLPirp+b{_k45MI--EbvCM#b5&#OPBXEzl zGwvnSbBx828iON1p&(}{M`&>d!pzR0nCVof+>%p_0guj{+*ZQ|02u)aQyc)7Ul+UO ziSi_Sh1`!%LRaPV#(r4#Y-x-}q7HiDJrgiYZ{hQ9Um@`9`pUbBth zoKv&Bku$O)A`b$AAE)Su zu<@V23HeF9QL-RbXt}N3GQsPLaG%xZThi6G;le#;6<8tM@^;|&V?@vZjz+} z4ghD=dcMC&cG<2ke`-_{UTf6+tAQsH>^>;na$&+A@29Y^!)Mrh#3eNJ7T)TT$yFgsL=cx5Wpcpn)@)ekq zaW`rm0fVaKc9vvg?QQ`2KOey6!!1klT;X#kUHU38F)iv3!7^j*9~&-{mVdebF#yn^ z|DY?3|DZAO|8WO2!Qg-UyVdlM`|!!KKkhRxbmG-uYtHa7 zib}fpOqIZ5o|^J1xV=#5HL0`IcYMn{s)|#o*t$G+<{v7u8}Ba^IK>IYCGFC!6WTI| zc;Bq2e1PEFPF4|ro}9e|CQ-$XSZ6b9;QA5G=yM^Q2(w zOLQ0QlY;#(ab5ic1wk_7h@*Wfk;-SzxPQo2j~>0VZJ>TyPNhDbA{0y$K&sw8;|-TA zX^2yMve#5Yo@}n0bjo{=qGCsScdtoU zhMb3WaeJ@nX@T3cH^#vGjeeh)k^vXS#e;17ZI2Cp>K z=n4u?hx0);=0M3A=qQi*>7i0Gr!$Xv{ojB-@-X^3Ck$Bo3YQg4O&i(ha|kPCfL)Zm zV|Vw)l-JkjyKIhUImKJyk|C~k0UzKV;WpSe4<;I|-Mt=)+&su@dbjZbh>%2cO#Wu^ z#`h0W$qZw5J_e1Vf@(2tXN!CY%~QM;+>S=!wmez&8O|dpIk6?_ead8NZHh!1$Rx&zgJM$8WSaS($^956gyOeJmrBXdkMeBLeA`|Cf1h8||E4@fur8r8B#&6w~DzDW7 z%y{%1aUh?8!GprrRAHbdsyCIb>oY^o2Z(iL^{SRx_6^di^2t`IpQ{UzHKg)2lyC%? zEm~EQ^QSOjAkw;F#nO4uVRKyiYN_u8uhpb?l@bikKmB9&8k)p}K{;SCg`L7A%D|77 z!d9}^XHidY3(yolA@q&SSu-Hg03+uum~&-)fhc9A1pjYPZnIZ<^0{w$^-8ZOfp+Ba z>%oZDU#s~PJ2WP)#tcc4R`Bb+05(uV9GX^=w|5vpph}}B4d~UaroMMl*%cEZ!EWCk z8Sb9Ze$?Fo!hy@G6rg9<(McorPe^=~;K+=MaYFv^=7H~Ti_iES`S@Rx_@>LaS4=Sc zGy8izJncD`f^O}BtxkzU{st;gkHH*;iT};dd_+a*r?se2xo~u)0(C-O=-kIR5nS>& z-fdnlKRX_Y5&&mZ7)CtCR;A(adTE&mOyX9^@qZ-s;r|d3#{fzl_uo98ll7x~a|z7f zDDb~Y&dz>(%KEuf7R}o8<=U2|zz5LL9suUS(Vr7LD((8L4gUb~eAyvyTC(MgkFDMl zpT2)5`$i{9Kya>E^{?qH?-rB1#>5>D70g|?a~H#JMS)n7{qUW@7r> z#wjWW^MI+b{}NH_>G*N1nR;Sx8oblQFtU8*2g5({`2R+@A1b6l9gJD_$O4w@4y-gN1tmb<7R>hE{B}zv`GpUUvT3q zj67@EDhVyB6#e}OoXjtv^`+LU6(n7CU3_R@PvBL@?f&a!qT*k(pUt&)$*kqf^I+~e za<@={liYlwIH5mV3)G%6p#ls18`6b<-r4+k>cJ8r)?- z^SJs&c)AOnG#-DN4!lDvOTP5`03^VZjME4{+yjgAnL ze*Kw{@q1nt(d!^RVn*w4e+6mumfJl|>q^r<8n1jONu^ev}F<<}>=(IO2y85jAV37NAz=MlwfThePmLQ_&%%+t_=!Gi( z&24;jDfY0bO~bwQsmwRYL_b=ckZv&(xnI>#r7;?k@4)wp>Ga!ah4x%a#?6@MoPS)- z7FWCR2H&ARGEW^9pChEGhEjZ!yqYj=MfDX#=>e-*9sM`4(ZGX^CoW`g`)#df>H>@J z#O}eP-qEvq+fLT*kBU+TJM$#_#Sa|X7T5R}>$4^Q&T4#DuqmGv6F`%otJ-FrSiWlC zE%UbNo5Rd^2_s++`IBYI0SB>%`Wl9b6|4Y0?D5HvngdhBTKd8y3_$WlFK6 zNx&7)EQs4+#^aBMvb{-`c7I{7rO9yF_~|pGThBdiRIu{Et~fbhd5)8Y+M#JMGjuIL zX*nqOK@htq(vSgzEMK#i*LRW#pEV@bQN5blrs2If+H#%VN_AL-QXj#f?zWlM>_eRR z-FT&iuOQ!@8xK9Zwo8Wu@&!k4o70WNY{`Xei0_U9!FVENF{h}mu}?YT)Wm;lU>f99 zj&QSfz!A_jZm6ooBroP{*8?LCb9bG_pGElsb+6%GnG?2iVIfR?PYCIA6o6th+l^(`=+8 zTG5LWmTZZmgTvJTJZXx1ccSOcqlKCCjW2LQiWK?a`xCtGp?@Ar?lekya#qihsY+8v zKKq#rf8O^)IFD)_|B~*`c)r)D<}w3b_R3CXDr4iqCoz0ETKlG3lVj|xQw0grkUfl{ z{*`f9S5|lH4q@J49G};2A0v4d;KV`%t;})2C~^bCr1&#Pup6mB^#@U&jD$Vh3xz*K zQ(;waDSO8+-$XQV~a>P_T?^TsY~dX zxt$Jb%w+l;yFLs43=*jpT3QE&Y7OSk$WZb&*$P`e=*}swoF(>jqj5ZY*}&l&-Aw&o zVRH7B>Fp{lEK|1M{Q2bVuhLyvgW`Q2IwMvekSn#=HI?~EPt4oOu&v9C;p!mLj0UmE zl||MF6HWze4(=81z1ybT)FRDYDF!W`J6;FKT2ui^cd@^$fTX+FJOjtxn1dMyK}9n| z3y4&A#o8qIoXaj`N2r0mp=}Zd@e(k`0w(w*vFzyGr znRC{+y;CA*EA#wC<3>dqLHT;$nfYnZ*wJ3pBtXd1BS-^v%%8j@?N*v@AlOn<$+ z?lwB67NY#($W3TlLt#jc7Lgul>jp|cC884AmVbdRv<)K{vOy+}sFjFIwm%V2%KI)> zj0qU-yNz~SzhjK36QmfM2oG626tbnvk9|1X94Y_yU7qrbiV3wrlT_d)8QaRAlBi2i zzrs?InFFN?u)DFzqN<4{x@wUL!#tYdZo?l^C)8ZurN3STIA_%u@w~h!;)S+G>~OEddQ2WdpbN_tlIA$FpxC*n${H4)ICuO>+5uae~WEUjMt zKBcP!25B+*2Kj+le!l+2vw%)(64U11Hbx^Ui?V?f-JN|_@h>*wP^L-5aV8{;;!!qR z8xmNiK~!|g+2fFD(NY3cu`0K(dZk4S(}L;8h8WQihQQX^AL~LPY|fyNH`z3P;8HF< zA^`tUZAk1X{R_q;*_RwN%e@_Py7Po;Ao3p~4AyDLkssD3k{{+eU@ zAzh^OBw?)ZazaW;0`y2n{)kusIuN5N2pZZ3EQ&p)@W|IGP^C;SS&EuFp~@(cGc1u@dxRTHbrN1ipU7^d%tS#sFW0kQ3lzl-iFW#0dzadEVF;%U zs&A4HZJ9yVx6ktJ#Ljoq&KLw=yh@5x%pSN>w2sE#@I#IX?zomMrbX2WTHk(u@X1wd zc`5B|=he|t+C6ezdJg0~j0kCIH-Vq}ne{Jd1=Bx?N;ZB0FGo5k?Pbk6F%8_xa?@xbH?>c&k|=Uy zf|3W?!GX#$Ptv7EnaViiNR2Aa8s*()AF{Pn$RM6cY<&4pm1$U=0HiWkiq?=SlBsXh zg=R(7FVH9MQl>Hx)?yZ${_ccl$&ducpjod4yZCG-gZzK46n?S0#_q^z9AdJJmqS=g9jAhbp00 zq2h~MpRP`jFYiMARqqSO>jm*9vCqUovuOclbH&P3qX#oE9*VkeckJbI_E&(a=->Vi znD*mbK?p~FW~F6XqXu>e!S*1=r;C;fM{VqfM>4ygu1E+5`fXap@&nR zWm;6~*qOt6W6gsu>lxZ^V4$8H*u)*R&I%cDdy-y7P@?}~qF^iU+7f279(sGOqp z_kpaFZ#F-v^M$PMZZ_W_*ZVc0d@2}_+_y96QzvR>^NJIYv}h9n$T~IQ!kT>KgZaLA zO4CM8TDSQ=m-rEXQWGhNRsHl9B7Df3r+2K)m-NU9U{-^y2ZS^y67ru~i3R6ggW;`+qSZ+_f^y~2E zNnAZN0yZDuAGvzRa2i^4Vg)=>0sNFV54%FB7bmUqKv}ebLUv5BLyo@$7D22 z%;0b$?XV2%e)_Ns<4&LB!cOjDA}FxqPk`Y6AvTa{tVPu%undI?BE9#?3^a89@_p0T z+B!e5-jC_CLb3;6*~= zAJGF}6Q>W(;x$a2{>N2zsC3me{7@45+i)Ys^>;bnTgJ7_Mst@1F@}wjMrjeA@+pHxvckTU8gtE zVA2c}TM%YBb_ccf^35rAues>%KPGId#I3Nh1lAPjNjb)<6;t}<1gfrZwOXXjNt=cyy+8V3<`Z7( z>cm*&d$tJ71rAT5=`(9%VD^!@r!0DfY74$~(c$>b$RV_lO2;XOgcmdGsSv3({S;L5 zGN4mGNfKC%4g&Ub$-~M{eI0Vz*MlKhHD+M*^{<|OS~o$~C?ev+Czq+>JdMeuTj~%V|1QJeZIxtg z<=rOnu`uqt8h4__FMdL>sE62(HocD-x6h+C^4tY*|4R3LUUVy(p!ZpQQ+p51^!zHu zQ^5W)VOyMF*IVW1i0Y@L-k+)-6sQv(t`@%mvlo!4lwL_94HK}~HR4nG7AVQY!sf24RCTlZE=cU(A5Kb9sYKXj=#Q~8murirfY#)z(awsI@B|N zFuHFRYxM31{X$V&?)xqGM=I7AWOwo*E&V5u zTe16bo|}@N3qm(|J>1{eF#bmn^>Amg{YSVMt0rCdTugio+`G_W8uEV!eQy=?Pxj9L zJ;8>>yns95U-9_Qv+G~+KM%0S$^Nu8kX2N~Dk5f%fB0HDU_thfj5L6@1G0J%LDv$q z#y@-`ov|Q$N|qczI|f<3im+&j*~6L2i2gr|Ej7HT7Rrae;vtMtneH3lyb-mX$~>8q z_i?K?YLhg%bO+}uz&5o)k`kWAsyne3q92?-4_ka5TycY}R2gh7i2A+$eCE3L+drZbJoG zz4d=l_KiWB{7aY9nzn7*Hm7adwmoedPusR_+qOMzTRV66Zp0gL{}Fq)KK&x}T<>`Ri^yW4Rnw-gYwef!N{J0rTTI*OskpQ* zQu*(}`L04Y$8hb?1tIqO#P@uTlqTuaAm7)r_kx`HNmt2Mmdx?zFUVAu&=Wn$$@S!Z z;gp$KHOeh34LO41kJn2JxuKq~e5v1IUVkNL?DQ(WN~!C*a@-j+(n9pZN%oywZ`%GQ z-p2)8YpnDBq+@Ld|&|BVwP`ID6G!r_HijAgpDE()EY9)POzYo!F$y|1m zg9=N{fj-K(gmHm>APLK%)W*V%+E2K)E`*bb)et z-QR%`g0!d%V8+!3ld0(e7p_Aji2SIyCZD2ug7(5+%~btGQLU9wmb5;>o^t}3E9r3A zu+~?N8;F^$q4=hJN9HU*Jb^7rV<57M)92S#U`kPhS;a1}?r8|FOJXNPqdADYPT;4P z4^B2yY6Yj(IxA5R(I$87eavy^IQ)nUF1Rytn~kTMAnkhmC~7Xe*9YH}<2PlHLxxrE zWbIWJGB)UP0*ktGjLAV-vj-9hYYj&E644{1q*$8BlZSU+`$-(@^88@jS4Z%w2JQ$4d@>QpzPah_#|A%Bam91V~# zVSefE>;mpB@$HEVQ1-r_rDeuFs>lnYL5}B&Qs2tHbk_fN0P*D5l{{vwXy2a~4uvKI zSVesMyHg!_UbBqCMhMya;2J(>*U0)b1S0EWpf!b zENVHlP2fCCvG+iAA~?g}wWHxvt%v0$OeF?q?mXt~tGHIPH6FI#e)U>2Y@dzfHWfC0 z`i&&K3Y`TdhSTl09nYsPum53~($^NvUN9FeSzR8A8WGG+z0cB!q?BwidVqo*HlbxX@6gwLe0RzFmPCPtN^vWLgCIs|y zhL%dsHc<4k1dI#}Q1qe}j!w=5oJ@a@(k8ZM&gKM6%p42^|NHvaU2A6(M*@0LYXfH! zVG|=eV-qMoKB#{`wp1sA^jCC3%b) z(CajzrVwgy$-&mY-VE7z5D9>a0T?wY50IPw)9Uv0EkpS z#au7vJ2G_TQYZ+rPgTTXZxe?MbS_wCW&n-e42m&kOgzA8C>m7ZTXkCS!+Q*?5G`sR z?T!hDd8+J4WelzU4ac7;;{Yg9JK-M4;a<)hN)nPKHKSfmjI;EGTsgqsO0^h6ly$_&PiQP$=M8FdXzwji zhY0F5Y2W!Pr=j#v?q+4uf<^i6^zU>IZ?2-C^aSJ;`K6V1mP#9o3Pq(-RBBkfJhpGg zquEhRRmf;qy=u4o7u(<4j|mNCzzssW=_%> z^lu3h;D7aQ|7@$y4|^VpK10|4=F{r*_;iH&v!|OQmh-LEZoqA)>gF24zEH#lw2Mw5 zH@Ke`N!X@JbZI946-B-fGESNRlY=h?49ZNz$dU=pA|%l<0@KIeDiT=CLUOJ!$_N0N zS}NcGr7G(O#usT7G#_I$J~E)}6x3!u(C+~;hP6ejHIC^2=NVDQi1XOfg?J(0F+j>B zFBM^{(Xd|?JnEtq>l06QSh3CSjIBnKfF3J=Sug_?3xxkqJSS8pX}(ILLcs~AXpUB7 zc14)EauChnle!l62#cU>8%E>Lv1r5b?4n*ZB6O?~mcFxibU_ycKv6$3p`4?ch7FEV zwjX5OuQ(0JP77xGmz?+;2UKWFmY=-XBb0Py@FHI>PxY97Jde2vL4% z`r82g3d*p9Et6rhp#^Yvj*Z`)}*2~ND5e-YfwB;@XqLK&nEM8!#Ac=CjqjQq)8Zyb{U?2cCs%s-NT3!6PGZ3ky!Jqg}y7 z0@R)W_~i=l>g_l?%{*dHMETfUJo{!=Veq6x_~*BQk@uHOyFhuRBK?W|$lrOTTbkeg zXWQwt{0x@fjvfwA&LAWP-j3gb>iip>8zJcUa#x2BI~hxFc&T>NEoylzIRnT!{Yyg| z6Ae>K^Ew)MyxX0g-fsg#9ktS$28kD2+0tQtsncVpr0RYk*Q4llI(rA(pN`_&AL}|+ zJy-U>PpsUEe2#pQe5O9jKi6L^PD-+JTs+SomQSk|v`Si@A3ooUe0v_QQ@%duUz4V5 zoPCP!sk8J>KO|4oxO>)Lm!@l6eVXnovh*%LEKk(jK6G)^U?V-&i+`iTGxoMMBZ_41 zc0u*y8sz<52-2CCMzm}-sxpd$u9s>!F`5nG=pYU;n>@i#h$$q=S$qM9Duo8MX~m5B zlchjJiB|C`x1i3m0JDOerQ6y=)CsmIUJb;1t@pvR7M7)P znc5q2uX3({^Y80?)Fnl1VCI6d5cj=zC@G5{APYjH{WjuecR1)(y2P9$rA|6egG5DK zQGfmn6$)8-gNWDqbR&kI@un2oZ z=dEO?QPbTyrR}x^2;+EVCK!Mz^GhidfJm9s-GMPCw8cQ&_$?tTip$`{8qSWDI9k&g zL$2rFnJ`=5wY5k32YE(9zW(dqm|Namb6a+ItXrS-eP5RLmt?Ju(Du&*PWkd&JcRa7qp7r1$-B)r!62|l7=2rvFGU3`uD z-Yo}8M+kA3OT#n3JCaHt=6B?gd*pg{O&C6zuI7y0{TM!9r$@e<7~YEoJEL->*AV!h z$9D_#6Tr%;UtPbL2-^se^R-4n)pfggH?%{z;pKc_;C-0VE^Fhb#e*Z&2@f#*}mVLqJgNM=g8uLzu8BJ zg~A>auXpvi>(BgZ?DmkC88PQosAW`C4hWQ9%cmZPsA`FyCs>Vop$(Jx)i|ay_|*y| zfFRkayZh)ve_IKu=f0WPx-0w7Fi#l_=|68mlqcjUIt{|3jD z9Nzd(^2WjPKgrv_$r&RvGvj|t&Mr01Z8z9ZzOGAV8T1=M!x77V2cX*9kn5z7rWLwE z&I`$#aG_aBm6MQ9gmk@&$Jdi;bhC-B=RqLo3TL0Y!Np2Yh#$g3$%_djD+5tNn70$X zEG(Cx&64Ucfo+E^5pJc_DBe{oN{ja*T!FrQSAuc6)Dh4p|LJko6f2oUFh(^m{t0F# zTu9*E7}t*p)pFUr#OuO!owY(6jzne*KAq_pxak|$V|auHTp9o=4Qr9u10|D7pfoE} z55e?gIh|hn!BSF;e90m+3k!llLGJRdixhIWVU^!%jn)6F+mVW*97b7$>@!?H<*>Y^ zjiR2)ym!$gFhcQWmLLvFVSmwSVRFK>EW<@u25^Uo^EPIb*+w~Sddn@5^rsMi&?vK2 zAqtruIzP^uz!CzYtXJ8@5Z(`g_)Y0c5NK9DXz0T0VCK~fQ4*;RW~~$%5`ErlFxHkU zydJ<~9jL5#Dsz=jGCI6qNSQ{^FU0l|>f|40J%9eYf{R>uhQ#^0YYe6#O;6p)#7*a2 zriQ)t5;+7t_t;0A0#9Rw%Sy$Bo69gmF3^6|b1gN2bi593Def`A9))yalL1v2jis$X z(sV4k0tgZ_BO0#*T2`CC1>sWAn2d%2^|LG+gz z81g)JgN7Z4W^}vh8SbH&`dHO96iYwgmcCk@<<-?3(#_gH$n5<%YObew6<2)Ev=wvH zVFOZxv-WU$Lp+2=_E_ZR7x4A00q?r8#{vdo5X&DS7N9PanhC(kwt;4Sb=hq1O&YND&v zSsbsey}dD0&^Pi=!c%z11tZ-{3h0ZC{Q(!d8b}Lwt=iBImV{%D%DmYdg7KGolK2E? zst4p~A{7a_!(QdkWQ5nf_Z~&L=#J-k_u0BKbjx$ST3{a*7>nZ%D$}&;YgVI_`qS(j zg}V`tAe!@TF8(-XlhjT0P~&8G1FVEUu&;z?o*XWp@LwU5y$$`2`qfcq#SQTX{$y}i zOi84*9?=;;eGfcrSM6C?MxP1$wnx$xHpsbKcjEj_%~78Z?9~Z!!}g}cR|8TSaYu2^ za|xU(LHuc?vT=>&q8VR03AFz1+w{M9dwYu`AU;&{k5cyM#``s6{5iuihY;JjMp7~1 z-MKN=g6J1OF(E+64}3m^LOGXGp8Z)-N&Cd3&@{W#qsh>nX_@z(qzXM?x73eZ0?3N5 z6@ly)?%|;54p20BsZ!rk@36P>!O^2rv5M{h^^Ff_uwU?o zYofuXet)RzXy@^JHjZamPuuHhNC$&gxkk4>Nbk~E;S$Q!=RHBRAZk1Cwj;x0()LYN zFV!|4^YbtsFy%`>b$!KFELcj_>v!BxB=~mt!@vBj;zoy7)eQ`)K^<9ryqQPiSj|xF z_Xoj)2`qt%iIjD$XKYo%#JM;yJIfmiQ%}yx$ubR@X)kPIUf~ZVwn$nq8m>`uW^)|1 zU&$>^=!l5pWCY?#hyrix=sNCp*gI`3}ng~22j5x6n` z+_5C#AR|TK9CH~WV6-ksgGV( zz~fvBF`BwRE9-+16V5(g)3{3E1|tm`mK4ah9*zU8_k4KH!(mT0e%D8KXvhJh@0pWP z_YZ2n<`&gSrGo+wHtts+pO1-;5n^btz}5R#(Yvs%@1P#rBcPw|!-+E98)Bb8sh97f z48g3Kjqjyv_Qgu34vEF7b`eJ0EG9a5a=U5G;gjP+X%NNUYvz}O!GzE@MRy1E$?^T0 zu?PfaSXeEVN9*>yp&r#B&bHc*7oi%*Kq?1uqibN8SMDJ*#s0|od(B`8d5ABW8d*mY z8Z3?o><0&fEi?^NP?(~Y<2OQ^?0b{V7Atxv8zwx?(X{N;<*MBT1~AH+F!J>nq2K1~ zaM02$WZhH1JFH|t7!pG17ix&nnuUX6Z4}9lMUB12c1An;BL;N6B{ateWLBZqzK1CBCV7F^p;&R}5As<}by;7C}zh{&w1FMS&q#wum#FrhmwMXhpP#IqiQ* zRCqrxY_yDQ#rXGZnyJI^$~48<=m@hrY)ANCW<}IT^fU&LYBV9SR^&HJ8c{YECnl8| z(Og!sA}S{Z0hv(dyiGobUfEEYK(G|OkZFV@bSdLzxVvWz`(h`l1@%njDZfp8zq@oo zz{Il~!W4cA+#3}B?fRKdQ6rywwSMwJ>-xBXOslY<+_xop6>AV_&#F6$)s zxHID$bIh-oEk^!VdA#1$x*i!ZP%LgplU2M=hTR`^d(}{X%P?cuUzNr32R2}XPn&*6 z_;9ody%#L3lz=?KbL|eS?aID8Cb;7$D?8mi0T21M46$=m#-(#eo@aznQ2<=DSyZ$m zh0Zi14CjQ$Tml#aV(P}G#q@o3B46%f_KqvWf;gO0@!tXwB8e{ZKkkn5=J*6sTrlG9 z*B1N^!HGC?ys1e{K4IcFp`Wiq4nyJbyG(-E1KBh1FkzDKhJ91qpYP+|;bC%3uFyN9qmXJ`i^#S~NMpw$ztC*M znVDLK1Al`im`Fqo5~RY(q|QCvUSF%!Z!e?ecj05C84a;QDop z(d+}P?<1?rtWdJ^oQr=-xqlyLhG%wkN-)eWSBoApj7LU6Yg zW@^0?KQsU*gVRo|!_BpXY<2};wZA>qPll|i0jXI>pBt+NH7+DC`H8rS;s zG#GvgbRwu(9j*)THjx>SZ8f!GUKUuw)YaH4wLn&G%1^3G{>1dyuU=3t+-iaYtL&f| zCm9{{xtx5!xfivO?hOjTmDB#KpGl@FjWXK{1T)!56{v!3W{Ocnr-uo1-{Jbwqx$o& zS{-R6lLL!1v5d{7Ke7W$Tk~G?3*Di3yGMr3c>)7-)qy`$A*MaL!^4ZcoV@M}br+;* z0gkYxMX=FFRLSCCpj`FkJjs#uy6l7CJWeb>Zb(EmAT-0KiHvlX(}~+7KV<0oot2th zh|W)yocrRCMp+$_+Fhf+YnEC-{K+^$ zIP7to{qRk%>2zml{3DcsZ^9DMrVM}__%)hI&sAqj12HXBtl+7Fx^T2$&p+yU(Hwi! z3}koD^uc4&me*j%l^yjvmv;n&WuY10lqEPK`X2K$W-*(?kZGOsHo@}Y1ILYxEiu?S zlDOK|uXK|p?{T;~_X&AE_aw`c8~dT;JcHU!9m zEQW)xg_jDPB2Z!JV30cq3ag}y_KYbr{s@fdgD%DJ%ZmgmrE`RZ-AmbtplBOsk)!gW z8Yi&1IVt@9Fl+4EM9oy2uU3X023S` ztjnweQQKH?q1l%O1zAwT%qX`g8QZ~iX0sA@l}ER(%2{0$O{lXXo9A+7uM7_9ai3AT z>;!e1n`%xxJ^@|NZL822EC4Ytn&O$h&Xq_U zw{aS7zof}$muySFE}L*5?-1{Sy~I3*FYr5BW);zj+V*3W;4#n|yfyL(hlJ{<#VdEh za8PJB+;@D34N$Lt;2NwP|H(BN*_fFATdq;0er~tHhVY%;BQ)SAsB5H(^0>JSWO0B( z`<8y`gE8MPZ{3b&Dpf7aIuY`D-Ep9>JW!rt4S|3c+qrUmB|g6CxErg*YZ+=;S7?_grc$fR$;_i$znk1|TeBfq zZ=~2N3&>2?=FO1hN!!2|U`f*ukG)nt`b^B;cx`T=VWJE9t)^Y6dLKSJft$l1)rBKM!VQMSN|RnHE|)M#<9oVfG}4_GnpK)B2`Hd_PY7tydo;) z58)1Nt>tXsT(0L{Ddqxy9{apT6&2&A{dO?~n@}qVd*o)Qmgqt9v@s$bzzAnGRj1=*`(jDU)S zU(t1(VO%(4bh_gV@9~$P*9la)@WSDMJLYorheSU=E27U6v92P}y^*oEaA_~X=`2&+ zv7ZXIjIH;%h6WaU^a>$r9w6lBGj!{XxkT9K7qegM(QiwWr6f!Y9Zq?@J#Ae_me3zF zYd*AXfY?E>1eMLfd27+C=)r7jlYkC3B73|a%?E~Z<3VRaXvVY^WBD$ko-yKis19tg zV*xU%!Y?3UnK_W3kTtuRQtZObnT8Q&b53vjvmlTzf%h6#JGH3A)j?$~c$liw}`R&$t+?m!uYuS^-bGY)?8=1T$+ZwOQdzPu_$>fpoG}jz)a0~3TbKiof{kjdS9@m7Q`qG*+3}4n$ z{AJ>)EP3+lWbn02mA_igE9Ur|&`GBWqO|ULfI$8EA{U%R9(&>%CiR9&b8?&iH(S~i z-Zn!P_bJdPk}H-?u7T-IV`nCxw-3z5m~~uRsBvx^AJID+j(4i zBCOwf-QtI;)5AbG{{H(75P!y>94Sz{uBs@q88gAZ$ax#jix$7bQ{mrDv#X_J|AyxO zYV}EKR71i?Nj#H%`KV3zc<^w;vJ4p0M1-7vG#F*y;8(zf@naI5t5eo-Wd(9~h%7KV6I#=LBHWQwCoqLB|FtN@?A?EN|(Z!i5K5c%}LD_kjQw$fP7F{w7)d$-M zIAFU^OZiH`LZS(fYDdU_&p(VWZG-rVZ-}Gn$grq&+Fz@wumwYkD;KrEGJ#=h>CCA+O_WN9Rb(#JpzB4 z7Vh~Eq2Tz33Nahoe;{29&LPRLybd3Qwu47*GIT@q)#fPBAn*#V#erh%498 z_3vO|U|O4BLhNND%-zjmT+e?tLybcyv|$(r!gHY<#=_ZY@1fvUEukn# zd+fiRjjXQqvoWmBw1F)`@iNQU;44%G;22!u27SVa;-e+A^$fxhn)2fh7NbPaB2PYu z6s?WGNf4<;vAcZ%yX`tJERaB6lyUkwhn{%8&EiM26%Q?;{hBAW1EMav$wqL=l1%N8 zA)+Wv7d5ilp#8h&%+9js{3HZDXC06GyE=M{+uRQLO7qYp*yx@PyPHZs?bW!%Tv7!U z4A*ltO?E$n3>cY2IfZvTnfRZCrnI5TE?~qOC9=d}X`ICuU8^uEBN8P>v-?4)O%xR^ zbeY6Qi+pA%iSIiww$!u{$VwlX!2x!CP6N3j9y2k@?~O%1 zt)RxN7dt&8viGmXaBzDdJ#P-Y4f|FeDk^SokzEDOKwgN%>)q^d-KPc7VZJsc*o_=b zm4@n$rAo@PHu`iIfFwuG1DBmM8u^)&FZveK6aN`?EZ02D$bbTZbH-fyZMWV>Agl(C z8;U2yWFL}#;+pQGS+b<7vhc9ryQ#{^&x4KWq6%$f_*d0P-KP`Oa2{JX_v__b@XFHN z%*KZ!gMK)|-)(Xl)Bt{32I7^(9i*b0=~#OOnFBmNt4-NiWiroO_=uV>iZ2fQj~}0E zNc;cvq5mW1u>F5vj)Yx5148iiE2@(-oP$m53NdXFm10rzp(rN-uu5TVgza~?QRojH zxGEZx;puz!Yf>aoTF80In0~+c2(1!>=E-JExBl=Sp^9Ex!@nhplqxzv`gnPMd2Jit z3D9%>b=LOKG(`G8_=RlflO{qt3U+a|QBY$vd>PrvA164bhC`5DxOk9!@4x%2mV5*P zf%t=0SZ7|3HaG18TNrceL~vj+5U5cV%a*vEcgkn0&`s709Cq{~I|G;0>=M580mNU_iHJm^frs;sisZ7-!=Y>= zHI#JaKT{yGTV1*`YS3%(_EqaSrdab@xia!Xsm#9tu--~H%!N=%m_8;5@Mc_{KbCj! z>RfCj;GpkI2l;}GXXF%u>AM`rBb9~|LPRK>n~I;N$|4#!O+DGwzWdq z*uBxCI2y7Y-`&hOn(#F^9RAU{z5Tt897Lha`z2`_$3r(pcuEq9!~Ih3 zND@O`hAl6RVak>Jn@+ztviA8pBDCUjP#h9Hu;IVE^%%@}dD7s;o_saweB4Kv=uzV* zN$-=bZh#MsZwxg&@jqMe@wRCL`BQr63|U}I@l(2vFnfGMcPvc!MfFj;0`{<4<_D$r z#q;TRlLO2P9||Rjt4TZ_O)H+WECLy#nfXbd$wCFJIa^W7q}Nsr=@Z?>ukz=!hNm{a z3#?*A+^k_`gTJM8(tXV?rb2;B#A9zMj+h)u{8|8J&XQPl1d}3;Trp*PtpkTy0fc); z3UtV)7lk~4w2r`>Xcu}JZyDg{j;e)3W30jf{dKz6lC$QA!d3gs^;sA#1W7;{a;0_FIVDU*i~s}>IA_z1q3J#Ug!SRe}+(fVKk@;XYQe; zwT+20wHr7J4sJR((yFT>tS}IHi76*MMdh2LO8pTRHALkFMC}XZfP?%IGp85=&XE7! zr6n$PipqScEqOrXkoys29}{1_*67*ObWW$&)#2*1x2`eyl6CbNGmsLGbSo22RsOl$ zsF&h6FAT%s@0IN+FUCO%um=X)1MP<(Po3HWJ;Nj4T$|$g6XtU;^L5BGJh;FNSVv@J7pX>gH??Zu=;2pt%)sTwuQx*Gnp{ z;sck*wo&bBPc2nojHmDMaleWPe}5C)iwMs|L1xvHUMx)&SCdZcvDH-MIFUFfibL_| z?sV09EM_&;)X_%5jzE$M^88%Bj>nnrAm~_V+I~>c54QNCvh#p}l0*RvN5zoslK%p{}%!%2Y3Q$0dI!hEXK<_uFR*-PY5H)!9kb^7V zx$xDoGk4rJ?`f8Mo`~CzMB$@D{{~_SQ(gZDgkfa;PlRD+`nN0bzoM99|Du>7*B%j^ z?V%VO2aoC$BFaL*0IgF(NloQ4tHk; z9kNRDDSuKD)mN6mn>dx8)Gc1PDoyQZHW)klrtbuHo#-|VlrRIKc4f?#^zZI9sZyJg>#E-G%5ZU3Zvn92I!J zG6{?wyQu99b?c+j(yviHu}rw4NGQ_ffS%QxCvV93cBr%HNd6_7bMUl*QD*-X5YGP$ z2qP=UznSL$oAXbp+t_7tAbe%(^@*uc@nJ{VTxrp@sk$jT({I_yG!gAi<=599k#>E& zXVk$$V*?r`oVi3Iru2`~F!{4F>F+5%7-Prcgjt@1@Q?`GQZ8q@vk@goWq8;@@5Mf* zEB8&u!GTD}J05SoLz#~o!2{p)^S@Ib*W|9#?($Q^gcJ24?%lKnJUQ*&DhQ%JJLy@^!ak*_N8h@tRT)m_t4k}u zh9>xcGH)=*5z+GkK^nl+&|>};B>)@`-yDT{zk`hDd**F2w%bGRyEh2yZ#sw?Rz-dM zT_O2b8fe{r(D4q7BaMK#lk}=F24K6Vy`;2DMJk@;VkhdJu~|h7%qf)MJ`Cv!At6Qx z;)0Nfg~7MaM>jA?3-MPuvOCa?hC@@-w7BAY4u$sVxzxWHqB7unC+|90nXIrBt5NXx zm>W!2Hrhp=Efcnu?teg^Ek0i@(71To>Hlc+9z7o)MAm6=XsA8~jsjM6Kzy}`Bz89e z|M3gjR&A2rA-~FfLoJOJuV-w&zR{88wc36sKv5V(S8iY&g*bChf^9XFZR>Dq%QVLn z`+VkjSya=G>;2VQEj3ZU6^E}TgA{^;QIeLBBRHO1oQT*Y29ub{aA4nRyi7}&JQ6fq zg`*M@jQ|7>WTP+>e3{d^B*XA`&mUPNfbgy0J%Vb(*0o=iLJ(g6sP`s>7hj>w%6eG= zuq@-U=~^@01XkOPjn|4LL;m=~47qh|ei?`&B9>rxv=EbVSN@z;MH08BziYP_)6Hux}@#wPqS0UY@V?> zXa^~~vtq67WR4IVZZe5_DA1#?_oRKk#lG%7?YzQUIz@Stt<`pi97EQQ7Win}_xc8> zguvYa6epPFavD}bQOwGUcd~)~V5y4shCA#A`3-B(nT?xshl%u(Nmhgx+`QX zjk=MaRjO+&2B`y~fzkiyL?D9wWHD}|<+4HLAZ0QgQ6+4w>R)g5sTFOJbHkU~5@MMP zy96&te9Kz15o^-6oBO-e8AW~l@v?ZJ|C9|dLzPCt6A`-@Slf zns7#>2b>hZ@CZW|+U~-$m{Hj*6a7`f>>}k)*lI<|0+&ILq2%53cj5Cbs%)bo!nb?( zb9Fc)w9acrsl>!ayT7VQ͌HrQ~}scN4o#f|?I`_X1O4;y`H;YLwbMZ#8HW3g+m zHX)-L23htYRDo4)#ry6|?1}27h?6hF33O13j6r`DxaBo`(Kfc~MyU*ntfl7}4bD1G zVjD!2@*({#js=G3Y-Q`u4>|2@wo~0-^OkZo%z7i-;T={C;x&Y^H$r!(%#V)l;8R55 zNJrkx)X#V&laG2u&xlt%c9nsMRE8X7fZ9U|T$CDIDp#zFM~iVebL2fwup#g(P3?7a zl% z&pS}oI}WCkLG3?EXlaM<_exu&GCnen65ur5(CUE`986PUl3W%aQzvk$dx^aKC*V(q zbEV{7&MDrhaAWFQ{YLBrHK3fu0si%JvyUQi6V6$NvJE%L*4`iw{#8m3kGN`d%MdUY&VS&W2f&~-x}4lrgPp%P#C#X$LO+0E0g)>X4=P+VVyHow?I$NV zdqR98b3u6>GfWRAevvR)1TiMxf2XK|)e@h8x)&bL1za2CdQZumuO~i}YiEVr zHBn#03aygzj8Ee~JpeT%63o(dhGg(p?mdLg`vR#7ihch>0%H0n9|qHZ?}h8q)UvA> zM)R4e*+rDvSZHJBIlkCZEmuBml*oCirZG$aU8?H>BA4;?UeWIT)vFJ4LZLWm(%EhB zvYc*LWrC#tLJSm6VW@7)bnuhee!i2niB?5uC^Sf2dE z>o)n${!$^T%K(HpNRg~;`2kT(Yl1Mu5Tfqf&&nc=R3IKe>vX&FX(*x6%4xeW1Ykt- zsY72LNpWuR3uK~f_?(u;B75)376Z#gQCyVXKhNPSFhPSYP0BAOYRLTu_oB}XJpp-n) zm^BL`Bol?D3ZXn#qeUHyLz?9osSttE^M!Hzl5SObz23S!yNaF3@$Kxe>Y*SaA&Qvs zmm!gd|Fig`hr4>kLLrxpY3OFZuSb-)Wd)B$fA^#CnSFaW7$zx#0GNH!(Owuq#JP?H zVlxUO{c1Fwc>VZQGTl~x_WlqApZcR2bGd|Z#Do}XW z@6m-7YhRk?YgcngInQf0#tDD2+;=b+Q1;t2D(MfXHidfH$4h; zRSWAYPsdLBkvM)>>CF>@Ba01wE zH=>hyw9~M>=QHS-?JyizO*G|C##*iF;cnqQxA9WsC~@x&UYS5m`mCA`HITAbj8&2T zwDojEUz+Ip^r~&)*@^f&l+2iR;8}5i)@>~9!##@X|DBFE6@FB*+D)(535q&J8KRYwXZ!nrE(!(yOx{OZP z(FDamgf}p|sQ$b+?-A0f{pv@Gw+hsw_4AnTBk;n_cq>z<>-f`m_7?|@oP($l@3b)Y z_MOqtNt~e%=nbQ4#}}PUIbKy~*EbZHVZng2tz*+l({&@bn zriZ}(vNKT5~NO| zF%;UOPX)6bJL)tljNok{23l*jX&$b$U#70BUZncu>CvT2U%ai2^d_xHw4s;lqu_8jM z>42@Mw81PW$Q}$4zM7*syCFgmW_(H!oZ7zYl?3c=-XdX4)D-89OP#3X^5C^3Zuu++ zW1#ub2rTIkuie~QC$bW2$JPgzh!(2+@A=SM=;i$iwmx%~@cRX8j%lfz42pC?KgLv4 zvugFtndb_Ij?=5a^xUmq_oub26W*)S7kihSRp#1ORVB_P1#V`%C$t;3mq*~|7%?{+ z##>^8b+L=b2B9pOY&h_3U%(lpPf-40h6822NvT`H4}w+>j@gmS0xQN3dE|w_ zeEu3b^@j-Ek)o;6SzX2*E>qcsF@4c-HY}9|z6`%nqCOnwA|bbO~55Rf#q3Mt@wm)tG5y@EH#_7O@`znZN6&>n9ZYE5ob zxPaXR=ta64rk>sVJW-?baQe5Ndmyu^Hw3$Ow2FM!f%j>SpnWp`UVPWuWd2qM;!lHz zfaW$BGWDKt178fggMQE~A+n0#)x=}Eq+UKja#rw?wOTwmFcF*v%=8XrVR2=w=ltU< zm{k?079hUOP2A{B-QTqWw~faisBCn`6pXJ3_fp~?UXT)_QW+fpKwp1+E;?$AbP>f= z!^m@c2i`62UKc$TtDtALwN0mjL9({z{Y+wknE+u-i5!? zOfggfc^35fCxqfneZ~4g`>gNf)0>r@Eq0JPl?+W)`{a6Ws4Vk&DaxtAHT2Lo`j)BA z{DGzBI@44L?0N)Yu-TZV;mt~_t|~)2T$57qYi(ebDFUkcbO7D}I)TaU+{O@*eg)y& zcatfKhBR!pJOA#g+pAQCZ6Yj6j3~WMWTU>|zJ<<-1R2dGX(v0Q*bJv3ML)XpWi{{x zNoTBkwf^{h*4=rLXQ-_y(KT zm?ZDrCRvYn{i!de3GXhXQkIA3+`4_Da?^DFY>@VNov>6U>^v+|@$+Fc)aE$`lgM2Y z)u%IDa@F|*4}y|w7+^xlK^Z|@97S@>*q{5}CZL$DD4=dn+CTI9-uJ+>`y!RyMTb#W z1jDh?b7;!3nYtwx3X5Rt298U72HUa@Kh=^jGLP2}!$02S3q(TO4f_u~i1{CcI1>}| ze=WqDG_{=eIsV0iZVJjQ8<%x_jOTfEc$;_|GK`N+JR=+fCA2|OpGem(YIX`D`-X@0 zCsoS>Xb$gjC32=kz%RgVLV0N*^MRfrh{eT^Y1!QPui{{g5j?Mq*1Z<5(-bCIG?owv zj(C5+eV=e&6v|QGE~J0tWM6&VGOOYpi3b7ymZP2pUO&toT9|)d_(s=iio8fv?=(;7{aJl#0)~NI8pJtMdzU)%I5vtIO3CI zroe24kvcNPotto+9w4Gja;o~w{LPmo9sZEQ5Ct(=6x)^tIk`Kc+XkgVSr|5VG1CKV z2f6bJd@la$s4FcVJJunBqhMC|cWjfzPY5)bzlD6StF)BfFeDT5Cj@kp=BBeAS&rud z7tE89^UY->Wr9q&xx3-N&9b1+Bnn~BOXS2qR0)cMkmq#KV5nmp{z!--9@*-AJ#u95 zfBE=+pWfDWsR)Y;^gwdN*Fq?>_2uZ|dJ^6!D$-R5f8*+4-+-c$VH71iL9;?eg`QeXS?xj;ds?&j0bKtCWuJ=Hr&cMD z0Y(rIVULp_I%Y2o#Q>1bPKywTnoY={Bn2J-MnW|N;DtS$?(MaNzNYAXr+(f~jJzJC z%=AoW`}n>%r>nEin#fhQGZlmtm45fR`qD#h%wC-BE)r?dkGnLY-@C8@-MiW0Cx@SJ z6$hJaW(R=h71vEDer{XUS3)Zi{2{>yr`OJqA_!n+jfovF(Khb@GZI%e1Dc{jp~uB!_D}R)Sio3lTgx(u zk6rx&ECb(87K3q%PxRya7FVl{;@x10v@}C^MAYaA-JDKsk_{n1CcnQ_6$GREbgX&rz(v+gHZB#y zW8q~xc`On`>6J4|vwapVXN;|MbH6Acbe99C|Uw{jw&0`gOVp=?<4gw{P zhe<&CoQ&Rs^vIIWEp?qs1shRK_P~CoO?;J3d*z}xggzgihk!fGc*Rn7tpr7oK*j(^bc z+8C=+Qc1C-gx{b6R*DSj@;aoQG|FTI!Ue~y?&Ko@`Y*wS!q}{KzwkXKoMW^muZ}2O zUBrPyk^!3tLxUsKydEY=@yM%a)GhLpes8cYu80z>Epd zRCR~`DWr(N;0gp%BX~ikk9@Zq@2Sp#w;5j>(pZF}0b&1r7$v&kk;_LtrNR;pgqn@Vm{=bm%V`9Nu?J$hAr z`4_9YqL3g_Jl>t18C43|=9 zae0KZz$>R^%;|FjA@l_tGFqbjg<^_GXd+(>HGc{*xo2gv8B8WxL7Z`HIB z+>sg+g!VfMngEO5L_kuKo?1Ha-ZY3R)FsAM$JBTSw3>qj&jdNv$|U*i;RN{{H+{CC z#vug0GMIGt6`N_s$b`Yy%~kE(?t)7%nl+ZnR4*8zD-*wU!bs*TK8?mq>Yii zj}YeY=li9v`88C*CzFgm1=d` zLO0a;u8J~3Md5Kx)JTRF#ys`zXbd9DMZ0jKghwC>JDXKh8g$px`0T2mYN)ZO4uS}UhqKaJRxbz&Yh zOT<4)xD&xgZ{`_RYQBRdzy_gON*rNK3ewkx$GHV_NhOJEUqy7y0U`Rk%PA3~W~f3f zs1D%)5`}|rJ%Z$b91Ns0P0w7G*hfDC0%-2YKnqrPtQWngp;vc77rK=`1pJ1`o}-2U zVWQGZNzx;EKwODri5Erjvv9-_r0LpCY*P)wu9QI+f;Ex{!BuhsfQZm^%0?BicHs4A zS~ziGbG2p56ehZkE#X zcxilKlh;UO+Q5(^O%Q$Ik7qIc-Y}i-a@B8@5Z`Q`x-j!Cm3*5n#*5g7ucz=C5bNlS(PM3px{|<)(_vst! z*5SwNMZI9iMZ{@~57Jw<=qJ9?QLBaQ`BypTULVcrtoN43rq-|RDf?0ZT7UO+H&W|o zo9OPNJ3jI3nq82Ua<&~qXqE=ka*N3%Fk@8(lQU>0hN#x-(QJj-*2n0V@+)HqvAa;0 zF}McpoWX<8R3Dr;;gtL`wBvgen9&^u3>l9un^uNklZ};9IlYaUX%$i1-uc(7!KIGw zuZ`*bmHF53BdhJI^~AyVJA={MQ2~8rZ$r)c0Q$&=)&-q8^%NVFCt$e34DVx@&KsSX zosK($w3{>pmglnfr*p%Wp3Z!E@`t6-aWLSjH1~Y+O5wSpc0%Qh<^WgYuW}X-Z9}B7b75o zK^oVF3V=dO4!gu4bAcjB@rTUD?Dm~FdI*4s&H@z+dmYZkh(Z&D&lrQ#8K~?a4_fGN3RVrT85@U1RHBSDs2#tHQ7mvmAHlD;n4x4HXZG ziP8JCa$Pp>; z(Vi#FIh)3)<|iAfLt@!#e(A;;2<{;r^EoXm6MM3SQ&~|Y`Y_QMa@NEytD{)-RR-Ex zj$#g2WzC^J@0R?mP8+tj)YlZ!GNI@Sa@aZQnN>dMyYvc!O}ylaNXt&Ki`s;Dhh6Y~ zdxsr`hxAU0%daiO`aGP%$JuPX4P#H|zGuKToZ;jWh2q92hV{0}>}m%3ukLgzDNBw! z{T6IoS|^jSqle+vx>|qc_csk@UT7VbccNJeQ|cRE*CzXeGE?f8@AKEtt9n^J6IkfV z@Y06>TcPe_&G$87R z^OI@yP4}>0I{=DU$ZwZo$6mBi6&Xh#ajLjk%3(+w*pD*mPn#nAerJY_s`H1%^=CF6 z+A!)*qegp*zo;T4fh5mBh7J2vZS< z(f_*szkvzW8G6ozl4xN!4>WB<70s=^xb%9-Ql?fcJe4!sQ?gpLC?a%zaKg%&2EAp! ziHRtS6xB(L-h0Xr6$s@;XyF))kj0P(2MTjY%G-|Y?ff>0Lebsm9@uOA|MpIb-(4nP zQZPDIHJ5zv>>w5K(;tqae+po5^!gLU4TB}skS*^+7X}!=5eyrd`Zn8}CnHABzYLG! zR)q>Z+bL1E4t;WTMJ4tk1=Q&tN>exY2Gx}`rNA0XUdtD^gb^_*qck-n$9K+Wa6ePW z2F+(Mne7}?e7K<6NH`>TNVRR435nDROmM=0jtU`62fe=G>(IPjlNQIc$311mZffc> zl5qwfjAdz9Ns3E40?6QnJ{w!$bs|V;;S%*q|d`w z{S1Nzl&6Hy@~2T^j>nM2i6vm;&~>N43A8$t9tbTQ?a7 zulVJ%dPHG>`tgUbphh*9V=1`uzDsu)jfJWN95;5b#RqNM^iD{V%th|WIb%kK_&uzh zN!GAqV;r3C9hu?Pr_Z3O5@g1Y7A@~VVX&6186dnZu^_0#Y7#^kCGkZI?A(|=QjK|n zU1f+Iu)#N6?|mSKfHz^0DzBr1YDHdI#+X9zu<8OTTScAA6mIfdTqL+cyvB=lQg%?I z%ZqOoxLC)5!Cm!#XZPsigz;w}f4~b7{zgJSE4`r}b$hEw`#y`t>!L%Pzt+XZ>+3G4 zJ^zx=Z((4p#NGv@lklJom+!<1!N>vlN=^g6^W+ zgxX0%r_)~P={5hxY8Tvwvu#!L%O21hJ$UH37^-%pK6&NR3A0ZL7YF5=Vh*N`8!hf;t-k6VBv4Qa)qv8Abhv?_19xpFeMGRKGO2OG%AS*)b&7SG0PFi2_Dzqw=k zte;bq*B&Fe3?f+Td93f}NS$>U2;%&HW%g!?<@M`Q@E=kqHWm85-HY8Z_o$m!Wm=z| zIU!ewd!WOT_Z)wND{|VQ9(OP~TY;cQFW(e8PVZ}ops@c$al7Gk5Ls-iDIby+->IK6 zk>S^0rF7m=EKO1aodL(hp~sKrLWgAML(9zoc;Nuusl9M=hWwM{qmM}!FOGZ;soy~4 zw_G7yYH&)W=f}S;BwpSca?Z;XhUBB3_Y&Ux95{JPlpf92?%V zlxipXgY{lIQ+uTzW_r!Go|Fce*UJ0lPX7D)m#$imfGnv%697%+8p0R5^St&98fSlSYdRE>%f}Eh`)0{8 z_)Hxv-0FtVdLkG{upj<2tn=$vc(%Tw8b>4^IM5mU=AqC`{ja_8zh>r)KlF|N;odl{ zrDK1<{(tt0=ZfHBw3NFfwb8&gWzE-(8aJ-6IuUaR6iv90tz-!Fn5Vzq_`)$W8%!0L zq3c2eZ%OVqUvpuxF%)0x1BQ|JR3Q>0BBI0+Zff}T5;I0v;cZw55gqgOf4OM1K}#p? z()ab=)Mk|MyC0qqeBPvM>~tAR_5D&RH|lo+RTdQBmaNx>>B|*-t1-lu?6Vv*sz&*9Z<(-AukeF4(jMCJ zE9=MU`GkWwvPAJ&rg0BU$dT;--3!m}@um#2EOH_8uuc63gd7T!`kqZSW-c+RJVtPs zbBTIJ)1vvOSB2rNJ3@# zFz&g;#k0dvY-HU@P@hfjcZ8;8X7mmZys95KFdzQWDlUZrbeUB9sfs zgjE~2Ti2|%c&psBdblkXtFL2zN2{4z)G@_o)TwgexU%$zi;?X`&W@n$2a;IA1K->BXhDoM$I`EW**r8K@@9e%TqonvK}2fD*uAWD^|XKX z+QQmlpkaY1)U)nDK$#P(yfDr7>a0eF$q%=;y(?#^=z85i-sgH*GE`2|Bm?@07%Fd; z8#=usH}KhdU&w3`Te*pSHqXQrc80Jm)=zZrH9)lRLUI1LVlp$sOcC;7kg}1Ywzi#r zw+OZ%>oTuEDz%WpmpC2*+bDW2`(Z>8hZec-sN1z$o8TrTeUO;^5mKL5#tjf|w2umJ zxZb!b!fwUqtdbYtxNgys}#Cn6o2~Hq%fKXk{CL z7aCkpw!69T>&#m<92AgTGD@nD`^Gr(VEsH(lpjUD*<3SibzPK$?7mw|T+=Nk@d+;t zl-=T>Of43dvsh`dwe6govx_&IL$mF@k~NT!v|xz|_+ycWJ(%t4x^u|gJy2J1MPQ8_ zlbS(%BHw~c#4cxuaLbCb!tQ9qTC+SXF(GEU3?qjtf5$J93_^}W8Bx{fSDuEPGIXyv zAzGTEb>3LNYr&u)fmwkqhdfCtPL-jh<7|IfN6*e~?jo1(&VC@9S65@G?rE#2`vD#J zb$>rZ7e9UPsLPAt}k>3<>LWn|I^lfQQghSd>DAutLM8k%uSC%A8alc_6=L0?i*#2E9&8)1z( zW_aV|C|o9@r1^{!Bq$?TKljK8QDR1gwMWiI;B?8kj9~d%W>73vX$fbbC;)uN253&$ zkRs_WT0Uy40e!zz;p&<2N5wl$o9QY#uk{I+#;TFc;5=k`THT9)VxQ%E<Nx%LfdydbLe`;Li|fjNVkZZA#%fHP=| zrlSLZyfX2E0=h~5JKny=Z-u)T?yGV=QNzma6+EKO{a1dIQbn}$;LMVjI8Qo4@>T1f zw)du|B@3oJ|5S0vuD%%pea}axC7xh2uG6gzLCL`_>k&8>-3I??^$UBrX4}^(v3|%* zXU)}Rf24vFgay%S{t6whH52*Vq)s5KG>E;P@c?9-Qd=ckRx ziKM{Hf+W9|i82RJ7-Wyt=pVyr9E=7uBhu7bV66(M^zz_K@HRj6Nz1l3UPQJL&p$mN z){tuX&7tSEh=2A&yGOamOif)s(jXW&jBps3yV_j2OTHud8l7DRSNr8qh1)_q+6xdd z1zAov91&i&FE@P&xrl0QJo54&o}J-cV5AEK%e}Dc3`7TkaOpS7V+?>-5{j^m4Z@x@ zm~up$XB~Ax^Cg~X99sLH+YyIZm(LGYB6aj++(Wz53G6D|!ov+6`);*%`82*zr+|RF zoO;0AW-0cfl2DbIN0PpB?TAF*1PUEMFw-oErQQtkKKAEh6d9vq$TMX7>s+r;PIX>mcnNZhXE-?4XqKNf@*3NOk12LP zDDSnOjY#Ep+aG27Ct#4v=Pyz$!G)4Yw7rB^72tRa7+#usKkR+;_&T5>;Q zmHhQLwUeDxYar+^h=_J+TowBUoNzy0)+d{_-UZw6HJ6m zk0MQxLcm{ysg(j=ykN~($l6oq_EM4h`@M;aBAhN#5z|kSCwuAX^$qk}5ThIdBTUNX znXKH^52KCgkWrZS|L6)={)s_Fnnh5_La zgU&T=O;+R0Mbqk~Lc@leKrHFHd~h!tHU_NmT(y-j#EYhDuK3nX#KSU^UK1dAu2 zHJs7c&Hjayo=SCqph9edy^kCWCaySC-O62^E8GJu+$-6GnOwNYfjnU7(#HWOmZUnv zBwT{=2In?QG;F)<`5UkQgP9G{w3Q!4I4=3~vE;(mk~P#X?<*T?JfS%hXiij)<8(aP zw4sLzJC{+FQS-j9ZKb@qNQa#Rlh3VsYTq$6&?=q8+TXOE}mLG5|cW;WN&>{4qqy(hOopI?DZAd9V(7fTW#qF%uLc{mii zr1FYc>laLp_(~CcTXoo1H*oz1-NVChsqV~F(?tjF@*Q>ki%RFP^tMl>N=K+Fg8rdaGyXlS>vLGFHUiNLI^^%v`BarkYFfHUuk<3m{HenhzS)l6Q(&2 z?HY5bmadgJ<(-40X>yt9VQJDl5Y4~8`^Trbr(hXPV0DL8Y%lQ5V6d257N<7z-dR6m zsIq?uWX!>|vG{h6?3V;asNpHX#PHdMn!yY#xA56}1t@0v@=HIR3(1^pieA>=_Q6-e zTkxOJ;Td+SXt)R=YYwjkqC?moJ(3NBRbgU%F+_;ZyZRJqhMMrG0a66lwKsu+v<0qK zLOd4m!O9b4&RTbCrL^2w@PQo^`Bkk_mLPFhidkX%;?1XX45Vlar>t+JaU>*JZ?o`T z7>?|nDzAa6Ofz(NGzAyD8YV|*Sa)$`wG%>4*>)2?o&xd#j=BtsK0l{tk*ev*CqavJ zkc9TLv9cP~>^Cj)#+Fu2BD{NFfAi*g7!uC886gisvcdgav8@9~B_M z>GKDxP(MVOHTaz#KMPVsGDT*%E)h}9OA!A6V=iEqzz~*!xPWUFRyWet^7}yMo4^}~ zBZO|(BlLgjQ`-eJdOWPu*Lq}Wm^R1p0Gs`4+<7(DOHsqwt0rVHkUFf0fiLDbn_?*y%^0`(rDRdHs)sLMjdYt8Qnbz4@=->j8v_|q(r!lGQ*+q|ez0}1Sv zkMy{DN)QM&$j|r?JlvL?Ws-P{YY;pTsx#pB?6_X{lSMxm*&!zK7sP zf#0ppZdiYwpyS(;qTk~3us2!59$qWNOKnR>Tc-s&j`{Q+c$dN(I<3uqUI_JA6oZkN zs3B7O44L6jRRl`IbMP!8uv|j-kuXUejwINp6;wB*#?HMEpQjXO>p5fJpfDuY6?g11 z^`2DL*foL!;hTQ>h~=Qi^PEE5r&5=6VF1kqy0EUrqFq=`@&yP4YKOmctj|Ea$)~rN_4i6GQ{&=J z@xMiW(d*IcJP`=?#+1DWth&qC!UcjwoiXAeBpEtFu?g&6qH%@{j5&C;;rnGx*kLWZ z^3Uz^Y4Qfzg%5Yw4gQIAxMGZ9RS3CgHp?o-539|>8fTeeAIv0T@6Wuhiz2x+aw+;J&uY}mvng&L5wJ5mE!5j2X9H$D zz`F+Be_sbPfcw-R@^jHI0SfiN;Voo5xyuRoU)ZC^fl=FWI3_)TDxu#_VeNL>N@&Qn z5CV7G7YSaHc46DwjW=OPHkq82?Jra0fw@-3xDcczWRSvNFANRu)nBn#Bee~WZlZx) zX2+dgd{IXJrCPbvsY(CRby97A8ucD|`uMZ3EMTyNqoe-X6W2-qk^edVgO~mPXU2M^ z^}pr+?snQBpbFG7_;Z5#b$+ryL75aWRSbLrw=IL6wP=zbAu-xk!RWq#W-|Aab$hqC zU%+7kCT%W)grGk_sTZq8wx1KYBYIKELL1>-q5oW<4PIeAV`Qlk|n*_Qd>} zH~`8BO@^B78)_(xIl?GIgw{Ro6flMbI|@2HK%$k(A(dDIp&FX{)i?OiM4MdscLrx^ zX~1{7R4Vm|hUbix5Y7^927n{k=OAfR^wVD`NnB{ufT6My{dmQOWO;oifSWKv-^|Qh z0mg)bo&j{h(QCgMfh{jChv&QVprwHArG?#6K!^k}L6itSzvCjQgr3pnB8KVyxh<6? zH%(P_%xaZHEloH?8)8%yFr3<~Y5`)3sQ$o{b5-AzuSq^DKF@Nyhi2)S zm>52E19Fpzw(+yqM3qB(P6mXqQ9=vVBjuI#by~<9as+6merd^7@S_)EInom-1r}*0 zii69jViz(1Y7aO=I7&vsk_>a#;w$nA6D1{^A%9{WGK!1e^jX8|3__%jJ&JU#IlQHx zSx-+5*1ipbvQC&7#0w4^xQ?+C(B;6Gw^DhA)5RgCe}oTc)ABTgO#RVpo34>jXL)~9 zuVwSL$aj_~wcrKYp57vnXy|kw6o8BLK5-)bbXk{x!}bPTo$iVv?3=H<=Sr7ga+P0F zcJ^qMt`q=4uh?xZj9U|izJQ{%!1WC}C9cSn9hhz~R~~Y^-msVtg>Ca1&^u3`((CB0 zX&_`Q%U(Z@Y3#VTO?~(98j~c{t;t%t0J>i&gBlIPWz>>2iU_wqAHD9+eO$Qz**@;Q z&&MCEBzv0iO^TalnF-4J}c!pSs^EFZS!E@Lp_tQH_S1COT z;!edmG2ValuXwS^L?3n6r~ApLX?P~8MO)v3&0qt>Z}4q)t0Z`%`X?O@OzB`BBd83= z{;4y`w0#cz1;O3pTDtUA~Kg)AE=nJ(yMCG$Z76VOcSSs`{nc;9- zL<%}U2by6*!<_-`OLN1J!?_V5_nQg+K|z9O2X$}pN?cholO-n;SLI8!hSUl9VHBLV zthwz=Ai9IkV^5mz5e$Mj9I?M74o{O%nYrU|Ndd>1$PW<1N%J|>*#Ozcbyxf;Q`577 z2IU46w`%F9%eZfgoGYq+30{VFo0Vj?&KVqiQQGs!on$;YicOl0w+6+|X=-aSdY;Gz?|II`KKtZ8;%xgdLCDo5na#l3+~d{ee~+< z(96TEx+9qj1l?3T@X96T9VA1G)B8fq1*t>-vc)|Mo+oQQlQvH~=NjAuT(I0eJJ>$h zDZA={YlfK8inJ8Ku^hB>8hj@|xM=1qBRr{3VHHYr0x5SRJ*>;>)yksY8fQFB9U*v4px?)%uGh zH5Ha1`e?Z!I%ZVb11<%gEl-9mobE2p&NiZ>30i@t0xx(W?MbMN>X7k|V>cdC3l??L zgVd~OpfB{ET(Z)Ry7b?4M~*P7gX9^4AA287YLX|8FD+G)Tv88FND-F$`laoz8wwJf+3pb*@V)o#Jv; zsf8?NxZ`qd!p7?~60K=+#D(!WA#$k$EVidTHqeFbaivaia(UaWmlkoONLRU*S8z#+ zw{S_CdO3>CGs(i+*0m6qM_Oia30Cz}SM%kGfj5^!LrS}v#lQ$>n{U`sM<6g&eFU&XNl3yQtpL~*pqlzg<&?2iEoVUG;t<;QZ zH~`VzTX~y2cE{zWM{tLB?r?gy7?25XlMR1Uh+Ot=2%Q(S~^Ne{ipoeBAW~u-><3~Huqn8cSqBG0zr8rlxQR7-cU9%ND`P*`qgtq zwQ+J{63_sXydRbvnJDP=h!-x*B`IOGSHZ)E$#xVDO5~<38#rbCYrWJ0T>;9H$Ol6= z{-XUTJ@3F-F(cHkCen5wBUJk_15ey-wM(b3i>g8Qf(4q&YPBJKl=sc6nBzW~0y7-r zM*7F&Evpos9dsuKJ72HQ>GsD4-!9%9-&fCDFRcQzJ@fj6%`#}RR3ges)>i_EmU-(& zP5Ln?Wc81+#d58yBrtnW@4{M4nan|h_r%SZ8zu)eZm4)QaXoxC>6Sfy6D@?7z71b> zla2R=4=~r*@TeZJ#%eKj@lUzUQK^_mpjl^Jp>X{NWp}oC}KS~%Qsrt8uEy?)rqe<2uzruCsZeiq8 z;WeoruTIvQQ~b3sa@+(=6fs@bwSWaUs%zTUdS%?(IqW$Y5HrXiJ!=!X1B?i19s3i)!0JbD_vtG}nP*8#!a5dp$89J-V>KRax@QZ&L0b59s{pQy*(^e?jB z|4GD(z5NBgfLb6}?r{13cVDC**{|l@C@Ppqyc0533TXBGw^Z)?F6JWR-9RpIO|mqu-*Q9T0!~ zq|&LqIuNjhvbTS}FfmMb(cGjf;Nh4TmhF{{-sdgrw)P3aiYG-I9ULezWXCH_D$0l# zDi0!$Ts`uo;g@=+%78)1Rf9XU*8aA z;c{cAnW_&`NLMtC=!?&ibwm?0v|Qh&g~d-5wlfz}c$ zyeW!kaS0aI9Z@rAE_IUoVDisdEkO$Z2Nu3|J`QDkg}@{w8lf7s;N?DcDPyJI!YOVM zL)j$JY7B=pEV1`YlYVjtrgVmyYqz3h;$P-mJu6Cjb_+vrNBOwj-@3JJSW^J$?R8=- zE+$evx*x_vFI&k42JWJxv4LQKLeN%=*-;WZTRNes2(=)_(z>CCeCjvh*y|-Y+UqnK z{z5qN@1f~2=h2mG6Hq}iWJtkNQdhe_YMH)d*y$n9cJrXuZhd|uj1!}Y+cfR%f2RuO4U%X?Wbpkw`*LTpxd{9#I2zYHE90fxSD2v za&KX=@6(1z6D&`rb(iv&JIpp-J(yf*TX%0;{#H;E?jwUXu?YX; z3c~v-QB?MEG9MYo?-!X6qxLOl&QY~p!~LuS{{&*(|EY<}+qcTZxaekpURSGF3buhQ_qISR}f)&W^p z!|#?*D9%0O*!NuX3~jR>L}Z0jH)z8NKxcF8cK}2xOD;@0AGtr%Had6xN#&8F49d<|Tl?$?sz-sH3 z{38$PQN^d6WwlYh$vdB?=jRjzMxmj)Q}YaX39QhO0b@~tkp4|th6mSF0FOS~u=5FL zUM;dJpFZ1?)wB(#rLqACMFrvxf3fR(kO!mxRcKdz z?`+~dthuvYxAT=`DC?;+p&ZH80fm{i{CfMA1&7S614VgQ&7p@E{0lD$?|b;If3@#47sVEDB?!}uQqH{N%P=-kDJ0^IhfQPuZO#8g}z6+WwL0h z!;fyfaUeSoYU)^Vky^}$6-_h*3+$tt#&dlVAms85y&f?9{xdB6pf+$Uy1}GgjqfP zJ*F&~OI0rN4Uw~pGZQ2bqZW)FKor^ko^+PB0Jq>2j>T%lK)&S{D{4!o=dZUC_!S@n zK6_xiM9PllJsq!(LMgQ$WA%vkuaWPM)HMd4JiEzro-ViF_LzT_U$pP_s)MPFVkFI9sl^rQ6Q zDA0C5dX=D%nIwag!m<$h`j~V_$#}<~8Y!IfT&B@Lz>I;K+2wP;_SXIfW)s35Hfpa9 zf2N3(I$2N~UOYrdi4qB@gi^cyoU~e!M$E5%^fgAz1g1DrlqMl&rP#U401KXogZ|wo zE_Qv=6xqlt7vMy+SDB}=)-gU|BBBOs&>C?&VDtEd zY5%n1ApR$}rP+`rY*m`nP{(W{=I^*|a=|OcQqZ%WvFvlvW_7LrA%$CsAaaf29?cBd z9yrpNYkbX-ABmFc@nt$%7xM%MyBopTmk%x~7Pi(J@YbpG)-z|%Xh>Fhpry<=eT+lQ zV!W%B%bxvIg>8I^%}fwVL39erHQPWj=mjal8nQU4*7=>y@S!a7YbJI)$;Eb4l`I#V z!%Xr3nzjcLQFEamlyX5Sm1+brCPUlupP{tP$c<61Cj%W( z#cBu|nO3o-a`ss%>nvm}bZ4(rrJ8zx019VaPN>~-M(k6==Ha-TgoT?VE@G1hzEDOp z$pP`oL}PA%Md4M(-F|q36+%AvFw~s29?xA$;dQ#ym~O;$Hq7u|;C%dGKjpN$ZGL52 zDk6DhQ`nd(Ib+@)%Z#%#<#ByIdrW_algczx#C}U*lXn%>?U3Q&LzM;S6NXv^Dnw38 z12ctExco;;Kh~^Opn1aGK-E#TK^jw@dY=%uAGxg$_+yArG!7X#xJi^*k)B@mjd?+C z)(RHkW_Ncl>yAc-`NSx-K7(so$nVLG+T&k3LU;xx;M(Q&bMpsjHn;Hk(@zWP3o?Do4 zrpe|7@x+iSOj(V^#MqijBvYmxO4SXtZgtFicZ=Q8A&p$ExkIRXXe$VzW@|dR4JdgC z9~_OAMiKA&)w_!391RjsK24b!C}DNiMM)RcScUNd=AN+SP114=ai+AS5g5Z|mX3NrK=yIo+#DxIYEQioH$(E6 z;!0XfPHE+)V@375A*bb4;4exL&&eEo)K@i_wOg&Yf_96QQ~8>kvdPHSZ`8;)P%klV zREh}l*4ash=XEwU8zbg)!P7y>F9o48VRK+~rPi?IGpoSAM9=Z-H)GP)LGIoF>^6_I z9x_Tw#15b)To1!G6tHl9**W^_4m;?qbr;}u=rVDl!oh6SPo~xudZVIUq?ms{}Ansvci~q#@2s!cD!f-)@*rjvY#+$wj^q(+lqM0cC$910wfOPk| zc%5h1)6gdE)j?+&4@8t8f=YlsEE|$0s+)C$*SldTjo)uR@qkfF9h4pY8-f}PMVgvre^2f!~i`3 z77x5+do^1^dBMP_2c&;yDB*r^oVVHH0ZUa)65j|D&l5N|mLy;y0dig)6$l>*VDlEg zMM#lE#YkcD#0K%WaQgL99vT~3Vj|E2E+|8MmuXvH(i`8u4fOPOc5VjAc8QUdZrzUg zP!=eV(@zrW)J0*wI75^3IOD^fz(PVPQBFJtAO!HyJ(^sHp0>88w=VrTR2;^yuBNvh z-yR}Vwy8&f%ewMKtrbHlRPs(zS{FS`f%@1Jp;UXbQSq*h8Oilmrje}Z6=sXXyEq3#+dANc;ck?{c8VM1=a2d@rXvmZ%wDXTDLi9#bH8WK zT-pLPO)u`(YY|xNJ8(k3qQV-B{@afsN62t(^-MHSxEixX@FOzND6=@KD_?a_HT_1T-Nk5@3NSpfoiQ>6aZtteEEMCI6v;tEdNhz z{g2eZ|5$6_NN2~sNb;w`G3YNMjrBg=*?LdQUBkYTcF)Q_yf!sAWn!0_gsGIvb1k_oaH108@uNdmtptF+gU3}gNq_^#>p z&HAENr0F_#j!LZDF9PuM?;1ex)f!~bc@@~!>;4Q-6XZhC-rc<>s0uK?w;J9ee|5e4 zdYBIHyx6(+Ylnen?E7+AAwpdJM0_omh+_E%#X(3bbN zCPMwf5q57#QzT*2*^iw%BW)EKMdcmd*zXwJ1635W#C!!;KW&>|%179sKZ1+-}Kv0+>{$ zvlDIV8Im6R15@K39(DxQqhB0VuOHe3mq(Fbdm{;N@9rk10s}}XO;2veSCNk9Rdln~ z2*5&n@+djG4~=4!4I z=`1eR+iZ76kTSjsq6~(KwzO7UArfM5s?Sa0a~upVL%z6?EHas<;Yv9IEpgqwoYktu zcbg4`LQgGMO~4k5zWnGZIitj)D=^F;edRyALH6ZW){|(9&iGk#4v+>OyeO3s%gB@= zisKVd!>uIiKw)~{0h6m#VsWre7zpP1r7MA*?)S52w?479fMMgsb{!;PVx(-u5FHVO z_Q?H-6DHYkta9c9d2P;2CNRG!N*fYGto5k#VN=fRRgX3kHDpb}q+SN~5@;CERH9OV zwB$^B&~K~swCoRWJ$`1<)myH7 znyDW$WVRLxo76}`X$_)-sU2^kxSOdV;Q~z)lH?jmrQE%(0~zOAE3Vba!Bc&d^mH;a zbm0@sPnkko_)-ZcLgRqdgtT!13@vnw;lYP8LC{I7bmgd`a^bV(xG!(I+``Sx%{z@OuHO;a3zuNUwoU9WH{fpOz!Vw1XgBqDpxz6 z1r)28<&nY|Ie$~JvV_5(!ri0G%R`EiAO&B2$Yu>=1uAgWXm-cAF)p6p=259jLA^Ur zo)l0d#3PAyKFW90)TGq9mR$Z#tg+jhQ#u#iD68BEjEQDkbuF9it>qIe z0DC`MfgL=<%%fa1iQ^8;j3tc!gGzshr*5D9*A|D9v6)@QRUxhe*EcH0m!5FOU-v+|XHFi9eBa@Vn!ybKF zCy=90oS^P>qX;j8^XoL4@55FK0|^MKSyShJpT~;z5Y~Uj*jxv!!M*=7m{S+Gn>X-f*wm9r!@^ zZfS%mHHQ0dWs@~kFPX0{9)PlSVyjm8%C~F;N_K9DU!eB8-s8P@fPj^U=CgM*=CFf{ zC5>}6Q32$Hc}ZIIMY(9F+083oxqr+1-;3wk{yZWLv@z6rb0x+>*MheuC^kmnV!ML% zV@$7b1oIRw%6T0`zSuBDOh*)^3~)bWI^qX4bJW{}oK$8-XvrgqkhN&e@a9c&KFWKA z)3u!d@mX6?yX(ngnvN+SZ(Henj&P>N)Tw2Ba0;gl2@mF8JwSCf(2JXi#HU=}mC3Kc zJO{;`=~HNx^oCj^!9LM<&jFX1#9Y}zLqAy$wy8*vEt$*3@~5D>Jb5x+Mqx9H3{+_7 z1~gQhbo;sySAL*^mPOhY8blB+N-o^3`D;c4qq(s#?2t)fRNR_~ycNQ4!|A&fm6HBI~JcH0kREtVIU32(AO@g;Dwo z&;r|GGLMuZ_4rfo^D0m1e=p$P?7`Y7KsvZ1B%tB(HP*Qo258g zgtuk2rkkbT{1?AubjQB9wJIvWeQ*r8L~@#+3kc+7q*SWNcLfM&3!>Ps=^0@cQW%gR zZ`Xea!(TTm-`@cT&&S`=6fN+WUu@r>B7?)FUgl=j`ehxg*Ruy?l~wvmHCJ(0(%ukg zc*{iJU@k+J{~#S@WcabEFc8=qSwZpe{5Ny~GxL9%+-cU@NZfBh^S%BTpodh5w9xO4V1w+>q@4FPn+Gi4_5x1+C5zg8mz&D+B4A=1+{mW+-8VEr!2uZT!_!of>^jqrTy~1`@b^=?T?;(Jq_P`jxF!F#2)+a)zbld4~}~8nLt-c&I$K=xh+^ zlM99Xb*iiwwB(IL68eE%ie`vV#7Q6@+7dzxD1jhGBMx^vgLZR9g$kdhCqeYjgCqVV z9NEe9a<^ymzTEx4ZysE_WJDxHjQFxUK?#jXGc8mYLJd(8Ou48Lcf=~#Wh^{XW#ZBwahDt2n8HG z(J02NvI{akXI-lHkZ+SB{a;WhxGs#%5$d>y)x; zR-`m7Ynd5sYmr%vN-ZBt9@fMWWmoYNo_j0JfRpvQ^_6W)w$*sc1V~6&pd@lPk-vA= zipP(W6Pr{0j~}7#Z{4^>Kjf?HEHAy}dzrP;zp{fg^eK+YE7(qDP68X7rHVYY+{dAk z@kqymGW`1XEq)>}6})lqVk$@9zuWJf7d+wAr*dy|x>xa03NT;-brBZr>W>YS$f&YR zWdY(fj)8Fl&nOf@$OP||&UmU)RY<=bqbkRnb(bk2(8dlUp+qt=2 zVvwq&c#eCGAWJY-xlExp9|H#Gh{ed_D;yuI@oEj)aZxZGS=Mc zTi8T}v_n$5yQ-7VZ@{9Os(qR@D^eOJEj}g+-YtO?(Vkp&+n}=={%q;rPXU(I1PAH3 z!O*{|kG1?&%E*b*dK1L-l;p1X_GUdv4gz?uij|BL8Is>Ppn%Yx<%~lhKLi8KL0-*~ z+Jp8I=NxvhKzfjx`1FE82qJsWwxzx>NJEOV8JAt%8=^Mo?H%R2AGbWMrsTmtw57f# zP>&)D_eHBCgU-x8>gk{-h;RgRA z4v`ccl6n2q3+WjqsVO^;R`+e#oO!LfK%3Q#quTVD<85qqP8XN5Gfl4O znZ5lDah{FiHPasaLeXqXs`F25PpTSe7~Sq>C5RMBZwOxS_!SgBGg$uu5cou#jebJ` zLvFxPh}>^aXaI)Qe`T}!>9RomLN#Lt+A8^ZABFe19k6!ZI=y-7oLvy9sxFh!`>ikB{ZXqXRNZ z-sRb`it%ho2%i&gj0hwYB92!aW~}oflPku+HzDR*DMvcRcfGZi1OgP9xIl~(Zm66B z6}7K8pAxx-qJ$V|e*@j4R>mVnR3Kcg4S+-g6*s01{PG(7e$VX#of6g2C_gBv6D=B8&-u(jv zGzsnkA^&W>YYfQS*vNjWsRIY9EwcWG@BgR&Pn z;{A=K@%B5t&Sw&sv-z9O1{sLE1W(T1pryE&a+j?c^nnl(LaUgF2&w$W;q2pW<^ql~s`OVeB^2;6USp%Pk8@SX@SeN| zkweB|?h#emYhc6jd*iG*%`V_Cnm3LzWuCI~WV{Nyz{Wps7JJ_-=0R=TxZdV{-$t%a z_tc15^TvLM(ALd>lm-`gB^o8m+}@6^UskN|b#Iq3#Ks1lI*-}phhNBFTodLHyPAm6 zJ}aZ|zz7@9)dWCThIa0#day!HXfJ)z^m?hxqp+7vTc*t7QkL{n107rD!!Tg7^M|Gd zpO9|xsdPiDil@r?D@eE7ty#>h^yzAAMYm1$FGK2 zs^la5r~r2GG=v(5o^Nh;ob%wo@1MgmeM=7KMAnHuX(fFaS2`w-9TV`~DO^{?;RM`( z?2?0anpKtD&SQ#FYmy0>{Y2bb7Ux|r7Gbaz(j8&Hsp0grFUkg9+tRbGk|RFuzf_ewX_* z0T72eKmetG%C-Xs?k%SIUGt{pYQCA8s8NEOfwqZ21qpW0L`*$i>-LX|hvoh$g8L5V zid;Bj)3f#%5=Ult%wfGGw8QJ%V(h{J)CZXR)x$SqKmAEe(>`E|$3RMU-99P}n_*%e zlV%2fP)BqLyPiopgqrzbhC?hcPYl8lCI0B9n^sOiF#U;N>FF(zMD|XYiVnX$i}Bve z(>Wg9wJqm`mdF+DA>dJ({cHw&wHHr3b)sO}>bbVu$<17g9YL29+XimQsPaT055h$b zgnGo!O9zRYGJfe*J=V~~HdxBC!*}{N#=Ek2vw=X$B$sIVU2vH|6cz8riKg!pUAjdCka6du{LoJp<*aE^gBr-JHPL;%hw*wTTTcv3|0gS!OX z7el&b)f?~E32IKv*b?pHuM4iOU0Gnb#~cmMIx&3P2r!;?5YE<0FG@w%FoINCwL{#v zLW-3gRxDruclHosuLdn(cw))Ne#>f)!lJ3&bzwc>Fc}nJBx;3@|9{#oghAF~+70 ztFLQh{QY&%5T(3;IGRi}-!-uuK~WfX&uZJ;ZiqUfJRj(Wv-lvlh=G+9 z^0ulqdb~nI1_3X*&-Lxq8yRFmozYjbuLq_8gygSXRel}52H0+_Nr@fsMSyw0<~Eg5 zVBK+mC2Yn~bM0j-{P4^ykhAf}kUv6(D3+^O4 zb|4-D?hAABcv>C?hOZ8yW#Kv@-)QB&g6$JSaTy{QJ0OzAtbnndlu0jZgw(cTJ zlzc$522cCJqrojEKN=cUPxO*@$}J1Xp<*hA=X48F_bh&&Bz8H`mwrt1%aNGhUQSNK7j~L z%Hw*LsP&2HFn$`b9%(w@d4?eNP4{8x`JdWIAdOVC^Y}2C8=1VvE4y@T!`)W66l6iq zo8<<)N3hT7Xo3l7M2pkKP@csg)trk%lN7{*n+ppN00@+_3CVO=qF&vjU7I`ELy9BL zoR?bI0u=%|2r5e4Idf@f;_iAo7t4?+h3E@%jiQ>CZ6DdumMbfCQR7Z9t7pvRKN+PS&8D^a80~-y>e&ly27N&L^I?oj2N%`&p=(+ z4PafrdGgSbswULY#D)*hpwQtwOx3V0(A$SIf^GQnlI^9#uR?)M%=Am!yIb*-$h}*j zDG&rTxL}flO*j;c0NlJHX`~3sgeAFP#+_N*fSFX2)u6eJ z0|)2~(<#@gzb*p$ZqE;1TK+~)Ts@uWkhcxKL_TPYma2-!gSa3hqNySMDXJzx18A2* zm6UV9T->X;5p|X@4?TLQek5IkKZDBLoZ4kD+~rpFdcrz?_x0}FNcy9)I2AK2+ z-s!#MT=c_v#DGA)vw;Mdk8w0SrUHE+*TnnI6s$No`gEfa&6u5kI6%{Jic3AWh}3y% zCE$UFM>vqjlu9r%f>?irFlvG3IM27+x!Jvxatg8{tJa*9IoV#@bZ7-Rqc(l^-?FY(Q z4Yt4|BVULVKCDZ512sNY3k55VaJX8*C||g9wdwqFT*^%!t?a@=uWc4Gnr5ij5|(3& zCXp)mtZ_yz77sfb0lK;z>ZghfDfN?`H#8dH5WoOPLkLpZbK2x1{_F!*o@hIRf({QF zhZ6}cQb{7C+N*lT<)ACJL{(FG=PbJIsAG3+-x_ecA)VY>Sk0h}96C8{VS!~7J4W1Hs|KiA-*XD-3O*<*t{99&oJM*bXPqlS@ zljYp?*?0#4?gI2d5;Zw|KhK8vteK7=X@b9fVar+FHD=M^+F%mN!o4T6vg51oGu+lH z3>?`~+AS9QrV|yX=+87FJ`CWYj^1lxTKiSChvv*(S^zrKIwO9@G^R_+qi22YkNXkU zZmJP|W8?O6J5G?pd>66m)66d6rJPk`V@#8}Z|b|HWubRjcJ}xtU=)TpXO~}_aeVeca}{oiK-0*E6=0zKA2eTyj$oJ4{^sDINu}?VPXvf9 zo<=AQ9PL9MK!m~~cL%GJ_ls_E6tvyptI~C-!lb<+Ua(dLF0G6BM)bj)KFvvS_bW#A zdefU#u$s2rHVGM4!e$+mTm&qd>;>%^$J}7JfcMQjyl9;aAw`w%q&Q)BKcmcK2odRD z(mEM~W0Jd@-@dsMb~xc&vSo|FJJ1%7H?YmQGq|k2iGW)1TDrAOzbEi^bIyk8EChn$ zZ7^=Y#_Rfu7_cFoB5MOM!W<>f2K%_>P1$d>xO_K$(4c7wmviV9czu^FuQM$hm8FEg zH)7QCrw`>MIT9|!Psekw@+Tz>K9S&v9$+xV;Z9Tn{9|DD11RJX(XAj}86-lu1OG%g zR?+tXDy9nY<&!%Ike_cK1%O4|FoHlf=@0b(`$Z&{A|4kR1HA3VK}b5|fRi8u#r5ES z2k_$LP6XD{rY_Y?@g|BGM?*Z!yC4dg!Wg9&fDklVbcu%gOC025--?Sz12Am`foYQM zZi0|BlqhJ$k4X}*w9n!@?9={~iG#0FS;60`&mf?_hxU-92x*EDa__bq#|#XHY93z6 zYdo5}irq|j*@^o#C>YkwJ?&5KPd_aR2>_PMA_76~QYi(-qYj^Se_FN%Yg^a<+B1it z1FrLG-?(uqt+fNe=khUR@x9tDlsi=j0~boX?u|inj9Ha=wrX0hF?Jm|9(eu%K@@%Y zExkgLVd!kIKwsIYNph-BSeg*?lLRM`q5jJooWtZ%vYlmrsSC8;C8O_sF|{$-80 zlet4cbMg3&^hPSS@8!SuDSpoxS=Rn4r*Z${r`h|=-+UWUkvD}$?F~6%`~E<`NzK*r zKlkjMEFAx>BLBaE4RbOu{=XG_Cbs_=HoT=VZimB;(EY4_1IKLx)jYQf+Tdv~6s|x8OzeK4iJ>qH=Usa~2Oe{%DVo*gwpRAKe9fl)QGr`AHByQ)o@RfSBqa#^cP7SNNU>z5wuHk$ z1QL?a4H&N0yr){fRx9SQB=mF#T=}|4ezX|mEpt zf^T>sK>=&P1q3b}eK2Zqe}b+q8b37v(tQUsszNkF<&M@!T@;laK*(f_wgn&8RfLr! z_|6ShM9ZS1E!{oc-_z;n=C6=EF{2dc-z^qRZr<#HLBfN}z`(fq2X{yNVlBEnnJ>4u zc6>iPztd~xueLTOo8Ifb@6v0?T|z72{lA;VN2l@MEuV=uuk7*h>o6$7EQdJvC-?Nlp*&u=+K9V?_%AQc9sZ7MDg4)k zU4Nz-4R6?NNk;QPSmjZ}7C}o39Xm`Ag~6~wtnoBvO9O_Zoi3?4%X?uj_ShaMoNN=B zf^jjM+&e^fCU4DZa7x+G#%p8Vu!flAm~Lm>u;fUFZ=`R0g4D9OsW^&Q6*wM4Y!9L> zJJ2#x_Q|FRZaC%S4~x3@D8V3|I7c$Wy$)PT_I<*@)X%V{59b-QUp?yF6}6|AWYO>-}_;Gi?AiwF&R~dFZTPL>k*EoOU6p`71ikz z$^!II0u4baEIosC!SY@FX#L9^$|r&jIz#IiEh8)7u<94v(rGKAbynlhzy6BS96VVq z&Uy}WgHN~NEyS2IPiv_Exj^`!nq~`@$9a!77#0&^iC~>sUnfXM`=aLrO^rI}f(@eq zRfj72-Xf&+kx`+{ilk}^`W?Qj-rfqprcjKREBy_SE`HecKL^(zclbYan*Cp41hj1J zvn2klm!(O$>}kxdkg`mCs!_W3l9YQcC`V{^3_4q-8yP?H`oT! zaTls`sYSR}J?w4g^L$OE2!|vAmdrk6q@3IpzeP{gZP`QR_6&ffxS2*YrtU|}T>jinJ#_r4f1-u-qWKiA~B`{}T6 zZ)eck8NEl$Hc?EaIc}fNzi3tZ1tdUOY*8~*HoKb9XMf#qN~17i+;g|R_b)Wk@g4`J7OFV+?4^!Yhd@^Fr+R|c~lC1Y8{8C$_sI711o6#R5;=4E@sDMlcc#XxrJ7Hx zn%E@LRf`$>x<1ILxv>MCwlZ{ewU*D6>9DeeAL@J6Lmv=Zoo#_G*Wbwa24IW`y(#V^p|nIUIQf zk@UQzAOz{CU+X7|Q1CR-3rl7gZ0WQmLLwl(>AohITu>pzoPt5+beO9JNRA#{Vj_4N z%_rxBjR%VfLWESdOj5`6Xy;X!s~{1=OZ{!EGYC`&;Sx1~^nK zK2jj717|N~VSMh2T%L2ZvzHd~71xrhmP%tCc5rECss~`zBfZB+$;6 zF2+CVCJI@i$(!qzDba;lkWe77W3hGYJp>fuC^-87WxoO;mT8UH!@77p zkP-wg`X_=3HZ(OyLFB?J53k#T(+BINjnwLEp?i*QIKvY?``Pn1l+kK0vO1Lj4?)GI z(?Fm}a;0OW@@*~pL5Ui4)WL?-I-Z(4$60|!?I1f}xg^2}s~|uY+a54NhA}G4EO*3p zP5TVfFJr2M=!63rp+AB`pam?i#rm##R2Fow1B@?=FglrZGRI&5M^KFsC#2?7h_8p{19M%>IJC{LBs@oGg8ZufeV&uERP4npH67!WGA7rC8l;&C^ao2 zw5PfH`a9?HSpo}Z9|0?C`ee&m0ZrlqV%Tm&5~t@AWYK|zfClhUAzw^q#!1z{oPdfl zQGAC?VX3QcuZAQc*wf3mSB_DA2E7+H#K8EJc`g_nA|a73czp>lRx>um_W)7`J8y>v zOO_swqibu!ORCaC&>H0){ufaY<#&pG0Eo-sJORYGcPL)ct4Su=fWFoIoI!0uMu&(o z^;t)N_Tgkn8fAd`ZIh}fH4PNnwF5HpP_`KNRzW8DkOpfUJ^ks;Ae};dw8py9ImPe= z8QUS6Skvm06wQq{3i9E{<7af?BwC0WzbM)58YvV!3j4x;f}1795q$8P_6+naBPps# zkg7GeTFIay_*%93xf5(lQ;n5*@T&uej*VC{v< zz={qN!G0KIl-jo)Pmr#L)gH}QmEY?_j}#iC$yMIv@IAi1Y^9fRqnIvvD0m=%LXELn zwjH^@q5)fS;prMgW4kYtM0n3;JWJeRu3F%SCWUIh+PZ7s5cqBLhV1j2Y84m@Lew(~ z-BiBZiqoxSDak(*Y#oq3l~y|OhPo;nVYQ(ueV-xQeu#OUm7T+0Y?goH9@wI~w<#cg za`}b*>!VIXrmvsz8@9;+vi=pkfFwSE3ocn*9aM-&=a5FonQd2xUAZe?jRm=LhvrJD>TC}Z2 ze*m+QpGExBEdP(JcEq;V$%0kBHo@J)Gx;$Zy1*XISy@;PF7eAb)UQS)oMNVxwJ_+rckg2w!f8}>l+fu*;5 zOFP(Zy***J2>^8C*d}tn`2zCyJEDe&AP}oBp1-IKXh{x?GK6*PbRP0XG^W9MW`T}2 zQLRZL(tZ35M|~d@e!`1Hcc%x!tjzqmAPe8{sH@eN4nZgk6`c$VH1@rIcZY2i%hFuj z<2Tq3v+WB8saX{a-syzt&>z1GGZJmE7=b|iXYv%5KTi)r@`u{)#<*3yRI1TlcjYY< zGH#TVDo?s?4vF&HfWAHkbw0{QvWFH#P$No!F_ywlky>Lq0gY8CoD3=u7HAmLsBrnv zYcVh83lAo&Xzq&!v)IAi)c< zA49lBz>cTJHn+IZWjneJZLj0Ma70;7N?S&Ou}=Wg*ndFAMg-8f7qw$FyDKCK#4-_j zNAhQ)-p3b@cZ;pcE=gYPG!I2h*-63Rq(J%|ga%*~XhL>mcY!SyaKNaleuU69(Y;`l z@OLK^%iLdZD%uLO4p~_WLl|N3ssO{orAeO_K4~4vx%O%cRFmp8aMjUW6WaSLm3ITM zRNq^2XwTUz=g~t&{hONwe29c^mVWc%t*74NoY`+qZQwdYmHceYm=y-P?)0+l)xeaz zbH!$2g#YP~g zk5|l0r4{jN5>3}xw1qEXd2cnfXz*ICuCrpBr_7i*geil(21Qr#;9)}&8(hTGm zBTx`pLIIDb7U#Uuo&O>P4e&m6!O=080x9#=l|;KP)BcgxY@r8hqBsG5&OkS2=vj-L zt9TJ4p&*jclt)k^|JyvrL%G{m(ZsPS;LxAo^Llmg2iA!uueU>P(18}joDpe%6)niM z2_c`TY0$OBta9g0c4>|`!2b7F??wxbFhvMhwWamWvh7?wufuRi_xMw$AU;ZK>oxcF zCh71+zXs}=vPw<0>w=|QG-e)GT8e6YhS16D6sSo}#RK0Y`%z(!cs?TqmA8 z@oYYHN;=-$Dt`B~pRqqs$O-}i#V>iTup+`P`lo!5s-n@4UyG=c^QUGlq}Y;_t!02u zAtU|@JT;Y@vGh?FJ)`;KRGarH8RQO=v{TIR;@0mMm65%(7ir^NPQnDwi>Kd!9_4#c z|2X3PgRPU1?T4rGU!VW8ouXUghn&KO@^1pW3QjE&D-3W$DXdzR#)`+Purf#m>F9vX z_!8;Qh&Mx6o>k2utqcQ5q(n4(bl^_Ma!>KW_)9b!qJoEx6O#CEwVS#Atb_yc&)2b&~(> z?Z>6lt>^1iOrZh7yV;s_Zv8v_%emSYIB+t062~Fo*{{9}hKE9oWroTeYZX{AC8SV- z$u1v#I-r`*rY*B*0f;^QRrE@?G*oB|7RjWvP)4kn&-INt%0HPFb}=sx8D5k=-r(_( z8s5)lM>9!M2&AAft=mgu#8LqGL+E&EGogQs6Cp6~>fs5Ao1BG^njwsaKc6*q$y+U0 zqCcWP*ebKUfG$;d#^QKJB&w1VWV;1I0Q6U*Nnt?5>-`g0C3~io;-`eumnx}to-thJ z;djLxVOSukub8MCCV;>Vr1&Y7a47gKvtkEX^<&YJt=~av(E#tO&0h-dr(|l%3&(e$ zL7gt5WtHq3u=JR@cM1-dBP=em=#N=)>Y8XaDcrrDB~3%AS5whjpJ-Ptz|WmJY0-J^ zu5Ym$z;Re9xHiu&tg}!nFGhhKLNEe>#j&Ibs&+}DE_ z+uMtp3s?4;%5OlO+y*xxgZ>2rZh2&~PcX52MObS^SdfI@dE)0?V|#`?Tntc&P?460 zGZVv`wE}Vxk|el%PpWQdX|~Wk-8eYokWxK>u_1~ zQ0K2!dS**>^oe?H?`?FIQ#E3RSmb26(F`P7;*CArd7aGJdNi*#6tV*UVUAEL4Piel$Fpy_p9i#AT_vg58Zp$uOa11jt)L-HCvjP`}j6 zYvIz(-1je!9UGa?$Ucs5hhUsyGjlSgJJ+#xCMQTB=u^>#4hP$VQaq!s7?uWj^D+xu z9E%+?T@GQ4pc1g~!;8S{IPkD=(9lNHqinEkAhaAOoE)McJ{nwPY*Yrq@*kN7<&P{ zy)~W>086EBsc;QEMQV)YDvuMoA|~WWLh3FFU!_;D_p!-dD$8lV%MQ4duH;xsGMAPs zGMO3Kd!LXV%N+m0Nf8dkXvjCVY&cgkxbnF;YR{G5$hF6@bcaSpZ1JXzwwz`ED-_ld zxfphcevTRR>GHL4bj`1wJADJxDura}KIZQ_=d5vwIrm4G>nnc@Q33hFo-ch=8?VXng+O5f5O-i!gpR06Ghv%Ivd2fC<_PGMa#kRkt38C8u$5rUv-Ub z^jX@5c30~z)~ZYwN?l|C)Tz)t(ZXyoxEf`B=(<1;dccK8)t|3svW9J3adGEl_N$RU(J?PCcwoWlVhb={drhLQs(Z6RF29IHp}6*~|~Y5bEQ+ z#sZ)4UZrM#C&T)&WjZ%bf{Ycipq1MYH~2j%^&=#lK5>so2?9y!3(2k{!ld-m;kQp4 zS8w~<{o^^ix;nEX;0q&dZ@3+r6A=Lo`9$sd5>!q6p$2o=fW!V;=C68i$i%3$oSl19 z8O(LW3yFrPI(mW`JB!EK!}10TgBcW6LZ2h)=m z>-_wlYL9gPria=m56|;PsTH)0t?`a};W~%Xum0Ch=zJOW@_(A=*#7(Jh>WS7xr+q> zBM19`oD{v(+OYeK4t;5SHKd(cTSt#p|+$|)?w*vAO}r_Te1&yRKwx>Jf!6!vL!c2#@8{Mt~CMq#@M z)AQO9aHNf`<<{;�vTPX_Xv8T}O;z<8O>X4Eb7e#rT3BS8$pIX0-uOw)~SNhrHpB zAE4}po_*#10vS!C6P}_gNGM%opsEY-C4|wrsG^5rXs;W)2rzYg&Nf=`Fg* z#z$Z2z$Y^z0S)Jrv-Q*CuTD6fbO0qZQcGG7+a)Cspkq9k@>KMe0_%#K5PX9DNj~h= zBEJ1(PUKRVl~f6#2hPV3BnePE_vlu7H_zqGpDr>4Rr7;owVa>+n+s^xT`feLes#b^ znl>1|A$|fs-0uzw!tp!BGSzgEMwOH5Y?0^}WHX<=d3NbL(NuEWVd=E?Q^M_|zsHtf zq~sqBkqfQ~E2Tp1TESx5rVHP1I6G-Ga=>Wo`r8^Slx0O%hzK-_-*l}vO`6G71xc_W3Z?4Dtf!9sP; zA5$imJBMADOcWqsokT|#9J>RNz!B6yvEO8WJX!^i7onPHKuniwCzAbjQb3zjQ~u_- zL35i?jsq-9F%b_nk!YjE=J^gqhf##wBOTqrGkKZ2SujpOBNK1f z_b0MBn(4h?XQ#q{y#cT8n`w9k@Jh`${~eNvWSfeu z;G6F53^ffApOL4=6T^Iv4Iaf!RbN-+kP&8ZERyJ2W^knBvAvy)n|k>);*80f*&6OGgKH(QNb+Y0XalVBf^HHMrhST1TPOxtnPeW6t7UN zYWe$Sw4<)Fb#Y8~w?eDT+YAxSxqY<`duM8Jh0gSH@Hk`;1if}zk&~mvPvYxnzNxgx z$sidv4J3w$@-Jx=<7sZdTN%nhBg4jhK9pC!nU|Ac7qBUl3NA%bzsucgw;X`@e)0AT z-eFi}Td0}^QU(LQunnbdQAfm$22-Lg2Gk^9#$e5c7M=mt3&qOpl!AXfDn*X zPb8z`D}vzQNyWsV3IqkMr;82^0;mvV%(I8M0Z`P!6=qzcp>yiXALyWJ#2-4EbTQhP z9OstKto@hIJ1vfW_a2+v z5xJto68x#iGhoghZP(WDWZWR<=P)tvS2SdpKQ!QR9z8&!k?u% z{%>+5T5zS9b7y$S3Ve!94pzQrbBNjdPkQ;Xhm7g(QU{|9 zbRdOADhKJv@ybI>dly!nUb+2nN@BO#(C6N>_xy6=YDbj3&5P-Gp)Yi5>)eo>dA%U# zaOXGlxC5xzf10D&|6wo6#_|8)stEqid(mnYYwHaLl+RrKf?rHincInmFdeS6$+5gx ztKl^u>~2=VNM#LMHQ#>fiCagC9nHxCKD7Ed-Y!>jrV#_b2+cSURS4-g=fnzMt(=$% z!>}?7_7bjo-h2tA!xZA6lQmpoKfeElz@Gkv$g|t?PnX-yWrz+T;#z=_MehSL`brya z58J!zvY0u7;{S6MbD!%}JDDL4OzLWln4}vlwQQH3W2>WLlD+9(!ql)e~JuC?& zBUatOej1r%`><#)O_B;k;ID&$F8!2qkRZD2Gc#NX;I%ApJYzuX$fLlaVNy|0A8z1r z5wkhnF&)Bk5Je?{E|C*$@^$|(VTe$c@tC@e@INtsZc(z>@=&kb)Q)Ufz1<&PAI{%3 z{g&EhlsAzB3soeHsv@-g)k>(1Ggsx1V>HUeM0pO0H8v6GR?}5l6{~BY8YH`B)Pn=2 zjZTvKK05*;4AU68x@uQe9L0OO>~ywND=i>^%x=wsNB@G9P!XeaBs=|?S=V^Tx)#66 zS5ohA+Ytw^p34Z?K0j$XPGR)f$j`%40r{KTm%r;pREBanL(V>~&^<^H7_atz#v5+R@w-NMyEC4fO*_+#T@ zb`;}!2QZb10WB{Wg?F~4G%ub3xGhko5Rfr0z zA~E#Q>wC(!p?R~3F8H*+cG~4jMNgLVm3F3xSwp}5wEM72@_Nkm`hxpcF{qlOP=N7f zzNc;urlvT5=(Ya;UwZBH5!|?hnBy+rRaV&>-$GP|u$pc}Jd_^r=XW^wMb(b_@ip)J z4&RpVJ+B(zk;D)XxIFzXC{9uly8Pts^UXpn{0{&0m&e;J-F#U8g}Z$75nS&#yua!s zHO{VJjFDi-a@y_>#w4Zyw&e^aa*ely<-;@2hqL(U#nA27;J$C8|ZN(WPs4%iu)+E#5+5rMt_ex2N=Gj8uxYc6#d1z_jjFJ4C^*P-Zecc={ z{AdD~Bx}pCGQ6|tq!azUU1p-#DzohxZCnli_l@&Vk**y*TIH5ucL?=rF8`phazSIR z9l94o%*MKhtNc?(bq#Km&HI_pEjZH5_o83Pbtv!T<_Xt^$vV-4w)>x$Tmw3gP;JpI~fdu?8n0tQ9GI8Y^h! zE7w*}YH6sSV^a@LEq+nNB=y6%qCPwYPdAS%u?VIZieAkK#8Pg?%J>#Q>sN_y6Fqu0 zmMgD+zU-~xfm3olu>oE?d_!(7g^>(fhOb4hYE_i^jQ8^h*^@9oz{W%f)s|WFr0%_} z7Rq>KG?jgy_`$Mou5S(?n&cV`B(o^@j{c_~VtQtBL(f-X7P%)-M46`}mv*ZepIiX_ z>2*Mcy%DyT)*)bcT0|c#FB=hW_;g>S6u%&DCZZzYCVO@(H=q@SP|G74bL9xNd{z;B zIigl=7*%DxW{(OZlVhMmqt>-Sty9mfD1W;G(Z|f)wm-iS+4{Q~ze1dcEO|jcGJ5hr z-Cro0elL(gloXBOnhz#GuNn@MK_tukEeY)a+RP&9Y=30E6guMRI54$#@?9%~YC53N zy^3SW3%B^qe|bU=N+Yq#5hk|g0MoC>0!Bh+AR$1bc8dzLMY1*>Ut6A6pgo-fZrSAq zn^^k^5v|-B>RrAZVkw?)1T}nT;<;U~QNp;ZTKkX(pGPdU(A7TP$h|Os*~>+VyS~O| zXdpO{YK&6yvm}?w5D*%tq&UK$Ja(e*6kZGdE1S8M{#LlXeZW(C&}=Q^dufkN(p^1o z)lg%;IYOd0y)^oJRf4Ch|3R;mSJBCWe*Gc*ue2^rOYkQMQo8Kn)#Gw~(|- zx*eQYvpucwg2biOLOvYX!zRbNAB#wwkdk2I(uO~^$!5x-{Bh*YbY#P+Mug$$t>X%m zV@@}s+mi|q8>xXzYmIaRKCf(XW<4p$=?l-)+6m9w@@wayK`S56M#YzFp(6XqX<4qD zcj}L4d0!C+#(p9|vq#Dzx5eD_yls>8UP$H&J=^+qA{KpyG*6cJ<~Ra+*9v>#J@gkX zmZHcg%#0@RZHlP}mK3RofVwDjP+qGuySVMzu)&TTJ2AyLg&HJnoZ#97ra&s1b8$?B z_$E;

v}ou6B>1098cjAbcI&8h*WOjQ-l;<#X%$qm$k}ZD2baqELscZY-l>41op_ zEzTR(PgXM&Ljmh>vBEU=suiZRvdm=?CXik6aDk)s+xT$Jfr-n6vSUo|_VqXmvtBO3j8utZ9c`8k4h*+7jvPQS@{8 zNwb}&*3E}G6beTiVb#O&6h+sB(AfQ)K{hOQ3L)3PA&2NTY$ZlyPnY%-Vra>w?f+uz zoq|Ny!ZpCQZQHhObGPl?yKURHZQHhO+jjSEPoKK?;a1J5nNyXgR8}g+Y+2q(9o zhH2olmU>KRTTAaw8~5k1PRpSx`VGYqSFNjXY^b#S-JxY+US=&PFHF zx^jdom$JKpL)kZdJ+-%rz}$@!R;xsx@9S~gxqEEo#)9uI21t}lBn_5*Lw>$}D;o=3 zV1adz;0=K1FfSBu~GK78J|;8M;sa~f{#Y^E22G?ZwOQpOow$molB zK~Cfv@O^-(A$2zYEl~PbQCsF8Ig)IEp|A$ox3wdmu$Xr zzCxj>|1tDwr2U1|l#ep-`NZpx5JDsxM}%D1+us{bRQ8a?`7qTsnMsQHW9k!^`eW)N z@?+|AJZI_j^aM4;F)Vq=M|M>6=5kDHP1n}r7Z;vQ^m!9Py`qHli^{~oE~Ozo}3=rbjko(^@kg}3TU*n+K0oYG++is|E9>HYmX%K##Y zP%vKp&be{bVo`BsV?-!+W}kyPLRR$$l1ia3y^$nLATT~48F+#KLK<;MhACPr4h0bjaVVsh45<{{k;-p}pZgdkqQnVm z;Rg^nm(L-S5NNJBsi?wE1quY_v{J>zO#nDhe#$zqWzu+9`wIloRUc+JPDFp?E>J&G zoV#mOm)&&ExaE#vEcU`PYx_14v4HZ=;MdIvkir+Kyf_Y zQ&2SB(j&XD@6H%67gBMWT;CmS0bD4lw+ ziTDSg)*nUfd52|8G6_&TQR3OL%3HHLf?Nz?yEn$0eRR>kwMk#uqKLNtyAtKrHa-)R zT0D$v)reWAlHH?5qVBKF@!izt8IuYVaEz_=DJ|yw*UAo?uddYpO-i(YkQ?=c*U8#Ol7OUDj4hDU#ZS^Ea+_eEW1=$@#LSir9{Touw`Jre~0a^&k< zD^$v1Kp>TdKh-y-gN+!2#u37Y0C{Kvr09xie|sVt^F|5Fq!_W5x@gYDaY#RoVs<-SfjV`$CP!{=`49$k{2f$Ij z6yX!@e#1U?dAjnvu2o1Mm{5ySW-DJ>XkTe^9WXfjSRfJ}~Gp<#V zF@fLXqnnqAdb)j_K)fdz=-h_VA&)%c;YJQfnb9n) z-#sIy)zuM`SM8j$+m*!g>GrmbB~CCBMaG6lva1aXe3q#fUavSmPqLxsU+t7B@iwNTvVNg$O%3Dv5Aem5iIzc8H_0?x-7DbeqI<~G9F@%d%=2Tn?I ztZznpLQ}WBzg|k-Eh>(==#}Gf**<%V+f(P9qiCOICFxhZ`hIyPqWOvTKo#Y{oSbrq zV~hX~8cidI5)=mIbU@TEPbDz~=#+x#u>-U^IFa5;57fO(ietct1VGUi)U|yI>vSPW zD=0PvaA(%i{8^zDOATe4cxGt7Fe3NEPX4vxR#pu*9ot{N6MjxQP(@+;UWY+6a3qtl zfQsN|wX~nID4O~tO$GAAoeg_o4q)7qEp&JzmFVL({XsZo_xFWTsI2;4Zfm40q_)<_ zPojNdxuk5>NkRq74}|ayRqNB3g9^#j52jBfKQ^&5$fgIRE<1$KxVCFYVCZW#JB;wT zDErgu2qzChA?1a(u^p~?oE{-pc|aHEigdspMOWj>X>qZgy9=Ct|A|XHtS=k`VYp+COGq;9l4_dmGhU6 zC$B8JlxBsN;<>(#17*8`xt0b%s?7x?+lIh~k1heRi30~ReNVgj3Q&=juG!-OuU+48 z>^ETdFx!g+NRdFCT);rPznF4dEWVDza3T^AIWkX(dsd^ZWeo2!!e)rH=3+*&yBwGE zyFTS~QEtlx(!$;s^M99%6zf-RR*LSXkyuarcWrbqD!ZWrayTx)ysgof=Wgn68$VQT z^grRMFi7MOuG}`aIMuU6lNL`9=|(> z@*6bDNkAa$PwHIxF{4Kli5N%gIPw_7H*g|;j+Q?}c(9BZLg>w&B(!yi2$~R)cPOh+ zRlz$YF3aYti-8y+NktY5S$!l1DGy@u1Rr9o{{ww_R@4?^D zo^xwkbhIYkyh2z(Ur|wv)pxdcSeA^F5K_<|zudnCL7G*6_n|y8cu~H=44bRcHE!$j zE@6kosKdU$)%g||R|jxVUZH*BH>j{X@U6ypWBv> z`Ip%0hvo49E<$m#{x3u9KNMi6)W)ng7!bPNsa+F&(~soNQ;VTB9VIPZ7SV$D8R``1 z!%5gBdb))b>uI&Ny(nO`5@otxI37$X6h(H05tm>bh!BxssA*?y=iM&#Wm&=$oKD%~ zx4e#M6yZd@{PY9xV&A=1@=)Ddf^VvKd(K^SyNkf=!c+<=&UXT!FdB-&zi{6WJHMQt zn(@EReNGX;VQOvOpbycu^!Aizcm#Y!5Tj9)qxAwTi(;eo;hrvmDrzS<;kyg(4mRKJ zR91@wzj)GCiKK(S)}5X+(HcT%cR2EzyqnT;t$r13lJzF(RkCo<|r9Mq3S;g&Y8g6UY@aE%e z@YwA`K~}0fox=3X71|>jvK%|7zL4V5u>&&VI$TCF2h0unALbOy25xVqe23E>{g_eXHf|adpYseNr?%^}*8} zE%>F(e?*F~0Q&DQ!8a5W@W#mn4y~wlf~tn@7s*2;AgTs75YIGs;-iPX+4iiIW$e3r zC%LSai}qirV(yzRa*DWT?O|ybAYS2 z*~0oAh|g~?Ad$d&jER9y=0^?pRgsY~6FCaw1b8!7Uuv+VAZUSCO5knmCJSrLy$%HB zZ^np!BXf+F+WFditrdq3i(Obxy?VO67cQC-!ve+Ch@($*{S?5Yt*8A;jUXT#+55Ly za9|bR4S}Wld7L8+ygCBI1Fj(V>l#aA)yquSdb7n;Z!Ww)xTL=VGvB}fPjWV$pk{Q9 zTO0e~o} z=x{KC2{%HMdpiPzW=B*C)p{r*&Xihp{nbf~81);eb)Ah{!U6f3ZhWL{tb=F5W_>w&{_o3>$29RiVW z)o;x@sY-mdbe?LbGHRCKGA9a$HGqSRkzMHHnHx5HZ%baEDQ>VYBdrap5J^N5@XF-& z)LaB|75oZ1rbZ4Fmq9XcadSnGS;&HvBuwl;->_b8LiEG2Ku|FTt#Dcdb>-5 zV^kE!hZyP>igT^DrSpUthC%bUG1{Wy%rY}eFd}x?%Ff|~6K^y1!_(&2J~q;uPpL+<*SlWUBat1CH3`BVV%CUo%!5mqFNM2 zU@D}_y!k6*+!Z@A-Q$E@XSQ~Mr-q{6seOFYb$fNH%VUiu1>5-1REGhkFIeEMMhuo3 zMB+_nql~pqu~Z;|1j+7dx|iSo;>>|+XXpFkV&z_BL6xmh#+2oTv96M^lyJt zY3N-=6Hzx;T^=rf$ytiHw|L^!DD&M{8PIrhB=R{*ER-0R-BDUlheL}hSrF3{p4d#} z^GxM!yJzD>L_onOuIQ>DQx>9da@yqgRlC77;1h~=P$RfVWXvWEZu+Ojcd?*Rs0h}E zf?J&Inhc%etKTO=RP4K1X~wPodqnanBkmNpl)FlF%Lf=70)jckws@Wazd3IE`hR2Y z0C}QV3cZ5Qx}Z*2Kfdy8A*Exi$Mo(^VuQR*l6&w!r#Lt-UqQPh*VNC$y=UL7PB4`V zFz?}xTsm{b3PSXoJ1nzM%F(ORFa5)32u%p)@C*)Rzx-;?0i8*qm z_br^+hW?7#hO7F(7EvX~I3++>hL_S(Or>-X4;ZKdf)E_=G65Exx)d^;;WmIemUg2A zA3){Lc;JbXFzAc<1#d^#ldar|lh4zB=d85R?7uWdqaAS9Snc}`Lh74^r(b=JIdIoA zpj{MQzt)Tb0YS0gC+vdfY$=j%QCddr0v7{G=_+$>3f=G}$@xWm~)-&CCYrFF}P7@bLYM0sF*ekSL`4wO7htB_Mj zK|LA1kaMN(GB{_Z!AoQHXKpTk=H{}-DY1&zp;zL-BpTigH>I}Sm;_msn3BQg#I-9$kvS*eOk#!~#7{IZJ2JBMt~DXz=C_MpS+vzyLKuw+!=)5(i)a~)dtY(~elD>^Ya z(K6);_|uRYw*W;#v_IJj{K+HSs|W8q!hbEq%<(!pOJx*T=zu(MWLc16IV*Q711FSMVbR zo=|=>p@M=W({D^VvOB?4#!jrf`5K^yFREGv{A!?v2NnIkBT$uHHD!I;d-O_v)+7Bq zts{NA>hLkdL>X;Wj!O#gk=im9Jx&a^Qv*)*g=qU)J9~#0chhkDW;`g6=~6&4G)a3M zS@nkGQr+>hZA}X-QM-vgvfpQJnkvX37U4s3dpZwyt6$sw z>Px?@?FNTwESEz43z7#zO?QME_aUDgAaLZbO1oV806Se6A1pP{L(-`+a9nx<`%KRz zS^%%M-JEnX8@G6AWx4aRp0vUIvcCBf9W;dYH5b0@uPdA&vOsm{dI`_9P#x)OPNdXk zuBwl+AvU0RIC~By4CK2fnR8=feWQL>`c09!NVr>7x5z~hp<{4qbyy5G<7jjbJ+HV>#Mf`rXwa+c zlS)7G4D1c;O~wvq!~3ib017Ui;2D5~`MO4|txe>ADEiP_4ApBL6nVl zDg6Y^*1_L(^`e+=xl+6*eD5rCa6-b5-!DI<~esN0b25n~t5QDEEifCtU{h`1`fflY_6*-pZcFOtsZHSZoI385)IR`zGT z-5EfZ!)hVA8~_sWa9x%Lm{`x2J{JkGXGv-{op7uwa1yK0I0^s|u+vvjq^)WASpgq? z2oW?MMwn&|{~g0FdLnjY>Bb!*zlDn_8N^P8%nwWzvTS_zCAd&;M$c2KU{Jvo7h5P~ zW8nGLQnQdgu8lLhXByqL+2O;v+zkJjP~kWB^*OGA5K-(_53$p=F9`neHN{s{yuqtD zgp#&QA3qTy82|gDcZ4Pd2Vi@FKBCuIYEqvW2naTYrYRnCl-#l1 zhvObmsRkq2Gv~fYhX{MwWMKKJK;OgP`KI+i^HrhcZk=jmSQ3ycr1mi`sbJCy_&~KR zTmyoFh{{x7)z*y40ECP&%|IBJ8CskyfJM7T2=^O|H&2KK2SanH^1(4SuQhJX;Ig)j z>`5own;3)k&-MmA*Pvn49|Vphg9o?JFNDeb%ws2K;aOh}p1RJ@F7vuk^NkfKr}0<7 z_&+!nBcTk1s0gl-!Q{8KK)H$gS%tX4s}k!-hjvd$*}Bya&QRJD8%WmITFkBk)q`|P zb7v@g8!I*RcVqQ6gLlwL3#*-9n#SiXmU|M-2t2jF9kOD(I@F93k_q$)Mi}ffVWcGq zP}Cfur21#UX-Xh4TdAKBwRs2~$nqVjb(lP@jS9uRHw67{f!HG*sO# zhW+~4C~0Nwq^dqY?{*EIkDKe?y}LRCLt8)##tZ-~ixvn-bx4o3QyUGu;(h{1jKV9h zB^6@-0)g@E@}&?k5D=&s?CmcmYZ3->Aj)s08ZrIhSD^Rqngm(%cv+)55K76HL*PwzXg^uu_6KBt(IIuwvm4sz(?~^}7^0OG@)=S*FpW;Ao{@%zYUPWUSC0El zPgqN$L?X#E1U5`oOB-f3bTtT@J_;b4V_J%7XWnqqqLK%LEbD^+ts@=CF*&%4Wuc2l z-Tgsp=A?y}&T14*&ZjI&SGDyt!}fT+iv0o4Q66%NZh~FlFvaICZv$4|rE;D31G;q! zqm*4bZZOHr;o@n~0>iEtTDH!?ldWM?j|X%|XNZ@%Vw{Y_`|SNKx@CbHHwhu zZsWFqMImfs#M>2?5>;Iq!|XG*YOQ04${cNnBv#?mz9bEU$`NJUNIPS6#>yxBu> zZMY5iLU*g)`Wfq^K_;16VMsq$dD&P`1q=|$)2B<}6PR5SFd^0X7y!Hc@l-2pe<)%Y zgAbHh1OnwzPpR1eHV~KTqRm#!(Y_{x%^rBCZC?NkXHIW==>R6dN)YH=SmJz3HKahF4yo`zhV~lzvNVS~C7Z4?g z-}8d1`602P*7a}!mLwLC4Q|x4_Kr{r6LUzXpLv|=^?QCgF6Jx81QnKW^KZul)F&3N z^?D~AdT^T9?BKL<9vMYqLPUG#3yLCmO}Xn^wV>S?d8NCDN%Y8&K4(%$MV`WdTD zWu&V#hbHuMFAyp}8UwAAAq9X*rsp?A0lkBsrin4J}Z|0T0$zV1h#yhgnO9%Q{NIyp&fyE0TT#enprErSQy(J+`%_VL=ov2+n?EwQSkr!MGh4Gqik3@oDNQ zEIE70*XzVc%*r`JwXEpT`dCRmQ?;Q9H@;aggCxNtjAu~)(eI%s|F7xcP@e_UsF~w4 zvTDaql@#}Wr7}u7$5jef%sn_G3P``M^LntQKO1bL5R-ol?F=WXV?~w9$9dlqwkg}b z{~A1DR_AWhlK zw%9RM`Xs;@unoOp(V+VGeuBNQLDbK6Br!mP-lCzi1GYZdlHT@Vk1i9k3^kR#;I0Y zN+JGoH`!r$MHO~rryH#Fhi@W4#u(l6X|m}`BvHbV8pAbLED-k${Lu@5*@)wcMcnrl z9471;LC!Hn=4Ff0IbzVc^g>A*;8%YZl?Y>o#$Z2ZtZ!Y>eM zVWHJ>{bc{MR_7s@P)hd7oCx7tUrh33E`8K^SX>xtU@_M+u3xD$6#A~l33&mCD~ODf zvrCKt%H=^qW?+>5O0|Ebh=*_64WnaOmNfOVg?{fj`OUf=wl`y8h3p#PSVC&8hRFG2 zfl^k6&uL={iM0FjFG;lqpQ>UaW%M$KwP2n3S`vaQhKh zftntlkGIeB`O;2+#SC0eNw3NsZzJJu*So!ytF>bf*OspKjwol=$SkXEYnz&$P0!8k?U#YPcZ2t{ z7Wf?2*)ojOmzUI=0oX_YpPLumOssEI@+)FFT?&_9%LWQL{w{(lDVrBK zs;&ND3Behz(R>Wx!4ryK%KF9WZOt~jeY$czK`8XSzep= zSW--gaQ*EF{7kYzpiSZ>b1Jm1na&(gr|gQ;ftX)tc+As&IUGn%bksa;ii-->dGsP? zJ-$A>HWFW}%|kCnycu+rR#%`e1h`|eXRo=tL3tZHjWxQ0XaW%5YZ%Yhqww~hgW3wy zH!+=o!M(Ii(lN*xPMN^TaPSQ0Il)EJc`0asPHY9|ZT3|KMCbAj;JM!Me zz9RwNJ7W->Bmf^eiTY;y=WIpFf#Gkpq4k!>Ul^{@`B9rJje+i;r(6_HAX$Zx=~OdJ zM!XD=G8lYkPC-Ir;a!lV(u|0Hfx1-tG%G&_37wXp3+X9Cc)_-$^oq-0dWBW%@9v{| zLuw23F`2hf!D+HV4<{e;oq?%oLrtCZF4B(BhkaMkLca6@=MTZFk|RZpL*-xj;cMX* zpx*ZMkP@aq1J*A9A6fu4?t43O{asCN1mSBZrS*@ol9b*x(wawVZpw~wgq!@US}(}} z7a#R=^WUZ^VLBha8;#fd!ZhHU#i-~xytfUGMMV)Yrt}HPpzMxD>A)jfIoV&@ zpX3!4*Ej#N)G{*tTWjW@z5fyZR;6iSbHIl7!;vA>?^zX?jNcbtG^`UyKZ9AHwl*U_ zqeIK;pIwzQTuj!M%qDohc)2H4uK$Q71qn3{?>@P|-$Xb0AMY(85k`0+G$O=0{kpc- z2QX2Nemi~ohGX$3Ufzf^tz$5T_&$f+FP~OI)wjv89Jl)(pU&57-nf6L0{$Q|^0}a! zAs)1NDSb8xE;%>b{Bk}%A7^0HKT32VBbxRh+u#2D><>Vot_TI{fkJ!Yxy=ZIC<8c# zvtX&ThY(W`RWvXt)Nnj@5l~1++N<^4{ zNWI^2!KGcFky9gwnOv8c*#Qqw?8NrGad}*+`ynn1E}>K4$&(2n`mJGML@7ipxri|i zB#TfyH~s`In7n~dBitElkv$+SZYMpQLm#W3!R4osr_Vx&Zm#V@4=>8y-;pA9W)}p~ zMc6zPdTvTVnDAYznwDp(;Y#(TlR)() zGYcue%$6h?Q6v|tT7QMaXLQSwW^I;xp(NNp^*HLLdAvJT4__KJWgCBHqF0=o931!g zdR-<4Z!AcK5Q!y@n8~coJ11GWsDxy@dv?n;oSYx2CODyq5%819W^i1&x{7fNDw1gM zAB`JVIUUUDvI8g$H2q<)pJouz4>VbX=iX6SW}bg#khrAns0*+$YGc=kMVYqNCFIwi8^UK`;y^jlHnbAZNL}>B6 z^^TA3JQ3?cDL-tpdOa5uRUU4=5X5-n@l3hpYP@+zYTieg$uWyoDKACuaBi^_OE4N8 z6Q&Uhk|@IgV}ER)?_Q|1g}?l`wE67FoKA*XTF(y^nov#C+Cod(i zDR4sbtMH*AeJT2I($HN@Gp=gV;1Z97$=1tEW$_2Ut~&OGf3h|xN@oPM zA7wyeQf+iXay2BVz<~ziAe@oHR^LiBLFa^}kw8lq{{muPuIRU17Y&yrP|UW~62tSN zeP>XWc8-oUp_so;TU6JbK)G`zOG&+iJ9Z6|-v!hu97Hdy6NHd{$9J>2+&_|iOc8wm zfl-J~gxdOqGsv%8qt-<4sm%@Ca>tCmxM^OyT)Xa8V6$}W0lJ8rV@2DVxVHk5p#oEc z+E`=*_L58_AozaLGQ$$_e}U+9K-b2K(2l!7c?C-mXKC}WPT|??I+BBM$7W@Oy=)640)N`CYE}sc}OtD_U>|pmIfHB=L=2szov1C;Qoq#kcqi$FDciWYq=QAmaVj*ow6*`xNasxJ`qi#`z&vC zGPbKn(oewO=<+Nuw>h~l;#6IBqStQFHpdx;wVEs#)ZS#o8A`BHO4eDjqd**JdiZ=; ziNWufCZia1W(UVy({uu0FQ=BVF{dr6?3XmfJ6b0w#tcNgM^K#S%5vNQL>o&UR<#-L zew{8R&Pa}g{WVk=?H51Hn3$EXc8#C7q?#vQg%qID-&&(0kjqCu0qt>()j$4wlZW?X zq9ml_b!!CvVaE3J@!=Erm3{Bwedhb~(bXcx{ho}}+zShYO{J@`-om)dg=O;TIb{F? zlqhiqKHMR|c$Gt(BtJDeF4kZIBZdyb;pasV=fq#&2H;0L7XxsKn+ES;!|&+byiPR| zA?abkz1YL=z)F@7&`e3`gS_!zGeZccOb`qeFrNti6OUi#3sQ(i}58Urcl#vIs@B-J{Q1IZY;! zI+M~}KN06QRH}a&2j7|r0C*uB*9h8=P~($4j&Kq-TweKud@5;eQ`nzHJnyca@4dae z0a=d3s`#goXAy`njwE3b4s8Fx+s43#jajY01JMy~uf?0LM97rEcPlUx#(sms=#M~z zCuabD(wxnTd@A;rn?>&5QZj+QGv_6)D8ffY`{SBXbz=cgzzimJ{vyL@VZ2duJ961n z4$xT5YhOMj$|`LC7NRh-{hw^`f2B5@GdgHRs(E zJz-jX#aF?!azm|x;uNHJteITVM;kdB0VAGhEkF>GbLF_Y%pdFcrP@ya0Jw73Ua5UG zr)ZZnX1}M3msrPqbYdDlPla}1rsb+hKdcK`8r85C31i(PdEnF2J7_>1Q;}kR)`QMD z>04ubePX90W6%F(uF=}>*qwglkjaLt=7uQtS1)z8{~@P9Ob)zI>F* zCdxP3tH=_hL>UuF5~<@By2Q(iVIm?>(HX7zqZVMXuv=xzqIXPWF$2>avbH)@ht5|{ zd4+0waX7nz5WfH*XQ<;S91%S-5ipW>AW_pnnw>y*Mj+?*I<3Q7bp3X%^plh(hPUW9 zFp&qykO_l(uMg1gh%{qgPnWsK^#u5%wyR@QHTF)JYuT-1Q6k#*yrhkDTo$C@SP{H%1P2?0h^@TQ?b zkF`Cn4n!8OJy76~nusiONff+=*1UI$JO{kIlw)P3jotiRE2G1tz;XNW*J7i%SLcgVBMyMM9_61W&D>-HW|DM*Z~! zHTWH$^Y`}3Q1*P&sR3B>K=OAW0lGp>*hMmUTA~l(^c#8rSh+HQHeEQSJ;s}N46M1O zG2!lpDEaQSMV$#jP)d! zi@j*VsR_Rro#|@WJi+2Y!keG3rmq|9cf#k1QxlZAfde`5R+RO{;iIFxhMqf;i~LvZ zNqJM;u|4v&TV3FY*k&P}@=&mf>R+Vmz1tO?lnt~B;Ci5HeDJbHaPYrHdYy(+25B`PqCvIZDU5#FKwkJb+3J z!cx5b!6E-XFGcjI8TgUEl-SJL9oguiA&(@#Hzb19B_D6rZ1dUJ^WnK@1IFjJ>rGyW z4|E{YLLRMzx@lwgKSDCzFePVo7Y;dWc8l}u%Dq7&bV^G5O3Q1m)7ie0q8+nV-q=m7 zQQi2ZApOSN2DQT3DL85ryuN2lYg_IukdKH694P0sMJ~RxD_y95l<3PP(|m z(9;pbda|BaNx@s4Z+|YSI^mrVLx2sv1mgp?*xP&*{?ZN2;pXqS1%Z+x|0M9{i>fA% z!nI-K1pbWVCwnKYSq{?Ucv-b*o{rgha}WzN1)t$gGY<4~x?HJ6hcz3Vq=+Z!l7kOG zRE`ag7*5*0)w|j8!GPngxxoD_|(WqZkE&5d_VW4LrAIN`~7m_8&98bGHO zU%Bx_A_q$BTb3Vhd{vMBj^Rmupr@*NQkVPW=S`M=<4v}ZcHXVimKJk+tji4k{Gd!2 zdg&Cg7(LRPB4x0)2y*Ffh=~+ejdvhY?@95z<`qt5*I(nCyMsT%%HkT7U^OU?!Fb0X zg9LRh10do7+~|2s%4DCg=#1w^dllGD%t21lSsx`52tqR-n38__qj= z<=@<8+1UPbgjkhs5tAW?65MlBBXEwcRbJv?5*)K(iA4G*gT=W*Ledy9L#JSU7h{#> zhrSV=DZ?d>Hl^C*hvtr-4&aekemCZZujuu&J*xzS9D`&*dFsko6Pbx>j*fx7F} zgF{b&b%V^qrdvO93a=hJ<8T+$p*3`C6+U2*CG}JF?-97haE~4pHK^V)KI&PXsUk>p)SGh%>@+{kd&8gJ!U64lz zAU68rfB2f*;*gp@e9f@fXt0XNV3FHi+A&PS{>b2+du@o|JtW6m<0C)>nz&p!l?VJ! zkWT!I-}u9_PEt6ryUL}?RI#yz<=u$}vPA~F%V=*ov zaPwrdbPCiKHTJ33dfWWQBw1I+twEgOAx20Z8W}&{^Hm6Wc)w3!J*ChdrSR$0&eG&L)moPotH3N` zAx;Yy2KqoR2`A0!JhQz*e{Ytv9G z2H39*VmOZwNP!^AX)xF704|Ao+{OB1yDRIK?(Ox~_owBkEjY~)EsEc?TCFRGC}d3O zO5`VDyj|;Uiq3beTWM~(v0jeIqjjKZX=t2vTIekq zvV#ObSJAe(3yO>|#hZRk!I?nH>P?JJ15mE1#@xjwQ&@#7)EBP!pcN+gN#pA@rI7@p zhi$pdhpGiF3?9tn-{JU&p##~~9X~i617yZf-!iO_vr-Jq;(ox02QOmIHNts8|1)`j3I5_OXp~(*o1}V>*VR28yKL-Mg7H zx>G9MLMA7)`cf3FRhBK?0}!rB4Waf&vNt)@ors4gMiJ@EUf0P(_BoLwJa1^unvvid zoHZSzClRCE?d0q`sc(RmN(DI<c89vm6+F;OVEg8_Pp`W5q1_H zFnBerB6vbnl&uQ6+GFUJ1HL3!<26EZr(4}Dv|*GHPy#Ho4Y!e?z>bm=G7RFYj&k$e z=)lxUDj{hON%IWzP7+mU^_~iT`!PhSI@Gt@F@^!k|QAw-Boj*rx1%2 zh{~RzLF?Rwcpr@mZ9+0i1px?0Ikd%x7+RS=_w~aM^z-!2q280vIV2jgR_lLPap~st zjJ#9S(!RTznXXZ+S^5&HbF-n<#1Ur9^mC^1E~Awhl#M5=)za4R7j7$a@y^=dLFpQI z-rTYP20_5Yc$_d23`fW|T@&!`#J$1#T5Sw*YY}LLtwDDY zKsQ{3Bz*Ij87Iqm-)emOUV9ZxBuC{*#ZHLrcAD$C4s4EI7(SQMeUTeKaP8f)$&Q6eKJm73@Gf7HHj) z`o})tgRS+`^}(6v!|P+A0s#_ut;0^XP4uVek%RqH^dORuKx)8vl}6x>22Sh6_|xhT z409&`- zvTfV8ZQHhO+qU+yZCiWUwrv~PZ*r@Ws(UIq`2+o-yQ+Kim~%b@;+J*U4_qVBUwSF&g`{Y(RQ6?p@bfR=&Gl&9 zZV?2Vi3uKG)}yI@&E5$XE&*m+HtTZEh#64aJ?m|ct?E)SVxO$iXi&^JlR~gQzChH5 zblA!=Ps`nZKGzUm@yY3BX@=>`=V&)W?7LIXSQ=WX=6-K|pTYLvgMOiy7P#!>c>w(J zi8RJvW!s|-sE@x~IczP+xo%2uY3oe%dNP|4Ag~5jSZbA?i5>H%nSPUc@Zv#Y40)yQ zx+eV1Ez@TUPcuxgfFdD&OOI9SDDMl+)o_o??9zNWnqrg-pNuF*01&c$bd4k61QxBS z&7xh+ky5;t7#J)G#lT7DLy$vvjMI)pl~X(=RhgbOwt>82fHocUKN`p7caIZ1Y8~%2 z=309av!{U9Q~4L7Wlc!Cy* zFe|29lvT|eDalYhh?#(@H;N^RBn=95DSnVcV{s3j)I>%%BLvHu_r^(P=QfRpP03Rr zFw^iM(FY2nft2murXd?sv6#!nR*B(}2!-d2o&uhKtvt!t#9#=ax>p#0dJ!R!H)24J zzx>xhO7<2)Q^$$4eXDZyiYy9NXmouhp&=xt*^#)etjj=LtVovxN!y8Z>bA(K8z$5j zrylN)m%e2wV==U31%Rtfo6lLc8wY$IMY4&tw8Y;aKjPAYtOyz9WDOV>8!NX1dzWmi zd0eMFpj?#72m)3hG>X$qUUnxQn#5QvA`B`{92aF`<9Rd*)m)$@Do6~6XBhWgdc)ps zi-R4MEVfZT3k6n|J=Z^dj)-Z^W=3iwV}#SpL_DGCuc2;DsPLAg#-5qM zis^JNFT&I}uZrp&r^5AT#M%P$;HSvHn=x8PepR`gH~*<~TS*%AX&6hKZ&HO!$G1)O zBK%uIt^Zwud3u>bgCr<}gh`3MZ#W*X<-$Mn^L&DT%l9=Mx|#+#8qb+HF|$?2wL3RN z96=Z14Qa71vswIv_zp5+dU^%#hgju~XEr z02FcgWND7yn7$z{DI?@6XXdYql<^!*pmYb_dXbNKPzs2%qA-UYIg%n#&t@(_Nv2}E z*x5r13riU|=0-R<0}9#d(G83nl%q{_Gn#iCWAm|nfx5tZ_KJd&bzncb=Wy}tLwa(qBikAKRliFbe{>O}}0Y0aIpo=m`T(2Gr%?E*V zisV8KWHrtK$QvZ!K0ha*U;4exXx=P}S{dA&ZlHB6SKej2b*9Y~uOo6-1r1Z1c3T)@ zMF5F?7j2h+duG2E-}~3Q^JEgW~C&KLRU z+4sQP5ob3`_NZ`>9xvwAiMKnmy)a4rj=ZQSx$!Rh4%Ruj*%SAorf%&T??j zGwocMk}HXn2*`_=xG!{b>OQ6Auqn@`@1%KUTQ%;ED`;ArHaV7^${ckmB|+fgYIAht`whi-^YAl`OcIz&-)a< zjn!T&=awp^yUkzJt38XNghiwaA^|xKb=F>^0(K_M8#nz9SzfrHCmGe(eNYf1$xp#% zbXZ`;G!YWB)iw485kyLP2#@pz8&J#OQ@Qm^2Dv(d0AMTOfNf)pkcHNXo|-tGS@h^M zpwU@&4SLVRC>(uuw>PS~i^4eW)<$r^r4%zQLa){|?>8Z+?B`AU=ORN!D%8j$))#G! zMHHFbfca>RR^z49b-k?X04sk^tMU&g79%Tf*Qg2L(9^X1EQX|VuBvA@heqz0+?pM} z-T ztH6Fu@ad0?c{GbAP4NI8?JwUWfXH(5`zCzYXudJu429K*g#IXHH=wtFhFTnNp82Mu z0yxO0v?B3b`a$(uxu{!hqp+^T+7!ukBBK0NXV76s=e002MM&W;UpYQ3uzZ$8&y$N4 zQ9dzOXN?)+@Wt8<%!8~eMm{=|t$6vYt9O(;M*6CO9`K_1kD+pnuF;vjUVDe_LU}^z zr+eg-q5fmS++R7J&2fj}jycfAR%?PE+@j%a!2vY1C<1i04l1|m#lcpG#jw5;s`#6E zE&}Sk5478~g0r{M+CfdH*^}0|_ioiyuZW3`7z;sC>FPaPmQpk8YjVrpNbu4Kt8TT6; z7myTci9H}G;h@P%>S>I2?ZXjn{`(42v~6BLr;?NFn(pr|{Z{A1lA8nA5*Pu(O{zn8 z_O|3M{T-jL*Kd!9{l&MRMURKOAAWc6i6fej9Esss%H%#fLS`cxG8^@LF2TEp%x&Bh z0>&~w(B7fU*^$9sVj;aG65gB+blA%&9Je^04xs}nzGQB+{91TC}asE%)Y!nd~7ZNQ83w`^O5g0w{ zIXmz{f=BTxAw(~0s;VJNRJdPHD;?A$ae55u0I;QEbPuR7vtMr-{TM@NR_QJ5znfo` zC6F20f+f9&xA@JJI#2z%n-jCM*rImaC z*NhZ-Z={kUii115AY6|bz1v1}dT_zo##*^8r`P&F`-i<)BGaqEMpG<6gL;v97ADVg zUt-O1AK$H>Afj`NFor;$!MvmE(=9xNdaHjPKlvi>!QBc~Ielu&A@SD7_2}3BwmyxI z@qj$-t8e<&&nwtB-027u&+UXh0H}5x@vqPE7n|1?gD*4wFW>L`Olpwe)na$bR?w&V zo4J}EKma!&6wiU=H;{pME-{csF!c3QY9(NCbO?Ck(zO1;eaKspYH#cavefxmLwm!N z`@A0vx@Ly$K@SkDL0>9I4A8DPpCWUwsEi!(%%!P2k(9^i$ z6Vq<_CLopGz!IaB_vmU+_&{FA9%qk!kGvEQwBOXuB7Eb#xSQpfAibz90Vj~6fJY<4 z&UgRj1d0rd^E{f?`5)`n-t;*gQ_c2oEb>1#Jy zS{}PU=xNG?na<2;$r2*#&kmP|*p^nTT$UavDXM+?5_VP4TLKVJK!F7;f>rl6GS?Gx zg;gNh`x6Q+?l(_GPDd$Zp~v?1{7=@osJ2=(!!(@JrGoXbDBSI(&*<6j?Kntrv` zFw-Un?K|Yg)$)m3B5P%S65OCA?2pjj{V0zuW!AZt;I^;eHZ91<%bZg+^G)%SIHH*& zKfoDOjThQ` z!%#Meq9H^qB=cpp?unG~=09JQobR42Kg!!yj@AYrq@JD0coYoz2o-32ZEu@g)G`9@ zXrvar4(H1M>I6^{ohe7#(+I0s-8kF;a&nvYTM;mOGaopVe+RDj%SxjM z>Bdlyt5;UrFuH*r5EK?ZYM5eILc$5~b%k09aR7~~tIE3uRE|Z<4obOn|7Fd>%(&RZ zEzUDRw)>OMc?28uX>9iZLgL|qu^bjLCu59J2)Y|&IVBwQ0G;8MI^kBj&Q(>T3BDb6 zNq=s3nTJg_E~PzZ(ZoKk-@2}ug4TvjSxf%Z$TlS+l?FU6s`kc>Hcip<=z8 zLrD=tys-Y}B$)0kNbFcL^YYf1T1k9;4$&35!!&5q^Q+($y`#bofBT~eTf-A8w@|@f z3x-+@F;9CylM^;R=kkF0!1D_>4fF_Xkv9fv((*UjE6+7aVv_WN!+zgisx1ztWw8EcSOv#8Mq9kBNoaCCJ7KW2(=k1@U zoO~XP>FP87{NYamrPX<9#S>@B{m!ZVCMmu3W^}P5iPh*XVsV=t-W$2`Y z)oNCVHx&-qcS(D|Gpf-SlE0>(0e-$vI3q;UWCMvKs`RyG-o3?jeLP@taVjftGQ5He zZ*tyoTAHl<5+Kg`*^x0Ky=5e8W~n$U9Fg{3m#KH`!lIoXJI)i*hN%?J0HmCZK=W_4FRcdqG(z=F6@|xfT_9=a;`MGblDcExI z`e~9tpRA=aA0K4}*_M0P3)n6RRKy^FFTx?%#A0yZoeQGdPMIQmiIPv61492D<;jPx zTh5$&*QR886_`uH9Tz5}7!wh*9c!O7i`Drj#E&s{w*Ygn=O!e0=Uc#+M|cUDR5*pOUV(*iWaVi8tG} z#FqZR1?0&A<=@YSV&{^LWIA0MQ_mx1XVq%-KC|3s^s;2-ZBz}_svAL>HgQ?XHL2E@ z)|LsD#Nh~$}KMY#lJP%$mjob@bZ#28A%;8kujqq-r*YYn6@zj_lFnA1%De>6dtq`;qB%Z3UanbFTK!Z0ElR;^_`|%m z^WrN(pzEyg?5(~(W|$)FEpLIJJur$Tsy2OO=7TBUaT4TTL|f7Y_?pAxX1J59Vs;(pdqi^55QMoUGRTW zU~K=XKa27IN93QTru|kc+CPHoKe~^JMlI2E#&AU<5UA7Pxw10M5oR2%ORI%r*5{=+ zoTMd*G~TQc3K$QHXm0H8It7~In=#_zzra5tI!?*vn3Kz@TXhj-*+q&knUDDP*_tFf zia(H2GEWHmznj!(h$$#CEBi&gr5resJ_B$k7P=Sal?jJwi|x+4A~?Ek7kTs=S5 zADgKE)0wr{T*5>2`ny-B=@|k*B_)}42l8%>z%5CXGl+H4Aw78ZECPY(zoFxdtp3-{ zecJVFQGRD5mbQ^<*G^$jLP{_Nv47FtOwKOh)tg#sXb8ioJ^669&!RcNy)STC#HtYA z?wBhH>R)nKVEpj;z!NjCo&l(j z%P@vys*{fe3nHWj^Li5jOvV{YZ-Z)D-4#$da5A>`OtjA{l&82n0$tZrdl|bc+pezs z-e_95=~XU8lF6Nzi)3L!j1rc*M`2uLdE~Y=Js%p!})gNN0qILpmZevUW zij^A9GrJV1hN|hD+4U>`sxqAvxn?hzF&aFR?4HLOjPw9ZpamLNZF@-3@i{pJFE+i; z$S?S7yhJ2t77|Go812m56jdY@me1?1mfRhkVDV%N2=xNH&3S^6Jle;pE+mJN{sTFhi8Z#S(GQ*!814T!wF-9;$U2v?mifCC5|qH$ zaGe~n9zrDOfgz8k^U)GmUxDIKK*WbTSnns>t+io+p$#bx&TN}_SQzReLT6_W*MUYM zyb)5F9@sBp2xbd-pRahF@tO^9fpgv2&On>n8*B z<7~JzZY@sskJC=t)xHca)O+*rmExC!Jl9<+y*o8mTmZiKBHky8I!H4!^)m=r0zoAY zOdff1#x$2PM{<8*5@|?s>dSR#g zk~w`;5?lw4^#&aeds2`ngJpZSdh)iv@9z)Gy1Ed_l^_B1b7#7Qi5Nv7ogpI)go_2> zl|8O8rPy7aK_FvGVyI#yJoA9lG%#Q(&sbLhmK!n z*nF*o%mHNaeUq4xKe+KvF1BVf6!kQ6h0aRq9`?NPURgs74Wr$64sn6!*RM!iaO71v<;YdDZEeKNafO*890G0)eg~wX4 zvx6g7d4TH#3@P{CiI-}z94I5HYx85rN&cP0!aS@(tC9R_7rl{#b2r<$6ZPoYNlV?e z37;;6vPun1T0EpwaC$h>wA7t~IBK*80p$S?)YfGxw{IlSY28`L&GZ-3rW>tHF(j<@ zT25q!mN~}$z3iZzZ$WO3|KZu{9_`4}<8)3b@vp>dI#n6L6#)egmAg?}$AOK2 zo)6$S?E!*ZrqD4K$sT7XuAKlSmx?|$oC;+y0WX-8WOmUZ10C4mzYOxWGkx=WvrW ziQ$#1tNSi#F7(PoKNRN0>`uOl1b=RDna3o5MCLzMMZ@r&Ws64l(Elc^_l~*`1Wfge zcxJrN^Zv1qHpKUl7Dmx1*lxY80{zaTU4Zs>!$>_u)Mo-)6Fel@^McHqw}^-J#_hrw zJHS}=)yhM&8<2|A%{n3s>;`F)LwTaj;H}38cHgf;(I^RAYRI2^7LkSz?Ov~7cGi$K zJe?lD>D6*~7~u6=UvK)eXAHo@YBEP*ID(6*#_&&F2h9{*s-|{9N2fkpSNdEZ;Lt#X zO#tJX1HV19g$c5&vsa6CRS){rJr<6)?L)ZexGq*>blD{oVX_zFIfUXGmFUe|!A zFQ77|H`}Jq-`T>RhTXNbC+{Iu(&gf~Q#zup&QnL?ZK~gpIMgWE59Clo=`J(h{Env% zulWuQKtuV5JAS1OSBzj5CjFUI@O}9Su$X`d`O7}Ql9CVu#*7d4sxP9DdUj(=J z4x7;yal-^3F;Z_I4f(a(sbrh0D!X-!Htht!v%iVh6@N;<4e;rt-70ATaw01mI{66v z#=DLo3<3mMx;Uxeg9saMVul0+yJpEQXUt(n$!v8kVjIaj#4X0`x#t zUdrQx3V<~~=#m)dJX2ht^bH{z3o*!H|Ek_ zyMtfsT(_JU0~>zU%$LPLf1wIl`c|60 z$Y7TPlp?{h{oQnsA(wKQPZLM#^Ih`aca$K&zyLY=4+BT0P%xw+dIhXHEBS!R_!1f^ ziKy4P9DCd-63K;J5IwMR-zNA&>~2itsoj`?$6Jos{F2e!&9OJT)7(F~#g;f*Gd7y< zgb=SdhrdAWInG1>N!$FZx&DV39nSxr!1F)u5*yObKX<9$H!)CyJPL)>SEk8w?gZ+{ z2%k<=8AB&?2bD@XPLHkapSdKg#AG_@)Xjz#K^m29&fycrj1$Je_k|cP5-9#X2dS}l zAHjM4a`$9Os@` z;g2)9R6hLt8I6F2!on*NT%*dN{jm++@J;9Rv5g$1>#eKshMg&6aJU$YrY1#+;JSSe z9`lfOlFpU~iw=*%?KQxW79_zOBwQi06w zw3nq+4ZoA~4vV5w5zs^t)(OYI2#i?bB4PvGsj9KKi1?Ysca)}ByMLxJjc@$(NSf6< z!{>Hm8Ma$dr8vJI@=L9THN4701Ie0EUbH90)HbWG3U)B59(-kUeEdq4PCdu;A7*jn2!gOyg7A1k*a z|E1PxUg=`wBtVVtvcD5#H(r1XN+=?LA_PGG=I81*)>n5AwRf8_jA) znt+E1xG@)kMSe9@H=bBlaV-pAV^_=N9I06b$=#PXYY!wR?yl^0nMr7&xvpkg+Q+F+ zMT85!bC0BHF`THugP(1g5WbPnh1X@lX zWcMN<$~4V~drgWMvBJc793Rg-Icu2lOX5TiN_HpkAhS zxKoWn5$BJ+Dg}ne*sPl3LNZ&qM}|X4T|0==!at!B-_QG7a4LM_Ecn*f05b(EbcQe# zU?CND3$kSl$V#NrD+o@hd?YA!%rLekA@Hf;mhw(gAWnGgMS2u~K1{BMkwjS9!--df zTq}GnyT^HjkOH@l4pBAshzrz`4HdB4#Iw4K?*g$%@2ae(OTzXE1m+gwYP*di`r-%g zl^aTE^LO0~Uk^TmFO7i$o{i7QoOoos**c}=O6Yx#SVieUda(+l%c~DxxrtWBF1xi$ zrncwsFXTX~fq1u%ZCnnJNP;EeDeff|=12npX+BS8F4RDioYP8!2FPd;zC-n@U>tW^ zET_f?D|s&*;3aCj0&fy~`2C8Xd?Vg_XZ)^3iQo@wfi^wEn+Oe$U5~>4^%- z!+3at(*O>XaCFO+V>@LKMcF+bE2BQZh$dRYo-=x+Lk?&<&`OPe9MGJ|XNDfLeQ}RC z%x$Omm~-|nY3sRrH`aLdU!`Q6Sc7!wA#7`VzgNSNS&k!5#jhet7g2gV3P+!S{?E0d z{;j2eB7`Ec&8%#QcQ~&Zg#_34#UrW@&MBvet(+4?cIFAa6_?9)(>N(9lAE5P0X~cAZg!E->17!!$a^Przokg?Bn(D@9Hv&gQHRS2U`Pld*^p}xl>-SHZei4WQ z!yUzkv;OS4#O5vF*W53DfA5ZC@js6n#_o1!i&`NKZWx;`)hg}Y zCd#4vi5M#NNL5BH3bO2^$Ezq}(0gS4bXpK^Z25?Kk4I*)LHksdPD>c=7G&N+q42xD z1EOUS(-0XF+nv8vc?-V!VXaj@t58(l#M*XVsR)rM)y*=ys*`5Xuybg4&{7ivT-||P zY79@aX(g;(KhU7Ucd+0`HD<)4j^-*R>M@XtEZ-31j1FSN-n9~>2UmL9cJe~1eh~L| zp>A&j`XPLr7IZBzm9U(VGs2x8@Vh8j2i1sftC`t6lE~;Qx}ba9HC7!ttF?lyw>n&5 zSyEY0K`OTugpOo&uJuzL{TKm{kvw#=9KT9sG=a6Cj5-zC zgh0(_nb+u+pqmAB0M5N81Ur#9Q**SJ55j_#eeAI{vGwMe8K{%NTa`{Fm2+w?0V(LkR-E>`;mf154zxGb#nxn795~PIn~;|0gBI@t>3w3j_Oq3mWM8H^p}__CE~h zdKP%-g}F_2{g+rm6FE1se|K?>7&rA%K=K=n!ASbFng4f1Zy+olvO{weij8|$_?-=U|2Q|be583J~PNM>IE>bI}NuHMDSHC;=$M+;ox z&S4?50(pLklz#?RZnc@Keg4(xRN20Mz}?UoUZ@F1fOb9AnAPFX31XxTrOlPJ5X1oD zL(uv7*sA+UBNX+unc^OZbgegkFQDcj(?wIRiM=dHGXy}b8Zx(! z-y;shnhn^*dl`_d6z&n;w(t9eWiV8BV#&VOkL(yQcmVmla<=9kdi=2X&t?^1dtH2Y z6p6bZQL@l)yLdeaqhO>9S*8j>xk5raP!RL7;U)>01%Sc=Z2s0Rnszh!>EsD)Me9Nd zB=8aJF^(Wy11wL95w}K=v~OM8G&-am8|s-fePN@mdBmhg0#t|_?0#Hfk5rG;@g2l$ zaw=UA{gZd!HP57$e4ok}@p>s(g{jh^P8WF#0}LdRtdq|fnLE#!51suvL@Q5s=AN;s zDgYpX-osLHKzVjG*|dW^K6Q--@f|Q7Kog(=Xb`}LXursm!2vo>H!^$-BrL|P9{T{E zOZ?kO>r7hwC-P8vPHDh@Lc)FEF930AekY=9?c5PrOZdE zEnCew332H?4Kx~ZU^EG12YEJ507wZw^oA9nb;?0o!z_`zM6ALCe?=dAO3qVtCq)wk z0!4g)ld41MKLWL|VytVReIId7<;f;hm556nrYCH|RVzSK(VWj70WQebl~{DJY2TBj z3=Bjl^{B`)EH}jbq5DjTN^&?>k+1H!7~%1v8DLpu5XY2x$}$LMHxE63P)?K@o*YT& zJ;*^tQ28_)rVgKr@X}b8)s-?obVRs3M;{&DrQ1fIgQoVZnqt(~Wn&HT#VE`?Qi?H!0V;(M~0gbER zR)O5+jW}u`b88Q_M1*wk#nqYYNh>N+Ior8p&{_92B`4OsvCUZpA)by-*)UV1dB$jc!!a`jB( z`^iyl13Pf!UeZmJc4|v)wDW0Z9;&k(egCLWA0P~)qj%BtKrV8y7Zf*jr`9LQN7K|v zPCb&y+9vs+!q{nJls=Hf5~4p@Ay9&AWM99-I%Ep->4mp$Exoa=@+5dJ_NQy1TB6wU zDh}{}rfUcY9(ydTqHoTXO}IN|ol9d9-I|!h6Eu=P6!L$vd~yBp!-X}!YwgB-t{Wv2 zDHn}Tn=1nASs)0Ps=pDv^!#X4d=8-^7;)vCJ6e+BOI4sFlIZubg?{&qv?-DYHofFl zZabzLQQsT`doem#Z=CtZ?brz=ja5<}eLP$2!%pK{hD${MbKqCeh^CX?h_*$U9z*8s zhq3MZ=EIvXYttH3krnRHK+2>us%fflSepy5(BlQ44b~U3(WC%S^jR~J%jU{nb4BxgnC&MT>tE#zeZwwEKrQ)&?;#iKs=7r*h zYhSqbx)&O?GtR^a`Tj21Vp2IRFGJm7-7O8tT~Wc3>ZZ0#2iHQ)r&nmxRrhD`y?bq# z3&f*EGZ}j%>$;bq{<`F}{Wu|kU=a11V_PhwfCY5d!0EtIj<(2jlza-2^eG)Sn@`%D zw`5Z4S+6Z{!9IVLp|ko$xWFALZKb~KO)y&Hd`imK9Cs+M;5R71;$W|0lJf{&Vs9EL z&bdAnMp&p`3F#140>V_s;1$*LnI`oahvsrC_n2kw4ps#lD~(mYcp;eWZ4){46KeGEd1s|OvZSo`CBcwEDl2{}zNtACW?BggfP_5HXSET<`7Ewm zy?El$Wo5Csy4i{5&A75R)Ju4|@kP67cOvSYM`@G-92}(*nL@1*u}8f`3wNT}G^pvj zrh{juGTX3P$Qy$^JbJpJc}w6hIgulu0G8k`ixj8i9+OGWvsb==m+U3xeCl?zJV0Py z@30LXh&X;e47D}M5GWNAr5~DBLz+^M4?q@B*2tZ9T0emiC*auJf<6+Uh6Z9IqMjiL zq)v0tQN20IP)E>kkox1O6a(Lx7tq6uh35d^; zInwCXf?SwmG&zD_a-J3fzA))Md^b~jPe;e66YrUPoqgX_?MGv1$Bz#?9-GIRN|63=Km?Kh0n*-Hzv%CIJiY&AeE43DaW3a_2G(pg z{a_)LJXh%E40DYM#;gO}_`3CBCcsPFQm|y;$G}{#ap^a9IrFMM-wa*&;(k77O^%gp zto01Kp&=+FOq=!OOoHMz@EY2WK;suB1n)7shgYyP4muXgNxB=dPC%awDAswMh=@5s zAC1)0bIDgySYjNPV!$W%d$tSOywc9&j7iZ=QO8$W?(Fp|+Qsx8;cB{p&NMsR-uExC zbg0$xe-dv0%&z~<0%K(T?}zJpG-RDO+5Uz2s5_LRTagI?01*uA;Edjo*p}56<1jgj z2}>(XsUe~I4ZHgLx&tPVk%q<5%8G*r65PEQ-n*d_kOn^WdZ7IJaT?==;y-GjAjp-V zM+Af<-l6?zsxv1kM2zKqWxwG&;9-`^C@trvPz2L!nHy#OY7hN2b9?!SqKubD8XqYTRy5o6YThjT?Zh_xBmbs|^JUCZjGoK^BV>XI_|EWDh%v%2 zDF{IVph6ib)X$XDXI|u(|7F^;Qp9+=c&iMLSpe%khyfXa5sO)}M4z}mG{dkg z-2-&N^x!VaL?2+UIyH$+MVSOT^j5(K*#O{mj3jla~Id z>)IuU{@9lo>c=pWQ4(P0DE3{cVSe1*e49@n)SHO(LwyF>pc?2aLD}e(( zXF!tXl+Z}fU<7;m&P184?j{`lq;E^%uy6c|!`*rN@l_lFk@uh+KmV>}-=C(=hQMtAvEiigE~>a`VK&e4@E$uG�wJH`2(@_$7t*N>h z3W@*NETMC_0=3F_l~gz9JeWIGVCXpubziLOSG85o{H)>g;4}_GU*B;DkuwsMM2SwKIGey8 zNbL2*g~VQ~

{r%*daKH(X5MvIVsj`}L~q^8Ed4bu#{Oee`njeV9)tukX(qB2iW}gLlHxKI&qs?UMke>PoCWR$8^0?_{E7AVnBUW^(RWsJUi*WZ%RWYxqUdW`3K^C~w zhTKqV=?9Y{=^S)i$d_eZO47){V})(hm=FN{)oo;B1J|@%lz@^0LYSz)(qdtT=Un#- zUy(fuU#r)f8T2+5G^*%nHtE z(H3c0#SQxGGaRQg-0?jHtZoB)I8jIlL!a#0_&|q7xIF~=HA<7|{dU|gf^aRi{7dxp zt5w&{a^4JBiVqOCoWf1BU6q8cju~s!%dLveiYr`0%(xt<9qPMJ9$G@YFp{^eW1I_c zgkgrkMJyhup~!^&kUbP46Qo*}efXml^vtVOgH1E%dyIsANEvR-R$BRai%UL(XLBjf zQDuky$f6S_W$~%pK!C0BKZ0$zp=ETz8^Tf*(S)&l?ls{bKp<$3hb&$wVaw$aq=rJ- zLPaQX;tbd4BJWIpzKLwHueS{P=$Di;+=Xnle}{BMqOBU{K=EGTYlTiQ6m0MIysa;q zM+`k*J2%hja=YENH%QoSH&&N#DvEgs4$Zv}1cHcK-Rq4_zJOxzzd%U$0;VqH6_9n+ zIyQ;j?Q5SF!CeW7gj89ElD&J|28$SU@*e``_J@9yD_sMrJU}dmw(qBNTtD^? z4xG5IAu|;a3WgtJ+XxE(wN`q8h+K=#08sMTk>|!MMjtYKi@lW`VdBf#UYOKCQ=u~! zIQ*hG96{<1bg}IcraaL`e8es{4oNZeOpggZr3+<(lEx?$z(+BPY{ht zzX|QC-&`NBY?d`>r+@zi(8|{^`VVi-zozd0{jFhQ`tQSddoVTQH%H#L`-0>_K{b$P z2C96W8r`x$0JA+l6@~-*QO!vQQzV=vHaGQmZ!wgL(;C?6lxXU|PCjm|#h4=YUpIBJ9Sg|hecdboDIf4_{HBNBl%)7z6zQTzM?`5(@ZGa!I> zj3K8Ie50(%B@s*;#+zJ-Nwln6)ePlb0RywQR`J;!aL{~Iaz5%f(qVcyo>lX%PpgHU z#!d|SHK}T1ofbq&g6(~O53fkjPl}XAlt2j8WjQ72D38* z5(8ccxelFr(<>rL5I0LM=@g4ZSx_qDQPU^Oh-W^LAWt>O0C;2yOb6=etF(v$1w4&(`l`2xc*Xrp@I=5b4X#DFB4^fjGl9>j z{-X=eGtIfdVi9d=pQdMde~s)9t}*A32IFqG_X`9~;#)nCLn-3QY5Y9~WC{JR|#a0fuwAO*?QrN}KpSS#Wo< z$f-{z+s;47AhC22Eu$J!DO#lL{3)rxoqZlHG%qi|1RM9oQMag9v|M{T6liEXtjr@Z z!xS+$Nbws)C5M-N835##=haY1kV?L@yTfV6qs%{WblGJk51Y8KEpE9MbFG%xbXhJS z61GOx9osi>AysISl<|n(+UMDe!A5}x9f>S_q^{*sb)7Hxj(IYKT>Lj0@caiI#z&mX z>=JM z>p^iOLcj$HaS;v}o!Z>ORHs9YO?EKF@Om&2x~X~O>hI2t-|N_@^U>iSb+24C6cSX^ z`T#`r8frJwSHssCzAK701wF&LhkH@ABugNo@q3P}Q%2a#XpR{(5*{L45+ZrmkqD96 z=k`-u6QVxKEL$m&Y}w{k>XcTpG@;V-1v6`;b$Q#xXKSRt4Gakryr>OAq{t)1`gIK| zBJ0JlQY4l!c#*lVh;R26vpl10GUk}5;N*E6^Xh_PEh(-OOOY_!4VV{6hHmOK5RxdZ zt_^K|1zeA9cjgzR=H>U$I%0cE4QEnPf=6{6L*uwF*`vbwYH`r)2cro(`Rl@VP1{*| ztWT7hjTh0>c*#Ggj5ZM`) zKRDp0FCyZO*CI%i;X$26eFK!{@a5y+U0%Kw9BYaFi=3@9Ao1khc0X-LyC^3|&YG|1 zxM_$y@qQfKdT1w(6 zcbDIa+-eINNnQhp5w>}k0+E$Zlo-%i?n}vW2NT!SwLvxp6_1EyijDP&5Gl-6QAhDB z2mkd%maJ-30Y*kFrC-1_3$coUfDB9ZA6Ed38Tb2|0*hqhL5L;oobPl=P>;->161unn3*_ynozIbSru#;|k>q zSQ9kHw9F3(hIgG39H7xXfa&OrW8MOH3@c+;>J}(Q<+(DhJ@TBkQdFdB{Gvh?5Z6qw z^19Tm413XwzcYf35cVI z#6ec1Q=#L(WQTh&{$z_PazFmIlj81oMG`b$h1uRYK;&1{T15s^{~o=$!SlM@tNt3r zAf1aUmUmecXK{z7UlT=vb|6>X>pTZ~_9@$K&F9r8lcVRcTfO_PtDZnrJBF%zcNQ>MyDjK!h(E{3czv zf09SY@4cXe|*4_nz4`0jji^8-OK^Td4;N(a$ugTeU*x@b#u6NniuzTR}zkRFqs%5;O!#p zW8pjA_Oo#QVYlW@p4Hs8-zpRauYfI(2;l~x2B9MbkrD4Z=Xc?Lg9vA^t!?-{{2*yF z{&}rIcfuZC^N6*MOze@l{a7m+kwSeN!`#W-fe6i}H$*`o*|{+y2ZKmvf#+lEzUuDL znJQRe^cOCNUo9rU{trDM&tYTp4$tYrOwndvQWkU?ULHWc@}qF4$bMLo9>_OnKYrnA z(5Rjy)M>BL4c!I&c4+QSe>a>4-d5bfxH&zuy=_dGwv|tZuBaF3=rK`JJQr8%ft{tm zjEIOF6Eez}y1AO2r+Is*k97ktW@AM)4@X)0T7OW_Cut!V*_sdL zKH@ogFs+$g6pZ9Z(WJM*>Dy?B#M~Wpz|vPy+IKxDV;}vcg+6*SGM~i-j3&kI{n{&?EhEbJ>&lac+d2|l63#S5s1qg+g7;j2)+FB z1>|#yEPX)9(QI$E2n#yRtQ`#J1t>wfHsA|wx9m&kA#?$V5oNN608(o##MrX zf)&BxO@+bW^=W&Mwe?6ZP)DAKXLM_>Hq8tRT>${i&ToKYH$XsH=vb#gjd$4qnwxu+ z6tH+hjcVYt%EV-2>JerX!k{!a1su&*LWX|^7Y~BP?>t2cq5>NShEPukr)lb4VWU05sYw|AfY(3<@SYNB}gRBh|TcUO%8DuDw@IG>+_&#NIW7F zRU0CoV8jEGhHFGH5{0&i7M5ul(L1Ig(hMoD3<66+#v0*-y+QvP3c~Nyqx_f`1qg1` z*y|GK5RW7H+z@XoKq+x7z=BDh2d^f_xWKYYl|$ea0cq_9t|lpvhzU1Bgdc&Sie~*Q z9*KbLNgbIu5U8>0ggdK^aDtK!Ko!EHEjiG2B`0tHxN-@1U{$`_Zu~x6+W({7oA5`P zgyGZi`F_3my-YBVkUX>SGkv+(?C<{OlYCR>_4=w0Zj=4%xOVM7+!7xB=hA}YFl+ng zdjI2LaXEbG+144eI}fh!*YjuS_|!$MKY`AZ1-W+p(|gO^50o%4J&@lG0O@N7a3dVJ zduhvdTzhnneut^5gMj&@U$p>pI`FTzTCNJPDa80Mp#}WmKf-YxBFn<4ps@1}7E2PU zAU7C4cJs8s%hZ{tvO#Fg{Z=+G`XpI0nA9VUE7BBhN3b0ms9i$$mK0jQ2bXCcEEL{7 zCjTWfMsI~v8w1UgsMDWgM>}TQ8QT-o4qq5QHeK}opkgbBomRbH)^1AIfj_=Y>?PHA zCyZ~J_I6y&8y^6pWjcgZ%l?XbWcD@sT;CKg*@?m4#9HWlY4 z#_yg}+QeoFh6ioah3VP))+v7@m$Jdbp2{StY&aOT@%dAn7LD;)@=pJF9?y@M5cIoY z6Qj0Ps|nSl=#>b`WjLRDE3}@7R@N@NN&m84PImLWG}8=a4bcT@7_#2`?^=Ks&Q-yD ziCThduFxtsc-qg4Q=o6%W1gdm^yOmtnU-n*oob+2Ev%*tNiXqUYMZDval&6k%Es7H zpQ(d`#&i&*#oS3ObHV++(wA7k0@Wk_a0T5orpx>A*z)^>1v3c;U-Ea4VN#W}q^Zfo zN0alTCsICo#lGsXLd&k@&5+&T()x+rParS=D`zT{q**1 z5YSTaR(ni>;Vlzu*5C^i#d3l4FVtjWWc**K`9FeT894sq8juZ5t=PgLfKRSoFLBDE z_v_~5o+*2{Y!NYOI;UKFyoi-))b1L{rp)b`l6SxUHF&=g%PgHuM)~P!&Dkw*IKz8< z7)1mI8u9_E#9-mUd_wLiJc^O+^=@xt#kExkLGWF_{FL2(!&cYpkDMgZ3J@u(6l=&KXy?8=0BkU9;V*C=>PP z8(vRs^i7vY%b3@5I?87gcocAE33K;0mhp~{a&?PYhd3ui_{MrjEyM(`m#)5Y$osBdeS33sv8aoS4hqWD2(yl_y(M(yN- zP@|ysl=zWR_%piT2Zxm(h3d*0*6~wUh^&r8_+|5Xf$GaXi-9RrKu@V~2(zZdwR3<0 ziwZO!tOJVt#%=aWnltw}9Xx(&n?P6kkWPN&DE@$+9*k>Vg1sp$aTxX7JR3EiNrK!L z<9&q3!?ca+V3H*$YVXN5VZy4BWbhc|9Yk^?D5ake<)3zvC4|aux$p1qJ~!`Qi1=N; zK9`(iL!L;=5N9@Faag;Jc*I1{aS9Y^i3)2B>I2yfC}ThzHy0p8r~(y?nJ7{A+ABmS z+f(mUo~+M_H~G@&q{^Jb4hr5wAlOHNR+~{Y(iD z`A~9bFRbt4Jo%rnL@5OXXYy0Pqjh!Czp^=RrYkMNQTZI@`$d_TE=`!D{Pi%2;!uyG zmhmRC9}I1!zcRkV95y2ubtwp5g60i@6`mr1DQGrL{I>2^DLZvISL))bH8rTbsq5SJ zpYGlzD9;-xSYYC+1xGxlT**ikDG5nK(1Ij)L^2ni{h3kM#7+TqPL2`h#pqNqAH=P~R30f1^6>tSdw4KHg+QMdEoBTI<-nw~cPy35 z*GdoQ+a@EnbHNY3$=lpqZ7Y683y$wm7_pc;*kN@#T#GuY)Z+=ur~%fJMZm86l` z2M+n=lSLZ@er00Y%40rfjrEu*Lr6az!OQWRz_}`+7ZV5~u_Bxl8oL#t!2Oy*xsT1l z0HkeR;^Ql=#NL!l+4P(aKf67!4rHEgy%oJ|#inL-Ci++9%sM*K@TO_kSXJxk3~kEa zwbueeE0gWzu}g*o;z>!1q)7w+Tt+Newm$w@QjhN;lRfEi&2&pPtxH@}wsF_rjjsc| zy}d;0+b+&SPo!p^tP8fOf5x512)O2WbV-6jLs;(x*@! zLj>r+Wef&gGs2BiAb(0DLl+Ey38NRH8YI9Gv_YI*0(6Ll!SDmXC=W`lF=%#W(-aJV zXtadUyQQ7%UD#)epJfUnw|Z5z%EdkFLxIS`1IvcA+$ITo23pAR-Q-wxjPcW9_VQ^~U)qgp@CPa@C(6i-o*aRB2cmS zzVbmpu($$(zDH9adgj6TXDJjh<&a8XOjkt-t%BUYD0UGC^&sEsV6=T%g0YC}4g$8D zUoMjk^aj$6YTVzgPT3UA`r~@e=T0mS=z9AcqrN~ly|HfpZPCH>FGtjj3~U_#sgJEH zb7?M2BX&YNMhF2{ltT=%I|OG1L1MHz9#oBL+oG)GsXI z#McLbFJ_3O?^=wgfWlB+I7x}*N9^I*%wJ?hbpw=zREeiW@4tU{eMT}NF;0$o9lrQt z#H)DC_sMBLTpMQa@xx-$_-DldlPTLEL-(VDR>uVOf=Fuzn@C;r z!nI09T!iNUGx18SwrD8c2%d4lRQs{{ zjT`*myUOrfR!CCqODelztC&6jH)_8HIjY@K+n+ubxg|8P$bQLbZW%=>@t>SWEIR7_ z*{sMCEdU=yP*cYuk*aMu`m-$E;5=Rb1mSre`(=6(Fq8o>Z=(r>L@;WS(h~^lWgfr^ zzi{dA)G#X`TYyyu64`_Nzo4E^lI6o0 zyyN-k;+S4pRc>S$V?mb@Jg$d$fp@^+Sdg0Fz2J4U=7P``ylf(OsqEOdLSiT<*+h>1 zOd5Xq)GS`^wNF1CTx|9bSLSgfw8+?Z>-_58buaCR^v=H&ifzYT7@yD0Y~roU<4?vA z{dmEuIUfUO316R%i>7a?y!9X!lIkcwAK!?X2D3j_k!t~UXe9beZx<)bu^=c}YUUxH zTqXAhNJQW)%PU8he6EI_{p$A|ai|o3Y{|<@ofbfmxc43@oGdhtKQ9k)C8U8Ai|$pC z;i{625LJW2euQFV7^OhonnXKe1BmBOnCkuKNmdw_?PoyhIHG<$ z#xb<2$sHD?R3s%KXidf|FA_<9RfXBT(%_b%j0GJ@aP7eRJ5@~zr3olf!U+a0{?RNe z)H(Ht>Dm_#^jqHR=a6f7G0MERpdBJT(o?&1&U~b9SIcyFb$vzryFV&Tv7()s z1U2bZvwJ>|WlV*;E&&m?OZaO`j;#a8MWv1n`zTBLMy~fgc*l`0DN16QU&!SU3lkjP zCcqJXm4F=!x+bsVxHOiJC7O8ji=yOFA>g1lKlY*!L7PHM+D3x$&#OE_sfg|J{G#6*}!!aY7J3_cD^)HC?2K@fLN7FBE@$Zw1bI8QsF`WN) zQCR-vqA)UW{KwYj4K*p-HBqFlH#MZ=V6d@;t`?H$Zy2qJMC6I%9?YXc$W+r5ppIT6 z6MuCz(1#bC4Ci0wBN4#6njK}PXTNX|;e{aHh)W~)$BS`_5FP6Jv^;zG8{+KEH}LJe z6mtFk(}LEj)kAS}`Sao947_ep$c#5@`OCz!u8k~wn21DCpyL9e11LSGV;OBT_w&%y zyA%F%_0z>a*?__G&reO=>o>$_j>$cGkcu(tXZL8WC=XQPd@tZ;!!S`OIX_nkk|?#S zM-A=~Iw(xp_mLJ?2#~tsZM29)_2H0C`5x7b<KV&6G1!svG| zo)In}gOQN>GIXF6BT)4n(%o!3R}o) zzkx+U;;oVFbK~ss23VlD5h(?#(pn5@(ge&XXC#N5*G|^LeH@}Z=mEt=6K~ta`f^3V zU3TsUhVx=%7o+U6yay%N7og%<^*9~d6iZ52jpfAXI%T|oxMyop=S%)Is~Rx|YqT*Q z?Det=uB)zQ^1M)obsc;oAEWog?5^LNG%=kBbLSQ7 zST9$8LtXEi#NePRY*IwUVQU3n`IUDTG(`#|#swIRs6sys3ZLf!$}k3boME_zATHb9 z$+#Q!7}AR5Pu5SqI<&{@ek%b^3ScCJk-&)wrI7qh(^FV}d^%HB6!1}}E1fW~^@d2w zxI3Y}qDx+%ms%`dZn|7d7QW6U-1(N(7Pp#HTxw|qr0_3S$oQ31IN;aruy<$VpE0hhX9Q=v* z-b}s-N6#%H&B!D9?4D7)|IQjGE{M%t6g|m4LM7biEu)U%(O(Rlc%|(VkiFMbNAW3qBpFy;hPcv^72Q0`2 zW34!E^NPmCI+o34=h&~^@=V`6yEM~)&`#t1SCdpbcl77fdf#vn&P05Tdji)2Le-Z<8YvXXL!e^fq}cMI$vrtg!AyMNlm*muBu;+hei4-Qd;yah-nCQ=Q>7fFQ`rU z%Alq$d%BA-@~cy8&XWd1)a@nZSkC*s0K!l(X5G>8l}KZEafyfS;DgkA$C~|xUZg=P zJ@3mMl{zY8R|;xrRXgYW^l4SdA0OG5x*BjQ-2uq*Gr?G($(t5Tqu^Z4rWu|r#ywkw zzCik%;n4pEq<>4~U}R$dk2BE@)HVJA(sv>U!8AHdsj6qZ6qX2Zb9o?`dHm{_5&(mx zH7Q(?q`yDp%i9c5l7v=666LL!K_5P~!O@GEn^|gC|Cty88I|#zGf8P5_Hy7Kqn^0F zztHgK#Bi)d?%{66{s)Mte}l{X7rWVjWbV`M5$H>I)f8GPiCtRg`!x9!6*#qD2{*NB z_}!?Eu8wxKsh;Z9R4o9`@JrpA^s4U7_W6ucj-kg<5cPFl?G-%j;w=WsKNRBvFJ}@H z0pyadkPRe*@u{tZh9_Wo=!OxFV`&(8w(I}l$M zryV3QkeEL#pKawwmk@{H`fnjfuYl`CP+_yX=|YF#7WeLXRLV8FW9;WAjQ3 zk>TQC66$(G>%{^dcH#7Lz1=3)S(+jpWXtn=rD6kGW@3TGXbrj|X=B6VCYJ7%k}(s+ z?uGh?SxrSgRqNL3!qaL!s%Qv}Ge6cbr2_yV#XZlS;?l1Ml{9$Oh{H=h$#^fTxYdRh zV-$G`{i({J+^_j7XrGFe{RavaT zPy~#sBqr&ivo(JeuB|7;Cu69n=uCwrh^}LWNh2d8RXr3oM8Gs4v&>toMR(SVcgR%j z_Fd9m^eqPPdMx%$XeuOK;QckZZE(+CX%>32mC-(jHEC?rhLAn{e7O1WbP^05l)KB$ z@LK9zAZs5Znu(1wN(TkBgFG4O7unV-K^KunA&_KI;ZRhUO^*dVd zS2!Zb^T_SEM$h^MGD}_bs)6Vj7wwr0GYk(tE-Nl$@l;Ow4)hudeY8%PIs-^79=PqQ z|8FD!M%2ePq@Y_KctzV-oCOn%SWDW6JOQL+H>9i!>XZUvt|2r6Od4&hk%a7kgB}Vb z0VWH@Ww*HKBUU%^AYs@$MOY#9_MpHzJ4gpjSmzKZf$Z9L`4#NwaY*%8#VP+H#$~{% zuKnV@_lR!r&O;ya9LDJ7g{9--8$9m=#ZNL+R9@ zkHlR^#~nkX)m0*0FDrdz4U+mzV@@(ysJ- z63&;y9M1Rq+x@^0a(Vvl1ILh0yWX(9LitiuIou(kpfVuYmY$f9w4OD1Mt=Ha1GqMO z>zps;GYo)`XZ~V~r%st1Ms*Z(uqVz6|JjDZDi(kyi|dhoY3k(h-$=^N{{NL27@1lB z<9gf;buGEQZ|~0c)Y?3{n1$)lX`Px1X&dT*#hMM_1#D%UJ=uVTcoexKE4-uuIx?7SGs`w?TYvCJmg8J@=W2}U0`4c9kO-P4s z55>LB&yO!B;jBlADxcZeuQ{jt%b*}U6pApAU74e8@Tila$difo``Ev+vL$=;bFsvg zKLS^Ce@7qU`g|ey{@DkD3_{PR$n$Ta@4X0 z`i5N1ymOiF{-;Q~nuIy{-v#Xhi{#RqAf`S+J*2&#Zr)oQ%33f&sET`&2k7UM+s(0l zxRHWa74aQ+|0Oo;6}!&Bz!L*Wg2Kltp-XLlFZd9Dai{qatcQ~Uoa9)9Z3_Hv$TA+G z@9p~WgkvaRtCESsv?aSS?bJi$CmtHp3nW zt^~XPksL#9N;`nV%kP%0f=EVJ{Z*XQ#Gu5?O~0hd(>b1UDyv~`rURRimn~4Ccu?20 zd#@t0mo73y_r+Q=s}>7BtKPwF@DqwcNE!yV*Y$)-LzUTt6xv*(&s~y3&kEdkIbVus zv`~{^6u-d%J~WxP6o=M@0*)9JtRv-X22YusTR-p~N+2GIjFn6nNmyVsNCc{WXi-CZ z$nKEkT2Ap#){kt^EgT*r+POFzWb}>c8j9Yxguy5a+sJ$TY!_8+bWxu(s{MDTeVvSe zStg;ZboEIT!Fae8lqoB%m7~o|CQ4-uljtRxxDNOzKUuN>&A&f}&cg{j4~2dy6*1b% zz{BK-hY$f;uV2nWe6x9R!ub5?$O=-!@U7s%2!h70ps;-kac4MGt4`G_BfLh|2)xlyM~)6{gJz%%pK;t}+DWiG#7P&Q%$|k#H(YFUHbXpXB%J8Fy{U3DIgj5AK|O)SU7TyIA!zMSlN*hls!hDJSgE5{DK(0m?gO$a^(L2kN{2tTDfk zFXES)IZHG1UHxq%P-gj?8XUJN>`rWh1OjyM3FMDRRP%Jgv}r$jz!{}#B_n9pi{Pk9 zrMT~6w|q{zxgouu4%bJyN^7DNUm-){pRV%^-sSyuIxn`ZtER3X=y1VTy{^D?dfg~D z;E1Bn>v^y1UAsqtX)=oZWh7J#{3Cf|I1d|}qwZtp$)XgGsgKBsi8E8&_R`5IH{Df2 zj-}WWJx@7R-G2czGsC~_y_q=~|I-7J3w15qO!0pJ&A*CHL%WA*+9FbsoWN10>8!Rf z;B7$_*|RLr$FILm@!efMG3j@)tntTNql#!SkTYxCwac-0p!Zq~2k<>x+jEm1+ZV>U z@_K#(_uXC|Zp7PhQ|u)x!RT!K2peT+b};gFH5E2rMWpCDu&VDz#^b*QU^G)cp7u7r9?ymqo>K6z|5OM*DLl!Hrl1s29MpBZv)g~M@El8Q9&v70i)Y%qjR4{tP$$l zSRlP#U1EPHq93}9;gN-N>5AMv)wLmpHyMm@_wFwK~)Z*Dq7hNs?X)kOg(>&fzqyviuJW1~S#d zT1tDL&HKjziki3*65zkYkOX4DC7LsnBqf(6W2ogY_BUxT-lwe2k11m?j%N^;!gRK8 zR#7{kiFncSf**wPGYWZbk9HV2X?aM)d{B6`^^sC=n#S;Wy`(WTbaob~G#xsN7n(#U z!_`RqD+gxekKsjk5}=D$TNpsPg3t zyfc~fv(WO@Z@tQdgbkPd>8{`)okFh?snk8bcl;bFAc0`I*VM$Iyn^{fCk7z9A?J$z znir6y>|-um6$}NBfgfd<@{1w4xFNl7Mf4MY)APPoUi+PHK6N* zCc5}=C_*hEgvz)@yXiqw%Gz6R(L`fhEGN>U_-eywOwxy!sP8^xmhcQi662l)W?u>} z^2$5FH3!pPKAQ&ew4>1Y*8Cf!x67+354D2WH{7;D7oA1zq0VzMtCN8)~TIB}(HhNfS z`fzE;#Urh*ecBo(9~vu-GgOO>q^Uulq54&ps{$rYze~lG*St|S>E%-V6N?JiDqz3) z*&j!(GHs?r&Q(#n#{i0CDux$zD%Ob5o#D&Ko3_nHOtH4!>1+x}4V`6Vi5{Y^Ew01q>sQrcoi&=N-1)HC+FzNp#G%JF%9mf=tT8rb-uO}t zluEr-f3wB&*YoIGL3JhvC zTOr;?@#3E>1oXx(06Gs?XFR ziD;tv{)S}d+)RympukF<%G@L-N%({&8J=`PmvPg22)qu>cdtzyYlh)x3hRcQxp-S# z458zo&Uo~2@i)DUX=vyF>dyFTTEH1R5A^BkaVNtqoTk+B{s?`?t3a0s6Z9EgZx_9Mq5BIH?r92LoFkhmh~L}4 z(enw6hd0#sF92s^_+N7&{Rf0LRJvy&ru|GdCU<@9q0&9WcK-%D&-!3 zMl{P>e`-`3pvs_8E$LkdgtB^4JnBRcjs%9iH1!r*)=Sb|sxt*h zg(@@-WGPm_x|+^7F>+CKNrWDxiS>+#vAhwiQkg;|3g^C8B!c-u0=xdKxV6a*qp|t{ zycDw0xG9a2^eheD1TmC48wO!7Mx+TUb_WZ_Qsbe8z9fV+N+^(je^C`ITYy9#(xf1aGk46X4dD0WzTVLpVoIK~?u_~}Hak9Fj?D0#VyZcZkHtcjFCA2q zXKFFuva+#}MN(@RqBotnm_I$1F!3YC)EyhgF~d0}PlNm=gAYzfh+7ye=&>p6jP_kY z&PQLH9pCIBd^u+5^yttbK`KX&gr&3%UJ%zTC*J88zGS-H(Fg1cT7mm(esg%eI&=8& zlJt>0onNeEn#-t{%|R&|+qXU(@vX+u17lJi#fWdgHl;Xa6oAU3 zf79Cn{+>JjDT8v8RX@&Hjig?NswDmg?qQoy;K1RUeF(SEV}L!%vuGI8D>TU{gIrFT zgHE4YF!k+RZG?s${R{J%m%wNHEijC4%thmf#uBwTL+UON%DJDFXVxr+?oXfed?;Pt&@qeu zu0`OYXB7j`NIqGLoqw3*!a1+gqtkdRh|yd_WMvuDCm zZDEp-P;tltLfxZjt=WUc`v?$${XSqafJO*j_}IZ zH$5P?fX)!E8XYnE@>fQcK6qcj=g)&;hmc#3^LK><=K&4-vBWc{6ptvkQ%BRji4yOr zpcKu(D<{=nb2P4Op`Wi@jF2RD-hFFFG=4iCW}=iPTbvE-c&({su`VH8qw?$tU!Z?! z@giH~7OYdL9+ZT$tmJ@=Jz)selz?U?myNTn>Sft9erHzB$t;>LM_C^} z>tB=pz?Y9wS*7BFFGJiWe1O+UaOlhVQw@`%_r2#^>GpQXvpG5CxzDA`GR*{?`bjFn z&oOv+pn|gNw^&ABEs6*prnT@{a&*qo6a1_Fy z3+NWeCK@y62yY8~_!VAgaoaOK*C-!y{^+PXPs{6X{t|ACyx{^YH>Nt9tAQMoKHj6!v#C{Bzm6-q8YU5skP4Q$q2q#@UHQB-+NbhMJ^-+;yPd>4R zOGvihQr~-*h^4HOl(B|`6iRDeBQ6>3&jMYIENx7sEfrk(K`H8Aqm9YB>8OTghSnrY z%kv0|S8Po)Ejm2|Jb8So3Celg${J=1;D6Z|n+agikDbCbm_xL>fWcQp~6A3v{#Jt|t?4b3;qvJ*AWKxm)Ug@!T zvu*&bi6qnT_>$8Mm7Bbd1%2YFqmuIY-7HUg{S;R!iSqPC2@~WW(jsskB&`;Ly%E@o zt*vGLLS&;vr95s9*M`3+;Ei$AWtQ}kc7Q6I{C(B?uB!)Kg}=w0c-+2?Ph7i|VRc>F zrw%EaRj=BZouWLis$XG_-iO(3*~Qh0i>HPj@lLSOGy}Eox>9ds6{#UQD!>Eg zrac+8^2%24b5pYPb|3vt_owl}F2O16Jwn89dPkPl4j!YC(MMXLKHbu-_5LA)+}E-k zW`WTOxQj~?eOT%34N{p#tfW<;r>B3)M=t(lrO3?4`fq2k|M_t6hPt)wcM!!tt(f|H z#`*;k@qjXYj5u1UnF8##fsc9A5Tdzo1`P*NPK~dR82Wn3m6(N+k2Bq>M$|c}#f=_ux2K%fx5Fs)3xVIf zcK2Uw+?l$_J2Oy&64D(jfDS+BmOI0yYu=aCC3Llh(W8}i=1SDSRX$U#Nyzt4Y@h6X zC`clD0STO;FNxJF@a)cmhZF%4Dv=1}Zm*M89aLPz9~A(BIu|^2kN@(Ucb> zTi_S9)~zR{_iY_Q#i98mW5d_mL^)9&2+~D~Ypq19SfjC7I2s7W$|z1=Ha2R_y=jgm zvy8<@ICzLa_68&2?2)zP-ZD|M!J3mm+mjH+;@n0=Z_`6M*$-&ULK{CUIco_d+=^)w zhJwO;3nyvLx7``2_v*mdEn-lT1>#CX1jqt}6wrA@!iEy|=}mFYSVNyGbde%+;|FxV zlen7v&7dQ#&ijsA;i2))Rg`P4Xpd^1((=`GfXE}N;xA0$N!bao9J3<~2ZYxtI|kD< zZ%}-oILJp95sfV1VC)7MvK##5QDI)OIE+;kihAxEIe;O4Ly7Ia^(=GlEn|m@3nIby zF9{E5my7*Aj?Y6n-7UUfUcnwkMyN!s2@iW$%Z^yDIei2pna08J=9GvM$cK9@|}t`f1F!zU=3- z^wE3X{d~Q+KB0DI*sh0N`^k#9P@;Y>sBWvQv*v9wS28`6NsQ5WqGOO+wvbl6^+)Q*#%SFl0ywq^ufg(KGnt6#P-~z*CWlfMeV|WM1?HutHIll zR2%BD(M;93Fvw(0Zc`6`t6Pj%ld5Td!=9aGeW7z6&^)`4X5Hw!ZhH74$T{%q6hnbj zkYQ*zCcv%R8o^R8dtTlvaMkzmoSP9bHy7U`r+msl*QcSYo)$KFnw{Pk6v1og!Q3yx@h8C8q% zL|h#>f?yu}31LXRB?=*AshFs|zwlXe$tRU_R3!q1r&XuH>Z3B*uA15GZ@Onb`zvq40QbgKj!gI8(PA>vnHHighDvL77lwuNSJrA<5uMKjv=Q-bfv~ ztyjgNIb}&`rLSMS-6hV$*FVVBt=Ysr{<5}b>n7^U2Zkw(xi z04xGr$S{?i>CcS;%mJg_(oy#qieL~{KaJ0Y1PEfs%dkoqCf!AL7`o)3lAevnasal|ucE_4q<0X}|s$F`?SAkn=vExqAx=$HXzi#AFS3 zv&~_58;FH5s6S6=vnpz2Si;`Ti_fa*GX!Tt;;D)yOsquKCgiGrFxAN?W$GRPsA*<8 zh3i|(idB1|vNne>X=?-rx9<_MJP*A}L(#waOiU77%UBYE;7ABVa18&!t>-_uorfiP zm}{#d;9pVGD17?~BNEgX_wbEdw-^+HuDSx#iyK%nM3W;;mCh8{tm$N~#B?AC}+jg_Qd`|s|$^l!6ypx<}{q>sgnY^zN{T>9*4 z{yf=p8<$lYNd1@$gR9&k%p9?GXxNZ)IR!dJ9^kT@MiA>CDO--_|EX^8dP}wcYMsFg zQtS(oR1nIvFtM)Zsq%zIgn+v>-p^V2WJ;Y8mjm=0qfdg|E~CEpZPhz1orYiiI@R=0 z{{@$VvOur{B&ol8Cw&4(U^Ir`oSMPzfJ4F^Y*_qpmL%C?$Cm5^-v%1UsCPl)lh0rs z6(!0u74pxmamVjqvzet-CnrTUcdU+6TBEhT%}ujO8_%24iLi@EZjJIEZ=3omYJ-j4 zrMKF)bz*Bk3}H|vtvtC-oSul9sIMGoxW|;S&T)5r12#Dmd~DOh6G|HB8Zo0dh8O8d zhaK{pTN$*uP43L0MwJouTw_$NFWW5Tz0KsaJLGBEh}giPwR}enA)kH%;V1=RO8Gqb zG=j@V1khp|cFS<#`fG5#&x)9$gszK+pK=d4Lb`LhrDhYI8Wr>y)zVDCo`5y}vz422 zR-szE)8+04r9tt3rS89US~9Y7{KwizQk4pS-T z)^M1&u{tf+|4r2krdf1T_3YXP%)^>_5Ex!Bj=hK8e59tYu`K92nJYj6%dcDX7V2BpGPOSr{iWx>W^i1JVa%a{n3f?O zjAWxr#vZx*c}SPOW$b?2y2$?H!+|y3p*h2@x%5aF>(R4wK6rED0W8X+&oQt^73x=_iCA;r6wgi4hDgU3y&p z7ChDd#F@ws$j`3Q7Ka)tsNvZ)`L;C%pudg;R%in*Yg2^h91cCf?6q$gw> z>i~LCqPCG;~DwJ$O`d&^wUSd)-^EZgyW+X+U%Fo43w znzqB&`Ou4@*a!g5Cg)paBmarfU1Dr9=3QE(A8XW(hVSTH#38A(;C|+VU3CtO%2d3% z(fY_!N51NR0VP{nWzFQQyw3xdMqZ#atgEy^lOT!D4+P*v-I+t$)&k>#i0v1!M;p8; zvu}9}S}!^{?Uo1}T18k)z_zLioeG-{FX&^NG9E}YrJOgGTfa&@P zI(^@z$iaXp{9U!+g0~zK9M!L1YWO7BpVl-q12Y^5t1}hJ!oIick31bHh$4prY!IRg zc;U+dS!?|p@OXKe1@W0`Y9plCc66nS@-0q^TFc}Mw~n1Y^lj2oRCeeZRWQ?l`Vl6` zS;|NyB&bW|plj$BRn=N2g#o%!R1|y8r=L=?yy2fCmLV0iu^gFQhy%}o3xPXGd@OP^ zD+{(fTQc5(4*#ILk*@prH517y#zeL98jE4zd%M8ZM^g9l>u50p`?94=(mTyXcs0fu z&iABFB*q=3-4W8}@68%Q>?MOQ+pO67cDXY{tbkAKC>!cWBLerJ3fnYfi=WA8pl2Lg zBrC%gzoX7lQKISD*()BK zxeZ2c7zb*Nf?D$1nd6G$6=6$m{f3o^3c?%5+7K^7GX13XLOm-_nY=?gSD>td0uP6WR4Aurz)AdCNn_N#bY9-PK+ytF@QG8 zGiOPg^~tBp{ieWNtPp)N|5n411Y4pZyzHkvUw%rcdqH|_3-L_vVwI_#EDx5s+!|U4&Quqhb#k#Mn zUqo8e!V{3i)+D+uQ~pcZz0Nk1X;OQSvJ}A))wnN_ivyp_2lw3xlhu9Gdk{&c*>b~b zfDNoWT>6FDN%mD6aMa6Z_e;5D*Os6Vj7H@)UiXI=H7G|!|K$KC_*yv1FXj>`n;}#$ z-$<`ZIu@5>@iw(qcU#%)fp7CG*?5GwoejnuUn4WL>%aZ`d`El!&oGkz9;@g0A6X*= z|7XSRPqK{M9>YHqZa;WSLb*OAckPT$(4e8sT~Bg=R8|IxXATQV=)!!vjkqbz&GW@8 zsaTCXd3-)5mP^8VVu`RACnWsR^f{uyB*$m=pu|Xs7*BZI>?yw;4zq$ zVlOTq(mxhHayI!9I6GVw#@m*p&Q!7en3D%LRPBczOX|^-Lka*M_TSb=KQ^t!4FHbu zhs_;#y$?lAynwI^!bJEkV}`m}w5}h?_$`uN6zP%8V>7=SW2bO%VR2(TP(h~GMboH& z*gHtTQHUcZ048X)&MoM6#F|6^%zWmJP+9VKYB4lrU4o$~oKYHtf=kw*VLdoAn)HcH z#o|Wu-Xr;!S+R2~U6N|LIZVy?{6nk8cHhH-<%km4IH@<#&d(!{1MPN9P?1GK){Er& z+-})@Spff4kQ5McXiNWIOCq1D$i{JCQdyDu*f!YMJ@J?esk!QEpp;QS8Jt|`8&(-^ z4`8!RLC(F?-1%nrRV$lC2ccz;wz)&j1RdAxDUS+82A2#SmVmswfH%KWFE+^NHQeF6 zxvMg>{sJ<&kd0!DJfq@6zP%5AmK~Kp??=Ka^F?83=8zrV%r)P% zbou4`72e(x!yR73vLTx`CMt^K*kJ`7{K}LFey<2$$>y03$f<|5`&usKouZRkbbOK% zs5hyrn90g~@!jl);dmQ`1@i%C4c>ZMD;unHlh9nQJ+E|rPo1Axj1bx0C3uTb()r|y zMCqT`px0v0{`dK>jq;KQ=7l78fl|b>oTABb%_Sdmm#a(0SZWVb(G0p0HCfg?y?0~Nov_+%Br_QIqZQ0NS$)xmN&g2G&c_-v;9bKp8)D@Iq8 zh@+H{4p)~-a^2GF+Znw3+Wiw4>CA0fetYjMuZ${kqo7{ep5qfF=&bzdVKi zJ6)WG?SJaxtp7ipshTpjIP8GVGqrpBr`dk01Q9fSuo1|P_8vNY63+8#WGJfyYYYjJ z8XCya?kzRiKQvm*igHYCVBr@QQ`jyyb>+|Ho?#2{HUw90c{D=e=K6A=_A#L3aK>0X z{}*fT7%NH`YzuDNwr$(CZJce}wym>m+qP}nwl(Lyxo_@!nVZS|F-a%Ay7HxyPIsy+ z^{usv9+=5JfiMai2$3&bINV78S=gB^PZ-7#4P`Z*)f{U`+&ch#+_s;j#frb^2#l2d zPh`5L%a|e~a!3G9IqW*FE*o^L$Fo`8mjEL={K`Ru4Fs|=7q$|y z6(-ZhkQ(G*r+X;9r$+zEIbh>vAomoZJu=$av`75{f=-J`kbj>=y)(rAhz$cZW4cLJ zn2AfYs(U{#P(S31@Y5QI96>+0xA|o_-#+|U9M}Nvoq7{L^jPR}Xk7#&jW8e@P9%WH z{f;TPULvev#SpZVf#e96L#7Pd5#ZST7nBErxG5ktO^Xp+P_X$WhzrpUQ8*~#zzIJa zHK$pl0b)ezG4h)tz6N)}5 zXw0CIkZSYPwd#61sy~yBUiAIeUWJ&-Vt*2;HW83yR2lyC-{Rb_N1>Z_-uij1hHa;z zqo=L@yWo>qoqXos)%$X9`Mh|jc&=PcUA_t1-gWz3^ZEXp8r8Vn+N}p)%h|?gz&Li0 zQ12&E&!}C&92bDnMjwVwAG+-}cw?8gs}I*{7uws^+w-ANyW35FdU}14_W0=Q;N$Xs z)B5;$`M4kiVIl^Fnw@nh&6nAimj`ATFJ2V*q6wiQS*b>%Ms=Hf7jk*$kWYM@7Y7 z)<7kQkpPT6p!)tCPw#Tfd((?Ec(URMwTtD;I$$}p z9KS44nSg%CeClVnt#m|IK|GU?uq8W0$$^$zm-lUQIlX)w=BC!L^RrNUXBVbev#Y0< z)k~?GXr)|jQIO+R<&mS1^2ibrec15wX>tjVwpC^<0FHQL9?Exv0iQF~TThXT535-Z7iM*j%_J*Cj!LwJU5TII{mmpPn`-~K(NcP#k{YVcRuW7Ki-pDqrO`-91hG8zVu1k|RG#XvO+T?7SuX!d>JfS4<50QH8l)iK8?vi%YIA zcg9nKYvR%5Nqw@0_kvS>%m@Fy0(8VY!P~siWc9kF=;a8bJkG~A=cpGq=lI$$Z`sbf zH>hO`|5lf}3Cve@{1O2FA0hm=ywpu_zOv&Ne|W2QpS_^}SoJ?cHm|u7ljp*;=nMEO zj;+wzJK0-Ul^utw+xHbW?y7EG72Li5^O&uypSfDi_~vTVH+wlxR*F~X)39yApP?Q? zeOTQ=1`V&U345O{&dJs9q5l1xv&$K-8{(8RI<~G+FeOsiz5+3!E4hQ=iX1f8jp&vz z^vXR}Om_0UqS4%D-Q7i@uoLH?E6KQw_G98!F?PT!eOpqI_wdcr691hyDRMCITskg& zqci^@uj+J~W=-D0nbqQEOujstc!KFj5i3f~4x!706CVrTm3!rxMZ#uD#29sYv8jN- zc)-QPmZM6|i$w}qHonEk7It4cEM3dVWb(|4V46O%T#iSz;UX}C6Atjc9q~37Z+jw$R{ul4^;L_$IdW^G6%AxUEC^Fj-0nnq_4vB z@@gL1PA`e8rAiUv=h2l_yRYnX6jUca>+^{ZHK(JIRy8y854hM z{`cX&G<)?WUNzV5g2nPhJ5aBUI_K?ffS<5zz?ZNEXu^ND{lUl34#U}o2*r+I|B$&5 z`)uA|vtLqlIfO&n77^M8=g(01>;w1PXoi=; zdp_Bj`UR)SXs7xw3Qm^)TE+g~pYyP+p&gebfZ}^wyN8G*crtQa-*G7x!)Up?gpeAW z+*SLLTnUhLc5p zHi&JsiNC|x&|PG9uxV@{s}$_zN$CXpH`p!<5qQGKJuj(D&ZaFX$FZ-=#a!l=Hkx+V zCZj+$XaavCPr~={A|;8i9hXz@uijW{8Px?Eb zGQuNMo9x5@Ljqm%F=Ybmp~M0R0?b)*?na&0tedQg{yk4SJI12bFH3L8c|&`~DCg;= zR7jC1$R3zZai=t5^rdEg|4N{^y-B^a^?^|(;&)Z z(>NgF!4Ir*|D;XHRm=RrhWLIM1FW%qk)eALtq0*k>3GfzUbz zhI>FB_+R;b-$qDTWCth7`nq71gm#+(Bg)8nrW^B43$gK*a+J>JziA#wtlRG{tiIL< zJX2~eITIypA$YhiDig-!RbV(s{$aCDkdY*E$7g3UPbKQd<8j$cqvj#_bYFR73O+rw z>euc`B0=ki&n1w&bcW&}cwj+<%K3T(8i)A)L5`VW2 zw?e|gknrvqqmYOtk4T%rha#4W3q^ms5uQA;@!rJzsz$Gu&X-1I1{nj?4JTP#bkws{ z=5*sSka~d?<}8h;sn6r%O_t^6KuD{j1|?eB!##Zws%1O=8jC+|8Ceu3_`GKn31w0I z7y$kCa63S}$0vpYkZ_1?PT!p*xW=77bUdat*evix?NhrXX z{PS{^4IePk046_zsyX=JaI`jVmebW=pqL*)Kw3H85D!nOwVi&jEZUc-|pPwRC)VfQNIRqYygZtHEU&N&0n-(Hd%x9C(QIGTZ0wWIo6aN zqrww6zfWV&e{%Q&8aoemO|NLws(Zei-pan>-%lY_K{l}82Xb}+_IRVSaJ|}oWx%)e zaW&M*k`mdnGE5Z&PA7KnT>35p(Sdh1`yJOmc)y7iLka^X6HnKM06C)&`T2m-R15mX zWt8zVCgW!#nk+5m$+WSA$0d(xYs2N+@1GKb!bqOAUNt7?`BJBHO}o|-IG)p(OI)E9 z9tUk1hG{edJ_xgi#%0Ogj{F(1?&N+CWX&WW2%5B#;eM$@Hvu5IicgJHA8Qy~Z}JlXH-2(Ju7qRz>6H9z$BhBt5JvW7;41Bve;N01fx;(qm;CmY7U4 z8RN)k$i37Pgy*^}0l4RWXQx45SS^DoaUJAF>n36bEl%$5ZCjfV(UVjC?F2zyBdhd5 z^18cHmr@*EBP?e~u_`so*=h6XFLkh)rZc5bl&xrx0IVd0&Y1BudNtx|)Z6@23qJH( z&yl6gXmmvPTV8e;QJek!boQNj>iY(l9x2;BIdmj&(3OX_>D2%Ukg^Kme`+>RN$<;{ zHP%6CV~&J3Ky~z2BP7{##y;g&0)q?D8N75OX%9qLqgbUt&6L+lpHtcO>%90Az1#{J zaUNzw-j1CDFZA;S%M4(F7u8VBv139T*FI=yM~_ZXM;3_))!(s;(sK5uZ+b{%_;~ZN z(FJQ|Wm_*912v3yqaWxZ4(unXH{aoVY^pYyf8<^urwR|br5gyxJJ4`P$3=!z!tAk0 z6r?YD==E@x$K3U86G1M)50d60x~t7sYbKM)Rk>zg52zC$osqNeRiRTBN1rl2Xe)EN zW(>F_H_Gs@X9;HGS#7P{9JMpPB@ijrx~tAtp15>S^VQ&FwV#hgxDv&YL{W$U|9VOz z)%z1?c}}Mm?=J(OsRG+L)D0CmWPy!;4;FD|-r2_$WC2;E_VO9UHmDvY&UxWuj>L=0 zU5H$=hCpY#Bt5gzvdZ0X_GIR~(FiZNUyq~wF`Kvg#(y2LbvBddYw+8SznbPDi z(SW~@z33ls6jh*CeF@{AhL>Xm+p zsX4=d#X&R>B2*o#$=HjpWq)-h^l(Tl0!snI=H;AL*VawOx+g*2! zjFXa9!Cm=@xRdw)7fF+u?Z4R_WMp9cPsea3PR9SXH*UAKtQ~GUV%MemUAoTOm?`@@ zNHpjRupAIcpV752Qa|`8HAoaqQ3${Pbgw+>Zd20?5i&96Y(Ep}wABhr=Jv2@IU9C4 zNhWc5@y665O?lb`4w59ADvbVbQDTIEJY%Ew0Ond*Ba zBlT8^cO0eU=blp|>2pKQVv%x$rB(xzxyQ>NrEmbc))G`F8Tk@p&5Uu+0QM#WMKJFe zMcEU3II+N#{L$v7C2HOpdn0rXL}KY|eTIv2Y~C7%Wv^Uz437)F)b5NAYk}J4BE=3z zmBq58M>Wa9`BE)ytPM`PWfp74SWAm&RIujK{T4pPh4dND3i8?pn%N_xFA$w8XGSsB zc2!>?5)by7faCl9OHNt7OV1gEK&hvN#VR>3CL{v%DMAPZT{}AFf1FRaHm54~Q7c(} zyI6$mr2R73T7?On-jPnUglA=MeT*B7fkIL8Q$qr@U{JDy4#ROOotfP@$zG>}gGlk! z%w$R{UyX7f-n{gx4g~zcf*HBSEiI)~a7?L&>!N-e-!5RdV+!Q(;)DDReM<#m} zhf>`R)Xt#UnzHK2*^xU$eSG6AhX95@0)K1b9O7KkGR2`~>y_M@9d!^I(e~)X! zgRa(e-+a)555L3k{k&ZshtWUbttOGF-z?zOHAY%Kio$IAn27Ed@zgX%WO?@Z|}oaB>eLpt!HB`|g4$ulA_QXs zhVq65j1f}BHSi2Qf{zhXd1<^fUh1w4*9RNIOyDQ+{%0V^&?EF1Gu2Gve+Ray8A`4H z>kbBtXN(w(cNoFPSgBSTHHPh>|0hVTqcPMRXb3ieoJ2|`rIFV7AA$CeW3*Il4cq?* zs89a3K&$2L=;(RBZGJv~FN6Vy$>E=Zg%wSzqkj*faG6?}1nqtWMsH+f$9WNu6Ca_0Q8ahyCpa#WT^G7+{!9X6aulFtrGeVuRn81w zWM%{e%L6Gg9Q8PNf?F974qym0y%-TbhYJA?7VJF9;YitzMNt-=(7)+FhLGG6l#ic5 zEAFabDLU}i1{da0pr5>~d)uQ7KfWFuK00zu#Km+3tel7>i)-cqn9Q1ZRtSG>B5g?7 z+w6z9675vT6bKYBq!|A0Ay0Eir6ao$fdj(C-XdqUvCd(hbrY=O$}pZd37Co`c4;r2 zBa4BPBMFFs72)rq00hwjvIMIuI1vyWCPy5CN&+s-wE&Ec2LmS#QA3cXSTKU}x^4`y zpud_cgI?BOh0Z;QIVodybAO#_Cp6$@L`6;IK?_ayD)w1xOjf0>jzfrhVqzds?BfE~ ztPBUPc+o3=3v#SKcse!lrPwV&hw($6$772z&s*}&LM9MKaShqRplCf(H z{xgPAE95XClAkoz#rjYdM8m}K;8Bv(KL^4w>r>@lCQ}y`9_*t|NzONUNFar;^fuf8DC(Ck-K{x`lW110sro368o!(pB{{8XAO`vcPMT zQiY}UUa={1vaNw88|iRBL$>8Na9tYEM>u^=QioQ42jmKLbE z%we$ANe}O1&(E8Dy@I_Y%;#wYMWEkmBnD=cLqt(_V68Q*;&G#ZR06|!yL&Ncdjd`F zwP39=eMn9Qgr^^j_Z7orDsxA%-#XTF+SD3*7Lmu7Ky5Y=xa;mgA_E}h@VWv#5d+F} z(RLXaAi_+*>4kV(;L;e;Q&i(Z3dJL+ZLUQr&;{6ARod{3>fsyUwKFR8mKXL3hQT7< zsOjY(FX;&nP25NIqtR-o#6>Bd*j7HwHTPw8%__#128tSHHl zFuUk-UZcPy4H_%;qr0!7F^=1sU_Wl9cezqu8p||jmwTC9I)Ru7x7&VTBw3?q*_?uz z2zQsL5CkS>3o-Lk(g1@9369bW+$9QsZ*}+6W!Fb^UB{I0z<;)@Mpbvf>5Wzlvu)dR zo)$0y)QPT~g5_b%bejQ|{b5*DL)ko|>Y;OAE6dQ8lTy?cc<4L+!|*>&s;-#PzF_io zfQx?n5hb5o{>J~RNW2S@N?dBZwdi$|rqP8m*gl4?XH)<$0@<0rzkkuzeBy_3YAgb_ z!FgjQZ87>TGI>&Laz3wVAXc@8mH9z!6sz1X*qa;IuF#;1tI>ucLngF~J(L_b%z@)J zi|DYe1io*)rjCsl1Sm;Ew&Ii~_|lRW6kku%dslRQpX@2PxWgx_a!WdkA}9Q42fp-| zQ(XUfmK4=ARp#9MDyl1ud!@8mNbIqY*kd7az(Qt)w#ni1qaJWUJ7kBn%?Rn38LkgB zgqT22qNUQ(XlvXUwuc?#rF#7XoI?dzMvAcYWuY1>!Za0xXv+vumf@nT|G$PqG?s*D zED6z?5u&uhMQMi$(2NwJ>&yOM;g$$deO#AacBV*mtSexOWg!knqKvqk&opkeIP`iz zft%zDYoZpzJq&V-wKWdBwQ6C@l9ALHV*>M~m?kGV9h!|0zf?x>$WU5~lsQ61%XT5nx_HhY zE12&1p;U6bjxHMg&3PM{_yQH;tGj_m^9iyBjP?D>_Ls`1QmI|WXkU3VCK4<+`wV6p z&ER3cPIg~Vu)-p31ertpGC@5Dd!_P{WoaPo93LBRG^u)B zJlEWZB`rWXq;r(j%la2Re}81^_VxcuMiPrTG{gR8W;tf2uC8PV!TZ7p_ho~10?Epw z&m57fjhh*VhVbBJKMnA9$6Tbt%cORA2BYHCB)>h`30j@oWv$vD`gEqf-GqEb0}jAx zdBdoA{#GCUM)e|TEAOR^>{0J&!=IR`k%HHk!+K8OH@$m{5?BBT6!t)A9Sc3+b-L&t zfMf9!AD#R&`oFZ*#4{Ph-e4a~@I(sf0F&1{GL1X0xVco=Y5ELW19rFl#58yF?4<2t zI{r*_DcgBbXnV>sfUaEtDxE|9uw`+Y&R%I#HY4fJgp`ry#kOrOuIhT^nViqnOfiK_ z+qP8s>YMGb@M+^w8wp4@Jr#z2p4`G|Qn7cy;z7Fr5FkTjAOOpN>H>iy0+1AmhOXt1u{p%G58R7+pPwTdn4rjUQYe+Go>KKg!$h7eA*KxBfed*~y`&s$ z#)R!>)X{udUAoOSD`9Q9^ZWw-+Z+A)d}tVN{&(>ReUlSRk&(+RCk}p?7)S*_<(z91 zpG_Y%n~<)Tyz`?knhn4wTO~x-iNJ9qC`t+3OR!k$rJmTbOzylS{JR1WCG62|YRmrd@82Q9ot_ z(21jXn&lJINk@7=H5nTDR&S&RbYrnx)*EK$j{46)HA!=iiEWzQ_WW1k^y33^$=A^0 z9rePpX`hC+)uGo&?#R=i10Q)RCD?pW0B9_IxTFd2X?IsSl^RX1Pj#o6=GM~7vU?7k zP1cPk!;-*dmB*m)N?m@?j4Mg4Ln@w@+%%00YtU64rg_G|lb)T3%)ZjA2^V(Km&=^h z8Idtl-80$e;!JGLdwD)Ku1g6J@vkL#heLF1FQUoNJqXGV05=H+bIlpjSzGsDn2GC? z1WSd#EBmCl5ZGW;tg+iW6Jwq#E|1o8`t&L~so{q2q!VcvGF=L~x_$j(8roJylCB+4 z@Tq_w;{mV#$1gu|HCpk?P{?72%gwik1DH!cx{I==Ztm&%cNU^V>%~uyw_Kj-)|i*A z?wOTxlfBdRty($)}_`OdyqL4`;bB&k=t#!I@8a2M8=}GsT$`>I_G;97xVE zKf1rW`5s+mZYyvh^tmW3|agsf;K*#%cM z&owXSK`eQhwR#U$h@>}4jdF;ro47KQcJ^0=dKV>WIr`F7{vzgfp4g&N2OZjieGsc# z8BuvcLJj&pCQ&B(GWM?w_Uf=z2Ko&4-#p?PHX12~5h&&JAhgqkg)(GH0N4zTKSlY#pMu&rS%HeO#DR}0 z3+Bj_dVVnZJdyOn?F`SFRJ4x{ag$&8>siCu~7U#AaHnymtZ^|+61xXbn!Sfi_{E@?#+G%5#MZiuM z+6*m{FW-{hmcZbHhw^l8LY~Uu@rW?_P7fMW8Bb@ND1x2%j%(azbGEbfes51doj*PX z!@_3WO4ap$zCC<@KI8Czyxcxc_7CA-@pn<)LLXk9Ru^~Wc6-Vn2e;2VKVNefv1xK0 zR1D5&)h(60)biV3b-E09R?pWPojp_J{5;&h~C5h^k^ z&2K!gYCS^5_G24RIKhI}#()}GtJ{sl4Qeo7%+wywUOq9JZo&yYOW^B~Jm%zI5@E&u zG#{g3XXe-QLtH0f)7S*e1;{?Y!u)_>beZ8TQHNq^x(pI6;U zf$FJSjo+C;6mX>3PuTll)||cyhTp&ob)3Szb_(=0A9G*<&zSgI=`ga4=doZD96<`0 z2T{Jk20zoZ7$Pa<0*I)ZznLNtiQRg@gmYnS7bYiS7Zjqn%Oil5+o!o$w_WivQt+T; zXx(y>AvaF-@rd0t;{^-up<;e(|4GcO$RRg7vtQ4wmwr(NVfM#LCC?m&Z`cK+5suq{ zK?r9a7M96U!PG;VA~P>`%o3Fm)yOz;Uk*;=k-`B55{z_)A9YmXMt~#}e`~e|z1L;j z!wDRZZw|x}AY@R!PO`x(4L>dm{X?;TQEHjMQ-ya_zn>1J!GCrwAV&z137iS!8dc>2 zEVKz9*pGp|%2EdGk+vVqQiM1S>}v@e#0v;k-j3dG*cY(wjEM9Z1Th3B-rx(W81K|n zeReJnP_Qo|(is?TTeskQ6ujvF`#{TY;^K!8i@~>83k@L-leQBFm>-mb8ATL|9*;Gce^#|l z7{2NY6Q@A-eKL;N@F4?e7*}OW7@DRA5411Agwq+|z8-JA7e8R);$IMf6J(eTTbmQM z`E1QWQ)qMVz4$G-R@Pq6)gVCN`++vQiyRF1Z_2r;&sd1d;uIFjq;SV^*$A=#gZtG3 zHB4+$17_z3vVYkgaa1W{TDm~cGt`Sq(C@9^9wdaNb6R#ZVx{MU@6wWyMYXVcb(S%^=}<0 zc!m<{EBBr>)Aj;F*i(VfU`J4F=)i5lbq1eej)z4j@u9(Q#fw7^_m z*rWUBlDcZ!kM%1^0OUR5@f~I!D;((0s6pUaCDBX|HfNPSP@yz0PDq@iN`=r>C_oV1 z2xoZ?vayik>DGf6kF^-k+Xr+7hbh1M@m%H&gf zs6vT0${?jeg&Qmwb^7t(>)-mismW>@SJK#xn8Z_)lVX|SOT1jsio+)c3_N%FDC7eP zAE>IN6y~!+>$i!EPh20XxgR(Oct zyW`T_otklaJU;InA^oLT9`#xIZh!!R55M<3R3anaKIPIheEgl>4)6_U&-X7;uI`@S zV<*o~ZO|@|s?Nn$1mEBNNAjH$c^>asd3b%kp5ENv$H&_rhu^`t+a8ZMQrYDv zE1A!`1^Qi|V1ya`(|6_0+`1oYSc0l`Onb~RtTU`NEFJPutR~hoD+W4XTB|yee_j^S z4Rqrj{|Pn|t)&}i$6HALPe4E3L-Lt;CEf6UfYC%8X-AszdXiDiht2LAZp4au#c8il zb%4yqErV{_kC$w@?dOGOAR$^}p&bE?wkeJgaves7W{c-gK}))NL9@$P!c6A?9}1dO zxE;Qr!Lqtea6C`zgf?8(`Ww0eFT7IsL%}~_UF>bFl-vDiiu)y|n|s4V@jFkhOXocLEMkZn`)ztGfy#fb zJz+wRsd3+R8J0WVq;7$s8jOR$glLg;djlYf&>RtxP>PUZu5&q{BpAa^06+nb1zZ~q z5nQg|0C8FxTU`aqV6_|fYpgc016}m)W2r#~XIo5QeB3}{87SES?j_{Mel`svX-vPM z0_#1b;I>1xW}o9g0YOZy@g}yL^SXqAt@IHzc}Y_PYD8B`goS`_;yMXIIqF zcu6RASuZkvA>HePIw&hy%v1Hb0mAN_#cv)hMKdh(|Azl;$ zDc7u3jpRwA8d3F_;5MR|L!k=#>?mkptZA;a0iD!ge6l9}x~R((B+46&%U{OSp3+Sb z4DFD5t^2O1#`M5g0Tk{~H{vXm64yWN%LUQiAc}GywORAjT2MP)S3oZH9wqJufc`>c z>SqVU;4Bsm`5NJVae*&D<{-LTKReYNx+)|ss3KOur1>g?IO6eFm_^fg`T~X=TN?jz zqnSw)BHeAoDg{r;I4!Ni2upc0UR|5>g6-^2h$ z0!EhqEKQjR*ce!u{ulfG-(05u1qs+0{`)m+j2pO0(&hr&LU5jvD3@Y@Frvg+_bU}{ zaVP>oG6_inQY1mQAc01gJZRuBuuB3&-U_fffd&QyS`tu{bbx>WA%et%9RU(8s7io)-*rF- zkN_qDTTSkMP-14P(*%fA=tI94KLfJ4$$j7X}uDUamO_W$?1NKtkUj7hm8T zfM07k1R8)J^>+Ss^pL%9{c!{el=IL)g06iC@jT!yRInxWMZ`W&!&?ACh)-yOA=IFu zQ(+zgd-ZT!yt_&l2nE@B0EmA1H#0sM6j*UXMj(u~%i-uibd$Tys>nKZv5xkB1Pz$I z0)A8uEU@9*&epx$K^H*+UPL}WZ8-bj?!jS<7kGt0GKjWM;PjFSe3%{3x7Jz2P|(Og zlA#b%kpKoaf+^?=68C!ldUmK6YKR{DL$kX_K|)0V@GlGo{x)EkU*Nlb0UiSZnh(IK z*;9Vt-zES9hB-XAVW4Y+SbLDY-Q|1R^g%mpzaR59^f{p5QhW@Ej<>JNaj01aFOq@f z&)qwHaT;@H`RkfQ%H72p$)FgL|eq(Su?CH@h;-t5#PR!0m0QMGCG`J4cHHW zn32}UD6%)TpB6tze6YtrLBJ$ri8ALpCl~uk!(yUF^52Pgm~pj@{C0$2g#cE}7HyX$ zQ^tM@ZY!zJ_KiR28q*u?vhw5K3}!cjv9pe_Ue&E*eEgjoe~CMFw}#$-itj~ofm5}S zlVd>Sr<9V{iX!K?LEJP8%QnW3uW>tLI4FI7|EZAD&&Ea73&?6v7YbH4^fVKTg=dK@ zK8}+JTgGc<-9??#_G`D~ZR-W4=Ti~OJuzFGOtj(vAahVvpu4|)n3r^`a1{fz@Z!{Z zoPv$YRf|70R7B|1(`R_PUzl6hjG2Q*M&+{A3>SMohk4{D44Zda79UTph?a zNy5zU(6LDm}=j_G|}vTBWZaD*T;e=B72_0*0FXAjozoFF_m2KWE+HqPQQ z*^>PsOgLFGqETld#@xa&kfWvXUIxxlvvriMyK%Zb9`O3)<49;M<*u%l(ow!aRSd`Y zYrZ8k9c?GppL9rDx0k79?y1_uG_z>qu-iIdH7`}V3afdh9%|)){M~UE@ZrFs1T~iP zXkAFl#1Sf($9bT({-mV-hNn$wn8hm?p|=xtxGnI}$~%SzWauw0Y4CJUcH^AH09*zx zuzVnqv)fH)!?kfjvGUoJ8K_|UF!K)IexmXXK#RyOI=5GzZ~rZVOs|_OPra-Babkic zc`=Oe7L;PRU1Z_|Dn-ukyJ2xNs*XR8`2<=`J|xykL3hP=EOsBQ${6R@y`V&dEkQ=` ze&w`sQd39FyeOA?#p)WRhW+By=~OiRd@Ds$0{S@08wWj}$3u+@s+a@q0xm!66In)i03)o~K7cB-$DBmuD_c5P0 z^Cr%YLsk_Kp9G05z}{F1G2`rG25Z>XI5%R646IyMwof|rUNS_U*$;|E0`7tLT4F{O zg2nrf>jghL(s8t1AKM~5_7;n6P86g76CA!qkw9nj&%=8v>j?%osP#>(q->N<(U-BZ z6752quu(;>K~Dss*>n7v+k38zv&Ep5Np1Vqeum*H>IwabJ6}VuWEa4+NO8JDiso?2 z3`t?Rvpr)Si(MAp6zKZWZUtOoGm2-LovtVgC8eX$`AX0Yy8?HTo0)Jr47+1 zd8G*yVT&xzT+i6#+#v6j?|s94nx2CmrjyI$ho$U2)xEEUo6Ws{f2}s#)P*FXlu0FU zZOnd(XZ;f_Mh2}!ZH!ZMx5I?7EF-eQ+v0dWt*yKtMmFO<20a)kDYDYL5f&Hf!@d`AQjmyKIGHQE6i_{B&;u|ti zwY70b?SHfd)Pe+Ula0A&RcrtQ^_$bo+>tTFbs#;ojS+U>(H&60q*leIBAjzFVVd{? z{|kR>Md19;0VSAq*eM^T*Clc9zOYjTW!VuaB1T*6rkmJC%Vqz547x`g+Z^5f$_hs!opq+6RVD|huskJ8(d`D)86~sT`sx_cm=*dv(Thb zwkjt(NI^|YO8PT`(Wf&M6hQ(H%wbk6{EUqS< z3N)9DH&Mwk36VI(w==6#S=`hQrW;(bp_n|i6=bJ$A2hrO8W#4;!MqxnCao`Of**Ct z83ITxGsUL;xS;MI%tsVAWfH#OgkZ7=@2u6u>!z(dM@-LUL3|nOTigT1iCc-_;(6;q zZy4zP!HzXh^WD^TV$!h}JANeaRR_7N?Pi|8?c3;xk2q0+b3uY;o}9}LX&3$%nJ3%V zTn^RGVe+1bvP#si%xV4|hBc!jSTsK2^USwXbm@}vv+wdU;Y9Z`Y9ve|={{qtk+>R$ zDLq{i(N<7d%hab*rcz3Nc0g)n(5MK>B*{0p^Ic7hRiV-c6qc|I?-XUS5=S5Xf>V<| zgmEcb*b3L@>dz9w!gZl(kM0|E>!kGur`=R`MXQ~jrw?}Jdhg3(wF}`i-IwkN>_?eS zGOKtN%ghb92@mzJjGY2P4>V^E%t3G#s(>uz_&6*cX0$jMCXg-`XCb5R9NNA-)TL6+ zetLSfv$6}O<9@%UEX3L~C2HgXL1Caab@=L|mINKSzjNvRa-;GJwh~JrC(wfdRRO2U z-^>o4^SS%28O4eGTOO81!nIE7d_6U-zo9vf?-dC*KVEMupOwmv*ZY-?h+SAb;SHRYVfql=Q-vy*mtn`DXARUqO_*w!BA-oWn%$aH#P`#Oj&z zId*t&uP46EB~O(W8D32AxaU(Pai&}8t&Xmv>9#+mdl_yj$8|BI0O9^|6kT1q z@;K?~Gu!a`T5Eo4dY)*oB-DBN#J}$k0Wk!?Bxa;(n`yRMc`4Q%u_O_+WezwY`-Z55 zm4Equ%67oUNV#AozFHPSE;~zWorr=`jEmncQ0dm=qO#jWStPo|&vCs(t?ywb0lpCN znRYz8*Fsg=m-Ao=AFIsyJN7qpc8CWb&jT%{eS>oy3Hj+<1AtdtO>(HE(DFVyx9q8D ze{!d}IWJLQt1>x7!Hwvru>s+=zfW z+J=C@kbRxKkTan(Qjf%~C*AA2Q|XzKzgc>6vLq`9C2e4MJ1K3$`q);n5z2`TG}5oy z*SvR^XGKofHEa+;?1rtzNKgfB5ijTg|4r|QH!yI?n@sUuWk42@z5SIlYOP0A{$s_l zgCF=@LP(O@vd4t~*^{`i!E?UZU!>cuJteO5#HTo5Bds?=v6*@XKl*iJgRYfJ8d3>i zhoDU#8Qb31RB343i)O_7-Jw*^!iCX+O0UGv_}G>OJaVj^Ca>FUyAc_C0GvJ}C=K15 z7k}2`jT6q>L}`up4!6;@mUEMH=$5kYfmKb|D1dsYEQpax$h-e^J# zZuu0_5{uCmgy)g{1S(iks{S#Q`c6h24xuz{a$5P=xg22pd6rH1i~d{Z%S8-@&yUu} z$3;N5W%46raTFFWEpm#CqdjR(w{MK9XF2STVNm7c5Fl;^wxO%GqFeIhwi{Qw zko>d-JL@B}*T`b{d@W7sr9Qu>)6e-3LTJ;ogod@)=B~iFA0{4s?U*YxTTaMRmXP*$7Nqb!t2MlYE9$dZI_9rt8|q^ zLB)JPG)HWsIPhGpQyw6Cp@hm6_3&-5+^{)}=vbw_Hd1wKgc+S8t!&Umh1{Wz)x&C# zkpFuV^zl^7__{Pyq9XfZd@2-I1j3;TwJ^;vx|ELgu)a(eE;!jj{#OOD3^ifISlWnd zuIZ*o8a392Zx51`Ws29m=;owuTciDc3~Wn!GmR7PP4;d0I{1ve!cX2+g=LqJs8eEJ zYWy=$M~MPeTBfRS4N41}i<^CmsZPhip7CuMdB3l%spjPu|AjL;YM4ESc67GBj@;9c z1$l{LzziAUB9TP;-^L=e9WqbYPIgE1uUUs!rF>s z-A&8Nd}o$PGY~gucvriDv4>LjxB9(Ne9#OKufyvfR@ktKy0A8Nwb- z{q=TU;i)|+Qe{p`;(4K3JJv5OXFu^+(tKiBJtzKHpw>)LJKj0*i!f5LUo6E4j?Be7 zewrcPS1rL$DPi(0RTcd!$*xbKnvo9@l4^;@w-0eUvS6_?J7D#1-G_YSEXO<31dgs6 zr4Zmo7^51c^w(9M@|uf;wuFVUGIc#0t{r#-Q>D_$L}a?Ju87Y*%m zCcS&h`R7Gco7gHidgdtxAz)bKO`p0pKPB&HM^+_sG{*1Ol_7>h=VsX3Xh$jK{;!a8 z;H5jVWT63c&>{|R?1>#e5GUw%z?(urKH5{av8Ne57bkk7(=pa<@9tfmTjgQL)3{#= zfW<@#lC@ZWr1I(#MmnNr@6Al@!s{H-&{vbnQgCdFne{lczO|;EBP100(>i%j9!K&c zle|tqSc{md9i+pfNMi6&CG)$F^)U@wo2b2&Uji;-`#qJYFked|qn%@%Ow|1b@4t#p zCK3=rW1lU)zaosPjmta_w0R46B+TRH-eynW&9MUJ)=BSQC*rD8QXbF>SE$ba5$PR> zTPQc3HEV86wuICgZO%Ra38k-_Nfcl&(ccdgQ8VJxjlD!Sjnm8RZdE6 zcgy*tJ1X@ny?u!a^>}cw+|V@^bl$W;^cqezO4}Bbw)4FnZ?K{)rM5*+2D~5jmQ!i3 ztRgS4(d6&!rmFS)3?nppB6wdJDVV%o-`WNNE$lMZr-jOS)Pt#PLI>0zl+ls`wu)fd+cYfxmF(WK$?-PvYX!=cO;Q;pst8Q>QYO6 z{*`NWWfitE5)82<&lB}kT(C4h?#J1WvZyUZM>X38@?Ir6VGhE~#>*uc!^g8QBnMQL zeKB)%b#qqn;EC-!tq}71_JT&ra9e?wizHm5xFQwW zHv}f0x+0B-=8{g*3lp@h+y3A~6YKX6G)A9#2D9Qaa+p`-*WDQ!YBG8w=zYy!1lOJw zWU|dVuFN#`ZQ1%*5S;S2kB9lojXHV1E`o)Ly5k5YX?#Jdtc@0F_xMC1s#Wbm)b-Bz zqj^!u$PtLGl%13bZci`&+SrCJT3AAD5D|=Bae4``KmALH4y0KZ=&nVT zucjDBsD8v&1YYV)D(uq$w?hk=x~%``qStqPXcFuV@-Ky*eNbPs`V0szjJVN+zIyBi z^KZ&f9JfikFe#->;uYrTa0w%g!Kx`XI|M96eX3OXHbV2K)3fax@6Fph#EkWnYR8G# zx-~9ppbv;wpL*zU6WZUvjw)g1issZ%H&32hh9V{sV{mdWUbPt1Ga<@9f747A20n^x z_u}q$BHz)K>NB1hK#6A1`;n`JMRK^eET^S$J>yRI#AakLTx4mUq*1AOch<^eU;q0( zR;}c`64N28q#=@QQhT_VAE;xg1W3yIW?j9OVWAj2ydI}UzM9itZuOBIAgtRHWOLdl8 z!BgZPBo+;NgEiA#Tunt)EaQ{mIXgKo@_LAGEN$Jr$(Kv?=lScJ^8GoV6km0R5h%V7 zWH^WdeKW-A5Q0UA)!JfU{~f`~w$OrLg7Zm7l6O6{m%RI!{x)(Td@nZKIS(QZW8=b= zX_uFg8GtsbqaCj~``ic8szP6;3Ae-MQ0^)#y)gr0WH>W3!vHiGF0PV`9h_Ch-QbGQ zRx*7i>G(Z=5Fi~h19$Fxc~n5!58Xs>rmM<<;%oOhB_S`hFUj|*7c+PvdT;#m&WUH@ zAk;OBltOv*G}OP5wN0X~LRzQmi^t;d4aOg9#&e2SbO(0(hsJ}8B>i3}qa!raq(zsx zYN@%lgz?4J#i#+u8IahHJ6|kng|nkso$eO**kJVp8Z>YA0_rG)~pN?vg`3;lb@b2oGg-wY()bLY6^nCU?ICkAhaPNqWpe+yoXg~ zfwrxE7RUa{ch=$T7P5THz%mC}&{=GjdL68!k)GB(^1FPiNzy1E?8eraqDIxS=Hyi6 z(DT2`11&gag>U2}zrQ!t4ZGx&@%I_F$Y za^IMf+9C84_#QPx5`cCMcd)kV#Z1t+alvQsG(sOzpC7|o@$2D#pV280EcuPDv%Oa{ zT#BtI?3vbBC6uM!{XC)bwD-yPWR_p0(k0#h( zI0y(Fx?mNCs$zsz;upo$TZONZMvO3YwQ-z$tBO}AP|M&Ae23=h z$+*gl(V5a^w?B{wQUro)>@+HMvmYog-c-Z276(RN( z8S(AmdnkooYUC+MSiBe$Bw>18pdE_;fhW%$YR7x2oVrrPiF5ZPf_ik2#v1Q>ss1c> z3rl$)$pv5LR^x;4ZV-!)-+f#21jEr6FRK2AHpr<7X>E+{yW=irQL1n_l~#Mwb`}XwHyBol=0%+NqmFodT&xZG&)im z78#<#?4k+=h`#`6ClN9~2(mdqoO9r-9mZdb!3~K6mH4X%01IS*hP_e_&YR_sB?HYn zK7$9q0ebuQ^-&yJ#7g7FgB1j@5K}^>!M%x44&vm+2KO6K?)W9?r#cJdYY)A?bar)l z5YrKKO1ODhAlmw~;~fEJgFJdSyY!p=^}xUyiRfzi6K_!gAdramvHZS1Mfl^m`-ot9 z_|x{3@OuH%HzKS3n;@qHAaCVA0558P ze+KLv(M{Cj#r(?y7=3+2lX zft#a$8MuPnoKx)`3f-DXA)|Ur4}L}R5<5c>3JM({A_^|@3c|n+n1nj-eXi&XsG+%Z zL;jeE&LNuJ!8n7h6-EMq3*P9P^#lJRK&HnA906hA9=>-1{C~Jhy*74A0JKw#2*QqlS>U{z`X%{nt-!Wqo zq&|Qz9(@2(4>B|W@{d0V$!Th@pW0kN@3$++n|wKSKOzhu=*#&}cZr|N5_ z$H@W!5R0A7zL`SNtW&aFwhFL`HxoSr3Z@KxI@hoL}#hfb;8ZEA7tFeyk?l&f% z!=B$03MVw~{R4R)Q#pM<9nO!zotW0XDexE29Z1Du93nr!ZiSw8;ql+nyzpC0tgpNt z0|r5?S+|(SwkwTA$4M*=Xn))M`&#Kg(47s%xM@89{>=0ZV$CZq7y_^HAT`I>)`#BRb2!j)GCUht=FLgAtFXlzdpAg56jBL3@a*V~X|fLDG3` zcOR#s8!})WNZLl}KwG%tj!QvV;5ci-YrAzHEwX|(a+NS4(>9au^3Xq6oxa>YaJ|yK zqDBZo{}-Qm6JE&xYR6LYFY;=t&!axYwL&q3i2B*4vJ^Ojc7EbKzqtQUtloBx=?(K? ztl6(jf=V(CT-$={fyo_W6x~&$Emng@A6vCMj*<<&SEr>xO<(8o&!<8wFfFO{b^*C^ z%2(;qSkX^`Gl~OP;n`Y)9Emn<*{Sqno;fWw2V+@pLqo1sO-}@Pw=AT~ZIyexjo-n@ zTXY@2f2lKF7I&T3{V4UeeoiO0%DmsarOT|YM566btJ)mEeCmv27dCvkSWU%a z8}^kUNR5pdq<$Ag)$}{x?;g0ZCBc{#@POaMD zf}#4sDD>jo@;RI(e5e2F>nsq_n@F8*qJ+UBz!yjW3$Yq?f){Csdl3&LLLEEOn@jWqOk`BiV)fR1V0 zCyTo*sH{Xk9NW+nj&l~l0q3_B?YuTRA(<4P{e7;ckKfZ_Ed!r>Dm{4ukndj|73CV- ztoxFz65(T}gDrK$Ds*o_Ji2=dv<6$_ewN#e>*I5I zY|Lj_uqAj0R4KYg>X>mc&GxOzRrYO&6*a;)jH|jYT_f@;nPeDYI=Ud55nF0rMd`D3 zUzUWgc5~$bt43M($%@As4?T+Z_2b=LG0N6#xQBlq*@Stw|Nj2FJWlahfN!rnL=H{9{qrIDtUPAOV+Bd_K zV670u>!M-n%YyX%2S3Y64kMTiO^@12c8C~OB(DGWxU#bEbCrR*$!CmIM}LO~zZ1n; z1T4*;U~BLJvX@LSO~g~mvUUmRT8z;x%28VW-$vg3tmXH0`wnldh|*Vz+25r6oR z-fQhBHowQpP{Ljcm0YrJ?>5=g44B;)%}%f#LM8Zn+0MKUutiCfA(C_HwS2Rm3O$fA zE%g*8xO2))G{MP75ALPmLq-Du5I1=b4FJ72sAYzmqn{r97tiQ7#J(oMm_34?c znTWI{`qENJ+1Xgh_+LI49F2c-Y|-4LRSLxE@hN3MSG1TLzKmAEyWhN27<;tMgy%ix z;njPwjI`B%hHOVISDpQmI=6e=qE^>N&lboDJiJ+SqY%?X1Bx&XaSmrSbA%hJ9GBi5 zx%{9O9bvdZ<#iRiXntp1@{UIjtZnDPzYRz&(r9RdK>HRYm+s8)^>ipm5eD9wkneeI ztaYbqlu>;Cgxys1{#6765C1NwQsp)>m=q%B<=^ONg)dF4N3tFy0-Fhy@)NgQCt}&y zDMgx8f!(e3=KZ|5OIf^*DX;t zo3^dN;of{kuRoL~JtZdMX)W&!*E(&Y63iNx$gXWw)pLiZ4JsEhxtM3VMx02RW#fqj z3Dy3!?MMq;ZlR-=fjCztX*Un#*bC0tm&!`dUQL9ZN+4kJ;N_qvf%y;=*mV?E({L1j-Bc?~9J+;dHE%$wIOh-ri$BZ`yVKPm~mepWAy4bWCAVa2-K zCOj(qnw1t7mbzT-X5iW`DLVD{;G8f87sW0?E_hl~h!y_}YdrVhLlS^wu8e9X!)r%U z=@zDn4<^WEyu{$Hs>*}avo3@qw6jFiv~kd%$6BEmL$PfhMYG0BMIiethDRQB2Q@lp zUdGD@#4Pcfc$PZKGZpQA&a-T9K0Uzy1l1G)~%uzDyTE)NWusWM3jw919O##haXM7U7(NgCUHJv=)0 z2>T^aZO}ee(r@Lu{Q+z*E?uTdUa&Ay(Y)Sc zpCjIXeHf{__w8Su6S|sNG5T{WF2%%bQ&d5x)u(t>Ebjx#|iQqyCf_|uc6 z?Y`)gF^SI91^2<+Ec7*7)^oDWs)@U)OW^MTSk)qwb)Rv<6)F{^rV|bCSfjk&ZB!Rxvu`SY3#w~Lv(&7GG+kpM8k(0QQu8hZLpVuV@cj3$}|NT1n4iX+L zs7&BGS_OwCKc4;G+Wjv4loG;}nv+=DFQ|G798~gcOI+qF4^#7ho9D8N0&8sP zmhh`;xH?k&oy2rY-&4Ah%%&KH>-S>pV@s52{mH6>GLtqrB3NZ_pXc@4ln@kxi94Y4 ziT04E#v}TaJ=(sG7z#G*6D zH1+>bMXR(FkS^f46R~MQU~?Avpp8i`g&a0~@SKE^&~)lB3ov9Knn-^QmVF^Qkdvu8 zwQz*bA2-a@9*vS1#{EP6;!G9+m_+xRHZym3p-q@cU7t40)t7!lUzl>7;yPn^=`4W@ zGX7-LvQZ;yevI#Bl{-1!BYS_NZgsZI*>hMa*(u5?%z7>}gAhr=DQ49;N@)n=mQ%q_ z7;!|ppZHU1JoC`R%x|7}Vmro1V;5WIC*E-`Ep&~vtqP>YAC^Az9Y?V#t0ed!Q;2?k z2>SJzmq&QJkJozjsxAtG`HR95s6Xoq;$bG%MQtpFPVsM;?5#2(2B_IuF>R*v>={Dm zuIc$5l^BxwVFbDSQED8Ip}U#tYi22dEHxl zZ$Ccu9?H{Ofo25HoBeNI5e8pgN3q;b*RN)?62HNV{A@|GFoWd+RXNFfw9kgx=XB!i z)aV>4C_qpsvd@YxGL(uIF){O8P+u0Y^!c6n1&@p3MSy_MECH~{W^1(0+V~jAMCq}% zTb(RCQXtHFESR-mU@77?(a-$Wf&vEnxHRp5Kn{%;wiJP|*q*AE+wR0}P%}Qkf_g?a z%*8=!uOzKTJjib}PjT+ciP~sE+zE25QZOjh=Zj{rkM8-r=AC;*Yej%`P~$RF$?h;o zVYs@jXNP#z%v4Re;`2kkr2;eAE~`Eh;X;$r_@wu5m5kYZv=-=k)P&Mwy92rAIScfJ zkH(`hSo4O>ywx{J4I^M>P8@!i zDnTHsL9@ozG;P~;;iJ&BgyIMaM!pukda{5a0}U6*=AUcjrc^SO~@Yi7Q3`Nl~WONd#0x1v1p|t=4dDgx4_G%LYZr7 z@A$g-Nqp_*#6JzK5B5N!-OS-U3?J*{w^|Dq`zSg-DO4qf?=%DR>sTwAk5l6IFtk?h z_oHUYAXB*3d+aFs=4cD9?yl@X-7$;N_HQi?zVyy+UYe5m1JhAI_u+;J5V;Uc9*epy zb#E_<*xv?K!q+OJ(mpz8c(xBAx1A0Lm1Whx`>!Az=D`d>0c>bR&E_! zR&w&Y%Cw|U*MVX}oxT)0Qd|4ox6tWDTcrrCt`j%a&fO87ox=qD$~BD|$Oe+tY-cRK$*e)!Jh)>mvstV!Q=Rw zuI{;(N+lM$h?Ws}OW$dy1KZ1y80lzdjDI1fnmAE|^p1TA_qy()PD4GX*;6|%_hW6O z%)9-2UFR!==kGfHb{pO&x*Hv_j64C}AV)LV7Qj0hBKrenx>~YDqsq_sXmn#eSK`j; zr_Vf89euGZxg@$$0*Z+Tvc}7LC)<>`B578`V>)?5`QgMZ((GGa7{mV zuyC(EXjvDarz=lrVku0}y6yXH?kp`fw})0aUkg~MU9EX!$|IZv4AeZR51~G_Z;?>T zfF)S0$j=~StcKm-S^V}+Pt!AqJ@I)Q4~Kh@G2WxY#r7p8^P-O6PAl2Y3@OP+ettpm zoPL>yz~u3Xm;4e^om+OWn$t0$FPN;4ox%sGuBIZ^_0T~=yD@)G#3n53t4C~YWA*Rd z3;0-0?eMX-ymBa}Y(hA*`-RK#xV0gEr*l>)5A$uLJaPAtNkm!dvC*vMKW`Mq_P&T0 zF>J(@W7I^_KHYL)hvqy%1`rH#(2P zEy!+IPpZl$KpH5Vlp8}Ig@V{j^R*)$7-h2jeMP3v#H4_jV=Jmg}J874TZ`DY1YAOP5XABHqjb;6pa%s0&;l@RBO1l+fC7VX$8cEWJOz& z*h%UnHTMJ0!>8QNam?LmQtJBOVsTD$7n!dcSvfK)83TxB{T7=QsSu5d#{FG-cP_>F zS22$guzs`H&b}+Ft5>vHq~)a94JHCYy5-Da{`8+KK@JDenFwy!+S10ITStnDDrKrgF(Am=as&8R$ zZEl^bwFR&yW>;>#-ut|u!^zsssah}F>U<3JZ`0!vWNlG~$ir+=0PJ;LW6%&SMX#s488>{id&g)qln0iY6TfxMcKLx{Q@+<4?ZEi5x0JBZuMB3%&B+Ngk zctHy4Zka(5&27}$z|?ZkZEO+;lU$u0+rN^6^>g1XhADtBJGT?t{e*3i!;7~&XtXU= zMxbM9c@>c}snO=T4sXN3sITy+t*vt&+eNgzG@1vBzh8{t95xcm)F<1!F{j_gGcf+i zWCx8@sd8=rIWt1(2KcKvL}NGe5An^7}N}qZ**AjWz4*2 z_e?5m$LE2iURck`sTlw6^FgLDwK{c-YD-tph$&$AU=l)kPUG$(7|Lkccrsn9&D{`v z>`tBqUrRQSJFpr2=lDtan|w2h)Z&!jGUNtl6->+T{*XKhUO)c3(yYg=Mt0~{{Y4g;>N*dF;T@c1d447 zl&}28c9)AzrFmcUwDoIyl4TiLcg2}u0lm;lSb)LkZ$a_)ry>S0FY(rGgU7}RpoQV0 zCQWpuv|Sa&WMz3KB`n^cm6AmdCRN9`=YdvyV)b}1W|`td4A8^t*P#Ba7`l^eL!CD5 zZ1Ohi-|OuT8#=mnZ>g7(FUyYZgSN_5mG)ONuX@t>SCyvGd)_mu@znW7jlEcC`cR_C z2n#RfrN_kEdS7M^9NWYXLeuGTBjt4p<)M#gUoMwBt@|wa<@TrisP~>UA#b^QCGG4B ztPu_8RUnIo$r|GvT9n+!s=9eQtF9afymWPZdu0bfVa)V(WXBdpdlFNr>p_X027ehg z>!}(VR_W5-0y+_LscN>Agwx8@*p11Z1>@04e!0-k|;>VzVquiwwM$ zZ}fYPnygAyA9T_lfd&OeFp5A(rbt2lfN3KwdOn zYt>~R;&_3065HZa(3vYty!Ht5fYw?v`(Z7;lqoqHq>lpAm%NjN-I%YO^1OXTQ-hKn z&N9nJEb0-!nkbhr<&bV!!%N`>&jKb>HfV9 z|AR`$%<+F(9{#sV$ISU((CxpgbZnfQ|KkRlXm=neTNzZ9@Sz&Gzj00ISoxK{k7pN|0W}Y9m}6kG7K2zHycZiH zV1S|fTcVHjBC4-d8V=6O%L^`GYgUL7iNZq{WFhBC?~=Es}LEM=Rr<82IBkzT)se|0bkaL z05b45^>+Tb9@M`0o}fNt=)&BCD`d{GzY^8oGq2yGi2$Q2*w)q;hs`op^QE#! zzyR&K;}i0YS51R@6#ek+bp$Oggzpy(^5~4kCfZNv-ruP5tzY{y!EYl=AKM>WK}uU2 z9^9W7(CbY!-QNS7_R>D!%k7t0#|-|~QMd^bv&yI+U@wmS6gEhR@DvEbK#)@_@cr%l z;Uo$Q3X*3J4Y><&3M7^M%Eq?}<@{6brD*guQe!SP_21@iZLfDEgYL^nO&8u5bK zb#5puDH%OF43(i@n(7EJf`Wb#vLZ5gfTtV4dxHMVj}BC@m!R76;C^r4L>!`D!6F8= z#DL4F0DyQB)L2ar1_X4_+-mxsx%wq1$G2m`Mqt30{ba z|4-m(a7QQfHAjuA;T`4&k5p~rCPt$18X;}yp6B!6j%FBxmeF}YJ#S-%?_ph^w#VV2 zH2`gA<(`r7LcNXn4^9RIHeS=0>XA=hf4-e~O_qM80(#*>>)=6}YI&EjFea=QjW-QY z<$moCbOgcN!xNQTxK4{~g(RnIa6k5}AmHgxP;o|#f;Tx1_YG->#bdc}(Ddle3lk~* zYS~ey8zynCrD%`?ZjtX;;kYtjKMTv?;o0RsN0b6w+Hs#t7dmcrEvC+iT5 zG$3NrBQu-3F=9p$Bw{^(gq#qRn?wBvmq=qv9B&GX&UgWYB`S*r^0&LEHQhuGsT+8( zT+Y(~4Xte{Ni6$sT{rk=k*h+E?)q7|5Hd|?Q@dvya(1hT?CxTw17)<4MT;I`myO$> z#}slENI1)Ecu>h1r0HYW#ZOU`1$BOvXXKKZ%tW8uR_T$ znG}xsw2o&9eZ67V6i+o}KY(OP%T?P9m#?l{Y-4>!dK$r_Y8`nO-3>lv1kb#aTV(DF zuJc2o^+zhB-Gi5g0eA8XMBEwmVapIPxBRGb%dxo6|3Z=Hh1aBp^X;X9YF9bk24|i8 zalKiuj)tWziQGP0;tjX&R9}421GS+KL|*QU1@%;lm9j?%0Gp_?C4ffhL2Jlp;Yqa7 z!Y#W}+*11FRui(@MzmNL?=v9=Qj#jjBKoEiic&$vQhT4a($`DToT*^BF-5|n@ovPh zLcC@Xa!i8}+Sm^vL9c*n^Nq*@Md@FvpKb`xp9{Lju`D(&ll{+-pG5!WDf7=0_&ec6 z_`Ok^XR-XQDuU0e-{0)LwuV1I5-tDQ(g-#lZ57WKj$)RRObn*8i(*1rzH_CLRJf8< zv6pL2C}x~}k>zReDZ{geHMe$f^WcE4D;l4a?o2(}Hej1n6yv8{nl}BEJ0SSpmC~9L z*;MN(Xh59L?`L&{BapRyYBS1Qg6^bj%+5kvJ?mXWhhcJ6_PUrQ%;E$X+xwN?1 ztw7}vqo)yj|CzhgtFQ@*D(_xZX%($j><&o{wNgJtk|nRT*b4Vz{M;Ym`iwwXlINam zY?D!Y&J3Cqlo!q6#=!1oFJ@U_m&rYRgR0EQ!iEeK<*!I3zM1ccA@jMZNQ2ImHBe%i zN*?ztS2sRi!<@vV@J%RdMA(667GC1_y}xfSD4 zbNhacgQtjbf|@2c)jk;Mr7Y(;S*Bc@+x55Gn| z;y^8=ivL(c%bDX54x^=kWq?Gv%mfRe6%ELX??HH&%tOl1JJ$=e{#{;SuiaBsn{__T zj!U;E`UOnc^a4ZXvR4fvQN2yqjZC}hHusDgJMokpX_f#K))+{tXjJgoxr1q9C>Xv? zpi_8&JG4TcHC$7P`N~_w#Ne@i7XGv@Q_1GXo2bTkH8ZKAERD6Eg7o#{WXO%hbU0Mw zywlMxYr^&B`_!I;?59ru9cG;5-itqcbCluwFr=gI)27wIPlI753qoZ=hzv@IpkNt` zY3JiGa|IOTh=r{myf9EO;A<`sOgIu^0p}w&tzqwQg>Hg)m(lHT_I)Yz zOrH4*!`SmEpTlc9>(mY-^ZgZ&wd^+GIddws!l#~2TN#ZI>Jl{3U=zcRZVE2p;D&_H z5E8y9VijH^Z+nj=Z=wvvx+R z^q8uXYD;)iBA;coEO}|4U?@lI(t;>zXSfV>q$qlh?zbuDJLY(?_)A&q6bjkPhw0T| zvuF|(ITDMGi(_r?ZDE_-eeONMy_lZoYGzxAJ+8C#-j*p@+Z6H81RcYm% zok?X29H3Qdi4V_s$BOb1O>2$(1o=x6#OtN630~Z<>S5 zH+tgtOkjAHxy`?>s~zVQ9Xu@eEW26Um1oFH9Jd~|n-KBN;nr!p--u_V&GrxlT7FYE z9f+A5N-@dwtKfQ4b*6Lf?x^}L>oU|)-)FeQ>hoQrhp$NE%ig_W?xDCJk9#=Z-7bA`RO>cB9_4t}?xt#}DI9RV15b{{)WokN14 z+?%ks5|19L?CtkGkSfOV6%8mLtdh4DWcgJ)`w-JM``5N(5lbtcswle7w`aORwWtMc z)uSo}c|87y7O9&{g~l}C#hol0A+3C7tIfgjR3{LPBb_vD!Hzv zb#E#2;^&*N*tE=5DlU2-vBUi==#e_$qFY$-GOLD$SW;$!=1d#|L5y7O|r z+*t1iZRT^nXi?bJ?s0*|;4@-OyOcVVm$J7l&hmh6uE`y@!DEO^I$Ub>}s|H(OnBKK${ttAk3pFO8 z>dU8=q>?}pX?1uD_KsxDsTe}XOX)ItlwXuB1hou_4HCvsIDfW3yViBTFpzJJ`5!u>sAqW3AIc+B8wpRNIx}fZ^s9yCi=HvM2sQg=SaLov2Z4>Wim|sC- zn^?%Ac##-yaMj28fVJYfFSFR0b`1&~H>uo<DAN^R%?O!YN#imL12fQX!ub6ufWN-Aswsql@zvo@^p0@YD(i#(~ zB3yCb2K8t|Tw7b8hk+@}zx~Pe4kHK48CwrW$pub3+&mSmPg!tZ7&1x4*7%{7ZT$jt4+-)YbqDQ^ zs>)~n)rg3&t3^Tj- zcW026OwUZFHkc<9e+6>s%ybFw?5~agLTov={Zc43EV_&d70J_NIP3VaX+}f6jAH}r zd|B!&1?P9VvNco2xLuyQY4n|;vhB>T*btl7Ae4L3@BLFzX8Iyya@O#dKrV6G$GNK| zBB0cd3BSG2rt@i&=o_U+U)RMW|EzGt<(#7A1oHA~-6%f(BN<;gMTY_A2ZTPk{2LVt z-uPfr)dJDMp%mp~WX6b+Gy@f)!S}~uMbsz!)f-kZ42kSn=!tv^EvqJ;Kv^`+RYuSk z?Y2RXSaV9^8vG$BnLNkh#I~t<`7~h$BXuhw>YE&&ZI?yuXc^rK!8$WX9-gQ@m*4Nd z`MhSk+TRK_edQ2(R;#u&TpA(fJHgX-4&(9e*&41~q_jYi!;DXzOJz+27O&Wj1IJg= zFrPdWMi5cTJ)t-kO@^h&obU=Glo#kD4|yRL`f$gJy;&=digyl)_pUa-YT!e`-~Nul z7soB(OuPAGcqaC;PFo651ykJ?jrcZ#YH#ikj*`W|pNgaUn$lwV{!@pVECQ!u%o(;& z*Ncm$R~{OXn?<6RGq|Z#h6waVLA-%3jCb9RtnuCz#E8`HI!HEST#TPGQUop`(7=-W zuY`v`g;vWWW=;^olU&5D8wMeeW!k9N@DRYV($L(f=7p`0!ZCNXbW?fVrzy|$Yr?1n zX3tJ8@h5sY6@q0N=N&jJEICCpEOv}?i18YAf51?vM97 zFGruaGoIrsROaXhjYtilRmU3=S8crx(FpnlGs0+-+KDS{jNL1meHJo%hN~y+7{lUG+ zWq--A|5a#hmG)OJhx)B5Q~ov7+$W8q9zV9wL(e>{gfXN zsMHwR?=zI^a$(T-3hPt@8P;54iCa^r1mvjMTN_N_xO79)vu(ChUAKuCmCK1Wg}*sa z2I{AIQCn6GJ6#mu05QIPt*Cnsmt|IBw6{uzQdwl(lR*E;sx!65aMj4ZcVupooFW*t_Cnnc&Z@OVLslpL6rhQbk;QJ+})$v66ztQ4q(J39m zEf>13IZr+BKt9kBS$&83HI3O1J{J=|~9lTRIa zP?P<&Zbt+*tNyRdrvmfILFkUFlQBCvBws0z3%n&rcjL{qBVR;rp>3F>R?9p$GZnFB zVKt+O#~ys^4P_*>Y4WyY%>{;2%F1Jhq>kI$rz1$8&z)E(Z90Ci@mm;S~&@ zptZC<@0GU>!C{Qss@kae2!*OE#&Gh;MQ*djkeh0f@~UYGBDEX{obRw{+E68lbd`rg zsXsV%mRP1`id1{VC%pK4ThG_O_<(bK-Dy+D3BK8 zd*ysVi++=}U34GcZN1M~-R&e=E&E{fJm@uL(D_lkeWnW4luQ!+i}L6#tFH+b;Pnk3 zC9XF6>D2L@U+Hqi6Ez}#`;?xnr?AS+Py(@@Ci9qWXKDsO8m;fHMg0J{`*x46JWbgi zIbt*1iR7m{mAR|GEBN1ag6IEMmIm~nJPxzXU6~K~78u!?ltvsT$4DPcJbmCjxnYFk zg?%dX|BKPf(C*+^HMyhht;&WJo9j_60tbU!%M2VdUV zLU-UI*@{WBp0+DTA0&m@WmazqO zcIW+IB@Fc+NFNM)^R?l1Jw~ZS3a`wn+!`3zygv;eqvUM|S zI3zHhyvmORw&h+H)GAp>Dk^vRX`O+w4yB=DSi!^^T> zTH_Mf&*Fq?u}t(s8I4kG{yMu>S`dwjtZLrdzZ?&NzKi#L4^_7uaDVBJk2WvsXfD=n zNN^r`^-DCT8&7t!*wqF0giQiza+%p3jt)AjRmK<2o7{@ax%tK3Jl_u)yb&(0kuQLM z=+iO1xg+xWDjuia(_gb6Hq+j?20raFso;X3MV!81crT@C9}Tw88vkk!nW^6fi|!F% z!SO6jY|Yt$vBXf!3A$Vez~)Y3sJdwt6vvP&)h$pTv~UgIn!+2D;D#0YV{O(6u#CS- zR4f-isXjIRB~6iU$Xs(}rG_dio<>jPM<$y#Uv}=IenTy&|1gRu$nTslc|izY)&geB zYuzSZ$sW{j({rta2hhi?M#7>aeNIFNfYKN=o+sjnCC`mVLw?wBBwTc|x^e7cBI4Z` zEB8QK$eOA=UFi_7NY-Qrpq*&2WoDfZOP%&FxRZWBVIX#3iM)-gi)UHd$*?IqIboTS zDwCukwZfL6#>B%YMSF3H6gX%;8h<3~6)d3rn5W$MU;tIWP`O-W3qDd=c1;&7Ydv3u zGHAUdjh19x7I~UwgeH*aEYhdH3gKz&g#$#ss|Fz||D5D?p{Dc2la?TQN zr1*#f0O84A24^=?VjU6_|01G5|HglFIz(IefzYrYBOE6meka>aK%ItV_MMLBhUbpl zXP=zdM4g#9y=_DbIAuYS*$*NRK}r9D=KOSQ0R;t(eaY#JVp+if4_jOAMRfrrn^2h4~i=TI-r5GS3w6Z?*dZz1H|eRWE1Rz z7Z)G_c(``;tMFqDB=yA-&QmC=zy;rf6XyV2?$I&$S4XA*)}efm0D`NZphDU_acQ36 zSl~d=x*>qCJR->7(F-sl>_ERW4*^Ac_Qo)OsLdlR(cK!hG-WlhRVor49Rujbe_-e} zX_pck-RZKsm!JJ2O2Cu!vr;poua-KD`cg23s|f=mp(-Vwfb1=z$u9gA^#_F$nnj z=DwZ5fPn_D4HBLMXr+PS3Et%b(-#=DDEW?-=5j+}|$2 zyr@LCX1^yHKdlUFdO&x-tPlx$`Mu7F7|TOITE9shr3Gt=(C-1Ce$tFb@U@K@)bjVt+jzGkx{2|5?Dlh!8Tce$fI?@A+-{xwgQZhJ+x?$OQU<9Ft??sRGaxm1CKIv97~FD0*R;D?PAc^VPSb z_V1zQl~L@OQo6((W{$bk3OM8ZTY=9sNA_`KMp?}O(HN`|9ZFD zuM62`c+hRp{aLUHhqn{eJ`(e~F=0Eyd}lzz{;j58qVR|{q*0^U2;{TCr7ko&nHflQ*frx4F>|pQC&SEYDAFyvsB(Qr8(((rwUCY~xf=>VwNNPxXS;IWC(KU1>IT$0maGo^Jv8&l-yt?0cX((c0u;z36T4Tx^ENrayxjpx1R(Mb>2q(`hwHePp=5s_U<`m9aoq{&$%+9qq{S6J*C z3C#yv=l4Icg?6lBLK|zYAwA~h*)a>J?6>hpPgU2}O0LFO$C~5GHqS_}@-mg(1^Vb* z0IqFU!aM$so;(SYb!g<7cr8cs5ufl1^eJdHp9Gjg6gC}=^k_*LhsQGivX6jESTT#q zM9Yz@xC~Mg8Ce=v&p?Hb<^(-{mdwV2d)gKP8BI96VRUa?5h1&)hP>VevDQx9sGrB1 zW&g62X(N{(;!GAendOyX3GaoDE^)bCkLQKET>&$**Dyy(*kkGS(j)n8$t{6R0g=!E z>BBz~`}@txu1h=}2{?+tj^(d^^#3Z}#}4*GGf?1>TG09G42ge)jbLm;Wx~~OdDrn% z3)m7kwU%g&kB;hrV;X%+pQ-eBL)E2$J3r}Bm7C{X)}DFKR{`p;6o+cGvD4(pbQ_JDExM~W8v|aI7Pg4?(lq&r|}ZF8iVu%DS57A3b_ei z_(u2@7Qzgv&^9*DX&US5`z!Y3ko7Y|+@chVp3`u87Kb&ypY!$TM=-K=3{t@z>QWdm z_6edV_#$RwW=AsqsKjQDN;%eZ8`XNalEd`Do=|ao(KU?uQGl1}7WXJ$1w~}@ZrFL%Z$PV{c6c){juvnf;5%n+#YqvKl zv~WEpz8&iF9MK${iWpca7Te7=2@R*d47}%pB_3wO*&?;0Wo{ptu)|Q`-I^JPDpLtA zMbnFMk zIA%l0bukZ>t_Tg<(D_0tyTVGzn&5#=|5=CwRgj6qCkOPDV_*p3c1SSfs1OSsH$Y#b z1f}NI^$9eWi`y{4Jy9^bCk_NqYa9;ipNB4e=D}Idu_9nX|CmI4KBJTq^uU!ep+xEj zJE0`MGe)I_cVK+BNrziA87_^{iouZW+_ByW^IKsPKh@_Vch@n=1rip*j&NDK!J%@y zfH(Io3xcydY_+Ab%B}RJwwuEIV0zP-mZ}Inva}O~`aE&mP2!1Y2g+--9zq-SOSMtq;(N{%!HGQ_C4NfB-v|;roVmr z5reqbI*4IRMe4-j(R64MrsX~-thK%!z0t47iDo73xXCTB%UQ_i z85>^lJ9#NfPP$ks{=ogfo<9D#&MLcPK{Q=l8X8dV44kPfO4ZF_LIHB z&=uQ|OF(llC6ht8ca#9md+M1$%%PeBf3G?_W)3uLbR16Fmf14hg!ov>{v;g#KES8r z&m~Ig-7-MXj_XhQckZYj&^KvL)?43BB~cklN(%>Yc^x!XAPlj{9+MtMJWpG2aW!=V zUX-tICW&yEBE&?2fU~t6RPLrZ((o?o#Mo)cewX1wT~fwkO_Q*opbVjziYYD)XoFcBFYScu-aW_P;6k zy}NzNh6b^fsrcH&m!?S>ZXf+NhG{x);!rzW{U0){Y)bRpc1%~|)_(`m@}g1K2$kS+ zqtnHS8^!Gg&&wDecqn}ZZrl8ZzN;m|sv7a4J*<+u=ez~!Y-5@Q4l~+KB9g5YC;i>! zEX7_GJvLOzYl(AzyRZ7W`zdm;*U8!rQRPKRTe8b8$40kx?Y`F=y39KG_`6t5#NV7) z!pu|MvnAt$vf*mp+F*W@l;pSpIvEaY zaYBd3u@7-wqrb-bp=<@?vKJ~@n|4u{mdAuT8A2lBup~LI?MgD4yM1eXI_vL(2t_p7 zz`BTona?%wES|grcWHe$r|R9=thFk-^i$=+%2e#eDqhLQ`|%z&)!eu-_z#tRSclo2 zuhb{0Yh`MH+($UN9%+a~(`TYeRxeDkg;aavy61m_$FLV4hL=wh3srrZTb0-7%22m; z!8}CqOX`O<9yJa(;tZ>7oL)RO=U5bh>ZbN7z?0oq3Nr7BVLfYuTa7pg&N59=|6szjInneEu0?TPiWU#7xAnXW!syGxH5t~=<7!<0 zm+_8Y#?s&_{8s3v7^L-PR;@LSgq9b`(f?|&8v`}%ct%TS*0IzHY-d@bDy+q_=~aa8 zqhjjTCK$#rj^N_2Bs~^uQYve}Lm#_q5iPn2Hx+}o+D!Yt@x9uk7pG&uX(_kaWY69} zl#qAZ#oNv|X#3MK*TEu`nkO3?aToCcX&LihNri`Q&u7e4u1!N2oEPtRQ%;huyJ~&& z;aXZ6uCIVKanoj^owvXUm2b}Imu1xa^ijQmKw3H+JBdowM-qtMB+K(b_MPeNs56F~P9qE6`+A*|o{vi<~?!{ld!cKhnY z2De?}L7^0zSQN*!gTdAbiZQGy{oT(=OoXea3R@++Bk0i5 zNV``7|6LWPqeypPxv)6L4a9iuh6T6zxd@e&!x1DM(@my2Z4T^%8Alp{s0d z3!#(RMS(WU>dWD44{BJ5ET(9`1Pf>8WB+YZXA>q=&OVhGLZ$6`InWWtww0 z6xofY%V7{RM)&Ib-U1&4k-f=tv2Uibh+d|7;!yKPE&X{^kLqSNntLVYV z=lD}tew;=CA|N(4>Mg7+5+g(nZ*%tL0~r=orZqrQyOGS`EdUC#fd621ozA78btS$S zAp(TPV&a=!IfE9KGjspv>0;!k1srkhGE7u<45A_hPo0K7sChQ z+nB|thwaKo=;p9I0Y>w>*?+{a4SO*}*(X-AauzZ`H6?A&5A0qDeXuxpJxs@ZCVr50 z-L9OGW)ZaWe-fT6{e`ETOVk)JyH;r7+WuzKY0s}*koe)^riJ07+fXL^)6Us2J9%VY zS|HgABhF1UK1Vs5T*Q50T107jS6}UX9`BCv>Kx`2gpGH%G9(iXv)F9&dRg+qGiTj? zWAw)L(pxtsD#0^D+m`S1_i$&j#}ssG5xma-E41;b5O~zMzm`4ZfB%FdyZYc)yXBL9s$^9C)D#Fq@ma71OvSRN z*1v|M!!{Ky+xf-4AL-<6eT0p+vYPVcc5c(9c5?2}J&@TX&>2}o=ar)dUim6Jk*2OK zDSZiBKm%M}C5EnwDy;D-@YGRAbGTtfDEBF?S3vV9yN9Qd@5q_~CzNFkz%K2A8x{YK zT3X-WcZ61&S%8`kgQSm_zNdM56oGY}HPfr({aFCb>wq|MDZ)4;o>^{3s}daC5iLZWo1C)i^q#`$BMP=Q zH)J@jB0g_$klQc3vR*E+AIH1!73eI%(2?^VnFat<$1C-<6JB)<7pPKhMnyFLXh+|_ zFsr+<;ap{`JQls{n=gP-QDkbh5M(jR(96Bd(rn1&y?LP zBXK{x6}p-5a|~C%DT7%Gp*)x5cOL-hyMEw(HkJihtlEx1(-GeW-vOBuvNwVJmt0#D z`L0RbtuJnJIMm{>heQMD24>GL{ufg|tZ0(Mt{AZ|#jf6$6HS)Bn#Y5*ukdcP#Aw-X zXXu3e`3~uyG;BTd)waN>c@l^g-bq>Kf8y!I3i*XOxc6cI9H|F)fg{EQjNMJLrj>A% z9}yAnw6@l8(*z~auEYs6iprfr@A7eIv1$c6THJQFU9r1Fte1A=^xZ!)5=y#)2kMde zDJEs+DHFqihOkbtCte3~n{BNIs-qn3Xt@eq1 zja$8|XlJ|vH3AnVHnKb7HaM^giD-R2` zpS}PaF}fj8w6L;OB60J9?-NF2%#wEpAD?fGVH>^W)lZo)gY_px2eFWA&N0YbN9uyW zNX2ir!>0FYi0FGONWIVGD^!^=M~MrS&bF1W(A=fuD+XjZv^qpl$h^(5W%~<@e@d#; zp)6&5hPP~aBe8rGW~jzjFQ3GAL+-HSgfBmlE{~uj5l|&xImBHNG1yZoRvXCW#%5BH z2NPflA;9pjt1C#myQ+iyXky6RcjB2T0JvWeL?w3V{Vj8HD~5Q7b*Ti;r|o<0mMW%hi+6qadCInXEuL zZz}PKh%r>p5{L5)JjHruY{;xt;MTemA|cG)6OR zly*0fhT%K3sP(O(5R1$(?#X?$CK}DT(@H5lsXSF3n*@vtnA%)yAvy7}rqKsvZ;$x5 zgr45!V_z?M9xZ0`Yp`_!Xy=bPJ`t;s^!R$8yxVq8=pM}hEIM}sQ#wngTz%i#nSKq9 ztM4&>>z?8b%71=kF>E)SJ~OV)6Y(2L#&20gCC!@iR?){5mJj7hcRvd1PnLuy@_2`C zvmL4EOHN?b??Owj@&>qTu&a$v;Z%bt-qg@+ADV9)Q-sXWn;Q(D5nd0ek!#a?k|I55 zR!u9pfry8#g}__{&1${5N9&Xd&#J+m%7;XTNU{Cs!_7y_#09AO6B|p!mdU$Y%3JOl zti56J92prK&+au(lABYp&8d=03bMUb{1(O$E=@gaN^Hp9UtAtv`v=^6iSR0Hwx$Cw zk~p7{!OnlAtN0B@Htz)`0!#!YTNlh!Z7%+{NS#{3Y1RKEW~bHCfvHUT!{MmWr0Ubo zC1;~{VmTK4yy!2fOwpwcMDLQ7uMPdeXPwYDaA(SM?fU^)f7plrpD>Q?|A28E%>SRh zF%vQ~vi#rCmCTG>Oq~CZ#z8ZPT39=qI1)05S{pc<08EVRj7^~V`JtVh9Zd{upxrmE zJ&mGkXIgEx{&)0j-uV9SWYp5B<-g_i%FSm^&+RS;MTf_abaV!`)3WqQMe%q9+10i7 zGA|y`^wTt~G%uhMnfgIGTUr_*4O`84d|W6CM1mpZ#lu8`0fdkM(Vr}iw*Pl{T4;E1 zcoNZ_CN?=BJ^EHn9v!MP*GA-f|AhL6VsDb5&@2smz9+jpVdSYlvD*Y zBp^}=1e6d3?ms@g2=SM+vb>nAhEM`PR&f_4j;s%9&)i6)=*ZUEz)FZ}1;|Z((&HVunc9+8ki~ ziL+gFHGKi#{&%9C++P&W2t;RoZ%7K?MMP`~RQ*>3%~dfmfeCc};gZX{s{Tk;V2J}t);E${;N;wXKAz#-550~9!(*!`1=;<>p!!Q znW3Gfg_&&e#Y0@GsBGyk+!sxavGM!u`8z_!uQUqMRNJTdVL{_Yd4bT#0qnpPSxjZ3Qy*tVwa{f(-Ps7gZVpFPnF{9T&z`|^WB2HFQ^ z4A9VP;5dM5khFuUxXQm{|M?1;w3TC7jU+M&H4N>Ak57 z3dR7t9oR`U!cj+60prFEvEpk~YH_%wZ~5;vlt31?7-5s~4~9_wm)PHU+S9-Dh9AnC zQjyrg4URB}tHH^7vKypk&(et_P93kW0+VJ1O|jN077DK1_eP+F8l?_hb|*D!f~{M#(zeUTJykE{;@cbPrT{vb`4< z`k1p}6u&oV(e1O_L+i%S^#!20H6!fh)zPj&Be7#F1mQLF8zwoJt*>dJ(jhYMwq;)8 znF}!Ov{%NX9a9$R8syW=E@^4(-@DoL-Q9of~dz}!xJJLzj-Sq&x_RRhK=Xw&L8w4z!9BZk@fW?IP)^Nr3E~FU-${CSwy{A z@A$_($jtR1InQf#0uShDQ+fy~8S1O}dfq!coxAFz=DzEcCtTM&t~t8XwA>|YC0dyl z=`3nGB<3eLKzdE!3(%VAuWL-(fjNl`JM26%4tGNa2vFi9rrhhdrgjnhHKf->}hwbUU%=nak@*cfM=2~4`gSs_SG#o>lJRy$&^*LxSxwu zHssySIO3Z}m8(??wlpM=j>T&0)9Km0vX0cCY`@-N+ zU94~Cc6&`vv+?Qcv=?Ah#I)6JDV}n6QC2xjV-37^E2DePEd>oo6fU>F>luiQQ?qD@ zv(y>rDrBs@X2U(?VDS#^^@gj4IK;g20XZZ3x?K{`gUcq&>nQQU$EFV zY1hGZBdgH3Ot=Oa?}|qM6Ra7sOJ6c|ot0HZ8SLT;w7Xr4QX#1;cSM=`@SobI2>FBO z#SYCfh;)2Cx2pSl-yUKOIOL3s^^&BRzdfY@yco|e#>1doR#KxX*56_zO6g1bl=@hz zfQRW@qp)hDG1lQ<(JMWmAH{8D77v_Lj4mRV*@KHBt2KTGDm*Fo5JG>Wbr+5rG6&rR z>(ru8fvYcRl`o>+gljnYdVy*rf(>8RO^E_h_&!e`l++@}u^1c4b}rzJTyS#Oc8D9qQ(`1L%GqsJK3|Z+RK8>}ArJ8QGT|oQ<7sZ16cM zyn=N5tB%H^5R}fg9a!C}M=9#WgnLgjXDtpR05LKnWqS6^I6?k0$8DQ{!Z}@Awx_a_ zX&p?)(|YY(vXK33H5J;{SPlr5{Kw=jHo+_=;ch~j8zd!n|7S8NX>S7wV(3_o!Ah^~ zb}(6KL8Fq=undW;RON!jOfDinWz<&Xx_+_+-}kw_kz~ph671^yk~Ff^y|{-^UBwy+ z=i8F0{fLZvW$EI|CnxQ^!rgx%P9 zYRt4#nyFd{tqu75yl;8g|AQH2+GvQGMp`~w2I?@*N5_G>FJUArC}GSk(dv13Itk5e zY+`qzVoe`huyS*;L9~PE=28AzetIyQ#k|%Q7zxAnfuflPpUq}Jv>egms$rgLrcyDI19o4}Z~Ts#M5udb_dKB^z?>gL@NQT( zk)9}Nb$SU~f*BLs>oj`KSqT1X&+}~iPKSeammc~hE})q-d^i_TE4Ti4X_16MRnT|) z_8?O9u^5M(ci7sc@Z#2%Z(g?m{t26E{~-&rtF}m{L}_CC^xpCaYcv@$%J0>T&~qMD zG~}!Nwk%0EVQf%!^_e=?rduu4ku?7eHe=P>-N~3O0J2D~>#SzM_JJ355bOQt%o9li zQ)i|1FQLAF1)@Zt>A&clq&+F5p=w0g=#e)Fq?nCB6=w0{nmG>-T&-w5`VHwC`tzU- z`_8dLO|_rS5a;##q^r&j@5JH{@MO^2>BSBi6V^Xc7Zs0AB2?A7+#nPmf5bsm^8%DI zet7s_WL$K9%>OE7seiiJYnQH(1}9ve*s8$_2VunYye6*Z_20l)mrAg5|H-?~a=?<& z>N@}yHHyvZQ?XV1TDUbwKwI&+#jKU?FQ|{=Tp+$ffT|FlzXp!V%qpQw#;7k8Y6-!c zWJNJfp9@W~@~a~A8eS)-p3m9g3ZwbkbKFq&Pn$k}xcXj?2E8sqa1FZTF#v?vG~@E? zwvP8)JZY0;LP(n+=(jt|&pPx5Bv!3>gA2iRw973gmd==ux$0`T8h|;_OrS#GUvn%F zOXE}IuD`HVrGtS|M%xa8a-fJe5J8{wZt5PLo{b^2U`E?u%FTG1c_i0CV?i*Mt|;?MW7oS3Tmk; zBqkdo0e~yEk$?Cgss1Q=k~X`e{0ku+HFw-~q#OF2;69>)29~qV%A_3b&N*%n`D7HZ zE+j3$?S9AZv@opO$zLw)=`DtV3GlAO3$#XSq2-f5TFtUWHk5WrBG)))V1VSgDMM%C zXK1(E!ChihG)qhX%)7iCz;{8J#TO=NwrE4ei^>$h@OR6V#?FXSyx6j+XB=m)I|uFA zr98B*wAu$rk`BDZq5{QH|GVE426iv-dFOegyaw@$bK?T)3pX9RyyhbN_XauAs!`V8 z<$t1>b3L;A+n$JDvOm;4T<@)o|DV4)>MU!wDH6;0>(Jh!?o2l_fykkIq6I+6WUtNN zdpdjIYBYOcEtTC?dS%emwD>ho+++m=eUhWCDf^Hy^@yUceUP7#&^kYY%*}8`mm`l& z^90PcYtlw7u9k?mW~NIK&Ceo1FkOGm+a)h2q?2ISQclSBfQ-phi|YNMMb}-46f-Uw zYh_*|`OkUW+>oa6enhjzo4ZF-%?g$vYmKwRg=cUqw|<%u9tDx$uHxn<8SotXN}eqo z9l^CkG=NMJIP+#vf3Svm{1+_aYHXlgVo_KoUC00Akt25cf)8`Shwxqc?{By(O$*`q z=CZDR_-i|(PCk{mv9Y5oi*NRtEvLlGC1r>&&I&iP#Sg5w1%CEEZ!*q$?hLswPsMnV zRW}+DYicW@=a+=1JIoVp3o>rhb}|Vp+WK~mLt$0$s_xsN)j5h&e$=ap=SLg##Uyay zNFM8$=2Hu3bXoRvbLJ%pu*9uD@~2263xRUayPkJ~z#ow&WoV;w@c2%;CqXjD5gh8N zNC&PMmMJl)GOIAFLz>4mHyxk294j^!eDJ7?ZTlTaq2{#<{D#TdBUr85CvO>WZKEw%P{`xRsi0b{ z{DTWD;*iZYH*xwGlpF7|i%onc7>gSx1k_MvpV-2KoZ>-Te6(+?XeGnHfD`mHxo?$_ zQ`#lFXLUO?5{mRIQ6Caoff!~U88tWmK?ll?Xqbo`LC%ZGAFQyIOeW^LI`N_34DTd-QFUX?tO zn=4e2v7V)2!kq3TPq=5-S$8dzR)E8nMwZThO@n|ZDB+~koH`pEiscMZh%1L5V2-DI zQ5G=tb1ng=T}!W;uyu3jZ+pG3DaMwt3(SBlZFE<;j|>t_c{t|raVp6)LU1Y1!gK=O zZvw{|)8)h|ArP$6Mzw&}F`T>Ul3aOd<^M7)rhKeVOT#XSi{lP?`p?He7 zYVGn5DJrHW7FjLd?82f-eSun3mm~`0qr;$pC~wiIklC6@zmws9c+9c~R?=D;Odvs^iYR(|nm=Z8mbSa0ho};`xOcZUV?^+foz68_ zzD_X!Z2mBHIs9np5!koMdCvsvM}r{GAXIeA1_t-iOsNEdpB)STdCnYPQ`u?6?gN{| zZszS+D*~XpkHXyt(&zMqwdRsRJuFV?c|SQdwK~g@(Tt0I_=1U;dxTl8&`Z;sNz3>+ zmGXarix30GsAv1~NZ@8^hJt>(jWBM8Z3Fou?I(%3aY6sEv!&Spw&o*+R6wts*d!Xm z)lKNmu))><=LV(sYb=km<%A0H6u=<9&N3&!)g^}5BN*$6NAOH|c|E!<=n*2_SU~2U zyu)Ea#D9G=?#foxkb9l!tlap0*$wk9-(tN$DEGHw6@+82%Rh8wA$SfuOvZivHS#Gh9zkQ*#C{q0CP5I{= zj={#MR4kMBW|c-aH0Qv3B$MEqZisLZ+JZg%RB2s9y{*YDTjq7`ClQUbxy7&DSJkz! zIoth3%GXfPAH9}A^sC@WmJ5t7U2H(Xv@g=y9(`|CJVQ_-kHMvq*qAS4JI`a;L+qvr zCW)3{s_08Mx2+u5H3qK}nLNfp(Tvjz_tf^NLUM)_%c>(Tp<~`W zqpE>&`Qpo;vMxXPW;Rqju>?z8J}&>NhZW#OBB0OeGW1HK^{EqI?=c#p(mpFRHyA4P zh?{90KK?gV59MqeG1LW3v}`r?p9bBt9k^{DIMYyIHL+Dyp21v^bo`J|)(c|VS{uux ztkj09re$AAs`1UAcZiZHV{zgjFvdq7go8(hV2A1JB%LIXXcXQiYVQ;JxwB|6Xd>hL z%+~^M_>pGjC$~9Vl*Ta8s;;&3!h(P)>}jNo!*F#!%!M7wbF?7DQEqWUypZ)7Eoflt zb0sU&%I7+lywRPJhm3QM7L=BO6`J&C7d!Xt7w!{W8L!KV0N!_v)1G3wrW3ZRGM@cI z&N0|k_BKuw{wbH)>ZV1 z5F;fiwjC@b?+@S&2Yuei0e`NT|6q1V_a^Hc7{^LBy$K42y*@GE5Q~cgwRr6EJt*2N z7ocQQU_hiw7%8I+i%t3zoby1#v7*vLsRoQaPXPhhwm+2^_&VZTVYqMSky%_+M30jG z6ZU~Be7~}YQ5Esv!a-#z5mONK^i^6&nJMd4FvI_Zxdu|{URi$-(wjT~ApUIB|2ihh zgZP&9#d{OHHON)W-I(Xcv>iK;3}enqmMso`#G#?Q+Ae9#F=x=-9P8wMg;<%`@7or$ zL*OYDMIen!u)+29Ar+s74sM|9-K}qcGIfYT-C4f)r&XUhJD@ye}9nI53AR*R|qrlq)JL8AA%h-YNWItrk$# z`T;7P%_rI5gT~Dpdr{Z`ytRE~ucGBf3%`)D&;MKsd0dt=r(^g;v7^GcA~M;l zVd7Gc4mef+x6Fc#05d2mx0-3&t*3N~FJa?v1IHgKZv!Sg!F^QCPT2zx5i)|)ZekJz zetvOXqKM|ih1Pg2F+vRq6&k3_7RJe0fj9-}JE;v!Kz*em<3h|uytWwQ(R_k-KYl8S zCJo54?w8IJ$AUnzzBARpX#yA(YG<6@As{V1Fg3Ddc>H@mvy;~7(rq!usC4%opg>A3 z#jt}4(>jeARnW%zzKmxgN^#+T;nVWH zFm-19TfDnTsZC?FcEnFi?3jPn0?BjZP?z1TU`;qBY}5V_2(YP&bIpq{g9+T`2)>gz zXBP$!FFv#4K@y$BwS^ zV!nYYyByFLB2uSGK-TfV!jZ(mm;ksC&GQctBJ_c291rRKBLsyn3x2&m2V@FSu7Qpm z2IPaFqp>M--Ac268G4Ip;ORF1;NW?Ig_>?cc)CaUIg+AMkZ=P{=u(A8`{_jYK9<<)z7(f&wW#374Q1f{{oR8@ahborW-(>?vT#Is-1 zu=+4EigPg4n?dyBp^7B=MI}t|pVKRyFz$WA_I>Vne2E`S??h(>KdWUKRohDg9Zb zU>AHx7{NAOH4R*-~IvxBm+;mSb2eD$|(d|+Vcn{-Hc_O!L9Ju?)-;iW8K|XQ^bvj@rZO7 zf0)hA1uBs!mi8zsIGcQs`4X!wT48W^c z>JI=KT|@aEZ-CbSIPy(Bi`6AsFfsBX>Q6$u1J(3vSih?CDcOD!{4Sg&(=Ea^luQ); zgtt|@uQzm$MbbUB$NErAB7HS1!4Ss*7an(N3muok*#7GXCkoWgIBJnUHUGQdH+RR0 zk}KdpL6`@kv3B!inZol|t}z^NO<^cX9nrdC^n(WI4+39I-n@pdqAs6Sjp%=Zrdj8` zf*mV=ymG$6$f29yHDN-w{^pLzMyD@lm&8|LB`7^(6_*|mN+|7gvDCJ)>1!8nKgX5KnwUfAc8!8G(x`?#lXll8d{B`^--ODeLL(0< zZ_3ppOq2=E7?c1%C_zz+Tz*?qqF6oB!Vx0Rnv{}5?*_$G8d*G3bH%*E(vC`|F3A&S zStCq-53;eyB>M&O{U(a`5Z}tWO0@Go1P%Zc)D7eo;g3R2=sAh=bYYaFzm&ZuqK4F} z9CK$LvX5_yk6+y128+^M{Cu|RWnGylYU=EDCA3?V*YXnFxmrqJIaH#m0(@zraISU; zAXX5O57pYh*0})2MDW^RXhlmQKiPUqLGVfd%wmb@PMxnPOlC8>y>1 zZ7IN1sE)+kc=j9gK@;Zh`+8j$Ed@@B-9<*n4tyFY5$2r7Rs(cD%SiRWQNoPh4wK!E z{w5Y%OS$7;+b=p2x^?_ismJ8DSDtzn2roRyw!>VZ%AQO9cL> zq{)30ZI%)+H(peQ!3n3V+DfF0l0UCo3EzVG1yFw%v1v-0AGeea>$pXOHRX|*%Fx-^ zJ-E+PT*;axBPI~>^jQ?M*#-|U-qn2Nr{bG$Ukd^(xsf7eY%`y}i&Ski6mRpgE9_k{*RWLRe_TB!ewg1hwO7rqYOzT=_&jv(g0w zPqxM4p!b!LzFYkl_k}#pm|mqj3iouZo#5!nBvYt|oSwJubXZQyG(i(Fr_%9i9*h)j zQNcP%Oe$4ZY`~;kiS`8aP~2SpK7AII3T&Oe`(wjK;g;vqoQAz1JzV5HaWfpNS+Co` zxo0yTd1v>0WA9#M%vuoJr3rtAEx&?j?*~sAx}AnCB$MUC`ub0GLSHY@Xki=4Jm^}p z1=Ty*ONx)zArAJg^gWyk9;Zz5Q`sw3(X{z$qvVRx{;4}`?yj*ox3+bdRB*;j5^vLX zxb@V9b)w(iF6C4x7s#Pht})^tspA!LiAS_P4HXbxXK~CYS<57ei`zCl8l1^-hYj@5>CvU07lqg<)@p-g$E6wnwdK8&lP zoQppjSu0pDdDv=*fN2JPAUMmH`IfpFM@6Zj}I)Gvqb zsQSH}aN}5HQ=8YbTL)iTm)v)&qe-GJ&BXHkrqSehrudAqzvsHLS#T^g0`nO3Q#bRs zfcEV<{^Hv`7k0`eY~ZNXiw2v9NAOfg!}=+WWM>cr$66T^e0rSCgibj}XmDoIaxA3- z@srN+J#n52;Ay<%0gOfd77TAYz6(VsQDC$l}Wy>KG|UX5aPwtpZo8jPOol_0HDZ zWd*j)-OK>C-xcR2ur+bbdkaQytTaJ4_R9J283z9Lj}B)SgLkPKKPCq=^UNKc2fNM$ zj5WEft@mN9DvEL;kPaadOKS7;v)f|+?n@V0{Pyz;w%)==+W#K%0w8{H|JFqlE7!+oT1cVZ0L%(7Ogz zCmXH}lv$9}CLyy@ElF&oCC4F=_R&mgK)R`B^m>uK%TCSSKsGQD+?$Hq&Eo^P-n0e} z4t7(r+(M$6cp;07f=}QP(~_X5jxvg%CVAElFHgs_iAetVXS2r~Ckvw%zl192PEm4B zk-A@_?~Ywvy``-kk`^88L5HKL6e6xJybOxeI5jI|2<#{t@}V0PQIdg|{2+l`iiUiU z)o^jhReAo5H#Cn>58kRG@jhKc!_7iR4(Av! zUX*jXBwDeiz7pO{LDV8IdL^VfiOb5N7Hy}PB%V$c3J);QXYpGM{9WxrkX`iGpV3+6 zD8Zks+V~goUz$b%JW_F*SkyK3qqh|J>rYrbejPLowpet!u|#=$6qc{${Jq-HOPxYZ zrTi(%e(G)paGt3^eO8Bc#k<8-F?KPEL}`vr#St1Q&kd0E;PixcgOp#^S~WnO7VOhH z9~Q*Q!GM2+cur{sl5lJY`35bfD}`!F_+|$D&};z%`7i&j~L(;&2jrw)mQMj8UIIM(Q3h&I|c*Kp$!-^7qIS? zQYOTK1_%>SG^GB?As8o>xS$m|V8jm&`6G33i$upycj9q}*21lRcpVY$2|TU6KOm4# zQec{I9oB6T{&}536GM)4nB2jyil`5#9N2oIZPcM37ajL6)X~fWutoO-B%XApRpV5C zZ|0V&6LAGY0>ebNw2+9yFn~7oJ|xYY`8q>+g;Zo#E8piN=lF!eM3z=QHL~1SkQ9ys zEotT2WAdiZfOWl~hU84!C+&&lnT{`$`lemMJ96npdbY>9h^f$igSTGsC$Fwk z@^ynVTD1+y=T_-)qfvqTBq3Mq@1((AC~-4*s{_-N++>xoa15Ok*tJJ59QZ&}Kz-{8 z+`qaNPEsiU0YYq9{=tZW5BXi~M$Jaz`hPjlFyJ^O)E}?40W8Yv8iREi0dn=@93ElxhKN2GEhtscugS2XlW1oMXCMzn-oDA z2J2&JdaYl!kof9|hji!t1z?2v0fW;cxSe!sCv^#_c8SlUju1iC$)<)fMt~EW3VPNDFCbMt8BRGKfT9el6zzjwj~fOO;m#JnGLHrA>* z0~wuDxSOubGd*(`cXBhn=~p>%IGLP-sCH}Z?#$tg(9qkj1+ot-poJu=)M8k4_*Yoo zH`&FLG_DSx-GGqgbo?7!M%}X4E_^G*>|;_4j_0HwqbkFuI`o&+o$pv&^#PaSmspBi zX?V27{KWMnEySQ0oSGm0)o%nLjNZM?o_x-nbDa1BWbH+XaE ztQo`F4g=F2voDudDfQ~T>eDM#$O~^ik+p(ri87F zP?-RVmJ%7OZtnB4J9+VX)};7$)6XX4oM#!*HNE-t9^O;m{PuhzL=>$TdI=_{UjphiWBI@=shf_7h?Taj>F$PShfUY^Z326Y!WDuwklu-r-Y|3Nz0E zXhX(q(}Ur~5qOwC%*J zf*|ZD&FJr!c@G8fm9IQ#!?553E?*#aRE^HMRhD<$mP%<=f@{n9(}7jE#3KA4*|Qt$ zvCe$YX3dW0Zj?qXB1vyb3dEIVv5R!3IfrfJz17PffXEK%$7bs1mX4aL7R|;NGk8ew zRu@Q(2}Z?*>%6A#_nVHY1Dog<7?PEiZDEjQAExiXA&vfn(q|V?l;$Nqb#oi23G}9{ znz$?Hnw0`?vzeqQU|k4b8;UE!qP>D-pi$o-x_HZyt1$7<+Eb^&!&XRF0f=E;dt8<0 zZNvs5zQIq%^X3It#h~TjLv+FyDYFd^ z{7)!sBpMG!5>&6OoalRuOqBZ)&>`|x|xw+@?`&42$=g@ zl%cY=HLl*TkxBOfmf&XZp#|*p#mk{>*5KY{7_SRprBR%?M*%BGJzhpPQ`L&IiQ5iA z_P!ZoW^&dXKS)NA%$$+uH;&YvIw6c7{iLK8Jxk(?5Zy9(D8MY`@<}Ypo`k~x{@l-~l6oE@=gK+gR6(CE zHRuk*ZKdt}VYjWH8Th(6xCapzU^v{V-qyax-z(Ph)j0J&;60+Wwh^%qrU&4yVHtR2 z7qQ}_?wyKV0T*TZLxD-c+V-(A82+xi9|A;3erRu1Y`UE8WiM08trW?9BcR{sSWrcu zvp6Hqc|HQ((a^f~?u+;EZ|L(VXR)^(zS)7sSI-s-#`pm=hT|Vp%055H<%;g9Yfx8H6JB z&@XP+fiD34#;LI+37b&+bLAo1n;gLkFpqc|D7D6^PkU!yj(TtT$o;!wf(O)-Nr z_N`Soh;Fz{I?AwWj9+5Q(>z?t4&1R8vk--?b`OZBwxHmuboLzcS__X1T+5SrQ*clZ zcioS47t9EIGEBOGMncL#MrS@QzPxU5KhthF$F(|^sS7lDpu;+9yJ;^#IMW4^L*E^- zq8B@{-jb+0!#$OX)M|3Z&OitrSnFdY-+`f~sz{j6JMq}E`$YkiKWv60V+p5u_{*KZ z%c|tWo5WAAbxFNyGo3cXFm3O4AQ+ELZ0hf5u8By+v+~k_M>02-LA4Ylu|Trd%mO|J zH58pd^pgnn4ThAeNuoLuH_Vrra6BT9f6`2Vp%^ z=4=GH_lmmIG32=t=nnEsewt~4A08iaGHA;tQ4l_WOu1?3sd2y)6_)Y+l4RHW4N1GM7ANt!%ZojRjO)1w|S zzlSMTj`$E)G^!~hU>?Iga@tgG zgV$q2-9nCNRxz(|1twCBMMlhWp8nuEx2*s0>tHydD60jL=YwtF^AcU?9$J0UOy$C* z5UcixHoX2xo}q)dVYZ1}6kIx=52N_B2uR18zTd|jBH0P+2Mma!g0HAgAFJjQpJ88H zY~k=O!to*%DUxl*IJcYsLuIau(G8l*p2h1z<-S)TPyn-&^XeYrw7=lwiqghP(v&0< z(%87|x%UQZ*D&$^{t(YM=drWcG)`QyC>zOBU=0{5D6MlZEsNK6x_@gALssV409>q4w(?CEPHe}2%e6k$?&LDGGIyz zYRSz8UG%!@C>{P-VG>1VBgO#M?^~{A-J)@G0rm)X`wnz^oHV(#lksbt&K;xT@g5oD zjh@xL|H=@Kgt0r})xKK?>Bvn*OUhrQ#ND1&(v+dM%`ZZ8-mO*AJEJnAuIxQm4c}gT zUs~&G@G*^7GljcpFQUVNg26#20bdO#_-(CAm-xhv%k?DH!vL{)_HtW)Cq~{4fvXzr zvLO&r(!@wtZ#2UdIn~;q3T8(hfgcijU&ho367+4~l8~Zl$>th^YwVhfO7g z(@25peAV{+XB!4(k6{m!kwofRV{>HF*jC1xPxQ@y&Z&A``3i!3Z4Pjz%yC4#ZoX$U zgz0Z4)cv|WeTRcuNGl>KV}cIQyRihFgCR`wy{^*$iuN%~mlV{(3z^Xb&Td(MxRw@1 zQ;+f6rf9&MD1^Ob`9mxld1pdRRIM?>>iOyap2!s zS#{|cH^<7tcD)Q!qN+w}tU}Fu+xfQ@_eSuS&5W zv6Gd(RU4D+FYX35yVnn{Ay}@dPMjq<#Rrh<;@BG=EaPiGx1x zpgGOJQ4=00k9GHd?zK`7A%{Q3p89hk=k3ZuMLZa#i$c=1(yt#wrO~0^X^+Y|?+d1N zmCdti7vz9RW#*6mg#|qwodG_T2j#G$pK7*xqhW5tAcDIs5WjB~2N)M@FaqDk2>gr~ z#1GSV9r`91Z?W0C)0dQDwiI^BNm}FZ!otfzHf?3*w2p2=5Z|J!dFUmupU#A(!TO)>(lLReE#qE(1i~w~-0xWW#Ec z5`y5^;(@o{l*B!4s1T@XeqO6cvDlj>;2lEP5R~CL%Aq`*g620_@mi)PX&t%E@N8|A zezc-76Ds^a^p|e8!V5F1chzhYh~zpZV&Mjh!LfMBj^t)y3LnGMfgGJv3c=88~LK*(|VKFYnuv&v6=yo#IKtQ1e5&Bf%W7U`n{CzA_ig zwfz$Fwz^iS7|UOsLeUdCJy5*9m)g;6T=>C46!-=b+G@OhJ_7I2ZsR zKSA~=7p+0FBg%14y!}4KB7pHjh9a0>r@Hk9{AU6tT&)(`5Mxzi{JaXLUKg!?6S24r z#zF@P5e5{}`-Q6-uwAs%3ZeBxXF*}H&F6Bd@;FDBaB>Yu8d*hb^SXK zw&AzzsLBV{nhx9)s@Dk#uuBz`w|p|>awEX^8{@v1a3fg76G^=3G*3ObYLc>d11##m z{LIGr{aa0$yDC6g5Dl0ra#MT%j0+N1KDK(Oq5#_0OpECz9uOL80BW%R40!mY$hV#N z#1Y7w>adR~a4H$$fVtv39cIf$64D&l4tE;pYXZ8N&q{PcHXNM*HDWA zr<^I%!l6gy%*bnhzxBB_ojEm~sIp}mGl{dg=%8Em$xAthJCmB&;En9hU1S$qK)_Id z|oTgUyfB=%hU&ximSt)Csaw6LOJu(xcTu0 zo0P%2Q}G`$?lM>i$O3sLz9lNu-ENs_nH+)Tit4Mm8E=oy-mJ0o5jS#N5`xXI^=n}JSImvFzWD|y1jc9n;npby5#)f)Y_%U z6h2iO0j=X#jH5H+%0$BFb6ma%2m6uiBZC#)SZH-aPYFnF9_%~|9;1Y@w!&+vZHQLJ z8SE(>sON-_lv^}0)2q~meb%`nv<xQJ~?)_Ow*uK={pQg+GJ# zSQ;1*-TAigdb_^2VPj05>71L_&9cFUGPz&I{yA4c*H3h3GI>+ZJVUkV1Ob1T|pG1bQvx!O+HKw6P&EzzM3ALu` z=EraPoF>DDOjI@T(_S8CUY(hmQcqvpL=YeZ-8>^bMQNejFCLEsq2{juZfHP3^;EU) zw?O2&;`~FT#*Va1tvc~Ha9z=*OEvwQm{C>riE{1N$b|TikGOdB^Jk+lr*| zB~Le^{e8sE5*J)fwgNO6mm_@#8rUKNTO>mkUPb^G3_WWK;YdiPJ{#f(xnG)FPC*!j z{9#Y zx|2V?(Hr~#s_C;PJRIzLq5=A|=P^z~IpE3Te(m~7n_QTLfxV7r`oT{Xr>aX_@N36a zI}-nnf_N(VPn3@H_cG!x%j;H&OH1$S(S@MYhC>;#5XX%4lOOG_+jjq%sfCuf7XNAw zv*;Fsf>^6AdD;yyLWY^9nAiIN{T>g}f7Zz3caiN!P_eql67lW$SWq~fPDuavtSo4z zI>c?OzY5_7VoUgMB#@iaf(DK6{=wkrs;ZC9`vu;T)JmWSiNP8l&%VZvEAxS%wKWHR zKj@==6?uEa_Mld9bYzu`(TzVmKjYH5RI`4aZPZP4=42yG$VTJX9!&joyOJKtf%@|T zLA`GGC9iUrN0Xn^6~+gvC%4_pWs^g#sPS|)n=`851Jo2s-y>ffcEON$6K(F2vy`b> z_vUu7ZP>+q6eA92$2q;iUkKLN&%5{HC#XhAp?o4QKUR2+W^kMrS(6QNbFN8rI>Z^! z&KVk?hT6C#eE-}byq1rd!WpfSuG}8zODi=^Fq^{3al8uznsOhccg5VJT~+^N(YAVh zlnD3Yj_4nRfK2nC@9@zBxj1jvq4w&n(pAOvT(%N<^znop$ST^Ph#td6R6P*1igpb{ zIn^p5qjk9vqL+UL0vqSHcsy^*m8RHfUtX_kI?5G3P3FGcRF~(C`WJ zMR1VzQUG=pLPe(~sWr7>0%QW`xHZpAB4PqluHc|}OW}vG*Uy?mx-~D-QtRMF^&8qm z<2GNe{Qlx2atY@H0HER$#tr)Ss3gMsj0K_)p_uCQX34@#959=&9^W|gi4#7(S?+sD zH57oll~tjKUl9#dTuph8ds#@&zjsEnO$8nD!Qq|iYr?Hi$5T!DtVd>-xP13V*K+S7 zGF7=7o>1Efc)sTtV9fyP&*Ko#w~n& z7PeX51brWDkhNt0gAQ&nGaH)$Omy*KY?X-!Rds|!~l&<_MjK(r&r zg@ql}XsD;=U6`iieSVChWubI2$pIZ?1y%z8RK%ZFqa_0Qn(1#5G9EqaKIK88b}Qhjyb3QNx)h|%5cBL%4x%G6G~q4dA`-b zhE5$LWLiNK@L>TM*@}*aW5+yLi9z-G!5FxqM(1Eetk-lGq-s$X@3Bf9g3vR>wS~Uk z?wAVW)$UHN^uUf-+a7PkG42XH{xj^ZOK7qkPmlY(+4!raz~;DP_&{(Itv|MkUxegs zFq=BTy;9nz!(yi#07OU`cwCK<@H0B8bYUVjf&G+4!D+`0%p8L~2Gz?&z`M2IZc3-c z(T-zi-};wb1SmdM5pWIH{EJr4m4jh=Z&bOmLP;}72%+0Kbln)sAv{J2!0{k)87Q)I z@t)#kIJAE7{;M9h_JeJdW>U)5j!`o&g;KESV(D z;EoV-&NQM;o;;O;OCJ2jE#QSt(f5sti`!*_;`41Wj7t?-3KaSHChu!eWvej9HtLg~ z-wPksO=KvbKK5jGDv>YPLn4n)Sh4Jf^2&jO$9*p9F%`UqwqRH1Tuhosv9pVqdU~(= z>c8sIh&1DayRY) z2xes2UeV)fDg-S?6MNt}&?$m#u)9~jnv0}0 zc!g@E5>PP4+#Pb9@zL8iEZ#D4>`yVj!k39ULG1~N!6K>?tExfmUr~<2)}d}{l2Uzj zW!vz#<}maNv8@t6Ma=l);MVYqZVK)daV_Tg`3O1OJrvS}f87;5E_Gb=py~7#`4;l9 zuixKfb-?3*p*S+V_rv>AB7s;W(-Fu(b>sIR@^#vG=5-oqnjbR6WWwp@C6*^7AWUq^ zXt04B?MpL^XKS!L{xL@XkFHXrl^$v&d}2z6e!7PVbx8DN7BPmQ8y7Bt*q2t~fGC}h z_)%dVAW?jz)gmrSbqv6uk&#XqK~w0|z!cA`Y*4L#`*t2c+X$HT^B#OQ#DzHDD-8ri z=2(wATxis@c(;+!nGQm!Df6Zy77Lau%gYl zfqsg@*cR4#x5+R+eJQ1n=Us{pS=GOXVkMwOat=BJ6l3B%cZJ#292oXm)%Iyam7WLZzj z{o$b`PqrP%w7TKk%oBMQs2RI0k>ZQ9EW2d6b!%kG*Y)2fj6qK}^uJ3a9$0bQc9Q+Y zIHYsJ)tf0HswC1+5FSoGt#p}mYj2q1|3F44ue;z>vfQwgE+%}4b0j=+jkq)srkhj6 zZCW3URTk&@=CHD_(3KV7_Do_5;GTI1r7?!*&+WQAcc-w{N#?DX;EqABQP0zYi@*wb2(}${UU3wYk@A%%Ni1l7`dC?KWn{SeApLzqAh7fO_~Z3-Kl( z9?vOT8VbFjt%oN+b*(8%s5nR_ zor``ZWp!?#BRhUfYtaV))r@~pUWRBQ+K_waU=uwXw_k#^WO`wO9Myysd+n#9p}lj-UDhEpD_G-rJe#g` z0^o&K?VUnteiGW>QXDti^P;B`1K*cD1f3PLu@QmBmVsRKWkM03Vn$3d=1;6b+K+sY zFFzT@1v#rt|Kg|t-t^!7ca>h9_!%FJ`-c8_k7`A|W)Yz2_cRlwdejjG(YxPb3LQn! zZ{Hgs5wo}TtTYafX=y^#7C}|(l(H~?|I`sB>6#WM?-{B?EoQU=wg+;&apA@voX8lQ zv#N2jf#I0P=#IqR+29s)Q{B(NfpVwzHVoz*>Ar_z>NvCD8=bryz z_-i9cqBGW?xP2X120BL`O{npiiJFR~_L^js!CZf?OLUCY?~-YcDYptBY1z!?Kxq}hf=|Ls}MAl$e(eR1tv3*yGXOx zw=NK;UtTg&zTK3-hKx`o3U_i!{4<~g+3vaBIPhRBoF^rlJ2)FH!#bAPa~V1mRt02z0b?lel8Pip$pM zZ*ZtE<;YeJgmuVJ^eVk#3ZJDzvu+7c^n(8g4m~)7>x?|$7GJ)nMw@FXKTT@eSM@)6 zK2KeQNk~Na%b@C*NFQ94270~d8D1kCr}IF*B}*svessZMx)gbnPP=K+<~+x<-~cYN-CK*7E2 z*2v^Uzn@Ma#c7}8+MkV-ud`x+y7(QI~Fm`U3U(OivEO}=N$)l>kX#l-g zqN(+pJIT_p)DU(i|GWnFiP_55^XXA!Gy1V+Hv_C?lHOJ*pQ5EeE2Mmg(B zp}4VD&SWh?XFF0%8d&2`@|xg=5xk0#n4*?AhFOt5oAe2{>(zwK@t{(UvUqvW#zxOD z(XqV}?5*@+!6cjz zc$Y=S>O&il-%bhn`8QT)x^Fc|Tv%QMcir+ zISvIgFn+T$YhjDqOnC{Qz|~!IC<7*%j^SPSazFRkimmm5)ku4AByxR{Sp^JXpglPv zdgRj@a;JmQ)GCN^Q>*tBCjx;~xFBguFLRzuFpw&P#Ts#Z4yh(PqcL!zB5RM2%eMyQ z$#IbqKiSah2(q?u#Xc^(z0`dEbxqG%Xs!f*c9O?)UW{=DC{$p^ptDDMxAl~*O)Ojw z{!Y^KUmaUy+KMd_OQ}FA5>aUfpKDPa8A?dumoVbp#@vcF_t&pM?dF4&nw;iGd-f}k zGK%EaPED<)+)93Rjv3fF|LNs}G7k6^YrE!=V*>H|2mhBq);!cRj44U>tbqs#b-Iy~ zwdub#C}y|QufN}wdNW6_?9?rws25;Kb7Yi0tBme%S2I=toU58<3xiY?a{~8N0kp!x zUt;pgQ2!bRql4iNjL6wDbZc#$9IO74o3MGLyE;{&T{~IfXzLVtXI|tqtFj=KAJ|~8 zv|@`_gvCoryOKEF7PKhN^#NlX{U0Ci6?-bHvT@k9eE$kydAQu0d${+E9dm1v+?TH1 z%L2UezrAobn~QJ~UkB4uBur?&Z@cda%at}N{L4+ZcKBpFf|&N39+3`QFDeb7A(=eP zf5!77Lz!JXWKQ3>jS5^o_nW*lCdVnPJB<4zS=sb6J_Y$0-QF{z`x8~PkrP_8OK{F6I?Anux< zOi$284D42++hxv4S*2dAzo5Qd(+R4GBI;*yu#AnwC??xbsoF;*W%v^s|GDTpGMh)w zN+fjy*;pW-yvw0j@mIa^uOilA)rP_PR(XiPNXfnG42s4?ovQR?ij6~#F!|DSFMhxa zV#hJL3$>myOB8G^iyu&Nps%}R494M?U7)|;#~8^XdTL3Le9euNLbg_tq_e3MXkRD+(ut zaM(wG4zBHrymSU{FQ-_+aur6X!w+efXwujyMidgb7|>b$t{lHeue;lO3MkLWTIWKU z;K89gM_&(#RLO?VI>ooUO1r(mvsuB2{&i76|v6E-gd{nIA8)j1>cD*^kH`KBqazkJJpH^hg`MP+^2=x8@4}c6j{db_PoUhaxmlj{A*p&Fp?EXehIwfHm735zEvhSx zJ&nAV$Z%uk>v`ocR4TXNf)zn_Um@Z=3Z^0#e7P9UOImR;vz7un)psi9{(`#v&6#g8 z?q3luB`kh8ypx=i%&4;q7E{xfW>#6H?KOZ8jL=I}Tm18vPL&G?34JQrNni73JHOLp znG#6dN~`*P=T4S?v@<~x`7$&`bb{`kvTz&QEmWQV@_%fgiS=ooIz@ar$slRAPTUr@QnxG) zVVu&PL?6dm98^K|HR3&f(62rqHU-mNcufKacoW_+eC&Q~AB`wnb)fue-MKlj^V&BX zkP_aR+tfr*F6{9dt0;P z={WXh`8V2@)y@aAVOF4z*z+EtI_e8|MokKN*Nz+I&L7;AoNvxUOH$zCbscwg$2ZHD z@)su?2US`@YL(?l1VFBwI}q8i42#H@9)~3poB5&J9q3Vea7T^oDLI~krvpU4-TdH<8BVUfF*YK@%9pW ztQ12CVOPR7|JPh3`~R7XWMSsu{BPIof7)$KES&8B?_6ZNlYQwd8ZC~T&1Xyud-ht3 zEjRMNQlyN{f4Y$~BuTe!Gwr8a9jf}gzc$sn-7goq^6D;0$WiN?oK@}|=|JZJFfuv- zri`ST1jxw9{t*G7so6Sf^GkE<3p;W{bL+{_`F2)73T!R_02zQ&GBN@hj{bkUgTjhR z+C!NAC(=K51^qK)3L^dmBZ&p3cSd%W7uJCK4lgdK_AZVF_Ra=I@8lC2Dk%Hb2T%;m zERCTMQq|{@laav{A|@+yiVqaPSG!;<=89g{r{mU7OA{qMTW$YOpV|8C(ry=ej8$Me(Ny|0tEacO6r;W#+J4g;8O4PJ0v$U)`8c4k=Yy^ z-u_(R3(5W70W16`7uh$o^e-0~6%&(PP($f2we~L;IlR7vNMQZP=)wYAp`n$v>63n9 z?q4qQ@E85n4a-+j*S`PEoN_TtKh_iH}xxAFEG7(I~bsCCiM^o#B9S0;KLeJx9KJq0*1^J`&w zX7SM5*SiQ6n);iO`W&JM~`TV`Q@ZC#6Na*E8@3|*0 z_itEYMgTA|H3qkDuz&mFcaG7;!Iizv{-u56@BUi-eI>}q?8w3ztgTzab^_NfX%0^P zj6|DO6e#WCN-Wl*T{LII%B7ihQ5hcq6E!jrWwlI_FND z?(ibFPXil`3orsQ(NxavA}FUx(j90u>V=X>OYe4p5q&T$vJ@7ixa?t4dcP=R4x$Ke zqe4mj1&EAANxIO{Dk+#;Jmy#yd+Fg{gw<^vf5uiR`#4{Fyf0J?pi}a z83dX^bQIN#B=J~@0Bu6N&S@xG_?!m?IE1I#$gD01luLaSgsmwz*Fb`A{#h?7>!OBj z*myNlOEMpVjV3fSamAnP+k=bywP?vh@L#uy4j*WgHJCe@I=X%%X6QA=7r~W!V?!GL z!NoiEbHKCG^v8GODd@3}vrIvq&Po~ttBKj|MRCx?6$5_0%qb{sce}F^(hHe~2_y%! zoK3IvCgsmJj~vNn513)5>e~^H zD}p-cB-Tn;C@Q7U==@>oLkkSgK7avZxj4mOT{Fc%>_4^XPp`3p`D{u+(rxh~7%_JR zA+SaX(?fg`o&(AxsAw6>f%-84gh+*1XmoEMK<$feQBVxRD02F!(qUCimI@B%Tw}&! z8a-TdxctlBSD2=>M?G5xWIS3OS0$5tM|oi8a{q@FDKi3)$LV3$US;Al%sb|)1>idN zZyJwNT}Z{z0y{%}Sp~x?i+_Or+N6m(rHpED5J5gAsB)ZQ^!Z=%$gQUAtOg1fmig;9 z|JL?nO^o8>B{QbX4J)EqmEp$&otx(RazjF@<+YTD8I24L zG2oHSpvR@;qMgy<&bQy!_n&Knl=xs`t=Hj=&da7)NgD&C2{b=$abjo;IUhrU%B6HY z9&Yhl)bPXHOUnwS96GgNFM|$co6o@0uG@g`q%9B6!Tkw6sh1XrObcW1;nVsB_B7^C z%+pOkimq*0&d2Rxx$e zW)Qm2*))g?)kh|B%3aG&TLSyrI7i|=-B6-Y)OMDERiLvRMrJ`we3l=7Ul+rK&_4e} z$?Y^4iz5tjD%!(=*NRebQF!&^i^;xq9NBesvArNL|X3HH!PD zY7}p}_r}!HxVgU;!`c`(UzfTK~$Y7S7sZoLk_>_iFU{jw*9RHvECy zRHK8nf2;3PyeKrHqmQq|Kcm>Qtn+SV33Np`B)`)!RLNZbcTBUHWQJFb=YHiErovVX z#W3yRBiuYT9T+v2l!*5nvHpxG3}71~1V~@@8IzNpMUfoW#$d{(48@y=(?qb_ynzSp69TiRe<*W5W!*toZym?{@cb5nR=KwwxDSvz5w1Uxwj z#Ludb)78c|X(SJ&6mo&R-N4sC0pKE<{W2GrZ$fBd;FWYu39C@=Nj`p0;&9nv*CdURH48Hh#o4he=GfyKup|d--@~}I3w>3Wf7+H!o|c1YYi#J~c9bB36z?NC6`e7Xy0Vj_0g^7>rtN$_$pO+ZM@w!Ysoce|&wA z?V9M_*he~)*(~8#fw178{y?8(FjguQLWcl!4Ye>xx!>vPXhW+$^`?YFa=}mu(lmh? zpw>4otGcmQ`20bqtH+(G;oE7uwAE{Uyb{<16EotVYxO$v2|!^^KfuWeZs8~sSa%Z6 zneH)tT9-AsVDXqi$d`EN0O4aFNd0=LzUBpq$$M?>q97x#9zWLC2`(TGU%?S+1MPJx zv-eOSKU^nedi>-svlZ)ic1ha$2ZHf-KMAND^YWuZVK6LAMViCd`^j+W8Ea5oqK*IQ zL*6G{S^<*DnJ;GFaUMo0$lCBXdQ8H@D3e`^Km@bkP}tVzEkEpF2*_dE)pMua(E4$B zg;{3z!}k?22jcFq5-G#gFQX~ZY7L9^4$FLIBr_8v_^;z_YAjbKA}q@^ixY^O{&pDk znYLVhT-HR0*kw6m`WCQN06OWPU9SMjQ~6zgI~ zvCjI>c>D80jj;TRh=c}-Gg`P~a?Jd?#5i8Iun&I-j}RC7FQ>J2GpG-c{Vvg)<1t}o zLOElXS~<(m^DaojIKqdtpJ6-p*fSX?+=1#c@);bVex%fn!YHn3hT=fT9?#x7!;q{8 z0?2$@7gh-mVz;8kWybiqGcD`i$}%?~CCYd%gj{B1CAm|X9`0DY6K>dz^ffE%nPN)# zn7xT|ec2YQZo9~km8uPJC4V;jVdj+3W09qG#ahRdQx(|v&-GVG*PlBh<8_vhi30~? zV~xpiuh=_A3D~c^=40NTx@^NVg^LlxxT=NiXw3YKm8s0Rel}LwPa-wcJpf54`BUC< z=NH-$#Nl}1YR8p4fV(2~m_NG3@bPJnegk&|j-OIbM~rU?rW{@YM|$v!BhY+?9A6DFVs2F zJ!98DTo&%n6&UT^W64Gm?f=Q!SG0^KL6IdS(CE%Ka5qOc(4@ryp$ha-P{!wd9 z|CstJuvef#+_z-KG_;uX>j-8sXSd28@j&IH44kuicnjRK2h3KdL=Pprug_8KP-Uf& zf{jKwg3+538dcKbSYdd8+XkP9ryp*}E^4#4dAGrB+ z@j=E;W&~C99B-Q}S`J?qY$=dC%|kAbo5`VmeT)~BD#!C#1A&qP;4_Al7njQC7}BR& zz+P6Gg#{R{aU3;g9&@DS(@G&L#`e&FsX?8ZvHX+E(}CnLFE8sXx9?|32awk#;7 zV$5^o&`rHon!wcLxe+hWi&kQ{WlaK#5{z|^Z>S+eM^?D5*zHpz3pZ~^xQp9nVmNX{ za9R{y&(#+x2fe+#GfGo}|Ll&+s~{j#CuW*LG3wv?9&HwMi;7fD7h1yndC2#6uyxQ#UTTr2C*Z z^vkTIsF>m64ADyXOqHHLwt4p~i(2Z1?=Oi#Fon+sfz5Me9}O8+Xl5M-0`6bLxU@JV zZja@NZ9LcABsVX2=sQE-mc~08J1*TD(7;m81uIsGnaa#|@5wWQh7#r@_qmP>z+nLSKJzY2am@{8v|C?c~7?!JkV%%WVI#x51OcHC)%ky5NWC_H4aX$UWrOT+~K18E||hv5^Re`;~G_j z3NU_pP$5%xH>De}JAU7t3=crBc~~vJ;*{YM7Z)k*rvU48WI$>N6VTNBTFQT!7 zpFb)4_x+JB;L%FbPFjrZ7}twgm782kUxLNM>PWx@g#LK;C`FnVe}AR_J=35tkxmYC z<9sOq5J3ro4bVm`1*5r=a2(lT(cmVm9!z2>|>d@JaAZ&nFuQja412NYZYk(|N(#&I*Y=rsGf^)X3KNWs9xHsPBG2w+hly-q}HG{PwM zIxVx0haE5cjsw7vG0fFm7?>e);W*#sZ5r`(V!TE+?rPfVxe9UYeDF#LQ@=RgnAr=v z%^RsW>E| za71r9`9#Ta#lX3a!2NWGgTy%Qt)5m<9=W*ai80GFF^7%2W{N7E$ma8SlyKwR$-jLZ zl~828bpUv_momvsK1xhmi;gZYaj4bCcPXvF^oi*}9_FV=ca5E`B@>zFHq`x;|{a|%WE9|GFsVdon{#_E()(dH> zBO+=Db*_Q}=oHxT7mK9BKMfZrE1Mz|H_E>LfefKRSpv7xe9w1o)Mb_&KT_?LuA2(# zeh+0ZM zQMjBAJyPrs2kvLe+#b6Ii4iYC=aRO>-onD5Fn2#e!Rm=`Ht$j^48Ztz7*{92C*RT$ zu6n(=EVAzvL3vYg2*j^QxF1mrcAUS7zFLXiy?mQLB?Jw{rR9w=p?Ik?n7&3UmF~MI?Deb3d6FYf>3RPm;o_wks46K^-6|%T^xNyZipv>w zl?isHpn&YqdUOl#AIfhUGd5XyEJZm<2fKL7n3JBH>e$FvWu$cDstr~U@j059Q4OMF7>AOWN`|+vr zpV0fpm9V3wagnAySic^m`ElF`3z8U@E9O9uKg|$V#1qX1>l>%kp>A+3w#w!Z}7TFHAcS zK8Q5M!kD=+Q45Dz9#M5wu~Q#<*9XpE6QVt93I6>0=2vS5H5g9{_m{X$3J56>2FML( zY3AvPC$M^?Xm+9BB*Edr#04W=Q$W6f!7ml!p;5Nx`1ceW8Ni0<5ZQJe+8Lt_(#SYQ zjmc9My>3y2uzV}%&#ErLu;~Oz`Q)LJaxb3>-y|$ErUlUu<5>;9qsP&>W16Ro0T^U? zstYiQ2$^n9Hp3|WYgBxS6Rkj1K5z?w13jR(4qK!FM-6hTWwR6sx8&d>l5yv7YgzgZzon zN4+gxa2cV+`;us@1-1S^@Gm^u`X>$nFD*jKP9{1W+6zI|OS0Y(?hH$I(`RTl@|yVE zN-mHU>o`yf4JYT+)`DA_EZ z$GxsDJRj_ZpAD(LP;wugWCTyJ60=oDF6~WcHof;6p&14q{6J)JNb&9x@QVp*onRx! z`#)a`)($$k>bw2o1}$L9y0~GlsWs(b;#hnSks`EfZ6Zz$^VOYgu;^zILd_-X{ZkE4 zsa>rgEjkChXyvY9Ggj7hOb)3Sw%~t0dfvwfvb*ti>KX-p-|B-;LJ1g?P3?lf@O8Nw zQw!V?R2vQC_&Cp5575&v>?j);lHzemgvRPE+9mN3-`&0c z7SkE$^{%FAmNHT_@A$p?7%V#CWYLiFLmO6Jn7Ij|-pZl8V*0U{v3v~FM{*-VrH;KsV0ZCF0%EG&8 zWCI*^f>|CfG20wfHVxPJHukgM5rY^yDp(Rwu(J50ZzzMlrt|Xb@CJ1?*YG+F7-w?o z$qmur+hSGog$!8%7!TbrY4PR|N7*UNFK{eMY*~ip^xsZlRh(Oo8o;+>{Bh$P8b;g( zlJ!Jk(9Nb1E7RZl`LzJBMG_dKw)2^2S`9sO)-!A3Sh$r~)fLN-qB-`jb|PByW2dn* zkDJRDn2X-HQ0k`GKY7?YM6Y#uZlul2=xTw-TrAQse(T%;Et^q412X%an~!jcT}U?! z&b8GWy>Htn-e+dDu1x)&1RFPdoVu1`s$C^OS(BVJN0TJImF=q!tYm1?lAuWhORMm< z!}GdkK|ZkI$U2+I9(hH4Hr$YYWPe1yGKEE^MK%Qy5#GfG=$3y5Y%;~V-|2SnDhI;! zUC~F%(8%j`LSZLfmbeo2tk$j#vWEG#6KLtnXmT}BpWzOen8($KrKB~FDaQisFy5QfxQLVBYAuKdO}SI2PnV@o+mMbPFYg3Q~&TGmXdJDGd)#Re`0dxNcLAbmX91tND5 zYLuxM^_Wc4{$2c~l_`zMSb{${#4v7`2WH)rnWD}gfO!kqN>-MEdmFaS=17f$g*c}y zSW=%SAc6Ijbf#{JN-fK2$c1@WsN?p^h0?Dx&nIkjdQ{jpV;;_-PiI z672yX4w_xiu+3zCd(iNVcKlp)1}lTDtrsmQtbN(hbv|L+roWLHz_0|xFv$|4l3^>P zi|qMF?8);iOAwM%B!Rl~x*iroiGYTo@`kw`k6V>Y<7Wr=@duuyef+D`PRgvBur|98^wOSBWv)3-0FUI#~I=EFDGaiSc#)@db1$i~nxf;En zK9!^K*CBY>98NtFuw4~0<(ZysFH2DBoGU`372kkwhelBk zPCLoGmASeUKcofaLN!`WC`T&V-H2M;w`BWlUg&ivdV2wDdNf~%-$WThirp)?0)J3q z%95(~iFuqY^^;Jyi;JHWj(4%3EwuBgB2MUYS^)c9^V^gMOmUU(~7I%u^17x6BfY zudUe^NMOXT?{ty}8gxG*fX<5MjUc4Y0&j@90 zVv;%>Z|hBzddNq2_6vf~OQW&*?QgSd~x{$&RI7eO?YZZB4u%j%t6b`8i&BKpKybL^jm^^q^lx} zuh*P9s{0nPC7{C`x>w`k(Jxpab)(uN4lVpPq&wWv-ebDg1%U8B z{5uPu<6hc3!$pQ5iidv~4nZ(_!4|oFPI2u%$=blri68Bq8Aha-#|&x_?fY< zUTQ-B8UY8Uwfvew^r^v(Ar9Fn=uFLe#_0{)sg3&>&0b7V;a`pVnqI{~2E~+0&Wo5@ z8rS4dX>+_^z>?P_XgKmrG+2oh``*nDIbLj7hIorMI%!vw zfdndkt`gzRR{wn`Rx;cn1js;rrHRWhN!-tnP6S_%g7+g{ws!fgo%tARpXuw?A38KM z7d-*ugh+xg=r^%zK;d>#rMvw0g~DJbC7jvSGtHE3@)w$H*&mSK9NwD6q4O?Ia!YJK zUh{AA_iWS?kTSsY!*nO(z={An_@wj)1Q30(75BjoPGKN}mY^ugd=DQiHE#Y23%=dj z)??*?O7T0IHT8wTkw2;rOwWJ*TpXwMRTSE9-QYb{TZ_hxyjKl#2jE$k^Mk^%rVwJ`|&k z7MmK-yt(QcWZ(RGglJ;Drt5`oXNh;kP(r53iyGy3tCGQK@g?Xuo)aPMaoY+_NK9CN zOSE2iVL%9FEDRLvqugCBWJFytag;!*5myQO>f<6-ZaOTQ_x3-h-_k=+LRS}t0C&mk zrW9|V>D8R``FdSj@GP}%3%QCL!t4|#a0U53Nr^kjSVVDYi{|8w&RwenB6E0#n z|60D7L2s=NrZZ~KYGgT%K5v8KAphuZj9EudQk;4f2l)ik`dbu{dJ_5zO>0$6{~*Tg z%d$eztm}*b68uB>tsc>=nd=z;!a+L?;Orlkg^Tx$JLWg-$B?3-UFk$^DXVzXAM03z zY=_*-;5>&uW|PyvN&kzi%CH*}WO@L9M^}kd4};oMSOyw^V7X?UO+O@>hr;Z%2oz6w zGIZ5kQGeHQY`p(r5u^Y5(O+?;W~Ke4g>shxB8OCJEj`m36xFWDA@vTcG9S=0PIp2z zsiM?zGS|}|LnalSCo0Qg9$j_aS`ymJotOcBc)}Wn~4K@WY%v@Ir*j6KfNWF1fc>fqa5qOl6c*E$#AV)lY zulp1v@swnI7@1x!ALRy14O!)j|(NzeLl5L@%tq@zKo zRLB%Ys^DHbHWD^FQ9(LO-NUy#YxQw%n38dz&7W#DWxfw_lQ{Rk{VOS<@bf$6PY6as zl1>s9x4djUVc`|)fH+(_O8zreFi?Tm@U3qE72<;TYIrun*aoh!8exLlv-0?hYWWA!Y? z;)Q(SfHC5h#^bB~A(7uH7P4H4J=J6Z!b8WQ$**7Evbdjf5eR)MF?fPap~Ff3`<$Fu z87UDja&u#tX09V1ML&PB{_$l-RGHB+_5-dgT|b{xk4~~20&Qt?e)(=RVFdj5q2#q;3|vHw~bqS|#X2(PMqg;bv?yUzK4i zPX#o%AjS@BdK;L)WN+jseLpWXDgI#Wtq(2~e0RTx#7e;8TvxhQbY_ zF)|5s&SVwt%ycN>^88auD=0u5jjUw+ZtmGDWmnF~8buPpOGCFZdTg>X&C7fwCI^-? zK?qj$d0m!rh?GBzwfE&uDnlD0K-m&V4@*`#@sSafN~c!eQ0Z!`_qyq<^WaDdkI#h=i5S#lb!o|FxL-eA$7=bI}WWK^RlFfl{8H8Xh z$)8B<;$MxA9;5KFf;?7zZ^_E#qL1rJc{@S}*yX}n+TQ!S(xyneRdcWa$wV2tSYNs< zzi|dHp*mO!hfaRMP6>`5uHRaYsI@g24V>|!rB(`=Mgbb~Uw| z(JlaKdsfm6f|vtm1a7xSmmHne89DbQ@w)?JyW4^=P|V1ii7S{f`|E>1w(PznaY*v7 zR{LXoD`e|yFbZ|{&*sp_3P7pR;Zp?OLjL+;VZHwDnshq z>+dyx@4V#D%%>)_X}K+$>5>HPau9Q(jWvKIUr@jauwGv_bvpk?|N5gdt^I?g?uN^0 z!YyxD~#B?bNNj6)4=pvx}E+u}SN%rT>hfNO&a5)Mbl_POm z9s;M5wA6Wm>P^ZwvX+uz>t)|ZWo$oN9U}FCS@W3~Y{!Pg^`|6LPC(qwShCD`!{Oz~ z7*H>BmX~U9`{T=X)$kO!^q44=c{^HmRoC>Q@pB zZf9`zI8PSs5>*?WGB_8qK`8$~f9VHJ!N2@x`nDk=huzbv`%aSVEKlJlZZz>9eK_07 z0!z?L!>U=Sn^n9Fj)D-yvRPCZ-y&DyIsf?@E@%{ls}OY#ia5y1{gzmD${wx{h z2W^*)+S)*f$n>CT_Q)~Wxy(ly2tOY5UcEh7EF9H)R;}z=Ta-+C4~F8&k+zTBCVhFR zTLoX6yN!~7q5CXb2Y) zPptieG4WaG^1as4U?9*J7Dc6OO=uRnFq(?fj}#!);xrT|B*l5(Byx>$gNCxZHa`@_ zK7?zVxHxX+WbzG3jv>8imn=G6)2+1V;ll{Q1r5T={?^yv;&6CDLKcN)-CdQ zAp<&Eu#jSQ8wUhxeMacN7nmRMuIL{X&?*d%zQ6vBZG7y~328BgZqL@*{uBN(5ZpQB zCiiwoCKIMrT{y&4IpgHFukzPgOZ9*7Qk)!4TqKrM9Mh zXp>nEPQigLn`QWjg;&Q8`O1HqPte&Ro@b>y?_BKPh=AgtnA-$1zT~B2^~0oB9l0F% zG)izPOFwO=%m1c0I!H)+rJ*zY2#61?3HX;KA`_`Q|1O`WEt`%2u43)-=fm|1(&&sJXNP6K6 zfOvNzsz!P_%&Js?kH*J_S5k2BXsoWW+jsN~|DaFEJC^U~Y1%W&x5E)N@x53O@xe9= zl?)P`VAQxO8DnpdzWzJc_1h8age1@#t%Fn14^E)ecV9n&64 z->+@IhnRDO6UzzQ&D-bK5IWVzTZ>wMkcPZ zWryrgEe!c>QQ6!&3VPoFP^6T@#q%gWJP-vk6R!`|e>O?M$g|{AA1!rdzC5!{F=Qo9 z0UfI1NwnD`2Q0@|=Oa!t;ye(~AmQ#N^7b;s`!7wlddxVBZ!!hONQ( zl}b_-Q3u*qVRLH)=+<|dA*LBqM&GGp80qDA;u9K|XDI}HbOe^?_bk!%x?w0)%_r5u z@rl-tNMkVbf)kQt^3(M{wh{cb<;+K>5JT7Q1B#5bvq~VxwI0fVvQ!%GrpWW{^FV3; z)5U#*eJqk?z}2sw2NI6ARYfjJ3g zBm8EZKebLu#3X{J`&-q3BJ`K{pw^j69jhk->laow{cY;Mni6JD&b3yNmq zs@<&*je%$p@%W;wRb+N!4z!Fy#`AjP&Fw{Ho7v}4q2(u+!ztryt{pqBePaiDITZum z>9E-?y1_cELT@JQ1GFfP@EA-vm4MkA=j^|wPTDsa%F`VU5mMN*sikLVTpPc}k?)76 z)2ujJrMW%6B6J(;v;Rtne(oqz2$Ei!59Zf<~dHdH)G*o*lo;2c`G4H zbvEHsT9@l<%+E1k=3l!JWzmuY4u1v4;iwTCU{&vl{Fcs3H_AI!iwIIbgcLmxO75T( z(`ao0TyoUzJ}S{p`*_KdVGfWR(s2f6PTMe)*|^uagMT$!n6qL#w}TT~FN-K4MJg;1 zVY$scy-?O^gfU+^zhwPzF~Vu_^=Q6u*7np3wiAQGv3v#Os2aW zd;&k_>|WAmbD4KZGKVp;C8i~jYq_faDA@~!;P@bJUO#*W=bbW~z;huM(|aKHtuMUp_~91Vc3-QVPT*gv2ryndL7@*Q=TD%*)(qMj)tb@!Q=S97O$Y?u-AR zkUg5sHz_>Df^I%Kiqr{w3D=#qPfmj}3|aE=oS#5U`mF+t_zI07mIFVi%V!oOd~mUk z{f&wN?4w$Yi!T%|gVirnb6Hp)@Z#nSEO>*YUR-k0)X6)S8t$q(r0ZkE_JHl)-lFs) zM8D!YzvIfJO6%2b*S#b?$P@^g60#j+Uyw%+xUg2rvfsG+RHaPgD}u^Qbx%`w>`4?1 ze=|466tCVyCmBYLZ{g5G_*~n2~^U)UeV7W&1l8p2sV! zk+UhvvFZ~s+UOTJdkNFl#vm^%W z*~tFwanBMZvvzPK5v(6_nvC%MP^GmY1>RBPW24)QR@a;W##J^xF_C3ViA?NS zeIrXei`*i!$BqJ4M1mPdUyH@)K}vR?>&R2qBC`Os(P z3?vr*xM{Sx=-hYTK$8I__&U+^a4)RgRiq3eyA0=k1K|xG*_Xa^kpceD=0;n})GuRx zQX%lfMr;CE$Mx{#Oi1LE$@*Ve0jb%#b05iR&daA6#9~v~vyIvzkX=u@WGDa_h5P-V zZGvDE4FOLF(dgh4zU}&!RaOA!Zu> z{6VQ5c?F%4%_{4P22Peoj&8En)p;+14A6(qc7>f{l;X1T5Qu*B_|o{q*j;sKjAA|4 z52iIMDZg=;oMpASILz^mV=;?q7p3z7BRVu>_(YZ^T0cuHguU|EsFDzUV3Ybjg4$X; zHCdl`Q{LnEIaascmHI4PWU#Bwdo3OO*$zB4cQysKjg{FM#;A6c{CQu#9Ay$)G`hPH z00_PD6^KdU7ik{reSPR$VJ1DH*>v_F@}doXr|BuxCP{W}?m-pH-?>-*rRHm z$0V7=Q^UmGed2~={8ROyUTFx-T}9}@x2xpZl8p{zPsHeVa?HAL`i5a|VOI;ZT~L48 zj?aXIiR15eCjxf7DJV3)g2!8aM$}q?t-5EEvmVdTXNeFYqC~35&h8a?QBeAmpW^MU z@m@HN+jU~lOryn5`M~9bcQP-=qn!CnlmEVI`{`o{bC|xEsH(($h(_@w`5SQ{p0D}Y z+M?{d<|Q41x2{O6(1CX7#1hI8WSBYB?A7m8usW#~0)Z|c@qu_DgP<-3Js~|!IqlVQ z+|6_ASk`hRF}zHuStyIvJq|O#hG#yDeM`g!WZt;Gd$+61tFlJNsQKlHC?o9)yx93C zijn_gx#Uot?B$Yi&jh$ncUEx`o5#;St=PE$1&Pi|6vTFm7MvLr=&Xe^sW@d7h*WH& zAobs7KW?VyWba$DmJq-O*|dI?{wB*9WH`sh<3OL|BK0-_@B4ys5o*(gmGJ2Y$s+@e z@UqcW7<(b1zSMdJnyYwVf}R`FhbJ|ilOBFhSQMGm`qllEhGTH<;3qA(TmY|w@Ei=G1vb=mCt%{Xq9X;Sl(lX* zAT2a&v4l^C^2bmm!;U0AQQ5oy0#WA!)3Dzo66$ICwd%6$6OC6q=c7cpMW0O>b?=g_ z7YBM;q2b2wd>#u2sK*rOAdf{ZVBbY7JM+h(LO7EROpnDGyaRjM8QXQSS{TB6&06yM z+Y@)8*lo}U2aIcscLSRxQwxF`%AD?MK0CP3a=^-6bZecht`-W2W; zx_>LTM+sM#TdI1u>7-<*4ihm<|LaK~Rn{ce5O%V%@AB`bz*v+{_i~T4?jVG=ytF+E zq%33+b#SwGvLcPp)9O)N_Q=PeOWyocAzrr+i;m2UaZGnRu#HQ#jl z&uPKREM<%@`2>QJ*jYN(i*#ocbD+>qg4W^z=}mJn-MI^0GBy;0n5JPxLAY|x(B__e zBc~m3;p&H_nR+@J3EJ3yGgH(oQ+ zVC9xSJ5GQ2Jb9*#x^6VKD5$`5E+HwJ48VgX9hLcA$gC+viSdRXIa1by+s|{*ueug< zkYzzlQu+?>i3~@GQkLCnD+S$Y;C19mZ1|TiYTb_SYr9Z3EB=W`9YgE?3+x~h-+$(6 z&K0E#B)BYS@%VwXvnoM0M~qpTy>1l-blyN3RvsuDNtd4zn5d*|HfK{>_l_9_(VO;- zp4xgRhGYQE_I)?WE=a@Obv*vc$&E42dOie;}kdv#EpS?KZ_2gB=mX&X`2^ zH)|TAC_ZgB8`Pb5wcA?#Q2q(mT}E2|xu)tT|0M>XqoUazy}Mak{e>E0pN2zBG;8<~ zQnBrZ|cPWamafX4+SM01a*!=<-pm^Na8J*e8CZ+G%3=9 zm`$Se>UU8@EtC9`z#R$$ahb5o9^WHwXB*gpJN85b=cRPu?FUQko>`_Py7;?fpJY}w zww9NeUFK+_)66OU(+Dosx(g6e*54Z|4uFPwd!BCnAvJ+!tr`-TtWnORtbMBUQ3qXv zJWPgj4XDwpsfFM6^LmSrxaX_-_;nyPN_*@xSWhjqY$78khoHB^mzCVN$WA$=3-7Yx zdMor|bQ0!mY)&$0FP2bHNBG!_nA-u-ZN*IVFsf66tlaK>181s>!rBJuGmsq3TNC00 zD!xP#wEZDd(s)m*DahisyY?vjv1SiFC;*iKfEIoAK)6(7$v~0=i7uTSSdO)$sYXjb z26XGjC+uRYH1{qzZEY4!cTQ_}$YTp)@0o&UptqxdlK@IGOM_xf89m<8!VQblQHWJY z6b?dq=8>NdgG-9omTvA-6H5d`D}f*f7s|h!UdgXybvytooCc^HtfxJ7m94h29P++6 zA}QNCfLT$8EXu}BwPxszh!PgVVD4HkRcT8bZS}iz1Vr)Ett*5b8GLGpE4CtG-seC? zWr&QYmxw{cbx`>3{|K|=X#|ac-=M`M*Bc{a)cq4Qq1@VxJ*qmxzlh~zvXO*<(D&Gu zUuY;bS}F&PFD(9wpkDYCCj%4LABX3!7EGdLv`xv4urIas>uzqrJc~UEz_@RAe?yTl z6-o5YW2Kuqqovj#Il2datWdv$wNakh+x1g^K8uVbRx?e^Sl1z$qI^J%^78&FsfzE; zmN)u}-?9W7e{(%J9=c>n=)4cv6?CC|XRBAH8TuoF=gL;t?F8&<=+7v1yUl;O6tVc- z=GQqTyLRqGhmpb4YS82Vhj+g>Jw9ZZ#Nm>*+Spg z${hfg8gm_)nF}#gMssY56JD~?ZWNN|F2iYe;f}kRRSUsDSKHWK=1v7ipk~#p=teC>78M zZCm2xVIe9}3|?jW!gcZhzme}>zUzL;vx)pdN%@d=&R2NYh9N9VatCJU2=hr;S4Byq z$Ss|d54KABO?X#uN!{2Mv&K};_aDZoQVDfv--rasM%U@)Vp5o8`tl=)G$#tyIzbw} zb#gPzQyq}Bwc2q>nfPd`zudJb&mGo~Mgy5}Te4{4fpF*9+E69%Qr|4#T%ihzzmpIy z6x^6su3+EAc}V9S6T^i}XPb;FPIJi?>&NN_rAd^{jt(+Do6V5@F&1Cb&pn1yNhvKF zDT5{>y?DTEC`e=zpDpHL!rE0*R!_RNoS3k}YfFQ-4yIW9Gp%!0eJLUg&h4NDTnNTr z0-YqsEYZ=(8uk$hwBv7h82S=h>waXLx(|K)40+*m!D|{QzhNY;qaa}NvKdoUQHr+3 z>KD^xLV~>HfE)p3hEr6HCJU?0`V>n$FAq25(*Hg2E3lD}OJzn)AclgQOCip)EJH;; zJczg+wFEQ~ZV&Jud`D<^m*CR-&^G4xu~&A4-c64W`h zou#0En}wN@YRL?4t1r@>+DeIMYDXn=q_=i#Yt6i`jX>C=eX$Jd!n!_{`wh|GN%8&F zf05m<{{@{41D^o(R`oX+`kw)0NtBt?>Ef)3Yj0x*S=VONv=*HH)Vp*S*^gFFok8diEiCEHIJH;Y*Ivzw7w_1+{!3mmEtH0c^v&&&I(n$WhvbkN%POga zoyDrY+=NB;@m|g}Fj$KXjX{H>8uAUQHj9Ui=p5X?So7AnZmIg3e-vGApCENi(pPAEq_9iwbaE1LeXk-P+w5t;NC5N7fb=NQwiM%DhadoKb#>N3;BEMujEfRo^VqrKbHtu(E&c?~(=fKRE&GDtGY7!iq8+_`*vX zH|uSrj^bLT`&(w}gOKJAxInMmx<_m+20 z@g)1;^C;wYX>0I0UL@EUcUt82AlI6|h&1vPDlC;`39ye!4#&k|opvcC8f_rf*Dgt?)h@iWJ6Oq~5j>Mg7=d`HL3Ug|9J54jibJbrXM@2Tt^l9(^51-pZ|s0C1&ftTlh( zu}<8&;toI_I{`^jM<%0~hB?^mVqh&~evwv~Ud)KVkE{krz8gJm5&f~voaVuL{7eig za^OB0w(e_n44o^d*B60hBajg$Cd=`mb;!oF>Y;I((%gG@_8pdys>y4Zln*=*z{XHN z*lL)Y{QpIBFk8wP#6}ZqOX^8O=N?ROgCg@91gDYHlNbzFM%U#Y=foq?bid?sUhFUn zZyrC@eygc%`d`JNx4<;rVX*{(mZZ&r99t}>%>;Ut@yZNpNeAN8MP>*s&R!n zTq6!&itEZOn%#vv32$0O#lfY|O7NpCDz!sC#y&*j<7NHkc;U{=S)k~B5==~ExLma_ zYTwe4MjO7tAXC~ttpxxSzb0<3CC`<2)=1($O~H`-9*@vF}^I_oKSq4a+b=&zI)aNf3VI$295&Mn=-8|^w9WhYaa zFlpEi;})=zvZ=nH6)^?>1Y)M8IS-Afm5JDJ{s=uaO}u;$k{__YLpw?85D$MO(Zqvo zR5}&Gr)a8+XfB(#`u~m-1M)FjCS23nv0N8sVZ9tr5jANoP6YGwT1dFb*f95q_e!3d zPVg5*OLP`%Tn@W#`lx&tPF!LSeQ}PuhZrgZ{?sO=wOdWM^ck%Quz91W7dBr@{PFOc zcGES{2kcDKrF(-5sg&ejcn?DRH~>rx>gJ@>xss=kI9b9@j}KF>DXE<%#roX7gm;vL zCkBn@e5Ve=_*1<<#@+ZD|D8D>V4$ROCRCGG%hN^bJXIe?<_ph&zaN!$89oWa#3m}z zr=@scyno;v#)6sx?9N9i{3@63Gu~>z{55ce`(JpIdE`@f|4c4kB&*RjV%E^;UbY5X z7~EawZ89F)W&jJ|?Tp%wy9!FB*dhZG^Uw#j^AKmzCn_Gw7F;iNNbsy6UKbn2GNx;jwp{IxSF@^uT@@ zVNZ@Tw77A;t81Ole6WKqbL>Fw%m6T@ap(EIivErOm_ftPfS*@QRB&op?B7vfX%TlY zIR3x&nUbh=+?+34i2RLmS^d-e8_dJLLZVJ4rf5r$pKgc$@AYYB`Wi6?(Usk{Z04A& zd{;X&jofr{ner_pdZ*^>_1WI_BX-vWuPi%S63gUO1Z@eEe+gg|_lOD8P$TFT)FGYHt6$Z%2kWFE z`@|PAZ{eSp3w1OD6rBHOc#6)kac}&DL`Cc+R7m(9AufkornwxINKy!T#;nq_JP#}j zp;0_Dz|sxyeNs!nA5@`i-Gq3xRjnRqH8muEhnue8S$BBPyT(M6>QP@UuJy)`h&aNo zhFZ=iuuWu|`OFYCWNzogf9qR{^Mq$o3ecKCuQS zKO^t5iX%do7>4ck4hPzC$HOHmvJ&102P}*;exVi*`l;jcM&F$33eqXyh?_9;?4(8d z1`{oei1tW)FT6pJCKrS+T0Ar{wTmG@`NF)${Io768)yrYz%gH0I?m$yy8X3@q@gN3 zB7}d7GK{7Z4Cua|9 z1PJ>XCv6quvo1kztQ~*Glv#n(Qa-4i6Rv1Mz!*^m?QuB%HDbBBlS6H^;r^9Udgw8j_P55k&rR9|&(O!02S=bMIilyHW_%8~F=I`_xzvMb=Am z(J`GFMoTDokQKP>4dR>`FYcG1IxE)InFnc%PBwFv zJukPoZ+}9M9(PyEdm3sdPUh9ofyfW~1h0b>!k++dsEyU%B!S&m5~ENgOwU`?*C-+f zk@te3|8;{>vZT(;XZq&*r0~8ELYFsJK{pK$dz*$9hc*CBD|T;z5A=l!Nahxn?)yq1 z`ZzMj@T2v?sV+X{i^{1rlF{+EuR@qJjh7}N8M^fwH z{eGRgV|^$t>beUINO+J|%{5(8rlg^@7EM#3qA{w85ooWL!=Gv!$(gj(mPr-ku>XE&P4^(Ntj3?ZHew2|V38=Qq#!goi(*TZpw1 znue!hJH!mxdxR#xLHK-Bz-MRy6+eas%^09U@LArxAvaFI;))KHWlonm%bUR)KNJpVlcDw)R(JI-cn&}}Ec%I(k zTw&OdlNTw@KN@;eRvB&1#il779o60IuFOMPRGH8vIBE6?7)g&hpG$pT<<qAdg{TubsLJ{9VJ4&;RR25qLkd5?61Lgy(^MyVNF) zs(+q${cZm1))n}l9Jm^>KFe3@@T=6dBBH{0mgNdZEMp_gtZ4M^E$uI7YqSP-Ev8&B zR^8LNr-m1!$n~`1rX5btpDNY*=i&LPN_N)HWUK=H+b1rR`@rekB!-?}@_18-M$xbc z7#|Cx(6&H2`nTBv|GF^HLy%*kZ<=sC*2^{;i?M$A!!Xd!)n#Fa0_3Pt3s$!P$ziF?vUg+9Ykn zg*Wf4n8dr*&ve((^?A(FKaOhF62$=KwTka}OI;LE9Gb#OpXku-OM($ zKA@73QY70Ew49VB#uCp`3CzdaZ^(^X@;`m0ggR7QAZeL2A;MY^_djkzQxg?Z^n~$w zO`k8R1!~4QEiFThIT2fgWEij5VPlk3ND)^3KG@UOnvQ&BJ(joQ)(j@bx6Xo$U zggbqLs)w`aIlGCp4duarz38o&qq}m0#c&o;+ZFcv+G*kGlbfdc?jZ~`VbIpTV@#sJ~IjEBuOy4mo0p#>3d zYrK@;&eKkP*|Ry|k=m}o>S|i_u`>uJ?<{&&lD98^)^b|o23UzKqU?H?x*o~=I~`at z-!JkAvbGb=HK_Jdek=$1EHp(d(3nd_1YS#{d%1fX(#t=48U`L^E=@COtJqW!L$$zE z^lD+DyyviyYu$WAEDV@h=0)+#sgSIH;KwT^p1mhH6=O_+Eq{pO*iX`8Adf~N>R8T! zJfOWu;4dJB5fe>fpVD=TNZcHzh!5P(Fl4^ZaRn#)HtHrpZ<}jUcW#^79pv1G_Rk z_*AO|WL8QOJ;9d7Y}=noG5MM7$E^u8wl9~5V>$|3!7R}DW--tQd8f9h-kUCdIJq8{ zaI&hT+VJ^P71fJQU85vfA%ls*1D!a4%^H^P`fplwmf9v8Q)O8GRyM>?Lk4i>{#HN7 zZu6gu4u3b1R92nQn=CnwAkW0=?Lmt+g~M?VDKVJeGaSAaO zR^2pfm$li82;Cz=1PD{8v({pO0%^(7=#)qoy!VQWJi1xKqNxT(xF$V2$Y_3f4whAm zd(+Q^m53#?vMc{B^8BJZSKct$?7iL{ER>~b2p#0Q5q;z5spj75&!Y8G z*hRtP-H0s8&-ur9PSd|@Xe)`0qr?eLX>MN{TruwN^Wfl6k*4yrM??DvCd7jS7fX(k&-cUJ$Rxs44-Qm#Lo6u zbO{G0M+}UCp`j%Eb{0wpYj%kXDd?O&YFTZi5S3GWPt6kCF@bmXNy(-nFOJ02o(;DL zHWp5hf2OlI_!V*`q)2A&bCY_1A=_`>Ot9T1(Kn@OP+yDTBmb7v_(c@1yAxVm_@dvO z*R_S;h4Z;%=0pc4M~q=SX)=QcX`q&jGIta&#OgdI@;5ioXyys@seJxULFiuBj~SQX zV|yj4J%hxnNw6`}_I=YHIxxTFXle7;pOrB4svpm4KqR@lK;6pbE2yA|RLe=#(F;o* zW?_er{#+`^1r4GH^fio!x|l3YV%{jUA zHbZW(dK4Lme(j_#?U`}l|Ai(-|K`oY%7aqA5F}SVfFv^s>J)R#*`fqHe<8|I)ofl4 zcP@a}z}WH+drLTH-3Rd->X~3Rxp;UK;)>xTWJWM2UT9wK6aAAwszpXdSaZL z4(pJ{fJ<57{8fh#p51HHaoq&wN@*>ToM_?`Id;=`zZg5T4_g&)i3F?-$>K<{{E-&k zKYPS@Fe$RpJD#Y!LrwCle>%PD4&$83f8=>@sn()7I6FS}!09{%Z{C=T>B{&)_?xwT z$+lvQN_0FvaE1oIXvZu{-vMUmOUDFQuK6okHSQ;e-L8xy2IZCz3|AZ-pSWUr{#+d2 zQeP32NmL{>Oea=1g{}eTk&h`V|9EB|T1~~MOoeZU0p_k(q(|1BS+RywXUxlaF1s`( zCQMIHLko9FGmhsRGD-Hs^Kf^L5^_W){5Cl~0cx1BV~B&`L|@$4UDn%na_iAOpsETrbB}*_||1S!HiGzuYiSU05hC$rY#>Lc$kU`wW(8W~L)Y#s{6o#K4#@WTm z)X)~jW5cEm)PX@CgDwYm^Ms+r(fEG=#QzM4SlivTmg}R>*{N*LXF$&dpeDBYvZ{Ng zhJRa5n$pVrvg*pven4_kaSRWc2N+P&CvoW(gFoxH6eQ_~y zdvPRudNv^Qs*soz3Ej881!iDnXbXarl)RddfDWn{F%AG4lC_b;gRcU9pbuNY5C^h^ zB|+7uK$Q-t$R+9f_|JhDn^{>q_|Jhj`_F+`SswbI15q01#twvyYznNzrD+-vfz;iA z)YrFyMM(Ff&|ck$dMaRnN+OZ{p92Be=Pp9*Vh!#}+h{!m=sgNTCn@nI=I#;A+_bMz}K4G`?)Krlo+xZarNs1gA& zx%H97bb|9UBYiKul%Tk<*73jkTfah*oVZ`b!2#9l0uxMM6ejzmR{M5FwD$X7@k^x; zE5DLYw{2PD{x4!9Lu&)WCj!spzi0QeaX6dnTHaszWWSb&yRZwBR5X;5lPbUVKtH({ z^=u6+Ep=?5lw7~X{{oBee?flbCvi2t%)NeOPI?!?48D4MVgehBLwN+F18?*X`|oNm zd(&oq#h_s}+P&wQ8yZ0@GBdG&VrYN2I5jeSe*Scb)5pb;x6J%veC6x?T>g3|$jWZX z#T2ZjUB|Qq(Jg9;(D;Z&oly6epPD_Xm8WC-SIfR`SrBQ$W#V4q>lyCS7@v0bA524F zJzVMCNN%+vVGm{Y5h%!up@v=38uz9l{mpt`vFoNm>tYMJ)C&d}tz(S`?TBu1nOD_< zPpHV%n;hq@N^_^&6Gk$LU#7c11ryng*3$ECL@8Y)keFNf4Q5@btP;*-hNJ1>K6Kwy z1Bd_TKn(087@cQgs)Mcl3A5y_Q~ugt)3hn;PHk&FckqU6qP|nKzz-dja9-9p*djrC z0DKm5c8v4yWwQU&%)1vX-+Cb`|2KXY+l1n3+I&@%dyx=<>Vnot=%%oo0cGC#3rH}e zprFi&aMBKx23;)cMG9DAakZ-q!A1B}n{^>CxJZ%llkpOB{1Y?a9-+pf>esPcNxV&Z zY{%4Q0_rM{2GDhijliGX=$os}cgUm!*ktSH$(BP0FD{?tJ-|v}dSj#)iuN_e{U(Dgn z0o89X8#A^DYbQkx1cchyh&y*UyBgUY^`Xaan zNoBGo*{7L*Ew|$ySTpNs*AzX?TA&Qd+A++xoL?Qa``>~4fJ zr9h^IzT6SBT2}(nd;z2hr0aaFCE?69QGIx3l(yFmI;D2jh1XB01hU&zue&r|O4TwN zryw2Xw-f^lnWMW?Kal=9v*rN5JNOdx*=;r|&$m<3MAf;k1bi5J`fxI0TBb1=B`Z}; z4)AA|LTVebyya+V zA1rB?=A_Ki(XFSRqYV5EvCld0A@3{q7=CYxkloc~=) zP)E)Y6Neq$vr@z_<=uAuXh+aZv-b=}S zQ!Zhby$3q!b_G4C(qpHO7uelkVz&7$I3?%hcxv3mn*Cq`2`?uyBE{l`cw%R6`PswG z#a8;P4)6T_v!?<;KFBeQvdDH~jM=}@U0G52Z%L*jL?R6Epp#4B>~24BhIyg}ce79j z8Ig>)XWq)Ua_^&A%NYCW<`vk{`B%K~e1~9gN#mKJ=2Z?6F-;Z5zT&8-_&sBui7_vS z^*}2NEF%%~As*TU6>1{v3KNJ|rS>*?li0|>vcp6uW)h8XJJb}$!n3x)26BS0A!iTv z)^C>{AMM4)AZD03?;U#J;01$<-1~covruXSU0kP`1a6BA;$st?S-Zn7PXGgDur739 zk!;rmmCRubgpjkQkhCWKQle6=420JruvV;doSImO^tba7>HV-gR-sR8vo+IbB93n9 zoSS^SM#laqK{{kAf<@z(D8yulunxe+?T5c7d0>2)W9eIz%Y}xQm^zs&2wb2&cICV( ztBV8hzx@;UuA}RFer`WkV=HpoP#CV~Lm9^EyZn$IursBVG^} z*-9#C6=pSFYd83x+Jf7&lo7^(`qfFFS%(-y#woTlELXPkyh-4jodBbAXlf6jKfuka z`ZwvL&F(@%It95gDdw`BaoiLNl%5y9Y;VGBl*`!2Guj(6Wnrc8%@kfoVmNNwJm>q% z#6|7ZD_)Bfl$~8A*?Ic~P#Q0|OU=JfZ7*x7k~q8L=VVFZ^9}E8Bt%f)6~gBHOX|kv zSYxLLFN0>xIs5JDGnAMJ}kBu0XdLIf9}83-MSKbSzptiMq@4*zp=!L7LtxN zFiNtXtr{zszVg}mE=EL1ju9$Z3$yEmPCY2@MSP62A$SRKBD(EQ149X~?IF}=1))XY zR&3pV(6~mUaJGx8h#D&P@`vt6LoGp?rs>aaEldJN=06X`jDc!4_Qte5VGGg2v3O-M z?Y^(l5>~5qQ^=z4R4>B4Bi&9!1@F_@y`lG=+?$%iP~`+|yk%bSlLm})G6e0%Fo$7`6& zFQB~dffgVRP@D!5NdGuyxaZ`=OdQ>wB#wol!u1|$VMjLw(Q>mj3vXBOyj(O|sK{U! zK7e5(_~pAR0o%*4WU)lwQ#Qc&j~Ht52*r}ebnP@8q;71b;`<|3BY=4r%GF}gjG0$!gsxf5SF3FL+5GMr#yJDcTX&AFWvQ!{91HH7)P4S zJOPSZW!c>k_*QJM>@WmfHVD5fcC7$G6+{WPlytM>I0xhdiZ6`!2<=f)cUtfoTGiA+Iqe zNm&GE;&>e=pIn%j;_w)l<&LDd$Jym;7ad*rkGjYqIf2^$nb{dCK%2@8v61|3Y2*+t z%>pH~TxINfdvtD{)HVYl4rceT`~pPC?J#|8s`-Fw*@S6SvVKMXU=07(KuN@#x`Z`+ zXE)wzVThdG8Z$Ca~vMsI})j-GQJfU z-h;8OIR`#mY8*k;qrwQwns1NrzJu?5rH8;!40?3UbMN#mk14Zsdeip6UwIdEdUq$c z9D#grNf_f3ir>5Ag^w?xlYBeg2usND z+czNN6gB+M74=!CIUYGQ z!#Ik8=&4JHO+x~%9a2}?dHTLM9)MP;fbk+xyK82Q3f6|TR!ls5qicN&GXAjWkkw5O%M%nz-lZtK4e6XQt%9sb5 zk$<$cKwEJ7GyE~$>Xb4{@E?RQ?nqs2^PW_qndtRw*Gi~qXdpgVG$h>=+&xhZ;Fyne`WOdsG9qR)I{xE zvhy02b<6-PiIUu`3KgOmLtY9{S48#%<4au5(vlv2*DN?1_l;6Fesx71)77nZ z$3O7DxqQk+w@>Z!g~SEyXK?jIk&T)vi7h^2-=t*W7J%WS3#DO1!{ZMwy zL!-9g!AnoQg8mV^L!~?H?Ol*&kxNF_s9VH0D2?boz`igPw?-VG3;3YC4&bxsoQlJ? zQhFQy#f%H|`6bO0&n1ZR^hKi-gMbl@ojY*W(1jy*W5b6E)JCG`PKVBpL6}#fZ7wfd z^GKekTa-7yp;QqB?-|h#+8_O=|6gnT%;=cRlDDNFK5RaaO-}5|Ad*EpG^=vx^v`h% z)?+VslwYU@lrHIcfSbGl>HWuO$*C19zv>GznSkZ0So=yrgIM(>;7$I^TXy6FvcWCIcYn6zqm8I7zU zSRPo#UJXKp50n4c2R5OWMfOGHTAfaJJlt;)pQkI%%8amKrPw8Ej&j%Q8$aUTi4=63 z!zq{}KhsqLQ7Am1s}`-KKwheTh+P)L1gX5K-V~VZ!ac)7VEUD|&IcI&Qb=DNK}+>g zO{}e&th+a@FE<&H`KCiw5{;sNhPtXA$d(zq3juU6D}LMZ&g3B*Dw!%9 zW@m-#k-#$M(B6DwF=RGn*KMZ~Cj0R{X+->92M|>Kp^v~8&5DkgHh|3@&p;arstIh8qQbX&AMwJ{e%6S^|{ zzx4+vMMMwZ)u`r8@^}l^AQgFqm7CGN!Paaz*m~cAFzsMCuq%cl6^a_^Aa~7CHLW;{ zhE-V4j{R^?86>^}pLZ5xO!IgC!71hn9A@nISe0vZws!f_>lWm@&&)W%E96-2_b{1r zj1#WY|FHzL0!xM%{uWB2byf`oi3Hx30^A6?XmR&H-)L&HF8N_9wIf$!sh-E>$*UD$ z!{b>_&Yy9~Hc{dn*iMjzSYlsT-Qg|wHCuc_8#=0hzNV-D6K`ncV<@?TX^ieb?J#-AuR&jhomK-ZQ8! z%fEnM*MKM}FQk znT*w81|7w`;hilNasqt#zES^-k>meuKyT$*OpF~17nV||c@K_07KBE+x^{=0^a&V?cEI7v|WqAz#W$&T8+5YGVHAZ-> zYG9LndymBVUEoD9eemEbJ}37UTo=^Se`gK~pOe;ttSf@nri5mlARn89u?I_2r3%Bl z9nmJ}HXf%Myt>VxBpL&UZ;*9s;qO#;b5L=Vp4La~Eag1aN(X)qtR0TEd`G z3*(+j^U;!zQmSQmH*&||a(04nTC4O15ijq5Wa{ptO8^h{8Sja2XO$;NNe3a2cAR%* zN`|pgF~@^bo%bpND(}jF&}7XdhUsJ@x-O3EI9m)rqaxsuW3DJR!SyAV#&0eX;Nz2& zAPgo$cA*>>L_URyLt3zE$OZ%3CzSW({dg|Ga1k1vRjxu@b;{9}ny zlI`aM&&UXgi(=0|R;lL-6{VIsMa7JXU&wScDmo3-unO&|d@^v!_su(E@D%+vJM5P(eoFm&k&F^Sr(YL~g{-p+vC=`=;V7y=s}0 zC>JMjN&~KIOi`2?+LOiL<81@bS_+cqQyJXghr+2IzTbpVRPsE;&o0XCVCdhgv+6X5 zHH29QHky!7$VVmLg0?w$Eyk142GfN))50Ql8Jlt%NI2V6lQm~(WV(N?2)^DoXI5hF z?imi)u$3XC)Nj5gljA3G2)w4+4$s6!oG4_D?zZ-K$Ddd+L-X+ZK`Zt|iqNb`Pq1zJ z5{C~*H3JEDe<>v<%=cirAQ`VA@_l)r<+wP?E!p`6Ke#@#ow6;sKe@9wgm^)J@c#=b zY(xtn&90Zm+?eU8Of9g#*bz|n5*i9e{yKE`(R+y1^aU5WXcQS1#J3kkxSu z^zf-dNd6#9yQmPP+W%d2u}|`LPTZO|Bs{QLD=O!}E)WT~M?Jur=0vQs*OJZ{8?8v_ zAd=9>*1D$$QEG!WM6W6!4V=w45;d3ot7M!!SsrN7n0Ba_g6TfH5svUJlu+e>|HvW3 z7jRV~JPGuv>UH&$4wiNHsY*>)=fBGK)E&y5E3zZ+S+F=9j+K6z#5MF6qO>rD9NU+f zIEjkuIp?1aI$lIL7`YRX&daP{vQL@EIhT7^*PPkaS;7Ios3yG04=(PZO-;X`;Q{c+ z$4!JvU-3n4QaXUt{XcXJdu?y?UVmfhn?E`t8Naq_6GwWMph{Pi*wwuP13ZEME9*s zPXFVjt>NT4-E!|?M5-c z$-5H@Mh^|gnY?W4VPP6#PV*^!G0*U#GDs)=-mJ_UdSSSrpnlVJqot-&ufYkc;3DGWj|4*$z4^`9`Yt@%bk`@se)dr?7E}Nd!^-rg_ z#1CQPbX~(2VfB7qh>R4BR1Nj`=AitSOq5YKbhA8nlt}`XsGb|o>RYf2XmHF?)s4dD z?MO3ZYzYgTYRPp}vvOcD3kJ0-XeC73!m zMDp#y+1_uZqv8*f+KZ=p!_o9%vS~Bl)a>>jadq#xxyU|~Z6_5)!VtkuY5La>>_rlK z5$40jaw3>`^BYGmd@$`lq1Qh8ARNm~x%B$ravx>qAgn#Z;G6QrykzR~C9k>WxWaTc zS#RG%(u?*=t8^qrEZ~=Mu$dcp$EJsaIl@Q*3Mzv9rcI!xz1}Mp70iW2HK!mt0tEws z@C4uLZ8aX40I!EJlRSRIL#&!CnRPzY+J0>~4>L{kF6)VHXgpo?qxrBz$$dX7|0j`Q z=qFxet6AOEG__>|L9<~eR@5X%(!W7li}k!Ld{$SzG}me$sZ@e!-ZnB)Fob1RXVvcxV(P6-h)?+G~1rTj$z^()S{Wk-~B&BRHC18=ViM}zxB=Zb*Q%I;s$X^;7*0dL-) zqn*bI=3M4Z@x#M`VANxI;M=jbtR7s>-&>M$+R5Ux)#V3neEQPa=~JWH;czP!;P7V< zWKw~FqZc)rSXJdz5H-b$9}4?B`1Qolh?15}gmFN!TCXCe+c(v`&F?PXKy zMFI4f#-|6)ijMYOE3H{XA-!M43?3(hl1ffvHQXQaDI`m-RSb1!`h<2Ak?3eTSjL_(v)r8=*HP!BxTIdo4bVEH!?C2rD z#fkiPH=gZl?-0)qB7qfTrpST)2f$79S%*Ei+gEHjncr|69>+7mJ>=epZNW;^s|`xB zU*lVjw$Jp!8IXZQG8d$a9RLe-WD`0knt9bX4XA(1o{o8z*bozKNUjLs!%}I$-^be6?AT>|F`gPNxH< zTK-9fQ|PrUlmiySnyP6sRL4f0L@c4G>+k3b&PAqIUUj+Xjdz`F40}X)l>If#tU0p? zpAfy^LO}Lz3G3Scz6(1N>uA)ie%OAO3O>HAuiAdJ;Ba#{%jWdFE**Ti_j1c{L=THg zKIW_e92FC2Un&4wZO;DUJcmSTR4gJZ5rmJLw|6Xca)E$LzUMqIn`N3Yyd}8DKL|_h zOhg9ntNnxr?Ht3`n5n`;t@oGpwvoW*#N3|3wK|zG^MGDgeu~12Y&ZTf5u0*I^{->e zDO4OqdYe~3!sFwrs`{UYDT&*WR4BcV6Z^m-Q_cY0CmP3zBL7R zylnzfkZK&4%H>G^K5s7uv%`~O8^RYHamZ1aDTvetzc1r)r`^%L+k_M)h#03ndc><( z8e*Iz;(t~gy;PD4QF-v_X4(^|tU!ep7{#CPSEC#OQ&wMsFhnmI^ni!#E|Fd3KNU^h zGX-jVYwfR?voym@rD~fsnq3nvpobv)+;Pn6VO4B!7TBy7mdoJ0LNkB=RYwmgxh z&d^W13Nv|m&`nPArkl5GM0GM=l%+^xO1?z$L`};OR5}%Qc*OuSI1cMh2yLHmqm77P zE|D7_aXl;Rm}+DQb4cyg8X_mizi}La#@9&c+ph%F({#dmDYtcaj(gC*!jtuC*crYU z3lzkY<3A15*;rB@vOg~-T^-F(%0vjKs@sInz`kPbaCwP}$XC5HrgAZ9|7st~LKWYg zz<6qxGt%)=eooA%c`3S;=z-^{{a97W@c`zxF+;KemV|cbK)Q0y8prQuPGHC5oti-y zSIrSvjMm{I+y#*himrA8MK?dNm8|66LDXy|6~nWqIBe3)ZQ$`FVDWh}uJgV&93Pfr zmEkMo;g+v&I=X9~?j?gZ+I<7}V6ohS8v%0_4`<}mER)if93?icL3(SCQSo z6X~B8=l7kHZ|&B(5}u!a79z_>Cp~-Sa5R$La~gS}jQl1bPa!p{$*`gc)_oJZPhZdU z7bz>d%wnV_vKKPYran&7YAY zR^kR;cm$n4SmNthAhASWQ|0Dt3mG7dNN#jX=-~JS+;J#Xku!wnwqP69#}?{F7PsSF zw5j7x9?h7A$nNDYP(x=D!x~|$R1^AFPf+GiuK2tC>bY{?iUxNo94~)|yey zf4xGd+`n^~uXa{;2;)++jlaIU7|?xvZov0r=0Em0v04<`v!z(q)c4ksxaAu)tlz0T zh6laPzT6q@DB6UNuWHnOTR8g+q&c|;q>zf2qk2>&Jg&Bh*IOjkDVX@%%TeANW4Lcv z`niEN|4U899>%Xvt2*w9KWq&!y5nRSDr3y(eoLbqh4XOQW(;c!QVoh5)UL z?Ru}ZFQxH{53=Wd>(&VleQTv&WPjbWDz0C!&_C)BlE^sa4*$S17IDcR>nFTNn-IVX)Wdxad|2#qQmb;cu&9TkpCjy8F?th6E>vouy&l}6_JE23tW z5d+D*x+{m+C>BHEy1{jSc8W~y`Dm^hOFfSEDLEZ%E;_CEe z$rSStbBt3yu0siCqF2yGP*BZZsH_C*Y+K=mz&*^v6x3WU|Gi$x(k-d20diuXvd)@` zXi`MuLc14T`M}NV4%!yed38*fp*;42Aw+%*IY>D4zZPlS#|U$|Lp|H-eu{Pzg`-<6 z4Y5-On?}1^I6aHb!A^Kx3p)y^A3?I74>-1A@dqlg;Yp!Yr|NYd7A9}9tP#uW>6K!o zBPO7Mj|qbmsx|Hmw<5;JMKNS^ktRprWtC=LXG!_In~Z-!gd57Jy-vkY&7o7oR$y-aP`ZIf1DjX%&`;ynxo$#5y+ zit<2OVt7&%7CS5yt%{YU%O7;S;RM%-vAKXKO@g*q#ju=~s@WIlPhiz#0{k3n`lt{Ljf`T?+4FG7MlpOtDo>}AnU*=**{5m_w9d1u^>Yn=5u_3 zWTprEHrH{@kx@+WPSw&|;bP}L(VYvoX3|=-8vhzWD==CW{*4K~4XCaxlTW_^WVRXC z6G^$*E_*FVhH1SF3sq*86CU(Zfc^leopl+}P*s(ADOH;fZtKsAt4i7-dYb$LgBTyH zZ3*4hvrZSo%+%}1XjGCpN-wpW1}d_`ra6V55mBqNN_3lX^oP!x#^XPEyIK4Cr|HW|E4;_Y4;6vz}WhC06o^}_$XFyVNBe)ll zxlXYWKHOHyI+%m70}UhF(8m zLHPLlsXir^mXspDU$DQxi2aq3$1J0_3SnDgk_+JT1q6k0E6~!N`NRk)%+uAIL8!tw z8^aeTmnm-2dT${vg^WDM?f=V@IUJW?+@ZsC>taJ%~fvwRfQUo|ZSU?(ME}@N_^bD(W{r1e9TLtjG{fwz%T-gzWlx zJ}thpNngmHxJusW1`puKY+k4+dP{c5->PfPX&Rduha33*pm{WO-MJ+w-U9m6%lsRa zgNllNoKCgrxwz&?HU|jtYmFRvz(v;NAy5%KXQhNMS4dLnJl6L0{g8r^6)a|AoPM6I z*P7?a4yB}gs9W&&!~wbAI_d+UC5OheIE?{qb8F_m6QR=YX)lQEOuWeT58M}BZC{bp zd-+XVL;b8&-AylE%`>9Hlw4W$-VAxo@+K9MUAZ+chqgPd7z?y?V+z zfcu{adPN5=U`_F~6D>QMZpqTz6DSso<-A?&C`Wv>hJ!r`hBrg~k{EO~lES4;c;I~K zd2lR!`4PPbB&E(KmQ6M+`ak+ypJ4SFM!q;Z^XSsPZ`ATpF+e*o2! zu!K=<>qB=(j(Dj^QCJ*QH^pZAOvYVyq>^lavGj%{)2ew(5P2)pdnU5y zX%|Wl7=VgGVByc&?|TgpANH05U)qxkHh;5Zc}ig*&XvD88ait}^ptfJCnqughN(JO z#%|y4?VhFdFs8mB!AE?oF;HjsexmKrDViN^ra44~Djd`j~p7CBh^t;Fu!_zIE?%M*K@ z(ZP|GiZ1xV`ImMSd3#3TrgkMO6s%offhorKKxup3dK!<<52nU$YcF4)jVP8t&rexAr|m|7(0h8QJ5%Mmu=g&ZQHhO+qP}n zr)=A{ZM*t^fO}W>IA?p1D>HV)7wN{4!h>#2(VR85)1^V;-ZpE)7gl3{1`@vN^uKlV*jpt+xfz!0x9#_2`})}rtK{=q#JNs3r&KPk6bCpboBe_C;c@$s~g z@(m>smA0ZaJFlSkEOTM7NBt&{`Q2bl0|4xp(Zk3RRyacYfD#QTA*m8q)P}1wUbK#{ zJ5qPzb-p6%x|gEb1ov%LE4Bh0CXmSnCbv<7sdte&OCjL1R|w?XQhO6$k9=uiz%r-IjdY+u(MWhu08d*mv+V^K>=O1Ct%X>+QG2 zf7l|1GX$0_0Sb!qGqO32)0FC_9I@V}j#-U;WdXXdW^hW@sl2abN=EnEQ;qJ0AH1@! zaVt?sFj>T4jbt*|=R!d#TtHX<`KoG%UDh6=d3=^w(}s7T*xDUs8Zm#n+Y7H$H4epr z%5Db8WdZMd6PIv{bs)nj<67Td-{c+48t3Q5g%OxC2bZ zl_8mj5k4DpZebx*J{Zc3AjMKySZ7U=PhXiKCS;6YW+;}G95{m&fspc+*|f+1S__nb zzFi`d{Jo!m7}7@C!z=5*tJ=3gnr^wuEp$ZhDYD8o&668n?kKH1I?N$*;izZIN@)+O zqzG(s9<&+H)V{J355=qv-LraJ!4b1L|MpTc;vML&1M?0XYa3%DYrx;S%ZT-t(x>Ujy>WEl!!{2Sdd zaa=k>M>^NY#c)nEalwp)tL#6uas1B;&v_t> z7Ee1=A%6~wObf-|XaFj0DI1dHw48zQAKT9_*Tk`Du~R86|2N+}B9^j$lPR1I%t7IuLYM8gTKp1!i(fLRU$ zw%!INP-;mxr-$GDmN;L#-ikopZj>Id!Vnh%guVVs_Wr><{*TP^ISK{c?@HlV{SUPT!>Hiw-u#$~>Gx<~pmY zy}%={dFN3|nKU0VK3ZdBQl>_!j}z#EP&U;ZB7uaimrnZ_B-uZ^j~S|(DxbP~E)dT^ z66dsLpBW*F+47qeuJmY-aJU$|oU3!utXqlJwd`lN(64eVh!cfu zc|98y%JVX9QjB;HhlOa<`#|Y+Pt1}%(+qRRci-KvJ%0D2CLCVRt7atul4X==a6#)> zm-29!3&rYIRL10^>EDiT9d7O4*ZU@OQob+MT(rlGryd^x2gp$$wK=>>KeVo$tg@Zm zRdFtrp;N1Iz6phMYf3}Dmf#|(THU7-+w6uF`Y8Mfwt!XHL>eFBrz?;U%RzGXk^7DS zUU83c1DQyCqsp34ZwBQFg$nahZwq59$=RtMb2^E z;y~%eAmhXz%ZLm6K*bSSqfoaOHvBEZaOwFEJcqpyMA7w1Y>hVedOg6Hyrt%kJXZkm z?a+og`4xH@*>5Llt$(1iBRuf7PiT!<@aE4kCnS`FhNrrb6hWU{8LhGvl?)Z07uNh+ zJzU~sb%ueaXYKG?z*z2{P$p|g^~fFrk1iAFoMrW=zm%M@iX zC`hK@nBY{oWaq41=XQa6rd}o{ci8_qz*&!s&W;NDJYTx{&>VQU!ZgDw;%r>^@2_pN zD4ddS{^@G+)6E`(3GJE@&`hekN)Q^Ba36Coa{kA=8aGI{|Ie3~f|Z@J)7R!Y|AVUx zg|!fY01D{Pt`Z7u)q@JN{oc|0jAXv@!{bZ^5Wi(QC@RfyOaqiOtkylITzgl zzG_oq!f_sNB-0{&3R4`v5#yE&C2P*0L@e4<-J^=WN5oIMEUqNbKBumtoShs+c`i)N zd)TRn2OLv35*h&vFT*FUhvC?`I;O&>2JPspv$`Yd%0Y+Y&w`llrE8>jcs{Md?Dud7 z(48}~;?Ue5H4X(!vd3LmaS)ud=_>Du<$RfEH`#gu8`3EU7m@eVi;#RMLbMX0fXSQI zA>_N#BhgN`O5@zg4btc|;H0llm_r8;%VHz#qR9k- za-0#p4rcf2{XciS8Roa><>>fR9c%g^a~FK42e%d6uL@q9w_+ZjsJ_85Nnh?7%oC+r7@3asw=AAJyz z?~meCvYye$@5^30YI%Rya%KDwa=JRh=pez<0FW=9DJYrhKM9&`x~q(^huSWRPX)}PMBHDlHnY2f1udt?gfF7!fI z<@{ifFXA*S&uMc(*Xfe^DivAp1?J}sgrYh0C4b@&5wFG8U%E(YzvTF%80!kM;Ho$! z4YjFUe7O`Xq-e7OBk6+Fs1r*-|h$tNz zp8IW`c47Sg?w1HsoJQcx6X=;Co?dd7Y*$dt2=KSizD(?)p=)lf3UySvK1&dvrSm!n z7)8H#HFYU|p4oIKD4o*$Qt}n2U6wAuS`2qrA1UzH}0bM8qL!b&T0 z`_I6DvtSR;WvbQeN^3wnO%}b)&_y(q_Qnag=+IVx>qgj2&(uj)oA6z5k8T8nPzG`b zuO-je%LBR8&31B2q2DoAg_ZF&r*|=5^6&hP4;TMXRN?{S`a4O&MPWTgsFJE`S@&2N zquMQZAOPiD<@TTxO*#P}=Jp*yf_`q$b12K$s>ZHEixD56$84+>=5M!@@Mi@VN#~qA zk}N7ymaN1SVUE681hKE}ZE2WA7QyyL{Qtq{U}IqX-}xMz|35wl8w1P#mCw;>>`*p? zMu)S7{3OZL_#d1jm%P^X#l!3GXUp;SWE#CK}BgPJs<%}!g{a-hGu4GrY1m&POL2eS%4-1WM*!2W~zXW z9_0R0eyIN8-C2}(dYRehKQMzcv(w{8cm`*3Z|#7bjH-n8pl&JwnGiu$5Cao)sD#vS z@}1d{%&&Y4W@Pd$e^qg4hmU*{<7fVfcmKt|ZaKWa#PfrU41h8LWb}Z>Owf6_xC8xe z$&Jh{;PpRaHdoj8`YU{a*}r{Yh2J4U)c)n^?|ch&Y-~?rZDxSdh@RTu>gY^lf!W>V z=?S<38+&V$w>=7C?Sj~|Kl|;!*aRoW&v0-;?r8rEpi zC_h_uhOha)iOkHPotwYpd)N4UzZ;6m-rU%8e_hA?rr+LzV6vwFbsWiN{jv7;04R z`lFZ9Sl=DWj*ARN78n~G1~o7`FaU9AZ2J85-_L62;>_IW_|CrfxB966y%S?%eqvw_ z)YffcKY(nMvW296L#EED3@FLWWKt>CGy>AiyY5{T1clSc!otxx+^sx3?I1>w`S0y? zqhlkz!_Vo!*iSDqqFyUX%AkiP+sF*A(r=NDHu=;lUE|g)4;5gZ1sV zzi*+!+`0nlir2gx7NC0nt_J|z%{@6^XjndQ(ShFzUG5;5N++3>AMH3DvvvwaWM?S zCz!mCBoj+D;-5!O+>|sNPt&L+1|7;F8{h=NrsSoaXkKP-^M+JW2AyxnsnNY z1tXc?PCEhF=-`9EiYL!wR>6h}Fwd0<4F`?h- z4gmze3YETBQlEn*rf9Gt$e&V0vsTcB0Np-i?1FtS_mVlIIIT{*Nn$~5ToHd|Ra?HH zyD8JeW>`7z_r{~U=BEb)=3(Tke=w45G+tsM-v9Dws|NB|TOmp`n46r(tB%c>2?Wy6 z*zl4p{b!XTxRVUCtrjO^82z1juheScedJE4VXkv7=bRklHT8mFQOFyy{lG;{aATw% zmRX#WUAp#6Yx{57Z9|gLVRxhaCUMXw7j3B5o@8!<*Od|f*>6dc=!j_t1#^cgg99wm z<}l+|`aXL`5>&E6b%)w=o5^KyX7>rmqS{L^>AP50sn7oX)^GaREXqe;MuVEzYbBs) z4ml&TY=8(CxtwIUHT<@ukZVyt6uuXevG(#d;Twn!acOSp_ZVOVTTk08vXChk6iVN6RXQ)bJgu!1>F*aW;mG8C3e`=4N z0qQ8gVC(E>_K3)1Q6C`#nLE{I^{hOrSOv$&_KkgjBt)=MwiqTMdjsh=&#b9Wkua}5 zJ8SD>gzo?aH&KmC5S1yr51O9-8F5qlqd24)%Y(0nygo9UYr_EpNLq?xcltj8XSgq< zwIWqP)^ZTb!FDI!N@@zCjxi&Os^6??en!=K!wIi{Ko4)&NdwB>yngUFBX6jAH+K6_ zADAv{Vp_8D@+Y^NeXql1hkTG1bjM#)&AHt0R~SjbfTpSff-0>V;te}3{PlnxrU;|W zgI3p2R!R$17wD4be6#h;`B_^OYRW-#n(Mo)LTFMmQTwPbkk{fWp1wNSTU)* z)8RGGDVI~gevp4R0dDmeXer$#PFg)?-o6gFj`zPg4%6I@=5CVuE0!8K4OLp7c04-C z^#6g7YOd-$GS#J2$)<=rgpOUho)M>)!P$>`?7`d#&l;xg{;l$wyQlw(Sn>0`gOSTj zOGIq##b%X=ut*0f8jmrJec3p=wa-yqoxd*i!pR6Z;^W;dll0=;^(Ok*vsoR&w;(3@ zb;V(|6@c9j*Yi|(6>Wl}xSI05<|2S7II;k*#(4Vtr;nrnwVLJ-Zy>zEykU&GJjV`s zTr?G~MG!TF`>nj=ASyo=R>oP7YAY=jSkIJp>j@hgFVc!v_9*9V4B=68T$EQdQa=d zyr9QsaTFEn#^!@SkRXFpwI9X`5ICN{Iq?mh10 z`>p~YR(GI78}E9C_W(@xpY_s6S_rJ#oE~X>k>=C`RweynNUDUthTjeczR96*^_jv1 z`L`wym}0Jz3Tz)C&Jy>|S{srOE`aE(mAKP_R@pie0Hv3BRt8xZ$f+srNi&izUnh$L z9D{m~aKOXHM7yMb8C~h~DDA!qUA!2cws&;JczlS3WHzS=)+BF{z|khLfqSsF?i^1wIw~_hu^rw(lzf z$}!PM-fJP$bCP~#I379aIxSqSEp_MeV;NwSC`NY4xXDeC63FJN0)X5g3^Y*b8d4P7AZL$az`BR4=e_BViX{xX|kaJqCo`Iq6y(U)~=N1@s}A-#ci&qDYL zkG=W{5k_!ZBCpdpeQ+kK+4%akzOMJT*=?DKkdu2I`+bXP+M`3_GZm2fKK9$cP}+ZT zmA6-0P@yPW4ESZ@AWrH_0yi4k{MQ~Iu#!b^hNXx3< z9D2zz?bU`!Gp-vxvc|YE17hb3ko$vN59ZputN9Czv;G`d5^TO4g0W^IBFv%RZ;0X7 zGB3HC5=@I$`7}N9;|~DoeKE^3^hB+E_@?Q`!B4V%?l@_^{toHZr5Ofr<08r?7{xZK zyy~kjl;99de<$qq@UC}K;V6E|24-Pi3it;X{5y{uO=>(;gzHDxIWNpQeFZA*FEJBN z+yix(E1407KxyS|7)SPcR&13Avh->aXuLN}hTyaUCI1nro0vR&vYx*t*tgn7DdJ2F ztLdhLiQVBgahuidLE7cGMPj=g&m*Ingg-ad7R1tQ|+HCfkW6 z-%0RqU@O)RNdErTzyf3ShX2|oRvX7Tb?G#+aA~x;2w_<*#sP^pGjL~Z5;!>BMR1i1 zZL>>d>1jwFecZ#61{N>l(p;QujQHruM~-MhO3n|PhI><9SHOT^*#lMsi^K7fbCF-! z2`!J0ut9GHIrLG=QW4AtKNG#Y0QcX9AumEIu9Ek? z2cnqK7m8DbdhCsop(m6JE8h{3YjSmvU0}?THtWfI|tLP6ja{b_nW zV*ycX(|LkVyDAgS!VX%-!8~_;NuV{qDi#^B^UoG1ly3WZ>Dtjs;|KCyk|4q5nGU4w z482;fa0#j~jDFd{L!utIKtXfh$Iw#`+B5iFw@7yYtEF@{nP8jh#0 zP&`X|3`rKZPg8|iT7q(c^3?U2Sdfr@!)F&4#w}Al@+B{R`7#phWYdHq@s;cwQK=xI z{MPk1aC#A@=cdjBtHx}DDiq|rJan;kT%-gwqpC{NcFI^iLZL8_{5L1ru6UZ;BLSkN zJwg>RYiO{|%={ycw(4%4b;cKcEgogT zU;=$ulSKSO!k0rFvEQgKV!n&20B8TcaN%y+yTEMQUc|#)ocoVsX*kd-H85iP%L&?| ze^U`dX$^U3;3-{NwJ-$GQ`?|81p1jE@!Qs7MjKYW+*SI`{dELx2UxX2{?qhmD{R4} zO`J<(`-K-<;{~ceQi4l85FTE{3p@9);;k{vFu#g3(tddWnm3KpuX#s8x>0gVqBi~} zCS3r$v1*Q(Ys^DPb?6Cgfi&JGmVp3%x*W9@o@j;;7pL|(BUUybwc=% z9qW=IOQ0~RRi7GDG3QbevxzS_P#KPR+rK`GB!S5#Y?aC70A@V4B1yewF*yX z1Wfp2WEPlEI#P1zo{k+**?tbW1V(Mj(&>j4*HJEU%xF`d}lJw@SAcISN zEh61kH@{N>f8Atr9b`1C$1RO-+YIiNTs1x6rrj8lMrLR{Ln*3TLJJ4$1W~*tyHNkX z3nPy``;I+53+-VFOO|oCKG>fT?FEz4DqjZhF=YS z;0-c00YHOTt(~1St~4y)rwO4tSrL#>Yw19?S~+SBSL#l)_E4{*x;gM&4ab(Wpic&Y zK!Ba>h;$KZKUVaM;sDWYutrM!MoSo_@8^aH3t?M}!VXTvAklK~GWSCQOE8|FO2$@p z)W~M5BPde+-RUGnT>xu0{>VRSZ-vOO%7In6REX0$N>@zN(brUpRWviaCZ6wFX z7CO%s>bK=B0lo47h)YW9I-AoIWT7ONtVj(tm9WzKO<2bU}+!d*7P8v8p95$cGluyARq%`mp8>s_tDH zz{>hKtO^47**hMoxoCehhK4?1@dq%)Tf#+L4P%g?Fs8?22GphsF|!{mM!r|+kG z*%aD%R51#}sx(QEnkWcqTvJeeC2E0d*;Y;-I6HUr(W38O_f`u(SXX=0+wHmcB9Q~k z8ejrDRcALXPdj4aeLv@t7O-dI{MVAwyatoXn)8k&W{wJWa$DY6MJEOXj_i?L8CnN~ z1U)4gLR6HbQF1(I>XXB)UxT-r?BsmUIYR%%H=AvQXZQ@ZUeYA{g4zusyGhBx%Th-pa zax&fwXk+B}3|#V;YE~%TJwlcBpD^2t#L-Pfox7_s3cauqvy#nq*xt;uoc~PJ^{Uf{ zFonpcI_qbiJ;g*tUv4E=-c>?)k>P33f5-sBTPuFKdO*V8_n-9uPY5gWEo)x$$B5r_ zp*~d+-lVZPe&VvTlGK6VxAjCve~0=9kR%O{oxZ#F-ov=Nz953MI#Me|@Fb%=&V1i|aKGR@^WlGh?^L%FZbFie-5tsKb%@;DLxnbbS+0TDQr9y=sc7M+v z5m|3PO>DX9D`KlcAFyWaVwSZ_79XyH^W~}AqG^pu?ee4`bnp$TlndVGQ@c#qH?P=c zdS=xdoygNcT4rLd{-BFPP7)+F^?0z}u|X>zg(!6Dewx%!#b|gwRp|U8X~iTd&XCF{6wP^Ay$7IY~hwrPabpZc%TPm6{j49bP?_ zr#J%0BbN*uHXsVx)FYx2CAJiKYx-0OmBCxcQV$e9-Kzt3%&AtRp2+!4 z@xx+lE>~aBAss-E=`{lVm5y^M3DTRaa3V=M__x9^Tk38=O~5Eq97C{eQG5GrJh)KL zTMx34$jB1$#+;DsM6L(^q#lRYUMPNgR(48V?w{3ii+l2ZiiBrw-g8}1(d38iFeKs~ z^Hq*llhTNjC_kqS)TfLXCJAakK2ooZ*N_@kO&2$`jA{`uiL?zS_^^dj>B)~t+ZGjb z3l`~up9>XIkD7a+;6e11`p?Gv9Xu$v!G#+M%%aAxDT_lo>?o(!8G^Z53lZ3*bEy}Se-BAo4|iplsp8XCD2ahY#iRWP3;xdftz2T5g!zq$WT_IYf*L4 z)9y$>&Lsf0;B;~aUZ9{V;;691(UTFxxg`pP+SLaeSI9f` zG2c>^`pU}}XZjaj`@z)J_JH8LH;N|&aU&M2T_OR1&C_>eY^1KWbQy5rIixlFco{W& zb5V?wn+CO|V7}9u35F`|nmWPmy)hHBdx%Fy2%R6Tq;XU66l6JEJ{Hxzbs=X{o`$&-PE));p^cU)I>rh{c_f0}T5pk= zMM*$Jw;UGG)w3fhYLtUr<|}0t>5EQD%Nd0;Cr{g7XeD4e{Pguoea9>ndx70xT^^6= zYF~2TQoyKjfYL1uqDSPSqsOB+ zK_$FVtqYi zH}!BND;>#N$rdHuDawd1=>ig_vJ#7zS)u(m_EtfKFYo*=f;*{m5<1$5l^bKe206^k&91Na6p|JU-vKGr-%(UTqM|Fc z3x>eUrhaegbvUXHR%d*%3|EYA*Uzn<2O8G3Ut2luJvUFnM7<4D2_gnaYZaqjL&-@; z_Shr38@F=-zK~qfxfKzN2e}$>&FpVJeH_<%+~aZ!vD1;c)`#T__j}4`6USDqa|2U;W!h1l?fj4&(16k_@ zXZ0h%k>3U*3Bs$c%!dynr8I{x3+a+%P{B&?7WwdZHMl6Fru^C8sk#pe|FR|&vbm8) zT+=&|3%R=$?u8g&fw1i>Mc~c5XRrKgRXrWg}PrEv(y3#uD_5I1qnt@b1!12!>q!W$-M<%x!a-!=;2%+y@%_2$!ZH890 zvbUD=&^OZT5$0+-c^E-_d!34Gs(;2Q>GjFe66`_FaX}dGZok&|zVDW==kn9eXFy7Z zs(Bbwk_F(e-ab-vnW1SO-Zv9)Uf*PpK;Djy8L~RO_)u+q?gLrp6G;Wny88Lurt5DA zv$Dd{;4=0BN5H~bzNh9u+pS5^X5qY}^P%KTIO!R%O)u+JHCRB<9}@3C5+f3>p|0u{ zqZy;~b0q5qpNRAIX_4pgIr~iO@X!3#ERIbevraqIR)`HcepE5;JyNtV-_R?yXQc|z z6yeqS*9E`07>va83)!GHN|%Z9ax2j8DZ_1+0uBj7VMOp((Pfb~SO|TlSvV`FV#@v4 zSmQ-8{c!%)RlyamaP9J(uX}C~Yez9Dnb;DWRp1T2>y28rL`438G@*EvbOfMnM;M`r z`g|ZTQJQ;iQGI-<;^i*o6#Pi@kcFG^{q`okKH^TBuNh9fz5S@_zS_%O*0(>JfRV0a zC;lL+2(il(J490+AZL@X*@a_%GJUx1GW|#>R&2@u0?bKA{1ba=XQT8X!7*-w)B0mF;AC zo<#O^AySy6z9y-`zin;rHpYF0{0?g5_TO6O{u=ls?ESkG*q{hLq%jo3q0vuTli=rm z-{z`c`B2j{65#HOdlP#se5Mzw-7uv9L{Ww01qa&C%88g(0x{e!tK|g=#533+&MQmR zr;^DLP%2dk_NLP@IY~BlZqelY>P53;5hEj7g~791zSSYaw@*LOt+cE3)OE1KCJin7 zW6YPiZz++5nlpxgD7`2(J1NAiZ>X=7vup& zW;|Op?(jE-g(q^o#F0Tt*1b*^^eM^Ctg43eRTp1`mY;U#i{*XVPmtT z`l{atB;rhv7tzzvT1Y>-F}Fe5UuGvKdnx8Lb=~Jt3O4TdSV`Mz3wFlRlQ-C&IrMgz z?fXE{C?4TLQVTj7ju+rM#%aG|4?JAr2nQqO_3fLTzFLrbkD4#D`Ny-gO@fuwXu~wS zV^k1w5<9HKiQr-Wa1vwALMg+1_WV2HiMm=ElG;HQG1i3v4FbHTX=l&9vT; zQmjux$fJ?2iyRFhN~9h8kIHq$9+aWreGn94=e@=n+^3EpY4Lt@rw!ob(7d%(UMSxd zr1(P;WC~oItcKJxPu4XZrpe6grrfr*A49Y#Hj85jMd+w%_Cw;8{k9#hME;RnAx6xk z*%rvgajGAq3IwjQw7;GLk8WyFB?CF+XH`h}bIScyFa9}nqZ3DPIM)K}DE&~b6qoO4 z`(}Rwks7_h4-C7--np@#FZEC9zDl;+t<+q*iax~0P$SW7^ivIjmhJZMQ41whqjW^7 z#_(b(MZ$D2G0H$f6Cllh?j^i;N=rC?>>;&5+$V3$qOsnoJBw#3gDMSwQ}#b+nDCiJ z49uy7(@Gx9!CS$Flr94QE5i71iR(G~Xb)IXVUWFPO(@hbsv5 zU4-W1&E@9Q)%YG3gle#za93iu#B#qYryl8zOn8cdvr&8pa0U^b8X2fv5|1V)OjaXCri#z9!>;&4mb2L-dk|^ zf~aUJ4jMt0PkTtgKT3X$LCvH1%V8z#8>ihl<)fe_FMg!j5Bjzn?3Ru zUN@HEFvtLZY~AbxI#C;B^`&jb(5JwKKRY*fD}-YaCl0d?JJ8F-&E{J>#|dx;C4U zs~VE}HJAiPF&0hijkSpcS{(i(49fhVS5#M=?mafv-#4kEbE~=6VADY5o#pUM?ch+{ zRY#v@%W<1XL!5hfy`P)*nuL}1805Eq`)+$b1StaFpH9^pwHKrNga5X#NqBYlGZuDGP@=n=@S@w}bf!mx&8h?|RN z==OiHQx6JS2=2!{#YzrswW52OS8_#9M;jYb>>-g zMkNM}%b2Yy25$mnbcRsEoVcl=^B+s)-T4}xVTb2J063yZD%Qo0tQ1~ z-1GzmaV!yi#B|927^xDy6}l&>XN6(Lf(tDeer!o557odfSGA4<`MP`vk|+|+&%$`+ zMP*KRz$JYuKbdLG9Z#c32FZu2Z_R1A7Jr7(2fGs%okeN)gboA*gQlOK61H<$D;0b-Bryg_ zw(xT<3<|ZlHgP9Fi#XN;#|Cp1naN}QbL3-Mj#*0f9q8Zr**+hcks+5cDJCjkzApYl zuGcRA!>UF(NVN|P!$Sx&xWWajmg*yx`#M`_EmZT!y2rjkS9LLTL@}TL+3fV&L2cP( zL*Ps`wjDQit1-8CrW{Nz0FKzAx}2ZxOr5V&ZAh zEo;>|Z6Y&fLggMlAmmd6`LAzw7EPey)onrvf(unp4?XI? zIHSNceU3vEDgdlP9xSCrVUdmRD4Cy3F)Q^jcf%RG|%8*VSACbtEEfXeTTnK5aZf;N#YN(zC7s2{)QQI&)@?|Oz{X8 z{)aDzl6g=%UT{?Le{%W}fQuVZ->gcKtWk+Yn-o$Eb^paNRjC>VlDutwwV#!5h1$GT z91M|Nd{Bq==3q(ocy3cgDd63Te_!!&imBT^+v{(i*|aZl*%(|>##!ZDO*hJFu%21a zoGuq8QW$C-G?`*A?g=G}y38AkWMWBV*DPrzS^i?KmV1jrO}UJl?Fl00xAt>cvg}(%Y8}Qwb<`yJKK9P_U!taa>f6_?u)6eorx;bWWU_c47U`>qz{tZ8RD!xr1mGWXlQ6 zTtLH027dS|%MX^>YEdG;U6NyPtuUdI?k8%1sw{D}dYcL3g{vu&*O%H2=#_V&cQHmR zz2BcxiCEJY!yh$>q_7R--v+({Z@FM7+vbDs!j^atd=n?AX1GPPwpw@|c69}V2m~;> zBS7q*qb5=f+Wx_>>`;RhdK!(KhP<`q-_ggp1$qRqqDErN%{p|x381jC-|H?BkB0aS zssfwC?&K!(6`5ZwC%hD8HU$M^?ni_M1%eXxny};#*@Lc3z;L8~d^zW^r`DV}IgI^Z zRormL6rC_}2rq*r`F`MsHyA2WUA2`#eYsfe^zY>?KUi;;T5+itv`$F!)Eht4S^7@` zxEqA#_Xbw*`-G=?K~eS=p_5y+Pqazwy8PmrQ}Mpp8DRqU*89)wo4DJ^qX!6fL$&oyT!0&ewT$ARZY169`4R!BRm^f zdL6k0wvUMnMA*3NjbJGOXXtdP{I0;KZ>1R+oZ<3+)rebS5Ps^7C?6)BY?9yPZ}>m$ z-(}*#?fB)3PJp9a)&dc_EF6Xmy|8o<$5m=$u(Q;ja5o8G=mc51taWz*87{WIX_1%x zj=7KRa9S@cpMD7i+@rrRJ`miQ&97zRY(JNae1N~puwH-StC(UD7S~OS}uvZ!7l}0PogSBfLX0sQeQnJ4b0HMza?L}Xn~ZaYFc8! zaJ8@!(=aElistq?C@`J3v&rAF?LRkRztj}U;ooBC;tTMP>DaS~!DuSS{|VY^e4KZB zsao2uYZowhguNU8!`L|l3Bv<`b#2?WZQHhO+cv+oZQHhO+qQT6w=u82@7t1A;!7lXj`g;fu36hYE?t(?V1C z3KAr;@zO-JQ-UU@?=Yydpf=!XyHJs^W4!p_P8EX=c;1y31j*%Ez-VS9?DQ2<8c#f3I&ODkB4z80LA!dUQ><@upNMmk6(sh&}-hh z-l!5?EvR2GIuc1H>2XNW)ZoGH>ywagkTGn+Mq9^;Lad!C^6<~Ec*z454J_h9ok`+w zp!^yP-}K00;fw3tO?#Hm$Y_eB3QAO+3}HWYXK6)ng}vb6my*io>>)M$uf&&jiI66( zI&09#=*;c7MJNa{73tl9Szx`!-{?ql{JEE>K4YG(s$7)-n?&HD^>BhlapZ*e>>S|`;< zw%C$wzY~v=THtm3z#TQ|)xf?1_sk2|D)nL;CbyOx7?MaNE%2RN+C6JueUOK%?w9d4 zx*0#7Q}H?}$>aCF){bKPO`%ANe`bmiz%C=kOXC)h2q!$M^tFpdlg;;LJ#jY->|z{S zv_|?4Q!zZa$5On;sK|(_(Ecv_`50Yp82%~o{?)T9EwxSin1&l;rABaxNgLmxP1i;} zAC9{4QeHhnHKil|C+$JCX9Ou3eg&=|^jvDGYyBbQjO*g}#`R*c&43|YR_5_l z8AQe}_$n#@PsNq-(YOQ8}+K~1--@vGPUm3{&DxM_Oo%Yp&NH%9t+1b#3 z$>v}5BD+SD=YLx>*2@aE=+KAWvF>_0bnwFj2HIj)*0`aJVc;?ilu-JzjX=zRuIV+? zDB9l3q@yDw*t#eDiMWvzca~TK{9Xxc(x$ue{sRzS=A-`IXfTCqPSYb}GoomLJqaxj z5AolU(0F!2<{Bb?1_HiCQm?NxW`E!Fx-U-n>;~4HE$oWB9H`lhNGtp|YiWI=eieEL z=a^e%?=*%_ER7W6G|A4e6K?Atl#EOF#98X`T8>2Q=*JEj+>$Z%5bS6rvC^5T4eJ(E zHNHugbVXm22**S3Cl0wRt2j zmqT_Wau1hI09DJ>G%uzbqxy+5nt~BvDC-qH%!hn?q_!?rM3~Vn+~d`l;z8F62jnj- zi7$f>2T&fU)l{f%YXhhG)8B`CjL1>KLI1c{vmbHQ3p)Kd!zt=`lR_zW^EG zQaS~x;yM(`sjFi6B*O^XCs4KcM$Zja2&hSph*2ryUQx+!$qLzW>0(QUv;5x%G;&@LA>KRv4?iI|7Anc<`Z-S$!(h!P*XsHD$73lvO9uvchcW zEDbQf1t3#Olo!mtC68@P3k_i<1`zfaAR@ajpG>vCmbPGPhj0VsIM%R0MCi`)Q?$y7 z&6D*7do(A#aH1>n0$s)jrEs@?`$)ac^UEjo(uTEesMewho z9IK5d<>NJ3Q_gUc7SrCxs9XyhU)Ow8$IrS9|AD&_hcjpVBI$U_fDOQXs_CsV-}Ndn zSfZETn3=RYd0V7KkugX@gja!vC}(osUSy*UO8T*N4WEKndjXIo1v6mX-7 z9nthFd3jGQq@=`@sz#5w$YTMAjwVrN{I}PgRTYW&cqg0C<1wYQVF zPANy8&cKZdB-C1ObRz;8EOsvyr-=R*(l;VjI0|L1`qbv7bM7PnH8zBG)UYxl$G+XD zkP~?~Vaju(y|R*PNM{`3^HlWC%g@JpT9F5Q9<^yFDFR~Z6co+IeVR{4adskrl9F{O zti?0xrMtE3SBiPJ4n~epKy|ssy-mifYc42vi&kZfo4-5%^TcidoQfy_VU#E^U)!+} zpS?12E>{y@UdofB(LP9b>Z+*pkcDnHN@Hc~@`A2wf|yJ{N+C?kDyq9k%O z@CwG*V5)j6_3mvo*dWF+NTIAi0z<}~oSl09E=);W!jDc7i=uZL!16Z;y9vFWYNKpt z#`bkK>`gdj4wH>OF0*Z0GmsH8Xh==()X1Kb$)Ud?S|+d{%>wp<}lm#9)ow-U&C zcXG_QLFkjy;B02I`f8G&)pezr*+{?TLQ>FwEiLV8ESx>TQTIn)^eTJ7 z3uov?h2ZF!tyx}MHT*fUic$&C*(8hd{Dfp*v8qso(z~yu>NWc&V0XqtEbJRmcPx+c!bm z_$ZIwTN|6|crf2;WlFV$6*+X?6vhW4rzXZUnT94{(>T%Vg14f9(IW~^*~t@QIx8-(#WdKEaeAzl*F&ACxo*A~HfyR8@bdc$iSD#hkPZ!9U9 zc6Bj7>$Rvm1YLB7ou=ib>ikGqBkc(A*J_k`gKXR~S|@U`M;Y0BQj z06M~ND61`Zr5dTK!k=lko-T#*n(z-jQ9#1aVe(hZT&DuKX&E^hpdiQ$GdS}_e)zH# zw+ql%DMSB;)p^p_lWNgb}d(JQca zou_YO-&4J$PIl$f_aJp_uvde(eaW!+gv{C`!PNisJaLU^Q5?_xnndu(Kz4KwBWpY@ zT_3yRtZ`PyTenHdA#^bt*=2p+0&5ay!A`;Jz2-5h7jj54=;d1FHZ+MZH>d|^7o>wO z4aO!umM|jAuTHf@Ub89R_Zc~TF#>MQb{%Mihzg*D(F@5=Su$6p9R_j%;VN3DS92KT zo5;bUj5vm7f0Y{87#0X$&&%(;vDC^C`~V_2qKr494CMs0h8*xhfoq#L)u*JBKEwqC z%E_-jSSV{iEk22I)@JvCtn50s`46=cF}9s)ODC#}5bz>gy>1TV$M%cl$>k11WjT+N zNvA}2kFR0S)2j%&9;w#XXfDvenB;w?a25mazZW?CSAqV!c z6Anzs(%fupu6dfD?uY((TufjmKUzS=K7>zc+O-pU9KiA;QQpXSKR!7oT0q;5D3`hh@aB`n?PMw#qUw_3+b9aL zS~!s^$L0e5RMpp}Pr=3)BKch8rRvsvZ3=1Z!||5Ya^xw*Ku(MdVp~l7O&d*frRe0@ zkmZiIny85Ja31}WL8R5`OW!rQ7Z_n1$)=XSZuhwBLlbIoiU4-iCT6{QEYgl&Am(z% z6D$*AX>z9bD_bbZQCjw4`@L>|f1pt9Q=(X21ajC$cC9>P+-W*zINS7ruuB9uMs zsP9hf^JNgd0jr)?2;Q8H&_(Iy9{544dIs+m5$425JCL(IaM0%=R^bx=OG7In`>*FD z(_8;;VYI9XVi~LPw~K_F99x5#jNOrLtRgKacld`$d@^v zig27e@q010xNF6P%4>*jnwGyT%U+_pF1HeY-sx(ehMl|M<RScWmrF(R~^+M!@5k~;u!#uA{L!3ROAw!IcO)RwCZyysbU(8I4!upDO$k^m#!$^b4iVM7&~# zX_D8ABr$v+2?G2ps6sgBGkDf4I@+B+Mr;gzRask#u1DgPR(n#{8|ONE?$=4v=vfF( z-YH10X+JAOl3guwfzvYhJ#;nfmq|2Z9UwMVy?BnEz<0PEtaMMTjiZceO{SO~@>ZoX z^!)<^1hEyo1(a)2mOC25UBCF*BmEAD$*w?}09yC&?~&NV7JD;pWJ~`|)G|Gj%?)*h zFP&2jxd0h$lfF{N5xXwfUi;MOO6@0ZaG_}xyIY^nv&K>jC}(kFZ&NGa4}Hc$W*d>T zlFGYYXM2ENU4+^5s=GSXw!huhA@<7ZA2^KE9tf+vS07*m$7!> zF!1hjZ#Rt_sjm->8?fIGDbs?)Y`^QAXz!#6FcRN_7Px@9@JtZijzlWUDN#h*&?J{I zg9Anky*rG(W~fPtnNTW_EG7me!@s$XtG!Y8(!O(h$|Iedc@yqYsEof1iNX0Z@)Fj^ z|7m6{r3-?-#$l-jGu3&|f*c&sYuXLI(LDTy?uEYG7<^?N>-*6A=erDM-$=a+Z%kzsE^R!_Zajx(g06Lg4*U&X zgRp!p4+@i(UFhDh=jgZ&6xHqoD15|F%e_LHA$*x}npXJ!`ocW>%G*J(LC}0lGn_Qv zaqz#rQYFm#4`=)3{SI{$YB6T^9HBD8>0UH{)`)a@Rj*m;!LTW1;`W64?Ey7A<+wN1 zxvUkrKa^zn$%Hq`;OH}HUtQvX>>@cS{pndS?9g|^uv`Uyewjt-dLE4wd$+djpbyxu zGaTOlR6?MT@H}Puims)C0bKvD@)YL(mpp}&k(C*WUdGhU+{NO*#s7Osz{$?a^uN?8 z1W@#1mNqV?P6YH~Hij;yBBsXnCZOA+dDY` z1FY>=U~G+!khlM9U~TW{1_{>#ba3u;C_Czm4}9e>)RIkE(N`l9Gn~(e?A6)EOvqGb5}6f+!A8l3sV{BckDKl-CVLb!lu64lafWk7*wmb8W>fBDd6 z*94fR=ddZ6YnTP=WL$QvjsU=FW@6&$A?;Qmo^}u-&%I|s+~{48Z?h(0j{zmblam#V z4?d?s=0#Id(fC-k>Zv~JUk<_48n8gv$f6q74%z1{t*rqiUyyS$JI`91;7Wxu6t5S? zOmcl1F0>t~q2u){xqPyuV{+k-_xpxfJ!?+w2T>y@ob|Al&v*Ch9$QlZ2~Pz%`F{;5 z3Z2lVZ=7?ITBM2^|`u8Q_eD`qZV-a{2^jq@}0WtWx*!mTxwmVYz zRwUj zB}G4In!sXI;5ae`NqblLP>%|@I${IZ`ygGc_ zmwrWngX0rPeAg)qzfAV6K5w5A-Px#dDV(2DdnfkfMr^3t@#l$aqdM7ArUzuXkH!x| zY(|vNzFN!WlOX%q~=cQz-x3q8dAx>sNGX1-iJ1dD8OmiR@e` z_iwf31%M556fbfa(kyN`g3g=m$GO5{;XzuMPO5eZ@=a7@XxuMm1}v*N>$6;1y#pd) z(bS7Ev9T7FHdts=s_6ZLzS>9JtSm&Wl$`}M`b1KEs}`-*pa%6Frm#026j41 z@}Bl1zsMw<eLd&b}i&0I}_zYGqOd#il&a($+m%J=3Ty|Qj zb`42%h9P=UXJL5FnPV3v!58HxYR8o^&C$DaR~0MG_NL?Z$q<<7--DEsGY&}6G}Em) zx~i*?G;}+mFu>@vJ?s1yp~A8QzRaY{L0~75_s_?-nG86D_7L=jpj)7v!ZmBwaDoOP^pw9SsTu&OnGb})LfB*WnXOA*#IPMBd; zmMXWx7A$s=klFSc+y^k&_P7B81AXqRwjIUabDamPlhK}EWcqdG*|Dq~_0^lP z51x04<8sece?A%m)$gmk^rfVloTL=61jcqcZ3p(0(a^JtSse(jJSIE>9Q;bgy^S|m zJfR1)4F-cYwWAfPaz9iFS&$g1nPj9qf5bs7vr9>@liXHEWs*hc=9P}~1+zbLdR!<|MQRI?PX z+bDhd`lgMLsRDvEUX^UX^tZ`bXc(Kw^5o&HYhk>UxY~VqVx}#yf)(2`!7U|J zLW};ZHk|d0Zy}P4inE3O=5uLQJ&HkEvaYbDG$oioMn?qMucNwle#8(6SpGsa=WeTxAKYn$c-A4_x1{QEZkDVA+4r zeUhp|rbD%}ofP8@f04_07V zJy~LO+rpL=C%~reMwkes2-d$F5u*6I-i3F}^0xCEkXn|QF#3@7oD@rscqoH2;+JOv zI?tPF9CYCO(<$L<1w@6E<3J4vqaB0pC2{0gt=~jQgwEu=gLg#_Y^!qzbNbE-2F;qA z(ri4TWX$HTi#o$GlW2K(_Wk86b8(+W9Q#g3T7y>wv4914x-{>S*Y_{tN)~k`sgPit zXDq4#pD_oGe(RlrTz_#-mBkDT%`FP5ZM`Z|JcFK$>JtI%y$qR%q3`gdvnGlaZHqmM zxX`7TZ+J7~$6KZ8mKkrFBaQBz2#hZ}juE1igU(;~uxz%m)W>0= zOECNUee)8hnMxu4NwB;qktqbU^{7jMxIxg0?oKA1)iN(4k=w&%f!S3*R$n~V;LI_f zjHG7$-Hm;mS{=P8dhE7}$Ei5LvDG@@#s( zYA-|==54iwlxZk5YnJ_9k1Xlrex>PhPDz=NWD-YlQD#bj;)99ob@8D=H~IKfG3Y_Xec*9POb|xpLY5 zQHrDmCzPMuk5#FQFn}0FNl_Gk6miMF8lbU`T@DJ+AILO_13uLw5MCbHL~Xwp8Bv^7 zn};ODJ1Kqu?}gwj@HR)$`1i!*J@{R4& z1F<;*US!peq>e%bk}0@mdBUGF=)Jnp7-55V1>H+OVU`5kOzq14n;bqsszU}ed&Bc4 z8%Azw(aVwMD~aE1vqJ|EGBzZ6$1R3RbHz92I%4G_#L9$RLyZoGUgf?~T)m<9gi)dY z+U^i8JI;;r4q0O4+i(zS#2?_`DMd;gj+UI#-+qa^9@z!Wka9j+s+xD*nE3p=Xp#HLgZ@{6phXh4`jzIta5R5?LrPwhQn)zpe0#aO!UF|sH6Tgg{@{HiR- z=^+!9ww^TP9Kd=1A}8weF|0<;_#Z=15|UCcBF5gf=AsT=IOcMWyRniJznIgf-;Can zuebWj2T4{r&MZaiDSKvEqQNDqBb!fWP+8d3c{CK3G2*Mlg$tU};l9p%Z0|l!`2qbw zMBi%;8#Q`dUqu!m~lHS-h^37ea6{}q3K z?t*u1X@Lu(y%;c$=k7B0lrf8oOT#G&BDb&Scf~XO!6e%Bf35A`8lPz#vBB6g`T>vRWl=Hq#b` z%RVB(3jx$DtG~09G@uVnpK$liOrJcK!(Sx7WEr!k--C$KmiiP3N?E$1H5UeVCZ@cL z)I4s+9lb9GRhX;MVWJ4YkGoO$x9J`F9&lnD@5&Uq+L60|jKy156sM+OX}uq+ zp=DHAvMObeGz`87geufy0au<^@!Q9y`CbL0l0fvebh6alFUAi5 zrB0vc-rv->Q-esDB=QNtO<5o$@y}v5?fDKbrIt~R9}oM7?{9-ESh01N6B3&+tMK-7 zrBb3WK*<|!CFH3e^Y%=Ax|(&ot!~*IE>!luu2|_e#}f;^#%{X37qck3HtxFaA?PGo z&TY(6^x&7)fk%mMF(-p^Z3kLXI2~USdkWd7!d`QbOzDmyoEUSlgVdu8bSKTI?{x=t zDMK6~Pv9#@J)`LxwSHO(CGEePLJQ?Obn~Td0F#~#!E+{AA1TOtNnYy3M>rgd!OVjx zT9>QLDYK>vtr`;R5CAqV55KBu4JsLLWZKH~Zx;W1c+H75)HiMb55nz@2L4R*4g*g( zrqFwk)md7TQzvb$4~jL%ex%i7;Zvw*79N9~9nC%-y$S049Ech5Hna&~ihn-o%sfw) zwLn}xLx0cB_)|1_28EpD>&UexTP-i#X$>E5LH1=nzl5_sOB=G~#3Qo!zktD`@R{~K zx;JtdDf;bAz^xzR*kVS<9DkV7ZXpvk>e3CD%2r9ehdqP8oDUfnRWzE+73UemQ~N^N zA#(?S!wh~M0b#|XdkBGThA7xX;?3H$ns4AW_EbSTNo=unjUH7Os3+BgWhUMdS_Zc- zAJ$5Z>!sp%fc9{rW4d3>J?ErCSLN|L&iAIuL+9nAPG6$>zhJRIui|dzdtehj3sIl* z4M~0;^tLgsy04@)C+2ft*>{<`)Ax@|vNfXMPg+||R!Y=x`@Q4=5_-#Kr%}lBg z)cqfpw61%ATxtE+H0vLJ1~uPFy=i zjhv_O)%}**W<1A1LrKN4Mi9)N&33cULj4CIpj8M>-1z~M(jt8FR#<8FCw^^I^kgIN z<&l)C-8)dOd&?e5M**o7mT6W8e8dk(^<^J!$@i(BN97f5?q==Bv4%SdR}FqnLbJ)4 z_9v$4sS0GeO%{{p8K<=N+gMm{5;MW`osHGXgIY>VB5^j1FuBPn1md;$(RAM*wW!r` zHQ7aK+$T>Spshq%O|Vq?z3d^V%%49Q#S!e;pT$~QEG&bH9@xP0gNSJKEB#!j-s%-_ zXS#v7YeH~q2>XDz@=5z9ni{AK@($1x&cA6sR^a&O_#h>Vj7?t^zuJ!g# zZJ=QLCx@(zqgQ zzm6&%BI`#;yb>@T5X3e7#yH@+3eG1-EdwQ*eK$)daUA~ydgPP3eRyigMqmuT*oCFr zQpB~$c@bT%9E+5`oa6wn&F}`n6(CyYQt9n+MtZ`hM{a?A2|SLqG9zTdb3HJvU5c&m zR~(Zfc+bCjIx+=|5LD7M$TEkyTRhGH-QG!CDDmz_s80X2xu4C<7AfMPMkQ$nvl^pQ z=&CKr`9^jLR5X6Y?HFpYL?}z>4vPK7 z6w#QS*HZ=2eumCVG+OJ(3P>S-j;Fzzl1NqzzLQV{>eGW3Gy7ZDtoMpO1PUu?i&j@! zU;F4~62Eb)g7{C>;z{;Jn5K*Tmq|%Ov#cDXIjxUWG>x^@wdD+ZvbJUB${cWFx|>T` z?}GU=^CGdh5BLlA`w&(%;RqeyMW6rD{eS>(6xXhe*s$ms7QY3ZL;C^e&IKb_Jm!6+ z;sciYB#oVA3l|kG@Ls*P_TN!*MHSUhZZlDJ&}~BzFeuV#Z{2FMm!D`tuXsk_N!rcl z{`z>LB!p~+8|9#>W0KH8n$jvAr-Noh%+40vT)k7kc02cV-s{ZsLlCTuW4s<<9zULj zyM9TT1aoa>mfj{I`CzR4XOMDjDDt_ip7Gm^@L(ZjFL68pX99W%vLP#`xtj+b^zv5q zK+#lVj5rhe>@wLjnx-p;=o1Y@E)M4))rh%4e>sdr&RDfg>a1-$Ku(72y{>J>S8{*q zH5h;Tb`9s3glzNEfZt4F@Lg32d~~9~etAA8tfY)`9!JT`P(^-ko;Zt|i;!yfLfrL@ z{2!obQrc)U7JzSw7f-+F;Z%_v1+te4Oe91k-Yl{cSgz0%lNVZzErR!AdFGr(zj>2H z?^YF#9%FwWy)sT+?kv{~ts^M>A_)r=C3CaExNh$Qzjy6{#g#!&4Mn+7=;o1p=J zeTC-CXw=!z_n6&l$>V$T5cg8wOEV-HwZNL+E>A-IO2=DMYy<}r9$D;L>i({bS+pGO z&B}4};k|)6-`!r~pjJ&+7p6GTjH8UJEc_K(hVM-s>i5w^q&RWXflYYF&Y#y8uUq=Q zk#mQBIQaBoOk@bg1xtIV0aXnB}uaC0y%&=0U1h|l2&kcgz3ukmONJ=Cu1Vqqgm;;?ZdLTG{YF$ zusW%YL5xsl!^%S}2DVD0QZt`6gJSqmgS$-oPk@%5?<~4_%AAYO%W*gtlHC(Et%PvJ zBi<^Lm2ZBfIX^7#{o3$1hY!__4Ep3`BIVT<^T?j-s!%@jl~AP#f5=I>%_R$Aq^QP8 z!v0i*M4I#=3K}f2SmIr=VH+j*hpf#bu=L>{6mPc2gvs=@)5*|JI48? zGw*W;_{^D{2T={F(MmVU#hNPx!=MKZIOJ3nIO*&4ZEmZ~6STXz3HJc9Mi}{sV?7?~ zTctve13jVEK&goMU-p9HB|=1*JFQYMa%&zCo`9muoN?#sK6nh@R7JSJ4$9$HZ;E=o z2PtVus)+y~YoO*JmY{URnYqQI_I&;lJ@ffLR87BTXb&z-MGCNl;uq;o`Cl6oc2(p! z&%Tu?cc`?19y*~KiD#4SlD53(xam}{%R6yjVT%y~I_IZ&G& zcu43NjBc5%-}MrLNhm=@)}8~sC44p)2yWctSQKvd#a)2NqucTv&@TX!osaVtRQpbHV%!D24aev_fojhOrjxt)U8c!n?=DOi_DaN?1>j^+t{Zr}Ok`TujEFl!f`9*GW}K~K7xUC%r1NZ(xKx-{RB4YLX?F+P2H*eClSbIJU?Sz742!+7 z#y(#f>()=!ZWgttRU&P*W+~wbOt7KzEaH0VSy}J-q%Ygr0Zs47TrkyR-b5&lKcyO} zLf#kmO%8MS;vC15wrYn)wG8{gXTNUvv5AK-W6vEKC>ZXyj(>yhy#to=x%Q;#awu~A zV)(S5n!cFB^k!{?!L|)qbiEO3p2jr=MmmBiRJ9dYXh)vLLGK+TfLUG2!>=2RDVVRiuU?zJsGAlM zC<#r*3Heb>#f9&N0)kDEZEM{G04tYsH+bA+^db6no<%E<>(HLJ!%KkQ=#l_Tl)rE> zV&@EY#$bZ&Tegy{(vcgWwtk8%G!WC0L{DW`$k8NMaREl5v_$^??;Kf?^UKXLN&_zp zU56tq4zY<#X#^7z1sJ2Oa+AaycwRzxjZK`51qHnq$~ZHxSx418_~1z-ixiixwsL=9 zyl6atynl4wBEE+Bijy~D4gy7}JV-oP_65*<-FEJ0w4g&9nP_A?>T`r7G~^EdF91_%^{&M?9<17PL~(&~iTc16@%oIrIb0}pZA5YSbd zux;hJ8&W;b}WMYsy3{s|FDmS4Zdo zKjkPNX{XlW;t%=@WhsD%qoVl5c5y$wh~Cr?uP8lMk5TNJWP>E>i*Mi=V@$^5Opw$$ zyMCq@9IBN`Sj-^^4|Q~3b#9IA*BXP_o|gn zh_OI+S=~jM)e?d$=!E%nyZ^An(nnBP$FE@g@YwNYj;zyPT70&Ol%!$FWD+!@NH2!7 znT?R4K1^RnXk`0!;&xQR|1}{t1AZ{xtRffU0PEF?e+e*5LDs86a(9%zkHnLnXG(!= zIg6+_lCFhH{ig47GeuUI3^= zfDyl~(V4Hc8e$(0wCTRr=b9SE*UQ-TFT9}zfytFI-H#M@hoe;Cst0r@8c=r-)fxUt z41gF_0MmCzzwF|hKH(Mb6Rqtc%R;7~L~jJPZsU42&LJkKtVvZbtY&aI#7?pkgdXa% zlw9!%4QW}Gz!0lyI2`BoVi*Sr267t>&>hpHvD*AE;Fr|iIZ|{-E@MdBmbN_`No-jt%#{?K$m6b=Wg!D(yh`Fvg1btBcl+OT z`!7$7wDfe+S3=_Iq3^x#5`RaW_pL-tw|k z^)k!T5t!-ln*l)ivT+~$CuwaLR-;NH=(~~cb}A$;d*&(d%oG~fQ{3wXfZpfHOFMzD zb+!6@q3>xUeZxM6w%Rn0kF-n{Ecc&3fI$9epl@IEPnR# zZ0jB@cuTQolsHn)4#J88@KaWGLTYQ&!I__euFUJzGXIk7eCy}G^fU8|ccaTY1Osad z?2r+5^D|e4w>*)~B$gO#ha>?I{1zVV2z(J2>LjgzYOBDovwOdp2#`{e-|-1eRCe&P z_>;+ZJsu@iZ6z*XCeYRHUYI%)2-NAeKL4OX(%73iM}&|SpG=rxp; zGWv?MmO2lDjy)Gh&HYA5F_O*V(fpY_e zr-qo_POP?tLMk7JQUmc`BvLXBI$qN6oq0RNJP(=Z2=ZN$|QNB+eK+1;gU~jKWD4(6zO}a(Xswt5z^6De;B~>>G zF%W8X)2?Gk^?QogUwRaw^~AQE<#pZ!Y5NIv7K87+MTLxxO=s&3V9UZ1a}h)7vlDY? z{x#Xdrq!+x4zTwXQJF}3MgpN9UcN^T5MGg0u@uUCy)BD2!s^!bJS$-t9_16BEBtiq zs}%B|wnSm-#;-|zA{t?C;7|r!1+b)QpAAcWcL14?J=p>Z#R$ssm+9K&M~eILS~^U) z>6niQ>jN{sfpQ3lx~K5!4iJsnE10v&CB7*8Ib*-Lr^iqjIOmYBv0tXusTTX`jgaT` z=3֍(6pr8QjpG2InNz)9UD=j*Auo_CD>s^FbN%r=I>-$5<#Qniwy1T=&uIQ;^ zJjWo{|H^6UZgD(vy~}O4h!3}RjGw1wD7fciu@{-(Zxu!lccHwKIM(lE-K;6wT!Ho2 zQ&`O*8R}D{=8Pp1y>}KyK94bPxo-1$^I)gVg2-CW(HvIR<8IX)d_{67SeOwov&Z7yDc`{xY%ro?eX3H2cvyf_Imxw#Hd|nqAdg z8NwSE855ZshgCpSPc=3>IR;@^Z0b)+h~xl@%@%ZPEfkv-unPd2N680j24`RdPRGQ| z*q;C(a(l&#BXEW`2PlDD;TH|)Y)POT2RnvPXlrV92F=g_@X*!O1=Y>bImgv~zxcyb z0t5p5&n6InIgSN^ps28%n3x8jAT?eEND|O0AWm!@P#E37Iu1er%>=l~1y})K<`xHV z326YuujLQP`EvrE|6TQ8%nQZh75&D@me$?`7(^jzePg|g0~i<3$*ojCTsxpK zCpO{6UqOtGz&ieq{?;E+X;#eN6`_&!uL|d=Pnv+-@gMiR3gYp%x)n3=RUgui@*2Re zH@%a9^1tYrzB%B(%Ln(OQn%Jsyg%=gJ;vXTe}bB-a%w_>r+xoD0@IpV8<|5jvVxa$ z{H-jGFFf~!`fo;w<@j z4^G~@AWrQY_Fu=jcSnc)%V?F-uC#9ZFKIGYZfqpavg&ZG^XH{hKG6$^wb`s?OS3Q} zekRBg{Ltd7p2hM^`^ks5HY61<)HBSDyvRPCEb3*9sKjqcL;uq(l!%7iJli2EW^SOU zpJu?1U%DHhlaalaOx_}4I9)TV$QqRUgXp&yZE=e2#GTm<0!qaNX16s3?n3*|LKF^l z5xUW+mm3pQoE6|m2c3uxwWw+Jx9!0 zG9#dzL|xIUdgRYbdB6q%b6UMJjI-c$m>g7T74SW*Jgyr!!-dk-7hJr1eUT?fY3a37 zS6PSbSLH5eIPz3JFY^^cI2!Hb`Jy#$_*~L-zBM=wUsY)<$EfZ9By6QI#o>ih9MkqB z_B;3%>6I+M&uH2u4-SJmO^)H#k!-vsBU8lqpfXh1W;b~F9+8!548yHI1wLXMJO{?} z3}Ke~1uEas&GU+b9>sY%D8L3yK z!*SLZWnQF0u>yP-FyTtC~;O&)Q+ci8)D<%h8+db*2@z63N^z%h5RfI^I}BfRhv6 z?61*tR2!N<2=>LDClYUuO%b}mQL_+G8i|MXPgHb|prXr;JtI;;36@RzG+~0ZTS&Z- zwyDE?Cs6u-5Sioy;0+UD+62>S@}MF;e}2&!IFg}q*6Q+?n#SJKrTpi{jQA5_1-(;( zWgeKwR{oIH{UW{5;qc3UV7e`*dGcyk0@vc~?r9$HscFlkOpLxCIDGugWGj!h8CmNZ z7GVXrczunq%(Ve4Ut92`jzDBE)R5*QD+4%@vfe-OH_fPOpb(^pZTOb!B7v8fys)yP z<&RaUws!hXB*4>WfzGU;U6I$5V#-;DCxK0qt}tE&2@14q7x>K<3BBWTa15eJErXa8 z8^lrmNE6^?1~z+*wx#&?6wg^uv;3Lrn$UL+|Dd^gt zTlnIzQ2pB2g;hs${L|nvA`_ew4a#$T(fKg{mD(J!*J}DUa%X4=E|%Lp{eH+E-uYA5Vf@6xj4MkIqO|8Y{d~; z-mdcF*zn77hoWa)VXh?K+;P4k-Oz3iW4y<9pExr)NHmtNMLf`MtFSdK{u2UgXlDe! z-BH==LD_hXu+2Ex>hU8ymG1;lLwA;?OK7QbiZ!?G15ZZx#V=(O#aj9!98eoP%r>N; zc`D+oomBhCxLxOxUe=)gL_-@Z5Z|Xn$|`Pt)-B$(D7z(mCbS-C<=q4f51>%b5eCU@ z@;Du-M1}sDfdn6TThK+cg46LzvZm=oicckifv{SCJb_*RC-82_uuF6cly}nl);$Yr z%d>B3%9X7x1M5|(cqVI3RHacmEjBBWRH{fZphchikBhp%7=^8)v*%Z0N4is(CJ)nw z^EIFTWLyPgy0k`hY^Cyx>4ck#o+sSW+^NUAnvU(E;OmzezpljBR${?;CJBUlgRe+LPhW;JR7iI&0mh zbYo2p*lvCZl2$UyV zJt8LnoM~}q@YCX4kx7#c%gJXm-&?%mtP-Yf z#Wz)?ftGIOonqHs$9koKckM0d%$@G1iaq0bqLy?50uMjJClPQP`kExpU*&5CRBD$= zxfE?dH?gdLua&KYIRX^knYnn>4K+E{GEw%1?|KP^l;F9v@l|i`o!=0z7;NgDz-)iq zNkpiJaqg^ztbNKzC>U#?nxn?Pe3p`0gD{4H5i7`8_(c{BMG}C;5cz8QEfJql!Rf%f z7-W7qsx%~$;~5(@a)WF~lMr^9MTl(Rs?mB>l($aw4_G#QF-Z?^V45d`{>iWN{fVzOmn1>HRBM;UJ?9O+r~ z{z+ir4fiTtnaqkXH5@%#D;~OQUK%0T)4nhtR|LgGUpwN~H#(SgJeyZWgbVJ|8vkv& zT*@j#aV>M>@_ls2Evu5I7-`X${(o#l0S1bpQqs@=j%o!KCd%ahg$A|NIyP`BDBz28hA~vf{1Ux7sEkVrC`v3I`br;v zY%!E}aShr66*mrMxj>SmcT^0#7}-vvbx6b#yR!UqZ=qXA0EU-DQy-a6h`o300t($@ z%#W>+Oa6)DutMJWdH3bFwqe!xgdTCWK21Bmcjo|=>;cT@*Yu(J2@%;};-(~7;^+wI zK!b)i1Y-+JxCz$3!c=B`Wx_I#b~oMiL5fIhGnlBNq%O}sVs;>;1mZhqpPsAX-K*ux z#lheaFE3gZ*cPLK?BLCGg6^(T4;pBfQ88@@%3Jh*tR|8#I`(VPM7%YR!nI1J!wQ`B z1&P)~%LMY4(pm{5={%Jki|<^BLgH%eY;zhNQBXOH!-UV%q>Bsfx!)()YyPfTyc>zF@~5P+zTO`*bJSGrHk9m^1z%tBh%(wlk|I09`k?2 zC7XaiN zQGVa-`=&7L;l!E7=GuK+#I6kpwbXpoFcTz8vGqKv6iI5bOQF@5WOXbFajRY6;PGnR z&JvhNasfV$6*$RY1Zr?PFnYpGhj$qJM++gS1@8+v+pud%sltN#13wmLlvY{s<}!=) z=2bw^hG=R)I|raYFbndO+1Xsl+xpmF14}FMh0bAX1xK`xuv=Fg>~6x!32chzf(EGU zPKs`B2@WOE5nu?AJM)%VHfKCHE2Dgs$IXDWY80oFJ=cTx+U=Fhh$$JKH^xfX|ODuDpG-St%Bi(>bc(B z>6MLACP(&1qLk%MNU6F4c%9S!s;uO`{8B*v%b1Z6R%{N;$z}6qaZZ{w0S4vzFN@y) zEKa1bjI4b<;?D5D;8c0bs+keKJn^Pmk%g+!5FRtCHZ|;Ug7I0gOeeDT~FXufI5Z@R#1aLhmsSggFgfv92C=8k3iM+I_f5XxorFNRp2Pit=flT<=!XzwtcwX3bf_G_3cn`S}xKi%(rj58VDdvXq(&4*N8Ptzv zEFmCl;TIR>NOl>|BT%Ih+}rD^a8~=y78lGMF=E-g}{LlALh$hvRH0~2z!iIfr4Q{ z=y!4n?JC9QF2(Ik$XZ3`$-$7!Np{ajGX6pLG(Dka8mKTK5A!0>GAr)rFk)CCx*@?P zoHH(~n=o)9UCY3lk~bV$qSJWkEV?=o3;ZQP*gf7t;pRW>Smoc|L9dW=9^VdzJ&QcJ zXJ~gxBA2YtFkpdtDU}N7bSU-FjAvtd4<=d*&ei%O^SLuW5S4+YzlO_+LLFx+N0EZO zSyTw8vkF~p!)|nw)T7R5yQ$R~U0_ST-k)cZVk>BQBxg=x@fCwAbR6?&9S0L`NGj5+ zr4*0OovyY1R6#od<7*t}Jt($Y_p7Sz#3xYvBIPNDRTguZ8I-qc4WY5Sg!XlYtRpHL zGpg(^M3}JV7F2gt(YA5tF{|&iWbT~fHPimdc@*ObQ_j;Km6!K(oI>#<-Fh{bmMh!a zXgp=#8^3TOy^De4-0GBODVGP+fNC1s>^3ckr7=#U)7R z{ojGT%hK=e?Z5hko3SlwHO**@dLnkMvG!*hO1O?V&;NJ>b**~pep#=l*m&ZtMab)A zv6J6BuMsD%s|JE{+yrI9r8^;Zl2P*u*UJ21eVXC{JD#aFkfNE+ARc-u?WSjkIiOD$ z)_&|(_c?Y+xC6!d%CYKNeWKg{WZ=&TlJyWo%W!HZ-r^&+YmtyvUs4@Ku9%1q%<)H)jUSr9o+U^~7Uazlr8PUOKP zx$83MYt!rhcDo^v8-rsgjW`?*k$b0StWcKAWcngzd^=}*wI_I^cw1Rvr*jifQdM$u zv_45g;?B}O;&>=4B1uy*dBlBJ#M+4en`EO!;LoP+w`Zu>uEykv`=g0UQ7BS5-RsK5 zTljBNt&W$qzC46D=|^?Fh~X8lM9QA8Y7@A7XjwHiF!{OtlUait31$>A2tbFS?c&4X z5BhxUj-_`{ay%1I5$`XPD5uMUBbfb_dJX8Cg0cnxxwmSVk+oyFr$getl0Z{*DNpaFZYa7)tm^l6hzJ}4ctlMP4)c3v0&s5hrX9F&XsecN> z1={@jRLujlz$j+M;O9TGb8;@Ji(NVv(;73Dn?%JXwp6FbX9KQY2Bi)$cx-e?D9zqQB=3lf;Z` z+OAt2=iVJX{p78nx?P7-Tj#G(_n?n+-)L{}_2@cdjBOqXf8>U}!0h!IPQ?zZ>u{LR zNw~%knl;;VH$OHsy>TePc7|mYKGLb~Krw0wi@s~4X5-;~6cHY7b!kWjw4u&uM7@C7 z(C1m9;YUrp-cEl{r0^`8AyR1@-bKrAHpv@7QtkGYLA?>##3GiPt0V?sQBOcd!+#m- z+oKYH4~06ii}T|W$KOk~Tv$H@iG8L0&h;8|=p}{Z|LVAuKf<~cjZVDEN%+fVt>#Im zT;8lzvxGFAau5akH4@teF^8X^;nqo3QY0>z^PNAk7nh3JK=Mnh%uF+IIwVDyx_?_5 zh=7ePJJQEkN!EV;?_N7ZC)2(&Dzy2eDq0^TQ;r94`{BA4bte`3OnP%6>I-%uqKHjz z)1+E=IbuQ3#(7FXsNDEThf076y{=|t&Bmd=$RFPrWO^cs%5+E-KV{8ANWU!Ce_|qi zs&~&fp?>PW$*^)D6WDs^JHi^eiW~~{Y^k}z<_=-7cD!Z!SxP{*)$W>VF=Xf8Aw$jW zd;EMk1eD2AXimPa1n8J4wGpr*hyI_;P2&+~sw~)%M!~bc2FHmw=bWv9e%*SwY`6;{ zhThrGVo7r}kK3iq_Jk&5wBNwb?{bjC^(i@9X$`F!P`;uo4RbNl<5(;`42Og(tb3FF zVtFNr!lm(AQ2#kUJD&JftuW8_fzj5m#G|w!Bq#wqIBCovoVI|UOKhyL*yeF(MQ%%_ z4yzPQ!^}PSxEi75UK)H|Hc}|8>ww|U25H+#Rv_Ol9ptEa0T+!hVlja}XSQPta0(AQ zeUo-=Qs8!o#QM8g^Jc}rLqzgqU2kxk5bk3f!pnC7EnaN4EsZx#B_Y5X3271(_=a=3uaTBmR*o_%v zO|(KLiq*@=W_JzmUQvBvV}B)=KE zbgK#nrgz52Jk|WQ(vvMrY>w7iXh!a!un+x1vVH?y8UIh07`hVI7(Lmvztb^myx#4< z8~&U^2e+FJFJma1R2V^uR^ChJ1E$>#siQ51RJ;v)qv1^Li&Ra&ODx-~hqlQmxZ}Cs;Ti|;GK6(!H3VoZ&g)#zy64^R z?3r6Vfj3jVfM3(PN=ZsIXw40u&O#Ga4H&562PwLb!qn7-u!#Sa+`ZMVb=g*Yve zi%MlPk{oHWv5rSB5l_1pF4+`c@M7m5JnpTJw6F~O`RXK9^q{Bg{v9|@^AeIfuCrUk zl=ltghdN3H)vWR>rMU_!;+3^!e@^esQ)Gpfz%5D%s0;!kU4E=3bJv_HkKYwh_R7+gy!I%g`(tnM`|5HDYTpn2hR& zA};{xqgCBj00EV(;`?7nZaao9?#Sac(UCady#{Aw(x&#EON&^YmJUzXb@vb2s-ss# z?As7tWbWOsrcSSI6QnTtS5!bQ*H3H&`}rN-#I4lZB<93pA{U}|P6?ds*G-4Tc}FOZ;PHZ2A?2+i?4<{?9JOgevU{K| zYs-OL*JT?E{O29PKr{(>gPT%Y&*0AClxBZDhZ)q^q(d74CRO;}9$Z5kAFqiN5HU)y zBJ=8h&V0p2Ai}}&8i{URVg8hsmHDI?W#$k9*vKO?W#jciT5Lb3$G#5PHMvSV+socC z4U?=&iiD1?D1g7FvIw$1CbokiNQm*vW+8+?Q+j~U~8nBc8e6wb`6*b}6csTDFQu1wA==>p}l`x(ls$xwP7UUU~ zTbbWBU)6z>$hVn8oXuO6mDnDh_S=@f_c%JA(jb^3vRw2|5y!n~TaP%0)`jsj1EO|Os>@P)U-~Ds~$hH6os9EAYkAA%H($+`t%do8VD1A%q)a|LRim|0>Vkvs)nyb8H| z?`QxotaR<9g!YzGpe|Ub!)8&;%b7}xZTxoznrBjV+q9`^aa0IrHGs;w8%%rt~yhRE@AqRTX%e+=8 zGgKc+ZH%jr+7+6J1r1GFoB6U>v-@cuJ6(;k5T@B39#>65%oC~JJ~puz1;neb*?^(e zp1Z+fP@M*Ix#w_L%C@RGylKk19!~Fc!$!R}O0Oqj zkr`&GV_dL&vdsz$JekMae!GA6sX05B@je^*Y?gx3Ol88xa>O@uK@b|zBGrx&>yg_V z=PTZ7x5=$c#oP|Pr9jjQrKlaQE-WtQ!t1xH&G!*)gkFK^%eKoewDb^tHUYNEtn%tn z>}-%j2k8p$A{0wqVm?uqXm%L3-ra7Y11sjGBhsm4>&vL3ku;0h@05zRs~9K8t9?mp zZQY8)N17cWB)?-(FG0f=Wqh#9CpODhKIm*g$BRh_jMDTyuA4dN?Fvc~RTxGzm&_c9 zd`RgkdxC9Jt;o=9H|fKT7;G_u>G8%V{zTsEynYSi(nKZ@#M1|Ht>khA2UQZDBaWI8 zs#v&_`-47a<&teWTsX#&OvD)!IYQG@!w6WsdkZZin|=<;Y?~HVj&6M$graP^5d0`f zF;--A1FNC-(B;V|^+lUaxb52H#ilnZ@el^|kP}gTF`&hka(`qsj=JM$vV-c7+ig6TQ>jJ8sNYkWqaP zkv90@N(>I?1iOGlM)+S;6P&FTyJ!Y zeALe9Gp`Ub@q@w`USlnf!0hc3g!>)V;-5jizPCA>c-*YaIzZ_Ba*I&oP*BF&5B zQb)v}%+j&p(0i{UnIN=j7=L(-!AHw((G)gih3`X3LO+ELWx`!81C3%FeYClxBHziS zt-7s1KCe)fQ)v zA+PZ}-VfI`g=d_B-AP7ER1xpy<@Ksz8GB9=mv18_!#u}%*<8gIi-72S zdzw$~;GaxeEzv0c7D5@^;4+!dsJ!19u32szhHzQ|4@uKel;yPj-T%yH{a=~cyr#!X zY4!?{!=&uX7*qp7nyC_&u;vczxg*<~_-SVwp%X6_m?Rx=26trq9&ZXo}ErU2M!Ph-ub0vcchrSWzth9^bEo49;NC`DZ4|N8~zZziZ^A zd$wv^Jch=$Q9K1g{j2#AGWjE+*fp4AeQM|==^6AnejQxFpe9rsI}pg6l^qyd>s6En z>0F3eZtrBTSD%&@@&F{G7&a5)k553|aX0)q_ez`oiC-x^apS$CE zQy*O}GZ(gALu}y1wSMR~H4`EdGJkZ)f}vPS09Pp{oZysT#RkTh1Ssk;UUjHS7g2)z zyfnY&d(lUa5y2ovY`AVP;ULnB1huJ1%^`tAh%f`jGtL3A=9aJ|mNMo6&z z5XE9GlZ?sjIs*d3!k~5UYbX4&XYgs%@DB@Bb5y*Q{1VMkM6}GN5Mxs@3Fon(-%o&; zZtXQ}>HE1YC^XqtY@r?IYt0W*MGIb7t<-U&FdfX)!&m9iDF{LmN+Nz=8_L6Yf6Y_j7M|olM{Pg7ew}; zE_c=kMRD7W7*i7W>X2i-lrI(cJAM2jMGQ5Xu8Ts$k&o&3BboPhzH9Ns&~B%|Ckd;S ztDk7kvz6qJ#VPaj*Az#k<~x6w4Pzh4>?Iy~L+%53Nb?ebz(b&4>EW*=(hz@^ORHBT z*;@yqT;BV+Q0L1iZB1?~r=P2g;um8-%ON6cjfby2uAU zUcOn^Dkh&@t^l8JHkOntxdu#TMpzjF4X+6gTJr{F)SwOk+xMVyyb66Yjnj^9wJZG) zV%Hi#RXb5=z$v;kdA5>`#woo?91sXcrGiJBO@Yj8xXr^`LB17F?ILY@|CwyW!N5M8 zIC>+xI7UXT?}b!ZiD|o<`z~YWr=UMe50cl&!YQ$zHE$vYQAs%ivcfYxdz$%rhSjW>nLrfefa>5bN$DaVYCEY7bh){7Xq{xX1GEkb zK0Z9}@t;OI+t60waP4oq^qYHm@1jg*x8^5zy8Vf$O5*7o9Ut*M+D`ElPFu+JSq?C5 z9^mD*FCCdGAI88`Ndlu92d{&&3YRQE-?U3h?7q6eI) zQA<(Qqj{PmO@g0vy5g+9b4->gOKc+d3*M-pQ@f$RswlT;i4KrDnU>zNE*`;GvVmEd z>oW|xF%wWZ1Rw%XE*)o|#r=!*n!RPyg`cu!n7zb1^-Zry{;DMtIV*@9Cb8#DR|El$1$4Hsy6!C<#_xNbpvYSflUu}wygjy_@^V%-43{xB=tmeNun&>n! z*_!0av+YR`*|E7TOX^4ad=zgmbyN5gpRKz(bSeKBShd@aER417GK+yw?StH5X|~9; z_^F7K)ViIT#R}-}XKEgt0C_l$f2z(2&$IWJ3=EOnE<97ADoq?+zlSgXCCS9iPQfGm zZU35irf-Hk6bZE>%*ymIIcvuK>UvGrSw&Zf-zRuBNY>nHNI>;zbzuTu{^IPQw`Vp4 zCteg%(yUQ8zAVh~cjzES$TXKzDEJIKiv8}MsJ;u${PfKwyC6`RB|{~KE~&DrTBiWV zv_IetR6Z%5cW07nyWD5=M#D&d7w&yWP$e$Rwb4~AT4JsMrq6`CUKkj6?RzYBGjq}pF>4c+XIna{AZck_xD)y}ywey&zJ z(dnsdOlW>^pJp_U7VOc4uDudfD}@qHez35kH8BZ!rM1S2_s6@xjb3co41SU`Uq`{$ z0=AnXq<{K(qZ^1eTCWtbF_^nbAhm;#DXKN#A1FlYssB2!$6f}k#}bS!g%85e^XDC1Qj zawoSHQTdAgOF6S*VyG*V+ zAj};4f#d{}kU9Ieroh9*K*%*nGX;gBKrxB2`oCp?NE7@AfA&NJa8U?7iY8RJncy6gZ!RU)bJV#E{g1zM9p%KJ!g58RI)cs{ntmVCvL z7*S#J>m{l80^LSX`k4h>SV#@R{SW4tC!?OK#3)1y9zloCup>b!SwmxA2KT3tJXi@! zMTV2Q%Pp7ouXl`I8SqaOkzd#dT)7;7M=J{1Y*e0oV$K`#dVHv`O&Qrxd|=3NA{q&tPJud$*t@O zZX(!~l#r4``H?RFaGpTaFfcy=5sY&&@_%f7k%9BBuSvw1VDY7SNe4ef%|+s*(H&hnL-_Pu7PfHD&BMpL*``}b|E#WG zJL)l7@(%J>xeVxz4a|1KexzM8ItMLL+IMpzwA|{ zDdbiX1l$8(wly4CYeZsl?&${>Izu-G!(1UE0nrf|(Yw;B4+s6b7oQKkrMBUudtCYRo!E(^ zk4}LhSv?C@70?Ro>RFVlO5FG}uJc7W3Niev)dEE2w`YAG=RRImWM#F?592x!^GbY3 zy6a<7L{bS1NSs*IPTsUMW)9=QzK)g%l9z-_qZ$0(Wo1mz zX`{sf8UEf!o@u(7B*?euO|Kc#w}iu-?^xzZ7hEvY4C&6l$jZOA3Vo#iN!L0840P zvn-w_b1Y+*OReEwC^GLoiJ8osR>?N39ZF)xh2cCi`p%W^v$bo13xwYCD!=S5j_SkA zpEDpjPJUSUN~%dT(;Z8pC@FPQ=Oiu=_~0BYs(fIDGFZ2@yUcjS6U58Dph<++(}3q20R+L zOUYd9U#XfMP`Hbb;ekVA1U)xCJ7!5(ikfr20)+3fKFiw^N0XfyKe6R}s!!WqSL&E( z3UTkHK=|*C<7?I6$YPg4^`a$uQXg?NNyz_D3r0$@Q?c>%ht?&}@Zs`!ghrf5 zmuO_DMP~ap8d90)O!E31TO8m{+$!3hN0`9D#k5&=l7k9!!6B)lmB?CY`J#HEb9aw za9-aVrU_}$3kXbm{Lo@YJG3+Jdkb)6@-%vID`hJid^6y#Psu9NDq}AiOZN}T#D^1KH3i1a_ zmKuS!{l5G)*d`X|O=e$#2+^7>C9^iV9#TwQGJZ+1E%~MMrDoFH)ixH=PJpTBl#9lE z*Wr97Br!c}si&1%xQ*F<=C?lGji;(-+LX+mmt5Ta=1pr?3_0lUDpS1;l3zD5*R~tc zAaC15chdv$Hcn*9TNiNPRT^2x*y+roJn!YPhsN;}>=f>l7Khk*^F9gH10D`k@FcSi zr$NGjJ1Wc36uhg=etAmkY@?lvqjU>%*XDHxor8}?Nv@ZkGT+NgOK%ylpsL&it8aVI zQ`SPvIPztLNZT|o_!HuJ-1cOMC2TWD`2JM9H_13kT;A_%2-8um0XO-F%Dl1_Ajczf zGqQ60(iARJS2F%bQ994WD#weBMwx}x?^7KJxnl`8G)GY_mCsWd#NTo7f_8v=)i<`o zRn=Rq@mG0#jx!7r)9I-TBMALsZABboyMC(^%M-8~ug{tp2XhG7&al{Bf)mTlIsiIO z9!0EmA){-9PT{;Y)(9KqGr#s1C-wyUpq@_^BtQPS z5wV9UjqCZneghbM`&_(@PYh)e*sgiiitdPOn{Ki{5_L^H! zIuz(JsmO=UI0BOmW#?AhBM=3@W0;qO`3L?EBTs9%xU|!hagPE7$+vdmU)2$qycJD# zJTZbqpDIM;q?Aj8Y2iNVK#FSx>sV=96VZ)k)>pd55Oi8Z$s?x9p{>rKVL`xAh_-vA z{c=T2`61{C0~zPb{+O3=bCiy*k>lW#gNyTZ@{U3DV5ROBl$|f%lN~?a@cJ|f%WWof zlD72saq5qa8#dPsZN12l19jvHp{jeaa8u~NoF^!A^bS)RLR5$~9Lgm78mWt2BJi^x zmhdL5I>HYekalC-1ia#|%HuI6!sL;Lkt@bzUfk<5O7q63yC@x`3jejui0iRSG5U6y zG_GvzJiK&C!hZSl8*K1J?gK3U-f*j+G}1!Ox+dcBJ8Fe}y>Z&M?No4=Scn?K0J~U9 zyWYNW2h#J<#M09ZcIJkp!KYP?0b%P2G@1RgrRNI#Va~13>fa$p796Yh{PF<1rZ*~K zSm}m9wP4_@cWZ)E@%bdm$425#rfkXVLH!P+2uXrjYA0p#Yd zPqL&?8c!w^)3!_M2B*t6rm7=^K=RYct(oJ$qgl^a!OA%`?p9jvRtGuL(o4=Ul-35l!?S&6D`M{bAE?20ipl)xUYUIZ+lAm;xw^>F=1>S1DM`hO!;W14!N=j}figiv1IU5Q%z%DjU|`T<2@dZJEKMwK z4T1|+lvWFgiHLmar}_y4jphQD9^K2DN;>fTziy*&=0|r1&@E0MFb)7-MKDNE4h=vc z)3mn!K*-=?bX1L`cHOY{UdsE zDvkw8xRwATC{7TVz}a~I7iSiyCU-l~kC`ee8i3$w)-sICA z=*MRO=x2xV1xT}Bz&$!9VF^I9HNLty`Ut4s7XW4R2avx50!WUHp4za4-A??#4U5gc z+7=cyw-!MyDlN{9jDQ(g8s9f7{MJ{lWCP^cQ{DReB7dqffVj!UM*(*gS{j)eo8L=b zt$tnpZlwUJpE^lE;cPx}5m_OT=wqJyMPDH*!0NW};veGqFMv{PcIU~D?q>iAz4aBy zW9geOz-5{i7wDxAnkysy4*+rf2Yl%1pQfG!gF*(;e|9$!E8|D?4dC%(UGhr6Xyiuz zQVN)kjEqXiIp4ki&=2+7BCnN~_f!2|ivVcf0dxS?^8td0`OsGvi9OK2!&SZ1LS_E# zO2(7RX9Wp{ zE~hdO(s#e5309aI;vdWyJQF)*QWCxu?(ea+xmtF>kD4-Mf zuC$wK!-PByWvL)LElRjYeF8@~bkL(}O(JQUhSTw_OXT461GL203bN2rHti31(5Zmu zu0OTU?|X^`bGJ*25mh>QbMpxFc3)4m<#|Hs(rT#hbCB9=)iDSkRFqq|f14{FhGPN3 zc)#BnpDFKy`$}4S&A4o;e&%uH@hJ0&bHK0al=u&uOp2Mw{T;UeL)D==(&AHxGxa`V z0gcL+D&Icbs>d&%@d~bG4K!N|#DU_WY{(bwerX5RY{KEzQ|#dKd_8Mu>kJ4zk>j+w zNLS5tqL+ISzpAB&m1NV=^tt2tt(n??XQFv zY#~;o^uGW{egw-?{veNO4E(R$8Uxd-t7 z)^G`a95j)E(y{tAQAEba;R6_*Jwo z?A;mS;Kl^7lt-G)SE5-zJr3;w+FAd(cfYv#1H+4s3hl<}w?Q+Ld1b9*27371gP%2v zpD5g4#8h$n3(ORt+*%f50@BpoQlwdA8YCmJ_4f)d&g^AxaKl#BvYy?MENJynI30P* zyb-Oqtp3jOT$n7wY?U#gCOTfr6!>OCL%W4vPL?>83pKsRKIQbM-)?u8LD`r zFlB#lbR{B6dY%+BIY&L*vT}RbL$JN}uLM^-YFIlU;K z?tq2WzClHf(Xi!JAx)IDoQ_Er3%XE&c)OOTdUe6ho+Mm-hhoObSL-_5dP5wk^&E)R zLuL$SQzxUwP$>~KsTv;i-joSjtH8msWj)e8`xdBcpr;#>({Z`1SG|EKqERab4%>wS zFU0G!BAbq&yobL(Uuru)PAL@&8|X{Lr}VE)ddq~?xG3zrN>)KWAn;M6;lDz(A%rd$ zR6XSLr|)){%f^LY=DNlc4f8K0G~emfVZq9keAr@mrnVCl^ln5zto>=gQ$`*7#3<5!_+dk}=e%(FRy^VgFB{&*KOWN(5j#ZCS z#|u&t-DC(l#~GAPz8zujmelA*j9}pliQB3b=2$w28_cJ7A+}`qvpmJ}ox1~%e>y-# z7K()J&=jAzGLyysb=O*|eKvF3AF)%wSQ)MD0#_lp zyr6SrwwQPKe%0R9-VUas?xHpkLu&w2aGrEK$LHd^xU@U@lZ+4n!@{FS6e!PeA!de$ z%GmX(56#CTF_F3>$N^i3i`4f-d%uuFu`j(%gDrg?8o1l}g?dr9H&iAEg*UPhe+nw% z_Zn(<=mTA6haS~Gx;gcC)BguVQCl--B<;(%fkZExjhLn5N*EFpTz6i=EsbQOBePC` zal?t6BqK9S9sIEHpl1gk6%CHgX<>PTt2|>{&!qlc$H;-OvX3E|Cu3rea7wq{i-!!6Ct6 za~yHARBMm~X?23tz)69}j?a9CNj{E1($h`l1X_NISHH*T(t7r(T-F#`(R)tkTb~n^}>tiH^gVQb=mITA!`DeuNN9Q6lD#%7@$;w$v#Iv@!PBl z!L58GXogtcrB{3NhTqE}3qO27bG+m&>Dq_gb@(7pnS}i%CuI&bTw!EjAYv+~UJRBS zRmeu4!E{%CHBju6SMA^cTl*!q>@Y$DgDrwd@=iUV*wqs6XjBExEnSNT$=k$hTZ9KK zkI>gDztGi2Z+dC^Gm+paH0t|~)_MBYKwmL|pP9MS2J4AEWkKZ7Ol>m!>0IOCmafBv z8b+*faN&Odh(LG0E!gQtafutrL3`opA$kS1Id(!Z^gNIp0(+LAKzRZj4=E9hK#A-d zeRymx>hT?Qij-9m40E{c%uhP@_zk9aYU=cjc#@waW(g~4doT?n5aFcvH5?Hdrl5jF z>WPT~O_CorS1oICG6FfZcx%9SbbaI&ZVEz@5tTGYyvuut4Y7@n9NzHXKB&OiT>Bi; z0{ojNLZ>g~^5U_K@I21rv@lnP5ZP0RL1cN#+jiZ3LVdZubmfO;Z-rSJ!lsn_^6{zY z0Kdx2#g)w!jKWy&t)f5z2`Ae60zxkH-VH@U1MG*k7cw!uLPt_oV2gn|_%}%sJsX0U zHK30{TmQADus2#b>agXnS4?U;=0hYG!TZS{_^h8_nqISmAX!`>2649?c$AJ|p!0&@ zGJ=ed8xzSbi}~&`?>GXzev(NdFg)l@oiD(^=XgIqc#4G;1Z&OkVa5!MqW5 zVUV`d7AL9}%*SRFs55}{!|t5fD@j$AL{d9XdBLdl^Ai8TqE30NgYc@QKURFu`j=VH z`>^g~%8pd>Ukq`4*O-#Ds%o2tZz&9+8_pMb8tY6m!N>a=@|Ym|)Z;C2{12JaQ?xMIr zhzWvHT_B{iwcjiX)oLfKx%1e5B~DJNkbTct?kec*T7wy6K)@nHf>f4}_DbbPMm3xh zK#*YFi@7nqJ1YU%Jd-flvZU*Haz}=i%iz1#K;dU|xpI=Dbi5P+)hKu}^|YpdDP&Mg zISU5L!$Uxy)EYT)p|{sHCDaf_od%ls)t%U(74-@YQjr-oQ&4o3zqM7>4T8?bpWmt1 z8n(WLXC~4?Vj-evn&68f>X0gB^UkQPKF6=bpWowh1H;#LHOr;o%5HiN5^wfZ0^V2%VnN~9G_N{<1W&FO7JDUD@E0cgE=Y+_JDnCk&deO$_hI{og0u zj$!hse67sOIONHZ^ITDl+~S_U$4)rB`6l_X7ao+}$-BzNuAGrMj<>v3Dj8Vp&vW0N zK>454;5*T4Rf9_wF?fJ?06;|cGL0)ujB2&H`enWknTQAPS-k_A%twujf*fq-1#`gC zRfet!b5qr%fiwZMMUIP8yV*!h(3x9@CE>P)B4YA!P~73T3G)N(iYz-dnLrojqj}V2 z?jgGRf`-6zNKZl}wYNZSf4y?RUK{X6@uzek*uajtfJC@ywLePSs$mDyH3>AwzQdg*`z`8`OKr>{l94#2d(a65W(v9LaK0nd-k`-a-oB~qP)1SGB0VR- z?BSydv+GEZ1k~K%0uB&=2Olw|%H;C>pc*q{(JXI-4A!i9VN#d1Q-i|_FZ(4BieO{h9sjzljaODDAG z)+}7MJg?XKmJCZ@I^`qoCVk!-reI+s+1eFSuP9S6&s5WiWU>T~;Bz?RAwRv%_OwBa zT3aCrJ_Y?Q<%^8RQB}6c9L4)FtI&(B;BI|0ux$Z1Axa+C3)vvKLJ0XMyv8F}*n$bPmH7nE*qZyVvShL&NQ zRQSEwxzErhEbHY9h(`73|8V>9wvQ~`IE#8?$f)WIyV0jcE_)Z?5G=57&!6jhX_7Yi zQUJ6LO=oyr+Kb5cGV`tX+T8IcbniTxvu>z@J&SC$;D2)#Ia8bF{d{SGh8p{folfDa z6KLKqGMT|TpLV!EQj*WlS?8)7Mz2}7C;xhj*K8JlF!hn~MJ}M?IMX6d58Yz8eW^Ux zDx++>Ii1c*^Fvzpp`rZn9Ek>NPNBtZAw%Q+8GY@a&Xm7Xz;Q7iV;0UUwV_PT{=4nX z?#UF!3vycq9hrKL=p!QTh$r(xhm z=#-Gm$q9VFY8+b*k0=Gz3qH>pKvgAkU+8!4a&v2>R@jr4wFqQ98ZjqZo$taK_XYw$ zjqJUVtQZ%p8$*v%bw9$u#cpkLI_sZOr))X=VG8^k2k&+0(+BeP0X2J^0?B~B9li0o*8fE2La4Qez9!zbGHPs72~me@kCpdsn<>ZjF8uFd|zi!9_u zm|Eei>P|#N)x^Vr(dHRdbUYs;n-@`(f-gUJTU{;Vzas+ct_lOUX-WpRv8+7U|K!|n znE>rQ)*IOmNWLC;J43uy=s5nFH>NVJ4QLDf$@G+(LZ|m_&TCp&zF>H;ukV1B@doG} zm6Sb4yK_^b-gfhO|6Fp&_jn)?JMTh${Gr`3zU6Z3j6kQl#aYpEiHt|Q+oK3ql0!xX zvg&tII)2#UQp-*x*(7!!QSVdxO(+@eA&^E9=JthZ-GI5>6T=artUm-|bt)oOg##e1JHvlQvu;Z zs!OTWz{3u{=LDf2Md^c|OGH@R`Qm+BGGCd6AN9g?U0F$`Jm}3e{i!15IrgAe7#zRA zGAeUrn+jX0R9&jBV`#t4%PVx)BUxhis8P-%xlSx)s07OTZ7j~y1r8k{D-gF1gpaZh zSj5$+afXo+%J#;{rtfY~#uUP62T1X$@rA5Lp6z4NAPAM`wu3j>uKSpNKJo1_V81&wOW)vQ2Lo0}+;!4_-)y2gi(c2wfxYS><>IpP?k&Zv$Ho z7?YJ~M9n@`*{-l~ZoIp3Jk#nwnx35$SY>OAL!Q5^0}UEy^`BFCM5r#ZVXf%{-MA@&7X>3m0EpgmF=>J7Kv#~+d~m}XF&S`XGG(MHoN z{l11e+8D-i2QHZV1()4_oo?px9kwTdYdmkY@+_K>1&2ng{bzNR-%gY9BuhYu z67$bf^;P<#j06mgMBN1aT1^D0|jn!%*j+Z!ML-bW?Tsvh(pSxP4ON;O#9`YO!Ye1~uCgr$hi!Cn+&L1&5Ah z(B#?ueF5H=-{5S8iYZX0a7s+`m}Mn1Yudw%CTpj14U2HYF~RIKEA}4ZlDIGiVPKVe z>z9$ocxJ6ma&leUK~JZdy3T+%A;rG!<;!=w!&U_NV;#=rMvt<2&3kOmIA8fYQ0OVz z=NEh|EJ{j>wF;sVePlXIGD@=O;}Q=MqEWP8AvjUzHB z9V*HFrYN^d8#^?k&7o7sF(yRkw6C~qucOA%5W|DW zq~6#;iRuA`14yxXO0@B(>&sGM9FN{9)KQ z-QtysXJ-si zclS3p6uTL8%F7$iAr!wN8M0XQRr$k~$uCU>#I?-}l&xTo+l|rac^?wKtVkC@&qu_n zMd9}$#8suFrZ0F&8myE-)t|rbc<|KmPKIu0vgfF3_#YN7gT(9&ZjS3rZ&)3dnwil- zB-Q=^0XuN7hubLDc?zpgvw6mk16*hjt#w+p}F!Xd_sAT z1;RBIQ!VrQtM}8inlll%uTunAb%luYG8iil{Ios#E-ytq^|6U+$PGS8LA2$8xptD| za%`8iGB!#X^Sp3@&>E~$=uhPK{I_!=*|_QqIJylDr-Y8)z$n0lj~sxnW*TwfS~+Yr zyd^&o%My1|S+S2pSTOop?!_Ges32CDdrwT zmSP?7`9ibUBvD7qen)XHFx->mpBVx_y;V}JU;3VVYyfMr82UaQUS{R~K(P0N?~`4s)UpBs(_1fkUcU*0kItNSscl?xf@j z6?_JD=a<98$QYaY$r~9s7FEewL#J|O4(l6w^%)^Zt) z6ex5k%p8$gI<-%zLeJ~k63i)wuyQ!+9^3ufm2iIN`Vlj-Rbwh@khT(0#Wt}dfQB@L zeHCbsK~(-=$&cD^ud$$2ULhz{nkxx;f%5WU+l$OY)Q7F8d7nrefP><^jz}thoSeW{CuS_dHVEVkj|{Fq1iH#Z-4>G)**M(zi-Kl%57aKsZ737><0swvdmuw6O6 z+jG|k%7`!W1#%ulsd0;ROIJ?v;dAv11qZ~|_z+98Ce89b^d8qAMy^~aKTkJU9;dPt z%yZs;-$)+7v@SO5So`))Z}ZPqg738>rVJA^m1) zQgX(`92biEhJ;Ph&}cXsHpWQ)m@Y|+yXKM9G_xM=(~B-I+y)?oNKOZ2X9vpOHxVhlyK zZUt45!~UaNUyZ~^2iCLD@$$a?sYDxueY^UeN@%%sLX&1GGwbqZ#ACZ)9j15~-HsVv zxx&4O%q%L8X=vc}rBiNohg=>`YWQvp>29)ba!@#ZFpjxH&l8-axx|s*QW-xkDjzp6 zzah@SWZ5NB4BF=lV-x@Vhm0(Rjbpg2e4w{_uWtvB5{FZCpf*HjX2eJ_<5W#KgWe^? zOpSm4SO()ZNRrGwqEs!P%R)xS(IKUaqwlgl#&B2T8sk*Nnz9mk*d?KIPG4()-EW?( zG8?cGRsVu$&kpMA?IVmDxJ`d3sIZH(%7TLl|1s;y=c7|`v{R9x)UybVkScE5GQ4S70nr1~L0u`x_ z{l0%sf&iN}dM4*cavhW1(|a3zpcLd1Glg#sxoLy5&B=BQ?Pig0C`-`X)xT*DGx;5r4uCK2BO5hR&KsqSNM ztN>LxhZU@fWVCE=;#2#6HLnYO<6Vqw^_TGqy%nBk7vJ|kCyFBKNOzZbrc3mmR-JPg zxabSda+-*y<(5wo0m0eRThd1Cyx!ZXM_H{7@xQQ`A1ztwRshfhoJ4=fHM!Vx+JUys ztb{1-eGX=fT$(8p*u>Tv@53bg6TG@W87U>gzz3j^G;!dJn06#T^WFenCqq}dB?1q`0ceewUNhRO+9AnJAI`@b4wQ_a(YUmDXqcvAQ zf!%j*wi0x$jVufH9V!l%L=E?bEkq&aiJ~Y(^zZ}~Vm*&vpa)u-&StsS6sbg+2b;|( z6&K6)v7(jkhg6Ky=CADbJjn@;ls+hur@5%BnBb?o-=ln4E}GFfbBn1K;)bd?+N!tf ztVZbB{)&)Nlw55jy!ZzI1dk2a;!IFObnq?DqB}rF7nQ)cz$;0@{mWAKvG4D2Sh|=w zw!$63kk;Xp4BqzfV+n#a7FRcq^dOfR>YYF4T965-S!96q-81_<8w+AVoK^*;br?6) zAde%-Izu)Q9Px)DWB?Q22`=8IK&4V@{|j<0>JUU&pSgG1b9f#AH)Ai)Av;q*OecY> z15<+6wPd~K1)c5?f|Hh$;c^yY*nC1>wh;v}O!v~omW*+$E?^Lf{DV7h#3owza94@E ziRYnCY`eMNK{hRNW0|La`%G>H)p%J4qrlO`NuJ%Tpjv!|SUysD9hzYC2TFX-Dbcr< zOGvmZLbtVXV#c3xzDdxLF8<{D_ur8x!FGt?*QJY|;kNI!b+efn7v`Td%u37JD)zpD zQu53h3x076B(>|%_m`m0RPFS_6k)%fZ=t{%b=Swg4;0Fic1bDb*1HGBTtKPjCIHO^ zCgP|}dDGeH^}hU)D>RH@Hnxg<_;y)19~fx!!Y-XI25mg{;iqQgv7lj`xtgNkyZ3v| zpj^bf9A4u(e~u=FtV*dD2ucQdj12+489?**4UB~2jehoTZV;m6J_YiZ3MS%Waj8MX z21KGScWQok-K{w}8*Lh}sy z7M2*%FH0W7Gw-Sv|fMSOlJ zK_}>RQT(=wmS_7SX={6iF+w?0m*&%&g5c9~#M=&T7ysgQ%8f~=3$wy{b_~S@jZTb~ z2!RrQ>JY+6ADMNk*txW5(RTD1@28s#N{>{@B)ybt8#! z7Ub5+mnjju>)_zgFqPCL>EasM8UNRM_L;=DmeAyHb(oly=<5*=T}H|4L=e%c#HGJ! z+Lr1^Itz8PyF4r-+pH2*WXVud^bfloYrmZ!HR=C^Mr^vO<~9H9nh!JGj~X)XZR^Z| zG|!=eWwXkoYetnZ^+GAE(VX|HAC4f;cb3f3WWANz*Qc+p*K++qxLKUOOv}W5Mev2@ zWJb=9ag1vpW0}Eef{WZjSf^s&p%`P}SK%IYagpYq?eWkBK_T*x*8ldW5z)THqGm^GB2|EcQ$_;p z!JU*lF6R1f+XpXE%%KMmOTil~^(=&Blo1zK4Qq;Z0OkP9E#PJ5yZX7z!y(c|ZP{lU zqUs$Hf>nVuDDoDQ6-LKOI@NvTj(U3^^?ez4qt?~VYC3`$I5wlmRShS6<|Y+H*%041 zsjA}q1;}_7!jqax;lbuTbtj2}g$)VD$G+SgYfR(4(uz_L#0K>{gb?={Z~ce}X;D!L z5LD+dF7x6q|0(4K3F`qKeRBoakEgusDZX7=m<1bduk7qf*BD+R!u4lFbA0>46r7%l zCBIS@6GrZC67SiF`ix>4jz4b>Vl2c6F-rWFD zd2+%h3(-ZLFAx_qiwKKe3Zy%V=fwxi};|)VFu&h`|_?u1y*j#zX5j8ek~w z6biSIr)#d;!m4jAexg}TqCm*;E6iXz&lP9YY+T>Ek!of%~Y%gTPosW zo!sYsdrfKi;nhHdZLXC>l!ScODLC8G*`c#A89&Z6tSdho?c5DAWh0tr6IexTs;(Cf zLzlZU`+2iD8jZ6TG=jeXVMY z%HYeeRD9~c5od98s2vvYk6v(B?5qpqHps9?z$^Na^t&iN)>L>C-}8W>x8F=kZ($${ zfDb@6`}osIJ9MDRE!u<&3bsqi?C{zRGVErMuK7@>o~WH-@--ks4n7 zT0ceerY6?N5a+-&SO}<}TH^Vb)I)BbpX8Z8Dj_@fn00HRm@QN>pzE7=WSgGNOVZY< z`X#Puuqe9+LlLBG+x7JpBl7hO=V96{pWXNi3(B=!z50B(SfNL+J2ITm=4W_)a)yPK}rfxJ%Xd z&pP57DFYsK!t)#fN!Nxn3uO0zopi`HosM+PE@d~U>RW%@c7FHI$Y6EBmR{m;EK@uw za8(byoAq-TiOYwi!>WZjtz|-_Qm{N3M5dc;8Zn@<20_ z(h78}`nfRb)Dlcop1XPcEE&b3>qtEzCirfcfSQktgKkcNPqDD?yMtPB~5cnB`6{Z$p#f+H9%Q%-{2h$~{7>oX<+T zA-0$2y!#i3$Z87FaNbsVIfxDqq#(E|mmu`HyT|Fn1U? zNhdE7`(5Fw5X+xGshXYiFNpn`CvPW&A&*%Ft}+pQWHQRIap4h+cg}<(=q1W4uHY)6 zhf0bD&1+_)ABL1354gFTkJaw68EE;XV$hibmU$L)NoeQURF)n{In1~p{JNH`g;|15 z59Kh>h+_b}<-$sdPOyAm!uF<-Xk5;%CH*CIe5$ORYcbVRN$UPgN}c}BWbm#39^GMi9Yg~*?0W_BNC z2h_R-l@y}XWS_?D5^U;k0;)aB{JJ(&V9wG5O3uFnw2F~FO0M9C!eH!djqr?CE;x2c z>6v7AisO@OAgIzSoiGjaJBABJiL`Vm9-Rz{9l;QgAz^wz@vujKu$HTJhIVUud$)3X zlpaH3;Nq+kth`p?W{dAyu8vYl@NPy>9lnir&1|lgH)GiWn*tY#kP>5Zzmj|2qPVV_ z!HVn?$@paVjO1sGHIP*{g;oTGy%)u_R?edIZfpAPc6X_DnaSDQH8g!5W{Q!1gH?B- z=73h_tiF-=lqY|Fih#HK(_-)M6(DciA1y$fH(dYymwc&?Ep0?q^dt|*<$SATP^`SS z8Q3JY6la|LVP=@1v7*aZ5ty|>uYqAKYuVjhsSZ+~@%xr?Il?w>-af-y6T+1{%ZG0N zlUBZ;*qjk;3_;Lyu8aH%waq_7-($oBLtHkNxIDRj}2f$rsFFK)BY69Z|(cm-S9ET177p|7;8L*e5Er*hsSxQ+W1Hjpf!0S{yeoAXf=FCye(;P_js0?qFOe72Mt3|%BV7lubYZl zH@X)>v!`r)RB0_OL%zJu!2o?L0+l=9pQ4&?hSlc70r*Z_TX!`77 zyAYLIPzmmky9+hiIOjW*^#!8|Se?GX zc90yi*2LQ&%U|09d_aKCs)M* zr1Ipnxj%A+&B0Q4mItv^B)?Cyu24qJ_}oDi6#G%Ow0PxlEHZEE0J3oU0n~i=&lCUsgE{9dYdijPdG*+a3pq9rcj-8 zui~_&Pda!xeNqoZqa%8FeIcsYhCgMK%|=Vv-nYDg1P4QaRzDjqN`mgH9O82)L9Nwq z%Z-`v?niU7nF>&_CkWz@!G#CC%>238gfyB%D!Hm#ZPSu4uGDRa2aD zO~^z0XX1k~d|KAS(@Nvc?=-ioG9Ut<*r~rGv{c|r_k!`!nccR8iJ*$G2#Va~s_1p@ zECMoKR@)Q83wX?9epYU`7TT3&-(*1ZKxp_dNd$Y5if9)aOH_2khX~)i%&hJEo)fhZ z(%7Gg)rIjQQk-aT1vh&o&*cjX9kuu^>RrE$pmK|Yh0U4o9fw2f!7+_0$;e(lck$|_ z$Ul$8H5M{AsU66tb{GVkRf^aJ0pWR&05ZZTAJa5qWT72%N5j9 z1CGXGrzvVSgyLKh65bypXVL=F5F))x0m zUV7*PON~8|Ja5V|4=_2&;~!LpeKS%&t)-8Rk+Lu@;_7Zx4yu!3TR@EO+4H_MejKmKGBb3*-n9-0H}j zf2kyfw2zNMZAqcBF4FB3B&~Aes&;Q&|7@OhFwV{6==<^_N|)=|gwIp~+cg<$@nWWS zM`~Y&|I9=$ZVTo#uDS}u6d&cc57)p8YJ7?+H+gDzOnA%*a8JTbq=m~Lqe}luG5iDb zWB1SfuYQ3_EZ7@AuhlpywN3BHjEoxJV7fbGRKgD?DQ;bH&9zT9k1fSXooh`;;5dGH zN6l*v@?QM@J9A?~7Bq+;;!zW2x+xwS7Msr&f5_q4=ts2p+P3TrA5~;ScOF~7K=eu^jRqMKkkJam45po6@XHc!z`=x4M?|7r z^QeSiMJ2Wrrl?NzteVlJUT4WWa?eB0b>WjTabGZ&&G!H2?uy8&VuMT@kG-a%Ji%0kgyYnP}Ko&ABE&J;7 z`{-xY_l;TWB$@k6Bf>zV5jU+Tt09SR6UY2;NWwksT(b;#6_%~22YvQsyv`F3LbW6A z9E+Qk`3c4{{ol?fdb1UgNcRz81e2U&&SV{F>C8&E$rTs|rXWzuE0SCXmuz9D+B)UC zudv#9U`&llGGc3Uu~^{?G%RY~E9xMbnDD$ml=|)Jaf0_8ciUWb zOMYo{CGyntE&6S$qtCnAc_Zs~V@;3^vqxvOK1xf?7*5|MClFbi_pqb@a}zNB+hwIi z6I_mUn*Ce2zOdNVB7+c>qoT~w(>b1=gh7{I=f$QGmaEvk&jAwaJ=CQC($j{`9nAil zDLp?rVd=y#wd0^)+xgPLW`gWdpMWanFl$L?>v#}?dvIP&P=f=Q?U!-b?DtvP>q zPNw&M-iSA=v-Mhiiu_q66@iafGyMJRRQql1WA~;F-oTP0f53;z{o5ZXg^!z_913qj zoMzf4pB_(JiI;-CR=BPv3LHm+x{O;Vi!{?V#={}0d&n8%r<*pU;*2YUbefk|PTHH=G&363m5Hbn8Fn6#T_%zYw zJLyJyPz~m>#RYsQ5PGAJJvR2Jio(~V>>ORI*NZ%>X(!3e6-LR^?%9;o(X2&+2uyaJ z`Q!blV|8g<4ZxSaZ4|$R$Al*d{R0korNbl=kFJ}@?=jQIw+AaTn8@Niqz+{#fhGL( z#}-dve0*B8!ZkEJ`o$1TWm!t}^Ru}IX57QsNzI+Gqxk70OXLlh5lNk)oMz8d_<`qN zi{nYvxxUMNb{$CtMqE0(G8J-9Xl!TMm5*2m zzK^uaRFKHo(DRk#Yvr?P%A`lNtFl;2M6Q`dg_OmO*M&vsx?<5Crk`%UNo>pYFZrbt zv?_E3cyfIj!)++TvD9-#(|D8z7&3Zn@F5ua8-qS?!tHyzDakKop#yK6wbN&bWEiNt zImn|o$0OHdVEzvIeEX$V@?Uo+*$l8~u#o($3F}&&&F)*-M`V&CUH(?*+ws>ge|m7M z>%R(m`CNF;?+nafDM`n~1aP(o9q39HF3CA&O?Rg<;%dHv!h2B+rk}r~Fkx?s?JuQ- z)UFUyn1SIPn)3;tGB3OT#&FH#M1{n#<^0T&kuAdXw+_4TW`uW3ByifMvx^T}W=6Jf zs&-iSOQQF<^9?uqbv;SGaHX_^om@F<2Tm-w@;XOZ%IWx~=Z79WMimC%14dUk9)Y6X z)D>g8S=k&(55zbeKv+AHFx)61bCpebkAZ+jh6~K&o>qJCKj3>SYLyd^b}SFSB>o6yFw_V#(aa|efxSn#z2l%bLF-ub*8%j zIQ+mq!1a0uR#LyITUuH_u~94^QPEk2dLG{IgPSy;@;&s{) z8H2CoZ6^c(zTfBg*8V|eGmy;^is_vK|Nkc=HmY<@5ImUJvvWFrWF8ywV3fvigw(pYY~d2&>bH zf5r)HJR*}vQb4KO^2bTf)mV49J0`X8#TgOO21vlTXM{v1{Oo?!a=o zf#9(_c#~`~X0qQQptUY<{b=bij;F||nv@?a7&)a`jCFic z=E2}=+}l3j^J_8^wxPw)HRvn5J)?Zd6%3qE>*>%sqw0AFU`K{7^L(%0BMGoT^>s-C z{bB3?(S-Ez8$nrrZl33JD{Z*M7ZF~$M-&@oQU|zO>Ie+vF=)voqNXS0p`Vx`;$QOu zC^wR!gD2&+%3_mtlv|S2`v^3+fIYu!M=8{JQm24bTyKEZcR>#(_3~5stD!NARkcBD zmHc6yBe63@iufqMFLvB+k+;P;*_jkWl% zurMjjSaPA^?`)>N>--SrX#~wa)KfG!9L=lvm^3zRrs=d{e8ayrx*yxqeR8+=U$6?d zi+V9@R+XCc)9=N`NivBZ`|shs%!jv3M}%{dnFsj$ zSc%=R!f}~5=1ga!xSV#v&~z+F})h zb@|TFs^2mQH3Cm~BK8h1OiiP%W7jOx+tOz5q0w0ePV1KeV)0rR^UXQ##gZfu$87RI@uku2~_g%rm zQ__s%xD50j_v!qEe50M^y=IUs1RcyglfMz8aRQzu@2`I<*8nfmH-h&*W)?B>Ngl zKu9mfXbEbQ1p@;E@iA+J{)EpPH4No_S88VaOd8r-A`K|C2D9>bpNWkf(klXIrqR?08d8CizI<46QDbO2@DX~vZTweKqvUcM2~yP&QNAGDl(z+)_`l8H0z zDa6hsZj*MMZLP7P!!2k!=?d#Q`xTop8vCSR8tRa6MBka?EN>Oy28G;^3G)4{^);mV z8ir!dys(2g(9}Rhf(3WWe_vLFbjBBu4DU09qGkdevlf%(!^zJHv3!Lm#)JzXHcH;+ zjtjCP;a84fcGR>Tg_UOcNn5NK(QRnU#+gFJ)6slV(i@gzMVU-EZ3DSS6?F zm>gLKWvLN<+C_98OrV%DRg?GVv|d8P*83+Ouxu!LwZY6HM>#$JxG`OH9)WcyV?DYp znN3g7>Z8}5)TQ=DxT=EB8&3Ym_i`K0A~U69zPg2rTAeLAneak58bw?vdI}fAypc^P zLmijPDs5XJiq$X-jzdA#L&d3feM{gsaoJlRPyQ0c-d}TQhbCq~2^Rt^`pga*<;?cO zpiaU|2&*y|h-#1zIblJD>n2%!m5DzSiWDui8KFi=g_zrEekC&a-}7dZn~x0eU$1YF zY76%5O5HnpZ4SR|V&m!D6e!zbb-ZS=L>oo7NS!+BF~2cZKrzd-ZWPWv81jo$S%ZsW z!6x@p55K;9ZpYNa2^Xt@K}LL#U%Q+}NV3zAljBA{rv-h&&bxsvqsHcYB-8U>YDy6h z3h`mS6rnV7Zv?IZ?hO$fyBtptox(Ix0&q4W{eUsfvZ}vj53WCYAX?4q%8lL&e2n`3 zp$*pDMdLIX1b^*7o&gJF$uP}s40GX$E4%^f1`j=sspki<5};lo%P`)tyiLhN1YU@oKXVurJ+mIBIK@MpgKFSjn;%>dI zw-$32Wu8f~#8FR5pz_a{th9bU_`4eSFj`^Ag0_4{2a-x6U;q?{J5U4EkyH{P;bRU5 zwmE@3V8jq*Wrj$r9wajI&sl;n9j$84ww?_(ijbiFxOPqtZ=8 zHB}YazO*GRXU7<}eql~exN=s~>|=LI3QV~J-_cYPuf4u&k~^J#@qD+=N^fwe(1r0$ z<~WfOF3tykC0PyO#$J2`!Lp~FM1@g34Gb*?uopY+(ha$Rv2aDeQ3M2Z=f{ppYss^2 zA_wDov7M#yIxquSL@9y)(-1Xo8-qu*h7vJjoP&?x0_*X@)QTS&$yQ$OTG0%6l>@M4 z?^=!EUvZ|XcEOYiWo~41baG{3Z3<;>WN%_>3NbY|Fd#4>Z(?c+JUj|7RC#b^ATLj1 zYEyJ=3NKC|F)%O+FGgu{b95j%I5-L~Ol59obZ8(nF*h(EARr(hAPO%=X>4?5av(28 zY+-a|L}g=dWMv9IJ_>Vma%Ev{3V7P>TiJ3ON3wnASM=jdIE1c!iEvDWHhMe~C7G19 zh8`fQMdFGiBmlJK`}Ox^Wi`6G(ZCoa?WY?e3yE5CIhmDN)oe-YL?tR|ovftRM5szR zLxiq$^hB7-sz^kr9EL&I$_rlwEDDn5dJt)fS5+|n0EDiBC4Szdc_3UBJc;t5lFHDs zfUiyjqGY9nNPUn`l0ZQLnKTHd(pC_+V4;)=5D;8tOmx&2D&vwGQB)>q5*Afug&{7H zw1>i=TxE?i`R#6qR>LQ*X(7!ox=x zYm<>cB|ta~1OO5I0{WwXEm0}_VtKHlidwq^2aTcu&d$avItfCe$5W5ARgCBf0&Imy zlc2g#X%?Um8ht?#WhGE2c!YBiqkv2V84o-uBBFvwGL{xY6__I>>4Nn{&^mmTQY%<5 zJdGPo9rRsV4XdRm(h(F&h4dZEbXpdifIA$`ip~>4&{zqTz#=3hF-tltWys^?E2W~X z9D+y!ewZW@W-y@@;5Sa@F=8RdZ`Hy8!WEm>|fBHobY#(=9K%MslQ6s@pP zBd}=&LKGCO@USpNGa?@I$Z|{u7qT3z%)yU89@H=Y_}WzU{j00_>YzTk{eN+SMkICy}M{f$qGX6T|338WL^XNL~qE_IL-$^tI9iJ-t2 zdSWB%B*P9Mlqi*WRK1t9FGY1+)o|UcO*NQ7OSi4i;EBKf}On|dToHv9!x8>g^z-xjAhsK~9CanPdTK@ig}YEsQwDBxT`ivkZ|oI=`# zzcsB=C_#B9`IwThov6e?(-8opIC&BrX-?*xIAj`UOe)1JAy-k~Wrk16YEe;VA*Y+3<)O-wxydWtS zf~8>ej`p%o@e+at%`=TmXrTwEU!P(GQ9~zQsIST8Sq#riEzY~5 zTbx=K)c{?lxxYk?N13%1R6a^tTSM_t%*oiKeq=SY+`}HrYm50jCwtGPI7)Om$|fh2o9%Kg6%_4^aJeGrgidOCb(wF=ex^BhW}b;Zw>+medZ*c& z`Ebip%GP+b*3FxgnM9zBf;5dQ811qkV6C$hXCAx4=6TxDKG*B2;1uncC@E)VPTZf? zX9?O)V#Y5?;CZRd5nFaqjxJ$fntDsPcr3dy}JRmzMU1LZ9bopMoT{c}_VhJ=s`ryG_e{xMeA2YfN10 z=IPwzDFL{^o8A-6=Pll%pjDcuP1;g{@TS$Y@eSdP?Hkez=EZbrVEhfo3d1W!5=d_-(Yq}g|wY_C< zB+bqyYGxiYGc%5v?J;}I%+O|!nVFfHdCbfVV;VCvGc((_-*a|1?u|XW-}mQsbY!bk zDy1qbRoS78N1{uUXDAl?8{i%GlqPSVRHl@Ts)2EgzJ0PIF?83cL=!*gL@QTkd2)r? z%r6xvSW|-4F!!czj)mwk{j1)RQJ*9X>6FVoc?L~(vJ}2O>#I;en|)5Tp^Pcx;5N5% zcn6`P7}3d&=TdND*><@?pRk+HJsaU}&t=p)<^DG2FPuY#=G>6c=i7_dr>Sru_`t3} z$j9sRk*nQkZDPwBUx|@3Q@ayZFYh|OJEug{`waGAL&m{w!(XX}1svm#>lD%rmrKZJk`F&W3Iu+aK3IJGwmqGCIMU>=U^=bv z(DSY8>Ce4Wcqq_YsJIiKo9|iho&Q>+KLjT~7x=;F^>)5-Ru}|<1gaeuw+t^NGMi|} zv;2Y-o)ah@8qf+0fs6(ddp7V|df#{_^?@G8SCI>zVhnOu|JmfD+EcwXZ+GVEcVhf; z^SWE030gDvGV~62ad5zHm`aWkaL-mTH)ZE{U+~G-qc?B<;O_l7ymWU62lA!x0ZFV6 zc382Zstl}Sb%c^|em@Y__jspvZ$YqbV;$`%>Y;!M63Uu(qr*h$8rr4a%BsoqJYnByv*7Q$Wyq|%UFII9s zK}DV_DtVeQaqbZz7<^ye2Df@chkbLyU+&InvWqE5;CqyGK>5mZdf8^*RTIxdf_oUx zqgEeoW~-V(kK6r=fu$#3H_ncCw=TX6ef}=j^(JOiPJ{xWHkcUs*%!?+8MEVwmC(e5ZQ^gIH?=X^#*f*j=5oEtkIk zGv3ZRQ}?vS^W@~CDM_Kr6EX6BU5Zb(5tFD@?8U=AIjebdS2`sW`s;Ng;4v3mb@(<)#%>?@zb15oU90n0DEo&Ya>+PlmwN5Z zabc?S%K_`E-@}e|ozBnt3j7lO>}LIW;SY~T3+L|rmTif-XU3O6Ds_XHlWE}a&=nzVo%tU zO3P-Gk+X3%%-RED!9x7=yb;Z{VBrwbK(rzn;MyIUOx-m54+F=$xVMg3xbn*G({p1Pd z?9$GKO^h#k0-zac?WD|XQb^lkCF|2{HfcSvFMP}&IC74zkaciHxV%;Fz4h3BV`zzx z`WhgWoL}8y*tdx~SrokgqW#2s^qJtX8|7dPG@YtZ$7U}Mqe zFuCdc?v~)uhw5?j-Ywejiue2j^W43ONOa8=&;hzCpPbQpi@ipZGN6-e=);5%)H;bc z83jK|8v}a9v#m???4oUg(RA{A*)mH-$2eY91)QY$E{wo!@ZP@G_?H+X^lxI5{=O|e{7SxVsdxChk=>(L>qc@ZAdSwLDjSZ!Mce@D>tDiQb zZhMK~TI(VLaRz++cTRuRXJzeAUNUjl&!6C5_YTdf#=QE@gg?!WPIG+k(|lEqh$vic z61t+;%Tv$Si8sF2bb9RL^v1xj_9WL>Q6i+JV2+3EA}v`Gv=Js4Ngu%E z{UwIyV`S1PM+>2Jsw+7?9#s>=+p4jt%6ir9%w~>*&vn$anFg$q+b4F{1{!GOK>u-D`J@_D8{y-|1e`S5zf}iRuA+$?4V9{Onhx3~ z0h0w4;tjEjhjCfozaGb11iSHSd%pO3qS@|idcML(h&<>;Tu}+!J2`g<*OR~^W*!?Kdc}DKVVk4pq zmL-CFMK47*JpxH5HQk?q78^sSDftmUZR@+pxQ|O-3RBf0vQrUu?y0x$r-3GJ;DM>@ zC_V`l8t6tMK%7zxRbPQYq7G3*JhhjU`&OlUPe5^HyGdcCodc*(?btu=u4xvevY8J` zJ_BUT)JK&-Z@)Ms@3VTpc8@J|j3@7$mZ;T?>+CxGOc@tDNjl;wP|zV+eYT0$_aL=c z2zLYZjC4bF3D*#fH)CZVjl@UMmhfWRt)R-uW#iJ9&V^y>h3;==qUy*X=71@P3897U zw?tFX60i7HWEPyFYYg=RBAz=W|VhN~UM2 zw;z-?(T#m05;;ShTHdDo8sfX%752hRZFFlN7n;qNb>Yb=tZ{n`PHG-d3o9aw;t&vr z6_icfxe03$pg0kkg~BF00+Am~e9lL6spAlEt%brWER9n1U09m(2a9k)0~XbfQ3#gt zLxYuby+F680CcJ!nsEJx=lEItwHj!`%k-H~$;6w05!n98Iy)nQoi50o?Pb240QzIkYx)pbJbHa(k8GOE1+iUA3SO;Nl-2FPt!M~Y-?w*+34OW~Thuvs{1XnGyRGXUw zn@z-KH~9296=cPx0coy|*O%BA`=eP|6QkTbZBwfM3_I)a;r6m?H5-p|AAY8lNzHU}!2_w0P9B!GZ9`-_DhP)V~Rn468l`I`j!%>kWEgqqBJ-g-o6Qh~FOy2CDlG z#0lP-bWa|h;d^f!?H<7|K$_T(4U_{>`H;e=Zgxs3D!4!11ZG322&ht9ouu=;4?ddBU-MmaoJ9 zah)mcOnmjWD;NM#q|P1VQ###D(4%b|`;@apD!mr{s{Z6UX--1B;GvyCXc&2g;22=t z^*g(k-ag_D7(USd?u?F|z9VK|Y+i4<*%{sD7aHE)6DxS@flRF3eGRY4#Z`|Vm-5|7 z3yhlH-q(*Uy;;Qsm-Qi>->I6y`hY3*~-Ew`@FR zB3eor7Ny$w-JLyAQkHPWlyS)`LPi#nrb6eOJzn-3r(7$8W7`DrikX3NreLkNm?P(> zwY9QAW)@al$85Jh0eF5pz5y%Fk2_MT!6-M@-QQk>2EI_gxez>X|4fXBzA%)?-<&$R zwkKKdM~tFI@j&p}NS8#vIMrIDj;1?BjPmhlGy=VLF(Gy&NX>E8pz*@}*46bI+4WNYOVn|42j<1DJ@BPnYU=M| zXETGmm#=*Mz)J3sw?fR@7pUsq_}G73%{l*jt2uB}g6)4T=N#PMIsUuLd6SNI&3@}I zpDq2FSVHj4gJKPG&;g-1VxhQRn1oKqKcGY79w<|n`+qeDKA(QmO7Wv)9Go>-Y5!n@9ONLizB+NvK($Dmsb3Gt(mMr10w-8mEq+H0@uUkA= zNg@b49{LeeSP``?UNw(O(usyY9vn6?0hHD8rx}J+E7vT71^ZQ0(yZWSvy>nisBGN zaxqk?*gh$mk8jDTlDG`GX5j8Qq+ytq#K0ozvw#`+pE-krBeU_#tP$wNGb3qH^=i`Y z6yGNt0*fW1DrG=C5a^);J8-Jf$jG(1RzbdD@bL#2asu!Rf7We6tOAIzMT=&fgv1NQ zaib;73{6BsKB;2aGwN7_#X?w6G#I085ynvBCD?K>gfetb$wx?|&60C8OC%?3_^V8f zqwlspKA*NeuJy0BK9wwJrVGAeuY8`NwR-O6dPTFXLYj{At}&X|KnRLXgItwIVE8SLupN%Q9Kix@ zbXnOCTam|UgbDCuagDfO8FHKgSG&ko?J!>mLImmXdpmln$=$rP|77rPS6D#)dcI?t zKXdK==4-xIE_ws@mk`DJ5+ako&up9~grOFr1Vmd^-!EPMJ=?8;D#r-knte$d%%*W| zM~xt5=iZiY1KBN?l%O4yD0%5gbH+ZzR%Ul>Jivxm@{EYC(YE#t|KtOo0DIM2=^A0t zB}5I(T*HG`^o(e@_VQa1v}pJrAk5NJC{19h9Sh_oMrps_xH}gYEO!PqFsSuj|h$JeRe51^&+BnBwJZ zgOI%^iXh1jZ&VUiT|vo&g7op#HzHs6sx9+!_pdvJEwY_lIWKr;@SVB=@a<}G;`l|v z7|b?H!}sB(T;G@H+XPEmCMH2&*{?Sl?_q9TY_*>EG}*rb@>1H`eW_8SR!2^Yh{WZ; zEmJ@aWku%0cR52+X5^a16NJ-YTjQM4dIJr@pwTw<<`i-TB9eb)aw}R(c@`PcZ~G7Y zlo8=e&X`_c7bf?k<;5#05s}apHV+MennX=ZI}C`WwSfFBGMk(*LSrdQ(MWTKuJQN0 z=+bEH?5$@}{nf5GbWp2n?|xdBy`Zl$5Kiu7R7|?i@_q%1J~6kK{C*`IzcWSDQBF!q zbq1Y&h7v=&oRb@JAx&xJJsN4r0Z{TY(=6a_RkWBROC{S#)&ne+I1+zp>bNE&Nk7!w zgm`$CwkpzqxHPFkDX-6eVq*D}MpI&HHJ!?gK{-aJBZiakvJ4^4*X>Ik}4M08Q=d~I8qxAICY!qucHw$gG@ftJkJQHiWf zzD6#9BQ-?{9p_X>qR1)rQ6voypfAJGly8v;rG*x3Ch1fMp7=aw@$A8z`e>gjCXi77 zRpMwrG%c}aVw~7CQMz5qIcGKb+hSq`*QgOgyCQ!^tvvX*R#{!am{b{e%8lT|6%!ND ztis9gtKm(OF#lYFIfl}t34R|6coi6qo<(_yhQs7?CCr=xoZ}xAYRiHRhUPdM)gj5- z^G3nh5_G*A9s#<_gezD9)lw}RmigZj-~yp&7GGA05YgDx)(0;%uTWvt2!}sS$TZ`( zlftLDubkm0(d{gdc`)GFKI})9&lCiupJ58MayE2+3|UjbAwcCVj2bbb#{w1>`EXEC z6d;7u5CbF&jVXW?N}iOw#uqe|W&K6khI*g=ew11}s_oZCs!l=_WKC1E!mNq>En)Gq zHKo@aka@j-LMA$0JM-kk!?-po=?Pg&B#~5pSx%BrT9lj{@#IZjCbgeUqm$))&2!ir zsVL}~PS|h)U-*c8GKcBabgk7K-MFq+dMddF%|>g%YaDe$gt9 zTpLyJpR75t$#f&F#>*l>x%>hcHEM$ci7(g?`o)5JbU-N@**8;#SJ6=cZ2CV-Q4k%t zl@kgq9a7q*?0Z~PAKsD5J1}6;`kJ#I4vok~Vi`Kt!dGoQf+t((#pR zitW=QKNAy07PoX{?;F@|l3{Y#f+PrZ^PR*0`oO0sJ^vwB>c{kF%LY6hc5aNF8{>Uk zrKg;)CQ)Wd&mgENobp=H#n;K|^711pL;%W*Vw379e4MXs( zPervN@?#YeE5V3K*gx%;_I-3qCYV%6C4{Q@gmyf zuqB?kze3qdP&RyPgA$u4l)RR@1DU4}EEa49?WVg+D7K_|XD|v6aIWN0R9<3u@ zD`2A0R;L-y9idw+Ld!K+mfazbAij&r!=_ToX)a}%BMgTyDa+`Gm+FfWeze8RMMaTu?hvfo2gYnF+g> z!GQ{hp36m#qJzEJk%m#iEkcwZlKrKWu2lF#II=%fzN%<2M{rq&1pl5JSv(kW#dJ-F z*@0F57eI*|Vj&sD&cYKmiCTS?yQq?1R)Es3UPO{^s1D`hy-1J)wFhcaS)y*_HW*Wa zW&%56GN~An3qz|f?nl}je$I_UyD~>N$(3{7H0c2sT#kd3f>m-!4XdD@K5TxMVP%+s z&`S!n6#S%nZIXLPxC4zmdw+498GqF;pS5ro%L!TK8JO@5C<@}@+Bos-C&A=bu2tD` z3JI?wn=E|9zfwC3DgrWFv`>cehYqa0wU;%AXeD0WPdurLs{~7T5p9DGi^a_pS;OhI z42Fw4!pU!CPio)>S=em^9G%LGC`z;h+jRm{SeyKXw!>!jFM{2{Z2y@?B z?y*;rsh2TFp@grr{96whA|*IS&rtv91nq+Epk%jAmGq(Vgxm10MnPb$%csO+rM8-i zBV{$yYEbZA*>KST6Z;w4e{LL^4R2SXH0@1JzMbgCcOJ}k_-CVET#x+<+Gt9+pCFu~ zkM*|W^rMpeR+~*i=e`spFA%1EH_;|EidW2l7I&AQZ5Yt$dV7PdL;`i1pB+R@vdc9=bl<&4t%%T!3ILNkR?U+zj0AZZIBV`T56g zsnNLLe3FW1al?`i3Tw;T)&*gbPVo0r2353lm{DM%mQ4u>%B-->+K)aRGY3`8J4)$FY9 z`KgRl#-E0YhC2Mj=!;9PLb;K_FUf~fLwbkDBsD9Bs~m#<3h28YC~i#2%OJY>ZX!z< zx8?eK8(nb>>&Mk`R9C+UF8r+VVu^k2y0NJ06F<9>`}x<<>$!#BszGPt$f3w6?+yv+eIs%yW!T6v zR_$Jjdtj>!zd59aNAW;Xsu%%*){E-gKg@-_AAha4f22<7IomHZRrtshzKcSuEgeIP zJEE%U6B$G!&pkVb&$)*czP|@oG2LN6n^s1}&#kO=18UKLB3`tlPtH1Db@T$W)C)dc%oQ!XO$q36KxlP80F0O zs7c-QDfNjPF8?Qv!zD_amo6mPKCST>#_}vxKumL*Rt)Qe$Mj}og=>alNkZEtWs#+(DG9N{N{`Qck*Ks#-6kSy8&Y$e6!GuVio@Y*jn5anXxNn?wb`nM$dwe})$iw@YH@goA`_pI-X%lH6Vk=yO)Iv(ii0gt>0XKJ{iR z#25z*qHM9ny!hi2$kg1i45${kiCp_WnpLHmdcTyRm9(%PmL@iYnvY%kIBuhR$&Soy zUE_~0E<&;)xrkrwN}D2M@x!G-;w}|8+?tEmnYXZ-fhibbViP~XrPz)r9<`pxt5F7- zk_Ly_ymafxlbs9J;fx9a^!4k?oDV~Dk7s?ltIA9)II>BQjq9w-mZX-6MtwiNE8hvf zC*Mu|l)OGSK~PB)g&KQJwqQ|*i(HYVmAg7b{>Vw-!0A@~9d$GvJR~XlC_)2&umMTw zeqc!;Kt)G&8*f{W&6i}r_tKR%BGKEf5{O20+V5Dem9Jq<+h!yebc7Ectf5Vy)Gm3* zn|aax=#$Rr>9w+VN;mLw`{Is&I0N&@@O%)&8&GBz<)$;dacO7c;@n`18GF`Bg#VcM zM2tzK&&9XRf9#fD9RKU8X1Up!_1wFsxn?JpBc?Td3*%&u)*X)kxqRO=LBQ?g5$2(8 zuPxw~R-%JU=$1#kW>`@d<0(S2y|D9{C(B@8?@4{VgO;g_ILi_y7VcFBvJ1h(b#1Mj zxuHrA}10J#vxuP|d`;>wc z4h2XpZM@i43`&p;euLcDBXvrpJUz4sbz?6}D^tFyjqu?1o|loG*YwpG>e>!tVfh() zsUqyAGObTbJ$GqeD1Ov>_>{3{c{m(X@gi4Bqz-<^UVXTfb|me~xi;J#n(;L8oP8Yb zkwm}qgTJY^;ei$zk$gW$I51h?FA)mO3#n_)pOFl8Nr%3{wB_BUQsGp1grndxZH7rX5=qhtsm$)v`@Pb#439zZ(2R4Bsu@x^o!5u}0 z7Tj_6qXFp?v^mt=`U7}NvoV}EWE|d9Gmie0D)lf9X@GzNoWpLtO zu)f2XdyCfaD)>v|?)CiDTvoFL!w(77D|Dp0B&ZcZ@TBXwYrU^5C<5nD-a0*EkoG=0 zQxV%zzJx>@tvSQPZt{b=iT*({q$y<}n=$^xOS#mi?pADyPT{yHAFVleo*c(L-?d9W zFi;2e#Wz(vfGHAd#o@t!(uw6@+XL0;nXe?>e+I+{)YpZwlK69qbc2z42qg=X`YU~5|U(IOB$#= zGyL!6c-odmj7MX*-`$y*X|Busr!T`lc-lJY=@D2uT-QoO|Jr_H<_+u|PJ!~sAAB~$ zWq*ug*e)=cwxv}WajDyWUij@OnE<;qUKX*u!q``8x!em|KU?flkE__wa#b0p>d=)* zssXu=vur`6E&G#qu$al2EhxcVdxCZRZUs>iO0@-fFN}JC2e;N{mnB$;9fB#*V8a)} zP$`1!`B_vD3M7u`_C-&ti?P(+OwW!2tMb3%^m|v>2?HMc%g;(?;VZmha((OId8-e0 z(=G#Bfnv^Q!3DptpVpW!75e`jP|u>peIhV`KMve>f=>xnOk2rJMi8#AA`g?re%p0x&{YRBUM|A+$9D%Ca>v?aSeT8yqogMqA z&ell3s!H`FT&V{U=6XjvH3oJfx0N5MKfIUgX|y5JRT|{1-dCj`eu1uBpSu2sm_8TF z{~KK(?Cb=vbD*YSQn7HdHU<7FI~!S=8an|gQ6O5t33yJ{P{mY(*ww-bKnwt45gZ&$ z&4}#{jjasLO=*}E9qde;jZGb>?M=*pVhk*d?97ZToHR@_rtYqG4knJ&G;sgcWMOA3 z281IJQ;YGiG6ReMGP5zWuyU|+urV-mP%$%80p;ZEO#Uko6$e9mds7o2w!zTa(G-qJ zQAJ#XQNr2U+Q`t>7KnMERsmQz5(B^gwuhcr&D6mW*flX5Be2{s2RADx2Lmf3=l`@5 zC=a|hSqm3aVxUnROk$=+7KXMo#8&o(P5?(!Lt>ZzaXBX=Dr=mPcpb1Yhg;)jkwJU@$f-DIJOqjF`MoyyiqWU5Kb23xa zeAtWLK&+dw9h*Z__iKK}H`(&DE9r}I;heq(ltfbK33ub{R>^#}<_c>Q-#hMCX>x6J9=+d%sFLyOSNW4 zRdMsuZ0&jwc#le}WCNuoxmuwk=nmf>yyO8EPLHrS6amus&Z;wht$%3X3iI7`c`I(8RSw4?=2KkT4;&n*%Q86yU8g9pFnYA^yoB7h+1)c|qTo&BPKNjKC5v?^PXN=3XQtfWRCxqZ51hBgSV zSEBI@z|&+q9cVVA)UP)kdN_UG!0GSP*a2V&0yjXp5XeX|fk7y&%A*J(GjLR<%Mi?0 z^8L{Yxep)!&;@DtaW*ahkYQQ^2>@2pDX^{qx`4Ck6d1`q+eX{Qw;<16y+(mX@qTXu z!Bv=5{(kUnVqCq&E3_DYQ2_5WCJb^Q8NhSq5H>cz7$7-)i9!fXH62s1LCFUzpHCo~ zNydjbnMWYmA^sg{vLIW+G3eVi{wn$^{SJAW$iUXCT>srR81CnyISf;P1^auIc0X=w zkPCE`yc>>=aHeF3up5SssJ2jtJoUN|8S?28%mXB*4XRw|Ni5eCZ51Uz9maVVi9viW zcRn^pH1Q}Erpdr{x_#QIUF#gO(WlWu1jiZK21HI!m2yiGPpm_z3_?=^Ph^gjrcG@+ z30gUb+-!yZ@%#>!h#E)ZDB&-o_O!&zB&rgIX+$$JVyrZ6d1c<{bVHDe@k)#f7^1HX zZQHrfUV);Z=#RQotLawi`O)YEBc`SNY;j(3AWM}!qDx*c8QpUw*ahbTf@Da~R;)1W zY~MtxE|nk9G981ebZ$ztijVuE10)1jZ5qjf&^@`sDEEE`1NDT?P(Qwsh(vT*V|uQR zOqUe`d5(=u0BBg6M+dx&h%{V!AOWpKwdw;DS`SteFZ7WC64A}5HcY_IF2xh`;hOGz z8Yci9un(a~1vbKS>L=vL`3HawmX&RqRzH5r%WvMp3{kEb9UKs$ru| z5bHfc1|$0Gi*!f>U@SUIG29910zV@~Ug~@BpNahL^f-D(ro5AaJkwIJF$;EE><2@U z^3u*AHPJ*<6+L&z3#e6M5>;(I(T;G+4w}bXs0_G{+&Cj923)LhSKcgpBCqzTM zyydRy+X`59P@w99Y2h+tY8R%xrpWFjqo;O|#&4%V)GoeIa{4`lisyP*!EifJLUnIA z?AcmedCMR4TGGq#)GjrV0X~bAK*hS~S}@QcLzm8=(+LRwC`9Tro+(5Ho?(P*TXcd4 z8X=WfgJKIgaq#z5Ynl+n7Mgdu6>on$h_{cik+YGa|7R^;w8_ZTw@XmZ88?p+EZ8Ui z55T(At!EH)uP{3!--~WPi#<$qheWrK8#cc19#Z_&H$uqa=^xeaNISpm!J;E&eKN1f zflmaIBKKde6|ern(ErOG(}p*LEDPjlx>a$%At=!RF1j@IopQ(B9yGcWSY_oO=enhB z3F5GajmDGFqv}Mc&btwd-y-gWtIm%u)TKhV&HDv9QiFO5PmlYOaK`*`lL^?D@d;L> zx}0te-+xVfopA*4nePAF!Q2W)od4xvo`AU^)>Fb&aP|+CbT6U{l2u3%iXUu_tme~= zveMNUjcScF{fDRwkrPH!TXN5Sq@z^87awR9F`Lu_BB93ZN09ViegiISQ7dqaM5n3( zG7TL_o?gpZs7lB)A*!-~hdg*|5IkY7W6-WVWNWYw0}zA&5@rO4S`2IOwLYZUZ|7iz z23*VFj{y^TUG9^<^W1cFCf;Wy@W1}X{Ogx#fcf1X{;&VqHc}ci z{5E4NG-jW7Erc4#Z?uK;c)a-auzd+xVJKQZzOV~F^spi!6*&4pslIJq3T1*z0GXaCvuIQw6VY1gHLjYxvo)7P{zmw0!5o!$2& z83N2g;bIx$XygJQbd(?cpce(O!j`k?;S&$@u|JggE5`Rc7fACFla zG!^>UcDUeYK^0PdERVmM0#Cb zoqa99<1>4yku3*nU)cW!@(-4q-nP5{QLq_m&CIuKZA4l|>K zJ=^^Nk4GdB=bX{Lefk};6n?QAo9*|P|KnUQWCwh-f;H9s>-g*&HB1{-05qz;Xa7GnyOh7 zwNlx|7fpg+gwrExCpr}zLOoi=!c}^ZjhPE)lxJ^UF?nQFi+!YNEGyd`uR?bvnt3NP zeA9o!y6Z^jE;Fr%YhCofGT`_@G#0l5LkKAp(#|Vv;C_|NSk@a)(GK~~*i(p)cU|giA z%=6z^PL*cp-q2I95uxmQXXub)c~qrh5&b45SCr&sVUTwixo_ zdu{TB{RA|aSB`j^oUulPqb&K@SI!ttS7^}eWFOyKMIO$RGSo|}7x7~|aUGnuzwa%$ zR%q&(*W2}!8}owNx;ro8X~3imJ_Xn&dOzhoDhozy>k+W&c|45LcbKnyP#?3cL<-KK zT2kLkC=nr6$o{l53>kFr`${jEx{c^!Y`g{HNFg`3)X!!BVg-@}fk^^}ok z`OFpP%DCg}o=VlQZEQtO!o5o2u#5tM`}xg$fL+S|lWEH^g93|t)(xxp9`=O(d|*>R z6pC_Z2p#eap!T)B7pfN3DUfg){vF?XCG^WXgjlm`$*Bn&f1y`2)2KY+hoWwE(8Qr!8H6uh4B}haHt%!LE8PFP58Q7^I!&yh0hS&p*JDUHwEdvgT zYA>j0=Z_9kBvb~%hwMgp&A08|d*^oqIt88s{r?+-nS10;GqG!_yotx6{>w{8yOqdZ zaNDQ%!|x6B3H%az9r^#nI1xI5QX*FD@sEP}KZ*QHNnnY#WxxY*f&Xtx%?ydr=Q+x^ zBixGuiJK^kp0}cYm%K+s$DfEI9Lf6!7S)};DXaQG zJnmqj<^r_Kuch1N+je%o>AICW9iWX$yQDqkXWD^+R?28SqZ-rw15~bX)j_r4N%I9` zFEHKi_i0w_#!lGgzq9mHV~-%;VcbMb+$l_OF0?jLHK5v4V5?0{tWMOcKDGTmi9i(e zQ@DE$jkBzAcLTzY| zxhaHs){~}2J~g{noMSD@)|9#)Q(G&XN9~d(HKtD-e+{TNwX1jcEo1jSW1M-dt~)A! zBCd^BB`jNh%1ENbq1e&gVUru<*+-VUuwk2$kH{YD%l88!sxNScMECXoJs#ocWa!}J X1`MOYad0w!XXS>Ypb%G(fct*{i^jr} literal 0 HcmV?d00001 diff --git a/third_party/mbedtls/repo/docs/architecture/Makefile b/third_party/mbedtls/repo/docs/architecture/Makefile new file mode 100644 index 000000000..d8db2e067 --- /dev/null +++ b/third_party/mbedtls/repo/docs/architecture/Makefile @@ -0,0 +1,26 @@ +PANDOC = pandoc + +default: all + +all_markdown = \ + mbed-crypto-storage-specification.md \ + testing/driver-interface-test-strategy.md \ + testing/invasive-testing.md \ + testing/test-framework.md \ + # This line is intentionally left blank + +html: $(all_markdown:.md=.html) +pdf: $(all_markdown:.md=.pdf) +all: html pdf + +.SUFFIXES: +.SUFFIXES: .md .html .pdf + +.md.html: + $(PANDOC) -o $@ $< +.md.pdf: + $(PANDOC) -o $@ $< + +clean: + rm -f *.html *.pdf + rm -f testing/*.html testing/*.pdf diff --git a/third_party/mbedtls/repo/docs/architecture/mbed-crypto-storage-specification.md b/third_party/mbedtls/repo/docs/architecture/mbed-crypto-storage-specification.md new file mode 100644 index 000000000..914bca3bb --- /dev/null +++ b/third_party/mbedtls/repo/docs/architecture/mbed-crypto-storage-specification.md @@ -0,0 +1,316 @@ +Mbed Crypto storage specification +================================= + +This document specifies how Mbed Crypto uses storage. + +Mbed Crypto may be upgraded on an existing device with the storage preserved. Therefore: + +1. Any change may break existing installations and may require an upgrade path. +1. This document retains historical information about all past released versions. Do not remove information from this document unless it has always been incorrect or it is about a version that you are sure was never released. + +Mbed Crypto 0.1.0 +----------------- + +Tags: mbedcrypto-0.1.0b, mbedcrypto-0.1.0b2 + +Released in November 2018.
+Integrated in Mbed OS 5.11. + +Supported backends: + +* [PSA ITS](#file-namespace-on-its-for-0.1.0) +* [C stdio](#file-namespace-on-stdio-for-0.1.0) + +Supported features: + +* [Persistent transparent keys](#key-file-format-for-0.1.0) designated by a [slot number](#key-names-for-0.1.0). +* [Nonvolatile random seed](#nonvolatile-random-seed-file-format-for-0.1.0) on ITS only. + +This is a beta release, and we do not promise backward compatibility, with one exception: + +> On Mbed OS, if a device has a nonvolatile random seed file produced with Mbed OS 5.11.x and is upgraded to a later version of Mbed OS, the nonvolatile random seed file is preserved or upgraded. + +We do not make any promises regarding key storage, or regarding the nonvolatile random seed file on other platforms. + +### Key names for 0.1.0 + +Information about each key is stored in a dedicated file whose name is constructed from the key identifier. The way in which the file name is constructed depends on the storage backend. The content of the file is described [below](#key-file-format-for-0.1.0). + +The valid values for a key identifier are the range from 1 to 0xfffeffff. This limitation on the range is not documented in user-facing documentation: according to the user-facing documentation, arbitrary 32-bit values are valid. + +The code uses the following constant in an internal header (note that despite the name, this value is actually one plus the maximum permitted value): + + #define PSA_MAX_PERSISTENT_KEY_IDENTIFIER 0xffff0000 + +There is a shared namespace for all callers. + +### Key file format for 0.1.0 + +All integers are encoded in little-endian order in 8-bit bytes. + +The layout of a key file is: + +* magic (8 bytes): `"PSA\0KEY\0"` +* version (4 bytes): 0 +* type (4 bytes): `psa_key_type_t` value +* policy usage flags (4 bytes): `psa_key_usage_t` value +* policy usage algorithm (4 bytes): `psa_algorithm_t` value +* key material length (4 bytes) +* key material: output of `psa_export_key` +* Any trailing data is rejected on load. + +### Nonvolatile random seed file format for 0.1.0 + +The nonvolatile random seed file contains a seed for the random generator. If present, it is rewritten at each boot as part of the random generator initialization. + +The file format is just the seed as a byte string with no metadata or encoding of any kind. + +### File namespace on ITS for 0.1.0 + +Assumption: ITS provides a 32-bit file identifier namespace. The Crypto service can use arbitrary file identifiers and no other part of the system accesses the same file identifier namespace. + +* File 0: unused. +* Files 1 through 0xfffeffff: [content](#key-file-format-for-0.1.0) of the [key whose identifier is the file identifier](#key-names-for-0.1.0). +* File 0xffffff52 (`PSA_CRYPTO_ITS_RANDOM_SEED_UID`): [nonvolatile random seed](#nonvolatile-random-seed-file-format-for-0.1.0). +* Files 0xffff0000 through 0xffffff51, 0xffffff53 through 0xffffffff: unused. + +### File namespace on stdio for 0.1.0 + +Assumption: C stdio, allowing names containing lowercase letters, digits and underscores, of length up to 23. + +An undocumented build-time configuration value `CRYPTO_STORAGE_FILE_LOCATION` allows storing the key files in a directory other than the current directory. This value is simply prepended to the file name (so it must end with a directory separator to put the keys in a different directory). + +* `CRYPTO_STORAGE_FILE_LOCATION "psa_key_slot_0"`: used as a temporary file. Must be writable. May be overwritten or deleted if present. +* `sprintf(CRYPTO_STORAGE_FILE_LOCATION "psa_key_slot_%lu", key_id)` [content](#key-file-format-for-0.1.0) of the [key whose identifier](#key-names-for-0.1.0) is `key_id`. +* Other files: unused. + +Mbed Crypto 1.0.0 +----------------- + +Tags: mbedcrypto-1.0.0d4, mbedcrypto-1.0.0 + +Released in February 2019.
+Integrated in Mbed OS 5.12. + +Supported integrations: + +* [PSA platform](#file-namespace-on-a-psa-platform-for-1.0.0) +* [library using PSA ITS](#file-namespace-on-its-as-a-library-for-1.0.0) +* [library using C stdio](#file-namespace-on-stdio-for-1.0.0) + +Supported features: + +* [Persistent transparent keys](#key-file-format-for-1.0.0) designated by a [key identifier and owner](#key-names-for-1.0.0). +* [Nonvolatile random seed](#nonvolatile-random-seed-file-format-for-1.0.0) on ITS only. + +Backward compatibility commitments: TBD + +### Key names for 1.0.0 + +Information about each key is stored in a dedicated file designated by the key identifier. In integrations where there is no concept of key owner (in particular, in library integrations), the key identifier is exactly the key identifier as defined in the PSA Cryptography API specification (`psa_key_id_t`). In integrations where there is a concept of key owner (integration into a service for example), the key identifier is made of an owner identifier (its semantics and type are integration specific) and of the key identifier (`psa_key_id_t`) from the key owner point of view. + +The way in which the file name is constructed from the key identifier depends on the storage backend. The content of the file is described [below](#key-file-format-for-1.0.0). + +* Library integration: the key file name is just the key identifier as defined in the PSA crypto specification. This is a 32-bit value. +* PSA service integration: the key file name is `(uint32_t)owner_uid << 32 | key_id` where `key_id` is the key identifier from the owner point of view and `owner_uid` (of type `int32_t`) is the calling partition identifier provided to the server by the partition manager. This is a 64-bit value. + +### Key file format for 1.0.0 + +The layout is identical to [0.1.0](#key-file-format-for-0.1.0) so far. However note that the encoding of key types, algorithms and key material has changed, therefore the storage format is not compatible (despite using the same value in the version field so far). + +### Nonvolatile random seed file format for 1.0.0 + +[Identical to 0.1.0](#nonvolatile-random-seed-file-format-for-0.1.0). + +### File namespace on a PSA platform for 1.0.0 + +Assumption: ITS provides a 64-bit file identifier namespace. The Crypto service can use arbitrary file identifiers and no other part of the system accesses the same file identifier namespace. + +Assumption: the owner identifier is a nonzero value of type `int32_t`. + +* Files 0 through 0xffffff51, 0xffffff53 through 0xffffffff: unused, reserved for internal use of the crypto library or crypto service. +* File 0xffffff52 (`PSA_CRYPTO_ITS_RANDOM_SEED_UID`): [nonvolatile random seed](#nonvolatile-random-seed-file-format-for-0.1.0). +* Files 0x100000000 through 0xffffffffffff: [content](#key-file-format-for-1.0.0) of the [key whose identifier is the file identifier](#key-names-for-1.0.0). The upper 32 bits determine the owner. + +### File namespace on ITS as a library for 1.0.0 + +Assumption: ITS provides a 64-bit file identifier namespace. The entity using the crypto library can use arbitrary file identifiers and no other part of the system accesses the same file identifier namespace. + +This is a library integration, so there is no owner. The key file identifier is identical to the key identifier. + +* File 0: unused. +* Files 1 through 0xfffeffff: [content](#key-file-format-for-1.0.0) of the [key whose identifier is the file identifier](#key-names-for-1.0.0). +* File 0xffffff52 (`PSA_CRYPTO_ITS_RANDOM_SEED_UID`): [nonvolatile random seed](#nonvolatile-random-seed-file-format-for-1.0.0). +* Files 0xffff0000 through 0xffffff51, 0xffffff53 through 0xffffffff, 0x100000000 through 0xffffffffffffffff: unused. + +### File namespace on stdio for 1.0.0 + +This is a library integration, so there is no owner. The key file identifier is identical to the key identifier. + +[Identical to 0.1.0](#file-namespace-on-stdio-for-0.1.0). + +### Upgrade from 0.1.0 to 1.0.0. + +* Delete files 1 through 0xfffeffff, which contain keys in a format that is no longer supported. + +### Suggested changes to make before 1.0.0 + +The library integration and the PSA platform integration use different sets of file names. This is annoyingly non-uniform. For example, if we want to store non-key files, we have room in different ranges (0 through 0xffffffff on a PSA platform, 0xffff0000 through 0xffffffffffffffff in a library integration). + +It would simplify things to always have a 32-bit owner, with a nonzero value, and thus reserve the range 0–0xffffffff for internal library use. + +Mbed Crypto 1.1.0 +----------------- + +Tags: mbedcrypto-1.1.0 + +Released in early June 2019.
+Integrated in Mbed OS 5.13. + +Identical to [1.0.0](#mbed-crypto-1.0.0) except for some changes in the key file format. + +### Key file format for 1.1.0 + +The key file format is identical to [1.0.0](#key-file-format-for-1.0.0), except for the following changes: + +* A new policy field, marked as [NEW:1.1.0] below. +* The encoding of key types, algorithms and key material has changed, therefore the storage format is not compatible (despite using the same value in the version field so far). + +A self-contained description of the file layout follows. + +All integers are encoded in little-endian order in 8-bit bytes. + +The layout of a key file is: + +* magic (8 bytes): `"PSA\0KEY\0"` +* version (4 bytes): 0 +* type (4 bytes): `psa_key_type_t` value +* policy usage flags (4 bytes): `psa_key_usage_t` value +* policy usage algorithm (4 bytes): `psa_algorithm_t` value +* policy enrollment algorithm (4 bytes): `psa_algorithm_t` value [NEW:1.1.0] +* key material length (4 bytes) +* key material: output of `psa_export_key` +* Any trailing data is rejected on load. + +Mbed Crypto TBD +--------------- + +Tags: TBD + +Released in TBD 2019.
+Integrated in Mbed OS TBD. + +### Changes introduced in TBD + +* The layout of a key file now has a lifetime field before the type field. +* Key files can store references to keys in a secure element. In such key files, the key material contains the slot number. + +### File namespace on a PSA platform on TBD + +Assumption: ITS provides a 64-bit file identifier namespace. The Crypto service can use arbitrary file identifiers and no other part of the system accesses the same file identifier namespace. + +Assumption: the owner identifier is a nonzero value of type `int32_t`. + +* Files 0 through 0xfffeffff: unused. +* Files 0xffff0000 through 0xffffffff: reserved for internal use of the crypto library or crypto service. See [non-key files](#non-key-files-on-tbd). +* Files 0x100000000 through 0xffffffffffff: [content](#key-file-format-for-1.0.0) of the [key whose identifier is the file identifier](#key-names-for-1.0.0). The upper 32 bits determine the owner. + +### File namespace on ITS as a library on TBD + +Assumption: ITS provides a 64-bit file identifier namespace. The entity using the crypto library can use arbitrary file identifiers and no other part of the system accesses the same file identifier namespace. + +This is a library integration, so there is no owner. The key file identifier is identical to the key identifier. + +* File 0: unused. +* Files 1 through 0xfffeffff: [content](#key-file-format-for-1.0.0) of the [key whose identifier is the file identifier](#key-names-for-1.0.0). +* Files 0xffff0000 through 0xffffffff: reserved for internal use of the crypto library or crypto service. See [non-key files](#non-key-files-on-tbd). +* Files 0x100000000 through 0xffffffffffffffff: unused. + +### Non-key files on TBD + +File identifiers in the range 0xffff0000 through 0xffffffff are reserved for internal use in Mbed Crypto. + +* Files 0xfffffe02 through 0xfffffeff (`PSA_CRYPTO_SE_DRIVER_ITS_UID_BASE + lifetime`): secure element driver storage. The content of the file is the secure element driver's persistent data. +* File 0xffffff52 (`PSA_CRYPTO_ITS_RANDOM_SEED_UID`): [nonvolatile random seed](#nonvolatile-random-seed-file-format-for-1.0.0). +* File 0xffffff54 (`PSA_CRYPTO_ITS_TRANSACTION_UID`): [transaction file](#transaction-file-format-for-tbd). +* Other files are unused and reserved for future use. + +### Key file format for TBD + +All integers are encoded in little-endian order in 8-bit bytes except where otherwise indicated. + +The layout of a key file is: + +* magic (8 bytes): `"PSA\0KEY\0"`. +* version (4 bytes): 0. +* lifetime (4 bytes): `psa_key_lifetime_t` value. +* type (4 bytes): `psa_key_type_t` value. +* policy usage flags (4 bytes): `psa_key_usage_t` value. +* policy usage algorithm (4 bytes): `psa_algorithm_t` value. +* policy enrollment algorithm (4 bytes): `psa_algorithm_t` value. +* key material length (4 bytes). +* key material: + * For a transparent key: output of `psa_export_key`. + * For an opaque key (unified driver interface): driver-specific opaque key blob. + * For an opaque key (key in a secure element): slot number (8 bytes), in platform endianness. +* Any trailing data is rejected on load. + +### Transaction file format for TBD + +The transaction file contains data about an ongoing action that cannot be completed atomically. It exists only if there is an ongoing transaction. + +All integers are encoded in platform endianness. + +All currently existing transactions concern a key in a secure element. + +The layout of a transaction file is: + +* type (2 bytes): the [transaction type](#transaction-types-on-tbd). +* unused (2 bytes) +* lifetime (4 bytes): `psa_key_lifetime_t` value that corresponds to a key in a secure element. +* slot number (8 bytes): `psa_key_slot_number_t` value. This is the unique designation of the key for the secure element driver. +* key identifier (4 bytes in a library integration, 8 bytes on a PSA platform): the internal representation of the key identifier. On a PSA platform, this encodes the key owner in the same way as [in file identifiers for key files](#file-namespace-on-a-psa-platform-on-tbd)). + +#### Transaction types on TBD + +* 0x0001: key creation. The following locations may or may not contain data about the key that is being created: + * The slot in the secure element designated by the slot number. + * The file containing the key metadata designated by the key identifier. + * The driver persistent data. +* 0x0002: key destruction. The following locations may or may not still contain data about the key that is being destroyed: + * The slot in the secure element designated by the slot number. + * The file containing the key metadata designated by the key identifier. + * The driver persistent data. + +Mbed Crypto TBD +--------------- + +Tags: TBD + +Released in TBD 2020.
+Integrated in Mbed OS TBD. + +### Changes introduced in TBD + +* The type field has been split into a type and a bits field of 2 bytes each. + +### Key file format for TBD + +All integers are encoded in little-endian order in 8-bit bytes except where otherwise indicated. + +The layout of a key file is: + +* magic (8 bytes): `"PSA\0KEY\0"`. +* version (4 bytes): 0. +* lifetime (4 bytes): `psa_key_lifetime_t` value. +* type (2 bytes): `psa_key_type_t` value. +* bits (2 bytes): `psa_key_bits_t` value. +* policy usage flags (4 bytes): `psa_key_usage_t` value. +* policy usage algorithm (4 bytes): `psa_algorithm_t` value. +* policy enrollment algorithm (4 bytes): `psa_algorithm_t` value. +* key material length (4 bytes). +* key material: + * For a transparent key: output of `psa_export_key`. + * For an opaque key (unified driver interface): driver-specific opaque key blob. + * For an opaque key (key in a secure element): slot number (8 bytes), in platform endianness. +* Any trailing data is rejected on load. diff --git a/third_party/mbedtls/repo/docs/architecture/testing/driver-interface-test-strategy.md b/third_party/mbedtls/repo/docs/architecture/testing/driver-interface-test-strategy.md new file mode 100644 index 000000000..d6769da0b --- /dev/null +++ b/third_party/mbedtls/repo/docs/architecture/testing/driver-interface-test-strategy.md @@ -0,0 +1,115 @@ +# Mbed Crypto driver interface test strategy + +This document describes the test strategy for the driver interfaces in Mbed Crypto. Mbed Crypto has interfaces for secure element drivers, accelerator drivers and entropy drivers. This document is about testing Mbed Crypto itself; testing drivers is out of scope. + +The driver interfaces are standardized through PSA Cryptography functional specifications. + +## Secure element driver interface + +The secure element driver interface (SE interface for short) is defined by [`psa/crypto_se_driver.h`](../../../include/psa/crypto_se_driver.h). This is an interface between Mbed Crypto and one or more third-party drivers. + +The SE interface consists of one function provided by Mbed Crypto (`psa_register_se_driver`) and many functions that drivers must implement. To make a driver usable by Mbed Crypto, the initialization code must call `psa_register_se_driver` with a structure that describes the driver. The structure mostly contains function pointers, pointing to the driver's methods. All calls to a driver function are triggered by a call to a PSA crypto API function. + +### SE driver interface unit tests + +This section describes unit tests that must be implemented to validate the secure element driver interface. Note that a test case may cover multiple requirements; for example a “good case” test can validate that the proper function is called, that it receives the expected inputs and that it produces the expected outputs. + +Many SE driver interface unit tests could be covered by running the existing API tests with a key in a secure element. + +#### SE driver registration + +* Test `psa_register_se_driver` with valid and with invalid arguments. +* Make at least one failing call to `psa_register_se_driver` followed by a successful call. +* Make at least one test that successfully registers the maximum number of drivers and fails to register one more. + +#### Dispatch to SE driver + +For each API function that can lead to a driver call (more precisely, for each driver method call site, but this is practically equivalent): + +* Make at least one test with a key in a secure element that checks that the driver method is called. A few API functions involve multiple driver methods; these should validate that all the expected driver methods are called. +* Make at least one test with a key that is not in a secure element that checks that the driver method is not called. +* Make at least one test with a key in a secure element with a driver that does not have the requisite method (i.e. the method pointer is `NULL`) but has the substructure containing that method, and check that the return value is `PSA_ERROR_NOT_SUPPORTED`. +* Make at least one test with a key in a secure element with a driver that does not have the substructure containing that method (i.e. the pointer to the substructure is `NULL`), and check that the return value is `PSA_ERROR_NOT_SUPPORTED`. +* At least one test should register multiple drivers with a key in each driver and check that the expected driver is called. This does not need to be done for all operations (use a white-box approach to determine if operations may use different code paths to choose the driver). +* At least one test should register the same driver structure with multiple lifetime values and check that the driver receives the expected lifetime value. + +Some methods only make sense as a group (for example a driver that provides the MAC methods must provide all or none). In those cases, test with all of them null and none of them null. + +#### SE driver inputs + +For each API function that can lead to a driver call (more precisely, for each driver method call site, but this is practically equivalent): + +* Wherever the specification guarantees parameters that satisfy certain preconditions, check these preconditions whenever practical. +* If the API function can take parameters that are invalid and must not reach the driver, call the API function with such parameters and verify that the driver method is not called. +* Check that the expected inputs reach the driver. This may be implicit in a test that checks the outputs if the only realistic way to obtain the correct outputs is to start from the expected inputs (as is often the case for cryptographic material, but not for metadata). + +#### SE driver outputs + +For each API function that leads to a driver call, call it with parameters that cause a driver to be invoked and check how Mbed Crypto handles the outputs. + +* Correct outputs. +* Incorrect outputs such as an invalid output length. +* Expected errors (e.g. `PSA_ERROR_INVALID_SIGNATURE` from a signature verification method). +* Unexpected errors. At least test that if the driver returns `PSA_ERROR_GENERIC_ERROR`, this is propagated correctly. + +Key creation functions invoke multiple methods and need more complex error handling: + +* Check the consequence of errors detected at each stage (slot number allocation or validation, key creation method, storage accesses). +* Check that the storage ends up in the expected state. At least make sure that no intermediate file remains after a failure. + +#### Persistence of SE keys + +The following tests must be performed at least one for each key creation method (import, generate, ...). + +* Test that keys in a secure element survive `psa_close_key(); psa_open_key()`. +* Test that keys in a secure element survive `mbedtls_psa_crypto_free(); psa_crypto_init()`. +* Test that the driver's persistent data survives `mbedtls_psa_crypto_free(); psa_crypto_init()`. +* Test that `psa_destroy_key()` does not leave any trace of the key. + +#### Resilience for SE drivers + +Creating or removing a key in a secure element involves multiple storage modifications (M1, ..., Mn). If the operation is interrupted by a reset at any point, it must be either rolled back or completed. + +* For each potential interruption point (before M1, between M1 and M2, ..., after Mn), call `mbedtls_psa_crypto_free(); psa_crypto_init()` at that point and check that this either rolls back or completes the operation that was started. +* This must be done for each key creation method and for key destruction. +* This must be done for each possible flow, including error cases (e.g. a key creation that fails midway due to `OUT_OF_MEMORY`). +* The recovery during `psa_crypto_init` can itself be interrupted. Test those interruptions too. +* Two things need to be tested: the key that is being created or destroyed, and the driver's persistent storage. +* Check both that the storage has the expected content (this can be done by e.g. using a key that is supposed to be present) and does not have any unexpected content (for keys, this can be done by checking that `psa_open_key` fails with `PSA_ERRROR_DOES_NOT_EXIST`). + +This requires instrumenting the storage implementation, either to force it to fail at each point or to record successive storage states and replay each of them. Each `psa_its_xxx` function call is assumed to be atomic. + +### SE driver system tests + +#### Real-world use case + +We must have at least one driver that is close to real-world conditions: + +* With its own source tree. +* Running on actual hardware. +* Run the full driver validation test suite (which does not yet exist). +* Run at least one test application (e.g. the Mbed OS TLS example). + +This requirement shall be fulfilled by the [Microchip ATECC508A driver](https://github.com/ARMmbed/mbed-os-atecc608a/). + +#### Complete driver + +We should have at least one driver that covers the whole interface: + +* With its own source tree. +* Implementing all the methods. +* Run the full driver validation test suite (which does not yet exist). + +A PKCS#11 driver would be a good candidate. It would be useful as part of our product offering. + +## Accelerator driver interface + +The accelerator driver interface is defined by [`psa/crypto_accel_driver.h`](../../../include/psa/crypto_accel_driver.h). + +TODO + +## Entropy driver interface + +The entropy driver interface is defined by [`psa/crypto_entropy_driver.h`](../../../include/psa/crypto_entropy_driver.h). + +TODO diff --git a/third_party/mbedtls/repo/docs/architecture/testing/invasive-testing.md b/third_party/mbedtls/repo/docs/architecture/testing/invasive-testing.md new file mode 100644 index 000000000..de611a567 --- /dev/null +++ b/third_party/mbedtls/repo/docs/architecture/testing/invasive-testing.md @@ -0,0 +1,367 @@ +# Mbed TLS invasive testing strategy + +## Introduction + +In Mbed TLS, we use black-box testing as much as possible: test the documented behavior of the product, in a realistic environment. However this is not always sufficient. + +The goal of this document is to identify areas where black-box testing is insufficient and to propose solutions. + +This is a test strategy document, not a test plan. A description of exactly what is tested is out of scope. + +This document is structured as follows: + +* [“Rules”](#rules) gives general rules and is written for brevity. +* [“Requirements”](#requirements) explores the reasons why invasive testing is needed and how it should be done. +* [“Possible approaches”](#possible-approaches) discusses some general methods for non-black-box testing. +* [“Solutions”](#solutions) explains how we currently solve, or intend to solve, specific problems. + +### TLS + +This document currently focuses on data structure manipulation and storage, which is what the crypto/keystore and X.509 parts of the library are about. More work is needed to fully take TLS into account. + +## Rules + +Always follow these rules unless you have a good reason not to. If you deviate, document the rationale somewhere. + +See the section [“Possible approaches”](#possible-approaches) for a rationale. + +### Interface design for testing + +Do not add test-specific interfaces if there's a practical way of doing it another way. All public interfaces should be useful in at least some configurations. Features with a significant impact on the code size or attack surface should have a compile-time guard. + +### Reliance on internal details + +In unit tests and in test programs, it's ok to include header files from `library/`. Do not define non-public interfaces in public headers (`include/mbedtls` has `*_internal.h` headers for legacy reasons, but this approach is deprecated). In contrast, sample programs must not include header files from `library/`. + +Sometimes it makes sense to have unit tests on functions that aren't part of the public API. Declare such functions in `library/*.h` and include the corresponding header in the test code. If the function should be `static` for optimization but can't be `static` for testing, declare it as `MBEDTLS_STATIC_TESTABLE`, and make the tests that use it depend on `MBEDTLS_TEST_HOOKS` (see [“rules for compile-time options”](#rules-for-compile-time-options)). + +If test code or test data depends on internal details of the library and not just on its documented behavior, add a comment in the code that explains the dependency. For example: + +> ``` +> /* This test file is specific to the ITS implementation in PSA Crypto +> * on top of stdio. It expects to know what the stdio name of a file is +> * based on its keystore name. +> */ +> ``` + +> ``` +> # This test assumes that PSA_MAX_KEY_BITS (currently 65536-8 bits = 8191 bytes +> # and not expected to be raised any time soon) is less than the maximum +> # output from HKDF-SHA512 (255*64 = 16320 bytes). +> ``` + +### Rules for compile-time options + +If the most practical way to test something is to add code to the product that is only useful for testing, do so, but obey the following rules. For more information, see the [rationale](#guidelines-for-compile-time-options). + +* **Only use test-specific code when necessary.** Anything that can be tested through the documented API must be tested through the documented API. +* **Test-specific code must be guarded by `#if defined(MBEDTLS_TEST_HOOKS)`**. Do not create fine-grained guards for test-specific code. +* **Do not use `MBEDTLS_TEST_HOOKS` for security checks or assertions.** Security checks belong in the product. +* **Merely defining `MBEDTLS_TEST_HOOKS` must not change the behavior**. It may define extra functions. It may add fields to structures, but if so, make it very clear that these fields have no impact on non-test-specific fields. +* **Where tests must be able to change the behavior, do it by function substitution.** See [“rules for function substitution”](#rules-for-function-substitution) for more details. + +#### Rules for function substitution + +This section explains how to replace a library function `mbedtls_foo()` by alternative code for test purposes. That is, library code calls `mbedtls_foo()`, and there is a mechanism to arrange for these calls to invoke different code. + +Often `mbedtls_foo` is a macro which is defined to be a system function (like `mbedtls_calloc` or `mbedtls_fopen`), which we replace to mock or wrap the system function. This is useful to simulate I/O failure, for example. Note that if the macro can be replaced at compile time to support alternative platforms, the test code should be compatible with this compile-time configuration so that it works on these alternative platforms as well. + +Sometimes the substitutable function is a `static inline` function that does nothing (not a macro, to avoid accidentally skipping side effects in its parameters), to provide a hook for test code; such functions should have a name that starts with the prefix `mbedtls_test_hook_`. In such cases, the function should generally not modify its parameters, so any pointer argument should be const. The function should return void. + +With `MBEDTLS_TEST_HOOKS` set, `mbedtls_foo` is a global variable of function pointer type. This global variable is initialized to the system function, or to a function that does nothing. The global variable is defined in a header in the `library` directory such as `psa_crypto_invasive.h`. This is similar to the platform function configuration mechanism with `MBEDTLS_PLATFORM_xxx_ALT`. + +In unit test code that needs to modify the internal behavior: + +* The test function (or the whole test file) must depend on `MBEDTLS_TEST_HOOKS`. +* At the beginning of the test function, set the global function pointers to the desired value. +* In the test function's cleanup code, restore the global function pointers to their default value. + +## Requirements + +### General goals + +We need to balance the following goals, which are sometimes contradictory. + +* Coverage: we need to test behaviors which are not easy to trigger by using the API or which cannot be triggered deterministically, for example I/O failures. +* Correctness: we want to test the actual product, not a modified version, since conclusions drawn from a test of a modified product may not apply to the real product. +* Effacement: the product should not include features that are solely present for test purposes, since these increase the attack surface and the code size. +* Portability: tests should work on every platform. Skipping tests on certain platforms may hide errors that are only apparent on such platforms. +* Maintainability: tests should only enforce the documented behavior of the product, to avoid extra work when the product's internal or implementation-specific behavior changes. We should also not give the impression that whatever the tests check is guaranteed behavior of the product which cannot change in future versions. + +Where those goals conflict, we should at least mitigate the goals that cannot be fulfilled, and document the architectural choices and their rationale. + +### Problem areas + +#### Allocation + +Resource allocation can fail, but rarely does so in a typical test environment. How does the product cope if some allocations fail? + +Resources include: + +* Memory. +* Files in storage (PSA API only — in the Mbed TLS API, black-box unit tests are sufficient). +* Key slots (PSA API only). +* Key slots in a secure element (PSA SE HAL). +* Communication handles (PSA crypto service only). + +#### Storage + +Storage can fail, either due to hardware errors or to active attacks on trusted storage. How does the code cope if some storage accesses fail? + +We also need to test resilience: if the system is reset during an operation, does it restart in a correct state? + +#### Cleanup + +When code should clean up resources, how do we know that they have truly been cleaned up? + +* Zeroization of confidential data after use. +* Freeing memory. +* Freeing key slots. +* Freeing key slots in a secure element. +* Deleting files in storage (PSA API only). + +#### Internal data + +Sometimes it is useful to peek or poke internal data. + +* Check consistency of internal data (e.g. output of key generation). +* Check the format of files (which matters so that the product can still read old files after an upgrade). +* Inject faults and test corruption checks inside the product. + +## Possible approaches + +Key to requirement tables: + +* ++ requirement is fully met +* \+ requirement is mostly met +* ~ requirement is partially met but there are limitations +* ! requirement is somewhat problematic +* !! requirement is very problematic + +### Fine-grained public interfaces + +We can include all the features we want to test in the public interface. Then the tests can be truly black-box. The limitation of this approach is that this requires adding a lot of interfaces that are not useful in production. These interfaces have costs: they increase the code size, the attack surface, and the testing burden (exponentially, because we need to test all these interfaces in combination). + +As a rule, we do not add public interfaces solely for testing purposes. We only add public interfaces if they are also useful in production, at least sometimes. For example, the main purpose of `mbedtls_psa_crypto_free` is to clean up all resources in tests, but this is also useful in production in some applications that only want to use PSA Crypto during part of their lifetime. + +Mbed TLS traditionally has very fine-grained public interfaces, with many platform functions that can be substituted (`MBEDTLS_PLATFORM_xxx` macros). PSA Crypto has more opacity and less platform substitution macros. + +| Requirement | Analysis | +| ----------- | -------- | +| Coverage | ~ Many useful tests are not reasonably achievable | +| Correctness | ++ Ideal | +| Effacement | !! Requires adding many otherwise-useless interfaces | +| Portability | ++ Ideal; the additional interfaces may be useful for portability beyond testing | +| Maintainability | !! Combinatorial explosion on the testing burden | +| | ! Public interfaces must remain for backward compatibility even if the test architecture changes | + +### Fine-grained undocumented interfaces + +We can include all the features we want to test in undocumented interfaces. Undocumented interfaces are described in public headers for the sake of the C compiler, but are described as “do not use” in comments (or not described at all) and are not included in Doxygen-rendered documentation. This mitigates some of the downsides of [fine-grained public interfaces](#fine-grained-public-interfaces), but not all. In particular, the extra interfaces do increase the code size, the attack surface and the test surface. + +Mbed TLS traditionally has a few internal interfaces, mostly intended for cross-module abstraction leakage rather than for testing. For the PSA API, we favor [internal interfaces](#internal-interfaces). + +| Requirement | Analysis | +| ----------- | -------- | +| Coverage | ~ Many useful tests are not reasonably achievable | +| Correctness | ++ Ideal | +| Effacement | !! Requires adding many otherwise-useless interfaces | +| Portability | ++ Ideal; the additional interfaces may be useful for portability beyond testing | +| Maintainability | ! Combinatorial explosion on the testing burden | + +### Internal interfaces + +We can write tests that call internal functions that are not exposed in the public interfaces. This is nice when it works, because it lets us test the unchanged product without compromising the design of the public interface. + +A limitation is that these interfaces must exist in the first place. If they don't, this has mostly the same downside as public interfaces: the extra interfaces increase the code size and the attack surface for no direct benefit to the product. + +Another limitation is that internal interfaces need to be used correctly. We may accidentally rely on internal details in the tests that are not necessarily always true (for example that are platform-specific). We may accidentally use these internal interfaces in ways that don't correspond to the actual product. + +This approach is mostly portable since it only relies on C interfaces. A limitation is that the test-only interfaces must not be hidden at link time (but link-time hiding is not something we currently do). Another limitation is that this approach does not work for users who patch the library by replacing some modules; this is a secondary concern since we do not officially offer this as a feature. + +| Requirement | Analysis | +| ----------- | -------- | +| Coverage | ~ Many useful tests require additional internal interfaces | +| Correctness | + Does not require a product change | +| | ~ The tests may call internal functions in a way that does not reflect actual usage inside the product | +| Effacement | ++ Fine as long as the internal interfaces aren't added solely for test purposes | +| Portability | + Fine as long as we control how the tests are linked | +| | ~ Doesn't work if the users rewrite an internal module | +| Maintainability | + Tests interfaces that are documented; dependencies in the tests are easily noticed when changing these interfaces | + +### Static analysis + +If we guarantee certain properties through static analysis, we don't need to test them. This puts some constraints on the properties: + +* We need to have confidence in the specification (but we can gain this confidence by evaluating the specification on test data). +* This does not work for platform-dependent properties unless we have a formal model of the platform. + +| Requirement | Analysis | +| ----------- | -------- | +| Coverage | ~ Good for platform-independent properties, if we can guarantee them statically | +| Correctness | + Good as long as we have confidence in the specification | +| Effacement | ++ Zero impact on the code | +| Portability | ++ Zero runtime burden | +| Maintainability | ~ Static analysis is hard, but it's also helpful | + +### Compile-time options + +If there's code that we want to have in the product for testing, but not in production, we can add a compile-time option to enable it. This is very powerful and usually easy to use, but comes with a major downside: we aren't testing the same code anymore. + +| Requirement | Analysis | +| ----------- | -------- | +| Coverage | ++ Most things can be tested that way | +| Correctness | ! Difficult to ensure that what we test is what we run | +| Effacement | ++ No impact on the product when built normally or on the documentation, if done right | +| | ! Risk of getting “no impact” wrong | +| Portability | ++ It's just C code so it works everywhere | +| | ~ Doesn't work if the users rewrite an internal module | +| Maintainability | + Test interfaces impact the product source code, but at least they're clearly marked as such in the code | + +#### Guidelines for compile-time options + +* **Minimize the number of compile-time options.**
+ Either we're testing or we're not. Fine-grained options for testing would require more test builds, especially if combinatorics enters the play. +* **Merely enabling the compile-time option should not change the behavior.**
+ When building in test mode, the code should have exactly the same behavior. Changing the behavior should require some action at runtime (calling a function or changing a variable). +* **Minimize the impact on code**.
+ We should not have test-specific conditional compilation littered through the code, as that makes the code hard to read. + +### Runtime instrumentation + +Some properties can be tested through runtime instrumentation: have the compiler or a similar tool inject something into the binary. + +* Sanitizers check for certain bad usage patterns (ASan, MSan, UBSan, Valgrind). +* We can inject external libraries at link time. This can be a way to make system functions fail. + +| Requirement | Analysis | +| ----------- | -------- | +| Coverage | ! Limited scope | +| Correctness | + Instrumentation generally does not affect the program's functional behavior | +| Effacement | ++ Zero impact on the code | +| Portability | ~ Depends on the method | +| Maintainability | ~ Depending on the instrumentation, this may require additional builds and scripts | +| | + Many properties come for free, but some require effort (e.g. the test code itself must be leak-free to avoid false positives in a leak detector) | + +### Debugger-based testing + +If we want to do something in a test that the product isn't capable of doing, we can use a debugger to read or modify the memory, or hook into the code at arbitrary points. + +This is a very powerful approach, but it comes with limitations: + +* The debugger may introduce behavior changes (e.g. timing). If we modify data structures in memory, we may do so in a way that the code doesn't expect. +* Due to compiler optimizations, the memory may not have the layout that we expect. +* Writing reliable debugger scripts is hard. We need to have confidence that we're testing what we mean to test, even in the face of compiler optimizations. Languages such as gdb make it hard to automate even relatively simple things such as finding the place(s) in the binary corresponding to some place in the source code. +* Debugger scripts are very much non-portable. + +| Requirement | Analysis | +| ----------- | -------- | +| Coverage | ++ The sky is the limit | +| Correctness | ++ The code is unmodified, and tested as compiled (so we even detect compiler-induced bugs) | +| | ! Compiler optimizations may hinder | +| | ~ Modifying the execution may introduce divergence | +| Effacement | ++ Zero impact on the code | +| Portability | !! Not all environments have a debugger, and even if they do, we'd need completely different scripts for every debugger | +| Maintainability | ! Writing reliable debugger scripts is hard | +| | !! Very tight coupling with the details of the source code and even with the compiler | + +## Solutions + +This section lists some strategies that are currently used for invasive testing, or planned to be used. This list is not intended to be exhaustive. + +### Memory management + +#### Zeroization testing + +Goal: test that `mbedtls_platform_zeroize` does wipe the memory buffer. + +Solution ([debugger](#debugger-based-testing)): implemented in `tests/scripts/test_zeroize.gdb`. + +Rationale: this cannot be tested by adding C code, because the danger is that the compiler optimizes the zeroization away, and any C code that observes the zeroization would cause the compiler not to optimize it away. + +#### Memory cleanup + +Goal: test the absence of memory leaks. + +Solution ([instrumentation](#runtime-instrumentation)): run tests with ASan. (We also use Valgrind, but it's slower than ASan, so we favor ASan.) + +Since we run many test jobs with a memory leak detector, each test function or test program must clean up after itself. Use the cleanup code (after the `exit` label in test functions) to free any memory that the function may have allocated. + +#### Robustness against memory allocation failure + +Solution: TODO. We don't test this at all at this point. + +#### PSA key store memory cleanup + +Goal: test the absence of resource leaks in the PSA key store code, in particular that `psa_close_key` and `psa_destroy_key` work correctly. + +Solution ([internal interface](#internal-interfaces)): in most tests involving PSA functions, the cleanup code explicitly calls `PSA_DONE()` instead of `mbedtls_psa_crypto_free()`. `PSA_DONE` fails the test if the key store in memory is not empty. + +Note there must also be tests that call `mbedtls_psa_crypto_free` with keys still open, to verify that it does close all keys. + +`PSA_DONE` is a macro defined in `psa_crypto_helpers.h` which uses `mbedtls_psa_get_stats()` to get information about the keystore content before calling `mbedtls_psa_crypto_free()`. This feature is mostly but not exclusively useful for testing, and may be moved under `MBEDTLS_TEST_HOOKS`. + +### PSA storage + +#### PSA storage cleanup on success + +Goal: test that no stray files are left over in the key store after a test that succeeded. + +Solution: TODO. Currently the various test suites do it differently. + +#### PSA storage cleanup on failure + +Goal: ensure that no stray files are left over in the key store even if a test has failed (as that could cause other tests to fail). + +Solution: TODO. Currently the various test suites do it differently. + +#### PSA storage resilience + +Goal: test the resilience of PSA storage against power failures. + +Solution: TODO. + +See the [secure element driver interface test strategy](driver-interface-test-strategy.html) for more information. + +#### Corrupted storage + +Goal: test the robustness against corrupted storage. + +Solution ([internal interface](#internal-interfaces)): call `psa_its` functions to modify the storage. + +#### Storage read failure + +Goal: test the robustness against read errors. + +Solution: TODO + +#### Storage write failure + +Goal: test the robustness against write errors (`STORAGE_FAILURE` or `INSUFFICIENT_STORAGE`). + +Solution: TODO + +#### Storage format stability + +Goal: test that the storage format does not change between versions (or if it does, an upgrade path must be provided). + +Solution ([internal interface](#internal-interfaces)): call internal functions to inspect the content of the file. + +Note that the storage format is defined not only by the general layout, but also by the numerical values of encodings for key types and other metadata. For numerical values, there is a risk that we would accidentally modify a single value or a few values, so the tests should be exhaustive. This probably requires some compile-time analysis (perhaps the automation for `psa_constant_names` can be used here). TODO + +### Other fault injection + +#### PSA crypto init failure + +Goal: test the failure of `psa_crypto_init`. + +Solution ([compile-time option](#compile-time-options)): replace entropy initialization functions by functions that can fail. This is the only failure point for `psa_crypto_init` that is present in all builds. + +When we implement the PSA entropy driver interface, this should be reworked to use the entropy driver interface. + +#### PSA crypto data corruption + +The PSA crypto subsystem has a few checks to detect corrupted data in memory. We currently don't have a way to exercise those checks. + +Solution: TODO. To corrupt a multipart operation structure, we can do it by looking inside the structure content, but only when running without isolation. To corrupt the key store, we would need to add a function to the library or to use a debugger. + diff --git a/third_party/mbedtls/repo/docs/architecture/testing/test-framework.md b/third_party/mbedtls/repo/docs/architecture/testing/test-framework.md new file mode 100644 index 000000000..c4178fa17 --- /dev/null +++ b/third_party/mbedtls/repo/docs/architecture/testing/test-framework.md @@ -0,0 +1,58 @@ +# Mbed TLS test framework + +This document is an overview of the Mbed TLS test framework and test tools. + +This document is incomplete. You can help by expanding it. + +## Unit tests + +See + +### Unit test descriptions + +Each test case has a description which succinctly describes for a human audience what the test does. The first non-comment line of each paragraph in a `.data` file is the test description. The following rules and guidelines apply: + +* Test descriptions may not contain semicolons, line breaks and other control characters, or non-ASCII characters.
+ Rationale: keep the tools that process test descriptions (`generate_test_code.py`, [outcome file](#outcome-file) tools) simple. +* Test descriptions must be unique within a `.data` file. If you can't think of a better description, the convention is to append `#1`, `#2`, etc.
+ Rationale: make it easy to relate a failure log to the test data. Avoid confusion between cases in the [outcome file](#outcome-file). +* Test descriptions should be a maximum of **66 characters**.
+ Rationale: 66 characters is what our various tools assume (leaving room for 14 more characters on an 80-column line). Longer descriptions may be truncated or may break a visual alignment.
+ We have a lot of test cases with longer descriptions, but they should be avoided. At least please make sure that the first 66 characters describe the test uniquely. +* Make the description descriptive. “foo: x=2, y=4” is more descriptive than “foo #2”. “foo: 0**Note:** To generate a random key, use `psa_generate_key()` instead of `psa_generate_random()`. + +This example shows how to generate ten bytes of random data by calling `psa_generate_random()`: +```C + psa_status_t status; + uint8_t random[10] = { 0 }; + + printf("Generate random...\t"); + fflush(stdout); + + /* Initialize PSA Crypto */ + status = psa_crypto_init(); + if (status != PSA_SUCCESS) { + printf("Failed to initialize PSA Crypto\n"); + return; + } + + status = psa_generate_random(random, sizeof(random)); + if (status != PSA_SUCCESS) { + printf("Failed to generate a random value\n"); + return; + } + + printf("Generated random data\n"); + + /* Clean up */ + mbedtls_psa_crypto_free(); +``` + +### Deriving a new key from an existing key + +Mbed Crypto provides a key derivation API that lets you derive new keys from +existing ones. The key derivation API has functions to take inputs, including +other keys and data, and functions to generate outputs, such as new keys or +other data. + +You must first initialize and set up a key derivation context, +provided with a key and, optionally, other data. Then, use the key derivation context to either read derived data to a buffer or send derived data directly to a key slot. + +See the documentation for the particular algorithm (such as HKDF or the TLS1.2 PRF) for +information about which inputs to pass when, and when you can obtain which outputs. + +**Prerequisites to working with the key derivation APIs:** +* Initialize the library with a successful call to `psa_crypto_init()`. +* Use a key with the appropriate attributes set: + * Usage flags set for key derivation (`PSA_KEY_USAGE_DERIVE`) + * Key type set to `PSA_KEY_TYPE_DERIVE`. + * Algorithm set to a key derivation algorithm + (for example, `PSA_ALG_HKDF(PSA_ALG_SHA_256)`). + +**To derive a new AES-CTR 128-bit encryption key into a given key slot using HKDF +with a given key, salt and info:** + +1. Set up the key derivation context using the `psa_key_derivation_setup()` +function, specifying the derivation algorithm `PSA_ALG_HKDF(PSA_ALG_SHA_256)`. +1. Provide an optional salt with `psa_key_derivation_input_bytes()`. +1. Provide info with `psa_key_derivation_input_bytes()`. +1. Provide a secret with `psa_key_derivation_input_key()`, referencing a key that + can be used for key derivation. +1. Set the key attributes desired for the new derived key. We'll set + the `PSA_KEY_USAGE_ENCRYPT` usage flag and the `PSA_ALG_CTR` algorithm for this + example. +1. Derive the key by calling `psa_key_derivation_output_key()`. +1. Clean up the key derivation context. + +At this point, the derived key slot holds a new 128-bit AES-CTR encryption key +derived from the key, salt and info provided: +```C + psa_status_t status; + psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + static const unsigned char key[] = { + 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, + 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, + 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, + 0x0b }; + static const unsigned char salt[] = { + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, + 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c }; + static const unsigned char info[] = { + 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, + 0xf7, 0xf8, 0xf9 }; + psa_algorithm_t alg = PSA_ALG_HKDF(PSA_ALG_SHA_256); + psa_key_derivation_operation_t operation = + PSA_KEY_DERIVATION_OPERATION_INIT; + size_t derived_bits = 128; + size_t capacity = PSA_BITS_TO_BYTES(derived_bits); + psa_key_id_t base_key; + psa_key_id_t derived_key; + + printf("Derive a key (HKDF)...\t"); + fflush(stdout); + + /* Initialize PSA Crypto */ + status = psa_crypto_init(); + if (status != PSA_SUCCESS) { + printf("Failed to initialize PSA Crypto\n"); + return; + } + + /* Import a key for use in key derivation. If such a key has already been + * generated or imported, you can skip this part. */ + psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DERIVE); + psa_set_key_algorithm(&attributes, alg); + psa_set_key_type(&attributes, PSA_KEY_TYPE_DERIVE); + status = psa_import_key(&attributes, key, sizeof(key), &base_key); + if (status != PSA_SUCCESS) { + printf("Failed to import a key\n"); + return; + } + psa_reset_key_attributes(&attributes); + + /* Derive a key */ + status = psa_key_derivation_setup(&operation, alg); + if (status != PSA_SUCCESS) { + printf("Failed to begin key derivation\n"); + return; + } + status = psa_key_derivation_set_capacity(&operation, capacity); + if (status != PSA_SUCCESS) { + printf("Failed to set capacity\n"); + return; + } + status = psa_key_derivation_input_bytes(&operation, + PSA_KEY_DERIVATION_INPUT_SALT, + salt, sizeof(salt)); + if (status != PSA_SUCCESS) { + printf("Failed to input salt (extract)\n"); + return; + } + status = psa_key_derivation_input_key(&operation, + PSA_KEY_DERIVATION_INPUT_SECRET, + base_key); + if (status != PSA_SUCCESS) { + printf("Failed to input key (extract)\n"); + return; + } + status = psa_key_derivation_input_bytes(&operation, + PSA_KEY_DERIVATION_INPUT_INFO, + info, sizeof(info)); + if (status != PSA_SUCCESS) { + printf("Failed to input info (expand)\n"); + return; + } + psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT); + psa_set_key_algorithm(&attributes, PSA_ALG_CTR); + psa_set_key_type(&attributes, PSA_KEY_TYPE_AES); + psa_set_key_bits(&attributes, 128); + status = psa_key_derivation_output_key(&attributes, &operation, + &derived_key); + if (status != PSA_SUCCESS) { + printf("Failed to derive key\n"); + return; + } + psa_reset_key_attributes(&attributes); + + printf("Derived key\n"); + + /* Clean up key derivation operation */ + psa_key_derivation_abort(&operation); + + /* Destroy the keys */ + psa_destroy_key(derived_key); + psa_destroy_key(base_key); + + mbedtls_psa_crypto_free(); +``` + +### Authenticating and encrypting or decrypting a message + +Mbed Crypto provides a simple way to authenticate and encrypt with associated data (AEAD), supporting the `PSA_ALG_CCM` algorithm. + +**Prerequisites to working with the AEAD cipher APIs:** +* Initialize the library with a successful call to `psa_crypto_init()`. +* The key attributes for the key used for derivation must have the `PSA_KEY_USAGE_ENCRYPT` or `PSA_KEY_USAGE_DECRYPT` usage flags. + +This example shows how to authenticate and encrypt a message: +```C + psa_status_t status; + static const uint8_t key[] = { + 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, + 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF }; + static const uint8_t nonce[] = { + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, + 0x08, 0x09, 0x0A, 0x0B }; + static const uint8_t additional_data[] = { + 0xEC, 0x46, 0xBB, 0x63, 0xB0, 0x25, + 0x20, 0xC3, 0x3C, 0x49, 0xFD, 0x70 }; + static const uint8_t input_data[] = { + 0xB9, 0x6B, 0x49, 0xE2, 0x1D, 0x62, 0x17, 0x41, + 0x63, 0x28, 0x75, 0xDB, 0x7F, 0x6C, 0x92, 0x43, + 0xD2, 0xD7, 0xC2 }; + uint8_t *output_data = NULL; + size_t output_size = 0; + size_t output_length = 0; + size_t tag_length = 16; + psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + psa_key_id_t key; + + printf("Authenticate encrypt...\t"); + fflush(stdout); + + /* Initialize PSA Crypto */ + status = psa_crypto_init(); + if (status != PSA_SUCCESS) { + printf("Failed to initialize PSA Crypto\n"); + return; + } + + output_size = sizeof(input_data) + tag_length; + output_data = (uint8_t *)malloc(output_size); + if (!output_data) { + printf("Out of memory\n"); + return; + } + + /* Import a key */ + psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT); + psa_set_key_algorithm(&attributes, PSA_ALG_CCM); + psa_set_key_type(&attributes, PSA_KEY_TYPE_AES); + psa_set_key_bits(&attributes, 128); + status = psa_import_key(&attributes, key, sizeof(key), &key); + psa_reset_key_attributes(&attributes); + + /* Authenticate and encrypt */ + status = psa_aead_encrypt(key, PSA_ALG_CCM, + nonce, sizeof(nonce), + additional_data, sizeof(additional_data), + input_data, sizeof(input_data), + output_data, output_size, + &output_length); + if (status != PSA_SUCCESS) { + printf("Failed to authenticate and encrypt\n"); + return; + } + + printf("Authenticated and encrypted\n"); + + /* Clean up */ + free(output_data); + + /* Destroy the key */ + psa_destroy_key(key); + + mbedtls_psa_crypto_free(); +``` + +This example shows how to authenticate and decrypt a message: + +```C + psa_status_t status; + static const uint8_t key_data[] = { + 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, + 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF }; + static const uint8_t nonce[] = { + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, + 0x08, 0x09, 0x0A, 0x0B }; + static const uint8_t additional_data[] = { + 0xEC, 0x46, 0xBB, 0x63, 0xB0, 0x25, + 0x20, 0xC3, 0x3C, 0x49, 0xFD, 0x70 }; + static const uint8_t input_data[] = { + 0x20, 0x30, 0xE0, 0x36, 0xED, 0x09, 0xA0, 0x45, 0xAF, 0x3C, 0xBA, 0xEE, + 0x0F, 0xC8, 0x48, 0xAF, 0xCD, 0x89, 0x54, 0xF4, 0xF6, 0x3F, 0x28, 0x9A, + 0xA1, 0xDD, 0xB2, 0xB8, 0x09, 0xCD, 0x7C, 0xE1, 0x46, 0xE9, 0x98 }; + uint8_t *output_data = NULL; + size_t output_size = 0; + size_t output_length = 0; + psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + psa_key_id_t key; + + printf("Authenticate decrypt...\t"); + fflush(stdout); + + /* Initialize PSA Crypto */ + status = psa_crypto_init(); + if (status != PSA_SUCCESS) { + printf("Failed to initialize PSA Crypto\n"); + return; + } + + output_size = sizeof(input_data); + output_data = (uint8_t *)malloc(output_size); + if (!output_data) { + printf("Out of memory\n"); + return; + } + + /* Import a key */ + psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT); + psa_set_key_algorithm(&attributes, PSA_ALG_CCM); + psa_set_key_type(&attributes, PSA_KEY_TYPE_AES); + psa_set_key_bits(&attributes, 128); + status = psa_import_key(&attributes, key_data, sizeof(key_data), &key); + if (status != PSA_SUCCESS) { + printf("Failed to import a key\n"); + return; + } + psa_reset_key_attributes(&attributes); + + /* Authenticate and decrypt */ + status = psa_aead_decrypt(key, PSA_ALG_CCM, + nonce, sizeof(nonce), + additional_data, sizeof(additional_data), + input_data, sizeof(input_data), + output_data, output_size, + &output_length); + if (status != PSA_SUCCESS) { + printf("Failed to authenticate and decrypt %ld\n", status); + return; + } + + printf("Authenticated and decrypted\n"); + + /* Clean up */ + free(output_data); + + /* Destroy the key */ + psa_destroy_key(key); + + mbedtls_psa_crypto_free(); +``` + +### Generating and exporting keys + +Mbed Crypto provides a simple way to generate a key or key pair. + +**Prerequisites to using key generation and export APIs:** +* Initialize the library with a successful call to `psa_crypto_init()`. + +**To generate an ECDSA key:** +1. Set the desired key attributes for key generation by calling + `psa_set_key_algorithm()` with the chosen ECDSA algorithm (such as + `PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_SHA_256)`). You only want to export the public key, not the key pair (or private key); therefore, do not set `PSA_KEY_USAGE_EXPORT`. +1. Generate a key by calling `psa_generate_key()`. +1. Export the generated public key by calling `psa_export_public_key()`: +```C + enum { + key_bits = 256, + }; + psa_status_t status; + size_t exported_length = 0; + static uint8_t exported[PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(key_bits)]; + psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + psa_key_id_t key; + + printf("Generate a key pair...\t"); + fflush(stdout); + + /* Initialize PSA Crypto */ + status = psa_crypto_init(); + if (status != PSA_SUCCESS) { + printf("Failed to initialize PSA Crypto\n"); + return; + } + + /* Generate a key */ + psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH); + psa_set_key_algorithm(&attributes, + PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_SHA_256)); + psa_set_key_type(&attributes, + PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1)); + psa_set_key_bits(&attributes, key_bits); + status = psa_generate_key(&attributes, &key); + if (status != PSA_SUCCESS) { + printf("Failed to generate key\n"); + return; + } + psa_reset_key_attributes(&attributes); + + status = psa_export_public_key(key, exported, sizeof(exported), + &exported_length); + if (status != PSA_SUCCESS) { + printf("Failed to export public key %ld\n", status); + return; + } + + printf("Exported a public key\n"); + + /* Destroy the key */ + psa_destroy_key(key); + + mbedtls_psa_crypto_free(); +``` + +### More about the PSA Crypto API + +For more information about the PSA Crypto API, please see the [PSA Cryptography API Specification](https://armmbed.github.io/mbed-crypto/html/index.html). diff --git a/third_party/mbedtls/repo/docs/proposed/Makefile b/third_party/mbedtls/repo/docs/proposed/Makefile new file mode 100644 index 000000000..1c314640b --- /dev/null +++ b/third_party/mbedtls/repo/docs/proposed/Makefile @@ -0,0 +1,25 @@ +PANDOC = pandoc + +default: all + +all_markdown = \ + psa-conditional-inclusion-c.md \ + psa-driver-developer-guide.md \ + psa-driver-integration-guide.md \ + psa-driver-interface.md \ + # This line is intentionally left blank + +html: $(all_markdown:.md=.html) +pdf: $(all_markdown:.md=.pdf) +all: html pdf + +.SUFFIXES: +.SUFFIXES: .md .html .pdf + +.md.html: + $(PANDOC) -o $@ $< +.md.pdf: + $(PANDOC) -o $@ $< + +clean: + rm -f *.html *.pdf diff --git a/third_party/mbedtls/repo/docs/proposed/README b/third_party/mbedtls/repo/docs/proposed/README new file mode 100644 index 000000000..09eae9aec --- /dev/null +++ b/third_party/mbedtls/repo/docs/proposed/README @@ -0,0 +1,4 @@ +The documents in this directory are proposed specifications for Mbed +TLS features. They are not implemented yet, or only partially +implemented. Please follow activity on the `development` branch of +Mbed TLS if you are interested in these features. diff --git a/third_party/mbedtls/repo/docs/proposed/psa-conditional-inclusion-c.md b/third_party/mbedtls/repo/docs/proposed/psa-conditional-inclusion-c.md new file mode 100644 index 000000000..52138b174 --- /dev/null +++ b/third_party/mbedtls/repo/docs/proposed/psa-conditional-inclusion-c.md @@ -0,0 +1,238 @@ +Conditional inclusion of cryptographic mechanism through the PSA API in Mbed TLS +================================================================================ + +This document is a proposed interface for deciding at build time which cryptographic mechanisms to include in the PSA Cryptography interface. + +This is currently a proposal for Mbed TLS. It is not currently on track for standardization in PSA. + +Time-stamp: "2020/11/26 09:30:50 GMT" + +## Introduction + +### Purpose of this specification + +The [PSA Cryptography API specification](https://armmbed.github.io/mbed-crypto/psa/#application-programming-interface) specifies the interface between a PSA Cryptography implementation and an application. The interface defines a number of categories of cryptographic algorithms (hashes, MAC, signatures, etc.). In each category, a typical implementation offers many algorithms (e.g. for signatures: RSA-PKCS#1v1.5, RSA-PSS, ECDSA). When building the implementation for a specific use case, it is often desirable to include only a subset of the available cryptographic mechanisms, primarily in order to reduce the code footprint of the compiled system. + +The present document proposes a way for an application using the PSA cryptography interface to declare which mechanisms it requires. + +### Conditional inclusion of legacy cryptography modules + +Mbed TLS offers a way to select which cryptographic mechanisms are included in a build through its configuration file (`config.h`). This mechanism is based on two main sets of symbols: `MBEDTLS_xxx_C` controls the availability of the mechanism to the application, and `MBEDTLS_xxx_ALT` controls the availability of an alternative implementation, so the software implementation is only included if `MBEDTLS_xxx_C` is defined but not `MBEDTLS_xxx_ALT`. + +### PSA evolution + +In the PSA cryptography interface, the **core** (built-in implementations of cryptographic mechanisms) can be augmented with drivers. **Transparent drivers** replace the built-in implementation of a cryptographic mechanism (or, with **fallback**, the built-in implementation is tried if the driver only has partial support for the mechanism). **Opaque drivers** implement cryptographic mechanisms on keys which are stored in a separate domain such as a secure element, for which the core only does key management and dispatch using wrapped key blobs or key identifiers. + +The current model is difficult to adapt to the PSA interface for several reasons. The `MBEDTLS_xxx_ALT` symbols are somewhat inconsistent, and in particular do not work well for asymmetric cryptography. For example, many parts of the ECC code have no `MBEDTLS_xxx_ALT` symbol, so a platform with ECC acceleration that can perform all ECDSA and ECDH operations in the accelerator would still embark the `bignum` module and large parts of the `ecp_curves`, `ecp` and `ecdsa` modules. Also the availability of a transparent driver for a mechanism does not translate directly to `MBEDTLS_xxx` symbols. + +### Requirements + +[Req.interface] The application can declare which cryptographic mechanisms it needs. + +[Req.inclusion] If the application does not require a mechanism, a suitably configured Mbed TLS build must not include it. The granularity of mechanisms must work for typical use cases and has [acceptable limitations](#acceptable-limitations). + +[Req.drivers] If a PSA driver is available in the build, a suitably configured Mbed TLS build must not include the corresponding software code (unless a software fallback is needed). + +[Req.c] The configuration mechanism consists of C preprocessor definitions, and the build does not require tools other than a C compiler. This is necessary to allow building an application and Mbed TLS in development environments that do not allow third-party tools. + +[Req.adaptability] The implementation of the mechanism must be adaptable with future evolution of the PSA cryptography specifications and Mbed TLS. Therefore the interface must remain sufficiently simple and abstract. + +### Acceptable limitations + +[Limitation.matrix] If a mechanism is defined by a combination of algorithms and key types, for example a block cipher mode (CBC, CTR, CFB, …) and a block permutation (AES, CAMELLIA, ARIA, …), there is no requirement to include only specific combinations. + +[Limitation.direction] For mechanisms that have multiple directions (for example encrypt/decrypt, sign/verify), there is no requirement to include only one direction. + +[Limitation.size] There is no requirement to include only support for certain key sizes. + +[Limitation.multipart] Where there are multiple ways to perform an operation, for example single-part and multi-part, there is no mechanism to select only one or a subset of the possible ways. + +## Interface + +### PSA Crypto configuration file + +The PSA Crypto configuration file `psa/crypto_config.h` defines a series of symbols of the form `PSA_WANT_xxx` where `xxx` describes the feature that the symbol enables. The symbols are documented in the section [“PSA Crypto configuration symbols”](#psa-crypto-configuration-symbols) below. + +The symbol `MBEDTLS_PSA_CRYPTO_CONFIG` in `mbedtls/config.h` determines whether `psa/crypto_config.h` is used. + +* If `MBEDTLS_PSA_CRYPTO_CONFIG` is unset, which is the default at least in Mbed TLS 2.x versions, things are as they are today: the PSA subsystem includes generic code unconditionally, and includes support for specific mechanisms conditionally based on the existing `MBEDTLS_xxx_` symbols. +* If `MBEDTLS_PSA_CRYPTO_CONFIG` is set, the necessary software implementations of cryptographic algorithms are included based on both the content of the PSA Crypto configuration file and the Mbed TLS configuration file. For example, the code in `aes.c` is enabled if either `mbedtls/config.h` contains `MBEDTLS_AES_C` or `psa/crypto_config.h` contains `PSA_WANT_KEY_TYPE_AES`. + +### PSA Crypto configuration symbols + +#### Configuration symbol syntax + +A PSA Crypto configuration symbol is a C preprocessor symbol whose name starts with `PSA_WANT_`. + +* If the symbol is not defined, the corresponding feature is not included. +* If the symbol is defined to a preprocessor expression with the value `1`, the corresponding feature is included. +* If the symbol is defined with a different value, the behavior is currently undefined and reserved for future use. + +#### Configuration symbol usage + +The presence of a symbol `PSA_WANT_xxx` in the Mbed TLS configuration determines whether a feature is available through the PSA API. These symbols should be used in any place that requires conditional compilation based on the availability of a cryptographic mechanism through the PSA API, including: + +* In Mbed TLS test code. +* In Mbed TLS library code using `MBEDTLS_USE_PSA_CRYPTO`, for example in TLS to determine which cipher suites to enable. +* In application code that provides additional features based on cryptographic capabilities, for example additional key parsing and formatting functions, or cipher suite availability for network protocols. + +#### Configuration symbol semantics + +If a feature is not requested for inclusion in the PSA Crypto configuration file, it may still be included in the build, either because the feature has been requested in some other way, or because the library does not support the exclusion of this feature. Mbed TLS should make a best effort to support the exclusion of all features, but in some cases this may be judged too much effort for too little benefit. + +#### Configuration symbols for key types + +For each constant or constructor macro of the form `PSA_KEY_TYPE_xxx`, the symbol **`PSA_WANT_KEY_TYPE_xxx`** indicates that support for this key type is desired. + +For asymmetric cryptography, `PSA_WANT_KEY_TYPE_xxx_KEY_PAIR` determines whether private-key operations are desired, and `PSA_WANT_KEY_TYPE_xxx_PUBLIC_KEY` determines whether public-key operations are desired. `PSA_WANT_KEY_TYPE_xxx_KEY_PAIR` implicitly enables `PSA_WANT_KEY_TYPE_xxx_PUBLIC_KEY`: there is no way to only include private-key operations (which typically saves little code). + +#### Configuration symbols for curves + +For elliptic curve key types, only the specified curves are included. To include a curve, include a symbol of the form **`PSA_WANT_ECC_family_size`**. For example: `PSA_WANT_ECC_SECP_R1_256` for secp256r1, `PSA_WANT_ECC_MONTGOMERY_CURVE25519`. It is an error to require an ECC key type but no curve, and Mbed TLS will reject this at compile time. + +#### Configuration symbols for algorithms + +For each constant or constructor macro of the form `PSA_ALG_xxx`, the symbol **`PSA_WANT_ALG_xxx`** indicates that support for this algorithm is desired. + +For parametrized algorithms, the `PSA_WANT_ALG_xxx` symbol indicates whether the base mechanism is supported. Parameters must themselves be included through their own `PSA_WANT_ALG_xxx` symbols. It is an error to include a base mechanism without at least one possible parameter, and Mbed TLS will reject this at compile time. For example, `PSA_WANT_ALG_ECDSA` requires the inclusion of randomized ECDSA for all hash algorithms whose corresponding symbol `PSA_WANT_ALG_xxx` is enabled. + +## Implementation + +### Additional non-public symbols + +#### Accounting for transparent drivers + +In addition to the [configuration symbols](#psa-crypto-configuration-symbols), we need two parallel or mostly parallel sets of symbols: + +* **`MBEDTLS_PSA_ACCEL_xxx`** indicates whether a fully-featured, fallback-free transparent driver is available. +* **`MBEDTLS_PSA_BUILTIN_xxx`** indicates whether the software implementation is needed. + +`MBEDTLS_PSA_ACCEL_xxx` is one of the outputs of the transpilation of a driver description, alongside the glue code for calling the drivers. + +`MBEDTLS_PSA_BUILTIN_xxx` is enabled when `PSA_WANT_xxx` is enabled and `MBEDTLS_PSA_ACCEL_xxx` is disabled. + +These symbols are not part of the public interface of Mbed TLS towards applications or to drivers, regardless of whether the symbols are actually visible. + +### Architecture of symbol definitions + +#### New-style definition of configuration symbols + +When `MBEDTLS_PSA_CRYPTO_CONFIG` is set, the header file `mbedtls/config.h` needs to define all the `MBEDTLS_xxx_C` configuration symbols, including the ones deduced from the PSA Crypto configuration. It does this by including the new header file **`mbedtls/config_psa.h`**, which defines the `MBEDTLS_PSA_BUILTIN_xxx` symbols and deduces the corresponding `MBEDTLS_xxx_C` (and other) symbols. + +`mbedtls/config_psa.h` includes `psa/crypto_config.h`, the user-editable file that defines application requirements. + +#### Old-style definition of configuration symbols + +When `MBEDTLS_PSA_CRYPTO_CONFIG` is not set, the configuration of Mbed TLS works as before, and the inclusion of non-PSA code only depends on `MBEDTLS_xxx` symbols defined (or not) in `mbedtls/config.h`. Furthermore, the new header file **`mbedtls/config_psa.h`** deduces PSA configuration symbols (`PSA_WANT_xxx`, `MBEDTLS_PSA_BUILTIN_xxx`) from classic configuration symbols (`MBEDTLS_xxx`). + +The `PSA_WANT_xxx` definitions in `mbedtls/config_psa.h` are needed not only to build the PSA parts of the library, but also to build code that uses these parts. This includes structure definitions in `psa/crypto_struct.h`, size calculations in `psa/crypto_sizes.h`, and application code that's specific to a given cryptographic mechanism. In Mbed TLS itself, code under `MBEDTLS_USE_PSA_CRYPTO` and conditional compilation guards in tests and sample programs need `PSA_WANT_xxx`. + +Since some existing applications use a handwritten `mbedtls/config.h` or an edited copy of `mbedtls/config.h` from an earlier version of Mbed TLS, `mbedtls/config_psa.h` must be included via an already existing header that is not `mbedtls/config.h`, so it is included via `psa/crypto.h` (for example from `psa/crypto_platform.h`). + +#### Summary of definitions of configuration symbols + +Whether `MBEDTLS_PSA_CRYPTO_CONFIG` is set or not, `mbedtls/config_psa.h` includes `mbedtls/crypto_drivers.h`, a header file generated by the transpilation of the driver descriptions. It defines `MBEDTLS_PSA_ACCEL_xxx` symbols according to the availability of transparent drivers without fallback. + +The following table summarizes where symbols are defined depending on the configuration mode. + +* (U) indicates a symbol that is defined by the user (application). +* (D) indicates a symbol that is deduced from other symbols by code that ships with Mbed TLS. +* (G) indicates a symbol that is generated from driver descriptions. + +| Symbols | With `MBEDTLS_PSA_CRYPTO_CONFIG` | Without `MBEDTLS_PSA_CRYPTO_CONFIG` | +| ------------------------- | -------------------------------- | ----------------------------------- | +| `MBEDTLS_xxx_C` | `mbedtls/config.h` (U) or | `mbedtls/config.h` (U) | +| | `mbedtls/config_psa.h` (D) | | +| `PSA_WANT_xxx` | `psa/crypto_config.h` (U) | `mbedtls/config_psa.h` (D) | +| `MBEDTLS_PSA_BUILTIN_xxx` | `mbedtls/config_psa.h` (D) | `mbedtls/config_psa.h` (D) | +| `MBEDTLS_PSA_ACCEL_xxx` | `mbedtls/crypto_drivers.h` (G) | N/A | + +#### Visibility of internal symbols + +Ideally, the `MBEDTLS_PSA_ACCEL_xxx` and `MBEDTLS_PSA_BUILTIN_xxx` symbols should not be visible to application code or driver code, since they are not part of the public interface of the library. However these symbols are needed to deduce whether to include library modules (for example `MBEDTLS_AES_C` has to be enabled if `MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES` is enabled), which makes it difficult to keep them private. + +#### Compile-time checks + +The header file **`library/psa_check_config.h`** applies sanity checks to the configuration, throwing `#error` if something is wrong. + +A mechanism similar to `mbedtls/check_config.h` detects errors such as enabling ECDSA but no curve. + +Since configuration symbols must be undefined or 1, any other value should trigger an `#error`. + +#### Automatic generation of preprocessor symbol manipulations + +A lot of the preprocessor symbol manipulation is systematic calculations that analyze the configuration. `mbedtls/config_psa.h` and `library/psa_check_config.h` should be generated automatically, in the same manner as `version_features.c`. + +### Structure of PSA Crypto library code + +#### Conditional inclusion of library entry points + +An entry point can be eliminated entirely if no algorithm requires it. + +#### Conditional inclusion of mechanism-specific code + +Code that is specific to certain key types or to certain algorithms must be guarded by the applicable symbols: `PSA_WANT_xxx` for code that is independent of the application, and `MBEDTLS_PSA_BUILTIN_xxx` for code that calls an Mbed TLS software implementation. + +## PSA standardization + +### JSON configuration mechanism + +At the time of writing, the preferred configuration mechanism for a PSA service is in JSON syntax. The translation from JSON to build instructions is not specified by PSA. + +For PSA Crypto, the preferred configuration mechanism would be similar to capability specifications of transparent drivers. The same JSON properties that are used to mean “this driver can perform that mechanism” in a driver description would be used to mean “the application wants to perform that mechanism” in the application configuration. + +### From JSON to C + +The JSON capability language allows a more fine-grained selection than the C mechanism proposed here. For example, it allows requesting only single-part mechanisms, only certain key sizes, or only certain combinations of algorithms and key types. + +The JSON capability language can be translated approximately to the boolean symbol mechanism proposed here. The approximation considers a feature to be enabled if any part of it is enabled. For example, if there is a capability for AES-CTR and one for CAMELLIA-GCM, the translation to boolean symbols will also include AES-GCM and CAMELLIA-CTR. If there is a capability for AES-128, the translation will also include AES-192 and AES-256. + +The boolean symbol mechanism proposed here can be translated to a list of JSON capabilities: for each included algorithm, include a capability with that algorithm, the key types that apply to that algorithm, no size restriction, and all the entry points that apply to that algorithm. + +## Open questions + +### Open questions about the interface + +#### Naming of symbols + +The names of [elliptic curve symbols](#configuration-symbols-for-curves) are a bit weird: `SECP_R1_256` instead of `SECP256R1`. Should we make them more classical, but less systematic? + +#### Impossible combinations + +What does it mean to have `PSA_WANT_ALG_ECDSA` enabled but with only Curve25519? Is it a mandatory error? + +#### Diffie-Hellman + +Way to request only specific groups? Not a priority: constrained devices don't do FFDH. Specify it as may change in future versions. + +#### Coexistence with the current Mbed TLS configuration + +The two mechanisms have very different designs. Is there serious potential for confusion? Do we understand how the combinations work? + +### Open questions about the design + +#### Algorithms without a key type or vice versa + +Is it realistic to mandate a compile-time error if a key type is required, but no matching algorithm, or vice versa? Is it always the right thing, for example if there is an opaque driver that manipulates this key type? + +#### Opaque-only mechanisms + +If a mechanism should only be supported in an opaque driver, what does the core need to know about it? Do we have all the information we need? + +This is especially relevant to suppress a mechanism completely if there is no matching algorithm. For example, if there is no transparent implementation of RSA or ECDSA, `psa_sign_hash` and `psa_verify_hash` may still be needed if there is an opaque signature driver. + +### Open questions about the implementation + +#### Testability + +Is this proposal decently testable? There are a lot of combinations. What combinations should we test? + + diff --git a/third_party/mbedtls/repo/docs/proposed/psa-driver-developer-guide.md b/third_party/mbedtls/repo/docs/proposed/psa-driver-developer-guide.md new file mode 100644 index 000000000..70cb9d397 --- /dev/null +++ b/third_party/mbedtls/repo/docs/proposed/psa-driver-developer-guide.md @@ -0,0 +1,45 @@ +PSA Cryptoprocessor driver developer's guide +============================================ + +**This is a specification of work in progress. The implementation is not yet merged into Mbed TLS.** + +This document describes how to write drivers of cryptoprocessors such as accelerators and secure elements for the PSA cryptography subsystem of Mbed TLS. + +This document focuses on behavior that is specific to Mbed TLS. For a reference of the interface between Mbed TLS and drivers, refer to the [PSA Cryptoprocessor Driver Interface specification](psa-driver-interface.html). + +The interface is not fully implemented in Mbed TLS yet and is disabled by default. You can enable the experimental work in progress by setting `MBEDTLS_PSA_CRYPTO_DRIVERS` in the compile-time configuration. Please note that the interface may still change: until further notice, we do not guarantee backward compatibility with existing driver code when `MBEDTLS_PSA_CRYPTO_DRIVERS` is enabled. + +## Introduction + +### Purpose + +The PSA cryptography driver interface provides a way to build Mbed TLS with additional code that implements certain cryptographic primitives. This is primarily intended to support platform-specific hardware. + +There are two types of drivers: + +* **Transparent** drivers implement cryptographic operations on keys that are provided in cleartext at the beginning of each operation. They are typically used for hardware **accelerators**. When a transparent driver is available for a particular combination of parameters (cryptographic algorithm, key type and size, etc.), it is used instead of the default software implementation. Transparent drivers can also be pure software implementations that are distributed as plug-ins to a PSA Crypto implementation. +* **Opaque** drivers implement cryptographic operations on keys that can only be used inside a protected environment such as a **secure element**, a hardware security module, a smartcard, a secure enclave, etc. An opaque driver is invoked for the specific key location that the driver is registered for: the dispatch is based on the key's lifetime. + +### Deliverables for a driver + +To write a driver, you need to implement some functions with C linkage, and to declare these functions in a **driver description file**. The driver description file declares which functions the driver implements and what cryptographic mechanisms they support. Depending on the driver type, you may also need to define some C types and macros in a header file. + +The concrete syntax for a driver description file is JSON. The structure of this JSON file is specified in the section [“Driver description syntax”](psa-driver-interface.html#driver-description-syntax) of the PSA cryptography driver interface specification. + +A driver therefore consists of: + +* A driver description file (in JSON format). +* C header files defining the types required by the driver description. The names of these header files is declared in the driver description file. +* An object file compiled for the target platform defining the functions required by the driver description. Implementations may allow drivers to be provided as source files and compiled with the core instead of being pre-compiled. + +## Driver C interfaces + +Mbed TLS calls driver entry points [as specified in the PSA Cryptography Driver Interface specification](psa-driver-interface.html#driver-entry-points) except as otherwise indicated in this section. + +## Building and testing your driver + + + +## Dependencies on the Mbed TLS configuration + + diff --git a/third_party/mbedtls/repo/docs/proposed/psa-driver-integration-guide.md b/third_party/mbedtls/repo/docs/proposed/psa-driver-integration-guide.md new file mode 100644 index 000000000..bfd765ea5 --- /dev/null +++ b/third_party/mbedtls/repo/docs/proposed/psa-driver-integration-guide.md @@ -0,0 +1,45 @@ +Building Mbed TLS with PSA cryptoprocessor drivers +================================================== + +**This is a specification of work in progress. The implementation is not yet merged into Mbed TLS.** + +This document describes how to build Mbed TLS with additional cryptoprocessor drivers that follow the PSA cryptoprocessor driver interface. + +The interface is not fully implemented in Mbed TLS yet and is disabled by default. You can enable the experimental work in progress by setting `MBEDTLS_PSA_CRYPTO_DRIVERS` in the compile-time configuration. Please note that the interface may still change: until further notice, we do not guarantee backward compatibility with existing driver code when `MBEDTLS_PSA_CRYPTO_DRIVERS` is enabled. + +## Introduction + +The PSA cryptography driver interface provides a way to build Mbed TLS with additional code that implements certain cryptographic primitives. This is primarily intended to support platform-specific hardware. + +Note that such drivers are only available through the PSA cryptography API (crypto functions beginning with `psa_`, and X.509 and TLS interfaces that reference PSA types). + +Concretely speaking, a driver consists of one or more **driver description files** in JSON format and some code to include in the build. The driver code can either be provided in binary form as additional object file to link, or in source form. + +## How to build Mbed TLS with drivers + +To build Mbed TLS with drivers: + +1. Activate `MBEDTLS_PSA_CRYPTO_DRIVERS` in the library configuration. + + ``` + cd /path/to/mbedtls + scripts/config.py set MBEDTLS_PSA_CRYPTO_DRIVERS + ``` + +2. Pass the driver description files through the Make variable `PSA_DRIVERS` when building the library. + + ``` + cd /path/to/mbedtls + make PSA_DRIVERS="/path/to/acme/driver.json /path/to/nadir/driver.json" lib + ``` + +3. Link your application with the implementation of the driver functions. + + ``` + cd /path/to/application + ld myapp.o -L/path/to/acme -lacmedriver -L/path/to/nadir -lnadirdriver -L/path/to/mbedtls -lmbedcrypto + ``` + + + + diff --git a/third_party/mbedtls/repo/docs/proposed/psa-driver-interface.md b/third_party/mbedtls/repo/docs/proposed/psa-driver-interface.md new file mode 100644 index 000000000..d82579462 --- /dev/null +++ b/third_party/mbedtls/repo/docs/proposed/psa-driver-interface.md @@ -0,0 +1,790 @@ +PSA Cryptoprocessor Driver Interface +==================================== + +This document describes an interface for cryptoprocessor drivers in the PSA cryptography API. This interface complements the [PSA Cryptography API specification](https://armmbed.github.io/mbed-crypto/psa/#application-programming-interface), which describes the interface between a PSA Cryptography implementation and an application. + +This specification is work in progress and should be considered to be in a beta stage. There is ongoing work to implement this interface in Mbed TLS, which is the reference implementation of the PSA Cryptography API. At this stage, Arm does not expect major changes, but minor changes are expected based on experience from the first implementation and on external feedback. + +Time-stamp: "2020/11/24 11:03:32 GMT" + +## Introduction + +### Purpose of the driver interface + +The PSA Cryptography API defines an interface that allows applications to perform cryptographic operations in a uniform way regardless of how the operations are performed. Under the hood, different keys may be stored and used in different hardware or in different logical partitions, and different algorithms may involve different hardware or software components. + +The driver interface allows implementations of the PSA Cryptography API to be built compositionally. An implementation of the PSA Cryptography API is composed of a **core** and zero or more **drivers**. The core handles key management, enforces key usage policies, and dispatches cryptographic operations either to the applicable driver or to built-in code. + +Functions in the PSA Cryptography API invoke functions in the core. Code from the core calls drivers as described in the present document. + +### Types of drivers + +The PSA Cryptography driver interface supports two types of cryptoprocessors, and accordingly two types of drivers. + +* **Transparent** drivers implement cryptographic operations on keys that are provided in cleartext at the beginning of each operation. They are typically used for hardware **accelerators**. When a transparent driver is available for a particular combination of parameters (cryptographic algorithm, key type and size, etc.), it is used instead of the default software implementation. Transparent drivers can also be pure software implementations that are distributed as plug-ins to a PSA Cryptography implementation (for example, an alternative implementation with different performance characteristics, or a certified implementation). +* **Opaque** drivers implement cryptographic operations on keys that can only be used inside a protected environment such as a **secure element**, a hardware security module, a smartcard, a secure enclave, etc. An opaque driver is invoked for the specific [key location](#lifetimes-and-locations) that the driver is registered for: the dispatch is based on the key's lifetime. + +### Requirements + +The present specification was designed to fulfill the following high-level requirements. + +[Req.plugins] It is possible to combine multiple drivers from different providers into the same implementation, without any prior arrangement other than choosing certain names and values from disjoint namespaces. + +[Req.compile] It is possible to compile the code of each driver and of the core separately, and link them together. A small amount of glue code may need to be compiled once the list of drivers is available. + +[Req.types] Support drivers for the following types of hardware: accelerators that operate on keys in cleartext; cryptoprocessors that can wrap keys with a built-in keys but not store user keys; and cryptoprocessors that store key material. + +[Req.portable] The interface between drivers and the core does not involve any platform-specific consideration. Driver calls are simple C function calls. Interactions with platform-specific hardware happen only inside the driver (and in fact a driver need not involve any hardware at all). + +[Req.location] Applications can tell which location values correspond to which secure element drivers. + +[Req.fallback] Accelerator drivers can specify that they do not fully support a cryptographic mechanism and that a fallback to core code may be necessary. Conversely, if an accelerator fully supports cryptographic mechanism, the core must be able to omit code for this mechanism. + +[Req.mechanisms] Drivers can specify which mechanisms they support. A driver's code will not be invoked for cryptographic mechanisms that it does not support. + +## Overview of drivers + +### Deliverables for a driver + +To write a driver, you need to implement some functions with C linkage, and to declare these functions in a **driver description file**. The driver description file declares which functions the driver implements and what cryptographic mechanisms they support. If the driver description references custom types, macros or constants, you also need to provide C header files defining those elements. + +The concrete syntax for a driver description file is JSON. The structure of this JSON file is specified in the section [“Driver description syntax”](#driver-description-syntax). + +A driver therefore consists of: + +* A driver description file (in JSON format). +* C header files defining the types required by the driver description. The names of these header files are declared in the driver description file. +* An object file compiled for the target platform defining the entry point functions specified by the driver description. Implementations may allow drivers to be provided as source files and compiled with the core instead of being pre-compiled. + +How to provide the driver description file, the C header files and the object code is implementation-dependent. + +### Driver description syntax + +The concrete syntax for a driver description file is JSON. + +#### Driver description list + +PSA Cryptography core implementations should support multiple drivers. The driver description files are passed to the implementation as an ordered list in an unspecified manner. This may be, for example, a list of file names passed on a command line, or a JSON list whose elements are individual driver descriptions. + +#### Driver description top-level element + +A driver description is a JSON object containing the following properties: + +* `"prefix"` (mandatory, string). This must be a valid prefix for a C identifier. All the types and functions provided by the driver have a name that starts with this prefix unless overridden with a `"name"` element in the applicable capability as described below. +* `"type"` (mandatory, string). One of `"transparent"` or `"opaque"`. +* `"headers"` (optional, array of strings). A list of header files. These header files must define the types, macros and constants referenced by the driver description. They may declare the entry point functions, but this is not required. They may include other PSA headers and standard headers of the platform. Whether they may include other headers is implementation-specific. If omitted, the list of headers is empty. The header files must be present at the specified location relative to a directory on the compiler's include path when compiling glue code between the core and the drivers. +* `"capabilities"` (mandatory, array of [capabilities](#driver-description-capability)). +A list of **capabilities**. Each capability describes a family of functions that the driver implements for a certain class of cryptographic mechanisms. +* `"key_context"` (not permitted for transparent drivers, mandatory for opaque drivers): information about the [representation of keys](#key-format-for-opaque-drivers). +* `"persistent_state_size"` (not permitted for transparent drivers, optional for opaque drivers, integer or string). The size in bytes of the [persistent state of the driver](#opaque-driver-persistent-state). This may be either a non-negative integer or a C constant expression of type `size_t`. +* `"location"` (not permitted for transparent drivers, optional for opaque drivers, integer or string). The [location value](#lifetimes-and-locations) for which this driver is invoked. In other words, this determines the lifetimes for which the driver is invoked. This may be either a non-negative integer or a C constant expression of type `psa_key_location_t`. + +### Driver description capability + +#### Capability syntax + +A capability declares a family of functions that the driver implements for a certain class of cryptographic mechanisms. The capability specifies which key types and algorithms are covered and the names of the types and functions that implement it. + +A capability is a JSON object containing the following properties: + +* `"entry_points"` (mandatory, list of strings). Each element is the name of a [driver entry point](#driver-entry-points) or driver entry point family. An entry point is a function defined by the driver. If specified, the core will invoke this capability of the driver only when performing one of the specified operations. The driver must implement all the specified entry points, as well as the types if applicable. +* `"algorithms"` (optional, list of strings). Each element is an [algorithm specification](#algorithm-specifications). If specified, the core will invoke this capability of the driver only when performing one of the specified algorithms. If omitted, the core will invoke this capability for all applicable algorithms. +* `"key_types"` (optional, list of strings). Each element is a [key type specification](#key-type-specifications). If specified, the core will invoke this capability of the driver only for operations involving a key with one of the specified key types. If omitted, the core will invoke this capability of the driver for all applicable key types. +* `"key_sizes"` (optional, list of integers). If specified, the core will invoke this capability of the driver only for operations involving a key with one of the specified key sizes. If omitted, the core will invoke this capability of the driver for all applicable key sizes. Key sizes are expressed in bits. +* `"names"` (optional, object). A mapping from entry point names described by the `"entry_points"` property, to the name of the C function in the driver that implements the corresponding function. If a function is not listed here, name of the driver function that implements it is the driver's prefix followed by an underscore (`_`) followed by the function name. If this property is omitted, it is equivalent to an empty object (so each entry point *suffix* is implemented by a function called *prefix*`_`*suffix*). +* `"fallback"` (optional for transparent drivers, not permitted for opaque drivers, boolean). If present and true, the driver may return `PSA_ERROR_NOT_SUPPORTED`, in which case the core should call another driver or use built-in code to perform this operation. If absent or false, the driver is expected to fully support the mechanisms described by this capability. See the section “[Fallback](#fallback)” for more information. + +#### Capability semantics + +When the PSA Cryptography implementation performs a cryptographic mechanism, it invokes available driver entry points as described in the section [“Driver entry points”](#driver-entry-points). + +A driver is considered available for a cryptographic mechanism that invokes a given entry point if all of the following conditions are met: + +* The driver specification includes a capability whose `"entry_points"` list either includes the entry point or includes an entry point family that includes the entry point. +* If the mechanism involves an algorithm: + * either the capability does not have an `"algorithms"` property; + * or the value of the capability's `"algorithms"` property includes an [algorithm specification](#algorithm-specifications) that matches this algorithm. +* If the mechanism involves a key: + * either the key is transparent (its location is `PSA_KEY_LOCATION_LOCAL_STORAGE`) and the driver is transparent; + * or the key is opaque (its location is not `PSA_KEY_LOCATION_LOCAL_STORAGE`) and the driver is an opaque driver whose location is the key's location. +* If the mechanism involves a key: + * either the capability does not have a `"key_types"` property; + * or the value of the capability's `"key_types"` property includes a [key type specification](#key-type-specifications) that matches this algorithm. +* If the mechanism involves a key: + * either the capability does not have a `"key_sizes"` property; + * or the value of the capability's `"key_sizes"` property includes the key's size. + +If a driver includes multiple applicable capabilities for a given combination of entry point, algorithm, key type and key size, and all the capabilities map the entry point to the same function name, the driver is considered available for this cryptographic mechanism. If a driver includes multiple applicable capabilities for a given combination of entry point, algorithm, key type and key size, and at least two of these capabilities map the entry point to the different function names, the driver specification is invalid. + +If multiple transparent drivers have applicable capabilities for a given combination of entry point, algorithm, key type and key size, the first matching driver in the [specification list](#driver-description-list) is invoked. If the capability has [fallback](#fallback) enabled and the first driver returns `PSA_ERROR_NOT_SUPPORTED`, the next matching driver is invoked, and so on. + +If multiple opaque drivers have the same location, the list of driver specifications is invalid. + +#### Capability examples + +Example 1: the following capability declares that the driver can perform deterministic ECDSA signatures (but not signature verification) using any hash algorithm and any curve that the core supports. If the prefix of this driver is `"acme"`, the function that performs the signature is called `acme_sign_hash`. +``` +{ + "entry_points": ["sign_hash"], + "algorithms": ["PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_ANY_HASH)"], +} +``` + +Example 2: the following capability declares that the driver can perform deterministic ECDSA signatures using SHA-256 or SHA-384 with a SECP256R1 or SECP384R1 private key (with either hash being possible in combination with either curve). If the prefix of this driver is `"acme"`, the function that performs the signature is called `acme_sign_hash`. +``` +{ + "entry_points": ["sign_hash"], + "algorithms": ["PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_SHA_256)", + "PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_SHA_384)"], + "key_types": ["PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_CURVE_SECP_R1)"], + "key_sizes": [256, 384] +} +``` + +### Algorithm and key specifications + +#### Algorithm specifications + +An algorithm specification is a string consisting of a `PSA_ALG_xxx` macro that specifies a cryptographic algorithm or an algorithm wildcard policy defined by the PSA Cryptography API. If the macro takes arguments, the string must have the syntax of a C macro call and each argument must be an algorithm specification or a decimal or hexadecimal literal with no suffix, depending on the expected type of argument. + +Spaces are optional after commas. Whether other whitespace is permitted is implementation-specific. + +Valid examples: +``` +PSA_ALG_SHA_256 +PSA_ALG_HMAC(PSA_ALG_SHA_256) +PSA_ALG_KEY_AGREEMENT(PSA_ALG_ECDH, PSA_ALG_HKDF(PSA_ALG_SHA_256)) +PSA_ALG_RSA_PSS(PSA_ALG_ANY_HASH) +``` + +#### Key type specifications + +An algorithm specification is a string consisting of a `PSA_KEY_TYPE_xxx` macro that specifies a key type defined by the PSA Cryptography API. If the macro takes an argument, the string must have the syntax of a C macro call and each argument must be the name of a constant of suitable type (curve or group). + +The name `_` may be used instead of a curve or group to indicate that the capability concerns all curves or groups. + +Valid examples: +``` +PSA_KEY_TYPE_AES +PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_CURVE_SECP_R1) +PSA_KEY_TYPE_ECC_KEY_PAIR(_) +``` + +### Driver entry points + +#### Overview of driver entry points + +Drivers define functions, each of which implements an aspect of a capability of a driver, such as a cryptographic operation, a part of a cryptographic operation, or a key management action. These functions are called the **entry points** of the driver. Most driver entry points correspond to a particular function in the PSA Cryptography API. For example, if a call to `psa_sign_hash()` is dispatched to a driver, it invokes the driver's `sign_hash` function. + +All driver entry points return a status of type `psa_status_t` which should use the status codes documented for PSA services in general and for PSA Cryptography in particular: `PSA_SUCCESS` indicates that the function succeeded, and `PSA_ERROR_xxx` values indicate that an error occurred. + +The signature of a driver entry point generally looks like the signature of the PSA Cryptography API that it implements, with some modifications. This section gives an overview of modifications that apply to whole classes of entry points. Refer to the reference section for each entry point or entry point family for details. + +* For entry points that operate on an existing key, the `psa_key_id_t` parameter is replaced by a sequence of three parameters that describe the key: + 1. `const psa_key_attributes_t *attributes`: the key attributes. + 2. `const uint8_t *key_buffer`: a key material or key context buffer. + 3. `size_t key_buffer_size`: the size of the key buffer in bytes. + + For transparent drivers, the key buffer contains the key material, in the same format as defined for `psa_export_key()` and `psa_export_public_key()` in the PSA Cryptography API. For opaque drivers, the content of the key buffer is entirely up to the driver. + +* For entry points that involve a multi-part operation, the operation state type (`psa_XXX_operation_t`) is replaced by a driver-specific operation state type (*prefix*`_XXX_operation_t`). + +* For entry points that are involved in key creation, the `psa_key_id_t *` output parameter is replaced by a sequence of parameters that convey the key context: + 1. `uint8_t *key_buffer`: a buffer for the key material or key context. + 2. `size_t key_buffer_size`: the size of the key buffer in bytes. + 2. `size_t *key_buffer_length`: the length of the data written to the key buffer in bytes. + +Some entry points are grouped in families that must be implemented as a whole. If a driver supports an entry point family, it must provide all the entry points in the family. + +#### General considerations on driver entry point parameters + +Buffer parameters for driver entry points obey the following conventions: + +* An input buffer has the type `const uint8_t *` and is immediately followed by a parameter of type `size_t` that indicates the buffer size. +* An output buffer has the type `uint8_t *` and is immediately followed by a parameter of type `size_t` that indicates the buffer size. A third parameter of type `size_t *` is provided to report the actual length of the data written in the buffer if the function succeeds. +* An in-out buffer has the type `uint8_t *` and is immediately followed by a parameter of type `size_t` that indicates the buffer size. In-out buffers are only used when the input and the output have the same length. + +Buffers of size 0 may be represented with either a null pointer or a non-null pointer. + +Input buffers and other input-only parameters (`const` pointers) may be in read-only memory. Overlap is possible between input buffers, and between an input buffer and an output buffer, but not between two output buffers or between a non-buffer parameter and another parameter. + +#### Driver entry points for single-part cryptographic operations + +The following driver entry points perform a cryptographic operation in one shot (single-part operation): + +* `"hash_compute"` (transparent drivers only): calculation of a hash. Called by `psa_hash_compute()` and `psa_hash_compare()`. To verify a hash with `psa_hash_compare()`, the core calls the driver's `"hash_compute"` entry point and compares the result with the reference hash value. +* `"mac_compute"`: calculation of a MAC. Called by `psa_mac_compute()` and possibly `psa_mac_verify()`. To verify a mac with `psa_mac_verify()`, the core calls an applicable driver's `"mac_verify"` entry point if there is one, otherwise the core calls an applicable driver's `"mac_compute"` entry point and compares the result with the reference MAC value. +* `"mac_verify"`: verification of a MAC. Called by `psa_mac_verify()`. This entry point is mainly useful for drivers of secure elements that verify a MAC without revealing the correct MAC. Although transparent drivers may implement this entry point in addition to `"mac_compute"`, it is generally not useful because the core can call the `"mac_compute"` entry point and compare with the expected MAC value. +* `"cipher_encrypt"`: unauthenticated symmetric cipher encryption. Called by `psa_cipher_encrypt()`. +* `"cipher_decrypt"`: unauthenticated symmetric cipher decryption. Called by `psa_cipher_decrypt()`. +* `"aead_encrypt"`: authenticated encryption with associated data. Called by `psa_aead_encrypt()`. +* `"aead_decrypt"`: authenticated decryption with associated data. Called by `psa_aead_decrypt()`. +* `"asymmetric_encrypt"`: asymmetric encryption. Called by `psa_asymmetric_encrypt()`. +* `"asymmetric_decrypt"`: asymmetric decryption. Called by `psa_asymmetric_decrypt()`. +* `"sign_hash"`: signature of an already calculated hash. Called by `psa_sign_hash()` and possibly `psa_sign_message()`. To sign a message with `psa_sign_message()`, the core calls an applicable driver's `"sign_message"` entry point if there is one, otherwise the core calls an applicable driver's `"hash_compute"` entry point followed by an applicable driver's `"sign_hash"` entry point. +* `"verify_hash"`: verification of an already calculated hash. Called by `psa_verify_hash()` and possibly `psa_verify_message()`. To verify a message with `psa_verify_message()`, the core calls an applicable driver's `"verify_message"` entry point if there is one, otherwise the core calls an applicable driver's `"hash_compute"` entry point followed by an applicable driver's `"verify_hash"` entry point. +* `"sign_message"`: signature of a message. Called by `psa_sign_message()`. +* `"verify_message"`: verification of a message. Called by `psa_verify_message()`. +* `"key_agreement"`: key agreement without a subsequent key derivation. Called by `psa_raw_key_agreement()` and possibly `psa_key_derivation_key_agreement()`. + +### Driver entry points for multi-part operations + +#### General considerations on multi-part operations + +The entry points that implement each step of a multi-part operation are grouped into a family. A driver that implements a multi-part operation must define all of the entry points in this family as well as a type that represents the operation context. The lifecycle of a driver operation context is similar to the lifecycle of an API operation context: + +1. The core initializes operation context objects to either all-bits-zero or to logical zero (`{0}`), at its discretion. +1. The core calls the `xxx_setup` entry point for this operation family. If this fails, the core destroys the operation context object without calling any other driver entry point on it. +1. The core calls other entry points that manipulate the operation context object, respecting the constraints. +1. If any entry point fails, the core calls the driver's `xxx_abort` entry point for this operation family, then destroys the operation context object without calling any other driver entry point on it. +1. If a “finish” entry point fails, the core destroys the operation context object without calling any other driver entry point on it. The finish entry points are: *prefix*`_mac_sign_finish`, *prefix*`_mac_verify_finish`, *prefix*`_cipher_fnish`, *prefix*`_aead_finish`, *prefix*`_aead_verify`. + +If a driver implements a multi-part operation but not the corresponding single-part operation, the core calls the driver's multipart operation entry points to perform the single-part operation. + +#### Multi-part operation entry point family `"hash_multipart"` + +This family corresponds to the calculation of a hash in multiple steps. + +This family applies to transparent drivers only. + +This family requires the following type and entry points: + +* Type `"hash_operation_t"`: the type of a hash operation context. It must be possible to copy a hash operation context byte by byte, therefore hash operation contexts must not contain any embedded pointers (except pointers to global data that do not change after the setup step). +* `"hash_setup"`: called by `psa_hash_setup()`. +* `"hash_update"`: called by `psa_hash_update()`. +* `"hash_finish"`: called by `psa_hash_finish()` and `psa_hash_verify()`. +* `"hash_abort"`: called by all multi-part hash functions of the PSA Cryptography API. + +To verify a hash with `psa_hash_verify()`, the core calls the driver's *prefix*`_hash_finish` entry point and compares the result with the reference hash value. + +For example, a driver with the prefix `"acme"` that implements the `"hash_multipart"` entry point family must define the following type and entry points (assuming that the capability does not use the `"names"` property to declare different type and entry point names): + +``` +typedef ... acme_hash_operation_t; +psa_status_t acme_hash_setup(acme_hash_operation_t *operation, + psa_algorithm_t alg); +psa_status_t acme_hash_update(acme_hash_operation_t *operation, + const uint8_t *input, + size_t input_length); +psa_status_t acme_hash_finish(acme_hash_operation_t *operation, + uint8_t *hash, + size_t hash_size, + size_t *hash_length); +psa_status_t acme_hash_abort(acme_hash_operation_t *operation); +``` + +#### Operation family `"mac_multipart"` + +TODO + +#### Operation family `"mac_verify_multipart"` + +TODO + +#### Operation family `"cipher_encrypt_multipart"` + +TODO + +#### Operation family `"cipher_decrypt_multipart"` + +TODO + +#### Operation family `"aead_encrypt_multipart"` + +TODO + +#### Operation family `"aead_decrypt_multipart"` + +TODO + +#### Operation family `"key_derivation"` + +This family requires the following type and entry points: + +* Type `"key_derivation_operation_t"`: the type of a key derivation operation context. +* `"key_derivation_setup"`: called by `psa_key_derivation_setup()`. +* `"key_derivation_set_capacity"`: called by `psa_key_derivation_set_capacity()`. The core will always enforce the capacity, therefore this function does not need to do anything for algorithms where the output stream only depends on the effective generated length and not on the capacity. +* `"key_derivation_input_bytes"`: called by `psa_key_derivation_input_bytes()` and `psa_key_derivation_input_key()`. For transparent drivers, when processing a call to `psa_key_derivation_input_key()`, the core always calls the applicable driver's `"key_derivation_input_bytes"` entry point. +* `"key_derivation_input_key"` (opaque drivers only) +* `"key_derivation_output_bytes"`: called by `psa_key_derivation_output_bytes()`; also by `psa_key_derivation_output_key()` for transparent drivers. +* `"key_derivation_output_key"`: called by `psa_key_derivation_output_key()` for transparent drivers when deriving an asymmetric key pair, and also for opaque drivers. +* `"key_derivation_abort"`: called by all key derivation functions of the PSA Cryptography API. + +TODO: key input and output for opaque drivers; deterministic key generation for transparent drivers + +TODO + +### Driver entry points for key management + +The driver entry points for key management differ significantly between [transparent drivers](#key-management-with-transparent-drivers) and [opaque drivers](#key-management-with-opaque-drivers). This section describes common elements. Refer to the applicable section for each driver type for more information. + +The entry points that create or format key data have the following prototypes for a driver with the prefix `"acme"`: + +``` +psa_status_t acme_import_key(const psa_key_attributes_t *attributes, + const uint8_t *data, + size_t data_length, + uint8_t *key_buffer, + size_t key_buffer_size, + size_t *key_buffer_length, + size_t *bits); // additional parameter, see below +psa_status_t acme_generate_key(const psa_key_attributes_t *attributes, + uint8_t *key_buffer, + size_t key_buffer_size, + size_t *key_buffer_length); +``` + +TODO: derivation, copy + +* The key attributes (`attributes`) have the same semantics as in the PSA Cryptography application interface. +* For the `"import_key"` entry point, the input in the `data` buffer is either the export format or an implementation-specific format that the core documents as an acceptable input format for `psa_import_key()`. +* The size of the key data buffer `key_buffer` is sufficient for the internal representation of the key. For a transparent driver, this is the key's [export format](#key-format-for-transparent-drivers). For an opaque driver, this is the size determined from the driver description and the key attributes, as specified in the section [“Key format for opaque drivers”](#key-format-for-opaque-drivers). +* For an opaque driver with an `"allocate_key"` entry point, the content of the key data buffer on entry is the output of that entry point. +* The `"import_key"` entry point must determine or validate the key size and set `*bits` as described in the section [“Key size determination on import”](#key-size-determination-on-import) below. + +All key creation entry points must ensure that the resulting key is valid as specified in the section [“Key validation”](#key-validation) below. This is primarily important for import entry points since the key data comes from the application. + +#### Key size determination on import + +The `"import_key"` entry point must determine or validate the key size. +The PSA Cryptography API exposes the key size as part of the key attributes. +When importing a key, the key size recorded in the key attributes can be either a size specified by the caller of the API (who may not be trusted), or `0` which indicates that the size must be calculated from the data. + +When the core calls the `"import_key"` entry point to process a call to `psa_import_key`, it passes an `attributes` structure such that `psa_get_key_bits(attributes)` is the size passed by the caller of `psa_import_key`. If this size is `0`, the `"import_key"` entry point must set the `bits` input-output parameter to the correct key size. The semantics of `bits` is as follows: + +* The core sets `*bits` to `psa_get_key_bits(attributes)` before calling the `"import_key"` entry point. +* If `*bits == 0`, the driver must determine the key size from the data and set `*bits` to this size. If the key size cannot be determined from the data, the driver must return `PSA_ERROR_INVALID_ARGUMENT` (as of version 1.0 of the PSA Cryptography API specification, it is possible to determine the key size for all standard key types). +* If `*bits != 0`, the driver must check the value of `*bits` against the data and return `PSA_ERROR_INVALID_ARGUMENT` if it does not match. If the driver entry point changes `*bits` to a different value but returns `PSA_SUCCESS`, the core will consider the key as invalid and the import will fail. + +#### Key validation + +Key creation entry points must produce valid key data. Key data is _valid_ if operations involving the key are guaranteed to work functionally and not to cause indirect security loss. Operation functions are supposed to receive valid keys, and should not have to check and report invalid keys. For example: + +* If a cryptographic mechanism is defined as having keying material of a certain size, or if the keying material involves integers that have to be in a certain range, key creation must ensure that the keying material has an appropriate size and falls within an appropriate range. +* If a cryptographic operation involves a division by an integer which is provided as part of a key, key creation must ensure that this integer is nonzero. +* If a cryptographic operation involves two keys A and B (or more), then the creation of A must ensure that using it does not risk compromising B. This applies even if A's policy does not explicitly allow a problematic operation, but A is exportable. In particular, public keys that can potentially be used for key agreement are considered invalid and must not be created if they risk compromising the private key. +* On the other hand, it is acceptable for import to accept a key that cannot be verified as valid if using this key would at most compromise the key itself and material that is secured with this key. For example, RSA key import does not need to verify that the primes are actually prime. Key import may accept an insecure key if the consequences of the insecurity are no worse than a leak of the key prior to its import. + +With opaque drivers, the key context can only be used by code from the same driver, so key validity is primarily intended to report key creation errors at creation time rather than during an operation. With transparent drivers, the key context can potentially be used by code from a different provider, so key validity is critical for interoperability. + +This section describes some minimal validity requirements for standard key types. + +* For symmetric key types, check that the key size is suitable for the type. +* For DES (`PSA_KEY_TYPE_DES`), additionally verify the parity bits. +* For RSA (`PSA_KEY_TYPE_RSA_PUBLIC_KEY`, `PSA_KEY_TYPE_RSA_KEY_PAIR`), check the syntax of the key and make sanity checks on its components. TODO: what sanity checks? Value ranges (e.g. p < n), sanity checks such as parity, minimum and maximum size, what else? +* For elliptic curve private keys (`PSA_KEY_TYPE_ECC_KEY_PAIR`), check the size and range. TODO: what else? +* For elliptic curve public keys (`PSA_KEY_TYPE_ECC_PUBLIC_KEY`), check the size and range, and that the point is on the curve. TODO: what else? + +### Miscellaneous driver entry points + +#### Driver initialization + +A driver may declare an `"init"` entry point in a capability with no algorithm, key type or key size. If so, the core calls this entry point once during the initialization of the PSA Cryptography subsystem. If the init entry point of any driver fails, the initialization of the PSA Cryptography subsystem fails. + +When multiple drivers have an init entry point, the order in which they are called is unspecified. It is also unspecified whether other drivers' `"init"` entry points are called if one or more init entry point fails. + +On platforms where the PSA Cryptography implementation is a subsystem of a single application, the initialization of the PSA Cryptography subsystem takes place during the call to `psa_crypto_init()`. On platforms where the PSA Cryptography implementation is separate from the application or applications, the initialization of the PSA Cryptography subsystem takes place before or during the first time an application calls `psa_crypto_init()`. + +The init entry point does not take any parameter. + +### Combining multiple drivers + +To declare a cryptoprocessor can handle both cleartext and wrapped keys, you need to provide two driver descriptions, one for a transparent driver and one for an opaque driver. You can use the mapping in capabilities' `"names"` property to arrange for multiple driver entry points to map to the same C function. + +## Transparent drivers + +### Key format for transparent drivers + +The format of a key for transparent drivers is the same as in applications. Refer to the documentation of [`psa_export_key()`](https://armmbed.github.io/mbed-crypto/html/api/keys/management.html#c.psa_export_key) and [`psa_export_public_key()`](https://armmbed.github.io/mbed-crypto/html/api/keys/management.html#c.psa_export_public_key) in the PSA Cryptography API specification. For custom key types defined by an implementation, refer to the documentation of that implementation. + +### Key management with transparent drivers + +Transparent drivers may provide the following key management entry points: + +* [`"import_key"`](#key-import-with-transparent-drivers): called by `psa_import_key()`, only when importing a key pair or a public key (key such that `PSA_KEY_TYPE_IS_ASYMMETRIC` is true). +* `"generate_key"`: called by `psa_generate_key()`, only when generating a key pair (key such that `PSA_KEY_TYPE_IS_KEY_PAIR` is true). +* `"key_derivation_output_key"`: called by `psa_key_derivation_output_key()`, only when deriving a key pair (key such that `PSA_KEY_TYPE_IS_KEY_PAIR` is true). +* `"export_public_key"`: called by the core to obtain the public key of a key pair. The core may call this function at any time to obtain the public key, which can be for `psa_export_public_key()` but also at other times, including during a cryptographic operation that requires the public key such as a call to `psa_verify_message()` on a key pair object. + +Transparent drivers are not involved when exporting, copying or destroying keys, or when importing, generating or deriving symmetric keys. + +#### Key import with transparent drivers + +As discussed in [the general section about key management entry points](#driver-entry-points-for-key-management), the key import entry points has the following prototype for a driver with the prefix `"acme"`: +``` +psa_status_t acme_import_key(const psa_key_attributes_t *attributes, + const uint8_t *data, + size_t data_length, + uint8_t *key_buffer, + size_t key_buffer_size, + size_t *key_buffer_length, + size_t *bits); +``` + +This entry point has several roles: + +1. Parse the key data in the input buffer `data`. The driver must support the export format for the key types that the entry point is declared for. It may support additional formats as specified in the description of [`psa_import_key()`](https://armmbed.github.io/mbed-crypto/html/api/keys/management.html#c.psa_export_key) in the PSA Cryptography API specification. +2. Validate the key data. The necessary validation is described in the section [“Key validation with transparent drivers”](#key-validation-with-transparent-drivers) above. +3. [Determine the key size](#key-size-determination-on-import) and output it through `*bits`. +4. Copy the validated key data from `data` to `key_buffer`. The output must be in the canonical format documented for [`psa_export_key()`](https://armmbed.github.io/mbed-crypto/html/api/keys/management.html#c.psa_export_key) or [`psa_export_public_key()`](https://armmbed.github.io/mbed-crypto/html/api/keys/management.html#c.psa_export_public_key), so if the input is not in this format, the entry point must convert it. + +### Fallback + +Sometimes cryptographic accelerators only support certain cryptographic mechanisms partially. The capability description language allows specifying some restrictions, including restrictions on key sizes, but it cannot cover all the possibilities that may arise in practice. Furthermore, it may be desirable to deploy the same binary image on different devices, only some of which have a cryptographic accelerators. +For these purposes, a transparent driver can declare that it only supports a [capability](#driver-description-capability) partially, by setting the capability's `"fallback"` property to true. + +If a transparent driver entry point is part of a capability which has a true `"fallback"` property and returns `PSA_ERROR_NOT_SUPPORTED`, the core will call the next transparent driver that supports the mechanism, if there is one. The core considers drivers in the order given by the [driver description list](#driver-description-list). + +If all the available drivers have fallback enabled and return `PSA_ERROR_NOT_SUPPORTED`, the core will perform the operation using built-in code. +As soon as a driver returns any value other than `PSA_ERROR_NOT_SUPPORTED` (`PSA_SUCCESS` or a different error code), this value is returned to the application, without attempting to call any other driver or built-in code. + +If a transparent driver entry point is part of a capability where the `"fallback"` property is false or omitted, the core should not include any other code for this capability, whether built in or in another transparent driver. + +## Opaque drivers + +Opaque drivers allow a PSA Cryptography implementation to delegate cryptographic operations to a separate environment that might not allow exporting key material in cleartext. The opaque driver interface is designed so that the core never inspects the representation of a key. The opaque driver interface is designed to support two subtypes of cryptoprocessors: + +* Some cryptoprocessors do not have persistent storage for individual keys. The representation of a key is the key material wrapped with a master key which is located in the cryptoprocessor and never exported from it. The core stores this wrapped key material on behalf of the cryptoprocessor. +* Some cryptoprocessors have persistent storage for individual keys. The representation of a key is an identifier such as label or slot number. The core stores this identifier. + +### Key format for opaque drivers + +The format of a key for opaque drivers is an opaque blob. The content of this blob is fully up to the driver. The core merely stores this blob. + +Note that since the core stores the key context blob as it is in memory, it must only contain data that is meaningful after a reboot. In particular, it must not contain any pointers or transient handles. + +The `"key_context"` property in the [driver description](#driver-description-top-level-element) specifies how to calculate the size of the key context as a function of the key type and size. This is an object with the following properties: + +* `"base_size"` (integer or string, optional): this many bytes are included in every key context. If omitted, this value defaults to 0. +* `"key_pair_size"` (integer or string, optional): this many bytes are included in every key context for a key pair. If omitted, this value defaults to 0. +* `"public_key_size"` (integer or string, optional): this many bytes are included in every key context for a public key. If omitted, this value defaults to 0. +* `"symmetric_factor"` (integer or string, optional): every key context for a symmetric key includes this many times the key size. If omitted, this value defaults to 0. +* `"store_public_key"` (boolean, optional): If specified and true, for a key pair, the key context includes space for the public key. If omitted or false, no additional space is added for the public key. +* `"size_function"` (string, optional): the name of a function that returns the number of bytes that the driver needs in a key context for a key. This may be a pointer to function. This must be a C identifier; more complex expressions are not permitted. If the core uses this function, it supersedes all the other properties. + +The integer properties must be C language constants. A typical value for `"base_size"` is `sizeof(acme_key_context_t)` where `acme_key_context_t` is a type defined in a driver header file. + +#### Size of a dynamically allocated key context + +If the core supports dynamic allocation for the key context and chooses to use it, and the driver specification includes the `"size_function"` property, the size of the key context is at least +``` +size_function(key_type, key_bits) +``` +where `size_function` is the function named in the `"size_function"` property, `key_type` is the key type and `key_bits` is the key size in bits. The prototype of the size function is +``` +size_t size_function(psa_key_type_t key_type, size_t key_bits); +``` + +#### Size of a statically allocated key context + +If the core does not support dynamic allocation for the key context or chooses not to use it, or if the driver specification does not include the `"size_function"` property, the size of the key context for a key of type `key_type` and of size `key_bits` bits is: + +* For a key pair (`PSA_KEY_TYPE_IS_KEY_PAIR(key_type)` is true): + ``` + base_size + key_pair_size + public_key_overhead + ``` + where `public_key_overhead = PSA_EXPORT_PUBLIC_KEY_MAX_SIZE(key_type, key_bits)` if the `"store_public_key"` property is true and `public_key_overhead = 0` otherwise. + +* For a public key (`PSA_KEY_TYPE_IS_PUBLIC_KEY(key_type)` is true): + ``` + base_size + public_key_size + ``` + +* For a symmetric key (not a key pair or public key): + ``` + base_size + symmetric_factor * key_bytes + ``` + where `key_bytes = ((key_bits + 7) / 8)` is the key size in bytes. + +#### Key context size for a secure element with storage + +If the key is stored in the secure element and the driver only needs to store a label for the key, use `"base_size"` as the size of the label plus any other metadata that the driver needs to store, and omit the other properties. + +If the key is stored in the secure element, but the secure element does not store the public part of a key pair and cannot recompute it on demand, additionally use the `"store_public_key"` property with the value `true`. Note that this only influences the size of the key context: the driver code must copy the public key to the key context and retrieve it on demand in its `export_public_key` entry point. + +#### Key context size for a secure element without storage + +If the key is stored in wrapped form outside the secure element, and the wrapped form of the key plus any metadata has up to *N* bytes of overhead, use *N* as the value of the `"base_size"` property and set the `"symmetric_factor"` property to 1. Set the `"key_pair_size"` and `"public_key_size"` properties appropriately for the largest supported key pair and the largest supported public key respectively. + +### Key management with opaque drivers + +Opaque drivers may provide the following key management entry points: + +* `"export_key"`: called by `psa_export_key()`, or by `psa_copy_key()` when copying a key from or to a different [location](#lifetimes-and-locations). +* `"export_public_key"`: called by the core to obtain the public key of a key pair. The core may call this entry point at any time to obtain the public key, which can be for `psa_export_public_key()` but also at other times, including during a cryptographic operation that requires the public key such as a call to `psa_verify_message()` on a key pair object. +* `"import_key"`: called by `psa_import_key()`, or by `psa_copy_key()` when copying a key from another location. +* `"generate_key"`: called by `psa_generate_key()`. +* `"key_derivation_output_key"`: called by `psa_key_derivation_output_key()`. +* `"copy_key"`: called by `psa_copy_key()` when copying a key within the same [location](#lifetimes-and-locations). + +In addition, secure elements that store the key material internally must provide the following two entry points: + +* `"allocate_key"`: called by `psa_import_key()`, `psa_generate_key()`, `psa_key_derivation_output_key()` or `psa_copy_key()` before creating a key in the location of this driver. +* `"destroy_key"`: called by `psa_destroy_key()`. + +#### Key creation in a secure element without storage + +This section describes the key creation process for secure elements that do not store the key material. The driver must obtain a wrapped form of the key material which the core will store. A driver for such a secure element has no `"allocate_key"` or `"destroy_key"` entry point. + +When creating a key with an opaque driver which does not have an `"allocate_key"` or `"destroy_key"` entry point: + +1. The core allocates memory for the key context. +2. The core calls the driver's import, generate, derive or copy entry point. +3. The core saves the resulting wrapped key material and any other data that the key context may contain. + +To destroy a key, the core simply destroys the wrapped key material, without invoking driver code. + +#### Key management in a secure element with storage + +This section describes the key creation and key destruction processes for secure elements that have persistent storage for the key material. A driver for such a secure element has two mandatory entry points: + +* `"allocate_key"`: this function obtains an internal identifier for the key. This may be, for example, a unique label or a slot number. +* `"destroy_key"`: this function invalidates the internal identifier and destroys the associated key material. + +These functions have the following prototypes for a driver with the prefix `"acme"`: +``` +psa_status_t acme_allocate_key(const psa_key_attributes_t *attributes, + uint8_t *key_buffer, + size_t key_buffer_size); +psa_status_t acme_destroy_key(const psa_key_attributes_t *attributes, + const uint8_t *key_buffer, + size_t key_buffer_size); +``` + +When creating a persistent key with an opaque driver which has an `"allocate_key"` entry point: + +1. The core calls the driver's `"allocate_key"` entry point. This function typically allocates an internal identifier for the key without modifying the state of the secure element and stores the identifier in the key context. This function should not modify the state of the secure element. It may modify the copy of the persistent state of the driver in memory. + +1. The core saves the key context to persistent storage. + +1. The core calls the driver's key creation entry point. + +1. The core saves the updated key context to persistent storage. + +If a failure occurs after the `"allocate_key"` step but before the call to the second driver entry point, the core will do one of the following: + +* Fail the creation of the key without indicating this to the driver. This can happen, in particular, if the device loses power immediately after the key allocation entry point returns. +* Call the driver's `"destroy_key"` entry point. + +To destroy a key, the core calls the driver's `"destroy_key"` entry point. + +Note that the key allocation and destruction entry points must not rely solely on the key identifier in the key attributes to identify a key. Some implementations of the PSA Cryptography API store keys on behalf of multiple clients, and different clients may use the same key identifier to designate different keys. The manner in which the core distinguishes keys that have the same identifier but are part of the key namespace for different clients is implementation-dependent and is not accessible to drivers. Some typical strategies to allocate an internal key identifier are: + +* Maintain a set of free slot numbers which is stored either in the secure element or in the driver's persistent storage. To allocate a key slot, find a free slot number, mark it as occupied and store the number in the key context. When the key is destroyed, mark the slot number as free. +* Maintain a monotonic counter with a practically unbounded range in the secure element or in the driver's persistent storage. To allocate a key slot, increment the counter and store the current value in the key context. Destroying a key does not change the counter. + +TODO: explain constraints on how the driver updates its persistent state for resilience + +TODO: some of the above doesn't apply to volatile keys + +#### Key creation entry points in opaque drivers + +The key creation entry points have the following prototypes for a driver with the prefix `"acme"`: + +``` +psa_status_t acme_import_key(const psa_key_attributes_t *attributes, + const uint8_t *data, + size_t data_length, + uint8_t *key_buffer, + size_t key_buffer_size, + size_t *key_buffer_length, + size_t *bits); +psa_status_t acme_generate_key(const psa_key_attributes_t *attributes, + uint8_t *key_buffer, + size_t key_buffer_size, + size_t *key_buffer_length); +``` + +If the driver has an [`"allocate_key"` entry point](#key-management-in-a-secure-element-with-storage), the core calls the `"allocate_key"` entry point with the same attributes on the same key buffer before calling the key creation entry point. + +TODO: derivation, copy + +#### Key export entry points in opaque drivers + +The key export entry points have the following prototypes for a driver with the prefix `"acme"`: + +``` +psa_status_t acme_export_key(const psa_key_attributes_t *attributes, + const uint8_t *key_buffer, + size_t key_buffer_size, + uint8_t *data, + size_t data_size, + size_t *data_length); +psa_status_t acme_export_public_key(const psa_key_attributes_t *attributes, + const uint8_t *key_buffer, + size_t key_buffer_size, + uint8_t *data, + size_t data_size, + size_t *data_length); +``` + +The core will only call `acme_export_public_key` on a private key. Drivers implementers may choose to store the public key in the key context buffer or to recalculate it on demand. If the key context includes the public key, it needs to have an adequate size; see [“Key format for opaque drivers”](#key-format-for-opaque-drivers). + +The core guarantees that the size of the output buffer (`data_size`) is sufficient to export any key with the given attributes. The driver must set `*data_length` to the exact size of the exported key. + +### Opaque driver persistent state + +The core maintains persistent state on behalf of an opaque driver. This persistent state consists of a single byte array whose size is given by the `"persistent_state_size"` property in the [driver description](#driver-description-top-level-element). + +The core loads the persistent state in memory before it calls the driver's [init entry point](#driver-initialization). It is adjusted to match the size declared by the driver, in case a driver upgrade changes the size: + +* The first time the driver is loaded on a system, the persistent state is all-bits-zero. +* If the stored persistent state is smaller than the declared size, the core pads the persistent state with all-bits-zero at the end. +* If the stored persistent state is larger than the declared size, the core truncates the persistent state to the declared size. + +The core provides the following callback functions, which an opaque driver may call while it is processing a call from the driver: +``` +psa_status_t psa_crypto_driver_get_persistent_state(uint_8_t **persistent_state_ptr); +psa_status_t psa_crypto_driver_commit_persistent_state(size_t from, size_t length); +``` + +`psa_crypto_driver_get_persistent_state` sets `*persistent_state_ptr` to a pointer to the first byte of the persistent state. This pointer remains valid during a call to a driver entry point. Once the entry point returns, the pointer is no longer valid. The core guarantees that calls to `psa_crypto_driver_get_persistent_state` within the same entry point return the same address for the persistent state, but this address may change between calls to an entry point. + +`psa_crypto_driver_commit_persistent_state` updates the persistent state in persistent storage. Only the portion at byte offsets `from` inclusive to `from + length` exclusive is guaranteed to be updated; it is unspecified whether changes made to other parts of the state are taken into account. The driver must call this function after updating the persistent state in memory and before returning from the entry point, otherwise it is unspecified whether the persistent state is updated. + +The core will not update the persistent state in storage while an entry point is running except when the entry point calls `psa_crypto_driver_commit_persistent_state`. It may update the persistent state in storage after an entry point returns. + +In a multithreaded environment, the driver may only call these two functions from the thread that is executing the entry point. + +## How to use drivers from an application + +### Using transparent drivers + +Transparent drivers linked into the library are automatically used for the mechanisms that they implement. + +### Using opaque drivers + +Each opaque driver is assigned a [location](#lifetimes-and-locations). The driver is invoked for all actions that use a key in that location. A key's location is indicated by its lifetime. The application chooses the key's lifetime when it creates the key. + +For example, the following snippet creates an AES-GCM key which is only accessible inside the secure element designated by the location `PSA_KEY_LOCATION_acme`. +``` +psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; +psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION( + PSA_KEY_PERSISTENCE_DEFAULT, PSA_KEY_LOCATION_acme)); +psa_set_key_identifer(&attributes, 42); +psa_set_key_type(&attributes, PSA_KEY_TYPE_AES); +psa_set_key_size(&attributes, 128); +psa_set_key_algorithm(&attributes, PSA_ALG_GCM); +psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT); +psa_key_id_t key; +psa_generate_key(&attributes, &key); +``` + +## Using opaque drivers from an application + +### Lifetimes and locations + +The PSA Cryptography API, version 1.0.0, defines [lifetimes](https://armmbed.github.io/mbed-crypto/html/api/keys/attributes.html?highlight=psa_key_lifetime_t#c.psa_key_lifetime_t) as an attribute of a key that indicates where the key is stored and which application and system actions will create and destroy it. The lifetime is expressed as a 32-bit value (`typedef uint32_t psa_key_lifetime_t`). An upcoming version of the PSA Cryptography API defines more structure for lifetime values to separate these two aspects of the lifetime: + +* Bits 0–7 are a _persistence level_. This value indicates what device management actions can cause it to be destroyed. In particular, it indicates whether the key is volatile or persistent. +* Bits 8–31 are a _location indicator_. This value indicates where the key material is stored and where operations on the key are performed. Location values can be stored in a variable of type `psa_key_location_t`. + +An opaque driver is attached to a specific location. Keys in the default location (`PSA_KEY_LOCATION_LOCAL_STORAGE = 0`) are transparent: the core has direct access to the key material. For keys in a location that is managed by an opaque driver, only the secure element has access to the key material and can perform operations on the key, while the core only manipulates a wrapped form of the key or an identifier of the key. + +### Creating a key in a secure element + +The core defines a compile-time constant for each opaque driver indicating its location called `PSA_KEY_LOCATION_`*prefix* where *prefix* is the value of the `"prefix"` property in the driver description. For convenience, Mbed TLS also declares a compile-time constant for the corresponding lifetime with the default persistence called `PSA_KEY_LIFETIME_`*prefix*. Therefore, to declare an opaque key in the location with the prefix `foo` with the default persistence, call `psa_set_key_lifetime` during the key creation as follows: +``` +psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_foo); +``` + +To declare a volatile key: +``` +psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION( + PSA_KEY_LOCATION_foo, + PSA_KEY_PERSISTENCE_VOLATILE)); +``` + +Generally speaking, to declare a key with a specified persistence: +``` +psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION( + PSA_KEY_LOCATION_foo, + persistence)); +``` + +## Open questions + +### Driver declarations + +#### Declaring driver entry points + +The core may want to provide declarations for the driver entry points so that it can compile code using them. At the time of writing this paragraph, the driver headers must define types but there is no obligation for them to declare functions. The core knows what the function names and argument types are, so it can generate prototypes. + +It should be ok for driver functions to be function-like macros or function pointers. + +#### Driver location values + +How does a driver author decide which location values to use? It should be possible to combine drivers from different sources. Use the same vendor assignment as for PSA services? + +Can the driver assembly process generate distinct location values as needed? This can be convenient, but it's also risky: if you upgrade a device, you need the location values to be the same between builds. + +The current plan is for Arm to maintain a registry of vendors and assign a location namespace to each vendor. Parts of the namespace would be reserved for implementations and integrators. + +#### Multiple transparent drivers + +When multiple transparent drivers implement the same mechanism, which one is called? The first one? The last one? Unspecified? Or is this an error (excluding capabilities with fallback enabled)? + +The current choice is that the first one is used, which allows having a preference order on drivers, but may mask integration errors. + +### Driver function interfaces + +#### Driver function parameter conventions + +Should 0-size buffers be guaranteed to have a non-null pointers? + +Should drivers really have to cope with overlap? + +Should the core guarantee that the output buffer size has the size indicated by the applicable buffer size macro (which may be an overestimation)? + +### Partial computations in drivers + +#### Substitution points + +Earlier drafts of the driver interface had a concept of _substitution points_: places in the calculation where a driver may be called. Some hardware doesn't do the whole calculation, but only the “main” part. This goes both for transparent and opaque drivers. Some common examples: + +* A processor that performs the RSA exponentiation, but not the padding. The driver should be able to leverage the padding code in the core. +* A processor that performs a block cipher operation only for a single block, or only in ECB mode, or only in CTR mode. The core would perform the block mode (CBC, CTR, CCM, ...). + +This concept, or some other way to reuse portable code such as specifying inner functions like `psa_rsa_pad` in the core, should be added to the specification. + +### Key management + +#### Mixing drivers in key derivation + +How does `psa_key_derivation_output_key` work when the extraction part and the expansion part use different drivers? + +#### Public key calculation + +ECC key pairs are represented as the private key value only. The public key needs to be calculated from that. Both transparent drivers and opaque drivers provide a function to calculate the public key (`"export_public_key"`). + +The specification doesn't mention when the public key might be calculated. The core may calculate it on creation, on demand, or anything in between. Opaque drivers have a choice of storing the public key in the key context or calculating it on demand and can convey whether the core should store the public key with the `"store_public_key"` property. Is this good enough or should the specification include non-functional requirements? + +#### Symmetric key validation with transparent drivers + +Should the entry point be called for symmetric keys as well? + +#### Support for custom import formats + +[“Driver entry points for key management”](#driver-entry-points-for-key-management) states that the input to `"import_key"` can be an implementation-defined format. Is this a good idea? It reduces driver portability, since a core that accepts a custom format would not work with a driver that doesn't accept this format. On the other hand, if a driver accepts a custom format, the core should let it through because the driver presumably handles it more efficiently (in terms of speed and code size) than the core could. + +Allowing custom formats also causes a problem with import: the core can't know the size of the key representation until it knows the bit-size of the key, but determining the bit-size of the key is part of the job of the `"import_key"` entry point. For standard key types, this could plausibly be an issue for RSA private keys, where an implementation might accept a custom format that omits the CRT parameters (or that omits *d*). + +### Opaque drivers + +#### Opaque driver persistent state + +The driver is allowed to update the state at any time. Is this ok? + +An example use case for updating the persistent state at arbitrary times is to renew a key that is used to encrypt communications between the application processor and the secure element. + +`psa_crypto_driver_get_persistent_state` does not identify the calling driver, so the driver needs to remember which driver it's calling. This may require a thread-local variable in a multithreaded core. Is this ok? + + diff --git a/third_party/mbedtls/repo/doxygen/input/doc_encdec.h b/third_party/mbedtls/repo/doxygen/input/doc_encdec.h index b1281cb63..46fb04fe3 100644 --- a/third_party/mbedtls/repo/doxygen/input/doc_encdec.h +++ b/third_party/mbedtls/repo/doxygen/input/doc_encdec.h @@ -5,7 +5,7 @@ */ /* * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved + * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 * * Licensed under the Apache License, Version 2.0 (the "License"); you may @@ -19,8 +19,6 @@ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) */ /** diff --git a/third_party/mbedtls/repo/doxygen/input/doc_hashing.h b/third_party/mbedtls/repo/doxygen/input/doc_hashing.h index e54b28e56..aaa0c7890 100644 --- a/third_party/mbedtls/repo/doxygen/input/doc_hashing.h +++ b/third_party/mbedtls/repo/doxygen/input/doc_hashing.h @@ -5,7 +5,7 @@ */ /* * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved + * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 * * Licensed under the Apache License, Version 2.0 (the "License"); you may @@ -19,8 +19,6 @@ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) */ /** diff --git a/third_party/mbedtls/repo/doxygen/input/doc_mainpage.h b/third_party/mbedtls/repo/doxygen/input/doc_mainpage.h index 44280d252..5b51bd5b6 100644 --- a/third_party/mbedtls/repo/doxygen/input/doc_mainpage.h +++ b/third_party/mbedtls/repo/doxygen/input/doc_mainpage.h @@ -5,7 +5,7 @@ */ /* * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved + * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 * * Licensed under the Apache License, Version 2.0 (the "License"); you may @@ -19,12 +19,10 @@ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) */ /** - * @mainpage mbed TLS v2.14.0 source code documentation + * @mainpage mbed TLS v2.25.0 source code documentation * * This documentation describes the internal structure of mbed TLS. It was * automatically generated from specially formatted comment blocks in diff --git a/third_party/mbedtls/repo/doxygen/input/doc_rng.h b/third_party/mbedtls/repo/doxygen/input/doc_rng.h index 0f212e040..b298d3ba1 100644 --- a/third_party/mbedtls/repo/doxygen/input/doc_rng.h +++ b/third_party/mbedtls/repo/doxygen/input/doc_rng.h @@ -5,7 +5,7 @@ */ /* * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved + * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 * * Licensed under the Apache License, Version 2.0 (the "License"); you may @@ -19,8 +19,6 @@ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) */ /** diff --git a/third_party/mbedtls/repo/doxygen/input/doc_ssltls.h b/third_party/mbedtls/repo/doxygen/input/doc_ssltls.h index 4addfb38e..6961124e4 100644 --- a/third_party/mbedtls/repo/doxygen/input/doc_ssltls.h +++ b/third_party/mbedtls/repo/doxygen/input/doc_ssltls.h @@ -5,7 +5,7 @@ */ /* * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved + * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 * * Licensed under the Apache License, Version 2.0 (the "License"); you may @@ -19,8 +19,6 @@ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) */ /** diff --git a/third_party/mbedtls/repo/doxygen/input/doc_tcpip.h b/third_party/mbedtls/repo/doxygen/input/doc_tcpip.h index 95f458601..a705de146 100644 --- a/third_party/mbedtls/repo/doxygen/input/doc_tcpip.h +++ b/third_party/mbedtls/repo/doxygen/input/doc_tcpip.h @@ -5,7 +5,7 @@ */ /* * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved + * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 * * Licensed under the Apache License, Version 2.0 (the "License"); you may @@ -19,8 +19,6 @@ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) */ /** diff --git a/third_party/mbedtls/repo/doxygen/input/doc_x509.h b/third_party/mbedtls/repo/doxygen/input/doc_x509.h index 9b52569bb..904967501 100644 --- a/third_party/mbedtls/repo/doxygen/input/doc_x509.h +++ b/third_party/mbedtls/repo/doxygen/input/doc_x509.h @@ -5,7 +5,7 @@ */ /* * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved + * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 * * Licensed under the Apache License, Version 2.0 (the "License"); you may @@ -19,8 +19,6 @@ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) */ /** diff --git a/third_party/mbedtls/repo/doxygen/mbedtls.doxyfile b/third_party/mbedtls/repo/doxygen/mbedtls.doxyfile index fd22cdbc9..dd4237acd 100644 --- a/third_party/mbedtls/repo/doxygen/mbedtls.doxyfile +++ b/third_party/mbedtls/repo/doxygen/mbedtls.doxyfile @@ -28,7 +28,7 @@ DOXYFILE_ENCODING = UTF-8 # identify the project. Note that if you do not use Doxywizard you need # to put quotes around the project name if it contains spaces. -PROJECT_NAME = "mbed TLS v2.14.0" +PROJECT_NAME = "mbed TLS v2.25.0" # The PROJECT_NUMBER tag can be used to enter a project or revision number. # This could be handy for archiving the generated documentation or @@ -1594,7 +1594,7 @@ SEARCH_INCLUDES = YES # contain include files that are not input files but should be processed by # the preprocessor. -INCLUDE_PATH = +INCLUDE_PATH = ../include # You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard # patterns (like *.h and *.hpp) to filter out the header-files in the diff --git a/third_party/mbedtls/repo/include/CMakeLists.txt b/third_party/mbedtls/repo/include/CMakeLists.txt index 1b581a54d..62c0f620a 100644 --- a/third_party/mbedtls/repo/include/CMakeLists.txt +++ b/third_party/mbedtls/repo/include/CMakeLists.txt @@ -3,14 +3,20 @@ option(INSTALL_MBEDTLS_HEADERS "Install mbed TLS headers." ON) if(INSTALL_MBEDTLS_HEADERS) file(GLOB headers "mbedtls/*.h") + file(GLOB psa_headers "psa/*.h") install(FILES ${headers} DESTINATION include/mbedtls PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ) + install(FILES ${psa_headers} + DESTINATION include/psa + PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ) + endif(INSTALL_MBEDTLS_HEADERS) # Make config.h available in an out-of-source build. ssl-opt.sh requires it. -if (NOT ${CMAKE_CURRENT_BINARY_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR}) +if (ENABLE_TESTING AND NOT ${CMAKE_CURRENT_BINARY_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR}) link_to_source(mbedtls) + link_to_source(psa) endif() diff --git a/third_party/mbedtls/repo/include/mbedtls/aes.h b/third_party/mbedtls/repo/include/mbedtls/aes.h index cfb20c4fc..052f47c9d 100644 --- a/third_party/mbedtls/repo/include/mbedtls/aes.h +++ b/third_party/mbedtls/repo/include/mbedtls/aes.h @@ -20,7 +20,8 @@ * . */ -/* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved. +/* + * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 * * Licensed under the Apache License, Version 2.0 (the "License"); you may @@ -34,15 +35,13 @@ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. - * - * This file is part of Mbed TLS (https://tls.mbed.org) */ #ifndef MBEDTLS_AES_H #define MBEDTLS_AES_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif @@ -121,7 +120,7 @@ typedef struct mbedtls_aes_xts_context * It must be the first API called before using * the context. * - * \param ctx The AES context to initialize. + * \param ctx The AES context to initialize. This must not be \c NULL. */ void mbedtls_aes_init( mbedtls_aes_context *ctx ); @@ -129,6 +128,8 @@ void mbedtls_aes_init( mbedtls_aes_context *ctx ); * \brief This function releases and clears the specified AES context. * * \param ctx The AES context to clear. + * If this is \c NULL, this function does nothing. + * Otherwise, the context must have been at least initialized. */ void mbedtls_aes_free( mbedtls_aes_context *ctx ); @@ -139,7 +140,7 @@ void mbedtls_aes_free( mbedtls_aes_context *ctx ); * It must be the first API called before using * the context. * - * \param ctx The AES XTS context to initialize. + * \param ctx The AES XTS context to initialize. This must not be \c NULL. */ void mbedtls_aes_xts_init( mbedtls_aes_xts_context *ctx ); @@ -147,6 +148,8 @@ void mbedtls_aes_xts_init( mbedtls_aes_xts_context *ctx ); * \brief This function releases and clears the specified AES XTS context. * * \param ctx The AES XTS context to clear. + * If this is \c NULL, this function does nothing. + * Otherwise, the context must have been at least initialized. */ void mbedtls_aes_xts_free( mbedtls_aes_xts_context *ctx ); #endif /* MBEDTLS_CIPHER_MODE_XTS */ @@ -155,7 +158,9 @@ void mbedtls_aes_xts_free( mbedtls_aes_xts_context *ctx ); * \brief This function sets the encryption key. * * \param ctx The AES context to which the key should be bound. + * It must be initialized. * \param key The encryption key. + * This must be a readable buffer of size \p keybits bits. * \param keybits The size of data passed in bits. Valid options are: *