From b4c7c5a2cb96aff733b6a3b7c10dfb687b7d925f Mon Sep 17 00:00:00 2001 From: Cristian Maglie Date: Thu, 7 Nov 2024 17:23:33 +0100 Subject: [PATCH] Use a more helpful message when a 'signature expired' error happens. --- internal/arduino/resources/resources_test.go | 60 +++++++++++------- .../package_index.tar.bz2 | Bin 0 -> 40458 bytes internal/arduino/security/signatures.go | 15 +++-- 3 files changed, 48 insertions(+), 27 deletions(-) create mode 100644 internal/arduino/resources/testdata/valid_signature_in_the_future/package_index.tar.bz2 diff --git a/internal/arduino/resources/resources_test.go b/internal/arduino/resources/resources_test.go index 0ca1bdd884b..3cd1d7a0098 100644 --- a/internal/arduino/resources/resources_test.go +++ b/internal/arduino/resources/resources_test.go @@ -131,29 +131,45 @@ func TestIndexDownloadAndSignatureWithinArchive(t *testing.T) { require.NoError(t, err) defer ln.Close() go server.Serve(ln) + defer server.Close() - validIdxURL, err := url.Parse("http://" + ln.Addr().String() + "/valid/package_index.tar.bz2") - require.NoError(t, err) - idxResource := &IndexResource{URL: validIdxURL} - destDir, err := paths.MkTempDir("", "") - require.NoError(t, err) - defer destDir.RemoveAll() - err = idxResource.Download(ctx, destDir, func(curr *rpc.DownloadProgress) {}, downloader.GetDefaultConfig()) - require.NoError(t, err) - require.True(t, destDir.Join("package_index.json").Exist()) - require.True(t, destDir.Join("package_index.json.sig").Exist()) - - invalidIdxURL, err := url.Parse("http://" + ln.Addr().String() + "/invalid/package_index.tar.bz2") - require.NoError(t, err) - invIdxResource := &IndexResource{URL: invalidIdxURL} - invDestDir, err := paths.MkTempDir("", "") - require.NoError(t, err) - defer invDestDir.RemoveAll() - err = invIdxResource.Download(ctx, invDestDir, func(curr *rpc.DownloadProgress) {}, downloader.GetDefaultConfig()) - require.Error(t, err) - require.Contains(t, err.Error(), "invalid signature") - require.False(t, invDestDir.Join("package_index.json").Exist()) - require.False(t, invDestDir.Join("package_index.json.sig").Exist()) + { + validIdxURL, err := url.Parse("http://" + ln.Addr().String() + "/valid_signature_in_the_future/package_index.tar.bz2") + require.NoError(t, err) + idxResource := &IndexResource{URL: validIdxURL} + destDir, err := paths.MkTempDir("", "") + require.NoError(t, err) + defer destDir.RemoveAll() + err = idxResource.Download(ctx, destDir, func(curr *rpc.DownloadProgress) {}, downloader.GetDefaultConfig()) + require.ErrorContains(t, err, "is your system clock set correctly?") + require.False(t, destDir.Join("package_index.json").Exist()) + require.False(t, destDir.Join("package_index.json.sig").Exist()) + } + { + validIdxURL, err := url.Parse("http://" + ln.Addr().String() + "/valid/package_index.tar.bz2") + require.NoError(t, err) + idxResource := &IndexResource{URL: validIdxURL} + destDir, err := paths.MkTempDir("", "") + require.NoError(t, err) + defer destDir.RemoveAll() + err = idxResource.Download(ctx, destDir, func(curr *rpc.DownloadProgress) {}, downloader.GetDefaultConfig()) + require.NoError(t, err) + require.True(t, destDir.Join("package_index.json").Exist()) + require.True(t, destDir.Join("package_index.json.sig").Exist()) + } + { + invalidIdxURL, err := url.Parse("http://" + ln.Addr().String() + "/invalid/package_index.tar.bz2") + require.NoError(t, err) + invIdxResource := &IndexResource{URL: invalidIdxURL} + invDestDir, err := paths.MkTempDir("", "") + require.NoError(t, err) + defer invDestDir.RemoveAll() + err = invIdxResource.Download(ctx, invDestDir, func(curr *rpc.DownloadProgress) {}, downloader.GetDefaultConfig()) + require.Error(t, err) + require.Contains(t, err.Error(), "invalid signature") + require.False(t, invDestDir.Join("package_index.json").Exist()) + require.False(t, invDestDir.Join("package_index.json.sig").Exist()) + } } func TestIndexFileName(t *testing.T) { diff --git a/internal/arduino/resources/testdata/valid_signature_in_the_future/package_index.tar.bz2 b/internal/arduino/resources/testdata/valid_signature_in_the_future/package_index.tar.bz2 new file mode 100644 index 0000000000000000000000000000000000000000..22284c67be460e9ab90476380efcfe2b58cad3bf GIT binary patch literal 40458 zcmZ5`19Y8D+wR`6Z8f&-#*MvWG}^Jv#@Vrr#HdFkzRXvL5~Ik!(hcJ)uFy)Km!WoR}Fu{y#pMs z1)lEu0r{0sNn|gUN#R-dLC-Eu%X18x@LK@5D7Zi(sQMdv>J0pzO|5J$Ufl{%E8b@7 zB>*5K_&|f=?1QDZSyLY?-fGpeO^*ZJ{M=5-Xif z7DGj9RoK|(Ezy7qF6Txm2a0ER8{UYiZ{ElpUrAB6ZZe4>A?kJhs6>SdM8pBr6T#v( zogT8vWi4f1HU#LW7X{a_w-4*Rh5B$UkfJJR$fthaYIUHy8 zQUw6iIu}{DYA+rup&TU4_rtFLQ{#M0#H!_OBnO>3k8X#v>A$l`g1x3R|-^(-kN;o-rvlJID6cKwgXyJctfPP zt(!ArRT&s5Xvv`fS=crlD5X?%6(U5|D1Q zmz2b8?q72Ty6Ma^Lv7VzZC)BV?+Ckh9P&?*UM*u4kK3?m1U88LR@7#fBO_hT5+bK2 zHSSJv+;5>1_A9p^THP@6fSM@j&Mhg5|7229mXrJ>FMQ2nz|dhe)nWq?NZpt)p`rdjw_n;E-r1IcTFVSU`n<$;yse2XEV1S5wUY(4dRJ>v#U%MH zsl2q4>m$^gycJw(S>o$%Lb|G3+#5LVsfIRHRcTbEdMnJqg;1O_%plAp4$}$@(<$95 z=BV*uYaODj487HsnwYGHaBgsBX#J*_qVKi^^Mm?A? ze8swW^FP>VXZQKG|*n{n|*^70g)O4cC2gHL%DIu**=3B(frL9V(GvJKL0Rnny zg7V<;>L~K4sPZTo4jm3t`k1fem5kW>Jee7*cIzcN3+$tKs%47yGZwRg9p@9n=lm?D z$L$%}Wm)2CTU0O8e_G29Ujx2<|HTzZh9bIFLWzEN=ea8M&(O@9=)(EWTVG|BqTZoD z>9J|wrHdY)djrN&7kvH7*uqQ}&m0zTF~}wY#npiO10O9yD5e`4wda}<*j)a?oaSO7 zZg`zY16i1!sN3hwKu++o#S#5_4|M9mmcGVS(p112iHS8mX+A% za4gjZSYVMR{hx@Bln3OIbn~4jmCNwTv{CoiaZKhz*s%O7%SI28e(|_DC!x2nj=~RTvC9 z@dYwFIIGb)4T*)uD)c-aX9IN==HW4u?U0>%G*vTZ-Ubl*7;1G334^;m%RizBu{&vF zypmIP`k607i}{y_Ifd6*-)*SDpiz8LhR5yQj9sSZwv5|auJWl}G$zzot&mezxT_4MeU3H;Ox zK(EJUW{9F12ugkW)gjU$WjR!%_eS^b3$hAtx zk*{|orPQ3ZNoJod%`8dsh*80lRQHVG)5VRJ#A&B?pyUP;;3YXa;bz#c++LDSq-UEq zbQiyP)(nI-#m;W)m3CmXaI5Anm86(IAV|enn8ZAqj2zjbKwmuKvF;E-ApD5Fj`!vD zMp9BbIz2vD3kfXp6^kY@5QdvFVYjpGOC^C(!ak#{%dG>htu?n%ENR-Z`gTrWzm?!b z(N;gY3{bq#&}}BbOy@>ans4>jjWrj#mgX)pS>Cn2eG3Q#vOlwZA|}#Os%fhQ>)Ur_ zX4=maMOT&Ggo+jWzVmgmEOGueiPbpUS^z;D#2OlE?nVBJ6TyS78%Jekh*fe4w z9gH}l2x)*-&tofw$S5+5H~|&R*BETYCGHun{}8`266FwSZXyDzA|9E=c_iP=IKs?u zut}T+$F#LQ7Z=L(5EuLObY?m>@vU{7#j5(IEf=lD@SMf)Xr#46tw1`-RGh^~_#VAj z=hQta;GCgXYkkRUhBJ(mXoZiVlQ4FLW4crzWsEc9M1y3~EYrFZNrO3ML8*QSW%D-~ z`QJ{JOMeRvWT;FzY)Th$aga&@=7c0H;sRIOYPxv{w+km*pt1>IU>spT<4hiSmP)-s zsWh?|v@OfB5AxI3XBRPHoq=z zHI1-7IxgBuQHbOVGV74gfoh~sOMIc02+Plx0YJp`VERe4mS@VZIAIC^Qka+_P)RlxrmAoAHPih8X&PO1$|RSq?^{1+EzXu)OD@}Sa~w0S)$>E1 z7zeo-A`=kSLumwM7ZYKnsq1kOB#T$3Ac^M{3501u5tET`c$xlx0I9}5-|%Td$=J$| za5;hBh(5)A^MFE9sLX%%=z=dB*7rXFDep-e9G4Xs?b5-Os8gfd4e+RN?&(|D={6tCw2n!FUI>G z;8O3Z+@6vT3j|07p(}ed?XF zyXzl0xjQuGB;-@)>0li0|0hTx)oLp;=~ROjRW}namnO#ID!WTOyTDaQJ3<;T{megg z14JO;GKcmCRSE2eVW}q{5s>6A3jtP4Vyo95f}=5mRdwE8UDqyFOIvEJJ_Hz|#U&D9 zhB(3ugOZLKvrOmVS%$c+fA?3U0cXa3${0#1zXiw8#|?^3lV;%>B>%S)47PX6S~bbc z0857A;33266BmLoHf1T=Esr&$sO!tXOS-Q{3N6HMBqHdwh4|M|Kl^`0@vBr+1F>@8iAiF#^ZL&*mEO z9gUWen+E_U6k7%-AdsfMqJ@4#QzSkbJyOn4akPL(&IX0i!b%ahz@)^28Lq&p+Jfq& z6cW)fSiVPxlC;kO8p5lb++<~9ctFySdLCSGE1<0;VdSh_jrxREoQ-TP`HN^@J&qr& zzAfRvUxhG+YEbT~E3xQir8WhkwQ+$gcPGlfn&0Moxy}AVmATu#_AN;$k5Qe>P+H~m zHhwtjd(H3mJ(Vv8v87;OoCAlFDTESO{R>BIh^Dm z%6e2;2r~|(vKr?H6Hr=*83e@n+8`aA>>(eV4+*Bglai)n))FTuz?FuTp-0A%lG2+j zmuQhzinWf_x8n%6wQkBautz{BN5-Ta3FIBDL*6UPZMit=T!ReD1QnIT_ z2RD#cB1B<=)Pfl)Q7|>jHC1s<8^}i@anvx?CK<$(?4g`#DgUzeh40hhPFJ3msaLgm z;v!pNurvZ$@+I`mlbqx}&Z~J;^F7+NSimkzuC4k_NxoC5R7VM`nv?o=g)0kFmQF2~ zGvbU!kkd&9Ek8WP8mqc3ZY~Ka$yAw~LlQrl=|NM@zKw;F2^xPK4k>dO1+uKVtYWh+ zfba#S|2HiJCvmuuf)EgbBc4M#$DDnO@>O>ZlT0~Gqq8zO+*vrJ4oX?`o+B&T-0L!$ zIg=%s+rFj+oY>-A?p!)zuVhLEG#zh{mLVU3ln-cPF~@*#G=u5KD-njxW$bmPzfO;D zaOsA(WaG*(B9&JWKqVB`Ga?k$$9UQ^+1o(Ihc(3sMv!hU$wV-^`62>uPvkw#CTMnr z>EL;llWI!6Rkykv9uO!a}*L3BLfZ&1!|G4t^2KK++Uh6 zL+`yiT`?l@d8-DJ3I}fL@8?!o>0=6wISQEpgI_|`=E^6FE~O)0ouKIWb}9=osqgVuHN@{LRlI6U&3WangGkwen) zhqs`81YV)#d?O?x_ACEN$5xVy;;#PF?r8iXL+RWY2_254ejHZCV4700q}(T)Ogvp$ z&Qy{SCHiCDDqUTatZMUugj8!)Z|>iALJa}7U&0T+7$|HM&BVDKV!2NkZVH-Bbslsc z+`AtL)pxHG3!a`fM%c5V40{xq` zL+V_fi5+{|jztTqL0C#!tBWgD3bx)T?QQn8&H8>=V6|@2esPB4uar@Y!{P*xYIcM{ z(vI`{Hl7;QoKZ=A`zH6Sh8bH{TjeIbj?5yS8hpK#j;y#^TjCnH50b@w$&y^-)_|L2Y<0`TH~k@qdlG&XFiEyQC?vd)yO}CnSaCNc z*9GoKBqrUUhnMrhzbtM2xVfA2_+V@U$~=J*2}8DDZaV4NN&i4UwcRIPQ|<(~?V8Zi zQKmI$@@|lqxW3R}b;fO_xcL56IjG)Nq4m&wIeLW}h*606H4H|4l;6ptd+{u63F(K+ z(xfxZWT{2J@;t3b*OEKij^OKHyJ*BB|e!W22ItW_m}lwtYFkrJKy$*fHd zGck|ksc**G>We4U*&ceb4o=LvOW)A0m1Zlr*SO|{XozsE=9p9LqVi`8C6K?G!KMOR zzbuk{F_o2!8)Uq(wpa6UGdGvRQgWyEP1(DS8_IveIrFZ#H8QZ%Q6xyF?k+D_xp;j0 zL&`@sOIK90tDosPjWT1_`rB$xc;Qws!F36*$4*HPJg43^*ifyTU z4`S|JU-A=9K=QP9qVGT~BJ$L~FN=zR@r}roi5KV-z-`b872TAwU?uqoNK*~;QKUg? z(s+!O*=dj(qA2>pD8@wwCi@mW`Tr5Y|0{@pQ1un9!D2PWDw)l&#?%U{RumvCY!nt= zOXX;ZHFYF;T4f=9jA<`SaA2hvQori*lP}OfU1u!e-7Kesfe1pP#pT|~Nd$ux6&%D{ z7HFJQOw5H09Y%ygN}dG>g8uj`L820YxN2&+w)!@y4Y)SVYIt$4Y1?ZgZev^q&LeHH z&(}4x;iu$Ia_s;W&6pioqOXjJno*3EAE*F|Yi2zuU*U6RR$xh)o0}0*?T{@{3{%L$ ze+@-LFs5{|Boh^d+dR~_H5=b^uut#PE6)Xfh{ZaU`A8pch^j11{uyLZjTxNQ65FCf zuUcGL^RNDqwjd2^O2>enfx^qX&I58VCnpgMf@hDa~Nl3FGPM zCdH%f38eP))N;ZDYr8;wEbd2-CFVzuCO3~dlqN{q2?G;L+}%@(3uF}cCnFQ$HEw@; zR9STiH{Tl8EJ6{eOnvt+TPH3gDvkZrZw7o6=vM1zJ}>kXJJ!aM3YL*e3unFYtf!Xt zMiC?;xF?IvAdNHiaDOOf*q=m!r82G(@f1*%6!O}QT+rQ>88Q+0x{?gk3uy@tNhJ(U z((5mPcLeBq>8F2E_I?@oY(-{EMG%{ZRx#)61rK6VQCU?l!C>;);DRJ7D>6W!Th!QC zs_CN}dL8q`qC&)p>^6;bF3Vf@c`f7T06LgNK%t zF^gyV%M5sXQN0#dWKp^U8+r-DJD;zU-ePjit#M8$@I5NT6K0tgBjtCI$)5C*6t zIkyl0N1xE(;^NYO7(KAl^zt~2bqwRBX?Jwhhy^ghE%>*=Yl$dVVb!@^3?BFIxJ zE-vV1HsOIcQd=$TGo@uDlwP(z82teL2fJ6PD;*wFMasEm)-`rNf7&PTVazP~0TS8= z1{KshsL2m;GGv!)q*D^h3n#^)$f>2UV^N8?3-vfxN{Xb2Sc~RBAj4ApgzvG>;u4(m3%WrhWNUXs|(K2$Wlrbpm$Kj$G>&q)N|fP-;3d zoH|>MMh)OW?n;4b-yX$iScHiQgNccm84Tt`kdo2}WW61Ma)gqXAJC-+Y`Lj#UP)4? z?WNPJrpeJl2#d{7CDj!oGby@hl&dlgG=dL2r6ybOQohV3O4_ zCQ2l^D=9xxW$&ERa{+ZC)`WCVqu5K%MX3cZMlSJ2TQ{?w=0QjM_ws8uH%}>J>R)mu z{Gx=nisyv$35UkmyDx?r%%UP9t#vg+Ot#^cmG5s|gjv6C*HIEq`W>9g8*<}n{hNRk{zaamQxna0UK`S*KghaxRf%K1(nVtcGKs-{ua)oMOaz;qv&||o91*ZVT$uS|& zVdMZ0@h?1L(%8@x8dAxasu&oY$%&a}CNdnKazP_s4qV7_&AIuZG2yY*ys1?aWmVFn zUG2QwTMgxCo2vHzRgirxXDre-?Ek-fceVIyYvN?3JlrbHmn38&Zs+7?gpzl^iVDS^B0)HTy+{8j=&&y!zGjIErjGQGp*l z3!^VBtjimFaX%itNaeC^azk7Njj|P%O1+Y~Nzabi5v)4537gXtM66)@kzybhv>~u* z-jtM7m7viNm1?ao$aEwc2hZt1t34WrU!uNRy}@)O%UgcA=D*nw_03>IFx#%XNZF_h zd)}t*>xIX`ltbtBYD-m7o?q9?zLz%V!L9QcLLdZ^O0J_M6{8MEPYy!05u@k9lY+>b zdkeBA3-0iCRJq)wZj{F5t_6I_zq#uJ((1{(vl2oMjMdZg}k`o)li^BFb8+}#5<`+Z>9r|S|@1GUc ze(a8g#4jK!AYaXvm>J-YX!}%&tyFb7y9!lyx!|s+D=OXQjXMjg_z*<|O8CB1_UfU! z<(p&%9^F^<=osI_c3|fjpc!ueB|THg?j5xqFud&8OENJPY@rL$7lT zv%z|&J_y{^efpA-@C3osy$ix!Glz*K*EY02HO7~W?Fb5mriAYn$p5{14sNw7)PZ>)(rs+g+i=z>;YA2E zMRtAdgrXoP0Z54jg^)keXQE{I-`vbZn{IsW;-5T*-#ZwknM$>*iQ3R-vaqX3ZEV$= z+-Jo##3pPo!_#7kMk&>4)}l$Euzt+R3^(UOnV_ELqE2QH3!^^ZNG9Z>Rnj^(sPK5a zM&cc$qA?8~X8=GVsxhwUvfKQ_kcCyqnUe-hpb>0jNqO(MM0lkUAQ?fje|LY)W&LRk zWD)+2_|rlNnWXW?59%3-Q?(o~@4m0=_|LmYJ%JI;#ELite@YxyOn`5`D< z(ctupg$+KP=yP`ld>-GxMqc>QwE(##ccsuPowzK(7z3abeqysCEQ4jYNwS7nCfv%R zzlufXUW^W3#E?(brC`3PBUXs%+-C5*ZIyJ^G!kL(&DFVsq7MJbJ?57ZwPZ!PFded3t*_Ew^KaL_`y1{g6R<6{Fd!scAq2RH`i>5-?fTxu<^?~$kzPqI|)8W$;f5hu9Escyx!iWPF~>>1gRxA~trt0z1uKd(sW z?D7$9CCtqOv4Q~z`Zw6t1DKdDd{`{XP?mH8^3KI8H&K*#!RZ!t_|KyGzZ>whh8B_qaOG-P(bwhgqOtPn&bs*uev4N=jlh-1wU%TySihCd# zEky2dw5x6usff$Up$MGn8~~M##L@Qii)0-XoK>?%54v=2c?JwYuz3=^1V!rEjL=>3 zb;^6AHF+uxu3lOa8imc~`3!>FViKmA{<&`$F?Sk@?s|^aYV+X?@p!e7f+K0}BGy|o zh_Nofx^|!q5qq@70fv__y0Ix%!a=EV7+$EvJ@Ts1POU3LQJlBZW5}?8(rO$jGkqO9RBQ)Sc$~fe5j8@tFIyiqs1@K`EJV4E29TTwK z>V$ImZ15dbEU3;R)e;Iiaqgz1?$yWDO0X&z4w(`JC8r*mU z?A=vtX(8}TTL5zVQ}>Us;i}8L9T{nad9?XFxRqhgiPTkjf8m^Evo@W613mzLs&uD8 zZ=K&L_K@EHDw5t6{tctz!qL_}bE=0L-P{KL6e#u|ND*)e5g;HC=nk1=u~i`(@_Ok@ z2*fFq-9RCBX?zj?g?x*{6YpmGxcxYlGeWeoW#h{yN%&$Ij$vioG?)y88*0UQ z_=-9Tx~m?yb|dr7bDN#Kxv#Gu`sXkbwD>zpa(`Xzn_dU_RG-@-o^PE8>93n@{Bet> z)p>De1kG{+gFA44K&pP?;8W+nZ(P4vyqTHiBiitW<}5WnnFVuN6D$EdGKb_z_qJqQ zFE`l4Bsk*-rg4x$#Am4xG!mTxgP?1N-MZr)6T19wIme%MZwg>{VSRLf_4Ecwb^_W5 zrLJyAg3&WE5R94^3~mpb262?kj@D7hT)P_-tEC7z9c+O~OdrxwxYp=V5UzIt*;W|n zL3Rp06!1O}HLX;0zBORfwTn3+OH1f&Yb@+q=~o+dbpPH@y;D5+iCUnUkw}O)@w%@m z{4AZfD0=w%fSKaZBQVGRCkpeLgCJq-*-Di#khdQMEvRvx;34Vmf5J;AOd(teMNn%T zi0cLO_fc>C<+&w}tm=f?Nf2|7xeEH}mxVsSu-mrhcKTMBc=rAtI!<&BXLCcxg~)`S z1YxV;TKo|h05vc< z)MmRRK2ceDr7n&6Zhm%pT!;P&00t3l`?+?F8Hs9-16FU-9Z;Z?u;i8>FbcC1%b1&7 z);C)0x%bmeC!Jf5n_t6YY%CUw_lKD0(vp89Jck37u=e`C;hew8z%w6I@Omc#UgD*wM_RW*iyQ zU@iiF19%iLFC`Lv5f(WJWLjCNu9FxEhm)_9h-g!}xB^mTU#%*vRjW35&_z0N)tl0_{dfg>Y=c2%+- z3gGnZGxT~O6eWTP!?Oz|i_hAE|F4raW?#+dymfWhbpQdtsL{vwFSGqVqZrhoshZ6) z3)=Fz%gyz6VO*~Hh-c`;MT@<(Q?8@NtnvNBsq6RQ&KmEfr+}wU%UT}T4Im>z^Xgik zhE2!4W!O*Q9x*mmU^J*MZOFDLUDBRoWRmu3QXxEJlxapTt*9-DhdnjQ(!0Nx01Tzi zzgdC>5K;)VBr;YWhoFvd4@>D^VFLRV4O%yU!UiFUb{?z_eA1AD@xaPW-4qS%7mq3d~hSD zr<`a6c(&*JPDx|P5Bo5WP)rW6pm-z~5eJ@M=I8nL%jJpqdB_Y-9IGZN0@cFK1gJcyO<#h3T-?%{6uuNaXeE)NGipywkI< z8k%D}!qkvYPkEko(oiyA)hAptBGzJcMTt$m57{m3n$OJ&`^(@|Hqt2=XcVdrW3Kj% zJg_dfb{_lS0i9h!8(T4>&UTN(P69u)=}3UZQoFm;OK5hMPH+*;a3R1_g4H`DApiI4 zuAVado& z%In9UO95NgtpGZ=_{b)qmrSiSM3zx?SVuPUbW!=k_#+q1sBsK2U?da*F!~h+PIxZp zx4m)B^t8LYiyHc29mM}tYBohuIn#IQlZ+g~hCg=6b@Y^F5s`Q({I!)f&O@>oxzW&nD)Hf_|#uH-f-bo$YnR=FmV$ddKDC zZkvB$-G-xy` z-t%0my`JPtWFnBirtaj6J!uzw%tjqG!5WK>t9b-08~Fuk?q6yJN{T^~NsEo}+3E9N zq4~3AMeHZ*Vh6>(PR5DUVE0HLt+dU)?2;^{TsI}EA_p1)Vi*0UPCHs|#6y@Qf*nM> z-C?!{m0i0}(}bQPGfko5ko1LH3Cn{u0`VSwmWM}uKofnOskLln_D{;?((GoG#_F2X za#u8e@+V8k%@lvOL^zR0QdILeW-%L<&$&4j239ickbyk~_z=Wcz zG`|QHsu3BDhST^t%o_|j@?;i@sd08qa%zvctkr{P&4eN0r zQoHPwBiijrGtu`wHQhZGS(%}vA!&sRYJhs4@p?U2+3|)0?s$XzGUGtjgU6c+#`w#^ z2SW|!7aTGg1b$#Nzi9q!_YW+5(j5}##tpe$__%6m-^`35W_viB-y^}?qojzG;Ob~= zk!N**s5{GDwcAq9k27RjWVr z>tijO^9r{{FcQLs6odl#*ht?<`2x7m44SR#{DXX$6400vPg4&N9?;@mEOtoV zW0&b3*wZ%99@7AESf~Cphibv-RpK7AM4F0@GNDS)HI~0was3+7_XBV~JN?6;(pIlq z9H-3 zggxWMHnm+Gjk*8Yc$`<#;NnKV52g4I$JC>rw<)FStW2D5qa ztahg&d(CCic}|jP@b{j4k&8{dIsCly)Pp&w`T9z@9+JG@C!7Uh#IhfuPmaAWYM5t& zLu}XUsOVAfX!b47WbxUuZ#@TjeoMm$N>@j-%5q9YFDlVE zENjmW;=O2fBBv^x1M{szsxQ}fY5gmk3d0o>#S$=i#|4Uh5o9Y#GG{M1sCHw>nYtcT zwLkDkkBni19-le|Pmp`592PgiK2yuL_m_#LxUtU`;&&G7I+{4y^|%uQHwTm4vEVka zGu)&_6X7l6iE?BNn!RwfS$SkV)}l048WV9?|J*ZmT)0()T=`I95>c#w5qo<_l@wX> zUot-xTXpE?CAdd=ZVXLyH-If9SL@w_^tom$SB&#HUFclDRVuEKWJC2*fEUwpod&iA z5t~@F-6EHWa8gFtS;a8O=#hU4KyQjVMXf1aRKnpO0*kxV6O+xC!)eqRFu!7A;*JLr ziBSu+-8T35HeT}Nx^7LkP=j)?0Al@>En{gW2a#R+!#1~8R-y9JN$i|JD5|V#Mh^N#9mW|rw~=DqFp1B*X;gM}oL_26>wfhDn+tV20dNA3zkuL1Le2pP8qZ)gXrUvk z!J?r|3Ov5a9cIh8vvQ6)N|sQh@U;4C-K=0l4|8K@W_5tVlZa(?@b0yAq8Asf(3USRB_ho;VnGJjK@D9O!i`I9{F8Culz}JQiYfY4X zmm zcfq2IiWjg(%6(_8!;`^2ws>sTO?q4;mXkPbhO`D2^&9*NPE)=2(+CJY`zF>o!zOnU zU&>YwK>RH)rC8j#GvWMbZCknlZ?hKGZ2p1B5d5W`LtXX)`yk^d$ zg?em&Pfn;yyKm2~w()1qw_cA-yi zD3*hDOEqF_c8qDGN#FbK(y5v~)SN!pSW8)TzH-937#b2U_j&c;M%YX;Ar31Hrb*^S@Y8HLo1|~Nc2F)1bt}9#t zuEY&HHzQ5%erx;(!P+MNSM__Z220S3Xrbe!uYG=qHwqf$%~2FXrZbAmGma4&+YP^A z(6@3;)MuM~mtbSam-K97Ax24*+30GxCkMP+Ze| zh+ZxJ3Qt)?Rs^4E;x#%`y$50`S2RI;0X4)BI{6V1NT@oXhAAxY*&9j?vh4amWa@g>{4YNLHlkjCk!Sm# zbC&HZsp>JzRky+V9x9ym!P?R`-FoOR_1b6Cu^%x&;#&0ig}LwUr*+@)1IF?;)}KU( zykoeYbQm)>&eCznA%fzv@YT(x6I@FRyPt*S&% zU;4*{x-L}9F-)Lt)I#>heB?Xn;y*+67U_;{9+lwTFg38Gy`TPb;qeVfy#?o8n z+23yh(b>!s*Mn)_a)g`^7X30Q`S>r%(FLfx^!X^cxR1V&ZBP6n1bq)1Opm9yG1dOE z#&P`~*IC^Fd+q)*1z1|C<79(rw?YGey;&E}j$waN4tnLMx_>OVaU3di?yXE0248k>4e0nu zF6Vf`^0CV7&3=jCa{67kQ+v;jiva#nmzvb;`;1~2ktZUO__=~14!&Ho( zMW28Pz!m0$lr1}C63<@@MGnC0i~1|J_d{n=l0^F$F#JFmI94EmcpOOM(3rs@8p6Nd z6!@Exby3?#Uw+Dh<_$nd>-qZD(r26d_H;GYapgwt_1mx6s=VaUvB=9b#f8{+{pKv9 z%)I4urFY>b?}l8rM{gn8^ZKB{XYZ zY|i(7vqNapgZD{L!rFpviMw0pkAe+t@2G1>mhrt?1@tJq5{{uvL`?cA%n`)>9{8Z; z)wf)DS-09h=BR6BH}ub8p)eq(pikZY0lr$qE)oT#rAIa2Q2cM(-8|Ij#h@hxRgZ>d zp5=m`3+*dlo3|HxE*pTu>>##yy3D{>wfUNeZ_0dq2u22xS)m&Ck@MUxMn5hFzSLW+Kg7%xX+K%-aN8UD!~vO}yZv)bC$b7$%sbeog35!ZFk zJ~P9U+~NU1R138>&_~%I3GC--nU}n({@hJ%L|2pcXM1Tc;1Bal1~rM_m3UkNXmC5&Iamqxj(6U_d^_iL)cUrDFtFr`X-Qj&qyU?}8op zykmIK$rOYhAHNHutiK@4b5@3Tw{7jnZr&sSBET6%X3VFF11DkgR&Bj<{szwu*$VzqrAkORds#377ht{N&^Wx(`L~bUg=LzH6Xi zt#r}OI@Cd++lE^HY&&Iax9m27^y!7$Th5cioRBmLDHlw3=|I<=``%LE?^6(~h$ywD z3X?WHoCXSdSiG-nkoRoj6Rn}R+_kaxvq}@qe7u26mxaE@oW6wmk~~QW4fpnUVy!ux z?R(Tljj#$F5>jP&zcf*#KWc`or_9Qd3okRS%`8RB&o|Sfxg+n9v0sgTAz}_tSCLJo z?~=JHf6D(GOoVpTbOC;^{o%`9Zxf5BCGa^XNun^=V0ue>v|yP+=+&#Scd<(7C;W{? zm#TmG;pQs$e$MPJ{MWVe*x8_s6P^4b7Ia0i4Pdhb=@m+J>m(%6cIM@}j&Ko;q&@q@ z-Eb<>-G1K!*MSp=%0SoA;`D2Ab&kFhe#gR(DCXq%_0m;m(jiyi6h~-Op9EL_b}s#u zvC3v=riqKF_U9e(Z`^<5HOee?y!K6fT&IQznf`R<*{c`l4ys)Umf(DK@w8jQ=a!2( z{R{#G;U`Fe0bDR}&r;1{jodDChP48gHupW9!)EPq)hQu2+MKks-5Y~K3H!NhiJp+o>JaJ(Am9t zT3>Q{-`Am!f^asmuaStb@oL*5@2>aMQ%^{T=BHr#IEKY(vuGw zJdI4FsWaEGSWfuzk~Re>Vujkvv%yCkYgZ$>+oFarXX8PtSrht^h-aV8dbZ!MQ=VEP@(W`L+1i*VME44#O(O(Ee*%K| ztX+hB6(n%}YF6!vKoXpt)3f~Fgrs*iNfez4$b)tvn+Hu)L&?gfwW zPtMME#53puwRdy)4!eFFlIU^XE2r$-QFc0{FYGPio6(1VcGfrdZzq48P>Ys@QEQxS z7s2#)6Wqu~2=a{8rOK9Vt&@!;6$!m3;tK;!&-%KDcQ$XAfcNCtCj8Qq-+K2{Q;~g3 z(Vn&#f9iA1o=l`k+n%)C6?wR^EcBApUMPZK*^33qzseb8TMz)b(Bh(H5kGkAynj&RWSK7h2%Beaz~2_KzZJVCvtvBLi&~ z)9lOj()x5Bw43%F!3*Q#ExW(JKYu%_8G4U$F%OnJSb85D3)?llo_JIZN08yt*+S3spd~rTYNqot%3EkrDc8HnO~&gC$y1gY+_S->)m-42Y+iFQHgU|Ka9DB~tr&@w*)XE~Y?=IYObITv zB>aTorAinH>L`(Lh^UaS;gxo&sf=yh$^^>7d@9tWB4i?+8Z$rlmEQ#YoZ^H%*8))Q z>$^!IgQ1a@y2GViIhPEXo9Q`B!cs7P>2q)spDwF|eg9|*YF=>gb_PmLo$Ml!yh>BH zd?VXVE-aY60@++ZryRzJTPvudsGX*i*cSdA)yb-Yjpv|spMaIs%2)th^#Br!}$G8-Mb*!jLaOYW#IDQ#v+SNSirJNmG?qg7e*G7*Pf?un#=Hr z0QW$^VRmEyCb-C7I$)n+_+|Mlxuj02VE>m5NBBQlc?Jz%uCw5mNrE=}auE2tH4%}% z`SACYiP<{(aQEChPYPn$L=o?d`@%ZkJ*Re_X$&m_H9nkqM}c~Ym|wEQK~}^C`?&Lr zq~XxJXzebdu;n8!!p-o+-_!Wf*FF?9-FHmFmT-#C@cizN;v0IVj7nfWQxV@8w#m}B zA1ksN>`HLe=*b-=SzUvi^U!|M@*GB%%B?EQbxla^R8XC1(+Gb0X;dr%PzLmlfD#!gC_LaR0h*bsSbQg(5e?OU6HCU%XqVM(igLjex{#6O<#4a8wg zrGK7COlA)}!plJh%qNV@7Y`K7O_a?=5n#AOaxSy+G(#p zLY0p9bj-&t}~5~>3J z7{ylA)rHYm{icy(O^?MABwF5?L9ZWmHvQgnQ!+^H;w9hx%}!XiPWtQ5Y~CN@Db6af z!ufeyD?h@!c$jpOz<8He#T%lcTb_;xH|p@3S()Y@e}1{NZ1gt^cWUYFJohYm1xTNy zm6Kq6X2EzY^fF=v_bh0%lf}6R>>|z`?^?422)j0(vU~5fUWWYidL%p|Zwq)E$lr^^ zuarnFAljmZMud7HA69-@x`uB&LFCLKoob6+!0tmN^YJwqdHBw|P%V^WDOWxWI5E9a z&u&+({kn;rVBT_q&sY=ygO}RFueYu7kV#8X9(m$~O~#>8UWUw=G&ucbW?ZWJ_&bJC zHB5;y6_Uu<6p`%{^nMFw*x2U)JzT8%3zof#LEm3pxGWFpGW|v)s}s22QzIr07KHbn zq-$BmzNoe?8u}xIbj_uRP2K{Cnf?!9Zvk7m7IbTd8BUm)nHf6F%t?otnNN}qGcz-D zhnbnF!#QDQrcU3<{O@U`k>+V6%ih|S2g}DNLSe_EGxH5s3yc5VA;f7r2{wIBm+S!X86>CBfTI zPF_1)z~OM`0>RVdnoEFBS_lTwAV&suNjub@ER7;bqQIy4)dO{?u(86d$$-ln>Md-H z@0Zuz-!0u>UjZ??RcSOc>PKu5e&7G7q&wr=oW?I}x>|EE;WIGiE6F_%;~NWE{ZFk& zw0Ki@ea9N=)rDq5MCB8GFCBX%u2@9;d`kBTe$aPI(O{B+paUxR$(T^0-lGxZ}7K) zDseh0#TyB89@V<3-TEWYL zx0?m=$ml^^4Av^}ldF1Xe@F=W)l0G*yd-VRu|k{q$*F>w=+-VrRAAY^n5||Elv9ZL z*gO^Q`I^6E>$s2N+J*f$n|Wa*W{FLsXpNbK_czFElg+^c04P(>A(V)@j+>OhI|%g}IlFW)H7a2lK1WzXmbT{!;%Or@N-*1XIr+-)S0DNh{mCLCs^ zreT%nYYXq8P&)j3nzB6IrP%%C)*s^Qoi7mu#|kf`1{4(>Xd$nP#T5senSo+2q%5(r z#k||{k%=txdFwOL6@0f$l$~o=S7nej>V_Xt)R|e791LVcg0H$YwKM-W70z+Q@q>Ed zu*xOE_{F8h&VF3O!4@iWkD?SE^9T8{0{>{qV=;VCuD<%#AVxNN7j}>15Ak9%Jm`t? z36xhLK$SjZF&8hkKz2|_cF3f&UC~H~WU!$$YANup?e4t-vyf}<6sBT{ceM#GN+=4^ zt4peq3)$zg0IvzgY8ru|XKJB(m0*S*u3B%%v9CVGN{F=0%1_K!SX3%>-j=+P)ZFwzFh+GX*h9r6KwX3NNX6t+)U z6%x`}&r~OFK*B0gEnWru(;UFkdOk*J{9wJcv1BR2Dd>R;*hKxa*Nobp!}vD?a#_;Q zw4kA+BDzY@Yegq!^R2Sa1@Kbi#HBDZsm3whb9Sc0;bkqni)fYKjA#18h%fT#cwBq8*0p?V^5 zC(hGtl}WdA>~H;)>2LXL))_)FDON;JqTWF-w(eC!05(=ZM`U2`4eoQheriH0z#kfX zPxN@*>kd9@o(YhUr}?OAT<$6)tGwz%?y`S|AiB2~C_3RF>rYZ|WZtITAtybCJGknl z8BG7WP8^is2CM%ttdP6|8}Bh!h8!*aAStUKi`)jbJTN0JI%<3U5pHH#W;%V}J)PI! zC7F6A%{BihShaoNw_7)oGkSwcS`9GhTCrSbO7zB;OK4J1-)a>eMC?aU&IJSO4us;Y z0qHeH{UUCG%yI7s5XopBdz9@X-WT_ciGb9{Q!X=x#x zxI@M?suOHQt_R|up$C9{?tShJ1<}Luc^C6j5*>Hc9$Pvfbwp=B8~;7v408@gdQH{F z#fVK}nOD;8J=FXyPlfs;QiS8SSV?5;3w{eov4uucr(%Q=d^&2HHDDH3VJyT}yC7WZycfXML0by)^L;^QBuW4DX8W9Td3wfnO#irI9Z-Z?_4g9o|osZ%gNCBsBLk z;-T;_Zn5e8$l_bCt~^S)4rO{qc5aWaAm>pGzAmy5K1vXZiFfl``@K|LwqCV@w50<< zQ$EW0P4J|k&cJ^*WhbjVzAQ;}jn=O=heBm|lyyg@#K5#)a)oMK*3ceg@XAexdmd}^ zgccdmJzM^=IQsb0w*+PiZpX|Tsm&gO)5uz>a~$u{mf78Gf%htD%cZ!pSiDwT3b~%W)pbb7@6YB{yjFpMaz-1Bod^hHxwzP7h=+ zCgsgZ(;1b<=WTgO-9d1tSBit7zo{fWkSb<_1Ga!3&Ib#Nt zg?+3Wn)F9(HEK?uEmerH#qojhTq5N39FmyEG2BTY(w9gH$wvKtU;$Q>l9j#X14mD=T{0!QiJv80SmPB9A(GV;4J8>8KX z?GUZhoj9?n)3r!bxt>*Yi=H)fPj`^#_4*+KGw?otynHx7{C0_#d^T=hOvqR&AIYI> ztCmRs6Rygl$%jW4?lbDs&wHcR8}?|7{Vuf-EIM+?MxAG^VQ2M z=&{*nrRZ{*FVmpcRH77MRx7ia|wc6O{s@o6#wUN)u8*zUn250oG#6QpHfiESDe(AjybiQ+o(W|1^PIOj>YfW4o zJ|j0x<>wF^kC;nhXb-Psv3v1){+Hk+zRlb>4Lc=0aPhhcg^Qe%uD<)*KDg0wF(_zJ zKC+nS6lG}%j)31i-pr)8fpN~a*A?oF#3EdBQ;~#s;*0fi9ASf{uh92wZMf=_fWYmQ zrB)fDAQ|WwtMm^Ne|{1cd3VF>-GRe|)|1Y+MAoN%j!2#u*P^UtNEm~|6qfJ zfp5zKx+KIh$=QR{HXu=a0y}!cTl@sq1TF)*qvnX6Gw|Enui8r*q&kZ%z|qphs}_W+ zB!DY6B2&E`xn<)#IU%D%h0TfSnVi%v;GOl~My;u@=J(FshCgrW`j(%YBp@OCGUG)h zUqOSiUS{HU8*NyMBmkd@kx4Ce63TO!>e|#1aLx>hwRI)UEnd5EtR98=94R+*?#37w4DP zmv>K>(~}4P{Ox|~nmYI88_h_v;!YU8+R88ZD*4ERW-RP>PVbg*RycEv^OnEXiT`!~ znrsV14Vu|?eeVV7Lc;0Mjs$$ZsjZ~qwJH3^%8`IrE!0u|6^lTN8oY@s(?&nm-il3q z)&2|?gnpwBTBZ>k5?z0?eA6yFS!OV7TLO>gI}?|rjYawK3YyF z#`XtflW;Ckn{34R!UOGRcG+j&HyGtm_2~z{e82#UIoFL+eoxMR1u1&>n1Op1X}Cwq zVQbP4^`t*0{>|#0UlZ5JGbERE71>bFX1Zy`c6&~Ki}tF1o(U|A3h5n7V3;G82TA$q zcUgZ#pE1=d{H;-87NnlhG0gHP&vsb>DVx&34F;zE{GTNjt6o_laEXahbrCe)*;jjl zTP?Car!GnZ&B{NG%vu2LITM)%iE&3~c9Lyq2Fr1*3O$kFDJR9s zG~;A9U34gN06lLPR;AMSe$;m0|G^?3(f7^3!}Ue&cRi4gGU+JDR_St57M=UIdg{nq z8Z>JhF^%ni6V22jeJRuAwFpHDhUH~@TD(&>Y7Ns&3b)Gpwl1VTV)&Maf3L69kqdwl zi8TJU|8+xYHO59O<;iZx;(J>jr(&wpu^mDk8`)0`EZr^YcxC0STQQ3{`88`y z(UWE`&;Ude)0CqUertg6kz4d&e}yQ~-{_*}YdeIE`_jwkl!zW(8di|N^&;XMOe16{ zxT71$TQ}8jvk;@{gHg0@`H_KF`t$I;CVwTVq%Ao(VMlr|esuFS?KxSToS_iW6Ou0n zDfK;d%2b%#8@CUph=+_0v-*KK9RF#OgceVM0~1|2S-@(PC?I;3Lz}UxbBX@=^a(~? zcSWymqd;MSh#O~itHYbX?Rq*7o^-vQkXz-A>7?+gpL?rDr3vC|9HuK&QVqe)f{U=$nmng9H%FVA9Qe~u(c4gj*c1+TYPXjp%Y{S ze&8wXSW(`Z!Y0nR0e5C;SBa+zD2 zIX^CvPg%f;^)1>v5g=Hsfg|dtviofix}WJNblg;D!cV$C zyvX?pX1nz7jfr6=1m1OSHaWNQg`(HOK7Jme&~qCT$M4pKMcOZu*wFkw&VYnxu0lL( z@t}qYBkwA2>>M{3QD#xlum|sedY_kckS@>_Z@_D0Zv=72kG??vs(@>QE-3B}e>3&R zm)nH?uO6R0TUgL;iC$%Syw=~Iw@%7caI}EIB4q$jLFozVgqdU8UT#7!3C#_K^fYCvARe~z5@+7ECO>dI`FMtYlzS)RxXVewU0jpUvTZEhw_{yHNiKA*dI!KX!O;BW>$o3@K0XzR+1ZoB+f4T7 z87-z5T6@;(e~z1d5GDJ3Mu@hCI1%Lzb){>2Z5Dj!ukr zU8Zcm;A~vQk|KxeDQWE=BToU6c4U3$KufCqm~$FXsD*;5U-d)PULAG{Xik3xh6M9+0vo$K?SgbwtT9~avmq1q4C?Rrnenaxk^7^LZxE!k9t?ahvOW^yLWG(>J8mp z$+`s|MywT!wRAi@LD;Vt47_FbMX|%0#0;qu3zj~>J27&}>aVJ^P?MD59QKcHDjZ{J zCIG~gUvC4lnf`_o{AoEkQ%_UpEAYLJT6r`gQ5)(^AavC~FHpaW;1Ycb<%wk{AEdYL z1*t@nH$b!{s7Y1DBb=R5sIMWl1;)DqrmqpDYy6I1`A;9!~2g9OPj_~pv zZ8Fkv*sd$?%Q-0qS)z(mSq0mG(7%gXy*D(p{wIp-`I_(Y69Mrzm+roOS7ap9r@_b` zhDzUR@a3C5@X#vKW4;Q9Aee;72$$(B{?`4>qFbpBB30`GNZU(J60NI?H#Ry${k52L z#16lc4g~@VV{X5o$lRR+7Eusz7_k7$tEkfMGD=D^T%AoidVmFp;NkgI{~N(0cfw2h zIE(bWj6aIbou3_XEu3@LYec_*hWwcQyO=nsf`oS)1#h<3pv(-|R&eK{e{6IMz z4fIYs#(p*zer?$9Ew6wSw(=4=Qf)HIuPqz;6__MQ{QQ|J`8s}v&yBb(3EX?d17aV+2&RTBUZ~4p1sq8 zv$!Ycrn|(&iJ|&%E}lkZE!s)3L~L%Ay%PdTXxCo#<$5zy)!zv{ZfH(Eh_j*v{XCd5 zb#mlx#q4x1TAe{W1OpFjd z6@24yB@Tmj)oTu@-rtRpileGQf|sX13Y1kfP7rruc1yZnKWxDJy*52xU=WL(s3osxqIUwtNZQJrv;Ix8baC zj4TSanfka(A^30J5^D5+@e7|`c~!T}fGCZ1ZkvKvW@kpBw+N^NFSCbF6uSA><5C;? zAHn~*!ugWqCWKNj-xmc-KCU4swrdHb`~ozB3WWa1y!ZKXlaemXGU_^3-p%j z+A=Qg%=st<>Zlwh<%l&M-IV?-nqrCSnE!L{wPxRTjP_b-lYIbr?^|=9EpV^Sl$!Of z1&FQHg#nhLEf;?JTC)F=2`y&!kEh=S z$&lIk&?c#$WUodP{jpj)Bwj*#J4z{&Bld}+Hp#LqgPduw$>|t@Hy9bZw{Tf9{C97^ z4&zL|FMKYM6SE?YqUg=>r6T;A6!z?=Jp-CoIZ_OX-^vmfN*DeSFi;s-m^~z^x+R?Y zAm?x8v8!Axr39a|^6%POr~Sh5<>DLMF&le}(~Dh+SVf~(soN&{caRO_EOIp+JT4r$>_Y{Cg@b>HhYaJx7=}UNDBpB* zGL0pp!eKDJpI}8ab~J}~#}M4!lPKS|%n78=-#mMY!vfofJgPpKk~Ej313Dt+yn8U?HM>pO!H93acXuyWPP2jc7-3}$P!rJ)(4Q~lm zz##A+u!r+8r*-ij%2H2{mNv#=4uPvX5pC?e(lh}bu!nYd*aett zND7R6U@mz>+@B{BK9+MLwduo{6HfdyU;rL#s+d>tWcyIW9T|yos2r@rasHawRUKL^ zcONG0X%4@-F#ESz6Jus5=1*;rZ<^g{8lN zNh1M1-2=9T)EEW@-xMAI3HgX{_hh~=per(CVB5+flov__7=NnK-ho{16>gglYM0L~ zrZ|^;5SRgHT^dZs!W?L=s#re4kz3V$I4@el7g2;s5bQhJq3uh=R}-GtnguD6i%NrQ z%TKTnlvoO#(TSS-AP^WzfSNfZht?z9!d*l)9kejv0Dxb>A|r0*oRCf`5+7F~;aykG&uX@W*D)?MnB*PvJ(2T43+9{QqX^VVmowanxyO;n zf3r&!MYgB7O%7F@DZHu*^m@$3uwWB?MyDBix=yv!+R+ZfX=g<4xg>Crl!TQmQMEEG^iX;NoDISz z7_&|0p>vG4?On|LQ_eI0`KW|!b5Y}L*52i-{9VScwE1J~j2tYII3vOS-t7!hvHX9M zAuvLJag2$ksuUz#KBSga3Dn@;!MgAf%d1`~J=8MU$lh40%Te(oSFz864K4r)Q~AP1S(G>!k-ClZMiOfPImIJ)ANqCEmDr7SrZ0oQs~(0j@-TH9|WVAG>-QP z$;>V7V5<$0>_cIrswRqo+`ZNDhz`Yqzh1rQrFAYdm6rNA?%Qxe--`(9m@85olZ!qv zF3C*S@5xMbwwBQf2^H(s1ZRIgQ2-qEAG}(QK2$GZ+HmI&50&M5-uK!u_R0jkX7urK z|I2Y~Lpn!M-V$d48=prz4r%9PC-!jgfan{CUGc4$d~t@(s_?2^0zGm8;LH4tf56}^ z>$EFN5%b#)4e5hL8*O2$wiiAr`PTSi2DlNpnT&)9)gT^!XNTG%^*;WahQXiUE8cF~ zhGengsDZ^;yU;;DdFyK1ueF}Aan1O(?V*cCP(z)JV^s=bZIR}>VF<#!UqnT6H4#fv zBCFTbip*9dg11of0bOV(z66IYDF~!zy$8LzB`dK}oL>*jHL%Az*-K7?B>a-~FUhs_ zl)@Nxw|qa}mEld<(4yUF5nb1PY2U4^bn`|-$OAkzR_A2|27;AfaH`+f>jNmA44%#ig=J0zfH9fZwGkhyc~PVue6qVVo#Y+H z-5r7&@Pqc2wM;E-Sp{3~`Tv=sAh-iHHW9YQTrk*CJNb>`f)U*$p+ux})rY9&o+$%? zzH$-vxuo?4?2xD81MLJ+fs#3WxB5YlMYFSW!AJs9L+Ktj3hBz4d}AGhLpa z4qp1U(?i9_CUx3m;>uD33~5`}5yrN!bGXBL&nws78Iqm0mbiG>r6Db)8aOL@1^#e7 zu}5S#W~J8Yj}=q9AatEOx`oWNq=Y40Z6N)a-)p-f49KLk098`t-IL+Vgy zVg+S8TUVqjRO(D$Y|HY(%}e69k5JN7D=A`dgo7)k7KfVGuL=3!b`g)Q%YSnXB`^ z@P8HfoVbp6LypM8AE4YS9|1$IUSV?>Rd2S$8ump!+r+&#Auu@l!Ms9^7Qsw=!3oe; zW!n)lRJg;8N1L}?5Ch&|kUl1YO2P5-<><|1K`Cj02O;drB+L_1WD_1Z!tZ2+DS{J$ zqaJEJlk)ag2h6$apY(sS6;Rn-%>*dwB*GE|)7p&#>`5#lSu-==eQ_naC-xQOR}u;F zParp4YDzzs;knO3PEkHZWRZk2Z)V0w7#-OoG*E7%H_5a8QDf)`=$MlTcWOTUfvhi;Fau_pw;mTGj=4+=V)tQ#|7jB(IMNvU(-JF z@whLoE0qfKtvjV&E(ux)GRp=Eg*aFjJwo#sV3F{oytfqKiT=BUAg|fMUSa!>KuX+V zUAZn9!ykR(0H0Ru+RuyTM6(@kL5|UJmqz-M5ZVS0O+bK7Kkm>nxvrk=!YrZ|y{>I7 zyH=UrGFUw;CXN+5I(eWdFlyr+J8fx_rnRH$IG|p<_r|y9q@R8>+dcMFE|_lwQ|)Ot z)peT`v3vwN4`-eBKXN5#FLmWij0#Jxs--vdDrW!HI|Ow2@NYiso*y6_2_=jP506MD;QfDC z_5aUwoh=l9>D~)3@w4f(G>eQ_N07qxe{*TD%)!wH{^5-j7Pl5RH!+*mq=r$d1eo>M z;IaVTH+YGTJsvEo3){+7QH-96BAZoJOzS^ba>I)(ftAOX(yJ9=s#DAheZ73DU*poc z3Wj;;{@Q;c-A^>V)WYyX;ZkZLmLMnkmzJPM3hRBOm{l~{#0T1D{$qF+rW|=Quq9r* znG%kbzbYy1O9=m_wK}wI?5aIazPk5}bZOfnzOr2Po0q&m*;C-xSP;v{#L9b#5Y0zS^pl}YmwFN~s= zNSyjkGORP&lp7S~Cm3H6hWat2EmS(ig347Z0uv)=Nb$>pFzIQND_xArMSf0zvzJu@ zz;cf>!?Jj7gozt;quL5F=3mf8#;V8qb#qXUTC=3si~T;L#`Zr7G;*1LS^b^A>Pc8= zxm99C#}yH%RDlZ;u+?v(f+~U;3Pwm3T>tlr=RYUq%cY82hEwfZv*f0i~O$lFr($vt8JrZ`H0!Mp@}X1(lxbgaFG+Eq}~|D{a1zD_uLP&m$R3ynS*=Fp_#)cA}^nA%W5Ex zlx-JSzu80lTqjUsxT?)Rl>)za96h`4yy_qtAY$&;-6%7{q>@%sLUB1MmZ3I(xYME7 zfohGURR%&PBmt0PN{sI<(xf?`zc|eSQ)9Nag^trInS2g-cQSLTn8(E~x1A2mQZ~i!#+8FkIB;m$zA?zS`=0Q#&^v?I4 zwKR*EuDoh=zC-nnD@qR77bSoVN+xPnnwL6oeem6RGUy{^Y(f}dp@{X|@rr|b zw^LQnY~{KQ@Pt zwsWmfmzV37;<2Jb>i>-w&p|5*zM^`UwKd7_!-eqMcJMvok~t^zI9LbSF#^QSFl3m} z@8-KoDA8r(LnFpNXob&fUnr|m;+eJm&5sbCh>@3kX*!MxGWa3(UtT;$P zpLa|pN_QizLjUnlK@^@SQP4rmCCgp4%YeG}zlGhoaVq^r*b9h(mfFsaYX`HjZ443X zpYmH!C@kTX)}gKt;YNSDL6?u%U48KK&0{_(hf89<7Jt`Ww0U?VbEUe(G{JJx%oJKm z7>SllWE0pVN}DlvSW;%$iHmYv2Qtm{@w~lx9l2t!LtbS|)T81fi{xhj%u|;e?a1P> z$+tYINI%<~0p>O2YX7O~14^IGMRF2`&MOErVCfPpD{I18Ng-%wQtd}-ItihA22!W5 z0qc=3@Y9Q`bT&yNz4?RgTkH8WwOrY$g4*)%c@ElS@V$hg)RoX__asE+FZ8nb-irMvNg zc+Kl!etuv2ou@`0_6#H)6-f1%j@_>9RJ2{FSlN?7u)IqlW`XkoZV(#A)m2(g~x zEw)z(;xMZVr+>fIU|^{JOW6VKo}#q_XWCIL>aIzSt@Li7SLJ*002EiUF9k}983|uf zZ9C~B6eJN6ppW4}r8@-hAT7QF{j@caRYnnFHHw$3JI?<8Cjnj;{@ktJT;^7@B^wDY z1liMogb@HIPz3oAQj=px^SzG<`7cV{7jpuCFR*r*f zqWf@itru8>OyWrnB_Tlx_7;kuVM;0oj^;&^wB|hmQ8SOxb}qVf5WMU$mW(pFF2RNL z&R2On$-V%sSsQyWOksanqfg2Yvg0TN+bR|eb5fy~4jJe_*@m4OhFidxV>!Ma*nO;Y zgCqx#F_b*AmYd5i#UI{^762Wxisf1ej`w_84&22*nTgR;dnD;ZBw$4VEU_Yy5M=k0 zCVu^*Wp}7EkSBccs(+!hPYOi3WSVARv8cwa(;2KDtg&dx7Om2Y5!-C5(;4=P88WnpFns4< zGN`Ju5Z+L8gO&~r`1L;+{o(8eYbEpwEcN{T+A8p8jI;x*<$r0h`tPhwU~UtRN^;%qtW^+(X_)AQ3=Xy*3q zhv12=FqtusE2PiZVnHs$9G)t>I# zwyYO|@E}*<5UQiuv;JodnwnFSw$;@&c50hH?eqo%<^G?${=WwG=oZNsSpWNq|F6SK z$Z{S$cog7`F=%-U?j0e{GRD-{c{zD)>e3X{(B(fI{*UUS z9g&|6Kqn5(;=Elw=F>@jbptx#4GOm>?rbh~`jteEdD1{nkk6duha|H7-1Ykqz3xrI zv&WToqNTWk;XWc;w45BX`<4YY9aZ3#WD9cV0sj2o-;PGKj}*i zS9uz*X}S&*f1`hHk3Y(OKN{2f7RZ6vo}cg+pV-$9ij&Y) z{6GPNzh3Ye`;6hw+w*H*C%@yv9~_*!@JqOxG)`-0MqYtny^I~R@hwtmrZ8*VGJ%;P z%&w(+#?$fcXe#=6;oZ)A>AL1EgcK+x<@eaS!H@|FUVT^5h#G~)w*=*$^a1xW`rG?$ z8PP#wgvMh2~8%cGIh;1wSC!0k4AhFsQp)__C|y zIgqUV8)JyF?+xjqRm0?9B&OT?80zfPcjl;=&k}k4wKpZ- z@(NT8=?p=p5&$1JldZIEveGm&oZoY0$I0lWx%h_lck5;zh-sSsQ&EZ@XZj|o3UN^k zx2)hgUb{m2`30Jjr}$|2%m;F!`T)GWlLqKA^eReuv&RS4#RzdVYJm8&XCzEkqj;3} zx5iX?fNNx(McV<;zalgb!G|lN&QP=5c;+|X0Sg;n7(4@ba8y#*oMo5lT;hlZgEPOg z6y1{O6{7EfdYxm@IOp6Ox)2xlRac?Qpnw_DW%dOyT1B{>e`Gm!+a~J?EGAyhaiFd& zfm_BuZ;yKrCo&{kA6?xT3-$@v0ufN6q0x+FCSbXr3mmJb8X_=fs7!3NreiN zPRChjEZTO*Wa{S2BkKeb1^ItsX5{ZV*7y>A<_u}YP)2|1_8uhLURd~3u_zc6@TT4L zqm)X3LF&PnNMfq~&lWjqIuczx8vNaUW>7Wyy9Lev4m7o@8d`9_CBFX>HT~b9_VRBh z!OUr(;35ByQRi(Wgqu$eP95)ov>85CLIf3Jbv_x7f)#gA6!7%Rs>#ks z<4HGn(?H`Z*xo)I95FWamfVz4<54vAtw4=0X#fX<zk!If(Aw*RSW@pIF#**DPHr zzh=jRNx8q-YWPI!uBCEHZ_ZipD98P-mS#}xy>q(qmypYpeBRyrwbOP$hK&~uvm8J) zD~^LKxX8ZxHvPp58&_p}6Q} z^tybXkv_{o!r&i))+&aa8VF{*7k#*%^P45JKd(z#42P2wV8%Z}8V&BPJm2hz17um> zNrQ#LD{f)1dWJRE%Q*nRc2EKbAOAF*h+jF99b|62{%_O!!CZl@lja7E9h;CNOq_hk zDIpX>VcM=#9Ta3&IlZ#Kv3=hK0ISBp*kY29dC05*AHje}IDdTsenf^O8?)sNQ2F(j z@NaKJr-c;s@WIMmzs%l08!FfbE?<5!wU7<;X$ueLB)G8yRx*a7IK~Pc%_~

r;xH zzMI{Gpu0}xjE0?P4ZBr^A{e+_)nfL;ffCX|Js!6hC}<(I5%x_ey+MLec#}pO+ZM6> z0tRi5L?4y?A%XnNF5+9awAJ{C8T&sIVgsMu*aTSyi0!h3Iet;P{|si<`^YB{T>tgO z=RDTL<9WZd=8LZ#fFnwvw%fD+ax6hF=u^NJ_8Bv{PmM>c^F@Ha;PKk7_rxAL)dlID z0vDK%XN~1OMQSTe$|qJ9jQOn=ej&DunKH?*nFMxq4s#0yIM%y7`W#BmHg@A5H?1YA zDRm`zM@L56WfI{@;R=G+`NbPg-B93YGo!8V(}N2Lwd3TlYfQY>r9ys~=PcbMS#`=k zqWO!^*erq&|M<5xqVl>XmEN+)k5uJ0Im3TgMIssj ztd)V9a)d0A^yV*Q@6Zr&$)Uhhz(^(V^qAf2spw4bj%{i5c!VRh6?ql3%B%D`>j@Lj zxZi=0`U^W_>V!cmspyLsy)|^E{tYJWwNk;oxrz%LZnhS&veilvA>7u(w8hC?O0T0J z?h&qPQ?JU(IYa9b@VU*34lr(WFcN>ot=n+Vo*tZ1O{rf-1kY|G%zUinx^F+wlkUz! z+Re)R14j#g*1y@J*v^cH)bt|}qi0C#hzh;#tX#&Qr=%(tBs7i~!ZWaW#Ixb#bGDGk z>MhzunQ2JNL0B(Su3Kt4NxrZIQtiR!oAb7bbTWwOJJB0o^J&O^e+lJ1C~OVO6~JSP zRBez-1}wflWlE+4PQfpAJOW2w^Y8bQ3;j7@=vWiK{Ql5DF}v+`_W=`bvKUOADzy*@ z%5k!121mS57C=nzURx8_Kkfp-klTM~=Lj0|(wUHM8m6jkjf{}gqmUah&+!R5BAT6ddeC_WQu0k&i;DIZfUs#$+$&3?O3%Vesq>D!yun_gWl*fanvasu!h zz#NGl2!}mf+{~z6X8N1gc`ujO+#R<r#XOFwj*?Tj^;0d3Ji!F&lRLe36`j$zX~uaT>PxrloN zs)R;Xd?ldG5aAmR?r{^-b7AnqYk8`{|Ck1Js=(kMS&(L_gg^x@wK)L_kM`BFIu1qe z45~m8Ew12nO7}OSX4iN*y1F|8ya$-{ouju=y|tZ+c}IR}bV@>B$=>~qVJNrq_{-xU z_axcuEc8^J=V#tOk-cZ(FJm)PN8JX2QMzbRJo#>DS^nhK>&v{A!tSu=7cKYXWmITf zk_6`L(yjkj0OcDRDOR5M7lXamPQH|+h-S@o;JTgd=7SeZ{sS>6!kL}ZNc-Yh zZHu?@_bK9coG~)uMHC~faYlpC@Gs{cf^fHZ_lf`ng*_%2$%ww8+#fON0Q==I)FL|rpSE!&xFQF@MRO#0~#+le( zonO9*)|l@Xuz``$N1&p3QPMS+iKTCpvkW5llqEV6x$H&q?&ZZP`^kU^5K0~1c!dgR zIlxy`(C0uzy2(YMel4xc;Ww)8ETb-ifsmGjxp=McZg=1U5_d4s=9u(5gx3g&Q#pa&*ja#1Zspw&=MavP6m~++^g(ZB?ca4kuadzF@nD$62=DTL63K(&vD93m!b6T%RcI=g2xOjS-CM-g1l|oB8}92(`_~Q zJs^tF%tIb>#swpji|iQ-nC;qENg?548SPgcMj_LfrSAIqe&SHdHJ#n#1Ei7_+>7J# zMTBv?tl>S@*{f6Gl_oz=rK;YcLqxpX~R&b+IjogH}L~z7>_fI8$_~A2KY~s5SL5W%@=ad>JMM}i5>Q)3!T#3+u z={4owXe3Ql1r~2t+~8QjLu&USfx2_WVETDRE5mgIx>5BBy$Vk@@3>1x&o`gD+IL6u zb@41Wv8QE9MNytLBkJH~Rm(UtfsPjGO8W2)6W zb`Rh>i`G_|NfID03%#~_horY`U1I9Gi-nq_wm)-~$j&jGo`Z7u9LY1ej#o)RqHa4) zjPU?qxRu`3HER{4L)T396|dJp5FHR9?F0Y?@xc%v+@DE)j<3$9H4Jn;p3Z7Q)tiAy zap~-@bVCz`f3YS$Sb!#Um zS=vsgds3X^T6FpEc+(kRRFw!=u80gpAZE$XL68O`HcFiZ(}19efWYF>0-9QYp| zdEg$URaI3{6;)MLRafoM2eJ=&(zR;TIdWe@UV{1xa3{wumEBU4;RNzrckQl%vRZtI4eAn00+&$Lz_3qcN2!+Un#nRN0 zn#aHHw{K0#t*h3Pi&o$f4|oCff&@fBfr0=_*;=X^4N`}^LBoqREl|T#D_SbGH8f39 z#;!`^hb(;>aV}0I_lE^FyVaXKvxd4jUQ&K(o2P>E}WgG!g?Hd zUp~cDe`l3+I*0bFcrzd??3JETUs_+=TVc@-bh03V2o+Xf zz_<)X)0b~<{ z)8|$(uV+Dho$d@75oSlW7MBkG_pDhqTNGi*?;p`Ma3@xysW$Dky{KU49f@C>yYC0M z6rjglLJ@rvi}bz<_@aBt;1d^xf-fX?>&X?+Z18}x1kX{cq}B1}B`Hy)cF#-QdJPA7 zidSmkK~)Rr@ckWe-`5(tRTa1#H0IGlS2RtK(?oi3s3pbKL)=tnwl4X~ns=pGb)FOR zxZ$oITo%t&w*tq6<%rHurM+ryq)afa zrBkp4K-xuw_#CUcwBLL~ygV-JEkITnIei zxe2Z}r~^68?}{w+z61#LR#M}vWQhkk4$-rZ9q{sM#p=L^r)iYs;|2%EqQ2^I=W{z% zi04EcmrT(f)Kx6cEdvufkaAtBtt+gz#SoG-1Jv+3Bzj_-%V9mV@qlO8q@fKzG5HFP;im$@w~lMLnQA&6<>hmOIul!!6HoXRO3qJpeuhljg@t`ep&l<7=$Mx?J3V z)z&vsan=l_OO0GDcN3LVHjK%gUFmAukrFpS-)Q(-#4eu~iPCzzg>)b>O(L3Rdl|E_ zWxY7gjw-wIOS!zMd+rX5a|UYjt~uIq;N5n3x}sdwzL(!d`FXC|`<6)RnDXB2o3-I) zH4nWF1a#LHL;yxTPXD1A`oQ&Ot?Huq41Ch>G zo^EhNxH#C*;yf-7d}uuGw+-8+v=-CCgUhD7ess!ON^Ue5;%52MAQ(+leQ|Wa`%aMO zkoWKes!QOXC2YBpT8gLbM=R(AR5~r6d5hwNr1M|3%|6LbJ55&DJ6b}B=FIaMy-kBe zv!QY?(Ry|Wc>~aZB2)YxB9!>ab&jP=;vEO4&+hbjyx#7^=bj*;_+<1EV~C4YjnS9Z zj6Holb&OJuZ)l6d`!pY9hPc8E_rhl6;#o1^oPDuK&ksI6#1-VP$0D%GTkpM*$ ze8r7Z*K`nwTO?QSqj)<@#b3RmAMB8zKQvIQek40Axiayt$YP3Eo7 z2oBVbSMPv~EhiK*JTW+wW+Bmqus9+=ODoLKlkY~;)pamOQ>=!&pm?XcGP`fB zY5f2L;QRFlI{;j6I(T{fJsxhIzMJnUV$`)YEGNX3JUBS7z~h5cF^f&AXk{2#SxplA z-+VegXTu!R?hm9P;vN4e`$})Vb0YbozQH@mds3$fQ@y&`&RweJ=?@{kpT7-X$iCniwI@5cj`$ip1O<_y+Nj!<<8JbS_6m5zl0`UTpTUldkZGDZ^UcznVfIz3Rl) ze)N1LP@|DeMGFp1oZQM0PT%YN4?1(qQ1M}AJ6Z&1{C(edRNTzXMZbQ&>@vSoXh#&l z8QZz~&qt?y3%9`%leHd~cZLRRzgOQjc3@141^26A_bj9_)ybBds&(+NBSgO1F9WnY zVe+N$7oUI$w!LS2>KjPyo}y-h{-4}|u!4xNFrW^Wm+8*(P);pk=hkf{>fSK>I?p<` zCFPmLT;z0nj?$3D$76+J??i*bgr|Wk8*)AdxY!)npyS~8e7$sMl`9UJC?SH-Qu|@dCU#Cm~D!~D@rZC@BkIx4 zFH;dMe7U3s^An(qJ z^rS$2QeL#@09bPR9SW-CuE`$5l}^0manG5Us;eW2fVUP4qfF^6T>uyQU%o+${bz4Oo!1beBKxFee-hInj!}-{TFOy z=8E@go$BtNkA3Wm^z(@HdEL9_xUoBj#)rO(e)E0$2;Q>({5j-*@%UDp!m`ONQy?ULI#J;Q^kwD3GQb^5${>5LsQcb7IP-*O-lc^oIp6UzE1Mf)cD9{IHl~07~rxNPfU;w^j7s})#dqgSogwE^nK~Gf-PRvcn0R= zDU=oYUExKbFL9hAS0>4DUf>6hp~4Yz;PNmpJxl|R*U`HG_&##B6h`kuo27*R0cMf= zRT9tz(i!dc`*92I#|yKXbVul{4)7dn9i1wGOP07@o=r*GP0noq;)+*98D02`sSuYK zH8lu^EQUP@*&NN0(QVsL6uH1WTWXngIi+E*A{)$Z`;`szCNF%5FUf-JeZj%DKbIGKt#O(Me8FfaH&iWA_9{aC)LxKA}9;b;J0Lcmipi)s?o z%^?74k*2&Vj{v2rRPu+v?V`TdH4m6%o@!qFQA;6ZOU@iow?^(FA|fIpA}XlZg$jz5 z0jVdz#P&R#j!9uLFrLSL%(`*62jcVc*PTJ;9uoV+`|n**d?_@#%THVdd@{<3FCU>N ze0k3?I(enQ^GQR&ti?>D6C$xkx|c`3lB=Vv^tGq3ei0@2>O6%@(q5VMQodD{-XqsY z^L%J6=Z|?Rd&O6(cuMUH^yaQpvg|6S#+{cjN`K?}|JwZ@hPM z_;d54e1TaKVcIp#IJl{*Tw2#0a5*wAFHBOJbfuDVQPih#K`8Zo~ybqzfZ{M*_oM{ znXxXca|oho>o$ig16Qh56rOVv3$Q`HowVZxom+Cau9IkRSCV9vA+gRyfDq^GF) z)OH@I_^xSp&|jEK9@6(I>K#u{e7kyUN!sTbXe{Qksekj`f1@ltqVE?3 zRdY)m4(3M#i-pEGCBul5_Pmq9;U|Z;ZMN)A`F?H90v{DSDc~nw@>*o6@u=Zf2~){J zer_7sEUvO}p#4;^;F0rG;P@*?tWJ&-xY%U_i^X`C9HUD931tW0)TGrpuPp{d)YVn1 zB!@;JaHb_V7Kt2FQAxtMrKObNK@R9u*pcPu&vKpXgWRWNI?0hVcBIOk@~=T(WfVCG zujxPL^;hOvl6_1{@s?FV;^pf;s+}ot2Rnw+DSK`ycv9tDQtp=&vb4LHD-1xnWlM)g z0Yk}^C+Tz~{j*VDl&p_ZI-D=E1z(bWLRzUZROqGB6?pm%I32-Y&{*ODL(` zQa?IN?GEpz&sj>XFJPV$d5Iqb#PiDdlpYFsZA$m)Dt*xW2UriOw#uris;a80s;a80 zs;a80s;a80s;a80s;Zl9w(&kGb}RFv#JDS^F8J_MRVz%INtP7)>Gy`1n!fTp_r88a zjR$luQdICBYVxm)sd}oQ`iVHD^bJektAxYkrP`z4deXQ~`jT7nk?p5-4WUe+`(Mj` zG4x%@9+*;keTkI#zCE_gBA+y$eM`K36+Pq^)hFDb`X6>rwo0CoRnPUOmOToSy7DoV zl8je{FCusseqE2crwV37Tq!LR@n21P4(PkpgoEj*z?YJudnhR4Mr{jLNn)am zRaq+XPhwQj2Gwv>z0!KS!=*f=u#==;Jx&!m%b`r2)%PdPoJA?$RVP_?jvi8_%BO8= znuh7AeZ4LpTgLE``i0efbsvY#K3aVmFIL-aw%g2JwDfus1733$klGg%;=HmSVMhor z1v*DmsfxoW^}_o@xR)Y6>MdJ31ap53oMWc!sDgy6bLy+S`V6sK=R;FFFdUNSjK%03l0#p}G4PYo+Wt-uSHkNl6>^`$=yYH#C{LWU5L7| zBC}O1HqC`?N>*uAGYrX@j4a8TNlhA3+9VljD^`Y)=uyR8VwCm@6N1wVkXB%-BBfl) z+aRKpA33g7cz7q5s+IPyKt+DX*YKZilZs*X@5ztr{I85vPR3736tu~i=$ zl;T^0vjy6KIV%ex69&W;A3SvS)b3{|Hrs8uk~NUJaw@*BvC%JjFQ@8?Us?A{g1Ma1 z;EuwE{#6oX8u3A#P1iq-K?d;=05+E>D5dZsIi63F10~NuY-N%}R0u_1qtGCTrqLvW z&`e2@R4dpN0XMpu6x5kW<0!VJ^o>sp;?1z!A;O#t*0n<&{BrUArXFhYQ4iMsPE^rA zPzoX_6x9(5 zw~F+5T=&Vz;A`dC_tbwcZ=m*U`(6{=^)Y;IlVRF(^?e%I?eD|WYIvP*S4%P9_S>zV z2POJ59e;bi`V@WITi_E*-QW3puH%E~H-5J{(QW?qze6|)|B0}+{f6It_pbB)UlZ8; zzkgefp96VO<+!Tt=HlzZ%y~Xu=g-%8A4^BP^*GzCexEzWY_yx)otDDa!M)MkY3pJh zKTCPJ&3BweM?dIm=iT7#epg-mw_cX_SElZNH?f`2>ASw4eaQQnoLzU}!J7ZRzTxi; h=Emc{<}8jp1H{G6d>^-I)Ac|6UC9*TLO`dp=VUhVg)0C6 literal 0 HcmV?d00001 diff --git a/internal/arduino/security/signatures.go b/internal/arduino/security/signatures.go index fb6ed9b0697..ebd86e4a037 100644 --- a/internal/arduino/security/signatures.go +++ b/internal/arduino/security/signatures.go @@ -16,12 +16,14 @@ package security import ( + "bytes" "embed" "errors" "io" "os" "github.com/ProtonMail/go-crypto/openpgp" + pgperrors "github.com/ProtonMail/go-crypto/openpgp/errors" "github.com/arduino/arduino-cli/internal/i18n" "github.com/arduino/go-paths-helper" ) @@ -71,16 +73,19 @@ func VerifySignature(targetPath *paths.Path, signaturePath *paths.Path, arduinoK if err != nil { return false, nil, errors.New(i18n.Tr("retrieving Arduino public keys: %s", err)) } - target, err := targetPath.Open() + target, err := targetPath.ReadFile() if err != nil { return false, nil, errors.New(i18n.Tr("opening target file: %s", err)) } - defer target.Close() - signature, err := signaturePath.Open() + signature, err := signaturePath.ReadFile() if err != nil { return false, nil, errors.New(i18n.Tr("opening signature file: %s", err)) } - defer signature.Close() - signer, err := openpgp.CheckDetachedSignature(keyRing, target, signature, nil) + signer, err := openpgp.CheckDetachedSignature(keyRing, bytes.NewBuffer(target), bytes.NewBuffer(signature), nil) + + if errors.Is(err, pgperrors.ErrSignatureExpired) { + err = errors.New(i18n.Tr("signature expired: is your system clock set correctly?")) + } + return (signer != nil && err == nil), signer, err }