From 6e5b225fb072658ee35e12638588e19da9a8ffe0 Mon Sep 17 00:00:00 2001 From: Christian Hohnstaedt Date: Sat, 22 Nov 2014 00:54:06 +0100 Subject: [PATCH] Prepare release 1.1.0, update documentation, changelog --- README.md | 43 +++++++++++++++++++ VERSION | 2 +- changelog | 2 + doc/xca-doc.tgz | Bin 21805 -> 23010 bytes doc/xca.sgml | 108 +++++++++++++++++++++++++++++++++++++----------- 5 files changed, 130 insertions(+), 25 deletions(-) create mode 100644 README.md diff --git a/README.md b/README.md new file mode 100644 index 00000000..92377110 --- /dev/null +++ b/README.md @@ -0,0 +1,43 @@ +# XCA -- X Certificate and Key Management + +## __Release Notes__ + + * Make a backup copy of your database! + + * The "1.1.0-brainpool" binaries of this release contain the ECC Brainpool + curves (RFC5639) as an OpenSSL patch backported from OpenSSL 1.0.2-beta3 + (The patch can be found in the misc/ directory of the sources) + + * Send bugs to christian@hohnstaedt.de + +## __Changelog:__ + +### xca 1.1.0 + + * SF Bug #79 Template export from WinXP + cannot be imported in Linux and Mac OS X + * Support for Brainpool windows and MacOSX binaries + * SF Feat. Req. #70 ability to search certificates + * SF Feat. Req. #75 show SHA-256 digest + * RedHat Bug #1164340 - segfault when viewing a + RHEL entitlement certificate + * Database hardening + - Delete invalid items (on demand) + - Be more tolerant against database errors + - Gracefully handle and repair corrupt databases + - Add "xca\_db\_stat(.exe)" binary to all installations + * Translation updates + * Optionally allow hash algos not supported by the token + * Select whether to translate established x509 terms + * Finish Token EC and DSA support - generate, import, export, sign + * SF Feat. Req. #57 More options for Distinguished Name + * Switch to autoconf for the configure script + * SF Feature Req. #76 Export private keys to clipboard + * EC Keys: show Curve name in table + * Support EC key generation on PKCS#11 token + * PKCS#11: Make EC and RSA signatures work + * PKCS#11: Fix reading EC keys from card + * SF Bug #82 Certificate Creation out of Spec + * SF Bug #95 XCA 1.0 only runs in French on a UK English Mac + + diff --git a/VERSION b/VERSION index 336c3677..9084fa2f 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.1.0-dev +1.1.0 diff --git a/changelog b/changelog index 757f7877..87ecefd8 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,5 @@ +xca 1.1.0 Sat Nov 22 2014 + * SF Bug #79 Template export from WinXP cannot be imported in Linux and Mac OS X * Support for Brainpool windows and MacOSX binaries diff --git a/doc/xca-doc.tgz b/doc/xca-doc.tgz index 27bcf92c9d4d933292ad666dcdd062a30aca026f..9e9e95b5933ab84a9126a07f9deb5ddebe75a50d 100644 GIT binary patch literal 23010 zcmV(@K-Rw>iwFQYfpAm+1MFOTbK6Fe&)@hIbKI+nR7H^@CE2l0Q58keG1q#nNN=3F zy}B9#LvmIifZ!pD`SjP18DKzCw0yNn;yWW1O9BS-=&%qgGeE(~%6@?ZI{9 z%sa)q_+!w!IP=8m)nMEc*S)L3kBy%O*Mqy>_~x!5`Zw3(!S(pZ#-)ym$BWoM7{_s# ziNn^L)~iS9ABvlVOF0##L)aWmH>~{{i zsUJrz>nUR37lQS;HT~0+G8{J*{vCOqlG){S>FuFt=`|^Ki#ua zOY02V!2ZR@;>k`Ns`bub>fJNX^G%3`HIbWCxNzigTf10;xZj(M-un zsKip|a}norl?s_8A@WMcQP%Rtb6{4M$Iz7wLwIi*rwe|Fefp_FuKE>+GZCjERlgQ0 z%QINQt({gZicE>z&aNr`3A@yGAVs8>ZZ}RZG-;gGO2m=!;;DdnRvn2wXqw10hmog3 z=ld{8YH`}Xxfq;{;v)6cX`B8KV>xMgAF~41vJ$Jf5OevUsCA&TTt~A)XLAKKk_*M1 zHsPtvVR{ch8>SddC`sc4r;8H+kx)^FG}-6Yftu=w`^80@DLcz+dB4Em3%N22!^g{c z99HW>0>qJdlogYIDnGB?s|IzbjM9mG!3IY-4OxV_Lo48(==Yki{l~W>k*O3{h0F0n z4HD_OjBE-YI214RZ$OZ$3!L;s8O8-IQI|Iqu1wD&6*RpZWe0B(r={@YFoadWl#wES zyjZ|*4>Byw!~#8?suZSClP8kFR83I?QG|mSn&U7&cCDu{{gns`7Fu|u9)Xiq215KD z$!{m=(5e>+C9{=S!h$MMt`@3E!qsCErznHmF^I^Tn0mJ#`lG*e4oh)`mt@&ZOZ*iV zpDA3q5y=5{c~I_DBb=U@GbyCU`~Z|=VMRwne?V&ZElKqQ4vb2aAA0@zwz)I&&`hRC zsQ~z7*G<~ychYQaqe$CqSN>?T`2Xf|*!p5)d-bFlbqxYClKwuNMm7j*bH~I$*PPpz~GBdmk?e7-=-e5um9gQ4wPx zS+kSbJT4e|P6!hPq7An&5Qh!}X!{V~E7Q#BX0j4Vk&|JERm3&i;PFd=sN*68IM|+WU@?Kl zbAH`e**fEZb1mjwXBYFZ%}**)sk8{mWoBA2GqlX~9Bu*uaJv~IL`dZT&@!&>DNJG9 z0YnfDUS~sq0H!Ok3y83Q)S&D;og%&?_kcKAm#YN=AehfWrbtSe2}@NN9+?$^tn3h6 z%fJeB(!7@%284U$oCIdhULbQh0U@w>XB*&o!EO8JKs?SWUu=xs_P>MCp3V5r(Kq}5 zdt6_c{l7^lp0LBzA3ej=cfQcncfZKgAMMr|o#*R}?lVk1w1NG*!&*Rtl4|wn59sKa zpMXCt!+2)R!89%+t0u)%hoF!_ueSu^0Q&|-jO2p~tS@TSDe*0c$$$rd1mG`YDKQEn z$$Dn147^m-?laKZU`D_<2I@}rtS~kWN6j3~T(^>4vXb4MR+8F`0F~f)imdjADIB8> z$`Gqh}gS_s(0qBpwk*e4WhFy1;m<+~zZB?LEQk;fSP@+o`-@Kq z@phtb>D5#G|08bT%i-DS`PuD<;U{GH-MfDG_~eb)Gx4B(FjEBoYFz^FJzNsl=RjqC zswZq!&D*DK=+yRn9gFj;TT3+TPW0;J#noZo5ilWvyE%p#y=t)}Y9J{x4Hy%sG>wS{ z&M>rqkK=bgP}FN}m}=S;zohTSX+RHS&n_FmEbKN-u{wia2wIBn;o)&pEa%#v!)A~e z(j?>>E@B2W-j=8!LnL=_3i;qP>$7(#@)W@>bM1?5;@*?{gVjQJ=l*~;7bfgCm)RUf zn8m5i=Zp1iauWtXf}eF1#LG;8Y-X$iKyYthgO5g+)lC#P-1>8P3Tzy`?{!aJQB(N! z1V$CLO^1u3Jx8_YFu+@>TcBq9TTK3V-WkZ`$k$~RMGLaR&k3Ye; z$iT>KD2N_0UoS8UXJP!zAa4{|wWN3(&|v|MsKW?8GH$tbN-lmE? zy8^am=uD7RaR2UdebVI|jU$0G>cW#%CXDCkbn-OuPl)&@JBbf%#wo0v0`Z{NCHZ(T z-s8#P8v)X@*mS@s;98i}!UCt`hYC7_<#& z;XG@!yq__@L(ZYGnw&$iYYccztj|!st!F3@+KqK$L(Q!Gun7yhOB?J0Jn<>#094-G z+M?tlY?>sLE5I7-V;S?2)#kXHsjrBsuXZvO+T39B1T!+IkQ8c)1eE|x&G^YV_@xn8 z1o+1~`IH)y<_VB`6K*KMDS(b?L>Y=CjVG}16;p%9A=6(%1TzQVr6*}LnHOmZs9?Eb z*itQ;)}T)exfu1T*n`!k%r(DAF>^vWGT3jNfC_l>sB10ovooc<;MC;#S{6Q(`4y|Q zaU@KGS@%ECGo8!OnJ)C3#nXI=lZcBv(*Xxym=ri`pm*jF7tI2^T@Hc!UFP3|3YxDd zhJgtt{OgZhx#6b%MUV%vOSthut?=PKnORJnXHaVzEC!@oYj^QvN^KL zH1nugllPFZb5&ddqF&F@|U|=lJv$Gi} zf3AE~*tD$_G8OetnF#hK%9pj=Fin|E2HeS4(k8nftd5dPUb+H!6OQi&OgT+q5-kTkey0vM!;`I*xd90Al{-xmo zRLMyh#&a0eE|Y(4n_MiB4O&rh2tkx#VmV@1rw8%(<+pfovATtgz!JjFHXvVDbml1gGftN`9kjicG}hSQ3iKy{Lprjz;~ zhNM$2>AFJ zA>i&8hJcU0ClXFy%Lb(P3!hGv<(#iL)otplm$(>?Txe2(tIYFO1p_9$Xh z@2ZOH8HX`bGWF+-dnnlsSRyaUr`IWqu|s~O9(|SM;&gE3&=USIp-AktOojq0F~sL~ zMZUHfJj>$*Se2WBF^5ZO0ZJ4wH#di&78FLPhDyYCZx~Cr zH0>7Y{Sn|45_?m8{{8*U)u7#iP0+45)KoT*R z0HV>mH5oH(-rgaz+S_0?`-oI=2@`U>^8}FR3c&bqkFYf%2rW?Hm=Tf%a6=jJ&Uk#q2+-Y#ZVL=mfVRq!H|DpE$Ota zXNY(^Imwnvzwa?ujQVT}R)bAZYBPGg?_uX0)F&yCP7N+FsaaJUvwlGT%;XU>@@$RL z-y|z3F>KBe!-Vuuq?iqS&xokf6sf@&OH?dWirF=@l6xzzoz_w7RjboFf&YGJQ3{0a zvpf*5*m&VP9>1eM42D?czEI%ymPNM07(UuW^a{5g-hyQN1?qBv*-c6qt;+531w3N6 zv?K#ZkqnbKw-DJKjmxA0a|A@DN=Am@9U?A*O~H9sa*C&pU%Pd$J?;FxAa42Q{QW5} zhwU#m#%Jn(UU$1E8~)#M=bQicdt6_c|2N82f(aP<32;2vc@pg88IIu57dnE+U*rg$ z>{h5p&sV6&&u|1WS$w?95j@6qetEnLvbO3ovO;{GZ|DgG`YMBA3~H))L~K3GjL{c)-MeV2?&?I`%PCJv;Jnf6Ukz&Ny$pynoK*rK#+=Vm zMtnFfU|%CzxhY;g!O2G#x0GEq%X}@0QV?w48lx(u1S*iISvxP6+H9CTaSGV_IZ{!V zxpl$7(gmz!xuXo9c5?r83Use?C|2M#16_qf3a_3N3`~(ExdV}XqH|{>*-eCVcw*MJ zbOs5S>In%*66>f+o4VQj&0>Dg?!&U+er^tTOmK#AF`L6=CYWHARyIDuP&RzUeJ)%V zY@X-I+je`oT(;Ds1SO$b@M7CfL;Sx*3Bt9ATaD~D9~?H@NEIupa{V_>6vdvYU4q=8 zC`DMBgloj(n|olOa*dIneUnxOLXkbPwvaMyX+hg6^Je-1_&_CU_AJTWWyWE&rj5gq zW<-vf+F0r599%M|O)xaGnTOuANL{i>yDIyrO&?7&=jZ#qgAtvx74NZF@d>l^f7C8H zsbgz=)@&0UaQ<&T;7nGEj)}{N%R+#kT##ztZsIJ;^WgTF2}RiAWwh^Yw`PC1C8Ovg zbvH6)LB=Z7NVHzc;gxA{Q=3rMt+Zn~QgCw2dI)eWC|& zmTQ|qjy=+ejIPn}#NZ70xrxVO^@ly1N4>&6i7*c5aYkrb5}ISshz2N5H6hIkYmye( z8$I9jw9SzuVUfqK{tF4`t^lUl zgQKx2!mUm;0xypNZ$TQ)fGs*rd_7AOC?HQ}fvvw`Iet;iWpBtn0(+ z!RG69ZpD~2bL7};L3Wa8Gto};pv5GV(fy`dv4v?Ik=u2AgWA~e(Z@veMD?wgwPOPn z>}+!BMMA1QHn$dlW_1#>^|kmBGeQR2;1O!Ga#O-iTV-8^nJt*P5v?+8gB9pxiFpjF z&D8KrPgfhD%WyR2(r#!4;KpdN42*}rTFX%y-0OaVr_4>$*}U=~Ax9dk!d4gU9BdS^ zf-9Y`pMs-0W}8g3g}MX_oR1|Tkzs$%t4~I`UPS38o5@*Nj~{BXJsxmU)V^Wrd~L-& zk_GPrm@(_i;~CGY+(GP|@F$mWKCZJ;eK}}zOR>r^^nwlHd;;tV|E+3^E?iy;Vd=MQ zfC{VBeV+={yXESQ}hHcS+?ZPlY@xkzpTaN#~7LL_frr z%bFrybMdlPRf58{Qa`A0#W)K^d&~E)*1k98{%KFAm~UZuwQpfr4Q0N6Wj-$l#_gEQRd2K7rOY-xc-NnqC}ss&J`nFwIV7$h7IScLhJXEJodqz8^=a&g#_3YC z7%OgGw)**LO?0>MDH9tY;wEI*>LS0L)M&$zy7YND>+!G#uBgkx#&~dx-()cRUI~c- z$nV!(nRRv6j}!X^K67{sCt^OjS2`EwyD(Mt70aJ%)xIZZf@1q6+P+1!?Z$Wbm_No8 zn=t86;hv+DyX1#h#Y{%OE+ku_%tmp@3+6Jv6^Hy$m&4f?8{;$e|Hmhzt<4c2^Bh=>@0MkHn)STjar8D%bWg(zkR$J z56(Ek1h?~Y;c^Z%zKg$Ae&t*#5WPx}7bQikkVPRMpYsc|388x9ha3G#UjZuMVY3 zBUo#VUcS?46!rC8r@hl3Dr&o^T()&>T&Z-2fuT>Az3ug;x>GLIQMIEg zK}#x6szL9ex-;^|s9ox~{o?e=D5zVjdpWk}lTjnn*$#@+nbob1;d|A0Rdw*t^!itK zi$Q6!mP%v0T5H*xN?zYp^2!?jb>Uhi-&j{#%4OxLa#?G&v)v~(Uuo*={F+L8udm15 z$A`Ox)Xq%j{U?1{(blZko60m+Y$(BIY+qGI6<4kIr`5%v*dCeP?8JI_Ts)RKW2vvH z`9@1q=dG8Gq!$#Wrn+loJ?h!osHZDe+VkVQd%gQy4%I=>$d-EuCFI;x}}jp3JmWA=2JnN@1zwY4$RO($DWnv3ytGnQI6)#+m| zeDappI-O|->Di}QJ$%?)!t~IW^PBZ#^5wcXs8zaVX7W6r6^e^YUd>45 zuHW^yx1TZ_{dqhLr@g|WkW&LqY1E!ZR(d_MJl1f{bPEQ_S{>=?XB;niRmZNBN~WUM zTgpu(KPhS%t!OI6;wQbWs%u@XXx{o>=^6Lyo~kz5C1s>{OT}?|P*Qg__seQ z^T(+@o9?XcU|F73SAFw#Yr~MLG$_}hiizZvnWvc}!|RQ#QZsGmy;V6=-S)L?M#8?d zu`Au|Q$Lel*~RL(0>ACqdabdd*P%=DkbAKL(?RQsQW`j%bqUA6dTg9S7mga5({lQ) zZlTq`E9|U|7UZw4uQH9k61d8IlI(pp2^NYCwdptikYx*k@FPo?XQ|GAOR2E{LS z#j%T5g}dgp)?MGbp|`uf8Q%n(N;a+Ln(FP7bLki>Q@X5H>dj*9a^Cp%jm>+#nm?TN zu=e1>5FO>mR*qLpXjwY%&YnE)rf1Chy`sH&X`-jU!6KyAcbfW)b7*&b4m~w+4ozqd zt#6%X@LV%*C(>w;?M||fnOe83sb5;l-gMl&U#x}$W1Jg2s(RCCe7@OuPx*1p8D*}r zz0Yp9nZA3vT|AU)yG%nGly4S`_BtqP^M{8W@BO4yV7!~7K&lHUvyv&t#w6d z_6k<96ZDH;*7-*7?%sPe#w)w3G$dVD8%iGQ^;pv?);9O0o6Tizi^k{SQ@VMh6z|lA zsx5DB??Yu{&u4CaY+UQ*uHmWa>-F78Dn3u`f!518-lbN0tlpNZooTo;+oN%3`gvDh zTWY}@jE$VuH|Le%84SC7}loG`PK6l7MEgSUe8y0X4&a= z){Up}=ZfpCKCSAV?58h{v7PbO%ki!9P13603aF5+yqSErT)1dKt9|3YvUu)IW3lc)i z|L0E1|G9Vh|6Tt7h4TM@vi<)h<^P{6{(mq2Gn306;J@dx*?0N>SA70v^1m?;eQ&_x zE?(CG4(VP_$p1eQ&v`%xA(ntwrvDp+f7snliT-E5C#xKn{>k4c28@9|9q1P`=Q!E1 z#=H=%dBF+#5NjilB81RHA}oaE(DOr}k09cm%)(!mK9btqJKNy=lygV&EKlh6j62G?=s)f&aptzaU9gzVm}hw8P8+eL zF#mry;64!y1W}}vl6B~!EhFGThuDZ+g}^F0m6(P8^Gyf;=MTAr=N6VWX z$@YB2>)B@-wIU|IrJ7r`U_n1hNucUtl3y{@^^E#*ha(r6fX_Sx@ZbnZtjni5W067Y$_ z(x(B{GEqzbFAPpq7AEF9gx^KNMxTW|h$aCs!?m4rNtW66E#ST5*>TxsUlz#Go?0MY zz#ed<2#{5*5kwIdq%$}_qZE;3=-Eru%BXQMF?i`Sf(z30!F9<8@h#Z5a}?ANuK?Al zx<_`C<8h=GVMIWI_qRB8Hv_YyL_A*r*JB}sn=@!ZaD%+gp#U>j{$$oBA(9rsT8tjO zOgcyDQScH(BS(&S4^Sq;G3Dd1nX>^D1XOfMYLyIAHfx1eS83`p{H`}^9V4&jWwj@_ zN;;^(^nvVxXTP>h>~+6FDzl+F|r-aMllO0_5J4=|NXQ?4~-qf##$ zkQk)iRH`jQH_v6Gs+HS$qgp(dApyBsYe{9JVzl6~R_&ZJJ$y~B737NE)JpKDq8eqR z)ua3hMym>WNd?GEk?TscWoYfP(v<7%X1!+WGFB^Zm|9seDtbNzxkHY!-T}29*&@ni z%uw3bvepIdAB!HZqO9t2*-+H7E>lKO$-L3jwHDTf|B|3y&~Q+^^0{o*b74O9OpDNVz~2Mm^NSAjg+RAn3!P%8E_Hek=GBW0r?Dfy0p#pVw~*P8|( zCe&nFi8nV5dLAu^IHf34Oc;Yxd=ACLbr2OmYrvyOm~LztjqUk_XCF*)+Z00U+@3B6 z82ptG_(bwJHN{*6$yfK`UJrDek^I52w*O5p;j<_~d^~%ZU5LyNp<|En_W$8Lf+G4( z2K3<*nvdKS2SV?OZSx*vJP=0_mdgdna5)^x|D1-ug@g)Yg&#p7qX(SSz(KtUTY)|b zX+KCy#o8&5BxAa@u{&r|*~kxo-k@dY7fj+$rJs9t3x zsq0OLBap!5;?xQ#tu?=r8sQa|=<32vSz#hc15co%9Rk;FI(DJb5>*@Lx{)MxIf5T3xCB~!M>b7C3*UM5C8ureSrU;%f9>n{F2Y# z%>G{iDfD%_|690Uf6P1RhnQc#L!I*GQ^PmVzQQA?NMGSLYpMNlL2@4>a@3Rjsq{p9 zF<_yfBq=i*$c|uo{J{PO?Fs1vbE)*le1tByZ$rrVfh9JZXeQJ!u8 z%>0&;OaZ7&McLC9LcUCdMEG0HC1<%JpyRix^ zMW(Ppt$4mMGgiXFJ3^oU&-a%LI-VFpau~kJk8xS6u89*CV-E+hWKj2HM-=sbRr@Uw=fBcn->OoMBI{C#N=q73!w@@!fu2W--rI21mc*%_bd=5Va$y!>>&yB zLPIO2heLxO#l$et4+haLvzf#ayP|AO$Ht<6ne~~eAI!F>y4Y1nW1ix423CH!wFmFT0 z4Ep~wSk8#Xk&qq|0~s={&L+ZtImTQS z1D0f_>aS73E`~BLRD*ts{$#&n-~_l(P?~}+>*dMV2Qqcyd(eCzQ|wuB7G+7%K}Lk~ z18<-6L!0QpB}O7apo!F0GjGY-N z?liPlov^wxB4TenN8*QLl$iuX<2yF4T0{}*#7*K@7JfK0;EC{ga$rJzX*h*70s$rh zB!oEQjF$UiB+*GYYo`2RIcH_~D5E5RB^bc+JM|XCV|Z8+GNm~IH?tp<30q?1h6hGn zxQ74MPCsRj-2Ym9LwXYU_nY-Cm|Kfr?1jILzhM!63x?mq(T-OD%fgh6se^-^qfL&T zzzqoxz++>;##;(5vjR^9m|5F({uTS*9oQCAn_-)(lm!15G#&+mP$X zCD_AYe&ZP)e=s^dX*9TPm=}zWTkLl);~j=IR5#L z{&$tm9mIdfrZtbkP8hu48fQ1=sR@60>OxR69{-C)=G@a2?1aG zmOWXMCje2Ag>K)ay)_(rLDY_Mf+Xg_#7O4$(pa05vazmlBi(0TO;VC#*~e)gXxNZK zLKIC1Z^wDwQgT-az84#b6L&LcZ;fOEoCjyqzxq_GIUFqu?j z=IjzL6ft19&ibYEo1l&2bm#VJVzQOSU*i?A0(JWVBII00Jp}3 zZp*Ck%ah<)YvFqgpC7nGLRe#)c;mU1Dm<~Bh@qG&%>41_tEwnl6T}HWCsGQ z9j8_h5yqn76y25C<1?h*89B7-pbMCYn88(r9ce_hWdy)38}x~K%vcMWC8N+{6CnmH z%rVzF)9#D`va+JkT;icX!pjqF?EJ7!j+-7ZV^n_wiJV_4`iZs^eij$-9LPtXbBs`C zDHEIr2nI z{}*)88*7Hyp6}-_k_h?UVv!)oW^+x14T@xN$Z!Vp7`ZvSb7Y5e(JNW{-}bJ(w~Zso z@89z&W))x~VM$7)-r7sBvLq)$Y}pW%O%At*#fTh915+G=Lt0io{dK*%t9yEebZ(tH z10t{+i|ncH=|^=ve`OPHI*Lxy&Dcxd!Ts`7R9L-@uW>nKN#L3G^Ls?PijAj9*4c%7 zv&C(LEzTi&eNr)(xHRNrSLc{p@zl$X$J{y+c*f-t59$*eMa78@Xi$!R)4A&>&E*g@NED%30&}+GA8+5Y8JtvDl$W{8EKH}aEkn5Lb|v{UGcdu@feh}%xG!o6BU$VKfW{-ZWOI_{A0NDE-uBUYpyn zEvY-0L`qLZ`3FLwsE0r>f|CeiXA``+BH{h$fHPTl6!6}2X&R`G0N?lRqrf;^N;WQ& zhQEiKSp>#J?6Tqp_QH&$t{?D#AUYyaXQW4W5Y$_tONS*BtC&Kl49z_GnL#~U;F>mV z?gQA|2W^}C07}Kcm1K8!N~y6}7Z3ajoXX?fgJuqwBUSYUDRe2r+AktO>=x>!WOsKE z8G*ybGJ>h~z?Tb}H=+ZPJFG~maftc}CE(zfr-xEB*XhFZNg!c+&(`=shgp5c7HLrh zT3F5K@0i!17$r{R#YAPXGt7G)EKtp6{>6+nUxUruO~9AyV}<>9f3QEO+kX#V?7x4+ z=PR@S0=Ls`E|H0yqZHa~4L(?H4gO5j_*J0s9t$~WWiacb$*#tde=2^<=HpuGvw5%$ zU*7!OKChm|xCYN5>G2SsH|I*0s4$sJz?LHv*qC{KZ$=oD2C6#AwRS68R0g~pM0hNw zSe*u)!gzaAb-t<9vQWa}>~@JCE6vTJ4Ih?vhu{wuAYsHWWW>8~g~Z1eQfe+#lE6Na z-RBY>OuB_%U-Q%G?O#61+D zGJ9Q0%_W4cfI2jj^z0PjD0EOngn-CsWYeKadSqjz;%R{lXN4hf6qv;%!3t}h(UR2V zERT%X-mC?+J~?VqE@%S0fw5^UD2jwZ|J)*!+i<8*Z?bUJbWphAnYNfolY1y%|6p~u zYz)`ngtYPKego22vfY1|%bF0h+$kBvp`1QS2NFKmHLgH>G@gu;w z11Vw3mK-yVz8bu$QD=vIgLXEojK)%V?LDNdyDN4XTnl zc%Zan=~DYsuFCK_z?_he4SZkW zD#-28B{!l%*B#RDF=Fdcm8}-^FI)7E&JUaPRgr8l)Z%s^)*uKxIY;MHRq4@U@+=1~ zSv-}g(ZVpc7+?|1PMP8+z<~XcqW?F7K%tJ$FKl;)=nwhaNFmRt^XnpQ!YZdJV0~~^ zM!))+dlOrJTdX4Z3gRYkEzhrp(ziCf5Or&rp|+l`q^f1(bkys9>uT;vR{5$HTJ^Do z6zmS8l|s$zjw9z7^h)kr$AU&l{pR%-gvCdXPl?P*#Y`dG0W(O z(KMC&&tFKfL`3It#%u8&lk*i{fEbXZoWVs|K6M%9XEU%D!%x%Y<840QV(_mBoE5#E zb`?PJc__QhQF(Ol!#ujEHsJM`a7F>1w-hE=J}E(J*NC%pKmC+HD}I3v0PfqB;lnTj z+7wdZ73wn6me6KRXQOjAVOdn!h_c81OF^H4`bEOj@~6qO8kVNk;@dU~B=#}SI|u1I|4|jkoULceN>IO^`3CXbNr@P|uqQx$#6EcG zoD6|Ndb= zV-6<<>)dl~$c?vHPF9NmirPj;?1^$&Q1w|7KAxYlXUTB$Y+^#}#=HyeJrE+)cDA`$ z{&R`*iAN=XU624;TtC?2*ZrO2kGtuGk}2w*9}L^rMVp|#yE07gLm>_0bC93Ltg%j9 z5f?HnmEg{mqh)0sTY@e`5O8KUQY$i~ntziAisq0im7|Xj=2~LPX}iA4s$!HH#kn%t zX)$&22I4QGW>_D-SXj1$p)P8Ny~g^%2uk6?&q1DrixGJO4;URHv2>qr95k8y3n$o0 z72|UH?E<~{X4|4+miR56BuvbjQBD`8j}m`&z20IBc;afa8|Dzha5cO*G9_BGw2o%* zT;{j}VSoj^{3(JnxhW$JP%n2;p%vd8zTa#r7iDF_`=dJ@cwz-I2AO$r|I}C-q<^FI z(+yE8FS>6*l=Qx4U4ya!Ko+tYwTm*L7r6i-)QEv@xi`&J7*1n25RCZo5#3Z<5YjU) zDv~fL#TV{x(+c&8g=iCYhOW$Z=JMV;F#=~@c3651TPx6USR^u!Q!KwP?7D?mC}Cr4 z6^+8)YKApp^>bjN4(oQ|^??5FH9AQA4rY@j8G0BPE9dWHC&g88uRl;(FHn_z)E=Tj zc^DqE4>`iCm~l-jb3tEc3qc5Ty(-^21}82TC7jF=T=6iL1lJ(a5%(C z8iln~5LerVUsu~^XI9&vkmA3HBHMs}$3ret8FqrU;l3};oD_9yibVn78bQE0Sor2X z7oY6pp(^-P&OcZ`f5w{))+<3L=Uov5w#{tM5^UIrd!-(e@qSli`{u1X{obIr+uJk$ z-R~Xr4tqzPzZ=4pImSuyU;MBCP7>_w`BLC;=jnH8-#oY9J4(*p4|{#P6pzn6b7d}i zpaX1g;Ex0SBNznaN3dF5Axxqn@OJ`CG`-S4Os61`n87Y?%qIG7Xa<)5k_aw60J?tG?@Z2A$o`-WrHxHq^^Gy>rnZy|60S!NP_+ z;f{xMmIw+g!5N$OvfF8YX`Gbil%p@^-S`^Zr(gZYt>BmIquu{I80@{^fBm0*zB2#s z5CY*xm_xcb6j=Hjgr(nV_WvHP_Wyon)xcFn13eyi*vcW-uO_rcEkVX(o&c;*i=c+w-8i7gxrvQu$&<@IEj>;lx|~6tu+P> zOCV|(0TsP0B6bNK3G^|8nH0D442-*5F4~KN#cAJ0OhJBu>bHYhhZAHk-30ZdyXrp%DcPfefv=e+K0RMt}kW!fTVq#P5iUlo%nt z7~kg|HeuXOz|0CB1+92ySFY1--<@e%}?JbQeY)T+Yn7!EF63bvQKi3+JDt8`pUO zK&ZpB8`4Iz^!(z@8`u%IrP_jax0#iZmGNFH>H$FS?CAnh z7iVX@+XP7s5DR$QSc51iP4EtkZqysA2P?7@f_Qs=H5{6A1Zc584&QzpAT4op$zbO> zg5-@b>qlYOCMZ)^1dD(M100qO1)%ViNRE#Mgi1YFp@g+eB;(Gk*cu+>e4{HHyK)s? z#vKZ&t>q`-kwnlWJnwAC0D~gzK-d749y@q2aLd~6f_JEdZPO@WCQ0oV)3ogwB7X|B zy+%QVxsS|rzy@$lli%!YaM^lze6(uEXdVEMk7p`cnW+~p$S@#B(9L7mjM%(JbggrEyn2X>7|EQ%n+@OLKi$dI%_YDJ z_pIJ>>Ew*Xr#gpN^s!4IAd%b z=-IJRJ=VF(XBW>j%wLEJ(g`8Ntj=QJ2F64p=T?ohq4tJ8_TE#XZj{#&ij{0%P|D}-mu!MT_M)lDbK_)WLf zKxSDn_a2eLUp__ldT4Tlgo&FPi~J$!gvRf^DSDW-!=^CuPWefSf#G^g%97=}P}7k9 z&}~VWnYjybr4e>q{V_?k@g0G8)TNmLtfgYNO4kk0h82TvDDKzB!q2U>p|Qn{Y;G(< z7eyGA;&g(3#%ICCQ&DE4WC>+8sTPDth4)!lCa6PV-pb~8>Zh{J`}doxKEn<@htDzL zor%#-d7cEYk0ztAI$^?e3;rs0Hh#=gYZ`Ze!#* ziFBlRI~Fd4Az_`$g0h=YkDQFdCJgtcr_+Z$#`vAgY$+Rnp(ns)N#jp;OOiGSIvhC| zewI6)@}S)*!1=bCiuxWV$4v(b1;M`c(>a|`67FBbtaB-MoU3ZV-K_eJH#o?_PY=2E zDP!a6Ayd(h0*Mz&K{O1#O@i>O=X{|q^LQ}e2A@XXoU%cwrOKZt5m{zpLPwsRY$b07 zz%w@Vu+G#7nFNnURoaHYemTpvi$kH9eT-h?Xep_K>S<$g@9L1b9FFJ60PM(eq3w2FfdH{in10x-vUkD#cr=_XvX{Jr%a-{pRk%}ASyz%0g}R|Mir0C8 zh4laoi8=%ule3MuiIu()cG4d{OVE)+S}qru<4H$o@xY#aw0!M%p`|^vT3vBdDIhl} zU5(~h1(KeGeUx`h&&ZkPRX3rI1Yf*Ue4>jISC!r6y^;AYAv;-jr`PZI`n!QHV-bIx zTmp09MVXLwA+fd{igNJDZihVw)c|V$HvcC!ubiX}vl=7Am#2&Fey@L${(@d~!#eNq zqUj}2VN%Pw0jKG3S!quIqlrwofz=3V)(d%f6ncc^Vcc3eK{;S^?yboB3R2+-TF}lA z6YN8gZeG56yLIA0vScKABH}5R>*C>1l(4pD-@JcYxoEJ|5VLS&bm^7z%8epo-lHSW zXyuMB*xiAw(XM_%4MMQx?S9l&H=Cbj54AD|#O#Hh0rN2jR$Ek$71gDrcLu%l9t3e^ zNEFMV_J4@<5TumjT*GB8eaCJjSzG zdyJI4n$E~VVvWpzQkkNp;v;|>tt4*q&s~Rc&_vGi@L(90)*$j!)%e&2TG7JE1{3_n z+jP@taHIKRtJYjiw3zGr16!}%R>s)mT$x#au#(0GbO>(e^sg{U8#QW)rItT#p)_$i z%SI3RAbwUwnchy{mcJQEC`-HF^AqZ5x_x&+P9k9mqS=Use3C#Y8?iOPhW@NmiabHq-ixbCRwzl7E0ssKb!9(oG2zE@)&# zT`i0uH$zT>vn0Vsuns3lbLiM`_~rs+W7wMThw2mykK<=MUyQbi?qIvBCfjZ;gJ;ZD z!H=!~jFHZZDLz$uhITNvKaGs6rTss^lkj{-XGuO_1~ePO{eGU$%<;CL{!VM;SfbDC zbPD1-vIpK|av}1Irm}|xWA1T=^=%Rd^M+pdyXJG>OJ6}iD|$NP=Y%VA1RB8HkpBoV z{BlZZFBDarc{lA1ydeguV*_i()u9;7ZzDag(cLIZdHvWK?9`WrvnCCTar!Oai2wXF z*!gK%K27rReGY#NF@C#(f4*6a&3`Vo>5kss*%=%i4aS4**Z=%PsYMdhx zUcK$}{^{YX*RPNFUL75r?Hu&KU9-ZakvQ$(Sf4C!8Nf}YpP(Q7BypbjkF#mo?Sg@( zYY8+?fT!h0q6)uQ%*;zvq4#lf{pI>tf&a3zdsxT+Hvf5v|N8?zUs?R0^`0pOFKrI| zJ6aw1ckp?Ee}|tF_;=LG#17VGVuvdO|3Iy+!M>Qs4qJi&&CdVGgA!-6bM}(O2dZ9&u-k+mdDEQ9iw=dWO z0so4EJ-UQoB`9BBodj_ZG}TK6_Aqa=VCT>?c`e<;SEU{3i3(|`IA#yMs+nyP5!wKr zcOtjh;*ud@!sq0&?3|4*_qd?7XLLB^?Be zydQNfI)Px&UT13a?(&@c%;@))D1-&L7j?m#z~gxc?)$?w2S2u8+W_>k&O5s?p#n~D~m)4?>jdyT0VlY+H4)doj_agyu1hWhV(X@+x@_AlrZWfZ!`i_ zaHdRiov_O>*9I|$Q$^Qm=yGbnSq>7XES`aLja?i00*0*6PHdiL`KiO&G2!AQo90Y) z;jY0Ou!|>x&H--GEmiG+sPggV6n;K!#BhQa^9o3D391mbfpAvu-4Q375k|}SS-2F6 zG9ryX_hB*R{o!4#8^NNEL!21`HZBnR|t~0CIiE}={UzkQ}XHk#; z(t)-ygYhk*nfN*MO<@B(iB}|eRoK9Pn}eVN2P!84@P$AFgf+%9fUzi^Zb506>n=HUCUX9~sMc zOv5H)W;FsNgee0>zvhr z^N`=F5vbs|G)UOY+?h?$J?+{iBrw_8leiS~!Wzbq%X*OCnAwKmROG}=sVcnh`4#pR zq8>$jAyQ~UdBQM~Ijwu*Iu=WHU;ZcX!1n4qtNMINU3} z3EvIaQWu86?n!6C@G%JxWS2kB222*0jc^A?HktKVqmT=gOl1DE3HT`P9|)9!vtI0T zTZs$FV-A(2PZ^#Ej1?j_le?L>s#k(pP96@LfRUMjOCWtmKkGv_AXYEoV@E0{Sb!ZHP>O~k%v9k7KX3LQ zGfb~#4cNf}6U>v*ZfOjZ6<`Nej8M-^NPmm!21j65I%=~#9R-#ridDAQ)j{1GRPDn; zHVmSrAM?PHppD*uY{YWvKSh{>Bwu|=9xe{RyqnV-d_n?njl^t9BBuNch_&_hJ4kKSpHI$*4)TZ+ zNGhi<#vq2+b&z?9b=D}A8Fu$*cBZX=&Y_QFG)*_olUCzv6Ys)MweOfE%RAVjcNQiNY+N`?VmnL1a~q}Y5wy~CRRcle_J{UM*PSO06N{@&kN zt?wOup1ybdIr^UT-@r7F)@GW=s}Y|}lj9cc?sy|8i|i?La9hPO7#za+T-SBOim;1$ zo>TJYJilX$K4n)!JZvf@r~%7S$`w!scUFt{MyK~jfZB;hj|UYM&rTU*IMP%iE6~5F zP)J3ZLrXB`*|QYm4<#my+KMcJLR}q$rgPk;3t@|(kV_iNtw+_x=0>OCBZVF7-6XqD zy*s=K*g8>QzVl@sEXK0^yuM|XuL>=hgMH|WEP_P;|XPV|oy0rYu_aHwUX z$M-fHeYi)Mf)RVpcGuhECKWt;q~B$gT~PAI{o?Tr>l3rT-o-ngKw+w=z2jC_GU{BZET_Urn%AT#>AUo-mp;^H@Y5Uu{b{* z1hpt5{_+2Kg&P68$;k%P<>JZIHSrjI0Jtzr@|4>q_M%BO@`mKE!yJmuH_`A!K}`p3 z(U}th0*GIj4P5a0;`j*8Dn2|Y0R6j0h6(g8E(ai+)*I_7Va@Pz;s7)CRr?H%OFZo1 za08YA!;~_K*)5d)a*&|m`?yzFHT-4+(lOK?KW?i|jxF?V&TH1oc1t5ATb3@OMKUJu z&?*=+6LQug2FEZjg2u!jU7$j|?iL4_NUSIeQ%sW1|A{wTGZtP=7?sfh%5gsS1_s~b zjp|7RARX2p)C-U>jElWrs2T#Y#j^BsRSSXytW64#M&w31xPdl_y}yx|W7ABHMBm7a z@u$2khC5PeFtvkox+0QIiOmLzO`B^=51As|dq&3PgviX2q^wo66855R7I~vn|4jlo z3D>Pp@ciPMp9lMKL*Ko607n_?S4TR>)K5IML;@-7&y6CL! zgR4PIwD{qmTFtuNxJX%(+Tq8@3`zj0fI(6rX#{whs*uD)l9-ybjsuX>4%+0j17A*a zidU$5cokPhh($bkrr3X0+?xIGF{w529Pw$W*@(s`H-uFXEq4oa#3V?Ka0%Qs!vShi z-kP6Xzv*xX_)IpN%}etlSqw3jkpa$5yB3gVL?k(-KeU-Getu{dQMjIZq-ip;~VOXn4ZB zU{TW}^I8i?+bE2L5-fqkGN!7(_~PEah^>7X9P#BGeScJRgbd<~b?_(l{~t8^|Mw0L zYVqIugWVVZ{~z)Bs{H>g9{-xdKWX>Shv!y~Xd=f@eC_?U$7Y(+mApCH0)~19I|gC! zek>oR)#5MN@^SLF@j{Z1M)LdLAMp1q9|NqRMaD6duF8*;mO3!U#0=sexCa z)l?CKAb)`80n3MaMZP)Jnqa7Z?SXtA;MIFF6h%>XYOos`lCq<#DZ%f6PS2p_RFwhk z8sMPeYA=}aW+oLz=^!`>Jp#PFAeW)1-Ut$1_+k#~RfVb8C=yq`P|Ut%8&Q{z%sn)R zRIAsl8f4Woxn`!%-6!z<`hMn-VFKl2QRS#>>e{v0!c&QY>l0M>dVDXv2t!#)#H`Cq zMpb2Omc5(ZPfN1_M!L>oibbq3BYiY4D~q*k>-oZU2zEtU{P#gPh`CDo8{hZq0U>tB zUrrbEa=aXgG9z|pE4ye?JtS6-bC8PGRfSCu)$BEnpRcbPp#c!8d(AZ=)8zGXjw&}G zqhdyAoY*c9t9vvxF>q-b$$Cx|ccWDHfJ)u>q^W@OX%6}Cax3F3MJC;heGr-S0Z;nd zq8hE5>;cT=AU4?p84x!4c{Zl~fO`GA2_*S4U#QYe`Wvg_?DP(LJ6qA0AM|j*k@Zl0 znI?jq+CXF%h(y*w5iw29e@tCc^on^j&37a7xXbf+MyO*@5X{z#)AJgkXqIp)89k?*T%imFXNF8ga z%@zbvA{ws(gFuz9^+K(I~0pbhee=c$2&Q(rK^P$>@6SE&XRQs~3*kp*Y-vjKpNWVeF(RGE$9J0}O_y6~n=3 zdf|8mrZo?&n|>L6@y5J7CjSkm?zJc8)rdAEVQHcbSy(kv4QVx+RAXLE(~QQWo^7&9 zL&$S<0vm&Qnc6oT?;DTitr2So57oq0#fR2tHbn4gnr$I`HF^zESDIdP*j0^ML)43= z))MwoBiG=Z(d1TmXKExHya$?OoBN9yP0o3?d-$LJ(GG3`wZjbcV!CHD3~ zbBpSM{Rr2&c6M(FfLVEF`lK1gRYRvg^)=%muXKFfP$pYBIiN$vw5-0USrLsOI(pQj z`cYl0Z*>=HHC)U!curiEL|v&L)u%jqpi!~a`ys0y9PCOH*Ii~$;%6p&!0y?BoXv|1|!=sB}Nh`UQd3qoFh;Rn457X)fYD}XK zz}x`Y?Sx`a(R*yf+y-U9JbHi~M0kbQfoX-1J7Dv9pwcr9kXs0>CN2oZle9ohO@lbZ zK}5KVHwe?}EkGbFO00oQ7486Ht!SRVBcvSRGahBr>O$Zr*Cc$5gpXGcHm$+}>#I&E z?AMt7-WLV_9gXkud?o*a4H{G2`=YrI7x@g95C40=G{akc@KHJMM-}+KRUxSrYX}e< zmZjGa7H0UlmyZ#fTh!S5QLWzVV6Z_|U`ZT1JM9k15BDR0G_KLhF7^^*47!(Hua_YN zAAV*(vOKgCAIlFsM_yb!I_nVQ7M#xQn-Y49 z>8^cIUQcHbFZNW9#`q*SQAU~L(XGv zudW~xk`Pm*!iQz$(_eQ3AVEo1oUL^xxr?SUvPckUbT_(x-DvQ^<@>dR$}E}tzdYCH z06xb@NBCWP*{Ipy_&KcCU;a|7AJvbKj}96&xL&KhJUae`9XuOF)+db<9x?WdJBwtz zqurP8|Dd0f|L6?cqYsx|c0TG~u*=)lMX$|D`_<~Z!*;dW8Fkc+!%Cf<$$H2dA(ORu|w?saoCye_f!a4_l)M!%OXWRN~|LU(@@hJMTr zD!)~Zk4yOAs5iRkp1yB4**<&E+9FEiM7lf?j0YaO6Dv070iTMw2$EN9B<2erZpJ57 z^&s?c(Hp#B=hxk{-%Agu%{9{I61(nR{2qvhWJ{ahtR{;{+{-YHH=9wTUz56Ju$qF zu??(Wyv-i%#Nt}>6iBb1I*xO4nO|o-5-eT_S8|^vAwzK>`-3oH5(tRg84sp{kA14399EbVTrUWjO1vFjoD1nhDOeT9k zB(*qc4?Eq{n=p-BaZ;rpY{bVE=Qd7ZE-SVQQ#RxGf?9hrPGm4mWjqtWBR&_Z(=y!U z36OUWyipt@f)-J@Kyr})Pze#l$df(Q+7lBQsD5$Mnq+Hw73TvCKIbbvF}%H;g?>IS zWI!0`TX8!6DBPrQEg#h4GHNHv1sfb989en9i&r2$)^3(z`HwDdSS%u(6;8+XC1|8$ z3$n~ykWe_6pMfEH7fAG2Xu)|ER@66Cu2@b3;gy{Pbq6n!q&ag#--lTM$;c5moX_E} zd+w*2Fi%b7fRBG8`wfv6 zubKf9JYKOSOek07e4>&xTs$no2z5|(3@Wmwrq1P?_RX)ggG^oFA)a+pVSnJ{V}Uc* zD%qtj_p_C%mDABQlRfK66zr6>6ozgRhY28({h@@pJF;|PXL9`1{U=WP>7xEWMu&-HUZ8Ra2vVP zI8MRaqc`T@(BdSLZi4P#&IQ078G7h+z-LQOCaa2b9xe$ONp!~npsB?|1PTN3f}f0M zVXC0#m@tvYs_++J0Ccngb?A(hlShA7!j^mjAhkqe8-H$h3H}XSwmU-*(!<+u!R4`V z$YH`n&{u;B;?TYaZSTW7p_^IVj8|-tCgj**7GVK5IO-vf6>$*)9BfZGFdakVnR;A% z*`nY;aup@J+AiT?o7W-`5jP0Q7G{(S(>KC&ENKD*aJgwF1juC%&@#^MF-)Pu0Ynfb zHO~?Q1&mf~7Z6bjQh>5&GD3Vu;Q>jqs8@3YKtRu&N61PZGs9IF9)%TvuIx};BfuPV z65UG)1Hv^5PCQMsx?aoK(!h{u}cvyJfu|9^aVw3+{D{LKG+lg|(4 z|A!08C+u+bhfi?zwXbyb^{;aEhr4Y??ddk7{sdPKZD9TG@D|V@<61HM12#HTcOahT zemFJmU=pT*F_UZ}eK5#i*DDNhfOM*LoQCKfg3l;q}xWfkwghjb0FTBOMU+Fp$LH={jHxON#^;D= zkP6_b9tY!i!Y-du8PO6jp*mn07yTlR!UP~J93jt`0YGwjA&EvLQwj^NB&%#DM2B&Z zz;z!w_0kBsBXAUjz8|K^w!GBi!cjU|-zgkubCX1*41yrlhDd1YO5IeZQBalz!9z?> z#t1ur!-P6R*1Q?i%pJ-E=~N2bRaaTES`ZfGX%b>)(xu!UjE~}@bhecRPUJPYDV2Lp$1K;v2#MurV|E#OISPf zfo-2L8^4gzTA;W-wHpbnG;$-jRM(k&cvg8xPwk*giV>8t z!3v~GL0E--5GZR9qNn>QbV{oUm##w&24 z9pxcKb-1&NnGWl%P9A6eF){ymC-b3=O1am7&T+(H!7q3+Tj%zHq!_K+Q95GQNU~%k_P;qOCNPmanJ0^ z-~vN+HW-U`9I9y?Re_8u;Hn^Y_ZN3A<_|msX#w;lAHdo<8fukU^+Iu=N>-u0<;fUl z%KF?L-n^&9w9&D_dI;BP!TY|JE9jL=pb35$Tcn51G94Sy^)n*n?<2bY{y&x+o^6aT z#Q%-j%Y)7M|KMl*|1Ca0TKunqxL#*h3gGAoDS-M{rT`AVDg|(~+pyK2ZrBc=kODwB zdAKVD01a%$6|w-AdXqSBprB)~qq4{3dmgEJKtPVA1ql5?QcgwmMdll^x_f1&=@9u_r%(xo_)$Oa6Ed%`}-IY+m*9x|k+`(qdP6=%C}rSnvq2DPa-XYytnC zWbBjcoW<}&-4YM3SS0ME+qZZLKXkN%y=KX95G6(tc2^FnfgU_g!Uc#b(F0=+pVC5< zC{ohg9EMsTxVDChFe4HZ1od<|35I9eAC7e*3hDJjZkHxpBEN3|;vlm()#pFYhy8A~ z0*j!UOQFq=qaK!_}NZZ zZ#!nfK}BU+dBxhV{&^XN(}>UGe*!(*bOHrzEmjrj>T;TJ0=83fzs$yILSm#4TH#YS zoG*B=ay=F;2rMS6V=%>=KEI;Dw?H6MwfNAt>LC3V1w|A&S?QDoz zg`!k(0|Z&6X8Rg>qW*YZ?8Kqk^dsS9qEv{x>CI(;DMrlbQ6sGcWR?=!)OhT#UWaV>m`~E^n zMVrquQ)aNtGHXV+_Z;k8m) zhXSF*psr~Z6_Uyhaq})n=OV%co}S5_QP*1KuyS0fRT}W$-z$`br0Yr_NLI>u;WLhU zM!xCxu*z{RJee0+G41$h5z!;6b?*{1+fC7yGt6#NPHL4ckFSuC3KcUpfbQlgMU}n? z%!eTdi)7r~-Xd3Xv`CswSvb*()fkUb-A`5BOXmmf>)&o;*H_^6Yu(8{q9zNZm9z7ut z#02}%u0Rm8>)SY3hzMI^DuV#`c5usZ5>jRuTuO`uG-9Djop~(5-J3#a$^A|&p?$y!p98|;lxv6K=CSbaDKnnT91BV!dc`dZk4IkoNHx|G?K2)&*C9Z0P-sh;?Tj-;1VbGWw1Jd6<*-|JNuJt_OZeE@iz>7o06ZuR0L=mPCzLZc zPxSd6o(RyDa`2Qn;-LCA+aR=G?PBk`v`tO`eqe0Mqg5pjUz#ca9EUK>+yD)TDFg%@ zBGBWgC=oGo>A!UT`oDo2B^=brjx5+C>q7;GC}2h8qq$p z!t``}2GbUZApfD@o-~ITVqgZ=6h;tFK@6lHNx()bJZ*{cOwXA%<<-LRfDyv?VsklN zAa*XKDjdvJAY7$L??oE`IpS%gr3@wj7*~aO^B#Ab%IpFITY$1j;TUMusv?_Vt_N8%?Z}Wf&ByJYYOGIWX(VRE}Z2c6iDC*q0 zVnCY_ZkAos;ULfhP~b6`BCxY~3g|`cfUO{E2EHUR@+Z;Xq*S$i!Mm zW)UF`k5FxP=a7Ms9Fu}9LK)=MAjs#(i#fr%_p*Y^nJ(@fBZXl)odGdptQ+A*H*R4l zlfF`Y&g~FvmL!W;)#`G&tcV8=MnY8J!Kxei_^$$sdL!djVEgcmC1#VUQidv<|Io^! zm@`#N&>K{x0Czuej(B|M1vscgV&-R0SIYpS$R8PBNV{KAO3NyCrt%)-K)c|kmiYQ2 zR%x`d$-|LlM2YI!DDEaIxumO&F*UPUUbE?u>g17j71vOkHo9h2cGPa}-_SWLc8>KB zkGQ4(qkhTS&Na?w%{S2jxBpQG+{jDOF+m=vGmaonRr6w=E+ZA$c|cQUOc}Ot8SFXR zz1d&x$te3s-QDPtbnO)iELyKnbF!`JSb;07XQ!5HhcLevhp9m0EL=mPD*J<%owKXX zfW4Tcxb!~33RLxbUO1yxOo%p}!Dft)&n8`ee}sq=-| zuFIM~F}Xl>lmHiT=6@CBK%c1iM8Jub;+6v?=#a<8b!{Kx*+7j4hGO3XQv>$y!7O_X zbDZx3=CpIHVxyf&M#65OlA9{P6oKVAN%??9xyLNlDd~e9lQaR>Ql>{VKEZ*fftscJ z_*ogpY-fOqQthU>X%=sk08u(`ecA0J!#mw;lLlAG z;oSB+aXOjE2Rb+usu8RcEx>FDq$5-HtIRglAp)s@uPV+>c8SA<-Wmx1TBzmN_|*8p zisKBGa7q?>Omp~HqU?RS=mWc;=eB}6w#7GE0TdfZo9Twq>x$Fdx@fE?Gus>E!kzGV zMm1<{)6-ilbTfd&teQ;ooEJ@>+)jdpe~74MJf{l885Xq;+c%e#X&8%DsCQ>#H(a2> zbCN8_QQ7;_${D`d3Q;!@>K5F0NVsoT(I~aCa35&H9f7Hml#N3SYUYuXATz>F;w2u6Eh?e-h6`Hp06I<=NlhD}Os^YRC{Fww6K zuv?a#0$wWO$)Y`+>~B6!rLo$r=_6-)392B8789*R2U?7M9^7q)61U`$p`a z=47;f7m8DO7mBe^`u!*Rcrn{}&&gwUw?TGyS7ko6!Q;bs+L0BGi&L^|ydnqp?@5we z%jpazVlTCg<6w4_puCVS!cuR9X(@U|amm;nC+e*BM#oDYZ$|KTJTn$b6y*6py>GH1 zasDuw{ryw?_1Xjr;1r8w?8wH+%(7@Nt{*n``Eg5hy>XP?B#2ZK@@qwv-_C0E;mBQj zy^x7`lm*VYtCUUQ!7Xu<#_TULNDM%JuNca#o3nPfFmGVOuAvhoM89+?3oi6~0rKiA zrGK_p`x^xll-tkH_9dciJHMljd16kn3`F|^*Bl)VqBz7DW^(#PCD{sPHi|=@aWC^{ zamZiwu_XI!V|=0h|ETeD^Zftu(a-viZ}IuT>OY$J(ijiRexFqR|CEA`#uo}Y(A+&z zCietW*LXtN27;BwuCfhikWW0T)i4LwFvP>~27(IoW)K)~-y~O++1It&=)O$&y@r?? zROryyS?EA*F1!7WT87reu>I!hb~x&ustglczJ~wr$RJsE?sr{ zydVBs>j$iv9duOc`e^;Bi!QJ$#{&wZP z_UHWFU0fu3oh4EGrn{WI`}6%D3+J}(2jh?3wBKGTvLE`sMK)0IFmn(4)4pt7 zj{U*Hdwn~-dDpn(@Bdu|J?p z+S<1N-=D(Dm9E-bLJ66gR_%Mn7;wUD5|UmWJsD%b31Dg)Nb>358us=8grx7CR`*CJ zQX7J|_ptV~#^2J8^&j8o{gda9^{6xqJEt}O_*fY(-A?(qdvn*XJhj{7W9u;->8*!# z?Y3O0_|tKt@ZB7J8gyp&N5xsAHCfw_R-x;jRY`XK6_t8F=m$?1ABvC0 zkI5*S-c=Trvr?#Qo!0%>F09A4&xGq1day{=rLj@^i0h?XGH@!Dnxz@-o_5|SKUDRi zUbVDp^@DL;Dy@xDL-*HL+MRi|zAKeF*EMZy^lQ~gVOT3Yx4ciQ;qmZTsn5Spo!Ru+ z?hlvsS#ve8E}k4%QjHF^Ix1l$Wo_o`*4Xs##&)e+aLWFwUTi)M^wXk(bLrqzdZ+h; zVqxV}o0A57c4q6f&RuWAl$4?MY6G@|-j}^JaXA|buK&`mbq-TF?&xmM9rXH@-r%zG zY(MH@`S|3x*coV{r_INO8%I-G&(reV{HWA0yS+j)3@!(5@4oZNY0Xyp!`Kat_FXvp zV9mYOL*xx^%a^?m^H1lxJwN$S&^x6^<;V4PSi1JBg?7}a-q%iUf{&f@X;}T_G+d{8 zT)FI?=>7GT7x~X8=acjBv2j``opnnW_wJEvt}NxK*=TpGt)qG8>sQ|QMzg%V>*4Id zgCREMr%sL+RA{GU?>^mY@1`{I{rtawp1KaTDT-E*ya zS?ZMZ<@v=`q&+(GnOB~eCq}(*`lZ6j`f{vPe@vaBes|{jM|$mh^P=9onMTjn^>}hK z{rKEo+og&>oS0|&z?wHk4IZ;da}{`X7AD4mr*J zlf5Ao7>7Dt)Qisr6i9CcP<8P68QiC*+<0 zu8By-z!4+`>-~TbQn8;Mkpe{Y*KFQ95|MX^4=tq0B@75s&e`(OqU?hvC`}NFD6Xo#1J~ zKHDkJkl36aqhzxGj~5D^CcqRz*MY{3{lZfBJv2Gj#?6MKjh>UBhRuMl+8duVg`7m?CurEw4(71 zeOH0YT1=nB8c`fSzo9b-=AgqIH5*VcCL0!EOK#?2@Cczy%`5?%vi3o61;z0tr#J_ zn0St`%wj)>-pa#s57F7wQ_S8FepdNl>h3&*a_MvgK$%Tj0|z=YfRq>#+(e!<4GNzg zvJqv>Q!#`OJX3GIW7)% zm_yl>50@dkD~ZTZn5e^*=W=8}xp=G*bcukllE7~Y;_;`;+583T8mWr*YKpJ~&M><9 z;eox4?1y?Q4iV>*Jq9|$bs>*=N~s{c+q2V7rz{2Z>_|ki6HNkc3o;(zNBod+utVDq zemQr1ygAUjmP#*0a5BvfFh4K@n$^r7QNR)1F~Sy!{n>!LLp>R{*TxUHt(>RBxTOil zGr`|f4wj4}8-ks1cEU}dkRvd_gr`GlC`=~wU6s^GyGBjm78D2zBj1liP<6`B}RaGY~uqCj5X3cGuVVMlMOCJ$ggtiZ!O9Ak1VM6EFqbWTA z8dEcYbx_kzcz78@(xTXSJHgjG;VMtw9lwQrWRI63#^|h{{!sm9kbz_!| zvRb-Rdo=^(-}YVCtk!z4$?I@#TdIa?QILweX6YJ4WJ@{FEO_&P9%#)w)wqSNWLavf ztD22=-Gs`Z_O90KnTC~9&8A+zE}PA2PK658W~-;v&4$^7V!c+58r^i2-JYpm*R`(NzV5bLmZ9RX%BH2)HM3!q^Uyl9s2VpQ z(-yscxv$5DcwJsR@=}` z{9xP~Fcz(QmlJhbM&}v|!9%sIHMFW>Detx^qNXVVQ=(sYjRtlZ$Y5QUte)As?ip&e z)hZ*M70c+}n7UzoQR^*>h;?llIcTA$QNvILPzoNy=hC%hBF&)dJ)_&bZuiVq^SuIR zI8X)psKKjcB5tcmLj?l0x_4M9(tv26Q~NaozV9MEiBcMpzygZty>u~X4+z*(lQF7I zqgpqsMpHNNX$x!Vo0joj(YmIE1x#+XuR)vFG-O;8&@29!TCh2qNY$(;TKUGrZi~V& z^_D4?36V^%33Ah-7p}qxQiMFk10%$y_fU#m2UY<@2DC%McH?6-b>|bnWH`lZQ!=e{ zXSy7s=VylDlhxzalzS04Un78LcOck|)pxG_^xyOnmPHQY{lR8)5u#Z~t~0^M{|93P zx%2Mz=EV|vfOywJc{Gqs2p@j-uJIqEX zrGXo`!>}NS166CAOIvs`fen|kmMZ!~mA>I9x0ph`G!MU$b6LYz8SdQ-SYZEuR#DE1P`OTjZ~&^{aj z*T^y(j7qed(qv^cykiU$@`GTxAoIisszdi}Va8>ut|{#V`W_Ec)u8yvCW>UXaT-x8 zxtQ7xSwv*SJyt<+Gg2Xs5%&svOplXRD5@AL_F}Ba0nFb+D9sFkZv#IGYi?rW3@O+a z>RPcrTpGd@lfp#YT6DWXJ{g-IS2C|YnUTexExf6ebmPTRE=f*DWWK|)Xre;jY$ffP zCjbv+_z`xUaRJjSo5=RBJWLk!@?ZH!_#n++q>r2qvmo*5%x;N1PdH9HmiaYI%y95O z!{uy&%~PaTW+6kP^e|(6VKbFx>843N&MWUE1UyHP3#bFMIm+tu?qeMPxeHA`1uVnb z>d$e<4o4~;RKr1@{^ZZ8;3PaK;tbX(VQgB)-jTKw-vjc!&vRL6i?Ws2kP%1u!rM7v zv`Hn6i$P=wG=*q2^OsDI12%97yClsD_x>Oqb0BSi>OpEi2T9G?F$~h#X(*Fwk`{>G zW)mc0*)?3=bD{mANl}PSY#ZlS{f}%*e6?B)J@$foDmpc79t?*!8gtr zopd7`o#-qBIyT=e=iG<)DslqYgCQKhQ-49}nYMdE+B7#5n)a&`b zz0g&LY``8Z=MLLa(DW%HFb{%P3-=8MgBW3oNdK_ zoShf{mj8ao&tFXb(*-|(Aj_{OgM33Gh@Z>@@l$Ca_M<7k9ZdNRIUu0Oz6=ml!!F8Y zfIkUM>a#%3L5%c&9}bcCK{n|R_+y3tJ^n$8G~!HAa~5mNn3u${O6M9v&xc8sOdJ}Z zW&TKFc7+o_hBw`2N)K1$q7dKtnfr=7#SmLWGAM_`I9pl9=ZY*#??|q|!=HsjN1{p) ze>ixbs^*dE6$$1D86ymntbf}BdLey-^m9OrdJsT?i=k_6>W*#aNxu78{kMAfp#Fis z0{-RjuLb`)=U-F)74fgO`iE?&#CfxrExX7U*wu;B9j2nCLy|+;0e~RuVvKz>zJef& zo>Ry==G99yB%%iv4)=k)XwYE@eo2qMZ6_>XjM$+-hBq^n7|R_2p9Z$`uqI~!N<|QP z1CQ?3XyS)%Cb6ghNM{cwPBM{jW7i@ngT0adEg2>WNvY=3u&=aiNFX7Ic7(SOc^>j= zUoyUjkBZ2F$IyPB07XnKi4o=%n8fWeqb~s`q^q28#PUdDk$z#EnUVcn(w!m%T+dx^ zI$!3PKZmE1_AhIlf7y}qpXRsz_s^g6lPsEF*TyUU|Aq5y{trz8fAfF8;pZ>N|G`nI zIj?YjZ$N(kN#OUN!hPQlmGE|?gg1b`Ly>)u?Mo`5J_%<|J3IfQb}|mW4W0 zxY>#XJ#oqrb;9w-jw_*kS!*};?P;9iWg|cVYhyW^JfZCn-HJ(y7cm2eh~`OPRixpK z0fbpkEFpyBRKe)_#Axkq4ta1?0cm&c_Heoxt;1kofD<8bX%0df^z#yBGq~Oh5CF9AS z#0%tiD-;RccrO4ll}L2rv^sX_6$R6Vxw+@;S{-ZeSZOYFO|koSiqjL&HiFe9*E)sx zH+y@k(;nf%tvdlVmZ2u-hsV1|v>^3QMA;eYwB0!(Yl|I3`G0^npQH1(^q5W=xfHQx zMjWytj0(F_?UDS3p7Nh1+$teerj)}u{(>EU@oxo#Z!!hwi=+Uj$^DcrllG6MX5?0t ztzs2|!{r9$ABqGu7A_>>`>hJI2uw+(8E`wSIE{StjuZM8X_?aJ^DHo+g#L`^pAw4-2y4w8$A4FXKZsU5}%qhtzkE-rFn)2V}AU@~HcQiPL9 zBOWa$0P}d!XT~vO3R*R@(&LSg0u~dPiz3t3i~*Tasggw~kaYA!9lJ2rscF>%HcZ*s z74m$y!xHn9s8I}UaseT9q(vDF5`N*-nfTxFvzTkaeT$P@dCgIwfcXcOY$6-5<6 z_p{M}=>{oQXjhY^bgayd5-Is#ri**DXV`2m*}DiL9{7tzCP5zWH5oQ2tHC8BG8m?k z8}gGKH=Ku#$x0k^lS|d}(#@DxTX?^$y^yjuh-+MKGG)UuoelAk+|{oByu|Aqx3l$`uE|w=B?~9oj_+g7{kO2wlRWoEIp9nUA>>UWCx}0r#E*w+>z)Cvo0; zoI$BX7f);v_P2|e8h@QITsX|(ZazYC54+>Z6nMM{gqD&VB#Wq@6=7y{s2UCKkIOk$ zcaS=cHxo(hQ7@YI$*1LJPZ>3mP#(7eMKReSov8m)IFdlpDX3KTW`Se+!F3lq7B+96 zmzMA;(tHoBBb6wl{|QpT+{O8s=_5k8sz?g$qR0ze9g!#tCY}b@-4=YtzQ@T}X_`sf zx?3-~wgbkdC&3Dj@r1j;ud(awM8YWOiX225(GM<@rEsGWP=GJ>6%qeMMhgx{UPU)u2ig92*LAOih!J890F&PEv^ycgg^O(z~8&(83 zOaCE1$YliIxb7TBz(;P9EPI37AiTr9kcd=5rW)8}l2Jak$F6h_W!^Fiu#GfA6(L<* z@t9?2j=#xFO@cU3{c(~Dz#|b{f)iuVBWtVNIYv2cT=#T^3MuWV5Myo=dI9CLS23d| z3OOmG_>KzX9nCU5XHsAt8-wR>+~M(Mh>BvEOukqN^PZ<<`<~5I6KA@X8nkWVq=;fL z0Wux?-}bJ(w~ge;-{12oCR!jXAtWVIZ{>CoJ+s2vvS7*CJzNgKm>kIiQyhXrTGoF0 z>w0xp_w)?uB=+3`93UG@>Z$JOM|C}a#io$}6dQxSxkY$y<4~dANa4_wQNHDwwwO8N zM<`$T!OHI02+*aa(77wqgBi9q?h;Od&j5~TKMk{gz!1$D_r^*`oo!Cal;~U5^rTSw z)Ts>rQ~_z|bf7MTIV3RZ4PD2S8*q@OvQS4FNvnjTEUueVkprRwk~ z?sO7A0+>6H5;m;Kn{o8j;8l$RJLG$`vmi1)s~}#537YvS)f!+S-qn$Cc=Cy7gwmxF zG0Wd*L#pPe`N^zdScBrJ_{?w{3Kd2QJwR^=u_5^NtYl6SueGi%@!&%5H4I21Fd%MF zmDE81r438h*gxf}43oo53HjIn_*jd<99!I)bwcC_E=J-jPPDsZAa;4M6p&#Rl(p(LDvmJ;v2nb8g(b-g0Y&eI~ z#B|`2`E!{XDI8-qj`hO-A4C?se(spNv{xzQ&DdYupJ`K_@ta6e9 z+yhtT@X`0(m)P=aq7~yOh?&^6ytuiOzP0L2)U9StZ9UytRZGL^sMmed)%=pI@>OrN z>S7Bi*cL{sc+ESM0Rk2R20fBH7dfaiuc47Eof*|{{6ZvY>_DUoGDG3a_2IoCwgtk0 z!h)KfB@jdpWQT!imVU{$U-$)@HRP|{X`OMO;^$ykm;KvFnPc$ajYish!g&fD9j;#$ zwOqf9rit8t|5A!&AV7;VUW)gSoNxF6#DFB_2rkOVek&nJ)%cuWxKm7rC^3Je(hMO8dX=;7l%MmBfYV3p%!|1lsq~cNL+-v0FL=q42-T z#rLxuuL>|$p_RfC^51wH;O$~$`g^z`4^Q{%1XoD z(Ah$T*O-F}!8(Ur8)V}(mJ`w%_`sLDh#y_;`8FUL?bbY|z5xnb^Jg7TkLv zM5yg-b94On66X_*N&vec0koL@vBj_ZJI9}PQ(fAzZuv*I{VtZ4wRcyB>0KzKVSEPi z)0j2Ri7VnlgrySbv2wVmtYbp}W(Wn$>_%!uhBWhU@<7lWQl&cd@xWY5OfhZOv#ctH zsZpFOqn#EL=WiB&0X4(=fW_Rh9Sn6)JM0SUMg;+k!Xs6@nX@g!kl&XjU`Fny5tv+MOe#sDX-HeXO3Q}O1=lxWS; zIvT-qmE#J84tDr>TfkjcRrQt|3S{QP(j30uY$^|B<-zx(I~90h1u_PCba4OFSQ@1N zqV&@ZQ46^OuJ>!!H7E)kWFebTIWM^c<|PQBMhtYzy=kVxa2hPf4R-~)DYgqZCar|F&AyZ&d`n7&RpJ22gc*9%MPP*sDX~dB9VEWV!3@`*Db_c2^%A;XcYEV zGprG--vJYKSf_KZ2lRKY&_UvNFdZ+*(8JhBIsZO(Qd|YU`U{oy0#w;2?I9@Uj(tBt zg>XRFFyoq3=7N5k%>^XN^{RZU7@W44mvAzN6d%q-^=idZ%?08rxt(hLOi{Mjt}riV zL>yudxt->KQW~fEHO^(izfJ$7C~WjnPgH*@MiYWlW4VTlW6{iGoxu^#7>gVU%4}Gg z`k4XHrg)7o9d({hN1qT*Q0=MHiBb+boS;nZ6c(}Qlo21-!XV`=REbn6G~7&rKqe6K zMMA|V*~~W7&BzFJ$VIJA6l29of>ak7A>WiDOcEyCbTAa(6$@iYa1C;g`J?+5LhuVSK=`-YknIl<`y-sTVaOpbzlI^T_c%-e(93G5C(Nu$Vy z3gu|q@at;Z?96KWGgABqQDhtNKk<^wRE3?OZMe6knUkV!O;I&ju||xmmMwkGKikPe zRq(l-eYAewj5iysSAtHihaw1Un%bTv*sKxyNWCWG{h`SA%~yB&y+Locw`cx;zjx3( z>>YLfVhBV1^d$Lj{@4E`33m2!Er_VI^oO)>-rMgTCFi$yy}n(FrnZ-a#Pr5OWAO?*x|o z9%0G1n*G0r%l*ImU*`Wk_!9r`VJnB+UztN5EYAipO%7T-z2?vDGw6AGHPFow!YrXl z7_t0fR0tk^3q@KAvjv+f>G>9d2#AmyvJaLsM29Akl9Q5cOrf>LpkWE?1CK`NWf8GU z=x{>G%nW8+yq{%Y+}(1~J`^kkC^iz9qlORGOA9)QVkn2~2B`Ps%XoKp=Aqz&Qw^nZ zNlxzfcFasIz=8+()s(qegU}~ao|+_@YDdJ7A!XT%S-w2?AzRw8`QHFRtRiqihFgo! zX|&j!EpU?(qRos5U)EzmOx28gUoo)W(!E>2;D_hR&zci43CehlVS@FbwM zgmJ0ZkY{8_ta3e}lYK3qD4;%nC})t`FxDmE-%L{E8ssC+h9AMjq~z40h^WqasqnOJ zJxfWR(knh}aZP^jB~;(oXpbji#pM@OHZdhAZA?E7tA3w;=)T(E@LhrsLxVxNm`@jT zRowxmpqIFq--qI}?!u^ni>Wy;n5CVi4u6FH!g&Yj#@oCA49vUpd(uL)^y2c>E7%e5 zOS7e^9k^;9$&3yA94CU|;P21h+@&}99C+*H9{w53akSUaw0t@SAo)ppNo!5uVydJ@ zx`|MjWbNbK`G+k!#qzG4O*)V-ZWAlxDnor%)B}K>sr46y`-5zD^ylJ$T$zhehvEur zNgB965jh4oKWp<~RfFY#+2DYBB#35wTtC|#I*2`M)5N`iW=GO}#Xf6$hVYjH4GS9%s<5g@>rm z`o*`E@Bq5dlZu(3J#7{Z6fU0Dxs*t;k=M*9sxW$^riV)UA#U8tvF1$k$VlcAqie;N z%La||mu=!5*M)>fU?l#frGOtU9m|qn+fm8b@@O&ns9ac>C`KlEWWODAOO?7Jw`ge{ z3N^*c&t^%Xqn3khbrE!`c!6!NZ}7|R-rzso5zx&gTnD#; zcHo?9?jiY1Xaxtv$1a(t10V?H;-$@KWQs5;{oXPBDrLV6lw-1w{fN3@wAL(@THR9!7iXXr@Qr4S#qIpMf@Aj$oi0 z8g{DOQP{7afHX98fg;43<*tyHEhpuC(yE(IlJS>rtAR|jV&=UfwS#<$Y&F;92uTmO zF%}6!(g}^<`%?5!YJ-0Am`a`!DVeaKFM3P3>aV3l-RNr?b zJy4fs2Cy81-6~x-KpU0{zJ;dkK7j4s5*dXp?qzdh5vwRdp%k|g^dvqDHXesEqa@29 zt4T)y!K3g33(NL&NX2W}{7!vQwq5^5a|JBeA>{J=$GkH!ng(|@48KdYxoV>ix>q+R zw^GJsS04_A93K@&))YfU&^ifVHz6D*MW;{_mrgo?JF=zc0;&`PAhk?GnM}@dVgGOEwJ#<$$#~p&^e7s17#{u3$HN_9lY`Bz;?Z zUG-mCM-=o{5geaf1vSc!b$8=jEm$wTSj=p66eCwjq#VU-u{a?N3G3VylpTrs$aoYs zVYnzgojzh~}?ZaPQ| z2==X?4(7y=aQ`Cal}p*-TsI32Wz{&mv!O=c^M~B}B(ZVzAyd(F0;v_sJv0oxO@i>A zmwc`+?|3lT2A@V>E#IKjH02MHh#oUBp(DsnwvsRd;0hbMR%dF2Y=B3jDs4kxznmr4 z#i3BlH%32kw2jnJ^i&(UcXh~B4##uoalm^r8QhA!r_r_LEJ8S|C|=<<%~2eTC==-V zI6rZfEtvw>U>ujoV^keN5l0hJtt)fxWTS}~hLC9(`b7?Pz@97T+V0~4j0;Y*>4(+x zy-V)Lqv32>z2psCw#;X#NS2z)x>}T|tbL_JT;&DU<^nJk>JV%dF4)LTtn`hrb^h>K zW{w=vaxsUnZ$3iv59}F63(9^MTG~Ua6%;p>0+NB!)o_+oAn8fiK>5J*jGSpcbrW#t z`Qn}68(oyRs_Y@}4bATovbS`1di{Q{zZ+;T7BR%hB`_CWlme;hNg*Xp$V={%-41&W z(8O#1HvbXZNlwy+S&gCL%aeI`zt=xWe?c#-VVw_n(ex51Qm19zfYWriEUhPi(L^TP zK!n7)DL`Hxh8{(E8Ml^Ba17X-`zo^HfmC>c4#soD6#7`Co7ZQrw@y4rhm0goL`>w0 zKRg_YGS$}5``g!*izZ49F$-5jmtHxmqcUnX;-e5M6_>OP2{RZ%Xt)7Ry1Ml#6K?vMP2I+||ZU6S!#6fBYSMPock zAT+28$OyNy9Pe_&D)48CqB=>eOY0*4RG2>-Cbjv>XlGj~{MXW^zn&yZPaYd8{lz&+ zR~gCQKu6MH9b4(91YQ<2GNP^)#*mvLC&5{gU=CP^lcYHm=kD&+CCG}fHQ@)85-uCJ5v_|42`n*miAkHFt;7umMWBj41>|w!ddYWRrh{VArp;z;v`P}!? zGYAkw4^sS`Fv5Kx5zh?yPY@F=rI3GRc@WUO(!&dOmSM!nizsqg9qqlc<21iGO z(O~=P@1M_i|Ni;xdy1QdeYF^bb(Gfc`f+>X>-Dh=|959+zaIa! zw~qh%7SHc2{>%Ei;E$K*1Sr=W_;s{A@ay2q0>2KwB=GB~mFXU=%ybWz27ZD5UW5HG zuN}4ogPA`!Os5wGcBPX9Be?XK%z-vs$}hFQWEYdGD-|YBI$PE5#pRs?RG_3Tt9=AE zN%SH@X}19GO1*(0Tp049OjMKsN)R%32=*0Qr+h@lbK8QdL5Z}-wv-b|ti;-EP>>wr zDTJ8vUZJ^<=7B32Q81RxbDpy&0sa*QeRGMSO2EIqISC>dXv!B1@L;}X&Q6{e@;E?bB5VRo=UBoZW;5sj>|&To4|WdxcKoTbNi`Ll&A>`R#ULj6 zb23w4&Ay>YvPmK0!KSNXmzYxq)$PH@lUPG1EBbmM=G`3^4;Lam zVp1Jvv$k$uYV+p$f*if*coxV19Q=E_VnyI`JOuywVVj2?Td*+#dV@0=g-~*L-R&aDPyUk(F;hDLE+=5@K zRO~R>8Y2d5ycedAQZ75p6-*FJhE1+UK#|1a#LOv03h<$AHW5U)mY=~<2?{Cg2`p9$ zRXfb|luuxWHETi{`Do>Y66)ZZd!NnhL^F>}$PXziNU7$|C}|iiJJWJ)+G3zVbQ*@v zlm-OSAf?1+dON4jTXXZmkQEMu&0s4(cUaFQ#E^8;Y}PJtU%VT-xYcNb;o5H{4hNj5 z^10#UX4%G=V;p>#S6YROvxEulgh2S{&JJ0BFb>4ePoyA=A?fboF6K)>z8}8D8ptgk zFT_kCWQa_q-C6;=M)+YrpN+zPbOlCzPMukOE(vya7WMeA9h{Yf{CKv_Of2}Ci`qCq zI)n+bQ5zC%qqCJuymEIU$1u?VVU6*O;83q_x331TxmqVRfP*5gEW|??!!Ex(chvyX zZQ!02N8PA!!-?H0iRUQuM_|#badOL{c_FtEzp<2TTY`SBg3mehqKQopfK9hVhF}Yr z3NnL+99jciSU^n&DenV&3x~Ei7XTF^bj?4L(#Ht$U97OFm^lq0Cw#&w^DzHHUHoU` zVv0e+fnS!8i`ghf<&%dW#dgA}W8#{`=(~xN>NK=G${d9^($qj2%){T6t5j=}MT0nFZ( zScxeB5mVAW|7PSe!p*S7KYL_j>=zFY#b*x0aWEm=D}4#y1=vzUq+|Cay<;Ghgu1cw znr8zhiviT#!I4d7y{{Mj1!s7=@&*wY<``%XKg3FjAW$AN<=K-T$h^^#q z=B*NvV7`Zk2qmygX5bQE-O=y*$?KT6E&_-g62wO2YfFXxHW=-`n*O*p+N~dY+&24q zeJrW}x-fLx`d{DV`JLJS^xp$?)HXZd@p3!h;g{I~kG{kXc-+dz4_D^nM@#L1 z!)jJD1DdyvTFihzw0%}Rb6_hVe1^GnR67NgO#z&>nVyt5mCanr1K-1$T3ZiY$OX=D z)|d|4wJ8%BD@-BE>r1)lBocxEBCUmf)BvieRVFqKl>RPAma4xF|H-BBU<9O%iq!yD zPGJkm7da6JqyP`A*vbSH?=+VrGo4?Cb|%a%;oLTF_Mb9Lvt;Ge!NC&DkI~_23>4LG z2UZMGn@&hejcPq9W-qh7*=NrZX2~DP;Y>_wn9tGwydU00Sj8zK>tgU^j&e_?I5b=V&{(|wDey5a^T_7GR z4#0ey)0TWf0&tAPY!V@+ehY}PjZSco%Bnw~oDUu25hajJPB@G~%&^NK^HSlg=`Azt z?#b*-TmP6tH3_UJ-IRZrzouO{%Uz}|b;=>6s;)KHH{LF6ycUo|Y#|$u>m=3q+St1= zRP8Hf$?^@h=#_;D14|yxl2{0n@Z5&^wH`t13i0)Ru`DMZ#xU9=6aZYa4*Jz(m$eT1 z|KV{<{Pp@+68~Y;zIy%V{#yV0CeQCz|7)rK+}~NQ?;U-azIXg3`kwUPz%-9mW}3&# z5r0gR;}-4icq1r_>M3(@Tg6cm9KtoIbVX$Zf)~2PvUEPnb4uQvuAXSMir^qGGG$dzccdr(pB{FE_fBTXfu0==jTg;JzBw0~n>JWDbDP-4QU zt;i85)YUO)I>&9g5Vi;kd8D!2cvM|%ZgU#GQrNLRjI+noyThA+jS~gtI$Px75;Uf; zcNFdOQz0fLsJUxTa(0<|pf-#GA1gpCSZ6A3jmrNRNSdvvAW%>!ZbthKV8D~})5_)$ z;4XldK}8|Jf3*8kRS}lK8A;eyn?SFGRfI8xcL>>NEOq)ykRuRRPmV$PIBruVO!K1Y~g9^an$dl;Kbvv$y-eRuilD!se@>&@i_6~HLCh*bi3DZ=Z) z`v{Gp-P`ot&CfS)ez~#jT?gM+;nDR%K`0=>q7*A6b3+M#?a@@EzONXE88{HOWUn^7 z3HaW%w{2O=4y6>b3mr_Bc7_OjV=^MpZl0<)cmDQ?7-gu)C#T254{RPC>8&B5L&y<* z2sPvD2y9jjj>o{9uD=ImyxJ||2)HufZgO| z1L|_|RO*^|j6MKd7$kYlZ4-OZq#8Lx^3P!o#pau6K%oHBUt4r$gkS*T7iRMoyuLU- z0-%Zy4+_BkQzOF!co%&HAWN%_^^~w;csX%^nfg`x430`X?BQ?&mH@+)GI`m1DEs6f zA;a%+pRjEB%?6}ns6Bk#R-G7I=-r&xte5SUMoJDXT^x^Ocs`(2FlHv?EKLjvVqOG| zi9fpVjCkE84y%z+Qx>L}B%S{gZ@6YGyqYj7qXU$qeB=!bevdb*ClP>jSbtG3K*BIA z_I@EWd}NDd>F3rKgpXI76d;WdpLB2oZ4!HbB~izwnHq_{ks0t#d0Py3q|#7o2j_G} zB%2bG4HTO;*OneKMY#8jjLQj}nI%bCwrC~nMZYZaMW_Ck1aJ_pTc6;?bWESKCU_F)i6btB%T$`KPy4 z)3DlyQ(KM1A5IIuCP(f-&M5uVINP;@JFf-NE5-BQ)KO;%LYo~2S}Ev^ClP5i{Bm=4 zhBlv_$7MzVO($Mtsp>2VfLA<;$(HY;<4r-&2~?O!r`g=-q`&~kPx4daSYT$3mW(LT zpD*5c2|Nt3VY~}2@w&CnSnVkaYRUQms=91eq|(|FXJoDHD@TUg$nQYzAt(g##KkZy z18}rp6E*Ecs$4j4Cl7f7KKT{gY}Uo*=12pX`LfT-j<&dWZIv!MEBoMTkQgm~IH*># zsy8lD)}nU!F*1YlM=D^DR7e;BnkFg`Gm+$_CavQD-{7O?Q@zQKoCT1=Dl{({$7}O-E>! zMsP^b1Q=sHYU>F#<Gx{TCvsY9yLXNirGmrL0JUKzLJtc8H^On><>r`-aad?K z!yh^O%T+A>>^=h;0oVv7m8rKSp3u7o@0I%PuEKJbL|8(#+62(>gn7ZDrbp(p=8&vX z7zrg<0*6IRRbTPLy?qf|`!G1->pA+qRdj?5;;VJ=A4~oJyZd$ghyC5P|NomjzbpTL zi^sp_@K4%3^x?UcBbvxD6kmIP<*}KjbR};Nw}7FZ!;V4NzMskulWP9QZ1FVy^Jp$9 zS3~*xUq0a9vwSq~*)sQd8Q+wjDEW4<)88|L_?s>e!y_~|E?PBJ#30BY;CaCEkzSE! z&eSFt>0f&wpZkywLr;dHD9TO^c0)r-c62oz_`A6ZDh3^=Itpml00#|M{lGjwGpR62 z2cb#m5#a3wxePt^Mv&;jFJ_=#RmG=#jG@|jCoImGe|JIV$~q4UdS~w zdFeib@7MP;4-FG2pNc9+T~pUC&E}p;6kMO6y4T}-=|dQbQX*zu{xzy9BeU$?>~T_> z4KUPo_EIcjj0x?-Sy@@EWLwV_u0yaZ(&FC+;UMNJ>2LhluLp$K9e+KU&&ttaD9Vi3 zovrMmN%fFeJpVumU=Ae&+yY@FCG5UYDM zH8F5$8p(P_6<4EF_JB&=_oS(S^JxZI{&FkhEJY^WjC~N9^Z`%$>!KPio9qG1nJ-l7CjE>hVs?55y`8P-#}9fq;K+KYzD$z~bD9VMB}!x$ zh(y*w5iw0Jeo9^H_mX)u&37a7xXbf+PAF+m7|PZQ)AJgkXqIp%%h*Y59_ucTUtfJG`W=&qdU$>Z=kjd)FO+k zsF@~QqWIFLAT620c&$L2R=i@Nz~~${){$ZA-*Ks#rG;c_bQ=nGXu3@mJDTPp4wGd= z+m~TvMJJ#U=7-6C$4Ed?oSz!41}q9qD+Wf<^uh6jK&!2;nhhBJ@WwPTCjT90lC|fF z)rdCa1ZkoTNkKJI4Ot$VRAZV)(~QQ0aBc2HLj-Pg0vlsXnc8<8ei{!htr2U8R@B6n zg)7!*HUyMunr#tfHF^y}K$>226i|&?LlB0h))IwLBiG<7(Bzgl3u+`AjMD*e zufgi8>9w1Eo3?d-$B4)~F=ayRUSic-CWZAuk%+1#{Rr22>&&nakFoU3^hr^PYbs8h z?`y_GPSW_gVJPO($pMunCiM43>W>Jh(b1z=-;av^eJe^+tJjc5ZB$7>SfVOd07g|b z9MwJw@%^Zv?@>0b?&dR%jnhPL7wN@xFHH|cO)~F($f^$xRi%mS9+HhIW16gKb+?!z zN|MwgO`ptvjQr3z;C-YV;RhaNkUtUr&`9oPq`x6kKrE!C{Ls98fPF-mgx7~@6_)*) zX7dlrwi(QLOegA#QuKy4!u7?{LkP1RQ-=DY4c*Q2DVVPC{~s5{X!(8BM}?;!Rf_sn z!lza&=0dzpmcE5h8^e^m828xxq88MTYD!)QgAJ;MNixOxY4?tN8$SWO-wM6#VlT0+ zt$W$^dbxvut}pC|Rw1_6bw7J~soIsKw`{+Xr>2epKJ;Tm6PwVQ^vW>rt8NM-?uQ2CzARKhR%S z_vx%)8eZqFuAlX@e%8u3F}pY^kT g*3bG`KkH}xte^F>e%8 -The database password can be changed by the Menu item File->Change DataBase password +The database password can be changed by the Menu item File->Change DataBase password

The different cryptographic parts are divided over 5 Tabs: Keys, Requests, Certificates, Templates and Revocation lists. @@ -344,7 +344,11 @@ exporting the certificate to a request. This is however only possible if you own the private key of the certificate. Multiple items may be selected to delete them all at once. +Searching Items +The displayed list of items can be reduced by the search-input at the +bottom right. It affects all tabs. It does not only search inside the displayed columns but the whole content of the items. It searches the internal name, +issuer, subject, extensions, PKCS#10 attributes and token provider. The Certificate Input Dialog

Once again: This software comes with no warranty at all! If XCA transforms your security token into a fridge, don't blame me. @@ -558,17 +562,25 @@ Otherwise fix the opensc setup. I had a functional setup with a "Reiner SCT" and a DELL keyboard with integrated card reader and TCOS Netkey E4 cards. I also used Aladdin Etoken very successfully (Thanks for support!). The Aladdin PKCS#11 library supports all needed features very well. +The ECC token support was tested with the www.cardcontact.de ECC tokens. +The OpenDNSSEC SoftHSMv2 was used as PKCS#11 reference implementation +to test all the token algorithms and certificate and key download functionality +to the token.

Before the keys of a token can be used, they must be imported into XCA. This means that XCA reads the token and shows the keys and certificates on the token. They can then be imported partially or completely -via the Multi-import dialog. +via the Multi-import dialog to be used by XCA. It is not unusal that a token contains more than one key or certificate. It is of course possible to create your own keys on the token. When selecting a token-key for signing, XCA verifies that the corresponding token is available. +If the Card reader supports a secure PIN input by a builtin keyboard, +it will be used by XCA and it will not ask for the PIN but waits for the Pin-pad +input. + The following actions with smartcards are supported: @@ -588,7 +600,7 @@ The following actions with smartcards are supported: Existing, non-deletable, built-in certificates of Smart-cards may be ignored. A new CA certificate can be created and self-signed by the Smart-card key. -It can then be used to issue end-entity certificates, containing other RSA, DSA or EC keys or sign imported certificate requests. +It can then be used to issue end-entity certificates, containing other RSA, DSA or EC keys, sign imported certificate requests or generate CRLs Key Management on the Token @@ -687,6 +699,10 @@ The following providers were used for testing: token and delete them from the token. Linux only: OpenCryptoki (IBM): may be used as a pure software token, but also supports TPMs and other IBM crypto processors + www.cardcontact.de OpenSC branch supports RSA and EC Keys. + Downloading keys to the token is not supported. + OpenDNSSEC SoftHSMv2 supports all mechanisms in software. + A great reference to test the PKCS#11 library interface. Tested compatibility with other applications @@ -771,7 +787,7 @@ The pkcs11-id can be obtained with the command: For creating certificates, keys are needed. All keys are stored encrypted in the database using the 3DES algorithm. -The password can be changed for each certificate. The password type means: +The password can be changed for each key. The password type means: common: The database password provided during database load private: The key has its own password, which is not stored by XCA. This can be set and reset via the context menu of the key @@ -780,9 +796,10 @@ The password can be changed for each certificate. The password type means:

-All keys carry a use counter which counts the times it is used. For new +All keys carry a use counter which counts the times it is used. When creating new requests or certificates the list of available keys is reduced to -the keys with a use counter of 0. +the keys with a use counter of 0. This can be overridden by the checkbox +next to the key list.

When importing an EC key with explicit curve parameters, the corresponding curve OID is searched and set if found. @@ -799,6 +816,9 @@ For EC keys, a list of curves is shown. It contains all X9.62 curves and many ot EC Brainpool curves are also supported when linking with OpenSSL 1.0.2, which is currently only available as BETA. +Alternatively, the "-brainpool" denoted binary distributions for Windows and MacOSX +may be used or the "misc/openssl-1.0.1-brainpool.patch" in the XCA sources. +

Even if the drop-down list only shows the most usual key sizes, any other value may be set here by editing this box. @@ -808,13 +828,15 @@ After the key generation is done the key will be stored in the database.

-When checking the Remember as default box, the settings (Key-type, key-size or EC curve) -will be remembered and preset for the next key generation dialog. This option is not available +When checking the Remember as default box, the settings +(Key-type, key-size or EC curve) will be remembered and preset for the +next key generation dialog. This option is not available when generating token keys.

-For every connected token providing the Key-generate facility an entry in the drop-down menu of the keytypes will be shown. +For every connected token providing the Key-generate facility an entry in the +drop-down menu of the keytypes will be shown. It contains the name of the token and the valid key-sizes.

@@ -823,7 +845,7 @@ In case of EC keys generated on a token, the list of possible curves is restricted based on informations provided by the token (Key size and FP/F2M). The token may support even less ECParameters / OIDs. When selecting an EC curve not supported by the token an error will occure. -Please consult the documentation of the PKCS#11 library. +Please consult the documentation of the provider of the PKCS#11 library. Key Export @@ -1145,18 +1167,6 @@ configuration files.

-Mandatory subject entries - -

- -A list of mandatory distinguished name entries may be specified to -get a warning, whenever issuing a certificate that lacks one or more listed -entries. This requirement is not checked when editing templates, -because templates may have empty entries that will be filled during -the rollout of the certificate. - -

- String settings

@@ -1212,7 +1222,57 @@ The CRL expiration date will be marked red 2 days before expiration.

-PKCS#11 library path +Translate established x509 terms + +

+ +It is usually more clear to read "commonName" instead of e.g (german) "Allgemeine Bezeichnung". Same is true for "Extended key usage" or "Basic constraints". +With this setting the translated terms are shown and the ToolTip of the +entry shows the established term. If not set, the established term will be displayed +and the ToolTip contains the translation. + +

+ +Only use hashes supported by the token when signing with a token key + +

+ +The PKCS#11 token does probably not support all possible hashes for +a signature operation. I.e. the EC and DSA signing algorithms are currently only +defined with SHA1 in the PKCS#11 specification. + +XCA does the hashing part of the digital signature in software outside +the token and uses the token to sign the hash. +That's why XCA may use additional hashing algorithms like ecdsaWithSha256. + +If other applications that probably use the token hashing algorithms shall use the +token, this option should be set. + +

+ +Mandatory subject entries + +

+ +A list of mandatory distinguished name entries may be specified to +get a warning, whenever issuing a certificate that lacks one or more listed +entries. This requirement is not checked when editing templates, +because templates may have empty entries that will be filled during +the rollout of the certificate. + +

+ +Explicit subject entries + +

+ +This list may be used to change the list of the usual 7 distinguished name entries +shown in the subjet tab of the Certificate / Request /Template generation dialog +to better fit ones needs. + +

+ +PKCS#11 provider