From 728c2040dd304f2e75fb18b90394bf555f40f26c Mon Sep 17 00:00:00 2001 From: aboyko Date: Wed, 19 Jul 2023 12:16:50 -0400 Subject: [PATCH] GHA: first attempt at factoring out osx distro sign/notarize --- .github/assets/entitlements.plist | 18 +++++ .github/assets/sts4.icns | Bin 0 -> 64651 bytes .../scripts/sign-notarize-osx-distro-file.sh | 48 +++++++++++++ .../gh-hosted-eclipse-distro-build.yml | 63 ++++++++++++++++-- 4 files changed, 125 insertions(+), 4 deletions(-) create mode 100644 .github/assets/entitlements.plist create mode 100644 .github/assets/sts4.icns create mode 100644 .github/scripts/sign-notarize-osx-distro-file.sh diff --git a/.github/assets/entitlements.plist b/.github/assets/entitlements.plist new file mode 100644 index 000000000..6a297d495 --- /dev/null +++ b/.github/assets/entitlements.plist @@ -0,0 +1,18 @@ + + + + + com.apple.security.cs.allow-jit + + com.apple.security.cs.allow-unsigned-executable-memory + + com.apple.security.cs.disable-executable-page-protection + + com.apple.security.cs.allow-dyld-environment-variables + + com.apple.security.cs.disable-library-validation + + com.apple.security.cs.debugger + + + diff --git a/.github/assets/sts4.icns b/.github/assets/sts4.icns new file mode 100644 index 0000000000000000000000000000000000000000..dc3b53dc91f235659e68a9260e1493d54499359e GIT binary patch literal 64651 zcmd>ncU+Xm^YC7wNbkKVDqOFCiUoU&F;=8WzXl>IQdBI@(R)=8up6Udh2!p!V2hf> zbd#7~P4gR*7^5+XCA_oG6%IvXjOO>pd!J9_Zg;2b%gDFlFF|PZs1PA1IMCnQ z)iF3thQ^Kw4@}axye$6%+JTmW04|Fu}B!WNG6lSAa`f`h&iK% zdGL~D(#5F+vaz$Zb@UF6Ns~&`B{2lDb`Z^8B!^$J#nPk#G^Am%LXn=Xkjr9(~1`FYFJ(~4h2 zsHwKPs%ZVHoMnoXwZ}B5sjj}Ha4l5I7FVmZogICZB}MtUYfEd}4rx`Yqn)Ld>+@H( zb!xO4wPsJpu`Z%?b@m3WQst$6u0?&U17&5e*r!&h)ZN<)kEo7zrDZM8I6!FK4wU5W zS8F;uP=+G0X=hb#dSQoJb-V*Q8lM=KoLSzkRjYctRM62yWqS^3;FspO<^Xi`&2H_{ zW5wE^57Sf z#pVeR;`6wCE{Dx#v6!4NG2-y~&=mh-@x&owHo|S$94=oVBE%M z0RAz2=6o6P@q3fMoT>XQ&R@`X>GvD|>zlKdjZ4<_eg9Vi~49esI?Pm_eciA01JNNs3fNGK- z9g^vw`G0tTL z2aO0E>W5t1T}qJq#7R@ejtUzk7V^o8VF57YJ=~q`ijl{J$zuURECl5Tj~qTMz}MTu z&CS_SoL7WAL&C$uLPY{Dn+XGdsK2kbr@O1OLx5a5ONqS4hN2MgAAG3Ar2KunJ)qX! zGe(}CLZDG&$Aymuv_Oyn)dAQUxVbpl`9y>Bkj5f3X58peV1Rn6em6*%c_y$sBoUzie_tPuKuH-CPO=XJk7*^B#G(Muf~VVvQmI*5BHNk|ZLM*~ z{r$YX++F-7g;EQ7TJl(DYccf8BP|snM^6vXjBA`sCQnl&J;QUccABCf`z#}nlZQRB zbF>SW#mop9=4@?k$BI)FNh#?mg~-Cn-rmN+-NA;irn~SLDr7}cYMLae5YeC<3e9a? zf~F;<$%>^^g-lw6tZZy;9o&b9J)5jhltP(2xdfR9K9e9(q{+(xRF+zXXxXxK_(7AW z%TgEP|1`LTgN~xtHElnYjO69T!WD%R1Dv?N2W6Mz`qSZCk7K54B zv}{1AuC=8c^(og8VCJpOTbpZ8Rb5RnB8m!D=7E_vZ`jyWQ&v$~R+zt*$j`|GGjHD9 zg6f)Us>(`>3zci~SLSDh28%Scy96SI$YwSbv7 zm7uEn>T*nKZT_mf?5w33>2hgeM!V)%CzyFtLsM-ft_FhnD|54#FI}7_mn1CPr-8t- z8=?A^hQ@kKl~}uaW$udQnHdUcQcA%Q4WaVx?S$TMsK-nJ<<)sPE0#fRs(j53ty-y~ z^gyI=!7Kw`KzYT|rOUEc7dN$QG=(avM%4~>UQ|*9WLM>6D;syTA5m+y>H?MP5r|Cc zj*6<1qC!kGTe(XOfvi~NtZv^6QLE>0Nn?2t0YX?&+@UE~QPp*a36)K6S4mw-0rWq6 z^zs~~DxYdX46?y9_HnQ5zm4Rf{jFcDR(El^qYst{VSGAnDT zEW1!;sn&EKsgo=$gYJ1?(c~@71U)GBtD!=BWLuGRLCPjAbiKO^y6&WiMF}bKwd#GF z%X1~s^W%yA+9DO@*pWhHzbH95E-5WBCUQZPv}mtZU8JJ+c5W*~wh5BBn5f8wvC{mO zBU)gE+O6pMX!S`y8bz`|4(;lio z=G!!y-d?OG=uU61M%_@2Y!9n7U0p|edyjT$G+pgr^IaNMR|gc5HqYkq7+~`(E*HYI z2pl;n*;c^L%C7aD*jAU_GLB+^|FNO%sJlq+1x5Ig%5d+ zd1xp{09lZdjYJiIjL%n!X`v!WRagMZ;^Q&_s{qK0fl44wmPF-ZT8MxtC=d_9X*SN6 zSnP5!J%rETg(xA9fgUp19D;>7rBEv31ak|4wiqD>mta$vtYWcQh=|V&;uS$!1yOq# zi^U+A2)G#nNt1xf3}Wy@3W2Z)y6hOtK_i11Jh2cmC}wa_Fb6tK2@`^+_77%48pQ}E zf@n;xFa%@~Dhen>lwcMSY!MU`%w+RLAte|OuLunp0a+N%`$QpSP$U+XATyQ_=UmXm z&=4UQE#!3}xNl)%E_mqxkvKFI*f0wT4HXH8S0f5vOo)`Bbg@_@6g40Uho=-$c${)% zn0Dw=6~n*WMJZ(VW%zCK*GaMpq1}Cb&4{u-u|JD5v>5qCU*9-%ysxhlJ=NFuv7e#b z@Yn6fzP^)wANTdW*B{KNuj+npYg^$QY zdGH2vq=T0mN)!LCp4Zxa;Q{z({|$d4M0x7W{rmTwBU=9e?0p>wNerwG_BS3O`_I09 zzW&x=m3@7mV>1hIM4|W5FHFSo$MeI%!OvLg>al$d^7(d~azYI}^1-^sPOrVS(U5aR<$Am#GOcO;Sp_pHa=)p_|bL5-IB4S*` z#K{qp#+M*kMCfQ}1MW>s2q_{?39|HIvYF)k<{YvbJ27JNq=*R<#*Z6Qj4VY!9@7^Q zLaIOrGiMr;#b79dsW1aMgY1S+niw%m4-6dUe+mtm zXoORSQ^tlCB09{dA#4aObn%q~s{m#YCP*+eTp395_d10vLnlnsQ6s|XW5$dQ3oAf0 zQ5c4!3i$j2E@HsS3B(#b7!gPvHZ0&YG9Nz?IyP=B5pD)hqsD|3Ac`o25Yhxd4W|K+ zYABI|>qrbZVg$+Mu%W~JPb0H&6URf}h;R$6_fcV?LM5^niiJW933&kI4;&0Sl0nKv z4>>fz?=+&18%shu>n#TQ2RsS@l#hwp;1vrtBX~qm@W^104H`}anhzT~G+?NoixyEP zPAo-KQTR9_+y%3YO%8Mp283yo2q+vjfm0WqQcMs42CzXlmv%&-G<|Y}s00leGd?_A zhlU8HgMvapVqgop^a#*UA&*f8BT_}6pg0&< zB4iOVI-DF+Mtpj;*g$p$NeYueS{*UMl9Vn;C_w3te8Gy{+&u_)s++6xb9#jIhzL+u z5i$deATbk!29aZg3vr*&~QA`u?Vrzfe7`gyf0pwpRbQ60D6#!ksIMkb#ZpwZbWT?hupXc;iCvd3mb)< zfHjF+Z(%rn1^rO)c(pb)P9ne(gbK*Lz1#>=6iO@#SHgwr?Buuwxd%jG-pSF4EjWB! zco-`*3=_CZYp!}JlVh~s`iTHLAmHok4w}qKrS>lk^61!esjR@Fd;3u6_+zBcub;$%ypGhOtAc*}-6& zMju23nCsN+LwKWmX;?ZsIM0?#(^F@(BJ)w>BMdYKj;A38XNC3PbPo+|{&Z5)1{#FB z8P+sb1;xpUaHQIW!ip6|p4x`!V<+hQF_4B)*KE>U!3W^*LV7jB5F>SAftBs)iLJ?~ zZas}ai4vB!q{(fFGG;sxZfoNAOx5i%Kp6&u)s14Kx^>#X6lg9kI&C;Q*t47~M?Nepgr@Vh9ih?`JaJNSV>>oF>Zaa9?1SK4$EA zQ~zfYLkDxQ{lWf0K2}e~d$yt;%uA9CIn&q)rd0HK?*K1rA~4fXfg|<(hMqZ=7duhj zh}W87tBQpaGaQagN8p2$Z-^GY5by9X(RsjuBM>XaeX@KbEJjP>ied9Wc@K#Jil^u@ zEt8DZsQ5ufq7@#AK*5o-NYM;>mlPuhqYE?)6k|#=xRV`5rb>obagUF+1Oj#r0kh#!)|iY$Q%&6EOmt}t8B;C5iQD^5lgeAM7mSCsq|va&g41JT((y2= z9uOvsX^k~@vyP7T4gr%>QGRP!Hjl$CmBX)gidXJYijyw}rcvqCObaHZVa0!|z zQEbD~fvh|X(lHp-ronB%U>l%WE4_!pK9Nj0Jd@nHMeZSWWbsh+FO*?D_< zdIzvVC(en(J8p8B8VoTtvI;r!U?CSz2M3?A5dOB{Uc7vU@h8qp1kUB{Qj}OHMF~~N z3^ua?Z~)_`qhW}zx6kmnSSyE}bvDFljZUR=A_q`T*<`Fd;>*mC_Vk zo}!lACS(akIukJh8dZw{tqg!8=E%FHbooN(S@K%x5Jl<|wg8hO>2Z`SbG=0qPBsq{n8j4Qz`V|$^FiH3G@t-5_k(w!g>$oZG4ZGkKI z9*;p}3GUV-Eif0|It%ZsWU_W5Bm;|f_jZ_9vMvmy8?2|r);>iXQ z@<>-}Yxl&BFg{X>5zRdyAdnbN9|mU9KfR-Qdrk)fvyjKRTie)9RgjG#lN}11<3xb9 z(YJU7#N$?rysd4l8S*CmI1LCK5H+bDd@yoLT`RYEnZ6m#pUe*XL!ZY~xdxg=d0E@o z*iBP3VK=;}3Q@g`={C;pJUzV@!f3NpEO3K%)&hAmoj#m%~-Q8WsD8Lyh;)Ys7YugA#3l8Cl z#fa`70C~k-SstwGxK5NGf%Z?iS{K+*!W0nk(EAM#v9=6G-9P zVFK2Cc^g&$tStKI@Eg(=-8336^0>LqkRJpRv%P@?6@<4%itvE}ALyx`ACnB)3`fSv z5Oe5?WPv>i!Iy8wF&FX#Qru*R`{#x@8>Tu($oBzP(y1QSg(O#ySfoSlW#;3Dmv2nx zk``p>bqZJPf$=DxGt|bq$c7@2ZN(FB*!1%CA8c+&brdRg!-)jNLZ&@Xpjq3Ek#7a2 zq)8=+;sbMl{`sDjZcgv)>=-QH1t9WBmIIKWSvyX{DM@-tDYEkRffXg4#+3bw08~f6 zXA6uj#iH@PcGe{TG9q5S z9ZxP{y5UX&5FSHtJa=-2^Z=GiXpRok!GbJh3Pr;7AUNAmVnesKA1#$_2SQRv7$_dz zN>93no4boM>}a|;=_bWgJ1&e3OE^#$J8`6ojddB2@|mO9iFIFzs2-3kxl>%+U=`e+ zfH^eH!QL~eK{`a9CQo=)?B{4>U5?3!Qsg^1~#l~aC_G=$%^Lzv9uK-TLNab$X;pZU=x7P zog~N18pHH)f>CK*2W@TKM zdk2yPVTWwnY%DO~qyzEETPU* zJO`4QBQT&-<602i4%d=IH{xmspU^oHg}f7Y4dg(xCu@;yqsH?-@ zNt+SH1|X4bosE^XwT+XX=;;Kx0{kXaCT>ME8#_DOD(I)Bt+Su#sW_PeLLEge*^a1i z_@~51X+6Zo(KBewGx2hT;useDPDHV?CTt38DpM~mIAty_%x7c7qYjuv3GRy zWsaIUCmzZbvKJxCk)}rMMwWuvF{yGWlD`b3<`CFQN3el6`H~2NWJPqvbEc}*9)4%}eiZq!d z_8dYfgoKi&01u!@lS)!#Zy<{qsZt=WkhMYd0-KadlOx_i^!Q|HYATTiOCI&oAu>4T zB$r4fQrSnyJSiEzNae~jLP5w0MM0XmTq;RTNlE$&QRgH}h*TskmRRDVR7p~j>?dR) znxpp;ZAi%{e*$hN$pzOJ^my1J^WvZkUO_SkARZ)|LAsIRT9sj00h zfjzdS@-onHGcF*TRaO_n{>G~OcaT|S!={#|s#0WIyU|cvUS3xQdu;293JUUJkFB|> zxn=XFt&Jtfj;L)QF;rHTmzUL+z#iN3^(6(x>({T!K8MU&Hf`G4)=V@}nj0V{wN%$t zR})p{xM^8caS5^_N|eO<^#uiM^K;H1^M=;eP1{SV?IS0Y&-1pdN1Zs#PRl>!wYZ8VOfl z-&_l=Y8rJ+Vz}axVhl(W8{k&0TDdAW>lAV*X=>?*tE;amDM0p>4Z6-@z~Z7(B^2cs zU`SvT2(Db2pL-fPY-}^qtE;QsSk(s`W)*cV8bkZO@Rqy-kNOKFso|= zPKgFueSKY>vKCbWWO5iRKNZ$WqqW+|Yn26SY(@6QXKlMNM5L zW?IK}VS!RvP*SjN&3aP|xvN*en$wI-**;`OY}(b<1Sht`8d^z2MuV+^vwHoA3IGuS zc0mwE!R6)V=H#qe4yn_UC0R>kdyoauvc0u+>!!wHB&=@6Tp5v>>Y%95fUI96(5+k| zhmy4n_S<9`%QG?-%XXt71XwG!@J$Uuv?XB?G}nVI)!mN*X$toWdj(KfzC34ndSrSg9K}q>9gxdp;B_Ss z^lX}Uke$$tP@-Wj=(7d}sop&f=!D)tj3h|A$08z0EL*lTD|2yX1}S|^LJCehHD&3p zHgG!Iu%Pl%AQX%y8CGFh~k0r0s*#yKqvqy%kL)>RTQtr+X=oo(K;=&^T7cy&6wWPE6U1 z56Sj)w4tcR`ldl;qzef~Jz$dpA(`qyhhL{`!{8(JkerxMr-4(o+O7j_D6+bqOjL|P zyx+|~gqlee=*PA}%}I#~C7Mz=6eLW2{(LM9Dfb{lnTorUK4& zYq}~>azj(=hNkA$riQxu`Wl1^YwP-Rv3^o_>l-WF;0f>1w?QGvNeS`FPIZ-v+S3_X zj_8feO^uMGST=6lR8v<|Rn`45l7ZYDP=A+xLQ7OiqeVP#)Ga zLT^+hD4uB0XL0w*mrO?G8hzGkV%DT%)O+{=&KImYy;-B)0O#gApM#S}HIS#)hY#vn z?sdOL1HcwwaKA>q^n2f=_~e2E+9s@i6&%3pYuI$R|Gg{qxsO)#GzJ@=DM<;5Iombr zO<4IwD5AW+@&37`!Hx%w>tM$^2kd%R$W2a2%xY0-TERoAjuxV*nz~Jc%4u*Htncn9koN z@_{2-?>fLf4PIB8nw*-pvgWx?t$G)Xvkp}m5*Jog*4{r!CgYrmko7o;3^%A1}$q=Ne;?SQMZ z5{-{21rsJQ-PcPR2MJ6GGBTFst}Cf+-F>J7-|kT#!ePA{g%ZVO1GF%RYl0xPEHiUi zuClUe=l&xqe91-K1;ba>UWNDtMWs6P8<1hF)=dh@kdU=}>GHgirsoa=_W-$9g$~z% z!KpM=h^egl8{1vJe0A0K!)h(b@Q%(J;JT{{jV!7peS=Yc15?Zu%U2X_J_5v!sA%fv zS~M6+U5MCyOG=62!m^^Gg5n3rENeySb7~D-e4=S8cLMB?o=${{szBOhM2SNsdGX7{ zxQKi+a=Mg9E6mA_M?)~e{5y^`&kT9xlnbwg2^$#i?**dAr(NR=dZnWsTtiYHE zW+{&Vl$p9CBe7jwr}EWy?!;h5(;GOaCGsqF46fdQzw*I|0b5TXiVEutaYeb|wiWmNt=NPEK`qlDt*M zM6K60syspFBnU}mz{n$VEp_wCr6nK%bM2-@(MfwCG>awC`SajktLga?V?;Px$pNJ2UqXSfqvK zz|yGLsI{6V-LQ4aU8Bno4AZlW5-@m6&4J9Q*l76yHEssjoR;OS9FXE=Y|?0;+1`w( z*qFE$9M(0RhoIfkoRyd_V-me|FN{1(?QTU>Y;07Cwwd%%704wrTbDBSCqH?I!GjIy z-kKT>Ewek-&6q)GxgvKZpd{JTXR&EY@B~(BZ9^h%D%*$SeGepiZcFlVR~s^3!z@ry zs_lfvoyD;+v9U3U+qEsw_)rOQ%*f5n&oki_Pb#R2T5X5QO1nQN8n=$y0Ii{8hl`L? zmD4}_l{IVj zgBLndoDi+lQG&#xyR#kEVY62c=!`PMQWwspjhcNbGf1M+qhs_iTY$UHVq}{GCSaNs zTN#ogNu72NW^QLrY;*z8i7ioYA@lrVhZ$!j&cROTAZ9%WKg3luLPNZ4E z@fExnld|H7dYj4uY=2vRVpL2~EG=sBPR%x~*Y+}GzAP6fN}x*zh{sFQ;lvEN?vWzj zr{0Y3vuY1CEMJ7d=rPf&4rsPxQIsREC18t?y=7!BU6v-7OJwQ#)so~^O$&f&wTD{P zq((=T#L}Y@YSilOKu!&_9mJ9folci)a_0A(wL|i zfQ*TT8OBab5T=@$E3y_ZSuDe+TvG7X159`mGY*5_wgw>0q3vZWk^!m=(<|%H>;!t+ z4!ET)TD*8k8N4BqEX5Eo{ch1zs%+spF2L-l%9Y1PN5z!KnnlOt?8I3XND|Ja!(Il= zJfLx09!#ihp|Q5Jy{#-)76+{>p>=e6lS=a(?$eQ0WE+puzof*(goOBnZLo}EkI{E` z?%z?nc4=}9fK&rWl&q#h`#kPUEAmZAkzo9Z3GwlZVsg}4xEs80d(FCKlGvE2=$P7A z^XQoL>O)%f^VnTzT99W-ii~6k1H{F~l{FOPW+VacQ8D$g7BNw=OB>-b@E$NZEimMg zVA41a#&Jv(VBHXF5gnD7*9O_-KA69E5G}|iDOHbk(W1DxR*WfHUc6faV+L+0A8tX` z@yRKAHW$UU#9BgUlJc4kYhfq?DHSwGN|xvw#Kkqo4uJ;o%c}N*8X=kM?Scl8iO>Kf z1ANDA)HTQ~+X)Hi5j^F7t_4|{G-!kdQBg_DE1`j=6PVC|v@DZSF#=$*KGq5d#7S4x z?}3C7@;$8<)MXKokW5xr$J)d|eQau0>1KGE1ROLd=-?J)77?Em9~V~R9Iy*gia>)OEXgZ-CIBE;+(cVt5GXnMycXoDlb`m|5ZpdneXu5lPx>cQBM^vzfc;Jw_t4q~g z&_i@nv|0kbn0KqXI#r#Azd{a&k94YzbatvcJG)e>&Q6tz=%jTWKF|(3i7hSddk%KA zw2(WAT*3>RqoIXM2vQn(x}DBu_HC;~1lh2bY>Sg>h`Pq_&NBDkxExCQ(|fWtTPSZsXdi^U8) zhv+OWTxeJFDFPlG)b&#Gi=hn{PF%n}Zw?*K$8lI^klAn`Aq2uyArG$M(cq9GzXZ3# z7x1{;LJpnF<8W9nBC0?n#LN~UDjWM;FfR-*tn7hl>#0VaReniB^PnvE1Opgm&&OeX5c9x#us3CRso`L1;x;W!h?5d zC@gj{Tpx!kdZz)25F_D2DTiOgE8s$pm2k|N4O|wo;Y}WB!Vy;T5m$*@6!Hq81slFI zd4-%JHiZ>*8hESZTL`!!7K6(Li577!cx(LwcG;#}~1ppJ}d~*RG zzh(r6Rt9n^0mMZtGw8Dqi&@AjftGLpf-kB8-STv_OQA^#iwgJci&$k$B!H_lT;T?O zDL~_@Isl?Gg85=WD=3#QsweRpYRuuDy*O0Jg}OkVu+~Vk9-u543?|$?3>6NCTHvVK z$bKEG6dx_*DaDi!A<$zBt4!)jm`Vm>7vPKgBB;b>hPz@Qsbo-CLU=JCOy~o6y?6qw zK3rYG##Eu2DS%f4LID<2EjHF-ss#*qHVR|r<8JbFiYfz8+|5D;j1_oqK(HCkt`-iE z090|x0WL%cr+#@nHk|f>Gn@nX!c8hMUAR!f6^Y2Jo^XVSLl_yr?BQ0`Vv0yqft-f( z;AsfBjmrlY1b3ntVB3bCU|w<48jP?4#z`^QjF5{TyAnX7Qm%pLA`oL8;Nz8JNtN-b zaNgEbT7@7Eem#EDp$vNpLB-v*EI|X7hXC9fPk2u)SF{0h0M{2>b$Y;*OWC!gC@Cy{ z6Mlyw42A*+Jc@1<=}ZRbazvXzzkI0V8+D|sEC3Y>S}|f6EnCYX5dK#SA(gn zehuo#5&+BJ28i)cgYl-92Cl@0%3yK?JM=8W^BBYcEz;m2F5xcBG7D}%dxLN7xAG#U z8H>XgibI~mq(yLeJqRA%DAF5VEvtY@XK~;~iFQEFgC#BwhX>I?$96r-9DWJmu=@e1 z72?z7_IGiP8a(E?VRUwNG z90)}xF+;p6aK3z9g%Y0Y08To^NLUN__+(WPsTjDH%N2;a;0+Kyt`fiv?BN^+k35|V z4j7LiICaYvYQ+%VYQ;98LNIkUFbmz`D)~s?2HX}`&@HBl*rHl^HbjWH907O~r0*}d zKYouG{AwM%^&!MBqhOzmkyBY5VUL(9WD0PV7_m7ZB%RGbl?bXr*sOYZ3Pj`uRXjZu zCWi$e2p*V+S#WP!lQ+26P2_Js<(V@PdOl8=wX_ zXG1*1y)6Wo7XS@E7$|KJ(?dnbhogi+S_G9vEF^qEOc%gOZSF>~Ez}_vKtc!DEb_$| zvI&M4GJ}IzqK()zijgH3uKF|BY$gP^VippBoJH`)34);p`UF)oxP{=aDQwYEc=-ii zDPWfZOGkAe6qX3raKWZV07Z5g^t~G_gQWy)&Df{_9UTG`n_UjPf=LLO zP{rK@14PJzX%2qtrGkanP$MAk{F+lkSz z;h-xE#ds*Lz*A{V=mL03Zb-A(0>UUCzor8KEWs|^O_=#I;j}(99ty$;W-uWx z0(*^OOK284n)0V=-Ewk}ujXMnHh%4pb7<983#humz+i zh9j{-#f%+5g)2NriVEXkKxo|>Oovu{5!j7L1cd>?tOCXsTnHh8^wK2C0!EvzOrQc5 z#9=L%P64Ae7>5#p8q0?V4TD%pMpLjE`3w;ZBq)Xaf*ueAZ)`LMn?o_UQ*eG1k$5XK zX4V6Oil0MPP=bqaym=XS zi4S=yOCWj!zK00*!UGWEkk>E=0+UtZ;1`GxJbMMNREdBaF`pxXd7qb;h|LZ1@;ZtPufw88{?M$gtgKvp@rU-vNFE(9 z=)^nc&!7MFo3G(>!1mGcJSyZ0(`R%hJSvud1Q+CG(!9o$KD?4?{EYN9etn!@tY;nm z=@Z=xr6k&RQ~KHcl;;2VP0Ltn|L@21Egl@>?g8-Havw z{tI<%tNsz!o6`)~tiCm+f5gbwYJKr%<$OcafBDxU{zU()R4?mal0pH$n$myMOiv`> zf5zhL9nU_NaXG-y`(%1TWBxP}f-gT9-f9l zKq!4ZWZ}R5=g>e>dq`W~J+N>kregEfz`~q=O`1e7P}F@lC*jf;2a?)|%LZC%-=E>Q z@ZW!g1B|M#@3cMh>D6~VrT1~x)S&?v2lDjUqemtB{K@@%o4q#>Z{J6E5!Y2;`s%J` z&-J6Qh@aX2-uh2S{d8b--Y-geF_--ZVq5a_|xEE zkFRw30DAZQi0{ufA0JIqOh4f<{eVxEY2zpH{n(HPP)Eq>=#wC7iZknh^wH4IOdCIe z@0UhAn1RUyCKpeDf$a~bkCx(Rm!IJ0_i=YIV3D#!Y?wnq)jcWKK6fq~hN zoM8=y_o2(4*3+jvN_zXyRPNt!yPkf~FZXZrBx}CZFXap$9{a<@x7y!QUE1SCB`SG{^lNfveS)YB3;{3;` zP9neW{xQ&F1bEZJ_v^=q?jNH%Z}opm|8w{MTl(Ml{om66+V}r&`v2GR|H%3OR{k*l z{!jhS>t;ia{bQ%`7y(WoTg#n#Y3m;gO^pDeJz>d3eyr((UtxMA;2#6^^oOK>`bY@= zCD2Ry?d>VA{7XcS2wtM={_scI-hV`zCSbQC^z{D^R(~-YAKL5aQ}&xM^&ft1(2%v-S`md<= z)7fOuKK^TRZt(YyHZHj9a9cmn* zv!1m0D<41{ZiqbTHK9-MUiTfqj;($$463-tQTUhXarptH@efMFPPR*VOtZ4D zqW%%t{>H(N<6zQX`%EW#{m38Y8$IQVN0+(|@}ua7A#~q1-gW=#DD2N=h8fj;Dg0f9 zaMvU6OkCe$a>noP=-j_PV&89%qJ?WaL++3BpVfr4{Nn?u-)wkX_b*9ShvmHf4`Ra2 zmzVkdvmX9^Ym4!f?>-a@x8JE8^U#s*@9CPfu%4hi{Woi+-=ADN#>xcbv40&gyQKSr zL3e3>e!sI|M!;hyI0!-q<|IkcwxegxpMU@BuircW_KTXW%G8Kp{c`Fc08gmM%F5o? z$JXj!$vZ8TKMEd**!#DaaC^5nPnDSB4PXHf{3cIWs0t z4w#d*RF;+@g>|#)>d1J7Po&HE7gopvhrc;LLtLD_cY^H*+s1|B9bG-^Kl>~+vuQ@? z$HOj3Zv6b_rgLwO61{L|$Ly(d)(C!Rb2)QDO9TY}X8+0fF5X6~5g)%75Inx?kHR^Z zDxbgH5-w^<>*@Gh`tzD=Tdr))|M{r=irJ;3?a@v3E)=)cLmYSE#TBKsW#d?NMWx%_ z&38o2^<~BHdxjc1+d5Aj_r>HF^AkV1@Y!G64r-_Qx&|!wPf>lh*Sf5h^2?sc*K#SV zZ`S)y_#xKsM#?3vAmR*fb@x}PADmt>eqD8%>>KvQcgxHo=cku7JJh~@_K#^cw**Jt zPuxB${c`)IZ+E7&<$SiiW7(DDzqTzor6|6(`y!|8 zt+4N3oqy`X{q2osH=oKqqYa7u_1AFv$?~4K)~hdP-C8n#>#yH``$I_UYx%3D+`ien z>Zu!Rv$l=?>3?f3T`OwhSlr&-yrIzbOkvsj9n&V>`2ONw9iKk!K=VxZ`gX>8Zo@9S zINsOsOP;^<)=V4su=o6Dx?R4hoVUGiimEb;I2>cXe{NOv?2kD|f4KbT+_P`Gui3Vy zICQ^q{c&5>5VPP-{L*7qv!ZE^lHdsQFWf#<>?^c07rGpD@vKPPA#?Zs{^ZzS$8@#4 zaq9Ss8~%FbmBhk7yWi|$N=nBUxOIBnt~ucLuJr2u;zg;>6V|cAs1rtd1~`3G_*Q~& z#*O;rLdvjJ6=P@JX!PlHmRz~{;nNvY6UK(Uf2X%fH1GMgsh^GRdSQD~pNRR)qWK>j zVB2X*0$*d?GK)WU`=!K=MgL=m&DC7=+|m>E=AVgwUcN27!MdIP+?VUWiMp!IdO7y> z7doFg{bNS-io8g#CFWnd{c^tLZ24K=Ys;^G6J5)YlH8+bnK0_udaP#?VD>)#Z&9UU)%Ea@vpec{8uEtbR+$m zSL_%0ZmT@B^8Yn0KJfI=zzkPEx2zXKznYsY{58nNGIi4250y;^FW++8#@jm1*Dlrn zyFIrS9p^5jl;7&0UZ3?>WaNVXE!)8GUAT1CsN)lztAW{;hoga*HUBN9g}(4_6^s(neQ~FcpVO9 zHnsk6scf%D$t%y)DCU=byd>7!?8@iYYp=HnU$A$M<4)gv%jV?q30Hr-#l2Y5g_?W_ z<;#JY9&f#B@wwTkYegS-esapU{;4(AU%vPIk2g--6s}x%=e_@ZdS=Ce?>U4zEPTs} zFRo<2KR%*wKay9kr)=N0CUQ>FUrP~+Kr^OHT(FYz)3L>Mk`I>qty~)U`|BuxFuyu7 zV*5mgGhdE2b67(-m6sgr?48)=ar;BdPaM57p1N4_+lR;@Hf?uK#_LI8KJPsJzFpE{ z=|{u!N>1E%rcIlp>D|An@F_NbP)EHRnRo5A#+IPB_QhR@ z{OrPKk)QoeU9oiQ>pcIUE9X{h%XuNVb@#c5M&;TzW!4ur*3{{GX5aD;&J*eH=MSa5K|kVtW9JRZp6l~Id^O7=>(Ez6 ztU})Ma5)iovm$Y%MX}oI*YoWBk+|LT+!2TFXm|g?m=Jq=&57;IrJn{e7WYi_+_bp! zNSH7pymMFa54ATh`Cgm4cT@C*9eu06`8{h_^5jfQr=V%^7a{l*3Wi<1ncdgF9I6W@u84ugz>%Hbg zR-VlKAnWD6+z+zmy7}+!e)GoaZ$&)cz8ClX^y`HWIl&j+5MH%e^ULpJrpHNtQ^ahT zneH=PYV*VUM}HmJN`I5Ne%>d)_r3Yq%asc+Z~FLaY7?`mdjBuP$4CCy_scAI<~x7f zK76d3^YwQ(f_@&G(DaVQuV;S_mUoSdbp3wY>i_*QbMeq$W#jhQWV}|hdBHN3L_Xw$ zFH0+4-n)1F)6;KH^?zZ)h$|Z}?3?iCpYHxwf1UC6mEA+Ok8q9%-kh{Ct!|p-7iN)_ z{&Q}hJU(}0*s<%E8^<+{Uel}kkoyAfy$NS6Peny8-5sUbdh^w*->oe=;;ucO$)#vE zo!-6vd<^ruIoHn$(<>?_#6Fkn(W5l$`LXFW|54{x{V>}PF9<8u_0)ncwesE?UQb_rt8l zJD{#5Q)Yd2I`EwD@S~r9PfSsGI2_BWmpaG#j$ik^)2z*7mF?$_U(}-DPY$Nkr;N%y z^2xXxht_9(urEP-^S$+dy}>)QH&f+14or!^`jFM9@3CI}eAfcuYuRgOhkf?q`SHBJ zj)!h}_VT=Xt8p_Ed$#@Tyyk}c!r83#m*aZAh?ts^lQQMVr+M#LeDd}A?B&xYr_BE` z`CZnlQ$KztW5*)DYhT?s`$N%;sxsou-q;o2{>tflEq?LT!@r;TbMm!4ZK{Ivd9y^6 zs=EEV*IyX@bm_{TeNpTkYjVz6``+HXhvruNR;5eK{);N&+$^+U_`;xR^yWgVSCd>C z&(B$IJ978I4CaU4h2I`LZ0~!i{})C%#snO+30Q@VnOP z*CIreZV9pI=7}*|7VaNgKKGT>hUpUexluV)*}cCe9UT2@zDQQMPMvq?jb`fk&qwZE zcs}mesf90oaIrM;#;pCrOMWbCpLBNTl9g|dL?;#vSH;D;)#kZfN_b`0zIb8Uv*l;# z-(IALerfjI5zA@Px@lh8A+Hwa?mt=mf$W^{?PpNTq)SeHitz-xS~xp$(;nNT+esHH zSvDzWyD0|_bTXT-iV~JA&DmdUA6}jqvf0(Okp7DI?8^F+4eD3I`?42Le{b^C-{~!} zZwG&L;6s^~+x+PbVY#(;!c%V6<2maZU$|wn^Fl^2m}{MV;ld6ti}?=UEm=0sK6QSj z{|C3$yirTp>^{Ne&alFs_{^W!+nL|`B6pXz?@k8${r11FDR0py&5K(QP5X{oRAKeY z+esg-wx2yQRQqYx?Haq?X))@L4yXV&L!=oOWA$p2k*Rj{K_kDDUV+C zm~)#DY*@JSMdjIbr59%x7jgE_+NSQ>ziiB#$5**#DStb1adrxNKV{liAGoX+&;0WJ zv@bF)VTb(6H0tN?UU9u(^g7H{OOJG1@h{q#C&zy zCHn$bk$GUk{sS^^5vWVxKJEPFp0|GZa{fsBrRU{k3$Q&-%d5YjJr+SJ25#+VYi>f)wvJJsaN%4RusLzq5eh{1knp{gTyA{2QJp z559b5WmV=m-p!gI!I%?ng|#$6bpFb#v^{es9ojtZ!fjc^4M}I(NMg9}j*ed|_h$zl z8B@8?XIXN@|A<+cHz@84TKFGdjquuLx$9K3xnGno`=u9#jtcTevwpmF?v){5mc*Zb zRdMyLH5c1`(lwTTOStUx=E(DcKP~Bgx6W4=rkMmN?a_I0`kI)k@;5TC zcrFS1M2xNTyFksW7rX49;;)+Xs$-5S?AC|f-g`5eZBh#@ z%)`-hM62fR6K%YeB5O5^mQG*rhueq?zulRy4!^Yg^WbE^@#|LBAKKuTs@k-Dc=M+t zQ`6&qTHVIlk`z`0LNPBtK8%wEcrp@nZLGP?NvoLI|-81H_L%(o z@z~~7!!Gp%-aHbqzkRLKufwNxU7#q;lSWtzcJ{6-5auLB)@tU~URs#*ak-ZeyEMs= z^CORc7WG?uWLM+mJH3BIPSgsWmPFWjZ$1)VSh{cF;w}}sd3l`mjO3QoPTR>XYyYrj zGnr*m?SgqDo1bqKy|4aX={)bPlwVR$>{M?!^VIVfc&~q(>lmH=ZsP5e`+I8_QeF(| zxlk$3N(!0Ts{HQzlWF4{+-#4z-h6tN$2VCYr+-~(xogL_UejbAzSqs&x4--{di8An z`ddH0Jid>${;K2~GppHF-+jL5%7M4e|F-^v&#Lx!$Tc%UZrY!{k}7+RzHrSMtJ!8= zHmPy;=igfOmQ%`4yTAU;|C>t(-GgpVZ`giF^O59W{4~#JR&(d-pFdYz z_1ej!t)BNukiui?)yC^bc{gvq-tx_cZBAcX_|bJ=IFU08o(cRp1W z^MN$!`5<)jqo3b-^{vB)-pk3D*K7Y*WzFGI<=F{8d@0#X9IJWh@|CRoqvz>9vA07s zw3+XJ?yy<5@{1U^Rb$W3c$eaHF8*AqPr7^Zrmu#$PWb4@$Zs1HZ^;u^Zl--)a$)0% zh$~6gd#n%tKf2B`s?E0B*1_G1YbY))?ofgid5g8UTZ1_^pZi`h0Dq`M8N zM{t8O=q;f(Y-!{=-ThQL)eGYClEu894L_9&_IF_?&a<$AZvCaRo0Faob{p$2cSgs* zYZT@3SDW6SHCA5C4o7yLAr@}YCw{G9p2L93Z<~YHP9DpHz*}2Npo+ZB+Lz*q_8w zx-`>3(7(A;HE~W)Jxq5XMc>uitCS+@#Deczv>jDnH(%01^3?A3UsibE(mf3LKkdS5zy;s?hef*cDP?;t5<44LHO5-;Dke_CmWt@ME z%l2%;Nle&0;3CT8#Zwfe&yhu-q06}3hPH0*$C*ygrK$3oaA@jBn)?;uJ!y`J4=xQH zA!(_AG9>pcMB7^HV+ie)ptnM+fs97Zr4&=M$+unBR4E=ofD@?znbVFtP5;IWwn)!w zei{K`)Rv9o<)MoDByKnXvXYc?`{PSd>dSAJjV~c#_tl2d)-4V9`mhfsIbE@Uek2(2_?s)7^Dfc3)crVfG`eVF3RXzX*MQ=kdiJG$;P{EtruqN=t>wF?{qYp&^Ht8)4y7_Aq`UYy^EZZ)@8LQ<8= zuh2_F_C<^bBAexXIg^(5w8tJ<7s2ql{5hIrU|(T%iS(demcwfRRE;wKh(PZ5{3J*i zJw3&qT2PAhnfiwL;hyE7RTisC`XiIM(&AR=!M!5{ksy5T9x*U2)_@TU6hctia1h@^ z)pFz2EdBh)FbhARufvN}0#u7Rs3|xlgd~mx_gbjih$m>u&Rr{bG$E%xji<#`CND}W zB>9{_`TaY$s+#yx$ZlJ*@;GdM-V#8JVVx1QO5KCiuy{D6s|wH0=I26^cO4~7xBlr{ zKHaa@=k7N$TZYAbO>ftt8CO3koTBFr6nZl1i!OA`TbU^MtSv8-13FfBR03h27p4ki z(Gj;?SEcyNvUN5Jo}{+mb;W?Tv}f-z21#VYg|z7FG_ZNS-x~2%P7$SF zK@kA~qI1sS(0}^n8QHwTK3%nOz27JpvQa`QsWI#nbZ7OMeQW|hnelKoRfp1#e@soP z+2HJbbbvPRc{XJQSNl27+bc8pS2ygDL!r@OTAK0wHBT%Rup#*Om4)#paeQ?TYe%y_ z0{y-mUCOHn>#`169aMwbM=-0>cG8f=V9X>rM;9s1kRR!Qo7fy|l80I+)~ql4Wo83Y zXt7y?(v#lS3l5E?)W;yf)qZfVG>up@cG~t_7m@GZ7_|E*+<%1o*F) zJeM9H#Gl~7JvQ7mG9UG1(KS)DrfgM<8?A&1jJq_P;8NdeE0WY<6yb6lHC8>zI5!A0 z2xjoYE4pjUnN|t3oucj(R|fQx@?XA8btjh(&6rioJ-Thk@B|}R0~~ZA+OaHJhR-I-a=NA|I2q)TYLffmuQD#S}M z;kCj-55GL}wI$F^4>PzFbk!yxTEsao3&G+0x(kwAAqdu>rg6UhVu2G`Kgb#h~|s@dIEEOnuw| zuhU3);JfO%T*Q>`Zh;I^HK&oT6_Bgsr+G)Is;wZUcSOm!ti*l69Ept3 zu1&6QpTXpb+Iy{QtDje9nI$KmHoyFUC{jF$<;mS!|1wvrcXAhIr*;3kWZ(q5{eT=0 z1G;-IdjuJoz_>meDsyaQ+_rP8Oj#Pwn*1()-y(vyE@Dy8b@_txSayQX7|IQGZe|<` z+{vvxMPqIbJEu&>r)8DvB`32t%8+CE+)x94Of3p+kznXbbn?~Sh@~a^Cp5S4`p1F~ zY5}Pxc~6t;(CUj)8aNK5hF&`R11;N^0=AYqGafkB(=A%=C9<%X&hD!PF$(El;m)hm zJ!j|?M8y~VWj{HnLe2GLP1L*Ds!GYbxL~f)gnqxhM$a&2z1fbGay$!W5(MJ3lp2=; z?m!QJEM%fPXACBNu6L)aFeGf=pT3U~ya>|@2Jhyd zX-!=qKQG#>8Dn*v3eyWJPkf7SM3YEiOTeYHn&(O&rm>5C4>lOXtUC~_VazW^Qtu5u zesD7Y4JN()$25E3Iyq~b0I1#R5l2POBO*)o&y=Q7UTOVzOdbUojiDS^<$(dDfXHyJ zp}jTCp+;8r3Xc(xS^&k+KeXkj8tLUq64y+-=-+)~ETwOC5F=p!n1E>F`Bnkw=mrjb!6}!nT+K!)H%FbeXt-s%{!G zhHe1OptWdjYz$rNigycIk!O4HkLwGm;~;q=I%+x}n7Z$9S{`ncC*UwtRWV!U_J zzIzfT7483iFuYqfl(k>}tL0DPC+{%9$vMZ0DhfYUjj-R7IUwgNRFwZUi)W`?P%gl0fCv5(-e)ZPHDOJO#OW^*O@~=EhQgJ$-QjQKb z*@d?fZj8Z$mw`rYt>g(0vcxyJ`_WMF_KU#Hg|o(_)fqfMP)zG?3iR9`K_q?rjD3hR zRfh`&NL^uCmTJ$*m3wh{tLsBjmm|?f63DCvxT{pRuoV$F_HY`R?Wv#kr>S`MTo1aE zT-=z3uv#K>c>}7!t@-3TxL$#wo(RJ1`&EUVKg|2>R z8$K4nMm1jN3(6)|i2N<5SeHOp5lzM>!1ee=MBb83V{N=zL0~@E-V%X>`-uS z7Lrnr*H=)Ne6)=7f>QNVEr~v4Q&sHHW2i(^aG>xHQB2O4EN%nU!<29ipM*LK^KFL- zrbWB@Jj3=v19351z^CYtYRuCP^naJdspW$VHcKP{%~%v%?4Iu);|j>bC-Y6E#!}p3 zDy?f{6x6nTLH#gd@o2=C;Thn|mUP(=(vAZ;8KebcpTz$3{s#K_Cc!K{?41=2sCS;2 zO$4<)WR*a%bBpH)xe2+jBb=x*#_anyOSRZA6KH(8I?Q$rQ?zAeB6e-5EOw03w3>>A zEZY`r%&oZu;I7b00bYB(z3qv7YR5WhJ>xq4nkjN1>V;F)$J94~#*bd~D;J#}gA*V_ zJV&|!yJ7ExZfFqFBM|y)m_zO4hCTR1{d)6{m8WSeFnkPUdv;^vpYTY=@AnA&wa*cP zqDXr}>8WQ}7WR{%%^Tlbd-SJRrB0~?B9xTtJi&ZaNw0LaA})}!P833v87Q$$n$T@E zg~D*0riY3k#{3k~s_gFgy0xBvoczCAU90__yb-b(&}DdCE{(X_X*9n#v-QM;O9TRr zMy!(is?t8*^sXxU7H!7=&&IR*e@3P{LeZLmRPL)I}u;S7@$9(HhXdzm&$iNO~4W> zLPKa>J)WHuySXH?BU~Ry<;G21d@D0;J;NorL6i55U?@`}(eo^t+FQo{CJNO8zzG1WSf^$ z4qO^l3DXfrV^$0L^Qu&fYGwb+uvN<$+LJsji4)R6do^$7#b13tCr0HZ_OT+WqXp>v zD~j{;rn5IR#8IYuy6P`C1o=OlZNp4@;)LQcOwQPU)(B=rk(vB*vmWTUJ`LFl z2g(hYHJrV%bU#QCOY4GAY%?q8k?-fPnzh0BS zb7h5hc>!3Of6sTB`}>tPT_tow@1|FkmyX&f#?PH8dMgGIM;+d!{vpRveblU`tCCzA z9ZL4npB5W*zF;e#%UdIg-0FR4-Oz}z3VwCiG^5eStZf=4b$R)2`=ND#=Wz!Sy)hv7 zc{_352iY73(aJyjHoBnXc{y&Ygz;^7%J7=BHriT>n}oS35? zyn1`7L6q%0^z%eL!q%4}xv`Syl;Y&~M34p|_A@+0Pv%TF7fr#%9i86TQ22*J-FFFf zy|-=d5`zo;7_X7irgu>=7>60$zUwNFL&)MTbmG+Wg(VjQ=(UAFGT^#o}e`+s0dXzGOZe>tzI4$|xT70vscf z$FJH?EZtZ1lK7wB#mD+Q_BwXlTnC-akq3x(6-`~dy&1d$`E3#2TfZM7p;Agal&eeI zyNq3vkNfxGqf1Q>VYel+_njijl*zV2)I`vR+6a^QOo~?z6WX5fL{C)7%Pt>N#eibR zJ|Eph+IPEw1q&~^`-U7N4~AEA;a9gf%9-)1u{xb(>3R%|H-gX1aX3DkBz(W`O0l@~ zo13k?U9cUAAvU$MIP!K)pTTc>5*sx(RCRau*nv4Y-Gip1S@}*XvlTx+U zhe3+rIDsD6Ohi2et0xjm^(y$YU5QW5LxPS1A7rODrcln3TUF<1+)PVKyc-COy zqpl*3O~PmYOm=KXG{Z-opFw%1IY*RtH0S4omXuu8nzOpT z)x|q2;g&Zb)!quwy3Hoi1w@2riz*;g6s<$H@T2FuF;uI^HLWku2W!x^mk5WeaG9&b zB=&2ye2HThr@iYG8FmH}`-vZ>KN-1QOT#WB z$)3J|*zqu#gy$81u_bb#fugd80iv>RRZpx0%F5)cOMrtf^lh-l4$wiG2$j}W?K=jU zt53Hn=e-wSZ@*=!^ip@OH|XB+CCFO9zltmHDqo>3?gIKG`2=WQoBBGG`kuVF?>r%y zJThurI*MK<&HNz@(D;3;$snmFu9R}GX+;NMjq+q2n@5pOUvDM7r#6`OzAXQ0^|zDy z4IaRAU1oO<4HwJ=)&)1FP3_j*B-+(nB%a;45_F|zd`taf%HoxfR_x`tY$*}!lCl$+ z1_36rp74(MAm}l$NVdmpm_IZHBM3RYoo3JuSa=>DZ5?``w+e&w6=RjuB-#GR=47G} zMS$#xqGj02SDaD=2Ocl&T-pr_e6HuPSvh(A)=n7w()h5boI7dA?wkzoFcNOYZFQ{2 zem(iuq~E;zaKV4~i^=1*YJ%opz`r23I)3~gxW7Z5Z%B}ct5qv&EnMiv@E`S}d(#t1 zi&8IeuB7NWkpx^KYlm8gLY-i{A1{ucy=^tRWAHF44}_n*c+7=0;3?>|~@s;Uzl0n9@Zz2evm z{=V8BPW{hPEd_{9?EN-U9%X|gNv-8SM)Z&KpWUnNNtJoe-|D6}mMQVhsRk-)3Q=+j zSs-Jk$RxiZ3*zk!k1|-BL~WzwP5Ugna$!*F89TkoF}aA^l~^k8lR;oU?m>ArmVHb6 zNTR*eAAWtD*sqkonkN}~^!H2-i%RvcoxC~>yP<&;t;x=jqY~St`-Eobp7WXwNq3`f z69%?YbAQN!MBSM=6!i+2~H@fz0MGZ3JLRK z%|)7J=MNBh~j(t zjlFk_CSMzGx|M?l+FyMoU^n9%=k4SzkQe~&JJrVu4-vDxd>%M2@HegRh@B#!`ERrY zV6qo%7Rky~o2wYWmP^pE{zz}fIq-poW6c;50Lt6!uKJTjKlEx)ez$$=r<{DD2Fe{g zcT1W238n1~4pygCCKzxfRPt3Rt*MUF&b0g1G3{&}woX0i@The(Nd$`h5z+Piij&Fz zA)9U@qHIJ1@ZsnL=h=xWsJ2&>edN0&CM)44LByl7T%~`*-23vapl{?c5*MKH0w6Z! zZx&JKg(@UB#~If1Img2Nd!A$NSR1r z97-+PCxL+z&`daX4N|H^Y97=q1fXTyOj)+;U)WC&1n}o{KZh#OlpB#pAQ&Ue&tCj< zMUVg|+P}KbQ9*tPf#9AWUh6lRN>r@|l-bu)%}_Kz>}p1qAA;ePXTZZB7xA%cBoZek z&vVbV?NrMS#d!hs?bRz~$lE|;5wSd)0UH#?k3hai2oojvF+x}bwmdI}jg8u@=EvKc zGLtD0vk=FV0$mB8$&fI7^pL{u+{ikE-TELUgQ9%TFO~zn;>LLk95KI*cC#LU0j`@P z)ShgGrlsBuVWRG~)0}!~eIAEzQPcc!eq6xfJ1B?306Sjvg1=gNZa#%B`&2bu6lySXhUGDux^6$S zJQPP;I`ceN2{lEq8lL|ld)@GG zUjDTcDR2#Oi`TN6lMGi0T0Gh>SgsV*hkSJ^?iYXDj-7K-nbcJOuuEUX@vkiJ>&SD1 z4*k~bR$?NdU+7|?;*X>L4q54P-_{ta>O*|k=Im*6eVuBPL^Dt$t$>Ie^gG&o3Aa&l z!&hDB8r@RzO^-)&R^N~?&2iF3+}>jdk1BtIC9dI)@FdL2#lQR5e?U9QKLF2G%@D8a z8R;OIIJxF;wm;lt%~%?lY3d}SDUDpYwoXGuo{0}eOwqga02XxtK4B&j!bU3dK$5aP*>aSw3xMf3}N&GY4L{HTP5shP9Umydh)O&e^`DoY*+faCtOLKcq3rFegK^hMplMpCfM8XWlUz?R#_jJZ&?^ptNc%F z%X}Wy-wEqS{W9sd?r(VLAcvd3_Eu3hV2hejFCJw~TI?{UKe5B3Hk^x}R$296Oz1cD z{*YD2Ncb86iRoAqe>Ha-)$Y>WD!F-=hL~`5Z75aQ8>7z9%CWQkC-nK45{*VM!kiVO(Pc-;4KHF&vODlDHIw-B05W&K4aIl4v(bymNi8vX-u}fJeugE_?1bDnn~OUI+HaFopKd`R#0PwFmt}$2qnc zZgod!BmK#fMkh?`mt?qchDdQ7$;P3LDHvx-AgQqjAx2plUO~*fn zf?CJ!j#vcuN4gS60o%qfp{sBqPKN|D)VVJlw-${mcBt6AUE`jHqwKyrnL-0LC8fkH zRps>MGq3-VRn(#9f^T73_!9&Z6&rgH>BYIawf(g;H3mY|8v52XLQLkp1$=WiflbjP zdn$&`d1MzVT(zql_M@H9PAuwCQ)++B{a`uH;=r+Rzwv{xz+HH`Kdy&LI-ulpHvi%( zr6XUr@)IkO?wiYaTp}B#s^$f_II19!h17}-ZpZtJ;fWHv4PB(|{}{*P`ewqRklLQe za@ia>Ape(LsF%E?&=yB6ZR(`Bt8g#-Lk--nzJ;}OUZ?i2p%#h{Yjyth31fQ!U&-*! zckiS#ltKe~b^4pBWy0t8JJz+En4iMRuU!(}4AN@?T9&ZAp{sW$d`k%NM?z2OK~cZPZ7dOG(o@6n9O~w}C9X6qH+z3;SGoV<6FDa(P7NHlZ|5xW9>r#ATS;{C1XdytKyJp5AfXGIN(rGzG{%Fp>ZW<~8agZW6hb9jA#x$nxcG))RmN*?E^% z!J@tY>{7K)pH(bv$F??Hhh>eP>3%9`qix!tl^b%UZf<|3Rxg8MCtlJEA@;14=%*s{ zhIOZDw#2E0J(=H-u#}B2^lNDPS@kTM*J%CU*3?ws1QS-@eA{w5VD`(QHwTzhY?6#!b* zUnMl9Efn=c?-~KUF&DxRmF_=Mr1$I+?!1mmJ!70*#2S>`sXt9 zmd!k2!YMoo2lmsp7G1mba9H{<*2))A%BWBOK9Y1aZJ(R>wHFbrTb7?q$DQRYoP^oU zUw!aqw8rxJx=`=?HHPj?!7%4ynql1aKn$*K$p#_*_I$nNsk|w$e_x{o_2SDWLf^NB zkCC=TE61?L7`CAlN0vAa67X#y_6Y_;Iw?;QB8R{z^eun|2~@iySoPz-qK;hLCm)>N z(NggC4K3g;<`2@le(av$bK;?5xm5GjL!c7+l;~V)!f*(${(b3-8DUX=W;*|$Z|LI~ z>ydex3%Hjo!gUxf+6?Q$#JoDplQ`^wy=m2_IFdo|5JlLUQH!MoHRw&K4?5&>&&TEo zO%ve@3}*7Ix17baKiihXhvY7$VFJpS7!bSJjkEkWcD50?1w(Hc=#5@?X8|aI)huu1 zapTi|;?Ix6>+vx&27WX+Ru`H83!=$t9DUPQKL6@N8AR5wOd5IguqRcYD~OCH&xugA zyNzNCpMTF*K}Bxlc04*;X4F&{=4vDg%a^}X@-6eZO1!p4v=BwqAy>sSyb+`q7w5ST z#A8(0!G~_6^;)vgpBbaX+6FZfKOjJzvn3>nkc-ox?Q6!1^(s_q-q=~QqK~SvXnJZRL5QbPGePU2 zg~)e}GtS249}qS$T9J4bMsg8HvfYEmoU`$2eS<+ZYS){BC<~_V9P; z)!feSYyep4G58QY(&g&$+P2I+rQ(K&J|6ERnkf z(sPq$_c;%){OdhIOHANcXp(5RUj66^=CtwjiV5%eudDmf73hT1hd2mHRc_$wOBax! z#bSheKsyx_ZXnPgdf6tEP5`U)6_&Szsg#}S=2}L+o6GO2B9tyej#%ZaJoMnqW@uWU zqZ1EW8BqaHfov2R+mm1snFMy)(c4+p)&(?u6&3I4uj8RZN>7njWnE8A`q>i3+Yo_K zGTLu(cI#I%)+7zuJltJ7+l!jh&%NhW6uqdSTS=Wm7Uv1|v9mUiodsDDmeez89R$;7 zYCRzV%g`=7^LV)}tWd8ErQ>M;t&71{T#_DB(amu!!4%aTHcU$*jKhC_dI)7Nu)(ea zwC55HyY9^(Znv50o=A8Ej9>F!+5R%)mM)mUFE&PE(ZWlkwdo?|8Xg0_6rzY2mQtL^_*5OCAQpWesisv_zF6gb&H z-(NmGGW~hpBUC0{YS2TquT#g7e6Q0kOMuM(S&%jz3VxnmFhDgmIqd!WP;(CaKGdP*Aim&vc`%=^%%{S+tA_+a!qgpi_^*gnYjMS*tF`&g@h0_CPdp0r^ z1}OPW{;Og5pW!9gg{vd=oO!i)P(o>QYRXaWEr2`?Fs`-?OqEtyJ9ho*8{qbI0ns-Y z%k#CsISkL&ahjrYkm5sQ&(qdgUN!{ZLZ3+#cSskaB#E+U@>dd)sxEPomU)0zNxIO zI%cikfaZn!dbB95ZjC#JPJaeIfK$rh1FIXu4=awOFDN2HWIG={P$T$R(*0YASV+@I zRml&Du&a$w*dkbO+9zq0LONUYSfnp{0R&s;YC=(}^@pI`Fu zAcyy`SJB|2!^d{H$Ff}wM`^c^&C&12rniO*9iK%Tus-W+uLLgFl5kl#zZT}q3lEvJ>@!1 z&HISmSU&Dpf?cu|cHKh*oe2w1t5Q_h>`eb=HaTM66x%)%gouvJmOid;1iN}cHY?uw z8@t6lWM1VUrwWcc zbHg%>nH(s;WvE|v1APbuUwoHvCi#;^A=?%8`pSRS$CY(b&wT<`JxAbpJ3zBr>o~G{MAodawXC$fr0i;BB*4*#MmM8=Umgc=G%wjF@?_uOjj^1 zY+`d#h_(kFB{H1)3+$a|0kO(?Bk9Vs08R|xNW57|(7T&(0msS4MUBL~ma;aa{=#}2yGHT;MqP-L$@H#k zBD;{JmCDtRAge|vacs)qLq${Dv+cc`yYjChDjxJS0a^CRSAloEIVLkM$Ge!hn$n&@ zxy6fiJ?qK!z#+gtCJSm-l9EeopWudlC=>HG_=Xke9|F zh?}_%q~;$ix}m@pnarkZpIV-dm4!ml3H8M5z>wW-+e};gN0&4Dkk&sfdW}54e~$`$ zJVQIg5%*61S{soNNY$@^JJ0p2+GgdD^_}a`005*GhbI;<-W{E7te>$xuq0?}%YOzw zwKQrAkGX@#?g=iv)5v3eF(M>^@h-LlvC%wlQjAbjD7>yma$ndyF zve3D0jk(`@*Rq1RC2DP8)D%;Y(jeC<>C<}^C+bOHSzBDk`v7jr`{b|n*Sn*F;-x=^ zx}akQQ@6@Ct^Qq{?|nFe^)KYYW8Z-G!}U{u$X_}k%33I(3a{)XmijYiJ!1c#(q6$H zUG_HVixhXX!$Hg8&Av!y)rg(_uTx7O48|w!7fTmM9Ar3sS`5~1<)NHA4skX6RI#!Z zW@&&D^X9Fv@e+LY&y-ZbJf!~_aEEQwUC^P|r!>oPCU=DgM>I*t{ZkJ2$>-*GOM7|? zSS=27&uWuH3_49FFa@#%H!+^d)-ZPB`KGQ?$c!JfJIN1r%^^-=qy2b-(f?D{FT|nj zNL3^1uA^Q3uW9|;Sg>QMo9_7PceDPK$6snv{3X9%=ETSW=#X+P@VmjX_gMvliOO(# zz>})Y*Q1p_(l1|aGnN2&(ecevZj#Fx>3UKNnLawoGn*Jw{5nIY zx?#aWHOTJzVsZ#o_yuKwy!PfoW#0V*g(3}26+yQb9LA8hRgzMXDSLUTL zulAIWMEK7eWxsNDQ1&&IlXqo3O20TM3ZLv=GB=Wy!>Upx0hBeFKEDE9 z+$kP$K*YHo7HOU-5RY4X%Kr#Tu3y@S3OZZL=OkBr&_esL^G9AD`wxWE66R-2Ieg)?-x^`8yu@H}?uo%$5 z#ehH?GHdv)!d@f!O<}vv3uNc{q__LhbB_@l8O_C23-ER94(cEBB0dfI%?P@0LX{0T z70sFTzd)b4M8AiC9;^wOf0!<~E!jtvqfC)XS*oa6bi`tIGDRnKSEcmt$c9B*!-#nD z@zb6w?+rt4W+iTfh6&`#Ro0FJoH zi&dd}^Ps2vJmt!zoG3*_VC=cBY^+Y8jrbeob1m0nhzY!}wxI|*M>!ggjPs}a4#5>C zd|WD2)RV8IuU7qXn``;Gmq_TBuOHzApzR92$rss1CT^h?b-OnZdxXuGDG<}4HeiIP zY@gtj<@~qs-&hK_*0J6T@nrzECw80_$Phg<0!}%M?6fim335dP`rPuw$!_hK8LES* ztb<+S$FM6#rx**57OjS+GpOTZ?CxjRMd0JLS$+^-*`v%1HM+<*XD8ZIp40GNVs)lv zKglHl#cuCO&vk|a0$>WG$j4Ng$z7T>%kGfSZpI_$%MB$hQOa1I2cHQO3-R&B!;E)9 z?*J-6%hv-RhRe@{XZ*mlT#WVlltRDE+;e@TcAvg0?)5mqSyw?3A4!NdVyEeWrlyws zO_X_H(3_SuVkr`rMOTVPa2Cc$ysYN@g9-Su8F)4Ud=WH2RO@pCZSq6!GV+4h0WmuC zGD$B0fTsh0-v!WNILQ)BhQ%YRNue)JSgV(Flsn`o%Ce5S?soIHWqE@F^e)yqMYG?( zVaUpwp8TztaX+N?gI|Jo>Rk|Xjt9#-ycHRVt&gGsT#^`7i)S!v&rkg< zr(Q^a>SzD29EcT~h`Is6)PY{VxtPDbT>Nyx3x6?2dZW(_m)DS+x_Stn@xHsOT;gLX~a$^z@s;X7t^ zl?MDBo*lmTOTLm3kQNP~W)@7PLvO}d=}ru73l`Tv7-T^(ju$)howjS)a1H z-nB((`DS!G3$kQ%`=#s0haMd;YF3vX+w%LL7c(*BoTK9-vU|_P}EOiDzn@Z-?`TW&f z@sUvhH8;N0dsK;Rh`0Up+c?9(Yf|A7Vtz>drgIIEt*>;S+o-OV(LCR?x>#w~w0on~ zn>Esmp8&|=rq;dHmP-q;j+!bB;IB*INiCpnv`b%~{2dD&4OLz-ax?6gz)}(NA5RQw zTG&@pG%>b&+O=l-yHs{-^y(DCG+WXbRN ziJaw|5##9x)kTBxK5d3N3^BJ4hq(o^2Y-QL{u)ujUA+#L;FMlXI|2}bF1<%J>N((FeLU~g2T3CO$j6MiPoJ*(h3FX_MKvvs*Wy>>Yu%kH*Pd2(}0(ROuTi=U_C8~b#h*(l`^OYhcoQaLKu_SkVY zkI^JT8~J5Xm5o_`4{q7hIX{=|i5#!~IFV_6q2QhSpg#i$yN=aa^X9XY+dgu@@$g1Q zPDg5BcNMx|U^k}I`ni?W@X8_mdvQdoJYufDYa%@PYisV8t>>S>O}P+{vy0VFQQ)?R z0uUsr^Ws#DFih<;>IY<3+XZPm@*ft8fw=X}!BuC?h;8=wLJ$J^(yws=h8E z@m}aKbDPo%`u&x2gY$B*KIm}nhR!}4u&d=&nS8V0>Q-)yo+V=TU2qNWuR;oo^?XAM z+4A8_!u!6aSyjrY{o>+8K~Ggc9-ZMn1?_;=YKxf6%`l)r z7|34pThGdp*(S@tWYR2=`h3+y)P1XJc%;^yqGz4NS3Jg#WCQq=G(5j=064CGlE0QFDAkZMhg#<_vw4Sv1YW?+u zY_PLYU5dT1nfPC!)$pJe+AJpckt*v!+~+}*^7ef!+~T_6{OVp7tqIZi)%<3nBl*Z$ z!yyCkCDGMF>H$W%u_qSNb~g7m)ZXCy3Vn}1p)Q8iQ&K+2@7v)zG+tmH82;n#e9$qX zZFve)wJPnGK@A-D2^Cb-))xB7z~Y4gL+;hX-&JW@09O%P^*C8Yc58Lm?Zq+T1el9u z0w^TxZ*zh?keJm-ULVihqn2@Dvt6*D?W%of@wo$2xioKfWh0v_Pm(6z>2(yJr*Hy9MeJKImn@7a7w{WS zko8N5fg!1(JxK((JAh6K5A~9VDlg)yBs8kp&*%!Q)!a##=6B71ggS`w=|;Svb^zF8 zYAVzQS6c-^n8r zYb1B=n$S0QgWdO6CnGvRE1m5wuSkAw25PXj~`K|NV6x;hs&i({R+qIa)U#{1_U&il3Ve{s0 zavNRw3yKfJ+kQ<2+gN4db&(3QWE8~a4D&4@j#=w$7d8mvjPC;Or!A%`_|fv(c`3D% zVI{MLRCU-p1j&Ac-#BrmwacoS%DsEo$jZ1XMhkyd*lRvMe-V&IQ;$pxYlrMZWhcAm zG#@8clktLiu8fHLOQ@e47dt;AH7(CW>UDj9lD}B74=EVAWSAYUuy=WIkGcGV5518+ z!*M+aPZv~-HBJ$L0ybE4yufENQm8?@tWXCWw9m%yD-#b=zUT7h^J1N_)=VG}NHW@C zAnte)bp8s)yS8ZhXi{;>oHuqIbjNyCJB@bV2fUK0!I4G0$PK_-0-=AjTmoWntbP}q z+vgk4S;Bp8Q2c8>bUT^S**r6X44oh5rY$9k;3vtw~`<%z$6C&drZ{7H-(%l5PXAj(iPR(4{l#mkqpvV(UIS+?GnGr~px`Prs7?eq z2_FP~LW8vB!Bz9o%iu8ix$L&!?$wDP=+%LzFz}`pL}SL*FG?$J4r( z@r&t}iK(M{Qi9xV-<#3w9n#;Si{GB2jlDiTcLX6qpg2tP7IXKDS9jRVNb(E-6;Qg( zkiqHo2KDfHboIAO6+TFb?Q?tLMbR7lWh?SD{y-Wu%`v1}1Seob=$5uCXTRU#fbq9x z=gHCJnrz*U?8)z2@i^IwQxD$ez+rO0+Is8$vW=(Rt)Hw616+hJ%ws z1dVVSmS!OI)t$5UU6p&WCZ!ijFgzU6OUc!cDy`q1dCRe7T3@PBn ztO=j-&R+4F@yDZYG-(?#$)#dnD*l2Xy~crVhAz#_n==>*L&DAR;Mh%F`q~@l%s;g& z@q|v>{uY~k(7;Rh9Jnrs-lg?-tyii>vf_s^x?Hd$_=ZAyd1qkbduFo*CVaIUIjJ>k*(0sL6iQCfC<1FWg$0JM)51?&zd zGnn7TB*y%jb4EoD)*8pv{cKDmq(C$1#*}l)rn~H z9r1Ahw(p5^sd>#kb|r|QJ!3d|)^?$?!&HzT^kuY^x^Dd@W`dFjhXv3d`x(`}N3aZ4c-s`OK);D z#1~9yR|1yc8vbaR+cjReXvwVa1*_~i^anaM*g#6*Jp^8b+TU%ZHE6ryJ3xhvH|F=s zK2uhxMp0qK+>!Gi!d#~b-nKVN*23I_>b5h=hA?+Dg*hA4BW*3)jk>Kx!~?NFigtvy zR=Gg1>=!bntZT=mRuv)-ytS^?84dh; zEn?RCz6R8}HLqH)U`V+zON)P`cUz*z-2Eq-7406QCzW-SXsZK!RLYO~qyUQU(JB|2B^BihOX;MzT%)hRNv7gN=8yVt z2AoDXr1+zaXjtu=BbX!RwQrv*?!RYm|K%6nPgAtQYrKE{XXE{Bccbv}mwW&Ahnna7 zgYtyC|DSm1`FjS*mA~N`0Dx81d#bG3^ew+oR=k!9Q(BtAZYEP_T+r4C1!>Jui{INO z<#CE1zTOz&E3p<+Lu@GnxX%CF=g&>#RNn`Jcl(>ydwoXw>9VYz>gV=zMw$S=_uYf1 zF1`HxF}kP-uK`mLTESFVOq@<9woPR982?YrgovyZ7JMd`8WW;=VKF!Ra94Ly+z zpz!f+zCZZ%kG7@w@q7NJ_&45FRI8`*kADu*8tDuG%Dr~^RJ(^?0fxm23r%H$bTlKW zt*ky76}ZYkjB>rtI5mu|vmcES+YAScK(Q&l|D&q7xOpX*b1{k4b{_E&A3o!C{|65h z*I(WIlzWu@)$MM4_h0SkiMF0GsmzI!i6AL{0*!aQ59?53FJa>y zLF(HBaNqiNubBWs3OBXJAK!R+?fk@V?&ZPYxBU1y??E~PXqM43&?>7ZMneYF*qOcl z@jG54)dh9JHI@~fHj`q6Lfy?iH8kkRPsV~hvFbNMtBJ(l030w^T+?dqB5Tq{+~NhE zFMRoY@mDXekM$Ma5zY6(@CmQ|{uQ6Tq-?;bs_N{k-R@1JUjM_~SZ4rGpc@QNwaW4s z=%nD7p~YGw8&v$h@G~3nVDGD0dI*Vnh@re0kD z&Gmj=Rz~DiF0le8e)w-a4Y~ z>6t}1^N=EEn4?)Cs6rGB1d1lB2*h{fzfb=zrauhXEd3e4O}#JCk91!7dUr>T_8LL+ za*t+WbK6ng{L3wmJpsJ(`!B7%?a|v$mt}dBjZt02(jwY7MlF8PQPmzjO`^(wrmWUi zUj6uAuENh-|A*UNY!xN_rJ>k`#Fw|>FhKj_SN&J$KETC`%>%}ef zM%jK|@TT53zt!8dqDSuW=ehA0dYilaTN{bpZug1JSlCnryz;v*tz7%)?Q8UFqeVDP ziV=*u;s+lK$>Q-xX+P~5&de6T3qeFC*??0^{+o>pA_Opl2wCGZR zeW^o{<){2$*Wtjt=7zcAgYVsY@0H`u{kOi|EncP5`yal(`HyQ#N+-H$j`|Z#C!Wfk z`s7ERe`K>(H+}d+K_B>~+a4)f#mQDLOai@%Zr&BWXL{#aE8qF}f5H)eTb8O@Jko0y zFVO52CLi%KQt`V9yAL!+{mmwD zfZkS){xG@eGXNjYmA`OD=R3dmrEM#C?+f(8(Zz-0vO_Pl@V5$R+30#77+zfQ>!r&P z`aAKr-n8j?P%ZE1b`}a=6N2aZ@4E9qapds4vYPFLGO*R7Kf;*E$luB0N6_V4FE~l} z0Tw}zTl{)CpmV`r(qEaK<_Q32DBt;RZ|aZm*cbVN-|gQ|6YQ*?VdedrhBlq;p55xv zAN`of1hA6{S@@aTkC$a}6h22f^+$IU{IuMq-)sV!>-^1TZah64{a@{MpBzuC9z8P?02Tit{e8lx(T%+L zT`k968WZ@yHkK!dew}Wf;ktUee{T*SfAdcY(Iv9e9YU(qMYw3^W)Dqdg9)=6RVW)Q|H1NQ~`LzLG~ z@GM}j7Q5w`h^Fv;Hg<-t%4+2kfB*BRCgp7=CV+*XIee1pwd2Y?7QYm`B}Cf1p_Pe^ z05S@6J~>Ng0socWkbB4VZ|Tslh)&qs z3N^*c9o7n_h91$4<%t@7W(glZ6aMUTKQ7++j(NUTN1>lROK;QdvqH}Y5gzB=LC^7< zAME6r*||18_4PNs&HdnKSdIjk;bG+g=H6u0~ z>E6`C3p_W`k9BUL8+(^t)ckCExA$^yy?XeQ4?ll;(s4}h8311PDT+nzFcqoQsSzX* znm4pEkrB|20%pgiQ(!O6iZY-#_TF*B;7g$58o#B%)hReQ#Aqbb$?mnd4H@? zU#yNEr}$0Hh`LnlA09rp{f?XFi<{{Wr8dj-W`KX}vklk%zQQ^aFx}K^ew;J?`(5t(PxP68U9YER0$5nS z^#uLMr(<<$1cfa$Z)jyABha-dV0LUeg}M~%T^{b_Ux!nCD*WaV-fZpX)?Dl1(;t5R z>~=>z6%znm_b=1Wdmq!nO*+j?so~n9j!dsFYWuGEQS?{RDgN8(jmG8_KN(3g)96;c z$N%pSe|~i*0;ZeoySps>qgy)Ffw?nu^k0aFc8bX=m`I_G$ktBOhO|Li2`JCNcuuhyrHErcwn5vJVF(MLxW!L$xagdZOkC-^JOc{Wbmd*EDbE&Gz0L96f&H|M3a` z&}Xo>DA~0MV7=8|NSsR*Yhm{nHE}Wwy3vn|otsq(FX&uzeY?1UZsav@=FRF}96j!; zS3L2FhbH$M|It0~;;X=OKX`MME&e8T;>U|QS6tmHuBPAEH;?Ofa^y{q zFZ{JE`ibwhzw9%t$GiR*kS2lUR#~2`KcW*?1iXn&;}7fHG|6yU|JJKe@N>o6u4y$# z`DxlYyATVCpFZsQ;C8;}KT5ZDeF8v`m;~rWAbj>KE^edF@M-MHzOXJINP00edMKcY#XjmrV5ZYglycp5-ygPf+NDfnsH8`B%hG!;Lx zG&K_dg5gPk{?;I9Eq<$aBOu-V1>eV8SP0kf&EvV<-ygFO!L$`WayC^H00O#*&IDSR z1gPMx=8XVi=NH_tyX3O6xa_ia@iw|~*Zi<%=l8*$@L2U8`S?e6=W*Yl{7u~ifIu+` zlx1~-=BM=c0fTxmLB22c%P(s+&*3MS+kI_n3X326V=5;A1a{GXcT1<7Z=K;u0E`JQ zc*E`@DsY^}U$)RLE`Ced6#Im8+?bOLOlk2Wx~ZK25Zt6D0bH+Ncwt$*g}!ck4Sn|? z#om1B78!1qZO_0I7eD$w)e`^$9CZ@Fsr%f)qPXhHb}@gTEO7dMYmqlc^L&>!?cL76G~VqWl#`j5 z01*80)AudSwX3J;g(3Uxz@Sbw{3Zjtm4R6*e&lFo{^ZN4ho4))+fzvJZtdL0ZqRGGx zXCQpc~>=AW_JRR6#UGm?|rOYw&<e*BlG^zlY8ay-l)5D-%S9T7=BXFs!o)xvZK6ayZ;8y zk}|_A{9eD??LKkp;nlSn?#8x+-b?^P(ux~}?RNDjoe>-z0&7H5nt`V9H{LPL1h8?A z_(h`T(qM!{O#y^|r(YDOnAF zZDEj&soG2cVBdBlk8_^K>cso-C13VvIM(AdVC31IA$?VJLhEG!gr9hnr4(C5w< zi(b*0)=LL|8K+gO7QJ${SM$X<+)7N!&Ze&c(Q!@cfE|)uINhgMOQ7!OOhO)S{ zXjS3ECfhhc;5YPTyIA9ncFSk6#nHW6lxLel=d8@!s+j<0ZkLT7Fm5^)#T@-hm-%*Y zv8q}LUkf=!7RA|OeYLqMmuIDEHyLO$&}3i_WZ?e?o;67bWbOl700000NkvXXu0mjf DWAE+r literal 0 HcmV?d00001 diff --git a/.github/scripts/sign-notarize-osx-distro-file.sh b/.github/scripts/sign-notarize-osx-distro-file.sh new file mode 100644 index 000000000..ce678e183 --- /dev/null +++ b/.github/scripts/sign-notarize-osx-distro-file.sh @@ -0,0 +1,48 @@ +# Takes a .tar.gz file as a parameter, entitlements.plist file path and icns file path +set -e + +file=$1 +entitlements=$2 +icns=$3 +filename="$(basename -- $file)" +dir="$(dirname "$file")" + +echo "****************************************************************" +echo "*** Processing : ${file}" +echo "****************************************************************" +destination_folder_name=extracted_${filename} +echo "Extracting archive ${filename} to ${dir}/${destination_folder_name}" +mkdir ${dir}/${destination_folder_name} +tar -zxf $file --directory ${dir}/${destination_folder_name} +echo "Successfully extracted ${filename}" +echo "About to sign OSX .app file: ${dir}/${destination_folder_name}/SpringToolSuite4.app" +codesign --verbose --deep --force --timestamp --entitlements $entitlements --options=runtime --keychain $KEYCHAIN -s $MACOS_CERTIFICATE_ID ${dir}/${destination_folder_name}/SpringToolSuite4.app + +cd ${dir}/${destination_folder_name} +echo "Generating dmg-config.json..." +echo '{' >> dmg-config.json +echo ' "title": "Spring Tool Suite 4",' >> dmg-config.json +echo ' "icon": "/Users/aboyko/git/sts4/eclipse-distribution/org.springframework.boot.ide.branding/sts4.icns",' >> dmg-config.json +echo ' "contents": [' >> dmg-config.json +echo ' { "x": 192, "y": 100, "type": "file", "path": "./SpringToolSuite4.app" },' >> dmg-config.json +echo ' { "x": 448, "y": 100, "type": "link", "path": "/Applications" },' >> dmg-config.json +echo ' { "x": 1000, "y": 2000, "type": "file", "path": "'$icns'", "name": ".VolumeIcon.icns" }' >> dmg-config.json +echo ' ],' >> dmg-config.json +echo ' "format": "UDZO"' >> dmg-config.json +echo '}' >> dmg-config.json +cat ./dmg-config.json +dmg_filename=${filename%.*.*}.dmg +appdmg ./dmg-config.json ../${dmg_filename} +cd .. +rm -rf ./${destination_folder_name} +rm -f $filename + +echo "Sign $dmg_filename" +codesign --verbose --deep --force --timestamp --keychain $KEYCHAIN -s $MACOS_CERTIFICATE_ID $dmg_filename + +echo "Notarizing $dmg_filename" +xcrun notarytool submit ${dmg_filename} --keychain-profile notarize-app-dmg-profile --wait & + +#echo "Creating checksums sha-256 and md5 for ${file}" +#shasum -a 256 $filename > ${filename}.sha256 +#md5 $filename > ${filename}.md5 diff --git a/.github/workflows/gh-hosted-eclipse-distro-build.yml b/.github/workflows/gh-hosted-eclipse-distro-build.yml index 937f15275..f5c97d17f 100644 --- a/.github/workflows/gh-hosted-eclipse-distro-build.yml +++ b/.github/workflows/gh-hosted-eclipse-distro-build.yml @@ -89,7 +89,7 @@ jobs: AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLS_S3_SECRET_KEY }} run: | echo "Uploading Win Zips to S3 for signing..." - aws s3 cp ${{ github.workspace }}/eclipse-distribution/org.springframework.boot.ide.product.${{ inputs.eclipse_profile }}/target/products s3://dist.springsource.com/sts4-distro-ci-temp/${{ github.run_id }} --recursive --exclude "*" --include "spring-tool-suite-4*win*.zip*" --exclude "*/*" --no-progress + aws s3 cp ${{ github.workspace }}/eclipse-distribution/org.springframework.boot.ide.product.${{ inputs.eclipse_profile }}/target/products s3://dist.springsource.com/sts4-distro-ci-temp/${{ github.run_id }} --recursive --exclude "*" --include "spring-tool-suite-4*win*.zip" --include "spring-tool-suite-4*macosx*.tar.gz" --exclude "*/*" --no-progress - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce with: name: s3-dist-path-${{ github.run_id }}.${{ github.run_attempt }} @@ -97,7 +97,7 @@ jobs: retention-days: 1 - sign-win-executable: + sign-win-distros: needs: eclipse-distro-build runs-on: self-hosted steps: @@ -137,10 +137,65 @@ jobs: echo "Removing old win zip and self extracting jar files from s3..." aws s3 rm s3://dist.springsource.com/${dist_path} --recursive --exclude "*" --include "spring-tool-suite-4*win*.zip*" --include "spring-tool-suite-4*win*.self-extracting.jar*" --exclude "*/*" echo "Uploading new win zip and self extracting jar files to s3..." - aws s3 mv . s3://dist.springsource.com/${dist_path} --recursive --exclude "*" --include "spring-tool-suite-4*win*.zip*" --include "spring-tool-suite-4*win*.self-extracting.jar*" --exclude "*/*" --acl public-read --no-progress + aws s3 mv . s3://dist.springsource.com/${dist_path} --recursive --exclude "*" --include "spring-tool-suite-4*win*.zip*" --include "spring-tool-suite-4*win*.self-extracting.jar*" --exclude "*/*" --acl public-read --no-progress + + sign-osx-distros: + needs: eclipse-distro-build + runs-on: macos-latest + steps: + - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 + with: + sparse-checkout: | + .github + - name: Create Keychain. Add Mac App Dev Certificate to Keychain + env: + BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }} + P12_PASSWORD: ${{ secrets.P12_PASSWORD }} + KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} + run: | + CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12 + KEYCHAIN=$RUNNER_TEMP/app-signing.keychain-db + + echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH + + security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN + security set-keychain-settings -lut 21600 $KEYCHAIN + security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN + + security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN + security list-keychain -d user -s $KEYCHAIN + - name: Unlock Keychain for OSX signing + run: | + security unlock-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} $RUNNER_TEMP/app-signing.keychain-db + - name: Install appdmg + run: | + npm install -g appdmg + - name: Setup Notarization Credentials + run: | + xcrun notarytool store-credentials notarize-app-dmg-profile --apple-id ${{ secrets.AC_USERNAME }} --team-id ${{ secrets.APPLE_TEAM_ID }} --password ${{ secrets.AC_PASSWORD }} + - name: Download OSX tarr.gz files from S3 for Signing/Notarization + env: + AWS_ACCESS_KEY_ID: ${{ secrets.TOOLS_S3_ACCESS_KEY }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLS_S3_SECRET_KEY }} + run: | + rm -rf *macosx* + ls + aws s3 mv s3://dist.springsource.com/sts4-distro-ci-temp/${{ github.run_id }} . --recursive --exclude "*" --include "spring-tool-suite-4*macosx*.tar.gz" --exclude "*/*" --no-progress + - name: Sign .app, Create DMG, Sign and Notarize DMG + env: + MACOS_CERTIFICATE_ID: ${{ secrets.MACOS_CERTIFICATE_ID }} + run: | + KEYCHAIN=$RUNNER_TEMP/app-signing.keychain-db + files=`ls spring-tool-suite-4*macosx*.tar.gz` + for file in $files + do + ${{ github.workspace }}/.github/scripts/sign-notarize-osx-distro-file.sh $file ${{ github.workspace }}/.github/assets/entitlements.plist ${{ github.workspace }}/.github/assets/sts4.icns + done + wait + echo "Done sign and notarization" cleanup: - needs: [ sign-win-executable ] + needs: [ sign-win-distros, sign-osx-distros ] if: ${{ always() }} runs-on: ubuntu-latest steps: