From 350778aaf12726893d5c975e39be4e0f7b5050ca Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 10 Feb 2021 14:16:17 +0100 Subject: [PATCH 01/18] Update to 3.7.0 upstream release --- .gitignore | 2 + gnutls-3.6.15-gnulib-perror-tests.patch | 46 ------------ gnutls-3.7.0-gost.patch | 12 ++++ ...xes.patch => gnutls-3.7.0-test-fixes.patch | 72 ++++++++++++------- gnutls.spec | 14 ++-- sources | 4 +- 6 files changed, 73 insertions(+), 77 deletions(-) delete mode 100644 gnutls-3.6.15-gnulib-perror-tests.patch create mode 100644 gnutls-3.7.0-gost.patch rename gnutls-3.6.15-test-fixes.patch => gnutls-3.7.0-test-fixes.patch (73%) diff --git a/.gitignore b/.gitignore index ea6a2e0..7137263 100644 --- a/.gitignore +++ b/.gitignore @@ -129,3 +129,5 @@ gnutls-2.10.1-nosrp.tar.bz2 /gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg /gnutls-3.6.15.tar.xz /gnutls-3.6.15.tar.xz.sig +/gnutls-3.7.0.tar.xz +/gnutls-3.7.0.tar.xz.sig diff --git a/gnutls-3.6.15-gnulib-perror-tests.patch b/gnutls-3.6.15-gnulib-perror-tests.patch deleted file mode 100644 index 5de2e14..0000000 --- a/gnutls-3.6.15-gnulib-perror-tests.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 175e0bc72808d564074c4adcc72aeadb74adfcc6 Mon Sep 17 00:00:00 2001 -From: Paul Eggert -Date: Thu, 27 Aug 2020 17:52:58 -0700 -Subject: [PATCH] perror, strerror_r: remove unportable tests - -Problem reported by Florian Weimer in: -https://lists.gnu.org/r/bug-gnulib/2020-08/msg00220.html -* tests/test-perror2.c (main): -* tests/test-strerror_r.c (main): Omit unportable tests. ---- - ChangeLog | 8 ++++++++ - tests/test-perror2.c | 3 --- - tests/test-strerror_r.c | 3 --- - 3 files changed, 8 insertions(+), 6 deletions(-) - -diff --git a/gl/tests/test-perror2.c b/gl/tests/test-perror2.c -index 1d14eda7b..c6214dd25 100644 ---- a/gl/tests/test-perror2.c -+++ b/gl/tests/test-perror2.c -@@ -79,9 +79,6 @@ main (void) - errno = -5; - perror (""); - ASSERT (!ferror (stderr)); -- ASSERT (msg1 == msg2 || msg1 == msg4 || STREQ (msg1, str1)); -- ASSERT (msg2 == msg4 || STREQ (msg2, str2)); -- ASSERT (msg3 == msg4 || STREQ (msg3, str3)); - ASSERT (STREQ (msg4, str4)); - - free (str1); -diff --git a/gl/tests/test-strerror_r.c b/gl/tests/test-strerror_r.c -index b11d6fd9f..c1dbcf837 100644 ---- a/gl/tests/test-strerror_r.c -+++ b/gl/tests/test-strerror_r.c -@@ -165,9 +165,6 @@ main (void) - - strerror_r (EACCES, buf, sizeof buf); - strerror_r (-5, buf, sizeof buf); -- ASSERT (msg1 == msg2 || msg1 == msg4 || STREQ (msg1, str1)); -- ASSERT (msg2 == msg4 || STREQ (msg2, str2)); -- ASSERT (msg3 == msg4 || STREQ (msg3, str3)); - ASSERT (STREQ (msg4, str4)); - - free (str1); --- -2.26.2 - diff --git a/gnutls-3.7.0-gost.patch b/gnutls-3.7.0-gost.patch new file mode 100644 index 0000000..7cad9b5 --- /dev/null +++ b/gnutls-3.7.0-gost.patch @@ -0,0 +1,12 @@ +diff -up ./tests/gnutls-cli-debug.sh.gost ./tests/gnutls-cli-debug.sh +--- ./tests/gnutls-cli-debug.sh.gost 2021-02-09 13:28:46.528821113 +0100 ++++ ./tests/gnutls-cli-debug.sh 2021-02-09 13:29:18.851646678 +0100 +@@ -217,6 +217,8 @@ if test "${ENABLE_GOST}" = "1" && test " + kill ${PID} + wait + ++ cat $OUTFILE ++ + check_text "for VKO GOST-2012 (draft-smyshlyaev-tls12-gost-suites) support... yes" + check_text "for GOST28147-CNT cipher (draft-smyshlyaev-tls12-gost-suites) support... yes" + check_text "for GOST28147-IMIT MAC (draft-smyshlyaev-tls12-gost-suites) support... yes" diff --git a/gnutls-3.6.15-test-fixes.patch b/gnutls-3.7.0-test-fixes.patch similarity index 73% rename from gnutls-3.6.15-test-fixes.patch rename to gnutls-3.7.0-test-fixes.patch index 7bf84c5..066feb4 100644 --- a/gnutls-3.6.15-test-fixes.patch +++ b/gnutls-3.7.0-test-fixes.patch @@ -1,4 +1,4 @@ -From c2e39386e5df376620264b820fde2994b12d035d Mon Sep 17 00:00:00 2001 +From c815f725448af8d023818a968e1296946ceb0f1c Mon Sep 17 00:00:00 2001 From: Stefan Berger Date: Mon, 21 Dec 2020 09:36:47 -0500 Subject: [PATCH 1/2] tests: Fix tpmtool_test due to changes in trousers @@ -14,7 +14,7 @@ Signed-off-by: Stefan Berger 1 file changed, 27 insertions(+), 10 deletions(-) diff --git a/tests/tpmtool_test.sh b/tests/tpmtool_test.sh -index c6e4bc42e..137552d62 100755 +index eba502612..77fe17e59 100755 --- a/tests/tpmtool_test.sh +++ b/tests/tpmtool_test.sh @@ -138,6 +138,7 @@ start_tcsd() @@ -76,7 +76,7 @@ index c6e4bc42e..137552d62 100755 2.29.2 -From 40203390a48b8fa01d72c6a9739d963cf24556b8 Mon Sep 17 00:00:00 2001 +From 2b0f6f3a2ff13153aaa70c764ba7a8b90aef794d Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 28 Dec 2020 16:16:53 +0100 Subject: [PATCH 2/2] testpkcs11: use datefudge to trick certificate expiry @@ -90,28 +90,11 @@ https://gitlab.com/gnutls/gnutls/-/issues/1135#note_469682121 Signed-off-by: Daiki Ueno --- - tests/scripts/common.sh | 5 +++++ - tests/testpkcs11.sh | 12 +++++++++++- - 2 files changed, 16 insertions(+), 1 deletion(-) + tests/testpkcs11.sh | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) -diff --git a/tests/scripts/common.sh b/tests/scripts/common.sh -index 6ae19fa58..69b5fd612 100644 ---- a/tests/scripts/common.sh -+++ b/tests/scripts/common.sh -@@ -187,6 +187,11 @@ launch_bare_server() { - ${SERV} $* >${LOGFILE-/dev/null} & - } - -+launch_bare_server2() { -+ wait_for_free_port "$PORT" -+ "$@" >${LOGFILE-/dev/null} & -+} -+ - wait_server() { - local PID=$1 - trap "test -n \"${PID}\" && kill ${PID};exit 1" 1 15 2 diff --git a/tests/testpkcs11.sh b/tests/testpkcs11.sh -index 9458af238..3d74bfea6 100755 +index 38b9585bc..09a627477 100755 --- a/tests/testpkcs11.sh +++ b/tests/testpkcs11.sh @@ -67,6 +67,8 @@ have_ed25519=0 @@ -144,8 +127,8 @@ index 9458af238..3d74bfea6 100755 echo -n "* Using PKCS #11 with gnutls-cli (${txt})... " # start server eval "${GETPORT}" -- launch_pkcs11_server $$ "${ADDITIONAL_PARAM}" --echo --priority NORMAL --x509certfile="${certfile}" \ -+ launch_bare_server2 datefudge -s "$TESTDATE" \ +- launch_server ${ADDITIONAL_PARAM} --echo --priority NORMAL --x509certfile="${certfile}" \ ++ launch_bare_server datefudge -s "$TESTDATE" \ + $VALGRIND $SERV $DEBUG -p "$PORT" \ + ${ADDITIONAL_PARAM} --debug 10 --echo --priority NORMAL --x509certfile="${certfile}" \ --x509keyfile="$keyfile" --x509cafile="${cafile}" \ @@ -171,3 +154,42 @@ index 9458af238..3d74bfea6 100755 -- 2.29.2 +From 5a64e896a56ef602bb86242bbac01e4319f12cbe Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Tue, 9 Feb 2021 15:26:07 +0100 +Subject: [PATCH] tests/gnutls-cli-debug.sh: don't unset system priority + settings + +When the test is exercised, GNUTLS_SYSTEM_PRIORITY_FILE is set in many +places, such as TESTS_ENVIRONMENT tests/Makefile.am or a packaging +system that runs the test in a restricted environment. Unsetting it +after a temporary use forces the remaining part of the test to use the +default system priority, which might not be the intention of the user. + +Signed-off-by: Daiki Ueno +--- + tests/gnutls-cli-debug.sh | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/tests/gnutls-cli-debug.sh b/tests/gnutls-cli-debug.sh +index a73910dea..3c3e2214e 100755 +--- a/tests/gnutls-cli-debug.sh ++++ b/tests/gnutls-cli-debug.sh +@@ -184,13 +184,11 @@ cat <<_EOF_ > ${TMPFILE} + tls-disabled-cipher = CAMELLIA-128-CBC + tls-disabled-cipher = CAMELLIA-256-CBC + _EOF_ +-export GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}" + ++GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}" \ + timeout 1800 datefudge "2017-08-9" \ + "${DCLI}" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!" + +-unset GNUTLS_SYSTEM_PRIORITY_FILE +- + kill ${PID} + wait + +-- +2.29.2 + diff --git a/gnutls.spec b/gnutls.spec index e2bf429..adba8c2 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,10 +1,10 @@ # This spec file has been automatically updated -Version: 3.6.15 -Release: 4%{?dist} +Version: 3.7.0 +Release: 1%{?dist} Patch1: gnutls-3.6.7-no-now-guile.patch Patch2: gnutls-3.2.7-rpath.patch -Patch3: gnutls-3.6.15-gnulib-perror-tests.patch -Patch4: gnutls-3.6.15-test-fixes.patch +Patch3: gnutls-3.7.0-test-fixes.patch +Patch4: gnutls-3.7.0-gost.patch %bcond_without dane %if 0%{?rhel} %bcond_with guile @@ -158,6 +158,8 @@ echo "SYSTEM=NORMAL" >> tests/system.prio # via the crypto policies %build +%define _lto_cflags %{nil} + CCASFLAGS="$CCASFLAGS -Wa,--generate-missing-build-notes=yes" export CCASFLAGS @@ -282,6 +284,10 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %endif %changelog +* Mon Feb 8 2021 Daiki Ueno - 3.7.0-1 +- Update to upstream 3.7.0 release +- Temporarily disable LTO + * Tue Jan 26 2021 Daiki Ueno - 3.6.15-4 - Fix broken tests on rawhide (#1908110) - Add BuildRequires: make (by Tom Stellard) diff --git a/sources b/sources index b005a4a..da7e44a 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (gnutls-3.6.15.tar.xz) = f757d1532198f44bcad7b73856ce6a05bab43f6fb77fcc81c59607f146202f73023d0796d3e1e7471709cf792c8ee7d436e19407e0601bc0bda2f21512b3b01c -SHA512 (gnutls-3.6.15.tar.xz.sig) = a6dbb6093fefddce4c76ce0015d1e0ff7bb712985007c5c6bd5ed6a8cd7529ab250bcbc98b70beeb9dc1b43dcfc65495c77b9abb43e690f24eb7bf0042af1f68 +SHA512 (gnutls-3.7.0.tar.xz) = 5cf1025f2d0a0cbf5a83dd7f3b22dafd1769f7c3349096c0272d08573bb5ff87f510e0e69b4bbb47dad1b64476aa5479804b2f4ceb2216cd747bbc53bf42d885 +SHA512 (gnutls-3.7.0.tar.xz.sig) = 25793ac5e3d2610f95f26a2aa6f444a0cebe45a173cd330ed95b38c82b8f469024c9fa35249917f6b880ae32192b5e74988169a68724c08f5c82a3379fff82fd SHA512 (gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg) = a74b92826fd0e5388c9f6d9231959e38b26aeef83138648fab66df951d8e1a4db5302b569d08515d4d6443e5e4f6c466f98319f330c820790260d22a9b9f7173 From 70bde1a03dde2a0335db58f9c2ce45b66f283967 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 10 Feb 2021 16:42:27 +0100 Subject: [PATCH 02/18] Tolerate duplicate certs in the chain --- gnutls-3.7.0-duplicate-certs.patch | 403 +++++++++++++++++++++++++++++ gnutls.spec | 6 +- 2 files changed, 408 insertions(+), 1 deletion(-) create mode 100644 gnutls-3.7.0-duplicate-certs.patch diff --git a/gnutls-3.7.0-duplicate-certs.patch b/gnutls-3.7.0-duplicate-certs.patch new file mode 100644 index 0000000..d86b855 --- /dev/null +++ b/gnutls-3.7.0-duplicate-certs.patch @@ -0,0 +1,403 @@ +From 09b40be6e0e0a59ba4bd764067eb353241043a70 Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Mon, 28 Dec 2020 12:14:13 +0100 +Subject: [PATCH] gnutls_x509_trust_list_verify_crt2: ignore duplicate + certificates + +The commit ebb19db9165fed30d73c83bab1b1b8740c132dfd caused a +regression, where duplicate certificates in a certificate chain are no +longer ignored but treated as a non-contiguous segment and that +results in calling the issuer callback, or a verification failure. + +This adds a mechanism to record certificates already seen in the +chain, and skip them while still allow the caller to inject missing +certificates. + +Signed-off-by: Daiki Ueno +Co-authored-by: Andreas Metzler +--- + lib/x509/common.c | 8 ++ + lib/x509/verify-high.c | 157 +++++++++++++++++++++++++++++++------ + tests/missingissuer.c | 2 + + tests/test-chains-issuer.h | 101 +++++++++++++++++++++++- + 4 files changed, 245 insertions(+), 23 deletions(-) + +diff --git a/lib/x509/common.c b/lib/x509/common.c +index 3301aaad0..10c8db53c 100644 +--- a/lib/x509/common.c ++++ b/lib/x509/common.c +@@ -1758,6 +1758,14 @@ unsigned int _gnutls_sort_clist(gnutls_x509_crt_t *clist, + * increasing DEFAULT_MAX_VERIFY_DEPTH. + */ + for (i = 0; i < clist_size; i++) { ++ /* Self-signed certificate found in the chain; skip it ++ * as it should only appear in the trusted set. ++ */ ++ if (gnutls_x509_crt_check_issuer(clist[i], clist[i])) { ++ _gnutls_cert_log("self-signed cert found", clist[i]); ++ continue; ++ } ++ + for (j = 1; j < clist_size; j++) { + if (i == j) + continue; +diff --git a/lib/x509/verify-high.c b/lib/x509/verify-high.c +index 588e7ee0d..9a16e6b42 100644 +--- a/lib/x509/verify-high.c ++++ b/lib/x509/verify-high.c +@@ -67,6 +67,80 @@ struct gnutls_x509_trust_list_iter { + + #define DEFAULT_SIZE 127 + ++struct cert_set_node_st { ++ gnutls_x509_crt_t *certs; ++ unsigned int size; ++}; ++ ++struct cert_set_st { ++ struct cert_set_node_st *node; ++ unsigned int size; ++}; ++ ++static int ++cert_set_init(struct cert_set_st *set, unsigned int size) ++{ ++ memset(set, 0, sizeof(*set)); ++ ++ set->size = size; ++ set->node = gnutls_calloc(size, sizeof(*set->node)); ++ if (!set->node) { ++ return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); ++ } ++ ++ return 0; ++} ++ ++static void ++cert_set_deinit(struct cert_set_st *set) ++{ ++ size_t i; ++ ++ for (i = 0; i < set->size; i++) { ++ gnutls_free(set->node[i].certs); ++ } ++ ++ gnutls_free(set->node); ++} ++ ++static bool ++cert_set_contains(struct cert_set_st *set, const gnutls_x509_crt_t cert) ++{ ++ size_t hash, i; ++ ++ hash = hash_pjw_bare(cert->raw_dn.data, cert->raw_dn.size); ++ hash %= set->size; ++ ++ for (i = 0; i < set->node[hash].size; i++) { ++ if (unlikely(gnutls_x509_crt_equals(set->node[hash].certs[i], cert))) { ++ return true; ++ } ++ } ++ ++ return false; ++} ++ ++static int ++cert_set_add(struct cert_set_st *set, const gnutls_x509_crt_t cert) ++{ ++ size_t hash; ++ ++ hash = hash_pjw_bare(cert->raw_dn.data, cert->raw_dn.size); ++ hash %= set->size; ++ ++ set->node[hash].certs = ++ gnutls_realloc_fast(set->node[hash].certs, ++ (set->node[hash].size + 1) * ++ sizeof(*set->node[hash].certs)); ++ if (!set->node[hash].certs) { ++ return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); ++ } ++ set->node[hash].certs[set->node[hash].size] = cert; ++ set->node[hash].size++; ++ ++ return 0; ++} ++ + /** + * gnutls_x509_trust_list_init: + * @list: A pointer to the type to be initialized +@@ -1328,6 +1402,7 @@ gnutls_x509_trust_list_verify_crt2(gnutls_x509_trust_list_t list, + unsigned have_set_name = 0; + unsigned saved_output; + gnutls_datum_t ip = {NULL, 0}; ++ struct cert_set_st cert_set = { NULL, 0 }; + + if (cert_list == NULL || cert_list_size < 1) + return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); +@@ -1376,36 +1451,68 @@ gnutls_x509_trust_list_verify_crt2(gnutls_x509_trust_list_t list, + memcpy(sorted, cert_list, cert_list_size * sizeof(gnutls_x509_crt_t)); + cert_list = sorted; + ++ ret = cert_set_init(&cert_set, DEFAULT_MAX_VERIFY_DEPTH); ++ if (ret < 0) { ++ return ret; ++ } ++ + for (i = 0; i < cert_list_size && +- cert_list_size <= DEFAULT_MAX_VERIFY_DEPTH; i++) { +- if (!(flags & GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN)) { +- unsigned int sorted_size; ++ cert_list_size <= DEFAULT_MAX_VERIFY_DEPTH; ) { ++ unsigned int sorted_size = 1; ++ unsigned int j; ++ gnutls_x509_crt_t issuer; + ++ if (!(flags & GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN)) { + sorted_size = _gnutls_sort_clist(&cert_list[i], + cert_list_size - i); +- i += sorted_size - 1; + } + +- if (i == cert_list_size - 1) { +- gnutls_x509_crt_t issuer; +- +- /* If it is the last certificate and its issuer is +- * known, don't need to run issuer callback. */ +- if (_gnutls_trust_list_get_issuer(list, +- cert_list[i], +- &issuer, +- 0) == 0) { ++ /* Remove duplicates. Start with index 1, as the first element ++ * may be re-checked after issuer retrieval. */ ++ for (j = 1; j < sorted_size; j++) { ++ if (cert_set_contains(&cert_set, cert_list[i + j])) { ++ if (i + j < cert_list_size - 1) { ++ memmove(&cert_list[i + j], ++ &cert_list[i + j + 1], ++ sizeof(cert_list[i])); ++ } ++ cert_list_size--; + break; + } +- } else if (gnutls_x509_crt_check_issuer(cert_list[i], +- cert_list[i + 1])) { +- /* There is no gap between this and the next +- * certificate. */ ++ } ++ /* Found a duplicate, try again with the same index. */ ++ if (j < sorted_size) { ++ continue; ++ } ++ ++ /* Record the certificates seen. */ ++ for (j = 0; j < sorted_size; j++, i++) { ++ ret = cert_set_add(&cert_set, cert_list[i]); ++ if (ret < 0) { ++ goto cleanup; ++ } ++ } ++ ++ /* If the issuer of the certificate is known, no need ++ * for further processing. */ ++ if (_gnutls_trust_list_get_issuer(list, ++ cert_list[i - 1], ++ &issuer, ++ 0) == 0) { ++ cert_list_size = i; ++ break; ++ } ++ ++ /* If there is no gap between this and the next certificate, ++ * proceed with the next certificate. */ ++ if (i < cert_list_size && ++ gnutls_x509_crt_check_issuer(cert_list[i - 1], ++ cert_list[i])) { + continue; + } + + ret = retrieve_issuers(list, +- cert_list[i], ++ cert_list[i - 1], + &retrieved[retrieved_size], + DEFAULT_MAX_VERIFY_DEPTH - + MAX(retrieved_size, +@@ -1413,15 +1520,20 @@ gnutls_x509_trust_list_verify_crt2(gnutls_x509_trust_list_t list, + if (ret < 0) { + break; + } else if (ret > 0) { +- memmove(&cert_list[i + 1 + ret], +- &cert_list[i + 1], +- (cert_list_size - i - 1) * ++ assert((unsigned int)ret <= ++ DEFAULT_MAX_VERIFY_DEPTH - cert_list_size); ++ memmove(&cert_list[i + ret], ++ &cert_list[i], ++ (cert_list_size - i) * + sizeof(gnutls_x509_crt_t)); +- memcpy(&cert_list[i + 1], ++ memcpy(&cert_list[i], + &retrieved[retrieved_size], + ret * sizeof(gnutls_x509_crt_t)); + retrieved_size += ret; + cert_list_size += ret; ++ ++ /* Start again from the end of the previous segment. */ ++ i--; + } + } + +@@ -1581,6 +1693,7 @@ gnutls_x509_trust_list_verify_crt2(gnutls_x509_trust_list_t list, + for (i = 0; i < retrieved_size; i++) { + gnutls_x509_crt_deinit(retrieved[i]); + } ++ cert_set_deinit(&cert_set); + return ret; + } + +diff --git a/tests/missingissuer.c b/tests/missingissuer.c +index f21e2b6b0..226d09592 100644 +--- a/tests/missingissuer.c ++++ b/tests/missingissuer.c +@@ -145,6 +145,8 @@ void doit(void) + printf("[%d]: Chain '%s'...\n", (int)i, chains[i].name); + + for (j = 0; chains[i].chain[j]; j++) { ++ assert(j < MAX_CHAIN); ++ + if (debug > 2) + printf("\tAdding certificate %d...", (int)j); + +diff --git a/tests/test-chains-issuer.h b/tests/test-chains-issuer.h +index 543e2d71f..bf1e65c95 100644 +--- a/tests/test-chains-issuer.h ++++ b/tests/test-chains-issuer.h +@@ -24,7 +24,7 @@ + #ifndef GNUTLS_TESTS_TEST_CHAINS_ISSUER_H + #define GNUTLS_TESTS_TEST_CHAINS_ISSUER_H + +-#define MAX_CHAIN 6 ++#define MAX_CHAIN 15 + + #define SERVER_CERT "-----BEGIN CERTIFICATE-----\n" \ + "MIIDATCCAbmgAwIBAgIUQdvdegP8JFszFHLfV4+lrEdafzAwPQYJKoZIhvcNAQEK\n" \ +@@ -338,11 +338,102 @@ static const char *missing_middle_unrelated_extra_insert[] = { + NULL, + }; + ++static const char *missing_middle_single_duplicate[] = { ++ SERVER_CERT, ++ SERVER_CERT, ++ CA_CERT_5, ++ CA_CERT_5, ++ CA_CERT_4, ++ CA_CERT_4, ++ CA_CERT_2, ++ CA_CERT_2, ++ CA_CERT_1, ++ CA_CERT_1, ++ NULL, ++}; ++ ++static const char *missing_middle_multiple_duplicate[] = { ++ SERVER_CERT, ++ SERVER_CERT, ++ CA_CERT_5, ++ CA_CERT_5, ++ CA_CERT_4, ++ CA_CERT_4, ++ CA_CERT_1, ++ CA_CERT_1, ++ NULL, ++}; ++ ++static const char *missing_last_single_duplicate[] = { ++ SERVER_CERT, ++ SERVER_CERT, ++ CA_CERT_5, ++ CA_CERT_5, ++ CA_CERT_4, ++ CA_CERT_4, ++ CA_CERT_3, ++ CA_CERT_3, ++ CA_CERT_2, ++ CA_CERT_2, ++ NULL, ++}; ++ ++static const char *missing_last_multiple_duplicate[] = { ++ SERVER_CERT, ++ SERVER_CERT, ++ CA_CERT_5, ++ CA_CERT_5, ++ CA_CERT_4, ++ CA_CERT_4, ++ CA_CERT_3, ++ CA_CERT_3, ++ NULL, ++}; ++ ++static const char *missing_skip_single_duplicate[] = { ++ SERVER_CERT, ++ SERVER_CERT, ++ CA_CERT_5, ++ CA_CERT_5, ++ CA_CERT_3, ++ CA_CERT_3, ++ CA_CERT_1, ++ CA_CERT_1, ++ NULL, ++}; ++ ++static const char *missing_skip_multiple_duplicate[] = { ++ SERVER_CERT, ++ SERVER_CERT, ++ CA_CERT_5, ++ CA_CERT_5, ++ CA_CERT_3, ++ CA_CERT_3, ++ NULL, ++}; ++ + static const char *missing_ca[] = { + CA_CERT_0, + NULL, + }; + ++static const char *middle_single_duplicate_ca[] = { ++ SERVER_CERT, ++ CA_CERT_5, ++ CA_CERT_0, ++ CA_CERT_4, ++ CA_CERT_0, ++ CA_CERT_2, ++ CA_CERT_0, ++ CA_CERT_1, ++ NULL, ++}; ++ ++static const char *missing_middle_single_duplicate_ca_unrelated_insert[] = { ++ CA_CERT_0, ++ NULL, ++}; ++ + static struct chains { + const char *name; + const char **chain; +@@ -377,6 +468,14 @@ static struct chains { + { "skip multiple unsorted", missing_skip_multiple_unsorted, missing_skip_multiple_insert, missing_ca, 0, 0 }, + { "unrelated", missing_middle_single, missing_middle_unrelated_insert, missing_ca, 0, GNUTLS_CERT_INVALID | GNUTLS_CERT_SIGNER_NOT_FOUND }, + { "unrelated extra", missing_middle_single, missing_middle_unrelated_extra_insert, missing_ca, 0, 0 }, ++ { "middle single duplicate", missing_middle_single_duplicate, missing_middle_single_insert, missing_ca, 0, 0 }, ++ { "middle multiple duplicate", missing_middle_multiple_duplicate, missing_middle_multiple_insert, missing_ca, 0, 0 }, ++ { "last single duplicate", missing_last_single_duplicate, missing_last_single_insert, missing_ca, 0, 0 }, ++ { "last multiple duplicate", missing_last_multiple_duplicate, missing_last_multiple_insert, missing_ca, 0, 0 }, ++ { "skip single duplicate", missing_skip_single_duplicate, missing_skip_single_insert, missing_ca, 0, 0 }, ++ { "skip multiple duplicate", missing_skip_multiple_duplicate, missing_skip_multiple_insert, missing_ca, 0, 0 }, ++ { "middle single duplicate ca", middle_single_duplicate_ca, missing_middle_single_insert, missing_ca, 0, 0 }, ++ { "middle single duplicate ca - insert unrelated", middle_single_duplicate_ca, missing_middle_single_duplicate_ca_unrelated_insert, missing_ca, 0, GNUTLS_CERT_INVALID | GNUTLS_CERT_SIGNER_NOT_FOUND }, + { NULL, NULL, NULL, NULL }, + }; + +-- +2.29.2 + diff --git a/gnutls.spec b/gnutls.spec index adba8c2..a183863 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,10 +1,11 @@ # This spec file has been automatically updated Version: 3.7.0 -Release: 1%{?dist} +Release: 2%{?dist} Patch1: gnutls-3.6.7-no-now-guile.patch Patch2: gnutls-3.2.7-rpath.patch Patch3: gnutls-3.7.0-test-fixes.patch Patch4: gnutls-3.7.0-gost.patch +Patch5: gnutls-3.7.0-duplicate-certs.patch %bcond_without dane %if 0%{?rhel} %bcond_with guile @@ -284,6 +285,9 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %endif %changelog +* Wed Feb 10 2021 Daiki Ueno - 3.7.0-2 +- Tolerate duplicate certs in the chain + * Mon Feb 8 2021 Daiki Ueno - 3.7.0-1 - Update to upstream 3.7.0 release - Temporarily disable LTO From db38e2331ad1da18e1742848704c196534e9ee98 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 2 Mar 2021 09:20:21 +0100 Subject: [PATCH 03/18] Reduce BRs for non-bootstrapping build Also disable guile tweaks if it's not enabled and remove non-existing build-time options from configure command-line. Signed-off-by: Daiki Ueno --- gnutls.spec | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/gnutls.spec b/gnutls.spec index a183863..3811ea9 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,11 +1,12 @@ # This spec file has been automatically updated Version: 3.7.0 -Release: 2%{?dist} +Release: 3%{?dist} Patch1: gnutls-3.6.7-no-now-guile.patch Patch2: gnutls-3.2.7-rpath.patch Patch3: gnutls-3.7.0-test-fixes.patch Patch4: gnutls-3.7.0-gost.patch Patch5: gnutls-3.7.0-duplicate-certs.patch +%bcond_with bootstrap %bcond_without dane %if 0%{?rhel} %bcond_with guile @@ -21,13 +22,15 @@ Name: gnutls License: GPLv3+ and LGPLv2+ BuildRequires: p11-kit-devel >= 0.21.3, gettext-devel BuildRequires: zlib-devel, readline-devel, libtasn1-devel >= 4.3 -BuildRequires: libtool, automake, autoconf, texinfo -BuildRequires: autogen-libopts-devel >= 5.18 autogen +%if %{with bootstrap} +BuildRequires: automake, autoconf, gperf, libtool, texinfo +BuildRequires: autogen-libopts-devel >= 5.18, autogen +%endif BuildRequires: nettle-devel >= 3.5.1 BuildRequires: trousers-devel >= 0.3.11.2 BuildRequires: libidn2-devel BuildRequires: libunistring-devel -BuildRequires: gperf, net-tools, datefudge, softhsm, gcc, gcc-c++ +BuildRequires: net-tools, datefudge, softhsm, gcc, gcc-c++ BuildRequires: gnupg2 %if %{with fips} BuildRequires: fipscheck @@ -147,11 +150,13 @@ This package contains Guile bindings for the library. gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} %autosetup -p1 -#autoreconf -fi +%if %{with bootstrap} +rm -f src/libopts/*.c src/libopts/*.h src/libopts/compat/*.c src/libopts/compat/*.h +autoreconf -fi +%endif sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure rm -f lib/minitasn1/*.c lib/minitasn1/*.h -rm -f src/libopts/*.c src/libopts/*.h src/libopts/compat/*.c src/libopts/compat/*.h echo "SYSTEM=NORMAL" >> tests/system.prio @@ -164,14 +169,16 @@ echo "SYSTEM=NORMAL" >> tests/system.prio CCASFLAGS="$CCASFLAGS -Wa,--generate-missing-build-notes=yes" export CCASFLAGS +%if %{with guile} # These should be checked by m4/guile.m4 instead of configure.ac # taking into account of _guile_suffix guile_snarf=%{_bindir}/guile-snarf2.2 export guile_snarf GUILD=%{_bindir}/guild2.2 export GUILD +%endif -%configure --with-libtasn1-prefix=%{_prefix} \ +%configure \ %if %{with fips} --enable-fips140-mode \ %endif @@ -191,9 +198,9 @@ export GUILD %endif %if %{with dane} --with-unbound-root-key-file=/var/lib/unbound/root.key \ - --enable-dane \ + --enable-libdane \ %else - --disable-dane \ + --disable-libdane \ %endif --disable-rpath \ --with-default-priority-string="@SYSTEM" @@ -285,6 +292,9 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %endif %changelog +* Tue Mar 2 2021 Daiki Ueno - 3.7.0-3 +- Reduce BRs for non-bootstrapping build + * Wed Feb 10 2021 Daiki Ueno - 3.7.0-2 - Tolerate duplicate certs in the chain From cc83f24622e28d177485c47aef0f738a8d3c4c5a Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 5 Mar 2021 12:16:43 +0100 Subject: [PATCH 04/18] Tolerate duplicate certs in the chain also with PKCS #11 trust store --- gnutls-3.7.0-duplicate-certs-pkcs11.patch | 44 +++++++++++++++++++++++ gnutls.spec | 6 +++- 2 files changed, 49 insertions(+), 1 deletion(-) create mode 100644 gnutls-3.7.0-duplicate-certs-pkcs11.patch diff --git a/gnutls-3.7.0-duplicate-certs-pkcs11.patch b/gnutls-3.7.0-duplicate-certs-pkcs11.patch new file mode 100644 index 0000000..02284b4 --- /dev/null +++ b/gnutls-3.7.0-duplicate-certs-pkcs11.patch @@ -0,0 +1,44 @@ +From e97a5f07bc9d9394424c6520656e902019fcb380 Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Fri, 5 Mar 2021 12:08:25 +0100 +Subject: [PATCH] gnutls_x509_trust_list_verify_crt2: skip duped certs for + PKCS11 too + +The commit 09b40be6e0e0a59ba4bd764067eb353241043a70 (part of +gnutls/gnutls!1370) didn't cover the case where the trust store is +backed by PKCS #11, because it used _gnutls_trust_list_get_issuer, +which only works with file based trust store. + +This patch replaces the call with more generic +gnutls_x509_trust_list_get_issuer so it also works with other trust +store implementations. + +Reported by Michal Ruprich. + +Signed-off-by: Daiki Ueno +--- + lib/x509/verify-high.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/lib/x509/verify-high.c b/lib/x509/verify-high.c +index 9a16e6b42..736326ee1 100644 +--- a/lib/x509/verify-high.c ++++ b/lib/x509/verify-high.c +@@ -1495,10 +1495,10 @@ gnutls_x509_trust_list_verify_crt2(gnutls_x509_trust_list_t list, + + /* If the issuer of the certificate is known, no need + * for further processing. */ +- if (_gnutls_trust_list_get_issuer(list, +- cert_list[i - 1], +- &issuer, +- 0) == 0) { ++ if (gnutls_x509_trust_list_get_issuer(list, ++ cert_list[i - 1], ++ &issuer, ++ 0) == 0) { + cert_list_size = i; + break; + } +-- +2.29.2 + diff --git a/gnutls.spec b/gnutls.spec index 3811ea9..51ff567 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,11 +1,12 @@ # This spec file has been automatically updated Version: 3.7.0 -Release: 3%{?dist} +Release: 4%{?dist} Patch1: gnutls-3.6.7-no-now-guile.patch Patch2: gnutls-3.2.7-rpath.patch Patch3: gnutls-3.7.0-test-fixes.patch Patch4: gnutls-3.7.0-gost.patch Patch5: gnutls-3.7.0-duplicate-certs.patch +Patch6: gnutls-3.7.0-duplicate-certs-pkcs11.patch %bcond_with bootstrap %bcond_without dane %if 0%{?rhel} @@ -292,6 +293,9 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %endif %changelog +* Fri Mar 5 2021 Daiki Ueno - 3.7.0-4 +- Tolerate duplicate certs in the chain also with PKCS #11 trust store + * Tue Mar 2 2021 Daiki Ueno - 3.7.0-3 - Reduce BRs for non-bootstrapping build From 4763bbed59b46464b2da55d8827650ba95e1d87a Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Sat, 13 Mar 2021 10:01:24 +0100 Subject: [PATCH 05/18] Update to upstream 3.7.1 release Also remove fipscheck dependency, as it is now calculated with an internal tool. --- .gitignore | 2 + gnutls-3.7.0-duplicate-certs-pkcs11.patch | 44 --- gnutls-3.7.0-duplicate-certs.patch | 403 -------------------- gnutls-3.7.0-gost.patch | 12 - gnutls-3.7.0-test-fixes.patch | 195 ---------- gnutls-3.7.1-aggressive-realloc-fixes.patch | 84 ++++ gnutls.spec | 22 +- sources | 4 +- 8 files changed, 99 insertions(+), 667 deletions(-) delete mode 100644 gnutls-3.7.0-duplicate-certs-pkcs11.patch delete mode 100644 gnutls-3.7.0-duplicate-certs.patch delete mode 100644 gnutls-3.7.0-gost.patch delete mode 100644 gnutls-3.7.0-test-fixes.patch create mode 100644 gnutls-3.7.1-aggressive-realloc-fixes.patch diff --git a/.gitignore b/.gitignore index 7137263..0f9ce46 100644 --- a/.gitignore +++ b/.gitignore @@ -131,3 +131,5 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.6.15.tar.xz.sig /gnutls-3.7.0.tar.xz /gnutls-3.7.0.tar.xz.sig +/gnutls-3.7.1.tar.xz +/gnutls-3.7.1.tar.xz.sig diff --git a/gnutls-3.7.0-duplicate-certs-pkcs11.patch b/gnutls-3.7.0-duplicate-certs-pkcs11.patch deleted file mode 100644 index 02284b4..0000000 --- a/gnutls-3.7.0-duplicate-certs-pkcs11.patch +++ /dev/null @@ -1,44 +0,0 @@ -From e97a5f07bc9d9394424c6520656e902019fcb380 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Fri, 5 Mar 2021 12:08:25 +0100 -Subject: [PATCH] gnutls_x509_trust_list_verify_crt2: skip duped certs for - PKCS11 too - -The commit 09b40be6e0e0a59ba4bd764067eb353241043a70 (part of -gnutls/gnutls!1370) didn't cover the case where the trust store is -backed by PKCS #11, because it used _gnutls_trust_list_get_issuer, -which only works with file based trust store. - -This patch replaces the call with more generic -gnutls_x509_trust_list_get_issuer so it also works with other trust -store implementations. - -Reported by Michal Ruprich. - -Signed-off-by: Daiki Ueno ---- - lib/x509/verify-high.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/lib/x509/verify-high.c b/lib/x509/verify-high.c -index 9a16e6b42..736326ee1 100644 ---- a/lib/x509/verify-high.c -+++ b/lib/x509/verify-high.c -@@ -1495,10 +1495,10 @@ gnutls_x509_trust_list_verify_crt2(gnutls_x509_trust_list_t list, - - /* If the issuer of the certificate is known, no need - * for further processing. */ -- if (_gnutls_trust_list_get_issuer(list, -- cert_list[i - 1], -- &issuer, -- 0) == 0) { -+ if (gnutls_x509_trust_list_get_issuer(list, -+ cert_list[i - 1], -+ &issuer, -+ 0) == 0) { - cert_list_size = i; - break; - } --- -2.29.2 - diff --git a/gnutls-3.7.0-duplicate-certs.patch b/gnutls-3.7.0-duplicate-certs.patch deleted file mode 100644 index d86b855..0000000 --- a/gnutls-3.7.0-duplicate-certs.patch +++ /dev/null @@ -1,403 +0,0 @@ -From 09b40be6e0e0a59ba4bd764067eb353241043a70 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Mon, 28 Dec 2020 12:14:13 +0100 -Subject: [PATCH] gnutls_x509_trust_list_verify_crt2: ignore duplicate - certificates - -The commit ebb19db9165fed30d73c83bab1b1b8740c132dfd caused a -regression, where duplicate certificates in a certificate chain are no -longer ignored but treated as a non-contiguous segment and that -results in calling the issuer callback, or a verification failure. - -This adds a mechanism to record certificates already seen in the -chain, and skip them while still allow the caller to inject missing -certificates. - -Signed-off-by: Daiki Ueno -Co-authored-by: Andreas Metzler ---- - lib/x509/common.c | 8 ++ - lib/x509/verify-high.c | 157 +++++++++++++++++++++++++++++++------ - tests/missingissuer.c | 2 + - tests/test-chains-issuer.h | 101 +++++++++++++++++++++++- - 4 files changed, 245 insertions(+), 23 deletions(-) - -diff --git a/lib/x509/common.c b/lib/x509/common.c -index 3301aaad0..10c8db53c 100644 ---- a/lib/x509/common.c -+++ b/lib/x509/common.c -@@ -1758,6 +1758,14 @@ unsigned int _gnutls_sort_clist(gnutls_x509_crt_t *clist, - * increasing DEFAULT_MAX_VERIFY_DEPTH. - */ - for (i = 0; i < clist_size; i++) { -+ /* Self-signed certificate found in the chain; skip it -+ * as it should only appear in the trusted set. -+ */ -+ if (gnutls_x509_crt_check_issuer(clist[i], clist[i])) { -+ _gnutls_cert_log("self-signed cert found", clist[i]); -+ continue; -+ } -+ - for (j = 1; j < clist_size; j++) { - if (i == j) - continue; -diff --git a/lib/x509/verify-high.c b/lib/x509/verify-high.c -index 588e7ee0d..9a16e6b42 100644 ---- a/lib/x509/verify-high.c -+++ b/lib/x509/verify-high.c -@@ -67,6 +67,80 @@ struct gnutls_x509_trust_list_iter { - - #define DEFAULT_SIZE 127 - -+struct cert_set_node_st { -+ gnutls_x509_crt_t *certs; -+ unsigned int size; -+}; -+ -+struct cert_set_st { -+ struct cert_set_node_st *node; -+ unsigned int size; -+}; -+ -+static int -+cert_set_init(struct cert_set_st *set, unsigned int size) -+{ -+ memset(set, 0, sizeof(*set)); -+ -+ set->size = size; -+ set->node = gnutls_calloc(size, sizeof(*set->node)); -+ if (!set->node) { -+ return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); -+ } -+ -+ return 0; -+} -+ -+static void -+cert_set_deinit(struct cert_set_st *set) -+{ -+ size_t i; -+ -+ for (i = 0; i < set->size; i++) { -+ gnutls_free(set->node[i].certs); -+ } -+ -+ gnutls_free(set->node); -+} -+ -+static bool -+cert_set_contains(struct cert_set_st *set, const gnutls_x509_crt_t cert) -+{ -+ size_t hash, i; -+ -+ hash = hash_pjw_bare(cert->raw_dn.data, cert->raw_dn.size); -+ hash %= set->size; -+ -+ for (i = 0; i < set->node[hash].size; i++) { -+ if (unlikely(gnutls_x509_crt_equals(set->node[hash].certs[i], cert))) { -+ return true; -+ } -+ } -+ -+ return false; -+} -+ -+static int -+cert_set_add(struct cert_set_st *set, const gnutls_x509_crt_t cert) -+{ -+ size_t hash; -+ -+ hash = hash_pjw_bare(cert->raw_dn.data, cert->raw_dn.size); -+ hash %= set->size; -+ -+ set->node[hash].certs = -+ gnutls_realloc_fast(set->node[hash].certs, -+ (set->node[hash].size + 1) * -+ sizeof(*set->node[hash].certs)); -+ if (!set->node[hash].certs) { -+ return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); -+ } -+ set->node[hash].certs[set->node[hash].size] = cert; -+ set->node[hash].size++; -+ -+ return 0; -+} -+ - /** - * gnutls_x509_trust_list_init: - * @list: A pointer to the type to be initialized -@@ -1328,6 +1402,7 @@ gnutls_x509_trust_list_verify_crt2(gnutls_x509_trust_list_t list, - unsigned have_set_name = 0; - unsigned saved_output; - gnutls_datum_t ip = {NULL, 0}; -+ struct cert_set_st cert_set = { NULL, 0 }; - - if (cert_list == NULL || cert_list_size < 1) - return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); -@@ -1376,36 +1451,68 @@ gnutls_x509_trust_list_verify_crt2(gnutls_x509_trust_list_t list, - memcpy(sorted, cert_list, cert_list_size * sizeof(gnutls_x509_crt_t)); - cert_list = sorted; - -+ ret = cert_set_init(&cert_set, DEFAULT_MAX_VERIFY_DEPTH); -+ if (ret < 0) { -+ return ret; -+ } -+ - for (i = 0; i < cert_list_size && -- cert_list_size <= DEFAULT_MAX_VERIFY_DEPTH; i++) { -- if (!(flags & GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN)) { -- unsigned int sorted_size; -+ cert_list_size <= DEFAULT_MAX_VERIFY_DEPTH; ) { -+ unsigned int sorted_size = 1; -+ unsigned int j; -+ gnutls_x509_crt_t issuer; - -+ if (!(flags & GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN)) { - sorted_size = _gnutls_sort_clist(&cert_list[i], - cert_list_size - i); -- i += sorted_size - 1; - } - -- if (i == cert_list_size - 1) { -- gnutls_x509_crt_t issuer; -- -- /* If it is the last certificate and its issuer is -- * known, don't need to run issuer callback. */ -- if (_gnutls_trust_list_get_issuer(list, -- cert_list[i], -- &issuer, -- 0) == 0) { -+ /* Remove duplicates. Start with index 1, as the first element -+ * may be re-checked after issuer retrieval. */ -+ for (j = 1; j < sorted_size; j++) { -+ if (cert_set_contains(&cert_set, cert_list[i + j])) { -+ if (i + j < cert_list_size - 1) { -+ memmove(&cert_list[i + j], -+ &cert_list[i + j + 1], -+ sizeof(cert_list[i])); -+ } -+ cert_list_size--; - break; - } -- } else if (gnutls_x509_crt_check_issuer(cert_list[i], -- cert_list[i + 1])) { -- /* There is no gap between this and the next -- * certificate. */ -+ } -+ /* Found a duplicate, try again with the same index. */ -+ if (j < sorted_size) { -+ continue; -+ } -+ -+ /* Record the certificates seen. */ -+ for (j = 0; j < sorted_size; j++, i++) { -+ ret = cert_set_add(&cert_set, cert_list[i]); -+ if (ret < 0) { -+ goto cleanup; -+ } -+ } -+ -+ /* If the issuer of the certificate is known, no need -+ * for further processing. */ -+ if (_gnutls_trust_list_get_issuer(list, -+ cert_list[i - 1], -+ &issuer, -+ 0) == 0) { -+ cert_list_size = i; -+ break; -+ } -+ -+ /* If there is no gap between this and the next certificate, -+ * proceed with the next certificate. */ -+ if (i < cert_list_size && -+ gnutls_x509_crt_check_issuer(cert_list[i - 1], -+ cert_list[i])) { - continue; - } - - ret = retrieve_issuers(list, -- cert_list[i], -+ cert_list[i - 1], - &retrieved[retrieved_size], - DEFAULT_MAX_VERIFY_DEPTH - - MAX(retrieved_size, -@@ -1413,15 +1520,20 @@ gnutls_x509_trust_list_verify_crt2(gnutls_x509_trust_list_t list, - if (ret < 0) { - break; - } else if (ret > 0) { -- memmove(&cert_list[i + 1 + ret], -- &cert_list[i + 1], -- (cert_list_size - i - 1) * -+ assert((unsigned int)ret <= -+ DEFAULT_MAX_VERIFY_DEPTH - cert_list_size); -+ memmove(&cert_list[i + ret], -+ &cert_list[i], -+ (cert_list_size - i) * - sizeof(gnutls_x509_crt_t)); -- memcpy(&cert_list[i + 1], -+ memcpy(&cert_list[i], - &retrieved[retrieved_size], - ret * sizeof(gnutls_x509_crt_t)); - retrieved_size += ret; - cert_list_size += ret; -+ -+ /* Start again from the end of the previous segment. */ -+ i--; - } - } - -@@ -1581,6 +1693,7 @@ gnutls_x509_trust_list_verify_crt2(gnutls_x509_trust_list_t list, - for (i = 0; i < retrieved_size; i++) { - gnutls_x509_crt_deinit(retrieved[i]); - } -+ cert_set_deinit(&cert_set); - return ret; - } - -diff --git a/tests/missingissuer.c b/tests/missingissuer.c -index f21e2b6b0..226d09592 100644 ---- a/tests/missingissuer.c -+++ b/tests/missingissuer.c -@@ -145,6 +145,8 @@ void doit(void) - printf("[%d]: Chain '%s'...\n", (int)i, chains[i].name); - - for (j = 0; chains[i].chain[j]; j++) { -+ assert(j < MAX_CHAIN); -+ - if (debug > 2) - printf("\tAdding certificate %d...", (int)j); - -diff --git a/tests/test-chains-issuer.h b/tests/test-chains-issuer.h -index 543e2d71f..bf1e65c95 100644 ---- a/tests/test-chains-issuer.h -+++ b/tests/test-chains-issuer.h -@@ -24,7 +24,7 @@ - #ifndef GNUTLS_TESTS_TEST_CHAINS_ISSUER_H - #define GNUTLS_TESTS_TEST_CHAINS_ISSUER_H - --#define MAX_CHAIN 6 -+#define MAX_CHAIN 15 - - #define SERVER_CERT "-----BEGIN CERTIFICATE-----\n" \ - "MIIDATCCAbmgAwIBAgIUQdvdegP8JFszFHLfV4+lrEdafzAwPQYJKoZIhvcNAQEK\n" \ -@@ -338,11 +338,102 @@ static const char *missing_middle_unrelated_extra_insert[] = { - NULL, - }; - -+static const char *missing_middle_single_duplicate[] = { -+ SERVER_CERT, -+ SERVER_CERT, -+ CA_CERT_5, -+ CA_CERT_5, -+ CA_CERT_4, -+ CA_CERT_4, -+ CA_CERT_2, -+ CA_CERT_2, -+ CA_CERT_1, -+ CA_CERT_1, -+ NULL, -+}; -+ -+static const char *missing_middle_multiple_duplicate[] = { -+ SERVER_CERT, -+ SERVER_CERT, -+ CA_CERT_5, -+ CA_CERT_5, -+ CA_CERT_4, -+ CA_CERT_4, -+ CA_CERT_1, -+ CA_CERT_1, -+ NULL, -+}; -+ -+static const char *missing_last_single_duplicate[] = { -+ SERVER_CERT, -+ SERVER_CERT, -+ CA_CERT_5, -+ CA_CERT_5, -+ CA_CERT_4, -+ CA_CERT_4, -+ CA_CERT_3, -+ CA_CERT_3, -+ CA_CERT_2, -+ CA_CERT_2, -+ NULL, -+}; -+ -+static const char *missing_last_multiple_duplicate[] = { -+ SERVER_CERT, -+ SERVER_CERT, -+ CA_CERT_5, -+ CA_CERT_5, -+ CA_CERT_4, -+ CA_CERT_4, -+ CA_CERT_3, -+ CA_CERT_3, -+ NULL, -+}; -+ -+static const char *missing_skip_single_duplicate[] = { -+ SERVER_CERT, -+ SERVER_CERT, -+ CA_CERT_5, -+ CA_CERT_5, -+ CA_CERT_3, -+ CA_CERT_3, -+ CA_CERT_1, -+ CA_CERT_1, -+ NULL, -+}; -+ -+static const char *missing_skip_multiple_duplicate[] = { -+ SERVER_CERT, -+ SERVER_CERT, -+ CA_CERT_5, -+ CA_CERT_5, -+ CA_CERT_3, -+ CA_CERT_3, -+ NULL, -+}; -+ - static const char *missing_ca[] = { - CA_CERT_0, - NULL, - }; - -+static const char *middle_single_duplicate_ca[] = { -+ SERVER_CERT, -+ CA_CERT_5, -+ CA_CERT_0, -+ CA_CERT_4, -+ CA_CERT_0, -+ CA_CERT_2, -+ CA_CERT_0, -+ CA_CERT_1, -+ NULL, -+}; -+ -+static const char *missing_middle_single_duplicate_ca_unrelated_insert[] = { -+ CA_CERT_0, -+ NULL, -+}; -+ - static struct chains { - const char *name; - const char **chain; -@@ -377,6 +468,14 @@ static struct chains { - { "skip multiple unsorted", missing_skip_multiple_unsorted, missing_skip_multiple_insert, missing_ca, 0, 0 }, - { "unrelated", missing_middle_single, missing_middle_unrelated_insert, missing_ca, 0, GNUTLS_CERT_INVALID | GNUTLS_CERT_SIGNER_NOT_FOUND }, - { "unrelated extra", missing_middle_single, missing_middle_unrelated_extra_insert, missing_ca, 0, 0 }, -+ { "middle single duplicate", missing_middle_single_duplicate, missing_middle_single_insert, missing_ca, 0, 0 }, -+ { "middle multiple duplicate", missing_middle_multiple_duplicate, missing_middle_multiple_insert, missing_ca, 0, 0 }, -+ { "last single duplicate", missing_last_single_duplicate, missing_last_single_insert, missing_ca, 0, 0 }, -+ { "last multiple duplicate", missing_last_multiple_duplicate, missing_last_multiple_insert, missing_ca, 0, 0 }, -+ { "skip single duplicate", missing_skip_single_duplicate, missing_skip_single_insert, missing_ca, 0, 0 }, -+ { "skip multiple duplicate", missing_skip_multiple_duplicate, missing_skip_multiple_insert, missing_ca, 0, 0 }, -+ { "middle single duplicate ca", middle_single_duplicate_ca, missing_middle_single_insert, missing_ca, 0, 0 }, -+ { "middle single duplicate ca - insert unrelated", middle_single_duplicate_ca, missing_middle_single_duplicate_ca_unrelated_insert, missing_ca, 0, GNUTLS_CERT_INVALID | GNUTLS_CERT_SIGNER_NOT_FOUND }, - { NULL, NULL, NULL, NULL }, - }; - --- -2.29.2 - diff --git a/gnutls-3.7.0-gost.patch b/gnutls-3.7.0-gost.patch deleted file mode 100644 index 7cad9b5..0000000 --- a/gnutls-3.7.0-gost.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up ./tests/gnutls-cli-debug.sh.gost ./tests/gnutls-cli-debug.sh ---- ./tests/gnutls-cli-debug.sh.gost 2021-02-09 13:28:46.528821113 +0100 -+++ ./tests/gnutls-cli-debug.sh 2021-02-09 13:29:18.851646678 +0100 -@@ -217,6 +217,8 @@ if test "${ENABLE_GOST}" = "1" && test " - kill ${PID} - wait - -+ cat $OUTFILE -+ - check_text "for VKO GOST-2012 (draft-smyshlyaev-tls12-gost-suites) support... yes" - check_text "for GOST28147-CNT cipher (draft-smyshlyaev-tls12-gost-suites) support... yes" - check_text "for GOST28147-IMIT MAC (draft-smyshlyaev-tls12-gost-suites) support... yes" diff --git a/gnutls-3.7.0-test-fixes.patch b/gnutls-3.7.0-test-fixes.patch deleted file mode 100644 index 066feb4..0000000 --- a/gnutls-3.7.0-test-fixes.patch +++ /dev/null @@ -1,195 +0,0 @@ -From c815f725448af8d023818a968e1296946ceb0f1c Mon Sep 17 00:00:00 2001 -From: Stefan Berger -Date: Mon, 21 Dec 2020 09:36:47 -0500 -Subject: [PATCH 1/2] tests: Fix tpmtool_test due to changes in trousers - -Recent changes to trousers now require an ownership of root:tss for -the tcsd config file, older ones requires tss:tss. So, start tcsd -using trial and error with either one of these ownership configurations -until one works. - -Signed-off-by: Stefan Berger ---- - tests/tpmtool_test.sh | 37 +++++++++++++++++++++++++++---------- - 1 file changed, 27 insertions(+), 10 deletions(-) - -diff --git a/tests/tpmtool_test.sh b/tests/tpmtool_test.sh -index eba502612..77fe17e59 100755 ---- a/tests/tpmtool_test.sh -+++ b/tests/tpmtool_test.sh -@@ -138,6 +138,7 @@ start_tcsd() - local tcsd_conf=$workdir/tcsd.conf - local tcsd_system_ps_file=$workdir/system_ps_file - local tcsd_pidfile=$workdir/tcsd.pid -+ local owner - - start_swtpm "$workdir" - [ $? -ne 0 ] && return 1 -@@ -146,20 +147,36 @@ start_tcsd() - port = $TCSD_LISTEN_PORT - system_ps_file = $tcsd_system_ps_file - _EOF_ -+ # older versions of trousers require tss:tss ownership of the -+ # config file, later ones root:tss -+ for owner in tss root; do -+ if [ "$owner" = "tss" ]; then -+ chmod 0600 $tcsd_conf -+ else -+ chmod 0640 $tcsd_conf -+ fi -+ chown $owner:tss $tcsd_conf - -- chown tss:tss $tcsd_conf -- chmod 0600 $tcsd_conf -+ bash -c "TCSD_USE_TCP_DEVICE=1 TCSD_TCP_DEVICE_PORT=$SWTPM_SERVER_PORT tcsd -c $tcsd_conf -e -f &>/dev/null & echo \$! > $tcsd_pidfile; wait" & -+ BASH_PID=$! - -- bash -c "TCSD_USE_TCP_DEVICE=1 TCSD_TCP_DEVICE_PORT=$SWTPM_SERVER_PORT tcsd -c $tcsd_conf -e -f &>/dev/null & echo \$! > $tcsd_pidfile; wait" & -- BASH_PID=$! -+ if wait_for_file $tcsd_pidfile 3; then -+ echo "Could not get TCSD's PID file" -+ return 1 -+ fi - -- if wait_for_file $tcsd_pidfile 3; then -- echo "Could not get TCSD's PID file" -- return 1 -- fi -+ sleep 0.5 -+ TCSD_PID=$(cat $tcsd_pidfile) -+ kill -0 "${TCSD_PID}" -+ if [ $? -ne 0 ]; then -+ # Try again with other owner -+ continue -+ fi -+ return 0 -+ done - -- TCSD_PID=$(cat $tcsd_pidfile) -- return 0 -+ echo "TCSD could not be started" -+ return 1 - } - - stop_tcsd() --- -2.29.2 - - -From 2b0f6f3a2ff13153aaa70c764ba7a8b90aef794d Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Mon, 28 Dec 2020 16:16:53 +0100 -Subject: [PATCH 2/2] testpkcs11: use datefudge to trick certificate expiry - -The certificates stored in tests/testpkcs11-certs expired on -2020-12-13. To avoid verification failure due to that, use datefudge -to set custom date when calling gnutls-cli, gnutls-serv, and certtool. - -Based on the patch by Andreas Metzler: -https://gitlab.com/gnutls/gnutls/-/issues/1135#note_469682121 - -Signed-off-by: Daiki Ueno ---- - tests/testpkcs11.sh | 12 +++++++++++- - 1 file changed, 11 insertions(+), 1 deletion(-) - -diff --git a/tests/testpkcs11.sh b/tests/testpkcs11.sh -index 38b9585bc..09a627477 100755 ---- a/tests/testpkcs11.sh -+++ b/tests/testpkcs11.sh -@@ -67,6 +67,8 @@ have_ed25519=0 - P11TOOL="${VALGRIND} ${P11TOOL} --batch" - SERV="${SERV} -q" - -+TESTDATE=2020-12-01 -+ - . ${srcdir}/scripts/common.sh - - rm -f "${LOGFILE}" -@@ -79,6 +81,8 @@ exit_error () { - exit 1 - } - -+skip_if_no_datefudge -+ - # $1: token - # $2: PIN - # $3: filename -@@ -523,6 +527,7 @@ write_certificate_test () { - pubkey="$5" - - echo -n "* Generating client certificate... " -+ datefudge -s "$TESTDATE" \ - "${CERTTOOL}" ${CERTTOOL_PARAM} ${ADDITIONAL_PARAM} --generate-certificate --load-ca-privkey "${cakey}" --load-ca-certificate "${cacert}" \ - --template ${srcdir}/testpkcs11-certs/client-tmpl --load-privkey "${token};object=gnutls-client;object-type=private" \ - --load-pubkey "$pubkey" --outfile tmp-client.crt >>"${LOGFILE}" 2>&1 -@@ -900,7 +905,9 @@ use_certificate_test () { - echo -n "* Using PKCS #11 with gnutls-cli (${txt})... " - # start server - eval "${GETPORT}" -- launch_server ${ADDITIONAL_PARAM} --echo --priority NORMAL --x509certfile="${certfile}" \ -+ launch_bare_server datefudge -s "$TESTDATE" \ -+ $VALGRIND $SERV $DEBUG -p "$PORT" \ -+ ${ADDITIONAL_PARAM} --debug 10 --echo --priority NORMAL --x509certfile="${certfile}" \ - --x509keyfile="$keyfile" --x509cafile="${cafile}" \ - --verify-client-cert --require-client-cert >>"${LOGFILE}" 2>&1 - -@@ -908,13 +915,16 @@ use_certificate_test () { - wait_server ${PID} - - # connect to server using SC -+ datefudge -s "$TESTDATE" \ - ${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509cafile="${cafile}" >"${LOGFILE}" 2>&1 && \ - fail ${PID} "Connection should have failed!" - -+ datefudge -s "$TESTDATE" \ - ${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509certfile="${certfile}" \ - --x509keyfile="$keyfile" --x509cafile="${cafile}" >"${LOGFILE}" 2>&1 || \ - fail ${PID} "Connection (with files) should have succeeded!" - -+ datefudge -s "$TESTDATE" \ - ${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509certfile="${token};object=gnutls-client;object-type=cert" \ - --x509keyfile="${token};object=gnutls-client;object-type=private" \ - --x509cafile="${cafile}" >"${LOGFILE}" 2>&1 || \ --- -2.29.2 - -From 5a64e896a56ef602bb86242bbac01e4319f12cbe Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Tue, 9 Feb 2021 15:26:07 +0100 -Subject: [PATCH] tests/gnutls-cli-debug.sh: don't unset system priority - settings - -When the test is exercised, GNUTLS_SYSTEM_PRIORITY_FILE is set in many -places, such as TESTS_ENVIRONMENT tests/Makefile.am or a packaging -system that runs the test in a restricted environment. Unsetting it -after a temporary use forces the remaining part of the test to use the -default system priority, which might not be the intention of the user. - -Signed-off-by: Daiki Ueno ---- - tests/gnutls-cli-debug.sh | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -diff --git a/tests/gnutls-cli-debug.sh b/tests/gnutls-cli-debug.sh -index a73910dea..3c3e2214e 100755 ---- a/tests/gnutls-cli-debug.sh -+++ b/tests/gnutls-cli-debug.sh -@@ -184,13 +184,11 @@ cat <<_EOF_ > ${TMPFILE} - tls-disabled-cipher = CAMELLIA-128-CBC - tls-disabled-cipher = CAMELLIA-256-CBC - _EOF_ --export GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}" - -+GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}" \ - timeout 1800 datefudge "2017-08-9" \ - "${DCLI}" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!" - --unset GNUTLS_SYSTEM_PRIORITY_FILE -- - kill ${PID} - wait - --- -2.29.2 - diff --git a/gnutls-3.7.1-aggressive-realloc-fixes.patch b/gnutls-3.7.1-aggressive-realloc-fixes.patch new file mode 100644 index 0000000..dfe035f --- /dev/null +++ b/gnutls-3.7.1-aggressive-realloc-fixes.patch @@ -0,0 +1,84 @@ +From e1cf5b8694b23cdc88f4a4a344f8262aa8ab0f8e Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Wed, 10 Mar 2021 16:11:29 +0100 +Subject: [PATCH 1/2] _gnutls_buffer_resize: account for unused area if + AGGRESSIVE_REALLOC + +Signed-off-by: Daiki Ueno +--- + lib/str.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/lib/str.c b/lib/str.c +index 506fe1721..bc20ebb04 100644 +--- a/lib/str.c ++++ b/lib/str.c +@@ -155,12 +155,12 @@ int _gnutls_buffer_resize(gnutls_buffer_st * dest, size_t new_size) + + unused = MEMSUB(dest->data, dest->allocd); + dest->allocd = +- gnutls_realloc_fast(dest->allocd, new_size); ++ gnutls_realloc_fast(dest->allocd, new_size + unused); + if (dest->allocd == NULL) { + gnutls_assert(); + return GNUTLS_E_MEMORY_ERROR; + } +- dest->max_length = new_size; ++ dest->max_length = new_size + unused; + dest->data = dest->allocd + unused; + + return 0; +-- +2.30.2 + + +From 78691bfe4555c4d610b405173987ed7515515d20 Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Wed, 10 Mar 2021 16:12:23 +0100 +Subject: [PATCH 2/2] str: suppress -Wunused-function if AGGRESSIVE_REALLOC is + defined + +Signed-off-by: Daiki Ueno +--- + lib/str.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/lib/str.c b/lib/str.c +index bc20ebb04..8007340f1 100644 +--- a/lib/str.c ++++ b/lib/str.c +@@ -87,15 +87,6 @@ void _gnutls_buffer_clear(gnutls_buffer_st * str) + + #define MIN_CHUNK 1024 + +-static void align_allocd_with_data(gnutls_buffer_st * dest) +-{ +- assert(dest->allocd != NULL); +- assert(dest->data != NULL); +- if (dest->length) +- memmove(dest->allocd, dest->data, dest->length); +- dest->data = dest->allocd; +-} +- + /** + * gnutls_buffer_append_data: + * @dest: the buffer to append to +@@ -168,6 +159,15 @@ int _gnutls_buffer_resize(gnutls_buffer_st * dest, size_t new_size) + + #else + ++static void align_allocd_with_data(gnutls_buffer_st * dest) ++{ ++ assert(dest->allocd != NULL); ++ assert(dest->data != NULL); ++ if (dest->length) ++ memmove(dest->allocd, dest->data, dest->length); ++ dest->data = dest->allocd; ++} ++ + int _gnutls_buffer_resize(gnutls_buffer_st * dest, size_t new_size) + { + if (unlikely(dest->data != NULL && dest->allocd == NULL)) +-- +2.30.2 + diff --git a/gnutls.spec b/gnutls.spec index 51ff567..e743644 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,12 +1,9 @@ # This spec file has been automatically updated -Version: 3.7.0 -Release: 4%{?dist} +Version: 3.7.1 +Release: 1%{?dist} Patch1: gnutls-3.6.7-no-now-guile.patch Patch2: gnutls-3.2.7-rpath.patch -Patch3: gnutls-3.7.0-test-fixes.patch -Patch4: gnutls-3.7.0-gost.patch -Patch5: gnutls-3.7.0-duplicate-certs.patch -Patch6: gnutls-3.7.0-duplicate-certs-pkcs11.patch +Patch3: gnutls-3.7.1-aggressive-realloc-fixes.patch %bcond_with bootstrap %bcond_without dane %if 0%{?rhel} @@ -33,9 +30,6 @@ BuildRequires: libidn2-devel BuildRequires: libunistring-devel BuildRequires: net-tools, datefudge, softhsm, gcc, gcc-c++ BuildRequires: gnupg2 -%if %{with fips} -BuildRequires: fipscheck -%endif # for a sanity check on cert loading BuildRequires: p11-kit-trust, ca-certificates @@ -213,8 +207,9 @@ make %{?_smp_mflags} V=1 %{?__debug_package:%{__debug_install_post}} \ %{__arch_install_post} \ %{__os_install_post} \ - fipshmac -d $RPM_BUILD_ROOT%{_libdir} $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.* \ - file=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.hmac` && mv $RPM_BUILD_ROOT%{_libdir}/$file $RPM_BUILD_ROOT%{_libdir}/.$file && ln -s .$file $RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac \ + file=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*`.hmac && \ + mv $RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac $RPM_BUILD_ROOT%{_libdir}/.$file && \ + ln -s .$file $RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac \ %{nil} %endif @@ -293,6 +288,11 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %endif %changelog +* Sat Mar 13 2021 Daiki Ueno - 3.7.1-1 +- Update to upstream 3.7.1 release +- Remove fipscheck dependency, as it is now calculated with an + internal tool + * Fri Mar 5 2021 Daiki Ueno - 3.7.0-4 - Tolerate duplicate certs in the chain also with PKCS #11 trust store diff --git a/sources b/sources index da7e44a..37216a4 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (gnutls-3.7.0.tar.xz) = 5cf1025f2d0a0cbf5a83dd7f3b22dafd1769f7c3349096c0272d08573bb5ff87f510e0e69b4bbb47dad1b64476aa5479804b2f4ceb2216cd747bbc53bf42d885 -SHA512 (gnutls-3.7.0.tar.xz.sig) = 25793ac5e3d2610f95f26a2aa6f444a0cebe45a173cd330ed95b38c82b8f469024c9fa35249917f6b880ae32192b5e74988169a68724c08f5c82a3379fff82fd +SHA512 (gnutls-3.7.1.tar.xz) = 0fe801f03676c3bd970387f94578c8be7ba6030904989e7d21dffdc726209bab44c8096fbcb6d51fed2de239537bd00df2338ee9c8d984a1c386826b91062a95 +SHA512 (gnutls-3.7.1.tar.xz.sig) = 78327723cd23e515326bee4348f00ef2c11626267a715243d9392490e30d44965fc8997184a348d0c9a5beaf50be4028304a49a0c569a1e9f3998bda9000713d SHA512 (gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg) = a74b92826fd0e5388c9f6d9231959e38b26aeef83138648fab66df951d8e1a4db5302b569d08515d4d6443e5e4f6c466f98319f330c820790260d22a9b9f7173 From 43597a7ec6c85dafffe67512102e1d9da6a7608a Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 16 Mar 2021 08:03:06 +0100 Subject: [PATCH 06/18] Temporarily restore fipscheck dependency This seems to be causing self-test failure in FIPS mode: https://gitlab.com/gnutls/gnutls/-/issues/1191 --- gnutls.spec | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/gnutls.spec b/gnutls.spec index e743644..4d80526 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 3.7.1 -Release: 1%{?dist} +Release: 2%{?dist} Patch1: gnutls-3.6.7-no-now-guile.patch Patch2: gnutls-3.2.7-rpath.patch Patch3: gnutls-3.7.1-aggressive-realloc-fixes.patch @@ -30,6 +30,9 @@ BuildRequires: libidn2-devel BuildRequires: libunistring-devel BuildRequires: net-tools, datefudge, softhsm, gcc, gcc-c++ BuildRequires: gnupg2 +%if %{with fips} +BuildRequires: fipscheck +%endif # for a sanity check on cert loading BuildRequires: p11-kit-trust, ca-certificates @@ -207,9 +210,9 @@ make %{?_smp_mflags} V=1 %{?__debug_package:%{__debug_install_post}} \ %{__arch_install_post} \ %{__os_install_post} \ - file=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*`.hmac && \ - mv $RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac $RPM_BUILD_ROOT%{_libdir}/.$file && \ - ln -s .$file $RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac \ + rm -f $RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.*.hmac \ + fipshmac -d $RPM_BUILD_ROOT%{_libdir} $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.* \ + file=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.hmac` && mv $RPM_BUILD_ROOT%{_libdir}/$file $RPM_BUILD_ROOT%{_libdir}/.$file && ln -s .$file $RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac \ %{nil} %endif @@ -288,6 +291,9 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %endif %changelog +* Tue Mar 16 2021 Daiki Ueno - 3.7.1-2 +- Restore fipscheck dependency + * Sat Mar 13 2021 Daiki Ueno - 3.7.1-1 - Update to upstream 3.7.1 release - Remove fipscheck dependency, as it is now calculated with an From 02209e3365041eb641562f061cb5799105798ee4 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Sun, 14 Mar 2021 11:03:06 +0100 Subject: [PATCH 07/18] Remove %defattr invocations which are no longer necessary --- gnutls.spec | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/gnutls.spec b/gnutls.spec index 4d80526..b650258 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 3.7.1 -Release: 2%{?dist} +Release: 3%{?dist} Patch1: gnutls-3.6.7-no-now-guile.patch Patch2: gnutls-3.2.7-rpath.patch Patch3: gnutls-3.7.1-aggressive-realloc-fixes.patch @@ -234,7 +234,6 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %files -f gnutls.lang -%defattr(-,root,root,-) %{_libdir}/libgnutls.so.30* %if %{with fips} %{_libdir}/.libgnutls.so.30*.hmac @@ -246,7 +245,6 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %{_libdir}/libgnutlsxx.so.* %files devel -%defattr(-,root,root,-) %{_includedir}/* %{_libdir}/libgnutls*.so %if %{with fips} @@ -260,7 +258,6 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %{_docdir}/manual/* %files utils -%defattr(-,root,root,-) %{_bindir}/certtool %{_bindir}/tpmtool %{_bindir}/ocsptool @@ -276,13 +273,11 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %if %{with dane} %files dane -%defattr(-,root,root,-) %{_libdir}/libgnutls-dane.so.* %endif %if %{with guile} %files guile -%defattr(-,root,root,-) %{_libdir}/guile/2.2/guile-gnutls*.so* %{_libdir}/guile/2.2/site-ccache/gnutls.go %{_libdir}/guile/2.2/site-ccache/gnutls/extra.go @@ -291,6 +286,9 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %endif %changelog +* Sun Mar 28 2021 Daiki Ueno - 3.7.1-3 +- Remove %%defattr invocations which are no longer necessary + * Tue Mar 16 2021 Daiki Ueno - 3.7.1-2 - Restore fipscheck dependency From 55cc52f801657c2587ab5d1a044adf03a4a51b73 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Sun, 14 Mar 2021 11:04:54 +0100 Subject: [PATCH 08/18] libpkcs11mock1.* is not installed anymore --- gnutls.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gnutls.spec b/gnutls.spec index b650258..64ca31d 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -223,7 +223,6 @@ rm -f $RPM_BUILD_ROOT%{_infodir}/dir rm -f $RPM_BUILD_ROOT%{_libdir}/*.la rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.2/guile-gnutls*.a rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.2/guile-gnutls*.la -rm -f $RPM_BUILD_ROOT%{_libdir}/gnutls/libpkcs11mock1.* %if %{without dane} rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc %endif @@ -288,6 +287,7 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %changelog * Sun Mar 28 2021 Daiki Ueno - 3.7.1-3 - Remove %%defattr invocations which are no longer necessary +- libpkcs11mock1.* is not installed anymore * Tue Mar 16 2021 Daiki Ueno - 3.7.1-2 - Restore fipscheck dependency From 9a791a76c8c513bd3afa4316421885a0552a5f86 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Sun, 14 Mar 2021 11:07:59 +0100 Subject: [PATCH 09/18] hobble-gnutls: Remove SRP removal The SRP patent expired in May 2015 so this doesn't make any sense. We actually haven't used this hobble-gnutls script since 3.5.12 update in 2017: https://src.fedoraproject.org/rpms/gnutls/c/5651d6db313d5d2a15f7efe6b05c7eb85cfdb30b OpenSSL also does no longer disable it since: https://src.fedoraproject.org/rpms/openssl/c/1ff978b22e53e729cb86c4b8783b2d13cf3734b6 --- gnutls.spec | 1 + hobble-gnutls | 7 ------- 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/gnutls.spec b/gnutls.spec index 64ca31d..bed226a 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -288,6 +288,7 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null * Sun Mar 28 2021 Daiki Ueno - 3.7.1-3 - Remove %%defattr invocations which are no longer necessary - libpkcs11mock1.* is not installed anymore +- hobble-gnutls: Remove SRP removal * Tue Mar 16 2021 Daiki Ueno - 3.7.1-2 - Restore fipscheck dependency diff --git a/hobble-gnutls b/hobble-gnutls index 0989b6c..dd914a5 100755 --- a/hobble-gnutls +++ b/hobble-gnutls @@ -6,10 +6,3 @@ if [ "$1" = "-e" ] ; then else CMD="rm -f" fi - -# SRP -for f in auth/srp_sb64.c auth/srp_passwd.c auth/srp_rsa.c \ - srp.c auth/srp.c ext/srp.c ; do - eval "$CMD lib/$f" -done - From 202e58ecbe560be6e615107dc9b4db8089094c37 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Sun, 14 Mar 2021 11:14:36 +0100 Subject: [PATCH 10/18] Use correct source URL --- gnutls.spec | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/gnutls.spec b/gnutls.spec index bed226a..64387a8 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -50,8 +50,8 @@ BuildRequires: guile22-devel %endif BuildRequires: make URL: http://www.gnutls.org/ -Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz -Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz.sig +Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/%{name}-%{version}.tar.xz +Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/%{name}-%{version}.tar.xz.sig Source2: gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 @@ -289,6 +289,7 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null - Remove %%defattr invocations which are no longer necessary - libpkcs11mock1.* is not installed anymore - hobble-gnutls: Remove SRP removal +- Use correct source URL * Tue Mar 16 2021 Daiki Ueno - 3.7.1-2 - Restore fipscheck dependency From e964e868db25d5b29f6c9e611eee1038bcb0e9f8 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Sun, 28 Mar 2021 08:53:10 +0200 Subject: [PATCH 11/18] Switch to using %gpgverify macro --- gnutls.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/gnutls.spec b/gnutls.spec index 64387a8..5f67111 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -145,7 +145,7 @@ This package contains Guile bindings for the library. %endif %prep -gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} +%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' %autosetup -p1 %if %{with bootstrap} @@ -290,6 +290,7 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null - libpkcs11mock1.* is not installed anymore - hobble-gnutls: Remove SRP removal - Use correct source URL +- Switch to using %%gpgverify macro * Tue Mar 16 2021 Daiki Ueno - 3.7.1-2 - Restore fipscheck dependency From 2c6449ac95cc0555040573c15b4fdd04496179b1 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Sat, 29 May 2021 16:06:11 +0200 Subject: [PATCH 12/18] Update to upstream 3.7.2 release --- .gitignore | 2 + gnutls-3.7.1-aggressive-realloc-fixes.patch | 84 --------------------- gnutls.spec | 8 +- sources | 4 +- 4 files changed, 9 insertions(+), 89 deletions(-) delete mode 100644 gnutls-3.7.1-aggressive-realloc-fixes.patch diff --git a/.gitignore b/.gitignore index 0f9ce46..9ea9030 100644 --- a/.gitignore +++ b/.gitignore @@ -133,3 +133,5 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.7.0.tar.xz.sig /gnutls-3.7.1.tar.xz /gnutls-3.7.1.tar.xz.sig +/gnutls-3.7.2.tar.xz +/gnutls-3.7.2.tar.xz.sig diff --git a/gnutls-3.7.1-aggressive-realloc-fixes.patch b/gnutls-3.7.1-aggressive-realloc-fixes.patch deleted file mode 100644 index dfe035f..0000000 --- a/gnutls-3.7.1-aggressive-realloc-fixes.patch +++ /dev/null @@ -1,84 +0,0 @@ -From e1cf5b8694b23cdc88f4a4a344f8262aa8ab0f8e Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Wed, 10 Mar 2021 16:11:29 +0100 -Subject: [PATCH 1/2] _gnutls_buffer_resize: account for unused area if - AGGRESSIVE_REALLOC - -Signed-off-by: Daiki Ueno ---- - lib/str.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/lib/str.c b/lib/str.c -index 506fe1721..bc20ebb04 100644 ---- a/lib/str.c -+++ b/lib/str.c -@@ -155,12 +155,12 @@ int _gnutls_buffer_resize(gnutls_buffer_st * dest, size_t new_size) - - unused = MEMSUB(dest->data, dest->allocd); - dest->allocd = -- gnutls_realloc_fast(dest->allocd, new_size); -+ gnutls_realloc_fast(dest->allocd, new_size + unused); - if (dest->allocd == NULL) { - gnutls_assert(); - return GNUTLS_E_MEMORY_ERROR; - } -- dest->max_length = new_size; -+ dest->max_length = new_size + unused; - dest->data = dest->allocd + unused; - - return 0; --- -2.30.2 - - -From 78691bfe4555c4d610b405173987ed7515515d20 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Wed, 10 Mar 2021 16:12:23 +0100 -Subject: [PATCH 2/2] str: suppress -Wunused-function if AGGRESSIVE_REALLOC is - defined - -Signed-off-by: Daiki Ueno ---- - lib/str.c | 18 +++++++++--------- - 1 file changed, 9 insertions(+), 9 deletions(-) - -diff --git a/lib/str.c b/lib/str.c -index bc20ebb04..8007340f1 100644 ---- a/lib/str.c -+++ b/lib/str.c -@@ -87,15 +87,6 @@ void _gnutls_buffer_clear(gnutls_buffer_st * str) - - #define MIN_CHUNK 1024 - --static void align_allocd_with_data(gnutls_buffer_st * dest) --{ -- assert(dest->allocd != NULL); -- assert(dest->data != NULL); -- if (dest->length) -- memmove(dest->allocd, dest->data, dest->length); -- dest->data = dest->allocd; --} -- - /** - * gnutls_buffer_append_data: - * @dest: the buffer to append to -@@ -168,6 +159,15 @@ int _gnutls_buffer_resize(gnutls_buffer_st * dest, size_t new_size) - - #else - -+static void align_allocd_with_data(gnutls_buffer_st * dest) -+{ -+ assert(dest->allocd != NULL); -+ assert(dest->data != NULL); -+ if (dest->length) -+ memmove(dest->allocd, dest->data, dest->length); -+ dest->data = dest->allocd; -+} -+ - int _gnutls_buffer_resize(gnutls_buffer_st * dest, size_t new_size) - { - if (unlikely(dest->data != NULL && dest->allocd == NULL)) --- -2.30.2 - diff --git a/gnutls.spec b/gnutls.spec index 5f67111..6d2895a 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,9 +1,8 @@ # This spec file has been automatically updated -Version: 3.7.1 -Release: 3%{?dist} +Version: 3.7.2 +Release: 1%{?dist} Patch1: gnutls-3.6.7-no-now-guile.patch Patch2: gnutls-3.2.7-rpath.patch -Patch3: gnutls-3.7.1-aggressive-realloc-fixes.patch %bcond_with bootstrap %bcond_without dane %if 0%{?rhel} @@ -285,6 +284,9 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %endif %changelog +* Sat May 29 2021 Daiki Ueno - 3.7.2-1 +- Update to upstream 3.7.2 release + * Sun Mar 28 2021 Daiki Ueno - 3.7.1-3 - Remove %%defattr invocations which are no longer necessary - libpkcs11mock1.* is not installed anymore diff --git a/sources b/sources index 37216a4..52f21ca 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (gnutls-3.7.1.tar.xz) = 0fe801f03676c3bd970387f94578c8be7ba6030904989e7d21dffdc726209bab44c8096fbcb6d51fed2de239537bd00df2338ee9c8d984a1c386826b91062a95 -SHA512 (gnutls-3.7.1.tar.xz.sig) = 78327723cd23e515326bee4348f00ef2c11626267a715243d9392490e30d44965fc8997184a348d0c9a5beaf50be4028304a49a0c569a1e9f3998bda9000713d +SHA512 (gnutls-3.7.2.tar.xz) = 5d01d561a05379da71e4847e30ba13c2abe09f7a5c4359fd539d8bd19abad0ce87120f82ee7b6264e787bd3edbc5ae16beffa892983cbc3d59f11a1811c10329 +SHA512 (gnutls-3.7.2.tar.xz.sig) = fc3314c0ce5fb608352fcd8e19efd14435e4cfa5c0eb843d86febb6053fec7d46774b637037b96c5a621a7001f89d6c110f75bff96f94c2a77caf5d9c3aa9447 SHA512 (gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg) = a74b92826fd0e5388c9f6d9231959e38b26aeef83138648fab66df951d8e1a4db5302b569d08515d4d6443e5e4f6c466f98319f330c820790260d22a9b9f7173 From 7e1d46e3df393f1c7c33e8f7be111f1b9bb59dde Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Thu, 24 Feb 2022 16:34:53 +0100 Subject: [PATCH 13/18] Fix race condition in gnutls_x509_trust_list_verify_crt2 (#2050164) Signed-off-by: Zoltan Fridrich --- gnutls-3.7.3-fix-race-condition.patch | 45 +++++++++++++++++++++++++++ gnutls.spec | 8 +++-- 2 files changed, 51 insertions(+), 2 deletions(-) create mode 100644 gnutls-3.7.3-fix-race-condition.patch diff --git a/gnutls-3.7.3-fix-race-condition.patch b/gnutls-3.7.3-fix-race-condition.patch new file mode 100644 index 0000000..00b8b38 --- /dev/null +++ b/gnutls-3.7.3-fix-race-condition.patch @@ -0,0 +1,45 @@ +From 22f837ba0bc7d13c3d738a8583566368fc12aee1 Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Sat, 30 Oct 2021 08:56:07 +0200 +Subject: [PATCH] x509: fix thread-safety in gnutls_x509_trust_list_verify_crt2 + +This function previously used gnutls_x509_trust_list_get_issuer +without GNUTLS_TL_GET_COPY flag, which is required when the function +is called from multi-threaded application and PKCS #11 trust store is +in use. + +Reported and the change suggested by Remi Gacogne in: +https://gitlab.com/gnutls/gnutls/-/issues/1277 + +Signed-off-by: Daiki Ueno +--- + lib/x509/verify-high.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/lib/x509/verify-high.c b/lib/x509/verify-high.c +index ab8e006ca7..5698d4f372 100644 +--- a/lib/x509/verify-high.c ++++ b/lib/x509/verify-high.c +@@ -1102,7 +1102,8 @@ int trust_list_get_issuer_by_dn(gnutls_x509_trust_list_t list, + * gnutls_x509_trust_list_get_issuer: + * @list: The list + * @cert: is the certificate to find issuer for +- * @issuer: Will hold the issuer if any. Should be treated as constant. ++ * @issuer: Will hold the issuer if any. Should be treated as constant ++ * unless %GNUTLS_TL_GET_COPY is set in @flags. + * @flags: flags from %gnutls_trust_list_flags_t (%GNUTLS_TL_GET_COPY is applicable) + * + * This function will find the issuer of the given certificate. +@@ -1521,7 +1522,8 @@ gnutls_x509_trust_list_verify_crt2(gnutls_x509_trust_list_t list, + if (gnutls_x509_trust_list_get_issuer(list, + cert_list[i - 1], + &issuer, +- 0) == 0) { ++ GNUTLS_TL_GET_COPY) == 0) { ++ gnutls_x509_crt_deinit(issuer); + cert_list_size = i; + break; + } +-- +GitLab + diff --git a/gnutls.spec b/gnutls.spec index 6d2895a..cd3eba6 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,8 +1,9 @@ # This spec file has been automatically updated -Version: 3.7.2 -Release: 1%{?dist} +Version: 3.7.2 +Release: 2%{?dist} Patch1: gnutls-3.6.7-no-now-guile.patch Patch2: gnutls-3.2.7-rpath.patch +Patch3: gnutls-3.7.3-fix-race-condition.patch %bcond_with bootstrap %bcond_without dane %if 0%{?rhel} @@ -284,6 +285,9 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %endif %changelog +* Thu Feb 24 2022 Zoltan Fridrich - 3.7.2-2 +- Fix race condition in gnutls_x509_trust_list_verify_crt2 (#2050164) + * Sat May 29 2021 Daiki Ueno - 3.7.2-1 - Update to upstream 3.7.2 release From 4bcf37f14fda357c852f54ab40a10e38438f3031 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Mon, 25 Apr 2022 15:41:38 +0200 Subject: [PATCH 14/18] Prepare for automation - add gpg key - add rpmautospec macros Signed-off-by: Zoltan Fridrich --- .gitignore | 1 - changelog | 807 +++++++++++++++++ gnutls.spec | 810 +----------------- ...2225C3B46F34879FC8496CD605848ED7E69871.gpg | Bin 0 -> 48528 bytes sources | 1 - 5 files changed, 809 insertions(+), 810 deletions(-) create mode 100644 changelog create mode 100644 gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg diff --git a/.gitignore b/.gitignore index 9ea9030..ede02f4 100644 --- a/.gitignore +++ b/.gitignore @@ -126,7 +126,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.6.13.tar.xz /gnutls-3.6.14.tar.xz /gnutls-3.6.14.tar.xz.sig -/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg /gnutls-3.6.15.tar.xz /gnutls-3.6.15.tar.xz.sig /gnutls-3.7.0.tar.xz diff --git a/changelog b/changelog new file mode 100644 index 0000000..cf000fe --- /dev/null +++ b/changelog @@ -0,0 +1,807 @@ +* Thu Feb 24 2022 Zoltan Fridrich - 3.7.2-2 +- Fix race condition in gnutls_x509_trust_list_verify_crt2 (#2050164) + +* Sat May 29 2021 Daiki Ueno - 3.7.2-1 +- Update to upstream 3.7.2 release + +* Sun Mar 28 2021 Daiki Ueno - 3.7.1-3 +- Remove %%defattr invocations which are no longer necessary +- libpkcs11mock1.* is not installed anymore +- hobble-gnutls: Remove SRP removal +- Use correct source URL +- Switch to using %%gpgverify macro + +* Tue Mar 16 2021 Daiki Ueno - 3.7.1-2 +- Restore fipscheck dependency + +* Sat Mar 13 2021 Daiki Ueno - 3.7.1-1 +- Update to upstream 3.7.1 release +- Remove fipscheck dependency, as it is now calculated with an + internal tool + +* Fri Mar 5 2021 Daiki Ueno - 3.7.0-4 +- Tolerate duplicate certs in the chain also with PKCS #11 trust store + +* Tue Mar 2 2021 Daiki Ueno - 3.7.0-3 +- Reduce BRs for non-bootstrapping build + +* Wed Feb 10 2021 Daiki Ueno - 3.7.0-2 +- Tolerate duplicate certs in the chain + +* Mon Feb 8 2021 Daiki Ueno - 3.7.0-1 +- Update to upstream 3.7.0 release +- Temporarily disable LTO + +* Tue Jan 26 2021 Daiki Ueno - 3.6.15-4 +- Fix broken tests on rawhide (#1908110) +- Add BuildRequires: make (by Tom Stellard) + +* Tue Jan 26 2021 Fedora Release Engineering - 3.6.15-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Mon Sep 28 2020 Jeff Law - 3.6.15-2 +- Re-enable LTO now that upstream GCC bugs have been fixed + +* Fri Sep 4 2020 Daiki Ueno - 3.6.15-1 +- Update to upstream 3.6.15 release + +* Mon Aug 17 2020 Jeff Law - 3.6.14-7 +- Disable LTO on ppc64le + +* Tue Aug 4 2020 Daiki Ueno - 3.6.14-6 +- Fix underlinking of libpthread + +* Sat Aug 01 2020 Fedora Release Engineering - 3.6.14-5 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon Jul 27 2020 Fedora Release Engineering - 3.6.14-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Thu Jul 02 2020 Anderson Sasaki - 3.6.14-3 +- Rebuild with autogen built with guile-2.2 (#1852706) + +* Tue Jun 09 2020 Anderson Sasaki - 3.6.14-2 +- Fix memory leak when serializing iovec_t (#1845083) +- Fix automatic libraries sonames detection (#1845806) + +* Thu Jun 4 2020 Daiki Ueno - 3.6.14-1 +- Update to upstream 3.6.14 release + +* Sun May 31 2020 Daiki Ueno - 3.6.13-6 +- Update gnutls-3.6.13-superseding-chain.patch + +* Sun May 31 2020 Daiki Ueno - 3.6.13-5 +- Fix cert chain validation behavior if the last cert has expired (#1842178) + +* Mon May 25 2020 Anderson Sasaki - 3.6.13-4 +- Add option to gnutls-cli to wait for resumption under TLS 1.3 + +* Tue May 19 2020 Anderson Sasaki - 3.6.13-3 +- Disable RSA blinding during FIPS self-tests + +* Thu May 14 2020 Anderson Sasaki - 3.6.13-2 +- Bump linked libraries soname to fix FIPS selftests (#1835265) + +* Tue Mar 31 2020 Daiki Ueno - 3.6.13-1 +- Update to upstream 3.6.13 release + +* Thu Mar 26 2020 Anderson Sasaki - 3.6.12-2 +- Fix FIPS POST (#1813384) +- Fix gnutls-serv --echo to not exit when a message is received (#1816583) + +* Sun Feb 02 2020 Nikos Mavrogiannopoulos - 3.6.12-1 +- Update to upstream 3.6.12 release + +* Tue Jan 28 2020 Fedora Release Engineering - 3.6.11-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Mon Dec 02 2019 Nikos Mavrogiannopoulos - 3.6.11-1 +- Update to upstream 3.6.11 release + +* Sun Sep 29 2019 Nikos Mavrogiannopoulos - 3.6.10-1 +- Update to upstream 3.6.10 release + +* Fri Jul 26 2019 Nikos Mavrogiannopoulos - 3.6.9-1 +- Update to upstream 3.6.9 release + +* Thu Jul 25 2019 Fedora Release Engineering - 3.6.8-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Mon Jul 15 2019 Nikos Mavrogiannopoulos - 3.6.8-2 +- Rebuilt with guile-2.2 + +* Tue May 28 2019 Nikos Mavrogiannopoulos - 3.6.8-1 +- Update to upstream 3.6.8 release + +* Wed Mar 27 2019 Anderson Toshiyuki Sasaki - 3.6.7-1 +- Update to upstream 3.6.7 release +- Fixed CVE-2019-3836 (#1693214) +- Fixed CVE-2019-3829 (#1693210) + +* Fri Feb 1 2019 Nikos Mavrogiannopoulos - 3.6.6-1 +- Update to upstream 3.6.6 release + +* Thu Jan 31 2019 Fedora Release Engineering - 3.6.5-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Fri Jan 11 2019 Anderson Toshiyuki Sasaki - 3.6.5-2 +- Added explicit Requires for nettle >= 3.4.1 + +* Tue Dec 11 2018 Anderson Toshiyuki Sasaki - 3.6.5-1 +- Update to upstream 3.6.5 release + +* Mon Oct 29 2018 James Antill - 3.6.4-5 +- Remove ldconfig scriptlet, now done via. transfiletrigger in glibc. + +* Wed Oct 17 2018 Nikos Mavrogiannopoulos - 3.6.4-4 +- Fix issue with rehandshake affecting glib-networking (#1634736) + +* Tue Oct 16 2018 Tomáš Mráz - 3.6.4-3 +- Add missing annobin notes for assembler sources + +* Tue Oct 09 2018 Petr Menšík - 3.6.4-2 +- Rebuilt for unbound 1.8 + +* Tue Sep 25 2018 Nikos Mavrogiannopoulos - 3.6.4-1 +- Updated to upstream 3.6.4 release +- Added support for the latest version of the TLS1.3 protocol +- Enabled SHA1 support as SHA1 deprecation is handled via the + fedora crypto policies. + +* Thu Aug 16 2018 Nikos Mavrogiannopoulos - 3.6.3-4 +- Fixed gnutls-cli input reading +- Ensure that we do not cause issues with version rollback detection + and TLS1.3. + +* Tue Aug 07 2018 Nikos Mavrogiannopoulos - 3.6.3-3 +- Fixed ECDSA public key import (#1612803) + +* Thu Jul 26 2018 Nikos Mavrogiannopoulos - 3.6.3-2 +- Backported regression fixes from 3.6.2 + +* Mon Jul 16 2018 Nikos Mavrogiannopoulos - 3.6.3-1 +- Update to upstream 3.6.3 release + +* Fri Jul 13 2018 Fedora Release Engineering - 3.6.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Wed Jun 13 2018 Nikos Mavrogiannopoulos - 3.6.2-4 +- Enable FIPS140-2 mode in Fedora + +* Wed Jun 06 2018 Nikos Mavrogiannopoulos - 3.6.2-3 +- Update to upstream 3.6.2 release + +* Fri May 25 2018 David Abdurachmanov - 3.6.2-2 +- Add missing BuildRequires: gnupg2 for gpgv2 in %%prep + +* Fri Feb 16 2018 Nikos Mavrogiannopoulos - 3.6.2-1 +- Update to upstream 3.6.2 release + +* Wed Feb 07 2018 Fedora Release Engineering - 3.6.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Fri Feb 2 2018 Nikos Mavrogiannopoulos - 3.6.1-4 +- Rebuilt to address incompatibility with new nettle + +* Thu Nov 30 2017 Nikos Mavrogiannopoulos - 3.6.1-3 +- Corrected regression from 3.6.1-2 which prevented the loading of + arbitrary p11-kit modules (#1507402) + +* Mon Nov 6 2017 Nikos Mavrogiannopoulos - 3.6.1-2 +- Prevent the loading of all PKCS#11 modules on certificate verification + but only restrict to p11-kit trust module (#1507402) + +* Sat Oct 21 2017 Nikos Mavrogiannopoulos - 3.6.1-1 +- Update to upstream 3.6.1 release + +* Mon Aug 21 2017 Nikos Mavrogiannopoulos - 3.6.0-1 +- Update to upstream 3.6.0 release + +* Wed Aug 02 2017 Fedora Release Engineering - 3.5.14-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Wed Jul 26 2017 Fedora Release Engineering - 3.5.14-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Tue Jul 04 2017 Nikos Mavrogiannopoulos - 3.5.14-1 +- Update to upstream 3.5.14 release + +* Wed Jun 07 2017 Nikos Mavrogiannopoulos - 3.5.13-1 +- Update to upstream 3.5.13 release + +* Thu May 11 2017 Nikos Mavrogiannopoulos - 3.5.12-2 +- Fix issue with p11-kit-trust arch dependency + +* Thu May 11 2017 Nikos Mavrogiannopoulos - 3.5.12-1 +- Update to upstream 3.5.12 release + +* Fri Apr 07 2017 Nikos Mavrogiannopoulos - 3.5.11-1 +- Update to upstream 3.5.11 release + +* Mon Mar 06 2017 Nikos Mavrogiannopoulos - 3.5.10-1 +- Update to upstream 3.5.10 release + +* Wed Feb 15 2017 Nikos Mavrogiannopoulos - 3.5.9-2 +- Work around missing pkg-config file (#1422256) + +* Tue Feb 14 2017 Nikos Mavrogiannopoulos - 3.5.9-1 +- Update to upstream 3.5.9 release + +* Fri Feb 10 2017 Fedora Release Engineering - 3.5.8-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Sat Feb 4 2017 Nikos Mavrogiannopoulos 3.5.8-2 +- Added patch fix initialization issue in gnutls_pkcs11_obj_list_import_url4 + +* Mon Jan 9 2017 Nikos Mavrogiannopoulos 3.5.8-1 +- New upstream release + +* Tue Dec 13 2016 Nikos Mavrogiannopoulos 3.5.7-3 +- Fix PKCS#8 file loading (#1404084) + +* Thu Dec 8 2016 Nikos Mavrogiannopoulos 3.5.7-1 +- New upstream release + +* Fri Nov 4 2016 Nikos Mavrogiannopoulos 3.5.6-1 +- New upstream release + +* Tue Oct 11 2016 walters@redhat.com - 3.5.5-2 +- Apply patch to fix compatibility with ostree (#1383708) + +* Mon Oct 10 2016 Nikos Mavrogiannopoulos 3.5.5-1 +- New upstream release + +* Thu Sep 8 2016 Nikos Mavrogiannopoulos 3.5.4-1 +- New upstream release + +* Mon Aug 29 2016 Nikos Mavrogiannopoulos 3.5.3-2 +- Work around #1371082 for x86 +- Fixed issue with DTLS sliding window implementation (#1370881) + +* Tue Aug 9 2016 Nikos Mavrogiannopoulos 3.5.3-1 +- New upstream release + +* Wed Jul 6 2016 Nikos Mavrogiannopoulos 3.5.2-1 +- New upstream release + +* Wed Jun 15 2016 Nikos Mavrogiannopoulos 3.5.1-1 +- New upstream release + +* Tue Jun 7 2016 Nikos Mavrogiannopoulos 3.4.13-1 +- New upstream release (#1343258) +- Addresses issue with setuid programs introduced in 3.4.12 (#1343342) + +* Fri May 20 2016 Nikos Mavrogiannopoulos 3.4.12-1 +- New upstream release + +* Mon Apr 11 2016 Nikos Mavrogiannopoulos 3.4.11-1 +- New upstream release + +* Fri Mar 4 2016 Nikos Mavrogiannopoulos 3.4.10-1 +- New upstream release (#1314576) + +* Wed Feb 3 2016 Nikos Mavrogiannopoulos 3.4.9-1 +- Fix broken key usage flags introduced in 3.4.8 (#1303355) + +* Mon Jan 11 2016 Nikos Mavrogiannopoulos 3.4.8-1 +- New upstream release (#1297079) + +* Mon Nov 23 2015 Nikos Mavrogiannopoulos 3.4.7-1 +- New upstream release (#1284300) +- Documentation updates (#1282864) +- Adds interface to set unique IDs in certificates (#1281343) +- Allow arbitrary key sizes with ARCFOUR (#1284401) + +* Wed Oct 21 2015 Nikos Mavrogiannopoulos 3.4.6-1 +- New upstream release (#1273672) +- Enhances p11tool to write CKA_ISSUER and CKA_SERIAL_NUMBER (#1272178) + +* Tue Oct 20 2015 Adam Williamson - 3.4.5-2 +- fix interaction with Chrome 45+ (master secret extension) (#1273102) + +* Mon Sep 14 2015 Nikos Mavrogiannopoulos 3.4.5-1 +- New upstream release (#1252192) +- Eliminates hard limits on CRL parsing of certtool. + +* Mon Aug 10 2015 Nikos Mavrogiannopoulos 3.4.4-1 +- new upstream release +- no longer requires trousers patch +- fixes issue in gnutls_x509_privkey_import (#1250020) + +* Mon Jul 13 2015 Nikos Mavrogiannopoulos 3.4.3-2 +- Don't link against trousers but rather dlopen() it when available. + That avoids a dependency on openssl by the main library. + +* Mon Jul 13 2015 Nikos Mavrogiannopoulos 3.4.3-1 +- new upstream release + +* Thu Jul 02 2015 Adam Jackson 3.4.2-3 +- Only disable -z now for the guile modules + +* Thu Jun 18 2015 Nikos Mavrogiannopoulos 3.4.2-2 +- rename the symbol version for internal symbols to avoid clashes + with 3.3.x. + +* Wed Jun 17 2015 Nikos Mavrogiannopoulos 3.4.2-1 +- new upstream release + +* Tue May 5 2015 Nikos Mavrogiannopoulos 3.4.1-2 +- Provide missing GNUTLS_SUPPLEMENTAL_USER_MAPPING_DATA definition + +* Mon May 4 2015 Nikos Mavrogiannopoulos 3.4.1-1 +- new upstream release + +* Sat May 02 2015 Kalev Lember - 3.3.14-2 +- Rebuilt for GCC 5 C++11 ABI change + +* Mon Mar 30 2015 Nikos Mavrogiannopoulos 3.3.14-1 +- new upstream release +- improved BER decoding of PKCS #12 structures (#1131461) + +* Fri Mar 6 2015 Nikos Mavrogiannopoulos 3.3.13-3 +- Build with hardened flags +- Removed -Wl,--no-add-needed linker flag + +* Fri Feb 27 2015 Till Maas - 3.3.13-2 +- Do not build with hardened flags + +* Thu Feb 26 2015 Nikos Mavrogiannopoulos 3.3.13-1 +- new upstream release + +* Sat Feb 21 2015 Till Maas - 3.3.12-3 +- Make build verbose +- Use %%license + +* Sat Feb 21 2015 Till Maas - 3.3.12-2 +- Rebuilt for Fedora 23 Change + https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code + +* Mon Jan 19 2015 Nikos Mavrogiannopoulos 3.3.12-1 +- new upstream release + +* Mon Jan 5 2015 Nikos Mavrogiannopoulos 3.3.11-2 +- enabled guile bindings (#1177847) + +* Thu Dec 11 2014 Nikos Mavrogiannopoulos 3.3.11-1 +- new upstream release + +* Mon Nov 10 2014 Nikos Mavrogiannopoulos 3.3.10-1 +- new upstream release + +* Thu Oct 23 2014 Nikos Mavrogiannopoulos 3.3.9-2 +- applied fix for issue in get-issuer (#1155901) + +* Mon Oct 13 2014 Nikos Mavrogiannopoulos 3.3.9-1 +- new upstream release + +* Fri Sep 19 2014 Nikos Mavrogiannopoulos 3.3.8-2 +- strip rpath from library + +* Thu Sep 18 2014 Nikos Mavrogiannopoulos 3.3.8-1 +- new upstream release + +* Mon Aug 25 2014 Nikos Mavrogiannopoulos 3.3.7-1 +- new upstream release + +* Sat Aug 16 2014 Fedora Release Engineering - 3.3.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Wed Jul 23 2014 Nikos Mavrogiannopoulos 3.3.6-1 +- new upstream release + +* Tue Jul 01 2014 Nikos Mavrogiannopoulos 3.3.5-2 +- Added work-around for s390 builds with gcc 4.9 (#1102324) + +* Mon Jun 30 2014 Nikos Mavrogiannopoulos 3.3.5-1 +- new upstream release + +* Tue Jun 17 2014 Nikos Mavrogiannopoulos 3.3.4-3 +- explicitly depend on p11-kit-trust + +* Sat Jun 07 2014 Fedora Release Engineering - 3.3.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Mon Jun 02 2014 Nikos Mavrogiannopoulos 3.3.4-1 +- new upstream release + +* Fri May 30 2014 Nikos Mavrogiannopoulos 3.3.3-1 +- new upstream release + +* Wed May 21 2014 Nikos Mavrogiannopoulos 3.3.2-2 +- Require crypto-policies + +* Fri May 09 2014 Nikos Mavrogiannopoulos 3.3.2-1 +- new upstream release + +* Mon May 05 2014 Nikos Mavrogiannopoulos 3.3.1-4 +- Replaced /etc/crypto-profiles/apps with /etc/crypto-policies/back-ends. +- Added support for "very weak" profile. + +* Mon Apr 28 2014 Nikos Mavrogiannopoulos 3.3.1-2 +- gnutls_global_deinit() will not do anything if the previous + initialization has failed (#1091053) + +* Mon Apr 28 2014 Nikos Mavrogiannopoulos 3.3.1-1 +- new upstream release + +* Mon Apr 14 2014 Nikos Mavrogiannopoulos 3.3.0-1 +- new upstream release + +* Tue Apr 08 2014 Nikos Mavrogiannopoulos 3.2.13-1 +- new upstream release + +* Wed Mar 05 2014 Nikos Mavrogiannopoulos 3.2.12.1-1 +- new upstream release + +* Mon Mar 03 2014 Nikos Mavrogiannopoulos 3.2.12-1 +- new upstream release + +* Mon Feb 03 2014 Nikos Mavrogiannopoulos 3.2.10-2 +- use p11-kit trust store for certificate verification + +* Mon Feb 03 2014 Nikos Mavrogiannopoulos 3.2.10-1 +- new upstream release + +* Tue Jan 14 2014 Tomáš Mráz 3.2.8-2 +- build the crywrap tool + +* Mon Dec 23 2013 Nikos Mavrogiannopoulos 3.2.8-1 +- new upstream release + +* Wed Dec 4 2013 Nikos Mavrogiannopoulos 3.2.7-2 +- Use the correct root key for unbound /var/lib/unbound/root.key (#1012494) +- Pull asm fixes from upstream (#973210) + +* Mon Nov 25 2013 Nikos Mavrogiannopoulos 3.2.7-1 +- new upstream release +- added dependency to autogen-libopts-devel to use the system's + libopts library +- added dependency to trousers-devel to enable TPM support + +* Mon Nov 4 2013 Tomáš Mráz 3.1.16-1 +- new upstream release +- fixes CVE-2013-4466 off-by-one in dane_query_tlsa() + +* Fri Oct 25 2013 Tomáš Mráz 3.1.15-1 +- new upstream release +- fixes CVE-2013-4466 buffer overflow in handling DANE entries + +* Wed Oct 16 2013 Tomáš Mráz 3.1.13-3 +- enable ECC NIST Suite B curves + +* Sat Aug 03 2013 Fedora Release Engineering - 3.1.13-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Mon Jul 15 2013 Tomáš Mráz 3.1.13-1 +- new upstream release + +* Mon May 13 2013 Tomáš Mráz 3.1.11-1 +- new upstream release + +* Mon Mar 25 2013 Tomas Mraz 3.1.10-1 +- new upstream release +- license of the library is back to LGPLv2.1+ + +* Fri Mar 15 2013 Tomas Mraz 3.1.9-1 +- new upstream release + +* Thu Mar 7 2013 Tomas Mraz 3.1.8-3 +- drop the temporary old library + +* Tue Feb 26 2013 Tomas Mraz 3.1.8-2 +- don't send ECC algos as supported (#913797) + +* Thu Feb 21 2013 Tomas Mraz 3.1.8-1 +- new upstream version + +* Wed Feb 6 2013 Tomas Mraz 3.1.7-1 +- new upstream version, requires rebuild of dependencies +- this release temporarily includes old compatibility .so + +* Tue Feb 5 2013 Tomas Mraz 2.12.22-2 +- rebuilt with new libtasn1 +- make guile bindings optional - breaks i686 build and there is + no dependent package + +* Tue Jan 8 2013 Tomas Mraz 2.12.22-1 +- new upstream version + +* Wed Nov 28 2012 Tomas Mraz 2.12.21-2 +- use RSA bit sizes supported by libgcrypt in FIPS mode for security + levels (#879643) + +* Fri Nov 9 2012 Tomas Mraz 2.12.21-1 +- new upstream version + +* Thu Nov 1 2012 Tomas Mraz 2.12.20-4 +- negotiate only FIPS approved algorithms in the FIPS mode (#871826) + +* Wed Aug 8 2012 Tomas Mraz 2.12.20-3 +- fix the gnutls-cli-debug manpage - patch by Peter Schiffer + +* Thu Jul 19 2012 Fedora Release Engineering - 2.12.20-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Mon Jun 18 2012 Tomas Mraz 2.12.20-1 +- new upstream version + +* Fri May 18 2012 Tomas Mraz 2.12.19-1 +- new upstream version + +* Thu Mar 29 2012 Tomas Mraz 2.12.18-1 +- new upstream version + +* Thu Mar 8 2012 Tomas Mraz 2.12.17-1 +- new upstream version +- fix leaks in key generation (#796302) + +* Fri Feb 03 2012 Kevin Fenzi - 2.12.14-3 +- Disable largefile on arm arch. (#787287) + +* Fri Jan 13 2012 Fedora Release Engineering - 2.12.14-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Tue Nov 8 2011 Tomas Mraz 2.12.14-1 +- new upstream version + +* Mon Oct 24 2011 Tomas Mraz 2.12.12-1 +- new upstream version + +* Thu Sep 29 2011 Tomas Mraz 2.12.11-1 +- new upstream version + +* Fri Aug 26 2011 Tomas Mraz 2.12.9-1 +- new upstream version + +* Tue Aug 16 2011 Tomas Mraz 2.12.8-1 +- new upstream version + +* Mon Jul 25 2011 Tomas Mraz 2.12.7-2 +- fix problem when using new libgcrypt +- split libgnutlsxx to a subpackage (#455146) +- drop libgnutls-openssl (#460310) + +* Tue Jun 21 2011 Tomas Mraz 2.12.7-1 +- new upstream version + +* Mon May 9 2011 Tomas Mraz 2.12.4-1 +- new upstream version + +* Tue Apr 26 2011 Tomas Mraz 2.12.3-1 +- new upstream version + +* Mon Apr 18 2011 Tomas Mraz 2.12.2-1 +- new upstream version + +* Thu Mar 3 2011 Tomas Mraz 2.10.5-1 +- new upstream version + +* Tue Feb 08 2011 Fedora Release Engineering - 2.10.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Wed Dec 8 2010 Tomas Mraz 2.10.4-1 +- new upstream version + +* Thu Dec 2 2010 Tomas Mraz 2.10.3-2 +- fix buffer overflow in gnutls-serv (#659259) + +* Fri Nov 19 2010 Tomas Mraz 2.10.3-1 +- new upstream version + +* Thu Sep 30 2010 Tomas Mraz 2.10.2-1 +- new upstream version + +* Wed Sep 29 2010 jkeating - 2.10.1-4 +- Rebuilt for gcc bug 634757 + +* Thu Sep 23 2010 Tomas Mraz 2.10.1-3 +- more patching for internal errors regression (#629858) + patch by Vivek Dasmohapatra + +* Tue Sep 21 2010 Tomas Mraz 2.10.1-2 +- backported patch from upstream git hopefully fixing internal errors + (#629858) + +* Wed Aug 4 2010 Tomas Mraz 2.10.1-1 +- new upstream version + +* Wed Jun 2 2010 Tomas Mraz 2.8.6-2 +- add support for safe renegotiation CVE-2009-3555 (#533125) + +* Wed May 12 2010 Tomas Mraz 2.8.6-1 +- upgrade to a new upstream version + +* Mon Feb 15 2010 Rex Dieter 2.8.5-4 +- FTBFS gnutls-2.8.5-3.fc13: ImplicitDSOLinking (#564624) + +* Thu Jan 28 2010 Tomas Mraz 2.8.5-3 +- drop superfluous rpath from binaries +- do not call autoreconf during build +- specify the license on utils subpackage + +* Mon Jan 18 2010 Tomas Mraz 2.8.5-2 +- do not create static libraries (#556052) + +* Mon Nov 2 2009 Tomas Mraz 2.8.5-1 +- upgrade to a new upstream version + +* Wed Sep 23 2009 Tomas Mraz 2.8.4-1 +- upgrade to a new upstream version + +* Fri Aug 14 2009 Tomas Mraz 2.8.3-1 +- upgrade to a new upstream version + +* Fri Jul 24 2009 Fedora Release Engineering - 2.8.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Wed Jun 10 2009 Tomas Mraz 2.8.1-1 +- upgrade to a new upstream version + +* Wed Jun 3 2009 Tomas Mraz 2.8.0-1 +- upgrade to a new upstream version + +* Mon May 4 2009 Tomas Mraz 2.6.6-1 +- upgrade to a new upstream version - security fixes + +* Tue Apr 14 2009 Tomas Mraz 2.6.5-1 +- upgrade to a new upstream version, minor bugfixes only + +* Fri Mar 6 2009 Tomas Mraz 2.6.4-1 +- upgrade to a new upstream version + +* Tue Feb 24 2009 Fedora Release Engineering - 2.6.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Mon Dec 15 2008 Tomas Mraz 2.6.3-1 +- upgrade to a new upstream version + +* Thu Dec 4 2008 Tomas Mraz 2.6.2-1 +- upgrade to a new upstream version + +* Tue Nov 11 2008 Tomas Mraz 2.4.2-3 +- fix chain verification issue CVE-2008-4989 (#470079) + +* Thu Sep 25 2008 Tomas Mraz 2.4.2-2 +- add guile subpackage (#463735) +- force new libtool through autoreconf to drop unnecessary rpaths + +* Tue Sep 23 2008 Tomas Mraz 2.4.2-1 +- new upstream version + +* Tue Jul 1 2008 Tomas Mraz 2.4.1-1 +- new upstream version +- correct the license tag +- explicit --with-included-opencdk not needed +- use external lzo library, internal not included anymore + +* Tue Jun 24 2008 Tomas Mraz 2.4.0-1 +- upgrade to latest upstream + +* Tue May 20 2008 Tomas Mraz 2.0.4-3 +- fix three security issues in gnutls handshake - GNUTLS-SA-2008-1 + (#447461, #447462, #447463) + +* Mon Feb 4 2008 Joe Orton 2.0.4-2 +- use system libtasn1 + +* Tue Dec 4 2007 Tomas Mraz 2.0.4-1 +- upgrade to latest upstream + +* Tue Aug 21 2007 Tomas Mraz 1.6.3-2 +- license tag fix + +* Wed Jun 6 2007 Tomas Mraz 1.6.3-1 +- upgrade to latest upstream (#232445) + +* Tue Apr 10 2007 Tomas Mraz 1.4.5-2 +- properly require install-info (patch by Ville Skyttä) +- standard buildroot and use dist tag +- add COPYING and README to doc + +* Wed Feb 7 2007 Tomas Mraz 1.4.5-1 +- new upstream version +- drop libtermcap-devel from buildrequires + +* Thu Sep 14 2006 Tomas Mraz 1.4.1-2 +- detect forged signatures - CVE-2006-4790 (#206411), patch + from upstream + +* Tue Jul 18 2006 Tomas Mraz - 1.4.1-1 +- upgrade to new upstream version, only minor changes + +* Wed Jul 12 2006 Jesse Keating - 1.4.0-1.1 +- rebuild + +* Wed Jun 14 2006 Tomas Mraz - 1.4.0-1 +- upgrade to new upstream version (#192070), rebuild + of dependent packages required + +* Tue May 16 2006 Tomas Mraz - 1.2.10-2 +- added missing buildrequires + +* Mon Feb 13 2006 Tomas Mraz - 1.2.10-1 +- updated to new version (fixes CVE-2006-0645) + +* Fri Feb 10 2006 Jesse Keating - 1.2.9-3.2 +- bump again for double-long bug on ppc(64) + +* Tue Feb 07 2006 Jesse Keating - 1.2.9-3.1 +- rebuilt for new gcc4.1 snapshot and glibc changes + +* Tue Jan 3 2006 Jesse Keating 1.2.9-3 +- rebuilt + +* Fri Dec 9 2005 Tomas Mraz 1.2.9-2 +- replaced *-config scripts with calls to pkg-config to + solve multilib conflicts + +* Wed Nov 23 2005 Tomas Mraz 1.2.9-1 +- upgrade to newest upstream +- removed .la files (#172635) + +* Sun Aug 7 2005 Tomas Mraz 1.2.6-1 +- upgrade to newest upstream (rebuild of dependencies necessary) + +* Mon Jul 4 2005 Tomas Mraz 1.0.25-2 +- split the command line tools to utils subpackage + +* Sat Apr 30 2005 Tomas Mraz 1.0.25-1 +- new upstream version fixes potential DOS attack + +* Sat Apr 23 2005 Tomas Mraz 1.0.24-2 +- readd the version script dropped by upstream + +* Fri Apr 22 2005 Tomas Mraz 1.0.24-1 +- update to the latest upstream version on the 1.0 branch + +* Wed Mar 2 2005 Warren Togami 1.0.20-6 +- gcc4 rebuild + +* Tue Jan 4 2005 Ivana Varekova 1.0.20-5 +- add gnutls Requires zlib-devel (#144069) + +* Mon Nov 08 2004 Colin Walters 1.0.20-4 +- Make gnutls-devel Require libgcrypt-devel + +* Tue Sep 21 2004 Jeff Johnson 1.0.20-3 +- rebuild with release++, otherwise unchanged. + +* Tue Sep 7 2004 Jeff Johnson 1.0.20-2 +- patent tainted SRP code removed. + +* Sun Sep 5 2004 Jeff Johnson 1.0.20-1 +- update to 1.0.20. +- add --with-included-opencdk --with-included-libtasn1 +- add --with-included-libcfg --with-included-lzo +- add --disable-srp-authentication. +- do "make check" after build. + +* Fri Mar 21 2003 Jeff Johnson 0.9.2-1 +- upgrade to 0.9.2 + +* Tue Jun 25 2002 Jeff Johnson 0.4.4-1 +- update to 0.4.4. + +* Fri Jun 21 2002 Tim Powers +- automated rebuild + +* Sat May 25 2002 Jeff Johnson 0.4.3-1 +- update to 0.4.3. + +* Tue May 21 2002 Jeff Johnson 0.4.2-1 +- update to 0.4.2. +- change license to LGPL. +- include splint annotations patch. + +* Tue Apr 2 2002 Nalin Dahyabhai 0.4.0-1 +- update to 0.4.0 + +* Thu Jan 17 2002 Nalin Dahyabhai 0.3.2-1 +- update to 0.3.2 + +* Thu Jan 10 2002 Nalin Dahyabhai 0.3.0-1 +- add a URL + +* Thu Dec 20 2001 Nalin Dahyabhai +- initial package diff --git a/gnutls.spec b/gnutls.spec index cd3eba6..f0a5c32 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 3.7.2 -Release: 2%{?dist} +Release: %{?autorel}%{!?autorel:1} Patch1: gnutls-3.6.7-no-now-guile.patch Patch2: gnutls-3.2.7-rpath.patch Patch3: gnutls-3.7.3-fix-race-condition.patch @@ -285,810 +285,4 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %endif %changelog -* Thu Feb 24 2022 Zoltan Fridrich - 3.7.2-2 -- Fix race condition in gnutls_x509_trust_list_verify_crt2 (#2050164) - -* Sat May 29 2021 Daiki Ueno - 3.7.2-1 -- Update to upstream 3.7.2 release - -* Sun Mar 28 2021 Daiki Ueno - 3.7.1-3 -- Remove %%defattr invocations which are no longer necessary -- libpkcs11mock1.* is not installed anymore -- hobble-gnutls: Remove SRP removal -- Use correct source URL -- Switch to using %%gpgverify macro - -* Tue Mar 16 2021 Daiki Ueno - 3.7.1-2 -- Restore fipscheck dependency - -* Sat Mar 13 2021 Daiki Ueno - 3.7.1-1 -- Update to upstream 3.7.1 release -- Remove fipscheck dependency, as it is now calculated with an - internal tool - -* Fri Mar 5 2021 Daiki Ueno - 3.7.0-4 -- Tolerate duplicate certs in the chain also with PKCS #11 trust store - -* Tue Mar 2 2021 Daiki Ueno - 3.7.0-3 -- Reduce BRs for non-bootstrapping build - -* Wed Feb 10 2021 Daiki Ueno - 3.7.0-2 -- Tolerate duplicate certs in the chain - -* Mon Feb 8 2021 Daiki Ueno - 3.7.0-1 -- Update to upstream 3.7.0 release -- Temporarily disable LTO - -* Tue Jan 26 2021 Daiki Ueno - 3.6.15-4 -- Fix broken tests on rawhide (#1908110) -- Add BuildRequires: make (by Tom Stellard) - -* Tue Jan 26 2021 Fedora Release Engineering - 3.6.15-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Mon Sep 28 2020 Jeff Law - 3.6.15-2 -- Re-enable LTO now that upstream GCC bugs have been fixed - -* Fri Sep 4 2020 Daiki Ueno - 3.6.15-1 -- Update to upstream 3.6.15 release - -* Mon Aug 17 2020 Jeff Law - 3.6.14-7 -- Disable LTO on ppc64le - -* Tue Aug 4 2020 Daiki Ueno - 3.6.14-6 -- Fix underlinking of libpthread - -* Sat Aug 01 2020 Fedora Release Engineering - 3.6.14-5 -- Second attempt - Rebuilt for - https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Mon Jul 27 2020 Fedora Release Engineering - 3.6.14-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Thu Jul 02 2020 Anderson Sasaki - 3.6.14-3 -- Rebuild with autogen built with guile-2.2 (#1852706) - -* Tue Jun 09 2020 Anderson Sasaki - 3.6.14-2 -- Fix memory leak when serializing iovec_t (#1845083) -- Fix automatic libraries sonames detection (#1845806) - -* Thu Jun 4 2020 Daiki Ueno - 3.6.14-1 -- Update to upstream 3.6.14 release - -* Sun May 31 2020 Daiki Ueno - 3.6.13-6 -- Update gnutls-3.6.13-superseding-chain.patch - -* Sun May 31 2020 Daiki Ueno - 3.6.13-5 -- Fix cert chain validation behavior if the last cert has expired (#1842178) - -* Mon May 25 2020 Anderson Sasaki - 3.6.13-4 -- Add option to gnutls-cli to wait for resumption under TLS 1.3 - -* Tue May 19 2020 Anderson Sasaki - 3.6.13-3 -- Disable RSA blinding during FIPS self-tests - -* Thu May 14 2020 Anderson Sasaki - 3.6.13-2 -- Bump linked libraries soname to fix FIPS selftests (#1835265) - -* Tue Mar 31 2020 Daiki Ueno - 3.6.13-1 -- Update to upstream 3.6.13 release - -* Thu Mar 26 2020 Anderson Sasaki - 3.6.12-2 -- Fix FIPS POST (#1813384) -- Fix gnutls-serv --echo to not exit when a message is received (#1816583) - -* Sun Feb 02 2020 Nikos Mavrogiannopoulos - 3.6.12-1 -- Update to upstream 3.6.12 release - -* Tue Jan 28 2020 Fedora Release Engineering - 3.6.11-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Mon Dec 02 2019 Nikos Mavrogiannopoulos - 3.6.11-1 -- Update to upstream 3.6.11 release - -* Sun Sep 29 2019 Nikos Mavrogiannopoulos - 3.6.10-1 -- Update to upstream 3.6.10 release - -* Fri Jul 26 2019 Nikos Mavrogiannopoulos - 3.6.9-1 -- Update to upstream 3.6.9 release - -* Thu Jul 25 2019 Fedora Release Engineering - 3.6.8-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Mon Jul 15 2019 Nikos Mavrogiannopoulos - 3.6.8-2 -- Rebuilt with guile-2.2 - -* Tue May 28 2019 Nikos Mavrogiannopoulos - 3.6.8-1 -- Update to upstream 3.6.8 release - -* Wed Mar 27 2019 Anderson Toshiyuki Sasaki - 3.6.7-1 -- Update to upstream 3.6.7 release -- Fixed CVE-2019-3836 (#1693214) -- Fixed CVE-2019-3829 (#1693210) - -* Fri Feb 1 2019 Nikos Mavrogiannopoulos - 3.6.6-1 -- Update to upstream 3.6.6 release - -* Thu Jan 31 2019 Fedora Release Engineering - 3.6.5-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Fri Jan 11 2019 Anderson Toshiyuki Sasaki - 3.6.5-2 -- Added explicit Requires for nettle >= 3.4.1 - -* Tue Dec 11 2018 Anderson Toshiyuki Sasaki - 3.6.5-1 -- Update to upstream 3.6.5 release - -* Mon Oct 29 2018 James Antill - 3.6.4-5 -- Remove ldconfig scriptlet, now done via. transfiletrigger in glibc. - -* Wed Oct 17 2018 Nikos Mavrogiannopoulos - 3.6.4-4 -- Fix issue with rehandshake affecting glib-networking (#1634736) - -* Tue Oct 16 2018 Tomáš Mráz - 3.6.4-3 -- Add missing annobin notes for assembler sources - -* Tue Oct 09 2018 Petr Menšík - 3.6.4-2 -- Rebuilt for unbound 1.8 - -* Tue Sep 25 2018 Nikos Mavrogiannopoulos - 3.6.4-1 -- Updated to upstream 3.6.4 release -- Added support for the latest version of the TLS1.3 protocol -- Enabled SHA1 support as SHA1 deprecation is handled via the - fedora crypto policies. - -* Thu Aug 16 2018 Nikos Mavrogiannopoulos - 3.6.3-4 -- Fixed gnutls-cli input reading -- Ensure that we do not cause issues with version rollback detection - and TLS1.3. - -* Tue Aug 07 2018 Nikos Mavrogiannopoulos - 3.6.3-3 -- Fixed ECDSA public key import (#1612803) - -* Thu Jul 26 2018 Nikos Mavrogiannopoulos - 3.6.3-2 -- Backported regression fixes from 3.6.2 - -* Mon Jul 16 2018 Nikos Mavrogiannopoulos - 3.6.3-1 -- Update to upstream 3.6.3 release - -* Fri Jul 13 2018 Fedora Release Engineering - 3.6.2-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Wed Jun 13 2018 Nikos Mavrogiannopoulos - 3.6.2-4 -- Enable FIPS140-2 mode in Fedora - -* Wed Jun 06 2018 Nikos Mavrogiannopoulos - 3.6.2-3 -- Update to upstream 3.6.2 release - -* Fri May 25 2018 David Abdurachmanov - 3.6.2-2 -- Add missing BuildRequires: gnupg2 for gpgv2 in %%prep - -* Fri Feb 16 2018 Nikos Mavrogiannopoulos - 3.6.2-1 -- Update to upstream 3.6.2 release - -* Wed Feb 07 2018 Fedora Release Engineering - 3.6.1-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Fri Feb 2 2018 Nikos Mavrogiannopoulos - 3.6.1-4 -- Rebuilt to address incompatibility with new nettle - -* Thu Nov 30 2017 Nikos Mavrogiannopoulos - 3.6.1-3 -- Corrected regression from 3.6.1-2 which prevented the loading of - arbitrary p11-kit modules (#1507402) - -* Mon Nov 6 2017 Nikos Mavrogiannopoulos - 3.6.1-2 -- Prevent the loading of all PKCS#11 modules on certificate verification - but only restrict to p11-kit trust module (#1507402) - -* Sat Oct 21 2017 Nikos Mavrogiannopoulos - 3.6.1-1 -- Update to upstream 3.6.1 release - -* Mon Aug 21 2017 Nikos Mavrogiannopoulos - 3.6.0-1 -- Update to upstream 3.6.0 release - -* Wed Aug 02 2017 Fedora Release Engineering - 3.5.14-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild - -* Wed Jul 26 2017 Fedora Release Engineering - 3.5.14-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Tue Jul 04 2017 Nikos Mavrogiannopoulos - 3.5.14-1 -- Update to upstream 3.5.14 release - -* Wed Jun 07 2017 Nikos Mavrogiannopoulos - 3.5.13-1 -- Update to upstream 3.5.13 release - -* Thu May 11 2017 Nikos Mavrogiannopoulos - 3.5.12-2 -- Fix issue with p11-kit-trust arch dependency - -* Thu May 11 2017 Nikos Mavrogiannopoulos - 3.5.12-1 -- Update to upstream 3.5.12 release - -* Fri Apr 07 2017 Nikos Mavrogiannopoulos - 3.5.11-1 -- Update to upstream 3.5.11 release - -* Mon Mar 06 2017 Nikos Mavrogiannopoulos - 3.5.10-1 -- Update to upstream 3.5.10 release - -* Wed Feb 15 2017 Nikos Mavrogiannopoulos - 3.5.9-2 -- Work around missing pkg-config file (#1422256) - -* Tue Feb 14 2017 Nikos Mavrogiannopoulos - 3.5.9-1 -- Update to upstream 3.5.9 release - -* Fri Feb 10 2017 Fedora Release Engineering - 3.5.8-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Sat Feb 4 2017 Nikos Mavrogiannopoulos 3.5.8-2 -- Added patch fix initialization issue in gnutls_pkcs11_obj_list_import_url4 - -* Mon Jan 9 2017 Nikos Mavrogiannopoulos 3.5.8-1 -- New upstream release - -* Tue Dec 13 2016 Nikos Mavrogiannopoulos 3.5.7-3 -- Fix PKCS#8 file loading (#1404084) - -* Thu Dec 8 2016 Nikos Mavrogiannopoulos 3.5.7-1 -- New upstream release - -* Fri Nov 4 2016 Nikos Mavrogiannopoulos 3.5.6-1 -- New upstream release - -* Tue Oct 11 2016 walters@redhat.com - 3.5.5-2 -- Apply patch to fix compatibility with ostree (#1383708) - -* Mon Oct 10 2016 Nikos Mavrogiannopoulos 3.5.5-1 -- New upstream release - -* Thu Sep 8 2016 Nikos Mavrogiannopoulos 3.5.4-1 -- New upstream release - -* Mon Aug 29 2016 Nikos Mavrogiannopoulos 3.5.3-2 -- Work around #1371082 for x86 -- Fixed issue with DTLS sliding window implementation (#1370881) - -* Tue Aug 9 2016 Nikos Mavrogiannopoulos 3.5.3-1 -- New upstream release - -* Wed Jul 6 2016 Nikos Mavrogiannopoulos 3.5.2-1 -- New upstream release - -* Wed Jun 15 2016 Nikos Mavrogiannopoulos 3.5.1-1 -- New upstream release - -* Tue Jun 7 2016 Nikos Mavrogiannopoulos 3.4.13-1 -- New upstream release (#1343258) -- Addresses issue with setuid programs introduced in 3.4.12 (#1343342) - -* Fri May 20 2016 Nikos Mavrogiannopoulos 3.4.12-1 -- New upstream release - -* Mon Apr 11 2016 Nikos Mavrogiannopoulos 3.4.11-1 -- New upstream release - -* Fri Mar 4 2016 Nikos Mavrogiannopoulos 3.4.10-1 -- New upstream release (#1314576) - -* Wed Feb 3 2016 Nikos Mavrogiannopoulos 3.4.9-1 -- Fix broken key usage flags introduced in 3.4.8 (#1303355) - -* Mon Jan 11 2016 Nikos Mavrogiannopoulos 3.4.8-1 -- New upstream release (#1297079) - -* Mon Nov 23 2015 Nikos Mavrogiannopoulos 3.4.7-1 -- New upstream release (#1284300) -- Documentation updates (#1282864) -- Adds interface to set unique IDs in certificates (#1281343) -- Allow arbitrary key sizes with ARCFOUR (#1284401) - -* Wed Oct 21 2015 Nikos Mavrogiannopoulos 3.4.6-1 -- New upstream release (#1273672) -- Enhances p11tool to write CKA_ISSUER and CKA_SERIAL_NUMBER (#1272178) - -* Tue Oct 20 2015 Adam Williamson - 3.4.5-2 -- fix interaction with Chrome 45+ (master secret extension) (#1273102) - -* Mon Sep 14 2015 Nikos Mavrogiannopoulos 3.4.5-1 -- New upstream release (#1252192) -- Eliminates hard limits on CRL parsing of certtool. - -* Mon Aug 10 2015 Nikos Mavrogiannopoulos 3.4.4-1 -- new upstream release -- no longer requires trousers patch -- fixes issue in gnutls_x509_privkey_import (#1250020) - -* Mon Jul 13 2015 Nikos Mavrogiannopoulos 3.4.3-2 -- Don't link against trousers but rather dlopen() it when available. - That avoids a dependency on openssl by the main library. - -* Mon Jul 13 2015 Nikos Mavrogiannopoulos 3.4.3-1 -- new upstream release - -* Thu Jul 02 2015 Adam Jackson 3.4.2-3 -- Only disable -z now for the guile modules - -* Thu Jun 18 2015 Nikos Mavrogiannopoulos 3.4.2-2 -- rename the symbol version for internal symbols to avoid clashes - with 3.3.x. - -* Wed Jun 17 2015 Nikos Mavrogiannopoulos 3.4.2-1 -- new upstream release - -* Tue May 5 2015 Nikos Mavrogiannopoulos 3.4.1-2 -- Provide missing GNUTLS_SUPPLEMENTAL_USER_MAPPING_DATA definition - -* Mon May 4 2015 Nikos Mavrogiannopoulos 3.4.1-1 -- new upstream release - -* Sat May 02 2015 Kalev Lember - 3.3.14-2 -- Rebuilt for GCC 5 C++11 ABI change - -* Mon Mar 30 2015 Nikos Mavrogiannopoulos 3.3.14-1 -- new upstream release -- improved BER decoding of PKCS #12 structures (#1131461) - -* Fri Mar 6 2015 Nikos Mavrogiannopoulos 3.3.13-3 -- Build with hardened flags -- Removed -Wl,--no-add-needed linker flag - -* Fri Feb 27 2015 Till Maas - 3.3.13-2 -- Do not build with hardened flags - -* Thu Feb 26 2015 Nikos Mavrogiannopoulos 3.3.13-1 -- new upstream release - -* Sat Feb 21 2015 Till Maas - 3.3.12-3 -- Make build verbose -- Use %%license - -* Sat Feb 21 2015 Till Maas - 3.3.12-2 -- Rebuilt for Fedora 23 Change - https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code - -* Mon Jan 19 2015 Nikos Mavrogiannopoulos 3.3.12-1 -- new upstream release - -* Mon Jan 5 2015 Nikos Mavrogiannopoulos 3.3.11-2 -- enabled guile bindings (#1177847) - -* Thu Dec 11 2014 Nikos Mavrogiannopoulos 3.3.11-1 -- new upstream release - -* Mon Nov 10 2014 Nikos Mavrogiannopoulos 3.3.10-1 -- new upstream release - -* Thu Oct 23 2014 Nikos Mavrogiannopoulos 3.3.9-2 -- applied fix for issue in get-issuer (#1155901) - -* Mon Oct 13 2014 Nikos Mavrogiannopoulos 3.3.9-1 -- new upstream release - -* Fri Sep 19 2014 Nikos Mavrogiannopoulos 3.3.8-2 -- strip rpath from library - -* Thu Sep 18 2014 Nikos Mavrogiannopoulos 3.3.8-1 -- new upstream release - -* Mon Aug 25 2014 Nikos Mavrogiannopoulos 3.3.7-1 -- new upstream release - -* Sat Aug 16 2014 Fedora Release Engineering - 3.3.6-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild - -* Wed Jul 23 2014 Nikos Mavrogiannopoulos 3.3.6-1 -- new upstream release - -* Tue Jul 01 2014 Nikos Mavrogiannopoulos 3.3.5-2 -- Added work-around for s390 builds with gcc 4.9 (#1102324) - -* Mon Jun 30 2014 Nikos Mavrogiannopoulos 3.3.5-1 -- new upstream release - -* Tue Jun 17 2014 Nikos Mavrogiannopoulos 3.3.4-3 -- explicitly depend on p11-kit-trust - -* Sat Jun 07 2014 Fedora Release Engineering - 3.3.4-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild - -* Mon Jun 02 2014 Nikos Mavrogiannopoulos 3.3.4-1 -- new upstream release - -* Fri May 30 2014 Nikos Mavrogiannopoulos 3.3.3-1 -- new upstream release - -* Wed May 21 2014 Nikos Mavrogiannopoulos 3.3.2-2 -- Require crypto-policies - -* Fri May 09 2014 Nikos Mavrogiannopoulos 3.3.2-1 -- new upstream release - -* Mon May 05 2014 Nikos Mavrogiannopoulos 3.3.1-4 -- Replaced /etc/crypto-profiles/apps with /etc/crypto-policies/back-ends. -- Added support for "very weak" profile. - -* Mon Apr 28 2014 Nikos Mavrogiannopoulos 3.3.1-2 -- gnutls_global_deinit() will not do anything if the previous - initialization has failed (#1091053) - -* Mon Apr 28 2014 Nikos Mavrogiannopoulos 3.3.1-1 -- new upstream release - -* Mon Apr 14 2014 Nikos Mavrogiannopoulos 3.3.0-1 -- new upstream release - -* Tue Apr 08 2014 Nikos Mavrogiannopoulos 3.2.13-1 -- new upstream release - -* Wed Mar 05 2014 Nikos Mavrogiannopoulos 3.2.12.1-1 -- new upstream release - -* Mon Mar 03 2014 Nikos Mavrogiannopoulos 3.2.12-1 -- new upstream release - -* Mon Feb 03 2014 Nikos Mavrogiannopoulos 3.2.10-2 -- use p11-kit trust store for certificate verification - -* Mon Feb 03 2014 Nikos Mavrogiannopoulos 3.2.10-1 -- new upstream release - -* Tue Jan 14 2014 Tomáš Mráz 3.2.8-2 -- build the crywrap tool - -* Mon Dec 23 2013 Nikos Mavrogiannopoulos 3.2.8-1 -- new upstream release - -* Wed Dec 4 2013 Nikos Mavrogiannopoulos 3.2.7-2 -- Use the correct root key for unbound /var/lib/unbound/root.key (#1012494) -- Pull asm fixes from upstream (#973210) - -* Mon Nov 25 2013 Nikos Mavrogiannopoulos 3.2.7-1 -- new upstream release -- added dependency to autogen-libopts-devel to use the system's - libopts library -- added dependency to trousers-devel to enable TPM support - -* Mon Nov 4 2013 Tomáš Mráz 3.1.16-1 -- new upstream release -- fixes CVE-2013-4466 off-by-one in dane_query_tlsa() - -* Fri Oct 25 2013 Tomáš Mráz 3.1.15-1 -- new upstream release -- fixes CVE-2013-4466 buffer overflow in handling DANE entries - -* Wed Oct 16 2013 Tomáš Mráz 3.1.13-3 -- enable ECC NIST Suite B curves - -* Sat Aug 03 2013 Fedora Release Engineering - 3.1.13-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild - -* Mon Jul 15 2013 Tomáš Mráz 3.1.13-1 -- new upstream release - -* Mon May 13 2013 Tomáš Mráz 3.1.11-1 -- new upstream release - -* Mon Mar 25 2013 Tomas Mraz 3.1.10-1 -- new upstream release -- license of the library is back to LGPLv2.1+ - -* Fri Mar 15 2013 Tomas Mraz 3.1.9-1 -- new upstream release - -* Thu Mar 7 2013 Tomas Mraz 3.1.8-3 -- drop the temporary old library - -* Tue Feb 26 2013 Tomas Mraz 3.1.8-2 -- don't send ECC algos as supported (#913797) - -* Thu Feb 21 2013 Tomas Mraz 3.1.8-1 -- new upstream version - -* Wed Feb 6 2013 Tomas Mraz 3.1.7-1 -- new upstream version, requires rebuild of dependencies -- this release temporarily includes old compatibility .so - -* Tue Feb 5 2013 Tomas Mraz 2.12.22-2 -- rebuilt with new libtasn1 -- make guile bindings optional - breaks i686 build and there is - no dependent package - -* Tue Jan 8 2013 Tomas Mraz 2.12.22-1 -- new upstream version - -* Wed Nov 28 2012 Tomas Mraz 2.12.21-2 -- use RSA bit sizes supported by libgcrypt in FIPS mode for security - levels (#879643) - -* Fri Nov 9 2012 Tomas Mraz 2.12.21-1 -- new upstream version - -* Thu Nov 1 2012 Tomas Mraz 2.12.20-4 -- negotiate only FIPS approved algorithms in the FIPS mode (#871826) - -* Wed Aug 8 2012 Tomas Mraz 2.12.20-3 -- fix the gnutls-cli-debug manpage - patch by Peter Schiffer - -* Thu Jul 19 2012 Fedora Release Engineering - 2.12.20-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild - -* Mon Jun 18 2012 Tomas Mraz 2.12.20-1 -- new upstream version - -* Fri May 18 2012 Tomas Mraz 2.12.19-1 -- new upstream version - -* Thu Mar 29 2012 Tomas Mraz 2.12.18-1 -- new upstream version - -* Thu Mar 8 2012 Tomas Mraz 2.12.17-1 -- new upstream version -- fix leaks in key generation (#796302) - -* Fri Feb 03 2012 Kevin Fenzi - 2.12.14-3 -- Disable largefile on arm arch. (#787287) - -* Fri Jan 13 2012 Fedora Release Engineering - 2.12.14-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild - -* Tue Nov 8 2011 Tomas Mraz 2.12.14-1 -- new upstream version - -* Mon Oct 24 2011 Tomas Mraz 2.12.12-1 -- new upstream version - -* Thu Sep 29 2011 Tomas Mraz 2.12.11-1 -- new upstream version - -* Fri Aug 26 2011 Tomas Mraz 2.12.9-1 -- new upstream version - -* Tue Aug 16 2011 Tomas Mraz 2.12.8-1 -- new upstream version - -* Mon Jul 25 2011 Tomas Mraz 2.12.7-2 -- fix problem when using new libgcrypt -- split libgnutlsxx to a subpackage (#455146) -- drop libgnutls-openssl (#460310) - -* Tue Jun 21 2011 Tomas Mraz 2.12.7-1 -- new upstream version - -* Mon May 9 2011 Tomas Mraz 2.12.4-1 -- new upstream version - -* Tue Apr 26 2011 Tomas Mraz 2.12.3-1 -- new upstream version - -* Mon Apr 18 2011 Tomas Mraz 2.12.2-1 -- new upstream version - -* Thu Mar 3 2011 Tomas Mraz 2.10.5-1 -- new upstream version - -* Tue Feb 08 2011 Fedora Release Engineering - 2.10.4-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild - -* Wed Dec 8 2010 Tomas Mraz 2.10.4-1 -- new upstream version - -* Thu Dec 2 2010 Tomas Mraz 2.10.3-2 -- fix buffer overflow in gnutls-serv (#659259) - -* Fri Nov 19 2010 Tomas Mraz 2.10.3-1 -- new upstream version - -* Thu Sep 30 2010 Tomas Mraz 2.10.2-1 -- new upstream version - -* Wed Sep 29 2010 jkeating - 2.10.1-4 -- Rebuilt for gcc bug 634757 - -* Thu Sep 23 2010 Tomas Mraz 2.10.1-3 -- more patching for internal errors regression (#629858) - patch by Vivek Dasmohapatra - -* Tue Sep 21 2010 Tomas Mraz 2.10.1-2 -- backported patch from upstream git hopefully fixing internal errors - (#629858) - -* Wed Aug 4 2010 Tomas Mraz 2.10.1-1 -- new upstream version - -* Wed Jun 2 2010 Tomas Mraz 2.8.6-2 -- add support for safe renegotiation CVE-2009-3555 (#533125) - -* Wed May 12 2010 Tomas Mraz 2.8.6-1 -- upgrade to a new upstream version - -* Mon Feb 15 2010 Rex Dieter 2.8.5-4 -- FTBFS gnutls-2.8.5-3.fc13: ImplicitDSOLinking (#564624) - -* Thu Jan 28 2010 Tomas Mraz 2.8.5-3 -- drop superfluous rpath from binaries -- do not call autoreconf during build -- specify the license on utils subpackage - -* Mon Jan 18 2010 Tomas Mraz 2.8.5-2 -- do not create static libraries (#556052) - -* Mon Nov 2 2009 Tomas Mraz 2.8.5-1 -- upgrade to a new upstream version - -* Wed Sep 23 2009 Tomas Mraz 2.8.4-1 -- upgrade to a new upstream version - -* Fri Aug 14 2009 Tomas Mraz 2.8.3-1 -- upgrade to a new upstream version - -* Fri Jul 24 2009 Fedora Release Engineering - 2.8.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild - -* Wed Jun 10 2009 Tomas Mraz 2.8.1-1 -- upgrade to a new upstream version - -* Wed Jun 3 2009 Tomas Mraz 2.8.0-1 -- upgrade to a new upstream version - -* Mon May 4 2009 Tomas Mraz 2.6.6-1 -- upgrade to a new upstream version - security fixes - -* Tue Apr 14 2009 Tomas Mraz 2.6.5-1 -- upgrade to a new upstream version, minor bugfixes only - -* Fri Mar 6 2009 Tomas Mraz 2.6.4-1 -- upgrade to a new upstream version - -* Tue Feb 24 2009 Fedora Release Engineering - 2.6.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild - -* Mon Dec 15 2008 Tomas Mraz 2.6.3-1 -- upgrade to a new upstream version - -* Thu Dec 4 2008 Tomas Mraz 2.6.2-1 -- upgrade to a new upstream version - -* Tue Nov 11 2008 Tomas Mraz 2.4.2-3 -- fix chain verification issue CVE-2008-4989 (#470079) - -* Thu Sep 25 2008 Tomas Mraz 2.4.2-2 -- add guile subpackage (#463735) -- force new libtool through autoreconf to drop unnecessary rpaths - -* Tue Sep 23 2008 Tomas Mraz 2.4.2-1 -- new upstream version - -* Tue Jul 1 2008 Tomas Mraz 2.4.1-1 -- new upstream version -- correct the license tag -- explicit --with-included-opencdk not needed -- use external lzo library, internal not included anymore - -* Tue Jun 24 2008 Tomas Mraz 2.4.0-1 -- upgrade to latest upstream - -* Tue May 20 2008 Tomas Mraz 2.0.4-3 -- fix three security issues in gnutls handshake - GNUTLS-SA-2008-1 - (#447461, #447462, #447463) - -* Mon Feb 4 2008 Joe Orton 2.0.4-2 -- use system libtasn1 - -* Tue Dec 4 2007 Tomas Mraz 2.0.4-1 -- upgrade to latest upstream - -* Tue Aug 21 2007 Tomas Mraz 1.6.3-2 -- license tag fix - -* Wed Jun 6 2007 Tomas Mraz 1.6.3-1 -- upgrade to latest upstream (#232445) - -* Tue Apr 10 2007 Tomas Mraz 1.4.5-2 -- properly require install-info (patch by Ville Skyttä) -- standard buildroot and use dist tag -- add COPYING and README to doc - -* Wed Feb 7 2007 Tomas Mraz 1.4.5-1 -- new upstream version -- drop libtermcap-devel from buildrequires - -* Thu Sep 14 2006 Tomas Mraz 1.4.1-2 -- detect forged signatures - CVE-2006-4790 (#206411), patch - from upstream - -* Tue Jul 18 2006 Tomas Mraz - 1.4.1-1 -- upgrade to new upstream version, only minor changes - -* Wed Jul 12 2006 Jesse Keating - 1.4.0-1.1 -- rebuild - -* Wed Jun 14 2006 Tomas Mraz - 1.4.0-1 -- upgrade to new upstream version (#192070), rebuild - of dependent packages required - -* Tue May 16 2006 Tomas Mraz - 1.2.10-2 -- added missing buildrequires - -* Mon Feb 13 2006 Tomas Mraz - 1.2.10-1 -- updated to new version (fixes CVE-2006-0645) - -* Fri Feb 10 2006 Jesse Keating - 1.2.9-3.2 -- bump again for double-long bug on ppc(64) - -* Tue Feb 07 2006 Jesse Keating - 1.2.9-3.1 -- rebuilt for new gcc4.1 snapshot and glibc changes - -* Tue Jan 3 2006 Jesse Keating 1.2.9-3 -- rebuilt - -* Fri Dec 9 2005 Tomas Mraz 1.2.9-2 -- replaced *-config scripts with calls to pkg-config to - solve multilib conflicts - -* Wed Nov 23 2005 Tomas Mraz 1.2.9-1 -- upgrade to newest upstream -- removed .la files (#172635) - -* Sun Aug 7 2005 Tomas Mraz 1.2.6-1 -- upgrade to newest upstream (rebuild of dependencies necessary) - -* Mon Jul 4 2005 Tomas Mraz 1.0.25-2 -- split the command line tools to utils subpackage - -* Sat Apr 30 2005 Tomas Mraz 1.0.25-1 -- new upstream version fixes potential DOS attack - -* Sat Apr 23 2005 Tomas Mraz 1.0.24-2 -- readd the version script dropped by upstream - -* Fri Apr 22 2005 Tomas Mraz 1.0.24-1 -- update to the latest upstream version on the 1.0 branch - -* Wed Mar 2 2005 Warren Togami 1.0.20-6 -- gcc4 rebuild - -* Tue Jan 4 2005 Ivana Varekova 1.0.20-5 -- add gnutls Requires zlib-devel (#144069) - -* Mon Nov 08 2004 Colin Walters 1.0.20-4 -- Make gnutls-devel Require libgcrypt-devel - -* Tue Sep 21 2004 Jeff Johnson 1.0.20-3 -- rebuild with release++, otherwise unchanged. - -* Tue Sep 7 2004 Jeff Johnson 1.0.20-2 -- patent tainted SRP code removed. - -* Sun Sep 5 2004 Jeff Johnson 1.0.20-1 -- update to 1.0.20. -- add --with-included-opencdk --with-included-libtasn1 -- add --with-included-libcfg --with-included-lzo -- add --disable-srp-authentication. -- do "make check" after build. - -* Fri Mar 21 2003 Jeff Johnson 0.9.2-1 -- upgrade to 0.9.2 - -* Tue Jun 25 2002 Jeff Johnson 0.4.4-1 -- update to 0.4.4. - -* Fri Jun 21 2002 Tim Powers -- automated rebuild - -* Sat May 25 2002 Jeff Johnson 0.4.3-1 -- update to 0.4.3. - -* Tue May 21 2002 Jeff Johnson 0.4.2-1 -- update to 0.4.2. -- change license to LGPL. -- include splint annotations patch. - -* Tue Apr 2 2002 Nalin Dahyabhai 0.4.0-1 -- update to 0.4.0 - -* Thu Jan 17 2002 Nalin Dahyabhai 0.3.2-1 -- update to 0.3.2 - -* Thu Jan 10 2002 Nalin Dahyabhai 0.3.0-1 -- add a URL - -* Thu Dec 20 2001 Nalin Dahyabhai -- initial package +%autochangelog diff --git a/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg b/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg new file mode 100644 index 0000000000000000000000000000000000000000..30cd72996164fbba16fd2ee7098b8d28633c03e8 GIT binary patch literal 48528 zcmb5VQ;=<2x2>DDZQHhO+qP}n_DtKhjhVLXoN4pMT>Jj_tP?w8$G)%ap^V;Yd{KI@ zrPh%N1PdZ%eoY6608p?9sJDjauB61Mal}5@*d`MbUTX6-OAM5_0Dpt4eG}#{jV5rl zOUETAD1jo6LxP_{go z1S(C}bY0VK&qWh^*|DHRHK4h%|7c~RPf8$|M|N5GyTg_9?Z^mn3++O4C7Hh~7S%*% zhAtR5-t1wTkld;^S2}>x|KeVHvgFZ@gxt(~9o=-=^kKjXQ;^h!RHN8FDRwTDf3DOd zMI%Hnr2}!n)F)CNR*lJu@*0eIO?OUi68G1a-qYS;*JoN8XFPal0My1McQ-Sic3#7| zC`;7X5MIrs^n;&Th8%2mt-nR7nKHo4j-iKOaz9A-@nEo4yP`)D*1TmAfQs4%946qg z1Z~Uh`P@ViNIl)471$FZR3>Z7Y0nVq??D{h!EjUpgjzX2!Utu63zAzUG+oPX*-+sM zB}xsU-~f+DesFlL4U;fV1A;GB>+HJPkH;aEi?vl^x-2JS$}^-pY)mWSq-)Y~QZ!cs z=x0B}t$>nogi05GIHpzUZHsJ-NE4e=G~ExxS5-u)Z@ng9L?AV(E~ee{nBbW-Rc+#O z?<1TyI^gs{Kg|;+uyEInMEO`YiMoy_?nf!IKh0f7Jr zK!N^Z1B49>1`P=T4h#f>3IqWRf(8T(2!sa+gdP9@1&Oc%8WOj9lHq7K0RJOnrc%)I zqidW@3P;o$c|=h0q-AIT^Ie3e!IcgfK_{&C{3jZn+^#8wqc_yE53z%#l+XCulq$z? zYqew$fmNCiDz-c&4O4pT>0rj%SmqLue2zBSp9KRX4t&DzFbJq$-}#wbWzjWDvTT2?!#) z2B1OEW|XO_O`cZ%HK-AiGZ#k2L7tIRfkGF_sL_E&%IWJ*O+Q1`@b+=Yg7>(XOQu^K0jFLAlUd773p3#U z(GwShy$xj8i{cn(Htz+%ya`+*I2nVKsL7t%QJ`?>l-F*r@RZxV)VGAZve(X00vs)N zc!OLe+-89ggY4#eOM5zX%kk1+i-Al+p8@oy&)!IQ6-uMDGE0#Zs%xuUr@J8}M1tAQ zAjEDUU`MT?3C=K`{Oxc-9pd&YF`DRoHAF0T=dijMz$b`*}Oh3Bo(Z z7gf`yDyVo}*A*0fF_QE}*=oM{)%b{H!kperZS+`M3{cYu0zkTXF|S43W?N zUT{F0t3#Nvd+J<=vg~yGKl<_gsRIhyR3Bdm$5s9@e2YJ!<1J{BK{8kP?h-CGlEKRhwQ|FdWT=l|=op_yWp_2l>KFB{?^{Uvaf`e)SES?yLr= z^=R$uqsbi%m0@AN^sHn5;oF%|1DuDyJr6O1sjQ*K^`oB>FWM+W8*>qQxB#Dj1X5*K z#VASKZPjj)Fm&_`rk7eArUdd+#$x-*Xlyc8v~=!ig_39V@S;4z$pHO|ge6J&^GG zlqv}&&^UuXP6maYa~yMiDnbkd0TBoQ>@P2ms(P;CpkxBbGf`@Ia~g@w_3ktc$Rk3|Cm~V+jt~Pu{;%he z_JkV$tE1iYgsFk%iA4?vkOK=Dr8PJB<#rvnHsX)B^uE;}aSo6lc%#1PpmYuu8(~6l z)~eEbGo!HoZyj{5Go7yGAP5dY{F zbRGSDzNOfd3Kt{wowt??5AKM_OJj2LH_}z82qZQN-i1&kP`gNJi>ujTHl3Oc1P{xZwFbTd=U}%$Hkcy{JliqAn?2XUns+>&B zYfVo*=PJ%t8~thvG?(6;tH{z30`;iCTHvrWdx(Hd&Gq62ghD%vi!1@m;Ul{3htZ|@ z^Skme_vEH{27>0KMla7&JGqX+IzE|Jai(m&K|DyiI(Z6QGCF&0xEIXX%qV^rXeJoS1+|2sbo0yeSdY>vuE<5~*9ao`(h%kRfZ9;pJ%YdQZU{T$dtx2Rse zgDwowlT>6y^v&0quM_Fa`7s)}HgCp+^$m<2{y_ooi3*javkeNTr(}9}vSw)3_ZRV2 zaATyu3KY(b6SG7aSdV<1cNaB^KrCUUW&3!jiEzF%fA@!w$h?Hy_pw1vTa%MEHr``} zvwCf!2+Tb6s3sBONt<8Z2HosNvU9p)=OZ?U##6KXplo;@D4dLw#PlTHN)40dXuEK< z;eN{x7^)>q$_Wp>HTomh&W>G|#L*+bM4F9QVpJA>pPxJF^JLm@HmoKn&A$Eo zx1J^$Xq96!}Q2#Gx>3`|?1;)JJN(vd8v;&YXAT@%R zxpWe7Q@O-)+{ycdtw9Blf3i0OlOM@~SxS&DJ~gVSPAE zjAIFqpTep%4M!78J6%1huM0jj@e=+sCGhq zutgv(6Y;fy3GJxwhqO9HZ;>+`3`=Gl?dCL^Xo5ZPuukijJVU@+YFbrLT))OvtU){l zrQuWFtU!lE-`*8qx!IeNA)cVm6-U&BALgl8+=}S{(4~#JWXUR!5En;A8|!k5R-uq2 z3~K#HqQS35;^Qg_>%jCpSu<)W5af;aOIp3SJ4mWgppb{6j}ZSi$%}AO={pqA1c%!? zLJz9JKs%d6H7;sTb8&k#(z_IaY_lQ+=bFRVK)Rq|Ip^5{ef-mjIDC9Wp*LcK>d zg4P%}Ic|$6O%jtB##;a6L5i;F1}C#lf~8{mq4OEL8YaY3&zOTBw4cF@3-Wu}w=C@* zne=N2}H#xrv`57^dGFqbed8Ye(OU8_tj*8b^saNw~1Om5F1t;>ONWKv;_sEBri*-snR(x+Aw8 zF?ShAKJeaV0IvseYS=iaH?NVzP;G^%AUIcfB=&kpkQwlF;*SBU6)pF!$d|r9CSAM> zBKa-rb8uuFOU+`pY)0R)lbTQFq6a=sH)=MEH3Ec)YL5QH_b3FWC_mKl)aCASBg7+hUyOnj`&%5hglkATizvh zGF+bvR*S7-x>j`RZJ3n~?Cw8bF!n?rBg4?hZoFw-k%X-A8hGYbb-nDEz5r;E1qiTU5VgI>nO8 zG1xd251V-AY!%m?gT$v!^Y>VT29rv}qU#luiBGb-NgH2##?avNnw5Uu*KIcHHeA`1 zyAJTgMq>00y>*?wfba7?9^H5Z%jx}IZ6;v)I)3}b;4k>ZPD5~&WFZ&1A#JR{6hFEM zeqG{aP8C%m>eC>7(nA~VeLG&#-mTfhGcOw0v>_=ZY&RK60p@l8@884bxz-Ms8D=?C z`lRj13}3-eu4Ubon`HdM`LSh*z_X5{bgU=Xh zpD}(5*qV}2gmlkYO$t?hhOkuHE`#9WEY|fFIJ$K+X5V4>z?=xWVi(4ony%*s&e`R? zTkM_{y5jFz;}L?(=9OxNq<7Co*utjrVa(WZHZK!|fsl*UEws0n0>HX1Ts|TzDU97--lf)0!zd7ylF;xkxc1Zo zLHptEXTI0yHQ|`af_* zENW#poK=fJs1fyczhs>0?;wmlY=ZS@oFl|r5jpH+GkAn0V+Xl!nOl6F4m{>PWC*xG zOLBe)d@|>Arh0qjMM3dxS6r4t>pBw}keD`BaZu3p*BYvz zqLFJ&y7O8uA?xZf<^2N!!KhviqU_t^yzu4qvm2#f%dtV*F>d~Il$Q$HB<%k+Gyb&UX+NhU|(ZBFhR`L)@|%t0l95_GM4Y4<}>om>szc5_4= zW%pnn=c2}~E*4EywSZnj_}}hP_+|MQk9|e1O#GQsl9mVrfY>giZ%&-}XzRfcTrM?lSd+(&XwGQ`*Zy&<7ZIr5Bl(&P4N^-2sZhA8jsu|m$Iss zHEK<^m_^kzFzE_zApHt5BVTf_`&GST^yt?fD;a*m=frTXAZ%NJYX$~7w)&!c6ud;S z1!+Gom^>%|u%^Yq_K-an>6)WtB)iF8u_0NXH=~wbK{H5-axVCOjDkv~Wuj|#RH@sc z(AJ{$_Af|*)cw5|$x^XYsW{HH;S7THQPZwvUT_?>R?X=OnTG<(S2N;|b=XU=O7d7# z+xuOtQ)4t2=sA|a#=wqKlGXhDjAPV@9gP|511c!w8!N`CY(2~vq>&S?TKsCppOlsC zv3VOU;YiexMVz|Jf;|nR^WLL#SN~UmXyOW130@(mhN#D z2%mZu;7u9eNX={a{gZ_jIk*PLdn4; zl&7VowD(7`{m(Pq8Kb%&-Vv?8XwAQaM>!u~=Wta3h8|dMH!PKzNBf)Pg?s5+b=(@r zd6{Dm+ixon4mnA+HCFH7hnD7`BC#<8Z*l!9)&7k~ku=X=JWRIvm&&q7@+)!Rzximl z5}O2JT`mS2cX=r1l6(&|HL?dvzQopkrUkMC!J@rD18G zT<}+QO0&m7HP~%k0@))vo+5y!8VCuvi#Np#%0j5!%5DTX1-^k zYy?!fCq#6>SvVhHo$p|L_q;|SD6H|ntz74>5)@5DuT6d@MzHF0rVA`knvCvw#7Di2 zTK>HRNd-A3cMdGTZDhflSNJOxV@#F>{M`pFGir#CKoT`n_>%gL`__9?6WB3K(PCWb zYVLiVr)Udsuc7m-N`8$Zj?C7G?KZj0*bY#>=P{SK^C*_EoHJq}a%5;#ca|U;b!{S} zieZ3e$-$VQeVlPD%UK66QKsnv`#7>!VpxCXz0>yCpaJjfFtzICmqFa`z%ZO~(nyTc z3R})t`isc$z=rwj}{lr~` zhXU--r^hM3QL5FZez}=68)fP;w8!StY7QX*{=4)|HR=G|`(I5mXeSI7Dk#-4ku!nv6qRI&<<)!E$1*NuPZVd9(gcl@-4%T1 zFDy2T$E3~GSX~F*>Ho%~nzZvT9@b<%7d1$PQeMpn0G-Y8KfKf^bfnMrmHe6Q*6rzs z5lq8oHF=Q*SubgI8L^-@{*z%c;_*zWRaTR2|E}LMTMN z40l2~sHBDgY{Plw9azQ+uY@sQ%`<^KREmmbWiWyMB;g>TN-lTB!k0`8-0A4-b&?X| z=Hc=+i&~gfT?YHf5bY zt}m+BI$TQ4XeCVwfM_f92V0f2BC|RU3I*b4p;yd@oDWXEcq-p~Yd~HrKVL zHn5tgYi{}E$|SM@bD2UJR_zOu{r-C1L*5S4fQJa?MVrJGOZaxWP1sCapvBY;=V_h5 z=uTYQT@}2K<>e4`!21B{1uZXe=no;yDu@K){b!s+{(r_v|80;23Z$^EiUJA=p_HZf zm!JQPBa!FezuEox$$c(k2=|t&y76veP|x~4-^f!7h=RW9F5(ueSAclGYGGiy?%c{# zBMc7anR`*QOXvTLYN3N_)s1S=S~DGTSXrKSiLH;nvz13$+B(K3z836&;DRH&8%XLb z#e>B5_EYW?F9;Gk(WMT=9Q0s{QVE>ccBj;dgJ16)V6~=mW&o{Ab{&Mj&SjXUYGn{> z+by6Nn}*Fx4YD}Wsq3bJ2M!cUrZwCQqfs^?59&MXsTS>$~!uKsV`!DHMwjD)lta<7Z%aA5qz$a zMqO}cjDXl~+g1V5a^=dN{RS-Wly4brce7&rUF_DfT$EM5*DKk0x9jLzB~cbOqbHra z{~Q!Dw&`~ls{I~fItRacTsNxkq#uf}#I{KuQ>a;^g)@udq$i}0oWq+>JYbb$(UOa> zUCPtLAtGKt)*y6g{8R&b!oCGFe0VuzxSp9M$lXQsq&*D)=qjxofrYBE4nS0RAY9s+ zk#zlSO{|mVHnB-!8MK~1_PEx z0WR*tLa^sI1&uI0SdG)v78RO;usSx2PsUzvC!gmS1$|Z{d*UwKG?NIlApqMdvQN5s z7XL4MQBnZE`-=ySiAfz*oD9&3C;T^WYaI46tAVvzZaPGn_^uC$x;)~!CU}Su$GM#O z!r3ApGD1P|BUZd8cX^5EL|QmW9_2vrd;-(-bv1pUzTlLO#V~eN846y~cI~E@OXM)s zqnqfaSN{E+XXDlwi&InUZ zGNA8xzIg?pG1y7Uq}gSAc-bUT4-`PjP)$C3+BYO>xBVEN}Fd}6x#z~yUa2@?Sv0!Ki{s>#omj!mLCmu~}x{u*3t|pL7 zu^suJ$|X>W#e<5o-qL`IjM#%GN&_5t8UfJ#_#Uk7=DKn$-OzHitgsqVUX4dOjAfE& z$d}`L1S$gTMA?-tgSI%YoAUMfoDxxB=`sA07_JM@=P%%QsUQrw`>B*zsKSVSMfS~W z6DiFPipll7apLm~D>>c&oxLb2#QXt;gpJ{3`?tM_TEl-ri12Wcg(HVL6w!=vLZj4+b)RtwW`nu<&D80zgSr8eBsidEkm_Q>sHW8S z3xgrPn7OjnD9VPuS}TgSVI37}F6*Pomo`^SKMcpmW#}aag3(m|et4y=YJeUVR!ud@ z_7Ct0<)5wgbU+=<(<4F}hHpw7S^dm&^&XFNT<#zb|1H#Hzkf*XkDklDD?f8IyOih6 zgYHG`V{cB6N>CyJ>wi@eo->??BUbUgpB;8AsJ2D-c~~h5lT`SntdbYZ_dBs)Kc6gi0B2 za`#(pu4@*oHkH7EHUyY^&nF-_5`0b3xmZKEm(iB?PM*Kq|>Y zjfkyg#dXpv0`MwcrzSbzo}e|iCC*5?!>_f2|1CeGRiKcFa_j&2&wpM|s4wt8?z>jk zx!79XPByJ3JrqM46A1U>fO@rCA9drE_qj$kzZEeDcYHDGbe12w?LBXUG{zC4&~DyV zj9`l$+GnjcB!Fio8;jShLUl4ehql%Mb(Ade+AQeD$w9QU1e>FLT3eQM^MX?1hu6K6h)@na z0}W`9N0W$&vE$AJB#-4FJivHE)s0|FJws`loa3gsB<)h3hwzW`2Tcr}ghvMTLoqd3 z{nQy#wTAO+`rQY&_q4_SL^<8ofEjbfB2ynBpPsuHCeED(NpaDY4O_tQ@{jp!-o%Mm zK=+%k+zy~(sf(YWoR4%eFEuD0N};Taq=B!s`zl`VzC){ueO{vo9do>8Ah4Q3;%Q`? z$Y`Df=5UFK#4u%;&jm$-Y~8NAq1)o|KS5v4!Zy7Xr8a5giuZMoMXG1vZjbNYUsVN9-#+<^k1`gMK&7w zzwRP7S5o7k;M~Hv3-HY+gES>idK{s3D*|q%$6`^sLvp)j$!v`#{*xW<*mVyG5ZO=j zeC!+>E3hpOxx=qx-=Z|tvfo#OoW4gk%1Ju+pTz0Y#s??9Ca6JgT5_}qOR z)uxbsBJpZr?a5)bmMX}oKaa6QFzAtbUzNq;xbhzaOE*W)n%oWrP4o(SaO2Kz9GbZx z!dw#0E(~g+Q9dODv%Ir6n6mX9LRqM~^O?LXarG!DeF$fYo5O%a4dw{h~9V$0Grm|JjPbMI!{kKVga6 zDJLzYbT}T4T?Bzg;u(4b1=4nC;rd&(|D50+fPa7<*!neAAT1RT%vioIto@?0y1TE~ zaFO#?9=}VBHJ0TeJ8`BKDG`4OU`X$hZ2yzFw-TSXA^3-2R}$PoI=r$oFIV(iP$-l2 zA^kK{G}?K>I;Nk0lqTWkvi2I|-j2hc!iN^Oo!<>dcGf8*9Via_g>@)pxec;SlLVi! zr%w$)_1C>x?G~<*C(hV98T*0KYfP33f8a~?bL{9&Z|JQKWheqp*{p>ch5r8ZFhr}i zB%r0T%?uy~ii3QwOS%ObQ7~)IAr5Dxjhj%NeaZrmuS^D0=A)vR)XohlZ(Nc$~SRYdDwq2q}5HuG9Q<9K*KRYi@ zmai^BazE-o?(tPYQAh6fd7?ppL78U`)iGERTGS0QC36-~Ut`r!6V}r5TPi(TJxdV4 z^N-R!laOcU*G56X#7AZ@ck4n~sfIclDmdWq#IK1v1B|7;QTm370wdTmPx0z1QyS81 zxt!XeR?d8|s2T8&l{}+Z)A11ecv)a`X&J#6y=JGo_3ANTvYNgI_t1q^86evl&`C5} zUMtYHOal%}MELyrCK4CSndWi0-zP#zN1;O`WM|PT?<~y`&K51~zmkT4I1f7SN5&W8 zTCm`4uuSG9_;=Nw{e0~L;7Qa>wl?#Wt-K(k9)?1dGopuR(j+qn1!DhkCt4IuE z0cJbbD#6RVWwLGiF*)|RVPtRv!vw-h9ZDCWO?OjqSPt2lGdMtTb%K5QM@AMVEAV|F zlNusl`6UQcdis)jv?AMa91Azu>hub?!=q@I0~gtdjn*lRb-UEg9-y{Uqe^|nTc=}v znzo{PXp5f2*~#6d&hvuu1T{RF=61TqL;Y5o>V$qK%oAT-6K5}%Iw2BB<)0Rl?|*19 z(Fj4rh)9Q;?ODR}#wBh3^9lzA(yqel0)@n?po9GjU~$!b;Uf{{ygjgnxBKkKpC)YIHxgplUI{DZZL*Y76uBEt zNFw8(i1;5OkADG|mve`;xjlKHwj)DO4k+kT6XAaLvfro(HvF-#EJ|umGy(GepUlxs9M#P#%|pX_&54qD;54>^J23KullijxdxQ}x_*G!&M$;^C ztGkyTg5W!q)u90I>p=u}0QVRa$G?x)%4zTYyQACt3#5$cK zXvQL(ii!F$&$~wXO;6FgYd+J#ENnU|j@<=xns~o$iDS4^+CiKYj{?s^x z9SkV|4bsK`HZ#>wI94?$=MZwaL~1%NJ=c%QSS=zGMQjqo@$YUOm?N~N2t@BVQ`mzp z=-cnwe=z87GI|x!R6X$rsNWpxUz?@+qzy0ByJ<7C>rCLedJl1}AeKOe?9*`z{nOaM zBZiL_U)+{$`&x+41d8DK(h3H1w=zd}dJHpi1(I7n=bZx9xq*I2n>@9;G-8V zx?xjRa~zqusoNmt_E~^@uKpdunINg*E+Zg3O|d0J`Fy)CknMQ7;xn2DR(3KrBdgvx zGqT8HxY{QJoru-ObY5%HB3$y7M8t+L8=9g?p$8Ve9%yq*?JUfTN=pRG^6;=D>r!TT zwbxDKw-~MH+l{{k+=e}WJi&1-yg`^xgLB20TZx<(5Zm%V1I{rXkwa-(^or+vLcfnL zcB!&kuC4!I%FE_M@=-gO?>Djh0So`cgVP4-kzR?<2*&j({bFFqDr)ER_Muq&0gd_N zLzG2^T~Vfi&3L7u_3m17u?jY&JQf?OfU>A)(dI{jjXkLl7&Es#Xskz=J)CRJ_StBY zn~^vdjwd=gXSq50&UWYjkZR}*!~X~?Rt+DwoSuk5en3Oc^j%YSSM=l0D))tux_6e_ zS%XXxTi(<`HAnq&L&);nc8sI%r4rob{#el>Ng4haJGbNF+m=E-5ahkjE}lT^NK_7{ zAT3Eiwewz~^`U|=LFX7bYc}8gB}19#YT{^tSq`8Gt>`U#`e>H77u8e#My0la1A}JK zmaewGNXTU^yGJ!Y%SAW-LDBD~eKAx1Q^)DRLCd&1xzaiCjVF;mYEuK9fg9b_W&4M0 zhIQ~Y!AHIsPiRC)uf|F@ypPSlCd5kJ;-&s)^}0+PU0HpOYV)S!*m zf*Z+j(<5lTVCm?#HD^G`xjK^nFIfwtj5&>_m*f9eEKP7n@Q;|%{ z4WaFpK@bX*8XK6g2g?ZczDI*qoIRD^rA8+tf10SZKdMWBxx`9!cx#;jH<1$c0a!v% z!E9Ex=Y4#&>*D+XPgucAjDm)IniE@ddOOiwKrKDO=!6YGbo$JE8i2-Sbb%sz=*JAL zx6}9{4!F!W-RACd?1?6vVz$kiC9C73NEdB~3FF|2U6l|s$&Q^9A3kn!*r?O3IagvXV(anAx%oH`0S)w4FqFuY04V@ zps+4W(mrJZJvQa(dng*{ozeDhVuOi@SFv zeqBHR)5mi?d)Fit=i?}-jPl1HQLCbu<;Au>!okbxbr#knAx2?|QZ9!HsE~T%5H8C8 zn>KYgPzLGfDqRJj)l+!}_hE&^_l!4`agrhzt;liiYhAA?<|V2jL9#Z0bK~pKOsgEt zcE0aczmqjLIB*S02A#A_k22s$gJIh)!#vLSdkpi1-NvBmHia3jE+wxh85{D`#)UY@ zU!VfJ_mw&g_spmQ+8NN(D;}%%Ukoe&P z5qRV-JKdzc;a|M8BJ1KW=vD9$lZ=TGew%)68O6He1&UooTjuv-aQb}Dqrj;B~%^3ZjQI((~7}WH|=tq z`Hq!`#U;-H3uZp5ZP+iUA|@X*Dm|I*e+|%R>3`2PdXM3M%ri&*n`~Soq%c}NUBDr9 z8T_oB*YzIHU^P{eNyKPA>vxH+C>Dy7qTj2?NtbU&vwqLe@7bsKn??>#%v0K?VRyuc z6M8DDd<2+wC=)QFwh`UsMlK3V1a$(9=<8Xq`>+{#9aRoK^ioVXd zB}XL19c*<4OZ~>ka6?!-IH7cQ_Rew4`fTOkHJMF9&6Psd!RBc)Rymj`s@KrYQpr++ zX^1oYNbvNUmx{=|0E^^jU8LT&v6+6$pFinBFVa1|T!DAf$pGf_t(*Q~kt*Vpx{Ad` zb0fxlM9UlH^!DhdZDqaX%=n`E+2buepE3BsWybgU5l#mNb`C~CGrIY%)m71yiFx$SPS+7gk6vhCis#IvY(T$?FF8t`x|2_okr z-s!7H&Y2oR?TJAfay|3pIuYvp4J5<{H>{wXKga`iq;yM)%3Qpk9l240L%2?e3OL+; zvshy+No~P5;4^}1*h|C(G0XQ<-OoodGuLiZAa@S8NqqziB8>=^4N!^^LJ!e;>Io}} zEPNS~mMDaeoN+sKD_P81IF(!GCRi0V67Wa-o1Vtr!(p|2_$U1Xab>S7?b+g!WI)ME zL)_8ujxa?)I5PA8tvV}|g-Tp|P0o6BUDQL+@qY*fzFEP)xvSEJQ&|&)i(3oW?9MGM z`gLM@G^vvLAoZ;&Nl!R`1Hb1pinXF(b*5>sr9*#=`yp|#7j)bpC-LKc@T8~;Ab^wa ztHXA#=hh)R+Ic`uSVdif^3O9h9iLO=Wy#ho;qz&aPT64Q0kGbE;Q%#^kb@_a9=x6M zXQ7mF@P%@xU`2BK{c#GDx8%-B+JODe#BuaIIuCVtHy)RL9>=OMe&|anTgv3cB&Jeq z{SyNS;rM(n-C~b@ZyxG!3DZXJ=B1ji`Y{?8pj-1ydsXFVgi+KjmgoA$U1)E$dB#3q($%xvp(B)e%{@$!$wEHeqcS{o0B%H(1`s7Buo z3^6fe7jFc*BPu$XhT zuB?x)GmxfZRZo@TLw#a!q`{^l(GdR%) zDyr0Y{~(8A#Ms*(@Rn(Xxoq==@cp3O(`Sy5P^|7_-{IpJBP#IU|E}8qE)>9;g8&GV z#r7*Cr*|h$ZGJ2EIC9^<7&!yY^DU`C|YG8?heC68-XBF2=BF`eP$PphS&|Lhu26;BA(mVXLF{QcNY= z0)h?LDMkEcYe!?PtD5ty1^jcD*h4Yw59ptVo8Ofb6=Vy$%sqy9=)VX36y|4es`_ATTtt&L^*^?9 zjFfN7v&u7v7wbe6P+(o5hq~e9OIUz^AWI*z*9A^4z4>nqW|}hYUJetyZJM~n6%@{$ zLp95vUY(ezF>q`5rZEtC|9D<_xmv>n8Y2?3j<5oqzDZu0>vqjqiTuE`j5Yr0nGV#J zocqPM@RR4g)%;1{Z#f)4?apcsR1%1Fppli|Qvf6cU6o@o=fXnDp zv1P<_2g#N{J&}$1kcWyCqnN4o)~Plwcz5Vv#08q-jV~Ny@Dwk4Z(EdJA1p|^6WAuc>-G*fYZC>wpET^d>No=*Zv5>)T zs_#VC6Ow=YW}+pxh>SHajo>Mk5#XQ7DzgT>@O@`{SZUYXgdWPgO4pS! z#5GE~an~5t%L35S2)1>&GSSXOlpd$F5M9HXH4Zp%^T=;BR)dx50!wpe8$NEtvx#ut zZc%i`mc)hn%~3SVy(tkU&_OLo-%6q0gIbe=pRELHE*o7*jq9Em(f5ntU@@f7k~-r; zlELy=?9jqZRKL9vOh#|5W*M$o`Svj`1TL6J zd(E3vS%CM4N^w7f4f>vTHpqw+;1*3wicl*UtqFHS%KJJlgon`u*A{I=OmH*0)idVT z$r`TuzG`e87ILIIA62&eN)H(F)`g^0<PYi)pa`0#~6bp!|U zLKDy}znlb>yx|`jgk1fr78jk6CRB^bNqXPq^-fKRIM|j5NdcSHtGngKZ%6}#bjW?h z5FiJd?j#>$c35`-C~Ua6`EvUYw1=R&<6y3nfx9e>n!UM>q9jID$Ui+{aSd#F=nHYs zWBG+s^7SB&3X4V|X7uE#(YH&j1E4ZmuO0YnvBkjVn;MQQCHNG_N+u^=+YH9C*&O5=j4Z?3%DKNc$Kcc}% zp+{D&8cH1dbLzL-oLFq&+6C?g#~sN{4LYCq@z0)lx*<0J)oTi3srk-$+g0ZfS2`*9 zLb!FXJ>|UP@(-s7M6X+}Igsvn`RnangK)HiDUyvC9kGb;BmiLSbTSn1<%NF1 z7ht#ji!Y;BKR5(pmz0}$x%gyt_6K-e(<&Jh`^5diXvf_CaT`lH8m zuEc21hfNTw8q8FZB@KVMkx03<*SCbvv)t)t3A*WBr=8_Qs`s%+gq(YctCY^(mrh1H zJ<=-^VatSxSvO(f)RILrH!>35)=o*3p?!SWND)8~s}5@!t1HYl452C_B?Pfe3l8Sa z62&RiauZN>d+a!5);?$HD5~P9$ar*YQ<3=gX>_)$;U}5$F0s?u5#a; zM9Ab&II1K*nxpdqlom z@PH~SPaX`jh$TTe8WEFVkZYCuAa$MBLe_Bt%vwJgb!tQ>3P|j)J=n;}m$XzQ)845- zOT!i0chg=9uOP95npF6Ky#1P35}i1)@+MN{1)J)*;dTF(@gX;k?l;b2(ciw>_?-vq zw=UK$9V`q;b@k&Bph&~0H7IfJ{pSQW7_~^H1ulczXcwYaVMItZF(st75CZ0KCQ@Ma z(3KW5LXtHjV&f1V(SXSfO|HNx#QQXS-)tE=&}Vo~M9h-?98IzIfGsVXv@mg{={@`n z5SKTj!;1etlF%3s3ZQW!3K@WZ zgT9pXMLdaI#||wySoSxQXf~{*n3R-JeQwFwV>{9sF3W_PTh5=j8p!~V>YtG|NLw;0!&ppzWpG$ESD|AGoVp#{dhDv*Ym6gU^6 z99;XeRJIqH{q`jln_WsMvL#1lm%an`O#HikUA^>sGu_FqUX?_#`|aLi&xFs zRv41^#&mkfX!{mi{J4!WVCeX>rs8K1nF*_i?X-(uLlZ<(v10G*QA&)}FiQ01+e&)x z&q54Gh6GmCH&bu3-zp#H`a-|gyRvT8&Zh3=5C8NdTq!WhEk$;cO$K}G3b1m&s;B&H zYrRpQ|M%t#Qh7^L8)rhf!4?}EQzt@RJ4{c z=kGh2pfx2{{y6Zd>;}l?Iist}2r$mj1o0I7h%EpVl5WfZ@`V5Bddzpvj}6C4NU4~K z`xFxIn*S5$pP6Xon-bx_aRLQSxn0sENxg0WdFoph5=>d|U94o5QGOsIHTMI1fa) zUy2%wi){|U2I@m!KY#D{GX5w2jaKpB_`q8Ah}IbA_}z$rFA_BH%llZ{oYI}Gbp_sJ99}x)WK)U;X)pP3B85? z#D9bn{TqM$wk0j+z;6j`74WU)LaGl(md`QawFXoJdAf+ZX*ZnOXyEY5H8E3gHvJp$ z?eBilPH?T*irKvm(&joS(1CL_cU?Y)!k({XoiVO-6K)EMf&>j90|Qn8oV?>>Te!G5 za5FHtySvky+q+np+uJ*v(%YH3FgTbyF#KJ<$#oy1qdABQEfbKR%-}NkqUmSg|83Wb zdelpzFVHFi$lv)n+G>H}Y~MwA=0Qj;_$bCtqx#=vPQm{lmPw9V$=^dzq@TnG7PWA0H_`=Kb=Uz0>RRBOa?_9Ha^eun=uoUDA^z5Vxj znfyve(sAV_1)?AUi52!|5Q?G}B8MYJh6(BTqwqU1eWom1hTJdET z^d)Sl>~kWRJg_XHP3VqoBl{PUbJ#)-t?qgR7ezZLsGVMN9BxurB7}4Yz4_~tr2`Ga zzx})&&h|c%lz!c?qi~wU( z<(j<0y1;Nd2EYL2;|=3S5O4`?g{oD;Ru7dZmo^~%dR^vmDGLgo%p#Kz2`?aav8Ek{ zOkWw!yEMf7{BL^h?f;qG7J8dsCTf>%SIUI=cJI+!V}oLS6G%C6jaK=PSECXQq|5TZ z3UTJURx@s+?DZ|sli#`G6vwKFcY31o?bpIC>AE0@i@M&qx)NOffsKV*mrttMs8W6M zaEX20dk3~J%&hh*Mu$vU`Ht!D#L#2oFcuW!FTy66niSk0AsQgFsea&l#X*@SOj>pg zp~a%BPxUsJis0ZGg;E9zxTvKDshYn?wXS=T3>J;x5ezFYUF1P$VgIh9t7^_ZM3FJ7 z=kE1kyaTpMXy?8>(Mc#ZJhgKZV&c<*<%uc%asG3O%h1H!@d88&2y=qA8SS}pkEibf zBFmfMk$uL?NbL3K;)*eIQKKc2fpu&K_&@1UzwyoctH*Ke?wdW@%)Lb(5|9(Hxq9+P zi*&zLeVl|QX~7`}RdT}FPV2g$BEgve%Kj}$*s-j|a=tn^;Ix>YR_uIzH(vD932g?t zFmk=>V;L0CU=Tzmx|MN}oLZ>fb`UOau_+0mRZ_nK&X#!>lx#j~8+ch}yzU)`4jKv}~khEBD{Az;#EOlwR<>EkSsgIpr zUvi@v&U@B6x|1w|8j*6%RJb<+o_Jv&A_CT$vxaEL2|(rR^Jq&w*k6)3{*KCj{YvLB zy(l%zI)+$(=z0?1rM{4|2w|Sj^VAm&D1@%M>0$LJyLOhg8E(QSxBQzPWT1bpB2a#r z8vUD|-39-b=llm`G-`-%DIbn3IpI8lt0rca@}6F5HP!vv#S$&|gq=Bkf(m%JrvfxL z$!y{;OvxW6Id!Z{uV73NZm+vm&-uqlD#(CwO<{ca@1UOCPB4nojTukQCAf_yr)^}H zG}pmZcsIr~Yy5ncgxg9OztJ>+P@pB3?u>s0hfF7>Q|A#uxukg(W&}e(cUZJR(U|X% zDEx6r@B_;NU1kXVcy_|&7%*%T>_pV=4}LoL_y>d~YtvIwO%TSTM%&=AOIjT8TLFq? zV%CU}mryKK6_+suSetmDy zN}S+-mAxv!OLU%k~JG{*OseuaYKD@9Mr>c>& zmzbs02n$Or{fyxu7hQ2&=+$cS7P9pAhy~}U5QwK>2QsX|$p*{r{ZQL(%l}AzSM^vi z8R&rj_|B|rHU>(|+5-5!ymo&$osQw+o4}nULpf^eGi|b!m^*NX$a&wyts!WzO53?( zhIdlf_&th`q8TA&P`->;nhRHNMp-{3lH+o(S%SP3#ciD}DJE8ujOMvO7480;5;+K` zZ`}g!)Yr-Sk*BxHfc)`|2|9_x%{nxMl==Q(E#7}ZKMFYG$7oW=VORu^-@kQWFyOzx z@PKhZz@U()Kmh-{YU}^53I9#tgJ#|<<%m;yr7hG4JkA*tSNT(+79VLX8IZJ<(=V^& z+3nvF1-3VEc?Z4FULW%d)k^nBy9oB80fhtxO8hAn`Iz!jWsY+QLR*`I4O`gxoL z1VmAf$hGl_2IB{3OVD;#n1X@E<^+U%#|%^Ubi0AVtg`EiONwUIy&a-X9J?|}K=cBE zYE^OE_N|sdUn4MwKU30Ronlk8`(?QJCzvWE7R$)pkQAy_(*c2loetGTh+T z5KW(V!S7w_2MsyNzi_j%BFJi$=F{G`z3&^zN3c6yJj$!YH@zoA4M|GMGSG(Od@T*6 z(;w155soAkpX=W;p*}7P%v>7a2V+yBYk3A$&(n4M(z(SvQ`8sz{BIrgrXcfgdOZ?g zhg7->;886R-oY)hVULfza$(!I=W1Mwu{pZWAJH2c{l z4zM?;)f$#hcQ`mX1ZSVKY3_u>i)KoTlWE!vO6gl)pfb={SZI-IC>#&0o%S2Eo0`(o zKscd?SkO8u$c$fqvGo#Do5#((P4kO0;SA!COxDbSFNYDEAepbg&Oxb-Zk~b_N~-me zs6a-C^S7EX|3<%J_H>1y=|j+V#O1`<^BQ5b*B zL;OY*6`3Qd#8i!EV@%2)Py8)OtaK{=CtcL~s*rhsm0PfMkpDTByl!bI_%}RWmdT$A z<{Q}3etI)VkBPVu>EXce#D|BP=eQv~tbk15PLF-2VyySi@&F2?h_aCZFQr`HwfpT5 zaiWbj5Q^5R{t+LL0Lno?!KC>w34%J27u8e|t5YG@*0+%9V|Kz!d=57MCo79i6~4Ri zF<`vn_KIB8NDZrca=R>qUt;crm=5KghL&h^3Fy_|Bt4s|Q<$L>vShgCu$Hc)<=8jj zX3t@+9(q}KfvyTizl@8>$ZQX3iHj)jYO;`I+>vRjbweCd!%0F3W}_rqc`s_t#;LKB;vJW8-hx~_Y;tXqILe+-Q z?hpRU<2EPkFON-rx7PAVJ%%trL_nKFkz~HJLoO!q46XkS3qCy4r znzJKcaG*zimP|tY>eIcjheFGln2=8xW@^eMv(UHOw~;jcT97V#!~FvAFfDF z%D&FsEHv0sIu<5iW-_ftR}I7iHEpGukFV3|pQ6=UwPzbcUq4a#r6eg1rR5lgOfab< zOI~9Pk#AH-c>O6AhUwI~_kSgZy?TyREooOJn9p>*1#K(m-)}Bj(+*}>JNpGl+ z2PaL!FX~?9x(Og}ZsjD4e#9irsxtoobz&jx&ME@Odmw2g+ZN;WarhK&V#qlKn;5Bc zQpi$b!BHtvqXcV^FHlp_ks!K#9q}U*v~eItb*( zdg;77HVD^lsO)S8_Co+EbX#Cmp9XJ3=H)bHonLw2qJt0z63=4LS6?L6@ zXZHEVID~p&^(FWtHuuzjc|4r(|K;%0etRjXy8!%)+K+Ey!0n& zTSI-2AWEHs=+E_mF^eV^+bg9)Xc-wa)T^2ORXSQ|r-X=X%BQ?NOBkGAvC;FnJa1>h zH3bEYf^(B{!QP(hPDGk8d)QiDgCId6mROH?L(T}uw}>{nK#ZtR(+4tHY>_5sAA(*} zdxBgU0Ds`w$h^3?sfGUO7oMov1@*`}2AKtb*4Jn%TQ*b+Rc4km>wS=a%ayoU zF(b)Yt4DSiH(?!`?5egnrJluXfRR2TpBQ}NejQp_Vw7;YYlGMrq99=tqP82Llx&zPW?)LcU-{ zAo?weIDP(`yC$PdJ18#1SYBh+KSnzTJeA zq$JlT^$o>|71hyM^+J4X4+!W?jEFPN!_aG>?qT0N)0q_CDl#{a$En}0{lr6aw8)Mf zbeC!PGMo8u+M)q2dm$9fmC8&XH1nB_n{C*R zIs6k{G4SSN%=E0-Jey1oGIY~Bo;NNu>M2f6o9Tm=-a#Q(aNuetbrA6V97Y>(t#Ai1=v8(?5XP+HRCvpgF zI_);ezI&l+=)6^&qO7lJcrt;Q{KLinZf)dq?Ik^LcvKp~oOx{6bat7|1sp}UM`+t+ zJG;GwyE?o$PA_0u#vaS7wYLF7WjXK!cLIz8Wa?DKJT=ToU|Z9)a3u+BSVV3&lo2wUYNU9J!JvPTlP zh>rqgN>cXwW?SiM9NSVU`l(~CAIoXM$*goN!;bR0+8?p_{gY`$_tMRMb+LGJy_>=B+@<}^0}b_z4!6E%mmf=x zs~u2Yrm~ym;j4W3_Lw0d8FHx@h6>;Z1Poq0{WSA+aSdV=uvxENm zGchc&Ns`BlANqJbtXvs=25rsS(71a1>cepA%}~m;CW!_EzqH}=DHC#j+@rXM+_O{ORYk0^<7}tq$6v;@N(D1`m@x>$l=R*8$S-CmHV@K*c&& zk#<;`^LeDQM$M~sW>`i%WDAmVt;yb*0*&=fiNoG+yi%l$|9gtoC9#!&M($Ums%tlaOPKsNk`{7K8~agI7jHJsatZH4@<$AtEE z5FTTHNjfRt0xg|9*#(Y+o!UB_7NY^r8n1d;Q6B=qjUC*o|G6CUOw^rjT_)uqMIswD z67t%0xx!Q^dpr42CpXS>EEO?>+7<>+5jgKghLXLb8z1zxa$3&o+Kw%?F^(GGCqEr> zS$?EN_Y_tub#p3GI(%- z2ir{_PJxD^(8Ba_r^8pGM|Q)|;AHEc3TkHso1}_L|M@s+wKOHvuo-=T|7De)8q_9V z2k|VGn@_tcHxRcXHtZ@6{7RgXup=4es?8H?(5Z@b0R!!3A3O3Ag@)QDo$zCIrRPa# zd>mcV^C+f3ulvx8&!7;fd>sp-7z)B$Mb_)L&!l=f38Z;uf|o=3!FxspbirGVPP**v zu*^w4ppDHm5#N}~s=0ZtW4qa0I*xz+h3ZEU(7gh8`k>X5q?myvuq3!mEH4;7ZLdDl zl^lV;GDa`&q)X9%c&I>oL;vLgm8x`Y%FPIk>46Any?4z^DY+TP_Mm2K>iCo~_h3C0 z`^0Q}noH&+&gH49`_^ZfHk{&IjjJ<{y8o$KdEu_;(X*cCCQ$SF6e~}aq-R45g>F!) z5i%<)bERZPypOAM0#~&!r7TAKn_`$f+iS+ukGe90mMyBWcC0vmAnBVe$qy`DNtCoi zy-QlzA^fy{{54YvdEQ(J;S=o11&gCbe(HPjB?*<$Oh0kJYczPHByan4Fr}J2w4mK* z4Iv7TJXltg*wbRYP(}aURi3-*f+c?m3{95#Lc)C}BydcyX<_J;gXYX^Mc+cwVa`{$ zwZ>^Rv9iE-3}oHfwvR-ccQuJ)Pb;Gfw#k;wD2H&kHTOg;Ci5NIOJkd#ATe}usYSG5 zYiZnQ(jxm*o}_v5cfBf~uvRe#FFw~82PXAYR4yLF$IzTbpEL9)fk;-rOcWQ{{fy7C zSCXp&MSEP_+>0Jp0!pH!u!-Xe;aHX|FU}*3R;dw&R}uz)?aIQt`xFL(kP3{n3x2ZT zL}JlNQ3$)Z@kCtL_n8D~tJH|5HdIHN3)HyO$jpdiK{;Ucp6|#(5`hmko$SJAChr<4 zz)yu&1^!+J~?en9hgD(kXl0zI0J+RT>I4c+Eh z8X|nG2PX;qdpr!J)WImONXcQZ-=gmAe|f+pa{T2Hv`p$9*t_L`FpcoV)Ea{WP>m#n z7jhnC(&LMO+JjLGuO{N!CdPb4xgJ)@>3JbVn|d}MDuqMPhG6)tWygvU*wh{*0YtT{y+*NhAdeY&P3 zID|uby!Y#r_Ac254rGaMJ7GU)vIJm`egySKRP1C*Z>$^0SXW}#exPhWgzM)%^E!Ot z)qJBWqrz~Xx7XfhytfTxSf4&q@9LXl*=|Ue(|3~g(&tC+dXV-pJ_&e*cAHgv#0kz$ zQvjpE>Ad|?k;Nez5>o!)o#OnqxiJY+7z&3JZ8kxe^tzo3N@C%G`m|N8Lc~MZ;_DPJ zFfM)3i^%CS@%yu$2aw{;bYm{-Q>4NLD;lZxf@@Lay-0 zSj!iVdYxDwA7*~8*j_GeLEc47p$Ov5&~Oj*G%o0(ee|e2|yt=q4{`ohF=51Z|Zq&XW;~ph0lXq{JOlEGY<#(&P5-e|eb4k^kipr4dk94U9QT zo{R9U@Ac@M60fhaxV}(!D1A#VVyq2@Hj%1B+^1l-9J+ln#wH_SXNfq?!OK!XQ-}Kb zk_|ar>gG{kB{c1KHF9>hhZ4&Oq)}Md?pU?vAfRS<5WA8WO6K;C^^lV*Qg0>1k94oh z%oE$W#}iYYX+hg0EmR~K$AmOd>4k4jdE-YDgal`yh#PQy8Al;fP~V4`F$u5!!B2n} zE5+29K%5%K*cory?yMtkWmebM+m?z|$qRg9@673$7>|ghPG__1dAXd%0Mfg6n$6uc zz=Iw^-bmtkOi2|h%?2enq@aLIgQeTdX`Y5_bPh$*k|mOtJ8nvxSsyTcD!UWWjKE}X z1A6daPtf?bv=aifT7F^i?EfU1CqKEY&U6RQ|D{vs&?iR|`0X!3hp*=9<8v6k6<1w) zU6^ImDmXI0UNAMFOAZe&#MR9Szm~X>uzrF&3hFk-k~qWv=V${H`5^GDNVr16KoK8Y~H%8%=57fW@z%Wd+#Yp$ClWI{* zqor@t)-xouthT`f(2GV+m`GVSHrhaYwYy^dB%$?`ES9-8MFCX>-Fdmkbv@*GszO9Q zRhNr)wMVM|>9T0^)h2fb9d=>9zq)AGaB40TgiXI4*~1^Zd!v@IZ}C}{WD4`&@d6d| zIJUn$Bte_H1b$qC2aQzo$4y!}*s^aK~LdLEZ{loQXw_xKK)g+L5Mk(7sdPh3nX z-nNq~mcU$NUkB2{&nktjp1BW7TO|?il<)-fOqH|xijQa&+?rYD(am3fY%yc-m0f=y- zDLQnzXEV+>TpAJ+*4g4EOp{VW60vYW5JRQ6bs-c6%4b3MhZY_g5Z(DSNn`?O5o*zd zL0uHWECCJX7Ku%;mk|^sba)2?4iD|?3HRF$J&;oY1PS%w`3kv3MVPu%hNwa!srnMp z>2H1@izX?|^kK8BrFF+G<4j;pU?`#F1+LFT27*Dm-=%|hyKjuVb_<{vp$#_P$6aKq|)h1hyh1F!q+A*-skRW_UPH#=doOQhpGK_QbCA!qwo7w3 zcd}yydgUJ1Q2WT8TE>}9aYEHwcV7D0&>50F@9?**<=7L;I4kxU#%inRFalyb| zGC;vqG5nMydNIiTm7@V6Y>u~ATG*t31-{fR#_8GOAc&97>gT{!(w9I@7Vk5`sr%e? z7t^`ME!cI|*^G2wyV3HtCQXr2bZ=J=|i|#Hwv>zyVbi{kr z-x)x#n8@A(m6IPj3xm|9rEk};AxpG5@Q+q#dqM>q-`8}qjoeDvlZ zyNaq0cupN@I>9HntV!nSkd$2%K{S6H`j@$ z21}1V^^|~;X^ST87n8bTAA@|V8eOQAFjEx@K0jIvows$tzR&xWu`xMnJHCeSriI$M z`|Z3;m1nKA`2ZML+$a9ez18buUjKi2{M)N=z0&y4;d1I(Pw9-0J9~xjEj>2CC)5Ur z%wucqxU}j6m*e%6&a&n(jZG7G=$SD+B-y53X zVXw50IZ)utZuN+BI`87F%puWj=UKa@y#T#FEVNrR$ocksGYZ{MI)-Pmws*(wLEvUZ zpjcvngD21kB TE+bP#h8N{or-u4VqP(2Ae6=ZFGmnF)z>V{x3d#jXUdwk4s5K*h zi*~_eDHE8;qZt*x{F`s!jNZ-BcEPQ4*pQrkb&r*&0}bwVbm>WJt@w(!znn;_)ux&X zo}F=fPGJ~lJ{8o@4G>D!YArihHfnOF=we_o%GxHX=p#vFm-D0LklBgmD`8LMHJ*vH z@++)%XDdlc$%yZRdi^Z5ZN)c4#V3o_Up(8Nr~VsADsXp}y&l6G3W+<>VP;R5I&~wH zj~3Zzw^Var$fHD3lL2n8Yw?7;)k9s2VCwO=}dd*yE3%KznYQ^xm~2d6uDp=J8f zP(ePzx0Hh>1Sx=Cz?oU?$uv@;MS-Lvb|7g7R6^rWbp{gzsPE|Q%<(;`&o z!Xh^lLsEe<>U%%dannZ0O@X_3erGfs>hRtV?LM)C{Q4r-C)RS6m2tJ zh8v9k|Jw|^AKsaa2=%QOd-Yv8W0<39W;#&g;x;f{*= zllZRgx?P)t5*rp!5$&6|OQ;9ky$|XUr&5zHf6Ci2((=xheymft+>E83V=?ZaYPwI> zRo<0On+?`Eg2Paz&?C7|+3{Kl&V=i9B%Ptj4`r;j=3WEE)UAgQQ(E4AvL<1{DjRVy ztECCa-RuH4(?UHph9T$ME}vtz^`W zVr<6WVx@p>TXAWlmu0S{DLRo8!c z+_F^u<>5;`T_>(GOUY@C2TNDeRKq}JS&wz3SAMuGJrtGT=E!!>A znswp_dCfzfVMShJ!{IyE=Vp~oO}Q=SR5cm zzMQ?YlTydKV^NNqNpUY--K^0>(pn^Cg0TdtB`$PeR4K(U>x^`CCvnfk%c$LC180nj z7NjlMt9B{wy|22Q58n4t5wGWroF`%x9iG{Z>B@uSyVjK>flZOoXFBf0o{h-X7AED9 zsEG#0MTtjmU#;}lZ8`&^(2t?`nS?wd9z*jNK~QIq-e)*E!TF4!?8BXv-wn!@HAQ!< z%bu|v$t+ee7i_G@r^}5GT8<`8Cc$vx{U#R{fiYN44pYCVc*u>qd-UEzKwKMhAefUQ zy9rTvzaK}!(`YQoi=2EoyYbG-mQqk?qGH-f&}NpU^Xf=B-W!GpwQp{Os=LDK<#Z?2 zbOIGPH2_&1wF1R%i#ns&ySxU9BA=uEz3y3vPLYqx`9V*haip)WqVtOr?1@(*G}smj ze8hA=B5f$P&AW$^Xcot5E9c|+#IJ`2)j5=&tyxY=SInqa&;Sy4y)njG4DLbx7xHy} z9k1f^UF&hf{r@Vq{~j*)v`K$?SlKMMni|t_3v?sAgAr0O*LJ`3ijvtVhZ^^IY(?N@ zgFqEMjj9gjdFt%U0On8rRK&J?^tVpxNNd2Cqn$}bi7+~ltAsTzCxQnt*{v<4E! zA0lNH)lLf9{4s{tP)q{k5tW{WuHMOM%IbZ?5FF5WVvyirbw7JuAs(8p1VUVem1s9=y1tPnDY<&99)%lqX zH|H!wBuyM&K%NInhds#B&LW-yGDAQMsLrM*H8I(ptWUNCv(%y4nWq-YbR)gclej=| z^A|~YNFE6nVU}ki^c@;o-ndAs$%0t2%!=%qS5gjuEi^x#b1OKv*~j2GUKoxk zggjoW48;6KrLn=QDg8*tmu>+4(22!ayk)VTq9^O*AKCI|j2hST_Oc-Y3U)WQ=R4KQ znYeQHCiucAT6X%CpQpGX*m1CQ=_2%m*tne$7%siCryLO7)CYkiYNac5DM~i0di0EO zuQP@Xs8M)ceg3fQ6=foe@_dR8!Mb_e|GV<|-=3UnuYdXvU4l&Y82wn4Q9lsAIBxa% zk8j@b(W;lfJwuA{^UwdVU!lqq6v(R%4SxOE=-*CCnX##YeG+)eo!l0L-q=CME8mHR z>A+x|wMNkYoTgS-!knd(N~RwXg_ywla9axBvZ2mH(14rDV8-#RR{zXD8YZYM8g&gF zl5tXR0SZ9~5Dr@^Hgt`YxG77F#e6K?@a$b2xuT-FF?08C;r;zl%&(DX9BJ$D}tBs^a$)7>7nMWSQw4* zSw<`)f1DGV{rn6oR{t3V$&Qt5QxghE*f`@0fQKp0)q^+%BRBtE4M(|C{JFBAazmf;a$xX ztvsQ>@$DtFHmhH773)jR0Irn{fg|aUjojIcf7zhN zq+Im1Z&sJF%bOh=oJ{i*K4t_Y*NFo@Jp@@g!jZ52bL0qk4mu%tVw(potCX&z3hZ*t zFH6?T@q(t&Fy__0gq+dzun%6> zpRWgPvW-b~mpVLXvm|-$Uzl$bcpa}0h47V|=IN@GBvGvmjNILYTmK#||MIv+;rzRM zfP+59PYC|#A`nIdL=iE$UfCqyH*ekZ9>Y?mYFYqs_gLRE8)4L^pTVNnKAyAVMT5po z&q+S6X5ubT&i9s$^;loguadxB?RyzuT}P<2xz-`hN9%`BsOE4u*vi7L)mCIH+HjEK z)7ycNq2rf}!T->M?%v3Tqc)JAUkopw4sX(|?w*9d4Imm9Ipb+#AR9XimE7?bSvy0;aUU}hZDAK7OieDPdD1_o zd z@`LE|)hA7)7@xtIPv%>@r#9vCc^0=2)hx`&543XJ>{o|TzzuRgLuN|9@BY_nY>{hZ2p zo^^B}KN+MM7X8Z|G0%H*sxCYYvv$_v>g^@ykBddmurVbIC4i%~hq zWYU7oP+PKw7u74}sgH;eIa-g<)3^$WiAR0I&R4wIQQ#oWwR>qW+zL+rWR~o%WjIiZ zi!&sW&wqHR;D?9)<-tV}Q;wKxB>KpP@NLeB-^1DTW5YQACd3sY2LDYiZqZ(EcPnZ# z^3z(F2ym|?&hvfiVN6hCb_Vz|;`}_zfC=nMaeIGhEQ{tbIHl%_WrnQgZ6hjeR8)Gi zFnLgsrEXJfWRjWAyNtFNQ|!Uo_*ERlP#R)qYL%EA3prenADb}wcJ-H*> z)l?IS+>6s{TM&_S-PH%H+G1Pc1wUyfdjGr(F`L2fdUJ>0B@UH?H_*|8e5L96k%>_*JH^8(icgUyrT- zzLMDaCOz%cxt;%^jg6ZL3; za-B-&kb9DivlV^b2v+4l)pX_kG(^SPN6aDS7bQbk7GPT#-4e;OeP{*>yL=h9c}jzd%TWxpY5^njkliI^ViPlszS4DG|HIabba|(39zfL)El#Xt9thDN>f& z`}S6(+$LA|-UQW0E-? z=ZKcd=3@pM#bI8tApFyE&rWRx2`IGxk03FOl(oM+kp6A9S4pZT{=0h^bag7|tp2%i zHbD3mVgE@XcD3w!`|RhJ{fite)CCJ%7-mZODau*reW1IFN7iV=xQT0pVsph99-T=b zr?`Tcj=#;qYY|FTzOnjL*dxJXUZ0k6Jy8zc`trH5_X>V{9h1sfFA-ae@>#udcMHcj z8T5`BPFB*me5S{$;iVS_u`o?pf(kUP+X_18C8+G~sUe9+RgF0uBvdB``zVYVS61V6 zNeE4q^42@w0ZAHJ`ITIo%9ZB$g0Kw|1o_&KPydmUP!7yo!k6Is4h3{5CsmxHf9IMe zhtP>}eQ3NJDWz8Fjw~)YLRgFCmRDjWK7*b#)0q)V+Y?O7{TkT2++z<7Tf1U=q9JBF zU@$29M~SA{pY#5>cn&!frzGyq_r9%Od1rT4#?S(^N#qMi)Z(%)Hh@ihIP>D8`P%$5 z^i>=DOZ+zu+_xmT|L;f$4dU6_1^LeFHZY+Vr-aSg=Ghu$I*G#>`5|cIM`|&QnaHWM zfj{a%OnOD70^>FMsU34p0m0Fpk}Uf~{e`jYrBxxb;k`m=n~lLrwHb3=z>usUUV-st zi}uhLMAxI&=>?Q{9zJZtQhx%4Y&U)s^SEv?fj%wo;ZJsuOdk>Dqy_S8ZmNBSkc#vk z-<`!+e!yI*riHYMEKA9wLgy*7uHENtDy_~>W;J52MnfHdG|IQS&<+J%VVSNB{pErD zzgdizl$yUhv~vp#&EjX1eY6k(6W?moZtosGuP(MU$@xY*pkE)5ATGyHwl>XFbt$id z_%58W5jm#=FH?s3UB5T^EHjzLje~ZKM-v{fI^T@<758^``+njqn6jP@gXQX5E@faQ zK0%y%3(`~KR91UsQR0x)g;H(2pm6sbtVA=uAmVEHX}em^(rfM9@o_?5DqG=)ErBgl zs?laz?9W~J;cn9-?7PqAKxD{BqIr)+7$(~=6m>|keR5o~kFp>@L(v-q&2h8kV#)nM z?kT~lk+V#F4zw`0i=`jzPC`D%V+h1N*u+0k?2_LPc6*W#XYqiCLugt4Wx{mcWXfh% zQ)l?(tzgXhXAy14#fap6lFP+p%Y2o$-Cfs2c4%O9K3{Kng&$tqdY+u-Z1=>ZQe3e_ z{LJZ+jNG{1)nW--$tYxe?TyTq!#k%>@^k)3?2~Ck?~3laq}%{G>}x<8G?W)GmSJNO{hm+A=A(Z;35T>Dk>il2d(d@z%=CWFjXT z?(8<*AYf!yXfU+B;=7MthX-EVqiHRAV9iT~97{d!ijBD6U`c4@TbqprZ7yUP(C2}5B{Nk6_G8+13s~l5}<@=yoz@G10;UWj&m>@xY z0`|Pvz>dE864w}3$bWdK5Y>VICU>@QGuxA*@AoGR?g?(q7BY+X#oz z2V{cW&vf0jkV++ums$iV?kwDnG&vH62#>w4!}6h$ECH(zUo{wd2n$PQWu(jAk_1t| zOLkj!Pgxry%WQat^$qTG@3+aMa3JW@8}g*O0vR@d*Lco=oAt(Ztpj3|BP0>OD5PRZ zlvSGD?V@{@=bJ5i+Mr?vMelIszCgV;Ul^&JBFj^mU{R863el3nCq@VSohi2>osi`j z&S#!7CRK$IE>dsxT#8*Ul-=**SVThmBZ75PSqCcDOqD<%?x0D$H^EC`nxA{cyNkUb zVgpCQQlOzm;%c>cipf{oZO0;MUmUqK7D0}&1i&62@{8hfoN!Nr2cP?r%ZXzsJh$raXU`85LmmB( z`KLytJd}bdK4tYE!EI=(!d3o@<-8G#xY4+mQ%hHaAp%m2 zB8{XQ8R>NT*7o;BZbd9YH}`$^K4$0mzsu5;6yXyTko3eqskQ>_MBqwaj{9 zP31c!KlG>CKGj;Hv{kW_R|=RtfR=T&DTj3i$=v-H8*U7QEV7hq^kP>MWm`YO^lK1n zl`x;hrU(6v9S)QuO{GKL_jiTEj6Dkbb7G4KuV5#U5|K8VE1xji1Nagz$?2v@;6BjR z!)Tmfxgfas+VJ(ck1RyWJXSt5K%m!c(BDWS(yIrN84v3zw#s14wvhxAp&d|>8Iv(n z0h_cFzXg-tIX*Fn8yFqtxkJ;=Vx$5DfBy*pN zmAJ#WVJ|Q0jBdkZu{1$KhtZNisycc^S;UgyRC|5`g77C?D-RqKh~nA9W39hXd@nE= z%|F3c`x3-?`sdehr;LJh{T@+j&n+NCw0a-F(_|Bhv=BQNN5|k0Ul+u^Au-ils&z_F zYli8%f3CPk6`)6AR0rOU*1c`$WG}y;scg4=&7#OV%gW5maie6_B z0qQ7+5O%!jr`UHJf}?_o`y$5?(&FhU1F9dw5ADMd{8(0-J&g`j?Tj(XGM9(e(?2ZGj9cg457Gk(%GR73wp6PJ0_;0iHNq?2T*s~ z2RWXRRK7OBggXqSR@bR4V~-9lK{l! z96-@}dAvqm9do7uiaZ(bdkVKRNh@awX0= zAG_{z^<&ih4sQ>Tm+Rb7tl217V$=xI&MUw4^B85d;x~@CQ%On(IyvX`DSFeM5bscs zRY`wexuLE@pu4dK{z)tBSy;V;E+z7Q<{Zs#(*%NCS+p&(c%1gQo&S#e^Ku2$N7)<4 z#c!{z5xIS**Bq3E`@}%UcqxyQ?=wlvu$sCd*F&nmWeE$LLSXlsy#wbMH}x}>?;_uk z^75(R5>F~#Vbvic$-vxO1Ms44w(?lg(uD=z5LC^*B8RiA1AVTp@)~}BbkQ;D*{XLM z<1VHOF-*c9B_vb~n@ECFYcf+{q(R#15Se;9^E6UpGzCUj$Rl_~Gt8i>3AP*%s4cAbt!K6CGXu>H|5jSv&>tgy*u>Yk_H6Cu+x`u6MO8z~#^PRCy$2Vae1B+fe4 ziLW$aO;{|lCR7L4v_l_Dbb73vJp!2LA0GcqJ)c7TKa3-Lfrkp?N5l*3;Uav%7Q`<# z23uDRG?H^MWPn7U-jNe7FVZu1Dy$w01rgOB$648C9n8{`P7&ltmjY^MgSW!Fp;HjTUg zrnzqWCBeAyS%mUO0a|bd7lllz%jLKfG3R>y+a~|`=9ji*=}z=|_(aujPskg8|G4kM z1$8O@Dc&c@$#{c$*7#Nq-cX_OqAoL3&GMHB&q`dgW@gPzVzQoIs4zN-j(I0qMeNB) z%K|CH*O||bL(^9`XT>}`s$F(zVmX{-j`Nk-IvZ}iB>VnQu6MdHDhB3y|4l=#_8xGB z@RJN_<`hT8 zfl0>khUoa-Uri}^>_&DBaX(qPp)`p=jD_8LX|xIU7I@HrYD>gJ8Xq5r6)qkGb_xTX z1V;sd2DCtcDn5KGf(QWFX7zPI^929^00Mxtt&x#|qq(h(pv@oK1qNfFqZ7TejRVlY z$c(`dNTO+OZ4Gp=Hn6eT@l8-NaC9`VHn1TwG;jnO6IlY?i5$&MZOm;3;2viGCG5@tglgNZF$avn4~N^wzaK zu1^AXXN^LN#h!5Y9%^{t37`DgSX18Wq@KOJbVetmiVH+fymBj@j1>Nufu6MkwmQ!& z=Jlb7k1{u|`Qm`zIh~HzE$lMyow1tt_IJa+3x@HxV&16Yxx~txG*GgAOynoKuhMAA z?c?**wI_<1y1g0DM#WN2I=~`O^L!NGk6lTqawkmiJDz+TcVY;QGMgqu7F$+nBnRV z|E;-tIm6K0CuceA*1ijUOeOl66J8pkvG8<^RfBpmO`WNEQafKJ zHM|Iw_WW&8kh_=Kw(mW;$(nbW9X~Eiv+}+(yJzX3 zsB@H|j1?zW|5S1d1Izr&vL6xxRPi#;{*OE~Vv@=pMl$vM>+t~X0oK(q@+xb9cl_d< zfn|RLvid_9%(&Mv!)8S&M)f%nR4e2c3e%Lj0(}Y;#_Z>HTV*V#!C};aHc<5%wRlS z&OIhEEK(puDLeqQ)eZXn)09O`@F~ioVL!~8{mk0a>Gc~lQLlicj!8+l`;i#GkLFk#<{zsE3noz z%GA>aw>!{VT5F#Sa}gPA$FK3jJB?VKoAm z6LlGs4F0HBjv+N-8XC8_*23JA#Dcyw2^AR>@G-&e3l|x)4%7L>n_>>NF~Vr+_I4sg zd^sru^(9U~m$j#SxHG*d{B#@HWM7_8pk03DrTl3#5;m6z;~X~FVu)9p=!HsYh)q2h zFH~L~u|{Xj6c?z9i*7^Y)5i(H;8qw8e>ZAr={R3Ns(d<|!J8kV31EYcEu`@EzA2ga zPk8>xH-EzOiuSLW>HmbMbQK<8c%w&7{(QR*a_R~m$YXl=MQl#T2Ux2E)^tXT_DW34 zJ?DZ*FI+AflRLJaT21%fAhRp=8iDlVn! z%fwli4qb(q#f{M|#W7UsBmIGn0kxyxu6#X=+?jdyz_`@XLKqZ_$;g&ND$JqvvD|>* z)ss*jqxOr)<(rAOYA|DNY{%EobWe~Vn08gx2)D=@DWv$X{Z`+FJr^L^cQ=Q-Kxi?= zBScuke1TGiGXX1Zj{NX9q!Cr)2o6Nu?6$uXzu(bT`GQL?Y~+ZQO?(-fYeAx*@hwd1 z&dpcvgtnfsqx>{!-LdA|rWbI%7b6=G&I@LebF~h0A7|$ zg=E}r2UwU@umfbMoIGap9v0Ce=OtRMpK^QN|B zca))MX5D9}#O^&4Sfh*#)hZe>iN=@8(H^Vm05^(T$vVzpuEHe$t@Ie7nM|bJ#$~~H z-a$5o!5KMG1l1tzw$H4xHVnF}=A_m0mm`f@83Wf3sAEhww)lv{ApON-u@+r!RluUKVI{riVil#nX6gnq#q(BHd_ zBkM`d#AND>B9?uTO7j-HquCthw78N7;vO3 zttlGsM_)5sdwTZl6=C4gyHmgGZl7v928(O{ASLR1S`iSr>WVHx^l+DGU9!{O!Tqnj7wFwwtvdB!;ray7jKbBv|KOZ(KZ2Y zTAob7`prbsge~cPWGx`kO7fL$Q)8>W)Xq`u=a3fYWutRgSQ5r7%`e2*9-QorIB~Ub z1AD)PD5cZ3UnGYeQ5Z(Mg3`0!$3&;G3D7;e6U#wqLy7>0$6L#qd3IVxN0RJO^HiWC z3E%y_wSi0t99~q9VyJz@JFag(^3qJ0rs1;8`PRYw7ML8ka8PYHcW7ngK`o|}srlXZ zQc-r8aghApNa`*@PsU>Vt>1^;rb$Ru&=DZDc409ocWPhY)`?E(X=5SB8;^PlH#FNS zD(~b`+}g@9Yr5*61LeCs^zaG)VflyK_80BOd>W4x5%G_DUOcM9 zBpN71ijNq)Pq^4AQ_6V8MNx+^vy%J(VFpdD(8B?Chv(Thvx!#)@53lOnQt1rJ}L%Y zf6&XIQ-t3ZOMnc`@S9RH#P%JaXzxbkCfvBR7tNV@B8N6B53Rm2p=H7eU@KrN;KdaA zUeL7uuAu(FG14FWy`;=2oL;jn!PV%=xuu8{cYsUX6w|u4<%ZXcafrAd=!fADL{jxC z;sACi3wM5L-Q; z^;i(ddIe}|lE!wvPC{-li&xiiTt;s6pDkei)!Nk5eC~Kx%EaXn_R2I*QeXNM%m8(e?1nHc?FVj{X z=K{m~yRH#x`&zdEM~|P{PItELp4TKKGWpvW#B47Z7nCB&JztKEK{ZJKAuMVO*D=M< zco|&14N}yo|$fJSPH#5nu4@e}7ZpnDNioukwn`H;B8^y+FXY=papU#s&Y% z!N~`aW5%K%4|Dlj3MpEP5HDhj3p89yV+|%rzcnGFc89@NGHI-0>>Q_jTx@k~HA7^8 zI1#&s6|`Ql^!uJ*M=!BZ{>tHd%SRrcC~0!XF)3HfE@GtlD=GQqc-t>oYtIjsl)a^5 zVAq%^l~saBw{l;Jie|sWNPX`JZJk!xy4XpYIL`|2r7w=PAhFBcxt^CS(<(M#6;XW% znI=hccq|Dz0zMyw!7(_v#(-Oml1g~Q8*Xktqt0`6wc9t7zfm@xp(i=NOrXUDd{z&az(hQZT2KBi z={hQgcBTr~SYc?(zlP^oU}7>!984RP&5FZ!I-gYzunUTFrHLp5OPF$a(m-ebWFien zB=@UF5L6et|KhsoNcj;8+0gsgp=qWfJR57|VWY+o$|IZWA5(k~CX%U|fBh4mz)W5( zrj!1FulGKSNX4#lIbTfs=CnIpX;)cRqtrs|?#|eL(nH5H1qGw`)la68y_w(+37kw# zg|8$MBx5Z-n|qJ=mc2gO*|w@F>98Z#`S;LCdSN8&{@WKV(Gr)ny2?9V{#erJUOis*B!q435@T1z3CrM~*|`(Z zAH=MhoF;t6=n6+Q*<;80TgJeK^QTCN(rh@ykV!PRQY5NohL#YwCmxl33cxlY#`tV` zas#VjA}Vl3qO~P)FGkL%?LO|^0Z}C)R@J8&%zYlN8zaFYoql~>2}J2Nuy~nm(8Ti; z>GuVpMKDKWFw8Zw96B^|#!8%frwg2Z&Gq^&lxL_ADC|0mbNrg|7QV1GtM5ULBWn}T zXyL*q>jTpXGs7p7dV)2CBPu;p?Ma(su)0{rr~2&uTE+$@Vl)jsYju4z^-Cv}pW&~= zm=}Z4%Z~$|N;tQlfi60){BUdGyH_4rjJnZN{>K%vJ5Zlwy)N2XVdoOxW4(`BQF-Fw zjnqMg0oVH9Zlt4$yArRl77iDkubnxmO>z;u{ffOPU?yyR#-f*}VSCbi?}5jA&x?Rn zIl0>St9Vn#0!i{C4;&FPEGwG56Hn-`q*|-;rqbP78<^2v#i1OXT4KL4a#G&vCnpJu z!>2Ut-#rC3tc&V;85k3|4jvD2T_4Ldo*83$_nn+tLJbzw)m+=?rjw>ywo%L6H`wgH z*Uhorp=WP^@da+bmEI2(yN~ZRFjXOs)I}{ADxbJO3!&ermy!%}oV^~c`|0hrj_@6; zHP~n!9&w&{$8{KS9F!tgdA0G}I-Dn>W6w<0XV=_kN0jLq;J(on;`Z|bg_gqg!(I^M zynKv#EL8~K8*VNS5knRj@7P?fFn@fP(TmYOcVRihFaNH=zvCI@o;N;I$YG?*FA4vv zmY{xQt=-LVql|Z9n*7s4f;Q@J|6dT`U;e*H|5$**|7`*Ghr9ncePN5kd?RH|~gf_IUW zzfb&YxW{y5@tMFu1c$6hiYZ0w%CVN#`EoL%;hbXTNV7@6I3?e508Gu2^`~f7O`p!x z>8Gr{w^y{^CX)oxwj1{ z7+`6j2;hqHnpq&ofRk1O*J(vk%d6kAUoztv3rR4}2eI4TODMr?OP?nOkN5$-=*f$> zxn4?!;=3#u2F|(PiaALn=T8g?h0xg9g$Nra2nV`{Ruo%Bd~@y5$BQp$c$oMh*OUjO z@I26l3UBcyK^6JISISI$hr~~9*DBV;IwZeE*`skOmUl#5*sH*jTe00}!w03a*sNXE zh0bsfSGqlyn1kzer;L|``7{fkiSpr=J`^C;;7w-e=%-RpzH`YlC6H#BFDRzQwnes; zPLz)vR{n4X&Cj{3yw}#!NEp~I=}f8tB9{&*E6Ijh3HERORw)_U>PaISdgx8S1w*GmrSW z8*WcV!0SBNetw0>uT0iS#vH;BLhUT>1CvKZ$;}aavHN6vuioL2dkKAi>4XLkOd1+M zmLzXcx{3bz&Qar$K&e3*`W}^U3{Pw7rgq=H?i}si)>eqIJc_%M9Lr6!Z%QbR3z8K5 zmi1;FtW9&O-Q!_==D^{Mud;}eSre~Xw|Eo(yzzz`52)&Lwt0$+k^XrI7kF< z3msu@z(#M%txAVAOl_0!nK&PuEd@@%MJCF1evv0)F6BM4}arD&MEji5k=7+nS7 z+BoY*zx}rhFqg1{vyCm0gn_xC6_AKZ&JJipq-5*tU<4!*1-byOZ0)RpHcr$;yoP_S z6Ew0iceMN8hqpn1{t?t)rhRbY?El%cPfk)Qk>MLgFQ+~-Ad!;65KJT@kD@IAgm@!U zyYa2X0}N8$M{bGxN^qr`J0J0)X+ld)cBhr8i|jJkc(TC8YjP=?deITu@|~5CvD7`xKq);2s=Q+8sFEkk+1YYW=lwnzP=+IdFOS43LF@de^g0d0`-mRnZdRP~ zji{Pc6fdwOdO*&Ec%Zf_xGZ_~aMW{B+yz{bb}s9xT7=ncaodG$z{mUBr3`d8HAyJP zWPAR1pkY)o*#q~6J&{B!xI;A@5q;-vZaJL#JCpPhtK_W6$?v&M&y5;im=|#P!|yi- zIYf}sU+1&Ne3Z8%Qw``GJ9;y*Y8gn_*K<_z-a@{yg8&1-H+-MEjl#*0C zu5`wK!z}xz1H7$i)?jnx}jYQ`6iLVB_ zX4y!BU?z;m2+8{tyN;<9OwJcKzA61;_f|wuaOD5CmR6M4`fKLz5RMG+N~3mW%LkB& zK(^DAmt^r)XExYKfm;lZK&NF5$bdq^x+tU(`g(j8VI$klH=Cg7{Pt&*z`u|-D_L=T zMIM}T!qkNd&Q5pgcd+cPC^q0`B$IMs>_3bLo`i(k;YyOIoJMo+ZqqmSE_yqF0i_5* zv8s-;sedj%O}xkf()8rj{|(Yxgw&e2SxRL7vhHV)MEin5xi*Fdiizyi81!9?rE1>T zt*}mL3hl#Y$d{Mcj0Igx>u0Zi${&_f-`P@9!~$^0)R$B)pXdXZa3)ABW#z>#c3Pkv z*1ZD5$>(@=t9u!Ca;{-I)vlI`NaE{38IEb>VWn%$*d3v!o~J$cVYbuoJM_LV62lY} zfO_8#SoH7yXGN)pvIy zTP3=TVOLPFWcM&U!aHPcfL9C9=xfEBRa_n!Ood5udrGUxzYFkzgK_RYTE|Y$W7Imc zf?=twPPD+PE8WLK?uHV;S>R*`Uclo7X zm74t`glfkgO4qAiCr0*nU5fPH%7kF#J(#YD{j#d?^y;#riM%xNV~`DPwd&cKi^Ks; znwdVVx}vH@Ea?cX2_Y9UQKoPX?oZjOZ&f`2y()=cj6?;&4nv>%%zu{>pydCQ5`TjU z9^x-B{V65>;g7B`GN5Zof%gP5)v--Md)Ja1yPvJFu60$>?~45Jj3qfRp~?aL#8b2JDA97wt|n82Ft37KaezGFiOh&t5)9pe{m))C^J zNB!f^J5?q~$%9uC0?ngapMFpZNxgMtqa^umQy2p=^VKwvOi~n!S1&3TpGuxifp5Ru ze)>aM&af#s_2sEzgo9XlilVUwX8qumBZy_KMfsa%4*X{_2>!U0NHx09f4xXc{X z-ySs-0fQ6y4Sh~!7;SECNr(Bm6xX!Hi?bR3HWCH>Z&$$ukD{pJz=4o6}FOP zbeh_#YE0{8zF>qjbtNksODfRTDK7$Y z=i*B!hI=B*F-_1^t13_(Gzxp#OA`?Ueex}w=}YG7API2iou1?0R=_2*ake=SqSxCX zPhW;J%65rJ3IH_vwyVJg434FC(FA61oe@f=RBVxl=$@%dd>(WZu`<;Vy9&#MR@1)n z_7PX*35}h$gq|kKeZz;_Cmyx-tTFzf*(d|hn<+9kahf=7zPDAI!p$y|M@h%+mwv$O z-sYU8hZl#<+;CfvSw=IY78(X9Pho;SVaan=wp4TjA?jdXO#|^MBdI#3`&-ab&Hf+0 z4-D5D2KZF2IGZwGRBKqZU=3*zv>@{){jYVvc#f*{S#IH>N|49bk-QpXVFcl}5-oZ1 zwsY-CDi(qd;`rS*VB{WFB4guY>2jjkyV?>jp{uajzTB!m`VBsnm^e@lF@?81Y#wmR zU7yiWWnuGexgjj>>Ues2?yS>BrrUDSD~V# zFIv@s#*^G3A2%id*3Vv_pKB%zlLJWT&wS;na~OW5{7{5h=kcisRxU_ir7MtX3wGAB z;(8=3%FyUrZ2!9yVpMVhni$yF63G}iIT<*Z+n5vaI{tl%!Rnt=f~J33w+u$M*8E|h zTz}aXlR$v}(b0dJko1Q=`p=LcHiFKMJ^@Idj%nBgsem8eheelAn4_+i_5IdodH!_c zh0e^{PmmF58YxMB8r_ISVbwbiNk#x_{@{EoQ)f2JjU-#!*8(4FOle#EO`SHO8^C-h z7KvP*$r@6qd;mquiayW!R6z-U_60I^yW4SDfi$P5lwq}XO|oJXnNRoHx@U#-Q5+lY zgHHN5BPLJQvT)+#3tK#kP4on9vv*Qq<~Q}ve36F9-gqf_x)cWilTI<1LA(9RE7Z5s zAT`as64ldirom1acd`rBJGG(i&|`V2S4CSIP&?1X0l3fTv^Nuy-qd}h7!1eO*aeO@ z!M)y^P-p*km9CMolf7}+5$AbIq$E_g6wsfi$qyl)?G3;nBy5B;VsA!#%m`%;UbXI& z!+L`(lKn5ZnIteniQbNUqn={K(FReze$-ncXBM8GYWs>h>SN^SuU|sL`{YJa8V^NppKSsB1|W;nm7F< z%?p-Ah5(`IlOVgU3Yij6n3eZH0J>i1q^3S|3q=HB7Ju0G^$zkVTXrMR=;qMV?+0uM z4ln!~4UTPWbIZJ6uL5@Rc1))m-{rT}|lo*n=3L zMAd#vF`*5O<_UMQLQy;^_&9|OrmPUeZC_yoM`cr=(?4!rt^{t zn!z@gu`5HHSX5>Ms$~^wz48DxcLh;$+$FUi)$*-fNR_+JG;LU3_6f&^xf-+YC*5Qe zowoO>%$;`wYjFfnztirrt0?E%OPgxHBezBgXjHW<`DYQn%uj*okplVF>z>Nc6dD_k zp%h>D7K@o$AdRz#IW0VnXX~Bv5F+bbt7P(~`mdgQ#+ORx*S)sL_(g6yKZq`<9@@W) z*VBe7-vv?&7H7W5+nWhQpm^<&s+#{QvK(7oh<{YUf=| z@gK|#V=UzePkAOs%#>Z%qV9SBs#*SP{L$Yi`D^^qKg7_~M+W>%{dBEmdPBkx&yk6z zQH^ufO~n^5$!?7Ps=Gg6l5vQXpjFa=*E#Q0v8z9 zGD|Zi`L6tKsz_CU$m*Z);=NXmK7P2s3{xabU8KgiMuXV0w=Dul1hWg^u z??pF_&QB`Jh}RSx1m^1HLN0jrqE^3xeF5UuS(cUE36)F9q8p6nkA%}-yRbykp))spQ9M3cYDs&gGEmBzXU4^SO; zoA90o4^#4W)+;<)S^9${@_e|msi^+yOs-pE=xgx*0iKbJ_w#v&wgi5{JS`XLO>KZ~j21Qv~6It0Ol+ z8L#BQ8UG$;w#w)z6(4&^qJI;w;Icq*TgK1TcD<1u-JHLL2`isQ5S3_NAcNs~Nkb&P zOZs`n#_K2~cmWq)HdWy%%(evSzI2$b@=hhal%VRCN?N3SwvU$l2m!G$nmsLfDNkWc z&zrmO)i-Ef7<1{~NVG;Dq6g{=;|;yW7_Ufn^3O6vK9FruA>X~yVjLH5hoKPrOi%MRh{fD z9y44Xv|GT#S2a(Rt|5d;{EHhiv1UZ%Aa28%Cz-(&+I~riw`u1z^_xn!IG1fR^sxg- zF$!DNNfOEFoMZwVOQ;`;*EVN|5&;3XCgHZ~LQDifel>9O35=YQBA_a)=g0};3 z$J>ddg6BlC3^N~_F~Zi9gDl-wk#y#+qOyO38-y1e>(5vI|3PN(5P!++-{m9>4)v+c z=wo4kE_55RDJ)y@X5^i)=3dk_e0lpqCcb5u&Q%Cl(n0i|r~Jg6BKJFzBJoPbDq!-? z(U_ymNL*_PKU`mG?YZs=xh$Z(%0|nLK!5{N`14iU&4&T8b zV2JuAPF@yCX~cgI8G>xX$HpvWf)-L*po~SRBOv1n-?{nj(WjZ6ESJ0NsW%C2yi>$t zdgXU;0Nirxyo%X{oSQO7m65up&vyv^XMg&Igfts(eqB+9veueMo6gA>(Xv~HF`+(7 z<@k<+a(E>;2yH@e8dCdK-RK@H=p*QWu>t)CsDwhu{v26lk*1GJ#k7JGxSGd5RMVcu zPX~bpqz4fJi@w7@Z0PdD+&8KP04oU5K8nOemELf9w)i|nNfaMfQh4NgX($Oc%kE6? z4ciX*2f+KvFVGNgfrWH(2WYQBIHzq@=c9G!mo^BAmzcQXv&NbfDQXXPirfj%O)K#L zJfZoPuw2z-FUjr()2;-{FoA#=p&ylZ$6*dr9J2jEQ{@7VQ9*fhXuFxE3bYB=r`}yX z_x>uJdpX?Jbfm^wm_n~|H(rVqcL6efa=vzFrzh=!JHoWYv#ge*G5kkEwQZN0s38yR zs^D%-^i1Du8g4X0Y;oD#HNBBzPP2s<`Yo64%L&5XS`?O;Fa5Tq{d556w+p>FbIQc6 ze^U)t%GS(=NYoZc#A{(|W+Mo6GqAR^0{-1`{WqjJr}iC}d&omRQGPOQ33-kOWr;6C zfc{y^zmc}h>ieIN_RlR;5zv5C4?6@GGiBoR#tq>JloOwoK#FQdrV58vQuBG5n8d8O zDO?~AOS9PBbnchMLBk!8^;U%7*@B9QA?w@FH{Zm?<;Y$wVz7)=mr7;m)b3X+>L`Q` zX ze07yW3t%TfVt?e{yORC!2WkJ(VB!AzUMS{gu1fB^ep+aQxi+GUp6FsZ@H&7FbYo@h z%-ITk`O#NQ3tO=HT!Mmi>>By8xTIT6C&I_0O6JEt*s3QnxuKLqkDcC+JQJjsT|X_+^S58PfR$|piii%9=tH<`lZk<+;Y)H}grmMDCZJEMvkRS_tH z9=Es)v?BI4nF)W6Jx^<><`M?}e!gIt2gYGc@ zPm90;EV47g- z(mWt!qyc1F`Ac7a)08uF+d7<$ed5BHbdaeUYEd^s1>Ls3%1E=y}NqaR?z+!B(WShebF2dM{->5my8Wv_gkv>u{Lx)=`#6+!u$J*0Hh|B z;EYXXq88tsf859f{Z0kjbrKQ?$*xlRl%Rrd^$1^;3mVzK$thP$-N&COtc3uT5lIHj zl-c%f1xpU8j8GhCkwVMoinDx}Lw35%^gu3J(FGzluXaSscKfaLn^Zz$j9u4xDrBic z#hSP+1zhV&=7%}7KjP(#eOb7#2M*{WOrpUp_H=J zD@50H@04whc{2tDJphb+wCj?_5q^p zz3%ZedM714_4-zk8;WM#;)%mWzMaJYCX@>NsndW7Jl)HJ991BpzAH)Nv`qg7P`O5rAHdzz1(iVeF`2ip z-^fIBixEoI?xDlc4d7%8X_t;cn7@RMNd5?XOuFfjdI6;qC<0lXp+aUku_P=+=iI@_ z!q9Js->-UXcNuEUXS6ZVJF9YCtnuhN_Vi`?;?58 zK(9C^q#C^6c(o5mWbs}-)#IZsCRx<52x=SCYo5siv)dBrpSma@Ht*>AlOc6r4HiJ4 z0Ua0v%XhHfciPR&id{i-TYS4O>n?giI|OZfyG)+SC`Jdznq+`dff6A0lSEhA&B_Km zeG-I8EJfpkP!j09#N=AFEF>eQqng5Y}IFR_trw_Uc9I{4@zNs^#SGQ#A<| znxkb&JleYzp-Edr#bcBBqg_tdeUWSWH;%{tg7=9?FKf`;@+ZC62c>M(nOc&{Zs}t_ zn7`;qf@w81Y{Yu$GWu!Q}x7Hw)LsilcWG)_-S6 zR#5|UOLHO>pp7jNm9?#hxs{axkt5K^*#SuOr!_}S#B1yfw6PU*02-SaIQ`wJ1Nr{f zW`GNW7@SHHw>@^9YT@3jp0l_F^*AiYtO^43&l3O1od01P@Xy8EuuvZiwD07HG^ix( z5Pals7^)lG#@S@VpFPnT13z})!UO=;6zP>jS5{}^zXj9a2{Qr%VIItB)W0TgWIx~3 zL<{kyDaoYy!lK8RJ8_azGl6yp7TO!0?Y=bd*=0W`T{?ZG4zZ=GGvhkbzRF4%{uC~G zU?(v+F0Pu3(4uhjmQ6x9A+;5e)k%9k-u76&?&S45{BTdTSVfcWEKw=Y!@naMYF77H z!VwmlaiKa_v{wO^Gqk&}2>2c#no06qhisxXD=CoLg_FyiGlOL=W8GM6hXSkY(7Fqe z6s8~|-@+ovEoY4{AB=LjPr{9BG*WTioPLHV&xlmiX=wHm8Vkbzf!x1Txx*`M)ynmI zaX($Jf#s$P5J3>wrR}oQw4eJZFzmf*GUPYiT{WE0+_A58u!eprF`PP;RUks#AJ^pC zP&3oV@3e$pgM;~lV=9Pg@X36uvnLwNEUygKJ!TutU<`d6%+})3+fj}OUvFW7DhCNM z9~!L~@JZXOq4XT0U;_ay;RLHNN6WF#;Q2Gug0ieP%qd0RcUl5bMUwPO$`?FzJiL zS=Ohou|Ch!{&1f*4bXmckVnCt8(&>biS?`-@W?4}7D!W>`V^nANdE;nj=#16ME`@p z{%Y&|BP5u2s840dsutJyGcch*%knTlrdym$q8Q6GM zM9XT_m}YHMI-Q~KWqcMo5+CJPE&8^ZOjQj+tV<)WlP`&`5S~zQxWVWeC|VoX&sg1* zt(;E9m+u0QW`!=Ytm3Ry@32Xgl*r<3t~nef8Pu6**Bb1~ox4XDgnj7$eKv--755E0@g7<^{ZVH3`7zAk_f+5=+G@g$NUL>o~_dO|L{9A48oM3_VLVY0hqGb`8#5*!w|yiK{Bh@q{`AhVGj=58L~#I5Qf${-5oTz8f@n LgW^y2I9&e=>2^@# literal 0 HcmV?d00001 diff --git a/sources b/sources index 52f21ca..2098ebb 100644 --- a/sources +++ b/sources @@ -1,3 +1,2 @@ SHA512 (gnutls-3.7.2.tar.xz) = 5d01d561a05379da71e4847e30ba13c2abe09f7a5c4359fd539d8bd19abad0ce87120f82ee7b6264e787bd3edbc5ae16beffa892983cbc3d59f11a1811c10329 SHA512 (gnutls-3.7.2.tar.xz.sig) = fc3314c0ce5fb608352fcd8e19efd14435e4cfa5c0eb843d86febb6053fec7d46774b637037b96c5a621a7001f89d6c110f75bff96f94c2a77caf5d9c3aa9447 -SHA512 (gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg) = a74b92826fd0e5388c9f6d9231959e38b26aeef83138648fab66df951d8e1a4db5302b569d08515d4d6443e5e4f6c466f98319f330c820790260d22a9b9f7173 From a9b34e8a5f10d6f940314105b660f5c6d73cd626 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Mon, 25 Apr 2022 16:18:23 +0200 Subject: [PATCH 15/18] [packit] 3.7.4 upstream release Upstream tag: 3.7.4 Upstream commit: c46725bc Signed-off-by: Zoltan Fridrich --- .gitignore | 3 ++ README.packit | 3 ++ gnutls-3.7.4.tar.xz.sig | Bin 0 -> 685 bytes gnutls-release-keyring.gpg | Bin 0 -> 20850 bytes gnutls.spec | 28 ++++++++++++++---- ...2225C3B46F34879FC8496CD605848ED7E69871.gpg | Bin 48528 -> 0 bytes sources | 3 +- 7 files changed, 29 insertions(+), 8 deletions(-) create mode 100644 README.packit create mode 100644 gnutls-3.7.4.tar.xz.sig create mode 100644 gnutls-release-keyring.gpg delete mode 100644 gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg diff --git a/.gitignore b/.gitignore index ede02f4..7c7df98 100644 --- a/.gitignore +++ b/.gitignore @@ -134,3 +134,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.7.1.tar.xz.sig /gnutls-3.7.2.tar.xz /gnutls-3.7.2.tar.xz.sig +/gnutls-3.7.3.tar.xz +/gnutls-3.7.3.tar.xz.sig +/gnutls-3.7.4.tar.xz diff --git a/README.packit b/README.packit new file mode 100644 index 0000000..06da437 --- /dev/null +++ b/README.packit @@ -0,0 +1,3 @@ +This repository is maintained by packit. +https://packit.dev/ +The file was generated using packit 0.49.0. diff --git a/gnutls-3.7.4.tar.xz.sig b/gnutls-3.7.4.tar.xz.sig new file mode 100644 index 0000000000000000000000000000000000000000..b9c03b613433c41a237be8218cedfb14bbb47c87 GIT binary patch literal 685 zcmV;e0#f~mbp!ww3IH7zAp~7U%MW%m1*ZiyR`hyxrbx5-A`ArrVlyr80162ZdUd8q zv-u(n1fT%@6p|Gjsi!d%jZayHA(`cQ<>+~sy4$WtrhapJo4T(K0RXwd%q}q}Ybf;b z%vd1>kQOV+LR^s~^WXqaLUuumtqh3*GXwwu2ml=xAp}MuCBw9DG>4zaNo>{ygpSwd zm~jOHVlz7C0162Z)&+!)*XEdUbkz_26y8?IDiWQ~yL{S3<@MyX0J#&?!B!Hmkuqjr zVjSXJp&OyeF&uRa*1-ZjIZQ|HW5c4yp=uLm>WYU-Ib4Irr?CgoL7fZ1l$y6 z!bx4F4Jylhe5XS-;?wZ38V=L4I0Z)%$ zmHdQpnRXGHNa_UoPKj_Kdd5(Pc!UPKU8^0qG>GF{yJD%H&W;gP{`zG7$PG;qSKAr; Ty-KhOFJ<0WcXPu(BNiKNz}7%A literal 0 HcmV?d00001 diff --git a/gnutls-release-keyring.gpg b/gnutls-release-keyring.gpg new file mode 100644 index 0000000000000000000000000000000000000000..e33ee430307d77bbf4ea2b05e65a1bb9ac795769 GIT binary patch literal 20850 zcmb5VV~{4@wyyn@ZQHhO+qP}nw$)|Zw$)|3%j`0`{6)WOuf5lf6LG#c|1xJp-kBrg znj`1TagQuuI8bSeYkD9=K;aUQ{yM&gvNDtA5ywzdyKHPkneFEs32@RP!VR9zO?ZF| zy5Q9wJ-57&Fy0s~*19~h+4e{}CnS}9OcO~G(bIR6h5bMQ7NXN0l&1%&ZTA`sQV-@s z`N~u>m<)aMb!~?OH*MTy=b|$8pw{O8qqV648KF=<`DM}1PB*UCBV(v-^b4)k6oKwI zG*j7G`Vf!=^M@HC3hTN&nLw_9i+h==(notz3Ui+g46_-the2yBAu?Ao%@T*?xcM-F z`7+Z~%~1W+PNYRM-zWt*b!Ka-YjBcvy?Oa5yxdRyr(cKNAL->>2@qj{(3_V$JuLh> z`HkmdtkL7c__b3q5B}9!s`@58 z7SORIUF+@n{A4j`1O1RS_!AOz7F+9S?=afWAzZzo2sA>(I(dJh2Nl5!(pzP8J*ytM zFp)}SDox>#K+i`32n6j-({L_B!cR7vocg-=$6?ir^)(XuY-bayGvqrQENhbFYqAM4 zbT>noXMdyZz|slCD%Svb<~5le%N)!oQ`=K?y?3NPYDmyu`pqCn!0OW7%zNjtA+zaf zIwTc7N4T%_AQ?mcS|>dG)o~O+xhZH#2(&K{tCVPd67cXL<)`3;rlzRZtWl zU;sZb4hS$l5HLm{7z`971PB-!G!!HZ7&xW$1rB7Z{4b`>l%e(faF z2@F`L8oL_|3cHdX4gd{>`0w%SGK5b&fdX2%*crOo15t)nHc0RUgi%@Uo@4YEP8xhG z@;Wv85R@`K<7C*9j|LoejdXWdVdQ!6fDj#$jk`(xs0brQELxa=yA^7Drwg$L(Wy$Q zcsXZaTcKZ&Ma(LTXYIHkjvP1_jzL2WuflQUQ&H=n$p&-Sq)`b^!~zdd$GIRC6+GeX z?oXa*9Vn1ggNg<;#CRWl95<>$jlUhLijzB%Ou;?L`V#4TAb(CpbB36#FG;r}JponG zj*_{<`%dpdNDyJGZG(=}TsUwks}>?5!1#EncUy=`xIOKNY-l{Th2x&X~FO28qd zSTFYPBQIfktZV`Tj?oxn3<4@8pzXi7+i)LVXgVX8kkBy|yQ>!y{UByPlkmR(oi(k&HXP`aa{=jg zJkO)ItPWwMx7w{NA}jkf#ZmhJQa25?m8z1|z#Z7^d>SIZ{P8@NL(kv>lcwZ4q9IK5 zHI13H}u?hJ@OURIghM!&Ho0IoUAob@wRj|A(T$ z6MP*M!h_JCSRz()afSmwQXCW!2^atl1}tsysP>l*P<*a>r|9TWK`#*RR{uR2W2gU&b{|8TC zP&8mj5YWGP{)^iG1kipE;ak>RwXpSD&m@Hmp13XQh_LcW+sF|1s~BICI|C|`UPS%* zcMJxFeRC>jUzk@vQYUK}zsa>3^$(-%wbCI(HW?!5xQf(tES(Vy`c%mlC-n>%xJYeg z17v$8HInx(vR~)d@^)WuD6?Log-Gz>qn$fJPzPG3M%a1v-U4!A($HdHCwrqg(aHnt3B} zoYb~N&{N-?e#jSN`0c)ABK5pMp%243Jcq=hqrN_k3QS~*lzPaR91W96=dk<<(&QtyLt z)t-c^!R7c0x^h%t##L!JEZBQZ65TPqsF^iaLnr9Dt)d!;lV&W*)$k{*B}D#c5ee(3 z86@=^kbz=Vh<``1VSAIhrEqk@6#W?Jg8;IWc{T>??5VD2Sl@|FB*`G%96N-Bk>;RWtco!m_lIagnBkXKku|H?xZS|EYsP@mI$gr?$@uNs&~X z6Oiwul~V1JF=Qy%>T1IO2NP%6|J@jnM`dv>okg9hT+)gSY@GCIY^oh36{!x2hy?R@ zV*NX=``WM?eBovb(K5iEFD^SplGoU!-Q5A1I&unI10}&VoBJW$(V+?^U{C10S%!M5 zs#OZ{iud8sHg~UwZw!&xCmPSbLj0fi1^JI|VfWGB=UYDhT{D2nN2g*6$oG*+!F!-K zi}|{56rL+6A6^Yn%L5ej4?RA%uvIq*9S)G+3n7M@iI{st0po%q0{vU)>#tA*gCnh+ zJy}JKIKmg3#Ck%9WigMdB~?dgchFCwd4^8hqxj}zGCvIRVZL|jnLjJ!-e;TDQ#{%k zL9*VILdghKg2P(^Le#uPS`6k>;;;O+R~6*q-s}1rKd$2KbTF>A!SWb9xQnfvAkmHr zZ3GX?a)t@n)!i;`Kq+;?xycj39p7WxznNT1KEA3B^GopG&*rI( zHLs-sPJ>^-+y39y3doh<-YW$s8RsCTdc_S2o%G>IUSy)HVy}KK{9VXrE{`!Fb@{WV zY_H%P2oH)tPt<6vUG31gy`?jIQ?hU6mZ!Qf?`C1Q%`sqe7F@y30pZ2o6;DO zRp-EQ6!M}v>dx_Y?kqp3kvwr(y0tDLbV9{y^444D)}f3;(neZHc6aT&C668flj*kN zNzvH^{r(+e${Lc_|n!ws&oxln42@Roo%I6yGU3H7Omku$uPHxLP+n<_;As(ebvP$dh^~$lf+dotwr>rD9F)BNWTNV}ZEk z5f6zO}k zUYt+wU#N%H`N! zb_72*A#GQpedm4qFV4Mt9T9olLQw_mvuk!{X?tQ1DKxy+FD)!snx=P22*t#yrU!58 z4IZq?b(>Qce;PoC^w(yBbpjjSw~N_4!5nRyn-?)YBYvW;hxr}r+iQ8{x3Xk z3IF0zw?$-X5CSjlQiJfVlJs2WAL^sb?B#aZDb{d>T$@th4_WTYx;MssF%>F8dO-98 zCWKYIt+ODWQ{7&!8fNfqaWOZ6!!Xg`JHctf=$OZLrUO$~RrQh_A6KJ8sZ@Ym%nkPE zBg1g9%teVGNmExD5S(SHH9@{*U(6vq{gL~wxQ8qhKSW;(!23ah1}+}@)q6B4Oh+*~ z7~V|*nWF&;bQU6mZSj;X*b`ZXhG}7JUlt)a*OyayYW}tl-84l*nzL} zjrwRAp1I}^a>tL5CY3>fTge@;2f>pHRuzK93-WYcM)dlJ^Dn>9Sfho^O=XuccJ-3w zG(kSl@KM0<_{E4EC&)^5Jfa`h!kjG zSD28AHaA4WacT*>)z6tpvf{1D7Ae*}#<}d{Bbxn4Y2~q68*GlrA|;~qUW|j423nnV zME)cZ!*z1uGDb3d=cvuxsED`P!Zk4)w7yC1X1YBWu9aBFcCYF-*s>@e*x!G=VEz(& zj0#65zwx1SLl(BdZ{(d{)BOZ0R)`X><*~Q&IgSnBJihzL9B)z{zuYgl=ENIK3&t4u{a<)I`~Stm&!Ip4N{CQo=NaLP120z!9ae?#VZKGwszlKi%`LVYveCaw z?YJma-S$*WZ!SEU>7Q#)(x~p%E^t72YG$Zn?3nZ(g%8BOu z1egZ}YuQ*TuZd7dh{#$pso1Jus9UN(FD^iAd%tEc4+=9^h%{w<8bk+p0)`rIjU~E2T4y|7H@Hejiyyd z#n-E-lON=FQ?`B%OkpACwW|Yse|Feu+VSL4?>Zrpnn*A<^*40;1HaCH@#-ZYTFvbD z=`e#Z)C)K)g?u6;bs0gZrU<*r59?qDrTWuH3h0rnaH*;h)0_qykR96U?A!B^^=;23 zoq5y3r4LIZb>Cg^w2Y=`bVt)B94|+G!gxCcC%u&zY!d@j_VMF z1glMhC9Yomtoc_s0SFhOp7@0cmzLXkp-WCh-!_L=rJlr__C%!6iba)r5!v0dF^-6t zLO6?sC&f$$J5NEOiL(_HHi%E=GNH3`xA2JvF*zwQ4rKpO)K5) zr67o&E4Q!cYAREYw@;bP(+DbLl@tuZ3!VebVDNr~$C=+XMr{OE3PrqVlp9TEF#wEy zF5QfD0Vp%l^jw^2-fLvUlj3z!D8cS9X4HZq)+dt*c8(8SNpnHTYZ|Hus^Rj(G;hjYdJ8wMY>voxhXbobI1b-1dk~hQ zzD(nBzb!yPEo{=i8lx+siU&@7;l$m(+G)Q0<&SObWlP{D;&uDZlk9zLCjr`$;7qc> znXm62E&5Y}_A$o2%^-iO_MeXHO{E#{OU;sIL>x%uo=#? zX`TpwRrIin-S82PoCEZ}b$;p3OwcjkA!FbLda}zy&_m$*iOeXqi~kYF<;zaPNJ|`o zD-`w-$-)S7d~=2?+v!Zzi%h`Q~Y>M;QAQXSWRtPoxrR3ecW_-UvA(=EPKvn!& zT^2vRzxSdI>Nq#)Iwvf?k5Y1Eky6)(qXh|@^8G3#lIhDCZx-J2jZz@zNt zDRrhk4Qo&sa14u_e0burnN+^VGD%@Xpv$7P;k6C>F!?M2A;WGXK_|hxzLQWdJ(A-F zSk@MExt)@s>P<4HxZhdbv4S^#Pc`EtWnAfaP!1w5oV>}7Tm~UnpJwOFZR>;}%(6ce zU+3k&Q2w+Sn>(roQh}}4EbqN5X;7#GZns7yQ1=cNa4%}z>*LVX)Cw6iMgB8;6n$F# z#baNIJBwiUl(aPx5fImn{KbWv5MwhGif0a#w&_ecKr)(zR-`QB1biRgaq>uP+qIf^ zaDQ%4ZSoAp^Ue_QV@o1c3X)x+fYvi_*tNX6b)80wJ$6Yg9bBf82iTyJ+}Mx8`+iOT z7$fFSueGcI(Q{G+cQB3};F^(3z15NsNIIOLBqvI1wFm3 z#+X_63LgZndYjfvrR+l?)gN<`_YJs9@G6QpG`ssf>{AnTSD1O$pr)YCQ_{79g3M#I z$X(4@n*(ZSlpAZN=^TBmSmeFWv;>dO7oS{z{wNKUz}{#|`1_vsim3SRs8IoS8Slqr#R@%mUn!EXuVUWl7r7 zL^Tb4VwpoPzaDW}1~ct&@#D-Cv2P5{SP;w@nb4S-29}KlLFJv-so8X9vsY4}?=fN~uoE%INNo;s%~)dosuLKz$@XF|Dg2`5 zzxXw$ZV`?!#%{j?B%EmH(ubkMIThJ7SIv#eS z$qT$&iqo6h=-@Rxa+Z9GfDu;LG6dd6P%F5m2R-wIs)JZu1=C>WGA;Lb1@HSNR-k_+ zQUhLpTJ)LyrWG~H%fQ9}6!i7B!hlsBipL*Lj;Zze*Re%6k6H}?WPW)mT04cVy;mV? zb{XhOmH20%+ZJVak?t-Z*Ajc8mNc5KRK)1Sp&j~jTA9YOcA?-+@7VRpIC=x7l|N3+ z3^n)}+0m#i<&_hKsMIXng;(QZ2JAN$rC5e`;mTI9tb(f3;B&^0!e{V7f$>shD9jaO z`8K+CQ(JT_i>TutgPTfwaf?o^%V}o2em-Ls8D%geV`51|>Q~^LiQCv8wH-Wh(jojJJ z$}zuU9NhslAdhuyR{jOEaqh?|sm;u#G#tj0mG3_>E1ie@D^zq@x6t+qEF^`D@QIJl zT@%M@6!#Nd#lLYyd)v_$R*CAQ94l2zDPQLCgqkCL&HzMRJ3Ps9j!ryS<}H#I460aj zPG(d^M}fU%ZW*pw9EOB#XBktn)AlpJG)0@{dDq&G= zz-`qAPqmO(5=LFh8wsLyzYBd(q4HEr?;`=)ZS=~|WhiQ>artu)K^|jEzWk!xG|X{1 zR){xW^sMM%B0?#&Fp*1|JDyvgEiDkIa3#wL<*WI(4c_8ypkIw$XVnVpl=0+t#_YE# zEuJn*6Mb^R6TLdYd6Fcdmq>)E|?agj^IILi8f{^k@n1cR@f6xaV!@D3Rx`IBL z)wEHicg~aPH530O9U*mmx9sAt57mz{d|s+8GK#5tbk$q%Q&H1x22uS0J`$=g^&GLN zUIGe&f+4~GqJ`};oF+=Z1lW!OEA4$n04pT4eQ0m#gQ-XNmWCN##2*56aPr;FOyy!{<>yJei zu%~Kq@tiCc@b6??WHhOj?l^?f$-z5a-Ctc~M0ojl{4HXZ=9L$F(g}|+D=J9S77kRJ z4Z9v@-((=|b$cOVx^qFF0%!>_#fRb~s!Yw$1lbss3!&#EbKegL2%O5>E@t>o^E}u{FL~>rdfI3Lfo=5?npUQgZd@5OhHtLd ziy}R4vKqqLuVwy}2n6X_)5v5q#8M7~tuOJ#4-#vTyGqX^Q5H%v>ppB~cMaX}C zKL0}53D-n`4B(v%+R*qn?)mSuU~XORAxObgl&vYRq{q zZ?Sl`#E*hlSn`OS;Kfr>DmIxOL7GoB7_yMaJab*c5M&@Ut!p`gQ(caVpS)AI>rV)Luy%-^#bkvjTU5s$0 z^V4Tvy;s5qbUM}m?^oI%YEeIjCXb=9U~BN?2_D}>pMH2uj%lun7Oagevj=jRR^3$u z;7%zPt2}S^Nh4G%F4H0ZtPD}}W7&{jb+i(*nmm7?h+}@mPYHY|dG4Hy-rTk)w7@Oo zS=em5EZ%+z>^>LmKd!oI()EWEt8g<-;WkC+8r+G8z&Hv-+IhV!a$rC4YT3}gk7RQ< zgJy~EDtuQhgHbLWRG#&f1y*Lp9XwGP;v&!rg6${tV(+xnS77UfRj6l&*OKvRKGI{Z zkj6m09N!~S6XGPvt#%u>$9vyYY%KgJ6$6nOCn$~Oz5sjv1bLGV#+1LGPK|>uiriP? z*t#~A)_SL$+Q^?EInT6~*NX!B@0x?^b*jr>JOC~Fy|U$9eb4d`Z@^WFli@Ob1U&tn zHD*x$q6zBZ9Vy{j~ULYD&=IRlK9DyeWztJ^s_Yq-^( z2?eiVD_qLo2AuBgTwgS;f#QE}Rk6g09i4w|R2&hn`Nw3!OtfJA9~J-$d$<3p{;T~{ zUKRMC!YVi#Brp^-%zu`-_eM1pKpiSkj$x%a*reII;@@F_lN4%EB#qC+$)8Gpz~GHJ zJIV|ShfeCK9CqO56*+8Q86pVI%_ltM*+!&w9o`UXIRD>FZ8x#3B&l;s4T_LT+sPlEA1`aGE&g2D;w*$ux*0M3+R6$!$n$+fC zYblG<+|Y%gFRbwR#Y|Pw1?D=2VUlr{85L(y7Rg&8D=09XU2X$(;rGV=u-c)u1v8v= zm7ynVglC+5(GS$gLl9`~g6kErhGYLF!_bg~KQHPW622b~3A31Kq zw~ch!X;pH;k-~%i$yq$dvn3fW*hwSA&_=1zi&p!CAV(R@LN2C?2G1iYvOkycU@5f7 ziYD_yiqYy={Ls=}%%GzRTvmU*b_Kpg<@PZ?^+Rp(R<;AyBuq2dmYlBdW#7JN>it<7 zYIrkmK;&)pogq4b4=aYT@{WvIl{sLg4L$pklLg0;*HS!g9?L*Boc-sf(;d=tphIt? zAFFi?>1U!;D49H+fRJwZ!T%*;>y99Nizro(9JijHh(o=@K+X1FQ}t915X`Cchmv`8 zRoL5rPLWvM)I+yK=ei?id+j*IGxSjl?eV;?YLljpypNyTbMx;=qa6tG-RG1{qIV{# zgiw-|CZgH^bBpU*; zg`q>(t?kbH`Rg_$1OQLiAe~h$q^I!(_cmQ* zY)A`+^)uGz$vU3KzFJ&8HcFHRKXs16YA-m-_Jx#m)$l6o7f_280+Q)7UNGnfTV0?{ z#K?tVO(ZAEVl(iqfV?ENg3)hU#5{wmR#)B7W;DyGDF(lljV>+8c(~R`DM8z{tGkt^ zFDOIA45)pjP+&*eo@8GW4mb}%XdL+Xg$jpv^oQX3;}GtX!MkkC+F$dX#mP)+P``V_ z;~UxYF&5)t#tVw36&gUD6qk%c%^4`tVs4k)2Ek;tCz2TJ`-O+PcttSs>8W4NWqA#? z%Jz$##NO_ZAt|T^EZu9}qX!m|l;MEUMmt30AZ)FG8dS{R=bsCrWqTzjy#5?iHYd8Zd$S&{r%Hcnh=siZA9BdLvgNg z7)=Q|F_?WuXee)vI9|Dqhmg9*bJsDe?m1gmNex$3*0Xbmn$)jfv#Uc5za4%24w(u6 z0gtdDer^78jpybhQuYU>lX_#Cn4%$Jb`MF=DmX~I$18^ZuXm0iI_IPYT% z?l6;oK*eq9ct*Wk@PetROdX7{iYG%m8IzD=QfOEBB6pwHLDh2s=4_sfyEJ2x1SR*^ zA8h3nN?R*a=D@s~zev5bo!sE;A^rl7(=_+!gd$UZ2&{qs;7`=JBL46%2N~hV~i%lv%&gRxY z5(_9Bx0qT{M;mO!TV-WMNcz0S_aWU6!l*r(Yk8l)p7Q(#P#b91?~J;yialqtfEtZx z7o$VbfCGU7ZAu^j0YL~JD*!u$%NkN%1J%`5Eapg{Jxq?YMRw23SP|PAKKos_kZC*E zx*FLNiaT4GI$N1o67qVR|LaiD+04|^$d%s2!Hz#N8x#c{8X$~L1ga-Kjo{7-Ru0Cd z{^;#iCfWQ-3=0PQ_s+mLAYf1+Ll%I4+@ruC#K1t{|2Rm2|7#%$0gUmFNAKU4S*-&B zid1$5JY%RVc<(gy&!^Oz05Z?Jv-Z@l;>9XtYoyhtK!7{AY5<|R8@H-|SUauVPtrKD z6_=O9L3&L_W0qNvP2djBf8s`l{wMAXH6XCRfsa&hPX}^8m%O`&p2o~QP#-i2mX2_t zt3Ym>I{Uu3d4m8!LPYw5VxmI>$p3$$g8f%if9Ko3pL}iv@QKDTyE<5m%K@%C6#@Q1 zU~p(4S;WM2Bl5r)D3tm_2MqX@c+1X&vIqu%%$m0H68XNHbs@L&eBgjHqHDf+J zN3QK8O|?3{4~ASp`Mg3|M5eu67{9~1TA5gEY&k4ErO1@nEi$}!T`q{`E*x-8bW>C5 zNYuLs2If|f4pi&pSI;EWCf3W2y#0swxNv`ue;x=jvPC}_9*gkw6_ueZqkqlY2wb4e zZ br3mjnvaYXfYvewcG^Fk=qVN7@G@ z4>qUIU<0ZhXmGMfJN{#}VD5QM4pCZC;W_q)4jbwdi-C9ot0O#%>yZO+9Sje^EQfuwQFsiTBDgwNd3E7EB9pZ7 zrQsFHtBr+zV7K)%q~OIQhyw~}fCrO2uNo}G(7>~%lkA^E_ZW)w{M z6o1+Imrt8e)yj@gdAP^Y#mt_N*VW37-r3FU?}?y=ohQAi8GjToA1DeCG=KsO_%AsB zd&d1QzxMw)Vj&sn+KMbdDK(rB0j-Dc5F?(dA`LF|$2uiJLqZab?;p(>Gk+v6*tE7 zc#r(O$5ZE1|Kr2Hv_{I8kdN3M#{pX~4yh0|W@_LW8S0i>K?+e~O*j*iaVRiXW-qjSV<|FxnUwG(pxT>WON~`y8I#Z_K@Bkf#+6c(D z<4Dy&{ZAu!cz%ch@|$$2mp9oz9~A~q_isjn()Sqk`e_!<+T>vX`;$2(Z)Ft* znT`x8o#LYf$QN{f+PG#QMVXAJt3T`Djr}p)8TYTf-G2#f?fez`0*TjBY%LbaB1HIN zs4IE&9{^>PtklJA5`%P+d3%6UW+8z^_WfYcFTzp0`BWb|?P;O(^07=I(wxrCCwL2u zs1c~iOUqqcGh_SDtz zqtz>&4L zZr{q`6>Uh`AdeTwnV$+tG-o1JeWzhF-i`tLey@4Qk3R?et33n+VgGbc@Q=lvDWmaF z#1gafEoFO98>fR|=lmvzr8Ta7xw2xmmivnJ0%H~Ewrn1ws%8w_#+WPiUkxSD|1^~R zpRFYSN=@iQptwzbJ()%_beck@cK^;&V8FWW+vQ+TuyKqSf3f=a_!&3C2c!=W#*Z}% zZxHw!=9?M29ef{9y5kSBUT@3-uga91G=7w=LUG2nbg)(|m!{gDn5OmCMJx$(RDIc4 zyL!!B&PBdoS2S7LpZ2~&>w230y$XSZtxIrIyQbpg*kP9`&55i`z+k)+OU@P6TXni# zy5C(^q~BZCE2{~IPno}(kTmzJNPnRap4{OfrK?Pxg?r&HeO|ND$}Ui>@oFDwq(v}5 z%GBPmexAxDCV`X%t3^jLbXS1QZs^Cu2z|SF#cS79Qtw6M4<5e?fjbDYvJ9bbw$mI$ zUD|9UbX7O72;?j1WH2O`CJlYeg71des%Y&R*%rIdN8GlxTMfp?zb5jVF3 zE;+U(Y_QGN&wCBVXz%-Ia*xBfVGm5V7Ya_$k8kI2S{v_0SRo7XClH3>j!Bam*0DeN zptH9Dj>+d384V3Rci9J`c9CgP)*q1Jok^J1YYj;8!rDs#KtGg6yO)HeO|gsK$^2s! zb7yhdVAv{;*ox8)+zu#Vrs4~&1a=Q#KY!$p>WGy_EsLMJFywSbHP9dNyo z&nbXT|7j#D&NWE|v z)&^-yD1z@i__7kCeUVtm%V@T#KGjYlR7{5RlY*Bths^1RZtaAk&JaS9`H#ubf%Mmq zVJ00~cq;+!eaDrSci*LvdPyur?>$e=pa^>yWqz#81I{_f3+N!9jk(>~FiUOb?XFxj zo=J$WbH*)S1ZK@?dP<$^`x(U}NnBf%x>i!5Qs9-?pI9wB^Qj8SG2b?eRrRj|Cx%)} z1XwMr6=3~-*uTIfFaKQ6V)>jkU0f(zvzpVCh#xzyo?QeEPP2=HI>b@L&G}p8`hego zPYkKQ9Zj@j5|exKBh3=)Ced%pSKGQy8lf9PG^EliNe>Ci?cYu3&V6#;(q=w6k3(K` z{s$f!Gh0r7@z}ca_9k4uJRHD8`1Ts^uq{MeG!}Y%0_MDATp^Y%FZqoy6-35r;e<&W z6G5oZy62C^>`V^{VDI5sJXktBZG?#U8TaTDa8@b#OkW0iq?2#q zeR&o!8)3CL0OkeH!N<|5y*}!am3d|vc1@xra8nHOjg&7;yE>OJfm5@qu(JH&SuUu~ zIel~*u_%v}p8eV0dhWC;kKk3;W!n{poq0n@EV{b1D_067kh?nmnYPk7#OU%%X>2=X zKzTsc40kIhy?qmpVBH{Qa+^Pt5P$DxVMBN1X(w>~-8g!-$nK4*pAC*Bg_*g^B{oezkv^2==2QJ~V89ZWhHYZky zJk1Z%Z`TcVZT$n1|5*44V`s5daxSs`c-!Ydw8J+Cj^x z6#J}WxaWzDW#Cq9r;BD^hdwMm;pNc=?OPlUTJeTSio+alhs4ol;075b2|{L-MH%eX z;CjV1^SnFr^2JO>{FD89$7_KG&>*iGRI=YeM(au8S+JW*Nh}IR*r-TGc z3q?ux$#ny#GEf4slOXi#C17^)GkFB{IR31;G`xr~GY7?}dtN{XS4UaROU%yu?u2UR z{zGdXIn5z2ebzEj*`%7ntjO6l6LKjk(vsGeHIU3}Ows6N=Z$RW5OXzk#`hgO_EiD+ z1FYwY8hH+f8sS!Y1uo?A;SoX$aG|=Y8Gg>H8=(cq96OWP@7zJLNrCPCwe478OVYKk zf6=J#^u^TOA7MPK5k9n!96gDvSYALaev$+&Da7(zWXY`c{Z1DWfXEzH8U}CJqN<=u zJtCjq5MI83*r56`z3If%`C3`y^z#m$u&oKw#_7%g(%A0Y=eL0lISO#tdo(8;*oXEd zio~GFd$n9yGM;pEd8Z9d!ek$sX@^97#P!1kogCPCCCT#8Pg}82!lL36O3|X|KMmi@ zGF~3gtE{boo((x!b|nWn#LVlHwh-Agd>27JdWi<9@2!f4A$V12! zUE>I2y;9dT33l5nAEE4feu7weuFcfrp1fxC0rx~tBSnTA4U}Pk;zBbnZ@IaVaQ{&1 z21|18YB9lL?BRKDFQck{`V*ex6Eo?dq9T(J-Cv^7o;-RteK{^PjXSV6Qm^vn2zzUj z(x{yyV2t%>I2xyNx8d%ATM3-HeCSt;40{k|Q)c!Vp5Q5$8-9&1aI9Z4w>E!T7tToK zGuwV0b~Ec;FI24jWe6-2&CW_WA@muQ`1@SF^Lh*Er{X>~GK2l51qZ@n_7Cj?!&?zm6oDVdobj(6eOjW(elH{Xt7sFLV0u|KBB znaX$X6ED_bQUjRryuj}?K^aMKq1DTa=H#Rcq>|$JC;er`xmWf5H}29n+54VLh&~%l z=qS=#*}0LV#{M7~VKp;daVlawFS#2qiQi}9dzWnW^5)=Fry}$j`V>#P``NgTYCsSZ zLN*u}wSyeL+bLsabs;xVekm?qo%7Ib9Vu1~q`odNG$qkNvZh|0He3Y8#B4Z%t_N?Vh!l#q$L)gWQlg07FxB0}Ecqp01Q9Yl~BR}E^{&Bo9Vb^U4 zZKw_BV2zt}%mD7GCS|<3^m8D*Ag?d4YeKuX{UFsfeKf9jWQRK%)SVM0Zg)L%GqFHU z)qI()u59tssF&Vo5HdO-(Vnea zkPsK3NGnRiy=Pz6Oj=_M&!XIBp@`fo5R&Wj$3*swc*t&5P!d_ZBu8x-M`T$mo26!@ zNHOCgrJ*5T9xBqMn`o>py`zBzrLC)QiEY#fn;DYOKD@9E&NO7R1AmsYJN}E-I%->0^fIsA_>D{Ipy#VLfi5VA;-@q@X8(NaMEln@!1p zj7z}nDdU^u?dLlg9*VGk>;6ZbIYpp0)es)8$ET7hc%jR@y{5W96RjaAk_}7C!`8;- zO<1)UeHXIg*bfnMIt1>W-?1#=grLC04bKrW--PH}yfJG?o3TGBXJR1+`12^?n)Jy@ z#Y?9?8FOE3{+k~#V3qEc|F{1<7D|YK8mw(8f}2x%R0Tg{X&$OaI`h{=LX?3G{&D%Q zCY3O2sz0@1B+rcFo$O}Q!bM8L`~);!qMVAICRaFVGdGZE^wgyjK3X(eQO5YG>34D0 zu+lu674p`5r2C3>c@;C6YDFe+NCX9yn@hK`c|ble%siRaLmVAD@n}~vMBf67ac3>o z;IM1t@_21dZske>YLZt~A5@m?PV%sexP6uv$@l+%kH>M2V%| zLa8SQ4O|0a5Kv*}8}@a$=MgD#xeS?#|G!eLDl7^{+rq#wgtQ6_-Jl|aDF2Xybj{Gx z-8qzibSVrqgdiauqev>!HKcTlLrF^vAt4}jKkqsJJ^#~rxv%SC@0b0pwfA1@U4~p7 zZq-zuWjiG*)wX$&#!x8L>Y_f~VHU(Lie#ftX<+MSeY8eAYLMwG&>tFYvLSC6bM!5A zaYlH-_ab?7u9()&MGMvD&w8Nc($6tz!r_NEu%YN@Ox$puK5mdJP!7jq+apsNgOb!5 z1j=w%uN%xYYqAsy+#5Fhz0#Z8^9GKWp$E)G&oal%nI6u=Nl(f{%I7A6^mIt?9Ebta zyfmX`+l#Q0fyRfA{DhODvlE=gnr(JOqQmOABab^9Jh@Z@Jh)C{%!%p$_2)4v8$$eH zmx`fuWvTP}hNB5ToC%YwFBPQ!6A3k{RlNFBKi0wXtAR=B);Sn52*JaBniy((Z(oSt&uFho}Qm*2Fp%r2hVCX^-{zqL~N>O!U`cT5I zUQR8h0K*t=i}G?Hz^KQ&`A_}7k(pW0jjqT^14RKX8rIh9O?#b2w1mwota+`!QTy7> zHU4-dAdmLc@w+N$X>|1hAhWTWD%yPW0ZGT;B?A{-CwDaDsmP-p=c>H{1&TN)hR%`9 z6s5URg9)@rz$gHslkSrY5>d;WvKAxGy$^n3&Hnu5>igfUcwYUf&u4rtL>UZ@NQhDu zRN3=edn-bu&ON$7t$OCHN#O;t>1WLQyP1XaVqNG;qG|86dO+0!ueik15>tpHf&N1N z35qW$tE{`XL&e-+sZw39Xe0DvSu*8MsxCIzlGW z5L|%E^s~a#jH;>w5-rbpI-8LHV~78$E(T`zZh&MU?-1la)up_i`il9h=%EW=*UDCH zNj4-*P#8RWSxSnQisc?KN@J9BMNooQbJHj%<%tvZiVc9?V~Qw^gg6o)KL zDSkX%QSRj2V;SGyjgDV<#~XxAF2&!~zEcf)Dha?t_nB5nb{R z+Qjzlugk$N3eC^en-_W{^;VDwdv|eJ?%}*)?o2_$$w7hi{xOoS_>Lmr*H>j0M-uCh z>U_OJ-flLuPvRs@X>F@RIJ^S62Yslc*ntJ92dm&pkO@*0@?O-OzC3T|>WM#+7kZLy zLnGYZv$+SXoX}_wOy8MnlD}z>zD;IOG@9~iKbOr>yu%`s?YNZ?^mdBum)(42dU{)Z zukl|AITd6U*KS##1n9N_w+VHi=RU7WYtn?j2PZHZXj}dsLH;K2fudh`>M)~YDOv2! z_8$oEGZO|EBqVCyEqU>d3T}hY+ubcm0krw?xYc<8mDGyI`#08$B9<~jCvEOHO2#gN zGf3er%sW^!J^;#5rB7$>`Aka1Jr#g6#e@V;)bqR3G0%x(WB1u(o#(k^+sDF) z?$5w|7b!&`z!VA4`P27rWExI=Nl`_fo%Z2}Q6DkWWf@_oH^LE}1YV zFU{nL9AajecQr{6^_{vj8<>Sf_V1A8BG863RgNpWkco`hj*bV^O5rfs4NzkpxX%_D zu1#Hxr&0ye<#-=;#yp9;qSo^q|AIiow=5~b>y*V%ei}O=Frgg@(({3PyNo}b(x<~G zR=7S6iCRaB*gqaW&h{!Bf`djoMI(AW@pazGeYlqWOq}th`)^bX=i{JqQsfuQhl3o) z=dU=L8D^fFLYLgPt+7IgX|6cT%`wG!bTo{6r%Cn>q#ep9nK3U}8~%719^cwgfZ3QGm|OL;9sXtIagM36nMclLL=}m>Qvthq~0v)ODac*3Dw^Vb@tsQlDUS_}sfvV92Izyb_77p1l=#r{#z*aw-%j zjec>PEcpVMjUY=SA|NDMhQVo0lYyQRadRMcJ}5M?iF^lg&>ngDWYKU!+0l#; z@M@WMVr$eJ>mq^Rh3DqVjr4$EcJ6Y<7-4AufnJCTxpsa z>eEGcq-@|PJK2LdStk2X_f$WpFBJU8mme*#&zz+8Qfi_pb9Wq9d3K3LYGAqOagTVn z6hRZ8j|()+n`rMvRjVy(Yes*dLp4>-!#ef~BOQ9$|a^?B=Y! zhxMen=iQ)u#y)jnEBxJ~aVj}^;4;dpX|?F$L=!7!r1{*wWp4U-vdc8!BWR!Byk2j| z8y-B@t7T`4Rp7k%P>Q*_85sOoakAYQG(V|xAH36pkqDxQsuw6)Z*Pgxl!NEDsKw|O z7<8XHd8riK%WG)EaEutJbq zQ7veWF|WaS`lwje;@1q9!HCVJa>yu7_O;Yd(i>Nfh`>|v@GlbQbn4Y#Ka)S=mJJ3@ z`?}{0c`pVI2;UiOBy3^fzrE)A>_$3!K!hhhYu#D(EmmVMmhDS}@xCgi201A3ZLxAK zR5*JrJn6x0ZzL~CXB6p*o_}x)DZ{M{lVkxy;MIYX5^t9P8u-SGHaokA^YC|mm@1It zdy^k-O?Rd#*Fw+sDplEvMC8vj(0$PNRtsC_ zo@&u97zOxPVgL7DHKR0ZQA<)};>{<$-x@f&E#*R% z&68sZ#Wgm0{=%7$5vTgDSSgVGJ6|P9%t%O1zz1Ny_1~;1?EhL*BLAe5stD>+&*8di zh1ia)4)1#QL>3kE-{_hZ*<5&uKr_1MXYEj|=q>uO7xNbcTzwOOS9Y#FE2Y{Gz}+FH zLzg8zb;{~d;}Y~z!P6mPCrj12Ds9-yTuPXMH)>I{wKtE=oO(#@Lln1iO^ntQP;I4W ziD?nWxA`v zEySK2=adZ?q_biv4QYTADIPiYg?6QWu$=E3eIVvtv-lI2LI30NI$9auxjX^!DppAQ z;TW`>;Q#U>T*+QDzS<*wZk}$dionf%KN5#(F*B^I7*FCv% z&A9Zd3Zk?Yh<$Y8xW!qU?*&7m%aIh2gK-ehCxR!Hi}u&L=ybwL;bM{v40IzsGg@w)Swd1{-Wldu*u)p2t}!TOGhG&eQyqgH6|1 t{2}Ob>92!N(jIs;&qFtyN1hyy|9&&(k-SYLagnUTRoF>ICS= 0.21.3, gettext-devel BuildRequires: zlib-devel, readline-devel, libtasn1-devel >= 4.3 %if %{with bootstrap} BuildRequires: automake, autoconf, gperf, libtool, texinfo -BuildRequires: autogen-libopts-devel >= 5.18, autogen %endif BuildRequires: nettle-devel >= 3.5.1 +%if %{with tpm12} BuildRequires: trousers-devel >= 0.3.11.2 +%endif BuildRequires: libidn2-devel BuildRequires: libunistring-devel BuildRequires: net-tools, datefudge, softhsm, gcc, gcc-c++ @@ -40,7 +42,9 @@ Requires: crypto-policies Requires: p11-kit-trust Requires: libtasn1 >= 4.3 Requires: nettle >= 3.4.1 +%if %{with tpm12} Recommends: trousers >= 0.3.11.2 +%endif %if %{with dane} BuildRequires: unbound-devel unbound-libs @@ -50,9 +54,10 @@ BuildRequires: guile22-devel %endif BuildRequires: make URL: http://www.gnutls.org/ -Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/%{name}-%{version}.tar.xz -Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/%{name}-%{version}.tar.xz.sig -Source2: gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg +%define short_version %(echo %{version} | grep -m1 -o "[0-9]*\.[0-9]*" | head -1) +Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{version}.tar.xz +Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{version}.tar.xz.sig +Source2: gnutls-release-keyring.gpg # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 Provides: bundled(gnulib) = 20130424 @@ -179,6 +184,11 @@ export GUILD %configure \ %if %{with fips} --enable-fips140-mode \ +%endif +%if %{with gost} + --enable-gost \ +%else + --disable-gost \ %endif --enable-sha1-support \ --disable-static \ @@ -186,7 +196,11 @@ export GUILD --disable-non-suiteb-curves \ --with-system-priority-file=%{_sysconfdir}/crypto-policies/back-ends/gnutls.config \ --with-default-trust-store-pkcs11="pkcs11:" \ +%if %{with tpm12} --with-trousers-lib=%{_libdir}/libtspi.so.1 \ +%else + --without-tpm \ +%endif --htmldir=%{_docdir}/manual \ %if %{with guile} --enable-guile \ @@ -258,7 +272,9 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %files utils %{_bindir}/certtool +%if %{with tpm12} %{_bindir}/tpmtool +%endif %{_bindir}/ocsptool %{_bindir}/psktool %{_bindir}/p11tool diff --git a/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg b/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg deleted file mode 100644 index 30cd72996164fbba16fd2ee7098b8d28633c03e8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 48528 zcmb5VQ;=<2x2>DDZQHhO+qP}n_DtKhjhVLXoN4pMT>Jj_tP?w8$G)%ap^V;Yd{KI@ zrPh%N1PdZ%eoY6608p?9sJDjauB61Mal}5@*d`MbUTX6-OAM5_0Dpt4eG}#{jV5rl zOUETAD1jo6LxP_{go z1S(C}bY0VK&qWh^*|DHRHK4h%|7c~RPf8$|M|N5GyTg_9?Z^mn3++O4C7Hh~7S%*% zhAtR5-t1wTkld;^S2}>x|KeVHvgFZ@gxt(~9o=-=^kKjXQ;^h!RHN8FDRwTDf3DOd zMI%Hnr2}!n)F)CNR*lJu@*0eIO?OUi68G1a-qYS;*JoN8XFPal0My1McQ-Sic3#7| zC`;7X5MIrs^n;&Th8%2mt-nR7nKHo4j-iKOaz9A-@nEo4yP`)D*1TmAfQs4%946qg z1Z~Uh`P@ViNIl)471$FZR3>Z7Y0nVq??D{h!EjUpgjzX2!Utu63zAzUG+oPX*-+sM zB}xsU-~f+DesFlL4U;fV1A;GB>+HJPkH;aEi?vl^x-2JS$}^-pY)mWSq-)Y~QZ!cs z=x0B}t$>nogi05GIHpzUZHsJ-NE4e=G~ExxS5-u)Z@ng9L?AV(E~ee{nBbW-Rc+#O z?<1TyI^gs{Kg|;+uyEInMEO`YiMoy_?nf!IKh0f7Jr zK!N^Z1B49>1`P=T4h#f>3IqWRf(8T(2!sa+gdP9@1&Oc%8WOj9lHq7K0RJOnrc%)I zqidW@3P;o$c|=h0q-AIT^Ie3e!IcgfK_{&C{3jZn+^#8wqc_yE53z%#l+XCulq$z? zYqew$fmNCiDz-c&4O4pT>0rj%SmqLue2zBSp9KRX4t&DzFbJq$-}#wbWzjWDvTT2?!#) z2B1OEW|XO_O`cZ%HK-AiGZ#k2L7tIRfkGF_sL_E&%IWJ*O+Q1`@b+=Yg7>(XOQu^K0jFLAlUd773p3#U z(GwShy$xj8i{cn(Htz+%ya`+*I2nVKsL7t%QJ`?>l-F*r@RZxV)VGAZve(X00vs)N zc!OLe+-89ggY4#eOM5zX%kk1+i-Al+p8@oy&)!IQ6-uMDGE0#Zs%xuUr@J8}M1tAQ zAjEDUU`MT?3C=K`{Oxc-9pd&YF`DRoHAF0T=dijMz$b`*}Oh3Bo(Z z7gf`yDyVo}*A*0fF_QE}*=oM{)%b{H!kperZS+`M3{cYu0zkTXF|S43W?N zUT{F0t3#Nvd+J<=vg~yGKl<_gsRIhyR3Bdm$5s9@e2YJ!<1J{BK{8kP?h-CGlEKRhwQ|FdWT=l|=op_yWp_2l>KFB{?^{Uvaf`e)SES?yLr= z^=R$uqsbi%m0@AN^sHn5;oF%|1DuDyJr6O1sjQ*K^`oB>FWM+W8*>qQxB#Dj1X5*K z#VASKZPjj)Fm&_`rk7eArUdd+#$x-*Xlyc8v~=!ig_39V@S;4z$pHO|ge6J&^GG zlqv}&&^UuXP6maYa~yMiDnbkd0TBoQ>@P2ms(P;CpkxBbGf`@Ia~g@w_3ktc$Rk3|Cm~V+jt~Pu{;%he z_JkV$tE1iYgsFk%iA4?vkOK=Dr8PJB<#rvnHsX)B^uE;}aSo6lc%#1PpmYuu8(~6l z)~eEbGo!HoZyj{5Go7yGAP5dY{F zbRGSDzNOfd3Kt{wowt??5AKM_OJj2LH_}z82qZQN-i1&kP`gNJi>ujTHl3Oc1P{xZwFbTd=U}%$Hkcy{JliqAn?2XUns+>&B zYfVo*=PJ%t8~thvG?(6;tH{z30`;iCTHvrWdx(Hd&Gq62ghD%vi!1@m;Ul{3htZ|@ z^Skme_vEH{27>0KMla7&JGqX+IzE|Jai(m&K|DyiI(Z6QGCF&0xEIXX%qV^rXeJoS1+|2sbo0yeSdY>vuE<5~*9ao`(h%kRfZ9;pJ%YdQZU{T$dtx2Rse zgDwowlT>6y^v&0quM_Fa`7s)}HgCp+^$m<2{y_ooi3*javkeNTr(}9}vSw)3_ZRV2 zaATyu3KY(b6SG7aSdV<1cNaB^KrCUUW&3!jiEzF%fA@!w$h?Hy_pw1vTa%MEHr``} zvwCf!2+Tb6s3sBONt<8Z2HosNvU9p)=OZ?U##6KXplo;@D4dLw#PlTHN)40dXuEK< z;eN{x7^)>q$_Wp>HTomh&W>G|#L*+bM4F9QVpJA>pPxJF^JLm@HmoKn&A$Eo zx1J^$Xq96!}Q2#Gx>3`|?1;)JJN(vd8v;&YXAT@%R zxpWe7Q@O-)+{ycdtw9Blf3i0OlOM@~SxS&DJ~gVSPAE zjAIFqpTep%4M!78J6%1huM0jj@e=+sCGhq zutgv(6Y;fy3GJxwhqO9HZ;>+`3`=Gl?dCL^Xo5ZPuukijJVU@+YFbrLT))OvtU){l zrQuWFtU!lE-`*8qx!IeNA)cVm6-U&BALgl8+=}S{(4~#JWXUR!5En;A8|!k5R-uq2 z3~K#HqQS35;^Qg_>%jCpSu<)W5af;aOIp3SJ4mWgppb{6j}ZSi$%}AO={pqA1c%!? zLJz9JKs%d6H7;sTb8&k#(z_IaY_lQ+=bFRVK)Rq|Ip^5{ef-mjIDC9Wp*LcK>d zg4P%}Ic|$6O%jtB##;a6L5i;F1}C#lf~8{mq4OEL8YaY3&zOTBw4cF@3-Wu}w=C@* zne=N2}H#xrv`57^dGFqbed8Ye(OU8_tj*8b^saNw~1Om5F1t;>ONWKv;_sEBri*-snR(x+Aw8 zF?ShAKJeaV0IvseYS=iaH?NVzP;G^%AUIcfB=&kpkQwlF;*SBU6)pF!$d|r9CSAM> zBKa-rb8uuFOU+`pY)0R)lbTQFq6a=sH)=MEH3Ec)YL5QH_b3FWC_mKl)aCASBg7+hUyOnj`&%5hglkATizvh zGF+bvR*S7-x>j`RZJ3n~?Cw8bF!n?rBg4?hZoFw-k%X-A8hGYbb-nDEz5r;E1qiTU5VgI>nO8 zG1xd251V-AY!%m?gT$v!^Y>VT29rv}qU#luiBGb-NgH2##?avNnw5Uu*KIcHHeA`1 zyAJTgMq>00y>*?wfba7?9^H5Z%jx}IZ6;v)I)3}b;4k>ZPD5~&WFZ&1A#JR{6hFEM zeqG{aP8C%m>eC>7(nA~VeLG&#-mTfhGcOw0v>_=ZY&RK60p@l8@884bxz-Ms8D=?C z`lRj13}3-eu4Ubon`HdM`LSh*z_X5{bgU=Xh zpD}(5*qV}2gmlkYO$t?hhOkuHE`#9WEY|fFIJ$K+X5V4>z?=xWVi(4ony%*s&e`R? zTkM_{y5jFz;}L?(=9OxNq<7Co*utjrVa(WZHZK!|fsl*UEws0n0>HX1Ts|TzDU97--lf)0!zd7ylF;xkxc1Zo zLHptEXTI0yHQ|`af_* zENW#poK=fJs1fyczhs>0?;wmlY=ZS@oFl|r5jpH+GkAn0V+Xl!nOl6F4m{>PWC*xG zOLBe)d@|>Arh0qjMM3dxS6r4t>pBw}keD`BaZu3p*BYvz zqLFJ&y7O8uA?xZf<^2N!!KhviqU_t^yzu4qvm2#f%dtV*F>d~Il$Q$HB<%k+Gyb&UX+NhU|(ZBFhR`L)@|%t0l95_GM4Y4<}>om>szc5_4= zW%pnn=c2}~E*4EywSZnj_}}hP_+|MQk9|e1O#GQsl9mVrfY>giZ%&-}XzRfcTrM?lSd+(&XwGQ`*Zy&<7ZIr5Bl(&P4N^-2sZhA8jsu|m$Iss zHEK<^m_^kzFzE_zApHt5BVTf_`&GST^yt?fD;a*m=frTXAZ%NJYX$~7w)&!c6ud;S z1!+Gom^>%|u%^Yq_K-an>6)WtB)iF8u_0NXH=~wbK{H5-axVCOjDkv~Wuj|#RH@sc z(AJ{$_Af|*)cw5|$x^XYsW{HH;S7THQPZwvUT_?>R?X=OnTG<(S2N;|b=XU=O7d7# z+xuOtQ)4t2=sA|a#=wqKlGXhDjAPV@9gP|511c!w8!N`CY(2~vq>&S?TKsCppOlsC zv3VOU;YiexMVz|Jf;|nR^WLL#SN~UmXyOW130@(mhN#D z2%mZu;7u9eNX={a{gZ_jIk*PLdn4; zl&7VowD(7`{m(Pq8Kb%&-Vv?8XwAQaM>!u~=Wta3h8|dMH!PKzNBf)Pg?s5+b=(@r zd6{Dm+ixon4mnA+HCFH7hnD7`BC#<8Z*l!9)&7k~ku=X=JWRIvm&&q7@+)!Rzximl z5}O2JT`mS2cX=r1l6(&|HL?dvzQopkrUkMC!J@rD18G zT<}+QO0&m7HP~%k0@))vo+5y!8VCuvi#Np#%0j5!%5DTX1-^k zYy?!fCq#6>SvVhHo$p|L_q;|SD6H|ntz74>5)@5DuT6d@MzHF0rVA`knvCvw#7Di2 zTK>HRNd-A3cMdGTZDhflSNJOxV@#F>{M`pFGir#CKoT`n_>%gL`__9?6WB3K(PCWb zYVLiVr)Udsuc7m-N`8$Zj?C7G?KZj0*bY#>=P{SK^C*_EoHJq}a%5;#ca|U;b!{S} zieZ3e$-$VQeVlPD%UK66QKsnv`#7>!VpxCXz0>yCpaJjfFtzICmqFa`z%ZO~(nyTc z3R})t`isc$z=rwj}{lr~` zhXU--r^hM3QL5FZez}=68)fP;w8!StY7QX*{=4)|HR=G|`(I5mXeSI7Dk#-4ku!nv6qRI&<<)!E$1*NuPZVd9(gcl@-4%T1 zFDy2T$E3~GSX~F*>Ho%~nzZvT9@b<%7d1$PQeMpn0G-Y8KfKf^bfnMrmHe6Q*6rzs z5lq8oHF=Q*SubgI8L^-@{*z%c;_*zWRaTR2|E}LMTMN z40l2~sHBDgY{Plw9azQ+uY@sQ%`<^KREmmbWiWyMB;g>TN-lTB!k0`8-0A4-b&?X| z=Hc=+i&~gfT?YHf5bY zt}m+BI$TQ4XeCVwfM_f92V0f2BC|RU3I*b4p;yd@oDWXEcq-p~Yd~HrKVL zHn5tgYi{}E$|SM@bD2UJR_zOu{r-C1L*5S4fQJa?MVrJGOZaxWP1sCapvBY;=V_h5 z=uTYQT@}2K<>e4`!21B{1uZXe=no;yDu@K){b!s+{(r_v|80;23Z$^EiUJA=p_HZf zm!JQPBa!FezuEox$$c(k2=|t&y76veP|x~4-^f!7h=RW9F5(ueSAclGYGGiy?%c{# zBMc7anR`*QOXvTLYN3N_)s1S=S~DGTSXrKSiLH;nvz13$+B(K3z836&;DRH&8%XLb z#e>B5_EYW?F9;Gk(WMT=9Q0s{QVE>ccBj;dgJ16)V6~=mW&o{Ab{&Mj&SjXUYGn{> z+by6Nn}*Fx4YD}Wsq3bJ2M!cUrZwCQqfs^?59&MXsTS>$~!uKsV`!DHMwjD)lta<7Z%aA5qz$a zMqO}cjDXl~+g1V5a^=dN{RS-Wly4brce7&rUF_DfT$EM5*DKk0x9jLzB~cbOqbHra z{~Q!Dw&`~ls{I~fItRacTsNxkq#uf}#I{KuQ>a;^g)@udq$i}0oWq+>JYbb$(UOa> zUCPtLAtGKt)*y6g{8R&b!oCGFe0VuzxSp9M$lXQsq&*D)=qjxofrYBE4nS0RAY9s+ zk#zlSO{|mVHnB-!8MK~1_PEx z0WR*tLa^sI1&uI0SdG)v78RO;usSx2PsUzvC!gmS1$|Z{d*UwKG?NIlApqMdvQN5s z7XL4MQBnZE`-=ySiAfz*oD9&3C;T^WYaI46tAVvzZaPGn_^uC$x;)~!CU}Su$GM#O z!r3ApGD1P|BUZd8cX^5EL|QmW9_2vrd;-(-bv1pUzTlLO#V~eN846y~cI~E@OXM)s zqnqfaSN{E+XXDlwi&InUZ zGNA8xzIg?pG1y7Uq}gSAc-bUT4-`PjP)$C3+BYO>xBVEN}Fd}6x#z~yUa2@?Sv0!Ki{s>#omj!mLCmu~}x{u*3t|pL7 zu^suJ$|X>W#e<5o-qL`IjM#%GN&_5t8UfJ#_#Uk7=DKn$-OzHitgsqVUX4dOjAfE& z$d}`L1S$gTMA?-tgSI%YoAUMfoDxxB=`sA07_JM@=P%%QsUQrw`>B*zsKSVSMfS~W z6DiFPipll7apLm~D>>c&oxLb2#QXt;gpJ{3`?tM_TEl-ri12Wcg(HVL6w!=vLZj4+b)RtwW`nu<&D80zgSr8eBsidEkm_Q>sHW8S z3xgrPn7OjnD9VPuS}TgSVI37}F6*Pomo`^SKMcpmW#}aag3(m|et4y=YJeUVR!ud@ z_7Ct0<)5wgbU+=<(<4F}hHpw7S^dm&^&XFNT<#zb|1H#Hzkf*XkDklDD?f8IyOih6 zgYHG`V{cB6N>CyJ>wi@eo->??BUbUgpB;8AsJ2D-c~~h5lT`SntdbYZ_dBs)Kc6gi0B2 za`#(pu4@*oHkH7EHUyY^&nF-_5`0b3xmZKEm(iB?PM*Kq|>Y zjfkyg#dXpv0`MwcrzSbzo}e|iCC*5?!>_f2|1CeGRiKcFa_j&2&wpM|s4wt8?z>jk zx!79XPByJ3JrqM46A1U>fO@rCA9drE_qj$kzZEeDcYHDGbe12w?LBXUG{zC4&~DyV zj9`l$+GnjcB!Fio8;jShLUl4ehql%Mb(Ade+AQeD$w9QU1e>FLT3eQM^MX?1hu6K6h)@na z0}W`9N0W$&vE$AJB#-4FJivHE)s0|FJws`loa3gsB<)h3hwzW`2Tcr}ghvMTLoqd3 z{nQy#wTAO+`rQY&_q4_SL^<8ofEjbfB2ynBpPsuHCeED(NpaDY4O_tQ@{jp!-o%Mm zK=+%k+zy~(sf(YWoR4%eFEuD0N};Taq=B!s`zl`VzC){ueO{vo9do>8Ah4Q3;%Q`? z$Y`Df=5UFK#4u%;&jm$-Y~8NAq1)o|KS5v4!Zy7Xr8a5giuZMoMXG1vZjbNYUsVN9-#+<^k1`gMK&7w zzwRP7S5o7k;M~Hv3-HY+gES>idK{s3D*|q%$6`^sLvp)j$!v`#{*xW<*mVyG5ZO=j zeC!+>E3hpOxx=qx-=Z|tvfo#OoW4gk%1Ju+pTz0Y#s??9Ca6JgT5_}qOR z)uxbsBJpZr?a5)bmMX}oKaa6QFzAtbUzNq;xbhzaOE*W)n%oWrP4o(SaO2Kz9GbZx z!dw#0E(~g+Q9dODv%Ir6n6mX9LRqM~^O?LXarG!DeF$fYo5O%a4dw{h~9V$0Grm|JjPbMI!{kKVga6 zDJLzYbT}T4T?Bzg;u(4b1=4nC;rd&(|D50+fPa7<*!neAAT1RT%vioIto@?0y1TE~ zaFO#?9=}VBHJ0TeJ8`BKDG`4OU`X$hZ2yzFw-TSXA^3-2R}$PoI=r$oFIV(iP$-l2 zA^kK{G}?K>I;Nk0lqTWkvi2I|-j2hc!iN^Oo!<>dcGf8*9Via_g>@)pxec;SlLVi! zr%w$)_1C>x?G~<*C(hV98T*0KYfP33f8a~?bL{9&Z|JQKWheqp*{p>ch5r8ZFhr}i zB%r0T%?uy~ii3QwOS%ObQ7~)IAr5Dxjhj%NeaZrmuS^D0=A)vR)XohlZ(Nc$~SRYdDwq2q}5HuG9Q<9K*KRYi@ zmai^BazE-o?(tPYQAh6fd7?ppL78U`)iGERTGS0QC36-~Ut`r!6V}r5TPi(TJxdV4 z^N-R!laOcU*G56X#7AZ@ck4n~sfIclDmdWq#IK1v1B|7;QTm370wdTmPx0z1QyS81 zxt!XeR?d8|s2T8&l{}+Z)A11ecv)a`X&J#6y=JGo_3ANTvYNgI_t1q^86evl&`C5} zUMtYHOal%}MELyrCK4CSndWi0-zP#zN1;O`WM|PT?<~y`&K51~zmkT4I1f7SN5&W8 zTCm`4uuSG9_;=Nw{e0~L;7Qa>wl?#Wt-K(k9)?1dGopuR(j+qn1!DhkCt4IuE z0cJbbD#6RVWwLGiF*)|RVPtRv!vw-h9ZDCWO?OjqSPt2lGdMtTb%K5QM@AMVEAV|F zlNusl`6UQcdis)jv?AMa91Azu>hub?!=q@I0~gtdjn*lRb-UEg9-y{Uqe^|nTc=}v znzo{PXp5f2*~#6d&hvuu1T{RF=61TqL;Y5o>V$qK%oAT-6K5}%Iw2BB<)0Rl?|*19 z(Fj4rh)9Q;?ODR}#wBh3^9lzA(yqel0)@n?po9GjU~$!b;Uf{{ygjgnxBKkKpC)YIHxgplUI{DZZL*Y76uBEt zNFw8(i1;5OkADG|mve`;xjlKHwj)DO4k+kT6XAaLvfro(HvF-#EJ|umGy(GepUlxs9M#P#%|pX_&54qD;54>^J23KullijxdxQ}x_*G!&M$;^C ztGkyTg5W!q)u90I>p=u}0QVRa$G?x)%4zTYyQACt3#5$cK zXvQL(ii!F$&$~wXO;6FgYd+J#ENnU|j@<=xns~o$iDS4^+CiKYj{?s^x z9SkV|4bsK`HZ#>wI94?$=MZwaL~1%NJ=c%QSS=zGMQjqo@$YUOm?N~N2t@BVQ`mzp z=-cnwe=z87GI|x!R6X$rsNWpxUz?@+qzy0ByJ<7C>rCLedJl1}AeKOe?9*`z{nOaM zBZiL_U)+{$`&x+41d8DK(h3H1w=zd}dJHpi1(I7n=bZx9xq*I2n>@9;G-8V zx?xjRa~zqusoNmt_E~^@uKpdunINg*E+Zg3O|d0J`Fy)CknMQ7;xn2DR(3KrBdgvx zGqT8HxY{QJoru-ObY5%HB3$y7M8t+L8=9g?p$8Ve9%yq*?JUfTN=pRG^6;=D>r!TT zwbxDKw-~MH+l{{k+=e}WJi&1-yg`^xgLB20TZx<(5Zm%V1I{rXkwa-(^or+vLcfnL zcB!&kuC4!I%FE_M@=-gO?>Djh0So`cgVP4-kzR?<2*&j({bFFqDr)ER_Muq&0gd_N zLzG2^T~Vfi&3L7u_3m17u?jY&JQf?OfU>A)(dI{jjXkLl7&Es#Xskz=J)CRJ_StBY zn~^vdjwd=gXSq50&UWYjkZR}*!~X~?Rt+DwoSuk5en3Oc^j%YSSM=l0D))tux_6e_ zS%XXxTi(<`HAnq&L&);nc8sI%r4rob{#el>Ng4haJGbNF+m=E-5ahkjE}lT^NK_7{ zAT3Eiwewz~^`U|=LFX7bYc}8gB}19#YT{^tSq`8Gt>`U#`e>H77u8e#My0la1A}JK zmaewGNXTU^yGJ!Y%SAW-LDBD~eKAx1Q^)DRLCd&1xzaiCjVF;mYEuK9fg9b_W&4M0 zhIQ~Y!AHIsPiRC)uf|F@ypPSlCd5kJ;-&s)^}0+PU0HpOYV)S!*m zf*Z+j(<5lTVCm?#HD^G`xjK^nFIfwtj5&>_m*f9eEKP7n@Q;|%{ z4WaFpK@bX*8XK6g2g?ZczDI*qoIRD^rA8+tf10SZKdMWBxx`9!cx#;jH<1$c0a!v% z!E9Ex=Y4#&>*D+XPgucAjDm)IniE@ddOOiwKrKDO=!6YGbo$JE8i2-Sbb%sz=*JAL zx6}9{4!F!W-RACd?1?6vVz$kiC9C73NEdB~3FF|2U6l|s$&Q^9A3kn!*r?O3IagvXV(anAx%oH`0S)w4FqFuY04V@ zps+4W(mrJZJvQa(dng*{ozeDhVuOi@SFv zeqBHR)5mi?d)Fit=i?}-jPl1HQLCbu<;Au>!okbxbr#knAx2?|QZ9!HsE~T%5H8C8 zn>KYgPzLGfDqRJj)l+!}_hE&^_l!4`agrhzt;liiYhAA?<|V2jL9#Z0bK~pKOsgEt zcE0aczmqjLIB*S02A#A_k22s$gJIh)!#vLSdkpi1-NvBmHia3jE+wxh85{D`#)UY@ zU!VfJ_mw&g_spmQ+8NN(D;}%%Ukoe&P z5qRV-JKdzc;a|M8BJ1KW=vD9$lZ=TGew%)68O6He1&UooTjuv-aQb}Dqrj;B~%^3ZjQI((~7}WH|=tq z`Hq!`#U;-H3uZp5ZP+iUA|@X*Dm|I*e+|%R>3`2PdXM3M%ri&*n`~Soq%c}NUBDr9 z8T_oB*YzIHU^P{eNyKPA>vxH+C>Dy7qTj2?NtbU&vwqLe@7bsKn??>#%v0K?VRyuc z6M8DDd<2+wC=)QFwh`UsMlK3V1a$(9=<8Xq`>+{#9aRoK^ioVXd zB}XL19c*<4OZ~>ka6?!-IH7cQ_Rew4`fTOkHJMF9&6Psd!RBc)Rymj`s@KrYQpr++ zX^1oYNbvNUmx{=|0E^^jU8LT&v6+6$pFinBFVa1|T!DAf$pGf_t(*Q~kt*Vpx{Ad` zb0fxlM9UlH^!DhdZDqaX%=n`E+2buepE3BsWybgU5l#mNb`C~CGrIY%)m71yiFx$SPS+7gk6vhCis#IvY(T$?FF8t`x|2_okr z-s!7H&Y2oR?TJAfay|3pIuYvp4J5<{H>{wXKga`iq;yM)%3Qpk9l240L%2?e3OL+; zvshy+No~P5;4^}1*h|C(G0XQ<-OoodGuLiZAa@S8NqqziB8>=^4N!^^LJ!e;>Io}} zEPNS~mMDaeoN+sKD_P81IF(!GCRi0V67Wa-o1Vtr!(p|2_$U1Xab>S7?b+g!WI)ME zL)_8ujxa?)I5PA8tvV}|g-Tp|P0o6BUDQL+@qY*fzFEP)xvSEJQ&|&)i(3oW?9MGM z`gLM@G^vvLAoZ;&Nl!R`1Hb1pinXF(b*5>sr9*#=`yp|#7j)bpC-LKc@T8~;Ab^wa ztHXA#=hh)R+Ic`uSVdif^3O9h9iLO=Wy#ho;qz&aPT64Q0kGbE;Q%#^kb@_a9=x6M zXQ7mF@P%@xU`2BK{c#GDx8%-B+JODe#BuaIIuCVtHy)RL9>=OMe&|anTgv3cB&Jeq z{SyNS;rM(n-C~b@ZyxG!3DZXJ=B1ji`Y{?8pj-1ydsXFVgi+KjmgoA$U1)E$dB#3q($%xvp(B)e%{@$!$wEHeqcS{o0B%H(1`s7Buo z3^6fe7jFc*BPu$XhT zuB?x)GmxfZRZo@TLw#a!q`{^l(GdR%) zDyr0Y{~(8A#Ms*(@Rn(Xxoq==@cp3O(`Sy5P^|7_-{IpJBP#IU|E}8qE)>9;g8&GV z#r7*Cr*|h$ZGJ2EIC9^<7&!yY^DU`C|YG8?heC68-XBF2=BF`eP$PphS&|Lhu26;BA(mVXLF{QcNY= z0)h?LDMkEcYe!?PtD5ty1^jcD*h4Yw59ptVo8Ofb6=Vy$%sqy9=)VX36y|4es`_ATTtt&L^*^?9 zjFfN7v&u7v7wbe6P+(o5hq~e9OIUz^AWI*z*9A^4z4>nqW|}hYUJetyZJM~n6%@{$ zLp95vUY(ezF>q`5rZEtC|9D<_xmv>n8Y2?3j<5oqzDZu0>vqjqiTuE`j5Yr0nGV#J zocqPM@RR4g)%;1{Z#f)4?apcsR1%1Fppli|Qvf6cU6o@o=fXnDp zv1P<_2g#N{J&}$1kcWyCqnN4o)~Plwcz5Vv#08q-jV~Ny@Dwk4Z(EdJA1p|^6WAuc>-G*fYZC>wpET^d>No=*Zv5>)T zs_#VC6Ow=YW}+pxh>SHajo>Mk5#XQ7DzgT>@O@`{SZUYXgdWPgO4pS! z#5GE~an~5t%L35S2)1>&GSSXOlpd$F5M9HXH4Zp%^T=;BR)dx50!wpe8$NEtvx#ut zZc%i`mc)hn%~3SVy(tkU&_OLo-%6q0gIbe=pRELHE*o7*jq9Em(f5ntU@@f7k~-r; zlELy=?9jqZRKL9vOh#|5W*M$o`Svj`1TL6J zd(E3vS%CM4N^w7f4f>vTHpqw+;1*3wicl*UtqFHS%KJJlgon`u*A{I=OmH*0)idVT z$r`TuzG`e87ILIIA62&eN)H(F)`g^0<PYi)pa`0#~6bp!|U zLKDy}znlb>yx|`jgk1fr78jk6CRB^bNqXPq^-fKRIM|j5NdcSHtGngKZ%6}#bjW?h z5FiJd?j#>$c35`-C~Ua6`EvUYw1=R&<6y3nfx9e>n!UM>q9jID$Ui+{aSd#F=nHYs zWBG+s^7SB&3X4V|X7uE#(YH&j1E4ZmuO0YnvBkjVn;MQQCHNG_N+u^=+YH9C*&O5=j4Z?3%DKNc$Kcc}% zp+{D&8cH1dbLzL-oLFq&+6C?g#~sN{4LYCq@z0)lx*<0J)oTi3srk-$+g0ZfS2`*9 zLb!FXJ>|UP@(-s7M6X+}Igsvn`RnangK)HiDUyvC9kGb;BmiLSbTSn1<%NF1 z7ht#ji!Y;BKR5(pmz0}$x%gyt_6K-e(<&Jh`^5diXvf_CaT`lH8m zuEc21hfNTw8q8FZB@KVMkx03<*SCbvv)t)t3A*WBr=8_Qs`s%+gq(YctCY^(mrh1H zJ<=-^VatSxSvO(f)RILrH!>35)=o*3p?!SWND)8~s}5@!t1HYl452C_B?Pfe3l8Sa z62&RiauZN>d+a!5);?$HD5~P9$ar*YQ<3=gX>_)$;U}5$F0s?u5#a; zM9Ab&II1K*nxpdqlom z@PH~SPaX`jh$TTe8WEFVkZYCuAa$MBLe_Bt%vwJgb!tQ>3P|j)J=n;}m$XzQ)845- zOT!i0chg=9uOP95npF6Ky#1P35}i1)@+MN{1)J)*;dTF(@gX;k?l;b2(ciw>_?-vq zw=UK$9V`q;b@k&Bph&~0H7IfJ{pSQW7_~^H1ulczXcwYaVMItZF(st75CZ0KCQ@Ma z(3KW5LXtHjV&f1V(SXSfO|HNx#QQXS-)tE=&}Vo~M9h-?98IzIfGsVXv@mg{={@`n z5SKTj!;1etlF%3s3ZQW!3K@WZ zgT9pXMLdaI#||wySoSxQXf~{*n3R-JeQwFwV>{9sF3W_PTh5=j8p!~V>YtG|NLw;0!&ppzWpG$ESD|AGoVp#{dhDv*Ym6gU^6 z99;XeRJIqH{q`jln_WsMvL#1lm%an`O#HikUA^>sGu_FqUX?_#`|aLi&xFs zRv41^#&mkfX!{mi{J4!WVCeX>rs8K1nF*_i?X-(uLlZ<(v10G*QA&)}FiQ01+e&)x z&q54Gh6GmCH&bu3-zp#H`a-|gyRvT8&Zh3=5C8NdTq!WhEk$;cO$K}G3b1m&s;B&H zYrRpQ|M%t#Qh7^L8)rhf!4?}EQzt@RJ4{c z=kGh2pfx2{{y6Zd>;}l?Iist}2r$mj1o0I7h%EpVl5WfZ@`V5Bddzpvj}6C4NU4~K z`xFxIn*S5$pP6Xon-bx_aRLQSxn0sENxg0WdFoph5=>d|U94o5QGOsIHTMI1fa) zUy2%wi){|U2I@m!KY#D{GX5w2jaKpB_`q8Ah}IbA_}z$rFA_BH%llZ{oYI}Gbp_sJ99}x)WK)U;X)pP3B85? z#D9bn{TqM$wk0j+z;6j`74WU)LaGl(md`QawFXoJdAf+ZX*ZnOXyEY5H8E3gHvJp$ z?eBilPH?T*irKvm(&joS(1CL_cU?Y)!k({XoiVO-6K)EMf&>j90|Qn8oV?>>Te!G5 za5FHtySvky+q+np+uJ*v(%YH3FgTbyF#KJ<$#oy1qdABQEfbKR%-}NkqUmSg|83Wb zdelpzFVHFi$lv)n+G>H}Y~MwA=0Qj;_$bCtqx#=vPQm{lmPw9V$=^dzq@TnG7PWA0H_`=Kb=Uz0>RRBOa?_9Ha^eun=uoUDA^z5Vxj znfyve(sAV_1)?AUi52!|5Q?G}B8MYJh6(BTqwqU1eWom1hTJdET z^d)Sl>~kWRJg_XHP3VqoBl{PUbJ#)-t?qgR7ezZLsGVMN9BxurB7}4Yz4_~tr2`Ga zzx})&&h|c%lz!c?qi~wU( z<(j<0y1;Nd2EYL2;|=3S5O4`?g{oD;Ru7dZmo^~%dR^vmDGLgo%p#Kz2`?aav8Ek{ zOkWw!yEMf7{BL^h?f;qG7J8dsCTf>%SIUI=cJI+!V}oLS6G%C6jaK=PSECXQq|5TZ z3UTJURx@s+?DZ|sli#`G6vwKFcY31o?bpIC>AE0@i@M&qx)NOffsKV*mrttMs8W6M zaEX20dk3~J%&hh*Mu$vU`Ht!D#L#2oFcuW!FTy66niSk0AsQgFsea&l#X*@SOj>pg zp~a%BPxUsJis0ZGg;E9zxTvKDshYn?wXS=T3>J;x5ezFYUF1P$VgIh9t7^_ZM3FJ7 z=kE1kyaTpMXy?8>(Mc#ZJhgKZV&c<*<%uc%asG3O%h1H!@d88&2y=qA8SS}pkEibf zBFmfMk$uL?NbL3K;)*eIQKKc2fpu&K_&@1UzwyoctH*Ke?wdW@%)Lb(5|9(Hxq9+P zi*&zLeVl|QX~7`}RdT}FPV2g$BEgve%Kj}$*s-j|a=tn^;Ix>YR_uIzH(vD932g?t zFmk=>V;L0CU=Tzmx|MN}oLZ>fb`UOau_+0mRZ_nK&X#!>lx#j~8+ch}yzU)`4jKv}~khEBD{Az;#EOlwR<>EkSsgIpr zUvi@v&U@B6x|1w|8j*6%RJb<+o_Jv&A_CT$vxaEL2|(rR^Jq&w*k6)3{*KCj{YvLB zy(l%zI)+$(=z0?1rM{4|2w|Sj^VAm&D1@%M>0$LJyLOhg8E(QSxBQzPWT1bpB2a#r z8vUD|-39-b=llm`G-`-%DIbn3IpI8lt0rca@}6F5HP!vv#S$&|gq=Bkf(m%JrvfxL z$!y{;OvxW6Id!Z{uV73NZm+vm&-uqlD#(CwO<{ca@1UOCPB4nojTukQCAf_yr)^}H zG}pmZcsIr~Yy5ncgxg9OztJ>+P@pB3?u>s0hfF7>Q|A#uxukg(W&}e(cUZJR(U|X% zDEx6r@B_;NU1kXVcy_|&7%*%T>_pV=4}LoL_y>d~YtvIwO%TSTM%&=AOIjT8TLFq? zV%CU}mryKK6_+suSetmDy zN}S+-mAxv!OLU%k~JG{*OseuaYKD@9Mr>c>& zmzbs02n$Or{fyxu7hQ2&=+$cS7P9pAhy~}U5QwK>2QsX|$p*{r{ZQL(%l}AzSM^vi z8R&rj_|B|rHU>(|+5-5!ymo&$osQw+o4}nULpf^eGi|b!m^*NX$a&wyts!WzO53?( zhIdlf_&th`q8TA&P`->;nhRHNMp-{3lH+o(S%SP3#ciD}DJE8ujOMvO7480;5;+K` zZ`}g!)Yr-Sk*BxHfc)`|2|9_x%{nxMl==Q(E#7}ZKMFYG$7oW=VORu^-@kQWFyOzx z@PKhZz@U()Kmh-{YU}^53I9#tgJ#|<<%m;yr7hG4JkA*tSNT(+79VLX8IZJ<(=V^& z+3nvF1-3VEc?Z4FULW%d)k^nBy9oB80fhtxO8hAn`Iz!jWsY+QLR*`I4O`gxoL z1VmAf$hGl_2IB{3OVD;#n1X@E<^+U%#|%^Ubi0AVtg`EiONwUIy&a-X9J?|}K=cBE zYE^OE_N|sdUn4MwKU30Ronlk8`(?QJCzvWE7R$)pkQAy_(*c2loetGTh+T z5KW(V!S7w_2MsyNzi_j%BFJi$=F{G`z3&^zN3c6yJj$!YH@zoA4M|GMGSG(Od@T*6 z(;w155soAkpX=W;p*}7P%v>7a2V+yBYk3A$&(n4M(z(SvQ`8sz{BIrgrXcfgdOZ?g zhg7->;886R-oY)hVULfza$(!I=W1Mwu{pZWAJH2c{l z4zM?;)f$#hcQ`mX1ZSVKY3_u>i)KoTlWE!vO6gl)pfb={SZI-IC>#&0o%S2Eo0`(o zKscd?SkO8u$c$fqvGo#Do5#((P4kO0;SA!COxDbSFNYDEAepbg&Oxb-Zk~b_N~-me zs6a-C^S7EX|3<%J_H>1y=|j+V#O1`<^BQ5b*B zL;OY*6`3Qd#8i!EV@%2)Py8)OtaK{=CtcL~s*rhsm0PfMkpDTByl!bI_%}RWmdT$A z<{Q}3etI)VkBPVu>EXce#D|BP=eQv~tbk15PLF-2VyySi@&F2?h_aCZFQr`HwfpT5 zaiWbj5Q^5R{t+LL0Lno?!KC>w34%J27u8e|t5YG@*0+%9V|Kz!d=57MCo79i6~4Ri zF<`vn_KIB8NDZrca=R>qUt;crm=5KghL&h^3Fy_|Bt4s|Q<$L>vShgCu$Hc)<=8jj zX3t@+9(q}KfvyTizl@8>$ZQX3iHj)jYO;`I+>vRjbweCd!%0F3W}_rqc`s_t#;LKB;vJW8-hx~_Y;tXqILe+-Q z?hpRU<2EPkFON-rx7PAVJ%%trL_nKFkz~HJLoO!q46XkS3qCy4r znzJKcaG*zimP|tY>eIcjheFGln2=8xW@^eMv(UHOw~;jcT97V#!~FvAFfDF z%D&FsEHv0sIu<5iW-_ftR}I7iHEpGukFV3|pQ6=UwPzbcUq4a#r6eg1rR5lgOfab< zOI~9Pk#AH-c>O6AhUwI~_kSgZy?TyREooOJn9p>*1#K(m-)}Bj(+*}>JNpGl+ z2PaL!FX~?9x(Og}ZsjD4e#9irsxtoobz&jx&ME@Odmw2g+ZN;WarhK&V#qlKn;5Bc zQpi$b!BHtvqXcV^FHlp_ks!K#9q}U*v~eItb*( zdg;77HVD^lsO)S8_Co+EbX#Cmp9XJ3=H)bHonLw2qJt0z63=4LS6?L6@ zXZHEVID~p&^(FWtHuuzjc|4r(|K;%0etRjXy8!%)+K+Ey!0n& zTSI-2AWEHs=+E_mF^eV^+bg9)Xc-wa)T^2ORXSQ|r-X=X%BQ?NOBkGAvC;FnJa1>h zH3bEYf^(B{!QP(hPDGk8d)QiDgCId6mROH?L(T}uw}>{nK#ZtR(+4tHY>_5sAA(*} zdxBgU0Ds`w$h^3?sfGUO7oMov1@*`}2AKtb*4Jn%TQ*b+Rc4km>wS=a%ayoU zF(b)Yt4DSiH(?!`?5egnrJluXfRR2TpBQ}NejQp_Vw7;YYlGMrq99=tqP82Llx&zPW?)LcU-{ zAo?weIDP(`yC$PdJ18#1SYBh+KSnzTJeA zq$JlT^$o>|71hyM^+J4X4+!W?jEFPN!_aG>?qT0N)0q_CDl#{a$En}0{lr6aw8)Mf zbeC!PGMo8u+M)q2dm$9fmC8&XH1nB_n{C*R zIs6k{G4SSN%=E0-Jey1oGIY~Bo;NNu>M2f6o9Tm=-a#Q(aNuetbrA6V97Y>(t#Ai1=v8(?5XP+HRCvpgF zI_);ezI&l+=)6^&qO7lJcrt;Q{KLinZf)dq?Ik^LcvKp~oOx{6bat7|1sp}UM`+t+ zJG;GwyE?o$PA_0u#vaS7wYLF7WjXK!cLIz8Wa?DKJT=ToU|Z9)a3u+BSVV3&lo2wUYNU9J!JvPTlP zh>rqgN>cXwW?SiM9NSVU`l(~CAIoXM$*goN!;bR0+8?p_{gY`$_tMRMb+LGJy_>=B+@<}^0}b_z4!6E%mmf=x zs~u2Yrm~ym;j4W3_Lw0d8FHx@h6>;Z1Poq0{WSA+aSdV=uvxENm zGchc&Ns`BlANqJbtXvs=25rsS(71a1>cepA%}~m;CW!_EzqH}=DHC#j+@rXM+_O{ORYk0^<7}tq$6v;@N(D1`m@x>$l=R*8$S-CmHV@K*c&& zk#<;`^LeDQM$M~sW>`i%WDAmVt;yb*0*&=fiNoG+yi%l$|9gtoC9#!&M($Ums%tlaOPKsNk`{7K8~agI7jHJsatZH4@<$AtEE z5FTTHNjfRt0xg|9*#(Y+o!UB_7NY^r8n1d;Q6B=qjUC*o|G6CUOw^rjT_)uqMIswD z67t%0xx!Q^dpr42CpXS>EEO?>+7<>+5jgKghLXLb8z1zxa$3&o+Kw%?F^(GGCqEr> zS$?EN_Y_tub#p3GI(%- z2ir{_PJxD^(8Ba_r^8pGM|Q)|;AHEc3TkHso1}_L|M@s+wKOHvuo-=T|7De)8q_9V z2k|VGn@_tcHxRcXHtZ@6{7RgXup=4es?8H?(5Z@b0R!!3A3O3Ag@)QDo$zCIrRPa# zd>mcV^C+f3ulvx8&!7;fd>sp-7z)B$Mb_)L&!l=f38Z;uf|o=3!FxspbirGVPP**v zu*^w4ppDHm5#N}~s=0ZtW4qa0I*xz+h3ZEU(7gh8`k>X5q?myvuq3!mEH4;7ZLdDl zl^lV;GDa`&q)X9%c&I>oL;vLgm8x`Y%FPIk>46Any?4z^DY+TP_Mm2K>iCo~_h3C0 z`^0Q}noH&+&gH49`_^ZfHk{&IjjJ<{y8o$KdEu_;(X*cCCQ$SF6e~}aq-R45g>F!) z5i%<)bERZPypOAM0#~&!r7TAKn_`$f+iS+ukGe90mMyBWcC0vmAnBVe$qy`DNtCoi zy-QlzA^fy{{54YvdEQ(J;S=o11&gCbe(HPjB?*<$Oh0kJYczPHByan4Fr}J2w4mK* z4Iv7TJXltg*wbRYP(}aURi3-*f+c?m3{95#Lc)C}BydcyX<_J;gXYX^Mc+cwVa`{$ zwZ>^Rv9iE-3}oHfwvR-ccQuJ)Pb;Gfw#k;wD2H&kHTOg;Ci5NIOJkd#ATe}usYSG5 zYiZnQ(jxm*o}_v5cfBf~uvRe#FFw~82PXAYR4yLF$IzTbpEL9)fk;-rOcWQ{{fy7C zSCXp&MSEP_+>0Jp0!pH!u!-Xe;aHX|FU}*3R;dw&R}uz)?aIQt`xFL(kP3{n3x2ZT zL}JlNQ3$)Z@kCtL_n8D~tJH|5HdIHN3)HyO$jpdiK{;Ucp6|#(5`hmko$SJAChr<4 zz)yu&1^!+J~?en9hgD(kXl0zI0J+RT>I4c+Eh z8X|nG2PX;qdpr!J)WImONXcQZ-=gmAe|f+pa{T2Hv`p$9*t_L`FpcoV)Ea{WP>m#n z7jhnC(&LMO+JjLGuO{N!CdPb4xgJ)@>3JbVn|d}MDuqMPhG6)tWygvU*wh{*0YtT{y+*NhAdeY&P3 zID|uby!Y#r_Ac254rGaMJ7GU)vIJm`egySKRP1C*Z>$^0SXW}#exPhWgzM)%^E!Ot z)qJBWqrz~Xx7XfhytfTxSf4&q@9LXl*=|Ue(|3~g(&tC+dXV-pJ_&e*cAHgv#0kz$ zQvjpE>Ad|?k;Nez5>o!)o#OnqxiJY+7z&3JZ8kxe^tzo3N@C%G`m|N8Lc~MZ;_DPJ zFfM)3i^%CS@%yu$2aw{;bYm{-Q>4NLD;lZxf@@Lay-0 zSj!iVdYxDwA7*~8*j_GeLEc47p$Ov5&~Oj*G%o0(ee|e2|yt=q4{`ohF=51Z|Zq&XW;~ph0lXq{JOlEGY<#(&P5-e|eb4k^kipr4dk94U9QT zo{R9U@Ac@M60fhaxV}(!D1A#VVyq2@Hj%1B+^1l-9J+ln#wH_SXNfq?!OK!XQ-}Kb zk_|ar>gG{kB{c1KHF9>hhZ4&Oq)}Md?pU?vAfRS<5WA8WO6K;C^^lV*Qg0>1k94oh z%oE$W#}iYYX+hg0EmR~K$AmOd>4k4jdE-YDgal`yh#PQy8Al;fP~V4`F$u5!!B2n} zE5+29K%5%K*cory?yMtkWmebM+m?z|$qRg9@673$7>|ghPG__1dAXd%0Mfg6n$6uc zz=Iw^-bmtkOi2|h%?2enq@aLIgQeTdX`Y5_bPh$*k|mOtJ8nvxSsyTcD!UWWjKE}X z1A6daPtf?bv=aifT7F^i?EfU1CqKEY&U6RQ|D{vs&?iR|`0X!3hp*=9<8v6k6<1w) zU6^ImDmXI0UNAMFOAZe&#MR9Szm~X>uzrF&3hFk-k~qWv=V${H`5^GDNVr16KoK8Y~H%8%=57fW@z%Wd+#Yp$ClWI{* zqor@t)-xouthT`f(2GV+m`GVSHrhaYwYy^dB%$?`ES9-8MFCX>-Fdmkbv@*GszO9Q zRhNr)wMVM|>9T0^)h2fb9d=>9zq)AGaB40TgiXI4*~1^Zd!v@IZ}C}{WD4`&@d6d| zIJUn$Bte_H1b$qC2aQzo$4y!}*s^aK~LdLEZ{loQXw_xKK)g+L5Mk(7sdPh3nX z-nNq~mcU$NUkB2{&nktjp1BW7TO|?il<)-fOqH|xijQa&+?rYD(am3fY%yc-m0f=y- zDLQnzXEV+>TpAJ+*4g4EOp{VW60vYW5JRQ6bs-c6%4b3MhZY_g5Z(DSNn`?O5o*zd zL0uHWECCJX7Ku%;mk|^sba)2?4iD|?3HRF$J&;oY1PS%w`3kv3MVPu%hNwa!srnMp z>2H1@izX?|^kK8BrFF+G<4j;pU?`#F1+LFT27*Dm-=%|hyKjuVb_<{vp$#_P$6aKq|)h1hyh1F!q+A*-skRW_UPH#=doOQhpGK_QbCA!qwo7w3 zcd}yydgUJ1Q2WT8TE>}9aYEHwcV7D0&>50F@9?**<=7L;I4kxU#%inRFalyb| zGC;vqG5nMydNIiTm7@V6Y>u~ATG*t31-{fR#_8GOAc&97>gT{!(w9I@7Vk5`sr%e? z7t^`ME!cI|*^G2wyV3HtCQXr2bZ=J=|i|#Hwv>zyVbi{kr z-x)x#n8@A(m6IPj3xm|9rEk};AxpG5@Q+q#dqM>q-`8}qjoeDvlZ zyNaq0cupN@I>9HntV!nSkd$2%K{S6H`j@$ z21}1V^^|~;X^ST87n8bTAA@|V8eOQAFjEx@K0jIvows$tzR&xWu`xMnJHCeSriI$M z`|Z3;m1nKA`2ZML+$a9ez18buUjKi2{M)N=z0&y4;d1I(Pw9-0J9~xjEj>2CC)5Ur z%wucqxU}j6m*e%6&a&n(jZG7G=$SD+B-y53X zVXw50IZ)utZuN+BI`87F%puWj=UKa@y#T#FEVNrR$ocksGYZ{MI)-Pmws*(wLEvUZ zpjcvngD21kB TE+bP#h8N{or-u4VqP(2Ae6=ZFGmnF)z>V{x3d#jXUdwk4s5K*h zi*~_eDHE8;qZt*x{F`s!jNZ-BcEPQ4*pQrkb&r*&0}bwVbm>WJt@w(!znn;_)ux&X zo}F=fPGJ~lJ{8o@4G>D!YArihHfnOF=we_o%GxHX=p#vFm-D0LklBgmD`8LMHJ*vH z@++)%XDdlc$%yZRdi^Z5ZN)c4#V3o_Up(8Nr~VsADsXp}y&l6G3W+<>VP;R5I&~wH zj~3Zzw^Var$fHD3lL2n8Yw?7;)k9s2VCwO=}dd*yE3%KznYQ^xm~2d6uDp=J8f zP(ePzx0Hh>1Sx=Cz?oU?$uv@;MS-Lvb|7g7R6^rWbp{gzsPE|Q%<(;`&o z!Xh^lLsEe<>U%%dannZ0O@X_3erGfs>hRtV?LM)C{Q4r-C)RS6m2tJ zh8v9k|Jw|^AKsaa2=%QOd-Yv8W0<39W;#&g;x;f{*= zllZRgx?P)t5*rp!5$&6|OQ;9ky$|XUr&5zHf6Ci2((=xheymft+>E83V=?ZaYPwI> zRo<0On+?`Eg2Paz&?C7|+3{Kl&V=i9B%Ptj4`r;j=3WEE)UAgQQ(E4AvL<1{DjRVy ztECCa-RuH4(?UHph9T$ME}vtz^`W zVr<6WVx@p>TXAWlmu0S{DLRo8!c z+_F^u<>5;`T_>(GOUY@C2TNDeRKq}JS&wz3SAMuGJrtGT=E!!>A znswp_dCfzfVMShJ!{IyE=Vp~oO}Q=SR5cm zzMQ?YlTydKV^NNqNpUY--K^0>(pn^Cg0TdtB`$PeR4K(U>x^`CCvnfk%c$LC180nj z7NjlMt9B{wy|22Q58n4t5wGWroF`%x9iG{Z>B@uSyVjK>flZOoXFBf0o{h-X7AED9 zsEG#0MTtjmU#;}lZ8`&^(2t?`nS?wd9z*jNK~QIq-e)*E!TF4!?8BXv-wn!@HAQ!< z%bu|v$t+ee7i_G@r^}5GT8<`8Cc$vx{U#R{fiYN44pYCVc*u>qd-UEzKwKMhAefUQ zy9rTvzaK}!(`YQoi=2EoyYbG-mQqk?qGH-f&}NpU^Xf=B-W!GpwQp{Os=LDK<#Z?2 zbOIGPH2_&1wF1R%i#ns&ySxU9BA=uEz3y3vPLYqx`9V*haip)WqVtOr?1@(*G}smj ze8hA=B5f$P&AW$^Xcot5E9c|+#IJ`2)j5=&tyxY=SInqa&;Sy4y)njG4DLbx7xHy} z9k1f^UF&hf{r@Vq{~j*)v`K$?SlKMMni|t_3v?sAgAr0O*LJ`3ijvtVhZ^^IY(?N@ zgFqEMjj9gjdFt%U0On8rRK&J?^tVpxNNd2Cqn$}bi7+~ltAsTzCxQnt*{v<4E! zA0lNH)lLf9{4s{tP)q{k5tW{WuHMOM%IbZ?5FF5WVvyirbw7JuAs(8p1VUVem1s9=y1tPnDY<&99)%lqX zH|H!wBuyM&K%NInhds#B&LW-yGDAQMsLrM*H8I(ptWUNCv(%y4nWq-YbR)gclej=| z^A|~YNFE6nVU}ki^c@;o-ndAs$%0t2%!=%qS5gjuEi^x#b1OKv*~j2GUKoxk zggjoW48;6KrLn=QDg8*tmu>+4(22!ayk)VTq9^O*AKCI|j2hST_Oc-Y3U)WQ=R4KQ znYeQHCiucAT6X%CpQpGX*m1CQ=_2%m*tne$7%siCryLO7)CYkiYNac5DM~i0di0EO zuQP@Xs8M)ceg3fQ6=foe@_dR8!Mb_e|GV<|-=3UnuYdXvU4l&Y82wn4Q9lsAIBxa% zk8j@b(W;lfJwuA{^UwdVU!lqq6v(R%4SxOE=-*CCnX##YeG+)eo!l0L-q=CME8mHR z>A+x|wMNkYoTgS-!knd(N~RwXg_ywla9axBvZ2mH(14rDV8-#RR{zXD8YZYM8g&gF zl5tXR0SZ9~5Dr@^Hgt`YxG77F#e6K?@a$b2xuT-FF?08C;r;zl%&(DX9BJ$D}tBs^a$)7>7nMWSQw4* zSw<`)f1DGV{rn6oR{t3V$&Qt5QxghE*f`@0fQKp0)q^+%BRBtE4M(|C{JFBAazmf;a$xX ztvsQ>@$DtFHmhH773)jR0Irn{fg|aUjojIcf7zhN zq+Im1Z&sJF%bOh=oJ{i*K4t_Y*NFo@Jp@@g!jZ52bL0qk4mu%tVw(potCX&z3hZ*t zFH6?T@q(t&Fy__0gq+dzun%6> zpRWgPvW-b~mpVLXvm|-$Uzl$bcpa}0h47V|=IN@GBvGvmjNILYTmK#||MIv+;rzRM zfP+59PYC|#A`nIdL=iE$UfCqyH*ekZ9>Y?mYFYqs_gLRE8)4L^pTVNnKAyAVMT5po z&q+S6X5ubT&i9s$^;loguadxB?RyzuT}P<2xz-`hN9%`BsOE4u*vi7L)mCIH+HjEK z)7ycNq2rf}!T->M?%v3Tqc)JAUkopw4sX(|?w*9d4Imm9Ipb+#AR9XimE7?bSvy0;aUU}hZDAK7OieDPdD1_o zd z@`LE|)hA7)7@xtIPv%>@r#9vCc^0=2)hx`&543XJ>{o|TzzuRgLuN|9@BY_nY>{hZ2p zo^^B}KN+MM7X8Z|G0%H*sxCYYvv$_v>g^@ykBddmurVbIC4i%~hq zWYU7oP+PKw7u74}sgH;eIa-g<)3^$WiAR0I&R4wIQQ#oWwR>qW+zL+rWR~o%WjIiZ zi!&sW&wqHR;D?9)<-tV}Q;wKxB>KpP@NLeB-^1DTW5YQACd3sY2LDYiZqZ(EcPnZ# z^3z(F2ym|?&hvfiVN6hCb_Vz|;`}_zfC=nMaeIGhEQ{tbIHl%_WrnQgZ6hjeR8)Gi zFnLgsrEXJfWRjWAyNtFNQ|!Uo_*ERlP#R)qYL%EA3prenADb}wcJ-H*> z)l?IS+>6s{TM&_S-PH%H+G1Pc1wUyfdjGr(F`L2fdUJ>0B@UH?H_*|8e5L96k%>_*JH^8(icgUyrT- zzLMDaCOz%cxt;%^jg6ZL3; za-B-&kb9DivlV^b2v+4l)pX_kG(^SPN6aDS7bQbk7GPT#-4e;OeP{*>yL=h9c}jzd%TWxpY5^njkliI^ViPlszS4DG|HIabba|(39zfL)El#Xt9thDN>f& z`}S6(+$LA|-UQW0E-? z=ZKcd=3@pM#bI8tApFyE&rWRx2`IGxk03FOl(oM+kp6A9S4pZT{=0h^bag7|tp2%i zHbD3mVgE@XcD3w!`|RhJ{fite)CCJ%7-mZODau*reW1IFN7iV=xQT0pVsph99-T=b zr?`Tcj=#;qYY|FTzOnjL*dxJXUZ0k6Jy8zc`trH5_X>V{9h1sfFA-ae@>#udcMHcj z8T5`BPFB*me5S{$;iVS_u`o?pf(kUP+X_18C8+G~sUe9+RgF0uBvdB``zVYVS61V6 zNeE4q^42@w0ZAHJ`ITIo%9ZB$g0Kw|1o_&KPydmUP!7yo!k6Is4h3{5CsmxHf9IMe zhtP>}eQ3NJDWz8Fjw~)YLRgFCmRDjWK7*b#)0q)V+Y?O7{TkT2++z<7Tf1U=q9JBF zU@$29M~SA{pY#5>cn&!frzGyq_r9%Od1rT4#?S(^N#qMi)Z(%)Hh@ihIP>D8`P%$5 z^i>=DOZ+zu+_xmT|L;f$4dU6_1^LeFHZY+Vr-aSg=Ghu$I*G#>`5|cIM`|&QnaHWM zfj{a%OnOD70^>FMsU34p0m0Fpk}Uf~{e`jYrBxxb;k`m=n~lLrwHb3=z>usUUV-st zi}uhLMAxI&=>?Q{9zJZtQhx%4Y&U)s^SEv?fj%wo;ZJsuOdk>Dqy_S8ZmNBSkc#vk z-<`!+e!yI*riHYMEKA9wLgy*7uHENtDy_~>W;J52MnfHdG|IQS&<+J%VVSNB{pErD zzgdizl$yUhv~vp#&EjX1eY6k(6W?moZtosGuP(MU$@xY*pkE)5ATGyHwl>XFbt$id z_%58W5jm#=FH?s3UB5T^EHjzLje~ZKM-v{fI^T@<758^``+njqn6jP@gXQX5E@faQ zK0%y%3(`~KR91UsQR0x)g;H(2pm6sbtVA=uAmVEHX}em^(rfM9@o_?5DqG=)ErBgl zs?laz?9W~J;cn9-?7PqAKxD{BqIr)+7$(~=6m>|keR5o~kFp>@L(v-q&2h8kV#)nM z?kT~lk+V#F4zw`0i=`jzPC`D%V+h1N*u+0k?2_LPc6*W#XYqiCLugt4Wx{mcWXfh% zQ)l?(tzgXhXAy14#fap6lFP+p%Y2o$-Cfs2c4%O9K3{Kng&$tqdY+u-Z1=>ZQe3e_ z{LJZ+jNG{1)nW--$tYxe?TyTq!#k%>@^k)3?2~Ck?~3laq}%{G>}x<8G?W)GmSJNO{hm+A=A(Z;35T>Dk>il2d(d@z%=CWFjXT z?(8<*AYf!yXfU+B;=7MthX-EVqiHRAV9iT~97{d!ijBD6U`c4@TbqprZ7yUP(C2}5B{Nk6_G8+13s~l5}<@=yoz@G10;UWj&m>@xY z0`|Pvz>dE864w}3$bWdK5Y>VICU>@QGuxA*@AoGR?g?(q7BY+X#oz z2V{cW&vf0jkV++ums$iV?kwDnG&vH62#>w4!}6h$ECH(zUo{wd2n$PQWu(jAk_1t| zOLkj!Pgxry%WQat^$qTG@3+aMa3JW@8}g*O0vR@d*Lco=oAt(Ztpj3|BP0>OD5PRZ zlvSGD?V@{@=bJ5i+Mr?vMelIszCgV;Ul^&JBFj^mU{R863el3nCq@VSohi2>osi`j z&S#!7CRK$IE>dsxT#8*Ul-=**SVThmBZ75PSqCcDOqD<%?x0D$H^EC`nxA{cyNkUb zVgpCQQlOzm;%c>cipf{oZO0;MUmUqK7D0}&1i&62@{8hfoN!Nr2cP?r%ZXzsJh$raXU`85LmmB( z`KLytJd}bdK4tYE!EI=(!d3o@<-8G#xY4+mQ%hHaAp%m2 zB8{XQ8R>NT*7o;BZbd9YH}`$^K4$0mzsu5;6yXyTko3eqskQ>_MBqwaj{9 zP31c!KlG>CKGj;Hv{kW_R|=RtfR=T&DTj3i$=v-H8*U7QEV7hq^kP>MWm`YO^lK1n zl`x;hrU(6v9S)QuO{GKL_jiTEj6Dkbb7G4KuV5#U5|K8VE1xji1Nagz$?2v@;6BjR z!)Tmfxgfas+VJ(ck1RyWJXSt5K%m!c(BDWS(yIrN84v3zw#s14wvhxAp&d|>8Iv(n z0h_cFzXg-tIX*Fn8yFqtxkJ;=Vx$5DfBy*pN zmAJ#WVJ|Q0jBdkZu{1$KhtZNisycc^S;UgyRC|5`g77C?D-RqKh~nA9W39hXd@nE= z%|F3c`x3-?`sdehr;LJh{T@+j&n+NCw0a-F(_|Bhv=BQNN5|k0Ul+u^Au-ils&z_F zYli8%f3CPk6`)6AR0rOU*1c`$WG}y;scg4=&7#OV%gW5maie6_B z0qQ7+5O%!jr`UHJf}?_o`y$5?(&FhU1F9dw5ADMd{8(0-J&g`j?Tj(XGM9(e(?2ZGj9cg457Gk(%GR73wp6PJ0_;0iHNq?2T*s~ z2RWXRRK7OBggXqSR@bR4V~-9lK{l! z96-@}dAvqm9do7uiaZ(bdkVKRNh@awX0= zAG_{z^<&ih4sQ>Tm+Rb7tl217V$=xI&MUw4^B85d;x~@CQ%On(IyvX`DSFeM5bscs zRY`wexuLE@pu4dK{z)tBSy;V;E+z7Q<{Zs#(*%NCS+p&(c%1gQo&S#e^Ku2$N7)<4 z#c!{z5xIS**Bq3E`@}%UcqxyQ?=wlvu$sCd*F&nmWeE$LLSXlsy#wbMH}x}>?;_uk z^75(R5>F~#Vbvic$-vxO1Ms44w(?lg(uD=z5LC^*B8RiA1AVTp@)~}BbkQ;D*{XLM z<1VHOF-*c9B_vb~n@ECFYcf+{q(R#15Se;9^E6UpGzCUj$Rl_~Gt8i>3AP*%s4cAbt!K6CGXu>H|5jSv&>tgy*u>Yk_H6Cu+x`u6MO8z~#^PRCy$2Vae1B+fe4 ziLW$aO;{|lCR7L4v_l_Dbb73vJp!2LA0GcqJ)c7TKa3-Lfrkp?N5l*3;Uav%7Q`<# z23uDRG?H^MWPn7U-jNe7FVZu1Dy$w01rgOB$648C9n8{`P7&ltmjY^MgSW!Fp;HjTUg zrnzqWCBeAyS%mUO0a|bd7lllz%jLKfG3R>y+a~|`=9ji*=}z=|_(aujPskg8|G4kM z1$8O@Dc&c@$#{c$*7#Nq-cX_OqAoL3&GMHB&q`dgW@gPzVzQoIs4zN-j(I0qMeNB) z%K|CH*O||bL(^9`XT>}`s$F(zVmX{-j`Nk-IvZ}iB>VnQu6MdHDhB3y|4l=#_8xGB z@RJN_<`hT8 zfl0>khUoa-Uri}^>_&DBaX(qPp)`p=jD_8LX|xIU7I@HrYD>gJ8Xq5r6)qkGb_xTX z1V;sd2DCtcDn5KGf(QWFX7zPI^929^00Mxtt&x#|qq(h(pv@oK1qNfFqZ7TejRVlY z$c(`dNTO+OZ4Gp=Hn6eT@l8-NaC9`VHn1TwG;jnO6IlY?i5$&MZOm;3;2viGCG5@tglgNZF$avn4~N^wzaK zu1^AXXN^LN#h!5Y9%^{t37`DgSX18Wq@KOJbVetmiVH+fymBj@j1>Nufu6MkwmQ!& z=Jlb7k1{u|`Qm`zIh~HzE$lMyow1tt_IJa+3x@HxV&16Yxx~txG*GgAOynoKuhMAA z?c?**wI_<1y1g0DM#WN2I=~`O^L!NGk6lTqawkmiJDz+TcVY;QGMgqu7F$+nBnRV z|E;-tIm6K0CuceA*1ijUOeOl66J8pkvG8<^RfBpmO`WNEQafKJ zHM|Iw_WW&8kh_=Kw(mW;$(nbW9X~Eiv+}+(yJzX3 zsB@H|j1?zW|5S1d1Izr&vL6xxRPi#;{*OE~Vv@=pMl$vM>+t~X0oK(q@+xb9cl_d< zfn|RLvid_9%(&Mv!)8S&M)f%nR4e2c3e%Lj0(}Y;#_Z>HTV*V#!C};aHc<5%wRlS z&OIhEEK(puDLeqQ)eZXn)09O`@F~ioVL!~8{mk0a>Gc~lQLlicj!8+l`;i#GkLFk#<{zsE3noz z%GA>aw>!{VT5F#Sa}gPA$FK3jJB?VKoAm z6LlGs4F0HBjv+N-8XC8_*23JA#Dcyw2^AR>@G-&e3l|x)4%7L>n_>>NF~Vr+_I4sg zd^sru^(9U~m$j#SxHG*d{B#@HWM7_8pk03DrTl3#5;m6z;~X~FVu)9p=!HsYh)q2h zFH~L~u|{Xj6c?z9i*7^Y)5i(H;8qw8e>ZAr={R3Ns(d<|!J8kV31EYcEu`@EzA2ga zPk8>xH-EzOiuSLW>HmbMbQK<8c%w&7{(QR*a_R~m$YXl=MQl#T2Ux2E)^tXT_DW34 zJ?DZ*FI+AflRLJaT21%fAhRp=8iDlVn! z%fwli4qb(q#f{M|#W7UsBmIGn0kxyxu6#X=+?jdyz_`@XLKqZ_$;g&ND$JqvvD|>* z)ss*jqxOr)<(rAOYA|DNY{%EobWe~Vn08gx2)D=@DWv$X{Z`+FJr^L^cQ=Q-Kxi?= zBScuke1TGiGXX1Zj{NX9q!Cr)2o6Nu?6$uXzu(bT`GQL?Y~+ZQO?(-fYeAx*@hwd1 z&dpcvgtnfsqx>{!-LdA|rWbI%7b6=G&I@LebF~h0A7|$ zg=E}r2UwU@umfbMoIGap9v0Ce=OtRMpK^QN|B zca))MX5D9}#O^&4Sfh*#)hZe>iN=@8(H^Vm05^(T$vVzpuEHe$t@Ie7nM|bJ#$~~H z-a$5o!5KMG1l1tzw$H4xHVnF}=A_m0mm`f@83Wf3sAEhww)lv{ApON-u@+r!RluUKVI{riVil#nX6gnq#q(BHd_ zBkM`d#AND>B9?uTO7j-HquCthw78N7;vO3 zttlGsM_)5sdwTZl6=C4gyHmgGZl7v928(O{ASLR1S`iSr>WVHx^l+DGU9!{O!Tqnj7wFwwtvdB!;ray7jKbBv|KOZ(KZ2Y zTAob7`prbsge~cPWGx`kO7fL$Q)8>W)Xq`u=a3fYWutRgSQ5r7%`e2*9-QorIB~Ub z1AD)PD5cZ3UnGYeQ5Z(Mg3`0!$3&;G3D7;e6U#wqLy7>0$6L#qd3IVxN0RJO^HiWC z3E%y_wSi0t99~q9VyJz@JFag(^3qJ0rs1;8`PRYw7ML8ka8PYHcW7ngK`o|}srlXZ zQc-r8aghApNa`*@PsU>Vt>1^;rb$Ru&=DZDc409ocWPhY)`?E(X=5SB8;^PlH#FNS zD(~b`+}g@9Yr5*61LeCs^zaG)VflyK_80BOd>W4x5%G_DUOcM9 zBpN71ijNq)Pq^4AQ_6V8MNx+^vy%J(VFpdD(8B?Chv(Thvx!#)@53lOnQt1rJ}L%Y zf6&XIQ-t3ZOMnc`@S9RH#P%JaXzxbkCfvBR7tNV@B8N6B53Rm2p=H7eU@KrN;KdaA zUeL7uuAu(FG14FWy`;=2oL;jn!PV%=xuu8{cYsUX6w|u4<%ZXcafrAd=!fADL{jxC z;sACi3wM5L-Q; z^;i(ddIe}|lE!wvPC{-li&xiiTt;s6pDkei)!Nk5eC~Kx%EaXn_R2I*QeXNM%m8(e?1nHc?FVj{X z=K{m~yRH#x`&zdEM~|P{PItELp4TKKGWpvW#B47Z7nCB&JztKEK{ZJKAuMVO*D=M< zco|&14N}yo|$fJSPH#5nu4@e}7ZpnDNioukwn`H;B8^y+FXY=papU#s&Y% z!N~`aW5%K%4|Dlj3MpEP5HDhj3p89yV+|%rzcnGFc89@NGHI-0>>Q_jTx@k~HA7^8 zI1#&s6|`Ql^!uJ*M=!BZ{>tHd%SRrcC~0!XF)3HfE@GtlD=GQqc-t>oYtIjsl)a^5 zVAq%^l~saBw{l;Jie|sWNPX`JZJk!xy4XpYIL`|2r7w=PAhFBcxt^CS(<(M#6;XW% znI=hccq|Dz0zMyw!7(_v#(-Oml1g~Q8*Xktqt0`6wc9t7zfm@xp(i=NOrXUDd{z&az(hQZT2KBi z={hQgcBTr~SYc?(zlP^oU}7>!984RP&5FZ!I-gYzunUTFrHLp5OPF$a(m-ebWFien zB=@UF5L6et|KhsoNcj;8+0gsgp=qWfJR57|VWY+o$|IZWA5(k~CX%U|fBh4mz)W5( zrj!1FulGKSNX4#lIbTfs=CnIpX;)cRqtrs|?#|eL(nH5H1qGw`)la68y_w(+37kw# zg|8$MBx5Z-n|qJ=mc2gO*|w@F>98Z#`S;LCdSN8&{@WKV(Gr)ny2?9V{#erJUOis*B!q435@T1z3CrM~*|`(Z zAH=MhoF;t6=n6+Q*<;80TgJeK^QTCN(rh@ykV!PRQY5NohL#YwCmxl33cxlY#`tV` zas#VjA}Vl3qO~P)FGkL%?LO|^0Z}C)R@J8&%zYlN8zaFYoql~>2}J2Nuy~nm(8Ti; z>GuVpMKDKWFw8Zw96B^|#!8%frwg2Z&Gq^&lxL_ADC|0mbNrg|7QV1GtM5ULBWn}T zXyL*q>jTpXGs7p7dV)2CBPu;p?Ma(su)0{rr~2&uTE+$@Vl)jsYju4z^-Cv}pW&~= zm=}Z4%Z~$|N;tQlfi60){BUdGyH_4rjJnZN{>K%vJ5Zlwy)N2XVdoOxW4(`BQF-Fw zjnqMg0oVH9Zlt4$yArRl77iDkubnxmO>z;u{ffOPU?yyR#-f*}VSCbi?}5jA&x?Rn zIl0>St9Vn#0!i{C4;&FPEGwG56Hn-`q*|-;rqbP78<^2v#i1OXT4KL4a#G&vCnpJu z!>2Ut-#rC3tc&V;85k3|4jvD2T_4Ldo*83$_nn+tLJbzw)m+=?rjw>ywo%L6H`wgH z*Uhorp=WP^@da+bmEI2(yN~ZRFjXOs)I}{ADxbJO3!&ermy!%}oV^~c`|0hrj_@6; zHP~n!9&w&{$8{KS9F!tgdA0G}I-Dn>W6w<0XV=_kN0jLq;J(on;`Z|bg_gqg!(I^M zynKv#EL8~K8*VNS5knRj@7P?fFn@fP(TmYOcVRihFaNH=zvCI@o;N;I$YG?*FA4vv zmY{xQt=-LVql|Z9n*7s4f;Q@J|6dT`U;e*H|5$**|7`*Ghr9ncePN5kd?RH|~gf_IUW zzfb&YxW{y5@tMFu1c$6hiYZ0w%CVN#`EoL%;hbXTNV7@6I3?e508Gu2^`~f7O`p!x z>8Gr{w^y{^CX)oxwj1{ z7+`6j2;hqHnpq&ofRk1O*J(vk%d6kAUoztv3rR4}2eI4TODMr?OP?nOkN5$-=*f$> zxn4?!;=3#u2F|(PiaALn=T8g?h0xg9g$Nra2nV`{Ruo%Bd~@y5$BQp$c$oMh*OUjO z@I26l3UBcyK^6JISISI$hr~~9*DBV;IwZeE*`skOmUl#5*sH*jTe00}!w03a*sNXE zh0bsfSGqlyn1kzer;L|``7{fkiSpr=J`^C;;7w-e=%-RpzH`YlC6H#BFDRzQwnes; zPLz)vR{n4X&Cj{3yw}#!NEp~I=}f8tB9{&*E6Ijh3HERORw)_U>PaISdgx8S1w*GmrSW z8*WcV!0SBNetw0>uT0iS#vH;BLhUT>1CvKZ$;}aavHN6vuioL2dkKAi>4XLkOd1+M zmLzXcx{3bz&Qar$K&e3*`W}^U3{Pw7rgq=H?i}si)>eqIJc_%M9Lr6!Z%QbR3z8K5 zmi1;FtW9&O-Q!_==D^{Mud;}eSre~Xw|Eo(yzzz`52)&Lwt0$+k^XrI7kF< z3msu@z(#M%txAVAOl_0!nK&PuEd@@%MJCF1evv0)F6BM4}arD&MEji5k=7+nS7 z+BoY*zx}rhFqg1{vyCm0gn_xC6_AKZ&JJipq-5*tU<4!*1-byOZ0)RpHcr$;yoP_S z6Ew0iceMN8hqpn1{t?t)rhRbY?El%cPfk)Qk>MLgFQ+~-Ad!;65KJT@kD@IAgm@!U zyYa2X0}N8$M{bGxN^qr`J0J0)X+ld)cBhr8i|jJkc(TC8YjP=?deITu@|~5CvD7`xKq);2s=Q+8sFEkk+1YYW=lwnzP=+IdFOS43LF@de^g0d0`-mRnZdRP~ zji{Pc6fdwOdO*&Ec%Zf_xGZ_~aMW{B+yz{bb}s9xT7=ncaodG$z{mUBr3`d8HAyJP zWPAR1pkY)o*#q~6J&{B!xI;A@5q;-vZaJL#JCpPhtK_W6$?v&M&y5;im=|#P!|yi- zIYf}sU+1&Ne3Z8%Qw``GJ9;y*Y8gn_*K<_z-a@{yg8&1-H+-MEjl#*0C zu5`wK!z}xz1H7$i)?jnx}jYQ`6iLVB_ zX4y!BU?z;m2+8{tyN;<9OwJcKzA61;_f|wuaOD5CmR6M4`fKLz5RMG+N~3mW%LkB& zK(^DAmt^r)XExYKfm;lZK&NF5$bdq^x+tU(`g(j8VI$klH=Cg7{Pt&*z`u|-D_L=T zMIM}T!qkNd&Q5pgcd+cPC^q0`B$IMs>_3bLo`i(k;YyOIoJMo+ZqqmSE_yqF0i_5* zv8s-;sedj%O}xkf()8rj{|(Yxgw&e2SxRL7vhHV)MEin5xi*Fdiizyi81!9?rE1>T zt*}mL3hl#Y$d{Mcj0Igx>u0Zi${&_f-`P@9!~$^0)R$B)pXdXZa3)ABW#z>#c3Pkv z*1ZD5$>(@=t9u!Ca;{-I)vlI`NaE{38IEb>VWn%$*d3v!o~J$cVYbuoJM_LV62lY} zfO_8#SoH7yXGN)pvIy zTP3=TVOLPFWcM&U!aHPcfL9C9=xfEBRa_n!Ood5udrGUxzYFkzgK_RYTE|Y$W7Imc zf?=twPPD+PE8WLK?uHV;S>R*`Uclo7X zm74t`glfkgO4qAiCr0*nU5fPH%7kF#J(#YD{j#d?^y;#riM%xNV~`DPwd&cKi^Ks; znwdVVx}vH@Ea?cX2_Y9UQKoPX?oZjOZ&f`2y()=cj6?;&4nv>%%zu{>pydCQ5`TjU z9^x-B{V65>;g7B`GN5Zof%gP5)v--Md)Ja1yPvJFu60$>?~45Jj3qfRp~?aL#8b2JDA97wt|n82Ft37KaezGFiOh&t5)9pe{m))C^J zNB!f^J5?q~$%9uC0?ngapMFpZNxgMtqa^umQy2p=^VKwvOi~n!S1&3TpGuxifp5Ru ze)>aM&af#s_2sEzgo9XlilVUwX8qumBZy_KMfsa%4*X{_2>!U0NHx09f4xXc{X z-ySs-0fQ6y4Sh~!7;SECNr(Bm6xX!Hi?bR3HWCH>Z&$$ukD{pJz=4o6}FOP zbeh_#YE0{8zF>qjbtNksODfRTDK7$Y z=i*B!hI=B*F-_1^t13_(Gzxp#OA`?Ueex}w=}YG7API2iou1?0R=_2*ake=SqSxCX zPhW;J%65rJ3IH_vwyVJg434FC(FA61oe@f=RBVxl=$@%dd>(WZu`<;Vy9&#MR@1)n z_7PX*35}h$gq|kKeZz;_Cmyx-tTFzf*(d|hn<+9kahf=7zPDAI!p$y|M@h%+mwv$O z-sYU8hZl#<+;CfvSw=IY78(X9Pho;SVaan=wp4TjA?jdXO#|^MBdI#3`&-ab&Hf+0 z4-D5D2KZF2IGZwGRBKqZU=3*zv>@{){jYVvc#f*{S#IH>N|49bk-QpXVFcl}5-oZ1 zwsY-CDi(qd;`rS*VB{WFB4guY>2jjkyV?>jp{uajzTB!m`VBsnm^e@lF@?81Y#wmR zU7yiWWnuGexgjj>>Ues2?yS>BrrUDSD~V# zFIv@s#*^G3A2%id*3Vv_pKB%zlLJWT&wS;na~OW5{7{5h=kcisRxU_ir7MtX3wGAB z;(8=3%FyUrZ2!9yVpMVhni$yF63G}iIT<*Z+n5vaI{tl%!Rnt=f~J33w+u$M*8E|h zTz}aXlR$v}(b0dJko1Q=`p=LcHiFKMJ^@Idj%nBgsem8eheelAn4_+i_5IdodH!_c zh0e^{PmmF58YxMB8r_ISVbwbiNk#x_{@{EoQ)f2JjU-#!*8(4FOle#EO`SHO8^C-h z7KvP*$r@6qd;mquiayW!R6z-U_60I^yW4SDfi$P5lwq}XO|oJXnNRoHx@U#-Q5+lY zgHHN5BPLJQvT)+#3tK#kP4on9vv*Qq<~Q}ve36F9-gqf_x)cWilTI<1LA(9RE7Z5s zAT`as64ldirom1acd`rBJGG(i&|`V2S4CSIP&?1X0l3fTv^Nuy-qd}h7!1eO*aeO@ z!M)y^P-p*km9CMolf7}+5$AbIq$E_g6wsfi$qyl)?G3;nBy5B;VsA!#%m`%;UbXI& z!+L`(lKn5ZnIteniQbNUqn={K(FReze$-ncXBM8GYWs>h>SN^SuU|sL`{YJa8V^NppKSsB1|W;nm7F< z%?p-Ah5(`IlOVgU3Yij6n3eZH0J>i1q^3S|3q=HB7Ju0G^$zkVTXrMR=;qMV?+0uM z4ln!~4UTPWbIZJ6uL5@Rc1))m-{rT}|lo*n=3L zMAd#vF`*5O<_UMQLQy;^_&9|OrmPUeZC_yoM`cr=(?4!rt^{t zn!z@gu`5HHSX5>Ms$~^wz48DxcLh;$+$FUi)$*-fNR_+JG;LU3_6f&^xf-+YC*5Qe zowoO>%$;`wYjFfnztirrt0?E%OPgxHBezBgXjHW<`DYQn%uj*okplVF>z>Nc6dD_k zp%h>D7K@o$AdRz#IW0VnXX~Bv5F+bbt7P(~`mdgQ#+ORx*S)sL_(g6yKZq`<9@@W) z*VBe7-vv?&7H7W5+nWhQpm^<&s+#{QvK(7oh<{YUf=| z@gK|#V=UzePkAOs%#>Z%qV9SBs#*SP{L$Yi`D^^qKg7_~M+W>%{dBEmdPBkx&yk6z zQH^ufO~n^5$!?7Ps=Gg6l5vQXpjFa=*E#Q0v8z9 zGD|Zi`L6tKsz_CU$m*Z);=NXmK7P2s3{xabU8KgiMuXV0w=Dul1hWg^u z??pF_&QB`Jh}RSx1m^1HLN0jrqE^3xeF5UuS(cUE36)F9q8p6nkA%}-yRbykp))spQ9M3cYDs&gGEmBzXU4^SO; zoA90o4^#4W)+;<)S^9${@_e|msi^+yOs-pE=xgx*0iKbJ_w#v&wgi5{JS`XLO>KZ~j21Qv~6It0Ol+ z8L#BQ8UG$;w#w)z6(4&^qJI;w;Icq*TgK1TcD<1u-JHLL2`isQ5S3_NAcNs~Nkb&P zOZs`n#_K2~cmWq)HdWy%%(evSzI2$b@=hhal%VRCN?N3SwvU$l2m!G$nmsLfDNkWc z&zrmO)i-Ef7<1{~NVG;Dq6g{=;|;yW7_Ufn^3O6vK9FruA>X~yVjLH5hoKPrOi%MRh{fD z9y44Xv|GT#S2a(Rt|5d;{EHhiv1UZ%Aa28%Cz-(&+I~riw`u1z^_xn!IG1fR^sxg- zF$!DNNfOEFoMZwVOQ;`;*EVN|5&;3XCgHZ~LQDifel>9O35=YQBA_a)=g0};3 z$J>ddg6BlC3^N~_F~Zi9gDl-wk#y#+qOyO38-y1e>(5vI|3PN(5P!++-{m9>4)v+c z=wo4kE_55RDJ)y@X5^i)=3dk_e0lpqCcb5u&Q%Cl(n0i|r~Jg6BKJFzBJoPbDq!-? z(U_ymNL*_PKU`mG?YZs=xh$Z(%0|nLK!5{N`14iU&4&T8b zV2JuAPF@yCX~cgI8G>xX$HpvWf)-L*po~SRBOv1n-?{nj(WjZ6ESJ0NsW%C2yi>$t zdgXU;0Nirxyo%X{oSQO7m65up&vyv^XMg&Igfts(eqB+9veueMo6gA>(Xv~HF`+(7 z<@k<+a(E>;2yH@e8dCdK-RK@H=p*QWu>t)CsDwhu{v26lk*1GJ#k7JGxSGd5RMVcu zPX~bpqz4fJi@w7@Z0PdD+&8KP04oU5K8nOemELf9w)i|nNfaMfQh4NgX($Oc%kE6? z4ciX*2f+KvFVGNgfrWH(2WYQBIHzq@=c9G!mo^BAmzcQXv&NbfDQXXPirfj%O)K#L zJfZoPuw2z-FUjr()2;-{FoA#=p&ylZ$6*dr9J2jEQ{@7VQ9*fhXuFxE3bYB=r`}yX z_x>uJdpX?Jbfm^wm_n~|H(rVqcL6efa=vzFrzh=!JHoWYv#ge*G5kkEwQZN0s38yR zs^D%-^i1Du8g4X0Y;oD#HNBBzPP2s<`Yo64%L&5XS`?O;Fa5Tq{d556w+p>FbIQc6 ze^U)t%GS(=NYoZc#A{(|W+Mo6GqAR^0{-1`{WqjJr}iC}d&omRQGPOQ33-kOWr;6C zfc{y^zmc}h>ieIN_RlR;5zv5C4?6@GGiBoR#tq>JloOwoK#FQdrV58vQuBG5n8d8O zDO?~AOS9PBbnchMLBk!8^;U%7*@B9QA?w@FH{Zm?<;Y$wVz7)=mr7;m)b3X+>L`Q` zX ze07yW3t%TfVt?e{yORC!2WkJ(VB!AzUMS{gu1fB^ep+aQxi+GUp6FsZ@H&7FbYo@h z%-ITk`O#NQ3tO=HT!Mmi>>By8xTIT6C&I_0O6JEt*s3QnxuKLqkDcC+JQJjsT|X_+^S58PfR$|piii%9=tH<`lZk<+;Y)H}grmMDCZJEMvkRS_tH z9=Es)v?BI4nF)W6Jx^<><`M?}e!gIt2gYGc@ zPm90;EV47g- z(mWt!qyc1F`Ac7a)08uF+d7<$ed5BHbdaeUYEd^s1>Ls3%1E=y}NqaR?z+!B(WShebF2dM{->5my8Wv_gkv>u{Lx)=`#6+!u$J*0Hh|B z;EYXXq88tsf859f{Z0kjbrKQ?$*xlRl%Rrd^$1^;3mVzK$thP$-N&COtc3uT5lIHj zl-c%f1xpU8j8GhCkwVMoinDx}Lw35%^gu3J(FGzluXaSscKfaLn^Zz$j9u4xDrBic z#hSP+1zhV&=7%}7KjP(#eOb7#2M*{WOrpUp_H=J zD@50H@04whc{2tDJphb+wCj?_5q^p zz3%ZedM714_4-zk8;WM#;)%mWzMaJYCX@>NsndW7Jl)HJ991BpzAH)Nv`qg7P`O5rAHdzz1(iVeF`2ip z-^fIBixEoI?xDlc4d7%8X_t;cn7@RMNd5?XOuFfjdI6;qC<0lXp+aUku_P=+=iI@_ z!q9Js->-UXcNuEUXS6ZVJF9YCtnuhN_Vi`?;?58 zK(9C^q#C^6c(o5mWbs}-)#IZsCRx<52x=SCYo5siv)dBrpSma@Ht*>AlOc6r4HiJ4 z0Ua0v%XhHfciPR&id{i-TYS4O>n?giI|OZfyG)+SC`Jdznq+`dff6A0lSEhA&B_Km zeG-I8EJfpkP!j09#N=AFEF>eQqng5Y}IFR_trw_Uc9I{4@zNs^#SGQ#A<| znxkb&JleYzp-Edr#bcBBqg_tdeUWSWH;%{tg7=9?FKf`;@+ZC62c>M(nOc&{Zs}t_ zn7`;qf@w81Y{Yu$GWu!Q}x7Hw)LsilcWG)_-S6 zR#5|UOLHO>pp7jNm9?#hxs{axkt5K^*#SuOr!_}S#B1yfw6PU*02-SaIQ`wJ1Nr{f zW`GNW7@SHHw>@^9YT@3jp0l_F^*AiYtO^43&l3O1od01P@Xy8EuuvZiwD07HG^ix( z5Pals7^)lG#@S@VpFPnT13z})!UO=;6zP>jS5{}^zXj9a2{Qr%VIItB)W0TgWIx~3 zL<{kyDaoYy!lK8RJ8_azGl6yp7TO!0?Y=bd*=0W`T{?ZG4zZ=GGvhkbzRF4%{uC~G zU?(v+F0Pu3(4uhjmQ6x9A+;5e)k%9k-u76&?&S45{BTdTSVfcWEKw=Y!@naMYF77H z!VwmlaiKa_v{wO^Gqk&}2>2c#no06qhisxXD=CoLg_FyiGlOL=W8GM6hXSkY(7Fqe z6s8~|-@+ovEoY4{AB=LjPr{9BG*WTioPLHV&xlmiX=wHm8Vkbzf!x1Txx*`M)ynmI zaX($Jf#s$P5J3>wrR}oQw4eJZFzmf*GUPYiT{WE0+_A58u!eprF`PP;RUks#AJ^pC zP&3oV@3e$pgM;~lV=9Pg@X36uvnLwNEUygKJ!TutU<`d6%+})3+fj}OUvFW7DhCNM z9~!L~@JZXOq4XT0U;_ay;RLHNN6WF#;Q2Gug0ieP%qd0RcUl5bMUwPO$`?FzJiL zS=Ohou|Ch!{&1f*4bXmckVnCt8(&>biS?`-@W?4}7D!W>`V^nANdE;nj=#16ME`@p z{%Y&|BP5u2s840dsutJyGcch*%knTlrdym$q8Q6GM zM9XT_m}YHMI-Q~KWqcMo5+CJPE&8^ZOjQj+tV<)WlP`&`5S~zQxWVWeC|VoX&sg1* zt(;E9m+u0QW`!=Ytm3Ry@32Xgl*r<3t~nef8Pu6**Bb1~ox4XDgnj7$eKv--755E0@g7<^{ZVH3`7zAk_f+5=+G@g$NUL>o~_dO|L{9A48oM3_VLVY0hqGb`8#5*!w|yiK{Bh@q{`AhVGj=58L~#I5Qf${-5oTz8f@n LgW^y2I9&e=>2^@# diff --git a/sources b/sources index 2098ebb..bb1d91b 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (gnutls-3.7.2.tar.xz) = 5d01d561a05379da71e4847e30ba13c2abe09f7a5c4359fd539d8bd19abad0ce87120f82ee7b6264e787bd3edbc5ae16beffa892983cbc3d59f11a1811c10329 -SHA512 (gnutls-3.7.2.tar.xz.sig) = fc3314c0ce5fb608352fcd8e19efd14435e4cfa5c0eb843d86febb6053fec7d46774b637037b96c5a621a7001f89d6c110f75bff96f94c2a77caf5d9c3aa9447 +SHA512 (gnutls-3.7.4.tar.xz) = 38b488ca1223d9aa8fc25756df08db6f29aaf76fb5816fdeaa14bd89fb431a2e1c495fefc64094f726337d5b89e198146ec7dc22e9a1bca6841a9d881b0d99e6 From 53fc0044f8ae64a2251ed17169ff22990347f37b Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Tue, 26 Apr 2022 11:55:34 +0200 Subject: [PATCH 16/18] Add dist tag to release Signed-off-by: Zoltan Fridrich --- gnutls.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gnutls.spec b/gnutls.spec index b7f1a91..186c77c 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 3.7.4 -Release: %{?autorel}%{!?autorel:1} +Release: %{?autorel}%{!?autorel:1}%{?dist} Patch1: gnutls-3.6.7-no-now-guile.patch Patch2: gnutls-3.2.7-rpath.patch %bcond_with bootstrap From 9ae9cbb42e06a118dbbf0bbd63a24442988a7f79 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Tue, 17 May 2022 07:56:18 +0200 Subject: [PATCH 17/18] [packit] 3.7.5 upstream release Upstream tag: 3.7.5 Upstream commit: 96ce6ad4 Signed-off-by: Zoltan Fridrich --- .gitignore | 1 + .packit.yaml | 33 +++++++++++++++++++++++++++++++++ README.packit | 2 +- gnutls-3.7.5.tar.xz.sig | Bin 0 -> 685 bytes gnutls.spec | 2 +- sources | 2 +- 6 files changed, 37 insertions(+), 3 deletions(-) create mode 100644 .packit.yaml create mode 100644 gnutls-3.7.5.tar.xz.sig diff --git a/.gitignore b/.gitignore index 7c7df98..dabacd7 100644 --- a/.gitignore +++ b/.gitignore @@ -137,3 +137,4 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.7.3.tar.xz /gnutls-3.7.3.tar.xz.sig /gnutls-3.7.4.tar.xz +/gnutls-3.7.5.tar.xz diff --git a/.packit.yaml b/.packit.yaml new file mode 100644 index 0000000..a27df63 --- /dev/null +++ b/.packit.yaml @@ -0,0 +1,33 @@ +# See the documentation for more information: +# https://packit.dev/docs/configuration/ + +specfile_path: gnutls.spec + +files_to_sync: + - .packit.yaml + - gnutls.spec + +upstream_project_url: https://gitlab.com/gnutls/gnutls +upstream_package_name: gnutls +downstream_package_name: gnutls + +actions: + post-upstream-clone: + - "wget https://src.fedoraproject.org/rpms/gnutls/raw/main/f/gnutls.spec" + - "wget https://src.fedoraproject.org/rpms/gnutls/raw/main/f/gnutls-3.2.7-rpath.patch" + - "wget https://src.fedoraproject.org/rpms/gnutls/raw/main/f/gnutls-3.6.7-no-now-guile.patch" + get-current-version: + - "git describe --abbrev=0" + create-archive: + - | + bash -c "wget https://www.gnupg.org/ftp/gcrypt/gnutls/v$(expr $PACKIT_PROJECT_VERSION : '^\([0-9]*\.[0-9]*\)')/gnutls-${PACKIT_PROJECT_VERSION}.tar.xz" + - | + bash -c "wget https://www.gnupg.org/ftp/gcrypt/gnutls/v$(expr $PACKIT_PROJECT_VERSION : '^\([0-9]*\.[0-9]*\)')/gnutls-${PACKIT_PROJECT_VERSION}.tar.xz.sig" + - bash -c "echo gnutls-${PACKIT_PROJECT_VERSION}.tar.xz" + - bash -c "echo gnutls-${PACKIT_PROJECT_VERSION}.tar.xz.sig" + +jobs: + - job: propose_downstream + trigger: release + metadata: + dist_git_branches: fedora-all diff --git a/README.packit b/README.packit index 06da437..65c3b70 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.49.0. +The file was generated using packit 0.50.0. diff --git a/gnutls-3.7.5.tar.xz.sig b/gnutls-3.7.5.tar.xz.sig new file mode 100644 index 0000000000000000000000000000000000000000..b1e591f3f7c26af957334d33efb4ff3085501d1b GIT binary patch literal 685 zcmV;e0#f~mbp!ww3IH7zAp~7U%MW%m1*ZiyR`hyxrbx5-A`ArrVtojB0162ZdUd8q zv-u(nw*>(IQVa%7W49>fM5KR_wVg;cFShzNT&Y1NDK&B`xlr5W0RL^^JLh<|DKQ|4 z8}_{OUkD!EFGKQ54zaNo>{ygpSwd zm~jOHVtpTt0162Z)&+!)*XEdUsZ0<5K?NGDVyp9oAj!B=TrD?H!L(8*Fxq>^>+_!( zX?Ub3u#)1@-RqY>v88qw`^m_WEG1$14ofMBfgIz_MmE~pVIAV4$rQ@*RrX*D!`I~a!kAQ(04)dm?K94|16jz}> zv1Z;%Vph$#iMI-N{M`_yC1hz*#vMYUnlMTYmy4bktI6P3Mr)yVC+g%CeKykz{>=HV zND_ePY5}YAhh(x1+mAF^k=^mrDC$^YNHeZrP0JvfqT1%*6w;kw_ zR>R%#rt)OQ;Vb*ELgr&6HSR6|X#6dJvJQ16z>W?Tk(Q1ystr(LRrw!>!4qNj;~>G{y)@OgqHv11 Tgh%PbJ8f@0Zcx^u-OUEF literal 0 HcmV?d00001 diff --git a/gnutls.spec b/gnutls.spec index 186c77c..6be02fb 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 3.7.4 +Version: 3.7.5 Release: %{?autorel}%{!?autorel:1}%{?dist} Patch1: gnutls-3.6.7-no-now-guile.patch Patch2: gnutls-3.2.7-rpath.patch diff --git a/sources b/sources index bb1d91b..d8f0c0b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (gnutls-3.7.4.tar.xz) = 38b488ca1223d9aa8fc25756df08db6f29aaf76fb5816fdeaa14bd89fb431a2e1c495fefc64094f726337d5b89e198146ec7dc22e9a1bca6841a9d881b0d99e6 +SHA512 (gnutls-3.7.5.tar.xz) = 2e4898e6aeff4f82abd48e6a442f5c9ebe4ecaeb0c038b76e2da8e468f6a7ae37fef5e8de17d90346f29aa0b56a08abf67fe8b81ba09dcf4612cc3b97b830bec From bdbe654b1435ef47885efc1120e41f3655337a34 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Fri, 27 May 2022 14:00:19 +0200 Subject: [PATCH 18/18] [packit] 3.7.6 upstream release Upstream tag: 3.7.6 Upstream commit: 1f8b1ff2 Signed-off-by: Zoltan Fridrich --- .gitignore | 1 + README.packit | 2 +- gnutls-3.7.6.tar.xz.sig | Bin 0 -> 685 bytes gnutls.spec | 34 ++++++++++++++++++---------------- sources | 2 +- 5 files changed, 21 insertions(+), 18 deletions(-) create mode 100644 gnutls-3.7.6.tar.xz.sig diff --git a/.gitignore b/.gitignore index dabacd7..28bf8cc 100644 --- a/.gitignore +++ b/.gitignore @@ -138,3 +138,4 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.7.3.tar.xz.sig /gnutls-3.7.4.tar.xz /gnutls-3.7.5.tar.xz +/gnutls-3.7.6.tar.xz diff --git a/README.packit b/README.packit index 65c3b70..c242324 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.50.0. +The file was generated using packit 0.51.0. diff --git a/gnutls-3.7.6.tar.xz.sig b/gnutls-3.7.6.tar.xz.sig new file mode 100644 index 0000000000000000000000000000000000000000..70cb359cfa200e21bbf41fbe8a97062d6596949b GIT binary patch literal 685 zcmV;e0#f~n0y6{v0SEvc79j*iA|=DLZ#0LW$VqJ01%!^*=9qB>0%DM=asUbm5Y`2R zj@Raxag~S<|6D@l3C3#|Jf^=OwKKysslXB+p;!Ex&05zgiTPH4f-KUI^0rO|%5HLC zcqlZLJfI{ft90^YHlVmsW)tiIu5|vOl1A3=r=NDpLbuo^P5iV~Z+iBr#DLYG_l^-N z+@%p;65TrGX*i(k0ncB=DN2|=SdBdZ{z}TT7YJzgd1Gl)R-71t9Q>nrlmFsxeI4)7 z>|q#*M2D~Y380*5)@$X#B`lg0oraC@$tlt)#8EE*=!619mLQo7xciwU-KDl|G~PmX zY_{lGs%M0eh}D7x4UyAoekX+{eM$g-=HuV9rmaV_{JKfa+Z~^qu|4^2?Jp0oi>E#I zKXKXFg;k#?1p~(g-e*Y1yN6xR1Hruv@nk8NM7n`s3rV{Hw(j&apnj*?g(n&OGf0Cy zt$0!7N0u;x={}M;VX>uG_`zH0vX4YYSf8wj_pC&#>tiUL{%EMrFH8<(>LG!Ha_@i- z4Fo0C@#5uqcs zZL4w_X10cGjIq8Gs_rimDBxqByOUO7eR~O!%%s8ni;$kT5P65+Hn#qFy(#!8gF{|f z{fKo002T@W9Tp)3T}I0fb~FX21vOUmdUd8qv-u(n1p;D_l4Sr22@ra9rbx5-A`I}} z0RA~Yf@MX8iwd_>M6_sh73C=7B7}?+21`rW9!3W-oTC8%yxSB_;^bY^-$zRA&RE{( THJM||bc2D~!02dd{ $RPM_BUILD_ROOT%{_libdir}/.gnutls.hmac +sed -i "s^$RPM_BUILD_ROOT/usr^^" $RPM_BUILD_ROOT%{_libdir}/.gnutls.hmac +%endif + +%if %{with fips} +%define __spec_install_post \ + %{?__debug_package:%{__debug_install_post}} \ + %{__arch_install_post} \ + %{__os_install_post} \ +%{nil} +%endif + %find_lang gnutls %check @@ -249,7 +254,7 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %files -f gnutls.lang %{_libdir}/libgnutls.so.30* %if %{with fips} -%{_libdir}/.libgnutls.so.30*.hmac +%{_libdir}/.gnutls.hmac %endif %doc README.md AUTHORS NEWS THANKS %license LICENSE doc/COPYING doc/COPYING.LESSER @@ -260,9 +265,6 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %files devel %{_includedir}/* %{_libdir}/libgnutls*.so -%if %{with fips} -%{_libdir}/.libgnutls.so.*.hmac -%endif %{_libdir}/pkgconfig/*.pc %{_mandir}/man3/* diff --git a/sources b/sources index d8f0c0b..f8d02bd 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (gnutls-3.7.5.tar.xz) = 2e4898e6aeff4f82abd48e6a442f5c9ebe4ecaeb0c038b76e2da8e468f6a7ae37fef5e8de17d90346f29aa0b56a08abf67fe8b81ba09dcf4612cc3b97b830bec +SHA512 (gnutls-3.7.6.tar.xz) = f872339df80ec31d292821ff00eaafbe50e0bd4cdbb86e21e4f78541cd0a26d843596d5e69c91de4db8ce7d027fc639ae6462b57d89fb116162ae63c5a97486a