From 2890e683a84fa9eec9a9e516fdf3cd4eeb5aef2f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 6 Mar 2017 11:26:22 +0100 Subject: [PATCH 01/14] Update to 3.5.10-1 - Update to upstream 3.5.10 release --- .gitignore | 1 + gnutls.spec | 13 ++++++++----- sources | 2 +- 3 files changed, 10 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 0b5b1b6..b07fe75 100644 --- a/.gitignore +++ b/.gitignore @@ -72,3 +72,4 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.5.7-hobbled.tar.xz /gnutls-3.5.8-hobbled.tar.xz /gnutls-3.5.9-hobbled.tar.xz +/gnutls-3.5.10-hobbled.tar.xz diff --git a/gnutls.spec b/gnutls.spec index a1b2d5f..1f29060 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated -Version: 3.5.9 -Release: 2%{?dist} +Version: 3.5.10 +Release: 1%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.4.2-no-now-guile.patch %bcond_without dane @@ -153,6 +153,7 @@ echo "SYSTEM=NORMAL" >> tests/system.prio --with-system-priority-file=%{_sysconfdir}/crypto-policies/back-ends/gnutls.config \ --with-default-trust-store-pkcs11="pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit" \ --with-trousers-lib=%{_libdir}/libtspi.so.1 \ + --htmldir=%{_docdir}/manual \ %if %{with guile} --enable-guile \ %else @@ -171,6 +172,7 @@ make %{?_smp_mflags} V=1 %install make install DESTDIR=$RPM_BUILD_ROOT +make -C doc install-html DESTDIR=$RPM_BUILD_ROOT rm -f $RPM_BUILD_ROOT%{_bindir}/srptool rm -f $RPM_BUILD_ROOT%{_mandir}/man1/srptool.1 rm -f $RPM_BUILD_ROOT%{_mandir}/man3/*srp* @@ -182,9 +184,6 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/gnutls/libpkcs11mock1.* %if %{without dane} rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc %endif -# Temporary work around for #1422256 -sed -i 's/libidn2,//g' $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls.pc -sed -i 's/-lunistring/-lunistring -lidn2/' $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls.pc %find_lang gnutls @@ -238,6 +237,7 @@ fi %{_mandir}/man3/* %{_infodir}/gnutls* %{_infodir}/pkcs11-vision* +%{_docdir}/manual/* %files utils %defattr(-,root,root,-) @@ -270,6 +270,9 @@ fi %endif %changelog +* Mon Mar 06 2017 Nikos Mavrogiannopoulos - 3.5.10-1 +- Update to upstream 3.5.10 release + * Wed Feb 15 2017 Nikos Mavrogiannopoulos - 3.5.9-2 - Work around missing pkg-config file (#1422256) diff --git a/sources b/sources index 3db9ea8..3824406 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (gnutls-3.5.9-hobbled.tar.xz) = a8e308cafe6103ca613e113e6409d9fe73ad84db8c199680b437dacdecb7af0593ae8659d789dcb033c8a51d00e3d567e2a90585dfcd7008f9f49bb6e125d826 +SHA512 (gnutls-3.5.10-hobbled.tar.xz) = 141901717478fc09e6dbe6abed181e34f084a9aa29a5b9cbb0464f35ea245427d34c99ed0aeee9b90b9facd54e95efd63a40b21f9eca691901c8f1baa39d215c From 50590f6b511b836f14b0933835624738a6c51a87 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 7 Apr 2017 18:50:13 +0200 Subject: [PATCH 02/14] Update to 3.5.11-1 - Update to upstream 3.5.11 release --- .gitignore | 1 + gnutls.spec | 10 ++++++++-- sources | 2 +- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index b07fe75..fb1c48c 100644 --- a/.gitignore +++ b/.gitignore @@ -73,3 +73,4 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.5.8-hobbled.tar.xz /gnutls-3.5.9-hobbled.tar.xz /gnutls-3.5.10-hobbled.tar.xz +/gnutls-3.5.11-hobbled.tar.xz diff --git a/gnutls.spec b/gnutls.spec index 1f29060..ef33cd5 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 3.5.10 +Version: 3.5.11 Release: 1%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.4.2-no-now-guile.patch @@ -19,6 +19,8 @@ BuildRequires: trousers-devel >= 0.3.11.2 BuildRequires: libidn2-devel BuildRequires: libunistring-devel BuildRequires: gperf, net-tools, datefudge, softhsm +# for a sanity check on cert loading +BuildRequires: p11-kit-trust, ca-certificates Requires: crypto-policies Requires: p11-kit-trust Requires: libtasn1 >= 4.3 @@ -138,6 +140,7 @@ This package contains Guile bindings for the library. sed 's/gnutls_srp.c//g' -i lib/Makefile.in sed 's/gnutls_srp.lo//g' -i lib/Makefile.in +sed 's/global_init/gnutls_global_init/g' -i tests/trust-store.c sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure rm -f lib/minitasn1/*.c lib/minitasn1/*.h rm -f src/libopts/*.c src/libopts/*.h src/libopts/compat/*.c src/libopts/compat/*.h @@ -151,7 +154,7 @@ echo "SYSTEM=NORMAL" >> tests/system.prio --disable-srp-authentication \ --disable-non-suiteb-curves \ --with-system-priority-file=%{_sysconfdir}/crypto-policies/back-ends/gnutls.config \ - --with-default-trust-store-pkcs11="pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit" \ + --with-default-trust-store-pkcs11="pkcs11:" \ --with-trousers-lib=%{_libdir}/libtspi.so.1 \ --htmldir=%{_docdir}/manual \ %if %{with guile} @@ -270,6 +273,9 @@ fi %endif %changelog +* Fri Apr 07 2017 Nikos Mavrogiannopoulos - 3.5.11-1 +- Update to upstream 3.5.11 release + * Mon Mar 06 2017 Nikos Mavrogiannopoulos - 3.5.10-1 - Update to upstream 3.5.10 release diff --git a/sources b/sources index 3824406..be18ad8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (gnutls-3.5.10-hobbled.tar.xz) = 141901717478fc09e6dbe6abed181e34f084a9aa29a5b9cbb0464f35ea245427d34c99ed0aeee9b90b9facd54e95efd63a40b21f9eca691901c8f1baa39d215c +SHA512 (gnutls-3.5.11-hobbled.tar.xz) = b47b9c6f270454ba626ca17b81c638993563ae6a9c6444e4e2392ee03c5673b790ab7cba52bab58bc1fa4b88bacc44ff11df26e4fc3c727eeb5624c3af8dcd38 From e516dc7d1d2706ea918c3ebbcc9ab01ae9c16188 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 11 May 2017 13:23:51 +0200 Subject: [PATCH 03/14] Update to 3.5.12-1 - Update to upstream 3.5.12 release --- .gitignore | 3 +++ gnutls.spec | 24 ++++++++---------- ...42418905D8206AA754CCDC29EE58B996865171.gpg | Bin 0 -> 56226 bytes sources | 4 ++- 4 files changed, 17 insertions(+), 14 deletions(-) create mode 100644 gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg diff --git a/.gitignore b/.gitignore index fb1c48c..288f655 100644 --- a/.gitignore +++ b/.gitignore @@ -74,3 +74,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.5.9-hobbled.tar.xz /gnutls-3.5.10-hobbled.tar.xz /gnutls-3.5.11-hobbled.tar.xz +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/gnutls-3.5.12.tar.xz.sig +/gnutls-3.5.12.tar.xz diff --git a/gnutls.spec b/gnutls.spec index ef33cd5..5c4e84f 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 3.5.11 +Version: 3.5.12 Release: 1%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.4.2-no-now-guile.patch @@ -22,7 +22,7 @@ BuildRequires: gperf, net-tools, datefudge, softhsm # for a sanity check on cert loading BuildRequires: p11-kit-trust, ca-certificates Requires: crypto-policies -Requires: p11-kit-trust +Requires: p11-kit-trust%{?_isa} Requires: libtasn1 >= 4.3 Recommends: trousers >= 0.3.11.2 @@ -33,10 +33,9 @@ BuildRequires: unbound-devel unbound-libs BuildRequires: guile-devel %endif URL: http://www.gnutls.org/ -#Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/%{name}-%{version}.tar.xz -#Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/%{name}-%{version}.tar.xz.sig -# XXX patent tainted code removed. -Source0: %{name}-%{version}-hobbled.tar.xz +Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/%{name}-%{version}.tar.xz +Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/%{name}-%{version}.tar.xz.sig +Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 Provides: bundled(gnulib) = 20130424 @@ -134,13 +133,12 @@ This package contains Guile bindings for the library. %endif %prep +gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} + %setup -q %patch1 -p1 %patch2 -p1 -sed 's/gnutls_srp.c//g' -i lib/Makefile.in -sed 's/gnutls_srp.lo//g' -i lib/Makefile.in -sed 's/global_init/gnutls_global_init/g' -i tests/trust-store.c sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure rm -f lib/minitasn1/*.c lib/minitasn1/*.h rm -f src/libopts/*.c src/libopts/*.h src/libopts/compat/*.c src/libopts/compat/*.h @@ -151,7 +149,6 @@ echo "SYSTEM=NORMAL" >> tests/system.prio %configure --with-libtasn1-prefix=%{_prefix} \ --disable-static \ --disable-openssl-compatibility \ - --disable-srp-authentication \ --disable-non-suiteb-curves \ --with-system-priority-file=%{_sysconfdir}/crypto-policies/back-ends/gnutls.config \ --with-default-trust-store-pkcs11="pkcs11:" \ @@ -176,9 +173,6 @@ make %{?_smp_mflags} V=1 %install make install DESTDIR=$RPM_BUILD_ROOT make -C doc install-html DESTDIR=$RPM_BUILD_ROOT -rm -f $RPM_BUILD_ROOT%{_bindir}/srptool -rm -f $RPM_BUILD_ROOT%{_mandir}/man1/srptool.1 -rm -f $RPM_BUILD_ROOT%{_mandir}/man3/*srp* rm -f $RPM_BUILD_ROOT%{_infodir}/dir rm -f $RPM_BUILD_ROOT%{_libdir}/*.la rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.0/guile-gnutls*.a @@ -249,6 +243,7 @@ fi %{_bindir}/ocsptool %{_bindir}/psktool %{_bindir}/p11tool +%{_bindir}/srptool %if %{with dane} %{_bindir}/danetool %endif @@ -273,6 +268,9 @@ fi %endif %changelog +* Thu May 11 2017 Nikos Mavrogiannopoulos - 3.5.12-1 +- Update to upstream 3.5.12 release + * Fri Apr 07 2017 Nikos Mavrogiannopoulos - 3.5.11-1 - Update to upstream 3.5.11 release diff --git a/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg b/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg new file mode 100644 index 0000000000000000000000000000000000000000..1f9a40cc96ea43f54ea9dc0f1873971a85535c2f GIT binary patch literal 56226 zcmb5#gL9?PyXg5H+qP}nwr$%sJ4VMz$2L0Z*tVUHZ9BP@-#K?~pPH$fnSbE3_FB(3 zEALL_%>YUOmBc$}1cD{pxXIaBVJ{hWJA4%Z)9ni{SHt5yt#wqrchRH}nVar+Hg16F zb)B38Lw{tz5e0U;n8D@MMBjiku$@o$9b!zR>J)Li;lyXD^sHJ~Wp6q- z0yXavWO2O;<#hYK2ABm-Tz8iOqOtR5$)65eONbbZI^*!NeJO|ljurm^x1@h4m)2vW zUeaK6U7O~oldSCtC{mVzHLzMPnOZ+V*%2W!J65foX@`K@ydA{uC5*@0Wb1 zeW5;GRFe6ThZJ$+-VDDMqV-(fyc$ux%tbl28IZZ^g=gNBei_x9a5cKv&+xT)RIv`a z@F8k69-rjTJjDBjlH1t%1(L?fdomeXh=U>`0RzCnfF+rJ}ke72fhDD6WmFZaET^IgW5za`-4hWFLY7|``6^>`K zOFsIcPaNZX4Ssw0e;hgaV!Ut1YTwvhVK7HDDh7}j=5BiZJOgozfiI(Z0}6UJXI5hk z$jgEUQJ~TAPqrv2FY4#Jy~OMYhx^A-SX=#eq}XA2@ZR!G*;fF$=H7r6`5k)QwA)+E z%}uatXU}eKK;FoJseFjfM6UzF!B?O6>HC!yr1!th!TYy!z=U?tlAmQIRtw0+#`@B= zpXei@`YfeaXW=woM*ZU`f_{BFu^mTe?O4Yk zN9BNA->_0|0wd?h(4Fxsc=3TZuma|3KsG^^_@8{YJ}+*G8LNd>Am&88i{5`7AKGt+ z5jd7q5~b<0A03dZ$6I4bro>e6IiAMD^#aE}&-F3}$bt_5UVv&bU-nW~@O~-ZCM-fa z|7Y%U%9q98jtg$>yh?8&gZDTfZ~MW%nzW`-O&;gfiv-^lzoOcv0FXDuOTjc8pJ)A3 zM2_=Z+0Qw4;)3{}&!d9U^X=Hd408)=Vsf~O0&*yNvekel*%$1t5B$`Z3@TYYsKo%e z*3WgHYd@KB&eP)$GK~=E#Fz7n{&fhBzn!@4Ou9qdt=y~@K&}Tm`{(1MPgmcsjD;jH z(_5Y?^hrQAw#z%vvP(4H6iKa{hGOVW9}24DKaQ#|)wjcdJ>x>f3-+N31jtKA&7A_~ z_8;LAY{No{C^4Gbb2SCz#SYk*1it&Gn*73T%doM}V3*Jj`o~eDuljbncI;`X{elTI zx&gU%Gc(IAbkBE+$goCs8X=yuw56ngyn1u@wzDq+er+O=w>r&OU*|se&3_z?{)%r0 z_-77w;s=VeJQE-rGmF#{bLeWyQVOYr2pep$$UA@tkhh6_nzuthVQg)x{1c&j+?=y? z%l{uolRxI$*{ooOX2yC6Q0=m?F^#U#>o@`_45(| z@={|KFo|xk5rt=sqOX(BxasaF>i~I&20S`sFl*o~2fLw1cl*_4Ui~{Nga#Qhhb?4+=S3N+k7$({pD+$t~@a0xZ@b>l43MbR& z|8W$4P=|gy>PKHul!C*Mj+1~~?cDV9S)!dh*9qEb^Lm2#t4oLlKwdq(%@bg=S1e+mw{0vZQV(U zF`5Q>d*v^K$wyMP|2UA}_q?2@*DiO zbF6O6SqIz1Vn74Pi@#KloBSjWtC8gbG-emF9fU5<0rEyMM_yLY+0R~~_eu>5+)9V5 z2hIO+G&OF%9Zqle6#q82FF{B^ULu%^Vj-8R8#9*NWcQ}0nXP103?SDQi=6!4rZBxTG5tGNe0N_ z)Shfa(a!9S8#`GZrI-o^Ixt&|5C=v1?|ms+n0`A9DQJ)thrslwsDQkfdaD;=>mTE( z*;&(0vd{gz){i@YY`l09jlWawISYmd(@wJD5l07*ud4Ph->+kd55e?QIt;qG}S44i<`;cEe5(;`WcDR{{8TezNrk zIFdp<(cuH~Huubnp$l3Vi3K{{pF`AJGnPfq0XbySTz62!^wmZ5x_jgozBLK6az6iY zp#Rg4!jsjv^Iq4kYe3NLXtM#x#!}#+lJz4XEYwiuo41q49gi_)0OU~eFlF(dMpzeNe>z?peX>`P%{3u0yoJIK_7z0=&Z^NWwfUS?w5} zYnrB`q?U!@uT=sE$8YPy^grTllXaedw&c+gm%NB7*^+JaaE{T2(dyNGj{hzmQWp z7;8uPCA6064607oqJFkmM3{l1AVC7iz<}k{2U_s4EnQt5xfvKdJUr+v99%6e92{KC z={91*8e~(4Ae5qHATXwAg3?rk>wj(wRxn^Wg;_nie|KZV>`8B8$zW>6VB=u# zYGm`D9nm>D*jkx*(ObIO*?w=%$xal7FNT;-z8jD$%+%=V{q@tm6e@AB^)u1HK;BIX zkSiax#Xa{4&dk_0>J8lW-b(+l*ZMzJb@>0ks`?@o|EM>(>d_P+R~LK5bs>^Ky#7gk zVc++&c5Ozx9gwTuY`su=138D?NNC%%!*Z(WVXPD3_n#Yt4-8n&a6zB>-@V#fnb6rA znb0{pJ6M~UxPCvtGx!_Z8W}k<{Ig*YFd)zGO*=1aJumd%q+JLBazthAg3t$pC?|we)6?R z=aP?gQb<51LsEfE9_zmHt_#Se{Dp^S zbyfOh4%oYuJSS-RC=ES{hL@4zZTx8%)7e2H|9q`bK_TpOLw}1?V~w(+70@rU+u&Y~x{5?x z*sZnFyK=&*TFH>HZuP7gM9iym?OWbPeJ#V<9zTib$fQzUbBOj#_@xoQOfHYO!eg7X zm}uR9k4Fh9_WPW(YNwIZT^&+-_8{KCJcN}>!I4p6;^=E?g40y*_*)2fO?)8~IrXqn z%`Nl@GJSLxQ%(XiO2mzx3P=4J$lU3Bi(!!PQzs5bFtkx9aPA8XVLB|+ihDO(%NG_I zlcimnAg4D;mVG>?01x-z7A2^uEo-U_!JnpYg3-5aRib(KVgC< zZ5?80$rI|OiieE`NvNSO*^ImK>wBV;Y-AB>45hD4Act!1FVHYSw2;vC;q@95rvsVnlU4}BYJ=E-ec3MS%dDQ>Y9`O`W=^u+1QyEp)bLIJj<6nYRM8E9RaAO?jeOR834w<-wSk9&S3| ze7XX)dYhMX#vXm?IOMu`UxUqB~z6|S} zwta__|E4OHgv-eTbVfKKi*V3`;|wa~5; za&?v>Ddd89s0d(_tCrz)t7L(T@0P;sG*H)8@-o9r(^M*H;;&-@^1Dc_@z*WyIqN;F zk}aBL`J_^ymcMtR8c8vUOf-EO!j-tI&_Xcf2t13vKSFnk&GL|xm4*}3d&{p@V^qwG zG(hyh`@LxJQY~VGkx}Lu=ae?&4!)bCIT*T1{HbR=%ALhnj&beXl;KJ%0JS-IeaEF8 z7@n8>imRXs?8T%+kj3Nk+pe-BRGu^=mHH{ihjM&^pFDLuU@I@TT?918k@Wj`Q2zVw zQ7YN`{^2^&4r<8}>SC|lhxp`IQ$a(4U*V7OA?F`yB9V1n3#*n;p$&StxEc~j_ABAI z!5;TRBwKpz8krSMq9^jc=zZP&z%c7jXDCm0DiZi{l-TG9!qKDlj2aRRs?DSER+{a` z+_udFf{5v8qk(Q9amsliD8WjVzs(G(TD`E9tDmoTW5fP?2@+^Lyb>2C`}chcTZ#_J z2^@vqX^Ba1@T~Ls>7G}sQ%c@uu2PkAU{`Q+9@3EnAqIb!UUiYw{QMhIrYo5qewzH2 zeyLLVkhBx5Tk9KkC4kycMGuk5gjpGUUz)nfGM4X`%`a~Dsjy~AI@N|CaNU0Qhh;5` z$>l>ae0Wy*yxLC7(SiWPQi6A?)FCol82etrUfoE;blPUTY*)p((x=Ke#PlV#s*+L5 z$mLXh?CbOy%2zP);-&f3B?fd01_~Qf6enh$XcO)^cTa$2bIfL~B0W>YR287k`Q7TS zAy-)=Y9qt~Mwvqhk)YrX&O6KByQ^;!4OK3T?_4Mh`_@R1{SETV-Sx(mv$(p^<34dJ z=5l925(*_hCiaB&r#wk*>Yj*%(a!4}r+IE(`o(k+n%Q?Y;Yf}cD^d9ANSGW+%MpwE_Iz7ym>)hWEX%n6B_0p~MJ0ix8M`y)Z? zDUE?)%qrN<4Wb)d2TXjeURU-8@S@44ZB?U?svc63(x;fe7BB~VoZ?|L67hNd`eugI zLGvWZ)EN9hFc96m#x|3NCygSFa zcJPOhHXp-h-BT%W8MH{C>+KJ$mF*Ocj*?ZZbUGx?3c9mUQD*2@<~B+sP|ttHL;n4z z&Vxo^91t)lvUG3&I1Cgd1PCxF8ZaaXC^|3*5HLOvFh=0__^2*5TT{c7oCwol3Dp0x z%I8epIkGpQmEG9S?b?&x!5+rtl}1FU_PDcaWCD|d!M%X;V%i)K3F?JJ(;{l`nsmzi zt%qaUKQoghv|n#HXu>(`cuX3k8uR(P{I#ftE{$vOdiG~4pQKR!q+3_qj+-DIh?HEr zhF#9?&2VjCAVc3fg%wE9>O9aSQ8FI?*b-Z}k4mS)%IrnerJq(HMXO|qyMP~mk!QoE zq@m6q(|Wg4lkIx0d9ADShT1%4KX#0?B>{qh7&cW0Da0GkonG!_kLiX7zgo)L_xNLR z`<5?B<7L+G=cA7rRkQu3b#L(^caZLrtb;A3qtv94+sIu; zH%U3EzqHss*3*+Lln^M0Avef-z;t5e33i1hc3p*8W9$3pg3qc5p-{t-(#-tFGiB?p*&jD1*7?Ne`MM~nwydb%oO`qDCg9z-1{ zP}W_|pR_lMEFqwQ3mak|wL@nP$@xg2{{M`S>i=zcV8D`7br8Ttqhg%}nGjDhvl ziQM>y&{y{KwJiDH!U%4udoIv4yj@z96Qf~_<}AvCb!hr63dh)!6~tDa;idxio=1su z*NN8h7p!59B!Vb;joswyWQCVyrDrwrp)C`H(z)au?uv9nj|pL-(Yk2>8jypz)+E-e zVr`WU9ue9K4cdgF)EM-j-tTt+3>&e=@8ES7w@bUnH>K%l-WGV_yz0g6{xhIjV_A=% zxs^uE8Yq4d5$e~W0bR`7RJ@sA@UEqytv@|rD(C~Em-$HmIpf_nT90d;rskljRIbGv zf0N&i!?pG#jm&YjnkCweaRpY3ZFNMS7A%HRy!`i+cDHz(Gi;Yw(;(q}$Ck8}PS@@H z$V#qUG8VfntTvc`LQUM`!lg_z_5cMV%0vsnOu3 z6OIoW!@_LUS8u4pl}`Oeix2)SDK3{zw48j7o`0DKS(Bf#yfrC$bJ({h-)ranpiOxd zM3B<}}hNCD(M>X8+^X=#a;A>m>~K|DdHL{;8@Pg~8N zzyw{bT%cECd-0Vd6B~^nTT7w&^{_@6ojr>nWq#(*|>q(Zm{}Gk)?c3r(P>}4>l>c zbLYSbW6i?R+cT-dV&Sv6I8}5D%ioLlP8}^}et3aM%O!f75FE}>m;Cg6dS0idlPam9 zH+P(d3jfubhG+(iLp{mN+CM9{0n+cE3_m_SI>|V09eQs!O#7Yqy=A z#_H;0@7jC1H--F!Jn3#$MM1|nnKe=~dty5aDV5PKz=N6V_-`Hx>)hXY_@_~ie?oiT zd1E4cX*P25rCfPfI6-4NoDds$Z8_h~W zzl5VaF^=2_#E#RycgIVyqm!3qmX2x|RHfJ%Y(d))cz~?onwD}Ip$er|*ZbHz?%RD#`cMpF9U0$S zB&*=BEV{tk${AIX?kbf^xpv;YY>Yxa2V;C`2WAujV;f%E9x>pBzyc7m`@ ziIF^hdrwM5rcOLs&Y2^;7~++}&c|~i!x;dIy*zOhZfuDFU+QL*&_yvkT&{A1=X6RS z9{186hZT`F^B5#4x-n34@0|FvyYtDVBL}9%!=H&g^uR{FVz%}2)p3KrX5Olb2SHVH z{73Z*gK}lYdi0*n+OBW4l-JX)IW*ux*pwHjEb&O{?w#jvkSOC(=wD@URj%2&p)aCW zp?jERYa}O40^F$=Ad1B?owK$G*S}zQsXyzA+3bzZlYjJaaL;WzMop?7VKoZ1$o!j! zqK@Eq9!EyN+moMF3^06%fRr{7GclZPS~}@a5cOo&>1uhTIu(fqQdO<_{w6RR zF%&Deu;QRb@UbA>B+2pw`UFpdtz5xLbg)(eI0Sj7B3hP~r{|USMC?HYJ^{oRVLf^g zJLmhW8{NFIkzy0&#-4%K{wPfOif|P&rX&i#p}Hr5JY~1!5mq0XrTaJ+34ml5I@W3-+~Xg^U*T*fgCxkp3ka5 z@iQo8UGYPdqHbqPy)SbWb2=y!@Ze4=SiIe6a%ay(ReUK}UAiWWRqt`YnA)x!!2m*V zztpWb*@?m5hiU^Thm?7XP1pJ3(|~^4eGC+Yb4>Vd3aAO02#=4qhe~xx?JXJBRAq!_ zk8ROo`i?kLN=>QX;SSZI<`w4ICSttr5)Q2?1a)topz&(-oZ70K?leQ1_EmbF)yOyg z_PzcJhwF`K-ZF|UwKtA^E9*%PBKEjBDFCryWSq1Ibe5QasJSaCDOS_UtzjnGk+7on zcEcu0$G9{RuevjyXM1wMWveDVpqe9VJ)u8hR=JSpMUWD)P*e^i}# z0Q!AqW=zAO(_@owTGOv$o~Dbz^)=OeXj93#AA3q;%%`FBiGII2rI-Zehv410Jf$u3 zt`#wPrHbsOc=iesqM%p5Pdii!gHSEu*5iKtW;y;UHTaF~2XAw(5U3sIYR&5Kn)oVV zt69>ZvIj{&c&EmhenziR<|_pn!?EN4dx}f;cDXajPK3Y0&rg3tE31FXuo*cdq>8Iz z$&2(W;e7lU)rKDJU6u{SY~RHSn$J5OwHw1;T{Qc{MUpl0aDXCoNdGfY0~lh0zpwaU z0%b^vO*Ni0tuyAhzKWK8$u3#Z#z0?>m}($iG_eOw*O6Um9<|k)b!LoyAS8u$DD}zi zk@OsILWzrYojl8Qm!c9q?ktUO6^y#EY1lm{z<#WWt=VKxzdqo%5Z>PtAw!yl_h)&a z8=u0X{fp~+wph#Qef)y5BUuCd(KdD^Ko6W0iVi%#o;WcwTDUN5IUN@_&yCZnCypQbwe+|sh+dJw&`Q$?N$d_-zaUl--u zrQ}P+GxvHcE+#?QG3|jRpyYUVEFxPt=|?pUuMXYlb4(-9{5TnEK=8v+XrCmEW_om# zvIYZaYgN)$ z+1wQ|+6iv*3=b`UhnSHN$>Dcoi@h(s#(R@NLZ(HN+poserMY3Ri_37EQzDc}}SB@0dA5}zyu z#TNbO%s4M*X*IuAsUs$|u}P%YqB{J3ha{i#h)zci2+dQs4NEh8w0oXp!Yn(4Y` z`Xhl#VaZX{Wo4*^J#q)DpsZDV795&XE$hvx{o;r~ErxAB8e;TK7zKxXGQ%n{1yyAv zL+j(ks|MXge~Vz;#7z;yLWB+wx|^_w*Y-8C_dYqK2>H^aCTJ3xJJeDc8Tb5B&?ure zzJ%SPji!9&{-53AbI(!;!d{Hm0_C|0r_S-!%qjC|LJ}f%VnbYQl80GP4?e^sRCUVC zE#+^uRV}4}TI6J~p+c*xt)ezI0Avh!B6Id6I|gCvAL^MA7*Y+IftIhucb?g?USpUh zY#*UnG~7W{c^Z?LPAfy4Kc^JoBOmP+IDjJg&;Xu8IU?O*0HA2;`JidDmo`Iqqx{kA z>u|RPCqyiwn%!KZg)s%!kHsa6hKxWu6&H?6qU`~Hdfx-(z+Lr1`;RmgnM_^34qZm_ zhe4Lp^q!s-KOKso;p8sI-sngz z8BK&Fts;Ie`qrE>tYq7(6&gMa07YE$rZZ&nLd40${A(eTYNM@$Q|T^c~Gg%HR_>sStj_LC$S7% zuG6A^Qr?Zp{ac8jt1~SLK2K515_l+-L=edqzv7e)q#D^VY@QNbA6xn|co-nE!K|pL z27|iYpL=Ubv$pH#Fxzi}Az*NKcfgzgWBc}4$J z$^juE8oY@oC(guyo%YnejvhA}2V-71l;$fIaE5eOI?G3YL#&h76Mb39%Ru9 zF2kFcN!3f0Revsbx;k}vRH~=V4%Uq*+Xd1uqkP0RcD^Q-TU`y|OZs7`%D!P%UbbCYQHCM6Ze^9AyuC2{pu;NZ z)(z96EsQQo6)k4#u4G0P4Yn0RnAv*OtKZ1P7{rT5McB1;s*zoZrBAY%GwNWZMt`fj zS1s1(LR<8Y{GpvvXFq0B5#lCrbSU|ty_nCrdy0u-F*(_Ec<6>Sp!j1}RI&FSY{ctm z5SzO8=$W~f-$gy&OT|k-txI<>Lz~N5vNQ1q0(R|;h)xrZ)Gs*aO;M)YylC{0k_0kQ z8yi2QN&jECR-Kc5X#0dG=X*=)5~r3&-3Q=2XK^ga67y|b?kd$Y9ItMTIO9)0B%#+4 z9S}-8X;Qp@l#!ib{oci!X7<3{6RPjPuJvR#d6g%uo$m^iC-uG{_%y6m%JhBH;G7OA zXqgF7va4wNz;FKaxSP~a_eqH;M?MpNFSn0;0VTRlU#BbwzMXq)_PKg4IlAiP*}r)% zj6B?!n_aZUBG;&Jz&Iwy?qxVxHmezCfF8V7p(G4Wee@+M}= z?&TN_-c{Q8mmO`|nv=;KL81SIL@v#A0M`Rn>u8f0sq02I)7gdC`YWy*K}iyKK%o?p z&V`E22>GWd`cJY%lng6=D|sn8D~CR^D6lj9)#Ze&{aJ}J4-kLVhY~*ecbERalFn_` zQ%d`fJ6|Zl+3`41hr;%B&+z_Qo9wqpv3SXfgWpwXIQ^SC&tT3tT> z%#>PR`9ZomEO3bP+c}hoGebUyno_bA9LM#uJY7GVNMzo@zztzwiMx@^LvtKBOwB_a z(H_$|^Ii^e5YxU{l~8K1obEXZU|8dY;x-#4mpH5~;g-cL+KhNVmLH*{2;5H%1DXHzeDPXf z&GvC?PS&Q7NlVv)#Q;)`wGNz@?GrNixtHJE&nGqQydp<>ZE{QSNR@^d>Vi17@ndPE z5ifIXlxjvXye30dl#R*L5GW+aO>Ki=mZ(|CNBUWB1kM0`)aiq?@#h!83UP4kE7=oM z1|YWQ9YQK%6byDr|0BOG%Zc?OmqL!p*7+c~B^)}33U;L={@k1m9mmhVY+%H+p z9{C*L!Ow{4IJaj+U&=Wk%xSUg`6TAWwh|P4@hm%)=1m?eypsv|VLnHHpR03{_P#4cE5ujVOnsx_cB{$zjZ;T7&yt z>H}-Dg>KDICuuA@)Svc}=eUKDc)o=HSF3-juykw8B_PHc^QTMQ=*_eo~mOU{cy@x&aTm-phYHIDA9~_K^eWf&$ zoT@KLghD`K`m&Bcxaalb3}-Tt>|~uamyvL_6TBcTTh1Tg700fkM(i(?Pz`FLXeieQ z!+yj*sM7j3iFU&V2Al-N9TX5EE6o$(&@~Xr^5YoUn96+qoScq@q?qjAJPZcLzi$r^ zkS%4hk-e}*c!W+J|MSesL#yoC%F!@7zY7d z1>E9URcdJEyv^WkyjLNQlxSP&1Yl^qI_b1(A$gyIhYCr#A&1T51nNgLrBosp{+$-b zU7yN1y#hE;_9?bHqCsN#rm3&=yI9VVZqY#~h+lRk@sS^k*F!1YqoalzbobS<6<+8eA#cA0 zy`VsPYh@4ySKED6Vp~WYU{UV!J}jO3Q5*g~5&jIGH15xCRJO2<*3 zvt9c*RlShE^zsDh{yvhKThQ{LhMidtEJuy;dPO7(9}-_t45>)4TN@fvW>?>qfoRYb zHk#G>0Wy)-i`kTqs1~KUbP| z=Ks1uH1KwTZ$9v<=Lh1QxIO*L{G+8M6~YlOOMHbg7i5QlwtCVVOJOa^Mi^9D?kX7W z!1`#|If%0md+~rvQ!HJ;nK0UwE|*s3$w=V7triyg;urZf{{EG9`mf(MELDxJx8WKA z!~w5Am0Muci6P7`Z2sE0oI&)SOc)7KqFt)H79Z79c*kIAZ@!0Z8p!y{IQhZyP(=_g zE+x>2{+ox3qw#khqg*d(Uua=1D18W@EdAH2#{!j}jfuz)mO9He(vX3kSPIe?*R>=i zdcfcjvN0RRu3BV9xjU{@L$-V;(us%L#>akjws3{A#$CSOZD1|z?~oDHYibHax!{veayH*lzc z`8gQaNoHK>ouS*nP)p2FHHk&IAv%WtSQPoFeR^@4?{Dsc@*}jXwmHAIzkaMnTh*!*u(d7$ z-9p9*Dn(jYyN`FpSV^%Tg9Am5&U&1#77%$OZB4 zL^l(Tvc-p4HqjP>AJj%NdjIATp4jxA2OyKh&E{8yT8TO$AR>?7%V_ww{7}|p*b+xm zIw*_F{C(gW? z4DwUi=mg>39rR^_4h3S&yKDfq>(MoYixv$B7`O+`Fr%9mj(g=ae zSlliouA@dfsUP=-jqqYH#9~292!6d28RgUX6Hw4~3N zl!CFrCg*x&QR3@}l|rL|yrr(kJXSKId+uCh2Om;Fm$_0VP~F9h>H(p!H%ln$xAK0% z{yeXZgVe8KHh<4}OI7#0oM*L0^U+QCuXwAz+442|r>#PQ2K*&G2i)cGnqC>GW4e44 zt;B9q7rSArR-0`7w1OjoWrXOR%>vJ@Js`WHAI_bEN(|av2)dvnABIMyPhcp}ZVv=x z`mrZ=Eb}bo(VC6o_xs|~3H0zb%NKuaczcDn=~vccgb$<_ zp}%QOe$&;gtaeUMRF+;izIJqG{?$D@nkSOM!WP^ID!-1S7ubPRE z%O82?MZ*CBQNvvQ834%HkSbs#urB+Wz5peey=~|~E~cVv#k6g+mw#aQ>F-&*{JO{` z_+dD4((uzf6Q>X%jBjAPl5FscD;A>S7dG$J@}_O`ZKnDN5B1{Fb%TKS^GloJD=S`w zTs*cFHuwVLbVFb_`jy-)?a$cwn{i@AC!rE)@8%F=91JgZms3>Ti*Z${Fsvt#rVEy; zqtU@+b8oO1Hs<8ShnXcKponu_4WvFNZJ5B({G(Nr&OZiRBzvULj!}XKaPRy-!H5A0 zb!({RoyclO?2E0Y1lvM4=)cV*SYPz0Wv4GAN7hfzlYoH{W;)6QCA}PmAg_2FQhh2i z(HXg8La=`OiJ2Q#YSGUl8fM}4E+EIvEez<>X8B3EmAoC)2TfO;KR28A@yLxi)1;`Z&;QCz5Y@ZjP4nro3ULB$!9G7S04ZM_JBfj z@OK_fIe&q^QkF3Vr+{e>B3NHAoB{{q}KMMQAOl!gh7^Ty0cLu zvgm*)endCtTwv{idVl?JnU&5?wBln}Eu3d;&xytX?;4|N$rE_b*7Gec*BccBOirJ* z`NfJWUW3xWHHpNYLLkdgX#2}scr@ge8*}&^8_&blBd)*4_x|a&t3Z-9GC15cFB}u26*>8Fh z;i`U#P5iJZ69pl^6q}noAeOXl;0HMnT&61L>aFQjqPp?NUQOkulofFq<@|Iu&WAl{ zykfh%Pe7jrUwcHKyQx|CQ9i`|%!}c$lcrw!R#SakDEC?{t=8+ZIH^E7FxFkhiUM{> zA?*nydN}v;-#iov|MT)+8AE%>-J&B4D@SGwO8BPOrX?Soqm;;ukFZ*kyHw?|6$$$r96uSt_qIn1wv5s7a4c`lp zitYNDN{-n}2eC9MSx-~rftu9GEI<2?I<^bOCh?3mSDYZ+)5T$I87o@P90^XaQYI|P zvuxIGTaV2z|JUx7sB%ILQ;wX&68W}HUQ@-`!-=t8B=?AfdD-BGHof1!1>)QGTn!==nXf41)eYaKX*z`F|+@w}(yG7y{c;`~CXZqX#FuW9{^0B zha~AINq+Fl#)qs!`Vu()VFAe2Zhs$dR&%F55ht_Ie^ha-Ldt4~YA>gY`>BR|U*da!i&G3? zbZKo^Q2{17Q;;9{WPAfsmOIHl1`^@=tO^Mf>ilGl?dt1a->mV4yVe_#god8k1k~4z ze*(ahiTsr8%H|#$honQ_-{x{jR**{eWnZ=<8ZVPX_pIQ=f!wTLH7=;%g$Mk3L2Y?# z6)vTM98_+~axVP$F6)*AtoV) zpb)SI*KiB>P^3-b;9u?-|7L5!o&M&P#1_?q--sQjs zAMW=RYMfVkw8V4o=THN9G+DHWhWa!l9x|d&fZPYVMQvCnYHU~wrW~nN_of|6L9riK zN0y=)5~$*Kf`M7VEtEzHtTMLn7mldWiGr9SMh=ifSot>(k4M<=Jd$JQ0n8d|nK~8- zpJec@{7{&N=TmtXpg`)@3K@K8>WoxxOPdf4*f2}D@XId7G*-X@zxGp$)6lAsIROq( zwGLBYIvse=e5L3}7T6Ki$s}qQU;~CIgkB~caXpudXnY}pN~>hlGINXDpZ9?ZoTR!! zn1Z~!9=XKgJ)=X*94Iz2Z_RxCd=yj1^x;r%d! zEU4bQr$VXpZ_7<~<0}_5i1oomcUTu!7eH16{aO5(3F|Rl)*ZfqSEq?$Nt*wa$A7(f zrqTbO7hA~pM%+q839rCm5kAla1tB3UzrZ7rZ`;;!{$6CF3R6_vl^+h5LNQdhokwor z^ZD2q@91w~jVHo?n#ut`$nNks;;}`SA5K4a4&|z<*ar-qm9E4XUO?~v9N&<$0`SHj zi&qgbZl_%0+%*;j5NNya>us}0CCeGOH;_q|rVlI%$e3)Y5>)U!iA-as@1=20mi|fU zyCnv1OGcDlZGcpB22rc9rXd=Z6-png)n-A_iHVZ(B+P?YdmW>sGQM{*a8zEZxb@!m z`=due)GcQmtu3jbpC79FEh^mdeEv)!8Z1A&QC2o3z5Mv_$= z+a5fAQMMub>9VOwb*`XOsg+sUsy+d;+k`xbs5`;obijj@#qU&|81xM*P|~9 z@}g%GiB zQQHxrPvYEtq*1bf2Y+UGxpe9h2d3l^2;?|@edhx!I?hLd=v6)>)9RQDA?{P5|~TvI~+ zhH7}WRbg5qX5K^#)e@?GCE#@y8D!T;^{Y3q*Vn^W3$KJ3#4VF1&W*rq8XFwo)Qbm? zU~ne#$4kjl+mnR~f$~TXeL0`|#NWHJPjoO;k6a#ZVi4|P%UdSFl@l)iMZb3gpC6KK z47{gC_`{vCC*J~GimvVBWzy~8f3bEC&XKO+y6`*p#5O0IU}D?O#1q@LZQJQ+Vq>C- zZQHiZQ)}(L&Ym^3_o?sH`Tl{cyWYOK`|f_~y?+dGgBIk5U^cd#kK&}_8}^Q?TGDU% z8n@pu-BNZ`&%vG-;e=vYo)X3YMn~v`apjOaJwd#j@83Mg?>WVB#CYsax8GG9O7uD8kb!*4yYhV(ui6f17W0#jm$Wh((Fy zsfAAo@-jVCKg9_Kvd2N$94i5fsxPM!ekbe^S z3-QBXRe1nzbz+i~*~+d09)bA_I-o+$oxj^wc(UGgzY+>Tz19kryl*pMr_E*jcuFouRn}E zMIC*`S!Hd}`e9#-#)r81>B9?8C6SdB7DSt#p=*5`)-t80WEW0jlen#iZ_>s9{Zpy?C!k)T{G!yy?G_Fn+ zjKc7@=Wy`b${4M|>CXwCS>IF%q91m%>>tavtmb~cS|A~^prRvJ&5VM4fp@665Y1W( zrtl=Rz-lAS>&b`JBlqm}|y)<3BXA2pn-WjdyiOoGcipS$Rv2x`S^?;vbkIXqW zKXKNkPN$)E%zfjih&41XSU)-jg?u$+ZQJ%JjT3*^6M@sT#0~Qtp%uM66s{(>m&$Fw zIO7IV{D85}h@NF88EEEMmM#=Jk8~x>GDC|W3{_I5H-a=%gss2(xVv9@mF#A(hFW$w zR^t2Uh8_OwWKRRffmf^Lh(~LAi$)^AKUg3|*gkYqbUlRRZx}WcD`xI#cnkvt=vB|{ zgc;J&^+&Vvl9u;*Gy>aF&rXn5>9c_&)rZ6f(aYMhSQ)_H_%(21cH?e%yfd^&QXz-yXpm3Ey0tC!~-3Z-~1l80vjCG?$qSX8Q7H= zTo`ZpZ6h=${fCo*IK#N^6X85~z7z#K=TTudxZzDWk2@e)^VKq~4>p zK}L@q$n`---FN($+J-xt-Iv^w!#Kcg^Y|nThQ5XCj++{mmF6PW%{u=cd$ykI^-fZ; zToos z4hAMIAMl|r$Hf)&0LS(AQtY3?*i35iZJ;AXi|K{1D@I=qA8?QLkTo-1W55-p{QG0w2Tf(=TT3`#`}9cEdY zR5*dQXPO^ONSv$N=GUnDHCni%Mu&cLDGGNTQuejLxi`brPjZ>pS+XhWdM1Q-aL$v5 z(d=)M1V--#fo5!-n^t0f)#IN#dSoB|-U`sRlJpZczvI(F1mYXo2wEwsTK+`-7JBLK zX?sk$f}$uLFve{%A=uN;WZ5=`FthL5ppP+!tcJj;{t>cXw^e3S&u&#LorjA6p;^G} zR|7cop{DU#luM@7zAfCu*GhaL)wEUoysZj4a2X}+O6ZT*QfK2^jUM zM_lf+#^*zY*S4@k`SDxNa?c7-9_JyZXjLHl#*vTQ$Ww-_q`{$ho48PHy96qVW+s(R zMO9JIPkAscL53Hho*psXk+zW&IhpjAgTOU}-lVUNYT;~r%Ye|QAH5skb#`E^eRYT} zK+(=zL~1ofGvd@ytuaD~i!&{Hf@x~7@mx~d<4{@_1w1WHW>bnR6;~KfZYsH125bd# z#24+FpwrNN06c;<`<{54sK^)2{9VHgRB{37itwo4>me8P_cETe1OoCU0uWkCZ^SoD zxrQYCaOK-ito7LA;ml!-ml^Cr;17!IJf9o5)j~N6l$Aj;cvoszx&$aKGe{H046jiz zN-5SEcd^Ra%TUq9_MFh~#Xf0Y=1xmB(dEbqmw)lx2cP6Q==OqdZOx4e7`_Xwbq6~+ z45s6g?Xqrd=;lgKks-%D7iJB+=@+^W!CFV=3~VN}@OVjAk7K^3i9+0dINv-Wj{p}| zAgiH)#~J=fJQ8M%MK^8Q00sf(qFKDdhB-FaD(tWCRU&SiOVz*cUMHsY-F|!LdJgTI zR?e=rZpM@{oRfmM%g{T*mrD-{iF>5(AXNo)vVltX8`WQCM{Bs)Kq=>A;?@`vd4zSr z2>UUkN4c+Z_!~Q>Q0O4SGUj0~5WHSnksw|dn6=|Yj6eN?meEf{WwCh$iITk1x4Umo zq9?CTX+pG6bZ^nJOS?jhdPZz--Z`eAV%(-Vd4i?o)55SGUkTX0znY!joz1+LQd`!2 zXf$W1H69OuQQm&d`xFSFJSNh%#2^Mumv%JA!5Bah+Ns<30qi$aJZQDDuc`t1U7!o}!j9K2 zC!cRf4gbWETmH7>BTDG4xR?9b$-+oM3wMfldP8_+U%C1s`HGeoe%uiD#|L~wY}-=P<5um!xV4WqgCuVl3e z&41^iuJb3Er3BK!m2KE$fAMKaqp?@U+~~)xr(<&tzphiV20!oU;xb6H`-m1itfu`~ zg_2VG24RIim$pjbi$B14Kv~R>aF`@a7ZlPJPLt^SqijM9`>G}FN@bc?RE$HSdOVmY;0 zZ~e*({xSP2brT9Omg_44*3H$P;spx0yl|{qJ*TiARv~ksk##4o!Qcen;W0ByaDj+u z0QS9N2Y<$H>k6=S06FB~^$T#@yJo7!fX9&CrV(MzT;uXFE|h?3!H*+QeWG!ZJP2dT z;`AhO=J$Gh+xdG%5Y)Q&v9iZFyn8j`8@g|h6l&}AnIUsW{oASJsG=L>riehn8Ot!b z5tC(0iMY;oB-C^~ScOGeZzLpb?lbr}PrDO>S%>2jwMlZpAu+H{%QpdXN?{9kKEaTm z0*yDW5x&EDB`*&p2h4SR+q16WT=!c$ub;S{=@BphkZoGP&IUIS7l;z+qfeuM#_1}5 zkHXBmFsi&0S6i8>IsM@0K7%_GvAX}Ws0)$)#-z*t&UedvBsOHQIw5c4i3Ar~#D`u$ zRsMyc`l`yz%8|R?W~?;7$`G0tPC_CHYM3H#%KBd5k+>Kgnv^fuUtx!r)uZf1xnEK3 zaG7SyZ#Ko731R*@wX~xnyGx}7@7Wy+egoH|Q%M_3U3Sp=2Fla9Sk=a-{FJRPK=mmS zMtWlUwe@n?3@m@WH_pO4Szxw<`{nug!bwbb5LOTU?(>5qDGZ2z$iLt`wWL+l-J2_r86MOVD9{*(=hB`aH z?=G%*Xo!83Mli=52FFKEpZk6!BAVx7=^bs7WNq~I4iP zH+Big+}O8S)jlQ3=sDd7xw0kG+>sXkZE7dbvq`f9N1C7}mNaQ`x0wa1zNsI<=f`3ZQBUACEVhg6(jz@g$Y%V z$jdavSvteo57zlP9O(Oi8FBO?>_MA2E*DRiL;n#%wdpXwjXR~J^&{qKgLtVsB}>OV znD|peu*FJhSzky=TfpZAaEym{TF<3{v2`EPajp%!n)Srf9T4MQLS^Fc)JT=@imb2D zj|+>4!@+o$ay6_)v9Cv%9vMyTJ)%9!Ov$Zob;XHu)D^`^n)=0)zzX4t6_H=G<>z%% zml9p;XGadFz=J&>J6ZXAJrw$_|Eh-^oM1rGmEr_OOtey-70ZK}@qYGVln~9lcim=?N^c(}{ezaMw?0;xlS5$Bn1= zC+BTE@-2lJ(L3;xFO{9zM`LO?y5EuFsx2ZV7!a2z-}>Yq0K9DzO>eUdM_iv>TN45e zujGfKDJvizK`lJPZdE6Gy62HLZUh4vad8BjP`fbu2Xn4H zz&KZ?dene=K#KQJ>W_fbFc&vRP1G6M=S1+T9zNR<9TGOWuniq+eU=|b8ZFtq`Pc@N z<*TA5yrbVTj46Fgmsitdw&};PecG@e$fMvVHJcaUz#5Tt82!TBy|E~ zFaCu)qija(OW?3D59D~;m#8i3df&=JbCcm&LG|lKLaYq(Gq)fs1;PVYwA7EQ$kD)w2-_}B-=40{pvgF z;`*JjsG-}YB=Ba6G1uP$0qVSWGFcpO(Dn01W0q&K zl4V`D52yZWzrJ#k*}zhKIBdVHxtRI5vtmLQ?ZG=-Cc2c7y(k?OTtM*YA}L+j$=wNW zqUg&p{?2ISc~GGp;!5kT(cb2DUk2+D+34w4{I=wR;C0iFvr;9HSt68VkH(%g=}5}~ zt3AOiSw({`JD3nVJSuL}%+j+%;Egcc!)AVh#FS4*nT>QZ3@;IcEhuMVoG*1HbV^t_ z;EVe{l%Uwp8dxyj>J#=8g4HXdj268@@>i*ju$cFQaMzbq8I3Ytd+MF+Q-p7Bra!!z z=~A}j``Te<=*<$KHW8Sct{oltYUC!OBUdkqv^eSJJkT9ZLp$7!Ip$ZPm&9lJ?08Q} z`ZUyzWgfj5UFM3*Jx_W8A3>B@@o&5sdZRCys-~nOjF*poJY4+1e5kU#_i2WK9O*ix8Sgzs@K$*0$9RRjrC1gGtZwd@6m;24^eHn zE@DJ9W4~wX6a7a${#obt_n+$7t3z>1Wg_07Rfr$j2st%)YlEkZB{bvtdPP-7BPI>m6l5XU^R0`Yn#;581;{MMjR?^{p58e^ z(v&cp-=HErpKyVPG2uRSv4Qj;=NMz$rQh9Jtnd%m>3==I9qfGux_PJW9%9BQvcr*H zKa2+E_&|UNMlb<&x;(xG**4TD;ai58-kOx;Xp(WFOr&baIN`;d*Q)BNd6x|*ZRaZ` zd)I~lgq0$~%IEeLj#~TJ1sZ^<?ONr6Do86y_~okX@C4QUw%3$41e|9p5;1XRQz}aa37+5T9#WM3MK)n zM#FF$l4x*ig%HvKqex(w7n{Iq5&g&}?b!vg81vhifD_Btf{`TJf|jX;o~>47xGvfG zU-@e;oO%{EM5mjWT9wxwumpmMZW55;6o;)WFxl9XY1u{A{$PGe8ER2^;h0T7dp>Ae z*3d@qK+SPC-|Miy8j-t5U_BI^sDOU|E-xAKDhNi`F~qMVP2dpMU&0Ovd0{Ms79Vlf z`YGink`q3kJaP-Ppq;I)QbTNFTeb|d}p`jXIQC}gn?cqu6_V9T}mnTd*kE9?B zF58XX^r~u3G)c}6nuWhb;@Qtd+T1%`&3q?K>Ut$&sKne7A!f8frwi>AZGq2qtAcd> zff>^Ay4WzX<5HUDuVAl7ie&iCRQ_Xlkc^s5kx}!KCZ?}smQ5IZu~DndcAgl3E>Ry8 z$~uUJU=g(fp|7>G+}SBauU#M0+EeulT|M5)5rNgUj`5u*7NU%{1m7ruV`s1~CMxk4 zG{2me)Gzr4p@@L1}DEY8+Y*tOkM+iOwAz;&fP|0{`KL4^dFO} z^888lU*A1=p9R^-0WM^8Q%Hc^0tc*Y%bxsB{>PPq658Tk$~1_AXahC1IH?p*^5y4U zN0go!NawXSVl#OEjD68>y;mf({&Z9IDJXhhRdezheO@o)9$3+3H6GrCjLR$x~Pv$vX4f zM=4eY41YM|tXn2P#V zivF0X&My!-h0NtHJ>YQjSb>5tOCEb&ID{P%cdMXOIDFOZ41j-%litj3DVf9yN>}tt zLCZ1?KqMIYC*H~{uCMZuOFF7Dp8C1@mR@iSn*VnRq@jE75{>RK3?4%RdNRS3EBmv? zu?idhV-eZ|W*aQk-|Mkd_xH-*{vZCw27~l?5CTYmAf$p%5XeYUe(A87HN$tK_|05F zaAj1fUXAXKb+MPXf2;^rwQ$|iMMecC;rn<7 zwRJ+-NKiDn8=-`B%=*jjjb0F@-&oB?aonp``SpGl03XDlG%a*o6vJNadWOu7)b#7| z<4rQ74wsf*iVf;;yW>tBl$(%}EYpi1$`aW`r{!{}1Clw@U)CUlXO}aaKT*lYwleKG z+kF$;6mMUG%bq##O>}gjwvq~nE~rIu^kE~A_h-g)b2=`UDp28mx|+%oLI70{i;F%Y zg0N)w+&iM9tJR%L0MjH~k#)_|HufaI%fcZfvRQRo@~)J4J6aY=>cpD-Q7B%4-5MY< z)hv0w%&d?(PNRDAracg5PW2J$8xt%Cy8^aKK?q*yc?tGzUoYipgO*F5;c%d$0+^!? zy5{Hp1j#F!XDr7PEax6$NB0?sLQ9b0L9Xwr@UGB%4sN2thsr;{U6Aq^zphuV-q#S6 zAgRJ|=4@WcSX>9srYC?EQX-^{6u4e3v%+QyCsrKcZn|4hd-3H5U%+)iQX++v-w*Vl z+m1w=FcBkNxqdi|MT^Lq97t;Ng0lG53J)682b!w2SbT#+>CN6iq?!;%W){M6E?2|v z0b?^emYGUIxL9L$rNb(85CL$=O;(xp&Hqu4zef`l44Ux2K0SJVxqdZ;hq2t1KmsJq zgulTv*|*I~Wf;-7cA2HiLcYw4gd{q=+D4 z)gEw=QR_IC4J`PSVI#&w)~t?bJpvytTFsH%PoDi#qG{deC988x2d%m0^yEQ>M1~~$ zMbsDo6bc-GacPBow|-`tIeQs-67}C-k3uzjEGhf=nu!A&p%TkVxa*}-=%-8Xpt&ml zJuxv)t*P^Adwxq~hch&>K~?vwkeAbslK5JieyHN6`n7L9H3c=oUSR5dYZU^U1z0uk zL}UV2OnALzeviSX)`R5RmmJj$6VlAJa(r6^#zLG4moPVnR^C{129Dql8e;dx<5INc z&?LFCMfBEAusBTtUIZVcd2*!ReB2`BC>%qQm=nu>3U=kr4lJ7eJR^l=p(Q2IWyhda3(rkt!E(zfoj6OImr9NM$eQbM?Hc)zca zf$?h(eddD+D7d1{jb>s~-i3?=QE$41^NiX}h22slJNi{@&<3`b0XK9(P!Myoultp=Y2%phM-$4xv=y) z+ZoT9u;p-Pw~W4lQR}ZP6pE^^_TkSyu%2s*90GA^i#86L|4xi<#<4!wth`CEOwAjE zK;c{#M=7G{-`qtk`Q4kq+ux=t0FwQu=qb)m`ZVXap)klnR8MxYcVcNg$hhT1nuuB5 z;qt`yh*tq7*0E<*yjI&HEvP2&f8T;10P|Gj3mAHOp%Go3%!qV|u zZmL)Bb3FSB;8#xRH3D6&c5k&sp-#%CZWpLLQZObC8f=mw-6RI+xZ!e+KgB`uaJG$v z-6(GBY5vdhg{hN+sg<6YC7pqd6>k_w_ut2Rln|f_G_wSME)|1BhX#d#h5H|N!ugBC z6GfM1;tzL&HI>hP<#^LVRVJwm4ddLL{W9U8PkNVvG$4HH(c$Ofl7yOp4mbZM^r6n1 z>`jwG4HM}Eok}4*YTE$uev%+|ec{LId%m4Www%9s((jGVf0XBccr*x3$R=w%S}v2% zQ$!9?)?|3#7#>%*87K*+krAIZM;b`H!$yt>#7z2hn=vKAEoH&778Uy$bboTw)&3^z zR;HLkZ=Y&zwFO#xyoSi&J;0)GdiePgORW7wXXz+>g1i7aNc=}RxKY6?>`Sk_vg-F` zV=I|1$C5{(f$Pd#bh8ZEhAPh}4eo>_xyAm{A%iF#I_}(>@h_Gy@l5jIC!E<{i%|V= zwvZ@=Vx}&F*&ut?Nwg&m!@E1s_5C#;MEp)GK|K1H%p{nJly4hZgtcdq&_0%>US%$w z%$-jLn-Hx%iXzy|&DdR4AJOtCBFIT+c^rv94r8!0CSc6Wx^ko8mw4tlPl?qj3!{+7 z*Cizc%x3B;Vmm6yB(Y?WDH76caW=>OpcQ@}C+1IvexEiIh7muMOKQM_t5g;Zs{33w)Xs#q_^bSj6e7+S-T@9<#^it#E0&JBn9A1$FnD9p z70;hCet7f`*i4C@ppXn5UJ#criNwFsh8O?5C=f323h*O?L%K;I%$7@i zab}OiZ%OEFp&=hG;8pFYT@K%*W5y~^Jk{Lkk)(AB<&ljxQJr%3IrPtHT}isl#>@-} zG;z=kPd=SQl~y27ZSZ!gME3ol66k;BrMWn8xzE#p09gc>uU&j6A74{Aw^Z7(QS0Cy z8nKLBw0y{D!W}qFJYJ8f(vW$1QK*w1e`yKmmuBRG0-N1Dc!1gll{mU$|B0M)>35B> z$v)-8$?M3Eq?1OAh8f}!AE@GO?G|p=?QwJw1vgH1A-Q~XKdO6AMi6Na=-KZ53JVA6 zru@?wr0^<`Kk;kIuLOG*wbH{G_-~_YjDp=>4jk4{2h|PJpatq+XfYk;m?WMi=Wh#n zb`3&mmQ1*x%JiFj=JFgh2;&1fZrogxWOBRG&6xSN<$!OK8=bb1b;<^_?P<5nSTG7| zAmKy(0~$BHF`(%jM&aLC2Nelh(q>P}kB^$@F%GnjWPh*6AJb-pIpT-8*Cf9JaeE6| z;t&@xmDqP~QdrifWTJAIEO@JT_)kx&$>J`nwN&xOHe?q~m~HXIBQSolIRGzf9!t>V z^k>BFIV)Agec0hiU;NwaT*XTjF~@M zdaFnu)p0K-#i$ujp^3&zlBpmSlt&5|G=KC82*$sXB{Xz*-YTG2tMZ(&inSQFR7*0> zo3^25DK!n|uMl9lGd3#uoF(0(uUd`sMRH?e<82ULHDob~Ya0i1+kBP$e(JkpAdxnwU?pcXCPP*j*w1lUm z;Wrn6)1N3@^TspMqb$#sfD50eJS@Lu3Ed9rQ6U-B4H%I4_c-ydX%p)N@k3mLB+Ql^ zXTr~l)X2h)x^X7Q`AhAVjy|4EI6l#551Wb(9;HcAn{czXRzXoR?|~M63OIF<&T&Pa zUtjQiA!gclJu_q{7Rtz~)~#oN04++;sHitiL1|Pp;M<5nn*KR@B#1#(=LdnN|^% zJz+;p#2$|_Bq5+uRJX2>d7V6KwZFzi4kmqCO^F#9vDj_6pdbG}WkLGiKSusFZF0yV zzQSLEh|wsWtl1KDc1bYA-y_4=j6O}=?0LM6`Uk<4c7CUcqvrB%3$p#hNup=>G%Ya_ z*&gEZpdb-3@CL<$qzu+vJ!CLCtfPFvgW%{|<56=Ia6-V}NDAZSK22w;s_^SxFE~%n zt)G^8T`40(iT*^hyL~&RGtT;>VIk0h0!x8zjhkL*NDv`M2XzGbK2Vtg&2M~~KQfyz zn*2*rVf7kwZ=b_*o#G}M%j#1vdba6aF-8Bg^3^uwGEl&RzU+?>u%@02fm@3yo3xHM3VmO9FwS)*^ev@F~QH$FBh zH7~lz3YI095%4K~;x^9!?e(D5^@EtL2$(#_*3DmZma^dh0=X!RZXqY_O834FvR@wj{xM(b`{a0IAIBKqu*ec|1p zq;6lKza#r*PS6Aj0X7DbXN;*yW#sOOBo9K5)TrJ~&u8Nn6X{V|qIeqorOeZ|=22Nw ze?3;_Tt8V}Wf-vlg&csCg$>;GTucgW@|BXlhN2=B<-pryq%PmPra2WSP+}de!hC0O zD`m14srRJx_|Cd9`T_*TQR|r_xs3{URkGUqat~(^b=!{{H2Rje@rS(b)Kxv(|2%Ed zS^bHx@tgeb$@9NdA94Ks^}lA8f7CV65w z4-jSGrkeZuy1R&+YYnle<+q$a)V1_l05EWXHe15_#e33YLFb~>{n9TASq_ke$Ho8g zMK@c0Qz#rncbNUx^Z8R<^AZB&h@%hZLkV_lXkj`AP4cX9qP#r<0l?FTb_5&2 zlS7!bX9(k%go@5)8r9!({;jS(e*@%5c8|2_Jh*-$mEFz|9JF4^n#h3xJ5AnBt^N+el^8v`_?A#KxQjWi{$8kSa9tPcIHWmT}jX5|HEMzV0~4ixx3*itV024?%sfT_Xno1}Nhn zU-ipMvC?C4+Kl^+rqsIru1o!)t|>48fUE6%#9ugAV6TcT*nXW7`eeW4Xaj&L;!Tre z;E^o6Z-+VZjzHA%j@qBBoFl3iwo>$a&cD?)Qf@#t9nisTJV0h2R8vD+5sE54B+BT3P7}cxSKEe1D3uP70g?KhBE+vclU&_#bYJ`8PYr3(395*(NsD*9TUoQJ8dNapz>tv^Ok$@a`8M_wZ zz@Iz$pc6K7*Mi5Jk9oDf<@}+pNp%8pG&MwHJ$Ew$x&*|gy#pXy`&uB?0XbeNAs@5m z*(Xs9Rk{vR!{)B~Ptw2TsPV@C^*;SaT{D;fWHYvv1@|3H@gr!X5?Lym$#*9lwE=(; z6-PSEI$gA>Q{73drYG}LSh-C9%IWwk=O1;gvI39+9?Hg1JYJNwPfiuO8otf0ht5F* z$kBSamm5YQ^|96MxuA~_JwVH#5&bPkIsd3@S9Snkr7sgUlFpgAzNzmVWH(zQ zB^XT>AjdF2D|vA`UK9^W4lh>9-^nR^<@vXq?}u)G<-ln0ohwSgs5zGdvXCp5zlN?% z0y_pa-Rpa^e=W8i<^zD04Jc4|t9(f!DuhVcfo;zqf@i&c;SV1iwV9 zKL=0@mq~i6QnuU!fH%yrk9{gey^~kIBQKKcww|1OQe$^3carhniURrG|s_b>M)WWBjFW{b!&5$@xcbYv=@IVIddZ zL>jKQZ{qj%J$^+&Vt&m@1pxi|6VB_;ZsvF>dBU_Tm zD1`5q)2Kf&%aosW^{CSf$mUDNp(AvP-Zr(RnxR!s5oJ9O!Ty)t_VcgT{U5!Jy#N4= z`H)u%pMmh*=K2h$AzKE35YP^nd@#SD-Xi!?k8Xc8A~0)WZMacxq1DqSL%ixMC2IV_HYY8Q4J>?X4p2BM?{qGgHQFK5Sb_551F9G<6DtJ(|?`?`eyjt%TAV(mSmK^V(%SnydYMo2A zol2SMVD-10KNPr-eL#*bdJnl6ity2jnT)my_y%)966zWt$BQyEY*CCR-VX7mDmF(R zUO8mWJyh#|Qs90i0v?NyEK7CaAgNK<*uRm>zbig^&X<_S@apr89S6SRVFEr3x=u`` zMo5r44NLPLu;3is1S~ZR#F-zJyUMak$|;|JL)!j8;8-I7&tMGo4NM^xA;aM#ow;T* zD4aFcaC|+V*M1e%0=ff?{Q(~io1QNabMw?0MtKU-(??fa6(!#Ct^9{<)63(2s#adV z<^O@eMVSFUl&iiP$&r`n-ok}yk7VeBo53KWk`^4uzkV_1bof$G&Jz+Kp6hUad0=MOVJ7y!6%vDR?I&4#m3vwMvfjElI| zv6Th@?#l?>UVrya9u|!-OV4(54f4vVfyoFWa!Wy;5Kf9~0o@WaNRWfA~6bF={F|M3z?)-yiki zFx)1!I6aFFo#}=swf9n@p8T$o!OO3{Z&>#(x^GMgdziW0c<=unyc-yhPJ3xc+Z}P0 zuF=ucSQ#@_faFpBHkGp2YerByJs@ZxO?jVGxLz0O4U|e$d|0t(48WnhkQ%f_uF42c z6_bPI<@Ru1s(DMKy%^z7-^{KO)(NZlQXk|gX-#(b;L!5b%>v_Td)>Oi-dbE{3m@86 z^T;zjb1j@3Gdt8dV+~UgysxleQW={`WpF2Fo<=!AA`M2;ER@<1tL|aa9BK1 zHq9?M{j)uPugvNjR%AGkmrI=QHSe;8UzfvA-cVNkzbt_$6#GzOzpJ7&4S&Z$gMc(M z(-P#B0h_ZRiK$b!8AX9#6oKzt%`TU?G?aaoT)4?#g!CYSZyu6`zFI!pm;dg|?4ra@ zjkOWlD1_NWY4${VCviwi&i1vO1QV}#^TZDc%@N)`{lo>G-OS;=N9^9Ot#-klaLxH# zsG1cQhMbw)f7CoH^F0}6K*g{u>g@p9MyyUy-!-xcmVaF4x6AX-*z*qpcft+zVLfjh zNrW8^#^>0*=Z#2Uc@fxFuICN6_JFRY7)5`^0i4K;~7|D~dCvv`bq z;hpGUM*yyQB~P8EPN1YjAq@6cNaD{SbB(_EJPJ@~O>yfL+B7;(L(S#6idm`MsXN_< zIRztrWwI>oOTvXv&x1S*2zmomH5Fp^P|(7=k~0++WiD{bKbu&<0Pub%02doU$YiSIdwxXT)L^~h?c ztgg!NkR)TG-q6tp2S%#0f(X!+F`z>##P+Kuo7&&eVbn{CVBRcU}JjANO*X!u zyG6A5+@!y;C`11nfqVaJX8s3(D+q!Ighhk!#SAlKJG8?0y?SUxg}!`0{6*vLSkP7A zWPWD)bkMGta)w-FOxZ?ff)hVBFnhM9bIi=R1R6$$IkCW7j@NB5ht`VedAZWniQ;o6 zf;`vh;|sg~qwr_7q_U3NbP#OM1Q^93&_NrlJ`{^RG#np|J2=9#{#)U3g}zvXoc@r* zGYoD5CRdjsR`s*Ohxc@_cfCLYnPKJR86Ms}f=|FSHasF=y-h!&fgor(9Ff{UecGc(B2z$eazy;`p#*kKm04eFezWn5(5`w0K@q|7f=h=KKTUf{fQ zc%nX1ilxwoV2@bSc}GRB@R?&AN5D-%b<2WFMo{C^{G+rPg& zXCm+b-xf6@4W+O311Dp77zI1{yUWE2cxD=Pcm`s}w!>}dMb(oIp(Rlf;!)InDhO1$ zp!R#v+x$5pWJ1kxG(T4d1$q!1{N#q%KL1ShLuJjq5?KnY5Qmlr)k){tOM36ZzKJo= z&7?glN1iTk|1$q0**0A2a&i3#(s+23>ZFGk>NfLBup9J4F#xxgCb`z3)WFM*6DjfS zN!ZPrrVe^@qOoBO!;T(7V{e*O4pVX!N|vU8UyPKK1+!y8Gf89D`IV9!_6?OkCdR) z1pd|tuhYE%I4FV_ZNid)1O;6p;=wOJr>`DX4(YNxbyJ^8>|#YKuat}E<`>?Oy?FfG z?1Fe03}7`^y)sA~gip})#T>2!Ra~#;3IBz_?a%#rTn@R->dRg?w{qW@>J2jQ}jIl z;I~wYYl}yz%;|j^(}i6J2-+MVdIjyF&?=Sc-eytJv~-t`MkMmZgxa)6ruVN?ohSI0 zIoLtPtVK|y^k%8ykmKXTz$M`=c)fv@#ka|yb4b}sco~_MHgo@Y)h(>{9hrC(qg}wvaF6-&xl(*HTowW<*N#`P4(->6-xY zEhZ(KOO)mNclfjffw%x>0Wb9U;MCd-bp6$aME|*wNu^$zXORMrL2DfSw&e!l+x3=j z4NVt*HXY~&T$2MX&^qft(eU)bX`aywkVNVAd$l{i3}hv26%}E(%V3kH`!Adpp+KVt zW|ag;SsJ4JbxrAREc$I%+W{1>Uuo%Z2@}fY)a_>ml1>z)p%3tMiE8PWn&h- z=^LSF$@{oT>-%&@h&=ysWcMFH@gIDc5gOu$vgVjWVFCRpI8`F70?0EnQoFdmKwUD} z2Hhde3g@Cmi2JG0wRK%tus-{AgSV9F+fNsaZm#DcxaO}v5odQF?aDK8kVK0=edDV1 z`*`P|4S7^4Gab&HvwFe{Kg(F0ug*q3MI$XHzgb45kxS!u{{&X>g64E~3%et)k=(+) zgzvbv8A^rWfpK?y0F57uO8s@|<3bChIYq~e0_wEBWTwna3Gs;PDc=;3F_cOd5LS&c zGf{db0fA*iGKO7f$qMOVT~Zg3*-c zPPRV$1+b5cD8|DF@IHhfX&JpB0WMUsc`l&K#5l8>4?ob-gGcFR53&qkI5ix7LiEn| zz`fYXmUTM=o>pe+J4NyR(T;>K*Q|WA9$RU3{O-$=A7uvNZeJG6go?5nTgR$EBSyl_ zfMTsRjU2sSbA1qd`EKxbdpG(MW7DnNIA;>A^3)W;*>a=qi<1SnbHX=Zm9Z?PCgAKp zg`E@93s-usxvI-{x4M3#_g6jJ#QnV&X-I$=s~Kl&Q7*kJ)mp?A{7#Ezi2P>< zWf8jev|Bty3~DK9> zMa8uG=UHf%*?_itBc{%mX`N2^)E=D@PI&k=N={}q6@7)q@P%sf^*f%+Pv5GaqR@8m z^lJ5`&6hk{^w*Y~P$*}|(hwljEbw$7N@R!SpoE9H9)q?S<2U$Bs3D<6A=$>yPY9{x z?lmO*5-)%zE048K_F31K6VS)S$(2d3!;VL`UJ-{Vo1Ad_R$6eRq-6(T<|Iu_E@O}Z z{#?EAonp=9LO)UDE+xK;L-3~oAshcuy7z~IjFCyb(eDH#JseO{brGD-eliwVyg*%M&Op($IQ{+2azY{LCO(vU?S@c_sNZojnqS_M1uDA|__6(`N8+P_DHRG3tPj%?ZHO7J%Y;& z{q9ZfO_O9-d0JBtlFJTECqA#sFFY4|ZW34(?o#!V|>u1IKak~zJ!H5#actisiZo9yw zfNHgi_L1>4u`HUwIhO!hoNbz>1mj6(Q74!hHxkE-y~#>`xGbx^P$jD{jv}J1u;?b7JGFDSsJI^D)xc2;DQ(Of#6U|?IY`&N zFQXn=11iStn0>0-Q{WqI_YHwp@#3?)FgdhrDFE7~`F=hE?m)e&>GhFpIt5N-jcDys z%rerwb~J$xNUn|{;S-x5*{EB3@N!N+W4YTX)Np|cDNtfJ;0i?^dXcklYRo1HEu2#} z56Os8@otU>t_3CZY5{C|oZPkTlb(bOvo9`CP3;fZ1E|t!GE&K{xW~DmJhrVs zdS@_y&wcH16V%r69hi$qI@0LNO(1lZ3I%8PKmytd!J+)Liol#n$(4J4zqENuwQdik z0SZGh-)A?{B_qq?u||_b&@GI-4QlpGB3f6@w#DD`_!l2GY=QXgRrDi-%~9^XWW!5W z|JL1XuBFz;Pb`4L_Ht{72UQCa0iyNe@RKG`cuwf=Ze z_8zE1Cb|XN+DTai+r1OYQ>`~7{jvTW`yo%hF4yddRS-v#+c&o4Q-z|}1r?A#Y6()M z=XfIZ_QyP?tEneX>oet5pzEMz;Cv}-Bb{DgE=sIlTvu0oa=Edr$Do+X*3GnMgL-IL{48iC=M?WElnJN2h#QW+2$KlerJ zlLPU374&22fPX!`o_%Jd(*3-#o|uCXV>huUvR1aIEwmk7!13;^-72j5sVt7KYWDe$ zwRZ2pZYQTELfi1B&Bm6)4>1zB4iS>xvQ@M9h-uejDc>D%FK5TH?YAoqBXrUvN2%A*+smplubk+Gv5U$ z9hRaf{17&S!zB)A4P|3^PXz-#a-`XLjv5!WUR(Vvxvhl9mx7oqq>Ajl6G4>ckp??n zjnRbL^puRIfos=}le=F2XA1G%b1(@EiewkDaQO*f|IFhbd>Csa5>O(`E0EXvl5CD7 zlN;5exRsvpc;tQvS=c+Y7sKrAL23=XL`_#%tJ=z2SFH+1BCY>Gs~;Z0AfdIV<4{1T z>T^LKR0ebkH1=^OoD=|Ykzm@(;nR()4oUF24(JpS=?DE~WXt5xNvtGvHQ^1?f^^#} zj-k-ia?uhdqpn7N)cYAm**4@d8yDnOmtt(ZCr8hGJ&0uG_MtyU@+1)^*3%gj~ z`HxCIxUkE&$;8Ka+gIf8M7Q_48YBls3SkhDQjDR<=spB^{^ZS4)EEM41KLTxm%5%> z{NPUdx&~x^*RKSg3lblrXN;m;G{q>7`^%KE=S;fT1DQLla($gAY$e&GMn1JyG84+K zSsHR-Z@D(**s9LfVl=u%|GQ|S=`0gkP@MPBaVulmBf%9rgz(lv*XF$1(*>jDE7rYQ z(NfrnPE};>NmiZ8=qVJ7Js=HXazKv`XGm-Y9!lI21Z#;xsy6%WSgfQfUfIW3%iV#2 zd}YAY!qjIL3+vHqKVos~N;5>g6$JOXIF`(*T&Itp;H5%VlTG7`HnsKcIX-FAH>p~M zt(4srsCVOSQW7-T9#kSNTZ)cqTHR!57U{fH9=xqyFVdym#VzEc$BMiTA z@E&22Y#E3Xzh7R8#jQgSw6wn+^w>c3(rKvLzUAIEAlUxj=JEaiKmT8T{+`FbbUAfO zB%tXbv0Ou)24Uux23i_wjS3)QIJ4HEb3-b5l>=##62I}-nY(+6G^HbGzeC>@d&mjt z1w`v8biPYiTk|EAjJy`3H%=P?5R2I`cq5o796^C~?xhtL!{Znl3Y%`+T;4;O{0d>y z%G`kou}ki;rN-$H2s0GJ0yN5qVLQee&P&i4JMUWnn8$YbdwU(q8%W^DObSQ?!q>>+ z>U4bK`OV>C_7_d(qsG=go~Q$%m=B)+ec_5jcfv5X90^^@XMKxYOe2Hh^0Q+VKnlzs zXyRO01Mk^9-c+Y3x`t1aH9;Csap1UW!nj2b@9w?j+(+^locIg#tBddATbk#Ip%?Ra zOFx&c2wKR*@+Oqs?K+cA+yZKGHCKcgpaayYv2*6}8aUg_z!9u5gORf`Z`xZ1U|~4{ z*8arc8`Uky;oOsip9J}Y<~5Vh^VuCz7Y+ppM3UBQL!GqTw;JSutbA0X6&PWTaNQ<< zm{9H}S2gKYoDTtcU9Cq!PdW>Guo1t}x^yM5-PnwMIg_+olba~hec+pR3*}R3%{m>b zroYX4yvKa*SCHHhA~neAwK{m~k-Aa>TBsLP4W>`1O=W?7QjZQY85f8qN==!Gcro`OxFsDB5N6dtHu{e|{;A7R z`6GTSDB^m3ZU$?`wrZnCKoP%S%95Ex|30~M{v;Gw=l&rwBy9Ee*peod=)iZNhvgj4 z&L1ANn6!`F+YPL+%xfHNQf|`h6QHmzVQ%|zoH6AVJt>4$@!Piy;~KK6t$8uv>u0$- z9So?omlgJpQi5wqC!#``4djh1Nlk++!81(kk%(EK2exB(e8KvZPdr0{l)`Plg|4VW z9R?<~fE5ia<}^j(%&~@ZojteW^H_U%Xxs^U3U48l!QWgoUmxW>L8k~msS{mvS{Zy{ zFQ+{08KuY*=45@!18!cRMc-fGtxPv1iq1#cG?$PLqWK|LiR_zBMempVCDuo+v$ZHj zk1X?ySenna15~8A-KEo1%upoML*q#keU&foeuy`8xrl{W7+pm+qP{nfgws>y1dy#c z?_#{1;q%mBgZq8rxD_@RefGmI2Hb! zzL@>aXFQ|cM$N_p|4@vuN;sXTSyDp;r8Q2i2oY#l@SVVl@jL&eD~juyu~@6J1p{5_9< z>2i=&i0|ONdhh5FY5v1O+m+s>9%BoZ9pieobbwKCA8RA*MAmWzlg}vBvsqdcGdJfvm_Jc7?X8?-c6jaMQZjFag1t6t zaXLbd{g7ED4AAX{m#b7^Ag~f+3}{1q^n~}MExy26L>Kmv_35AOawTpm9ow8xj|(ES zXwHEqBCEwt^Kz)$uJxzals#TnqYTerFZ&0A{I5xO)c2ByASP$urLi0>fzU~ms54Gh z6cRn|T<%wP*P$;~lG~f0>l0IBDGB;6O^y|icg z7~aiS6A~rxM^Y&+B^d?Laywkk2m+2eFxyo2=HV~Pd_-TS9Ah7V`O0=i2S}eOu#bDA z@za#P%gPmcg_PV@K$1-{dr}%)gdurKSwPJr3C*sU`4ao*JXpWZNaoa^PE;9L^_|XH zH+(dtg%Re3U(i$V&_p4kxa#CIqtKcR$8QQ&>Ny!N^5P2OLp$cEzqBm8N(ci?QW>!# zZn&8>Up}q2$pNp)@QLtllvN`j55YO_a}e+y(#CZRvY8fCC;kS-npJ0gWr*st{$>5) zdLBr^ybl}!F{wF~qf^@)=DRxRhBRsA#b|_e%7}N3k{&E`Q)d=|YwC=I!*_E!sdQ<@ z>~FhS^f`$Ms_V6_2jY**&uczheR5agCplin%I5pZmKa4{+3*7ggX##^5z?*xSO>|e;Iwatq)>B_6+*cGN?BcJgv_wH zWw7ZVVGwn#U8B7>@@gc}1>hTAO{ORmmvY?8miu*%_8_ZyaqBVy{#3tIb z_SCnkCvo^J>ezGRp{}*2CX3e+)D_&{9!i2Bp3K^%4>^H>$_A3|=WNoE1nFaQnOPb?19^joZ(>xBwdnR&Ui zOqpETCqkacjUn;LBwtWUyT>(LWdxS6Dj$ zuKjjz`dQVuAY=}3QowFJ>-hKS@h^OE#0?23@S;#0#7V|0M76dX22zS{lJZ0Pm-nEl zOZvU6=+Mmrf{4|^pc^v$Ht4pK93EXJaXkNdY+P?af6<%XBH09@XmLIzj5yklPFue; zc9`}~1o+AR3F@0aNAVt~f~;>B| ztD~;9S3rNHEmX)1SB9+Q{BfcPHI4oP48uL0x+SekK6zlGw}qzfubMe5>YJ!V(uqezlO@0VrslbA zG0_+8uJl#4a?;e*>}NI=D{=!YjsB~j1FPt0bu70MnZRb}{y z9S8KV!R>1g-hlJRCohBFIqn{iAsxTxG|CC}`#y*V&-9)kqNOV`2BKRM==B-|-A)*^ z?{J>RBo-9|7~P#$RNhuj7H-!D=1kK{>YpYf9ks1iu>Uw4wvIP}TpE_snqTAq{dvS6 zzVxhQ45mXIj9>8BqeU8AWjfXaB;M|z>%)a=w8G)>wlmzkhLSpU?=TGf9B>k`cj^5Q zR6JRUR&~n9^CC7|!kU7I5K%OLYnG}azpo^NJtYA$!#7a^qC1%+L=OJlS>@(XbpR3+ zd&xIVWc9=uz*Te$Ot!2^8Vh54hP~i|CBz?`y!f*{BHw#0yDZgBI+;_?i-CdM#b2;& zo1kpa+}Wb-8rpU8d4ztRO7LMYf9Y*6xwj3+VOe&T+2uV+&ZSG`}Oq4z4Xxe7oucbE2~&u-58L4)}$QH#fqE;M?N zLz-O40%3a_@k|^W`V!6JyyGc#dH(^)qx~95gzVrnim={jRH=4~o(T`tj0C#e2 zR`$*QB)xGs+sAh3*=E^2d6(=uT-790(wo|X z&9L)3*^_KDUKm#zKC*-6AuI`dC9`;X<&~@GK4ktS__0_x6=KX%du@^-%Nwb2w)a^w zkiC0u`m0C=ky@)n_NV2>{kTn~XUB=|@J!vjNK8{iSDXQnO#1A;-Wt(YE{@20p6(^A#=T$=YGJxI8xjGW8aLFCPt&OMndlH!_NMpc4_>+Z}81 zScxXP<<&D0&GSXRJ&^Tb#-DCM0HHFUS3Bp>W(vl0IDa9TfCvuB6*F55}aIlc;LiqO3yUC_& z@$7GKUuveqDsiFk7_;Ol+@F4eEIzw6np~E2_z%ap<{1wBHp4Qef{fC=yQr) zjOAo@75ipmW2{kqo;TpUgsmAY?DP4d%Otokg2d!Kw>g4AoGn`hU;kU-%%yFygnMn@>#S0oMumyrhZpV}n+U zolYUh4RW$SvZ}~*a9YpPtMFHb46YPai zMaz;2#mDfj4&%mf88?^(cbSt@#8`&KLod$!Olk2cT8LrVifVXKGR`4^njhDW zC2em?j$Jc#rnI^DW*cA#VZ(cx+GJH^rX&4^GvyaKAE+E{Q#cR#LzR2!?2QBUOuVjB z&z~j3mfvao=G`TP zH1>&*eHoH-Gq)GE|58bcA}b$PW`VdLB6eoc(Amc_>T%B5b)Wcnlz!`9Xw2QSVqvRd zv`Pime7E4`A9DnnsE(*>J{~&2`ABh^mg`-X+u{kNMp0Y5h~gDr|bX{VW0em z+^?Cm_At)5O)y5IE8L*dDrGSh;3wi>6lBm+vURQ;U{&HmFtUNoQqv ztmrPU=~OAiWaRH}8#s+A1qVM#+jz243=1Os#IcLkXH#5=sA?ekvC7{nI3GKdsFnc% z7}U!XjDyG{Y*CEttjRPbzcADTV9Y76QlG9Z4c(sa=~&OO80J3Dqgh;6tzA`OKo(v` zmGOOYo<`5C)esVSZRcVcxppW*5QCVk!@i|40b}POo;(fyK$w3Phx@BMj<|)u6f1|} zF8t(YxKpaff3@u;u#qi7G-w8FtOw~wG1;TNy*BbNFk?r6d)jn^sx;w0;fqjecP{>7E$gC+W%*I{IB?+s1o8AHx2u^mV%;m78I0; zRUIL-zucYy@)amNAw!Mwb@tI|G&s!1HNQzAqXDxujbFSJFzapYmjwX-DQKj(K1 z#KxQk2omCWeC+eZ`o-47E*Dky85{$9Kl2BZuPHAvPdST@gTl$cmm5zhE>oD)OluR> z@aSKsYn`5Hos>1@W(eSKs+JYoafxqd)XRJ}GT2Ty@dr|OrpTUNhYhu_UZ)O_lQ#pA zNaN@EZ9gW=liDuY^=TLcq;5p{b(f(%;7^kMln|EU$njl{LI0fLBrgV zep#O4f6dI@IeZ-v5U1JNEt&>$2SQnfAXswy5cc_*K68_#}7n!4+t zbN}H+E8!Um6q-L@x#$tC2Q=R}qcfaav2p^{O=7Khfe9m+$Or$jxAfMeFWr#9uhlG_ zgmj~@vTAC>tkYmCrtB4*^5N;Bh;?hUnYHJBM}?959^DXg;9TkD!%1Hj%M=3&g8#@=Nd^)cH>+p;nR+m(j#TYH)?6*4 zV|#_3n!-x}vidvT5`2_ld_xOGb)}`})QEF3opLWE=->1B7e4s8g9OwM-HCpeiK&ty z7)*RwtztooSY{W#On^6%OwdP^-F73F<8CcVtM%K`Tz14HZCIJkW5@v6#}UfTAGR3` zcxA`tO3M!6aoL)7c?(!j4C|F?9zkkhj6Q$00ra}Xl3un=`hDNs-hDelmST+R68f-ZGGB4BLo zVR_ZmE$Zj*pq1UQ_8QMqH0AYrry_l9S1{wf`M32G=+}^j zP5hdsSqqG%5&1851$V4wyRj4F=j%{)Dn{cI_CW*XybAWfnh=@CffF1H`BX$dx`Rwx z3~;im@K+Z=4XzoN&XGKqhNW!7^0MbL`r0*vkd}kDgQCaspddRAXQy0fTvxm$a+ z2-8r3DsarW%El6nM6}_Dc(=TevS9vxJdQ4~Fy? z`18>W^UZ2of%w?bwYCZP(&{G|lQXf;8QhQc&&diS=k@KLMT=DZk$RUnEpLFL$ zJjod^$s9gFZ>QvTP24PxJhqVRyq(+64?C8BRGZm==V0}Mt{b_WM*k+wp%(*9{b^et z+}D{NL#6;;$tp*Uv(+|+0wnCB@~mh_rI<(+X=YjkcqPeugH zj+vK|HFJ@r>p0})kWMR*TVX@Jl9BBqsp(wko0mgRr95AR^%vF~(!}sjVyb?JY$F%r zgtMD0n*lfeW-|RuB`ZmMRr8^buZmSVjV6g@1;6sXckc`1*y#8D#UFVihc_i@%{6hv zQ|%YPuB>?xMdxUU-hz}ZKa9n229itVW4$5GT6jSHg7|HK5-Qiu61gK#H<&zJi6~$R zU{_imqTDR#Xde=o6$5=ywD&x}>EIxEkDXCwij4!uJuifMp#MHST%Y0pT8sS`AN15h z{I*+N=6V^jS;m$q(aTxu!oV|TG&|Ap9!d20^?RxS+XH)9NiZ#x4O@zZ8 z@+5Yp4>xfQ660{18BY=DcvOlq4N*VpIDj7{Cn7@bILzp+iw=yKX=o0X`PZ~l#;zm+e6Z@Yxd0XdiG^+ghyF=XNos15;K z3O)KZ>}|2xU~wL89nj|%zGy8>4@4x<19x|B`;_IOnZ4@_B`c)@O1a}`Tf=7!rwe1R z19RL;pg26g4;Js~E3^`n!7Bq4S^P`xKp{*??ncV|`&81E=~2G>4TPnmuTlG%IGE+o zMCGUf!;(nz+65%*tGl3X;QXLw=4q_LL@eQI&tr!g>QTouo)FgT{S6%DKVUSf(~O?& z8=_07hrZDfKG!X&3-s@+WQ`Lvx{1Iqh@0lOs_zcsZDKu>s~1Bv`fQYsx`HG|ArHd< z$W<=i+HizUR%afxImkb&LJH&05B`vHyz~{}D#R%q_rDM=WHN$;;pPU%l%Ehsmpi4)whT=k1Cn)V_^Q~E+iy!r2^ z<@LPP5Knol7GI`B;x!$y^??h&@07(~-C0E?u^Wqq+T&I;8!<`d)5jhc7#e7c{1aFd zHa&={&W7M!`f6?qU-v?DK?lIWCbe{qp0ynHXM`SD2dxbNLpB0|wdw+|;Lv0CKTr%m!3P8_PR^=}{$+5Pa zQ@=sUiBHr12KypJSn%j~1IgiFn*qV}WbZJU03*@EJ)pI*fR%PkpE8xRg#x^z~U z%ag(5eUqF458}bvWjN#qbxT~#9a)1wNY{)>zGD+@e0OU%XJh*xqRh`iE*fh>0RpS`@^c9cWooTiX+h`reI_ zZC<&25vga#Y~{B)oBON-a#k~g%53LLoMrZ%;*YQGFjdrH3INovQ?LS^3G$MTK^zEP z*YhfO$CsKkyN-nxg8Vi=z5A;RX*a#@7-ZldhP62W2Zh`lUr~#eD?Dr(dMz8beid8! z^dE)Um64t+EIvzfxrXroM%-=_QqCEWErk-3ce!QOaITT@0D+6fcXbWJlW0W{GRc~K z=upzrak=UNEK8;zvUF#(_}2Iqy2_<1uL#i2l^zOOOrx(*ZXeKaiPcV0(G*ZXZ!494 z!9|*$xX(1osE>UMxhBiP+8IzCEZ}~L19-m7mq|6fwinP7wM>d(&kALBVqD_e3>V9dk4fEp&Yh}W6KmF_WbYzo{wX@lPhFCxSpkgj;N~aaS{A_&M z?_8VeDVK>c5}%l^@@6&cYx%$;ghIMF@^Q$+GZi1VcrZ-3FXjW-Z#bF}VHO!l%La^A zr)mHqM|Ua`U)m;s?_Zv_LGiSVJ;w__e*F^f>~^CdJJwGW6RbcM_|!%g^tA~~B2hYU zIp{$K6%aYGqx9@!mhFpoo+T`^vj&)cTGu&Z_&V{z%-nnA9pmFvbKbta0-rp8ADDAt~c`(Bwm;&BRsy2WSrZT+e z@&Tt$ziwdvGsd-lP ztFI&^=OcFmqWBD7G&m_;w<0v4?i1kK7R&o$KeA#s(xIS~A>K{=5Z&Ek{)C}PX0{&b zqSqw=Du~PZ1^E)9! zlF>|V-mq4H_9l^dWU(WQklS-bEUP-zu#77}J zG>}082TeHqE=_dEzb_>jp`wSzQh+XFy=`yf=yt#YhDBkd7^4-MtFBx~-$#N1ItE96 z6b2`)D>SfJGu&*OmU~S2(hL<72@2TCMWd@ZI{J$uti!QvOXq@b?F&rMQNZU(@Rwai z_lcwtFoWJTVj4l+LCH||hprinG~s%v0iP&=hG`1sv(ww$@3oxw?7x73ngz1Hbw6ra=za^j3{`^BV?Cw;*1p z&c2EWqdoOaQDq}|yRdDmZ%rVV-GKtzo>1i&23(}>YK!Hy7uzP_a;cPFd?-jZ0m>uX zy;_44`Cj6$2?@wQJ=rO(HH-&xR?%PS z6;98L2`0r(M(mS6$g|N6d4=#QbnfnAvB{)UaF@GeRmJFs`)1fyMF!;;xvpMA62W8{=n5661=}br5*_Wc{un|?(b~?$ zIf3h(-g4BsXaa6)6fS$CW`9nszH4G|r*2g~gx-b3z56v-YV_SWOIXFxjqXtG=Jjr%{Ujn(M<4^*0Sz8WU{!EK5;RRK!MIrK6*xFAynTK5tyTv7@Tu zXb%d%U`7;iuWY(b6C{(XOX`Bx0v%a%(>g4PL>=T@lh&J+cDfhoa?^5i!QNbieMK)maEVgXHn*mS3C4hS^3=Er1v^;9E!syrNncrWp z#i!W3#@0Ix-EexZY!wzEz+g?&SsNgtsOW3NXm18q-y5t-hufK8K!cF?I2@>Or0u$fnJ%h)vH(*3@ZUppk*PIldyXw^(dW*gA6 zCUX?w;%xwN6YLn)OZZT*0W(rbmoS`G1K^PHe$RU$)D2N}YLF*Am%R(*AgFZdWbeMy zi9$E_>?le>#<`gX6dJLIB^sWpmM}9qN?^n%r}SaXk{=W0ZX0U6m)!*FwV^~^feiH6 z{;KaK5iwphdm%v}=8m%A+XT6?x@o8bUBlp3o&4mE3s7OYUyrlMjE8~!Zb=@Ymx3^$Kg6KsHi1NRSEJz5Qy~QGEWt$dc+&78`&Q|g6~Lo83IIJ zB0&psIOFHGt6c2QIkNjzd@hP6FOK$Fkl25M!Qand^Joq)3dKeK5o? z3hP%l>GBx^KK{cdQRnnIqC^Ba5V;L3{QZrZEzv^Z0`(yYgRrLv8(Gh@^XQq}yik^$ zbadFRo1emerY_tTbSohA!bE% z%*+6&mwj3%aK@Ry4@Gn}FNzfpw#FjHk~O!f0+eVchsDjGkNO_rK<^k5anxg(N&F(E z)E(`L)vg!M9xA8;&&a=?z{4UWGBCAF11TQ*E=Ez9JvcCx_CBzuO;wf#`OMde6?^Q^ zcUj3=$J}o*xvJdTcw`v+Rs7LSCmnk=BVh5v$IUXwUB@>ECkUH=e6B7p&Tq9E^d4&u z2^2)M2%Dh$w?b%MRq+)g8o9GXWKX7oP@DlKb`BRxnPqoUN(A}=(cSN2&#OT3GlTqy^7`XDv(SUM8~aL zA9zggPMhPl8I0a(!0+w@O>*UXGCN%%3enZtt7+0Nk(#`Ar(=#u`MecQf6wDzHl=$M z;Em#(^s&+h8C!1_%hrKpqe}>Po7JY}1k)Ci_5s$k z6iU=cpNbG9=a(R^R1~G(EBx)46bqdBbT*U^28yB!8=pU?Rg^RTNT(x-A>BKmb_}vX zX=pE>;|Hq^9gLr1jLQBzYt!b>CrzH{V#oN-kzqTu2LFoJT#_#{&(uX%ckL6t0{+s9?A{t){f}-9B*N%t1%PS1Z zdIo2#abtL5^7*%G(DkPcp+N>}u6dUs4+IH8b@MY}p(ISFS9@Q%3t;Fh8PQ6IDRl?2 zTD&U&k;ow=cE23L0lZb|REBoizy9DNSZ#?2k1*Oz_9C30`MA=b@u{f?m__UFc_RjreWTjlQPKd<8L%cA(LnGqWRm{jgk0Ml}?08Af`GZTeZjc2chEm8qlD75*xdxJ7Im~JjhOYr{7FAqgY zLb{wK3f4L3;m;jESTclJ=9J<72>Y^^R{$X}qj*AM-k?1v60f~la@WVkp{vO;s=1ev zOx0Wyy%Zcp)whIPw48P0)P~Z>1Iu)V(9Yt_Ra+_fNouzHCW2nTrqp8wP`huD=}&0? z(90Mle|}29sdw4%#ZI`o)iB(vm);9($NWg#{}Emr_2H z?Q$F7>?Cbbe8Z-8Q!W{J*zm@;7b^~Tw)@WnK-hG=xgb;@1MIXF} zaA}tTu;Hh{A#EHOR-fc-o4ck~$g;lWv&W8a-c@cf(5V(4q{Q2~EKv2w81Wq-ZK5PT zcJQM8Bw++7$vGZn@ZR)RB`Ac1Fn)b{V`G&#hAhbrkYKrTxHVUG%SE8v z?$5*j$>V>uDf5w#fSUPnsvUHm5>nAHN?W$I(dVIKnQwkH`JO+EEa={CdJVDmxDvDB zDrYd2hdP#zmDxD(-gujR0SS$NB*IeCHM7#A7;J{;6wBvzf?E(frHnx$WT$VsbsLNV zoyEt`zkdlaPc32JDdef3`n7;-$a^MCEX+NkZpWzzvM{S&rCDJ^2Inut>4=mlhH5qj zDQ_R5C;OdpmWU^HGnjLj-N7Khs7Ss_r|o>|)D9W+KG?Zy(e$-=Nq9;zL*o)TfJTFP z)B5YdDhu!F4cPG&j7|UqND0+P+du;qZZ*?#( zJss2gyzk%h_%&?%*Yx01mw3XSt7Tgg{n`J+=78>5-E+#9l4Nd-T0VSnlFoy zgUN0aBad@=sVo~@4SQB<-dd(oE%zNm6nqc$($|e2V1Pd7zJs*Evsz&!F-=W=B%TbX zJ`F+^8e>EXJINjdU_V8+(cE0Qu0uZ09X~q{MVHtesGjbb-=yL3GRzT5=B1wx&-W#f z3e@1AJBldz+pku0z?TvYh$Mh|Jv`+llpRV0Q6&EYVC2n z_Vthw)_{f_BP%AzLO`OYLkLq>*`Wie_B(7{UARhs1V!~zB3WwtPLLf_fuQxRM2O!I zWHWxKm)#b|DDWz5oh7sRe$^t@NcOw<4+*4CJ1AnDG(%ZirU|K0H!}Ma`vH*Ek%EV5 z*DVt<29K*+mUAKw1{dV-{YwK(kTH$#L>|~LKi`hvt{l;DVzk;YuwDL$7*`pR?ur*p zIUXH*>HF`FTnK9TFl=!iMdc!In7l(l2OvCsJj(YBq7_ccg~WESd9<3hEc~iH0Y6(+ z0WDG7*wUydM@03|vH#hc{-w)7fP=^?!~D5%s6E<*4t1g3;pHDMp(5s~P2vfM5f60Y^c|Hnsg_x!?3x>g3M%mX<4{ zvT*Tk6#4_Fi_rj~nHr{{Cf!RsfA#0|6d*5wXv}D*@$jk)kc}!M`y!--uXmXnhD(2q zoK|#|eGZ*@{*wAo4k0_$S%D3wo;jV^9mb z1Z~pl(-tn-?426LnhLflpZ;k$TFPq5r}tSf^DlD^oiSvKYapU6YT z^$Ow1*`yK&hZoaPc)L&%H25v>8>;p6s&31jwm)$b-oV=IUC1W(6%ImPbGChy7JP7h z@0#PQIF{0e30dur&CC3J{2#cU>ym2Ke!kcXuPZ_O`);xpdbjyYNKy}{fCumiXkx}I zcnuqLz$~Z9)5apMEhKw68xsUdl|R7{=C={9UsD5tE2c^_X418Tt6_ZWjY|i{8hE@5 z>3Vw!2A~!#rDwUVKPq-iWT2SwO+Tw~F582T{bzdouQuf*KN3)$I986b*p=HA+*vn( z-DW0?!rXb>PhIY3kp-^c0V9H~rxd}K)(QHul_6>dqG#o{IYUd;QR<|}V%(?MWM5E= z3zBG{pzFBAz1>TjhjaBV;(}I5e@wOFB(RzSxA3JGRyJM$s!NmW4$xp)wyEf|+tc`v z7F!r_){wNBliBIl2lGe%iwNt+eJq)ugGEEro@8cT-6cRUMPhjD+8ZtVr{iFuR3)>p z*%;h34|-bAMpUo^{{Wrk&@HMA5)8djqdQyt;I;hsf$%I-L39W4YlxDBesO^FMrZ?Z$Q;F{Aibwm)6%BMX=QgF9C=yTG*L#pKfTOEWC6C1P^OZ z+7-@T=2V7rQ{yus)uv4Yd;U5R>5`Iy+S_{qxAI%S%4ToI`%N#R7I`APd94bK%vLOM zpsgRr64I@@iL13us?9Qf8Xxe!nh1zU1Dk3&qWA4R34&RYdKcgoDa{6c}xI_jm*QpF(m3@1J`g+O+w@MS850>YmeI8r zQy@|j&NtZ_w}0HnRA=aKu(a2Lb}FCPbtKghMH69;qhe`vKN87SYgp5l(UeI++yP2^ z{hS8=%@tq0%rVJFNIr_pkBpk7{`d7I;qrtL1#sxlrA1^DYC>0M*w4#p^64Bk`LE6D z6}$=LsatnV*yCAPUVJjEG>?xMmohN#P0-;~%0z9U>4hID9-VIRL8V&=1&308iXr11 z_7M`xGgS0}n{l)#55hW^Um5h^6)_H&dfew=K&&)>4VVAhru>H%gxZYw0bNhaKfX|3 z!{L5jg);Mj>>ik39d|bw%i1P}aizxKetd6hvPm+xyE#kzmh>maFdQm&hgXfB&wDL-j!&wHUSWB8`erpmFV~7 zsnlGkMRepK25XFgIk*+2rK4^A=EAAP9*w{b)j;=$o)^H>F*JmN>4zPe?lLXdlkov& zpb1J59eaDK3vJFf0&oGrlXz0NvJi8l60LAv^)ENhbQ*gyYS2kxdBW#W8{u%Eby^!C z>GSyf2c=A}_8-~G(8N5T9 zh~sRxj{c~Z%tBAj3Ua#ro`pAe6HHZ2k)n4z_S?CbsH4bo0^*(5Nv~B$kSPYk%bNdJ zU3dM}grom)d?Td>5|b%N%BT_2-3$aqN;A3yKY|~S5~N!Yq>+>uEj?<0jBW&!Q3{Gm zPJuD{p3m3sJ?H*#@Bi?A{PI5Mb)MgpqWLq=720?y#^rW<#!Q#5D6irr%l!z)L5gmV z9hJe>vn@%6N&YP+`PkpUnN~>US7o=Ax>#E zyRo<|;21l6>Ymk^QQZ9fd*tWwxw}>~N-VLkwryecFd!Yaq(!kjHtok0w`O$*yXu_h zl+NV3%fP9!sdyZttRF-IyeiCb50q2zt0K0F%R3}AZDCD{P&DH&q5I{xRigGZme*_) zW%`*;7a17$Rm93}TNdI^qqp=qd6OF9z~Mk#vN0F9y0K7347j&uXRf3%(qxM13rhOg zku0<>C1*Ny*;+a@!qgZ|3=fyj<vA{OlPIHd9T|7SPB0EMfdPhrMJbU+`mwbc5$W)iES^&$4C!szvS9S(xV?Wg znlj>VWHdYu+_p69z;mOohlIMeh3_#TzuJ`9)#+C z-qOg2bsyeH#&03xlkw?3dG0Qi4EmkX--Q9YnMb)R6tUX^q z?``9lZK`o3*Oh+vmiUXG8J+f0u@#k{D`aJh-Py=e%2ai-pmHI=E*5ye-xF(%R^|IH zCclNbEbPhI`TG94ZrHP^PDAs)Y!_-(n=#mbof8;EMibf^euRodrkH8F!)_tCXT;B1 zi~XyoO^czRbG$HkL&?p0?hEaOn05aKk&*R&KYa+2)_8K7hd)~bZFE}tbrV;5%YFv; z!wE)iYi~yKSnaeG7u5~hQ2H8z_>iYHvd+)ut#NsqzqznlXM9PnzP&AWb~vqRmh@yJ zHc6cBa6mYmH!O`ZAyqV4Fwuaj(|dC2P}T#waPATD-l7lJsH&{znq#x_q81)W{Y5EW6Vlv}$ec)ts#u z=;+|{R5Ww=zH|7jX(B~Oe{^u9jaxXqOR<##e-^T@B#-UUli$IqtY5U;G6oZqy~u-} zAO_?=4J6A~4r@Fb_N8ekh<$B?kc!@r7PPC=6#5An_@0X>pg!#{b&TgE$v(W6BTom5 zWhL82}pciz%-n2A?F)uzDy^84Nmp_0U06BmBbyqP;o{#nH2Ph|9 zpv{)CwJkf+p#w-qro+Ak1Kt4i5&}j#^o$DA+B0$Wxp%W0%Of0kdMPAdrCc6MUsqq} zcP}wrcH^&g=cSM2o?8-QS1LC8LKHDC9RfYT9^;SRf1AcX*QY+lC7Gz}G7aQ=lX9kk z5$E5Y9*vO<_}UIn7$nY-ON+;XS~xCsOR6G%qLSb-z}dh&lVH!zYrB;-_#6Qls302PD4zGX*N ztg&yO9VZ#&&n{JmeM{t@UqJz~n(&GVtuC%}0}$&Le?ILU)TVxt5Hs(EK&yHG#;JR= zsc7aPegFW8|`^~C7V#TZVTn8;{#m*vR@el56IvT`Y* zg!q|{)LvwPDr#|Dv=wKC@9d#toX>}5nE%W#!JPFs?H>8i#3ck698h{fmn^-y99*?J zAx`>I?>!BeIYMKEGt!G*2ueHXksg~XJusK>7Wwck^OnN5>=C<1!5dG}SjQwQjphS%;uM_8Orvy9wt zaVC4Y$yz^U52u^##h^xB+p`&>=#%_6f$uq7>HJGxW_XeZ$&5=P(Dw&SNS~RSYqa_9 zd_Nppnzqnouy}KV`Of@69p9I$t2GEH$AuxD?_}j*8d=|_m(kvyI{K`f32JL3 z&;9BBnOoyc(H?nqkInV7+2-ELDF%Fr?ihje3<1eDqwI!clu})+&UDs3|p*q2D1vT6T z5BGS3Fgb$Ywaz3|n?V^uOxJF2x#|ZWcG%U0DAS?F0wz6`5|jc79SW22ld;(rs#Prh zKW$Io4Ztw%1qDk+nq%$?=ruzq&g)1UYErr`GvG8NRCg?64M@0Tm9EPc;Q25Syw!Uu zk}!+SzSHvykHNcZ5zsYPF8s6~T2lZi=# zkIDidN|{3lc!BA&k<>3mj)v6{bp`A(@G7aSc71_5du1(368TycCHfmWdkhhbq zfr-n4r>_{3nB=TMDBB^WcjfsQKnKcUM<&wCqIAa(VhYJ-USy%Ni<@<`3iJ-R*3`iH zKc3iI1Xn$>G}1wdP2P5KTc*7pj3)TBdmy Date: Thu, 11 May 2017 18:25:46 +0200 Subject: [PATCH 04/14] Fix issue with p11-kit-trust arch dependency --- gnutls.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/gnutls.spec b/gnutls.spec index 5c4e84f..0cafe42 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 3.5.12 -Release: 1%{?dist} +Release: 2%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.4.2-no-now-guile.patch %bcond_without dane @@ -22,7 +22,7 @@ BuildRequires: gperf, net-tools, datefudge, softhsm # for a sanity check on cert loading BuildRequires: p11-kit-trust, ca-certificates Requires: crypto-policies -Requires: p11-kit-trust%{?_isa} +Requires: p11-kit-trust Requires: libtasn1 >= 4.3 Recommends: trousers >= 0.3.11.2 @@ -268,6 +268,9 @@ fi %endif %changelog +* Thu May 11 2017 Nikos Mavrogiannopoulos - 3.5.12-2 +- Fix issue with p11-kit-trust arch dependency + * Thu May 11 2017 Nikos Mavrogiannopoulos - 3.5.12-1 - Update to upstream 3.5.12 release From 052f2d5f5097d7fb8a6c5590c6ae4d3826821e20 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 7 Jun 2017 13:32:27 +0200 Subject: [PATCH 05/14] Update to 3.5.13-1 - Update to upstream 3.5.13 release --- .gitignore | 3 +++ gnutls.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 288f655..9197dae 100644 --- a/.gitignore +++ b/.gitignore @@ -77,3 +77,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /gnutls-3.5.12.tar.xz.sig /gnutls-3.5.12.tar.xz +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/gnutls-3.5.13.tar.xz.sig +/gnutls-3.5.13.tar.xz diff --git a/gnutls.spec b/gnutls.spec index 0cafe42..a20af38 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated -Version: 3.5.12 -Release: 2%{?dist} +Version: 3.5.13 +Release: 1%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.4.2-no-now-guile.patch %bcond_without dane @@ -268,6 +268,9 @@ fi %endif %changelog +* Wed Jun 07 2017 Nikos Mavrogiannopoulos - 3.5.13-1 +- Update to upstream 3.5.13 release + * Thu May 11 2017 Nikos Mavrogiannopoulos - 3.5.12-2 - Fix issue with p11-kit-trust arch dependency diff --git a/sources b/sources index d4a80eb..5b4832d 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 7eccc70fb763cf8a6525228230c1f537224809cf553efb3ad6bc88ad96f01122c30a5cd9d8328fa3a97b242d59e00bc9966589a24b1e65dd4a27eb71393f097c -SHA512 (gnutls-3.5.12.tar.xz.sig) = 62b618e9fcfbb873960177800254d83c1e26899d433425b3aa22f37976464273b0b40cf17923c39e7ae15d90f325f88d5ea885a32394353d268c4b9c16744581 -SHA512 (gnutls-3.5.12.tar.xz) = 8fec23e7e494a2e15e0f938115cae1ba3fee952d634db387f983b01096f68ca4313b23bc4c439d3c7fdd07c861eac4913a7c2343c8704961588ae195886ec90c +SHA512 (gnutls-3.5.13.tar.xz.sig) = bc31a7e848e95861308dc8a3ea0faf4590601385c8c90840d6e3c6ec74fd002c1f2aebaba468e99cf0da5d82c802733a0bcb8544ac6b66e33d172e26299ae59e +SHA512 (gnutls-3.5.13.tar.xz) = e98f23a589042f879936c3f8b474535e695fb7dd68a9e81323668c013241f765c2d3af6c6a072ecf867acc1e551ec46e15bb842144d3a06bdd5d2f4fc3d828a7 From 31a732f7ddf79a0eb893047ec310100f2f0770f6 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 4 Jul 2017 09:25:44 +0200 Subject: [PATCH 06/14] Update to 3.5.14-1 - Update to upstream 3.5.14 release --- .gitignore | 3 +++ gnutls.spec | 5 ++++- sources | 4 ++-- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 9197dae..0869b77 100644 --- a/.gitignore +++ b/.gitignore @@ -80,3 +80,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /gnutls-3.5.13.tar.xz.sig /gnutls-3.5.13.tar.xz +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/gnutls-3.5.14.tar.xz.sig +/gnutls-3.5.14.tar.xz diff --git a/gnutls.spec b/gnutls.spec index a20af38..42e3454 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 3.5.13 +Version: 3.5.14 Release: 1%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.4.2-no-now-guile.patch @@ -268,6 +268,9 @@ fi %endif %changelog +* Tue Jul 04 2017 Nikos Mavrogiannopoulos - 3.5.14-1 +- Update to upstream 3.5.14 release + * Wed Jun 07 2017 Nikos Mavrogiannopoulos - 3.5.13-1 - Update to upstream 3.5.13 release diff --git a/sources b/sources index 5b4832d..4019415 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 7eccc70fb763cf8a6525228230c1f537224809cf553efb3ad6bc88ad96f01122c30a5cd9d8328fa3a97b242d59e00bc9966589a24b1e65dd4a27eb71393f097c -SHA512 (gnutls-3.5.13.tar.xz.sig) = bc31a7e848e95861308dc8a3ea0faf4590601385c8c90840d6e3c6ec74fd002c1f2aebaba468e99cf0da5d82c802733a0bcb8544ac6b66e33d172e26299ae59e -SHA512 (gnutls-3.5.13.tar.xz) = e98f23a589042f879936c3f8b474535e695fb7dd68a9e81323668c013241f765c2d3af6c6a072ecf867acc1e551ec46e15bb842144d3a06bdd5d2f4fc3d828a7 +SHA512 (gnutls-3.5.14.tar.xz.sig) = 0c3fa5b0af9ed72948f6b1bb9476358473de81706c068bc1ff62be1b53e4e475f3102e689fec8c25fa2fd3608b24c7f6f613e08631fb11476a28e2c5ec6624e9 +SHA512 (gnutls-3.5.14.tar.xz) = c55384bdf835c0f7715bfb10b7fa0ac30d26d53ffa5f32af78844cf27985407eed034af77413fb2e94e3a0c0a5fb0597d66f5dbbbe72e5e0658bfeeafa6f7829 From a3e666c78b4ca6c81dc169885d08ecf2b386d10a Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Aug 2017 13:10:26 +0200 Subject: [PATCH 07/14] Update to 3.5.15-1 - Update to upstream 3.5.15 release --- .gitignore | 3 +++ gnutls.spec | 5 ++++- sources | 4 ++-- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 0869b77..060eab3 100644 --- a/.gitignore +++ b/.gitignore @@ -83,3 +83,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /gnutls-3.5.14.tar.xz.sig /gnutls-3.5.14.tar.xz +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/gnutls-3.5.15.tar.xz.sig +/gnutls-3.5.15.tar.xz diff --git a/gnutls.spec b/gnutls.spec index 42e3454..5e95dfd 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 3.5.14 +Version: 3.5.15 Release: 1%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.4.2-no-now-guile.patch @@ -268,6 +268,9 @@ fi %endif %changelog +* Mon Aug 21 2017 Nikos Mavrogiannopoulos - 3.5.15-1 +- Update to upstream 3.5.15 release + * Tue Jul 04 2017 Nikos Mavrogiannopoulos - 3.5.14-1 - Update to upstream 3.5.14 release diff --git a/sources b/sources index 4019415..4404a99 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 7eccc70fb763cf8a6525228230c1f537224809cf553efb3ad6bc88ad96f01122c30a5cd9d8328fa3a97b242d59e00bc9966589a24b1e65dd4a27eb71393f097c -SHA512 (gnutls-3.5.14.tar.xz.sig) = 0c3fa5b0af9ed72948f6b1bb9476358473de81706c068bc1ff62be1b53e4e475f3102e689fec8c25fa2fd3608b24c7f6f613e08631fb11476a28e2c5ec6624e9 -SHA512 (gnutls-3.5.14.tar.xz) = c55384bdf835c0f7715bfb10b7fa0ac30d26d53ffa5f32af78844cf27985407eed034af77413fb2e94e3a0c0a5fb0597d66f5dbbbe72e5e0658bfeeafa6f7829 +SHA512 (gnutls-3.5.15.tar.xz.sig) = 9312f55067a985116af301b4037fb08ef60228fd1bdcbfb387b763d4fef4cbfada82284f0ca250d3951aa561b4097b3c9d0ae39c4e15eb0fdd6d6aacbcf7f1e2 +SHA512 (gnutls-3.5.15.tar.xz) = 046cf3adf6cc3d38fd431f2ff28ddabb65f3c13379516d105316a04c7128be89c5f7ed3df6a034fc06e9ab2e154c2cde2f5cbe8530a1e58cc4b4fb72e158134b From 2f80193ad3ab63c28784d5f3e14d7484426f044e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sat, 21 Oct 2017 20:05:34 +0200 Subject: [PATCH 08/14] Update to 3.5.16-1 - Update to upstream 3.5.16 release --- .gitignore | 3 +++ gnutls.spec | 5 ++++- sources | 4 ++-- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 060eab3..7b88812 100644 --- a/.gitignore +++ b/.gitignore @@ -86,3 +86,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /gnutls-3.5.15.tar.xz.sig /gnutls-3.5.15.tar.xz +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/gnutls-3.5.16.tar.xz.sig +/gnutls-3.5.16.tar.xz diff --git a/gnutls.spec b/gnutls.spec index 5e95dfd..c4d25ed 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 3.5.15 +Version: 3.5.16 Release: 1%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.4.2-no-now-guile.patch @@ -268,6 +268,9 @@ fi %endif %changelog +* Sat Oct 21 2017 Nikos Mavrogiannopoulos - 3.5.16-1 +- Update to upstream 3.5.16 release + * Mon Aug 21 2017 Nikos Mavrogiannopoulos - 3.5.15-1 - Update to upstream 3.5.15 release diff --git a/sources b/sources index 4404a99..3a8187a 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 7eccc70fb763cf8a6525228230c1f537224809cf553efb3ad6bc88ad96f01122c30a5cd9d8328fa3a97b242d59e00bc9966589a24b1e65dd4a27eb71393f097c -SHA512 (gnutls-3.5.15.tar.xz.sig) = 9312f55067a985116af301b4037fb08ef60228fd1bdcbfb387b763d4fef4cbfada82284f0ca250d3951aa561b4097b3c9d0ae39c4e15eb0fdd6d6aacbcf7f1e2 -SHA512 (gnutls-3.5.15.tar.xz) = 046cf3adf6cc3d38fd431f2ff28ddabb65f3c13379516d105316a04c7128be89c5f7ed3df6a034fc06e9ab2e154c2cde2f5cbe8530a1e58cc4b4fb72e158134b +SHA512 (gnutls-3.5.16.tar.xz.sig) = 7fa6d65b94f0895885229ac7c4df5b98372043e9b37e41d7a8799a35a06305abef97525edb27013be406a3e23efe711ae7b324c5ded65fc1677b1c0289ab267c +SHA512 (gnutls-3.5.16.tar.xz) = 451d3167be599ed8e0333dd7c9f8501fcb47b7aa871aeb461c368381c0b7ecd7e2026ec35dbbb2aa685cb2c3a22e9296e0a0699409e3744b731c1bb7e7e69f07 From 1beb39592fc399cce1cf4d049b60005dd06d5e3f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 6 Nov 2017 10:57:34 +0100 Subject: [PATCH 09/14] Prevent the loading of all PKCS#11 modules on certificate verification Resolves: rhbz#1507402 --- gnutls-3.6.1-pkcs11-loading.patch | 284 ++++++++++++++++++++++++++++++ gnutls.spec | 7 +- 2 files changed, 290 insertions(+), 1 deletion(-) create mode 100644 gnutls-3.6.1-pkcs11-loading.patch diff --git a/gnutls-3.6.1-pkcs11-loading.patch b/gnutls-3.6.1-pkcs11-loading.patch new file mode 100644 index 0000000..ede3c2a --- /dev/null +++ b/gnutls-3.6.1-pkcs11-loading.patch @@ -0,0 +1,284 @@ +diff --git a/lib/includes/gnutls/pkcs11.h b/lib/includes/gnutls/pkcs11.h +index c3db2181a..52f7898b4 100644 +--- a/lib/includes/gnutls/pkcs11.h ++++ b/lib/includes/gnutls/pkcs11.h +@@ -65,6 +65,7 @@ typedef struct gnutls_pkcs11_obj_st *gnutls_pkcs11_obj_t; + + #define GNUTLS_PKCS11_FLAG_MANUAL 0 /* Manual loading of libraries */ + #define GNUTLS_PKCS11_FLAG_AUTO 1 /* Automatically load libraries by reading /etc/gnutls/pkcs11.conf */ ++#define GNUTLS_PKCS11_FLAG_AUTO_TRUSTED (1<<1) /* Automatically load trusted libraries by reading /etc/gnutls/pkcs11.conf */ + + /* pkcs11.conf format: + * load = /lib/xxx-pkcs11.so +diff --git a/lib/libgnutls.map b/lib/libgnutls.map +index 43a6b1321..16c582c6f 100644 +--- a/lib/libgnutls.map ++++ b/lib/libgnutls.map +@@ -1241,6 +1241,7 @@ GNUTLS_PRIVATE_3_4 { + _gnutls_mpi_log; + _gnutls_mpi_release; + # Internal symbols needed by tests/: ++ _gnutls_pkcs11_token_get_url; + _gnutls_pkcs12_string_to_key; + _gnutls_bin2hex; + _gnutls_mac_to_entry; +diff --git a/lib/pkcs11.c b/lib/pkcs11.c +index e014a6b5f..e6e37c60c 100644 +--- a/lib/pkcs11.c ++++ b/lib/pkcs11.c +@@ -108,7 +108,8 @@ struct find_cert_st { + + static struct gnutls_pkcs11_provider_st providers[MAX_PROVIDERS]; + static unsigned int active_providers = 0; +-static unsigned int providers_initialized = 0; ++ ++static init_level_t providers_initialized = PROV_UNINITIALIZED; + static unsigned int pkcs11_forkid = 0; + + static int _gnutls_pkcs11_reinit(void); +@@ -116,6 +117,8 @@ static int _gnutls_pkcs11_reinit(void); + gnutls_pkcs11_token_callback_t _gnutls_token_func; + void *_gnutls_token_data; + ++static int auto_load(unsigned trusted); ++ + int pkcs11_rv_to_err(ck_rv_t rv) + { + switch (rv) { +@@ -232,7 +235,8 @@ pkcs11_add_module(const char* name, struct ck_function_list *module, unsigned cu + /* initially check if this module is a duplicate */ + for (i = 0; i < active_providers; i++) { + /* already loaded, skip the rest */ +- if (module == providers[i].module) { ++ if (module == providers[i].module || ++ memcmp(&info, &providers[i].info, sizeof(info)) == 0) { + _gnutls_debug_log("p11: module %s is already loaded.\n", name); + return GNUTLS_E_INT_RET_0; + } +@@ -261,7 +265,7 @@ pkcs11_add_module(const char* name, struct ck_function_list *module, unsigned cu + * The output value of the callback will be returned if it is + * a negative one (indicating failure). + */ +-int _gnutls_pkcs11_check_init(void *priv, pkcs11_reinit_function cb) ++int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_function cb) + { + int ret; + +@@ -269,7 +273,7 @@ int _gnutls_pkcs11_check_init(void *priv, pkcs11_reinit_function cb) + if (ret != 0) + return gnutls_assert_val(GNUTLS_E_LOCKING_ERROR); + +- if (providers_initialized != 0) { ++ if (providers_initialized >= req_level) { + ret = 0; + + if (_gnutls_detect_fork(pkcs11_forkid)) { +@@ -288,10 +292,16 @@ int _gnutls_pkcs11_check_init(void *priv, pkcs11_reinit_function cb) + + gnutls_mutex_unlock(&_gnutls_pkcs11_mutex); + return ret; +- } ++ } else if (providers_initialized < req_level && ++ (req_level == PROV_INIT_TRUSTED)) { ++ _gnutls_debug_log("Initializing needed PKCS #11 modules\n"); ++ ret = auto_load(1); + +- _gnutls_debug_log("Initializing PKCS #11 modules\n"); +- ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_AUTO, NULL); ++ providers_initialized = PROV_INIT_TRUSTED; ++ } else { ++ _gnutls_debug_log("Initializing all PKCS #11 modules\n"); ++ ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_AUTO, NULL); ++ } + + gnutls_mutex_unlock(&_gnutls_pkcs11_mutex); + +@@ -742,13 +752,13 @@ static void compat_load(const char *configfile) + return; + } + +-static int auto_load(void) ++static int auto_load(unsigned trusted) + { + struct ck_function_list **modules; + int i, ret; + char* name; + +- modules = p11_kit_modules_load_and_initialize(0); ++ modules = p11_kit_modules_load_and_initialize(trusted?P11_KIT_MODULE_TRUSTED:0); + if (modules == NULL) { + gnutls_assert(); + _gnutls_debug_log +@@ -817,15 +827,21 @@ gnutls_pkcs11_init(unsigned int flags, const char *deprecated_config_file) + if (flags == GNUTLS_PKCS11_FLAG_MANUAL) { + /* if manual configuration is requested then don't + * bother loading any other providers */ +- providers_initialized = 1; ++ providers_initialized = PROV_INIT_MANUAL; + return 0; + } else if (flags & GNUTLS_PKCS11_FLAG_AUTO) { + if (deprecated_config_file == NULL) +- ret = auto_load(); ++ ret = auto_load(0); + + compat_load(deprecated_config_file); + +- providers_initialized = 1; ++ providers_initialized = PROV_INIT_ALL; ++ ++ return ret; ++ } else if (flags & GNUTLS_PKCS11_FLAG_AUTO_TRUSTED) { ++ ret = auto_load(1); ++ ++ providers_initialized = PROV_INIT_TRUSTED; + + return ret; + } +@@ -918,7 +934,7 @@ void gnutls_pkcs11_deinit(void) + p11_kit_module_release(providers[i].module); + } + active_providers = 0; +- providers_initialized = 0; ++ providers_initialized = PROV_UNINITIALIZED; + + gnutls_pkcs11_set_pin_function(NULL, NULL); + gnutls_pkcs11_set_token_function(NULL, NULL); +@@ -2177,11 +2193,18 @@ find_token_modname_cb(struct ck_function_list *module, struct pkcs11_session_inf + return 0; + } + ++/* Internal symbol used by tests */ ++int ++_gnutls_pkcs11_token_get_url(unsigned int seq, ++ gnutls_pkcs11_url_type_t detailed, char **url, ++ unsigned flags); ++ + /** +- * gnutls_pkcs11_token_get_url: ++ * _gnutls_pkcs11_token_get_url: + * @seq: sequence number starting from 0 + * @detailed: non zero if a detailed URL is required + * @url: will contain an allocated url ++ * @flags: zero or 1. When 1 no initialization is performed. + * + * This function will return the URL for each token available + * in system. The url has to be released using gnutls_free() +@@ -2190,16 +2213,18 @@ find_token_modname_cb(struct ck_function_list *module, struct pkcs11_session_inf + * %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if the sequence number + * exceeds the available tokens, otherwise a negative error value. + * +- * Since: 2.12.0 + **/ + int +-gnutls_pkcs11_token_get_url(unsigned int seq, +- gnutls_pkcs11_url_type_t detailed, char **url) ++_gnutls_pkcs11_token_get_url(unsigned int seq, ++ gnutls_pkcs11_url_type_t detailed, char **url, ++ unsigned flags) + { + int ret; + struct find_token_num tn; + +- PKCS11_CHECK_INIT; ++ if (!(flags & 1)) { ++ PKCS11_CHECK_INIT; ++ } + + memset(&tn, 0, sizeof(tn)); + tn.seq = seq; +@@ -2224,6 +2249,28 @@ gnutls_pkcs11_token_get_url(unsigned int seq, + } + + /** ++ * gnutls_pkcs11_token_get_url: ++ * @seq: sequence number starting from 0 ++ * @detailed: non zero if a detailed URL is required ++ * @url: will contain an allocated url ++ * ++ * This function will return the URL for each token available ++ * in system. The url has to be released using gnutls_free() ++ * ++ * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, ++ * %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if the sequence number ++ * exceeds the available tokens, otherwise a negative error value. ++ * ++ * Since: 2.12.0 ++ **/ ++int ++gnutls_pkcs11_token_get_url(unsigned int seq, ++ gnutls_pkcs11_url_type_t detailed, char **url) ++{ ++ return _gnutls_pkcs11_token_get_url(seq, detailed, url, 0); ++} ++ ++/** + * gnutls_pkcs11_token_get_info: + * @url: should contain a PKCS 11 URL + * @ttype: Denotes the type of information requested +@@ -3173,7 +3220,11 @@ gnutls_pkcs11_obj_list_import_url4(gnutls_pkcs11_obj_t ** p_list, + int ret; + struct find_obj_data_st priv; + +- PKCS11_CHECK_INIT; ++ if (flags & GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED) { ++ PKCS11_CHECK_INIT_TRUSTED; ++ } else { ++ PKCS11_CHECK_INIT; ++ } + + memset(&priv, 0, sizeof(priv)); + +diff --git a/lib/pkcs11_int.h b/lib/pkcs11_int.h +index 2c2de3463..de9afbdee 100644 +--- a/lib/pkcs11_int.h ++++ b/lib/pkcs11_int.h +@@ -82,7 +82,15 @@ struct gnutls_pkcs11_privkey_st { + * directly. It can be provided a callback function to run when a reinitialization + * occurs. */ + typedef int (*pkcs11_reinit_function)(void *priv); +-int _gnutls_pkcs11_check_init(void *priv, pkcs11_reinit_function cb); ++ ++typedef enum init_level_t { ++ PROV_UNINITIALIZED = 0, ++ PROV_INIT_MANUAL, ++ PROV_INIT_TRUSTED, ++ PROV_INIT_ALL ++} init_level_t; ++ ++int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_function cb); + + #define FIX_KEY_USAGE(pk, usage) \ + if (usage == 0) { \ +@@ -93,12 +101,17 @@ int _gnutls_pkcs11_check_init(void *priv, pkcs11_reinit_function cb); + } + + #define PKCS11_CHECK_INIT \ +- ret = _gnutls_pkcs11_check_init(NULL, NULL); \ ++ ret = _gnutls_pkcs11_check_init(PROV_INIT_MANUAL, NULL, NULL); \ ++ if (ret < 0) \ ++ return gnutls_assert_val(ret) ++ ++#define PKCS11_CHECK_INIT_TRUSTED \ ++ ret = _gnutls_pkcs11_check_init(PROV_INIT_TRUSTED, NULL, NULL); \ + if (ret < 0) \ + return gnutls_assert_val(ret) + + #define PKCS11_CHECK_INIT_RET(x) \ +- ret = _gnutls_pkcs11_check_init(NULL, NULL); \ ++ ret = _gnutls_pkcs11_check_init(PROV_INIT_MANUAL, NULL, NULL); \ + if (ret < 0) \ + return gnutls_assert_val(x) + +diff --git a/lib/pkcs11_privkey.c b/lib/pkcs11_privkey.c +index 34fe47a38..afe831ee9 100644 +--- a/lib/pkcs11_privkey.c ++++ b/lib/pkcs11_privkey.c +@@ -36,7 +36,7 @@ + /* In case of a fork, it will invalidate the open session + * in the privkey and start another */ + #define PKCS11_CHECK_INIT_PRIVKEY(k) \ +- ret = _gnutls_pkcs11_check_init(k, reopen_privkey_session); \ ++ ret = _gnutls_pkcs11_check_init(PROV_INIT_MANUAL, k, reopen_privkey_session); \ + if (ret < 0) \ + return gnutls_assert_val(ret) + diff --git a/gnutls.spec b/gnutls.spec index c4d25ed..52f55dd 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,8 +1,9 @@ # This spec file has been automatically updated Version: 3.5.16 -Release: 1%{?dist} +Release: 2%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.4.2-no-now-guile.patch +Patch3: gnutls-3.6.1-pkcs11-loading.patch %bcond_without dane %bcond_without guile Summary: A TLS protocol implementation @@ -268,6 +269,10 @@ fi %endif %changelog +* Mon Nov 6 2017 Nikos Mavrogiannopoulos - 3.5.17-2 +- Prevent the loading of all PKCS#11 modules on certificate verification + but only restrict to p11-kit trust module (#1507402) + * Sat Oct 21 2017 Nikos Mavrogiannopoulos - 3.5.16-1 - Update to upstream 3.5.16 release From 2b7d1990ec5dfcaada626bd1fe9ab932594c2d23 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 22 Nov 2017 14:51:48 +0100 Subject: [PATCH 10/14] apply missing patch --- gnutls.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/gnutls.spec b/gnutls.spec index 52f55dd..e086cd5 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 3.5.16 -Release: 2%{?dist} +Release: 3%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.4.2-no-now-guile.patch Patch3: gnutls-3.6.1-pkcs11-loading.patch @@ -139,6 +139,7 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} %setup -q %patch1 -p1 %patch2 -p1 +%patch3 -p1 sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure rm -f lib/minitasn1/*.c lib/minitasn1/*.h @@ -269,6 +270,9 @@ fi %endif %changelog +* Wed Nov 22 2017 Nikos Mavrogiannopoulos - 3.5.17-3 +- Apply missing patch (#1507402) + * Mon Nov 6 2017 Nikos Mavrogiannopoulos - 3.5.17-2 - Prevent the loading of all PKCS#11 modules on certificate verification but only restrict to p11-kit trust module (#1507402) From 94ac3507b14baad475d26b42bd80b857b78fddf9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 30 Nov 2017 13:51:07 +0100 Subject: [PATCH 11/14] fix regression in loading of modules --- gnutls-3.6.1-pkcs11-loading2.patch | 289 +++++++++++++++++++++++++++++ gnutls.spec | 8 +- 2 files changed, 296 insertions(+), 1 deletion(-) create mode 100644 gnutls-3.6.1-pkcs11-loading2.patch diff --git a/gnutls-3.6.1-pkcs11-loading2.patch b/gnutls-3.6.1-pkcs11-loading2.patch new file mode 100644 index 0000000..bc45834 --- /dev/null +++ b/gnutls-3.6.1-pkcs11-loading2.patch @@ -0,0 +1,289 @@ +diff --git a/lib/pkcs11.c b/lib/pkcs11.c +index e6e37c60c..e1aa64f19 100644 +--- a/lib/pkcs11.c ++++ b/lib/pkcs11.c +@@ -267,20 +267,20 @@ pkcs11_add_module(const char* name, struct ck_function_list *module, unsigned cu + */ + int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_function cb) + { +- int ret; ++ int ret, sret = 0; + + ret = gnutls_mutex_lock(&_gnutls_pkcs11_mutex); + if (ret != 0) + return gnutls_assert_val(GNUTLS_E_LOCKING_ERROR); + +- if (providers_initialized >= req_level) { ++ if (providers_initialized > PROV_UNINITIALIZED) { + ret = 0; + + if (_gnutls_detect_fork(pkcs11_forkid)) { + /* if we are initialized but a fork is detected */ + ret = _gnutls_pkcs11_reinit(); + if (ret == 0) { +- ret = 1; ++ sret = 1; + if (cb) { + int ret2 = cb(priv); + if (ret2 < 0) +@@ -290,25 +290,60 @@ int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_ + } + } + +- gnutls_mutex_unlock(&_gnutls_pkcs11_mutex); +- return ret; +- } else if (providers_initialized < req_level && +- (req_level == PROV_INIT_TRUSTED)) { +- _gnutls_debug_log("Initializing needed PKCS #11 modules\n"); +- ret = auto_load(1); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; ++ } ++ } + +- providers_initialized = PROV_INIT_TRUSTED; +- } else { +- _gnutls_debug_log("Initializing all PKCS #11 modules\n"); +- ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_AUTO, NULL); ++ /* Possible Transitions: PROV_UNINITIALIZED -> PROV_INIT_MANUAL -> PROV_INIT_MANUAL_TRUSTED ++ * PROV_UNINITIALIZED -> PROV_INIT_TRUSTED -> PROV_INIT_ALL ++ * ++ * request for PROV_INIT_TRUSTED may result to PROV_INIT_MANUAL_TRUSTED ++ * request for PROV_INIT_ALL may result to PROV_INIT_MANUAL or PROV_INIT_MANUAL_TRUSTED ++ */ ++ switch(req_level) { ++ case PROV_UNINITIALIZED: ++ case PROV_INIT_MANUAL: ++ break; ++ case PROV_INIT_TRUSTED: ++ case PROV_INIT_MANUAL_TRUSTED: ++ if (providers_initialized < PROV_INIT_MANUAL_TRUSTED) { ++ _gnutls_debug_log("Initializing needed PKCS #11 modules\n"); ++ ret = auto_load(1); ++ if (ret < 0) { ++ gnutls_assert(); ++ } ++ ++ if (providers_initialized == PROV_INIT_MANUAL) ++ providers_initialized = PROV_INIT_MANUAL_TRUSTED; ++ else ++ providers_initialized = PROV_INIT_TRUSTED; ++ ++ goto cleanup; ++ } ++ break; ++ case PROV_INIT_ALL: ++ if (providers_initialized == PROV_INIT_TRUSTED || ++ providers_initialized == PROV_UNINITIALIZED) { ++ _gnutls_debug_log("Initializing all PKCS #11 modules\n"); ++ ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_AUTO, NULL); ++ if (ret < 0) { ++ gnutls_assert(); ++ } ++ ++ providers_initialized = PROV_INIT_ALL; ++ goto cleanup; ++ } ++ break; + } + +- gnutls_mutex_unlock(&_gnutls_pkcs11_mutex); ++ ret = sret; + +- if (ret < 0) +- return gnutls_assert_val(ret); ++ cleanup: ++ gnutls_mutex_unlock(&_gnutls_pkcs11_mutex); + +- return 0; ++ return ret; + } + + +@@ -3220,11 +3255,7 @@ gnutls_pkcs11_obj_list_import_url4(gnutls_pkcs11_obj_t ** p_list, + int ret; + struct find_obj_data_st priv; + +- if (flags & GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED) { +- PKCS11_CHECK_INIT_TRUSTED; +- } else { +- PKCS11_CHECK_INIT; +- } ++ PKCS11_CHECK_INIT_FLAGS(flags); + + memset(&priv, 0, sizeof(priv)); + +@@ -3965,7 +3996,7 @@ int gnutls_pkcs11_get_raw_issuer(const char *url, gnutls_x509_crt_t cert, + size_t id_size; + struct p11_kit_uri *info = NULL; + +- PKCS11_CHECK_INIT; ++ PKCS11_CHECK_INIT_FLAGS(flags); + + memset(&priv, 0, sizeof(priv)); + +@@ -4057,7 +4088,7 @@ int gnutls_pkcs11_get_raw_issuer_by_dn (const char *url, const gnutls_datum_t *d + struct find_cert_st priv; + struct p11_kit_uri *info = NULL; + +- PKCS11_CHECK_INIT; ++ PKCS11_CHECK_INIT_FLAGS(flags); + + memset(&priv, 0, sizeof(priv)); + +@@ -4144,7 +4175,7 @@ int gnutls_pkcs11_get_raw_issuer_by_subject_key_id (const char *url, + struct find_cert_st priv; + struct p11_kit_uri *info = NULL; + +- PKCS11_CHECK_INIT; ++ PKCS11_CHECK_INIT_FLAGS(flags); + + memset(&priv, 0, sizeof(priv)); + +@@ -4238,7 +4269,7 @@ unsigned gnutls_pkcs11_crt_is_known(const char *url, gnutls_x509_crt_t cert, + size_t serial_size; + struct p11_kit_uri *info = NULL; + +- PKCS11_CHECK_INIT_RET(0); ++ PKCS11_CHECK_INIT_FLAGS_RET(flags, 0); + + memset(&priv, 0, sizeof(priv)); + +diff --git a/lib/pkcs11_int.h b/lib/pkcs11_int.h +index de9afbdee..3ba9c5501 100644 +--- a/lib/pkcs11_int.h ++++ b/lib/pkcs11_int.h +@@ -86,10 +86,14 @@ typedef int (*pkcs11_reinit_function)(void *priv); + typedef enum init_level_t { + PROV_UNINITIALIZED = 0, + PROV_INIT_MANUAL, ++ PROV_INIT_MANUAL_TRUSTED, + PROV_INIT_TRUSTED, + PROV_INIT_ALL + } init_level_t; + ++/* See _gnutls_pkcs11_check_init() for possible Transitions. ++ */ ++ + int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_function cb); + + #define FIX_KEY_USAGE(pk, usage) \ +@@ -101,20 +105,26 @@ int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_ + } + + #define PKCS11_CHECK_INIT \ +- ret = _gnutls_pkcs11_check_init(PROV_INIT_MANUAL, NULL, NULL); \ ++ ret = _gnutls_pkcs11_check_init(PROV_INIT_ALL, NULL, NULL); \ + if (ret < 0) \ + return gnutls_assert_val(ret) + +-#define PKCS11_CHECK_INIT_TRUSTED \ +- ret = _gnutls_pkcs11_check_init(PROV_INIT_TRUSTED, NULL, NULL); \ ++#define PKCS11_CHECK_INIT_RET(x) \ ++ ret = _gnutls_pkcs11_check_init(PROV_INIT_ALL, NULL, NULL); \ ++ if (ret < 0) \ ++ return gnutls_assert_val(x) ++ ++#define PKCS11_CHECK_INIT_FLAGS(f) \ ++ ret = _gnutls_pkcs11_check_init((f & GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE)?PROV_INIT_TRUSTED:PROV_INIT_ALL, NULL, NULL); \ + if (ret < 0) \ + return gnutls_assert_val(ret) + +-#define PKCS11_CHECK_INIT_RET(x) \ +- ret = _gnutls_pkcs11_check_init(PROV_INIT_MANUAL, NULL, NULL); \ ++#define PKCS11_CHECK_INIT_FLAGS_RET(f, x) \ ++ ret = _gnutls_pkcs11_check_init((f & GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE)?PROV_INIT_TRUSTED:PROV_INIT_ALL, NULL, NULL); \ + if (ret < 0) \ + return gnutls_assert_val(x) + ++ + /* thus function is called for every token in the traverse_tokens + * function. Once everything is traversed it is called with NULL tinfo. + * It should return 0 if found what it was looking for. +diff --git a/lib/pkcs11_privkey.c b/lib/pkcs11_privkey.c +index afe831ee9..fd1997c8c 100644 +--- a/lib/pkcs11_privkey.c ++++ b/lib/pkcs11_privkey.c +@@ -36,7 +36,7 @@ + /* In case of a fork, it will invalidate the open session + * in the privkey and start another */ + #define PKCS11_CHECK_INIT_PRIVKEY(k) \ +- ret = _gnutls_pkcs11_check_init(PROV_INIT_MANUAL, k, reopen_privkey_session); \ ++ ret = _gnutls_pkcs11_check_init(PROV_INIT_ALL, k, reopen_privkey_session); \ + if (ret < 0) \ + return gnutls_assert_val(ret) + +diff --git a/lib/x509/verify-high.c b/lib/x509/verify-high.c +index 69fc0f2e6..7b375d61f 100644 +--- a/lib/x509/verify-high.c ++++ b/lib/x509/verify-high.c +@@ -367,7 +367,7 @@ advance_iter(gnutls_x509_trust_list_t list, + if (list->pkcs11_token != NULL) { + if (iter->pkcs11_list == NULL) { + ret = gnutls_pkcs11_obj_list_import_url2(&iter->pkcs11_list, &iter->pkcs11_size, +- list->pkcs11_token, (GNUTLS_PKCS11_OBJ_FLAG_CRT|GNUTLS_PKCS11_OBJ_FLAG_MARK_CA|GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED), 0); ++ list->pkcs11_token, (GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE|GNUTLS_PKCS11_OBJ_FLAG_CRT|GNUTLS_PKCS11_OBJ_FLAG_MARK_CA|GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED), 0); + if (ret < 0) + return gnutls_assert_val(ret); + +@@ -972,7 +972,7 @@ int gnutls_x509_trust_list_get_issuer(gnutls_x509_trust_list_t list, + gnutls_datum_t der = {NULL, 0}; + /* use the token for verification */ + ret = gnutls_pkcs11_get_raw_issuer(list->pkcs11_token, cert, &der, +- GNUTLS_X509_FMT_DER, 0); ++ GNUTLS_X509_FMT_DER, GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE); + if (ret < 0) { + gnutls_assert(); + return ret; +@@ -1044,7 +1044,7 @@ int gnutls_x509_trust_list_get_issuer_by_dn(gnutls_x509_trust_list_t list, + gnutls_datum_t der = {NULL, 0}; + /* use the token for verification */ + ret = gnutls_pkcs11_get_raw_issuer_by_dn(list->pkcs11_token, dn, &der, +- GNUTLS_X509_FMT_DER, 0); ++ GNUTLS_X509_FMT_DER, GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE); + if (ret < 0) { + gnutls_assert(); + return ret; +@@ -1105,7 +1105,7 @@ int gnutls_x509_trust_list_get_issuer_by_subject_key_id(gnutls_x509_trust_list_t + gnutls_datum_t der = {NULL, 0}; + /* use the token for verification */ + ret = gnutls_pkcs11_get_raw_issuer_by_subject_key_id(list->pkcs11_token, dn, spki, &der, +- GNUTLS_X509_FMT_DER, 0); ++ GNUTLS_X509_FMT_DER, GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE); + if (ret < 0) { + gnutls_assert(); + return ret; +diff --git a/lib/x509/verify-high2.c b/lib/x509/verify-high2.c +index fb9f9ce10..8c75b2641 100644 +--- a/lib/x509/verify-high2.c ++++ b/lib/x509/verify-high2.c +@@ -188,6 +188,10 @@ int add_trust_list_pkcs11_object_url(gnutls_x509_trust_list_t list, const char * + gnutls_pkcs11_obj_t *pcrt_list = NULL; + unsigned int pcrt_list_size = 0, i; + int ret; ++ ++ /* here we don't use the flag GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE, ++ * as we want to explicitly load from any module available in the system. ++ */ + ret = + gnutls_pkcs11_obj_list_import_url2(&pcrt_list, &pcrt_list_size, + url, +@@ -323,7 +327,7 @@ gnutls_x509_trust_list_add_trust_file(gnutls_x509_trust_list_t list, + */ + if (is_pkcs11_url_object(ca_file) != 0) { + return add_trust_list_pkcs11_object_url(list, ca_file, tl_flags); +- } else { /* token */ ++ } else { /* trusted token */ + if (list->pkcs11_token != NULL) + return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); + list->pkcs11_token = gnutls_strdup(ca_file); +@@ -331,7 +335,7 @@ gnutls_x509_trust_list_add_trust_file(gnutls_x509_trust_list_t list, + /* enumerate the certificates */ + ret = gnutls_pkcs11_obj_list_import_url(NULL, &pcrt_list_size, + ca_file, +- (GNUTLS_PKCS11_OBJ_FLAG_CRT|GNUTLS_PKCS11_OBJ_FLAG_MARK_CA|GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED), ++ (GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE|GNUTLS_PKCS11_OBJ_FLAG_CRT|GNUTLS_PKCS11_OBJ_FLAG_MARK_CA|GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED), + 0); + if (ret < 0 && ret != GNUTLS_E_SHORT_MEMORY_BUFFER) + return gnutls_assert_val(ret); diff --git a/gnutls.spec b/gnutls.spec index e086cd5..1dc296a 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,9 +1,10 @@ # This spec file has been automatically updated Version: 3.5.16 -Release: 3%{?dist} +Release: 4%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.4.2-no-now-guile.patch Patch3: gnutls-3.6.1-pkcs11-loading.patch +Patch4: gnutls-3.6.1-pkcs11-loading2.patch %bcond_without dane %bcond_without guile Summary: A TLS protocol implementation @@ -140,6 +141,7 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} %patch1 -p1 %patch2 -p1 %patch3 -p1 +%patch4 -p1 sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure rm -f lib/minitasn1/*.c lib/minitasn1/*.h @@ -270,6 +272,10 @@ fi %endif %changelog +* Thu Nov 30 2017 Nikos Mavrogiannopoulos - 3.5.17-4 +- Corrected regression from 3.5.17-3 which prevented the loading of + arbitrary p11-kit modules (#1507402) + * Wed Nov 22 2017 Nikos Mavrogiannopoulos - 3.5.17-3 - Apply missing patch (#1507402) From e5ae12bbc08201d45558c25e4aee3dc6e662f08f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 17 Jan 2018 11:05:28 +0100 Subject: [PATCH 12/14] Update to 3.5.17-1 - Update to upstream 3.5.17 release --- .gitignore | 3 + gnutls-3.6.1-pkcs11-loading.patch | 284 ---------------------------- gnutls-3.6.1-pkcs11-loading2.patch | 289 ----------------------------- gnutls.spec | 11 +- sources | 4 +- 5 files changed, 10 insertions(+), 581 deletions(-) delete mode 100644 gnutls-3.6.1-pkcs11-loading.patch delete mode 100644 gnutls-3.6.1-pkcs11-loading2.patch diff --git a/.gitignore b/.gitignore index 7b88812..0302e45 100644 --- a/.gitignore +++ b/.gitignore @@ -89,3 +89,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /gnutls-3.5.16.tar.xz.sig /gnutls-3.5.16.tar.xz +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/gnutls-3.5.17.tar.xz.sig +/gnutls-3.5.17.tar.xz diff --git a/gnutls-3.6.1-pkcs11-loading.patch b/gnutls-3.6.1-pkcs11-loading.patch deleted file mode 100644 index ede3c2a..0000000 --- a/gnutls-3.6.1-pkcs11-loading.patch +++ /dev/null @@ -1,284 +0,0 @@ -diff --git a/lib/includes/gnutls/pkcs11.h b/lib/includes/gnutls/pkcs11.h -index c3db2181a..52f7898b4 100644 ---- a/lib/includes/gnutls/pkcs11.h -+++ b/lib/includes/gnutls/pkcs11.h -@@ -65,6 +65,7 @@ typedef struct gnutls_pkcs11_obj_st *gnutls_pkcs11_obj_t; - - #define GNUTLS_PKCS11_FLAG_MANUAL 0 /* Manual loading of libraries */ - #define GNUTLS_PKCS11_FLAG_AUTO 1 /* Automatically load libraries by reading /etc/gnutls/pkcs11.conf */ -+#define GNUTLS_PKCS11_FLAG_AUTO_TRUSTED (1<<1) /* Automatically load trusted libraries by reading /etc/gnutls/pkcs11.conf */ - - /* pkcs11.conf format: - * load = /lib/xxx-pkcs11.so -diff --git a/lib/libgnutls.map b/lib/libgnutls.map -index 43a6b1321..16c582c6f 100644 ---- a/lib/libgnutls.map -+++ b/lib/libgnutls.map -@@ -1241,6 +1241,7 @@ GNUTLS_PRIVATE_3_4 { - _gnutls_mpi_log; - _gnutls_mpi_release; - # Internal symbols needed by tests/: -+ _gnutls_pkcs11_token_get_url; - _gnutls_pkcs12_string_to_key; - _gnutls_bin2hex; - _gnutls_mac_to_entry; -diff --git a/lib/pkcs11.c b/lib/pkcs11.c -index e014a6b5f..e6e37c60c 100644 ---- a/lib/pkcs11.c -+++ b/lib/pkcs11.c -@@ -108,7 +108,8 @@ struct find_cert_st { - - static struct gnutls_pkcs11_provider_st providers[MAX_PROVIDERS]; - static unsigned int active_providers = 0; --static unsigned int providers_initialized = 0; -+ -+static init_level_t providers_initialized = PROV_UNINITIALIZED; - static unsigned int pkcs11_forkid = 0; - - static int _gnutls_pkcs11_reinit(void); -@@ -116,6 +117,8 @@ static int _gnutls_pkcs11_reinit(void); - gnutls_pkcs11_token_callback_t _gnutls_token_func; - void *_gnutls_token_data; - -+static int auto_load(unsigned trusted); -+ - int pkcs11_rv_to_err(ck_rv_t rv) - { - switch (rv) { -@@ -232,7 +235,8 @@ pkcs11_add_module(const char* name, struct ck_function_list *module, unsigned cu - /* initially check if this module is a duplicate */ - for (i = 0; i < active_providers; i++) { - /* already loaded, skip the rest */ -- if (module == providers[i].module) { -+ if (module == providers[i].module || -+ memcmp(&info, &providers[i].info, sizeof(info)) == 0) { - _gnutls_debug_log("p11: module %s is already loaded.\n", name); - return GNUTLS_E_INT_RET_0; - } -@@ -261,7 +265,7 @@ pkcs11_add_module(const char* name, struct ck_function_list *module, unsigned cu - * The output value of the callback will be returned if it is - * a negative one (indicating failure). - */ --int _gnutls_pkcs11_check_init(void *priv, pkcs11_reinit_function cb) -+int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_function cb) - { - int ret; - -@@ -269,7 +273,7 @@ int _gnutls_pkcs11_check_init(void *priv, pkcs11_reinit_function cb) - if (ret != 0) - return gnutls_assert_val(GNUTLS_E_LOCKING_ERROR); - -- if (providers_initialized != 0) { -+ if (providers_initialized >= req_level) { - ret = 0; - - if (_gnutls_detect_fork(pkcs11_forkid)) { -@@ -288,10 +292,16 @@ int _gnutls_pkcs11_check_init(void *priv, pkcs11_reinit_function cb) - - gnutls_mutex_unlock(&_gnutls_pkcs11_mutex); - return ret; -- } -+ } else if (providers_initialized < req_level && -+ (req_level == PROV_INIT_TRUSTED)) { -+ _gnutls_debug_log("Initializing needed PKCS #11 modules\n"); -+ ret = auto_load(1); - -- _gnutls_debug_log("Initializing PKCS #11 modules\n"); -- ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_AUTO, NULL); -+ providers_initialized = PROV_INIT_TRUSTED; -+ } else { -+ _gnutls_debug_log("Initializing all PKCS #11 modules\n"); -+ ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_AUTO, NULL); -+ } - - gnutls_mutex_unlock(&_gnutls_pkcs11_mutex); - -@@ -742,13 +752,13 @@ static void compat_load(const char *configfile) - return; - } - --static int auto_load(void) -+static int auto_load(unsigned trusted) - { - struct ck_function_list **modules; - int i, ret; - char* name; - -- modules = p11_kit_modules_load_and_initialize(0); -+ modules = p11_kit_modules_load_and_initialize(trusted?P11_KIT_MODULE_TRUSTED:0); - if (modules == NULL) { - gnutls_assert(); - _gnutls_debug_log -@@ -817,15 +827,21 @@ gnutls_pkcs11_init(unsigned int flags, const char *deprecated_config_file) - if (flags == GNUTLS_PKCS11_FLAG_MANUAL) { - /* if manual configuration is requested then don't - * bother loading any other providers */ -- providers_initialized = 1; -+ providers_initialized = PROV_INIT_MANUAL; - return 0; - } else if (flags & GNUTLS_PKCS11_FLAG_AUTO) { - if (deprecated_config_file == NULL) -- ret = auto_load(); -+ ret = auto_load(0); - - compat_load(deprecated_config_file); - -- providers_initialized = 1; -+ providers_initialized = PROV_INIT_ALL; -+ -+ return ret; -+ } else if (flags & GNUTLS_PKCS11_FLAG_AUTO_TRUSTED) { -+ ret = auto_load(1); -+ -+ providers_initialized = PROV_INIT_TRUSTED; - - return ret; - } -@@ -918,7 +934,7 @@ void gnutls_pkcs11_deinit(void) - p11_kit_module_release(providers[i].module); - } - active_providers = 0; -- providers_initialized = 0; -+ providers_initialized = PROV_UNINITIALIZED; - - gnutls_pkcs11_set_pin_function(NULL, NULL); - gnutls_pkcs11_set_token_function(NULL, NULL); -@@ -2177,11 +2193,18 @@ find_token_modname_cb(struct ck_function_list *module, struct pkcs11_session_inf - return 0; - } - -+/* Internal symbol used by tests */ -+int -+_gnutls_pkcs11_token_get_url(unsigned int seq, -+ gnutls_pkcs11_url_type_t detailed, char **url, -+ unsigned flags); -+ - /** -- * gnutls_pkcs11_token_get_url: -+ * _gnutls_pkcs11_token_get_url: - * @seq: sequence number starting from 0 - * @detailed: non zero if a detailed URL is required - * @url: will contain an allocated url -+ * @flags: zero or 1. When 1 no initialization is performed. - * - * This function will return the URL for each token available - * in system. The url has to be released using gnutls_free() -@@ -2190,16 +2213,18 @@ find_token_modname_cb(struct ck_function_list *module, struct pkcs11_session_inf - * %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if the sequence number - * exceeds the available tokens, otherwise a negative error value. - * -- * Since: 2.12.0 - **/ - int --gnutls_pkcs11_token_get_url(unsigned int seq, -- gnutls_pkcs11_url_type_t detailed, char **url) -+_gnutls_pkcs11_token_get_url(unsigned int seq, -+ gnutls_pkcs11_url_type_t detailed, char **url, -+ unsigned flags) - { - int ret; - struct find_token_num tn; - -- PKCS11_CHECK_INIT; -+ if (!(flags & 1)) { -+ PKCS11_CHECK_INIT; -+ } - - memset(&tn, 0, sizeof(tn)); - tn.seq = seq; -@@ -2224,6 +2249,28 @@ gnutls_pkcs11_token_get_url(unsigned int seq, - } - - /** -+ * gnutls_pkcs11_token_get_url: -+ * @seq: sequence number starting from 0 -+ * @detailed: non zero if a detailed URL is required -+ * @url: will contain an allocated url -+ * -+ * This function will return the URL for each token available -+ * in system. The url has to be released using gnutls_free() -+ * -+ * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, -+ * %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if the sequence number -+ * exceeds the available tokens, otherwise a negative error value. -+ * -+ * Since: 2.12.0 -+ **/ -+int -+gnutls_pkcs11_token_get_url(unsigned int seq, -+ gnutls_pkcs11_url_type_t detailed, char **url) -+{ -+ return _gnutls_pkcs11_token_get_url(seq, detailed, url, 0); -+} -+ -+/** - * gnutls_pkcs11_token_get_info: - * @url: should contain a PKCS 11 URL - * @ttype: Denotes the type of information requested -@@ -3173,7 +3220,11 @@ gnutls_pkcs11_obj_list_import_url4(gnutls_pkcs11_obj_t ** p_list, - int ret; - struct find_obj_data_st priv; - -- PKCS11_CHECK_INIT; -+ if (flags & GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED) { -+ PKCS11_CHECK_INIT_TRUSTED; -+ } else { -+ PKCS11_CHECK_INIT; -+ } - - memset(&priv, 0, sizeof(priv)); - -diff --git a/lib/pkcs11_int.h b/lib/pkcs11_int.h -index 2c2de3463..de9afbdee 100644 ---- a/lib/pkcs11_int.h -+++ b/lib/pkcs11_int.h -@@ -82,7 +82,15 @@ struct gnutls_pkcs11_privkey_st { - * directly. It can be provided a callback function to run when a reinitialization - * occurs. */ - typedef int (*pkcs11_reinit_function)(void *priv); --int _gnutls_pkcs11_check_init(void *priv, pkcs11_reinit_function cb); -+ -+typedef enum init_level_t { -+ PROV_UNINITIALIZED = 0, -+ PROV_INIT_MANUAL, -+ PROV_INIT_TRUSTED, -+ PROV_INIT_ALL -+} init_level_t; -+ -+int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_function cb); - - #define FIX_KEY_USAGE(pk, usage) \ - if (usage == 0) { \ -@@ -93,12 +101,17 @@ int _gnutls_pkcs11_check_init(void *priv, pkcs11_reinit_function cb); - } - - #define PKCS11_CHECK_INIT \ -- ret = _gnutls_pkcs11_check_init(NULL, NULL); \ -+ ret = _gnutls_pkcs11_check_init(PROV_INIT_MANUAL, NULL, NULL); \ -+ if (ret < 0) \ -+ return gnutls_assert_val(ret) -+ -+#define PKCS11_CHECK_INIT_TRUSTED \ -+ ret = _gnutls_pkcs11_check_init(PROV_INIT_TRUSTED, NULL, NULL); \ - if (ret < 0) \ - return gnutls_assert_val(ret) - - #define PKCS11_CHECK_INIT_RET(x) \ -- ret = _gnutls_pkcs11_check_init(NULL, NULL); \ -+ ret = _gnutls_pkcs11_check_init(PROV_INIT_MANUAL, NULL, NULL); \ - if (ret < 0) \ - return gnutls_assert_val(x) - -diff --git a/lib/pkcs11_privkey.c b/lib/pkcs11_privkey.c -index 34fe47a38..afe831ee9 100644 ---- a/lib/pkcs11_privkey.c -+++ b/lib/pkcs11_privkey.c -@@ -36,7 +36,7 @@ - /* In case of a fork, it will invalidate the open session - * in the privkey and start another */ - #define PKCS11_CHECK_INIT_PRIVKEY(k) \ -- ret = _gnutls_pkcs11_check_init(k, reopen_privkey_session); \ -+ ret = _gnutls_pkcs11_check_init(PROV_INIT_MANUAL, k, reopen_privkey_session); \ - if (ret < 0) \ - return gnutls_assert_val(ret) - diff --git a/gnutls-3.6.1-pkcs11-loading2.patch b/gnutls-3.6.1-pkcs11-loading2.patch deleted file mode 100644 index bc45834..0000000 --- a/gnutls-3.6.1-pkcs11-loading2.patch +++ /dev/null @@ -1,289 +0,0 @@ -diff --git a/lib/pkcs11.c b/lib/pkcs11.c -index e6e37c60c..e1aa64f19 100644 ---- a/lib/pkcs11.c -+++ b/lib/pkcs11.c -@@ -267,20 +267,20 @@ pkcs11_add_module(const char* name, struct ck_function_list *module, unsigned cu - */ - int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_function cb) - { -- int ret; -+ int ret, sret = 0; - - ret = gnutls_mutex_lock(&_gnutls_pkcs11_mutex); - if (ret != 0) - return gnutls_assert_val(GNUTLS_E_LOCKING_ERROR); - -- if (providers_initialized >= req_level) { -+ if (providers_initialized > PROV_UNINITIALIZED) { - ret = 0; - - if (_gnutls_detect_fork(pkcs11_forkid)) { - /* if we are initialized but a fork is detected */ - ret = _gnutls_pkcs11_reinit(); - if (ret == 0) { -- ret = 1; -+ sret = 1; - if (cb) { - int ret2 = cb(priv); - if (ret2 < 0) -@@ -290,25 +290,60 @@ int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_ - } - } - -- gnutls_mutex_unlock(&_gnutls_pkcs11_mutex); -- return ret; -- } else if (providers_initialized < req_level && -- (req_level == PROV_INIT_TRUSTED)) { -- _gnutls_debug_log("Initializing needed PKCS #11 modules\n"); -- ret = auto_load(1); -+ if (ret < 0) { -+ gnutls_assert(); -+ goto cleanup; -+ } -+ } - -- providers_initialized = PROV_INIT_TRUSTED; -- } else { -- _gnutls_debug_log("Initializing all PKCS #11 modules\n"); -- ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_AUTO, NULL); -+ /* Possible Transitions: PROV_UNINITIALIZED -> PROV_INIT_MANUAL -> PROV_INIT_MANUAL_TRUSTED -+ * PROV_UNINITIALIZED -> PROV_INIT_TRUSTED -> PROV_INIT_ALL -+ * -+ * request for PROV_INIT_TRUSTED may result to PROV_INIT_MANUAL_TRUSTED -+ * request for PROV_INIT_ALL may result to PROV_INIT_MANUAL or PROV_INIT_MANUAL_TRUSTED -+ */ -+ switch(req_level) { -+ case PROV_UNINITIALIZED: -+ case PROV_INIT_MANUAL: -+ break; -+ case PROV_INIT_TRUSTED: -+ case PROV_INIT_MANUAL_TRUSTED: -+ if (providers_initialized < PROV_INIT_MANUAL_TRUSTED) { -+ _gnutls_debug_log("Initializing needed PKCS #11 modules\n"); -+ ret = auto_load(1); -+ if (ret < 0) { -+ gnutls_assert(); -+ } -+ -+ if (providers_initialized == PROV_INIT_MANUAL) -+ providers_initialized = PROV_INIT_MANUAL_TRUSTED; -+ else -+ providers_initialized = PROV_INIT_TRUSTED; -+ -+ goto cleanup; -+ } -+ break; -+ case PROV_INIT_ALL: -+ if (providers_initialized == PROV_INIT_TRUSTED || -+ providers_initialized == PROV_UNINITIALIZED) { -+ _gnutls_debug_log("Initializing all PKCS #11 modules\n"); -+ ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_AUTO, NULL); -+ if (ret < 0) { -+ gnutls_assert(); -+ } -+ -+ providers_initialized = PROV_INIT_ALL; -+ goto cleanup; -+ } -+ break; - } - -- gnutls_mutex_unlock(&_gnutls_pkcs11_mutex); -+ ret = sret; - -- if (ret < 0) -- return gnutls_assert_val(ret); -+ cleanup: -+ gnutls_mutex_unlock(&_gnutls_pkcs11_mutex); - -- return 0; -+ return ret; - } - - -@@ -3220,11 +3255,7 @@ gnutls_pkcs11_obj_list_import_url4(gnutls_pkcs11_obj_t ** p_list, - int ret; - struct find_obj_data_st priv; - -- if (flags & GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED) { -- PKCS11_CHECK_INIT_TRUSTED; -- } else { -- PKCS11_CHECK_INIT; -- } -+ PKCS11_CHECK_INIT_FLAGS(flags); - - memset(&priv, 0, sizeof(priv)); - -@@ -3965,7 +3996,7 @@ int gnutls_pkcs11_get_raw_issuer(const char *url, gnutls_x509_crt_t cert, - size_t id_size; - struct p11_kit_uri *info = NULL; - -- PKCS11_CHECK_INIT; -+ PKCS11_CHECK_INIT_FLAGS(flags); - - memset(&priv, 0, sizeof(priv)); - -@@ -4057,7 +4088,7 @@ int gnutls_pkcs11_get_raw_issuer_by_dn (const char *url, const gnutls_datum_t *d - struct find_cert_st priv; - struct p11_kit_uri *info = NULL; - -- PKCS11_CHECK_INIT; -+ PKCS11_CHECK_INIT_FLAGS(flags); - - memset(&priv, 0, sizeof(priv)); - -@@ -4144,7 +4175,7 @@ int gnutls_pkcs11_get_raw_issuer_by_subject_key_id (const char *url, - struct find_cert_st priv; - struct p11_kit_uri *info = NULL; - -- PKCS11_CHECK_INIT; -+ PKCS11_CHECK_INIT_FLAGS(flags); - - memset(&priv, 0, sizeof(priv)); - -@@ -4238,7 +4269,7 @@ unsigned gnutls_pkcs11_crt_is_known(const char *url, gnutls_x509_crt_t cert, - size_t serial_size; - struct p11_kit_uri *info = NULL; - -- PKCS11_CHECK_INIT_RET(0); -+ PKCS11_CHECK_INIT_FLAGS_RET(flags, 0); - - memset(&priv, 0, sizeof(priv)); - -diff --git a/lib/pkcs11_int.h b/lib/pkcs11_int.h -index de9afbdee..3ba9c5501 100644 ---- a/lib/pkcs11_int.h -+++ b/lib/pkcs11_int.h -@@ -86,10 +86,14 @@ typedef int (*pkcs11_reinit_function)(void *priv); - typedef enum init_level_t { - PROV_UNINITIALIZED = 0, - PROV_INIT_MANUAL, -+ PROV_INIT_MANUAL_TRUSTED, - PROV_INIT_TRUSTED, - PROV_INIT_ALL - } init_level_t; - -+/* See _gnutls_pkcs11_check_init() for possible Transitions. -+ */ -+ - int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_function cb); - - #define FIX_KEY_USAGE(pk, usage) \ -@@ -101,20 +105,26 @@ int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_ - } - - #define PKCS11_CHECK_INIT \ -- ret = _gnutls_pkcs11_check_init(PROV_INIT_MANUAL, NULL, NULL); \ -+ ret = _gnutls_pkcs11_check_init(PROV_INIT_ALL, NULL, NULL); \ - if (ret < 0) \ - return gnutls_assert_val(ret) - --#define PKCS11_CHECK_INIT_TRUSTED \ -- ret = _gnutls_pkcs11_check_init(PROV_INIT_TRUSTED, NULL, NULL); \ -+#define PKCS11_CHECK_INIT_RET(x) \ -+ ret = _gnutls_pkcs11_check_init(PROV_INIT_ALL, NULL, NULL); \ -+ if (ret < 0) \ -+ return gnutls_assert_val(x) -+ -+#define PKCS11_CHECK_INIT_FLAGS(f) \ -+ ret = _gnutls_pkcs11_check_init((f & GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE)?PROV_INIT_TRUSTED:PROV_INIT_ALL, NULL, NULL); \ - if (ret < 0) \ - return gnutls_assert_val(ret) - --#define PKCS11_CHECK_INIT_RET(x) \ -- ret = _gnutls_pkcs11_check_init(PROV_INIT_MANUAL, NULL, NULL); \ -+#define PKCS11_CHECK_INIT_FLAGS_RET(f, x) \ -+ ret = _gnutls_pkcs11_check_init((f & GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE)?PROV_INIT_TRUSTED:PROV_INIT_ALL, NULL, NULL); \ - if (ret < 0) \ - return gnutls_assert_val(x) - -+ - /* thus function is called for every token in the traverse_tokens - * function. Once everything is traversed it is called with NULL tinfo. - * It should return 0 if found what it was looking for. -diff --git a/lib/pkcs11_privkey.c b/lib/pkcs11_privkey.c -index afe831ee9..fd1997c8c 100644 ---- a/lib/pkcs11_privkey.c -+++ b/lib/pkcs11_privkey.c -@@ -36,7 +36,7 @@ - /* In case of a fork, it will invalidate the open session - * in the privkey and start another */ - #define PKCS11_CHECK_INIT_PRIVKEY(k) \ -- ret = _gnutls_pkcs11_check_init(PROV_INIT_MANUAL, k, reopen_privkey_session); \ -+ ret = _gnutls_pkcs11_check_init(PROV_INIT_ALL, k, reopen_privkey_session); \ - if (ret < 0) \ - return gnutls_assert_val(ret) - -diff --git a/lib/x509/verify-high.c b/lib/x509/verify-high.c -index 69fc0f2e6..7b375d61f 100644 ---- a/lib/x509/verify-high.c -+++ b/lib/x509/verify-high.c -@@ -367,7 +367,7 @@ advance_iter(gnutls_x509_trust_list_t list, - if (list->pkcs11_token != NULL) { - if (iter->pkcs11_list == NULL) { - ret = gnutls_pkcs11_obj_list_import_url2(&iter->pkcs11_list, &iter->pkcs11_size, -- list->pkcs11_token, (GNUTLS_PKCS11_OBJ_FLAG_CRT|GNUTLS_PKCS11_OBJ_FLAG_MARK_CA|GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED), 0); -+ list->pkcs11_token, (GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE|GNUTLS_PKCS11_OBJ_FLAG_CRT|GNUTLS_PKCS11_OBJ_FLAG_MARK_CA|GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED), 0); - if (ret < 0) - return gnutls_assert_val(ret); - -@@ -972,7 +972,7 @@ int gnutls_x509_trust_list_get_issuer(gnutls_x509_trust_list_t list, - gnutls_datum_t der = {NULL, 0}; - /* use the token for verification */ - ret = gnutls_pkcs11_get_raw_issuer(list->pkcs11_token, cert, &der, -- GNUTLS_X509_FMT_DER, 0); -+ GNUTLS_X509_FMT_DER, GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE); - if (ret < 0) { - gnutls_assert(); - return ret; -@@ -1044,7 +1044,7 @@ int gnutls_x509_trust_list_get_issuer_by_dn(gnutls_x509_trust_list_t list, - gnutls_datum_t der = {NULL, 0}; - /* use the token for verification */ - ret = gnutls_pkcs11_get_raw_issuer_by_dn(list->pkcs11_token, dn, &der, -- GNUTLS_X509_FMT_DER, 0); -+ GNUTLS_X509_FMT_DER, GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE); - if (ret < 0) { - gnutls_assert(); - return ret; -@@ -1105,7 +1105,7 @@ int gnutls_x509_trust_list_get_issuer_by_subject_key_id(gnutls_x509_trust_list_t - gnutls_datum_t der = {NULL, 0}; - /* use the token for verification */ - ret = gnutls_pkcs11_get_raw_issuer_by_subject_key_id(list->pkcs11_token, dn, spki, &der, -- GNUTLS_X509_FMT_DER, 0); -+ GNUTLS_X509_FMT_DER, GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE); - if (ret < 0) { - gnutls_assert(); - return ret; -diff --git a/lib/x509/verify-high2.c b/lib/x509/verify-high2.c -index fb9f9ce10..8c75b2641 100644 ---- a/lib/x509/verify-high2.c -+++ b/lib/x509/verify-high2.c -@@ -188,6 +188,10 @@ int add_trust_list_pkcs11_object_url(gnutls_x509_trust_list_t list, const char * - gnutls_pkcs11_obj_t *pcrt_list = NULL; - unsigned int pcrt_list_size = 0, i; - int ret; -+ -+ /* here we don't use the flag GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE, -+ * as we want to explicitly load from any module available in the system. -+ */ - ret = - gnutls_pkcs11_obj_list_import_url2(&pcrt_list, &pcrt_list_size, - url, -@@ -323,7 +327,7 @@ gnutls_x509_trust_list_add_trust_file(gnutls_x509_trust_list_t list, - */ - if (is_pkcs11_url_object(ca_file) != 0) { - return add_trust_list_pkcs11_object_url(list, ca_file, tl_flags); -- } else { /* token */ -+ } else { /* trusted token */ - if (list->pkcs11_token != NULL) - return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); - list->pkcs11_token = gnutls_strdup(ca_file); -@@ -331,7 +335,7 @@ gnutls_x509_trust_list_add_trust_file(gnutls_x509_trust_list_t list, - /* enumerate the certificates */ - ret = gnutls_pkcs11_obj_list_import_url(NULL, &pcrt_list_size, - ca_file, -- (GNUTLS_PKCS11_OBJ_FLAG_CRT|GNUTLS_PKCS11_OBJ_FLAG_MARK_CA|GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED), -+ (GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE|GNUTLS_PKCS11_OBJ_FLAG_CRT|GNUTLS_PKCS11_OBJ_FLAG_MARK_CA|GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED), - 0); - if (ret < 0 && ret != GNUTLS_E_SHORT_MEMORY_BUFFER) - return gnutls_assert_val(ret); diff --git a/gnutls.spec b/gnutls.spec index 1dc296a..bc26a4f 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,10 +1,8 @@ # This spec file has been automatically updated -Version: 3.5.16 -Release: 4%{?dist} +Version: 3.5.17 +Release: 1%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.4.2-no-now-guile.patch -Patch3: gnutls-3.6.1-pkcs11-loading.patch -Patch4: gnutls-3.6.1-pkcs11-loading2.patch %bcond_without dane %bcond_without guile Summary: A TLS protocol implementation @@ -140,8 +138,6 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} %setup -q %patch1 -p1 %patch2 -p1 -%patch3 -p1 -%patch4 -p1 sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure rm -f lib/minitasn1/*.c lib/minitasn1/*.h @@ -272,6 +268,9 @@ fi %endif %changelog +* Wed Jan 17 2018 Nikos Mavrogiannopoulos - 3.5.17-1 +- Update to upstream 3.5.17 release + * Thu Nov 30 2017 Nikos Mavrogiannopoulos - 3.5.17-4 - Corrected regression from 3.5.17-3 which prevented the loading of arbitrary p11-kit modules (#1507402) diff --git a/sources b/sources index 3a8187a..87b32ff 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 7eccc70fb763cf8a6525228230c1f537224809cf553efb3ad6bc88ad96f01122c30a5cd9d8328fa3a97b242d59e00bc9966589a24b1e65dd4a27eb71393f097c -SHA512 (gnutls-3.5.16.tar.xz.sig) = 7fa6d65b94f0895885229ac7c4df5b98372043e9b37e41d7a8799a35a06305abef97525edb27013be406a3e23efe711ae7b324c5ded65fc1677b1c0289ab267c -SHA512 (gnutls-3.5.16.tar.xz) = 451d3167be599ed8e0333dd7c9f8501fcb47b7aa871aeb461c368381c0b7ecd7e2026ec35dbbb2aa685cb2c3a22e9296e0a0699409e3744b731c1bb7e7e69f07 +SHA512 (gnutls-3.5.17.tar.xz.sig) = 7028c2c1f75e5a3fde151e350fe43a1896d1659c23f6db940ea5149d8d15dd16259541b6e7cc2cae2cadd5cd79aa5f98313c8b5d2c98197a40d5eb476c2944b8 +SHA512 (gnutls-3.5.17.tar.xz) = 0cb3405dee64737e314bfa9eed6afa57a8951190fe576122aecaf587c07ec1a5df1ac4819078bff0d292271639019c76d9a708027b502e3f55e2cf6576555ea6 From b098d60c085424baee0ecd36616eadacefcba401 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 16 Feb 2018 12:52:36 +0100 Subject: [PATCH 13/14] Update to 3.5.18-1 - Update to upstream 3.5.18 release --- .gitignore | 3 +++ gnutls.spec | 5 ++++- ...42418905D8206AA754CCDC29EE58B996865171.gpg | Bin 56226 -> 58697 bytes sources | 6 +++--- 4 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 0302e45..708891e 100644 --- a/.gitignore +++ b/.gitignore @@ -92,3 +92,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /gnutls-3.5.17.tar.xz.sig /gnutls-3.5.17.tar.xz +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/gnutls-3.5.18.tar.xz.sig +/gnutls-3.5.18.tar.xz diff --git a/gnutls.spec b/gnutls.spec index bc26a4f..89eee1d 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 3.5.17 +Version: 3.5.18 Release: 1%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.4.2-no-now-guile.patch @@ -268,6 +268,9 @@ fi %endif %changelog +* Fri Feb 16 2018 Nikos Mavrogiannopoulos - 3.5.18-1 +- Update to upstream 3.5.18 release + * Wed Jan 17 2018 Nikos Mavrogiannopoulos - 3.5.17-1 - Update to upstream 3.5.17 release diff --git a/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg b/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg index 1f9a40cc96ea43f54ea9dc0f1873971a85535c2f..b1ee43c60379c783e5f3457c480d6a7ecc2447c5 100644 GIT binary patch delta 2201 zcmajfc{me}9|!Pl=AJuq&XptPi(I*nxuX%52)RWlAfZp?Q9Q`^!3dC3PpY4+LQv=C>t3>qinS9bDmO+iAPZZd~l($$+Yk|`EUM(b>rQG}ZYwp~0NipABHt$KT=2!*pw=7EyUq5kFXS2$SyEx-R zOpu};aRD$+(G{5mst5LHA$h{~hps4U#=dgu7A&o2om;==t3>7W%)9{bJg-6Ot!y+s zp*h?n588O?`kj`8KC$5m`weubIhq0wB?P&cNMH(UpU&n7nEu!r#r>UgFn0S6ut6!d z!iJYez;GfCUOn@v!sK~g2V6R{H->25(kAUK9?zhG6cV;TY^+%UYg!vaecpg?X%;T^ ztiJYsp&&z_EB-*`$o}2ySVNhBMo#(ceAV9g8A3=d{tbPa0z#94Twu32lMNsnp#DQF z|J6L&Ok}XwkYJdzNV7#CLb5do!3j@S49hDR)RifH*_!Wms~vQor3%US{jA+vQR6B> z-|B(^La=>)Y6@c|X5C(0H5Q{=M4D4w_p)xLlhUZNw+lvU>>LPBB4BM;(j6 zV=MzsMtp5XYvSZw4c(!S9hc$WrejRS0WOm?;&2+0Hb)PH*wlQ~=qKAn(Dg%k{P%S^ z=hmPW7#4*3GG%hgsB4ocm2pD3nLqZppWo)KwkFIMVU?_5WXIvOSe_<#Ul2Iw1D z7{~^Yhf0Gb5vCc;(^A2e&ckzx+gHih)XU+_p#S;;iGi5e`G=VRKofS}KT*dWDX<8T z4FH2mgI!M=-760WRS<^@k<;SVX?uZ1{=Z)V9PGS*E@;xFYVQ(HPkM)aS zI9SqhoWOUs7KKxi78HagU2K8M>T3_i$@a+nY)-*AM3@R8^o9NUNI}ID8C9CnWg7U> zH94+`CH~bLjht1;Bg>lZ1*16mxA-u-HKICNOvcADn=vg2k-|`VW>epO6Aj4`(dbo4vgq`8y_xg*q7zEB*RYH7sLW+JyCLx|I90 zq&41`e5b5}YY)||>ZyY+>g3GsA5m!3CyuD~>HRU0ex_O~YiJiMiHkm$v3rvb_Rp^2 z;>rG)XVj9jLN0CH>I5XrP*=YD5EC1Bw{1^CFnWK zu7b}f2O3hh0L2uDUm!$gPwI}6hx)M>11@fw&G4e9I9`g%F8;BB)YWmyE9 zzEyRGQ(Wy=_n3$sn!F}DQC9A8ww%oO3)ShQOG8YL<6MF~;p!blj5}mLd;X^~=gUkaG)> zJH4zfntmm;`Olti4SMsxK>&9AUl2?=Kw^;JApAG)KOk7FK_rx;RrCxa)0c2Kb*leN zOb#?8J1F9k^&!XR=XXSFaR%%OwVCfDv+(nQ)vCc8lKWF#49%nZ5ZJ^Rb7TIY7D3*d!?9;5u~KJT~?0x=KP z=1jIlwavO}pMMY(@_k!UTPIj;Cl}HQ>t>P=fML4y3a}e&>>IEYQ-cP({a+T|#FWE^ z)8sF;Q`{oY3P Date: Fri, 16 Feb 2018 17:23:14 +0100 Subject: [PATCH 14/14] Backported PKCS#11 loading improvements --- gnutls-3.5.18-pkcs11-loading.patch | 289 +++++++++++++++++++++++++++++ gnutls.spec | 7 +- 2 files changed, 295 insertions(+), 1 deletion(-) create mode 100644 gnutls-3.5.18-pkcs11-loading.patch diff --git a/gnutls-3.5.18-pkcs11-loading.patch b/gnutls-3.5.18-pkcs11-loading.patch new file mode 100644 index 0000000..1439395 --- /dev/null +++ b/gnutls-3.5.18-pkcs11-loading.patch @@ -0,0 +1,289 @@ +diff --git a/lib/pkcs11.c b/lib/pkcs11.c +index ec5754e89..c8b2c71f2 100644 +--- a/lib/pkcs11.c ++++ b/lib/pkcs11.c +@@ -264,20 +264,20 @@ pkcs11_add_module(const char* name, struct ck_function_list *module, const char + */ + int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_function cb) + { +- int ret; ++ int ret, sret = 0; + + ret = gnutls_mutex_lock(&_gnutls_pkcs11_mutex); + if (ret != 0) + return gnutls_assert_val(GNUTLS_E_LOCKING_ERROR); + +- if (providers_initialized >= req_level) { ++ if (providers_initialized > PROV_UNINITIALIZED) { + ret = 0; + + if (_gnutls_detect_fork(pkcs11_forkid)) { + /* if we are initialized but a fork is detected */ + ret = _gnutls_pkcs11_reinit(); + if (ret == 0) { +- ret = 1; ++ sret = 1; + if (cb) { + int ret2 = cb(priv); + if (ret2 < 0) +@@ -287,25 +287,60 @@ int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_ + } + } + +- gnutls_mutex_unlock(&_gnutls_pkcs11_mutex); +- return ret; +- } else if (providers_initialized < req_level && +- (req_level == PROV_INIT_TRUSTED)) { +- _gnutls_debug_log("Initializing needed PKCS #11 modules\n"); +- ret = auto_load(1); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; ++ } ++ } + +- providers_initialized = PROV_INIT_TRUSTED; +- } else { +- _gnutls_debug_log("Initializing all PKCS #11 modules\n"); +- ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_AUTO, NULL); ++ /* Possible Transitions: PROV_UNINITIALIZED -> PROV_INIT_MANUAL -> PROV_INIT_MANUAL_TRUSTED ++ * PROV_UNINITIALIZED -> PROV_INIT_TRUSTED -> PROV_INIT_ALL ++ * ++ * request for PROV_INIT_TRUSTED may result to PROV_INIT_MANUAL_TRUSTED ++ * request for PROV_INIT_ALL may result to PROV_INIT_MANUAL or PROV_INIT_MANUAL_TRUSTED ++ */ ++ switch(req_level) { ++ case PROV_UNINITIALIZED: ++ case PROV_INIT_MANUAL: ++ break; ++ case PROV_INIT_TRUSTED: ++ case PROV_INIT_MANUAL_TRUSTED: ++ if (providers_initialized < PROV_INIT_MANUAL_TRUSTED) { ++ _gnutls_debug_log("Initializing needed PKCS #11 modules\n"); ++ ret = auto_load(1); ++ if (ret < 0) { ++ gnutls_assert(); ++ } ++ ++ if (providers_initialized == PROV_INIT_MANUAL) ++ providers_initialized = PROV_INIT_MANUAL_TRUSTED; ++ else ++ providers_initialized = PROV_INIT_TRUSTED; ++ ++ goto cleanup; ++ } ++ break; ++ case PROV_INIT_ALL: ++ if (providers_initialized == PROV_INIT_TRUSTED || ++ providers_initialized == PROV_UNINITIALIZED) { ++ _gnutls_debug_log("Initializing all PKCS #11 modules\n"); ++ ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_AUTO, NULL); ++ if (ret < 0) { ++ gnutls_assert(); ++ } ++ ++ providers_initialized = PROV_INIT_ALL; ++ goto cleanup; ++ } ++ break; + } + +- gnutls_mutex_unlock(&_gnutls_pkcs11_mutex); ++ ret = sret; + +- if (ret < 0) +- return gnutls_assert_val(ret); ++ cleanup: ++ gnutls_mutex_unlock(&_gnutls_pkcs11_mutex); + +- return 0; ++ return ret; + } + + +@@ -3149,11 +3184,7 @@ gnutls_pkcs11_obj_list_import_url4(gnutls_pkcs11_obj_t ** p_list, + int ret; + struct find_obj_data_st priv; + +- if (flags & GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED) { +- PKCS11_CHECK_INIT_TRUSTED; +- } else { +- PKCS11_CHECK_INIT; +- } ++ PKCS11_CHECK_INIT_FLAGS(flags); + + memset(&priv, 0, sizeof(priv)); + +@@ -3790,7 +3821,7 @@ int gnutls_pkcs11_get_raw_issuer(const char *url, gnutls_x509_crt_t cert, + size_t id_size; + struct p11_kit_uri *info = NULL; + +- PKCS11_CHECK_INIT; ++ PKCS11_CHECK_INIT_FLAGS(flags); + + memset(&priv, 0, sizeof(priv)); + +@@ -3882,7 +3913,7 @@ int gnutls_pkcs11_get_raw_issuer_by_dn (const char *url, const gnutls_datum_t *d + struct find_cert_st priv; + struct p11_kit_uri *info = NULL; + +- PKCS11_CHECK_INIT; ++ PKCS11_CHECK_INIT_FLAGS(flags); + + memset(&priv, 0, sizeof(priv)); + +@@ -3969,7 +4000,7 @@ int gnutls_pkcs11_get_raw_issuer_by_subject_key_id (const char *url, + struct find_cert_st priv; + struct p11_kit_uri *info = NULL; + +- PKCS11_CHECK_INIT; ++ PKCS11_CHECK_INIT_FLAGS(flags); + + memset(&priv, 0, sizeof(priv)); + +@@ -4063,7 +4094,7 @@ unsigned gnutls_pkcs11_crt_is_known(const char *url, gnutls_x509_crt_t cert, + size_t serial_size; + struct p11_kit_uri *info = NULL; + +- PKCS11_CHECK_INIT_RET(0); ++ PKCS11_CHECK_INIT_FLAGS_RET(flags, 0); + + memset(&priv, 0, sizeof(priv)); + +diff --git a/lib/pkcs11_int.h b/lib/pkcs11_int.h +index e27518e3f..168bb7807 100644 +--- a/lib/pkcs11_int.h ++++ b/lib/pkcs11_int.h +@@ -69,10 +69,14 @@ typedef int (*pkcs11_reinit_function)(void *priv); + typedef enum init_level_t { + PROV_UNINITIALIZED = 0, + PROV_INIT_MANUAL, ++ PROV_INIT_MANUAL_TRUSTED, + PROV_INIT_TRUSTED, + PROV_INIT_ALL + } init_level_t; + ++/* See _gnutls_pkcs11_check_init() for possible Transitions. ++ */ ++ + int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_function cb); + + #define FIX_KEY_USAGE(pk, usage) \ +@@ -84,20 +88,26 @@ int _gnutls_pkcs11_check_init(init_level_t req_level, void *priv, pkcs11_reinit_ + } + + #define PKCS11_CHECK_INIT \ +- ret = _gnutls_pkcs11_check_init(PROV_INIT_MANUAL, NULL, NULL); \ ++ ret = _gnutls_pkcs11_check_init(PROV_INIT_ALL, NULL, NULL); \ + if (ret < 0) \ + return gnutls_assert_val(ret) + +-#define PKCS11_CHECK_INIT_TRUSTED \ +- ret = _gnutls_pkcs11_check_init(PROV_INIT_TRUSTED, NULL, NULL); \ ++#define PKCS11_CHECK_INIT_RET(x) \ ++ ret = _gnutls_pkcs11_check_init(PROV_INIT_ALL, NULL, NULL); \ ++ if (ret < 0) \ ++ return gnutls_assert_val(x) ++ ++#define PKCS11_CHECK_INIT_FLAGS(f) \ ++ ret = _gnutls_pkcs11_check_init((f & GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE)?PROV_INIT_TRUSTED:PROV_INIT_ALL, NULL, NULL); \ + if (ret < 0) \ + return gnutls_assert_val(ret) + +-#define PKCS11_CHECK_INIT_RET(x) \ +- ret = _gnutls_pkcs11_check_init(PROV_INIT_MANUAL, NULL, NULL); \ ++#define PKCS11_CHECK_INIT_FLAGS_RET(f, x) \ ++ ret = _gnutls_pkcs11_check_init((f & GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE)?PROV_INIT_TRUSTED:PROV_INIT_ALL, NULL, NULL); \ + if (ret < 0) \ + return gnutls_assert_val(x) + ++ + /* thus function is called for every token in the traverse_tokens + * function. Once everything is traversed it is called with NULL tinfo. + * It should return 0 if found what it was looking for. +diff --git a/lib/pkcs11_privkey.c b/lib/pkcs11_privkey.c +index 4a9d928a3..6e9027d0b 100644 +--- a/lib/pkcs11_privkey.c ++++ b/lib/pkcs11_privkey.c +@@ -36,7 +36,7 @@ + /* In case of a fork, it will invalidate the open session + * in the privkey and start another */ + #define PKCS11_CHECK_INIT_PRIVKEY(k) \ +- ret = _gnutls_pkcs11_check_init(PROV_INIT_MANUAL, k, reopen_privkey_session); \ ++ ret = _gnutls_pkcs11_check_init(PROV_INIT_ALL, k, reopen_privkey_session); \ + if (ret < 0) \ + return gnutls_assert_val(ret) + +diff --git a/lib/x509/verify-high.c b/lib/x509/verify-high.c +index 1749d49b1..ec1a52ace 100644 +--- a/lib/x509/verify-high.c ++++ b/lib/x509/verify-high.c +@@ -368,7 +368,7 @@ advance_iter(gnutls_x509_trust_list_t list, + if (list->pkcs11_token != NULL) { + if (iter->pkcs11_list == NULL) { + ret = gnutls_pkcs11_obj_list_import_url2(&iter->pkcs11_list, &iter->pkcs11_size, +- list->pkcs11_token, (GNUTLS_PKCS11_OBJ_FLAG_CRT|GNUTLS_PKCS11_OBJ_FLAG_MARK_CA|GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED), 0); ++ list->pkcs11_token, (GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE|GNUTLS_PKCS11_OBJ_FLAG_CRT|GNUTLS_PKCS11_OBJ_FLAG_MARK_CA|GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED), 0); + if (ret < 0) + return gnutls_assert_val(ret); + +@@ -964,7 +964,7 @@ int gnutls_x509_trust_list_get_issuer(gnutls_x509_trust_list_t list, + gnutls_datum_t der = {NULL, 0}; + /* use the token for verification */ + ret = gnutls_pkcs11_get_raw_issuer(list->pkcs11_token, cert, &der, +- GNUTLS_X509_FMT_DER, 0); ++ GNUTLS_X509_FMT_DER, GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE); + if (ret < 0) { + gnutls_assert(); + return ret; +@@ -1036,7 +1036,7 @@ int gnutls_x509_trust_list_get_issuer_by_dn(gnutls_x509_trust_list_t list, + gnutls_datum_t der = {NULL, 0}; + /* use the token for verification */ + ret = gnutls_pkcs11_get_raw_issuer_by_dn(list->pkcs11_token, dn, &der, +- GNUTLS_X509_FMT_DER, 0); ++ GNUTLS_X509_FMT_DER, GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE); + if (ret < 0) { + gnutls_assert(); + return ret; +@@ -1097,7 +1097,7 @@ int gnutls_x509_trust_list_get_issuer_by_subject_key_id(gnutls_x509_trust_list_t + gnutls_datum_t der = {NULL, 0}; + /* use the token for verification */ + ret = gnutls_pkcs11_get_raw_issuer_by_subject_key_id(list->pkcs11_token, dn, spki, &der, +- GNUTLS_X509_FMT_DER, 0); ++ GNUTLS_X509_FMT_DER, GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE); + if (ret < 0) { + gnutls_assert(); + return ret; +diff --git a/lib/x509/verify-high2.c b/lib/x509/verify-high2.c +index fb9f9ce10..8c75b2641 100644 +--- a/lib/x509/verify-high2.c ++++ b/lib/x509/verify-high2.c +@@ -188,6 +188,10 @@ int add_trust_list_pkcs11_object_url(gnutls_x509_trust_list_t list, const char * + gnutls_pkcs11_obj_t *pcrt_list = NULL; + unsigned int pcrt_list_size = 0, i; + int ret; ++ ++ /* here we don't use the flag GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE, ++ * as we want to explicitly load from any module available in the system. ++ */ + ret = + gnutls_pkcs11_obj_list_import_url2(&pcrt_list, &pcrt_list_size, + url, +@@ -323,7 +327,7 @@ gnutls_x509_trust_list_add_trust_file(gnutls_x509_trust_list_t list, + */ + if (is_pkcs11_url_object(ca_file) != 0) { + return add_trust_list_pkcs11_object_url(list, ca_file, tl_flags); +- } else { /* token */ ++ } else { /* trusted token */ + if (list->pkcs11_token != NULL) + return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); + list->pkcs11_token = gnutls_strdup(ca_file); +@@ -331,7 +335,7 @@ gnutls_x509_trust_list_add_trust_file(gnutls_x509_trust_list_t list, + /* enumerate the certificates */ + ret = gnutls_pkcs11_obj_list_import_url(NULL, &pcrt_list_size, + ca_file, +- (GNUTLS_PKCS11_OBJ_FLAG_CRT|GNUTLS_PKCS11_OBJ_FLAG_MARK_CA|GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED), ++ (GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE|GNUTLS_PKCS11_OBJ_FLAG_CRT|GNUTLS_PKCS11_OBJ_FLAG_MARK_CA|GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED), + 0); + if (ret < 0 && ret != GNUTLS_E_SHORT_MEMORY_BUFFER) + return gnutls_assert_val(ret); diff --git a/gnutls.spec b/gnutls.spec index 89eee1d..dcfbe24 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,8 +1,9 @@ # This spec file has been automatically updated Version: 3.5.18 -Release: 1%{?dist} +Release: 2%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.4.2-no-now-guile.patch +Patch3: gnutls-3.5.18-pkcs11-loading.patch %bcond_without dane %bcond_without guile Summary: A TLS protocol implementation @@ -138,6 +139,7 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} %setup -q %patch1 -p1 %patch2 -p1 +%patch3 -p1 sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure rm -f lib/minitasn1/*.c lib/minitasn1/*.h @@ -268,6 +270,9 @@ fi %endif %changelog +* Fri Feb 16 2018 Nikos Mavrogiannopoulos - 3.5.18-2 +- Backported PKCS#11 loading improvements. + * Fri Feb 16 2018 Nikos Mavrogiannopoulos - 3.5.18-1 - Update to upstream 3.5.18 release