From da6a8406bd597edab5d91e5ed848673464b70fb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Tue, 28 Mar 2017 13:19:31 +0200
Subject: [PATCH 001/359] Resolves: #1434916 - httpd.service: Failed with
 result timeout

---
 httpd-2.4.25-r1787141.patch | 103 ++++++++++++++++++++++++++++++++++++
 httpd.spec                  |   7 ++-
 2 files changed, 109 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.25-r1787141.patch

diff --git a/httpd-2.4.25-r1787141.patch b/httpd-2.4.25-r1787141.patch
new file mode 100644
index 0000000..012bc13
--- /dev/null
+++ b/httpd-2.4.25-r1787141.patch
@@ -0,0 +1,103 @@
+diff --git a/modules/http2/h2_workers.c b/modules/http2/h2_workers.c
+index 1dcfb2f..cbaf1bc 100644
+--- a/modules/http2/h2_workers.c
++++ b/modules/http2/h2_workers.c
+@@ -235,6 +235,28 @@ static apr_status_t h2_workers_start(h2_workers *workers)
+     return status;
+ }
+ 
++static apr_status_t workers_pool_cleanup(void *data)
++{
++    h2_workers *workers = data;
++    h2_worker *w;
++    
++    if (!workers->aborted) {
++        workers->aborted = 1;
++
++        /* before we go, cleanup any zombies and abort the rest */
++        cleanup_zombies(workers, 1);
++        w = H2_WORKER_LIST_FIRST(&workers->workers);
++        while (w != H2_WORKER_LIST_SENTINEL(&workers->workers)) {
++            h2_worker_abort(w);
++            w = H2_WORKER_NEXT(w);
++        }
++        apr_thread_mutex_lock(workers->lock);
++        apr_thread_cond_broadcast(workers->mplx_added);
++        apr_thread_mutex_unlock(workers->lock);
++    }
++    return APR_SUCCESS;
++}
++
+ h2_workers *h2_workers_create(server_rec *s, apr_pool_t *server_pool,
+                               int min_workers, int max_workers,
+                               apr_size_t max_tx_handles)
+@@ -283,50 +305,20 @@ h2_workers *h2_workers_create(server_rec *s, apr_pool_t *server_pool,
+         if (status == APR_SUCCESS) {
+             status = apr_thread_cond_create(&workers->mplx_added, workers->pool);
+         }
+-        
+         if (status == APR_SUCCESS) {
+             status = apr_thread_mutex_create(&workers->tx_lock,
+                                              APR_THREAD_MUTEX_DEFAULT,
+                                              workers->pool);
+         }
+-        
+         if (status == APR_SUCCESS) {
+             status = h2_workers_start(workers);
+         }
+-        
+-        if (status != APR_SUCCESS) {
+-            h2_workers_destroy(workers);
+-            workers = NULL;
++        if (status == APR_SUCCESS) {
++            apr_pool_pre_cleanup_register(pool, workers, workers_pool_cleanup);    
++            return workers;
+         }
+     }
+-    return workers;
+-}
+-
+-void h2_workers_destroy(h2_workers *workers)
+-{
+-    /* before we go, cleanup any zombie workers that may have accumulated */
+-    cleanup_zombies(workers, 1);
+-    
+-    if (workers->mplx_added) {
+-        apr_thread_cond_destroy(workers->mplx_added);
+-        workers->mplx_added = NULL;
+-    }
+-    if (workers->lock) {
+-        apr_thread_mutex_destroy(workers->lock);
+-        workers->lock = NULL;
+-    }
+-    while (!H2_MPLX_LIST_EMPTY(&workers->mplxs)) {
+-        h2_mplx *m = H2_MPLX_LIST_FIRST(&workers->mplxs);
+-        H2_MPLX_REMOVE(m);
+-    }
+-    while (!H2_WORKER_LIST_EMPTY(&workers->workers)) {
+-        h2_worker *w = H2_WORKER_LIST_FIRST(&workers->workers);
+-        H2_WORKER_REMOVE(w);
+-    }
+-    if (workers->pool) {
+-        apr_pool_destroy(workers->pool);
+-        /* workers is gone */
+-    }
++    return NULL;
+ }
+ 
+ apr_status_t h2_workers_register(h2_workers *workers, struct h2_mplx *m)
+diff --git a/modules/http2/h2_workers.h b/modules/http2/h2_workers.h
+index ae7b4d8..b96cff3 100644
+--- a/modules/http2/h2_workers.h
++++ b/modules/http2/h2_workers.h
+@@ -67,10 +67,6 @@ h2_workers *h2_workers_create(server_rec *s, apr_pool_t *pool,
+                               int min_size, int max_size, 
+                               apr_size_t max_tx_handles);
+ 
+-/* Destroy the worker pool and all its threads. 
+- */
+-void h2_workers_destroy(h2_workers *workers);
+-
+ /**
+  * Registers a h2_mplx for task scheduling. If this h2_mplx runs
+  * out of tasks, it will be automatically be unregistered. Should
diff --git a/httpd.spec b/httpd.spec
index 6d764c6..f7e5631 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,7 +8,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.25
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: http://httpd.apache.org/
 Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -66,6 +66,7 @@ Patch35: httpd-2.4.17-sslciphdefault.patch
 Patch56: httpd-2.4.4-mod_unique_id.patch
 Patch57: httpd-2.4.10-sigint.patch
 Patch58: httpd-2.4.25-r1778319+.patch
+Patch59: httpd-2.4.25-r1787141.patch
 # Security fixes
 
 License: ASL 2.0
@@ -213,6 +214,7 @@ interface for storing and accessing per-user session data.
 %patch56 -p1 -b .uniqueid
 %patch57 -p1 -b .sigint
 %patch58 -p1 -b .r1778319+
+%patch59 -p1 -b .r1787141
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -684,6 +686,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Mar 28 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.25-5
+- Resolves: #1434916 - httpd.service: Failed with result timeout
+
 * Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.25-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
 

From 70d2b4ee4f12d3adb11124c96c93cc08a9f34595 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Wed, 12 Jul 2017 14:54:15 +0200
Subject: [PATCH 002/359] perl dependency renamed to perl-interpreter
 <https://fedoraproject.org/wiki/Changes/perl_Package_to_Install_Core_Modules>

---
 httpd.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 81f556e..359e50b 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -72,7 +72,7 @@ Patch58: httpd-2.4.25-r1738878.patch
 License: ASL 2.0
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
-BuildRequires: autoconf, perl, perl-generators, pkgconfig, findutils, xmlto
+BuildRequires: autoconf, perl-interpreter, perl-generators, pkgconfig, findutils, xmlto
 BuildRequires: zlib-devel, libselinux-devel, lua-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0
 BuildRequires: systemd-devel

From 6de83362da8ce6c5240c082e6e7b8a838ae1857d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 14 Jul 2017 12:55:47 +0100
Subject: [PATCH 003/359] Fix grammar.

---
 httpd.service | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd.service b/httpd.service
index 1f707e8..011df3b 100644
--- a/httpd.service
+++ b/httpd.service
@@ -3,7 +3,7 @@
 # Modifying this file in-place is not recommended, because changes
 # will be overwritten during package upgrades.  If you want to
 # customize the behaviour, the best way is to use "systemctl edit"
-# command to create an override unit.
+# to create an override unit.
 
 # For example, to pass additional options (such as -D definitions) to
 # the httpd binary at startup, create an override unit (as is done by

From 3150aa97f5e624e42fb242ba6cdecad36bdcdfd1 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 14 Jul 2017 12:57:27 +0100
Subject: [PATCH 004/359] Shorter text in httpd.service.

---
 httpd.service | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/httpd.service b/httpd.service
index 011df3b..1b779e9 100644
--- a/httpd.service
+++ b/httpd.service
@@ -1,9 +1,8 @@
 # See httpd.service(8) for more information on using the httpd service.
 
 # Modifying this file in-place is not recommended, because changes
-# will be overwritten during package upgrades.  If you want to
-# customize the behaviour, the best way is to use "systemctl edit"
-# to create an override unit.
+# will be overwritten during package upgrades.  To customize the
+# behaviour, run "systemctl edit httpd" to create an override unit.
 
 # For example, to pass additional options (such as -D definitions) to
 # the httpd binary at startup, create an override unit (as is done by

From e9d2120fbfd6cf56ab24c09c3d5773f19d485492 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 17 Jul 2017 11:39:57 +0100
Subject: [PATCH 005/359] switch to event by default for Fedora 27 and later
 (#1471708) Resolves: rhbz#1471708

---
 00-mpm.conf |  2 +-
 httpd.spec  | 18 ++++++++++++++++--
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/00-mpm.conf b/00-mpm.conf
index 7bfd1d4..75d90e9 100644
--- a/00-mpm.conf
+++ b/00-mpm.conf
@@ -3,7 +3,7 @@
 
 # prefork MPM: Implements a non-threaded, pre-forking web server
 # See: http://httpd.apache.org/docs/2.4/mod/prefork.html
-LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
+#LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
 
 # worker MPM: Multi-Processing Module implementing a hybrid
 # multi-threaded multi-process web server
diff --git a/httpd.spec b/httpd.spec
index 359e50b..5ae1891 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -4,11 +4,16 @@
 %define mmn 20120211
 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits}
 %define vstring %(source /etc/os-release; echo ${REDHAT_SUPPORT_PRODUCT})
+%if 0%{?fedora} < 27
+%global mpm prefork
+%else
+%global mpm event
+%endif
 
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: http://httpd.apache.org/
 Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -230,7 +235,8 @@ fi
 
 xmlto man $RPM_SOURCE_DIR/httpd.service.xml
 
-: Building with MMN %{mmn}, MMN-ISA %{mmnisa} and vendor string '%{vstring}'
+: Building with MMN %{mmn}, MMN-ISA %{mmnisa}
+: Default MPM is %{mpm}, vendor string is '%{vstring}'
 
 %build
 # forcibly prevent use of bundled apr, apr-util, pcre
@@ -314,6 +320,11 @@ for f in 00-base.conf 00-mpm.conf 00-lua.conf 01-cgi.conf 00-dav.conf \
         $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/$f
 done
 
+sed -i '/^#LoadModule mpm_%{mpm}_module /s/^#//' \
+     $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/00-mpm.conf
+touch -r $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/00-mpm.conf \
+     $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/00-mpm.conf
+
 # install systemd override drop directory
 # Web application packages can drop snippets into this location if
 # they need ExecStart[pre|post].
@@ -692,6 +703,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Jul 17 2017 Joe Orton <jorton@redhat.com> - 2.4.27-3
+- switch to event by default for Fedora 27 and later (#1471708)
+
 * Wed Jul 12 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.27-2
 - Resolves: #1469959 - httpd update cleaned out /etc/sysconfig
 

From adcaa3428979e75ed3cc4e3a942842be7b16cfa2 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 18 Jul 2017 09:25:14 +0100
Subject: [PATCH 006/359] update mod_systemd (r1802251)

---
 httpd-2.4.26-r1800306.patch                   | 86 -------------------
 ...ystemd.patch => httpd-2.4.27-systemd.patch | 40 ++++++---
 httpd.spec                                    |  7 +-
 3 files changed, 33 insertions(+), 100 deletions(-)
 delete mode 100644 httpd-2.4.26-r1800306.patch
 rename httpd-2.4.10-mod_systemd.patch => httpd-2.4.27-systemd.patch (79%)

diff --git a/httpd-2.4.26-r1800306.patch b/httpd-2.4.26-r1800306.patch
deleted file mode 100644
index 4a8bc2d..0000000
--- a/httpd-2.4.26-r1800306.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-# ./pullrev.sh 1800306
-
-http://svn.apache.org/viewvc?view=revision&revision=1800306
-
-diff -uap httpd-2.4.26/modules/mappers/mod_actions.c.r1800306 httpd-2.4.26/modules/mappers/mod_actions.c
---- httpd-2.4.26/modules/mappers/mod_actions.c.r1800306
-+++ httpd-2.4.26/modules/mappers/mod_actions.c
-@@ -186,8 +186,7 @@
-         ap_field_noparam(r->pool, r->content_type);
- 
-     if (action && (t = apr_table_get(conf->action_types, action))) {
--        int virtual = (*t++ == '0' ? 0 : 1);
--        if (!virtual && r->finfo.filetype == APR_NOFILE) {
-+        if (*t++ == '0' && r->finfo.filetype == APR_NOFILE) {
-             ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00652)
-                           "File does not exist: %s", r->filename);
-             return HTTP_NOT_FOUND;
-@@ -198,9 +197,6 @@
-          * (will be REDIRECT_HANDLER there)
-          */
-         apr_table_setn(r->subprocess_env, "HANDLER", action);
--        if (virtual) {
--            apr_table_setn(r->notes, "virtual_script", "1");
--        }
-     }
- 
-     if (script == NULL)
-diff -uap httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c.r1800306 httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c
---- httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c.r1800306
-+++ httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c
-@@ -321,7 +321,6 @@
-     apr_status_t rv;
-     apr_size_t avail_len, len, required_len;
-     int next_elem, starting_elem;
--    int fpm = 0;
-     fcgi_req_config_t *rconf = ap_get_module_config(r->request_config, &proxy_fcgi_module);
-     fcgi_dirconf_t *dconf = ap_get_module_config(r->per_dir_config, &proxy_fcgi_module);
- 
-@@ -354,8 +353,6 @@
-                     *qs = '\0';
-                 }
-             }
--        } else {
--            fpm = 1;
-         }
- 
-         if (newfname) {
-@@ -364,38 +361,9 @@
-         }
-     }
- 
--#if 0
--    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(09999)
--                  "r->filename: %s", (r->filename ? r->filename : "nil"));
--    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(09999)
--                  "r->uri: %s", (r->uri ? r->uri : "nil"));
--    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(09999)
--                  "r->path_info: %s", (r->path_info ? r->path_info : "nil"));
--#endif
--
-     ap_add_common_vars(r);
-     ap_add_cgi_vars(r);
- 
--    if (fpm || apr_table_get(r->notes, "virtual_script")) {
--        /*
--         * Adjust SCRIPT_NAME, PATH_INFO and PATH_TRANSLATED for PHP-FPM
--         * TODO: Right now, PATH_INFO and PATH_TRANSLATED look OK...
--         */
--        const char *pend;
--        const char *script_name = apr_table_get(r->subprocess_env, "SCRIPT_NAME");
--        pend = script_name + strlen(script_name);
--        if (r->path_info && *r->path_info) {
--            pend = script_name + ap_find_path_info(script_name, r->path_info) - 1;
--        }
--        while (pend != script_name && *pend != '/') {
--            pend--;
--        }
--        apr_table_setn(r->subprocess_env, "SCRIPT_NAME", pend);
--        ap_log_rerror(APLOG_MARK, APLOG_TRACE4, 0, r,
--                      "fpm:virtual_script: Modified SCRIPT_NAME to: %s",
--                      pend);
--    }
--
-     /* XXX are there any FastCGI specific env vars we need to send? */
- 
-     /* Give admins final option to fine-tune env vars */
diff --git a/httpd-2.4.10-mod_systemd.patch b/httpd-2.4.27-systemd.patch
similarity index 79%
rename from httpd-2.4.10-mod_systemd.patch
rename to httpd-2.4.27-systemd.patch
index 88d76ac..26aac48 100644
--- a/httpd-2.4.10-mod_systemd.patch
+++ b/httpd-2.4.27-systemd.patch
@@ -1,8 +1,10 @@
-diff --git a/modules/arch/unix/config5.m4 b/modules/arch/unix/config5.m4
-index 77027a8..7a13d5a 100644
---- a/modules/arch/unix/config5.m4
-+++ b/modules/arch/unix/config5.m4
-@@ -18,6 +18,16 @@ APACHE_MODULE(privileges, Per-virtualhost Unix UserIDs and enhanced security for
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+--- httpd-2.4.27/modules/arch/unix/config5.m4.systemd
++++ httpd-2.4.27/modules/arch/unix/config5.m4
+@@ -18,6 +18,16 @@
    fi
  ])
  
@@ -19,12 +21,10 @@ index 77027a8..7a13d5a 100644
  APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
  
  APACHE_MODPATH_FINISH
-diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
-new file mode 100644
-index 0000000..5381c98
---- /dev/null
-+++ b/modules/arch/unix/mod_systemd.c
-@@ -0,0 +1,145 @@
+diff -uap httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd httpd-2.4.27/modules/arch/unix/mod_systemd.c
+--- httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd
++++ httpd-2.4.27/modules/arch/unix/mod_systemd.c
+@@ -0,0 +1,161 @@
 +/* Licensed to the Apache Software Foundation (ASF) under one or more
 + * contributor license agreements.  See the NOTICE file distributed with
 + * this work for additional information regarding copyright ownership.
@@ -66,11 +66,20 @@ index 0000000..5381c98
 +static unsigned long bytes_served;
 +static pid_t mainpid;
 +
++static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
++                              apr_pool_t *ptemp)
++{
++    sd_notify(0,
++              "RELOADING=1\n"
++              "STATUS=Reading configuration...\n");
++    ap_extended_status = 1;
++    return OK;
++}
++
 +static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
 +{
 +    int rv;
 +
-+    ap_extended_status = 1;
 +    mainpid = getpid();
 +
 +    rv = sd_notifyf(0, "READY=1\n"
@@ -91,6 +100,11 @@ index 0000000..5381c98
 +    char bps[5];
 +    int rv;
 +
++    if (!ap_extended_status) {
++        /* Nothing useful to report if ExtendedStatus disabled. */
++        return DECLINED;
++    }
++    
 +    ap_get_sload(&sload);
 +    /* up_time in seconds */
 +    up_time = (apr_uint32_t) apr_time_sec(apr_time_now() -
@@ -136,6 +150,8 @@ index 0000000..5381c98
 +
 +static void systemd_register_hooks(apr_pool_t *p)
 +{
++    /* Enable ap_extended_status. */
++    ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
 +    /* We know the PID in this hook ... */
 +    ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST);
 +    /* Used to update httpd's status line using sd_notifyf */
diff --git a/httpd.spec b/httpd.spec
index 5ae1891..4fd787a 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: http://httpd.apache.org/
 Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -62,7 +62,7 @@ Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
 Patch26: httpd-2.4.4-r1337344+.patch
 Patch27: httpd-2.4.2-icons.patch
-Patch29: httpd-2.4.10-mod_systemd.patch
+Patch29: httpd-2.4.27-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
 Patch31: httpd-2.4.18-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
@@ -703,6 +703,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Jul 18 2017 Joe Orton <jorton@redhat.com> - 2.4.27-4
+- update mod_systemd (r1802251)
+
 * Mon Jul 17 2017 Joe Orton <jorton@redhat.com> - 2.4.27-3
 - switch to event by default for Fedora 27 and later (#1471708)
 

From bd989fa784369209509ce45b75379a95cf1980ea Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 26 Jul 2017 12:53:42 +0000
Subject: [PATCH 007/359] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 4fd787a..85a8cb4 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: http://httpd.apache.org/
 Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -703,6 +703,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.27-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
 * Tue Jul 18 2017 Joe Orton <jorton@redhat.com> - 2.4.27-4
 - update mod_systemd (r1802251)
 

From da66bed0cf8d4ef23f6b029a9871a07e90ac7ee6 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 2 Aug 2017 23:33:12 +0000
Subject: [PATCH 008/359] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 85a8cb4..412e411 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: http://httpd.apache.org/
 Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -703,6 +703,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.27-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
 * Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.27-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
 

From ddabcffa42aeee042fbe2af37931158ec539cb80 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 4 Aug 2017 13:19:55 +0100
Subject: [PATCH 009/359] Switch to https:// URLs.

---
 httpd.spec | 4 ++--
 index.html | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 412e411..0e25a2c 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -14,8 +14,8 @@ Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
 Release: 6%{?dist}
-URL: http://httpd.apache.org/
-Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
+URL: https://httpd.apache.org/
+Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
 Source2: httpd.logrotate
 Source4: httpd-ssl-pass-dialog
diff --git a/index.html b/index.html
index 7eff881..943f060 100644
--- a/index.html
+++ b/index.html
@@ -123,7 +123,7 @@
 					<div class="logos">
 						<p>You are free to use the images below on Apache and Fedora powered HTTP servers. Thanks for using Apache and Fedora!</p>
 
-						<p><a href="http://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="http://fedoraproject.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
+						<p><a href="https://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="http://fedoraproject.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
 					</div>
 				</div>
 			</div>

From b022e3b52344b687c25875b0a7d6c1ee26f8e5fa Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 13 Sep 2017 14:21:17 +0100
Subject: [PATCH 010/359] add new content-length filter (upstream PR 61222)

---
 .gitignore                  |   2 +-
 httpd-2.4.27-r1808230.patch | 131 ++++++++++++++++++++++++++++++++++++
 httpd.spec                  |   7 +-
 pullrev.sh                  |   4 +-
 4 files changed, 140 insertions(+), 4 deletions(-)
 create mode 100644 httpd-2.4.27-r1808230.patch

diff --git a/.gitignore b/.gitignore
index 19a3666..e364382 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,7 +10,7 @@ x86_64
 /httpd-2.2.21.tar.bz2
 /clog
 /httpd-2.2.22.tar.bz2
-/httpd-2.4.?
+/httpd-2.4.??/
 /httpd-2.4.2.tar.bz2
 /httpd-2.4.3.tar.bz2
 /httpd-2.4.4.tar.bz2
diff --git a/httpd-2.4.27-r1808230.patch b/httpd-2.4.27-r1808230.patch
new file mode 100644
index 0000000..e4062ea
--- /dev/null
+++ b/httpd-2.4.27-r1808230.patch
@@ -0,0 +1,131 @@
+# ./pullrev.sh 1808230
+http://svn.apache.org/viewvc?view=revision&revision=1808230
+
+--- httpd-2.4.27/server/protocol.c
++++ httpd-2.4.27/server/protocol.c
+@@ -1708,62 +1708,88 @@
+         ctx->tmpbb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
+     }
+ 
+-    /* Loop through this set of buckets to compute their length
+-     */
++    /* Loop through the brigade to count the length. To avoid
++     * arbitrary memory consumption with morphing bucket types, this
++     * loop will stop and pass on the brigade when necessary. */
+     e = APR_BRIGADE_FIRST(b);
+     while (e != APR_BRIGADE_SENTINEL(b)) {
++        apr_status_t rv;
++
+         if (APR_BUCKET_IS_EOS(e)) {
+             eos = 1;
+             break;
+         }
+-        if (e->length == (apr_size_t)-1) {
++        /* For a flush bucket, fall through to pass the brigade and
++         * flush now. */
++        else if (APR_BUCKET_IS_FLUSH(e)) {
++            e = APR_BUCKET_NEXT(e);
++        }
++        /* For metadata bucket types other than FLUSH, loop. */
++        else if (APR_BUCKET_IS_METADATA(e)) {
++            e = APR_BUCKET_NEXT(e);
++            continue;
++        }
++        /* For determinate length data buckets, count the length and
++         * continue. */
++        else if (e->length != (apr_size_t)-1) {
++            r->bytes_sent += e->length;
++            e = APR_BUCKET_NEXT(e);
++            continue;
++        }
++        /* For indeterminate length data buckets, perform one read. */
++        else /* e->length == (apr_size_t)-1 */ {
+             apr_size_t len;
+             const char *ignored;
+-            apr_status_t rv;
+-
+-            /* This is probably a pipe bucket.  Send everything
+-             * prior to this, and then read the data for this bucket.
+-             */
++        
+             rv = apr_bucket_read(e, &ignored, &len, eblock);
++            if ((rv != APR_SUCCESS) && !APR_STATUS_IS_EAGAIN(rv)) {
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
++                              "ap_content_length_filter: "
++                              "apr_bucket_read() failed");
++                return rv;
++            }
+             if (rv == APR_SUCCESS) {
+-                /* Attempt a nonblocking read next time through */
+                 eblock = APR_NONBLOCK_READ;
++                e = APR_BUCKET_NEXT(e);
+                 r->bytes_sent += len;
+             }
+             else if (APR_STATUS_IS_EAGAIN(rv)) {
+-                /* Output everything prior to this bucket, and then
+-                 * do a blocking read on the next batch.
+-                 */
+-                if (e != APR_BRIGADE_FIRST(b)) {
+-                    apr_bucket *flush;
+-                    apr_brigade_split_ex(b, e, ctx->tmpbb);
+-                    flush = apr_bucket_flush_create(r->connection->bucket_alloc);
++                apr_bucket *flush;
+ 
+-                    APR_BRIGADE_INSERT_TAIL(b, flush);
+-                    rv = ap_pass_brigade(f->next, b);
+-                    if (rv != APR_SUCCESS || f->c->aborted) {
+-                        return rv;
+-                    }
+-                    apr_brigade_cleanup(b);
+-                    APR_BRIGADE_CONCAT(b, ctx->tmpbb);
+-                    e = APR_BRIGADE_FIRST(b);
++                /* Next read must block. */
++                eblock = APR_BLOCK_READ;
+ 
+-                    ctx->data_sent = 1;
+-                }
+-                eblock = APR_BLOCK_READ;
+-                continue;
++                /* Ensure the last bucket to pass down is a flush if
++                 * the next read will block. */
++                flush = apr_bucket_flush_create(f->c->bucket_alloc);
++                APR_BUCKET_INSERT_BEFORE(e, flush);
+             }
+-            else {
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
+-                              "ap_content_length_filter: "
+-                              "apr_bucket_read() failed");
+-                return rv;
+-            }
+         }
+-        else {
+-            r->bytes_sent += e->length;
++
++        /* Optimization: if the next bucket is EOS (directly after a
++         * bucket morphed to the heap, or a flush), short-cut to
++         * handle EOS straight away - allowing C-L to be determined
++         * for content which is already entirely in memory. */
++        if (e != APR_BRIGADE_SENTINEL(b) && APR_BUCKET_IS_EOS(e)) {
++            continue;
+         }
+-        e = APR_BUCKET_NEXT(e);
++
++        /* On reaching here, pass on everything in the brigade up to
++         * this point. */
++        apr_brigade_split_ex(b, e, ctx->tmpbb);
++        
++        rv = ap_pass_brigade(f->next, b);
++        if (rv != APR_SUCCESS) {
++            return rv;
++        }
++        else if (f->c->aborted) {
++            return APR_ECONNABORTED;
++        }
++        apr_brigade_cleanup(b);
++        APR_BRIGADE_CONCAT(b, ctx->tmpbb);
++        e = APR_BRIGADE_FIRST(b);
++        
++        ctx->data_sent = 1;
+     }
+ 
+     /* If we've now seen the entire response and it's otherwise
diff --git a/httpd.spec b/httpd.spec
index 0e25a2c..01beaf2 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 6%{?dist}
+Release: 7%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -72,6 +72,7 @@ Patch56: httpd-2.4.4-mod_unique_id.patch
 Patch57: httpd-2.4.10-sigint.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.25-r1738878.patch
+Patch59: httpd-2.4.27-r1808230.patch
 # Security fixes
 
 License: ASL 2.0
@@ -218,6 +219,7 @@ interface for storing and accessing per-user session data.
 %patch56 -p1 -b .uniqueid
 %patch57 -p1 -b .sigint
 %patch58 -p1 -b .r1738878
+%patch59 -p1 -b .r1808230
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -703,6 +705,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Sep 13 2017 Joe Orton <jorton@redhat.com> - 2.4.27-7
+- add new content-length filter (upstream PR 61222)
+
 * Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.27-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
 
diff --git a/pullrev.sh b/pullrev.sh
index d106968..c366613 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then
 fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
-repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.26
+#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+ver=2.4.27
 prefix="httpd-${ver}"
 suffix="r$1${2:++}"
 fn="${prefix}-${suffix}.patch"

From a7a88382f7efa6154d762b7a7a22fc7e4d057adb Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 10:02:32 +0100
Subject: [PATCH 011/359] move httpd.service.d, httpd.socket.d dirs to
 -filesystem

---
 httpd.spec | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 01beaf2..351c519 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 7%{?dist}
+Release: 8%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -642,8 +642,6 @@ rm -rf $RPM_BUILD_ROOT
 
 %{_unitdir}/*.service
 %{_unitdir}/*.socket
-%attr(755,root,root) %dir %{_unitdir}/httpd.service.d
-%attr(755,root,root) %dir %{_unitdir}/httpd.socket.d
 
 %files filesystem
 %dir %{_sysconfdir}/httpd
@@ -705,6 +703,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-8
+- move httpd.service.d, httpd.socket.d dirs to -filesystem
+
 * Wed Sep 13 2017 Joe Orton <jorton@redhat.com> - 2.4.27-7
 - add new content-length filter (upstream PR 61222)
 

From e2185159edf65e22614512636360186c986bdb99 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 10:08:07 +0100
Subject: [PATCH 012/359] move httpd.service.d, httpd.socket.d dirs to
 -filesystem

---
 httpd.spec | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/httpd.spec b/httpd.spec
index 351c519..dacd616 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -652,6 +652,8 @@ rm -rf $RPM_BUILD_ROOT
 %dir %{docroot}/html
 %dir %{contentdir}
 %dir %{contentdir}/icons
+%attr(755,root,root) %dir %{_unitdir}/httpd.service.d
+%attr(755,root,root) %dir %{_unitdir}/httpd.socket.d
 
 %files tools
 %defattr(-,root,root)

From d5e6805c2638b8419253e37b0647591e8e2b7ba6 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 12:36:38 +0100
Subject: [PATCH 013/359] Update links to Fedora home page.

---
 index.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/index.html b/index.html
index 943f060..1b7ea03 100644
--- a/index.html
+++ b/index.html
@@ -111,7 +111,7 @@
 					<li>Neither the Fedora Project or Red Hat has "hacked" this webserver, this test page is an included component of Apache's httpd webserver software.</li>
 					</ul>
 
-					<p>For more information about Fedora, please visit the <a href="http://fedoraproject.org/">Fedora Project website</a>.</p>
+					<p>For more information about Fedora, please visit the <a href="https://getfedora.org/">Fedora Project website</a>.</p>
 					<hr />
 				</div>
 
@@ -123,7 +123,7 @@
 					<div class="logos">
 						<p>You are free to use the images below on Apache and Fedora powered HTTP servers. Thanks for using Apache and Fedora!</p>
 
-						<p><a href="https://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="http://fedoraproject.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
+						<p><a href="https://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="https://getfedora.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
 					</div>
 				</div>
 			</div>

From 870b71c4f0c8e363d0e46c365f5d85fa76b62803 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 12:46:35 +0100
Subject: [PATCH 014/359] httpd.service(5) update: show how to ungracefully
 stop/restart

---
 httpd.service.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/httpd.service.xml b/httpd.service.xml
index d03e133..8f82e59 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -143,6 +143,11 @@ Wants=network-online.target</programlisting>
       which terminates the server only once active connections have
       been processed.</para>
 
+      <para>To "ungracefully" stop the server without waiting for
+      requests to complete, use <command>systemctl kill
+      --kill-who=main httpd</command>; similarly to "ungracefully"
+      reload the configuration, use <command>systemctl kill
+      --kill-who=main --signal=HUP httpd</command>.</para>
     </refsect2>
 
     <refsect2>

From 180ad320f452c4c58f6edc75a5749f665bf7459f Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Wed, 20 Sep 2017 14:18:24 -0400
Subject: [PATCH 015/359] Generate SSL keys on service start

This defers the creation of self-signed SSL certificates to the
first time that httpd starts up. This has several advantages:

* Waiting until the first boot will help avoid some issues with
  limited entropy in the install process.
* The certificates can be regenerated automatically whenever they
  are removed, which helps with tools such as virt-sysprep
* The certificates are now generated by SSCG, which produces a
  limited-trust CA alongside it that can be safely imported by a
  client.

For more information on SSCG, see:
https://sgallagh.wordpress.com/2016/05/02/self-signed-ssltls-certificates-why-they-are-terrible-and-a-better-alternative/

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
 httpd-init.service | 12 ++++++++++++
 httpd-ssl-gencerts | 24 +++++++++++++++++++++++
 httpd.service      |  3 ++-
 httpd.spec         | 49 +++++++++++++++-------------------------------
 ssl.conf           |  2 +-
 5 files changed, 55 insertions(+), 35 deletions(-)
 create mode 100644 httpd-init.service
 create mode 100755 httpd-ssl-gencerts

diff --git a/httpd-init.service b/httpd-init.service
new file mode 100644
index 0000000..05af86e
--- /dev/null
+++ b/httpd-init.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=One-time configuration for httpd.service
+
+ConditionPathExists=|!/etc/pki/tls/certs/localhost.crt
+ConditionPathExists=|!/etc/pki/tls/certs/localhost-ca.crt
+ConditionPathExists=|!/etc/pki/tls/private/localhost.key
+
+[Service]
+Type=oneshot
+RemainAfterExit=no
+
+ExecStart=/usr/libexec/httpd-ssl-gencerts
diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts
new file mode 100755
index 0000000..0771b73
--- /dev/null
+++ b/httpd-ssl-gencerts
@@ -0,0 +1,24 @@
+#!/usr/bin/bash
+
+set -e
+
+FQDN=`hostname`
+# A >59 char FQDN means "root@FQDN" exceeds 64-char max length for emailAddress
+if [ "x${FQDN}" = "x" -o ${#FQDN} -gt 59 ]; then
+   FQDN=localhost.localdomain
+fi
+
+sscg -q                                                             \
+     --cert-file           /etc/pki/tls/certs/localhost.crt         \
+     --cert-key-file       /etc/pki/tls/private/localhost.key       \
+     --ca-file             /etc/pki/tls/certs/localhost-ca.crt      \
+     --hash-alg            sha256                                   \
+     --key-strength        2048                                     \
+     --lifetime            365                                      \
+     --country             "--"                                     \
+     --state               SomeState                                \
+     --locality            SomeCity                                 \
+     --organization        SomeOrganization                         \
+     --organizational-unit SomeOrganizationalUnit                   \
+     --hostname            $FQDN                                    \
+     --email               root@$FQDN
diff --git a/httpd.service b/httpd.service
index 1b779e9..6ff4e8b 100644
--- a/httpd.service
+++ b/httpd.service
@@ -13,7 +13,8 @@
 
 [Unit]
 Description=The Apache HTTP Server
-After=network.target remote-fs.target nss-lookup.target
+Wants=httpd-init.service
+After=network.target remote-fs.target nss-lookup.target httpd-init.service
 Documentation=man:httpd.service(8)
 
 [Service]
diff --git a/httpd.spec b/httpd.spec
index dacd616..4073f37 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 8%{?dist}
+Release: 8.4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -48,6 +48,8 @@ Source31: README.confmod
 Source32: httpd.service.xml
 Source40: htcacheclean.service
 Source41: htcacheclean.sysconf
+Source42: httpd-init.service
+Source43: httpd-ssl-gencerts
 # build/scripts patches
 Patch1: httpd-2.4.1-apctl.patch
 Patch2: httpd-2.4.9-apxs.patch
@@ -155,6 +157,7 @@ BuildRequires: openssl-devel
 Requires(post): openssl, /bin/cat, hostname
 Requires(pre): httpd-filesystem
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+Requires: sscg >= 2.1.0
 Obsoletes: stronghold-mod_ssl
 # Require an OpenSSL which supports PROFILE=SYSTEM
 Conflicts: openssl-libs < 1:1.0.1h-4
@@ -303,7 +306,7 @@ make DESTDIR=$RPM_BUILD_ROOT install
 
 # Install systemd service files
 mkdir -p $RPM_BUILD_ROOT%{_unitdir}
-for s in httpd.service htcacheclean.service httpd.socket; do
+for s in httpd.service htcacheclean.service httpd.socket httpd-init.service; do
   install -p -m 644 $RPM_SOURCE_DIR/${s} \
                     $RPM_BUILD_ROOT%{_unitdir}/${s}
 done
@@ -432,6 +435,10 @@ mkdir -p $RPM_BUILD_ROOT%{_libexecdir}
 install -m755 $RPM_SOURCE_DIR/httpd-ssl-pass-dialog \
 	$RPM_BUILD_ROOT%{_libexecdir}/httpd-ssl-pass-dialog
 
+# install http-ssl-gencerts
+install -m755 $RPM_SOURCE_DIR/httpd-ssl-gencerts \
+	$RPM_BUILD_ROOT%{_libexecdir}/httpd-ssl-gencerts
+
 # Install action scripts
 mkdir -p $RPM_BUILD_ROOT%{_libexecdir}/initscripts/legacy-actions/httpd
 for f in graceful configtest; do
@@ -511,36 +518,6 @@ exit 0
 test -f /etc/sysconfig/httpd-disable-posttrans || \
   /bin/systemctl try-restart httpd.service htcacheclean.service >/dev/null 2>&1 || :
 
-%define sslcert %{_sysconfdir}/pki/tls/certs/localhost.crt
-%define sslkey %{_sysconfdir}/pki/tls/private/localhost.key
-
-%post -n mod_ssl
-umask 077
-
-if [ -f %{sslkey} -o -f %{sslcert} ]; then
-   exit 0
-fi
-
-%{_bindir}/openssl genrsa -rand /proc/apm:/proc/cpuinfo:/proc/dma:/proc/filesystems:/proc/interrupts:/proc/ioports:/proc/pci:/proc/rtc:/proc/uptime 2048 > %{sslkey} 2> /dev/null
-
-FQDN=`hostname`
-# A >59 char FQDN means "root@FQDN" exceeds 64-char max length for emailAddress
-if [ "x${FQDN}" = "x" -o ${#FQDN} -gt 59 ]; then
-   FQDN=localhost.localdomain
-fi
-
-cat << EOF | %{_bindir}/openssl req -new -key %{sslkey} \
-         -x509 -sha256 -days 365 -set_serial $RANDOM -extensions v3_req \
-         -out %{sslcert} 2>/dev/null
---
-SomeState
-SomeCity
-SomeOrganization
-SomeOrganizationalUnit
-${FQDN}
-root@${FQDN}
-EOF
-
 %check
 # Check the built modules are all PIC
 if readelf -d $RPM_BUILD_ROOT%{_libdir}/httpd/modules/*.so | grep TEXTREL; then
@@ -640,7 +617,8 @@ rm -rf $RPM_BUILD_ROOT
 
 %{_mandir}/man8/*
 
-%{_unitdir}/*.service
+%{_unitdir}/httpd.service
+%{_unitdir}/htcacheclean.service
 %{_unitdir}/*.socket
 
 %files filesystem
@@ -674,7 +652,9 @@ rm -rf $RPM_BUILD_ROOT
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-ssl.conf
 %config(noreplace) %{_sysconfdir}/httpd/conf.d/ssl.conf
 %attr(0700,apache,root) %dir %{_localstatedir}/cache/httpd/ssl
+%{_unitdir}/httpd-init.service
 %{_libexecdir}/httpd-ssl-pass-dialog
+%{_libexecdir}/httpd-ssl-gencerts
 %{_unitdir}/httpd.socket.d/10-listen443.conf
 
 %files -n mod_proxy_html
@@ -705,6 +685,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Sep 20 2017 Stephen Gallagher <sgallagh@redhat.com> - 2.4.27-8.1
+- Generate SSL certificates on service start, not %posttrans
+
 * Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-8
 - move httpd.service.d, httpd.socket.d dirs to -filesystem
 
diff --git a/ssl.conf b/ssl.conf
index a07bd8f..a2709ce 100644
--- a/ssl.conf
+++ b/ssl.conf
@@ -122,7 +122,7 @@ SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
 #   Set the CA certificate verification path where to find CA
 #   certificates for client authentication or alternatively one
 #   huge file containing all of them (file must be PEM encoded)
-#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
+SSLCACertificateFile /etc/pki/tls/certs/localhost-ca.crt
 
 #   Client Authentication (Type):
 #   Client certificate verification type and depth.  Types are

From 6a777617406defe19df7a85b86427f1f3e0c3384 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 21 Sep 2017 16:41:20 +0100
Subject: [PATCH 016/359] use sscg defaults; append CA cert to generated cert
 document httpd-init.service in httpd-init.service(8)

---
 httpd-init.service |  1 +
 httpd-ssl-gencerts | 18 ++++++++----------
 httpd.service.xml  | 16 ++++++++++++++++
 httpd.spec         | 10 ++++++++--
 ssl.conf           |  2 +-
 5 files changed, 34 insertions(+), 13 deletions(-)

diff --git a/httpd-init.service b/httpd-init.service
index 05af86e..e2e8dd6 100644
--- a/httpd-init.service
+++ b/httpd-init.service
@@ -1,5 +1,6 @@
 [Unit]
 Description=One-time configuration for httpd.service
+Documentation=man:httpd-init.service(8)
 
 ConditionPathExists=|!/etc/pki/tls/certs/localhost.crt
 ConditionPathExists=|!/etc/pki/tls/certs/localhost-ca.crt
diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts
index 0771b73..67b6d9a 100755
--- a/httpd-ssl-gencerts
+++ b/httpd-ssl-gencerts
@@ -3,22 +3,20 @@
 set -e
 
 FQDN=`hostname`
-# A >59 char FQDN means "root@FQDN" exceeds 64-char max length for emailAddress
-if [ "x${FQDN}" = "x" -o ${#FQDN} -gt 59 ]; then
-   FQDN=localhost.localdomain
+
+if test -f /etc/pki/tls/certs/localhost.crt -o \
+        -f /etc/pki/tls/private/localhost.key -o \
+        -f /etc/pki/tls/certs/localhost-ca.crt; then
+    exit 1
 fi
 
 sscg -q                                                             \
      --cert-file           /etc/pki/tls/certs/localhost.crt         \
      --cert-key-file       /etc/pki/tls/private/localhost.key       \
      --ca-file             /etc/pki/tls/certs/localhost-ca.crt      \
-     --hash-alg            sha256                                   \
-     --key-strength        2048                                     \
      --lifetime            365                                      \
-     --country             "--"                                     \
-     --state               SomeState                                \
-     --locality            SomeCity                                 \
-     --organization        SomeOrganization                         \
-     --organizational-unit SomeOrganizationalUnit                   \
      --hostname            $FQDN                                    \
      --email               root@$FQDN
+
+# mod_ssl will send the CA cert if it's appended to the server cert.
+cat /etc/pki/tls/certs/localhost-ca.crt >> /etc/pki/tls/certs/localhost.crt
diff --git a/httpd.service.xml b/httpd.service.xml
index 8f82e59..d851862 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -37,12 +37,14 @@
   <refnamediv>
     <refname>httpd.service</refname>
     <refname>httpd.socket</refname>
+    <refname>httpd-init.service</refname>
     <refpurpose>httpd unit files for systemd</refpurpose>
   </refnamediv>
 
   <refsynopsisdiv>
     <para>
       <filename>/usr/lib/systemd/system/httpd.service</filename>, 
+      <filename>/usr/lib/systemd/system/httpd-init.service</filename>,
       <filename>/usr/lib/systemd/system/httpd.socket</filename>
     </para>
   </refsynopsisdiv>
@@ -124,6 +126,20 @@ Wants=network-online.target</programlisting>
 
     </refsect2>
 
+    <refsect2>
+      <title>SSL/TLS certificate generation</title>
+
+      <para>The <command>httpd-init.service</command> unit is provided
+      with the mod_ssl package. This oneshot unit automatically
+      creates a TLS server certificate and key (using a generated
+      self-signed CA certificate and key) for testing purposes before
+      httpd is started. To inhibit certificate generation, use
+      <command>systemctl mask httpd-init.service</command> after
+      installing mod_ssl, and adjust the mod_ssl configuration to use
+      an appropriate certicate and key.</para>
+
+    </refsect2>
+
     <refsect2>
       <title>Reloading and stopping the service</title>
 
diff --git a/httpd.spec b/httpd.spec
index 4073f37..efff2c5 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 8.4%{?dist}
+Release: 9%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -452,7 +452,7 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.logrotate \
 	$RPM_BUILD_ROOT/etc/logrotate.d/httpd
 
 # Install systemd service man pages
-install -m 644 -p httpd.service.8 httpd.socket.8 \
+install -m 644 -p httpd.service.8 httpd-init.service.8 httpd.socket.8 \
         $RPM_BUILD_ROOT%{_mandir}/man8
 
 # fix man page paths
@@ -616,6 +616,7 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd/proxy
 
 %{_mandir}/man8/*
+%exclude %{_mandir}/man8/httpd-init.*
 
 %{_unitdir}/httpd.service
 %{_unitdir}/htcacheclean.service
@@ -656,6 +657,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/httpd-ssl-pass-dialog
 %{_libexecdir}/httpd-ssl-gencerts
 %{_unitdir}/httpd.socket.d/10-listen443.conf
+%{_mandir}/man8/httpd-init.*
 
 %files -n mod_proxy_html
 %defattr(-,root,root)
@@ -685,6 +687,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Sep 21 2017 Joe Orton <jorton@redhat.com> - 2.4.27-9
+- use sscg defaults; append CA cert to generated cert
+- document httpd-init.service in httpd-init.service(8)
+
 * Wed Sep 20 2017 Stephen Gallagher <sgallagh@redhat.com> - 2.4.27-8.1
 - Generate SSL certificates on service start, not %posttrans
 
diff --git a/ssl.conf b/ssl.conf
index a2709ce..a07bd8f 100644
--- a/ssl.conf
+++ b/ssl.conf
@@ -122,7 +122,7 @@ SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
 #   Set the CA certificate verification path where to find CA
 #   certificates for client authentication or alternatively one
 #   huge file containing all of them (file must be PEM encoded)
-SSLCACertificateFile /etc/pki/tls/certs/localhost-ca.crt
+#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
 
 #   Client Authentication (Type):
 #   Client certificate verification type and depth.  Types are

From 10a87792e56496e94cd11bcb4d44ee9561f07552 Mon Sep 17 00:00:00 2001
From: "Jeroen van Meeuwen (Ergo Project)"
 <jeroen.van.meeuwen@ergo-project.org>
Date: Thu, 21 Sep 2017 19:28:15 +0200
Subject: [PATCH 017/359] Address CVE-2017-9798 by applying upstream patch

Reference RHBZ #1490344
---
 httpd-2.4.27-CVE-2017-9798.patch | 15 +++++++++++++++
 httpd.spec                       | 11 ++++++++---
 2 files changed, 23 insertions(+), 3 deletions(-)
 create mode 100644 httpd-2.4.27-CVE-2017-9798.patch

diff --git a/httpd-2.4.27-CVE-2017-9798.patch b/httpd-2.4.27-CVE-2017-9798.patch
new file mode 100644
index 0000000..be590f2
--- /dev/null
+++ b/httpd-2.4.27-CVE-2017-9798.patch
@@ -0,0 +1,15 @@
+--- httpd/httpd/branches/2.4.x/server/core.c	2017/08/16 16:50:29	1805223
++++ httpd/httpd/branches/2.4.x/server/core.c	2017/09/08 13:13:11	1807754
+@@ -2266,6 +2266,12 @@
+             /* method has not been registered yet, but resource restriction
+              * is always checked before method handling, so register it.
+              */
++            if (cmd->pool == cmd->temp_pool) {
++                /* In .htaccess, we can't globally register new methods. */
++                return apr_psprintf(cmd->pool, "Could not register method '%s' "
++                                   "for %s from .htaccess configuration",
++                                    method, cmd->cmd->name);
++            }
+             methnum = ap_method_register(cmd->pool,
+                                          apr_pstrdup(cmd->pool, method));
+         }
diff --git a/httpd.spec b/httpd.spec
index efff2c5..65884a8 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 9%{?dist}
+Release: 10%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -74,7 +74,8 @@ Patch56: httpd-2.4.4-mod_unique_id.patch
 Patch57: httpd-2.4.10-sigint.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.25-r1738878.patch
-Patch59: httpd-2.4.27-r1808230.patch
+Patch59: httpd-2.4.27-CVE-2017-9798.patch
+Patch60: httpd-2.4.27-r1808230.patch
 # Security fixes
 
 License: ASL 2.0
@@ -222,7 +223,8 @@ interface for storing and accessing per-user session data.
 %patch56 -p1 -b .uniqueid
 %patch57 -p1 -b .sigint
 %patch58 -p1 -b .r1738878
-%patch59 -p1 -b .r1808230
+%patch59 -p4 -b .cve-2017-9798
+%patch60 -p1 -b .r1808230
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -687,6 +689,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-10
+- Address CVE-2017-9798 by applying patch from upstream (#1490344)
+
 * Thu Sep 21 2017 Joe Orton <jorton@redhat.com> - 2.4.27-9
 - use sscg defaults; append CA cert to generated cert
 - document httpd-init.service in httpd-init.service(8)

From fd03d5ee373e7683b56b9dcfa77e858f2a0b00e9 Mon Sep 17 00:00:00 2001
From: "Jeroen van Meeuwen (Ergo Project)"
 <jeroen.van.meeuwen@ergo-project.org>
Date: Thu, 21 Sep 2017 19:28:15 +0200
Subject: [PATCH 018/359] Address CVE-2017-9798 by applying upstream patch

Reference RHBZ #1490344
---
 httpd-2.4.27-CVE-2017-9798.patch | 15 +++++++++++++++
 httpd.spec                       | 11 ++++++++---
 2 files changed, 23 insertions(+), 3 deletions(-)
 create mode 100644 httpd-2.4.27-CVE-2017-9798.patch

diff --git a/httpd-2.4.27-CVE-2017-9798.patch b/httpd-2.4.27-CVE-2017-9798.patch
new file mode 100644
index 0000000..be590f2
--- /dev/null
+++ b/httpd-2.4.27-CVE-2017-9798.patch
@@ -0,0 +1,15 @@
+--- httpd/httpd/branches/2.4.x/server/core.c	2017/08/16 16:50:29	1805223
++++ httpd/httpd/branches/2.4.x/server/core.c	2017/09/08 13:13:11	1807754
+@@ -2266,6 +2266,12 @@
+             /* method has not been registered yet, but resource restriction
+              * is always checked before method handling, so register it.
+              */
++            if (cmd->pool == cmd->temp_pool) {
++                /* In .htaccess, we can't globally register new methods. */
++                return apr_psprintf(cmd->pool, "Could not register method '%s' "
++                                   "for %s from .htaccess configuration",
++                                    method, cmd->cmd->name);
++            }
+             methnum = ap_method_register(cmd->pool,
+                                          apr_pstrdup(cmd->pool, method));
+         }
diff --git a/httpd.spec b/httpd.spec
index 01beaf2..83665bd 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 7%{?dist}
+Release: 8%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -72,7 +72,8 @@ Patch56: httpd-2.4.4-mod_unique_id.patch
 Patch57: httpd-2.4.10-sigint.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.25-r1738878.patch
-Patch59: httpd-2.4.27-r1808230.patch
+Patch59: httpd-2.4.27-CVE-2017-9798.patch
+Patch60: httpd-2.4.27-r1808230.patch
 # Security fixes
 
 License: ASL 2.0
@@ -219,7 +220,8 @@ interface for storing and accessing per-user session data.
 %patch56 -p1 -b .uniqueid
 %patch57 -p1 -b .sigint
 %patch58 -p1 -b .r1738878
-%patch59 -p1 -b .r1808230
+%patch59 -p4 -b .cve-2017-9798
+%patch60 -p1 -b .r1808230
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -705,6 +707,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-8
+- Address CVE-2017-9798 by applying patch from upstream (#1490344)
+
 * Wed Sep 13 2017 Joe Orton <jorton@redhat.com> - 2.4.27-7
 - add new content-length filter (upstream PR 61222)
 

From 8953e641574976a5050d7da5ee3c88fb2c78ec21 Mon Sep 17 00:00:00 2001
From: "Jeroen van Meeuwen (Ergo Project)"
 <jeroen.van.meeuwen@ergo-project.org>
Date: Thu, 21 Sep 2017 19:28:15 +0200
Subject: [PATCH 019/359] Address CVE-2017-9798 by applying upstream patch

Reference RHBZ #1490344
---
 httpd-2.4.27-CVE-2017-9798.patch | 15 +++++++++++++++
 httpd.spec                       |  7 ++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.27-CVE-2017-9798.patch

diff --git a/httpd-2.4.27-CVE-2017-9798.patch b/httpd-2.4.27-CVE-2017-9798.patch
new file mode 100644
index 0000000..be590f2
--- /dev/null
+++ b/httpd-2.4.27-CVE-2017-9798.patch
@@ -0,0 +1,15 @@
+--- httpd/httpd/branches/2.4.x/server/core.c	2017/08/16 16:50:29	1805223
++++ httpd/httpd/branches/2.4.x/server/core.c	2017/09/08 13:13:11	1807754
+@@ -2266,6 +2266,12 @@
+             /* method has not been registered yet, but resource restriction
+              * is always checked before method handling, so register it.
+              */
++            if (cmd->pool == cmd->temp_pool) {
++                /* In .htaccess, we can't globally register new methods. */
++                return apr_psprintf(cmd->pool, "Could not register method '%s' "
++                                   "for %s from .htaccess configuration",
++                                    method, cmd->cmd->name);
++            }
+             methnum = ap_method_register(cmd->pool,
+                                          apr_pstrdup(cmd->pool, method));
+         }
diff --git a/httpd.spec b/httpd.spec
index 81f556e..29805bc 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,7 +8,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: http://httpd.apache.org/
 Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -67,6 +67,7 @@ Patch56: httpd-2.4.4-mod_unique_id.patch
 Patch57: httpd-2.4.10-sigint.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.25-r1738878.patch
+Patch59: httpd-2.4.27-CVE-2017-9798.patch
 # Security fixes
 
 License: ASL 2.0
@@ -213,6 +214,7 @@ interface for storing and accessing per-user session data.
 %patch56 -p1 -b .uniqueid
 %patch57 -p1 -b .sigint
 %patch58 -p1 -b .r1738878
+%patch59 -p4 -b .cve-2017-9798
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -692,6 +694,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-3
+- Address CVE-2017-9798 by applying patch from upstream (#1490344)
+
 * Wed Jul 12 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.27-2
 - Resolves: #1469959 - httpd update cleaned out /etc/sysconfig
 

From d614e8aa11f9520416f7ef10f93a29670efe1505 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Thu, 21 Sep 2017 14:55:16 -0400
Subject: [PATCH 020/359] Require sscg 2.2.0 for creating service and CA
 certificates together

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
 httpd-ssl-gencerts | 7 ++-----
 httpd.spec         | 7 +++++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts
index 67b6d9a..371a838 100755
--- a/httpd-ssl-gencerts
+++ b/httpd-ssl-gencerts
@@ -5,18 +5,15 @@ set -e
 FQDN=`hostname`
 
 if test -f /etc/pki/tls/certs/localhost.crt -o \
-        -f /etc/pki/tls/private/localhost.key -o \
-        -f /etc/pki/tls/certs/localhost-ca.crt; then
+        -f /etc/pki/tls/private/localhost.key; then
     exit 1
 fi
 
 sscg -q                                                             \
      --cert-file           /etc/pki/tls/certs/localhost.crt         \
      --cert-key-file       /etc/pki/tls/private/localhost.key       \
-     --ca-file             /etc/pki/tls/certs/localhost-ca.crt      \
+     --ca-file             /etc/pki/tls/certs/localhost.crt         \
      --lifetime            365                                      \
      --hostname            $FQDN                                    \
      --email               root@$FQDN
 
-# mod_ssl will send the CA cert if it's appended to the server cert.
-cat /etc/pki/tls/certs/localhost-ca.crt >> /etc/pki/tls/certs/localhost.crt
diff --git a/httpd.spec b/httpd.spec
index 65884a8..6cff5f7 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 10%{?dist}
+Release: 11%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -158,7 +158,7 @@ BuildRequires: openssl-devel
 Requires(post): openssl, /bin/cat, hostname
 Requires(pre): httpd-filesystem
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
-Requires: sscg >= 2.1.0
+Requires: sscg >= 2.2.0
 Obsoletes: stronghold-mod_ssl
 # Require an OpenSSL which supports PROFILE=SYSTEM
 Conflicts: openssl-libs < 1:1.0.1h-4
@@ -689,6 +689,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Sep 21 2017 Stephen Gallagher <sgallagh@redhat.com> - 2.4.27-11
+- Require sscg 2.2.0 for creating service and CA certificates together
+
 * Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-10
 - Address CVE-2017-9798 by applying patch from upstream (#1490344)
 

From ccd2dc5050cf444bd10c41d9b5c09e2a897f12a2 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 22 Sep 2017 08:03:13 +0100
Subject: [PATCH 021/359] Fix MPM defaults if building on RHEL, fix touch -r
 for 00-mpm.conf.

---
 httpd.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 65884a8..16c9dde 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -4,7 +4,7 @@
 %define mmn 20120211
 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits}
 %define vstring %(source /etc/os-release; echo ${REDHAT_SUPPORT_PRODUCT})
-%if 0%{?fedora} < 27
+%if 0%{?fedora} < 27 || %{?rhel} <= 7
 %global mpm prefork
 %else
 %global mpm event
@@ -329,7 +329,7 @@ done
 
 sed -i '/^#LoadModule mpm_%{mpm}_module /s/^#//' \
      $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/00-mpm.conf
-touch -r $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/00-mpm.conf \
+touch -r $RPM_SOURCE_DIR/00-mpm.conf \
      $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/00-mpm.conf
 
 # install systemd override drop directory

From 87cc93ad9657758149e241e00625016116e514e5 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 22 Sep 2017 08:04:10 +0100
Subject: [PATCH 022/359] Remove condition on localhost-ca.crt, tweak
 description.

---
 httpd-init.service | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/httpd-init.service b/httpd-init.service
index e2e8dd6..3074778 100644
--- a/httpd-init.service
+++ b/httpd-init.service
@@ -1,9 +1,8 @@
 [Unit]
-Description=One-time configuration for httpd.service
+Description=One-time temporary TLS key generation for httpd.service
 Documentation=man:httpd-init.service(8)
 
 ConditionPathExists=|!/etc/pki/tls/certs/localhost.crt
-ConditionPathExists=|!/etc/pki/tls/certs/localhost-ca.crt
 ConditionPathExists=|!/etc/pki/tls/private/localhost.key
 
 [Service]

From ad89c85e8be4a29f009ef87d7bad9f15c3008202 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 22 Sep 2017 08:04:57 +0100
Subject: [PATCH 023/359] Ignore more.

---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index e364382..29c6655 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,3 +28,5 @@ x86_64
 /httpd.service.8
 /httpd-2.4.26.tar.bz2
 /httpd-2.4.27.tar.bz2
+/httpd-*.tar.bz2
+/httpd*.8

From c094ba48271609ad5329c2bd04c276b011a639c5 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 22 Sep 2017 08:06:39 +0100
Subject: [PATCH 024/359] Fix conditional.

---
 httpd.spec | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index b887b03..c550a28 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -4,10 +4,10 @@
 %define mmn 20120211
 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits}
 %define vstring %(source /etc/os-release; echo ${REDHAT_SUPPORT_PRODUCT})
-%if 0%{?fedora} < 27 || %{?rhel} <= 7
-%global mpm prefork
-%else
+%if 0%{?fedora} > 26 || 0%{?rhel} > 7
 %global mpm event
+%else
+%global mpm prefork
 %endif
 
 Summary: Apache HTTP Server

From eec4cf442f96fabda35399b232ef5b5206e9901f Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Fri, 22 Sep 2017 10:29:43 -0400
Subject: [PATCH 025/359] Handle edge-cases in gencerts

Make sure that we exit with success if the files already exist and
that we exit with failure and a message if only one or the other
is present.
---
 httpd-ssl-gencerts | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts
index 371a838..22aece4 100755
--- a/httpd-ssl-gencerts
+++ b/httpd-ssl-gencerts
@@ -4,11 +4,24 @@ set -e
 
 FQDN=`hostname`
 
-if test -f /etc/pki/tls/certs/localhost.crt -o \
+if test -f /etc/pki/tls/certs/localhost.crt -a \
         -f /etc/pki/tls/private/localhost.key; then
+    exit 0
+fi
+
+if test -f /etc/pki/tls/certs/localhost.crt -a \
+        ! -f /etc/pki/tls/private/localhost.key; then
+    echo "Missing certificate key!"
     exit 1
 fi
 
+if test ! -f /etc/pki/tls/certs/localhost.crt -a \
+         -f /etc/pki/tls/private/localhost.key; then
+    echo "Missing certificate, but key is present!"
+    exit 1
+fi
+
+
 sscg -q                                                             \
      --cert-file           /etc/pki/tls/certs/localhost.crt         \
      --cert-key-file       /etc/pki/tls/private/localhost.key       \

From 962c8003312ff2f026e5855e536b3073062e0f01 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 22 Sep 2017 15:48:42 +0100
Subject: [PATCH 026/359] better error handling in httpd-ssl-gencerts
 (#1494556) Resolves: rhbz#1494556

---
 httpd-ssl-gencerts | 7 +++++++
 httpd.spec         | 5 ++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts
index 22aece4..350f5b5 100755
--- a/httpd-ssl-gencerts
+++ b/httpd-ssl-gencerts
@@ -3,6 +3,7 @@
 set -e
 
 FQDN=`hostname`
+ssldotconf=/etc/httpd/conf.d/ssl.conf
 
 if test -f /etc/pki/tls/certs/localhost.crt -a \
         -f /etc/pki/tls/private/localhost.key; then
@@ -21,6 +22,12 @@ if test ! -f /etc/pki/tls/certs/localhost.crt -a \
     exit 1
 fi
 
+if ! test -f ${ssldotconf} || \
+   ! grep -q '^SSLCertificateFile /etc/pki/tls/certs/localhost.crt' ${ssldotconf} || \
+   ! grep -q '^SSLCertificateKeyFile /etc/pki/tls/private/localhost.key' ${ssldotconf}; then
+    # Non-default configuration, do nothing.
+    exit 0
+fi
 
 sscg -q                                                             \
      --cert-file           /etc/pki/tls/certs/localhost.crt         \
diff --git a/httpd.spec b/httpd.spec
index c550a28..51f4084 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 11%{?dist}
+Release: 12%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -689,6 +689,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Sep 22 2017 Joe Orton <jorton@redhat.com> - 2.4.27-12
+- better error handling in httpd-ssl-gencerts (#1494556)
+
 * Thu Sep 21 2017 Stephen Gallagher <sgallagh@redhat.com> - 2.4.27-11
 - Require sscg 2.2.0 for creating service and CA certificates together
 

From d31ea66d9d9bfa62d3aae8b4ee0f390134dc89d1 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 22 Sep 2017 16:20:54 +0100
Subject: [PATCH 027/359] drop Requires(post) for mod_ssl

---
 httpd.spec | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 51f4084..6f14798 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 12%{?dist}
+Release: 13%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -155,7 +155,6 @@ Group: System Environment/Daemons
 Summary: SSL/TLS module for the Apache HTTP Server
 Epoch: 1
 BuildRequires: openssl-devel
-Requires(post): openssl, /bin/cat, hostname
 Requires(pre): httpd-filesystem
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 Requires: sscg >= 2.2.0
@@ -689,6 +688,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Sep 22 2017 Joe Orton <jorton@redhat.com> - 2.4.27-13
+- drop Requires(post) for mod_ssl
+
 * Fri Sep 22 2017 Joe Orton <jorton@redhat.com> - 2.4.27-12
 - better error handling in httpd-ssl-gencerts (#1494556)
 

From 6d96e6a1937ef08901638b1500498b49321d3d33 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 3 Oct 2017 09:16:29 +0100
Subject: [PATCH 028/359] add notes on enabling httpd_graceful_shutdown boolean
 for prefork

---
 00-mpm.conf       |  8 ++++++--
 httpd.service.xml | 18 ++++++++++++++++++
 httpd.spec        | 10 ++++++++--
 3 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/00-mpm.conf b/00-mpm.conf
index 75d90e9..b15f913 100644
--- a/00-mpm.conf
+++ b/00-mpm.conf
@@ -1,8 +1,13 @@
 # Select the MPM module which should be used by uncommenting exactly
-# one of the following LoadModule lines:
+# one of the following LoadModule lines.  See the httpd.service(8) man
+# page for more information on changing the MPM.
 
 # prefork MPM: Implements a non-threaded, pre-forking web server
 # See: http://httpd.apache.org/docs/2.4/mod/prefork.html
+#
+# NOTE: If enabling prefork, the httpd_graceful_shutdown SELinux
+# boolean should be enabled, to allow graceful stop/shutdown.
+#
 #LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
 
 # worker MPM: Multi-Processing Module implementing a hybrid
@@ -16,4 +21,3 @@
 # See: http://httpd.apache.org/docs/2.4/mod/event.html
 #
 #LoadModule mpm_event_module modules/mod_mpm_event.so
-
diff --git a/httpd.service.xml b/httpd.service.xml
index d851862..4402ed5 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -166,6 +166,24 @@ Wants=network-online.target</programlisting>
       --kill-who=main --signal=HUP httpd</command>.</para>
     </refsect2>
 
+    <refsect2>
+      <title>Changing the default MPM (Multi-Processing Module)</title>
+
+      <para>httpd offers a choice of multi-processing modules (MPMs),
+      which can be configured in
+      <filename>/etc/httpd/conf.modules.d/00-mpm.conf</filename>.  The
+      default is to use the <emphasis>@MPM@</emphasis> MPM.</para>
+
+      <para>If using the <emphasis>prefork</emphasis> MPM, the
+      "httpd_graceful_shutdown" SELinux boolean should also be
+      enabled, since with this MPM, httpd needs to establish TCP
+      connections to local ports to successfully complete a graceful
+      restart or shutdown. This boolean can be enabled by running the
+      command: <command>semanage boolean -m --on
+      httpd_graceful_shutdown</command></para>
+
+    </refsect2>
+
     <refsect2>
       <title>systemd integration and mod_systemd</title>
 
diff --git a/httpd.spec b/httpd.spec
index 6f14798..e9e4319 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 13%{?dist}
+Release: 14%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -239,7 +239,10 @@ if test "x${vmmn}" != "x%{mmn}"; then
    exit 1
 fi
 
-xmlto man $RPM_SOURCE_DIR/httpd.service.xml
+sed 's/@MPM@/%{mpm}/' < $RPM_SOURCE_DIR/httpd.service.xml \
+    > httpd.service.xml
+
+xmlto man ./httpd.service.xml
 
 : Building with MMN %{mmn}, MMN-ISA %{mmnisa}
 : Default MPM is %{mpm}, vendor string is '%{vstring}'
@@ -688,6 +691,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Oct  3 2017 Joe Orton <jorton@redhat.com> - 2.4.27-14
+- add notes on enabling httpd_graceful_shutdown boolean for prefork
+
 * Fri Sep 22 2017 Joe Orton <jorton@redhat.com> - 2.4.27-13
 - drop Requires(post) for mod_ssl
 

From abf387add27f77159ac674a0ef544d39a0e0551c Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 10:02:32 +0100
Subject: [PATCH 029/359] move httpd.service.d, httpd.socket.d dirs to
 -filesystem

---
 httpd.spec | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 83665bd..a4cf2f7 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -644,8 +644,6 @@ rm -rf $RPM_BUILD_ROOT
 
 %{_unitdir}/*.service
 %{_unitdir}/*.socket
-%attr(755,root,root) %dir %{_unitdir}/httpd.service.d
-%attr(755,root,root) %dir %{_unitdir}/httpd.socket.d
 
 %files filesystem
 %dir %{_sysconfdir}/httpd
@@ -707,6 +705,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-8.1
+- move httpd.service.d, httpd.socket.d dirs to -filesystem
+
 * Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-8
 - Address CVE-2017-9798 by applying patch from upstream (#1490344)
 

From 8b3e8259a700bed4a285b5851a0ab6b6f8043582 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 10:08:07 +0100
Subject: [PATCH 030/359] move httpd.service.d, httpd.socket.d dirs to
 -filesystem

---
 httpd.spec | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/httpd.spec b/httpd.spec
index a4cf2f7..aa9b322 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -654,6 +654,8 @@ rm -rf $RPM_BUILD_ROOT
 %dir %{docroot}/html
 %dir %{contentdir}
 %dir %{contentdir}/icons
+%attr(755,root,root) %dir %{_unitdir}/httpd.service.d
+%attr(755,root,root) %dir %{_unitdir}/httpd.socket.d
 
 %files tools
 %defattr(-,root,root)

From 5c1fc79a5ad6cdd17c0284d4452baddc147d246c Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 12:36:38 +0100
Subject: [PATCH 031/359] Update links to Fedora home page.

---
 index.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/index.html b/index.html
index 943f060..1b7ea03 100644
--- a/index.html
+++ b/index.html
@@ -111,7 +111,7 @@
 					<li>Neither the Fedora Project or Red Hat has "hacked" this webserver, this test page is an included component of Apache's httpd webserver software.</li>
 					</ul>
 
-					<p>For more information about Fedora, please visit the <a href="http://fedoraproject.org/">Fedora Project website</a>.</p>
+					<p>For more information about Fedora, please visit the <a href="https://getfedora.org/">Fedora Project website</a>.</p>
 					<hr />
 				</div>
 
@@ -123,7 +123,7 @@
 					<div class="logos">
 						<p>You are free to use the images below on Apache and Fedora powered HTTP servers. Thanks for using Apache and Fedora!</p>
 
-						<p><a href="https://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="http://fedoraproject.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
+						<p><a href="https://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="https://getfedora.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
 					</div>
 				</div>
 			</div>

From e5ce62e7b4f4f2f1a8684cedaadcb6c12da1f437 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 12:46:35 +0100
Subject: [PATCH 032/359] httpd.service(5) update: show how to ungracefully
 stop/restart

---
 httpd.service.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/httpd.service.xml b/httpd.service.xml
index d03e133..8f82e59 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -143,6 +143,11 @@ Wants=network-online.target</programlisting>
       which terminates the server only once active connections have
       been processed.</para>
 
+      <para>To "ungracefully" stop the server without waiting for
+      requests to complete, use <command>systemctl kill
+      --kill-who=main httpd</command>; similarly to "ungracefully"
+      reload the configuration, use <command>systemctl kill
+      --kill-who=main --signal=HUP httpd</command>.</para>
     </refsect2>
 
     <refsect2>

From f0c4143d9826300a6cbe954bd85d7bba4e2d1b67 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Wed, 20 Sep 2017 14:18:24 -0400
Subject: [PATCH 033/359] Generate SSL keys on service start

This defers the creation of self-signed SSL certificates to the
first time that httpd starts up. This has several advantages:

* Waiting until the first boot will help avoid some issues with
  limited entropy in the install process.
* The certificates can be regenerated automatically whenever they
  are removed, which helps with tools such as virt-sysprep
* The certificates are now generated by SSCG, which produces a
  limited-trust CA alongside it that can be safely imported by a
  client.

For more information on SSCG, see:
https://sgallagh.wordpress.com/2016/05/02/self-signed-ssltls-certificates-why-they-are-terrible-and-a-better-alternative/

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
 httpd-init.service | 12 ++++++++++++
 httpd-ssl-gencerts | 24 +++++++++++++++++++++++
 httpd.service      |  3 ++-
 httpd.spec         | 49 +++++++++++++++-------------------------------
 ssl.conf           |  2 +-
 5 files changed, 55 insertions(+), 35 deletions(-)
 create mode 100644 httpd-init.service
 create mode 100755 httpd-ssl-gencerts

diff --git a/httpd-init.service b/httpd-init.service
new file mode 100644
index 0000000..05af86e
--- /dev/null
+++ b/httpd-init.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=One-time configuration for httpd.service
+
+ConditionPathExists=|!/etc/pki/tls/certs/localhost.crt
+ConditionPathExists=|!/etc/pki/tls/certs/localhost-ca.crt
+ConditionPathExists=|!/etc/pki/tls/private/localhost.key
+
+[Service]
+Type=oneshot
+RemainAfterExit=no
+
+ExecStart=/usr/libexec/httpd-ssl-gencerts
diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts
new file mode 100755
index 0000000..0771b73
--- /dev/null
+++ b/httpd-ssl-gencerts
@@ -0,0 +1,24 @@
+#!/usr/bin/bash
+
+set -e
+
+FQDN=`hostname`
+# A >59 char FQDN means "root@FQDN" exceeds 64-char max length for emailAddress
+if [ "x${FQDN}" = "x" -o ${#FQDN} -gt 59 ]; then
+   FQDN=localhost.localdomain
+fi
+
+sscg -q                                                             \
+     --cert-file           /etc/pki/tls/certs/localhost.crt         \
+     --cert-key-file       /etc/pki/tls/private/localhost.key       \
+     --ca-file             /etc/pki/tls/certs/localhost-ca.crt      \
+     --hash-alg            sha256                                   \
+     --key-strength        2048                                     \
+     --lifetime            365                                      \
+     --country             "--"                                     \
+     --state               SomeState                                \
+     --locality            SomeCity                                 \
+     --organization        SomeOrganization                         \
+     --organizational-unit SomeOrganizationalUnit                   \
+     --hostname            $FQDN                                    \
+     --email               root@$FQDN
diff --git a/httpd.service b/httpd.service
index 1b779e9..6ff4e8b 100644
--- a/httpd.service
+++ b/httpd.service
@@ -13,7 +13,8 @@
 
 [Unit]
 Description=The Apache HTTP Server
-After=network.target remote-fs.target nss-lookup.target
+Wants=httpd-init.service
+After=network.target remote-fs.target nss-lookup.target httpd-init.service
 Documentation=man:httpd.service(8)
 
 [Service]
diff --git a/httpd.spec b/httpd.spec
index aa9b322..717e321 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 8%{?dist}
+Release: 8.4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -48,6 +48,8 @@ Source31: README.confmod
 Source32: httpd.service.xml
 Source40: htcacheclean.service
 Source41: htcacheclean.sysconf
+Source42: httpd-init.service
+Source43: httpd-ssl-gencerts
 # build/scripts patches
 Patch1: httpd-2.4.1-apctl.patch
 Patch2: httpd-2.4.9-apxs.patch
@@ -156,6 +158,7 @@ BuildRequires: openssl-devel
 Requires(post): openssl, /bin/cat, hostname
 Requires(pre): httpd-filesystem
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+Requires: sscg >= 2.1.0
 Obsoletes: stronghold-mod_ssl
 # Require an OpenSSL which supports PROFILE=SYSTEM
 Conflicts: openssl-libs < 1:1.0.1h-4
@@ -305,7 +308,7 @@ make DESTDIR=$RPM_BUILD_ROOT install
 
 # Install systemd service files
 mkdir -p $RPM_BUILD_ROOT%{_unitdir}
-for s in httpd.service htcacheclean.service httpd.socket; do
+for s in httpd.service htcacheclean.service httpd.socket httpd-init.service; do
   install -p -m 644 $RPM_SOURCE_DIR/${s} \
                     $RPM_BUILD_ROOT%{_unitdir}/${s}
 done
@@ -434,6 +437,10 @@ mkdir -p $RPM_BUILD_ROOT%{_libexecdir}
 install -m755 $RPM_SOURCE_DIR/httpd-ssl-pass-dialog \
 	$RPM_BUILD_ROOT%{_libexecdir}/httpd-ssl-pass-dialog
 
+# install http-ssl-gencerts
+install -m755 $RPM_SOURCE_DIR/httpd-ssl-gencerts \
+	$RPM_BUILD_ROOT%{_libexecdir}/httpd-ssl-gencerts
+
 # Install action scripts
 mkdir -p $RPM_BUILD_ROOT%{_libexecdir}/initscripts/legacy-actions/httpd
 for f in graceful configtest; do
@@ -513,36 +520,6 @@ exit 0
 test -f /etc/sysconfig/httpd-disable-posttrans || \
   /bin/systemctl try-restart httpd.service htcacheclean.service >/dev/null 2>&1 || :
 
-%define sslcert %{_sysconfdir}/pki/tls/certs/localhost.crt
-%define sslkey %{_sysconfdir}/pki/tls/private/localhost.key
-
-%post -n mod_ssl
-umask 077
-
-if [ -f %{sslkey} -o -f %{sslcert} ]; then
-   exit 0
-fi
-
-%{_bindir}/openssl genrsa -rand /proc/apm:/proc/cpuinfo:/proc/dma:/proc/filesystems:/proc/interrupts:/proc/ioports:/proc/pci:/proc/rtc:/proc/uptime 2048 > %{sslkey} 2> /dev/null
-
-FQDN=`hostname`
-# A >59 char FQDN means "root@FQDN" exceeds 64-char max length for emailAddress
-if [ "x${FQDN}" = "x" -o ${#FQDN} -gt 59 ]; then
-   FQDN=localhost.localdomain
-fi
-
-cat << EOF | %{_bindir}/openssl req -new -key %{sslkey} \
-         -x509 -sha256 -days 365 -set_serial $RANDOM -extensions v3_req \
-         -out %{sslcert} 2>/dev/null
---
-SomeState
-SomeCity
-SomeOrganization
-SomeOrganizationalUnit
-${FQDN}
-root@${FQDN}
-EOF
-
 %check
 # Check the built modules are all PIC
 if readelf -d $RPM_BUILD_ROOT%{_libdir}/httpd/modules/*.so | grep TEXTREL; then
@@ -642,7 +619,8 @@ rm -rf $RPM_BUILD_ROOT
 
 %{_mandir}/man8/*
 
-%{_unitdir}/*.service
+%{_unitdir}/httpd.service
+%{_unitdir}/htcacheclean.service
 %{_unitdir}/*.socket
 
 %files filesystem
@@ -676,7 +654,9 @@ rm -rf $RPM_BUILD_ROOT
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-ssl.conf
 %config(noreplace) %{_sysconfdir}/httpd/conf.d/ssl.conf
 %attr(0700,apache,root) %dir %{_localstatedir}/cache/httpd/ssl
+%{_unitdir}/httpd-init.service
 %{_libexecdir}/httpd-ssl-pass-dialog
+%{_libexecdir}/httpd-ssl-gencerts
 %{_unitdir}/httpd.socket.d/10-listen443.conf
 
 %files -n mod_proxy_html
@@ -707,6 +687,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Sep 20 2017 Stephen Gallagher <sgallagh@redhat.com> - 2.4.27-8.1
+- Generate SSL certificates on service start, not %posttrans
+
 * Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-8.1
 - move httpd.service.d, httpd.socket.d dirs to -filesystem
 
diff --git a/ssl.conf b/ssl.conf
index a07bd8f..a2709ce 100644
--- a/ssl.conf
+++ b/ssl.conf
@@ -122,7 +122,7 @@ SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
 #   Set the CA certificate verification path where to find CA
 #   certificates for client authentication or alternatively one
 #   huge file containing all of them (file must be PEM encoded)
-#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
+SSLCACertificateFile /etc/pki/tls/certs/localhost-ca.crt
 
 #   Client Authentication (Type):
 #   Client certificate verification type and depth.  Types are

From 45393c8877e0cbcde302d5bc21d3d69557434e00 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 21 Sep 2017 16:41:20 +0100
Subject: [PATCH 034/359] use sscg defaults; append CA cert to generated cert
 document httpd-init.service in httpd-init.service(8)

---
 httpd-init.service |  1 +
 httpd-ssl-gencerts | 18 ++++++++----------
 httpd.service.xml  | 16 ++++++++++++++++
 httpd.spec         | 10 ++++++++--
 ssl.conf           |  2 +-
 5 files changed, 34 insertions(+), 13 deletions(-)

diff --git a/httpd-init.service b/httpd-init.service
index 05af86e..e2e8dd6 100644
--- a/httpd-init.service
+++ b/httpd-init.service
@@ -1,5 +1,6 @@
 [Unit]
 Description=One-time configuration for httpd.service
+Documentation=man:httpd-init.service(8)
 
 ConditionPathExists=|!/etc/pki/tls/certs/localhost.crt
 ConditionPathExists=|!/etc/pki/tls/certs/localhost-ca.crt
diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts
index 0771b73..67b6d9a 100755
--- a/httpd-ssl-gencerts
+++ b/httpd-ssl-gencerts
@@ -3,22 +3,20 @@
 set -e
 
 FQDN=`hostname`
-# A >59 char FQDN means "root@FQDN" exceeds 64-char max length for emailAddress
-if [ "x${FQDN}" = "x" -o ${#FQDN} -gt 59 ]; then
-   FQDN=localhost.localdomain
+
+if test -f /etc/pki/tls/certs/localhost.crt -o \
+        -f /etc/pki/tls/private/localhost.key -o \
+        -f /etc/pki/tls/certs/localhost-ca.crt; then
+    exit 1
 fi
 
 sscg -q                                                             \
      --cert-file           /etc/pki/tls/certs/localhost.crt         \
      --cert-key-file       /etc/pki/tls/private/localhost.key       \
      --ca-file             /etc/pki/tls/certs/localhost-ca.crt      \
-     --hash-alg            sha256                                   \
-     --key-strength        2048                                     \
      --lifetime            365                                      \
-     --country             "--"                                     \
-     --state               SomeState                                \
-     --locality            SomeCity                                 \
-     --organization        SomeOrganization                         \
-     --organizational-unit SomeOrganizationalUnit                   \
      --hostname            $FQDN                                    \
      --email               root@$FQDN
+
+# mod_ssl will send the CA cert if it's appended to the server cert.
+cat /etc/pki/tls/certs/localhost-ca.crt >> /etc/pki/tls/certs/localhost.crt
diff --git a/httpd.service.xml b/httpd.service.xml
index 8f82e59..d851862 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -37,12 +37,14 @@
   <refnamediv>
     <refname>httpd.service</refname>
     <refname>httpd.socket</refname>
+    <refname>httpd-init.service</refname>
     <refpurpose>httpd unit files for systemd</refpurpose>
   </refnamediv>
 
   <refsynopsisdiv>
     <para>
       <filename>/usr/lib/systemd/system/httpd.service</filename>, 
+      <filename>/usr/lib/systemd/system/httpd-init.service</filename>,
       <filename>/usr/lib/systemd/system/httpd.socket</filename>
     </para>
   </refsynopsisdiv>
@@ -124,6 +126,20 @@ Wants=network-online.target</programlisting>
 
     </refsect2>
 
+    <refsect2>
+      <title>SSL/TLS certificate generation</title>
+
+      <para>The <command>httpd-init.service</command> unit is provided
+      with the mod_ssl package. This oneshot unit automatically
+      creates a TLS server certificate and key (using a generated
+      self-signed CA certificate and key) for testing purposes before
+      httpd is started. To inhibit certificate generation, use
+      <command>systemctl mask httpd-init.service</command> after
+      installing mod_ssl, and adjust the mod_ssl configuration to use
+      an appropriate certicate and key.</para>
+
+    </refsect2>
+
     <refsect2>
       <title>Reloading and stopping the service</title>
 
diff --git a/httpd.spec b/httpd.spec
index 717e321..cccea46 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 8.4%{?dist}
+Release: 9%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -454,7 +454,7 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.logrotate \
 	$RPM_BUILD_ROOT/etc/logrotate.d/httpd
 
 # Install systemd service man pages
-install -m 644 -p httpd.service.8 httpd.socket.8 \
+install -m 644 -p httpd.service.8 httpd-init.service.8 httpd.socket.8 \
         $RPM_BUILD_ROOT%{_mandir}/man8
 
 # fix man page paths
@@ -618,6 +618,7 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd/proxy
 
 %{_mandir}/man8/*
+%exclude %{_mandir}/man8/httpd-init.*
 
 %{_unitdir}/httpd.service
 %{_unitdir}/htcacheclean.service
@@ -658,6 +659,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/httpd-ssl-pass-dialog
 %{_libexecdir}/httpd-ssl-gencerts
 %{_unitdir}/httpd.socket.d/10-listen443.conf
+%{_mandir}/man8/httpd-init.*
 
 %files -n mod_proxy_html
 %defattr(-,root,root)
@@ -687,6 +689,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Sep 21 2017 Joe Orton <jorton@redhat.com> - 2.4.27-9
+- use sscg defaults; append CA cert to generated cert
+- document httpd-init.service in httpd-init.service(8)
+
 * Wed Sep 20 2017 Stephen Gallagher <sgallagh@redhat.com> - 2.4.27-8.1
 - Generate SSL certificates on service start, not %posttrans
 
diff --git a/ssl.conf b/ssl.conf
index a2709ce..a07bd8f 100644
--- a/ssl.conf
+++ b/ssl.conf
@@ -122,7 +122,7 @@ SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
 #   Set the CA certificate verification path where to find CA
 #   certificates for client authentication or alternatively one
 #   huge file containing all of them (file must be PEM encoded)
-SSLCACertificateFile /etc/pki/tls/certs/localhost-ca.crt
+#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
 
 #   Client Authentication (Type):
 #   Client certificate verification type and depth.  Types are

From b20eb973912f8d18a0f110c65ce3ab20edd7e812 Mon Sep 17 00:00:00 2001
From: "Jeroen van Meeuwen (Ergo Project)"
 <jeroen.van.meeuwen@ergo-project.org>
Date: Thu, 21 Sep 2017 19:28:15 +0200
Subject: [PATCH 035/359] Address CVE-2017-9798 by applying upstream patch

Reference RHBZ #1490344
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index cccea46..4ae6c7b 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 9%{?dist}
+Release: 10%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -689,6 +689,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-10
+- Address CVE-2017-9798 by applying patch from upstream (#1490344)
+
 * Thu Sep 21 2017 Joe Orton <jorton@redhat.com> - 2.4.27-9
 - use sscg defaults; append CA cert to generated cert
 - document httpd-init.service in httpd-init.service(8)

From 76ede692d89a4ed26076aaa46aa948d53f415947 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Thu, 21 Sep 2017 14:55:16 -0400
Subject: [PATCH 036/359] Require sscg 2.2.0 for creating service and CA
 certificates together

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
 httpd-ssl-gencerts | 7 ++-----
 httpd.spec         | 7 +++++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts
index 67b6d9a..371a838 100755
--- a/httpd-ssl-gencerts
+++ b/httpd-ssl-gencerts
@@ -5,18 +5,15 @@ set -e
 FQDN=`hostname`
 
 if test -f /etc/pki/tls/certs/localhost.crt -o \
-        -f /etc/pki/tls/private/localhost.key -o \
-        -f /etc/pki/tls/certs/localhost-ca.crt; then
+        -f /etc/pki/tls/private/localhost.key; then
     exit 1
 fi
 
 sscg -q                                                             \
      --cert-file           /etc/pki/tls/certs/localhost.crt         \
      --cert-key-file       /etc/pki/tls/private/localhost.key       \
-     --ca-file             /etc/pki/tls/certs/localhost-ca.crt      \
+     --ca-file             /etc/pki/tls/certs/localhost.crt         \
      --lifetime            365                                      \
      --hostname            $FQDN                                    \
      --email               root@$FQDN
 
-# mod_ssl will send the CA cert if it's appended to the server cert.
-cat /etc/pki/tls/certs/localhost-ca.crt >> /etc/pki/tls/certs/localhost.crt
diff --git a/httpd.spec b/httpd.spec
index 4ae6c7b..b5282ca 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 10%{?dist}
+Release: 11%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -158,7 +158,7 @@ BuildRequires: openssl-devel
 Requires(post): openssl, /bin/cat, hostname
 Requires(pre): httpd-filesystem
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
-Requires: sscg >= 2.1.0
+Requires: sscg >= 2.2.0
 Obsoletes: stronghold-mod_ssl
 # Require an OpenSSL which supports PROFILE=SYSTEM
 Conflicts: openssl-libs < 1:1.0.1h-4
@@ -689,6 +689,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Sep 21 2017 Stephen Gallagher <sgallagh@redhat.com> - 2.4.27-11
+- Require sscg 2.2.0 for creating service and CA certificates together
+
 * Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-10
 - Address CVE-2017-9798 by applying patch from upstream (#1490344)
 

From 74a4babeac2a6c4e82ba4697f927f397f6a40859 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 22 Sep 2017 08:03:13 +0100
Subject: [PATCH 037/359] Fix MPM defaults if building on RHEL, fix touch -r
 for 00-mpm.conf.

---
 httpd.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index b5282ca..b364001 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -4,7 +4,7 @@
 %define mmn 20120211
 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits}
 %define vstring %(source /etc/os-release; echo ${REDHAT_SUPPORT_PRODUCT})
-%if 0%{?fedora} < 27
+%if 0%{?fedora} < 27 || %{?rhel} <= 7
 %global mpm prefork
 %else
 %global mpm event
@@ -329,7 +329,7 @@ done
 
 sed -i '/^#LoadModule mpm_%{mpm}_module /s/^#//' \
      $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/00-mpm.conf
-touch -r $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/00-mpm.conf \
+touch -r $RPM_SOURCE_DIR/00-mpm.conf \
      $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/00-mpm.conf
 
 # install systemd override drop directory

From 41a6265259db5ed41f72308944652fe3af30221a Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 22 Sep 2017 08:04:10 +0100
Subject: [PATCH 038/359] Remove condition on localhost-ca.crt, tweak
 description.

---
 httpd-init.service | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/httpd-init.service b/httpd-init.service
index e2e8dd6..3074778 100644
--- a/httpd-init.service
+++ b/httpd-init.service
@@ -1,9 +1,8 @@
 [Unit]
-Description=One-time configuration for httpd.service
+Description=One-time temporary TLS key generation for httpd.service
 Documentation=man:httpd-init.service(8)
 
 ConditionPathExists=|!/etc/pki/tls/certs/localhost.crt
-ConditionPathExists=|!/etc/pki/tls/certs/localhost-ca.crt
 ConditionPathExists=|!/etc/pki/tls/private/localhost.key
 
 [Service]

From 1f4f47bb29100309aa6e288311820fc58102e992 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 22 Sep 2017 08:04:57 +0100
Subject: [PATCH 039/359] Ignore more.

---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index e364382..29c6655 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,3 +28,5 @@ x86_64
 /httpd.service.8
 /httpd-2.4.26.tar.bz2
 /httpd-2.4.27.tar.bz2
+/httpd-*.tar.bz2
+/httpd*.8

From 140992d5b15dfc76bf207df7841fde1d33501f9d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 22 Sep 2017 08:06:39 +0100
Subject: [PATCH 040/359] Fix conditional.

---
 httpd.spec | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index b364001..b67946e 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -4,10 +4,10 @@
 %define mmn 20120211
 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits}
 %define vstring %(source /etc/os-release; echo ${REDHAT_SUPPORT_PRODUCT})
-%if 0%{?fedora} < 27 || %{?rhel} <= 7
-%global mpm prefork
-%else
+%if 0%{?fedora} > 26 || 0%{?rhel} > 7
 %global mpm event
+%else
+%global mpm prefork
 %endif
 
 Summary: Apache HTTP Server

From 2038991f8c6d3db4a8f650195538a66a41f9f751 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Fri, 22 Sep 2017 10:29:43 -0400
Subject: [PATCH 041/359] Handle edge-cases in gencerts

Make sure that we exit with success if the files already exist and
that we exit with failure and a message if only one or the other
is present.
---
 httpd-ssl-gencerts | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts
index 371a838..22aece4 100755
--- a/httpd-ssl-gencerts
+++ b/httpd-ssl-gencerts
@@ -4,11 +4,24 @@ set -e
 
 FQDN=`hostname`
 
-if test -f /etc/pki/tls/certs/localhost.crt -o \
+if test -f /etc/pki/tls/certs/localhost.crt -a \
         -f /etc/pki/tls/private/localhost.key; then
+    exit 0
+fi
+
+if test -f /etc/pki/tls/certs/localhost.crt -a \
+        ! -f /etc/pki/tls/private/localhost.key; then
+    echo "Missing certificate key!"
     exit 1
 fi
 
+if test ! -f /etc/pki/tls/certs/localhost.crt -a \
+         -f /etc/pki/tls/private/localhost.key; then
+    echo "Missing certificate, but key is present!"
+    exit 1
+fi
+
+
 sscg -q                                                             \
      --cert-file           /etc/pki/tls/certs/localhost.crt         \
      --cert-key-file       /etc/pki/tls/private/localhost.key       \

From 10e930c7445a425f43959aa0ffdec3a2f87466db Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 22 Sep 2017 15:48:42 +0100
Subject: [PATCH 042/359] better error handling in httpd-ssl-gencerts
 (#1494556) Resolves: rhbz#1494556

---
 httpd-ssl-gencerts | 7 +++++++
 httpd.spec         | 5 ++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts
index 22aece4..350f5b5 100755
--- a/httpd-ssl-gencerts
+++ b/httpd-ssl-gencerts
@@ -3,6 +3,7 @@
 set -e
 
 FQDN=`hostname`
+ssldotconf=/etc/httpd/conf.d/ssl.conf
 
 if test -f /etc/pki/tls/certs/localhost.crt -a \
         -f /etc/pki/tls/private/localhost.key; then
@@ -21,6 +22,12 @@ if test ! -f /etc/pki/tls/certs/localhost.crt -a \
     exit 1
 fi
 
+if ! test -f ${ssldotconf} || \
+   ! grep -q '^SSLCertificateFile /etc/pki/tls/certs/localhost.crt' ${ssldotconf} || \
+   ! grep -q '^SSLCertificateKeyFile /etc/pki/tls/private/localhost.key' ${ssldotconf}; then
+    # Non-default configuration, do nothing.
+    exit 0
+fi
 
 sscg -q                                                             \
      --cert-file           /etc/pki/tls/certs/localhost.crt         \
diff --git a/httpd.spec b/httpd.spec
index b67946e..04bdce2 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 11%{?dist}
+Release: 12%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -689,6 +689,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Sep 22 2017 Joe Orton <jorton@redhat.com> - 2.4.27-12
+- better error handling in httpd-ssl-gencerts (#1494556)
+
 * Thu Sep 21 2017 Stephen Gallagher <sgallagh@redhat.com> - 2.4.27-11
 - Require sscg 2.2.0 for creating service and CA certificates together
 

From cb3d7379b185b3d0f666608cb3e51c5336b8bdbd Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 22 Sep 2017 16:20:54 +0100
Subject: [PATCH 043/359] drop Requires(post) for mod_ssl

---
 httpd.spec | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 04bdce2..93b183f 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 12%{?dist}
+Release: 13%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -155,7 +155,6 @@ Group: System Environment/Daemons
 Summary: SSL/TLS module for the Apache HTTP Server
 Epoch: 1
 BuildRequires: openssl-devel
-Requires(post): openssl, /bin/cat, hostname
 Requires(pre): httpd-filesystem
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 Requires: sscg >= 2.2.0
@@ -689,6 +688,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Sep 22 2017 Joe Orton <jorton@redhat.com> - 2.4.27-13
+- drop Requires(post) for mod_ssl
+
 * Fri Sep 22 2017 Joe Orton <jorton@redhat.com> - 2.4.27-12
 - better error handling in httpd-ssl-gencerts (#1494556)
 

From 6fa38dce2ff2ff68c1fc269f05b908fb0bf0b11b Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 3 Oct 2017 09:16:29 +0100
Subject: [PATCH 044/359] add notes on enabling httpd_graceful_shutdown boolean
 for prefork

---
 00-mpm.conf       |  8 ++++++--
 httpd.service.xml | 18 ++++++++++++++++++
 httpd.spec        | 10 ++++++++--
 3 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/00-mpm.conf b/00-mpm.conf
index 75d90e9..b15f913 100644
--- a/00-mpm.conf
+++ b/00-mpm.conf
@@ -1,8 +1,13 @@
 # Select the MPM module which should be used by uncommenting exactly
-# one of the following LoadModule lines:
+# one of the following LoadModule lines.  See the httpd.service(8) man
+# page for more information on changing the MPM.
 
 # prefork MPM: Implements a non-threaded, pre-forking web server
 # See: http://httpd.apache.org/docs/2.4/mod/prefork.html
+#
+# NOTE: If enabling prefork, the httpd_graceful_shutdown SELinux
+# boolean should be enabled, to allow graceful stop/shutdown.
+#
 #LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
 
 # worker MPM: Multi-Processing Module implementing a hybrid
@@ -16,4 +21,3 @@
 # See: http://httpd.apache.org/docs/2.4/mod/event.html
 #
 #LoadModule mpm_event_module modules/mod_mpm_event.so
-
diff --git a/httpd.service.xml b/httpd.service.xml
index d851862..4402ed5 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -166,6 +166,24 @@ Wants=network-online.target</programlisting>
       --kill-who=main --signal=HUP httpd</command>.</para>
     </refsect2>
 
+    <refsect2>
+      <title>Changing the default MPM (Multi-Processing Module)</title>
+
+      <para>httpd offers a choice of multi-processing modules (MPMs),
+      which can be configured in
+      <filename>/etc/httpd/conf.modules.d/00-mpm.conf</filename>.  The
+      default is to use the <emphasis>@MPM@</emphasis> MPM.</para>
+
+      <para>If using the <emphasis>prefork</emphasis> MPM, the
+      "httpd_graceful_shutdown" SELinux boolean should also be
+      enabled, since with this MPM, httpd needs to establish TCP
+      connections to local ports to successfully complete a graceful
+      restart or shutdown. This boolean can be enabled by running the
+      command: <command>semanage boolean -m --on
+      httpd_graceful_shutdown</command></para>
+
+    </refsect2>
+
     <refsect2>
       <title>systemd integration and mod_systemd</title>
 
diff --git a/httpd.spec b/httpd.spec
index 93b183f..f03a98f 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 13%{?dist}
+Release: 14%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -239,7 +239,10 @@ if test "x${vmmn}" != "x%{mmn}"; then
    exit 1
 fi
 
-xmlto man $RPM_SOURCE_DIR/httpd.service.xml
+sed 's/@MPM@/%{mpm}/' < $RPM_SOURCE_DIR/httpd.service.xml \
+    > httpd.service.xml
+
+xmlto man ./httpd.service.xml
 
 : Building with MMN %{mmn}, MMN-ISA %{mmnisa}
 : Default MPM is %{mpm}, vendor string is '%{vstring}'
@@ -688,6 +691,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Oct  3 2017 Joe Orton <jorton@redhat.com> - 2.4.27-14
+- add notes on enabling httpd_graceful_shutdown boolean for prefork
+
 * Fri Sep 22 2017 Joe Orton <jorton@redhat.com> - 2.4.27-13
 - drop Requires(post) for mod_ssl
 

From 9c5d9117f56d16b1481d52ed9c9915762422f559 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 3 Oct 2017 10:05:16 +0100
Subject: [PATCH 045/359] Fix mismerge.

---
 httpd.spec | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index f03a98f..b845611 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -711,14 +711,14 @@ rm -rf $RPM_BUILD_ROOT
 - document httpd-init.service in httpd-init.service(8)
 
 * Wed Sep 20 2017 Stephen Gallagher <sgallagh@redhat.com> - 2.4.27-8.1
-- Generate SSL certificates on service start, not %posttrans
-
-* Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-8.1
-- move httpd.service.d, httpd.socket.d dirs to -filesystem
+- Generate SSL certificates on service start, not %%posttrans
 
 * Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-8
 - Address CVE-2017-9798 by applying patch from upstream (#1490344)
 
+* Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-8.1
+- move httpd.service.d, httpd.socket.d dirs to -filesystem
+
 * Wed Sep 13 2017 Joe Orton <jorton@redhat.com> - 2.4.27-7
 - add new content-length filter (upstream PR 61222)
 

From 783f274da85c5b8773ea89abcb028d32def4eaf8 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 3 Oct 2017 10:05:44 +0100
Subject: [PATCH 046/359] Fix mismerge.

---
 httpd.spec | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index b845611..45b76e8 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -710,12 +710,12 @@ rm -rf $RPM_BUILD_ROOT
 - use sscg defaults; append CA cert to generated cert
 - document httpd-init.service in httpd-init.service(8)
 
-* Wed Sep 20 2017 Stephen Gallagher <sgallagh@redhat.com> - 2.4.27-8.1
-- Generate SSL certificates on service start, not %%posttrans
-
 * Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-8
 - Address CVE-2017-9798 by applying patch from upstream (#1490344)
 
+* Wed Sep 20 2017 Stephen Gallagher <sgallagh@redhat.com> - 2.4.27-8.1
+- Generate SSL certificates on service start, not %%posttrans
+
 * Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-8.1
 - move httpd.service.d, httpd.socket.d dirs to -filesystem
 

From a69b9e522a2346178de6de6d0848a488b67cbdea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 6 Oct 2017 18:09:25 +0200
Subject: [PATCH 047/359] new version 2.4.28

---
 httpd-2.4.10-sigint.patch            | 28 ----------------------------
 httpd-2.4.17-socket-activation.patch | 19 +++++++++----------
 httpd-2.4.27-CVE-2017-9798.patch     | 15 ---------------
 httpd.spec                           | 11 +++++------
 sources                              |  2 +-
 5 files changed, 15 insertions(+), 60 deletions(-)
 delete mode 100644 httpd-2.4.10-sigint.patch
 delete mode 100644 httpd-2.4.27-CVE-2017-9798.patch

diff --git a/httpd-2.4.10-sigint.patch b/httpd-2.4.10-sigint.patch
deleted file mode 100644
index ecdd82e..0000000
--- a/httpd-2.4.10-sigint.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/server/mpm/prefork/prefork.c b/server/mpm/prefork/prefork.c
-index 559f90a..a386a75 100644
---- a/server/mpm/prefork/prefork.c
-+++ b/server/mpm/prefork/prefork.c
-@@ -220,6 +220,9 @@ static void clean_child_exit(int code)
- {
-     retained->mpm->mpm_state = AP_MPMQ_STOPPING;
- 
-+    apr_signal(SIGHUP, SIG_IGN);
-+    apr_signal(SIGTERM, SIG_IGN);
-+
-     if (pchild) {
-         apr_pool_destroy(pchild);
-     }
-@@ -699,6 +702,13 @@ static int make_child(server_rec *s, int slot, int bucket)
-          */
-         apr_signal(SIGHUP, just_die);
-         apr_signal(SIGTERM, just_die);
-+        /* Ignore SIGINT in child. This fixes race-condition in signals
-+         * handling when httpd is runnning on foreground and user hits ctrl+c.
-+         * In this case, SIGINT is sent to all children followed by SIGTERM
-+         * from the main process, which interrupts the SIGINT handler and
-+         * leads to inconsistency.
-+         */
-+        apr_signal(SIGINT, SIG_IGN);
-         /* The child process just closes listeners on AP_SIG_GRACEFUL.
-          * The pod is used for signalling the graceful restart.
-          */
diff --git a/httpd-2.4.17-socket-activation.patch b/httpd-2.4.17-socket-activation.patch
index d5cbdf2..dbdd80c 100644
--- a/httpd-2.4.17-socket-activation.patch
+++ b/httpd-2.4.17-socket-activation.patch
@@ -1,5 +1,5 @@
 diff --git a/server/listen.c b/server/listen.c
-index 1d9be83..f5f7754 100644
+index a8e9e6f..1a6c1d3 100644
 --- a/server/listen.c
 +++ b/server/listen.c
 @@ -34,6 +34,10 @@
@@ -100,11 +100,10 @@ index 1d9be83..f5f7754 100644
      }
  
  #ifdef WIN32
-@@ -277,6 +286,124 @@ static apr_status_t close_listeners_on_exec(void *v)
-     return APR_SUCCESS;
+@@ -315,6 +324,123 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
+     return found;
  }
  
-+
 +#ifdef HAVE_SYSTEMD
 +
 +static int find_systemd_socket(process_rec * process, apr_port_t port) {
@@ -222,10 +221,10 @@ index 1d9be83..f5f7754 100644
 +
 +#endif /* HAVE_SYSTEMD */
 +
- static const char *alloc_listener(process_rec *process, char *addr,
+ static const char *alloc_listener(process_rec *process, const char *addr,
                                    apr_port_t port, const char* proto,
                                    void *slave)
-@@ -479,7 +606,7 @@ static int open_listeners(apr_pool_t *pool)
+@@ -495,7 +621,7 @@ static int open_listeners(apr_pool_t *pool)
                  }
              }
  #endif
@@ -234,7 +233,7 @@ index 1d9be83..f5f7754 100644
                  ++num_open;
              }
              else {
-@@ -591,8 +718,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+@@ -607,8 +733,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
          }
      }
  
@@ -265,7 +264,7 @@ index 1d9be83..f5f7754 100644
      }
  
      for (lr = ap_listeners; lr; lr = lr->next) {
-@@ -682,7 +829,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
+@@ -698,7 +844,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
                              duplr->bind_addr);
                  return stat;
              }
@@ -274,7 +273,7 @@ index 1d9be83..f5f7754 100644
  #if AP_NONBLOCK_WHEN_MULTI_LISTEN
              use_nonblock = (ap_listeners && ap_listeners->next);
              stat = apr_socket_opt_set(duplr->sd, APR_SO_NONBLOCK, use_nonblock);
-@@ -809,6 +956,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -825,6 +971,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
      if (argc < 1 || argc > 2) {
          return "Listen requires 1 or 2 arguments.";
      }
@@ -286,7 +285,7 @@ index 1d9be83..f5f7754 100644
  
      rv = apr_parse_addr_port(&host, &scope_id, &port, argv[0], cmd->pool);
      if (rv != APR_SUCCESS) {
-@@ -840,6 +992,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -856,6 +1007,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
          ap_str_tolower(proto);
      }
  
diff --git a/httpd-2.4.27-CVE-2017-9798.patch b/httpd-2.4.27-CVE-2017-9798.patch
deleted file mode 100644
index be590f2..0000000
--- a/httpd-2.4.27-CVE-2017-9798.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- httpd/httpd/branches/2.4.x/server/core.c	2017/08/16 16:50:29	1805223
-+++ httpd/httpd/branches/2.4.x/server/core.c	2017/09/08 13:13:11	1807754
-@@ -2266,6 +2266,12 @@
-             /* method has not been registered yet, but resource restriction
-              * is always checked before method handling, so register it.
-              */
-+            if (cmd->pool == cmd->temp_pool) {
-+                /* In .htaccess, we can't globally register new methods. */
-+                return apr_psprintf(cmd->pool, "Could not register method '%s' "
-+                                   "for %s from .htaccess configuration",
-+                                    method, cmd->cmd->name);
-+            }
-             methnum = ap_method_register(cmd->pool,
-                                          apr_pstrdup(cmd->pool, method));
-         }
diff --git a/httpd.spec b/httpd.spec
index 45b76e8..6e88039 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.27
-Release: 14%{?dist}
+Version: 2.4.28
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -71,10 +71,8 @@ Patch34: httpd-2.4.17-socket-activation.patch
 Patch35: httpd-2.4.17-sslciphdefault.patch
 # Bug fixes
 Patch56: httpd-2.4.4-mod_unique_id.patch
-Patch57: httpd-2.4.10-sigint.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.25-r1738878.patch
-Patch59: httpd-2.4.27-CVE-2017-9798.patch
 Patch60: httpd-2.4.27-r1808230.patch
 # Security fixes
 
@@ -220,9 +218,7 @@ interface for storing and accessing per-user session data.
 %patch35 -p1 -b .sslciphdefault
 
 %patch56 -p1 -b .uniqueid
-%patch57 -p1 -b .sigint
 %patch58 -p1 -b .r1738878
-%patch59 -p4 -b .cve-2017-9798
 %patch60 -p1 -b .r1808230
 
 # Patch in the vendor string
@@ -691,6 +687,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Oct 06 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.28-1
+- new version 2.4.28
+
 * Tue Oct  3 2017 Joe Orton <jorton@redhat.com> - 2.4.27-14
 - add notes on enabling httpd_graceful_shutdown boolean for prefork
 
diff --git a/sources b/sources
index dafe33c..2db6285 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.27.tar.bz2) = 7e7e8070715b74cb6890096a74e194f4c6a49c14bda685b1ad832e84312f1ac4316ea03a430e679502bfd8e1853aefa544ee002a20d0f7e994b9a590c74bc42c
+SHA512 (httpd-2.4.28.tar.bz2) = 8de8e32b87e6de220e492e74db9df0882fae11c3b9732f3d3316da048c04767ac4429c0433c36f87d8705263e3376f97a7e1f66a9d7a518632a67b6fe617590a

From 01bcbc5642a6ea61101e6af963e64175f7b307c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 6 Oct 2017 18:14:03 +0200
Subject: [PATCH 048/359] new version 2.4.28

---
 httpd-2.4.10-sigint.patch            | 28 ----------------------------
 httpd-2.4.17-socket-activation.patch | 19 +++++++++----------
 httpd-2.4.27-CVE-2017-9798.patch     | 15 ---------------
 httpd.spec                           | 11 +++++------
 sources                              |  2 +-
 5 files changed, 15 insertions(+), 60 deletions(-)
 delete mode 100644 httpd-2.4.10-sigint.patch
 delete mode 100644 httpd-2.4.27-CVE-2017-9798.patch

diff --git a/httpd-2.4.10-sigint.patch b/httpd-2.4.10-sigint.patch
deleted file mode 100644
index ecdd82e..0000000
--- a/httpd-2.4.10-sigint.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/server/mpm/prefork/prefork.c b/server/mpm/prefork/prefork.c
-index 559f90a..a386a75 100644
---- a/server/mpm/prefork/prefork.c
-+++ b/server/mpm/prefork/prefork.c
-@@ -220,6 +220,9 @@ static void clean_child_exit(int code)
- {
-     retained->mpm->mpm_state = AP_MPMQ_STOPPING;
- 
-+    apr_signal(SIGHUP, SIG_IGN);
-+    apr_signal(SIGTERM, SIG_IGN);
-+
-     if (pchild) {
-         apr_pool_destroy(pchild);
-     }
-@@ -699,6 +702,13 @@ static int make_child(server_rec *s, int slot, int bucket)
-          */
-         apr_signal(SIGHUP, just_die);
-         apr_signal(SIGTERM, just_die);
-+        /* Ignore SIGINT in child. This fixes race-condition in signals
-+         * handling when httpd is runnning on foreground and user hits ctrl+c.
-+         * In this case, SIGINT is sent to all children followed by SIGTERM
-+         * from the main process, which interrupts the SIGINT handler and
-+         * leads to inconsistency.
-+         */
-+        apr_signal(SIGINT, SIG_IGN);
-         /* The child process just closes listeners on AP_SIG_GRACEFUL.
-          * The pod is used for signalling the graceful restart.
-          */
diff --git a/httpd-2.4.17-socket-activation.patch b/httpd-2.4.17-socket-activation.patch
index d5cbdf2..dbdd80c 100644
--- a/httpd-2.4.17-socket-activation.patch
+++ b/httpd-2.4.17-socket-activation.patch
@@ -1,5 +1,5 @@
 diff --git a/server/listen.c b/server/listen.c
-index 1d9be83..f5f7754 100644
+index a8e9e6f..1a6c1d3 100644
 --- a/server/listen.c
 +++ b/server/listen.c
 @@ -34,6 +34,10 @@
@@ -100,11 +100,10 @@ index 1d9be83..f5f7754 100644
      }
  
  #ifdef WIN32
-@@ -277,6 +286,124 @@ static apr_status_t close_listeners_on_exec(void *v)
-     return APR_SUCCESS;
+@@ -315,6 +324,123 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
+     return found;
  }
  
-+
 +#ifdef HAVE_SYSTEMD
 +
 +static int find_systemd_socket(process_rec * process, apr_port_t port) {
@@ -222,10 +221,10 @@ index 1d9be83..f5f7754 100644
 +
 +#endif /* HAVE_SYSTEMD */
 +
- static const char *alloc_listener(process_rec *process, char *addr,
+ static const char *alloc_listener(process_rec *process, const char *addr,
                                    apr_port_t port, const char* proto,
                                    void *slave)
-@@ -479,7 +606,7 @@ static int open_listeners(apr_pool_t *pool)
+@@ -495,7 +621,7 @@ static int open_listeners(apr_pool_t *pool)
                  }
              }
  #endif
@@ -234,7 +233,7 @@ index 1d9be83..f5f7754 100644
                  ++num_open;
              }
              else {
-@@ -591,8 +718,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+@@ -607,8 +733,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
          }
      }
  
@@ -265,7 +264,7 @@ index 1d9be83..f5f7754 100644
      }
  
      for (lr = ap_listeners; lr; lr = lr->next) {
-@@ -682,7 +829,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
+@@ -698,7 +844,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
                              duplr->bind_addr);
                  return stat;
              }
@@ -274,7 +273,7 @@ index 1d9be83..f5f7754 100644
  #if AP_NONBLOCK_WHEN_MULTI_LISTEN
              use_nonblock = (ap_listeners && ap_listeners->next);
              stat = apr_socket_opt_set(duplr->sd, APR_SO_NONBLOCK, use_nonblock);
-@@ -809,6 +956,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -825,6 +971,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
      if (argc < 1 || argc > 2) {
          return "Listen requires 1 or 2 arguments.";
      }
@@ -286,7 +285,7 @@ index 1d9be83..f5f7754 100644
  
      rv = apr_parse_addr_port(&host, &scope_id, &port, argv[0], cmd->pool);
      if (rv != APR_SUCCESS) {
-@@ -840,6 +992,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -856,6 +1007,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
          ap_str_tolower(proto);
      }
  
diff --git a/httpd-2.4.27-CVE-2017-9798.patch b/httpd-2.4.27-CVE-2017-9798.patch
deleted file mode 100644
index be590f2..0000000
--- a/httpd-2.4.27-CVE-2017-9798.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- httpd/httpd/branches/2.4.x/server/core.c	2017/08/16 16:50:29	1805223
-+++ httpd/httpd/branches/2.4.x/server/core.c	2017/09/08 13:13:11	1807754
-@@ -2266,6 +2266,12 @@
-             /* method has not been registered yet, but resource restriction
-              * is always checked before method handling, so register it.
-              */
-+            if (cmd->pool == cmd->temp_pool) {
-+                /* In .htaccess, we can't globally register new methods. */
-+                return apr_psprintf(cmd->pool, "Could not register method '%s' "
-+                                   "for %s from .htaccess configuration",
-+                                    method, cmd->cmd->name);
-+            }
-             methnum = ap_method_register(cmd->pool,
-                                          apr_pstrdup(cmd->pool, method));
-         }
diff --git a/httpd.spec b/httpd.spec
index e9e4319..d780615 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.27
-Release: 14%{?dist}
+Version: 2.4.28
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -71,10 +71,8 @@ Patch34: httpd-2.4.17-socket-activation.patch
 Patch35: httpd-2.4.17-sslciphdefault.patch
 # Bug fixes
 Patch56: httpd-2.4.4-mod_unique_id.patch
-Patch57: httpd-2.4.10-sigint.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.25-r1738878.patch
-Patch59: httpd-2.4.27-CVE-2017-9798.patch
 Patch60: httpd-2.4.27-r1808230.patch
 # Security fixes
 
@@ -220,9 +218,7 @@ interface for storing and accessing per-user session data.
 %patch35 -p1 -b .sslciphdefault
 
 %patch56 -p1 -b .uniqueid
-%patch57 -p1 -b .sigint
 %patch58 -p1 -b .r1738878
-%patch59 -p4 -b .cve-2017-9798
 %patch60 -p1 -b .r1808230
 
 # Patch in the vendor string
@@ -691,6 +687,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Oct 06 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.28-1
+- new version 2.4.28
+
 * Tue Oct  3 2017 Joe Orton <jorton@redhat.com> - 2.4.27-14
 - add notes on enabling httpd_graceful_shutdown boolean for prefork
 
diff --git a/sources b/sources
index dafe33c..2db6285 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.27.tar.bz2) = 7e7e8070715b74cb6890096a74e194f4c6a49c14bda685b1ad832e84312f1ac4316ea03a430e679502bfd8e1853aefa544ee002a20d0f7e994b9a590c74bc42c
+SHA512 (httpd-2.4.28.tar.bz2) = 8de8e32b87e6de220e492e74db9df0882fae11c3b9732f3d3316da048c04767ac4429c0433c36f87d8705263e3376f97a7e1f66a9d7a518632a67b6fe617590a

From 0cea9da48f64d0ee51f5f90e9b7f9ad008964ab7 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 10:02:32 +0100
Subject: [PATCH 049/359] move httpd.service.d, httpd.socket.d dirs to
 -filesystem

---
 httpd.spec | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 29805bc..c9792bb 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -631,8 +631,6 @@ rm -rf $RPM_BUILD_ROOT
 
 %{_unitdir}/*.service
 %{_unitdir}/*.socket
-%attr(755,root,root) %dir %{_unitdir}/httpd.service.d
-%attr(755,root,root) %dir %{_unitdir}/httpd.socket.d
 
 %files filesystem
 %dir %{_sysconfdir}/httpd
@@ -694,6 +692,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-8.1
+- move httpd.service.d, httpd.socket.d dirs to -filesystem
+
 * Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-3
 - Address CVE-2017-9798 by applying patch from upstream (#1490344)
 

From 0c9804fc74c9c8df33af1f18f16d50d1a5c2484d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 10:08:07 +0100
Subject: [PATCH 050/359] move httpd.service.d, httpd.socket.d dirs to
 -filesystem

---
 httpd.spec | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/httpd.spec b/httpd.spec
index c9792bb..f6da380 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -641,6 +641,8 @@ rm -rf $RPM_BUILD_ROOT
 %dir %{docroot}/html
 %dir %{contentdir}
 %dir %{contentdir}/icons
+%attr(755,root,root) %dir %{_unitdir}/httpd.service.d
+%attr(755,root,root) %dir %{_unitdir}/httpd.socket.d
 
 %files tools
 %defattr(-,root,root)

From 1557b7a661f55b2522a5edae8bb91d7dd910dbe9 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 4 Aug 2017 13:19:55 +0100
Subject: [PATCH 051/359] Switch to https:// URLs.

---
 httpd.spec | 6 +++---
 index.html | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index f6da380..f3c95f0 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,9 +8,9 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 3%{?dist}
-URL: http://httpd.apache.org/
-Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
+Release: 6%{?dist}
+URL: https://httpd.apache.org/
+Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
 Source2: httpd.logrotate
 Source4: httpd-ssl-pass-dialog
diff --git a/index.html b/index.html
index 7eff881..943f060 100644
--- a/index.html
+++ b/index.html
@@ -123,7 +123,7 @@
 					<div class="logos">
 						<p>You are free to use the images below on Apache and Fedora powered HTTP servers. Thanks for using Apache and Fedora!</p>
 
-						<p><a href="http://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="http://fedoraproject.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
+						<p><a href="https://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="http://fedoraproject.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
 					</div>
 				</div>
 			</div>

From ed8864968f14b8ec60f6e97db3ecb03f605ea0ae Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 13 Sep 2017 14:21:17 +0100
Subject: [PATCH 052/359] add new content-length filter (upstream PR 61222)

---
 .gitignore                  |   2 +-
 httpd-2.4.27-r1808230.patch | 131 ++++++++++++++++++++++++++++++++++++
 httpd.spec                  |   7 +-
 pullrev.sh                  |   4 +-
 4 files changed, 139 insertions(+), 5 deletions(-)
 create mode 100644 httpd-2.4.27-r1808230.patch

diff --git a/.gitignore b/.gitignore
index 19a3666..e364382 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,7 +10,7 @@ x86_64
 /httpd-2.2.21.tar.bz2
 /clog
 /httpd-2.2.22.tar.bz2
-/httpd-2.4.?
+/httpd-2.4.??/
 /httpd-2.4.2.tar.bz2
 /httpd-2.4.3.tar.bz2
 /httpd-2.4.4.tar.bz2
diff --git a/httpd-2.4.27-r1808230.patch b/httpd-2.4.27-r1808230.patch
new file mode 100644
index 0000000..e4062ea
--- /dev/null
+++ b/httpd-2.4.27-r1808230.patch
@@ -0,0 +1,131 @@
+# ./pullrev.sh 1808230
+http://svn.apache.org/viewvc?view=revision&revision=1808230
+
+--- httpd-2.4.27/server/protocol.c
++++ httpd-2.4.27/server/protocol.c
+@@ -1708,62 +1708,88 @@
+         ctx->tmpbb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
+     }
+ 
+-    /* Loop through this set of buckets to compute their length
+-     */
++    /* Loop through the brigade to count the length. To avoid
++     * arbitrary memory consumption with morphing bucket types, this
++     * loop will stop and pass on the brigade when necessary. */
+     e = APR_BRIGADE_FIRST(b);
+     while (e != APR_BRIGADE_SENTINEL(b)) {
++        apr_status_t rv;
++
+         if (APR_BUCKET_IS_EOS(e)) {
+             eos = 1;
+             break;
+         }
+-        if (e->length == (apr_size_t)-1) {
++        /* For a flush bucket, fall through to pass the brigade and
++         * flush now. */
++        else if (APR_BUCKET_IS_FLUSH(e)) {
++            e = APR_BUCKET_NEXT(e);
++        }
++        /* For metadata bucket types other than FLUSH, loop. */
++        else if (APR_BUCKET_IS_METADATA(e)) {
++            e = APR_BUCKET_NEXT(e);
++            continue;
++        }
++        /* For determinate length data buckets, count the length and
++         * continue. */
++        else if (e->length != (apr_size_t)-1) {
++            r->bytes_sent += e->length;
++            e = APR_BUCKET_NEXT(e);
++            continue;
++        }
++        /* For indeterminate length data buckets, perform one read. */
++        else /* e->length == (apr_size_t)-1 */ {
+             apr_size_t len;
+             const char *ignored;
+-            apr_status_t rv;
+-
+-            /* This is probably a pipe bucket.  Send everything
+-             * prior to this, and then read the data for this bucket.
+-             */
++        
+             rv = apr_bucket_read(e, &ignored, &len, eblock);
++            if ((rv != APR_SUCCESS) && !APR_STATUS_IS_EAGAIN(rv)) {
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
++                              "ap_content_length_filter: "
++                              "apr_bucket_read() failed");
++                return rv;
++            }
+             if (rv == APR_SUCCESS) {
+-                /* Attempt a nonblocking read next time through */
+                 eblock = APR_NONBLOCK_READ;
++                e = APR_BUCKET_NEXT(e);
+                 r->bytes_sent += len;
+             }
+             else if (APR_STATUS_IS_EAGAIN(rv)) {
+-                /* Output everything prior to this bucket, and then
+-                 * do a blocking read on the next batch.
+-                 */
+-                if (e != APR_BRIGADE_FIRST(b)) {
+-                    apr_bucket *flush;
+-                    apr_brigade_split_ex(b, e, ctx->tmpbb);
+-                    flush = apr_bucket_flush_create(r->connection->bucket_alloc);
++                apr_bucket *flush;
+ 
+-                    APR_BRIGADE_INSERT_TAIL(b, flush);
+-                    rv = ap_pass_brigade(f->next, b);
+-                    if (rv != APR_SUCCESS || f->c->aborted) {
+-                        return rv;
+-                    }
+-                    apr_brigade_cleanup(b);
+-                    APR_BRIGADE_CONCAT(b, ctx->tmpbb);
+-                    e = APR_BRIGADE_FIRST(b);
++                /* Next read must block. */
++                eblock = APR_BLOCK_READ;
+ 
+-                    ctx->data_sent = 1;
+-                }
+-                eblock = APR_BLOCK_READ;
+-                continue;
++                /* Ensure the last bucket to pass down is a flush if
++                 * the next read will block. */
++                flush = apr_bucket_flush_create(f->c->bucket_alloc);
++                APR_BUCKET_INSERT_BEFORE(e, flush);
+             }
+-            else {
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
+-                              "ap_content_length_filter: "
+-                              "apr_bucket_read() failed");
+-                return rv;
+-            }
+         }
+-        else {
+-            r->bytes_sent += e->length;
++
++        /* Optimization: if the next bucket is EOS (directly after a
++         * bucket morphed to the heap, or a flush), short-cut to
++         * handle EOS straight away - allowing C-L to be determined
++         * for content which is already entirely in memory. */
++        if (e != APR_BRIGADE_SENTINEL(b) && APR_BUCKET_IS_EOS(e)) {
++            continue;
+         }
+-        e = APR_BUCKET_NEXT(e);
++
++        /* On reaching here, pass on everything in the brigade up to
++         * this point. */
++        apr_brigade_split_ex(b, e, ctx->tmpbb);
++        
++        rv = ap_pass_brigade(f->next, b);
++        if (rv != APR_SUCCESS) {
++            return rv;
++        }
++        else if (f->c->aborted) {
++            return APR_ECONNABORTED;
++        }
++        apr_brigade_cleanup(b);
++        APR_BRIGADE_CONCAT(b, ctx->tmpbb);
++        e = APR_BRIGADE_FIRST(b);
++        
++        ctx->data_sent = 1;
+     }
+ 
+     /* If we've now seen the entire response and it's otherwise
diff --git a/httpd.spec b/httpd.spec
index f3c95f0..86bad76 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,7 +8,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 6%{?dist}
+Release: 7%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -68,6 +68,7 @@ Patch57: httpd-2.4.10-sigint.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.25-r1738878.patch
 Patch59: httpd-2.4.27-CVE-2017-9798.patch
+Patch60: httpd-2.4.27-r1808230.patch
 # Security fixes
 
 License: ASL 2.0
@@ -215,6 +216,7 @@ interface for storing and accessing per-user session data.
 %patch57 -p1 -b .sigint
 %patch58 -p1 -b .r1738878
 %patch59 -p4 -b .cve-2017-9798
+%patch60 -p1 -b .r1808230
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -694,8 +696,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-8.1
+* Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-3.1
 - move httpd.service.d, httpd.socket.d dirs to -filesystem
+- add new content-length filter (upstream PR 61222)
 
 * Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-3
 - Address CVE-2017-9798 by applying patch from upstream (#1490344)
diff --git a/pullrev.sh b/pullrev.sh
index d106968..c366613 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then
 fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
-repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.26
+#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+ver=2.4.27
 prefix="httpd-${ver}"
 suffix="r$1${2:++}"
 fn="${prefix}-${suffix}.patch"

From 129d56ab3fc4e6b1a8e93737dfae52e05f913974 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 12:36:38 +0100
Subject: [PATCH 053/359] Update links to Fedora home page.

---
 index.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/index.html b/index.html
index 943f060..1b7ea03 100644
--- a/index.html
+++ b/index.html
@@ -111,7 +111,7 @@
 					<li>Neither the Fedora Project or Red Hat has "hacked" this webserver, this test page is an included component of Apache's httpd webserver software.</li>
 					</ul>
 
-					<p>For more information about Fedora, please visit the <a href="http://fedoraproject.org/">Fedora Project website</a>.</p>
+					<p>For more information about Fedora, please visit the <a href="https://getfedora.org/">Fedora Project website</a>.</p>
 					<hr />
 				</div>
 
@@ -123,7 +123,7 @@
 					<div class="logos">
 						<p>You are free to use the images below on Apache and Fedora powered HTTP servers. Thanks for using Apache and Fedora!</p>
 
-						<p><a href="https://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="http://fedoraproject.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
+						<p><a href="https://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="https://getfedora.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
 					</div>
 				</div>
 			</div>

From 35f1318a481b6e353f1749fa72df84ce5e408f73 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 12:46:35 +0100
Subject: [PATCH 054/359] httpd.service(5) update: show how to ungracefully
 stop/restart

---
 httpd.service.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/httpd.service.xml b/httpd.service.xml
index d03e133..8f82e59 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -143,6 +143,11 @@ Wants=network-online.target</programlisting>
       which terminates the server only once active connections have
       been processed.</para>
 
+      <para>To "ungracefully" stop the server without waiting for
+      requests to complete, use <command>systemctl kill
+      --kill-who=main httpd</command>; similarly to "ungracefully"
+      reload the configuration, use <command>systemctl kill
+      --kill-who=main --signal=HUP httpd</command>.</para>
     </refsect2>
 
     <refsect2>

From e0e3d5e91caf82d9893aeefd732aac21e92f55c2 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 18 Jul 2017 09:25:14 +0100
Subject: [PATCH 055/359] update mod_systemd (r1802251)

---
 httpd-2.4.26-r1800306.patch                   | 86 -------------------
 ...ystemd.patch => httpd-2.4.27-systemd.patch | 40 ++++++---
 httpd.spec                                    |  3 +-
 3 files changed, 30 insertions(+), 99 deletions(-)
 delete mode 100644 httpd-2.4.26-r1800306.patch
 rename httpd-2.4.10-mod_systemd.patch => httpd-2.4.27-systemd.patch (79%)

diff --git a/httpd-2.4.26-r1800306.patch b/httpd-2.4.26-r1800306.patch
deleted file mode 100644
index 4a8bc2d..0000000
--- a/httpd-2.4.26-r1800306.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-# ./pullrev.sh 1800306
-
-http://svn.apache.org/viewvc?view=revision&revision=1800306
-
-diff -uap httpd-2.4.26/modules/mappers/mod_actions.c.r1800306 httpd-2.4.26/modules/mappers/mod_actions.c
---- httpd-2.4.26/modules/mappers/mod_actions.c.r1800306
-+++ httpd-2.4.26/modules/mappers/mod_actions.c
-@@ -186,8 +186,7 @@
-         ap_field_noparam(r->pool, r->content_type);
- 
-     if (action && (t = apr_table_get(conf->action_types, action))) {
--        int virtual = (*t++ == '0' ? 0 : 1);
--        if (!virtual && r->finfo.filetype == APR_NOFILE) {
-+        if (*t++ == '0' && r->finfo.filetype == APR_NOFILE) {
-             ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00652)
-                           "File does not exist: %s", r->filename);
-             return HTTP_NOT_FOUND;
-@@ -198,9 +197,6 @@
-          * (will be REDIRECT_HANDLER there)
-          */
-         apr_table_setn(r->subprocess_env, "HANDLER", action);
--        if (virtual) {
--            apr_table_setn(r->notes, "virtual_script", "1");
--        }
-     }
- 
-     if (script == NULL)
-diff -uap httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c.r1800306 httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c
---- httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c.r1800306
-+++ httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c
-@@ -321,7 +321,6 @@
-     apr_status_t rv;
-     apr_size_t avail_len, len, required_len;
-     int next_elem, starting_elem;
--    int fpm = 0;
-     fcgi_req_config_t *rconf = ap_get_module_config(r->request_config, &proxy_fcgi_module);
-     fcgi_dirconf_t *dconf = ap_get_module_config(r->per_dir_config, &proxy_fcgi_module);
- 
-@@ -354,8 +353,6 @@
-                     *qs = '\0';
-                 }
-             }
--        } else {
--            fpm = 1;
-         }
- 
-         if (newfname) {
-@@ -364,38 +361,9 @@
-         }
-     }
- 
--#if 0
--    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(09999)
--                  "r->filename: %s", (r->filename ? r->filename : "nil"));
--    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(09999)
--                  "r->uri: %s", (r->uri ? r->uri : "nil"));
--    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(09999)
--                  "r->path_info: %s", (r->path_info ? r->path_info : "nil"));
--#endif
--
-     ap_add_common_vars(r);
-     ap_add_cgi_vars(r);
- 
--    if (fpm || apr_table_get(r->notes, "virtual_script")) {
--        /*
--         * Adjust SCRIPT_NAME, PATH_INFO and PATH_TRANSLATED for PHP-FPM
--         * TODO: Right now, PATH_INFO and PATH_TRANSLATED look OK...
--         */
--        const char *pend;
--        const char *script_name = apr_table_get(r->subprocess_env, "SCRIPT_NAME");
--        pend = script_name + strlen(script_name);
--        if (r->path_info && *r->path_info) {
--            pend = script_name + ap_find_path_info(script_name, r->path_info) - 1;
--        }
--        while (pend != script_name && *pend != '/') {
--            pend--;
--        }
--        apr_table_setn(r->subprocess_env, "SCRIPT_NAME", pend);
--        ap_log_rerror(APLOG_MARK, APLOG_TRACE4, 0, r,
--                      "fpm:virtual_script: Modified SCRIPT_NAME to: %s",
--                      pend);
--    }
--
-     /* XXX are there any FastCGI specific env vars we need to send? */
- 
-     /* Give admins final option to fine-tune env vars */
diff --git a/httpd-2.4.10-mod_systemd.patch b/httpd-2.4.27-systemd.patch
similarity index 79%
rename from httpd-2.4.10-mod_systemd.patch
rename to httpd-2.4.27-systemd.patch
index 88d76ac..26aac48 100644
--- a/httpd-2.4.10-mod_systemd.patch
+++ b/httpd-2.4.27-systemd.patch
@@ -1,8 +1,10 @@
-diff --git a/modules/arch/unix/config5.m4 b/modules/arch/unix/config5.m4
-index 77027a8..7a13d5a 100644
---- a/modules/arch/unix/config5.m4
-+++ b/modules/arch/unix/config5.m4
-@@ -18,6 +18,16 @@ APACHE_MODULE(privileges, Per-virtualhost Unix UserIDs and enhanced security for
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+--- httpd-2.4.27/modules/arch/unix/config5.m4.systemd
++++ httpd-2.4.27/modules/arch/unix/config5.m4
+@@ -18,6 +18,16 @@
    fi
  ])
  
@@ -19,12 +21,10 @@ index 77027a8..7a13d5a 100644
  APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
  
  APACHE_MODPATH_FINISH
-diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
-new file mode 100644
-index 0000000..5381c98
---- /dev/null
-+++ b/modules/arch/unix/mod_systemd.c
-@@ -0,0 +1,145 @@
+diff -uap httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd httpd-2.4.27/modules/arch/unix/mod_systemd.c
+--- httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd
++++ httpd-2.4.27/modules/arch/unix/mod_systemd.c
+@@ -0,0 +1,161 @@
 +/* Licensed to the Apache Software Foundation (ASF) under one or more
 + * contributor license agreements.  See the NOTICE file distributed with
 + * this work for additional information regarding copyright ownership.
@@ -66,11 +66,20 @@ index 0000000..5381c98
 +static unsigned long bytes_served;
 +static pid_t mainpid;
 +
++static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
++                              apr_pool_t *ptemp)
++{
++    sd_notify(0,
++              "RELOADING=1\n"
++              "STATUS=Reading configuration...\n");
++    ap_extended_status = 1;
++    return OK;
++}
++
 +static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
 +{
 +    int rv;
 +
-+    ap_extended_status = 1;
 +    mainpid = getpid();
 +
 +    rv = sd_notifyf(0, "READY=1\n"
@@ -91,6 +100,11 @@ index 0000000..5381c98
 +    char bps[5];
 +    int rv;
 +
++    if (!ap_extended_status) {
++        /* Nothing useful to report if ExtendedStatus disabled. */
++        return DECLINED;
++    }
++    
 +    ap_get_sload(&sload);
 +    /* up_time in seconds */
 +    up_time = (apr_uint32_t) apr_time_sec(apr_time_now() -
@@ -136,6 +150,8 @@ index 0000000..5381c98
 +
 +static void systemd_register_hooks(apr_pool_t *p)
 +{
++    /* Enable ap_extended_status. */
++    ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
 +    /* We know the PID in this hook ... */
 +    ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST);
 +    /* Used to update httpd's status line using sd_notifyf */
diff --git a/httpd.spec b/httpd.spec
index 86bad76..1e3abf6 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -57,7 +57,7 @@ Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
 Patch26: httpd-2.4.4-r1337344+.patch
 Patch27: httpd-2.4.2-icons.patch
-Patch29: httpd-2.4.10-mod_systemd.patch
+Patch29: httpd-2.4.27-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
 Patch31: httpd-2.4.18-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
@@ -699,6 +699,7 @@ rm -rf $RPM_BUILD_ROOT
 * Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-3.1
 - move httpd.service.d, httpd.socket.d dirs to -filesystem
 - add new content-length filter (upstream PR 61222)
+- update mod_systemd (r1802251)
 
 * Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-3
 - Address CVE-2017-9798 by applying patch from upstream (#1490344)

From 7c50471725536b88b7bd0cfc23d397dc81ca4ea8 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 14 Jul 2017 12:55:47 +0100
Subject: [PATCH 056/359] Fix grammar.

---
 httpd.service | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd.service b/httpd.service
index 1f707e8..011df3b 100644
--- a/httpd.service
+++ b/httpd.service
@@ -3,7 +3,7 @@
 # Modifying this file in-place is not recommended, because changes
 # will be overwritten during package upgrades.  If you want to
 # customize the behaviour, the best way is to use "systemctl edit"
-# command to create an override unit.
+# to create an override unit.
 
 # For example, to pass additional options (such as -D definitions) to
 # the httpd binary at startup, create an override unit (as is done by

From c96d33c29448223b65d68b1cd21dd4734acd4437 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 14 Jul 2017 12:57:27 +0100
Subject: [PATCH 057/359] Shorter text in httpd.service.

---
 httpd.service | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/httpd.service b/httpd.service
index 011df3b..1b779e9 100644
--- a/httpd.service
+++ b/httpd.service
@@ -1,9 +1,8 @@
 # See httpd.service(8) for more information on using the httpd service.
 
 # Modifying this file in-place is not recommended, because changes
-# will be overwritten during package upgrades.  If you want to
-# customize the behaviour, the best way is to use "systemctl edit"
-# to create an override unit.
+# will be overwritten during package upgrades.  To customize the
+# behaviour, run "systemctl edit httpd" to create an override unit.
 
 # For example, to pass additional options (such as -D definitions) to
 # the httpd binary at startup, create an override unit (as is done by

From 4f4a88bbca916c3aec829af113dc13bc54eb54be Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 9 Oct 2017 17:36:00 +0100
Subject: [PATCH 058/359] Fix changelog chronology.

---
 httpd.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 1e3abf6..684d071 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -696,7 +696,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-3.1
+* Mon Oct  9 2017 Joe Orton <jorton@redhat.com> - 2.4.27-7
 - move httpd.service.d, httpd.socket.d dirs to -filesystem
 - add new content-length filter (upstream PR 61222)
 - update mod_systemd (r1802251)

From 6ebb5a2203de9f5cf7c3d9f9a1e7bf026cfa8dc2 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <patrick@puiterwijk.org>
Date: Tue, 10 Oct 2017 13:31:46 +0200
Subject: [PATCH 059/359] Backport patch for fixing ticket key usage

Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
---
 httpd-2.4.27-fixticketkeys.patch | 65 ++++++++++++++++++++++++++++++++
 httpd.spec                       | 10 ++++-
 2 files changed, 74 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.27-fixticketkeys.patch

diff --git a/httpd-2.4.27-fixticketkeys.patch b/httpd-2.4.27-fixticketkeys.patch
new file mode 100644
index 0000000..3769da9
--- /dev/null
+++ b/httpd-2.4.27-fixticketkeys.patch
@@ -0,0 +1,65 @@
+From 4171fbfcb249e63f934471054d7a0752272fb8ee Mon Sep 17 00:00:00 2001
+From: Yann Ylavic <ylavic@apache.org>
+Date: Tue, 22 Mar 2016 13:09:17 +0000
+Subject: [PATCH] mod_ssl: return non ambigous value in
+ ssl_callback_SessionTicket() for encryption mode (we used to return 0,
+ OpenSSL documents returning 1 instead).
+
+Practically this does not change anything since OpenSSL will only check for
+>= 0 return value (non error) for encryption mode (the other possible return
+values are only relevant for decryption mode).
+
+However the OpenSSL documentation for SSL_CTX_set_tlsext_ticket_key_cb()
+states:
+"
+The return value of the cb function is used by OpenSSL to determine what
+further processing will occur. The following return values have meaning:
+
+2
+    This indicates that the ctx and hctx have been set and the session can
+    continue on those parameters. Additionally it indicates that the session
+    ticket is in a renewal period and should be replaced. The OpenSSL library
+    will call cb again with an enc argument of 1 to set the new ticket (see
+    RFC5077 3.3 paragraph 2).
+
+1
+    This indicates that the ctx and hctx have been set and the session can
+    continue on those parameters.
+
+0
+    This indicates that it was not possible to set/retrieve a session ticket
+    and the SSL/TLS session will continue by by negotiating a set of
+    cryptographic parameters or using the alternate SSL/TLS resumption
+    mechanism, session ids.
+    If called with enc equal to 0 the library will call the cb again to get a
+    new set of parameters.
+
+less than 0
+    This indicates an error.
+"
+
+So 0 is not appropriate in our code, 1 is what we really want (and it won't
+break if OpenSSL later changes its checks on the callback return value).
+
+Reported by: oknet on github, pull request #18.
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1736186 13f79535-47bb-0310-9956-ffa450edef68
+---
+ modules/ssl/ssl_engine_kernel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
+index 91da94c4f58..91d5e926d66 100644
+--- a/modules/ssl/ssl_engine_kernel.c
++++ b/modules/ssl/ssl_engine_kernel.c
+@@ -2303,7 +2303,7 @@ int ssl_callback_SessionTicket(SSL *ssl,
+                       "TLS session ticket key for %s successfully set, "
+                       "creating new session ticket", sc->vhost_id);
+ 
+-        return 0;
++        return 1;
+     }
+     else if (mode == 0) {
+         /* 
diff --git a/httpd.spec b/httpd.spec
index d780615..3c25596 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.28
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -76,6 +76,9 @@ Patch58: httpd-2.4.25-r1738878.patch
 Patch60: httpd-2.4.27-r1808230.patch
 # Security fixes
 
+# https://github.com/apache/httpd/commit/4171fbfcb249e63f934471054d7a0752272fb8ee
+Patch61: httpd-2.4.27-fixticketkeys.patch
+
 License: ASL 2.0
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
@@ -221,6 +224,8 @@ interface for storing and accessing per-user session data.
 %patch58 -p1 -b .r1738878
 %patch60 -p1 -b .r1808230
 
+%patch61 -p1 -b .ticketkeys
+
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
 
@@ -687,6 +692,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Oct 10 2017 Patrick Uiterwijk <patrick@puiterwijk.org> - 2.4.28-2
+- Backport patch for fixing ticket key usage
+
 * Fri Oct 06 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.28-1
 - new version 2.4.28
 

From 41db69f9b8fcb76650e41bc356f505629dd40dfd Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <patrick@puiterwijk.org>
Date: Tue, 10 Oct 2017 13:31:46 +0200
Subject: [PATCH 060/359] Backport patch for fixing ticket key usage

Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
---
 httpd-2.4.27-fixticketkeys.patch | 65 ++++++++++++++++++++++++++++++++
 httpd.spec                       | 10 ++++-
 2 files changed, 74 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.27-fixticketkeys.patch

diff --git a/httpd-2.4.27-fixticketkeys.patch b/httpd-2.4.27-fixticketkeys.patch
new file mode 100644
index 0000000..3769da9
--- /dev/null
+++ b/httpd-2.4.27-fixticketkeys.patch
@@ -0,0 +1,65 @@
+From 4171fbfcb249e63f934471054d7a0752272fb8ee Mon Sep 17 00:00:00 2001
+From: Yann Ylavic <ylavic@apache.org>
+Date: Tue, 22 Mar 2016 13:09:17 +0000
+Subject: [PATCH] mod_ssl: return non ambigous value in
+ ssl_callback_SessionTicket() for encryption mode (we used to return 0,
+ OpenSSL documents returning 1 instead).
+
+Practically this does not change anything since OpenSSL will only check for
+>= 0 return value (non error) for encryption mode (the other possible return
+values are only relevant for decryption mode).
+
+However the OpenSSL documentation for SSL_CTX_set_tlsext_ticket_key_cb()
+states:
+"
+The return value of the cb function is used by OpenSSL to determine what
+further processing will occur. The following return values have meaning:
+
+2
+    This indicates that the ctx and hctx have been set and the session can
+    continue on those parameters. Additionally it indicates that the session
+    ticket is in a renewal period and should be replaced. The OpenSSL library
+    will call cb again with an enc argument of 1 to set the new ticket (see
+    RFC5077 3.3 paragraph 2).
+
+1
+    This indicates that the ctx and hctx have been set and the session can
+    continue on those parameters.
+
+0
+    This indicates that it was not possible to set/retrieve a session ticket
+    and the SSL/TLS session will continue by by negotiating a set of
+    cryptographic parameters or using the alternate SSL/TLS resumption
+    mechanism, session ids.
+    If called with enc equal to 0 the library will call the cb again to get a
+    new set of parameters.
+
+less than 0
+    This indicates an error.
+"
+
+So 0 is not appropriate in our code, 1 is what we really want (and it won't
+break if OpenSSL later changes its checks on the callback return value).
+
+Reported by: oknet on github, pull request #18.
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1736186 13f79535-47bb-0310-9956-ffa450edef68
+---
+ modules/ssl/ssl_engine_kernel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
+index 91da94c4f58..91d5e926d66 100644
+--- a/modules/ssl/ssl_engine_kernel.c
++++ b/modules/ssl/ssl_engine_kernel.c
+@@ -2303,7 +2303,7 @@ int ssl_callback_SessionTicket(SSL *ssl,
+                       "TLS session ticket key for %s successfully set, "
+                       "creating new session ticket", sc->vhost_id);
+ 
+-        return 0;
++        return 1;
+     }
+     else if (mode == 0) {
+         /* 
diff --git a/httpd.spec b/httpd.spec
index 684d071..d0564d3 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,7 +8,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 7%{?dist}
+Release: 8%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -71,6 +71,9 @@ Patch59: httpd-2.4.27-CVE-2017-9798.patch
 Patch60: httpd-2.4.27-r1808230.patch
 # Security fixes
 
+# https://github.com/apache/httpd/commit/4171fbfcb249e63f934471054d7a0752272fb8ee
+Patch61: httpd-2.4.27-fixticketkeys.patch
+
 License: ASL 2.0
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
@@ -218,6 +221,8 @@ interface for storing and accessing per-user session data.
 %patch59 -p4 -b .cve-2017-9798
 %patch60 -p1 -b .r1808230
 
+%patch61 -p1 -b .ticketkeys
+
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
 
@@ -696,6 +701,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Oct 10 2017 Patrick Uiterwijk <patrick@puiterwijk.org> - 2.4.27-8
+- Backport patch for fixing ticket key usage
+
 * Mon Oct  9 2017 Joe Orton <jorton@redhat.com> - 2.4.27-7
 - move httpd.service.d, httpd.socket.d dirs to -filesystem
 - add new content-length filter (upstream PR 61222)

From ff612b7eda5a2d2002bf31038e9348362ebfa3ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Tue, 10 Oct 2017 16:06:57 +0200
Subject: [PATCH 061/359] new version 2.4.28

---
 .gitignore                           |  1 +
 httpd-2.4.10-sigint.patch            | 28 ----------------------------
 httpd-2.4.17-socket-activation.patch | 19 +++++++++----------
 httpd-2.4.27-CVE-2017-9798.patch     | 15 ---------------
 httpd.spec                           | 11 +++++------
 sources                              |  2 +-
 6 files changed, 16 insertions(+), 60 deletions(-)
 delete mode 100644 httpd-2.4.10-sigint.patch
 delete mode 100644 httpd-2.4.27-CVE-2017-9798.patch

diff --git a/.gitignore b/.gitignore
index e364382..2f07a6e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,3 +28,4 @@ x86_64
 /httpd.service.8
 /httpd-2.4.26.tar.bz2
 /httpd-2.4.27.tar.bz2
+/httpd-2.4.28.tar.bz2
diff --git a/httpd-2.4.10-sigint.patch b/httpd-2.4.10-sigint.patch
deleted file mode 100644
index ecdd82e..0000000
--- a/httpd-2.4.10-sigint.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/server/mpm/prefork/prefork.c b/server/mpm/prefork/prefork.c
-index 559f90a..a386a75 100644
---- a/server/mpm/prefork/prefork.c
-+++ b/server/mpm/prefork/prefork.c
-@@ -220,6 +220,9 @@ static void clean_child_exit(int code)
- {
-     retained->mpm->mpm_state = AP_MPMQ_STOPPING;
- 
-+    apr_signal(SIGHUP, SIG_IGN);
-+    apr_signal(SIGTERM, SIG_IGN);
-+
-     if (pchild) {
-         apr_pool_destroy(pchild);
-     }
-@@ -699,6 +702,13 @@ static int make_child(server_rec *s, int slot, int bucket)
-          */
-         apr_signal(SIGHUP, just_die);
-         apr_signal(SIGTERM, just_die);
-+        /* Ignore SIGINT in child. This fixes race-condition in signals
-+         * handling when httpd is runnning on foreground and user hits ctrl+c.
-+         * In this case, SIGINT is sent to all children followed by SIGTERM
-+         * from the main process, which interrupts the SIGINT handler and
-+         * leads to inconsistency.
-+         */
-+        apr_signal(SIGINT, SIG_IGN);
-         /* The child process just closes listeners on AP_SIG_GRACEFUL.
-          * The pod is used for signalling the graceful restart.
-          */
diff --git a/httpd-2.4.17-socket-activation.patch b/httpd-2.4.17-socket-activation.patch
index d5cbdf2..dbdd80c 100644
--- a/httpd-2.4.17-socket-activation.patch
+++ b/httpd-2.4.17-socket-activation.patch
@@ -1,5 +1,5 @@
 diff --git a/server/listen.c b/server/listen.c
-index 1d9be83..f5f7754 100644
+index a8e9e6f..1a6c1d3 100644
 --- a/server/listen.c
 +++ b/server/listen.c
 @@ -34,6 +34,10 @@
@@ -100,11 +100,10 @@ index 1d9be83..f5f7754 100644
      }
  
  #ifdef WIN32
-@@ -277,6 +286,124 @@ static apr_status_t close_listeners_on_exec(void *v)
-     return APR_SUCCESS;
+@@ -315,6 +324,123 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
+     return found;
  }
  
-+
 +#ifdef HAVE_SYSTEMD
 +
 +static int find_systemd_socket(process_rec * process, apr_port_t port) {
@@ -222,10 +221,10 @@ index 1d9be83..f5f7754 100644
 +
 +#endif /* HAVE_SYSTEMD */
 +
- static const char *alloc_listener(process_rec *process, char *addr,
+ static const char *alloc_listener(process_rec *process, const char *addr,
                                    apr_port_t port, const char* proto,
                                    void *slave)
-@@ -479,7 +606,7 @@ static int open_listeners(apr_pool_t *pool)
+@@ -495,7 +621,7 @@ static int open_listeners(apr_pool_t *pool)
                  }
              }
  #endif
@@ -234,7 +233,7 @@ index 1d9be83..f5f7754 100644
                  ++num_open;
              }
              else {
-@@ -591,8 +718,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+@@ -607,8 +733,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
          }
      }
  
@@ -265,7 +264,7 @@ index 1d9be83..f5f7754 100644
      }
  
      for (lr = ap_listeners; lr; lr = lr->next) {
-@@ -682,7 +829,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
+@@ -698,7 +844,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
                              duplr->bind_addr);
                  return stat;
              }
@@ -274,7 +273,7 @@ index 1d9be83..f5f7754 100644
  #if AP_NONBLOCK_WHEN_MULTI_LISTEN
              use_nonblock = (ap_listeners && ap_listeners->next);
              stat = apr_socket_opt_set(duplr->sd, APR_SO_NONBLOCK, use_nonblock);
-@@ -809,6 +956,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -825,6 +971,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
      if (argc < 1 || argc > 2) {
          return "Listen requires 1 or 2 arguments.";
      }
@@ -286,7 +285,7 @@ index 1d9be83..f5f7754 100644
  
      rv = apr_parse_addr_port(&host, &scope_id, &port, argv[0], cmd->pool);
      if (rv != APR_SUCCESS) {
-@@ -840,6 +992,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -856,6 +1007,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
          ap_str_tolower(proto);
      }
  
diff --git a/httpd-2.4.27-CVE-2017-9798.patch b/httpd-2.4.27-CVE-2017-9798.patch
deleted file mode 100644
index be590f2..0000000
--- a/httpd-2.4.27-CVE-2017-9798.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- httpd/httpd/branches/2.4.x/server/core.c	2017/08/16 16:50:29	1805223
-+++ httpd/httpd/branches/2.4.x/server/core.c	2017/09/08 13:13:11	1807754
-@@ -2266,6 +2266,12 @@
-             /* method has not been registered yet, but resource restriction
-              * is always checked before method handling, so register it.
-              */
-+            if (cmd->pool == cmd->temp_pool) {
-+                /* In .htaccess, we can't globally register new methods. */
-+                return apr_psprintf(cmd->pool, "Could not register method '%s' "
-+                                   "for %s from .htaccess configuration",
-+                                    method, cmd->cmd->name);
-+            }
-             methnum = ap_method_register(cmd->pool,
-                                          apr_pstrdup(cmd->pool, method));
-         }
diff --git a/httpd.spec b/httpd.spec
index d0564d3..379021a 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -7,8 +7,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.27
-Release: 8%{?dist}
+Version: 2.4.28
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -64,10 +64,8 @@ Patch34: httpd-2.4.17-socket-activation.patch
 Patch35: httpd-2.4.17-sslciphdefault.patch
 # Bug fixes
 Patch56: httpd-2.4.4-mod_unique_id.patch
-Patch57: httpd-2.4.10-sigint.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.25-r1738878.patch
-Patch59: httpd-2.4.27-CVE-2017-9798.patch
 Patch60: httpd-2.4.27-r1808230.patch
 # Security fixes
 
@@ -216,9 +214,7 @@ interface for storing and accessing per-user session data.
 %patch35 -p1 -b .sslciphdefault
 
 %patch56 -p1 -b .uniqueid
-%patch57 -p1 -b .sigint
 %patch58 -p1 -b .r1738878
-%patch59 -p4 -b .cve-2017-9798
 %patch60 -p1 -b .r1808230
 
 %patch61 -p1 -b .ticketkeys
@@ -701,6 +697,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Oct 10 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.28-1
+- new version 2.4.28
+
 * Tue Oct 10 2017 Patrick Uiterwijk <patrick@puiterwijk.org> - 2.4.27-8
 - Backport patch for fixing ticket key usage
 
diff --git a/sources b/sources
index dafe33c..2db6285 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.27.tar.bz2) = 7e7e8070715b74cb6890096a74e194f4c6a49c14bda685b1ad832e84312f1ac4316ea03a430e679502bfd8e1853aefa544ee002a20d0f7e994b9a590c74bc42c
+SHA512 (httpd-2.4.28.tar.bz2) = 8de8e32b87e6de220e492e74db9df0882fae11c3b9732f3d3316da048c04767ac4429c0433c36f87d8705263e3376f97a7e1f66a9d7a518632a67b6fe617590a

From 596b5fc517852e60be8e61e1e83a048d1218f575 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 10 Oct 2017 15:23:11 +0100
Subject: [PATCH 062/359] drop obsolete Obsoletes update docs, Summary trim
 %changelog

---
 httpd.spec | 147 +++++------------------------------------------------
 1 file changed, 14 insertions(+), 133 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 3c25596..ded11c5 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.28
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -106,8 +106,7 @@ web server.
 
 %package devel
 Group: Development/Libraries
-Summary: Development interfaces for the Apache HTTP server
-Obsoletes: secureweb-devel, apache-devel, stronghold-apache-devel
+Summary: Development interfaces for the Apache HTTP Server
 Requires: apr-devel, apr-util-devel, pkgconfig
 Requires: httpd = %{version}-%{release}
 
@@ -116,31 +115,30 @@ The httpd-devel package contains the APXS binary and other files
 that you need to build Dynamic Shared Objects (DSOs) for the
 Apache HTTP Server.
 
-If you are installing the Apache HTTP server and you want to be
+If you are installing the Apache HTTP Server and you want to be
 able to compile or develop additional modules for Apache, you need
 to install this package.
 
 %package manual
 Group: Documentation
-Summary: Documentation for the Apache HTTP server
+Summary: Documentation for the Apache HTTP Server
 Requires: httpd = %{version}-%{release}
-Obsoletes: secureweb-manual, apache-manual
 BuildArch: noarch
 
 %description manual
 The httpd-manual package contains the complete manual and
-reference guide for the Apache HTTP server. The information can
-also be found at http://httpd.apache.org/docs/2.2/.
+reference guide for the Apache HTTP Server. The information can
+also be found at https://httpd.apache.org/docs/2.4/.
 
 %package filesystem
 Group: System Environment/Daemons
-Summary: The basic directory layout for the Apache HTTP server
+Summary: The basic directory layout for the Apache HTTP Server
 BuildArch: noarch
 Requires(pre): /usr/sbin/useradd
 
 %description filesystem
 The httpd-filesystem package contains the basic directory layout
-for the Apache HTTP server including the correct permissions
+for the Apache HTTP Server including the correct permissions
 for the directories.
 
 %package tools
@@ -159,7 +157,6 @@ BuildRequires: openssl-devel
 Requires(pre): httpd-filesystem
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 Requires: sscg >= 2.2.0
-Obsoletes: stronghold-mod_ssl
 # Require an OpenSSL which supports PROFILE=SYSTEM
 Conflicts: openssl-libs < 1:1.0.1h-4
 
@@ -692,6 +689,11 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Oct 10 2017 Joe Orton <jorton@redhat.com> - 2.4.28-3
+- drop obsolete Obsoletes
+- update docs, Summary
+- trim %%changelog
+
 * Tue Oct 10 2017 Patrick Uiterwijk <patrick@puiterwijk.org> - 2.4.28-2
 - Backport patch for fixing ticket key usage
 
@@ -718,7 +720,7 @@ rm -rf $RPM_BUILD_ROOT
 - document httpd-init.service in httpd-init.service(8)
 
 * Wed Sep 20 2017 Stephen Gallagher <sgallagh@redhat.com> - 2.4.27-8.1
-- Generate SSL certificates on service start, not %posttrans
+- Generate SSL certificates on service start, not %%posttrans
 
 * Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-8
 - move httpd.service.d, httpd.socket.d dirs to -filesystem
@@ -1203,124 +1205,3 @@ rm -rf $RPM_BUILD_ROOT
 - split all LoadModules to conf.modules.d/*.conf
 - include conf.d/*.conf at end of httpd.conf
 - trim %%changelog
-
-* Mon Feb 13 2012 Joe Orton <jorton@redhat.com> - 2.2.22-2
-- fix build against PCRE 8.30
-
-* Mon Feb 13 2012 Joe Orton <jorton@redhat.com> - 2.2.22-1
-- update to 2.2.22
-
-* Fri Feb 10 2012 Petr Pisar <ppisar@redhat.com> - 2.2.21-8
-- Rebuild against PCRE 8.30
-
-* Mon Jan 23 2012 Jan Kaluza <jkaluza@redhat.com> - 2.2.21-7
-- fix #783629 - start httpd after named
-
-* Mon Jan 16 2012 Joe Orton <jorton@redhat.com> - 2.2.21-6
-- complete conversion to systemd, drop init script (#770311)
-- fix comments in /etc/sysconfig/httpd (#771024)
-- enable PrivateTmp in service file (#781440)
-- set LANG=C in /etc/sysconfig/httpd
-
-* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.2.21-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
-
-* Tue Dec 06 2011 Jan Kaluza <jkaluza@redhat.com> - 2.2.21-4
-- fix #751591 - start httpd after remote-fs
-
-* Mon Oct 24 2011 Jan Kaluza <jkaluza@redhat.com> - 2.2.21-3
-- allow change state of BalancerMember in mod_proxy_balancer web interface
-
-* Thu Sep 22 2011 Ville Skyttä <ville.skytta@iki.fi> - 2.2.21-2
-- Make mmn available as %%{_httpd_mmn}.
-- Add .svgz to AddEncoding x-gzip example in httpd.conf.
-
-* Tue Sep 13 2011 Joe Orton <jorton@redhat.com> - 2.2.21-1
-- update to 2.2.21
-
-* Mon Sep  5 2011 Joe Orton <jorton@redhat.com> - 2.2.20-1
-- update to 2.2.20
-- fix MPM stub man page generation
-
-* Wed Aug 10 2011 Jan Kaluza <jkaluza@redhat.com> - 2.2.19-5
-- fix #707917 - add httpd-ssl-pass-dialog to ask for SSL password using systemd
-
-* Fri Jul 22 2011 Iain Arnell <iarnell@gmail.com> 1:2.2.19-4
-- rebuild while rpm-4.9.1 is untagged to remove trailing slash in provided
-  directory names
-
-* Wed Jul 20 2011 Jan Kaluza <jkaluza@redhat.com> - 2.2.19-3
-- fix #716621 - suexec now works without setuid bit
-
-* Thu Jul 14 2011 Jan Kaluza <jkaluza@redhat.com> - 2.2.19-2
-- fix #689091 - backported patch from 2.3 branch to support IPv6 in logresolve
-
-* Fri Jul  1 2011 Joe Orton <jorton@redhat.com> - 2.2.19-1
-- update to 2.2.19
-- enable dbd, authn_dbd in default config
-
-* Thu Apr 14 2011 Joe Orton <jorton@redhat.com> - 2.2.17-13
-- fix path expansion in service files
-
-* Tue Apr 12 2011 Joe Orton <jorton@redhat.com> - 2.2.17-12
-- add systemd service files (#684175, thanks to Jóhann B. Guðmundsson)
-
-* Wed Mar 23 2011 Joe Orton <jorton@redhat.com> - 2.2.17-11
-- minor updates to httpd.conf
-- drop old patches
-
-* Wed Mar  2 2011 Joe Orton <jorton@redhat.com> - 2.2.17-10
-- rebuild
-
-* Wed Feb 23 2011 Joe Orton <jorton@redhat.com> - 2.2.17-9
-- use arch-specific mmn
-
-* Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.2.17-8
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
-
-* Mon Jan 31 2011 Joe Orton <jorton@redhat.com> - 2.2.17-7
-- generate dummy mod_ssl cert with CA:FALSE constraint (#667841)
-- add man page stubs for httpd.event, httpd.worker
-- drop distcache support
-- add STOP_TIMEOUT support to init script
-
-* Sat Jan  8 2011 Joe Orton <jorton@redhat.com> - 2.2.17-6
-- update default SSLCipherSuite per upstream trunk
-
-* Wed Jan  5 2011 Joe Orton <jorton@redhat.com> - 2.2.17-5
-- fix requires (#667397)
-
-* Wed Jan  5 2011 Joe Orton <jorton@redhat.com> - 2.2.17-4
-- de-ghost /var/run/httpd
-
-* Tue Jan  4 2011 Joe Orton <jorton@redhat.com> - 2.2.17-3
-- add tmpfiles.d configuration, ghost /var/run/httpd (#656600)
-
-* Sat Nov 20 2010 Joe Orton <jorton@redhat.com> - 2.2.17-2
-- drop setuid bit, use capabilities for suexec binary
-
-* Wed Oct 27 2010 Joe Orton <jorton@redhat.com> - 2.2.17-1
-- update to 2.2.17
-
-* Fri Sep 10 2010 Joe Orton <jorton@redhat.com> - 2.2.16-2
-- link everything using -z relro and -z now
-
-* Mon Jul 26 2010 Joe Orton <jorton@redhat.com> - 2.2.16-1
-- update to 2.2.16
-
-* Fri Jul  9 2010 Joe Orton <jorton@redhat.com> - 2.2.15-3
-- default config tweaks:
- * harden httpd.conf w.r.t. .htaccess restriction (#591293)
- * load mod_substitute, mod_version by default
- * drop proxy_ajp.conf, load mod_proxy_ajp in httpd.conf
- * add commented list of shipped-but-unloaded modules
- * bump up worker defaults a little
- * drop KeepAliveTimeout to 5 secs per upstream
-- fix LSB compliance in init script (#522074)
-- bundle NOTICE in -tools
-- use init script in logrotate postrotate to pick up PIDFILE
-- drop some old Obsoletes/Conflicts
-
-* Sun Apr 04 2010 Robert Scheck <robert@fedoraproject.org> - 2.2.15-1
-- update to 2.2.15 (#572404, #579311)
-

From 082f3536aa8b73283eede9cf867eefd01c8597fb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 25 Oct 2017 14:20:19 +0200
Subject: [PATCH 063/359] new version 2.4.29

---
 httpd.spec | 7 +++++--
 sources    | 2 +-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index ded11c5..505f241 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.28
-Release: 3%{?dist}
+Version: 2.4.29
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -689,6 +689,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Oct 25 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.29-1
+- new version 2.4.29
+
 * Tue Oct 10 2017 Joe Orton <jorton@redhat.com> - 2.4.28-3
 - drop obsolete Obsoletes
 - update docs, Summary
diff --git a/sources b/sources
index 2db6285..6978287 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.28.tar.bz2) = 8de8e32b87e6de220e492e74db9df0882fae11c3b9732f3d3316da048c04767ac4429c0433c36f87d8705263e3376f97a7e1f66a9d7a518632a67b6fe617590a
+SHA512 (httpd-2.4.29.tar.bz2) = 840982fd3d21463bc5c1747f211dfacf3abdf634d149e49bb49fd2e5deda140de602dbdf31e1bbe5337a48f718ab2261c408e83a8dd39a9291ee7b6b7a85639a

From 16b03b20d8a2c18913e94ab6653c66deb5922ace Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 25 Oct 2017 14:28:47 +0200
Subject: [PATCH 064/359] Removed patches, which are already included in
 upstream source

---
 httpd-2.4.27-fixticketkeys.patch |  65 ---------
 httpd-2.4.27-r1808230.patch      | 131 -----------------
 httpd-2.4.4-mod_unique_id.patch  | 239 -------------------------------
 httpd.spec                       |  12 +-
 4 files changed, 2 insertions(+), 445 deletions(-)
 delete mode 100644 httpd-2.4.27-fixticketkeys.patch
 delete mode 100644 httpd-2.4.27-r1808230.patch
 delete mode 100644 httpd-2.4.4-mod_unique_id.patch

diff --git a/httpd-2.4.27-fixticketkeys.patch b/httpd-2.4.27-fixticketkeys.patch
deleted file mode 100644
index 3769da9..0000000
--- a/httpd-2.4.27-fixticketkeys.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 4171fbfcb249e63f934471054d7a0752272fb8ee Mon Sep 17 00:00:00 2001
-From: Yann Ylavic <ylavic@apache.org>
-Date: Tue, 22 Mar 2016 13:09:17 +0000
-Subject: [PATCH] mod_ssl: return non ambigous value in
- ssl_callback_SessionTicket() for encryption mode (we used to return 0,
- OpenSSL documents returning 1 instead).
-
-Practically this does not change anything since OpenSSL will only check for
->= 0 return value (non error) for encryption mode (the other possible return
-values are only relevant for decryption mode).
-
-However the OpenSSL documentation for SSL_CTX_set_tlsext_ticket_key_cb()
-states:
-"
-The return value of the cb function is used by OpenSSL to determine what
-further processing will occur. The following return values have meaning:
-
-2
-    This indicates that the ctx and hctx have been set and the session can
-    continue on those parameters. Additionally it indicates that the session
-    ticket is in a renewal period and should be replaced. The OpenSSL library
-    will call cb again with an enc argument of 1 to set the new ticket (see
-    RFC5077 3.3 paragraph 2).
-
-1
-    This indicates that the ctx and hctx have been set and the session can
-    continue on those parameters.
-
-0
-    This indicates that it was not possible to set/retrieve a session ticket
-    and the SSL/TLS session will continue by by negotiating a set of
-    cryptographic parameters or using the alternate SSL/TLS resumption
-    mechanism, session ids.
-    If called with enc equal to 0 the library will call the cb again to get a
-    new set of parameters.
-
-less than 0
-    This indicates an error.
-"
-
-So 0 is not appropriate in our code, 1 is what we really want (and it won't
-break if OpenSSL later changes its checks on the callback return value).
-
-Reported by: oknet on github, pull request #18.
-
-
-
-git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1736186 13f79535-47bb-0310-9956-ffa450edef68
----
- modules/ssl/ssl_engine_kernel.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
-index 91da94c4f58..91d5e926d66 100644
---- a/modules/ssl/ssl_engine_kernel.c
-+++ b/modules/ssl/ssl_engine_kernel.c
-@@ -2303,7 +2303,7 @@ int ssl_callback_SessionTicket(SSL *ssl,
-                       "TLS session ticket key for %s successfully set, "
-                       "creating new session ticket", sc->vhost_id);
- 
--        return 0;
-+        return 1;
-     }
-     else if (mode == 0) {
-         /* 
diff --git a/httpd-2.4.27-r1808230.patch b/httpd-2.4.27-r1808230.patch
deleted file mode 100644
index e4062ea..0000000
--- a/httpd-2.4.27-r1808230.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-# ./pullrev.sh 1808230
-http://svn.apache.org/viewvc?view=revision&revision=1808230
-
---- httpd-2.4.27/server/protocol.c
-+++ httpd-2.4.27/server/protocol.c
-@@ -1708,62 +1708,88 @@
-         ctx->tmpbb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
-     }
- 
--    /* Loop through this set of buckets to compute their length
--     */
-+    /* Loop through the brigade to count the length. To avoid
-+     * arbitrary memory consumption with morphing bucket types, this
-+     * loop will stop and pass on the brigade when necessary. */
-     e = APR_BRIGADE_FIRST(b);
-     while (e != APR_BRIGADE_SENTINEL(b)) {
-+        apr_status_t rv;
-+
-         if (APR_BUCKET_IS_EOS(e)) {
-             eos = 1;
-             break;
-         }
--        if (e->length == (apr_size_t)-1) {
-+        /* For a flush bucket, fall through to pass the brigade and
-+         * flush now. */
-+        else if (APR_BUCKET_IS_FLUSH(e)) {
-+            e = APR_BUCKET_NEXT(e);
-+        }
-+        /* For metadata bucket types other than FLUSH, loop. */
-+        else if (APR_BUCKET_IS_METADATA(e)) {
-+            e = APR_BUCKET_NEXT(e);
-+            continue;
-+        }
-+        /* For determinate length data buckets, count the length and
-+         * continue. */
-+        else if (e->length != (apr_size_t)-1) {
-+            r->bytes_sent += e->length;
-+            e = APR_BUCKET_NEXT(e);
-+            continue;
-+        }
-+        /* For indeterminate length data buckets, perform one read. */
-+        else /* e->length == (apr_size_t)-1 */ {
-             apr_size_t len;
-             const char *ignored;
--            apr_status_t rv;
--
--            /* This is probably a pipe bucket.  Send everything
--             * prior to this, and then read the data for this bucket.
--             */
-+        
-             rv = apr_bucket_read(e, &ignored, &len, eblock);
-+            if ((rv != APR_SUCCESS) && !APR_STATUS_IS_EAGAIN(rv)) {
-+                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
-+                              "ap_content_length_filter: "
-+                              "apr_bucket_read() failed");
-+                return rv;
-+            }
-             if (rv == APR_SUCCESS) {
--                /* Attempt a nonblocking read next time through */
-                 eblock = APR_NONBLOCK_READ;
-+                e = APR_BUCKET_NEXT(e);
-                 r->bytes_sent += len;
-             }
-             else if (APR_STATUS_IS_EAGAIN(rv)) {
--                /* Output everything prior to this bucket, and then
--                 * do a blocking read on the next batch.
--                 */
--                if (e != APR_BRIGADE_FIRST(b)) {
--                    apr_bucket *flush;
--                    apr_brigade_split_ex(b, e, ctx->tmpbb);
--                    flush = apr_bucket_flush_create(r->connection->bucket_alloc);
-+                apr_bucket *flush;
- 
--                    APR_BRIGADE_INSERT_TAIL(b, flush);
--                    rv = ap_pass_brigade(f->next, b);
--                    if (rv != APR_SUCCESS || f->c->aborted) {
--                        return rv;
--                    }
--                    apr_brigade_cleanup(b);
--                    APR_BRIGADE_CONCAT(b, ctx->tmpbb);
--                    e = APR_BRIGADE_FIRST(b);
-+                /* Next read must block. */
-+                eblock = APR_BLOCK_READ;
- 
--                    ctx->data_sent = 1;
--                }
--                eblock = APR_BLOCK_READ;
--                continue;
-+                /* Ensure the last bucket to pass down is a flush if
-+                 * the next read will block. */
-+                flush = apr_bucket_flush_create(f->c->bucket_alloc);
-+                APR_BUCKET_INSERT_BEFORE(e, flush);
-             }
--            else {
--                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
--                              "ap_content_length_filter: "
--                              "apr_bucket_read() failed");
--                return rv;
--            }
-         }
--        else {
--            r->bytes_sent += e->length;
-+
-+        /* Optimization: if the next bucket is EOS (directly after a
-+         * bucket morphed to the heap, or a flush), short-cut to
-+         * handle EOS straight away - allowing C-L to be determined
-+         * for content which is already entirely in memory. */
-+        if (e != APR_BRIGADE_SENTINEL(b) && APR_BUCKET_IS_EOS(e)) {
-+            continue;
-         }
--        e = APR_BUCKET_NEXT(e);
-+
-+        /* On reaching here, pass on everything in the brigade up to
-+         * this point. */
-+        apr_brigade_split_ex(b, e, ctx->tmpbb);
-+        
-+        rv = ap_pass_brigade(f->next, b);
-+        if (rv != APR_SUCCESS) {
-+            return rv;
-+        }
-+        else if (f->c->aborted) {
-+            return APR_ECONNABORTED;
-+        }
-+        apr_brigade_cleanup(b);
-+        APR_BRIGADE_CONCAT(b, ctx->tmpbb);
-+        e = APR_BRIGADE_FIRST(b);
-+        
-+        ctx->data_sent = 1;
-     }
- 
-     /* If we've now seen the entire response and it's otherwise
diff --git a/httpd-2.4.4-mod_unique_id.patch b/httpd-2.4.4-mod_unique_id.patch
deleted file mode 100644
index 30bdfe0..0000000
--- a/httpd-2.4.4-mod_unique_id.patch
+++ /dev/null
@@ -1,239 +0,0 @@
---- trunk/modules/metadata/mod_unique_id.c	2011/12/02 23:02:04	1209766
-+++ trunk/modules/metadata/mod_unique_id.c	2013/07/10 16:20:31	1501827
-@@ -31,14 +31,11 @@
- #include "http_log.h"
- #include "http_protocol.h"  /* for ap_hook_post_read_request */
- 
--#if APR_HAVE_UNISTD_H
--#include <unistd.h>         /* for getpid() */
--#endif
-+#define ROOT_SIZE 10
- 
- typedef struct {
-     unsigned int stamp;
--    unsigned int in_addr;
--    unsigned int pid;
-+    char root[ROOT_SIZE];
-     unsigned short counter;
-     unsigned int thread_index;
- } unique_id_rec;
-@@ -64,20 +61,15 @@
-  * gethostbyname (gethostname()) is unique across all the machines at the
-  * "site".
-  *
-- * We also further assume that pids fit in 32-bits.  If something uses more
-- * than 32-bits, the fix is trivial, but it requires the unrolled uuencoding
-- * loop to be extended.  * A similar fix is needed to support multithreaded
-- * servers, using a pid/tid combo.
-- *
-- * Together, the in_addr and pid are assumed to absolutely uniquely identify
-- * this one child from all other currently running children on all servers
-- * (including this physical server if it is running multiple httpds) from each
-+ * The root is assumed to absolutely uniquely identify this one child
-+ * from all other currently running children on all servers (including
-+ * this physical server if it is running multiple httpds) from each
-  * other.
-  *
-- * The stamp and counter are used to distinguish all hits for a particular
-- * (in_addr,pid) pair.  The stamp is updated using r->request_time,
-- * saving cpu cycles.  The counter is never reset, and is used to permit up to
-- * 64k requests in a single second by a single child.
-+ * The stamp and counter are used to distinguish all hits for a
-+ * particular root.  The stamp is updated using r->request_time,
-+ * saving cpu cycles.  The counter is never reset, and is used to
-+ * permit up to 64k requests in a single second by a single child.
-  *
-  * The 144-bits of unique_id_rec are encoded using the alphabet
-  * [A-Za-z0-9@-], resulting in 24 bytes of printable characters.  That is then
-@@ -92,7 +84,7 @@
-  * module change.
-  *
-  * It is highly desirable that identifiers exist for "eternity".  But future
-- * needs (such as much faster webservers, moving to 64-bit pids, or moving to a
-+ * needs (such as much faster webservers, or moving to a
-  * multithreaded server) may dictate a need to change the contents of
-  * unique_id_rec.  Such a future implementation should ensure that the first
-  * field is still a time_t stamp.  By doing that, it is possible for a site to
-@@ -100,7 +92,15 @@
-  * wait one entire second, and then start all of their new-servers.  This
-  * procedure will ensure that the new space of identifiers is completely unique
-  * from the old space.  (Since the first four unencoded bytes always differ.)
-+ *
-+ * Note: previous implementations used 32-bits of IP address plus pid
-+ * in place of the PRNG output in the "root" field.  This was
-+ * insufficient for IPv6-only hosts, required working DNS to determine
-+ * a unique IP address (fragile), and needed a [0, 1) second sleep
-+ * call at startup to avoid pid reuse.  Use of the PRNG avoids all
-+ * these issues.
-  */
-+
- /*
-  * Sun Jun  7 05:43:49 CEST 1998 -- Alvaro
-  * More comments:
-@@ -116,8 +116,6 @@
-  * htonl/ntohl. Well, this shouldn't be a problem till year 2106.
-  */
- 
--static unsigned global_in_addr;
--
- /*
-  * XXX: We should have a per-thread counter and not use cur_unique_id.counter
-  * XXX: in all threads, because this is bad for performance on multi-processor
-@@ -129,7 +127,7 @@
- /*
-  * Number of elements in the structure unique_id_rec.
-  */
--#define UNIQUE_ID_REC_MAX 5
-+#define UNIQUE_ID_REC_MAX 4
- 
- static unsigned short unique_id_rec_offset[UNIQUE_ID_REC_MAX],
-                       unique_id_rec_size[UNIQUE_ID_REC_MAX],
-@@ -138,113 +136,32 @@
- 
- static int unique_id_global_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *main_server)
- {
--    char str[APRMAXHOSTLEN + 1];
--    apr_status_t rv;
--    char *ipaddrstr;
--    apr_sockaddr_t *sockaddr;
--
-     /*
-      * Calculate the sizes and offsets in cur_unique_id.
-      */
-     unique_id_rec_offset[0] = APR_OFFSETOF(unique_id_rec, stamp);
-     unique_id_rec_size[0] = sizeof(cur_unique_id.stamp);
--    unique_id_rec_offset[1] = APR_OFFSETOF(unique_id_rec, in_addr);
--    unique_id_rec_size[1] = sizeof(cur_unique_id.in_addr);
--    unique_id_rec_offset[2] = APR_OFFSETOF(unique_id_rec, pid);
--    unique_id_rec_size[2] = sizeof(cur_unique_id.pid);
--    unique_id_rec_offset[3] = APR_OFFSETOF(unique_id_rec, counter);
--    unique_id_rec_size[3] = sizeof(cur_unique_id.counter);
--    unique_id_rec_offset[4] = APR_OFFSETOF(unique_id_rec, thread_index);
--    unique_id_rec_size[4] = sizeof(cur_unique_id.thread_index);
-+    unique_id_rec_offset[1] = APR_OFFSETOF(unique_id_rec, root);
-+    unique_id_rec_size[1] = sizeof(cur_unique_id.root);
-+    unique_id_rec_offset[2] = APR_OFFSETOF(unique_id_rec, counter);
-+    unique_id_rec_size[2] = sizeof(cur_unique_id.counter);
-+    unique_id_rec_offset[3] = APR_OFFSETOF(unique_id_rec, thread_index);
-+    unique_id_rec_size[3] = sizeof(cur_unique_id.thread_index);
-     unique_id_rec_total_size = unique_id_rec_size[0] + unique_id_rec_size[1] +
--                               unique_id_rec_size[2] + unique_id_rec_size[3] +
--                               unique_id_rec_size[4];
-+                               unique_id_rec_size[2] + unique_id_rec_size[3];
- 
-     /*
-      * Calculate the size of the structure when encoded.
-      */
-     unique_id_rec_size_uu = (unique_id_rec_total_size*8+5)/6;
- 
--    /*
--     * Now get the global in_addr.  Note that it is not sufficient to use one
--     * of the addresses from the main_server, since those aren't as likely to
--     * be unique as the physical address of the machine
--     */
--    if ((rv = apr_gethostname(str, sizeof(str) - 1, p)) != APR_SUCCESS) {
--        ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01563)
--          "unable to find hostname of the server");
--        return HTTP_INTERNAL_SERVER_ERROR;
--    }
--
--    if ((rv = apr_sockaddr_info_get(&sockaddr, str, AF_INET, 0, 0, p)) == APR_SUCCESS) {
--        global_in_addr = sockaddr->sa.sin.sin_addr.s_addr;
--    }
--    else {
--        ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01564)
--                    "unable to find IPv4 address of \"%s\"", str);
--#if APR_HAVE_IPV6
--        if ((rv = apr_sockaddr_info_get(&sockaddr, str, AF_INET6, 0, 0, p)) == APR_SUCCESS) {
--            memcpy(&global_in_addr,
--                   (char *)sockaddr->ipaddr_ptr + sockaddr->ipaddr_len - sizeof(global_in_addr),
--                   sizeof(global_in_addr));
--            ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01565)
--                         "using low-order bits of IPv6 address "
--                         "as if they were unique");
--        }
--        else
--#endif
--        return HTTP_INTERNAL_SERVER_ERROR;
--    }
--
--    apr_sockaddr_ip_get(&ipaddrstr, sockaddr);
--    ap_log_error(APLOG_MARK, APLOG_INFO, 0, main_server, APLOGNO(01566) "using ip addr %s",
--                 ipaddrstr);
--
--    /*
--     * If the server is pummelled with restart requests we could possibly end
--     * up in a situation where we're starting again during the same second
--     * that has been used in previous identifiers.  Avoid that situation.
--     *
--     * In truth, for this to actually happen not only would it have to restart
--     * in the same second, but it would have to somehow get the same pids as
--     * one of the other servers that was running in that second. Which would
--     * mean a 64k wraparound on pids ... not very likely at all.
--     *
--     * But protecting against it is relatively cheap.  We just sleep into the
--     * next second.
--     */
--    apr_sleep(apr_time_from_sec(1) - apr_time_usec(apr_time_now()));
-     return OK;
- }
- 
- static void unique_id_child_init(apr_pool_t *p, server_rec *s)
- {
--    pid_t pid;
--
--    /*
--     * Note that we use the pid because it's possible that on the same
--     * physical machine there are multiple servers (i.e. using Listen). But
--     * it's guaranteed that none of them will share the same pids between
--     * children.
--     *
--     * XXX: for multithread this needs to use a pid/tid combo and probably
--     * needs to be expanded to 32 bits
--     */
--    pid = getpid();
--    cur_unique_id.pid = pid;
--
--    /*
--     * Test our assumption that the pid is 32-bits.  It's possible that
--     * 64-bit machines will declare pid_t to be 64 bits but only use 32
--     * of them.  It would have been really nice to test this during
--     * global_init ... but oh well.
--     */
--    if ((pid_t)cur_unique_id.pid != pid) {
--        ap_log_error(APLOG_MARK, APLOG_CRIT, 0, s, APLOGNO(01567)
--                    "oh no! pids are greater than 32-bits!  I'm broken!");
--    }
--
--    cur_unique_id.in_addr = global_in_addr;
-+    ap_random_insecure_bytes(&cur_unique_id.root,
-+                             sizeof(cur_unique_id.root));
- 
-     /*
-      * If we use 0 as the initial counter we have a little less protection
-@@ -253,13 +170,6 @@
-      */
-     ap_random_insecure_bytes(&cur_unique_id.counter,
-                              sizeof(cur_unique_id.counter));
--
--    /*
--     * We must always use network ordering for these bytes, so that
--     * identifiers are comparable between machines of different byte
--     * orderings.  Note in_addr is already in network order.
--     */
--    cur_unique_id.pid = htonl(cur_unique_id.pid);
- }
- 
- /* NOTE: This is *NOT* the same encoding used by base64encode ... the last two
-@@ -291,10 +201,8 @@
-     unsigned short counter;
-     int i,j,k;
- 
--    new_unique_id.in_addr = cur_unique_id.in_addr;
--    new_unique_id.pid = cur_unique_id.pid;
-+    memcpy(&new_unique_id.root, &cur_unique_id.root, ROOT_SIZE);
-     new_unique_id.counter = cur_unique_id.counter;
--
-     new_unique_id.stamp = htonl((unsigned int)apr_time_sec(r->request_time));
-     new_unique_id.thread_index = htonl((unsigned int)r->connection->id);
- 
diff --git a/httpd.spec b/httpd.spec
index 505f241..ad2efc5 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -69,15 +69,12 @@ Patch30: httpd-2.4.4-cachehardmax.patch
 Patch31: httpd-2.4.18-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
 Patch35: httpd-2.4.17-sslciphdefault.patch
+
 # Bug fixes
-Patch56: httpd-2.4.4-mod_unique_id.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.25-r1738878.patch
-Patch60: httpd-2.4.27-r1808230.patch
-# Security fixes
 
-# https://github.com/apache/httpd/commit/4171fbfcb249e63f934471054d7a0752272fb8ee
-Patch61: httpd-2.4.27-fixticketkeys.patch
+# Security fixes
 
 License: ASL 2.0
 Group: System Environment/Daemons
@@ -216,12 +213,7 @@ interface for storing and accessing per-user session data.
 %patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
-
-%patch56 -p1 -b .uniqueid
 %patch58 -p1 -b .r1738878
-%patch60 -p1 -b .r1808230
-
-%patch61 -p1 -b .ticketkeys
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h

From 317bdd7eb806872a5229d626789d328701b37b5f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 25 Oct 2017 14:31:34 +0200
Subject: [PATCH 065/359] new version 2.4.29

---
 httpd-2.4.27-fixticketkeys.patch |  65 ---------
 httpd-2.4.27-r1808230.patch      | 131 -----------------
 httpd-2.4.4-mod_unique_id.patch  | 239 -------------------------------
 httpd.spec                       |  17 +--
 sources                          |   2 +-
 5 files changed, 6 insertions(+), 448 deletions(-)
 delete mode 100644 httpd-2.4.27-fixticketkeys.patch
 delete mode 100644 httpd-2.4.27-r1808230.patch
 delete mode 100644 httpd-2.4.4-mod_unique_id.patch

diff --git a/httpd-2.4.27-fixticketkeys.patch b/httpd-2.4.27-fixticketkeys.patch
deleted file mode 100644
index 3769da9..0000000
--- a/httpd-2.4.27-fixticketkeys.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 4171fbfcb249e63f934471054d7a0752272fb8ee Mon Sep 17 00:00:00 2001
-From: Yann Ylavic <ylavic@apache.org>
-Date: Tue, 22 Mar 2016 13:09:17 +0000
-Subject: [PATCH] mod_ssl: return non ambigous value in
- ssl_callback_SessionTicket() for encryption mode (we used to return 0,
- OpenSSL documents returning 1 instead).
-
-Practically this does not change anything since OpenSSL will only check for
->= 0 return value (non error) for encryption mode (the other possible return
-values are only relevant for decryption mode).
-
-However the OpenSSL documentation for SSL_CTX_set_tlsext_ticket_key_cb()
-states:
-"
-The return value of the cb function is used by OpenSSL to determine what
-further processing will occur. The following return values have meaning:
-
-2
-    This indicates that the ctx and hctx have been set and the session can
-    continue on those parameters. Additionally it indicates that the session
-    ticket is in a renewal period and should be replaced. The OpenSSL library
-    will call cb again with an enc argument of 1 to set the new ticket (see
-    RFC5077 3.3 paragraph 2).
-
-1
-    This indicates that the ctx and hctx have been set and the session can
-    continue on those parameters.
-
-0
-    This indicates that it was not possible to set/retrieve a session ticket
-    and the SSL/TLS session will continue by by negotiating a set of
-    cryptographic parameters or using the alternate SSL/TLS resumption
-    mechanism, session ids.
-    If called with enc equal to 0 the library will call the cb again to get a
-    new set of parameters.
-
-less than 0
-    This indicates an error.
-"
-
-So 0 is not appropriate in our code, 1 is what we really want (and it won't
-break if OpenSSL later changes its checks on the callback return value).
-
-Reported by: oknet on github, pull request #18.
-
-
-
-git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1736186 13f79535-47bb-0310-9956-ffa450edef68
----
- modules/ssl/ssl_engine_kernel.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
-index 91da94c4f58..91d5e926d66 100644
---- a/modules/ssl/ssl_engine_kernel.c
-+++ b/modules/ssl/ssl_engine_kernel.c
-@@ -2303,7 +2303,7 @@ int ssl_callback_SessionTicket(SSL *ssl,
-                       "TLS session ticket key for %s successfully set, "
-                       "creating new session ticket", sc->vhost_id);
- 
--        return 0;
-+        return 1;
-     }
-     else if (mode == 0) {
-         /* 
diff --git a/httpd-2.4.27-r1808230.patch b/httpd-2.4.27-r1808230.patch
deleted file mode 100644
index e4062ea..0000000
--- a/httpd-2.4.27-r1808230.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-# ./pullrev.sh 1808230
-http://svn.apache.org/viewvc?view=revision&revision=1808230
-
---- httpd-2.4.27/server/protocol.c
-+++ httpd-2.4.27/server/protocol.c
-@@ -1708,62 +1708,88 @@
-         ctx->tmpbb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
-     }
- 
--    /* Loop through this set of buckets to compute their length
--     */
-+    /* Loop through the brigade to count the length. To avoid
-+     * arbitrary memory consumption with morphing bucket types, this
-+     * loop will stop and pass on the brigade when necessary. */
-     e = APR_BRIGADE_FIRST(b);
-     while (e != APR_BRIGADE_SENTINEL(b)) {
-+        apr_status_t rv;
-+
-         if (APR_BUCKET_IS_EOS(e)) {
-             eos = 1;
-             break;
-         }
--        if (e->length == (apr_size_t)-1) {
-+        /* For a flush bucket, fall through to pass the brigade and
-+         * flush now. */
-+        else if (APR_BUCKET_IS_FLUSH(e)) {
-+            e = APR_BUCKET_NEXT(e);
-+        }
-+        /* For metadata bucket types other than FLUSH, loop. */
-+        else if (APR_BUCKET_IS_METADATA(e)) {
-+            e = APR_BUCKET_NEXT(e);
-+            continue;
-+        }
-+        /* For determinate length data buckets, count the length and
-+         * continue. */
-+        else if (e->length != (apr_size_t)-1) {
-+            r->bytes_sent += e->length;
-+            e = APR_BUCKET_NEXT(e);
-+            continue;
-+        }
-+        /* For indeterminate length data buckets, perform one read. */
-+        else /* e->length == (apr_size_t)-1 */ {
-             apr_size_t len;
-             const char *ignored;
--            apr_status_t rv;
--
--            /* This is probably a pipe bucket.  Send everything
--             * prior to this, and then read the data for this bucket.
--             */
-+        
-             rv = apr_bucket_read(e, &ignored, &len, eblock);
-+            if ((rv != APR_SUCCESS) && !APR_STATUS_IS_EAGAIN(rv)) {
-+                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
-+                              "ap_content_length_filter: "
-+                              "apr_bucket_read() failed");
-+                return rv;
-+            }
-             if (rv == APR_SUCCESS) {
--                /* Attempt a nonblocking read next time through */
-                 eblock = APR_NONBLOCK_READ;
-+                e = APR_BUCKET_NEXT(e);
-                 r->bytes_sent += len;
-             }
-             else if (APR_STATUS_IS_EAGAIN(rv)) {
--                /* Output everything prior to this bucket, and then
--                 * do a blocking read on the next batch.
--                 */
--                if (e != APR_BRIGADE_FIRST(b)) {
--                    apr_bucket *flush;
--                    apr_brigade_split_ex(b, e, ctx->tmpbb);
--                    flush = apr_bucket_flush_create(r->connection->bucket_alloc);
-+                apr_bucket *flush;
- 
--                    APR_BRIGADE_INSERT_TAIL(b, flush);
--                    rv = ap_pass_brigade(f->next, b);
--                    if (rv != APR_SUCCESS || f->c->aborted) {
--                        return rv;
--                    }
--                    apr_brigade_cleanup(b);
--                    APR_BRIGADE_CONCAT(b, ctx->tmpbb);
--                    e = APR_BRIGADE_FIRST(b);
-+                /* Next read must block. */
-+                eblock = APR_BLOCK_READ;
- 
--                    ctx->data_sent = 1;
--                }
--                eblock = APR_BLOCK_READ;
--                continue;
-+                /* Ensure the last bucket to pass down is a flush if
-+                 * the next read will block. */
-+                flush = apr_bucket_flush_create(f->c->bucket_alloc);
-+                APR_BUCKET_INSERT_BEFORE(e, flush);
-             }
--            else {
--                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
--                              "ap_content_length_filter: "
--                              "apr_bucket_read() failed");
--                return rv;
--            }
-         }
--        else {
--            r->bytes_sent += e->length;
-+
-+        /* Optimization: if the next bucket is EOS (directly after a
-+         * bucket morphed to the heap, or a flush), short-cut to
-+         * handle EOS straight away - allowing C-L to be determined
-+         * for content which is already entirely in memory. */
-+        if (e != APR_BRIGADE_SENTINEL(b) && APR_BUCKET_IS_EOS(e)) {
-+            continue;
-         }
--        e = APR_BUCKET_NEXT(e);
-+
-+        /* On reaching here, pass on everything in the brigade up to
-+         * this point. */
-+        apr_brigade_split_ex(b, e, ctx->tmpbb);
-+        
-+        rv = ap_pass_brigade(f->next, b);
-+        if (rv != APR_SUCCESS) {
-+            return rv;
-+        }
-+        else if (f->c->aborted) {
-+            return APR_ECONNABORTED;
-+        }
-+        apr_brigade_cleanup(b);
-+        APR_BRIGADE_CONCAT(b, ctx->tmpbb);
-+        e = APR_BRIGADE_FIRST(b);
-+        
-+        ctx->data_sent = 1;
-     }
- 
-     /* If we've now seen the entire response and it's otherwise
diff --git a/httpd-2.4.4-mod_unique_id.patch b/httpd-2.4.4-mod_unique_id.patch
deleted file mode 100644
index 30bdfe0..0000000
--- a/httpd-2.4.4-mod_unique_id.patch
+++ /dev/null
@@ -1,239 +0,0 @@
---- trunk/modules/metadata/mod_unique_id.c	2011/12/02 23:02:04	1209766
-+++ trunk/modules/metadata/mod_unique_id.c	2013/07/10 16:20:31	1501827
-@@ -31,14 +31,11 @@
- #include "http_log.h"
- #include "http_protocol.h"  /* for ap_hook_post_read_request */
- 
--#if APR_HAVE_UNISTD_H
--#include <unistd.h>         /* for getpid() */
--#endif
-+#define ROOT_SIZE 10
- 
- typedef struct {
-     unsigned int stamp;
--    unsigned int in_addr;
--    unsigned int pid;
-+    char root[ROOT_SIZE];
-     unsigned short counter;
-     unsigned int thread_index;
- } unique_id_rec;
-@@ -64,20 +61,15 @@
-  * gethostbyname (gethostname()) is unique across all the machines at the
-  * "site".
-  *
-- * We also further assume that pids fit in 32-bits.  If something uses more
-- * than 32-bits, the fix is trivial, but it requires the unrolled uuencoding
-- * loop to be extended.  * A similar fix is needed to support multithreaded
-- * servers, using a pid/tid combo.
-- *
-- * Together, the in_addr and pid are assumed to absolutely uniquely identify
-- * this one child from all other currently running children on all servers
-- * (including this physical server if it is running multiple httpds) from each
-+ * The root is assumed to absolutely uniquely identify this one child
-+ * from all other currently running children on all servers (including
-+ * this physical server if it is running multiple httpds) from each
-  * other.
-  *
-- * The stamp and counter are used to distinguish all hits for a particular
-- * (in_addr,pid) pair.  The stamp is updated using r->request_time,
-- * saving cpu cycles.  The counter is never reset, and is used to permit up to
-- * 64k requests in a single second by a single child.
-+ * The stamp and counter are used to distinguish all hits for a
-+ * particular root.  The stamp is updated using r->request_time,
-+ * saving cpu cycles.  The counter is never reset, and is used to
-+ * permit up to 64k requests in a single second by a single child.
-  *
-  * The 144-bits of unique_id_rec are encoded using the alphabet
-  * [A-Za-z0-9@-], resulting in 24 bytes of printable characters.  That is then
-@@ -92,7 +84,7 @@
-  * module change.
-  *
-  * It is highly desirable that identifiers exist for "eternity".  But future
-- * needs (such as much faster webservers, moving to 64-bit pids, or moving to a
-+ * needs (such as much faster webservers, or moving to a
-  * multithreaded server) may dictate a need to change the contents of
-  * unique_id_rec.  Such a future implementation should ensure that the first
-  * field is still a time_t stamp.  By doing that, it is possible for a site to
-@@ -100,7 +92,15 @@
-  * wait one entire second, and then start all of their new-servers.  This
-  * procedure will ensure that the new space of identifiers is completely unique
-  * from the old space.  (Since the first four unencoded bytes always differ.)
-+ *
-+ * Note: previous implementations used 32-bits of IP address plus pid
-+ * in place of the PRNG output in the "root" field.  This was
-+ * insufficient for IPv6-only hosts, required working DNS to determine
-+ * a unique IP address (fragile), and needed a [0, 1) second sleep
-+ * call at startup to avoid pid reuse.  Use of the PRNG avoids all
-+ * these issues.
-  */
-+
- /*
-  * Sun Jun  7 05:43:49 CEST 1998 -- Alvaro
-  * More comments:
-@@ -116,8 +116,6 @@
-  * htonl/ntohl. Well, this shouldn't be a problem till year 2106.
-  */
- 
--static unsigned global_in_addr;
--
- /*
-  * XXX: We should have a per-thread counter and not use cur_unique_id.counter
-  * XXX: in all threads, because this is bad for performance on multi-processor
-@@ -129,7 +127,7 @@
- /*
-  * Number of elements in the structure unique_id_rec.
-  */
--#define UNIQUE_ID_REC_MAX 5
-+#define UNIQUE_ID_REC_MAX 4
- 
- static unsigned short unique_id_rec_offset[UNIQUE_ID_REC_MAX],
-                       unique_id_rec_size[UNIQUE_ID_REC_MAX],
-@@ -138,113 +136,32 @@
- 
- static int unique_id_global_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *main_server)
- {
--    char str[APRMAXHOSTLEN + 1];
--    apr_status_t rv;
--    char *ipaddrstr;
--    apr_sockaddr_t *sockaddr;
--
-     /*
-      * Calculate the sizes and offsets in cur_unique_id.
-      */
-     unique_id_rec_offset[0] = APR_OFFSETOF(unique_id_rec, stamp);
-     unique_id_rec_size[0] = sizeof(cur_unique_id.stamp);
--    unique_id_rec_offset[1] = APR_OFFSETOF(unique_id_rec, in_addr);
--    unique_id_rec_size[1] = sizeof(cur_unique_id.in_addr);
--    unique_id_rec_offset[2] = APR_OFFSETOF(unique_id_rec, pid);
--    unique_id_rec_size[2] = sizeof(cur_unique_id.pid);
--    unique_id_rec_offset[3] = APR_OFFSETOF(unique_id_rec, counter);
--    unique_id_rec_size[3] = sizeof(cur_unique_id.counter);
--    unique_id_rec_offset[4] = APR_OFFSETOF(unique_id_rec, thread_index);
--    unique_id_rec_size[4] = sizeof(cur_unique_id.thread_index);
-+    unique_id_rec_offset[1] = APR_OFFSETOF(unique_id_rec, root);
-+    unique_id_rec_size[1] = sizeof(cur_unique_id.root);
-+    unique_id_rec_offset[2] = APR_OFFSETOF(unique_id_rec, counter);
-+    unique_id_rec_size[2] = sizeof(cur_unique_id.counter);
-+    unique_id_rec_offset[3] = APR_OFFSETOF(unique_id_rec, thread_index);
-+    unique_id_rec_size[3] = sizeof(cur_unique_id.thread_index);
-     unique_id_rec_total_size = unique_id_rec_size[0] + unique_id_rec_size[1] +
--                               unique_id_rec_size[2] + unique_id_rec_size[3] +
--                               unique_id_rec_size[4];
-+                               unique_id_rec_size[2] + unique_id_rec_size[3];
- 
-     /*
-      * Calculate the size of the structure when encoded.
-      */
-     unique_id_rec_size_uu = (unique_id_rec_total_size*8+5)/6;
- 
--    /*
--     * Now get the global in_addr.  Note that it is not sufficient to use one
--     * of the addresses from the main_server, since those aren't as likely to
--     * be unique as the physical address of the machine
--     */
--    if ((rv = apr_gethostname(str, sizeof(str) - 1, p)) != APR_SUCCESS) {
--        ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01563)
--          "unable to find hostname of the server");
--        return HTTP_INTERNAL_SERVER_ERROR;
--    }
--
--    if ((rv = apr_sockaddr_info_get(&sockaddr, str, AF_INET, 0, 0, p)) == APR_SUCCESS) {
--        global_in_addr = sockaddr->sa.sin.sin_addr.s_addr;
--    }
--    else {
--        ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01564)
--                    "unable to find IPv4 address of \"%s\"", str);
--#if APR_HAVE_IPV6
--        if ((rv = apr_sockaddr_info_get(&sockaddr, str, AF_INET6, 0, 0, p)) == APR_SUCCESS) {
--            memcpy(&global_in_addr,
--                   (char *)sockaddr->ipaddr_ptr + sockaddr->ipaddr_len - sizeof(global_in_addr),
--                   sizeof(global_in_addr));
--            ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01565)
--                         "using low-order bits of IPv6 address "
--                         "as if they were unique");
--        }
--        else
--#endif
--        return HTTP_INTERNAL_SERVER_ERROR;
--    }
--
--    apr_sockaddr_ip_get(&ipaddrstr, sockaddr);
--    ap_log_error(APLOG_MARK, APLOG_INFO, 0, main_server, APLOGNO(01566) "using ip addr %s",
--                 ipaddrstr);
--
--    /*
--     * If the server is pummelled with restart requests we could possibly end
--     * up in a situation where we're starting again during the same second
--     * that has been used in previous identifiers.  Avoid that situation.
--     *
--     * In truth, for this to actually happen not only would it have to restart
--     * in the same second, but it would have to somehow get the same pids as
--     * one of the other servers that was running in that second. Which would
--     * mean a 64k wraparound on pids ... not very likely at all.
--     *
--     * But protecting against it is relatively cheap.  We just sleep into the
--     * next second.
--     */
--    apr_sleep(apr_time_from_sec(1) - apr_time_usec(apr_time_now()));
-     return OK;
- }
- 
- static void unique_id_child_init(apr_pool_t *p, server_rec *s)
- {
--    pid_t pid;
--
--    /*
--     * Note that we use the pid because it's possible that on the same
--     * physical machine there are multiple servers (i.e. using Listen). But
--     * it's guaranteed that none of them will share the same pids between
--     * children.
--     *
--     * XXX: for multithread this needs to use a pid/tid combo and probably
--     * needs to be expanded to 32 bits
--     */
--    pid = getpid();
--    cur_unique_id.pid = pid;
--
--    /*
--     * Test our assumption that the pid is 32-bits.  It's possible that
--     * 64-bit machines will declare pid_t to be 64 bits but only use 32
--     * of them.  It would have been really nice to test this during
--     * global_init ... but oh well.
--     */
--    if ((pid_t)cur_unique_id.pid != pid) {
--        ap_log_error(APLOG_MARK, APLOG_CRIT, 0, s, APLOGNO(01567)
--                    "oh no! pids are greater than 32-bits!  I'm broken!");
--    }
--
--    cur_unique_id.in_addr = global_in_addr;
-+    ap_random_insecure_bytes(&cur_unique_id.root,
-+                             sizeof(cur_unique_id.root));
- 
-     /*
-      * If we use 0 as the initial counter we have a little less protection
-@@ -253,13 +170,6 @@
-      */
-     ap_random_insecure_bytes(&cur_unique_id.counter,
-                              sizeof(cur_unique_id.counter));
--
--    /*
--     * We must always use network ordering for these bytes, so that
--     * identifiers are comparable between machines of different byte
--     * orderings.  Note in_addr is already in network order.
--     */
--    cur_unique_id.pid = htonl(cur_unique_id.pid);
- }
- 
- /* NOTE: This is *NOT* the same encoding used by base64encode ... the last two
-@@ -291,10 +201,8 @@
-     unsigned short counter;
-     int i,j,k;
- 
--    new_unique_id.in_addr = cur_unique_id.in_addr;
--    new_unique_id.pid = cur_unique_id.pid;
-+    memcpy(&new_unique_id.root, &cur_unique_id.root, ROOT_SIZE);
-     new_unique_id.counter = cur_unique_id.counter;
--
-     new_unique_id.stamp = htonl((unsigned int)apr_time_sec(r->request_time));
-     new_unique_id.thread_index = htonl((unsigned int)r->connection->id);
- 
diff --git a/httpd.spec b/httpd.spec
index d85b687..59bff19 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.28
-Release: 3%{?dist}
+Version: 2.4.29
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -70,15 +70,10 @@ Patch31: httpd-2.4.18-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
 Patch35: httpd-2.4.17-sslciphdefault.patch
 # Bug fixes
-Patch56: httpd-2.4.4-mod_unique_id.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.25-r1738878.patch
-Patch60: httpd-2.4.27-r1808230.patch
 # Security fixes
 
-# https://github.com/apache/httpd/commit/4171fbfcb249e63f934471054d7a0752272fb8ee
-Patch61: httpd-2.4.27-fixticketkeys.patch
-
 License: ASL 2.0
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
@@ -216,12 +211,7 @@ interface for storing and accessing per-user session data.
 %patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
-
-%patch56 -p1 -b .uniqueid
 %patch58 -p1 -b .r1738878
-%patch60 -p1 -b .r1808230
-
-%patch61 -p1 -b .ticketkeys
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -689,6 +679,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Oct 25 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.29-1
+- new version 2.4.29
+
 * Tue Oct 10 2017 Joe Orton <jorton@redhat.com> - 2.4.28-3
 - drop obsolete Obsoletes
 - update docs, Summary
diff --git a/sources b/sources
index 2db6285..6978287 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.28.tar.bz2) = 8de8e32b87e6de220e492e74db9df0882fae11c3b9732f3d3316da048c04767ac4429c0433c36f87d8705263e3376f97a7e1f66a9d7a518632a67b6fe617590a
+SHA512 (httpd-2.4.29.tar.bz2) = 840982fd3d21463bc5c1747f211dfacf3abdf634d149e49bb49fd2e5deda140de602dbdf31e1bbe5337a48f718ab2261c408e83a8dd39a9291ee7b6b7a85639a

From 7eca232f16fca8ef27cf94e1c45b3c4f63cd5447 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 25 Oct 2017 14:57:17 +0200
Subject: [PATCH 066/359] new version 2.4.29

---
 .gitignore                       |   1 +
 httpd-2.4.27-fixticketkeys.patch |  65 ---------
 httpd-2.4.27-r1808230.patch      | 131 -----------------
 httpd-2.4.4-mod_unique_id.patch  | 239 -------------------------------
 httpd.spec                       |  14 +-
 sources                          |   2 +-
 6 files changed, 6 insertions(+), 446 deletions(-)
 delete mode 100644 httpd-2.4.27-fixticketkeys.patch
 delete mode 100644 httpd-2.4.27-r1808230.patch
 delete mode 100644 httpd-2.4.4-mod_unique_id.patch

diff --git a/.gitignore b/.gitignore
index 2f07a6e..b1c1924 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,3 +29,4 @@ x86_64
 /httpd-2.4.26.tar.bz2
 /httpd-2.4.27.tar.bz2
 /httpd-2.4.28.tar.bz2
+/httpd-2.4.29.tar.bz2
diff --git a/httpd-2.4.27-fixticketkeys.patch b/httpd-2.4.27-fixticketkeys.patch
deleted file mode 100644
index 3769da9..0000000
--- a/httpd-2.4.27-fixticketkeys.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 4171fbfcb249e63f934471054d7a0752272fb8ee Mon Sep 17 00:00:00 2001
-From: Yann Ylavic <ylavic@apache.org>
-Date: Tue, 22 Mar 2016 13:09:17 +0000
-Subject: [PATCH] mod_ssl: return non ambigous value in
- ssl_callback_SessionTicket() for encryption mode (we used to return 0,
- OpenSSL documents returning 1 instead).
-
-Practically this does not change anything since OpenSSL will only check for
->= 0 return value (non error) for encryption mode (the other possible return
-values are only relevant for decryption mode).
-
-However the OpenSSL documentation for SSL_CTX_set_tlsext_ticket_key_cb()
-states:
-"
-The return value of the cb function is used by OpenSSL to determine what
-further processing will occur. The following return values have meaning:
-
-2
-    This indicates that the ctx and hctx have been set and the session can
-    continue on those parameters. Additionally it indicates that the session
-    ticket is in a renewal period and should be replaced. The OpenSSL library
-    will call cb again with an enc argument of 1 to set the new ticket (see
-    RFC5077 3.3 paragraph 2).
-
-1
-    This indicates that the ctx and hctx have been set and the session can
-    continue on those parameters.
-
-0
-    This indicates that it was not possible to set/retrieve a session ticket
-    and the SSL/TLS session will continue by by negotiating a set of
-    cryptographic parameters or using the alternate SSL/TLS resumption
-    mechanism, session ids.
-    If called with enc equal to 0 the library will call the cb again to get a
-    new set of parameters.
-
-less than 0
-    This indicates an error.
-"
-
-So 0 is not appropriate in our code, 1 is what we really want (and it won't
-break if OpenSSL later changes its checks on the callback return value).
-
-Reported by: oknet on github, pull request #18.
-
-
-
-git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1736186 13f79535-47bb-0310-9956-ffa450edef68
----
- modules/ssl/ssl_engine_kernel.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
-index 91da94c4f58..91d5e926d66 100644
---- a/modules/ssl/ssl_engine_kernel.c
-+++ b/modules/ssl/ssl_engine_kernel.c
-@@ -2303,7 +2303,7 @@ int ssl_callback_SessionTicket(SSL *ssl,
-                       "TLS session ticket key for %s successfully set, "
-                       "creating new session ticket", sc->vhost_id);
- 
--        return 0;
-+        return 1;
-     }
-     else if (mode == 0) {
-         /* 
diff --git a/httpd-2.4.27-r1808230.patch b/httpd-2.4.27-r1808230.patch
deleted file mode 100644
index e4062ea..0000000
--- a/httpd-2.4.27-r1808230.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-# ./pullrev.sh 1808230
-http://svn.apache.org/viewvc?view=revision&revision=1808230
-
---- httpd-2.4.27/server/protocol.c
-+++ httpd-2.4.27/server/protocol.c
-@@ -1708,62 +1708,88 @@
-         ctx->tmpbb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
-     }
- 
--    /* Loop through this set of buckets to compute their length
--     */
-+    /* Loop through the brigade to count the length. To avoid
-+     * arbitrary memory consumption with morphing bucket types, this
-+     * loop will stop and pass on the brigade when necessary. */
-     e = APR_BRIGADE_FIRST(b);
-     while (e != APR_BRIGADE_SENTINEL(b)) {
-+        apr_status_t rv;
-+
-         if (APR_BUCKET_IS_EOS(e)) {
-             eos = 1;
-             break;
-         }
--        if (e->length == (apr_size_t)-1) {
-+        /* For a flush bucket, fall through to pass the brigade and
-+         * flush now. */
-+        else if (APR_BUCKET_IS_FLUSH(e)) {
-+            e = APR_BUCKET_NEXT(e);
-+        }
-+        /* For metadata bucket types other than FLUSH, loop. */
-+        else if (APR_BUCKET_IS_METADATA(e)) {
-+            e = APR_BUCKET_NEXT(e);
-+            continue;
-+        }
-+        /* For determinate length data buckets, count the length and
-+         * continue. */
-+        else if (e->length != (apr_size_t)-1) {
-+            r->bytes_sent += e->length;
-+            e = APR_BUCKET_NEXT(e);
-+            continue;
-+        }
-+        /* For indeterminate length data buckets, perform one read. */
-+        else /* e->length == (apr_size_t)-1 */ {
-             apr_size_t len;
-             const char *ignored;
--            apr_status_t rv;
--
--            /* This is probably a pipe bucket.  Send everything
--             * prior to this, and then read the data for this bucket.
--             */
-+        
-             rv = apr_bucket_read(e, &ignored, &len, eblock);
-+            if ((rv != APR_SUCCESS) && !APR_STATUS_IS_EAGAIN(rv)) {
-+                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
-+                              "ap_content_length_filter: "
-+                              "apr_bucket_read() failed");
-+                return rv;
-+            }
-             if (rv == APR_SUCCESS) {
--                /* Attempt a nonblocking read next time through */
-                 eblock = APR_NONBLOCK_READ;
-+                e = APR_BUCKET_NEXT(e);
-                 r->bytes_sent += len;
-             }
-             else if (APR_STATUS_IS_EAGAIN(rv)) {
--                /* Output everything prior to this bucket, and then
--                 * do a blocking read on the next batch.
--                 */
--                if (e != APR_BRIGADE_FIRST(b)) {
--                    apr_bucket *flush;
--                    apr_brigade_split_ex(b, e, ctx->tmpbb);
--                    flush = apr_bucket_flush_create(r->connection->bucket_alloc);
-+                apr_bucket *flush;
- 
--                    APR_BRIGADE_INSERT_TAIL(b, flush);
--                    rv = ap_pass_brigade(f->next, b);
--                    if (rv != APR_SUCCESS || f->c->aborted) {
--                        return rv;
--                    }
--                    apr_brigade_cleanup(b);
--                    APR_BRIGADE_CONCAT(b, ctx->tmpbb);
--                    e = APR_BRIGADE_FIRST(b);
-+                /* Next read must block. */
-+                eblock = APR_BLOCK_READ;
- 
--                    ctx->data_sent = 1;
--                }
--                eblock = APR_BLOCK_READ;
--                continue;
-+                /* Ensure the last bucket to pass down is a flush if
-+                 * the next read will block. */
-+                flush = apr_bucket_flush_create(f->c->bucket_alloc);
-+                APR_BUCKET_INSERT_BEFORE(e, flush);
-             }
--            else {
--                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
--                              "ap_content_length_filter: "
--                              "apr_bucket_read() failed");
--                return rv;
--            }
-         }
--        else {
--            r->bytes_sent += e->length;
-+
-+        /* Optimization: if the next bucket is EOS (directly after a
-+         * bucket morphed to the heap, or a flush), short-cut to
-+         * handle EOS straight away - allowing C-L to be determined
-+         * for content which is already entirely in memory. */
-+        if (e != APR_BRIGADE_SENTINEL(b) && APR_BUCKET_IS_EOS(e)) {
-+            continue;
-         }
--        e = APR_BUCKET_NEXT(e);
-+
-+        /* On reaching here, pass on everything in the brigade up to
-+         * this point. */
-+        apr_brigade_split_ex(b, e, ctx->tmpbb);
-+        
-+        rv = ap_pass_brigade(f->next, b);
-+        if (rv != APR_SUCCESS) {
-+            return rv;
-+        }
-+        else if (f->c->aborted) {
-+            return APR_ECONNABORTED;
-+        }
-+        apr_brigade_cleanup(b);
-+        APR_BRIGADE_CONCAT(b, ctx->tmpbb);
-+        e = APR_BRIGADE_FIRST(b);
-+        
-+        ctx->data_sent = 1;
-     }
- 
-     /* If we've now seen the entire response and it's otherwise
diff --git a/httpd-2.4.4-mod_unique_id.patch b/httpd-2.4.4-mod_unique_id.patch
deleted file mode 100644
index 30bdfe0..0000000
--- a/httpd-2.4.4-mod_unique_id.patch
+++ /dev/null
@@ -1,239 +0,0 @@
---- trunk/modules/metadata/mod_unique_id.c	2011/12/02 23:02:04	1209766
-+++ trunk/modules/metadata/mod_unique_id.c	2013/07/10 16:20:31	1501827
-@@ -31,14 +31,11 @@
- #include "http_log.h"
- #include "http_protocol.h"  /* for ap_hook_post_read_request */
- 
--#if APR_HAVE_UNISTD_H
--#include <unistd.h>         /* for getpid() */
--#endif
-+#define ROOT_SIZE 10
- 
- typedef struct {
-     unsigned int stamp;
--    unsigned int in_addr;
--    unsigned int pid;
-+    char root[ROOT_SIZE];
-     unsigned short counter;
-     unsigned int thread_index;
- } unique_id_rec;
-@@ -64,20 +61,15 @@
-  * gethostbyname (gethostname()) is unique across all the machines at the
-  * "site".
-  *
-- * We also further assume that pids fit in 32-bits.  If something uses more
-- * than 32-bits, the fix is trivial, but it requires the unrolled uuencoding
-- * loop to be extended.  * A similar fix is needed to support multithreaded
-- * servers, using a pid/tid combo.
-- *
-- * Together, the in_addr and pid are assumed to absolutely uniquely identify
-- * this one child from all other currently running children on all servers
-- * (including this physical server if it is running multiple httpds) from each
-+ * The root is assumed to absolutely uniquely identify this one child
-+ * from all other currently running children on all servers (including
-+ * this physical server if it is running multiple httpds) from each
-  * other.
-  *
-- * The stamp and counter are used to distinguish all hits for a particular
-- * (in_addr,pid) pair.  The stamp is updated using r->request_time,
-- * saving cpu cycles.  The counter is never reset, and is used to permit up to
-- * 64k requests in a single second by a single child.
-+ * The stamp and counter are used to distinguish all hits for a
-+ * particular root.  The stamp is updated using r->request_time,
-+ * saving cpu cycles.  The counter is never reset, and is used to
-+ * permit up to 64k requests in a single second by a single child.
-  *
-  * The 144-bits of unique_id_rec are encoded using the alphabet
-  * [A-Za-z0-9@-], resulting in 24 bytes of printable characters.  That is then
-@@ -92,7 +84,7 @@
-  * module change.
-  *
-  * It is highly desirable that identifiers exist for "eternity".  But future
-- * needs (such as much faster webservers, moving to 64-bit pids, or moving to a
-+ * needs (such as much faster webservers, or moving to a
-  * multithreaded server) may dictate a need to change the contents of
-  * unique_id_rec.  Such a future implementation should ensure that the first
-  * field is still a time_t stamp.  By doing that, it is possible for a site to
-@@ -100,7 +92,15 @@
-  * wait one entire second, and then start all of their new-servers.  This
-  * procedure will ensure that the new space of identifiers is completely unique
-  * from the old space.  (Since the first four unencoded bytes always differ.)
-+ *
-+ * Note: previous implementations used 32-bits of IP address plus pid
-+ * in place of the PRNG output in the "root" field.  This was
-+ * insufficient for IPv6-only hosts, required working DNS to determine
-+ * a unique IP address (fragile), and needed a [0, 1) second sleep
-+ * call at startup to avoid pid reuse.  Use of the PRNG avoids all
-+ * these issues.
-  */
-+
- /*
-  * Sun Jun  7 05:43:49 CEST 1998 -- Alvaro
-  * More comments:
-@@ -116,8 +116,6 @@
-  * htonl/ntohl. Well, this shouldn't be a problem till year 2106.
-  */
- 
--static unsigned global_in_addr;
--
- /*
-  * XXX: We should have a per-thread counter and not use cur_unique_id.counter
-  * XXX: in all threads, because this is bad for performance on multi-processor
-@@ -129,7 +127,7 @@
- /*
-  * Number of elements in the structure unique_id_rec.
-  */
--#define UNIQUE_ID_REC_MAX 5
-+#define UNIQUE_ID_REC_MAX 4
- 
- static unsigned short unique_id_rec_offset[UNIQUE_ID_REC_MAX],
-                       unique_id_rec_size[UNIQUE_ID_REC_MAX],
-@@ -138,113 +136,32 @@
- 
- static int unique_id_global_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *main_server)
- {
--    char str[APRMAXHOSTLEN + 1];
--    apr_status_t rv;
--    char *ipaddrstr;
--    apr_sockaddr_t *sockaddr;
--
-     /*
-      * Calculate the sizes and offsets in cur_unique_id.
-      */
-     unique_id_rec_offset[0] = APR_OFFSETOF(unique_id_rec, stamp);
-     unique_id_rec_size[0] = sizeof(cur_unique_id.stamp);
--    unique_id_rec_offset[1] = APR_OFFSETOF(unique_id_rec, in_addr);
--    unique_id_rec_size[1] = sizeof(cur_unique_id.in_addr);
--    unique_id_rec_offset[2] = APR_OFFSETOF(unique_id_rec, pid);
--    unique_id_rec_size[2] = sizeof(cur_unique_id.pid);
--    unique_id_rec_offset[3] = APR_OFFSETOF(unique_id_rec, counter);
--    unique_id_rec_size[3] = sizeof(cur_unique_id.counter);
--    unique_id_rec_offset[4] = APR_OFFSETOF(unique_id_rec, thread_index);
--    unique_id_rec_size[4] = sizeof(cur_unique_id.thread_index);
-+    unique_id_rec_offset[1] = APR_OFFSETOF(unique_id_rec, root);
-+    unique_id_rec_size[1] = sizeof(cur_unique_id.root);
-+    unique_id_rec_offset[2] = APR_OFFSETOF(unique_id_rec, counter);
-+    unique_id_rec_size[2] = sizeof(cur_unique_id.counter);
-+    unique_id_rec_offset[3] = APR_OFFSETOF(unique_id_rec, thread_index);
-+    unique_id_rec_size[3] = sizeof(cur_unique_id.thread_index);
-     unique_id_rec_total_size = unique_id_rec_size[0] + unique_id_rec_size[1] +
--                               unique_id_rec_size[2] + unique_id_rec_size[3] +
--                               unique_id_rec_size[4];
-+                               unique_id_rec_size[2] + unique_id_rec_size[3];
- 
-     /*
-      * Calculate the size of the structure when encoded.
-      */
-     unique_id_rec_size_uu = (unique_id_rec_total_size*8+5)/6;
- 
--    /*
--     * Now get the global in_addr.  Note that it is not sufficient to use one
--     * of the addresses from the main_server, since those aren't as likely to
--     * be unique as the physical address of the machine
--     */
--    if ((rv = apr_gethostname(str, sizeof(str) - 1, p)) != APR_SUCCESS) {
--        ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01563)
--          "unable to find hostname of the server");
--        return HTTP_INTERNAL_SERVER_ERROR;
--    }
--
--    if ((rv = apr_sockaddr_info_get(&sockaddr, str, AF_INET, 0, 0, p)) == APR_SUCCESS) {
--        global_in_addr = sockaddr->sa.sin.sin_addr.s_addr;
--    }
--    else {
--        ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01564)
--                    "unable to find IPv4 address of \"%s\"", str);
--#if APR_HAVE_IPV6
--        if ((rv = apr_sockaddr_info_get(&sockaddr, str, AF_INET6, 0, 0, p)) == APR_SUCCESS) {
--            memcpy(&global_in_addr,
--                   (char *)sockaddr->ipaddr_ptr + sockaddr->ipaddr_len - sizeof(global_in_addr),
--                   sizeof(global_in_addr));
--            ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01565)
--                         "using low-order bits of IPv6 address "
--                         "as if they were unique");
--        }
--        else
--#endif
--        return HTTP_INTERNAL_SERVER_ERROR;
--    }
--
--    apr_sockaddr_ip_get(&ipaddrstr, sockaddr);
--    ap_log_error(APLOG_MARK, APLOG_INFO, 0, main_server, APLOGNO(01566) "using ip addr %s",
--                 ipaddrstr);
--
--    /*
--     * If the server is pummelled with restart requests we could possibly end
--     * up in a situation where we're starting again during the same second
--     * that has been used in previous identifiers.  Avoid that situation.
--     *
--     * In truth, for this to actually happen not only would it have to restart
--     * in the same second, but it would have to somehow get the same pids as
--     * one of the other servers that was running in that second. Which would
--     * mean a 64k wraparound on pids ... not very likely at all.
--     *
--     * But protecting against it is relatively cheap.  We just sleep into the
--     * next second.
--     */
--    apr_sleep(apr_time_from_sec(1) - apr_time_usec(apr_time_now()));
-     return OK;
- }
- 
- static void unique_id_child_init(apr_pool_t *p, server_rec *s)
- {
--    pid_t pid;
--
--    /*
--     * Note that we use the pid because it's possible that on the same
--     * physical machine there are multiple servers (i.e. using Listen). But
--     * it's guaranteed that none of them will share the same pids between
--     * children.
--     *
--     * XXX: for multithread this needs to use a pid/tid combo and probably
--     * needs to be expanded to 32 bits
--     */
--    pid = getpid();
--    cur_unique_id.pid = pid;
--
--    /*
--     * Test our assumption that the pid is 32-bits.  It's possible that
--     * 64-bit machines will declare pid_t to be 64 bits but only use 32
--     * of them.  It would have been really nice to test this during
--     * global_init ... but oh well.
--     */
--    if ((pid_t)cur_unique_id.pid != pid) {
--        ap_log_error(APLOG_MARK, APLOG_CRIT, 0, s, APLOGNO(01567)
--                    "oh no! pids are greater than 32-bits!  I'm broken!");
--    }
--
--    cur_unique_id.in_addr = global_in_addr;
-+    ap_random_insecure_bytes(&cur_unique_id.root,
-+                             sizeof(cur_unique_id.root));
- 
-     /*
-      * If we use 0 as the initial counter we have a little less protection
-@@ -253,13 +170,6 @@
-      */
-     ap_random_insecure_bytes(&cur_unique_id.counter,
-                              sizeof(cur_unique_id.counter));
--
--    /*
--     * We must always use network ordering for these bytes, so that
--     * identifiers are comparable between machines of different byte
--     * orderings.  Note in_addr is already in network order.
--     */
--    cur_unique_id.pid = htonl(cur_unique_id.pid);
- }
- 
- /* NOTE: This is *NOT* the same encoding used by base64encode ... the last two
-@@ -291,10 +201,8 @@
-     unsigned short counter;
-     int i,j,k;
- 
--    new_unique_id.in_addr = cur_unique_id.in_addr;
--    new_unique_id.pid = cur_unique_id.pid;
-+    memcpy(&new_unique_id.root, &cur_unique_id.root, ROOT_SIZE);
-     new_unique_id.counter = cur_unique_id.counter;
--
-     new_unique_id.stamp = htonl((unsigned int)apr_time_sec(r->request_time));
-     new_unique_id.thread_index = htonl((unsigned int)r->connection->id);
- 
diff --git a/httpd.spec b/httpd.spec
index 379021a..c82b88a 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -7,7 +7,7 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.28
+Version: 2.4.29
 Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
@@ -63,15 +63,10 @@ Patch31: httpd-2.4.18-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
 Patch35: httpd-2.4.17-sslciphdefault.patch
 # Bug fixes
-Patch56: httpd-2.4.4-mod_unique_id.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.25-r1738878.patch
-Patch60: httpd-2.4.27-r1808230.patch
 # Security fixes
 
-# https://github.com/apache/httpd/commit/4171fbfcb249e63f934471054d7a0752272fb8ee
-Patch61: httpd-2.4.27-fixticketkeys.patch
-
 License: ASL 2.0
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
@@ -213,11 +208,7 @@ interface for storing and accessing per-user session data.
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 
-%patch56 -p1 -b .uniqueid
 %patch58 -p1 -b .r1738878
-%patch60 -p1 -b .r1808230
-
-%patch61 -p1 -b .ticketkeys
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -697,6 +688,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Oct 25 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.29-1
+- new version 2.4.29
+
 * Tue Oct 10 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.28-1
 - new version 2.4.28
 
diff --git a/sources b/sources
index 2db6285..6978287 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.28.tar.bz2) = 8de8e32b87e6de220e492e74db9df0882fae11c3b9732f3d3316da048c04767ac4429c0433c36f87d8705263e3376f97a7e1f66a9d7a518632a67b6fe617590a
+SHA512 (httpd-2.4.29.tar.bz2) = 840982fd3d21463bc5c1747f211dfacf3abdf634d149e49bb49fd2e5deda140de602dbdf31e1bbe5337a48f718ab2261c408e83a8dd39a9291ee7b6b7a85639a

From 9c91812414ae30246f37b11c46ba579f89ab3ecb Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 3 Nov 2017 16:52:50 +0000
Subject: [PATCH 067/359] Add docs on using socket activation.

---
 httpd.service.xml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/httpd.service.xml b/httpd.service.xml
index 4402ed5..b8fe7b3 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -221,6 +221,31 @@ Wants=network-online.target</programlisting>
 
     </refsect2>
 
+    <refsect2>
+      <title>Socket activation</title>
+
+      <para>Socket activation (see
+      <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      for more information) can be used with <command>httpd</command>
+      by enabling the <command>httpd.socket</command> unit.  The
+      <command>httpd</command> listener configuration must exactly
+      match the <literal>ListenStream</literal> options configured for
+      the <command>httpd.socket</command> unit.  The default
+      <command>httpd.socket</command> has a
+      <literal>ListenStream=80</literal> and, if mod_ssl is installed,
+      <literal>ListenStream=443</literal> by a drop-in file. If
+      additional <literal>Listen</literal> directives are added to the
+      httpd configuration, corresponding
+      <literal>ListenStream</literal> options should be added via
+      drop-in files, for example via <command>systemctl edit
+      httpd.socket</command>.</para>
+
+      <para>If using socket activation with httpd, only one listener
+      on any given TCP port is supported; a configuration with both
+      "<literal>Listen 127.0.0.1:80</literal>" and "<literal>Listen
+      192.168.1.2:80</literal>" will not work.</para>
+    </refsect2>
+
   </refsect1>
 
   <refsect1>
@@ -240,6 +265,7 @@ Wants=network-online.target</programlisting>
     <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>, 
     <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
     <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
     <citerefentry><refentrytitle>httpd_selinux</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
     <citerefentry><refentrytitle>semanage</refentrytitle><manvolnum>8</manvolnum></citerefentry>
     </para>

From 4533b4fe588d174b12ce97d18ed0c10189c32b45 Mon Sep 17 00:00:00 2001
From: Yevhenii Shapovalov <yshapova@redhat.com>
Date: Thu, 16 Nov 2017 12:27:52 +0200
Subject: [PATCH 068/359] add tests with standart test interface

---
 tests/httpd-php-mysql-sanity-test/Makefile    |  67 ++++++++++++
 tests/httpd-php-mysql-sanity-test/PURPOSE     |   3 +
 .../httpd-php-mysql-sanity-test/new_mysql.php |  12 +++
 .../httpd-php-mysql-sanity-test/old_mysql.php |  12 +++
 .../php_mysql_test.conf                       |   5 +
 .../php_mysql_test.sql                        |   6 ++
 tests/httpd-php-mysql-sanity-test/runtest.sh  | 102 ++++++++++++++++++
 tests/tests.yml                               |  15 +++
 8 files changed, 222 insertions(+)
 create mode 100644 tests/httpd-php-mysql-sanity-test/Makefile
 create mode 100644 tests/httpd-php-mysql-sanity-test/PURPOSE
 create mode 100644 tests/httpd-php-mysql-sanity-test/new_mysql.php
 create mode 100644 tests/httpd-php-mysql-sanity-test/old_mysql.php
 create mode 100644 tests/httpd-php-mysql-sanity-test/php_mysql_test.conf
 create mode 100644 tests/httpd-php-mysql-sanity-test/php_mysql_test.sql
 create mode 100755 tests/httpd-php-mysql-sanity-test/runtest.sh
 create mode 100644 tests/tests.yml

diff --git a/tests/httpd-php-mysql-sanity-test/Makefile b/tests/httpd-php-mysql-sanity-test/Makefile
new file mode 100644
index 0000000..17fb9d3
--- /dev/null
+++ b/tests/httpd-php-mysql-sanity-test/Makefile
@@ -0,0 +1,67 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+#   Description: test fetching data from mysqldb/mariadb through php
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE mysql.php php_mysql_test.sql php_mysql_test.conf
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+-include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Karel Srot <ksrot@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     test fetching data from mysqldb/mariadb through php" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RunFor:          httpd" >> $(METADATA)
+	@echo "Requires:        httpd php php-zts php-mysqlnd mysql-server mariadb-server" >> $(METADATA)
+	@echo "RhtsRequires:    library(httpd/http)" >> $(METADATA)
+	@echo "RhtsRequires:    library(mysql/basic)" >> $(METADATA)
+	@echo "RhtsRequires:    library(mariadb55/basic)" >> $(METADATA)
+	@echo "RhtsRequires:    library(php/utils)" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/httpd-php-mysql-sanity-test/PURPOSE b/tests/httpd-php-mysql-sanity-test/PURPOSE
new file mode 100644
index 0000000..59b3931
--- /dev/null
+++ b/tests/httpd-php-mysql-sanity-test/PURPOSE
@@ -0,0 +1,3 @@
+PURPOSE of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+Description: test fetching data from mysqldb/mariadb through php
+Author: Karel Srot <ksrot@redhat.com>
diff --git a/tests/httpd-php-mysql-sanity-test/new_mysql.php b/tests/httpd-php-mysql-sanity-test/new_mysql.php
new file mode 100644
index 0000000..6087b11
--- /dev/null
+++ b/tests/httpd-php-mysql-sanity-test/new_mysql.php
@@ -0,0 +1,12 @@
+<?php
+$db = mysqli_connect("localhost", "root");
+if (!$db) {
+    die("Could not connect");
+}
+if (!mysqli_select_db($db, "php_mysql_test")) {
+    die("Could not select database");
+}
+$res = mysqli_query($db, "SELECT * from foobar");
+$row = mysqli_fetch_assoc($res);
+printf("%s is %d\n", $row['name'], $row['value']);
+?>
diff --git a/tests/httpd-php-mysql-sanity-test/old_mysql.php b/tests/httpd-php-mysql-sanity-test/old_mysql.php
new file mode 100644
index 0000000..8904c58
--- /dev/null
+++ b/tests/httpd-php-mysql-sanity-test/old_mysql.php
@@ -0,0 +1,12 @@
+<?php
+$db = mysql_connect("localhost", "root");
+if (!$db) {
+    die("Could not connect");
+}
+if (!mysql_select_db("php_mysql_test")) {
+    die("Could not select database");
+}
+$res = mysql_query("SELECT * from foobar");
+$row = mysql_fetch_assoc($res);
+printf("%s is %d\n", $row['name'], $row['value']);
+?>
diff --git a/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf b/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf
new file mode 100644
index 0000000..d03c3c3
--- /dev/null
+++ b/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf
@@ -0,0 +1,5 @@
+
+Alias /php_mysql_test /var/www/php_mysql_test
+
+<Directory /var/www/php_mysql_test>
+</Directory>
diff --git a/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql b/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql
new file mode 100644
index 0000000..ad931ac
--- /dev/null
+++ b/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql
@@ -0,0 +1,6 @@
+
+CREATE DATABASE php_mysql_test;
+USE php_mysql_test;
+
+CREATE TABLE foobar (name VARCHAR(10), value INTEGER);
+INSERT INTO foobar VALUES("fish", 42);
diff --git a/tests/httpd-php-mysql-sanity-test/runtest.sh b/tests/httpd-php-mysql-sanity-test/runtest.sh
new file mode 100755
index 0000000..e2239ad
--- /dev/null
+++ b/tests/httpd-php-mysql-sanity-test/runtest.sh
@@ -0,0 +1,102 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+#   Description: test fetching data from mysqldb/mariadb through php
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+[ -e /usr/bin/rhts-environment.sh ] && . /usr/bin/rhts-environment.sh
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGES="${PACKAGES:-httpd}"
+REQUIRES="${REQUIRES:-php $DB}"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport httpd/http" 0 "Import httpd library"
+        if rlIsRHEL 5 6 && [ $httpCOLLECTION = 0 ]; then
+            DB="mysql-server"
+            rlRun "rlImport mysql/basic" 0 "Import mysqld library"
+            SERVICE=${mysqlServiceName}
+        else
+            DB="mariadb-server"
+            rlRun "rlImport mariadb55/basic" 0 "Import mariadb library"
+            SERVICE=${mariadbServiceName}
+        fi
+	# install also php-mysql on rhel-6 (instead of php-mysqlnd on rhel-7)
+        rlRun "rlImport php/utils"
+        phpPdoPhpMysqlSetup
+        rlAssertRpm --all
+        rlRun "rlServiceStart $SERVICE" 0
+        rlRun "echo DROP DATABASE php_mysql_test | mysql -u root" 0,1
+        rlRun "mysql --verbose -u root < php_mysql_test.sql"
+        rlRun "httpStop" 0 "Stop httpd if running"
+        rlRun "> $httpLOGDIR/error_log"
+        rlRun "rm -rvf $httpROOTDIR/php_mysql_test"
+        rlRun "mkdir -v $httpROOTDIR/php_mysql_test"
+        rlRun "cp -v php_mysql_test.conf $httpCONFDIR/conf.d/"
+        rlRun "php_version=`rlCheckRpm php`"
+        if [[ $php_version =~ php-7* ]] || [[ $php_version =~ php-5.[5-6]* ]]; then
+            rlRun "cp -v new_mysql.php $httpROOTDIR/php_mysql_test/mysql.php"
+        else
+            rlRun "cp -v old_mysql.php $httpROOTDIR/php_mysql_test/mysql.php"
+        fi
+        rlRun "sed -i 's|/var/www|$httpROOTDIR|' $httpCONFDIR/conf.d/php_mysql_test.conf"
+        rlRun "chown -R apache:  $httpROOTDIR/php_mysql_test"
+        #rlRun "restorecon  $httpROOTDIR/php_mysql_test"
+        selinuxenabled && rlRun "chcon -Rv -t httpd_sys_content_t $httpROOTDIR/php_mysql_test"
+        rlRun "httpStart" 0 "Start httpd"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        URL="http://localhost/php_mysql_test/"
+        RETVAL=0
+        tries=`seq 1 10`
+
+        for n in ${tries}; do
+            output=`curl -s $URL/mysql.php`
+            rv=$?
+            echo "PHP output ${n}: ${rv} x${output}y"
+            [ ${rv} -ne 0 -o "x${output}y" != "xfish is 42y" ] && RETVAL=66
+        done
+
+        if [ $RETVAL -ne 0 ]; then
+            rlFail
+        else
+            rlPass
+        fi
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -f $httpCONFDIR/conf.d/php_mysql_test.conf"
+        rlRun "rm -rf $httpROOTDIR/php_mysql_test"
+        rlRun "echo DROP DATABASE php_mysql_test | mysql -u root"
+        rlRun "rlServiceRestore ${SERVICE}" 0
+        rlRun "httpStop" 0 "Stop httpd if running"
+	# uninstall php-mysql on rhel-6 if it was installed during setup
+        phpPdoPhpMysqlCleanup
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
diff --git a/tests/tests.yml b/tests/tests.yml
new file mode 100644
index 0000000..43c38e7
--- /dev/null
+++ b/tests/tests.yml
@@ -0,0 +1,15 @@
+---
+# Tests that run in all contexts
+- hosts: localhost
+  vars:
+    use_beakerlib_libraries: true
+  roles:
+  - role: standard-test-rhts
+    tags:
+    - classic
+    - container
+    tests:
+    - httpd-php-mysql-sanity-test
+    required_packages:
+    - findutils         # beakerlib needs find command
+    - which             # smoke requires which command

From 95a0c9518b8a5659e7ba07aad0bcc338409e86cf Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 23 Nov 2017 11:11:28 +0000
Subject: [PATCH 069/359] build and load mod_brotli

---
 00-base.conf | 1 +
 httpd.spec   | 8 ++++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/00-base.conf b/00-base.conf
index ec9acf1..28dacb3 100644
--- a/00-base.conf
+++ b/00-base.conf
@@ -23,6 +23,7 @@ LoadModule authz_host_module modules/mod_authz_host.so
 LoadModule authz_owner_module modules/mod_authz_owner.so
 LoadModule authz_user_module modules/mod_authz_user.so
 LoadModule autoindex_module modules/mod_autoindex.so
+LoadModule brotli_module modules/mod_brotli.so
 LoadModule cache_module modules/mod_cache.so
 LoadModule cache_disk_module modules/mod_cache_disk.so
 LoadModule cache_socache_module modules/mod_cache_socache.so
diff --git a/httpd.spec b/httpd.spec
index ad2efc5..3ebf372 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.29
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -80,7 +80,7 @@ License: ASL 2.0
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
 BuildRequires: autoconf, perl-interpreter, perl-generators, pkgconfig, findutils, xmlto
-BuildRequires: zlib-devel, libselinux-devel, lua-devel
+BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0
 BuildRequires: systemd-devel
 Requires: /etc/mime.types, system-logos-httpd
@@ -278,6 +278,7 @@ export LYNX_PATH=/usr/bin/links
         --with-suexec-syslog \
 	--with-suexec-bin=%{_sbindir}/suexec \
 	--with-suexec-uidmin=1000 --with-suexec-gidmin=1000 \
+        --with-brotli \
         --enable-pie \
         --with-pcre \
         --enable-mods-shared=all \
@@ -681,6 +682,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Nov 23 2017 Joe Orton <jorton@redhat.com> - 2.4.29-2
+- build and load mod_brotli
+
 * Wed Oct 25 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.29-1
 - new version 2.4.29
 

From 7d5e373bce7b08da94ccd956f47dd61e69a70732 Mon Sep 17 00:00:00 2001
From: Yevhenii Shapovalov <yshapova@redhat.com>
Date: Thu, 16 Nov 2017 12:27:52 +0200
Subject: [PATCH 070/359] add tests with standart test interface

---
 tests/httpd-php-mysql-sanity-test/Makefile    |  67 ++++++++++++
 tests/httpd-php-mysql-sanity-test/PURPOSE     |   3 +
 .../httpd-php-mysql-sanity-test/new_mysql.php |  12 +++
 .../httpd-php-mysql-sanity-test/old_mysql.php |  12 +++
 .../php_mysql_test.conf                       |   5 +
 .../php_mysql_test.sql                        |   6 ++
 tests/httpd-php-mysql-sanity-test/runtest.sh  | 102 ++++++++++++++++++
 tests/tests.yml                               |  15 +++
 8 files changed, 222 insertions(+)
 create mode 100644 tests/httpd-php-mysql-sanity-test/Makefile
 create mode 100644 tests/httpd-php-mysql-sanity-test/PURPOSE
 create mode 100644 tests/httpd-php-mysql-sanity-test/new_mysql.php
 create mode 100644 tests/httpd-php-mysql-sanity-test/old_mysql.php
 create mode 100644 tests/httpd-php-mysql-sanity-test/php_mysql_test.conf
 create mode 100644 tests/httpd-php-mysql-sanity-test/php_mysql_test.sql
 create mode 100755 tests/httpd-php-mysql-sanity-test/runtest.sh
 create mode 100644 tests/tests.yml

diff --git a/tests/httpd-php-mysql-sanity-test/Makefile b/tests/httpd-php-mysql-sanity-test/Makefile
new file mode 100644
index 0000000..17fb9d3
--- /dev/null
+++ b/tests/httpd-php-mysql-sanity-test/Makefile
@@ -0,0 +1,67 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+#   Description: test fetching data from mysqldb/mariadb through php
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE mysql.php php_mysql_test.sql php_mysql_test.conf
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+-include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Karel Srot <ksrot@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     test fetching data from mysqldb/mariadb through php" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RunFor:          httpd" >> $(METADATA)
+	@echo "Requires:        httpd php php-zts php-mysqlnd mysql-server mariadb-server" >> $(METADATA)
+	@echo "RhtsRequires:    library(httpd/http)" >> $(METADATA)
+	@echo "RhtsRequires:    library(mysql/basic)" >> $(METADATA)
+	@echo "RhtsRequires:    library(mariadb55/basic)" >> $(METADATA)
+	@echo "RhtsRequires:    library(php/utils)" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+
+	rhts-lint $(METADATA)
diff --git a/tests/httpd-php-mysql-sanity-test/PURPOSE b/tests/httpd-php-mysql-sanity-test/PURPOSE
new file mode 100644
index 0000000..59b3931
--- /dev/null
+++ b/tests/httpd-php-mysql-sanity-test/PURPOSE
@@ -0,0 +1,3 @@
+PURPOSE of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+Description: test fetching data from mysqldb/mariadb through php
+Author: Karel Srot <ksrot@redhat.com>
diff --git a/tests/httpd-php-mysql-sanity-test/new_mysql.php b/tests/httpd-php-mysql-sanity-test/new_mysql.php
new file mode 100644
index 0000000..6087b11
--- /dev/null
+++ b/tests/httpd-php-mysql-sanity-test/new_mysql.php
@@ -0,0 +1,12 @@
+<?php
+$db = mysqli_connect("localhost", "root");
+if (!$db) {
+    die("Could not connect");
+}
+if (!mysqli_select_db($db, "php_mysql_test")) {
+    die("Could not select database");
+}
+$res = mysqli_query($db, "SELECT * from foobar");
+$row = mysqli_fetch_assoc($res);
+printf("%s is %d\n", $row['name'], $row['value']);
+?>
diff --git a/tests/httpd-php-mysql-sanity-test/old_mysql.php b/tests/httpd-php-mysql-sanity-test/old_mysql.php
new file mode 100644
index 0000000..8904c58
--- /dev/null
+++ b/tests/httpd-php-mysql-sanity-test/old_mysql.php
@@ -0,0 +1,12 @@
+<?php
+$db = mysql_connect("localhost", "root");
+if (!$db) {
+    die("Could not connect");
+}
+if (!mysql_select_db("php_mysql_test")) {
+    die("Could not select database");
+}
+$res = mysql_query("SELECT * from foobar");
+$row = mysql_fetch_assoc($res);
+printf("%s is %d\n", $row['name'], $row['value']);
+?>
diff --git a/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf b/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf
new file mode 100644
index 0000000..d03c3c3
--- /dev/null
+++ b/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf
@@ -0,0 +1,5 @@
+
+Alias /php_mysql_test /var/www/php_mysql_test
+
+<Directory /var/www/php_mysql_test>
+</Directory>
diff --git a/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql b/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql
new file mode 100644
index 0000000..ad931ac
--- /dev/null
+++ b/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql
@@ -0,0 +1,6 @@
+
+CREATE DATABASE php_mysql_test;
+USE php_mysql_test;
+
+CREATE TABLE foobar (name VARCHAR(10), value INTEGER);
+INSERT INTO foobar VALUES("fish", 42);
diff --git a/tests/httpd-php-mysql-sanity-test/runtest.sh b/tests/httpd-php-mysql-sanity-test/runtest.sh
new file mode 100755
index 0000000..e2239ad
--- /dev/null
+++ b/tests/httpd-php-mysql-sanity-test/runtest.sh
@@ -0,0 +1,102 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+#   Description: test fetching data from mysqldb/mariadb through php
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+[ -e /usr/bin/rhts-environment.sh ] && . /usr/bin/rhts-environment.sh
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGES="${PACKAGES:-httpd}"
+REQUIRES="${REQUIRES:-php $DB}"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport httpd/http" 0 "Import httpd library"
+        if rlIsRHEL 5 6 && [ $httpCOLLECTION = 0 ]; then
+            DB="mysql-server"
+            rlRun "rlImport mysql/basic" 0 "Import mysqld library"
+            SERVICE=${mysqlServiceName}
+        else
+            DB="mariadb-server"
+            rlRun "rlImport mariadb55/basic" 0 "Import mariadb library"
+            SERVICE=${mariadbServiceName}
+        fi
+	# install also php-mysql on rhel-6 (instead of php-mysqlnd on rhel-7)
+        rlRun "rlImport php/utils"
+        phpPdoPhpMysqlSetup
+        rlAssertRpm --all
+        rlRun "rlServiceStart $SERVICE" 0
+        rlRun "echo DROP DATABASE php_mysql_test | mysql -u root" 0,1
+        rlRun "mysql --verbose -u root < php_mysql_test.sql"
+        rlRun "httpStop" 0 "Stop httpd if running"
+        rlRun "> $httpLOGDIR/error_log"
+        rlRun "rm -rvf $httpROOTDIR/php_mysql_test"
+        rlRun "mkdir -v $httpROOTDIR/php_mysql_test"
+        rlRun "cp -v php_mysql_test.conf $httpCONFDIR/conf.d/"
+        rlRun "php_version=`rlCheckRpm php`"
+        if [[ $php_version =~ php-7* ]] || [[ $php_version =~ php-5.[5-6]* ]]; then
+            rlRun "cp -v new_mysql.php $httpROOTDIR/php_mysql_test/mysql.php"
+        else
+            rlRun "cp -v old_mysql.php $httpROOTDIR/php_mysql_test/mysql.php"
+        fi
+        rlRun "sed -i 's|/var/www|$httpROOTDIR|' $httpCONFDIR/conf.d/php_mysql_test.conf"
+        rlRun "chown -R apache:  $httpROOTDIR/php_mysql_test"
+        #rlRun "restorecon  $httpROOTDIR/php_mysql_test"
+        selinuxenabled && rlRun "chcon -Rv -t httpd_sys_content_t $httpROOTDIR/php_mysql_test"
+        rlRun "httpStart" 0 "Start httpd"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        URL="http://localhost/php_mysql_test/"
+        RETVAL=0
+        tries=`seq 1 10`
+
+        for n in ${tries}; do
+            output=`curl -s $URL/mysql.php`
+            rv=$?
+            echo "PHP output ${n}: ${rv} x${output}y"
+            [ ${rv} -ne 0 -o "x${output}y" != "xfish is 42y" ] && RETVAL=66
+        done
+
+        if [ $RETVAL -ne 0 ]; then
+            rlFail
+        else
+            rlPass
+        fi
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -f $httpCONFDIR/conf.d/php_mysql_test.conf"
+        rlRun "rm -rf $httpROOTDIR/php_mysql_test"
+        rlRun "echo DROP DATABASE php_mysql_test | mysql -u root"
+        rlRun "rlServiceRestore ${SERVICE}" 0
+        rlRun "httpStop" 0 "Stop httpd if running"
+	# uninstall php-mysql on rhel-6 if it was installed during setup
+        phpPdoPhpMysqlCleanup
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
diff --git a/tests/tests.yml b/tests/tests.yml
new file mode 100644
index 0000000..43c38e7
--- /dev/null
+++ b/tests/tests.yml
@@ -0,0 +1,15 @@
+---
+# Tests that run in all contexts
+- hosts: localhost
+  vars:
+    use_beakerlib_libraries: true
+  roles:
+  - role: standard-test-rhts
+    tags:
+    - classic
+    - container
+    tests:
+    - httpd-php-mysql-sanity-test
+    required_packages:
+    - findutils         # beakerlib needs find command
+    - which             # smoke requires which command

From bb57b966352665d98c2efd9b6f37bfdfb812fcd2 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 23 Nov 2017 11:11:28 +0000
Subject: [PATCH 071/359] build and load mod_brotli

---
 00-base.conf | 1 +
 httpd.spec   | 8 ++++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/00-base.conf b/00-base.conf
index ec9acf1..28dacb3 100644
--- a/00-base.conf
+++ b/00-base.conf
@@ -23,6 +23,7 @@ LoadModule authz_host_module modules/mod_authz_host.so
 LoadModule authz_owner_module modules/mod_authz_owner.so
 LoadModule authz_user_module modules/mod_authz_user.so
 LoadModule autoindex_module modules/mod_autoindex.so
+LoadModule brotli_module modules/mod_brotli.so
 LoadModule cache_module modules/mod_cache.so
 LoadModule cache_disk_module modules/mod_cache_disk.so
 LoadModule cache_socache_module modules/mod_cache_socache.so
diff --git a/httpd.spec b/httpd.spec
index 6a55faa..25f543b 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.29
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -78,7 +78,7 @@ License: ASL 2.0
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
 BuildRequires: autoconf, perl-interpreter, perl-generators, pkgconfig, findutils, xmlto
-BuildRequires: zlib-devel, libselinux-devel, lua-devel
+BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0
 BuildRequires: systemd-devel
 Requires: /etc/mime.types, system-logos-httpd
@@ -276,6 +276,7 @@ export LYNX_PATH=/usr/bin/links
         --with-suexec-syslog \
 	--with-suexec-bin=%{_sbindir}/suexec \
 	--with-suexec-uidmin=1000 --with-suexec-gidmin=1000 \
+        --with-brotli \
         --enable-pie \
         --with-pcre \
         --enable-mods-shared=all \
@@ -679,6 +680,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Nov 23 2017 Joe Orton <jorton@redhat.com> - 2.4.29-2
+- build and load mod_brotli
+
 * Wed Oct 25 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.29-1
 - new version 2.4.29
 

From b94d82008d9638446135c618be5b7fefa3c6f3f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= <besser82@fedoraproject.org>
Date: Sat, 20 Jan 2018 23:06:54 +0100
Subject: [PATCH 072/359] Rebuilt for switch to libxcrypt

---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 3ebf372..f27154c 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.29
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -682,6 +682,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Sat Jan 20 2018 Björn Esser <besser82@fedoraproject.org> - 2.4.29-3
+- Rebuilt for switch to libxcrypt
+
 * Thu Nov 23 2017 Joe Orton <jorton@redhat.com> - 2.4.29-2
 - build and load mod_brotli
 

From 2820bed4db52840588a0c309b77e51822a30dd31 Mon Sep 17 00:00:00 2001
From: Paul Howarth <paul@city-fan.org>
Date: Fri, 26 Jan 2018 17:23:59 +0000
Subject: [PATCH 073/359] Rebuild with updated flags to work around compiler
 issues on i686

---
 httpd.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index f27154c..1720169 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.29
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -682,6 +682,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jan 26 2018 Paul Howarth <paul@city-fan.org> - 2.4.29-4
+- Rebuild with updated flags to work around compiler issues on i686
+  (#1538648, #1538693)
+
 * Sat Jan 20 2018 Björn Esser <besser82@fedoraproject.org> - 2.4.29-3
 - Rebuilt for switch to libxcrypt
 

From 2971e92b1f95f600619e89adf75416fbeeba7cdb Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Sat, 27 Jan 2018 09:19:58 +0100
Subject: [PATCH 074/359] link mod_lua against -lcrypt (#1538992) Resolves:
 rhbz#1538992

---
 httpd-2.4.27-r1822305.patch | 17 +++++++++++++++++
 httpd.spec                  |  7 ++++++-
 2 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.27-r1822305.patch

diff --git a/httpd-2.4.27-r1822305.patch b/httpd-2.4.27-r1822305.patch
new file mode 100644
index 0000000..d8c6a8c
--- /dev/null
+++ b/httpd-2.4.27-r1822305.patch
@@ -0,0 +1,17 @@
+# ./pullrev.sh 1822305
+
+http://svn.apache.org/viewvc?view=revision&revision=1822305
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1538992
+
+--- httpd-2.4.27/modules/lua/config.m4
++++ httpd-2.4.27/modules/lua/config.m4
+@@ -104,7 +104,7 @@
+   CHECK_LUA()
+   if test "x$enable_lua" != "xno" ; then
+     APR_ADDTO(MOD_INCLUDES, [$LUA_CFLAGS])
+-    APR_ADDTO(MOD_LUA_LDADD, [$LUA_LIBS])
++    APR_ADDTO(MOD_LUA_LDADD, [$LUA_LIBS $CRYPT_LIBS])
+   fi
+ ])
+ 
diff --git a/httpd.spec b/httpd.spec
index 1720169..54633d6 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.29
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -56,6 +56,7 @@ Patch2: httpd-2.4.9-apxs.patch
 Patch3: httpd-2.4.1-deplibs.patch
 Patch5: httpd-2.4.3-layout.patch
 Patch6: httpd-2.4.3-apctl-systemd.patch
+Patch7: httpd-2.4.27-r1822305.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
@@ -200,6 +201,7 @@ interface for storing and accessing per-user session data.
 %patch3 -p1 -b .deplibs
 %patch5 -p1 -b .layout
 %patch6 -p1 -b .apctlsystemd
+%patch7 -p1 -b .r1822305
 
 %patch19 -p1 -b .detectsystemd
 
@@ -682,6 +684,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Sat Jan 27 2018 Joe Orton <jorton@redhat.com> - 2.4.29-5
+- link mod_lua against -lcrypt (#1538992)
+
 * Fri Jan 26 2018 Paul Howarth <paul@city-fan.org> - 2.4.29-4
 - Rebuild with updated flags to work around compiler issues on i686
   (#1538648, #1538693)

From cc87a074cd3e0193d2435bfa3565539c287c4091 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 7 Feb 2018 16:31:52 +0000
Subject: [PATCH 075/359] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 54633d6..e952c32 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.29
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -684,6 +684,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.29-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
 * Sat Jan 27 2018 Joe Orton <jorton@redhat.com> - 2.4.29-5
 - link mod_lua against -lcrypt (#1538992)
 

From 5450cc3ba1ff9ca1f9fbed8be812a9be35e40c79 Mon Sep 17 00:00:00 2001
From: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
Date: Tue, 13 Feb 2018 23:30:42 +0100
Subject: [PATCH 076/359] Remove BuildRoot definition

None of currently supported distributions need that.
It was needed last for EL5 which is EOL now

Signed-off-by: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
---
 httpd.spec | 1 -
 1 file changed, 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index e952c32..62f9ef6 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -79,7 +79,6 @@ Patch58: httpd-2.4.25-r1738878.patch
 
 License: ASL 2.0
 Group: System Environment/Daemons
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
 BuildRequires: autoconf, perl-interpreter, perl-generators, pkgconfig, findutils, xmlto
 BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0

From 2919621fa46af1283067d2b7959e54b5036f65d7 Mon Sep 17 00:00:00 2001
From: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
Date: Wed, 14 Feb 2018 08:07:05 +0100
Subject: [PATCH 077/359] Remove %clean section

None of currently supported distributions need that.
Last one was EL5 which is EOL for a while.

Signed-off-by: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
---
 httpd.spec | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 62f9ef6..97b82ed 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -542,9 +542,6 @@ done
 set -x
 exit $rv
 
-%clean
-rm -rf $RPM_BUILD_ROOT
-
 %files
 %defattr(-,root,root)
 

From 4af7d39caff507079f39c874cb4494eeb4c44f81 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 26 Feb 2018 12:28:41 +0000
Subject: [PATCH 078/359] simplify liblua detection in configure

---
 httpd-2.4.27-r1825147.patch | 35 +++++++++++++++++++++++++++++++++++
 httpd.spec                  |  7 ++++++-
 2 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.27-r1825147.patch

diff --git a/httpd-2.4.27-r1825147.patch b/httpd-2.4.27-r1825147.patch
new file mode 100644
index 0000000..314ad2e
--- /dev/null
+++ b/httpd-2.4.27-r1825147.patch
@@ -0,0 +1,35 @@
+# ./pullrev.sh 1825147
+http://svn.apache.org/viewvc?view=revision&revision=1825147
+
+--- httpd-2.4.27/modules/lua/config.m4
++++ httpd-2.4.27/modules/lua/config.m4
+@@ -55,9 +55,16 @@
+     test_paths="${lua_path}"
+ fi
+ 
+-AC_CHECK_LIB(m, pow, lib_m="-lm")
+-AC_CHECK_LIB(m, sqrt, lib_m="-lm")
+-for x in $test_paths ; do
++if test -n "$PKGCONFIG" -a -z "$lua_path" \
++   && $PKGCONFIG --atleast-version=5.1 lua; then
++  LUA_LIBS="`$PKGCONFIG --libs lua`"
++  LUA_CFLAGS="`$PKGCONFIG --cflags lua`"
++  LUA_VERSION="`$PKGCONFIG --modversion lua`"
++  AC_MSG_NOTICE([using Lua $LUA_VERSION configuration from pkg-config])
++else
++  AC_CHECK_LIB(m, pow, lib_m="-lm")
++  AC_CHECK_LIB(m, sqrt, lib_m="-lm")
++  for x in $test_paths ; do
+     CHECK_LUA_PATH([${x}], [include/lua-5.3], [lib/lua-5.3], [lua-5.3])
+     CHECK_LUA_PATH([${x}], [include/lua5.3], [lib], [lua5.3])
+     CHECK_LUA_PATH([${x}], [include/lua53], [lib/lua53], [lua])
+@@ -71,7 +78,8 @@
+     CHECK_LUA_PATH([${x}], [include/lua-5.1], [lib/lua-5.1], [lua-5.1])
+     CHECK_LUA_PATH([${x}], [include/lua5.1], [lib], [lua5.1])
+     CHECK_LUA_PATH([${x}], [include/lua51], [lib/lua51], [lua])
+-done
++  done
++fi
+ 
+ AC_SUBST(LUA_LIBS)
+ AC_SUBST(LUA_CFLAGS)
diff --git a/httpd.spec b/httpd.spec
index 97b82ed..67d7e41 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.29
-Release: 6%{?dist}
+Release: 7%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -57,6 +57,7 @@ Patch3: httpd-2.4.1-deplibs.patch
 Patch5: httpd-2.4.3-layout.patch
 Patch6: httpd-2.4.3-apctl-systemd.patch
 Patch7: httpd-2.4.27-r1822305.patch
+Patch8: httpd-2.4.27-r1825147.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
@@ -201,6 +202,7 @@ interface for storing and accessing per-user session data.
 %patch5 -p1 -b .layout
 %patch6 -p1 -b .apctlsystemd
 %patch7 -p1 -b .r1822305
+%patch8 -p1 -b .r1825147
 
 %patch19 -p1 -b .detectsystemd
 
@@ -680,6 +682,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Feb 26 2018 Joe Orton <jorton@redhat.com> - 2.4.29-7
+- simplify liblua detection in configure
+
 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.29-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
 

From c144c0a274a6af28e637720d7dee87b5f589cb53 Mon Sep 17 00:00:00 2001
From: Jitka Plesnikova <jplesnik@redhat.com>
Date: Mon, 5 Mar 2018 09:36:51 +0100
Subject: [PATCH 079/359] Rebuilt with brotli 1.0.3

---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 67d7e41..2c97e1e 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.29
-Release: 7%{?dist}
+Release: 8%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -682,6 +682,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Mar 05 2018 Jitka Plesnikova <jplesnik@redhat.com> - 2.4.29-8
+- Rebuilt with brotli 1.0.3
+
 * Mon Feb 26 2018 Joe Orton <jorton@redhat.com> - 2.4.29-7
 - simplify liblua detection in configure
 

From 6a73e2c6609714b99512c153d294a95d624025ae Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 28 Mar 2018 20:15:39 +0100
Subject: [PATCH 080/359] Add section on restarts.

---
 httpd.service.xml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/httpd.service.xml b/httpd.service.xml
index b8fe7b3..8008b16 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -166,6 +166,20 @@ Wants=network-online.target</programlisting>
       --kill-who=main --signal=HUP httpd</command>.</para>
     </refsect2>
 
+    <refsect2>
+      <title>Automated service restarts</title>
+
+      <para>System packages (including the httpd package itself) may
+      restart the httpd service automatically after packages are
+      upgraded, installed, or removed. This is done using the
+      <command>systemctl reload httpd.service</command>, which
+      produces a <emphasis>graceful</emphasis> restart by default as
+      described above.</para>
+
+      <para>To suppress automatic reloads entirely, create the file
+      <filename>/etc/sysconfig/httpd-disable-posttrans</filename>.</para>
+    </refsect2>
+
     <refsect2>
       <title>Changing the default MPM (Multi-Processing Module)</title>
 

From c7d07f31b9738c8f1f0d5b31b87e8474541e4818 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 28 Mar 2018 20:18:58 +0100
Subject: [PATCH 081/359] rebase to 2.4.33 (#1560174) add mod_md subpackage;
 load mod_proxy_uwsgi by default

---
 00-proxy.conf                                 |   1 +
 01-md.conf                                    |   1 +
 httpd-2.4.27-r1822305.patch                   |  17 ---
 httpd-2.4.27-r1825147.patch                   |  35 -----
 ...-export.patch => httpd-2.4.33-export.patch |   8 +-
 httpd-2.4.33-mddefault.patch                  |  21 +++
 ...38878.patch => httpd-2.4.33-r1738878.patch | 133 +++++++++---------
 ...patch => httpd-2.4.33-sslciphdefault.patch |  12 +-
 httpd.spec                                    |  47 +++++--
 sources                                       |   2 +-
 10 files changed, 135 insertions(+), 142 deletions(-)
 create mode 100644 01-md.conf
 delete mode 100644 httpd-2.4.27-r1822305.patch
 delete mode 100644 httpd-2.4.27-r1825147.patch
 rename httpd-2.4.4-export.patch => httpd-2.4.33-export.patch (75%)
 create mode 100644 httpd-2.4.33-mddefault.patch
 rename httpd-2.4.25-r1738878.patch => httpd-2.4.33-r1738878.patch (71%)
 rename httpd-2.4.17-sslciphdefault.patch => httpd-2.4.33-sslciphdefault.patch (75%)

diff --git a/00-proxy.conf b/00-proxy.conf
index 448eb63..f0f84c2 100644
--- a/00-proxy.conf
+++ b/00-proxy.conf
@@ -14,4 +14,5 @@ LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
 LoadModule proxy_http_module modules/mod_proxy_http.so
 LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so
 LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
+LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
 LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
diff --git a/01-md.conf b/01-md.conf
new file mode 100644
index 0000000..2739202
--- /dev/null
+++ b/01-md.conf
@@ -0,0 +1 @@
+LoadModule md_module modules/mod_md.so
diff --git a/httpd-2.4.27-r1822305.patch b/httpd-2.4.27-r1822305.patch
deleted file mode 100644
index d8c6a8c..0000000
--- a/httpd-2.4.27-r1822305.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-# ./pullrev.sh 1822305
-
-http://svn.apache.org/viewvc?view=revision&revision=1822305
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1538992
-
---- httpd-2.4.27/modules/lua/config.m4
-+++ httpd-2.4.27/modules/lua/config.m4
-@@ -104,7 +104,7 @@
-   CHECK_LUA()
-   if test "x$enable_lua" != "xno" ; then
-     APR_ADDTO(MOD_INCLUDES, [$LUA_CFLAGS])
--    APR_ADDTO(MOD_LUA_LDADD, [$LUA_LIBS])
-+    APR_ADDTO(MOD_LUA_LDADD, [$LUA_LIBS $CRYPT_LIBS])
-   fi
- ])
- 
diff --git a/httpd-2.4.27-r1825147.patch b/httpd-2.4.27-r1825147.patch
deleted file mode 100644
index 314ad2e..0000000
--- a/httpd-2.4.27-r1825147.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-# ./pullrev.sh 1825147
-http://svn.apache.org/viewvc?view=revision&revision=1825147
-
---- httpd-2.4.27/modules/lua/config.m4
-+++ httpd-2.4.27/modules/lua/config.m4
-@@ -55,9 +55,16 @@
-     test_paths="${lua_path}"
- fi
- 
--AC_CHECK_LIB(m, pow, lib_m="-lm")
--AC_CHECK_LIB(m, sqrt, lib_m="-lm")
--for x in $test_paths ; do
-+if test -n "$PKGCONFIG" -a -z "$lua_path" \
-+   && $PKGCONFIG --atleast-version=5.1 lua; then
-+  LUA_LIBS="`$PKGCONFIG --libs lua`"
-+  LUA_CFLAGS="`$PKGCONFIG --cflags lua`"
-+  LUA_VERSION="`$PKGCONFIG --modversion lua`"
-+  AC_MSG_NOTICE([using Lua $LUA_VERSION configuration from pkg-config])
-+else
-+  AC_CHECK_LIB(m, pow, lib_m="-lm")
-+  AC_CHECK_LIB(m, sqrt, lib_m="-lm")
-+  for x in $test_paths ; do
-     CHECK_LUA_PATH([${x}], [include/lua-5.3], [lib/lua-5.3], [lua-5.3])
-     CHECK_LUA_PATH([${x}], [include/lua5.3], [lib], [lua5.3])
-     CHECK_LUA_PATH([${x}], [include/lua53], [lib/lua53], [lua])
-@@ -71,7 +78,8 @@
-     CHECK_LUA_PATH([${x}], [include/lua-5.1], [lib/lua-5.1], [lua-5.1])
-     CHECK_LUA_PATH([${x}], [include/lua5.1], [lib], [lua5.1])
-     CHECK_LUA_PATH([${x}], [include/lua51], [lib/lua51], [lua])
--done
-+  done
-+fi
- 
- AC_SUBST(LUA_LIBS)
- AC_SUBST(LUA_CFLAGS)
diff --git a/httpd-2.4.4-export.patch b/httpd-2.4.33-export.patch
similarity index 75%
rename from httpd-2.4.4-export.patch
rename to httpd-2.4.33-export.patch
index eb670c6..9adf398 100644
--- a/httpd-2.4.4-export.patch
+++ b/httpd-2.4.33-export.patch
@@ -6,12 +6,12 @@ Upstream-HEAD: needed
 Upstream-2.0: omit
 Upstream-Status: EXPORT_DIRS change is conditional on using shared apr
 
---- httpd-2.4.4/server/Makefile.in.export
-+++ httpd-2.4.4/server/Makefile.in
-@@ -57,9 +57,6 @@ export_files:
- 	( for dir in $(EXPORT_DIRS); do \
+--- httpd-2.4.33/server/Makefile.in.export
++++ httpd-2.4.33/server/Makefile.in
+@@ -60,9 +60,6 @@
  	      ls $$dir/*.h ; \
  	  done; \
+ 	  echo "$(top_srcdir)/server/mpm_fdqueue.h"; \
 -	  for dir in $(EXPORT_DIRS_APR); do \
 -	      ls $$dir/ap[ru].h $$dir/ap[ru]_*.h 2>/dev/null; \
 -	  done; \
diff --git a/httpd-2.4.33-mddefault.patch b/httpd-2.4.33-mddefault.patch
new file mode 100644
index 0000000..9e82fb8
--- /dev/null
+++ b/httpd-2.4.33-mddefault.patch
@@ -0,0 +1,21 @@
+
+Override default.
+
+--- httpd-2.4.33/modules/md/mod_md_config.c.mddefault
++++ httpd-2.4.33/modules/md/mod_md_config.c
+@@ -54,10 +54,14 @@
+ 
+ #define DEF_VAL     (-1)
+ 
++#ifndef MD_DEFAULT_STORE_DIR
++#define MD_DEFAULT_STORE_DIR "state/md"
++#endif
++
+ /* Default settings for the global conf */
+ static md_mod_conf_t defmc = {
+     NULL,
+-    "md",
++    MD_DEFAULT_STORE_DIR,
+     NULL,
+     NULL,
+     80,
diff --git a/httpd-2.4.25-r1738878.patch b/httpd-2.4.33-r1738878.patch
similarity index 71%
rename from httpd-2.4.25-r1738878.patch
rename to httpd-2.4.33-r1738878.patch
index e4b46cc..d7ef42f 100644
--- a/httpd-2.4.25-r1738878.patch
+++ b/httpd-2.4.33-r1738878.patch
@@ -1,28 +1,9 @@
 diff --git a/modules/proxy/ajp.h b/modules/proxy/ajp.h
 index c119a7e..267150a 100644
---- a/modules/proxy/ajp.h
-+++ b/modules/proxy/ajp.h
-@@ -413,12 +413,14 @@ apr_status_t ajp_ilink_receive(apr_socket_t *sock, ajp_msg_t *msg);
-  * @param sock      backend socket
-  * @param r         current request
-  * @param buffsize  max size of the AJP packet.
-+ * @param secret    authentication secret
-  * @param uri       requested uri
-  * @return          APR_SUCCESS or error
-  */
- apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r,
-                              apr_size_t buffsize,
--                             apr_uri_t *uri);
-+                             apr_uri_t *uri,
-+                             const char *secret);
- 
- /**
-  * Read the ajp message and return the type of the message.
-diff --git a/modules/proxy/ajp_header.c b/modules/proxy/ajp_header.c
-index 67353a7..680a8f3 100644
---- a/modules/proxy/ajp_header.c
-+++ b/modules/proxy/ajp_header.c
-@@ -213,7 +213,8 @@ AJPV13_REQUEST/AJPV14_REQUEST=
+diff -uap httpd-2.4.33/modules/proxy/ajp_header.c.r1738878 httpd-2.4.33/modules/proxy/ajp_header.c
+--- httpd-2.4.33/modules/proxy/ajp_header.c.r1738878
++++ httpd-2.4.33/modules/proxy/ajp_header.c
+@@ -213,7 +213,8 @@
  
  static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
                                            request_rec *r,
@@ -32,7 +13,7 @@ index 67353a7..680a8f3 100644
  {
      int method;
      apr_uint32_t i, num_headers = 0;
-@@ -293,17 +294,15 @@ static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
+@@ -293,17 +294,15 @@
                     i, elts[i].key, elts[i].val);
      }
  
@@ -53,7 +34,7 @@ index 67353a7..680a8f3 100644
  
      if (r->user) {
          if (ajp_msg_append_uint8(msg, SC_A_REMOTE_USER) ||
-@@ -671,7 +670,8 @@ static apr_status_t ajp_unmarshal_response(ajp_msg_t *msg,
+@@ -671,7 +670,8 @@
  apr_status_t ajp_send_header(apr_socket_t *sock,
                               request_rec *r,
                               apr_size_t buffsize,
@@ -63,7 +44,7 @@ index 67353a7..680a8f3 100644
  {
      ajp_msg_t *msg;
      apr_status_t rc;
-@@ -683,7 +683,7 @@ apr_status_t ajp_send_header(apr_socket_t *sock,
+@@ -683,7 +683,7 @@
          return rc;
      }
  
@@ -72,48 +53,29 @@ index 67353a7..680a8f3 100644
      if (rc != APR_SUCCESS) {
          ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(00988)
                 "ajp_send_header: ajp_marshal_into_msgb failed");
-diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
-index f6fb473..f693f63 100644
---- a/modules/proxy/mod_proxy.c
-+++ b/modules/proxy/mod_proxy.c
-@@ -314,6 +314,12 @@ static const char *set_worker_param(apr_pool_t *p,
-                                 (int)sizeof(worker->s->upgrade));
-         }
-     }
-+    else if (!strcasecmp(key, "secret")) {
-+        if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) {
-+            return apr_psprintf(p, "Secret length must be < %d characters",
-+                                (int)sizeof(worker->s->secret));
-+        }
-+    }
-     else {
-         if (set_worker_hc_param_f) {
-             return set_worker_hc_param_f(p, s, worker, key, val, NULL);
-diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h
-index 8a0ad10..f92c185 100644
---- a/modules/proxy/mod_proxy.h
-+++ b/modules/proxy/mod_proxy.h
-@@ -352,6 +352,7 @@ PROXY_WORKER_HC_FAIL )
- #define PROXY_WORKER_MAX_HOSTNAME_SIZE  64
- #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
- #define PROXY_BALANCER_MAX_STICKY_SIZE  64
-+#define PROXY_WORKER_MAX_SECRET_SIZE    64
+diff -uap httpd-2.4.33/modules/proxy/ajp.h.r1738878 httpd-2.4.33/modules/proxy/ajp.h
+--- httpd-2.4.33/modules/proxy/ajp.h.r1738878
++++ httpd-2.4.33/modules/proxy/ajp.h
+@@ -413,12 +413,14 @@
+  * @param sock      backend socket
+  * @param r         current request
+  * @param buffsize  max size of the AJP packet.
++ * @param secret    authentication secret
+  * @param uri       requested uri
+  * @return          APR_SUCCESS or error
+  */
+ apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r,
+                              apr_size_t buffsize,
+-                             apr_uri_t *uri);
++                             apr_uri_t *uri,
++                             const char *secret);
  
- /* RFC-1035 mentions limits of 255 for host-names and 253 for domain-names,
-  * dotted together(?) this would fit the below size (+ trailing NUL).
-@@ -443,6 +444,7 @@ typedef struct {
-     hcmethod_t      method;     /* method to use for health check */
-     apr_interval_time_t interval;
-     char      upgrade[PROXY_WORKER_MAX_SCHEME_SIZE];/* upgrade protocol used by mod_proxy_wstunnel */
-+    char      secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */
- } proxy_worker_shared;
- 
- #define ALIGNED_PROXY_WORKER_SHARED_SIZE (APR_ALIGN_DEFAULT(sizeof(proxy_worker_shared)))
-diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
-index 051724e..e706518 100644
---- a/modules/proxy/mod_proxy_ajp.c
-+++ b/modules/proxy/mod_proxy_ajp.c
-@@ -193,6 +193,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
+ /**
+  * Read the ajp message and return the type of the message.
+diff -uap httpd-2.4.33/modules/proxy/mod_proxy_ajp.c.r1738878 httpd-2.4.33/modules/proxy/mod_proxy_ajp.c
+--- httpd-2.4.33/modules/proxy/mod_proxy_ajp.c.r1738878
++++ httpd-2.4.33/modules/proxy/mod_proxy_ajp.c
+@@ -193,6 +193,7 @@
      apr_off_t content_length = 0;
      int original_status = r->status;
      const char *original_status_line = r->status_line;
@@ -121,7 +83,7 @@ index 051724e..e706518 100644
  
      if (psf->io_buffer_size_set)
         maxsize = psf->io_buffer_size;
-@@ -202,12 +203,15 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
+@@ -202,12 +203,15 @@
         maxsize = AJP_MSG_BUFFER_SZ;
      maxsize = APR_ALIGN(maxsize, 1024);
  
@@ -138,3 +100,38 @@ index 051724e..e706518 100644
      if (status != APR_SUCCESS) {
          conn->close = 1;
          ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00868)
+diff -uap httpd-2.4.33/modules/proxy/mod_proxy.c.r1738878 httpd-2.4.33/modules/proxy/mod_proxy.c
+--- httpd-2.4.33/modules/proxy/mod_proxy.c.r1738878
++++ httpd-2.4.33/modules/proxy/mod_proxy.c
+@@ -318,6 +318,12 @@
+                                 (int)sizeof(worker->s->upgrade));
+         }
+     }
++    else if (!strcasecmp(key, "secret")) {
++        if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) {
++            return apr_psprintf(p, "Secret length must be < %d characters",
++                                (int)sizeof(worker->s->secret));
++        }
++    }
+     else {
+         if (set_worker_hc_param_f) {
+             return set_worker_hc_param_f(p, s, worker, key, val, NULL);
+diff -uap httpd-2.4.33/modules/proxy/mod_proxy.h.r1738878 httpd-2.4.33/modules/proxy/mod_proxy.h
+--- httpd-2.4.33/modules/proxy/mod_proxy.h.r1738878
++++ httpd-2.4.33/modules/proxy/mod_proxy.h
+@@ -353,6 +353,7 @@
+ #define PROXY_WORKER_MAX_HOSTNAME_SIZE  64
+ #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
+ #define PROXY_BALANCER_MAX_STICKY_SIZE  64
++#define PROXY_WORKER_MAX_SECRET_SIZE    64
+ 
+ #define PROXY_RFC1035_HOSTNAME_SIZE	256
+ 
+@@ -447,6 +448,7 @@
+     apr_interval_time_t interval;
+     char      upgrade[PROXY_WORKER_MAX_SCHEME_SIZE];/* upgrade protocol used by mod_proxy_wstunnel */
+     char      hostname_ex[PROXY_RFC1035_HOSTNAME_SIZE];  /* RFC1035 compliant version of the remote backend address */
++    char      secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */
+ } proxy_worker_shared;
+ 
+ #define ALIGNED_PROXY_WORKER_SHARED_SIZE (APR_ALIGN_DEFAULT(sizeof(proxy_worker_shared)))
diff --git a/httpd-2.4.17-sslciphdefault.patch b/httpd-2.4.33-sslciphdefault.patch
similarity index 75%
rename from httpd-2.4.17-sslciphdefault.patch
rename to httpd-2.4.33-sslciphdefault.patch
index 8efc461..f2919b8 100644
--- a/httpd-2.4.17-sslciphdefault.patch
+++ b/httpd-2.4.33-sslciphdefault.patch
@@ -3,9 +3,9 @@ https://bugzilla.redhat.com/show_bug.cgi?id=1109119
 
 Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
 
---- httpd-2.4.17/modules/ssl/ssl_engine_config.c.sslciphdefault
-+++ httpd-2.4.17/modules/ssl/ssl_engine_config.c
-@@ -708,8 +708,10 @@ const char *ssl_cmd_SSLCipherSuite(cmd_p
+--- httpd-2.4.33/modules/ssl/ssl_engine_config.c.sslciphdefault
++++ httpd-2.4.33/modules/ssl/ssl_engine_config.c
+@@ -758,8 +758,10 @@
      SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
      SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
  
@@ -18,9 +18,9 @@ Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
  
      if (cmd->path) {
          dc->szCipherSuite = arg;
-@@ -1428,8 +1430,10 @@ const char *ssl_cmd_SSLProxyCipherSuite(
+@@ -1502,8 +1504,10 @@
  {
-     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+     SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
  
 -    /* always disable null and export ciphers */
 -    arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
@@ -29,5 +29,5 @@ Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
 +    if (strncmp(arg, "PROFILE=", 8) != 0)
 +        arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
  
-     sc->proxy->auth.cipher_suite = arg;
+     dc->proxy->auth.cipher_suite = arg;
  
diff --git a/httpd.spec b/httpd.spec
index 2c97e1e..0ba512a 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.29
-Release: 8%{?dist}
+Version: 2.4.33
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -42,6 +42,7 @@ Source25: 01-session.conf
 Source26: 10-listen443.conf
 Source27: httpd.socket
 Source28: 00-optional.conf
+Source29: 01-md.conf
 # Documentation
 Source30: README.confd
 Source31: README.confmod
@@ -56,12 +57,10 @@ Patch2: httpd-2.4.9-apxs.patch
 Patch3: httpd-2.4.1-deplibs.patch
 Patch5: httpd-2.4.3-layout.patch
 Patch6: httpd-2.4.3-apctl-systemd.patch
-Patch7: httpd-2.4.27-r1822305.patch
-Patch8: httpd-2.4.27-r1825147.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
-Patch23: httpd-2.4.4-export.patch
+Patch23: httpd-2.4.33-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
 Patch26: httpd-2.4.4-r1337344+.patch
@@ -70,11 +69,11 @@ Patch29: httpd-2.4.27-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
 Patch31: httpd-2.4.18-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
-Patch35: httpd-2.4.17-sslciphdefault.patch
+Patch35: httpd-2.4.33-sslciphdefault.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
-Patch58: httpd-2.4.25-r1738878.patch
+Patch58: httpd-2.4.33-r1738878.patch
 
 # Security fixes
 
@@ -163,6 +162,19 @@ The mod_ssl module provides strong cryptography for the Apache Web
 server via the Secure Sockets Layer (SSL) and Transport Layer
 Security (TLS) protocols.
 
+%package -n mod_md
+Group: System Environment/Daemons
+Summary: Certificate provisioning using ACME for the Apache HTTP Server
+Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+BuildRequires: jansson-devel, libcurl-devel
+
+%description -n mod_md
+This module manages common properties of domains for one or more
+virtual hosts. Specifically it can use the ACME protocol (RFC Draft)
+to automate certificate provisioning. These will be configured for
+managed domains and their virtual hosts automatically. This includes
+renewal of certificates before they expire.
+
 %package -n mod_proxy_html
 Group: System Environment/Daemons
 Summary: HTML and XML content filters for the Apache HTTP Server
@@ -201,8 +213,6 @@ interface for storing and accessing per-user session data.
 %patch3 -p1 -b .deplibs
 %patch5 -p1 -b .layout
 %patch6 -p1 -b .apctlsystemd
-%patch7 -p1 -b .r1822305
-%patch8 -p1 -b .r1825147
 
 %patch19 -p1 -b .detectsystemd
 
@@ -213,7 +223,7 @@ interface for storing and accessing per-user session data.
 %patch27 -p1 -b .icons
 %patch29 -p1 -b .systemd
 %patch30 -p1 -b .cachehardmax
-%patch31 -p1 -b .sslmultiproxy
+#patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 %patch58 -p1 -b .r1738878
@@ -318,7 +328,8 @@ install -m 644 $RPM_SOURCE_DIR/README.confmod \
     $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/README
 for f in 00-base.conf 00-mpm.conf 00-lua.conf 01-cgi.conf 00-dav.conf \
          00-proxy.conf 00-ssl.conf 01-ldap.conf 00-proxyhtml.conf \
-         01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf; do
+         01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf \
+         01-md.conf; do
   install -m 644 -p $RPM_SOURCE_DIR/$f \
         $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/$f
 done
@@ -366,6 +377,7 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.tmpfiles \
 
 # Other directories
 mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/dav \
+         $RPM_BUILD_ROOT%{_localstatedir}/lib/httpd \
          $RPM_BUILD_ROOT/run/httpd/htcacheclean
 
 # Substitute in defaults which are usually done (badly) by "make install"
@@ -425,6 +437,7 @@ ln -s ../../pixmaps/poweredby.png \
 
 # symlinks for /etc/httpd
 ln -s ../..%{_localstatedir}/log/httpd $RPM_BUILD_ROOT/etc/httpd/logs
+ln -s ../..%{_localstatedir}/lib/httpd $RPM_BUILD_ROOT/etc/httpd/state
 ln -s /run/httpd $RPM_BUILD_ROOT/etc/httpd/run
 ln -s ../..%{_libdir}/httpd/modules $RPM_BUILD_ROOT/etc/httpd/modules
 
@@ -552,6 +565,7 @@ exit $rv
 
 %{_sysconfdir}/httpd/modules
 %{_sysconfdir}/httpd/logs
+%{_sysconfdir}/httpd/state
 %{_sysconfdir}/httpd/run
 %dir %{_sysconfdir}/httpd/conf
 %config(noreplace) %{_sysconfdir}/httpd/conf/httpd.conf
@@ -589,6 +603,7 @@ exit $rv
 %{_libdir}/httpd/modules/mod*.so
 %exclude %{_libdir}/httpd/modules/mod_auth_form.so
 %exclude %{_libdir}/httpd/modules/mod_ssl.so
+%exclude %{_libdir}/httpd/modules/mod_md.so
 %exclude %{_libdir}/httpd/modules/mod_*ldap.so
 %exclude %{_libdir}/httpd/modules/mod_proxy_html.so
 %exclude %{_libdir}/httpd/modules/mod_xml2enc.so
@@ -607,6 +622,7 @@ exit $rv
 %attr(0700,apache,apache) %dir /run/httpd/htcacheclean
 %attr(0700,root,root) %dir %{_localstatedir}/log/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/lib/dav
+%attr(0700,apache,apache) %dir %{_localstatedir}/lib/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd/proxy
 
@@ -671,6 +687,11 @@ exit $rv
 %{_libdir}/httpd/modules/mod_auth_form.so
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
 
+%files -n mod_md
+%defattr(-,root,root)
+%{_libdir}/httpd/modules/mod_md.so
+%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-md.conf
+
 %files devel
 %defattr(-,root,root)
 %{_includedir}/httpd
@@ -682,6 +703,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Mar 28 2018 Joe Orton <jorton@redhat.com> - 2.4.33-1
+- rebase to 2.4.33 (#1560174)
+- add mod_md subpackage; load mod_proxy_uwsgi by default
+
 * Mon Mar 05 2018 Jitka Plesnikova <jplesnik@redhat.com> - 2.4.29-8
 - Rebuilt with brotli 1.0.3
 
diff --git a/sources b/sources
index 6978287..e8c3a89 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.29.tar.bz2) = 840982fd3d21463bc5c1747f211dfacf3abdf634d149e49bb49fd2e5deda140de602dbdf31e1bbe5337a48f718ab2261c408e83a8dd39a9291ee7b6b7a85639a
+SHA512 (httpd-2.4.33.tar.bz2) = e74b2b3346d67be45a8bc8a7cbb8eabf5c403a5cfe5797a976f94a539529843fbcdf03b9ca0548816b2cf37f4ce0eb301f8d5af25b1270fdf8dd9f5bf0585269

From f68f9f06a837965f11953ad52ce31994f93bcb2a Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 28 Mar 2018 20:18:58 +0100
Subject: [PATCH 082/359] rebase to 2.4.33 (#1560174) add mod_md subpackage;
 load mod_proxy_uwsgi by default

---
 00-proxy.conf                                 |   1 +
 01-md.conf                                    |   1 +
 ...-export.patch => httpd-2.4.33-export.patch |   8 +-
 httpd-2.4.33-mddefault.patch                  |  21 +++
 ...38878.patch => httpd-2.4.33-r1738878.patch | 133 +++++++++---------
 ...patch => httpd-2.4.33-sslciphdefault.patch |  12 +-
 httpd.spec                                    |  43 +++++-
 sources                                       |   2 +-
 8 files changed, 136 insertions(+), 85 deletions(-)
 create mode 100644 01-md.conf
 rename httpd-2.4.4-export.patch => httpd-2.4.33-export.patch (75%)
 create mode 100644 httpd-2.4.33-mddefault.patch
 rename httpd-2.4.25-r1738878.patch => httpd-2.4.33-r1738878.patch (71%)
 rename httpd-2.4.17-sslciphdefault.patch => httpd-2.4.33-sslciphdefault.patch (75%)

diff --git a/00-proxy.conf b/00-proxy.conf
index 448eb63..f0f84c2 100644
--- a/00-proxy.conf
+++ b/00-proxy.conf
@@ -14,4 +14,5 @@ LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
 LoadModule proxy_http_module modules/mod_proxy_http.so
 LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so
 LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
+LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
 LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
diff --git a/01-md.conf b/01-md.conf
new file mode 100644
index 0000000..2739202
--- /dev/null
+++ b/01-md.conf
@@ -0,0 +1 @@
+LoadModule md_module modules/mod_md.so
diff --git a/httpd-2.4.4-export.patch b/httpd-2.4.33-export.patch
similarity index 75%
rename from httpd-2.4.4-export.patch
rename to httpd-2.4.33-export.patch
index eb670c6..9adf398 100644
--- a/httpd-2.4.4-export.patch
+++ b/httpd-2.4.33-export.patch
@@ -6,12 +6,12 @@ Upstream-HEAD: needed
 Upstream-2.0: omit
 Upstream-Status: EXPORT_DIRS change is conditional on using shared apr
 
---- httpd-2.4.4/server/Makefile.in.export
-+++ httpd-2.4.4/server/Makefile.in
-@@ -57,9 +57,6 @@ export_files:
- 	( for dir in $(EXPORT_DIRS); do \
+--- httpd-2.4.33/server/Makefile.in.export
++++ httpd-2.4.33/server/Makefile.in
+@@ -60,9 +60,6 @@
  	      ls $$dir/*.h ; \
  	  done; \
+ 	  echo "$(top_srcdir)/server/mpm_fdqueue.h"; \
 -	  for dir in $(EXPORT_DIRS_APR); do \
 -	      ls $$dir/ap[ru].h $$dir/ap[ru]_*.h 2>/dev/null; \
 -	  done; \
diff --git a/httpd-2.4.33-mddefault.patch b/httpd-2.4.33-mddefault.patch
new file mode 100644
index 0000000..9e82fb8
--- /dev/null
+++ b/httpd-2.4.33-mddefault.patch
@@ -0,0 +1,21 @@
+
+Override default.
+
+--- httpd-2.4.33/modules/md/mod_md_config.c.mddefault
++++ httpd-2.4.33/modules/md/mod_md_config.c
+@@ -54,10 +54,14 @@
+ 
+ #define DEF_VAL     (-1)
+ 
++#ifndef MD_DEFAULT_STORE_DIR
++#define MD_DEFAULT_STORE_DIR "state/md"
++#endif
++
+ /* Default settings for the global conf */
+ static md_mod_conf_t defmc = {
+     NULL,
+-    "md",
++    MD_DEFAULT_STORE_DIR,
+     NULL,
+     NULL,
+     80,
diff --git a/httpd-2.4.25-r1738878.patch b/httpd-2.4.33-r1738878.patch
similarity index 71%
rename from httpd-2.4.25-r1738878.patch
rename to httpd-2.4.33-r1738878.patch
index e4b46cc..d7ef42f 100644
--- a/httpd-2.4.25-r1738878.patch
+++ b/httpd-2.4.33-r1738878.patch
@@ -1,28 +1,9 @@
 diff --git a/modules/proxy/ajp.h b/modules/proxy/ajp.h
 index c119a7e..267150a 100644
---- a/modules/proxy/ajp.h
-+++ b/modules/proxy/ajp.h
-@@ -413,12 +413,14 @@ apr_status_t ajp_ilink_receive(apr_socket_t *sock, ajp_msg_t *msg);
-  * @param sock      backend socket
-  * @param r         current request
-  * @param buffsize  max size of the AJP packet.
-+ * @param secret    authentication secret
-  * @param uri       requested uri
-  * @return          APR_SUCCESS or error
-  */
- apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r,
-                              apr_size_t buffsize,
--                             apr_uri_t *uri);
-+                             apr_uri_t *uri,
-+                             const char *secret);
- 
- /**
-  * Read the ajp message and return the type of the message.
-diff --git a/modules/proxy/ajp_header.c b/modules/proxy/ajp_header.c
-index 67353a7..680a8f3 100644
---- a/modules/proxy/ajp_header.c
-+++ b/modules/proxy/ajp_header.c
-@@ -213,7 +213,8 @@ AJPV13_REQUEST/AJPV14_REQUEST=
+diff -uap httpd-2.4.33/modules/proxy/ajp_header.c.r1738878 httpd-2.4.33/modules/proxy/ajp_header.c
+--- httpd-2.4.33/modules/proxy/ajp_header.c.r1738878
++++ httpd-2.4.33/modules/proxy/ajp_header.c
+@@ -213,7 +213,8 @@
  
  static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
                                            request_rec *r,
@@ -32,7 +13,7 @@ index 67353a7..680a8f3 100644
  {
      int method;
      apr_uint32_t i, num_headers = 0;
-@@ -293,17 +294,15 @@ static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
+@@ -293,17 +294,15 @@
                     i, elts[i].key, elts[i].val);
      }
  
@@ -53,7 +34,7 @@ index 67353a7..680a8f3 100644
  
      if (r->user) {
          if (ajp_msg_append_uint8(msg, SC_A_REMOTE_USER) ||
-@@ -671,7 +670,8 @@ static apr_status_t ajp_unmarshal_response(ajp_msg_t *msg,
+@@ -671,7 +670,8 @@
  apr_status_t ajp_send_header(apr_socket_t *sock,
                               request_rec *r,
                               apr_size_t buffsize,
@@ -63,7 +44,7 @@ index 67353a7..680a8f3 100644
  {
      ajp_msg_t *msg;
      apr_status_t rc;
-@@ -683,7 +683,7 @@ apr_status_t ajp_send_header(apr_socket_t *sock,
+@@ -683,7 +683,7 @@
          return rc;
      }
  
@@ -72,48 +53,29 @@ index 67353a7..680a8f3 100644
      if (rc != APR_SUCCESS) {
          ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(00988)
                 "ajp_send_header: ajp_marshal_into_msgb failed");
-diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
-index f6fb473..f693f63 100644
---- a/modules/proxy/mod_proxy.c
-+++ b/modules/proxy/mod_proxy.c
-@@ -314,6 +314,12 @@ static const char *set_worker_param(apr_pool_t *p,
-                                 (int)sizeof(worker->s->upgrade));
-         }
-     }
-+    else if (!strcasecmp(key, "secret")) {
-+        if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) {
-+            return apr_psprintf(p, "Secret length must be < %d characters",
-+                                (int)sizeof(worker->s->secret));
-+        }
-+    }
-     else {
-         if (set_worker_hc_param_f) {
-             return set_worker_hc_param_f(p, s, worker, key, val, NULL);
-diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h
-index 8a0ad10..f92c185 100644
---- a/modules/proxy/mod_proxy.h
-+++ b/modules/proxy/mod_proxy.h
-@@ -352,6 +352,7 @@ PROXY_WORKER_HC_FAIL )
- #define PROXY_WORKER_MAX_HOSTNAME_SIZE  64
- #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
- #define PROXY_BALANCER_MAX_STICKY_SIZE  64
-+#define PROXY_WORKER_MAX_SECRET_SIZE    64
+diff -uap httpd-2.4.33/modules/proxy/ajp.h.r1738878 httpd-2.4.33/modules/proxy/ajp.h
+--- httpd-2.4.33/modules/proxy/ajp.h.r1738878
++++ httpd-2.4.33/modules/proxy/ajp.h
+@@ -413,12 +413,14 @@
+  * @param sock      backend socket
+  * @param r         current request
+  * @param buffsize  max size of the AJP packet.
++ * @param secret    authentication secret
+  * @param uri       requested uri
+  * @return          APR_SUCCESS or error
+  */
+ apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r,
+                              apr_size_t buffsize,
+-                             apr_uri_t *uri);
++                             apr_uri_t *uri,
++                             const char *secret);
  
- /* RFC-1035 mentions limits of 255 for host-names and 253 for domain-names,
-  * dotted together(?) this would fit the below size (+ trailing NUL).
-@@ -443,6 +444,7 @@ typedef struct {
-     hcmethod_t      method;     /* method to use for health check */
-     apr_interval_time_t interval;
-     char      upgrade[PROXY_WORKER_MAX_SCHEME_SIZE];/* upgrade protocol used by mod_proxy_wstunnel */
-+    char      secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */
- } proxy_worker_shared;
- 
- #define ALIGNED_PROXY_WORKER_SHARED_SIZE (APR_ALIGN_DEFAULT(sizeof(proxy_worker_shared)))
-diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
-index 051724e..e706518 100644
---- a/modules/proxy/mod_proxy_ajp.c
-+++ b/modules/proxy/mod_proxy_ajp.c
-@@ -193,6 +193,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
+ /**
+  * Read the ajp message and return the type of the message.
+diff -uap httpd-2.4.33/modules/proxy/mod_proxy_ajp.c.r1738878 httpd-2.4.33/modules/proxy/mod_proxy_ajp.c
+--- httpd-2.4.33/modules/proxy/mod_proxy_ajp.c.r1738878
++++ httpd-2.4.33/modules/proxy/mod_proxy_ajp.c
+@@ -193,6 +193,7 @@
      apr_off_t content_length = 0;
      int original_status = r->status;
      const char *original_status_line = r->status_line;
@@ -121,7 +83,7 @@ index 051724e..e706518 100644
  
      if (psf->io_buffer_size_set)
         maxsize = psf->io_buffer_size;
-@@ -202,12 +203,15 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
+@@ -202,12 +203,15 @@
         maxsize = AJP_MSG_BUFFER_SZ;
      maxsize = APR_ALIGN(maxsize, 1024);
  
@@ -138,3 +100,38 @@ index 051724e..e706518 100644
      if (status != APR_SUCCESS) {
          conn->close = 1;
          ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00868)
+diff -uap httpd-2.4.33/modules/proxy/mod_proxy.c.r1738878 httpd-2.4.33/modules/proxy/mod_proxy.c
+--- httpd-2.4.33/modules/proxy/mod_proxy.c.r1738878
++++ httpd-2.4.33/modules/proxy/mod_proxy.c
+@@ -318,6 +318,12 @@
+                                 (int)sizeof(worker->s->upgrade));
+         }
+     }
++    else if (!strcasecmp(key, "secret")) {
++        if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) {
++            return apr_psprintf(p, "Secret length must be < %d characters",
++                                (int)sizeof(worker->s->secret));
++        }
++    }
+     else {
+         if (set_worker_hc_param_f) {
+             return set_worker_hc_param_f(p, s, worker, key, val, NULL);
+diff -uap httpd-2.4.33/modules/proxy/mod_proxy.h.r1738878 httpd-2.4.33/modules/proxy/mod_proxy.h
+--- httpd-2.4.33/modules/proxy/mod_proxy.h.r1738878
++++ httpd-2.4.33/modules/proxy/mod_proxy.h
+@@ -353,6 +353,7 @@
+ #define PROXY_WORKER_MAX_HOSTNAME_SIZE  64
+ #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
+ #define PROXY_BALANCER_MAX_STICKY_SIZE  64
++#define PROXY_WORKER_MAX_SECRET_SIZE    64
+ 
+ #define PROXY_RFC1035_HOSTNAME_SIZE	256
+ 
+@@ -447,6 +448,7 @@
+     apr_interval_time_t interval;
+     char      upgrade[PROXY_WORKER_MAX_SCHEME_SIZE];/* upgrade protocol used by mod_proxy_wstunnel */
+     char      hostname_ex[PROXY_RFC1035_HOSTNAME_SIZE];  /* RFC1035 compliant version of the remote backend address */
++    char      secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */
+ } proxy_worker_shared;
+ 
+ #define ALIGNED_PROXY_WORKER_SHARED_SIZE (APR_ALIGN_DEFAULT(sizeof(proxy_worker_shared)))
diff --git a/httpd-2.4.17-sslciphdefault.patch b/httpd-2.4.33-sslciphdefault.patch
similarity index 75%
rename from httpd-2.4.17-sslciphdefault.patch
rename to httpd-2.4.33-sslciphdefault.patch
index 8efc461..f2919b8 100644
--- a/httpd-2.4.17-sslciphdefault.patch
+++ b/httpd-2.4.33-sslciphdefault.patch
@@ -3,9 +3,9 @@ https://bugzilla.redhat.com/show_bug.cgi?id=1109119
 
 Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
 
---- httpd-2.4.17/modules/ssl/ssl_engine_config.c.sslciphdefault
-+++ httpd-2.4.17/modules/ssl/ssl_engine_config.c
-@@ -708,8 +708,10 @@ const char *ssl_cmd_SSLCipherSuite(cmd_p
+--- httpd-2.4.33/modules/ssl/ssl_engine_config.c.sslciphdefault
++++ httpd-2.4.33/modules/ssl/ssl_engine_config.c
+@@ -758,8 +758,10 @@
      SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
      SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
  
@@ -18,9 +18,9 @@ Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
  
      if (cmd->path) {
          dc->szCipherSuite = arg;
-@@ -1428,8 +1430,10 @@ const char *ssl_cmd_SSLProxyCipherSuite(
+@@ -1502,8 +1504,10 @@
  {
-     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+     SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
  
 -    /* always disable null and export ciphers */
 -    arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
@@ -29,5 +29,5 @@ Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
 +    if (strncmp(arg, "PROFILE=", 8) != 0)
 +        arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
  
-     sc->proxy->auth.cipher_suite = arg;
+     dc->proxy->auth.cipher_suite = arg;
  
diff --git a/httpd.spec b/httpd.spec
index c82b88a..2cc7874 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -7,7 +7,7 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.29
+Version: 2.4.33
 Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
@@ -37,6 +37,7 @@ Source25: 01-session.conf
 Source26: 10-listen443.conf
 Source27: httpd.socket
 Source28: 00-optional.conf
+Source29: 01-md.conf
 # Documentation
 Source30: README.confd
 Source31: README.confmod
@@ -52,7 +53,7 @@ Patch6: httpd-2.4.3-apctl-systemd.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
-Patch23: httpd-2.4.4-export.patch
+Patch23: httpd-2.4.33-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
 Patch26: httpd-2.4.4-r1337344+.patch
@@ -61,10 +62,12 @@ Patch29: httpd-2.4.27-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
 Patch31: httpd-2.4.18-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
-Patch35: httpd-2.4.17-sslciphdefault.patch
+Patch35: httpd-2.4.33-sslciphdefault.patch
+
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
-Patch58: httpd-2.4.25-r1738878.patch
+Patch58: httpd-2.4.33-r1738878.patch
+
 # Security fixes
 
 License: ASL 2.0
@@ -156,6 +159,19 @@ The mod_ssl module provides strong cryptography for the Apache Web
 server via the Secure Sockets Layer (SSL) and Transport Layer
 Security (TLS) protocols.
 
+%package -n mod_md
+Group: System Environment/Daemons
+Summary: Certificate provisioning using ACME for the Apache HTTP Server
+Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+BuildRequires: jansson-devel, libcurl-devel
+
+%description -n mod_md
+This module manages common properties of domains for one or more
+virtual hosts. Specifically it can use the ACME protocol (RFC Draft)
+to automate certificate provisioning. These will be configured for
+managed domains and their virtual hosts automatically. This includes
+renewal of certificates before they expire.
+
 %package -n mod_proxy_html
 Group: System Environment/Daemons
 Summary: HTML and XML content filters for the Apache HTTP Server
@@ -204,7 +220,7 @@ interface for storing and accessing per-user session data.
 %patch27 -p1 -b .icons
 %patch29 -p1 -b .systemd
 %patch30 -p1 -b .cachehardmax
-%patch31 -p1 -b .sslmultiproxy
+#patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 
@@ -305,7 +321,8 @@ install -m 644 $RPM_SOURCE_DIR/README.confmod \
     $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/README
 for f in 00-base.conf 00-mpm.conf 00-lua.conf 01-cgi.conf 00-dav.conf \
          00-proxy.conf 00-ssl.conf 01-ldap.conf 00-proxyhtml.conf \
-         01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf; do
+         01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf \
+         01-md.conf; do
   install -m 644 -p $RPM_SOURCE_DIR/$f \
         $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/$f
 done
@@ -348,6 +365,7 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.tmpfiles \
 
 # Other directories
 mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/dav \
+         $RPM_BUILD_ROOT%{_localstatedir}/lib/httpd \
          $RPM_BUILD_ROOT/run/httpd/htcacheclean
 
 # Substitute in defaults which are usually done (badly) by "make install"
@@ -407,6 +425,7 @@ ln -s ../../pixmaps/poweredby.png \
 
 # symlinks for /etc/httpd
 ln -s ../..%{_localstatedir}/log/httpd $RPM_BUILD_ROOT/etc/httpd/logs
+ln -s ../..%{_localstatedir}/lib/httpd $RPM_BUILD_ROOT/etc/httpd/state
 ln -s /run/httpd $RPM_BUILD_ROOT/etc/httpd/run
 ln -s ../..%{_libdir}/httpd/modules $RPM_BUILD_ROOT/etc/httpd/modules
 
@@ -563,6 +582,7 @@ rm -rf $RPM_BUILD_ROOT
 
 %{_sysconfdir}/httpd/modules
 %{_sysconfdir}/httpd/logs
+%{_sysconfdir}/httpd/state
 %{_sysconfdir}/httpd/run
 %dir %{_sysconfdir}/httpd/conf
 %config(noreplace) %{_sysconfdir}/httpd/conf/httpd.conf
@@ -600,6 +620,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/httpd/modules/mod*.so
 %exclude %{_libdir}/httpd/modules/mod_auth_form.so
 %exclude %{_libdir}/httpd/modules/mod_ssl.so
+%exclude %{_libdir}/httpd/modules/mod_md.so
 %exclude %{_libdir}/httpd/modules/mod_*ldap.so
 %exclude %{_libdir}/httpd/modules/mod_proxy_html.so
 %exclude %{_libdir}/httpd/modules/mod_xml2enc.so
@@ -618,6 +639,7 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0700,apache,apache) %dir /run/httpd/htcacheclean
 %attr(0700,root,root) %dir %{_localstatedir}/log/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/lib/dav
+%attr(0700,apache,apache) %dir %{_localstatedir}/lib/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd/proxy
 
@@ -677,6 +699,11 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/httpd/modules/mod_auth_form.so
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
 
+%files -n mod_md
+%defattr(-,root,root)
+%{_libdir}/httpd/modules/mod_md.so
+%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-md.conf
+
 %files devel
 %defattr(-,root,root)
 %{_includedir}/httpd
@@ -688,6 +715,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Mar 28 2018 Joe Orton <jorton@redhat.com> - 2.4.33-1
+- rebase to 2.4.33 (#1560174)
+- add mod_md subpackage; load mod_proxy_uwsgi by default
+
 * Wed Oct 25 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.29-1
 - new version 2.4.29
 
diff --git a/sources b/sources
index 6978287..e8c3a89 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.29.tar.bz2) = 840982fd3d21463bc5c1747f211dfacf3abdf634d149e49bb49fd2e5deda140de602dbdf31e1bbe5337a48f718ab2261c408e83a8dd39a9291ee7b6b7a85639a
+SHA512 (httpd-2.4.33.tar.bz2) = e74b2b3346d67be45a8bc8a7cbb8eabf5c403a5cfe5797a976f94a539529843fbcdf03b9ca0548816b2cf37f4ce0eb301f8d5af25b1270fdf8dd9f5bf0585269

From cb3c26bd437510e9bcb18e04b43cc7b6a31f29c8 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Fri, 30 Mar 2018 17:24:23 -0700
Subject: [PATCH 083/359] Exclude mod_md config file from main package
 (#1562413)

---
 httpd.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 0ba512a..9429b61 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -584,6 +584,7 @@ exit $rv
 %exclude %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/01-ldap.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
+%exclude %{_sysconfdir}/httpd/conf.modules.d/01-md.conf
 
 %config(noreplace) %{_sysconfdir}/sysconfig/htcacheclean
 %ghost %{_sysconfdir}/sysconfig/httpd
@@ -703,6 +704,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Mar 30 2018 Adam Williamson <awilliam@redhat.com> - 2.4.33-2
+- Exclude mod_md config file from main package (#1562413)
+
 * Wed Mar 28 2018 Joe Orton <jorton@redhat.com> - 2.4.33-1
 - rebase to 2.4.33 (#1560174)
 - add mod_md subpackage; load mod_proxy_uwsgi by default

From f56e21847dd26be1e91112fef9ded50c737a89d7 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Fri, 30 Mar 2018 17:24:23 -0700
Subject: [PATCH 084/359] Exclude mod_md config file from main package
 (#1562413)

---
 httpd.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 2cc7874..dc1b559 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,7 +8,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -601,6 +601,7 @@ rm -rf $RPM_BUILD_ROOT
 %exclude %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/01-ldap.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
+%exclude %{_sysconfdir}/httpd/conf.modules.d/01-md.conf
 
 %config(noreplace) %{_sysconfdir}/sysconfig/htcacheclean
 %ghost %{_sysconfdir}/sysconfig/httpd
@@ -715,6 +716,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Mar 30 2018 Adam Williamson <awilliam@redhat.com> - 2.4.33-2
+- Exclude mod_md config file from main package (#1562413)
+
 * Wed Mar 28 2018 Joe Orton <jorton@redhat.com> - 2.4.33-1
 - rebase to 2.4.33 (#1560174)
 - add mod_md subpackage; load mod_proxy_uwsgi by default

From 616eacccb0370d7c40fd43d10eb910b3ec4ebbad Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 12 Apr 2018 08:03:52 +0100
Subject: [PATCH 085/359] mod_ssl: drop implicit 'SSLEngine on' for vhost w/o
 certs (#1564537) Resolves: rhbz#1564537

---
 httpd-2.4.33-sslmerging.patch | 15 +++++++++++++++
 httpd.spec                    |  8 +++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.33-sslmerging.patch

diff --git a/httpd-2.4.33-sslmerging.patch b/httpd-2.4.33-sslmerging.patch
new file mode 100644
index 0000000..066b5c8
--- /dev/null
+++ b/httpd-2.4.33-sslmerging.patch
@@ -0,0 +1,15 @@
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1564537
+
+--- httpd-2.4.33/modules/ssl/ssl_engine_init.c.sslmerging
++++ httpd-2.4.33/modules/ssl/ssl_engine_init.c
+@@ -261,7 +261,8 @@
+          * the protocol is https. */
+         if (ap_get_server_protocol(s) 
+             && strcmp("https", ap_get_server_protocol(s)) == 0
+-            && sc->enabled == SSL_ENABLED_UNSET) {
++            && sc->enabled == SSL_ENABLED_UNSET
++            && (!apr_is_empty_array(sc->server->pks->cert_files))) {
+             sc->enabled = SSL_ENABLED_TRUE;
+         }
+ 
diff --git a/httpd.spec b/httpd.spec
index 9429b61..7fc519a 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -74,6 +74,8 @@ Patch35: httpd-2.4.33-sslciphdefault.patch
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.33-r1738878.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1564537
+Patch59: httpd-2.4.33-sslmerging.patch
 
 # Security fixes
 
@@ -227,6 +229,7 @@ interface for storing and accessing per-user session data.
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 %patch58 -p1 -b .r1738878
+%patch59 -p1 -b .sslmerging
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -704,6 +707,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Apr 12 2018 Joe Orton <jorton@redhat.com> - 2.4.33-3
+- mod_ssl: drop implicit 'SSLEngine on' for vhost w/o certs (#1564537)
+
 * Fri Mar 30 2018 Adam Williamson <awilliam@redhat.com> - 2.4.33-2
 - Exclude mod_md config file from main package (#1562413)
 

From e41c00658ac1bb7e8df1a5201e06dd2d7bd39c48 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 16 Apr 2018 08:24:31 +0100
Subject: [PATCH 086/359] - mod_ssl: fix mod_nss compat patch (Rob Crittenden,
 #1566511)

---
 httpd-2.4.33-sslmultiproxy.patch | 140 +++++++++++++++++++++++++++++++
 1 file changed, 140 insertions(+)
 create mode 100644 httpd-2.4.33-sslmultiproxy.patch

diff --git a/httpd-2.4.33-sslmultiproxy.patch b/httpd-2.4.33-sslmultiproxy.patch
new file mode 100644
index 0000000..5879134
--- /dev/null
+++ b/httpd-2.4.33-sslmultiproxy.patch
@@ -0,0 +1,140 @@
+From 11f3375333ca795939d90e14a761f2f288034704 Mon Sep 17 00:00:00 2001
+From: Rob Crittenden <rcritten@redhat.com>
+Date: Fri, 13 Apr 2018 11:14:57 -0400
+Subject: [PATCH] Update sslmultiproxy patch to work with 2.4.33
+
+---
+ httpd-2.4.18-sslmultiproxy.patch | 85 +++++++++++++++++++++++++++-------------
+ 1 file changed, 58 insertions(+), 27 deletions(-)
+
+diff --git a/httpd-2.4.18-sslmultiproxy.patch b/httpd-2.4.18-sslmultiproxy.patch
+index 3f00f3f..9e311ea 100644
+--- a/httpd-2.4.18-sslmultiproxy.patch
++++ b/httpd-2.4.18-sslmultiproxy.patch
+@@ -1,53 +1,81 @@
++From ce2d1d7d4b2bebe34cf37fdeb30d35050092c5b5 Mon Sep 17 00:00:00 2001
++From: Rob Crittenden <rcrit@cow.greyoak.com>
++Date: Thu, 12 Apr 2018 14:36:28 -0400
++Subject: [PATCH] httpd-2.4.18-sslmultiproxy.patch
++
++---
++ modules/ssl/mod_ssl.c         | 24 ++++++++++++++++++++++--
++ modules/ssl/ssl_engine_vars.c | 18 +++++++++++++++++-
++ 2 files changed, 39 insertions(+), 3 deletions(-)
++
+ diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
+-index 717a694..a3ce718 100644
++index 48d64cb..42e85a3 100644
+ --- a/modules/ssl/mod_ssl.c
+ +++ b/modules/ssl/mod_ssl.c
+-@@ -395,6 +395,9 @@ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c)
+-     return sslconn;
++@@ -444,12 +444,19 @@ static int ssl_hook_pre_config(apr_pool_t *pconf,
++     return OK;
+  }
+  
+-+static typeof(ssl_proxy_enable) *othermod_proxy_enable;
+ +static typeof(ssl_engine_disable) *othermod_engine_disable;
+++static typeof(ssl_engine_set) *othermod_engine_set;
+ +
+- int ssl_proxy_enable(conn_rec *c)
++ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c,
++                                            ap_conf_vector_t *per_dir_config)
+  {
+-     SSLSrvConfigRec *sc;
+-@@ -403,6 +406,12 @@ int ssl_proxy_enable(conn_rec *c)
+-     sc = mySrvConfig(sslconn->server);
+- 
+-     if (!sc->proxy_enabled) {
+-+        if (othermod_proxy_enable) {
+-+            ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c,
+-+                          "mod_ssl proxy not configured, passing through to other module.");
+-+            return othermod_proxy_enable(c);
+-+        }
+-+
+-         ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(01961)
+-                       "SSL Proxy requested for %s but not enabled "
+-                       "[Hint: SSLProxyEngine]", sc->vhost_id);
+-@@ -422,6 +431,10 @@ int ssl_engine_disable(conn_rec *c)
+- 
+      SSLConnRec *sslconn = myConnConfig(c);
++     SSLSrvConfigRec *sc;
+  
+ +    if (othermod_engine_disable) {
+ +        othermod_engine_disable(c);
+ +    }
+ +
+      if (sslconn) {
+-         sc = mySrvConfig(sslconn->server);
++         return sslconn;
+      }
+-@@ -621,6 +634,9 @@ static void ssl_register_hooks(apr_pool_t *p)
+-     ap_hook_post_read_request(ssl_hook_ReadReq, pre_prr,NULL, APR_HOOK_MIDDLE);
++@@ -508,6 +515,10 @@ static int ssl_engine_set(conn_rec *c,
++ {
++     SSLConnRec *sslconn;
++     int status;
+++
+++    if (othermod_engine_set) {
+++        return othermod_engine_set(c, per_dir_config, proxy, enable);
+++    }
++     
++     if (proxy) {
++         sslconn = ssl_init_connection_ctx(c, per_dir_config);
++@@ -537,12 +548,18 @@ static int ssl_engine_set(conn_rec *c,
++ 
++ static int ssl_proxy_enable(conn_rec *c)
++ {
++-    return ssl_engine_set(c, NULL, 1, 1);
+++    if (othermod_engine_set)
+++        return othermod_engine_set(c, NULL, 1, 1);
+++    else
+++        return ssl_engine_set(c, NULL, 1, 1);
++ }
++ 
++ static int ssl_engine_disable(conn_rec *c)
++ {
++-    return ssl_engine_set(c, NULL, 0, 0);
+++    if (othermod_engine_set)
+++        return othermod_engine_set(c, NULL, 0, 0);
+++    else
+++        return ssl_engine_set(c, NULL, 0, 0);
++ }
++ 
++ int ssl_init_ssl_connection(conn_rec *c, request_rec *r)
++@@ -730,6 +747,9 @@ static void ssl_register_hooks(apr_pool_t *p)
++                       APR_HOOK_MIDDLE);
+  
+      ssl_var_register(p);
+ +    
+-+    othermod_proxy_enable = APR_RETRIEVE_OPTIONAL_FN(ssl_proxy_enable);
+ +    othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable);
+++    othermod_engine_set = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_set);
+  
+      APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
+      APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
+ diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c
+-index a6b0d0d..24fd8c7 100644
++index a28d4dd..caf7131 100644
+ --- a/modules/ssl/ssl_engine_vars.c
+ +++ b/modules/ssl/ssl_engine_vars.c
+ @@ -54,6 +54,8 @@ static char *ssl_var_lookup_ssl_cipher(apr_pool_t *p, SSLConnRec *sslconn, char
+@@ -80,7 +108,7 @@ index a6b0d0d..24fd8c7 100644
+      APR_REGISTER_OPTIONAL_FN(ssl_is_https);
+      APR_REGISTER_OPTIONAL_FN(ssl_var_lookup);
+      APR_REGISTER_OPTIONAL_FN(ssl_ext_list);
+-@@ -272,6 +279,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r,
++@@ -271,6 +278,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r,
+       */
+      if (result == NULL && c != NULL) {
+          SSLConnRec *sslconn = ssl_get_effective_config(c);
+@@ -96,3 +124,6 @@ index a6b0d0d..24fd8c7 100644
+          if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
+              && sslconn && sslconn->ssl)
+              result = ssl_var_lookup_ssl(p, sslconn, r, var+4);
++-- 
++2.14.3
++
+-- 
+2.13.6
+

From dbbe3f2b69ca74595353ec34337693492f1f2f8d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 16 Apr 2018 08:25:48 +0100
Subject: [PATCH 087/359] mod_ssl: fix mod_nss compat patch (Rob Crittenden,
 #1566511) mod_md: change hard-coded default MdStoreDir to state/md (#1563846)
 Resolves: rhbz#1566511 Resolves: rhbz#1563846

---
 httpd.spec | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 7fc519a..4702136 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -60,6 +60,7 @@ Patch6: httpd-2.4.3-apctl-systemd.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
+Patch21: httpd-2.4.33-mddefault.patch
 Patch23: httpd-2.4.33-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
@@ -218,6 +219,7 @@ interface for storing and accessing per-user session data.
 
 %patch19 -p1 -b .detectsystemd
 
+%patch21 -p1 -b .mddefault
 %patch23 -p1 -b .export
 %patch24 -p1 -b .corelimit
 %patch25 -p1 -b .selinux
@@ -225,7 +227,7 @@ interface for storing and accessing per-user session data.
 %patch27 -p1 -b .icons
 %patch29 -p1 -b .systemd
 %patch30 -p1 -b .cachehardmax
-#patch31 -p1 -b .sslmultiproxy
+%patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 %patch58 -p1 -b .r1738878
@@ -707,6 +709,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Apr 16 2018 Joe Orton <jorton@redhat.com> - 2.4.33-4
+- mod_ssl: fix mod_nss compat patch (Rob Crittenden, #1566511)
+- mod_md: change hard-coded default MdStoreDir to state/md (#1563846)
+
 * Thu Apr 12 2018 Joe Orton <jorton@redhat.com> - 2.4.33-3
 - mod_ssl: drop implicit 'SSLEngine on' for vhost w/o certs (#1564537)
 

From 480519c1a79db4c982937cf1be5ac43f944d2f1c Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 16 Apr 2018 08:28:27 +0100
Subject: [PATCH 088/359] Fix to use correct multiproxy patch.

---
 httpd-2.4.18-sslmultiproxy.patch | 98 --------------------------------
 1 file changed, 98 deletions(-)
 delete mode 100644 httpd-2.4.18-sslmultiproxy.patch

diff --git a/httpd-2.4.18-sslmultiproxy.patch b/httpd-2.4.18-sslmultiproxy.patch
deleted file mode 100644
index 3f00f3f..0000000
--- a/httpd-2.4.18-sslmultiproxy.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
-index 717a694..a3ce718 100644
---- a/modules/ssl/mod_ssl.c
-+++ b/modules/ssl/mod_ssl.c
-@@ -395,6 +395,9 @@ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c)
-     return sslconn;
- }
- 
-+static typeof(ssl_proxy_enable) *othermod_proxy_enable;
-+static typeof(ssl_engine_disable) *othermod_engine_disable;
-+
- int ssl_proxy_enable(conn_rec *c)
- {
-     SSLSrvConfigRec *sc;
-@@ -403,6 +406,12 @@ int ssl_proxy_enable(conn_rec *c)
-     sc = mySrvConfig(sslconn->server);
- 
-     if (!sc->proxy_enabled) {
-+        if (othermod_proxy_enable) {
-+            ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c,
-+                          "mod_ssl proxy not configured, passing through to other module.");
-+            return othermod_proxy_enable(c);
-+        }
-+
-         ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(01961)
-                       "SSL Proxy requested for %s but not enabled "
-                       "[Hint: SSLProxyEngine]", sc->vhost_id);
-@@ -422,6 +431,10 @@ int ssl_engine_disable(conn_rec *c)
- 
-     SSLConnRec *sslconn = myConnConfig(c);
- 
-+    if (othermod_engine_disable) {
-+        othermod_engine_disable(c);
-+    }
-+
-     if (sslconn) {
-         sc = mySrvConfig(sslconn->server);
-     }
-@@ -621,6 +634,9 @@ static void ssl_register_hooks(apr_pool_t *p)
-     ap_hook_post_read_request(ssl_hook_ReadReq, pre_prr,NULL, APR_HOOK_MIDDLE);
- 
-     ssl_var_register(p);
-+    
-+    othermod_proxy_enable = APR_RETRIEVE_OPTIONAL_FN(ssl_proxy_enable);
-+    othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable);
- 
-     APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
-     APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
-diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c
-index a6b0d0d..24fd8c7 100644
---- a/modules/ssl/ssl_engine_vars.c
-+++ b/modules/ssl/ssl_engine_vars.c
-@@ -54,6 +54,8 @@ static char *ssl_var_lookup_ssl_cipher(apr_pool_t *p, SSLConnRec *sslconn, char
- static void  ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algkeysize);
- static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var);
- static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl);
-+static APR_OPTIONAL_FN_TYPE(ssl_is_https) *othermod_is_https;
-+static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *othermod_var_lookup;
- 
- static SSLConnRec *ssl_get_effective_config(conn_rec *c)
- {
-@@ -68,7 +70,9 @@ static SSLConnRec *ssl_get_effective_config(conn_rec *c)
- static int ssl_is_https(conn_rec *c)
- {
-     SSLConnRec *sslconn = ssl_get_effective_config(c);
--    return sslconn && sslconn->ssl;
-+
-+    return (sslconn && sslconn->ssl)
-+        || (othermod_is_https && othermod_is_https(c));
- }
- 
- static const char var_interface[] = "mod_ssl/" AP_SERVER_BASEREVISION;
-@@ -137,6 +141,9 @@ void ssl_var_register(apr_pool_t *p)
- {
-     char *cp, *cp2;
- 
-+    othermod_is_https = APR_RETRIEVE_OPTIONAL_FN(ssl_is_https);
-+    othermod_var_lookup = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup);
-+
-     APR_REGISTER_OPTIONAL_FN(ssl_is_https);
-     APR_REGISTER_OPTIONAL_FN(ssl_var_lookup);
-     APR_REGISTER_OPTIONAL_FN(ssl_ext_list);
-@@ -272,6 +279,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r,
-      */
-     if (result == NULL && c != NULL) {
-         SSLConnRec *sslconn = ssl_get_effective_config(c);
-+
-+        if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
-+            && (!sslconn || !sslconn->ssl) && othermod_var_lookup) {
-+            /* For an SSL_* variable, if mod_ssl is not enabled for
-+             * this connection and another SSL module is present, pass
-+             * through to that module. */
-+            return othermod_var_lookup(p, s, c, r, var);
-+        }
-+
-         if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
-             && sslconn && sslconn->ssl)
-             result = ssl_var_lookup_ssl(p, sslconn, r, var+4);

From 935fcaceb70646cf9aaef3b96883dffa3d6d6d37 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 16 Apr 2018 08:44:11 +0100
Subject: [PATCH 089/359] Apply sslmultiproxy patch.

---
 httpd-2.4.33-sslmultiproxy.patch | 254 +++++++++++++++----------------
 1 file changed, 120 insertions(+), 134 deletions(-)

diff --git a/httpd-2.4.33-sslmultiproxy.patch b/httpd-2.4.33-sslmultiproxy.patch
index 5879134..679f229 100644
--- a/httpd-2.4.33-sslmultiproxy.patch
+++ b/httpd-2.4.33-sslmultiproxy.patch
@@ -1,140 +1,126 @@
-From 11f3375333ca795939d90e14a761f2f288034704 Mon Sep 17 00:00:00 2001
-From: Rob Crittenden <rcritten@redhat.com>
-Date: Fri, 13 Apr 2018 11:14:57 -0400
-Subject: [PATCH] Update sslmultiproxy patch to work with 2.4.33
+From ce2d1d7d4b2bebe34cf37fdeb30d35050092c5b5 Mon Sep 17 00:00:00 2001
+From: Rob Crittenden <rcrit@cow.greyoak.com>
+Date: Thu, 12 Apr 2018 14:36:28 -0400
+Subject: [PATCH] httpd-2.4.18-sslmultiproxy.patch
 
 ---
- httpd-2.4.18-sslmultiproxy.patch | 85 +++++++++++++++++++++++++++-------------
- 1 file changed, 58 insertions(+), 27 deletions(-)
+ modules/ssl/mod_ssl.c         | 24 ++++++++++++++++++++++--
+ modules/ssl/ssl_engine_vars.c | 18 +++++++++++++++++-
+ 2 files changed, 39 insertions(+), 3 deletions(-)
 
-diff --git a/httpd-2.4.18-sslmultiproxy.patch b/httpd-2.4.18-sslmultiproxy.patch
-index 3f00f3f..9e311ea 100644
---- a/httpd-2.4.18-sslmultiproxy.patch
-+++ b/httpd-2.4.18-sslmultiproxy.patch
-@@ -1,53 +1,81 @@
-+From ce2d1d7d4b2bebe34cf37fdeb30d35050092c5b5 Mon Sep 17 00:00:00 2001
-+From: Rob Crittenden <rcrit@cow.greyoak.com>
-+Date: Thu, 12 Apr 2018 14:36:28 -0400
-+Subject: [PATCH] httpd-2.4.18-sslmultiproxy.patch
+diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
+index 48d64cb..42e85a3 100644
+diff -uap httpd-2.4.33/modules/ssl/mod_ssl.c.sslmultiproxy httpd-2.4.33/modules/ssl/mod_ssl.c
+--- httpd-2.4.33/modules/ssl/mod_ssl.c.sslmultiproxy
++++ httpd-2.4.33/modules/ssl/mod_ssl.c
+@@ -444,12 +444,19 @@
+     return OK;
+ }
+ 
++static APR_OPTIONAL_FN_TYPE(ssl_engine_disable) *othermod_engine_disable;
++static APR_OPTIONAL_FN_TYPE(ssl_engine_set) *othermod_engine_set;
 +
-+---
-+ modules/ssl/mod_ssl.c         | 24 ++++++++++++++++++++++--
-+ modules/ssl/ssl_engine_vars.c | 18 +++++++++++++++++-
-+ 2 files changed, 39 insertions(+), 3 deletions(-)
+ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c,
+                                            ap_conf_vector_t *per_dir_config)
+ {
+     SSLConnRec *sslconn = myConnConfig(c);
+     SSLSrvConfigRec *sc;
+ 
++    if (othermod_engine_disable) {
++        othermod_engine_disable(c);
++    }
 +
- diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
--index 717a694..a3ce718 100644
-+index 48d64cb..42e85a3 100644
- --- a/modules/ssl/mod_ssl.c
- +++ b/modules/ssl/mod_ssl.c
--@@ -395,6 +395,9 @@ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c)
--     return sslconn;
-+@@ -444,12 +444,19 @@ static int ssl_hook_pre_config(apr_pool_t *pconf,
-+     return OK;
-  }
-  
--+static typeof(ssl_proxy_enable) *othermod_proxy_enable;
- +static typeof(ssl_engine_disable) *othermod_engine_disable;
-++static typeof(ssl_engine_set) *othermod_engine_set;
- +
-- int ssl_proxy_enable(conn_rec *c)
-+ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c,
-+                                            ap_conf_vector_t *per_dir_config)
-  {
--     SSLSrvConfigRec *sc;
--@@ -403,6 +406,12 @@ int ssl_proxy_enable(conn_rec *c)
--     sc = mySrvConfig(sslconn->server);
-- 
--     if (!sc->proxy_enabled) {
--+        if (othermod_proxy_enable) {
--+            ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c,
--+                          "mod_ssl proxy not configured, passing through to other module.");
--+            return othermod_proxy_enable(c);
--+        }
--+
--         ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(01961)
--                       "SSL Proxy requested for %s but not enabled "
--                       "[Hint: SSLProxyEngine]", sc->vhost_id);
--@@ -422,6 +431,10 @@ int ssl_engine_disable(conn_rec *c)
-- 
-      SSLConnRec *sslconn = myConnConfig(c);
-+     SSLSrvConfigRec *sc;
-  
- +    if (othermod_engine_disable) {
- +        othermod_engine_disable(c);
- +    }
- +
-      if (sslconn) {
--         sc = mySrvConfig(sslconn->server);
-+         return sslconn;
-      }
--@@ -621,6 +634,9 @@ static void ssl_register_hooks(apr_pool_t *p)
--     ap_hook_post_read_request(ssl_hook_ReadReq, pre_prr,NULL, APR_HOOK_MIDDLE);
-+@@ -508,6 +515,10 @@ static int ssl_engine_set(conn_rec *c,
-+ {
-+     SSLConnRec *sslconn;
-+     int status;
-++
-++    if (othermod_engine_set) {
-++        return othermod_engine_set(c, per_dir_config, proxy, enable);
-++    }
-+     
-+     if (proxy) {
-+         sslconn = ssl_init_connection_ctx(c, per_dir_config);
-+@@ -537,12 +548,18 @@ static int ssl_engine_set(conn_rec *c,
-+ 
-+ static int ssl_proxy_enable(conn_rec *c)
-+ {
-+-    return ssl_engine_set(c, NULL, 1, 1);
-++    if (othermod_engine_set)
-++        return othermod_engine_set(c, NULL, 1, 1);
-++    else
-++        return ssl_engine_set(c, NULL, 1, 1);
-+ }
-+ 
-+ static int ssl_engine_disable(conn_rec *c)
-+ {
-+-    return ssl_engine_set(c, NULL, 0, 0);
-++    if (othermod_engine_set)
-++        return othermod_engine_set(c, NULL, 0, 0);
-++    else
-++        return ssl_engine_set(c, NULL, 0, 0);
-+ }
-+ 
-+ int ssl_init_ssl_connection(conn_rec *c, request_rec *r)
-+@@ -730,6 +747,9 @@ static void ssl_register_hooks(apr_pool_t *p)
-+                       APR_HOOK_MIDDLE);
-  
-      ssl_var_register(p);
- +    
--+    othermod_proxy_enable = APR_RETRIEVE_OPTIONAL_FN(ssl_proxy_enable);
- +    othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable);
-++    othermod_engine_set = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_set);
-  
-      APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
-      APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
- diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c
--index a6b0d0d..24fd8c7 100644
-+index a28d4dd..caf7131 100644
- --- a/modules/ssl/ssl_engine_vars.c
- +++ b/modules/ssl/ssl_engine_vars.c
- @@ -54,6 +54,8 @@ static char *ssl_var_lookup_ssl_cipher(apr_pool_t *p, SSLConnRec *sslconn, char
-@@ -80,7 +108,7 @@ index a6b0d0d..24fd8c7 100644
-      APR_REGISTER_OPTIONAL_FN(ssl_is_https);
-      APR_REGISTER_OPTIONAL_FN(ssl_var_lookup);
-      APR_REGISTER_OPTIONAL_FN(ssl_ext_list);
--@@ -272,6 +279,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r,
-+@@ -271,6 +278,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r,
-       */
-      if (result == NULL && c != NULL) {
-          SSLConnRec *sslconn = ssl_get_effective_config(c);
-@@ -96,3 +124,6 @@ index a6b0d0d..24fd8c7 100644
-          if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
-              && sslconn && sslconn->ssl)
-              result = ssl_var_lookup_ssl(p, sslconn, r, var+4);
-+-- 
-+2.14.3
+     if (sslconn) {
+         return sslconn;
+     }
+@@ -508,6 +515,10 @@
+ {
+     SSLConnRec *sslconn;
+     int status;
 +
--- 
-2.13.6
-
++    if (othermod_engine_set) {
++        return othermod_engine_set(c, per_dir_config, proxy, enable);
++    }
+     
+     if (proxy) {
+         sslconn = ssl_init_connection_ctx(c, per_dir_config);
+@@ -537,12 +548,18 @@
+ 
+ static int ssl_proxy_enable(conn_rec *c)
+ {
+-    return ssl_engine_set(c, NULL, 1, 1);
++    if (othermod_engine_set)
++        return othermod_engine_set(c, NULL, 1, 1);
++    else
++        return ssl_engine_set(c, NULL, 1, 1);
+ }
+ 
+ static int ssl_engine_disable(conn_rec *c)
+ {
+-    return ssl_engine_set(c, NULL, 0, 0);
++    if (othermod_engine_set)
++        return othermod_engine_set(c, NULL, 0, 0);
++    else
++        return ssl_engine_set(c, NULL, 0, 0);
+ }
+ 
+ int ssl_init_ssl_connection(conn_rec *c, request_rec *r)
+@@ -730,6 +747,9 @@
+                       APR_HOOK_MIDDLE);
+ 
+     ssl_var_register(p);
++    
++    othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable);
++    othermod_engine_set = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_set);
+ 
+     APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
+     APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
+diff -uap httpd-2.4.33/modules/ssl/ssl_engine_vars.c.sslmultiproxy httpd-2.4.33/modules/ssl/ssl_engine_vars.c
+--- httpd-2.4.33/modules/ssl/ssl_engine_vars.c.sslmultiproxy
++++ httpd-2.4.33/modules/ssl/ssl_engine_vars.c
+@@ -54,6 +54,8 @@
+ static void  ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algkeysize);
+ static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var);
+ static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl);
++static APR_OPTIONAL_FN_TYPE(ssl_is_https) *othermod_is_https;
++static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *othermod_var_lookup;
+ 
+ static SSLConnRec *ssl_get_effective_config(conn_rec *c)
+ {
+@@ -68,7 +70,9 @@
+ static int ssl_is_https(conn_rec *c)
+ {
+     SSLConnRec *sslconn = ssl_get_effective_config(c);
+-    return sslconn && sslconn->ssl;
++
++    return (sslconn && sslconn->ssl)
++        || (othermod_is_https && othermod_is_https(c));
+ }
+ 
+ static const char var_interface[] = "mod_ssl/" AP_SERVER_BASEREVISION;
+@@ -137,6 +141,9 @@
+ {
+     char *cp, *cp2;
+ 
++    othermod_is_https = APR_RETRIEVE_OPTIONAL_FN(ssl_is_https);
++    othermod_var_lookup = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup);
++
+     APR_REGISTER_OPTIONAL_FN(ssl_is_https);
+     APR_REGISTER_OPTIONAL_FN(ssl_var_lookup);
+     APR_REGISTER_OPTIONAL_FN(ssl_ext_list);
+@@ -271,6 +278,15 @@
+      */
+     if (result == NULL && c != NULL) {
+         SSLConnRec *sslconn = ssl_get_effective_config(c);
++
++        if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
++            && (!sslconn || !sslconn->ssl) && othermod_var_lookup) {
++            /* For an SSL_* variable, if mod_ssl is not enabled for
++             * this connection and another SSL module is present, pass
++             * through to that module. */
++            return othermod_var_lookup(p, s, c, r, var);
++        }
++
+         if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
+             && sslconn && sslconn->ssl)
+             result = ssl_var_lookup_ssl(p, sslconn, r, var+4);

From 799dcecff84cab0900592a65440333e378b0a89a Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 16 Apr 2018 08:44:34 +0100
Subject: [PATCH 090/359] Use updated sslmultiproxy patch.

---
 httpd.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 4702136..b89f424 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -68,7 +68,7 @@ Patch26: httpd-2.4.4-r1337344+.patch
 Patch27: httpd-2.4.2-icons.patch
 Patch29: httpd-2.4.27-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
-Patch31: httpd-2.4.18-sslmultiproxy.patch
+Patch31: httpd-2.4.33-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
 Patch35: httpd-2.4.33-sslciphdefault.patch
 

From 5860daab1113a7ccce3c7977e6d509c7df3dbd2b Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 19 Apr 2018 17:18:11 +0100
Subject: [PATCH 091/359] add httpd@.service; update httpd.service(8) and add
 new stub

---
 httpd.service.xml | 51 ++++++++++++++++++++++++++++++++++++++++++++---
 httpd.spec        | 23 +++++++++++++++++++--
 httpd@.service    | 23 +++++++++++++++++++++
 instance.conf     | 22 ++++++++++++++++++++
 4 files changed, 114 insertions(+), 5 deletions(-)
 create mode 100644 httpd@.service
 create mode 100644 instance.conf

diff --git a/httpd.service.xml b/httpd.service.xml
index 8008b16..bc6c503 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -4,7 +4,7 @@
 
 ]>
 <!--
- Copyright 2017 Red Hat, Inc.
+ Copyright 2018 Red Hat, Inc.
 
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
@@ -36,6 +36,7 @@
   
   <refnamediv>
     <refname>httpd.service</refname>
+    <refname>httpd@.service</refname>
     <refname>httpd.socket</refname>
     <refname>httpd-init.service</refname>
     <refpurpose>httpd unit files for systemd</refpurpose>
@@ -44,6 +45,7 @@
   <refsynopsisdiv>
     <para>
       <filename>/usr/lib/systemd/system/httpd.service</filename>, 
+      <filename>/usr/lib/systemd/system/httpd@.service</filename>,
       <filename>/usr/lib/systemd/system/httpd-init.service</filename>,
       <filename>/usr/lib/systemd/system/httpd.socket</filename>
     </para>
@@ -82,8 +84,9 @@
       directly, since such changes would be lost over package
       upgrades. Running <command>systemctl edit
       httpd.service</command> or <command>systemctl edit
-      httpd.socket</command> as root will create a drop-in file in
-      <filename>/etc/systemd/system/httpd.service.d</filename> which
+      httpd.socket</command> as root will create a drop-in file (in
+      the former case, in
+      <filename>/etc/systemd/system/httpd.service.d</filename>) which
       over-rides the system defaults.</para>
 
       <para>For example, to set the <option>LD_LIBRARY_PATH</option>
@@ -260,6 +263,48 @@ Wants=network-online.target</programlisting>
       192.168.1.2:80</literal>" will not work.</para>
     </refsect2>
 
+    <refsect2>
+      <title>Instatiated services</title>
+
+      <para>The <command>httpd@.service</command> unit is an
+      instatiated template service. An instance of this unit will be
+      started using the configuration file
+      <filename>/etc/httpd/conf/INSTANCE.conf</filename>, where
+      <emphasis>INSTANCE</emphasis> is replaced with the instance
+      name.  For example, <command>systemctl start
+      httpd@foobar.service</command> will start httpd using the
+      configuration file
+      <filename>/etc/httpd/conf/foobar.conf</filename>.  The
+      <option>HTTPD_INSTANCE</option> environment variable is set to
+      the instance name by the unit and is available name for use
+      within the configuration file.</para>
+
+      <para>To allow multiple instances of httpd to run
+      simultaneously, a number of configuration directives must be
+      changed; such as <command>PidFile</command> and
+      <command>DefaultRuntimeDir</command> to pick non-conflict paths,
+      and <command>Listen</command> to choose ports.  The example
+      configuration file
+      <filename>/usr/share/doc/httpd/instance.conf</filename>
+      demonstrates how to make such changes using
+      <option>HTTPD_INSTANCE</option> variable.</para>
+
+      <para>It can be useful to configure instances of
+      <command>httpd@.service</command> to reload when
+      <command>httpd.service</command> is reloaded; for example,
+      <command>logrotate</command> will reload only
+      <command>httpd.service</command> when logs are rotated. If this
+      behaviour is required, create a drop-in file for the instance as
+      follows:
+
+      <programlisting>[Unit]
+ReloadPropagatedFrom=httpd.service</programlisting>
+
+      As with normal units, drop-in files for instances can be created
+      using <command>systemctl edit</command>, e.g. <command>systemctl edit
+      httpd@foobar.service</command>.</para>
+    </refsect2>
+
   </refsect1>
 
   <refsect1>
diff --git a/httpd.spec b/httpd.spec
index b89f424..7e63af8 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,11 +13,12 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
 Source2: httpd.logrotate
+Source3: instance.conf
 Source4: httpd-ssl-pass-dialog
 Source5: httpd.tmpfiles
 Source6: httpd.service
@@ -51,6 +52,7 @@ Source40: htcacheclean.service
 Source41: htcacheclean.sysconf
 Source42: httpd-init.service
 Source43: httpd-ssl-gencerts
+Source44: httpd@.service
 # build/scripts patches
 Patch1: httpd-2.4.1-apctl.patch
 Patch2: httpd-2.4.9-apxs.patch
@@ -239,6 +241,16 @@ sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
 # Prevent use of setcap in "install-suexec-caps" target.
 sed -i '/suexec/s,setcap ,echo Skipping setcap for ,' Makefile.in
 
+# Example conf for instances
+cp $RPM_SOURCE_DIR/instance.conf .
+sed < $RPM_SOURCE_DIR/httpd.conf >> instance.conf '
+0,/^ServerRoot/d;
+/# Supplemental configuration/,$d
+/^ *CustomLog .logs/s,logs/,logs/${HTTPD_INSTANCE}_,
+/^ *ErrorLog .logs/s,logs/,logs/${HTTPD_INSTANCE}_,
+'
+touch -r $RPM_SOURCE_DIR/instance.conf instance.conf
+
 # Safety check: prevent build if defined MMN does not equal upstream MMN.
 vmmn=`echo MODULE_MAGIC_NUMBER_MAJOR | cpp -include include/ap_mmn.h | sed -n '/^2/p'`
 if test "x${vmmn}" != "x%{mmn}"; then
@@ -319,7 +331,8 @@ make DESTDIR=$RPM_BUILD_ROOT install
 
 # Install systemd service files
 mkdir -p $RPM_BUILD_ROOT%{_unitdir}
-for s in httpd.service htcacheclean.service httpd.socket httpd-init.service; do
+for s in httpd.service htcacheclean.service httpd.socket \
+         httpd@.service httpd-init.service; do
   install -p -m 644 $RPM_SOURCE_DIR/${s} \
                     $RPM_BUILD_ROOT%{_unitdir}/${s}
 done
@@ -469,6 +482,7 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.logrotate \
 
 # Install systemd service man pages
 install -m 644 -p httpd.service.8 httpd-init.service.8 httpd.socket.8 \
+        httpd@.service.8 \
         $RPM_BUILD_ROOT%{_mandir}/man8
 
 # fix man page paths
@@ -567,6 +581,7 @@ exit $rv
 
 %doc ABOUT_APACHE README CHANGES LICENSE VERSIONING NOTICE
 %doc docs/conf/extra/*.conf
+%doc instance.conf
 
 %{_sysconfdir}/httpd/modules
 %{_sysconfdir}/httpd/logs
@@ -636,6 +651,7 @@ exit $rv
 %exclude %{_mandir}/man8/httpd-init.*
 
 %{_unitdir}/httpd.service
+%{_unitdir}/httpd@.service
 %{_unitdir}/htcacheclean.service
 %{_unitdir}/*.socket
 
@@ -709,6 +725,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Apr 19 2018 Joe Orton <jorton@redhat.com> - 2.4.33-5
+- add httpd@.service; update httpd.service(8) and add new stub
+
 * Mon Apr 16 2018 Joe Orton <jorton@redhat.com> - 2.4.33-4
 - mod_ssl: fix mod_nss compat patch (Rob Crittenden, #1566511)
 - mod_md: change hard-coded default MdStoreDir to state/md (#1563846)
diff --git a/httpd@.service b/httpd@.service
new file mode 100644
index 0000000..c58ae88
--- /dev/null
+++ b/httpd@.service
@@ -0,0 +1,23 @@
+# This is a template for httpd instances.
+# See httpd@.service(8) for more information.
+
+[Unit]
+Description=The Apache HTTP Server
+After=network.target remote-fs.target nss-lookup.target
+Documentation=man:httpd@.service(8)
+
+[Service]
+Type=notify
+Environment=LANG=C
+Environment=HTTPD_INSTANCE=%i
+ExecStartPre=/bin/mkdir -m 710 -p /run/httpd/instance-%i
+ExecStartPre=/bin/chown root.apache /run/httpd/instance-%i
+ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND -f conf/%i.conf
+ExecReload=/usr/sbin/httpd $OPTIONS -k graceful -f conf/%i.conf
+# Send SIGWINCH for graceful stop
+KillSignal=SIGWINCH
+KillMode=mixed
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
diff --git a/instance.conf b/instance.conf
new file mode 100644
index 0000000..2f36d3c
--- /dev/null
+++ b/instance.conf
@@ -0,0 +1,22 @@
+#
+# This is an example instance-specific configuration file.  To use
+# copy this file to e.g. /etc/httpd/conf/foobar.conf.  See the
+# httpd.service(8) man page for more information.
+#
+# This config will then used as the default configuration when
+# running:
+#
+#   # systemctl start httpd@foobar.service
+#
+# The changes compared to the default are:
+# - DefaultRuntime and Pidfile renamed to be instance-specific
+# - default logfile names are prefixed with the instance name
+# - /etc/httpd/conf.d is NOT included by default (conf.modules.d still is)
+#
+# Further customisations will be required for an instance to run
+# simultaneously to httpd.service under the default configuration,
+# e.g. changing the port used with Listen.
+#
+
+DefaultRuntimeDir /run/httpd/instance-${HTTPD_INSTANCE}
+PidFile /run/httpd/instance-${HTTPD_INSTANCE}.pid

From 38b8da0d614cd5c688aaf90e325cd23cedd199e6 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 19 Apr 2018 17:24:04 +0100
Subject: [PATCH 092/359] Tweak wording.

---
 instance.conf | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/instance.conf b/instance.conf
index 2f36d3c..56f3f0d 100644
--- a/instance.conf
+++ b/instance.conf
@@ -1,8 +1,9 @@
 #
-# This is an example instance-specific configuration file.  To use
-# copy this file to e.g. /etc/httpd/conf/foobar.conf.  See the
-# httpd.service(8) man page for more information.
+# This is an example instance-specific configuration file. See the
+# httpd.service(8) man page for detailed information on using the
+# the httpd@.service with instances.
 #
+# To use this example, copy instance.conf to /etc/httpd/conf/foobar.conf.
 # This config will then used as the default configuration when
 # running:
 #

From 00fb256f231e9608b9bc35cb2b70c1e6918fa94d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 19 Apr 2018 17:24:20 +0100
Subject: [PATCH 093/359] Tweak wording.

---
 instance.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/instance.conf b/instance.conf
index 56f3f0d..f2b03f7 100644
--- a/instance.conf
+++ b/instance.conf
@@ -3,7 +3,7 @@
 # httpd.service(8) man page for detailed information on using the
 # the httpd@.service with instances.
 #
-# To use this example, copy instance.conf to /etc/httpd/conf/foobar.conf.
+# To use this example, copy instance.conf to /etc/httpd/conf/foobar.conf
 # This config will then used as the default configuration when
 # running:
 #

From 5d40f924f7bd8d31ddaf21ea3c9d29d8a06b1c41 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 1 May 2018 08:54:09 +0100
Subject: [PATCH 094/359] Grammar and spelling fixes.

---
 httpd.service.xml | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/httpd.service.xml b/httpd.service.xml
index bc6c503..1e6a8ce 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -139,7 +139,7 @@ Wants=network-online.target</programlisting>
       httpd is started. To inhibit certificate generation, use
       <command>systemctl mask httpd-init.service</command> after
       installing mod_ssl, and adjust the mod_ssl configuration to use
-      an appropriate certicate and key.</para>
+      an appropriate certificate and key.</para>
 
     </refsect2>
 
@@ -276,15 +276,15 @@ Wants=network-online.target</programlisting>
       configuration file
       <filename>/etc/httpd/conf/foobar.conf</filename>.  The
       <option>HTTPD_INSTANCE</option> environment variable is set to
-      the instance name by the unit and is available name for use
-      within the configuration file.</para>
+      the instance name by the unit and is available for use within
+      the configuration file.</para>
 
       <para>To allow multiple instances of httpd to run
       simultaneously, a number of configuration directives must be
-      changed; such as <command>PidFile</command> and
-      <command>DefaultRuntimeDir</command> to pick non-conflict paths,
-      and <command>Listen</command> to choose ports.  The example
-      configuration file
+      changed, such as <command>PidFile</command> and
+      <command>DefaultRuntimeDir</command> to pick non-conflicting
+      paths, and <command>Listen</command> to choose different ports.
+      The example configuration file
       <filename>/usr/share/doc/httpd/instance.conf</filename>
       demonstrates how to make such changes using
       <option>HTTPD_INSTANCE</option> variable.</para>
@@ -312,6 +312,7 @@ ReloadPropagatedFrom=httpd.service</programlisting>
 
     <para><filename>/usr/lib/systemd/system/httpd.service</filename>,
     <filename>/usr/lib/systemd/system/httpd.socket</filename>,
+    <filename>/usr/lib/systemd/system/httpd@.service</filename>,
     <filename>/etc/systemd/systemd/httpd.service.d</filename></para>
   </refsect1>
   

From 07274a959f0e67f63389153680b9ce87049e8ee1 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 12 Apr 2018 08:03:52 +0100
Subject: [PATCH 095/359] mod_ssl: drop implicit 'SSLEngine on' for vhost w/o
 certs (#1564537) Resolves: rhbz#1564537

---
 httpd-2.4.33-sslmerging.patch | 15 +++++++++++++++
 httpd.spec                    |  8 +++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.33-sslmerging.patch

diff --git a/httpd-2.4.33-sslmerging.patch b/httpd-2.4.33-sslmerging.patch
new file mode 100644
index 0000000..066b5c8
--- /dev/null
+++ b/httpd-2.4.33-sslmerging.patch
@@ -0,0 +1,15 @@
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1564537
+
+--- httpd-2.4.33/modules/ssl/ssl_engine_init.c.sslmerging
++++ httpd-2.4.33/modules/ssl/ssl_engine_init.c
+@@ -261,7 +261,8 @@
+          * the protocol is https. */
+         if (ap_get_server_protocol(s) 
+             && strcmp("https", ap_get_server_protocol(s)) == 0
+-            && sc->enabled == SSL_ENABLED_UNSET) {
++            && sc->enabled == SSL_ENABLED_UNSET
++            && (!apr_is_empty_array(sc->server->pks->cert_files))) {
+             sc->enabled = SSL_ENABLED_TRUE;
+         }
+ 
diff --git a/httpd.spec b/httpd.spec
index 9429b61..7fc519a 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -74,6 +74,8 @@ Patch35: httpd-2.4.33-sslciphdefault.patch
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.33-r1738878.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1564537
+Patch59: httpd-2.4.33-sslmerging.patch
 
 # Security fixes
 
@@ -227,6 +229,7 @@ interface for storing and accessing per-user session data.
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 %patch58 -p1 -b .r1738878
+%patch59 -p1 -b .sslmerging
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -704,6 +707,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Apr 12 2018 Joe Orton <jorton@redhat.com> - 2.4.33-3
+- mod_ssl: drop implicit 'SSLEngine on' for vhost w/o certs (#1564537)
+
 * Fri Mar 30 2018 Adam Williamson <awilliam@redhat.com> - 2.4.33-2
 - Exclude mod_md config file from main package (#1562413)
 

From 5dbb1d7caba340ea5c0c41e54fc37d98b9cfaf84 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 16 Apr 2018 08:25:48 +0100
Subject: [PATCH 096/359] mod_ssl: fix mod_nss compat patch (Rob Crittenden,
 #1566511) mod_md: change hard-coded default MdStoreDir to state/md (#1563846)
 Resolves: rhbz#1566511 Resolves: rhbz#1563846

---
 httpd.spec | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 7fc519a..4702136 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -60,6 +60,7 @@ Patch6: httpd-2.4.3-apctl-systemd.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
+Patch21: httpd-2.4.33-mddefault.patch
 Patch23: httpd-2.4.33-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
@@ -218,6 +219,7 @@ interface for storing and accessing per-user session data.
 
 %patch19 -p1 -b .detectsystemd
 
+%patch21 -p1 -b .mddefault
 %patch23 -p1 -b .export
 %patch24 -p1 -b .corelimit
 %patch25 -p1 -b .selinux
@@ -225,7 +227,7 @@ interface for storing and accessing per-user session data.
 %patch27 -p1 -b .icons
 %patch29 -p1 -b .systemd
 %patch30 -p1 -b .cachehardmax
-#patch31 -p1 -b .sslmultiproxy
+%patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 %patch58 -p1 -b .r1738878
@@ -707,6 +709,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Apr 16 2018 Joe Orton <jorton@redhat.com> - 2.4.33-4
+- mod_ssl: fix mod_nss compat patch (Rob Crittenden, #1566511)
+- mod_md: change hard-coded default MdStoreDir to state/md (#1563846)
+
 * Thu Apr 12 2018 Joe Orton <jorton@redhat.com> - 2.4.33-3
 - mod_ssl: drop implicit 'SSLEngine on' for vhost w/o certs (#1564537)
 

From e4c2da63b4f4d451a829f586d333268421ca6516 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 1 May 2018 09:48:48 +0100
Subject: [PATCH 097/359] Omit multiproxy change.

---
 httpd.spec | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 4702136..5879dbc 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -227,7 +227,7 @@ interface for storing and accessing per-user session data.
 %patch27 -p1 -b .icons
 %patch29 -p1 -b .systemd
 %patch30 -p1 -b .cachehardmax
-%patch31 -p1 -b .sslmultiproxy
+#patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 %patch58 -p1 -b .r1738878
@@ -710,7 +710,6 @@ exit $rv
 
 %changelog
 * Mon Apr 16 2018 Joe Orton <jorton@redhat.com> - 2.4.33-4
-- mod_ssl: fix mod_nss compat patch (Rob Crittenden, #1566511)
 - mod_md: change hard-coded default MdStoreDir to state/md (#1563846)
 
 * Thu Apr 12 2018 Joe Orton <jorton@redhat.com> - 2.4.33-3

From 4bd9fa63fdb95f92567401db863c94216c14ec97 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 19 Apr 2018 17:18:11 +0100
Subject: [PATCH 098/359] add httpd@.service; update httpd.service(8) and add
 new stub

---
 httpd.service.xml | 51 ++++++++++++++++++++++++++++++++++++++++++++---
 httpd.spec        | 23 +++++++++++++++++++--
 httpd@.service    | 23 +++++++++++++++++++++
 instance.conf     | 22 ++++++++++++++++++++
 4 files changed, 114 insertions(+), 5 deletions(-)
 create mode 100644 httpd@.service
 create mode 100644 instance.conf

diff --git a/httpd.service.xml b/httpd.service.xml
index 8008b16..bc6c503 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -4,7 +4,7 @@
 
 ]>
 <!--
- Copyright 2017 Red Hat, Inc.
+ Copyright 2018 Red Hat, Inc.
 
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
@@ -36,6 +36,7 @@
   
   <refnamediv>
     <refname>httpd.service</refname>
+    <refname>httpd@.service</refname>
     <refname>httpd.socket</refname>
     <refname>httpd-init.service</refname>
     <refpurpose>httpd unit files for systemd</refpurpose>
@@ -44,6 +45,7 @@
   <refsynopsisdiv>
     <para>
       <filename>/usr/lib/systemd/system/httpd.service</filename>, 
+      <filename>/usr/lib/systemd/system/httpd@.service</filename>,
       <filename>/usr/lib/systemd/system/httpd-init.service</filename>,
       <filename>/usr/lib/systemd/system/httpd.socket</filename>
     </para>
@@ -82,8 +84,9 @@
       directly, since such changes would be lost over package
       upgrades. Running <command>systemctl edit
       httpd.service</command> or <command>systemctl edit
-      httpd.socket</command> as root will create a drop-in file in
-      <filename>/etc/systemd/system/httpd.service.d</filename> which
+      httpd.socket</command> as root will create a drop-in file (in
+      the former case, in
+      <filename>/etc/systemd/system/httpd.service.d</filename>) which
       over-rides the system defaults.</para>
 
       <para>For example, to set the <option>LD_LIBRARY_PATH</option>
@@ -260,6 +263,48 @@ Wants=network-online.target</programlisting>
       192.168.1.2:80</literal>" will not work.</para>
     </refsect2>
 
+    <refsect2>
+      <title>Instatiated services</title>
+
+      <para>The <command>httpd@.service</command> unit is an
+      instatiated template service. An instance of this unit will be
+      started using the configuration file
+      <filename>/etc/httpd/conf/INSTANCE.conf</filename>, where
+      <emphasis>INSTANCE</emphasis> is replaced with the instance
+      name.  For example, <command>systemctl start
+      httpd@foobar.service</command> will start httpd using the
+      configuration file
+      <filename>/etc/httpd/conf/foobar.conf</filename>.  The
+      <option>HTTPD_INSTANCE</option> environment variable is set to
+      the instance name by the unit and is available name for use
+      within the configuration file.</para>
+
+      <para>To allow multiple instances of httpd to run
+      simultaneously, a number of configuration directives must be
+      changed; such as <command>PidFile</command> and
+      <command>DefaultRuntimeDir</command> to pick non-conflict paths,
+      and <command>Listen</command> to choose ports.  The example
+      configuration file
+      <filename>/usr/share/doc/httpd/instance.conf</filename>
+      demonstrates how to make such changes using
+      <option>HTTPD_INSTANCE</option> variable.</para>
+
+      <para>It can be useful to configure instances of
+      <command>httpd@.service</command> to reload when
+      <command>httpd.service</command> is reloaded; for example,
+      <command>logrotate</command> will reload only
+      <command>httpd.service</command> when logs are rotated. If this
+      behaviour is required, create a drop-in file for the instance as
+      follows:
+
+      <programlisting>[Unit]
+ReloadPropagatedFrom=httpd.service</programlisting>
+
+      As with normal units, drop-in files for instances can be created
+      using <command>systemctl edit</command>, e.g. <command>systemctl edit
+      httpd@foobar.service</command>.</para>
+    </refsect2>
+
   </refsect1>
 
   <refsect1>
diff --git a/httpd.spec b/httpd.spec
index 5879dbc..d66c063 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,11 +13,12 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
 Source2: httpd.logrotate
+Source3: instance.conf
 Source4: httpd-ssl-pass-dialog
 Source5: httpd.tmpfiles
 Source6: httpd.service
@@ -51,6 +52,7 @@ Source40: htcacheclean.service
 Source41: htcacheclean.sysconf
 Source42: httpd-init.service
 Source43: httpd-ssl-gencerts
+Source44: httpd@.service
 # build/scripts patches
 Patch1: httpd-2.4.1-apctl.patch
 Patch2: httpd-2.4.9-apxs.patch
@@ -239,6 +241,16 @@ sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
 # Prevent use of setcap in "install-suexec-caps" target.
 sed -i '/suexec/s,setcap ,echo Skipping setcap for ,' Makefile.in
 
+# Example conf for instances
+cp $RPM_SOURCE_DIR/instance.conf .
+sed < $RPM_SOURCE_DIR/httpd.conf >> instance.conf '
+0,/^ServerRoot/d;
+/# Supplemental configuration/,$d
+/^ *CustomLog .logs/s,logs/,logs/${HTTPD_INSTANCE}_,
+/^ *ErrorLog .logs/s,logs/,logs/${HTTPD_INSTANCE}_,
+'
+touch -r $RPM_SOURCE_DIR/instance.conf instance.conf
+
 # Safety check: prevent build if defined MMN does not equal upstream MMN.
 vmmn=`echo MODULE_MAGIC_NUMBER_MAJOR | cpp -include include/ap_mmn.h | sed -n '/^2/p'`
 if test "x${vmmn}" != "x%{mmn}"; then
@@ -319,7 +331,8 @@ make DESTDIR=$RPM_BUILD_ROOT install
 
 # Install systemd service files
 mkdir -p $RPM_BUILD_ROOT%{_unitdir}
-for s in httpd.service htcacheclean.service httpd.socket httpd-init.service; do
+for s in httpd.service htcacheclean.service httpd.socket \
+         httpd@.service httpd-init.service; do
   install -p -m 644 $RPM_SOURCE_DIR/${s} \
                     $RPM_BUILD_ROOT%{_unitdir}/${s}
 done
@@ -469,6 +482,7 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.logrotate \
 
 # Install systemd service man pages
 install -m 644 -p httpd.service.8 httpd-init.service.8 httpd.socket.8 \
+        httpd@.service.8 \
         $RPM_BUILD_ROOT%{_mandir}/man8
 
 # fix man page paths
@@ -567,6 +581,7 @@ exit $rv
 
 %doc ABOUT_APACHE README CHANGES LICENSE VERSIONING NOTICE
 %doc docs/conf/extra/*.conf
+%doc instance.conf
 
 %{_sysconfdir}/httpd/modules
 %{_sysconfdir}/httpd/logs
@@ -636,6 +651,7 @@ exit $rv
 %exclude %{_mandir}/man8/httpd-init.*
 
 %{_unitdir}/httpd.service
+%{_unitdir}/httpd@.service
 %{_unitdir}/htcacheclean.service
 %{_unitdir}/*.socket
 
@@ -709,6 +725,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Apr 19 2018 Joe Orton <jorton@redhat.com> - 2.4.33-5
+- add httpd@.service; update httpd.service(8) and add new stub
+
 * Mon Apr 16 2018 Joe Orton <jorton@redhat.com> - 2.4.33-4
 - mod_md: change hard-coded default MdStoreDir to state/md (#1563846)
 
diff --git a/httpd@.service b/httpd@.service
new file mode 100644
index 0000000..c58ae88
--- /dev/null
+++ b/httpd@.service
@@ -0,0 +1,23 @@
+# This is a template for httpd instances.
+# See httpd@.service(8) for more information.
+
+[Unit]
+Description=The Apache HTTP Server
+After=network.target remote-fs.target nss-lookup.target
+Documentation=man:httpd@.service(8)
+
+[Service]
+Type=notify
+Environment=LANG=C
+Environment=HTTPD_INSTANCE=%i
+ExecStartPre=/bin/mkdir -m 710 -p /run/httpd/instance-%i
+ExecStartPre=/bin/chown root.apache /run/httpd/instance-%i
+ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND -f conf/%i.conf
+ExecReload=/usr/sbin/httpd $OPTIONS -k graceful -f conf/%i.conf
+# Send SIGWINCH for graceful stop
+KillSignal=SIGWINCH
+KillMode=mixed
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
diff --git a/instance.conf b/instance.conf
new file mode 100644
index 0000000..2f36d3c
--- /dev/null
+++ b/instance.conf
@@ -0,0 +1,22 @@
+#
+# This is an example instance-specific configuration file.  To use
+# copy this file to e.g. /etc/httpd/conf/foobar.conf.  See the
+# httpd.service(8) man page for more information.
+#
+# This config will then used as the default configuration when
+# running:
+#
+#   # systemctl start httpd@foobar.service
+#
+# The changes compared to the default are:
+# - DefaultRuntime and Pidfile renamed to be instance-specific
+# - default logfile names are prefixed with the instance name
+# - /etc/httpd/conf.d is NOT included by default (conf.modules.d still is)
+#
+# Further customisations will be required for an instance to run
+# simultaneously to httpd.service under the default configuration,
+# e.g. changing the port used with Listen.
+#
+
+DefaultRuntimeDir /run/httpd/instance-${HTTPD_INSTANCE}
+PidFile /run/httpd/instance-${HTTPD_INSTANCE}.pid

From f8da0fa0cb9924cd3eaf867863e98e473a0de487 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 19 Apr 2018 17:24:04 +0100
Subject: [PATCH 099/359] Tweak wording.

---
 instance.conf | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/instance.conf b/instance.conf
index 2f36d3c..56f3f0d 100644
--- a/instance.conf
+++ b/instance.conf
@@ -1,8 +1,9 @@
 #
-# This is an example instance-specific configuration file.  To use
-# copy this file to e.g. /etc/httpd/conf/foobar.conf.  See the
-# httpd.service(8) man page for more information.
+# This is an example instance-specific configuration file. See the
+# httpd.service(8) man page for detailed information on using the
+# the httpd@.service with instances.
 #
+# To use this example, copy instance.conf to /etc/httpd/conf/foobar.conf.
 # This config will then used as the default configuration when
 # running:
 #

From 3aa9222d7dbbfb2e350826cee46f9c7ed2f071ef Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 19 Apr 2018 17:24:20 +0100
Subject: [PATCH 100/359] Tweak wording.

---
 instance.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/instance.conf b/instance.conf
index 56f3f0d..f2b03f7 100644
--- a/instance.conf
+++ b/instance.conf
@@ -3,7 +3,7 @@
 # httpd.service(8) man page for detailed information on using the
 # the httpd@.service with instances.
 #
-# To use this example, copy instance.conf to /etc/httpd/conf/foobar.conf.
+# To use this example, copy instance.conf to /etc/httpd/conf/foobar.conf
 # This config will then used as the default configuration when
 # running:
 #

From 95e657b1ee681092e42ddc5dfafaf796ea7f1bba Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 1 May 2018 08:54:09 +0100
Subject: [PATCH 101/359] Grammar and spelling fixes.

---
 httpd.service.xml | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/httpd.service.xml b/httpd.service.xml
index bc6c503..1e6a8ce 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -139,7 +139,7 @@ Wants=network-online.target</programlisting>
       httpd is started. To inhibit certificate generation, use
       <command>systemctl mask httpd-init.service</command> after
       installing mod_ssl, and adjust the mod_ssl configuration to use
-      an appropriate certicate and key.</para>
+      an appropriate certificate and key.</para>
 
     </refsect2>
 
@@ -276,15 +276,15 @@ Wants=network-online.target</programlisting>
       configuration file
       <filename>/etc/httpd/conf/foobar.conf</filename>.  The
       <option>HTTPD_INSTANCE</option> environment variable is set to
-      the instance name by the unit and is available name for use
-      within the configuration file.</para>
+      the instance name by the unit and is available for use within
+      the configuration file.</para>
 
       <para>To allow multiple instances of httpd to run
       simultaneously, a number of configuration directives must be
-      changed; such as <command>PidFile</command> and
-      <command>DefaultRuntimeDir</command> to pick non-conflict paths,
-      and <command>Listen</command> to choose ports.  The example
-      configuration file
+      changed, such as <command>PidFile</command> and
+      <command>DefaultRuntimeDir</command> to pick non-conflicting
+      paths, and <command>Listen</command> to choose different ports.
+      The example configuration file
       <filename>/usr/share/doc/httpd/instance.conf</filename>
       demonstrates how to make such changes using
       <option>HTTPD_INSTANCE</option> variable.</para>
@@ -312,6 +312,7 @@ ReloadPropagatedFrom=httpd.service</programlisting>
 
     <para><filename>/usr/lib/systemd/system/httpd.service</filename>,
     <filename>/usr/lib/systemd/system/httpd.socket</filename>,
+    <filename>/usr/lib/systemd/system/httpd@.service</filename>,
     <filename>/etc/systemd/systemd/httpd.service.d</filename></para>
   </refsect1>
   

From 31cf3e9de5ba8e0766534c6125ccb3a4e82fa05d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 12 Apr 2018 08:03:52 +0100
Subject: [PATCH 102/359] mod_ssl: drop implicit 'SSLEngine on' for vhost w/o
 certs (#1564537) Resolves: rhbz#1564537

---
 httpd-2.4.33-sslmerging.patch | 15 +++++++++++++++
 httpd.spec                    |  8 +++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.33-sslmerging.patch

diff --git a/httpd-2.4.33-sslmerging.patch b/httpd-2.4.33-sslmerging.patch
new file mode 100644
index 0000000..066b5c8
--- /dev/null
+++ b/httpd-2.4.33-sslmerging.patch
@@ -0,0 +1,15 @@
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1564537
+
+--- httpd-2.4.33/modules/ssl/ssl_engine_init.c.sslmerging
++++ httpd-2.4.33/modules/ssl/ssl_engine_init.c
+@@ -261,7 +261,8 @@
+          * the protocol is https. */
+         if (ap_get_server_protocol(s) 
+             && strcmp("https", ap_get_server_protocol(s)) == 0
+-            && sc->enabled == SSL_ENABLED_UNSET) {
++            && sc->enabled == SSL_ENABLED_UNSET
++            && (!apr_is_empty_array(sc->server->pks->cert_files))) {
+             sc->enabled = SSL_ENABLED_TRUE;
+         }
+ 
diff --git a/httpd.spec b/httpd.spec
index dc1b559..980a41b 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,7 +8,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -67,6 +67,8 @@ Patch35: httpd-2.4.33-sslciphdefault.patch
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.33-r1738878.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1564537
+Patch59: httpd-2.4.33-sslmerging.patch
 
 # Security fixes
 
@@ -225,6 +227,7 @@ interface for storing and accessing per-user session data.
 %patch35 -p1 -b .sslciphdefault
 
 %patch58 -p1 -b .r1738878
+%patch59 -p1 -b .sslmerging
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -716,6 +719,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Apr 12 2018 Joe Orton <jorton@redhat.com> - 2.4.33-3
+- mod_ssl: drop implicit 'SSLEngine on' for vhost w/o certs (#1564537)
+
 * Fri Mar 30 2018 Adam Williamson <awilliam@redhat.com> - 2.4.33-2
 - Exclude mod_md config file from main package (#1562413)
 

From 77f88e99ce49bad052b14b2f87da358bf8631fe2 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 16 Apr 2018 08:25:48 +0100
Subject: [PATCH 103/359] mod_md: change hard-coded default MdStoreDir to
 state/md (#1563846) Resolves: rhbz#1563846

---
 httpd.spec | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 980a41b..497bfb4 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,7 +8,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -53,6 +53,7 @@ Patch6: httpd-2.4.3-apctl-systemd.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
+Patch21: httpd-2.4.33-mddefault.patch
 Patch23: httpd-2.4.33-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
@@ -215,6 +216,7 @@ interface for storing and accessing per-user session data.
 
 %patch19 -p1 -b .detectsystemd
 
+%patch21 -p1 -b .mddefault
 %patch23 -p1 -b .export
 %patch24 -p1 -b .corelimit
 %patch25 -p1 -b .selinux
@@ -222,7 +224,7 @@ interface for storing and accessing per-user session data.
 %patch27 -p1 -b .icons
 %patch29 -p1 -b .systemd
 %patch30 -p1 -b .cachehardmax
-#patch31 -p1 -b .sslmultiproxy
+%patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 
@@ -719,6 +721,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Apr 16 2018 Joe Orton <jorton@redhat.com> - 2.4.33-4
+- mod_ssl: fix mod_nss compat patch (Rob Crittenden, #1566511)
+- mod_md: change hard-coded default MdStoreDir to state/md (#1563846)
+
 * Thu Apr 12 2018 Joe Orton <jorton@redhat.com> - 2.4.33-3
 - mod_ssl: drop implicit 'SSLEngine on' for vhost w/o certs (#1564537)
 

From 3ffaeaa96aba408e63e84ff825dddd171bea39e1 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 1 May 2018 21:40:57 +0100
Subject: [PATCH 104/359] Remove mention of mod_ssl/nss compat fix.

---
 httpd.spec | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 497bfb4..1b186ae 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -224,7 +224,7 @@ interface for storing and accessing per-user session data.
 %patch27 -p1 -b .icons
 %patch29 -p1 -b .systemd
 %patch30 -p1 -b .cachehardmax
-%patch31 -p1 -b .sslmultiproxy
+#patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 
@@ -722,7 +722,6 @@ rm -rf $RPM_BUILD_ROOT
 
 %changelog
 * Mon Apr 16 2018 Joe Orton <jorton@redhat.com> - 2.4.33-4
-- mod_ssl: fix mod_nss compat patch (Rob Crittenden, #1566511)
 - mod_md: change hard-coded default MdStoreDir to state/md (#1563846)
 
 * Thu Apr 12 2018 Joe Orton <jorton@redhat.com> - 2.4.33-3

From c189ca4f3d1b23fe6fff92a96037e42cf66e5118 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 12 Jun 2018 15:19:00 +0100
Subject: [PATCH 105/359] Make cleaner patches.

---
 pullrev.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pullrev.sh b/pullrev.sh
index c366613..255cda4 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -35,7 +35,7 @@ prev=/dev/null
 for r in $*; do
     echo "+ fetching ${r}"
     this=`mktemp /tmp/pullrevXXXXXX`
-    svn diff -c ${r} ${repo} | filterdiff --remove-timestamps -x 'CHANGES' -x 'next-number' -x 'STATUS' \
+    svn diff -c ${r} ${repo} | filterdiff --remove-timestamps --clean -x 'CHANGES' -x 'next-number' -x 'STATUS' \
         --addprefix="${prefix}/" > ${this}
     next=`mktemp /tmp/pullrevXXXXXX`
     combinediff --quiet ${prev} ${this} > ${next}

From 3778b45de130cd3a61fa3cb736b1e155b9080843 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 12 Jun 2018 15:31:38 +0100
Subject: [PATCH 106/359] mod_systemd: show bound ports in status and log to
 journal   at startup.

---
 ...ystemd.patch => httpd-2.4.33-systemd.patch | 101 ++++++++++++++----
 httpd.spec                                    |   6 +-
 2 files changed, 84 insertions(+), 23 deletions(-)
 rename httpd-2.4.27-systemd.patch => httpd-2.4.33-systemd.patch (62%)

diff --git a/httpd-2.4.27-systemd.patch b/httpd-2.4.33-systemd.patch
similarity index 62%
rename from httpd-2.4.27-systemd.patch
rename to httpd-2.4.33-systemd.patch
index 26aac48..7f5ee3b 100644
--- a/httpd-2.4.27-systemd.patch
+++ b/httpd-2.4.33-systemd.patch
@@ -1,9 +1,5 @@
-diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
-diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
-diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
-diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
---- httpd-2.4.27/modules/arch/unix/config5.m4.systemd
-+++ httpd-2.4.27/modules/arch/unix/config5.m4
+--- httpd-2.4.33/modules/arch/unix/config5.m4.systemd
++++ httpd-2.4.33/modules/arch/unix/config5.m4
 @@ -18,6 +18,16 @@
    fi
  ])
@@ -21,10 +17,9 @@ diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules
  APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
  
  APACHE_MODPATH_FINISH
-diff -uap httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd httpd-2.4.27/modules/arch/unix/mod_systemd.c
---- httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd
-+++ httpd-2.4.27/modules/arch/unix/mod_systemd.c
-@@ -0,0 +1,161 @@
+--- httpd-2.4.33/modules/arch/unix/mod_systemd.c.systemd
++++ httpd-2.4.33/modules/arch/unix/mod_systemd.c
+@@ -0,0 +1,223 @@
 +/* Licensed to the Apache Software Foundation (ASF) under one or more
 + * contributor license agreements.  See the NOTICE file distributed with
 + * this work for additional information regarding copyright ownership.
@@ -56,6 +51,7 @@ diff -uap httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd httpd-2.4.27/modu
 +#include "mpm_common.h"
 +
 +#include "systemd/sd-daemon.h"
++#include "systemd/sd-journal.h"
 +
 +#if APR_HAVE_UNISTD_H
 +#include <unistd.h>
@@ -65,6 +61,7 @@ diff -uap httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd httpd-2.4.27/modu
 +static int shutdown_counter = 0;
 +static unsigned long bytes_served;
 +static pid_t mainpid;
++static char describe_listeners[50];
 +
 +static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
 +                              apr_pool_t *ptemp)
@@ -76,6 +73,55 @@ diff -uap httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd httpd-2.4.27/modu
 +    return OK;
 +}
 +
++static char *dump_listener(ap_listen_rec *lr, apr_pool_t *p)
++{
++    apr_sockaddr_t *sa = lr->bind_addr;
++    char addr[128];
++
++    if (apr_sockaddr_is_wildcard(sa)) {
++        return apr_pstrcat(p, "port ", apr_itoa(p, sa->port), NULL);
++    }
++
++    apr_sockaddr_ip_getbuf(addr, sizeof addr, sa);
++
++    return apr_psprintf(p, "%s port %u", addr, sa->port);
++}
++
++static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
++                               apr_pool_t *ptemp, server_rec *s)
++{
++    ap_listen_rec *lr;
++    apr_size_t plen = sizeof describe_listeners;
++    char *p = describe_listeners;
++
++    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
++        return OK;
++
++    for (lr = ap_listeners; lr; lr = lr->next) {
++        char *s = dump_listener(lr, ptemp);
++
++        if (strlen(s) + 3 < plen) {
++            char *newp = apr_cpystrn(p, s, plen);
++            if (lr->next)
++                newp = apr_cpystrn(newp, ", ", 3);
++            plen -= newp - p;
++            p = newp;
++        }
++        else {
++            if (plen < 4) {
++                p = describe_listeners + sizeof describe_listeners - 4;
++                plen = 4;
++            }
++            apr_cpystrn(p, "...", plen);
++            break;
++        }
++    }
++
++    sd_journal_print(LOG_INFO, "Server configured, listening on: %s", describe_listeners);
++
++    return OK;
++}
++
 +static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
 +{
 +    int rv;
@@ -83,8 +129,9 @@ diff -uap httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd httpd-2.4.27/modu
 +    mainpid = getpid();
 +
 +    rv = sd_notifyf(0, "READY=1\n"
-+                    "STATUS=Processing requests...\n"
-+                    "MAINPID=%" APR_PID_T_FMT, mainpid);
++                    "STATUS=Started, listening on: %s\n"
++                    "MAINPID=%" APR_PID_T_FMT,
++                    describe_listeners, mainpid);
 +    if (rv < 0) {
 +        ap_log_perror(APLOG_MARK, APLOG_ERR, 0, p, APLOGNO(02395)
 +                     "sd_notifyf returned an error %d", rv);
@@ -106,18 +153,26 @@ diff -uap httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd httpd-2.4.27/modu
 +    }
 +    
 +    ap_get_sload(&sload);
-+    /* up_time in seconds */
-+    up_time = (apr_uint32_t) apr_time_sec(apr_time_now() -
-+                               ap_scoreboard_image->global->restart_time);
 +
-+    apr_strfsize((unsigned long)((float) (sload.bytes_served)
-+                                 / (float) up_time), bps);
++    if (sload.access_count == 0) {
++        rv = sd_notifyf(0, "READY=1\n"
++                        "STATUS=Running, listening on: %s\n",
++                        describe_listeners);
++    }
++    else {
++        /* up_time in seconds */
++        up_time = (apr_uint32_t) apr_time_sec(apr_time_now() -
++                                              ap_scoreboard_image->global->restart_time);
 +
-+    rv = sd_notifyf(0, "READY=1\n"
-+                    "STATUS=Total requests: %lu; Idle/Busy workers %d/%d;"
-+                    "Requests/sec: %.3g; Bytes served/sec: %sB/sec\n",
-+                    sload.access_count, sload.idle, sload.busy,
-+                    ((float) sload.access_count) / (float) up_time, bps);
++        apr_strfsize((unsigned long)((float) (sload.bytes_served)
++                                     / (float) up_time), bps);
++
++        rv = sd_notifyf(0, "READY=1\n"
++                        "STATUS=Total requests: %lu; Idle/Busy workers %d/%d;"
++                        "Requests/sec: %.3g; Bytes served/sec: %sB/sec\n",
++                        sload.access_count, sload.idle, sload.busy,
++                        ((float) sload.access_count) / (float) up_time, bps);
++    }
 +
 +    if (rv < 0) {
 +        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02396)
@@ -152,6 +207,8 @@ diff -uap httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd httpd-2.4.27/modu
 +{
 +    /* Enable ap_extended_status. */
 +    ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
++    /* Grab the listener config. */
++    ap_hook_post_config(systemd_post_config, NULL, NULL, APR_HOOK_LAST);
 +    /* We know the PID in this hook ... */
 +    ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST);
 +    /* Used to update httpd's status line using sd_notifyf */
diff --git a/httpd.spec b/httpd.spec
index 7e63af8..9564d57 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -725,6 +725,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Jun 12 2018 Joe Orton <jorton@redhat.com> - 2.4.33-6
+- mod_systemd: show bound ports in status and log to journal
+  at startup.
+
 * Thu Apr 19 2018 Joe Orton <jorton@redhat.com> - 2.4.33-5
 - add httpd@.service; update httpd.service(8) and add new stub
 

From df56b6f20c2b0c5596cb7dd53c3d05e390809d94 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 12 Jun 2018 16:08:30 +0100
Subject: [PATCH 107/359] - update for new mod_systemd patch

---
 httpd.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 9564d57..0760824 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -68,7 +68,7 @@ Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
 Patch26: httpd-2.4.4-r1337344+.patch
 Patch27: httpd-2.4.2-icons.patch
-Patch29: httpd-2.4.27-systemd.patch
+Patch29: httpd-2.4.33-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
 Patch31: httpd-2.4.33-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch

From 0c0d4558f1a1a159add79e09a8e6faa525c6969e Mon Sep 17 00:00:00 2001
From: Bruno Goncalves <bgoncalv@redhat.com>
Date: Wed, 13 Jun 2018 11:48:11 +0200
Subject: [PATCH 108/359] fix test to use beakerlib role 1. standard-test-roles
 dropped support to rhts role, so we need to replace with beakerlib role that
 now support beakerlib-libraries 2. httpd requires services and this does not
 work on container, so it got removed from tests.yml

---
 tests/httpd-php-mysql-sanity-test/Makefile   | 2 +-
 tests/httpd-php-mysql-sanity-test/runtest.sh | 2 +-
 tests/tests.yml                              | 5 +----
 3 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/tests/httpd-php-mysql-sanity-test/Makefile b/tests/httpd-php-mysql-sanity-test/Makefile
index 17fb9d3..a688236 100644
--- a/tests/httpd-php-mysql-sanity-test/Makefile
+++ b/tests/httpd-php-mysql-sanity-test/Makefile
@@ -29,7 +29,7 @@ export TESTVERSION=1.0
 
 BUILT_FILES=
 
-FILES=$(METADATA) runtest.sh Makefile PURPOSE mysql.php php_mysql_test.sql php_mysql_test.conf
+FILES=$(METADATA) runtest.sh Makefile PURPOSE new_mysql.php old_mysql.php php_mysql_test.sql php_mysql_test.conf
 
 .PHONY: all install download clean
 
diff --git a/tests/httpd-php-mysql-sanity-test/runtest.sh b/tests/httpd-php-mysql-sanity-test/runtest.sh
index e2239ad..6fa8315 100755
--- a/tests/httpd-php-mysql-sanity-test/runtest.sh
+++ b/tests/httpd-php-mysql-sanity-test/runtest.sh
@@ -57,7 +57,7 @@ rlJournalStart
         rlRun "rm -rvf $httpROOTDIR/php_mysql_test"
         rlRun "mkdir -v $httpROOTDIR/php_mysql_test"
         rlRun "cp -v php_mysql_test.conf $httpCONFDIR/conf.d/"
-        rlRun "php_version=`rlCheckRpm php`"
+        php_version=`rlCheckRpm php`
         if [[ $php_version =~ php-7* ]] || [[ $php_version =~ php-5.[5-6]* ]]; then
             rlRun "cp -v new_mysql.php $httpROOTDIR/php_mysql_test/mysql.php"
         else
diff --git a/tests/tests.yml b/tests/tests.yml
index 43c38e7..e0ef0be 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -1,13 +1,10 @@
 ---
 # Tests that run in all contexts
 - hosts: localhost
-  vars:
-    use_beakerlib_libraries: true
   roles:
-  - role: standard-test-rhts
+  - role: standard-test-beakerlib
     tags:
     - classic
-    - container
     tests:
     - httpd-php-mysql-sanity-test
     required_packages:

From 890b6080ee5e60a7ff1b66aa9c5acb78d68de047 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 6 Jul 2018 10:33:09 +0100
Subject: [PATCH 109/359] Spelling fixes.

---
 httpd.service.xml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/httpd.service.xml b/httpd.service.xml
index 1e6a8ce..e079ca2 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -110,10 +110,10 @@ Environment=LD_LIBRARY_PATH=/opt/vendor/lib</programlisting></para>
 
       <para>If httpd is configured to depend on any specific IP
       address (for example, with a "Listen" directive) which may only
-      become available during startup, or if httpd depends on other
+      become available during start-up, or if httpd depends on other
       services (such as a database daemon), the service
       <emphasis>must</emphasis> be configured to ensure correct
-      startup ordering.</para>
+      start-up ordering.</para>
 
       <para>For example, to ensure httpd is only running after all
       configured network interfaces are configured, create a drop-in
@@ -125,7 +125,7 @@ Wants=network-online.target</programlisting>
 
       See <ulink
       url="https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/"/>
-      for more information on startup ordering with systemd.</para>
+      for more information on start-up ordering with systemd.</para>
 
     </refsect2>
 
@@ -264,10 +264,10 @@ Wants=network-online.target</programlisting>
     </refsect2>
 
     <refsect2>
-      <title>Instatiated services</title>
+      <title>Instantiated services</title>
 
       <para>The <command>httpd@.service</command> unit is an
-      instatiated template service. An instance of this unit will be
+      instantiated template service. An instance of this unit will be
       started using the configuration file
       <filename>/etc/httpd/conf/INSTANCE.conf</filename>, where
       <emphasis>INSTANCE</emphasis> is replaced with the instance
@@ -332,3 +332,6 @@ ReloadPropagatedFrom=httpd.service</programlisting>
   </refsect1>
 
 </refentry>
+
+<!-- LocalWords:  systemd PidFile
+-->

From e47d696aed71fd566e6efbe939baa1342ab70e63 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 6 Jul 2018 14:03:23 +0100
Subject: [PATCH 110/359] Filter patches harder.

---
 pullrev.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pullrev.sh b/pullrev.sh
index 255cda4..8ed3a64 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -35,7 +35,7 @@ prev=/dev/null
 for r in $*; do
     echo "+ fetching ${r}"
     this=`mktemp /tmp/pullrevXXXXXX`
-    svn diff -c ${r} ${repo} | filterdiff --remove-timestamps --clean -x 'CHANGES' -x 'next-number' -x 'STATUS' \
+    svn diff -c ${r} ${repo} | filterdiff --remove-timestamps --clean -x 'CHANGES' -x '*/next-number' -x 'STATUS' \
         --addprefix="${prefix}/" > ${this}
     next=`mktemp /tmp/pullrevXXXXXX`
     combinediff --quiet ${prev} ${this} > ${next}

From ea1a9f29fa33aec23b1805734829f22ae6592b35 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 6 Jul 2018 14:03:44 +0100
Subject: [PATCH 111/359] Ignore mock builds.

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 29c6655..4f0a93f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,3 +30,4 @@ x86_64
 /httpd-2.4.27.tar.bz2
 /httpd-*.tar.bz2
 /httpd*.8
+/results_httpd

From 1d78fa49cb5091b75ce3d2c8972665e211c1c6c0 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 6 Jul 2018 14:04:07 +0100
Subject: [PATCH 112/359] mod_ssl: add PKCS#11 cert/key support (Anderson
 Sasaki)

---
 httpd-2.4.33-r1830819+.patch | 690 +++++++++++++++++++++++++++++++++++
 httpd.spec                   |   8 +-
 2 files changed, 697 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.33-r1830819+.patch

diff --git a/httpd-2.4.33-r1830819+.patch b/httpd-2.4.33-r1830819+.patch
new file mode 100644
index 0000000..0b2d90d
--- /dev/null
+++ b/httpd-2.4.33-r1830819+.patch
@@ -0,0 +1,690 @@
+# ./pullrev.sh 1830819 1830836 1830912 1830913 1830927 1831168 1831173
+
+http://svn.apache.org/viewvc?view=revision&revision=1830819
+http://svn.apache.org/viewvc?view=revision&revision=1830912
+http://svn.apache.org/viewvc?view=revision&revision=1830913
+http://svn.apache.org/viewvc?view=revision&revision=1830927
+http://svn.apache.org/viewvc?view=revision&revision=1831168
+http://svn.apache.org/viewvc?view=revision&revision=1831173
+http://svn.apache.org/viewvc?view=revision&revision=1835240
+http://svn.apache.org/viewvc?view=revision&revision=1835242
+
+--- httpd-2.4.33/modules/ssl/ssl_engine_config.c.r1830819+
++++ httpd-2.4.33/modules/ssl/ssl_engine_config.c
+@@ -891,7 +891,9 @@
+     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+     const char *err;
+ 
+-    if ((err = ssl_cmd_check_file(cmd, &arg))) {
++    /* Only check for non-ENGINE based certs. */
++    if (!modssl_is_engine_id(arg)
++        && (err = ssl_cmd_check_file(cmd, &arg))) {
+         return err;
+     }
+ 
+@@ -907,7 +909,9 @@
+     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+     const char *err;
+ 
+-    if ((err = ssl_cmd_check_file(cmd, &arg))) {
++    /* Check keyfile exists for non-ENGINE keys. */
++    if (!modssl_is_engine_id(arg)
++        && (err = ssl_cmd_check_file(cmd, &arg))) {
+         return err;
+     }
+ 
+--- httpd-2.4.33/modules/ssl/ssl_engine_init.c.r1830819+
++++ httpd-2.4.33/modules/ssl/ssl_engine_init.c
+@@ -1181,12 +1182,18 @@
+                 (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i,
+                                           const char *));
+          i++) {
++        EVP_PKEY *pkey;
++        const char *engine_certfile = NULL;
++
+         key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i);
+ 
+         ERR_clear_error();
+ 
+         /* first the certificate (public key) */
+-        if (mctx->cert_chain) {
++        if (modssl_is_engine_id(certfile)) {
++            engine_certfile = certfile;
++        }
++        else if (mctx->cert_chain) {
+             if ((SSL_CTX_use_certificate_file(mctx->ssl_ctx, certfile,
+                                               SSL_FILETYPE_PEM) < 1)) {
+                 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02561)
+@@ -1215,12 +1222,46 @@
+ 
+         ERR_clear_error();
+ 
+-        if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
+-                                         SSL_FILETYPE_PEM) < 1) &&
+-            (ERR_GET_FUNC(ERR_peek_last_error())
+-                != X509_F_X509_CHECK_PRIVATE_KEY)) {
++        if (modssl_is_engine_id(keyfile)) {
++            apr_status_t rv;
++
++            cert = NULL;
++            
++            if ((rv = modssl_load_engine_keypair(s, ptemp, vhost_id,
++                                                 engine_certfile, keyfile,
++                                                 &cert, &pkey))) {
++                return rv;
++            }
++
++            if (cert) {
++                if (SSL_CTX_use_certificate(mctx->ssl_ctx, cert) < 1) {
++                    ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10137)
++                                 "Failed to configure engine certificate %s, check %s",
++                                 key_id, certfile);
++                    ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
++                    return APR_EGENERAL;
++                }
++
++                /* SSL_CTX now owns the cert. */
++                X509_free(cert);
++            }                    
++            
++            if (SSL_CTX_use_PrivateKey(mctx->ssl_ctx, pkey) < 1) {
++                ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10130)
++                             "Failed to configure private key %s from engine",
++                             keyfile);
++                ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
++                return APR_EGENERAL;
++            }
++
++            /* SSL_CTX now owns the key */
++            EVP_PKEY_free(pkey);
++        }
++        else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
++                                              SSL_FILETYPE_PEM) < 1)
++                 && (ERR_GET_FUNC(ERR_peek_last_error())
++                     != X509_F_X509_CHECK_PRIVATE_KEY)) {
+             ssl_asn1_t *asn1;
+-            EVP_PKEY *pkey;
+             const unsigned char *ptr;
+ 
+             ERR_clear_error();
+@@ -1307,8 +1348,9 @@
+     /*
+      * Try to read DH parameters from the (first) SSLCertificateFile
+      */
+-    if ((certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *)) &&
+-        (dhparams = ssl_dh_GetParamFromFile(certfile))) {
++    certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *);
++    if (certfile && !modssl_is_engine_id(certfile)
++        && (dhparams = ssl_dh_GetParamFromFile(certfile))) {
+         SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);
+         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
+                      "Custom DH parameters (%d bits) for %s loaded from %s",
+@@ -1320,10 +1362,10 @@
+     /*
+      * Similarly, try to read the ECDH curve name from SSLCertificateFile...
+      */
+-    if ((certfile != NULL) && 
+-        (ecparams = ssl_ec_GetParamFromFile(certfile)) &&
+-        (nid = EC_GROUP_get_curve_name(ecparams)) &&
+-        (eckey = EC_KEY_new_by_curve_name(nid))) {
++    if (certfile && !modssl_is_engine_id(certfile)
++        && (ecparams = ssl_ec_GetParamFromFile(certfile))
++        && (nid = EC_GROUP_get_curve_name(ecparams)) 
++        && (eckey = EC_KEY_new_by_curve_name(nid))) {
+         SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey);
+         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541)
+                      "ECDH curve %s for %s specified in %s",
+--- httpd-2.4.33/modules/ssl/ssl_engine_pphrase.c.r1830819+
++++ httpd-2.4.33/modules/ssl/ssl_engine_pphrase.c
+@@ -143,9 +143,6 @@
+     const char *key_id = asn1_table_vhost_key(mc, p, sc->vhost_id, idx);
+     EVP_PKEY *pPrivateKey = NULL;
+     ssl_asn1_t *asn1;
+-    unsigned char *ucp;
+-    long int length;
+-    BOOL bReadable;
+     int nPassPhrase = (*pphrases)->nelts;
+     int nPassPhraseRetry = 0;
+     apr_time_t pkey_mtime = 0;
+@@ -222,16 +219,12 @@
+          * is not empty. */
+         ERR_clear_error();
+ 
+-        bReadable = ((pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file,
+-                     NULL, ssl_pphrase_Handle_CB, &ppcb_arg)) != NULL ?
+-                     TRUE : FALSE);
+-
+-        /*
+-         * when the private key file now was readable,
+-         * it's fine and we go out of the loop
+-         */
+-        if (bReadable)
+-           break;
++        pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file,
++                                             ssl_pphrase_Handle_CB, &ppcb_arg);
++        /* If the private key was successfully read, nothing more to
++           do here. */
++        if (pPrivateKey != NULL)
++            break;
+ 
+         /*
+          * when we have more remembered pass phrases
+@@ -356,19 +349,12 @@
+         nPassPhrase++;
+     }
+ 
+-    /*
+-     * Insert private key into the global module configuration
+-     * (we convert it to a stand-alone DER byte sequence
+-     * because the SSL library uses static variables inside a
+-     * RSA structure which do not survive DSO reloads!)
+-     */
+-    length = i2d_PrivateKey(pPrivateKey, NULL);
+-    ucp = ssl_asn1_table_set(mc->tPrivateKey, key_id, length);
+-    (void)i2d_PrivateKey(pPrivateKey, &ucp); /* 2nd arg increments */
++    /* Cache the private key in the global module configuration so it
++     * can be used after subsequent reloads. */
++    asn1 = ssl_asn1_table_set(mc->tPrivateKey, key_id, pPrivateKey);
+ 
+     if (ppcb_arg.nPassPhraseDialogCur != 0) {
+         /* remember mtime of encrypted keys */
+-        asn1 = ssl_asn1_table_get(mc->tPrivateKey, key_id);
+         asn1->source_mtime = pkey_mtime;
+     }
+ 
+@@ -619,3 +605,288 @@
+      */
+     return (len);
+ }
++
++
++#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
++
++/* OpenSSL UI implementation for passphrase entry; largely duplicated
++ * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be
++ * worth trying to shift pphrase handling over to the UI API
++ * completely. */
++static int passphrase_ui_open(UI *ui)
++{
++    pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui);
++    SSLSrvConfigRec *sc = mySrvConfig(ppcb->s);
++
++    ppcb->nPassPhraseDialog++;
++    ppcb->nPassPhraseDialogCur++;
++
++    /*
++     * Builtin or Pipe dialog
++     */
++    if (sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN
++        || sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
++        if (sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
++            if (!readtty) {
++                ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s,
++                             APLOGNO(10143)
++                             "Init: Creating pass phrase dialog pipe child "
++                             "'%s'", sc->server->pphrase_dialog_path);
++                if (ssl_pipe_child_create(ppcb->p,
++                            sc->server->pphrase_dialog_path)
++                        != APR_SUCCESS) {
++                    ap_log_error(APLOG_MARK, APLOG_ERR, 0, ppcb->s,
++                                 APLOGNO(10144)
++                                 "Init: Failed to create pass phrase pipe '%s'",
++                                 sc->server->pphrase_dialog_path);
++                    return 0;
++                }
++            }
++            ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, APLOGNO(10145)
++                         "Init: Requesting pass phrase via piped dialog");
++        }
++        else { /* sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN */
++#ifdef WIN32
++            ap_log_error(APLOG_MARK, APLOG_ERR, 0, ppcb->s, APLOGNO(10146)
++                         "Init: Failed to create pass phrase pipe '%s'",
++                         sc->server->pphrase_dialog_path);
++            return 0;
++#else
++            /*
++             * stderr has already been redirected to the error_log.
++             * rather than attempting to temporarily rehook it to the terminal,
++             * we print the prompt to stdout before EVP_read_pw_string turns
++             * off tty echo
++             */
++            apr_file_open_stdout(&writetty, ppcb->p);
++
++            ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, APLOGNO(10147)
++                         "Init: Requesting pass phrase via builtin terminal "
++                         "dialog");
++#endif
++        }
++
++        /*
++         * The first time display a header to inform the user about what
++         * program he actually speaks to, which module is responsible for
++         * this terminal dialog and why to the hell he has to enter
++         * something...
++         */
++        if (ppcb->nPassPhraseDialog == 1) {
++            apr_file_printf(writetty, "%s mod_ssl (Pass Phrase Dialog)\n",
++                            AP_SERVER_BASEVERSION);
++            apr_file_printf(writetty,
++                            "A pass phrase is required to access the private key.\n");
++        }
++        if (ppcb->bPassPhraseDialogOnce) {
++            ppcb->bPassPhraseDialogOnce = FALSE;
++            apr_file_printf(writetty, "\n");
++            apr_file_printf(writetty, "Private key %s (%s)\n",
++                            ppcb->key_id, ppcb->pkey_file);
++        }
++    }
++
++    return 1;
++}
++
++static int passphrase_ui_read(UI *ui, UI_STRING *uis)
++{
++    pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui);
++    SSLSrvConfigRec *sc = mySrvConfig(ppcb->s);
++    const char *prompt;
++    int i;
++    int bufsize;
++    int len;
++    char *buf;
++
++    prompt = UI_get0_output_string(uis);
++    if (prompt == NULL) {
++        prompt = "Enter pass phrase:";
++    }
++
++    /*
++     * Get the maximum expected size and allocate the buffer
++     */
++    bufsize = UI_get_result_maxsize(uis);
++    buf = apr_pcalloc(ppcb->p, bufsize);
++
++    if (sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN
++        || sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
++        /*
++         * Get the pass phrase through a callback.
++         * Empty input is not accepted.
++         */
++        for (;;) {
++            if (sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
++                i = pipe_get_passwd_cb(buf, bufsize, "", FALSE);
++            }
++            else { /* sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN */
++                i = EVP_read_pw_string(buf, bufsize, "", FALSE);
++            }
++            if (i != 0) {
++                OPENSSL_cleanse(buf, bufsize);
++                return 0;
++            }
++            len = strlen(buf);
++            if (len < 1){
++                apr_file_printf(writetty, "Apache:mod_ssl:Error: Pass phrase"
++                                "empty (needs to be at least 1 character).\n");
++                apr_file_puts(prompt, writetty);
++            }
++            else {
++                break;
++            }
++        }
++    }
++    /*
++     * Filter program
++     */
++    else if (sc->server->pphrase_dialog_type == SSL_PPTYPE_FILTER) {
++        const char *cmd = sc->server->pphrase_dialog_path;
++        const char **argv = apr_palloc(ppcb->p, sizeof(char *) * 3);
++        char *result;
++
++        ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, APLOGNO(10148)
++                     "Init: Requesting pass phrase from dialog filter "
++                     "program (%s)", cmd);
++
++        argv[0] = cmd;
++        argv[1] = ppcb->key_id;
++        argv[2] = NULL;
++
++        result = ssl_util_readfilter(ppcb->s, ppcb->p, cmd, argv);
++        apr_cpystrn(buf, result, bufsize);
++        len = strlen(buf);
++    }
++
++    /*
++     * Ok, we now have the pass phrase, so give it back
++     */
++    ppcb->cpPassPhraseCur = apr_pstrdup(ppcb->p, buf);
++    UI_set_result(ui, uis, buf);
++
++    /* Clear sensitive data. */
++    OPENSSL_cleanse(buf, bufsize);
++    return 1;
++}
++
++static int passphrase_ui_write(UI *ui, UI_STRING *uis)
++{
++    pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui);
++    SSLSrvConfigRec *sc;
++    const char *prompt;
++
++    sc = mySrvConfig(ppcb->s);
++
++    if (sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN
++        || sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
++        prompt = UI_get0_output_string(uis);
++        apr_file_puts(prompt, writetty);
++    }
++
++    return 1;
++}
++
++static int passphrase_ui_close(UI *ui)
++{
++    /*
++     * Close the pipes if they were opened
++     */
++    if (readtty) {
++        apr_file_close(readtty);
++        apr_file_close(writetty);
++        readtty = writetty = NULL;
++    }
++    return 1;
++}
++
++static apr_status_t pp_ui_method_cleanup(void *uip)
++{
++    UI_METHOD *uim = uip;
++    
++    UI_destroy_method(uim);
++
++    return APR_SUCCESS;
++}
++
++static UI_METHOD *get_passphrase_ui(apr_pool_t *p)
++{
++    UI_METHOD *ui_method = UI_create_method("Passphrase UI");
++
++    UI_method_set_opener(ui_method, passphrase_ui_open);
++    UI_method_set_reader(ui_method, passphrase_ui_read);
++    UI_method_set_writer(ui_method, passphrase_ui_write);
++    UI_method_set_closer(ui_method, passphrase_ui_close);
++
++    apr_pool_cleanup_register(p, ui_method, pp_ui_method_cleanup,
++                              pp_ui_method_cleanup);
++    
++    return ui_method;
++}
++
++
++apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
++                                        const char *vhostid,
++                                        const char *certid, const char *keyid,
++                                        X509 **pubkey, EVP_PKEY **privkey)
++{
++    SSLModConfigRec *mc = myModConfig(s);
++    ENGINE *e;
++    UI_METHOD *ui_method = get_passphrase_ui(p);
++    pphrase_cb_arg_t ppcb;
++
++    memset(&ppcb, 0, sizeof ppcb);
++    ppcb.s = s;
++    ppcb.p = p;
++    ppcb.bPassPhraseDialogOnce = TRUE;
++    ppcb.key_id = vhostid;
++    ppcb.pkey_file = keyid;
++
++    if (!mc->szCryptoDevice) {
++        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10131)
++                     "Init: Cannot load private key `%s' without engine",
++                     keyid);
++        return ssl_die(s);
++    }
++
++    if (!(e = ENGINE_by_id(mc->szCryptoDevice))) {
++        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10132)
++                     "Init: Failed to load Crypto Device API `%s'",
++                     mc->szCryptoDevice);
++        ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
++        return ssl_die(s);
++    }
++
++    if (APLOGdebug(s)) {
++        ENGINE_ctrl_cmd_string(e, "VERBOSE", NULL, 0);
++    }
++
++    if (certid) {
++        struct {
++            const char *cert_id;
++            X509 *cert;
++        } params = { certid, NULL };
++
++        if (!ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &params, NULL, 1)) {
++            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10136)
++                         "Init: Unable to get the certificate");
++            ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
++            return ssl_die(s);
++        }
++
++        *pubkey = params.cert;
++    }
++
++    *privkey = ENGINE_load_private_key(e, keyid, ui_method, &ppcb);
++    if (*privkey == NULL) {
++        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10133)
++                     "Init: Unable to get the private key");
++        ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
++        return ssl_die(s);
++    }
++
++    ENGINE_free(e);
++
++    return APR_SUCCESS;
++}
++#endif
+--- httpd-2.4.33/modules/ssl/ssl_private.h.r1830819+
++++ httpd-2.4.33/modules/ssl/ssl_private.h
+@@ -976,21 +976,28 @@
+ apr_status_t ssl_load_encrypted_pkey(server_rec *, apr_pool_t *, int,
+                                      const char *, apr_array_header_t **);
+ 
++/* Load public and/or private key from the configured ENGINE. Private
++ * key returned as *pkey.  certid can be NULL, in which case *pubkey
++ * is not altered.  Errors logged on failure. */
++apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
++                                        const char *vhostid,
++                                        const char *certid, const char *keyid,
++                                        X509 **pubkey, EVP_PKEY **privkey);
++
+ /**  Diffie-Hellman Parameter Support  */
+ DH           *ssl_dh_GetParamFromFile(const char *);
+ #ifdef HAVE_ECC
+ EC_GROUP     *ssl_ec_GetParamFromFile(const char *);
+ #endif
+ 
+-unsigned char *ssl_asn1_table_set(apr_hash_t *table,
+-                                  const char *key,
+-                                  long int length);
+-
+-ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table,
+-                               const char *key);
+-
+-void ssl_asn1_table_unset(apr_hash_t *table,
+-                          const char *key);
++/* Store the EVP_PKEY key (serialized into DER) in the hash table with
++ * key, returning the ssl_asn1_t structure pointer. */
++ssl_asn1_t *ssl_asn1_table_set(apr_hash_t *table, const char *key,
++                               EVP_PKEY *pkey);
++/* Retrieve the ssl_asn1_t structure with given key from the hash. */
++ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table, const char *key);
++/* Remove and free the ssl_asn1_t structure with given key. */
++void ssl_asn1_table_unset(apr_hash_t *table, const char *key);
+ 
+ /**  Mutex Support  */
+ int          ssl_mutex_init(server_rec *, apr_pool_t *);
+@@ -1078,6 +1085,10 @@
+ int ssl_is_challenge(conn_rec *c, const char *servername, 
+                      X509 **pcert, EVP_PKEY **pkey);
+ 
++/* Returns non-zero if the cert/key filename should be handled through
++ * the configured ENGINE. */
++int modssl_is_engine_id(const char *name);
++
+ #endif /* SSL_PRIVATE_H */
+ /** @} */
+ 
+--- httpd-2.4.33/modules/ssl/ssl_util.c.r1830819+
++++ httpd-2.4.33/modules/ssl/ssl_util.c
+@@ -181,45 +181,37 @@
+     return TRUE;
+ }
+ 
+-/*
+- * certain key data needs to survive restarts,
+- * which are stored in the user data table of s->process->pool.
+- * to prevent "leaking" of this data, we use malloc/free
+- * rather than apr_palloc and these wrappers to help make sure
+- * we do not leak the malloc-ed data.
+- */
+-unsigned char *ssl_asn1_table_set(apr_hash_t *table,
+-                                  const char *key,
+-                                  long int length)
++/* Decrypted private keys are cached to survive restarts.  The cached
++ * data must have lifetime of the process (hence malloc/free rather
++ * than pools), and uses raw DER since the EVP_PKEY structure
++ * internals may not survive across a module reload. */
++ssl_asn1_t *ssl_asn1_table_set(apr_hash_t *table, const char *key,
++                               EVP_PKEY *pkey)
+ {
+     apr_ssize_t klen = strlen(key);
+     ssl_asn1_t *asn1 = apr_hash_get(table, key, klen);
++    apr_size_t length = i2d_PrivateKey(pkey, NULL);
++    unsigned char *p;
+ 
+-    /*
+-     * if a value for this key already exists,
+-     * reuse as much of the already malloc-ed data
+-     * as possible.
+-     */
++    /* Re-use structure if cached previously. */
+     if (asn1) {
+         if (asn1->nData != length) {
+-            free(asn1->cpData); /* XXX: realloc? */
+-            asn1->cpData = NULL;
++            asn1->cpData = ap_realloc(asn1->cpData, length);
+         }
+     }
+     else {
+         asn1 = ap_malloc(sizeof(*asn1));
+         asn1->source_mtime = 0; /* used as a note for encrypted private keys */
+-        asn1->cpData = NULL;
+-    }
+-
+-    asn1->nData = length;
+-    if (!asn1->cpData) {
+         asn1->cpData = ap_malloc(length);
++
++        apr_hash_set(table, key, klen, asn1);
+     }
+ 
+-    apr_hash_set(table, key, klen, asn1);
++    asn1->nData = length;
++    p = asn1->cpData;
++    i2d_PrivateKey(pkey, &p); /* increases p by length */
+ 
+-    return asn1->cpData; /* caller will assign a value to this */
++    return asn1;
+ }
+ 
+ ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table,
+@@ -469,3 +461,13 @@
+ }
+ 
+ #endif /* #if APR_HAS_THREADS && MODSSL_USE_OPENSSL_PRE_1_1_API */
++
++int modssl_is_engine_id(const char *name)
++{
++#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
++    /* ### Can handle any other special ENGINE key names here? */
++    return strncmp(name, "pkcs11:", 7) == 0;
++#else
++    return 0;
++#endif
++}
+--- httpd-2.4.33/modules/ssl/ssl_util_ssl.c.r1830819+
++++ httpd-2.4.33/modules/ssl/ssl_util_ssl.c
+@@ -74,7 +74,7 @@
+ **  _________________________________________________________________
+ */
+ 
+-EVP_PKEY *modssl_read_privatekey(const char* filename, EVP_PKEY **key, pem_password_cb *cb, void *s)
++EVP_PKEY *modssl_read_privatekey(const char *filename, pem_password_cb *cb, void *s)
+ {
+     EVP_PKEY *rc;
+     BIO *bioS;
+@@ -83,7 +83,7 @@
+     /* 1. try PEM (= DER+Base64+headers) */
+     if ((bioS=BIO_new_file(filename, "r")) == NULL)
+         return NULL;
+-    rc = PEM_read_bio_PrivateKey(bioS, key, cb, s);
++    rc = PEM_read_bio_PrivateKey(bioS, NULL, cb, s);
+     BIO_free(bioS);
+ 
+     if (rc == NULL) {
+@@ -107,41 +107,9 @@
+             BIO_free(bioS);
+         }
+     }
+-    if (rc != NULL && key != NULL) {
+-        if (*key != NULL)
+-            EVP_PKEY_free(*key);
+-        *key = rc;
+-    }
+     return rc;
+ }
+ 
+-typedef struct {
+-    const char *pass;
+-    int pass_len;
+-} pass_ctx;
+-
+-static int provide_pass(char *buf, int size, int rwflag, void *baton)
+-{
+-    pass_ctx *ctx = baton;
+-    if (ctx->pass_len > 0) {
+-        if (ctx->pass_len < size) {
+-            size = (int)ctx->pass_len;
+-        }
+-        memcpy(buf, ctx->pass, size);
+-    }
+-    return ctx->pass_len;
+-}
+-
+-EVP_PKEY   *modssl_read_encrypted_pkey(const char *filename, EVP_PKEY **key, 
+-                                       const char *pass, apr_size_t pass_len)
+-{
+-    pass_ctx ctx;
+-    
+-    ctx.pass = pass;
+-    ctx.pass_len = pass_len;
+-    return modssl_read_privatekey(filename, key, provide_pass, &ctx);
+-}
+-
+ /*  _________________________________________________________________
+ **
+ **  Smart shutdown
+--- httpd-2.4.33/modules/ssl/ssl_util_ssl.h.r1830819+
++++ httpd-2.4.33/modules/ssl/ssl_util_ssl.h
+@@ -64,8 +64,11 @@
+ void        modssl_init_app_data2_idx(void);
+ void       *modssl_get_app_data2(SSL *);
+ void        modssl_set_app_data2(SSL *, void *);
+-EVP_PKEY   *modssl_read_privatekey(const char *, EVP_PKEY **, pem_password_cb *, void *);
+-EVP_PKEY   *modssl_read_encrypted_pkey(const char *, EVP_PKEY **, const char *, apr_size_t);
++
++/* Read private key from filename in either PEM or raw base64(DER)
++ * format, using password entry callback cb and userdata. */
++EVP_PKEY   *modssl_read_privatekey(const char *filename, pem_password_cb *cb, void *ud);
++
+ int         modssl_smart_shutdown(SSL *ssl);
+ BOOL        modssl_X509_getBC(X509 *, int *, int *);
+ char       *modssl_X509_NAME_ENTRY_to_string(apr_pool_t *p, X509_NAME_ENTRY *xsne,
diff --git a/httpd.spec b/httpd.spec
index 0760824..5543eae 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 6%{?dist}
+Release: 7%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -73,6 +73,7 @@ Patch30: httpd-2.4.4-cachehardmax.patch
 Patch31: httpd-2.4.33-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
 Patch35: httpd-2.4.33-sslciphdefault.patch
+Patch36: httpd-2.4.33-r1830819+.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -232,6 +233,8 @@ interface for storing and accessing per-user session data.
 %patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
+%patch36 -p1 -b .r1830819+
+
 %patch58 -p1 -b .r1738878
 %patch59 -p1 -b .sslmerging
 
@@ -725,6 +728,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jul  6 2018 Joe Orton <jorton@redhat.com> - 2.4.33-7
+- mod_ssl: add PKCS#11 cert/key support (Anderson Sasaki)
+
 * Tue Jun 12 2018 Joe Orton <jorton@redhat.com> - 2.4.33-6
 - mod_systemd: show bound ports in status and log to journal
   at startup.

From 57759762322e764ae8472a5cb6ad536ca45d5af5 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 6 Jul 2018 17:03:16 +0100
Subject: [PATCH 113/359] Update to 2.4.33.

---
 pullrev.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pullrev.sh b/pullrev.sh
index 8ed3a64..e389b56 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then
 fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
-#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.27
+repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+ver=2.4.33
 prefix="httpd-${ver}"
 suffix="r$1${2:++}"
 fn="${prefix}-${suffix}.patch"

From 8ab39c8ee0a67248967e885e763afddb314cb0df Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 6 Jul 2018 17:03:22 +0100
Subject: [PATCH 114/359] add per-request memory leak fix (upstream r1833014)

---
 httpd-2.4.33-r1833841.patch | 59 +++++++++++++++++++++++++++++++++++++
 httpd.spec                  |  7 ++++-
 2 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.33-r1833841.patch

diff --git a/httpd-2.4.33-r1833841.patch b/httpd-2.4.33-r1833841.patch
new file mode 100644
index 0000000..749d67f
--- /dev/null
+++ b/httpd-2.4.33-r1833841.patch
@@ -0,0 +1,59 @@
+# ./pullrev.sh 1833841
+http://svn.apache.org/viewvc?view=revision&revision=1833841
+
+--- httpd-2.4.33/modules/http/http_request.c
++++ httpd-2.4.33/modules/http/http_request.c
+@@ -345,6 +345,16 @@
+     return rv;
+ }
+ 
++#define RETRIEVE_BRIGADE_FROM_POOL(bb, key, pool, allocator) do {       \
++    apr_pool_userdata_get((void **)&bb, key, pool);                     \
++    if (bb == NULL) {                                                   \
++        bb = apr_brigade_create(pool, allocator);                       \
++        apr_pool_userdata_setn((const void *)bb, key, NULL, pool);      \
++    }                                                                   \
++    else {                                                              \
++        apr_brigade_cleanup(bb);                                        \
++    }                                                                   \
++} while(0)
+ 
+ AP_DECLARE(void) ap_process_request_after_handler(request_rec *r)
+ {
+@@ -357,7 +367,8 @@
+      * this bucket is destroyed, the request will be logged and
+      * its pool will be freed
+      */
+-    bb = apr_brigade_create(c->pool, c->bucket_alloc);
++    RETRIEVE_BRIGADE_FROM_POOL(bb, "ap_process_request_after_handler_brigade",
++                               c->pool, c->bucket_alloc);
+     b = ap_bucket_eor_create(c->bucket_alloc, r);
+     APR_BRIGADE_INSERT_HEAD(bb, b);
+ 
+@@ -383,7 +394,7 @@
+      */
+     rv = ap_check_pipeline(c, bb, DEFAULT_LIMIT_BLANK_LINES);
+     c->data_in_input_filters = (rv == APR_SUCCESS);
+-    apr_brigade_destroy(bb);
++    apr_brigade_cleanup(bb);
+ 
+     if (c->cs)
+         c->cs->state = (c->aborted) ? CONN_STATE_LINGER
+@@ -477,7 +488,8 @@
+     ap_process_async_request(r);
+ 
+     if (!c->data_in_input_filters) {
+-        bb = apr_brigade_create(c->pool, c->bucket_alloc);
++        RETRIEVE_BRIGADE_FROM_POOL(bb, "ap_process_request_brigade", 
++                                   c->pool, c->bucket_alloc);
+         b = apr_bucket_flush_create(c->bucket_alloc);
+         APR_BRIGADE_INSERT_HEAD(bb, b);
+         rv = ap_pass_brigade(c->output_filters, bb);
+@@ -490,6 +502,7 @@
+             ap_log_cerror(APLOG_MARK, APLOG_INFO, rv, c, APLOGNO(01581)
+                           "flushing data to the client");
+         }
++        apr_brigade_cleanup(bb);
+     }
+     if (ap_extended_status) {
+         ap_time_process_request(c->sbh, STOP_PREQUEST);
diff --git a/httpd.spec b/httpd.spec
index 5543eae..f7e0765 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 7%{?dist}
+Release: 8%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -80,6 +80,7 @@ Patch36: httpd-2.4.33-r1830819+.patch
 Patch58: httpd-2.4.33-r1738878.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1564537
 Patch59: httpd-2.4.33-sslmerging.patch
+Patch60: httpd-2.4.33-r1833841.patch
 
 # Security fixes
 
@@ -237,6 +238,7 @@ interface for storing and accessing per-user session data.
 
 %patch58 -p1 -b .r1738878
 %patch59 -p1 -b .sslmerging
+%patch60 -p1 -b .r1833841
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -728,6 +730,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jul  6 2018 Joe Orton <jorton@redhat.com> - 2.4.33-8
+- add per-request memory leak fix (upstream r1833014)
+
 * Fri Jul  6 2018 Joe Orton <jorton@redhat.com> - 2.4.33-7
 - mod_ssl: add PKCS#11 cert/key support (Anderson Sasaki)
 

From 1ee4430d4280365a45b96bf3f6c9f32cb1e59dab Mon Sep 17 00:00:00 2001
From: Jason Tibbitts <tibbs@math.uh.edu>
Date: Tue, 10 Jul 2018 01:20:33 -0500
Subject: [PATCH 115/359] Remove needless use of %defattr

---
 httpd.spec | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index f479b9e..553f46e 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -582,7 +582,6 @@ set -x
 exit $rv
 
 %files
-%defattr(-,root,root)
 
 %doc ABOUT_APACHE README CHANGES LICENSE VERSIONING NOTICE
 %doc docs/conf/extra/*.conf
@@ -673,7 +672,6 @@ exit $rv
 %attr(755,root,root) %dir %{_unitdir}/httpd.socket.d
 
 %files tools
-%defattr(-,root,root)
 %{_bindir}/*
 %{_mandir}/man1/*
 %doc LICENSE NOTICE
@@ -681,12 +679,10 @@ exit $rv
 %exclude %{_mandir}/man1/apxs.1*
 
 %files manual
-%defattr(-,root,root)
 %{contentdir}/manual
 %config(noreplace) %{_sysconfdir}/httpd/conf.d/manual.conf
 
 %files -n mod_ssl
-%defattr(-,root,root)
 %{_libdir}/httpd/modules/mod_ssl.so
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-ssl.conf
 %config(noreplace) %{_sysconfdir}/httpd/conf.d/ssl.conf
@@ -698,29 +694,24 @@ exit $rv
 %{_mandir}/man8/httpd-init.*
 
 %files -n mod_proxy_html
-%defattr(-,root,root)
 %{_libdir}/httpd/modules/mod_proxy_html.so
 %{_libdir}/httpd/modules/mod_xml2enc.so
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf
 
 %files -n mod_ldap
-%defattr(-,root,root)
 %{_libdir}/httpd/modules/mod_*ldap.so
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-ldap.conf
 
 %files -n mod_session
-%defattr(-,root,root)
 %{_libdir}/httpd/modules/mod_session*.so
 %{_libdir}/httpd/modules/mod_auth_form.so
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
 
 %files -n mod_md
-%defattr(-,root,root)
 %{_libdir}/httpd/modules/mod_md.so
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-md.conf
 
 %files devel
-%defattr(-,root,root)
 %{_includedir}/httpd
 %{_bindir}/apxs
 %{_mandir}/man1/apxs.1*

From 68920957bf7bf106d75f78598dda3255f0ad1740 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 13 Jul 2018 05:07:26 +0000
Subject: [PATCH 116/359] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 553f46e..c9927ce 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 8%{?dist}
+Release: 9%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -721,6 +721,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.33-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
 * Fri Jul  6 2018 Joe Orton <jorton@redhat.com> - 2.4.33-8
 - add per-request memory leak fix (upstream r1833014)
 

From 2279af3204a62ddaa161fcbc00a15d9839855df1 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 16 Jul 2018 16:48:41 +0100
Subject: [PATCH 117/359] Tweak wording in privkey passphrase prompt.

---
 httpd-ssl-pass-dialog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd-ssl-pass-dialog b/httpd-ssl-pass-dialog
index 1e850cd..79318a6 100755
--- a/httpd-ssl-pass-dialog
+++ b/httpd-ssl-pass-dialog
@@ -1,3 +1,3 @@
 #!/bin/sh
 
-exec /bin/systemd-ask-password "Enter SSL pass phrase for $1 ($2) : "
+exec /bin/systemd-ask-password "Enter TLS private key passphrase for $1 ($2) : "

From 7a7c76fbe05fe657b4de60d41fcb9aa5e4fea04d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 16 Jul 2018 17:01:34 +0100
Subject: [PATCH 118/359] add Lua-based /server-status example page to docs

---
 httpd.spec | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index c9927ce..4594e86 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 9%{?dist}
+Release: 10%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -24,6 +24,7 @@ Source5: httpd.tmpfiles
 Source6: httpd.service
 Source7: action-graceful.sh
 Source8: action-configtest.sh
+Source9: server-status.conf
 Source10: httpd.conf
 Source11: 00-base.conf
 Source12: 00-mpm.conf
@@ -255,6 +256,7 @@ sed < $RPM_SOURCE_DIR/httpd.conf >> instance.conf '
 /^ *ErrorLog .logs/s,logs/,logs/${HTTPD_INSTANCE}_,
 '
 touch -r $RPM_SOURCE_DIR/instance.conf instance.conf
+cp -p $RPM_SOURCE_DIR/server-status.conf server-status.conf
 
 # Safety check: prevent build if defined MMN does not equal upstream MMN.
 vmmn=`echo MODULE_MAGIC_NUMBER_MAJOR | cpp -include include/ap_mmn.h | sed -n '/^2/p'`
@@ -430,9 +432,12 @@ cat > $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d/macros.httpd <<EOF
 EOF
 
 # Handle contentdir
-mkdir $RPM_BUILD_ROOT%{contentdir}/noindex
+mkdir $RPM_BUILD_ROOT%{contentdir}/noindex \
+      $RPM_BUILD_ROOT%{contentdir}/server-status
 install -m 644 -p $RPM_SOURCE_DIR/index.html \
         $RPM_BUILD_ROOT%{contentdir}/noindex/index.html
+install -m 644 -p docs/server-status/* \
+        $RPM_BUILD_ROOT%{contentdir}/server-status
 rm -rf %{contentdir}/htdocs
 
 # remove manual sources
@@ -585,7 +590,7 @@ exit $rv
 
 %doc ABOUT_APACHE README CHANGES LICENSE VERSIONING NOTICE
 %doc docs/conf/extra/*.conf
-%doc instance.conf
+%doc instance.conf server-status.conf
 
 %{_sysconfdir}/httpd/modules
 %{_sysconfdir}/httpd/logs
@@ -637,11 +642,13 @@ exit $rv
 %dir %{contentdir}/error
 %dir %{contentdir}/error/include
 %dir %{contentdir}/noindex
+%dir %{contentdir}/server-status
 %{contentdir}/icons/*
 %{contentdir}/error/README
 %{contentdir}/error/*.var
 %{contentdir}/error/include/*.html
 %{contentdir}/noindex/index.html
+%{contentdir}/server-status/*
 
 %attr(0710,root,apache) %dir /run/httpd
 %attr(0700,apache,apache) %dir /run/httpd/htcacheclean
@@ -721,6 +728,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Jul 16 2018 Joe Orton <jorton@redhat.com> - 2.4.33-10
+- add Lua-based /server-status example page to docs
+
 * Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.33-9
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 

From 23fb452daee23c23d64d203dc22f8924486a7b02 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 16 Jul 2018 17:02:14 +0100
Subject: [PATCH 119/359] don't block on service try-restart in posttrans
 scriptlet

---
 httpd.spec | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 4594e86..55e7748 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -556,7 +556,7 @@ exit 0
 
 %posttrans
 test -f /etc/sysconfig/httpd-disable-posttrans || \
-  /bin/systemctl try-restart httpd.service htcacheclean.service >/dev/null 2>&1 || :
+  /bin/systemctl try-restart --no-block httpd.service htcacheclean.service >/dev/null 2>&1 || :
 
 %check
 # Check the built modules are all PIC
@@ -729,6 +729,7 @@ exit $rv
 
 %changelog
 * Mon Jul 16 2018 Joe Orton <jorton@redhat.com> - 2.4.33-10
+- don't block on service try-restart in posttrans scriptlet
 - add Lua-based /server-status example page to docs
 
 * Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.33-9

From f7e11bc804e9dacc2a1f02480b830d96663544ef Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 16 Jul 2018 17:03:11 +0100
Subject: [PATCH 120/359] Add example lua server-status config.

---
 server-status.conf | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 server-status.conf

diff --git a/server-status.conf b/server-status.conf
new file mode 100644
index 0000000..be98f1b
--- /dev/null
+++ b/server-status.conf
@@ -0,0 +1,10 @@
+#
+# Lua-based server-status page; requires mod_lua to be loaded
+# as per default configuration.
+#
+LuaMapHandler ^/server-status$ /usr/share/httpd/server-status/server-status.lua
+
+<Directory /usr/share/httpd/server-status>
+    AllowOverride None
+    Require local
+</Directory>

From 6fd32168ffabf701a0e76e1ba264963f7352e9e7 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 16 Jul 2018 17:11:20 +0100
Subject: [PATCH 121/359] don't block on service try-restart in posttrans
 scriptlet add Lua-based /server-status example page to docs obsoletes: and
 provides: for mod_proxy_uswgi (#1599113) Resolves: rhbz#1599113

---
 httpd.spec | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/httpd.spec b/httpd.spec
index 55e7748..dda419f 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -104,6 +104,8 @@ Requires(preun): systemd-units
 Requires(postun): systemd-units
 Requires(post): systemd-units
 Conflicts: apr < 1.5.0-1
+Provides: mod_proxy_uwsgi = %{version}-%{release}
+Obsoletes: mod_proxy_uwsgi < 2.0.17-1
 
 %description
 The Apache HTTP Server is a powerful, efficient, and extensible
@@ -731,6 +733,7 @@ exit $rv
 * Mon Jul 16 2018 Joe Orton <jorton@redhat.com> - 2.4.33-10
 - don't block on service try-restart in posttrans scriptlet
 - add Lua-based /server-status example page to docs
+- obsoletes: and provides: for mod_proxy_uswgi (#1599113)
 
 * Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.33-9
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

From bc2b0a9538baa13d8436f120d24231c624e836b4 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 16 Jul 2018 20:41:32 +0100
Subject: [PATCH 122/359] BR gcc

---
 httpd.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index dda419f..8f22536 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -87,10 +87,10 @@ Patch60: httpd-2.4.33-r1833841.patch
 
 License: ASL 2.0
 Group: System Environment/Daemons
-BuildRequires: autoconf, perl-interpreter, perl-generators, pkgconfig, findutils, xmlto
+BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto
+BuildRequires: perl-interpreter, perl-generators, systemd-devel
 BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0
-BuildRequires: systemd-devel
 Requires: /etc/mime.types, system-logos-httpd
 Obsoletes: httpd-suexec
 Provides: webserver

From 5072c65a7ba0a2cda7310b48f4135eb0a5017a8b Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 18 Jul 2018 11:55:03 +0100
Subject: [PATCH 123/359] update to 2.4.34 (#1601160) Resolves: rhbz#1601160

---
 httpd-2.4.33-r1833841.patch                   | 59 -------------------
 httpd-2.4.33-sslmerging.patch                 | 15 -----
 ...38878.patch => httpd-2.4.34-r1738878.patch | 43 ++++++--------
 httpd.spec                                    | 16 +++--
 4 files changed, 25 insertions(+), 108 deletions(-)
 delete mode 100644 httpd-2.4.33-r1833841.patch
 delete mode 100644 httpd-2.4.33-sslmerging.patch
 rename httpd-2.4.33-r1738878.patch => httpd-2.4.34-r1738878.patch (74%)

diff --git a/httpd-2.4.33-r1833841.patch b/httpd-2.4.33-r1833841.patch
deleted file mode 100644
index 749d67f..0000000
--- a/httpd-2.4.33-r1833841.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-# ./pullrev.sh 1833841
-http://svn.apache.org/viewvc?view=revision&revision=1833841
-
---- httpd-2.4.33/modules/http/http_request.c
-+++ httpd-2.4.33/modules/http/http_request.c
-@@ -345,6 +345,16 @@
-     return rv;
- }
- 
-+#define RETRIEVE_BRIGADE_FROM_POOL(bb, key, pool, allocator) do {       \
-+    apr_pool_userdata_get((void **)&bb, key, pool);                     \
-+    if (bb == NULL) {                                                   \
-+        bb = apr_brigade_create(pool, allocator);                       \
-+        apr_pool_userdata_setn((const void *)bb, key, NULL, pool);      \
-+    }                                                                   \
-+    else {                                                              \
-+        apr_brigade_cleanup(bb);                                        \
-+    }                                                                   \
-+} while(0)
- 
- AP_DECLARE(void) ap_process_request_after_handler(request_rec *r)
- {
-@@ -357,7 +367,8 @@
-      * this bucket is destroyed, the request will be logged and
-      * its pool will be freed
-      */
--    bb = apr_brigade_create(c->pool, c->bucket_alloc);
-+    RETRIEVE_BRIGADE_FROM_POOL(bb, "ap_process_request_after_handler_brigade",
-+                               c->pool, c->bucket_alloc);
-     b = ap_bucket_eor_create(c->bucket_alloc, r);
-     APR_BRIGADE_INSERT_HEAD(bb, b);
- 
-@@ -383,7 +394,7 @@
-      */
-     rv = ap_check_pipeline(c, bb, DEFAULT_LIMIT_BLANK_LINES);
-     c->data_in_input_filters = (rv == APR_SUCCESS);
--    apr_brigade_destroy(bb);
-+    apr_brigade_cleanup(bb);
- 
-     if (c->cs)
-         c->cs->state = (c->aborted) ? CONN_STATE_LINGER
-@@ -477,7 +488,8 @@
-     ap_process_async_request(r);
- 
-     if (!c->data_in_input_filters) {
--        bb = apr_brigade_create(c->pool, c->bucket_alloc);
-+        RETRIEVE_BRIGADE_FROM_POOL(bb, "ap_process_request_brigade", 
-+                                   c->pool, c->bucket_alloc);
-         b = apr_bucket_flush_create(c->bucket_alloc);
-         APR_BRIGADE_INSERT_HEAD(bb, b);
-         rv = ap_pass_brigade(c->output_filters, bb);
-@@ -490,6 +502,7 @@
-             ap_log_cerror(APLOG_MARK, APLOG_INFO, rv, c, APLOGNO(01581)
-                           "flushing data to the client");
-         }
-+        apr_brigade_cleanup(bb);
-     }
-     if (ap_extended_status) {
-         ap_time_process_request(c->sbh, STOP_PREQUEST);
diff --git a/httpd-2.4.33-sslmerging.patch b/httpd-2.4.33-sslmerging.patch
deleted file mode 100644
index 066b5c8..0000000
--- a/httpd-2.4.33-sslmerging.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1564537
-
---- httpd-2.4.33/modules/ssl/ssl_engine_init.c.sslmerging
-+++ httpd-2.4.33/modules/ssl/ssl_engine_init.c
-@@ -261,7 +261,8 @@
-          * the protocol is https. */
-         if (ap_get_server_protocol(s) 
-             && strcmp("https", ap_get_server_protocol(s)) == 0
--            && sc->enabled == SSL_ENABLED_UNSET) {
-+            && sc->enabled == SSL_ENABLED_UNSET
-+            && (!apr_is_empty_array(sc->server->pks->cert_files))) {
-             sc->enabled = SSL_ENABLED_TRUE;
-         }
- 
diff --git a/httpd-2.4.33-r1738878.patch b/httpd-2.4.34-r1738878.patch
similarity index 74%
rename from httpd-2.4.33-r1738878.patch
rename to httpd-2.4.34-r1738878.patch
index d7ef42f..5af48f5 100644
--- a/httpd-2.4.33-r1738878.patch
+++ b/httpd-2.4.34-r1738878.patch
@@ -1,8 +1,5 @@
-diff --git a/modules/proxy/ajp.h b/modules/proxy/ajp.h
-index c119a7e..267150a 100644
-diff -uap httpd-2.4.33/modules/proxy/ajp_header.c.r1738878 httpd-2.4.33/modules/proxy/ajp_header.c
---- httpd-2.4.33/modules/proxy/ajp_header.c.r1738878
-+++ httpd-2.4.33/modules/proxy/ajp_header.c
+--- httpd-2.4.34/modules/proxy/ajp_header.c.r1738878
++++ httpd-2.4.34/modules/proxy/ajp_header.c
 @@ -213,7 +213,8 @@
  
  static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
@@ -53,9 +50,8 @@ diff -uap httpd-2.4.33/modules/proxy/ajp_header.c.r1738878 httpd-2.4.33/modules/
      if (rc != APR_SUCCESS) {
          ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(00988)
                 "ajp_send_header: ajp_marshal_into_msgb failed");
-diff -uap httpd-2.4.33/modules/proxy/ajp.h.r1738878 httpd-2.4.33/modules/proxy/ajp.h
---- httpd-2.4.33/modules/proxy/ajp.h.r1738878
-+++ httpd-2.4.33/modules/proxy/ajp.h
+--- httpd-2.4.34/modules/proxy/ajp.h.r1738878
++++ httpd-2.4.34/modules/proxy/ajp.h
 @@ -413,12 +413,14 @@
   * @param sock      backend socket
   * @param r         current request
@@ -72,9 +68,8 @@ diff -uap httpd-2.4.33/modules/proxy/ajp.h.r1738878 httpd-2.4.33/modules/proxy/a
  
  /**
   * Read the ajp message and return the type of the message.
-diff -uap httpd-2.4.33/modules/proxy/mod_proxy_ajp.c.r1738878 httpd-2.4.33/modules/proxy/mod_proxy_ajp.c
---- httpd-2.4.33/modules/proxy/mod_proxy_ajp.c.r1738878
-+++ httpd-2.4.33/modules/proxy/mod_proxy_ajp.c
+--- httpd-2.4.34/modules/proxy/mod_proxy_ajp.c.r1738878
++++ httpd-2.4.34/modules/proxy/mod_proxy_ajp.c
 @@ -193,6 +193,7 @@
      apr_off_t content_length = 0;
      int original_status = r->status;
@@ -100,10 +95,9 @@ diff -uap httpd-2.4.33/modules/proxy/mod_proxy_ajp.c.r1738878 httpd-2.4.33/modul
      if (status != APR_SUCCESS) {
          conn->close = 1;
          ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00868)
-diff -uap httpd-2.4.33/modules/proxy/mod_proxy.c.r1738878 httpd-2.4.33/modules/proxy/mod_proxy.c
---- httpd-2.4.33/modules/proxy/mod_proxy.c.r1738878
-+++ httpd-2.4.33/modules/proxy/mod_proxy.c
-@@ -318,6 +318,12 @@
+--- httpd-2.4.34/modules/proxy/mod_proxy.c.r1738878
++++ httpd-2.4.34/modules/proxy/mod_proxy.c
+@@ -319,6 +319,12 @@
                                  (int)sizeof(worker->s->upgrade));
          }
      }
@@ -113,13 +107,12 @@ diff -uap httpd-2.4.33/modules/proxy/mod_proxy.c.r1738878 httpd-2.4.33/modules/p
 +                                (int)sizeof(worker->s->secret));
 +        }
 +    }
-     else {
-         if (set_worker_hc_param_f) {
-             return set_worker_hc_param_f(p, s, worker, key, val, NULL);
-diff -uap httpd-2.4.33/modules/proxy/mod_proxy.h.r1738878 httpd-2.4.33/modules/proxy/mod_proxy.h
---- httpd-2.4.33/modules/proxy/mod_proxy.h.r1738878
-+++ httpd-2.4.33/modules/proxy/mod_proxy.h
-@@ -353,6 +353,7 @@
+     else if (!strcasecmp(key, "responsefieldsize")) {
+         long s = atol(val);
+         if (s < 0) {
+--- httpd-2.4.34/modules/proxy/mod_proxy.h.r1738878
++++ httpd-2.4.34/modules/proxy/mod_proxy.h
+@@ -357,6 +357,7 @@
  #define PROXY_WORKER_MAX_HOSTNAME_SIZE  64
  #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
  #define PROXY_BALANCER_MAX_STICKY_SIZE  64
@@ -127,10 +120,10 @@ diff -uap httpd-2.4.33/modules/proxy/mod_proxy.h.r1738878 httpd-2.4.33/modules/p
  
  #define PROXY_RFC1035_HOSTNAME_SIZE	256
  
-@@ -447,6 +448,7 @@
-     apr_interval_time_t interval;
-     char      upgrade[PROXY_WORKER_MAX_SCHEME_SIZE];/* upgrade protocol used by mod_proxy_wstunnel */
+@@ -453,6 +454,7 @@
      char      hostname_ex[PROXY_RFC1035_HOSTNAME_SIZE];  /* RFC1035 compliant version of the remote backend address */
+     apr_size_t   response_field_size; /* Size of proxy response buffer in bytes. */
+     unsigned int response_field_size_set:1;
 +    char      secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */
  } proxy_worker_shared;
  
diff --git a/httpd.spec b/httpd.spec
index 8f22536..8e30af1 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.33
-Release: 10%{?dist}
+Version: 2.4.34
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -78,10 +78,7 @@ Patch36: httpd-2.4.33-r1830819+.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
-Patch58: httpd-2.4.33-r1738878.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=1564537
-Patch59: httpd-2.4.33-sslmerging.patch
-Patch60: httpd-2.4.33-r1833841.patch
+Patch58: httpd-2.4.34-r1738878.patch
 
 # Security fixes
 
@@ -230,7 +227,7 @@ interface for storing and accessing per-user session data.
 %patch23 -p1 -b .export
 %patch24 -p1 -b .corelimit
 %patch25 -p1 -b .selinux
-%patch26 -p1 -b .r1337344+
+#patch26 -p1 -b .r1337344+
 %patch27 -p1 -b .icons
 %patch29 -p1 -b .systemd
 %patch30 -p1 -b .cachehardmax
@@ -240,8 +237,6 @@ interface for storing and accessing per-user session data.
 %patch36 -p1 -b .r1830819+
 
 %patch58 -p1 -b .r1738878
-%patch59 -p1 -b .sslmerging
-%patch60 -p1 -b .r1833841
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -730,6 +725,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Jul 18 2018 Joe Orton <jorton@redhat.com> - 2.4.34-1
+- update to 2.4.34 (#1601160)
+
 * Mon Jul 16 2018 Joe Orton <jorton@redhat.com> - 2.4.33-10
 - don't block on service try-restart in posttrans scriptlet
 - add Lua-based /server-status example page to docs

From 3a7bb1c9cbf2e2d6b2ca30005f04091aefa8217a Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 18 Jul 2018 12:11:53 +0100
Subject: [PATCH 124/359] Add sources.

---
 sources | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sources b/sources
index e8c3a89..a131fd4 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 SHA512 (httpd-2.4.33.tar.bz2) = e74b2b3346d67be45a8bc8a7cbb8eabf5c403a5cfe5797a976f94a539529843fbcdf03b9ca0548816b2cf37f4ce0eb301f8d5af25b1270fdf8dd9f5bf0585269
+SHA512 (httpd-2.4.34.tar.bz2) = 2bc09213f08a4722e305929fbac5f5060c7a8444704494894bb9b61f17e4d20bb6e3d663bb93fc5b2030b04a43fb12373d260cc291422b210b299725aaf3b5c8

From e07e4cdf0ff62c65f73258c7e3a120567a1cb02a Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 18 Jul 2018 12:13:22 +0100
Subject: [PATCH 125/359] Remove old sources.

---
 sources | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sources b/sources
index a131fd4..1840642 100644
--- a/sources
+++ b/sources
@@ -1,2 +1 @@
-SHA512 (httpd-2.4.33.tar.bz2) = e74b2b3346d67be45a8bc8a7cbb8eabf5c403a5cfe5797a976f94a539529843fbcdf03b9ca0548816b2cf37f4ce0eb301f8d5af25b1270fdf8dd9f5bf0585269
 SHA512 (httpd-2.4.34.tar.bz2) = 2bc09213f08a4722e305929fbac5f5060c7a8444704494894bb9b61f17e4d20bb6e3d663bb93fc5b2030b04a43fb12373d260cc291422b210b299725aaf3b5c8

From 71609fae141f89f2ee6602938b80b7ef59ff38de Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 18 Jul 2018 20:22:36 +0100
Subject: [PATCH 126/359] update Obsoletes for mod_proxy_uswgi (#1599113)
 Resolves: rhbz#httpd.spec

---
 httpd.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 8e30af1..bd55d7a 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.34
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -102,7 +102,7 @@ Requires(postun): systemd-units
 Requires(post): systemd-units
 Conflicts: apr < 1.5.0-1
 Provides: mod_proxy_uwsgi = %{version}-%{release}
-Obsoletes: mod_proxy_uwsgi < 2.0.17-1
+Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2
 
 %description
 The Apache HTTP Server is a powerful, efficient, and extensible
@@ -725,6 +725,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Jul 18 2018 Joe Orton <jorton@redhat.com> - 2.4.34-2
+- update Obsoletes for mod_proxy_uswgi (#1599113)
+
 * Wed Jul 18 2018 Joe Orton <jorton@redhat.com> - 2.4.34-1
 - update to 2.4.34 (#1601160)
 

From 84d2251c2d61d47cef5fbd15e037ce643ff0086c Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 19 Jul 2018 18:47:48 +0100
Subject: [PATCH 127/359] - Fedora layout is now upstream, drop patch

---
 httpd-2.4.3-layout.patch | 33 ---------------------------------
 httpd.spec               |  2 --
 2 files changed, 35 deletions(-)
 delete mode 100644 httpd-2.4.3-layout.patch

diff --git a/httpd-2.4.3-layout.patch b/httpd-2.4.3-layout.patch
deleted file mode 100644
index 163c66b..0000000
--- a/httpd-2.4.3-layout.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-
-Add layout for Fedora.
-
---- httpd-2.4.3/config.layout.layout
-+++ httpd-2.4.3/config.layout
-@@ -370,3 +370,27 @@
-     logfiledir:      ${localstatedir}/log/httpd
-     proxycachedir:   ${localstatedir}/cache/httpd
- </Layout>
-+
-+# Fedora/RHEL layout
-+<Layout Fedora>
-+    prefix:        /usr
-+    exec_prefix:   ${prefix}
-+    bindir:        ${prefix}/bin
-+    sbindir:       ${prefix}/sbin
-+    libdir:        ${prefix}/lib
-+    libexecdir:    ${prefix}/libexec
-+    mandir:        ${prefix}/man
-+    sysconfdir:    /etc/httpd/conf
-+    datadir:       ${prefix}/share/httpd
-+    installbuilddir: ${libdir}/httpd/build
-+    errordir:      ${datadir}/error
-+    iconsdir:      ${datadir}/icons
-+    htdocsdir:     /var/www/html
-+    manualdir:     ${datadir}/manual
-+    cgidir:        /var/www/cgi-bin
-+    includedir:    ${prefix}/include/httpd
-+    localstatedir: /var
-+    runtimedir:    /run/httpd
-+    logfiledir:    ${localstatedir}/log/httpd
-+    proxycachedir: ${localstatedir}/cache/httpd/proxy
-+</Layout>     
diff --git a/httpd.spec b/httpd.spec
index bd55d7a..e2e8e86 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -58,7 +58,6 @@ Source44: httpd@.service
 Patch1: httpd-2.4.1-apctl.patch
 Patch2: httpd-2.4.9-apxs.patch
 Patch3: httpd-2.4.1-deplibs.patch
-Patch5: httpd-2.4.3-layout.patch
 Patch6: httpd-2.4.3-apctl-systemd.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
@@ -218,7 +217,6 @@ interface for storing and accessing per-user session data.
 %patch1 -p1 -b .apctl
 %patch2 -p1 -b .apxs
 %patch3 -p1 -b .deplibs
-%patch5 -p1 -b .layout
 %patch6 -p1 -b .apctlsystemd
 
 %patch19 -p1 -b .detectsystemd

From e7a848a3dbca276fc439833e5e6ed62aac023e1a Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 20 Jul 2018 11:22:10 +0100
Subject: [PATCH 128/359] mod_ssl: fix OCSP regression (upstream r1555631)

---
 httpd-2.4.34-r1555631.patch | 14 ++++++++++++++
 httpd.spec                  |  7 ++++++-
 pullrev.sh                  |  4 ++--
 3 files changed, 22 insertions(+), 3 deletions(-)
 create mode 100644 httpd-2.4.34-r1555631.patch

diff --git a/httpd-2.4.34-r1555631.patch b/httpd-2.4.34-r1555631.patch
new file mode 100644
index 0000000..7ca9478
--- /dev/null
+++ b/httpd-2.4.34-r1555631.patch
@@ -0,0 +1,14 @@
+# ./pullrev.sh 1555631
+http://svn.apache.org/viewvc?view=revision&revision=1555631
+
+--- httpd-2.4.34/modules/ssl/ssl_engine_ocsp.c
++++ httpd-2.4.34/modules/ssl/ssl_engine_ocsp.c
+@@ -61,7 +61,7 @@
+     /* Use default responder URL if forced by configuration, else use
+      * certificate-specified responder, falling back to default if
+      * necessary and possible. */
+-    if (sc->server->ocsp_force_default) {
++    if (sc->server->ocsp_force_default == TRUE) {
+         s = sc->server->ocsp_responder;
+     }
+     else {
diff --git a/httpd.spec b/httpd.spec
index e2e8e86..c90d5c5 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.34
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -78,6 +78,7 @@ Patch36: httpd-2.4.33-r1830819+.patch
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.34-r1738878.patch
+Patch59: httpd-2.4.34-r1555631.patch
 
 # Security fixes
 
@@ -235,6 +236,7 @@ interface for storing and accessing per-user session data.
 %patch36 -p1 -b .r1830819+
 
 %patch58 -p1 -b .r1738878
+%patch59 -p1 -b .r1555631
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -723,6 +725,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jul 20 2018 Joe Orton <jorton@redhat.com> - 2.4.34-3
+- mod_ssl: fix OCSP regression (upstream r1555631)
+
 * Wed Jul 18 2018 Joe Orton <jorton@redhat.com> - 2.4.34-2
 - update Obsoletes for mod_proxy_uswgi (#1599113)
 
diff --git a/pullrev.sh b/pullrev.sh
index e389b56..dbb97a5 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then
 fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
-repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.33
+#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+ver=2.4.34
 prefix="httpd-${ver}"
 suffix="r$1${2:++}"
 fn="${prefix}-${suffix}.patch"

From 16e8d752336b4300e840b50e4e8604f1fea529c5 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 23 Jul 2018 13:43:03 +0100
Subject: [PATCH 129/359] Wording updates.

---
 httpd.service.xml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/httpd.service.xml b/httpd.service.xml
index e079ca2..4a6038d 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -56,8 +56,8 @@
 
     <para>This manual page describes the <command>systemd</command>
     unit files used to integrate the <command>httpd</command> daemon
-    with <command>systemd</command>. Two unit files are available:
-    <command>httpd.service</command> allows the
+    with <command>systemd</command>. Two main unit files are
+    available: <command>httpd.service</command> allows the
     <command>httpd</command> daemon to be run as a system service, and
     <command>httpd.socket</command> allows httpd to be started via
     socket-based activation. Most systems will use
@@ -223,8 +223,9 @@ Wants=network-online.target</programlisting>
       to which httpd can bind (using the <literal>Listen</literal>
       directive), which parts of the filesystem can be accessed, and
       whether outgoing TCP connections are possible. Many of these
-      restrictions can be adjusted using <command>semanage</command>
-      to change booleans or other types. See
+      restrictions can be relaxed or adjusted by using
+      <command>semanage</command> to change booleans or other
+      types. See
       <citerefentry><refentrytitle>httpd_selinux</refentrytitle><manvolnum>8</manvolnum></citerefentry>
       for more information.</para>
 

From 2f9bc4598d6ae6b6d700bbaf3db7b33315edb06b Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 13 Aug 2018 14:43:07 +0100
Subject: [PATCH 130/359] mod_ssl: backport TLSv1.3 support changes from
 upstream (#1615059) Resolves: rhbz#1615059

---
 httpd-2.4.34-layfix.patch    |  24 ++
 httpd-2.4.34-r1827912+.patch | 737 +++++++++++++++++++++++++++++++++++
 httpd.spec                   |   9 +-
 3 files changed, 769 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.34-layfix.patch
 create mode 100644 httpd-2.4.34-r1827912+.patch

diff --git a/httpd-2.4.34-layfix.patch b/httpd-2.4.34-layfix.patch
new file mode 100644
index 0000000..39728a1
--- /dev/null
+++ b/httpd-2.4.34-layfix.patch
@@ -0,0 +1,24 @@
+--- httpd-2.4.34/config.layout.layfix
++++ httpd-2.4.34/config.layout
+@@ -133,6 +133,7 @@
+ # Layout used in Fedora httpd packaging.
+ <Layout Fedora>
+     prefix:        /usr
++    localstatedir: /var
+     exec_prefix:   ${prefix}
+     bindir:        ${prefix}/bin
+     sbindir:       ${prefix}/sbin
+@@ -144,11 +145,10 @@
+     installbuilddir: ${libdir}/httpd/build
+     errordir:      ${datadir}/error
+     iconsdir:      ${datadir}/icons
+-    htdocsdir:     /var/www/html
++    htdocsdir:     ${localstatedir}/www/html
+     manualdir:     ${datadir}/manual
+-    cgidir:        /var/www/cgi-bin
++    cgidir:        ${localstatedir}/www/cgi-bin
+     includedir:    ${prefix}/include/httpd
+-    localstatedir: /var
+     runtimedir:    /run/httpd
+     logfiledir:    ${localstatedir}/log/httpd
+     proxycachedir: ${localstatedir}/cache/httpd/proxy
diff --git a/httpd-2.4.34-r1827912+.patch b/httpd-2.4.34-r1827912+.patch
new file mode 100644
index 0000000..a4567a6
--- /dev/null
+++ b/httpd-2.4.34-r1827912+.patch
@@ -0,0 +1,737 @@
+# ./pullrev.sh 1827912 1827924 1827992 1828220 1828222 1828720 1828723 1828790 1828791 1828792
+http://svn.apache.org/viewvc?view=revision&revision=1827912
+http://svn.apache.org/viewvc?view=revision&revision=1827924
+http://svn.apache.org/viewvc?view=revision&revision=1827992
+http://svn.apache.org/viewvc?view=revision&revision=1828220
+http://svn.apache.org/viewvc?view=revision&revision=1828222
+http://svn.apache.org/viewvc?view=revision&revision=1828720
+http://svn.apache.org/viewvc?view=revision&revision=1828723
+http://svn.apache.org/viewvc?view=revision&revision=1828790
+http://svn.apache.org/viewvc?view=revision&revision=1828791
+http://svn.apache.org/viewvc?view=revision&revision=1828792
+
+--- httpd-2.4.34/modules/ssl/mod_ssl.c.r1827912+
++++ httpd-2.4.34/modules/ssl/mod_ssl.c
+@@ -93,9 +93,9 @@
+     SSL_CMD_SRV(FIPS, FLAG,
+                 "Enable FIPS-140 mode "
+                 "(`on', `off')")
+-    SSL_CMD_ALL(CipherSuite, TAKE1,
+-                "Colon-delimited list of permitted SSL Ciphers "
+-                "('XXX:...:XXX' - see manual)")
++    SSL_CMD_ALL(CipherSuite, TAKE12,
++                "Colon-delimited list of permitted SSL Ciphers, optional preceeded "
++                "by protocol identifier ('XXX:...:XXX' - see manual)")
+     SSL_CMD_SRV(CertificateFile, TAKE1,
+                 "SSL Server Certificate file "
+                 "('/path/to/file' - PEM or DER encoded)")
+@@ -185,9 +185,9 @@
+     SSL_CMD_PXY(ProxyProtocol, RAW_ARGS,
+                "SSL Proxy: enable or disable SSL protocol flavors "
+                 "('[+-][" SSL_PROTOCOLS "] ...' - see manual)")
+-    SSL_CMD_PXY(ProxyCipherSuite, TAKE1,
++    SSL_CMD_PXY(ProxyCipherSuite, TAKE12,
+                "SSL Proxy: colon-delimited list of permitted SSL ciphers "
+-               "('XXX:...:XXX' - see manual)")
++               ", optionally preceeded by protocol specifier ('XXX:...:XXX' - see manual)")
+     SSL_CMD_PXY(ProxyVerify, TAKE1,
+                "SSL Proxy: whether to verify the remote certificate "
+                "('on' or 'off')")
+@@ -398,7 +398,7 @@
+     /* We must register the library in full, to ensure our configuration
+      * code can successfully test the SSL environment.
+      */
+-#if MODSSL_USE_OPENSSL_PRE_1_1_API
++#if MODSSL_USE_OPENSSL_PRE_1_1_API || defined(LIBRESSL_VERSION_NUMBER)
+     (void)CRYPTO_malloc_init();
+ #else
+     OPENSSL_malloc_init();
+--- httpd-2.4.34/modules/ssl/ssl_engine_config.c.r1827912+
++++ httpd-2.4.34/modules/ssl/ssl_engine_config.c
+@@ -136,6 +136,7 @@
+     mctx->auth.cipher_suite   = NULL;
+     mctx->auth.verify_depth   = UNSET;
+     mctx->auth.verify_mode    = SSL_CVERIFY_UNSET;
++    mctx->auth.tls13_ciphers = NULL;
+ 
+     mctx->ocsp_mask           = UNSET;
+     mctx->ocsp_force_default  = UNSET;
+@@ -280,6 +281,7 @@
+     cfgMergeString(auth.cipher_suite);
+     cfgMergeInt(auth.verify_depth);
+     cfgMerge(auth.verify_mode, SSL_CVERIFY_UNSET);
++    cfgMergeString(auth.tls13_ciphers);
+ 
+     cfgMergeInt(ocsp_mask);
+     cfgMergeBool(ocsp_force_default);
+@@ -761,24 +763,39 @@
+ 
+ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd,
+                                    void *dcfg,
+-                                   const char *arg)
++                                   const char *arg1, const char *arg2)
+ {
+     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+     SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
+ 
+-    /* Disable null and export ciphers by default, except for PROFILE=
+-     * configs where the parser doesn't cope. */
+-    if (strncmp(arg, "PROFILE=", 8) != 0)
+-        arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
+-
+-    if (cmd->path) {
+-        dc->szCipherSuite = arg;
+-    }
+-    else {
+-        sc->server->auth.cipher_suite = arg;
++    if (arg2 == NULL) {
++        arg2 = arg1;
++        arg1 = "SSL";
+     }
+-
+-    return NULL;
++    
++    if (!strcmp("SSL", arg1)) {
++        /* Disable null and export ciphers by default, except for PROFILE=
++         * configs where the parser doesn't cope. */
++        if (strncmp(arg2, "PROFILE=", 8) != 0)
++            arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
++        if (cmd->path) {
++            dc->szCipherSuite = arg2;
++        }
++        else {
++            sc->server->auth.cipher_suite = arg2;
++        }
++        return NULL;
++     }
++#ifdef SSL_OP_NO_TLSv1_3
++    else if (!strcmp("TLSv1.3", arg1)) {
++        if (cmd->path) {
++            return "TLSv1.3 ciphers cannot be set inside a directory context";
++        }
++        sc->server->auth.tls13_ciphers = arg2;
++        return NULL;
++     }
++#endif
++    return apr_pstrcat(cmd->pool, "procotol '", arg1, "' not supported", NULL);
+ }
+ 
+ #define SSL_FLAGS_CHECK_FILE \
+@@ -1451,6 +1468,9 @@
+         else if (strcEQ(w, "TLSv1.2")) {
+             thisopt = SSL_PROTOCOL_TLSV1_2;
+         }
++        else if (SSL_HAVE_PROTOCOL_TLSV1_3 && strcEQ(w, "TLSv1.3")) {
++            thisopt = SSL_PROTOCOL_TLSV1_3;
++        }
+ #endif
+         else if (strcEQ(w, "all")) {
+             thisopt = SSL_PROTOCOL_ALL;
+@@ -1512,18 +1532,30 @@
+ 
+ const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *cmd,
+                                         void *dcfg,
+-                                        const char *arg)
++                                        const char *arg1, const char *arg2)
+ {
+     SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
+-
+-    /* Disable null and export ciphers by default, except for PROFILE=
+-     * configs where the parser doesn't cope. */
+-    if (strncmp(arg, "PROFILE=", 8) != 0)
+-        arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
+-
+-    dc->proxy->auth.cipher_suite = arg;
+-
+-    return NULL;
++    
++    if (arg2 == NULL) {
++        arg2 = arg1;
++        arg1 = "SSL";
++    }
++    
++    if (!strcmp("SSL", arg1)) {
++        /* Disable null and export ciphers by default, except for PROFILE=
++         * configs where the parser doesn't cope. */
++        if (strncmp(arg2, "PROFILE=", 8) != 0)
++            arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
++        dc->proxy->auth.cipher_suite = arg2;
++        return NULL;
++    }
++#ifdef SSL_OP_NO_TLSv1_3
++    else if (!strcmp("TLSv1.3", arg1)) {
++        dc->proxy->auth.tls13_ciphers = arg2;
++        return NULL;
++    }
++#endif
++    return apr_pstrcat(cmd->pool, "procotol '", arg1, "' not supported", NULL);
+ }
+ 
+ const char *ssl_cmd_SSLProxyVerify(cmd_parms *cmd,
+--- httpd-2.4.34/modules/ssl/ssl_engine_init.c.r1827912+
++++ httpd-2.4.34/modules/ssl/ssl_engine_init.c
+@@ -568,6 +568,9 @@
+ #ifdef HAVE_TLSV1_X
+                      (protocol & SSL_PROTOCOL_TLSV1_1 ? "TLSv1.1, " : ""),
+                      (protocol & SSL_PROTOCOL_TLSV1_2 ? "TLSv1.2, " : ""),
++#if SSL_HAVE_PROTOCOL_TLSV1_3
++                     (protocol & SSL_PROTOCOL_TLSV1_3 ? "TLSv1.3, " : ""),
++#endif
+ #endif
+                      NULL);
+     cp[strlen(cp)-2] = NUL;
+@@ -600,6 +603,13 @@
+             TLSv1_2_client_method() : /* proxy */
+             TLSv1_2_server_method();  /* server */
+     }
++#ifdef SSL_OP_NO_TLSv1_3
++    else if (protocol == SSL_PROTOCOL_TLSV1_3) {
++        method = mctx->pkp ?
++            TLSv1_3_client_method() : /* proxy */
++            TLSv1_3_server_method();  /* server */
++    }
++#endif
+ #endif
+     else { /* For multiple protocols, we need a flexible method */
+         method = mctx->pkp ?
+@@ -617,7 +627,8 @@
+ 
+     SSL_CTX_set_options(ctx, SSL_OP_ALL);
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L  || \
++	(defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x20800000L)
+     /* always disable SSLv2, as per RFC 6176 */
+     SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
+ 
+@@ -640,9 +651,19 @@
+         SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_2);
+     }
+ #endif
++#ifdef SSL_OP_NO_TLSv1_3
++    if (!(protocol & SSL_PROTOCOL_TLSV1_3)) {
++        SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_3);
++    }
++#endif
+ 
+ #else /* #if OPENSSL_VERSION_NUMBER < 0x10100000L */
+     /* We first determine the maximum protocol version we should provide */
++#ifdef SSL_OP_NO_TLSv1_3
++    if (SSL_HAVE_PROTOCOL_TLSV1_3 && (protocol & SSL_PROTOCOL_TLSV1_3)) {
++        prot = TLS1_3_VERSION;
++    } else
++#endif
+     if (protocol & SSL_PROTOCOL_TLSV1_2) {
+         prot = TLS1_2_VERSION;
+     } else if (protocol & SSL_PROTOCOL_TLSV1_1) {
+@@ -664,6 +685,11 @@
+ 
+     /* Next we scan for the minimal protocol version we should provide,
+      * but we do not allow holes between max and min */
++#ifdef SSL_OP_NO_TLSv1_3
++    if (prot == TLS1_3_VERSION && protocol & SSL_PROTOCOL_TLSV1_2) {
++        prot = TLS1_2_VERSION;
++    }
++#endif
+     if (prot == TLS1_2_VERSION && protocol & SSL_PROTOCOL_TLSV1_1) {
+         prot = TLS1_1_VERSION;
+     }
+@@ -888,7 +914,15 @@
+         ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
+         return ssl_die(s);
+     }
+-
++#ifdef SSL_OP_NO_TLSv1_3
++    if (mctx->auth.tls13_ciphers 
++        && !SSL_CTX_set_ciphersuites(ctx, mctx->auth.tls13_ciphers)) {
++        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO()
++                "Unable to configure permitted TLSv1.3 ciphers");
++        ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
++        return ssl_die(s);
++    }
++#endif
+     return APR_SUCCESS;
+ }
+ 
+--- httpd-2.4.34/modules/ssl/ssl_engine_kernel.c.r1827912+
++++ httpd-2.4.34/modules/ssl/ssl_engine_kernel.c
+@@ -188,6 +188,12 @@
+             || strcmp(a1->cipher_suite, a2->cipher_suite))) {
+         return 0;
+     }
++    /* both have the same ca cipher suite string */
++    if ((a1->tls13_ciphers != a2->tls13_ciphers)
++        && (!a1->tls13_ciphers || !a2->tls13_ciphers 
++            || strcmp(a1->tls13_ciphers, a2->tls13_ciphers))) {
++        return 0;
++    }
+     return 1;
+ }
+ 
+@@ -424,21 +430,55 @@
+     }
+ }
+ 
++static int ssl_check_post_client_verify(request_rec *r, SSLSrvConfigRec *sc, 
++                                        SSLDirConfigRec *dc, SSL *ssl)
++{
++    /*
++     * Finally check for acceptable renegotiation results
++     */
++    if ((dc->nVerifyClient != SSL_CVERIFY_NONE) ||
++        (sc->server->auth.verify_mode != SSL_CVERIFY_NONE)) {
++        BOOL do_verify = ((dc->nVerifyClient == SSL_CVERIFY_REQUIRE) ||
++                          (sc->server->auth.verify_mode == SSL_CVERIFY_REQUIRE));
++
++        if (do_verify && (SSL_get_verify_result(ssl) != X509_V_OK)) {
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02262)
++                          "Re-negotiation handshake failed: "
++                          "Client verification failed");
++
++            return HTTP_FORBIDDEN;
++        }
++
++        if (do_verify) {
++            X509 *peercert;
++
++            if ((peercert = SSL_get_peer_certificate(ssl)) == NULL) {
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02263)
++                              "Re-negotiation handshake failed: "
++                              "Client certificate missing");
++
++                return HTTP_FORBIDDEN;
++            }
++
++            X509_free(peercert);
++        }
++    }
++    return OK;
++}
++
+ /*
+- *  Access Handler
++ *  Access Handler, classic flavour, for SSL/TLS up to v1.2 
++ *  where everything can be renegotiated and no one is happy.
+  */
+-int ssl_hook_Access(request_rec *r)
++static int ssl_hook_Access_classic(request_rec *r, SSLSrvConfigRec *sc, SSLDirConfigRec *dc,
++                                   SSLConnRec *sslconn, SSL *ssl)
+ {
+-    SSLDirConfigRec *dc         = myDirConfig(r);
+-    SSLSrvConfigRec *sc         = mySrvConfig(r->server);
+-    SSLConnRec *sslconn         = myConnConfig(r->connection);
+-    SSL *ssl                    = sslconn ? sslconn->ssl : NULL;
+     server_rec *handshakeserver = sslconn ? sslconn->server : NULL;
+     SSLSrvConfigRec *hssc       = handshakeserver? mySrvConfig(handshakeserver) : NULL;
+     SSL_CTX *ctx = NULL;
+     apr_array_header_t *requires;
+     ssl_require_t *ssl_requires;
+-    int ok, i;
++    int ok, i, rc;
+     BOOL renegotiate = FALSE, renegotiate_quick = FALSE;
+     X509 *cert;
+     X509 *peercert;
+@@ -446,66 +486,9 @@
+     X509_STORE_CTX *cert_store_ctx;
+     STACK_OF(SSL_CIPHER) *cipher_list_old = NULL, *cipher_list = NULL;
+     const SSL_CIPHER *cipher = NULL;
+-    int depth, verify_old, verify, n, is_slave = 0;
++    int depth, verify_old, verify, n;
+     const char *ncipher_suite;
+ 
+-    /* On a slave connection, we do not expect to have an SSLConnRec, but
+-     * our master connection might have one. */
+-    if (!(sslconn && ssl) && r->connection->master) {
+-        sslconn         = myConnConfig(r->connection->master);
+-        ssl             = sslconn ? sslconn->ssl : NULL;
+-        handshakeserver = sslconn ? sslconn->server : NULL;
+-        hssc            = handshakeserver? mySrvConfig(handshakeserver) : NULL;
+-        is_slave        = 1;
+-    }
+-    
+-    if (ssl) {
+-        /*
+-         * We should have handshaken here (on handshakeserver),
+-         * otherwise we are being redirected (ErrorDocument) from
+-         * a renegotiation failure below. The access is still 
+-         * forbidden in the latter case, let ap_die() handle
+-         * this recursive (same) error.
+-         */
+-        if (!SSL_is_init_finished(ssl)) {
+-            return HTTP_FORBIDDEN;
+-        }
+-        ctx = SSL_get_SSL_CTX(ssl);
+-    }
+-
+-    /*
+-     * Support for SSLRequireSSL directive
+-     */
+-    if (dc->bSSLRequired && !ssl) {
+-        if ((sc->enabled == SSL_ENABLED_OPTIONAL) && !is_slave) {
+-            /* This vhost was configured for optional SSL, just tell the
+-             * client that we need to upgrade.
+-             */
+-            apr_table_setn(r->err_headers_out, "Upgrade", "TLS/1.0, HTTP/1.1");
+-            apr_table_setn(r->err_headers_out, "Connection", "Upgrade");
+-
+-            return HTTP_UPGRADE_REQUIRED;
+-        }
+-
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02219)
+-                      "access to %s failed, reason: %s",
+-                      r->filename, "SSL connection required");
+-
+-        /* remember forbidden access for strict require option */
+-        apr_table_setn(r->notes, "ssl-access-forbidden", "1");
+-
+-        return HTTP_FORBIDDEN;
+-    }
+-
+-    /*
+-     * Check to see whether SSL is in use; if it's not, then no
+-     * further access control checks are relevant.  (the test for
+-     * sc->enabled is probably strictly unnecessary)
+-     */
+-    if (sc->enabled == SSL_ENABLED_FALSE || !ssl) {
+-        return DECLINED;
+-    }
+-
+ #ifdef HAVE_SRP
+     /*
+      * Support for per-directory reconfigured SSL connection parameters
+@@ -581,7 +564,7 @@
+         }
+ 
+         /* configure new state */
+-        if (is_slave) {
++        if (r->connection->master) {
+             /* TODO: this categorically fails changed cipher suite settings
+              * on slave connections. We could do better by
+              * - create a new SSL* from our SSL_CTX and set cipher suite there,
+@@ -659,7 +642,7 @@
+         }
+ 
+         if (renegotiate) {
+-            if (is_slave) {
++            if (r->connection->master) {
+                 /* The request causes renegotiation on a slave connection.
+                  * This is not allowed since we might have concurrent requests
+                  * on this connection.
+@@ -732,7 +715,7 @@
+                   (verify     & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)))
+             {
+                 renegotiate = TRUE;
+-                if (is_slave) {
++                if (r->connection->master) {
+                     /* The request causes renegotiation on a slave connection.
+                      * This is not allowed since we might have concurrent requests
+                      * on this connection.
+@@ -1050,30 +1033,8 @@
+         /*
+          * Finally check for acceptable renegotiation results
+          */
+-        if ((dc->nVerifyClient != SSL_CVERIFY_NONE) ||
+-            (sc->server->auth.verify_mode != SSL_CVERIFY_NONE)) {
+-            BOOL do_verify = ((dc->nVerifyClient == SSL_CVERIFY_REQUIRE) ||
+-                              (sc->server->auth.verify_mode == SSL_CVERIFY_REQUIRE));
+-
+-            if (do_verify && (SSL_get_verify_result(ssl) != X509_V_OK)) {
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02262)
+-                              "Re-negotiation handshake failed: "
+-                              "Client verification failed");
+-
+-                return HTTP_FORBIDDEN;
+-            }
+-
+-            if (do_verify) {
+-                if ((peercert = SSL_get_peer_certificate(ssl)) == NULL) {
+-                    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02263)
+-                                  "Re-negotiation handshake failed: "
+-                                  "Client certificate missing");
+-
+-                    return HTTP_FORBIDDEN;
+-                }
+-
+-                X509_free(peercert);
+-            }
++        if (OK != (rc = ssl_check_post_client_verify(r, sc, dc, ssl))) {
++            return rc;
+         }
+ 
+         /*
+@@ -1167,6 +1128,195 @@
+     return DECLINED;
+ }
+ 
++#ifdef SSL_OP_NO_TLSv1_3
++/*
++ *  Access Handler, modern flavour, for SSL/TLS v1.3 and onward. 
++ *  Only client certificates can be requested, everything else stays.
++ */
++static int ssl_hook_Access_modern(request_rec *r, SSLSrvConfigRec *sc, SSLDirConfigRec *dc,
++                                  SSLConnRec *sslconn, SSL *ssl)
++{
++    if ((dc->nVerifyClient != SSL_CVERIFY_UNSET) ||
++        (sc->server->auth.verify_mode != SSL_CVERIFY_UNSET)) {
++        int vmode_inplace, vmode_needed;
++        int change_vmode = FALSE;
++        int old_state, n, rc;
++
++        vmode_inplace = SSL_get_verify_mode(ssl);
++        vmode_needed = SSL_VERIFY_NONE;
++
++        if ((dc->nVerifyClient == SSL_CVERIFY_REQUIRE) ||
++            (sc->server->auth.verify_mode == SSL_CVERIFY_REQUIRE)) {
++            vmode_needed |= SSL_VERIFY_PEER_STRICT;
++        }
++
++        if ((dc->nVerifyClient == SSL_CVERIFY_OPTIONAL) ||
++            (dc->nVerifyClient == SSL_CVERIFY_OPTIONAL_NO_CA) ||
++            (sc->server->auth.verify_mode == SSL_CVERIFY_OPTIONAL) ||
++            (sc->server->auth.verify_mode == SSL_CVERIFY_OPTIONAL_NO_CA))
++        {
++            vmode_needed |= SSL_VERIFY_PEER;
++        }
++
++        if (vmode_needed == SSL_VERIFY_NONE) {
++            return DECLINED;
++        }
++
++        vmode_needed |= SSL_VERIFY_CLIENT_ONCE;
++        if (vmode_inplace != vmode_needed) {
++            /* Need to change, if new setting is more restrictive than existing one */
++
++            if ((vmode_inplace == SSL_VERIFY_NONE)
++                || (!(vmode_inplace   & SSL_VERIFY_PEER) 
++                    && (vmode_needed  & SSL_VERIFY_PEER))
++                || (!(vmode_inplace   & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) 
++                    && (vmode_needed & SSL_VERIFY_FAIL_IF_NO_PEER_CERT))) {
++                /* need to change the effective verify mode */
++                change_vmode = TRUE;
++            }
++            else {
++                /* FIXME: does this work with TLSv1.3? Is this more than re-inspecting
++                 * the certificate we should already have? */
++                /*
++                 * override of SSLVerifyDepth
++                 *
++                 * The depth checks are handled by us manually inside the
++                 * verify callback function and not by OpenSSL internally
++                 * (and our function is aware of both the per-server and
++                 * per-directory contexts). So we cannot ask OpenSSL about
++                 * the currently verify depth. Instead we remember it in our
++                 * SSLConnRec attached to the SSL* of OpenSSL.  We've to force
++                 * the renegotiation if the reconfigured/new verify depth is
++                 * less than the currently active/remembered verify depth
++                 * (because this means more restriction on the certificate
++                 * chain).
++                 */
++                n = (sslconn->verify_depth != UNSET)? 
++                    sslconn->verify_depth : sc->server->auth.verify_depth;
++                /* determine the new depth */
++                sslconn->verify_depth = (dc->nVerifyDepth != UNSET)
++                                        ? dc->nVerifyDepth
++                                        : sc->server->auth.verify_depth;
++                if (sslconn->verify_depth < n) {
++                    change_vmode = TRUE;
++                    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO()
++                                  "Reduced client verification depth will "
++                                  "force renegotiation");
++                }
++            }
++        }
++
++        if (change_vmode) {
++            char peekbuf[1];
++
++            if (r->connection->master) {
++                /* FIXME: modifying the SSL on a slave connection is no good.
++                 * We would need to push this back to the master connection
++                 * somehow.
++                 */
++                apr_table_setn(r->notes, "ssl-renegotiate-forbidden", "verify-client");
++                return HTTP_FORBIDDEN;
++            }
++
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO() "verify client post handshake");
++
++            SSL_set_verify(ssl, vmode_needed, ssl_callback_SSLVerify);
++            SSL_verify_client_post_handshake(ssl);
++
++            old_state = sslconn->reneg_state;
++            sslconn->reneg_state = RENEG_ALLOW;
++            modssl_set_app_data2(ssl, r);
++
++            SSL_do_handshake(ssl);
++            /* Need to trigger renegotiation handshake by reading.
++             * Peeking 0 bytes actually works.
++             * See: http://marc.info/?t=145493359200002&r=1&w=2
++             */
++            SSL_peek(ssl, peekbuf, 0);
++
++            sslconn->reneg_state = old_state;
++            modssl_set_app_data2(ssl, NULL);
++
++            /*
++             * Finally check for acceptable renegotiation results
++             */
++            if (OK != (rc = ssl_check_post_client_verify(r, sc, dc, ssl))) {
++                return rc;
++            }
++        }
++    }
++
++    return DECLINED;
++}
++#endif
++
++int ssl_hook_Access(request_rec *r)
++{
++    SSLDirConfigRec *dc         = myDirConfig(r);
++    SSLSrvConfigRec *sc         = mySrvConfig(r->server);
++    SSLConnRec *sslconn         = myConnConfig(r->connection);
++    SSL *ssl                    = sslconn ? sslconn->ssl : NULL;
++
++    /* On a slave connection, we do not expect to have an SSLConnRec, but
++     * our master connection might have one. */
++    if (!(sslconn && ssl) && r->connection->master) {
++        sslconn         = myConnConfig(r->connection->master);
++        ssl             = sslconn ? sslconn->ssl : NULL;
++    }
++
++    /*
++     * We should have handshaken here, otherwise we are being 
++     * redirected (ErrorDocument) from a renegotiation failure below. 
++     * The access is still forbidden in the latter case, let ap_die() handle
++     * this recursive (same) error.
++     */
++    if (ssl && !SSL_is_init_finished(ssl)) {
++        return HTTP_FORBIDDEN;
++    }
++
++    /*
++     * Support for SSLRequireSSL directive
++     */
++    if (dc->bSSLRequired && !ssl) {
++        if ((sc->enabled == SSL_ENABLED_OPTIONAL) && !r->connection->master) {
++            /* This vhost was configured for optional SSL, just tell the
++             * client that we need to upgrade.
++             */
++            apr_table_setn(r->err_headers_out, "Upgrade", "TLS/1.0, HTTP/1.1");
++            apr_table_setn(r->err_headers_out, "Connection", "Upgrade");
++
++            return HTTP_UPGRADE_REQUIRED;
++        }
++
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02219)
++                      "access to %s failed, reason: %s",
++                      r->filename, "SSL connection required");
++
++        /* remember forbidden access for strict require option */
++        apr_table_setn(r->notes, "ssl-access-forbidden", "1");
++
++        return HTTP_FORBIDDEN;
++    }
++
++    /*
++     * Check to see whether SSL is in use; if it's not, then no
++     * further access control checks are relevant.  (the test for
++     * sc->enabled is probably strictly unnecessary)
++     */
++    if (sc->enabled == SSL_ENABLED_FALSE || !ssl) {
++        return DECLINED;
++    }
++
++#ifdef SSL_OP_NO_TLSv1_3
++    /* TLSv1.3+ is less complicated here. Branch off into a new codeline
++     * and avoid messing with the past. */
++    if (SSL_version(ssl) >= TLS1_3_VERSION) {
++        return ssl_hook_Access_modern(r, sc, dc, sslconn, ssl);
++    } 
++#endif
++    return ssl_hook_Access_classic(r, sc, dc, sslconn, ssl);
++}
++
+ /*
+  *  Authentication Handler:
+  *  Fake a Basic authentication from the X509 client certificate.
+--- httpd-2.4.34/modules/ssl/ssl_private.h.r1827912+
++++ httpd-2.4.34/modules/ssl/ssl_private.h
+@@ -132,13 +132,14 @@
+         SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL)
+ #define SSL_CTX_set_max_proto_version(ctx, version) \
+         SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL)
+-#endif
+-/* LibreSSL declares OPENSSL_VERSION_NUMBER == 2.0 but does not include most
+- * changes from OpenSSL >= 1.1 (new functions, macros, deprecations, ...), so
+- * we have to work around this...
++#elif LIBRESSL_VERSION_NUMBER < 0x2070000f
++/* LibreSSL before 2.7 declares OPENSSL_VERSION_NUMBER == 2.0 but does not
++ * include most changes from OpenSSL >= 1.1 (new functions, macros, 
++ * deprecations, ...), so we have to work around this...
+  */
+ #define MODSSL_USE_OPENSSL_PRE_1_1_API (1)
+-#else
++#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */
++#else /* defined(LIBRESSL_VERSION_NUMBER) */
+ #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L)
+ #endif
+ 
+@@ -238,7 +239,8 @@
+ void free_bio_methods(void);
+ #endif
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x10002000L || defined(LIBRESSL_VERSION_NUMBER)
++#if OPENSSL_VERSION_NUMBER < 0x10002000L || \
++	(defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2070000f)
+ #define X509_STORE_CTX_get0_store(x) (x->ctx)
+ #endif
+ 
+@@ -372,8 +374,17 @@
+ #ifdef HAVE_TLSV1_X
+ #define SSL_PROTOCOL_TLSV1_1 (1<<3)
+ #define SSL_PROTOCOL_TLSV1_2 (1<<4)
++#define SSL_PROTOCOL_TLSV1_3 (1<<5)
++
++#ifdef SSL_OP_NO_TLSv1_3
++#define SSL_HAVE_PROTOCOL_TLSV1_3   (1)
++#define SSL_PROTOCOL_ALL   (SSL_PROTOCOL_BASIC| \
++                            SSL_PROTOCOL_TLSV1_1|SSL_PROTOCOL_TLSV1_2|SSL_PROTOCOL_TLSV1_3)
++#else
++#define SSL_HAVE_PROTOCOL_TLSV1_3   (0)
+ #define SSL_PROTOCOL_ALL   (SSL_PROTOCOL_BASIC| \
+                             SSL_PROTOCOL_TLSV1_1|SSL_PROTOCOL_TLSV1_2)
++#endif
+ #else
+ #define SSL_PROTOCOL_ALL   (SSL_PROTOCOL_BASIC)
+ #endif
+@@ -646,6 +657,11 @@
+     /** for client or downstream server authentication */
+     int          verify_depth;
+     ssl_verify_t verify_mode;
++
++    /** TLSv1.3 has its separate cipher list, separate from the
++     settings for older TLS protocol versions. Since which one takes
++     effect is a matter of negotiation, we need separate settings */
++    const char  *tls13_ciphers;
+ } modssl_auth_ctx_t;
+ 
+ #ifdef HAVE_TLS_SESSION_TICKETS
+@@ -801,7 +817,7 @@
+ const char  *ssl_cmd_SSLCryptoDevice(cmd_parms *, void *, const char *);
+ const char  *ssl_cmd_SSLRandomSeed(cmd_parms *, void *, const char *, const char *, const char *);
+ const char  *ssl_cmd_SSLEngine(cmd_parms *, void *, const char *);
+-const char  *ssl_cmd_SSLCipherSuite(cmd_parms *, void *, const char *);
++const char  *ssl_cmd_SSLCipherSuite(cmd_parms *, void *, const char *, const char *);
+ const char  *ssl_cmd_SSLCertificateFile(cmd_parms *, void *, const char *);
+ const char  *ssl_cmd_SSLCertificateKeyFile(cmd_parms *, void *, const char *);
+ const char  *ssl_cmd_SSLCertificateChainFile(cmd_parms *, void *, const char *);
+@@ -830,7 +846,7 @@
+ 
+ const char  *ssl_cmd_SSLProxyEngine(cmd_parms *cmd, void *dcfg, int flag);
+ const char  *ssl_cmd_SSLProxyProtocol(cmd_parms *, void *, const char *);
+-const char  *ssl_cmd_SSLProxyCipherSuite(cmd_parms *, void *, const char *);
++const char  *ssl_cmd_SSLProxyCipherSuite(cmd_parms *, void *, const char *, const char *);
+ const char  *ssl_cmd_SSLProxyVerify(cmd_parms *, void *, const char *);
+ const char  *ssl_cmd_SSLProxyVerifyDepth(cmd_parms *, void *, const char *);
+ const char  *ssl_cmd_SSLProxyCACertificatePath(cmd_parms *, void *, const char *);
diff --git a/httpd.spec b/httpd.spec
index c90d5c5..d87e1c6 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.34
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -58,6 +58,7 @@ Source44: httpd@.service
 Patch1: httpd-2.4.1-apctl.patch
 Patch2: httpd-2.4.9-apxs.patch
 Patch3: httpd-2.4.1-deplibs.patch
+Patch4: httpd-2.4.34-layfix.patch
 Patch6: httpd-2.4.3-apctl-systemd.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
@@ -74,6 +75,7 @@ Patch31: httpd-2.4.33-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
 Patch35: httpd-2.4.33-sslciphdefault.patch
 Patch36: httpd-2.4.33-r1830819+.patch
+Patch37: httpd-2.4.34-r1827912+.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -218,6 +220,7 @@ interface for storing and accessing per-user session data.
 %patch1 -p1 -b .apctl
 %patch2 -p1 -b .apxs
 %patch3 -p1 -b .deplibs
+%patch4 -p1 -b .layfix
 %patch6 -p1 -b .apctlsystemd
 
 %patch19 -p1 -b .detectsystemd
@@ -234,6 +237,7 @@ interface for storing and accessing per-user session data.
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 %patch36 -p1 -b .r1830819+
+%patch37 -p1 -b .r1827912+
 
 %patch58 -p1 -b .r1738878
 %patch59 -p1 -b .r1555631
@@ -725,6 +729,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Aug 13 2018 Joe Orton <jorton@redhat.com> - 2.4.34-4
+- mod_ssl: backport TLSv1.3 support changes from upstream (#1615059)
+
 * Fri Jul 20 2018 Joe Orton <jorton@redhat.com> - 2.4.34-3
 - mod_ssl: fix OCSP regression (upstream r1555631)
 

From b52ebeb33d4b79ff9ec399502499fc92b56a3ee1 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 21 Aug 2018 08:34:34 +0100
Subject: [PATCH 131/359] mod_ssl: further TLSv1.3 fix (#1619389) Resolves:
 rhbz#1619389

---
 httpd-2.4.34-r1827912+.patch | 61 ++++++++++++++++++++++++++++++++++++
 httpd.spec                   |  5 ++-
 2 files changed, 65 insertions(+), 1 deletion(-)

diff --git a/httpd-2.4.34-r1827912+.patch b/httpd-2.4.34-r1827912+.patch
index a4567a6..b4b2acc 100644
--- a/httpd-2.4.34-r1827912+.patch
+++ b/httpd-2.4.34-r1827912+.patch
@@ -9,6 +9,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1828723
 http://svn.apache.org/viewvc?view=revision&revision=1828790
 http://svn.apache.org/viewvc?view=revision&revision=1828791
 http://svn.apache.org/viewvc?view=revision&revision=1828792
+http://svn.apache.org/viewvc?view=revision&revision=1833588
 
 --- httpd-2.4.34/modules/ssl/mod_ssl.c.r1827912+
 +++ httpd-2.4.34/modules/ssl/mod_ssl.c
@@ -655,6 +656,66 @@ http://svn.apache.org/viewvc?view=revision&revision=1828792
  /*
   *  Authentication Handler:
   *  Fake a Basic authentication from the X509 client certificate.
+@@ -2080,31 +2230,43 @@
+ {
+     conn_rec *c;
+     server_rec *s;
+-    SSLConnRec *scr;
+ 
+     /* Retrieve the conn_rec and the associated SSLConnRec. */
+     if ((c = (conn_rec *)SSL_get_app_data((SSL *)ssl)) == NULL) {
+         return;
+     }
+ 
+-    if ((scr = myConnConfig(c)) == NULL) {
+-        return;
+-    }
++    /* With TLS 1.3 this callback may be called multiple times on the first
++     * negotiation, so the below logic to detect renegotiations can't work.
++     * Fortunately renegotiations are forbidden starting with TLS 1.3, and
++     * this is enforced by OpenSSL so there's nothing to be done here.
++     */
++#if SSL_HAVE_PROTOCOL_TLSV1_3
++    if (SSL_version(ssl) < TLS1_3_VERSION)
++#endif
++    {
++        SSLConnRec *sslconn;
+ 
+-    /* If the reneg state is to reject renegotiations, check the SSL
+-     * state machine and move to ABORT if a Client Hello is being
+-     * read. */
+-    if (!scr->is_proxy &&
+-        (where & SSL_CB_HANDSHAKE_START) &&
+-        scr->reneg_state == RENEG_REJECT) {
+-            scr->reneg_state = RENEG_ABORT;
++        if ((sslconn = myConnConfig(c)) == NULL) {
++            return;
++        }
++
++        /* If the reneg state is to reject renegotiations, check the SSL
++         * state machine and move to ABORT if a Client Hello is being
++         * read. */
++        if (!sslconn->is_proxy &&
++                (where & SSL_CB_HANDSHAKE_START) &&
++                sslconn->reneg_state == RENEG_REJECT) {
++            sslconn->reneg_state = RENEG_ABORT;
+             ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02042)
+                           "rejecting client initiated renegotiation");
+-    }
+-    /* If the first handshake is complete, change state to reject any
+-     * subsequent client-initiated renegotiation. */
+-    else if ((where & SSL_CB_HANDSHAKE_DONE) && scr->reneg_state == RENEG_INIT) {
+-        scr->reneg_state = RENEG_REJECT;
++        }
++        /* If the first handshake is complete, change state to reject any
++         * subsequent client-initiated renegotiation. */
++        else if ((where & SSL_CB_HANDSHAKE_DONE)
++                 && sslconn->reneg_state == RENEG_INIT) {
++            sslconn->reneg_state = RENEG_REJECT;
++        }
+     }
+ 
+     s = mySrvFromConn(c);
 --- httpd-2.4.34/modules/ssl/ssl_private.h.r1827912+
 +++ httpd-2.4.34/modules/ssl/ssl_private.h
 @@ -132,13 +132,14 @@
diff --git a/httpd.spec b/httpd.spec
index d87e1c6..697b97e 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.34
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -729,6 +729,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Aug 21 2018 Joe Orton <jorton@redhat.com> - 2.4.34-5
+- mod_ssl: further TLSv1.3 fix (#1619389)
+
 * Mon Aug 13 2018 Joe Orton <jorton@redhat.com> - 2.4.34-4
 - mod_ssl: backport TLSv1.3 support changes from upstream (#1615059)
 

From 5bf30dc15619f53f8d281e3a35360d9c67bf9ea2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Mon, 3 Sep 2018 11:29:22 +0200
Subject: [PATCH 132/359] mod_ssl: enable SSLv3 and change behavior of
 "SSLProtocol All"   configuration (#1624777)

Resolves: #1624777
---
 httpd-2.4.34-enable-sslv3.patch | 60 +++++++++++++++++++++++++++++++++
 httpd.spec                      |  8 ++++-
 2 files changed, 67 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.34-enable-sslv3.patch

diff --git a/httpd-2.4.34-enable-sslv3.patch b/httpd-2.4.34-enable-sslv3.patch
new file mode 100644
index 0000000..f559bf9
--- /dev/null
+++ b/httpd-2.4.34-enable-sslv3.patch
@@ -0,0 +1,60 @@
+diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
+index 517ce30..075f7e1 100644
+--- a/modules/ssl/ssl_engine_config.c
++++ b/modules/ssl/ssl_engine_config.c
+@@ -1474,6 +1474,8 @@ static const char *ssl_cmd_protocol_parse(cmd_parms *parms,
+ #endif
+         else if (strcEQ(w, "all")) {
+             thisopt = SSL_PROTOCOL_ALL;
++            // by default, ALL kw doesn't turn on SSLv3
++            thisopt &= ~SSL_PROTOCOL_SSLV3;
+         }
+         else {
+             return apr_pstrcat(parms->temp_pool,
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index 60df45f..f6645c2 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -537,6 +537,28 @@ static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s,
+ }
+ #endif
+ 
++/*
++ * Enable/disable SSLProtocol. If the mod_ssl enables protocol
++ * which is disabled by default by OpenSSL, show a warning.
++ * "option" is for example SSL_OP_NO_SSLv3.
++ */
++static void ssl_set_ctx_protocol_option(server_rec *s,
++                                        SSL_CTX *ctx,
++                                        long option,
++                                        int enabled,
++                                        const char *name)
++{
++      if (!enabled) {
++                SSL_CTX_set_options(ctx, option);
++      }
++      else if (SSL_CTX_get_options(ctx) & option) {
++                    SSL_CTX_clear_options(ctx, option);
++                    ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(02904)
++                                 "Allowing SSLProtocol %s even though it is disabled "
++                                 "by OpenSSL by default on this system", name);
++      }
++}
++
+ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+                                           apr_pool_t *p,
+                                           apr_pool_t *ptemp,
+@@ -695,9 +719,13 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+     }
+     if (prot == TLS1_1_VERSION && protocol & SSL_PROTOCOL_TLSV1) {
+         prot = TLS1_VERSION;
++        ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_TLSv1,
++                                    protocol & SSL_PROTOCOL_TLSV1, "TLSv1");
+     }
+ #ifndef OPENSSL_NO_SSL3
+     if (prot == TLS1_VERSION && protocol & SSL_PROTOCOL_SSLV3) {
++        ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_SSLv3,
++                                    protocol & SSL_PROTOCOL_SSLV3, "SSLv3");
+         prot = SSL3_VERSION;
+     }
+ #endif
diff --git a/httpd.spec b/httpd.spec
index 697b97e..5d98218 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.34
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -81,6 +81,7 @@ Patch37: httpd-2.4.34-r1827912+.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.34-r1738878.patch
 Patch59: httpd-2.4.34-r1555631.patch
+Patch60: httpd-2.4.34-enable-sslv3.patch
 
 # Security fixes
 
@@ -241,6 +242,7 @@ interface for storing and accessing per-user session data.
 
 %patch58 -p1 -b .r1738878
 %patch59 -p1 -b .r1555631
+%patch60 -p1 -b .enablesslv3
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -729,6 +731,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Aug 28 2018 Luboš Uhliarik <luhliari@redhat.com> - 2.4.34-6
+- mod_ssl: enable SSLv3 and change behavior of "SSLProtocol All"
+  configuration (#1624777)
+
 * Tue Aug 21 2018 Joe Orton <jorton@redhat.com> - 2.4.34-5
 - mod_ssl: further TLSv1.3 fix (#1619389)
 

From 369db50dd0f2e26d94699d80e69ae0e196fb585c Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 18 Sep 2018 13:57:48 +0100
Subject: [PATCH 133/359] mod_ssl: more TLSv1.3 fixes (#1619389) Resolves:
 rhbz#1619389

---
 httpd-2.4.33-sslciphdefault.patch |  33 ---
 httpd-2.4.34-r1827912+.patch      | 356 +++++++++++++++++-------------
 httpd-2.4.34-sslciphdefault.patch |  34 +++
 httpd.spec                        |   9 +-
 4 files changed, 248 insertions(+), 184 deletions(-)
 delete mode 100644 httpd-2.4.33-sslciphdefault.patch
 create mode 100644 httpd-2.4.34-sslciphdefault.patch

diff --git a/httpd-2.4.33-sslciphdefault.patch b/httpd-2.4.33-sslciphdefault.patch
deleted file mode 100644
index f2919b8..0000000
--- a/httpd-2.4.33-sslciphdefault.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1109119
-
-Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
-
---- httpd-2.4.33/modules/ssl/ssl_engine_config.c.sslciphdefault
-+++ httpd-2.4.33/modules/ssl/ssl_engine_config.c
-@@ -758,8 +758,10 @@
-     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
-     SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
- 
--    /* always disable null and export ciphers */
--    arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
-+    /* Disable null and export ciphers by default, except for PROFILE=
-+     * configs where the parser doesn't cope. */
-+    if (strncmp(arg, "PROFILE=", 8) != 0)
-+        arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
- 
-     if (cmd->path) {
-         dc->szCipherSuite = arg;
-@@ -1502,8 +1504,10 @@
- {
-     SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
- 
--    /* always disable null and export ciphers */
--    arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
-+    /* Disable null and export ciphers by default, except for PROFILE=
-+     * configs where the parser doesn't cope. */
-+    if (strncmp(arg, "PROFILE=", 8) != 0)
-+        arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
- 
-     dc->proxy->auth.cipher_suite = arg;
- 
diff --git a/httpd-2.4.34-r1827912+.patch b/httpd-2.4.34-r1827912+.patch
index b4b2acc..98c7ac8 100644
--- a/httpd-2.4.34-r1827912+.patch
+++ b/httpd-2.4.34-r1827912+.patch
@@ -1,15 +1,7 @@
-# ./pullrev.sh 1827912 1827924 1827992 1828220 1828222 1828720 1828723 1828790 1828791 1828792
-http://svn.apache.org/viewvc?view=revision&revision=1827912
-http://svn.apache.org/viewvc?view=revision&revision=1827924
-http://svn.apache.org/viewvc?view=revision&revision=1827992
-http://svn.apache.org/viewvc?view=revision&revision=1828220
-http://svn.apache.org/viewvc?view=revision&revision=1828222
-http://svn.apache.org/viewvc?view=revision&revision=1828720
-http://svn.apache.org/viewvc?view=revision&revision=1828723
-http://svn.apache.org/viewvc?view=revision&revision=1828790
-http://svn.apache.org/viewvc?view=revision&revision=1828791
-http://svn.apache.org/viewvc?view=revision&revision=1828792
-http://svn.apache.org/viewvc?view=revision&revision=1833588
+
+Pull all changes from upstream integration branch:
+
+svn diff -r1840105:1841219 https://svn.apache.org/repos/asf/httpd/httpd/branches/tlsv1.3-for-2.4.x
 
 --- httpd-2.4.34/modules/ssl/mod_ssl.c.r1827912+
 +++ httpd-2.4.34/modules/ssl/mod_ssl.c
@@ -65,7 +57,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
  
      cfgMergeInt(ocsp_mask);
      cfgMergeBool(ocsp_force_default);
-@@ -761,24 +763,39 @@
+@@ -761,22 +763,37 @@
  
  const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd,
                                     void *dcfg,
@@ -75,28 +67,21 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
      SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
      SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
  
--    /* Disable null and export ciphers by default, except for PROFILE=
--     * configs where the parser doesn't cope. */
--    if (strncmp(arg, "PROFILE=", 8) != 0)
--        arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
+-    /* always disable null and export ciphers */
+-    arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
 -
 -    if (cmd->path) {
 -        dc->szCipherSuite = arg;
--    }
--    else {
--        sc->server->auth.cipher_suite = arg;
 +    if (arg2 == NULL) {
 +        arg2 = arg1;
 +        arg1 = "SSL";
      }
--
--    return NULL;
+-    else {
+-        sc->server->auth.cipher_suite = arg;
 +    
 +    if (!strcmp("SSL", arg1)) {
-+        /* Disable null and export ciphers by default, except for PROFILE=
-+         * configs where the parser doesn't cope. */
-+        if (strncmp(arg2, "PROFILE=", 8) != 0)
-+            arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
++        /* always disable null and export ciphers */
++        arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
 +        if (cmd->path) {
 +            dc->szCipherSuite = arg2;
 +        }
@@ -104,21 +89,23 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
 +            sc->server->auth.cipher_suite = arg2;
 +        }
 +        return NULL;
-+     }
-+#ifdef SSL_OP_NO_TLSv1_3
+     }
+-
+-    return NULL;
++#if SSL_HAVE_PROTOCOL_TLSV1_3
 +    else if (!strcmp("TLSv1.3", arg1)) {
 +        if (cmd->path) {
 +            return "TLSv1.3 ciphers cannot be set inside a directory context";
 +        }
 +        sc->server->auth.tls13_ciphers = arg2;
 +        return NULL;
-+     }
++    }
 +#endif
 +    return apr_pstrcat(cmd->pool, "procotol '", arg1, "' not supported", NULL);
  }
  
  #define SSL_FLAGS_CHECK_FILE \
-@@ -1451,6 +1468,9 @@
+@@ -1449,6 +1466,9 @@
          else if (strcEQ(w, "TLSv1.2")) {
              thisopt = SSL_PROTOCOL_TLSV1_2;
          }
@@ -128,7 +115,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
  #endif
          else if (strcEQ(w, "all")) {
              thisopt = SSL_PROTOCOL_ALL;
-@@ -1512,18 +1532,30 @@
+@@ -1510,16 +1530,28 @@
  
  const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *cmd,
                                          void *dcfg,
@@ -137,10 +124,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
  {
      SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
 -
--    /* Disable null and export ciphers by default, except for PROFILE=
--     * configs where the parser doesn't cope. */
--    if (strncmp(arg, "PROFILE=", 8) != 0)
--        arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
+-    /* always disable null and export ciphers */
+-    arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
 -
 -    dc->proxy->auth.cipher_suite = arg;
 -
@@ -152,14 +137,12 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
 +    }
 +    
 +    if (!strcmp("SSL", arg1)) {
-+        /* Disable null and export ciphers by default, except for PROFILE=
-+         * configs where the parser doesn't cope. */
-+        if (strncmp(arg2, "PROFILE=", 8) != 0)
-+            arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
++        /* always disable null and export ciphers */
++        arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
 +        dc->proxy->auth.cipher_suite = arg2;
 +        return NULL;
 +    }
-+#ifdef SSL_OP_NO_TLSv1_3
++#if SSL_HAVE_PROTOCOL_TLSV1_3
 +    else if (!strcmp("TLSv1.3", arg1)) {
 +        dc->proxy->auth.tls13_ciphers = arg2;
 +        return NULL;
@@ -185,7 +168,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
              TLSv1_2_client_method() : /* proxy */
              TLSv1_2_server_method();  /* server */
      }
-+#ifdef SSL_OP_NO_TLSv1_3
++#if SSL_HAVE_PROTOCOL_TLSV1_3
 +    else if (protocol == SSL_PROTOCOL_TLSV1_3) {
 +        method = mctx->pkp ?
 +            TLSv1_3_client_method() : /* proxy */
@@ -205,31 +188,31 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
      /* always disable SSLv2, as per RFC 6176 */
      SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
  
-@@ -640,9 +651,19 @@
+@@ -639,10 +650,19 @@
+     if (!(protocol & SSL_PROTOCOL_TLSV1_2)) {
          SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_2);
      }
- #endif
-+#ifdef SSL_OP_NO_TLSv1_3
-+    if (!(protocol & SSL_PROTOCOL_TLSV1_3)) {
-+        SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_3);
-+    }
++#if SSL_HAVE_PROTOCOL_TLSV1_3
++    ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_TLSv1_3,
++                                protocol & SSL_PROTOCOL_TLSV1_3, "TLSv1.3");
 +#endif
+ #endif
  
  #else /* #if OPENSSL_VERSION_NUMBER < 0x10100000L */
      /* We first determine the maximum protocol version we should provide */
-+#ifdef SSL_OP_NO_TLSv1_3
++#if SSL_HAVE_PROTOCOL_TLSV1_3
 +    if (SSL_HAVE_PROTOCOL_TLSV1_3 && (protocol & SSL_PROTOCOL_TLSV1_3)) {
 +        prot = TLS1_3_VERSION;
-+    } else
++    } else  
 +#endif
      if (protocol & SSL_PROTOCOL_TLSV1_2) {
          prot = TLS1_2_VERSION;
      } else if (protocol & SSL_PROTOCOL_TLSV1_1) {
-@@ -664,6 +685,11 @@
+@@ -664,6 +684,11 @@
  
      /* Next we scan for the minimal protocol version we should provide,
       * but we do not allow holes between max and min */
-+#ifdef SSL_OP_NO_TLSv1_3
++#if SSL_HAVE_PROTOCOL_TLSV1_3
 +    if (prot == TLS1_3_VERSION && protocol & SSL_PROTOCOL_TLSV1_2) {
 +        prot = TLS1_2_VERSION;
 +    }
@@ -237,12 +220,26 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
      if (prot == TLS1_2_VERSION && protocol & SSL_PROTOCOL_TLSV1_1) {
          prot = TLS1_1_VERSION;
      }
-@@ -888,7 +914,15 @@
+@@ -736,6 +761,13 @@
+         SSL_CTX_set_mode(ctx, SSL_MODE_RELEASE_BUFFERS);
+ #endif
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x1010100fL
++    /* For OpenSSL >=1.1.1, disable auto-retry mode so it's possible
++     * to consume handshake records without blocking for app-data.
++     * https://github.com/openssl/openssl/issues/7178 */
++    SSL_CTX_clear_mode(ctx, SSL_MODE_AUTO_RETRY);
++#endif
++    
+     return APR_SUCCESS;
+ }
+ 
+@@ -888,7 +920,15 @@
          ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
          return ssl_die(s);
      }
 -
-+#ifdef SSL_OP_NO_TLSv1_3
++#if SSL_HAVE_PROTOCOL_TLSV1_3
 +    if (mctx->auth.tls13_ciphers 
 +        && !SSL_CTX_set_ciphersuites(ctx, mctx->auth.tls13_ciphers)) {
 +        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO()
@@ -254,6 +251,20 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
      return APR_SUCCESS;
  }
  
+@@ -1493,6 +1533,13 @@
+     X509_STORE_CTX *sctx;
+     X509_STORE *store = SSL_CTX_get_cert_store(mctx->ssl_ctx);
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x1010100fL
++    /* For OpenSSL >=1.1.1, turn on client cert support which is
++     * otherwise turned off by default (by design).
++     * https://github.com/openssl/openssl/issues/6933 */
++    SSL_CTX_set_post_handshake_auth(mctx->ssl_ctx, 1);
++#endif
++    
+     SSL_CTX_set_client_cert_cb(mctx->ssl_ctx,
+                                ssl_callback_proxy_cert);
+ 
 --- httpd-2.4.34/modules/ssl/ssl_engine_kernel.c.r1827912+
 +++ httpd-2.4.34/modules/ssl/ssl_engine_kernel.c
 @@ -188,6 +188,12 @@
@@ -269,77 +280,38 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
      return 1;
  }
  
-@@ -424,21 +430,55 @@
+@@ -424,87 +430,70 @@
      }
  }
  
-+static int ssl_check_post_client_verify(request_rec *r, SSLSrvConfigRec *sc, 
-+                                        SSLDirConfigRec *dc, SSL *ssl)
-+{
-+    /*
-+     * Finally check for acceptable renegotiation results
-+     */
-+    if ((dc->nVerifyClient != SSL_CVERIFY_NONE) ||
-+        (sc->server->auth.verify_mode != SSL_CVERIFY_NONE)) {
-+        BOOL do_verify = ((dc->nVerifyClient == SSL_CVERIFY_REQUIRE) ||
-+                          (sc->server->auth.verify_mode == SSL_CVERIFY_REQUIRE));
-+
-+        if (do_verify && (SSL_get_verify_result(ssl) != X509_V_OK)) {
-+            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02262)
-+                          "Re-negotiation handshake failed: "
-+                          "Client verification failed");
-+
-+            return HTTP_FORBIDDEN;
-+        }
-+
-+        if (do_verify) {
-+            X509 *peercert;
-+
-+            if ((peercert = SSL_get_peer_certificate(ssl)) == NULL) {
-+                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02263)
-+                              "Re-negotiation handshake failed: "
-+                              "Client certificate missing");
-+
-+                return HTTP_FORBIDDEN;
-+            }
-+
-+            X509_free(peercert);
-+        }
-+    }
-+    return OK;
-+}
-+
- /*
+-/*
 - *  Access Handler
-+ *  Access Handler, classic flavour, for SSL/TLS up to v1.2 
-+ *  where everything can be renegotiated and no one is happy.
-  */
+- */
 -int ssl_hook_Access(request_rec *r)
-+static int ssl_hook_Access_classic(request_rec *r, SSLSrvConfigRec *sc, SSLDirConfigRec *dc,
-+                                   SSLConnRec *sslconn, SSL *ssl)
++static int ssl_check_post_client_verify(request_rec *r, SSLSrvConfigRec *sc, 
++                                        SSLDirConfigRec *dc, SSLConnRec *sslconn,
++                                        SSL *ssl)
  {
 -    SSLDirConfigRec *dc         = myDirConfig(r);
 -    SSLSrvConfigRec *sc         = mySrvConfig(r->server);
 -    SSLConnRec *sslconn         = myConnConfig(r->connection);
 -    SSL *ssl                    = sslconn ? sslconn->ssl : NULL;
-     server_rec *handshakeserver = sslconn ? sslconn->server : NULL;
-     SSLSrvConfigRec *hssc       = handshakeserver? mySrvConfig(handshakeserver) : NULL;
-     SSL_CTX *ctx = NULL;
-     apr_array_header_t *requires;
-     ssl_require_t *ssl_requires;
+-    server_rec *handshakeserver = sslconn ? sslconn->server : NULL;
+-    SSLSrvConfigRec *hssc       = handshakeserver? mySrvConfig(handshakeserver) : NULL;
+-    SSL_CTX *ctx = NULL;
+-    apr_array_header_t *requires;
+-    ssl_require_t *ssl_requires;
 -    int ok, i;
-+    int ok, i, rc;
-     BOOL renegotiate = FALSE, renegotiate_quick = FALSE;
+-    BOOL renegotiate = FALSE, renegotiate_quick = FALSE;
      X509 *cert;
-     X509 *peercert;
-@@ -446,66 +486,9 @@
-     X509_STORE_CTX *cert_store_ctx;
-     STACK_OF(SSL_CIPHER) *cipher_list_old = NULL, *cipher_list = NULL;
-     const SSL_CIPHER *cipher = NULL;
+-    X509 *peercert;
+-    X509_STORE *cert_store = NULL;
+-    X509_STORE_CTX *cert_store_ctx;
+-    STACK_OF(SSL_CIPHER) *cipher_list_old = NULL, *cipher_list = NULL;
+-    const SSL_CIPHER *cipher = NULL;
 -    int depth, verify_old, verify, n, is_slave = 0;
-+    int depth, verify_old, verify, n;
-     const char *ncipher_suite;
- 
+-    const char *ncipher_suite;
+-
 -    /* On a slave connection, we do not expect to have an SSLConnRec, but
 -     * our master connection might have one. */
 -    if (!(sslconn && ssl) && r->connection->master) {
@@ -349,7 +321,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
 -        hssc            = handshakeserver? mySrvConfig(handshakeserver) : NULL;
 -        is_slave        = 1;
 -    }
--    
+     
 -    if (ssl) {
 -        /*
 -         * We should have handshaken here (on handshakeserver),
@@ -360,13 +332,23 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
 -         */
 -        if (!SSL_is_init_finished(ssl)) {
 -            return HTTP_FORBIDDEN;
--        }
++    /*
++     * Remember the peer certificate's DN
++     */
++    if ((cert = SSL_get_peer_certificate(ssl))) {
++        if (sslconn->client_cert) {
++            X509_free(sslconn->client_cert);
+         }
 -        ctx = SSL_get_SSL_CTX(ssl);
--    }
++        sslconn->client_cert = cert;
++        sslconn->client_dn = NULL;
+     }
 -
--    /*
++    
+     /*
 -     * Support for SSLRequireSSL directive
--     */
++     * Finally check for acceptable renegotiation results
+      */
 -    if (dc->bSSLRequired && !ssl) {
 -        if ((sc->enabled == SSL_ENABLED_OPTIONAL) && !is_slave) {
 -            /* This vhost was configured for optional SSL, just tell the
@@ -374,20 +356,40 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
 -             */
 -            apr_table_setn(r->err_headers_out, "Upgrade", "TLS/1.0, HTTP/1.1");
 -            apr_table_setn(r->err_headers_out, "Connection", "Upgrade");
--
++    if ((dc->nVerifyClient != SSL_CVERIFY_NONE) ||
++        (sc->server->auth.verify_mode != SSL_CVERIFY_NONE)) {
++        BOOL do_verify = ((dc->nVerifyClient == SSL_CVERIFY_REQUIRE) ||
++                          (sc->server->auth.verify_mode == SSL_CVERIFY_REQUIRE));
++
++        if (do_verify && (SSL_get_verify_result(ssl) != X509_V_OK)) {
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02262)
++                          "Re-negotiation handshake failed: "
++                          "Client verification failed");
+ 
 -            return HTTP_UPGRADE_REQUIRED;
--        }
--
++            return HTTP_FORBIDDEN;
+         }
+ 
 -        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02219)
 -                      "access to %s failed, reason: %s",
 -                      r->filename, "SSL connection required");
 -
 -        /* remember forbidden access for strict require option */
 -        apr_table_setn(r->notes, "ssl-access-forbidden", "1");
--
++        if (do_verify) {
++            if (cert == NULL) {
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02263)
++                              "Re-negotiation handshake failed: "
++                              "Client certificate missing");
+ 
 -        return HTTP_FORBIDDEN;
--    }
--
++                return HTTP_FORBIDDEN;
++            }
++        }
+     }
++    return OK;
++}
+ 
 -    /*
 -     * Check to see whether SSL is in use; if it's not, then no
 -     * further access control checks are relevant.  (the test for
@@ -396,11 +398,28 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
 -    if (sc->enabled == SSL_ENABLED_FALSE || !ssl) {
 -        return DECLINED;
 -    }
--
++/*
++ *  Access Handler, classic flavour, for SSL/TLS up to v1.2 
++ *  where everything can be renegotiated and no one is happy.
++ */
++static int ssl_hook_Access_classic(request_rec *r, SSLSrvConfigRec *sc, SSLDirConfigRec *dc,
++                                   SSLConnRec *sslconn, SSL *ssl)
++{
++    server_rec *handshakeserver = sslconn ? sslconn->server : NULL;
++    SSLSrvConfigRec *hssc       = handshakeserver? mySrvConfig(handshakeserver) : NULL;
++    SSL_CTX *ctx = NULL;
++    BOOL renegotiate = FALSE, renegotiate_quick = FALSE;
++    X509 *peercert;
++    X509_STORE *cert_store = NULL;
++    X509_STORE_CTX *cert_store_ctx;
++    STACK_OF(SSL_CIPHER) *cipher_list_old = NULL, *cipher_list = NULL;
++    const SSL_CIPHER *cipher = NULL;
++    int depth, verify_old, verify, n, rc;
++    const char *ncipher_suite;
+ 
  #ifdef HAVE_SRP
      /*
-      * Support for per-directory reconfigured SSL connection parameters
-@@ -581,7 +564,7 @@
+@@ -581,7 +570,7 @@
          }
  
          /* configure new state */
@@ -409,7 +428,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
              /* TODO: this categorically fails changed cipher suite settings
               * on slave connections. We could do better by
               * - create a new SSL* from our SSL_CTX and set cipher suite there,
-@@ -659,7 +642,7 @@
+@@ -659,7 +648,7 @@
          }
  
          if (renegotiate) {
@@ -418,7 +437,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
                  /* The request causes renegotiation on a slave connection.
                   * This is not allowed since we might have concurrent requests
                   * on this connection.
-@@ -732,7 +715,7 @@
+@@ -732,7 +721,7 @@
                    (verify     & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)))
              {
                  renegotiate = TRUE;
@@ -427,8 +446,29 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
                      /* The request causes renegotiation on a slave connection.
                       * This is not allowed since we might have concurrent requests
                       * on this connection.
-@@ -1050,30 +1033,8 @@
+@@ -885,6 +874,7 @@
+ 
+         if (renegotiate_quick) {
+             STACK_OF(X509) *cert_stack;
++            X509 *cert;
+ 
+             /* perform just a manual re-verification of the peer */
+             ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(02258)
+@@ -1037,43 +1027,10 @@
+         }
+ 
          /*
+-         * Remember the peer certificate's DN
+-         */
+-        if ((cert = SSL_get_peer_certificate(ssl))) {
+-            if (sslconn->client_cert) {
+-                X509_free(sslconn->client_cert);
+-            }
+-            sslconn->client_cert = cert;
+-            sslconn->client_dn = NULL;
+-        }
+-
+-        /*
           * Finally check for acceptable renegotiation results
           */
 -        if ((dc->nVerifyClient != SSL_CVERIFY_NONE) ||
@@ -455,16 +495,19 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
 -
 -                X509_free(peercert);
 -            }
-+        if (OK != (rc = ssl_check_post_client_verify(r, sc, dc, ssl))) {
++        if (OK != (rc = ssl_check_post_client_verify(r, sc, dc, sslconn, ssl))) {
 +            return rc;
          }
  
          /*
-@@ -1167,6 +1128,195 @@
-     return DECLINED;
- }
+@@ -1096,6 +1053,215 @@
+         }
+     }
  
-+#ifdef SSL_OP_NO_TLSv1_3
++    return DECLINED;
++}
++
++#if SSL_HAVE_PROTOCOL_TLSV1_3
 +/*
 + *  Access Handler, modern flavour, for SSL/TLS v1.3 and onward. 
 + *  Only client certificates can be requested, everything else stays.
@@ -557,8 +600,16 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
 +            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO() "verify client post handshake");
 +
 +            SSL_set_verify(ssl, vmode_needed, ssl_callback_SSLVerify);
-+            SSL_verify_client_post_handshake(ssl);
 +
++            if (SSL_verify_client_post_handshake(ssl) != 1) {
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10158)
++                              "cannot perform post-handshake authentication");
++                ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);
++                apr_table_setn(r->notes, "error-notes",
++                               "Reason: Cannot perform Post-Handshake Authentication.<br />");
++                return HTTP_FORBIDDEN;
++            }
++            
 +            old_state = sslconn->reneg_state;
 +            sslconn->reneg_state = RENEG_ALLOW;
 +            modssl_set_app_data2(ssl, r);
@@ -576,7 +627,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
 +            /*
 +             * Finally check for acceptable renegotiation results
 +             */
-+            if (OK != (rc = ssl_check_post_client_verify(r, sc, dc, ssl))) {
++            if (OK != (rc = ssl_check_post_client_verify(r, sc, dc, sslconn, ssl))) {
 +                return rc;
 +            }
 +        }
@@ -592,6 +643,9 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
 +    SSLSrvConfigRec *sc         = mySrvConfig(r->server);
 +    SSLConnRec *sslconn         = myConnConfig(r->connection);
 +    SSL *ssl                    = sslconn ? sslconn->ssl : NULL;
++    apr_array_header_t *requires;
++    ssl_require_t *ssl_requires;
++    int ok, i, ret;
 +
 +    /* On a slave connection, we do not expect to have an SSLConnRec, but
 +     * our master connection might have one. */
@@ -643,20 +697,26 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
 +        return DECLINED;
 +    }
 +
-+#ifdef SSL_OP_NO_TLSv1_3
++#if SSL_HAVE_PROTOCOL_TLSV1_3
 +    /* TLSv1.3+ is less complicated here. Branch off into a new codeline
 +     * and avoid messing with the past. */
 +    if (SSL_version(ssl) >= TLS1_3_VERSION) {
-+        return ssl_hook_Access_modern(r, sc, dc, sslconn, ssl);
-+    } 
++        ret = ssl_hook_Access_modern(r, sc, dc, sslconn, ssl);
++    }
++    else
 +#endif
-+    return ssl_hook_Access_classic(r, sc, dc, sslconn, ssl);
-+}
++    {
++        ret = ssl_hook_Access_classic(r, sc, dc, sslconn, ssl);
++    }
 +
- /*
-  *  Authentication Handler:
-  *  Fake a Basic authentication from the X509 client certificate.
-@@ -2080,31 +2230,43 @@
++    if (ret != DECLINED) {
++        return ret;
++    }
++
+     /* If we're trying to have the user name set from a client
+      * certificate then we need to set it here. This should be safe as
+      * the user name probably isn't important from an auth checking point
+@@ -2080,31 +2246,43 @@
  {
      conn_rec *c;
      server_rec *s;
@@ -680,6 +740,10 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
 +#endif
 +    {
 +        SSLConnRec *sslconn;
++
++        if ((sslconn = myConnConfig(c)) == NULL) {
++            return;
++        }
  
 -    /* If the reneg state is to reject renegotiations, check the SSL
 -     * state machine and move to ABORT if a Client Hello is being
@@ -688,10 +752,6 @@ http://svn.apache.org/viewvc?view=revision&revision=1833588
 -        (where & SSL_CB_HANDSHAKE_START) &&
 -        scr->reneg_state == RENEG_REJECT) {
 -            scr->reneg_state = RENEG_ABORT;
-+        if ((sslconn = myConnConfig(c)) == NULL) {
-+            return;
-+        }
-+
 +        /* If the reneg state is to reject renegotiations, check the SSL
 +         * state machine and move to ABORT if a Client Hello is being
 +         * read. */
diff --git a/httpd-2.4.34-sslciphdefault.patch b/httpd-2.4.34-sslciphdefault.patch
new file mode 100644
index 0000000..6060f24
--- /dev/null
+++ b/httpd-2.4.34-sslciphdefault.patch
@@ -0,0 +1,34 @@
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1109119
+
+Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
+
+--- httpd-2.4.34/modules/ssl/ssl_engine_config.c.sslciphdefault
++++ httpd-2.4.34/modules/ssl/ssl_engine_config.c
+@@ -774,9 +774,11 @@
+     }
+     
+     if (!strcmp("SSL", arg1)) {
+-        /* always disable null and export ciphers */
+-        arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
+         if (cmd->path) {
++            /* Disable null and export ciphers by default, except for PROFILE=
++             * configs where the parser doesn't cope. */
++            if (strncmp(arg2, "PROFILE=", 8) != 0)
++                arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
+             dc->szCipherSuite = arg2;
+         }
+         else {
+@@ -1540,8 +1542,10 @@
+     }
+     
+     if (!strcmp("SSL", arg1)) {
+-        /* always disable null and export ciphers */
+-        arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
++        /* Disable null and export ciphers by default, except for PROFILE=
++         * configs where the parser doesn't cope. */
++        if (strncmp(arg2, "PROFILE=", 8) != 0)
++            arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
+         dc->proxy->auth.cipher_suite = arg2;
+         return NULL;
+     }
diff --git a/httpd.spec b/httpd.spec
index 697b97e..6640f65 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.34
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -73,9 +73,9 @@ Patch29: httpd-2.4.33-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
 Patch31: httpd-2.4.33-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
-Patch35: httpd-2.4.33-sslciphdefault.patch
 Patch36: httpd-2.4.33-r1830819+.patch
 Patch37: httpd-2.4.34-r1827912+.patch
+Patch38: httpd-2.4.34-sslciphdefault.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -235,9 +235,9 @@ interface for storing and accessing per-user session data.
 %patch30 -p1 -b .cachehardmax
 #patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
-%patch35 -p1 -b .sslciphdefault
 %patch36 -p1 -b .r1830819+
 %patch37 -p1 -b .r1827912+
+%patch38 -p1 -b .sslciphdefault
 
 %patch58 -p1 -b .r1738878
 %patch59 -p1 -b .r1555631
@@ -729,6 +729,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Sep 18 2018 Joe Orton <jorton@redhat.com> - 2.4.34-6
+- mod_ssl: more TLSv1.3 fixes (#1619389)
+
 * Tue Aug 21 2018 Joe Orton <jorton@redhat.com> - 2.4.34-5
 - mod_ssl: further TLSv1.3 fix (#1619389)
 

From 86433978a1e5820ebe5ece19a64cebf77053910b Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 21 Sep 2018 13:07:38 +0100
Subject: [PATCH 134/359] mod_ssl: follow OpenSSL protocol defaults if
 SSLProtocol   is not configured (Rob Crittenden, #1618371) Resolves:
 rhbz#1618371

---
 httpd-2.4.34-sslprotdefault.patch | 53 +++++++++++++++++++++++++++++++
 httpd.spec                        |  8 ++++-
 2 files changed, 60 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.34-sslprotdefault.patch

diff --git a/httpd-2.4.34-sslprotdefault.patch b/httpd-2.4.34-sslprotdefault.patch
new file mode 100644
index 0000000..65f8d40
--- /dev/null
+++ b/httpd-2.4.34-sslprotdefault.patch
@@ -0,0 +1,53 @@
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1618371 
+
+--- httpd-2.4.34/modules/ssl/ssl_engine_config.c.sslprotdefault
++++ httpd-2.4.34/modules/ssl/ssl_engine_config.c
+@@ -119,7 +119,7 @@
+     mctx->ticket_key          = NULL;
+ #endif
+ 
+-    mctx->protocol            = SSL_PROTOCOL_DEFAULT;
++    mctx->protocol            = SSL_PROTOCOL_NONE;
+     mctx->protocol_set        = 0;
+ 
+     mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET;
+--- httpd-2.4.34/modules/ssl/ssl_engine_init.c.sslprotdefault
++++ httpd-2.4.34/modules/ssl/ssl_engine_init.c
+@@ -555,9 +555,8 @@
+      *  Create the new per-server SSL context
+      */
+     if (protocol == SSL_PROTOCOL_NONE) {
+-        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231)
+-                "No SSL protocols available [hint: SSLProtocol]");
+-        return ssl_die(s);
++        ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, 
++                     "Using OpenSSL/system default SSL/TLS protocols");
+     }
+ 
+     cp = apr_pstrcat(p,
+@@ -673,14 +672,8 @@
+     } else if (protocol & SSL_PROTOCOL_SSLV3) {
+         prot = SSL3_VERSION;
+ #endif
+-    } else {
+-        SSL_CTX_free(ctx);
+-        mctx->ssl_ctx = NULL;
+-        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378)
+-                "No SSL protocols available [hint: SSLProtocol]");
+-        return ssl_die(s);
+     }
+-    SSL_CTX_set_max_proto_version(ctx, prot);
++    if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_max_proto_version(ctx, prot);
+ 
+     /* Next we scan for the minimal protocol version we should provide,
+      * but we do not allow holes between max and min */
+@@ -700,7 +693,7 @@
+         prot = SSL3_VERSION;
+     }
+ #endif
+-    SSL_CTX_set_min_proto_version(ctx, prot);
++    if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_min_proto_version(ctx, prot);
+ #endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L */
+ 
+ #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
diff --git a/httpd.spec b/httpd.spec
index 6640f65..7b97a69 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.34
-Release: 6%{?dist}
+Release: 7%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -76,6 +76,7 @@ Patch34: httpd-2.4.17-socket-activation.patch
 Patch36: httpd-2.4.33-r1830819+.patch
 Patch37: httpd-2.4.34-r1827912+.patch
 Patch38: httpd-2.4.34-sslciphdefault.patch
+Patch39: httpd-2.4.34-sslprotdefault.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -238,6 +239,7 @@ interface for storing and accessing per-user session data.
 %patch36 -p1 -b .r1830819+
 %patch37 -p1 -b .r1827912+
 %patch38 -p1 -b .sslciphdefault
+%patch39 -p1 -b .sslprotdefault
 
 %patch58 -p1 -b .r1738878
 %patch59 -p1 -b .r1555631
@@ -729,6 +731,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Sep 21 2018 Joe Orton <jorton@redhat.com> - 2.4.34-7
+- mod_ssl: follow OpenSSL protocol defaults if SSLProtocol
+  is not configured (Rob Crittenden, #1618371)
+
 * Tue Sep 18 2018 Joe Orton <jorton@redhat.com> - 2.4.34-6
 - mod_ssl: more TLSv1.3 fixes (#1619389)
 

From e6f56309054391f226d45bafc1b9b5b1dc87cf2e Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 21 Sep 2018 15:22:11 +0100
Subject: [PATCH 135/359] comment-out SSLProtocol, SSLProxyProtocol from
 ssl.conf in   default configuration; now follow OpenSSL system default
 (#1468322) Resolves: rhbz#1468322

---
 httpd.spec |  6 +++++-
 ssl.conf   | 17 ++++++++---------
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 9ddb745..6ee6bea 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.34
-Release: 7%{?dist}
+Release: 8%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -733,6 +733,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Sep 21 2018 Joe Orton <jorton@redhat.com> - 2.4.34-8
+- comment-out SSLProtocol, SSLProxyProtocol from ssl.conf in
+  default configuration; now follow OpenSSL system default (#1468322)
+
 * Fri Sep 21 2018 Joe Orton <jorton@redhat.com> - 2.4.34-7
 - mod_ssl: follow OpenSSL protocol defaults if SSLProtocol
   is not configured (Rob Crittenden, #1618371)
diff --git a/ssl.conf b/ssl.conf
index a07bd8f..373b9e5 100644
--- a/ssl.conf
+++ b/ssl.conf
@@ -70,11 +70,10 @@ LogLevel warn
 SSLEngine on
 
 #   List the protocol versions which clients are allowed to connect with.
-#   Disable SSLv3 by default (cf. RFC 7525 3.1.1).  TLSv1 (1.0) should be
-#   disabled as quickly as practical.  By the end of 2016, only the TLSv1.2
-#   protocol or later should remain in use.
-SSLProtocol all -SSLv3
-SSLProxyProtocol all -SSLv3
+#   The OpenSSL system profile is configured by default.  See
+#   update-crypto-policies(8) for more details.
+#SSLProtocol all -SSLv3
+#SSLProxyProtocol all -SSLv3
 
 #   User agents such as web browsers are not configured for the user's
 #   own preference of either security or performance, therefore this
@@ -83,10 +82,10 @@ SSLProxyProtocol all -SSLv3
 SSLHonorCipherOrder on
 
 #   SSL Cipher Suite:
-# List the ciphers that the client is permitted to negotiate.
-# See the mod_ssl documentation for a complete list.
-# The OpenSSL system profile is configured by default.  See
-# update-crypto-policies(8) for more details.
+#   List the ciphers that the client is permitted to negotiate.
+#   See the mod_ssl documentation for a complete list.
+#   The OpenSSL system profile is configured by default.  See
+#   update-crypto-policies(8) for more details.
 SSLCipherSuite PROFILE=SYSTEM
 SSLProxyCipherSuite PROFILE=SYSTEM
 

From 1f748ace31801b5aad9f970bd913474f4b059c58 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 25 Sep 2018 09:43:59 +0100
Subject: [PATCH 136/359] fix build if OpenSSL built w/o SSLv3 support

---
 httpd-2.4.34-enable-sslv3.patch | 25 +++++++++++++------------
 httpd.spec                      |  7 +++++--
 2 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/httpd-2.4.34-enable-sslv3.patch b/httpd-2.4.34-enable-sslv3.patch
index f559bf9..a2eba80 100644
--- a/httpd-2.4.34-enable-sslv3.patch
+++ b/httpd-2.4.34-enable-sslv3.patch
@@ -1,21 +1,22 @@
-diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
-index 517ce30..075f7e1 100644
---- a/modules/ssl/ssl_engine_config.c
-+++ b/modules/ssl/ssl_engine_config.c
-@@ -1474,6 +1474,8 @@ static const char *ssl_cmd_protocol_parse(cmd_parms *parms,
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1623165
+
+--- httpd-2.4.34/modules/ssl/ssl_engine_config.c.enable-sslv3
++++ httpd-2.4.34/modules/ssl/ssl_engine_config.c
+@@ -1474,6 +1474,10 @@
  #endif
          else if (strcEQ(w, "all")) {
              thisopt = SSL_PROTOCOL_ALL;
-+            // by default, ALL kw doesn't turn on SSLv3
++#ifndef OPENSSL_NO_SSL3
++            /* by default, ALL kw doesn't turn on SSLv3 */
 +            thisopt &= ~SSL_PROTOCOL_SSLV3;
++#endif
          }
          else {
              return apr_pstrcat(parms->temp_pool,
-diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
-index 60df45f..f6645c2 100644
---- a/modules/ssl/ssl_engine_init.c
-+++ b/modules/ssl/ssl_engine_init.c
-@@ -537,6 +537,28 @@ static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s,
+--- httpd-2.4.34/modules/ssl/ssl_engine_init.c.enable-sslv3
++++ httpd-2.4.34/modules/ssl/ssl_engine_init.c
+@@ -537,6 +537,28 @@
  }
  #endif
  
@@ -44,7 +45,7 @@ index 60df45f..f6645c2 100644
  static apr_status_t ssl_init_ctx_protocol(server_rec *s,
                                            apr_pool_t *p,
                                            apr_pool_t *ptemp,
-@@ -695,9 +719,13 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -687,9 +709,13 @@
      }
      if (prot == TLS1_1_VERSION && protocol & SSL_PROTOCOL_TLSV1) {
          prot = TLS1_VERSION;
diff --git a/httpd.spec b/httpd.spec
index 6ee6bea..5d42dca 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.34
-Release: 8%{?dist}
+Release: 9%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -244,7 +244,7 @@ interface for storing and accessing per-user session data.
 
 %patch58 -p1 -b .r1738878
 %patch59 -p1 -b .r1555631
-%patch60 -p1 -b .enablesslv3
+%patch60 -p1 -b .enable-sslv3
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -733,6 +733,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Sep 25 2018 Joe Orton <jorton@redhat.com> - 2.4.34-9
+- fix build if OpenSSL built w/o SSLv3 support
+
 * Fri Sep 21 2018 Joe Orton <jorton@redhat.com> - 2.4.34-8
 - comment-out SSLProtocol, SSLProxyProtocol from ssl.conf in
   default configuration; now follow OpenSSL system default (#1468322)

From f201a4ebc1cf1111d8a761dc9c0ba6662bd463fb Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 28 Sep 2018 08:51:19 +0100
Subject: [PATCH 137/359] apachectl: don't read /etc/sysconfig/httpd

---
 ...d.patch => httpd-2.4.34-apctlsystemd.patch | 24 ++++++++++++++-----
 httpd.spec                                    |  7 ++++--
 2 files changed, 23 insertions(+), 8 deletions(-)
 rename httpd-2.4.3-apctl-systemd.patch => httpd-2.4.34-apctlsystemd.patch (63%)

diff --git a/httpd-2.4.3-apctl-systemd.patch b/httpd-2.4.34-apctlsystemd.patch
similarity index 63%
rename from httpd-2.4.3-apctl-systemd.patch
rename to httpd-2.4.34-apctlsystemd.patch
index c6bf5da..996978c 100644
--- a/httpd-2.4.3-apctl-systemd.patch
+++ b/httpd-2.4.34-apctlsystemd.patch
@@ -5,17 +5,29 @@ Note: "apachectl graceful" is documented to start httpd if not running.
 
 Upstream-Status: vendor specific patch
 
---- httpd-2.4.18/support/apachectl.in.apctlsystemd
-+++ httpd-2.4.18/support/apachectl.in
-@@ -100,9 +100,28 @@ fi
+--- httpd-2.4.34/support/apachectl.in.apctlsystemd
++++ httpd-2.4.34/support/apachectl.in
+@@ -58,11 +58,6 @@
+ # have one, then status and fullstatus will not work.
+ STATUSURL="http://localhost:@PORT@/server-status"
+ 
+-# Source /etc/sysconfig/httpd for $HTTPD setting, etc.
+-if [ -r /etc/sysconfig/httpd ]; then
+-   . /etc/sysconfig/httpd
+-fi
+-
+ #
+ # Set this variable to a command that increases the maximum
+ # number of file descriptors allowed per child process. This is
+@@ -100,9 +95,28 @@
  ERROR=$?
  }
  
 +if [ "x$2" != "x" ] ; then
 +    echo Passing arguments to httpd using apachectl is no longer supported.
 +    echo You can only start/stop/restart httpd using this script.
-+    echo If you want to pass extra arguments to httpd, edit the
-+    echo /etc/sysconfig/httpd config file.
++    echo To pass extra arguments to httpd, see the httpd.service(8)
++    echo man page.
 +fi
 +
  case $ACMD in
@@ -38,7 +50,7 @@ Upstream-Status: vendor specific patch
      ERROR=$?
      ;;
  startssl|sslstart|start-SSL)
-@@ -114,10 +133,6 @@ startssl|sslstart|start-SSL)
+@@ -114,10 +128,6 @@
  configtest)
      testconfig
      ;;
diff --git a/httpd.spec b/httpd.spec
index 5d42dca..8938613 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.34
-Release: 9%{?dist}
+Release: 10%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -59,7 +59,7 @@ Patch1: httpd-2.4.1-apctl.patch
 Patch2: httpd-2.4.9-apxs.patch
 Patch3: httpd-2.4.1-deplibs.patch
 Patch4: httpd-2.4.34-layfix.patch
-Patch6: httpd-2.4.3-apctl-systemd.patch
+Patch6: httpd-2.4.34-apctlsystemd.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
@@ -733,6 +733,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Sep 28 2018 Joe Orton <jorton@redhat.com> - 2.4.34-10
+- apachectl: don't read /etc/sysconfig/httpd
+
 * Tue Sep 25 2018 Joe Orton <jorton@redhat.com> - 2.4.34-9
 - fix build if OpenSSL built w/o SSLv3 support
 

From c72daf66bd5b17af39b0707234d0650118b52815 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 31 Oct 2018 10:01:24 +0000
Subject: [PATCH 138/359] add htcacheclean.service(8) man page

---
 .gitignore               |   1 +
 htcacheclean.service     |   3 +-
 htcacheclean.service.xml | 123 +++++++++++++++++++++++++++++++++++++++
 httpd.spec               |   9 ++-
 4 files changed, 133 insertions(+), 3 deletions(-)
 create mode 100644 htcacheclean.service.xml

diff --git a/.gitignore b/.gitignore
index 4f0a93f..00acede 100644
--- a/.gitignore
+++ b/.gitignore
@@ -31,3 +31,4 @@ x86_64
 /httpd-*.tar.bz2
 /httpd*.8
 /results_httpd
+/htcacheclean.service.8
diff --git a/htcacheclean.service b/htcacheclean.service
index 166067b..d1e9d60 100644
--- a/htcacheclean.service
+++ b/htcacheclean.service
@@ -1,6 +1,7 @@
 [Unit]
-Description=Disk Cache Cleaning Daemon for Apache HTTP Server
+Description=Disk Cache Cleaning Daemon for the Apache HTTP Server
 After=httpd.service
+Documentation=man:htcacheclean.service(8)
 
 [Service]
 Type=forking
diff --git a/htcacheclean.service.xml b/htcacheclean.service.xml
new file mode 100644
index 0000000..d771ae7
--- /dev/null
+++ b/htcacheclean.service.xml
@@ -0,0 +1,123 @@
+<?xml version='1.0' encoding='utf-8'?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
+
+]>
+<!--
+ Copyright 2018 Red Hat, Inc.
+
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language overning permissions and
+ limitations under the License.
+-->
+<refentry>
+  <refentryinfo>
+    <title>htcacheclean systemd unit</title>
+    <productname>httpd</productname>
+    <author><contrib>Author</contrib><surname>Orton</surname><firstname>Joe</firstname><email>jorton@redhat.com</email></author>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>htcacheclean.service</refentrytitle>
+    <manvolnum>8</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>htcacheclean.service</refname>
+    <refpurpose>htcacheclean unit file for systemd</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <para>
+      <filename>/usr/lib/systemd/system/htcacheclean.service</filename>
+    </para>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para>This manual page describes the <command>systemd</command>
+    unit file for the <command>htcacheclean</command> daemon.  This
+    unit file provides a service which runs
+    <command>htcacheclean</command> is run in daemon mode,
+    periodically cleaning the disk cache root to ensure disk space
+    usage is within configured limits.</para>
+
+  </refsect1>
+
+  <refsect1>
+    <title>Options</title>
+
+    <para>The service is configured by configuration file
+    <filename>/etc/sysconfig/htcacheclean</filename>. The following
+    variables are used, following standard <command>systemd</command>
+    <varname>EnvironmentFile=</varname> syntax:</para>
+
+    <variablelist>
+      <varlistentry>
+        <term><varname>INTERVAL=</varname></term>
+
+        <listitem><para>Sets the interval between cache clean runs, in
+        minutes.  By default this is configured as
+        <emphasis>15</emphasis>.</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>CACHE_ROOT=</varname></term>
+
+        <listitem><para>Sets the directory name used for the cache
+        root.  By default this is configured as
+        <filename>/var/cache/httpd/proxy</filename>.</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>LIMIT=</varname></term>
+
+        <listitem><para>Sets the total disk cache space limit, in
+        bytes.  Use a <emphasis>K</emphasis> or <emphasis>M</emphasis>
+        suffix to signify kilobytes or megabytes.  By default this is
+        set to <emphasis>100M</emphasis>.</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>OPTIONS=</varname></term>
+
+        <listitem><para>Any other options to pass to
+        <command>htcacheclean</command>.</para></listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1>
+    <title>Files</title>
+
+    <para><filename>/usr/lib/systemd/system/htcacheclean.service</filename>,
+    <filename>/etc/sysconfig/htcacheclean</filename></para>
+  </refsect1>
+
+  <refsect1>
+    <title>See also</title>
+
+    <para>
+    <citerefentry><refentrytitle>htcacheclean</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>httpd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    </para>
+  </refsect1>
+
+</refentry>
+
+<!-- LocalWords:  systemd httpd htcacheclean
+-->
diff --git a/httpd.spec b/httpd.spec
index 8938613..85d661c 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.34
-Release: 10%{?dist}
+Release: 11%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -49,6 +49,7 @@ Source29: 01-md.conf
 Source30: README.confd
 Source31: README.confmod
 Source32: httpd.service.xml
+Source33: htcacheclean.service.xml
 Source40: htcacheclean.service
 Source41: htcacheclean.sysconf
 Source42: httpd-init.service
@@ -275,6 +276,7 @@ sed 's/@MPM@/%{mpm}/' < $RPM_SOURCE_DIR/httpd.service.xml \
     > httpd.service.xml
 
 xmlto man ./httpd.service.xml
+xmlto man $RPM_SOURCE_DIR/htcacheclean.service.xml
 
 : Building with MMN %{mmn}, MMN-ISA %{mmnisa}
 : Default MPM is %{mpm}, vendor string is '%{vstring}'
@@ -497,7 +499,7 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.logrotate \
 
 # Install systemd service man pages
 install -m 644 -p httpd.service.8 httpd-init.service.8 httpd.socket.8 \
-        httpd@.service.8 \
+        httpd@.service.8 htcacheclean.service.8 \
         $RPM_BUILD_ROOT%{_mandir}/man8
 
 # fix man page paths
@@ -733,6 +735,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Oct 31 2018 Joe Orton <jorton@redhat.com> - 2.4.34-11
+- add htcacheclean.service(8) man page
+
 * Fri Sep 28 2018 Joe Orton <jorton@redhat.com> - 2.4.34-10
 - apachectl: don't read /etc/sysconfig/httpd
 

From e869b8b79917f05a480544aa297c36a45f0136bc Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 31 Oct 2018 10:08:18 +0000
Subject: [PATCH 139/359] update to 2.4.37

---
 httpd-2.4.34-layfix.patch    |  24 -
 httpd-2.4.34-r1555631.patch  |  14 -
 httpd-2.4.34-r1827912+.patch | 858 -----------------------------------
 httpd.spec                   |  13 +-
 sources                      |   2 +-
 5 files changed, 6 insertions(+), 905 deletions(-)
 delete mode 100644 httpd-2.4.34-layfix.patch
 delete mode 100644 httpd-2.4.34-r1555631.patch
 delete mode 100644 httpd-2.4.34-r1827912+.patch

diff --git a/httpd-2.4.34-layfix.patch b/httpd-2.4.34-layfix.patch
deleted file mode 100644
index 39728a1..0000000
--- a/httpd-2.4.34-layfix.patch
+++ /dev/null
@@ -1,24 +0,0 @@
---- httpd-2.4.34/config.layout.layfix
-+++ httpd-2.4.34/config.layout
-@@ -133,6 +133,7 @@
- # Layout used in Fedora httpd packaging.
- <Layout Fedora>
-     prefix:        /usr
-+    localstatedir: /var
-     exec_prefix:   ${prefix}
-     bindir:        ${prefix}/bin
-     sbindir:       ${prefix}/sbin
-@@ -144,11 +145,10 @@
-     installbuilddir: ${libdir}/httpd/build
-     errordir:      ${datadir}/error
-     iconsdir:      ${datadir}/icons
--    htdocsdir:     /var/www/html
-+    htdocsdir:     ${localstatedir}/www/html
-     manualdir:     ${datadir}/manual
--    cgidir:        /var/www/cgi-bin
-+    cgidir:        ${localstatedir}/www/cgi-bin
-     includedir:    ${prefix}/include/httpd
--    localstatedir: /var
-     runtimedir:    /run/httpd
-     logfiledir:    ${localstatedir}/log/httpd
-     proxycachedir: ${localstatedir}/cache/httpd/proxy
diff --git a/httpd-2.4.34-r1555631.patch b/httpd-2.4.34-r1555631.patch
deleted file mode 100644
index 7ca9478..0000000
--- a/httpd-2.4.34-r1555631.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-# ./pullrev.sh 1555631
-http://svn.apache.org/viewvc?view=revision&revision=1555631
-
---- httpd-2.4.34/modules/ssl/ssl_engine_ocsp.c
-+++ httpd-2.4.34/modules/ssl/ssl_engine_ocsp.c
-@@ -61,7 +61,7 @@
-     /* Use default responder URL if forced by configuration, else use
-      * certificate-specified responder, falling back to default if
-      * necessary and possible. */
--    if (sc->server->ocsp_force_default) {
-+    if (sc->server->ocsp_force_default == TRUE) {
-         s = sc->server->ocsp_responder;
-     }
-     else {
diff --git a/httpd-2.4.34-r1827912+.patch b/httpd-2.4.34-r1827912+.patch
deleted file mode 100644
index 98c7ac8..0000000
--- a/httpd-2.4.34-r1827912+.patch
+++ /dev/null
@@ -1,858 +0,0 @@
-
-Pull all changes from upstream integration branch:
-
-svn diff -r1840105:1841219 https://svn.apache.org/repos/asf/httpd/httpd/branches/tlsv1.3-for-2.4.x
-
---- httpd-2.4.34/modules/ssl/mod_ssl.c.r1827912+
-+++ httpd-2.4.34/modules/ssl/mod_ssl.c
-@@ -93,9 +93,9 @@
-     SSL_CMD_SRV(FIPS, FLAG,
-                 "Enable FIPS-140 mode "
-                 "(`on', `off')")
--    SSL_CMD_ALL(CipherSuite, TAKE1,
--                "Colon-delimited list of permitted SSL Ciphers "
--                "('XXX:...:XXX' - see manual)")
-+    SSL_CMD_ALL(CipherSuite, TAKE12,
-+                "Colon-delimited list of permitted SSL Ciphers, optional preceeded "
-+                "by protocol identifier ('XXX:...:XXX' - see manual)")
-     SSL_CMD_SRV(CertificateFile, TAKE1,
-                 "SSL Server Certificate file "
-                 "('/path/to/file' - PEM or DER encoded)")
-@@ -185,9 +185,9 @@
-     SSL_CMD_PXY(ProxyProtocol, RAW_ARGS,
-                "SSL Proxy: enable or disable SSL protocol flavors "
-                 "('[+-][" SSL_PROTOCOLS "] ...' - see manual)")
--    SSL_CMD_PXY(ProxyCipherSuite, TAKE1,
-+    SSL_CMD_PXY(ProxyCipherSuite, TAKE12,
-                "SSL Proxy: colon-delimited list of permitted SSL ciphers "
--               "('XXX:...:XXX' - see manual)")
-+               ", optionally preceeded by protocol specifier ('XXX:...:XXX' - see manual)")
-     SSL_CMD_PXY(ProxyVerify, TAKE1,
-                "SSL Proxy: whether to verify the remote certificate "
-                "('on' or 'off')")
-@@ -398,7 +398,7 @@
-     /* We must register the library in full, to ensure our configuration
-      * code can successfully test the SSL environment.
-      */
--#if MODSSL_USE_OPENSSL_PRE_1_1_API
-+#if MODSSL_USE_OPENSSL_PRE_1_1_API || defined(LIBRESSL_VERSION_NUMBER)
-     (void)CRYPTO_malloc_init();
- #else
-     OPENSSL_malloc_init();
---- httpd-2.4.34/modules/ssl/ssl_engine_config.c.r1827912+
-+++ httpd-2.4.34/modules/ssl/ssl_engine_config.c
-@@ -136,6 +136,7 @@
-     mctx->auth.cipher_suite   = NULL;
-     mctx->auth.verify_depth   = UNSET;
-     mctx->auth.verify_mode    = SSL_CVERIFY_UNSET;
-+    mctx->auth.tls13_ciphers = NULL;
- 
-     mctx->ocsp_mask           = UNSET;
-     mctx->ocsp_force_default  = UNSET;
-@@ -280,6 +281,7 @@
-     cfgMergeString(auth.cipher_suite);
-     cfgMergeInt(auth.verify_depth);
-     cfgMerge(auth.verify_mode, SSL_CVERIFY_UNSET);
-+    cfgMergeString(auth.tls13_ciphers);
- 
-     cfgMergeInt(ocsp_mask);
-     cfgMergeBool(ocsp_force_default);
-@@ -761,22 +763,37 @@
- 
- const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd,
-                                    void *dcfg,
--                                   const char *arg)
-+                                   const char *arg1, const char *arg2)
- {
-     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
-     SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
- 
--    /* always disable null and export ciphers */
--    arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
--
--    if (cmd->path) {
--        dc->szCipherSuite = arg;
-+    if (arg2 == NULL) {
-+        arg2 = arg1;
-+        arg1 = "SSL";
-     }
--    else {
--        sc->server->auth.cipher_suite = arg;
-+    
-+    if (!strcmp("SSL", arg1)) {
-+        /* always disable null and export ciphers */
-+        arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
-+        if (cmd->path) {
-+            dc->szCipherSuite = arg2;
-+        }
-+        else {
-+            sc->server->auth.cipher_suite = arg2;
-+        }
-+        return NULL;
-     }
--
--    return NULL;
-+#if SSL_HAVE_PROTOCOL_TLSV1_3
-+    else if (!strcmp("TLSv1.3", arg1)) {
-+        if (cmd->path) {
-+            return "TLSv1.3 ciphers cannot be set inside a directory context";
-+        }
-+        sc->server->auth.tls13_ciphers = arg2;
-+        return NULL;
-+    }
-+#endif
-+    return apr_pstrcat(cmd->pool, "procotol '", arg1, "' not supported", NULL);
- }
- 
- #define SSL_FLAGS_CHECK_FILE \
-@@ -1449,6 +1466,9 @@
-         else if (strcEQ(w, "TLSv1.2")) {
-             thisopt = SSL_PROTOCOL_TLSV1_2;
-         }
-+        else if (SSL_HAVE_PROTOCOL_TLSV1_3 && strcEQ(w, "TLSv1.3")) {
-+            thisopt = SSL_PROTOCOL_TLSV1_3;
-+        }
- #endif
-         else if (strcEQ(w, "all")) {
-             thisopt = SSL_PROTOCOL_ALL;
-@@ -1510,16 +1530,28 @@
- 
- const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *cmd,
-                                         void *dcfg,
--                                        const char *arg)
-+                                        const char *arg1, const char *arg2)
- {
-     SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
--
--    /* always disable null and export ciphers */
--    arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
--
--    dc->proxy->auth.cipher_suite = arg;
--
--    return NULL;
-+    
-+    if (arg2 == NULL) {
-+        arg2 = arg1;
-+        arg1 = "SSL";
-+    }
-+    
-+    if (!strcmp("SSL", arg1)) {
-+        /* always disable null and export ciphers */
-+        arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
-+        dc->proxy->auth.cipher_suite = arg2;
-+        return NULL;
-+    }
-+#if SSL_HAVE_PROTOCOL_TLSV1_3
-+    else if (!strcmp("TLSv1.3", arg1)) {
-+        dc->proxy->auth.tls13_ciphers = arg2;
-+        return NULL;
-+    }
-+#endif
-+    return apr_pstrcat(cmd->pool, "procotol '", arg1, "' not supported", NULL);
- }
- 
- const char *ssl_cmd_SSLProxyVerify(cmd_parms *cmd,
---- httpd-2.4.34/modules/ssl/ssl_engine_init.c.r1827912+
-+++ httpd-2.4.34/modules/ssl/ssl_engine_init.c
-@@ -568,6 +568,9 @@
- #ifdef HAVE_TLSV1_X
-                      (protocol & SSL_PROTOCOL_TLSV1_1 ? "TLSv1.1, " : ""),
-                      (protocol & SSL_PROTOCOL_TLSV1_2 ? "TLSv1.2, " : ""),
-+#if SSL_HAVE_PROTOCOL_TLSV1_3
-+                     (protocol & SSL_PROTOCOL_TLSV1_3 ? "TLSv1.3, " : ""),
-+#endif
- #endif
-                      NULL);
-     cp[strlen(cp)-2] = NUL;
-@@ -600,6 +603,13 @@
-             TLSv1_2_client_method() : /* proxy */
-             TLSv1_2_server_method();  /* server */
-     }
-+#if SSL_HAVE_PROTOCOL_TLSV1_3
-+    else if (protocol == SSL_PROTOCOL_TLSV1_3) {
-+        method = mctx->pkp ?
-+            TLSv1_3_client_method() : /* proxy */
-+            TLSv1_3_server_method();  /* server */
-+    }
-+#endif
- #endif
-     else { /* For multiple protocols, we need a flexible method */
-         method = mctx->pkp ?
-@@ -617,7 +627,8 @@
- 
-     SSL_CTX_set_options(ctx, SSL_OP_ALL);
- 
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L  || \
-+	(defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x20800000L)
-     /* always disable SSLv2, as per RFC 6176 */
-     SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
- 
-@@ -639,10 +650,19 @@
-     if (!(protocol & SSL_PROTOCOL_TLSV1_2)) {
-         SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_2);
-     }
-+#if SSL_HAVE_PROTOCOL_TLSV1_3
-+    ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_TLSv1_3,
-+                                protocol & SSL_PROTOCOL_TLSV1_3, "TLSv1.3");
-+#endif
- #endif
- 
- #else /* #if OPENSSL_VERSION_NUMBER < 0x10100000L */
-     /* We first determine the maximum protocol version we should provide */
-+#if SSL_HAVE_PROTOCOL_TLSV1_3
-+    if (SSL_HAVE_PROTOCOL_TLSV1_3 && (protocol & SSL_PROTOCOL_TLSV1_3)) {
-+        prot = TLS1_3_VERSION;
-+    } else  
-+#endif
-     if (protocol & SSL_PROTOCOL_TLSV1_2) {
-         prot = TLS1_2_VERSION;
-     } else if (protocol & SSL_PROTOCOL_TLSV1_1) {
-@@ -664,6 +684,11 @@
- 
-     /* Next we scan for the minimal protocol version we should provide,
-      * but we do not allow holes between max and min */
-+#if SSL_HAVE_PROTOCOL_TLSV1_3
-+    if (prot == TLS1_3_VERSION && protocol & SSL_PROTOCOL_TLSV1_2) {
-+        prot = TLS1_2_VERSION;
-+    }
-+#endif
-     if (prot == TLS1_2_VERSION && protocol & SSL_PROTOCOL_TLSV1_1) {
-         prot = TLS1_1_VERSION;
-     }
-@@ -736,6 +761,13 @@
-         SSL_CTX_set_mode(ctx, SSL_MODE_RELEASE_BUFFERS);
- #endif
- 
-+#if OPENSSL_VERSION_NUMBER >= 0x1010100fL
-+    /* For OpenSSL >=1.1.1, disable auto-retry mode so it's possible
-+     * to consume handshake records without blocking for app-data.
-+     * https://github.com/openssl/openssl/issues/7178 */
-+    SSL_CTX_clear_mode(ctx, SSL_MODE_AUTO_RETRY);
-+#endif
-+    
-     return APR_SUCCESS;
- }
- 
-@@ -888,7 +920,15 @@
-         ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
-         return ssl_die(s);
-     }
--
-+#if SSL_HAVE_PROTOCOL_TLSV1_3
-+    if (mctx->auth.tls13_ciphers 
-+        && !SSL_CTX_set_ciphersuites(ctx, mctx->auth.tls13_ciphers)) {
-+        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO()
-+                "Unable to configure permitted TLSv1.3 ciphers");
-+        ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
-+        return ssl_die(s);
-+    }
-+#endif
-     return APR_SUCCESS;
- }
- 
-@@ -1493,6 +1533,13 @@
-     X509_STORE_CTX *sctx;
-     X509_STORE *store = SSL_CTX_get_cert_store(mctx->ssl_ctx);
- 
-+#if OPENSSL_VERSION_NUMBER >= 0x1010100fL
-+    /* For OpenSSL >=1.1.1, turn on client cert support which is
-+     * otherwise turned off by default (by design).
-+     * https://github.com/openssl/openssl/issues/6933 */
-+    SSL_CTX_set_post_handshake_auth(mctx->ssl_ctx, 1);
-+#endif
-+    
-     SSL_CTX_set_client_cert_cb(mctx->ssl_ctx,
-                                ssl_callback_proxy_cert);
- 
---- httpd-2.4.34/modules/ssl/ssl_engine_kernel.c.r1827912+
-+++ httpd-2.4.34/modules/ssl/ssl_engine_kernel.c
-@@ -188,6 +188,12 @@
-             || strcmp(a1->cipher_suite, a2->cipher_suite))) {
-         return 0;
-     }
-+    /* both have the same ca cipher suite string */
-+    if ((a1->tls13_ciphers != a2->tls13_ciphers)
-+        && (!a1->tls13_ciphers || !a2->tls13_ciphers 
-+            || strcmp(a1->tls13_ciphers, a2->tls13_ciphers))) {
-+        return 0;
-+    }
-     return 1;
- }
- 
-@@ -424,87 +430,70 @@
-     }
- }
- 
--/*
-- *  Access Handler
-- */
--int ssl_hook_Access(request_rec *r)
-+static int ssl_check_post_client_verify(request_rec *r, SSLSrvConfigRec *sc, 
-+                                        SSLDirConfigRec *dc, SSLConnRec *sslconn,
-+                                        SSL *ssl)
- {
--    SSLDirConfigRec *dc         = myDirConfig(r);
--    SSLSrvConfigRec *sc         = mySrvConfig(r->server);
--    SSLConnRec *sslconn         = myConnConfig(r->connection);
--    SSL *ssl                    = sslconn ? sslconn->ssl : NULL;
--    server_rec *handshakeserver = sslconn ? sslconn->server : NULL;
--    SSLSrvConfigRec *hssc       = handshakeserver? mySrvConfig(handshakeserver) : NULL;
--    SSL_CTX *ctx = NULL;
--    apr_array_header_t *requires;
--    ssl_require_t *ssl_requires;
--    int ok, i;
--    BOOL renegotiate = FALSE, renegotiate_quick = FALSE;
-     X509 *cert;
--    X509 *peercert;
--    X509_STORE *cert_store = NULL;
--    X509_STORE_CTX *cert_store_ctx;
--    STACK_OF(SSL_CIPHER) *cipher_list_old = NULL, *cipher_list = NULL;
--    const SSL_CIPHER *cipher = NULL;
--    int depth, verify_old, verify, n, is_slave = 0;
--    const char *ncipher_suite;
--
--    /* On a slave connection, we do not expect to have an SSLConnRec, but
--     * our master connection might have one. */
--    if (!(sslconn && ssl) && r->connection->master) {
--        sslconn         = myConnConfig(r->connection->master);
--        ssl             = sslconn ? sslconn->ssl : NULL;
--        handshakeserver = sslconn ? sslconn->server : NULL;
--        hssc            = handshakeserver? mySrvConfig(handshakeserver) : NULL;
--        is_slave        = 1;
--    }
-     
--    if (ssl) {
--        /*
--         * We should have handshaken here (on handshakeserver),
--         * otherwise we are being redirected (ErrorDocument) from
--         * a renegotiation failure below. The access is still 
--         * forbidden in the latter case, let ap_die() handle
--         * this recursive (same) error.
--         */
--        if (!SSL_is_init_finished(ssl)) {
--            return HTTP_FORBIDDEN;
-+    /*
-+     * Remember the peer certificate's DN
-+     */
-+    if ((cert = SSL_get_peer_certificate(ssl))) {
-+        if (sslconn->client_cert) {
-+            X509_free(sslconn->client_cert);
-         }
--        ctx = SSL_get_SSL_CTX(ssl);
-+        sslconn->client_cert = cert;
-+        sslconn->client_dn = NULL;
-     }
--
-+    
-     /*
--     * Support for SSLRequireSSL directive
-+     * Finally check for acceptable renegotiation results
-      */
--    if (dc->bSSLRequired && !ssl) {
--        if ((sc->enabled == SSL_ENABLED_OPTIONAL) && !is_slave) {
--            /* This vhost was configured for optional SSL, just tell the
--             * client that we need to upgrade.
--             */
--            apr_table_setn(r->err_headers_out, "Upgrade", "TLS/1.0, HTTP/1.1");
--            apr_table_setn(r->err_headers_out, "Connection", "Upgrade");
-+    if ((dc->nVerifyClient != SSL_CVERIFY_NONE) ||
-+        (sc->server->auth.verify_mode != SSL_CVERIFY_NONE)) {
-+        BOOL do_verify = ((dc->nVerifyClient == SSL_CVERIFY_REQUIRE) ||
-+                          (sc->server->auth.verify_mode == SSL_CVERIFY_REQUIRE));
-+
-+        if (do_verify && (SSL_get_verify_result(ssl) != X509_V_OK)) {
-+            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02262)
-+                          "Re-negotiation handshake failed: "
-+                          "Client verification failed");
- 
--            return HTTP_UPGRADE_REQUIRED;
-+            return HTTP_FORBIDDEN;
-         }
- 
--        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02219)
--                      "access to %s failed, reason: %s",
--                      r->filename, "SSL connection required");
--
--        /* remember forbidden access for strict require option */
--        apr_table_setn(r->notes, "ssl-access-forbidden", "1");
-+        if (do_verify) {
-+            if (cert == NULL) {
-+                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02263)
-+                              "Re-negotiation handshake failed: "
-+                              "Client certificate missing");
- 
--        return HTTP_FORBIDDEN;
-+                return HTTP_FORBIDDEN;
-+            }
-+        }
-     }
-+    return OK;
-+}
- 
--    /*
--     * Check to see whether SSL is in use; if it's not, then no
--     * further access control checks are relevant.  (the test for
--     * sc->enabled is probably strictly unnecessary)
--     */
--    if (sc->enabled == SSL_ENABLED_FALSE || !ssl) {
--        return DECLINED;
--    }
-+/*
-+ *  Access Handler, classic flavour, for SSL/TLS up to v1.2 
-+ *  where everything can be renegotiated and no one is happy.
-+ */
-+static int ssl_hook_Access_classic(request_rec *r, SSLSrvConfigRec *sc, SSLDirConfigRec *dc,
-+                                   SSLConnRec *sslconn, SSL *ssl)
-+{
-+    server_rec *handshakeserver = sslconn ? sslconn->server : NULL;
-+    SSLSrvConfigRec *hssc       = handshakeserver? mySrvConfig(handshakeserver) : NULL;
-+    SSL_CTX *ctx = NULL;
-+    BOOL renegotiate = FALSE, renegotiate_quick = FALSE;
-+    X509 *peercert;
-+    X509_STORE *cert_store = NULL;
-+    X509_STORE_CTX *cert_store_ctx;
-+    STACK_OF(SSL_CIPHER) *cipher_list_old = NULL, *cipher_list = NULL;
-+    const SSL_CIPHER *cipher = NULL;
-+    int depth, verify_old, verify, n, rc;
-+    const char *ncipher_suite;
- 
- #ifdef HAVE_SRP
-     /*
-@@ -581,7 +570,7 @@
-         }
- 
-         /* configure new state */
--        if (is_slave) {
-+        if (r->connection->master) {
-             /* TODO: this categorically fails changed cipher suite settings
-              * on slave connections. We could do better by
-              * - create a new SSL* from our SSL_CTX and set cipher suite there,
-@@ -659,7 +648,7 @@
-         }
- 
-         if (renegotiate) {
--            if (is_slave) {
-+            if (r->connection->master) {
-                 /* The request causes renegotiation on a slave connection.
-                  * This is not allowed since we might have concurrent requests
-                  * on this connection.
-@@ -732,7 +721,7 @@
-                   (verify     & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)))
-             {
-                 renegotiate = TRUE;
--                if (is_slave) {
-+                if (r->connection->master) {
-                     /* The request causes renegotiation on a slave connection.
-                      * This is not allowed since we might have concurrent requests
-                      * on this connection.
-@@ -885,6 +874,7 @@
- 
-         if (renegotiate_quick) {
-             STACK_OF(X509) *cert_stack;
-+            X509 *cert;
- 
-             /* perform just a manual re-verification of the peer */
-             ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(02258)
-@@ -1037,43 +1027,10 @@
-         }
- 
-         /*
--         * Remember the peer certificate's DN
--         */
--        if ((cert = SSL_get_peer_certificate(ssl))) {
--            if (sslconn->client_cert) {
--                X509_free(sslconn->client_cert);
--            }
--            sslconn->client_cert = cert;
--            sslconn->client_dn = NULL;
--        }
--
--        /*
-          * Finally check for acceptable renegotiation results
-          */
--        if ((dc->nVerifyClient != SSL_CVERIFY_NONE) ||
--            (sc->server->auth.verify_mode != SSL_CVERIFY_NONE)) {
--            BOOL do_verify = ((dc->nVerifyClient == SSL_CVERIFY_REQUIRE) ||
--                              (sc->server->auth.verify_mode == SSL_CVERIFY_REQUIRE));
--
--            if (do_verify && (SSL_get_verify_result(ssl) != X509_V_OK)) {
--                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02262)
--                              "Re-negotiation handshake failed: "
--                              "Client verification failed");
--
--                return HTTP_FORBIDDEN;
--            }
--
--            if (do_verify) {
--                if ((peercert = SSL_get_peer_certificate(ssl)) == NULL) {
--                    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02263)
--                                  "Re-negotiation handshake failed: "
--                                  "Client certificate missing");
--
--                    return HTTP_FORBIDDEN;
--                }
--
--                X509_free(peercert);
--            }
-+        if (OK != (rc = ssl_check_post_client_verify(r, sc, dc, sslconn, ssl))) {
-+            return rc;
-         }
- 
-         /*
-@@ -1096,6 +1053,215 @@
-         }
-     }
- 
-+    return DECLINED;
-+}
-+
-+#if SSL_HAVE_PROTOCOL_TLSV1_3
-+/*
-+ *  Access Handler, modern flavour, for SSL/TLS v1.3 and onward. 
-+ *  Only client certificates can be requested, everything else stays.
-+ */
-+static int ssl_hook_Access_modern(request_rec *r, SSLSrvConfigRec *sc, SSLDirConfigRec *dc,
-+                                  SSLConnRec *sslconn, SSL *ssl)
-+{
-+    if ((dc->nVerifyClient != SSL_CVERIFY_UNSET) ||
-+        (sc->server->auth.verify_mode != SSL_CVERIFY_UNSET)) {
-+        int vmode_inplace, vmode_needed;
-+        int change_vmode = FALSE;
-+        int old_state, n, rc;
-+
-+        vmode_inplace = SSL_get_verify_mode(ssl);
-+        vmode_needed = SSL_VERIFY_NONE;
-+
-+        if ((dc->nVerifyClient == SSL_CVERIFY_REQUIRE) ||
-+            (sc->server->auth.verify_mode == SSL_CVERIFY_REQUIRE)) {
-+            vmode_needed |= SSL_VERIFY_PEER_STRICT;
-+        }
-+
-+        if ((dc->nVerifyClient == SSL_CVERIFY_OPTIONAL) ||
-+            (dc->nVerifyClient == SSL_CVERIFY_OPTIONAL_NO_CA) ||
-+            (sc->server->auth.verify_mode == SSL_CVERIFY_OPTIONAL) ||
-+            (sc->server->auth.verify_mode == SSL_CVERIFY_OPTIONAL_NO_CA))
-+        {
-+            vmode_needed |= SSL_VERIFY_PEER;
-+        }
-+
-+        if (vmode_needed == SSL_VERIFY_NONE) {
-+            return DECLINED;
-+        }
-+
-+        vmode_needed |= SSL_VERIFY_CLIENT_ONCE;
-+        if (vmode_inplace != vmode_needed) {
-+            /* Need to change, if new setting is more restrictive than existing one */
-+
-+            if ((vmode_inplace == SSL_VERIFY_NONE)
-+                || (!(vmode_inplace   & SSL_VERIFY_PEER) 
-+                    && (vmode_needed  & SSL_VERIFY_PEER))
-+                || (!(vmode_inplace   & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) 
-+                    && (vmode_needed & SSL_VERIFY_FAIL_IF_NO_PEER_CERT))) {
-+                /* need to change the effective verify mode */
-+                change_vmode = TRUE;
-+            }
-+            else {
-+                /* FIXME: does this work with TLSv1.3? Is this more than re-inspecting
-+                 * the certificate we should already have? */
-+                /*
-+                 * override of SSLVerifyDepth
-+                 *
-+                 * The depth checks are handled by us manually inside the
-+                 * verify callback function and not by OpenSSL internally
-+                 * (and our function is aware of both the per-server and
-+                 * per-directory contexts). So we cannot ask OpenSSL about
-+                 * the currently verify depth. Instead we remember it in our
-+                 * SSLConnRec attached to the SSL* of OpenSSL.  We've to force
-+                 * the renegotiation if the reconfigured/new verify depth is
-+                 * less than the currently active/remembered verify depth
-+                 * (because this means more restriction on the certificate
-+                 * chain).
-+                 */
-+                n = (sslconn->verify_depth != UNSET)? 
-+                    sslconn->verify_depth : sc->server->auth.verify_depth;
-+                /* determine the new depth */
-+                sslconn->verify_depth = (dc->nVerifyDepth != UNSET)
-+                                        ? dc->nVerifyDepth
-+                                        : sc->server->auth.verify_depth;
-+                if (sslconn->verify_depth < n) {
-+                    change_vmode = TRUE;
-+                    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO()
-+                                  "Reduced client verification depth will "
-+                                  "force renegotiation");
-+                }
-+            }
-+        }
-+
-+        if (change_vmode) {
-+            char peekbuf[1];
-+
-+            if (r->connection->master) {
-+                /* FIXME: modifying the SSL on a slave connection is no good.
-+                 * We would need to push this back to the master connection
-+                 * somehow.
-+                 */
-+                apr_table_setn(r->notes, "ssl-renegotiate-forbidden", "verify-client");
-+                return HTTP_FORBIDDEN;
-+            }
-+
-+            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO() "verify client post handshake");
-+
-+            SSL_set_verify(ssl, vmode_needed, ssl_callback_SSLVerify);
-+
-+            if (SSL_verify_client_post_handshake(ssl) != 1) {
-+                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10158)
-+                              "cannot perform post-handshake authentication");
-+                ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);
-+                apr_table_setn(r->notes, "error-notes",
-+                               "Reason: Cannot perform Post-Handshake Authentication.<br />");
-+                return HTTP_FORBIDDEN;
-+            }
-+            
-+            old_state = sslconn->reneg_state;
-+            sslconn->reneg_state = RENEG_ALLOW;
-+            modssl_set_app_data2(ssl, r);
-+
-+            SSL_do_handshake(ssl);
-+            /* Need to trigger renegotiation handshake by reading.
-+             * Peeking 0 bytes actually works.
-+             * See: http://marc.info/?t=145493359200002&r=1&w=2
-+             */
-+            SSL_peek(ssl, peekbuf, 0);
-+
-+            sslconn->reneg_state = old_state;
-+            modssl_set_app_data2(ssl, NULL);
-+
-+            /*
-+             * Finally check for acceptable renegotiation results
-+             */
-+            if (OK != (rc = ssl_check_post_client_verify(r, sc, dc, sslconn, ssl))) {
-+                return rc;
-+            }
-+        }
-+    }
-+
-+    return DECLINED;
-+}
-+#endif
-+
-+int ssl_hook_Access(request_rec *r)
-+{
-+    SSLDirConfigRec *dc         = myDirConfig(r);
-+    SSLSrvConfigRec *sc         = mySrvConfig(r->server);
-+    SSLConnRec *sslconn         = myConnConfig(r->connection);
-+    SSL *ssl                    = sslconn ? sslconn->ssl : NULL;
-+    apr_array_header_t *requires;
-+    ssl_require_t *ssl_requires;
-+    int ok, i, ret;
-+
-+    /* On a slave connection, we do not expect to have an SSLConnRec, but
-+     * our master connection might have one. */
-+    if (!(sslconn && ssl) && r->connection->master) {
-+        sslconn         = myConnConfig(r->connection->master);
-+        ssl             = sslconn ? sslconn->ssl : NULL;
-+    }
-+
-+    /*
-+     * We should have handshaken here, otherwise we are being 
-+     * redirected (ErrorDocument) from a renegotiation failure below. 
-+     * The access is still forbidden in the latter case, let ap_die() handle
-+     * this recursive (same) error.
-+     */
-+    if (ssl && !SSL_is_init_finished(ssl)) {
-+        return HTTP_FORBIDDEN;
-+    }
-+
-+    /*
-+     * Support for SSLRequireSSL directive
-+     */
-+    if (dc->bSSLRequired && !ssl) {
-+        if ((sc->enabled == SSL_ENABLED_OPTIONAL) && !r->connection->master) {
-+            /* This vhost was configured for optional SSL, just tell the
-+             * client that we need to upgrade.
-+             */
-+            apr_table_setn(r->err_headers_out, "Upgrade", "TLS/1.0, HTTP/1.1");
-+            apr_table_setn(r->err_headers_out, "Connection", "Upgrade");
-+
-+            return HTTP_UPGRADE_REQUIRED;
-+        }
-+
-+        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02219)
-+                      "access to %s failed, reason: %s",
-+                      r->filename, "SSL connection required");
-+
-+        /* remember forbidden access for strict require option */
-+        apr_table_setn(r->notes, "ssl-access-forbidden", "1");
-+
-+        return HTTP_FORBIDDEN;
-+    }
-+
-+    /*
-+     * Check to see whether SSL is in use; if it's not, then no
-+     * further access control checks are relevant.  (the test for
-+     * sc->enabled is probably strictly unnecessary)
-+     */
-+    if (sc->enabled == SSL_ENABLED_FALSE || !ssl) {
-+        return DECLINED;
-+    }
-+
-+#if SSL_HAVE_PROTOCOL_TLSV1_3
-+    /* TLSv1.3+ is less complicated here. Branch off into a new codeline
-+     * and avoid messing with the past. */
-+    if (SSL_version(ssl) >= TLS1_3_VERSION) {
-+        ret = ssl_hook_Access_modern(r, sc, dc, sslconn, ssl);
-+    }
-+    else
-+#endif
-+    {
-+        ret = ssl_hook_Access_classic(r, sc, dc, sslconn, ssl);
-+    }
-+
-+    if (ret != DECLINED) {
-+        return ret;
-+    }
-+
-     /* If we're trying to have the user name set from a client
-      * certificate then we need to set it here. This should be safe as
-      * the user name probably isn't important from an auth checking point
-@@ -2080,31 +2246,43 @@
- {
-     conn_rec *c;
-     server_rec *s;
--    SSLConnRec *scr;
- 
-     /* Retrieve the conn_rec and the associated SSLConnRec. */
-     if ((c = (conn_rec *)SSL_get_app_data((SSL *)ssl)) == NULL) {
-         return;
-     }
- 
--    if ((scr = myConnConfig(c)) == NULL) {
--        return;
--    }
-+    /* With TLS 1.3 this callback may be called multiple times on the first
-+     * negotiation, so the below logic to detect renegotiations can't work.
-+     * Fortunately renegotiations are forbidden starting with TLS 1.3, and
-+     * this is enforced by OpenSSL so there's nothing to be done here.
-+     */
-+#if SSL_HAVE_PROTOCOL_TLSV1_3
-+    if (SSL_version(ssl) < TLS1_3_VERSION)
-+#endif
-+    {
-+        SSLConnRec *sslconn;
-+
-+        if ((sslconn = myConnConfig(c)) == NULL) {
-+            return;
-+        }
- 
--    /* If the reneg state is to reject renegotiations, check the SSL
--     * state machine and move to ABORT if a Client Hello is being
--     * read. */
--    if (!scr->is_proxy &&
--        (where & SSL_CB_HANDSHAKE_START) &&
--        scr->reneg_state == RENEG_REJECT) {
--            scr->reneg_state = RENEG_ABORT;
-+        /* If the reneg state is to reject renegotiations, check the SSL
-+         * state machine and move to ABORT if a Client Hello is being
-+         * read. */
-+        if (!sslconn->is_proxy &&
-+                (where & SSL_CB_HANDSHAKE_START) &&
-+                sslconn->reneg_state == RENEG_REJECT) {
-+            sslconn->reneg_state = RENEG_ABORT;
-             ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02042)
-                           "rejecting client initiated renegotiation");
--    }
--    /* If the first handshake is complete, change state to reject any
--     * subsequent client-initiated renegotiation. */
--    else if ((where & SSL_CB_HANDSHAKE_DONE) && scr->reneg_state == RENEG_INIT) {
--        scr->reneg_state = RENEG_REJECT;
-+        }
-+        /* If the first handshake is complete, change state to reject any
-+         * subsequent client-initiated renegotiation. */
-+        else if ((where & SSL_CB_HANDSHAKE_DONE)
-+                 && sslconn->reneg_state == RENEG_INIT) {
-+            sslconn->reneg_state = RENEG_REJECT;
-+        }
-     }
- 
-     s = mySrvFromConn(c);
---- httpd-2.4.34/modules/ssl/ssl_private.h.r1827912+
-+++ httpd-2.4.34/modules/ssl/ssl_private.h
-@@ -132,13 +132,14 @@
-         SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL)
- #define SSL_CTX_set_max_proto_version(ctx, version) \
-         SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL)
--#endif
--/* LibreSSL declares OPENSSL_VERSION_NUMBER == 2.0 but does not include most
-- * changes from OpenSSL >= 1.1 (new functions, macros, deprecations, ...), so
-- * we have to work around this...
-+#elif LIBRESSL_VERSION_NUMBER < 0x2070000f
-+/* LibreSSL before 2.7 declares OPENSSL_VERSION_NUMBER == 2.0 but does not
-+ * include most changes from OpenSSL >= 1.1 (new functions, macros, 
-+ * deprecations, ...), so we have to work around this...
-  */
- #define MODSSL_USE_OPENSSL_PRE_1_1_API (1)
--#else
-+#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */
-+#else /* defined(LIBRESSL_VERSION_NUMBER) */
- #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L)
- #endif
- 
-@@ -238,7 +239,8 @@
- void free_bio_methods(void);
- #endif
- 
--#if OPENSSL_VERSION_NUMBER < 0x10002000L || defined(LIBRESSL_VERSION_NUMBER)
-+#if OPENSSL_VERSION_NUMBER < 0x10002000L || \
-+	(defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2070000f)
- #define X509_STORE_CTX_get0_store(x) (x->ctx)
- #endif
- 
-@@ -372,8 +374,17 @@
- #ifdef HAVE_TLSV1_X
- #define SSL_PROTOCOL_TLSV1_1 (1<<3)
- #define SSL_PROTOCOL_TLSV1_2 (1<<4)
-+#define SSL_PROTOCOL_TLSV1_3 (1<<5)
-+
-+#ifdef SSL_OP_NO_TLSv1_3
-+#define SSL_HAVE_PROTOCOL_TLSV1_3   (1)
-+#define SSL_PROTOCOL_ALL   (SSL_PROTOCOL_BASIC| \
-+                            SSL_PROTOCOL_TLSV1_1|SSL_PROTOCOL_TLSV1_2|SSL_PROTOCOL_TLSV1_3)
-+#else
-+#define SSL_HAVE_PROTOCOL_TLSV1_3   (0)
- #define SSL_PROTOCOL_ALL   (SSL_PROTOCOL_BASIC| \
-                             SSL_PROTOCOL_TLSV1_1|SSL_PROTOCOL_TLSV1_2)
-+#endif
- #else
- #define SSL_PROTOCOL_ALL   (SSL_PROTOCOL_BASIC)
- #endif
-@@ -646,6 +657,11 @@
-     /** for client or downstream server authentication */
-     int          verify_depth;
-     ssl_verify_t verify_mode;
-+
-+    /** TLSv1.3 has its separate cipher list, separate from the
-+     settings for older TLS protocol versions. Since which one takes
-+     effect is a matter of negotiation, we need separate settings */
-+    const char  *tls13_ciphers;
- } modssl_auth_ctx_t;
- 
- #ifdef HAVE_TLS_SESSION_TICKETS
-@@ -801,7 +817,7 @@
- const char  *ssl_cmd_SSLCryptoDevice(cmd_parms *, void *, const char *);
- const char  *ssl_cmd_SSLRandomSeed(cmd_parms *, void *, const char *, const char *, const char *);
- const char  *ssl_cmd_SSLEngine(cmd_parms *, void *, const char *);
--const char  *ssl_cmd_SSLCipherSuite(cmd_parms *, void *, const char *);
-+const char  *ssl_cmd_SSLCipherSuite(cmd_parms *, void *, const char *, const char *);
- const char  *ssl_cmd_SSLCertificateFile(cmd_parms *, void *, const char *);
- const char  *ssl_cmd_SSLCertificateKeyFile(cmd_parms *, void *, const char *);
- const char  *ssl_cmd_SSLCertificateChainFile(cmd_parms *, void *, const char *);
-@@ -830,7 +846,7 @@
- 
- const char  *ssl_cmd_SSLProxyEngine(cmd_parms *cmd, void *dcfg, int flag);
- const char  *ssl_cmd_SSLProxyProtocol(cmd_parms *, void *, const char *);
--const char  *ssl_cmd_SSLProxyCipherSuite(cmd_parms *, void *, const char *);
-+const char  *ssl_cmd_SSLProxyCipherSuite(cmd_parms *, void *, const char *, const char *);
- const char  *ssl_cmd_SSLProxyVerify(cmd_parms *, void *, const char *);
- const char  *ssl_cmd_SSLProxyVerifyDepth(cmd_parms *, void *, const char *);
- const char  *ssl_cmd_SSLProxyCACertificatePath(cmd_parms *, void *, const char *);
diff --git a/httpd.spec b/httpd.spec
index 85d661c..156716f 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.34
-Release: 11%{?dist}
+Version: 2.4.37
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -59,7 +59,6 @@ Source44: httpd@.service
 Patch1: httpd-2.4.1-apctl.patch
 Patch2: httpd-2.4.9-apxs.patch
 Patch3: httpd-2.4.1-deplibs.patch
-Patch4: httpd-2.4.34-layfix.patch
 Patch6: httpd-2.4.34-apctlsystemd.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
@@ -75,14 +74,12 @@ Patch30: httpd-2.4.4-cachehardmax.patch
 Patch31: httpd-2.4.33-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
 Patch36: httpd-2.4.33-r1830819+.patch
-Patch37: httpd-2.4.34-r1827912+.patch
 Patch38: httpd-2.4.34-sslciphdefault.patch
 Patch39: httpd-2.4.34-sslprotdefault.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.34-r1738878.patch
-Patch59: httpd-2.4.34-r1555631.patch
 Patch60: httpd-2.4.34-enable-sslv3.patch
 
 # Security fixes
@@ -223,7 +220,6 @@ interface for storing and accessing per-user session data.
 %patch1 -p1 -b .apctl
 %patch2 -p1 -b .apxs
 %patch3 -p1 -b .deplibs
-%patch4 -p1 -b .layfix
 %patch6 -p1 -b .apctlsystemd
 
 %patch19 -p1 -b .detectsystemd
@@ -239,12 +235,10 @@ interface for storing and accessing per-user session data.
 #patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch36 -p1 -b .r1830819+
-%patch37 -p1 -b .r1827912+
 %patch38 -p1 -b .sslciphdefault
 %patch39 -p1 -b .sslprotdefault
 
 %patch58 -p1 -b .r1738878
-%patch59 -p1 -b .r1555631
 %patch60 -p1 -b .enable-sslv3
 
 # Patch in the vendor string
@@ -735,6 +729,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Oct 31 2018 Joe Orton <jorton@redhat.com> - 2.4.37-1
+- update to 2.4.37
+
 * Wed Oct 31 2018 Joe Orton <jorton@redhat.com> - 2.4.34-11
 - add htcacheclean.service(8) man page
 
diff --git a/sources b/sources
index 1840642..ca284fa 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.34.tar.bz2) = 2bc09213f08a4722e305929fbac5f5060c7a8444704494894bb9b61f17e4d20bb6e3d663bb93fc5b2030b04a43fb12373d260cc291422b210b299725aaf3b5c8
+SHA512 (httpd-2.4.37.tar.bz2) = e802915801bbe885a65dada04b0116d145b293fabfff734dddb61a79ca1c6d65326f51155d1b864b093c3ec00d0bdfdf1401ab55677bae1ea3da1d199d7bcad4

From 920857b24c5741e97e50809b3d176eb5c543f25d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 31 Oct 2018 12:19:33 +0000
Subject: [PATCH 140/359] add DefaultStateDir/ap_state_dir_relative()
 mod_dav_fs: use state dir for default DAVLockDB mod_md: use state dir for
 default MDStoreDir

---
 httpd-2.4.33-mddefault.patch |  21 ---
 httpd-2.4.37-r1842929+.patch | 317 +++++++++++++++++++++++++++++++++++
 httpd.spec                   |  11 +-
 3 files changed, 325 insertions(+), 24 deletions(-)
 delete mode 100644 httpd-2.4.33-mddefault.patch
 create mode 100644 httpd-2.4.37-r1842929+.patch

diff --git a/httpd-2.4.33-mddefault.patch b/httpd-2.4.33-mddefault.patch
deleted file mode 100644
index 9e82fb8..0000000
--- a/httpd-2.4.33-mddefault.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-
-Override default.
-
---- httpd-2.4.33/modules/md/mod_md_config.c.mddefault
-+++ httpd-2.4.33/modules/md/mod_md_config.c
-@@ -54,10 +54,14 @@
- 
- #define DEF_VAL     (-1)
- 
-+#ifndef MD_DEFAULT_STORE_DIR
-+#define MD_DEFAULT_STORE_DIR "state/md"
-+#endif
-+
- /* Default settings for the global conf */
- static md_mod_conf_t defmc = {
-     NULL,
--    "md",
-+    MD_DEFAULT_STORE_DIR,
-     NULL,
-     NULL,
-     80,
diff --git a/httpd-2.4.37-r1842929+.patch b/httpd-2.4.37-r1842929+.patch
new file mode 100644
index 0000000..c6aa1f7
--- /dev/null
+++ b/httpd-2.4.37-r1842929+.patch
@@ -0,0 +1,317 @@
+# ./pullrev.sh 1842929 1842931
+http://svn.apache.org/viewvc?view=revision&revision=1842929
+http://svn.apache.org/viewvc?view=revision&revision=1842931
+
+--- httpd-2.4.37/acinclude.m4.r1842929+
++++ httpd-2.4.37/acinclude.m4
+@@ -45,6 +45,7 @@
+   APACHE_SUBST(installbuilddir)
+   APACHE_SUBST(runtimedir)
+   APACHE_SUBST(proxycachedir)
++  APACHE_SUBST(statedir)
+   APACHE_SUBST(other_targets)
+   APACHE_SUBST(progname)
+   APACHE_SUBST(prefix)
+@@ -663,6 +664,7 @@
+   APACHE_SUBST_EXPANDED_ARG(runtimedir)
+   APACHE_SUBST_EXPANDED_ARG(logfiledir)
+   APACHE_SUBST_EXPANDED_ARG(proxycachedir)
++  APACHE_SUBST_EXPANDED_ARG(statedir)
+ ])
+ 
+ dnl 
+--- httpd-2.4.37/config.layout.r1842929+
++++ httpd-2.4.37/config.layout
+@@ -29,6 +29,7 @@
+     includedir:    ${prefix}/include
+     localstatedir: ${prefix}
+     runtimedir:    ${localstatedir}/logs
++    statedir:      ${localstatedir}/state
+     logfiledir:    ${localstatedir}/logs
+     proxycachedir: ${localstatedir}/proxy
+ </Layout>
+@@ -54,6 +55,7 @@
+     includedir:    ${prefix}/include+
+     localstatedir: ${prefix}/var+
+     runtimedir:    ${localstatedir}/run
++    statedir:      ${localstatedir}/state
+     logfiledir:    ${localstatedir}/log
+     proxycachedir: ${localstatedir}/proxy
+ </Layout>
+@@ -78,6 +80,7 @@
+     includedir:    /System/Library/Frameworks/Apache.framework/Versions/2.0/Headers
+     localstatedir: /var
+     runtimedir:    ${prefix}/Logs
++    statedir:      ${prefix}/State
+     logfiledir:    ${prefix}/Logs
+     proxycachedir: ${prefix}/ProxyCache
+ </Layout>
+@@ -102,6 +105,7 @@
+     includedir:    ${prefix}/include+
+     localstatedir: /var
+     runtimedir:    ${localstatedir}/run
++    statedir:      ${localstatedir}/state
+     logfiledir:    ${localstatedir}/log+
+     proxycachedir: ${runtimedir}/proxy
+ </Layout>
+@@ -126,6 +130,7 @@
+     includedir:    ${prefix}/include/apache
+     localstatedir: /var
+     runtimedir:    ${localstatedir}/run
++    statedir:      ${localstatedir}/lib/httpd
+     logfiledir:    ${localstatedir}/log/httpd
+     proxycachedir: ${localstatedir}/cache/httpd
+ </Layout>     
+@@ -151,6 +156,7 @@
+     includedir:    ${prefix}/include/httpd
+     runtimedir:    /run/httpd
+     logfiledir:    ${localstatedir}/log/httpd
++    statedir:      ${localstatedir}/lib/httpd
+     proxycachedir: ${localstatedir}/cache/httpd/proxy
+ </Layout>     
+ 
+@@ -175,6 +181,7 @@
+     localstatedir: /var${prefix}
+     runtimedir:    ${localstatedir}/run
+     logfiledir:    ${localstatedir}/logs
++    statedir:      ${localstatedir}/state
+     proxycachedir: ${localstatedir}/proxy
+ </Layout>
+ 
+@@ -197,6 +204,7 @@
+     cgidir:        ${datadir}/cgi-bin
+     includedir:    ${prefix}/include/apache
+     localstatedir: /var/lib/httpd
++    statedir:      ${localstatedir}
+     runtimedir:    /var/run
+     logfiledir:    /var/log/httpd
+     proxycachedir: /var/cache/httpd
+@@ -223,6 +231,7 @@
+     localstatedir: /var
+     runtimedir:    ${localstatedir}/run
+     logfiledir:    ${localstatedir}/log/httpd
++    statedir:      ${prefix}/state
+     proxycachedir: ${localstatedir}/proxy
+ </Layout>
+ 
+@@ -246,6 +255,7 @@
+     includedir:    ${exec_prefix}/include
+     localstatedir: ${prefix}
+     runtimedir:    /var/run
++    statedir:      ${datadir}/state
+     logfiledir:    ${datadir}/logs
+     proxycachedir: ${datadir}/proxy
+ </Layout>
+@@ -271,6 +281,7 @@
+     localstatedir: ${prefix}
+     runtimedir:    ${prefix}/logs
+     logfiledir:    ${prefix}/logs
++    statedir:      ${prefix}/state
+     proxycachedir: ${prefix}/proxy
+ </Layout>
+ 
+@@ -315,6 +326,7 @@
+     cgidir:        ${prefix}/usr/lib/cgi-bin
+     includedir:    ${exec_prefix}/include/apache2
+     localstatedir: ${prefix}/var/lock/apache2
++    statedir:      ${prefix}/var/lib/apache2
+     runtimedir:    ${prefix}/var/run/apache2
+     logfiledir:    ${prefix}/var/log/apache2
+     proxycachedir: ${prefix}/var/cache/apache2/proxy
+@@ -343,6 +355,7 @@
+     manualdir:     ${datadir}/manual
+     cgidir:        ${datadir}/cgi-bin
+     runtimedir:    ${localstatedir}/run
++    runtimedir:    ${localstatedir}/lib/httpd
+     logfiledir:    ${localstatedir}/log/httpd
+     proxycachedir: ${localstatedir}/cache/httpd/cache-root
+ </Layout>
+@@ -366,6 +379,7 @@
+     manualdir:     ${prefix}/manual
+     includedir:    ${prefix}/include
+     localstatedir: /var/httpd
++    statedir:      ${localstatedir}/state
+     runtimedir:    ${localstatedir}/run
+     logfiledir:    ${localstatedir}/logs
+     proxycachedir: ${localstatedir}/proxy
+@@ -391,6 +405,7 @@
+     includedir:      ${prefix}/include/httpd
+     localstatedir:   /var
+     runtimedir:      ${localstatedir}/run/httpd
++    statedir:        ${localstatedir}/lib/httpd
+     logfiledir:      ${localstatedir}/log/httpd
+     proxycachedir:   ${localstatedir}/cache/httpd
+ </Layout>
+--- httpd-2.4.37/configure.in.r1842929+
++++ httpd-2.4.37/configure.in
+@@ -41,7 +41,7 @@
+ AC_PREFIX_DEFAULT(/usr/local/apache2)
+ 
+ dnl Get the layout here, so we can pass the required variables to apr
+-APR_ENABLE_LAYOUT(Apache, [errordir iconsdir htdocsdir cgidir])
++APR_ENABLE_LAYOUT(Apache, [errordir iconsdir htdocsdir cgidir statedir])
+ 
+ dnl reparse the configure arguments.
+ APR_PARSE_ARGUMENTS
+--- httpd-2.4.37/include/ap_config_layout.h.in.r1842929+
++++ httpd-2.4.37/include/ap_config_layout.h.in
+@@ -60,5 +60,7 @@
+ #define DEFAULT_REL_LOGFILEDIR "@rel_logfiledir@"
+ #define DEFAULT_EXP_PROXYCACHEDIR "@exp_proxycachedir@"
+ #define DEFAULT_REL_PROXYCACHEDIR "@rel_proxycachedir@"
++#define DEFAULT_EXP_STATEDIR "@exp_statedir@"
++#define DEFAULT_REL_STATEDIR "@rel_statedir@"
+ 
+ #endif /* AP_CONFIG_LAYOUT_H */
+--- httpd-2.4.37/include/http_config.h.r1842929+
++++ httpd-2.4.37/include/http_config.h
+@@ -757,6 +757,14 @@
+  */
+ AP_DECLARE(char *) ap_runtime_dir_relative(apr_pool_t *p, const char *fname);
+ 
++/**
++ * Compute the name of a persistent state file (e.g. a database or
++ * long-lived cache) relative to the appropriate state directory.
++ * Absolute paths are returned as-is.  The state directory is
++ * configured via the DefaultStateDir directive or at build time.
++ */
++AP_DECLARE(char *) ap_state_dir_relative(apr_pool_t *p, const char *fname);
++
+ /* Finally, the hook for dynamically loading modules in... */
+ 
+ /**
+--- httpd-2.4.37/Makefile.in.r1842929+
++++ httpd-2.4.37/Makefile.in
+@@ -213,6 +213,7 @@
+ install-other:
+ 	@test -d $(DESTDIR)$(logfiledir) || $(MKINSTALLDIRS) $(DESTDIR)$(logfiledir)
+ 	@test -d $(DESTDIR)$(runtimedir) || $(MKINSTALLDIRS) $(DESTDIR)$(runtimedir)
++	@test -d $(DESTDIR)$(statedir) || $(MKINSTALLDIRS) $(DESTDIR)$(statedir)
+ 	@for ext in dll x; do \
+ 		file=apachecore.$$ext; \
+ 		if test -f $$file; then \
+--- httpd-2.4.37/modules/dav/fs/mod_dav_fs.c.r1842929+
++++ httpd-2.4.37/modules/dav/fs/mod_dav_fs.c
+@@ -29,6 +29,10 @@
+ 
+ extern module AP_MODULE_DECLARE_DATA dav_fs_module;
+ 
++#ifndef DEFAULT_DAV_LOCKDB
++#define DEFAULT_DAV_LOCKDB "davlockdb"
++#endif
++
+ const char *dav_get_lockdb_path(const request_rec *r)
+ {
+     dav_fs_server_conf *conf;
+@@ -39,7 +43,11 @@
+ 
+ static void *dav_fs_create_server_config(apr_pool_t *p, server_rec *s)
+ {
+-    return apr_pcalloc(p, sizeof(dav_fs_server_conf));
++    dav_fs_server_conf *conf = apr_pcalloc(p, sizeof(dav_fs_server_conf));
++
++    conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB);
++
++    return conf;
+ }
+ 
+ static void *dav_fs_merge_server_config(apr_pool_t *p,
+--- httpd-2.4.37/modules/md/mod_md_config.c.r1842929+
++++ httpd-2.4.37/modules/md/mod_md_config.c
+@@ -54,10 +54,14 @@
+ 
+ #define DEF_VAL     (-1)
+ 
++#ifndef MD_DEFAULT_BASE_DIR
++#define MD_DEFAULT_BASE_DIR "state/md"
++#endif
++
+ /* Default settings for the global conf */
+ static md_mod_conf_t defmc = {
+     NULL,
+-    "md",
++    NULL,
+     NULL,
+     NULL,
+     80,
+@@ -112,6 +116,7 @@
+         memcpy(mod_md_config, &defmc, sizeof(*mod_md_config));
+         mod_md_config->mds = apr_array_make(pool, 5, sizeof(const md_t *));
+         mod_md_config->unused_names = apr_array_make(pool, 5, sizeof(const md_t *));
++        mod_md_config->base_dir = ap_state_dir_relative(pool, MD_DEFAULT_BASE_DIR);
+         
+         apr_pool_cleanup_register(pool, NULL, cleanup_mod_config, apr_pool_cleanup_null);
+     }
+--- httpd-2.4.37/server/core.c.r1842929+
++++ httpd-2.4.37/server/core.c
+@@ -129,6 +129,8 @@
+ AP_DECLARE_DATA int ap_run_mode = AP_SQ_RM_UNKNOWN;
+ AP_DECLARE_DATA int ap_config_generation = 0;
+ 
++static const char *core_state_dir;
++
+ static void *create_core_dir_config(apr_pool_t *a, char *dir)
+ {
+     core_dir_config *conf;
+@@ -3104,6 +3106,24 @@
+     return NULL;
+ }
+ 
++static const char *set_state_dir(cmd_parms *cmd, void *dummy, const char *arg)
++{
++    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
++
++    if (err != NULL) {
++        return err;
++    }
++
++    if ((apr_filepath_merge((char**)&core_state_dir, NULL,
++                            ap_server_root_relative(cmd->temp_pool, arg),
++                            APR_FILEPATH_TRUENAME, cmd->pool) != APR_SUCCESS)
++        || !ap_is_directory(cmd->temp_pool, core_state_dir)) {
++        return "DefaultStateDir must be a valid directory, absolute or relative to ServerRoot";
++    }
++
++    return NULL;
++}
++
+ static const char *set_timeout(cmd_parms *cmd, void *dummy, const char *arg)
+ {
+     const char *err = ap_check_cmd_context(cmd, NOT_IN_DIR_CONTEXT);
+@@ -4398,6 +4418,8 @@
+   "Common directory of server-related files (logs, confs, etc.)"),
+ AP_INIT_TAKE1("DefaultRuntimeDir", set_runtime_dir, NULL, RSRC_CONF | EXEC_ON_READ,
+   "Common directory for run-time files (shared memory, locks, etc.)"),
++AP_INIT_TAKE1("DefaultStateDir", set_state_dir, NULL, RSRC_CONF | EXEC_ON_READ,
++  "Common directory for persistent state (databases, long-lived caches, etc.)"),
+ AP_INIT_TAKE1("ErrorLog", set_server_string_slot,
+   (void *)APR_OFFSETOF(server_rec, error_fname), RSRC_CONF,
+   "The filename of the error log"),
+@@ -5150,6 +5172,27 @@
+     }
+ }
+ 
++AP_DECLARE(char *) ap_state_dir_relative(apr_pool_t *p, const char *file)
++{
++    char *newpath = NULL;
++    apr_status_t rv;
++    const char *state_dir;
++
++    state_dir = core_state_dir
++        ? core_state_dir
++        : ap_server_root_relative(p, DEFAULT_REL_STATEDIR);
++
++    rv = apr_filepath_merge(&newpath, state_dir, file, APR_FILEPATH_TRUENAME, p);
++    if (newpath && (rv == APR_SUCCESS || APR_STATUS_IS_EPATHWILD(rv)
++                                      || APR_STATUS_IS_ENOENT(rv)
++                                      || APR_STATUS_IS_ENOTDIR(rv))) {
++        return newpath;
++    }
++    else {
++        return NULL;
++    }
++}
++
+ static apr_random_t *rng = NULL;
+ #if APR_HAS_THREADS
+ static apr_thread_mutex_t *rng_mutex = NULL;
diff --git a/httpd.spec b/httpd.spec
index 156716f..e40e04d 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.37
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -63,7 +63,7 @@ Patch6: httpd-2.4.34-apctlsystemd.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
-Patch21: httpd-2.4.33-mddefault.patch
+Patch21: httpd-2.4.37-r1842929+.patch
 Patch23: httpd-2.4.33-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
@@ -224,7 +224,7 @@ interface for storing and accessing per-user session data.
 
 %patch19 -p1 -b .detectsystemd
 
-%patch21 -p1 -b .mddefault
+%patch21 -p1 -b .r1842929+
 %patch23 -p1 -b .export
 %patch24 -p1 -b .corelimit
 %patch25 -p1 -b .selinux
@@ -729,6 +729,11 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Oct 31 2018 Joe Orton <jorton@redhat.com> - 2.4.37-2
+- add DefaultStateDir/ap_state_dir_relative()
+- mod_dav_fs: use state dir for default DAVLockDB
+- mod_md: use state dir for default MDStoreDir
+
 * Wed Oct 31 2018 Joe Orton <jorton@redhat.com> - 2.4.37-1
 - update to 2.4.37
 

From 25b89a94797bf63979497969ba7cc961359bf5c5 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 2 Nov 2018 11:07:11 +0000
Subject: [PATCH 141/359] Fix grammar.

---
 htcacheclean.service.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htcacheclean.service.xml b/htcacheclean.service.xml
index d771ae7..01b68e4 100644
--- a/htcacheclean.service.xml
+++ b/htcacheclean.service.xml
@@ -50,7 +50,7 @@
     <para>This manual page describes the <command>systemd</command>
     unit file for the <command>htcacheclean</command> daemon.  This
     unit file provides a service which runs
-    <command>htcacheclean</command> is run in daemon mode,
+    <command>htcacheclean</command> in daemon mode,
     periodically cleaning the disk cache root to ensure disk space
     usage is within configured limits.</para>
 

From 2fa14eded508bce407d4c70ce1a1b983f5cfc55d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 7 Nov 2018 12:38:50 +0100
Subject: [PATCH 142/359] Resolves: #1647241 - fix apachectl script

---
 httpd-2.4.34-apctlsystemd.patch | 2 +-
 httpd.spec                      | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/httpd-2.4.34-apctlsystemd.patch b/httpd-2.4.34-apctlsystemd.patch
index 996978c..20d7101 100644
--- a/httpd-2.4.34-apctlsystemd.patch
+++ b/httpd-2.4.34-apctlsystemd.patch
@@ -26,7 +26,7 @@ Upstream-Status: vendor specific patch
 +if [ "x$2" != "x" ] ; then
 +    echo Passing arguments to httpd using apachectl is no longer supported.
 +    echo You can only start/stop/restart httpd using this script.
-+    echo To pass extra arguments to httpd, see the httpd.service(8)
++    echo "To pass extra arguments to httpd, see the httpd.service(8)"
 +    echo man page.
 +fi
 +
diff --git a/httpd.spec b/httpd.spec
index e40e04d..f242ddb 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.37
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -729,6 +729,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Nov 07 2018 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-3
+- Resolves: #1647241 - fix apachectl script
+
 * Wed Oct 31 2018 Joe Orton <jorton@redhat.com> - 2.4.37-2
 - add DefaultStateDir/ap_state_dir_relative()
 - mod_dav_fs: use state dir for default DAVLockDB

From 36d7a682414a54ad9b7c6a1a0b1dba29a52304df Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 8 Nov 2018 17:13:42 +0000
Subject: [PATCH 143/359] add httpd.conf(5) (#1611361) Resolves: rhbz#1611361

---
 .gitignore        |   1 +
 README.confd      |   4 +-
 README.confmod    |   3 +-
 httpd.conf        |   3 +
 httpd.conf.xml    | 260 ++++++++++++++++++++++++++++++++++++++++++++++
 httpd.service.xml |  16 +--
 httpd.spec        |  22 +++-
 7 files changed, 290 insertions(+), 19 deletions(-)
 create mode 100644 httpd.conf.xml

diff --git a/.gitignore b/.gitignore
index 00acede..bdeafe7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -32,3 +32,4 @@ x86_64
 /httpd*.8
 /results_httpd
 /htcacheclean.service.8
+/httpd.conf.5
diff --git a/README.confd b/README.confd
index f5e9661..6071deb 100644
--- a/README.confd
+++ b/README.confd
@@ -5,5 +5,5 @@ processed as httpd configuration files.  The directory is used in
 addition to the directory /etc/httpd/conf.modules.d/, which contains
 configuration files necessary to load modules.
 
-Files are processed in alphabetical order.
-
+Files are processed in sorted order.  See httpd.conf(5) for more
+information.
diff --git a/README.confmod b/README.confmod
index d33d1d4..f4b055d 100644
--- a/README.confmod
+++ b/README.confmod
@@ -6,4 +6,5 @@ configuration fragments necessary only to load modules.
 Administrators should use the directory "/etc/httpd/conf.d" to modify
 the configuration of httpd, or any modules.
 
-Files are processed in alphanumeric order.
+Files are processed in sorted order and should have a two digit
+numeric prefix.  See httpd.conf(5) for more information.
diff --git a/httpd.conf b/httpd.conf
index a7af0dc..6ab68cb 100644
--- a/httpd.conf
+++ b/httpd.conf
@@ -6,6 +6,9 @@
 # <URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
 # for a discussion of each configuration directive.
 #
+# See the httpd.conf(5) man page for more information on this configuration,
+# and httpd.service(8) on using and configuring the httpd service.
+#
 # Do NOT simply read the instructions in here without understanding
 # what they do.  They're here only as hints or reminders.  If you are unsure
 # consult the online docs. You have been warned.  
diff --git a/httpd.conf.xml b/httpd.conf.xml
new file mode 100644
index 0000000..fdf02b7
--- /dev/null
+++ b/httpd.conf.xml
@@ -0,0 +1,260 @@
+<?xml version='1.0' encoding='utf-8'?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
+
+]>
+<!--
+ Copyright 2018 Red Hat, Inc.
+
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<refentry>
+  <refentryinfo>
+    <title>httpd.conf</title>
+    <productname>httpd</productname>
+    <author><contrib>Author</contrib><surname>Orton</surname><firstname>Joe</firstname><email>jorton@redhat.com</email></author>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>httpd.conf</refentrytitle>
+    <manvolnum>5</manvolnum>
+  </refmeta>
+  
+  <refnamediv>
+    <refname>httpd.conf</refname>
+    <refpurpose>Configuration files for httpd</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <para>
+      <filename>/etc/httpd/conf/httpd.conf</filename>, 
+      <filename>/etc/httpd/conf.modules.d</filename>,
+      <filename>/etc/httpd/conf.d</filename>
+    </para>
+  </refsynopsisdiv>
+  
+  <refsect1>
+    <title>Description</title>
+
+    <para>The <command>httpd</command> daemon uses a main
+    configuration file at
+    <filename>/etc/httpd/conf/httpd.conf</filename>.  The syntax of
+    this file is described at <ulink
+    url="https://httpd.apache.org/docs/2.4/configuring.html"/>, and
+    the full set of available directives at <ulink
+    url="https://httpd.apache.org/docs/2.4/mod/directives.html"/>.
+    </para>
+
+    <refsect2>
+      <title>Configuration structure</title>
+
+      <para>The main configuration file
+      (<filename>httpd.conf</filename>) sets up various defaults and
+      includes configuration files from two directories -
+      <filename>/etc/httpd/conf.modules.d</filename> and
+      <filename>/etc/httpd/conf.d</filename>.  Packages containing
+      loadable modules (like <option>mod_ssl.so</option>) place files
+      in the <filename>conf.modules.d</filename> directory with the
+      appropriate <option>LoadModule</option> directive so that module
+      is loaded by default.</para>
+
+      <para>Some notable configured defaults are:.</para>
+
+      <variablelist>
+        <varlistentry>
+          <term><option>DocumentRoot @DOCROOT@/html</option></term>
+          <listitem><para>The default document root from which content
+          is served.</para></listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><option>Listen 80</option></term>
+          <listitem><para>The daemon lists on TCP port 80.</para></listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><option>ErrorLog "logs/error_log"</option></term>
+          <listitem><para>Error messages are logged to
+          <filename>@LOGDIR@/error_log</filename>.</para></listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><option>ScriptAlias /cgi-bin/ "@DOCROOT@/cgi-bin/"</option></term>
+          <listitem><para>CGI scripts are served via the URL-path <option>/cgi-bin/</option>.</para></listitem>
+        </varlistentry>
+        
+      </variablelist>
+
+      <para>To remove any of the default configuration provided in
+      separate files covered below, replace that file with an empty
+      file rather than removing it from the filesystem, otherwise it
+      may be restored to the original when the package which provides
+      it is upgraded.</para>
+      
+    </refsect2>
+
+    <refsect2>
+      <title>MPM configuration</title>
+
+      <para>The configuration file at
+      <filename>/etc/httpd/conf.modules.d/00-mpm.conf</filename> is
+      used to select the multi-processing module (MPM), which governs
+      how <command>httpd</command> divides work between processes
+      and/or threads at run-time.  Exactly one
+      <option>LoadModule</option> directive must be uncommented in
+      this file; by default the <option>@MPM@</option> MPM is enabled.
+      For more information on MPMs, see <ulink
+      url="https://httpd.apache.org/docs/2.4/mpm.html"/>.</para>
+
+      <para>If using the <emphasis>prefork</emphasis> MPM, the
+      "httpd_graceful_shutdown" SELinux boolean should also be
+      enabled, since with this MPM, httpd needs to establish TCP
+      connections to local ports to successfully complete a graceful
+      restart or shutdown. This boolean can be enabled by running the
+      command: <command>semanage boolean -m --on
+      httpd_graceful_shutdown</command></para>
+    </refsect2>
+    
+    <refsect2>
+      <title>Module configuration files</title>
+      
+      <para>Module configuration files are provided in the
+      <filename>/etc/httpd/conf.modules.d/</filename> directory, with
+      names which are by convention prefixed with two digit numeric
+      prefix to ensure they are processed in the desired order.  Core
+      modules provide with the <command>httpd</command> package are
+      loaded by files with a <option>0x-</option> prefix to ensure
+      these are loaded first.  Only filenames with a
+      <option>.conf</option> suffix in this directory will be
+      processed.</para>
+
+      <para>Other provided configuration files are listed below.
+      
+      <variablelist>
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.modules.d/00-base.conf</filename></term>
+          <listitem><para>The set of core modules included with
+          <command>httpd</command> which are all loaded by
+          default.</para></listitem>
+        </varlistentry>
+        
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.modules.d/00-optional.conf</filename></term>
+          <listitem><para>The set of non-core modules included with
+          <command>httpd</command> which are <emphasis>not</emphasis>
+          loaded by default.</para></listitem>
+        </varlistentry>
+        
+
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.modules.d/00-systemd.conf</filename></term>
+          <listitem><para>This file loads <option>mod_systemd</option>
+          which is necessary for the correct operation of the
+          <command>httpd.service</command> service, and should not be
+          removed or disabled.</para></listitem>
+        </varlistentry>
+      </variablelist>
+      </para>
+    </refsect2>
+        
+    <refsect2>
+      <title>Other configuration files</title>
+
+      <para>Default module configuration files and site-specific
+      configuration files are loaded from the
+      <filename>/etc/httpd/conf.d/</filename> directory.  Only files
+      with a <option>.conf</option> suffix will be loaded.  The
+      following files are provided:
+
+      <variablelist>
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.d/userdir.conf</filename></term>
+          <listitem><para>This file gives an example configuration for
+          <option>mod_userdir</option> to map URLs such as
+          <option>http://localhost/~jim/</option> to
+          <filename>/home/jim/public_html/</filename>. Userdir mapping
+          is disabled by default.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.d/autoindex.conf</filename></term>
+          <listitem><para>This file provides the default configuration
+          for <option>mod_autoindex</option> which generates HTML
+          directory listings when enabled.  It also makes file icon
+          image files available at the <option>/icons/</option>
+          URL-path.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.d/welcome.conf</filename></term>
+          <listitem><para>This file enables a "welcome page" at
+          <option>http://localhost/</option> if no content is present
+          in the default documentation root
+          <filename>/var/www/html</filename>.</para></listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><filename>/etc/httpd/conf.d/ssl.conf</filename> (present only if <option>mod_ssl</option> is installed)</term>
+          <listitem><para>This file configures a TLS
+          <option>VirtualHost</option> listening on port
+          <option>443</option>.  If the default configuration is used,
+          the referenced test certificate and private key are
+          generated the first time <command>httpd.service</command> is
+          started; see
+          <citerefentry><refentrytitle>httpd-init.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+          for more information.</para></listitem>
+        </varlistentry>
+        
+      </variablelist></para>
+    </refsect2>
+    
+    <refsect2>
+      <title>Instantiated services</title>
+
+      <para>As an alternative to (or in addition to) the
+      <command>httpd.service</command> unit, the instatiated template
+      service <command>httpd@.service</command> unit file can be used,
+      which starts <command>httpd</command> using a different
+      configuration file to the default. For example,
+      <command>systemctl start httpd@foobar.service</command> will
+      start httpd using the configuration file
+      <filename>/etc/httpd/conf/foobar.conf</filename>.  See <citerefentry><refentrytitle>httpd@.service</refentrytitle><manvolnum>8</manvolnum></citerefentry> for more information.</para>
+    </refsect2>
+      
+  </refsect1>
+  <refsect1>
+    <title>Files</title>
+
+    <para>
+      <filename>/etc/httpd/conf/httpd.conf</filename>, 
+      <filename>/etc/httpd/conf.d</filename>, 
+      <filename>/etc/httpd/conf.modules.d</filename>
+    </para>
+  </refsect1>
+  
+  <refsect1>
+    <title>See also</title>
+
+    <para>
+    <citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>, 
+    <citerefentry><refentrytitle>httpd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <ulink url="https://httpd.apache.org/docs/2.4/configuring.html"/>,
+    <ulink url="https://httpd.apache.org/docs/2.4/mod/directives.html"/>
+    </para>
+  </refsect1>
+
+</refentry>
+
+<!-- LocalWords:  systemd PidFile
+-->
diff --git a/httpd.service.xml b/httpd.service.xml
index 4a6038d..b2c72dd 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -188,17 +188,10 @@ Wants=network-online.target</programlisting>
 
       <para>httpd offers a choice of multi-processing modules (MPMs),
       which can be configured in
-      <filename>/etc/httpd/conf.modules.d/00-mpm.conf</filename>.  The
-      default is to use the <emphasis>@MPM@</emphasis> MPM.</para>
-
-      <para>If using the <emphasis>prefork</emphasis> MPM, the
-      "httpd_graceful_shutdown" SELinux boolean should also be
-      enabled, since with this MPM, httpd needs to establish TCP
-      connections to local ports to successfully complete a graceful
-      restart or shutdown. This boolean can be enabled by running the
-      command: <command>semanage boolean -m --on
-      httpd_graceful_shutdown</command></para>
-
+      <filename>/etc/httpd/conf.modules.d/00-mpm.conf</filename>.
+      See
+      <citerefentry><refentrytitle>httpd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      for more information on changing the MPM.</para>
     </refsect2>
 
     <refsect2>
@@ -322,6 +315,7 @@ ReloadPropagatedFrom=httpd.service</programlisting>
 
     <para>
     <citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>, 
+    <citerefentry><refentrytitle>httpd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
     <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, 
     <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>, 
     <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
diff --git a/httpd.spec b/httpd.spec
index f242ddb..5f68c0b 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.37
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -266,11 +266,16 @@ if test "x${vmmn}" != "x%{mmn}"; then
    exit 1
 fi
 
-sed 's/@MPM@/%{mpm}/' < $RPM_SOURCE_DIR/httpd.service.xml \
-    > httpd.service.xml
+sed '
+s,@MPM@,%{mpm},g
+s,@DOCROOT@,%{docroot},g
+s,@LOGDIR@,%{_localstatedir}/log/httpd,g
+' < $RPM_SOURCE_DIR/httpd.conf.xml \
+    > httpd.conf.xml
 
-xmlto man ./httpd.service.xml
+xmlto man ./httpd.conf.xml
 xmlto man $RPM_SOURCE_DIR/htcacheclean.service.xml
+xmlto man $RPM_SOURCE_DIR/httpd.service.xml
 
 : Building with MMN %{mmn}, MMN-ISA %{mmnisa}
 : Default MPM is %{mpm}, vendor string is '%{vstring}'
@@ -491,10 +496,13 @@ mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d
 install -m 644 -p $RPM_SOURCE_DIR/httpd.logrotate \
 	$RPM_BUILD_ROOT/etc/logrotate.d/httpd
 
-# Install systemd service man pages
+# Install man pages
+install -d $RPM_BUILD_ROOT%{_mandir}/man8 $RPM_BUILD_ROOT%{_mandir}/man5
 install -m 644 -p httpd.service.8 httpd-init.service.8 httpd.socket.8 \
         httpd@.service.8 htcacheclean.service.8 \
         $RPM_BUILD_ROOT%{_mandir}/man8
+install -m 644 -p httpd.conf.5 \
+        $RPM_BUILD_ROOT%{_mandir}/man5
 
 # fix man page paths
 sed -e "s|/usr/local/apache2/conf/httpd.conf|/etc/httpd/conf/httpd.conf|" \
@@ -660,6 +668,7 @@ exit $rv
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd/proxy
 
 %{_mandir}/man8/*
+%{_mandir}/man5/*
 %exclude %{_mandir}/man8/httpd-init.*
 
 %{_unitdir}/httpd.service
@@ -729,6 +738,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Nov  8 2018 Joe Orton <jorton@redhat.com> - 2.4.37-4
+- add httpd.conf(5) (#1611361)
+
 * Wed Nov 07 2018 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-3
 - Resolves: #1647241 - fix apachectl script
 

From f7bb212f408bbcd0ffd3c6b0fb1ae7975c41d772 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 9 Nov 2018 09:01:23 +0000
Subject: [PATCH 144/359] add httpd.conf(5) (#1611361) Resolves: rhbz#1611361

---
 00-mpm.conf | 2 +-
 httpd.spec  | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/00-mpm.conf b/00-mpm.conf
index b15f913..a4a70b8 100644
--- a/00-mpm.conf
+++ b/00-mpm.conf
@@ -1,5 +1,5 @@
 # Select the MPM module which should be used by uncommenting exactly
-# one of the following LoadModule lines.  See the httpd.service(8) man
+# one of the following LoadModule lines.  See the httpd.conf(5) man
 # page for more information on changing the MPM.
 
 # prefork MPM: Implements a non-threaded, pre-forking web server
diff --git a/httpd.spec b/httpd.spec
index 5f68c0b..715a9e8 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -50,6 +50,7 @@ Source30: README.confd
 Source31: README.confmod
 Source32: httpd.service.xml
 Source33: htcacheclean.service.xml
+Source34: httpd.conf.xml
 Source40: htcacheclean.service
 Source41: htcacheclean.sysconf
 Source42: httpd-init.service

From affd30da6fb6cf7a15bdcadca606a84a42eeecc1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 23 Nov 2018 11:11:59 +0100
Subject: [PATCH 145/359] Resolves: #1652678 - TLS connection allowed while all
 protocols are forbidden

---
 httpd-2.4.34-sslprotdefault.patch | 53 -----------------
 httpd-2.4.37-sslprotdefault.patch | 98 +++++++++++++++++++++++++++++++
 httpd.spec                        |  7 ++-
 3 files changed, 103 insertions(+), 55 deletions(-)
 delete mode 100644 httpd-2.4.34-sslprotdefault.patch
 create mode 100644 httpd-2.4.37-sslprotdefault.patch

diff --git a/httpd-2.4.34-sslprotdefault.patch b/httpd-2.4.34-sslprotdefault.patch
deleted file mode 100644
index 65f8d40..0000000
--- a/httpd-2.4.34-sslprotdefault.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1618371 
-
---- httpd-2.4.34/modules/ssl/ssl_engine_config.c.sslprotdefault
-+++ httpd-2.4.34/modules/ssl/ssl_engine_config.c
-@@ -119,7 +119,7 @@
-     mctx->ticket_key          = NULL;
- #endif
- 
--    mctx->protocol            = SSL_PROTOCOL_DEFAULT;
-+    mctx->protocol            = SSL_PROTOCOL_NONE;
-     mctx->protocol_set        = 0;
- 
-     mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET;
---- httpd-2.4.34/modules/ssl/ssl_engine_init.c.sslprotdefault
-+++ httpd-2.4.34/modules/ssl/ssl_engine_init.c
-@@ -555,9 +555,8 @@
-      *  Create the new per-server SSL context
-      */
-     if (protocol == SSL_PROTOCOL_NONE) {
--        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231)
--                "No SSL protocols available [hint: SSLProtocol]");
--        return ssl_die(s);
-+        ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, 
-+                     "Using OpenSSL/system default SSL/TLS protocols");
-     }
- 
-     cp = apr_pstrcat(p,
-@@ -673,14 +672,8 @@
-     } else if (protocol & SSL_PROTOCOL_SSLV3) {
-         prot = SSL3_VERSION;
- #endif
--    } else {
--        SSL_CTX_free(ctx);
--        mctx->ssl_ctx = NULL;
--        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378)
--                "No SSL protocols available [hint: SSLProtocol]");
--        return ssl_die(s);
-     }
--    SSL_CTX_set_max_proto_version(ctx, prot);
-+    if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_max_proto_version(ctx, prot);
- 
-     /* Next we scan for the minimal protocol version we should provide,
-      * but we do not allow holes between max and min */
-@@ -700,7 +693,7 @@
-         prot = SSL3_VERSION;
-     }
- #endif
--    SSL_CTX_set_min_proto_version(ctx, prot);
-+    if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_min_proto_version(ctx, prot);
- #endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L */
- 
- #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
diff --git a/httpd-2.4.37-sslprotdefault.patch b/httpd-2.4.37-sslprotdefault.patch
new file mode 100644
index 0000000..546fa1f
--- /dev/null
+++ b/httpd-2.4.37-sslprotdefault.patch
@@ -0,0 +1,98 @@
+diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
+index 55c237e..5467d23 100644
+--- a/modules/ssl/ssl_engine_config.c
++++ b/modules/ssl/ssl_engine_config.c
+@@ -119,7 +119,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
+     mctx->ticket_key          = NULL;
+ #endif
+ 
+-    mctx->protocol            = SSL_PROTOCOL_DEFAULT;
++    mctx->protocol            = SSL_PROTOCOL_NONE;
+     mctx->protocol_set        = 0;
+ 
+     mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET;
+@@ -262,6 +262,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
+ {
+     if (add->protocol_set) {
+         mrg->protocol = add->protocol;
++        mrg->protocol_set = 1;
+     }
+     else {
+         mrg->protocol = base->protocol;
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index e3f62fe..31fc0e6 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -568,6 +568,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+     MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL;
+     char *cp;
+     int protocol = mctx->protocol;
++    int protocol_set = mctx->protocol_set;
+     SSLSrvConfigRec *sc = mySrvConfig(s);
+ #if OPENSSL_VERSION_NUMBER >= 0x10100000L
+     int prot;
+@@ -577,12 +578,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+      *  Create the new per-server SSL context
+      */
+     if (protocol == SSL_PROTOCOL_NONE) {
+-        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231)
+-                "No SSL protocols available [hint: SSLProtocol]");
+-        return ssl_die(s);
+-    }
++        if (protocol_set) {
++            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231)
++                    "No SSL protocols available [hint: SSLProtocol]");
++            return ssl_die(s);
++        }
+ 
+-    cp = apr_pstrcat(p,
++        ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, 
++                     "Using OpenSSL/system default SSL/TLS protocols");
++        cp = "default";
++    }
++    else {
++        cp = apr_pstrcat(p,
+ #ifndef OPENSSL_NO_SSL3
+                      (protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""),
+ #endif
+@@ -595,7 +602,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+ #endif
+ #endif
+                      NULL);
+-    cp[strlen(cp)-2] = NUL;
++        cp[strlen(cp)-2] = NUL;
++    }
+ 
+     ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s,
+                  "Creating new SSL context (protocols: %s)", cp);
+@@ -696,13 +704,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+         prot = SSL3_VERSION;
+ #endif
+     } else {
+-        SSL_CTX_free(ctx);
+-        mctx->ssl_ctx = NULL;
+-        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378)
+-                "No SSL protocols available [hint: SSLProtocol]");
+-        return ssl_die(s);
++        if (protocol_set) {
++            SSL_CTX_free(ctx);
++            mctx->ssl_ctx = NULL;
++            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378)
++                    "No SSL protocols available [hint: SSLProtocol]");
++            return ssl_die(s);
++        }
+     }
+-    SSL_CTX_set_max_proto_version(ctx, prot);
++    if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_max_proto_version(ctx, prot);
+ 
+     /* Next we scan for the minimal protocol version we should provide,
+      * but we do not allow holes between max and min */
+@@ -726,7 +736,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+         prot = SSL3_VERSION;
+     }
+ #endif
+-    SSL_CTX_set_min_proto_version(ctx, prot);
++    if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_min_proto_version(ctx, prot);
+ #endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L */
+ 
+ #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
diff --git a/httpd.spec b/httpd.spec
index 715a9e8..8014895 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.37
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -76,7 +76,7 @@ Patch31: httpd-2.4.33-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
 Patch36: httpd-2.4.33-r1830819+.patch
 Patch38: httpd-2.4.34-sslciphdefault.patch
-Patch39: httpd-2.4.34-sslprotdefault.patch
+Patch39: httpd-2.4.37-sslprotdefault.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -739,6 +739,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Nov 22 2018 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-5
+- Resolves: #1652678 - TLS connection allowed while all protocols are forbidden
+
 * Thu Nov  8 2018 Joe Orton <jorton@redhat.com> - 2.4.37-4
 - add httpd.conf(5) (#1611361)
 

From 85e5fe0b3f371d4964757099fe0f6d62f8ddf390 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 9 Nov 2018 11:46:40 +0000
Subject: [PATCH 146/359] Fix spelling.

---
 httpd.conf.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd.conf.xml b/httpd.conf.xml
index fdf02b7..0a7bdc1 100644
--- a/httpd.conf.xml
+++ b/httpd.conf.xml
@@ -223,7 +223,7 @@
       <title>Instantiated services</title>
 
       <para>As an alternative to (or in addition to) the
-      <command>httpd.service</command> unit, the instatiated template
+      <command>httpd.service</command> unit, the instantiated template
       service <command>httpd@.service</command> unit file can be used,
       which starts <command>httpd</command> using a different
       configuration file to the default. For example,

From 8fe3905176a114f7a663edbfc991dc513e82a876 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 29 Nov 2018 16:48:09 +0000
Subject: [PATCH 147/359] Wording tweaks.

---
 httpd.conf.xml | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/httpd.conf.xml b/httpd.conf.xml
index 0a7bdc1..705e527 100644
--- a/httpd.conf.xml
+++ b/httpd.conf.xml
@@ -50,12 +50,11 @@
   <refsect1>
     <title>Description</title>
 
-    <para>The <command>httpd</command> daemon uses a main
-    configuration file at
+    <para>The main configuration file for the <command>httpd</command> daemon is
     <filename>/etc/httpd/conf/httpd.conf</filename>.  The syntax of
     this file is described at <ulink
     url="https://httpd.apache.org/docs/2.4/configuring.html"/>, and
-    the full set of available directives at <ulink
+    the full set of available directives is listed at <ulink
     url="https://httpd.apache.org/docs/2.4/mod/directives.html"/>.
     </para>
 
@@ -130,8 +129,8 @@
       <title>Module configuration files</title>
       
       <para>Module configuration files are provided in the
-      <filename>/etc/httpd/conf.modules.d/</filename> directory, with
-      names which are by convention prefixed with two digit numeric
+      <filename>/etc/httpd/conf.modules.d/</filename> directory.  Filenames
+      in this directory are by convention prefixed with two digit numeric
       prefix to ensure they are processed in the desired order.  Core
       modules provide with the <command>httpd</command> package are
       loaded by files with a <option>0x-</option> prefix to ensure

From e7d5e11589c1bc5d6b9d439d20c1bfe477256428 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 19 Dec 2018 16:01:30 +0000
Subject: [PATCH 148/359] Fix typos.

---
 httpd.conf.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/httpd.conf.xml b/httpd.conf.xml
index 705e527..3a02111 100644
--- a/httpd.conf.xml
+++ b/httpd.conf.xml
@@ -71,7 +71,7 @@
       appropriate <option>LoadModule</option> directive so that module
       is loaded by default.</para>
 
-      <para>Some notable configured defaults are:.</para>
+      <para>Some notable configured defaults are:</para>
 
       <variablelist>
         <varlistentry>
@@ -81,7 +81,7 @@
         </varlistentry>
         <varlistentry>
           <term><option>Listen 80</option></term>
-          <listitem><para>The daemon lists on TCP port 80.</para></listitem>
+          <listitem><para>The daemon listens on TCP port 80.</para></listitem>
         </varlistentry>
         <varlistentry>
           <term><option>ErrorLog "logs/error_log"</option></term>

From ccaa54fd8d3aad780b8ee1588e2b77220a47a3d9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= <besser82@fedoraproject.org>
Date: Mon, 14 Jan 2019 19:04:04 +0100
Subject: [PATCH 149/359] Rebuilt for libcrypt.so.2 (#1666033)

---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 8014895..8e3bf09 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.37
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -739,6 +739,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Jan 14 2019 Björn Esser <besser82@fedoraproject.org> - 2.4.37-6
+- Rebuilt for libcrypt.so.2 (#1666033)
+
 * Thu Nov 22 2018 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-5
 - Resolves: #1652678 - TLS connection allowed while all protocols are forbidden
 

From 1810bd511f23f55b129cb3b2ecda3b293bb08f63 Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Wed, 23 Jan 2019 11:21:32 +0000
Subject: [PATCH 150/359] new version 2.4.38 (#1668125) adjusted patches

---
 ...819+.patch => httpd-2.4.38-r1830819+.patch | 98 +++++++++----------
 httpd.spec                                    | 11 ++-
 sources                                       |  2 +-
 3 files changed, 52 insertions(+), 59 deletions(-)
 rename httpd-2.4.33-r1830819+.patch => httpd-2.4.38-r1830819+.patch (89%)

diff --git a/httpd-2.4.33-r1830819+.patch b/httpd-2.4.38-r1830819+.patch
similarity index 89%
rename from httpd-2.4.33-r1830819+.patch
rename to httpd-2.4.38-r1830819+.patch
index 0b2d90d..01027ce 100644
--- a/httpd-2.4.33-r1830819+.patch
+++ b/httpd-2.4.38-r1830819+.patch
@@ -9,9 +9,11 @@ http://svn.apache.org/viewvc?view=revision&revision=1831173
 http://svn.apache.org/viewvc?view=revision&revision=1835240
 http://svn.apache.org/viewvc?view=revision&revision=1835242
 
---- httpd-2.4.33/modules/ssl/ssl_engine_config.c.r1830819+
-+++ httpd-2.4.33/modules/ssl/ssl_engine_config.c
-@@ -891,7 +891,9 @@
+diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
+index d276fea..5467d23 100644
+--- a/modules/ssl/ssl_engine_config.c
++++ b/modules/ssl/ssl_engine_config.c
+@@ -919,7 +919,9 @@ const char *ssl_cmd_SSLCertificateFile(cmd_parms *cmd,
      SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
      const char *err;
  
@@ -22,7 +24,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
          return err;
      }
  
-@@ -907,7 +909,9 @@
+@@ -935,7 +937,9 @@ const char *ssl_cmd_SSLCertificateKeyFile(cmd_parms *cmd,
      SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
      const char *err;
  
@@ -33,9 +35,11 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
          return err;
      }
  
---- httpd-2.4.33/modules/ssl/ssl_engine_init.c.r1830819+
-+++ httpd-2.4.33/modules/ssl/ssl_engine_init.c
-@@ -1181,12 +1182,18 @@
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index 8ba3486..e1b0844 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -1264,12 +1264,18 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
                  (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i,
                                            const char *));
           i++) {
@@ -55,7 +59,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
              if ((SSL_CTX_use_certificate_file(mctx->ssl_ctx, certfile,
                                                SSL_FILETYPE_PEM) < 1)) {
                  ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02561)
-@@ -1215,12 +1222,46 @@
+@@ -1298,12 +1304,46 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
  
          ERR_clear_error();
  
@@ -107,7 +111,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
              const unsigned char *ptr;
  
              ERR_clear_error();
-@@ -1307,8 +1348,9 @@
+@@ -1390,8 +1430,9 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
      /*
       * Try to read DH parameters from the (first) SSLCertificateFile
       */
@@ -119,7 +123,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
          SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);
          ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
                       "Custom DH parameters (%d bits) for %s loaded from %s",
-@@ -1320,10 +1362,10 @@
+@@ -1403,10 +1444,10 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
      /*
       * Similarly, try to read the ECDH curve name from SSLCertificateFile...
       */
@@ -134,42 +138,20 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
          SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey);
          ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541)
                       "ECDH curve %s for %s specified in %s",
---- httpd-2.4.33/modules/ssl/ssl_engine_pphrase.c.r1830819+
-+++ httpd-2.4.33/modules/ssl/ssl_engine_pphrase.c
-@@ -143,9 +143,6 @@
+diff --git a/modules/ssl/ssl_engine_pphrase.c b/modules/ssl/ssl_engine_pphrase.c
+index 8c29443..d5d33f7 100644
+--- a/modules/ssl/ssl_engine_pphrase.c
++++ b/modules/ssl/ssl_engine_pphrase.c
+@@ -143,8 +143,6 @@ apr_status_t ssl_load_encrypted_pkey(server_rec *s, apr_pool_t *p, int idx,
      const char *key_id = asn1_table_vhost_key(mc, p, sc->vhost_id, idx);
      EVP_PKEY *pPrivateKey = NULL;
      ssl_asn1_t *asn1;
 -    unsigned char *ucp;
 -    long int length;
--    BOOL bReadable;
      int nPassPhrase = (*pphrases)->nelts;
      int nPassPhraseRetry = 0;
      apr_time_t pkey_mtime = 0;
-@@ -222,16 +219,12 @@
-          * is not empty. */
-         ERR_clear_error();
- 
--        bReadable = ((pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file,
--                     NULL, ssl_pphrase_Handle_CB, &ppcb_arg)) != NULL ?
--                     TRUE : FALSE);
--
--        /*
--         * when the private key file now was readable,
--         * it's fine and we go out of the loop
--         */
--        if (bReadable)
--           break;
-+        pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file,
-+                                             ssl_pphrase_Handle_CB, &ppcb_arg);
-+        /* If the private key was successfully read, nothing more to
-+           do here. */
-+        if (pPrivateKey != NULL)
-+            break;
- 
-         /*
-          * when we have more remembered pass phrases
-@@ -356,19 +349,12 @@
+@@ -351,19 +349,12 @@ apr_status_t ssl_load_encrypted_pkey(server_rec *s, apr_pool_t *p, int idx,
          nPassPhrase++;
      }
  
@@ -192,7 +174,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
          asn1->source_mtime = pkey_mtime;
      }
  
-@@ -619,3 +605,288 @@
+@@ -614,3 +605,288 @@ int ssl_pphrase_Handle_CB(char *buf, int bufsize, int verify, void *srv)
       */
      return (len);
  }
@@ -481,9 +463,11 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
 +    return APR_SUCCESS;
 +}
 +#endif
---- httpd-2.4.33/modules/ssl/ssl_private.h.r1830819+
-+++ httpd-2.4.33/modules/ssl/ssl_private.h
-@@ -976,21 +976,28 @@
+diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h
+index f46814d..1fdde13 100644
+--- a/modules/ssl/ssl_private.h
++++ b/modules/ssl/ssl_private.h
+@@ -1002,21 +1002,28 @@ BOOL         ssl_util_vhost_matches(const char *servername, server_rec *s);
  apr_status_t ssl_load_encrypted_pkey(server_rec *, apr_pool_t *, int,
                                       const char *, apr_array_header_t **);
  
@@ -521,7 +505,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
  
  /**  Mutex Support  */
  int          ssl_mutex_init(server_rec *, apr_pool_t *);
-@@ -1078,6 +1085,10 @@
+@@ -1109,6 +1116,10 @@ int modssl_request_is_tls(const request_rec *r, SSLConnRec **sslconn);
  int ssl_is_challenge(conn_rec *c, const char *servername, 
                       X509 **pcert, EVP_PKEY **pkey);
  
@@ -532,9 +516,11 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
  #endif /* SSL_PRIVATE_H */
  /** @} */
  
---- httpd-2.4.33/modules/ssl/ssl_util.c.r1830819+
-+++ httpd-2.4.33/modules/ssl/ssl_util.c
-@@ -181,45 +181,37 @@
+diff --git a/modules/ssl/ssl_util.c b/modules/ssl/ssl_util.c
+index 0d23465..223b385 100644
+--- a/modules/ssl/ssl_util.c
++++ b/modules/ssl/ssl_util.c
+@@ -192,45 +192,37 @@ BOOL ssl_util_path_check(ssl_pathcheck_t pcm, const char *path, apr_pool_t *p)
      return TRUE;
  }
  
@@ -596,7 +582,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
  }
  
  ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table,
-@@ -469,3 +461,13 @@
+@@ -480,3 +472,13 @@ void ssl_util_thread_id_setup(apr_pool_t *p)
  }
  
  #endif /* #if APR_HAS_THREADS && MODSSL_USE_OPENSSL_PRE_1_1_API */
@@ -610,9 +596,11 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
 +    return 0;
 +#endif
 +}
---- httpd-2.4.33/modules/ssl/ssl_util_ssl.c.r1830819+
-+++ httpd-2.4.33/modules/ssl/ssl_util_ssl.c
-@@ -74,7 +74,7 @@
+diff --git a/modules/ssl/ssl_util_ssl.c b/modules/ssl/ssl_util_ssl.c
+index b7f0eca..4fa089b 100644
+--- a/modules/ssl/ssl_util_ssl.c
++++ b/modules/ssl/ssl_util_ssl.c
+@@ -74,7 +74,7 @@ void modssl_set_app_data2(SSL *ssl, void *arg)
  **  _________________________________________________________________
  */
  
@@ -621,7 +609,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
  {
      EVP_PKEY *rc;
      BIO *bioS;
-@@ -83,7 +83,7 @@
+@@ -83,7 +83,7 @@ EVP_PKEY *modssl_read_privatekey(const char* filename, EVP_PKEY **key, pem_passw
      /* 1. try PEM (= DER+Base64+headers) */
      if ((bioS=BIO_new_file(filename, "r")) == NULL)
          return NULL;
@@ -630,7 +618,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
      BIO_free(bioS);
  
      if (rc == NULL) {
-@@ -107,41 +107,9 @@
+@@ -107,41 +107,9 @@ EVP_PKEY *modssl_read_privatekey(const char* filename, EVP_PKEY **key, pem_passw
              BIO_free(bioS);
          }
      }
@@ -672,8 +660,10 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
  /*  _________________________________________________________________
  **
  **  Smart shutdown
---- httpd-2.4.33/modules/ssl/ssl_util_ssl.h.r1830819+
-+++ httpd-2.4.33/modules/ssl/ssl_util_ssl.h
+diff --git a/modules/ssl/ssl_util_ssl.h b/modules/ssl/ssl_util_ssl.h
+index c67dacf..d6307d9 100644
+--- a/modules/ssl/ssl_util_ssl.h
++++ b/modules/ssl/ssl_util_ssl.h
 @@ -64,8 +64,11 @@
  void        modssl_init_app_data2_idx(void);
  void       *modssl_get_app_data2(SSL *);
diff --git a/httpd.spec b/httpd.spec
index 8e3bf09..6539e23 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.37
-Release: 6%{?dist}
+Version: 2.4.38
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -74,7 +74,7 @@ Patch29: httpd-2.4.33-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
 Patch31: httpd-2.4.33-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
-Patch36: httpd-2.4.33-r1830819+.patch
+Patch36: httpd-2.4.38-r1830819+.patch
 Patch38: httpd-2.4.34-sslciphdefault.patch
 Patch39: httpd-2.4.37-sslprotdefault.patch
 
@@ -235,7 +235,7 @@ interface for storing and accessing per-user session data.
 %patch30 -p1 -b .cachehardmax
 #patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
-%patch36 -p1 -b .r1830819+
+#%patch36 -p1 -b .r1830819+
 %patch38 -p1 -b .sslciphdefault
 %patch39 -p1 -b .sslprotdefault
 
@@ -739,6 +739,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Jan 23 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.38-1
+- new version 2.4.38 (#1668125)
+
 * Mon Jan 14 2019 Björn Esser <besser82@fedoraproject.org> - 2.4.37-6
 - Rebuilt for libcrypt.so.2 (#1666033)
 
diff --git a/sources b/sources
index ca284fa..69cd474 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.37.tar.bz2) = e802915801bbe885a65dada04b0116d145b293fabfff734dddb61a79ca1c6d65326f51155d1b864b093c3ec00d0bdfdf1401ab55677bae1ea3da1d199d7bcad4
+SHA512 (httpd-2.4.38.tar.bz2) = 8bdc36fa2bd13fd83feee17fdce4a5316ed8f96c1ac32b636ba106572ba257815438c72068d2d0e900783a3fa25c90a5da34c3f83fc2c04a1dbdbf234f7ad448

From a18552330d63b8d908a523a98bd6588ee86e1d47 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 23 Jan 2019 13:04:05 +0100
Subject: [PATCH 151/359] Update PKCS#11 patch.

---
 httpd-2.4.38-r1830819+.patch | 81 +++++++++++++++++-------------------
 httpd.spec                   |  2 +-
 2 files changed, 40 insertions(+), 43 deletions(-)

diff --git a/httpd-2.4.38-r1830819+.patch b/httpd-2.4.38-r1830819+.patch
index 01027ce..7df5ff6 100644
--- a/httpd-2.4.38-r1830819+.patch
+++ b/httpd-2.4.38-r1830819+.patch
@@ -11,9 +11,9 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242
 
 diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
 index d276fea..5467d23 100644
---- a/modules/ssl/ssl_engine_config.c
-+++ b/modules/ssl/ssl_engine_config.c
-@@ -919,7 +919,9 @@ const char *ssl_cmd_SSLCertificateFile(cmd_parms *cmd,
+--- httpd-2.4.38/modules/ssl/ssl_engine_config.c.r1830819+
++++ httpd-2.4.38/modules/ssl/ssl_engine_config.c
+@@ -916,7 +916,9 @@
      SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
      const char *err;
  
@@ -24,7 +24,7 @@ index d276fea..5467d23 100644
          return err;
      }
  
-@@ -935,7 +937,9 @@ const char *ssl_cmd_SSLCertificateKeyFile(cmd_parms *cmd,
+@@ -932,7 +934,9 @@
      SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
      const char *err;
  
@@ -35,11 +35,9 @@ index d276fea..5467d23 100644
          return err;
      }
  
-diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
-index 8ba3486..e1b0844 100644
---- a/modules/ssl/ssl_engine_init.c
-+++ b/modules/ssl/ssl_engine_init.c
-@@ -1264,12 +1264,18 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+--- httpd-2.4.38/modules/ssl/ssl_engine_init.c.r1830819+
++++ httpd-2.4.38/modules/ssl/ssl_engine_init.c
+@@ -1228,12 +1228,18 @@
                  (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i,
                                            const char *));
           i++) {
@@ -59,7 +57,7 @@ index 8ba3486..e1b0844 100644
              if ((SSL_CTX_use_certificate_file(mctx->ssl_ctx, certfile,
                                                SSL_FILETYPE_PEM) < 1)) {
                  ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02561)
-@@ -1298,12 +1304,46 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+@@ -1262,12 +1268,46 @@
  
          ERR_clear_error();
  
@@ -111,7 +109,7 @@ index 8ba3486..e1b0844 100644
              const unsigned char *ptr;
  
              ERR_clear_error();
-@@ -1390,8 +1430,9 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+@@ -1354,8 +1394,9 @@
      /*
       * Try to read DH parameters from the (first) SSLCertificateFile
       */
@@ -123,7 +121,7 @@ index 8ba3486..e1b0844 100644
          SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);
          ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
                       "Custom DH parameters (%d bits) for %s loaded from %s",
-@@ -1403,10 +1444,10 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+@@ -1367,10 +1408,10 @@
      /*
       * Similarly, try to read the ECDH curve name from SSLCertificateFile...
       */
@@ -138,11 +136,9 @@ index 8ba3486..e1b0844 100644
          SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey);
          ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541)
                       "ECDH curve %s for %s specified in %s",
-diff --git a/modules/ssl/ssl_engine_pphrase.c b/modules/ssl/ssl_engine_pphrase.c
-index 8c29443..d5d33f7 100644
---- a/modules/ssl/ssl_engine_pphrase.c
-+++ b/modules/ssl/ssl_engine_pphrase.c
-@@ -143,8 +143,6 @@ apr_status_t ssl_load_encrypted_pkey(server_rec *s, apr_pool_t *p, int idx,
+--- httpd-2.4.38/modules/ssl/ssl_engine_pphrase.c.r1830819+
++++ httpd-2.4.38/modules/ssl/ssl_engine_pphrase.c
+@@ -143,8 +143,6 @@
      const char *key_id = asn1_table_vhost_key(mc, p, sc->vhost_id, idx);
      EVP_PKEY *pPrivateKey = NULL;
      ssl_asn1_t *asn1;
@@ -151,7 +147,16 @@ index 8c29443..d5d33f7 100644
      int nPassPhrase = (*pphrases)->nelts;
      int nPassPhraseRetry = 0;
      apr_time_t pkey_mtime = 0;
-@@ -351,19 +349,12 @@ apr_status_t ssl_load_encrypted_pkey(server_rec *s, apr_pool_t *p, int idx,
+@@ -221,7 +219,7 @@
+          * is not empty. */
+         ERR_clear_error();
+ 
+-        pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file, NULL,
++        pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file,
+                                              ssl_pphrase_Handle_CB, &ppcb_arg);
+         /* If the private key was successfully read, nothing more to
+            do here. */
+@@ -351,19 +349,12 @@
          nPassPhrase++;
      }
  
@@ -174,7 +179,7 @@ index 8c29443..d5d33f7 100644
          asn1->source_mtime = pkey_mtime;
      }
  
-@@ -614,3 +605,288 @@ int ssl_pphrase_Handle_CB(char *buf, int bufsize, int verify, void *srv)
+@@ -614,3 +605,288 @@
       */
      return (len);
  }
@@ -463,11 +468,9 @@ index 8c29443..d5d33f7 100644
 +    return APR_SUCCESS;
 +}
 +#endif
-diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h
-index f46814d..1fdde13 100644
---- a/modules/ssl/ssl_private.h
-+++ b/modules/ssl/ssl_private.h
-@@ -1002,21 +1002,28 @@ BOOL         ssl_util_vhost_matches(const char *servername, server_rec *s);
+--- httpd-2.4.38/modules/ssl/ssl_private.h.r1830819+
++++ httpd-2.4.38/modules/ssl/ssl_private.h
+@@ -1002,21 +1002,28 @@
  apr_status_t ssl_load_encrypted_pkey(server_rec *, apr_pool_t *, int,
                                       const char *, apr_array_header_t **);
  
@@ -505,7 +508,7 @@ index f46814d..1fdde13 100644
  
  /**  Mutex Support  */
  int          ssl_mutex_init(server_rec *, apr_pool_t *);
-@@ -1109,6 +1116,10 @@ int modssl_request_is_tls(const request_rec *r, SSLConnRec **sslconn);
+@@ -1109,6 +1116,10 @@
  int ssl_is_challenge(conn_rec *c, const char *servername, 
                       X509 **pcert, EVP_PKEY **pkey);
  
@@ -516,11 +519,9 @@ index f46814d..1fdde13 100644
  #endif /* SSL_PRIVATE_H */
  /** @} */
  
-diff --git a/modules/ssl/ssl_util.c b/modules/ssl/ssl_util.c
-index 0d23465..223b385 100644
---- a/modules/ssl/ssl_util.c
-+++ b/modules/ssl/ssl_util.c
-@@ -192,45 +192,37 @@ BOOL ssl_util_path_check(ssl_pathcheck_t pcm, const char *path, apr_pool_t *p)
+--- httpd-2.4.38/modules/ssl/ssl_util.c.r1830819+
++++ httpd-2.4.38/modules/ssl/ssl_util.c
+@@ -192,45 +192,37 @@
      return TRUE;
  }
  
@@ -582,7 +583,7 @@ index 0d23465..223b385 100644
  }
  
  ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table,
-@@ -480,3 +472,13 @@ void ssl_util_thread_id_setup(apr_pool_t *p)
+@@ -480,3 +472,13 @@
  }
  
  #endif /* #if APR_HAS_THREADS && MODSSL_USE_OPENSSL_PRE_1_1_API */
@@ -596,11 +597,9 @@ index 0d23465..223b385 100644
 +    return 0;
 +#endif
 +}
-diff --git a/modules/ssl/ssl_util_ssl.c b/modules/ssl/ssl_util_ssl.c
-index b7f0eca..4fa089b 100644
---- a/modules/ssl/ssl_util_ssl.c
-+++ b/modules/ssl/ssl_util_ssl.c
-@@ -74,7 +74,7 @@ void modssl_set_app_data2(SSL *ssl, void *arg)
+--- httpd-2.4.38/modules/ssl/ssl_util_ssl.c.r1830819+
++++ httpd-2.4.38/modules/ssl/ssl_util_ssl.c
+@@ -74,7 +74,7 @@
  **  _________________________________________________________________
  */
  
@@ -609,7 +608,7 @@ index b7f0eca..4fa089b 100644
  {
      EVP_PKEY *rc;
      BIO *bioS;
-@@ -83,7 +83,7 @@ EVP_PKEY *modssl_read_privatekey(const char* filename, EVP_PKEY **key, pem_passw
+@@ -83,7 +83,7 @@
      /* 1. try PEM (= DER+Base64+headers) */
      if ((bioS=BIO_new_file(filename, "r")) == NULL)
          return NULL;
@@ -618,7 +617,7 @@ index b7f0eca..4fa089b 100644
      BIO_free(bioS);
  
      if (rc == NULL) {
-@@ -107,41 +107,9 @@ EVP_PKEY *modssl_read_privatekey(const char* filename, EVP_PKEY **key, pem_passw
+@@ -107,41 +107,9 @@
              BIO_free(bioS);
          }
      }
@@ -660,10 +659,8 @@ index b7f0eca..4fa089b 100644
  /*  _________________________________________________________________
  **
  **  Smart shutdown
-diff --git a/modules/ssl/ssl_util_ssl.h b/modules/ssl/ssl_util_ssl.h
-index c67dacf..d6307d9 100644
---- a/modules/ssl/ssl_util_ssl.h
-+++ b/modules/ssl/ssl_util_ssl.h
+--- httpd-2.4.38/modules/ssl/ssl_util_ssl.h.r1830819+
++++ httpd-2.4.38/modules/ssl/ssl_util_ssl.h
 @@ -64,8 +64,11 @@
  void        modssl_init_app_data2_idx(void);
  void       *modssl_get_app_data2(SSL *);
diff --git a/httpd.spec b/httpd.spec
index 6539e23..01c4dda 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -235,7 +235,7 @@ interface for storing and accessing per-user session data.
 %patch30 -p1 -b .cachehardmax
 #patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
-#%patch36 -p1 -b .r1830819+
+%patch36 -p1 -b .r1830819+
 %patch38 -p1 -b .sslciphdefault
 %patch39 -p1 -b .sslprotdefault
 

From 584830e35ee967968509b4d01e9e0a5bcc46ad5f Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Wed, 23 Jan 2019 12:34:26 +0000
Subject: [PATCH 152/359] Updated release num

---
 httpd.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 01c4dda..6ff6988 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.38
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -739,7 +739,7 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Wed Jan 23 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.38-1
+* Wed Jan 23 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.38-2
 - new version 2.4.38 (#1668125)
 
 * Mon Jan 14 2019 Björn Esser <besser82@fedoraproject.org> - 2.4.37-6

From a0bbdf8c6cb24387f0d5869a95215bcceb4c4a15 Mon Sep 17 00:00:00 2001
From: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
Date: Mon, 28 Jan 2019 20:17:48 +0100
Subject: [PATCH 153/359] Remove obsolete Group tag

References: https://fedoraproject.org/wiki/Changes/Remove_Group_Tag
---
 httpd.spec | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 6ff6988..378d347 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -86,7 +86,6 @@ Patch60: httpd-2.4.34-enable-sslv3.patch
 # Security fixes
 
 License: ASL 2.0
-Group: System Environment/Daemons
 BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto
 BuildRequires: perl-interpreter, perl-generators, systemd-devel
 BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
@@ -112,7 +111,6 @@ The Apache HTTP Server is a powerful, efficient, and extensible
 web server.
 
 %package devel
-Group: Development/Libraries
 Summary: Development interfaces for the Apache HTTP Server
 Requires: apr-devel, apr-util-devel, pkgconfig
 Requires: httpd = %{version}-%{release}
@@ -127,7 +125,6 @@ able to compile or develop additional modules for Apache, you need
 to install this package.
 
 %package manual
-Group: Documentation
 Summary: Documentation for the Apache HTTP Server
 Requires: httpd = %{version}-%{release}
 BuildArch: noarch
@@ -138,7 +135,6 @@ reference guide for the Apache HTTP Server. The information can
 also be found at https://httpd.apache.org/docs/2.4/.
 
 %package filesystem
-Group: System Environment/Daemons
 Summary: The basic directory layout for the Apache HTTP Server
 BuildArch: noarch
 Requires(pre): /usr/sbin/useradd
@@ -149,7 +145,6 @@ for the Apache HTTP Server including the correct permissions
 for the directories.
 
 %package tools
-Group: System Environment/Daemons
 Summary: Tools for use with the Apache HTTP Server
 
 %description tools
@@ -157,7 +152,6 @@ The httpd-tools package contains tools which can be used with
 the Apache HTTP Server.
 
 %package -n mod_ssl
-Group: System Environment/Daemons
 Summary: SSL/TLS module for the Apache HTTP Server
 Epoch: 1
 BuildRequires: openssl-devel
@@ -173,7 +167,6 @@ server via the Secure Sockets Layer (SSL) and Transport Layer
 Security (TLS) protocols.
 
 %package -n mod_md
-Group: System Environment/Daemons
 Summary: Certificate provisioning using ACME for the Apache HTTP Server
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 BuildRequires: jansson-devel, libcurl-devel
@@ -186,7 +179,6 @@ managed domains and their virtual hosts automatically. This includes
 renewal of certificates before they expire.
 
 %package -n mod_proxy_html
-Group: System Environment/Daemons
 Summary: HTML and XML content filters for the Apache HTTP Server
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 BuildRequires: libxml2-devel
@@ -198,7 +190,6 @@ The mod_proxy_html and mod_xml2enc modules provide filters which can
 transform and modify HTML and XML content.
 
 %package -n mod_ldap
-Group: System Environment/Daemons
 Summary: LDAP authentication modules for the Apache HTTP Server
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 Requires: apr-util-ldap
@@ -208,7 +199,6 @@ The mod_ldap and mod_authnz_ldap modules add support for LDAP
 authentication to the Apache HTTP Server.
 
 %package -n mod_session
-Group: System Environment/Daemons
 Summary: Session interface for the Apache HTTP Server
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 

From 887d8d1a450e2669aaf5d33b3533874a4e9b73c5 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 1 Feb 2019 02:28:37 +0000
Subject: [PATCH 154/359] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 378d347..dc5e500 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.38
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -729,6 +729,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.38-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
 * Wed Jan 23 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.38-2
 - new version 2.4.38 (#1668125)
 

From 80cf4174c6f72e572545afe357b86f19f60712aa Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 5 Feb 2019 12:11:27 +0000
Subject: [PATCH 155/359] use serverroot-relative statedir, rundir by default

---
 config.layout                | 24 ++++++++++++++++++
 httpd-2.4.37-r1842929+.patch | 49 +++++++++++++++++++++---------------
 httpd.spec                   | 14 ++++++++---
 pullrev.sh                   |  2 +-
 4 files changed, 65 insertions(+), 24 deletions(-)
 create mode 100644 config.layout

diff --git a/config.layout b/config.layout
new file mode 100644
index 0000000..3a9f6c8
--- /dev/null
+++ b/config.layout
@@ -0,0 +1,24 @@
+# Layout used in Fedora httpd packaging.
+<Layout Fedora>
+    prefix:        /etc/httpd
+    localstatedir: /var
+    exec_prefix:   /usr
+    bindir:        ${exec_prefix}/bin
+    sbindir:       ${exec_prefix}/sbin
+    libdir:        ${exec_prefix}/lib
+    libexecdir:    ${exec_prefix}/libexec
+    mandir:        ${exec_prefix}/man
+    sysconfdir:    /etc/httpd/conf
+    datadir:       ${exec_prefix}/share/httpd
+    installbuilddir: ${libdir}/httpd/build
+    errordir:      ${datadir}/error
+    iconsdir:      ${datadir}/icons
+    htdocsdir:     ${localstatedir}/www/html
+    manualdir:     ${datadir}/manual
+    cgidir:        ${localstatedir}/www/cgi-bin
+    includedir:    ${exec_prefix}/include/httpd
+    runtimedir:    ${prefix}/run
+    logfiledir:    ${localstatedir}/log/httpd
+    statedir:      ${prefix}/state
+    proxycachedir: ${localstatedir}/cache/httpd/proxy
+</Layout>     
diff --git a/httpd-2.4.37-r1842929+.patch b/httpd-2.4.37-r1842929+.patch
index c6aa1f7..e841e34 100644
--- a/httpd-2.4.37-r1842929+.patch
+++ b/httpd-2.4.37-r1842929+.patch
@@ -1,9 +1,10 @@
 # ./pullrev.sh 1842929 1842931
 http://svn.apache.org/viewvc?view=revision&revision=1842929
 http://svn.apache.org/viewvc?view=revision&revision=1842931
+http://svn.apache.org/viewvc?view=revision&revision=1852982
 
---- httpd-2.4.37/acinclude.m4.r1842929+
-+++ httpd-2.4.37/acinclude.m4
+--- httpd-2.4.38/acinclude.m4.r1842929+
++++ httpd-2.4.38/acinclude.m4
 @@ -45,6 +45,7 @@
    APACHE_SUBST(installbuilddir)
    APACHE_SUBST(runtimedir)
@@ -20,8 +21,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1842931
  ])
  
  dnl 
---- httpd-2.4.37/config.layout.r1842929+
-+++ httpd-2.4.37/config.layout
+--- httpd-2.4.38/config.layout.r1842929+
++++ httpd-2.4.38/config.layout
 @@ -29,6 +29,7 @@
      includedir:    ${prefix}/include
      localstatedir: ${prefix}
@@ -142,8 +143,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1842931
      logfiledir:      ${localstatedir}/log/httpd
      proxycachedir:   ${localstatedir}/cache/httpd
  </Layout>
---- httpd-2.4.37/configure.in.r1842929+
-+++ httpd-2.4.37/configure.in
+--- httpd-2.4.38/configure.in.r1842929+
++++ httpd-2.4.38/configure.in
 @@ -41,7 +41,7 @@
  AC_PREFIX_DEFAULT(/usr/local/apache2)
  
@@ -153,8 +154,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1842931
  
  dnl reparse the configure arguments.
  APR_PARSE_ARGUMENTS
---- httpd-2.4.37/include/ap_config_layout.h.in.r1842929+
-+++ httpd-2.4.37/include/ap_config_layout.h.in
+--- httpd-2.4.38/include/ap_config_layout.h.in.r1842929+
++++ httpd-2.4.38/include/ap_config_layout.h.in
 @@ -60,5 +60,7 @@
  #define DEFAULT_REL_LOGFILEDIR "@rel_logfiledir@"
  #define DEFAULT_EXP_PROXYCACHEDIR "@exp_proxycachedir@"
@@ -163,8 +164,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1842931
 +#define DEFAULT_REL_STATEDIR "@rel_statedir@"
  
  #endif /* AP_CONFIG_LAYOUT_H */
---- httpd-2.4.37/include/http_config.h.r1842929+
-+++ httpd-2.4.37/include/http_config.h
+--- httpd-2.4.38/include/http_config.h.r1842929+
++++ httpd-2.4.38/include/http_config.h
 @@ -757,6 +757,14 @@
   */
  AP_DECLARE(char *) ap_runtime_dir_relative(apr_pool_t *p, const char *fname);
@@ -180,8 +181,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1842931
  /* Finally, the hook for dynamically loading modules in... */
  
  /**
---- httpd-2.4.37/Makefile.in.r1842929+
-+++ httpd-2.4.37/Makefile.in
+--- httpd-2.4.38/Makefile.in.r1842929+
++++ httpd-2.4.38/Makefile.in
 @@ -213,6 +213,7 @@
  install-other:
  	@test -d $(DESTDIR)$(logfiledir) || $(MKINSTALLDIRS) $(DESTDIR)$(logfiledir)
@@ -190,8 +191,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1842931
  	@for ext in dll x; do \
  		file=apachecore.$$ext; \
  		if test -f $$file; then \
---- httpd-2.4.37/modules/dav/fs/mod_dav_fs.c.r1842929+
-+++ httpd-2.4.37/modules/dav/fs/mod_dav_fs.c
+--- httpd-2.4.38/modules/dav/fs/mod_dav_fs.c.r1842929+
++++ httpd-2.4.38/modules/dav/fs/mod_dav_fs.c
 @@ -29,6 +29,10 @@
  
  extern module AP_MODULE_DECLARE_DATA dav_fs_module;
@@ -216,14 +217,14 @@ http://svn.apache.org/viewvc?view=revision&revision=1842931
  }
  
  static void *dav_fs_merge_server_config(apr_pool_t *p,
---- httpd-2.4.37/modules/md/mod_md_config.c.r1842929+
-+++ httpd-2.4.37/modules/md/mod_md_config.c
+--- httpd-2.4.38/modules/md/mod_md_config.c.r1842929+
++++ httpd-2.4.38/modules/md/mod_md_config.c
 @@ -54,10 +54,14 @@
  
  #define DEF_VAL     (-1)
  
 +#ifndef MD_DEFAULT_BASE_DIR
-+#define MD_DEFAULT_BASE_DIR "state/md"
++#define MD_DEFAULT_BASE_DIR "md"
 +#endif
 +
  /* Default settings for the global conf */
@@ -242,8 +243,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1842931
          
          apr_pool_cleanup_register(pool, NULL, cleanup_mod_config, apr_pool_cleanup_null);
      }
---- httpd-2.4.37/server/core.c.r1842929+
-+++ httpd-2.4.37/server/core.c
+--- httpd-2.4.38/server/core.c.r1842929+
++++ httpd-2.4.38/server/core.c
 @@ -129,6 +129,8 @@
  AP_DECLARE_DATA int ap_run_mode = AP_SQ_RM_UNKNOWN;
  AP_DECLARE_DATA int ap_config_generation = 0;
@@ -287,7 +288,15 @@ http://svn.apache.org/viewvc?view=revision&revision=1842931
  AP_INIT_TAKE1("ErrorLog", set_server_string_slot,
    (void *)APR_OFFSETOF(server_rec, error_fname), RSRC_CONF,
    "The filename of the error log"),
-@@ -5150,6 +5172,27 @@
+@@ -4927,6 +4949,7 @@
+     ap_regcomp_set_default_cflags(AP_REG_DOLLAR_ENDONLY);
+ 
+     mpm_common_pre_config(pconf);
++    core_state_dir = NULL;
+ 
+     return OK;
+ }
+@@ -5150,6 +5173,27 @@
      }
  }
  
diff --git a/httpd.spec b/httpd.spec
index dc5e500..4285193 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.38
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -56,6 +56,7 @@ Source41: htcacheclean.sysconf
 Source42: httpd-init.service
 Source43: httpd-ssl-gencerts
 Source44: httpd@.service
+Source45: config.layout
 # build/scripts patches
 Patch1: httpd-2.4.1-apctl.patch
 Patch2: httpd-2.4.9-apxs.patch
@@ -257,6 +258,9 @@ if test "x${vmmn}" != "x%{mmn}"; then
    exit 1
 fi
 
+# Provide default layout
+cp $RPM_SOURCE_DIR/config.layout .
+
 sed '
 s,@MPM@,%{mpm},g
 s,@DOCROOT@,%{docroot},g
@@ -399,7 +403,7 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.tmpfiles \
 
 # Other directories
 mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/dav \
-         $RPM_BUILD_ROOT%{_localstatedir}/lib/httpd \
+         $RPM_BUILD_ROOT%{_localstatedir}/lib/httpd/state \
          $RPM_BUILD_ROOT/run/httpd/htcacheclean
 
 # Substitute in defaults which are usually done (badly) by "make install"
@@ -461,8 +465,9 @@ ln -s ../../pixmaps/poweredby.png \
         $RPM_BUILD_ROOT%{contentdir}/icons/poweredby.png
 
 # symlinks for /etc/httpd
+rmdir $RPM_BUILD_ROOT/etc/httpd/{state,run}
 ln -s ../..%{_localstatedir}/log/httpd $RPM_BUILD_ROOT/etc/httpd/logs
-ln -s ../..%{_localstatedir}/lib/httpd $RPM_BUILD_ROOT/etc/httpd/state
+ln -s ../..%{_localstatedir}/lib/httpd/state $RPM_BUILD_ROOT/etc/httpd/state
 ln -s /run/httpd $RPM_BUILD_ROOT/etc/httpd/run
 ln -s ../..%{_libdir}/httpd/modules $RPM_BUILD_ROOT/etc/httpd/modules
 
@@ -729,6 +734,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Feb  5 2019 Joe Orton <jorton@redhat.com> - 2.4.38-4
+- use serverroot-relative statedir, rundir by default
+
 * Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.38-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 
diff --git a/pullrev.sh b/pullrev.sh
index dbb97a5..5494c7e 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -7,7 +7,7 @@ fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
 #repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.34
+ver=2.4.37
 prefix="httpd-${ver}"
 suffix="r$1${2:++}"
 fn="${prefix}-${suffix}.patch"

From 9e462af294c3fbd19348dba908d304daf1b3b078 Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Tue, 5 Feb 2019 12:39:17 +0000
Subject: [PATCH 156/359] segmentation fault fix (FIPS)

---
 httpd-2.4.37-fips-segfault.patch | 42 ++++++++++++++++++++++++++++++++
 httpd.spec                       |  7 +++++-
 2 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.37-fips-segfault.patch

diff --git a/httpd-2.4.37-fips-segfault.patch b/httpd-2.4.37-fips-segfault.patch
new file mode 100644
index 0000000..6039980
--- /dev/null
+++ b/httpd-2.4.37-fips-segfault.patch
@@ -0,0 +1,42 @@
+diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
+index 37947e7..b50c259 100644
+--- a/modules/ssl/mod_ssl.c
++++ b/modules/ssl/mod_ssl.c
+@@ -331,9 +331,6 @@ static apr_status_t ssl_cleanup_pre_config(void *data)
+     /*
+      * Try to kill the internals of the SSL library.
+      */
+-#ifdef HAVE_FIPS
+-    FIPS_mode_set(0);
+-#endif
+     /* Corresponds to OBJ_create()s */
+     OBJ_cleanup();
+     /* Corresponds to OPENSSL_load_builtin_modules() */
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index 5063a72..21e41e2 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -183,6 +183,14 @@ int ssl_is_challenge(conn_rec *c, const char *servername,
+     return 0;
+ }
+ 
++#ifdef HAVE_FIPS
++static apr_status_t ssl_fips_cleanup(void *data)
++{
++    FIPS_mode_set(0);
++    return APR_SUCCESS;
++}
++#endif
++
+ /*
+  *  Per-module initialization
+  */
+@@ -316,6 +324,8 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
+             if (FIPS_mode_set(1)) {
+                 ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, s, APLOGNO(01884)
+                              "Operating in SSL FIPS mode");
++                apr_pool_cleanup_register(p, NULL, ssl_fips_cleanup,
++                                          apr_pool_cleanup_null);
+             }
+             else {
+                 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01885) "FIPS mode failed");
diff --git a/httpd.spec b/httpd.spec
index 4285193..b7520a2 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.38
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -78,6 +78,7 @@ Patch34: httpd-2.4.17-socket-activation.patch
 Patch36: httpd-2.4.38-r1830819+.patch
 Patch38: httpd-2.4.34-sslciphdefault.patch
 Patch39: httpd-2.4.37-sslprotdefault.patch
+Patch40: httpd-2.4.37-fips-segfault.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -229,6 +230,7 @@ interface for storing and accessing per-user session data.
 %patch36 -p1 -b .r1830819+
 %patch38 -p1 -b .sslciphdefault
 %patch39 -p1 -b .sslprotdefault
+%patch40 -p1 -b .fipsseg
 
 %patch58 -p1 -b .r1738878
 %patch60 -p1 -b .enable-sslv3
@@ -734,6 +736,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Feb 05 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.38-5
+- segmentation fault fix (FIPS)
+
 * Tue Feb  5 2019 Joe Orton <jorton@redhat.com> - 2.4.38-4
 - use serverroot-relative statedir, rundir by default
 

From b86b48c4a2a3293c0e9a8cb74e01f1827c3be904 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 14 Mar 2019 10:30:15 +0000
Subject: [PATCH 157/359] apachectl: cleanup and replace script wholesale
 (#1641237)  * drop "apachectl fullstatus" support  * run systemctl with
 --no-pager option  * implement graceful&graceful-stop by signal directly run
 "httpd -t" from legacy action script Resolves: rhbz#1641237

---
 action-configtest.sh            |  2 +-
 action-graceful.sh              |  2 +-
 apachectl.sh                    | 62 ++++++++++++++++++++++
 httpd-2.4.1-apctl.patch         | 94 ---------------------------------
 httpd-2.4.34-apctlsystemd.patch | 63 ----------------------
 httpd.spec                      | 18 ++++---
 6 files changed, 75 insertions(+), 166 deletions(-)
 create mode 100755 apachectl.sh
 delete mode 100644 httpd-2.4.1-apctl.patch
 delete mode 100644 httpd-2.4.34-apctlsystemd.patch

diff --git a/action-configtest.sh b/action-configtest.sh
index 6685b0a..711d9cd 100644
--- a/action-configtest.sh
+++ b/action-configtest.sh
@@ -1,2 +1,2 @@
 #!/bin/sh
-exec /sbin/apachectl configtest "$@"
+exec /usr/sbin/httpd -t
diff --git a/action-graceful.sh b/action-graceful.sh
index dc68b2e..4976087 100644
--- a/action-graceful.sh
+++ b/action-graceful.sh
@@ -1,2 +1,2 @@
 #!/bin/sh
-exec /sbin/apachectl graceful "$@"
+exec /sbin/apachectl graceful
diff --git a/apachectl.sh b/apachectl.sh
new file mode 100755
index 0000000..ee2dba8
--- /dev/null
+++ b/apachectl.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/sh
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if [ "x$1" = "x-k" ]; then
+    shift
+fi
+
+ACMD="$1"
+ARGV="$@"
+SVC='httpd.service'
+
+if [ "x$2" != "x" ] ; then
+    echo Passing arguments to httpd using apachectl is no longer supported.
+    echo You can only start/stop/restart httpd using this script.
+    echo To pass extra arguments to httpd, see the $SVC'(8)'
+    echo man page.
+    exit 1
+fi
+
+case $ACMD in
+start|stop|restart|status)
+    /usr/bin/systemctl --no-pager $ACMD $SVC
+    ERROR=$?
+    ;;
+graceful)
+    if /usr/bin/systemctl -q is-active $SVC; then
+        /usr/bin/systemctl kill --signal=SIGUSR1 $SVC
+    else
+        /usr/bin/systemctl start $SVC
+    fi
+    ERROR=$?
+    ;;
+graceful-stop)
+    /usr/bin/systemctl kill --signal=SIGWINCH $SVC
+    ERROR=$?
+    ;;
+configtest)
+    /usr/sbin/service ${SVC/.service//} $ACMD
+    ERROR=$?
+    ;;
+*)
+    echo apachectl: The \"$ACMD\" option is not supported. 1>&2
+    ERROR=2
+    ;;
+esac
+
+exit $ERROR
+
diff --git a/httpd-2.4.1-apctl.patch b/httpd-2.4.1-apctl.patch
deleted file mode 100644
index b31c3c5..0000000
--- a/httpd-2.4.1-apctl.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-
-- fail gracefully if links is not installed on target system
-- source sysconfig/httpd for custom env. vars etc.
-- make httpd -t work even in SELinux
-- pass $OPTIONS to all $HTTPD invocation
-
-Upstream-HEAD: vendor
-Upstream-2.0: vendor
-Upstream-Status: Vendor-specific changes for better initscript integration
-
---- httpd-2.4.1/support/apachectl.in.apctl
-+++ httpd-2.4.1/support/apachectl.in
-@@ -44,19 +44,25 @@ ARGV="$@"
- # the path to your httpd binary, including options if necessary
- HTTPD='@exp_sbindir@/@progname@'
- #
--# pick up any necessary environment variables
--if test -f @exp_sbindir@/envvars; then
--  . @exp_sbindir@/envvars
--fi
- #
- # a command that outputs a formatted text version of the HTML at the
- # url given on the command line.  Designed for lynx, however other
- # programs may work.  
--LYNX="@LYNX_PATH@ -dump"
-+if [ -x "@LYNX_PATH@" ]; then
-+  LYNX="@LYNX_PATH@ -dump"
-+else
-+  LYNX=none
-+fi
- #
- # the URL to your server's mod_status status page.  If you do not
- # have one, then status and fullstatus will not work.
- STATUSURL="http://localhost:@PORT@/server-status"
-+
-+# Source /etc/sysconfig/httpd for $HTTPD setting, etc.
-+if [ -r /etc/sysconfig/httpd ]; then
-+   . /etc/sysconfig/httpd
-+fi
-+
- #
- # Set this variable to a command that increases the maximum
- # number of file descriptors allowed per child process. This is
-@@ -76,9 +82,27 @@ if [ "x$ARGV" = "x" ] ; then 
-     ARGV="-h"
- fi
- 
-+function checklynx() {
-+if [ "$LYNX" = "none" ]; then
-+   echo "The 'links' package is required for this functionality."
-+   exit 8
-+fi
-+}
-+
-+function testconfig() {
-+# httpd is denied terminal access in SELinux, so run in the
-+# current context to get stdout from $HTTPD -t.
-+if test -x /usr/sbin/selinuxenabled && /usr/sbin/selinuxenabled; then
-+  runcon -- `id -Z` $HTTPD $OPTIONS -t
-+else
-+  $HTTPD $OPTIONS -t
-+fi
-+ERROR=$?
-+}
-+
- case $ACMD in
- start|stop|restart|graceful|graceful-stop)
--    $HTTPD -k $ARGV
-+    $HTTPD $OPTIONS -k $ARGV
-     ERROR=$?
-     ;;
- startssl|sslstart|start-SSL)
-@@ -88,17 +112,18 @@ startssl|sslstart|start-SSL)
-     ERROR=2
-     ;;
- configtest)
--    $HTTPD -t
--    ERROR=$?
-+    testconfig
-     ;;
- status)
-+    checklynx
-     $LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } '
-     ;;
- fullstatus)
-+    checklynx
-     $LYNX $STATUSURL
-     ;;
- *)
--    $HTTPD "$@"
-+    $HTTPD $OPTIONS "$@"
-     ERROR=$?
- esac
- 
diff --git a/httpd-2.4.34-apctlsystemd.patch b/httpd-2.4.34-apctlsystemd.patch
deleted file mode 100644
index 20d7101..0000000
--- a/httpd-2.4.34-apctlsystemd.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-
-Make apachectl run via systemctl.
-
-Note: "apachectl graceful" is documented to start httpd if not running.
-
-Upstream-Status: vendor specific patch
-
---- httpd-2.4.34/support/apachectl.in.apctlsystemd
-+++ httpd-2.4.34/support/apachectl.in
-@@ -58,11 +58,6 @@
- # have one, then status and fullstatus will not work.
- STATUSURL="http://localhost:@PORT@/server-status"
- 
--# Source /etc/sysconfig/httpd for $HTTPD setting, etc.
--if [ -r /etc/sysconfig/httpd ]; then
--   . /etc/sysconfig/httpd
--fi
--
- #
- # Set this variable to a command that increases the maximum
- # number of file descriptors allowed per child process. This is
-@@ -100,9 +95,28 @@
- ERROR=$?
- }
- 
-+if [ "x$2" != "x" ] ; then
-+    echo Passing arguments to httpd using apachectl is no longer supported.
-+    echo You can only start/stop/restart httpd using this script.
-+    echo "To pass extra arguments to httpd, see the httpd.service(8)"
-+    echo man page.
-+fi
-+
- case $ACMD in
--start|stop|restart|graceful|graceful-stop)
--    $HTTPD $OPTIONS -k $ARGV
-+start|stop|restart|status)
-+    /usr/bin/systemctl $ACMD httpd.service
-+    ERROR=$?
-+    ;;
-+graceful)
-+    if /usr/bin/systemctl -q is-active httpd.service; then
-+        /usr/bin/systemctl reload httpd.service
-+    else
-+        /usr/bin/systemctl start httpd.service
-+    fi
-+    ERROR=$?
-+    ;;
-+graceful-stop)
-+    /usr/bin/systemctl stop httpd.service
-     ERROR=$?
-     ;;
- startssl|sslstart|start-SSL)
-@@ -114,10 +128,6 @@
- configtest)
-     testconfig
-     ;;
--status)
--    checklynx
--    $LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } '
--    ;;
- fullstatus)
-     checklynx
-     $LYNX $STATUSURL
diff --git a/httpd.spec b/httpd.spec
index b7520a2..d8f2d02 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.38
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -45,7 +45,6 @@ Source26: 10-listen443.conf
 Source27: httpd.socket
 Source28: 00-optional.conf
 Source29: 01-md.conf
-# Documentation
 Source30: README.confd
 Source31: README.confmod
 Source32: httpd.service.xml
@@ -57,11 +56,10 @@ Source42: httpd-init.service
 Source43: httpd-ssl-gencerts
 Source44: httpd@.service
 Source45: config.layout
+Source46: apachectl.sh
 # build/scripts patches
-Patch1: httpd-2.4.1-apctl.patch
 Patch2: httpd-2.4.9-apxs.patch
 Patch3: httpd-2.4.1-deplibs.patch
-Patch6: httpd-2.4.34-apctlsystemd.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
@@ -210,10 +208,8 @@ interface for storing and accessing per-user session data.
 
 %prep
 %setup -q
-%patch1 -p1 -b .apctl
 %patch2 -p1 -b .apxs
 %patch3 -p1 -b .deplibs
-%patch6 -p1 -b .apctlsystemd
 
 %patch19 -p1 -b .detectsystemd
 
@@ -482,7 +478,8 @@ install -m755 $RPM_SOURCE_DIR/httpd-ssl-pass-dialog \
 install -m755 $RPM_SOURCE_DIR/httpd-ssl-gencerts \
 	$RPM_BUILD_ROOT%{_libexecdir}/httpd-ssl-gencerts
 
-# Install action scripts
+# Install scripts
+install -p -m 755 $RPM_SOURCE_DIR/apachectl.sh $RPM_BUILD_ROOT%{_sbindir}/apachectl
 mkdir -p $RPM_BUILD_ROOT%{_libexecdir}/initscripts/legacy-actions/httpd
 for f in graceful configtest; do
     install -p -m 755 $RPM_SOURCE_DIR/action-${f}.sh \
@@ -736,6 +733,13 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Feb 28 2019 Joe Orton <jorton@redhat.com> - 2.4.38-6
+- apachectl: cleanup and replace script wholesale (#1641237)
+ * drop "apachectl fullstatus" support
+ * run systemctl with --no-pager option
+ * implement graceful&graceful-stop by signal directly
+- run "httpd -t" from legacy action script
+
 * Tue Feb 05 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.38-5
 - segmentation fault fix (FIPS)
 

From c30e10218028cb4759eb0fa5a61d06e3148c073d Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Tue, 2 Apr 2019 10:53:17 +0000
Subject: [PATCH 158/359] update to 2.4.39

---
 httpd-2.4.37-fips-segfault.patch | 42 --------------------------------
 httpd.spec                       |  9 ++++---
 sources                          |  2 +-
 3 files changed, 6 insertions(+), 47 deletions(-)
 delete mode 100644 httpd-2.4.37-fips-segfault.patch

diff --git a/httpd-2.4.37-fips-segfault.patch b/httpd-2.4.37-fips-segfault.patch
deleted file mode 100644
index 6039980..0000000
--- a/httpd-2.4.37-fips-segfault.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
-index 37947e7..b50c259 100644
---- a/modules/ssl/mod_ssl.c
-+++ b/modules/ssl/mod_ssl.c
-@@ -331,9 +331,6 @@ static apr_status_t ssl_cleanup_pre_config(void *data)
-     /*
-      * Try to kill the internals of the SSL library.
-      */
--#ifdef HAVE_FIPS
--    FIPS_mode_set(0);
--#endif
-     /* Corresponds to OBJ_create()s */
-     OBJ_cleanup();
-     /* Corresponds to OPENSSL_load_builtin_modules() */
-diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
-index 5063a72..21e41e2 100644
---- a/modules/ssl/ssl_engine_init.c
-+++ b/modules/ssl/ssl_engine_init.c
-@@ -183,6 +183,14 @@ int ssl_is_challenge(conn_rec *c, const char *servername,
-     return 0;
- }
- 
-+#ifdef HAVE_FIPS
-+static apr_status_t ssl_fips_cleanup(void *data)
-+{
-+    FIPS_mode_set(0);
-+    return APR_SUCCESS;
-+}
-+#endif
-+
- /*
-  *  Per-module initialization
-  */
-@@ -316,6 +324,8 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
-             if (FIPS_mode_set(1)) {
-                 ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, s, APLOGNO(01884)
-                              "Operating in SSL FIPS mode");
-+                apr_pool_cleanup_register(p, NULL, ssl_fips_cleanup,
-+                                          apr_pool_cleanup_null);
-             }
-             else {
-                 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01885) "FIPS mode failed");
diff --git a/httpd.spec b/httpd.spec
index d8f2d02..c1b14c1 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.38
-Release: 6%{?dist}
+Version: 2.4.39
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -76,7 +76,6 @@ Patch34: httpd-2.4.17-socket-activation.patch
 Patch36: httpd-2.4.38-r1830819+.patch
 Patch38: httpd-2.4.34-sslciphdefault.patch
 Patch39: httpd-2.4.37-sslprotdefault.patch
-Patch40: httpd-2.4.37-fips-segfault.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -226,7 +225,6 @@ interface for storing and accessing per-user session data.
 %patch36 -p1 -b .r1830819+
 %patch38 -p1 -b .sslciphdefault
 %patch39 -p1 -b .sslprotdefault
-%patch40 -p1 -b .fipsseg
 
 %patch58 -p1 -b .r1738878
 %patch60 -p1 -b .enable-sslv3
@@ -733,6 +731,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Apr 02 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.39-1
+- update to 2.4.39
+
 * Thu Feb 28 2019 Joe Orton <jorton@redhat.com> - 2.4.38-6
 - apachectl: cleanup and replace script wholesale (#1641237)
  * drop "apachectl fullstatus" support
diff --git a/sources b/sources
index 69cd474..248974a 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.38.tar.bz2) = 8bdc36fa2bd13fd83feee17fdce4a5316ed8f96c1ac32b636ba106572ba257815438c72068d2d0e900783a3fa25c90a5da34c3f83fc2c04a1dbdbf234f7ad448
+SHA512 (httpd-2.4.39.tar.bz2) = 9742202040b3dc6344b301540f54b2d3f8e36898410d24206a7f8dcecb1bea7d7230fabc7256752724558af249facf64bffe2cf678b8f7cccb64076737abfda7

From 94b643f7e2997f39e42a1a927284fc2c6c585bca Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Tue, 2 Apr 2019 12:34:14 +0000
Subject: [PATCH 159/359] Forgot to commit 00-base.conf with redis LoadModule

---
 00-base.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/00-base.conf b/00-base.conf
index 28dacb3..e46d911 100644
--- a/00-base.conf
+++ b/00-base.conf
@@ -46,6 +46,7 @@ LoadModule macro_module modules/mod_macro.so
 LoadModule mime_magic_module modules/mod_mime_magic.so
 LoadModule mime_module modules/mod_mime.so
 LoadModule negotiation_module modules/mod_negotiation.so
+LoadModule redis_module modules/mod_socache_redis.so
 LoadModule remoteip_module modules/mod_remoteip.so
 LoadModule reqtimeout_module modules/mod_reqtimeout.so
 LoadModule request_module modules/mod_request.so

From c6cd42af04575bfc94a6c59fe7f1aac854ffbadb Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Tue, 2 Apr 2019 15:27:39 +0000
Subject: [PATCH 160/359] Fix wrong module name used in LoadModule directive

---
 00-base.conf | 2 +-
 httpd.spec   | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/00-base.conf b/00-base.conf
index e46d911..7cabce0 100644
--- a/00-base.conf
+++ b/00-base.conf
@@ -46,7 +46,6 @@ LoadModule macro_module modules/mod_macro.so
 LoadModule mime_magic_module modules/mod_mime_magic.so
 LoadModule mime_module modules/mod_mime.so
 LoadModule negotiation_module modules/mod_negotiation.so
-LoadModule redis_module modules/mod_socache_redis.so
 LoadModule remoteip_module modules/mod_remoteip.so
 LoadModule reqtimeout_module modules/mod_reqtimeout.so
 LoadModule request_module modules/mod_request.so
@@ -56,6 +55,7 @@ LoadModule slotmem_plain_module modules/mod_slotmem_plain.so
 LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
 LoadModule socache_dbm_module modules/mod_socache_dbm.so
 LoadModule socache_memcache_module modules/mod_socache_memcache.so
+LoadModule socache_redis_module modules/mod_socache_redis.so
 LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
 LoadModule status_module modules/mod_status.so
 LoadModule substitute_module modules/mod_substitute.so
diff --git a/httpd.spec b/httpd.spec
index c1b14c1..5363e54 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.39
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -731,7 +731,7 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Tue Apr 02 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.39-1
+* Tue Apr 02 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.39-2
 - update to 2.4.39
 
 * Thu Feb 28 2019 Joe Orton <jorton@redhat.com> - 2.4.38-6

From 56f7420323e1ca6f246482b4abd35f9dca73b874 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 16 Apr 2019 08:45:34 +0100
Subject: [PATCH 161/359] Grammar fixes/tweaks.

---
 httpd.conf.xml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/httpd.conf.xml b/httpd.conf.xml
index 3a02111..13e5d69 100644
--- a/httpd.conf.xml
+++ b/httpd.conf.xml
@@ -129,12 +129,12 @@
       <title>Module configuration files</title>
       
       <para>Module configuration files are provided in the
-      <filename>/etc/httpd/conf.modules.d/</filename> directory.  Filenames
-      in this directory are by convention prefixed with two digit numeric
-      prefix to ensure they are processed in the desired order.  Core
-      modules provide with the <command>httpd</command> package are
-      loaded by files with a <option>0x-</option> prefix to ensure
-      these are loaded first.  Only filenames with a
+      <filename>/etc/httpd/conf.modules.d/</filename> directory.
+      Filenames in this directory are by convention prefixed with two
+      digit numeric prefix to ensure they are processed in the desired
+      order.  Core modules provided with the <command>httpd</command>
+      package are loaded by files with a <option>0x-</option> prefix
+      to ensure these load first.  Only filenames with a
       <option>.conf</option> suffix in this directory will be
       processed.</para>
 
@@ -160,8 +160,8 @@
           <term><filename>/etc/httpd/conf.modules.d/00-systemd.conf</filename></term>
           <listitem><para>This file loads <option>mod_systemd</option>
           which is necessary for the correct operation of the
-          <command>httpd.service</command> service, and should not be
-          removed or disabled.</para></listitem>
+          <command>httpd.service</command> systemd unit, and should
+          not be removed or disabled.</para></listitem>
         </varlistentry>
       </variablelist>
       </para>

From 3aa63a93a96242548cc9c99798beed41044c945f Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 16 Apr 2019 08:48:10 +0100
Subject: [PATCH 162/359] - fix statedir symlink to point to /var/lib/httpd
 (#1697662)

---
 httpd.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 5363e54..d53c385 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.39
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -463,7 +463,7 @@ ln -s ../../pixmaps/poweredby.png \
 # symlinks for /etc/httpd
 rmdir $RPM_BUILD_ROOT/etc/httpd/{state,run}
 ln -s ../..%{_localstatedir}/log/httpd $RPM_BUILD_ROOT/etc/httpd/logs
-ln -s ../..%{_localstatedir}/lib/httpd/state $RPM_BUILD_ROOT/etc/httpd/state
+ln -s ../..%{_localstatedir}/lib/httpd $RPM_BUILD_ROOT/etc/httpd/state
 ln -s /run/httpd $RPM_BUILD_ROOT/etc/httpd/run
 ln -s ../..%{_libdir}/httpd/modules $RPM_BUILD_ROOT/etc/httpd/modules
 
@@ -731,6 +731,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Apr  9 2019 Joe Orton <jorton@redhat.com> - 2.4.39-3
+- fix statedir symlink to point to /var/lib/httpd (#1697662)
+
 * Tue Apr 02 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.39-2
 - update to 2.4.39
 

From fc242751072a1f65e8c8d0f8e81210a2e32ea282 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 16 Apr 2019 08:49:29 +0100
Subject: [PATCH 163/359] - mod_reqtimeout: fix default values regression (PR
 63325)

---
 httpd-2.4.37-r1857129.patch | 65 +++++++++++++++++++++++++++++++++++++
 httpd.spec                  |  4 +++
 2 files changed, 69 insertions(+)
 create mode 100644 httpd-2.4.37-r1857129.patch

diff --git a/httpd-2.4.37-r1857129.patch b/httpd-2.4.37-r1857129.patch
new file mode 100644
index 0000000..4dbf05a
--- /dev/null
+++ b/httpd-2.4.37-r1857129.patch
@@ -0,0 +1,65 @@
+# ./pullrev.sh 1857129
+http://svn.apache.org/viewvc?view=revision&revision=1857129
+
+--- httpd-2.4.37/modules/filters/mod_reqtimeout.c
++++ httpd-2.4.37/modules/filters/mod_reqtimeout.c
+@@ -31,7 +31,7 @@
+ #define UNSET                            -1
+ #define MRT_DEFAULT_handshake_TIMEOUT     0 /* disabled */
+ #define MRT_DEFAULT_handshake_MAX_TIMEOUT 0
+-#define MRT_DEFAULT_handshake_MIN_RATE    APR_INT32_MAX
++#define MRT_DEFAULT_handshake_MIN_RATE    0
+ #define MRT_DEFAULT_header_TIMEOUT       20
+ #define MRT_DEFAULT_header_MAX_TIMEOUT   40
+ #define MRT_DEFAULT_header_MIN_RATE      500
+@@ -220,7 +220,7 @@
+     if (block == APR_NONBLOCK_READ || mode == AP_MODE_INIT
+         || mode == AP_MODE_EATCRLF) {
+         rv = ap_get_brigade(f->next, bb, mode, block, readbytes);
+-        if (ccfg->cur_stage.rate_factor > 0 && rv == APR_SUCCESS) {
++        if (ccfg->cur_stage.rate_factor && rv == APR_SUCCESS) {
+             extend_timeout(ccfg, bb);
+         }
+         return rv;
+@@ -254,7 +254,7 @@
+             }
+ 
+             if (!APR_BRIGADE_EMPTY(bb)) {
+-                if (ccfg->cur_stage.rate_factor > 0) {
++                if (ccfg->cur_stage.rate_factor) {
+                     extend_timeout(ccfg, bb);
+                 }
+ 
+@@ -315,7 +315,7 @@
+          * the real (relevant) bytes to be asked later, within the
+          * currently alloted time.
+          */
+-        if (ccfg->cur_stage.rate_factor > 0 && rv == APR_SUCCESS
++        if (ccfg->cur_stage.rate_factor && rv == APR_SUCCESS
+                 && mode != AP_MODE_SPECULATIVE) {
+             extend_timeout(ccfg, bb);
+         }
+@@ -638,17 +638,17 @@
+     ap_hook_post_read_request(reqtimeout_before_body, NULL, NULL,
+                               APR_HOOK_MIDDLE);
+ 
+-#if MRT_DEFAULT_HANDSHAKE_MIN_RATE > 0
++#if MRT_DEFAULT_handshake_MIN_RATE
+     default_handshake_rate_factor = apr_time_from_sec(1) /
+-                                    MRT_DEFAULT_HANDSHAKE_MIN_RATE;
++                                    MRT_DEFAULT_handshake_MIN_RATE;
+ #endif
+-#if MRT_DEFAULT_HEADER_MIN_RATE > 0
++#if MRT_DEFAULT_header_MIN_RATE
+     default_header_rate_factor = apr_time_from_sec(1) /
+-                                 MRT_DEFAULT_HEADER_MIN_RATE;
++                                 MRT_DEFAULT_header_MIN_RATE;
+ #endif
+-#if MRT_DEFAULT_BODY_MIN_RATE > 0
++#if MRT_DEFAULT_body_MIN_RATE
+     default_body_rate_factor = apr_time_from_sec(1) /
+-                               MRT_DEFAULT_BODY_MIN_RATE;
++                               MRT_DEFAULT_body_MIN_RATE;
+ #endif
+ }
+ 
diff --git a/httpd.spec b/httpd.spec
index d53c385..52287af 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -81,6 +81,8 @@ Patch39: httpd-2.4.37-sslprotdefault.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.34-r1738878.patch
 Patch60: httpd-2.4.34-enable-sslv3.patch
+# https://bz.apache.org/bugzilla/show_bug.cgi?id=63325
+Patch61: httpd-2.4.37-r1857129.patch
 
 # Security fixes
 
@@ -228,6 +230,7 @@ interface for storing and accessing per-user session data.
 
 %patch58 -p1 -b .r1738878
 %patch60 -p1 -b .enable-sslv3
+%patch61 -p1 -b .r1857129
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -733,6 +736,7 @@ exit $rv
 %changelog
 * Tue Apr  9 2019 Joe Orton <jorton@redhat.com> - 2.4.39-3
 - fix statedir symlink to point to /var/lib/httpd (#1697662)
+- mod_reqtimeout: fix default values regression (PR 63325)
 
 * Tue Apr 02 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.39-2
 - update to 2.4.39

From db627365881ba25e590d64695738231fffcd8bc3 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 16 Apr 2019 09:10:28 +0100
Subject: [PATCH 164/359] - fix systemd_postun usage.

---
 httpd.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 52287af..cdd7ff1 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -546,7 +546,7 @@ exit 0
 %systemd_preun httpd.service htcacheclean.service httpd.socket
 
 %postun
-%systemd_postun
+%systemd_postun httpd.service htcacheclean.service httpd.socket
 
 # Trigger for conversion from SysV, per guidelines at:
 # https://fedoraproject.org/wiki/Packaging:ScriptletSnippets#Systemd

From bc95575bf53f74d3196619fc05f39332e7d731c7 Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Thu, 2 May 2019 14:46:02 +0000
Subject: [PATCH 165/359] httpd dependency on initscripts is unspecified
 (#1705188)

- substitute "service" cmd by "httpd" with -t arg

Resolves: #1705188
---
 apachectl.sh | 3 ++-
 httpd.spec   | 8 +++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/apachectl.sh b/apachectl.sh
index ee2dba8..77868fe 100755
--- a/apachectl.sh
+++ b/apachectl.sh
@@ -22,6 +22,7 @@ fi
 ACMD="$1"
 ARGV="$@"
 SVC='httpd.service'
+HTTPD='@HTTPDBIN@'
 
 if [ "x$2" != "x" ] ; then
     echo Passing arguments to httpd using apachectl is no longer supported.
@@ -49,7 +50,7 @@ graceful-stop)
     ERROR=$?
     ;;
 configtest)
-    /usr/sbin/service ${SVC/.service//} $ACMD
+    $HTTPD -t
     ERROR=$?
     ;;
 *)
diff --git a/httpd.spec b/httpd.spec
index cdd7ff1..00094c6 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.39
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -414,6 +414,9 @@ sed -i \
     s,@@Port@@,80,;" \
     docs/conf/extra/*.conf
 
+# Set correct path for httpd binary in apachectl script
+sed -i 's,@HTTPDBIN@,%{_sbindir}/httpd,g' $RPM_SOURCE_DIR/apachectl.sh
+
 # Create cache directory
 mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/cache/httpd \
          $RPM_BUILD_ROOT%{_localstatedir}/cache/httpd/proxy \
@@ -734,6 +737,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu May 02 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.39-4
+- httpd dependency on initscripts is unspecified (#1705188)
+
 * Tue Apr  9 2019 Joe Orton <jorton@redhat.com> - 2.4.39-3
 - fix statedir symlink to point to /var/lib/httpd (#1697662)
 - mod_reqtimeout: fix default values regression (PR 63325)

From 67d32a785dc7bd653e149066f242071bfcb5a315 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 12 Jun 2019 10:48:06 +0100
Subject: [PATCH 166/359] fixes for StateDir directive (upstream r1857731,
 r1857731)

---
 ...929+.patch => httpd-2.4.39-r1842929+.patch | 148 ++++++++++++------
 httpd.spec                                    |   7 +-
 2 files changed, 105 insertions(+), 50 deletions(-)
 rename httpd-2.4.37-r1842929+.patch => httpd-2.4.39-r1842929+.patch (75%)

diff --git a/httpd-2.4.37-r1842929+.patch b/httpd-2.4.39-r1842929+.patch
similarity index 75%
rename from httpd-2.4.37-r1842929+.patch
rename to httpd-2.4.39-r1842929+.patch
index e841e34..50f8aa1 100644
--- a/httpd-2.4.37-r1842929+.patch
+++ b/httpd-2.4.39-r1842929+.patch
@@ -1,10 +1,12 @@
-# ./pullrev.sh 1842929 1842931
+# ./pullrev.sh 1842929 1842931 1852982 1853631 1857731
 http://svn.apache.org/viewvc?view=revision&revision=1842929
 http://svn.apache.org/viewvc?view=revision&revision=1842931
 http://svn.apache.org/viewvc?view=revision&revision=1852982
+http://svn.apache.org/viewvc?view=revision&revision=1857731
+http://svn.apache.org/viewvc?view=revision&revision=1853631
 
---- httpd-2.4.38/acinclude.m4.r1842929+
-+++ httpd-2.4.38/acinclude.m4
+--- httpd-2.4.39/acinclude.m4.r1842929+
++++ httpd-2.4.39/acinclude.m4
 @@ -45,6 +45,7 @@
    APACHE_SUBST(installbuilddir)
    APACHE_SUBST(runtimedir)
@@ -21,8 +23,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1852982
  ])
  
  dnl 
---- httpd-2.4.38/config.layout.r1842929+
-+++ httpd-2.4.38/config.layout
+--- httpd-2.4.39/config.layout.r1842929+
++++ httpd-2.4.39/config.layout
 @@ -29,6 +29,7 @@
      includedir:    ${prefix}/include
      localstatedir: ${prefix}
@@ -143,8 +145,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1852982
      logfiledir:      ${localstatedir}/log/httpd
      proxycachedir:   ${localstatedir}/cache/httpd
  </Layout>
---- httpd-2.4.38/configure.in.r1842929+
-+++ httpd-2.4.38/configure.in
+--- httpd-2.4.39/configure.in.r1842929+
++++ httpd-2.4.39/configure.in
 @@ -41,7 +41,7 @@
  AC_PREFIX_DEFAULT(/usr/local/apache2)
  
@@ -154,8 +156,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1852982
  
  dnl reparse the configure arguments.
  APR_PARSE_ARGUMENTS
---- httpd-2.4.38/include/ap_config_layout.h.in.r1842929+
-+++ httpd-2.4.38/include/ap_config_layout.h.in
+--- httpd-2.4.39/include/ap_config_layout.h.in.r1842929+
++++ httpd-2.4.39/include/ap_config_layout.h.in
 @@ -60,5 +60,7 @@
  #define DEFAULT_REL_LOGFILEDIR "@rel_logfiledir@"
  #define DEFAULT_EXP_PROXYCACHEDIR "@exp_proxycachedir@"
@@ -164,8 +166,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1852982
 +#define DEFAULT_REL_STATEDIR "@rel_statedir@"
  
  #endif /* AP_CONFIG_LAYOUT_H */
---- httpd-2.4.38/include/http_config.h.r1842929+
-+++ httpd-2.4.38/include/http_config.h
+--- httpd-2.4.39/include/http_config.h.r1842929+
++++ httpd-2.4.39/include/http_config.h
 @@ -757,6 +757,14 @@
   */
  AP_DECLARE(char *) ap_runtime_dir_relative(apr_pool_t *p, const char *fname);
@@ -181,8 +183,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1852982
  /* Finally, the hook for dynamically loading modules in... */
  
  /**
---- httpd-2.4.38/Makefile.in.r1842929+
-+++ httpd-2.4.38/Makefile.in
+--- httpd-2.4.39/Makefile.in.r1842929+
++++ httpd-2.4.39/Makefile.in
 @@ -213,6 +213,7 @@
  install-other:
  	@test -d $(DESTDIR)$(logfiledir) || $(MKINSTALLDIRS) $(DESTDIR)$(logfiledir)
@@ -191,8 +193,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1852982
  	@for ext in dll x; do \
  		file=apachecore.$$ext; \
  		if test -f $$file; then \
---- httpd-2.4.38/modules/dav/fs/mod_dav_fs.c.r1842929+
-+++ httpd-2.4.38/modules/dav/fs/mod_dav_fs.c
+--- httpd-2.4.39/modules/dav/fs/mod_dav_fs.c.r1842929+
++++ httpd-2.4.39/modules/dav/fs/mod_dav_fs.c
 @@ -29,6 +29,10 @@
  
  extern module AP_MODULE_DECLARE_DATA dav_fs_module;
@@ -204,22 +206,43 @@ http://svn.apache.org/viewvc?view=revision&revision=1852982
  const char *dav_get_lockdb_path(const request_rec *r)
  {
      dav_fs_server_conf *conf;
-@@ -39,7 +43,11 @@
- 
- static void *dav_fs_create_server_config(apr_pool_t *p, server_rec *s)
- {
--    return apr_pcalloc(p, sizeof(dav_fs_server_conf));
-+    dav_fs_server_conf *conf = apr_pcalloc(p, sizeof(dav_fs_server_conf));
-+
-+    conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB);
-+
-+    return conf;
+@@ -57,6 +61,24 @@
+     return newconf;
  }
  
- static void *dav_fs_merge_server_config(apr_pool_t *p,
---- httpd-2.4.38/modules/md/mod_md_config.c.r1842929+
-+++ httpd-2.4.38/modules/md/mod_md_config.c
-@@ -54,10 +54,14 @@
++static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog,
++                                       apr_pool_t *ptemp, server_rec *base_server)
++{
++    server_rec *s;
++
++    for (s = base_server; s; s = s->next) {
++        dav_fs_server_conf *conf;
++
++        conf = ap_get_module_config(s->module_config, &dav_fs_module);
++
++        if (!conf->lockdb_path) {
++            conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB);
++        }
++    }
++
++    return OK;
++}
++
+ /*
+  * Command handler for the DAVLockDB directive, which is TAKE1
+  */
+@@ -87,6 +109,8 @@
+ 
+ static void register_hooks(apr_pool_t *p)
+ {
++    ap_hook_post_config(dav_fs_post_config, NULL, NULL, APR_HOOK_MIDDLE);
++
+     dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL,
+                              APR_HOOK_MIDDLE);
+     dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE);
+--- httpd-2.4.39/modules/md/mod_md_config.c.r1842929+
++++ httpd-2.4.39/modules/md/mod_md_config.c
+@@ -54,10 +54,18 @@
  
  #define DEF_VAL     (-1)
  
@@ -231,20 +254,29 @@ http://svn.apache.org/viewvc?view=revision&revision=1852982
  static md_mod_conf_t defmc = {
      NULL,
 -    "md",
-+    NULL,
++#if 1
++    NULL, /* apply default state-dir-relative */
++#else
++    MD_DEFAULT_BASE_DIR,
++#endif
      NULL,
      NULL,
      80,
-@@ -112,6 +116,7 @@
-         memcpy(mod_md_config, &defmc, sizeof(*mod_md_config));
-         mod_md_config->mds = apr_array_make(pool, 5, sizeof(const md_t *));
-         mod_md_config->unused_names = apr_array_make(pool, 5, sizeof(const md_t *));
-+        mod_md_config->base_dir = ap_state_dir_relative(pool, MD_DEFAULT_BASE_DIR);
-         
-         apr_pool_cleanup_register(pool, NULL, cleanup_mod_config, apr_pool_cleanup_null);
+@@ -864,6 +872,12 @@
+     if (mc->hsts_max_age > 0) {
+         mc->hsts_header = apr_psprintf(p, "max-age=%d", mc->hsts_max_age);
      }
---- httpd-2.4.38/server/core.c.r1842929+
-+++ httpd-2.4.38/server/core.c
++
++#if 1
++    if (mc->base_dir == NULL) {
++        mc->base_dir = ap_state_dir_relative(p, MD_DEFAULT_BASE_DIR);
++    }
++#endif
+     
+     return APR_SUCCESS;
+ }
+--- httpd-2.4.39/server/core.c.r1842929+
++++ httpd-2.4.39/server/core.c
 @@ -129,6 +129,8 @@
  AP_DECLARE_DATA int ap_run_mode = AP_SQ_RM_UNKNOWN;
  AP_DECLARE_DATA int ap_config_generation = 0;
@@ -254,7 +286,25 @@ http://svn.apache.org/viewvc?view=revision&revision=1852982
  static void *create_core_dir_config(apr_pool_t *a, char *dir)
  {
      core_dir_config *conf;
-@@ -3104,6 +3106,24 @@
+@@ -1409,12 +1411,15 @@
+     return res_buf;
+ }
+ 
+-static int reset_config_defines(void *dummy)
++/* pconf cleanup - clear global variables set from config here. */
++static apr_status_t reset_config(void *dummy)
+ {
+     ap_server_config_defines = saved_server_config_defines;
+     saved_server_config_defines = NULL;
+     server_config_defined_vars = NULL;
+-    return OK;
++    core_state_dir = NULL;
++
++    return APR_SUCCESS;
+ }
+ 
+ /*
+@@ -3113,6 +3118,24 @@
      return NULL;
  }
  
@@ -279,7 +329,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1852982
  static const char *set_timeout(cmd_parms *cmd, void *dummy, const char *arg)
  {
      const char *err = ap_check_cmd_context(cmd, NOT_IN_DIR_CONTEXT);
-@@ -4398,6 +4418,8 @@
+@@ -4407,6 +4430,8 @@
    "Common directory of server-related files (logs, confs, etc.)"),
  AP_INIT_TAKE1("DefaultRuntimeDir", set_runtime_dir, NULL, RSRC_CONF | EXEC_ON_READ,
    "Common directory for run-time files (shared memory, locks, etc.)"),
@@ -288,15 +338,17 @@ http://svn.apache.org/viewvc?view=revision&revision=1852982
  AP_INIT_TAKE1("ErrorLog", set_server_string_slot,
    (void *)APR_OFFSETOF(server_rec, error_fname), RSRC_CONF,
    "The filename of the error log"),
-@@ -4927,6 +4949,7 @@
+@@ -4934,8 +4959,7 @@
+ 
+     if (!saved_server_config_defines)
+         init_config_defines(pconf);
+-    apr_pool_cleanup_register(pconf, NULL, reset_config_defines,
+-                              apr_pool_cleanup_null);
++    apr_pool_cleanup_register(pconf, NULL, reset_config, apr_pool_cleanup_null);
+ 
      ap_regcomp_set_default_cflags(AP_REG_DOLLAR_ENDONLY);
  
-     mpm_common_pre_config(pconf);
-+    core_state_dir = NULL;
- 
-     return OK;
- }
-@@ -5150,6 +5173,27 @@
+@@ -5163,6 +5187,27 @@
      }
  }
  
diff --git a/httpd.spec b/httpd.spec
index 00094c6..9351fde 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.39
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -63,7 +63,7 @@ Patch3: httpd-2.4.1-deplibs.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
-Patch21: httpd-2.4.37-r1842929+.patch
+Patch21: httpd-2.4.39-r1842929+.patch
 Patch23: httpd-2.4.33-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
@@ -737,6 +737,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Jun 12 2019 Joe Orton <jorton@redhat.com> - 2.4.39-5
+- fixes for StateDir directive (upstream r1857731, r1857731)
+
 * Thu May 02 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.39-4
 - httpd dependency on initscripts is unspecified (#1705188)
 

From 720c6f392bad265bb6f9b8be05d2a8de536b3289 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 13 Jun 2019 16:37:06 +0100
Subject: [PATCH 167/359] mod_ssl: fix "httpd -L" (etc) before
 httpd-init.service runs

---
 httpd-2.4.39-r1861269.patch | 24 ++++++++++++++++++++++++
 httpd.spec                  |  7 ++++++-
 2 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.39-r1861269.patch

diff --git a/httpd-2.4.39-r1861269.patch b/httpd-2.4.39-r1861269.patch
new file mode 100644
index 0000000..4142e3c
--- /dev/null
+++ b/httpd-2.4.39-r1861269.patch
@@ -0,0 +1,24 @@
+# ./pullrev.sh r1861269
+http://svn.apache.org/viewvc?view=revision&revision=r1861269
+
+Allows "httpd -L" etc to work before httpd-init.service has run,
+if mod_ssl is installed.
+
+--- httpd-2.4.37/modules/ssl/ssl_engine_config.c
++++ httpd-2.4.37/modules/ssl/ssl_engine_config.c
+@@ -904,8 +904,14 @@
+ static const char *ssl_cmd_check_file(cmd_parms *parms,
+                                       const char **file)
+ {
+-    const char *filepath = ap_server_root_relative(parms->pool, *file);
++    const char *filepath;
+ 
++    /* If only dumping the config, don't verify the paths */
++    if (ap_state_query(AP_SQ_RUN_MODE) == AP_SQ_RM_CONFIG_DUMP) {
++        return NULL;
++    }
++
++    filepath = ap_server_root_relative(parms->pool, *file);
+     if (!filepath) {
+         return apr_pstrcat(parms->pool, parms->cmd->name,
+                            ": Invalid file path ", *file, NULL);
diff --git a/httpd.spec b/httpd.spec
index 9351fde..ab05228 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.39
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -76,6 +76,7 @@ Patch34: httpd-2.4.17-socket-activation.patch
 Patch36: httpd-2.4.38-r1830819+.patch
 Patch38: httpd-2.4.34-sslciphdefault.patch
 Patch39: httpd-2.4.37-sslprotdefault.patch
+Patch40: httpd-2.4.39-r1861269.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -227,6 +228,7 @@ interface for storing and accessing per-user session data.
 %patch36 -p1 -b .r1830819+
 %patch38 -p1 -b .sslciphdefault
 %patch39 -p1 -b .sslprotdefault
+%patch40 -p1 -b .r1861269
 
 %patch58 -p1 -b .r1738878
 %patch60 -p1 -b .enable-sslv3
@@ -737,6 +739,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jun 13 2019 Joe Orton <jorton@redhat.com> - 2.4.39-6
+- mod_ssl: fix "httpd -L" (etc) before httpd-init.service runs
+
 * Wed Jun 12 2019 Joe Orton <jorton@redhat.com> - 2.4.39-5
 - fixes for StateDir directive (upstream r1857731, r1857731)
 

From e945a601cafc320679bffd9d3a2d75e4b3a5c4ff Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Thu, 13 Jun 2019 17:38:40 +0200
Subject: [PATCH 168/359] Removed bundled mod_md

---
 01-md.conf |  1 -
 httpd.spec | 28 ++++++----------------------
 2 files changed, 6 insertions(+), 23 deletions(-)
 delete mode 100644 01-md.conf

diff --git a/01-md.conf b/01-md.conf
deleted file mode 100644
index 2739202..0000000
--- a/01-md.conf
+++ /dev/null
@@ -1 +0,0 @@
-LoadModule md_module modules/mod_md.so
diff --git a/httpd.spec b/httpd.spec
index 9351fde..06e7af5 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.39
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -44,7 +44,6 @@ Source25: 01-session.conf
 Source26: 10-listen443.conf
 Source27: httpd.socket
 Source28: 00-optional.conf
-Source29: 01-md.conf
 Source30: README.confd
 Source31: README.confmod
 Source32: httpd.service.xml
@@ -167,18 +166,6 @@ The mod_ssl module provides strong cryptography for the Apache Web
 server via the Secure Sockets Layer (SSL) and Transport Layer
 Security (TLS) protocols.
 
-%package -n mod_md
-Summary: Certificate provisioning using ACME for the Apache HTTP Server
-Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
-BuildRequires: jansson-devel, libcurl-devel
-
-%description -n mod_md
-This module manages common properties of domains for one or more
-virtual hosts. Specifically it can use the ACME protocol (RFC Draft)
-to automate certificate provisioning. These will be configured for
-managed domains and their virtual hosts automatically. This includes
-renewal of certificates before they expire.
-
 %package -n mod_proxy_html
 Summary: HTML and XML content filters for the Apache HTTP Server
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
@@ -328,6 +315,7 @@ export LYNX_PATH=/usr/bin/links
         --enable-authn-anon --enable-authn-alias \
         --disable-imagemap --disable-file-cache \
         --disable-http2 \
+        --disable-md \
 	$*
 make %{?_smp_mflags}
 
@@ -353,8 +341,7 @@ install -m 644 $RPM_SOURCE_DIR/README.confmod \
     $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/README
 for f in 00-base.conf 00-mpm.conf 00-lua.conf 01-cgi.conf 00-dav.conf \
          00-proxy.conf 00-ssl.conf 01-ldap.conf 00-proxyhtml.conf \
-         01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf \
-         01-md.conf; do
+         01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf; do
   install -m 644 -p $RPM_SOURCE_DIR/$f \
         $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/$f
 done
@@ -621,7 +608,6 @@ exit $rv
 %exclude %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/01-ldap.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
-%exclude %{_sysconfdir}/httpd/conf.modules.d/01-md.conf
 
 %config(noreplace) %{_sysconfdir}/sysconfig/htcacheclean
 %ghost %{_sysconfdir}/sysconfig/httpd
@@ -641,7 +627,6 @@ exit $rv
 %{_libdir}/httpd/modules/mod*.so
 %exclude %{_libdir}/httpd/modules/mod_auth_form.so
 %exclude %{_libdir}/httpd/modules/mod_ssl.so
-%exclude %{_libdir}/httpd/modules/mod_md.so
 %exclude %{_libdir}/httpd/modules/mod_*ldap.so
 %exclude %{_libdir}/httpd/modules/mod_proxy_html.so
 %exclude %{_libdir}/httpd/modules/mod_xml2enc.so
@@ -723,10 +708,6 @@ exit $rv
 %{_libdir}/httpd/modules/mod_auth_form.so
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
 
-%files -n mod_md
-%{_libdir}/httpd/modules/mod_md.so
-%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-md.conf
-
 %files devel
 %{_includedir}/httpd
 %{_bindir}/apxs
@@ -737,6 +718,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jun 13 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.39-6
+- remove bundled mod_md module
+
 * Wed Jun 12 2019 Joe Orton <jorton@redhat.com> - 2.4.39-5
 - fixes for StateDir directive (upstream r1857731, r1857731)
 

From 10963a8dadf029141ca95f45c0bf5c622d98ab9b Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 20 Jun 2019 11:52:17 +0100
Subject: [PATCH 169/359] remove superfluous ap_hack_ symbols from httpd binary
 more verbose %check section

---
 httpd-2.4.33-export.patch | 20 --------------
 httpd-2.4.39-export.patch | 58 +++++++++++++++++++++++++++++++++++++++
 httpd.spec                | 41 +++++++++++++++++++++------
 3 files changed, 90 insertions(+), 29 deletions(-)
 delete mode 100644 httpd-2.4.33-export.patch
 create mode 100644 httpd-2.4.39-export.patch

diff --git a/httpd-2.4.33-export.patch b/httpd-2.4.33-export.patch
deleted file mode 100644
index 9adf398..0000000
--- a/httpd-2.4.33-export.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-
-There is no need to "suck in" the apr/apr-util symbols when using
-a shared libapr{,util}, it just bloats the symbol table; so don't.
-
-Upstream-HEAD: needed
-Upstream-2.0: omit
-Upstream-Status: EXPORT_DIRS change is conditional on using shared apr
-
---- httpd-2.4.33/server/Makefile.in.export
-+++ httpd-2.4.33/server/Makefile.in
-@@ -60,9 +60,6 @@
- 	      ls $$dir/*.h ; \
- 	  done; \
- 	  echo "$(top_srcdir)/server/mpm_fdqueue.h"; \
--	  for dir in $(EXPORT_DIRS_APR); do \
--	      ls $$dir/ap[ru].h $$dir/ap[ru]_*.h 2>/dev/null; \
--	  done; \
- 	) | sed -e s,//,/,g | sort -u > $@
- 
- exports.c: export_files
diff --git a/httpd-2.4.39-export.patch b/httpd-2.4.39-export.patch
new file mode 100644
index 0000000..e343b22
--- /dev/null
+++ b/httpd-2.4.39-export.patch
@@ -0,0 +1,58 @@
+
+Reduce size of httpd binary by telling linker to export all symbols
+from libmain.a, rather than bloating the symbol table with ap_hack_*
+to do so indirectly.
+
+Upstream-HEAD: needed
+Upstream-2.0: omit
+
+--- httpd-2.4.39/Makefile.in.export
++++ httpd-2.4.39/Makefile.in
+@@ -4,8 +4,15 @@
+ 
+ PROGRAM_NAME         = $(progname)
+ PROGRAM_SOURCES      = modules.c
+-PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
++PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) \
++	$(PROGRAM_LDDEPS)  \
++	$(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
+ PROGRAM_PRELINK      = $(COMPILE) -c $(top_srcdir)/server/buildmark.c
++PROGRAM_LDDEPS = \
++  $(BUILTIN_LIBS) \
++  $(MPM_LIB) \
++  -Wl,--whole-archive,server/.libs/libmain.a,--no-whole-archive \
++  os/$(OS_DIR)/libos.la
+ PROGRAM_DEPENDENCIES = \
+   server/libmain.la \
+   $(BUILTIN_LIBS) \
+--- httpd-2.4.39/server/main.c.export
++++ httpd-2.4.39/server/main.c
+@@ -835,17 +835,3 @@
+     return !OK;
+ }
+ 
+-#ifdef AP_USING_AUTOCONF
+-/* This ugly little hack pulls any function referenced in exports.c into
+- * the web server.  exports.c is generated during the build, and it
+- * has all of the APR functions specified by the apr/apr.exports and
+- * apr-util/aprutil.exports files.
+- */
+-const void *ap_suck_in_APR(void);
+-const void *ap_suck_in_APR(void)
+-{
+-    extern const void *ap_ugly_hack;
+-
+-    return ap_ugly_hack;
+-}
+-#endif
+--- httpd-2.4.39/server/Makefile.in.export
++++ httpd-2.4.39/server/Makefile.in
+@@ -12,7 +12,7 @@
+ 	connection.c listen.c util_mutex.c \
+ 	mpm_common.c mpm_unix.c mpm_fdqueue.c \
+ 	util_charset.c util_cookies.c util_debug.c util_xml.c \
+-	util_filter.c util_pcre.c util_regex.c exports.c \
++	util_filter.c util_pcre.c util_regex.c \
+ 	scoreboard.c error_bucket.c protocol.c core.c request.c provider.c \
+ 	eoc_bucket.c eor_bucket.c core_filters.c \
+ 	util_expr_parse.c util_expr_scan.c util_expr_eval.c
diff --git a/httpd.spec b/httpd.spec
index 40af3b5..860f8af 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.39
-Release: 7%{?dist}
+Release: 8%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -63,7 +63,7 @@ Patch3: httpd-2.4.1-deplibs.patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
 Patch21: httpd-2.4.39-r1842929+.patch
-Patch23: httpd-2.4.33-export.patch
+Patch23: httpd-2.4.39-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
 Patch26: httpd-2.4.4-r1337344+.patch
@@ -556,19 +556,36 @@ test -f /etc/sysconfig/httpd-disable-posttrans || \
   /bin/systemctl try-restart --no-block httpd.service htcacheclean.service >/dev/null 2>&1 || :
 
 %check
-# Check the built modules are all PIC
-if readelf -d $RPM_BUILD_ROOT%{_libdir}/httpd/modules/*.so | grep TEXTREL; then
-   : modules contain non-relocatable code
-   exit 1
-fi
+make -C server exports.o
+nm --defined httpd > exports-actual.list
 set +x
 rv=0
+nm --defined-only server/exports.o | \
+  sed -n '/ap_hack_/{s/.* ap_hack_//;/^ap[ru]/d;p;}' | \
+  while read sym; do
+    if ! grep -q " "$sym\$ exports-actual.list; then
+     echo ERROR: Symbol $sym missing in httpd exports
+     rv=1
+    fi
+  done
+if [ $rv -eq 0 ]; then
+  echo PASS: Symbol export list verified.
+fi
+# Check the built modules are all PIC
+if readelf -d $RPM_BUILD_ROOT%{_libdir}/httpd/modules/*.so | grep TEXTREL; then
+   echo FAIL: Modules contain non-relocatable code
+   rv=1
+else
+   echo PASS: No non-relocatable code in module builds
+fi
 # Ensure every mod_* that's built is loaded.
 for f in $RPM_BUILD_ROOT%{_libdir}/httpd/modules/*.so; do
   m=${f##*/}
   if ! grep -q $m $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/*.conf; then
-    echo ERROR: Module $m not configured.  Disable it, or load it.
+    echo FAIL: Module $m not configured.  Disable it, or load it.
     rv=1
+   else
+    echo PASS: Module $m is configured and loaded.
   fi
 done
 # Ensure every loaded mod_* is actually built
@@ -576,8 +593,10 @@ mods=`grep -h ^LoadModule $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/*.c
 for m in $mods; do
   f=$RPM_BUILD_ROOT%{_libdir}/httpd/modules/${m}
   if ! test -x $f; then
-    echo ERROR: Module $m is configured but not built.
+    echo FAIL: Module $m is configured but not built.
     rv=1
+  else
+    echo PASS: Loaded module $m is installed.
   fi
 done
 set -x
@@ -720,6 +739,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jun 20 2019 Joe Orton <jorton@redhat.com> - 2.4.39-8
+- remove superfluous ap_hack_ symbols from httpd binary
+- more verbose %%check section
+
 * Thu Jun 13 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.39-7
 - remove bundled mod_md module
 

From eb4dbe737f56b6380c7a69d5a65f9ef40ab390ca Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 20 Jun 2019 15:41:26 +0100
Subject: [PATCH 170/359] Now upstream though in a more complicated way which
 is opt-in.

---
 httpd-2.4.39-export.patch | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/httpd-2.4.39-export.patch b/httpd-2.4.39-export.patch
index e343b22..b20a6e7 100644
--- a/httpd-2.4.39-export.patch
+++ b/httpd-2.4.39-export.patch
@@ -3,8 +3,7 @@ Reduce size of httpd binary by telling linker to export all symbols
 from libmain.a, rather than bloating the symbol table with ap_hack_*
 to do so indirectly.
 
-Upstream-HEAD: needed
-Upstream-2.0: omit
+Upstream: https://svn.apache.org/r1861685 (as new default-off configure option)
 
 --- httpd-2.4.39/Makefile.in.export
 +++ httpd-2.4.39/Makefile.in

From b18b77bc684aac41fe1a9b8c1dc8d491fe051045 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 21 Jun 2019 09:00:52 +0100
Subject: [PATCH 171/359] create instance-specific StateDir in httpd@.service,
 instance.conf

---
 httpd.spec     | 5 ++++-
 httpd@.service | 2 ++
 instance.conf  | 5 +++--
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 860f8af..32cb463 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.39
-Release: 8%{?dist}
+Release: 9%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -739,6 +739,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jun 21 2019 Joe Orton <jorton@redhat.com> - 2.4.39-9
+- create instance-specific StateDir in httpd@.service, instance.conf
+
 * Thu Jun 20 2019 Joe Orton <jorton@redhat.com> - 2.4.39-8
 - remove superfluous ap_hack_ symbols from httpd binary
 - more verbose %%check section
diff --git a/httpd@.service b/httpd@.service
index c58ae88..7649dff 100644
--- a/httpd@.service
+++ b/httpd@.service
@@ -12,6 +12,8 @@ Environment=LANG=C
 Environment=HTTPD_INSTANCE=%i
 ExecStartPre=/bin/mkdir -m 710 -p /run/httpd/instance-%i
 ExecStartPre=/bin/chown root.apache /run/httpd/instance-%i
+ExecStartPre=/bin/mkdir -m 700 -p /var/lib/httpd/instance-%i
+ExecStartPre=/bin/chown apache.apache /var/lib/httpd/instance-%i
 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND -f conf/%i.conf
 ExecReload=/usr/sbin/httpd $OPTIONS -k graceful -f conf/%i.conf
 # Send SIGWINCH for graceful stop
diff --git a/instance.conf b/instance.conf
index f2b03f7..074fb66 100644
--- a/instance.conf
+++ b/instance.conf
@@ -1,6 +1,6 @@
 #
 # This is an example instance-specific configuration file. See the
-# httpd.service(8) man page for detailed information on using the
+# httpd@.service(8) man page for detailed information on using the
 # the httpd@.service with instances.
 #
 # To use this example, copy instance.conf to /etc/httpd/conf/foobar.conf
@@ -10,7 +10,7 @@
 #   # systemctl start httpd@foobar.service
 #
 # The changes compared to the default are:
-# - DefaultRuntime and Pidfile renamed to be instance-specific
+# - DefaultRuntime, DefaultStateDir and Pidfile renamed to instance-specific
 # - default logfile names are prefixed with the instance name
 # - /etc/httpd/conf.d is NOT included by default (conf.modules.d still is)
 #
@@ -20,4 +20,5 @@
 #
 
 DefaultRuntimeDir /run/httpd/instance-${HTTPD_INSTANCE}
+DefaultStateDir /var/lib/httpd/instance-${HTTPD_INSTANCE}
 PidFile /run/httpd/instance-${HTTPD_INSTANCE}.pid

From 4d2ffdca914614be62ba75e12fea4452f8d93667 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 8 Jul 2019 09:06:38 +0100
Subject: [PATCH 172/359] Use mod_cgid for any non-prefork MPM.

---
 01-cgi.conf | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/01-cgi.conf b/01-cgi.conf
index 5b8b936..4b680cf 100644
--- a/01-cgi.conf
+++ b/01-cgi.conf
@@ -2,10 +2,7 @@
 # which has been configured in 00-mpm.conf.  mod_cgid should be used
 # with a threaded MPM; mod_cgi with the prefork MPM.
 
-<IfModule mpm_worker_module>
-   LoadModule cgid_module modules/mod_cgid.so
-</IfModule>
-<IfModule mpm_event_module>
+<IfModule !mpm_prefork_module>
    LoadModule cgid_module modules/mod_cgid.so
 </IfModule>
 <IfModule mpm_prefork_module>

From 2ae67b32b199fc1b8339a068b502a863e44744fd Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 8 Jul 2019 09:18:33 +0100
Subject: [PATCH 173/359] htpasswd: add SHA-256/512 support

---
 httpd-2.4.37-r1861793+.patch | 270 +++++++++++++++++++++++++++++++++++
 httpd.spec                   |   7 +-
 2 files changed, 276 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.37-r1861793+.patch

diff --git a/httpd-2.4.37-r1861793+.patch b/httpd-2.4.37-r1861793+.patch
new file mode 100644
index 0000000..c522c7c
--- /dev/null
+++ b/httpd-2.4.37-r1861793+.patch
@@ -0,0 +1,270 @@
+# ./pullrev.sh 1861793 1862611 1862612
+http://svn.apache.org/viewvc?view=revision&revision=1861793
+
+http://svn.apache.org/viewvc?view=revision&revision=1862611
+http://svn.apache.org/viewvc?view=revision&revision=1862612
+
+--- httpd-2.4.37/configure.in
++++ httpd-2.4.37/configure.in
+@@ -500,6 +500,28 @@
+ AC_SEARCH_LIBS(crypt, crypt)
+ CRYPT_LIBS="$LIBS"
+ APACHE_SUBST(CRYPT_LIBS)
++
++if test "$ac_cv_search_crypt" != "no"; then
++   # Test crypt() with the SHA-512 test vector from https://akkadia.org/drepper/SHA-crypt.txt
++   AC_CACHE_CHECK([whether crypt() supports SHA-2], [ap_cv_crypt_sha2], [
++    AC_RUN_IFELSE([AC_LANG_PROGRAM([[
++#include <crypt.h>
++#include <stdlib.h>
++#include <string.h>
++
++#define PASSWD_0 "Hello world!"
++#define SALT_0 "\$6\$saltstring"
++#define EXPECT_0 "\$6\$saltstring\$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjnQJu" \
++               "esI68u4OTLiBFdcbYEdFCoEOfaS35inz1"
++]], [char *result = crypt(PASSWD_0, SALT_0);
++     if (!result) return 1;
++     if (strcmp(result, EXPECT_0)) return 2;
++])], [ap_cv_crypt_sha2=yes], [ap_cv_crypt_sha2=no])])
++   if test "$ap_cv_crypt_sha2" = yes; then
++     AC_DEFINE([HAVE_CRYPT_SHA2], 1, [Define if crypt() supports SHA-2 hashes])
++   fi
++fi
++
+ LIBS="$saved_LIBS"
+ 
+ dnl See Comment #Spoon
+--- httpd-2.4.37/support/htpasswd.c
++++ httpd-2.4.37/support/htpasswd.c
+@@ -109,17 +109,21 @@
+             "for it." NL
+         " -i  Read password from stdin without verification (for script usage)." NL
+         " -m  Force MD5 encryption of the password (default)." NL
+-        " -B  Force bcrypt encryption of the password (very secure)." NL
++        " -2  Force SHA-256 crypt() hash of the password (very secure)." NL
++        " -5  Force SHA-512 crypt() hash of the password (very secure)." NL
++        " -B  Force bcrypt aencryption of the password (very secure)." NL
+         " -C  Set the computing time used for the bcrypt algorithm" NL
+         "     (higher is more secure but slower, default: %d, valid: 4 to 31)." NL
++        " -r  Set the number of rounds used for the SHA-256, SHA-512 algorithms" NL
++        "     (higher is more secure but slower, default: 5000)." NL
+         " -d  Force CRYPT encryption of the password (8 chars max, insecure)." NL
+-        " -s  Force SHA encryption of the password (insecure)." NL
++        " -s  Force SHA-1 encryption of the password (insecure)." NL
+         " -p  Do not encrypt the password (plaintext, insecure)." NL
+         " -D  Delete the specified user." NL
+         " -v  Verify password for the specified user." NL
+         "On other systems than Windows and NetWare the '-p' flag will "
+             "probably not work." NL
+-        "The SHA algorithm does not use a salt and is less secure than the "
++        "The SHA-1 algorithm does not use a salt and is less secure than the "
+             "MD5 algorithm." NL,
+         BCRYPT_DEFAULT_COST
+     );
+@@ -178,7 +182,7 @@
+     if (rv != APR_SUCCESS)
+         exit(ERR_SYNTAX);
+ 
+-    while ((rv = apr_getopt(state, "cnmspdBbDiC:v", &opt, &opt_arg)) == APR_SUCCESS) {
++    while ((rv = apr_getopt(state, "cnmspdBbDi25C:r:v", &opt, &opt_arg)) == APR_SUCCESS) {
+         switch (opt) {
+         case 'c':
+             *mask |= APHTP_NEWFILE;
+--- httpd-2.4.37/support/passwd_common.c
++++ httpd-2.4.37/support/passwd_common.c
+@@ -185,10 +185,15 @@
+ #if CRYPT_ALGO_SUPPORTED
+     char *cbuf;
+ #endif
++#ifdef HAVE_CRYPT_SHA2
++    const char *setting;
++    char method;
++#endif
+ 
+-    if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT) {
++    if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT
++        && ctx->alg != ALG_CRYPT_SHA256 && ctx->alg != ALG_CRYPT_SHA512 ) {
+         apr_file_printf(errfile,
+-                        "Warning: Ignoring -C argument for this algorithm." NL);
++                        "Warning: Ignoring -C/-r argument for this algorithm." NL);
+     }
+ 
+     if (ctx->passwd == NULL) {
+@@ -246,6 +251,34 @@
+         break;
+ #endif /* CRYPT_ALGO_SUPPORTED */
+ 
++#ifdef HAVE_CRYPT_SHA2
++    case ALG_CRYPT_SHA256:
++    case ALG_CRYPT_SHA512:
++        ret = generate_salt(salt, 16, &ctx->errstr, ctx->pool);
++        if (ret != 0)
++            break;
++
++        method = ctx->alg == ALG_CRYPT_SHA256 ? '5': '6';
++
++        if (ctx->cost) 
++            setting = apr_psprintf(ctx->pool, "$%c$rounds=%d$%s",
++                                   method, ctx->cost, salt);
++        else
++            setting = apr_psprintf(ctx->pool, "$%c$%s",
++                                   method, salt);
++
++        cbuf = crypt(pw, setting);
++        if (cbuf == NULL) {
++            rv = APR_FROM_OS_ERROR(errno);
++            ctx->errstr = apr_psprintf(ctx->pool, "crypt() failed: %pm", &rv);
++            ret = ERR_PWMISMATCH;
++            break;
++        }
++
++        apr_cpystrn(ctx->out, cbuf, ctx->out_len - 1);
++        break;
++#endif /* HAVE_CRYPT_SHA2 */
++
+ #if BCRYPT_ALGO_SUPPORTED
+     case ALG_BCRYPT:
+         rv = apr_generate_random_bytes((unsigned char*)salt, 16);
+@@ -294,6 +327,19 @@
+     case 's':
+         ctx->alg = ALG_APSHA;
+         break;
++#ifdef HAVE_CRYPT_SHA2
++    case '2':
++        ctx->alg = ALG_CRYPT_SHA256;
++        break;
++    case '5':
++        ctx->alg = ALG_CRYPT_SHA512;
++        break;
++#else
++    case '2':
++    case '5':
++        ctx->errstr = "SHA-2 crypt() algorithms are not supported on this platform.";
++        return ERR_ALG_NOT_SUPP;
++#endif
+     case 'p':
+         ctx->alg = ALG_PLAIN;
+ #if !PLAIN_ALGO_SUPPORTED
+@@ -324,11 +370,12 @@
+         return ERR_ALG_NOT_SUPP;
+ #endif
+         break;
+-    case 'C': {
++    case 'C':
++    case 'r': {
+             char *endptr;
+             long num = strtol(opt_arg, &endptr, 10);
+             if (*endptr != '\0' || num <= 0) {
+-                ctx->errstr = "argument to -C must be a positive integer";
++                ctx->errstr = "argument to -C/-r must be a positive integer";
+                 return ERR_SYNTAX;
+             }
+             ctx->cost = num;
+--- httpd-2.4.37/support/passwd_common.h
++++ httpd-2.4.37/support/passwd_common.h
+@@ -28,6 +28,8 @@
+ #include "apu_version.h"
+ #endif
+ 
++#include "ap_config_auto.h"
++
+ #define MAX_STRING_LEN 256
+ 
+ #define ALG_PLAIN 0
+@@ -35,6 +37,8 @@
+ #define ALG_APMD5 2
+ #define ALG_APSHA 3
+ #define ALG_BCRYPT 4
++#define ALG_CRYPT_SHA256 5
++#define ALG_CRYPT_SHA512 6
+ 
+ #define BCRYPT_DEFAULT_COST 5
+ 
+@@ -84,7 +88,7 @@
+     apr_size_t      out_len;
+     char            *passwd;
+     int             alg;
+-    int             cost;
++    int             cost; /* cost for bcrypt, rounds for SHA-2 */
+     enum {
+         PW_PROMPT = 0,
+         PW_ARG,
+--- httpd-2.4.37/docs/man/htpasswd.1
++++ httpd-2.4.37/docs/man/htpasswd.1
+@@ -27,16 +27,16 @@
+ .SH "SYNOPSIS"
+  
+ .PP
+-\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR
++\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR
+  
+ .PP
+-\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR
++\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR
+  
+ .PP
+-\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR
++\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR
+  
+ .PP
+-\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR
++\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR
+  
+ 
+ .SH "SUMMARY"
+@@ -48,7 +48,7 @@
+ Resources available from the Apache HTTP server can be restricted to just the users listed in the files created by \fBhtpasswd\fR\&. This program can only manage usernames and passwords stored in a flat-file\&. It can encrypt and display password information for use in other types of data stores, though\&. To use a DBM database see dbmmanage or htdbm\&.
+  
+ .PP
+-\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA1, or the system's \fBcrypt()\fR routine\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&.
++\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA-1, or the system's \fBcrypt()\fR routine\&. SHA-2-based hashes (SHA-256 and SHA-512) are supported for \fBcrypt()\fR\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&.
+  
+ .PP
+ This manual page only lists the command line arguments\&. For details of the directives necessary to configure user authentication in httpd see the Apache manual, which is part of the Apache distribution or can be found at http://httpd\&.apache\&.org/\&.
+@@ -73,6 +73,12 @@
+ \fB-m\fR
+ Use MD5 encryption for passwords\&. This is the default (since version 2\&.2\&.18)\&.  
+ .TP
++\fB-2\fR
++Use SHA-256 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&.  
++.TP
++\fB-5\fR
++Use SHA-512 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&.  
++.TP
+ \fB-B\fR
+ Use bcrypt encryption for passwords\&. This is currently considered to be very secure\&.  
+ .TP
+@@ -79,11 +85,14 @@
+ \fB-C\fR
+ This flag is only allowed in combination with \fB-B\fR (bcrypt encryption)\&. It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 31)\&.  
+ .TP
++\fB-r\fR
++This flag is only allowed in combination with \fB-2\fR or \fB-5\fR\&. It sets the number of hash rounds used for the SHA-2 algorithms (higher is more secure but slower; the default is 5,000)\&.  
++.TP
+ \fB-d\fR
+ Use \fBcrypt()\fR encryption for passwords\&. This is not supported by the httpd server on Windows and Netware\&. This algorithm limits the password length to 8 characters\&. This algorithm is \fBinsecure\fR by today's standards\&. It used to be the default algorithm until version 2\&.2\&.17\&.  
+ .TP
+ \fB-s\fR
+-Use SHA encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&.  
++Use SHA-1 (160-bit) encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&.  
+ .TP
+ \fB-p\fR
+ Use plaintext passwords\&. Though \fBhtpasswd\fR will support creation on all platforms, the httpd daemon will only accept plain text passwords on Windows and Netware\&.  
+@@ -152,11 +161,14 @@
+ When using the \fBcrypt()\fR algorithm, note that only the first 8 characters of the password are used to form the password\&. If the supplied password is longer, the extra characters will be silently discarded\&.
+  
+ .PP
+-The SHA encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&.
++The SHA-1 encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&.
+  
+ .PP
+-The SHA and \fBcrypt()\fR formats are insecure by today's standards\&.
++The SHA-1 and \fBcrypt()\fR formats are insecure by today's standards\&.
+  
++.PP
++The SHA-2-based \fBcrypt()\fR formats (SHA-256 and SHA-512) are supported on most modern Unix systems, and follow the specification at https://www\&.akkadia\&.org/drepper/SHA-crypt\&.txt\&.
++ 
+ .SH "RESTRICTIONS"
+  
+ .PP
diff --git a/httpd.spec b/httpd.spec
index 32cb463..a94fdb6 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.39
-Release: 9%{?dist}
+Release: 10%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -76,6 +76,7 @@ Patch36: httpd-2.4.38-r1830819+.patch
 Patch38: httpd-2.4.34-sslciphdefault.patch
 Patch39: httpd-2.4.37-sslprotdefault.patch
 Patch40: httpd-2.4.39-r1861269.patch
+Patch41: httpd-2.4.37-r1861793+.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -216,6 +217,7 @@ interface for storing and accessing per-user session data.
 %patch38 -p1 -b .sslciphdefault
 %patch39 -p1 -b .sslprotdefault
 %patch40 -p1 -b .r1861269
+%patch41 -p1 -b .r1861793+
 
 %patch58 -p1 -b .r1738878
 %patch60 -p1 -b .enable-sslv3
@@ -739,6 +741,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Jul  8 2019 Joe Orton <jorton@redhat.com> - 2.4.39-10
+- htpasswd: add SHA-256/512 support
+
 * Fri Jun 21 2019 Joe Orton <jorton@redhat.com> - 2.4.39-9
 - create instance-specific StateDir in httpd@.service, instance.conf
 

From 7ee1cb5208eaa7a0ce86eea5263d0d17e94feae1 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 8 Jul 2019 09:23:48 +0100
Subject: [PATCH 174/359] - apachectl: restore -V/-v/-t support (#1727434)

---
 apachectl.sh | 6 +++++-
 httpd.spec   | 7 +++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/apachectl.sh b/apachectl.sh
index 77868fe..e0f6f78 100755
--- a/apachectl.sh
+++ b/apachectl.sh
@@ -49,10 +49,14 @@ graceful-stop)
     /usr/bin/systemctl kill --signal=SIGWINCH $SVC
     ERROR=$?
     ;;
-configtest)
+configtest|-t)
     $HTTPD -t
     ERROR=$?
     ;;
+-v|-V)
+    $HTTPD $ACMD
+    ERROR=$?
+    ;;
 *)
     echo apachectl: The \"$ACMD\" option is not supported. 1>&2
     ERROR=2
diff --git a/httpd.spec b/httpd.spec
index a94fdb6..5fbcc76 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -406,7 +406,8 @@ sed -i \
     docs/conf/extra/*.conf
 
 # Set correct path for httpd binary in apachectl script
-sed -i 's,@HTTPDBIN@,%{_sbindir}/httpd,g' $RPM_SOURCE_DIR/apachectl.sh
+sed 's,@HTTPDBIN@,%{_sbindir}/httpd,g' $RPM_SOURCE_DIR/apachectl.sh \
+    > apachectl.sh
 
 # Create cache directory
 mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/cache/httpd \
@@ -474,7 +475,8 @@ install -m755 $RPM_SOURCE_DIR/httpd-ssl-gencerts \
 	$RPM_BUILD_ROOT%{_libexecdir}/httpd-ssl-gencerts
 
 # Install scripts
-install -p -m 755 $RPM_SOURCE_DIR/apachectl.sh $RPM_BUILD_ROOT%{_sbindir}/apachectl
+install -m 755 apachectl.sh $RPM_BUILD_ROOT%{_sbindir}/apachectl
+touch -r $RPM_SOURCE_DIR/apachectl.sh $RPM_BUILD_ROOT%{_sbindir}/apachectl
 mkdir -p $RPM_BUILD_ROOT%{_libexecdir}/initscripts/legacy-actions/httpd
 for f in graceful configtest; do
     install -p -m 755 $RPM_SOURCE_DIR/action-${f}.sh \
@@ -743,6 +745,7 @@ exit $rv
 %changelog
 * Mon Jul  8 2019 Joe Orton <jorton@redhat.com> - 2.4.39-10
 - htpasswd: add SHA-256/512 support
+- apachectl: restore -V/-v/-t support (#1727434)
 
 * Fri Jun 21 2019 Joe Orton <jorton@redhat.com> - 2.4.39-9
 - create instance-specific StateDir in httpd@.service, instance.conf

From c4e5cc737f187af40b089e3a64848cd830ebeb5a Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Tue, 16 Jul 2019 17:14:13 +0200
Subject: [PATCH 175/359] Remove redundant part of patch - we ship are own
 config.layout

---
 httpd-2.4.39-r1842929+.patch | 122 -----------------------------------
 1 file changed, 122 deletions(-)

diff --git a/httpd-2.4.39-r1842929+.patch b/httpd-2.4.39-r1842929+.patch
index 50f8aa1..9fea432 100644
--- a/httpd-2.4.39-r1842929+.patch
+++ b/httpd-2.4.39-r1842929+.patch
@@ -23,128 +23,6 @@ http://svn.apache.org/viewvc?view=revision&revision=1853631
  ])
  
  dnl 
---- httpd-2.4.39/config.layout.r1842929+
-+++ httpd-2.4.39/config.layout
-@@ -29,6 +29,7 @@
-     includedir:    ${prefix}/include
-     localstatedir: ${prefix}
-     runtimedir:    ${localstatedir}/logs
-+    statedir:      ${localstatedir}/state
-     logfiledir:    ${localstatedir}/logs
-     proxycachedir: ${localstatedir}/proxy
- </Layout>
-@@ -54,6 +55,7 @@
-     includedir:    ${prefix}/include+
-     localstatedir: ${prefix}/var+
-     runtimedir:    ${localstatedir}/run
-+    statedir:      ${localstatedir}/state
-     logfiledir:    ${localstatedir}/log
-     proxycachedir: ${localstatedir}/proxy
- </Layout>
-@@ -78,6 +80,7 @@
-     includedir:    /System/Library/Frameworks/Apache.framework/Versions/2.0/Headers
-     localstatedir: /var
-     runtimedir:    ${prefix}/Logs
-+    statedir:      ${prefix}/State
-     logfiledir:    ${prefix}/Logs
-     proxycachedir: ${prefix}/ProxyCache
- </Layout>
-@@ -102,6 +105,7 @@
-     includedir:    ${prefix}/include+
-     localstatedir: /var
-     runtimedir:    ${localstatedir}/run
-+    statedir:      ${localstatedir}/state
-     logfiledir:    ${localstatedir}/log+
-     proxycachedir: ${runtimedir}/proxy
- </Layout>
-@@ -126,6 +130,7 @@
-     includedir:    ${prefix}/include/apache
-     localstatedir: /var
-     runtimedir:    ${localstatedir}/run
-+    statedir:      ${localstatedir}/lib/httpd
-     logfiledir:    ${localstatedir}/log/httpd
-     proxycachedir: ${localstatedir}/cache/httpd
- </Layout>     
-@@ -151,6 +156,7 @@
-     includedir:    ${prefix}/include/httpd
-     runtimedir:    /run/httpd
-     logfiledir:    ${localstatedir}/log/httpd
-+    statedir:      ${localstatedir}/lib/httpd
-     proxycachedir: ${localstatedir}/cache/httpd/proxy
- </Layout>     
- 
-@@ -175,6 +181,7 @@
-     localstatedir: /var${prefix}
-     runtimedir:    ${localstatedir}/run
-     logfiledir:    ${localstatedir}/logs
-+    statedir:      ${localstatedir}/state
-     proxycachedir: ${localstatedir}/proxy
- </Layout>
- 
-@@ -197,6 +204,7 @@
-     cgidir:        ${datadir}/cgi-bin
-     includedir:    ${prefix}/include/apache
-     localstatedir: /var/lib/httpd
-+    statedir:      ${localstatedir}
-     runtimedir:    /var/run
-     logfiledir:    /var/log/httpd
-     proxycachedir: /var/cache/httpd
-@@ -223,6 +231,7 @@
-     localstatedir: /var
-     runtimedir:    ${localstatedir}/run
-     logfiledir:    ${localstatedir}/log/httpd
-+    statedir:      ${prefix}/state
-     proxycachedir: ${localstatedir}/proxy
- </Layout>
- 
-@@ -246,6 +255,7 @@
-     includedir:    ${exec_prefix}/include
-     localstatedir: ${prefix}
-     runtimedir:    /var/run
-+    statedir:      ${datadir}/state
-     logfiledir:    ${datadir}/logs
-     proxycachedir: ${datadir}/proxy
- </Layout>
-@@ -271,6 +281,7 @@
-     localstatedir: ${prefix}
-     runtimedir:    ${prefix}/logs
-     logfiledir:    ${prefix}/logs
-+    statedir:      ${prefix}/state
-     proxycachedir: ${prefix}/proxy
- </Layout>
- 
-@@ -315,6 +326,7 @@
-     cgidir:        ${prefix}/usr/lib/cgi-bin
-     includedir:    ${exec_prefix}/include/apache2
-     localstatedir: ${prefix}/var/lock/apache2
-+    statedir:      ${prefix}/var/lib/apache2
-     runtimedir:    ${prefix}/var/run/apache2
-     logfiledir:    ${prefix}/var/log/apache2
-     proxycachedir: ${prefix}/var/cache/apache2/proxy
-@@ -343,6 +355,7 @@
-     manualdir:     ${datadir}/manual
-     cgidir:        ${datadir}/cgi-bin
-     runtimedir:    ${localstatedir}/run
-+    runtimedir:    ${localstatedir}/lib/httpd
-     logfiledir:    ${localstatedir}/log/httpd
-     proxycachedir: ${localstatedir}/cache/httpd/cache-root
- </Layout>
-@@ -366,6 +379,7 @@
-     manualdir:     ${prefix}/manual
-     includedir:    ${prefix}/include
-     localstatedir: /var/httpd
-+    statedir:      ${localstatedir}/state
-     runtimedir:    ${localstatedir}/run
-     logfiledir:    ${localstatedir}/logs
-     proxycachedir: ${localstatedir}/proxy
-@@ -391,6 +405,7 @@
-     includedir:      ${prefix}/include/httpd
-     localstatedir:   /var
-     runtimedir:      ${localstatedir}/run/httpd
-+    statedir:        ${localstatedir}/lib/httpd
-     logfiledir:      ${localstatedir}/log/httpd
-     proxycachedir:   ${localstatedir}/cache/httpd
- </Layout>
 --- httpd-2.4.39/configure.in.r1842929+
 +++ httpd-2.4.39/configure.in
 @@ -41,7 +41,7 @@

From 2993aea7a705c7ef4b943b1770f98b2964792d83 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 17 Jul 2019 11:31:15 +0100
Subject: [PATCH 176/359] mod_cgid: use fd passing to fix script stderr
 handling (#1591157) Resolves: rhbz#1591157

---
 httpd-2.4.37-r1828172+.patch | 1069 ++++++++++++++++++++++++++++++++++
 httpd.spec                   |    8 +-
 2 files changed, 1076 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.37-r1828172+.patch

diff --git a/httpd-2.4.37-r1828172+.patch b/httpd-2.4.37-r1828172+.patch
new file mode 100644
index 0000000..822cccf
--- /dev/null
+++ b/httpd-2.4.37-r1828172+.patch
@@ -0,0 +1,1069 @@
+# ./pullrev.sh 1828172 1862968 1863191
+http://svn.apache.org/viewvc?view=revision&revision=1828172
+http://svn.apache.org/viewvc?view=revision&revision=1862968
+http://svn.apache.org/viewvc?view=revision&revision=1863191
+
+--- httpd-2.4.37/modules/generators/mod_cgi.c
++++ httpd-2.4.37/modules/generators/mod_cgi.c
+@@ -92,6 +92,10 @@
+     apr_size_t  bufbytes;
+ } cgi_server_conf;
+ 
++typedef struct {
++    apr_interval_time_t timeout;
++} cgi_dirconf;
++
+ static void *create_cgi_config(apr_pool_t *p, server_rec *s)
+ {
+     cgi_server_conf *c =
+@@ -112,6 +116,12 @@
+     return overrides->logname ? overrides : base;
+ }
+ 
++static void *create_cgi_dirconf(apr_pool_t *p, char *dummy)
++{
++    cgi_dirconf *c = (cgi_dirconf *) apr_pcalloc(p, sizeof(cgi_dirconf));
++    return c;
++}
++
+ static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg)
+ {
+     server_rec *s = cmd->server;
+@@ -150,6 +160,17 @@
+     return NULL;
+ }
+ 
++static const char *set_script_timeout(cmd_parms *cmd, void *dummy, const char *arg)
++{
++    cgi_dirconf *dc = dummy;
++
++    if (ap_timeout_parameter_parse(arg, &dc->timeout, "s") != APR_SUCCESS) {
++        return "CGIScriptTimeout has wrong format";
++    }
++
++    return NULL;
++}
++
+ static const command_rec cgi_cmds[] =
+ {
+ AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF,
+@@ -158,6 +179,9 @@
+      "the maximum length (in bytes) of the script debug log"),
+ AP_INIT_TAKE1("ScriptLogBuffer", set_scriptlog_buffer, NULL, RSRC_CONF,
+      "the maximum size (in bytes) to record of a POST request"),
++AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_CONF,
++     "The amount of time to wait between successful reads from "
++     "the CGI script, in seconds."),
+     {NULL}
+ };
+ 
+@@ -471,23 +495,26 @@
+                           apr_filepath_name_get(r->filename));
+         }
+         else {
++            cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module);
++            apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
++
+             apr_pool_note_subprocess(p, procnew, APR_KILL_AFTER_TIMEOUT);
+ 
+             *script_in = procnew->out;
+             if (!*script_in)
+                 return APR_EBADF;
+-            apr_file_pipe_timeout_set(*script_in, r->server->timeout);
++            apr_file_pipe_timeout_set(*script_in, timeout);
+ 
+             if (e_info->prog_type == RUN_AS_CGI) {
+                 *script_out = procnew->in;
+                 if (!*script_out)
+                     return APR_EBADF;
+-                apr_file_pipe_timeout_set(*script_out, r->server->timeout);
++                apr_file_pipe_timeout_set(*script_out, timeout);
+ 
+                 *script_err = procnew->err;
+                 if (!*script_err)
+                     return APR_EBADF;
+-                apr_file_pipe_timeout_set(*script_err, r->server->timeout);
++                apr_file_pipe_timeout_set(*script_err, timeout);
+             }
+         }
+     }
+@@ -563,189 +590,7 @@
+ }
+ 
+ #if APR_FILES_AS_SOCKETS
+-
+-/* A CGI bucket type is needed to catch any output to stderr from the
+- * script; see PR 22030. */
+-static const apr_bucket_type_t bucket_type_cgi;
+-
+-struct cgi_bucket_data {
+-    apr_pollset_t *pollset;
+-    request_rec *r;
+-};
+-
+-/* Create a CGI bucket using pipes from script stdout 'out'
+- * and stderr 'err', for request 'r'. */
+-static apr_bucket *cgi_bucket_create(request_rec *r,
+-                                     apr_file_t *out, apr_file_t *err,
+-                                     apr_bucket_alloc_t *list)
+-{
+-    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
+-    apr_status_t rv;
+-    apr_pollfd_t fd;
+-    struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data);
+-
+-    APR_BUCKET_INIT(b);
+-    b->free = apr_bucket_free;
+-    b->list = list;
+-    b->type = &bucket_type_cgi;
+-    b->length = (apr_size_t)(-1);
+-    b->start = -1;
+-
+-    /* Create the pollset */
+-    rv = apr_pollset_create(&data->pollset, 2, r->pool, 0);
+-    if (rv != APR_SUCCESS) {
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01217)
+-                     "apr_pollset_create(); check system or user limits");
+-        return NULL;
+-    }
+-
+-    fd.desc_type = APR_POLL_FILE;
+-    fd.reqevents = APR_POLLIN;
+-    fd.p = r->pool;
+-    fd.desc.f = out; /* script's stdout */
+-    fd.client_data = (void *)1;
+-    rv = apr_pollset_add(data->pollset, &fd);
+-    if (rv != APR_SUCCESS) {
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01218)
+-                     "apr_pollset_add(); check system or user limits");
+-        return NULL;
+-    }
+-
+-    fd.desc.f = err; /* script's stderr */
+-    fd.client_data = (void *)2;
+-    rv = apr_pollset_add(data->pollset, &fd);
+-    if (rv != APR_SUCCESS) {
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01219)
+-                     "apr_pollset_add(); check system or user limits");
+-        return NULL;
+-    }
+-
+-    data->r = r;
+-    b->data = data;
+-    return b;
+-}
+-
+-/* Create a duplicate CGI bucket using given bucket data */
+-static apr_bucket *cgi_bucket_dup(struct cgi_bucket_data *data,
+-                                  apr_bucket_alloc_t *list)
+-{
+-    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
+-    APR_BUCKET_INIT(b);
+-    b->free = apr_bucket_free;
+-    b->list = list;
+-    b->type = &bucket_type_cgi;
+-    b->length = (apr_size_t)(-1);
+-    b->start = -1;
+-    b->data = data;
+-    return b;
+-}
+-
+-/* Handle stdout from CGI child.  Duplicate of logic from the _read
+- * method of the real APR pipe bucket implementation. */
+-static apr_status_t cgi_read_stdout(apr_bucket *a, apr_file_t *out,
+-                                    const char **str, apr_size_t *len)
+-{
+-    char *buf;
+-    apr_status_t rv;
+-
+-    *str = NULL;
+-    *len = APR_BUCKET_BUFF_SIZE;
+-    buf = apr_bucket_alloc(*len, a->list); /* XXX: check for failure? */
+-
+-    rv = apr_file_read(out, buf, len);
+-
+-    if (rv != APR_SUCCESS && rv != APR_EOF) {
+-        apr_bucket_free(buf);
+-        return rv;
+-    }
+-
+-    if (*len > 0) {
+-        struct cgi_bucket_data *data = a->data;
+-        apr_bucket_heap *h;
+-
+-        /* Change the current bucket to refer to what we read */
+-        a = apr_bucket_heap_make(a, buf, *len, apr_bucket_free);
+-        h = a->data;
+-        h->alloc_len = APR_BUCKET_BUFF_SIZE; /* note the real buffer size */
+-        *str = buf;
+-        APR_BUCKET_INSERT_AFTER(a, cgi_bucket_dup(data, a->list));
+-    }
+-    else {
+-        apr_bucket_free(buf);
+-        a = apr_bucket_immortal_make(a, "", 0);
+-        *str = a->data;
+-    }
+-    return rv;
+-}
+-
+-/* Read method of CGI bucket: polls on stderr and stdout of the child,
+- * sending any stderr output immediately away to the error log. */
+-static apr_status_t cgi_bucket_read(apr_bucket *b, const char **str,
+-                                    apr_size_t *len, apr_read_type_e block)
+-{
+-    struct cgi_bucket_data *data = b->data;
+-    apr_interval_time_t timeout;
+-    apr_status_t rv;
+-    int gotdata = 0;
+-
+-    timeout = block == APR_NONBLOCK_READ ? 0 : data->r->server->timeout;
+-
+-    do {
+-        const apr_pollfd_t *results;
+-        apr_int32_t num;
+-
+-        rv = apr_pollset_poll(data->pollset, timeout, &num, &results);
+-        if (APR_STATUS_IS_TIMEUP(rv)) {
+-            if (timeout) {
+-                ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, data->r, APLOGNO(01220)
+-                              "Timeout waiting for output from CGI script %s",
+-                              data->r->filename);
+-                return rv;
+-            }
+-            else {
+-                return APR_EAGAIN;
+-            }
+-        }
+-        else if (APR_STATUS_IS_EINTR(rv)) {
+-            continue;
+-        }
+-        else if (rv != APR_SUCCESS) {
+-            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, data->r, APLOGNO(01221)
+-                          "poll failed waiting for CGI child");
+-            return rv;
+-        }
+-
+-        for (; num; num--, results++) {
+-            if (results[0].client_data == (void *)1) {
+-                /* stdout */
+-                rv = cgi_read_stdout(b, results[0].desc.f, str, len);
+-                if (APR_STATUS_IS_EOF(rv)) {
+-                    rv = APR_SUCCESS;
+-                }
+-                gotdata = 1;
+-            } else {
+-                /* stderr */
+-                apr_status_t rv2 = log_script_err(data->r, results[0].desc.f);
+-                if (APR_STATUS_IS_EOF(rv2)) {
+-                    apr_pollset_remove(data->pollset, &results[0]);
+-                }
+-            }
+-        }
+-
+-    } while (!gotdata);
+-
+-    return rv;
+-}
+-
+-static const apr_bucket_type_t bucket_type_cgi = {
+-    "CGI", 5, APR_BUCKET_DATA,
+-    apr_bucket_destroy_noop,
+-    cgi_bucket_read,
+-    apr_bucket_setaside_notimpl,
+-    apr_bucket_split_notimpl,
+-    apr_bucket_copy_notimpl
+-};
+-
++#include "cgi_common.h"
+ #endif
+ 
+ static int cgi_handler(request_rec *r)
+@@ -766,6 +611,8 @@
+     apr_status_t rv;
+     cgi_exec_info_t e_info;
+     conn_rec *c;
++    cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module);
++    apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
+ 
+     if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
+         return DECLINED;
+@@ -928,7 +775,7 @@
+     apr_file_pipe_timeout_set(script_in, 0);
+     apr_file_pipe_timeout_set(script_err, 0);
+ 
+-    b = cgi_bucket_create(r, script_in, script_err, c->bucket_alloc);
++    b = cgi_bucket_create(r, dc->timeout, script_in, script_err, c->bucket_alloc);
+     if (b == NULL)
+         return HTTP_INTERNAL_SERVER_ERROR;
+ #else
+@@ -985,7 +832,7 @@
+              * stderr output, as normal. */
+             discard_script_output(bb);
+             apr_brigade_destroy(bb);
+-            apr_file_pipe_timeout_set(script_err, r->server->timeout);
++            apr_file_pipe_timeout_set(script_err, timeout);
+             log_script_err(r, script_err);
+         }
+ 
+@@ -1036,7 +883,7 @@
+      * connection drops or we stopped sending output for some other
+      * reason */
+     if (rv == APR_SUCCESS && !r->connection->aborted) {
+-        apr_file_pipe_timeout_set(script_err, r->server->timeout);
++        apr_file_pipe_timeout_set(script_err, timeout);
+         log_script_err(r, script_err);
+     }
+ 
+@@ -1277,7 +1124,7 @@
+ AP_DECLARE_MODULE(cgi) =
+ {
+     STANDARD20_MODULE_STUFF,
+-    NULL,                        /* dir config creater */
++    create_cgi_dirconf,          /* dir config creater */
+     NULL,                        /* dir merger --- default is to override */
+     create_cgi_config,           /* server config */
+     merge_cgi_config,            /* merge server config */
+--- httpd-2.4.37/modules/generators/mod_cgid.c
++++ httpd-2.4.37/modules/generators/mod_cgid.c
+@@ -342,15 +342,19 @@
+     return close(fd);
+ }
+ 
+-/* deal with incomplete reads and signals
+- * assume you really have to read buf_size bytes
+- */
+-static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
++/* Read from the socket dealing with incomplete messages and signals.
++ * Returns 0 on success or errno on failure.  Stderr fd passed as
++ * auxiliary data from other end is written to *errfd, or else stderr
++ * fileno if not present. */
++static apr_status_t sock_readhdr(int fd, int *errfd, void *vbuf, size_t buf_size)
+ {
+-    char *buf = vbuf;
+     int rc;
++#ifndef HAVE_CGID_FDPASSING
++    char *buf = vbuf;
+     size_t bytes_read = 0;
+ 
++    if (errfd) *errfd = 0;
++    
+     do {
+         do {
+             rc = read(fd, buf + bytes_read, buf_size - bytes_read);
+@@ -365,9 +369,52 @@
+         }
+     } while (bytes_read < buf_size);
+ 
++   
++#else /* with FD passing */
++    struct msghdr msg = {0};
++    struct iovec vec = {vbuf, buf_size};
++    struct cmsghdr *cmsg;
++    union {  /* union to ensure alignment */
++        struct cmsghdr cm;
++        char buf[CMSG_SPACE(sizeof(int))];
++    } u;
++    
++    msg.msg_iov = &vec;
++    msg.msg_iovlen = 1;
++    
++    msg.msg_control = u.buf;
++    msg.msg_controllen = sizeof(u.buf);
++
++    if (errfd) *errfd = 0;
++    
++    /* use MSG_WAITALL to skip loop on truncated reads */
++    do {
++        rc = recvmsg(fd, &msg, MSG_WAITALL);
++    } while (rc < 0 && errno == EINTR);
++
++    if (rc == 0) {
++        return ECONNRESET;
++    }
++    
++    cmsg = CMSG_FIRSTHDR(&msg);
++    if (errfd
++        && cmsg
++        && cmsg->cmsg_len == CMSG_LEN(sizeof(*errfd))
++        && cmsg->cmsg_level == SOL_SOCKET
++        && cmsg->cmsg_type == SCM_RIGHTS) {
++        *errfd = *((int *) CMSG_DATA(cmsg));
++    }
++#endif
++    
+     return APR_SUCCESS;
+ }
+ 
++/* As sock_readhdr but without auxiliary fd passing. */
++static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
++{
++    return sock_readhdr(fd, NULL, vbuf, buf_size);
++}
++
+ /* deal with signals
+  */
+ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
+@@ -384,7 +431,7 @@
+     return APR_SUCCESS;
+ }
+ 
+-static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
++static apr_status_t sock_writev(int fd, int auxfd, request_rec *r, int count, ...)
+ {
+     va_list ap;
+     int rc;
+@@ -399,9 +446,39 @@
+     }
+     va_end(ap);
+ 
++#ifndef HAVE_CGID_FDPASSING
+     do {
+         rc = writev(fd, vec, count);
+     } while (rc < 0 && errno == EINTR);
++#else
++    {
++        struct msghdr msg = { 0 };
++        struct cmsghdr *cmsg;
++        union { /* union for alignment */
++            char buf[CMSG_SPACE(sizeof(int))];
++            struct cmsghdr align;
++        } u;
++
++        msg.msg_iov = vec;
++        msg.msg_iovlen = count;
++
++        if (auxfd) {
++            msg.msg_control = u.buf;
++            msg.msg_controllen = sizeof(u.buf);
++
++            cmsg = CMSG_FIRSTHDR(&msg);
++            cmsg->cmsg_level = SOL_SOCKET;
++            cmsg->cmsg_type = SCM_RIGHTS;
++            cmsg->cmsg_len = CMSG_LEN(sizeof(int));
++            *((int *) CMSG_DATA(cmsg)) = auxfd;
++        }
++
++        do {
++            rc = sendmsg(fd, &msg, 0);
++        } while (rc < 0 && errno == EINTR);
++    }
++#endif
++    
+     if (rc < 0) {
+         return errno;
+     }
+@@ -410,7 +487,7 @@
+ }
+ 
+ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
+-                            cgid_req_t *req)
++                            int *errfd, cgid_req_t *req)
+ {
+     int i;
+     char **environ;
+@@ -421,7 +498,7 @@
+     r->server = apr_pcalloc(r->pool, sizeof(server_rec));
+ 
+     /* read the request header */
+-    stat = sock_read(fd, req, sizeof(*req));
++    stat = sock_readhdr(fd, errfd, req, sizeof(*req));
+     if (stat != APR_SUCCESS) {
+         return stat;
+     }
+@@ -479,14 +556,15 @@
+     return APR_SUCCESS;
+ }
+ 
+-static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
+-                             int req_type)
++static apr_status_t send_req(int fd, apr_file_t *errpipe, request_rec *r,
++                             char *argv0, char **env, int req_type)
+ {
+     int i;
+     cgid_req_t req = {0};
+     apr_status_t stat;
+     ap_unix_identity_t * ugid = ap_run_get_suexec_identity(r);
+     core_dir_config *core_conf = ap_get_core_module_config(r->per_dir_config);
++    int errfd;
+ 
+ 
+     if (ugid == NULL) {
+@@ -507,16 +585,21 @@
+     req.args_len = r->args ? strlen(r->args) : 0;
+     req.loglevel = r->server->log.level;
+ 
++    if (errpipe)
++        apr_os_file_get(&errfd, errpipe);
++    else
++        errfd = 0;
++    
+     /* Write the request header */
+     if (req.args_len) {
+-        stat = sock_writev(fd, r, 5,
++        stat = sock_writev(fd, errfd, r, 5,
+                            &req, sizeof(req),
+                            r->filename, req.filename_len,
+                            argv0, req.argv0_len,
+                            r->uri, req.uri_len,
+                            r->args, req.args_len);
+     } else {
+-        stat = sock_writev(fd, r, 4,
++        stat = sock_writev(fd, errfd, r, 4,
+                            &req, sizeof(req),
+                            r->filename, req.filename_len,
+                            argv0, req.argv0_len,
+@@ -531,7 +614,7 @@
+     for (i = 0; i < req.env_count; i++) {
+         apr_size_t curlen = strlen(env[i]);
+ 
+-        if ((stat = sock_writev(fd, r, 2, &curlen, sizeof(curlen),
++        if ((stat = sock_writev(fd, 0, r, 2, &curlen, sizeof(curlen),
+                                 env[i], curlen)) != APR_SUCCESS) {
+             return stat;
+         }
+@@ -582,20 +665,34 @@
+     }
+ }
+ 
++/* Callback executed in the forked child process if exec of the CGI
++ * script fails.  For the fd-passing case, output to stderr goes to
++ * the client (request handling thread) and is logged via
++ * ap_log_rerror there.  For the non-fd-passing case, the "fake"
++ * request_rec passed via userdata is used to log. */
+ static void cgid_child_errfn(apr_pool_t *pool, apr_status_t err,
+                              const char *description)
+ {
+-    request_rec *r;
+     void *vr;
+ 
+     apr_pool_userdata_get(&vr, ERRFN_USERDATA_KEY, pool);
+-    r = vr;
+-
+-    /* sure we got r, but don't call ap_log_rerror() because we don't
+-     * have r->headers_in and possibly other storage referenced by
+-     * ap_log_rerror()
+-     */
+-    ap_log_error(APLOG_MARK, APLOG_ERR, err, r->server, APLOGNO(01241) "%s", description);
++    if (vr) {
++        request_rec *r = vr;
++        
++        /* sure we got r, but don't call ap_log_rerror() because we don't
++         * have r->headers_in and possibly other storage referenced by
++         * ap_log_rerror()
++         */
++        ap_log_error(APLOG_MARK, APLOG_ERR, err, r->server, APLOGNO(01241) "%s", description);
++    }
++    else {
++        const char *logstr;
++        
++        logstr = apr_psprintf(pool, APLOGNO(01241) "error spawning CGI child: %s (%pm)\n",
++                              description, &err);
++        fputs(logstr, stderr);
++        fflush(stderr);
++    }
+ }
+ 
+ static int cgid_server(void *data)
+@@ -669,7 +766,7 @@
+     }
+ 
+     while (!daemon_should_exit) {
+-        int errfileno = STDERR_FILENO;
++        int errfileno;
+         char *argv0 = NULL;
+         char **env = NULL;
+         const char * const *argv;
+@@ -709,7 +806,7 @@
+         r = apr_pcalloc(ptrans, sizeof(request_rec));
+         procnew = apr_pcalloc(ptrans, sizeof(*procnew));
+         r->pool = ptrans;
+-        stat = get_req(sd2, r, &argv0, &env, &cgid_req);
++        stat = get_req(sd2, r, &argv0, &env, &errfileno, &cgid_req);
+         if (stat != APR_SUCCESS) {
+             ap_log_error(APLOG_MARK, APLOG_ERR, stat,
+                          main_server, APLOGNO(01248)
+@@ -741,6 +838,16 @@
+             continue;
+         }
+ 
++        if (errfileno == 0) {
++            errfileno = STDERR_FILENO;
++        }
++        else {
++            ap_log_error(APLOG_MARK, APLOG_DEBUG, rv, main_server,
++                          "using passed fd %d as stderr", errfileno);
++            /* Limit the received fd lifetime to pool lifetime */
++            apr_pool_cleanup_register(ptrans, (void *)((long)errfileno),
++                                      close_unix_socket, close_unix_socket);
++        }
+         apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool);
+         apr_os_file_put(&inout, &sd2, 0, r->pool);
+ 
+@@ -800,7 +907,10 @@
+             close(sd2);
+         }
+         else {
+-            apr_pool_userdata_set(r, ERRFN_USERDATA_KEY, apr_pool_cleanup_null, ptrans);
++            if (errfileno == STDERR_FILENO) {
++                /* Used by cgid_child_errfn without fd-passing. */
++                apr_pool_userdata_set(r, ERRFN_USERDATA_KEY, apr_pool_cleanup_null, ptrans);
++            }
+ 
+             argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args);
+ 
+@@ -1099,6 +1209,33 @@
+     return ret;
+ }
+ 
++/* Soak up stderr from a script and redirect it to the error log.
++ * TODO: log_scripterror() and this could move to cgi_common.h. */
++static apr_status_t log_script_err(request_rec *r, apr_file_t *script_err)
++{
++    char argsbuffer[HUGE_STRING_LEN];
++    char *newline;
++    apr_status_t rv;
++    cgid_server_conf *conf = ap_get_module_config(r->server->module_config, &cgid_module);
++
++    while ((rv = apr_file_gets(argsbuffer, HUGE_STRING_LEN,
++                               script_err)) == APR_SUCCESS) {
++
++        newline = strchr(argsbuffer, '\n');
++        if (newline) {
++            char *prev = newline - 1;
++            if (prev >= argsbuffer && *prev == '\r') {
++                newline = prev;
++            }
++
++            *newline = '\0';
++        }
++        log_scripterror(r, conf, r->status, 0, argsbuffer);
++    }
++
++    return rv;
++}
++
+ static int log_script(request_rec *r, cgid_server_conf * conf, int ret,
+                       char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
+                       apr_file_t *script_err)
+@@ -1204,6 +1341,11 @@
+     return ret;
+ }
+ 
++#ifdef HAVE_CGID_FDPASSING
++/* Pull in CGI bucket implementation. */
++#include "cgi_common.h"
++#endif
++
+ static int connect_to_daemon(int *sdptr, request_rec *r,
+                              cgid_server_conf *conf)
+ {
+@@ -1395,6 +1537,7 @@
+ 
+ static int cgid_handler(request_rec *r)
+ {
++    conn_rec *c = r->connection;
+     int retval, nph, dbpos;
+     char *argv0, *dbuf;
+     apr_bucket_brigade *bb;
+@@ -1404,10 +1547,11 @@
+     int seen_eos, child_stopped_reading;
+     int sd;
+     char **env;
+-    apr_file_t *tempsock;
++    apr_file_t *tempsock, *script_err, *errpipe_out;
+     struct cleanup_script_info *info;
+     apr_status_t rv;
+     cgid_dirconf *dc;
++    apr_interval_time_t timeout;
+ 
+     if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
+         return DECLINED;
+@@ -1416,7 +1560,7 @@
+     conf = ap_get_module_config(r->server->module_config, &cgid_module);
+     dc = ap_get_module_config(r->per_dir_config, &cgid_module);
+ 
+-    
++    timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
+     is_included = !strcmp(r->protocol, "INCLUDED");
+ 
+     if ((argv0 = strrchr(r->filename, '/')) != NULL) {
+@@ -1469,6 +1613,17 @@
+     }
+     */
+ 
++#ifdef HAVE_CGID_FDPASSING
++    rv = apr_file_pipe_create(&script_err, &errpipe_out, r->pool);
++    if (rv) {
++        return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10176)
++                               "could not create pipe for stderr");
++    }
++#else
++    script_err = NULL;
++    errpipe_out = NULL;
++#endif
++    
+     /*
+      * httpd core function used to add common environment variables like
+      * DOCUMENT_ROOT. 
+@@ -1481,12 +1636,16 @@
+         return retval;
+     }
+ 
+-    rv = send_req(sd, r, argv0, env, CGI_REQ);
++    rv = send_req(sd, errpipe_out, r, argv0, env, CGI_REQ);
+     if (rv != APR_SUCCESS) {
+         ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01268)
+                      "write to cgi daemon process");
+     }
+ 
++    /* The write-end of the pipe is only used by the server, so close
++     * it here. */
++    if (errpipe_out) apr_file_close(errpipe_out);
++    
+     info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
+     info->conf = conf;
+     info->r = r;
+@@ -1508,12 +1667,7 @@
+      */
+ 
+     apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
+-    if (dc->timeout > 0) { 
+-        apr_file_pipe_timeout_set(tempsock, dc->timeout);
+-    }
+-    else { 
+-        apr_file_pipe_timeout_set(tempsock, r->server->timeout);
+-    }
++    apr_file_pipe_timeout_set(tempsock, timeout);
+     apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket);
+ 
+     /* Transfer any put/post args, CERN style...
+@@ -1605,23 +1759,28 @@
+      */
+     shutdown(sd, 1);
+ 
++    bb = apr_brigade_create(r->pool, c->bucket_alloc);
++#ifdef HAVE_CGID_FDPASSING
++    b = cgi_bucket_create(r, dc->timeout, tempsock, script_err, c->bucket_alloc);
++    if (b == NULL)
++        return HTTP_INTERNAL_SERVER_ERROR; /* should call log_scripterror() w/ _UNAVAILABLE? */
++#else
++    b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
++#endif
++    APR_BRIGADE_INSERT_TAIL(bb, b);
++    b = apr_bucket_eos_create(c->bucket_alloc);
++    APR_BRIGADE_INSERT_TAIL(bb, b);
++
+     /* Handle script return... */
+     if (!nph) {
+-        conn_rec *c = r->connection;
+         const char *location;
+         char sbuf[MAX_STRING_LEN];
+         int ret;
+ 
+-        bb = apr_brigade_create(r->pool, c->bucket_alloc);
+-        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-        b = apr_bucket_eos_create(c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-
+         if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+                                                         APLOG_MODULE_INDEX)))
+         {
+-            ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL);
++            ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err);
+ 
+             /*
+              * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
+@@ -1658,6 +1817,11 @@
+             /* Soak up all the script output */
+             discard_script_output(bb);
+             apr_brigade_destroy(bb);
++            if (script_err) {
++                apr_file_pipe_timeout_set(script_err, timeout);
++                log_script_err(r, script_err);
++            }
++            
+             /* This redirect needs to be a GET no matter what the original
+              * method was.
+              */
+@@ -1690,7 +1854,6 @@
+     }
+ 
+     if (nph) {
+-        conn_rec *c = r->connection;
+         struct ap_filter_t *cur;
+ 
+         /* get rid of all filters up through protocol...  since we
+@@ -1704,14 +1867,20 @@
+         }
+         r->output_filters = r->proto_output_filters = cur;
+ 
+-        bb = apr_brigade_create(r->pool, c->bucket_alloc);
+-        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-        b = apr_bucket_eos_create(c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-        ap_pass_brigade(r->output_filters, bb);
++        rv = ap_pass_brigade(r->output_filters, bb);
+     }
+ 
++    /* don't soak up script output if errors occurred writing it
++     * out...  otherwise, we prolong the life of the script when the
++     * connection drops or we stopped sending output for some other
++     * reason */
++    if (script_err && rv == APR_SUCCESS && !r->connection->aborted) {
++        apr_file_pipe_timeout_set(script_err, timeout);
++        log_script_err(r, script_err);
++    }
++
++    if (script_err) apr_file_close(script_err);
++
+     return OK; /* NOT r->status, even if it has changed. */
+ }
+ 
+@@ -1829,7 +1998,7 @@
+         return retval;
+     }
+ 
+-    send_req(sd, r, command, env, SSI_REQ);
++    send_req(sd, NULL, r, command, env, SSI_REQ);
+ 
+     info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
+     info->conf = conf;
+--- httpd-2.4.37/modules/generators/config5.m4
++++ httpd-2.4.37/modules/generators/config5.m4
+@@ -78,4 +78,15 @@
+ 
+ APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
+ 
++AC_ARG_ENABLE(cgid-fdpassing,
++  [APACHE_HELP_STRING(--enable-cgid-fdpassing,Enable experimental mod_cgid support for fd passing)],
++  [if test "$enableval" = "yes"; then
++     AC_CHECK_DECL(CMSG_DATA,
++       [AC_DEFINE([HAVE_CGID_FDPASSING], 1, [Enable FD passing support in mod_cgid])],
++       [AC_MSG_ERROR([cannot support mod_cgid fd-passing on this system])], [
++#include <sys/types.h>
++#include <sys/socket.h>])
++  fi
++])
++
+ APACHE_MODPATH_FINISH
+--- httpd-2.4.37/modules/generators/cgi_common.h
++++ httpd-2.4.37/modules/generators/cgi_common.h
+@@ -0,0 +1,216 @@
++/* Licensed to the Apache Software Foundation (ASF) under one or more
++ * contributor license agreements.  See the NOTICE file distributed with
++ * this work for additional information regarding copyright ownership.
++ * The ASF licenses this file to You under the Apache License, Version 2.0
++ * (the "License"); you may not use this file except in compliance with
++ * the License.  You may obtain a copy of the License at
++ *
++ *     http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++#include "apr.h"
++#include "apr_strings.h"
++#include "apr_buckets.h"
++#include "apr_lib.h"
++#include "apr_poll.h"
++
++#define APR_WANT_STRFUNC
++#define APR_WANT_MEMFUNC
++#include "apr_want.h"
++
++#include "httpd.h"
++#include "util_filter.h"
++
++/* A CGI bucket type is needed to catch any output to stderr from the
++ * script; see PR 22030. */
++static const apr_bucket_type_t bucket_type_cgi;
++
++struct cgi_bucket_data {
++    apr_pollset_t *pollset;
++    request_rec *r;
++    apr_interval_time_t timeout;
++};
++
++/* Create a CGI bucket using pipes from script stdout 'out'
++ * and stderr 'err', for request 'r'. */
++static apr_bucket *cgi_bucket_create(request_rec *r,
++                                     apr_interval_time_t timeout,
++                                     apr_file_t *out, apr_file_t *err,
++                                     apr_bucket_alloc_t *list)
++{
++    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
++    apr_status_t rv;
++    apr_pollfd_t fd;
++    struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data);
++
++    APR_BUCKET_INIT(b);
++    b->free = apr_bucket_free;
++    b->list = list;
++    b->type = &bucket_type_cgi;
++    b->length = (apr_size_t)(-1);
++    b->start = -1;
++
++    /* Create the pollset */
++    rv = apr_pollset_create(&data->pollset, 2, r->pool, 0);
++    if (rv != APR_SUCCESS) {
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01217)
++                     "apr_pollset_create(); check system or user limits");
++        return NULL;
++    }
++
++    fd.desc_type = APR_POLL_FILE;
++    fd.reqevents = APR_POLLIN;
++    fd.p = r->pool;
++    fd.desc.f = out; /* script's stdout */
++    fd.client_data = (void *)1;
++    rv = apr_pollset_add(data->pollset, &fd);
++    if (rv != APR_SUCCESS) {
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01218)
++                     "apr_pollset_add(); check system or user limits");
++        return NULL;
++    }
++
++    fd.desc.f = err; /* script's stderr */
++    fd.client_data = (void *)2;
++    rv = apr_pollset_add(data->pollset, &fd);
++    if (rv != APR_SUCCESS) {
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01219)
++                     "apr_pollset_add(); check system or user limits");
++        return NULL;
++    }
++
++    data->r = r;
++    data->timeout = timeout;
++    b->data = data;
++    return b;
++}
++
++/* Create a duplicate CGI bucket using given bucket data */
++static apr_bucket *cgi_bucket_dup(struct cgi_bucket_data *data,
++                                  apr_bucket_alloc_t *list)
++{
++    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
++    APR_BUCKET_INIT(b);
++    b->free = apr_bucket_free;
++    b->list = list;
++    b->type = &bucket_type_cgi;
++    b->length = (apr_size_t)(-1);
++    b->start = -1;
++    b->data = data;
++    return b;
++}
++
++/* Handle stdout from CGI child.  Duplicate of logic from the _read
++ * method of the real APR pipe bucket implementation. */
++static apr_status_t cgi_read_stdout(apr_bucket *a, apr_file_t *out,
++                                    const char **str, apr_size_t *len)
++{
++    char *buf;
++    apr_status_t rv;
++
++    *str = NULL;
++    *len = APR_BUCKET_BUFF_SIZE;
++    buf = apr_bucket_alloc(*len, a->list); /* XXX: check for failure? */
++
++    rv = apr_file_read(out, buf, len);
++
++    if (rv != APR_SUCCESS && rv != APR_EOF) {
++        apr_bucket_free(buf);
++        return rv;
++    }
++
++    if (*len > 0) {
++        struct cgi_bucket_data *data = a->data;
++        apr_bucket_heap *h;
++
++        /* Change the current bucket to refer to what we read */
++        a = apr_bucket_heap_make(a, buf, *len, apr_bucket_free);
++        h = a->data;
++        h->alloc_len = APR_BUCKET_BUFF_SIZE; /* note the real buffer size */
++        *str = buf;
++        APR_BUCKET_INSERT_AFTER(a, cgi_bucket_dup(data, a->list));
++    }
++    else {
++        apr_bucket_free(buf);
++        a = apr_bucket_immortal_make(a, "", 0);
++        *str = a->data;
++    }
++    return rv;
++}
++
++/* Read method of CGI bucket: polls on stderr and stdout of the child,
++ * sending any stderr output immediately away to the error log. */
++static apr_status_t cgi_bucket_read(apr_bucket *b, const char **str,
++                                    apr_size_t *len, apr_read_type_e block)
++{
++    struct cgi_bucket_data *data = b->data;
++    apr_interval_time_t timeout = 0;
++    apr_status_t rv;
++    int gotdata = 0;
++
++    if (block != APR_NONBLOCK_READ) {
++        timeout = data->timeout > 0 ? data->timeout : data->r->server->timeout;
++    }
++
++    do {
++        const apr_pollfd_t *results;
++        apr_int32_t num;
++
++        rv = apr_pollset_poll(data->pollset, timeout, &num, &results);
++        if (APR_STATUS_IS_TIMEUP(rv)) {
++            if (timeout) {
++                ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, data->r, APLOGNO(01220)
++                              "Timeout waiting for output from CGI script %s",
++                              data->r->filename);
++                return rv;
++            }
++            else {
++                return APR_EAGAIN;
++            }
++        }
++        else if (APR_STATUS_IS_EINTR(rv)) {
++            continue;
++        }
++        else if (rv != APR_SUCCESS) {
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, data->r, APLOGNO(01221)
++                          "poll failed waiting for CGI child");
++            return rv;
++        }
++
++        for (; num; num--, results++) {
++            if (results[0].client_data == (void *)1) {
++                /* stdout */
++                rv = cgi_read_stdout(b, results[0].desc.f, str, len);
++                if (APR_STATUS_IS_EOF(rv)) {
++                    rv = APR_SUCCESS;
++                }
++                gotdata = 1;
++            } else {
++                /* stderr */
++                apr_status_t rv2 = log_script_err(data->r, results[0].desc.f);
++                if (APR_STATUS_IS_EOF(rv2)) {
++                    apr_pollset_remove(data->pollset, &results[0]);
++                }
++            }
++        }
++
++    } while (!gotdata);
++
++    return rv;
++}
++
++static const apr_bucket_type_t bucket_type_cgi = {
++    "CGI", 5, APR_BUCKET_DATA,
++    apr_bucket_destroy_noop,
++    cgi_bucket_read,
++    apr_bucket_setaside_notimpl,
++    apr_bucket_split_notimpl,
++    apr_bucket_copy_notimpl
++};
++
diff --git a/httpd.spec b/httpd.spec
index 5fbcc76..98f5102 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.39
-Release: 10%{?dist}
+Release: 11%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -77,6 +77,7 @@ Patch38: httpd-2.4.34-sslciphdefault.patch
 Patch39: httpd-2.4.37-sslprotdefault.patch
 Patch40: httpd-2.4.39-r1861269.patch
 Patch41: httpd-2.4.37-r1861793+.patch
+Patch42: httpd-2.4.37-r1828172+.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -218,6 +219,7 @@ interface for storing and accessing per-user session data.
 %patch39 -p1 -b .sslprotdefault
 %patch40 -p1 -b .r1861269
 %patch41 -p1 -b .r1861793+
+%patch42 -p1 -b .r1828172+
 
 %patch58 -p1 -b .r1738878
 %patch60 -p1 -b .enable-sslv3
@@ -316,6 +318,7 @@ export LYNX_PATH=/usr/bin/links
         --enable-disk-cache \
         --enable-ldap --enable-authnz-ldap \
         --enable-cgid --enable-cgi \
+        --enable-cgid-fdpassing \
         --enable-authn-anon --enable-authn-alias \
         --disable-imagemap --disable-file-cache \
         --disable-http2 \
@@ -743,6 +746,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Jul 17 2019 Joe Orton <jorton@redhat.com> - 2.4.39-11
+- mod_cgid: use fd passing to fix script stderr handling (#1591157)
+
 * Mon Jul  8 2019 Joe Orton <jorton@redhat.com> - 2.4.39-10
 - htpasswd: add SHA-256/512 support
 - apachectl: restore -V/-v/-t support (#1727434)

From fc0e844ce257850a310accba95d25b054f33bed3 Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Fri, 19 Jul 2019 11:28:20 +0200
Subject: [PATCH 177/359] - Remove pointless creation of /var/lib/httpd/state
 dir in RPM build root - Substitute tabs for spaces.

---
 httpd.spec | 47 +++++++++++++++++++++++------------------------
 1 file changed, 23 insertions(+), 24 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 98f5102..b64a53e 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -276,7 +276,7 @@ autoheader && autoconf || exit 1
 
 # Before configure; fix location of build dir in generated apxs
 %{__perl} -pi -e "s:\@exp_installbuilddir\@:%{_libdir}/httpd/build:g" \
-	support/apxs.in
+        support/apxs.in
 
 export CFLAGS=$RPM_OPT_FLAGS
 export LDFLAGS="-Wl,-z,relro,-z,now"
@@ -286,34 +286,34 @@ export LYNX_PATH=/usr/bin/links
 
 # Build the daemon
 ./configure \
- 	--prefix=%{_sysconfdir}/httpd \
- 	--exec-prefix=%{_prefix} \
- 	--bindir=%{_bindir} \
- 	--sbindir=%{_sbindir} \
- 	--mandir=%{_mandir} \
-	--libdir=%{_libdir} \
-	--sysconfdir=%{_sysconfdir}/httpd/conf \
-	--includedir=%{_includedir}/httpd \
-	--libexecdir=%{_libdir}/httpd/modules \
-	--datadir=%{contentdir} \
+        --prefix=%{_sysconfdir}/httpd \
+        --exec-prefix=%{_prefix} \
+        --bindir=%{_bindir} \
+        --sbindir=%{_sbindir} \
+        --mandir=%{_mandir} \
+        --libdir=%{_libdir} \
+        --sysconfdir=%{_sysconfdir}/httpd/conf \
+        --includedir=%{_includedir}/httpd \
+        --libexecdir=%{_libdir}/httpd/modules \
+        --datadir=%{contentdir} \
         --enable-layout=Fedora \
         --with-installbuilddir=%{_libdir}/httpd/build \
         --enable-mpms-shared=all \
         --with-apr=%{_prefix} --with-apr-util=%{_prefix} \
-	--enable-suexec --with-suexec \
+        --enable-suexec --with-suexec \
         --enable-suexec-capabilities \
-	--with-suexec-caller=%{suexec_caller} \
-	--with-suexec-docroot=%{docroot} \
-	--without-suexec-logfile \
+        --with-suexec-caller=%{suexec_caller} \
+        --with-suexec-docroot=%{docroot} \
+        --without-suexec-logfile \
         --with-suexec-syslog \
-	--with-suexec-bin=%{_sbindir}/suexec \
-	--with-suexec-uidmin=1000 --with-suexec-gidmin=1000 \
+        --with-suexec-bin=%{_sbindir}/suexec \
+        --with-suexec-uidmin=1000 --with-suexec-gidmin=1000 \
         --with-brotli \
         --enable-pie \
         --with-pcre \
         --enable-mods-shared=all \
-	--enable-ssl --with-ssl --disable-distcache \
-	--enable-proxy --enable-proxy-fdpass \
+        --enable-ssl --with-ssl --disable-distcache \
+        --enable-proxy --enable-proxy-fdpass \
         --enable-cache \
         --enable-disk-cache \
         --enable-ldap --enable-authnz-ldap \
@@ -323,7 +323,7 @@ export LYNX_PATH=/usr/bin/links
         --disable-imagemap --disable-file-cache \
         --disable-http2 \
         --disable-md \
-	$*
+        $*
 make %{?_smp_mflags}
 
 %install
@@ -396,7 +396,6 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.tmpfiles \
 
 # Other directories
 mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/dav \
-         $RPM_BUILD_ROOT%{_localstatedir}/lib/httpd/state \
          $RPM_BUILD_ROOT/run/httpd/htcacheclean
 
 # Substitute in defaults which are usually done (badly) by "make install"
@@ -471,11 +470,11 @@ ln -s ../..%{_libdir}/httpd/modules $RPM_BUILD_ROOT/etc/httpd/modules
 # install http-ssl-pass-dialog
 mkdir -p $RPM_BUILD_ROOT%{_libexecdir}
 install -m755 $RPM_SOURCE_DIR/httpd-ssl-pass-dialog \
-	$RPM_BUILD_ROOT%{_libexecdir}/httpd-ssl-pass-dialog
+        $RPM_BUILD_ROOT%{_libexecdir}/httpd-ssl-pass-dialog
 
 # install http-ssl-gencerts
 install -m755 $RPM_SOURCE_DIR/httpd-ssl-gencerts \
-	$RPM_BUILD_ROOT%{_libexecdir}/httpd-ssl-gencerts
+        $RPM_BUILD_ROOT%{_libexecdir}/httpd-ssl-gencerts
 
 # Install scripts
 install -m 755 apachectl.sh $RPM_BUILD_ROOT%{_sbindir}/apachectl
@@ -489,7 +488,7 @@ done
 # Install logrotate config
 mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d
 install -m 644 -p $RPM_SOURCE_DIR/httpd.logrotate \
-	$RPM_BUILD_ROOT/etc/logrotate.d/httpd
+        $RPM_BUILD_ROOT/etc/logrotate.d/httpd
 
 # Install man pages
 install -d $RPM_BUILD_ROOT%{_mandir}/man8 $RPM_BUILD_ROOT%{_mandir}/man5

From 5586dfdc484bd6860eb6c46b6178318d17e5ea24 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 23 Jul 2019 10:41:39 +0100
Subject: [PATCH 178/359] drop /var/lib/dav directory, since mod_dav_fs uses
 statedir

---
 httpd.spec | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index b64a53e..82ff179 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.39
-Release: 11%{?dist}
+Release: 12%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -395,12 +395,12 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.tmpfiles \
    $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d/httpd.conf
 
 # Other directories
-mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/dav \
+mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/httpd \
          $RPM_BUILD_ROOT/run/httpd/htcacheclean
 
 # Substitute in defaults which are usually done (badly) by "make install"
 sed -i \
-   "s,@@ServerRoot@@/var,%{_localstatedir}/lib/dav,;
+   "/^DavLockDB/d;
     s,@@ServerRoot@@/user.passwd,/etc/httpd/conf/user.passwd,;
     s,@@ServerRoot@@/docs,%{docroot},;
     s,@@ServerRoot@@,%{docroot},;
@@ -673,7 +673,6 @@ exit $rv
 %attr(0710,root,apache) %dir /run/httpd
 %attr(0700,apache,apache) %dir /run/httpd/htcacheclean
 %attr(0700,root,root) %dir %{_localstatedir}/log/httpd
-%attr(0700,apache,apache) %dir %{_localstatedir}/lib/dav
 %attr(0700,apache,apache) %dir %{_localstatedir}/lib/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd/proxy
@@ -745,6 +744,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Jul 23 2019 Joe Orton <jorton@redhat.com> - 2.4.39-12
+- drop /var/lib/dav directory, since mod_dav_fs uses statedir
+
 * Wed Jul 17 2019 Joe Orton <jorton@redhat.com> - 2.4.39-11
 - mod_cgid: use fd passing to fix script stderr handling (#1591157)
 

From 84b529bffa2507d21b32bf5a95f7cdec5c6e30ef Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 25 Jul 2019 08:38:22 +0000
Subject: [PATCH 179/359] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 82ff179..69c630c 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.39
-Release: 12%{?dist}
+Release: 13%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -744,6 +744,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.39-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
 * Tue Jul 23 2019 Joe Orton <jorton@redhat.com> - 2.4.39-12
 - drop /var/lib/dav directory, since mod_dav_fs uses statedir
 

From 1578b453430d67328430007f0f1ddfffc0e83dfd Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 15 Aug 2019 06:44:03 +0100
Subject: [PATCH 180/359] update to 2.4.41

---
 httpd-2.4.37-r1857129.patch  | 65 ------------------------------------
 httpd-2.4.37-r1861793+.patch |  4 +--
 httpd-2.4.39-r1842929+.patch | 35 -------------------
 httpd.spec                   | 10 +++---
 sources                      |  2 +-
 5 files changed, 8 insertions(+), 108 deletions(-)
 delete mode 100644 httpd-2.4.37-r1857129.patch

diff --git a/httpd-2.4.37-r1857129.patch b/httpd-2.4.37-r1857129.patch
deleted file mode 100644
index 4dbf05a..0000000
--- a/httpd-2.4.37-r1857129.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-# ./pullrev.sh 1857129
-http://svn.apache.org/viewvc?view=revision&revision=1857129
-
---- httpd-2.4.37/modules/filters/mod_reqtimeout.c
-+++ httpd-2.4.37/modules/filters/mod_reqtimeout.c
-@@ -31,7 +31,7 @@
- #define UNSET                            -1
- #define MRT_DEFAULT_handshake_TIMEOUT     0 /* disabled */
- #define MRT_DEFAULT_handshake_MAX_TIMEOUT 0
--#define MRT_DEFAULT_handshake_MIN_RATE    APR_INT32_MAX
-+#define MRT_DEFAULT_handshake_MIN_RATE    0
- #define MRT_DEFAULT_header_TIMEOUT       20
- #define MRT_DEFAULT_header_MAX_TIMEOUT   40
- #define MRT_DEFAULT_header_MIN_RATE      500
-@@ -220,7 +220,7 @@
-     if (block == APR_NONBLOCK_READ || mode == AP_MODE_INIT
-         || mode == AP_MODE_EATCRLF) {
-         rv = ap_get_brigade(f->next, bb, mode, block, readbytes);
--        if (ccfg->cur_stage.rate_factor > 0 && rv == APR_SUCCESS) {
-+        if (ccfg->cur_stage.rate_factor && rv == APR_SUCCESS) {
-             extend_timeout(ccfg, bb);
-         }
-         return rv;
-@@ -254,7 +254,7 @@
-             }
- 
-             if (!APR_BRIGADE_EMPTY(bb)) {
--                if (ccfg->cur_stage.rate_factor > 0) {
-+                if (ccfg->cur_stage.rate_factor) {
-                     extend_timeout(ccfg, bb);
-                 }
- 
-@@ -315,7 +315,7 @@
-          * the real (relevant) bytes to be asked later, within the
-          * currently alloted time.
-          */
--        if (ccfg->cur_stage.rate_factor > 0 && rv == APR_SUCCESS
-+        if (ccfg->cur_stage.rate_factor && rv == APR_SUCCESS
-                 && mode != AP_MODE_SPECULATIVE) {
-             extend_timeout(ccfg, bb);
-         }
-@@ -638,17 +638,17 @@
-     ap_hook_post_read_request(reqtimeout_before_body, NULL, NULL,
-                               APR_HOOK_MIDDLE);
- 
--#if MRT_DEFAULT_HANDSHAKE_MIN_RATE > 0
-+#if MRT_DEFAULT_handshake_MIN_RATE
-     default_handshake_rate_factor = apr_time_from_sec(1) /
--                                    MRT_DEFAULT_HANDSHAKE_MIN_RATE;
-+                                    MRT_DEFAULT_handshake_MIN_RATE;
- #endif
--#if MRT_DEFAULT_HEADER_MIN_RATE > 0
-+#if MRT_DEFAULT_header_MIN_RATE
-     default_header_rate_factor = apr_time_from_sec(1) /
--                                 MRT_DEFAULT_HEADER_MIN_RATE;
-+                                 MRT_DEFAULT_header_MIN_RATE;
- #endif
--#if MRT_DEFAULT_BODY_MIN_RATE > 0
-+#if MRT_DEFAULT_body_MIN_RATE
-     default_body_rate_factor = apr_time_from_sec(1) /
--                               MRT_DEFAULT_BODY_MIN_RATE;
-+                               MRT_DEFAULT_body_MIN_RATE;
- #endif
- }
- 
diff --git a/httpd-2.4.37-r1861793+.patch b/httpd-2.4.37-r1861793+.patch
index c522c7c..22886e2 100644
--- a/httpd-2.4.37-r1861793+.patch
+++ b/httpd-2.4.37-r1861793+.patch
@@ -46,7 +46,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1862612
 +        " -5  Force SHA-512 crypt() hash of the password (very secure)." NL
 +        " -B  Force bcrypt aencryption of the password (very secure)." NL
          " -C  Set the computing time used for the bcrypt algorithm" NL
-         "     (higher is more secure but slower, default: %d, valid: 4 to 31)." NL
+         "     (higher is more secure but slower, default: %d, valid: 4 to 17)." NL
 +        " -r  Set the number of rounds used for the SHA-256, SHA-512 algorithms" NL
 +        "     (higher is more secure but slower, default: 5000)." NL
          " -d  Force CRYPT encryption of the password (8 chars max, insecure)." NL
@@ -237,7 +237,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1862612
  .TP
 @@ -79,11 +85,14 @@
  \fB-C\fR
- This flag is only allowed in combination with \fB-B\fR (bcrypt encryption)\&. It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 31)\&.  
+ This flag is only allowed in combination with \fB-B\fR (bcrypt encryption)\&. It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17)\&.  
  .TP
 +\fB-r\fR
 +This flag is only allowed in combination with \fB-2\fR or \fB-5\fR\&. It sets the number of hash rounds used for the SHA-2 algorithms (higher is more secure but slower; the default is 5,000)\&.  
diff --git a/httpd-2.4.39-r1842929+.patch b/httpd-2.4.39-r1842929+.patch
index 9fea432..0bf7292 100644
--- a/httpd-2.4.39-r1842929+.patch
+++ b/httpd-2.4.39-r1842929+.patch
@@ -118,41 +118,6 @@ http://svn.apache.org/viewvc?view=revision&revision=1853631
      dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL,
                               APR_HOOK_MIDDLE);
      dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE);
---- httpd-2.4.39/modules/md/mod_md_config.c.r1842929+
-+++ httpd-2.4.39/modules/md/mod_md_config.c
-@@ -54,10 +54,18 @@
- 
- #define DEF_VAL     (-1)
- 
-+#ifndef MD_DEFAULT_BASE_DIR
-+#define MD_DEFAULT_BASE_DIR "md"
-+#endif
-+
- /* Default settings for the global conf */
- static md_mod_conf_t defmc = {
-     NULL,
--    "md",
-+#if 1
-+    NULL, /* apply default state-dir-relative */
-+#else
-+    MD_DEFAULT_BASE_DIR,
-+#endif
-     NULL,
-     NULL,
-     80,
-@@ -864,6 +872,12 @@
-     if (mc->hsts_max_age > 0) {
-         mc->hsts_header = apr_psprintf(p, "max-age=%d", mc->hsts_max_age);
-     }
-+
-+#if 1
-+    if (mc->base_dir == NULL) {
-+        mc->base_dir = ap_state_dir_relative(p, MD_DEFAULT_BASE_DIR);
-+    }
-+#endif
-     
-     return APR_SUCCESS;
- }
 --- httpd-2.4.39/server/core.c.r1842929+
 +++ httpd-2.4.39/server/core.c
 @@ -129,6 +129,8 @@
diff --git a/httpd.spec b/httpd.spec
index 69c630c..ed18bf1 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.39
-Release: 13%{?dist}
+Version: 2.4.41
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -83,8 +83,6 @@ Patch42: httpd-2.4.37-r1828172+.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.34-r1738878.patch
 Patch60: httpd-2.4.34-enable-sslv3.patch
-# https://bz.apache.org/bugzilla/show_bug.cgi?id=63325
-Patch61: httpd-2.4.37-r1857129.patch
 
 # Security fixes
 
@@ -223,7 +221,6 @@ interface for storing and accessing per-user session data.
 
 %patch58 -p1 -b .r1738878
 %patch60 -p1 -b .enable-sslv3
-%patch61 -p1 -b .r1857129
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -744,6 +741,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Aug 15 2019 Joe Orton <jorton@redhat.com> - 2.4.41-1
+- update to 2.4.41
+
 * Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.39-13
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 
diff --git a/sources b/sources
index 248974a..c6aa939 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.39.tar.bz2) = 9742202040b3dc6344b301540f54b2d3f8e36898410d24206a7f8dcecb1bea7d7230fabc7256752724558af249facf64bffe2cf678b8f7cccb64076737abfda7
+SHA512 (httpd-2.4.41.tar.bz2) = 350cc7dcd2c439e0590338fa6da3f44df44f9bb885c381e91f91b14c2f48597f6f0bbac0ea118a8a67eaa70ae7edbb769beace368643ed73f6daee44c307b335

From 8c08392f60a8d4651bb53b8f83cd024fb90c9653 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Tue, 14 May 2019 10:55:19 -0400
Subject: [PATCH 181/359] Use testpage from system-logos-httpd for proper
 branding

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
 httpd.spec   |  10 ++--
 index.html   | 132 ---------------------------------------------------
 welcome.conf |   1 +
 3 files changed, 7 insertions(+), 136 deletions(-)
 delete mode 100644 index.html

diff --git a/httpd.spec b/httpd.spec
index ed18bf1..043b593 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,10 +13,9 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.41
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
-Source1: index.html
 Source2: httpd.logrotate
 Source3: instance.conf
 Source4: httpd-ssl-pass-dialog
@@ -428,8 +427,8 @@ EOF
 # Handle contentdir
 mkdir $RPM_BUILD_ROOT%{contentdir}/noindex \
       $RPM_BUILD_ROOT%{contentdir}/server-status
-install -m 644 -p $RPM_SOURCE_DIR/index.html \
-        $RPM_BUILD_ROOT%{contentdir}/noindex/index.html
+ln -s ../../fedora-testpage/index.html \
+      $RPM_BUILD_ROOT%{contentdir}/noindex/index.html
 install -m 644 -p docs/server-status/* \
         $RPM_BUILD_ROOT%{contentdir}/server-status
 rm -rf %{contentdir}/htdocs
@@ -741,6 +740,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Sep 19 2019 Stephen Gallagher <sgallagh@redhat.com> - 2.4.41-2
+- Use testpage from system-logos-httpd for proper branding
+
 * Thu Aug 15 2019 Joe Orton <jorton@redhat.com> - 2.4.41-1
 - update to 2.4.41
 
diff --git a/index.html b/index.html
deleted file mode 100644
index 1b7ea03..0000000
--- a/index.html
+++ /dev/null
@@ -1,132 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
-
-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
-	<head>
-		<title>Test Page for the Apache HTTP Server on Fedora</title>
-		<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-		<style type="text/css">
-			/*<![CDATA[*/
-			body {
-				background-color: #fff;
-				color: #000;
-				font-size: 0.9em;
-				font-family: sans-serif,helvetica;
-				margin: 0;
-				padding: 0;
-			}
-			:link {
-				color: #c00;
-			}
-			:visited {
-				color: #c00;
-			}
-			a:hover {
-				color: #f50;
-			}
-			h1 {
-				text-align: center;
-				margin: 0;
-				padding: 0.6em 2em 0.4em;
-				background-color: #22437f;
-				color: #fff;
-				font-weight: normal;
-				font-size: 1.75em;
-				border-bottom: 2px solid #000;
-			}
-			h1 strong {
-				font-weight: bold;
-			}
-			h2 {
-				font-size: 1.1em;
-				font-weight: bold;
-			}
-			hr {
-				display: none;
-			}
-			.content {
-				padding: 1em 5em;
-			}
-			.content-columns {
-				/* Setting relative positioning allows for 
-				absolute positioning for sub-classes */
-				position: relative;
-				padding-top: 1em;
-			}
-			.content-column-left {
-				/* Value for IE/Win; will be overwritten for other browsers */
-				width: 47%;
-				padding-right: 3%;
-				float: left;
-				padding-bottom: 2em;
-			}
-			.content-column-left hr {
-				display: none;
-			}
-			.content-column-right {
-				/* Values for IE/Win; will be overwritten for other browsers */
-				width: 47%;
-				padding-left: 3%;
-				float: left;
-				padding-bottom: 2em;
-			}
-			.content-columns>.content-column-left, .content-columns>.content-column-right {
-				/* Non-IE/Win */
-			}
-			img {
-				border: 2px solid #fff;
-				padding: 2px;
-				margin: 2px;
-			}
-			a:hover img {
-				border: 2px solid #f50;
-			}
-			/*]]>*/
-		</style>
-	</head>
-
-	<body>
-		<h1>Fedora <strong>Test Page</strong></h1>
-
-		<div class="content">
-			<div class="content-middle">
-				<p>This page is used to test the proper operation of the Apache HTTP server after it has been installed. If you can read this page, it means that the web server installed at this site is working properly, but has not yet been configured.</p>
-			</div>
-			<hr />
-
-			<div class="content-columns">
-				<div class="content-column-left">
-					<h2>If you are a member of the general public:</h2>
-
-					<p>The fact that you are seeing this page indicates that the website you just visited is either experiencing problems, or is undergoing routine maintenance.</p>
-
-					<p>If you would like to let the administrators of this website know that you've seen this page instead of the page you expected, you should send them e-mail. In general, mail sent to the name "webmaster" and directed to the website's domain should reach the appropriate person.</p>
-
-					<p>For example, if you experienced problems while visiting www.example.com, you should send e-mail to "webmaster@example.com".</p>
-
-					<p>Fedora is a distribution of Linux, a popular computer operating system. It is commonly used by hosting companies because it is free, and includes free web server software. Many times, they do not set up their web server correctly, and it displays this "test page" instead of the expected website.</p>
-
-					<p>Accordingly, please keep these facts in mind:</p>
-					<ul>
-					<li>Neither the Fedora Project or Red Hat has any affiliation with any website or content hosted from this server (unless otherwise explicitly stated).</li>
-					<li>Neither the Fedora Project or Red Hat has "hacked" this webserver, this test page is an included component of Apache's httpd webserver software.</li>
-					</ul>
-
-					<p>For more information about Fedora, please visit the <a href="https://getfedora.org/">Fedora Project website</a>.</p>
-					<hr />
-				</div>
-
-				<div class="content-column-right">
-					<h2>If you are the website administrator:</h2>
-
-					<p>You may now add content to the directory <code>/var/www/html/</code>. Note that until you do so, people visiting your website will see this page, and not your content. To prevent this page from ever being used, follow the instructions in the file <code>/etc/httpd/conf.d/welcome.conf</code>.</p>
-
-					<div class="logos">
-						<p>You are free to use the images below on Apache and Fedora powered HTTP servers. Thanks for using Apache and Fedora!</p>
-
-						<p><a href="https://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="https://getfedora.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
-					</div>
-				</div>
-			</div>
-		</div>
-	</body>
-</html>
diff --git a/welcome.conf b/welcome.conf
index 5d1e452..b279c2f 100644
--- a/welcome.conf
+++ b/welcome.conf
@@ -16,3 +16,4 @@
 </Directory>
 
 Alias /.noindex.html /usr/share/httpd/noindex/index.html
+Alias /poweredby.png /usr/share/httpd/icons/apache_pb2.png

From a4638c111cab87559dceecc46dc883164ef51375 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 25 Sep 2019 15:23:20 +0100
Subject: [PATCH 182/359] mod_ssl: restore dependency on /usr/bin/hostname
 (#1135118) Resolves: rhbz#1135118

---
 httpd.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 043b593..416a207 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.41
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source2: httpd.logrotate
@@ -157,7 +157,7 @@ Epoch: 1
 BuildRequires: openssl-devel
 Requires(pre): httpd-filesystem
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
-Requires: sscg >= 2.2.0
+Requires: sscg >= 2.2.0, /usr/bin/hostname
 # Require an OpenSSL which supports PROFILE=SYSTEM
 Conflicts: openssl-libs < 1:1.0.1h-4
 
@@ -740,6 +740,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Sep 25 2019 Joe Orton <jorton@redhat.com> - 2.4.41-3
+- mod_ssl: restore dependency on /usr/bin/hostname (#1135118)
+
 * Thu Sep 19 2019 Stephen Gallagher <sgallagh@redhat.com> - 2.4.41-2
 - Use testpage from system-logos-httpd for proper branding
 

From 5b6bedca6c8618b5f40c887c01399f5592d154e0 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 2 Oct 2019 11:47:35 +0100
Subject: [PATCH 183/359] mod_cgid: possible stdout timeout handling fix
 (#1757683) Resolves: rhbz#1757683

---
 ...172+.patch => httpd-2.4.41-r1828172+.patch | 115 ++++++++++--------
 httpd.spec                                    |   7 +-
 pullrev.sh                                    |   4 +-
 3 files changed, 73 insertions(+), 53 deletions(-)
 rename httpd-2.4.37-r1828172+.patch => httpd-2.4.41-r1828172+.patch (94%)

diff --git a/httpd-2.4.37-r1828172+.patch b/httpd-2.4.41-r1828172+.patch
similarity index 94%
rename from httpd-2.4.37-r1828172+.patch
rename to httpd-2.4.41-r1828172+.patch
index 822cccf..534acef 100644
--- a/httpd-2.4.37-r1828172+.patch
+++ b/httpd-2.4.41-r1828172+.patch
@@ -1,10 +1,12 @@
-# ./pullrev.sh 1828172 1862968 1863191
+# ./pullrev.sh 1828172 1862968 1863191 1867878 1867882
 http://svn.apache.org/viewvc?view=revision&revision=1828172
 http://svn.apache.org/viewvc?view=revision&revision=1862968
 http://svn.apache.org/viewvc?view=revision&revision=1863191
+http://svn.apache.org/viewvc?view=revision&revision=1867878
+http://svn.apache.org/viewvc?view=revision&revision=1867882
 
---- httpd-2.4.37/modules/generators/mod_cgi.c
-+++ httpd-2.4.37/modules/generators/mod_cgi.c
+--- httpd-2.4.41/modules/generators/mod_cgi.c
++++ httpd-2.4.41/modules/generators/mod_cgi.c
 @@ -92,6 +92,10 @@
      apr_size_t  bufbytes;
  } cgi_server_conf;
@@ -287,16 +289,19 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
  
      if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
          return DECLINED;
-@@ -928,7 +775,7 @@
-     apr_file_pipe_timeout_set(script_in, 0);
-     apr_file_pipe_timeout_set(script_err, 0);
+@@ -925,10 +772,7 @@
+     AP_DEBUG_ASSERT(script_in != NULL);
  
+ #if APR_FILES_AS_SOCKETS
+-    apr_file_pipe_timeout_set(script_in, 0);
+-    apr_file_pipe_timeout_set(script_err, 0);
+-
 -    b = cgi_bucket_create(r, script_in, script_err, c->bucket_alloc);
 +    b = cgi_bucket_create(r, dc->timeout, script_in, script_err, c->bucket_alloc);
      if (b == NULL)
          return HTTP_INTERNAL_SERVER_ERROR;
  #else
-@@ -985,7 +832,7 @@
+@@ -985,7 +829,7 @@
               * stderr output, as normal. */
              discard_script_output(bb);
              apr_brigade_destroy(bb);
@@ -305,7 +310,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
              log_script_err(r, script_err);
          }
  
-@@ -1036,7 +883,7 @@
+@@ -1036,7 +880,7 @@
       * connection drops or we stopped sending output for some other
       * reason */
      if (rv == APR_SUCCESS && !r->connection->aborted) {
@@ -314,7 +319,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
          log_script_err(r, script_err);
      }
  
-@@ -1277,7 +1124,7 @@
+@@ -1277,7 +1121,7 @@
  AP_DECLARE_MODULE(cgi) =
  {
      STANDARD20_MODULE_STUFF,
@@ -323,8 +328,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
      NULL,                        /* dir merger --- default is to override */
      create_cgi_config,           /* server config */
      merge_cgi_config,            /* merge server config */
---- httpd-2.4.37/modules/generators/mod_cgid.c
-+++ httpd-2.4.37/modules/generators/mod_cgid.c
+--- httpd-2.4.41/modules/generators/mod_cgid.c
++++ httpd-2.4.41/modules/generators/mod_cgid.c
 @@ -342,15 +342,19 @@
      return close(fd);
  }
@@ -350,7 +355,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
      do {
          do {
              rc = read(fd, buf + bytes_read, buf_size - bytes_read);
-@@ -365,9 +369,52 @@
+@@ -365,9 +369,60 @@
          }
      } while (bytes_read < buf_size);
  
@@ -366,11 +371,12 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 +    
 +    msg.msg_iov = &vec;
 +    msg.msg_iovlen = 1;
-+    
-+    msg.msg_control = u.buf;
-+    msg.msg_controllen = sizeof(u.buf);
 +
-+    if (errfd) *errfd = 0;
++    if (errfd) {
++        msg.msg_control = u.buf;
++        msg.msg_controllen = sizeof(u.buf);
++        *errfd = 0;
++    }
 +    
 +    /* use MSG_WAITALL to skip loop on truncated reads */
 +    do {
@@ -380,10 +386,17 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 +    if (rc == 0) {
 +        return ECONNRESET;
 +    }
-+    
-+    cmsg = CMSG_FIRSTHDR(&msg);
++    else if (rc < 0) {
++        return errno;
++    }
++    else if (rc != buf_size) {
++        /* MSG_WAITALL should ensure the recvmsg blocks until the
++         * entire length is read, but let's be paranoid. */
++        return APR_INCOMPLETE;
++    }
++
 +    if (errfd
-+        && cmsg
++        && (cmsg = CMSG_FIRSTHDR(&msg)) != NULL
 +        && cmsg->cmsg_len == CMSG_LEN(sizeof(*errfd))
 +        && cmsg->cmsg_level == SOL_SOCKET
 +        && cmsg->cmsg_type == SCM_RIGHTS) {
@@ -403,7 +416,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
  /* deal with signals
   */
  static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
-@@ -384,7 +431,7 @@
+@@ -384,7 +439,7 @@
      return APR_SUCCESS;
  }
  
@@ -412,7 +425,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
  {
      va_list ap;
      int rc;
-@@ -399,9 +446,39 @@
+@@ -399,9 +454,39 @@
      }
      va_end(ap);
  
@@ -452,7 +465,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
      if (rc < 0) {
          return errno;
      }
-@@ -410,7 +487,7 @@
+@@ -410,7 +495,7 @@
  }
  
  static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
@@ -461,7 +474,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
  {
      int i;
      char **environ;
-@@ -421,7 +498,7 @@
+@@ -421,7 +506,7 @@
      r->server = apr_pcalloc(r->pool, sizeof(server_rec));
  
      /* read the request header */
@@ -470,7 +483,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
      if (stat != APR_SUCCESS) {
          return stat;
      }
-@@ -479,14 +556,15 @@
+@@ -479,14 +564,15 @@
      return APR_SUCCESS;
  }
  
@@ -488,7 +501,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
  
  
      if (ugid == NULL) {
-@@ -507,16 +585,21 @@
+@@ -507,16 +593,21 @@
      req.args_len = r->args ? strlen(r->args) : 0;
      req.loglevel = r->server->log.level;
  
@@ -512,7 +525,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
                             &req, sizeof(req),
                             r->filename, req.filename_len,
                             argv0, req.argv0_len,
-@@ -531,7 +614,7 @@
+@@ -531,7 +622,7 @@
      for (i = 0; i < req.env_count; i++) {
          apr_size_t curlen = strlen(env[i]);
  
@@ -521,7 +534,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
                                  env[i], curlen)) != APR_SUCCESS) {
              return stat;
          }
-@@ -582,20 +665,34 @@
+@@ -582,20 +673,34 @@
      }
  }
  
@@ -564,7 +577,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
  }
  
  static int cgid_server(void *data)
-@@ -669,7 +766,7 @@
+@@ -669,7 +774,7 @@
      }
  
      while (!daemon_should_exit) {
@@ -573,7 +586,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
          char *argv0 = NULL;
          char **env = NULL;
          const char * const *argv;
-@@ -709,7 +806,7 @@
+@@ -709,7 +814,7 @@
          r = apr_pcalloc(ptrans, sizeof(request_rec));
          procnew = apr_pcalloc(ptrans, sizeof(*procnew));
          r->pool = ptrans;
@@ -582,7 +595,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
          if (stat != APR_SUCCESS) {
              ap_log_error(APLOG_MARK, APLOG_ERR, stat,
                           main_server, APLOGNO(01248)
-@@ -741,6 +838,16 @@
+@@ -741,6 +846,16 @@
              continue;
          }
  
@@ -599,7 +612,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
          apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool);
          apr_os_file_put(&inout, &sd2, 0, r->pool);
  
-@@ -800,7 +907,10 @@
+@@ -800,7 +915,10 @@
              close(sd2);
          }
          else {
@@ -611,7 +624,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
  
              argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args);
  
-@@ -1099,6 +1209,33 @@
+@@ -1099,6 +1217,33 @@
      return ret;
  }
  
@@ -645,7 +658,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
  static int log_script(request_rec *r, cgid_server_conf * conf, int ret,
                        char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
                        apr_file_t *script_err)
-@@ -1204,6 +1341,11 @@
+@@ -1204,6 +1349,11 @@
      return ret;
  }
  
@@ -657,7 +670,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
  static int connect_to_daemon(int *sdptr, request_rec *r,
                               cgid_server_conf *conf)
  {
-@@ -1395,6 +1537,7 @@
+@@ -1395,6 +1545,7 @@
  
  static int cgid_handler(request_rec *r)
  {
@@ -665,7 +678,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
      int retval, nph, dbpos;
      char *argv0, *dbuf;
      apr_bucket_brigade *bb;
-@@ -1404,10 +1547,11 @@
+@@ -1404,10 +1555,11 @@
      int seen_eos, child_stopped_reading;
      int sd;
      char **env;
@@ -678,7 +691,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
  
      if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
          return DECLINED;
-@@ -1416,7 +1560,7 @@
+@@ -1416,7 +1568,7 @@
      conf = ap_get_module_config(r->server->module_config, &cgid_module);
      dc = ap_get_module_config(r->per_dir_config, &cgid_module);
  
@@ -687,7 +700,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
      is_included = !strcmp(r->protocol, "INCLUDED");
  
      if ((argv0 = strrchr(r->filename, '/')) != NULL) {
-@@ -1469,6 +1613,17 @@
+@@ -1469,6 +1621,17 @@
      }
      */
  
@@ -705,7 +718,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
      /*
       * httpd core function used to add common environment variables like
       * DOCUMENT_ROOT. 
-@@ -1481,12 +1636,16 @@
+@@ -1481,12 +1644,16 @@
          return retval;
      }
  
@@ -723,7 +736,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
      info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
      info->conf = conf;
      info->r = r;
-@@ -1508,12 +1667,7 @@
+@@ -1508,12 +1675,7 @@
       */
  
      apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
@@ -737,7 +750,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
      apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket);
  
      /* Transfer any put/post args, CERN style...
-@@ -1605,23 +1759,28 @@
+@@ -1605,23 +1767,28 @@
       */
      shutdown(sd, 1);
  
@@ -774,7 +787,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
  
              /*
               * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
-@@ -1658,6 +1817,11 @@
+@@ -1658,6 +1825,11 @@
              /* Soak up all the script output */
              discard_script_output(bb);
              apr_brigade_destroy(bb);
@@ -786,7 +799,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
              /* This redirect needs to be a GET no matter what the original
               * method was.
               */
-@@ -1690,7 +1854,6 @@
+@@ -1690,7 +1862,6 @@
      }
  
      if (nph) {
@@ -794,7 +807,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
          struct ap_filter_t *cur;
  
          /* get rid of all filters up through protocol...  since we
-@@ -1704,14 +1867,20 @@
+@@ -1704,14 +1875,20 @@
          }
          r->output_filters = r->proto_output_filters = cur;
  
@@ -821,7 +834,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
      return OK; /* NOT r->status, even if it has changed. */
  }
  
-@@ -1829,7 +1998,7 @@
+@@ -1829,7 +2006,7 @@
          return retval;
      }
  
@@ -830,8 +843,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
  
      info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
      info->conf = conf;
---- httpd-2.4.37/modules/generators/config5.m4
-+++ httpd-2.4.37/modules/generators/config5.m4
+--- httpd-2.4.41/modules/generators/config5.m4
++++ httpd-2.4.41/modules/generators/config5.m4
 @@ -78,4 +78,15 @@
  
  APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
@@ -848,9 +861,9 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 +])
 +
  APACHE_MODPATH_FINISH
---- httpd-2.4.37/modules/generators/cgi_common.h
-+++ httpd-2.4.37/modules/generators/cgi_common.h
-@@ -0,0 +1,216 @@
+--- httpd-2.4.41/modules/generators/cgi_common.h
++++ httpd-2.4.41/modules/generators/cgi_common.h
+@@ -0,0 +1,220 @@
 +/* Licensed to the Apache Software Foundation (ASF) under one or more
 + * contributor license agreements.  See the NOTICE file distributed with
 + * this work for additional information regarding copyright ownership.
@@ -902,6 +915,10 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 +    apr_pollfd_t fd;
 +    struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data);
 +
++    /* Disable APR timeout handling since we'll use poll() entirely. */
++    apr_file_pipe_timeout_set(out, 0);
++    apr_file_pipe_timeout_set(err, 0);
++    
 +    APR_BUCKET_INIT(b);
 +    b->free = apr_bucket_free;
 +    b->list = list;
diff --git a/httpd.spec b/httpd.spec
index 416a207..06fe8c5 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.41
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source2: httpd.logrotate
@@ -76,7 +76,7 @@ Patch38: httpd-2.4.34-sslciphdefault.patch
 Patch39: httpd-2.4.37-sslprotdefault.patch
 Patch40: httpd-2.4.39-r1861269.patch
 Patch41: httpd-2.4.37-r1861793+.patch
-Patch42: httpd-2.4.37-r1828172+.patch
+Patch42: httpd-2.4.41-r1828172+.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -740,6 +740,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Oct  2 2019 Joe Orton <jorton@redhat.com> - 2.4.41-4
+- mod_cgid: possible stdout timeout handling fix (#1757683)
+
 * Wed Sep 25 2019 Joe Orton <jorton@redhat.com> - 2.4.41-3
 - mod_ssl: restore dependency on /usr/bin/hostname (#1135118)
 
diff --git a/pullrev.sh b/pullrev.sh
index 5494c7e..efe221f 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -7,7 +7,7 @@ fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
 #repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.37
+ver=2.4.41
 prefix="httpd-${ver}"
 suffix="r$1${2:++}"
 fn="${prefix}-${suffix}.patch"
@@ -36,7 +36,7 @@ for r in $*; do
     echo "+ fetching ${r}"
     this=`mktemp /tmp/pullrevXXXXXX`
     svn diff -c ${r} ${repo} | filterdiff --remove-timestamps --clean -x 'CHANGES' -x '*/next-number' -x 'STATUS' \
-        --addprefix="${prefix}/" > ${this}
+        -x '*.xml' --addprefix="${prefix}/" > ${this}
     next=`mktemp /tmp/pullrevXXXXXX`
     combinediff --quiet ${prev} ${this} > ${next}
     rm -f "${this}"

From f1280d5f56f726ae20ad766d80dc62fffe5a606c Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 3 Oct 2019 09:06:46 +0100
Subject: [PATCH 184/359] mod_proxy_balancer: fix balancer-manager XSRF check
 (PR 63688)

---
 httpd-2.4.41-r1865749.patch | 14 ++++++++++++++
 httpd.spec                  |  7 ++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.41-r1865749.patch

diff --git a/httpd-2.4.41-r1865749.patch b/httpd-2.4.41-r1865749.patch
new file mode 100644
index 0000000..d79a559
--- /dev/null
+++ b/httpd-2.4.41-r1865749.patch
@@ -0,0 +1,14 @@
+# ./pullrev.sh 1865749
+http://svn.apache.org/viewvc?view=revision&revision=1865749
+
+--- httpd-2.4.41/modules/proxy/mod_proxy_balancer.c.r1865749
++++ httpd-2.4.41/modules/proxy/mod_proxy_balancer.c
+@@ -1104,7 +1104,7 @@
+     if (apr_uri_parse(r->pool, ref, &uri) || !uri.hostname)
+         return 0;
+ 
+-    return strcmp(uri.hostname, ap_get_server_name(r)) == 0;
++    return strcasecmp(uri.hostname, ap_get_server_name(r)) == 0;
+ }
+ 
+ /* Manages the loadfactors and member status
diff --git a/httpd.spec b/httpd.spec
index 06fe8c5..55a783d 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.41
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source2: httpd.logrotate
@@ -82,6 +82,7 @@ Patch42: httpd-2.4.41-r1828172+.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.34-r1738878.patch
 Patch60: httpd-2.4.34-enable-sslv3.patch
+Patch61: httpd-2.4.41-r1865749.patch
 
 # Security fixes
 
@@ -220,6 +221,7 @@ interface for storing and accessing per-user session data.
 
 %patch58 -p1 -b .r1738878
 %patch60 -p1 -b .enable-sslv3
+%patch61 -p1 -b .r1865749
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -740,6 +742,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Oct  3 2019 Joe Orton <jorton@redhat.com> - 2.4.41-5
+- mod_proxy_balancer: fix balancer-manager XSRF check (PR 63688)
+
 * Wed Oct  2 2019 Joe Orton <jorton@redhat.com> - 2.4.41-4
 - mod_cgid: possible stdout timeout handling fix (#1757683)
 

From 5f6c5adf6f8ba549061650f73ec554c9e6d23d53 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 3 Oct 2019 09:10:23 +0100
Subject: [PATCH 185/359] Remove suexec patch already merged upstream.

---
 httpd-2.4.4-r1337344+.patch | 250 ------------------------------------
 httpd.spec                  |   2 -
 2 files changed, 252 deletions(-)
 delete mode 100644 httpd-2.4.4-r1337344+.patch

diff --git a/httpd-2.4.4-r1337344+.patch b/httpd-2.4.4-r1337344+.patch
deleted file mode 100644
index 6e5c3e7..0000000
--- a/httpd-2.4.4-r1337344+.patch
+++ /dev/null
@@ -1,250 +0,0 @@
-# ./pullrev.sh 1337344 1341905 1342065 1341930
-
-suexec enhancements:
-
-1) use syslog for logging
-2) use capabilities not setuid/setgid root binary
-
-http://svn.apache.org/viewvc?view=revision&revision=1337344
-http://svn.apache.org/viewvc?view=revision&revision=1341905
-http://svn.apache.org/viewvc?view=revision&revision=1342065
-http://svn.apache.org/viewvc?view=revision&revision=1341930
-
---- httpd-2.4.4/configure.in.r1337344+
-+++ httpd-2.4.4/configure.in
-@@ -734,7 +734,24 @@ APACHE_HELP_STRING(--with-suexec-gidmin,
- 
- AC_ARG_WITH(suexec-logfile,
- APACHE_HELP_STRING(--with-suexec-logfile,Set the logfile),[
--  AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file] ) ] )
-+  if test "x$withval" = "xyes"; then
-+    AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file])
-+  fi
-+])
-+
-+AC_ARG_WITH(suexec-syslog,
-+APACHE_HELP_STRING(--with-suexec-syslog,Set the logfile),[
-+  if test $withval = "yes"; then
-+    if test "x${with_suexec_logfile}" != "xno"; then
-+      AC_MSG_NOTICE([hint: use "--without-suexec-logfile --with-suexec-syslog"])
-+      AC_MSG_ERROR([suexec does not support both logging to file and syslog])
-+    fi
-+    AC_CHECK_FUNCS([vsyslog], [], [
-+       AC_MSG_ERROR([cannot support syslog from suexec without vsyslog()])])
-+    AC_DEFINE(AP_LOG_SYSLOG, 1, [SuExec log to syslog])
-+  fi    
-+])
-+
- 
- AC_ARG_WITH(suexec-safepath,
- APACHE_HELP_STRING(--with-suexec-safepath,Set the safepath),[
-@@ -744,6 +761,15 @@ AC_ARG_WITH(suexec-umask,
- APACHE_HELP_STRING(--with-suexec-umask,umask for suexec'd process),[
-   AC_DEFINE_UNQUOTED(AP_SUEXEC_UMASK, 0$withval, [umask for suexec'd process] ) ] )
- 
-+INSTALL_SUEXEC=setuid
-+AC_ARG_ENABLE([suexec-capabilities], 
-+APACHE_HELP_STRING(--enable-suexec-capabilities,Use Linux capability bits not setuid root suexec), [
-+INSTALL_SUEXEC=caps
-+AC_DEFINE(AP_SUEXEC_CAPABILITIES, 1, 
-+          [Enable if suexec is installed with Linux capabilities, not setuid])
-+])
-+APACHE_SUBST(INSTALL_SUEXEC)
-+
- dnl APR should go after the other libs, so the right symbols can be picked up
- if test x${apu_found} != xobsolete; then
-   AP_LIBS="$AP_LIBS `$apu_config --avoid-ldap --link-libtool`"
---- httpd-2.4.4/docs/manual/suexec.html.en.r1337344+
-+++ httpd-2.4.4/docs/manual/suexec.html.en
-@@ -372,6 +372,21 @@
-       together with the <code>--enable-suexec</code> option to let
-       APACI accept your request for using the suEXEC feature.</dd>
- 
-+      <dt><code>--enable-suexec-capabilities</code></dt>
-+
-+      <dd><strong>Linux specific:</strong> Normally,
-+      the <code>suexec</code> binary is installed "setuid/setgid
-+      root", which allows it to run with the full privileges of the
-+      root user.  If this option is used, the <code>suexec</code>
-+      binary will instead be installed with only the setuid/setgid
-+      "capability" bits set, which is the subset of full root
-+      priviliges required for suexec operation.  Note that
-+      the <code>suexec</code> binary may not be able to write to a log
-+      file in this mode; it is recommended that the
-+      <code>--with-suexec-syslog --without-suexec-logfile</code>
-+      options are used in conjunction with this mode, so that syslog
-+      logging is used instead.</dd>
-+
-       <dt><code>--with-suexec-bin=<em>PATH</em></code></dt>
- 
-       <dd>The path to the <code>suexec</code> binary must be hard-coded
-@@ -433,6 +448,12 @@
-       "<code>suexec_log</code>" and located in your standard logfile
-       directory (<code>--logfiledir</code>).</dd>
- 
-+      <dt><code>--with-suexec-syslog</code></dt>
-+
-+      <dd>If defined, suexec will log notices and errors to syslog
-+      instead of a logfile.  This option must be combined
-+      with <code>--without-suexec-logfile</code>.</dd>
-+
-       <dt><code>--with-suexec-safepath=<em>PATH</em></code></dt>
- 
-       <dd>Define a safe PATH environment to pass to CGI
-@@ -550,9 +571,12 @@ Group webgroup
- 
-     <p>The suEXEC wrapper will write log information
-     to the file defined with the <code>--with-suexec-logfile</code>
--    option as indicated above. If you feel you have configured and
--    installed the wrapper properly, have a look at this log and the
--    error_log for the server to see where you may have gone astray.</p>
-+    option as indicated above, or to syslog if <code>--with-suexec-syslog</code>
-+    is used. If you feel you have configured and
-+    installed the wrapper properly, have a look at the log and the
-+    error_log for the server to see where you may have gone astray. 
-+    The output of <code>"suexec -V"</code> will show the options
-+    used to compile suexec, if using a binary distribution.</p>
- 
- </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
- <div class="section">
-@@ -640,4 +664,4 @@ if (typeof(prettyPrint) !== 'undefined')
-     prettyPrint();
- }
- //--><!]]></script>
--</body></html>
-\ No newline at end of file
-+</body></html>
---- httpd-2.4.4/Makefile.in.r1337344+
-+++ httpd-2.4.4/Makefile.in
-@@ -238,11 +238,22 @@ install-man:
- 	  cd $(DESTDIR)$(manualdir) && find . -name ".svn" -type d -print | xargs rm -rf 2>/dev/null || true; \
- 	fi
- 
--install-suexec:
-+install-suexec: install-suexec-binary install-suexec-$(INSTALL_SUEXEC)
-+
-+install-suexec-binary:
- 	@if test -f $(builddir)/support/suexec; then \
-             test -d $(DESTDIR)$(sbindir) || $(MKINSTALLDIRS) $(DESTDIR)$(sbindir); \
-             $(INSTALL_PROGRAM) $(top_builddir)/support/suexec $(DESTDIR)$(sbindir); \
--            chmod 4755 $(DESTDIR)$(sbindir)/suexec; \
-+	fi
-+
-+install-suexec-setuid:
-+	@if test -f $(builddir)/support/suexec; then \
-+	    chmod 4755 $(DESTDIR)$(sbindir)/suexec; \
-+	fi
-+
-+install-suexec-caps:
-+	@if test -f $(builddir)/support/suexec; then \
-+            setcap 'cap_setuid,cap_setgid+pe' $(DESTDIR)$(sbindir)/suexec; \
- 	fi
- 
- suexec:
---- httpd-2.4.4/modules/arch/unix/mod_unixd.c.r1337344+
-+++ httpd-2.4.4/modules/arch/unix/mod_unixd.c
-@@ -284,6 +284,13 @@ unixd_set_suexec(cmd_parms *cmd, void *d
-     return NULL;
- }
- 
-+#ifdef AP_SUEXEC_CAPABILITIES
-+/* If suexec is using capabilities, don't test for the setuid bit. */
-+#define SETUID_TEST(finfo) (1)
-+#else
-+#define SETUID_TEST(finfo) (finfo.protection & APR_USETID)
-+#endif
-+
- static int
- unixd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
-                  apr_pool_t *ptemp)
-@@ -300,7 +307,7 @@ unixd_pre_config(apr_pool_t *pconf, apr_
-     ap_unixd_config.suexec_enabled = 0;
-     if ((apr_stat(&wrapper, SUEXEC_BIN, APR_FINFO_NORM, ptemp))
-          == APR_SUCCESS) {
--        if ((wrapper.protection & APR_USETID) && wrapper.user == 0
-+        if (SETUID_TEST(wrapper) && wrapper.user == 0
-             && (access(SUEXEC_BIN, R_OK|X_OK) == 0)) {
-             ap_unixd_config.suexec_enabled = 1;
-             ap_unixd_config.suexec_disabled_reason = "";
---- httpd-2.4.4/support/suexec.c.r1337344+
-+++ httpd-2.4.4/support/suexec.c
-@@ -58,6 +58,10 @@
- #include <grp.h>
- #endif
- 
-+#ifdef AP_LOG_SYSLOG
-+#include <syslog.h>
-+#endif
-+
- #if defined(PATH_MAX)
- #define AP_MAXPATH PATH_MAX
- #elif defined(MAXPATHLEN)
-@@ -69,7 +73,20 @@
- #define AP_ENVBUF 256
- 
- extern char **environ;
-+
-+#ifdef AP_LOG_SYSLOG
-+/* Syslog support. */
-+#if !defined(AP_LOG_FACILITY) && defined(LOG_AUTHPRIV)
-+#define AP_LOG_FACILITY LOG_AUTHPRIV
-+#elif !defined(AP_LOG_FACILITY)
-+#define AP_LOG_FACILITY LOG_AUTH
-+#endif
-+
-+static int log_open;
-+#else
-+/* Non-syslog support. */
- static FILE *log = NULL;
-+#endif
- 
- static const char *const safe_env_lst[] =
- {
-@@ -137,7 +154,14 @@ static void err_output(int is_error, con
- 
- static void err_output(int is_error, const char *fmt, va_list ap)
- {
--#ifdef AP_LOG_EXEC
-+#if defined(AP_LOG_SYSLOG)
-+    if (!log_open) {
-+        openlog("suexec", LOG_PID, AP_LOG_FACILITY);
-+        log_open = 1;
-+    }
-+
-+    vsyslog(is_error ? LOG_ERR : LOG_INFO, fmt, ap);
-+#elif defined(AP_LOG_EXEC)
-     time_t timevar;
-     struct tm *lt;
- 
-@@ -295,7 +319,9 @@ int main(int argc, char *argv[])
- #ifdef AP_HTTPD_USER
-         fprintf(stderr, " -D AP_HTTPD_USER=\"%s\"\n", AP_HTTPD_USER);
- #endif
--#ifdef AP_LOG_EXEC
-+#if defined(AP_LOG_SYSLOG)
-+        fprintf(stderr, " -D AP_LOG_SYSLOG\n");
-+#elif defined(AP_LOG_EXEC)
-         fprintf(stderr, " -D AP_LOG_EXEC=\"%s\"\n", AP_LOG_EXEC);
- #endif
- #ifdef AP_SAFE_PATH
-@@ -591,6 +617,12 @@ int main(int argc, char *argv[])
- #endif /* AP_SUEXEC_UMASK */
- 
-     /* Be sure to close the log file so the CGI can't mess with it. */
-+#ifdef AP_LOG_SYSLOG
-+    if (log_open) {
-+        closelog();
-+        log_open = 0;
-+    }
-+#else
-     if (log != NULL) {
- #if APR_HAVE_FCNTL_H
-         /*
-@@ -612,6 +644,7 @@ int main(int argc, char *argv[])
-         log = NULL;
- #endif
-     }
-+#endif
- 
-     /*
-      * Execute the command, replacing our image with its own.
diff --git a/httpd.spec b/httpd.spec
index 55a783d..6ceb282 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -65,7 +65,6 @@ Patch21: httpd-2.4.39-r1842929+.patch
 Patch23: httpd-2.4.39-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
-Patch26: httpd-2.4.4-r1337344+.patch
 Patch27: httpd-2.4.2-icons.patch
 Patch29: httpd-2.4.33-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
@@ -206,7 +205,6 @@ interface for storing and accessing per-user session data.
 %patch23 -p1 -b .export
 %patch24 -p1 -b .corelimit
 %patch25 -p1 -b .selinux
-#patch26 -p1 -b .r1337344+
 %patch27 -p1 -b .icons
 %patch29 -p1 -b .systemd
 %patch30 -p1 -b .cachehardmax

From aaba8b57e0025c9a75d646e6e71600d28e126a61 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 4 Oct 2019 16:47:09 +0100
Subject: [PATCH 186/359] mod_cgid/mod_cgi: further upstream consolidation
 patches

---
 httpd-2.4.41-r1828172+.patch | 568 +++++++++++++++++++++++++++--------
 httpd.spec                   |   5 +-
 2 files changed, 455 insertions(+), 118 deletions(-)

diff --git a/httpd-2.4.41-r1828172+.patch b/httpd-2.4.41-r1828172+.patch
index 534acef..72b124b 100644
--- a/httpd-2.4.41-r1828172+.patch
+++ b/httpd-2.4.41-r1828172+.patch
@@ -1,9 +1,12 @@
-# ./pullrev.sh 1828172 1862968 1863191 1867878 1867882
+# ./pullrev.sh 1828172 1862968 1863191 1867878 1867882 1867968 1867970 1867971
 http://svn.apache.org/viewvc?view=revision&revision=1828172
 http://svn.apache.org/viewvc?view=revision&revision=1862968
 http://svn.apache.org/viewvc?view=revision&revision=1863191
 http://svn.apache.org/viewvc?view=revision&revision=1867878
 http://svn.apache.org/viewvc?view=revision&revision=1867882
+http://svn.apache.org/viewvc?view=revision&revision=1867968
+http://svn.apache.org/viewvc?view=revision&revision=1867970
+http://svn.apache.org/viewvc?view=revision&revision=1867971
 
 --- httpd-2.4.41/modules/generators/mod_cgi.c
 +++ httpd-2.4.41/modules/generators/mod_cgi.c
@@ -89,9 +92,31 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
              }
          }
      }
-@@ -563,189 +590,7 @@
+@@ -541,212 +568,10 @@
+     return APR_SUCCESS;
  }
  
+-static void discard_script_output(apr_bucket_brigade *bb)
+-{
+-    apr_bucket *e;
+-    const char *buf;
+-    apr_size_t len;
+-    apr_status_t rv;
+-
+-    for (e = APR_BRIGADE_FIRST(bb);
+-         e != APR_BRIGADE_SENTINEL(bb);
+-         e = APR_BUCKET_NEXT(e))
+-    {
+-        if (APR_BUCKET_IS_EOS(e)) {
+-            break;
+-        }
+-        rv = apr_bucket_read(e, &buf, &len, APR_BLOCK_READ);
+-        if (rv != APR_SUCCESS) {
+-            break;
+-        }
+-    }
+-}
+-
  #if APR_FILES_AS_SOCKETS
 -
 -/* A CGI bucket type is needed to catch any output to stderr from the
@@ -276,11 +301,13 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
 -    apr_bucket_copy_notimpl
 -};
 -
-+#include "cgi_common.h"
++#define WANT_CGI_BUCKET
  #endif
++#include "cgi_common.h"
  
  static int cgi_handler(request_rec *r)
-@@ -766,6 +611,8 @@
+ {
+@@ -766,6 +591,8 @@
      apr_status_t rv;
      cgi_exec_info_t e_info;
      conn_rec *c;
@@ -289,7 +316,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
  
      if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
          return DECLINED;
-@@ -925,10 +772,7 @@
+@@ -925,10 +752,7 @@
      AP_DEBUG_ASSERT(script_in != NULL);
  
  #if APR_FILES_AS_SOCKETS
@@ -301,25 +328,120 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
      if (b == NULL)
          return HTTP_INTERNAL_SERVER_ERROR;
  #else
-@@ -985,7 +829,7 @@
-              * stderr output, as normal. */
-             discard_script_output(bb);
-             apr_brigade_destroy(bb);
+@@ -938,111 +762,7 @@
+     b = apr_bucket_eos_create(c->bucket_alloc);
+     APR_BRIGADE_INSERT_TAIL(bb, b);
+ 
+-    /* Handle script return... */
+-    if (!nph) {
+-        const char *location;
+-        char sbuf[MAX_STRING_LEN];
+-        int ret;
+-
+-        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+-                                                        APLOG_MODULE_INDEX)))
+-        {
+-            ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err);
+-
+-            /*
+-             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
+-             * does not set an explicit status and ap_meets_conditions, which
+-             * is called by ap_scan_script_header_err_brigade, detects that
+-             * the conditions of the requests are met and the response is
+-             * not modified.
+-             * In this case set r->status and return OK in order to prevent
+-             * running through the error processing stack as this would
+-             * break with mod_cache, if the conditions had been set by
+-             * mod_cache itself to validate a stale entity.
+-             * BTW: We circumvent the error processing stack anyway if the
+-             * CGI script set an explicit status code (whatever it is) and
+-             * the only possible values for ret here are:
+-             *
+-             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
+-             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
+-             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
+-             * processing of the response of the CGI script, e.g broken headers
+-             * or a crashed CGI process).
+-             */
+-            if (ret == HTTP_NOT_MODIFIED) {
+-                r->status = ret;
+-                return OK;
+-            }
+-
+-            return ret;
+-        }
+-
+-        location = apr_table_get(r->headers_out, "Location");
+-
+-        if (location && r->status == 200) {
+-            /* For a redirect whether internal or not, discard any
+-             * remaining stdout from the script, and log any remaining
+-             * stderr output, as normal. */
+-            discard_script_output(bb);
+-            apr_brigade_destroy(bb);
 -            apr_file_pipe_timeout_set(script_err, r->server->timeout);
-+            apr_file_pipe_timeout_set(script_err, timeout);
-             log_script_err(r, script_err);
-         }
- 
-@@ -1036,7 +880,7 @@
-      * connection drops or we stopped sending output for some other
-      * reason */
-     if (rv == APR_SUCCESS && !r->connection->aborted) {
+-            log_script_err(r, script_err);
+-        }
+-
+-        if (location && location[0] == '/' && r->status == 200) {
+-            /* This redirect needs to be a GET no matter what the original
+-             * method was.
+-             */
+-            r->method = "GET";
+-            r->method_number = M_GET;
+-
+-            /* We already read the message body (if any), so don't allow
+-             * the redirected request to think it has one.  We can ignore
+-             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
+-             */
+-            apr_table_unset(r->headers_in, "Content-Length");
+-
+-            ap_internal_redirect_handler(location, r);
+-            return OK;
+-        }
+-        else if (location && r->status == 200) {
+-            /* XXX: Note that if a script wants to produce its own Redirect
+-             * body, it now has to explicitly *say* "Status: 302"
+-             */
+-            return HTTP_MOVED_TEMPORARILY;
+-        }
+-
+-        rv = ap_pass_brigade(r->output_filters, bb);
+-    }
+-    else /* nph */ {
+-        struct ap_filter_t *cur;
+-
+-        /* get rid of all filters up through protocol...  since we
+-         * haven't parsed off the headers, there is no way they can
+-         * work
+-         */
+-
+-        cur = r->proto_output_filters;
+-        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
+-            cur = cur->next;
+-        }
+-        r->output_filters = r->proto_output_filters = cur;
+-
+-        rv = ap_pass_brigade(r->output_filters, bb);
+-    }
+-
+-    /* don't soak up script output if errors occurred writing it
+-     * out...  otherwise, we prolong the life of the script when the
+-     * connection drops or we stopped sending output for some other
+-     * reason */
+-    if (rv == APR_SUCCESS && !r->connection->aborted) {
 -        apr_file_pipe_timeout_set(script_err, r->server->timeout);
-+        apr_file_pipe_timeout_set(script_err, timeout);
-         log_script_err(r, script_err);
-     }
+-        log_script_err(r, script_err);
+-    }
+-
+-    apr_file_close(script_err);
+-
+-    return OK;                      /* NOT r->status, even if it has changed. */
++    return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err);
+ }
  
-@@ -1277,7 +1121,7 @@
+ /*============================================================================
+@@ -1277,7 +997,7 @@
  AP_DECLARE_MODULE(cgi) =
  {
      STANDARD20_MODULE_STUFF,
@@ -328,6 +450,24 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
      NULL,                        /* dir merger --- default is to override */
      create_cgi_config,           /* server config */
      merge_cgi_config,            /* merge server config */
+--- httpd-2.4.41/modules/generators/config5.m4
++++ httpd-2.4.41/modules/generators/config5.m4
+@@ -78,4 +78,15 @@
+ 
+ APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
+ 
++AC_ARG_ENABLE(cgid-fdpassing,
++  [APACHE_HELP_STRING(--enable-cgid-fdpassing,Enable experimental mod_cgid support for fd passing)],
++  [if test "$enableval" = "yes"; then
++     AC_CHECK_DECL(CMSG_DATA,
++       [AC_DEFINE([HAVE_CGID_FDPASSING], 1, [Enable FD passing support in mod_cgid])],
++       [AC_MSG_ERROR([cannot support mod_cgid fd-passing on this system])], [
++#include <sys/types.h>
++#include <sys/socket.h>])
++  fi
++])
++
+ APACHE_MODPATH_FINISH
 --- httpd-2.4.41/modules/generators/mod_cgid.c
 +++ httpd-2.4.41/modules/generators/mod_cgid.c
 @@ -342,15 +342,19 @@
@@ -658,19 +798,49 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
  static int log_script(request_rec *r, cgid_server_conf * conf, int ret,
                        char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
                        apr_file_t *script_err)
-@@ -1204,6 +1349,11 @@
+@@ -1204,6 +1349,13 @@
      return ret;
  }
  
-+#ifdef HAVE_CGID_FDPASSING
 +/* Pull in CGI bucket implementation. */
-+#include "cgi_common.h"
++#define cgi_server_conf cgid_server_conf
++#ifdef HAVE_CGID_FDPASSING
++#define WANT_CGI_BUCKET
 +#endif
++#include "cgi_common.h"
 +
  static int connect_to_daemon(int *sdptr, request_rec *r,
                               cgid_server_conf *conf)
  {
-@@ -1395,6 +1545,7 @@
+@@ -1270,27 +1422,6 @@
+     return OK;
+ }
+ 
+-static void discard_script_output(apr_bucket_brigade *bb)
+-{
+-    apr_bucket *e;
+-    const char *buf;
+-    apr_size_t len;
+-    apr_status_t rv;
+-
+-    for (e = APR_BRIGADE_FIRST(bb);
+-         e != APR_BRIGADE_SENTINEL(bb);
+-         e = APR_BUCKET_NEXT(e))
+-    {
+-        if (APR_BUCKET_IS_EOS(e)) {
+-            break;
+-        }
+-        rv = apr_bucket_read(e, &buf, &len, APR_BLOCK_READ);
+-        if (rv != APR_SUCCESS) {
+-            break;
+-        }
+-    }
+-}
+-
+ /****************************************************************
+  *
+  * Actual cgid handling...
+@@ -1395,6 +1526,7 @@
  
  static int cgid_handler(request_rec *r)
  {
@@ -678,7 +848,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
      int retval, nph, dbpos;
      char *argv0, *dbuf;
      apr_bucket_brigade *bb;
-@@ -1404,10 +1555,11 @@
+@@ -1404,10 +1536,11 @@
      int seen_eos, child_stopped_reading;
      int sd;
      char **env;
@@ -691,7 +861,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
  
      if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
          return DECLINED;
-@@ -1416,7 +1568,7 @@
+@@ -1416,7 +1549,7 @@
      conf = ap_get_module_config(r->server->module_config, &cgid_module);
      dc = ap_get_module_config(r->per_dir_config, &cgid_module);
  
@@ -700,7 +870,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
      is_included = !strcmp(r->protocol, "INCLUDED");
  
      if ((argv0 = strrchr(r->filename, '/')) != NULL) {
-@@ -1469,6 +1621,17 @@
+@@ -1469,6 +1602,17 @@
      }
      */
  
@@ -718,7 +888,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
      /*
       * httpd core function used to add common environment variables like
       * DOCUMENT_ROOT. 
-@@ -1481,12 +1644,16 @@
+@@ -1481,12 +1625,16 @@
          return retval;
      }
  
@@ -736,7 +906,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
      info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
      info->conf = conf;
      info->r = r;
-@@ -1508,12 +1675,7 @@
+@@ -1508,12 +1656,7 @@
       */
  
      apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
@@ -750,10 +920,116 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
      apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket);
  
      /* Transfer any put/post args, CERN style...
-@@ -1605,23 +1767,28 @@
+@@ -1605,114 +1748,19 @@
       */
      shutdown(sd, 1);
  
+-    /* Handle script return... */
+-    if (!nph) {
+-        conn_rec *c = r->connection;
+-        const char *location;
+-        char sbuf[MAX_STRING_LEN];
+-        int ret;
+-
+-        bb = apr_brigade_create(r->pool, c->bucket_alloc);
+-        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-        b = apr_bucket_eos_create(c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-
+-        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+-                                                        APLOG_MODULE_INDEX)))
+-        {
+-            ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL);
+-
+-            /*
+-             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
+-             * does not set an explicit status and ap_meets_conditions, which
+-             * is called by ap_scan_script_header_err_brigade, detects that
+-             * the conditions of the requests are met and the response is
+-             * not modified.
+-             * In this case set r->status and return OK in order to prevent
+-             * running through the error processing stack as this would
+-             * break with mod_cache, if the conditions had been set by
+-             * mod_cache itself to validate a stale entity.
+-             * BTW: We circumvent the error processing stack anyway if the
+-             * CGI script set an explicit status code (whatever it is) and
+-             * the only possible values for ret here are:
+-             *
+-             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
+-             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
+-             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
+-             * processing of the response of the CGI script, e.g broken headers
+-             * or a crashed CGI process).
+-             */
+-            if (ret == HTTP_NOT_MODIFIED) {
+-                r->status = ret;
+-                return OK;
+-            }
+-
+-            return ret;
+-        }
+-
+-        location = apr_table_get(r->headers_out, "Location");
+-
+-        if (location && location[0] == '/' && r->status == 200) {
+-
+-            /* Soak up all the script output */
+-            discard_script_output(bb);
+-            apr_brigade_destroy(bb);
+-            /* This redirect needs to be a GET no matter what the original
+-             * method was.
+-             */
+-            r->method = "GET";
+-            r->method_number = M_GET;
+-
+-            /* We already read the message body (if any), so don't allow
+-             * the redirected request to think it has one. We can ignore
+-             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
+-             */
+-            apr_table_unset(r->headers_in, "Content-Length");
+-
+-            ap_internal_redirect_handler(location, r);
+-            return OK;
+-        }
+-        else if (location && r->status == 200) {
+-            /* XXX: Note that if a script wants to produce its own Redirect
+-             * body, it now has to explicitly *say* "Status: 302"
+-             */
+-            discard_script_output(bb);
+-            apr_brigade_destroy(bb);
+-            return HTTP_MOVED_TEMPORARILY;
+-        }
+-
+-        rv = ap_pass_brigade(r->output_filters, bb);
+-        if (rv != APR_SUCCESS) { 
+-            ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r,
+-                          "Failed to flush CGI output to client");
+-        }
+-    }
+-
+-    if (nph) {
+-        conn_rec *c = r->connection;
+-        struct ap_filter_t *cur;
+-
+-        /* get rid of all filters up through protocol...  since we
+-         * haven't parsed off the headers, there is no way they can
+-         * work
+-         */
+-
+-        cur = r->proto_output_filters;
+-        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
+-            cur = cur->next;
+-        }
+-        r->output_filters = r->proto_output_filters = cur;
+-
+-        bb = apr_brigade_create(r->pool, c->bucket_alloc);
+-        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-        b = apr_bucket_eos_create(c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-        ap_pass_brigade(r->output_filters, bb);
+-    }
 +    bb = apr_brigade_create(r->pool, c->bucket_alloc);
 +#ifdef HAVE_CGID_FDPASSING
 +    b = cgi_bucket_create(r, dc->timeout, tempsock, script_err, c->bucket_alloc);
@@ -765,76 +1041,13 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
 +    APR_BRIGADE_INSERT_TAIL(bb, b);
 +    b = apr_bucket_eos_create(c->bucket_alloc);
 +    APR_BRIGADE_INSERT_TAIL(bb, b);
-+
-     /* Handle script return... */
-     if (!nph) {
--        conn_rec *c = r->connection;
-         const char *location;
-         char sbuf[MAX_STRING_LEN];
-         int ret;
  
--        bb = apr_brigade_create(r->pool, c->bucket_alloc);
--        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
--        APR_BRIGADE_INSERT_TAIL(bb, b);
--        b = apr_bucket_eos_create(c->bucket_alloc);
--        APR_BRIGADE_INSERT_TAIL(bb, b);
--
-         if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
-                                                         APLOG_MODULE_INDEX)))
-         {
--            ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL);
-+            ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err);
- 
-             /*
-              * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
-@@ -1658,6 +1825,11 @@
-             /* Soak up all the script output */
-             discard_script_output(bb);
-             apr_brigade_destroy(bb);
-+            if (script_err) {
-+                apr_file_pipe_timeout_set(script_err, timeout);
-+                log_script_err(r, script_err);
-+            }
-+            
-             /* This redirect needs to be a GET no matter what the original
-              * method was.
-              */
-@@ -1690,7 +1862,6 @@
-     }
- 
-     if (nph) {
--        conn_rec *c = r->connection;
-         struct ap_filter_t *cur;
- 
-         /* get rid of all filters up through protocol...  since we
-@@ -1704,14 +1875,20 @@
-         }
-         r->output_filters = r->proto_output_filters = cur;
- 
--        bb = apr_brigade_create(r->pool, c->bucket_alloc);
--        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
--        APR_BRIGADE_INSERT_TAIL(bb, b);
--        b = apr_bucket_eos_create(c->bucket_alloc);
--        APR_BRIGADE_INSERT_TAIL(bb, b);
--        ap_pass_brigade(r->output_filters, bb);
-+        rv = ap_pass_brigade(r->output_filters, bb);
-     }
- 
-+    /* don't soak up script output if errors occurred writing it
-+     * out...  otherwise, we prolong the life of the script when the
-+     * connection drops or we stopped sending output for some other
-+     * reason */
-+    if (script_err && rv == APR_SUCCESS && !r->connection->aborted) {
-+        apr_file_pipe_timeout_set(script_err, timeout);
-+        log_script_err(r, script_err);
-+    }
-+
-+    if (script_err) apr_file_close(script_err);
-+
-     return OK; /* NOT r->status, even if it has changed. */
+-    return OK; /* NOT r->status, even if it has changed. */
++    return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err);
  }
  
-@@ -1829,7 +2006,7 @@
+ 
+@@ -1829,7 +1877,7 @@
          return retval;
      }
  
@@ -843,27 +1056,9 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
  
      info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
      info->conf = conf;
---- httpd-2.4.41/modules/generators/config5.m4
-+++ httpd-2.4.41/modules/generators/config5.m4
-@@ -78,4 +78,15 @@
- 
- APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
- 
-+AC_ARG_ENABLE(cgid-fdpassing,
-+  [APACHE_HELP_STRING(--enable-cgid-fdpassing,Enable experimental mod_cgid support for fd passing)],
-+  [if test "$enableval" = "yes"; then
-+     AC_CHECK_DECL(CMSG_DATA,
-+       [AC_DEFINE([HAVE_CGID_FDPASSING], 1, [Enable FD passing support in mod_cgid])],
-+       [AC_MSG_ERROR([cannot support mod_cgid fd-passing on this system])], [
-+#include <sys/types.h>
-+#include <sys/socket.h>])
-+  fi
-+])
-+
- APACHE_MODPATH_FINISH
 --- httpd-2.4.41/modules/generators/cgi_common.h
 +++ httpd-2.4.41/modules/generators/cgi_common.h
-@@ -0,0 +1,220 @@
+@@ -0,0 +1,359 @@
 +/* Licensed to the Apache Software Foundation (ASF) under one or more
 + * contributor license agreements.  See the NOTICE file distributed with
 + * this work for additional information regarding copyright ownership.
@@ -893,6 +1088,24 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
 +#include "httpd.h"
 +#include "util_filter.h"
 +
++static void discard_script_output(apr_bucket_brigade *bb)
++{
++    apr_bucket *e;
++    const char *buf;
++    apr_size_t len;
++
++    for (e = APR_BRIGADE_FIRST(bb);
++         e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e);
++         e = APR_BRIGADE_FIRST(bb))
++    {
++        if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) {
++            break;
++        }
++        apr_bucket_delete(e);
++    }
++}
++
++#ifdef WANT_CGI_BUCKET
 +/* A CGI bucket type is needed to catch any output to stderr from the
 + * script; see PR 22030. */
 +static const apr_bucket_type_t bucket_type_cgi;
@@ -1084,3 +1297,124 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882
 +    apr_bucket_copy_notimpl
 +};
 +
++#endif /* WANT_CGI_BUCKET */
++
++/* Handle the CGI response output, having set up the brigade with the
++ * CGI or PIPE bucket as appropriate. */
++static int cgi_handle_response(request_rec *r, int nph, apr_bucket_brigade *bb,
++                               apr_interval_time_t timeout, cgi_server_conf *conf,
++                               char *logdata, apr_file_t *script_err)
++{
++    apr_status_t rv;
++    
++    /* Handle script return... */
++    if (!nph) {
++        const char *location;
++        char sbuf[MAX_STRING_LEN];
++        int ret;
++
++        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
++                                                        APLOG_MODULE_INDEX)))
++        {
++            ret = log_script(r, conf, ret, logdata, sbuf, bb, script_err);
++
++            /*
++             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
++             * does not set an explicit status and ap_meets_conditions, which
++             * is called by ap_scan_script_header_err_brigade, detects that
++             * the conditions of the requests are met and the response is
++             * not modified.
++             * In this case set r->status and return OK in order to prevent
++             * running through the error processing stack as this would
++             * break with mod_cache, if the conditions had been set by
++             * mod_cache itself to validate a stale entity.
++             * BTW: We circumvent the error processing stack anyway if the
++             * CGI script set an explicit status code (whatever it is) and
++             * the only possible values for ret here are:
++             *
++             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
++             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
++             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
++             * processing of the response of the CGI script, e.g broken headers
++             * or a crashed CGI process).
++             */
++            if (ret == HTTP_NOT_MODIFIED) {
++                r->status = ret;
++                return OK;
++            }
++
++            return ret;
++        }
++
++        location = apr_table_get(r->headers_out, "Location");
++
++        if (location && r->status == 200) {
++            /* For a redirect whether internal or not, discard any
++             * remaining stdout from the script, and log any remaining
++             * stderr output, as normal. */
++            discard_script_output(bb);
++            apr_brigade_destroy(bb);
++
++            if (script_err) {
++                apr_file_pipe_timeout_set(script_err, timeout);
++                log_script_err(r, script_err);
++            }
++        }
++
++        if (location && location[0] == '/' && r->status == 200) {
++            /* This redirect needs to be a GET no matter what the original
++             * method was.
++             */
++            r->method = "GET";
++            r->method_number = M_GET;
++
++            /* We already read the message body (if any), so don't allow
++             * the redirected request to think it has one.  We can ignore
++             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
++             */
++            apr_table_unset(r->headers_in, "Content-Length");
++
++            ap_internal_redirect_handler(location, r);
++            return OK;
++        }
++        else if (location && r->status == 200) {
++            /* XXX: Note that if a script wants to produce its own Redirect
++             * body, it now has to explicitly *say* "Status: 302"
++             */
++            discard_script_output(bb);
++            apr_brigade_destroy(bb);
++            return HTTP_MOVED_TEMPORARILY;
++        }
++
++        rv = ap_pass_brigade(r->output_filters, bb);
++    }
++    else /* nph */ {
++        struct ap_filter_t *cur;
++
++        /* get rid of all filters up through protocol...  since we
++         * haven't parsed off the headers, there is no way they can
++         * work
++         */
++
++        cur = r->proto_output_filters;
++        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
++            cur = cur->next;
++        }
++        r->output_filters = r->proto_output_filters = cur;
++
++        rv = ap_pass_brigade(r->output_filters, bb);
++    }
++
++    /* don't soak up script output if errors occurred writing it
++     * out...  otherwise, we prolong the life of the script when the
++     * connection drops or we stopped sending output for some other
++     * reason */
++    if (script_err && rv == APR_SUCCESS && !r->connection->aborted) {
++        apr_file_pipe_timeout_set(script_err, timeout);
++        log_script_err(r, script_err);
++    }
++
++    if (script_err) apr_file_close(script_err);
++
++    return OK;                      /* NOT r->status, even if it has changed. */
++}
diff --git a/httpd.spec b/httpd.spec
index 6ceb282..e5bd540 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.41
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source2: httpd.logrotate
@@ -740,6 +740,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Oct  4 2019 Joe Orton <jorton@redhat.com> - 2.4.41-6
+- mod_cgid/mod_cgi: further upstream consolidation patches
+
 * Thu Oct  3 2019 Joe Orton <jorton@redhat.com> - 2.4.41-5
 - mod_proxy_balancer: fix balancer-manager XSRF check (PR 63688)
 

From c99e83a2d8d3fb9808b1048f5f7d0550882f4521 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 8 Oct 2019 09:33:16 +0100
Subject: [PATCH 187/359] Add note that logs are not compressed by default.

---
 httpd.logrotate | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/httpd.logrotate b/httpd.logrotate
index 28c9730..c5a008c 100644
--- a/httpd.logrotate
+++ b/httpd.logrotate
@@ -1,3 +1,5 @@
+# Note that logs are not compressed unless "compress" is configured,
+# which can be done either here or globally in /etc/logrotate.conf.
 /var/log/httpd/*log {
     missingok
     notifempty

From c55d94fac79223ab9b003cd757ef8000a70a9d72 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 8 Oct 2019 09:47:42 +0100
Subject: [PATCH 188/359] Add section on logfile rotation & compression.

---
 httpd.service.xml | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/httpd.service.xml b/httpd.service.xml
index b2c72dd..c518549 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -232,6 +232,24 @@ Wants=network-online.target</programlisting>
 
     </refsect2>
 
+    <refsect2>
+      <title>Logging and log file rotation</title>
+
+      <para>The <command>httpd</command> daemon is configured to log
+      to the <filename>/var/log/httpd</filename> directory by default,
+      and a drop-in for <command>logrotate</command> is provided at
+      <filename>/etc/logrotate.d/httpd</filename> to enable log file
+      rotation.  The <command>httpd.service</command> systemd unit is
+      reloaded after a <command>logrotate</command> run.</para>
+
+      <para>Log file compression is not enabled by default; since
+      <command>httpd</command> can continue writing to open log files
+      for some time after a reload (graceful restart), if compression
+      is enabled the <literal>delaycompress</literal> option must be
+      present (as in the default) to delay compression of log files to
+      a later rotation run.</para>
+    </refsect2>
+
     <refsect2>
       <title>Socket activation</title>
 
@@ -322,7 +340,8 @@ ReloadPropagatedFrom=httpd.service</programlisting>
     <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
     <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
     <citerefentry><refentrytitle>httpd_selinux</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>semanage</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    <citerefentry><refentrytitle>semanage</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>logrotate</refentrytitle><manvolnum>8</manvolnum></citerefentry>
     </para>
   </refsect1>
 

From 4d13e7251808152c1bf10ec702a1588b9813ad61 Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Mon, 11 Nov 2019 17:27:51 +0100
Subject: [PATCH 189/359] add automatic source tarball signature verification
 in %prep section

---
 .gitignore |    1 +
 KEYS       | 8682 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 httpd.spec |   65 +-
 sources    |    1 +
 4 files changed, 8721 insertions(+), 28 deletions(-)
 create mode 100644 KEYS

diff --git a/.gitignore b/.gitignore
index bdeafe7..d92b5da 100644
--- a/.gitignore
+++ b/.gitignore
@@ -33,3 +33,4 @@ x86_64
 /results_httpd
 /htcacheclean.service.8
 /httpd.conf.5
+/httpd-2.4.41.tar.bz2.asc
diff --git a/KEYS b/KEYS
new file mode 100644
index 0000000..9784650
--- /dev/null
+++ b/KEYS
@@ -0,0 +1,8682 @@
+This file contains the PGP keys of various developers that work on
+the Apache HTTP Server and its subprojects.
+
+Please don't use these keys for email unless you have asked the owner
+because some keys are only used for code signing.
+
+Please realize that this file itself or the public key servers may be
+compromised.  You are encouraged to validate the authenticity of these keys in
+an out-of-band manner.  For information about our validation and signing
+policies, please read http://httpd.apache.org/dev/verification.html.
+
+Apache users: pgp < KEYS
+Apache developers: 
+        (pgpk -ll <your name> && pgpk -xa <your name>) >> this file.
+      or
+        (gpg --fingerprint --list-sigs <your name>
+             && gpg --armor --export <your name>) >> this file.
+
+Apache developers: please ensure that your key is also available via the
+PGP keyservers (such as pgpkeys.mit.edu).
+
+Type Bits/KeyID    Date       User ID
+pub  1024/2719AF35 1995/05/13 Ben Laurie <ben@algroup.co.uk>
+                              Ben Laurie <ben@gonzo.ben.algroup.co.uk>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 2.6.3ia
+
+mQCNAi+0jQEAAAEEAK7oX0FeNncaHfa1v+V7SMUviAm8qB8orWG0zvja4ZtSrHVg
+/PMwppUh44t5ERA9lltRBdHu30+YSh8a1dYt1XOD83nknzj9rhtpFAPqyywlLVhN
+VY3PVLyMbULw27aEAGc+StFqrDoUQ0+j9QU/YH/IyVN9rBaJyhsIDEUnGa81AAUR
+tB5CZW4gTGF1cmllIDxiZW5AYWxncm91cC5jby51az6JARUDBRAyb2Doc3AsNzyk
+Yh0BARa6CACUBnsP9Vb+T/PvNYKVQBIODz+90tz5GozWwCVfPVSaRd8Dz+oF1sFs
+YCz/KuxqBhL5PkiCuSMfOVlPA5nirjoktMF/af5saZqhPr5rvr67Z1OzZnVDvWe4
+DhFrn8EoLrY5YNJhUwfINnZqyKaQu8TW6p4caLkTCW0KM+4ztTe74xRG9NeE+K0+
+0RMpAF3jEY36LGRjq6miazt2bVZQDTl6CuWE+gAaFlX2ojV7e1xdxVvpBIEc34MP
+g9ORJ0evx1QilMt1VyGcS/pe4IQgjdJqjU/4fzqFZkT2nntQMbV9kQyNe2+qfqP7
+giTryIanmBAfd3oOCTsRz2VKPfdhCqCRiQB1AwUQMRdzEEyr2GZv4ALJAQEuhAL6
+A8I84BR+87uNAHD0ZJkTM73WdyMEGvAKBvrZK/g0VLYj0NtgkSuRJfrXnGkuh27I
+ZrjfL952Q/mXgMtHhJHJ9YfenGFWSEDHnolNzKOzTQJpE01IZ3nWv7ezA9N1LZVC
+iQCVAgUQMROrdRsIDEUnGa81AQEUNgQAlvyjt534RDQd2AYGoZriaFzjaL7dTCRH
+4b1zxuWBNWf3pI4W0iwU02Q5rEWEmY5DLl6/ie+vcQKOWSqXVgnM/s6EARdKEN56
+d6PzkwszgfEybDYrcAxReJcTCcV8ItJer/iqpBLgtaxyUpI77NvKcDGHp6BgYpnv
+1lNkH0FISK+JAJUDBRAwtzlWdGx7qH+PTVkBARFWA/99NTCMihlOZS7LmHDVic/q
+H1K1DVdMcv0iL39+7Pq4+AA/ET8dWIgcjaIreSqAZTpjwU1pMPaWgecDD1rEMCYX
+R+JoofLJ24BLcSlpXJ/gWMifYNxqdDeMRkw/aW/kaXQJWIz+oDYNuOyi5VvB6faF
+6Lm7P5cw1mX0I5rYc3woh7QoQmVuIExhdXJpZSA8YmVuQGdvbnpvLmJlbi5hbGdy
+b3VwLmNvLnVrPokAlQIFEDEXgCUbCAxFJxmvNQEBiL8D/3MLjfHGvuByqP1VFQrF
+QeMNd2aIQuC7ys3lkDvrLkkPJQANua0/MdDaZk6F5pCGcTmmmaJOjcOcCheD7FU5
+w9zxkQGR3Swr3opFHSr/CkEl83jRy3oq1MFydWoGajQjIr/c23X8zr+XntPyO6VX
+q5He4RrTiXeAEFBzz+J+R+EQ
+=zh1u
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+Type Bits KeyID      Created    Expires    Algorithm       Use
+sec+ 1024 0xA99F75DD 1997-01-24 ---------- RSA             Sign & Encrypt 
+f16    Fingerprint16 = F7 E5 6D 20 58 AA B0 65  ED 0D B1 66 03 BA 9C C6
+uid  Rodent of Unusual Size <Ken.Coar@Golux.Com>
+uid  Rodent of Unusual Size <coar@Apache.Org>
+uid  Rodent of Unusual Size <Coar@Raleigh.IBM.Com>
+uid  Rodent of Unusual Size <Ken.Coar@MeepZor.Com>
+uid  Rodent of Unusual Size <Ken@Coar.Org>
+uid  Ken A L Coar <Coar@DECUS.Org>
+uid  Rodent of Unusual Size <Coar@DECUS.Org>
+uid  Rodent of Unusual Size <coar@ACM.Org>
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: PGPfreeware 5.0i for non-commercial use
+
+mQCNAzLpIyUAAAEEAN9KC8CxTeozPYJjsnhFpJ14d4Hhf2M6OTgqPQFRHOswM/3j
+B7IW0s+HwVyQ5/SjIlo+8ur9X7yaj1FS2GQmKD1x9LKeHRAoosBIs33okRtoeDRy
+ufTaTyQTwLklxClWm3JEef4xZioun1mtWbpz0yVEOCSZcRvtnJrNPMCpn3XdAAUR
+tCtSb2RlbnQgb2YgVW51c3VhbCBTaXplIDxLZW4uQ29hckBHb2x1eC5Db20+iQCV
+AwUQNiiZ2JrNPMCpn3XdAQGlgwP+JLlZvNV/fJ2azKIwjibDa4n2LUDxa7ofKboU
+QL+D7FD24zQcmzmkBQm/BL/FSUtxZasJkvdVbU98N3G4h3C4AyErfQOFcrepyGAB
+M88onQ1DbQ6tiUA3gw9gIB+2l1C5R8wBOtlwoRJM4GFvjjtRp+KaQqvN3f+lLMMt
+hKYB70mJAJUDBRAz3QWlms08wKmfdd0BAQMfBAC1c+9gr7ELthxwzYGTB7LiBk+p
+UABsPG/hT9z/cTGN8YQbK6VXV74sPAaeyD/t56xFUI9CRktZCinXp2cxvbNTe3Q0
+MLtD/PlCSRsgwsEIoM+1An1S3qOXWiGBXoXl/DgRzz9GVnB04m5/SP9XLE4Tmz+1
+X/Gu4TJnRjZZxN4xoYkAPwMFEDb44af9b4jGIdCnGxECiFUAnR3RORpXVyclwFEl
+euOwoynPQbY6AJ9H5rwHnz4gkE+AVp95++HmyeDkYIkAlQMFEDb45Ogxpj2W7BQL
+gQEBaS4D/R+EzfuRPiX5LgV7C70xtplIgS1iK+h0ddkPAr3P3zPxY0AEOjM81hiz
+Ol2Kf0TUMhhcLqO0UjNK9EyIHpO+Bf7pQoV050XYvcIwzNyVez5VCbDM7JA+vVeG
+/Pb+O/tPyEs7peSpdJAP4Kbg4Eu4b6+1QTLKrBCTWkEuNHABOuzDiQCVAwUQNzs2
+CairDeBjG1dJAQGb7AQAzHChrwaosl01sLcmlItrsqmzSFL5hbLor9Wh8UjVeYxX
+FMVgTQGs/AwN1B0W8PApOsz8mg0pSJm8VPHv+pc4Z9eNhUokfUsRJ4LHjREpr3Gh
++5LoZ53nk1f62VQSOCxOOJ50cAH2rqv/ym9EVCaZ7evfHIR7/KH5+sVpcs14c/2J
+AEYEEBECAAYFAjhv6QUACgkQF1lVzkO+5qgYaACfaA4rC0EaP5yxR0wEYiGmgy6O
+ZhMAoNt4cGFIMI3x2VI9hyi/ZoUiu0zOiQA/AwUQOtYm5d26ZLosMS0vEQK8VgCf
+Tw+RZ/xUlB/5YfyrK9fb/VKGm0wAoK3bRHDa/MMxxFtO2c0SqOKxbTKGiQBGBBAR
+AgAGBQI7FOmzAAoJEJcWsik7qjrgJlwAnjRjnKXy4jj1pAFnFFUebJ/+Ur8kAJ4+
+DTV/SegKBL3jSua5ISqm+LBOjokARgQQEQIABgUCO4p7LQAKCRC/S9DmBJ24edNS
+AKD4ddoiLbPhQkQtGHjy9BlwUSdg3ACg+1fpy3UjWHzCWqWYSh33aneZuXa0KFJv
+ZGVudCBvZiBVbnVzdWFsIFNpemUgPGNvYXJAQXBhY2hlLk9yZz6JAJUDBRA2KJmI
+ms08wKmfdd0BAT3yBADEDHAn++77n7bLA/u9QYM2LBQHnXdw5Is8YGHpHcNZVDA8
+CtRTOdub8rhe9qgsid/jEry0hT9Sygfx/ry5ntjmF12ltnxBDPdZuU2DaHaIh/zB
+UAv0hyaQeAXEYiV9J75GrDkTj5Jrrnd623uyIRoMZPKYb+oqsZ4HjIe/w+CDfokA
+PwMFEDb44bT9b4jGIdCnGxECzDAAoNR8md7KvzarecOh/6NpTb5r8JXJAJ0aJtTz
+soNXpLaVwSMiGdm5ts2qOYkAlQMFEDb45PYxpj2W7BQLgQEBxKID/11Dft+UeLdd
+kIDFjaJGrIOfQ11y+QlJWaQ2Him/qNzNP8w8ZJ/meAb4PMSeQOI3PVKulf8vMp3Z
+0Jh2irfn1ycqsui4kDe6azvd5PultRKTRljtwVIDuqsrVMVq/zNAC2bN6CUnkkdZ
+2O7a5qIkDDYnyRzAEwKhJxleWrXYHiIhiQCVAwUQNzs2GqirDeBjG1dJAQHcYgP/
+eRCEQW5DJ6JQol5HQ26UnjBfQGdXsRvpT6gFNCDy/Nv+b886WC9j99T3IU+AztXf
+OPfPh7oU/2yC0VOmSaZS9SQ/PuuFdNhMggR8Q7goWothdBsMOUyO3iYrQCRnV3mL
+NsOT+/gpSt9diLujs7SpiQeHZmQaNMQUrJPBp7tTbsaJAD8DBRA61ibv3bpkuiwx
+LS8RAvHXAJ95ifArYzouYPB3clib/568TqHeVQCgxgEb1xJ4AgjZibMl34g+19wb
+G3CJAEYEEBECAAYFAjsU6ocACgkQlxayKTuqOuCaDwCfTHOoCNtoYenYgqa2LgUC
+62mEqFUAn25xLhvjjODMpWry5uAA2NR1k00KtC1Sb2RlbnQgb2YgVW51c3VhbCBT
+aXplIDxDb2FyQFJhbGVpZ2guSUJNLkNvbT6JAJUDBRA2KKJpms08wKmfdd0BAWcz
+A/9xfbUofCDogPs2gbMQrGx9kT90SBEYcWnlPq/Ocj1871ZlnYeYhJaMSOuLnMAC
+Ze9AbadYRgVVwXWhamH+d0uAvCw98ixmI9emPUsPuiifk8Re8mWQV+kcOqIbjE45
+FtsZYFy/WyqTHp2OSl/JcugwPfrlhrMW4q6selY/ABBEkokAPwMFEDb44b/9b4jG
+IdCnGxECNOMAn3K6caoKqMtKGrqRwoFaCPjBgOi5AKCc1dP5HAtyFloQGxS2fAwJ
+p9Dp8okAlQMFEDb45QAxpj2W7BQLgQEBX1gD/1O/9VxXp2a8yrlV2qJ6xJ9U3fCL
+/OVUTrgDgzw/219jeXgiG0CAM0ApZ7NSqk95aRSKZqWoJvTY5K+P4RuGoMJ1JYjQ
+i2fXiCSHo4fDF2RPTXxqCorQq6M8csJqpQykiUQRd6HfKSURk1WRfvGqi2iwiCQG
+ipqd0kmzyQ2WSEjviQA/AwUQOtYm9926ZLosMS0vEQKW5wCgiIdzdam+8MnCpvrp
+5ooDS+XqJi0AoL6kVPnu/uDN4WVIIaO3rOYeW+SViQBGBBARAgAGBQI7FOqHAAoJ
+EJcWsik7qjrg+S4An1wT/kE/gbX3qmG3oEGY78r56mM0AJwOEJ5QA1bl/wDeHeyH
+tHd2qw/lVbQtUm9kZW50IG9mIFVudXN1YWwgU2l6ZSA8S2VuLkNvYXJATWVlcFpv
+ci5Db20+iQCVAwUQN7GHT5rNPMCpn3XdAQHIuQP9G3RaObWL3iI2xoIWs3s6L0LF
+noFv/RrK0NHEDy0YEm9LqeVp86F9QvOA+kh3ySfVPtxbwsMAswAkqbvWNi7U2Xz0
+V9KJmnEnJFLmjHoTBNpahTGFTnOxcH4X+57mAAzbCWyXFvGsT2b8orset0QVqDhV
+hwOLGKLlXWzDiQdrY1+JAD8DBRA61icB3bpkuiwxLS8RAkGnAJ9m1mvfaHA5Z3FU
+JyzUpuS7xd4NcQCg5XMoJgXHC1Gngqn6jAh+Dn3TDVqJAEYEEBECAAYFAjsU6ocA
+CgkQlxayKTuqOuCHpACfU7nZUI2Pj5dS46VZpVygxMl6dAEAnA751ZlwgIYWnZyh
+uqKcJzbwdV2fiQA/AwUQOt88Av1viMYh0KcbEQKqwgCgyDsKH89EE1W7/b8cfns3
+OrI+3DUAoNBYnQdsW6Uk45iQWyODnV3jUIgQtCVSb2RlbnQgb2YgVW51c3VhbCBT
+aXplIDxLZW5AQ29hci5Pcmc+iQCVAwUQN7Gd35rNPMCpn3XdAQHcoQQArrWwFNeS
+A5Yu1nEXevfStfkSUQqzA6qsREPgrczIOgsCfDR/RA/1P7GcxiOvY5mtckuvgkP0
+A9atWkCFX4A0UzerKAKaSirUd/V6Dm8w3hOR/e66I/rbQifZoV/KqvofRsxESV4U
++uXoBsleePwhpmDarpx1BlMJrjwhDDmGaVaJAD8DBRA61icL3bpkuiwxLS8RAn9y
+AJ0YXmF4g4/6GVCilTjxhZWL6acAvgCgwfYFTgB7gdCg9+3LL2jsc6bC4OCJAEYE
+EBECAAYFAjsU6ocACgkQlxayKTuqOuDA9gCeLlDfQW6ryZS8S00/LKsdvdVF0R4A
+nipUMGGyTIHYvgX+SI8vfZu3lUwwiQA/AwUQOt88D/1viMYh0KcbEQI9bgCg7T2u
+7Hzf/HG7s+m5So67+ixdngYAnjTlgTJNKSRLspsZVVumNM9YgxdjtB1LZW4gQSBM
+IENvYXIgPENvYXJAREVDVVMuT3JnPokAlQMFEDNNn5SazTzAqZ913QEByxcD/RkT
+z31D9IdedFAd8dseUv7TZkSSnZNctg5fZSlxL8kOWQKzclLFmEmnxRkTsIm/jtLF
+g2B8rEtKCfvbnOIvUFVIJLYtLPgBEWPFRrDpBx0eaLdWmogD534En/gsc5Yh1XTB
+G4Vveq39iZPcuP1Zc/fhmsNTvdgsdpbLyDquYH+riQA/AwUQNNhoI1F+HqlP3KvB
+EQJbxQCgxoQqL3hPPRxUhG3jFPIfiMGokUgAoPXYHWM63hFwomWAkaN6qSAHPKe/
+iQA/AwUQM9vDdGfM5V5WR8xwEQL2iQCdFQX3I1x2K94zlI740/VKtpv+2g8An3Wk
+FnyJR/3SJA88j/cujVv7kLX0iQBGBBARAgAGBQI2treyAAoJEBPfD2hdwuxYIq4A
+oKI1iXIAvt6KWLnde4nH4fJYvT58AJ99QNGbxthzYLnyFL3M/6jmQIk4b4kARgQQ
+EQIABgUCNu/SaQAKCRBrQHp6H3FQjZO3AKDQQnUS2qMjw3D/Oy6UlMVxZEYPUgCe
+LsZj8ZIUcKkfuhtKycVaIK2wC9mJAEYEEBECAAYFAjhJyKwACgkQURMkRYnG89BU
+PgCfa7gmUGgguVXend9EzB1h1TqQErYAoJai8ymv6wYxUXR8/OjoY9eB3CIJiQA/
+AwUQNvjhlv1viMYh0KcbEQKGGgCdFsmDuwfAnU9UFyxhSoyvdkcOcwYAoLp5e1SL
+6ZmIvITFg++VkDvR/j4UiQCVAwUQNvjkzzGmPZbsFAuBAQFdWgP/bv9a9t3J/xZY
+44wb0holsJFuZWOVYKeF9RFIWd0sJXut7yUeWZ5g760eFSEX0QDHfiq3KOT3XO9l
+hcNnDRBInMbBnawbBneLpzM58ZaRnw10HwsOl49Ekc9nHZBBM47mqy1BlGXMi+Yk
+Kh3W2MsuitHkAYwZuNalrqYhqghwooeJAD4DBRA61icU3bpkuiwxLS8RAuD2AKDr
+q4JAQFljMpudc569P131/RjPrwCYqxVlo0cbfFBihV06y5LHjQEd44kARgQQEQIA
+BgUCOxTqhwAKCRCXFrIpO6o64HEaAJ4wLnOLuRX5U21MFOUzIZOumrItcACdH9DA
+YvOpnnkjPNSNGjaI1oh2w9+0J1JvZGVudCBvZiBVbnVzdWFsIFNpemUgPENvYXJA
+REVDVVMuT3JnPokAPwMFEDb44dT9b4jGIdCnGxECfaUAoLEJ3t6nXT15EskyH+83
+pKZe4zkIAKClLlJ7vTuZ5fcjOsqVURNrs4o/cIkAlQMFEDb45Qoxpj2W7BQLgQEB
+QjQD/3DOozCF5e6JkMXJ5HGVrAxbDpRs4SJCrLFX3GuTeGsVCniOf0WTy6+cXuod
+zu1ZbRVlji9YKO2ufoWvH6AEPEVnHYp25T0dtMya/mwEI010dCrj4oXTaYikz2lu
+WTDPgKcHk+mYNDHREOOcN0/CO6RWTZIhok3Su4zBYL0YTg/RiQA/AwUQOtYnG926
+ZLosMS0vEQJe2gCg+51l8oZ1DQAL5hzKeW3pY5Vg2gkAoMlzmol5cvtxt9wFyrjw
+L39LL0fstCVSb2RlbnQgb2YgVW51c3VhbCBTaXplIDxjb2FyQEFDTS5Pcmc+iQCV
+AwUQOsoapprNPMCpn3XdAQHxkAP7BJ4KshrO4m+T2/l5OepLDQAGWxIg5XK05upw
+mgNPO6enptNjT+Quu78GYOKgVQww3eQoIlxFiEQ7Kccc0gFBhZVoqhrZ7mALrY5l
+HPN5Gy68PlpZ7LJoeYm694LlbwcWa2IAs2K7pfWft/36t3LRBt3NKOyOFVSCGPoi
+U+LiZuuJAD8DBRA61icj3bpkuiwxLS8RAhflAKCyngJ8wc9VaBIA+qaMFxCdGbIw
+egCfbseHoGcorOi0OS6B2ev8hZbJt1aJAEYEEBECAAYFAjsU6ocACgkQlxayKTuq
+OuDvlgCfcKf4eO+Y/ojSavGhITOWjBxgPG8Anja9yfJLediLcTlQwsycsWVMx3wh
+iQA/AwUQOt88GP1viMYh0KcbEQIyoQCeIFtr399fYt4MqRBfvGo59oE3A5sAn0yV
+t89HbY/x/sBXuksvBGxFGhgs
+=GI5x
+-----END PGP PUBLIC KEY BLOCK-----
+
+Type Bits KeyID      Created    Expires    Algorithm       Use
+sec  1024 0x302DA568 2001-02-13 ---------- DSS             Sign & Encrypt 
+f20    Fingerprint20 = DE29 FB39 71E7 1543 FD2D  C049 508E AEC5 302D A568
+sub  1024 0x04E15F28 2001-02-13 ---------- Diffie-Hellman                 
+f20    Fingerprint20 = C41F 1F5C 6485 0100 B21B  EB14 A14E 77B6 04E1 5F28
+uid  Rodent of Unusual Size (DSA) <Ken.Coar@Golux.Com>
+uid  Rodent of Unusual Size (DSA) <coar@Apache.Org>
+uid  Rodent of Unusual Size (DSA) <Coar@Raleigh.IBM.Com>
+uid  Rodent of Unusual Size (DSA) <Ken.Coar@MeepZor.Com>
+uid  Rodent of Unusual Size (DSA) <Ken@Coar.Org>
+uid  Rodent of Unusual Size (DSA) <coar@ACM.Org>
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: PGPfreeware 5.0i for non-commercial use
+
+mQGiBDqJD0sRBADmh5EfoFA8VC/c7+BlG5l4+RBIcYlkvYFZcLbS2fPgkHDndrrp
+5xIeYCFvnnRSVGkQbAfl4Gj62fGcyaI9QIbLAByGeqSoM+DbiEzIyR+QQNpBq+bo
+V1JWaXiuI8d4sdf5ZyTH2nT1EUWVPiBgeXHYtdnjoh7IpG5ETH2miBs7swCgvcJr
+y3Lwa8FfgVtCXFeI5E8wAm0EALOtxh6HwJbTWGAFJFA9RWw2oShLmovYGtdnxcY+
+wHX12oCkanKd26Nr09O+onh/xiQ0mSql3v6SUPnCfyC/qCLeuO2w4vspDlFMbBP0
+I+XFUt16Owldxvmy5fHvhChs7YSZqkVCMx5i+NTvyd51P9aELFG6A/7x3z/tpmyn
+Be8wBAC8l29qjxJSNDsIMMf0cw8STUtNKN9SknKVpQektHb+x+3wreUESPByrgfl
+cTm7y1ulg8rVazynsSVjMCRtmZIfboV2mhsgOu08aZ3bXPpWiHSJ5NR97jdH8s3I
+xuiyQ84PHHVjyLAIh28nAkIvbPRtgt7M581dPpKknHvqz1sW6LQxUm9kZW50IG9m
+IFVudXN1YWwgU2l6ZSAoRFNBKSA8S2VuLkNvYXJAR29sdXguQ29tPokAVgQTEQIA
+FgUCOokPSwQLCgQDAxUDAgMWAgECF4AACgkQUI6uxTAtpWj/KACfccB9nTN1VpGP
+zL2c11ya9ApunAsAn0zhuYOoDZsUCbKooUIg4zH3+nFziQBWBBMRAgAWBQI6iQ9L
+BAsKBAMDFQMCAxYCAQIXgAAKCRBQjq7FMC2laP8oAJ9LlFZKQo9K+VFVsIu44z+H
+GniLfwCffPkZqEjG6nSJYV50x0bjnVb8GDuJAEYEEBECAAYFAjsU6ugACgkQlxay
+KTuqOuDQRwCfbpsHlgt++QSd1BRy8yHqrUupApMAnjcY03RsdplzcGr+xuiiRjo1
+quipiQCVAwUQO+FSL5rNPMCpn3XdAQGqgAP/VUU1o7ZxsEZJYUq8R4wErYxlMr1U
+IGpVkPhMmlSnJyTN2KbZGcGkbiQ7+prdjj/tk5MVssVTP8JHEjS2pXc5/Gpf01oM
+opK2h7K1fEX2NH3F3Ow7yEt1/kGtNhgaEBYUVO8TqZaba6ikqXn/vYFQpprSUThg
+pOk4kk/7eggUxRaJAD8DBRA74VKU3bpkuiwxLS8RAu8aAKCLrqGScZZ3pWXcvnsF
+7Zu3Cq/X8wCgssm+gUsZtncub+LPqEWcrS7MVqW0LlJvZGVudCBvZiBVbnVzdWFs
+IFNpemUgKERTQSkgPGNvYXJAQXBhY2hlLk9yZz6JAFYEExECABYFAjrKH6IECwoE
+AwMVAwIDFgIBAheAAAoJEFCOrsUwLaVoixAAnjACHycu39VEG/T/HnNY8iJt3TFH
+AJ97peKuDSVTTLWtfwBHv/y05+ieNokARgQQEQIABgUCOxTq6gAKCRCXFrIpO6o6
+4FBhAJ4orS3X+GJ64mXjzqU9YFd9XYKBTQCfapw8Ss2Fy/HZgPd1CeUuBuM+9/WJ
+AJUDBRA74VI5ms08wKmfdd0BAaVhBADN5lhtY+wUn21GCQHP8aRfL+efIVhDlOE+
+uKY+SAK+FgMM97r3eVEVC6r/eWeXOV6hCUNcpnawy2mwck1XwJ/uAkmvXPZevP1Y
+P+8We9NL16ECH5Ow/oSz1i+ASKsDH06HpALC5VhPfZ1qIc2M+n7xhhPUFS8g42w5
+yfrHDS97OYkAPwMFEDvhUqfdumS6LDEtLxEC+xUAnAuKRZ5OyM3wZWZhUOFu2+1m
+RYuVAKCjjuLsMfV8KDlFyEc3QXvdyhyJYbQzUm9kZW50IG9mIFVudXN1YWwgU2l6
+ZSAoRFNBKSA8Q29hckBSYWxlaWdoLklCTS5Db20+iQBWBBMRAgAWBQI6yh/NBAsK
+BAMDFQMCAxYCAQIXgAAKCRBQjq7FMC2laAFLAJ9B4SLn9nVY1NWW7yZLiJl5CIoE
+fACfVJFGZ+CgvozX8nt7kRXcsu+FZiaJAEYEEBECAAYFAjsU6uoACgkQlxayKTuq
+OuC92QCfTrmLK2FBGB6auc0Llz91JtM8vPQAnRI4xh+uenrt0Mijf00tKBDL8O+A
+tDNSb2RlbnQgb2YgVW51c3VhbCBTaXplIChEU0EpIDxLZW4uQ29hckBNZWVwWm9y
+LkNvbT6JAFYEExECABYFAjrKH+cECwoEAwMVAwIDFgIBAheAAAoJEFCOrsUwLaVo
+6WoAoLPiSCJ+ZpzTBxGbUMkmm8jidlpZAKCTFBQddW1FkHuKFMUae9S3gOQVsYkA
+RgQQEQIABgUCOxTq6wAKCRCXFrIpO6o64ErDAJ4pyRV1ShT0E4TegsZQ0IQ6wM/g
+oACeJQNXftu7U/bVZuNkLfXnD7SKwNOJAJUDBRA74VJKms08wKmfdd0BAcANA/9M
+g1QCcgmg6t4HTaZ3caeI8nNZ/LjWs8MNWi0Z8OGytEwOgwIrG/DzoCPRQY/IlMya
+gEspYEDO1kjrk37HcUeO8aOWkEjXt+0uFDLfQGKJnusyb+ekjw+JxOUzM8gMH/mR
+ePJM+zx+ZU9dJU1rvbwXrtPwJpYX8xSf1L0J1p0ih4kAPwMFEDvhUrHdumS6LDEt
+LxECD5UAn3gLjfBN18lmbw73leBq3+XKjI5gAKDBXQHmIc0zRT9VgszOGZG+XfRk
+nLQrUm9kZW50IG9mIFVudXN1YWwgU2l6ZSAoRFNBKSA8S2VuQENvYXIuT3JnPokA
+VgQTEQIAFgUCOsof+wQLCgQDAxUDAgMWAgECF4AACgkQUI6uxTAtpWi5swCeJrPK
+y5D9fDm/H9nbsXLQTuo5QdUAn21AiEiqhurk46M747SqLpNJmgqFiQBGBBARAgAG
+BQI7FOrrAAoJEJcWsik7qjrghWsAmgOEE0Fh3Xcml6sk5boGNVRgg5+YAJ9lKBe/
+9SY/DssCK8LV4gSCdhRCnIkAlQMFEDvhUlaazTzAqZ913QEBzWED/0gy/fbatnok
+wtHz2P8xEAZ47ObQ52IhjxaG5GCkfdSEF5x+EUQaNeO+u3O2k3LakNO1/YN2BC36
+MuZeO/rU6bJro1r3ct5G5TODdb5MNSnf6rUath4T1BvHi3P5sdhB4e04WlenUscB
+AbEpo2zfEMn6QDvmrc6Mr+WpnVCb2gJiiQA/AwUQO+FSvd26ZLosMS0vEQIRiQCf
+cdu11Fj7Uotcb4R9mrM7MGYVptEAoMDImlcyl2w/jf3vjPnoNmrzD6YqtCtSb2Rl
+bnQgb2YgVW51c3VhbCBTaXplIChEU0EpIDxjb2FyQEFDTS5Pcmc+iQBWBBMRAgAW
+BQI6yiAkBAsKBAMDFQMCAxYCAQIXgAAKCRBQjq7FMC2laIlXAKCWqXUTcphAK7wQ
+lpLXYTIpq45cKgCfV7S+4kkw8A/Sg3/v9rzbTIFTKfWJAEYEEBECAAYFAjsU6usA
+CgkQlxayKTuqOuChhQCfXC1x2yzBiRp61UJM4ILFM79TtU0AoIUYBWyxpU6eS2kU
+mHnBZlHzkZJiiQCVAwUQO+FSYJrNPMCpn3XdAQGqygP/XT9IZzBm42ZeG7hIh8Nq
+UwPinkv1AP0lqUX8ME9hIcBOtmpSwvqHV4aa8RBzStth7ob2XXvJyjl/oBgxjTkQ
+mdPwqsYGT6CQWm8q3roJe2oASahYgGinkgivKi5KNCLwdpst+0nEcTb2L8GDOJ0d
+cWmBRVoKlQPNKI44uL68XCWJAD8DBRA74VLL3bpkuiwxLS8RAsATAKClx09xbGW7
+VDKSZi+HXLpy83R1fwCgo5dkvND4CEAJD4XyNol2Ygj/j2+5AQ0EOokPURAEAPb9
+XCxUtIXh12LmwYNk0PA9TWNJM1Mgo20rwUsZUdLHOZNuXCUfYIjHjw951K1KqpXG
+Cv4On/0SVXagXZs9yI+y4Emkz6qPhr9nAzHexH+ykn+ROaP0zNKtPPgp5CQcHz9F
+Xyz90XZuU48Tly20a9qo0v21dhVh0D4tulkS3pAHAAMFBADUgNY87Tsz3ndoonHo
+JUFfzwlm5gOknvxE0Sk8dgYzYPrcLX9ZETpSoTWepbjfSe2F1voTscMkV2WhKMSr
+dtzFrd8PjvOo8tXLkPL72vyUgw7BDFnfLvIaLtHAQu0BqfHaORhH5ufFZLXrOXvH
+GaYfx/kSbFOpjK/KCrYgLzF3r4kARgQYEQIABgUCOokPUQAKCRBQjq7FMC2laDSz
+AKCv+P8evU1SsJcZdjTcfyQzcN7FowCfRZE55mNxbmQZH8RiK/ssP3gcEwiJAEYE
+GBECAAYFAjqJD1EACgkQUI6uxTAtpWg0swCeIya+hFw4LjTi4KyK8puAMTMNsNkA
+oLSGqJ147DJuA6/pNp9OXD1q98vj
+=DZH6
+-----END PGP PUBLIC KEY BLOCK-----
+
+Type Bits KeyID      Created    Expires    Algorithm       Use
+sec+ 1024 0x2C312D2F 1998-10-17 ---------- DSS             Sign & Encrypt 
+f20    Fingerprint20 = 1315 5B0E 9E63 4F42 BF6C  163F DDBA 64BA 2C31 2D2F
+sub  2048 0xC9D00816 1998-10-17 ---------- Diffie-Hellman                 
+f20    Fingerprint20 = F05E 8A42 A306 92F1 7B32  E3DE 2B88 4A28 C9D0 0816
+uid  Rodent of Unusual Size (DSS) <Ken.Coar@Golux.Com>
+uid  Rodent of Unusual Size (DSS) <coar@Apache.Org>
+uid  Rodent of Unusual Size (DSS) <Ken.Coar@MeepZor.Com>
+uid  Rodent of Unusual Size (DSS) <Coar@Raleigh.IBM.Com>
+uid  Rodent of Unusual Size (DSS) <Ken@Coar.Org>
+uid  Rodent of Unusual Size (DSS) <coar@DECUS.Org>
+uid  Rodent of Unusual Size <coar@ACM.Org>
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: PGPfreeware 5.0i for non-commercial use
+
+mQGiBDYpIJsRBADkH4H8YqFaBHE7lTb+DkZ12CLXq7Hk41DA/HU+KM2CrGOExK4r
+DO9zVa7zjMbjhskYMK9AVTPC+f+LrDk4PtTJrRrh6DKZf8loEhgChrUpSDBvlByw
+sWiAxWqIWAdNy0POXuZNyW+XPc6u/bKgn61pe9UARKI+qqxIouRxfPJuOQCg/7q0
+syYsnWFiUTOMF7/ku6PHdhEEAJVpl3PaqW5BExYKrdDLKfQ0H7jLXXOABul4bDzm
+pjUx5Wmkq2zhh75v4bGQRBdCCTAd3EAowVsk2VbhUY/oQ/bfv7lK32PNTrhtA9Af
+adueeU6hDQcH2YV0U7AnaYHlRbiYxc6ASGZdSNiPL8CYLuP3KQ7eSWjRqG+iEa1T
+5nHkBADWMdJJ10rUeLSoqUKGnDhVDt7T7H7EuEcgPrERksztzBc/bkOFZg+aRlFo
+Z8on8LURDDjtQkHgy1X3ZZMNi7RlKOfEVVBQAwaxqUzxv8gGKBhu41TZfksJ6e6j
+q4ew51wBKl0dLfnsWGdxrzbFvQr42KIia51VW81fuEWWbePGgLQxUm9kZW50IG9m
+IFVudXN1YWwgU2l6ZSAoRFNTKSA8S2VuLkNvYXJAR29sdXguQ29tPokASwQQEQIA
+CwUCNikgmwQLAwECAAoJEN26ZLosMS0v09sAoK4Pkxh5nK6rASGHMm6yJ1vAcj59
+AJ9Bc1TmkW2hfjy+h/qupI3GSGKAPIkARgQQEQIABgUCNu/URQAKCRBrQHp6H3FQ
+jQTMAKCeQ/gtRkp14n4IPb5XUFgaiuxVAgCgooJ/PF27EtttYAcQQrCj1boFxgWJ
+AD8DBRA2+OJt/W+IxiHQpxsRAvTAAKDOlNLFMosEetY77WXXcecvjt6SKACg28M5
+aGHwbNgMCYAMc5N6CyJ6P1iJAJUDBRA2+OSuMaY9luwUC4EBAa6hBACSL40yvCXR
+8KqrNh8YbXYQsWsauIWiHfjXrMjlYpGPjU8aYsn0dhGYNsiYZwVKkTJMogRtiNeF
+RpaTJcjTQA0D7G2d+eq2YULmuPeLoHXCp2+xjh77SD9Ybb8cOl7iNNNEGXrza4aE
+X0Y6/bAH+IizlIXapirzyV40bilv1sh5v4kAlQMFEDc7NZaoqw3gYxtXSQEBc0oE
+AJrDIhOcHRPtJTYGig3+dBuKOpVh6KXg6t0oWbr5+xopEBlAjFJdJouk/lkzlXGo
+XmJIqodvlwcSBrANO9ntJNTZGZ0fIbrk/a+j6NE46xb5UqDlkKN9n8Giw+kWvCbi
+eRneb+JKLDtr4241tMEG9DnizsoHEeX75iIdWRTkjSK0iQBGBBARAgAGBQI4EBU+
+AAoJEPq7n7kJORDtSGYAoJ1UO1rpepVGPj3fK79ZkdNuz6MXAKC0cVfKK6V0HlH8
+lnJkNe+4zOqwiIkARgQQEQIABgUCOCrN7AAKCRDdIMImBDBlVl24AJ9oDUfkD5Wz
+Y6xwHuiVRSqApSeKRQCgzR7imurkIfa62k7ozQA7cBSGY7WJAEYEEBECAAYFAjqJ
+ELYACgkQUI6uxTAtpWgUvQCgmUw/9s6iwO9yC2e8KustCEZTtBAAn13ziXenfoWz
+yc0uIhuNQSo9/9obiQCVAwUQO+FRk5rNPMCpn3XdAQFQeQP/diFqVU8L0XIRUHqv
+TklJ5NVCFxb1DgkRjPQgQc6URSr+u9d7+sUe+XIj3UD/V0ib+lmTribpe/OUSlTg
+TAJGH3WmXxxJaPigbQL4cSmuvdQ/aU/pxZzcUW4OpVjbOlBzo9zchP1wWFmQYYai
+hi+vjB63HgrUotJfI/JoZ8eook+0LlJvZGVudCBvZiBVbnVzdWFsIFNpemUgKERT
+UykgPGNvYXJAQXBhY2hlLk9yZz6JAEsEEBECAAsFAjYpIigECwMBAgAKCRDdumS6
+LDEtLzFfAJ9ptM0H+S2O1EuUoRWwh4frOdkH/ACgwtUhdrNQctOzp1jzuXefRLek
+zZuJAD8DBRA2+OJ//W+IxiHQpxsRAmm5AJ0QTZhmPKYuRZ1wLeEISwSVoTxPDwCe
+Kn/V8i9uXG5SrjJIqzM52C9nNu+JAJUDBRA2+OTHMaY9luwUC4EBAa7LA/9i3oYk
+i2PT43SKo/WXMEfEUp0SZrBqaYhJn0LWOuGeBB3ta+ijQzVF6KV8dlwX115Y/rd8
+xHV4QEQqGD1ofC0QWXGc1TJl7l/yv25nHE+9/+JnPp3xAwYfW+IJca7pVcNxceNO
+v3xKH/yDc36qtAVkB9IZZ6kXAktQbzUbTi+lQIkAlQMFEDc7NbCoqw3gYxtXSQEB
+5bED/iThb1hGo0sSEiF5LReuq5GIIliy9Ju0lYGG7sjF+HuGa+l3VCp7uh+axFSR
+KKeAYZfN+arHujpqcYHKeMdJreRsIEm3bBLgcMboiVjqqJQ2Kz8rw0Ax1dcS43tU
+2E7XfbDhVRHee8H2BNAEoCE2qMBZ2qEargC69lPVunSs1LWLiQBGBBARAgAGBQI6
+iRC9AAoJEFCOrsUwLaVoijsAoJ4P63/fTU1SS0CsJcrGLav5q3vaAKCHK1eUxe+d
+PtPYaeZuLmvmcTdcOIkAlQMFEDvhUaeazTzAqZ913QEB7vID/3ny3JaTnCgeFt4p
+LZ0nuv7UaywuvXj/6RgH/4MLEWHVXagvgfgEML/jmFw3j7VzxE78pEWt41R+Kfpj
+ZK4YQS9LgZLCM6UENe/ejijeljOTAGYRlei46O3nMyZXCkLsq+YFoVd7Gn+yplaw
+Quiy7snl9ChUsGMLCjAa3jZt4QRTtDNSb2RlbnQgb2YgVW51c3VhbCBTaXplIChE
+U1MpIDxLZW4uQ29hckBNZWVwWm9yLkNvbT6JAEsEEBECAAsFAjexiO8ECwMBAgAK
+CRDdumS6LDEtL+PCAKCK+FbSDw/QtyB6U03NXEviaQmUNACg6d9pt5X9/E/utW0p
+KeX4Yws0BieJAEYEEBECAAYFAjqJEL0ACgkQUI6uxTAtpWgkhQCbBvzYd4A/V7uB
+LHmEqz52teOoVt4AoLgZMi2vfQwqv13ED/y3zspL625ciQCVAwUQO+FRwprNPMCp
+n3XdAQHc4wP/V9gdW71Ygc1Jr8hxmMODtq4auSsqg4mfOHpP7Z6vbAhLFn1RTAYY
+pIhTYX/Y5514f8yWmDyL8/ePGrvZlHqpu8MNDlju37kdSS78+KlUf3XCA6s0RlXA
+VDovcmbAGVQmNQKf2tlJEPmipTZmExF5tMGM7H2Ob7w7nvSgwiXZm4q0M1JvZGVu
+dCBvZiBVbnVzdWFsIFNpemUgKERTUykgPENvYXJAUmFsZWlnaC5JQk0uQ29tPokA
+SwQQEQIACwUCN7GJGAQLAwECAAoJEN26ZLosMS0vkGUAoPbhp3yi/BeC6zR2mv16
+XARtVlAwAKCE8kHKDREPKA/E7KpH6dHEx8BBzokARgQQEQIABgUCOokQvQAKCRBQ
+jq7FMC2laJlUAKCG8lAf70mA++RFLykYKh6uouPYXwCdEvy1e48Py7VD/M+q8c0V
+Zw3a92e0K1JvZGVudCBvZiBVbnVzdWFsIFNpemUgKERTUykgPEtlbkBDb2FyLk9y
+Zz6JAEsEEBECAAsFAjexna0ECwMBAgAKCRDdumS6LDEtLyKeAJ9N38ClCaouEyFL
+uCqlojSCcInEMgCg6fgtZXAoi9KyGP1JPhwFstk3hSyJAEYEEBECAAYFAjqJEL0A
+CgkQUI6uxTAtpWjwFACfbO9rVnMASuQuBNr5S0v6QvEJHUwAnR9Q4cYjXPQ8Q+B5
+ozX3QKSo4fLMiQCVAwUQO+FR2prNPMCpn3XdAQFhywP/VwKYdMizq+z/3wqqMoG/
+e7XIkTEllE8O8fPa/mg9S1Gdf3ysErKmPoxwzhA2NiI+1ItxaFhmSnb3FolzGB1r
+XOdPUn74T8PJAdycmmwLqY9jq6qzx3qva+O/KBkp4RH5Y4Jrd8R1w2IfNGllvI83
+/QixXihNUYZChg+0wbAx7Wu0LVJvZGVudCBvZiBVbnVzdWFsIFNpemUgKERTUykg
+PGNvYXJAREVDVVMuT3JnPokASwQQEQIACwUCNikhawQLAwECAAoJEN26ZLosMS0v
+urAAoLIKrWymZ44LD56dmUSbp0Im3HX9AKCPXngeaVD2FV9yb4xyEr3aAPb8p4kA
+PwMFEDb44nj9b4jGIdCnGxECo8wAoOw5N9z4B7faBmnTBDetulfBfhGqAJ9gGzaA
+V6Hp0D8dNO9V+MxZETY9d4kAlQMFEDb45Lkxpj2W7BQLgQEBKYwD/0ng4LDO9Dpm
+6m0AxD2EzOsdN0eGB0VdfEJfeWxM/TAnHlecPL1Aq8XXex8LSvDemfATtQIXeOld
+Ye2np5szUpY2MBTCLr53kNuPmDLOYhNCzQnB9w6QtaXHlDINGyTjTQ9S2r+YhCtc
+Qb5LPS4uY79qE4GVMmkvI+60/n02YlJRtCVSb2RlbnQgb2YgVW51c3VhbCBTaXpl
+IDxjb2FyQEFDTS5Pcmc+iQBLBBARAgALBQI6yhqCBAsDAQIACgkQ3bpkuiwxLS/t
+3ACcCjcL+TpZYClEaxwdFM4SFgha8TAAn2qAC65Jedqiwrhy3MTDaUII0pdKiQCV
+AwUQO+FR6ZrNPMCpn3XdAQHnUwQAkYJGSM95uGyAu2M4ndw4oIm61olaZE4LlGnJ
+Pl3rmf51A9VxLGSCGWDuZ8BBvPiwu2A+sf9j+FY4f3r9/lNf+wGb1dnnv0uo2D59
+CbUGkPsGmV0YRet9AAwy0RXXWL1QZ7f3AH6R6JVymMNupE0z+qupNjlBP+k93Xx5
+M+krQM+5Ag0ENikgnBAIAPZCV7cIfwgXcqK61qlC8wXo+VMROU+28W65Szgg2gGn
+VqMU6Y9AVfPQB8bLQ6mUrfdMZIZJ+AyDvWXpF9Sh01D49Vlf3HZSTz09jdvOmeFX
+klnN/biudE/F/Ha8g8VHMGHOfMlm/xX5u/2RXscBqtNbno2gpXI61Brwv0YAWCvl
+9Ij9WE5J280gtJ3kkQc2azNsOA1FHQ98iLMcfFstjvbzySPAQ/ClWxiNjrtVjLhd
+ONM0/XwXV0OjHRhs3jMhLLUq/zzhsSlAGBGNfISnCnLWhsQDGcgHKXrKlQzZlp+r
+0ApQmwJG0wg9ZqRdQZ+cfL2JSyIZJrqrol7DVekyCzsAAgIH/As5pFqpFu0udUuY
+2p4I+ck+xrOOv949yjVrx5PiCIHhPyyUNJO2P4DJULgIzAFnpKZnuXY35UXmsHN9
+85MnHzvk9nk0b0HylxomBFrrw7xUHwZgD0qXCbDp6gDyDa+SY2zmBho8V/dTK7nq
+tuUEfqzUY7rCb+26p2pRvdetHmCXR5/yQ5cWvNw8AyGCbx+7C8ta2y6arWz24ZP3
+2MvenLXrpGeAiuZRKqWnCALksSxNUT0NMqmTghkL29Qcw2F5br/MTz4KnE0znvt9
+q3zLK+upIxoqTsKaqK2yiSuI/lMbl1NPH+/Bw2Er1VBcCNB14/2cqit421pMiCm2
+0dChqOKJAD8DBRg2KSCc3bpkuiwxLS8RAt8CAKDSmRCvou1moFG3fWUxweRlndgL
+XgCg6ajZ164aAHwQStdF9x+Jn96GQTg=
+=e95K
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub  1024D/08C975E5 1999-04-14 Jim Jagielski <jim@apache.org>
+sig        08C975E5 1999-04-14 Jim Jagielski <jim@apache.org>
+uid                            Jim Jagielski <jim@jaguNET.com>
+sig        08C975E5 2001-04-03 Jim Jagielski <jim@apache.org>
+uid                            Jim Jagielski <jim@jimjag.com>
+sig 3      08C975E5 2002-11-11 Jim Jagielski <jim@apache.org>
+sub  2048g/4CCDB430 1999-04-14
+sig        08C975E5 1999-04-14 Jim Jagielski <jim@apache.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.2.1 (Darwin)
+
+mQGiBDcUl9QRBADl5tF8kOD0uddlnl9qsaG70/hwujGTsSXATnqoLseTsWORoVXf
+oBklokEAGmT2+Cl8XIXZ31Wh+GaJ3CTbEv8Ok1vapOt+ltPgOKzZEB4uP25EbhC2
+LWf+lUoafcd2Xi0KBV4fqXqEEuDGP1TAdZ6k7NVqgpjvbJ5TdqL0LrWOOwCg/0b4
++/p/avQr+uZRU2rdmYu/b/0D/2LnjcEqUjsslh2e9m0OgAu+gnYAmQH6Dbnp+iKl
+jffWPChwIMFZd/7FnGOzYDzoqnzTFyA4VE5PHWL61V2lpHJWB21K9D6rbEcx0iYB
+AHHxZQEmxSBU6PmGnbF+2P7vC0Jz9gZ5dCbjtGboYxd00/XQlZwCs8jHueTpSfx9
+n7dYBACFpW+v2pSlG0ReiS6Ult3gaGWiw81D0nFVvCp5BlxgQDymyF1MS6FbCj/g
+FGILosMhlsIHTFaC0DD0LSXyN1rm0ykPvi+vULIlKNJwW7fCi+33j1Azx+zfMNeO
+T5vqAfF6cvsZ6qPb9CcYvU4jEKvkovA1U3jMFehqcGkTV5sfvbQeSmltIEphZ2ll
+bHNraSA8amltQGFwYWNoZS5vcmc+iE4EEBECAA4ECwMCAQIZAQUCNxSX1QAKCRCL
+OmAfCMl15UklAKDq2PsXa7PbJPtGlXblJjD1OZgjTwCgkCz0EAdWS4Fuhi0mmSm7
+h1gtH/W0H0ppbSBKYWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT6ISwQQEQIACwUC
+OsodagQLAwIBAAoJEIs6YB8IyXXlajkAoL2wNKsEorxLhZQAPRNa8kcv5uaCAKCc
+KvWB5TIgPvXc9KIyu7YwfYiLg7QeSmltIEphZ2llbHNraSA8amltQGppbWphZy5j
+b20+iFwEExECABwFAj3P+LMCGwMECwcDAgMVAgMDFgIBAh4BAheAAAoJEIs6YB8I
+yXXlb3AAoOOU1s/F8PJAxYQwAQmlKxYUnZHdAJ9uIWY2w2UUMpTw45tkJ3xplawX
+Y7kCDQQ3FJfVEAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bxbrlLOCDaAadWoxTp
+j0BV89AHxstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJPPT2N286Z4VeSWc39
+uK50T8X8dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrUGvC/RgBYK+X0iP1Y
+TknbzSC0neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVbGI2Ou1WMuF040zT9
+fBdXQ6MdGGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcpesqVDNmWn6vQClCb
+AkbTCD1mpF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAggAhIc3ERhHN8t/+GDWhvPR
+ZrSEaRVOc6GmccQ65lIktR3YahcpL/KM2k8o3yJgroavIugxteaBrncT5muxMrAn
+AP6pkBAVa1xStg2ExVt1Jz8qohPNtqZaNHeObtXLCsz7xqR2FRguBzhCgoIUcv+e
+Jx9H7Cld1UpSFwIURtyyLLcwLbJa0mBC1tS6L+dxivmGaUQyU2ywMYyGAfJBGIYk
+GMx5v3GwXkaYxvQaaAUIeeHTTo9tglPBwuCr2Upw3CwM5g8q0BVxX337ybUO/hx9
+oiFijBTo6UR4dmSuroSW9N2KP7/mnZirNR0hBXVeVSVApKspoSk9Dolp15jR6kFH
+5YhGBBgRAgAGBQI3FJfVAAoJEIs6YB8IyXXlME4AniogMeV3YLNf6C1Y2+k8F3rt
+0S/OAKDHF+wfxLDzCxsoQbwesIUAKgb7Hg==
+=5VyJ
+-----END PGP PUBLIC KEY BLOCK-----
+
+Type Bits/KeyID    Date       User ID
+pub  2048/DD919C31 1996/12/24 sameer@c2.net
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 2.6.3ia
+
+mQENAzK/QZIAAAEIALrsEjuGlt6wkHy8fx2wPSkH7paAqJHDCbO1W/GMVs41BsH1
+xpyBi9lOtUXHsDC8Obx/TES4/xVPSsFKPQLa9Q/OsxjXmEPBvQ5PZdOXJ5zmRMI1
+1cfUp2s8w6i+IS68IWRKdPMshGWFGar1YUPM1UpVME7U+uGD3wgdC4DrVJHzS5Eh
+gEDyQ9FPb+8CpsRO3AvUPzsZGG8Iy/9GiLzmaJG34zZ5fv5X7sr89xiWJ21ehk+X
+ePO9kvq+nzfOCCK6a3GZD4g3KJX/Pm3oKeaXeL8WSCCPzpNbtRJk3ofeN7Zm1K0L
+yChPiyui+OO063/WASv52bxUIlmzbX82a92RnDEABRG0DXNhbWVlckBjMi5uZXSJ
+ARUDBRAyv0GTbX82a92RnDEBAfqVB/9GSzADIVqY0faFOLN6+E3qqg3hPRLBvjgC
+5cvTlwT7W64zI+aiSZuN+xAXq+3lnKtmzn45F3hD7gBxRPJbSKsObn2zU4UcqW/o
+qoiYEnO9EhoBomwPUbVy8C00CWvDLfeF4L5r+2oXgilTsCojSaWJX0QoPCwRQao1
+YwZ6CqAA78vdbBNkmA0WrPsVqwd3ijgFapcX671AqiT+pDbvK646I6uGPXJzN3ZU
+vFuDim9D2uNk9CfvPhKGscr4qqP40TnNn5fjSsmrFyFxYsdwo7I4TFpnsEPOw226
+GU+TR7zdwnByP72AxPEBJ/F22LwNyreuph+fRpWCnCf+9gVW9Heh
+=jS5Z
+-----END PGP PUBLIC KEY BLOCK-----
+
+ ===========================
+Rob Hartill <robh@imdb.com>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 2.6.2
+
+mQCNAzG6VfMAAAEEAOvtvphFG/D02vGLENBl5OVPgEJgP9E1xhUgKTZnJstv30kD
+h1IqeIBkEAy5bpKapCbvvxukyQErhB0efTi2v5yTAlz5pVjgWM5Sa8CyTXJmXPHH
+EuOfy1DqaiQSmZ6KWX0ygw3gKDZMiNMf06UURLLYtRlGKSYY3WVj2u2UCmS9AAUR
+tB5Sb2JlcnQgSGFydGlsbCA8cm9iaEBpbWRiLmNvbT6JAJUDBRAx5eIAZWPa7ZQK
+ZL0BAU2XBACXfopMzC8kW3KEqq+N9W9fkGNgy//8XqQ77FmfPQPbO4X7Zn3cyO46
+MxvPP+92zSyN3dyj/xWZYoRLwll+ync9d4KUFwKw45DALAvz1CKHMOpQPD7dIWdE
+9poJQrcbKeOqLcGZTu/hY90gWBUZ++9umR8X8lyh/WEgcUolfgYHew==
+=upYh
+-----END PGP PUBLIC KEY BLOCK-----
+
+Type Bits/KeyID    Date       User ID
+pub  1024/631B5749 1996/06/21 Randy Terbush <randy@zyzzyva.com>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 2.6.3
+
+mQCNAzHLBS8AAAEEANGFXb9o0NPVfVjSLvQh1j3fN6cMeVNA5BGUJ6HZGP/NDxTE
+i8hwejJqakkU4ux/g6Kqckrx3h8WR7OXZZ+R8CsA0bg9Sr42ndEQCUISgArg+lXZ
+gRUniARPPA7tamTSq8v1mnxqy9s26Ht2rAG2D6IiK/7v0JlezKirDeBjG1dJAAUR
+tCFSYW5keSBUZXJidXNoIDxyYW5keUB6eXp6eXZhLmNvbT6JAJUDBRAxywUwqKsN
+4GMbV0kBAegnA/sH63WyfwMFmn3nWe8T/5IXO/QkMYoMGLS1i7IxMY9O8BVvKQM+
+oxEcJdFAG7zPZkpgKzTBxmExz5hMZ9hwJ42XhrslWoP7JVvADJcdthrUAYW9W+jx
+GcDYAW3qW5DpKsQchfvXq9QOBDxP+Kbbe2B8xGEyGUhLkacISFTrIhhQSg==
+=8P8s
+-----END PGP PUBLIC KEY BLOCK-----
+
+Type bits      keyID      Date       User ID
+RSA  1024      0x49A563D9 1997/02/24 Mark Cox <mark@awe.com>
+                                     Mark Cox <mjc@apache.org>
+                                     Mark Cox <mjc@redhat.com>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: PGP 6.5.8
+
+mQCNAzMRY/IAAAEEAOloTOU0f4w7FDRMM6kA/6XazXxJ/HH8dsmb6E7RuYfVlXsd
+kCwxUBOkyW+AYhkHbYUwnB5qBoFUyLrbLGuwKHW1KnAwgbeZLTH5nqQLpA0RLGVZ
+v3tzImKUdyyxBphZWC4IeEgUbl9cc+piOsEJ8QzF7gnqwWo/Ku6tTP1JpWPZAAUR
+tBdNYXJrIENveCA8bWFya0Bhd2UuY29tPokAlQMFEDQvYTHurUz9SaVj2QEB/hMD
+/ix6pAa+4ZgFQNRAc7fC+I4uGWvXoI8N8wtgiJi//8Kc1vjtvTylLPKVBDsy1ihs
+bVOjD3NUEkH95TNI3QhVeCwJPl2e3GgFl253hj8Jai9snHj75pXjQXq0NxQ/JRSr
+EAqrFM7+yRLPs7zDwsMoc2Ox5emq4joVa3syZUEwW7LxiQEVAwUQNLELtdZUWxzP
+wQD1AQFWIQf/RtyM8Rw01RdQXH5fA2jLaQlwD/VG1dlxqAcLKVQIKR77iBPdfcrW
+LyexGgQmltuVTGs5U1XPf7dff21NP79aglvD9hll82L5wZQybNpy2o6/66EPp4OW
+F1/WG7JhuCRfy53H983ERZnqGD4YeBafLHI9oGAixZ9G/+cFsxPde3Lv7Ij/1Hwp
+eNAHJQibBkpdq29Kye/+PHgE0HTMSapYXN/YVTCpEFzE46YnD/BjzZ/E1UClvcsW
+ZVoqPR46HARVQNu+MfoR/WSBAOj65Dt5oBZTcLoQ7TyDcd4gvLhdzLUo+kboGTjt
+HLvesaAWKLSWtKY6G8Iy7R5+Ms0helLFaIkARgQQEQIABgUCOG/pBQAKCRAXWVXO
+Q77mqABMAKCgO+LVARom7t/XmRw4w4TO9IkM9gCgh2URPU7tqECsr+WuVfC/v/7e
+vVWJAD8DBRA02GubUX4eqU/cq8ERAgUbAKCO913wXBCqiBfQBT5F6koRZRRvbQCf
+fJ+Y14jFEx+cfCdDIUjjD0l4/diJAEYEEBECAAYFAjvQk5wACgkQVZbdDOm/ZT0n
+TQCfdqn38SRRYeIG3+LIPqBdODr39JwAmgOH2/N2hjA2Z/4QMOjrQ4gIgpAPiQBG
+BBARAgAGBQI7zAqEAAoJEKFQ/C2FqPeL7C8AnRr7d0vN+E1W218XjItFonLw42qT
+AJ4xUrPsSduizUQnOuzdR8x2x4yEyIkARgQQEQIABgUCOjcVtAAKCRDe3YS5RDds
+3Dz/AJ9UaB2vKuteTC+gm80f028DPbmCegCg3ZM1Rt2WMDS/wHW7nQJ/xnyg8PuJ
+AD8DBRA6ynJX/W+IxiHQpxsRAjd/AKCSXqSmTnrzlnpgYwMESQiKQxfOywCeNuUy
+0q65a+C/ayC7t6F6ih9+bcW0GU1hcmsgQ294IDxtamNAYXBhY2hlLm9yZz6JAJUD
+BRA54aHP7q1M/UmlY9kBASf1BACwKxBv5osTZpJIiKsdim/P2LHOtU91Ne8kxTdr
+78Q86cHSz8V0ExA/FWKkOPgEHAIncXItNH0t3pGtUbAcYuT830Y7OJgLZdEWszQc
+bsp72nlK0ceZ6SFRE/ouDlcnyaiou28l4JGlttqi08yO6LcX3sQD8wDaQhoUoCe9
+wg/eaokAlQMFEDrLUyUbCAxFJxmvNQEB3XgD/2M9X5cgqjItm4vH9CjkAEOvfYh0
+KjDTy9/WA0mVDcXvV9RZGMMnWmSKg1yDZp4A8lWEQkk6VxZEMwW1PTtsFlOAyEQT
+2QiRQtS6tFTj8X9aZ6a0PeYF5PyS20hvJzYXpbogkemBFtUDmsfXToSoO6Uz1E3q
+eTYYIMB01pImXvdpiQBGBBARAgAGBQI70JOfAAoJEFWW3Qzpv2U9XQYAmwfOqWaT
+wJFN0bz/9PLlxJRO0J+ZAKCHUML3L2N1yqR0CXTO2C40fDjsMokAPwMFEDrKcnL9
+b4jGIdCnGxECMsMAoPGRixfMANAdwK0OwFjayMH0GV0PAJ4kP7UxlR3DkU/5wTOZ
+dGL/zRRHJrQZTWFyayBDb3ggPG1qY0ByZWRoYXQuY29tPokAlQMFEDnhofnurUz9
+SaVj2QEBJxcD/017e1bFJGNcISL2dIvINhnXnzHxL6B66exG+8+1pFkR8e/EvgEv
+XHMs2+AqDfUxkb1PNSoq/u/m/VpJGEWoObuSkiwiqUYrmXcJGElUQyHMLDKSLQQh
+G4PkeSp0T2yX+Fk+5F3vIOdK53jsD21zXqB5QD7TjCLSGkU+BiLuLGX6iQBGBBAR
+AgAGBQI70JOfAAoJEFWW3Qzpv2U9p6kAn3lo65wMqy/XbG+RgeJlrQQk0v5tAJ9e
+zLVU5oVtfnH6JvAZFvi8sudRhokARgQQEQIABgUCO8wKigAKCRChUPwthaj3i4gq
+AKC67ZkCrpAZWQKPJdwTw6zn6GsyVwCfQyoy5lGIuGBu0je6You3NEakk36JAD8D
+BRA6ynJ4/W+IxiHQpxsRAsw3AKCqcCFo5uzU7XEom82HnvX7kSPDtACeIqOnzHMb
+ArpmDAcknLxcmsjp2J4=
+=WGLR
+-----END PGP PUBLIC KEY BLOCK-----
+
+Type Bits/KeyID    Date       User ID
+pub  1024/2F90A69D 1997/02/24 Paul Sutton <paul@ukweb.com>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 2.6.3ia
+
+mQCNAzMRsB0AAAEEAKj2XYYEGcZhT69x4gskQ3xz+KMTLn7gKSqqcyyeinJ0ZjLl
+6AJjb1/68nGsF+IIY+IJS+5smq8do1qpC3UZcmw423Sg8F71GeqDO4HZXOAOieVy
+rpVs6S5TaXlJOcrC7zZCx+iql97+xJFjUGkkS7j/jIkx1AajzMNkSr0vkKadAAUR
+tBxQYXVsIFN1dHRvbiA8cGF1bEB1a3dlYi5jb20+iQCVAwUQMxGwHcNkSr0vkKad
+AQGrigP9F43zbiOigYel+JCMiB0HK/UdqSrf3xWxHIKWKNhQNjhnyeF+jKQwFld6
+7KQYsqZIpHsWLWmSk0AmKQOUIw+DxclDxBL2dT4p+CjgTgIAcbvPpahWkBAw/E+c
+EGTiYbe+Y3sHJhhP+d0TOLmsETG9tpi7gFZ6FfNcWPxFMdxGrf4=
+=0jQW
+-----END PGP PUBLIC KEY BLOCK-----
+
+Type bits/keyID    Date       User ID
+pub  1024/BA20321D 1997/06/05 Chuck Murcko <chuck@topsail.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 2.6.2
+
+mQCNAzOW7moAAAEEAMYZlNOxWCjLR/PosadbG+xsrB2unid2LiYoakTFiDIBaZjx
+bu6hNmVZPYfKOXQcqrCu0EY3uVLP/L89bST5pfIZOzz8GTm33zrETgfzpXYyFdbX
+eZ5vc6aa3+7zmI7h/aU567P9ruB2C/RBLl1A59wmPRRVvjEIAkI4bAO6IDIdAAUR
+tCBDaHVjayBNdXJja28gPGNodWNrQHRvcHNhaWwub3JnPg==
+=vUdL
+-----END PGP PUBLIC KEY BLOCK-----
+
+Type Bits/KeyID    Date       User ID
+pub  1024/26BB437D 1997/04/28 Ralf S. Engelschall <rse@engelschall.com>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 2.6.3ia
+
+mQCNAzNko/QAAAEEANZ2kpN/oMkz4tqzxvKPZws/XwsD0Y+E5/y7P2DIw4uHS/4N
+syQbgkdrZhPBlXDv68DQioHXWsb904qyr7iZB1LC5ItK9MgqlK+Z2mvPqsGbHM8J
++oYib8kf2zJ6HvrYrP7NYB0tN9YYum2ICtx+hIi6aKGXdB1ATA5erwYmu0N9AAUR
+tClSYWxmIFMuIEVuZ2Vsc2NoYWxsIDxyc2VAZW5nZWxzY2hhbGwuY29tPokAlQMF
+EDNko/QOXq8GJrtDfQEBKVoD/2K/+4pcwhxok+FkuLwC5Pnuh/1oeOYHiKYwx0Z3
+p09RLvDtNldr6VD+aL9JltxdPTARzZ8M50UqoF9jMr25GifheFYhilww41OVZA3e
+cLXlLgda1+t0vWs3Eg/i2b0arQQDaIq7PeRdjdEDgwnG4xBaqaAqfgxwOXJ+LPWF
+hiXZ
+=K7lL
+-----END PGP PUBLIC KEY BLOCK-----
+
+Type bits/keyID    Date       User ID
+pub  1024/45B91DF1 1996/03/02 Doug MacEachern <dougm@osf.org>      
+                                                            
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 2.6.2
+
+mQCNAzE4lesAAAEEAKJYS1vL2iB3owwiZdCxp3JyvSNaC7h1p2jQXcJvY10gqyZm
+VffDwFoSvJM1JdCx3o1mb3JpZ2OTV4SrDDkzcSpTXelgyh7k9O3HB7oG6pHTML9g
+Dq9ZKydShMIvIJos7KuLWoM/eeeejtkv7r/gWsGHAyKbT8fs3r7nlmxFuR3xAAUX
+tB9Eb3VnIE1hY0VhY2hlcm4gPGRvdWdtQG9zZi5vcmc+
+=yaR9
+-----END PGP PUBLIC KEY BLOCK-----
+
+Type Bits/KeyID    Date       User ID
+pub  1023/163751F5 1997/08/18 Dean Gaudet <dgaudet@arctic.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 2.6.3a
+
+mQCNAzP30QgAAAED/1k8hPKsJj8Il/TfhP1JIRGwnXuzfQ/etv+MZJMzeNeKa8OX
+Kw0d4e1S/KdJ+AZwWQp3ZMDoX2ghZ79X4DDDLEAc/Fmy0Gg8t89CP+xJk7b4EHjk
+F7HX69BRJp3On4aRTXRND3WviqEmn5ppzbBkTenF9WWudLRbqrc4NnoWN1H1AAUR
+tCBEZWFuIEdhdWRldCA8ZGdhdWRldEBhcmN0aWMub3JnPokAlQMFEDP30Qm3ODZ6
+FjdR9QEB9VQD/0+zumFj1zzYZ1+bS9Az36gijDUb8rlEVf/lBShx4VEvha8fsRRy
+vkwnmJyupYvGtrSIYAwB0VK+GZPZa7XfZvUCM83AZY9vGpE0LwW2Vcz9kWZdJ0t+
+B7zJElmBUrmj9aW6ICmSNbOBwVo1Y7hg6lPSFFMOOECFpT1WuTXXYpNA
+=KWcF
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+pub  1024R/EE65E321 1998-10-22 Martin Kraemer <martin at apache.org>
+sig         BB1D9F6D 1998-11-09   ct magazine CERTIFICATE <pgpCA at ct.heise.de>
+sig         E2449019 1998-10-22   Martin Kraemer <Martin.Kraemer at Fujitsu-Siemens.com>
+sig         EE65E321 1998-10-22   Martin Kraemer <martin at apache.org>
+sig         43BEE6A8 2000-01-03   Michael Cook <MBCook at MBCook.com>
+sig         49A563D9 2001-04-04   Mark Cox <mjc at redhat.com>
+sig         F88341D9 2001-11-18   Lars Eilebrecht <lars at eilebrecht.org>
+sig         4F09F055 2003-04-21   Daniel Schemmel <daniel at schemmel-ac.de>
+sig 3       CC78C893 2003-11-18   Rich Bowen <rbowen at rcbowen.com>
+sig         D20BA2ED 2001-06-03   ruf at tik <ruf at tik.ee.ethz.ch>
+sig 2       F43C2F92 2002-11-25   Bruno Lustosa <bruno at lustosa.net>
+rev         30B94B5C 2002-12-28   imacat (¨Ìº¿¿ß) <imacat at mail.imacat.idv.tw>
+sig 3       3BAA3AE0 2003-11-18   Rasmus Lerdorf <rasmus at lerdorf.com>
+sig 2       4C9165B6 2003-11-18   Aaron Mulder <ammulder at alumni.princeton.edu>
+sig 3       88C3A5A5 2003-11-18   Philippe M. Chiasson (http://perl.apache.org/) <gozer at apache.org>
+sig         84F9264F 2003-04-21   Harno <ask me>
+sig 3       30B94B5C 2002-10-09   imacat (¨Ìº¿¿ß) <imacat at mail.imacat.idv.tw>
+sig 3       A54DA2DF 2003-11-18   Erin Mulder <meara at alumni.princeton.edu>
+sig 2       A1D69759 2003-11-24   Michael Kellen <idsfa at visi.com>
+sig         152924AF 2003-11-22   Sander Temme <sander at temme.net>
+sig         964F31D9 2003-11-22   [User-ID nicht gefunden]
+sig 3       76D83CC6 2003-11-22   Manoj Kasichainula <manoj at apache.org>
+sig 3       CE19D5C6 2003-11-18   Jamie Wallingford (legobuff) <jamie at legobuff.com>
+sig 3       F5FC4B42 2003-11-21   Theodore W. Leung <twl at sauria.com>
+sig         FD093C41 2003-11-23   James M. Turner <turner at blackbear.com>
+sig 3       A11D56FB 2003-11-25   Geoffrey Young (http://www.modperlcookbook.org/~geoff/) <geoff at modperlcookbook.org>
+sig 2       65FDCDEE 2003-11-23   James Howison <james at freelancepropaganda.com>
+sig         40581837 2003-11-27   Nick Kew <nick at webthing.com>
+sig 3       D147B776 2003-11-28   Mitch Comstock (RAID) <mcomstock at raidworks.com>
+sig 3       142B509B 2003-11-28   Glenn L. Nielsen <glenn at mail.more.net>
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.2.3 (FreeBSD)
+
+mQCNAzYvawcAAAEEAO/lLOQVYsUS+l7yan+Rzr0ehfWRqlgeNsV4DQ0xTuQewD9K
+5lm7ujRwutxlNaf5dXjE24mlsiRN8KDp+fKwm7Wtqv490xmhzS/6y8ekwB02P4fi
+/JJNX1PbLS0cL6+bz2dFqLDhh03Ovz3G16Y9he5mrJ2PNOWa9Dfj9F/uZeMhAAUR
+tCJNYXJ0aW4gS3JhZW1lciA8bWFydGluQGFwYWNoZS5vcmc+iQCVAwUQNkcAbUS4
+3da7HZ9tAQFUnAP+PrKa3YFKp9XTrANmORex4kOyNpM1adS8zM6bTcHyIkH4WitB
+b2nRbqOdOuSwbh655aSStluIxY66CValeL+6E7MCEqQ/UlzzMVmdbMyWSYwDlkV3
+gQkg3vE6bgFlWlLLr2HnkllY3ISEChDWh8x7fRKLy+8ZBGW89ZXOGkhIb9mJAJUD
+BRA2L2ueKwLDReJEkBkBAbeGBACKM1FCmQC583/IHyw7rDlvnsZKeKvdbbLGSnmJ
+NWOyf4VgkC8OCKmwPnWLOOIK44/JsT2Yonih2r+04FBqYo6SsMgBqOBJqKktHvtx
+bD3VfUUkkV8kZ4ituecWTx0zj1Oa0QiCiv8HHvdsmQB0mj07mWQz1CamXPSwHYn+
+t+fJOIkAlQMFEDYva2c34/Rf7mXjIQEBcNQEAOrt4+o2LwcCiJp3bOF9WZMirpMQ
+QJISqXBnom3r2eB+k1a/Jig1sePSzPxneW9EgWIrWg0EfK+u2kMgvTJynDUux9zL
+4qnECmZT+ESEm+P8rPKeecOfUHgDjQlTUCneOX5p0TbdvJm+TcJVjXjoVrYv6hZg
+InYw+jlvF5e/sdI8iEYEEBECAAYFAjhv6QUACgkQF1lVzkO+5qgJ7wCglwijjcMK
+mq7F50Yc1+rpktcbYqgAnivId+oJ9iwi/18y6Y6t5zxk53i8iQCVAwUQOsp2y+6t
+TP1JpWPZAQH6sAQA1jbAPT5GEWyV7gKNeAmWOBo5JA8+ETmtvDAIGg37wsNhNBQG
+kCP+pN9CuzREKCSOLgZ5KXYpLWsYLJz1X7ZztR2kFmBGPHspYBdJsrzmvydyODHC
+ZgN9Bh0/vmWWKPY3047pkZOIiQ5ldSqaXtmYMzzSVe2vC6VqKQUkZUCNQJ2JAJID
+BRA79yw8Po+38viDQdkBAVwVA+IDjCUtGZoWG2GUN7OoaABSZWqtQfetBL58G71h
+Umv6IhTq1IBm3FDTosZeh6IN+vcSlVvq67F+y9gRDWdsu5Sl2J9n9ZUDUymysQFQ
+++B65oZaJpS8pD09aWAt7CkvthkYD7UXpzQau7fq59XRxZiN+bDAHtSBf4TMi+On
+B4hGBBARAgAGBQI+pFcNAAoJEDGGzQRPCfBVmHMAoO48YN2ZQBVtGaKnYQZpqeka
+zsHvAKCumrigMBBhhUiZq5XLLohV9GU2bIhGBBMRAgAGBQI/uphrAAoJEFz9N/rM
+eMiTc/0AoIN7/2mNfxYll+7LYDVlWG/zWENzAJ9O5SzBY/v7nHJ6tuD+VETweIir
+BokAlQMFEDsaVtNoOT9M0gui7QEBGvAD/jHgMCvKihnRNm3k2+nDUTHFn6blxG6k
+jRtL1DJGQD5cATbhxMx9ioQtD1q87KCj54pcGQ8HbTL8frQbyPX6yFjpSPILIPCX
+WF6NVHZ9GCi3SOo39HNFxCQZUpVof49gmGOgL/qwfu7mi/sBEJP7c3FeyFnvewYE
+2a9SBhZUWdb2iEYEEhECAAYFAj3iUNoACgkQiNfNvfQ8L5L+qwCfdgPwwfKJxDGH
+7S+8llIfUtQAsRMAoI4J55ch47lhayilgtr/MzqoS8k/iEkEMBECAAkFAj4NNagC
+HQAACgkQi9gubzC5S1yB4QCggBPo0gnQXYxXXovq++XB06XkyE8AnAr8Z8v89p/x
+Z5f8Jhv3+arjeJQtiEYEExECAAYFAj+6g54ACgkQlxayKTuqOuDBXgCdE6UopS7i
+xaU0PlutyqcEE6HLlaMAn3tjDl+8GTNjFa3i/yI9VGssa2L+iEYEEhECAAYFAj+5
+3/cACgkQuSRSrEyRZbaJrwCeOVTRdXKeHI8NZGbEKIpBSD2942IAn2jD5cP1e6iZ
+QBp/KcxFSs1BPGzLiEYEExECAAYFAj+5wvYACgkQyzKhB4jDpaX2cQCfSx4yFkoJ
+vJEmA6faBkggxB8cRLkAn0t1PJ2ujChDobTDZyQTGbHaH6RRiQIVAwUQPqRYgc1j
+0d2E+SZPAQJy5BAAiC9vzladIopS40igR8djtOq7qc0h9JqTXN1NXl6sbLPyh8VG
+Ty6CLRTcqw3dvKoj7WSW1ICGOAw1N6UE8g6ErpEcJ7UhZ6JWYcHDAcS7rWNYnPqE
+g4Vz2yprdzJYo38ACD3o81O7ko+KvwFsT+PYquZsc2OsjWH9GNwBGiSugyEJA3nk
+N9S7YMmJ5LriOofMze1fl8wnaoCx55RliOIYe7T5l65hokvQ7u2AT/z/Wca/qSuI
+iz7bNznLyyUT15OILl/WgXtDyhh1dL0C3K0dDxkbCmUB1DoT5Qp03w7fleT8diOh
+Squk9181iUKI85teeGkIMzPff8Th7liyxFFiFse8Q+xbtvN+3/jtnK59ArCpc6uS
+xWBdwoE66Unf63mmiGvEbkgoZ+aAsxm5LkP3v7VHHUJOtESfijLq3QSv2vrobxDH
+ejLgtMU9MQbPLV8s2mcRWeLrMJuFNRRNSEfJLEhG7FtvX8RzEz5kkgaHgSdyJ6Ht
+DHo5MNIl9WkY/oFrh+jo+8j8eh1i81pZyAxPd+FRsDiyGTBtNJLQoARJV+YAY3D0
+Xa5Gmd4p2X2M47koDgHeA5HOpmfB0wuQOYDNnILdhIuHVB1GRcicJGMVx7DOXVJa
+5hoTbHoIz0XlpLsafMIQym/K3x6sP3MybzefD83MaJ+Ilat+T3FxctedvHmIRgQT
+EQIABgUCPaREVQAKCRCL2C5vMLlLXNEgAJ4iYCTPB23/Flm7qNroUl6GVX28CQCf
+RrordYeSP+K7QSxk4IL8PAEbSJOIRgQTEQIABgUCP7mlEwAKCRAQ+kyIpU2i37G6
+AJ4n3x4exHlJaJ0b0aplo7IhezqhzACgmZyzlypniz1CgWFKayMzNdYv5uGIRgQS
+EQIABgUCP8FT2wAKCRDMITAgodaXWVUxAJ91OzkZlLqXZRx40R7Gw5AxUq0fAACf
+ZUrGzdZMoFh4VLmXs9UwjPIkqQ+IRgQQEQIABgUCP7+tkwAKCRCyvrxAFSkkr6ju
+AKDwXK9W+Khm1OACepHiwBjqhs0g0gCfVZCH8N3c9BWUNzvdWl1SY/5v7iuIRgQQ
+EQIABgUCP7+twQAKCRDBHntHlk8x2Z+aAJ9+DwDEdvuehFeJsocl75danlHX9wCf
+SmZLWzDCnXESPG+Nt0zKlOB8VQeJARwEEwECAAYFAj+/yA8ACgkQBurPqnbYPMbk
+bgf/bwdAlRX30Ys7o8Yw0KjnyurkboF5jgGveYQ6ycT7cqOnrT6/68QvNtx9v1Vl
+AqXGbo+vW3N0vPKmyoOk+vVDTjnzOcF56i9fzkRg4kUT0NuDdYS12Ducg7V2bHoB
+oDYErKCPhAMpHlIXH82Y2KjtlJ42QXbjM2PHhp4jRVrVaGEDzpKMJ4J8vy9RsQP6
+VhIBlIkJfEQyAcRzrQPMXTL43q2nSej40OPfwPttPViF4AZcI0WjXSrSUl1TDei1
+2vxatJVQU+5pAnXqNptS5z0CRzew9FbmUtRASf4I6KbUFAEHoactAmSqO+nVQwya
+t8B4F5cVdI61GbAIltn3dJeSY4hGBBMRAgAGBQI/uavWAAoJEKge5knOGdXGNJ0A
+n1fgKsQjBZ9IInHEgxfXuBFBmWYuAKCwL4eokLlqwfoKISp9nb+Q0cVaWIhGBBMR
+AgAGBQI/vdF+AAoJEL66K4f1/EtCFcIAoLso4QP/YJF3MvQb0UD0KgixM5IWAJ91
+gPVA+HGquzcbvBRsuWSbXW/6xIhGBBARAgAGBQI/wSPnAAoJEBoJ0YP9CTxBwBoA
+oLQl8sQPadNHQxlEOE9VDvTHKd0OAKClJufnKrR+QqWdyLj3oWdaPNxlH4hGBBMR
+AgAGBQI/wq8yAAoJEAlaRdyhHVb78VwAn3T3DlfLsALf1p2Fmb8M4AjSm4qrAKDI
+/71tcIrH9SOXnaEUYdn/drhRcohGBBIRAgAGBQI/v/ykAAoJEOyZPWNl/c3u+yYA
+n2DGGUr3635ok+rBGpKTNQShReckAJ9MZN+4nDJUbXdM+mF+yMEIxtKkEohGBBAR
+AgAGBQI/xiDTAAoJEG0LxzpAWBg3tp8An1L06fIxRRms2VFp+jJmEcBz8xGaAKCK
+ff6vbVmqxbVQGcAhd3kQGMOTjYhGBBMRAgAGBQI/x9hmAAoJEKR0DznRR7d26TAA
+nRdPRJLDgffciI89IDzxI/OSOFJxAKCG3SDpdF3M2VpRJUdb088MsOk0BYhGBBMR
+AgAGBQI/x2/kAAoJEPo8jSYUK1Cbb6AAnROPVUmurToM36vGQ6UBUzFtb00+AJwI
+EGe6WyTrfx947xo6gB8GL5A0fpkAbQM0SmQyAAABAwDjeySbW44+mRRLLW0Eteh3
+fwT5cHW3MzBmkNDIt14374uQ6uPi3/G7YW/GFrvKcSG/upLZn81poLIVsMTTWM2m
+P4qoB+9s5YGEhuHWKKMwuMo+Zzr9QXOcUOvXcv3lNNEABRG0Ik1hcnRpbiBLcmFl
+bWVyIDxtYXJ0aW5AYXBhY2hlLm9yZz6JAHUDBRA2L2c/UOvXcv3lNNEBAYdFAwCS
++ei8zQhw/82vG2n7cpU3PoIMNW1Pg1ipJ3Y74hwmj8AWzK5X7BJ3VRS5Y4TOZeG4
+AVIaUwUBvrTz4fRqNbgC9oo6nF7wLKYnGNmUpAGZQscXRT9hkmFSqk6F5pUbI/aJ
+AHUDBRA2L2b/NirXWI85Tj0BAYF6Av4zz/Q5QPvtiEzAJuPKObKSJp0EdA4Ga0JO
+cr751xRNKlAqNwnGxY3MUTupLW3IDQ3CJk1bpxWJr7q9ufv5g/yZJqCTSvRNw3+J
+ePJaWw9N/OGT1SmKvXBx9aApv0/ZXAuJAJUDBRA6n1qpKwLDReJEkBkBAc3wA/9Z
+/ZnF0QkP71AeqPes3FXvYsUH3d8uIBSz+KJoQa/SvB573sW1C50i+JEWnVe8fAQs
+wQQ+F8q/kJal+eqJvap6+ro3KRG1CGa28acuRzHchSmG6GJpUqOXrFfo4sbFCEXI
+s2Wmwho7d7AtnrN8lsfqYmaz1Uc/yl+wHJUJUIubCw==
+=Pz1L
+-----END PGP PUBLIC KEY BLOCK-----
+Type bits      keyID      Date       User ID
+RSA   768      0xFDE534D1 1997/10/19 Martin Kraemer <martin@apache.org>
+sig            0xFDE534D1             Martin Kraemer <martin@apache.org>
+sig            0xE2449019             Martin Kraemer <Martin.Kraemer@Fujitsu-Siemens.com>
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 2.6.3ia
+
+mQBtAzRKZDIAAAEDAON7JJtbjj6ZFEstbQS16Hd/BPlwdbczMGaQ0Mi3Xjfvi5Dq
+4+Lf8bthb8YWu8pxIb+6ktmfzWmgshWwxNNYzaY/iqgH72zlgYSG4dYoozC4yj5n
+Ov1Bc5xQ69dy/eU00QAFEbQiTWFydGluIEtyYWVtZXIgPG1hcnRpbkBhcGFjaGUu
+b3JnPokAlQMFEDqfWqkrAsNF4kSQGQEBzfAD/1n9mcXRCQ/vUB6o96zcVe9ixQfd
+3y4gFLP4omhBr9K8HnvexbULnSL4kRadV7x8BCzBBD4Xyr+QlqX56om9qnr6ujcp
+EbUIZrbxpy5HMdyFKYboYmlSo5esV+jixsUIRcizZabCGjt3sC2es3yWx+piZrPV
+Rz/KX7AclQlQi5sLiQB1AwUQNi9nP1Dr13L95TTRAQGHRQMAkvnovM0IcP/Nrxtp
++3KVNz6CDDVtT4NYqSd2O+IcJo/AFsyuV+wSd1UUuWOEzmXhuAFSGlMFAb608+H0
+ajW4AvaKOpxe8CymJxjZlKQBmULHF0U/YZJhUqpOheaVGyP2iQB1AwUQNi9m/zYq
+11iPOU49AQGBegL+M8/0OUD77YhMwCbjyjmykiadBHQOBmtCTnK++dcUTSpQKjcJ
+xsWNzFE7qS1tyA0NwiZNW6cVia+6vbn7+YP8mSagk0r0TcN/iXjyWlsPTfzhk9Up
+ir1wcfWgKb9P2VwL
+=ZxgG
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+Type Bits/KeyID    Date       User ID
+pub  1024/EC140B81 1997/04/10 Dirk-Willem van Gulik <dirkx@webweaving.org>
+                              Dirk-Willem van Gulik <Dirk.vanGulik@jrc.it>
+                              Dirk-Willem van Gulik <dirkx@webweaving.nl>
+                              Dirk-Willem van Gulik <dirkx@dds.nl>
+                              Dirk-Willem van Gulik <dirkx@bigfoot.com>
+                              Dirk-Willem van Gulik <dirkx@technologist.com>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 2.6.3i
+
+mQCNAzNNOsMAAAEEAJmwazRhNJB4mQkvp0rrxLkeOAxR9fGBXgJNa6HHdLv7YHwx
+mwMorHYDCAMypO1yuznNTaMVT1z3cS+yqhOkTVxwNI1mxW6Zts1kOJB9pWuU33sk
+sUuCkLHXMgyvP9cms6gcYgB5g3UP6M/aQ4T017+Gk/7crlH87DGmPZbsFAuBAAUR
+tCxEaXJrLVdpbGxlbSB2YW4gR3VsaWsgPGRpcmt4QHdlYndlYXZpbmcub3JnPokA
+lQMFEDRZ5+0xpj2W7BQLgQEB/KAD/1xniFNLHp+jxIVrEL6HcI06QZUYPvRuarWq
+3aI2gdeXej59Ry96MOo2MU3MsuQ+wW+6gEJAuyCp2jyYfzF/8winNcFWc738s/hX
+fRYCJe4bvtMcnhBV7GAlTgyw00fcrnaJaQ811+QwKnZvXXWb+QuoXC4ddTon25w4
+XHLjtDZHtCxEaXJrLVdpbGxlbSB2YW4gR3VsaWsgPERpcmsudmFuR3VsaWtAanJj
+Lml0PokAlQMFEDNNOsMxpj2W7BQLgQEBzW8EAItAEaeuIzPIVlKOk1LnHlYc4FyW
+aiNJC2+rRmftYu2bIp/JFuXu3xC0U0byyHu0p+Y1pcAnt2YrqmYUfM0d2cx1b4+L
+8RQR4SGKhq9jWKS3icfKoyMnGiD2CeI8/Xx8V6b8Xg0QqsdlS0kz//qGCDWMz0vi
+oxzasVEvFjqAse03tCtEaXJrLVdpbGxlbSB2YW4gR3VsaWsgPGRpcmt4QHdlYndl
+YXZpbmcubmw+iQCVAwUQNFnn1DGmPZbsFAuBAQE0vAP/aOb/rXsE256tpi0+CRp6
+cd9b1oBmw894UK+Cf4DeNHWehPWJog4y0eNFUcAMdLIdubDzc6Kfxw5QyJt2EAXr
+05XuJ2DJdG24S/aPzGq+6VzL7Nq7pylXuhrACTgeesaceEpUd/NeOCOyzNR7i8qM
+zbGFtU7fH1ipfJjN6fXLo5K0JERpcmstV2lsbGVtIHZhbiBHdWxpayA8ZGlya3hA
+ZGRzLm5sPokAlQMFEDRZ58Expj2W7BQLgQEBGRwD/jdUjCJXFcAbjx3Y2pWUkR7C
+hwJTohM2TvhFp80Ffbhh1xT961XGuHL5l41fRAIg9FEHjQKNVfXeisLH68Qh73cF
+5xuNE6c1x1VSqfDLl9fXZ6TA35qt0G599T67jmVai4F/LjHWDI1O6UvPRuZE3O7m
+eRaCfbPLAJ1ztFujtS3btClEaXJrLVdpbGxlbSB2YW4gR3VsaWsgPGRpcmt4QGJp
+Z2Zvb3QuY29tPokAlQMFEDRZ56Qxpj2W7BQLgQEBvOED/1LhhPP5OkeCCEMVnmyZ
+jZexzv6XOH2I5qH0iuozsI987sSK+zfv8O0wEBwjUOQqBuzlvjKImYQ/oqR89egQ
+AinPc4z1b3kgeGyqrmtea6ScmpKufcWUBbhH0qsXF41eU3ArKY4kB9znV+/PacCe
+VrOD8roFaxIDZ2nW9FS0mriOtC5EaXJrLVdpbGxlbSB2YW4gR3VsaWsgPGRpcmt4
+QHRlY2hub2xvZ2lzdC5jb20+iQCVAwUQNFnnjTGmPZbsFAuBAQEaHwP/Q2Rs6MIu
+z8all/xildFOPfRAX73InwBeInr1O4UU4l6yWRvuLkg+m6O8eJSHo21SNZBCu9gM
+FoQsd0jVOitUr8+w2WkypBlJo5wl1nCw/1sLU4AxtBb0jyADvJzxFCeje/FkxEvs
+6Y3eLxpJRBylbg6KFOsmSY46DyGc49B6cZo=
+=xUw/
+-----END PGP PUBLIC KEY BLOCK-----
+
+Type Bits KeyID      Created    Expires    Algorithm       Use
+sec+ 1024 0xF08E012A 1998-02-19 ---------- DSS             Sign & Encrypt
+sub  2048 0xD8F8125A 1998-02-19 ---------- Diffie-Hellman
+uid  Dean Gaudet <dgaudet@arctic.org>
+uid  Dean Gaudet <dgaudet-djg20@arctic.org>
+uid  Dean Gaudet <dgaudet@apache.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: PGPfreeware 5.0i for non-commercial use
+
+mQGiBDTsCJkRBADJmDUiJL0xUaxg0yw7+VqqFUL6sjWxZeZ7kQZs4dyN3R1ilBUG
+KmOXE6qSfb6Pi0qEmgCz1K7g1KaglMRrpANY4h1CjziEVmTH5s3ocxe77w2uaou1
+gHJERIqQuC4/z0DwFqq61ZVf5dUQTD8OmfOwG4pFs51Si9WS03ueVEFQFwCg/9Z2
+j6UzCLyUABpWeV1v4m0w82kEAK96GyKDcT20TymKJnMKuwya+ZwqrULH3Sdi2Mwi
+1GOH7aomG2fK4D2yxWx5xTiYhmYNnRoopgu/Kv5a4x43tOKS3zeADMnHIw9dMSn9
+4Kba8vfKbZnlOgt9veV+iWZv7N2aS2z7w/i53Y6LAlV1hAIMvGJ3zLfmShZs0LDI
+Ya18A/wNcdJazUk9mLGIoycCYOk5YhWL9sCaCBdmdfDPu++rLnqROSWkmfYkOTt+
+pG9SPnvv3XrX/SEwM8gYfpbZwrFDJFI9W63lc9hdSosFD+8xiRl6h2gKRwWvc1Ry
+xIt3+gUrZxovNxBOv98BoSf/j3lkldU+ZjDGlCplRHSndxlN/bQgRGVhbiBHYXVk
+ZXQgPGRnYXVkZXRAYXJjdGljLm9yZz6JAEsEEBECAAsFAjTsCJkECwMBAgAKCRB9
+bb/R8I4BKqqzAKDc/4H9iOXJxVE0yCEHeTQ2gAHfhgCg7VSq7eNhiJhBgblQav/R
+XOhaHj20JkRlYW4gR2F1ZGV0IDxkZ2F1ZGV0LWRqZzIwQGFyY3RpYy5vcmc+iQBL
+BBARAgALBQI07AjSBAsDAQIACgkQfW2/0fCOASoWOACfb+8OVvy6FCqN2MxdCqp6
+gffNbYgAoOxlTa4NjCUUO9dfLFFYpDfGrRy7tCBEZWFuIEdhdWRldCA8ZGdhdWRl
+dEBhcGFjaGUub3JnPokASwQQEQIACwUCNOwI/gQLAwECAAoJEH1tv9HwjgEqiC8A
+oJDu1HTuGOfChFSJJ31XvV8tnlo5AKCFceck4veIMP8pDC0f5UBGGC3mZLkCDQQ0
+7AiZEAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bxbrlLOCDaAadWoxTpj0BV89AH
+xstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJPPT2N286Z4VeSWc39uK50T8X8
+dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrUGvC/RgBYK+X0iP1YTknbzSC0
+neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVbGI2Ou1WMuF040zT9fBdXQ6Md
+GGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcpesqVDNmWn6vQClCbAkbTCD1m
+pF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAggAhb3cBmR67H4+9Rj4FeTwJ8kflX6I
+pp2AeXXZiffiPVBv5cGzGn2RkGPAZqbp2AkrCb4TrJH//1GPdR8VmPeEGsm6u0uT
+0M404l/4IW1FFQ4JBpTENPn4NYBHkKBNkPcls/ip0lSjlmLGVQVOtDOaFD7n44xV
+hT4WpptCripg/5kymDmK9c8hv6rPUvNoVrDdWR4//MCvNAZvGq2bZGdFTyd5Tn6D
+AmwbvL/UwgiDnm95qBBfCZtmGkkFaoOePtBevWFaviFZM2pErPRcjY8A/1cZsycj
+JPMFYqBKGDIk76ulDSjU0Q8dqhCEDf0o2oQEg6msjDtetVFEDw9yJe0AGIkAPwMF
+GDTsCJl9bb/R8I4BKhECBKgAoNRtRaRMdYNwajSO7056eKazCGSDAKDShamaRjAe
+ThQ1KefmJKyzfcosZQ==
+=25Cv
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+Type Bits/KeyID    Date       User ID
+pub  999R/F88341D9 1994-11-08 Lars Eilebrecht <lars@hyperreal.org>
+uid                           Lars Eilebrecht <sfx@unix-ag.org>
+uid                           Lars Eilebrecht <lars@apache.org>
+uid                           Lars Eilebrecht <Lars.Eilebrecht@unix-ag.org>
+uid                           Lars Eilebrecht <SFX@unix-ag.uni-siegen.de>
+uid                           Lars Eilebrecht <lars@eilebrecht.net>
+uid                           Lars Eilebrecht <lars@eilebrecht.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.2.1 (GNU/Linux)
+
+mQCKAi6+wOsAAAED53PJgrIYS7iHbZn0ycrnzS03fwvwsDpoAVouoqqBSVNoVXH+
+lL+8HzX/fADvNyk1lYi5kTiYR2meKB1p0qpvj4bQ8ZEmcBemhV0FbESJ4CxIgy6V
+euxOD3v9gauyf1u4lkfyLIsCepuJqpkH+aOviE9VhTcE/D6Pt/L4g0HZAAURtCRM
+YXJzIEVpbGVicmVjaHQgPGxhcnNAaHlwZXJyZWFsLm9yZz6JAJUDBRA3pN73pBlG
+R0SoBbUBAahrA/9/Pyd+R/2vz0is/Tuu6aniMYb5O09OWypVtJ+1QB0Hr2pTB7MR
+Spb8ljpMTT+Mv+hE9RZm0lxwW6OgYbosrDCwpw39Tfs89UjFJMmCj+UyThmpt52k
+g3MkcRD7C7J0w+RVV+EPs67vLya3wKRRXKa5i3I1RlznleiJwxxGAgaxOokAlAMF
+EzeoM6P9LZCSqJB7JQEB9XYD9R+ZzFmtJuclCbKR7zZcB/5lqpbmuDRMStAaBIq7
+KZ019tbuyj8RGdc04UFBAVL31pwHl2hrBTsCw0ZsVudvRg1ufn9KwNQnmO4j9fbE
+fYJ1gNDgTaf0zMZ5KdKAhNtw0Wx8tAntvqjcxM//h4lSMn8HWiYlRqNFSxRT0nGT
+CxqJAJMDBRA3peHbT37mpPWwmrUBAXpIA+kBT2YJm3tep61cxMn64OlY+i/OOt05
+Of+fcJwPwD4q0hxXCeWMYSueDvavvJG4+42T1O8xLPCeR6cqe8PBtXlRbyY4b6cI
+mFRuOsFlqEtpXNmJ9AY2KIU8bhZBuzckS6oXGxbM40PiXsIwREib3J5OY6G4YG23
+8LpTheINpKmJAJUDBRA3nOBupMNFzIvCD00BAXGEA/98Rkn6Ncn9BgFUJlLskcsw
+Bn45IJhIJtLYIqyjSWZY9iGPU41txPPcqi2k2atn03ThUufQc4V1R6pnLZwijeoA
+pd3AuXv7o0wRj/zi9lrhpQpE5L/9YzJ+uGkHTMjMBSks74IR87QVebdMxSvFYBPK
+QbwAVohgOBdZyNYyiCn3SokBFQMFEDecWF2urbkCPI45bQEBc40IAJ7NUAL5a5Bh
+qUDf60pLZlYonowEbAnnkT+0pnp70JD1w4+bi1dSa/iboU4Kedf9tqGnPlC6LhN+
+uPWSyJcZ4AxkyhBPoezUdpKDYxezLbSlnsWPpjSHo2iYani7uSDFjppTq5vmmkPW
+lW2NuI9DvXtDS6UnHJa31CqvVl60vmuyQyceI75UK/Qe4kZRgfFQsLrCWpiw6fLu
+KB9NWm5wVt09ZN4U3Zo7eSNVZfSSqzkPKgXR21yD79Qs66PxjM+SH6PrbD6UEtkW
+llB42nzdiQ/8MGNCFLgnaYqUkLe58Y2oicWy7OxC+wWPxuvCW64TF8uGkDlF8ors
+J5DTX6c57HqJAJUDBRA3ovk3JBRJVbhWhOUBAWmRA/92NqJsbkEExxDNrAeQB5Y0
+draruR6h4BTWreJtFH4WitgnqOvU8ylveGLMLiv/cZKRmZuDaBncoQ+mdCMOeZNB
+qW0xGKS4nm+rTw7LlG0DjyO/fDTe8LXdQBxR5hDcm+ynfH/Q16x2Nov7DO9NBvkq
+vvp/nj2KzGH8wrgsHFzOkIkBFQIFEzeOINlR6m16P5LTsQEBE2cH/00BLuWwe/bX
+DqL9+qxsx+Ko53cuJj6ZLwc7UU/YKEW4/9q7EVG3slfbl4aPWWURH5XCpn0iDpKc
+fEvgsbGe6yEoxpDQkj2fTnU9z1B7aitb2u/a1NMhdgNBOHvU0p9dVlaanqsGG0zV
+KE2yxZOa5R7H27PESjK2vT0NxljuUV0zV65oQgb3zT8a1DNnpvbVcPskTSrPiecm
+p8B3sH0OdG9mCAEfO2QDLcg9+XDOH7M1BvH/x6eo3ccj4TUAIx0GCz3LsEenAxkw
+18Bgdu25jhBcjdgNj1yvEbD/+vc6iL3HkuPbDt2jtc25QVRNPYtMDPVOXCzRovAJ
+WOEMaLb74hiJAJUCBRA3jiC/xEaR6Lw5pc0BAZshBACeTZNGRkwDJC4BKFan90qG
+RCAxkzFCVxyFjetBqwkeFsWM4E1dKxPoObjR0lrsXt+IbxZ0xUQB6yquCyIWZvyl
+v4y77ZxBfklHQwOZimA1rinxgOsZozdAJY5OztaScc5fKEDmMGlbc8Kn0UL7k3+p
+FOF+XuMktL3ZUt9nyEbU0YkBFQMFEDeOS7Cec+sKTVjuUQEB4I0H/Aw3vqOo4y12
+XODHVnRiRcZ4fRunqF5KsqHdBuf3Bh8fH99iwlIV6rj7Rdod9OjE10ARCvoxiaYj
+Ev+DF88+xam77IkDks0IGU3ou+c2RjPI9h189FWG8q5m04ZcHtvo3GnGvmgaD5wd
+setAM/xg4279gktoUi/o/Xi6DpJ0mx0VBOuTVwnVEKoCUWJtWrOjVEF4teSrI8n4
+Mb+Y/Cche/iu8l3t9fnny90RfOg1r6jSJi7wy9XSgVangSCjWlrn/gbYmsH7wb2B
+9BUfsiEu2HAZVAIGuOZeU0nqDl4Z91aMK8scVBKBHmeST7dYB6KqXyQaGmDDsxU2
+5ks5GBPChuOJARUDBRA3jOyQaxYS8X0sCakBAd2hCAChV00lh5v4uicK+hHrL6uz
+FI0KgtehTYBLC21EW++q3g4UtVw5bg4ksGgM0cN3T2O3VJ+OIeYp2aW0DUTGVymF
+SZ7Ezt+J+YTq1PeDVpqWI16z/qvyGCJwNLWU39QnX9gYPTfoB0bYTCqnp1CZ6l/n
+E4skqiryJCyoy/icDBsErz8WkPS7R5mJlNtmO9T0WSh6w6AXQrsKKorl1p/dcyYM
+Fr+ggJ7fq1xzufnUdRi+S8rWQbIqcgIKIrGrSaHqKkf4zIHn1QBJO5HomHmLT5pp
+d6SUbXCnTFDk05uSmZHT4g4/wyqhxkWlGtyTMjDluboRUIFXR3Q1cvBMiZII0r4S
+iQCVAwUQN4uW+cmGeh06atyFAQFuigP6AltjOGhRcEg5rc3wrSZqk6fpVucw9qhh
+QKPv5aBTWtIJdIQy1mls00V4QjPW2PFGWpQJSl0ZXTLIgrr/rlBQRziJ8WFMmLhE
+c/TH1ZUSfC3P2YMd9rWxIA6Nk4c7qDmR7bYE6cvndRCEws5NCmvpigY+30tVXBU5
+bK1zgVmR/E+JARUDBRM3ieTK4clqXikoFOUBAUjKB/9FstalvSqDeMHbcYdRiC5x
+AyDA5fU6ZY1keaTSQY9qPCVfHji87wbJge2kmIxA+ldpQQQB7t3z7ktPV25o29dk
+aZpRHllDfzGd7heJPBC0DXEIXu3XZRUG19Baxt2VZ8JA/v/bzL1o/i/sLTEvDk4q
+OeB6LZrvRcK7COFYlSByZXmWcbZGV39qzykG+NxrfXqOwz4NZqebewj3e0cQ/cGv
+csRnh2IsMMfWXDOfioUgLsYQzuVP9imGhRtYzkIf0vf5A+YRBBXLvrAmp3qpJqLm
+D0pSYYGXxwbGEfLqXa2lbjDToRfDvyGfFtgen1AfgaUIKiqRVTRCvxf9ZuvQXiac
+iQCSAwUQN4UudD6Pt/L4g0HZAQGagQPjBZRiXtA4UeXk+J1zYjYKf6dq//K9Fi7z
+9U4obGoY0e0k1OcOGWEa5DWhl3vftOaiWejmU4gXveYcdVCly6fNoX1T8EAmu2Dt
+/qFxyZ8RSWb+ncTqYGM1PFVWmvJBmDfz4zg88gNLnIfxzYravVCvBpaSRjhouBPY
+BegjWUuIRgQQEQIABgUCOG/pBQAKCRAXWVXOQ77mqCkzAKCT40AAdAWiS+62IuYS
+YdYpBzKs1wCgzFg2kH7H0vpchKnpk5W/0R2qcUGJAJUDBRA61hGfms08wKmfdd0B
+AfifBADG9LL4HjrFMfyx2b5g/TqWOpB5eJa5WVvwTgPuYYgEFeD+xQ0AnsU+dpd5
++jyPEdoV3+soL/sg4jbCo3YcHvWZmdo7h76Y6xQLMTFedDGR8IFfeT/X9Be07mb0
+xbVM+Wdy3N71Ua0Tg4nQWbTh5LokCO0lKwCNdu/rB6V9/qKJt4g/AwUQOtYol926
+ZLosMS0vEQIv1wCdGHwC5HayJ+XUosOG9t+qnkBFefcAoL6YCaOqC/YSrDW5jkbB
+ZBB+oKxkiQCVAwUQPL2DzQ9HL1s0103BAQH6igQAiB9kefGNX8/a53jdLcgD9qUs
+VFC1B8zQXPVPwqTv20LVx5TktTfISnupUGMrrh+xNHNN1ay3GkZ0EfbUBAthn0Cy
+gWq06QXyCRyacl4sne+Y+1D51HvvVHCzanXzuaLj0MdCx6Vc2wdCaONFhzqRtUF4
+YZlGAZLEuLqmNqwVPQKIRgQQEQIABgUCPQM/OQAKCRCXFrIpO6o64MRiAJ41B8/Q
+fCbyEIaIssIpaVEmI6If4ACdHBRZcOMhdBVPzBHUG+xOQTO1U/WIPwMFED0ZvGvb
+0kX8s7KhLBEC/NUAnjRj0EuDSbYocYlv2DjVLIibIa8JAKC+N4o91dBh/9CuMPfa
+z9vPKCDsyIhGBBMRAgAGBQI9Z7LJAAoJECxw4sZEMXOc0TAAmwUfeGq6mFWbi6fZ
+OtmmEzQg1mcmAJ4sEqOsUBJg45taUqfsbfCSvaZPKYhGBBMRAgAGBQI9pETZAAoJ
+EIvYLm8wuUtcjmoAnjW65Rh4NdDrhpwYrQ7MqTQBY5IAAJkBG8gWL9hJCyPGM8Wf
+dBwTP4UrWYkAlQMFEz2a8A2z4b7txQbzsQEBV28D/32OJ7GOos9ei5fNp1Njmxrk
+bozjcZK1pSrpTzQQ1BMNLHr+4YPMaTbXX+CqBBOEZKZaeDeAVT1v+EMEHm4o3Ubp
+Bebeyzdwnu29fh5Iz0iOIn2J6YInAt1RxjYosiY9n9tR5l9jkB1QSk5fXWEth25z
+PyYceq7GyiZXslcNiyvgiEYEEBECAAYFAj3YIQYACgkQXUFK4eAFycuG6ACfe0Jj
+SFuU7UQYRzM7bMlcP1SBYtMAn2oFVZTyasM1HST2S8UpxP3n1StLiEYEExECAAYF
+Aj3YF1AACgkQatVs/hkxGwC/jQCcDgaoS8X7hJH8hvwnwVEnPypGOW0AoNAkWdA6
+8HkLjfMjqJE6I10zx8qyiEYEExECAAYFAj3YEhQACgkQyXxQllwcOtd4NwCg0G3A
+M7MqkjQNyI4d1VSQI4N0fu8AoLQA9Wwoz5uc1Gxpaf3w/gjuQQe6iEYEExECAAYF
+Aj3YIHoACgkQ/A+FifiUvhJmigCfVHlN3xXMFNDb3Ff62nYfT8dPBlIAn1TFMV5+
+OM/WS/pS0EfBbfCLp62FiEYEEhECAAYFAj3YJrkACgkQNhUi14Kre9Ga+QCgzbbI
+qTwpnIaFGJefGdtCtmYOaqgAn0jbjCRVi2hoed0UG2D+wiEafE6BiEYEExECAAYF
+Aj3YIx8ACgkQZjW2wN6IXdPO2QCgrCq8WNdXJQBHKNy0xLmOfOIIRhAAn01YjYrh
+v5UF8/HbW80LQJjFISvliQIVAwUQPdgj3CQOZvzFnDJwAQLxuQ/+MbaPOSJZ/cLX
+V1m1opESzQ16OXeYdMrpTRpNaXVyOfhu/gwuhSp3M0l3K5RAb7jVhei9Yed+P7/U
+8O14JC912YSfJxod6O0cg++GExyJliJMYXdnVfU/HJeBuXI9lgAhMx9xHopEmNxG
+4d1ZJUQA3GP9n29go8RwQc30t3z2QTX6tQEk41MIZmWFMAWmLN3o9s7QmwnKMHFH
+EVgD/QpC9W8t1aHtMFxsweJ+FdsAuyCejCcu0xxW04yN2VSQMM8nFYZpkV6bwl9j
+9R3Uni4mDtML31xxJ+ciZPXb8ue2EnLnx1tSeORGyj/2qTyB2zInNxI0idyhX5cZ
+ZYjbn/D35fuKVJO2PUzn0LKMExABkJ30M5pN1Q0iTVkYXLB2QqM/8MX3582bHg5I
++kj5rYlFixYlqI+V7PBv5Y+fkiiKWfPhqOniwtX1y5MTuOxYvdx1AtVZnE3BQYrL
+7Sr5CMf9M0vvaAh3zjx9OYpUq/NklJhYLs/D0XJ45HEEfv4ZaVjVZHxsstgurows
+H6My6cFTDf5gtBgRut/dXLjM7Ax1QRoqFuk9pW5+MrcZtgi/RdEl//MWF0b5vdo8
+38PbMO4EfRlZucmVE6u4tx3B4VSQl+Cf6ye5C2rey1zr548wGZYBWO5m7be8nwHw
+ahzy8pFWR5o9REnzD/7La+qUuVM0jJSJAJUDBRA92CROMaY9luwUC4EBAWmfBACO
+SpwHkNx3uKZeiQeIHur9MVfh+hUuS/Sr1MxjmnHbATqQ6svHkXZ3fm+RhJNChv9I
+apMRsMfDXgW+11P0kwLWuGsaWSDdO8L7AlQjG4vAVZGa3RfbYFL/dWzzJMZhMMRZ
+K4GABGFJt2b8go/RycyDW5TkPTDs/7oeulDfqvPCSohGBBARAgAGBQI92BsvAAoJ
+ELK+vEAVKSSvj7wAoOTZLlnlRLmbiqy9O4oGdI4e7K4VAJsEXFoMtImL9VCPJ5xY
+3Fr/O/FLVohGBBARAgAGBQI93I4EAAoJEFWR4sBmZMB42ZYAni7JWxTE+uRlHTaN
+1Mt9humWf7JXAJwIOaNK+whZiPpuVSy7uSUaozPqIIhGBBMRAgAGBQI93T35AAoJ
+EDRKhE11HX8nMdgAn0gIl6XfePxdBe0u/VncEC9ttk/zAJ9wX4dZlgIKfyVKTVUM
+sQRPm3Ep3YhGBBMRAgAGBQI93Ws2AAoJEEzETQAR34fpj8IAnjzJaWos8DsyMxAL
+YAGKji13z1QRAJ48+B0pijAIS6QsK0rZI9mJd/6KwIkAlQMFEz3dIQtksM0FGHvW
+jQEBMgED/2nl2SchT5r3rITPNvKJSXqEi3ZJk9KC9tEX6NsgHBDufnHMlFmPzWF8
+CIY1Esfk91i6IScbtdIJDCXxTbeI6VQY2EZGAbCaz+VyJRD/daEM/aRjopjxLLlr
+49QEW+YFib2a0QzViWYfdYzB2VFBEOaoGvabHrAsfaRUAZtHDGkNiQCVAwUTPd+M
+ze6tTP1JpWPZAQHPPQP+O0DPnE+N1kUDH0r+96E1CGfeLYAPGUJM1BZVj11DplKP
+lrB3oK2fjxd3zvBbPdJqKrq4/mtxeGXlgOS1n5Wjmtb9Z+k8/aCG2Hw8qg7lzWQQ
+wJxMqDxogERkmshVXT9svhLGwurYY00tNEU1IDV0zTEtCz+CxXpv5sTnyJjJFCiI
+RgQTEQIABgUCPeHubQAKCRAxNjTku5KeVPzIAKCfuxJYXBWle20SqWNlbPpWN+rO
+wgCdHMJI9FmbIkU9wvapRCNQ12Ze18uIRgQTEQIABgUCPeQBxAAKCRDtomXYNFh4
+DngVAJwPbACWWWL3lnUZZisChi50pO7cdACgsjxddmEKCXt11Uds3iBzZOq8pRKI
+RgQTEQIABgUCPhWzowAKCRBadar9ZAHxYQ3yAKDErPthqfaOcfpBRfChi3YfuW9B
+yACfbksBj0KxStjXNIlC2L5SBLpVHtOISQQwEQIACQUCPg01+gIdAAAKCRCL2C5v
+MLlLXDpLAJ0edFHjJfn3buJwBEUXFOOg2yZ5uQCggJcEFvWyrhLkCwXuluFcnS6Z
+uge0IUxhcnMgRWlsZWJyZWNodCA8c2Z4QHVuaXgtYWcub3JnPokAlQMFEzeoM+39
+LZCSqJB7JQEBpE8D/AunAbzd6eYOmNwVXWh6krunrxduJrLPMwBye0H2g1nHVvho
+o9q17Drfl72Lo/Ku2Gs19TVp+KLNk6vcol8ULAdQYftPhIUF8Hf2D2dARMlvjLr+
+fQoYYRS1GX9OoEN4G8PntE0P2aGplVuf45mUpEFaPYwW22FjFykBw7SFp/7iiD8D
+BRA3il+CVuaW53sMD6YRAjTGAJ908hV1PrzsbnTbVr/dbQZYkXrklACdFtqhkXLa
+focMmhudI7IQcccjkTiJARUDBRA3lMiLrq25AjyOOW0BAQudB/45xavMfDwL5K2A
+K1CZEmkwUQLqJJ+e4FMCnT0sUhZ1fO4Yj/HHJ8MYBZ1QHAfyYyE7vConUzGy6m2l
+4amT5uJ/XcibobrUMlTSC1nKl97+vpy8bUOiMTV6xT7iw/vxkPX5tYGORJs0T9hP
+qCqJ+2iT9Owq+bxHL1bBEe9FkExDdjQRO0PMBACiNjvgK3pN0bPaunYINePrNjR2
+3k2cd90+M0XAKCIgaC9LDPB/JeA4HZ9qntofCp0QplzBKOOk2iVKYf+XGVEisRGP
+EaoRYaoMQO0/errELoyY2r3jTTb+FtR8saeZmDsNPiHrZlbXrZcBWXz6pZVyY1OV
+HKDg1HP1iQEVAgUTN4n7alHqbXo/ktOxAQGeVQf9E4rasb5UWITWjmiKloegcwkA
++YYJ+cGUQEw/EttFrbQERZVtC7q3yhPGGlURcvukJyxkghnTWj62IBtEA+OQ6RNd
+OqLmqQc4CqqCWd4GvoGdtmc2IJHEp2G0k+pknoFs9jzGETDRW+8B++mNPeZJuyRp
+FWHKLWrsECfbgmCIYqr/i7HDvBncTDWLWdPlKUT4p8S4+T6cnPx7WdNOYUumCT/1
+Tbze5eb7w4fXheWzP7/EV+jyHxO7yOw286HID5JyB9U/wcAR2duoNKpF47I9yAkv
+7XR/uLAbaNmNgscc5lmZKWuTnOBkrldFKIFCWJ/uRA7eCTq4aZVGHQBm8cud8okA
+lQIFEDeJ+pzERpHovDmlzQEBnkkD/2gHyW4NojEQMZ7eepxwy1JKADIJ4TBi6R43
+RxlT9H2TeWxX9CnOxUngtJMW9vuAf/M11gY6r3c0xgPkAVUCvaZcL/OfBa0cP6TF
+RcQySxJZTyFqyeb3RDgwg+aWnaRNG4XuCDx77A8YH/CQZZ1z13hHptE+u26ZMe8o
+6wC+qJ4oiQCVAwUQNikcGZrNPMCpn3XdAQEqEgP/WcMgFopVyTTFrFdCn8lHh2ew
+rBQPfykIsS7aUh/Io+K2i2rK+q7q3EnJK3fjokCj0BtP00l0gBD+7LmrVel00yxB
+RyW5qnIU2VzEmqcMRVhi8XRvm7gojrlcW6aKeGaCs9sW/hrXXsng6/v/4BS/sGxK
+pWTF378IMwQsXDjP7WWJAJIDBRAzzQ7YPo+38viDQdkBAcaXA+du8KHJjdox8QpJ
+iJiA/mDFRfINUYo9whMvqCwGYojVkkcY9pVkx4bFWV7cxed/gA+/ayaqxYWVAsfl
+urxuOrizLrt/1aZxH6tkLA9HesyFL0gxSMbMv7OJJ8r4HzHl3Mx5m+74xmxrMj/Z
+qowMjezFHKoAQQDR+B1/QkkTfIkAlQMFEDYbWZExpj2W7BQLgQEBurUD/2sDxRYC
+nrqc/Qb0NS0GZ57+pqg6HlkgxOgPwpDYu4kk/4gX6kA7Qgmx28k9oPHihHT+huq5
+al+5ezaC0ZrEUwvrcgbNfxAacTMPOqxjuJD5GEOU7+W8357yJP7nfzSe/IM3D/ZU
+MuFAxH0mYP3gDDD7T0CqBEWbJm9kzxaZ+R8OiD8DBRA61ihT3bpkuiwxLS8RAh8k
+AJ4rm5LDty/7QrAM92rq7JEUuQ7INgCeO7LTLOw9jOqZDwdp8JrC9s2nhyGJAJUD
+BRA8vYPND0cvWzTXTcEBAcXgBACfG2fGomWNVzTCwRzuwZxFfPkRSOAxu2Dt3JlI
+JuCl9Ku+3f8tTaGgOUDvym0suzhz5/PeMvilsrdPI/dsx2FeNZXE1c1Y+kBNmYEX
+MmdGHJGatkdlHEeiFKOwhc17E8CPrk8XzkcwW8N8L7G480hOb9t9jjvN+og1I7Dj
+uUUC/4hGBBARAgAGBQI9Az9AAAoJEJcWsik7qjrgVSEAnRcnEEMrkgFw161OtpTS
+a6giTqsUAJsEDO9X6vwPmGgO/nkeDWce/VATPIg/AwUQPRm8jNvSRfyzsqEsEQKE
+WQCgj+POQEwEMtvcVKA6Z3/ZjoFT+TMAn1ZK+xwgUQnp8eTClAACRIvkuv00iEUE
+ExECAAYFAj1nss4ACgkQLHDixkQxc5xFpQCWMKBv2yd23G73gc0JAGYW8rmGSQCf
+UyGiZ6zDQ+HwKwvlFkWvd+Mn33OJAJUDBRA2VRZbYlyoKdWSjeUBASW/BACnKm/2
+FjN86jOtAH1ir8XdiWzTBCynV9F8A7dxOuEKCaf+6ILgfM3pmRl78GggE9ZesrKT
+hxB6+azt5ln3vOnXBKYwwyiyn6dAjBjYKQCjXUnPr6lYWpn2nDfi5jGg8Wd3GLvC
+BegSMeN54TrvvQqgjb6rnDrO3PfStT7HfKnk7ohGBBMRAgAGBQI9pETXAAoJEIvY
+Lm8wuUtcAlwAoIgGWg4/teriietB5v7akloDwBDGAKCp6ijRdWQaMJ8mOkGRWZpY
+Kjl4X4kAlQMFEz2a8Aiz4b7txQbzsQEBNcIEAJ1Zcp1UYCY15Pua1qLME6Shrh/x
+U+KQIUkbU9aoHRLtMJ9ZyK3nIpN2Z8wuz6YJZ58+gFLuwx8kuw+E9j8yRBwmrw/J
+SViBPa8AZvdWx7qE5wb4wKL3JzDmhbLyD6tdq8k/K8PIKILn0og1lSanOAzWWB6J
+y8UcJf4qstXNxR8CiEYEEBECAAYFAj3YIQgACgkQXUFK4eAFycvpowCePnhazYAL
+xZ+J1VJ14CJsqbhVeKQAnRa7TCTSMLRZ9tKG2IP5h9d4UU3jiEYEExECAAYFAj3Y
+F2oACgkQatVs/hkxGwABbwCePGUylMh9ebstpcYvmVp1Ge0/a2sAoMhsIjfO3mZo
+I9TRG11eH0T0bWPuiEYEExECAAYFAj3YEgwACgkQyXxQllwcOtdbbwCgq1bWegCT
+2Om9MBEOatVMxMGIBb8AoMkDiPAaflgi/sNQqj/fJz5W48K1iEYEExECAAYFAj3Y
+IIkACgkQ/A+FifiUvhLdvACeKIGPl8brem8WCV2DyODB4WEof/8Anin3nbi9soQ5
+tB7Wufk9ubya+yOciEYEEhECAAYFAj3YJrYACgkQNhUi14Kre9HgPACfc1+WD8bA
+p/MCHOUXl75Pq/ynhkkAnAhPJxhwbwmJQAPe93FJK0CWT7xFiEYEExECAAYFAj3Y
+IxYACgkQZjW2wN6IXdN+8gCfckABgKVKMH7z9zOOuZQXZnEYUk4An3uK8GiwIoyP
+PoZlxyYSG3pFZPFAiQIVAwUQPdgVECQOZvzFnDJwAQIueRAAg0qcWjnN86oZUuqZ
+cT3df8pdRukrtrameId7JOT92eIcfSZ0e3TOuZvf9j4CapGoDP7fTtBjvN8sW7QY
+B4jMida0/Jp2iubPAxO/BCOoMthDZLaERp5K+YcrIWskofCOfZys9e0PKwL0pOsH
+XIOCuHai/s6rWPAuSNxo+M7lJ2gkvcFTopAbnC1T2r4Tl6xhd3EqRiI/meHAHSVP
+vhmqGWYCSJjM0I2JReTAlyzXu3t0lPSjsedlHnY1mjSN4dxcuuUglc3WCln6JntM
+RYUMZ1UlsrBMbfGYyxzcxSO8nkV6n5+95BrAkV2ncmSFbt3dX36Np1gPJW4leobC
+FXrP6SEF0pUAXQSXdunXR2/fnxlq2kSHGvNMDKSLJMx7POhaD/A7X5uTCID/t3ND
+ep1AUSBfk7NkNRsA1VzRP+2BUxOFPscNB7mDoQQIXX3ccUWFwiJuQ05CrCsCUerv
+BQlBXEwXIyBl+ZvJTpY9jpp1NI31GBTcHA1kyS/DCCzTDhkg9gAuYDEUuxtN/YcV
+BbbKl2mT7VF4s7k5DYJwBRDX2pJrdzGebiPRs0IVDI/dHocTTDlxf++r3mB4J506
+82i+kVmwJ7HrLkgXlitZxeesTCFY+Et7qEZLENaJV3jScYPEkJ8zGSRnNsa7ySj/
+5Ky50SjTHjyu94ODQRJ61j/OweOIRgQQEQIABgUCPdga0QAKCRCyvrxAFSkkr1iZ
+AJ9P1L/Kcnu5YO3Ffjt3BCt8iBN1AwCg5yilElAdPPY4T0+C2169KeO1seuIRgQQ
+EQIABgUCPdwsCwAKCRBVkeLAZmTAeMjDAJ9rjShqH9hddmcjx8OtjAI+9qY1bwCg
+hlWGanggTHNIXXRJeJm/nHja+4uIRgQTEQIABgUCPd099gAKCRA0SoRNdR1/JzsQ
+AKCgxC8Ud97WqPsvn+Leszd/82wtQQCfWHEzkf6CXB0AjItFv2lavhQPZsCIRQQT
+EQIABgUCPd1rMAAKCRBMxE0AEd+H6UQ9AJ4n96TMb6dFairFj6i5PneMP5VNtACX
+eFF09NN7EhhdOydNuSD2o2WFCYkAlQMFEz3dIQFksM0FGHvWjQEB9FAD/0jbvqVv
+oFwjXFu2GBlUu2oRCFpwbo5xAydPpL6H1/PHtkzNMkzuLdY7rintSRZebUGDbnlk
+4MMOmqqg59YHNv7X9Gf9hwMGiMjZ0VVyQs5+cC927n9WGbPMybbimCbPcnFZ34ug
+h3tqb7+UyvPdlMJBvywqipu3vYKj6htITnIEiQCVAwUTPd+M0u6tTP1JpWPZAQFE
+zwQAsO6P8DH2bTvJJsEl7GCaet0XkSO8WEXgU7GDsA7BAdKA4WGxf4Hp7FvT2znp
+A76paD8com79YcmsULidmh3WVrCGG6tb4ydt91CU8V4Bugr/0/auhfpNnOY6H+eJ
+d4OgF8NcNmjM3Jt7l1ZNRvDFqyyS4fXeJGHyBwMhrHO1EfyIRgQTEQIABgUCPeHu
+YAAKCRAxNjTku5KeVGP8AJ4q2zuDiIgArirtTfI+s+hjThAX1ACfbamjwnJY0wKj
+ouenyM0kX20/aeuIRgQTEQIABgUCPeQBvwAKCRDtomXYNFh4DgHWAJ9s68ZI0exd
+RgoL/QycXDNUxFSqgACfdtMFKtINALcJ07vOOu6K1BSRU9GIRgQTEQIABgUCPhWz
+oAAKCRBadar9ZAHxYUfwAJ4lfEdpwATb3PXKccqsZ3frQ1Z9cwCgiRq8qM3CCqow
+5rqV0fLr5kwWN6mISQQwEQIACQUCPg01+gIdAAAKCRCL2C5vMLlLXIfZAJ0T9uMZ
+PqUMpcfRweoqtr0lbKu+nwCfdtyKm1Er1qQdEMBgN2B8EtrMotO0IUxhcnMgRWls
+ZWJyZWNodCA8bGFyc0BhcGFjaGUub3JnPokAlQMFEzeoNAP9LZCSqJB7JQEBoyYD
++wXn4TqjNwDe+7JGRng/4TXtjYnzCrdeoEmc3b5LCtv4MadCSOfeBvDA7ZwXcEoo
+KXvd/M4B4o6QA4SqUcJU5pDqdgP7nFD3IRzx/8XRy+OODciAPHrmZUelNIQ2S3vM
+kjpjjUf0/lQ1jVWiGllmlxCNe7+O+q+iCJOVsN64Er72iQCSAwUQN4UuKD6Pt/L4
+g0HZAQFWvQPmPTlwE9IfrBcb6afTEb6hWewTcwLZckphgwNjcuDBccv193gl8MOh
+PG+wFv2c+jKwndV19NvHeB0r1HE0+lYqLxQI0DTGZTVGDfyQBJMKBOMLOdB5Qk12
+gNOXC7F8Ulhx9w/LlBs31MRsl3e6TY5JyzclPP8qNSI1DhBBBzSJAJUDBRA61hFP
+ms08wKmfdd0BAT6mA/oDuaRfJMUpypSCFrVgprN5fCNDz4hosv+rmkt0A5Ks+Xf5
+Z+BzjCnJxSjUwxNI1z+F2NDDgLXZG9xl0oC2ib4snH7lfWee//zJNr1OqDAOp+D6
+BWfDr41Eu+AYsZdikbZ9sRkilGbGRkx6EjOO+AB5sLwwvZtN2Y9vNBxkR3byKYg/
+AwUQOtYorN26ZLosMS0vEQI2lgCgvvVmipxqIKxd70Gw/P7GZSOM57gAnjMD/8OI
+u7bFfryVUKVIJiVmyPa6iQCVAwUQPL2DzA9HL1s0103BAQGAuAQArIZWUAWR1Dm8
+ahwIXAlGKMGtqJVkbVu4c+Ziwax7qGvIf7sTD7WQFAbytyEK0guirnqSodXOGLLW
+SVrvzB/8d9C7PDK8zDpzatmoA5CXxPWYKGtdB7OjrA32eTuSrwf6S9+OdJXi4960
+CYTUq2D7FyLR3SU/MyvljRLhLIZoq06IRgQQEQIABgUCPQM/QAAKCRCXFrIpO6o6
+4Nd6AJ9U7VCOElgSVuZoFcZa+aIoj21C9wCfe4SCgoM/khv9TNLCLn1OpwzFGeCI
+PwMFED0ZvH3b0kX8s7KhLBECGjwAn2N/LvnT38Ip4KXU5sg4ZFVhYASKAJ9DjJK1
+rgsWcKjjSgWM2ESgYiA+sohGBBMRAgAGBQI9Z7LOAAoJECxw4sZEMXOcf1EAnR5P
+O0gfDHPjKml0u5NpVDXCIYFPAJ9lnk0E5tDzrMtzIBAyvb5UyJPxUIhGBBMRAgAG
+BQI9pETZAAoJEIvYLm8wuUtc7GcAn1ryTaOMH725FdVBWv4vVOBp+Q34AKCNS4HN
+i50ZMJkfAXR99aGlCoz9PokAlQMFEz2a8A2z4b7txQbzsQEBl30D/0/Lo7Cz1mVP
+GlqS6DNbAoeJdmEIvuM6iITmp/Iw2BanBiyI7XsDEw50lhq4PqR3k+Un2vRKnFP3
+FvhD1b1iuyzAiTR2q9OZzDRURRlGnVcZ2qNoduzWQqrmXCDEeWWTEEe9GYO/j2R/
+PYiJrlWmBHC/44EUjcZZ2fkQh4xZJ0A9iQCVAwUQPdgVPBsIDEUnGa81AQGXWwP8
+CXqiBsIZej3+4R05GTZsmWofAMiCrK6BW3dqGj3BQsVjuwAC2Jy1FIXRdnLkyyW6
+qZGzed67nr4cs83WcnITk2p8cei6pmu8tQRwQFlayrIMbn/RzAqguocbNprdnYT1
+aAlJOYPcPfr8/CCHVyuMn1kdkcRGh0O5enLsG/IZ5++IRgQQEQIABgUCPdghCAAK
+CRBdQUrh4AXJy1MoAKCOBamdjWJX7lm8IQh4+Yxl0LS8RgCfUWMqettiFD0g+CeM
+X3yWxDwXvs6IRgQTEQIABgUCPdgXagAKCRBq1Wz+GTEbACrmAJwPGPKlh/TVffbX
+Znc9W4YKmv0CtACeICRk74geAZX+FTMVf2vojnn5aXeIRgQTEQIABgUCPdgSFAAK
+CRDJfFCWXBw612SjAJ9Tw8gPCHWJAXgoJJqFjIkVCB8uGwCg5hbOzUzwDBXkqcX7
+4XBeXF0YnoqIRgQTEQIABgUCPdggiQAKCRD8D4WJ+JS+EhhMAJ9fCvK4SG7U2Ain
+BgARpPzFW/xS5QCffbmKs4pbgGY+bMX7toNRDPPVO3WIRgQSEQIABgUCPdgmuQAK
+CRA2FSLXgqt70WtSAKCZNK3C7QttpKa83LUu9PxKDhTzMACfR77FFd4vrY7uuDiQ
+wSvWAMqPnO+IRgQTEQIABgUCPdgjHwAKCRBmNbbA3ohd0w0fAJ4qt8RjiNFJmoGk
+4ZiREGmJGK7CNACeIK4AmENr/kjihSVzN3oS4CybhA+JAhUDBRA92CPbJA5m/MWc
+MnABAuj2EACQ2kVZwBBIoz0NKZIvyla7/Xi0+xvaY3qeAAoM1LpYvlNDUkFZOwwV
+nSNNXbFmdVjqJs6TOoeMRDOZNeTwJwzCV6RM/OI+Wwv6Ji3ZhF61IHlR7wSS6KVX
+aeuHPvLIW1LTWF5yDEu+QckAoG18Q9rPAXMVKGdcKiMvc7jz8qUt6rT0myEJP51j
+4DNXAFlxKVDgSiXjE71a0DkHgsYZU1JLbO467iRkbA6L+c9aKTu4EuCjUVr5E3rl
+Z7EB6uki2b77MbBVCFYblaIPPz0guf2CZPgLeFiSViqVUypuIGjKOsrGlkb3aya0
+AMtc46vGYZ4kO7ulfUHSscJ/SmSNkONbzjTmpGbEdc4OqI+1UJovEWM8CFopXypE
+UOvKeARzO73JF3JE2er/zRngOOhliWn8Jy1NeAt9bKQ7Fg6VD/p6CNcjkfEy2mri
+UtR1o6oezQCRSPBbURceZIaX2FWHAi+L9ohLTfzk0Ff4s9i48U2eoIIVcVfDWIFJ
+zQa9dB7EEmaEsseMHnqRxtz0oQCR0ihKSeHKt3vSnVzEEvNcwoKstH/cbi12T1Vp
+PBRmMSs1oNbpDZAeuNvvVM9b+XAkV42dTSs80ukjnlRSP8bRhf2qvaYDKv7GT+st
+EkOGNQmzH7H+4fIH6JfnH6K7QoPARfyFZEjhHtEZnOMILxaxvbhn7IkAlQMFED3Y
+JE0xpj2W7BQLgQEBPnUD/3B7Q3rFd+Rc6QESia5oZAiv7DlU0YpKbnqf36nShgpA
+BZn3gIVXIzlijVZoQNZe5Y9vVv0LBBCAX3+hTu+q8y8lUYcDvrKyQHoIKzg2cfAl
+sKDqAfCRd1wo/ePZgrpFQXjWgpmfJnFxKvU00XPiLcViHIX9ut2+mik3L+RVCP0G
+iEYEEBECAAYFAj3YGy8ACgkQsr68QBUpJK82zACcClM78giKcJReGZ5v3g2MNhwP
+SlkAoPPnlCWqDcOSnv7zWilUdiC08+D0iEYEEBECAAYFAj3cjhAACgkQVZHiwGZk
+wHiTFQCg7ScJ5CKs0d95DwfYfFQeYRXnagEAoNVnZ1LyCt9gm4C+k7lcxuPS2xae
+iEYEExECAAYFAj3dPfkACgkQNEqETXUdfydraACggSLLr4mP8iCTyqtmihdk1Ldy
+N70An0sGk21GGI8QOF0fHHtwFfoT5za8iEYEExECAAYFAj3dazYACgkQTMRNABHf
+h+nd4QCcD2eLYdwrQNPJxjsJx+5AIhdIS/UAnihAavuB4SaijBBmH92tGzw3iGuI
+iEYEExECAAYFAj3dIgYACgkQXP03+sx4yJMYbgCgpPZG7Xg2AKb8sI4aD9PuU+Qs
+5YwAoLlQjy7gvlv6OPNn8ygxp3JrBkEHiQCVAwUTPd0hC2SwzQUYe9aNAQFo4QP/
+VjYmvIsDDOg4kRD9zDgyNMrqpJNIGTDN4gOAt6H4vmUN7qY9laYLarMLrJQg/9+m
+7NYuC6IzDlY1Bu1YnOR0OnVtL+WV2EPQuee2YzqAH0qmY2ZQxKc6QfqfqwvAwK4y
+NU7xXvTOAeSNZ7pOqpj62l1puOYbMFqWM5BKykSQr26JAJUDBRM934zS7q1M/Uml
+Y9kBAXX0BACUFIWyTCWZMRZL8Eex1LzvIFpzojkm26V3mIbZp3E6RV13zjqatIJX
+EPFe3qiWGgGHKIaLOt0N2R/A9LLWuYhE016uu3xQQmWgh8XbeKU9VtD9j7eqNiq2
+iVRnQlkR8Z1Jrv8Y0LsvBU2LC83nf8Z0UEYCOxS6ghKc8EFnK0UyRIhGBBMRAgAG
+BQI94e5tAAoJEDE2NOS7kp5UTroAnR15zCxKXR2bok0hFXYW7Qpzk51mAKCf04rW
+temf5aASKwJ9iGwmYhaVg4hGBBMRAgAGBQI95AHEAAoJEO2iZdg0WHgOET4AoJNA
+zn8VI0d03B5PmlecuJiVhivsAKCRlpbeLXdAwwVJPDtC0UcTa/A1mIhGBBMRAgAG
+BQI+FbOjAAoJEFp1qv1kAfFh8rcAoO3xdFE+dO+R4GMptC+cEmYu38JJAKCPcw/Z
+HK33u5NTITecwuqtHNuwbohJBDARAgAJBQI+DTX6Ah0AAAoJEIvYLm8wuUtcvosA
+njKNyxNGBDXk0S/UDxrOEc52JAS/AJ9Pl8MKXgL3kakVr9HgxauwuTpfr7QtTGFy
+cyBFaWxlYnJlY2h0IDxMYXJzLkVpbGVicmVjaHRAdW5peC1hZy5vcmc+iQCVAwUT
+N6g0Fv0tkJKokHslAQFZqAP9EWFA4Cr0GU4MzDAdpaEl8DuVztob+QtWFSgzAtZ8
+/pYnboE/gDWev/ODGzxh89Wg7qOBA1bu6ZatUtUR9KOEU0W9DzeprtSPQ9nmq7DY
+jBo+EvxrRZUXrxM2niJ1kpu13zM0n2tgEmn76RdRQ2wAAfmnzqF7e1PpIR57tg20
+1hOIPwMFEDeKX5FW5pbnewwPphECcNwAmgL5p1ev2W9XyQEy6ylAtga2XBGgAKD9
+nQvjRYGBhAjC6QJ2VWlOtWc+hokBFQMFEDeUyIuurbkCPI45bQEBbXwH/18e2qOB
+Y1iNFYbNqxfAdKItzH6KvA1dsZ0of/JGgXXK6iTcdpPq2vl/RYTpmwLVErhhBRik
+n4XxtNUxigMS0U6IUKesyggHLrXPY3hwGKAvV+QmB/YosTqtWJi885oEIv5uMlJ2
+mO39jjqYAnR2CqoKH1B0b4wRFdpcP5IPYiL9Z4F0zniFxFQ46Vd/pet4K49KVP5b
+nI3yw0x9/t+nbJjee8XDP0Vxcg6A7QoaJU1RKpGWrKsYfBlOGPh/gixcCQbrpsNs
+sPiSplWdxT+xctQpIviPn8UsAgF1WV0jLZyQmtoZ+JvYVR0nrBUNJVQGrsSPbI9f
+0dJXaiM3ddE7dbuJARUCBRM3ift7Ueptej+S07EBAUktB/0Q+oYJVnLw+j6eDPv7
+wzXtFRHcNnv2Wn1eGH/NL3fe6/wglaiZ8tw7kcY9TQWdqCidjSkJSmKCW3O3uNtD
+dRF1kVoEzjMQJLOKY+wHDT5TKemKoNATJPTNp/HJiV2XCVnCR/vvqIrG6n9ct1gZ
+AlTVdqtwHeZ5x3qLQapo26RzYM3Liblhn1vGg0VuO9tgbscZDWDkrRVV2Hr6FIOz
+1PF8INOv9Gm6IJkIQ+fToOz84TNk5ubQUeHbLAjH8fKaaIOYhebrSQVNEAgLQys0
+rhB+B1TVLIiXE76pXk596vwVGii1Cejm0HyX7EhQKMF+IX3kiwnHbdW+6Sx6LkKD
+FzvDiQCVAgUQN4n6usRGkei8OaXNAQGTKAP9GLjMHw1oZ+lTu5B+UVJf7HTQZecE
+jGw33t5w1vvyleNcjl/iEsyNb/g6LMuahmldh1J7SZt615Jw6p6AzXZxk2ispmum
+e+37O0VKPNGZ2IUs0mFhAJ8yzTAZXcMh2SPzUW5gL7HznskNOpxTctope9PlqRGQ
+T+Qmmsc+y6VzfMyJAJIDBRAzzQwFPo+38viDQdkBAa31A+dPvsRw1zWvyMDp2aQw
+qIawIi2wiFl56lYfpkwWWjsdftuK0HHe+gek0aJ1vLwJFlrivroEukF1JaK3kS/o
+b2u/TNIZ4MKWjfhbkJW40Y7gCKCUJPzh6hDw1nYfc4N9XKnwubiRVdW2ig1HVoKZ
+UN9Ad034m30jMHEzqXbO4IkAlQMFEDrWEWuazTzAqZ913QEBaOkD/1ga4Z9KUKzs
+LMcCrqX/4H9p8iJ/wRecXL6CcnyEK/xcm/flhsRZLnNiNMOusW2RIeZSzntjYmK7
+7CUH5UEFb+ryf4LXKoFXV1FOLqnwcJ3JGIX4pf7HnPtcVblX0zrwAwjoCikLsM/c
+s7xVcC7cMUdUb5tgh9RvYcbOtDB54wGxiD8DBRA61ihe3bpkuiwxLS8RAkebAKDL
+Ofbxii5qPiMxr5keCdzwprztxACbBrZie4yvYdXwpylwrJ88o2+n6eiJAJUDBRA8
+vYPND0cvWzTXTcEBAZrkBACLGS/AiGBBDtOK1CzMUneK0DdYkVBk+qXxvFllOfZj
+varNz8wOyACkSB37ZzsxAmq5Dvu2td0HDUkLsvhrmJHIddd2YVIlg6ScWMkKDVmo
+N2t0rPIffFxr4lkeIFXr6LeJXEz2zPmldT+VNVlzIiPHiZuBXqNXAL0ILrt5aHTo
+O4hGBBARAgAGBQI9Az9AAAoJEJcWsik7qjrgpBMAnjVge968Imw+z1aOVDFh5glu
+LuR4AJ4qjQ0A6dN6h6F+xsHUUrMbgVP5a4g/AwUQPRm8w9vSRfyzsqEsEQIFBwCe
+P2q55CzSI50XAhoP1Ps90lttg48An3sPoV5oZr8vNI9dOhrlOEUPJkZsiEYEExEC
+AAYFAj1nss4ACgkQLHDixkQxc5yjyACggstQvc5IdrafzY+XFrlNo9NoWccAn3+w
+jcgbUdR50oVbIsjTbO9p28+oiEYEExECAAYFAj2kRNkACgkQi9gubzC5S1yTgACg
+rO4DT0Pk1EJVg7kUpLL9gJjZQBAAn29oAuoqSk+TbmFLR1Mip/xyJCpxiQCVAwUT
+PZrwDbPhvu3FBvOxAQFAfgQAhcL/YD94uQgNYnlNA8WyQt0iCp6k534X2B4P+mR2
+fAnsvb47pK+POPPXku+MDQLGt1L7fWXn2HV0/IXMrA8vjDBXQdHi56ACB77LKlb/
+RkgjBsJ5sxSaqKm3kknCPU303ypSu/bx0/v2NAsA5dsa3MMOZbw551cpwSAUxDqt
+Q16IRgQQEQIABgUCPdghCAAKCRBdQUrh4AXJy2m5AJ9MdOQSizBm2+c0oe+r+m+v
+AW0y7wCggAwJCQPzsAohf5ZLwrokLrsNEGuIRgQTEQIABgUCPdgXawAKCRBq1Wz+
+GTEbAOS3AKC854HXJSr3q15MXWJ2aRpsgrODXwCfatZhrw0eCToappL6QVO+emvf
+v7OIRgQTEQIABgUCPdgSFAAKCRDJfFCWXBw616euAKD4bhe/A/1YlMCW8VEeMz1q
+8q3jsACggYVijk5n/GXTAYagYLuHt2sS3TeIRgQTEQIABgUCPdggiQAKCRD8D4WJ
++JS+EmSAAJ9VUKqSxwDnt5DOBDOIDrkBeFSLuACfYozztzIvA7dcpRJfbQqhSwfY
+aoOIRgQSEQIABgUCPdgmuQAKCRA2FSLXgqt70aUyAJ9ZnFBaA2KO+QjMMoJrY/JR
+w0d22ACg8D/KhGNnqu04hx5uIHRB/U6WQIqIRgQTEQIABgUCPdgjHwAKCRBmNbbA
+3ohd0/Z5AJ0d9ItcBgBA2jYFZPYM2ndkpiMnsACdFNRsQDPvu+0IKuUhUG8QDOqC
+RiOJAhUDBRA92CPeJA5m/MWcMnABAi0jEACTNnLtJQyLh985/pcpL20ehr7OLhW5
+aAdzodMCoqXrPGlkJPe6/OAP2RtG/g2E8yL4VVVcShcV0WlvHnNIX5KE14LSKjY3
+5iVdSGDzItTuZuXPgzLjzo8pwFW9OCdG48TdGgxrGLAJRcWzWqNat+ZY6C4mQu3E
+/pqv8Twif9J0QeXb1TBiAjg1mDCKpFSb2Eh3KWxNxRqZRrx54BTh5CqeISl/ISDQ
++hQLvD3LrISGfgGDGmlTs6Bltd7PM4wO1MeonSprzgwGqWPVIrWTsD9YQJRGZ9r7
+tPztqeqPk0TIgKQvhS8W0Vf22ZWSNLS62CZtX8EYdD6snN7tfBbG39UszgyQ4EPw
+ds8My80NZ87oP+xIiycllMXGcdN7KjwE2Ai4HNzk5H+6cpUwHNhmV3eVkKyVlEdU
+vXJUywrb94ivGn/loBUwDw7ghCKnDEFxNBiL6vYgkezG92ajaYhjyRynBqALL//V
+07W1+5CdMkr1/MoDOQjGYgkf5+vT3At90gYXvrD2hZ5XwW95Zw+2A6gPOZBDa3iG
+r72smcD3ny/v1NjXC/aKpN4Od6nSI2wNeqm2b2AFHkpSySdWLG1TAc0rVaOw5y13
+vbWNiwP4i4RRIb9mkHpUU5yGLEZJ9CjT+K7OkxAg7A8i079b+xjEBJ6nXMLrxSaZ
+XXYc5h5TDGbLxokAlQMFED3YJE8xpj2W7BQLgQEB8HcEAJSAz9moNPBm4kNtG7yu
+z5gkIlFa6cOmaJB5dnAW3OphxoyC5bac1SBADT6XVTgVNtBwvbk7MwDDp85idhOA
+GDahLBmrFVV+O6o7OjexJhlcTab+eC/pOQrxfG0pYpqk6IsIVNRjHM9LOjngYV2d
+2OZjJ93wPxmYdlkFDjEaL+2kiEYEEBECAAYFAj3YGy0ACgkQsr68QBUpJK9B4wCe
+JPHrZa7bBzVcqPOqdbUyJ8Tn5OkAnR8dm0MWvYtqRYdK4/COcxbkBzlkiEYEEBEC
+AAYFAj3cjeMACgkQVZHiwGZkwHizXgCfZNz44hhBeJvbPj5xN41qnzxpX9cAn0Ug
+9dhPASUF16va6ZW++e8+WGaKiEYEExECAAYFAj3dPfkACgkQNEqETXUdfyeB8ACg
+2hn69wNnJQ3SaUZMoM49SGKxw5cAn2259C7IAho7Wnypa/76Vfv2qD8UiEYEExEC
+AAYFAj3dazYACgkQTMRNABHfh+n8MQCcDfaZ/LmpH2g2izNcTNpic2Isu+8AnRXI
+dHIrQKbKDOnCcTRuqeJBe+1ziQCVAwUTPd0hC2SwzQUYe9aNAQE/OwP7B0Qt69z6
+BP555Yo+PtaDPFJMOtWFsYnlx5/P1b3Y7y8HLnmWAa0bY83SPAKjvLHeQh904vEN
+mopBk5plRPpz/e+T8EJZL10BaZys3KeVncMMiVdfxCMiusu+U3uiWeXbjpauyQjZ
+N2YfdhvZ30yVYRT7KBt+XuRKRHVW+fl4IgSJAJUDBRM934zS7q1M/UmlY9kBAV+W
+BACm/UKONS/oG8Jecyc6HZkaHJnWADYT2EypyaE3OvXNEimaU6S/xLrm2EywbOHQ
+L6IHr8GLZjpln5SXWO/ve+H+kZOERO+jIFUysFDoG7d+S4Zex/dFCULsZCVbaMLj
+G2IPmTsbbJptllGcENNdzl+QlEdWMNiWszv6SCBRnsDNFYhGBBMRAgAGBQI94e5t
+AAoJEDE2NOS7kp5UnP4AnRfUpx/baaGqTO69gRbzLK1exu1WAKCBjqiAjNETihto
+PJ5cku6Hu++Rw4hGBBMRAgAGBQI95AHEAAoJEO2iZdg0WHgO42AAnjIcf+CQlXYR
+eKV47t+DHDvXshn6AKCxSaDbodEOC1Z92ltAsImD+MG7wYhGBBMRAgAGBQI+FbOj
+AAoJEFp1qv1kAfFh1jMAnAmgt9XJeko49kxYxctaaIBj1QoSAKDv2fMPZruYf48g
+C/UmCIkLrbl+pYhJBDARAgAJBQI+DTX6Ah0AAAoJEIvYLm8wuUtcxFkAn0+f5UD6
+GBmz671Jv+/zIG8Qs9z2AJ9ctlW2IAlEXD3QSEoLK4mNnICiWLQxTGFycyBgU0ZY
+JyBFaWxlYnJlY2h0IDxTRlhAdW5peC1hZy51bmktc2llZ2VuLmRlPokAVQMFEDD5
+fUoJNGLsuYI5PQEBF9gCAJQqYY+CSP8r6HWCJaQtjDzrPoX072jD1YUgmWdBFX2Y
+E2aS0F0A4lKJWAb0xyZ4wWcl2aM5Z/3X+DAR0IClsJiIRgQQEQIABgUCNra3sgAK
+CRAT3w9oXcLsWDX0AKDf7NZOZSFYpvRorhOUgBFSoGQ8UwCgxreAMZgT6o+/Ew0S
+6kw3yXpJyWeJAJUCBRAw+O6OHdm2eHD917EBAfj1A/4/cYEEa7jN8+ptmxZKsfZ0
+xOP2dxsPnicDT4VR16MHN6rkVrto782XSiRx3ZUsd9RjUmfHZA3mHoJIGo6JRFVO
+eyjg3LEASSSfZr4YFkhutnf0lDlJOeEKhqvIw/dSO7MDwdLxhOqAFv9UzAlpOm4G
+Lx9p1N61xDl1dIYEnY9cOIkAlQMFEDD5QYseKXCPGoSZUQEByFYD/jqPx2u8D1aQ
+zKHvZqS9PUYSsPMTgn10FR/tp2c9Ch60f+BQ96fOUCzmRt94Iq1iMZsJ0oTyLLf6
+wf/Mdb1LhvsGf7rXFATh25OUpPx1qPUWstSToHSn0+Zf8e1B0p6PJ96duI6rimoc
+8NKppOwSmRvqAD3ATCKpMiOSwWe9+mBZiQBVAgUQMPlE+T40zOw5+FkbAQHkSgIA
+g0xBZlmf7XavacVJwJJx/lNoqmb5jox8Sy9WDS2u94QnviJtsUOjwAFnaDoWDN8P
+EAxvE2xRBoyuGHRNpIL0TIkAdQMFEDMR9XVLXCU0Hmjw3QEBftADALeK5boLfjNz
+xZ7g1VPHw6k6QwSUESwiPJCmGTIT5f941YhHqohgwN5kGR9XDxWCCJAqQfFvbxhi
+Zv0zu4HvQ7FYLVLO2zwZrVvOfR259jvGDFpPqRBq1ccxTNXuvf2a44kAlQIFEDD5
+QnyFat0badac6QEBCCMEAKV60AedWZyXWokcwWIbW/PLgNTCh8JL1vijXGnBvT2P
+uA0L7/rCXPhbb20Arrq+P6xbGFxi42iWieeU2T5zN5IlPObT6cPeRWJkxPnaSf8Z
+D33Y1almcuhhYMUc7lkL7yqSo1J8TRVCSxjQ4W0+QDUFIEvrigb5Scd7zYHGOqoS
+iQDuAwUQMOFRHordZNYSzXUpAQFOeQbBASAkyTxIdH7aIGY4lDbH6S/gtWY+nyF1
+ooIF1+8kOatKm4SCsFYUj08OlLAXs1Ys+oRI+dajl13xh7KfNjPdoKIhcA5QHSsb
+y26MXV1Kf+QVQIyqCq9s85TexK/q1WUQIgCHrsZM0efrUgiEszQobi/16WjQuT9K
+lbBFE8llb+W1AECmO1H6O4U6Krrzr54T2QoEIiYIi2EF4T9x/ol/C5Lj7W6L4yaS
+Squc7z7Ttt2NuRZNLNMveXXa/+0zanwXCqmzjXL7ecgQ7Orsix/jMGN/DZkp5dsR
+eokAVQIFEDD4zdqb2lGD8IQbEQEBjYUB/2eiJQSOIXRm/LXnpTIGNpH9yKtPDQcs
+soCQCOPB6k3tHCiFugT3AZCajKKCbUSU1+kZLfH0SnvyDxnhxqslt3iJAJUCBRAw
++R5/voJFl2Zsya0BAVlWA/0eFxcSJrCcc6WspLfB5eJKUDVmFh3eWnvNUBZWv73y
+KZQanlVq9vfaVGztcQbeBBT4uWsmvAhsF7PLkbByp97u9dY3064tZiqYjAVrdePQ
+bFJOZRQpxPYFaOVMWHKTNr29SOQynqP/Pw7mM9RUIV8DsRqgaiK/oIENXze0NL+a
+s4kBFQMFEDEsVXTwiYRjAFcYEQEBWnwH/jmcYmaqYHgN4jGc2zq9e7+GIy/yeDd6
+Ya3MvLLIdK5kwWzR1jn0UdMsxpQF3rKQki8wZ0kDKYdjF3NwJedSyuM+PO4gEMab
+uZP2Sq4OWoWSO1+aJL4k3EY5l5KW216frDLOid2Tjo8TtbVsrUl1uf95SsG482lE
+ZW1GwQPUEEhgGD57MGfgjykTblLJNhCN8uA1lY7mmznAnjcuEy3wfVCGPNaF31zs
+k/othcGdH9W3n3mbrjyAhkCMZRBYtx3d4QxAIDSfB7vQulwAp2Ink+3VWLZWB9eF
+E5OvwiypG1jYXfyOUkDD24oyits1OVN7z3KJQNVGpUgXJH7Q0Nok5pmJAJUDBRM3
+qDQn/S2QkqiQeyUBASpPA/0Z0rLxeX8MgmxAwon/DVmw7K6pkvp8fd7FkLfVjxfo
+OTxc3ZHDQqQ7Y+Mw2leyN3R+nn1f2zBMP+F/WBEivtS+H+nadd/IFIOvj9VQekru
+3HsgHdmiUhlW+2brv4fy98cqT1cQWAUXXj5pW8oeiNdne2xG3pabvyecnjeB1XIe
+vokAkgMFEDzHIq0+j7fy+INB2QEBcVsD52j29s0zprKtUQc3w/46DAmFDKzcDMin
+N4levHlq3BrUGtmCD08CoJoG0RjC5nykWUOyMTYMF2V5UNm69vFZTqj2D0+p5gFu
+Mu1Yi58Pt936dQ2vw9x9yScnvSsGD4KrdBvAGD3OMCFuLDSXj42CrNKVEQJTD3yR
+nNK/h1tbiEYEEBECAAYFAj0DP0AACgkQlxayKTuqOuCeSwCggVvzIE9C73tVUvil
+R7R5usmUsBoAn2InryHTX7AsmLBzBjaI79xbPPdJiD8DBRA9GbzS29JF/LOyoSwR
+Ari5AJ9k8ZhNyiR6grJAwa4Iigq/oGVpkACfT3vl1YHpwt+yUMvOov/yhzKhZauI
+RgQTEQIABgUCPWeyzgAKCRAscOLGRDFznNZOAJ0bH1y2CWmpHxtcykhGSi89wQmM
+mwCgii8iieGXBawlNPJeAER2FJXymoKIRgQTEQIABgUCPaRE2QAKCRCL2C5vMLlL
+XAGuAJ9Y8YH+Gs1xngyJesAkLHnqyhyMWgCfRTMZ7apjOcrXs+0j53vcYeSIIruJ
+AJUDBRM9mvANs+G+7cUG87EBAYlvBACUWlrJjgP01FqtwFCaUleVttYBWmjYCXub
+Hj+ZU42BCfsRgiB6YdChS2wv8uA9GPn0o+OKIoTv3mPKphHHJKZn3+lhLBDsjghc
+B2nwv6Qxv0mMdS/1LjVYxCrXilMPTKWZYfbHHDIeOI/56lwceVFLeHsfFOkuZUsX
+RIVoo/KmbohGBBARAgAGBQI92CEIAAoJEF1BSuHgBcnLdowAoIkKRS3UN5p1Jds9
+69DxGb47DutDAJ4/+UpAcRAeU4FUlfOg553W8SZnSohGBBMRAgAGBQI92BdrAAoJ
+EGrVbP4ZMRsAhd0An3M4p6RM8Wg3FS5N0SXYdN6fEixLAJkBm1N9j7rVPFrPysB0
+Qb47cFYqpIhGBBMRAgAGBQI92BIUAAoJEMl8UJZcHDrXT4MAn2TD0Ep1qO/PKx6r
+7oWdOT0m0793AJ0fZsoJew+uvBEU7ZRia1vGXErQCYhGBBMRAgAGBQI92CCJAAoJ
+EPwPhYn4lL4S7PYAmweDkE1fdzHdraYzjkylmrvtKAImAJ4gH2LkSlXMXH8c6IBF
+YY58GyMAsYhGBBIRAgAGBQI92Ca5AAoJEDYVIteCq3vRIIoAoPzstX0RqEi9O6Kt
+/V3coeAYt+06AJoCRNIdj7Gf9jfQesdixpx27EVvH4hGBBMRAgAGBQI92CMfAAoJ
+EGY1tsDeiF3T5lkAnit9whQcSy6TVvtl7XUhHJGT4bMEAJwNAwvXBvNbycwJstzK
+P0LFL5SwqokCFQMFED3YI98kDmb8xZwycAECXdcP/A/As+JysKxhur5LcAsZ+QCa
+J272Kg9dBvsPr2d7IdvLyJzs7E4C8IXabvjaYAiZrA4cHBS0tEfK2+3WCUo5P5uh
+l3zKxhddzNul+2ilqu0yJu/+Ag078qRL2QVfHrrdRb7HWeHhMTjlIXMVHU0lUKmj
+dzySe40DNmOgQcRjfd+4vSWW3rUAiV5IbeRE5ZR37ZGDIyS0Zx443VukLwL/oO1C
+CA2eiNDhluJs1yeBjs8MzWMsX5P5KV53QCJjOT9IE+xUEoGskUD1DtJCJGbEXiql
+hpfw4wyNaxLBeh+mxSVLazg88JfcoNcHEQ11lJ7hKiZewJhl2oTxmPIxPcCshr4K
+SETyHsKw2FxQ3zJW/GONM7QLP7wf57wIJy3bKMPkWHgRUeQFjG9/CDdQRz0iwLwz
+OWaoLr7JS6oRepB8reukM4J5yb1+a92TW7YPe9r2xznSKWYlWrIZx01hTyRWkQIP
+aOIYBrf2gThaZXX/uluJNi97H/wDh+Qk+oY7DVK52i7KA5F4N/yRHIzeh9meLJpM
+8oo0y4mMTgSD6r+Sbk4YDYI8QYapkOnppeUW7PPD1JSjKPkEQOaZ/HGc6JZf4Xb8
+D5mtULc4MJ5x4kVsL6cmMyl6u+CFlGPpMSD1J33XH91muHgOPukP/pBzSLzznsz4
+2D6DD113mrGgdhYQIeIsiQCVAwUQPdgkUDGmPZbsFAuBAQGS9gP+OOi6LUmn10LC
+AWfoi6QXGBdS5bEMbXrKv925dH8SLa44LKcwG/U6WeZMZKznUPMkCglUCG+LoQoK
+WL+MGyHUbUwVDzWKzwsGdOR3T/dROMiUgw4GyciGGFnBfMoIB4L0mdWk7rzN8Io3
+aS4r6Fu3ADiHP8NCLwJvJngS+8in3MCIRgQQEQIABgUCPdgbLgAKCRCyvrxAFSkk
+rwfZAJ9DsO1nxRuw/yB9OCmoDwqjQXZkEwCeMczpSwyDe96Ocat18hg/nJUPsTSI
+RgQQEQIABgUCPdyN2QAKCRBVkeLAZmTAeM9wAKCh46jDqmzsLMkYaG7cJxk2blX/
+EgCgiEmEEAAa4dvte2GQddnyV6ZGZoGIRgQTEQIABgUCPd09+QAKCRA0SoRNdR1/
+JwoHAKDJK83QGRvh8bdVUhJZzsbJRNjglgCgmF9Xa1NIrqMDgp+it9BlETtYRf2I
+RgQTEQIABgUCPd1rNgAKCRBMxE0AEd+H6QwjAJ91JzeXNaCoxAYaLxFXVbjUB0GU
+7QCfc3Q69ITy1wYaU04JZaPjIrxgYIyJAJUDBRM93SELZLDNBRh71o0BAV6OA/9u
+YIcNjG3B41EwpdeiR2+xLjsbBAIek3d+Ojuf+oOmk3tdxRJ5Irt0x5twaJ8qLAMh
+f6oxu0C3rg6r9pAJM3aUEhu+KondpcnMgtrHew1qDxaegMqeogwb0gcBdJxYlwY6
+EuBU9PROHwhbNw/Ger3d9f1L/JgK85Kdsgu+6VC9O4kAlQMFEz3fjNLurUz9SaVj
+2QEBTC8D/RZ8sYP3QQvx9EZxfsM3gPlkXDGzfV3WuC/40pZn/p6BxXzeJommIkOl
+/7voAT+a4fHlWkkPe2gOJbPwJqYnNg/owAMhQFGbBCGPnWtRK6t9RwLRAleOJzkW
+GNH0oj/XniTl+Dl7xN6ZZQ0RHIzwJrzxPQI1S8tzeDx2w05l6mOsiEYEExECAAYF
+Aj3h7m0ACgkQMTY05LuSnlT/5gCgthoEVzwmErtYzsQ21Njy3hoDH1cAnjyCEFAX
+C216923CIpTeQowdhHfEiEYEExECAAYFAj3kAcQACgkQ7aJl2DRYeA7ayQCZAYHb
+SiLL9Zctr4y6UCqU3AhPbqcAoMJ5tDR63Cl1jbSxRcvhdsPaxVFKiEYEExECAAYF
+Aj4Vs6MACgkQWnWq/WQB8WGyLACfT83t7Y+df2bdiyVs9SKOipgMg88AoL4i1IEp
+1aMwRStOCSkGrqfGcbNbiEkEMBECAAkFAj4NNfoCHQAACgkQi9gubzC5S1xnSQCg
+nq30ULvQwLVltJ9Nq15HMhcV8a4An0QxsO2gBI+LlgZZg3knkpHHAU8ztDNMYXJz
+IGBTRlgnIEVpbGVicmVjaHQgPFNGWEBhcHBsMS5ocnoudW5pLXNpZWdlbi5kZT6J
+AJIDBTA8xyNNPo+38viDQdkBAd07A+dAkaK08KXYxLiO0AuO8uZLsD+n5dxSMtpw
+zwk+fRboA7qWAzmDp4+0w09lSrxP77M8M/NMKVRedFPKEM1xQftkdhSqhq+5ZguI
+8FdDmrjBsRV3lR8MTfBEuNE8d2SZB079qnZd8pOhIxdwA2AODmswzpwZ3oOEcbag
+KViC+4kAVQMFEDD5fY4JNGLsuYI5PQEBW0kB/0s9AqawHqJ/0rO9jsMhk3vuHNgw
+VF4DoKTL5EDIORETccAf4UZVJo+JzmjYxc1f2RkwkMkk/N9afKZmcNSYzteJAJQC
+BRAux7auD0cvWzTXTcEBATNVA/jU+bTUqnlZdrf6KgCv+hDOs6VO538cExQNsBl7
+x82Djbp8Q5t21YEV8LiFN1imuLYqHXqDEHt7qtroNaBYXgnR24QjI3urel+kYMib
+ZWxGrq382C2apReaEDmQ1qtEzP+kXexaawAzKMo8VKWMnXjQYBLZohuUqfciE9A7
+OQF1iQBVAgUQL9JDvxEZCRz6lM9/AQG2xwH+IQAJZEvldNHzeikez18Txy12EnJ9
+k+za2rjPVnlX7+teIY3VNO1homUgwqjoOHpZkdGgdOdmufOglT3Rqrk5FYkAlQIF
+EDD47t0d2bZ4cP3XsQEBdGsD/3F8CAWhAI+A/0oczJ2tzUPxDOGk54gB3VSB+Hel
+IdkcAwqGLeh8BD9dcXwcCOmw1pUIXVIA8xjl5jsSsb/17YuL4hzsDtSqo0bRzsg3
++ISP6LtqdG57VzGeclb9FmpMlu5GHeysU22HfwkynvBwfvMJI/IdaW99SSaF81rI
+JsF4iQCVAgUQLs1+vx4pcI8ahJlRAQHwXAP8CKLDWFLJ7Fc3JZ0MnuPxW79M9nRQ
+wL2TI/Vd4lCUSiDOUdEvjU45MLmLgU+4OZNPeXaBSLkN4z8PUkxGEEvSeCFE7u04
+VNq1GJ2aC+fHVFzuWbp0LsezqDSnm6xvBxz40yEaZnkXu3+66kXZV/E4BNIkCaB5
+V2qXxrBIg0D10iCJAFUCBRAw+UUZPjTM7Dn4WRsBAah7AgCIWR/HNt+V20bDueCO
+9mhwGirq5E7TJU+C9xT+3BeZXmyy/AR7tWJdKnC6laGDLnMko3CWr/XRKD+rC050
+nNsriQBVAwUQL9M7ykMGd0cf7QM7AQFbNAH/dXBIx96GTyGsnUmcT1IxdUhN6fdz
+Z2OgN5imUdb5HsBurEalWuDDuJcPMPAFO4Htq78LqRd8HhdWfQxtm2rhpokAlQIF
+EC/TPkdGsYn74N6qbQEBe7QD+we/Mvd4GqIwzAvDcH4jSoe5eXAYdDjQPltYNzu2
+CxOVu2f3zoOB96Tro56lOx9zbAoZg8bQSkCCImV6ZzYODbdxe+ubfBD6zJo40CeG
+uvvAh35l5nzUlqjzHY4CVuMpDJ1GrBoYBdWfH5TTZHx+YH1vRq/FHApYCqmucb5I
+QuXMiQCVAgUQLxgZ6khfqy8j2SvjAQGc7QP/VHgeVQzjcJSPF2KfNyKM4nFE17uJ
+5emnvE2f1K4mi0NV4IsNEVKmYXYQVvQoPKhfZtjXzE9P2xa0gxi/heKBIHB+5H5K
+n4nUIt0/7POYhltkFz7cbnEzqeKm9oqXUOSFKUup51bh2aDWsqAI5dgod3MdRxqd
+40TiuShaVXAbmuGJAJUCBRAv0bftSUmmLBOdkOEBAc1GBADKJ3N1BTYxqJ/Bf6Jn
+NDzwN63x9iEuht9RTen0Wq1tT8JOwlpcd8IB5uoDvcX1eZQ4wSfpVZm5i8/9TGYY
+OuOnhUW7oLQWGzl8BOs5jaygYXIVbnlTjc8FjyAPAWbUdi8OgopADoSoJeJ3YPDz
+vFFIPIIdFVChkzwytDCke2QqRokAVQIFEC/SFz55jBgMe7ddiQEBqSAB/2a5delC
+8N/4Je09dRG52wPU9y417g+ExtyBnhFd89cG0adtu8jddmtz22rxCiY9Zn1q2Wk/
+PV7dbJmAWiMF+GqJAJUCBRAw+ULYhWrdG2nWnOkBAQUwA/9AUqFQsXW9kMi5RooI
+TiQbRynunPh2aqadVnuLZoAhxp16c+EQYpc4Qi6jLPBVemHdS4PW8vJegF1pJtDZ
+4VfLNwwkIxj7Y0hU8A4BcHUIfFdOER7SwbW/i7QTU8u3vNHfmgIodv19D7rFxEzq
+qPxMHRpIs8/IOG9L3zc3kV8rnYkARQIFEC6+xa2V04tRZnGpVQEBTi0Bf1grk33L
+BHO89ViuQTEJbQoJzb7s9IYpjT9hcT5eIOa6t7vItN3aj27lcH68Us8vpokAVQIF
+EC/S7ZyZNU6jaP3/TQEB25sCAJyZCXeC915C4DbNKaoc2sIRd2aMgiW05ZzxYUI8
+mMO3pzZwF2a7Cg5iSdZYYMwpe9OWHqU+AhXHd+GWGhvHEUqJAFUCBRAw+M4sm9pR
+g/CEGxEBAYOpAgDY/Zq9tIHGEWeHg357k0pEr7Y7yqMdBLTPlJwAIIocVKubzQmQ
+xHqIWUmQUf6dqZLXErvnHZOWwRR7c5GjU7fNiQCVAgUQMPke2r6CRZdmbMmtAQGO
+zAP/U3CbvKhXqyPupOIppb1LcNAPcspe3B6IN1gXSWn3rUhaS7IG6vhpgE1E5Arz
+bMVCoo0p+yb4Ve743oBhDbMRQkRSRP1FCCayt9TWrTrtmij51yTlPbO4f7+SqYX2
+3bwa/iOPFVOK3oL3Y0SFyK6007jyQrfYFPaaBfbDu12zobiJAJUCBRAv0zhK5cuG
+DKtEoMkBAf+9BACMYzfvQzBwh+a1D17/SPSfO1DBDXx1cwD50zI0eIatz4kLvW7n
+OPHCY7tHVW/tlIBp/0+yUX/XXzBLp8WD0E/4s7lPgPjjAwlN+Iwy/fRDhJ/Gf0Nf
+03eJjMvU9MeaUI58JBCq8LjnVdtxcQKqapYcSogjz//jD+H3KuX/kX+5eYkBFQMF
+EDEsVbzwiYRjAFcYEQEBVCoH/2OA43qNfPmQH69ASpdeD9vXSit6fDi3J6l4eo7g
+X00YlpxSba0Hxh/cN6UL6YtkUbg2U00M4TuHjqtoOYMvTMrVNYbS0VaVcAZ5poy0
+Vs9Fhqq+MuGVC24N4WuTbHwaaXYBypOWPgabbyC/9+2QZM7ZIgV37NGW3N32UeG0
+lNcQzhPh0tAaHzsbm6n2awmbwIzAguTSeEddx/MZ2IOjSkAgKjn3gjlVpBp3PwSu
+1QKzF4wvKP/Z0A82Nn0TyDT5wm+H/+D7p8DqxM2usy8V34Da2kCdfW6D2/6PQwZb
+zTlpKvYEplZ0xJKqxDLYl3d9SgFPy1QkR/+9Jse12ZBefzeJAJUDBRM3qDRS/S2Q
+kqiQeyUBAfIXA/44omiNe1tswtoLSbqmatLQQDliRtXu0OzXGnXxkKRI+InHk+aU
+ziuuJr8l1oTFFKvbxKvEjzaMJNbOvN9LkMgEH7XKOcWfkbk+WWKj8d32pLuUNeh0
+WgXiUBH8crNeEhDD+yvH4rj+Ihy5ly8E4TxNBLFANFU2labWkMMLaOa7iIkAVQIF
+EC/SVx/9mEr5stbwpQEBz+sB/2uYnno7jRBUPzTf5tTXNKJITXH4VRG35x4CyjOq
+j21oWhEgZdNrwymzBK3IAuckqnIOQYSdN9F0BFVC1wTNgmeJAJIDBRA8xyMUPo+3
+8viDQdkBAQiAA+YlSJjf9yMCd2qZ8AYhGVF3PvN0KIaxSFVDVLoCbKSJXTv/0biX
+1MPVHIgVjQOSWe9uVfWgIzhogTBmQbymuGGZOzCejzoiVXaFwcM2Gi3+bau3+Zcg
+3qMp4E3oUSpMPjRu+JPXS78sF0SkRbkJocS5znUVnthUSC14Dprzf7QzTGFycyBg
+U0ZYJyBFaWxlYnJlY2h0IDxTRlhAYXBwbDIuaHJ6LnVuaS1zaWVnZW4uZGU+iQCS
+AwUwPMci2z6Pt/L4g0HZAQHWaAPjBALNx2Em/tfMwY2tsJAmcvTlZ9IPXRp1z3Ll
+03pL8cu6WZwhMN4ej/BO/noZYTCCk0M/3UyYupSrhuVR8R+N1ds3FBZbX29bP/B7
+9WuOEUmaesMhLli5mzNs54dTGAExbjqC1ZnescaiFcIEZy/Ns7kUA6rWbhDywfKG
+aZGJAJUCBRAw+UKqhWrdG2nWnOkBAeh7A/0aKD0eqRZ0orAnq05T4UrwyNoJdh1D
+BcNAmSeSSlZY+RhQ2aeY5dMoYAhQsHhbhO0VIDDpLxnhKBD2XsoqWnLK1SHDtumg
+kMnqy00HeiU4DrghHhL5IwcIqjq1TUhDzOU1j80HO0OyA7Sk7Ak/sTRrTuj4tvgK
+2WqHWU7aeLV5AokA7gMFEDDhUjOK3WTWEs11KQEBgTUGwQGH8Ic7zNaUlRmYm5J8
+R375iP8CrJ/xILbET69VsR2aDG2MA2z8NBBkV1ARrAC2YWa9sO91yCyf3NAI6I1o
+qtbv/09Im/s0bTu66dWrqRAiuTB3Ou+gHJ0fc85gTWcBd9/xS/mNlZb1/ZXjkBaY
+dl0Bzm72c3+HqZjHzT3nlxVY5HCi15J4iDgCuCPzeo1r8QgGmsbP7fD+0Hka7tlX
+b87WxPZt+nkjGS9xmLrNHw5/vJpcN4+fzevzhTQD8IcsUr0QcZUH9jZpm6xWpibP
+F5z7FzXTorguf+WJAFUCBRAw+M4Lm9pRg/CEGxEBAd1UAf94iAKTp+jf8y/G7sgR
+J0Msz+jOHXjK9nPoW8L9Uq1KnnWCiqxXmMj3AoA0iOict47sYm5uM76Woe+wRWwZ
+D7CkiQCVAgUQMPke/r6CRZdmbMmtAQEP1AP+Igi85SrIpEFaMeAkPvOiyTENAf9h
+WEm7n3OgIQ4kbBcU8uVPdx6Z4wJpUtrle+gOcthZn9t8jmcV328X0bDBuY/z/Hf1
+nc3bEp8mkPx4fmKe7kDC0iyR9eOZxmFJ8OC/ZekBoWKDPfAgG35duQ9HEknF+oPm
+gnXKzSo17RTqOPKJARUDBRAxLFWu8ImEYwBXGBEBActWB/9xboWXOY54i8n/fIHu
++FI6WmK+djTSIqfPMKlYs5qxoLg09rOGo0h7AFrTUpK5qYiJxiTNeTwx5pOrkRpB
+8nID4211ZKb/f+K8pag7gpqoltU+fFoOcHYoEf7aarQEnitLiLaNVm6ilu0wAdX6
+VBQdpUfzbphoU9r7jbkD8f45qqfYR2QvzR+kgmwAKy51g8MYIpLfNwyOylUrVxeo
+1EPMg5nwj9e3I0QmnDXJEZ+3iOufiWP2NTjLS/qwU63qOm68CbJE3+l5vCNgnDVh
+7r3swySfScRp8fnkS35d90E5g2bdJv8naDyPYlVWE3okq4VjIzWS8rXdGTLdKIs9
+TMP3iQCVAwUTN6g0Of0tkJKokHslAQHbHQP9Fq5S9UeaqdsUY0cEkKZzkQpud3CB
+FRL5uNy/TLEikV2yXGJlqKyiKo1CpGs8sIjprs/ASVN9DTNvc+86C4szLjNgFRq2
+m52ivF4OyxAgTLQCQ3KEi05SnM1SgC/OKX6rPR1Ss0w8C9UQP+jeKYL21UJjxUtE
+08npogtN5IgjNrSJAJIDBRA8xyFgPo+38viDQdkBAQ4wA+da39v4prHsJRFyCimD
+qqOaMBA31weXM9+VwXtiJK+xYdY2W1WHuk/LgSEiCG3XRI7SkdhLSA+8e9zX/8bX
+Z1GfFoN2iBxa8Zx+s4e15e3fwFPqnpOOGf1g5pOtPgrrT9NYgOF9w7GuSfVUk4Ks
+SVuP33rURLGnfY4xupUk5LQlTGFycyBFaWxlYnJlY2h0IDxsYXJzQGVpbGVicmVj
+aHQubmV0PokAkgMFEzzHJII+j7fy+INB2QEBI8ID51RHz7Ph6vGOZL++1VlLq8UH
+ynvnTuhlFwsGSrsdD1lZs/NGUIOrAt6XiDREmdl6EXXzynzVvgt1a2uuvWXd8LLC
+0iO0IvVgf9VhejQu2Hy7dkePWSWXr6WDk0Np3su214B9Wg2pOuNnZI4Da6ZQhSdi
+PiGYwHpsMBwQMXj8iEYEEBECAAYFAj0DP0AACgkQlxayKTuqOuDjkACfWbR5le9Z
+2r7pQYjgZoxnwdmHQcEAoIKxUG3XN+giUetPdAzKUcqI1Fk6iD8DBRA9Gbyf29JF
+/LOyoSwRAndOAJ4xoxylpNNYHf6uCYArmxQTxvwP8wCfXiwiBYiLgJreewbY4N58
+Z2qDy9eIRQQTEQIABgUCPWeyzgAKCRAscOLGRDFznK7lAJUeHMiB7cf3RR7FrvgS
+V5CnCu5qAJ430yl+G052F3d5eMpNx8yKYJob0YhGBBMRAgAGBQI9pETZAAoJEIvY
+Lm8wuUtcz6YAn0N+Tu+fDOpTCRlJ8XDM7utgansJAKCcaWk9WmhU60dp8MLfmrdT
+k7tTrIkAlQMFEz2a8A2z4b7txQbzsQEB2g0EANQfBdutEsim81MQeLu+7IslJJq1
+fY2oiPxBifuE8qHG8KjwTrrVSgHiPbCAr8YmAYtJLXRmVCO3p726sIEJk5+fhq+l
+pLgq4/aay9DwtV6N8Un8tkMU62mV4MVoBfkxchCAvYJFV0JFPBW1Y3YJs7TU3EjA
+2lR4pBwhK1s2VO+5iEYEEBECAAYFAj3YIQgACgkQXUFK4eAFycse7ACghPizmKwu
+kMGfHkycZ7BMbXZOd5gAoIUTQE9SNhpI61W9PuWttMKJGthhiEYEExECAAYFAj3Y
+F2sACgkQatVs/hkxGwC1BQCdEocdvgS3BSSM33sEVtMahZ5N0y4AnRjCy7YlOUaj
+rhSlDUUJKcH/9+nSiEYEExECAAYFAj3YEhQACgkQyXxQllwcOtetsgCg5JGjx3qz
+e3iguiCz1YeGWvhZUREAoN4wPchwgEIPZQTQccm39Ssr14vOiEYEExECAAYFAj3Y
+IIkACgkQ/A+FifiUvhLfCACeNrIoRYmww8AlGuzC2icyAIO4HqoAnR0WxMvgNJ8L
+p9vWaHcjSs6au/MiiEYEEhECAAYFAj3YJrkACgkQNhUi14Kre9Go1ACePRg49ZH2
+KmW+vaDHRrbwXdSNGwAAoLejkLTJq6rpFCOwMtiQ4O4+xiCriEYEExECAAYFAj3Y
+Ix8ACgkQZjW2wN6IXdPC4gCfYnFZ5ZDlATc/oDFQ7ZhaNKyWBVEAoJhPQc4xbV09
+eH+xDkKKutvPh6LiiQIVAwUQPdgj3SQOZvzFnDJwAQLlUg//Tog10d4EAAmXKRhV
+cF8osK1dEZ4i0O+0zd7W84uzngRVPSP9fVjIcKEAq44MZplPQ8dLijlBbMrb+7C6
+uUSphkk88DyGjPUbH5HBUmXIyLPK4A+I5WDTRspYh5zj82PQ8EEgnPeY5SDFoAOm
+vemG5Msr8BT1FwdrOPbZnaZyoLDPpg/XdTDFljOnrdQ0LR7qL7yG7UJrP1z2kCzv
+S4CJRdcxdaGiPOnl4Yqp7vWe1whcpjBVsmFA/rzrhK/zLHaGn/yHQhi9g3ExK0Jh
+kJIP8g26UpCLKSJ57/3ClK9l7vHVDX7g6r4+lKzmH9P8RuOlOjabp6KCwSsMEIpV
+FS/F76+V+i4IYCe+lgXqlLbrFodN6FogwhzfceBx4H+XPEf+/Bm/QD3ArbNNbBQN
+Dcf45feOJFopmIueWuGVVUiJ4lin1WfRCRZOA/LF9wYXBkEKV+Xje/mkY18r1YFE
+5I/ZtaviwIQs6kaD7DerTWpbVbxRv5RaVDIo3NozxkvBZZV+8EXm5k5TXfxy6nbv
+dsQm/UV8Ac8MYjVVTlLYI3jS8wMtZMKZV/XRuw82syYQL09a1hTQYyjbeuXEGYhN
+6frqSoHl+1rNFZ/Y74Oah4oPb50lH3kW3OUWvH7xORcCmz89wwNC5FFX6xxKpT9d
+MlyoPcuhd6+F67meaZjqwZ8KwdOJAJUDBRA92CROMaY9luwUC4EBAUqkA/4poVCt
+2CWOvGyCVg9CedyT+F552IzQuWM2BsuMdwgfmEbzz63G6ohDXzN9LxF1E9hqe8RC
+hVCR4EYkVV3SHwK6ZKKU2TTUcf9PR6mZKXSKmb2eEY1PrmgmfQLtONWXU28v5PZl
+WseLXKnJsPtRhDq3ybWRUETNrYkzggb8xpWeFYhGBBARAgAGBQI93I35AAoJEFWR
+4sBmZMB4+6IAnjFQD73eU0GAv1G9FcrxZkLLK5+uAJ9QRU9eaKbh9ppE9XB45Yp0
+l6uLLIhGBBMRAgAGBQI93T35AAoJEDRKhE11HX8nensAoJR8foKDOiBir79UIAQI
+aqKZj2q+AJ9byxSuWrEYIjLgNX1n/6gKkfz/3YhGBBMRAgAGBQI93Ws2AAoJEEzE
+TQAR34fpPQIAnRw1AOmI/Zu2jIF7gs9lYDT674zCAJ9Trf3hkd6fJ6Ht0TDB5Afu
+4h3r34hGBBMRAgAGBQI93SIKAAoJEFz9N/rMeMiTfIkAn0f2xve55OEI2swMZtY6
+khgTslz4AKCtFr6G5Ao1BdOFkbLfZ7e/EqieEIkAlQMFEz3dIQtksM0FGHvWjQEB
+y0IEAJyShUw6Ce3rhVoWxsu1Y8trO54vonyZ/Fvi1iVfWThK7HOtY3n7FbePg7V6
+riUV4oNWVakIgABi7uO/g9r3pcmBmifUMPKz0Qjo6+evA5d3ZalcVRFamSFlBRCr
+VRzVgL9JRkWvlb+nh1gZc4zaLpynsG23v6ou5rXa2c0/cyQwiQCVAwUTPd+M0u6t
+TP1JpWPZAQGwuQQAo1u0FeIUyYCczjgqvnmVGSWdy5eEV5nW9OxhsOJd7wjEVDEZ
+8iHprLLcvOfYdNxx5yLkh48bPFzuey56HEz0QVWK0Ezr32k9WygrpbsDLdApGiqG
+umQbvfLdmmk3F9Llyb58qLuVHyJGa1l4YYXCQOoLVMNekIhPVULh/XVxtn6IRgQT
+EQIABgUCPeHubQAKCRAxNjTku5KeVN52AJoCU3QuScdnWAKYXH+KFNni07/CswCf
+XZXXuOybaZLZgjCXrK3ATbZshe6IRgQTEQIABgUCPeQBxAAKCRDtomXYNFh4DuPA
+AKCcdiby1x35ME9t6YNfyTgTT50USQCfaKoyi7KNaTE63XH+14o92ikJ+PSIRgQT
+EQIABgUCPhWzowAKCRBadar9ZAHxYRwYAJwJ8wzH6IwMH7lo3gYRqduVfH/evACc
+CpFNrs6EaZEzGacXtVgnjnwXTPuISQQwEQIACQUCPg01+gIdAAAKCRCL2C5vMLlL
+XHbbAKCsKVO8v606BEYa2TwRlFqgXq21igCgnqU4zpGi7HKxMhEqhe/NaIL2dkq0
+JUxhcnMgRWlsZWJyZWNodCA8bGFyc0BlaWxlYnJlY2h0Lm9yZz6JAJIDBRM8xyTM
+Po+38viDQdkBAZUGA+dj7+znMU4Q8yWMiPRL6RSLKCWZf3IPHwPgRoiIAKy6FMOU
+vWC4TbduBqcApI7+Xuzy2V6HLSlf9XGILj/aFI1zw905705ON2fRKeueBrVZ0576
+izfTmNxSZit8MTt9rQWInnVhU6omrTCqzdVJTu2lTcAeeAa00kPm1fvBMIhGBBAR
+AgAGBQI9Az9AAAoJEJcWsik7qjrghSEAnAu8h2Wz42zg0w8qQBWCKK8U0RGKAJ4y
+PTXtnRyKse96SwajcZGeUQwdTYg/AwUQPRm8sNvSRfyzsqEsEQJZHQCfSsP5J6Aw
++fgdHGx1KiYf973EYYIAoNxaj5ZrXhKG/+9fEWEDNNkqND5MiEYEExECAAYFAj1n
+ss4ACgkQLHDixkQxc5xvcgCfb5ua8g8L87M9risSGJX8TrWTHc8An12HAxgXcMdd
+uIEag3T5FH7lU4cUiEYEExECAAYFAj2kRNkACgkQi9gubzC5S1zOwgCeJRqvA8Kt
+dTW5ytZe2Pk3Sj1JhFoAnR/XXJxDswWiIfsmyYamwlRfZ0joiQCVAwUTPZrwDbPh
+vu3FBvOxAQGQjgQAhBKgFpJtp2AoEXPh+5Qw3VA9ooXGUmdI6XvIWRGPL+cduO6Y
+Fz3JyvD60P/kBVCqq7GaTPCKFeaedpZbEOa2FdtuCi04sCgLX1DO97JhdeW/+7Oe
+bnIt2yGd7sZH3GDOy61VI2iTxrvVWzAFf+JLwCByvOprFLly860Gy7jjbvaIRgQQ
+EQIABgUCPdghCAAKCRBdQUrh4AXJy/NlAJ0fFmMipOTp6vslz2O9spLapldGxwCc
+CJ6lzCXC32O5QCSOEkr0ab7ZXeKIRgQTEQIABgUCPdgXawAKCRBq1Wz+GTEbAOLM
+AKCBYhZPY2It9Gs4OB9InCJo4FLtbwCeMKiPDrlf51uUKOLsWh9ClNrY5baIRgQT
+EQIABgUCPdgSFAAKCRDJfFCWXBw614gTAKCUmNiiyFPS49Ba7cs3HRvpQZW0ZACg
+wV7OY3Em3StOxlyrC6dsbjdVvgmIRgQTEQIABgUCPdggiQAKCRD8D4WJ+JS+Esrp
+AJ0SLYNh5KZE5+CICruBXMxkCuA4JQCfa6K1vj53RYafQNH0xKwFZEGh0JeIRgQS
+EQIABgUCPdgmuQAKCRA2FSLXgqt70SbiAKCmuozsDmD/08yLEvdd0V+s7X0yJQCe
+K0NausfA2RcjMUTVul9YzjcMF3aIRgQTEQIABgUCPdgjHwAKCRBmNbbA3ohd08DG
+AJ912o5jWryb486jhE6VtCET38+AlwCfe4eA6J0qr/NrZLQUPOcuCWfwPACJAhUD
+BRA92CPeJA5m/MWcMnABAk9iD/99S+k6PW8u+F/wF5ZmBQAtchOewRw/q+wOC66O
+BZbxIGn4C8R6I6vjHUP+e6zdjABWqfFAqwlYEkjm60MPBm77Of1Bd9NAEPpzg6zI
+6WOQdg7jCUMbZOrQ5HCSCvo5qEXaCN4qvVLPjL5MamTiQio0fdGZqUL+Xtz5Ypy5
+/K5aW6XKfLuFpIAvc56mSFHNKjFYi+94+avI417s6P+MPgijz5zbQkZqbrLaCGLX
+njZVxMX/Dz+mKk82U0oVsQL2ht6TXQWy2co+KAMlDCKZIOJVfCJBRjeo5/vfjMad
+GuDPnlKTJAZe5gtATr6jukvllg94UxwUyv8bFsV+khBKdd5gvGwoPgq2DTSOVbk5
+FeZRY7SSMHMPsqjl2ARHArNeYR3S3maTExwTkWKAHifNY9SUuscoyVnlNFPhqRDz
+oLbH/TnCNBxDzf8ZqdEjNpO0nhPm/ej4edGj495Pgt+6m63B2dtEkUYfpnf6oS9h
+ubCfTdVbuJBihySKtL2LDTCuWnySsj7QarNFXYWHQT/Lj4AeEXxGeec/z0m1N7De
+5wmdO8qjZsi4810xTj01FhmUm/Cf4ejnP+pnF1fU4biOHTML0lSaBvk9qjU+uhoN
+r28wXYKVq3vvQn1kXUWWubBI5k1TnpNPxIT2cZuVySxalmtIAHtI8519oOr8rJKG
+PhDgzokAlQMFED3YJE8xpj2W7BQLgQEBgtMD/0kxmNPp2SM3hzv6ELGLPrhluGA1
+f40+tvea157/xcGYDTr7370KUoKOAG9eGsjtp9aCCOUr/zBdrdMdkdEP4VsdPNUF
+MqvS+DU8DcqaD13Tjkzz7+TqTO8Q/iYvPjd9khXNlk8zPh+a4sdaoaYz3vAzovfj
+A9QlcWXgy0ISToYhiEYEEBECAAYFAj3cje4ACgkQVZHiwGZkwHiu1gCcDf/xdDgy
+zOh2gxa4vdxe267zd9YAoNurihcjNyCAF/iK41q2Kq2rJQUCiEYEExECAAYFAj3d
+PfkACgkQNEqETXUdfyfW8wCgpF9UPAyc7cl6fJkiHBvonLpW+JYAoKCH86A7kK0b
+nfeQLq74LgIk0xG+iEYEExECAAYFAj3dazYACgkQTMRNABHfh+kk3ACfZo/G108n
+HpPjrQxOLRVsGw9d1OcAn3ZxDF5jXOdx3/WmQgW55+qQcKfniEYEExECAAYFAj3d
+IgoACgkQXP03+sx4yJMoQQCfVxNJAYt9MBJhFmR6JPAC9l+1ckIAnjyfT5fwq/dZ
+2ZFX7DbaihqDu9mgiQCVAwUTPd0hC2SwzQUYe9aNAQElxwP/VDAgsM5UfwB5UX/s
+TR01+8Qo9C0rlEES/P6BXOIZGfBKQ5b48c6FnbSQaPV9ofWjim2Ypu5htAXj+0KK
+Ujsfpx2AUia1aBo/c8p5mGe/Ts8vkIGMLkzUC4LmtXPRPc+ytyJQuiT+NXE9ufY0
+Mn6i6mgku9brMAi9NIqZnNdPQH2JAJUDBRM934zS7q1M/UmlY9kBASVaA/9XCoos
+OyUY+I3ERk+oosbc49AS0K837NkqvZGabAGx/Mwf2kL1naqerdMCS1wpcccYkZvi
+W4copWlDb9AfRr1C99CuoPX5LGvc5gKrNVvsOUrGrBBfhu8vjzOwD0k+eAqvegLt
+MxfkCjM1Ap3pZu6e4sClFIuKEOmUSQcRdtYMN4hGBBMRAgAGBQI94e5tAAoJEDE2
+NOS7kp5USlMAn0XYhqQFMLM/tpswZqkIudQDFeZNAJ9SuhSeAjnPyM0Qb9xWik6/
+CLsn3YhGBBMRAgAGBQI95AHEAAoJEO2iZdg0WHgOP2cAnRcINt425OHmBhMm8uJF
+Q/PDOYYNAJ9Nw9juAd6Zqu1N1vx9HVgWluNSEIhGBBMRAgAGBQI+FbOjAAoJEFp1
+qv1kAfFh+KoAoKy03qRC6JP9ehyNTJm8TGQ5uBDUAKCUvfLtj/ofHRhqDE60RjWV
+MLLBPohJBDARAgAJBQI+DTX6Ah0AAAoJEIvYLm8wuUtc4IEAn2T1HffAKkajXTJp
+Hn+RctMlc3txAJ49LFjccadq2/QGIPU4aVmPOLGk1g==
+=yvlm
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+
+Type Bits/KeyID    Date       User ID
+pub  1024/28AA55C5 2000/03/02 Daniel Lopez Ridruejo <ridruejo@apache.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 2.6.2
+
+mQCNAzi+5mgAAAEEAKRyfbHaGoNuWwHVSa/5mRbWdhDTkR26z3Uwq4KdCZ2Wp+b0
+VF4Tfh6d4IoK2jXKBUlUfq+v7FYzSzYdPCmwB9L9cHlaU/ItfcWD2G7rIHyO/lGn
+VXK/BGUPoOhT2yeO8tf6oe81hmN5VzqqhG/SWEkwlJASRX3ApyanqCooqlXFAAUR
+tCtEYW5pZWwgTG9wZXogUmlkcnVlam8gPHJpZHJ1ZWpvQGFwYWNoZS5vcmc+iQCV
+AwUQOMAjHyanqCooqlXFAQF9swQAnVrUersSbO/SrT+nnwgRPL/xRMjGCQe93gUe
+JPcOOYU2be1tFGynJl842SIDPTHcJVg1hHReO93K4jvQKsbmT5zrzIlQ7hVB2u48
+WNcgsIKWIxcGaMp4+qsDOhN7Fh7vIEZdRRYhL7YcGKZ2WnXOZnGsKSD8VZenycwQ
+cAA4xkA=
+=3hIM
+-----END PGP PUBLIC KEY BLOCK-----  
+
+Type Bits KeyID      Created    Expires    Algorithm       Use
+sec+ 2048 0xC808A7BF 2000-03-09 ---------- RSA             Sign & Encrypt
+uid  rbb@apache.org
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: PGPfreeware 5.0i for non-commercial use
+
+mQENAzjHNiMAAAEIAK+iTnKRHymuUYmRRe6JlH3oN4GfpakM6CITpS0aM/piJBX8
+MNgcCUK2tz8MSCqAlfF+2r0hGRMSQ+UpXqLXcJaCkGIvXtlKmxCcCX6R+LDCnzoa
+QvOar3+rKFFJyiauyV7VPucZZhFKesReG6o53uoOAd0jyzcV9TdpAIn4Xl8W617T
+L98GdODY9jK0zfgGo2bSgPpo2YswlDCGbYzRX6bfEGmAbP4t4UnP1ikVCE3NTIyz
+gT4kywMb5AT1Tm3FbwTx7rXc/nL20t22VTJMjyCxqPrOTs91PxdXyTAQUKY82x+U
+ZgW39f6aKrJHDEJtxOyym+B5NpYgeP5QQsgIp78ABRG0DnJiYkBhcGFjaGUub3Jn
+iQEVAwUQOMc2I3j+UELICKe/AQE4yAgAkNXkalNn8Xi+v3BFCmHLlB7PKlItzlS2
+PnMcTJPgzO8w+PyXc5lzS3dnqLEBoCwRazEZh8ncVbeBJz1LjQU67gvCBqyFl+3n
+r+Z8k6cJYw1AzSK9FLAgOEtG8IdE+jsPq39xORpu6Dhsuln++G1xaK6fePeAEgR3
+qH7gog/SFCa9QXQd85wsGRlQlmMwe/HDyoRd/iHg3X7mr4yB+zYkxYKDD+TKlSqq
+V23n0H4n3oTI10PfaB8LDYVuPiQvIRn08XKUv0Att1KPH6iJTIJ/KRbZyGb2J+1r
+RO1nBGw+qaOAw4wUQXOpJyXVUeanIt1tSe8Gczlf/uxJZdCNSpgeqIkAPwMFEDjH
+OY/9b4jGIdCnGxECdl8AnAvSwMQ2v2ryh2NLL4FgfVLCjb40AJoDu0jaEqUinZnp
+oMBmjFgtsDYp+w==
+=5ByY
+-----END PGP PUBLIC KEY BLOCK-----
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 2.6.2
+
+mQCNAzjJAagAAAEEAKkko/H+E4+c7OXgiNfBCwlU/PrxPovDS3/JCKuILnflbNtC
+Lxbqvf7LccZ4LoiHOKd3+G4V8BgaTndqADx4crEsS0BpNrJdshPmXajzkdQeo6jN
+nts6QJ8/mlL4Q+s2/8dnleCrgDkzP4DpAIRGK9OARE/TKmUFUonO2YYGoUwFAAUR
+tA5yYmJAYXBhY2hlLm9yZw==
+=dGNO
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+Type Bits KeyID      Created    Expires    Algorithm       Use
+sec+ 1024 0x00ADEBF5 2000-01-25 ---------- RSA             Sign & Encrypt 
+uid  Marc Slemko <marcs@znep.com>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: PGPfreeware 5.0i for non-commercial use
+
+mQCNAziM6n8AAAEEAODTLW2h2homp9NCjlsNdQQQACaUgrEm0sO0Lr1BVSp35fFQ
+a6XtrIxQXwcvBqM0py1ea2zcmYqnv6vY+7i6sBnxiNNugH3ShBnOYeCaO6AzQNaN
+2OvLkB7+1AoDmbU4a/+APtLrhzYzUj4DmwSmr7wTwdO06PsdM1Qv/g4Arev1AAUR
+tBxNYXJjIFNsZW1rbyA8bWFyY3NAem5lcC5jb20+iQCVAwUQOIzqf1Qv/g4Arev1
+AQFTZgP/Q+/pcNsCncKr4x39f/N5zXine0zQaKY46ek+PCUrhDm5N8cFTyijE7V0
+huRDVENAFkwtznz/H7BN0vtMRlvUQJOPFa2UaN8zIbcMIzSbiNEx5nvfFeT/Gr52
+GtnrQ+BvczfaauJ0Zw4p5uq6na/+0iyEf17d4qrhIBftlO3Ti+M=
+=+laC
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+Type bits      keyID      Date       User ID
+RSA  1024      0x62C48B29 1996/01/22 *** DEFAULT SIGNING KEY ***
+                                     Ask Bjoern Hansen <ask@netcetera.dk>
+                                     Ask Bjoern Hansen <ask@plys.net>
+                                     Ask Bjoern Hansen <ask@perl.org>
+                                     Ask Bjoern Hansen <ask@apache.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: PGP 6.5.1
+
+mQCNAjEC6XcAAAEEALdrW5rH+2XOKX2zAPQmgomvHGADJedG4Dxf3Ci3HpGmKazV
+Uoo/f7Vf21ldvBBYC2CMpJU5uiMstNdrJ8Rx0KDBH2pLXsfE4XvVm8cGLbHcJycj
+cZsYl4yppOufL/76kmpP7q0Jni/pXrkYg2mLG3lCN3JoZqX9tvkoKP1ixIspAAUR
+tCRBc2sgQmpvZXJuIEhhbnNlbiA8YXNrQG5ldGNldGVyYS5kaz6JAJUDBRA1eczx
++Sgo/WLEiykBAZIjA/4+uCJi5WD0p3EFzOnmkZRxf8egjQlFdBDVR7sixVToZCze
+oZZ9EVianFbwv8XU0McA7FLSUala0FIxRtmOs8/yN96rhBqJnYfLxu3b/ZRpBf4Z
+UExXQbussUX7AsPUmFim9Xp8mTy7xDEpcfiBnGY9Dtx+nmSvyLO38W5VvKP1qYkA
+PwMFEDV7CdYJPTjw/8ByixECHSsAoKUySg0ht56Rjsct6ViXjWfVEF1xAKCldK5x
+LXMjefgsiuW3n5seRVogQokARgQQEQIABgUCNgEYdgAKCRBoqAGJariS5S72AJ9N
+JsXpts88tCq7uZiirWlL54vTUwCg4A2urEUCEPuSz5deMyMX4lpjN5GJAJUDBRA5
+Ix6ndTAZgHu8twkBAZDHA/0fiaJSxGAxIdgYQY1KqYJGWg/E7Gwn87kZyiRHKUaJ
+gP4IA4PVnh0rMtTTo+CWyzcqMPjRAZNDW4ECWymrqqNrYgqy/NrcN4h7LZC5wmnW
+hXF3HdgAgxIn7m2YQOLluNqIrhVKga5G9/xytZLsF15qZbvjyX4mqToOsRqAtUBI
+ALQgQXNrIEJqb2VybiBIYW5zZW4gPGFza0BwbHlzLm5ldD6JAJUDBRAz6gMS+Sgo
+/WLEiykBAd9fA/9YdBn26x/7DE0by/Zzelfxu8o4AgZOV0AuWqZJebXKjeFmkJ0B
+lZRaC+NUcvpXOcANP6berJknvAMjNfTD1wi89XUVlbisDSW3UMR7Op8EpYjqLTo5
+u+KmyS+ehhQjA3somcJc8fBdnGJZ17cKWEbzJK+oJBvnzpjtgtvw6/oH/okAlQMF
+EDV5zQX5KCj9YsSLKQEBbk0EAJ+CwSbR4QQ2pgyXV7U4P4+1xSXa8U6IuI7AX9Fm
+LNlDu7a8DnJt8trZxjBcEMZcfoSNmbjIzMotzl0vvtDpqYgKfJ5Dd3eUTRCDYYS7
+8DoYcuB0cunBoGijkHS/2IkucAZGgcnNjPdhm7EnDJ/4F5VR9ZByqXiAIhZ746bs
+Z+nrtCBBc2sgQmpvZXJuIEhhbnNlbiA8YXNrQHBlcmwub3JnPokAlQMFEDkjD+v5
+KCj9YsSLKQEBEK0EAJBYAopnB9/dun1G0t+TKWVwGQUi56sWd5bwLypHklf/fy2V
+QPjCz9QoI0L/jAguBrqCfwtlIHRHMwzvvNWLRtuA8oiTDl4w2gO2vjy7V3Y4qneA
+3U5CYRT/ekvK42d+aHA6yMeHSPlNEQg09Idmee5Lub7kV8ejjtRZ8s3jcZ0utCJB
+c2sgQmpvZXJuIEhhbnNlbiA8YXNrQGFwYWNoZS5vcmc+iQCVAwUQOSMQB/koKP1i
+xIspAQGtCwP9FFWCZN2540lomDAY6tXt7Q3AhP/CkAec5i/lsv21sUl09jlZQnr/
+Kc8hL1lPOuAlLFGqso3zL7KMVlrOIng+R/E5fcYpE60QhhIoHdvlxFKTJ5GZq7DG
+stCrR34q2A4OWtoC7tF0Uu+Ew2ontVgvqsrgq4qt0h3yh/kABp/8mRw=
+=GGxP
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+Type bits/keyID    Date       User ID
+pub  2048/10FDE075 2000/10/09 William A. Rowe, Jr. <wrowe@rowe-clan.net>
+          Key fingerprint =  33 16 9B 46 FC 12 D4 01  CA 6D DB D7 DE EA 4F D7
+                              wrowe@lnd.com
+                              wrowe@apache.org
+                              wrowe@covalent.net
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 5.0
+Comment: PGP Key Server 0.9.4+patch2
+
+mQENAznhOVsAAAEIAKuVs0grRRD6sNsgkr78WHvgpxf7ExaKI/bWEtS7eiFwJ+JE
+qP/ceM/zpot1wzUyNAVC+wiOJaj8CXyFrrmsjRM6zO5hRE/Hkf4me4ZviDP2lJTH
+suoTIcmSRdY6q3dIFQJVWPeDU2JhjAE313R/U6G/uJ9yVK86YPEC/b5Wr1XIDwDR
+GE9X58tZgMTDftYM/1wxeQNNF9kyFQky/45H/iXOirj52RI+gchkZfgRbfTSbF8r
+zSvs+JTHJBiSv4SpcPMq/ZTsxju6BIxb+PVaRVthIGcgRrgSgjPyTQYuPzcw0Zi3
+W3zfhlXCYngtumV9AM1uv5teiKlP9xOoeRD94HUABRG0KldpbGxpYW0gQS4gUm93
+ZSwgSnIuIDx3cm93ZUByb3dlLWNsYW4ubmV0PokAlQMFEDrRq1BTB0fmI+nqtQEB
+XhkEAKv4yJlR5l9hxDkK1L4/tW77LPAd+8dlJW+KaciyrfbBw9mphtzCrcSYsMbB
+4i6UEIezgp7MGftxSYAB78B/Cz2f0MOntgddqlsVHhNe4b+sgjrgXu/Dgu6S0b0M
+09oTvsc6RBjnUmfMlpXcWmK2a0MFpY+ppsYXPo8hM5Bulg6UiQBGBBARAgAGBQI7
+UhsoAAoJEFWR4sBmZMB4zVYAoNJR6RMw3ayHjelXGtInTeTDfAseAKD6npDv9S6B
+o84AO4er+DrQFY3X9IhGBBARAgAGBQI6yntXAAoJEJcWsik7qjrgOx0An28zO34Q
+FSSM2TkmqCWUdIplhp+XAJ9t2KpAJxanRh978KeU7C8SPHV7rYhGBBARAgAGBQI7
+pXfnAAoJELymmQeGwEBXsHYAnRwiIsFfDoqXdCdQyucm/5a3a/DJAKCtgvY6AXZX
+oBcAA895Q3fsjrMFr4kBFQMFEDnhOVv3E6h5EP3gdQEBjLMH+QF/daZ3aqh2/EtF
+uIOMNUQw+sF4mxgp7HQvhvwgfbOzT3uczqgtLlVd/a4rcPd6LxD4j7HdNXCJaOn3
+ANgaZkqUyNOMyS5Z3Fiyjq8o1t4lFcFo6Vk5Y24G78OnZ19Dvw/KayiYFcVVoEJX
+9WssFmq6VwKJyx68pg2tMfDKiCOG2tZ+LWZnsQd60ceBp3MyKKAHMQQu3B2mo0xm
+603JeobTxBydxrJ7b9LXYAcqcm7CdJ3ELutUQr7oQu/bcDhnphdlEjqZqWDQ6I06
+lxU9MSxdO1hpM0bShzmXZwKXClDP3w0+2DG/Udy2Qj/6F7RUNmUkBfiC5HQEb8se
+FF18pjaJAD8DBRA6ynRH/W+IxiHQpxsRAnNrAKCS2i4ohDFHz4x4r3zGkE8YhzYw
+QQCeJwSRE+py6XqEg+G3yc4uHGVWxwK0DXdyb3dlQGxuZC5jb22IRgQQEQIABgUC
+Osp7WgAKCRCXFrIpO6o64Bb7AJ9inF86z/jFF6YZApvfn6qr7sLnZgCZAfEGCtLX
+dNrH8cKmm3Tf2wge1CWIRgQQEQIABgUCO6V36AAKCRC8ppkHhsBAV1NrAJ0SlSBe
+ofgRiXMWo57hWKiB9Oo5kwCbBCSGL2v1Uw0fH1MbGm94/4h+g5qJARUDBRA54TxE
+9xOoeRD94HUBAeOuB/921e4vBxTPe6cFR5EnBJxfTerVSktVGVqn/00PVYjlZ21E
+IF2AG/8o0znIPXBxUcGC/rRi/rF+bnsnf4P1rPD8wMEpd6W1MOBQzVzQ33DY5a4D
+BaktKwK06vEZuJbTCTLH71TXVgr4SwrjTFLGUnMHB1xnM663LbL/fnLLpOY1Rs79
+dTUsuSbkCgYnA4dXwHlzThWGSpwc0dEwwbdNOzegs/vSV0e2fk6HJB2tnfOYsmyv
+PHTlLocaicq//I4Wl3Cx2ouruF241N/nNTXMU12em9G1cTu241tipdlXXzSlhQho
+qKyY72qRpYg1HeA18GmIjE2beKWE4Gv7IqlNU1loiQA/AwUQOsp0Yv1viMYh0Kcb
+EQLDlQCfYh70u5epjTvR4fSQcY9NpL2LzUUAnRZ4gidgRImYkhGsbqmmcvxwMFyo
+tBB3cm93ZUBhcGFjaGUub3JniQCVAwUQOtGriFMHR+Yj6eq1AQGzEwQAgKsP0KRO
+htk3QFUvb8P+RWUeiuVv4VzHcwfCFSsfdxWqK+OgxYqWidhJTtBTmcbnfFVljsq4
+HM4zaL4n1HR4ew4CDQ9CFWJYx2h0vL7ncJK+gvZgkHsDOdDtMLPtSOrq0/hylxq2
+fviZQQ+qxKYp4U5rPI3f+RL2k3KHQqGwCyOJAEYEEBECAAYFAjtSG1gACgkQVZHi
+wGZkwHgf5ACfVErPDVqxQ9vRdrkZRUc0cLUuqfIAn2dNPjPLSg+jdsz6DRsKmZBJ
+bNYGiEYEEBECAAYFAjrKe1kACgkQlxayKTuqOuD3LgCeK/rmg0vWNyP7BYDZEdUa
+hNdi+oMAnAhax0Y/HeJ7FiTK0J8wVrS1HhWviEYEEBECAAYFAjuld+gACgkQvKaZ
+B4bAQFfnRwCfXw1NgX1fJXT5aXKxIHrTms3+dgwAnjSlu4dds1jxMreB0iTFuz9z
+sVR6iQEVAwUQOeE8IfcTqHkQ/eB1AQEevAgAi9jAfi75hpYxTkniV6fo5x7Ftde2
+zkZZ4nMo24vMkiEQOcSGv8/IrAYFWOrUPRBwPTPH9AzcSIlrW9lAYEqKOns/1Qva
+6adU3EJ//QY11zzaT3AEp/rgudIIsIUeGisJgGObSz1lOtOf6AHdNdhfR6GV1SKL
+h5hrsU2Gi/xVvOULn9vhXGe42V+8OedCP9N9UgxAIgvjxiIFC/j8eZJB5dghlckt
+Ms/ZvosU6yF44yzcvk5tf25MSJGlnkITuOBn3f9RToWkXDjRjsTXZfhFjYN/2ZGn
+CSs1iJHuE7UWvqL4qcjI3kzaLcT4yVWuwvC14J5Lag4fKWwiaQQ7O8VGcYkAPwMF
+EDrKdFr9b4jGIdCnGxECoSoAniXuoavR+ikLMFjPzq4x0bpD3N1DAJwJK0b5uXnZ
+Jp644mvIFlzFmY4cYLQSd3Jvd2VAY292YWxlbnQubmV0iQCVAwUQOtMhGlMHR+Yj
+6eq1AQHtZgP/eRSF36yvWktiUoGnPgCr9mcC5k3IfsyNYZU09iMM6KyEA+YNNQS5
+PyW2rodOeSpI+kze9CcVovBVnN7mydrzi2tGDu5mS20gwD6L66aZb7UyRB1H2kmI
+olkmRIN/VR1PJ794qllgU0KdWnjdCxsn/rCwhRGu021INtgMBFdAgZaJAEYEEBEC
+AAYFAjtSG4AACgkQVZHiwGZkwHjIaACggQI9vwb+WHSy6pZ+9Bj0yW9g068An2ha
+jJliSh4II5EI0MUAo7yhiuzPiEYEEBECAAYFAjrKe1oACgkQlxayKTuqOuCtxgCf
+RlLBfmRwczoFl1pAD//oAbC7jToAn2EAejckcE/hIPHuRq5UpKlhumY3iEYEEBEC
+AAYFAjuld+gACgkQvKaZB4bAQFesPwCgpSH1pRHHk20vi0M8cjOAivZQckwAn3WW
+s2Q8i3BNxDwYPhYzqyBRyZIkiQEVAwUQOeE+rPcTqHkQ/eB1AQFpfgf/T23qlkH/
+/oxtKHZPeZyobAy4jury203tMp+2uvcUJ3WrAOZ4ci17nIB0WwQSNpHd0YMEx37j
+rpqrx1cgfUQW5bf9zPY2go9mCvqBEXkxeaG/uLBoifxdAlxT5jBI7CycI5rGmu3n
+q9ZfdtmxM9XzJzOJX8Y0b+nM4BMtG1B5P0fAHryS4wSEHZNbEX/twp8aE4bK9+9s
+WQxJESfcgAVQmYNNTI9ibexdCcWLlu0kCjmOs1CG/jAjxPMgkYQ3IXhVuwKE+agR
+QOv2LCUgC+tBdH7qif8zXKR4td/wEgwcxzCJCril5zmVZhhsRMPC2Hf3f9bAMGTU
+M568+aKglxGgRYkAPwMFEDrKdGf9b4jGIdCnGxECE1sAoOwHZW+fIvuZ9m74Liko
+Svnm3b8WAJ9sKeuYzFUrRi7+TMHG+5qjYCkaug==
+=e23Z
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub   4096R/B55D9977 2008-04-09 [expires: 2018-07-07]
+      Key fingerprint = B1B9 6F45 DFBD CCF9 7401  9235 193F 180A B55D 9977
+uid                  William A. Rowe, Jr. <wrowe@rowe-clan.net>
+uid                  William A. Rowe, Jr. <wrowe@apache.org>
+uid                  William A. Rowe, Jr. <wrowe@vmware.com>
+sub   4096R/CB9B9EC5 2008-04-09 [expired: 2009-07-03]
+sub   4096g/FF1392F5 2008-04-09 [expired: 2009-07-03]
+sub   4096R/C10FE28B 2008-04-09 [expired: 2009-07-03]
+sub   4096R/7F7214A7 2009-07-09 [expired: 2011-07-09]
+sub   4096R/7715D89C 2009-07-09 [expired: 2011-07-09]
+sub   4096g/FCDC8C20 2009-07-09 [expired: 2011-07-09]
+sub   4096R/60C5442D 2011-08-31 [expires: 2013-08-30]
+sub   4096R/17886D66 2011-08-31 [expires: 2013-08-30]
+sub   4096g/E25AC108 2011-08-31 [expires: 2013-08-30]
+sub   4096R/9088F565 2013-06-28 [expires: 2018-06-27]
+sub   4096R/DE8FC860 2013-06-28 [expires: 2018-06-27]
+sub   4096g/E1758474 2013-06-28 [expires: 2018-06-27]
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.9 (GNU/Linux)
+
+mQINBEf810gBEADSwwRqdmepv91pr6k18+X7Xmgr+TM7DXUSxjGEZ6zkJkK9VEBn
+WKIV37768nvZXFl6kxTvMfRNlwotlDHz2WA94fDOA5cTsH6AcRVx+5SNKbGBhDSz
+HJ58K43f1EpiVMZnrwcZPMZrB3tfJt6E3fzwTtmXJCrqPil5WmBA1LDX1C2dmqlN
+qdLMWTo/ZBFGz5SzP7L9cKmcedGIn4QWNQHsraDTwkFPTRmj+KkweElR02ZJpHIW
+qPhKaGnGYzdjFgrCzUt9V68LUIt8CY4zHnpmqbVqHPMTtmQ/iyZFrTqeVk+NAu/M
+lEG9scechJ3DHYw81zZSZ4l7HH9IVcAscY8l2oTHPQHAc4+MDzjtz6w+/aOIlQy4
+16LGWl1ykAe1K7cYRvkwCpaA4+pT1YddWWHASGcgxyjzv1INlJWAsaNIaP0XycaO
+InZSwl5v7q/dmDNc7LaISodASvgPkcY8mivZBtkmdNZkVjAtz4ZD8Zu5d+UNEcaR
+X1i6tBDnNC2PepZ1AVpsoQKlMLi0szc9k37Azg0vikihmkGF34NyYjHoDEh2Dv3h
+A83VxxcGcZ1cx+lCkt37Pfiz+OQoYGTyFVOWxzxW54HYCSYEd+czIumIlzrqVXLZ
+Z9gRsEL8vmiaCR6/RJ4fZnCJjZytSvZSdeBnVZwUdX8Jy2S4mLFvj5wKzwARAQAB
+tCpXaWxsaWFtIEEuIFJvd2UsIEpyLiA8d3Jvd2VAcm93ZS1jbGFuLm5ldD6JARwE
+EAECAAYFAkf84YsACgkQ9xOoeRD94HUvUwf/dZgDnw/2QH04f3y/QjNimz+HOj4G
+Im0WSWk/qrv+xy5wyeou5D8LOBymGsDkP89Jg8AyWrC43L3AYhunvIqnFrB30v2l
+Wo97v6ye5y/9JzODSHvtDDMttmtHymZZHIAAJWgwBYp88b1jL7H8Al1nLT1gbL13
+3UTNi9SfKXCZubD+DFNPanIVkvmU+igufEuxzWouS1F7C4LqfgKZXG710Z71pKQK
+6nIVabXXErEvSHW8clXU2WaeJeG5z9QbMXx65zQ/54XtuVilfJ3daDWPCbg/uF4y
+JMh8vcGtueXfN1RrZyJZ2jyBWW4HjUdkfG8mUyCIPAk4WVz3hy+ZXDYb7YhGBBAR
+AgAGBQJH/UZRAAoJEJA4TZo1x+lCOmQAn2pNvQmEH1H09C5kJ0T8avI42SpOAJ97
+JIqllYY3+Nk1siYgUxLDBbnjMohGBBARAgAGBQJH/cajAAoJEBg4H9dLG+aYpesA
+oLAAEhc4iJZWSX87F2c5oyGeffCNAKCNka1vAfc/0wpbvZLc66DmYbCyf4hGBBAR
+AgAGBQJH/dw5AAoJEHPdjBYBUwI1u/wAn3hhiKsgmnEMrbXtxgK3d7pxM7+fAJwN
++CB5kLynlnmdOZ4vWc+Gi6hM/YhGBBARAgAGBQJH/k+ZAAoJEP1viMYh0KcbPGsA
+njM51ugZdOXyGqttC28NlcOk+Cl1AKD6VkMlsVjGeaTAKWPVECMdu2A3WohGBBAR
+AgAGBQJH/1OAAAoJEDyaQgQMCIW06PoAoJ/3i4XmPjfmG0WzNepS2QNiO4jNAJ9a
+17edZ5coTQq54NG6XJ8+/l0ZlohGBBARAgAGBQJIAhtsAAoJEPXCYBZM7tdfrYEA
+oIEifF+e56erz+GWTgITWdJzKa/XAJ4yPbLnufvrPriGgvD3tK6Zwr6ZfYhGBBAR
+AgAGBQJIBT81AAoJEI6jsGhMdlfxg8IAoJGBeaZhyCMYmsZEx23KVvtC50BmAKDB
+V8pZ3ru0QWhn/o3Q6MY5ln1exYhGBBARAgAGBQJID05EAAoJEBhhwyLFYBSyECYA
+n0FWhEjTF3qUvdV+ZAOHbZOM2ZeqAKDJO9t5ehmazXq32sFXwXWnRKGcQYhGBBAR
+AgAGBQJIIhYHAAoJEA9FCiZiEL/AheEAoJGzINXsl4qKWLHxLw8KGgjPdKKNAJ9l
+UieGObbQG15y7Tbpf2Ze8zH5AIhGBBMRAgAGBQJH/6qVAAoJEEwEKBgxGj3l2/QA
+oIcqKyuWn1MC60v31tVtH+7J5sxFAJ4+ns7bDTln/x1j8Z7ztgP3qfNjHYhGBBMR
+AgAGBQJICfc8AAoJEN6A5lYZ+SkYbhUAn28xqwl2wzKdGibIe0Zg5G5IiVkkAKCt
+MwuhpeikPAHakSEBhWhQitHu+ohrBBMRAgArBQJH/StHJBpodHRwczovL3d3dy5j
+YWNlcnQub3JnL2Nwcy5waHAjcDUuMgAKCRB/WE+eTdnRxK7mAKDC2wOJgFNkW/4/
+GniKayVsRdfKwACffQrONiUpNQCr16wnLNZTkFEhJDGInAQQAQIABgUCR/5N9gAK
+CRAxpj2W7BQLgYhPA/9LAqibEUsg4ZVV9ntrH5NmOoIQuNOJTj4FVj9AEWj2hNyh
+XzGs+vCfTdwJZQ7R3EpqoQ6J2B3ivXcLvDQwtpw3cVsNwgHp/FMIQPq+PIYqc01T
+HGHqfQkd9NclsbFrM3920TE7Wp7PW2od3IjG81lInJOPmPVghZ2YZvkOOUzUo4hG
+BBARAgAGBQJIQgvkAAoJELK+vEAVKSSvzNwAnik5Qboq2TA0N9ujcf1qTdY/1ylH
+AJ474I3CsKrb+DnwOYQhySdWoOnp7YhGBBARAgAGBQJIWURXAAoJENUzTnWxMT3i
+ITUAnArmUDweW+BemwfyDl0pSg1eZ5nYAKC2lWPEHhMOWbHMeZrofXqP3O6+mIhG
+BBARAgAGBQJJGjROAAoJEFuWgBDgT5qJtf4AnjT05yrvzenyJl/afFsTtcoGC+8a
+AKCR9C284hNXrNMBGG+/TDC7cpm59IkCVAQTAQIAPgIbAwYLCQgHAwIEFQIIAwQW
+AgMBAh4BAheAAhkBBQkTQze1BQJM0s6dFBhodHRwOi8vcGdwLm1pdC5lZHUvAAoJ
+EBk/GAq1XZl3fDIP/R6JuS/WSlcX2zbcCw0j8aejHf60AgJXCkUxL6bqj2R1sfFh
+7T1Ov4iuqnPSkGXz4IAAh65uDoCzGPebwkzqP3BurNrUthjQgEp9SdKSyPCUQaWi
+n/0M+ct/nCmzVfc5H2jF1TRICgjJsBH8GZ5yD7JAlSdgRVzMAaL/dZJac5zho27T
+sLMKvbjbj09sNnUM9+d1dLlT/vq9gSQZWFfVrqe7ReXgHp3U4da04k6wiKIgbxkg
+UiPuUjUmmNZ0hUeOTAMnWqqSJZXMQZWvD4kuiS8roFtiasyGaN9AlUppFmj2CvJb
+Oque2M9q0Q1lfxphezpsTK/0ZudbdGHJQbd9fiQp2BALnH5RPAzzl/N4nK9tkbUP
+gQt6sx/wfaXUPnXqirb7Gr5WBesuCAKb8hqlWH3xt3LKhxYiaSDelMJJA69OkOG9
+aTSAZOfLijp9zia3dDhZkmuXOYYh+E7TXTPmf0nCxJy1GNRrb+/e3/X+IN6imN8a
+6VV/7BNnRL4aacdywmTxu/pbz9tpvcenyRs4gQuBVkG8/MtzD2+y4p+8U5iiKYzN
++HS1/zS5tQ7YErRtWzzF2u7WzVN8y7w6HMhgdO7HtQxff0pm3OXa4OQS7QzKh5YH
+8elPgKindPy6y3DyX/2DbOaRY4oxYsqpBWyJeEocFyR3TeXNDTzDeQMscHs6tCdX
+aWxsaWFtIEEuIFJvd2UsIEpyLiA8d3Jvd2VAYXBhY2hlLm9yZz6JARwEEAECAAYF
+Akf84YsACgkQ9xOoeRD94HVekAf/Q9xaanBwcGPPtaqHy9534g2rQhIyO4aSUXX6
+hSztKBu0sSTVofsHW0H9tOMcC0cHfoakIPBXYFmFbo2ofc4CJLoOVF110ac3XmTt
+bFMoO4ZBmd80tlLpgeE2R2e+XwOJcGwP+NHmBHJ+jQvJqyIdNv95cyzpaEWYO5i5
+81g/jqEqVhb9QLBaQBI9hE2hTpSTQlS8AlBUiBn4efQZj4RmZ++lRxSIY0GncjRk
+thmentxIWZ+u3oR7Mzz9D0d82rBIy6mnws469t5yKdcDtsLsd75sqGUnJ7/27Q4N
+DsqqMXO6ZtPtDvnEk5R0LRqRm3PPVKKRsFSmw80CbpyC6wCVv4hGBBARAgAGBQJH
+/UZRAAoJEJA4TZo1x+lCRpYAn2OH8WaHucmGOuXuocAzerQq+gYPAKDboz+zevbn
+QaGf2mRewuqPajGVD4hGBBARAgAGBQJH/canAAoJEBg4H9dLG+aY6C0AoMhRRXj8
+9ESEt+NIFYcez54oKGwrAJ9dPV4tZlhXANlbjYDk8gWX1eBp7IhGBBARAgAGBQJH
+/dxCAAoJEHPdjBYBUwI1eMUAn0+N5yTMT3C52umNxAhV8yWrqDCoAJ40+S+Wlr4J
+XgucB98S0pGR2DFkXYhGBBARAgAGBQJH/k+ZAAoJEP1viMYh0KcbrS0AoPTWYltK
+wRLFc4eMVnqt8jva518SAJ9Kaah/amDGEK1Bfy05fjeXZYcWQ4hGBBARAgAGBQJH
+/1OAAAoJEDyaQgQMCIW00YQAnRdVVcsHKnYlddfNrNdqbDwQtJX4AJ4ngGYjjSQu
+X4xqr79EgpqEAzWDSYhGBBARAgAGBQJIAhtsAAoJEPXCYBZM7tdfJFQAnRTKR6bC
+gaTMEIeH5bMIUYdkzfzeAJ41/R0maanZeFx88D4hjZ/2wuXcKIhGBBARAgAGBQJI
+BT81AAoJEI6jsGhMdlfxc70An0T+27SsGmdOxgDAo7ulDfnwqZlqAJ428eaU3mCx
+Vse174q8RBPsY793mIhGBBARAgAGBQJID05MAAoJEBhhwyLFYBSyKFQAn1v7gFZY
+VyktjaoVINe3oiCq6NrnAJ4kQQzmqvKj0Yg/+1NGoyoqV1Xx8IhGBBARAgAGBQJI
+IhYHAAoJEA9FCiZiEL/AIxkAoKnH4okkKrPXnX33l/WnCfVYoch7AJ42bTa+0arq
+9YsCG5X3BeReXftHK4hGBBMRAgAGBQJH/6qVAAoJEEwEKBgxGj3leagAnj+0nNT7
+ynpN6DIuxfIJmXhjmB3xAKCxoFsmpw5yzuvwIo/foM5Da6+yEYhGBBMRAgAGBQJI
+Cfc+AAoJEN6A5lYZ+SkYbFcAn1ONz6o2scpC+URV4TBbUXmw9iIAAJ9vz9bm0Akm
+JWfg/AMFfFb6jyHnBYhrBBMRAgArBQJH/StKJBpodHRwczovL3d3dy5jYWNlcnQu
+b3JnL2Nwcy5waHAjcDUuMgAKCRB/WE+eTdnRxKn/AKDX8Pd//IP1xFq8gf0QpJ0w
+y3VcvACfZ4g0hx0gQOwhNB1/9Gkc175ahI6InAQQAQIABgUCR/5N9gAKCRAxpj2W
+7BQLgf47A/4sPG9KJkB7xJOYDqpFK/n29JOSGJGQGAHs+2PAxwQbXZZ1ON7ogzAk
+Op7ka+ORzYOTHiDj4MyYdZzmqUER3biC6aIISN7VcMAj908y3bteIPE2dhikKgfw
+P2XU5WWskpZwaQM3bffF9RZbFYCy67BGQ88/kRO4W1+0EOMv7+Idn4hFBBARAgAG
+BQJIQgvkAAoJELK+vEAVKSSvi3UAmPZ2cfNJjXhGHshKIJUwR3/hWNYAnR+R+a9I
+2v8dhBOQSr3d7MfZSICBiEYEEBECAAYFAkhZRFsACgkQ1TNOdbExPeJ+ZQCgrle8
+p4Gh2/9F9bfQ3Y0h7QsqPeIAniUqC11Q2Ttd5KdFI8s/SmGEp2b1iEYEEBECAAYF
+AkkaNFQACgkQW5aAEOBPmonfsQCdGBYTaE7e/94gJZANZhUDGWK5jFsAnROzFVjG
+u7Ld7VDyWaWrSjTIvdaPiQJRBBMBAgA7AhsDBgsJCAcDAgQVAggDBBYCAwECHgEC
+F4AFCRNDN7UFAkzSzqEUGGh0dHA6Ly9wZ3AubWl0LmVkdS8ACgkQGT8YCrVdmXcG
+3Q//dKZmBj5+Gyn3Nm3H3mt3Q/ZUr3x7rPA0ERRHunGyx0tUyaFWyPyQngTDfAA5
+oXdHFmKUmooKTTLS1kCp2GapQGro/0tG52agg7fPmYLjCaTHmGp9nRDA5OVqfOH+
+stJQjDcnABWx1Qpa0kjLer5Ul9lyHtF7fu+heiZmnnXvbpPi05/s7zGmOtgmsiKi
+TV+csYLorOaLnKfh582cjE0JNtYvj30v57WM83Ia90cDeW6lT7/z+9FA7XZj3HWV
+fFGV1BB0AYs91/dxZQpb+gE+2S1RcoXnkab5LeFHDyR4LXLHXK++Cc9JlCMMnDtM
+IJV40OnCZe+KbM5rVuTwAOhMt5dziT5/u+GXibKu5KCG7Qiu1QKj4n8pZpNEEJ8T
+bzy9qPVNY4/HrU//tqihiMCKfZv1B96GuOX1KS7GRiaIQJphyeqg0wYX4TbpDs+F
+cynajWCjw/cJRvr+UgFjS8t7s7wLHiZfrJEmF1qSZi+R2igVHRPydcrsLCmMWYvk
+UTflCNMvEWF9Uk4VOb1KYG4fkHsSF8cC7/2zCbF+m/ZEKcHxnN+KxFMAUqg3qUh7
+ina5lyeeOl4pIi6xSZ/7U1WdRjQoh/vQRAhtwO/6S9jULaV0tIth/OuE0C7Vrtdi
+EzFq5RHT/Nw0ziEG9UfRj5mvRQZpaV9Gwo88WvvnxS+tYYi0J1dpbGxpYW0gQS4g
+Um93ZSwgSnIuIDx3cm93ZUB2bXdhcmUuY29tPokCPAQTAQIAJgUCTNLPXgIbAwUJ
+E0M3tQYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEBk/GAq1XZl31qkQALtXQmmX
+N5gww4xJpTOjjs6Fq+jqqArWO/nrAkdg4f0syovOb6h59o9hzQH1kWHTlzXCF3up
+eY1kw/RJ3q+8TPfVzfGNagxM2pxVMVsyDk+TC5n5z7+B9cphx/VzuWvZjUfS73Zg
++RFgNsLhE5ykmYDsxnBc9/YxL4UWWKXO2vq/i65uzyFLrWeyJlVyocbGZkxWt3/a
+5m/J2J/V9tkrK+h9mFKdijCixanVvefjhAXPBXVFDonJE2zdx+3Mt1szjwQOBEFo
+ZywvWUQ1pn90qPjj/LR0fHbEpiP1i2mkrlwRAkiKF/OhdS1tMb3gH/Ile/Qs2Zs/
+l01+h4joQzYGHGzzoBSAphKaWAASWDzWFxvnxvizAn+M+eBFIBdMFPqKC5iFnpwm
+471wmI2BVcVZ4bfjZTEgE5Kt9kPEMZ0JpsmgXt4cnbQZwadZ7YSsaJjpZdozNCp9
+MmxawnNvyKi/DVOVUZY+S6eyQSiPq3p4IIsbT+87C3n6HfRICcPl8NUxRYMjY7Wq
+WTQrFZeDTqlu+YtoPVMAcPAmH5rS1VHJMIXELjFc6wCEvJF7xRiAAQhIXwuQETwM
+qqG29kViHqv3/A6XGK0tmmoMCcNSASYT1tbqmcb3+mrUzQmyUXTb2xJ1zTxLxZS9
+elE4eb1hxPLbQo4qd3E8fMDQi39pYkl+up50uQINBEf83woBEADgCTSoU3Euh4hD
+c3+yB62683MtDiG4DGCQaL9QmK4HyLV1u0bLO7S5eWIsWpdRGWnKSIObAocmsYQt
+Fd13imrdZBGuHcvRAyBrG4/SzsRImo2iQUE6yi9q+BI4Nif5kJDm8rT5RCyTER4l
+gTx/ZAsa1LvAwPN6a1PXQeNICeJqNWBzbZWbGx2br4gqjtpG0vHq1zoM9LrhZCEW
+sFXICBT7sN71W6e6brJ//VLPeMX3nCvotP6V192sxiaT3AMhkfhtY7oxv0rNmaVV
+9rL4Fd9drxmTfykQ90IGHRxBrWc4GzU5dshoAT1MSiZbMTOAVwnZcvpq6PFXg6kb
+ZA+cpb8J+jyBXFNfdPEkrX36JJZGkdyJrqqqg9xwY7SFq4ipFZ81a+a9KCXlmV6y
+6bmUm7cMrhOKEjE8/3AfqgIlafs0lhIwI1SQmU1dCGDL9dpWeQ79nZWEu18GjtPe
+UNtCL8ACgEPhrxUAJM6Or/bGFrJy+/ZvUV84TB6PYFO6id/SVN+/yvPAEdTbwI3Z
+tdtwNJx9MLSVwOOuc40KRlXB6dTpjDUJ1mvQuwQXST6bYStIRY8uF0wzf8raO4Lu
+/6EUCBW05fYC8HAkZGBsivm/YCymjB57mpz53ovuLcwAp3pNmnRWDpKiGVwJdN0B
+uNCxuUUgioEoF4p56IS5YQQSVP0VWwARAQABiQREBBgBAgAPBQJH/N8KAhsCBQkC
+UUMAAikJEBk/GAq1XZl3wV0gBBkBAgAGBQJH/N8KAAoJEIFUZ7bLm57F2doP/2w/
+H6COAjjzcLUosembG9DnC9e5I30OQxZKGUQ4mNJD5nQT0euuNoH284KXeoBTaFRz
+kdXU68BK4SDEXotH4vwXStzK8gMp/dmpr3lGwS0BHHElDxFNwk4b5y7lYCJt93N1
+IQbAEtZCqv/Dfn8y+7hOmMociDxgZgai1cYym9YCVkOPOl2ikBK7V3XRPXKKcYx9
+IslI6TH2HnTRN1xzjggq04IwT0o7u1wMB72xU8kaUgrUHYio0Smh0memClUhwCEQ
+d1ic9nrg3TOvlAw4V18NHglQemwVtpRgAGOZNwXaLIEUBfvTKhva3ZVA3yeoaYuP
+CVFE9X91z+sGdRydFJde4m1b8W4gf2Mv2RnrW5EgfdisLgXRw3C2xo8qrh3R8Gx0
+pLv2VJJT8n/o0Ij+w4BsXYWTD0jAuC6bEfHNraqqihsWf0C7N1T2QVCcwbzxANUO
+oYegFfCrz5RqjemsmDTZkCJXxRR6RcvW2wHtXI/K4HULUBTvPl4FWFEtmO5LxcRR
+BfeeXHrrOFmQ+zFwb8O6MoQIvmOSylB1BDi5nZ1v8ojvhHkqufMpqtK8RN7DO4MW
+BSavjOApAgX9HpChQeFEbvpWy8zKsljfhnvhgBL88kMQ3Oq/1KQlthmVVqYmPvd5
+oIcYWo+oAcnY/RAGVYLmLAo7a6Z+ms17VeSP35aDH3YP/0sX0ipnzstwA19ULQAK
+UhjMKGGv0dt0gkT1/ZXO5GZVWx63VcJbWWMzRsTzGYLZzl1//RCMSRdDbqzWBKYT
+4w1dU9chORG4Bgnj28cPS2CNHrLzgkPtcJWcpyXo6cuaRKXrZ8W2Jyz9jKltTPSX
+bxOnGvQ1YkRhhzSDyhU/KBguo1IiAXgTBMgO/LL0R12PMETIepBMrPz5YZhIZpKm
+rqTayjpLu2n7xBHu12XOnwm/kRqmBHFxyAFQ3VxWeXVzhVvk4JKWajyzRZQrRSv7
+8rULuAw22llzi/EGY6oTzEQvEJipA9OtcJx0+NKcLfBgYO0dh4bPvA1iW1BFfE9x
+t1eCjDl1WHPAZXLWTJO/OpkDzsgcWlggC0gpgE64lsriKpUtCTbnGei3VdlBNNar
+A/JsudJUehMEh7t1W5bJPrCaoeyZOMqlDxcshUFfa0CFiytOn1ILcc6okhytwo+v
+NjndBupTdfE0IVwBxNE/SqBbn3cwQ2B6z8sZnrHKIe+dOI5yK7CndAr1GkAdhSvC
+TS/ctOnWpsX/rWEk5bIsmeXVYjJTVVbaPer8VC2Bvxdhdob5LpMfMhRsJnoC7Fjd
+7X/CHQlkQVwiMixanJqTzA/DCr0M5ahZHAKBw7rdhTOdK5UyM6yzszxFvpwT6btY
+yRM8MRdtqZPgn/7CUVl+sViiuQQNBEf8328QEADucL8UtxhlP8R0C9vmyextchzk
+AjvhoYZP5XGk15gx5yM7W525vTI+G2v7jWgfv4G2WsACQ4CJTEAy5bYzQ8jjGUdh
+phhug5G2CQgaY0F+sQWeoBNeZZ7ngRepppL4QcfsJmk7sQNu5u0F/ryK3kRleyv1
+WspmQ78Id+/fh6VNSR22ILNi+AuhK412bUc0tJRhC/JOIMr5Gt1HGUnlu15cgAKf
+L03MHnfpiB5qCdUkdvdGjT3UkHfBVrpIlTWBhZUsJmbpBTOwpseXyLjr8/dXXc8h
+o5XnzeSYZF0rZNSMc5PkpCiBdVNiyYSfIFzSCedwCC/8MYWCfxTvfjEiTP9/m+pA
+6Q1POAGYvFqTSNLiDie8qhOHHVUlJ0J8WyUmi8k6yOktGQj/EbHvMRduMUTwqUzv
+RzdsURvZ0KY6207dsTRhJEplS2n6WFAnYdovWBtoNSKhsqLg1GpXufJdZTWCsDIz
+3y09IcNLdMa6ybJqV6pK8dGMATBlIbXuPjlwlcfOLeJlx7mxH4R6SwTaPV8koOX2
+3aX2SNDnvrTMLR/u8s4aFGn/hqJ4Gs0J3SBhRLWyPNNXPXYXd8VZosnfoQ/ZAYkK
+KYQMLxisP7I9SRavSKJ2Db3n3rKQbaFNULxrmqgZiiSO9NEYKAaQfU+wwcPURmhc
+9UItS5ZFGmqzUnJ1EwADBhAAvrDHdNE7TtA171w737weox1PJmHdCeOIWUttom29
+cBkSa6J8EfAebYOxcn2sjOfWDdrJb6n6z2SHRHG15rTJ/eDFH8f3ol2L7VNzq52o
+HPnkUwnrJJv6TD/f7B+48qhrgF5c6ujOUC4QwpdeZ5jz3qzXl9onXt8SedT9yVt5
+KAquEDVaeBZdUiE728zBD951JvUzrRmJ1hYODBxbhxmLPihoZyNYaAPWkoSXnLFM
+Yc1PIrRygvwDJfviEtd021nYt0NDjves9v8KdFT2SX5NtsIg5GnpraURtCr1PMbZ
+mTKiBHTO3tnin1Okg65ZzoUsVA0hOCIYXNxDS3MPAkJOWTqBphT7bbAC0vdSuMr5
+lMZmuNjR/MmG2xvVHxQZvlUJi/F4ZltV1oo5ugz+XzEGgO5L/lX3LpKIcS76dUXZ
+aQ9nSoc5jtKZOYBQD71CGXYvtb0dpKPYuAMuwODaf0dz3DUD7e0AJDgOD4neXcpR
+Ml4s2QZzFhTyu04pEROLGomBcfT7PkaRPyPeumrEuNHuC52Sv7zO4ZOiwaOLzsUF
+yzf/y4sho1NvwunOJ3QSrXdAnOo2VxE+amQwkfetfknL2P/PFdshtSiq+L6RcDW3
+b09R4H4yO2yUJ5cQRrU8aicGFjf/QzFdFUz6jhm0Nynvw5uIRp5VDNmaZWul1o/p
+nimJAiUEGAECAA8FAkf8328CGwwFCQJRQwAACgkQGT8YCrVdmXe4fA/9HKVc+cjk
+OQdhkWFqkRv0gQl4fC9yQnakRJgJ8G3hG6j1ai0FZYiRRFJYSJf3MNMIbilLWDTm
+UEp/EVz/c6lkuT4Et1ZktVwnZF/QObOfWVvxStvM/RvL9cu4KmLeVqCW4p0LzCYM
+EbMj5VeeBiLtxrmGHbhiqRPhprczn17or15S1lBewzDMKbKC0if7TeO8FMTHwHGF
+P/bCdn6ZWcAFnNlHYF8Ywbwxr7UybztGx/QKb7XOZh8b/y5+lq8m1EWZJ8SW35R/
+uuWU2XS3vtYVo/Oe48NFf5qSmddqZCQhMO+ajGC6gBa/MvA0dIO7E5YIa+M50Ttp
+Qt+GzlUlc4RThTIYEjB/+LmG7PltSg9WmkMsaOdWOJtToKVGsM9ENDML62qAJI1U
+dc+69tn0/VGxcT8gIJFnnQ9CmN2lhgurOztnmKBf6Ms0MWnFJKp+lFN054RyNnBJ
+1qO/+w081u8/zKv6+Ypp8AixBjlABori2yVv9gpD0xa5yYEu3hZuuZ5TKcZZXraW
+BVPWmsh9w0ECIV4ZAZ+08M7sUstU3jSIYl/28QYe5bxEP/XqTiLyygw9AXGOSFAZ
+s2nK47+dOOJ6MEcfFHvPt1JoYx9dKSAhk9nYjSO6foHPBggM5M0ZgFaik2r4iQqM
+MNw8ogqFfMwOBLbzvyviBi2v2M9VWNzE2M65Ag0ER/zicQEQAL/crQrnyzcQtKya
+51YvMr+hCl0LU6wcIKvvbdI71ydqaQY0TvO/AAOWWcz5AI8W/bgqV898Wk1g26Nd
+NQKxzEzikeSvx9qsZhNeqqx0B44chCI9TTGuLs0i4YoohQuFXBtz3tC1CdytFtJ4
+UODseqH+s1vALjrxJGgLdEPU7CEmDGQTYheK11+Mz1h91OS835d/qct00Cqzxn6M
+m+ehXqsy7lGsSL/mWKQLf9yDg1DduAXqlmsmjiM8kaRkpfx4ghh7E4O2LPT3kdme
+4CQTt+BQGdkV3JEkWc92WWufGSEqtVUcHN2pvVXcWM90cbpAbKh7pPn4Nx7hV9th
+NZfjNBSIFXYTdmFmu0i+w9dHxtSelRwnzNM/CLL13x8s4rXAiG/v8eAr7FCVFRHZ
+52absma6zTqBMoxn80jCoC7Bk5EEvn8dV0tEkrgvjRHZ/mc7A6OpZX3dj6B9lf0j
+WXlkRiYTor6SHW5IsdQuv5KwoE3kkUfCD8w2QAhGcXT1sylBpoLNXgMFX46OS+g1
++CE0G3l8vxfrFSE0l1GqzpRl5ZiZ5ECKdk0wkRe6HPXNE4WnBNupC5fiSuZ3H4Ki
+j8RK6HpbVhZa1Rpb0yf0fpkoPhBNw1kXjOBziQ2LspHDAhY22VJWxbINnqBvsf5j
+dAVw9uHuswFBwGmV5nhNHurZLwujABEBAAGJAiUEGAECAA8FAkf84nECGwwFCQJR
+QwAACgkQGT8YCrVdmXcOXg/+IoNiOxeMxeQYe/XBcJAcBBZPDLVQhJQ5KqgWYnbF
+w6lrK1nKzbuCGQNGp3RubWwsax2yQxTcN0vzhe/WvShEnXwfTxF+9XrTxYqx9ZJo
+2Phs+f08Xe70RDP9Kc+BNzIHI9uXA53VeGWOAenkxFBu2Qd4vKJzmRR66TbNDiHs
+Yh9k5+FAW+0wUf8YSca5RYEuXksf3XMA66edUcWpPvd6eWf6YDnK1pq+Kd9oB506
+1iDzUmkjV+0Lr8z46d8mo9BDfx7gX7hwF3T5/eodB/gKuBrPup8151j1fGI7QKUI
+swIfq/82qC6iP/jKEPFa0g+V4naSWp1TrBh8wyJU3Bi0tHbUfSj1zrMnPq4lJDtp
+mfQb5lmJbuE4VKBRPTtkETF4DjYsQOE8iQiwo8uyMP0H1xX9PKPQOD/YakQ2Wlkq
+cggfo2QO7bCKIeF5UmwB5x5ZPEZ7XnHJ7T7iavS8f4qAEn/Xnx+pzMzWteaHahkY
+B7M1XcU8QmrUC4fpbVwVOet7zfFKdH277LzKmDEbxpuFkj0fHHF2GmVZacEiCyOB
+vOZlrUiDY/IFlYr+3wc3mJWHKkfYVTB3x8Tks3aaq758t6lOic32ZiDWWWBcHQCl
+bgWAMFKEh21yRQ7DkmPwv/p2SRJvRaDQUKOoESzJKPkDaPN6GvqZhJZLXJo+VENO
+ENy5Ag0ESlU/sgEQAKynd0bz8BthKrW/ksESoqLhcOKuDVyR54Znirswjo3rhYp8
+5eQWd12H4c+ffdaxtTLL+TXRKGylDQTapfMUx5W6f/R2ei0ihr9RyOVKPODCVLfu
+NZIomf2qUMUbAoGyIUfxbg1fFsymaCJtGD6Raer2GCEPP6EFsq5IBii+As5FiP7K
+Iv0JHsKK5tKHLsg+hp4wvQi4TLaBuZ2TWnCM5JrBFZFzsVSTeFgMOG+H2nz7WWbg
+o4/+75Sj6venFu1+cxGZPZ+2MQyONTVnSkc6jGqiaEXqapfSJXMwhd0JiWwR7Pu6
+lmnVDL4C7E7O+Z0pB9tkCAizwVK/dOg4eukPYAdNTSO/D5yXcQ4g9lPNTnmAAYKa
+REfuQTZduP4f898ZqjHr45wqgX9LdBZ7noRNQAZJ+Nq+uQomRNBfBMhTrJq9UUhc
+vKsIMZ/FkF7Ft8LhSVvSY6/P+IbwXxEkQtSiuP4GWfHCBz89vgPZ8BkBA/Y1FzPK
+xkIXRtEAlo9YeEAH94/Ehc67YlynLVoVMpMTngdA12+2QwzpCxvPDmZiaXRTBEDm
+5aitEGxC52z0RPOS/Wov5gnwdBB3fzpwMvPab8eWIQ2E4tB2deEU4EkjZkOdOtPh
+fHd1C3dz/X2EkKG/NVdM5U/+GItR8OvapnXxZWPPPyNNFQAb8beKw7v7gnchABEB
+AAGJBEQEGAECAA8FAkpVP7ICGwIFCQPCZwACKQkQGT8YCrVdmXfBXSAEGQECAAYF
+AkpVP7IACgkQo0i5hH9yFKdrow/+PMOFDxC4Jl9hdtn6Ab2Fq6RtOdWpxQ8/heWN
+pVB+15Zh0pxMJ+oBuaLnrs0iZuQXJnUW3UpkoxS6TyRhJTi7cNE+5b3k4jn1oC8Q
+M8xKU39+iKx3i6Yranc2+ov6/OvcHXqT+d/oM7PwQ1asYnQqU7GrLxrMAsk4zF16
+7FTYTxrA2gPVZXQSnoh4pH6PLx1K3vsVGDqd2ePB9pJ97I8e7AFvQbOGq+KdM4Xc
+TaV0JbF1GbUgAEukXAsHnSlnCj6lbzTTbF1VdnsgzStS0PI+9lEZjeWQ9qvy/G9L
+fjeJKdaJWW4wbuSTwZdgmY+NOAC2ZRkGzIKB5zPbvkzc6vJQjFeiq5VyryRUplVb
+pm3pIyRL/xeat8Z491bTnPVuyAlhndHG8yGw1zE8nGoo50UbwvhUCpY29RE/exjf
+kaR6LCRRIduL8evca0EHGBVhB7fXFW4YFhxCWDe0dgC5NSurgZs6OXaIF4EvLkhS
+7pgKqN9EagMo6IvGyuf8FpLKdmTwL3X30Y2lvhi2D9hd38+VNV1mumA8ul76pcqa
+Tnu48l26qJ8HvhWrUC0/prylYO/aGrUjeyOt82/sQZ/7hfGR+yJTpKv9bEaJkPIB
+Y7zXfPOObLfii8BfMDCXBH+kN9gvqjw5rxGxWj5gYGnzwreQMXZune1f+m5bD9F4
+O0mxcBMJLw/+P8R6kbImzrYoBR+ktbs++q7bq/FJe5Wye1Oa70AuJy5zs26Xxc7a
+zw7rMv6QiOY66PJS2Pcl9H+kH4stL5CvqiGcsSNo/7KEyrfEY1s14jAg/5iHHkxI
+f4UYG1Bnef9mUHf8TdDDpgPQPUsC8gAPDG4sT79iSfX9F3SVquDaE6Wm/KPRpOxm
+MuM12qwNpD5jlIHM8MjDolKTHasVCRxtyTop644FGlo5bkndTJqfY3YMZYLFO2yf
+LaL8hGPelwKO4RI4de7jtMEI+r0VJwUNfEtQR8EgradjKrG2BdXZi0Jok20aIA6a
+RKe1bh3C6yOe/RkHsbMLF7iJP+YYjqx7d/uk7wDRu8p/iIp6O6JGKC81Dn+dUjCd
+Sg0uaENW9Kl9dGRahB5VWwRewlS4SiORhV/t7PcCoMEkVCkgx+bJSf6W/+HObAb7
+ZL4rmGm9uLzIrmWfk77FWmkKUv2hyNdg4ByUpt6w8J2n5rexBqcgWAoLhPWzylSj
+XKPQEE/3gfWsMyIFBoxSyQiFpdK/JEZTU7IDmCQJIrhxOjBuaTqo/s7ArYBSJkkw
+aXQwkamOTF289QgF/lpyUBg5vFS9EBThLDcgMtTspU+F185TnJ13pDXOVd7DyFl2
+3W1dDhToo5hj2JqYnwZIpIWM4CHQsV2E+hXpWJNd2AIo84IA/oOOOZS5Ag0ESlVA
+/wEQALW6VJKYN/3q7MPYiqXB9I7W8I3jctnoZFYHC65U5FGARcEuiNyDmR5C4K20
+Cutc1hCXwPC/vt4k7JtF/d20XNeBY4RNS1E294c5MEFWhpnrq1zZoDWDllQaqOYv
+6UbyXdt/WOAEci7BBNoXCnk7t3aqtNSVe9ZsUiTKNt0hD5Lz8fzw6cBRoUOdOKmv
+QR/wNLxqF9V4xZiJJmIqeXggyHcaTB25j01xdx684GpFIWWBgUGyY0KWd2M0vxgO
+8G9Ih1nPdRo4gNofslMHwLN2eElZk2mbsXVbTSL/mCpmrn1iIcztpkVW7X2VZiFt
+7h+JJk9kfGFIYix6/xJ9oEnU9youerAcjC1To+6kss1XrBC6UOf2m+asUUo+EwDh
+gdQ01f3ihKfIoNctKXXNYYbpIzIFudrVRf8n8RlxgfSgJlvqZ6E4pQEhKe1I+T7O
+Zy76YSv+f2jgFFqt1p3As+fOVFIu7ePQd8vLx9Ft4/H6oYw2fCfI77aOGr5so2nK
+/yCpHsBDfWrv7Bll5tVJfqnd5wPCgDY875LcOa5jI9Y6yr0tWD9BpR5H8TfH7s+E
+qEog+a01a2G+k1Kw6WOVrqRztkCyTcbRb19bS4Q6nDZPyvo6435lEtKjOlvd5FVj
+p5KFg1osdklRTNVX4kk0++J8ul1ld8jq8Za/MW3vse0SRYoZABEBAAGJAiUEGAEC
+AA8FAkpVQP8CGwwFCQPCZwAACgkQGT8YCrVdmXdPBBAAx9KH3COxe4WLBtwtYZqX
+Vm/pe0BzEBxOZf5h3IyZFhHkxWeBje3g6tr1rsER84ed039TAQV2vbQCYd0lyLbV
+O3ZmHRDvLTG02dzTU0pSN2yJr1aQeGLrxlRdT92jaTYRLfocP8pkTJ22UJvoSsm5
+vEyFe3HMFJUHqQMG59oe3/YkZkBDr9CDFytWmp85C9+Iql4/hxKVZNabpIRC67w0
+SCxoeEU3c41RIcGj7ZHfNcco6LiUhhXG66dp5Vmc6P8QDIypdpywK5FzpsMuxlj4
+0gBmNR6tBqq/eCtRpM3HTh4XzwHgLoa9NgbUwQFjYC3nRgYciymmoWBcVl39AQ2R
+VdE3ZoRS7ZS+v4E3D6DJfpZO8yuumT7Jk6RBUzBKWSktwH03brJmoZUWq/sX56ff
+H1UkmZY7e45Z9iaQp6152UX3T8E3eQtbKKgzQN9rw2hjOszswZmeMX58IcflHgQs
+KTnpHgcwHeLZ9nEUCU7l/tZ9bOfcmPFGSkzOE8o7EWfOcDABKph5ruY4l0vA0ALD
+wcFm0xbXw7UYiiMiS1FiIgX3YyA72MhiOWOS7uUDmUU1dB0ikPoegZLrLIwRQ3+r
+1ZGcveIEAniailyvzjZ2MJCtffRiD69TDwII4w3ksW1bE76kIqgdRf35/j8mtdAX
+cFpjhKP1yEE0pvDC4IvHiaO5BA0ESlVAPxAQAM+PIW4juuY/121KxUNWHYGrUz6f
+Oyh7g4U8AqfTbugJfL8zbwNO6PWh31iYZ5sN0maraW8HsC/Qy/1tE2+xb0khni5T
+fhb947oYGUbMga+SVXXq4kz24Bgo1nMnj0QXP4wnhyJIfgcQqmaMYDVxwRZLvqZt
+s0Fs7N6azsuOH+XBN642RjE7EBrpMn73AoYIsik8j8a2S81g0bcjfYXFSfn6tKLv
+BjiCemRnPmnDHPd2iiVb5AYpIrqInCyVp1c26Eq3Bs5nQH9riKIwgF1sCxVxVWU8
+p+E3iQP9N6IkVKfe5srDJ2WTsnbxZ+tjpgdmmGkYBoEgYdBheAfJzet9PPEc5WU5
+5dHOp7kA9bfx8+YAPLyEjf3t2LesVyTHmGG1lmDz5h9VY7GnTno3CyTJZxj2DiyE
+0oKzBKIzJ5lL6taHMSLL8rPskdm/Luefiwb84qihcDvS3jpFNG6BrlZx+GNtkBPu
+ZioPZyaLxmf3xlqXbGZc6bOg4302EnuzQhnj+2QEWJo1KMIdaHLnQRjFfQIuceow
+EPGbq2qTSbnwz5y/pXVyDpVgfDF6jsiwec7ngMsLntYJJEpwLCy8U0c0VL+vg3ES
+GNnNqrFD1GOVNo6ckIX859ZJFBdAhocok7cG3ZFpaIUwQ9AapgtY6zPBeqragjQm
+dpevdslK03nzxR8zAAMGD/4nIUkehuylxTm//WZLO6Q7LEH0s5shWj/GwaqzW/eC
+IMcgxOtVZUXgwSKWly0zLh0Xm2vGg22AE88zgZOz0mJUdYch24vykr9giCoCF5fU
+Ji6quVJPC7JXCt6K/tcJSzf81j89HkOfRHFf57YKFpiKLbOBpMroHpUiL225HEwT
+nk7UGTjH8fcHAp0Zt0u0QQtPvX7Uwt2A28F1HJCLt3P6cdTbcupVdUy5MTxghjfc
+tubpBbo/Gxt5kJ6c1U0U4SaOjaxdVznotJpNvcpUAw4cu29XpkZgN+NhEHFHm/o8
+I102J/r9CCFBax9sWMBI3kD2J2jgo15YcQLHvNQMT0HXopM9f968NGy2gFkXyCjS
+ZWlKIB6hsJQWfnIeiGOsqhyGowbESYN7UsCgM06A/2L+3yU7NjQ+LZ4PgPKqk4wI
+LmV6NEnTX/9bkarcLqWCt1KX6g+6IgGbvJ96eiI8ZwPxI3C3MuSHNiY1NSP8EiKE
+V3ds+OOIdV+yl3gQ4lW/2z6gBicpoElkN39Yq7tcO7rWgrj9oQyPslo35Jx3d53h
+T+6ytK8g9d3PRrvF9ckr9eZ5JfWuy20jIs0WZrDeHTm5Sn4eWiwFo/Mk1vrFLvOr
+KwLWN++k/ltz2nsqT1073O9yn5tPJvuCG4hJyNiYWkXKQnLXD2IuD4a8hreDIGn+
+JYkCJQQYAQIADwUCSlVAPwIbDAUJA8JnAAAKCRAZPxgKtV2ZdyjJEADDKmjRcK6u
+c9icCLbeFsAH29z7hrjpVMRMVn895p2bFHqaX5iP59GanVczflkDM1HTqiSd9x6s
+acIBlJyiPsvPzV6EnLqKOZU7vMZVOOmJ35QNEXY3fnLQeicrc0M+W1vOSWb0uEEI
+EUA/azzyKT3OBmB2OeztDbS3DkQFY/Vc/f9bgJYV2yJOv5LlL9EGw7T421ewKyqa
+ECpg87OW5J6f5Ia3Wos3nKfqIlqWsMVIRE1tuHqoLu3Wioy6fADYOaiSMO/Reez5
+cTQWzkJvbW8kGRYaFIolEnYMtBiDz7IODE9QvWD0RCt49MAXAVUcdrHqdSSrtNaH
+KeOTFwexXc89v8ESGhDNfG5B+gg7Pz1008EGXP7oWpkT6oPv5nz+bPmM99brR4kJ
+6D0EcD0RM21VLxZX+VCBTPKxlltU1w8uRS7Ra+Myze784PBpYLj7p0KIV2t84pM3
+zUv6VSGsPrg5YCIA1ARJgEg6fmZoto4OqQbvXHEeSpb8Utbow6cBrj7RmT6fcimo
+YnbDIae5sRfcLXcNqPxX4XFd1ZWza7lw8SCVyUE4yPAseTMPk/qlVJX5HuohIZ7H
+bwDdatc5zSO8EIlPi0WsaV9OoZ68rSOoOVzbE8gVoZOCpwzUYHYc8/xuUIS9WZWp
+f6p1tsImabq7D4ZXvixijfDd/1jHxA04LLkCDQROXbvMARAA1y0p3gdbrfj6XSeg
+vNGfN2bTjtdLEjIyX9y9DBAeSxTAPUdaN+kS7DxfsiCR068QNw56RPoXJeE61OPh
+XkOGwalSP0M1yE9fS7Ym/9onQdUhrUetzftueqcW/oLAOXwcxwbZ9iWIbr+vSx2k
+bIMe+0m9T7IUXna9IO3XiE4c3SQxWuxhKyTm6sOcC7pqUY6PvhN/zRQvnNEmr4VX
+xoqkNsw7tpWYXKRHhz1GFMAeVXsuqYOVohbkxOSp2NyUsoffCpmfShT1VGJwDckY
+ywQ8VkAyQpr1zpOX4ZgaMlpsipPHZ9Ab9UbLqB8+4SaFEo2wqOvJ71JdIrHwa+/U
+BGwh4X5AGH5uyEfbSH3SyzG9TLZQUF310khDivVdkINYfifGuLJMrQaIe7aRtK5y
+9p2zP9VBFel6OJgK3m9A7f+GNvVzq4C/YK4o8pqOmPI0Rc2ZGihvq50A4I8st3aN
+jm8QXAWIgVu+7ZPZqp0qD2xFQ+Qa7o3BcTWzPM4vT6Kb2Kmju+HhddXGK+bAeW1Y
+BzUOhy4kWBTE1+YwheJYG5na+bNSeOmpdOCDOfT6uWTaVfKnqDaIe5Qq54QRNiGw
+I4cKv9Ccb1vt8k4VmhQ9NEVGqiEH5Vq7WfrDIWWIFNuq7I1F5WoqQrYrnVrX1w36
+2kk0Za22tSBKDjWD+Yd36CKyofMAEQEAAYkERAQYAQIADwUCTl27zAIbAgUJA8Jn
+AAIpCRAZPxgKtV2Zd8FdIAQZAQIABgUCTl27zAAKCRBVk7ypYMVELcQ4D/9yesl4
+2hO75XeLIgjBDbMYZSMIRlrj6CQa58LQvlKw5+9QuYXGCh0YHyuQ3o4A7CPplNYl
+dY9V++griWfGofs8xoX2t4La8kjTIHSmNcvUVuYm5cmlJlkUUqadPXtAzB8Kz/0E
+vvNq6j2D98TlViUj55JfXy+GDv47A4jQ+71uFiRv3JwI52s7DYuZY1P1FHzGRW31
+v41UJEr8LivleiIOstJQZ7rsIi4mL3dFu+vV17dhSHA/lNLKk0dADwI46EYLLiL0
+nQgA9oKBNX06ZszE7tVPat+vos+sEkbHBlwnX4FidnOkmXs2Ek8xtKn6pwYj7flI
+733dY8HlgcTKMYr4vKoxKKKfLElRm9baY8wb9reYUAMEFL0VOgYY8EL3csoGdhfd
+MGXk77WgwPt5KOFNuoPn9VZdNMcIpIyEvVkTdqo/QAqR4bo1zliVOPGKGnhyEZps
+CwhcPLSIxMjIyj5Cyiyj+2alGf4UEbdjdAOYqQ63yIi3oY+YBWVxIN3SQlM94XsV
+mh4bxaF6pVRoEBWYr21QVFY6jA7RCWzDkIf0eCFkvbP1JQe9iQ6cB4TsAYqPyyut
+E0rGOefeA8db+cg5TFqAg4IAr+x1XtMM8waGYMpaouCpdM9aritMzcbKXJKzvfYa
+JHyY65UdTFlYgPrmmTXgLVSYPytXBJsrFBFGC9BhEAC/iPjm2pYfxOCUBiOZIFHm
+KZE1BXcMR91kZUdIjlSKsIrKDWi3ZsxgCx+jAGr3BraOVX6PkRsKJmDSraU0zE8E
+FEDMh0MgVobFm88lodJcgn8SHGogS8iyfRuiO9WLrNaktbaZUy8eSVHYY8A2fLrB
+w7iIJPM8WSf1N+vwZqmEq5kdw45po8OkzoHcVzWnQddBnBY4rlhcApzSjyRSygXw
+lcgmnpXYcNf20MsB951QyroSkOLVqLTeI8VPWK/djq7s0Q/nqEC5RAZ9x9mTn+xt
+PLJNLsJ4VKAnoWbVs5wzSxr7ZxO5eZvjsPQC7cJB9HNkNaFNYURS5paIj8RMFzZK
+oicU9r0nAXMYzFJOt7bfVcBe3qoPYkBYnZC+yswCnwacmZQWrzMbm8FZITdXgtaF
+DS7u4P6t9jxW2QwfKVtTGJHqM+VsjpgTMa6GHUfqLBoMz7sbbXHAHnUd9P2IRS1E
+hYsjvD88rrUHOM78sEfLS4kHbKhv7TPRFRqGVJ1Ul0umKEvNMezvv0OQgOLdnhEU
+TmHNTFE5GGFuQ/dijb1bju2I3FyIiRtviv1fqRxTHWRA7kHUtL+95dFq1EcmoBiP
+ZDWW6tkKxqP8ZBEnBMdC46IwUEWXy1lMaBHodJEEtGUFrw2KS8VWDhgAK+BLKWqD
+36HsZhw3C0wnx2+IlMt9rLkCDQROXbwJARAA5HFImRF3mJI3fv3bEndHfK0tkzVN
+KD838cq6gfwxuJYy9sutatfLRlE/WVjS07t/7vaL/9BKiwwWmdqhPyXoANPadM3v
+6KWbV7h/MM9zTV4ViI8z8u6TXgBkQzqe+YRS1s1LLqNGeh32VTCjkzpIgf/IcOnu
+oYqhx+5cqNCl/26YGMp4tzxcAGCWwzqhhOD4UkHD0ksTy5RB0NCqb4gIPP5eh11l
++PRm6n9kgc4T9zSgCzb01Pu0bO8jWTM0+q/JxxanweM47Kjg6cxq9djQNLFlaqGq
+Ft4SUGqsVgfJusHBs+0gfM7C24BQ3Z9n4lupv+tcI6GlPaR4lqQ2zHjLclDzPwOP
+Qa0IlkohQ3E5gGUPij2jrF4a1zXOPsd19XCu/yrkDsr5NPagZDvDxCTwOvvc0yCk
++N+xt061WWIINYnSN1cvEpvfCy5MfQy/ZSSNy35QwI13IWimRyFIwUBJOBItNPfa
+Ye4C/QkvLJGsmVq2KZR+uSzjEeTWCRlXPiwqqYefWxA63vhCg1TRN7Cof5ktD1TX
+XAhwMAO0BjXgou3/ajF1CCXmvSJvIyW8gPeKd8fPv0qhVpvCdQOcQINsKjQKz6Rj
+r2wxGZhFwfMU83S8BWe+IPex5KxI8I6kGgoQbXjlwHY5pv0wSaBhr7bJtID8K/O4
+ZjHhv+IxW2FUfjcAEQEAAYkCJQQYAQIADwUCTl28CQIbDAUJA8JnAAAKCRAZPxgK
+tV2Zd7nlEACray+U3dgfA7t2HkuOybWjy1a89YLaGovc6rItTQ9HTEr5cHmcOC/p
+4cCtRLB+25PCl4PfRC5aVyMGzFmQ8HxZdhn923dYvdhuVY7Mnm7IKZrmkf+NnsyR
+8NJSdKoCbV/Yjcq8YHguswlzQXOfMbz2dAD39TG5JipjWCoRyKC7QI+BwPBBcpKu
+p7ALK7IkzYnjwGThM4ocbNsjPIIva4Du1DdPvB+bhrHOdUJ1FCqID23yWrAUXvM7
+TKhkl0vvIhe5wJ8jEMFVCJU1i2Xw3D01FOykQ4GHui/kL7Ddm91Vlls9v4dJQjWs
+jSo136cPld1O4Z4bNd3PBZpfJuJfs0NepX4+XGcmgk3HdeGgImmfc3LqVGcaz14O
+cnDy4IPxRHY6W2/+S8+UFxz1vHDAAX96wYIdadkkk1WjOLpyKhy/hCnlbyL0mx0v
+yQZYCPTCY1E/Olt/uNuoRU0e//ynKZJeqvF1qqH+gNI1UQYtvlqRAVdugxXPC9af
+uMGyaazcT1IFUPLmpuaxmUSIsSBOctVbKtF3rjluo1VTwr+6j2Bm1CDCXwcLWvm4
+pALWtGnNPEgnDm3IhR9H3ORWR8ibPv2a5SdJ/wQwawjWtz45s9xITpXlemNxOUke
+CET1h6v4C4t0bqzinFzi8CwrR/uI7ACdzkhOHU465ffR3IfRiNHi3rkEDQROXbwv
+EBAAsYX0xg2Ca/OjLFNiaxyZRjcNIyQGon1Jgh7ybfSAXbXnoVaG8yWf0O0si3jM
+JsNkBtGhRRM+TmJxRVqRj8vgrYBOq6FvSsbfKKnsbdL8Uxvna+t1SwdQ72CXWctb
+F10LNfNo6LGwdWpyoXQAop9Ny14TLEgj8lT2WwVd+Q+tWtlZKsFYVyLXwW1ZEF5+
+hpesFdMtNL48JHcdOSHN0L28DU4b2V1m9D2eZkMcbZEd9ePYKclwfU75fYxaSpWD
+nAXKfAPR10vpL+H7CjFxiYSDnsSQPO83fQvVrTDyPacR0HDbO0VeZ9N6JAs9p6QM
+QJwywUhvW/IMvbN5xvLK7Vqy4ODoej9vSGj5QqT826Yhpy5pP28MmSlAqseDiSNn
+qLvrAqmIhu+KAQo/Kesbbxh69SI0zeGu1+Dj7bnoSgvFvNiyNOY+YsIpx0GnSXS5
+mQPdxvwHuWcVaIZk+ZDQq9cLQq1PXQHyiKbLSnhrnUbKJGs42ecyKZ0ZXxndbEUi
+5MRoqw6OIvzpPYWAwShenMZTpMAT3zS78+m1BYZMbVVUHlwlhOSw3uzzm8klmF52
+jJLFVtDBfW9uJtk28ZYHwUwXhUi28BVAgnzq6IbN78cv/GRJYxSRiXwKhAS2+/Gl
+ul4gC60a8qNL3GJTqZ1Rul1XT576acS7QBzWthxI1lNSOH8AAwUP/1NTZ/iaW1/2
+wH8+4taP2ksHKbESzZ3g7qhZ+wB+iWQbC/jb25ECr9uJ9KEEhIsXonKr/SzIPjHO
+0rQZjl2I78dNIvUjwsG/hkKHv3m9qZU4Jv4hvAh3K3e8vct9YSpzpRtGRQ2fqEdF
+32Xkhyns8T8AdU0rpysDYxYd2Y0u0lkZqZSXPfvwuvWehkL5n3iHM2wDBxPnlRTw
+FC0L802HjIu0b3OSr08PdLQwFVrICFMS7oTNSxqd3SVsCe7Z5yCpuAi2tdKwxPNt
+s52wwRHZmyC8HiAMnOkuwNcnH2TeU+DDkHCiKDFV9DJFw5xNJHaEVAJJlsV4a2p/
+0GZDrtzND/YVoFSQxgBlfCLFL2kko8AyW1BjGomTpgJ1mWXMi8sPGzpY/MjHDGMv
+vzVhL0YfDKTddmClqxFoeNYFf0C82yb1JejvjAo5AFKrjWzEtwBo320jSHte6v4B
+RvzEsA8136wfnkID0SHPk/KxE9K5djqROQ5hn/+WZzE2trqqQLlWIoe9MCfF+B6h
+fKHw9CoyXRRfWlu7K8F+411dYoo5oFgbJ3FDGsVtZNhCRES/xn5klz538AIUWiv2
+qy7LJvvejPAKpnTziUEqkGfNmv5Q9Q/pN6xJsreJb03p3JLGTddeicNacr2ElEDq
+pOWEbpxL2IBOdNYuYKYQdaxCUxmPwEBjiQIlBBgBAgAPBQJOXbwvAhsMBQkDwmcA
+AAoJEBk/GAq1XZl3mwIQAI5IMKuMerWu++Yyt7JgoqP9B6pAE3bh3OaKTWaWVzaf
+0HSezNU6gV/yc5UVezARSS5R+/lmp1RprfKxt1ZtuU5cKHYdSbr781vULvnFIffF
+Jlqw2VV3TOlNxGammzyFvxE+CLUC0yQ0tlNrc7wVjZDjN2mz28TqOeZsBfHknBQK
+WgtmUbWRCqm6ZeZHFHja2Yt5u5exhChbg4hX23ao/w9raTlly6iaahqNYgJhcnlN
+REY9ecV723E7IaF43/bXfLnDJiA5nCqSCP6PM7yEWnxQVo1uyijfzIqzRBNrh99X
+G//ucPt+h9JveabuZE63NQTvSWdPQY+fUYze1YlPfdRgsTcm5hJ5e91tAubH2Fv5
+LkIIUzIwdD3Cv6c9inQzHw0DUzbL2YxiWDQU0LMNU5OtlHxjx3Rv0ScoyLN4cyJY
+glZCMHsYRzsFqwAdCJVNoEQTxZrTCTWtST0f9CECbzcZlIVtzi3/IkoEExWxy3Mf
+uekIcECixRXyxfvdFEIGwnAI/rlzTl5H2HxKjdo3MFWAJtCpk9DMx8gc7VLVpVnt
+WhZwzVxsGytW3CU5cz9/uuYlWKHlf7b7MOaDw2cQhhID9FZV3owuhPFRWvhr3LrS
+R0YkaPdUIXEHu3dXm62u1t8ADQLnrqI1d5P2u9Hhy5BohUd+QYaLwq9IXZ65cNN3
+uQINBFHNxxoBEAC7nB1AFiIke6oUVZh1zKL8+Si7dlQ0J4Gcwi8jhxSVnfgfrCYg
+tLCo4zdKnQSdh8jrTDW7oxiuSIbkzRReg7sTGA8b0TUyTemndGXNb/ULzQj4KbZW
+o9lRtBMbpuGM0R6SNX0bc8hTJ54hH4FLL+l0hYSrRZcZ9WNdcOleOQNX+fU67x+l
+70lLIECoje2+C4Cq1bhcVXF1Qy6DS+4DLvZgMoySguUyAyp4ivVcGdMxkzS/iKvZ
+drLiONn2hlt+m6j3h7dLdAQKBLRD9+njE248t/+aij966chB3BywmF3F0Val72rs
+J2bxqRVS6xxeoUZZout/qIpX2Y/pF5slpzvADWdm3XG4a0tANsgixpZ7qQwHFXn0
+1Pz2NGrur37pvbAk964XZJ11oCROBkQArCMGRrjHwyyUbcoaGdxBdDiAoaBhyl5J
+vU9QCs/r+0D4w6wqknfAl7S0jX7+6Nr1JaRJAmzivKeA8xGu7iJlM0dLa+bvauCz
+G56HCVxJdSuDb+A6ILa/Rv3KktwWDn3lVI7KEl5lBnfotTSgl30QetaI03zw2mMI
+sSrifRm7yGwnLctJXc7ZmqZQdGWEO3ydh5ae8yTc+smgnl4fA557To0Tv+vdY6XA
+2ulV3TdvmlCL7lnhV0lYq/xMJ6KknH4T4ZbB7lMG+1jJXrxSFL8kZxcqZwARAQAB
+iQREBBgBAgAPBQJRzccaAhsCBQkJZgGAAikJEBk/GAq1XZl3wV0gBBkBAgAGBQJR
+zccaAAoJEI77GWKQiPVldFIP/j5m0erquVWssZyomy/2jCDK/fDPz0ppUWpg4grp
+UAWUHRfNvE07HopTnY0U7XQMSC4bCiljsKtec8M7T08RqGOiIRaGr2FzaLXEBDEQ
+0K5P85hjMKAZWoGCvE7yspeVEKuid0VBXtDLl9X0b6Kz1z/JhfKsv+OusJOAAzVz
+TA5gvjhRcV6Opy4Q4k99JFIep4ZRHompWVjcTH5VPf0JsRv5CRZ4CZd2/2htCw0U
+lF0MSdqDErEQGD98LdMf/2kYUA2RYxhaG/h87Rk1ArXrD1Xp1b5qe0Rp5JZsaCes
+6/FHE/jHINigsGUHEZ5Nf4vWgKfrB2ih3WUkGHGpYFlTp26Vz+HEUAlkqktYDS8Y
+dUeP0A9oG6yxh02QNdk50Wm945xIbuQLPiUOjc6AL+mKQMGGgNlhpY28FvnHZlot
+lseXj59a77ebk3ISSy0Bp540wxiNQypTltjsIhvVvEywpBYrWFRyOxe6vSj2LinE
+U8YmQbRo8eC75gRWrdMgWZF51Z0qF91S6RW0n881HEtXG8eH3ACjkbq5f4LP7rPX
+KMT2sJCOW2aZRephlznfpZ6pMo0HgdbYRUkZjchABgKt8+Y26H2kBGnvsFW98gdm
+RBULGBtoifNRz3D8L51ivfeVTSyH+lDPLmNurFVGH2d/Mu45vRxAQHLzIY7XIHbp
+fgLsevwP/AqjbDpvLF9N5oInovr1fJAOnRvdaxrrngGft+FC63Er5soDaZPktK5j
+nINrSCkZiCTCG/xtPBLynj4yRvmgwcjtw6aEGtnAoz41JkPmddhj9pThAkuObZ6E
+HQZPV3NQBCYvw9qDod1ZJ517QB+AMYmQxIRkjf7g68J6J4+9VVZDP53WXolF/CaF
+g5S+UqD3Vw2bCKRTq2JkXw0Cfe3zbq/xz/jGU613/PU9pgi8hKioozQATxvCfgZP
+pm+FYTgbtsYXYTjXciRTxpoXggW9bGl2ICYrIfRtDNQFBcgTSylPIDqqrBawYkA3
+jZm4vnw1SavMzWh1gh0QCJPtn8LxtjVL0Ck1qgwlVlWSI+GpPyOaU+KgefVvn7qK
+eum2OagJjIPwnDf+N02DFx+JGRcVAU+4wblDHi0chP5fH65YrXmd7d5QfpEuTKdI
+5J0EuEm4PFz8gXptzOwllwKV7wDBGzdEIZlt4hXjixEw2o8gKu58s7qZcPApb7c6
+ec15km0oZJpd41+ZxuUUdWmnsQvyJHe61O5g5CXqiGz6lSlZp92Ai4RJwVuivn2P
+ropwMXvZ+D7BWI8ETXzWtYknZWG1F7Dbhe5WIuAGt5NGug4BXOXeuSvfazFo0MKR
+CqG4TNe+Iwee+yub6bGVcPu5R2EMjHa+koR0YdTu3sRbJPZzQ72CuQINBFHNx18B
+EAC8lhILAFOFiS/PFhYxGKfN+Tv8g1HaSIGCFKPXUUT0YwYhJCgwHklbV7cFagmx
+HGHELRFW9Jzw2SV6r0206CsBrlAxWXX1QjI60eBdiIZjhSTycG0VcnUCDnI27uJO
+tNy/UBZtmClsuuCx2GGCsgYSNucek44mFvmvsaK8ytENZS6lRriW6l9th8hE/Lj+
+Ss7LRmSVPRf7aN2X8o5Z5OMXf7kS2R8ScFAGG9lkyr0YETg1NPVE1HUBV+jof1vk
+LVprA2bURqld1nKKOr6HKLuxM5eZ7jNraCoSAhPPrfOSl0YAt+hZ8ZepwfvFgaek
+3V85VjVT79cOzkdHMbDzCsaNhS0tM5qZL/UZTcgRtHgH/2mHHLFJ+k3fd4rY0QUq
+5ngBHo2PwWx26Lc7izfvwPzY0A1zuLU4YqozppoWhVMoIoZ5dPrU76Bd9IfrbZ0u
+M6KJ9nItWQEOA/PrfydSur6578gHbkA1umGCkLQuizAqmXQ5yU3Nf3RI4j6zbRN0
+3DIw7vVN1BD2eL2x1w9vKjjcsdKuRUS0aehfa9WE9WKEUyY8dzouzl8RAgLaRcot
+y/N6jVMi55gxLX2j4PtdVChXC0CkuG3iH6Mlbuc9XmqOBag8u+TRXvNN45UN6nbr
+SlHz0QAQ7SbMH5JEK//3EaSvrzWFni6fOpOCoxjIIPNJJwARAQABiQIlBBgBAgAP
+BQJRzcdfAhsMBQkJZgGAAAoJEBk/GAq1XZl3cA4QAIJAIc0DDP8JrkDjKO3Cf4wx
+mBSzR4PUWrgRbG+A+XMNzYNQGASbst014ckSNKRAmsrzSvBINBOAVliGZIbI6d7u
+jbvQWHrSyQxdyiDrPrz2P0qwMu927SGDeZB5513rSDaH6D2U4QI53V3yOxiWcAIp
+LUrg/j2LQsMUSkUe9vO78nKw9oFdPHhzTgVgICmvTilKYzIkVjInz8ke4I+EA439
+2FLq58A3lw9MgWi0XEVnR9c+ddorR1I5Ku28NnVkjeXA+2uQFYRtcnSxx9PXttwt
+pSossDyJD2K5H1pjpF0GyzCVTvBJgHLTZ/bOHfQNDLv29yRVczCjiyujNEM1Sm/k
+4V0IFBB5nUDX0xDhNRL51tXJQ0HhpeJI1oDzCvKWtLhF2qxH7bx/uYJBF3GhFQ0f
+Or6zqDf1lnJnJTElY/pbt1teZsrbATPqCQnDkNhG9z8JMceGYl0nz31CaWI3sBGg
+TCY9JdRLLIWQygaN7jOlyRWnTpnKRgJQ/dOotrf9DWvgrUYIiPA7pubQdwww3GAG
+5Ieb9jnJtc8YCnM+AgWAqQoDxM49zKjkOy287UqGLO0+pL+wjEk+dDsMuqwba71a
+OhQo6gZzfG/eHmKCCPITbSqaAD/DD9QRhULz99GGybdnLPoAiurrANxL4e0UkpDF
+L/nyyG8tKpwEuF8T7f7kuQQNBFHNx6MQEACbR1gnAryeceHHc3ljQxERLFBCBZ4V
+cQkDYxxpQRMsk5ZvxH3u2I9w9oKgJNou9ZI8XLluqg25CM1DGUKKoV7CDsdaP7GC
+gE6OMj+VhPr9mjKsTzYyHLMaLPSOX7t/mfT7SbbZovknXIz7U4UeLT9djTlP4pen
+FFv0csVRAuETPrlCHFut59evYoGlVax10I9+T+aC3v2OY0yB9vukxalccvFL2RdT
+lV//ElMNrPe7BoSVrBlSycDZqYsU53QxCdDCWJ7+43iQave09edVmVscxZpiVoHd
+vcz5j3u/krMY57QEem1ZFhygsYaG0A1n1XJ3cn5nf6oIJvG6kHZ8mgoi+89rfbg8
+w/N3lUH1ZABLgzN+hJ+byexHc6epQbH+ZVmJEnMPtmND9Wcpg14gaXH+1ygvTnW1
+FusFDatdmM43UJ4M+mP4scA2s0Iix9xXHmbbEQLWp3C/n3R3n6ImTtoekAfH3IOt
+4eoMU0qgIn6VhL91/aGBxQVhSPWR2XxkS7gClCxWAatRMWWf6Vg2uuJeVra1x6Yq
+iVrsEx7446G4fkv/z3jqUl7gdt/KBlCg0BYE1meBqJSnCvvgDXmJ8lEU32L0IE/A
+9WkKCMMx74+GdBKATCuBGskJrOwb8dCVXBN0fq4fg/SBKjWY3JoQAX9JcXmcg4oB
+jGWpLUX5zU3CNwADBQ//X6WxF5cmQo0gu7mMjGkWo+Xdl26afEDhTppucb/rxZka
+Emucxt0R7kzqyxjqrp3SNJhmhmtSm9UkhSyvKHH1R2jSF3VrWRZYRrUgf0PJLelI
+WGRPWcnlw6WcmB3imgMEtLKcwRvhqUhgC/wc8kyPD24sDb33dOdnqRsyfX1PRPbB
+csQzSbQfnoZZDDnJbxuNOnJYHquRo2OIWCKPjchfSoe1U3JioZwD9yYQj/6Y5RU1
+5Fk8OutmJr49FT9I62qQOwGJ4BKI9FRTX+y8rCF3dNOpgxTABmXjqAl9SfghIIjk
+SXgPNhKioxQ/mciuji+2Hdoim3IxCg0GJZxFxpyNTQWR27kn/p4NhwpLnRnF/qD6
+b1N54pL3o9VRLgVR700+/vSu81ipl9aurYUrVsDtupcEzzKpyb+Z+A6nwrAQb/Cb
+SBnCoV4w5wU2MPeLHNE+gp8VLbS+CYgUpchFu/XKkgTIqgGIvQ8FBvJh3leU89XS
+qvRb92qkZ+LQbpDbpaJGM6G9huijVsAChmYEKy9lFa9/fH1I81E7M6q+AawWyiEI
+KBBVLToH4GS0TWkADrEZ6LI5+P0IkplDm5ttOsepfX//fqkAJLhfy0Slu0KE7hvr
+S2RDjnjrUFAJhv/7fKKzZ7j8BkUINXWK4gcytkzkBUPF2mfpUH9CCetirVwVvHKJ
+AiUEGAECAA8FAlHNx6MCGwwFCQlmAYAACgkQGT8YCrVdmXeEAxAAnH4mQOYOh/49
+0YmWPrt5mKG0rv3kNTOOx+TlBpcXOI+RFv4JliFFfmclqhdHyaveRZ4Ho1hPGaoJ
+RM+rlB0nJoWFo44hN3dQ0Qdv3WsD9ewzi/D1ODKsvYZmxd7S5gH0K/wr+g/ZUHMI
+FeARHbviBkQM/bq9PDdYK8vDbTzix9Xk2nH/zIWSjnY3Bj16Gyn0Tkxc3gsUal1P
+ypTuMbaznHB9SljvkbM9p+iG7Q5bG6tfUv6eJR3Ex0J4OcnVEEJrpq3rDzrH10XL
+rvYXSofAYjz2sQ/NpKdfL4dOxLiD/67hEXKjZEH8Pp53ZxMNCC7sdaTWkaLgcCE9
+fzQX8g3vmZAXMPU2ET1CNjkl9QvCx9yRGnY6VN6pvRmQjo/L2UhCqN9xWcUEmyhB
+lLkSzcaIyhpaQ9lLTXu6uA8Bh9XyksLo+4uqbfuc3hK9vkKqoJNP+hR/sdHqgEjX
+Ks093B643nXVe40az5flt7xKlR7PI/FVm9ALoL25seBQbSNRemZixLiFAQev5hYc
+/75PaDozWbhVWsK/IN4dSdHOk5fjaJyIANPRPm0jvYhh9+snJ8A7+Q1Bwfw6nbbd
+cQnZiHSbaFn3zkK4fkxzqnPGov3PlB4WZjmQLwzbUmZ3pReGA7z5R9MjT6ZhTpzg
+CAf4F0UC9mAucwHZOkjI0HulK1HliZc=
+=prMe
+-----END PGP PUBLIC KEY BLOCK-----
+
+Type bits      keyID      Date       User ID
+RSA  2048      0xB96CD0C7 2001/01/04 *** DEFAULT SIGNING KEY ***
+                                     Bill Stoddard <bill@wstoddard.com>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: PGP 6.5.8
+
+mQENAzpT47cAAAEIALLL4JXm/9vHTouYSWrdDvAvNNxa6UwOZ1Sp6urCgGtuRLz3
+ysFFY4hlfIhSUvMdBuLMY5X73Tzg0+LpzCBuvRHasSUWO/5UMlTdS4LnI6oIS+7T
+Nc//iwPQaH+P3CU2QScftyI0kS6kxr49Ejf4UZrJwMXsgvk+oDzRIdx1X8F4A5oW
+oAUl2njrqVodbO9nPifBPlooHg84Cm3r1xgMK8OPPSEiVnmypmwTXE0fMsxAmW/6
+AqPf6x54tKmAyFY6UWM1bX/XhjVlwUu0Ax7ndBTKgw2ZCZA3TY3GQTPNbiK7eOpr
+PUYN69EIKwtyFZHDSalkVpaZB44/nZygsbls0McABRG0IkJpbGwgU3RvZGRhcmQg
+PGJpbGxAd3N0b2RkYXJkLmNvbT6JARUDBRA6U+O3nZygsbls0McBAazZCACW0+ss
+3zAcpJNVI8rBZGwRSCEHW+NVRCQvrT4WiXQmb0fcTMJD8WD7kkMrYxaDuRzx4Iqr
+nwdTqzc0MieM8j0lqa7zaoncxYFh/iLeeZKvK1988UIrVmFDslRQpnzeSXLjUWnF
+1JYsS9+sYt8NBJGSIGXALji8QwcjpjRagzNjyO9YEs3TkGqdNslTQo1LJ2ZNIH6T
+aIWoTdnoU9WUUldsSQEbYB6JNNP67eiFTRZZnKradoQ0PVBXtYZAw1zOp5y/xPH+
+72vhKLk7+Tt3zaV/SmoB52ssE7AXazdQtHfH3N5XXtZJvjIIf/Y/Svw+OaJ2nD3n
+Jn3b7QtvWvkY2geD
+=0D9G
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+Type bits      keyID      Date       User ID
+RSA  2048      0x423FF2F1 2001/03/16 *** DEFAULT SIGNING KEY ***
+                                     Paul J. Reder <rederpj@raleigh.ibm.com>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: PGP 6.5.8
+
+mQENAzqyerAAAAEIAMPeottLIzgSNklzro66gEnshbRLeb8MRwlivgOMxl5MgDpx
+sH44MPaYKaB1owFQdVSSA+k8ARrxSbki46mQvK53+t1yUeVtaPu85GBta4Q2paXJ
++2/JVB83Qt8ZdkR7bA3Rxet+Poye4wqZcNQW271FS+sUkTvhAF6nb+5nWFNyKkTe
+ApG9eudukksFd4Uh6ekMjpOX0HPUXoyzf7CmwSERZIny+qwK0dkKkr6qKvZZOEXu
+wjnFgQoqcj242usLpGUfrGZCDQsOheGmaWH+RxrmccOqqqfmjo/EoHNjmEvfRSDP
+Mviq9p574VRsKdt3smkyo63DcaguX/FV7EI/8vEABRG0J1BhdWwgSi4gUmVkZXIg
+PHJlZGVycGpAcmFsZWlnaC5pYm0uY29tPokBFQMFEDqyerBf8VXsQj/y8QEBX5AH
+/iGMf93L2+1NP2MHZzuggQrcRcf7fkOdVRfx0GcMUFuet4G/0Qg/NKy24J2xMVLI
+E03//bn99c47BmGWlSrsuKM3nHXDtLHfmX9ajWB2x5TGLsQqCubfvGyxviFKyUKr
+tVLrvOmfiOGZkbRjD1r1mjNKWONKgUcjgFmSqsZPnZsclNjOMnqENVwOtSS14r0K
+YMquMP/sk7xDNZlRVUPEVn2TlLSBJp0NiAzwzbafbszX6xHLRJzE23hCGjl0ZnX+
+zkBusLpUGkuRkK6phJO6pg0E41D5QRnts3pHaDQ4EI6jEnWwlIsavrHh0mAw6ocf
+oO+6PlKrPkqjgRSHYewLqnU=
+=WB/Q
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+Type bits      keyID      Date       User ID
+RSA  2048      0x6BBA9D5D 2002/04/08 *** DEFAULT SIGNING KEY ***
+                                     Cliff Woolley <jwoolley@apache.org>
+sig            0x6BBA9D5D             Cliff Woolley <jwoolley@apache.org>
+sig            0xCC8B0F7E             Aaron Bannert <aaron@clove.org>
+DSS  1024      0xB0D5F771 2001/07/24 Cliff Woolley <jwoolley@virginia.edu>
+sig            0xB0D5F771             Cliff Woolley <jwoolley@virginia.edu>
+sig            0x6BBA9D5D             Cliff Woolley <jwoolley@apache.org>
+sig            0xCC8B0F7E             Aaron Bannert <aaron@clove.org>
+
+Key 0x6BBA9D5D fingerprint =  B777 8235 B7D0 36BC
+                              A8E7 C012 842F 3E99
+Key 0xB0D5F771 fingerprint =  3DE0 24AF DA7A 4B15
+                              CB6C 1441 0F81 AA8A
+                              B0D5 F771
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: PGP 6.5.8
+
+mQGiBDyyDL0RBAD7CpRGu7Gvtrp/J/wDKgOxLpX8xLTFTXFnncHctLYKMta6nQ1y
+pQpx5WhrVyE3wkVPTHbDfd+mtviD8muBLAVdtiVbpN8YxRPxg4KAY+yzpBtIEsUW
+xXc2C6JHgwlxmW+WNEUvBTllsG2m5FDuLiMw9UA7mGYsLChbt8S7T92YEQCg/1NP
+toNBVqZ6X9n97L9SaZuykh8EALlUMsXlSauI/CjHbOB8/kXcBah2p33/eD35vEt8
+GVMwASc6N7u5fwnlCeEKRkLVZD0nmZ/8/50eQyQdL6MCPDyFERBMKlAs8VbpfwQH
+Z3odHJcSbLEddmm3Y7ToCTpid03FO/UgonPbu/N//BNuu/WLimO6I3ZC9EYAMwWW
+zzhEBACv3IIwjrkJHLxJZh6NJjoXJL5/w0FgRA+C08/nZBxcBWElavk1ukpxyB2v
+23P531IljA8MT8VyQktNSzfAccQuvY3gIweDEgPXxpc5c1MqNihixDtZvAtoBqyr
+nmKWgl1WeW26oe1eg/0XmpCSg5klaeF7EV0EV5DYUczNP5Ecv7QjQ2xpZmYgV29v
+bGxleSA8andvb2xsZXlAYXBhY2hlLm9yZz6JAE4EEBECAA4FAjyyDL0ECwMBAgIZ
+AQAKCRA2FSLXgqt70TzVAKCr/RJ3yVYBNdkZTW5e2PFFhHfZhgCfYBAPdm+WomzF
+qHvigpnQ7KjXNuCJARwEEAEBAAYFAjyyDVAACgkQ1zqQuGu6nV2XRggAuGaGWQRp
+apcTcrsPALlzUuzFOTApMePxmtaB66fKm6zdV6FpC4iSW5zaMZOZTNDOWD5541qe
+Rl3JtP+lo/ZrY91gO9mmjkB5cnXQrzLP84rfL1LELgTgSJ3lcCFqgp6dJr3NI0UF
+eMYcAu/OjjUQ9JNoNsxVjTvuxnslSOekQWU28CjD11/pm4n0VPlbPJosHv4wbncF
+DplifohuXoQnJX7a2JbCTn0+YDvUe9+aMj6A1/qftgv4msvxqL7f8d8cZ5vwK+CC
+VfcVNsFYf/EblFH9X05e4nBt/P58SnLLWxsCg6foNKpuK83SjPpTAYA2s8+AJ9CA
+054a+swKXbFWDbkCDQQ8sg01EAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bxbrlL
+OCDaAadWoxTpj0BV89AHxstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJPPT2N
+286Z4VeSWc39uK50T8X8dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrUGvC/
+RgBYK+X0iP1YTknbzSC0neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVbGI2O
+u1WMuF040zT9fBdXQ6MdGGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcpesqV
+DNmWn6vQClCbAkbTCD1mpF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAgf/bu2YeGmA
+ks94lBudJLT6kil4hSw1J8JuKPAEJNiXLupxmrMDOegB306y/GGIQg92kbgbMANl
+wrsg3NXrnMe65PluraGnIovnh9KO9i4XSkIWdB3zQgTlkxhtfZ8NJHB/ihSnxtTa
+u8zmJ1514QJzHH6lDlCzYNhS4tPvR6deIoUwzSupi8L8DKNhS/dwlvKmKQXMpII4
+PULCDT7/nFbB35GmA0E6vM4ZnmHaZNDv448OxoePR8bKy0RpdNIznKHV8MbhI5il
+2IfzbiqJ0HIGtZJCaJSfIv2+qWsQf2JbY+uln+KiWwSkUI1MvqUHKKmC4/eMPVSK
+xsm2vrikocYSgokARgQYEQIABgUCPLINNQAKCRA2FSLXgqt70d0RAJ4gArDns42K
+44A6p/EkdHPvPRt2UACg1PdswGHhdskOJmGc6rftbDon2jyZAQ0DPLIMKAAAAQgA
+zLpNBiA2pEnKa2OocaCvTSiYn1mSnXPbtqsBQdodIeq0zm8x1YizTWzhyocjIwM0
+N1i2QdFY8RQfmiqjoEOthzPCpP/3/K+BUYOpaq1Oro67DvmDnS8tOFvhQG2cDLcq
+LXW1v9cDTSiRLP6cNZVyYYtlQAPoIkOVbnzBE2nHSeS5nv67XmDIvTNZJFlFHnUr
+cbZ1Lcbg5blL94teRFNaVRaCVpBKGiIE3XycgWV5+MBVKRH0XOnmcyaOS0VaFIr7
+o/g0WjZ2Cn8lipjEx3KSi0cERIqZQFMfqTGC7oVuuyOrtvp6S3/9ltmtndkzJ7so
+RMRnjS9eZW3XOpC4a7qdXQAFEbQjQ2xpZmYgV29vbGxleSA8andvb2xsZXlAYXBh
+Y2hlLm9yZz6JARUDBRA8sgwo1zqQuGu6nV0BAaZLB/9tR1ZYc2tB4uFGqa1YJbIq
+7qRYESrESkeePJvt5A1WF2n39zY7RwRECBuUhZe3GJVohac+kZ85pS6WbtihrO8I
+HSuSm0HPvfkoedk21Md/zUzaaq+gKE/0eaPO1UycwZk8F8jv4uC2tKBwfbZyay5L
+fQ8YcYM6XFzV0uY4oJF7x7jTaNT6iyQtsPPo6UAxNwcaZFdQ1Yz/ZFvl0vK3ssYz
+h00QsYxy1TJGaqHXO26FlIBzP24xl//jbMVS88DKmltO07O1ZzZ0H8gvX5u9AYeO
+S4jt7wJlJql5jQGQ781ZybGAzBma11ixK5XItq2mVaAQdJdOqMiTmJvWgE5/ymoQ
+iQBGBBARAgAGBQI8shKPAAoJECFFSvDMiw9+E3cAoJCOGqlkIY3JXY7rYHqICrz8
+D7eRAKDOQjhlMF3OOD6KlGtnuBpdhpK6rw==
+=gjEJ
+-----END PGP PUBLIC KEY BLOCK-----
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: PGP 6.5.8
+
+mQGiBDteBSwRBADAFBGWcqz40R9Ne7jX6zyk1XMqVsab4LNZMzd67n9J/Qni34Wq
+5ZMHKUUqMYgIgKjUB4J7J56XVoPEujGBxG7kb5HOi4Vt8C8jg3FF551yM2WgamVT
+cvEKwHeltYeIyYdq4DLCBt5GENA+/amakMS8LiHWPSz9+/RLzOUJABLuuQCg/y5p
+WzAw0lIO0OoFz2U1RLQ+RZkEAL33hMq4C9yfGsEKkSp7od8koJ7Uw6SvZEbRLaiv
+pxjDCeqM0Kd4CNyVgprdnnYmMxtsQQ8B1Hu9NE4///h1Gk1LWZnXw1/aTbZZKL21
+JPqkxdjRnqAztOuFo5pO0+EGG6Tg9euTjr4rZ9VhAYaO53Yhv+uDDaVB14HXtMMl
+bw+1BACNRHYjHxJPrRTF4u8lwgEsUC15hPUQZyqCOtYrWcu/FcfEluduA9E/7OTj
++DblPWViPLb3+9ojjwA9A3MRFA80nJTMbloSdNsTvMq+UFmk2MkKS7qsAMjLRC9P
+nbHA5tzzHuVscDZDLp7otIKaAGAqrxLXPc0DMM0JB6WG0A5N2bQlQ2xpZmYgV29v
+bGxleSA8andvb2xsZXlAdmlyZ2luaWEuZWR1PokATgQQEQIADgUCO14FLAQLAwEC
+AhkBAAoJEA+Bqoqw1fdxNb4AoNLFL4QgmbCEZhyVk1PwtC4oqmujAKCjymGdDhbi
+SruZ7t/Qo0bvGpDa3IkBHAQQAQEABgUCPLIM3wAKCRDXOpC4a7qdXdBbCACjf9kq
+TL7qzPfsiy+yaC7f2TVv9pzNMv6Qv+ep/zkNGYxHHokM6OQtGf4B4v7BLZ/23BS6
+Vikn77Q1OTtqtM5YTXwLOGIqjqgp1fwxIPAN0yekfAuGQi/gOpGVlRrOT0V/g/Yh
+aoHdvhHo65pObnm2sCOt6hPJwbns2lgoVoWdlNkbsuU8oU8oFGY18Gxm1gNpMJsQ
+48RHsFeVErIh3DA1tkCLOMQ0HpqVH7185JlKq9qaU5yAmUNSFfuHN/RHYWAKAN8R
+mN4EhVLigxEk9/qU2lJ0RdSonGjCQU8WXGM00V4z6Oael9d6q1bsYKidYq6lvN1Q
+jKAZTCVLNP+J81p8iQBGBBARAgAGBQI8sfqxAAoJECFFSvDMiw9+8FwAoIHAupTX
+tAqACQ4JWN4THVPZgQHLAJ9n7mpZ3H0Jk9JsT7gkfB6lYxR0EJkBDQM7ZJxaAAAB
+CACrn+bx3ALwnnFGAODsQJXtYmjarJ3IgknCW5G7NQgpv1rrN0DqqU6d1Xy+82aC
+q9ixXXgoq3Tf4yPD2QqLCd26ZORYWxP5wmcdzE1HRgBXbFZ0DdHdUa5180mRRukg
+X3JmU53s89tiEh8RH0ijqd7C88yGaHQFfgWmcbmAsBfyJ+pGyoyag630j/U1d9Pb
+/7LMILYtyeFMY39T5xPIcEBA8zBCWp2kqp5aO+lSSB5ZnjOZpnwYc+EMoGL4+oTT
+gPGHh/8P8OD35sik545t55XUX+KTPaP+T32s/FRyMf25GQg5bHOvczGarr99ZxOJ
+yck94fk2UeEufMeL87Y3EUs5AAURtCVDbGlmZiBXb29sbGV5IDxqd29vbGxleUB2
+aXJnaW5pYS5lZHU+iQEVAwUQO2ScWseL87Y3EUs5AQFQKwgAn0iyFJcsYTov0q8J
+Q1sfPZLYxo6Um4G2Sc2FmctlE+sc3GUc5IwpWQAfD7kQKJih1skL6HE2/yqPU2UJ
+Ah9e8JeVqo34mBBJtUk9f+OTWauEIexCtaGpnRDT0JFOgBpBugzOnE7Z22SlaTAe
+wi3OT9Mwv6UoTs/kt3oO8jZLemypUvgnWLtEpNAwFxgZXPtdC7EKs4eJhyjRdT+h
+CIVKvwKlzRVSHtgPhYpGT0l/BCOF9qNGQ8QJcu1U0YyDXhPzU9Ymqzs4GJYFmNI4
+iQWIJhaegDYdFCIRzYv6/giTdccm4EfvjX/CgONsJHAAE1ldd0iElLX/A2se5oS8
+1VCpI4kBFQMFEDyyDNnXOpC4a7qdXQEBn4IH/1/cvLPV1AB5u4SlKIknGlwkKBN2
+UqLRxkEi9AeMAiAatgnbT7WD4mIbGpn6ITOzYZUA9wmxHvWCMIZGh0y83Z93E31+
+7zr/8W8qEdYR9416LXBEosWoh43vPXpmysFdXSwO8S5BYy+sIC2XRamvVYae1LxF
+XNFY257pBSfbABtVtMdwo7LNNxNO1xpS4HFwoIHAmgH25dlD2AgrTjacNg1I2sPN
+h/KWU8eOFbMdKpDYkhQiKhvObO4uND3JALTsjUqk9XYgxk1fTejS/o+c3BfQ79Bk
+xo0Va2Sg8JA3lk5MaQPf4BRqGeZqqjNbogHhO2VzTwXgH5tY6kP+AR0vqlM=
+=8dFY
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+pub  1024D/751D7F27 1999-08-19 Graham Leggett <minfrin@apache.org>
+     Key fingerprint = EB13 8C6A F0FC 6910 01B1  6D93 344A 844D 751D 7F27
+uid                            Graham Leggett <minfrin@sharp.fm>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.0.7 (GNU/Linux)
+
+mQGiBDe8doYRBADX8dv5WHSCk8CDrqMFs7eB3MHEIeWanX+7e43s2NTuDhxWUOOg
+vWFYFM0aQrGGvJ3xT/8DrI3V6KdtBK1W/h2PjWNXoD1RsmBQZUzFx3PR+I+dwv+T
+iMWgrIpD9x93AUvvTUYDDVq7NcYMDyL1/Le3Bm1u9MhwucTBD+jhgtKULwCg//5c
+4yS482vmqWdR1nGLcqPGvo0EAK/2NvcgF28KhUPMMAkjl0YrGTmwbTLGJPbSK4nl
+BbGlzn5QpNTf5llSVUwmWVZmoidmBf6ghuu3XNr/uwM16BagVa4wIPHolFlQsDUy
+HMkVgtMrTHYHFdXZSPbQhU5UGzgF6QCgGHtzSISyHtiqXG+50xVPV8ku/bIJdws7
+ntrxA/95BJqZ71mVjBm+GHF4NBsSAkB5zeFcKBZaetLU6YAA3I2P8OMG5abCcr7H
+p/g5pDHMvYW9vA5OvmBW69TAem2K02ifohjXA3RSfdqeZ/VOvySTHKaHM158a8Ad
+BIMWFy8jgrT9rmwntPvofFD9xKh50XiJ1waJBj7rjvr8QyoQ9bQhR3JhaGFtIExl
+Z2dldHQgPG1pbmZyaW5Ac2hhcnAuZm0+iEsEEBECAAsFAje8doYECwMBAgAKCRA0
+SoRNdR1/J8r3AKCdGB5mx8Vm6KAA2Fs/HtNzWTw+mACgzdv86/7AmHCTy5uH6mbj
+ZeK/feaIRgQTEQIABgUCPdw82gAKCRBq1Wz+GTEbAAN5AJ9lGlLwQVv8nyYdKYBy
+AP0M+17DIwCfZTyc/PJQHxCGH2ESqD+T5ElQMX+IRgQTEQIABgUCPaRGlQAKCRCL
+2C5vMLlLXF6YAJ0WgqBLoX4b8bujrYe6PiRWZPm7aACglDrNXoM8TU93F/n3OgYx
+btxDuxSIRgQQEQIABgUCPdxChAAKCRBVkeLAZmTAeCkCAJ454pYX8Lc+cPkqE0Ph
+f8HeTEg18wCeMwbCbcyQ0ZhEnnUtWwuawxgAeNOJAJUDBRA93EdVms08wKmfdd0B
+AbwiA/sFXOdYaAD5FoUrBPhxxMIWMru2h2LZd3A1/jLhcptO2GQGCMafFje9b1YC
+APGsUgAtm128PzvvoOzge1tSUwGEWlQlEacDJo7REb++hOtycjccBUVMxaojlkwz
+Gfff6u9Z68EbRM+UpZMRWV39j6s/Yl0yFwU6emQjPKpWQH5OcYg/AwUQPdxHdt26
+ZLosMS0vEQIkegCfZyX6DAKQXY5eYzuGuZZRl+0Ug/YAn0w5TNjR1Og+eYT6tal5
+XcyBYY+GiQEcBBABAQAGBQI93Q0DAAoJEPcTqHkQ/eB1qRsH/RpjHaZOHbpsNFeQ
+KuPwxObBw6Rd72ut0N+N4ESVJSorytzCH//5rPmurmyMjtQ+b7qzohxDWMU8/ZJx
+RJ6GpI+m55S+lyz6X1t8bDt9P1T5nAbsALOvsFQEv70pVYNtSg4sK5AAqLCJOdh9
+5+FQJJK7sMVLShB9Jo2okVVripGxZOKqTi4lhCdmVmWgAMKhODoXg8IOPjxO/hZq
+oGP3cT5OW9hFYTmyECpMItTLYzcB2d3cTyYMaCg0kebMbuq+gAilho2NKRnZ0rJY
+9I5ObSL0F/q1Ji7gCoTi/FkqWa/dz7kTzJdyov8Th0Fkt22uvlKbInfuFgjnFsoA
+PFj6TpSIRgQTEQIABgUCPd0jKwAKCRCLOmAfCMl15aqFAJ9JlvmUZ+lIPP0OjQO/
+HM45FRalpQCgn6Kq7NSq3bPmc6bpkmBtEbdMOhuInAQQAQIABgUCPd0w0wAKCRAx
+pj2W7BQLgR9oBACIOv5kNRdT2EEHeb66cjooslW8omWRiuLD3a/i0wZBCI0lFoie
+HvH/ppJ1ELGMGCB7aBsahyBbDkxUMpPKOHwd5bu1p3qqUcqXbZw/GFjLyee8VwKD
+iyYMm22O6J9Sduw4ypdS41mGmlPvdkV/Jrp57/3fYyxnu8tX790aohTPgIiZBBMB
+AQAGBQI93TyXAAoJED6Pt/L4g0HZ4r4D5RnD0dfRtzX1iXFofoQ1TA1Hv1uIrdKG
+WqBFR28exzkyY1rUgD1ob6kA2phT91YYuAKq0D0DIdL4plIK3XJqmirN0KkWyQXh
+avEIOSVb24EMP8T1IWzQMVLsfJEJGZA9UrlVvSnjFvi6zDbk/AjpCG/oJOWhrNCC
+yReDWRKGiEYEEBECAAYFAj3cRhYACgkQvrorh/X8S0Iv4gCg4PgxsbODf5rnxHwY
+HzixdRl4hLMAn0f9VJRwdgH7s4eEHyjcFPpjsPe/tCNHcmFoYW0gTGVnZ2V0dCA8
+bWluZnJpbkBhcGFjaGUub3JnPohXBBMRAgAXBQI8su+QBQsHCgMEAxUDAgMWAgEC
+F4AACgkQNEqETXUdfyeoZQCg7MBpKayIclyy0m8J8ftN2hTjGSwAoPcPHDXDSXvp
+xRGpXBl9tlTOJVt/iEYEExECAAYFAj3cPPIACgkQatVs/hkxGwAgRACfTr4PRP6s
+6BtADfk1nSlxH+PjDUsAoL7GXrtCAeg9RUtRhk2K83VuHkrmiEYEExECAAYFAj2k
+RpcACgkQi9gubzC5S1wxsQCeKI3eJH2RLpP60M1uhMjNNOE2wqgAnA9GAOgdm1uR
+wnJyy9oO/k+m8u3riQCVAwUQPdxHXZrNPMCpn3XdAQFpIgQAzv8Sg+KAfH3mfPp3
+qyfUgcP2gQ8fpkEvGKCQl5xIWuWu+x4xK5CDLI/cl9xS3aJxG/0CrjtxdDE/nriQ
+Kpqyy3CXgX2QMca4Ud1SQm/Ij5mJqzpxungBVnvgXPH+HGyO8WVTb+ehEalKOz9b
+dtXNrxzBdjzAYTD5ce41Bwl+XmOIPwMFED3cR4HdumS6LDEtLxEC1EQAn3bSMKFo
+Uy0Qbn1AMQETscj/d+c1AKCloVdOiAlxq5UolYRgq9zX0w8mjYhGBBARAgAGBQI9
+3EoeAAoJEFWR4sBmZMB4+ycAn22HECjtgHXC7u9Ky74S1eqAkm/dAKDCQ0A++NEq
+D2UBVDX49rj8YtcZh4kBHAQQAQEABgUCPd0NIQAKCRD3E6h5EP3gdXIPCACak1UE
+LD9x7+rIZ1EhTRrgZBy4o7yj7xMMUzGd8jSmjjLyz2pcUA7WL4+qMlgtq27ZNb7V
+dSeJpumvlnYDU/vPwJwgAlochQnl5CfYMVlnjrHnmKaZD9N4m+53UgabFm+N7yip
+bL8MBs/m3K/EaRosNwRZyOfjbC688jV9mjj0//fHlBzj9DAjqMDoNpIMOnZNkwPd
+2lsW7UHNWoYq14j0BEWNjtduvgqb7vHavOfUr9CDa/kEeFRkxWkz0uFMAFdP/nw+
+5yMtMwqVaE2bhIBRr4/vqkejKt4ZHIhhPI8Om65ERrdp6Dd/LM2+nmqBz8YHqRuj
+LsjM+YoxkqlMJoriiEYEExECAAYFAj3dIzQACgkQizpgHwjJdeX1hACeIcBnwo0C
+ZpwKg8iHUuh+E/bfqdgAoLPwaGaaRwPMNvluSV+PNdLZ14PsiJwEEAECAAYFAj3d
+MNQACgkQMaY9luwUC4GJ0AP/dFH5CtCF/FZrHNzX2sSQRtO0szMd7GFc5DCbD8yw
+ugDJBiS3a2YU8LcT79JW8kA6UL20EokQVqCmkVdNaUVaFRxGITwcGJ3Kvek6DK0c
+UoWI/1R3B5INg5LAW1yfO74nyiZg6JqdZl3INbxDL73FwlZj79j7gSo5eZcolmuu
+cheImQQTAQEABgUCPd08mgAKCRA+j7fy+INB2e+cA+dwXZgI8S+Z0P5X7eqg1bWo
+lrq1DUTwWLCYq9OctBwrVDQkj0G30hBvUAiv2aXnTbtn/itcEA+eQg0cA9/zY+RA
+a9mVVXdewFqI5GOkoVkivGzGpTdhNWrDvMLkK40XyIgoaT2mhxe4GerdVNA86Oyn
+QNB5QTY5HEetIhK797kCDQQ3vHaGEAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bx
+brlLOCDaAadWoxTpj0BV89AHxstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJP
+PT2N286Z4VeSWc39uK50T8X8dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrU
+GvC/RgBYK+X0iP1YTknbzSC0neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVb
+GI2Ou1WMuF040zT9fBdXQ6MdGGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcp
+esqVDNmWn6vQClCbAkbTCD1mpF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAggAosBU
+cLsuvpn43c3M9txCs8fPDzeQL/0HGpcjNg2EaETggZJf8zlPvYOWMZgT8y64C86m
+PUIILYh2wcZX+SXaETfKcxN3iVvMCjr/BOzUQcIOvUWyR6vpAj49MGvG7PLodbai
+iIWmY6OCeMhQlnpMOiEGjyB0wnH/ImgxC/2Bppap4/Wl/kevVojKgS1V9zCHplI3
+3wmFaqPPYKV7jtlCyKYZY2jTiNjKourukAV/wXR7QgujP4NrqoSGQWXgXBWlEn+S
+Dh80jZoXuz1t6n5Pv7iY8UaFUzdFUQX8PipHWRBmX3W0WTZBbfONKI9qoswDp4zz
+7JV6y5fVnvNKUMnAp4g/AwUYN7x2hjRKhE11HX8nEQJ97QCgtVUJ4AhFQT4j6Da0
++DR0+1BGPD0AoPiJO6zeeh5I/4g6m5QHXjeL2raZ
+=qXzK
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+pub  1024D/6D791A41 2001-10-26 Greg Ames <gregames@apache.org>
+     Key fingerprint = FA51 765D 3CE4 EB83 BFE1  BDB7 605E 165A 6D79 1A41
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.0.4 (GNU/Linux)
+Comment: For info see http://www.gnupg.org
+
+mQGiBDvZp3cRBACm75cSDrKQCCGZIv8QL/AvcNMidSpnuZn1Huvxq28bgl1eh3br
+2JHBb8CYh1ijUNk9EQeB/fl6go8NiuWeLLVZkJGnqQRZSVGe+ukpZFLPFGb3mgGS
+lBmO/88gQ3gld5Cfumy7VRmMA3EtLCQlI25h74RcPIw5Gzil7pSj9N4JywCgsLDR
+olk/+Y4kTdHW1PTt0YbBETED+waq/aICopOLAtEC8W/G2uexi/m+FPXWwM80Mkxh
+K+2tjZX9oxzQQ+/GDeFId3q5NbSndscAFMq57ZI9/daenkdGLQqG8gaO0Hto24dG
+YNft/w92i5beYG0CPJoIFspCY46GeYaV0HoKaRkLVfcxXqN9UKvKmH18HhO6GO27
+idRMA/4l24wu/Qbp20PvEKTEAsPWQSfUjtbMECUdpmzC3/ZG6SWO1cICV/b+QlSC
+p5agjTesvno7GJC5IVs09RAkW6NmX4wVLY1LROPIzCriJKoKfgEeJcEqXPZu8q2R
+S3U2UPe0PEzzHjdWZlwps+iSr1qafaxRfZsnUXMU8X5KsV6GFbQfR3JlZyBBbWVz
+IDxncmVnYW1lc0BhcGFjaGUub3JnPohdBBMRAgAdBQI72ad3BQkSzAMABQsHCgME
+AxUDAgMWAgECF4AACgkQYF4WWm15GkGFuwCfaWyKPP8/CtIqgZkIBxUB4QqYwiMA
+niSB7MFpia1iTSSLg7e9dum5wrasuQENBDvZp4UQBACBHtkysTqPXCHqzsr75CSL
+7SbdmLQQamlMxw0crksTfDZyPIr6AVfZcojd+EHO/6bHU270FxuIwfR5n2NejIIx
+oZzjkTJ/TAa2r5qFy1XoUMnodF4qSNPq/JTajIaHXTSgNtPfuw098h3ommZ8XGSh
+OMEovonFFjNNXYCHeY5EBwAECwP+OJdDyBkt9r4Zr/5mbhsQJ78TlKhDpDy094zW
+/pHgULSEsVKbGbRGcDLYnTZ8Hjs7pCuyGy7uaCuWArRrnAzP40LNHEao7svl1VmR
+wZFsisZ10D5kRB8MRVh7ckdOqxq/lSC8AfMBaTmN81Z2ljMWQ7SEvdCGq5OU2wn7
+O59wAOmITAQYEQIADAUCO9mnhQUJEswDAAAKCRBgXhZabXkaQSHkAKCUveQ2Ews0
+yTd8V9Co3kVUq0E02QCfccreS0fXB9D57p8qPvXRWvJGiRs=
+=SVx5
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub  1024D/E04F9A89 2001-04-03 Roy T. Fielding <fielding@gbiv.com>
+     Key fingerprint = CBA5 A7C2 1EC1 4331 4C41  393E 5B96 8010 E04F 9A89
+uid                            Roy T. Fielding <roy.fielding@day.com>
+uid                            Roy T. Fielding <fielding@apache.org>
+uid                            Roy T. Fielding <fielding@cox.net>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.1 (Darwin)
+
+mQGiBDrKHnYRBADjqUE4qp5WS3rI51oKVZOMLPyYI8lNwf8NwJ6LwfquU/DfiCf3
+K4CWKej721VMgT3zkd+PK/hGl8XpKGZIZIsPyZnvUOfPW9k+bxn3WtUiprwwVvBi
+3YLOpKcubthMg9+Eh2IweR6iY/Jeoj8hk9+B1Yd7vq/Y1Dd6Hrn+NsqCDwCglzPc
+5hfMjdVqU5l6O32udxhSRR0D/AgTSYi3PXJvJHzesRPQ7BMkwwxpl0C/D0WxRvIR
+LlI6zAEgk5Du/JrmHqC5GCE7TF9gqM9BNCbJTnMupIMxM8hi+JwyhUqrpTEgri8f
+OcNf/6KoaU+SeHMhxTR8Ji+n7Nb5ohYn+qRUnyLZ4i27AQU3IXOgmRgBhrlOdQyD
+8zOsA/9/5YCQKeOUZscFSxk5V+lHAaRTUpUuxQ7CglWw/6sFZ8OqSWkYKB/+5C2f
+uBAXsZpBsN9fjlIxwJJJJLT0nowlRrANg/h+QComqo6ddRbJWImrUah9wo+arBZG
+nmFAFRD9FUjRJfllnQ627YivQvBda2/RSRUEyr+nPkUfxE4q3bQmUm95IFQuIEZp
+ZWxkaW5nIDxyb3kuZmllbGRpbmdAZGF5LmNvbT6IXwQTEQIAHwUCQY74bgIbAwcL
+CQgHAwIBAxUCAwMWAgECHgECF4AACgkQW5aAEOBPmokqrgCcC0KoXTZwGMuUEv9b
+c2ddPD2Ggd8Anj0JI6lG+iLuXusECs0Ipr1XQLxLiEYEExECAAYFAkGiWWkACgkQ
+BJfVkRK/55pyngCePS7ilC3pXrOMzwUCI/DQeCMoga4An3cgD0t6j2/T8nuB5h67
+Ze/LyaC1iEYEExECAAYFAkGaiCkACgkQMJF5cimLx9CgmwCgk3QCimNqLIcic0CR
++wNgBgp+gFgAnRixBUNQ9GLqJJWKbeMZ7b4i6TwfiEYEExECAAYFAkGalNAACgkQ
+yX6cq3d1tHkmjwCgrSID1cu/xLIAA2ehOm8NMYWkG5oAoJzSZh1lT/kRwzHLwd+/
+IO316iobiEYEEhECAAYFAkGjAgMACgkQB2FzsZKExFKnPwCdEQRk8+Z8n8IFnhQn
+1T6jXM7GLLoAoIP0sSWpQIs4z7zhRPjCqcAoKFnjiEYEExECAAYFAkGalnIACgkQ
+XP03+sx4yJOmCQCfTixepfWLoiTqs1GTz6u737iP80MAoM0TnDk54Q8CbWYJ/9zY
+6PCBwr6tiEYEExECAAYFAkGajQ4ACgkQF2rZyNGqiWJE7ACdHH2D5KlwbLgUFKzp
+zng9JRU6hKsAnitj4Shya0KoWQPiNkFHgB0CX8ZHiEYEExECAAYFAkGbzpMACgkQ
+XUFK4eAFyct6RQCfWQcbqL74JP946GValnxfJhhsQmEAnjm4jWAWWL3KtfXeOCgV
+MbBhL/a/iJwEEwECAAYFAkGZgZgACgkQMaY9luwUC4FfOQP+K20bh55JEs49DkMM
+gScH6P9DsCvZee+MNhjzLijzyWrdnMCRMEb4ye+cdPQxD+M+Wl0iaO61AMMqUCno
+D6DDo20hhzU8kn5LneOJ93pcz1hjkpzof02FG+2sf6B5x/BdQshgL1ySiXrPb74q
+s7gKuybtDtkobLRnKPuSESE/Lk+IRQQTEQIABgUCQZqKSwAKCRD8D4WJ+JS+Enqi
+AJ0XZi3M3rfMuqe7tIagqiIeIlrm/wCXcrzjI78YE4XEeThe9a2kIIdIOohGBBMR
+AgAGBQJBsRgPAAoJEN6ihzgyivIERxcAoIuSWSOTjocSQyedzgDeTDEs9r4AAKCo
+F4H183O7HWf0pomjCRQh/4f3RYhGBBMRAgAGBQJBq3mCAAoJEM4BpH4cQ9hQk9UA
+oJmXaSH3C0f9RfNUWtbM8TPBLoB+AJ4qqFgkYYfkDg9Cij28yyMa82tQE4hGBBIR
+AgAGBQJBujwZAAoJEAEFZrzkE2OSx9UAni1LSdTKkDgpDcGEiAlZ1WpKQmAaAJ9W
+Um5hl+2qSn/AVaMvGsp0XtgYVYhGBBARAgAGBQJBsBhLAAoJELK+vEAVKSSvVOsA
+nAgKhSKJKOI3uBTfP1/blI/04BwzAJwPuS+s8QgwTUkxQWicyrq9pg2XjYhGBBIR
+AgAGBQJB4viIAAoJEEzETQAR34fpsTMAn3DvE1Esp8Wc5JH8uaVjndouHtSeAJ9N
+c+wBHb+a5/RIZAJy1Jt2Nfl0tYhGBBMRAgAGBQJBzkgcAAoJEME58VMjy3oqokQA
+n0doBXF9FSeMRZV7u/ERU0n3qrVWAJ9ddFnxQU6Kra2eQpuBx57oPqoHAYhGBBMR
+AgAGBQJCLiKFAAoJEALjkFHlgLNjWywAn08xy+7kZwLdHaFi16sdKm5oxsKuAKCm
+r+MA/c7dvOb7f4Fh2vu/l1ITdIhGBBARAgAGBQJC3OR1AAoJEOyrDnuD5q4NFxIA
+ni0tkRV7SDBFmZ7BhbqSsdpmLxo4AKCu3nRFWT+6MAY4v4JeTm8MrV7moIhGBBAR
+AgAGBQJC4NkeAAoJEIzjdrgc1IYfkMQAn0t4Kh6txi12LJSkr4mc0P+AhQ75AJ9k
+OjklBQCS7C1hlluI+oGhlLwKTYhGBBMRAgAGBQJC3rBQAAoJEP1viMYh0KcbHu0A
+njNACpi5qo516Ohk4EiYmKFsNO+OAKDsu7NVsPst/s25q4qGT1H2p49kGYhGBBMR
+AgAGBQJC3rqPAAoJEDLJ5M42QstLJsAAoLbRG9j6wci/e/oLkYTbJpaRWlVjAKCl
+cvH1xY7KUnFRU063pqmJufzpsohGBBMRAgAGBQJC32zmAAoJEFCOrsUwLaVoI3IA
+oL13PvN9g6/ApleNvcrGWJXlWqn3AJ0RbsVM6fCpYgsdsjE8kyjU/S2JsIhGBBMR
+AgAGBQJC32zpAAoJEN26ZLosMS0vRMwAoIV8hheV4kG8fp2jVYr47RzWFvxbAKCv
+8O9RmTGmEd1BJ4NPJZfcU195WIicBBMBAgAGBQJC3seiAAoJEDfj9F/uZeMhyKYE
+AMoJv8QYRTXgpoUnT/IG34i4/sxCvL6yUmaMJPUN4zE/VvVpSb4gMHwVCKg5+fcg
+7OdyA2OG405nmkvCCZSZFdWslifh+smzbYLSTKWMaEIupFFntKH9ynOLXjewoSux
+lY4EreMrxqRhTdXXaIpzLw86hcz3rLptfvhyezFtIOPGiJwEEwECAAYFAkLfbOMA
+CgkQms08wKmfdd3jiAP/RHxhO/f4LLOaSPnVENjNK7st8D0MXHDXbDQYerEmJwuz
+7DT+uup9Sn/3NRA27vtDXJ9UgwVUYuuO2MJ4Ij6U+RbTcGwh9WElnACOaXKhv4Xs
+pdt8/7TA5BNcHL72RYzY58oj4hHN5WfyIO6kKa1TE+Ta+T/QHZOV1Hk5jQfIXTKI
+RgQTEQIABgUCQuDsuAAKCRDJtabs4td03wPaAJ95/ud8yHueG8HminBF4JB8BdYb
+lgCeNp3z89IspuW5AXQ85pIMeJF3U2y0JVJveSBULiBGaWVsZGluZyA8ZmllbGRp
+bmdAYXBhY2hlLm9yZz6IVwQTEQIAFwULBwoDBAMVAwIDFgIBAheABQJBjvlFAAoJ
+EFuWgBDgT5qJ0sAAnRsrrqrOFCISuF4mRulEeGXclRjWAJ9IxE/dEuR54aRjmELH
+2TxUFg/T3YkAlQMFEDrKbLcbCAxFJxmvNQEBvdAD/0pvyvL/ZC0GFpqdtApJX9eL
+yaR6bDkfNh/OrnFYu0s7Efb2j6KMFef9fx90gJ3gRSJj6ngX5eY4uejUGLoVx7aQ
+qJZePZedwy77uxEyI+SBlVJU8ArsL8ZjR2M/4TqSbw6+fJ/Y2KZECmoVpz7tTgFv
+eWNZxXKDbNkAVLwRQT+OiQEcBBABAQAGBQI6ynZpAAoJEPcTqHkQ/eB1+gIH/055
+hND4xOZqJo/+5AgkLx5f+M164bX7/WZVaSIDZbYF3AwCejYvdxh6e9wJ8ZP3ZyID
+jNtAEwZDCtDWNPUod5cgO2bVtQmxbIRXi7B1Wo/IaJVSbdmbWfE4exXiOumMS4n6
+oDYGOxVqUD4NkPbc2RxL9dKpF22o8+VUMwFOrClsb9X0KOa6FpHetCCyQnxsySbk
+wsT3ATCa1lpkaoWOCaAIAi5lH1eaxWvf4PbChH/E5NknS7y2a+duAZtZSKKzj6MI
+MpdiAk8tAF8wlvdZ8aN7BGFmX90evFcw+U/oHODlFog6yGNZIUx70TPVR1zdhgxw
+aCUmp4RS7vZA0tI8aBSIPwMFEEBfU1zMsutG52z20BECzRgAniaAcrtVanVO2Qrl
+0s59C1Fx+um1AJ9aB64YaNz6AYZgKfF+hsIldgp6Z4kCHAQQAQIABgUCPdlGwAAK
+CRAkDmb8xZwycPc5EACzRyV4vUKrRtXKx5mdnQ0IHx8d3x/qcIBQ1Y/2QM3LU4DR
+zeYV7fV8TIv3iBfxd1625BOx2LAbQ8ElDl7PLD4E/29dB7MwhtYJjqurR5yOh+6n
+nWcvJoz8owR6hS2DJ/i03+A9dzn9YpQRvmMOnACVrpL7IZZ2V+Kqk4TN3G4LGSfd
+LM/vpYsb2Ghqr5MQ3/F89LxuJZn74m1dCvCwBAoJf2RQlNesIb/irMsfU7Y5Fs0h
+5HHONNdiwTGIO7VEHyWvJlQ4rMSOp/rAw8k5uAdgHK6SMn10ogEj+qKUOcnHSeqg
+hXnFBorhHdb3Qmqc2s30b/YtItk5EIyXsARV6mdr55wtn0hp3wX8d3ct0zcMsYsl
+IlNuAXqQUCH2NO7Yjz2LF3K0A3cBz+PcXGjkXD/bUPsZG1DhbDwoxh8YeKGXZ0k4
+MKeb775EF5jgMT+cArHqi/OLqs1OcJNjYy35+plQSMSM0BPCdk7P+bcf4YOGRDei
+AukLnA+Dkl1CAzBDhFS9y231tLfob7w9CMoAXXF+E8mAG0QuLpVMta/JgMiOx3O7
+xs5t5JWOMIdv3FA8tSNdiviA3DIr1nhphoLu0mzGlD4W1dyczh5MBx8kCYgS+nS3
+ASd8NR9OSYuelOsRn0ykyThbVaewnY8VrwUsmp5JOCXAPWj2SOT7KQNmRa+GPYkC
+HAQQAQIABgUCPqRYcgAKCRDNY9HdhPkmT/o2D/42zg5Qwy77OvS37qEO371dsJsV
+IUSSi1lb9s8+GlwzyufGdlFkhgQ67q4vI0esl32DrdXwA4aVfuwp+HXj1nTuW0l+
+otOnvtt2UWtZgHHlVl6LLfGxMM+Ez1AaXym934adTRwoJ77jqeNO/G1t/Fvh8Cws
+8bM5nIOvcFYVFEF+67DFsNgiEjKztICy/0nNSWOE07vWWOXXsQacLemPRsG/zRVd
+45BNib5rBCLQFLqA5D6FXO4PLXCNb1ltsJENs/mN+MseihtQ82h2ENALOEiDCuOi
+f3D8bX8ZY+BwLbQn9iROzalaj7OJIJitAGfOFrdvD2Y6cZ8puakTYOzmBALPmSzS
+kViEMrjnUQoTxSK9fu9DCQ/UfUpDLuec9rCPrsJl2cQxW+rZ9UncxaEq6soa9ccZ
+niO2y+0R5b4hIOIxO9quZnYwHwdE9bIeEfjAzAN3vCwQh2VEkaL45qpGJdenwcc0
+yiayliiYVvt0PA63F1Hg7fpirLceJNtWW3u8Thiz5RcsDx0PxTREiixjhTPtCc1X
+Trv3QPR9QgGBp5W4Zd3xYDLrAS8+2ddlLIobWK7YEsr8s7aNce26FXwJRnnPeZL5
+LUkCXXiIJ+LZAvyWnVEOS1qNtE95HSTVZkhkUYxDf8BHchuRIFvlIVajKz1CuP9x
+mvu7WjsV9D4weEcJZohGBBARAgAGBQI9e3QXAAoJEAkiEpbxiQSLJXwAoJ0zFfYi
+1mAUhrWxvZW+doXeuDvxAJsHdbykofeTkQtvD9CyjO0XdF2wqYhGBBARAgAGBQI+
+pFcNAAoJEDGGzQRPCfBVWkMAnioUdcTH1PuioPpVojukOAeUH+AvAJ9EXXfWIgsa
+tgzCTDaPFs1lzFqe+ohGBBARAgAGBQI/whdoAAoJEInYTK9GsmLGTyAAoIVutvAn
+c0nj27Rqp+EYbx6YsbsaAJ4p7w/+fZjEa0wsf5Hy1r82UxHWg4hGBBARAgAGBQJA
+I7WkAAoJENtdJwgR1Yk9XmQAn0rLEaoX4IpXbDbVM1Yxf71vvgVZAJ9XMdPdVtk1
+LpDO4qv83rzLwWwo/YiZBBIBAgAGBQI/ym+aAAoJED6Pt/L4g0HZQp4D50gsuxjD
+1o0ZlS8sNxNhZHgaxohzBTgavEIY2ltnNUxshRdMtoBMx9tVvmZQFI4Dil57m4WB
+9fE0eMI5yQSUcVZd/Wj56uyrb4xwcZfWxU3k9uChf/eyqpEtH/V50DLdK1WUgGVU
+ndcWSNAPxKgCd3RbUxAEZx7B9zNf0I5GiEYEEhECAAYFAj3iURUACgkQiNfNvfQ8
+L5IdLQCghH3YKiAJRmA5vSVPqcDrGY2/jmgAnjBuzJlZtfpu7Q8twmFpXf2Fcbv2
+iJwEEwECAAYFAj/CgYoACgkQN+P0X+5l4yHW2AP+NpYD54gNj9Ll96pKXeEH7+Dl
+XNmeZwQSyY5F9V4luQaO2Qt15O+YK9eHOMnb32U2bwOo/LrDuraC0L63EOFalkNU
+TkRHXLrt5uZc6+Jz9KhoxNcv5rtoIKsi0p9a06d6yx3ppkfZHwqIxdAC8YRAvyhe
+WeZIZi3phb1let7y3F6IRgQTEQIABgUCPaRG0QAKCRCL2C5vMLlLXJtyAJ9N/nWN
+2dCv+92Z697B/SSJyvoLvQCfaI7sopLLYw+aVPdj4vykTZIdwJKIRgQTEQIABgUC
+PdiF5gAKCRBmNbbA3ohd0+P7AJ97IR6ryjBehFyut0EboKhdVN4mtgCgrwnqzg/M
+f/+142L7aT3TeKYKfKCIRgQTEQIABgUCP7ppgwAKCRDLMqEHiMOlpTTXAJ9GxCno
+937c9EpYtek6c+RkrheWNwCeKWKyFYAjFklOk7J23KII18XNq16IRgQTEQIABgUC
+P7qSXgAKCRBc/Tf6zHjIk9T+AJwIbe3CG+SZEyz6IliuRTAs3R3V1ACgspn53noF
+uYBKawQvI5718Di+BpWIRgQTEQIABgUCP8HFwQAKCRA2FSLXgqt70U9LAKCoGLVF
+3oBqemNHB/VMvL08pmRT4wCeKr1wCr+vM3wjDriHf5Xx6FEoJKuIRgQTEQIABgUC
+P8IaZAAKCRCJ2EyvRrJixkInAKCF5uuqPNCP1F+m7z9fR/nIJb3qeACfRcJhJmXY
+lNNLonnExeQT0hjOYYaIRgQTEQIABgUCQBXUSgAKCRAVP6DNdaZ2kndiAJ9eTafo
+NOGtPDsjQQB/LEpX8Nqg+ACeKEqMt8CgNKCBqQE2DuxjUOY/cjyIRgQTEQIABgUC
+QWVtyQAKCRA7KW1RzBhaO3XNAKCyI2RhtJ1IFIjJd8STppArFxLjSACgkL809tt4
+gdjw0ocpzW/9OzY+QQqIRgQTEQIABgUCQWVudgAKCRA2Or8wn8PVfj9EAJ4ltkHf
+zOrj1LD83ArlaUPP6Sy9eQCgqIY4Nsnrfb8h3J1tgQUPDxiQH6+IRgQTEQIABgUC
+QXA6EAAKCRAPkZbeblLCnjRnAKDlCfbsdTR+la6YbpNf0Aq0+DH3xQCfVuKzP9Ws
+0sSX3UklvGJAYMmYbN2ISQQwEQIACQUCPg03yQIdAAAKCRCL2C5vMLlLXPO9AJoC
+/yIz2xDEryTy37M27KTIAheuwACdEskgLXTBtz28QrFmPFx2OVg/lT+IRgQTEQIA
+BgUCQZomGgAKCRCLOmAfCMl15W/YAKCtdn5CG/LaBJ7DjRV8N5XjK8JxggCgnq7S
+lDL+JQGB6LRBL5TdcXas/teIRgQTEQIABgUCQaJZaQAKCRAEl9WREr/nmpBNAKCl
+/IZ+aETlq3NzYHkF0KSdmIrvKgCfSjDLzQWgoUDTLX0gxfXh1+0X3PaIRgQTEQIA
+BgUCQZqIKQAKCRAwkXlyKYvH0LwOAKC2lY8Ulzv7vv91eORNdJr4GRNAkgCfZJgR
+MWXhcilBCSKpKbQhNWbNBdWIRgQQEQIABgUCQZlVcQAKCRDJfFCWXBw61y6gAKD2
+jC8aqDOejUjA3krguJUQcdTvawCfT20bNihqtriktT6pjZcSLRJAW+OJARwEEwEC
+AAYFAj+/wGsACgkQBurPqnbYPMYnvQf+Mgvva9ljDjZXI+kLdEnPA86EHnANzh1P
+4VnC0a0Eq4o218U6C+9oUekhwz4wD2jAZUdoC4qwDtrFtHh76hDycfxciw7QgTbi
+LNKBD82a0P+ZuMFL6omfBzoeBlvswvvg/G+1LBSSPJTHV9nOpgoSDFZcKfrcX819
+KrKxeKGJXUIbYsOhX+PVNSGzPkNGjk+8jxWM6SiueIpQUJTQqa+9eKcR8/YuLmyG
+RhJMQrmJO8/wRFqblkOwASta18bdgYNHDpQuvRWgLhqHLM1P99AKaP+qGmyXP2qq
+DMh5Zy9TjRo06O0CiGPcioQ5PDDxrqnhqxEYQuwrvXJDFSvuj7BCqYhGBBMRAgAG
+BQJBmpTQAAoJEMl+nKt3dbR5MbgAn0YbFWKhffr32B6yuApTBZdXEkHRAJ4qqFjW
+qgYqBJx8XS5AdAY9dY65n4hGBBIRAgAGBQJBowIDAAoJEAdhc7GShMRSdakAn1TS
+35CiLVymIbX8h9mP0a/6nog8AJ0eibyHC9WX/n0FRiGrjvlvL0eHP4hGBBIRAgAG
+BQJAMBtjAAoJEC6L0IDMac7t4y4AoJhqI3bieTdIsLXoAkHPNQRljxaUAKCEgjL7
+xBbbcAXM8x4RiRmWZY2uy4hGBBMRAgAGBQJBmo0OAAoJEBdq2cjRqolikOwAoJbo
+SnWnLET+R/tlHslqWcek7VMIAJ4rrxd46qybfMYQHrrV6OtCS1v4w4hGBBMRAgAG
+BQJBm86KAAoJEF1BSuHgBcnLJdAAnjCisIbl9GuHD9qyQC5L9w1575xLAJ44OKIf
+WenBu2WzkBW32n5EnJ6pgohXBBMRAgAXBQI6yh52BQsHCgMEAxUDAgMWAgECF4AA
+CgkQW5aAEOBPmomWqACeNI36SXKcu0TyZGCk2E9qSU6Op1kAni0/pV25oQZXiEzk
+pFjt0Zvk6AXiiJwEEwECAAYFAkGZgZgACgkQMaY9luwUC4GhxgP/czUSd2of63/G
+3ldibnJrhUDxV3tHkkGkmi0CfwNf2LxE2VNwmw+ZZpptz0G2j87f/jBv+EBaPSRV
+yIbXe0kBwRwQ+kiTiIWyATPNN7yppPWSkyyQA9UrnzMzGa4fKMVYN8iNi0xG1fRP
+2WdVgGsz+rcOmpNo8hW6jo/ryNSXTD6IRgQTEQIABgUCP73P3wAKCRC+uiuH9fxL
+Qh6hAJkB/2nKwGgFeFEtt1cLtGBb1bsEAgCcCtguj2Eeqt0zMkT/ZBFXrwZryx2I
+RgQTEQIABgUCQZqKSwAKCRD8D4WJ+JS+EmvcAJ9N3mAC14G6QJaPYb70PnxkHjoc
+dgCfWC3ka9sEtarAymMa7MVdUocN0gyIRgQTEQIABgUCQaF9VAAKCRDLuVBj4NR3
+ba8IAJ9ixzfPZAwD5mSqmXtlW6tmYWEpGACglCCsKNik7J+wNiD1kxsRsgqQmaWI
+RgQTEQIABgUCQaVY/QAKCRCXZ4pyLS2qUrsmAKCwtWTP7YGz/T0P2IsUNByypl6Q
+2gCg+heYYJOVlGCLVfd/hXOncYKduNKIRgQTEQIABgUCQbEYDwAKCRDeooc4Mory
+BKMZAJ9q2Qrztrh7kZm1g2YhZVSHnVRALwCg3e4qeKmDQDPC6A+MEjyRzP7Sp0eI
+RgQTEQIABgUCQat5ggAKCRDOAaR+HEPYUGjcAJ9l7+VtHy+N1GPZXlcycSecdVCD
+YwCfUUytcVT9mzlkKW5SYDFh4rG23bOIRgQSEQIABgUCQbo8GQAKCRABBWa85BNj
+kuruAJwO+zspSq1zjUsQR2raH4pZ756xSQCeKX/+pYQYxPjDmxcWHcNbUb36PHyI
+RgQQEQIABgUCP7+tlQAKCRCyvrxAFSkkr9upAJ9NykpPMb6dRQ9FqwvweU/JXWDl
+GACg5zIfIAa9xAbqnCGziPwyKHF80PiIRgQQEQIABgUCP7+txAAKCRDBHntHlk8x
+2YmVAJwPRpDo/Nd3G3x/H+PjEOpq1QTFbgCfZ3O8gup1FVTtBlVEm+A1bQ1UqQqI
+RgQSEQIABgUCQeL4iwAKCRBMxE0AEd+H6YdpAJ0fVSCcrYcHXNGL65AsRr+6q197
+/gCfcKJFL6ZjOQ9jTju4XZ8HBoOQdDuIRgQTEQIABgUCQc5IFwAKCRDBOfFTI8t6
+Kuk0AJ0W/8WdV3g5G04/q6KODnQeuRBjiQCdHIGVdz3D096jg4ecVFkbiyVbS02I
+RgQTEQIABgUCQi4igwAKCRAC45BR5YCzY+t+AKDq8sy+taTxZ/Xlixt2U1A9jJF0
+lgCgnKQ4szOAerQOkkUH9KtVH0IBWDuIRgQQEQIABgUCQtzkdQAKCRDsqw57g+au
+DRMTAKDMYhafsynKXcWd/TMpNLLFTYSoywCgva6DByBZUrSmHQ0RQsrREUXhrAeI
+RgQQEQIABgUCQuDZHgAKCRCM43a4HNSGH6IVAKCqzk+V4RY4iKcXd+q4gDEU77F7
+7QCgpsK7JxEBCcZLAwSu78+v1Sd1LnGIRgQTEQIABgUCQt6wTwAKCRD9b4jGIdCn
+G9d2AKCOg8hb2mcwgTrwmdw3r/AlCD4kDgCcC/tJ/L3m8qxXeWPnqSOfYV2wuR6I
+RgQTEQIABgUCQt66jwAKCRAyyeTONkLLS3tNAKC3fajKlLewGgI19nqLS2gCpUZ1
+KwCfQBZ6gQ2fBSyH0GM6FUwQMpC1+wCIRgQTEQIABgUCQt9s5gAKCRBQjq7FMC2l
+aF77AKCugNqDPjHcOQMT+SXb0mOgUIVinACgg3m8nB/umwcl0rCjj4dTJldECuSI
+RgQTEQIABgUCQt9s6QAKCRDdumS6LDEtL16AAJwOEHZyEsnlLhZ8EPaDR2l+DrTD
+WQCeOUP6WWydX0oScKgxvrxQelD7mXaInAQTAQIABgUCQt9s4wAKCRCazTzAqZ91
+3YNEBACGZdqQctLIW89il1EOTdaETEFiBOZIgrTuMtbaLKCWjVLEZhRXwP7YOmG1
+VQ0/oareK36O0J+0dXQ/datCWbq7nKg8ah6v7OgsoSaL4SDbkXJRomJouE5+Le9p
+weASnNSnzXDI3iT4/VLNziNS+Px7MvprZfWqW7EtrWcZFNH8u4kBIgQQAQIADAUC
+QtEVQAUDABJ1AAAKCRCXELibyletfP5lB/9hCdsNGnB1hEFuC2MKOAxXyii4WUSh
+SZnAGU1KFmgPR1VT7ansRcfr1M7kAWadgbvZMKpiMfw/YUoDk70S+HV33klqYaBo
+G/ys8tlpB06wXLBgOG/ZXsgXVcfV+gKhBUHJ22yFyUGpwUE6841Z30P6QPEnGlnl
+OaYkj2Bzsu8oJ+v1zPjQMQzbWXflg/9qVm6GSmvkHi71uExVd9mmyXriK7AzgEkg
+fRjIsHgaHRANQgEHXpQIYb74jigpaZ58/iPsBuaJvtkU3D7K/pJh8ykVl4iogY2Q
+v1L4iFpwzJ8moXFZNl6/8WQKyclu4hvetUjqVhdv+TDnloY9IfBYzYSviQEiBBAB
+AgAMBQJC0br5BQMAEnUAAAoJEJcQuJvKV618RZsH/04shIbSOSb/oGQBKp5o/jZf
++y22LiOcvYuTFNmW7sC881yyWOAOXzvNSiqpLVBv+nPbNX2Zhu4JFKAcx+iD0E27
+8LuQwHt+mzYHg9jIacDF3gMPVMNUcWkdDcjilU8F01VuLe+EbtzPAv3wzH71njl3
+vp8hRhtJQ2Ljxd8rwtVmY+wj82+itO62bBI0R4jbPREA9FQUzqqlU9e37F5xyHeE
+GGFQGUaNNnU29bvZNhooF3Bp5n7nRbub9NH4NgoDSf4LIUhcJv5iExG2FgnnY1Ge
+1zEs2hjLlF2XEDaRZzuABDZkL4Cb8GB62YQIp+1sr0j1V+0phAKhuU//CfBZKp2I
+RgQTEQIABgUCQuDsuAAKCRDJtabs4td032/bAKC4/52AK7s02dRiB9TEyU1BTtIy
+jACgj0K7oUN3EdbRpvq4JztHnOGYNKyIRgQTEQIABgUCQuDtLQAKCRA39o/1AVr8
+ihrzAKDtlkrBk5yLVlFmB8cR9kXRdjw4CACeKxN8s4YBIhSi+dogdt4aBUz8j2q0
+IlJveSBULiBGaWVsZGluZyA8ZmllbGRpbmdAY294Lm5ldD6IXwQTEQIAHwUCQY74
+FwIbAwcLCQgHAwIBAxUCAwMWAgECHgECF4AACgkQW5aAEOBPmonYRwCglIthafvY
+gHvdYcvlQ42kkh16xq8An2KEveQwXY/rxzIfVdQOnXaPEMbLiEYEExECAAYFAkGa
+JhoACgkQizpgHwjJdeXLRACglVV7g4bLAU4cGCtVk4tAmZXpJo0AoJB13hnyxZ8L
+YaDz34DLslck+NjuiEYEExECAAYFAkGiWWkACgkQBJfVkRK/55rWlgCgop+hFNtg
+2mgo4QwbNpekeoF9+W8An1NNDP5O4HefD+V29AI1bPBkFo/AiEYEExECAAYFAkGa
+iCkACgkQMJF5cimLx9AyBACeLg3ys33NRvTcf5syppUh+9QDM6kAn18oB7U//NvK
+C0UzaU41suy0Gp7oiEYEEBECAAYFAkGZVXEACgkQyXxQllwcOtfSwQCcDlcuiPiR
+wtT7AQhYbMqqQt7cP9IAoKvtg9RBPm2C9ONLi1ZE5mPU2Wr6iQEcBBMBAgAGBQJB
+mUkOAAoJEAbqz6p22DzGAIkH/RANUKVj/mKV5ymNYV+2TLQdgRLLwf2Ilhh4x42+
+S9ugvOt9r010E7othLiRK266VfwhL4Mf1xT9tJolQtnP2VlGc+38URqYzr5aiwEO
+i5DKVPwZLf45Ih/+QYYaqetVCqR9QgxA00bNcVX520l2dp5nPmidMlb7SiQfLcsK
+/wUf9HV904GYzLPdNLMAo4AlPcC0ercNNAmJ7u5eR04RvZH3vonsvbLYAdv6HMew
+Gu87apHbMysxYNEFmpOTLqlo5L13DUrrcqUxA5kcu5h6j8GLRd1ClrB9JiJy+i/+
+UMGHIpPML/F8Crn/q4uN0hO4ZctuXKbMcRRqbQuPbYdiupWIRgQTEQIABgUCQZqU
+0AAKCRDJfpyrd3W0eQJEAJ4nI4H5yMJfhWdyRRY3Mk52n78ItgCfRNwz3MAo300v
+Y+akLcBAfwZVAdGIRgQSEQIABgUCQaMCAwAKCRAHYXOxkoTEUsX5AKCJwjAIDWv7
+x9NihTSYNb3ADNoPAQCeKHIXbSwKUmElwqVOJjybOSkc2GyIRgQTEQIABgUCQZqW
+cgAKCRBc/Tf6zHjIk8EJAJ4y9C4RTKgDIEfQEOLy8o8t1YL8WgCfRRLfkgc80b5C
+6bQwqgsPqVv0Q9eIRgQTEQIABgUCQZqNDwAKCRAXatnI0aqJYgsEAJ96xxxx1KYZ
+wWqu2ipWRgWGfFBnXwCeLHiXZwaFmQxyPjF0Y6/tMghg2kKIRgQTEQIABgUCQZvO
+kwAKCRBdQUrh4AXJy2jEAKCRhGu5f92Ih9S5+dwJ8LXiVc2IXACeP4/RMeJOqVP4
+2X8tru8WO/zYVdmInAQTAQIABgUCQZmBmAAKCRAxpj2W7BQLgcpiA/wMi9uNybWt
+sUkqMP51apjy7TAzY1DeR79xYyGy6E9+SWUJrUdpNQEvnCe65nMTFMZZkcuAkgGf
+aUpdxXsElt9N/cJmPyrstjRPsCINx3smRXLZfSAJdBxqfYjjxBO9VP4fc0CVsDXK
+oT9IYhO/0SmnP9g7P8SbEDIrtngZW7x/MohGBBMRAgAGBQJBmopLAAoJEPwPhYn4
+lL4S+IUAn3+70bfqGU/TxmjBV6y+UHaDr/htAJ9kS3gum+7tNmdJAqe1Ciavd6tj
+y4hGBBMRAgAGBQJBpVj4AAoJEJdninItLapSQyYAnRpjXaBU/YFfE/wzp6vo1A70
+zc4RAJ9KTuhI7QrSpjw1JCHeTxlR7lWxrYhGBBIRAgAGBQJBqolAAAoJEL66K4f1
+/EtC8QoAn3BJOW5EsHdCiTn471tOOK14QAsjAKDvJapbKzFtqjqGnYw2PWFEgBM/
+cYhGBBMRAgAGBQJBsRgPAAoJEN6ihzgyivIElLsAoJBsB4geBs+0jWI68y7B++HO
+4191AKD/MBrOIS3Is3BQieJvW4VsmPnaGohGBBMRAgAGBQJBq3mCAAoJEM4BpH4c
+Q9hQLtAAn3QUB+AdMyrhrH9Q0oxH4SXMN0VFAKCJHawjZ8I/DEOBjFPk6/VvCCjY
+OIhGBBIRAgAGBQJBujwZAAoJEAEFZrzkE2OS0AUAniHEQ3sRR6jR/7pXvLA9+sEb
+sEEfAJ4mckbMJYjC25GEYY/mshzavDq4NYhGBBARAgAGBQJBsBhUAAoJELK+vEAV
+KSSvDRQAn0Il+opfKW9MXiBtmmkGw1AooD+YAJ9JA6Y1a10IpgDiaf8PT8eNeJkr
+vYhGBBIRAgAGBQJB4viLAAoJEEzETQAR34fpN/gAniYfvgliN9PVsZHLE6lrxhMR
+IFQuAJ0QGzJtLUn2Wc4BiXb3kIFqGBQ374hGBBMRAgAGBQJBzkgcAAoJEME58VMj
+y3oqex0AnjOW+na6KMKM1oi/K9HSXCwyeTHfAJ4hSZuvs97N+Y5m7iPkr5fbXWyv
+2ohGBBARAgAGBQJC3OR1AAoJEOyrDnuD5q4N8wkAn2aRsbRUXZE4YxcWU1ShUJ6J
+/8pWAJ9oQvyzkiqk93vNJMw1hXOC3oX1b4hGBBARAgAGBQJC4NkeAAoJEIzjdrgc
+1IYfzPcAmwdnttRdoFx7LLzvKsx8gEdKKoeJAKCNiWCu71cp5Q5MGONEAmHiw91+
+FYhGBBMRAgAGBQJC3rBQAAoJEP1viMYh0KcbvPwAn082hYWUPqOUZVSVZDcWbvzj
+szKWAKCqVYxFZlWxP3ocJS1FTg8nwkAVs4hGBBMRAgAGBQJC3rqPAAoJEDLJ5M42
+QstLgrIAoIHjFAfBlsvQZCiBzEetlYL5iBOHAJ9iQfuFs/AIsuRAka4YjVgCb7ox
+DohGBBMRAgAGBQJC32zmAAoJEFCOrsUwLaVoATsAn3L1nGKnz1jIiUfZZDSQfGRJ
+sjL2AJsH7D/rc/ovbhHGoDFdHfP9WllqA4hGBBMRAgAGBQJC32zpAAoJEN26ZLos
+MS0v6cIAoP5oa2V+9TXOB+qXe4eTAiMUk3+gAKDgXYJs8iV6udwIYaq2d5KUY18Q
+bYicBBMBAgAGBQJC3seiAAoJEDfj9F/uZeMhmxcEAJCbwGZVbVmw8D7+nbiYAWdL
+4QUTm2y25Mest45jxpHj4XvNv80oLhh8UrQGMZFy4ydmi3lfQVerHl7QZ7In2hGh
+9ZDF6jAMDfR7pC54J55USf3s+PiMadqzTiIThdLD/yTeRVUn6KUv3RlCGqpfLh9X
+k/paB1V26Wpny6/A3MxbiJwEEwECAAYFAkLfbOMACgkQms08wKmfdd2KogP/aKPu
+QivvCNOg0smXso+p7RyP4imM2fnYfZKyIdztxfBCYPP02qClRBspmHmhLvNgZ+Ih
+PUm5lGodC9wYbcSurkpfRXDX8ImDBCZRJJxOmsD3qV5xQcmIJt35QiylBRrf/hBU
+yh+yeFGhebmplE9bAfo1S+B7azzdVtTCZlITCOuIRgQTEQIABgUCQuDsuAAKCRDJ
+tabs4td030I8AJ4tY6o5CNXMg85r9sn/T1XgxCf+JACgm3VUQb3crIBldo4E7ELs
+OlWKTCO0I1JveSBULiBGaWVsZGluZyA8ZmllbGRpbmdAZ2Jpdi5jb20+iGIEExEC
+ACICGwMHCwkIBwMCAQMVAgMDFgIBAh4BAheABQJBjv4aAhkBAAoJEFuWgBDgT5qJ
+GNYAnjO6NCBUeUnbCfpLr/TT+V05Ai3NAJ9w9U+xwdJqrNblobxTZofw/Zb394hG
+BBMRAgAGBQJBmiYYAAoJEIs6YB8IyXXlQO4An2CCetfVTn21dtjauCtRmqbMATLP
+AKDZtmMzLFJGQtbGUuhU1bcb+GY1IIhGBBMRAgAGBQJBollmAAoJEASX1ZESv+ea
++KIAoKGdYYE6onP/naeAMIc9Ik9FlW3MAKDDJB5Yv9rdMUGhVbqtYf4zQuBvRIhG
+BBMRAgAGBQJBmogoAAoJEDCReXIpi8fQa+4AoKaD1nsE4UgDubabko3KGfJFoedY
+AKCEF53SoAmE6PbASnDJ9Ik+fT8t5IhGBBARAgAGBQJBmVVrAAoJEMl8UJZcHDrX
+mOEAoMS0ZWF6F70fDvqFOieN6OPLnxTOAJ9aHvFmaoVTreA5jh6uh6zi8lljvIkB
+HAQTAQIABgUCQZlJCQAKCRAG6s+qdtg8xoZGB/9TcMq82G3eLnFDST6aPeoTCI/P
+DXnjg0INoWDyDXWrogLTGH4Euy/A6Az2qjWNBIE4iDT+OgeWFgGm5WHMxsAYAjzQ
+Oo0myVPJqxTGpRO319NI0Z4yyNDuIpsIz0wGWrN5OnOykZvOBRyMTR13bS8Bbsez
+gUdloa0MrFknJ/4oFquLFmoAHPeR7uulzaU2zyXvZ+k30DlA+6XfvOw7zOQaiAog
+RXfTrqEORmMpJqm6CHYtE2agnVHWnjnbCnOk4k46JTakGxag+yRwrpvsvdb/W4v6
+U55Q3fUdANOjHBmav3i8Wtf4K46sbYmEmqjexMYMsmhlONt8xxRPGsTbnFNkiEYE
+ExECAAYFAkGalM4ACgkQyX6cq3d1tHn40gCfadmQp3jfm8qAHtMF95jAGL69z9wA
+mwd65tfWocFWyOsx5WmfWDwRkKY5iEYEEBECAAYFAkGeEXoACgkQJ0aiJIc88a0m
+zACg6RISZOTkaIKTsTXGdO9Ief+1ixEAoKQ/B2tXzDwr03+cZ4mUHM8ZgoEriEYE
+EhECAAYFAkGjAgMACgkQB2FzsZKExFKhwACfVcYhM+6DVpb9ezMdt/D7suT+ui8A
+njQLpOz/O8xZJ+YfrXiigwkhJHp4iEYEExECAAYFAkGalm8ACgkQXP03+sx4yJNy
+YwCeOrQVc1LgdZsBzwBf+e7x/0/atbsAnjPuftS2naF3js1ZJa2Zg4mH3xM3iEYE
+ExECAAYFAkGajQkACgkQF2rZyNGqiWKSyACgun9gfZ2906QTXzwVKCyc7gCe8LYA
+nA1OD8ycF/voOHhnIUTUeD9gDOE3iEYEExECAAYFAkGbzpMACgkQXUFK4eAFycsY
+8wCfbkSGlU/uTfFCixTZw5T8/qHz2bQAoIFN04VyQbl3eTwZrndB6RGIpwhRiJwE
+EwECAAYFAkGZgZYACgkQMaY9luwUC4Gk1gP9E0ctfYyBxSYLf4BCzZHrf3LTfErN
+57cT4xJlZgoPhu+QiypAGvBd+HzJIypfk2xtMBmh4eVC4h6xEfayKZYiUQcXM5um
+qWPoejwypfiEirKMzyyBhhiRrhX101ZsKU3H1WT/hoDW1Fj5QyQHdU2Cy3H/N9kJ
+ffPvDYtwbBgc+2eIRgQTEQIABgUCQZqKPQAKCRD8D4WJ+JS+EsitAJ9WzgasMNX+
+VbNkCFzu0PKB3kRGvQCfTvBTqsCiJ7nSMjyQ9PS6LQO5MIOIRgQTEQIABgUCQaVY
+8gAKCRCXZ4pyLS2qUlpMAJ916tBgim3Jn+/NwDv3xp+MyEJe4wCgwawHk24C8hMG
+lid7m6TeifMHe2CIRgQSEQIABgUCQaqJPQAKCRC+uiuH9fxLQtFRAKCTwt7TpFr2
+QzGZ7zd65bMxqU+GPQCfXtbuVrNOb0pOW2FHfCsZnQ5Mj8KIRgQTEQIABgUCQbEY
+DAAKCRDeooc4MoryBBQ8AKD8Vak3rfHFjimL5Q9pR2lLGY6cAwCg2n4JgEHjlfOF
+r3hUjkpETcG4xdyIRgQTEQIABgUCQat5eQAKCRDOAaR+HEPYUKVsAKDCmpZ8fmUN
+EuXCyoL4Jprk1k2rpwCgkh5iH7bQc+nrct6qg9rTRZXJRI+IRgQSEQIABgUCQbo8
+GAAKCRABBWa85BNjklhbAJ9k0oKaUQPE/2wpEw4filsdii+qxACfVHxThFduOA0h
+sytzvRmUPOeNrJCIRgQQEQIABgUCQbAYXgAKCRCyvrxAFSkkryVJAKD7GQrehzhO
+noT8K/ifs0dSiBU1QACfTufX2kmNV6g9+2fBny01e75IFHaIRgQTEQIABgUCQb40
+2gAKCRDoMBhIFqjTqysKAJ96Ou8DkmXiL2ouHaawKxsXTeH3zwCfZBKeJm4oIEF5
+3QuB+WPr/tEnaeWIRgQSEQIABgUCQeL4iwAKCRBMxE0AEd+H6VTIAJ9DqsVxJS4m
+kADD5Uml2cjK2lk+QACfU7Ggp2szss9E8mY/uIH9NEvifDaIRgQTEQIABgUCQc5I
+HAAKCRDBOfFTI8t6Kh0kAJ0Uky1vHTiKQehy0Q0VYDtE7DQ+rwCcCLaE4hsCzmk0
+P7Xes3JpFuMnDx6JAhwEEwECAAYFAkGa7kEACgkQJPjfwmx8T11ZCw/+MqiwBNEF
+tGJOeXbMN88hfLeomTcRmnewd2QFtPDvE3zUyCOr+O3qVweOHH5uSsc7L/Xv/in5
+kPOU8QgGh5m7ChfKyB8t0MTmYZtQ69Dd68FWZOW8lMmrwu+NUyQ/FAcM7CHidkaf
+sVHx2EE6in9W8tzlZWQBPQFTQfKGth9s/x+UHZntwsKXfQE9KZQUu1XW+LeKmCP8
+wfCKSCoSe2wVTecLSBNSUfgLm3lU7W8JuY42PsjOnDWrhH6nA1HJKVWL3EnE48LY
+nU5fwyfUvOjvK0B3ieq1U0wzQJfp3Qs/5YwOyZj5OCn4+mzuDELH9ewvngIm4JkC
+Pg/rPp59v4Ew4wQRQPdy0COEJhUoXhobNDcqsBBh5MO4IDNK1Wr6UMG5LiRZy+hd
+bmVhzudlgSFMozp46Ah0B0jF4SpQAbaQCkVGiR22SGhl9pIRPeiv4rX1mZHx8x0x
+yNweDl/xTgj52jalscmkvg9DjHY4KTebFP0fnJQ3mm5kBo0HVb724+dR1I8hcigu
+42SiLDvXY6dhO05N98jceSHEvqDdXjVcAXMjqA8LCYqaWbd75xc060Con0qK0ynP
+q5hqSWk6IRIAVZF1ODWqxWt+SihMT3s61sGfQopxcSjAV34gnECrX5FWD7l09Q/v
+nIULGIi2+e+kS/CuU1putPH2D5/kE8774/mIRgQQEQIABgUCQtzkcQAKCRDsqw57
+g+auDYfFAJ9hZL3fmrXrLx5NpEn8bBgW1JQ1LgCgu2Mspu0TEQEx/Ni/1P1uDGsp
+rHqIRgQQEQIABgUCQuDZGwAKCRCM43a4HNSGH3onAJ0fP3lBAFOp84iaeXIsTOnF
+NKH9UQCeM91DA4FnM23QPM+EDOC7aScpOyCIRgQTEQIABgUCQt6wTAAKCRD9b4jG
+IdCnG0kvAKC3AAF56eR0KVFsfup1sw5WR/T8lgCg3+I89dms6CEBF0Dhkt8AeN7w
+VCmIRgQTEQIABgUCQt66hQAKCRAyyeTONkLLS70vAKC3ZI1p4QABXJpmj6mpX69W
+2qjGagCfe+x+Gz86TWXrA4Tx4O9oh/6vqFmIRgQTEQIABgUCQt9s5AAKCRBQjq7F
+MC2laKc2AJ9OgaYLbOtoPPbCFLW0SV4U703ApACgqqiljnK1G4dStQ0Vk7hfRZw0
+rQaIRgQTEQIABgUCQt9s5wAKCRDdumS6LDEtL/bgAJ4jgI9x/ZPMhfH/EFL36fVg
+e3RvxgCfdXMaJx1Z6H1tu1YPDpFk0Op8OseInAQTAQIABgUCQt7HmgAKCRA34/Rf
+7mXjIfGOBADRGrzCutbk7Ls/BeqmEq2y7VnGaOHiukp4p7Giaj9tNnTZspkU3+kX
+vNkA8jjzoTYpU6Mv41KQuW7/7DfPhRRSgupJgQVlxqAM7b/aSzXBu6our6kdksH0
+m8ZIq7efF4cHsRb/12sAn5NRi3VDXGnnYFudNdYQ59XVeZFgNHAkwoicBBMBAgAG
+BQJC32zhAAoJEJrNPMCpn3XdS7QD/22wUAgq5s8YyWq3yjJC2fFQTPoc8mrf7puL
+8KK9W259YBUY5NtuAjkfQ9L9hNx90HIMsa5Tsp/StbKbaU+v80NQ5pXgd2z209Tr
+mPwgt5CHOnEEo7hp6hmhFeQMgwCLsMYmaWp7YYE/W0MGO+HjijHc5ynffubt4Vrw
+YOFwxaDqiEYEExECAAYFAkLg7LcACgkQybWm7OLXdN/sxACfaPr1gyfLBqufCBnN
+EiktSb7quooAnip19UPZQ/DF9PerM7WW0YE2X8xCiEYEExECAAYFAkLg7SsACgkQ
+N/aP9QFa/IpZbQCg2Uf6sa8Ls4uMwhd/gDJDefB/i4QAn1XFkAGlZKp6NT0cXwHl
+5g0gg3fVuQENBDrKHoIQBAD0LtmKeekw1walkGK8OAvKJpBT4Wm4AhPmnHNh3MFR
+jCAit8ULZEW0XDHs/5IHOFRpxyKKpSynzRNGGM2Yi9DvW5acn5H4Us1Vc8CBx1TH
+K+zC7AU7yS9TCR51VDPEONIp2mcd0eayB2R9iGiu9KV/Rj8+H//YGF2sCvAqXwOK
+HwAECwQAs+bNP78S1L78v4mj57xptLLWlsTxXkZd1JCiosXitNmGLYsLtBldAtlu
+XFllS2IjDZPV9Kp74ofgaO4wh01Qprk4Gn5SrSI7Oj6YH8DA/gggw7v//hEBLimN
+75okfqfzBhNTXNIxH6zhuo80RcfX0J/rZQ4Adu/aXeYpR7E36CqIRgQYEQIABgUC
+OsoeggAKCRBbloAQ4E+aicVhAJ4oVY04egiOWbZj8DoBLuPjiwiGpACfZTuOsSKB
+xkA8JT6eXcJrBJhGbcY=
+=KQRI
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub  1024/E2226795 1999/09/19 Justin R. Erenkrantz <justin@erenkrantz.com>
+          Key fingerprint =  3C 01 6F 2B 76 46 21 BB  54 9C 66 B5 16 A9 64 95  E2 22 67 95
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 5.0
+Comment: PGP Key Server 0.9.4+patch2
+
+mQGiBDflD4IRBADqhgm28jVQWqu8ogG/NvYOSySYc4MhrXFqOQrRxJOcAxdc03fR
+Mu7RtAa4hXpNfjOLIfxY0cc6aqKJLlOuZAUxNNFWIcuO3xSWsPrwflaBsATt+0jw
+qc8zOqjQ+Eiejk+IWc+43+7ZggQ83ROhsX3njjdgZnCT6eSHbQwlBIAAWQCg/49v
+YeqveSr+JkWhCi45/NPHtfEEALPZcuaaTHyN5HBn9YjSIE+0S9R6fsdfIbD5OZok
+I4U8+SWPVHX7oDrW+vNhqQUE2u+kPTobjERqzSxT94sTx+93jUaI+H9CKb4x0i0j
+/4K0oPcBhlCsrIJR83IOqsw0+583OR9sIdKQ4H2aoPA5fWbE8swGpct9v/habHH1
+zty3BADfT4fbzDoryBzZGFIuaBaDjV36rWMf479Z8UfuWTcmODDilnitD1/JZekd
+uZ26A2pIDymYCl/YA1Ajel37ltL2uBBrj0RbqXJaco4qi/13d2P8wFcbj1qdvw8Q
+8b+BFeY6Wipa4YQQWWBl2DXpkQPbn6lp4fgH7re52Ifp+S67R7QsSnVzdGluIFIu
+IEVyZW5rcmFudHogPGp1c3RpbkBlcmVua3JhbnR6LmNvbT6IRgQQEQIABgUCO7q1
+XgAKCRAhRUrwzIsPfu3uAKC0/0sWPB/kb0R4IQLZ0puhGf0UkACglccPWwJoxlRP
+X7OXoyOAmh8ncyiIRgQQEQIABgUCOY+ykAAKCRBQENNBPZ/lLfXNAJ0TjsYqhnzD
+NTbjVRGhnBPtW7vkoQCePatWc3674bPrLqWjyxxsnQrC4IiJAEYEEBECAAYFAjiP
+jpMACgkQt5EJtVU3GBmGqwCg59ldjSguiatxd4GG8Zf8qYzYju8AoJlTLIxcu358
+M4o+x1SSCh6duWlbiQBGBBARAgAGBQI4uHwLAAoJEPkzzAXOnKkZXasAoLWUMtVp
+WejgEsi1a+83sxkI6OteAJ4zq9rOxZAnRf3EViBrYQYt8eSYRLQnSnVzdGluIFIu
+IEVyZW5rcmFudHogPGplcmVua3JhQHVjaS5lZHU+iEYEEBECAAYFAju6tWIACgkQ
+IUVK8MyLD343IACeJgsqw2TLSfqPg7vZXNr+YlE+ydYAoIgBr19QKzLvoOjiEYIh
+ybmYNKaUiEYEEBECAAYFAjmPspIACgkQUBDTQT2f5S3FPQCdFEcc43lyLLz3pHLi
+7fb438rJmo0An0CObwroeyH+JCYNTNWAAYJ7Q5B6iQBGBBARAgAGBQI4j46jAAoJ
+ELeRCbVVNxgZqSgAn1ggB/CwEj83gXMvC9jJ6M6dCB7dAKDsO36uuJEnET4AsBOK
+70w1dYtu5YkARgQQEQIABgUCOLh8LwAKCRD5M8wFzpypGSgEAKD840jlZGA4WdvW
+kwXTlqcb5GKhqQCfWQ0R+87LPP/mpFK9i7U71OlrtJi0Kkp1c3RpbiBSLiBFcmVu
+a3JhbnR6IDxqZXJlbmtyYW50ekBhY20ub3JnPohGBBARAgAGBQI7urViAAoJECFF
+SvDMiw9+9QgAnipmohCeCe6plQqqsNGFsJ74WVruAJ9Xtx5In/LzmIwHtoCGrcFy
+yA7y/4hGBBARAgAGBQI5j7KSAAoJEFAQ00E9n+UtbdIAn0pyUurPEG1GGSpt4pNQ
+6gXXv8idAJ9Bt1Wu4GZSLRjhFFR0BMU9Ce+VALQrSnVzdGluIFIuIEVyZW5rcmFu
+dHogPGplcmVua3JhQGljcy51Y2kuZWR1PohGBBARAgAGBQI7urViAAoJECFFSvDM
+iw9+o04AoMeojDRRWw0K3JN9D+IC0PJM8MCAAJ0VawIzQDYB/zot51ZbEgiNcZS1
+74hGBBARAgAGBQI5j7KSAAoJEFAQ00E9n+UtiI4Ani+W1CfvgzAJNeoTsazs6f8H
+m5sUAJ9l3DJCeC/HfoVBoyhgZea0xWADa4kARgQQEQIABgUCOI+OqwAKCRC3kQm1
+VTcYGS22AKDgckbOfjX0fJ91PFaZiosj1/Wm2QCgtfPhTwnIYWXisDJKxGKcPlOn
+2WSJAEYEEBECAAYFAji4fFUACgkQ+TPMBc6cqRkSNACgwk46PQfEpIvZMP4cQp+3
+ChdFFUsAnjYoMe2KLySYfmN7c/5dUMMs1/oBtC1KdXN0aW4gUi4gRXJlbmtyYW50
+eiA8amVyZW5rQHVjZi5pY3MudWNpLmVkdT6IRgQQEQIABgUCO7q1YgAKCRAhRUrw
+zIsPfqCbAJ4jIArOZ3d5SjYXfl+inSl05Y+VEgCfbg72HIziChfV/rnoqDsWgbM2
++M6IRgQQEQIABgUCOY+ykgAKCRBQENNBPZ/lLZ5DAJ4+Qv/6TF8iXRKdruxagqRL
+8v02bACffoxhfnEGNeWpk9kwbPV1+dKnfee0LUp1c3RpbiBSLiBFcmVua3JhbnR6
+IDxqZXJlbmtyYW50ekBhcGFjaGUub3JnPohXBBMRAgAXBQI7urQPBQsHCgMEAxUD
+AgMWAgECF4AACgkQFqlkleIiZ5XccQCeP3nBu8yevFJjVlEanG30vNOk6bUAoKUM
+BJh/uKGoQhoKjtRmAbva9LhYiEYEEBECAAYFAju6tWIACgkQIUVK8MyLD34d4ACe
+OZSsg4uMubn8phNFpoYKsYIIbM0An3f5XVvuNFqRhZq65So4Ibda+GsvtC1KdXN0
+aW4gUi4gRXJlbmtyYW50eiA8amVyZW5rcmFudHpAZWJ1aWx0LmNvbT6IVgQTEQIA
+FgUCObPdKAQLCgQDAxUDAgMWAgECF4AACgkQFqlkleIiZ5Uk8ACg+2tSClNalnwI
+CghNlALE48ypaZUAoM3FyTiZHgop2uSDjBWkS5qnrf/tiEYEEBECAAYFAju6tWIA
+CgkQIUVK8MyLD35NmwCfbIdBIg9SCiCckGyiWYLpst3fmjYAoLXxrih1AHEjXN36
+bvX8VjuK3ZsHuQINBDflD4MQCAD2Qle3CH8IF3KiutapQvMF6PlTETlPtvFuuUs4
+INoBp1ajFOmPQFXz0AfGy0OplK33TGSGSfgMg71l6RfUodNQ+PVZX9x2Uk89PY3b
+zpnhV5JZzf24rnRPxfx2vIPFRzBhznzJZv8V+bv9kV7HAarTW56NoKVyOtQa8L9G
+AFgr5fSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY7288kjwEPwpVsYjY67
+VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy1obEAxnIByl6ypUM
+2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XpMgs7AAICB/4uMRus4MO2
+fRm+/sz3o/6Vu1TQk1ZAb6qDhwrkArfnj7UjNCWqn0B9eaubF96vTokb6hBtv3FS
+BZ5TDvngAbFvZEjNpXGfoW4GkoRdDKNpYoI8RLTKjlRKiaEl+f1e9WxQp7iyP4o0
+VAxAW0f/sQwzLGIpMS1PajO2mBBtSW32e7Zgy4C/AA914Fb4AR8wkoDPvr8q3P0D
+vwtnmd0pSPeAfGqY8QtTKjjPdAyETp1JIqH+uVlrij5CwtAd3wJBN4GMfXotztEI
+TA8um8xS/4EnWSOROTf3NNhv9MrTvMYpPsodCD/d0IJ7lce4hV5vzZ6hYX07gvcJ
+4LQrqG9b3yLNiEYEGBECAAYFAjflD4MACgkQFqlkleIiZ5WSSACfQA6CboJi79Li
+SbEJZT7+4wK4UJwAoLCn2Gpg718hDIGZUzC2avajRNUT
+=6s4E
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub  1024D/2CF86427 2002-02-01 Ian Holsman <ianh@apache.org>
+     Key fingerprint = 67D4 D4C4 79ED D9EC 88E1  734C AB7A 60BC 2CF8 6427
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.0.6 (GNU/Linux)
+Comment: For info see http://www.gnupg.org
+
+mQGiBDxa7bMRBAC0kClufzb9tqQfQa+qs2E7sQYd5ag53w0nHKAW+9Q/5C1y0Gaq
+enp+p6FafJZdP4vIgmLw/4TWinNkLqJRSA2om2TLy29AznCGWbIvCuSX74WUa2Ec
+PIh2Lc/NpDQ743mocBc+XoLYBNESpGHPnpT5niYTvRLHjzxp0XLNk7Gc8wCgjR6/
+aKd+8vTZcDjh/3xZhsQos9MEAIQI/z97PtRnohkj5HVRXi2a7oQ8G4tPegfntz4Z
+n3jfq0WXNoMEWo7jrYUpJiy6L0y/tiuPfctb7RUJ5wfkdZmGjQ3x9NuGRq5jQstA
+neCxsIyl2f1qtwaV4IgfhVrfUvJhI1BQq7d5sqePjXmPNKfouYcNKeGOvZXbbswF
+oso6A/9MFgWcBOBx9h3wsoVQcYUo5nsUzq8a0AeTYKz6kUMPtVgFLmOxuJrKB2dX
+g+A/o+r1n4D/SYcCoiHBArUGuCjOU5ni6gC5mPKtlo8VpYpNV6tj8yx0ntyr4hu6
+KMcTdJwHs8KpfkWp/H1SXpy38ypUEQx7yZztpZnNiRMizDhDDbQdSWFuIEhvbHNt
+YW4gPGlhbmhAYXBhY2hlLm9yZz6IXQQTEQIAHQUCPFrtswUJBaOagAULBwoDBAMV
+AwIDFgIBAheAAAoJEKt6YLws+GQnhzwAmwfeZnT1FY3DfzE9IFkKKiJ1LhPRAJ48
+mi4txMWmwcQUv5N9PSgS6m5Ml7kBDQQ8Wu22EAQAyHiY98UhNYD1rJLJw81S/1Fc
+N/P657bqIbhPWifOHDaUpJEKY8YARxB5TucTCr2bF11fs0tlc8i+xqQjjIxlspFf
+d0b9mjzd0h8DfnN+Vbh8J/HrCN2l7EM9gbp9vh4sAfwFh4ObC0Z/ULnIpPw2s8U3
+v19WDLUz+OOaYvl8lU8AAwUEALd/VRU9DzAHefcJLrQkVbyaafq43FyQ0pp5HNO2
+FUYx3HohVKFHjPckCM6iOdFPixqNCTCutTT0ED8gTQ1f9zzNBqHx7RBlHcXQjPRV
+0Tzl+HWcTED7BL1i3rCRpWWguhZ7KYArjcPlngrDocshbWVYmUcE2KqIIRTkwbHW
+urXCiEsEGBECAAwFAjxa7bYFCQWjmoAACgkQq3pgvCz4ZCfAhwCXU8ZfULcXJERI
+YZ/OXV64q33OPgCeOftkLN7nxOPBn0so9h/rwSYo3qSZAaIEPFrtsxEEALSQKW5/
+Nv22pB9Br6qzYTuxBh3lqDnfDSccoBb71D/kLXLQZqp6en6noVp8ll0/i8iCYvD/
+hNaKc2QuolFIDaibZMvLb0DOcIZZsi8K5JfvhZRrYRw8iHYtz82kNDvjeahwFz5e
+gtgE0RKkYc+elPmeJhO9EsePPGnRcs2TsZzzAKCNHr9op37y9NlwOOH/fFmGxCiz
+0wQAhAj/P3s+1GeiGSPkdVFeLZruhDwbi096B+e3PhmfeN+rRZc2gwRajuOthSkm
+LLovTL+2K499y1vtFQnnB+R1mYaNDfH024ZGrmNCy0Cd4LGwjKXZ/Wq3BpXgiB+F
+Wt9S8mEjUFCrt3myp4+NeY80p+i5hw0p4Y69ldtuzAWiyjoD/0wWBZwE4HH2HfCy
+hVBxhSjmexTOrxrQB5NgrPqRQw+1WAUuY7G4msoHZ1eD4D+j6vWfgP9JhwKiIcEC
+tQa4KM5TmeLqALmY8q2WjxWlik1Xq2PzLHSe3KviG7ooxxN0nAezwql+Ran8fVJe
+nLfzKlQRDHvJnO2lmc2JEyLMOEMNtB1JYW4gSG9sc21hbiA8aWFuaEBhcGFjaGUu
+b3JnPohdBBMRAgAdBQI8Wu2zBQkFo5qABQsHCgMEAxUDAgMWAgECF4AACgkQq3pg
+vCz4ZCeHPACbB95mdPUVjcN/MT0gWQoqInUuE9EAnjyaLi3ExabBxBS/k309KBLq
+bkyXuQENBDxa7bYQBADIeJj3xSE1gPWsksnDzVL/UVw38/rntuohuE9aJ84cNpSk
+kQpjxgBHEHlO5xMKvZsXXV+zS2VzyL7GpCOMjGWykV93Rv2aPN3SHwN+c35VuHwn
+8esI3aXsQz2Bun2+HiwB/AWHg5sLRn9Qucik/DazxTe/X1YMtTP445pi+XyVTwAD
+BQQAt39VFT0PMAd59wkutCRVvJpp+rjcXJDSmnkc07YVRjHceiFUoUeM9yQIzqI5
+0U+LGo0JMK61NPQQPyBNDV/3PM0GofHtEGUdxdCM9FXRPOX4dZxMQPsEvWLesJGl
+ZaC6FnspgCuNw+WeCsOhyyFtZViZRwTYqoghFOTBsda6tcKISwQYEQIADAUCPFrt
+tgUJBaOagAAKCRCremC8LPhkJ8CHAJdTxl9QtxckREhhn85dXrirfc4+AJ45+2Qs
+3ufE48GfSyj2H+vBJijepA==
+=XyM+
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub  1024D/CC8B0F7E 2001-10-02 Aaron Bannert <abannert@kuci.org>
+     Key fingerprint = 937F B399 4A24 2BA9 BF49  E930 2145 4AF0 CC8B 0F7E
+uid                            Aaron Bannert <aaron@clove.org>
+uid                            Aaron Bannert <aaron@covalent.net>
+uid                            Aaron Bannert <aaron@apache.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQGiBDu5G8kRBACUCvGTlqgxnukt9kkjFPIpr/xsyGJjq9XJ7SEMx8caA6uMAxtU
+mBcbBFqiyYz2zp019B/RYdXkpyoKVYyxoTdpkkCp5leZwoPJob+kcTkAApfTf5Rq
+xs3AbY8e/R3XAaqdhwMsBJ4Vsu96qE0/JRajf+0sw+kGN1HNCI0z1cKWKwCg30x1
+zjFAQBf5QZP29z4pijNAPT0D/3L75dA2cBhG+hXkvbaAPf6ophD/owMku7vHqYLj
+SUHw8Cc1C+uXGbRvK4cYVFS7wfo/FiNCHxawdPWeak910/d3UsoUsrNcSSz95Vnl
+RxSlYG71KKUi7us3dOEGzOnv62+zRUwA/Y32aLPkTwV+U4qC+zqYGGz/DUPsbeN5
+AY75A/9jACi6Tjd5kgi584FHYIlJKsoej5YRr5mz5tvVQnwCHsySzvKZhFNA+Naw
+kImlDBtN5r6SzWaONCa2sW2cSbECfpmvmGl3uJe9uVvbs6lEhZPNggKQgYNzdJQU
+HlvKHK1e09IPLFOE2xd/De11d9rFDnv/AUtIJrl439en7EziL7QfQWFyb24gQmFu
+bmVydCA8YWFyb25AY2xvdmUub3JnPohXBBMRAgAXBQI7uRvJBQsHCgMEAxUDAgMW
+AgECF4AACgkQIUVK8MyLD36GmQCgt177yUba4wl27GeLLngmvioBc+cAnApbnspx
+CWUm61QppZdYAz44QwPSiEYEEBECAAYFAju6stAACgkQFqlkleIiZ5XUngCglWG4
+DejI6MJ496Vu1Tysc6J+ozsAoIe9QsA50cxCZalaxUrBT/XtT7HfiQEcBBABAQAG
+BQI8RgEgAAoJEPcTqHkQ/eB1H9IH/0aV16LSzf1pimZLuARbymfdJK4/+wQ29H9D
+XWf4wDLdBJvUMkHcN9YxsslTmhqlvudpqCbbrBXu0Q0en3Qa3gxlG8c2pxCFpNrE
+vi7bCiCcpmS+OUPT4PAMz3P2Mmzx+i9/Y7yCSdb2eZOjakTz4EvYcn7naTz6TOQ6
+WvjkOA2kgz2fER+ciXF40A+465KxwyNJJlMVffRPm6PMgifTIGDqcewYo69uvltE
+XweTzh2mX0FBOuBgi6NiI3Yu18LhWtpBXrLmz52eQBrrnUXDvuNYoWbHsxM/56Vf
+BFxzUUd38ChFziaCsGvz5HbreDA523qe4k+r3YG0E5zU70kTAW2IRgQQEQIABgUC
+PFrxagAKCRCremC8LPhkJ54XAJ9cZpEYbISKfHfd2aXI3orydfv8VQCeLXVQbC4I
+U5vLvPQLx2uEMNr9csOIPwMFEDyuIwT9b4jGIdCnGxECG8wAnigF7KzIbslopWCe
+fPGBgVv0bcHmAKDmVyKvqAj90Ejni/LngyPrkSWbuIkBHAQQAQEABgUCPLINwQAK
+CRDXOpC4a7qdXVYFCACHrv4T0OjkSWpTVLHYm85Rtk6oS2PvbLKxmVYbBMG3B2bO
+quVLhjFBbaQyUkr3ks1ebWcjgnJCf72DrUwbBIjtbm+BjpRTvqmQai/lkf4oyFb9
+nVcX0iUR0t4uf/ecsz2rjBLlVYmAxUi4GXPnAAmFJtego1qJbEuHUuh5ZNGJuaxZ
+Pk1Qnu+5VMN9VBbXOFT5Nvnt2WQBrxYM+5SbxszF4BmpztIFoa64QrheRLIQ3jd0
+S2+xyQsNCFVfwYIvMQqVmCNC623sBhGrFiJffTdJv5Y8JcQwBSfU8KnBB+XNirDq
+LiUUI4m2xBE0Vhg8dFLnSi8yshKjTOBNQegmcC2MiEYEEBECAAYFAjyznowACgkQ
+W5aAEOBPmol1jQCfYu3bWUJ27UUERTXpWuCx0wGgi6MAoJbXTrlFWVN/ihAOeyoM
++K8J1lA4iEYEEBECAAYFAjy01ucACgkQZjW2wN6IXdO/bgCglVvYECJYH9LS56Ug
+dx00l8NenM8AoIoyiqIRs27asHxwz4CRUAzM5SxStCJBYXJvbiBCYW5uZXJ0IDxh
+YXJvbkBjb3ZhbGVudC5uZXQ+iFcEExECABcFAju5HOoFCwcKAwQDFQMCAxYCAQIX
+gAAKCRAhRUrwzIsPfp/ZAKCcug8zNT2WbAXMt4PPJUzhPKch7gCglldxj1byfdKv
+9NJnrQLTQ6mXsmaIRgQQEQIABgUCO7qy0wAKCRAWqWSV4iJnlZVJAJ9/sAIUBPzG
+HfjRVuvkEPehgv5qpwCgm6FdzGwUXScv3jkqHGf8K5B3RNaJARwEEAEBAAYFAjxG
+AVgACgkQ9xOoeRD94HUX/QgAp4deUjwvISoeBoB7KmD67ccpcvSscBtFzpWVbJIm
+QSJEWkMwqU7ga616NgEV8e3BbOlpUrRCJg3l1lWGMVHFMlG7YRIDrCT91+M2IA0H
+0G0VCilPg4nUhx4vEww9H5gQkNAI2l4ep9B7LJD/EYMvIOfJ2W6SX/cip36/eHAy
+YjZbKw3+Af785A7H7lWWI+Umphq/rd103FcwCx4m7KGuZKZJlQse6l9PQqWcyjbP
+RrwD/WNUEhP8eXgy8/+XrHpqo9g4XMi4YVTqxc5nJ3iNYei6+iy2mK6Um4GNJANR
+70TNQBe3UlMFfvEZFQ8SrSxBBXk7Z7tdgi0/tb1saT7D4ohGBBARAgAGBQI8WvFv
+AAoJEKt6YLws+GQnsEkAnRlkBVgiZ9pkgU4k+Ab16M2bTYhzAJ4wWf4JZASGJM5z
+CVFQVpLsTcZAE4g/AwUQPK4jMf1viMYh0KcbEQKWqACg6oVtZOFNBi2KUiaiekea
++YROANQAnRaTUuA6FZT+8+8BGy75en8FJTWiiEYEEBECAAYFAjyznpIACgkQW5aA
+EOBPmok1nwCdEaXD1JKXsqNwir4cDfH4JOHvH8UAn3CbHK98MQOAv30O1E86F0HB
+CfUSiEYEEBECAAYFAjy01uwACgkQZjW2wN6IXdNaUgCcDgHxmicULGB2TbKrslpg
+COhS2UkAnjgsAMSQLAPkvC4r+1gXa4c/e1v6tCBBYXJvbiBCYW5uZXJ0IDxhYXJv
+bkBhcGFjaGUub3JnPohXBBMRAgAXBQI7uR0qBQsHCgMEAxUDAgMWAgECF4AACgkQ
+IUVK8MyLD36V4QCfdB9Kqiag3T98Y6tQ5YSb259XJnYAoM9fQ30sbQxfmNKuOHbk
+IuPuU24wiEYEEBECAAYFAju6stMACgkQFqlkleIiZ5V/dwCcDxamuhlGgk3a+T0V
+bIRp6Qy8bB0AoK6jwOfUwTn5YJTsVH8k2D/lwWBNiQEcBBABAQAGBQI8RgFCAAoJ
+EPcTqHkQ/eB1q90H/j1MMsFAQ6XpIpTSWNAt/wR9qp7ZIAv6KdrbYX3akO3bPy3b
+KL+7gDjEAqVGHzEBjTnqU7erDaI2Ms2RVBFhx/jI5RwT02KHSw3OJkSKN002yVxQ
+igBSmIm7aKig8Uk632x2ncQz/pLHk61jJ2h/62enIhROGCQvrbArZAdAzqxTrSkp
+YZ0IJqfHgttzxXgllHgAqTia7dbMMymYDUH1xdSyD7SfyA0dsJ4M9HhSgXFzmOIH
+/dXR6jMrj39jSHsVMHyaMn2WWEj/AHSqvQ5J+Hi1EmLpA4NC6sVOhttG/c9B6SZ4
+xVDrH+qciaL7fFBB7EsCXMYpYsfbybZ+rGuMGtGIRgQQEQIABgUCPFrxbwAKCRCr
+emC8LPhkJ6s9AJ9Elq2KHVPSqEbv0KEX+qd1izAW6QCffYVRnR0OVdB624DHWIbq
+BAKSsoSIPwMFEDyuIxL9b4jGIdCnGxECd5oAnjKUT4SFF4VIDS3HEc8BHGM4zqIx
+AKDzxSD8YeZ0xw4cWb7JQYzpWmzmkIhGBBARAgAGBQI8s56SAAoJEFuWgBDgT5qJ
+8D8AoIyG5L6TBB4IJWQ+hwfNrD9IwVXBAJoDckFzbkgxnvhIczlY33Q+EqoMgYhG
+BBARAgAGBQI8tNbsAAoJEGY1tsDeiF3TlFsAn374e8DpYNe6vJM9istjZ1EWnFpq
+AJwKMiSR90qBquj46vhZ7BYszuYKnbQhQWFyb24gQmFubmVydCA8YWJhbm5lcnRA
+a3VjaS5vcmc+iFcEExECABcFAju5Sa8FCwcKAwQDFQMCAxYCAQIXgAAKCRAhRUrw
+zIsPfnzfAJ9rFBBJky98n6vzgvqtl+3HNU6q0ACgxaSLwy0Ki6Ii/eTzqNm8fL34
+IX2IRgQQEQIABgUCO7qy0wAKCRAWqWSV4iJnlZksAJwO02q9t/zo5HypYme1NNZE
+XkJf2wCdEmnVSdzJypGpZSod+8z+yWeH0P+JARwEEAEBAAYFAjxGAUwACgkQ9xOo
+eRD94HXDwwf/ZrEtrxyCqkBk6epTjn+JIXhx4hyk2/7fWXIFduJee2Mkfum+ERP7
+fn5mAYblwCaVMG93av2zb2gkZySCGsdmF8W9/ntPKf3HZ9ZBbRXNamtYyIPHGmb+
+wJPENiGZcKkCgACw8SJ7/nbGu0ctJpgyWEg0vDc/A30zR1/GxGddTpJ5wIRdhss3
+JBZQnFXolu802XmOfnj0IZ+ddw8AlWKS2kQj5de1lc1/iMTObBaF2dxbIjFpKRN+
+ZuTsWTbS+ESNNKKoFHjoRwu+kScKh4EG4YXsH9lvEePHRNFVWJ4H4Iu3OZQ028Ll
+dqnCs19XhV5jTR1iRESKsEvFzqsbDH2/DYhGBBARAgAGBQI8WvFvAAoJEKt6YLws
++GQn+h8AnjSdURKLWjGTe2tyZ6uFgZfHNFHtAJ0dqyM2kQE0hqvbna1ekOKhhJxJ
+PIg/AwUQPK4jJv1viMYh0KcbEQJd5gCeNxmgjYHc8Rbskd/Rx6G4GLD8bf8AoKMb
+KOkABzz/lMkWnFoSQTORgoByiEYEEBECAAYFAjyznpIACgkQW5aAEOBPmomJlQCf
+YbwuwJSHLxlZ5X2e3S7NY1do6TUAnRi2BeKlVOINxZAgFsdzWtbyta8GiEYEEBEC
+AAYFAjy01uwACgkQZjW2wN6IXdPTvACeKekzrpxWT0kznQkzCsrWT95xQL4Ani5w
+hJTuQ4e2PItb0kLCyoRgMMmYuQINBDu5HBQQCACKePczRQE1gIWH6LZaCDY8pINs
+W6SHl4MXDnBPgnuZ9H/6kFr++2OXatVKlAoQ3mK0sN/py/HeGkMwKBI9lWVldPik
+4pgDhdmZU3B3spA+TTCBWNpKyXGY2c7P+ougUvwQAysifhxOGAvr1R6TpBqeSdZ7
+4ZzMPhHLSJGwOSq3BJ/uaViRzZORbVmUFV8s1Og3UlHdvoK+blnbj6eMVyrQ/n+U
+LviDnPDxasWhP4an+v8c4Gk2qsAz1XmXccn7S4pa9x/yxiXLNHHrr90Dd0h5Lvvv
+hgcQTUFbEwwcdfzKKaiOtuq6qA0Rki/wBBabEtLPzCgBIpUj2lUZZrySVR/7AAMF
+B/0a9jaU9Gc25ZygMtftWMVIXEGG7aTqm95Q3ZebYRlpxnJJUkNyLuj09IwBuV7a
+XkpEBdACHNTyPwl3khmswjxQO5tWj6JEvdijxMEHu8JtfTq43zRAc62bMq6uJshW
+Nd1oVu7pS4JQGmJvUyZjJ+Q9iiyY92XtdSyN0QnB0BeXHyHJB7ZeHbzALkOBDKUJ
+yK50/ACJz5JFXabvc0c0zwveU46rFFa2Vdqv2Tf3exL4Gix/Pd8cKfknrssXoIwm
+UvpESL92XUUSm7Ozy43+UWq2J55NSLNuqNtZyoMJWiLv3RpBn1DdGbXpuIeyDHCD
+MM59GnqTdrJWcVQ9WJ/9txxziEYEGBECAAYFAju5HBQACgkQIUVK8MyLD35AfACZ
+AcAS375Fg+hea6FxD9qnqpaZpjMAoLY7tAaEc1bKdJ/8Za3ZPT/GON9J
+=SyIW
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub  1024/3A4E7AC9 2000/10/11 Brad Nicholes <bnicholes@novell.com>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>
+
+mQGiBDnkyK0RBADedOdiCuVtn2awUpoc02Gq+BCHRjy/lnZ9p4wdgJPJIdImcEZo
+agfLwU8iDY4L+w71FMiZjR6Lp0dRK5TupeUD/NWEsDM7we4KjafK1tGN9QlkXAtZ
+WulDyUoR6c1cTNeMPowL8/MMs4IP1VGL+9SUjSsoJOm8VBu66NLne/WnfQCg/4bs
+0pNeQCtdzCzeNnTFbDSFd7cD/2FWSh+CMrhhC9tqDjfkvLrjcTj1bEpOI/qYb8Ir
+eivywJQ5u/tvIkW856SubuBDFRy9kMlJEJL7y8pxD+6xm4ZYexznLS2AjaiseqLE
+tgR+AXtgjebiM7gQ/hOtDJjpTPeA5hLYIsDYYrXds7FTeYhsJVeXZpZt6T0Uqqjk
+aIe7BADXsfg4lz9/ecmHjo4VAOII6A+Ax2P0FTkxSXqPfIK1AGebIpAGE9nrc9t3
+hKkaqFztHM/OS5/QFs0G+RBnSyMUd/HXUFSl71Bf8F9dq/CdhNK0KXnOuZqpXZaT
+WuD3Fl96HsCXYF2Dvzwf7Yoyai/3wX+f04VZbBKuLM+AsZmG67QkQnJhZCBOaWNo
+b2xlcyA8Ym5pY2hvbGVzQG5vdmVsbC5jb20+iQBOBBARAgAOBQI55MitBAsDAgEC
+GQEACgkQ9V3wKTpOesnSzwCfQ73nPsRRK31if54rQKcVaa1A+68Aniks/MIcwGUC
+xSxJZpCGICkXhueyuQENBDnkyLMQBADZi2ehJNymtM1VOMCzWkamCuIWaDZzUOmK
+Hz7pFnceoFC2xynrUI+AJIzFqqiWqovQqv4V3GloRdWcw9Ye2IIi7H25r6v00Ng7
+kL1TzFpjC6yoHGXgEzYFfxa63plWCRGdfWU+3yzg7lQAF9a/ATUxXUXl+uIebQbo
+ZI1Wt4l1kwACAgQA0bT3PCO4TT0yhTuS+Rgk3ROqZTNhmMAnrTpHW70E4N4hgBe1
+1ZEralIhzT/1/dpsPbouDMMUer6voDcAyq7kCZobu/84LKhvCgFLQAF7PAz6g5Rc
+sPsoVv09UYYVgVi96EeGciA6ozVSGsVfNwEzZX7QOBoyrFozlNlX2Y+oF8iJAEYE
+GBECAAYFAjnkyLMACgkQ9V3wKTpOesksrwCgwQImPBW83G11skRygzwEOm9DWHoA
+oPpwZLqqLg4/dGQ0ZK0Qm3HXok7W
+=YgRS
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub  1024D/DE885DD3 2002-04-10 Sander Striker <striker@apache.org>
+     Key fingerprint = 4C1E ADAD B4EF 5007 579C  919C 6635 B6C0 DE88 5DD3
+sig        DE885DD3 2002-04-10  Sander Striker <striker@apache.org>
+uid                            Sander Striker <striker@striker.nl>
+sig        DE885DD3 2002-04-10  Sander Striker <striker@apache.org>
+sub  2048g/532D14CA 2002-04-10
+sig        DE885DD3 2002-04-10  Sander Striker <striker@apache.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.0.6 (GNU/Linux)
+Comment: For info see http://www.gnupg.org
+
+mQGiBDy0wXgRBAD1J8+8rBKAXD3Z9n7LhdQ+gDcYIDw/sN0cZGz5kpc/1YWWaMQg
+ArmoNW7y+BBwNu6Cn42Nid16avSC86H1zBzOdQscDc9/WLwBCiFDCSHB98+UId25
+JGS2cRSE6vt2oDOy99Ent8Eh3f165e0rWVdc7NMOcFGhCTquAFbqMfxYzwCgvGIC
+KcMeykaY5QSHrX+ckJmc2QEEANDc4ZRPVF7cQ2wR2OIYzh5oXInhFFnyW2vYbTsx
+NwREbizoKXqG7rmTmOQPz6DsifJEo97QrFrSOcD9FI6aUpDmu1Ns06QSjmzCSS6i
+R1xPXBp5//2jcWjLs8td30N+AfwFnnB45sy8ILWel1CkGhdPoiHdI8Q0nJWahVwU
+PKz1A/9xPsk9k0quKrhEKI7sYZFJn/vy77gh4/k26/jk7JERonO8ECDDlo+r/hfF
+op8A/ljW2BDm6VxHSBUkIJvULUbN8rxvQGnpKplv9jgiwBHoPhKZ/TX7KvXAvdPg
+bx8Z4EfSVJRQs7j/v/IhM8xn8tu0EEW+Fg1SHCFWV5iqe6aTZrQjU2FuZGVyIFN0
+cmlrZXIgPHN0cmlrZXJAc3RyaWtlci5ubD6IVwQTEQIAFwUCPLTBeAULBwoDBAMV
+AwIDFgIBAheAAAoJEGY1tsDeiF3T18kAn2kAzhMXT0tOg5GvGVNi+rc+dpZcAJ4z
+rKA/8TnQ88Lqq/OOwkuC/TXrHohGBBARAgAGBQI8z5oyAAoJEBapZJXiImeVyywA
+n1wPiGQVC6Kwdz1XlXrFL6/yC98mAJ9MZZgOr/Kyh2mDgwqWi+Fa/bgqarQjU2Fu
+ZGVyIFN0cmlrZXIgPHN0cmlrZXJAYXBhY2hlLm9yZz6IVwQTEQIAFwUCPLTB5gUL
+BwoDBAMVAwIDFgIBAheAAAoJEGY1tsDeiF3TQNMAn0ear3DqKydi9oTzfBYFCidn
+YhqJAJ9fvKcU27+jJCRHIPp3lQPX0C+UQIhGBBARAgAGBQI8z5o1AAoJEBapZJXi
+ImeVXd0AoP+AlwMBWr5fJ9pERjvKmnnNJE5oAKCJTRBYnB/aYkt8/aqPMVtl3k1L
+NrkCDQQ8tMGJEAgA2F8v1AMPGI7cv7cWuySfnd2CV7SXOZQpc3Pfv2UHgYP+1lTL
+NJoRtfwXMiNjrEwgLrpLy7F0nHnVqb6MBYv/Dhx6eO7MoejJUc2pADijCS3Qcg5n
+7hCZ+pWvCjdZAfZhHB1cpSm0FVuc07jrJYTbI/qsdbUHQ4r1jcIZR/ZU4mTnFgnE
+bAw4NxSGJ8ikFNNfviDdb3O/XAYS27dgJcGHOHaQi54dWkJpYt5vayUHYt85pOMH
+MR1AwkvM3AiqPO3688VbV6mIlGS9XvBr11kbZ5EHUCDPFJl5AMjX2fg4lMQu/ONj
+rbxCqbJppPLLXu/MwfrV9Y4pb7L+riWqdQwEOwADBggAgOqiXCSsRXmbxC0hYNj3
+UCY9KKy6CmCwExigG8Irs3aqC3cPGi9/9lpuniMN5F9ieN/BJysJHAFWN8f3z4UC
+fQH6os3ewQDZqoFrgkHqlrAjej8qD0X5Ue0dozXLuMFe05X1XCkTff9wXI88uRxq
++5s7cedGqZQUixpN15oK9FZSORPPxjGsUe8NVMsplYvH/2xt7tXzDfE09zwT2qnM
+voQte/WBoVYdVCigUIeArRqNyCsk1yGUfiBcmJFHCyhKNtYNAUwWGPv8AmTAb5yf
+FFVprAMbDlv2yhiTnEj7AvEC+OP1RH0Z4j0TDlpeKHoZtu3uP/gp7Mshs7ssE2mV
+qohGBBgRAgAGBQI8tMGJAAoJEGY1tsDeiF3TPewAnj9AmBMuS8QvsuS5hUhSWNZ/
+uLN6AJ9FK1Wz3vBRoTloK5D3D3UaJ4x7Hg==
+=AHY5
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub  1024D/E005C9CB 2002-08-15 Greg Stein <gstein@lyra.org>
+     Key fingerprint = 01E4 7536 0FCC F1D0 F24B  9D14 5D41 4AE1 E005 C9CB
+sig        E005C9CB 2002-08-15  Greg Stein <gstein@lyra.org>
+uid                            Greg Stein <gstein@apache.org>
+sig        E005C9CB 2002-08-15  Greg Stein <gstein@lyra.org>
+uid                            Greg Stein <gstein@collab.net>
+sig        E005C9CB 2002-08-15  Greg Stein <gstein@lyra.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.0.6 (GNU/Linux)
+Comment: For info see http://www.gnupg.org
+
+mQGiBD1bRO4RBACFxCQEk8j9a9SSzVIFUg6EKAXabSii1f2vyhdsj7yLd4E2nybA
+6907ohpFkIHdOGWAasKKDRG3rpL1X37c5dxUYgGFGyfbe7FapUPP0azq/Wsfn8Ax
+6D0jcIHJKZg+L0zHqxSwItiyiSqt2YGRUO42Bo/8SF7PHnv5TNKQZOjBIwCgmyiQ
+lVmqE7NiM2oR3P0kYUDDcWMD/j0v3uyNKPTTOgapzRM7ThACv/6KmF600HH4ZbHg
+3B2JTaoHiCDoYs1kp/8F65N6KG8S8wzJb1ErpbZSCqy7ZjjFm+NDRsTkFHPZngUS
+l4ctAthOwgg93STorWE+XRF9ZjzL/XcQog2XV3ZMZAGq0prgX0LjZ8lHWPkvYv63
+EEJIA/430y8P+3refqpeO2UtsrUeDaYEkNJg379USVdI1VDJXdS1G5lCRkNiRcyU
+im6ZcgOlgf+7KNuBv9urIwk7GkcPl4QHHFk2Fex2+k2JDxn+8gafjG1O2bkDKEyi
+csHOWFouQvxLhglC8WJCmPQtMwMWzVpNlOnKyN6MPyvFz0CKc7QeR3JlZyBTdGVp
+biA8Z3N0ZWluQGFwYWNoZS5vcmc+iFcEExECABcFAj1b0FwFCwcKAwQDFQMCAxYC
+AQIXgAAKCRBdQUrh4AXJyzFQAJ973oVmfVyH0w4cs8SljCxwPnhUCACfebmWhkt1
+aYuu0vSX34Req3TPZ9e0HkdyZWcgU3RlaW4gPGdzdGVpbkBjb2xsYWIubmV0PohX
+BBMRAgAXBQI9W9BsBQsHCgMEAxUDAgMWAgECF4AACgkQXUFK4eAFycvhKQCdEvec
+2nvVEx6OC95oTwYZSM2B0NoAn0Ju156UP6IwGwczI0UGYuezk/4xtBxHcmVnIFN0
+ZWluIDxnc3RlaW5AbHlyYS5vcmc+iFcEExECABcFAj1b1JEFCwcKAwQDFQMCAxYC
+AQIXgAAKCRBdQUrh4AXJy2W3AJ9Q/SnukhlOxz2vHahHiQ7ZgDE5qwCfeCn6PL3H
+VMW9xLKJtU0O+Fep6a4=
+=2Mbf
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub  1024D/8103A37E 2002-07-18 Andre Malo <nd@apache.org>
+     Key fingerprint = 92CC EF0A A7DD 46AC 3A0F  498B CA69 3974 8103 A37E
+sig 3       8103A37E 2003-01-01   Andre Malo <nd@apache.org>
+sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
+sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
+sig 3       2261D073 2003-01-02   Astrid Kessler (Kess) <kess@kess-net.de>
+sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
+sig         75A67692 2003-03-18   Erik Abele <erik@codefaktor.de>
+sig         B3B2A12C 2003-05-13   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
+sig 3       F43C2F92 2003-10-03   Bruno Lustosa <bruno@lustosa.net>
+uid                            Andr\xe9\x20Malo <nd@perlig.de>
+sig 3       8103A37E 2002-07-18   Andre Malo <nd@apache.org>
+sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
+sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
+sig 3       2261D073 2003-01-02   Astrid Kessler (Kess) <kess@kess-net.de>
+sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
+sig         75A67692 2003-03-18   Erik Abele <erik@codefaktor.de>
+sig         B3B2A12C 2003-05-13   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
+sig 3       F43C2F92 2003-10-03   Bruno Lustosa <bruno@lustosa.net>
+uid                            Andre Malo <ndparker@gmx.net>
+sig 3       8103A37E 2002-07-18   Andre Malo <nd@apache.org>
+sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
+sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
+sig 3       2261D073 2003-01-02   Astrid Kessler (Kess) <kess@kess-net.de>
+sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
+sig         75A67692 2003-03-18   Erik Abele <erik@codefaktor.de>
+sig         B3B2A12C 2003-05-13   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
+sig 3       F43C2F92 2003-10-03   Bruno Lustosa <bruno@lustosa.net>
+sub  2048g/E71FD3A6 2002-07-18
+sig         8103A37E 2002-07-18   Andre Malo <nd@apache.org>
+sub  2048G/3EC3A5BB 2002-07-18
+rev         8103A37E 2003-11-28   Andre Malo <nd@apache.org>
+sig         8103A37E 2002-07-18   Andre Malo <nd@apache.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.2.3 (GNU/Linux)
+
+mQGiBD020E8RBACVdPw0jDJ4jXKx8hBllu73Vmoxz8amOq6J92XH0Ch3obgHKTa/
+JndsxvYFDy4onZItPXbb4TC8uJGwi717eU+w8dHvB/R972JveKgb0HMeHcrGFOvS
++AlggjSCSxGht0UzwvwQgTZAdWfM+14g0K7yPtpMr4eh3QjYI3Q65lZ21wCgwNS/
+9Jl0adHrs3VzLFpT669fcMMEAIaesoMbtU0YaSyKN6ohU612G3pNXG23FeqbOXTY
+twhKxtefcG0xmssI4ylq4jxxn4iLQHJUn9wI/oS/rksJjdBWICq3vah6FV3NUev7
+LZcJ1X/TntztE0SKSdwjngW4jhzxnZlteCVRmeejIgotj0xOwBzRfNGpW8E9JJdA
+uWeTA/4/b2+jlkcWnIYrfy0HwTeeN2Dzd0p1S+egfkFZOfD15G1iRCSVsDVaHyeL
+2n9NMfjVlHV/OzuW1/786IpvwFXwy/4HUm7b3DwG6p1GIUFFgyk4CjezzUqBAaJK
+vfiaGWAmPR/gVdPSI94RduQNBhvxFupdH6QsyXw8Rxp+dYM7WbQaQW5kcmUgTWFs
+byA8bmRAYXBhY2hlLm9yZz6IXwQTEQIAFwUCPhN4hgULBwoDBAMVAwIDFgIBAheA
+ABIJEMppOXSBA6N+B2VHUEcAAQFcggCdHaBDTO7VXi01WGveomeSLIvx//cAn3ov
+xRtZ5FkPALFK8Gu3aqJOf3osiJkEEwECAAYFAj514TUACgkQPo+38viDQdneGgPn
+RL56FbdifkKziqJVkXLNdPeHAH924v/k0SAoX4Z7UlLuzKGF9pyjeOl4XOWuD5yv
+FyjPMByZmeVOzPdsjPRAo+6y72POePrXvxZn6wdy/gEgceWxCC23DOdq0iIN581E
+Hc8mcKTrLj2ND1WPCNjz6iO74qoUKGxM3WbJpfeIRgQTEQIABgUCPnXlXQAKCRCi
+EVrhX2uLcmOPAJ9Lyg2fvTxGVamEwgvP1cf7/VU35ACgsFKVNlQ3qlSmPgeKDYr3
+cE3QfcWIRgQTEQIABgUCPhOHsQAKCRDu0eo5ImHQcwvLAJ4tsiuDE2UY17kdNlbW
+JUbGQim5bACeP/31gQEQBPKbbhSungcj/uiZHcOIPwMFED5119b9b4jGIdCnGxEC
+KCsAoNiERBYp3lGM/e041l/Dp4NalwfoAJ4vPM9qLN+CwKKqkPcFWT361dd9mohG
+BBARAgAGBQI+d6vlAAoJEBU/oM11pnaSFgYAnRXQPTwosdoB2tkdAixHt6r0SX5d
+AKCF3u+4wK/1/3NJLbe0rsthERhpE4g/AwUQPsEPa9vSRfyzsqEsEQL7MgCggSp9
+AlkHuIEjWqWe+cf71MI0/m4AoNqapfJAGP3nrFopelr8X3SmXOLCiEYEExECAAYF
+Aj99kD4ACgkQiNfNvfQ8L5JSDgCgtO3NvDQuGjMttuzQQ2q72/TKg0AAni7N9ZNz
+IYiK2tDIGHuZpvJKey7NtBlBbmRy6SBNYWxvIDxuZEBwZXJsaWcuZGU+iF8EExEC
+ABcFAj020E8FCwcKAwQDFQMCAxYCAQIXgAASCRDKaTl0gQOjfgdlR1BHAAEBkhUA
+oJeJ/RvFnduhbVt7aBX525PsY2PEAJwIsvADai6FHkyc0awF8XwLjF3MoYiZBBMB
+AgAGBQI+deEvAAoJED6Pt/L4g0HZAiQD50pdd3/xn1Ue76fQ9zShqBpP0YliD9Iu
+Co0Gh3PfATMYDbXqNThtC6jEDOyyeR8ZiJsJGwTh2eSRRVK6YURYy8ef7FWXiT8P
+MeMThCqui3mL3oovpZXTX7S7dkwY84OaWIyTc42Y0Yf+sI0WW0LTwnKId/NtxF5r
+nfmrcgkgiEYEExECAAYFAj515VQACgkQohFa4V9ri3J1UQCeJ6XBQjbUpYRgsndw
+2MD4p2WS8vUAn1Pe+uc60dzzIyzbJMLLI2CVro5+iEYEExECAAYFAj4Th6kACgkQ
+7tHqOSJh0HOCRwCeJkoqsG6ofuGk1lZS/6EBwupfppQAn1cs8TPKywSVEF5/kXpz
+MbFKMoAHiD8DBRA+ddfM/W+IxiHQpxsRAkHHAKD0TvgAFQkaIm3ihevb0A9bZdo6
+jQCdEG+yxufIV7YrMdR+ACF2YBRmQi6IRgQQEQIABgUCPner4gAKCRAVP6DNdaZ2
+kprhAJ0RKBvHof+L2PUAACwcNYxPmcdZzACfQn45gJqhY3iTuaSrxbtt9Uj+GAWI
+PwMFED7BD2Lb0kX8s7KhLBECfpEAn2SgNqS1FFCAa0qswKr+0VXRCLlBAKDvAj4o
+Fj0vMELaxdqLRpofJo6aDYhGBBMRAgAGBQI/fZA/AAoJEIjXzb30PC+SKbkAoIZv
+HORjyXUWiVtvZp5IbOg7PpmAAJ91B+sAXSC0KZAYdKiREaU1LuRIz7QdQW5kcmUg
+TWFsbyA8bmRwYXJrZXJAZ214Lm5ldD6IXwQTEQIAFwUCPTbeIQULBwoDBAMVAwID
+FgIBAheAABIJEMppOXSBA6N+B2VHUEcAAQGl9ACeLEMFRQIDIyptxewoPoarWpv+
+PJsAoKSt98+huyZ8ZnJbi3rDyUs99FWViJkEEwECAAYFAj514TUACgkQPo+38viD
+QdkofgPncrDfQy1Eqthl6zSIuqcy40VnIhZl6oG1QKQkpJFlWnfwBXGnxs3S91ZT
+xePXizV8ZEsTMxo9WpYOVkWF3f6OUFs0wEvRWNbH1OFZ+J7m/04xk0aeWSaTBc0B
+qDRDexm/kh7baUm7AHPVv5t6d4F9q2Udip1XSaEEXjGFW6+IRgQTEQIABgUCPnXl
+XQAKCRCiEVrhX2uLcnROAJ4qfuGagTHfXOQZxgtbv/xNBuDTmgCbBxmInYjKqVi5
+PGc6WqRjXlGEtWGIRgQTEQIABgUCPhOHsQAKCRDu0eo5ImHQc/y0AJ9Ygmr9qBZp
+gKtGY92gycOjY/nI+gCeOOMDnT20bRwsUY0KsPzfc3/n/lCIPwMFED511939b4jG
+IdCnGxECtWQAnjSqf+kk+QE0ySD/dmGKtV6m7rZmAKDHJOzT1DbySPVPYsRI71Zy
+LXRMyohGBBARAgAGBQI+d6vlAAoJEBU/oM11pnaSMpgAnjQjqqitLpaXEVX4xMyh
+c+SWwwqfAJ99J4WGSjx2TP6jH5F+g3eIBvTgUYg/AwUQPsEPdNvSRfyzsqEsEQKo
+KQCeMNi3xC7+A0W360cw2sVo3LFmEIMAoPiQkWR9p2nw2ZBw6fwFSC6ZjfG/iEYE
+ExECAAYFAj99kD8ACgkQiNfNvfQ8L5ILRwCfR8G61cs1o2rtGRuLRVxkHFdLauEA
+nR7PIdcv7egOVuEq7nI1/mVGyJ7UuQINBD020FwQCACzjBVkgyKm/qUtaK2pLCcA
+TUKioRrdEROiw85ojD83rtV5mW1XrvFfwekCbWMyBvDAlF+jF0IjjKaH7o8Q3I9q
+S4md8cetsH0PMpDqgxzX2sGXUO5oBckJ8InJM6QVj/FyUHmCaqcttaIJWSZBpv97
+NWKDrgscC5rCbmsZL0Hi1kLfxfllQvq0snP/88wWInRFyHrqHu3XVmyeA+08LJae
+GX9T1zPvKL+nXO+7TBswxGszE1lJmkafKnGzg2NLpZKKZTUNaFJhQnPqMsGNu9x7
+fwqE9avYnNLyIrYPy+fSZPsMtn2VS1TkbhVPQOMhq8J6k2WiHSd+/rNx41X+6N/3
+AAMFB/0UOqYx/526cVcqufmTUjsZ/ZHa52VYL64czno5u8D0Y7yw96rKFscnNbRu
+l6kY4RBZ3VRqWBPE8OLlNPU4NkpV3FsFnj3e1e+nmv4dRTHGENy4ufESDcu50JxT
+4obM5FjbdfAH81MPGZee97O2CYP+usTS8I/6fd4D4wsU24WAfpKIuHChjgpUAFOG
+9386j7TpRCMZfLQk7bIzZsa6fnNWxfdJGAfPrsKMAIc5JY4HHIfTjr8fZpe3Dxy8
+cxc+ZWdi6TUU2L9BAhsAh4OhuqnAN1/AChB1sCbe0zr8eLSwMkzvjBhYXBCpRDqR
+1BafVsRm09g03ZOeUVX8aFVN3Dm1iE4EGBECAAYFAj020FwAEgkQymk5dIEDo34H
+ZUdQRwABARO0AJ9KSq4YtCH0mEvc7bmtEYMg61OlzgCcDbnaS4zc3461d1GAxef2
+vZwJNc+5Ag0EPTbc1xQIALLx5n1nvDmOVjAGvYwXphGXDTdK2yoy5qhElUs3LtgV
+2pCsLmh0USK1IXc2pJN/XWq3FKkQd3W85LisWcCF5GvYlKlYS2Y1NG5k5TOcdAx8
+4ZtIxu6a79we6dJCQ4QPQMHDCxejw1Zflgg8Ml8Jex9CgVsTH9dR2OunrnPFdWB1
+M7zanFa0oMOpSMtn8s2YyMES2SeiBlX/ZDDlPvwBAW0nfwJ6X6ybPq0WD134W73t
+UqwU0lkXTtIVejix+3sUE7tHo/Q8u4Yr57uZlhgCCG5vYuMTmyRW7qSb2QkrNULf
+6aR5BLN/3ghrmX3VkcZzsuuvi4eWNjFFBsB9sxNRo48ABAsIAK0QfXGaO9utxSWy
+eOITFbv6p8rbsyv175hBeozB1mpEK8F01NJV5BkHGd03uOAjWo1e0IbJFdESG0tf
+wy7GbvbA+b6NP6fg7BvX/i3ca8XrdwAoasaMck1+RyUO8CCRqc2RY3V1ngL7z824
+Vn113QO7bngykdbO8Ub4A+LYoFv7QMgtjlbKCS4PTx8dHKfQWVz1a8F1qUIb6Abe
+UNt8GiehiUfZ2YaUE3CiMR0CYQYZJ61R8CmAw/ZwiKjbbde10n8uMhWOMmgCG5J4
+QCB1TAsBrH2fU+aMiobSp9Hz7UDdjDN1728LVdoEeaA5oArDhcEoIzwZ/Rgb4VxQ
+ZB7NGE6IYAQoEQIAIAUCP8am1RkdAmdudXBnIHZ1bG5lcmFiaWxpdHkgOi0oAAoJ
+EMppOXSBA6N+zfQAn3hYxwNd6/Zh9/9vSrBjnil4d1AMAJoD9Vi2J6DhxHDrUiw2
+i+8RU+4msYhOBBgRAgAGBQI9NtzXABIJEMppOXSBA6N+B2VHUEcAAQGSjACeKvXX
+kfcE8otR7xgRu/nO0LOLjSIAoK4gCL2NJ80W8HgC8JIAkHU25Lv+
+=93VU
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub  1024D/75A67692 2002-09-28 Erik Abele <erik@codefaktor.de>
+     Key fingerprint = D395 C757 3A68 B979 6D38  C258 153F A0CD 75A6 7692
+sig         75A67692 2002-11-23   Erik Abele <erik@codefaktor.de>
+sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
+sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
+sig 3       2261D073 2003-03-17   Astrid Kessler (Kess) <kess@kess-net.de>
+sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
+sig         B3B2A12C 2003-05-13   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
+sig 3       8103A37E 2003-04-04   Andre Malo <nd@apache.org>
+uid                            Erik Abele <erikabele@apache.org>
+sig 3       75A67692 2002-11-23   Erik Abele <erik@codefaktor.de>
+sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
+sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
+sig 3       2261D073 2003-03-17   Astrid Kessler (Kess) <kess@kess-net.de>
+sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
+sig         B3B2A12C 2003-05-13   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
+sig 3       8103A37E 2003-04-04   Andre Malo <nd@apache.org>
+sub  2048g/A680673F 2002-09-28
+     Key fingerprint = F2A1 2400 3799 B66C 7530  19E8 D8D1 82E4 A680 673F
+sig         75A67692 2002-09-28   Erik Abele <erik@codefaktor.de>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.2.1 (GNU/Linux)
+
+mQGiBD2WL90RBACfr70TIDSk7pcnS895qhkiBp1A3wunMVIshhmxNpjxxJAWnZ+5
+wS8rvtwksMmjW7LCK8UA6Jt0avsc12qyufiR+pfhMXVtJmGQc6VPHd/mQcQS6SM0
+/G7xpt7V4mRB2gIZULFlaSb2eJNFNo9faAJOv3pjnG30ON9MBHy7kJwo0wCgreok
+3H1+Jbv2X9NPSfh76QoiPQ0D/j1GsAIiZ18TFPD6UA5Xwh0f4jBNLNK50/xgJxvC
+adVAP0RPd6xgqYQLThMEQHyX79rVnlmW4HdtjvcxzqY5yQ4fTGTrEvMn2kj+UPA9
+xQfc2Lb0dHdkxguSicMpkVXKTP01avEpdIRO2zHVYKNeX75pKYQujD8Qq0QS+SsI
+4WvVBACFhAgGxxnoFzxprEmg9wkGaeiF6RlTLtTyHHqRdubdUkaa+rH2AWtSQ0h/
+acyePAvl2ScpGbt325TPfAQcW9ewCno02a80/7TfzOrktSZrM3yxVQz7cZYoZRup
+GUaN42eWUFRaOusRTBJyC1VBXeAkKJy2ZkgqVsbG0jx5kMFOPbQfRXJpayBBYmVs
+ZSA8ZXJpa0Bjb2RlZmFrdG9yLmRlPohGBBARAgAGBQI94AzpAAoJEBU/oM11pnaS
+KigAnj3zryS/aoPAoaxMhJAh8MPDtN2GAJ9R6/wC2EYBpAK2WiJzCUFfC1Ho0Ig/
+AwUQPnXZXv1viMYh0KcbEQLpLACfd1VwFJi67I9ZgGfGg+wgBny3kU4AoLszthWa
+cm3dHZl9ZzEdhNVWbEgDiJkEEwECAAYFAj5137IACgkQPo+38viDQdlNEgPkDd2a
+99kBVGY+PguJVGSIgtBYdmpu5DpmUfWaibtJUnIAxOk7AT9Ke7kaHAkp+JevV/d5
+4Hpy1pD2bYUitk4LfiprBtd5FtuT1/Qmk3d244mP1O857tVpUdOwKTN31hAr9E/u
+T1eMf7Yx0iVOuopiFAzYVFqZ0DgdIjPS0NWIRgQTEQIABgUCPnXaWwAKCRDu0eo5
+ImHQc9X5AJ0Z5IxYs2/x7XkMtOpdkOrvfkX+FwCfcjIzrpa/vOdIAXL3safBoMlu
+PgeIRgQTEQIABgUCPnXf+gAKCRCiEVrhX2uLcnA+AJ9czJ5JfRoGLaDeBwGk/Ydn
+XPeIrQCguUK5wJHnLE1TJUb1lrt/n45dCY2IPwMFED7BB1Xb0kX8s7KhLBECS3YA
+oI6mca0xDsxDc2jVfPMWBHy+M73tAJ96CL0jNtDe29PvmQiqWL+XBH1e8YhGBBMR
+AgAGBQI+jc/QAAoJEMppOXSBA6N+7QYAnj2Ci1JyfoDLYozP0+P8rcF9fUHPAKCz
+eEHJcMEBY4/Iie+inr7aD17+ibQhRXJpayBBYmVsZSA8ZXJpa2FiZWxlQGFwYWNo
+ZS5vcmc+iFcEExECABcFAj3gA1cFCwcKAwQDFQMCAxYCAQIXgAAKCRAVP6DNdaZ2
+kqTcAJ9b6SqN/SWtyDhAjwwVxhDAgpqYFQCgpOFZZ07RA3tLNBmPPsPVyOjhWC6I
+PwMFED512Wb9b4jGIdCnGxECzzQAoLVx22FhrxOpd2K5sa4/UE5t7croAJ9kHMrl
+tZt832fOmscRoAG2OHjDT4iZBBMBAgAGBQI+dd+8AAoJED6Pt/L4g0HZ/ycD5Aov
+I0RWvFNQsKh5/5vp6PRmsGPHGsptgZcYbkBh78ivkysASoyPAXyRGakeszeMoXgG
+qNb0WMInaIp/EKxiYH8xYq8FcGlX7vkRhM1zJkJsbWvsSNhR8+MgQ2D5KmVEeo/+
+OG8c0XLo6wQUa3Y5SwGCQtBFbbZwZHzRLgphiEUEExECAAYFAj512mAACgkQ7tHq
+OSJh0HOZuwCeIGKuddy18n7LrQ9onHIBN1u0iHYAmOKdJHhl9EV7d3VgTgdVtNDV
+Iu6IRgQTEQIABgUCPnXgCAAKCRCiEVrhX2uLcopTAJ9Lbh6cy8flzIn33YWb5Ao1
+S2bw+QCgp5Wxf86vhw9zy3zZa7WRN6sf3J+IPwMFED7BB2Db0kX8s7KhLBEChYsA
+nRosJaTfQroNwWkNesdYJd8kX2QzAKC13PFvlD5QiuP3cGJdpjF0uGVTC4hGBBMR
+AgAGBQI+jc/XAAoJEMppOXSBA6N+2qEAnjWL4KKHF7uiniUJ7J+8ickC/zubAJ9L
+Opt07eUYMEoLmDgcgWt8AEQaL7kCDQQ9li/uEAgAjhxXvtN1+g5/Aa40FFAJiRKh
+G6Yoa4oCA99HJEubjH6FKGfWE3j07WFpQ99jPcTdeEAEla+8I1VMLkF2kR4V+0oK
+0ilxRs2t/6V+h7KsqLtivGOCEIO8/uRLG8RUJos6LSHeda8KYEJm2K92gPX/PQC6
+mqZlToSyj4pun+mUMqM6Hbe05Updygij3ly7h1YQRLb1dUOIb/Ju9R4c3TnFQgFr
+j64c2hldJY4SPcM9rL5ffOj3TUnMLsaMdoLrML04H5wiIK11wpsx3bFeGcafoXHb
+wh21RxDK/KOVc9RUbw35H1Gahnr6ERnAOBz1SJHp30y2zDsVg27I0BCj81eANwAD
+BQf/RrdNtskNbuNSxsL/ULN94lSwowDlpcIgIRbFEfqyvCvjGDuNVz6AlHsierCW
+tIn7sD5bEKIGgJKFaNbAuIuBJ+PGhzlL7SCGWW9S9B19JbXBF/oBzvmdbs3HPm3T
+X3qAuvhVZ1b9F+mJTB6+Ub9/c/Ya1FugXzHfPyaJBpestQXSQGmgaAQd3+Y9YLHI
+tQJumfW/AWTCq5gFnTa87QpN+GsLIx3v49wtu9S+aRgEpl4Dbbf5LwCYtI51xomu
+Efdb4M2v+frqgvP7Wq9L0c5DPmqFrslVzE+i13eoPJxYv/uMdmEtdZG9JZgZSimb
+0LeNsqGJ8KZuFXrUIOCSUCIu9IhGBBgRAgAGBQI9li/uAAoJEBU/oM11pnaSshMA
+njooG5OC36mXXMf7EpADoF6hdVpOAJ9dg1mmlKY4jAKuyCAnJT4U5yjE7A==
+=Yf4N
+-----END PGP PUBLIC KEY BLOCK-----
+pub  1024D/2261D073 2003-01-01 Astrid Kessler (Kess) <kess@kess-net.de>
+     Key fingerprint = FA39 B617 B614 93FD 2835  03E7 EED1 EA39 2261 D073
+sig 3       2261D073 2003-04-04   Astrid Kessler (Kess) <kess@kess-net.de>
+uid                            Astrid Keáler (Kess) <kess@kess-net.de>
+sig 3       2261D073 2003-01-01   Astrid Kessler (Kess) <kess@kess-net.de>
+sig         8103A37E 2003-01-01   Andre Malo <nd@apache.org>
+sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
+sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
+sig         75A67692 2003-03-18   Erik Abele <erik@codefaktor.de>
+sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
+sig         B3B2A12C 2003-05-20   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
+uid                            Astrid Keáler (Kess) <kess@arsnoctre.de>
+sig 3       2261D073 2003-01-01   Astrid Kessler (Kess) <kess@kess-net.de>
+sig         8103A37E 2003-01-01   Andre Malo <nd@apache.org>
+sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
+sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
+sig         75A67692 2003-03-18   Erik Abele <erik@codefaktor.de>
+sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
+sig         B3B2A12C 2003-05-20   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
+uid                            Astrid Keáler (Kess) <kess@apache.org>
+sig 3       2261D073 2003-01-01   Astrid Kessler (Kess) <kess@kess-net.de>
+sig         8103A37E 2003-01-01   Andre Malo <nd@apache.org>
+sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
+sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
+sig         75A67692 2003-03-18   Erik Abele <erik@codefaktor.de>
+sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
+sig         B3B2A12C 2003-05-20   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
+uid                            Astrid Keáler (Kess) <astrid.kessler@bayercropscience.com>
+sig 3       2261D073 2003-01-01   Astrid Kessler (Kess) <kess@kess-net.de>
+sig         8103A37E 2003-01-01   Andre Malo <nd@apache.org>
+sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
+sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
+sig         75A67692 2003-03-18   Erik Abele <erik@codefaktor.de>
+sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
+sig         B3B2A12C 2003-05-20   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
+sub  2048g/A676B84D 2003-01-01
+sig         2261D073 2003-01-01   Astrid Kessler (Kess) <kess@kess-net.de>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.2.1 (MingW32)
+
+mQGiBD4TcBQRBADAwVM+jE6VQUNhOHL/0L+VsWC/n5tMEbINSYUj+7KFrWqlTLgc
+nVA9vOGlScm+STor7YaE5Uhni6WK9TfmMBrLL/qPBVVH+jh3J4AYv9IzNuqmIyV6
+eLhQ90jcL59orD2EnbVf9S+Xa1+5zatxPFH97aqd+wTbhiGhNGXyyrwk1wCgkgBy
+hImcmBHd11v8e8ECbn+h8o0D/RJAfUKKfQtJjJk8+gng0adRgqYL/XT1F8PTcFir
+MIvLrXXDv8X0JZ9PZ/AomV+9S0spqT9jStRIohALb7LiiWfwdOeE96tUNe8bgqUx
+SIJRku3NXJlQgxwI1eQr3kVT+vYwqhc+Pd4mngrmcDqRDgYqBRdvVU8xqVM/dU5O
+VzPzA/4jrpenZJl5SWDPFn4Al7enlvnYOd0ptvGO/tL58MHvJiAlFlB2xewiX/S5
+GYsidApV1+U3dCUyQadOxb9ZijGC/x6ck9Td+i0BMEC508tUCmWC64JYCEnbOi8x
+OzpQMUIM6KvfuY+4HqWe6efhnDFfrFQUl4Net7gVVvaKzwzSwrQoQXN0cmlkIEtl
+w6FsZXIgKEtlc3MpIDxrZXNzQGtlc3MtbmV0LmRlPohZBBMRAgAZBAsHAwIDFQID
+AxYCAQIeAQIXgAUCPhNwFgAKCRDu0eo5ImHQc106AJ4sQFbRVLQIFoi73RTzRI3J
+yL3wrwCcCxDCMy8ry7JvHUnsdryCMC80s3CIRgQQEQIABgUCPhN6UgAKCRDKaTl0
+gQOjfkrRAJ4z+GgWkgcNOAVuJ3AxJRSPlGS/qQCfWmfU1ioB/a8SZoegKDYMfKpl
+4zmImQQTAQIABgUCPnXgiwAKCRA+j7fy+INB2S6VA+dVyKV0awmH56wznCWWNGMC
+F2qzYAV/KfTETppEofVUFO7wHy/jle352Ucdu19aA5e/H3+2hiutS+8ORO8QMv/1
+mziMskrKTbT7xc9C7PQNOIdyM/EqanD4LF4aFIFKpvxRWumaxU9h1jImfabJHZg/
+jE6jWm0Fwj2qlD2tVYg/AwUQPnXYBP1viMYh0KcbEQLugACeKn1RUCsBWc/x7eEo
+yE/RAHVaw38AoPdmhDP9iH+SvDV/5UlJG2C4Qe5oiEYEEBECAAYFAj53pNwACgkQ
+FT+gzXWmdpKRyQCeNqFBkH4iNDL/rNPwgydSXykRSmoAnA36OwlYpSflMRCQjxc0
+KeAth72xiEYEExECAAYFAj515YIACgkQohFa4V9ri3JibgCfaqVNUK/VvMEzuI96
+dH4kGhmMJx0AoMNkxWQXpFugNbFqrGRgurHS3YO7iEYEEBECAAYFAj7KI1MACgkQ
+29JF/LOyoSzx1gCferfhaazwRtniE6H9Px/JuxF4X64AnjWMiRahZyqUOyLjn9NB
+Xe/VMfmptClBc3RyaWQgS2XDoWxlciAoS2VzcykgPGtlc3NAYXJzbm9jdHJlLmRl
+PohcBBMRAgAcBQI+E3h8AhsDBAsHAwIDFQIDAxYCAQIeAQIXgAAKCRDu0eo5ImHQ
+c9UpAKCOMBmZlo9iUnkIZpmojoxWMTWx2ACcC1TkKFzgp9YmuD4VkMR5kx6KKAaI
+RgQQEQIABgUCPhN6UgAKCRDKaTl0gQOjfqs9AJ91seXqRoGQegd5Sg5b1aawf5O2
+bACcCENC93l4uzFkZHLnikMdsPLXe72ImQQTAQIABgUCPnXgjQAKCRA+j7fy+INB
+2UwHA+deIxwJw9zoaRBIovlFpvFs82DdI736enhui0dZihSRbrCaT5TocOICf2S9
+gxBqksIaVX66OgQRmZzURAlTNE/9AgVMwuKPMxQNTIfqhsYYlSI+6F0kDlZPfRaR
+fZR20FV8ZEjITSlVxrcSXtAgJjErxdpM9TO7aBwc8Aen5Yg/AwUQPnXYGv1viMYh
+0KcbEQIwaQCgniOy83lysIlHKCGOC6HjRmnXhgQAn3SkuVSh6ELutSyPw6t+9vs1
+173ciEYEEBECAAYFAj53pOAACgkQFT+gzXWmdpKQlACdH8uC2kyy138l+dAgAz8q
+ht7aP1UAnRkHNPAzmsIZpxrQfI2XrO6R+ORFiEYEExECAAYFAj515YkACgkQohFa
+4V9ri3IklACgqtZocUtEssgWVHHtXvoRHKohHLQAoLfhSrQWl0U5xUFyMwdw7ICV
+LwELiEYEEBECAAYFAj7KI4EACgkQ29JF/LOyoSz4QgCgiT4OGQjPTFCIfqfiKaFx
+whYXxwcAnj4pmD1Zb5kv9bKQvLh+2f6elgXQtCdBc3RyaWQgS2XDoWxlciAoS2Vz
+cykgPGtlc3NAYXBhY2hlLm9yZz6IXAQTEQIAHAUCPhN41gIbAwQLBwMCAxUCAwMW
+AgECHgECF4AACgkQ7tHqOSJh0HOaagCeNgrOmUUahKTedv0Fjuumt+l26kwAnR20
+ZDRi63Yi1rEzpL7eNJ9lBUMHiEYEEBECAAYFAj4TelIACgkQymk5dIEDo371lACf
+aHoV/aWNsQiCTN/E7XkisU9rdWsAnA8EwJWG59zff1/r5FC+JY6IXNeaiJkEEwEC
+AAYFAj514I0ACgkQPo+38viDQdlj9QPmOhr2tdOghp2QBupznGUik/ogva/ZvDWU
+KbGrMP0dDoX2PvIahrRruonKBbrElWkPqmKFW1MkXS+lU6gFeYDzrze2iE4AT3dQ
+Muw6iY3yUr9jVJHEwMNZKk0FXx5l9FKYEhlFgoWxfOWhM4/CkxRTcyxGpNycG/kl
+Yasn9SuIPwMFED512Ar9b4jGIdCnGxECcUQAn1bhun0zd9C2I/of4vonPwLUKkKE
+AJ0ZQ82v+t313pFt2EiO1AqjX5pRLYhFBBARAgAGBQI+d6TgAAoJEBU/oM11pnaS
+pfsAmOd4LVw+9C+Q5BAVU64nXaSRTLUAniB4Lr1H/H2EUgU7QtImvAF4dSddiEYE
+ExECAAYFAj515YgACgkQohFa4V9ri3JOuACgmo/f2GmjPHO2W+W6O+I4cGFCT0oA
+niL5Y4zh9JjaJpIcJXiS4g+HyAMNiEYEEBECAAYFAj7KI28ACgkQ29JF/LOyoSz3
+rACg+9HCA3XInNfIM8bpqF4fC8LypjEAoOwrJcD/NFoETB5Gl2KlvFnWTQdGtDtB
+c3RyaWQgS2XDoWxlciAoS2VzcykgPGFzdHJpZC5rZXNzbGVyQGJheWVyY3JvcHNj
+aWVuY2UuY29tPohcBBMRAgAcBQI+E3kIAhsDBAsHAwIDFQIDAxYCAQIeAQIXgAAK
+CRDu0eo5ImHQc1amAJ0V0IX6W57sUsgP3jaHy9sdL/BHGgCcC1aGh5+WhdCYSQNf
+DMtsRmVrbeuIRgQQEQIABgUCPhN6UgAKCRDKaTl0gQOjflloAJsGWsl/jfrxjyTk
+Fx9kHHmtkZHY4wCcDj503AAQHNAUO9qswSSHvayTry6ImQQTAQIABgUCPnXgjQAK
+CRA+j7fy+INB2cyhA+Y+5CHNOHYOpw/gcYUIfc1OeX4IKWgZJImlySe8Pydzx5oJ
+275HAdcRvJEehXIaeCCPNHve20gGZWrBQowpMrO3AZXaHm3LKgW2jVwWNNgbo0jy
+7kvnijeujQlZC/wNRbetIoBdQIrPraywZgNYeaEAmSaW4TigavZTg1nr9Ig/AwUQ
+PnXYIv1viMYh0KcbEQIL8QCgq989k6yY2OkOIDF8QUxsG6bVegoAoKDNrIPhwPD6
+gj4rwK1TtFpE/s9AiEYEEBECAAYFAj53pOAACgkQFT+gzXWmdpKXEQCfbcQs7zcD
+Qb1OEwR7FwpSn7CxLn0AnjuK8206aC6qwVliEoIgmakZoVumiEYEExECAAYFAj51
+5YkACgkQohFa4V9ri3JouQCg4Y6nfjgAmkSA8STWFvCx+EMO3kwAoIMylSE2Kr5p
+VKnVqHSihrmFa9N5iEYEEBECAAYFAj7KI44ACgkQ29JF/LOyoSxk6ACgltr57L02
+sWUhaPWojTRQTG+FgsUAoIRw+CjYOaoHJgbjJhLhH7GefSHBtChBc3RyaWQgS2Vz
+c2xlciAoS2VzcykgPGtlc3NAa2Vzcy1uZXQuZGU+iF8EExECAB8CGwMECwcDAgMV
+AgMDFgIBAh4BAheAAhkBBQI+jgk/AAoJEO7R6jkiYdBzkEYAmwauRVlLQWfQQWYL
+2oETUR5r2LWMAJ4li2XuW3+Q9ieAcYVgLW5JVrIDkbkCDQQ+E3BzEAgAoNcpH15I
+EiWXX5dHI2H94Qnrff0Xl4j1Wdh+P/JJNDA8FrOWCMcGSR+RCDPYiZ+R1bNskmiU
+2fBnb/KrdVPVtGYc+Fm/51PeA7oxV/hyI7JudyouEm5JW4x9JzNcDXjnVWxt5Ovd
+dJX5CDU6NmELPycKArRAxuS970htnGXf9MzhBsqjCWyiq226r1d7irnXXqL7+nC0
+DPOcyV1FNoralULY3qpf7k6oxadjJ24x4Eo3GbZrse7IJzdO6ojfros9Mo0VVnnC
+0lRh4BHpOGNav8DENySNcWKUqCFSG6Pp8fvz5Py5pHP81sLDewaBp3wMrtKWt613
+N15Kuoy8FbeTdwADBQgAnNdV0mjGHWoOe+D4s61mm8OsawGSk5VvmxgClcO1uYO2
+hlCpRgpSSVwoy7Gk1BAH8iPRR0/zTk6tR/Yqgc57BIDSD/FSfDOEMj0FkOt07DEq
+dAqyqF1QQlmznMV8qWXCaVXZf4e3a1zTS233RU6ue7uF5iAvqSN1AOoh3dEk8WVl
+Na+Pdtao346XOK+bVDruJt9yRtW4AlR95Oy+FqPSSF0DzaH5MDFPCBJjZFuWAtOT
+pyKV7bqrREbzDiNNWHY9D24wk4jTvXakNPNWU2LSIt2MFvX7JUZHr39AOIuzOq7Y
+Hg6fISaeVG9bFLioCzvLHHwO98U3dkvXZWBMDRv1F4hGBBgRAgAGBQI+E3BzAAoJ
+EO7R6jkiYdBzo9MAniGRGjIDno4FmOE32kgt2U5LEvIrAJ46RiKuEJ7Yf6tf9CPQ
+d6rncSGIlA==
+=SNQD
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub   1024D/208F5064 2003-06-13
+      Key fingerprint = 984F B335 0C1D 5C7A 3282  255B B31B 213D 208F 5064
+uid                  Joe Schaefer <joe@sunstarsys.com>
+sig 3        208F5064 2003-06-13  Joe Schaefer <joe@sunstarsys.com>
+uid                  Joe Schaefer <joes@apache.org>
+sig 3        208F5064 2003-06-13  Joe Schaefer <joe@sunstarsys.com>
+sub   1024g/ED4260B6 2003-06-13
+sig          208F5064 2003-06-13  Joe Schaefer <joe@sunstarsys.com>
+sub   1024D/F8B0462F 2003-06-13 [expires: 2007-07-19]
+sig          208F5064 2005-07-19  Joe Schaefer <joe@sunstarsys.com>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.1 (GNU/Linux)
+
+mQGiBD7qX7gRBACxF9D8+GYaiLC/c7eyNwuxQJtbkm6myjuhUoZsG6o0Z4SPNqP7
+dlQn3uYIQeRrT3pZjXCpcxYAq10c2QpDNR/Ip3w20FXF/QDGZZ/B+DRAY0Te7jv5
+Jri2qRcJXOaoUuLV+BhG0w05dzcNrgONMJKMR+TXjod4M8HQdXDb9PDXkwCgjPAt
+zuoroLjvjz6GeWYiYmwWhzUEAKM3cqxbWUdsjho6RD29KBAAcc30W/qPzVZ/+ofJ
+SoIgnf/ZnF3ZszVQM8qZYzvE7bgMrZJPDcb6SNGM4sX3D3yBAL+KldKlC2pZriL+
+Uv68e4zVpf+7mMEtk0GoQLoG4QQ7XgHA6O+mIoL+zu0I+VwReEjrdOlRBjXrMfr+
+L+GEA/4q0Zk8TP8iIh+su09UHlIU2c8LloRGmxiPXw6GJHgLbY6Aa/DotLBHFLNJ
+LGD0zHhKqUl2n20FSB0fLikNppETF+gpp+6jzbfMGd8HAcfOgyh2VB8ShNuz68PT
+mZEQuUAPOS3iyo7BUnpFiPnv3NqVqPq9LyR6batV3StDVeyhC7QhSm9lIFNjaGFl
+ZmVyIDxqb2VAc3Vuc3RhcnN5cy5jb20+iFwEExECABwECwcDAgMVAgMDFgIBAh4B
+AheAAhkBBQI+6l+5AAoJELMbIT0gj1BkUf4Aniwfn4mUmtfAw3S4HRg1mbKjk20O
+AJ9HkxMkzG70xfROQXVClz5FAUp3RLQeSm9lIFNjaGFlZmVyIDxqb2VzQGFwYWNo
+ZS5vcmc+iFwEExECABwFAj7qYDMCGwMECwcDAgMVAgMDFgIBAh4BAheAAAoJELMb
+IT0gj1BkSUgAn22n8mLipL2NJM6jrD0alAeoDwiAAJ44564cvmM02Y0d705OFHgr
+eftiwLkBDQQ+6l/DEAQAkXQA7401V378j6PeasecoTwIxp4fQen+AICPeoYeuZKK
+qZeRh9Y0U8uAfNVdqNPSt+lgzQnoEpLdUSf5TWUPukter9mxxf8jATQ1W2Urrt+W
+xHw6cjJs1qdHXVJ8eWl4lJZon/JhcP6UnmKFCSse2SM/moywzMNKb4Ti6tHrsIMA
+AwYD/R6O4woc04s5fZn2XJjbZIcbLWemNpCMaRQa4ikHSwmh7HFZHwcU90W628Ms
+mK5nK7W9bZwydwfO82fPX95/RWVZitT22pLdKVxwjxxlE37cHcA8PMCMzLZ6BEly
+Hx8+3NNrtOT45C/gDlcutrdUBX6teLQECUe1o/a+7eh1qoIUiEYEGBECAAYFAj7q
+X8MACgkQsxshPSCPUGRaBQCgiVKCXgOCVhyy4TzQDrKio4aaG80AnjjgOcR1sjdE
+tCiRm4U1mjhlfYkGuQGiBD7qYc8RBADDggTr2/IrPdiP0L7iVRu1xXf/5+UU1/Bp
+ff8Em1afNH13ptnBrhI5ifMUFGwJoANUtfGEXCAynB6pCamEq3pAscNdNGst0/ul
+y4kLp1NJXdjvgw1wozRjnkJmIVTLa8Yg+aoYPC+tj5+74zmO5QvY9ZHXvdtYnrAM
+tViV0gouAwCgnhjt06CpXVYOJURDvlw7nvDkssUD/0idmaMKUCp2KzNL4v3uUN8L
+KF8pdUAOF0zPUl0w30KrWw9bO3sGmFfB7BQ9RYqzifcg1Ks/m1qVG56q3gf2ux60
+Uz7nB9VX1Q0GXj3vpq2jz5QEEu/PJ5ZWN21ZoD6PhHTtYAwEukq5XeNxjPa4Hf/9
+16TqlebaFcc9U6ObObw/A/4go6icBzpStu6wZzS/A7RzBfaRhn5wUjaVRkI4NyMJ
+TWBrCkVTwtnNxGawMZyxdwwCHido2SuGgp3vze/Nw0PX0V/QdJPvOA230dNstAeo
+KfMTki2MmCnFOZGSvznjb5XIOeVoUWYW5KeZd1JvFZbxbAdyqfKZV4M1LPZG/aI/
+U4hMBBgRAgAMBQJC3OzXBQkHtPIIAAoJELMbIT0gj1Bkma8AnjfgRtuon/0wgMZn
+GA2FZPS3vn7uAJ4xC/LsaX+zc3ON5nLs7sNBpV07tw==
+=8SJS
+-----END PGP PUBLIC KEY BLOCK-----
+
+Type Bits/KeyID    Date       User ID
+pub  1024/0300A2E9 1997/10/12 Jeff Trawick <trawick@ibm.net>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 2.6.2
+
+mQCNAzRAzqIAAAEEAMJUorgTyMEZPP+vXvmW/W+kdoCqAx7PFNpepvxTsTc5CQLt
+Up9PvWrCGT/lAWO6qQkOsyNju/g5c/+cbJv3G0h4bOZPBEbRH3pkmAOAFUVUdmIu
+FM+piYLdoAeEcE5+bmvWpzddkuiRRNIsMjmNjuNkqgOtYEZnGaCc8zADAKLpAAUR
+tB5KZWZmIFRyYXdpY2sgPHRyYXdpY2tAaWJtLm5ldD4=
+=E80M
+-----END PGP PUBLIC KEY BLOCK-----
+pub  1024D/A879FCF5 2001-11-06 Gregory Trubetskoy (Grisha) <grisha@ispol.com>
+     Key fingerprint = F8C2 405F 8893 395E 4DA8  68BA A01D BC9E A879 FCF5
+sig 3       A879FCF5 2001-11-06   Gregory Trubetskoy (Grisha) <grisha@ispol.com>
+sub  2048g/0596F229 2001-11-06 [expires: 2006-11-05]
+sig         A879FCF5 2001-11-06   Gregory Trubetskoy (Grisha) <grisha@ispol.com>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.2.2 (FreeBSD)
+
+mQGiBDvoUEkRBAC2ZKj/jb6WQEPH3pU3dfC654tnYU80UlbBo6HUUgj9CB6QtECr
+GsV771OqbBm4YAxpIo1QCpCSqnQyE38TEayuEs+BVWgh3WvZb3mNHz/5NFc2kEpt
+i9YxGUkQ9/2sSEvGSVbEYitbghjLAFzQxuPfxUhxW8GnDBSOdLhF7Qy7PwCgiJwq
+406ZJz5UGvzuFgpMZsyRm6sD/AyAM3eeTMARQbYa2cKBFDwgy6wLZl+llDGYmT9G
+D+N1uyyLtiqNwR2ANBJC7gJVfNtVFIMLnQ3ms/nVFzTugQKyunlg2Koq+3ORDw2w
+Hc/IJZiDlW+oyYeKZNpze7FKFalC2BzKA2QJDG7sHOHuqN6GA3FpFpw+LnxPTjgX
+OOPaBAC16on5pd6AXuC1BoJ/TAJgXlirlRysJQbcRVMBgb3sUouXcg2NvHGheVzd
+BEwRRZWH5oSxQW+C/dcJJIzF5je49TgBUzKuKSIdZ7x7fM9mm83lVa9mFVE3DLZ9
+sL7f4QRcefAUdCvwl/9bQq5fx3ZiT2v12FNPkZKfoDpFvKbPrrQuR3JlZ29yeSBU
+cnViZXRza295IChHcmlzaGEpIDxncmlzaGFAaXNwb2wuY29tPohdBBMRAgAdBQI7
+6FBJBQkJZgGABQsHCgMEAxUDAgMWAgECF4AACgkQoB28nqh5/PVGIwCfXKn6dGHw
+ypchTj31SPs0mG8mmdMAnjmIG097j3WbwlA0cnLkd9cuyYq0uQINBDvoUG4QCADO
+YvhOJQ5hYohZJrSrsMZMe49HBdiPnguxa6tVBbXwnJwPgk6ceYliKMhXe76r1cQz
+pgqyVSXVqeM+dxlIb8+Oxjm78OcGXlGhRoN/0MdU5yvj05UnPhKX9PE0nfTHhP7P
+ROEs1EBfSkKjBFri+pvPw6QS/3wAundM0sO3OcZgrZJhbpaKCwocI+QnVaXjOzPk
+vhguMT1jboQH3H4qKHgu13neQ0T6g+29UkN6cr3lj8izTb78htybgKY+btRuF9IT
+19yCa598prBka8F3weCTgrYm0D7gNA5Mh93TMvmuQT1xwL7KWrTpDF39mUJjdrs9
+LufCe6dVlCw/fs6Ler+LAAMGB/4ktRdYZB7IGXKzAm3Ga1mhM0uUsMEFnE04npKj
+hA9VL2LbyGspHf+LH11SdN1SO3fOBN/6t82zI6/52oX5k5on/Ssa1Gjh86camewk
+0DWHmnDSySsRU67ClBlRl0ZFTqVYld8NxzXihXN7OzJSIJQ2clz68iegVOg1zbWD
+DhB/Hlysx72UOXLHi/KaXHMlW5A6lAmY61Qf9C0TR9Hcc5BJGimwF+hPNw0kIGw3
+oPYo6VGeFdm6P0LDVElw/gbQxjKW+qy3GYsINGZz2lYlz4H4DJkpW9gGFsM7l10M
+/baQqcg9BpBrOE7QTzfFK3GLzrNV+zf8dseRLvLnZ92HYqoKiEwEGBECAAwFAjvo
+UG4FCQlmAYAACgkQoB28nqh5/PVs8wCcCsMhi1SacFM1kpsM+JPdT/KN0qwAnA48
+NdqzrIzzrrlvI8FkkZZzKggV
+=kwZz
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+
+
+pub  1024D/E76CF6D0 2001-04-09 Stas Bekman <stas@stason.org>
+sub  2048g/01611FBE 2001-04-09
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.0.4 (FreeBSD)
+Comment: For info see http://www.gnupg.org
+
+mQGiBDrSKd8RBADpBhHzpCEB/tWZTNZ0B4oMSMsWBnukkYADPy7ydBUOZHw17ddL
+oKj8IOveqkX9Fdl7e32At1cd25kitU2nNXeQWt27C47LfDVR0iPfnVg+YE4jfDDb
+rnDAcMKROqjvTTwAuGw8S+m+yqmS2xXsKIBN8A7druhT8R3xg1uBBsueHQCg/ytA
+mFM+SjmUXumdid73ZmyK8Y0EANA2uWUEUVQ7PFipydmy2AWY/ZwYrrh79wLy6hch
+zF294PU8Ubx/lqENzZBLNfMTeA9l8mbc1jF+up1IBpG/0DRGiCDtWLBDjTGorIFo
+ow2zkUKK603x+qpdXV0ghxBkb8KalUQrFAh4fr4gSdnvLhLP70C6hS6g3MbJYNHf
+v78kA/9u9y05+tZyNTzeeEcFWXTJX4t2GT4G3J+85fjpxiO21bjNg/I3kUxEyIDc
+sjsr0G0yfbSIdAKK88BC/YlRR9WfYKwd8vvH9VUyroYgo8ufFYvhhBZZwP+FWw60
+mvY5EWLPk5g7rwT8Fqrg5y8rVSXTsZs/baesQPqkhFLXT+g5TrQdU3RhcyBCZWtt
+YW4gPHN0YXNAc3Rhc29uLm9yZz6ISwQQEQIACwUCOtIp3wQLAwECAAoJEMyy60bn
+bPbQnXQAnj8fmeXLyodcHPASyt376IUzsar4AKC98XkNtS8gl4AfCCfOUkGNrh59
+B4icBBABAQAGBQI60Z9MAAoJEFMHR+Yj6eq1eLsD/inQzkDNOsCDEbOF9calmv/C
+QkRZps0kLKEnxk9bS3SnwYZN3PbtZDNh4ImrrZ/xqBdkOds95jZm5Mo4mJUTzpX0
+gK2gEhajjeWUdQ4k0QZ7pb722DQ69PMJReNZQQkcV+rY3SaRLugeDUIzpexvcO1w
+i4lKffrvJNVN0I/Yim4UiEYEEBECAAYFAjtSGwoACgkQVZHiwGZkwHhcpgCeNoZu
+zqc9rVB62+Igb4pu6l65Bu8AniM2tGWqq6tFGLqvYtA7DC0mlFfhiEYEEBECAAYF
+AjtXsjcACgkQyzKhB4jDpaXnwwCfSUCu5OKxMNtHZWQwv2HMt/DlgFYAnjoAbCqy
+96V/aY/0rHMhPWlhd4SJuQINBDrSKd8QCAD2Qle3CH8IF3KiutapQvMF6PlTETlP
+tvFuuUs4INoBp1ajFOmPQFXz0AfGy0OplK33TGSGSfgMg71l6RfUodNQ+PVZX9x2
+Uk89PY3bzpnhV5JZzf24rnRPxfx2vIPFRzBhznzJZv8V+bv9kV7HAarTW56NoKVy
+OtQa8L9GAFgr5fSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY7288kjwEPw
+pVsYjY67VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy1obEAxnI
+Byl6ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XpMgs7AAICB/47
+TeZ/O+z41M9MMI2/4aKBqbfIWNzcWl+71KZwPymTQO5F+WR9fSlS+qTNz+h3gi+l
+bAEQ4dI2d+tUZX6q5cszNn/60ffxUbEqa3uBIkOaE+ZuoFSM4I/3IWlZqH7q2x3N
+Q/oQgthLOU7c8HnCv3hHL4a1nsvVZze7zT4Rasb07+kGydlYpkoVhFEp012s0PJT
+vDHG062vs0sx9HmknX6Nu1y91UQCFE7GVfkixk991s/7qHbKNW3u7FC1F0WrwMDa
+Sgp27uJmn8E+tFrb8mpLqvJko2852EL9xKWGDDUqI/sRtZtuxdTcqsLBRyGJqxFy
+0yA+GHeueqiS5YeEX1Z1iD8DBRg60infzLLrRuds9tARAvtZAJ9YzzyCiEYU/s9p
+NVbVevC9/OkwYQCg5fViSXktQM035ki0W14ocNEpXdI=
+=oamg
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+
+pub  1024D/42721F00 2004-01-17 Paul Querna <chip@force-elite.com>
+     Key fingerprint = 39F6 691A 0ECF 0C50 E8BB  849C F788 75F6 4272 1F00
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.2.4 (Darwin)
+
+mQGiBEAJtaERBACrYSun+13XY5xobkfAojSZXeYiLCGrqpRQJiRbSQCQEFIhCqTp
+5Q3q5wcHFqx9da3EpF9Dl9yw7BP/R1nvWw68/eGKMusjyvjF9vVKFFCnaB0YwWuh
+tViq/+OVnVrkPKNtpkBcg4Rl14tEKqOVRAMX+GaPLZTb0J4/rSfqWMitVwCg0ZfQ
+pHJRuYqQDMUlWlg5kdMAxl0EAIGHa1q5fx81qd4jOd39C9ujkSak0GTlTWQptvMM
+LrUbbC0YCYKydKK00QG5sW/oSZd0emdn/0ITaM3v7Pe/JqinaUitIBeyIrLIYKFC
+TIArG7mqCJWHmGXhG0wkI53T/yE0ErkgDMN4U3jTD2ZcbV+UXqygHAtR3qM+uIsJ
+H/hYA/wMj3cOKwMBWfac3i/mrnJVdOXMaXzLrB6EjISWRhQrrlKVBsgqkPEdKwYb
+S1hieaoeZ0UIt2T72Un/KUZinBYYGZAzXSFQNNqiyvy1v5WeVMjaEHOHHWLbqzX5
+3ycf4o9B802MIBS6F0UGpCAEnakZzT+2GG0B/z8RTF6eHpRBv7QbUGF1bCBRdWVy
+bmEgPGNoaXBAY3lhbi5jb20+iF4EExECAB4FAkDwYsgCGwMGCwkIBwMCAxUCAwMW
+AgECHgECF4AACgkQ94h19kJyHwA1pwCfYThV8T/7hCKtGOBUgVABymqtER8An1Dq
+UrHIVDhb8JkD/pXxjf1g5pVWiEYEEhECAAYFAkGjAIEACgkQB2FzsZKExFLdCwCf
+bxMTetsoC3REjFbIGddDZQOICUkAoIY9m2AOUZmx21CniAK4ihNq1As8iEYEEhEC
+AAYFAkG6O+IACgkQAQVmvOQTY5JrygCgiW8vzmmKQ3lbIRUpHyQ1D9vubdYAniuO
+5P3M5v2glVmplF2kma3lu9SriEYEExECAAYFAkGaiAcACgkQMJF5cimLx9ADZwCf
+WWqyc5FAe+exeZeuOzL+F2Zj4bMAoLVY32mEOzifj3gRU84v7Wm2HxAMiEYEExEC
+AAYFAkGaug8ACgkQW5aAEOBPmomgLwCghP2fgryoG0IqPtp9NHWIuecwhqYAn1M+
+VmigV5yC/PXqZXhxCUX8YTZUiEYEExECAAYFAkGiWNwACgkQBJfVkRK/55qYPACf
+SReNPV+c0HhjCPgRT9/oZLw/E0UAn3uz9WHSWqxBrmvpoAXUFlBGqYZeiEYEExEC
+AAYFAkGjS4kACgkQ3bpkuiwxLS+jzwCfeziDXPZWK2KIhNEYW9XnBxfRzPsAoNXw
+LWYxPgO35kBQ8KTvoJbta0HTiEYEExECAAYFAkGjS5IACgkQUI6uxTAtpWj2PgCf
+buJ0M+q0RjVJFZ9FsttqXzCYr8EAn0/J280RJzAAvGARJkRztdZmkC+XiEYEExEC
+AAYFAkGkL9MACgkQF2rZyNGqiWKJtgCgkf0628uDGiANtRsnVqTC2T0ZXbkAoIVp
+cBe1RZIrVZ3I/d1ZM07u8Rm1iEYEExECAAYFAkGrePsACgkQzgGkfhxD2FBqPgCg
+mtjV6A54A0n+cWj5QNXhNoUKLGwAn3FXjBUNPsEDliW9cWBYS6ceRF1FiJwEEwEB
+AAYFAkGjTT0ACgkQms08wKmfdd2zFgQAwloFiGEZ4n+WrOMzzT9eued90SSVW42c
+6JyJA+nChSaGtT50XBxXDHxWtr3rtleQn/MqnFpFdi+LMCREJzc3Og3V86M+ndj/
+6xftMyig0VW0lC8FvDu9WSso4ny3MZt2vUmOqUBH7ConCFIhjEdjS4dCuq1+RhmH
+o+R7TDImU9eInAQTAQIABgUCQZmBbgAKCRAxpj2W7BQLgafeBACXLa0nkaexTqjG
+EhG/kksIC3TXR6IiH4i+VcTzuMEuv+T7uDrdhZjc7jroeLWWl5XyLCASyhI6LP/3
+lrK+UdO3AnNA+PDuzVYqaC4dDMj9kdDbEzKYcrVPbKymuTVzR4l+XSgWz5kOyoDW
+Nsqk6VxuK+/KdnuXdZ8K938HVBuIZYhGBBIRAgAGBQJB4sieAAoJEEzETQAR34fp
+yXIAnj1YBCHiGmdN6GjkM4oTyvVRWhluAJ9yWdPGw5wrlsRtAl9WHVqnZ3iPMIhG
+BBMRAgAGBQJBzqlGAAoJEME58VMjy3oqkFIAnRXkYqT6dfMckUaBZNCi+V9zi4kr
+AJ9qKT38Kfs36TFRt/WxmFZLysz7D7QiUGF1bCBRdWVybmEgPGNoaXBAZm9yY2Ut
+ZWxpdGUuY29tPohgBBMRAgAhAhsDBgsJCAcDAgMVAgMDFgIBAh4BAheABQJA8Gcf
+AhkBAAoJEPeIdfZCch8Au7UAlRmVWI3GpMbVSxFf1w/jj5I3S6MAnRfzZ8URA5C6
+pzb5X+WecPVrON+TiEYEEBECAAYFAkGeEXoACgkQJ0aiJIc88a3YbACgmixFO0rw
+BdROgUtYIUlYBLxucQUAoOb2Ki8PKEQlMl+gpaP4qwy+3E5kiEYEEhECAAYFAkGj
+AIEACgkQB2FzsZKExFI/XQCfViYZu5AcqGa3aZynBgUAd9A8ekUAn2skGwDzd3Jl
+y14qCWF+qCNyyej/iEYEEhECAAYFAkG6O+EACgkQAQVmvOQTY5KaCwCfUwLt98Pq
+aVgks/658RVhhlUNqLoAn2RyNQ9njp0HEc0cjeowpU5s4BumiEYEExECAAYFAkGa
+iAYACgkQMJF5cimLx9AjeQCfSWiedjEzebbt7il5PXHgvJx40pwAn1bbP6iVk7yv
+3nM3xKTtD1mHWzr+iEYEExECAAYFAkGaugsACgkQW5aAEOBPmomvzACfY2Jx3c5a
+GKEdKJBazjboun4g97cAn3RbDFtb8MDJe5bQVQ3X/vysdAQ8iEYEExECAAYFAkGi
+WNkACgkQBJfVkRK/55qh1gCfYVBinwZQBDLLWdOhFf9wYWcqEU0An0k9HWExIUFF
+3uItQ+K9Z7C3NGuqiEYEExECAAYFAkGjS48ACgkQ3bpkuiwxLS9JqACgrZy8c176
+z1zxMnKVgiLZ1xjjaI4AoLeLarplmadavnMPcGhF+TXH4Q2GiEYEExECAAYFAkGj
+S5gACgkQUI6uxTAtpWhjFQCeMEJH780DFHpbXWSyOvs29cYuPFgAoLmUNcUQbx0c
+iinkYFD8VdeReHodiEYEExECAAYFAkGkL9IACgkQF2rZyNGqiWJ1UQCgs3YJAx0P
+6pinCMhzunuIJTVBbRsAoLfF0lN2LW6Cy6mHBMIG0YB9Y0zSiEYEExECAAYFAkGr
+ePUACgkQzgGkfhxD2FBueACfdLtQ1wegmW1s934n4tDQH0dfpnAAoJbdfKwLrDNC
+agh6BwGF+Kd5hJKDiEYEExECAAYFAkG+MhkACgkQ6DAYSBao06uOFQCeNpMgvhNE
+MqsT3UWkDBjau2vTYcgAnRp3f65Wls0+Af794qZa9TtJFnqliF4EExECAB4FAkAJ
+taECGwMGCwkIBwMCAxUCAwMWAgECHgECF4AACgkQ94h19kJyHwD4kQCeO13BXjGC
+MLvj7PxuXmav149yFccAoMb8DRP1u4pTz2aE38nKCHtO4kwGiJwEEwEBAAYFAkGj
+TUIACgkQms08wKmfdd2aBgP7Bs3M4QnfAXFNf3pnWEIPhlS9JVsShwZEBe7U3saH
+6vLdGUTOqxU7fT7nohhGV+XDCAHpWLBI/odavlQguZiTYQf/RHaSxdtoXUuwSpvt
+NlFgYdp6ex/B2llg5Qof18LMHy1R5A9lm7M2Av+DDhi1ErYV59S59SryCU0PeREN
+KoKInAQTAQIABgUCQZmBbAAKCRAxpj2W7BQLgS6bA/9Ds417wgIpgS6frkCtyKAu
+otIL7JQ1Lqsbv4+CZeqi52ERxzGqryxBWx9YY58bwv+px9dOOnm33zesf4hx/IVr
+nD82bnrmdA1qWqXPPfLAwYdKh98gWPnYkhH9RCrYnudCTFjNezS5+xRENQyYX1qT
+UlAE+x2nffKxnLJ2845gTYhGBBIRAgAGBQJB4sihAAoJEEzETQAR34fp/cYAniEX
+EYhEkx0osaS407/sVzK1CAd/AJwJW0ZL0nAyjjsqpgOM0ba3IpKxg4hGBBMRAgAG
+BQJBzqlKAAoJEME58VMjy3oqDZkAn0Dulg3UtHdiI5EaABr9C5rN9lsnAJwIkeGz
+T+S6kfIkuSH9/Nafyd6r97QgUGF1bCBRdWVybmEgPHBxdWVybmFAYXBhY2hlLm9y
+Zz6IXgQTEQIAHgUCQPBidAIbAwYLCQgHAwIDFQIDAxYCAQIeAQIXgAAKCRD3iHX2
+QnIfAFiFAKCVt9mEsKqCe4o1K1HmOAT4OmdiOgCgnCr58C1CTeBYMjzgiLteqSl4
+Bx+IRgQSEQIABgUCQaMAgQAKCRAHYXOxkoTEUit6AJ9sVkHFsNXow160c1h70DYF
+nMduxQCcDdNa8lNoauvnKBq6Jv7B9JBaKEWIRgQSEQIABgUCQbo74gAKCRABBWa8
+5BNjkiZQAJ45YgPe6LiBIyGPI3LFsLPPaHp62QCfc6UHkdWCgsvHg8GhjSD5wwHX
+UHuIRgQTEQIABgUCQZqIBwAKCRAwkXlyKYvH0NHwAJ946lD+sO4+bWSWVG7fGtgN
+f3B32wCfRTezxng6aLluB/QWspObQEpvfXiIRgQTEQIABgUCQZq6DwAKCRBbloAQ
+4E+aiVMeAJ9o25E+6sOTxI4KxYfPLfHgip/QEwCeMTzPbYVlryWT2px1syjvjXkd
+tEWIRgQTEQIABgUCQaJY3AAKCRAEl9WREr/nmrG8AKDGq14Su7iLDYm5Z7/4LJSU
+8/MF1gCePdaPGg0vmnWonKZJApyEEuwvDJOIRgQTEQIABgUCQaNLjwAKCRDdumS6
+LDEtLzrTAJ9aq2KOnzSclCF1BBuF9tE6Ykwi7wCfWOrw/mBKr0tolIcQ5esUinIB
+RkSIRgQTEQIABgUCQaNLmAAKCRBQjq7FMC2laG3NAKCkzGOfXP+ONhWD0oAvIhjN
+AccyVwCeKlQjucbMdl7uEkWrf1Gya8pThu6IRgQTEQIABgUCQaQv0wAKCRAXatnI
+0aqJYpemAJ9GdLeZi96/h6Jg68z2ZDeSc53g3wCeJo7A6QuCXXM/rcmfJqCEbB5A
+0G2IRgQTEQIABgUCQat4+wAKCRDOAaR+HEPYUPLQAKDAMgt9qlL55JIRygMXhdiw
+kJD0TQCfQlGUyCYz4I3IYVbgpWtf4uq4KDyInAQTAQEABgUCQaNNQgAKCRCazTzA
+qZ913fUWA/49r5W+Y5V4RRWGWgaXd8JLAQ2yu88qZsIam35F997tRS1uqZOoEWds
+6r6F9XVXwOUt2xsZSe34+jRfKWAXZdcmTyMIMTInhCcmukPCzEcRRLd3PBgIBPDM
+vMgGGLKjDjjh5QZ/IpYdiVKaiY1IN92OLm6sKXh3SeXAjWlt1fK1d4icBBMBAgAG
+BQJBmYFuAAoJEDGmPZbsFAuBxiQD/R9audVADYECPnTSp+YZJeB+LSDh84FGrWRm
+61yKp2qGIorhhzf1zZ77QMS45Zy3hEct4Bx6/YSpieL2PPzMKhag+6LNY2W46QYN
+k+d9v+ru3MMSHYoNfIqo70GOV6zad4fUMYywtYhDEalyMyPB3pP8jrmHt8m5ahws
+sfJKn3fQiEYEEhECAAYFAkHiyKIACgkQTMRNABHfh+k6TQCeJk1afbGzsIN/doC0
+0HvYiHCmk7oAnRd4SefB12lqKxB7+rOETvWu5pqRiEYEExECAAYFAkHOqUoACgkQ
+wTnxUyPLeirbGQCbBQL/YdNEhAR+QojUCsGLg46B89QAmQF109O9TS5Eqrn9+C5f
+3bck6qbEtCBQYXVsIFF1ZXJuYSA8Y2hpcEBjb3JlbGFuZHMuY29tPoheBBMRAgAe
+BQJA8GKZAhsDBgsJCAcDAgMVAgMDFgIBAh4BAheAAAoJEPeIdfZCch8Ak0UAnjpl
+plE4Mw3PM3j9nSHOoXrzzglPAJ42khRlgk6TMfnUTU41h1FXA51bCohGBBIRAgAG
+BQJBowCBAAoJEAdhc7GShMRSXd4Anivb6tq25jFqiaoFJmqkNoi3/vdCAJ40ZK68
+cP0Q6ib2yiOWdjlmftGXXYhGBBIRAgAGBQJBujviAAoJEAEFZrzkE2OSFoAAn3Wb
+daZJ0raIS5NIOQcrca8sELZdAJ9y3+9st6AXjDXSRsghu59Zg3zfQYhGBBMRAgAG
+BQJBmogHAAoJEDCReXIpi8fQl3IAn24VtuU4CYAkDfSJhPRPbdwXC9oYAJ9KSvz3
+7QG2mZnimcoopCQy2g1z9YhGBBMRAgAGBQJBmroPAAoJEFuWgBDgT5qJhogAnRL0
+IF9/2Exe712BeoVWPK5eBSi2AJoDzWCbp7wr1nALbPllkqApkll2S4hGBBMRAgAG
+BQJBoljcAAoJEASX1ZESv+eashwAoIwuyzeeGal/ZWkKIxBbordqIl6bAKCj4iFg
+Kya4SFt/bd5ZKBzWWv16AohGBBMRAgAGBQJBo0uPAAoJEN26ZLosMS0vJroAnjeL
+RzjPkxFDmABQPshdkftFzAoXAKD7qaB4eHmYqZyDZ4n4dLpukmer44hGBBMRAgAG
+BQJBo0uYAAoJEFCOrsUwLaVoLuIAn2deIMzEBk9KTdIITM5cBUiPccGBAJ9PguKy
+15iLmZE1EduTLoY750KnTYhGBBMRAgAGBQJBpC/TAAoJEBdq2cjRqoliyFIAn0Ar
+xe90GYJrXOPsan0RbBWfrIzYAKCku4aJi4Fy9OweqRet0wzeyYzEE4hGBBMRAgAG
+BQJBq3j7AAoJEM4BpH4cQ9hQD4wAoLgEBvKXRJbdgpHKAynebPFc7+xTAKDCie3Y
+g9nTInyAkBR+woMlo8IP4oicBBMBAQAGBQJBo01CAAoJEJrNPMCpn3XdiXwD/1O4
+ya08P1YxIYn7owU2DFVj65++T97WO+yOvkZnPuT88anrx2lci915sXAQYZh1o4Qx
+HIsterJrJB31p3iokJzQxMt6K6HMzITDdNh4mvGoNAaSNurqhIeqmk2UpuLuDe1f
+gART4fCmgMxglgIlMBI6UyhP0RhzHx+qePRHxf4hiJwEEwECAAYFAkGZgW4ACgkQ
+MaY9luwUC4HNuQP/cQUltjk6iJq10+NLv97/vw7+eij/z8kBwfe7przIchSoApFa
+ADyVDuIMmZcSU/PbwlPRebESQrQ84q6jHqpG3ZMhvIT0EEOWmS+8Ga1FhwqXjNrY
+AsNlAFa/tfUPAPTj2M7kTt3Dq4UD2xXywY9Rja3Q+khSttGqQGEq+qB6a4eIRgQS
+EQIABgUCQeLIogAKCRBMxE0AEd+H6ZS7AJ94jbsCZKDncSb/JktR+O3R6XjmLQCf
+W8zLP/1780h7U+SeGZRx1K2uNDqIRgQTEQIABgUCQc6pSgAKCRDBOfFTI8t6KlUH
+AJwOQx8xEJeGwce+D3DtawU+uf/JdQCeIIL5AT7+oEK1IzZDN7klXB/4zii5Ag0E
+QAm1shAIALfqB4jeQyzKfybVkA8PksS9yD4hmjaYIo6XaQ6GAJsgYOVcWINPzcHt
+2rjQNxScSjkNApTxttpgRRVP2s8RCR9Vkn8S2t76SKm85mgmuTT3iVNjyIbtQEqQ
+cpN7LDJAq2LbGIDt1fdvmhkI2gNNqnbWMsAxsJkws3r0JHsCxD8jraXKvBQ83tFT
+Kqi9ZeQ1nW4dc5s1/p40OLrsq3ww23CfnP9Oxp+8rvggWyE1Rr4xb6hnYN7mSLNe
+u6xlycRopG12Rkvh5QLrKNr7D/GV1j6IGTqh4aRm+z9o/1Wwxz0WkaEyN7uFbQg5
+hscBBHJBKT1Q8evrJpTEUyzA8mrBO6sAAwYH/i2ygbxLRdqgRcjgqaWCkIDwUTJ+
+c6kIQmpPH9RMMpwnbU9kcGENCjhmFVIvbcUk9xBqQgUqSq9a8zZUrwuBauNCOmVX
+wruGyIXAYjlUXvxMOpTgEku6PlpKiDhmcv1Wb21dTz020ID5gpAa7s0T82VC3ciG
+JmYTiQut/Dz6W1X/vKkPtQ8UEQ7LTkNOyg7ys16FpktXYq/MxAhgQ5rRLqEwIPe1
+sjClgK4Lnzh5o6ue6pa6VAd+Bwpfy9i4yh3+CEgjWjq9DyciR6x6j2de+k0hQW6k
+V01gLPtduJnaPo+XWlHMonhKSlsPK10RMuVC901oLZYZSKOwMgpG5EGx2OSISQQY
+EQIACQUCQAm1sgIbDAAKCRD3iHX2QnIfAJZLAKCuvcDan/KMsSsAjM/rHTf8G0AK
+nQCfbbvCK0fwZcra7ofd1z1Up1+ID94=
+=xYye
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+pub   1024D/F39B3750 2005-07-14
+      Key fingerprint = 29A2 BA84 8177 B738 7827  7FA4 75CA A2A3 F39B 3750
+uid                  Colm MacCarthaigh <colm@apache.org>
+uid                  Colm MacCarthaigh <colm@stdlib.net>
+uid                  Colm MacCarthaigh <colm.maccarthaigh@heanet.ie>
+sub   2048g/2C7157D3 2005-07-14
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.1 (GNU/Linux)
+
+mQGiBELW4V8RBACRZw1GIal1EKcPqtPyTAEtvtSQqv/ZLj3l9ne9kNHFgp52TyRp
+vV1JRwrlptNhClkBFD2/o6OAOvR2YcDvWXkoNGIlbgrsRaU9H9l7ZVFU5titPj+s
+69hHn2aGox8mpWay0jfRLpNiA+hxHpo9Txh30Yzsian0+vCm2cr6H/IkswCg68o5
+MB/AahASaRJBBDS0kFOjWssEAIFEq0yBFbRljS4Ia43IKiIYCsMTesNAvpaoHLMI
+ARvgEkLxXYQr9ZPjIxTPVXzKIuM7sE7Q0JkOa1ACkI3UM61dRaZ8CTHCt4zIOGMN
+WP8FCUgFyu1/DMIcgFo86x1jM5YNdz09wezqvhpYwf0rAdTCyk3Jz57Wx9iJyX8L
+JYAeBACRXYr7D6/xwE6nnVHebuUI20uM3UqAVfELKfEju0A5iiqFu42qXTHYpvds
+AdA7bC8YEWQLK35q9v5Kyrp6IrMVJJlo3701Kjpoqn+Wqo0dKsG3devB4jIN53lJ
+Bglx3Woxo7pPAoeHyPMxxZbPpeox+0cfj4SAh+sECdUgTq0nQ7QjQ29sbSBNYWND
+YXJ0aGFpZ2ggPGNvbG1AYXBhY2hlLm9yZz6IXgQTEQIAHgUCQyCIgwIbAwYLCQgH
+AwIDFQIDAxYCAQIeAQIXgAAKCRB1yqKj85s3UNOyAKCOR2bfAWqBqP9AlRb3VXvU
+9CJcQACg34GFUHLb79GWPAq1eq2Q/rkWWbyIRgQQEQIABgUCQyCPUQAKCRDAyIND
+MMiiiOhAAKCXDn/0uoJ8kEbOzf5biPYnU8qKWwCglSSuY/6TfRfuVpBK+v5U+/F/
+pOqIRgQTEQIABgUCQyCXyAAKCRBc/Tf6zHjIk37oAKDs8rL+BAWNpg1AH8H7QCPE
+Z71AvgCfUZFeA6Lny8eSTLHp8xfCeKR+lz+IRgQTEQIABgUCQyTKEwAKCRCKB01M
+P37h8sjtAJ9oNlVkhM8eC1iZ63mOWk88RWp0fgCfVZJxv4U951SfwAN5JNUEJndZ
+wUWIRgQTEQIABgUCQyTeJAAKCRDYa/eUZKL/ajBFAJ0W2Lwg8NrYpeaatsOlPM+k
+P47JpwCgoDoETU6/KOltBn1aEkN0B5jMzdmIRgQTEQIABgUCQyVXBQAKCRA9ckWS
+wp73hyhwAKDYGgg4PwdoozFscPHWpL0Bqd5K8gCeK0+3GoMoyLmdVX/JVRpFLZSP
+dW60I0NvbG0gTWFjQ2FydGhhaWdoIDxjb2xtQHN0ZGxpYi5uZXQ+iF4EExECAB4F
+AkLW4V8CGwMGCwkIBwMCAxUCAwMWAgECHgECF4AACgkQdcqio/ObN1BDlACdHWGv
+tR1w9KrHSUpmQNVx9REVHNUAnA31s2SibQsdJ216/538PMYZgPLuiEYEEBECAAYF
+AkLe3ewACgkQymk5dIEDo34hrgCfXMyiE43e4tc7cH16VbWwzdniE/8AoIPKexDT
+a4m8vyiDa1GceK4GUyAjiEYEEBECAAYFAkLfTJQACgkQQeoJoFeTSY+H4wCfa7rE
+7djok2b+s95HBeF/NwZNPt0AmwZCMbG29o/bofeRUDs2CGGPvbh3iEYEEBECAAYF
+AkLfkvAACgkQAQVmvOQTY5I2rACfTY/W7cCeTUU281TxYgQQeNWrYRUAoI8NOyQx
+KEQ7kijRdscRjhSR4ui+iEYEEBECAAYFAkLkdwwACgkQjON2uBzUhh+VugCeL6uG
+G78nPzFwsP5WhksIYtv/RZwAnjmoEOofv0VZeXlQoSoFUuc/TgVViEYEEBECAAYF
+AkLkkh8ACgkQBJE0Quobo42bRgCggRA4xgADvjofITsuFd58PoORq0MAn3CGP0Tf
+6tgw4aYDwcc01Ha1JSQDiEYEEBECAAYFAkLlyfMACgkQYRlqLjM+ToS0AwCglahs
+pxQ6jze8IEAsweOfPLy28jgAn0vbj101OnrjEsIsuryv440kWY7eiEYEEBECAAYF
+AkLqZfMACgkQsr68QBUpJK/9nwCfYeo2Hyjboyba2vC93cAi0VKePnsAnREn2lG1
+4sz6s+O+q3Uwy7is8V7ZiEYEEBECAAYFAkMgj1MACgkQwMiDQzDIoogUXACgkCQV
+93N8bGlp/8Pctql/loQU0LEAoJ2sAiDDyPTfmcSYp0eI6tGl03XViEYEEhECAAYF
+AkLetSkACgkQi5YpQ/wkPzzHzQCeNsAOFJDT/bJpCEkL91yOyynw4JkAn0ctxG0M
+oevrTNSIgAIy0fmWmErKiEYEEhECAAYFAkLhNrAACgkQohFa4V9ri3IFfQCcCr4X
+XeFigTwF2F2WhBNIslhVY4EAnRF6/HIFGofC/wvrl72tQnwUIo7PiJwEEwECAAYF
+AkLerMUACgkQMaY9luwUC4EqDgP+MSHyBB9UmfjFQtrveCJJg8fxhUiiuX6f3/jP
+/TeeI9RHRVFLTR2j2ZK/OOjtUAZo9WC0XYNd/Uh/aVhqrxfFI/J9M90Iarsi1zAj
+Vj4sqjDIPW4ucvP5E21mscTKP+Jdcn3OBU46OXHppbRZhhqgWVN6DcPudgozQ71T
+hyZ/noqInAQTAQIABgUCQt7IeQAKCRA34/Rf7mXjIcqqBADerPaJID4FtbTgR3WB
+fsGV9TPMCLl3GBI+u+G0dJghrS3HsYzysBI9ZSTfsaxhK/5BtlbiHelv7xReyzZB
+R3LppWQuwILQWYI+PHbnVfQu8VbBS5th2V/JTdEwU5Udj4e4yUSEIEJJDyVMWVu4
+TuWCxfdGxyzvyrZC1UaqFhWunIicBBMBAgAGBQJC320vAAoJEJrNPMCpn3XdX8sD
+/2eBp9JWolVXYnm55sQXrwkin0jr7mDWa5ms755RGXJHjIaEpBHt9KDKknFpRv4v
+5lWQhsJQ3XjVhGGnwI360Zut0W+8Jtx9WS4UOLeWQwSbLa2miyNlbY1Dl0Lc7mri
+PTfp/aIk6PQrwlR9KR3X44eRphk2lX0pCalvNefEVXg9iEYEExECAAYFAkLesT0A
+CgkQ/W+IxiHQpxsbfQCfSBKiIFQAZ3ms+jdifoew4LjuRE4An3FqSIfHdjT7QS/G
+SteEDyEi/+35iEYEExECAAYFAkLeu4IACgkQMsnkzjZCy0vSuwCcDdk8GhXVselq
+w1P6KfIGB46paI8AoNODV1J8WOivefexZF132lBYbGc9iEYEExECAAYFAkLe2eIA
+CgkQ7tHqOSJh0HOcxACfQIaSKmPV6ul9JL7Tw6bZV6LoZ1IAnR/1dq5qI6L/XY5w
+3/hy8rNzLjNGiEYEExECAAYFAkLfbTAACgkQUI6uxTAtpWiQkgCglhRN4h56a2NX
+4PubTaTpt4s+cFEAn2zOK6T9rlGYd5QFynZj0k1GuO9aiEYEExECAAYFAkLfbTIA
+CgkQ3bpkuiwxLS/10QCg+3rbZys4iQ4vW4qS6R2yJNlrh3IAnj2tyMmRrsEtW+bN
+OvUrJY4gL1bRiEYEExECAAYFAkLg7QYACgkQybWm7OLXdN+EdACgrgKHTCgj307w
+0FOioXe9uPEbU+4AnjM4lBi94Nm84BgE6esZDvXbVOfSiEYEExECAAYFAkLg7aQA
+CgkQN/aP9QFa/IpM0QCgowfVv1Z98utS0tXToJL6zS1KYiQAnAqdbSAtRxK8xpnr
+vc9LnpsukMF0iEYEExECAAYFAkLg78MACgkQW5aAEOBPmolTvACfWWiuidASBspI
+UeoZysIMfcXSDKEAn2gdALzsW+uvVT4LKNeKzsbzIs/TiEYEExECAAYFAkLiYsYA
+CgkQbZiNF4cxXDEgIQCghR7mWPIoOJv5sZn2YB+iKKKQUPkAoPLQlPiDgZM0L66w
+7KFMcPuSlj2IiEYEExECAAYFAkLjWt4ACgkQEy5J1OQe3H7SgQCgg+1G28fkCt2K
+Npsdcv3hKRY9wkkAoKMdsQHQQl9LeSQtxmnVoWgtSWXliEYEExECAAYFAkLjuE4A
+CgkQbQvHOkBYGDcQmgCfcaUPfWx3tzbMhgPIaxnC+2+4GGgAn3UmWcL4y6CuafGo
+TVEJ3pnbaHCBiEYEExECAAYFAkLj7ckACgkQMoZOQZyFIisAbwCfR8Gv59/k1CNl
+ThPvjfqOA9v7zpIAoIlyWt6VamIUF6V1DJkUsLdMUiFliEYEExECAAYFAkLlEN0A
+CgkQUnkvr5l4r4aw2ACg4PcNmqWg0tmU78SCYb5sft9arAUAoKlzLyVwbgx8o+sV
+xooCVLbq5Pn1iEYEExECAAYFAkLlEcoACgkQa3OhBipiP3LtPACeNNzQK6+M7+iW
+GRoa/3x91WTXupMAnjppF3NKvRFM1bPBuPHkMQrlZ3L5iEYEExECAAYFAkLmmagA
+CgkQaOuMdvjqKWeCIQCePj1/DGvnWdsE8vVH6LYIIBCmQDIAoI9KyCTP31ETSRBO
++dkitssPvMO1iEYEExECAAYFAkLnYYsACgkQbpR1lMFSQxqbcACfS19GZMulB7qB
+5QvGKpFncsHE4i8AnAgs0jgBO4sWj987Wkm9xKb+6lF8iEYEExECAAYFAkMgl8gA
+CgkQXP03+sx4yJMg6QCgsjBgLZbMkacGPnXJQmR9OxPtUU4AoNusKhziIkJWlHWa
+uz8H9NuNp51riEYEExECAAYFAkMkyhMACgkQigdNTD9+4fIOkQCfSerkxohvKdRG
+uBh6/BbhoRyYY8oAoIdSEiSASDsllD6ABxpmFaLD0VjXiEYEExECAAYFAkMk3iQA
+CgkQ2Gv3lGSi/2r8rwCePvkHpYFFVmwaoyxDiWyAJIuO/ZkAoIfEGl2o1seOiM8Y
+pNIwqANE8Gt6iEYEExECAAYFAkMlVwUACgkQPXJFksKe94fKugCfSGLdAfgTPYNP
+JIddiYbExRj4tusAoNsqjlS7j0FiwuLxn2KhU0XdNR9otC9Db2xtIE1hY0NhcnRo
+YWlnaCA8Y29sbS5tYWNjYXJ0aGFpZ2hAaGVhbmV0LmllPoheBBMRAgAeBQJDIJFV
+AhsDBgsJCAcDAgMVAgMDFgIBAh4BAheAAAoJEHXKoqPzmzdQdvoAnRX9Td7jsxuJ
+tPtZTUuSzFP8ayWOAKDPnEXHSMWf83yGbYmYbjd1k6AVGYhGBBMRAgAGBQJDIJfB
+AAoJEFz9N/rMeMiTMNQAoO26cgCXNIHA1BXzt1Gc1YMx//urAJ4p9quyQ/0qhf5t
+A9FGXGX4nqYbc4hGBBMRAgAGBQJDJMoPAAoJEIoHTUw/fuHySjQAoIby3eTBkcvq
+Cvl2NWPrQJxPubd/AJ0QlXBRAJBycD6Hgf2Y1bcneLGKE4hGBBMRAgAGBQJDJN4h
+AAoJENhr95Rkov9qAwAAoNVYqqIIF2uvZSD4eKScYFb6u7n1AKDKFRSOjSeRHVXz
+GUd3UbUB+xny1IhGBBMRAgAGBQJDJVb6AAoJED1yRZLCnveHWC8AniAJhbJpdSR6
+lIzSkPbvJLRwdH5TAKDQ4aoyMe7914J9MgnkcVBraBhJj7kCDQRC1uF9EAgAgaod
+PcwlIct4wWAHDxe413Bgw6/v/kNp4Q0nbnLwQ++gsN3sCkK0O6qASsed+Ffsjhn2
+VEjAF03RT2T8Ir7AuA++EuWuAphBDTZLF/ARszSnYWEz3cELsuuqj1yXl4Gc3mj6
+1vDmST7g3iPxNbWGZNf0jinD1ycRYd+ZSs+5yQzOt6g2VtAE8DneL4M0o+tXZXlv
+Rl67PlrYbRIE81VYTm2C+k3eF0PWsdDyL8lPmV6ryIjvDK/EKLGynIQN2yWASzqZ
+Ql9mJGdwHKXMNxG5R0AQc0auJjk47sCj8ktP8+k6MPy2y2ZGv0PtSNSogROwMvJp
+MpqWoMtZdmrkXuGn9wADBQf/QAbCM0qCv6ogLmfsyyBubl42DkB8vMgRYoY0/kQW
+3qKBnIsCHhuQfYRX9oV+LVtq7vNd1NQe0HFMW3ZxOLA7e0lVPf2vJUWGG2wBWHOs
+2BxnS/691KUeB7NUA3MeiqaiPW5IM1+pWT5+/Ps9mJXnSHYYqaJdDHSiKeAvEYRz
+qGlwn1KpopIhtLZRMwio1ez5aNAQ6otD0vHFit3X+SCkl6+1+tvEfPTupUpbjBsG
+3geL3D1csPC45KsMCE7zwqAnXiVTYCGXumFEBS6b4bfh2uM8fZP2Sy0xEP0nxzmD
+mK5ERs8R3rshRHFZiil/qtqlMfucZER4XxWZidEoath1xYhJBBgRAgAJBQJC1uF9
+AhsMAAoJEHXKoqPzmzdQTTsAnRwKwOe+n2LgPgqAReIqMvbIHUxEAKDbuZIzxAtk
+Wq8UfA31IsLnxfIOGQ==
+=95yW
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+pub   1024D/311A3DE5 2005-10-02
+      Key fingerprint = 120A 8667 241A EDD4 A78B  4610 4C04 2818 311A 3DE5
+uid                  Ruediger Pluem <rpluem@apache.org>
+sig 3        311A3DE5 2009-08-12  Ruediger Pluem <rpluem@apache.org>
+sig 3        311A3DE5 2005-10-02  Ruediger Pluem <rpluem@apache.org>
+sub   2048g/A21CD598 2005-10-02
+sig          311A3DE5 2005-10-02  Ruediger Pluem <rpluem@apache.org>
+sub   4096R/5185BA1C 2009-08-12
+sig          311A3DE5 2009-08-12  Ruediger Pluem <rpluem@apache.org>
+sub   4096g/3B3BAB8F 2009-08-12
+sig          311A3DE5 2009-08-12  Ruediger Pluem <rpluem@apache.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.5 (GNU/Linux)
+
+mQGiBEM/yAsRBACVZVt6oK9fpc9B/7vPny00aHnuhDQ0MsM5rbEGZ57aBnmHYyX0
+gTKLWGBXhlkos0hxBBIc9UUbOmaVBp4VFu0rz8IQ2OUZ93J7lR/khRG3wlmYx25Z
+CcN0tOFmiZuyV+J9zNP/dBdBfUqDwcJD8zmA7u8NLeUWljJJdKv8wcZ2/wCgwN+/
+PWz58JCvsvphQT1QjzP8a6UD/3DsCYMq0m2dOi3YXxtHpeF2Kn+k4BXnFt5dkPsd
+O2MN5m66Ky3MndeIPj81Bw9ssc9zZGcP2PHej9mZPjKDQaJn0GkHem2sVQ5uDcbG
+JCy7UKjgLqBl/AAJs3+0KdArvWVxsxBUl6wViAxUytwdsgK1KUA3Qyfj7oAM3p4S
+iAWlBACVIZO0u3LzAN5halnEcsjWrCdNpvOLB7aopNMYQRm0X2OXgFWRuLa6X4/g
+yA/aDZg5xbSBVzC9VwMS3Os1hqwuFW0DuP0PAal1KIRL2dzD/1XIuRBz7N1WgeSq
+MqNqjFL8RuTh9jHlWOnHKd7GOitJazv2TNgP0KQgRoPKklas97QiUnVlZGlnZXIg
+UGx1ZW0gPHJwbHVlbUBhcGFjaGUub3JnPoheBBMRAgAeAh4BAheABQJKgx+aBQsJ
+CAcDBRUKCQgLBRYCAwEAAAoJEEwEKBgxGj3lOlgAoLLpqsZ5MXiNaNgPeaqD+NEF
+xzVLAJ9PmcaWHklV/BB2D4BloSt6LVtURohGBBARAgAGBQJEouU2AAoJEJA4TZo1
+x+lCEToAn0oaavCybTxvhrlRfAzUM6OXu7WSAKDgZKHzg9LLLITk9KBU1lNbtW1Y
+iohGBBARAgAGBQJEovOrAAoJEPdiuCXvtpTqZBMAnid4GvSulpSWKIetS5tXPpTV
+BFwRAJwMKS+OoH2ZrvhFP5BteT85qxbei4icBBABAgAGBQJEqThgAAoJEDfj9F/u
+ZeMhN30EAI7VnOAkWSv6uLoznFQYQC4/qAWY3pQzJJeEhEFWGdujc52Pqqlxrp7Y
+Ny8XkVNcM8JzZhBwx8ABAv6nGQF+Qov1OOzAZ4jAVd05kd51CAEFoWozIDUUeHoR
+Kyh4F02dJC0r3tn45zHIS6FzHxfIKoStrOdwfyreDg+gCZXbvRcCiEYEEBECAAYF
+AkSpOFIACgkQMsnkzjZCy0vHfwCgwAxPDq+A5glMd3kLkHJCIViJV8wAn1ne2QjM
+37U0E9AVUugkamnqcv0+iEYEEBECAAYFAkSqs3EACgkQNYuqM1D5YRYnlgCfdXa1
+F2wMsCEqR3Wgi/koDqAgXQYAnju0aFixh59qW8a5wkXK7T4BEtJtiEYEEBECAAYF
+AkSn0RcACgkQ1TNOdbExPeK/xgCgnEkD7fjmoWo1m3Jq2LFFS1II2BcAoKqNxupM
+Dwf9abpHvrApLg1147sPiEYEEBECAAYFAkSqyNgACgkQ+zfaQDMuY83TogCglcjo
+XiiKKuSth8WSzZvcUX513bcAn3uPk3VS5+jMKPAAcgt2IPI8qUcBiQEiBBABAgAM
+BQJECpypBQMAEnUAAAoJEJcQuJvKV6188n8IALHU0NZRB1aLUCJgHYxtvR3DPH7Y
+3lbiScdJMeKBI7JvzUL5sfoglgLJ+BIhJonvWVVnDsFURH90OhCVO8QyRH0Io/e2
+pV0Cq6MXQreIrwin1U3sqI5Z17tIilYzVUguq3NhVB6iO79KyHnYE6mR1vOP6PXO
+ZFMbpJHoCpa99ZoTEljSnrW5LAtfeDL0Ha/1pS/GC80mqgC1cANA2kh0FTy07exj
+u3f7eA4F6BF4n91YW6MZNohIHNb/E+rhZliJZ0dmm74cOwSYRo4QtOuOsRnfPz0r
+cDOsCNO5jbw4ZnAXReijao7HqILV2qt31uLIDyAdrYyIJ0D60sQpHc3FezSInAQQ
+AQIABgUCRjoHnwAKCRCazTzAqZ913UkpBACfWnkg8FpqkSY4hVUN+S2lxJP1LrcT
+kRAbjJ/ECd+7DagMkrp4qq1nRuTIZ1qni/dgLb1bHCbbQl2XII2zdEMwi5bB5PEQ
+ggcjGtEiB5tdsUyYZPnZjh3asQJStQ0rjP2pLARa1DPaYq5PiRJQ/lbjZFsMbaQh
+q9ysPPUuo5GHcYhGBBARAgAGBQJGOOKlAAoJEBVFs/7iIt5PBegAoJsY6fMRMVkd
+l5wbYRQPWcmvnqEwAJ4zaFXcLgOGzwQwVTakYQICj+W8A4hGBBARAgAGBQJGOOeD
+AAoJEGPQra6REgPkOE8AnjTb3rP//+I/WJBLeO194cmB5ZnKAJ0Ug2nG0bxINnga
+tODVO3CUh2ggjohGBBARAgAGBQJGOgefAAoJEFCOrsUwLaVo3asAnRW3Crwy/oRg
+Kuxh/+5OqjB4bo30AKCqgFXmSuCtuVMf+IBQu28JgBGLyIhGBBARAgAGBQJGOgef
+AAoJEN26ZLosMS0v3asAn0RbVVSQy/li97fKim2w81ILLctDAJ4v6OaPJmmAyeXq
+tSAsQ1Zm4dIN9ohGBBARAgAGBQJGPJHXAAoJEJhw7/PxL2ByD+UAoIxHuxKNL+pj
+PicrmIpKNigqe2XXAJoDHBqC7dGawg2eUsXS2g6+VJ/xWIhGBBMRAgAGBQJGPaBW
+AAoJEC65RoKIgXQCSpEAniORwuCyXUKIDFnQOEbAo5CfCnueAKCTw/OrIlakDL6H
+ktMcUMjHSPTNMohGBBARAgAGBQJGPhfcAAoJEFQiDSzIdBVc3bYAoITYcorsUW1f
+OamHAXMcflZDZEvqAJ9LhDRlZWaa2OGfRGmWrwRAwz1GFYhGBBARAgAGBQJGPhV/
+AAoJED4qb8JfKYgk8yoAn3BNCMpwqdV3LauYt0pTH1Qgvct2AJoCK2zdA5NGT74j
+NMqJHQXQysXZlohGBBARAgAGBQJGPdZXAAoJEPXCYBZM7tdfElsAnjSx5Am1oSrn
+Q7cUsLN1FPnOuTLsAJoD/T6wr2X08EP1DW8ndgBhGgrVVYhGBBARAgAGBQJGPfS8
+AAoJEKBy1NBDWMWE0SQAn0kYZ4EZRAZd6DdUV3DI05g1ZWQZAJ4k2nO3s5wg1RpU
+uujnoG4/WJeaq4hGBBARAgAGBQJGPgWDAAoJEAKlpgULfmz6dsEAoLMOj9qxLNdC
+3+bMXicJmUW9ePgSAJ4s13w3tDI6kbd9CLreIp31ICRjFIhGBBMRAgAGBQJGPbGb
+AAoJEOHh8rCZDtSqYtEAoIhyMN6rv0nT5gwNLV0c/Fa6+q0gAJ4+pr7oAZRLKtkR
+s/X6N33r36pJwohGBBARAgAGBQJGOPZiAAoJEHPdjBYBUwI1E7sAoIU1S8Impr3j
+MlGYrnwBamrSAwaEAJ9LAER9Xg6pCTM/1O69g+KaB244cohGBBARAgAGBQJGRhFG
+AAoJEKIRWuFfa4tyDJsAoKP5GAZyWTJ4SJpqCnizTk+dF150AJ42/QN+tsYbDVwN
+gQGSJl8dcJp+0IhxBBARAgAxBQJGSMVhKhxIZW5uaW5nIFNjaG1pZWRlaGF1c2Vu
+IDxocHNAaW50ZXJtZXRhLmRlPgAKCRAyhk5BnIUiK+WwAJ971xK0A2wXxrflodgE
+RBMq9/2m/wCfTUHo0b5y/aNj86HZOG+AxPLsM9CIRgQQEQIABgUCRkC1hAAKCRBt
+C8c6QFgYN2GnAJ0STXI6kDmBOQwJ7bIDZmVWs7mODQCeNwrDrhMAT0NGVWjhTeHX
+VWlFQ6mIRgQQEQIABgUCRkxEPQAKCRAfISPDa9hyoA+nAKDjxtQhZzz/0g6DScIn
+Qvh/Dgi2nwCgrmlR69W53euVDo08J3YtidwYkauIRgQQEQIABgUCRkx8lgAKCRAP
+RQomYhC/wAY1AJwIYQe+QvKCVFEUHR44HJhG9lThIQCgsHTzbz2rUZ2bFbEM3YpY
+hvKiqYeIRgQTEQIABgUCRlKlMQAKCRAD9oy93oiEoO3yAKDbaloGpJocFy1lMQX3
+ynEngTUOZwCgxGiYdithfO8Y8x4iaQWmyDqasl+IRgQQEQIABgUCRlJuCwAKCRAy
+wdbvDxQ7wV/+AJ0TbDMo7whcttqwtRIF9arL/aXJhgCgpVFxorts5yIisMXi/eVL
+5cUBTPaIRgQQEQIABgUCRlJuGAAKCRDLrr45pGxMoe+2AKC0e9ZZH9qep25JXFab
+WEG8UKsG6ACfR4VuOIIPKzBvSf9JuvGpjf7PlDuIqQQQEQIAaQUCRlPKpCAcU2Fu
+ZGVyIFRlbW1lIDxzYW5kZXJAdGVtbWUubmV0PiIcU2FuZGVyIFRlbW1lIDxzY3Rl
+bW1lQGFwYWNoZS5vcmc+HhxTYW5kZXIgVGVtbWUgPHNhbmRlckBtYWMuY29tPgAK
+CRCyvrxAFSkkr5V6AJwNVQSjFWYlRNyc5UB/Ylg1gVeRXQCdHuVvpnO/fxbjB+jw
+ILowxjbuFA6IRgQQEQIABgUCRl7VYwAKCRCahtfM0arqYOk8AJ9yFSe3EsBciiRX
+xTsXWHxH5aLBZwCgnLDW0bWkjd6CKStV62+Hg2FeNQSIRgQQEQIABgUCRqVKXAAK
+CRA5vlGhCEyRE7UjAKCU1AiErvVAmkZ+GeXUKHRfEQz6HwCfdQIV8YVaWBbvRgMl
+W1zVYGe91GWIRgQQEQIABgUCRq3MAQAKCRAzzWczr17EUhWfAJ9HbK0CO07DTZkV
+Nlnm3CmwOc4MvwCgwXLE1EjDufwxipQfwSPu0JRZioCIRgQSEQIABgUCR/0s+AAK
+CRCLlilD/CQ/PDErAJ9VEaLs+nFOJdiQzBZcNyUSVRpeFACfbjqUkvIecDdcI3lO
+JgVPjN6RhZKIawQTEQIAKwUCR/0m7iQaaHR0cHM6Ly93d3cuY2FjZXJ0Lm9yZy9j
+cHMucGhwI3A1LjIACgkQf1hPnk3Z0cSrogCeOYYQ0/P4O5X9/9d4pFPXa5h04nUA
+oJgZVFJ6d4wqBzQLW2FRIkkEifeFiEYEEBECAAYFAkf9xPMACgkQGDgf10sb5phu
+xwCggcEsz1tnzCqMNgwGTb8TrMHMZYQAn1muuBraWNZ8cPyDvFs+AzBCDksMiEYE
+EBECAAYFAkf99pAACgkQveChm7bpBvP2FACgmGDtfKQC0m9Ub3cwlLh1DMo0deYA
+n0IwhPcbQ/DewoJ69ijrYH+9d+whiJwEEAECAAYFAkf+TWkACgkQMaY9luwUC4FX
+YQP+NGCaVfHgIKVbeJ6TP45W+1p5mCL08V2AH0wYZ2v8UBgZrdMqCTJilA82FEps
+aUQWijC72YASpqwhkjpZk5Fn70WjT96x9Ire4jRR/QvBkitTF4RU1vf4nUrWdgHD
+9Gk4FYu9gq6qqyiSPWZq/OHkVGeFY6cM1w2TcTsrVNJDI2CIRgQQEQIABgUCR/31
+aQAKCRD3iHX2QnIfAB0gAKC21tFnvtiBIpqpUbqZw49VdvBEpACgiKtx89FFaxm0
+fEEu74aPz3fToTGIRgQQEQIABgUCR/5OywAKCRD9b4jGIdCnG9nvAJ9G8sOnzViU
+EdTJGeZzBeqrc5voyQCfa+wT8YN6a+Ep2B3rDtWs9d44EI2IRgQTEQIABgUCR/4L
+qwAKCRCBLyCFwtUL+w7SAJ0fMVEcuUltW+XJ0GCo4oWiqBcNDwCcC/pnKkKvrEWE
+3v6hUXEwHx0ZYZOIygQQEQIAigUCSAN5GR8cSmltIEphZ2llbHNraSA8amltQGFw
+YWNoZS5vcmc+IBxKaW0gSmFnaWVsc2tpIDxqaW1AamFndU5FVC5jb20+HxxKaW0g
+SmFnaWVsc2tpIDxqaW1AamltamFnLmNvbT4iHEppbSBKYWdpZWxza2kgPGppbWpA
+Y292YWxlbnQubmV0PgAKCRCLOmAfCMl15Ul6AKCiNufW+YV3obsLnrgRPyYd+KO8
+ngCguSjH+XXdANHTFECh1V2D3U5mXWaIRgQQEQIABgUCSAU+6wAKCRCOo7BoTHZX
+8XMyAKDJyeqX3oj0wRNGFVSkbjpV54i4xwCfYPtfmHBQL3GcnisIso3ien8aR2WI
+RgQTEQIABgUCSAnx0wAKCRDegOZWGfkpGIXXAKCoQHJFIIhXJ1LWWb1kRNpvdOq+
+AwCdHAwDQhohnLXFQC6C3Iu3Lr7+3oSJARwEEAECAAYFAkgInxUACgkQGWWFUMMR
+BhEFxAgApqRcZhmICKF0ZMuEBE7M+saRsgBTRoNnmsNKZ0g3kKk0bzKTtztZ4JhS
+7Lvck2ljO3DoLbrjRAPzYfaZk3rUWk1RAhrHC223XqBmIGhK05LLjuGrZZaPZBMv
+gPte4928Sc8b2U3lTAMwbTdG47gO2t3l5gFR9ZrsyHDw/gJtJ0k1VBWIssRrKnuT
+fPfJzO0U5bFuESVPaQ+u5+V+HjyXyrwBtn8daHp+PEz7Z9puXSLHqR2mTeWxGWtH
+S17Bb3CMwjKrfxG3lg/FCDryfu78XCpwjYOQouMcST2CKcPNkgKBQ3+GDbYKUOO3
+v8FpTQbK0ACOasTEjOF6KbKjMTtpGohGBBARAgAGBQJH/0xyAAoJEDyaQgQMCIW0
+tEAAniYkVrwPIJE/JQT9Gxk+nlB583MUAJ46HnOLwBuAUB1K/opKGUrrF+RD6ohG
+BBARAgAGBQJID00aAAoJEBhhwyLFYBSy2u0An3vnCXWczd0VR+suMEmyrpciAg5Q
+AJ9q7EBbQVSKom183DKkHuE8LShoNIhyBBARAgAyBQJIC2TXKxxCZXJuZCBGb25k
+ZXJtYW5uIChBU0YpIDxiZXJuZGZAYXBhY2hlLm9yZz4ACgkQs5fdGlNtq+0LSwCf
+VB1kPOLsUsJr7dOAPxGIo9bfWzkAn3HeFym3oPtJVbrMT1wIMUgAsZoRiQIcBBAB
+AgAGBQJIRASPAAoJEBk/GAq1XZl3bxkQAJ26wvx+BepGzI8u7X4UMKLclnTLBrtk
+uXxsPfLBHFAVS+quwkFoglUb9a3mNyRv9DR4F3/yBCZpUlvquPsPSQDW4CDODjKQ
+f0hiDMmCMrUWaLRbgWSb5HHk8V+RLtHb3l/37ywu1ezw2OF4Ue+xl5WIYDNiYEOa
+GCCbVoVwUtFUSHcIPSd6hr6coeXK/p/vcpc1WUSeYukmFFiyCy2ODRpfpA3Yjclh
+vCAklryyK0xOapIjIfUCbDfM56/8AS5Dy9AGnw5v8l80gRCD3FpSnUE8cyHCi9zc
+I4dYdSNO+ZuL0TexMno9rlJDBgbGYWYbmgEW8CRSv7jzVHSGaPYmdFA3bu2YdJmr
+vsKgONflOwEoP2naJVb6SSRHc+OHh+BAAZIUXPPLr0v68Ps1/fW2UzMmiPhgCJjf
+z8uo7dOdMzjVT4GgMhGnQuG64r0aHpX3AT53go4j9uk1rMWSikK5t6VacpqMUsqf
+VXo5VpADSRA7g2zBTbFUw11tWFrx7+M2jelvXobiWgBZ6jG+1XM7IvHrnN5j5M4I
++lWfbeIRlMMZJHnQnJDh8/4op2VQGt7VxURjN3cePI4IEJlRZ+Q1NjxDYSXkooXh
+Bx4RKYn/6fya4z7KDdBSMQRFLaZ+Hf9tQezj8PYyNO4xR0eJSeBUjXCqPePvJVOt
+B4NBC5uayBK+iEYEEBECAAYFAkl4Y98ACgkQi9gubzC5S1ypMgCgoTq8fqFbEpAV
+0c5K/Sg2Xc6JyqgAn0vOkLBBNh9WHHX6h9lh4ZGdjy6ZiEYEEBECAAYFAknKiAYA
+CgkQyceSTlEEfWYV4QCghWf8038x2jzjS2axOqnpPq2Q8PIAnjXYCVtSVTWlslK7
+xGBRkHueNFPOiEYEEBECAAYFAknP8aEACgkQJMGjeGoBexf9iwCgn6GB5Mo10dSG
+CT2+0JFcjv3aBIQAnAiuKtxLXe8ExsR2i3L5ANvFr92QiEYEEBECAAYFAknSWIgA
+CgkQrrAaFTt8dbFNYQCgkhqCyFMpSXHYl6OL0P2K2OgSBEEAoJIYWaQJGOy6DG2o
+3A44Jzc1GPQ7iEYEEBECAAYFAkpkJYUACgkQPPOSHMbURO3CsQCbB1x0IE2o0atR
+R2cjxjHYiE4EIwsAn3puLQANhPOhv9QkIDrZzBfXukwviFkEExECABkFAkM/yAsE
+CwcDAgMVAgMDFgIBAh4BAheAAAoJEEwEKBgxGj3lflgAni+OIjcWhfBnBaSXI/gK
+eWE4OyENAJ9cOfR5IZcmedhkBhy6dNBZDbgcibkCDQRDP8gYEAgAt1UbMmoZ/uoL
+StEC0SfcgbLVG3yTG6xFH5qL5t7w7HEboBvY9OkXYqHIMklC3MHJUv+BlRfhevo9
+R3DdeOY36AuYE5xwp2LXOzmDFtmqZ5aYD7269jXj5v0Vc41PK3XkQgltzKQWTvHe
+RD9r9Dm6MXQ/2n+/TfDfnpgVpW+rXvU+SXUru41+3kZREg3NeWMfPcI7earv8Vh9
+mEzHFtF49QauFa4E4cvvQnl5YD//Hpxube7qG3JDp7tQ4HYp+xX5HIuU+c545Up0
+NGWSpm2HnwnMzht6NEsVipWl7ncz2ESUJ3oHt4gDi2g3ODzZPndrQwr7U7qLuLCK
+n6wFTGMctwAEDQf+IjolfpRrijLrrMVtta9PO6KWNFZgQolOTN5E+Nbt+evFGCUz
+NNcDVlyozm3ls9NaHOUGUKtwUhgN4qGDyuB0DkWtqNMTEF5xzi2FLyzYqSZJjx/i
+kFI64D2hj1Tclkgz56cJtnjoS6U3OkQ7oS1mHDjjo0LXLY0X7nbyxwqE4XdLeYOF
+ilrvHIqJX0KBTrZTl5HHr9ZhR+Ho6ygcI+ip22gxhvqVXNWTFzJ84J/Zq3YJLqZW
+eDui1EzF/xFOIJeclm1HX24FX6VIsZgkhbPx0jG/QvYJDMnTmoZMePzz+EZdOvg6
+ycoCggtiZi8g6JLJjJdAWtcfSVEjIL8WR3G5qohGBBgRAgAGBQJDP8gYAAoJEEwE
+KBgxGj3lzTMAoKHiIZqz5SVGSwJftzHnZEeBhIZCAKCIYF7dohQgEGpBGmOUNo80
+QmAF2rkCDQRKgyDdARAAz3bbM3oSSxSUiDKmtpevW675+ygVoRMDJAeIiUZ9UQ8z
+cYbsGLqesgwmjtUGCHP+Fn1sV7eJLgyfHvBsRqloGVb1TIGdlElxwIz1UIBBD2pF
+4taTTGYugoau5kPN0Ds3PNdjB42Tn/W4mtnuAECKOftoJjWFHTuJuFyPjQ12dfW/
+epoFx+twNwvD6/YMqzDNZmDiaOcqxQyiVhal+re1ATkU/1we9rNcbI5lbahYnvYO
+Q4xiz7qavtiC2yY7moZicT+YMb9+AmMu/U/OGLkihVKi87N3cB1aUd2h7AM5CSoo
+ASFu5zFYinP6rLCo5H+91rgOMiLvwjI+5H28yhoKKM6udaZ7cwgMp+CaD/db3ruy
+HC330uYlG7byyNiucPXxiFTnUZb+9UOPEg99vs0RWDfHuGSf7EXADKR93cUNv30D
+Tlab2r+KNVgCn+pJJNLGvbAAfQ8VihpHP2YiX4gnuoAKBhEszwM+/eLjwPbZKylL
+ngkmJPvYIDm6FLJ7R7ubkL6SvNjPXWQy2TAm8O+saJLsrFVzpr2t8YkEtbuJmCT2
+8HHmz7H+30NC3SAUmy5biv/iXwnVP0dKSbGEXz63KKGm56ys9xusY+QbZjChAMeL
+CmiFhNVVtWsbK9rQeF227bL2YyE8md5sxX/9BYrbrM3zq2ERJ24o46ZmK/vtxC0A
+EQEAAYkCaAQYEQIACQUCSoMg3QIbAgIpCRBMBCgYMRo95cFdIAQZAQIABgUCSoMg
+3QAKCRDm1b7RUYW6HJMcD/96/KQo7RWGEpzad5TSxWaQYULuzWo9wolPbKFAJvDv
+l1EljIYvuvJjaPWX5a7YAivMg7nlEVknI+sGRG3BbYWRGnRaYOVjUT4OyrL//mdd
+N6CDMm7HXpPGk62pQORRE8F/+kfzxcx8cHwerdhwm3lGPx8Ibhw+ZjkUwOY3DBNu
+RcKDSlFMQN08R58tO0A6rDw5wereC9Ys+/853xWuwKxNmaGfE9AB9oZN2n4Ruxr2
+albiH0qSqTp1Iplv6JtGsqbQ5o7fLA2PeEltyPdj3oAHLIHq8rgD8T15YxpLHNP2
+a2tqZOqu6PMLRY0A3/2SLPq7gg1XuIXwLuCO5Irdlcf8FXxQZwSOg1BxAZXNquka
+TLBcZeHJlbiVuSzMG+PA9iYxwT1gCrqW9pkIiqQcpiZvuFHxsQRDhhkScA8ktTsT
+HJMiLp77cqhRYZG9BQGR5vMxJ7vFkOiSWkhaYC1VeQjn4FdkLryuXARU+VDzwqTn
+3EUABqyFAp8ZbdVLZAcqMAjTQdkQsHFPCz+2XKcAchQIcFILSCKwZLhuZaP23PT/
+qKdXOpWPVVFRBkcuDYC3pw/Tri39VJygF0/tIPHTmI6C6Etzd6okk+k1Itdt47Bv
+SDNtfCxBQ28tOYoc1ACKZOyWswE2o/00IzlHMMiBHcLerUM9DSvcjzKwvtS10l6t
+860PAJsFaZ70asd3WhQ3GQa+jXYrzeQ64wCfTYyzVKKECOc27nsw/t9mwwPUMYO5
+BA0ESoMhPRAQAIKs8QdUzoQIWxF9oaXQuYsCWBp3waN+G5eObOd51tfsZCVjng+r
+79R2w+qmYLg1ooySby36etxLxgKbA45oPBMTulNGKyJB39PcYZuc5OeicmciLIt5
+ziXdWjt5b4+8BiGGa+fsMblmDRDpgxLPgilYIT/8F7q7+ciHUnpOMnSH9UgOZphX
+65F4LgvNIrre7eBAXaN2dqIdHNCay3rOqU9Qy8lfHKTVepytDPCdmmTLpM28wZ0X
+MktK64pVkr6lTEZUjJzsuumYw7EzA7/U8B9RKmfeU0q9FfWsZASd3ys9Uu/re596
+q3FxwT7RAXwCOn9GszE5ZBFvMngBtsBhSYAhS8N30EDKdsc/0QH9PYtbO4E6Z8nc
+RF5TDp+6CY3u24MxNz1TwzOClcz9ZLYgTj6kNl8RNKTvd1JFcgT+18uBCBdQJxi8
+XH7PhsBZgy/UieX9T+NYcvC2xHIeP5O5/z6AgFqE62sYso87EgNxrZH2FI1tg6oG
+4JjsLzykORX29cUpKV95j65M6DKeb0eF61u7pk8r4qzdeaNTjnbm2cZf9/9F/rzZ
+sdz8Pl1DUwJdgLZCQBlFVrN9IbAzgMAQdHeSK9UDk5pLtwVhKwEL5JqzM90IuBK9
+GYH3Gvg8ZNTndL4n8q6sD56sWsXceUi19yQoLaxAuOORvxXQCy+YDb4nAAMFD/wM
+aEBi+TMG/iWTG7oCD5PJjf0T8FUriMTZWnbKCNznFaFlMyiV+ZFb7+dwVIt62n6T
+ijq60EwknzRnA2/urUBL39s2qeK9jU3KNeBlHSFRM/5Pjqlpy7ox3fH90fg0H4OG
+DlZlg4R2WfdeAgk9TjlMhWO6fjvSHtkoccP4OhGpefzBU1ujlIAYyIDNxSDQDrGE
+Dc5urTWcLp86eC6M3UXNopQVskITvjasc+/C9uAsto7xa/dBSwTsY4xHpQF0d3y9
+uu1ygO46Xq0N6nUVGgF7iM/OnL1sVyE82ccn2ikqfgY/l7gQXg/+POxxRlBAcGHX
+XtFrMf0eycxz+nB1Hh7dB71PnV7WRB63SvTJNKIBBQkEy194ob6gAKzazq8pXsZg
+pmnd6iEW6AP+8PcMsoYQJ6OdIqZneTQVfoiPyNG8XDygjwH/svXA4NUBdEskTHrk
+dVrDyWoCTNlY2jUmCC/is6ZfYK/fyR7KuF4D5uXL15NPK4FsLQbq6v428GVL+e+c
+HxztgILe+HKWv/h5YGaOOyVq+lUv5LopYt4poxnlC1npI2bNej5K+XyeQMsdCr1n
+3GlyqNFugRsIf/F+osARZfgfxNPXOekwlEnI2cQYJggwqLH9+zw5JnAksX3/57aE
+WeKvE4cuaQBx+qSS3NEb0Lq9If4CATs17eI/gPNT8ohJBBgRAgAJBQJKgyE9AhsM
+AAoJEEwEKBgxGj3lzDEAn1njbzNxuWwU9Qc0mPdkVrUIK0FBAJ906vRPI7J1KIh2
+DBlOT12zgK3B8A==
+=E5qG
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+pub   1024D/83E6AE0D 2003-05-08 [expires: 2008-08-18]
+      Key fingerprint = D694 DAB9 8F4E 68A8 4C17  F011 ECAB 0E7B 83E6 AE0D
+uid                  Maxime Petazzoni (Bulix.org) <maxime.petazzoni@bulix.org>
+uid                  Maxime Petazzoni (Bulix.org) <sam@bulix.org>
+uid                  Maxime Petazzoni (Apache Software Foundation) <maxime@apache.org>
+sub   1024g/EA644EE9 2003-05-08
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.2 (GNU/Linux)
+
+mQGiBD66FGARBACW/hHKwrc3NIMstpxwopJI2h7KMr70Ecmn5i6NFOPr8I8smABx
+dIBNE0E07oCWKlS5mT47mio6wY46j5Q3EUmxbfZDlox7IO+R+1+s6OpLDz6QyLpW
+BtcaGkHNHaZPB4ouyd4T640ni1mp0b1G4awlgLxJRVcP/AtJCWVJTcNc4wCg4I8r
+v3+yQ+oW3QDExgGN23AQxIUD/0N4aLkdzJNv7DmDto7cwqQ1+hmPVHsyG+M1oKxl
+isx7NpCbicumMyvaIrFekUbpX2jtdP4zK3F/l4BvlR8YfgDrk7QmDT4eCUMNLviu
+d23aEehFtfP83O/IjXt1CjVW5n8IWNY0jwEygY/9bOQNI5XX3LcJvyMwqZorUSts
+n/EuA/4zRkE3Y+p/gRNv1f8F1exV3Cn2pb5ROi6tmMbpvB8Lmx41hZylsbZQdNty
+s5roYdGJGAL100x/KplV72zigDlpSAFZzKP9ArcO8w5SiJiyqYQWuB6UKB3fH9eE
+inL+caa8CQY/Tr2NGIR45t03h2i3zD1MrKulZz47kCZYbztSOrQ5TWF4aW1lIFBl
+dGF6em9uaSAoQnVsaXgub3JnKSA8bWF4aW1lLnBldGF6em9uaUBidWxpeC5vcmc+
+iGcEExECACcCGwMGCwkIBwMCAxUCAwMWAgECHgECF4ACGQEFAkGOAVMFCQnvQvMA
+CgkQ7KsOe4Pmrg03XACePWqWwPgqWx07CfmVr/vHodYJI7YAoLIJanI8VZV4dHIB
+VXZf0Kgf3VlgiEYEExECAAYFAkGFmWsACgkQCbw14+5QZGFbKQCfUVJPpvg9taHb
+i3fopt+oStAtJ/0AoNrjNX3IQZVGW0A2BrcELzHWA1GSiGEEExECACECGwMGCwkI
+BwMCAxUCAwMWAgECHgECF4AFAkCWj6YCGQEACgkQ7KsOe4Pmrg0dwQCZAUZX8G4U
+6MBxPaN6SDXmV7AB8lwAnjjlVWgagBa+sGW//R/jNYlozb4FiEwEExECAAwFAkGT
+EiQFgwcWRS8ACgkQzTD+AjVP2VIqFgCfSMoeN3UXC6tGlnDJfrJJJJ9hb8EAnRwz
+xS785bagDzRQTrD72+kuukB4iEwEEhECAAwFAkG7qckFgwbtrYoACgkQlF9N1bY0
+ib0UuACgsjxfNyZkqZmfyLyLmeLaBIiR35kAn1EP8g8JnpQaatFUiWXzETr1u2EX
+iEYEEhECAAYFAkJC8CQACgkQv04Nz8dVki/mbACgx35U9znQ49Mw7gEEb/PkM9SN
+OXYAoL/OYqIQUqnnxjNUWdQHHqua+dDgiEwEExECAAwFAkKE3+kFgwYkd2oACgkQ
+9lPLMJjT96f6ogCfXfb7Jn7PWfeT5xqOFd5jahaL/aAAoLQdE/nmBOVqvAKXNKn8
+KlwFQeKDiEYEExECAAYFAkLb2vAACgkQW5aAEOBPmoncOACdE4Sqz035hyYWfqqx
+JYw+wKrB0MsAniUauUXnaedm5baA3MpLmKE14vmkiEwEEBECAAwFAkLc4GMFgwXM
+dvAACgkQ94h19kJyHwBIDQCgnIhgESJ8p6OUuEqLZonnGozpJZAAnjbKeqeHuRaK
+Lqtd/PSQKpjcsoLpiEYEExECAAYFAkLdBIEACgkQXP03+sx4yJPdPgCg6uOAE+5N
+EK/x+AoyXSi8Y8m/v6EAn3m1F0kFeAQOQOFWz+XCXFmp49GniEwEEBECAAwFAkLj
+kskFgwXFxIoACgkQhUnvgY6MdEhTDACgjLv4eCSEm68dlStlK/Ii3jrgKcoAn0lq
+qZdlIaK9LA2KRIM7p3JjpdHliEwEEBECAAwFAkLkElYFgwXFRP0ACgkQbQvHOkBY
+GDfyZQCeM7mtFt4c3RA2bVPmd9mxnY6k1bMAoIQbVZ1G3d7YP6oLATygKPx+689v
+iEwEExECAAwFAkMOxUgFgwWakgsACgkQf7o9T+sfU2R2fACgiz19Npntlekc7KXo
+eqIqfQW2EwMAoJVfMZjd5HSu+WX/DJLDGG/P38iTiEwEEBECAAwFAkMOvUcFgwWa
+mgwACgkQS3OlVpbZQYk52gCfXD1k4WEozb+oDW4g8w8mPnyD43kAn1es9XXb/sOP
+s2QSQpSuPQgKVjduiEYEEBECAAYFAkNM5uwACgkQF4qBnPu4WxVB8gCeMcL7DkgF
+9m1IwvS5vlNJ+ZZTtrUAn3BqUvaxgXS6PrbhzqV4ca6h5xRYtCxNYXhpbWUgUGV0
+YXp6b25pIChCdWxpeC5vcmcpIDxzYW1AYnVsaXgub3JnPohkBBMRAgAkAhsDBgsJ
+CAcDAgMVAgMDFgIBAh4BAheABQJBjgFXBQkJ70LzAAoJEOyrDnuD5q4NJPcAn3Ii
+MneIS7QSFFqbBuWXg1CtKmfbAJwPdXZaz8/XeNwl1IRqHcuF26sVU4hGBBMRAgAG
+BQJBhZluAAoJEAm8NePuUGRhVgEAnjECm7Za8pLWh986UN0dALCf6fPcAKC9JwmR
+xhk4Z/Jttho6m15LqYotSIhMBBMRAgAMBQJBkxIkBYMHFkUvAAoJEM0w/gI1T9lS
+pMoAnjMWb7SCcrNZWJ3eSdlSFk8ZPXcaAJ47na71eks2kL8yXB3fp2HWNOx2Rohe
+BBMRAgAeBQJBhZkfAhsDBgsJCAcDAgMVAgMDFgIBAh4BAheAAAoJEOyrDnuD5q4N
+PA4An3CRhtEOJ6sJvjTCzSv9vCuSeCCPAJ974rjwU4SCJ/gco7XMM1SZIgvIEYhM
+BBIRAgAMBQJBu6nJBYMG7a2KAAoJEJRfTdW2NIm98LcAoINh9Pw9fhCMf4tbGhKs
+cS1HVNacAJ4obCxEt7Z88ptYUtrlSru9aZNO/IhGBBIRAgAGBQJCQvApAAoJEL9O
+Dc/HVZIvr4oAoJWNbuFkt7K2hxNLSu8b2r80z7jpAJ9+6/MOCJ2Msvdy2y2XF8xE
+9L8jZ4hMBBMRAgAMBQJChN/pBYMGJHdqAAoJEPZTyzCY0/enS0UAnREbV//LESUt
+zmMSxefuLEHtk+rZAKChzgpgSVLEsKVQQh30GfQgRVWcj4hGBBMRAgAGBQJC29r0
+AAoJEFuWgBDgT5qJZIoAn3Ly8SL/FjA00L0l0gY+sjVR4oLvAKCPEw2fPgMDIRJw
+mPeV+Co+W07GnohMBBARAgAMBQJC3OBjBYMFzHbwAAoJEPeIdfZCch8AFNkAn1Vt
+31nqcgesRmOtfQnjQBFx5hC4AJ951q/b1oUn47FvyyJtfp+PUWuLX4hGBBMRAgAG
+BQJC3QSFAAoJEFz9N/rMeMiTVA8AnAlVBaQjW+twEAbgbWqFaF6dEsGLAKDbwimF
+XXTU9ZWQsDzpO8/r1fXW3ohMBBARAgAMBQJC45LJBYMFxcSKAAoJEIVJ74GOjHRI
+uHAAn1+BUjTwapsuQ5xy6mOhQVR3uhuzAJ4kz7GyZTQXveowgl3wuLr+zHW3C4hM
+BBARAgAMBQJC5BJWBYMFxUT9AAoJEG0LxzpAWBg3+z4AmwbyGsGW5goY5n1Y7n8l
+XvRNbek6AJ0eftBgNzQ8Wyliw2zrqrCx79ZS7IhMBBMRAgAMBQJDDsVIBYMFmpIL
+AAoJEH+6PU/rH1NkS6IAn30i+PkmC8Y1lrEVxZpSD/iJzcKKAJoCUkHRy6T0KJ1b
+TvFORa9yOD1wrYhMBBARAgAMBQJDDr1HBYMFmpoMAAoJEEtzpVaW2UGJUOcAoKyG
+1VXvxK830zLq3hnNP4DGCBc7AJ9JDp7sE9EjcgxsBlA7yYxKCHTPdIhGBBARAgAG
+BQJDTObxAAoJEBeKgZz7uFsVv2MAn0jeoqWUiSYQ7HULy/30CQNOFwa0AJ0bWNrM
+bnyLVOPsg2rDq1bGMGyMsrQ/TWF4aW1lIFBldGF6em9uaSAoTm92YS1tYWcub3Jn
+KSA8bWF4aW1lLnBldGF6em9uaUBub3ZhLW1hZy5vcmc+iGQEMBECACQFAkHkYDAd
+HSBUaGlzIGVtYWlsIG5vIGxvbmdlciBleGlzdHMACgkQ7KsOe4Pmrg2UrwCgqr4T
+NWfG6S1eplFbu9rXumEgezcAnjyz2jhtfVGCCsj2Z3AgAyDl8wCJiEwEEhECAAwF
+AkG7qckFgwbtrYoACgkQlF9N1bY0ib1QKQCgotl+L/SfrQrnD76obkGPzNuFqaQA
+n1Mj8Wk9FNf/hAsSZzCAbV3tgbI3iF4EExECAB4FAj+NhncCGwMGCwkIBwMCAxUC
+AwMWAgECHgECF4AACgkQ7KsOe4Pmrg0zuwCfSIJWxDK4Gkx7BsvaO0AZOCgapFwA
+nA+oKOaDt6GlxoqAhxuUiPo0xKZwiEYEExECAAYFAkGFmW4ACgkQCbw14+5QZGER
+zgCeIe3ZGHUjzz/UyQW25Yf7s9/8VBcAn2J2p0ZUHEdntWqlOTi6v3jxiVe/iEwE
+ExECAAwFAkGTEiQFgwcWRS8ACgkQzTD+AjVP2VKubgCgkVieHF2C0HYExlUCR8e+
+hkJjrQUAniPb3LEwUfj3OofUfREw/I8DGLbCiGQEExECACQCGwMGCwkIBwMCAxUC
+AwMWAgECHgECF4AFAkGOAVcFCQnvQvMACgkQ7KsOe4Pmrg2kHACgqrNFxaQR3e2r
+jyZ9yt9HThYvbc8An1yP6cOovt1AZ5p6OdU9R8AXBf+PtDJNYXhpbWUgUGV0YXp6
+b25pIChOb3ZhLW1hZy5vcmcpIDxzYW1Abm92YS1tYWcub3JnPohkBDARAgAkBQJB
+5GA/HR0gVGhpcyBlbWFpbCBubyBsb25nZXIgZXhpc3RzAAoJEOyrDnuD5q4NGJYA
+niQNlo383vzVTSeUdbLew6yRsGzFAJ47Jeh7vghc8e/gdRzqYcAoQuEyaohGBBAR
+AgAGBQI/k77UAAoJEO6QdfU5abv28oIAoMexl17WRE9fGmCPjeS5oCEy+gAyAKCH
+hRHg53SWgJUPQ6VuDL6cwUNUzYhZBBMRAgAZBQI+uhRgBAsHAwIDFQIDAxYCAQIe
+AQIXgAAKCRDsqw57g+auDVyAAJ9V0z5uUuipuRG/5YlUD91mFGonLgCdHKSWkg7d
+LmcA0I2fecVd3tyCD6KIRgQTEQIABgUCQFDzaQAKCRAw/hG7Ima1Z1NmAJ9vkgu5
+88uiz+IK/Vrz7bl4/j3T6QCfR+sEvZJIK4+BF3twAOgeqj+torOIRgQTEQIABgUC
+P7+2ngAKCRAXioGc+7hbFVSeAJ978TzTftJwzHQik2uipMjBC/BDjgCgh/VdE2kq
+A7uycb0AmqOFEG9nzz6IRgQTEQIABgUCP325YQAKCRBfSAZpCvvNYNaTAKCAApn8
+SL3+AeBH8jT/5U1zuhf6ZQCfXAFBAuFRtlf+iml+MOFccjDUlcOIRgQTEQIABgUC
+PwSSpAAKCRCrz3ACPcJ28S1jAJ9NMBTPc/16nQWrC9k8+ZL9l23zkgCgxbM23/yQ
+xAZwLzxFY4M3F1OKptKITAQSEQIADAUCQbupyQWDBu2tigAKCRCUX03VtjSJvSIn
+AJ9zZMfRjjsaG+mrQAT4RAZkOVqICACfc2FH/vtiAsoHPUnQDoq9f3ohgB6IRgQT
+EQIABgUCQYWZbgAKCRAJvDXj7lBkYa1nAJ9NgL+MQmis6wQ69+TTXYI0tJaG7gCg
+3ghKMJfGtbzNi4RxTZnqviTr49qITAQTEQIADAUCQZMSJAWDBxZFLwAKCRDNMP4C
+NU/ZUucTAJ9hGzCVYM3PvY5ci+L9OkJeg3JZ9ACdHk9ajnEBXBXQiHxPrSvEkYpG
+dX2IXwQTEQIAHwQLBwMCAxUCAwMWAgECHgECF4AFAkGOAVcFCQnvQvMACgkQ7KsO
+e4Pmrg2KmQCfThDO0PQglZ/QyjLq8a+t2nT+p78AoJtiOntKvb3zitjuIf/9l5i/
+to9otEFNYXhpbWUgUGV0YXp6b25pIChBcGFjaGUgU29mdHdhcmUgRm91bmRhdGlv
+bikgPG1heGltZUBhcGFjaGUub3JnPohkBBMRAgAkBQJC84EGAhsDBQkJ70LzBgsJ
+CAcDAgMVAgMDFgIBAh4BAheAAAoJEOyrDnuD5q4N1ZQAn3JZ4otgS3ogdgCGKFeQ
+hhT0PDaPAKDFBgOlH8LdGitENSoZOWVEXSw3ZYhMBBMRAgAMBQJDDsVIBYMFmpIL
+AAoJEH+6PU/rH1NkU58An3zcPhOI4SgSr/I7cGuHH4NrqKDnAJ4k2IaWtkxtYV1s
+S8VcANTKSEZJDYhMBBARAgAMBQJDDr1HBYMFmpoMAAoJEEtzpVaW2UGJ3usAn2kN
+ttPGuLGa65+6LJdavi9inG9LAJ4uTToi+StbM2uYMStiL/iOKyuoA7kBDQQ+uhRh
+EAQA0gQ6m2hdo3t55hByLXkQTf2zficxXaW9S8gA9mePQwyqpQcDD5wCXMCmhhnb
+XGdFtqs9GlRLK/VcGwkP9L8FedS/u/jtwtbE8aTI9BBE2QVGkRvEb0y38j23pCbQ
+EwRdv9RrGNxAFhCDlJiHFxBAE+dabJt9YCLEUXPmqXh6FocAAwUD/1rAGpdLLsez
+qBxeXYZPzefwNtxhbpEXs71sBC9+ijZnYoGFa1Acnqh3vJH1DXvLC0RDTnqWma/3
+QsHJJtH9Bfbo0M3zKWs5aaV+yu/2XPDGMiOLm1F47EfGFfb4lCWGasq1onD8zIME
+W7kB+6jaDOq+qsu77eWL2kbD/FyC1aNJiEYEGBECAAYFAj66FGEACgkQ7KsOe4Pm
+rg1PfwCeKe4JSyAC0hmnPn9sBOQIgsG2s28AoJ7gJ9zLdb4SquLE0vvfZeKQtLYh
+=DmIO
+-----END PGP PUBLIC KEY BLOCK-----
+pub   1024D/40581837 2000-10-23
+      Key fingerprint = 4535 10BD A6C5 8556 24E0  0923 6D0B C73A 4058 1837
+uid                  Nick Kew <nick@webthing.com>
+sub   1024g/6A4AF32A 2000-10-23
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.2 (GNU/Linux)
+
+mQGiBDnzkd4RBADgCTgS7k/tgx1KaZ+yI5PdpA9slDq9FNGOaP9U6GXhQPDz+Vwp
++DRn62/+k5Er8dN05ioycjNe2oaKRCHW29d+yXC5GeeAhovHYr+uwp1C1wkV8M2L
+m/3LcKizSja1UYsvqucYzBCKYtcK5ttEQmQAa24p9ZhE59Yl3fqpiilffwCglnu6
+eoXfGPxl9/hEitpc7lObQGcEAJSloC5SClhhqS3F2bw46AhrJ73BZ9kOcDe6dlJo
+J29SHt8rE9U2mN5WdLJpSyuwpHOK+xCjnW2JrVxn0xGVAsQ9g5T3FNTDbf1X+a37
+2pO6wAyvtsIH9ZC0JU5lfg/a1+2rGEl37T6tlPW6l3RVUkCPpiyYoaft3SNxslOd
+xJDcBADBtiNxviA3H+x6GXc978PvyjypsESU2JNZRaCI86yyT/dj8VRwVwUPzurm
+0vDqJNfeXbBEGQwp+Wj0C0ZiG30U0/R3rltEdz4Tn/CKH2WXAUkQAdevgOVB1rkU
+eoqjkGnvhwntq6WuHPYaT5pASpiC2wU4HDu7RJcRF1uj0PnVe7QcTmljayBLZXcg
+PG5pY2tAd2VidGhpbmcuY29tPohXBBMRAgAXBQI585HeBQsHCgMEAxUDAgMWAgEC
+F4AACgkQbQvHOkBYGDdpugCfco5ZqB5qIKHYOgfIA05mgc2WXqgAoI2SRD4E9UHY
+Tdx2EaqMfC9teG9TiJwEEwECAAYFAj/CgIoACgkQN+P0X+5l4yGyPgQA3psQD8uA
+j2QoX2bhCLG8rLwYyJfN4eqMvHwQK3iTUDKAF6qEcfnVyXQi8Tu5OY37maq/QOpw
+rHi+/50eiBVtStsqXbsHLKO2xxQGEaCSSehYMp5mQSiJmfKvyLTjlCb0BnesBWvD
+kRMbiEc3F9zzOIcUTt/pPV/YEXmrICM0HPeIRgQTEQIABgUCP7ppdQAKCRDLMqEH
+iMOlpYI+AJ9X3J4vcPGJrZqSMToGS5pzNYRPUACdHyrJ+Rt/ShkqVnJtaM+ONsQj
+H8GIRgQTEQIABgUCP7qPYQAKCRBc/Tf6zHjIk18PAKD1JRdPczkSbx75iHqEfooy
+O7FlBACeKkMmIs03OfCAOB5VW4YsF0x79E6IRgQTEQIABgUCP8exJwAKCRCkdA85
+0Ue3djCnAJ93/9aXFWDyqq4n9SjR2RW/Rcp1jgCff/eiV+vtiZwn1k324Cgqpjjc
+ITOIRgQTEQIABgUCP8OH/gAKCRD6PI0mFCtQm5CrAJ4yOwyw0kjJ23CVpL/AQ5so
+5f41JQCcDrDu5DPpL6sTJrUlnWB78S+14V2IRgQSEQIABgUCP7xo0QAKCRDsmT1j
+Zf3N7klmAJ4t4NE/syVP1xqfN7f9c9yc0IjTagCgmOv08ypx//V3x3/2sH/Qzr4q
+m66IRgQQEQIABgUCP8BknQAKCRAaCdGD/Qk8QbpcAKCZjXmmLt+vFPChYsA2VafU
+TJFCzQCfYPRG2bFBd3iZntiHAqLKpTRy8DiIRgQQEQIABgUCP7+tkwAKCRCyvrxA
+FSkkrwFsAJwKLTY7SnbEi4m0VLR6/JrjzBRZxQCguYUsuBvze88BDVIRX0epyK21
+RhaIRgQQEQIABgUCP7+twgAKCRDBHntHlk8x2fzLAKDgadjCownEBcSPk5zbg/Jh
+/HqFPQCgok3nbkTIvD3ottYB3+RjkQaDD1+JARwEEgECAAYFAj+/xR0ACgkQBurP
+qnbYPMbsLgf/foiuojq63JT4kDNAGSiBnk7NShOC9MRc4odQifQI6stCp1b0nn4h
+d1o/OlBZ1TZfXW/dyW+dMxYlkiaaV/WdbHY4r/ImynGR88aLgG6YVwl1oVUbHY+w
+ImAZLH/rJp4uafWtzX7/p21hVCeS9DckmR9Px23l5UPQyYZLHuI+iZdP0hhPkM0m
+rwC/km8UTuJ4o7+Y0+Zwl75TcTuBe5WodeRkbnIv46cnd6WyJjlgRfz+R2e6gJlG
+ysBkit62Qsl4qIKry+/F/jvy6nOJjJWNjtHTFQs5ijNHGhIagJUvytTFuNcNg3db
+MBEA88D2Js2n0qwLLh1a2aq2T++sj3Jae4hGBBMRAgAGBQI/uaNIAAoJEBD6TIil
+TaLfK7sAoNPyR6W2qBRLEn1usNwpKJcH9nMrAKCeLD1bpWkVXrbCJNsbRLZQcUVg
+MohGBBMRAgAGBQI/uasYAAoJEKge5knOGdXGnXgAoMMltbfOC8a0jhMzzLS0c2s5
+VoGGAKC1UMyYcatFXUT4m+Of45z/+xUL1IhGBBMRAgAGBQI/vc+wAAoJEL66K4f1
+/EtC25QAoNvrYI4Gz40AHHWuSNU3GcuC98GoAJ4w9jfiVYWDftQ020FEKMzDFFdk
+VohGBBIRAgAGBQI/udRNAAoJELkkUqxMkWW22kwAn2XBo4h4t1jxReXckDKhy+7r
+AgqeAJ9uvifvKci3nnfkcKvy/rsGmJC+44hGBBIRAgAGBQI/wVDVAAoJEMwhMCCh
+1pdZMdkAn2kkyMexCUuKCEHPoc2luhU1cuprAJ4peVxHFvyur9mBN0UQ5v2VGVnX
+sohGBBMRAgAGBQI/yuaJAAoJEGhad8ruVlUOIaQAoIX9Au+wI+URjTKwADRf2uHv
+EtDzAJ43TC/BwVHYDpsBu/+7Fjv4wqOY5YhGBBMRAgAGBQI/zd4FAAoJEBMuSdTk
+Htx+ZCoAoKJyCqZuCf0tN/z3NBNWaPgqU4C9AJwPztLCMNJ7J9skWbndk74IdiJX
+M4hGBBMRAgAGBQI/y4vVAAoJEAlaRdyhHVb7g7wAoLvvB/TarlHX/a2jm+BXFPdw
+V9e7AJ9AcySdlGowiXXtEW1cCPyQ+teqnohGBBMRAgAGBQI/0M5fAAoJEGQHhtmt
+v54amD0AoKdcXerf53vHCRVVjeJIdPugbM9OAJ4x8qs74w+PfZ9a+jwK7Mw9EYOt
+XIiZBBIBAgAGBQI/ym90AAoJED6Pt/L4g0HZEXAD50Gfce2rIDHB4DSf5BZyL2Qt
+NhbM3Qr61TlmlduTsyHWTruY1mB95nX/KPGaTiCWBqo95yrf1pcUn4rVH7Im7gyD
+XF82j/QYLSH1rN9CN9ESsFBjaGzi0BoRAAlqgaAELJAoQLsl53vAAaYQiWtaybd9
+u5UNIX7xy/pmYHNpiEYEEBECAAYFAkBVneAACgkQGFXfHI9FVgaXgACgonzAibvO
+s/UHFomOC1R94nKM9HcAnjmjgDH4Q/XOtpJX1Av6ZqTsJo7liEYEEhECAAYFAkAw
+G0cACgkQLovQgMxpzu1GygCfYyI+cF1P8qZvscDQJwwscBktk40AnRnz6qzzAfOS
+LZ9xYJ0s1IQnMGGViEYEExECAAYFAkAV0+kACgkQFT+gzXWmdpJuYwCfYxbaEOfR
+JQXdRj2BlYA0rbUaQ0YAn1MIZa+mkXo2LBwJgufuNVHKfFMuiD8DBRBAX1NazLLr
+Ruds9tARAn2XAJ9/ozPEegLNIXDRFHil+yEe/wz/2gCfXYXgwLrwoyeID7RIrwdc
+hIORke6IRgQTEQIABgUCQY7oHgAKCRBbloAQ4E+aiTqZAJ9SiogzAQfXUoeV12aT
+7PmwkqiulgCeJp8F5t6kEaBrA5yurTKX+6e5uV2IRgQQEQIABgUCP8IXWQAKCRCJ
+2EyvRrJixs9uAKCHjl+/UO32mu6ikEU6gmYFMLqB3QCdH+3pfTEDcGAvStQpZzE7
+ys/vZmCIRgQQEQIABgUCQt7ToAAKCRDKaTl0gQOjfpfQAKCkkLYJL5/0yrhd045h
+bIcgTN+9YQCfS64ZOAN1lh3l/SjlXLHWDzXmjlWIRgQQEQIABgUCQt9FqAAKCRBB
+6gmgV5NJj7p8AKCcfGPPWrDaq3SodTopRts4Kmo8EACgjJRLCg2DHKAzise70OVN
+THGYLm2IRgQQEQIABgUCQt+G2QAKCRAEYzpXfCAJQexCAJ97xbwzZhMOOXiM4aj5
+Ulzrja9nVwCdFZsZgtozofpvmZaHeEtKucxGG3qIRgQQEQIABgUCQt+SVwAKCRAB
+BWa85BNjkr5mAJ9qlkrrGciNUdkcGGjfAb444/G9rgCfTVtutNz831bCqDowpSqZ
+M5bAuUOIRgQQEQIABgUCQuAc7gAKCRCM43a4HNSGH39EAJ98iw5WB5CZOXHbhEPw
+dUnTSVKwkwCfcWJD5Yr0bSriF9aVLChmAzi9jjCIRgQQEQIABgUCQuOlhgAKCRAE
+kTRC6hujjbJoAJ9Mw8UfCDIttO0SGqaodq932IIUngCgj+E2QuHkF0TyMApSaEIO
+w8NOPsKIRgQQEQIABgUCQuSFYgAKCRBhGWouMz5OhB7XAKC4J7nTmBWA6cn67C0B
+vja2bxzRrwCeMAWS6xn1tBZ1vm6vP2A6WtNRWlmIRgQSEQIABgUCQt6mVwAKCRCL
+lilD/CQ/PGZGAJ0RRqxeZpOhWoM2ADUfrkqTkTXk+wCfWiWHJ64H7Ubs7z58fBsi
+M69wpeuIRgQTEQIABgUCQoptEwAKCRDI4/o2Nmo3W05JAJ9arsg7sN3ft5siNuGB
+pnd3Q01ToQCdHjxosGdQalkXeymtXD8SjACn1x6IRgQTEQIABgUCQt6v4QAKCRD9
+b4jGIdCnG4UIAKCJOOihLbPfW+c2CrkE6nEPxQ29SQCgkBCbx+h8aMEyqJqjPWpd
+QvfQofuIRgQTEQIABgUCQt66EwAKCRAyyeTONkLLSyDiAJ94yVjfasZoGZodSR/2
+kYqF4ZQEdQCgvOrzez4RP1JCHWsFTn15tUQgNh2IRgQTEQIABgUCQt7UjgAKCRDu
+0eo5ImHQc6jEAJ921c05ZPfI+9uWI97wsopfW+PDFACfQ/PxEyEzeCXbYFoEUe7B
+tOgp1AyIRgQTEQIABgUCQt9sXgAKCRBQjq7FMC2laOH/AKCwImpjMHoE9H7sQx7L
+I+9m1PmOeQCdH4x9T3vUF4gHL8BypAse/UuLQbmIRgQTEQIABgUCQt9sYAAKCRDd
+umS6LDEtLxjpAKDoV9vn0QheFsQLYuUeDF/5m20TkgCgwkSVcCDP/7m6aZ8blA/h
+cAeKrJCIRgQTEQIABgUCQuDsmAAKCRDJtabs4td03wkIAKCmhOt1jrHnnknNr623
+OtngC3yhkwCeMH2xnonwIboYmyo3hzC84VHzr1SIRgQTEQIABgUCQuDs5gAKCRA3
+9o/1AVr8ilTiAKCLvPNLPVjXY8epjHhSxkRY6+HU2wCfZnVkzoW+c7NQ0G7Db5/G
+rMjEgdyIRgQTEQIABgUCQuJhxQAKCRBtmI0XhzFcMY0AAJwKmpwnqrX8aDV2+t+E
+uTrM4i+42wCcDiK/v3y0jmXbylU5eZ93mrealSKIRgQTEQIABgUCQuNVMwAKCRAT
+LknU5B7cflj2AJ9ZTTFhGTJALO2/xVX8eVGucVbO5QCfe3mRMPaSx5nKne3TQWIR
+2Pck102IRgQTEQIABgUCQuNkkgAKCRB1yqKj85s3UN2KAKCH9B6mMup+BSkf/qog
+WTp+wkzt8ACfdLzMTdNnt15YpS0TEmSNrq0waweIRgQTEQIABgUCQuPrZQAKCRDy
+AsuClhyUYN+TAKCQGVfmlOhNu/L67ZmneL1KA7iMXACePs6DOTSlIh0LKzGvZh0H
+8jAwtR2IRgQTEQIABgUCQuPs9AAKCRAyhk5BnIUiKxpRAKCHGnESODZlUhkrPZ9G
+bKZj/WKMgACfY7HDgvOuK7N9evmNB1+8dUTZnuyIRgQTEQIABgUCQuUQeAAKCRBS
+eS+vmXivhsKnAJ9a1Pp8ZyZWTtryRgeRyIZ6CaG9DACeJtY83ZL2LatOpgfcLCt5
+U/F2okmIRgQTEQIABgUCQuURcgAKCRBrc6EGKmI/cllgAJ9LOwF1qeUlQplpr+mn
+mlLB9JyV+gCg8d75X/XaHWMYCqBs8dh0E/0zf6GIRgQTEQIABgUCQudgyQAKCRBu
+lHWUwVJDGoW3AKCvlrR3dxaHHPAa3Gxae3NTu9/j+ACdG66gH2TAfa9qSx/E+9Df
+H0pdIseInAQTAQIABgUCQt6sNQAKCRAxpj2W7BQLgUYIBACQv85g415QDF40KBaq
+b+3GMOtrHq0gbhG/xq8EfVq2NN+W4jRBgpDIdj17zgTgDy1Xby/04UK+7CMNhAFA
+li5QXPQgO+iKgmV3Dvdzml9P+IGGb7CjU7/oANNfJoCwFUeZanizFzZepTkyci9x
+H5OHcfe4Lhiq18wCmlb4nkG7wYicBBMBAgAGBQJC32xcAAoJEJrNPMCpn3XdRfoD
+/i0tYfOTUwa3OQ8hj9RUx9KTYJe/M0vGuyuNxEWdRB5R6AUolIeboIunb5auAbRb
+ubrVbXjRkvJS5wCqOO7WyL49w9G4BVAO0Uw+QptION+UdpV9ZfXHd+nsgDuiRkVM
+yhX0336SoD57RyiT5rglKpKOCb7l4e12S0dVr15PXc7IiQEcBBMBAgAGBQJC/ToO
+AAoJEFwyh8czExtlBa4H/jj+/4NJgM7ciC0A45ySTdJZY+DYFJyRCu5bCPkcYS6A
+3PKInXc8RgFykWfz0X57UtobvH+s0O+Gyg6ArSErEHXsCZGYlHPpcACgFLiLS7yE
+gEpzDLClmSIMmb7kRGr9LX5RyQhAPAjszlIk9jPdcn3jkTtvr+oHrVLmTy8tcW3u
+d9G8oD7PCZAeD2P8XA2eHiY+9/oPu5y/cJKLYl3J+gL6Ptk7jngft3hwr/6X/dAc
+bE9h09ZS9ZRmf28NiCEBJ6meswMA8C2ocJLmW+7X2Cctfo2LIPpvI0uKzvAeh+Hl
+/97HmmyArknk8qEFYHNh5sI7yT8okbuZ5daI0Ibp1NKIRgQTEQIABgUCQv04lgAK
+CRB+iDZMgoRJhB28AJ4wWlHXGXU73JYV3b/A5l0gdVF+qwCeKkLJspvZ+BF2cV3u
+4FKwIeq4FaqIRQQSEQIABgUCQuE1ugAKCRCiEVrhX2uLchEGAJUSSguS2p3XVs6l
+3ssMx/Cm11RoAJ4hazOLz9zi9bkkZe4Jsnj8t8dkPIhGBBARAgAGBQJDJH2xAAoJ
+EPwPhYn4lL4SDsgAniHK2LhZ+mFApRlM1EHt1XwuZic7AJ9DK42czJ0hWYRJuUge
+gH1hRJM3l7kBDQQ585IFEAQAqsJfRx6LMF9sBtHmNf83j1V2SCVv4NK8OoPcKWBg
+MKQxnDkpWD7DdV69p6azP6N/ENfmK8qsSiXHUUEwOS2UMct7T3Tqi5f/EAVSgw4T
+rTC9dgpafTUpU5A8MW7h+Psm0XDwmwlqREUvyK2gqnpVaMXhZIVU71yTeXxy/3Vs
+7ysAAwUD/iJg+Bc0iZ7LNnW1xZuvc4/6LOEGelQpmM5SPr+gG6DHXhR+TrUMDt7R
+e+WkPGS8yqqxZ/4JefF5X6KgQwDadfQAYldFwW0XakOBCP17yK3aJsYtdaxTyx5e
+R0LuGbxVdMz3u/UtY1Txn72wlEEqnPhNokbvAI50jyc71TTXWKaviEYEGBECAAYF
+AjnzkgUACgkQbQvHOkBYGDcHiwCeNV4G2NP0SvG75RaqmYvnvbyC1xUAn1qF30A0
+W/Kdk2iuwPLJw9rN5PFA
+=WPl7
+-----END PGP PUBLIC KEY BLOCK-----
+pub   4096R/F51BB88A 2009-11-04 [expires: 2016-02-17]
+      Key fingerprint = FC5A 6FC6 2E25 2DFD 8007  EE23 9BB8 63B0 F51B B88A
+uid                  Sander Temme <sander@temme.net>
+sig          152924AF 2009-11-04  Sander Temme <sander@temme.net>
+sig          D3262722 2010-01-01  Jean-Frederic Clere (Apache signing key) <jfclere@apache.org>
+sig          3C7705CF 2009-12-13  David Fisher <dave2wave@comcast.net>
+sig          D84E41AE 2009-11-30  Nick Burch <nick@gagravarr.org>
+sig          D1F99590 2010-03-18  Josh Micich (Software engineer) <josh@gildedtree.com>
+sig          B55D9977 2010-01-26  William A. Rowe, Jr. <wrowe@rowe-clan.net>
+sig          3F0A04B6 2010-01-26  Geoff Greer (Work) <geoff@floobits.com>
+sig          5D7BBC5A 2010-01-26  Leif Hedstrom (CODE SIGNING KEY) <zwoop@apache.org>
+sig          1824BDC1 2010-08-26  Brett Porter (Release Signing Key) <brett@apache.org>
+sig          B1669287 2010-11-10  Kathey Marsden <kmarsden@apache.org>
+sig          D01E0E18 2010-11-16  Jean-Sebastien Delfino <jsdelfino@apache.org>
+sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
+sig          6D5954FA 2010-11-04  Eric Covener <covener@apache.org>
+sig          F2F27A06 2010-12-30  Carsten Ziegeler (CODE SIGNING KEY) <cziegeler@apache.org>
+sig          4DCAA88F 2010-11-04  Thomas Dudziak (CODE SIGNING KEY) <tomdz@apache.org>
+sig          82A7FBCD 2010-11-04  Antoine Levy-Lambert (CODE SIGNING KEY) <antoine@apache.org>
+sig          7C408737 2010-11-04  Joseph Edward Bergmark (CODE SIGNING KEY) <bergmark@apache.org>
+sig          791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
+sig          0E371A09 2011-01-05  Sander Temme <Sander.Temme@thalesesec.com>
+sig 2        F2EFD0F0 2010-11-05  Christopher David Schultz (Christopher David Schultz) <chris@christopherschultz.net>
+sig 3     X  4336B448 2011-06-23  Scott Mustard <scott@mustard.net>
+sig          4E24517C 2011-11-10  Hyrum K. Wright (Personal) <hyrum@hyrumwright.org>
+sig          C4FC9A65 2011-11-10  Bernd Bohmann <bommel@apache.org>
+sig          1F49ECA5 2011-11-10  Ulrich StŠrk <uli@apache.org>
+sig          F5CBAE6B 2011-11-12  Akitoshi Yoshida (CODE SIGNING KEY) <ay@apache.org>
+sig          352ACF76 2011-11-10  Richard Keith Turner (CODE SIGNING KEY) <keith@deenlo.com>
+sig          B84508EC 2011-11-11  Bryan W. Call <bcall@apache.org>
+sig          2A239C2C 2011-11-21  Christian Mueller (CODE SIGNING KEY) <cmueller@apache.org>
+sig          0208FC11 2011-11-14  Carlos Sanchez <carlos@apache.org>
+sig          97C87790 2011-11-17  Paolo Castagna <castagna@apache.org>
+sig          088335A9 2011-11-24  Chris Darroch (CODE SIGNING KEY) <chrisd@apache.org>
+sig 2        41CEFDE0 2011-12-13  Stefan Fritsch <sf@sfritsch.de>
+sig 3        F51BB88A 2013-02-17  Sander Temme <sander@temme.net>
+sig 3        F51BB88A 2009-11-05  Sander Temme <sander@temme.net>
+uid                  Sander Temme <sander@me.com>
+sig          152924AF 2009-11-04  Sander Temme <sander@temme.net>
+sig          D3262722 2010-01-01  Jean-Frederic Clere (Apache signing key) <jfclere@apache.org>
+sig          3C7705CF 2009-12-13  David Fisher <dave2wave@comcast.net>
+sig          D84E41AE 2009-11-30  Nick Burch <nick@gagravarr.org>
+sig          D1F99590 2010-03-18  Josh Micich (Software engineer) <josh@gildedtree.com>
+sig          B55D9977 2010-01-26  William A. Rowe, Jr. <wrowe@rowe-clan.net>
+sig          3F0A04B6 2010-01-26  Geoff Greer (Work) <geoff@floobits.com>
+sig          5D7BBC5A 2010-01-26  Leif Hedstrom (CODE SIGNING KEY) <zwoop@apache.org>
+sig          1824BDC1 2010-08-26  Brett Porter (Release Signing Key) <brett@apache.org>
+sig          B1669287 2010-11-10  Kathey Marsden <kmarsden@apache.org>
+sig          D01E0E18 2010-11-16  Jean-Sebastien Delfino <jsdelfino@apache.org>
+sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
+sig          6D5954FA 2010-11-04  Eric Covener <covener@apache.org>
+sig          F2F27A06 2010-12-30  Carsten Ziegeler (CODE SIGNING KEY) <cziegeler@apache.org>
+sig          4DCAA88F 2010-11-04  Thomas Dudziak (CODE SIGNING KEY) <tomdz@apache.org>
+sig          82A7FBCD 2010-11-04  Antoine Levy-Lambert (CODE SIGNING KEY) <antoine@apache.org>
+sig          7C408737 2010-11-04  Joseph Edward Bergmark (CODE SIGNING KEY) <bergmark@apache.org>
+sig          791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
+sig          0E371A09 2011-01-05  Sander Temme <Sander.Temme@thalesesec.com>
+sig 2        F2EFD0F0 2010-11-05  Christopher David Schultz (Christopher David Schultz) <chris@christopherschultz.net>
+sig 3     X  4336B448 2011-06-23  Scott Mustard <scott@mustard.net>
+sig          4E24517C 2011-11-10  Hyrum K. Wright (Personal) <hyrum@hyrumwright.org>
+sig          C4FC9A65 2011-11-10  Bernd Bohmann <bommel@apache.org>
+sig          1F49ECA5 2011-11-10  Ulrich StŠrk <uli@apache.org>
+sig          352ACF76 2011-11-10  Richard Keith Turner (CODE SIGNING KEY) <keith@deenlo.com>
+sig          B84508EC 2011-11-11  Bryan W. Call <bcall@apache.org>
+sig          F5CBAE6B 2011-11-12  Akitoshi Yoshida (CODE SIGNING KEY) <ay@apache.org>
+sig          2A239C2C 2011-11-21  Christian Mueller (CODE SIGNING KEY) <cmueller@apache.org>
+sig          0208FC11 2011-11-14  Carlos Sanchez <carlos@apache.org>
+sig          088335A9 2011-11-24  Chris Darroch (CODE SIGNING KEY) <chrisd@apache.org>
+sig 2        41CEFDE0 2011-12-13  Stefan Fritsch <sf@sfritsch.de>
+sig 3        F51BB88A 2013-02-17  Sander Temme <sander@temme.net>
+sig 3        F51BB88A 2009-11-04  Sander Temme <sander@temme.net>
+uid                  [jpeg image of size 22992]
+sig          152924AF 2009-11-04  Sander Temme <sander@temme.net>
+sig          D3262722 2010-01-01  Jean-Frederic Clere (Apache signing key) <jfclere@apache.org>
+sig          3C7705CF 2009-12-13  David Fisher <dave2wave@comcast.net>
+sig          D84E41AE 2009-11-30  Nick Burch <nick@gagravarr.org>
+sig          D1F99590 2010-03-18  Josh Micich (Software engineer) <josh@gildedtree.com>
+sig          B55D9977 2010-01-26  William A. Rowe, Jr. <wrowe@rowe-clan.net>
+sig          3F0A04B6 2010-01-26  Geoff Greer (Work) <geoff@floobits.com>
+sig          5D7BBC5A 2010-01-26  Leif Hedstrom (CODE SIGNING KEY) <zwoop@apache.org>
+sig          1824BDC1 2010-08-26  Brett Porter (Release Signing Key) <brett@apache.org>
+sig          B1669287 2010-11-10  Kathey Marsden <kmarsden@apache.org>
+sig          6D5954FA 2010-11-04  Eric Covener <covener@apache.org>
+sig          F2F27A06 2010-12-30  Carsten Ziegeler (CODE SIGNING KEY) <cziegeler@apache.org>
+sig          0E371A09 2011-01-05  Sander Temme <Sander.Temme@thalesesec.com>
+sig 2        F2EFD0F0 2010-11-05  Christopher David Schultz (Christopher David Schultz) <chris@christopherschultz.net>
+sig 3     X  4336B448 2011-06-23  Scott Mustard <scott@mustard.net>
+sig          4E24517C 2011-11-10  Hyrum K. Wright (Personal) <hyrum@hyrumwright.org>
+sig          C4FC9A65 2011-11-10  Bernd Bohmann <bommel@apache.org>
+sig          1F49ECA5 2011-11-10  Ulrich StŠrk <uli@apache.org>
+sig          352ACF76 2011-11-10  Richard Keith Turner (CODE SIGNING KEY) <keith@deenlo.com>
+sig          B84508EC 2011-11-11  Bryan W. Call <bcall@apache.org>
+sig          F5CBAE6B 2011-11-12  Akitoshi Yoshida (CODE SIGNING KEY) <ay@apache.org>
+sig          34884E85 2011-11-25  Robin Hugh Johnson <robbat2@orbis-terrarum.net>
+sig          2A239C2C 2011-11-21  Christian Mueller (CODE SIGNING KEY) <cmueller@apache.org>
+sig          0208FC11 2011-11-14  Carlos Sanchez <carlos@apache.org>
+sig          088335A9 2011-11-24  Chris Darroch (CODE SIGNING KEY) <chrisd@apache.org>
+sig 2        41CEFDE0 2011-12-13  Stefan Fritsch <sf@sfritsch.de>
+sig 3        F51BB88A 2013-02-17  Sander Temme <sander@temme.net>
+sig 3        F51BB88A 2009-11-04  Sander Temme <sander@temme.net>
+uid                  Sander Temme <sctemme@apache.org>
+sig          152924AF 2009-11-04  Sander Temme <sander@temme.net>
+sig          D3262722 2010-01-01  Jean-Frederic Clere (Apache signing key) <jfclere@apache.org>
+sig          3C7705CF 2009-12-13  David Fisher <dave2wave@comcast.net>
+sig          D84E41AE 2009-11-30  Nick Burch <nick@gagravarr.org>
+sig          D1F99590 2010-03-18  Josh Micich (Software engineer) <josh@gildedtree.com>
+sig          B55D9977 2010-01-26  William A. Rowe, Jr. <wrowe@rowe-clan.net>
+sig          3F0A04B6 2010-01-26  Geoff Greer (Work) <geoff@floobits.com>
+sig          5D7BBC5A 2010-01-26  Leif Hedstrom (CODE SIGNING KEY) <zwoop@apache.org>
+sig          1824BDC1 2010-08-26  Brett Porter (Release Signing Key) <brett@apache.org>
+sig          B1669287 2010-11-10  Kathey Marsden <kmarsden@apache.org>
+sig          D01E0E18 2010-11-16  Jean-Sebastien Delfino <jsdelfino@apache.org>
+sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
+sig          6D5954FA 2010-11-04  Eric Covener <covener@apache.org>
+sig          F2F27A06 2010-12-30  Carsten Ziegeler (CODE SIGNING KEY) <cziegeler@apache.org>
+sig          4DCAA88F 2010-11-04  Thomas Dudziak (CODE SIGNING KEY) <tomdz@apache.org>
+sig          82A7FBCD 2010-11-04  Antoine Levy-Lambert (CODE SIGNING KEY) <antoine@apache.org>
+sig          7C408737 2010-11-04  Joseph Edward Bergmark (CODE SIGNING KEY) <bergmark@apache.org>
+sig          791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
+sig          0E371A09 2011-01-05  Sander Temme <Sander.Temme@thalesesec.com>
+sig 2        F2EFD0F0 2010-11-05  Christopher David Schultz (Christopher David Schultz) <chris@christopherschultz.net>
+sig 3     X  4336B448 2011-06-23  Scott Mustard <scott@mustard.net>
+sig          4E24517C 2011-11-10  Hyrum K. Wright (Personal) <hyrum@hyrumwright.org>
+sig          C4FC9A65 2011-11-10  Bernd Bohmann <bommel@apache.org>
+sig          1F49ECA5 2011-11-10  Ulrich StŠrk <uli@apache.org>
+sig          352ACF76 2011-11-10  Richard Keith Turner (CODE SIGNING KEY) <keith@deenlo.com>
+sig          B84508EC 2011-11-11  Bryan W. Call <bcall@apache.org>
+sig          F5CBAE6B 2011-11-12  Akitoshi Yoshida (CODE SIGNING KEY) <ay@apache.org>
+sig          2A239C2C 2011-11-21  Christian Mueller (CODE SIGNING KEY) <cmueller@apache.org>
+sig          0208FC11 2011-11-14  Carlos Sanchez <carlos@apache.org>
+sig          088335A9 2011-11-24  Chris Darroch (CODE SIGNING KEY) <chrisd@apache.org>
+sig          E1303A99 2011-12-02  Marshall I Schor (Code Signing Key 2) <schor@apache.org>
+sig 2        41CEFDE0 2011-12-13  Stefan Fritsch <sf@sfritsch.de>
+sig 3        F51BB88A 2013-02-17  Sander Temme <sander@temme.net>
+sig 3        F51BB88A 2009-11-04  Sander Temme <sander@temme.net>
+uid                  Sander Temme <sctemme@keysinthecloud.com>
+sig          6D5954FA 2010-11-04  Eric Covener <covener@apache.org>
+sig          F2F27A06 2010-12-30  Carsten Ziegeler (CODE SIGNING KEY) <cziegeler@apache.org>
+sig          4DCAA88F 2010-11-04  Thomas Dudziak (CODE SIGNING KEY) <tomdz@apache.org>
+sig          82A7FBCD 2010-11-04  Antoine Levy-Lambert (CODE SIGNING KEY) <antoine@apache.org>
+sig          7C408737 2010-11-04  Joseph Edward Bergmark (CODE SIGNING KEY) <bergmark@apache.org>
+sig          791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
+sig          D84E41AE 2010-11-04  Nick Burch <nick@gagravarr.org>
+sig          0E371A09 2011-01-05  Sander Temme <Sander.Temme@thalesesec.com>
+sig 2        F2EFD0F0 2010-11-05  Christopher David Schultz (Christopher David Schultz) <chris@christopherschultz.net>
+sig 3     X  4336B448 2011-06-23  Scott Mustard <scott@mustard.net>
+sig          4E24517C 2011-11-10  Hyrum K. Wright (Personal) <hyrum@hyrumwright.org>
+sig          C4FC9A65 2011-11-10  Bernd Bohmann <bommel@apache.org>
+sig          1F49ECA5 2011-11-10  Ulrich StŠrk <uli@apache.org>
+sig          352ACF76 2011-11-10  Richard Keith Turner (CODE SIGNING KEY) <keith@deenlo.com>
+sig          B84508EC 2011-11-11  Bryan W. Call <bcall@apache.org>
+sig          5D7BBC5A 2011-11-11  Leif Hedstrom (CODE SIGNING KEY) <zwoop@apache.org>
+sig          2A239C2C 2011-11-21  Christian Mueller (CODE SIGNING KEY) <cmueller@apache.org>
+sig          D3262722 2012-02-11  Jean-Frederic Clere (Apache signing key) <jfclere@apache.org>
+sig          0208FC11 2011-11-14  Carlos Sanchez <carlos@apache.org>
+sig          088335A9 2011-11-24  Chris Darroch (CODE SIGNING KEY) <chrisd@apache.org>
+sig 2        41CEFDE0 2011-12-13  Stefan Fritsch <sf@sfritsch.de>
+sig 3        F51BB88A 2013-02-17  Sander Temme <sander@temme.net>
+sig          D01E0E18 2010-11-16  Jean-Sebastien Delfino <jsdelfino@apache.org>
+sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
+sig 3        F51BB88A 2013-02-05  Sander Temme <sander@temme.net>
+sig 3        F51BB88A 2010-10-11  Sander Temme <sander@temme.net>
+sub   4096R/48BCACC6 2009-11-04 [expires: 2016-02-17]
+sig          F51BB88A 2013-02-17  Sander Temme <sander@temme.net>
+sub   4096R/632F5ABD 2012-06-18 [expires: 2016-02-17]
+sig          F51BB88A 2013-02-17  Sander Temme <sander@temme.net>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
+Comment: GPGTools - http://gpgtools.org
+
+mQINBErx+bIBEADFBcP1jJ1LFue4GUVlmDbqG6fbdE+jYG3ITo/EXLcGfjfOyR7D
+vkdXOXFJ1uzo7NHjleVuu5V+XKrsK1ZIFq07c9eGcqByOC9FOzAZFkC46iuoDM8w
+rhm5x4GeKTPqRfoZzSqoHe43Uqurw3KT2ltQraM0XDVdkqGjh9P6VVY2Yxz3afih
+syO1f2cmWSDnOGj0LmLUCgMa6YGswJh5eD6VvMNGI1NnluD7PCrsgKOp2CUOE+9R
+kzy0IbbY6Xc3hO29EHBYAES0H9e09rCASlQpkqNkZ0eA1YdmFv8oGWpZnPb19X3z
+y4hrbz616toOruKINMb8U07Y66d8xnj0wHbmjdLoZREJb3GnLIyKOHvsMwJueCWB
++t6aILtGIFHFvvvP7IooVBI7jfLPhjPSPGHeQQf2K9w2X4xYMs+fhedFZMa1LYjm
+mb64TVNvjB5AG02S1yaRWz73kRJ/vhNnKOZbUab+bYlzkb9ae+rCYg8YTif1CKSX
+03PuTs/ccJtmZFfj6xNIcooKs1YY4BvWhFMrjtuAOcXlSmgbooV55sJKbWTPmdLX
+5jZrhs620II6fZ8wNBmb0+97IxC9SzRh+cfe1JPM6W1extE8j+HXnXovsk5FHKhi
+BQwLiLE/BZIDvSOj1cggqVvoWaoKiwbNNbGGm9HO5g/+ysonTg84SDs6lQARAQAB
+tB9TYW5kZXIgVGVtbWUgPHNhbmRlckB0ZW1tZS5uZXQ+iEYEEBECAAYFAkrx/JkA
+CgkQsr68QBUpJK+7/gCgp9v0Jbz4vP0GKZcNPhqJs7MuP0wAni/6duAbG+RPP/2e
+rBXBuDpq1qgiiQIcBBABAgAGBQJLPcnoAAoJEO04c/XTJici+H8QAKt02h69emh6
+ILw95dehF9oCggNwrl2W4JS8vwMNe9v0edroDCknPYtK+5UsikW3d7vGBuHGVFKD
+UDyWxvmT1v5CcJQHGoGLNzQzc3nplPHbFbYdzuxkmJ4aVBeX6WqQ9y6c4e6uQB0t
+APzNvdGW6Oajg/sunMJKeO+m9IROq0alK3DFw9ilVJVpHXmfK29MIj+j+KTOO/CM
+nGrfl50mzRV62qhzV/Kud50qpZSvI3rBP9p1oz9/DAbpsbC2/Zh31+FEXblrE7J5
+TxBedJJqCyDf9pvFi+Xqx2vivxpgx79SjotDx02o+GFka1UWSdKQNg0Vo5vXV486
+o+yTwgZyI89FwvuRaBwEcfA++tTcDbrpaiFd1sABvZuWwDhBt2Oe1uTaUg+0m5He
+20+snyk5nrH7+5cF0r3ocHxsALCNLh+51K+0NIyPLF3VcrYMSaPEdHGbYcAEaDiy
+J0EUR8jj9h/TEF+Yf2Czo5sOLV8+C/CEaHpuj4JCzOilHGGEjGUmeaiagQs6Oj+1
+KcY4ILYnM0MaGqa2p64pTasUDYnCMySZKihdqTTwYLmmCMlSdTiS9kFx9qhUoscb
+Z66FameAzqyfUDezjpExkB4TQLk4eeUPnDnhH9gkXXVBPBJbiBlUW+1ljscCVINS
+kx3Ozmtl2uqn65zPCq0BxzA/c9cJcboJiQIcBBABCgAGBQJLJUYvAAoJEDF8bfg8
+dwXPtUQP/2+nqnjP9eQqI90eCUgDF11nSzPhq/3kGBEgdELRNOkhwr8qfnt+dCA8
+2zayHFy2fdwhpCeqO8Xrz6ByBgmolDKuZm6BZvEEBvQjae8nTU6ZWfR19iYUIFA3
+1oXLR+a2soTr0bYF2JSn80gyfALjbqStkR5abHmrbMtAXKdoG6DTBkIVBpjpODN7
+qLVrTi37zxVzqDdBMm2gAZUczsELB+Tf+2dCHIukIFNZrG4B6ttQrv4J3qPfp7A2
+yqYNXMYQwNK4RZ69uzDFKHLzIoJrBDkABU/JibSr6/+1Lp+CzUqYU0EGAiyhdOdO
+1LK1WsyI0Q7BOXNFU2XEijtfFjcHeDoiehKB+5U44meWf/ShTz7XnBUTvhfWrDT2
+L8G0F9XOSU6L/Yu0KxNiaUHX8GCTBuHERj/iiGX4REL1QAdzdJVygeBJHHOJubqC
+8DwKo9mQFfox9jJPDwlcHUix8qf4PCB+RhbrykGLZR7FWJhDEMFC3MXlkZLOqisj
+rfU+tGdDvz6uvHa3zwrYzN7u3q6ontDRkckTNxYCI5TsYazqNwQnsBgd1eZY0Veo
+etjfN3cdGR3sGtLICvHWjm2rqV6586Z3LTLOo0+zPKcV0QXMdo1UPgLHuSwycCLr
+vH9ogos6w+RZKQ/2Zn+PNadik4AlGsJn5NAzeYbLLAfvSr7YjiwqiQQcBBABCAAG
+BQJLFDXNAAoJEIqviNbYTkGuE/0f/0vnfSfYJE5URq0UR7zGmZuY6MQDEe5nHdrT
+j+5tWeatSQTOI8lNHlkUPSRuRv4caN6fBZw5mM7xbUhz6u0tqbO26euazAQVp2fC
+NQcBPWbEHLoxJF0ZkEDctVtYoshajtr9tdFxv/4p6HIsfIf0l4aoQBsdS8jxxJOS
+kN1ZrtYyBMz732OxvScwgd/rKphMLu65iT8YiQyPEVBd9glDVlASa10QOhQyyTcJ
+mfdkGzbYxAI8u5qFDhtWVPP1wSbJ53DGPjkmtG4J57bJtaxcz019bVK9LoY8Jemi
+J0t5Tu5GJZBLxO/0wfGAdb7c0ggws4yIwqARnKxLKJC4dbUVQlE34W9Ql59s3drJ
+uy6inOLr92D4iyKwuMkWvJtmrhwTgUcEam4giXsOGYQIWyHGheTHdwVN7XJfjUgd
+dCVvdjc5tJvA6zrXNhVm1SZM63SwvZ27zY8SgJz3nl89hT+iEaLE9Fp7+YqzdOXf
+kfm5Vp/y2y1qNNJ8nFn9gSHMBidHDwN/B1lGn5KBc3p34Iw047q+o+qi4YOV4VEq
+fHzwOTXD9vADvllRM1y19i22fUj0ke5tT6OX9djHfqzFQvUo0XAHXEL54lvAqoMQ
+11JYreYMKULtI4wE+CGqte4G2Bw1yCzyD5m6FIUlBFwcmJhnhkdjDr/dzOBaFtzG
+27zsd6GlQoPfDCjuE7/3/5nolpRzxrOWzBP0O4AiGOPnnmcRJtmDdDgx/QOuX5t5
+kazagZPkiUr0BFODjskJdFF5ojTx2n2cw3WsaU/55dQxSYVR3LKHLPI6Cu/CmAIV
+7mAJPe2pzJvWsH4xjuaFUTRBsBvBuRxsKeoVCc5RvEizqZS4x2SdziKGZi/SgILH
+GuYDwVRbZJRs7cYNkeQFeqZegj9SzkgITJsWa5ZgoCKZasSW6t+Z9i0fFZWPYzsa
+NdwcH12wPS5ZN4ToVwcjkfMv24zrE6Y/SPHLYYeDvNzbIjbCSxmarYlbwX36mEpZ
+CfwaGWCQ14hDKKgiRuICgsOMWJMeocZHQZnTN6EBv4b8TqHHh4Ux1HOnkC1B5V/5
+MjVsyWvqxRq7i74bk9sm6ZfvqFNHmm0jc/t50x4so5CHqD8KUXmDRf9myFj27tWl
+Br59qdnftjk3bXBtplmWagkOrG9SE/eqb40BzqkBxFirCByFnGTkdvhxZTtbJTWd
+7KBR/f+SEij1P+CTf8iXzj1aDGzYS1O65D9OJRt3YNLLxZWD4sI+Y4ggF1ZbKQYf
+/3NMfWrJvc6Q7HDTPr6D/C5VSb2D0ycZx9ZEbbMiLYYhAbF5di0Mg1d8LY8NlZvo
+nkDd0PrwMjJKUGdlG/IXm+yUOs7ugTxssf/Rml7+Jlpa+Rbju2OIRgQQEQIABgUC
+S6J7ZwAKCRCGC77m0fmVkKppAJ9ZetTyKSx0sBhWwccZAAmRrS8hSgCgqyFAGP/v
+B2RpQA9XtWaYdcc166WJAhwEEAECAAYFAktfZQQACgkQGT8YCrVdmXdQCg//VL7e
+PcPmYCOCu+Zka9xeFZzgV/l0/grgC36IuicZVCa93lj3gmtvTnbm3Fh83avsB5tZ
+DnWujFu3SfqqqRz1VWSwcGdobpQooL+LH9p6jXNkQLVfWKI4giNLzPCP7imWpjy3
+v3x5cRAKGQ9xuTARqTvG5ZZBaeoBOP4bVsZ3CS2LnvfZLq5z4/D3wSLGKsBvsJcX
+b8eoxkqpWVFlIl5LCziA7Eqs7hKNSKhryyvbfjVYROOyNOqhKQJlyg2Z2hfVdn8g
+EGJ5e9qL9vSNJA46GIpnx7hf/1WXdVyohkAWbKIJdjUDfy6/c+hAovKwONacY92u
+7Ly4TyyZHOj4D4wF2q3LJCGAXhp6DlOW8qDSfOUOszT4MAR2l2HyUniP+p21yc84
+cC2OMyFGtLPeInlO6xt2rXFlsfLqv9sdG2Bx+yS2qVa1+KSCmMvnLGPI3u9jT46/
+UtjrnV+HfdH5BiFzfSMLnILTgUAlsg/XeyaZtQt2BAnAZLASD7G8yawoW7elIOFD
+kWoSpA3S8Nu0QZt8VaeXsHW59W+1myojN2FPab2NiGlfCiWtWCtjH/ihYcIrkCLf
+14WLOaTCz7rSxKlMMwZXvwHXBHr+tGDHkmqLJwYtsS/IEUYqw4M6lU3dSMXBu02o
+Yzfx0bWntoTsjgFlcFU9OPhNFceyhvnGqKl7eEyJAhwEEAECAAYFAktfdS4ACgkQ
+VWu/8D8KBLYvihAAru3HWQkjUn0XZzsR9fOFU9Zq3OMdq5NyCnSrtVQPLhhJV9Bl
+euoMk8Y1zsyHljQ4OClWUXV6bFso+a13BmeieRvh0GhRBKY8HldaBaFsIuooPyap
+NOSwoBVsdXREXpecTIhfVgR42rms+GJNvmCDbQnbFLAH5UvR+jLLMoDzEJkCSf+d
+S63FkItHNzbuAsdf76Ggtk9el9N0bFBSt4fKPr8l6sA1PhyPbHiSL30Lie5Lga0P
+Si51YBJPZbH/0Br55Z3pzq5vqTam8RtLl/zN02mD9vSu7Vm1Wi7mYwqgFbTlYG/5
+t1YASu7ovHDui4I503f2+yTkGYcps+DXnLUfceBwUy1u7NgPuOoiotYQKwx6zLJO
+QuDX5upj/ZdQJ6xim6f5g7wOwikEnGFAh7Z0W/q2/lVxwXqQf7xqQLUkDym3Aje9
+519rEmm3/2vM23E9ZkDwVMZjM4U9619y64YwigjEteQ9cvyXXmkL19x3Alxzurwj
+CJnhM3FnFF2ISzsWbVFvbfP7DE8QVzjiflsUD3IqhIyBBtaRQRL5p7fOrRUGnKM0
+/dmUbSPj1Hb95yB1mDBdwP0T/pXaDxD89D1pxSaPpQAHnvpQoCICQT241SCh+60i
+g2GFQXcXdKa+Tdd9ggKeh8i0tffTt69FRZQ5eorS4MOVUaEgTWzPhBkvk0CJAhwE
+EAEKAAYFAktfZUwACgkQUz3vFV17vFpDtw/+P3CRrcBDZs/VHYPrs70dkUp7KC/C
+GKOD0jLOe455FUpk6LQTwH9rwtk+2F8gfY+i5j9+aHqj1U19p5kpU6sOnv0UXUhg
+YgX+rbIj8eSPPhTnj9pP43W8tfdt1bhT655t5VXGdzElNuV0SPLSl6WkREH3GsIZ
+YQSVSOqfcbj15+eWZWD6VdOkvCxOVvGGCbx3JDx9yVgCWpwp0zcO0EeyJYTCcOJg
+7Phpcekt+ek6S65vUYVt78ggdLXmrfiMIOCzc7BtECmHHBpUNlCLMSD9Ms68sbUt
+miHysFQbo4YHLHw97B3qvU4xGhn0lFOrBQBOjv3NXcbGGjvjqWHhtWVq8Fzv5RCm
+UkGz/qosxAgWD1rVGdOUIFX5m8IFAy77/C+OI2gdUebzsxcvAJpfWrl7fMVu0aim
+Q7kT8w2IQsSPw0Y1Uz0vtWQyZQDyEK2YMBqWuuVGA0d+DWa9DRKEDbUTFfnzoejh
+ep+5hIj76fIyDfF3h2SRTfFrsu1luZAyIsuxsryuH5xPH7mxlnNbSStHe9JUTFm5
+DG92Ls62jnxcxVwL3gFPr7jjCazz7sI1sd50OY/TydXflwn6qLy+TT3WODTjfzEi
+vzyqutiEtJDJtXZd7XHztpK1/2I+mLBaHGB5jHg+SV2zilRix1Ud35RTs+HL6J5r
+/0p9bamIRQm5HsuJAhwEEAEKAAYFAkx2khwACgkQ4TYIihgkvcFD1A/9FYpfwTQX
+gFjolMgWbfYCUsp//8CRX1P8r4ttw7u8kkEe4IYpObasVoZzaJZD+89n6/1Kx4uB
+ozPhwmoEYsBAsLtTKMEt0T0U7/ZDD4c4ZhNYVSTbQawn/pcf4jSy919tzMeqHfrM
+0IFwARK24C02BOrRzboiJU+1pXGaL8ivbEv66IC/aNC5B5lqN20bX/imXaj4KKiO
+i9Z8NnWHH+5UTGVIX+f8y1ADkGzs8SxkLl4Bc4AJUa0yDKoy2OpYc+0KOYRjTfdy
+YhcVfdQbd6xDujArpzBnDP1nzHAXdUae+sMr8X0sUEo+8Izoku4Dj/J2SyqQ1tt2
+I40z6cfgOsn36bQUdouBEPm5PL/92sCI95O4ZB8LUJxKySI+AHgxqm4WMMy6FZ3x
+HOyH84+cc340CRNPMUcr85eTrCPnbafId8W4/P7RWHNJRtItmO3tZC82OgujqLd9
+Z5VbsAGgK7E4Q7JaM1bRoCw8C+gSpkSUoVyVWzs1e4FO9UMkJUE4ExOQ3ZEQhybp
+X/fSSrjX5Lz54MUCWKS6ADiQ9PgmmARtGWxIcnkHnAEQy0Ref8EfMtvqsgTnu9gI
+dOObLMPn0a434kppMPK7JCUG5R6xc95sUexyZGDTDSynJYhGwmWX10iWz7jrdpup
+k1LipcVzSi5LmE/efcGJFo4UfeOcfh+wD+2IRgQQEQIABgUCTNsu6wAKCRAbSHfp
+sWaSh8siAJ91oX1vi7kLBJ98UWMKbVKSJL5CbgCcD380dJQuYlUYmtBcVAZNKhh/
+1emIdQQQEQIANQUCTOJSoi4cSmVhbi1TZWJhc3RpZW4gRGVsZmlubyA8anNkZWxm
+aW5vQGFwYWNoZS5vcmc+AAoJEKR9Hi3QHg4YANYAoJjhPnn2X9aUeepb6HzKkP2R
+EJTOAJwMqNSRlUdSQUBfUC93xCAS6sUJFYjKBBARAgCKBQJM0rRDHxxKaW0gSmFn
+aWVsc2tpIDxqaW1AYXBhY2hlLm9yZz4gHEppbSBKYWdpZWxza2kgPGppbUBqYWd1
+TkVULmNvbT4fHEppbSBKYWdpZWxza2kgPGppbUBqaW1qYWcuY29tPiIcSmltIEph
+Z2llbHNraSA8amltakBjb3ZhbGVudC5uZXQ+AAoJEIs6YB8IyXXlWaQAn1tiQjM4
+MyZA2v4GlT2Te9p05dSTAKCRpuwROcbdZlTLygOhH9j0/1lXXYkCHAQQAQoABgUC
+TNK09wAKCRCCeB3kbVlU+gW/D/9Utj7lCI9FR3vViba7MUi3QrP+mIIm9lIS6bR1
+HuhYT8XUDB4QSgPvSsvjz5Z9Iv1w0nAjFJsWUSyLPCuPCpD+v69yUTHhI8r7Td4h
+62DcFPW4OcUzhtLjO8lngxRcFOtnJGHsrDwOFCUsPi/S/8yixxBnIyFmCya3O7k+
+GIVk3J1ULeFxl/6LuVOFnFsoqRdIlQF6H/LhZFqTR8ZvdeUISpZ0jVIwqBW8aHaf
+VLDtup9UeIK2mHALxGmlT+yt5bH9xHSaLi0hT7HKig1P7AiELZplJy+e5DiosLmc
+4ajiIhCs1C+AZPU8LY3trFATpf6vStMnNOOcbRFEaTZpGNWTmHIDtdXOGGPzD/6i
+u0klzQk1UCzxQfGpdsMfR0UAkQfaKcQ0pfG8JKs1zpw2PMtx7u4qjzlraiEem0/g
+YJ2lbuYZ5gJ1VFN2PnTjQae/vmxDpX1nZDluuvPRFZNt/eGBrOOOSSwTQW8z4Qqb
+vtrKyUBK7T9OUkVMxnDi6YQZB0srGIloVYQ75I5dphJOesA4gHRDGyoqFMB9j+4E
+1DrdpEwfmj6cgcf1MNU2b5kLPJQXitydBXKO/FIg5gHvayUV06pn4TVcewMSIU/X
+c+HOjnhX4vP4BpYOSU4bJz4c9XOssnePF2qCzRGZCUCdPRIMy/+7MpABD44Owg2n
+fYifb4kCHAQQAQoABgUCTRxM4AAKCRA/z1Kf8vJ6BhXHD/4zDnnROmQOakmNbUvQ
+rcD+ZLiE/4bXrVyiG6d/BrFkng+wpUZaWPDZMEtTY1xpm2XBkqv+LX4QGwJt/m3X
+279nRauba3rkcn6qo/2352ESfEpF0QG6NzT6GlhCdUSl5kuw2nIX4QqloeuG20co
+R8ffU/nzfnxv5+Edd7NVpuxjJ73kk5r9RWo1yz8l1HTnAruezga8LFwGsJpJB1KJ
+Jp224LWcmnP5Fibt9/e124KldY8yNXgVKdNML9ejElEeAJ2PsSn+el5LfXC/k7cs
+J19/EcIuw2rfYfYphJnz7pPuDqbw2XxII6KLy+JpXNalc1xsDbcq3aqI6Wbtbz+5
+zjJaZ1sXEj+Uky8bc+HogscJYiOAzjkXKpWab4njRSHxCL7pG10Om2oNZuRDNs4P
+StOhbreVHUW6VSlCl95embICTRWfEQ2d3NX73DxhVZVsEiGhwPdb9BA1Sy994QKi
+8KB5SB7jgv+M5UY70Phtdoblrnq4iGaEFvVw4p9szfWdkghCw8rI7HHMkKeU3Uzp
+QWs3niPk61WGseWFjJGrs184dAOTmzWEthPu0hfyaMYE9Pe4gr58jG7GlH7q41kv
+EBczVyS04wPQapFHCVYFhhLfdF4TM0dmW2/PYD4MULse+5ko5ZMjQYWXxEcS6KiV
+Vwtv6RywMOKzGQQb+yK6TycILokCUgQQAQIAPAUCTNLNqTUcVGhvbWFzIER1ZHpp
+YWsgKENPREUgU0lHTklORyBLRVkpIDx0b21kekBhcGFjaGUub3JnPgAKCRDqTcrc
+Tcqoj+ksD/97lFmqIfbJKNxGSACbAoR/CmKLEy8bHLWpPcm0e95PDKC8byDDab6M
+cADwsECHZaKgHizynRn1OcmBSHVrcA8eHwwBHqxV71Ocu5M6IhQ2nU1aW7V2+d02
+8XiKich++KUDqtzighIjvOYTBtuFAl33vdggAY1PEl57UsPWy8PxNjJW0i1VMaGb
+oOw1lnoCgxN99VkuaKrEefL2p9xUp+yBZItEKJEuSpQkbNp8ANkHAhbjJrmA5shY
+IDTlsVqGADMt44cw0ugiQtqDwWjo/bXwZzoFWcC9a8Z55bj4w+atrPzCUsOuKpqH
+q0DU5+SnvTHLzXoreKfdRq+uNvfczRjx1AZlft1hmr0m0Y0yw+oktNRLbZzXUAJC
+5P+PDkKOmb82r0dFtF9uea2kX1gsCEP55dUnKk1Ego/gm68vlxLP1VnaLPRgLpKP
+W/mUsnuTY/7tmGzj2XUhAqwJWVv5rhS5/UaqucgH9nXnaZIrvLS9SWu3LzZ5SLXK
+Pw1ir9YZC1pTPrtd6nXPnJEffNbuhKH8/3A3UIt3NVEN9oBxmJiof9jRBWKyf1DS
+U13aP/wGmCCOiU7gN1I+BLMM3ZqP0WF0Mb6Y4mR6cAFHY+Ug/UjLX21okPE6djKG
+1B7UeGSUwJGcof6PU67dxaJfUmk47+DIQoOb8aP2whFZ197D7CitG4kCWgQQAQIA
+RAUCTNK42j0cQW50b2luZSBMZXZ5LUxhbWJlcnQgKENPREUgU0lHTklORyBLRVkp
+IDxhbnRvaW5lQGFwYWNoZS5vcmc+AAoJEF762f6Cp/vNNX4QANyh0StE9iY6zxHO
+B2/fkK93itUVxQx5VsZ7/FkWs1Um01gRaDJ3so2VYtGJoH6wFGKy29VWj2zNLhDv
+7VUUnosBuasnZXgcjXCW6OgEg+t/fnuNXAHXLEIaqZsZwYgx80rJEMIAW2NEhxyd
+zAj3m1gOf5urOqPpyDKcyB1VA3AVKa/08K6aS2Aa2xIZqt0ghGj3NVPBgRhkB+MH
+XmZypmbhRVZZn6bWXs0lhYdmBruljW2u5fgHJIS7Jdl5yvz3DaF9MizzaHvYBDWC
+3w1hbdE95cTWhPp8dRsp0sbJAzPHf3BgkaAP08e/v4txUmqlSw4JfxFecWt0JV64
+qT2tKotVQrqIeMOgimPJ9ovhfqOlAKBvzJCBZ6T8d9bcs/xThqCSMPaQCh+PiN9T
+7/h8xxfG7+gfGP5fwOOCEOVkKFi+9xMXye1vx4A2qWh1ScALs92GvhMwy1PYoLfj
+fsEgeYvRGtAX2TMKkyOsHQMqDGOdRxb6yFeBMZPQD6SQaNHOt6l2gIqstnTy9Vk+
+I9MUT3ynmSX/rkF7YVdPkDJP6kUAsxI3rACZrZz8gN0SIH8/3+WaT39+OQXVLleP
+/BbkKBtxnopi5De72CTG1ocwJZz00ZvZdi1/DvElLs7ia/5IyNEviCw7m2EQdvLS
+Szl2/Py3pYz1/rfmQkC39FOQ1neOiQJdBBABAgBHBQJM0tGrQBxKb3NlcGggRWR3
+YXJkIEJlcmdtYXJrIChDT0RFIFNJR05JTkcgS0VZKSA8YmVyZ21hcmtAYXBhY2hl
+Lm9yZz4ACgkQsNmRtHxAhzdp/hAAtF/zQVGiDrcSQuuYGU7Ez01J2Xk/9LSZ819Q
+3jsWopdQYzxGCmK+V8plEkGLIcM/jsK+NLAhZVzt7qg64vy3MTQ7anvjYx+1+mX1
+Z0p/g/r5IXXQ73Deg0RPPEtScM7ZanFlBUTniMEkZPt8qo5CZw23MeP2E4fl3UzH
+y1vt0CyB1dOJjsy9XPXLX258ON9IBnjS5s99fKqnCs2k0VFyNkOlsIdWzsvFCoQl
+7URnEEUI4OrrvftxQHouql3x2SxE9K7pIHZewg631W+UXuH72BC02kIXrHixu7yQ
+IE84fLzaptZJWZ9Xgoigk12L40ygMQbc4zbRfoVYGymn/jdZ6W/4TG9ksq8FHFi5
+eZNg+hv8YwFabfYH9cshjh1+ldUbHKE1YbY5TpXQ9wNZOu0XHMsvo/pijcptUiC8
+yvmeP1Ky7dyJb7PkoOcQ3cjf31wGiGP0cgDhw1FbS14g2OI+fng7Ns+9LLOZ34/Q
+ryK+hBLppEdAnLgAvIZzyuydK6KbdIPEzotffoJJ8PfEPoYa7ZHZZq3fJTno+DO8
+mhEi9V2jHkpDZDTNUkRYEIevSnfD8F/44bjvZHUy63T9Hrr+DTjqG2ucCDZeAkaM
+ue/NRXev53RIJ8AHLTUG2dbfb+GHfC/OkkwFe64ZO0is/SucfzHqQArAUB5mo5B+
+RC0o9huJApMEEAECAH0FAkzStCk1HEppbSBKYWdpZWxza2kgKFJlbGVhc2UgU2ln
+bmluZyBLZXkpIDxqaW1AYXBhY2hlLm9yZz4gHEppbSBKYWdpZWxza2kgPGppbUBq
+YWd1TkVULmNvbT4fHEppbSBKYWdpZWxza2kgPGppbUBqaW1qYWcuY29tPgAKCRA0
+6nbmeRSFqOljEAC+JPGA6EtNP7fhaBEuLL2dhgTs4vPGvWivygw4WKR4ONGVEMBC
+QQCxafRxXdUQEjvRTxxdnI/2S7VpGvQlEjSAPkVcwuX+lwxPYb/7L8D78a11AtAx
+nxN16QsDBG7s4m+aBBfjn+keQ1lIdScVqU20ZB4y0qrJb5Zv2hfaDUlg+99VS08V
+ohymSFPEFzUWDufyCC/nJbPnrKZppbBHZmJT6WZm8y0i+oC65ZbRCxaMV8FVRhcm
+iafXeZoC/SURf4YSX5tgI8++/Ydwzxp2wxI1NCxKzsG7sERjLmtoXi9lrDLlWJnh
+bO5Yid6/7EXqzHjcWmUqag6jldJVQRjUR8G7Coj5zUjuEUZRlTM8tllrWLLSamuK
+hyk1q+UB5gDTIqGDpFxj/SvdKeScL0fzsCmnroaLMXtd+QCBHmEk2umA9hb2N3bc
+q2Ht9+zZ5av1RHkNdT0L7l3TiFgyP8cx/qw5of/ZTQzcvD+Nsl3ijShyvihNHstP
+YDeANCcHdRlnmH6fusZGGV9t3H8O1kGIGi2R4Pw6pUDPuO1BHfA11Ld2uCuVbJwC
++2aG8tl8v7XzSovCrn6cZW5oPxnT724UMZ1ms2ECMu0Re+4T/q5r1N93vmqHj2AN
+Am/Kh0l4xBlO/W4lpVqmZUOsdup5mKQMLQWEgxBYLNgEqimt1u0kP1qmn4hGBBAR
+AgAGBQJNJK0WAAoJEH4q/cwONxoJUOEAoI9DIpUl7gHypVqz0P+tyWxVCrioAJ0e
+WiOrsUygqDUpDl2Nt050piF1LIhGBBIRAgAGBQJM1CP3AAoJEPQmjufy79DwdTQA
+nj0qTVNFNlZowBK9Kd1N00InXD1aAJ9kJylYaybYhPt23ACM6kusl8lSAIkCIgQT
+AQIADAUCTgOM3wWDApIJwAAKCRCMleyeQza0SCGLD/46iT/p9bOgVqY0qvmLztka
+jJsnQt58C9H1iQsNHR/dO9geiDtwBPYI3CqkuesZBVJkH3m+wK2eXILd47tvnq+V
+46utdYMqiZteW1zkKGjKrx6waZvH+WnEKeFMioRBy1FVWRPlVoAPPjyMy+LHP6O3
+hW1As1o98EUO2OeUVm2wB6q0x/CoIBhB3B04Oi3SPB0GHXeS3spWNZ2L2t6wlbVp
+W4OmNZ+iO0dgGmbxH7rjAhjBwRfzaem80sPH6hcyZas6S0MDW7TM9gL1Q28NQT/y
+TZ/yIGRTbus2pIsd3oFtAZgZSLggkQKHMj8RiCtstEXHJ+zBi5fFaF/fJ7+H9piD
+KzeRnPgtzF1uhZBLJk1+LxS1oJpFQziUE1BhjJz+Yo8c1YssrY/6PXXWn2f/FkR6
+4yQ6Idz1bM+oOwQLz236aI4lM5hHTqg4LW1dE7DHO4M6oQC08IArZaOYcJysSWMJ
+RiqkGOMU2SGorMP8toOMyFIA/AtJXuL1sPeCJsNQRdYvjqK9E/5hp876Go8TmwRk
+q13atCN6Lq5Mztp1X6wEgCTaEKjZWZiMEMjMHsltLTxpFrg1Nud+TqqvP/jLTIIV
+MELxQptX1XNx+x4wFB5RfgRI1eSKoFxiqDrdfIoXA33/cAMR92H/TLn+DKrqV+jL
+h6LWgGRLIHlu81YVDtdSLIhGBBARAgAGBQJOvCRSAAoJEAsDrm5OJFF8ZbAAnijm
+8R9IBFruKm6dgtAtNeb1zl6SAKCmy53zCniulyKX0CB9xdLcxnRBMIhGBBARAgAG
+BQJOvCmzAAoJEKvWMuzE/JplVHgAni1gnNV+TXRf1Hgbd5jljJ/pl+sAAJ9jScDd
+4xk3PyFh6u3M7yevfL47N4hGBBARAgAGBQJOvE7tAAoJEC8+XTEfSeylrQMAoKwR
+cQeCGc89oDGga6l/fMmvHar1AKCNhI3x+P3v9DQsIfV8fiRoVIFPy4kCGwQQAQIA
+BgUCTr5o3wAKCRD7Yz3o9cuua4/0D/iTDQFDtOwSW4ICZn3vbmbJVbyvHkqPxany
+6XoUpfsMrwoQnwLCwDYpmYDvPCpORPHOEoWh/rkMyFOdTpntxsGxboi8qgK0hSej
+pVFFyhtVLagmSImbFiZeK0BghhE5+3/ijmv4NBeoBdL4Mww+6+DVMMjAGHM498ev
+m2+nsX0f8YHVxhxFdoLpIa65+KtZ34Is1giL09E9fz085VaJEIjXV9RzgMeAexH4
+VXFkDlJ1tgHZujXbaAiJtV+k/JH3J6l2rGsLQKotb+xxAOdVX6b0xkO6YFsEvAQM
+5zwfdL5eZ4Nm7Krog+wIlWVc1Ofv365S9Qkq3pk75xAAB/lTWzVdrxCTLvOxW5eq
+VCu9z7I+yzs2ykGWZuTV2QozWRREyQsBR5A8SbNJRs4ShyKtrD7yGkk3cKhtcghM
+8Oe4VjhAR7hzrKaTmwASF+Z8w9tQGCqXX7jtDF1rrzxJTR9AkYAorjN0vdmtXo2G
+SNCQJs+Q9sai43TqJODXTSFIMQ0ia0D06Bgs0SmIjk5VhmgsAQ3i8KM270tnBcis
+YUwbHFDNzc+vAc/pRzkoYyn6T8iCNZq/wEHwukueFawO+/HxgmnWpVKcEKMIkt5S
+qlCoOwFsoEo4IZuJeLj0B4rT13CGBylgHj+JwFpEvmNDR4NfJjurRTiM+5Y+sKDg
+4t0tOTBYiQIcBBABAgAGBQJOvF9aAAoJEJqs+1Y1Ks92jmcP/2Vt8wxbMi3Ke0yR
+3l2UK6ExTiePVmbDfny8nqv7Q1TeFhDyHkyc4RhB2u2tKjqq2ZnEKp7tSXFW7icV
+Gjpsz4ZuEzYEAD6tAUP3kQHUmzQ0ZJlqBzsqk3pajTYML+krpv6ghP9arLRGowcm
+Wbsi1+Op6BJZIfTXWqTcIRtQ7VBTXRkFH0ori7tfh7KhiQFLRVOXbIg0koxwrFq7
+j15gT86qvIp4tEJ1POZfPY+XVrcQNBj1gtIEt/iBdhw2p+qH2f5pb6S/sSWn1vK2
+k1SUwqS5GnkWh4jPEgTXMxt5gPx5je6DU289oYNzXgN7DMSyFLtkFe1dCsS0WtHy
+4I69HS28R5kVYIMOnT1Iq7ef9VcdGgVEyWe+46E2O/iXl3jKJfvOJ3vh+lmYpwrK
+eWXeryiirVTPPY9O1vzNfLEfgAklZvTQZ3ypvVulJny/jKkZgJd4uxPj3uNcPwwB
+9AwH/HY06Z3BaC77/IuhFqQOvS/a1lwfXi0WpwEO17MzcOV+tZ2AGQ/lTelGBM2b
+YCBzFDD2PXhDEYhN537hjM+tVYtfdLcZih0Up4Nq13CsMlQjNDu099zaX5Y5j5os
+RPS49TzGHRzbB9e94I1viX65Cm/Wosx9dAcz71T0cFFwNkbH9XSqTPnuD0cZ7EQo
+0dD6CGxu0QmhGH8FSmja7KNf/kmliQIcBBABAgAGBQJOvVKJAAoJEE0VQRC4RQjs
+WbkQAIWh3uAccrqd3pRySW8JJNRSiXQre/OPvgukM/mc46DB9rgdndILZkeiGDdz
+M1Mc7LEB/yCyLFzZstpaVQgq9sLy8bMqkJyIx+a7eOgu8LjV2pRYQtGgAZQqmDgF
+Op9ZRsF4fcdUwRLfl8ZSju3w4s/3mkuPQpGPD1ZbL1ixyOhEp3qUvdOUIrHBBtWe
+Tedv/XhRTBzdd8KOImcnyqHNMdb7U7JSWSdF+CWq9uvU5LREaJNvV27+dtJzEGXT
+d1/SpPDhNR+9AYsy8Y3VhAQLZFB449fnTvmtqANcXM2PBGOm6jN20olDDswthg7n
+duK1kfJ7TROmMApAFR7+k/zqOmD2dh0pJGg0wWICW0Q9y4a49ffP9hTiNPCUCEBZ
+pDN87GmE3BkmTy3bVKeKNfyT7wLhAneGKFlJwVX4f1eF+V3n5iGow+Vu5XqjxffN
+HErbVykamVff80BSez3N91v1woUd3ky6pZP/pSY9FFA3XGgutfXGRNYKcMxq5evY
+UhPbaEsz4ozdD1VjITP9XcgZF5+K7rT2M15fMVOlN0dQaBASKSJjpy8gq5lNVyYu
+kCd4Q2a64KklGiDKISEKquijVg4mMmx5JMYKLjoQj7g0FkKAC+cwn6LRCdnhqFiB
+/f3+fZi7VvZxY/Hia8xzeD3ak5Hs+4Inj3CReZrfCxmKDlSiiQIcBBABAgAGBQJO
+yst+AAoJEImh9lEqI5wsaK4QAMBTfRkRKOryFif/5XBkPDYeMW6UHLwratUZDfHp
+CZXPGklGJwdz/H44WgNkklmuxmI1DRFkTQf4LzEaxGOnzLtBVDG93WLPOZvQfuVi
+7wg4J0HzybQwqwjWWMOSEdN100rdvoC2AFot6VdbxrQT30ZwK0qqd53h5GLDA326
+QTOXGRhi4Si0FgNkQq1++V890Yp03kXPFOiN6HiD/s40NkKUzfYD1OvYYK0/R9qD
+55arUx1nuRerEp24zTNOjT+33gDrGrCd6l/ieDMkgRCdh7G0LN+gHcjUN8f56/oW
+TfPHzeNI1RA4hqGn1YzSUXgZglO4P5RRMobs/FdbVLFIu8nFMDkDQB9wIHc1xPGr
+6cj5K4uSYrgvhXYDDGutA0GSuEvU7M3T7bwMEAIdql+oyYswlbbhyI6RIvIJx2PW
+GqboBVagx4wqvWCjJjZBDPmQG+pTpSGtwLz+HvLHZ2JczpKJmuox3qkaJk1gAUDn
+yvf7Mkxe2snk8fdnhkgTBb3dG4EbYKK95/rpkiqW/SN71ZbgFkmBkyJzWYhR45z9
+0aSo1oeScah0toTYGb/8BOq9qP9xVK1M/ZxGVQq535NgZSXBBUhP0RAg0Xw34FgG
+HVs7n27fClcAh+BUeg9T2BOdONOyFzXAN2rUJsj05Mpl50S4f5IRbfHHTFljq1T9
+PmbHiQIcBBABCgAGBQJOwWQKAAoJEE68DJ8CCPwRGAYQALDQI8RGxyBY90UKBnwe
+Q/mVtUjT9BgL+DPJ8Vmgk+AldFyStiZViKi1DGNzkHE1aYj42yZLdp55W/SfLgM/
+moXtz31uCX1t6eCds23JKxp1YT5I9GOsaajYL99vRMXhnhrYpSJ2ax3RYIEINv9o
+dAgb/QQLHYWfzf7b9luMx/sYV/ArweW4UMqsb6cfF1GgwvpbMAHBqp4JPr4BvYdA
+Jn9U4fOK9RcztS0r/NTBbiWrgU/WKVOkyr9gTfYqktgcpQkI3UzOb+g4kWv9BrDj
+C0+VQ+cltXCN2HMurTLQL8M0wKGeqqVxFk095DHlDDuKOV0dLC8eULnx2UdAWvdS
+Pkn5ohN1hVdEzLwsp3bpHjqj9yoMiyGIBJcmnEj/4uJyB1Su0MNQBI20A+zLLONu
+Ii0zLeLoaWpq2HtEFA8CvXNfMfpMzp864a09PtRWOQhdt5pHMnDgr3oWmJsWsPow
+o9ah3WMCc57tjPP+XvGYqbHD0KrKmycOJuNidFI1UVZH23afyPG+IOAdGDevHXiu
+Ue2UHGH7UJmsVZO5dHn3yUzoSoMMhRW+S/CpGKVX32VizoHgPzTCqrtaW/lnD6uS
+aMNuhlIPRMw3/GOrTXzjb+pqkkRFjHiNL59eJW263L4E8guvCUMmHYy6pltkiX6y
+GDfemnN3EKCK5Ut/sq9Sn9j6iQIcBBABCgAGBQJOxZdAAAoJEARUjz2XyHeQojkP
+/0nUKMl0mR48juHl5c3vGp9mt+rtfqBABR4+OeuuysKhX+0T0OtW7M40mZEJB0YW
+8bxT/2HH5IbitMmgSLAhkQaUr/XMWX2fHFfvzMLwZMmRtaIjB1IKE3eZgraUpmZc
+weeDGZxqOL3ROKhZtzLms14IOWkERhRVad4oj5sAKV7hJf/Q8Gep+lDmecVST/Jq
+ucmKdbGry/0rLVeRp8snbKygLQXrohRgATyjsbP3ssXU/Tz9ccWvu8Npb/rbK6aV
+rbVcF98OcaG55QimUty1eSq3DmVk1adcVe70Sj6OL+UACb9SpLI/AnuOgiwIJIHe
+pVs3bM9FH4KzJ87l23JQW6eKb1F9dTOwjTpgeaAHGsR7KVl7wyF45E5kOOt9mT+X
+CzRGnXVmnfaBXT9wbDj3kUvSgmRpX/NWCVCTqK9PGUwIkqD4pFYpwjH/BwB2m2Uk
+eGeLQWlVFf62+GXxkAbTzuBTgQSAY8kISrUKIiKBbbXPk7+HGuxXbKCa/SD9dOEs
+HWVuiiqYx4260PyeXUJRx/uKt8ehCQ5l6AGexIH7VXHNfkZSNQ9blKRHP3w1DxOC
+tqnMai4/+3hxEzRURB5fymOultmhEWbc1wkR4TjLq8hlrNUECf8nx50iOHelYPY9
+TDHcZlKhYj4JgVafwpBlWtJGRHcAnnRU+X/7P0D/5k9SiQIcBBABCgAGBQJOzZfR
+AAoJEPVP5kgIgzWpUr4P/RF+F0RPzARKJgm9zdY3V0lSQyEKIfHl8G9f95vWcIxz
+Vgb2W+eg80d5b07jalpvwFsqtsQqSDZH/REu0bZJkHuHCNWaKy1St7FvN+y+bv2C
+4asM35NYvO8H41Jmjex+2pE86mDI7U6NRMiyzq1Vbx+PKhq13idgGhCR5dnaX27R
+hHfjvfL7aQWIE1QRYNiHl6TAjmSTVWfRIJBZ6QB0ldw7CVbNnIoNhOd9gU4E48jQ
+rvBaUwVcQddesw0CfnxcdywvH0svxDVu0KImilfWWd+q3bSrtXmvIMDgAXoQ9mB2
+Es+IAgypIrD1+O7PDMCSu2o5MLTRph7+0bjFYUH+eh47T5OMrMhGOSArkalROzZ/
+naTBkMXsbh8QJEdrDJiZaomyQqcksF4SXFkEWBOVnKOWxOR/Ki80TCXRQAaZq/o6
+/mo1DMOPXVMTJrE7+EV1VGcUH5Vw20sL7ZA3WSMngtLYG3VA1ntO4oTrrTtR89Aa
+XLYwAWWJCOr4969eYy/xIeKk0EsEI/tbzY8n+sGH6EhiGM5fsBqHSPeqR0mpJGfi
+IGh5D2EP0fuMBznxYy/9+NVDQ4mad+16UMaV4lUG2TVoVofvVa/JiHc85VIh5B44
+eemGjnQxVfadPkbbiIF4IYA9UC5P2xhnOy++axdxjrAiU+qIsSp7V0C63UUDPwBD
+iQIcBBIBCAAGBQJO5uJeAAoJEMaHXzVBzv3gEscP/0aN6q0nv8z7lEJQdqOy72J2
+oYFCbZbNYQEGJdEirX24wa+Gki8ElQGB9XmupcVejq2m+J/ypPBzS9KKUonLxZtF
+FBQAJmcw+H5rOgFaSq+gyxGZMLmhBSU7RP4oYa1fE98DYlyf/a6zcnCEwyfU0zhy
+Z8cfItStoF0wc0K1+KTa3d4yr+AwYOj/CKS/NyMwPJORjtt4PpE5fo4VC8FQvKZ6
+zwS3tcVXoYciEhD70E8sfBx7rTgNHnm5I8bGIauCcTo2D5WHKq//Qw/3ZdibuX8c
+G/lgIu5AYGSNo8DIkqB1ayr4U6QzRJgSEogcBKfpeJid/jGkf/HLfSpQRnY+Lsa6
+CzPBLNerEVMEXIFtbxyX9dy8UAnN8TgjVc7vra1NCaQCQOvAXq0BKlIfHAnwCS61
+naGN7f74e8meQ596GtsnNsjmeviGaVrhCCeeYc1qL15WKjlCeqAH7JDESlH7Ioqx
+8sg4dofT4yv9tBFWpmvLRhTYnjJvtEj56YsOaEy6hGGI49hDGGte+UbSbQsJRxOV
+P9mM9Rbhjl7RKuREHIFJVhvNMHJ2Ch+2PczYWqG49EPl63I2/SB96+3982JCfK5V
+f52sfZG8kDv/6h1a34Z0fRCJkVeLdrQBmfsaLoLDKioL2cKEtxtuJVSnFS90hlvd
+MCXcJYJxysDNFjPdPBgFiQJABBMBAgAqAhsDAh4BAheABQsJCAcDBRUKCQgLBRYC
+AwEAAhkBBQJRII9HBQkL0jAVAAoJEJu4Y7D1G7iK2McP/jYqrS0KdYp8ljvXV+/o
+AHobtCmmclaZKHr8qOLSIxUcUiRTCRXNH4sn3KGYI4lpJc4y/HAoSPbRbrDj6rG2
+CI6P+VzgLcg0YKzu0vELCsmowWbp2E05F4Gqusyfk7wdjofgCInKLG+6xCaf74hU
+bdNyb8Sr4uo+qkAwHXqeo8SwE1hG1lDlCqhpaHJF5ms2EEyqIZjcrzfKvvvsJhZj
+v8iu1nAO1AlwGxfNVoxzvGTTPYT/PfpG1ZqZVrAchgGwLhbdRx3xgiMznUsza2bs
+7rF2UXesRsjGxfI87PrfEvNSszkyx2uzB6PKT1UwUfvZH1+37LH0/IxTYyRBxlVg
+PpIqp5UX5o3grpXwRSqFxSLxSyVHnhH0pe+2pLpFgR5a0dTx4CS5RBcgWm4Wkoh9
+W78qyumJFE5aAmeZCfKb3uZu9jzVcVi6+4rjVJg2q9QJzfbyQtzHwbF3I2+FcEv1
+hcXSkLoRAbCIta2eqRH4z0efY0pRXYr1xHM54J5JU12bGj4oDqJlKMy1m2hxlI2S
+FW95/SaDLesl65uuz79DRlwy3Q0FqYaUD44XRtQ3AGeGltvM+kPPRO+Sq29fzcQ5
+WzJU3A5yYmUgG/jn3acpjhO1TaHJvQEMXZEPR8b4nRoGzosJgTKH8A9lQhqCgxOV
+kItTt220wNwVbiT9z4kX6B8diQJABBMBAgAqAhsDAh4BAheABQsJCAcDBRUKCQgL
+BRYCAwEABQkFo5ztBQJK8yZuAhkBAAoJEJu4Y7D1G7iKgK0P/ix3+2ytJxlD55dQ
+n2Tf1nQ4BiQNn7hEjL8j8n2OyZEWIMiB8pgeQmFDaiwBQVhuadsIBO+Rwp8bhZ8S
+Ah1usxRSEJfNijMeVIrb1KHQ61XxYcRHCYViFfB0v37iTyIyc0y0tMyEvcjav5Qs
+cEMH9HGPnKC5P5z0vXwZJjG/ZwiLIw4wNMA/1xMY0ubifQC8RcGMQY/2VAn2Mo8l
+5h7081HfrUG7hDGkQiIqLWeZehbxRNBqXevrqzTnVQ87Q2Q8t/xQgjbMvl6T75l9
+rQqM8LYMLJjdlJyRSFmozy0fACrhhlwSrJFXfXN+AnQed57fHqW3FhxolDTDf7OD
+jczt17rLoCq7AZ3o8iF+9FRaQES/LgeJmwolpHjPMsrz7HJ1h69zOBbEZJuNDkfm
+TN2T0cCZWA1cmRaXRVv2I4zUBmBEn3R5HJjoWmcpVx6vMAG1WMtANWSdaqvZHgB9
+zbqWL76rafMQzstl5q3ZScr7g2E2Sp0F4ua+iH3HW0uuZOZMYjpkjGO3MXD6LcCW
+dZ48PjjJZWIKYIEhf4GtTl2fhi/hSYJybGsytWOg2qlATCEZe1N3lBHM/VbUFQYE
+0GH1vdhnD6px4zPGFMY0MBBKKdmCSJpmY9jaVnHJEgpUN1BCqtqusFOolqclbe+y
+pxTfL1SUjhQSWGfYMAzs3923/3S8tBxTYW5kZXIgVGVtbWUgPHNhbmRlckBtZS5j
+b20+iEYEEBECAAYFAkrx/pkACgkQsr68QBUpJK+GJACg91JqNc2mEePLqAJL5nZf
+cCIfUfgAoNWyrSnCEhKRTzOhD1BxZ1G8zajDiQIcBBABAgAGBQJLPcnoAAoJEO04
+c/XTJiciCawP/2zNbZ/O2YuVMT8Jyauw4oC3DFi0QN+ilXjCmDXRPWoff1aB7KIt
+GTbss/kmRZ4yYUwsN65g9/39R/uR4pV6aDLAGHky+3Rbze9eRJeZZn86TmFWXNjk
+5hgPgyu/RRMxVW0ruYWguskapzlZW8GG0jvlMOzRxgN0gR5m5cT3dEUyo/Xkxx+I
+1Dsd4FDwy3hT1fEMi5kFO1gcxMyoXYGOliSi5v30tMHdVq+gTpukHZoIrK5h6caR
+nMz3cJ4pooh9KCtTDT5MwFB+R8PzVocKbZG/DiJTyFIc+g8Bo/+YJtxx2+4wVpKi
+9z9Be6raL5BHRvmuIPb4OerbR2VPk5nrPu2SKCUUiGy3hzTQDupd7XoAlFHA4H8G
+Z+WRAASEqHlhmAL0/1j2CWQwd9iViNyJFmol6EDwAYgYsNk1jQf+/p3hphpCk0E5
+MCsF+/pGajM+w6oy+aTbCCxKawWyXJwVBxo+E9eljHISqeySYPBRzOKCkcAnmxzp
+xFqmVH4N0BaowYeN+ta39k1ielVzGbUPdx61hxqM9UHbrISnYhxc+3hGoAt5pUvO
+Uns1QiKMZux4qpu2hTeCmGaoBmUcbRCIodmpAvVXacfBbTUL11D4slxVxTslruNe
+DaVpsmUwrhun7I4tdheoaiau1KxvTTKaCFwA3QGAIa+M6R6GDRUQFrTIiQIcBBAB
+CgAGBQJLJUYwAAoJEDF8bfg8dwXPyasQALVodGpN983ope5ZY90q5+pmfbbGQvej
+DL1zPMhCkJM9TJjEtWVTUxslli6gEkZkzpQULbr9uMEsCFv3l0BsZhPqAuiFCyMv
+6LxJGs+TRS6q11Y/PiySR2vMHk4AYdx9ixQDB26MVlQEUrYe0rQjiCjTEO0D1nJT
+VpZlynHFLLNuG1FpVPLfRbNNBQGrMMnNdc9eF62iXm+Emy5odzUfKU0hxRyjyhrf
+NQqSuh4FF6fbsNGJpsPX5ca+mmMn16A1DQ3jvLmwHLn/GPhTozwaNKli56OT6Zu8
+AY730hIM1fANFoPGtuEdI/2QDy2obRE5jcWX1/U7t5DFMO/pT3fS7EhqPhWcqPqO
+g3sFeXVH29/Q1hjC1UqOI9qD4/snPaFVAei7rP8YKYiAIOIBPiAWW5nfiC4BFhew
+kQ4h1upl1ZD2QGKOrHB7PAqL4sYixw+R7SWIkeVDSTEJmq/CxmBM0fvGVlk1TQbR
+ZGqnXSojgA9sP+ZQdZy+NtPOxx6YpNzii9Y6qD9Fmu02F3d2GZVAmvaUGkSz2ndY
+arCvNhf/Z+uUlkEn20KG6o5n1aqD6t8hjD5izmGFYcPl/wfVugqOATn18NH3hp8t
+rBGZAx68ZX4nS00TLnmXji/gvC42hZXbalDm3l6p8w2/8oWmK5Sblcxq/DiCeovd
+zVGsIXTDcDDDiQQcBBABCAAGBQJLFDXNAAoJEIqviNbYTkGuR0gf/1EbrQHogVgR
+rJT3uWBsCGCarbG0VAgJtjhVAA1jX2TnLT/LefbPlrJjRtrOemuOncyO/qcc/1aC
+IVdSnIh9HEKqabIQZT9RjQCKyo7wU7GAEW96SETudwJaRQn9by2dZj8hOoxSX+lx
+5IHFsJzGE4dAK+OQDQMt0bvHvsS1EGAibYdcaCW8cNoUtMMmC0j5WqapV2arOATX
+Z0p/go83rRCPgBQ8Y8XsPBJrphjpBhzV7YE7P75nzf26HuLHWQmVN0vDEAwU5nDR
+PppBARwYXE/zRGQMTN0qHdNNhyP/FRFocTV8Z3hbE/7u9+l9iNkPcQWg3KbHTWn0
+1UioCxFTCU2CdJcK/9ayuSUOCOOsmnNr3mNw8fEP5D16QwQGI7IPoJwRr4sCwa1t
+mbx2QxVGaNI6Bo/uLOvRDwxnCkZNNT0tu7eHujFsvivk+dNRygxEHrW9eiKCzzkN
+hoQYCc3Wmgw9gTExcIW1JEXWW2ILsHXd1O8JD3aHjtRm9vLefNzIonaZRugJNC3w
+NBb3cD5u3fkUuOui9ydjfD/Q82dkfDKIyr30T5bEhrHZjsjH9Bl/LMAwoVKGwXTf
+n72v8tfoo5CzuKVlEgnpRVQ+uKSKfN/YL5Cb/3xKXpD/EgGPMO5pnQaSjP6L/eIM
+618Y58x/Tn1fz1jc0UR1zCUxLmogkGzaRyBHQzITkoouYJ3iM4VJiiSI4S18eFwR
+ZKQSErneYwCKUYNEQRT1I/kkHZV1Unk3m5rcD6JiS5e/Oihs6xvPZveGG4maOQo8
+NIEoPjwS218SJVQFs5TU9aUSF2BO+PNfrTDt7OMDR5ltqRvUd7iWVjg3y0LFluz2
+D0Z4E7movViMdS8UgKC7OSfKuhYubZ2BxDln//djzGQvCrRdAbNOgNa6pbldYmIE
+iaxEjamCGkTPuV3EjdQ6we8H2WpMUCzTQ6L5rUyaw1Qq+8UlW4PFLmpcYkj9+g2V
+v9zQwH81iqW7w5wOrqiMksYacKIX3NM2F1G4C4Aj/cQsnQ9EuqPufBEaFjhtSUym
+aQefv7zSG8u3sL6KVg0+CMnvGrjNEz8vQBWDcOC4Pcf77oA0Ao7l/me7bsxKO9Mo
+5k8J6bRPoTjVo1wr8lLe0FViU1LGLKVF0SmhqXh8yT4YkSsLAHiYVcnYFTcpS9TQ
+dC/VknQXzOSXA0Z4eNl4uEKnRQ9BsYkfQc4afYFU3hQ9Lq7ul6GyjPMf8QGNF6kJ
+ZpJXPgI/c2g18uFmH3zE9jTElS4qt2ioiFBUr+wvu1QFi9nTeYue4to0KcdLXzQA
+RCQUJV7VeLUbYRCgRjS1HYZoJVUI2gqmuY9pHBMNJC2uU8jBkg2yKoahc/51LE5l
+r9TO2gBiwmaIRgQQEQIABgUCS6J7ZwAKCRCGC77m0fmVkLsMAKCuDuZOSIv74T0Y
+TNWdr5+J3ICV9QCfRCZLEvW3RJ4W8gHtKfmiDWIl1mKJAhwEEAECAAYFAktfZQQA
+CgkQGT8YCrVdmXfJOQ/8C7/g0FEt8NcQHuFRkbGrM9W/CF8rvocsDdH6e9rwLZAv
+shkVy+5OKruN9IYsSJDXNu8XK5S+yAGqp2LH1UjP+G2dDzW5vh3AILfTW5SgJlhQ
+ygTIbKPWKMhDwtQuxlj13uj5mPpUIwQMU4WTgKcpIzhihGuqdUvuQsamUpeL3NLE
+JcHYCGRo47VAWnEmTiI1PMAB3wTmI4e5x7NfftQXeTPaMon6tA3cNkt/J+xxeVJo
+Z4Sv/bSbD2pMa2LU76JJ4C3KQ7QPSTgMMYTBkOEkyZYsoIxYbM14TpJka+9mUDBZ
+7i4oDg6rbngzN19FsV9psTsCOE9tFcLa/bzBqqryXZ0QdNK1XNYz6j7jxBmAy4fq
+EEPRS1qfFOrc5GT7g082sjEHt0W8iosvNxKPav/29DQnlhyTkPu//lzBOHR3qdIF
+7f2b8EkxPj7NkpTcgdFWCvQPFVzTdrByEwvjMARVwdQRkr86DW+d+iPzm5Kr+ZBN
+zy4LUic43u5PU9AUvTbMPtJZI8qpY9V4i/F9E8lbcW8THs/6oE1aIh/TEzFFGEdB
+TZD1JjYHMjJXCGTxBzY7vqXfdBtc3v4t+hXCK8HOsAJC318E8RrIwuPXV3KENVI/
+ds/Jz3cLbuZS3S6olf+3EEzo/xlc1wuwK1Rg1+/uoCCSzvc0DtC+t5K0xVonNyeJ
+AhwEEAECAAYFAktfdTQACgkQVWu/8D8KBLazdA//UkwKVnNaL9QO4h6plQBFsoci
+jpQEW3tL4UuPLa9Q0nV6X1NZKdsBK9HFuMdnjkksYByDcknYqFzOcOdnkuYBh5Fs
+2LlHx+BkJHxAd23cbC/KJyovx9e0DkxFkAJRfu0db9pCxg9m03v2Jp8FV1GChCUe
+xnbMQjT1HTH9AA+OEKVGc8V2AFzzfEqAfM5T8ex4SGBadISLaDjVLnof0F5nw0PW
+ZIWhgQnwS7YiHN2UobcesflijE6Vaf0ZMQ/sEEe6wuNxFUlaQlzulXU9YES32GTs
+dyC9HM/mtQQDex7O5prTxRFJekDVjE1rZ+467Pa3fB5X6naZcUa79VgKp8VJUXHK
+wBKVwer7vnYyPUWbNFkAOiXONRGSASsTpP1cBIbMs5Hp0LPJDVjKaFzDXRb8cmZt
+yxlEHWVyFUvk00CD/ykmJZ9mPD5jrsba9ACHTfB4CJkzd5wEffm4pw0GThiuSmkJ
+7DMI2K6OAUl9/bbGVWdvwZEPEeffvLbPHfhTGxNjw9QLfGFAwnOdw2fnEhHmuq08
+/Tuh0+nHqFlCr7sSTjbCefOgeKDbMaZR3bXTkGZ1aKZizMx3ZVSuHjD5QKkubNkl
+zVhWIxpW5BRroHVQgNhaROR8jAuR13ZVntZde+QgmnpirPQQcYesxc05Dq2Vda0f
+23MdVI1XoeOmWSUroK+JAhwEEAEKAAYFAktfZUwACgkQUz3vFV17vFpitRAAldOr
+AktkrVYn9HkaokKTjsFCOCNWpiGQelP2XtJrYFJqNs0kzxtefA4FrWN9xXCwJu3+
+G+zuFU8NWKq2UB2N/5BrUVPZFiZ889KjtC1j9x7SJADlayZdNmcPRI1g/nev7jLO
+gUec/Dyh4zDxxHd2FWuRNPERfimpiLJ7UMxSsyxgDgUQHyu9g5ULB0t7wSEzEB8J
+0jqENr4qbbIrq+padIjMZlKi+dxkvMDaEIcm1juley5ePehFDIUzRYmv8C22wyAX
+QUsL6hvR6Js1GOAg9lauW/JMJeqrhkIeD3A7pIT4E49jqc6UeqDk6Ix1Eh/7ZgMe
+Br7AyctllxJbH0fDQiTV6vuMXAa33f709leXhn2PGXkXI4OEVyxQIKOsLBOJdvWY
+MB5Bt1mN0T+sG1Pktop/ZDXRdMAzbWHJDxxWqIRsPsz1NBebzHw5B97lTp7e3CwE
+19HOBug6R+dv3HzLbCiWzxjz7hcIxBwT/KsSvpduUqQolSZhro1UhQt1lWuTPT/C
+qXZQaW4SJeiKYpgXHK1w/sQIMWFiWa8BPGFcE4f8qa8W/TuOMhqIODd1e484UpYO
+0L34wwiXoiY09/qQ86YzX2NAi1DT8CAGXu+CzllFdN78zig73n9fnhZE4MDFnB/B
+kOezUtXWY0jIizn71yMyKyj+JDVtSqNem9W3XQCJAhwEEAEKAAYFAkx2khwACgkQ
+4TYIihgkvcEjHg//YlmM3WXZeu87DRwLD61S+rAqK2rHekif6Xb7G7acbeXiWmaD
+Kgoyk0o5UZmIrquZvCKFx3tEjvqpVLTV7rLpy/0S9dlNdgAd+QhB+zYXKNJ97JX3
+AwvWSz6SHOXo873z7ReI2Ph3c5nqYs9Am3osWynJwOv3KIxave8W+7z73xbuyUZK
+pZL2wS2f4Ng9CNDkLIRW3AoeGV1ZIEdmQ6IqAtqFHTgI+oeaKksLbbGOS9TjG0kj
+58V+TcFS6Myf2FT/8Oa5Zd/vrJZBb8TT2YveuYoa1oheoRCW7t0i/olsVMchK/vD
+gJNAHr/985AHi+wbIal/vH28SMy3z/eTSCec339E3N7XFHSzipaUD8FNQy7runfo
+zLgd/l2/omPBfLEjZhSzGZSpcnL9xlHr2M7iTVLiYBgGV0gXVT2V6f3jYfHUtBbK
+neu7T50SBXX5I6r5YlEnjY7KSbOm4ixNkPRj+ExGMyOg+akcZvNBPinuO5I0XbfG
+YQx+XqN3oD/3c28dGbL0EXUI/zb8yG6MAfbZL9vmm7bBCB1gExAcLi/FHcEd4gj1
+sInQD12QSZxJHpxv+ctJPDN77RG90fqqfoibsxGHX7tOwQebspaDK5DSU3BrzeDB
+0flWBIZCC8aabQbUfykvRg3U9eopt+6Ny14GOrg1++WRttTnHASiCLkPm9iIRgQQ
+EQIABgUCTNsu6wAKCRAbSHfpsWaSh/1fAKCFCR55YV97JMNHT4Ezwe15hIq0kQCf
+WFcpcUyo4ZpWZ6Kh15b5rnxpmzWIdQQQEQIANQUCTOJSoi4cSmVhbi1TZWJhc3Rp
+ZW4gRGVsZmlubyA8anNkZWxmaW5vQGFwYWNoZS5vcmc+AAoJEKR9Hi3QHg4YANYA
+oJjhPnn2X9aUeepb6HzKkP2REJTOAJwMqNSRlUdSQUBfUC93xCAS6sUJFYjKBBAR
+AgCKBQJM0rRDHxxKaW0gSmFnaWVsc2tpIDxqaW1AYXBhY2hlLm9yZz4gHEppbSBK
+YWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT4fHEppbSBKYWdpZWxza2kgPGppbUBq
+aW1qYWcuY29tPiIcSmltIEphZ2llbHNraSA8amltakBjb3ZhbGVudC5uZXQ+AAoJ
+EIs6YB8IyXXlWaQAn1tiQjM4MyZA2v4GlT2Te9p05dSTAKCRpuwROcbdZlTLygOh
+H9j0/1lXXYkCHAQQAQoABgUCTNK09wAKCRCCeB3kbVlU+pNdD/9BM8Oi/xVaeuux
+DQ2Mf4Smv55ZTI1D4EC/BA/I5ctWkxm/xwEdJ2Hcd0Q6aPTNQlJuhzbnwRmRU65j
+osF+NiK4lI0EfV55KP+HEO85v3IrjiO9H0xoV5/L7NDKHaPMEXP7RKMiiw3Ogful
+u3SvzH6ZiOZ4ZvvkkFpMsiKJaeKIey0S8IW+CHDdFbbnmNbhsIyPv9XgHDii94gv
+LbgtL/RaKEV4Av3wpYuCd8GlyOmiJlGZ8Z4PNwpRmTB5h5DJGPzDq1jPlBf/9avL
+ukhgHWqFmGjpbRRl35mL/d7LbAramuSYoZREiP1CMLPbKMWxaYuT4f1Q6z0ykTNa
+8zVQfeP40V/L4QtmNrkfgQxKY6TRByckBupsq9p8AJUZj6tj2csXPCm0REyBzkoG
+ZcH/3PV2sCa/PAd/v+uJCT+mYwNdUvHImrG0gcwqgj4laewxB8QUrl6ghFWNsjvL
+rcZxAX1qBvPftM4Mg1QihVSPOl9HM3kck632Y5DKAxgS9aqXk6Z/hvQ+i2L4PGKN
+U+ubhpClk7J4aaLLr3B3vyTmg7vZb/el/fHyJZ5O5qh5d9XyuTjINSdSisMdTf57
+UldOjJlnCg4ij3Y765P5EoTEIa+5DLh3sHiX6VM3kHQAdJ8Fzg1dslxqhcmPVvLC
+p9L8UJcqrYqMgSN6ExYP/rAq7gx8k4kCHAQQAQoABgUCTRxM4AAKCRA/z1Kf8vJ6
+Bu11D/0cu/nu3LDNyiyDSPKd9PTkds6o3Oa26eqHTZ9CEgjdJktqbZ6qIGaovcD7
+oawiHcBWC3GY5ZhV70JCE2gufOgBEz7pQGMqNOM5WiUowznwbJIJnl75KbHC+6S7
+T801HGkOdYY2Zs8zLPGJ/wzK2oYGqWgiQrlKUyMBGkN3bFPPPAJ4fhZhkY3Qwyz8
+j+D+CF0QGWlnHtgMef9mN5TSxtJoVRDZnK9voxvW0fP9Ro2z1fLzBc9zcvjTVYk3
+2c/wKSFto/ANgqmlHo4SSuDNoCqN8VRVuF4QBpdc9Hf/LAJFq5eKMRWWB3ABVEBF
+2WygXtDGsFBb1P0raXJAC4RkmlbRqp5KiTnYATlQ6d60ApCIT+Z8LewrREbcmJyM
+5MAH3pVPd+OhtTnSXNSHXfGak5E7LSkCnchV+NoaHPXHy0tXC3O3d8bkWk53RsjE
+OCtCFWPcRVdWauNQE78SqP0VZqeLl7PDzMe6MFV+kB5ELg+LR7UtLgSbQCmJXpOe
+2TDPl6on7Q2kOvT22nUQLfuaoXvwTgW3NgIlizHSkiYc+N/iofTFfJbv+scZj7Km
+PnqrBpMx2sdxDrYowTvCd/0gsgofH6wI1Grd8YhBMuzIZ5qDqHNvXS6P8ClhzZQt
+TmYBKa5C5/2deSmOwRptlVWL95mhYNvHabGmIpdZkOlbtSRmOokCUgQQAQIAPAUC
+TNLNqTUcVGhvbWFzIER1ZHppYWsgKENPREUgU0lHTklORyBLRVkpIDx0b21kekBh
+cGFjaGUub3JnPgAKCRDqTcrcTcqoj+ksD/97lFmqIfbJKNxGSACbAoR/CmKLEy8b
+HLWpPcm0e95PDKC8byDDab6McADwsECHZaKgHizynRn1OcmBSHVrcA8eHwwBHqxV
+71Ocu5M6IhQ2nU1aW7V2+d028XiKich++KUDqtzighIjvOYTBtuFAl33vdggAY1P
+El57UsPWy8PxNjJW0i1VMaGboOw1lnoCgxN99VkuaKrEefL2p9xUp+yBZItEKJEu
+SpQkbNp8ANkHAhbjJrmA5shYIDTlsVqGADMt44cw0ugiQtqDwWjo/bXwZzoFWcC9
+a8Z55bj4w+atrPzCUsOuKpqHq0DU5+SnvTHLzXoreKfdRq+uNvfczRjx1AZlft1h
+mr0m0Y0yw+oktNRLbZzXUAJC5P+PDkKOmb82r0dFtF9uea2kX1gsCEP55dUnKk1E
+go/gm68vlxLP1VnaLPRgLpKPW/mUsnuTY/7tmGzj2XUhAqwJWVv5rhS5/UaqucgH
+9nXnaZIrvLS9SWu3LzZ5SLXKPw1ir9YZC1pTPrtd6nXPnJEffNbuhKH8/3A3UIt3
+NVEN9oBxmJiof9jRBWKyf1DSU13aP/wGmCCOiU7gN1I+BLMM3ZqP0WF0Mb6Y4mR6
+cAFHY+Ug/UjLX21okPE6djKG1B7UeGSUwJGcof6PU67dxaJfUmk47+DIQoOb8aP2
+whFZ197D7CitG4kCWgQQAQIARAUCTNK42j0cQW50b2luZSBMZXZ5LUxhbWJlcnQg
+KENPREUgU0lHTklORyBLRVkpIDxhbnRvaW5lQGFwYWNoZS5vcmc+AAoJEF762f6C
+p/vNNX4QANyh0StE9iY6zxHOB2/fkK93itUVxQx5VsZ7/FkWs1Um01gRaDJ3so2V
+YtGJoH6wFGKy29VWj2zNLhDv7VUUnosBuasnZXgcjXCW6OgEg+t/fnuNXAHXLEIa
+qZsZwYgx80rJEMIAW2NEhxydzAj3m1gOf5urOqPpyDKcyB1VA3AVKa/08K6aS2Aa
+2xIZqt0ghGj3NVPBgRhkB+MHXmZypmbhRVZZn6bWXs0lhYdmBruljW2u5fgHJIS7
+Jdl5yvz3DaF9MizzaHvYBDWC3w1hbdE95cTWhPp8dRsp0sbJAzPHf3BgkaAP08e/
+v4txUmqlSw4JfxFecWt0JV64qT2tKotVQrqIeMOgimPJ9ovhfqOlAKBvzJCBZ6T8
+d9bcs/xThqCSMPaQCh+PiN9T7/h8xxfG7+gfGP5fwOOCEOVkKFi+9xMXye1vx4A2
+qWh1ScALs92GvhMwy1PYoLfjfsEgeYvRGtAX2TMKkyOsHQMqDGOdRxb6yFeBMZPQ
+D6SQaNHOt6l2gIqstnTy9Vk+I9MUT3ynmSX/rkF7YVdPkDJP6kUAsxI3rACZrZz8
+gN0SIH8/3+WaT39+OQXVLleP/BbkKBtxnopi5De72CTG1ocwJZz00ZvZdi1/DvEl
+Ls7ia/5IyNEviCw7m2EQdvLSSzl2/Py3pYz1/rfmQkC39FOQ1neOiQJdBBABAgBH
+BQJM0tGrQBxKb3NlcGggRWR3YXJkIEJlcmdtYXJrIChDT0RFIFNJR05JTkcgS0VZ
+KSA8YmVyZ21hcmtAYXBhY2hlLm9yZz4ACgkQsNmRtHxAhzdp/hAAtF/zQVGiDrcS
+QuuYGU7Ez01J2Xk/9LSZ819Q3jsWopdQYzxGCmK+V8plEkGLIcM/jsK+NLAhZVzt
+7qg64vy3MTQ7anvjYx+1+mX1Z0p/g/r5IXXQ73Deg0RPPEtScM7ZanFlBUTniMEk
+ZPt8qo5CZw23MeP2E4fl3UzHy1vt0CyB1dOJjsy9XPXLX258ON9IBnjS5s99fKqn
+Cs2k0VFyNkOlsIdWzsvFCoQl7URnEEUI4OrrvftxQHouql3x2SxE9K7pIHZewg63
+1W+UXuH72BC02kIXrHixu7yQIE84fLzaptZJWZ9Xgoigk12L40ygMQbc4zbRfoVY
+Gymn/jdZ6W/4TG9ksq8FHFi5eZNg+hv8YwFabfYH9cshjh1+ldUbHKE1YbY5TpXQ
+9wNZOu0XHMsvo/pijcptUiC8yvmeP1Ky7dyJb7PkoOcQ3cjf31wGiGP0cgDhw1Fb
+S14g2OI+fng7Ns+9LLOZ34/QryK+hBLppEdAnLgAvIZzyuydK6KbdIPEzotffoJJ
+8PfEPoYa7ZHZZq3fJTno+DO8mhEi9V2jHkpDZDTNUkRYEIevSnfD8F/44bjvZHUy
+63T9Hrr+DTjqG2ucCDZeAkaMue/NRXev53RIJ8AHLTUG2dbfb+GHfC/OkkwFe64Z
+O0is/SucfzHqQArAUB5mo5B+RC0o9huJApMEEAECAH0FAkzStCk1HEppbSBKYWdp
+ZWxza2kgKFJlbGVhc2UgU2lnbmluZyBLZXkpIDxqaW1AYXBhY2hlLm9yZz4gHEpp
+bSBKYWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT4fHEppbSBKYWdpZWxza2kgPGpp
+bUBqaW1qYWcuY29tPgAKCRA06nbmeRSFqOljEAC+JPGA6EtNP7fhaBEuLL2dhgTs
+4vPGvWivygw4WKR4ONGVEMBCQQCxafRxXdUQEjvRTxxdnI/2S7VpGvQlEjSAPkVc
+wuX+lwxPYb/7L8D78a11AtAxnxN16QsDBG7s4m+aBBfjn+keQ1lIdScVqU20ZB4y
+0qrJb5Zv2hfaDUlg+99VS08VohymSFPEFzUWDufyCC/nJbPnrKZppbBHZmJT6WZm
+8y0i+oC65ZbRCxaMV8FVRhcmiafXeZoC/SURf4YSX5tgI8++/Ydwzxp2wxI1NCxK
+zsG7sERjLmtoXi9lrDLlWJnhbO5Yid6/7EXqzHjcWmUqag6jldJVQRjUR8G7Coj5
+zUjuEUZRlTM8tllrWLLSamuKhyk1q+UB5gDTIqGDpFxj/SvdKeScL0fzsCmnroaL
+MXtd+QCBHmEk2umA9hb2N3bcq2Ht9+zZ5av1RHkNdT0L7l3TiFgyP8cx/qw5of/Z
+TQzcvD+Nsl3ijShyvihNHstPYDeANCcHdRlnmH6fusZGGV9t3H8O1kGIGi2R4Pw6
+pUDPuO1BHfA11Ld2uCuVbJwC+2aG8tl8v7XzSovCrn6cZW5oPxnT724UMZ1ms2EC
+Mu0Re+4T/q5r1N93vmqHj2ANAm/Kh0l4xBlO/W4lpVqmZUOsdup5mKQMLQWEgxBY
+LNgEqimt1u0kP1qmn4hGBBARAgAGBQJNJK0WAAoJEH4q/cwONxoJHQIAn2msette
+hgxjatfizrygcPR/2MG1AJ0TfFlSZEdBVOcbyeQp9QHR44imhohGBBIRAgAGBQJM
+1CP3AAoJEPQmjufy79DwrF8AoKX1C2MHxi+3OURgekLqqLhhXcmsAJsGXHUPOxWI
+AO8gWdOUbSan0395mYkCIgQTAQIADAUCTgOM3wWDApIJwAAKCRCMleyeQza0SER2
+EACxkaUEHDutAFu1isg+H4N1+w1j++I4VbbminesbaWRl3X8or0CFeGJD7aFCZ10
+oj1tYwDQ79+lv7Nza7UgbM369lteJzF/uzHy0now2r1pfqZ/LDTegTbDaLx0l1l6
+T1RPr9Z7udWADOG9o2FfaPZx1sKZvHGdBAIQP0QGIwNaesXTOBALELN5YqFFJGw/
+QvZPjgrhiVekV3CecWtRe5F8oYPV2K4zwV1hOzD8t8nmK8U4C++vK6alVC7iQt7D
+1uyMeeX/Sj5wWdXQUo8PKauzDSRO7J786j7nl+c04OI83uij75nckwpKoaSKVuaJ
+1CIiAObWnU4X5qiWXhbO/D1iYDu9U/hbKrcBR6AAgF5UTLd8gc4cmMxMh156OMMv
+fbovNeLiMvtk+I59RMoFXR+M6vrF0IpPLuTD1v0HLvog2FEuBvDbXDeQp0CpR8xC
+VjiLGDNWBjtNnYYWUFBUY8AjmOjmlOKyhVyGzZKY2OFsTRaYHnpoWVWDbxMwdF4x
+OU2WiPp57gvxdLDuRugeyZ7at0uJ9qULzPdmY85ZpQ24iC6IvGeKbvbBRy03NO2f
+kC5QYiZ5GkjIdjMUJUAkBUnDRVfNWfxCt4WWDOj/b2Dx9j+wLlvoYSp8vJMOgzdY
+RCmLP4ILYHestBxjX5XL4/jP/ermAtE3Z1stjHPT0WypDohGBBARAgAGBQJOvCRS
+AAoJEAsDrm5OJFF8OV0Ani98tYfmIfP5XZQ5OB7i0utm+mUvAJ9i4Avj7LjRTUS/
+/Y8WEjwECKU/V4hGBBARAgAGBQJOvCmzAAoJEKvWMuzE/Jpl5R8An1XRpZqcpO/O
+Xhxah6XLsEpOyZwiAKC19goK1pK3aCPjqUQEZeTwjux3OYhGBBARAgAGBQJOvE7t
+AAoJEC8+XTEfSeylBJgAn3BMgHkHaW7aRruEYxqv6DRs2zotAKDSVf9WP7k8QRNM
+fX2OGjq0NY6AsokCHAQQAQIABgUCTrxfWgAKCRCarPtWNSrPdsfjD/9qBA81KkYP
+OINOIgYogWlJJ1v2glEbcICRvuBIOSpFgQqdT9cLyXrCl38Akhh+kO+A2PEtkBOw
+5fDMyENbO3scVOXSIui6SvqDZsTUhcua2jHSWILg1EYr0mWDa7WrbWWcFNna60QP
+M+sjYRAkO0oGES7xfg7mb12vHetZVlv6fitIRRBSXDnx09QrvmsVxj528TuR6l0Z
+p15MgqAALntYZRkgOwajBIlMcbYkFJg4PsOIzV2ucVYruoPaBpjRnh2AON6qaXF2
+k+0Hbt2DNwB1ZrV/CLlpWmrrgWdyBiO/niqxD5xJaYIr0A9aW01cdgp7kwEGvTXZ
+t3qpNr+Dc/Dqgjt94GoEEHJ+ugiifGD+kyox2kXIlNMT38FdorLxmTEPiyAQBDrS
+kQGXmZGW2ua05Ns6ElU5WDLpdqZlOg2GjQY7LHzuXNbILiKleoIMdkc1EmSRpLjd
+IeyGo94V2ae9G+R345KAsmZfP4Yszkb5W86KBDUErw3MY5wye6DdXPZKpy2w9XWh
+lMsz114+xpcJjo1Fv9/GlHSIoeEUBVl+TxoeVa8pjUOjWO7aCuf4ZXk9vfLhIJYw
+WfH9zlT7sTH+yQ2S1PqpfAhrYUNjxy05ZmSHKR0/QfLb/WmIVD5D7zoG8F5pV4uC
+WtMVuOHEId6U7W4/3BSKv2+qaOWKKy5+aYkCHAQQAQIABgUCTr1SiQAKCRBNFUEQ
+uEUI7JBKD/93jZP1q/wInzVCBN0zl5PI3Af9v4q8qoazYHrtaUxm8Zba0EmZlpLF
+H0VfgHxTnSQo5gJfSoN2fi/jcaSpr7hZozLw9eMkEL1XLbGb4LiOlwIR7bRhq+xh
+OTuSSJRi0VWdjaPZOXTnyefnkSgGe9bnW/imulKrto+c63rSfr2pL/xSPOu9wgbK
+fdRuhYQOZcnG39zDhFwYYGbLsriyJFxoc6F9u/5RRURVd67XQ/ZpdgjjkuebpmvG
+Hn3OTmsEnMJQrkeib/S7Oylv1Yhb9QlRIDEvsoOZGeEF/hAvlHDDYR8zAKpfOjSy
+eApK7sPaZp85+BUQ7ciT9Ty0bhMMNQRP3Bj/M6SpsVzgMUmUN9B4Mip7Kr5XDtY7
+CiGf7u212r1MOTZ/o0Wmh++66QI7rw0b6GmUlnJORJz7D+YiVfY0knRgU1dt0FYq
++qLUjVneqRmp5gfx4+5BWtOESYrITZUvc8VKTOYgRIeD4aJ13+IPhdCfDbWoH7YX
+e8z+lt2hLOE2KLiIoa15XQAI5t0hKEQQt1rYe+nEKB1k/azSgUtLh7uVUhYFJnKq
+3643pTKFoWJIuEUIaf2m96hZiUXFRxXWV3PIa2/GElJpdVZIPtwoliOcUDWn8Jpp
+o3OIM0wwHyuYjFq2rbgiyxygFAIlSZgMJvTnYASL+kUYQYZHWQu9zYkCHAQQAQIA
+BgUCTr5o4AAKCRD7Yz3o9cuuaxSaD/4qIpKpgCw4oe4DkpUlTgJM4RRtC5Wyd98/
+zavht3X9I/n+/rfrLVUgOiofHWGgBAD8U8RxUDw8EfW8ohR+U+u9RIBHUR57VFF0
+zU09F+UbI8m99paOb31vI2EratGOd6kmDIcVgaIBhY2JRbNxuet1bC6fphouPga/
+aUQtxISKwG6sUpWugCgD9oVtg2UhUfj6eH8A6Or4ARu9s5m1JbyDl9XEHY2v8LbM
+joyxd4kCWsYcuwqluE8BoEJw+R2QDra0y2voNcfgGMvnLbJFn1ivufgqLdtG5r3h
+2xnA7idL0jvp9YMXEFbVMzP+BnUxKIOnSo8hTDxfgwkiJbFqlgQIxzmAUjGAg9Ve
+rssFWUMsFs0Bm7gkiNhU76OFt+RdX3RmoQIDeUMUlJ56jvWi0wY1orNuTG5anu0o
+OiWHZAkVeptiiiAHF6sJlV4YeCzDXID6cz8+iVSK3ARlQnvwgzOfJzs+rs9AbtSU
+9BSWQNEaAcG1Cln1pjIeK9GasNBW+xLHxQNYUJWk+jmBMrRz5AXn8jzMv6BvRzVy
+weYosn0DhKuK7LAtFX8mmxPX2JGCC69Q/FYXVEvRuh4iI5P6heppDcEtRh/+oviv
+ZeIrAWLTij200V0t+XVRhAM03Q/sPKqKWN4W0ye2wpAD5RNwaPotS/dE6HhO+fsi
+0HcJmVg9IIkCHAQQAQIABgUCTsrLfgAKCRCJofZRKiOcLJ7ND/9NGFshib9CgkmD
+BG0M48kfXydfV6B/DQdtYRsPXQDmS8slTakrQQRBtNHFyX+YCYKRAPVgoTzn46X5
+e2CrF8Bi+qySJP4e7rP9F3DQG1LqPoYJPBdx68v23x1Uv4vJ/q8vTD3kWdktxWM7
+HxJwJnJCkiitg8JeYfdJAe7pjahN/ve/gMlbUUS9lzUqCmBVRIwxiVE2lPml54h6
+dtDtzKu942y9SzxgkQKRPIkKjN3ZUWHTkT+kE7KOh1cc3SyB9P6A2alm8GoYe6ky
+tmgvI1u6NtUPNMvPycLyWYIesORNwtD0ALzSRDRbbALEMby46xWBNddDR/3TKpdc
+bUFFjoXZTGGnSB/HD6b5fuul0tvzYebnyBzwNppd/WgGr1LeXYDUUohHWs63CKLF
+KH9EZmAYyPDKTIyIstmC5rndiBczHMlkKvPQcXId5QTNVIDS7ze/jRgX+yAqEump
+0Jt2S0V27km3NQoj0VpahzJYn/3xqchj+gRFoc2IwVxcqKP1ouV0Igmy2ddJRoQl
+VbsZ8fDdiIOP0tWDroZhy08lxmeC48YHoY46dqlVV3qOulmj5CwJttsaGV8N6UuW
+uplS7pqXioR+XBSsg4uGx2ht5jS5Ka/H3BJk+7QyUSKyfLbboamf5m9aQsDtuErF
+KsYMy4Aoh/dg2SgFFUNC4k5/oDz4sYkCHAQQAQoABgUCTsFkCgAKCRBOvAyfAgj8
+Ea1/D/4kr5cLC+J58QXTpFvDtem2Yf8KrQDMKm4pb3Abw3L5VA9w+z+AqzhKMwHY
+8WgakY0dA1uxnAl0hSZTg9oAt32vPzRZL1dCthHSSVr9iykWrJ0GPndVcPiJc3z5
+UIoSXZ9kN7HDBk0Fk4o9guWBMPmJ2BFrwsDjD6zW5L3xPzxhYN+D58e6VjRg6YoD
+vwUCLXwm1xtHPGBSM4CiLu8GC7VmBVL0k5x7FeczVaeCIF6uwgLHu/cb0dt7kJaD
+U6VodDOadM3xd7MRwU5v63gwR4JmqH85lZFYI7phjbVhnWOKMpUYYoNHT2Iuk36p
+ojyrwbMM0EqWA5WFvqNvedqwzJJ9GGTRx0zkrgM0i93GpQI8IvIC2QJXZcA5BcpQ
+ggQyVitnxb9ZNnp/YDDeIUmvRVCbc4IYtzwpYEGCESCW6gEFjafYdYyajKEGRmb9
+0/+69YbTBweOdihGMWrqhQpCE5caOj2e9LL0ZgGlmioSBALvfcVvGbte3XE9na1P
+dBFN2osybG+uZXld0uoa8OmSdjL+1LqBRyLIVHyRUIQZLfr+KtokMWK8GlL5WCPF
+i6RZOZcQ/KXWadTb++/Le+6qatmzyQ5B00ZNzBsUvmYBXbX75VeaEOWXelAU1OWG
+erO2SDEPifkaC+pHP1Ud+vH3SjeF3KoBENqBpkEKGUi937bpWYkCHAQQAQoABgUC
+Ts2X0QAKCRD1T+ZICIM1qafXD/9PLM0s0X635yhWfZRFxd8fM4NWiBMx5dgVMR3E
+aq+iXjeNJqqMt8u1MQvYqIXrzm+uOTJ5nBbh0UoWmXO02XBgIWENccgA8wWy17X1
+E/GKWYMFhr8ond32N7+kn/7ftrBQZasbBXSdz0zNFTi7B3ilZnq19whN8A63ctYC
+GNMxKfu31F/Mp4Ukz4oiNsXmBq4+2SLfoR6xZ8xomDEcpRDPu0yQM7q5YWEF9KNJ
+E9fsZ1ltRxoson6jjpGbwGS4N1MMlJrWndwKhz5ZwPWdMCiiAZW6X7ZvE5So7J1n
+CWR+NxnJAFqVwp9PZxjiiKCIHZPz8m20qm5CoCR/j/hk+hLbL5cB+ie8wgushd1O
+V6P9GV6ld4umM3Qh57cmZBZwhQoouDpjMHeMEK/P9EEjPKizfhF8T4qVVQEpQlJQ
+7U13xR9PuQh8ofDs2qDplKpZR0BVSBxQb7l2JNDJsjwxKiqeGrFhEu4RaeuXl7do
+PWHsJqTbxul49M6lh1IMn06XYlMxR/dViMmPCh710T4ShyPQHr3ubz3gQPNyUsJk
+FkiBCBTJ4A3yVgdsSLMCv2TCUYlVGgazIyXYj6CGlj5C9X7b2PFGOsmIuuMWJrZu
+K64ISrbZUU7weXYn7d9NCCzUFCZHWNxM5MqdKBHy6jVONdksvgXmmGJ32sN4WJDM
+5wutm4kCHAQSAQgABgUCTubiXgAKCRDGh181Qc794DR3EACrmqG2CZRKvWPToU9c
+YFMbTNQR7tMB3Iuz0Cks/JzgRpRnBIg3tNoWpJfuQeTYV/rWgbov9hF42X1aahKh
+yO7iAT5uc4n5C8YoWzvkViGDtkueOGcCgOV/DlMsYtaUlPpgAqqFwCwiboJShsRy
+d2Jxg1KxMbJK/b4iFYSqox0tqUT/E4+7fFkayY9hbG6VfX1Dt/rv+kWPcqcvbEFq
+U2ZOQ91QGic7ZLZ6TWkkJtmJnOc8q8WLzUz6jKPqJNwa4bcxc1+I5/fOVS2xlaOx
+ZXqX4eWSTy7Jx2Ya7ise6H+WDt7r3M+n8NgqpT7KHzd6ZDel/NXHL9HpL1sVvfBd
+nkTNnUH2ZAL4QN5u2FdZkR4N8sJ7VFbHFbpQTP7pFAWM5NxPhXcOvZz7CCYrCw0/
+3xSaQk2M7jUp2JbnWq/fxRzwBXG9YUe6ZzFmovgX9MjCf1kPQohKBjSZyfefB/7y
+IBO1gN/lq9R4KzeVqbBUHTv1yytEfhmSdiJD6Zn1I0+rBj0lOPFBh7FavZ8Mf3qa
+nBQdYwfviMIEsw1rxwi+m9q5RwPzN4c10GLxPyA9HiveA4dj8DI2bD/mHymhjM5E
+Di8plId5A2mqfb36CYVgi3zVgF6fdkSclqXJgmaO53Q0UCCl7qnKaBQiUvZ4m50S
+vun+iQyHOgf1OJocid27Fe0eaokCPQQTAQIAJwIbAwULCQgHAwUVCgkICwUWAgMB
+AAIeAQIXgAUCUSCPTgUJC9IwFQAKCRCbuGOw9Ru4igXDD/4wg4dxsAhXkOWYQb/8
+rN0plsvZHkacnRc3w0h6+5FfvNMbuUQY0YW3kD3APerX9mkYBsQbloY9d7KXMl7M
+ATQtdXl07HZZMS1PXEyIWPk5es1tHpfR+6NAU3nJyJdniSO/8GDjhiN4sq++uIF4
+NMvZC6/7XG4uT39BlPFqRHpFxLu9uJuzNkiQnPkHQZ08r9FKq854/KGDtaV1aAzP
+s4f1cghvh2JOrioKkNuS3yXWIn6AxhXmvYhufqHXajCBovv/Edwf+ErkZ6uYgJg7
+EjjU0f8sDsyoEThV0ChBcvIaxhYEne5QNRpcaLMU0w+/u03DTbKUmOGeYyOToB4y
+5HIhuiNB47DtFY0K9FQbT9gw4MOuQkVLX9WG9Ksnc7cPPHL2B6DtLER2lMczp3eW
+rftx4q+CcI/jfWDrpDN1a2MI1fwR0cxCF7tSxGWl3EmFnjC38qMWQvXWMXsFqGUI
+sTOGEmd4w1L2xnYVRXDh6Ic9OmYu95iIgUE064E8xeurDAM5ela2C9KVXcpefkU8
+0vuq8FqNofZzvV/LVQczE5W+O8b+pqh+PUa9vLbv3ukdDe+zJm9E4/bGF7NjPgjT
+YBkb7L0PQLb1zsAUj0oo9HdyEPwHf971N745js2m3jQrKAgAuUOXBFnpAQ8qhhxk
+eacb87oIzHdX8TdtqaSqAg18M4kCPQQTAQIAJwUCSvH9lAIbAwUJBaOc7QULCQgH
+AwUVCgkICwUWAgMBAAIeAQIXgAAKCRCbuGOw9Ru4iq3HD/0SKrQhKwuBcYSSbRNn
+i5w0l6erZ/ZllogFTHyn2J6sAYtG/GxJ268xBVhXgmSpXWt3G+809rYh8BMKp+UN
+4sMuphTs/eT61LTDjoPIACN7R1FxWjlhK1PzsaV6dlfQXaePjr8r1vqV99kl8Khx
+iAWpLBJVDjyCXlv5vTGzX/PuZdnE3R1OkVhjHANcWLr9M5j86WgORhhR1KkDpB+B
+pwYbCCg46yJqkRVF1FZsns9nYyMnbqCq4mTkRgj2hSoAzBgJ7WFpdJ0qSo++lWxR
+r54pXTgZHda+GVO4I1APyyyO0Xl+BBwwNbpxT1PyaBgz7/x4lTf1vng/8dKzJc7k
+cHQftTgcRdDMhzjoqBAR7P5hACK84mjcSfB4a4THBAW9hO7rGHFWs/kVoZbRy6+m
+n9Gk8bm3xyzR3kGSSSA2S3/LYxmNfBRXNPvG9M1j6/KPa2dLBdBB/09Zk/lgHtoc
+lOW25dHcAlieYSbqJH46WJmK+YANzwfJwd1ofSuvM3iXBRdcuGvTZ8LHpq3Aspgv
+2MwwDtZUyjOMUoC1JSUIVLRfM3498RGVd1K6kOU2IVM5fFG33fFjzbmDMqZa2dcw
+w42/Vk0XIjLOUoA9/BdmZsX1l+YoyiCWm8KPzMWMjpeuxKCgdjTW67wB5ReU8Amp
+rzaaAByaElVk1FZiiZH3MJEhRNH/AABZ5v8AAFnhARAAAQEAAAAAAAAAAAAAAAD/
+2P/gABBKRklGAAECAQBIAEgAAP/hC+RFeGlmAABNTQAqAAAACAAHARIAAwAAAAEA
+AQAAARoABQAAAAEAAABiARsABQAAAAEAAABqASgAAwAAAAEAAgAAATEAAgAAABQA
+AAByATIAAgAAABQAAACGh2kABAAAAAEAAACcAAAAyAAAAEgAAAABAAAASAAAAAFB
+ZG9iZSBQaG90b3Nob3AgNy4wADIwMDQ6MDk6MjggMTY6NTk6NTkAAAAAA6ABAAMA
+AAAB//8AAKACAAQAAAABAAAASKADAAQAAAABAAAAZQAAAAAAAAAGAQMAAwAAAAEA
+BgAAARoABQAAAAEAAAEWARsABQAAAAEAAAEeASgAAwAAAAEAAgAAAgEABAAAAAEA
+AAEmAgIABAAAAAEAAAq2AAAAAAAAAEgAAAABAAAASAAAAAH/2P/gABBKRklGAAEC
+AQBIAEgAAP/tAAxBZG9iZV9DTQAC/+4ADkFkb2JlAGSAAAAAAf/bAIQADAgICAkI
+DAkJDBELCgsRFQ8MDA8VGBMTFRMTGBEMDAwMDAwRDAwMDAwMDAwMDAwMDAwMDAwM
+DAwMDAwMDAwMDAENCwsNDg0QDg4QFA4ODhQUDg4ODhQRDAwMDAwREQwMDAwMDBEM
+DAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM/8AAEQgAZQBIAwEiAAIRAQMRAf/d
+AAQABf/EAT8AAAEFAQEBAQEBAAAAAAAAAAMAAQIEBQYHCAkKCwEAAQUBAQEBAQEA
+AAAAAAAAAQACAwQFBgcICQoLEAABBAEDAgQCBQcGCAUDDDMBAAIRAwQhEjEFQVFh
+EyJxgTIGFJGhsUIjJBVSwWIzNHKC0UMHJZJT8OHxY3M1FqKygyZEk1RkRcKjdDYX
+0lXiZfKzhMPTdePzRieUpIW0lcTU5PSltcXV5fVWZnaGlqa2xtbm9jdHV2d3h5en
+t8fX5/cRAAICAQIEBAMEBQYHBwYFNQEAAhEDITESBEFRYXEiEwUygZEUobFCI8FS
+0fAzJGLhcoKSQ1MVY3M08SUGFqKygwcmNcLSRJNUoxdkRVU2dGXi8rOEw9N14/NG
+lKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vYnN0dXZ3eHl6e3x//aAAwDAQACEQMR
+AD8ApEsBc1rCHEA7gD+c5273AfSUX33sDfVY7f8AS0iNA3d7v0n76J+zQ7i2t/h7
+W/8AfNqKzp2U72sLT8N4P/QepuEtbjC5ruvs9oLj4NEk6WNW5i/VPqtmMC51dT3t
+BDHaFpjbt/O8FZ6WMXplDXQftbwA8udv2/1JXS4djH0NcHAl+syoTluVD7WxHFUb
+Ly3/ADTzmMc0bXOAEEaSfzvcqFnS87pziMmrbW+CLGmROohzl3GRl10yCdVJj6Mm
+stIa9p0c0wQkMgurtRx6XVPAbgGvMGWw7wB266LMx2B/qMLA1gBLBzE6ua//AK41
+dd136vvprflYcOr131+7c1pH5kbty5KjfVZL9W6iSTpP/Wm/9UpeK9mIgjddhAF7
+Q8bmtBmDBJH0klBroa4EPcXyNxcwxrOm5zPBJFb1f//Q50fYC0jexrteSf7Lvoha
+PT8an1vtAcG00/pD7gZAHsb/AG3LmG5DnEe0ElbGRl47MYYtRO8AG1wES4JTmQKo
+arYQBN2dHQb1kPsL7T7nHTlWh9Yb6gPRc8g6OaDB+LHfvLDwaHWuFhEAj2/BbmPh
+MIBIUHCNqbgGi7uvdSdWHPe6yDo4gTHbd/KXVfVzrVF+Jv1e5uh2gB4/sH6S592H
+Wa4AUMPI/ZwsqsZ6lNnYaOHnW795EitQgx0e2q690/JsOMxxeTLXhzSyP5Lt8LI+
+sPTvsuJ9s6c1rmM0vre7sfova7+sszHsJb64eL9fba4Q8D92wt9y38ap2f0jIIf7
+ntcAABpA8/3koZZiVDVjniiY2Xjj1G4aOxmGOYd4f2Ulm23XV6myQJA0B1/d1CSt
+cR21avtDwf/R4MNuxLW+u11dldgLmkQ4fncFEtNgyHVmTY50a+ZVmnqW81ixrXND
+jsqs9zABztf/ADlP/W3LRysSrI6o3MY1oaS1zthLmyWz7S5Nn0XYgZXXTV0MGkNa
+1vgAFq4+0SHLCyHWUvAG90/RDNB85UGZ+aIfD2tcY2vAJ0TGyOz1EtGnIKhdi13i
+J1VB19owftI1IMEKjT9Yb67Gse0e/wCjAJkcfmo3fRJoO3bhPpwrDv2mCRH8VD6u
+davxcltQcC55DS08O/1/lI+LmjqGI6sge5pAIWN9VcUOy7Ls6W0YweQ+CZcwGPa2
+Xe1MIoaLJa7tbrdVN+bayktrpfkFrQOGhzi3dCSoW51j9zCxmpP6QAk8/S9xd9JJ
+WOPw6U16N34v/9LmL+k42S+cF7aLRuIxrHSx+7tiZT9u7/icnZZ/wli0K6siivHZ
+ZW6sta0WscIcHARDwVNvUuj9UxHUjEbjZdQfbWKdK7A0e+m2v83+Q5qDjdSrvqZX
+Ltzo2AmSBy1rif5KbLUeTJh9MiL+YOvTXXcPcEPIqrYNBqFGqxzP4IN73WgwSSeC
+FGJW2qFOxgYoswX1yCTqB8EGvp9Dn/A6rPxW5TNte97Q2CHDnTsrjbHVXEgyHan4
+o34IoXu7dFOPSz9EyHASYELBzMiujottmO3bbkO9F24AkifWtjT+UtnCyA+t5d+Y
+06rG6zlfVqy6vpWUX1iuXmyl383ZZ9L+S/axlbkhr9FsqjGXc6B5mpjwQdpIBE6d
+klfxfqjmZedbT9oZXh1PAGbYTD2kb2elU3dvdsPvSTtPmatm6rwf/9Oh076k9c6X
+ltzrq6jVW1zrHNfq0fv+9qyQKaswOja5upD9CG/mtH5j+V7LVmUmpxugMiHE6gz7
+dv8AaXC9e6H0a6+12Kx1LGncytrjsDhrNbY9rf5CRjqQBZrzUJAAGRoA7/1nOrLX
+gHsQq9eH6FztpNlZMhrnO08YITFzqONWEz8Edj67miDr3UMW6C3K6qngiuQSZaTY
+TAj+S1NTgWY7y++917n8l0AD+S0JsWmprp38KzZYCW1s99jiGtaNSSU6WyCfNHlW
+irAuYHbX3gVtI0Ik7pEf1VxOf05+LS219hsse73O7a+P8pd1kZeLgVtty8KnqGM0
+kvtbuNlLvovbbX/od3+EZ/bVzp/Vvqhluc1+DQKi0kt2kkQPpAf4St3/AG5WkBIa
+9OrFKUZWOvR5LC+sV1eK1rcdpqxwK2tDzMAbnO9wd/WSXaUdM+oua1zqK/QaS0A1
+l0bneTg/+qkhx+IpZ6arXip//9Spf9bs3PfjYe4Nre+uW8DQg7i7+StkPrtsdscH
+tgajVeattDbaiSdoc2Y8O66novXun03Oota6mszteSX6/uu/OTxkGOQFaS3PXwV9
+3lmxyMbMoHSPn/zuJO5m7cCC0tJBaeRBVc47Q/c0lh8lo5GTh33ssxrG2C1pnb+8
+zxH9RyY0Bwkcqoe4bkNgJCpDQgtWui4nSw/ctPp+PXTNlj9r3gsbYTqHOG1kEoGO
+xzTtLfmq/WnWuycDGpguFvrFh4d6bXOax39b3Ixs+PgiZrrXj2czPuyTUepUuNlQ
+ivLe3SeGtyHsH0N/0LVkvcaHC+g7ayZIH5p/eZ/JVrHzxXb6jBu9STbV/g9hGz0t
+kbfo/TVS6sYtwrEuxbhupJ7T9Kp39VSYZ6CMjr/LRbzHL5OH3uHhgf8AG/vSi6/S
+sq7I9SuvI9C4w8Ena10aOY535u5qSwqnnGvHdrTIB7t/dST/AGxx8X8ra3EeHh6X
+b//V4LOGLI+yF514eAB/J2wVev8AsHq/oC8CRpEgn8791zVzKSGff6fRs8h84+bc
+fL/3X9V9CrNBOH6Qh25vp7SCOD9o36N/wf8A01uV+lOnzXkKSght1+v7GTJXHOv3
+j/e/wuJ9mHoSsvqPo/tTGgv9aTs2c8O+ivLUk6Xyny/R3Wx+Yftezv8AsPo5H2Ta
+GSJ7nnWN35u76K0qHdGb0TIGTVXYzZ9PIseywu/N+y1UU3MbZ/o/0y86SUQ/aP73
+/ozeP81O/cq5b/L8sf579P2nayPo187p9s8x/KSWKkr32uL16b/R/9n/7RCMUGhv
+dG9zaG9wIDMuMAA4QklNBCUAAAAAABAAAAAAAAAAAAAAAAAAAAAAOEJJTQPtAAAA
+AAAQAEgAAAABAAEASAAAAAEAAThCSU0EJgAAAAAADgAAAAAAAAAAAAA/gAAAOEJJ
+TQQNAAAAAAAEAAAAHjhCSU0EGQAAAAAABAAAAB44QklNA/MAAAAAAAkAAAAAAAAA
+AAEAOEJJTQQKAAAAAAABAAA4QklNJxAAAAAAAAoAAQAAAAAAAAABOEJJTQP1AAAA
+AABIAC9mZgABAGxmZgAGAAAAAAABAC9mZgABAKGZmgAGAAAAAAABADIAAAABAFoA
+AAAGAAAAAAABADUAAAABAC0AAAAGAAAAAAABOEJJTQP4AAAAAABwAAD/////////
+////////////////////A+gAAAAA/////////////////////////////wPoAAAA
+AP////////////////////////////8D6AAAAAD/////////////////////////
+////A+gAADhCSU0ECAAAAAAAEAAAAAEAAAJAAAACQAAAAAA4QklNBB4AAAAAAAQA
+AAAAOEJJTQQaAAAAAANVAAAABgAAAAAAAAAAAAAAZQAAAEgAAAAQAE4AZQB3AE8A
+cgBsAGUAYQBuAHMAUwBxAHUAYQByAGUAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEA
+AAAAAAAAAAAAAEgAAABlAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAA
+AAAAEAAAAAEAAAAAAABudWxsAAAAAgAAAAZib3VuZHNPYmpjAAAAAQAAAAAAAFJj
+dDEAAAAEAAAAAFRvcCBsb25nAAAAAAAAAABMZWZ0bG9uZwAAAAAAAAAAQnRvbWxv
+bmcAAABlAAAAAFJnaHRsb25nAAAASAAAAAZzbGljZXNWbExzAAAAAU9iamMAAAAB
+AAAAAAAFc2xpY2UAAAASAAAAB3NsaWNlSURsb25nAAAAAAAAAAdncm91cElEbG9u
+ZwAAAAAAAAAGb3JpZ2luZW51bQAAAAxFU2xpY2VPcmlnaW4AAAANYXV0b0dlbmVy
+YXRlZAAAAABUeXBlZW51bQAAAApFU2xpY2VUeXBlAAAAAEltZyAAAAAGYm91bmRz
+T2JqYwAAAAEAAAAAAABSY3QxAAAABAAAAABUb3AgbG9uZwAAAAAAAAAATGVmdGxv
+bmcAAAAAAAAAAEJ0b21sb25nAAAAZQAAAABSZ2h0bG9uZwAAAEgAAAADdXJsVEVY
+VAAAAAEAAAAAAABudWxsVEVYVAAAAAEAAAAAAABNc2dlVEVYVAAAAAEAAAAAAAZh
+bHRUYWdURVhUAAAAAQAAAAAADmNlbGxUZXh0SXNIVE1MYm9vbAEAAAAIY2VsbFRl
+eHRURVhUAAAAAQAAAAAACWhvcnpBbGlnbmVudW0AAAAPRVNsaWNlSG9yekFsaWdu
+AAAAB2RlZmF1bHQAAAAJdmVydEFsaWduZW51bQAAAA9FU2xpY2VWZXJ0QWxpZ24A
+AAAHZGVmYXVsdAAAAAtiZ0NvbG9yVHlwZWVudW0AAAARRVNsaWNlQkdDb2xvclR5
+cGUAAAAATm9uZQAAAAl0b3BPdXRzZXRsb25nAAAAAAAAAApsZWZ0T3V0c2V0bG9u
+ZwAAAAAAAAAMYm90dG9tT3V0c2V0bG9uZwAAAAAAAAALcmlnaHRPdXRzZXRsb25n
+AAAAAAA4QklNBBEAAAAAAAEBADhCSU0EFAAAAAAABAAAAAE4QklNBAwAAAAACtIA
+AAABAAAASAAAAGUAAADYAABVOAAACrYAGAAB/9j/4AAQSkZJRgABAgEASABIAAD/
+7QAMQWRvYmVfQ00AAv/uAA5BZG9iZQBkgAAAAAH/2wCEAAwICAgJCAwJCQwRCwoL
+ERUPDAwPFRgTExUTExgRDAwMDAwMEQwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM
+DAwBDQsLDQ4NEA4OEBQODg4UFA4ODg4UEQwMDAwMEREMDAwMDAwRDAwMDAwMDAwM
+DAwMDAwMDAwMDAwMDAwMDAwMDP/AABEIAGUASAMBIgACEQEDEQH/3QAEAAX/xAE/
+AAABBQEBAQEBAQAAAAAAAAADAAECBAUGBwgJCgsBAAEFAQEBAQEBAAAAAAAAAAEA
+AgMEBQYHCAkKCxAAAQQBAwIEAgUHBggFAwwzAQACEQMEIRIxBUFRYRMicYEyBhSR
+obFCIyQVUsFiMzRygtFDByWSU/Dh8WNzNRaisoMmRJNUZEXCo3Q2F9JV4mXys4TD
+03Xj80YnlKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vY3R1dnd4eXp7fH1+f3EQAC
+AgECBAQDBAUGBwcGBTUBAAIRAyExEgRBUWFxIhMFMoGRFKGxQiPBUtHwMyRi4XKC
+kkNTFWNzNPElBhaisoMHJjXC0kSTVKMXZEVVNnRl4vKzhMPTdePzRpSkhbSVxNTk
+9KW1xdXl9VZmdoaWprbG1ub2JzdHV2d3h5ent8f/2gAMAwEAAhEDEQA/AKRLAXNa
+whxAO4A/nOdu9wH0lF997A31WO3/AEtIjQN3e79J++ifs0O4trf4e1v/AHzais6d
+lO9rC0/DeD/0HqbhLW4wua7r7PaC4+DRJOljVuYv1T6rZjAudXU97QQx2haY27fz
+vBWeljF6ZQ10H7W8APLnb9v9SV0uHYx9DXBwJfrMqE5blQ+1sRxVGy8t/wA085jH
+NG1zgBBGkn873KhZ0vO6c4jJq21vgixpkTqIc5dxkZddMgnVSY+jJrLSGvadHNME
+JDILq7Ucel1TwG4BrzBlsO8AduuizMdgf6jCwNYASwcxOrmv/wCuNXXdd+r76a35
+WHDq9d9fu3NaR+ZG7cuSo31WS/Vuokk6T/1pv/VKXivZiII3XYQBe0PG5rQZgwSR
+9JJQa6GuBD3F8jcXMMazpuczwSRW9X//0OdH2AtI3sa7Xkn+y76IWj0/Gp9b7QHB
+tNP6Q+4GQB7G/wBty5huQ5xHtBJWxkZeOzGGLUTvABtcBEuCU5kCqGq2EATdnR0G
+9ZD7C+0+5x05VofWG+oD0XPIOjmgwfix37yw8Gh1rhYRAI9vwW5j4TCASFBwjam4
+Bou7r3UnVhz3usg6OIEx23fyl1X1c61Rfib9XubodoAeP7B+kufdh1muAFDDyP2c
+LKrGepTZ2Gjh51u/eRIrUIMdHtquvdPybDjMcXky14c0sj+S7fCyPrD077LifbOn
+Na5jNL63u7H6L2u/rLMx7CW+uHi/X22uEPA/dsLfct/Gqdn9IyCH+57XAAAaQPP9
+5KGWYlQ1Y54omNl449RuGjsZhjmHeH9lJZtt11epskCQNAdf3dQkrXEdtWr7Q8H/
+0eDDbsS1vrtdXZXYC5pEOH53BRLTYMh1Zk2OdGvmVZp6lvNYsa1zQ47KrPcwAc7X
+/wA5T/1ty0crEqyOqNzGNaGktc7YS5sls+0uTZ9F2IGV101dDBpDWtb4ABauPtEh
+ywsh1lLwBvdP0QzQfOVBmfmiHw9rXGNrwCdExsjs9RLRpyCoXYtd4idVQdfaMH7S
+NSDBCo0/WG+uxrHtHv8AowCZHH5qN30SaDt24T6cKw79pgkR/FQ+rnWr8XJbUHAu
+eQ0tPDv9f5SPi5o6hiOrIHuaQCFjfVXFDsuy7OltGMHkPgmXMBj2tl3tTCKGiyWu
+7W63VTfm2spLa6X5Ba0Dhoc4t3QkqFudY/cwsZqT+kAJPP0vcXfSSVjj8OlNejd+
+L//S5i/pONkvnBe2i0biMax0sfu7YmU/bu/4nJ2Wf8JYtCurIorx2WVurLWtFrHC
+HBwEQ8FTb1Lo/VMR1IxG42XUH21inSuwNHvptr/N/kOag43Uq76mVy7c6NgJkgct
+a4n+Smy1HkyYfTIi/mDr0113D3BDyKq2DQahRqscz+CDe91oMEknghRiVtqhTsYG
+KLMF9cgk6gfBBr6fQ5/wOqz8VuUzbXve0Nghw507K42x1VxIMh2p+KN+CKF7u3RT
+j0s/RMhwEmBCwczIro6LbZjt225DvRduAJIn1rY0/lLZwsgPreXfmNOqxus5X1as
+ur6VlF9Yrl5spd/N2WfS/kv2sZW5Ia/RbKoxl3OgeZqY8EHaSAROnZJX8X6o5mXn
+W0/aGV4dTwBm2Ew9pG9npVN3b3bD70k7T5mrZuq8H//TodO+pPXOl5bc66uo1Vtc
+6xzX6tH7/vaskCmrMDo2ubqQ/Qhv5rR+Y/ley1ZlJqcboDIhxOoM+3b/AGlwvXuh
+9GuvtdisdSxp3Mra47A4azW2Pa3+QkY6kAWa81CQABkaAO/9Zzqy14B7EKvXh+hc
+7aTZWTIa5ztPGCExc6jjVhM/BHY+u5og691DFugtyuqp4IrkEmWk2EwI/ktTU4Fm
+O8vvvde5/JdAA/ktCbFpqa6d/Cs2WAltbPfY4hrWjUklOlsgnzR5VoqwLmB2194F
+bSNCJO6RH9VcTn9Ofi0ttfYbLHu9zu2vj/KXdZGXi4FbbcvCp6hjNJL7W7jZS76L
+221/6Hd/hGf21c6f1b6oZbnNfg0CotJLdpJED6QH+Erd/wBuVpASGvTqxSlGVjr0
+eSwvrFdXita3HaascCtrQ8zAG5zvcHf1kl2lHTPqLmtc6iv0GktANZdG53k4P/qp
+IcfiKWemq14qf//UqX/W7Nz342HuDa3vrlvA0IO4u/krZD67bHbHB7YGo1XmrbQ2
+2oknaHNmPDuup6L17p9NzqLWuprM7Xkl+v7rvzk8ZBjkBWktz18Ffd5ZscjGzKB0
+j5/87iTuZu3AgtLSQWnkQVXOO0P3NJYfJaORk4d97LMaxtgtaZ2/vM8R/UcmNAcJ
+HKqHuG5DYCQqQ0ILVrouJ0sP3LT6fj10zZY/a94LG2E6hzhtZBKBjsc07S35qv1p
+1rsnAxqYLhb6xYeHem1zmsd/W9yMbPj4Ima6149nMz7sk1HqVLjZUIry3t0nhrch
+7B9Df9C1ZL3GhwvoO2smSB+af3mfyVax88V2+owbvUk21f4PYRs9LZG36P01UurG
+LcKxLsW4bqSe0/Sqd/VUmGegjI6/y0W8xy+Th97h4YH/ABv70ouv0rKuyPUrryPQ
+uMPBJ2tdGjmOd+buaksKp5xrx3a0yAe7f3Uk/wBscfF/K2txHh4el2//1eCzhiyP
+shedeHgAfydsFXr/ALB6v6AvAkaRIJ/O/dc1cykhn3+n0bPIfOPm3Hy/91/VfQqz
+QTh+kIdub6e0gjg/aN+jf8H/ANNblfpTp815CkoIbdfr+xkyVxzr94/3v8LifZh6
+ErL6j6P7UxoL/Wk7NnPDvory1JOl8p8v0d1sfmH7Xs7/ALD6OR9k2hkie551jd+b
+u+itKh3Rm9EyBk1V2M2fTyLHssLvzfstVFNzG2f6P9MvOklEP2j+9/6M3j/NTv3K
+uW/y/LH+e/T9p2sj6NfO6fbPMfyklipK99ri9em/0f/ZOEJJTQQhAAAAAABVAAAA
+AQEAAAAPAEEAZABvAGIAZQAgAFAAaABvAHQAbwBzAGgAbwBwAAAAEwBBAGQAbwBi
+AGUAIABQAGgAbwB0AG8AcwBoAG8AcAAgADcALgAwAAAAAQA4QklNBAYAAAAAAAcA
+CAAAAAEBAP/hEkhodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvADw/eHBhY2tl
+dCBiZWdpbj0n77u/JyBpZD0nVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkJz8+Cjw/
+YWRvYmUteGFwLWZpbHRlcnMgZXNjPSJDUiI/Pgo8eDp4YXBtZXRhIHhtbG5zOng9
+J2Fkb2JlOm5zOm1ldGEvJyB4OnhhcHRrPSdYTVAgdG9vbGtpdCAyLjguMi0zMywg
+ZnJhbWV3b3JrIDEuNSc+CjxyZGY6UkRGIHhtbG5zOnJkZj0naHR0cDovL3d3dy53
+My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIycgeG1sbnM6aVg9J2h0dHA6
+Ly9ucy5hZG9iZS5jb20vaVgvMS4wLyc+CgogPHJkZjpEZXNjcmlwdGlvbiBhYm91
+dD0ndXVpZDpkYWJlYjcxYS0xMWE4LTExZDktYWVmOS04MDNmYjlmNDliNmUnCiAg
+eG1sbnM6eGFwTU09J2h0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9tbS8nPgog
+IDx4YXBNTTpEb2N1bWVudElEPmFkb2JlOmRvY2lkOnBob3Rvc2hvcDpkYWJlYjcx
+Ni0xMWE4LTExZDktYWVmOS04MDNmYjlmNDliNmU8L3hhcE1NOkRvY3VtZW50SUQ+
+CiA8L3JkZjpEZXNjcmlwdGlvbj4KCjwvcmRmOlJERj4KPC94OnhhcG1ldGE+CiAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAK
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+IAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAog
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgIAo8P3hwYWNrZXQgZW5kPSd3Jz8+/+4ADkFkb2JlAGRAAAAA
+Af/bAIQAAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB
+AQICAgICAgICAgICAwMDAwMDAwMDAwEBAQEBAQEBAQEBAgIBAgIDAwMDAwMDAwMD
+AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMD/8AAEQgAZQBI
+AwERAAIRAQMRAf/dAAQACf/EAaIAAAAGAgMBAAAAAAAAAAAAAAcIBgUECQMKAgEA
+CwEAAAYDAQEBAAAAAAAAAAAABgUEAwcCCAEJAAoLEAACAQMEAQMDAgMDAwIGCXUB
+AgMEEQUSBiEHEyIACDEUQTIjFQlRQhZhJDMXUnGBGGKRJUOhsfAmNHIKGcHRNSfh
+UzaC8ZKiRFRzRUY3R2MoVVZXGrLC0uLyZIN0k4Rlo7PD0+MpOGbzdSo5OkhJSlhZ
+WmdoaWp2d3h5eoWGh4iJipSVlpeYmZqkpaanqKmqtLW2t7i5usTFxsfIycrU1dbX
+2Nna5OXm5+jp6vT19vf4+foRAAIBAwIEBAMFBAQEBgYFbQECAxEEIRIFMQYAIhNB
+UQcyYRRxCEKBI5EVUqFiFjMJsSTB0UNy8BfhgjQlklMYY0TxorImNRlUNkVkJwpz
+g5NGdMLS4vJVZXVWN4SFo7PD0+PzKRqUpLTE1OT0laW1xdXl9ShHV2Y4doaWprbG
+1ub2Z3eHl6e3x9fn90hYaHiImKi4yNjo+DlJWWl5iZmpucnZ6fkqOkpaanqKmqq6
+ytrq+v/aAAwDAQACEQMRAD8ALBPU4OCryWJxO1czS5CopsTVx5OjxOalpoP7ybvz
+X8b+3zNDi54qjM1k4qp4aWlOm6xCULGEBHyw63QxwsCJV4jjWpYg8ak5PBeFeoku
+JGW2ZSyHVC1SDwpTTUY4Co1HPoOm/Lbz3thqTAndW3Nwpn1SqzzpS09FBhaapxmL
+wVJk6QZyGh3VVUOOqq7cKqkUFIyRyQTr40jiMi3Zr+eYRukitGQ5IHbU0BWuTmpP
+rinXoIrC2tnmXw5EYGMVejEUqG044Upxpw9ehzqNu7x35uBnxWPzOXllqYp0x2Fx
+lNkcpVmooN/YeCA1UNIlNFVySTJIrzf5pAEYFXb29fXCwPdTXd2Vi1UpgE9jetPX
+jnhTz6Y2y0luYrCKysy9yEJLVJUd6eQ9AOH5+XVpfWH8qD5T7h62oKyvynX+y83m
+9rYielwGbp6nG5rZuUgxUOMmxE89PHlsfkqGSPH008E5AlRJpIZkfxxkhCPmRpVv
+I441ZJI101AoCFAr6/aPl0OP6owxNYt9QySRSOXoa6gWJx5f8Wel6f5TvduExOVx
+cUe18xlYcTh3oslSTTUsuRrIGpjkqRcwtT4FnrWrKgfcuI5otBIjKsAtF3qSNET6
+Q+LQAlSKGgOTX1rT+delT8trI71vlMJJpqU1AJBpjyx/k6KpuT4xd5fGOuqaftPY
+VRjNs7khoqij3ViMicpj582IsvQPQZnMUiQUVFVyUjUiIjmORzp1WDaFEmz7hb3Q
+eAUWTBFcMaca+XDAz8+gxvO0z7WDeBfEgOpWoaqqk9tPOg4nA6Dz76lo6HdFc1Nm
+YqzHNjtyaVpRQ0Vf/d+eato46CqNZaOdqeVojKNaeNnLppXR7PAro5laOiLkHzPy
+HzJ/l0QmWJUEAYNIwoKZUUNammaKP29Eg6+wcWc/vbganblNjMJT0mTye3Me7NkZ
+sZNXyffZTFbihMstDPUQbxxbSSU4qXEixRF0gEt5ELTVZUaiowrSnA1AINPnn/N0
+oEazvJcFGZgwBzTyPcPlpr+3p5ws0UEXa2Mh3TStX4bC0Ne1SMJXpSZGsrqO0eTq
+xSxpCK9BVQwqkbPIscNvKwmKJdXEi3YMzajHUEqcilOP+D06TH9C4sVkgqNRGmvC
+h+H+R6//0C/H45RZIgw772DnWRR4pZtpbR1htWrVHNtefEFdTc+m3+x9zH+67ctV
+LxCD5UT/AIvrG1d9uKESQSV4Zr/Ov8+l3i/jp2bkFlxuAyO26xxDUVGjFR9h46v8
+CCGWqmhqMBveCuHhSnDftsXSMMBZS4LM22/TRhzeII8CpqAD5cDQDyr6npVa7r9V
+M0KWpeQLWmgE0HGmMkf4Orxfi9TdWfFPYuKyskOQm7r3Hh6Ki3Pkc7uAbxXai3lU
+rtmrr4JqykWuWZ5nDNNPGkwSZiRxjNzzzhd315d2NjcaoIiRrWtDk10hiTUcK8PT
+rKXkflW2trK0uLq1Ec8iqxQ4PDANAMH0/b1dz03uDDZjZGDyVNmKXITZuN8iZzWi
+ead5rFmZpZ5pCx0882uDYce98l7jt67TDFJfJ9Y7MWBYaq1pmprX7ePl0p5ltLpN
+xm/xVhAgABAxSnyFOs+/e2tu7ISeKtmjNREousj6EEjNEsURK3a8/lGmwufxf8Kd
+75ug2yVraGPXKBWv4fL09a8fl03tHL0+5qJddIq0xx8/y6n4XMbJ7U2/X46tptu7
+jxtWjUuUw9SKHLUsy6SrtJSzLKraWLBXtrRhe6sODfZN6g3aIyRyr468QDn/ACHo
+u3HbZ9ulCyxtoPAkfP8AZ1St85P5fmc2Pgd09sdKpQ5rakMWTm3JsuVdz/3i23gq
+rEVkMs235KCfMNmsXBVeP7mJo0lWA69MvjA9j2y3+dPAt7kBkHaCak54fIcePQD3
+Tlq2m+qurSiTMdTKAADTJocH504HPWvDsQZfaO4Hq8zHJX0EseUppKiszmShmoIM
+g9HURQ0VN/opxNTDRUdRSGVI/vWeeWR5ZW1ufZ8yEoFeEsePFh5gjOk4xWg8+PQL
+W6ignPhXChQMnTXyKnFacCR9nTXj62Skos7TVWO3ZlqzOLW0q5So3X1pkJqOnlyl
+DkIJaKDOZvAtTwQjHx+Old/H5T5GXWPa208KG2MZVjJQ4JNRXHmvDh0kvpWuLw3O
+uMLUHANOHl9vn1//0aaaQ9DSUNRTnc2zcdlDTZqLTV5DcVMs0r1NWMJkn+025jYI
+6v7GSLzxRSQxJUJdPQWJE4u9oljKm8QSUNcsK5NG4caUHyOeoyew3hJVYWDMgIzp
+U0GNS5PCvA5x0cb4+da7Rk3fH2NR5yjxmxuulG/6vTvChyEmRxtFjpJtuYdaeOsg
+kes3FlYokDRx5CHWXBZBGZFD/N292Vpss6wXJa4lJREVjUVxU8KaeJzToScobDeX
+G92813YqkMNGLMigauIA9ajhTh060fzLizm4q7LbtqWkzGZrqiahETZSonjhEzSP
+9v8Aa1lK0NKpPDA6W5tq59wdbWSxQOzgVIHz/b69ZIJBI8saRmpGT5YrTHy8h0Oc
+X8wveuzoKL+5OV3dWUlSXxuZwtFmUoMk8Eg/Zr9t5KZ5zQ5uiezRCo1B+UdtJ9Bf
+By7aTTmR9NWP8+NccAOje4a/MaoIjQV8uIHUjJ/PT5KZbA0WSz26dw7okp6yqp4c
+nk8DRU2TnwZliloZ8tFFUvSyZyFI2sCw0sWGtkKhT6TYLIRjw2Ooj14emT0WJFeq
+WYxBKGtOH5YHV/H8uf5nbJ7A6pOdK12cyWGkjo6mLbuLoqLe1G4gRSq7Wra5kyyS
+hLQww1WqcowgRmBj9o7B4to3Apca9B+GRaa1b5V+IfL86dFW9W099bgQhRSoKPXS
+wHDPkeOafKvR6ds/Oz4/dqbhquq8RlcnuWurKevwu46LObZyuympGm81JW4nK0uf
+Sgngq1hDCRU4BPDXuAe3PPi7dcW8MkTyxsQCzARkE8K8Rj16IIuSr26trm6qkaKC
+dNfEqPOlOP8AxfVd/wDMI+Oo6k6mbuv4xYnA5nA7amFD2ps/eO5JzLFiq2eFMVuD
+CZKKbwzquSlSnnp5g7+uOSI+lx7lfYOfkvV0qY5JS9B5kNSvFa0FBT06iLmH27ij
+DvGHtjo1NSulkrk6W/EK1+z7OqPZPkJu+OSSnyfSuz8gYHnjqRR7pZFBpI/JUhZa
+rB1UTyQpclCyuQrEAhWsPhv9xXQ9ihkPofTJ/wBR6jGTlkAak3J1QUAqDnVhR/q/
+w9f/0tWGh7ArcjJAHw2OrqyeTwRrGtSJ2eSRUhhaKEhZpXLWFkNz9AfdzYwICVnK
+imcj/D5fZ0TLfXJm0eCC58qGv7OrHd/dtbAwPW1N1JtKtr489SU1DVdhZ2mo48Mu
+Tz9BSLJUmpSeD7iSpoQDSwvyywq3qHkk1RvPrub0yTD9IEhRWp40qPt8/wDY6kmx
+iSO3XS1GABJp/Ppl6M2NXbwyFHuipp5Yaato6afGxToWkWjEgjuf7OqY3Y/kg3/P
+stvoJIGNvTurmn8q+v8Aq9epU2Ea7f6pqnUAP9XpnPVqXX3SeJqIYKipo6d5LqGV
+o1upvqJ/SACQf6fT25YWhcgMTq8/zr/q/l0IZ5kVa18ujFV3T+3qnBPTRU8Klaco
+qiNVRmY6nuLWNmPHHs4NupShB4f6v9jpHHIAwqgKmv5V6THTvYcfxoi3ltPc21m3
+RsLdkZhkpcZUQYjc+JaoZ0OS2jmnp5loc7jahlqKaKZJKSqdfDMl3EiEFzEiSCSW
+MNpPA8DXGfMH59FO97a0qRyWThWNa+n2Eeny9c1x0ZDYW4J6jHydgxbnpeySa2F8
+VvrN4f8Ahu+qOhSoQUeJ3VX4yrjyVXkKWkCwN941YmlAIXXSUAN312um8FYwY6im
+O5T51pxH24p6dObVbCxiVmDRkfEtaoR6qPL8qZ49W79cbVrfkV8Re4potzTR5Dcm
+2dz0NLjcXjcdFPjXose0ypNNXUzVE9Vk56UsHm1xheUOsagf8ibRLKxniuHhuoJQ
+wUYrw4nj3ZHnw6B/OW5QpdR2slsr200RUs1TTiMDh24+Y+fWm3uTd279uLJXTbqj
+mpMfNkKWleLHbfrY4q2GKZ3xoqq3DQwpOYItMg1u4S11KsL5D3kG8bbA89zejxEY
+ALpzpbt1DFdJOKmgOcmnUHJYbPcyPGlmTE/GhNNQFQCQRkUrQfLHX//T1MaXG7v6
+g3Ph133htwbS3JtPf2DrMli8pjHos7RR06wZWkqVx9fCoqaaVFWWHgxVCAaGsQwc
+lVvpnQpxJHp5cP59ILcQvuhdHqPDDfzAp8ulduafOw9gZjblWaybcmX3TJiZUqIJ
+6epkqctWeWoqpKOoL1NOxikHpf1oCRx7A9vAy/qA0Ra/yx+2v+fqSrTS4W3YDU5U
+Hz45/kKdX89JbShxWMwmNRFJoMXQY+SVuCXhijWVyT/q5Be3tHJE11Lqpknj59SX
+YhY/BiDgRqv/ABX+Do/fX/8ADKFZ6TI3jkacCOXR4wsiqBo+hB1/Ukk/4W59mFvH
+HEQGGkHzz0a+F46HRIC44ivEdDH91QQSR0oeGWKaNm8g0h0VjcFtX+pAJ/wt9Pah
+glKVBHTa2zolWXSScD/J0kt29XYHfdM1MldC9WpDxAqksbXC3Vx/aUcXsRz7Kry1
+WYEKakdWEb2qBpVIU+v+Dpu3N0vmNjdMbrmXPzYupixVfk6WSnijWBo1iI8tdUMn
+3M8aKvAd7Aj/AFrECbHA14WlbiDwwOH+Dovv7uRoGS3TuQU/4rpNfy6vmfvXqnsr
+C7VpMnTZDK5/KUO3qzGZAzS4zcJqJYoFg/yeopkGRnSQtTLWJMjav2XVi0T1vJ5N
+n/x7bzpuFOCK5FKaT6/6jjoFzWiboBFeVZD5+an1/l5fn1Vv82tubT3/AN173wOy
+6rC7P2LnfkVlMLiKCmqIYcXt/G53fGUxdHkosc1U9QKWmiSa0knjUoFQWFlGRE8k
+jcsiO+Ym8eOByxqdPwagW+WoEL9pPUV7pJafWwGyQaYVkVhRV1kA0YBclqqwLniK
+U6//1NcrafyTXLT7UotzYjbWaw9Pm647Z6/7DppdybGxdHh5Jvvp8Pumomot39aR
+pApMhxFbRxPJM8hgbkAyeWG5ijWVCGKsTXOQTkHjQD8ugrD4kMvixkUVlJ/P/D0c
+zs7qna/ZPyexHdWFxO36DFZCs21nMrHtHMZncO1pK+v2jQ18UOByWXpaKvyGOgqt
+CwyVESTmOwlu4JMXeK0M97aJr+k8QgEkEj1JI+fl1k/tXL0U3LfLm9tpF3IniMQC
+AQWKoKVxQAmvQz9hZLO7Ly1JFSx7yyEk8cr4yg2zVU2LoqaaKI1CvXVlYhgeqqSo
+SJWDkvYAAG/uoFy0pjVwiHgfWn+Xo1e2tUhllMLSygVopyaCuBiny9T0k8N3t3LC
+mOziU+98LjMlkKijOC3RSUFZkjLTRwSyVEv2lPDNFSVLylI6hlRGdXC30n365W/j
+j1eNUfMcOvbI9vc67s2lzbspAo54jORnqwWs3ruil6STtalElVPTVVPj6ikKu0ka
+v+wsIQam1x1Eh1G1j9Px7aEF2bRLnxBWuR8vt6EtxdxxSsrCqMgOP8PRYto/zBN7
+7azmCwmaxVLbcZZsI9PgMpXDJ0oqqmhWSJcXBVzRuKqlcMrGMgKX/SVPtTCb8xqU
+RTXh60GOH+z0Dt13G0ivore53J1kehUaGIzwGrhX5/t6tx6z7npvkl1Hmts1dLjZ
+Xym1srj6GrxZqJKWqgqaWakmjlFSDNDWQVFQheO/05UD2mWZ3mcMoBFftp6H/D1o
+RSQPpMusNQ1/wfl/Pqsr+Vd1hBle2d37375irMP1309iOxMnT7nmw2Wzi1ef2PiM
+rNRRy4bCU+QzWSpMLX0iVMjRwHylFiRi7WBPeqkm8WVowJgZwWX1IBNB+wV8uiq6
+gurTa7y9WPS4oobFACRnP9GtBx6rh3T3jnc8c9gq3a2xdc2RrJ13ZR0OXr6+Xx5W
+aobK0UWUy+WxxGTCl2EkLWErcBufcgm8vxDJD9c7QtxUkUNKUrgEUpx9BTqK49vg
++q8WhZoziuAAcmlMZJPX/9WirfHxL617NzEM/Qm5ML1tvOE7xqaXpXfW7XyOxt7T
+54VVJHQ/Hzv3cSYmhzFdU1AWaj2xvQYzNmGQQxZHJVKPGFnguBGsYP8AZv2HLgMD
+keTAE/I08ugeG8MSLk1p54weFTw+w4+fRwMDtrsTYeC6gwW5Nq57Z02D25t6k3tt
+vO0VXj87h9wUeMo6CiodwY+tpqauonnSMMokQFLAH8Fo4v0AluJX1KFYmhx3E0pn
+z8+sw+Wdziu/b/ZoWp4iwquM00sQf9Xqej6bS25gd6UtstSQySRxxGOQszeSRALX
+KaHUg8AqQbfn3qGaKZdDqAB/kp09b2UgK3MZJUfl+fSQ7A2ztvA08SUmPpoqqB/Q
+yK5kTUjErqZ5Xk4UkXNhbm/19q2AWMRRkaWyQPT/AC06XPZrGTPJVy37Py/M9HC6
+H6xo9w9H5/bprKOeeb/clBSsy6nipZkrGp4ICxMkjnkm13PtQIy1qVDAj/UOkswZ
+WVpk7ANPDGf9X5dBXt74+7Fr84ojv/k1YTUCnNLKEmRwkrItZDVCLV/tPjYDg+0u
+SAVkZTmtD08bQi3E2gaTw1Cp/I+nViuy9pbA2Ziok2vtxKTJ0lDPUVSUNBHQpVS0
+9MZVneOJTHUSER3JFi+oc+y24ZImCjDU4/PojewlE6AyDwS3n8z/AC6qd7k7CwXX
+3ws35uXrbCx4zePamZqeo8ouZoMXk8hWY+XMxdib4moY5sfPTzV4x2VhppJKRaer
+o440kilVgQzW2Qi53GK6SI/pI4NRWrvTz+wH59G3udZrsPLFhtEtyPqJLwSgAgdn
+hlMg5oGFR5H8uqPNr4nKUlXj6v8AhGaqaaDIUM9TGmNmEk9NFVQy1MQaaDnzQIR9
+eSfZxuNrd3ltd2kSlJZYnQNQnSWUgH8iaj7OoBaS2aKZBcIpZSoz5lSAcdf/1iG4
+35JfED5a9SZjZdP8edv9P95bKot89obSo+qnkwXW/b2LwGCqqncXWW+9q1NJNFga
+7G0Ua1OLr6JQ0cRnjkdvLJN7DVyb3l6WG5ineTbJJNDh3JKBsBhU40kDIPDiDx6O
+DaWXMNtNGEEe5RxFkCqArmOuCR5kE+X59B/1t8jcB2DtXbO33q802QykOPTb9DlK
+ufL5HH4SGClrsHicrkqyomrp6ahw4RKWolURNHF4VdnhY+682wpbSLLEC0cqKfzH
+ma+vQ59sd6gn2G62O5NLyKXUh8mViNSn0K04/Po4O1twVuGZoyLELrhYOFCegsde
+kEqLck24A9xsby5S40Mua46niymtFslUU0Uz59BzvbNZDdVLW/Zz5WprqyoaOGtx
+aTL4EdTBIqMoKpCFkKhzZtR1Aj2JbaEzwO8kxBPpXHy/z9JH3FBKiw2hbSeB+H9n
+r09dX0PaGIGJ2w+5N94SDF1GOq4ctRGKevqY6KoM8tDWVElIyzrUqul/QjsPo31v
+aG2naRlaVljOcYpT/L03dbg0cIc2YcKxqpzxwPtH59GPxu4cjtPd9fWUVZNLQ5Nj
+WVkMzOJaWslkLTSlfSPHUuSxFvQ9/wAe2b55bOd3VyY2P7CfM/4erWV9b3VqbaRK
+OvCv+D8v8HVhPS3YdPntubjqssyqMJtvITGeVtKrDFJCqnyE6VNn0i9ubD2lE/1D
+RVrQt9lf29E11A097bxQVLu60p/q4dVr/MjtT+W1uHduy/iF2vV782pSbOXK7nyW
+7uotxtBF1X2Z2jNDSZWrqY5xWYfcsWK25t3D1xp6qOSrp/vJIDNGGkHsRvZbvHaJ
+ebPKEBqzKQCHPADhWhHmPn0AOfN027dd7m27fZjNLAiorhiGWoBNc6QyGoIyMA04
+jqurrD+Uh273D3hv/ZJ7f2ZtHonY+66PF03yX35kNwjD7/2llMTQZ/AVPX2xcI2V
+r905ePb2RpajIIs0FDQVEq00tWsnp9mO1blNuNpHLBFpn+GTUaCNhxFPM18vShJF
+eoW3LZpLDdLuzWTXEKMj+TIwqCAPMg5+YNOv/9cpfx0/ko/OH4kdq4nvze20usch
+s3Z23N1ZfeGSwnYdJFWbLpFSCrXc1PS5/CQkDH0tI0c4hWRXppZQwKkxuk5p2i7/
+AHPLQKzArQBga0IweGCel3LG620W5ozhkiKMCSOFfMD1pj8+q/YqfZu0e4qLIpBL
+hMvh1nrqqg3LU0+CrcZg6lZaXGYnHVdPKm1txU1VHkKYS+JIKj7hIRSoVkYe1O7p
+b/uh4dxTRfNbAKKZLgA0A8+HlwyT0xywbqPmBL3aonl2+K41uRkJEW0lnP4RVhxx
+UgDqzPbs2OzENBVqw+1rKN4mYMNSSPH4/Vyb6Rcc29w2/hSTxlVqafsHWTkT6UY1
+7CB/sfz6Bvb3UcfX+7cn/D6rMbq2tkapqynxe4t2blQYepnl8lemPyFBVvU01FMz
+kxRyx1EVOzcLp49jCCK0ngirIUlApUcDw40/w06U2sNwXdLa+aGQmvdpYV+WrgK+
+QPDh0dvBbV21moqyh27HmKOsrKuSoxNTkO0Nw1iYKgNBBDBTRRYzC0dRXVEeQDuZ
+XmiDRto08X9mMVhAwJO4qFpjJJ/ZTP2n16rdjf444vqd0iKqKNoiSrGvnUkUpThX
+5dQdo9B7h60ys+X3z2duLtHK55JWr6zNJR0mPxuklqTE4THUsN6ahpIZNOqWSaom
+b1SOTawf3iOPxY2iJMWmh4ZNePRfBcskckRYmQsTqNK/yoKfLy6Vnae5odo9DdkY
+OizE+FzPZNJj9i4itoaqpo66hetro8xVVlBV0MtPWU01PjsRJeaJkeMstjci5UZR
+biKUAMUbgcg+VP2V49NxR3F3L4SXTRsVJ1KaMuKVU8QQSOHWsF3r8dcp1Js7Dbsz
+m7Mjurc+4N0TwZXNU7VVVjooKmmrqqqNfW1Sy1s2UqqkROZpWuxL3FwPY42nfX3C
+5kt3jSK1CUUYrWuAKeXHHl1E3MXKf7p22K+M8k+4vMdbZppoSSa1Na+ZOerJ+l/5
+iO89vdWYahoupMBXbR6loMT19isZT9h52DI1WPwlFJk8vkqSLKYjKpU09Tka+prZ
+tbPKxqDcsFX3q4v9v268ttrkLCVxrLAdpZmPxN/Ex+3AHRftvLm47rtV9vkRT6eG
+TRoLHWQqhiVFOAB4VqfLr//Q2/8AavbuzKvamVrN8x4ul2+KF6XJ1WVpRXYnIwZO
+WPGfwapiq4JKSuXKtUiBaYq4qDJo0nVb2c8zwWu0xT3txdqLREq4Jyopk0FSf2dM
+bBBd7vdWu2W0Oq7mcIle0EnyJNAB8zinWqX87fg98N97713vlep9q5/YWGxFbJn9
+vbT21umvn2Bh914wyVzZHaeEloIqbFYOvr6aOcY8M8KFmWMIulEKoeW+bN+26K/f
+l+L6JImeJprllkCkYMUSISQVoQZGGDSgHV/9cnb+Sdx3rlTZd9CW13IkN4VtUYy6
+SpaIyuzaVjkqv6WCw1kmopV9VVuU2HZ4knq8FV1D1b6VaR8aZnL1Kqqkk0pYlhpF
+15H0+kOSRhLlXFMVFOsmbUtJaCLirAGvH7K9C7g8xgN64+h+2rkE0iutQqTLFIqr
+qXWWYgBgAGFufZ/ZRxFKk9p9OlUU8xUgINXDP+r06HnrHZu2cfWCZt0TpLTs8yRS
+VbaNaqGPmkBVWR72Ckfi/wDj7MntoGRhHOQwHCv+XpMxufCfXGCK/wCr8+hm3Fno
+q2pwe18Ks24NyZisocRhsNiw1Vkcrlq+qWKlgo6dSZZfK8gTU2lF5YkAE+yC+dYw
+VaTNftPRd4lJRMRhRX1wBnH+AefXDfnavWPx1wGG3T3R8Yelvlp1NhMpWVe4+wcF
+U7lzPYfQm5apaTBbhxHYG0YK6iSv69jylA1OMzi5Hip6lClbDTuYmkFWz7DZSWca
+XUKvK9GqcqcYFfKgPHgeoy3/AJj3GbcZpraaSCJOwKpKtQHJI8iTkjy4dGS6A+WH
+8ofuTJZjHZv4s9A02zq3B1dfVYWLbG4q/K0FTjscals1jcc8la289nZMKwrUpYv4
+xhyfO9LU0ayzwpNz2G42KOe9g2aK6sirMFQUkRgO0UrRkJGSKEVrnpXBvFhvuzQW
+MXMF3b8yQM+sTyD6e4hJr2YBjmQVGltSTDCsrdpFbZfxr/kWd5UOVrtgbQm6vxlV
+l9q0UNX1/nt9Lip90bspnBgp6HL47cVDEKSvgmonkSGKmaOLUwCMhIRi3natznC7
+psd3aSMkR1aj266BtRJpRXJCkcQCaDHReN6u9ktLRNu5hhmLmRnj0fBpcqpyKkyJ
+R8HAIHX/0S9b5/m49z/IfLdMdH/xmhxW09y716xWpxUDClpFkxeWxdeMpkcxJUpe
+LDR0slUNDwxXQ3v7OZ9j2y+WW33VkNtJ/atKaLorqcsaig0g1zkdIrXfd3s7q3ut
+mhkbcIyfBSIapGkoQgQUJJLUpg16szgzGB3Znc1JgMrR5zENQUBeoo5qWviaoXUt
+SY6r9vxM4Y6uCPzf3NGyb5tHMe33N1sO5217tkZMYkhLaQyAApQVGAR6GhGCOsdO
+ZeU+ZuTd2gsOadou9v3pwJWhuFXWUckhwTQgEg+vmOOOqxK7FLlf4tT1GNq8bPjs
+xmMVU4yvi0VlBPjsjPTGCoVGZCTHErq6kq6OrqSDzhZzFbNZ7lewaCumVhQ8R3Gg
+I/1Dro3yRdx7vy3tN6sgfXboag+emjD7aj7eghl6+x9JlTX4yvrcBX3sz0jaaefn
+gVFMytSyH+pAjJ/PsNpuEkeFkIA6GQt9LkoBQ8KdCFtzZG86yoD0m9auISE+QwUd
+LHPL6NAEREk6RrpH5Rh7WR7tPJhJs/6qDpmeExReCyfpnP2fn/k6PP0D1/tzZbVe
+4Nz7kqMJnM/RZHaeJ3hkK2D+JUe49x4iuxm3oaCvyKS0cFUclLGygp4gsbal0g+z
+/ZNsXe72KzvrsQwyKwaQkAIukktU4A8vz9egTv253exWcm4bHtz3e6xPGYYVUu0k
+mtaKFXLUyaDyHp1TH35u/sqq2tkPlDsnJZjc+0ccMTsj5AZ/BkUsGeiNNjsJge4t
+x7YoNK4Gtz0E1LjtwRskmPrpRS1asJZ6mNNe1vPKy3T8tbjC4WLtjcrVGKEoQj+Y
+GmvdRsedQem/enk/bIVg32yuILfmK4AlurRGIKNKA5KLwAVj3Kp4k6RRT1XzmMnJ
+sOtpN+7ArpMftaqqKeurKXFTSU52tk5pFaHOYGSJllpsTPO48iIw+1lPptGbJPaq
+IhVSDFkkfbw/L/B1jU0jSkxuCswpQ8K8cdWC/FbtLdnZD7r2vtrt3/Rj2BkJsbvK
+hrJ8nJt7b27lwqRUecwGSzVGirianK4uQVVFUSaI6Wop6gF1WZPHFXPnLtjHbz7w
+kR0BdIVV1sGdsEAkAKta+Wehfybv9vse82FxdbJBeaSxZZxqSiiqYOMtVXUjKkGo
+I6//0tTCh3PHQ7q2PWVs9RFj6fObXWtNGxSpjoZqujpq0w8Mschp5nAYA6Sbjkez
+vfIxPtV/C8WotEwoTgkjAPyP+Dp7kq6l27mvly6ju/p3ivIyJgNRj1MF1gZB0A1p
+6jq+/wCFvzx+P2zN6ZTr/eGIz3Xe2aqPKSYjceUy+d7CFLWRzJNT4vOtV0Mmd1Gn
+LKk4jkWyKGA/V7inkrmbeOTL3e4ttFsNi3GNS8EztHGsqgqWjkjUlCyUU1Wh0jIO
+espvej7u+8+6lny5c2XMcu/897Wxi1mKOGeSFu+hEjBJNDd6qXqAToJGOje9hdjd
+R9h7229uXrLd+3910G+sFkoZ5sMZKeVM/shqKGtSuoKuGlq6XIT4DK0rNHJGrmOl
+YkAC5DUc8e4Xm5Wq2xRoCHP+M/VAiQkdrlFIVadqmpFePQL27lvmj23u4uWucLGW
+13BlEiJJEsJKEAagEZ1cE1JYUqScdN1RsiLK05npYkaYKWKBbM31U/W/FueeP9f2
+iurUMp0rQj16GUF+FcBx2eR+zp+6+xGRxtUMfVYqNo1lOiqYOJViNvTYgLbVx7Ys
+da0QxDjxpx6d3O5ikgQqxqRn+Z6CL5p5Dddf2T8RusdkpSVWUg7Vqu3KvA1kbyYj
+cLdabQ3BmsbtjLJHHKkdDm4KespmmeOSOmedZ3VhGfYui2Nd+2vdNoeoS8heM0JD
+Baajppmo01p50p1HW4b6+xyQbxBM8dzBKpjdSVIkY6ENRWncwHzrTz6qL2F3pBtn
+dD7kw9LPm13Sa6p7C2NJUH/RrJsyux4wNRsmr23VYlsHkaGswtXKuSaoiqKf7upR
+KRYvtomUIxtYctWm37Xt5asDnvYBnY6qgGtSc5JrwpXz6yR9t/u/7t7iyXXMnufb
+rFc38Qa3ikZgQkdQ7VRgwloKheCgHVSpALrvDblL1Hu+i2/SPVZXp3selqsx1zXZ
+IvUQYqOpkl/inXuUqZC6VE+H1eKN3bXU0jRSn1M9pt5J5pTeoGs70Bb1K1A/EpyG
+HnTyIHmOscvvE+x0/tPzFBc7W01zyjdoGglZSND8HhdhjUpyhOWQ1yQeg72tm6vq
+/feP1xHIY3F19JlsfR1LXTMbbaq/yvC1er9R8KvTPe40lWP19i66to5YLqxmXVE6
+kAnhQ8OGcH/BjrHUl2VJAKNwGc16/9PUl70i6uSrgfp6t3tUxtXSWp93YvCUWOgp
+wtGcV/B6yjy9fkKpmrS4f7yCFlgCk3cuqi3mAWItJjt8kxh0dwdVBB8tJVmrmvED
+HRNy99QdytvrRGG8aP4SSPiPEMFH20P8ujTb3ToqTdTP17Ub4o6KKrozFTTUdLka
+Ktysz1EuTjhrauuxWcxdNj5z4Y3FPWQVkIEwWmJNOMfN6KtZxEqF3Sjawp1IRq7a
+EhADSlRQ0NaE8eumHsUefI9xtBuK20vLRlTQZiYrlTitFjE2pTmgLIFFKFurVtuy
+bKmqfjo20qOPH16bg28uy48PkqLMY6eRcRkf9Lcm6J4MTgjSNLs41OtDHMyZFYbu
++qPSD+V/6xrf3xsdD2+l/FE1ETTUaaFfEbj8J0/lTqHvdyO2Hu3uh5rvL1t48eXQ
+PBCxiCj+H4RM7EoMacAE1qBk9Wk7eG1fuYzA8hF/3leOEU+q5vpdZS45+npt7Hs/
+0viNUmlfQU/w9AYfVeCvHRXHHV/PoYaIbI8o8bR+T03CJAUvbm7eQP8AX68e7H6S
+i0/1enTcn1FWqD/OnREvkOuzj8oOkzTz72Xe/wBzlP7vLs2ljkyuj+7eb8/8McVk
+cYg+y8n3f3K/Y/Z+b7n9jyeyvmn99fuZP6t6v3l4sXh6eNfFT08vX5V8uhLyWdqF
++/75W0Nr4UlfqiBB8JrrJBOr+DSNerT4fdTqoffDdJPs7uEdPxYGnwH8QxYnaWoq
+6zJajuHRXvjky1NQ5P8Aga5tKqSgWRtDRSQRysBGkksbt9d9VaHeAf3vVqhf7IfF
+TS3xHspgqPKpyaZZcnn3PX3k5f8A6zq7ctizvPptJCqTo7w+gPGprUOy6mpqIWtV
+6OtsXKfDug+FfbtF2ZsfrXdm34toEybm7+7T7P697Hrt2yxQ/wAKXozY/VnTvZ21
+sVu+hrSn8IaXcNZWVZV/uhT07SaTtzP/AFh5WXYFvP3x4y6mU9hH9JAAgjpg1kOM
+0rjou99191pNg3WX3Lls4vaEsn6W2rFKq/77Dz3Lw3jzlviP06IHoEUrnrX/AOwA
+gx20hrqnyyVtSMQ9VFTx1tTgwtnkzcVPNJBRVr0pgMyQPUQrVAhGZTqGV7+Obe2+
+rCifSdWk1WtM8QMVrSorw65XXIsRdXgsGdrDUdBkCqxXV26wpZQ9KVAJHHPX/9mI
+RgQQEQIABgUCSvH+twAKCRCyvrxAFSkkr7RwAJsFbGcXzq7Dlj/5fvyGG20oHQ71
+zQCgskn1egtpBybXwtADPQ1OSan6GXSJAhwEEAECAAYFAks9yegACgkQ7Thz9dMm
+JyIL9BAArndUyab5gn298I0S15DSvd3g47AlTFXDhoq3yDAWoWi/58se+dq4Dpjb
+entEm8gjsN/La0U7VtyVgQHV2fO3ErSnFAkRAJfLf+6//u0dMi0mKQbPUK8Z/Q1a
+Dq97WyP+28CaFFEj7s4gB2MQgH+kmlok5/IE6mojFbHHMtJG3GFost5cfAKUt7G0
+9KJmZOj5Nh46LGVogoHdYhRpfW57avrQh5HfIbegOUnE6oxn0jwWPNrHzMPpFwcC
+BU4wmXbCQwENqVjgfiVkkAP5ICzR/sWBKPlc51XYiwPIal4tKg96zZlezeGEc2wK
+HI1i+aQmlVuKFzA7vQzjHf/RFinXDauB/xB9anC/z0yF8hCpr80LZ/92mLWuG4Nq
+FJGfIA/DDCL6uXhanml8Oz2UbHwphCVmaJgb9fetGfNNYmfDtpxGzh/kOOqA7oj7
+aTqfT96zHD4L/b7n9SXfe9elttgDbjz0WFDyLmY1Bsh1kch+b3kCfHBqJgaiAppM
+4TDwiBLXu/+uI9b9G3Lt2yw3canz1Wi5mHOfa3bSf5ctvTRCLkLyy8SdE9mg3FZZ
+hizdXqNSVO2Ik2YsfdbI4PIQYGtrFY2U1BlMe1I6z/2mDZ1kLVGEqh9C+NENg/KY
+CFDNn2GLkNo4eHcThdEAPUI4NLRVUWH18wl+A1s9ak8032jP236JAhwEEAEKAAYF
+AkslRjEACgkQMXxt+Dx3Bc/GwxAAmneII98fueCMyxS8u65PaGmaRh+xZiAN8BAj
+s55aKs5K6KHTOUTlTdSzfIYDtywzQp1B1dM5fNlyk9/zAwYSlBa8KGXTKgQjx4U8
+Ge13Md7nCDDgZQHJCXcpPW/w9zWJ/VXGBaxV3AEn19Y2LeSim6B7GXG1eiKiHypn
+Su2T/lLlrO3Mn3VYhSP6j2ZFQc9ryD3RhEICgfcsxdo7Y/tWRTWc5HfsvDcw9Vn9
+LHIUURANnMlnMjyy3aQZMH/tA6/Im5arNLU2ApcEkX9kPjBn+eoKEOGYuOhvnV2s
+YS6qxME9D2+Xx6ykmk4r/D7iUEnyNdYf7/euQG8e0NXeeygR7kliltzMXF4iAM7c
+wwcMRvFiYUb4ML70IZCoZcUvxGbVbnvqoAP3Pk60GNZ4n3XN0Ikj9Ym/c2ghUgky
+bY86fKs2tFYrNSjkbRJecmb+COnPEQCbpWgv5oPROg8NuUyEc2jJx+/BnMCONAt2
+h1/7UQ/KA3GlkoTDVIzDMHPSu2bF4TOz/UzjfQetj2RJHc5xi+AuIdGsuoqdnNF5
+C2I20FmH7iVN0GxetnKvyobtDgJG6ohO8RFuOuWY66bVvUhRwf3aHH9CJSxk5YV8
+XzGoij0JoHamw5P7NCPZWvaHSDt+iOkuvgEQqSMsmId9xwoYzk7GrB0vLev62V5p
+UvZ+q9qJBBwEEAEIAAYFAksUNc0ACgkQiq+I1thOQa4MoyAAnpy+eTgbQ1xJy62W
+Tqy6nFPXcp2mApwCTB+vK6Km7niYBYTw52SYIEC/Sf9FOU5CskFgYMerw5/8oBKu
+C1JRGINxjjOI1tOZAiywROVkHrjQ7CxCh6kjoAhQPhMjECVUx7vmwmraI51aOkLh
+ZJZ3XkB8PO6pybR5+k4zr4JBA5EL6gEFEpKymazrZBh+6CqgmQfF0m78eSQ2OsVK
+sG8yeHxtZJ9Oo7O6yAWpzazOyDxaFKoet9+5cv8KI14187Sk+68tSrFhyNbasmIc
+DjYbTieT/o5e6Pxy4wMvEkAkpRLlvEKg3BJOcw16mr6U+gCTQ1UfchBxFdATG0LX
+HCTGX82nRZ8AzIhE1+RPwKJz0ixsDGQ6mLW98l/PZn7GPv94XNKSp86i2g689onY
+Z2wVA/dfbzxXe7Q4/THenn8sj91xMTs1F/BcUy7jUpE7ErHxngxs1AUN3tAsd73k
+l31L84y1O16vaQxLLer6sEmvpRQvzXIW/RVNN4PlylyDgXVI8yUixB+UXuKkLe9r
+Cu8Z7Z2kzJem3DY4twliIBqet7+AYlTWgzg5gT8Iq+omb1VGaBtBXrlnSrVoSaH6
+obcUNWlA/Nmkj6qd39iIoywJrI4mjfXtQ300/pIPIGDpZi5xckd55s75PeZ9WyML
+jF+ljOlcY1F1qbfl1TTx4L2ofzvvEbh/T+qQa79fKFPsmqoZaSG3Nad2KHpGJR1T
+PFjZD/EktKuNg6m3iWd4fDi+oICcmBjG+lQQwZhaeFwtEnU2/JfNOzS8OfPi/73d
+vX8nuaYdjCFnWs0NM3kLrebwcmy6gGskFmocn0rC50jJZ8Cs94CEKPHL5aN5jmpX
+gRX0SjGURvMZDvICc0UJgqLPbnoWHbaKm5b0/ICobdjCx5cg9GJ8u6OVkst86Nne
+WCqDSWWtawnH1WySkGQPBB9Y3nxH5j9aGr+jmCiCOrWbKS9KnbDq+JlDicO0YYww
+iZkVSZfLWVOwFMhUfCbLNsMKGo62jEJd4tSCHk2Ic+xcKw71SEeFx6jgaMrV/Ic8
+anr+dQG2F7Oy3VBOe7a1JxPBg1R+r+Trtk6t0NTbGXhzevY0qmInqeCxAAC7+KYT
+jgcL/YMt9BfQa9I02jNQ5FhvToCGZ9fHtUjjLnLoinv8JJI33aC+oQCmbldNHSdW
+kYBMSNcAzMV8kSGZ8YSN/brYEcD1QuLIq+EOsAZw4AC/iknrxLeUHoyuumS3sRlq
+/jfy3WPQ8M9wYP+z2w2+ZVkTb0LoYjbyL0FBOZfArQQ0WgkR/NuSGMV7dKz0i/xd
+XYuLFn9p+sYNfSpt/lV61zYWdxsou9dCW7difwnhE2rkjNync6ox8tAkdKFBr3fd
+5xnnUohGBBARAgAGBQJLontnAAoJEIYLvubR+ZWQ0IoAn0RtPgyMyGDQu7Pw7rXC
+ELQr0KFFAKDPCtIYyMgp06G+UGsCG4d1LnYaJIkCHAQQAQIABgUCS19lBAAKCRAZ
+PxgKtV2Zd4+7D/9sLmLfudG2tt7So9qf63bOYFHNvisHGxZjQFivM8V8VRToeSnP
+gteVCxsX/tbpwcWs3dLzHDjEEeHIBBVKco9HVuTudiL2rh11+1BJsjFIsoeZwcBs
+Q0rCtwKHSDmaSZRmKSgRIwz6V5fOHViPrzQiqH5L69ngmoBTfXI6gtmMo1plexf3
+b3tMHY4J/29Y9EjtfGiToUtcVW+MD1n1U+iI6IdsJETPlE8i2xfmeIADUQFjTbXL
+g4mGga6lyxiONE2dyJCGqPL8ctyt+OU55vVn5vqx2oxI4jdTURlHf9mhEMc47tgT
+E2HfbZbB8GLxbWnDFgQiZJZECfU3vG4IgUvgxDYNIvl2er1ZQxIgy3+PsbMC1OGC
+V1cHl40HJns5AueMQ8cbx1cEvkpvxighlaxq5AKb0EXvs0G/r0HU7yfj4HwDETJV
+8mpmCwllHxBh8bnVBBlDlebrintFjSYr6jdhdb95ZJjlgnbkSiknHBvqQ5V8w4eb
+8+YOBH7aKwbhmhL+Pwc7ATrHeJFVunzsWFgoUyrr5k0eyz59vTGuis6K5CzzA0Oi
+KIPupexetjOF4B+4eSYGLxlmO+1wPhHnisOTTyFN/32UaJ92ozvw8rW2VuywW8Xy
+rQ+F8hyj1xy3sopoU61dLOAJXbCPYLcCRvHlsPONqjM9jK7DSggf+XZuEIkCHAQQ
+AQIABgUCS191NQAKCRBVa7/wPwoEttuED/oCXyVB884L+Z2/CvELYowDzRmIeuZn
+sc4eqlS1Oyio4Dxl6PZM+BkScFNV7LH3904tYqo7YNcoLZ5Vbu1j8OaAJGcvBf5S
+MMcZfEULzLmUAKhPZ/J3XkIRMcd9gS0NwCvwxPq4wR9Iigf2UkzcGdVqvJ3U+FNv
+Z6DXRt1C3FRbZfGqHtkuNJKp405PiuE+ASyJQe8B16tEGvcohklACTijQzmipp+J
+D9O4Frf+iGWimrdObDXZdjg8zfOsruL1y5PqQ2hUPMLIt0Mm75g9QDcW/HhE1sDj
+MSQmdx8cQerrBof3KfNiW7EeWAyBJ7+lGPS2UxWIiiLYEvxtv2KgheffdRNouhW7
+ykijxop4YLuf3jPB89hY8xLKFiqM/OWH7z0fP/bJip+w7B5mgmZSRmemJDVl6SMU
+7xQ3UjLRASswc1YaiNatcWFXFaNR0+oBbLBoz8tHQ2kKzGWrbO10bcxV/dJsqkDo
+gzK7d+l1VCwaI4CALFVVwWgt9szWqWAKamGv/9u8hS1bUi2IshG879Hgmbb4KlEb
+/rYcOc2t1gT3h/7OD0tuWbUM+DSlK2Cdgb+V/kYH8pzkuYbOXvt09veA7QwijBrW
+7AjOyZXc8NmlDUEayTZIeGxIdEmsgFidV64zBXOZ6w4ySJpau38RYiVu/XRrSXxD
+Tw51NtJauVn/qokCHAQQAQoABgUCS19lTAAKCRBTPe8VXXu8WvHkEACF65H8WZTx
+06KHKRKNpTMPNc8PNUKoly0mNYCA068r+lFWKBfjrE2F08Xl/W+GaO2q0367yTAq
+xR4PTPDttGLxFUBWN/H/LdpcAxeDLHu2W/uK/ZF36rpHLCcVvL0XgyB7+Fj3ThdV
+RNlW2denBQmuR7LhNEulqznPNiiKJ3kR2LjdFQVzPv/IKIWPrCQoNyDt7oGzJV8j
+IZMHxIdAlxrcy6t1jUN99VhOrDZEVG0htFb4iSbzeUUjZRwYds+6twaVzAkrkqPu
+sxRD2KyQiXlk1PM27p54YReVpYKb8qOKfBuuIYxNrZ35qklv+6H0xKwXLibsuI5d
+jlVwrA9RXSKcna+VVnBB7m7WKdDqueG5mxXSYOLlrZjq7Aujwv+TWYGG5jVHSux+
+XtxjvhIkv47UjjUqmV6PUnZj6lwFuoHXCCPQ6GMSc+XZlx7tEf7EdTTxzfrn8n/x
+T22bYQSHCwisV7TCNEKZp76A9MwA2GT4hTspHN6Ty7aMouCI4I7eofXtRAysXnD/
+4tpgpTldTIFN54jNI3//N5XXOEueRBF/WzR4rzHguyLoyEhbxEnDwbXuWZjfFgvT
+NR5F+4l4YLFmkz9ofPG4CWQg2xlU4M9bWeydik2V10yEJXquZVYdmPbcR64ZzeCr
+HkMmbsJ2Dtt0etzdl+t0hvzrSardywR68okCHAQQAQoABgUCTHaSHAAKCRDhNgiK
+GCS9wcSiEAC89ttxfq/uPRMY6NLAUivhjqvNkM/bPcUjKmj2LcvSBz4lGzAPHWJQ
+HakHgrPREhknWck7/d9jYYxDblRJ8Gu89v2KI2NCxc7PX5XeRhDWH11FQ1oorazc
+hxW/v47Hv05ffDRlbpTKQalrtOzyLs8yqXgfG/vrYcNEjQimCHhYPenzsndp4rcA
+97IAtOdhDEomQSw4c14QAqqZpoDMNQ72CapjAEgp/Xkgw+kQDertNw1gD0r3m4Hr
+75CVR4HaX5ii5aUAUUjClb95ktbZ7HjROCVoO6NLnv+9Vogozcfrh8gnU/g3DcOU
+TyOyK2Du6mGrcdaUHVcfSMCfmmQaBnGioDWManP6WhkAohSBS0HZVvXhNeb6fMzT
+AEoj9G2m/lzsG/Kg9HN4b6Vdot3EjzAKLPyG281aorUvIQFB+B01Ija5h1AjzdGr
+EyNguhV1QoGduvNJCHNACWBjZVo/LKV+VAi9W9yr7Dn3z0VP364I2YVpOYHQ3Cg6
+uf35ZsVHrGZdNw7xAo9BqzIGNA/+Xe6EgxlSEmEu7x6+1KkqxHPPk5gtJr2dKzA+
+T4toWbKSq5F5V50hPeqVsPdxqKjzNBKlL6/g1DYfwna8Cp+d6+peMRR6MSYaaXKb
+xaCRTQg1k0bQ89oQPSUPtIWA3wjdXAA4P1ARMP2N7R6mnJjbbwdxoIhGBBARAgAG
+BQJM2y7rAAoJEBtId+mxZpKHgzYAoIB+nrJL7I5Cr4QvhhlO/El6jlzkAJ4+6Qk9
+14NQmFDVRrmLzA/3Q1NXsokCHAQQAQoABgUCTNK09wAKCRCCeB3kbVlU+n18D/40
+xttbcnGbNQor5wN14MjgHRFYKPKYLfqp5iZw3hKhBW5Eg8tvofO2covZcIs42aef
+gL/h84nae40YjW06BE9yNZVYXbZzvXSzoerJbKdYcuYGklKRAqfJ3vKP672uU7Zo
+HQBmgGMLhegVsLuaOJJfzMmOKqSueJJrDy6c03wkcYsj+liK2I8cU2eUewlLN0U0
+38xp1CZbru+zV43Rwq/Clpuk5BqeM56d5szzwELHOm4ijLTFLBc8qr5l+KDEHJE9
+30MIu+2PkTzKo5BRm7XNhWq4/1ouKiAfXGDrwqdM3jo34/CyDLwF1mZtw4HNSqZt
+tBjS8IJoXa/Hkktqob9+hFAPtayBXxJZhNgnjsu7tTbOIsVHanqFGYShA0DDaycB
+s5nkPkCAuDNp9t6+jijWiNtB2UeP/bJHogLrn6Mv/2W600L6lCXA9gqMRY8jXReP
+tT7oZriamSYgWbQndXXAFCOVM3wVC0JQ36IVDsjHmd1aZoQ42euq5vu+dK+kSWei
+DSPWHJiSiD1LauAyEyGKn4XKOvFLn2e1L/BZAuUTsjyei5iTpSYpouz+S9MsCDGM
+PTDJaKYWURp3/qI5y9c4Sd8xO5EhmbUZhsHFWqu2vi9/b4bFKhz1MGPsXDk6kHD1
+KiSaqxR2Q4epslWdyfwesw7d34X5YSV49wvLGVGUfIkCHAQQAQoABgUCTRxM4AAK
+CRA/z1Kf8vJ6BkhxEACeYh6BXFa2ZYWYg+aOYoKd4RxXh7XBX7Ah7driPWsNTcyd
+hq0VP2CY2trx96qdK/Xf5yHZ83UHuVIwtkr2M4+K3o9iWPXli9LedetXaF4l7PFL
+yYZwYu19HifJn6t7DN8bNa7lkFu5TgL8Fm8e3BxTcQIoOomyDxYm4y051QISeWxT
+9m4oPSO4JBd/IFB74zxUf997m4Lhm01mLuyEFQSYIi39UHFIwcbRdSNaA5AHwi6M
+kL5ip2nRj1QaP6J5JeH5efBta4oLgSPrma1V16Jp10tqtfpot7K0mEIaRQaSpj9n
+M/kgvsbU9T6MFZSvvT/sBTAEH2q8pRt4APIV8mU/bM0tuyQ/FVHYvamzSmPgKNLs
++6LnupuGBS+N+RO1xJ50rzCvVMQ4LhBCcdinshhXH492MKt3VlcN6djQs9iZhopl
+j3aqT083WG75ylLuoQwaB3jmCV+J9VUTT1U6tTlrJnnx9w8vHbOITIMEs+rmSS/9
+RRZr+7h5bIwKPqTHhA1qVjruJ4L30sGMsc6uaCwF9mHbpjXy54PcoMpcXLgvj+9w
+WGz9EB+3k5cbVZLe33qLGnTv4zlENskZNbzqTqPlDhuFYW0pOr8Mf5Vt9xNjTNuF
+5xUVYQMED+6xIwwYX05IkRT5fCJ/2rIgnvw+VjMCbLZ70pQetF7dgmrtRUwiY4hG
+BBARAgAGBQJNJK0WAAoJEH4q/cwONxoJAksAnjoZfzZrAyGlje7G6GVFV4Vi4O/P
+AJ0d7KcNvSGi20pr2h57Krc+XepjQYhGBBIRAgAGBQJM1CP3AAoJEPQmjufy79Dw
+RQkAoMDto1YFid3+0mq+lHsczMCKphVNAKCL1z17V2sx8lGyYYMjBk0plCdHxokC
+IgQTAQIADAUCTgOM3wWDApIJwAAKCRCMleyeQza0SGUtD/9yG6sly5LmoXvJSJfD
+Wv1hHP84El0NOf5JklVQgohzXjyRF3GM3hDzCItzx24718hoZpPoPJaguPLjZaoM
+AINeqbC0bUA6VAHR3iLwPmFEPsB2ynKOJza0nd2MJgYyjM6U2G+lGzSMGKaXcAG7
+4nr6tWJqqPrkg4a4wv4UP3H9mt7HydiLN+QqNDr9pJ1fiQik8RIRPLgIyhfh+1nb
+DuvupK9H7ZMBTsnz5MwOWHCnj6Dx0M2wCi4WuT9lA3hgOYMrrNO9DCw0+8GKt3YO
+24Ivw5VsN613slD8BsOiWkVWuhifCJLFih7ZRqMFC5uvhZAmBSRjXPTtvAGde5hm
+nnrE42XiRUnw4ikOObAFJ2KYgcOlhDTTOjzejrEPE+EPcuRB4GtyCMCtEEpzJcY7
+OXKhSpC8JByNzOdyjDfRpzEorU5Tsjaao6ILH1WJgAyYyosKc3aCtjSnkrmMLyc2
+iUd/LHwyHGToqoQCHVmAh9KL8L2x/MgkT6naJwB9a7KzwggMmNQhd2xOB/+6hDOW
+FuxBNFl8CBt+TiDs3E8BrS18uKQrvUa117boqOewjqmwJMGKTLsmEHNWVjDFkG2/
+oES3xo2+qpfwWlMhLhMxjwqzYSRrI74aGWZFQEnUGlVObThx3saIXD1uUAeZ9dL1
+6+wjEOQWleL/MwEVADJUePpEb4hGBBARAgAGBQJOvCRSAAoJEAsDrm5OJFF8/NUA
+mwfjmRqfaHmFbln2cyO97algu0mTAJ9vf+imI8yoxL9V2l2GiC/kDr4tiohGBBAR
+AgAGBQJOvCmzAAoJEKvWMuzE/JplCNAAoL9zXofnh2dSzIkxqBKouJ8NYgTdAKDu
+2wNCqRTDeDRiVjKpyWai3hpb5YhGBBARAgAGBQJOvE7tAAoJEC8+XTEfSeylyzMA
+nA9C7nFOFX7+22k1zd+NIRScXChuAJ9l4Vt9JMe2J6FcfjIQqqvSeVi83YkCHAQQ
+AQIABgUCTrxfWgAKCRCarPtWNSrPduWDD/0UdjOwVrlh22EdHqJJk2O3kLrOG/sx
+2Y2QNI1cTD97xfl2MrOMv0h4mrDuinY8y2Fx60gTpa/7ChII/lExXKr7sHshj6og
+RegdY2eVp9YmCiLZ9bLQA+vXQ7Efj9PdnunYEvSDL4eQEiw05UHujsH6H2l3un8i
+H6O+Jqi1iaS6izKfbgD5R/KWQEiSLfS/zlqRm0+B+fNkuKKgvLwquDuvGGa5SmkJ
+lESNdYOmGxgP5jE/EcxhpAAc2B5nKjhPtwFBSrATJ/u8BoyzS/+msl6Ig+jWJ7VY
+waax2SJ0b+lLCbJn19AMMF5+zlllk0iFgJ0M47XcFvXdWEoOkxWuI7YH9bQeAUbp
+WOSTxM7VnA5UQS/N3bEb6npVHzSCAv2UTB5U3t5zbTFEOoXA+5MzICoex/3O3Idd
+brIOZIXf1GSaYIT4TwycB6UXLnUSBcwYV33g0IzILbqjbh27wCLeJF5wmMgU8xLO
+0vGr23yXK9bBpBjWQcmME9q1kJXJ439RfjnoUBFeoyE/XpoJ0j5Km085c1ZWDzUY
+6BRJjEMrM9kN1U3TfXLEHrmAA1Lw1EgAmxnrgX70WgnG1Y0EfNMbnJG1bHV0+46E
+cjn0t0PuWX0KwwMMO2xw1UUqedk+Jq3j3LbRXuFMdD2TcAewj0QFp9gE8lQSt4k6
+MiUXuDTDCXVBt4kCHAQQAQIABgUCTr1SiQAKCRBNFUEQuEUI7HkLEACS/yoMCNKp
+PB5/7pgraYwv+ddNTmt0XCDypJKLPk3aU+6Zv47ixzWb0fsDCZrBQsgP8jz8iIeQ
+kge2rMlxajaKi92xIYSKYbLIENBYa07OKEJ4uQS78ajrSwtEMX5EczjyNMapFp6e
+46FBMILhYGMEAt0MjvYC+7fEWE/i+QW9X4K3N/sjxV8BqTHYTLh5c9tsVhLCZeZe
+5V7bct1HvElJ290ABk8XNMDUlrHuDQAmftJ6E0K4MaNFlA7pB3dje+bTX5lWo5RV
+bfZ//E45cNOvtNWZx0ArM3OqFhyiusH3Wi/RgKDZtRJCY3tshpV8sLtH/T2eCXKE
+8t956zCn5elZi5NxUiADSbzfyC0rUl3pftgsdOFBxRbwWpUkGGBE/ho8leXB4Jfu
+FTva6+OnUTD2c1t0qpDvwNwsVkOLQgdVXtfV5/PYTmcdKzqfHeP8en8gFZPPO7kQ
+xlDUHDNZGK7Jff+J4spFRDNksfgntIUHZ7qcQgRrIAlGj7zS9Y+bnfgTsqnpbsq4
+tDA+Cd7H3VxK3NF7bdrLhDFSeYdeOnRuZoUygJ0HRZelmYrRpLMtWW0HQaT12IbR
+gIh/1UI2aUBoTALm+T4qeRxbTW/r1yDF/gv0f7soyJ/8aiUqt8/TdD0t03ZwTjQq
+Q2wtca+4dJOKggHAYh8aL9BsD1WOitiFM4kCHAQQAQIABgUCTr5o4QAKCRD7Yz3o
+9cuua7f0D/9g6YtdXYH36VClOJ5zhCH/NIboXJu51NYN9j5Rv1SIywXlEkSfET0g
+WOIDpLGuFWFNnKdz9V+7u1pqgNgAyG5CFDiprXB4Yl8popy3sYiHD8Ga2LFbd114
++xYmHi3o/RmdTf1O8WMZDeusnlkMWfuBXW1PTIBnD5BuMlOu6DzBMLwbsj5cDH+g
+H7VPeq6Uop6CiGL8H6atpHfbK2pahfsWr/lLefFXmpmd7DRXXDqg1z1yc10N5J0d
+Bzi1Bc5+1MTqASkuz9gl6Anuki0wwpZkiQcsicstxNjr6ZPPCORNBhm+dEM1JOKz
+9ifFtRJ47gb4vsQTxmK6G6QZbmYGT/cQxnc12JNWWMz0a9Zl/Qb7k0cyhp60rbHQ
+FxlrJAd2CsE5RBu2hCCN/I2rorM4UueRpsIqKCiMKDjgwHjY6m1juI98TqYwYMpb
+P/3gXwVSzDw9N+krIUc+y3qwjLxJIRhUIYYiIILkK2Kx+YGZCR9qGOuY/lEFRMee
+Q79ZpMtCYX2OHDi6CU6VUGYZ5bds70IMWO5AAteADg15jKwbBdoUlSNONMTx/+hF
+R/Dy46+IIwHDgQPGxrcfB/ngvHK7R/52Tx54KOfEk9JYcy1BRyjypEpB0kmoOkNM
+wbsll28tKbTsL9fUjBpRG3fzdkl+ew8oORVk+tLS/pcmR+yjYta2y4hGBBARAgAG
+BQJO0ATUAAoJELJ7lE40iE6F4QsAnR1R23XrLJXjoXBpMTjB9LlIFV+AAJ45TiGU
+FxHKJNPTsEUNvFLpSiO46IkCHAQQAQIABgUCTsrLgAAKCRCJofZRKiOcLPk1EAC4
++q7bo7QhakHUSRD1CVNo2ZfHsyFmXSyUOCAHkzhtkrPwolrLqYB+NDfESyOn8RvO
+nEEUOOLhaaTfXc3BZlP1uiDtpiNHPevgNkiCSsBK2nMuaCBUzKmxzAqdrfrh/Lji
+PUhMXOD7mTskzvDGRFHiuUQs2DPhjORNnX0wDpVd0Jzop5FzUiiCovlVVZLfuq43
+O7tcbb5xH2JGQCTvTMYC0W7w7LdXrRF/dR2ny9asadDq4y+EOifX/scpCVcG/rX7
+780aoaSF+OzYwFdpAPabY47uS0sTfmfD7MTDladjDF8oQEZ6BxZ7GQB5Qwt2F/Ae
+uODTnS88OeK+K5StHBtLOmgA+tPH7hfhXMddNTnmukI8CgGsppwYtyu5XazSZLQV
+ytQ6gCmLdhYBdk/3/7juQ13r0Ew/V/tEem39KCH2/cm54PLcHZxCHgMQ9FBZ79+c
+atwFKCFaJeqAXdxsoiN06zxFGnLNy867aiP9d/DkWeoGOnfesK3WkYKl0b3ShQsa
+ZCaRgQA3EYbtlM/FNQxdzgNENfhMune9wqrIaMNQyyH4MA5SGWMb2AN8kd1Fzofc
+ixvoNIneEDiqkE6dYScwOn7LdJ5VBHQVb/dHsmE/aUAbmFa73VP9FtnDEFjZZ3VG
+NWHYF7bDmg/0RNKnFbHtwGkHpQOnu0PzKvNH/j5EYIkCHAQQAQoABgUCTsFkCgAK
+CRBOvAyfAgj8ERcfD/wOQE7biSCEjhJE6E0dcItAsCStJx2PVuo3CW5JgHKuEk2u
+yasRGL2jxC9dc1hDH586OmCHliaxFI8VnhFGQ5EELvyqWmC2iLMI2Y8uYq9Ph9zE
+hJT/g41HUv6Z71ce8oLbGBztoIWK9FMsIPcoLILiFx5phWRtcmK/thKcYVk0c588
+pVRytgtjI53gIPXj3c804jWfgKbCbPBRErTEl5j2GOV7M04WTuBOinQA2f5w4wDp
+05Zz7Zub5U/5i3+PaRH1a0ai7VgfgobkPs8OS1EVPdBCORQJbcc7f+sADd9ERn0Q
+AZkGxB1a8/cz9J1mpHTgGpctdGYfQqgvPJSVDVEEIBmZ894dObukPxyiSAF2q07r
+XF00sEqYSJsJ/1Yti0DsReOdrMmBWDN2CRQImu9oVYk3jUySEpu6b1kslZ/5CDoj
+PRrfbdXO5XULEX0FLE/ieQj8+Y98tPRw9boJ04EKmVdEySCIE2Dqvn5xpZStpl63
+jEind33FNOL3Ndt1NXwrNFfwMw6O32xNaUWI7tpdXfkeHgawzoZKWhnqZVOxZUZp
+jyVaTxFOGm+qU3IRAsPHpQDvsHOCBxqpYh93hLoYI+uQReLB8nI5K+2/3uFfjQeO
+McDpMyVNMtaa32FOjaWEiFlSu4Rp8qRv7G4ujfvy2VELk0STDTUy+4zNBq8U/4kC
+HAQQAQoABgUCTs2X0QAKCRD1T+ZICIM1qenOD/9cbWZVYOuUIZ/8ZTi4tBHckLjh
+iIFyBlgAwOKwhYIxOaZnQ/jDLIQuUwwpPfCVM2hooR45gz02A+racUwvhL7exoYp
+htx0KeMqxzsWIlWKLvPm9oN3HF4DD0iH/l4ctBr/5VM8FhDZeNA+M7PispziM/L1
+SUl6lm7nD2CaCh/R6AGyiDB4AXhnKQCPGJUjY0UlJcCfOvEAnpE+4P3/IDl4T2vm
+1pTfGLBxJv94SxjuGR+Lx9kCMeO196ixl4EAwBEibIc4LVGfOjzPtc4rNVPM3S7h
+WatdTgMDXThaoFOnDErlFOSdcmw71A/+mEa1luUr27+/KBSlnmdWcGFTjxqDVOD3
+ETmAXAOBGp3VNb71Fd5bCOYguVvAxlJl5lZ5OUqaNM0FjNrz/XWRVj+ROxo6uMD5
+9R10wdvFGjdFLn6Vfwi3mwaepDUZfepA+URQvsKX4puZAX+5U61fIqFFOTgXAnJb
+D2p/HsnieNx5bWyWqpM9YI9OVYfDnxdnUXcAPz8S2MxosEOGy/QvljQ84gnlh+/u
+ElFCnU4voT4dZNnEC0BaseUs1cXQ2UDUA4f4xXFDkuzevEjFdGSANVT2XkcFv9QY
+HFXShTAJILVvDx/9lFfqW7BpsMX6jPlGxsbmgLr9KTbOOtiw3JwnI428F1Mgc1Og
+L47C5uP9pbGD0zAg+IkCHAQSAQgABgUCTubiXgAKCRDGh181Qc794LvND/90tpSk
+f2l9JI336EfjjtsUShmzqTolRrMGDuH0ibIAMNsYwMrl7cBdQitUoPIQM/BuO0hW
+fnbXcH2h4P3IynNeCjO1aHQE9pEb+KbnwWVj+cXnIHNczWDuI6qXQ4ELcIK2gnsc
+VZFP3dj8S76D4lgQn3qLkocMdOJOo3U64WJ846b0FdIpUX00231FRS1eA6V+KdWv
+VjOHA/fprV4gWPQGuRMF4UQ/Ll66Rbyzl3PlzYFwr2tOyyJF0UUDCpU2AWN/xegM
+vXHHc2cJ/C0TP37W8y5lrbS8wDcyKFoPDua9zhPr+wZteF0GVxYXzC3i1DHBAhH5
+tjWHXk+QHEa+jzwoxYmEYmJ2LgxEDT0Fzytn1y52OCu+uhWznVWUiURnGhF6c5l7
+eJXDq/1lHkO0hoAxLAIfbU6gEgfjy2foOGxOTtnJZY45vANa1MAvH2vbemGAWONM
+65HeIBgNhgO245FZ7jCJ0ss8ZvM4NhVi0Vvh/z2yjQguvAEEIqBnV3um8Dh0Qxf7
+cbsRfbPyoHHwX+0o7mS1xXspI/Rzhc+lYzqbY2FW5F/qLrJ1KwZH3zR8POReKgLN
+Dbg3hstxy584NxbM5D64ux89y9W41oZmEohiLIH2REgnLIkfPJFmn+k+D3Tlk2fX
+CTUkkRo/ADpifwKQ23v74CUusv05NqLSmRH8aYkCPQQTAQIAJwIbAwULCQgHAwUV
+CgkICwUWAgMBAAIeAQIXgAUCUSCPTgUJC9IwFQAKCRCbuGOw9Ru4irAaD/4/7pgA
+xHEyLq1tcTh8u7Vpv/dtumNm6sM8PRRcLNWaHWlHN0qCkGdvaNHCZkBFQiXGi8FM
+HZYfhIzuCHsoId5gC2bHmaZfIWveHhMPGXo5KttyWUNZc58Vr6/yssYg+7IUj3TW
+VSJHcx4nZDDfdl3p29fiWx8alI5Eme3NFOtTLlKKMz1zRIQdUMMfsBGyFe9bZE6X
+kmrDJkj6lLUNp4Xw/34NtlgnrAvNmsdTGR9SWhB4LNJTxZUWq2+2mRLD3OEW61qF
+T0zRdSPxvdFloQ/XQKAdSNv2V/7wIcPdB2HFZdyf+SFnBytX3IQ7LnQZoiTZ4Pfo
++MA68fPjrJEAtdmHDoWhk73ToNbd8veyTFWNBCsVee3oLKh2LDnTFnObG8Ba4YSN
+ivTRkpkt3rtgUJCF06b9S8GWg1vsIgVQJgv4mTCu5+YjApefGOHA4I2r5NfxqRbL
+FM25C86LYS3z70PD5kNAPqcrvtd4bOvo+mICHPYMTWSDvlmYLFAgtSx2EDtyGZ4w
+4et2lLhhEPPQEGfOrM5IxhviW3thBPl0QGpSKY3XdviyWTZ8nzjuOoW3bdBhgpAO
+jK6nzYGUuaxIRPv+UsRZ0R+j+cjiigyY5RnHqMxMT2VZ+hpej9HfJaTkla9bJlDu
+THTpzGHNemLOJdHFv00RFlCNZb2bTY59CeBBOokCPQQTAQIAJwUCSvH9HAIbAwUJ
+BaOc7QULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRCbuGOw9Ru4ig2aEACU2sdb
+jNYVomdNeLTEkHpF8TWURZ2Gbh5HSqv3kNklpDUONU4f/mhuIyVLQ72LkRIGylwY
+VgyfOEYB3kgTEEqtgj1XqEcAvJCafMiE5fGrBr8yGchFtSq05btZtnJW60rKDksU
+8VhKsAJ9anj1Lt8hWeG9LhJJ8JX3pZ7gPSmDDe81Pk70SiYOfdB5j91hU2quy6TQ
+SxuNRspsElHuoIo/DU5sayTG6JBjtCrbKTscHfW4uT7JQQof34rZ9XLk79YYPoII
+DczXcsvg9Wx1kFQ96Y3GKCj+RL+2Vhw6MFWqJ+jlPOUJ8V1LfyC3Yc2+/hQR9KZ/
+g2QnYBHw19huvO55qnGEvCNn4RwueZOBGh0XDBw6ZGxaWlxf54y3i02djDpwkmgq
+16CrrkpBz25nYs0INiBxRwjN9xgEbBiRo39lkouvBKc2Si8wyaJhKD09A3w4i1QQ
+xlgD19VoUqk/80Yway9DbZMwh+tmpEtVXB+vaNqfIwINMabjsZPPiSj+8wlxLHOd
+QHH4gGovxVaeUHQ/BZVKVZAFu/fD5+pasxQ0IpZAcneKoZOxShpeRpzkP00rCvaL
+si67YU/ak6LxBHWcTJQxcLytml0TdC0wk0WODCC+rEhQ+jM2uDnlr6N/EDuujqJr
+bqGfHNFyl8a6b/9l7S/b6gHRdkx96jfu2097t7QhU2FuZGVyIFRlbW1lIDxzY3Rl
+bW1lQGFwYWNoZS5vcmc+iEYEEBECAAYFAkrx/wUACgkQsr68QBUpJK8ikQCgty0w
+1I+K7W/Lx8BYFR+m04MfFEwAoK5ldisJ8CmsyWR68OT6RocYZVjxiQIcBBABAgAG
+BQJLPcnoAAoJEO04c/XTJici/FkQAIJDo9PW3CY4Qu2pTlwuMVBSB9RHNO1UJLyP
+Geo6pBhN3KnpJu9ClqfmGjF/Ln/hXTlX2S9LxLp5/YU2l7JZ7kyfMd3nlW4tZQyP
+PUzgYwGNaAsWPdF2baYs8fk420ahff23RT/aIu2kU8kLy3J6B3daJ+bflm09+dfZ
+cbQXBFsHYq+3r1R/F3FmUIbFAZ092CeMdiLPRNF07c3uCi6g+NyxEdUVK2GlYUlv
+RwFf3PUy4lydUMjaRvuEoHENJOObQFci5D+P/VmROkhd50noDEWUyFAieY3CXz1T
+0Vy+8BmXCI1Aa+7/EpFh6V9DZBI7xWi1M8gg/xCD0EmgnUVmZrxUdWMsrVu95dJF
+Bpl3rcsRQ28ur9fnFf2b4E9ouN0kJGX7uThUf8aeteB0cjatEThLEUBhXY+hl47r
+e6ois/aLN/SzwUYBHpGowCbvGMztj429qhbZYB3lkF/do3U8b9+x5Y4T6cjs8hMN
+uEXi7Qah57WGGePJLfeGKSerKdt2yMG3ji9xzIAYUOnUeQEo4FE5TbNlBClcMtMP
+2qb0OFmaZTN0dFz6So8eaKfM2yB9q7rhIydMlRmXXSWlaA1UQ29bPsC8Uyqs3EEn
+xjDy3TipjJYbSzQjosKGLt4HsbEdWjNng8mMaLVwtxlZGNnEGmPI5vdnSdv3zuMt
+M4GU78PViQIcBBABCgAGBQJLJUYyAAoJEDF8bfg8dwXP6gAP/01RptxEUiIP74GR
+Nbd97arDQVY97KibVDH+SsgRgmTo46Mwed4FK9eK8v4EvulcnX4H0nCBoa9mI0Cp
+ttI89V60HE604KLdejSKQ95ceiI24HXZE/jxZz5nk7sZdkGsLgEOSs61rLI/cX9B
+aMAE6fRxks/44D9WyP4aDy4AFzO/rhKQb1+6qnb0icZ71G4nExIOhZkv1d61SxXx
++HzVHeKhayxG21k3IB2sm1LMFzzCqp8Plg6RonSiLNyrDLRdrNFAB5IUa/vcA/uT
+6y8+lKSGfYhfxBLoz1SJ6TnXDgMvC5gfdooKZElcribYrXBWe37yRbCQ5JDvyOF2
+Mn5jLl1ffqM9Y0LtFRU3azdtTRwls/p/kcmSGZq31ijR1UQFxcWakPnwDr04+1xI
+p4nweqZGMk6vCQr04Sxo6j6gFXQJx88cMgY9r3TW3+Jv8ko/s/CAr/1dqsQPgqEP
+Gx9FtsCwBL65MvuJBVCWxHTOTWEwNAMkf3umHttfSOH3t1IiLheTSjEpexTr1lS0
+00IzkNULuOj8Imw1Yx6BYOoW3kPysBts/rnEa2xrQMO/OptXaW+byCaxDoZToa5X
+GrCJuIkMHw+ago9mtl59GnWkAZhF4us6J1vplq/ciHbcG8ZA8so4Qpu93kyZziMU
+nBdPpYIXeySSgbTlpsrS+39o3PdeiQQcBBABCAAGBQJLFDXNAAoJEIqviNbYTkGu
+HSkf/A60mrVc6B10BitxoSUfdPYeQlqgnk1KWtprknb/Xm7PdEl8dw/MRiPtvzYR
++/NSaxEzuFRxoAa31SZxFsjhPWNFwqsZ+n6SZCNHiZow0PwGBbs9Ss5QuitX9MTs
+1Zcx1cdJmhhSc18Q94VW461Dkk6BXAKdufXpfDlRur63Ju3GRKxQTpv1eBwf23YN
+J1hBwjj6h7Ai9otMDnlcW5KtFvwwIyp8i23YKzUHy6K/Y1SuGvGXQzeIoD7ejSli
+ddrAkRuBQBaT3WO2NtIEQIP/cey3ib0CuV5LjnMZx4wNkfJ6KKzYPbmXIu/8pWTR
+wTNxOzc4pYIhaMmWg4W/QA0mtCN5nfu3qvKVTQuda+vXGimDFSfkBbeIMUQ5vkEJ
+Sf/vlg3Tv/t9P0AsmevgOi8hhN1s+utDefqeET+dj7VFcrKhonOli+Zy9xmzIWDW
+sv6gvMxxfnwvWW2McGyh3dE6bbUr4SRHamAn8CKYMmelnzEFIWYZ+iwBkTgoSm9u
+RG0aTL3Uek9DGMWJQ0SaQ8GfRDpMAlb2h5V02IMri0kVU02QM+5P8ovzkAVfwxuY
+LwBr6vrtki9C4qHq7mMI0KTFcGEqPtpLcj0d7WuvGqbYvJtj5b3SQecd/JwA25kQ
+96VjlZZ0A8LTjL5Vbbj7XO0jsW4YhwquTTCKfSLxS+dl4lrKI6uwshKE12AKRPpN
+iqU9/N8OY2hqh1sPzVwW/wAObcdxXcxvrQKIAEhl16C5GkUq1fDzNQekNVQ+NteH
+Wshj2ECT3x9Q/LZ9qCoM6MGTgcHA4IGlWLQ+lpgsxiaOsb03ffHCB/irKovRkjvj
+H9LBiBNlLaO9VDBntWDxFnVPKXK9nytmcmM25mzVzOVmGDw2wzsSf6bHB36GdYjB
+2vm2opxlpKj/9Iww/5TCfMIKQqi0ynG02dX5YjxWOtKX4cP46KnkaNRS8cTXaROg
+wTIpZc4D34JPwj/Vqa0oFOWXV/6ffMpwFKz6hlIVeUK/arAmhGe5NgVe+yDHCkV8
+/43ZhLRFrhh1WCv1akdrtYy2KR6IBbxrp+gag4Nm7p1S01pT6gjNVW/22CtJ7my+
+iai5mtURJzTb1gR2i2eUG5U8YIwN2cthWLbcdAunQ2LyWMAN5yAHi16VTb+uOC69
+utPyIKm9hxgvLOT82UoBrmYnFRD2NXhL7CmaUqNub1nTJQ6S4Pr1In6I7QrzQw9x
+xXqq3wBKbxwKVfAXhfF75QT2AeXG3tZIXSQU1A3juJax7wyF+lA0NTKR05Kd4Qll
+QEUaR6PmuD03fhd/tLGNLLGcA19/+7ud+c4Y5JxTVOCQRt5muPWLOtcgx+2r6e/C
+W1cdRchhNo27u0gjua/YoVokAOSIRgQQEQIABgUCS6J7ZwAKCRCGC77m0fmVkD48
+AJ4uPH8gQC1E8JYQ4QBx284gmbxyEQCgiUAoLrJ4wIGvk1fAmaZfitrSM+GJAhwE
+EAECAAYFAktfZQQACgkQGT8YCrVdmXelJQ/8DHbNvWQRM925jeUlmQYcfQeUcRS8
+2xacCWx9gwa5WzpUsLkxfb3hiPkWaD0g7AJfpXjDZhCYhWpvh1/4JayI31r5n9uL
+uhJrs8vF0+l0kMvfqbnOQ7SR4C5U4zmqQx9f0gzOfZhe6U+/2p1QnCWfDXAG1zrP
+wX0wPPaiObLJwqI4smVHIGlciFI08ZSuIO3RWCFp5gilDXmIcIxeNlC6+NbBOM+y
+XT15gGjFcxk8dTdDlYXBHv0O4sh0Nyw2UgLDRY07K4jYtpmsD28DvATc9xUMlwEA
+SCq2L18ZChBqbp7UwO26bptk5xa9PRYovNGJ1rnyW5MCBOooH/Du/8op/xEBf0tA
+h1s6AEyryTWMIRehDFoyhkw70RiLaiV7J6trElEzVxmPGMMWrBQ+OnHGoTMWc9/T
+lxCd1zGbtLZnMp+Xv1Xj+2aHmK2ojgJBwy++QbhsoH0Z0lokMhD5WlM8Rr7hSyVB
+YosqrYsaoR14yjFxm+f5cYJxfVzsPFCcG6JgykkzBZbeRfrh2/0NNKBWygY5r/df
+c70TwqxTbgffoJTZnTVlkpxgLy4KG72uqYf53TH05BFT4LXaLnVn8pWxQr3NR2ZN
+LM1ZMhP3d041rmBuhvHVg3Rg6H5oQZS8/aJs7McyQa1G0Ge3jOIr5LXG9LHJJY+f
+oVtaTAqCTEY3XoWJAhwEEAECAAYFAktfdTQACgkQVWu/8D8KBLa/TRAAnjYP9bVA
+bUK+3af1LsoY2SMG5uk8XLFT2KvRkazG3+Fb6K/WBU6fWQwHVYlC+mIJiRtViS+v
+xsJgEJNLAVMRm2O2/pKrYGDICxdrUoBvB+4m1d26un23zfsQSk0sepKqO+qwVZ0X
+EPGKgv/RqrixfcaIZRZsbIYdQd9rT10/THdCiRwmh3FTohcGKxKWCik/A7AC/9Vj
+QdbRQysQicUkZXHBVVgVPXB4oVbVAkT6Ccg/NEG506DTcLmSyiLp9R4fv4NeThy7
+CjeQleiHg4fflRC1fS3kBIpeLq7i6ZxJFMdo93HuT0fcVxOIYByAoTTktcKg/Qb4
+Qyd281rcOFpzQ8MJ2WWAgjmpR7LG+ihWOjutaWLTlmlFjZK7fdNLOq5JSpRpErQM
+4cDwzVuj4oibLvOzdiR6Tx2+Ux04tMTkZw6p4cfMpdLjMzAasAu6IcrCEfv4tL05
+Eo/kDHLHTiW14EP9U89GgSFfK7UwjPPKyZdj+v7GwQFANA7Vte9tAYgMgWALARq2
+1tgmfu9OZIVbf5fWfr361+vqp6a8vK54aD6ZZmvKYwVsK4F+7Q/tPxMLAbE0Qs1t
+CyYJToaYRkvDKwESEv1ajLc+vsC8Q+5/ckmr8gE3fHlR1mqrfYW4WQl8s0SXF/0i
+ggP67OrGDsNX8jknfV9INUw1mxwJme9sTcuJAhwEEAEKAAYFAktfZUwACgkQUz3v
+FV17vFqYChAAgG02Y0ck0hvD4wC1N49euSkxPGO0viDSveA5w443i3cIQW+mNhAt
+YRR6fm5EYpMX8ArnbSWZKColrx1lnAF+pb7qGm/1iKhWLxjtg/UwylMXum3eIcy2
+RYsCM9bOvaQsUF0T0daSk7Wf3zXKZKZjOR7U1atfAQ/m83VapuZHdQ7RrQdzZGOA
+t6J5rDyS4LUY8sB9Ux0hSYoMPXhcIhd7vIOYIuxElJZcR6ufdTQnhNJ2T6x1n9RG
+OOsB6DRgaQ/XCbJ2wZquCYWXNmWjGR4GfzrRVwDHYXk0Y2C62QdX9Gf05rFqlNPG
+8eitSnjsWDbaz/oDiV1pb9zWxDwA2Wa+7Tme8J95/snVDxTikj8oBdl5mePyKp5K
+Cfxu9BARzBu6A5Zryooly9t2N2yWvTCvrDmWQOkP5u7CsJX5BfSaLFzQ7HIQb+nL
+0IweTgKqAED+WJx0EZOltWQHLJNaT+5TOMhqHNZ3D+1ZaDJWPXp1ggYqhtCHbCp2
+qzla/6pWrruETjA8sN7R8hKLq2LEHfuC3+hnMkpPuMgHd8noq1FNHPWB7ywAghrK
+WPoWhxXabTBi4aLUdNo2toZzmQalG0I0WbjQJa1A/2MI27vqvO+84IrTbkZpcdn2
++A4/xBH+L3YrzlQ6JVCUkLGsERmev/JNktib17Psp7mGzfOgow5tJnmJAhwEEAEK
+AAYFAkx2khwACgkQ4TYIihgkvcHwdBAAvehXDEApOST9KS9Vhke1FE6Dn7xK9ujq
+tWqVis097pyLW+LyWaQdYlg9aQkD9kYxd929BaOVLLKdTfP4Ce08hSgkrJ4XJJC5
+z5vAIZar2z4cGdvYM8vbjQg6O8++tud8FKs1T4OOVFXqjjzjdcdrNZ0vuNdCghH6
+u+4Uf+LkelalGsEUi6DCBJiwnwNsYGCuKijc57ZqbTYJ2jcCTVPDjRrVIpRikn/y
+OxKlqJHzwrrVNSbiCNWrvgg9iJLXNWJBvg+cXtAVzXTQQEhIrdcUI6s81piz7s3A
+4EQQRKN4+ovxvkbnn5YXZKzv0I0b0Juz/6VRxiLnV9mcPjInFeF0jiyM85SC45a7
+TEBaTZQNP6cbROqWCaiVf0mLf1Id49ZpiHR8G8IywOgHb7K12poaETfMpje6KrVj
+zHmVOPR7cgGtwgpPR7uDHaHogVzJdPybIx4pBGADa9VOHXwJzMJdGSR9Gg3N/ARY
+2m0tHGkSpgpYBKib9D/hpiApTRqZ/0Lz0Tk+f/Mu9Y3VrOm6Yj1ocleX+1OW8png
+XLewnFIBgXIyvD0Yn2MM3ZF2PsIxVO+wU60cznwQ3tXOu+lzJLV77oqtSEL86SIi
+PDhZRIwr1KX4YJlwqB3DS6wv4ag0sCO4uVZW0vHTYFSoRbqsUVQh8XkhYSO5jgQD
+A8KJMLntuoiIRgQQEQIABgUCTNsu6wAKCRAbSHfpsWaSh6g+AJ9IxqG15LJm8Z+W
+kVQ+RxxCMp/FgwCgtKTq7T078n0bepdi+3dtrdOexveIdQQQEQIANQUCTOJSoi4c
+SmVhbi1TZWJhc3RpZW4gRGVsZmlubyA8anNkZWxmaW5vQGFwYWNoZS5vcmc+AAoJ
+EKR9Hi3QHg4YANYAoJjhPnn2X9aUeepb6HzKkP2REJTOAJwMqNSRlUdSQUBfUC93
+xCAS6sUJFYjKBBARAgCKBQJM0rRDHxxKaW0gSmFnaWVsc2tpIDxqaW1AYXBhY2hl
+Lm9yZz4gHEppbSBKYWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT4fHEppbSBKYWdp
+ZWxza2kgPGppbUBqaW1qYWcuY29tPiIcSmltIEphZ2llbHNraSA8amltakBjb3Zh
+bGVudC5uZXQ+AAoJEIs6YB8IyXXlWaQAn1tiQjM4MyZA2v4GlT2Te9p05dSTAKCR
+puwROcbdZlTLygOhH9j0/1lXXYkCHAQQAQoABgUCTNK09wAKCRCCeB3kbVlU+sPx
+D/4pOEtn3XmEjdtGVMe0ihQw4QCX4SesrmaFbB6hGL+ltf/7FupbqMXJ61jmBDza
+EzBpEul91nyQ57fYMCIXiTDwxV+nW4xO19/uPTxxdCNDiCDz8NRN+YnSWebculTD
+0sFMZe+Y9LvCRqQE2T8N+P4yCn+RUcj2Ch9qZ9hHQIEzWidMigUJ1nnZno943Obn
+ekoJM/7/oUFPxG/AqzV665wh/wUotbaSM16uLVI1ikOhaNSfTF+T2/Do2Zvwiqzv
+FUoG4Y/PYJvFEIevRn4XuAaw1mvf3FCF2bnjcuPRChApZKX2YEWlF3+UINDF1l0v
+ktao8mMJgUKhiXXtURK+CNYDWyAbQyqmp9QY2En35ktiZDWKoiWjJ3QiDL3RznGW
+6g6F9hKhY3wwB2On/lbn8w67skFPyTdKNwONU/Jz5vppIPryGHsrwiX1fP5klO4M
+j91tZrofhcaBqZPrpmQHfDHj5Rw0k1ztptPybqaRxhPYyachBnbgRztC8EO/k0RS
+fcihdLyMHjLax+r64ONZuFFC8awePmC5QuA+s8VlZctmuLd2A8Gdudt/x7IkNIEQ
+H7ZgaOM8j73ng40rcHkZQW33isbaMZJtizyQs7mzzMBeaxyzkv2y62pKnYg7WS32
+HQAiStgZL1hjRMqhaH8/ScZ1jbWQnZDMfVnyZk4DdudwRokCHAQQAQoABgUCTRxM
+4AAKCRA/z1Kf8vJ6BqIXD/9rPWy7oBCeNjjUxP0CqxQQH8N4R5iHSdcHm0001DhB
+YBYJFG6/kyO5Cg75wyT4Of2utEdLo5Rystr5ZdbQ9fAarf+aLSu2/BKMR2iXdegc
+SQtDUzVbMmtSMy00LAXzwQ74pW5w/822B1vodQn1iKJI6zVbkCPx0GOnHEiaPjBV
+hLwEeimrlVpfUD/xEQgqGIDj56eOOxgAS+QnNOBT+KcZ/+VND72hsVL+0iiGGF8x
+h+l896P/vgJem6XQlpVWfrsxETPSjnDXYpTaW2Qyk+mtgsfhmwigtDS2nFZZM0/V
+WW/nxpoTDqIIFK9G8pd6cmRBJxiYeC9SQ/ddhWVVsyxAC1nti95pv8GtZVJh9umO
+91mouH7m8Z75vUYjiAOF0eD90oAjAo/lCy0H4MrvkHj29+5MFMUi37SrdVB6aKWz
+UnVhoZWDhEtGPro5awcipdjlwoUNurmGF0E5sUMbybxhTPrdr0o050AG9dDa+M+v
+yFy3UKHmErJxAxY7A0IsZ3M/ikrZ6RIR9UOhv/5w7Yvpy8PDOJYMGOpKUZSp4Wg5
+Rjb6EqMrp0Xor47Cw5CV1fHnuMYYpTCv8nID0BdCYBXTOLp2zVdj5gHUSbC1VIzq
+3e3HuhiupHc2GWahgPKtt2iymDEqzFCduuDho3zu9v7uCCsntURNFKsAXZWrgHK8
+EokCUgQQAQIAPAUCTNLNqTUcVGhvbWFzIER1ZHppYWsgKENPREUgU0lHTklORyBL
+RVkpIDx0b21kekBhcGFjaGUub3JnPgAKCRDqTcrcTcqoj+ksD/97lFmqIfbJKNxG
+SACbAoR/CmKLEy8bHLWpPcm0e95PDKC8byDDab6McADwsECHZaKgHizynRn1OcmB
+SHVrcA8eHwwBHqxV71Ocu5M6IhQ2nU1aW7V2+d028XiKich++KUDqtzighIjvOYT
+BtuFAl33vdggAY1PEl57UsPWy8PxNjJW0i1VMaGboOw1lnoCgxN99VkuaKrEefL2
+p9xUp+yBZItEKJEuSpQkbNp8ANkHAhbjJrmA5shYIDTlsVqGADMt44cw0ugiQtqD
+wWjo/bXwZzoFWcC9a8Z55bj4w+atrPzCUsOuKpqHq0DU5+SnvTHLzXoreKfdRq+u
+NvfczRjx1AZlft1hmr0m0Y0yw+oktNRLbZzXUAJC5P+PDkKOmb82r0dFtF9uea2k
+X1gsCEP55dUnKk1Ego/gm68vlxLP1VnaLPRgLpKPW/mUsnuTY/7tmGzj2XUhAqwJ
+WVv5rhS5/UaqucgH9nXnaZIrvLS9SWu3LzZ5SLXKPw1ir9YZC1pTPrtd6nXPnJEf
+fNbuhKH8/3A3UIt3NVEN9oBxmJiof9jRBWKyf1DSU13aP/wGmCCOiU7gN1I+BLMM
+3ZqP0WF0Mb6Y4mR6cAFHY+Ug/UjLX21okPE6djKG1B7UeGSUwJGcof6PU67dxaJf
+Umk47+DIQoOb8aP2whFZ197D7CitG4kCWgQQAQIARAUCTNK42j0cQW50b2luZSBM
+ZXZ5LUxhbWJlcnQgKENPREUgU0lHTklORyBLRVkpIDxhbnRvaW5lQGFwYWNoZS5v
+cmc+AAoJEF762f6Cp/vNNX4QANyh0StE9iY6zxHOB2/fkK93itUVxQx5VsZ7/FkW
+s1Um01gRaDJ3so2VYtGJoH6wFGKy29VWj2zNLhDv7VUUnosBuasnZXgcjXCW6OgE
+g+t/fnuNXAHXLEIaqZsZwYgx80rJEMIAW2NEhxydzAj3m1gOf5urOqPpyDKcyB1V
+A3AVKa/08K6aS2Aa2xIZqt0ghGj3NVPBgRhkB+MHXmZypmbhRVZZn6bWXs0lhYdm
+BruljW2u5fgHJIS7Jdl5yvz3DaF9MizzaHvYBDWC3w1hbdE95cTWhPp8dRsp0sbJ
+AzPHf3BgkaAP08e/v4txUmqlSw4JfxFecWt0JV64qT2tKotVQrqIeMOgimPJ9ovh
+fqOlAKBvzJCBZ6T8d9bcs/xThqCSMPaQCh+PiN9T7/h8xxfG7+gfGP5fwOOCEOVk
+KFi+9xMXye1vx4A2qWh1ScALs92GvhMwy1PYoLfjfsEgeYvRGtAX2TMKkyOsHQMq
+DGOdRxb6yFeBMZPQD6SQaNHOt6l2gIqstnTy9Vk+I9MUT3ynmSX/rkF7YVdPkDJP
+6kUAsxI3rACZrZz8gN0SIH8/3+WaT39+OQXVLleP/BbkKBtxnopi5De72CTG1ocw
+JZz00ZvZdi1/DvElLs7ia/5IyNEviCw7m2EQdvLSSzl2/Py3pYz1/rfmQkC39FOQ
+1neOiQJdBBABAgBHBQJM0tGrQBxKb3NlcGggRWR3YXJkIEJlcmdtYXJrIChDT0RF
+IFNJR05JTkcgS0VZKSA8YmVyZ21hcmtAYXBhY2hlLm9yZz4ACgkQsNmRtHxAhzdp
+/hAAtF/zQVGiDrcSQuuYGU7Ez01J2Xk/9LSZ819Q3jsWopdQYzxGCmK+V8plEkGL
+IcM/jsK+NLAhZVzt7qg64vy3MTQ7anvjYx+1+mX1Z0p/g/r5IXXQ73Deg0RPPEtS
+cM7ZanFlBUTniMEkZPt8qo5CZw23MeP2E4fl3UzHy1vt0CyB1dOJjsy9XPXLX258
+ON9IBnjS5s99fKqnCs2k0VFyNkOlsIdWzsvFCoQl7URnEEUI4OrrvftxQHouql3x
+2SxE9K7pIHZewg631W+UXuH72BC02kIXrHixu7yQIE84fLzaptZJWZ9Xgoigk12L
+40ygMQbc4zbRfoVYGymn/jdZ6W/4TG9ksq8FHFi5eZNg+hv8YwFabfYH9cshjh1+
+ldUbHKE1YbY5TpXQ9wNZOu0XHMsvo/pijcptUiC8yvmeP1Ky7dyJb7PkoOcQ3cjf
+31wGiGP0cgDhw1FbS14g2OI+fng7Ns+9LLOZ34/QryK+hBLppEdAnLgAvIZzyuyd
+K6KbdIPEzotffoJJ8PfEPoYa7ZHZZq3fJTno+DO8mhEi9V2jHkpDZDTNUkRYEIev
+SnfD8F/44bjvZHUy63T9Hrr+DTjqG2ucCDZeAkaMue/NRXev53RIJ8AHLTUG2dbf
+b+GHfC/OkkwFe64ZO0is/SucfzHqQArAUB5mo5B+RC0o9huJApMEEAECAH0FAkzS
+tCk1HEppbSBKYWdpZWxza2kgKFJlbGVhc2UgU2lnbmluZyBLZXkpIDxqaW1AYXBh
+Y2hlLm9yZz4gHEppbSBKYWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT4fHEppbSBK
+YWdpZWxza2kgPGppbUBqaW1qYWcuY29tPgAKCRA06nbmeRSFqOljEAC+JPGA6EtN
+P7fhaBEuLL2dhgTs4vPGvWivygw4WKR4ONGVEMBCQQCxafRxXdUQEjvRTxxdnI/2
+S7VpGvQlEjSAPkVcwuX+lwxPYb/7L8D78a11AtAxnxN16QsDBG7s4m+aBBfjn+ke
+Q1lIdScVqU20ZB4y0qrJb5Zv2hfaDUlg+99VS08VohymSFPEFzUWDufyCC/nJbPn
+rKZppbBHZmJT6WZm8y0i+oC65ZbRCxaMV8FVRhcmiafXeZoC/SURf4YSX5tgI8++
+/Ydwzxp2wxI1NCxKzsG7sERjLmtoXi9lrDLlWJnhbO5Yid6/7EXqzHjcWmUqag6j
+ldJVQRjUR8G7Coj5zUjuEUZRlTM8tllrWLLSamuKhyk1q+UB5gDTIqGDpFxj/Svd
+KeScL0fzsCmnroaLMXtd+QCBHmEk2umA9hb2N3bcq2Ht9+zZ5av1RHkNdT0L7l3T
+iFgyP8cx/qw5of/ZTQzcvD+Nsl3ijShyvihNHstPYDeANCcHdRlnmH6fusZGGV9t
+3H8O1kGIGi2R4Pw6pUDPuO1BHfA11Ld2uCuVbJwC+2aG8tl8v7XzSovCrn6cZW5o
+PxnT724UMZ1ms2ECMu0Re+4T/q5r1N93vmqHj2ANAm/Kh0l4xBlO/W4lpVqmZUOs
+dup5mKQMLQWEgxBYLNgEqimt1u0kP1qmn4hGBBARAgAGBQJNJK0WAAoJEH4q/cwO
+NxoJqXUAn04GJX6IamiK46TpBngfZXuSjh31AJwNfYn8nS/y9cFvQQaYA26RhuWc
+johGBBIRAgAGBQJM1CP3AAoJEPQmjufy79DwttsAoIpYpCX704vSyDTCWig5IFJm
+nBafAJ9nvPSQApkry5XlHAlv2E5LBADCy4kCIgQTAQIADAUCTgOM3wWDApIJwAAK
+CRCMleyeQza0SH02D/4qYvbItCLYBo/9/Aq4zvrZXFfveXqbo5oAQ5SXBmaPjOjy
+OqGMjtH0suxtYWoWsxqKwMYg6uiA7o1IIYnGNvwxsIy01uchCpjiiF4SUKbYYd88
+ort8wgUF3BQlDfweEAzsu8tKVkyqr9zNK4t9sfvINVCxwrEbCvyim62tLIxaVhYP
+uxufJ8Dw/dLULmC6vpVHfMrRAwanGqCB1eAejzPDzXEaIHKMUTFlMKV+FwgTN89D
+VzWCACmPglm/8PrPw7O/wpSuojp6nZXJcCycIT0CvgDJvO3ENnxrHYn6J9coznIN
+rGdfLdZ6c22xxHlR/HsWXnKILlrMg6EZKVtdr17puqgsjTiKAsHkRvMa5whc+HgV
+XPNI7RbFGKFvB+xtrgW4adQzqWVkQaKNSyVqy8+rzsRxrmQDaOn7aHyVMuBl7Z/J
+FXjxFzZnERWxwYgQAUoWhsZmx8ccewvb0ddJNCn95bvY3LYJ4M2c8naInEbo/yJG
+Qj0/3u6IJZd2UaPElEutdac9acrySukO3OJkyI6yqebNwL/zrj23RX6a/Oarz73M
+VkiPvQjPuKCkPJ/6jfI3hCl0wPBbFDsQ9kHoIf/QN0KCtIqU+FZI/jh7UkObROaz
+d1xi4P4VZ3hjKmPJW9dfvsqZ/NdJBm7mCBca7kE0yxi98NCIl4GE/goxiN5oQohG
+BBARAgAGBQJOvCRSAAoJEAsDrm5OJFF8U1MAn2DXWP/j3r1dYXO0PGegOBYBgLfO
+AKCD51Kab80lGi6JoGjeWfPlUJC/9IhGBBARAgAGBQJOvCmzAAoJEKvWMuzE/Jpl
+ojsAoOdCrU8aEY4F8P8qZm5v/lKm45l8AKDN3B4NPlrN4UMLSrtu/dJXsfm5EIhG
+BBARAgAGBQJOvE7tAAoJEC8+XTEfSeyle9UAn3VdMEXENr1qB2cPydMYbe++KQzF
+AJ9iPNmBm5Hu6gWHgxjCatBFYbrgoYkCHAQQAQIABgUCTrxfWgAKCRCarPtWNSrP
+dm/QD/91O5fgoLIfpkZHTPkh3dwzorQbOn2k3XXHNzsnzeCG1B83YWPQh7bwEeAt
+7JYFiGqjrlYKpfuE2oBUP+86nLGdAWbVX1rXWFXVKRtrVNYMwsPNDzO7aWCgej89
+JFl7vuZe7sls2oS5FIodJ2GE8hu+tID7iy81lgpWIto5u2XBUT+Cdf5jy9AqPG/F
+kxqMfxzHFuEQsiW7lB1ZGl7nO5SyZ9EKnQHa+2MXikZcPQfp1LQmu7KtufyFm2lc
+q8KVFp0LkBblxOK4+v68Zg9t+6gqVAA47MtbIxSr61mE+uDXfSuEDKPAlbyFLHLV
+e8WCW0lDq+O9RIxQn5nejr/xkGqzHOaKZ4uLaZfTTRIpIVdnufcQakUISKXrge21
+vNRWetaMn3H5pNd7nCj8PjVTgIuwHzHrE32NoVjmY+5Br3zQE8mBUf7CRxYIe0co
+6pSiGF+sOb90vUIaysfCKh+7ovd1VfBDKnBpaGLE42q4l/9ddkiXvuFrDcLMFSgx
+HCjpOeJGLfh5Y6Zk/q9Vv1Qa/T9gGsUDNb0ZfMsIzmMNnts+KJotHxqSkI8M7rLB
+LgxutUKaiNj7gocaQJY/dz1tgk/baJGL1crYvq9Ih6kd05SX+7NvN9T+PcCWi4XI
+FAVDkthcbm3kH12AS53Gd3bYY/Du7RxS/QT/zJHg46grKR061IkCHAQQAQIABgUC
+Tr1SiQAKCRBNFUEQuEUI7JI7D/9qoxkG5/63D8mimhfEQwxSBCITRqQ/HcnGaEp/
+530izpGL614zlGeB+Ss0KEbr/Pnw1AePEwD8IAfxthBq17UmFqSjDOSq6ANQBske
+CL3Ilrs6mMdJZRWjY1JiS8Wz06jW8SE/his0FvmIXCIs8exNjS/4ClXF+NTvk8N1
+OXNukTv4G1cRsal8ohy286rHIlkkSW1hY5glYHcMg2BCJ5Z4hZavYhwsKxfBjrb2
+OBB2IeWHicQ37r1V8IcE+1M/qg1L0X0uKF7rw3/09w5WjmoI3CAhK+r3gY6+PMch
+TC+j+HLz20RukZHHKaCSoDXbBJj+MDgMnq+FhhDA3ig+zknE0qBKsm3P82CNfyBY
+vGaw0pXBvQHiuBEimLajUucg4RDzFNYBwdOGIt8nTq3Ari3pGSC5HYqCP41aLPKz
+o1FTz5BFdHkIHXyMq9UPhcQfr0tM8Hoq+lqrwVigds+pV93PJe+M51t7AKTrJ8kP
+4hdiZSWE85UiW5giGA8C7N2mOUBiUjl9HKbsZQ6Cn3F7mWN7FZYyWjSZ5lSVJDxK
+M6r10BFNZuYbBmh0bl/J4bL/mwSvYP/depiTtafM1nA/+sYL/7W9qwr69HITaDmw
+tPiO2vZ0sG68v2nrqcuwxLiAp7su3MyIcmT3VNLedISh7Y09D3MI0WRmCuyQJUWA
+Xq6XTIkCHAQQAQIABgUCTr5o4gAKCRD7Yz3o9cuua8DzD/94qJyLF7Re+o+M1GGB
+SX2h/o0IwxUUjB950SIiHilplUjnBVDSuzNay9RqrX3L6uIWwvIfgdXn+MHyX/k3
+CtxKN1XrUhGFS197cFx5h9rS2DHx+ntlX5NyhnZtRycSBQMnaxj75GyzD2ZE1dBs
+O/ki7Y0Y9BI4bxu9zCLnKvDawc0Y7XkFjxV0KnPYgFTEKcVxtVZHy7cwxWwENjeq
++JFI5PQW1TmFm5EzIfjBtE85jcveMhWu4mLfPmbvByhb9N5O0rsSzTeOtgwypSH9
+JjVbXWAB3bM2vwxzDq5ARlS6hSNrNTCLQY0VVs4adLVVbxF3rOaSl2zXtaXh54LZ
+RGkfgaeYpPeCRfjdwQwBj3tHdYOpZR/ZJbgS9OcdTioHj0QSYW//BQViAwwm9lCm
+IgQdX+qgdrBYtKFLQ0b6WmhFSRa6zPjdIxgN9mSa/Nx7NZVOerxBWkHGIkadLvnY
+AiIaLmWRX58u/2y1FzpXABW9QRAWtbjUQZYZXeqrvXwXAEE8RDPiQz1egrEjm4js
+gtOobHBRBVDuqPZdPCt766E+tdBo2bEjcjvfVaADiWWjgHwH4f7Kr1uBe1jeqmFJ
+DCpsJF5X7izsdMrDsdC2UaCK5UeWQXhgyDAvjaPioAV8LCwVaom596PgxXTPwnf4
+KXCeZjrsAjL1XfEMH7BlBKvjYYkCHAQQAQIABgUCTsrLfwAKCRCJofZRKiOcLP5M
+D/wONbynmOipqbqF/vIkuRcPq8BcYhiA5M3FzPiZXH4rgl7aCN7iV5SU/oilbP3s
+cHgv7pN5Y6aLxVipvp5UELrNxT2zUNJUbmyoKOEu0NJ72emXDX/KGjqqLZ1W/jRI
+TZR3w+cc3dOzx9MH8XdirfLWi+cpk7k48UC3VeEICB0EVYQ1oA4CG+BOFva0/gw/
+oRmlMIzG5ItH4wyUZCYICNP9njmLyjjsxvXdSNhGil8tQs6ywMuVi4u65L3FDTu5
+cbDUs67DsJZNH11UpPQOBFX21JS+tairMkJW8nF9t+5vrWWFE6KIWShTPx0QfDYu
+tve4rvtUkC7K532KNCliVb4G3oJAuwAWdM1OImNRf9VVg36FJFnimVN9IkwIkN8e
+EjwyVEbr4aseADECz8SNS1hYeSp5PzY3Tj/L5rXYvzmkq1EjijPT8O3TiVmfe8RU
+apDrrTM+by0wyp0915+XRjatErqI1kO/Pxf5nnOCl/DNCml1LqjeZTzUQRKrvNDb
+CDMSXzG3cqHR3Cmt0qF3wQ8jUKifFeJ4AlJm/BkkPfyxhD1tnIOAA6Kq/qg3empa
+bBrrYUbp77+Fk+5VRivEN/Z9NfrnF77SDsUsRe9sbl8BFPtiKb40wkopkcA36Za1
+OW0JfxJwJj34zovJoL0jrIhqb6GbRqlfy/KqsXcVlKcmeIkCHAQQAQoABgUCTsFk
+CwAKCRBOvAyfAgj8EbP/EAClSVH+M+jOf8Zaf/UGOOSHBP8K9ktC064V+gsNBClC
+XWhq7y+MC93ER0Ghiv0VRKQBPZS+ZisaoUN3nIvVkQM1ZFnQ8giQqDoXFbZJ8Wf+
+AexJkwSvlE2fmnwWykCtaKA+FHfeJs/YS2BoYbHMBrMLvZmZw41lvFIjv9k+OFNF
+pjZuEuCfQnZxb07ecyR3qBZHdRBeOEfrswJzlek6bSkjBVEioh359KkXl5266uHp
+bpO5yYAvwRvWbzgZ+aQeeyGzcoBrws9/u1Jcwmc7IWjr/Crk7pYgwiXHT4Z91ZqT
+XOeSuu+iMZCnb+R0pNH5Xbn81yQJjyoHa120bZj0OArnmNRTtASq1+yh5xsn9OTy
+bznWNpZUnPtOl+XeS4rfGxYpzhXYKHBUN5+4cPH2eYpyoOH7uGdPHaJ6WP42Nf5m
+joDBu9MZJPNuTbgNk9Ei1qC+7fNkXUF9VVfzgp7lIL+1gCvW+iPz1OSEjgCctGBN
+FyccapuzEMIBVOZ/s0HSc2DRNfPvubUbeRoaVbFlWusOWgoXGsqkyMSFKV+pBeVO
+CRK01g2RkfpZ69CdKAWB49ean6OaF6Z93Vtdbt/QRm9XsWI8w6FZzFudaUhyFnY7
+EhkeN5e2DOxjhqciBuOndM272i0m6WcScEudr/65WKQoSWgnBQsGKeeQQFxn1qxH
+pIkCHAQQAQoABgUCTs2X0QAKCRD1T+ZICIM1qUhhD/9s3yVu9p0bM01hIdLt5tju
+PXlSciGRXn/d3BgI/IRDwfYdgRq2yLym81iFRoEy0s2TF1VtdTJiXcpET/XP2sIC
+JwKmAzUAH+BYpfY0G6/uXkXfc5ZtCK/QEQz0G20Etb+vQQN/JYhgQKJKVPEh0Qor
+3McQbDpjjktL66npTE/aZ+Pnop3Qqf4Y3fP+j1/It436B+5AEcacahxnpchZMU+e
+XBn1WhxZqm2zeZcKyR4Zqg2/oGt2vrm92rqME5LaeebjKHWA0gRXAldK+uAedTaD
+P0c+JPem4W1K+CIvyaS7qsxch2LSSqCSyhBOS+yRtd4E7IHX7Kp4P/ZxrPVyUbOk
+fw4MNtPizvR2sA6FVElzfUFDD6Axjc7oqxOKaPc2vrG8CFpomvRwDnBcdnIU3NQt
+QMs5I7t5VONwGuBd68G81qbLlHWUIqHs6T+n5XIvUuh1WIfloEK+A5cJiiXWIyLz
+ucjDg3yAjXuvzrddbngdT+hMBkwwJKFVMkTvFiJ82IXBsR+MBA5WUAp+jr4x51RE
+y5IpIvtY7ux1Z9HORrm5jxeDoU0AmDDaTW1MIC1SkX+Pti8tKC6mOZJ8d5/rCQ2Y
+GU6PVIhcrsb8fGojASrnLeT4QmFpOssWxPCni9hwPZqUIvgBKgB4TMJtgsz7dls6
+A2rAm90NWb7CjEFVluy3uIkCHAQQAQoABgUCTtkqEgAKCRBzJfkC4TA6mZKQD/9F
+79MIbd3EDvrpM/oaLuVzQuNE6Ma6ZauB9LRFE6oRWDMUjC0cQSXGA6JM441J1WMB
+ngj3X6Wg922gVBBiptZvQUnMyPOS72UwJ9mCdS40lcJOtZjs31HY+/f3j6LJkZ1A
+8FKQn9nE6ceYVk0OXP5Nb01exXwPoAUZqAxqfzEAPyyvKXiP/6A8AxWg3/k+6mhM
+LeLB+5pnHeci65u+FU4UKWPLqqyuqv+UxCSrra6vozWmmtU6WlRtvteu4Y5aerqA
+vFaJCeO759IonXfPs4TzFjMvrW34jTHmYCV6vVqbOHu5qC2FKgtzGwlKd+MDGOCd
+2ekhd4MbbrIxp/GXfIbp3+vrIzkNpD32DgoniYlbrpBToxTJA9iebpcZ/BWtbT/P
+Uaa4imoAh4oPrZvj/iVzfatZ70FPC+Mg9I/3PWuV9sxbffFNNcywh/uGjI2WcJGs
+FTYTaTU7z4HnewDLJRYDYwO9/MjSb2mCsg8cG2ANiWZfHn2quCyn/gEGe0ffMjPn
+e2ZycUCReUo0ZcnEqz9VvakgwVSL9SiQrDsE8VNr76UeY+8m7rwTME5RMrM7nyFz
+tR89kPeD0jgnepBUyO+RpBSCexboKJ/GZqCRkiDpeRQUjzbLJX7IyULiqo3ufWvf
+KZqEUZ1qVAOCH3MbUFyAsBWALAVAXo8HS7y89nqt6YkCHAQSAQgABgUCTubiXgAK
+CRDGh181Qc794IzrD/48aDMZ6/fuonNVJR4PRd4mqU47Wc+S3URCMa3t3GGiXGkE
+PPhKfiubw+szqOu6ob9ZrAXXatPGaP/gT+rfP2Qy8I1ed6ors3p9pqa4+4v2fFZ2
+rkIinfw7hJcQuGJw/fBfP2EtpP2EU8KMR/QZvavxtk63BXD9Ed66chTqo0EEQrh6
+EUWEkBGBkrfPKH7FdwdWhhfNsI0EpE1l8vPD+bjobKRO4ByfwKVEOFA+6Cd7uh73
+LTuCnmRH+qRPLnNCZcoiNNR54U3SETod8wBEiCmo4HR3AVGYIEG1faUr7Dz6tXOo
+57lp2ced2AJANNw8kZ1R+5OhWY6J5ydTaqSBsk68pQtvHW1FqRBR5K0gq4ns8GJc
+g/yj6Tyy9iH2IxF2O7EzDS0Z/ZG4T8L4HMO6HfkUVGK95s1Pka/M3Lz2X8SFH42h
+Y396xN63SJOXfhXeOwDvtaFkgOvE26gqMN1JK8oyuzCsN8/8G98k0ObdM19rwkpQ
++zgQ5Z59I6m3v5szC9B55ikeTYB7EDDPxdibfMCya6GUvzkGpfCNb8ba4oA+nwTB
+kVk8+ROWqQUuKgSaYdEnEH8yxoTdMC6J6VTO+1f1qNKH2oGmSWqEl1xsVo1ZABnP
+iiRjQsLbxJ5WcHKDGVz+74Q2DL3XpoLCsYHzWv4aSdExllc1Fpf9YZDfb86Rk4kC
+PQQTAQIAJwIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCUSCPTwUJC9IwFQAK
+CRCbuGOw9Ru4ikDJEACVgT5YdZm2QBnh0OKno6u+ZwD2eIBfNJMXZAWdkXzY8JZ3
+QR4wOq9WfUhFB/Zl3qj1KfFc7W5IxsTdHELN0+eOlOg7GwiLbirJFLIUDgJm+sSi
+Mr+6To/B9NKhvUDVt/GtxfpFo9CbJ0neS7A9cp8l8lI+GJHsRmW2rrS8a+hyxJV7
+TGnMmjfOtWpjjGPbw0nu+ncLSGJcBSyMDMlsG9HPSg1faggRSQ/irR+OP2gm+/1E
+iDz5L13m5iYNj4SDnf7VmLN0AFPlaNL/k82cQgWtcGCE3WPI5tqK9JOqB5zX6Mq2
+qopON8Z+QaWYzaPiHulDkXuXNkQ7jcBb+iO9kYipM2PnRa+LGfgGh1SoMZxX3heE
+F1YPktzjBi5lW/0sCJ5BxIhhpQF0XfFKjn6Dbe35/Xyc3dnfHCcUh8ytSUPAiwlT
+saYFuiO7dnATLSAP1qQtQmZJvPTyL3W5CDYjUPOZiCp1TVTEfY3u4cjAhgdM8N6G
+qzCgoaZfeOH9wW2u9d/pwUlDE0i7KAvMkQbwPlcmQaIKBQxjv+K3f3+gViv8uU7g
+mDrk5A7WILZmbxnj2iRPDWxnClR/VoM414HmbqoDD5dX5h7Ldd49Z83fSK9NNhM0
+EpTVfHyXV/CmO2IKxxecPqum1CFxbx46b7qMEpRMHtdMRLuIag7Hh0XTi84JYIkC
+PQQTAQIAJwUCSvH9aQIbAwUJBaOc7QULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAK
+CRCbuGOw9Ru4ij+JD/0TuZUtNamxHdmvZjXlhREZWIa77qbS6d2hWsKUTBjIYSsU
+n4yglHZIsd5/p7IC+/Ri9ar9TFGvWtori7hTtM//vdfUUqYWQQdQMSEHp0UNxtQU
+/eKQHaXfxLKHlU9Mxic0h/G2M8KW2hq6986Vyma25LdAJ+ez7GBaYgJa9Z8GAOri
+uGVOimDNRN/OS3L9WS5AwYLaNClQTsRLLicqyF6TRY8NFEh6/07iaHGgsEfsJraI
+Zl9MpNhdg5TWfPBQ/ZDAYliCLJvNe5TjmRUAyz4Nb57QLrM0hbGdq0VnXvuUbERC
+AIn7ZrWZJdo+qUzoQ8VM3PnUt0Ptyd2/+oMfNv5hz3wcqZW/3sgGXziHA+q2VcU1
+thXxutQa9bgz52G5CLgGuXW92QrtPggbhpbaXKUMz9zYBLp9nSehNa48MGPk39JG
+7fe9SQmj9xw/xkmyI1RSPJMFMauGKUEMo2FPqlTFj5FP8READcOk3Rq3NpkX7vOr
+E/ECcg8A8UvV3N74n9CsWyburuXl/DGbZaXIHe6VaDe+fTpmGTZiow5GR2R1bsUB
+rvQXDEo7BeR3xksZ30GlW/KTsoWQ7okGX00XUdUzACESgXJWMD5AD0ZnWw0VDYJF
+9IsCf9qKkmX5nLMSqTUIqvrUiZvoF5qn0Cgvr4o1TUsiTrPY/V5FIgIft1XvurQp
+U2FuZGVyIFRlbW1lIDxzY3RlbW1lQGtleXNpbnRoZWNsb3VkLmNvbT6JAhwEEAEK
+AAYFAkzStPcACgkQgngd5G1ZVPoC4A/+JySuHv8UBK1iqOnltmdRYR6b190wTuo9
+Ir/iBFq7ofqxmEoxWqVct6lfqDNebAbIjgaAwoOoaKHkeyhZlcmCfsVj3QFAiwq9
+hkxP09hkHSVWvFh3CK1X9kYny7ljBMbx423ISyEZj+Lf3AjrjxI9KbRdNY3jMlUr
+f55pWTT4w6JR/qsIVx4E5g5wnVNBRI+Oqn0SijElfy0qA7UiMvz+sxAUXQnpC9c8
+1jp4RLgW16FazwwMq0vpb0NqszrTNF1Uwl2k8V6qC3fnrbb9w5b2zDRMeEmHunVs
+CEODOREkQHT/OdO982AxOp03uH3MQPYbiUOAgUlUwGJi866jBu01jiROl+CihFIX
+PidQeL6+Uz9aurk7H/gXAafwFBxcURn7zsyH/pb19HPfxg2TiOR8ZUgqQ5ytcAe4
+ONI/tVU3yUs/l2QvqqRKI+Cwi0iPeKh70Ny+lb5gjPN0lxAwYjCOZLJtQ1osFABX
+S7RcoZvCO7jdf5A+WdMm4fqB3FBTVpuZofU84GB91S8l9/qj02h1ZUDzUUiydsm2
+d+HHaGXYsx1oxgJWHSZ68tTrLSttFXi0R//VizGEfrYejMvU1z3Mrt/nn/Oua0UE
+sMK6U9nzSepflXeHa7q/xtdQ/5jNo5bXpI7TQEMe4dFoIC6NyxVvbYrrdPQZcGS9
+6GqyfG6d8qiJAhwEEAEKAAYFAk0cTOAACgkQP89Sn/LyegZ9Ew//YSC4hvz6fcDi
+uFTgpVEie1epmUhUTHe2lCSb7BErla9umRu3PAe+YyaHpunnKeA75541vA6navE6
+pp9bLpPllMc2OoDWOOk7REgLgPJkJPFiCWYeTpowHRvkT/qJV6BgJuehr3uODF0f
+/fVkaCXCOfZowEzu6NuXGfZ9qxwkM8SgQASRqDgcOkR6V4ricaT/lVx6Y+iz+3ua
+16CJDTMi2YHOwSV+MXDDujk66ebD55IYZeA+0B4I1YYKNhX7FJrTWYVGZ2XDaSBR
+5sPzohEPfswxQMeTV5ZwJRgax5Mzu6Ln4GiqVrk6uB/JRAabNN3IPq4pkTV1dt+c
+CxIEhLV/QjJ+DeiMyqBs60/LdeME89yFRsXsAKkP4bSsUpzVvmOHp1gz5AhqGec9
+Dmp72qLFM+/m9Ng+mxiZgaKyjENcKJhraO5YzdHgskfNu26yoJjqwgpRSoQ9P9GE
+zDh3wNd0sVaiVDQKHOPfpVYAFxst4/s4K6ZpMRXofm6wiABKwTRFHbE4Pd7bioBK
+A3UPkr3n4AoAo/bmlgQiS0jwMB40q9ynSkUKO99zyDybSFbeVCRmGU62k422AdhL
+rcwy26Tj3yHkpqLft8FBDjdOuGQcQVMP7PUD1p75FlrGdZw2Tpxqp4p4cWIydzSn
+xftt3ZB8ik4zwj0VU7Nel1uH6hepyvWJAlIEEAECADwFAkzSzak1HFRob21hcyBE
+dWR6aWFrIChDT0RFIFNJR05JTkcgS0VZKSA8dG9tZHpAYXBhY2hlLm9yZz4ACgkQ
+6k3K3E3KqI/pLA//e5RZqiH2ySjcRkgAmwKEfwpiixMvGxy1qT3JtHveTwygvG8g
+w2m+jHAA8LBAh2WioB4s8p0Z9TnJgUh1a3APHh8MAR6sVe9TnLuTOiIUNp1NWlu1
+dvndNvF4ionIfvilA6rc4oISI7zmEwbbhQJd973YIAGNTxJee1LD1svD8TYyVtIt
+VTGhm6DsNZZ6AoMTffVZLmiqxHny9qfcVKfsgWSLRCiRLkqUJGzafADZBwIW4ya5
+gObIWCA05bFahgAzLeOHMNLoIkLag8Fo6P218Gc6BVnAvWvGeeW4+MPmraz8wlLD
+riqah6tA1Ofkp70xy816K3in3Uavrjb33M0Y8dQGZX7dYZq9JtGNMsPqJLTUS22c
+11ACQuT/jw5Cjpm/Nq9HRbRfbnmtpF9YLAhD+eXVJypNRIKP4JuvL5cSz9VZ2iz0
+YC6Sj1v5lLJ7k2P+7Zhs49l1IQKsCVlb+a4Uuf1GqrnIB/Z152mSK7y0vUlrty82
+eUi1yj8NYq/WGQtaUz67Xep1z5yRH3zW7oSh/P9wN1CLdzVRDfaAcZiYqH/Y0QVi
+sn9Q0lNd2j/8BpggjolO4DdSPgSzDN2aj9FhdDG+mOJkenABR2PlIP1Iy19taJDx
+OnYyhtQe1HhklMCRnKH+j1Ou3cWiX1JpOO/gyEKDm/Gj9sIRWdfew+worRuJAloE
+EAECAEQFAkzSuNo9HEFudG9pbmUgTGV2eS1MYW1iZXJ0IChDT0RFIFNJR05JTkcg
+S0VZKSA8YW50b2luZUBhcGFjaGUub3JnPgAKCRBe+tn+gqf7zTV+EADcodErRPYm
+Os8Rzgdv35Cvd4rVFcUMeVbGe/xZFrNVJtNYEWgyd7KNlWLRiaB+sBRistvVVo9s
+zS4Q7+1VFJ6LAbmrJ2V4HI1wlujoBIPrf357jVwB1yxCGqmbGcGIMfNKyRDCAFtj
+RIccncwI95tYDn+bqzqj6cgynMgdVQNwFSmv9PCumktgGtsSGardIIRo9zVTwYEY
+ZAfjB15mcqZm4UVWWZ+m1l7NJYWHZga7pY1truX4BySEuyXZecr89w2hfTIs82h7
+2AQ1gt8NYW3RPeXE1oT6fHUbKdLGyQMzx39wYJGgD9PHv7+LcVJqpUsOCX8RXnFr
+dCVeuKk9rSqLVUK6iHjDoIpjyfaL4X6jpQCgb8yQgWek/HfW3LP8U4agkjD2kAof
+j4jfU+/4fMcXxu/oHxj+X8DjghDlZChYvvcTF8ntb8eANqlodUnAC7Pdhr4TMMtT
+2KC3437BIHmL0RrQF9kzCpMjrB0DKgxjnUcW+shXgTGT0A+kkGjRzrepdoCKrLZ0
+8vVZPiPTFE98p5kl/65Be2FXT5AyT+pFALMSN6wAma2c/IDdEiB/P9/lmk9/fjkF
+1S5Xj/wW5CgbcZ6KYuQ3u9gkxtaHMCWc9NGb2XYtfw7xJS7O4mv+SMjRL4gsO5th
+EHby0ks5dvz8t6WM9f635kJAt/RTkNZ3jokCXQQQAQIARwUCTNLRq0AcSm9zZXBo
+IEVkd2FyZCBCZXJnbWFyayAoQ09ERSBTSUdOSU5HIEtFWSkgPGJlcmdtYXJrQGFw
+YWNoZS5vcmc+AAoJELDZkbR8QIc3af4QALRf80FRog63EkLrmBlOxM9NSdl5P/S0
+mfNfUN47FqKXUGM8RgpivlfKZRJBiyHDP47CvjSwIWVc7e6oOuL8tzE0O2p742Mf
+tfpl9WdKf4P6+SF10O9w3oNETzxLUnDO2WpxZQVE54jBJGT7fKqOQmcNtzHj9hOH
+5d1Mx8tb7dAsgdXTiY7MvVz1y19ufDjfSAZ40ubPfXyqpwrNpNFRcjZDpbCHVs7L
+xQqEJe1EZxBFCODq6737cUB6Lqpd8dksRPSu6SB2XsIOt9VvlF7h+9gQtNpCF6x4
+sbu8kCBPOHy82qbWSVmfV4KIoJNdi+NMoDEG3OM20X6FWBspp/43Welv+ExvZLKv
+BRxYuXmTYPob/GMBWm32B/XLIY4dfpXVGxyhNWG2OU6V0PcDWTrtFxzLL6P6Yo3K
+bVIgvMr5nj9Ssu3ciW+z5KDnEN3I399cBohj9HIA4cNRW0teINjiPn54OzbPvSyz
+md+P0K8ivoQS6aRHQJy4ALyGc8rsnSuim3SDxM6LX36CSfD3xD6GGu2R2Wat3yU5
+6PgzvJoRIvVdox5KQ2Q0zVJEWBCHr0p3w/Bf+OG472R1Mut0/R66/g046htrnAg2
+XgJGjLnvzUV3r+d0SCfABy01BtnW32/hh3wvzpJMBXuuGTtIrP0rnH8x6kAKwFAe
+ZqOQfkQtKPYbiQKTBBABAgB9BQJM0rQpNRxKaW0gSmFnaWVsc2tpIChSZWxlYXNl
+IFNpZ25pbmcgS2V5KSA8amltQGFwYWNoZS5vcmc+IBxKaW0gSmFnaWVsc2tpIDxq
+aW1AamFndU5FVC5jb20+HxxKaW0gSmFnaWVsc2tpIDxqaW1AamltamFnLmNvbT4A
+CgkQNOp25nkUhajpYxAAviTxgOhLTT+34WgRLiy9nYYE7OLzxr1or8oMOFikeDjR
+lRDAQkEAsWn0cV3VEBI70U8cXZyP9ku1aRr0JRI0gD5FXMLl/pcMT2G/+y/A+/Gt
+dQLQMZ8TdekLAwRu7OJvmgQX45/pHkNZSHUnFalNtGQeMtKqyW+Wb9oX2g1JYPvf
+VUtPFaIcpkhTxBc1Fg7n8ggv5yWz56ymaaWwR2ZiU+lmZvMtIvqAuuWW0QsWjFfB
+VUYXJomn13maAv0lEX+GEl+bYCPPvv2HcM8adsMSNTQsSs7Bu7BEYy5raF4vZawy
+5ViZ4WzuWInev+xF6sx43FplKmoOo5XSVUEY1EfBuwqI+c1I7hFGUZUzPLZZa1iy
+0mpriocpNavlAeYA0yKhg6RcY/0r3SnknC9H87App66GizF7XfkAgR5hJNrpgPYW
+9jd23Kth7ffs2eWr9UR5DXU9C+5d04hYMj/HMf6sOaH/2U0M3Lw/jbJd4o0ocr4o
+TR7LT2A3gDQnB3UZZ5h+n7rGRhlfbdx/DtZBiBotkeD8OqVAz7jtQR3wNdS3drgr
+lWycAvtmhvLZfL+180qLwq5+nGVuaD8Z0+9uFDGdZrNhAjLtEXvuE/6ua9Tfd75q
+h49gDQJvyodJeMQZTv1uJaVapmVDrHbqeZikDC0FhIMQWCzYBKoprdbtJD9app+J
+BBwEEAEIAAYFAkzS6h4ACgkQiq+I1thOQa5y3R//az+kyS9sQUUivWaEKjhqoOB7
+IJJE7E3/YkPiaLnehNI2S27K6FY2h+skpjuIa8kAM38GUAA74KjdCiS4S4aPhCvL
+C/c2zNMVtGCk6EDGaRuU8Nx0wKyMGHqTfAtSxubmNTbR/+iBNakV2DahcDJhuKbM
+1FM/IE2vbObjtG87UZ5RjqjQRKE0ZnE1zyTV/jlQoHMjQFgMZdf3J8vpOt+YX/Fd
+jOvX5+YbIgnpoA23j4wIQQdXjnJaax5gdKkeUugOCItwEq5h/tvcR+tUkfcoEUPS
+IsAFx5nlxBWAGwdG8ag+D9m/d4I/UtEAdegrG+L9Fv/dE46sBkWrZeF896RpJF1f
+7iNOS2wOHXQ16/sMyy0j1zlUGZi156a92lf7sv7S/gy8qZ/uM8MGslEoJKAvNbsT
+e0u4D1eV+NHIKy7XgcxdOvd0JFLChUK9vSrNq15c+armNHAo5p+HRNrI+A+hbWAh
+kn7Tje7FoVMbq04kngcPXpin+z8G9WURG21a4WQP2s/nJ9yC7cgb+olXi+iNvliZ
+qEdF5p4nYRYUG5mPOScNSFmZj3fKN7wTWA8eoY33ag/V0KEiZVc2WJV+A7bUqFNx
+FGQdLDtSHgUyZM+g4Tre03F7GbJG7K7i/TxP0vW8wz8JXuJsvY+AoCmagFA0tXNV
+MrdzhnnMPN6SobrDcHRWQ9OHjz5CJ292qono6RWXUz0bzh355QW0bFCK24Mpa4oh
+hkR+wrJxgCdKsn51vr2I0NxWIn/3rTUn8OpFOI6QUVEJq9GfQYaJLiYBx3/XRNde
+zXDNPSbeZV6fHPNwhPS9rKmciTdRc87B8xIeT47J0+MJdYJqlEG4yvLl5hmhJYOZ
+C7O/tenlu+MVdB2UkAUQUIBLxoYN4OU2VRk4il/38V4Q8SY9CTU2ET5up/YuA5Fx
+b+Mj+jatRkVR9meAeEf6Nc2x8HmkIllVVPpz6qckMYBcVD2fc1dENguRarnQLFAO
+Igfu9aZN3AhnZypNcPgDkCS6fsOpoQZP6DRLZBPx9wVWQf5JLsrMBZ73+dDjl3Io
+TzXXVQLkrg+tb/849BYRwDkNHqaSFvoBugpSTMyPTiDU5nkp6z4mnyZuSFUfn1+u
+JMctBRdzF25/6+I5fP98R5infEz27PniId5FRKjfZYw3fV61NPUOHmeCSXbzqYfk
+vAENo9mLBq8jXCmkJ0fYoGHZuHXCnqkKU9cZEQ3fh23G6VCEJb0EvFVTlkRF+LDw
+LyyCH2pk1IJ/GPZ17NcOE0kNVVi87VaegcyNnDlnbIJQv063fPoQio8uN1qzqTGL
+Ce5GoGo+BJUCdSnywsXCBIoK8zwUwWP7R0mcvuGFyVcTrTbXQEfMa2eHIreaGohG
+BBARAgAGBQJNJK0WAAoJEH4q/cwONxoJNHwAn0Rbwtm8qdQ5naHtPtxTbqnvnwtj
+AKCTQ3ol1F/J9UgLlL9NlVyloleXc4hGBBIRAgAGBQJM1CP3AAoJEPQmjufy79Dw
+ZGYAnjktFpzU/3R+t2gei7E+XRTEJ/LSAJ96mGaEJprAgZ7R+p1Ae9eJBaqORYkC
+IgQTAQIADAUCTgOM3wWDApIJwAAKCRCMleyeQza0SNteD/4pjQpHD3OkcJY+yCD3
+zD5U3HKXRLigrR3SfRivz33EqlivC4FGvIUxbfxdiJlMhwW58J5+BrbiXkxgeVsu
+DfdKacjv+ro87i3NqJUGvCrmZFKN+p8PuuDZqD8jDHIWVMgUA9qXrrIwDdvdS6jT
+EsgmHaa0pVE8xQD8T+6DaVZOjbsZHn0iJLzrRjy5dg0ENOel82uTwFl5gNg/UB40
+66q5gASaTFzRr+qL54OnNmUrX4R459Hot6FogYUTowGzordQhFT88fJArfqdngYp
+Pq4sM29erxyTksUCwRv1wcmeUX26GuPzk3bIu+ExdyQJHJ+28p6DNmScvi1dXI7T
+/VnklisMprm+DFtMgz3eI/db9It6E+/W9+PSh4Xr5so9gShtO+ucJfeXHqKyrC/w
+Nw+eZKt7IKXWqXoXyNTKylOwyzqXUI5GFpgkn1QgZlpQI1dSQnd2ja1VANDMQNX+
+V07ytN28tEW8g4uqkR73hkrva0bUKwN+sEyTdjkAe45hCnZCVeCH06Rc8A0XcuYg
+wCTM6sElRlpoc+I0UWepls8DDYkIgOHyWUUMNq25odJ34dyMZuTBnsdQ8IacTxNk
+hh+ktkOgyL97F44PdSdt6mv4/heWeb9Bf+WNOtxGRU17lTh5A/Vo1PmTPY373dCL
+j91026aATwx7VUXxtJ3Oneeg6IhGBBARAgAGBQJOvCRSAAoJEAsDrm5OJFF8XuEA
+n2DV1RIKuYAhGkDeyDgYn6kpN++FAKCdbrXNf8O8oPD4zE71CvAFozTVbohGBBAR
+AgAGBQJOvCmzAAoJEKvWMuzE/JplcGAAoLYAV/Yr5kKua2wRMjdiJYIl/forAKDQ
+zQ5hksBZkPt7nqs/o5zmnc2VPYhGBBARAgAGBQJOvE7tAAoJEC8+XTEfSeylMMUA
+n1oAP8vd9CwWq6EWFfXk6jTzFucCAKCCjAjUess2a+L/Peg98anM93FiaIkCHAQQ
+AQIABgUCTrxfWgAKCRCarPtWNSrPdhsnD/9LAOJueJWvuZkxvP6oKYMdcb3AE5DM
+tNkSSEylxYK2/mM5pR/B7BEvK9pr0/So6TtGo6UNjSXfXIZeNiTqruSTdkF3Higj
+eo4M+xHVvDx2kQCg4mta4rHGOC8TAXQydAfl+i3XCr1F12oAEMB90KxzwbMuyGyD
+um6QuRfVAqHUOJdvwuz1WnqlUtMOE8eZweHdUKjgC/h7SRwqukzWnub37HFBDASE
+qxZ3m+D0INEpwiD7NkYvgqK2g7aIsRngY+6qwCCORc1rBM4ELzob2nLOymoeytD2
+uokM+1xK8mYhbxpi74xtrmUUaLHmv+WNcqFQNTGtrI4Wj6d0iuaeKxj2sLwVYfAe
+oGwwlO4ise0ZhHszXFKwCLyRyFuV4tZabS4d+7wMhztF7zoOMUCXXGUBdgDCHh+Y
+XSZxUFFTyL0unvnsS+YBHq5+V8VPJlB6q46IHs4TAcc9iwNDiGsLvuKZm0TRE7xG
+lztdRvvSZoc/ZMuPMia3HSO107H23qoiVxQTMkJQoDaFqzKM0M2Jnhy3fkpm+1xy
+J04XIFtcHzZ4+Fr+299l8prnHLRQoWqhiG+KK8CJtXXQ8iRsXbaFInmE+WxOc6OG
+VFiLad1tq19HW0rDpbLVggB/KPhR1j0UizpW6I0xFVivZXKn+6zO+B41+eTaNQcj
+crt3eLG0MXpCFYkCHAQQAQIABgUCTr1SiQAKCRBNFUEQuEUI7BwJEACTAIkrbKWj
+zxMS4JGJYeAaAU3uWOdyGHJ3lahQ6WFoe/L0ipY4j82bVmgHRb/pGcV4yM34x6b1
+FYM8kwFNqFUReDb14cB/6e9U4jBrGNIEgkuOOL5h716WJX/7jzh18+Wm2SNt+yug
+HTgP9QAPqRM28+ACuOD5H02ay6E2KZ08bmjNZWSmHA234UdaXhHV+lqdTgMc5dLh
+rLEX6+eve7vrJV6LCB6aq4SKu4UqTexWg7mtEluqZLZXarNnQssH1qPfkyivV1Xh
+1NfUgpOgtWVRydg0eFNE9Ux0CXLNZt3yil/0iaRBVFjr5M+J/lWoXo2M+Jn54pjw
+w2/VcQMYjOAt5WjG928gNEFDBZk3b0eM0jKWVY6xiDa/nMOzKqtEzL0Bu9v9brOf
+KOsgS/0vwKJg4Ktdt9UBhayDSUGeHWT2JP9pdx7+yYLrnGRT/1KnGeguNf8YHRxt
+EaYWcbaxR9GFPi9ZJ6/vzZq0cjFwoeU95hneZixmABCitJxAJ7HNEFzg7EApol4J
+rwtNuuMjwu1cCuf61UYtWBdCzNQG8OwivH3mZ9L3COmz6HMjp4uX4HegfYP8FPIx
+JQXtj//dZvDE9sGsZkqVvfwRJ8LisHGApPCPPWPK4P3DxyPzhoO7jVN6K/Pbmx4T
+/a7MhVCaohMAXOu2SpKQ2QzIdveExio3hokCHAQQAQoABgUCTrxp8AAKCRBTPe8V
+XXu8WnO6D/493waxI2i0yS5EO2vexL4t/E/RbGxvXGR4o1ldd9jWoZs259OFxsVt
+zgyq+PMTcxD0IrrbU4P1yj0jNfH3AE5SIgyunhWgP1oinKu83S4Qu8n6/1D25ehe
+Vozd+dI1fnKIgJM+0fHpKBftsbWXV6IX75doSsFH+afKQpKaQO4W8ybOFf097fMY
+M9Bpx8iF2h6kW1AJ4D73wFjcEYylEuuEPoupF+S/h6PYL+MfxvBmZtyUZtnYApCR
+0wkEZ2uAIQbeBjqsUmLKpta0dswDAlTSVokb6oNMFVEVn2QgiDKkba+kU3GsNf0H
+tdmdVLqGl+GOzG1ZM8V4WEbZtsBBqne9eLIyeUxwkPeyM+1g1+0E8d3ZCCb+e+pj
+1dMfu+TtoHblXH9og4hMOqOLR2/U342nHDtlSrETwYrF95FTTImsTIaz/4ZpSGHs
+C7otMHxWcDW5ek1QFDcMcruLp/k9uphHsL7x6ezlB9QQRlJURfW3rhkQ9QKv60ou
+8RCywl791cmaeKypDWut4dbAcEAU/52j3wCVkjv+PdO5THjBAvlWCe+ETz7zWwRi
++uRbq91Dtg9zZBh/KjuwdNrCPjlhNr/DySKhDOdCTg6ayZgx6chijTjMqhxuorDe
+orqWSRoMHcUbGCN1VNBicVcTvwLp0ZNGnIFv2tWa1NBsAHeTvJWIVYkCHAQQAQIA
+BgUCTsrLfwAKCRCJofZRKiOcLJttD/oDmttJnZ3a4BPd7AqZEPBjxGY/5MQanMF0
+tAYU6YxHHKXdfE6PRKaZv9sJHtPBWS6tTlYdUgntnxy7qYiuOAW/UUssdThqTb+E
+HrfPnZ68AEF9DbjlVp7cTvFS8jYICVQ3lelvwGLXvbQzLj3+4pnNPSGAEAfCPkOl
+y5imicTIjxnJ27i3T2BzjyhMRvhyV0OxEk2Y4D2FLLi/oeN4hUyxZrm2hP38kIYB
+UREX29W9XAya/BtI38N89StU5eHauLi5ywdIYWQMB0b2YIHqnplqRDN0W2h8kwZQ
+0DAVl7bRlTt0opVPDgntNi1ny66GVMA60JIIkQkb9NgQpDC+FLD+7Hn+MstGWhlm
+B/gA5tVQ5FU4vu7z+sOAXtrQyHrhqp4+QmMak+5HiKnM9cs65oAq6rj6WmF+g6g0
+4ksUlJakx+Ea0ervIhmwHMbuC6o2x3mTxibcldJ1brGIw3MNvF/vLJ2gkmon1xqw
+6xqn3Kii8OsZcigVFVxn3lAwb8XcKDJbM7gDosTZpluAlwlhZvP1zVT+0yjyLjcx
+blomgt27j1VWCRr6ue3Enth0vkQzEwjPHWi3Iy2DKBzcHmp5f5SyedFsbxUBVHyv
+S65af3/Thknsx005snZWBYj8JV/y81qHeMMRaTSrEoiQ+pzWx8r5btCTm1t/oOs3
+93gK5Ks9zYkCHAQQAQIABgUCTzZvaQAKCRDtOHP10yYnIidIEADM/xEu1TWcOfex
+vNUK/o3epLpRCT890C6ZXK+xI2hfIUObjEnUqNVuCQ8bRRWBlIVzeDw94elw08il
+uZcHJgr2mrNVXTi9Gg5Trp45DQdnSMwxbZAAwCrW+2JibIDpNAe3cCk4hSyN6yz2
+IXICt4mrO2WH9TsHXXXUQhq3bkQHontc1sRcZtPA9JZP2imhkYoLyjUXQhq2zpDm
+KbcukskpImiElzsdWAox27LabZRkKTWEithjtdD2qHg64UgHG4GTPnupEcBZ0y5o
+8WtCXXywpk7CUGnvIyzVuzWFusyrFfp6Cjq7H0K2hg9+d5JJBH3408tt84djDNXJ
+fcg/EWSNr/vmC8haJh7nHM+aeVCu0ztZrqxS4fgTA/jl5XGdf0Q04Je7Y8FYGQ20
+9PQnyujQyP4Pi9ye93RV3mh/Ki2OBFem0x2siG9ER4o37CpryRZg6AnKJ8RButid
+B5Xb8PqCC2Pxw/xl1UYUp8aqO3nOknlbn7D8q5+LGEANLZKz6sVMYRAvgknXi7OE
+hZbV38TtNuo1YCEI0WGUkTIUVd1dZ1S4EpqecIbIXH8SvzWrcVbbRS/j5F7gayc8
+1Jxpf98x1bHmd4r81rNXTpUyRPC9eseayK6Xh58ZIL4uzO//I8QFIob7tl27uYOp
+w1sO3QLVx8sLBJt6/fWAHFJuqk7954kCHAQQAQoABgUCTsFkCwAKCRBOvAyfAgj8
+EW4dEACv8cNDV2ayt7zYxvCUrBNTKjVhfvn/YF6lRnEKHc+9iBd3M9jLRBK0V3cR
+dSsVeXndvmUrmE52H6WLXKjJP44M/VRSvcgbhMoF1FBMkwueebG+xVrQbsoa161i
+NPv6zf7S0WLf078CoER3F0yMnTJUgR1ejiMQ5MK+EECcXhDwaPLAw6HlijqQJnul
+UkT1+fO5asy7F1QYQLp/5uCmSWfzUTfLNavWH2p1imtOJsl4koQvyZGSx5me1STS
+p5M22VhrcmzxawBeNWSc5YZcZNXaszvqCKT4Or6XEWASWfV8i9SN/yK5VZgFO1fO
+4WbuwD8820GWTRCSw6YQ80Bc8xpKJ9aPQBEnpQQ1hX/S1RJ1LnxR/iH852aP0tB6
+1HNcvE3PpJnmKfzZBsCER0VVuiBG5wwo7fILfSrjeKs/U1KHS6dmWj8uZB/r1tpV
+T0uGW5VG9o/CuIvZrVUsPIVYzH4st/JxOTW8wu1ade+VxC+ZAfDu0kBR3u9q2/3l
+fQaOim2+SZ9+PPbRnWClXQXaqQrg+bXSUFWveBqGAm4g8Hm9qRLweoeV611DMIcI
+/jSrzWudNSJrSgfdMySwQd7g/G7NHmb3AIUEZFPtG5PPSKnPhV9cR3BM0SooOaLa
+zgnCRuH0KZyMNOEXSTFCcE+4X5y2UlkNL9aVF3DTynhZO76r9IkCHAQQAQoABgUC
+Ts2X0QAKCRD1T+ZICIM1qZZuD/9vUi+1nCzf8kjkJnXuRhfFgskBDim/SLOhu+S5
+tIM7ui/xqCZWFUGEwRTR5kgNGEsTbPJ/x1glP0apQ7yaD6rWGbwqlbCqd1/KieGx
+NBkMdyK9JzfZkf44+Euypbac5shmIC4kLNN4ksgzLkqTnTr1ApPNrlLSOqVgr97C
+4WEDuKKPXrIkVvRCfGy5cjjXFBe+sG6b+PqYkyjC5y9m7WECW9wc92t/9pzXvk82
+sfPFzcF/0d+0bUF6GpImTCk78OMjVyjZ+WFq6RJF+yQx+k1ic71Huc6kk4ODPrMk
+7QawlWdsMbNPuPELhu4vu8DZj4bfgOy/77jCM2lkE6we+8cQ6FX73PlzlHV8qWQr
+e3yzuK+cbBZJ64XCyeiG+qcVLPORw+Saa6AZikp2g3LxmKK1q+MHUtAJbfyJvHrF
+V4w96kQsHnCAt6SznocMxn2JniUxtOrq1ykUbdGmR34WBzb/UsnAxgrIau+5y8S9
+pR9aBTmWw+AKOB1GG/zQcGJL/5nHrg/wxfnCIfO/1hOAH01LGLRMF+Ih77A03GtE
+sTRrtH0clT7HFb+aWTp4xuaLorPJ3CBoNT9lcI7HkkaAyN75Yd/WKZZbIKqAwX/M
+oKhn/DG+6EnS8MwuVCxMKNXftYIyhhZXttH9Erz8SUiQw2cTt6Nq1YjSoXwq/T3c
+EdYte4kCHAQSAQgABgUCTubiXgAKCRDGh181Qc794KfdEACInc7tkSJdiBsjlYME
+RWmGCMgjyPYbkIn8ZWCnfY0CkH6axy7znZ1XtAYg/ms0SFfkZiC/7Trs9XV//fR/
+BE+Y2Ry8bTuDjIiuAlJikYGc2mc5bm72jFg7ujx4AdlQY++FV6+8YAqtAYqqmNFq
+uxM95R9B6AbBEs3xYSEvD/flSOrvE+oC5d4rPnGIfKHKD2DaHbc7MednAz8txBgf
+kznk4zy3Ebx9joHmxTVbqsH8ydLTvFR0YUQxjQe8Whzeuu0dv0HZIiflygch1UqA
+mxMfM4+Zdw1dn2wyUAhFAmPlrMW0neoYdtXpNGL9fHGubfKHrFcmf56vtfffT2Jg
+mP4JlAsIkoYXLDDrtpfQtM1c9pgWs1ZWKakKzLWM+doW0vg1EJBv7ArCht/Ymlpy
+OOWpTY2cCWPxx5CWifOd+ZPmEL4vk0hJT7ZSrspR7/IykMe8ZA/CQEspM4yFoIbz
+1BCINzKcjZcurygRxlMUL+aZk0Fobgx3eijAOMX8yDbRkiL9Q0DA+zoH953Oqjqd
+mmVmP88Lsd1DxXEkt2wpedO1rUsGFjjSpfDP4NB5NRIjnx7Y/PLus3iyY2CSxcDe
+oBwB05GTZ3hqqV7tXVsV9xiGpLxD5kZfhBs1D4vf04dzvqp7/u/ORvislSNaSFxW
+eL2/4fr7ZxL/+1QvIuOSr7+WPIkCPgQTAQIAKAIbAwYLCQgHAwIGFQgCCQoLBBYC
+AwECHgECF4AFAlEgj08FCQvSMBUACgkQm7hjsPUbuIqV6RAAsyR7D1OSKh8WC41h
+ayD1W1MvqO6BfxCOgvQpoIp1ctEM43oI+fYjYxXEBeeiDpPv01ozQbwd7HSkCf0/
+1h0IvZNCZiUn004Mz2gmwSKjHl9oq5cOlhgJZB3RUbz4O+vo+vxkL8H/Mgfc3SSA
+9TdPWyTMn9m3YM46Ql7an0Q4Km9Gei03wkKoz48GJFw6/pnDgZP1mTq7JEYrQeBQ
+nX/5aUtsflXJr+riUIAHO6vjCy0AIN5b5D69/01+I6dk7Iw80kR+TFeT/0nJPiHX
+BRz8TDiZg/gJrdY2AykxmdAyZAop9IBJk3zGub7Aswn4V3oW+UIQ1pjIXH/bqciW
+RP/VAsz7kyg6cCteWO+Vtew86QOi3+1k82+QYrrDIKQP9rDhgKDr5CLHnr9HEYXr
+hV8liag1SNB2KTvDCiPPMscpDq/MWV+kdboq5m4ybOQGEUvpwQrjVGrPwyywkD7k
+3PqSpvy63p33zabbJHQjevopsDdDFzxlhH2NKJDH6WI7Sszk9q0VS5WCtneQ+8zb
+o4p/1nTVCSE0Leedy1LekUHDPUQ6pziGbjEU0JsvZNRC9RrKFUsnKTndgsQxlMwV
+2QiK/BfNwVkFReyEO5HEMvXXBZSR0JG4IJbYO9Tgzaxd/qOn1nD2RuO6h6O8CXX4
+ObQvMD6ANZOrQ6WClXKEKqnhuDWIdQQQEQIANQUCTOJSoi4cSmVhbi1TZWJhc3Rp
+ZW4gRGVsZmlubyA8anNkZWxmaW5vQGFwYWNoZS5vcmc+AAoJEKR9Hi3QHg4YANYA
+oJjhPnn2X9aUeepb6HzKkP2REJTOAJwMqNSRlUdSQUBfUC93xCAS6sUJFYjKBBAR
+AgCKBQJM0rRDHxxKaW0gSmFnaWVsc2tpIDxqaW1AYXBhY2hlLm9yZz4gHEppbSBK
+YWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT4fHEppbSBKYWdpZWxza2kgPGppbUBq
+aW1qYWcuY29tPiIcSmltIEphZ2llbHNraSA8amltakBjb3ZhbGVudC5uZXQ+AAoJ
+EIs6YB8IyXXlWaQAn1tiQjM4MyZA2v4GlT2Te9p05dSTAKCRpuwROcbdZlTLygOh
+H9j0/1lXXYkCOAQTAQIAIgUCURGZrQIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgEC
+F4AACgkQm7hjsPUbuIoS3RAAwLclnEpqvrPmnsvHXmxJviuBBsWXrBD6ces9BuV5
+LdCZr+Biuud0A/xtkNl9/2RiCx78qhszwNkNTGtyCUNuQXwPfkG0hdRr+qSuKds0
+/zx59DBGN+duxoxJOVSVFvQ/LG4QGi8xXauLzoBcCOJmdEJycdgvFkP7cRE2A6yI
+5C9FmHurJ43TZQHCdU5O5+3B7rmrPRaVnVy5/j1sVCgJcpFAWdsLC7JdFo3vyzEO
+BP8DIVE8eSVd74+Db0QCvF/LaWkUUM1noG8yXB8cnG7rEHQpg9T3y+pmKVtUIvoP
+DbNA3OfsNKCmo5ym1ps4yeX63F5SMZ4JgNXHEB5sSbdL6uFnyrFEeH6zb4u5pjdd
+g9cBRFLkAIUVpIISaWcGVNIe52YpJOqM9aQAzx2zVVfrB/0PHEex9zs+hQJLeUPu
+LI7QXKyEXD2xW4WtIaZxg9PgenzFWm+zTZkgaMW48EYW783xsq/dgia0i3s1mYSQ
+2STwGsM7whqUJdrNd5kybdaa17JRNXLtTEZU2mHtMKqfSFwOQ5KEnePLPTxl9KkR
+k8xrQH5F2MKgyQtZRLvWC7jJRceYilJ2K4XkT85xGzqumIa9ABrxeqZMlKSldaAF
+GYtSJr3m8TT9RVUTl9i2SJqlOEtuN5XlN+1zzhHAdzP/hxq35qunvgkatAm30DL/
+1HyJAj4EEwECACgFAkyyd3wCGwMFCQWjnO0GCwkIBwMCBhUIAgkKCwQWAgMBAh4B
+AheAAAoJEJu4Y7D1G7iKdjoP/jI+g2MfdwcYeulAtehiHpxWXU1HCXHblLdqLTNj
+DFHQ9KQaAi2yOhi/z6XRzZRCtBBrTqfOHEHl8h27v6Hlbg/J3XKz/Lgf87NUMoZ2
+YehvFvLGOCbt9AAMURTmTBOd9tmqR7GeG6IkeiIu5u0izyKezy0CX/6oyXkLyr7E
+Xd6n7D57T5LscmxlhsFW2bumFE+b3uvhfyeUyVH8yxNJGmAE+FB5PTb6WWT+yihQ
+I9Chq5qJVyEud+FM4XkbaqjyJCzzJf5ExU4uwbjWBd/fAVRgs8XGxfXPCJ66GurB
+FeMubHTIxKRnXqbcgYMeNNSFW27ZA5QHq0bForY2oWI2vzZtQu8EyJS94yKxRlwr
+Uvo+L2pjP2MOQGXcodSkYboEbNJrs0001+FBP+gTngK++pF1ihEcRoXLX4qXMwTn
+PdUuZ5T2PERIup6EwA1uFViNCa/RnaFFNSkNBkE9BcoZBUSGcCjZPzAgdTNbdv7O
+3QlZW6tBpKD9cXFzLinhElR1H454jEP7FqRYu42/TllgdNJh+GfLLHATRSe4dk9Q
+8ujOGXSbAoTwz6DHn6OrfRbXf6VrnjwSBC0wJ4lx7Oh5IspsBZtyK//GeMUa/0J/
+uXYLPNlDbBUckMm9e5lOt5PSa1AkM/bIxBvJc/XIOCcXVK/0iHI1KbaT9S3Am5xO
+BJM1uQINBErx+bIBEACvms9F9tvCbiiomUNcohHhHV+poRDb97luSQkXWqYYb4N0
+npxgAe+YzJCI2aKBZvLxIzET5w0foXvCDafrMvZ0nQHO1cqG4fFDqJYtietXW9CB
+d4kFn5pQJs1/8ZU/9/skQkw0zOJivfhHOnDza5JY6JmsS7By2fHJWfmkPU+5GSs0
++MmEJ1yQRTg0L0gYwyap2sYxOWb5h41mf1tPnEnZXT/T90E5YKtmAd6G3khuiuTj
+VoMvuqMk6ueVjK+B0mSmcg0rrwPa21rO7ymouL3CIoCniA0SoxeuvVqGv92fjxFh
+0a3brpyBIUj0SidVu8DGjlP5lFE7s6dX0hDYr8wWxOLOxHUvk02JQwoTy5UYe3jU
+g8cbGdACX99ATPstfdBmzMmhrJsJKGB7NzzZqMk15e7oxBEQhLG6gDCrpE5l+e/K
+TQH0x6R58IzyStlZYCcTYOS+80CGu3pQtIL6QXxnTAPx14Kb81a8h0+HRX4dELCM
+nNUAWnQvNaihTb7+yfVaJvBe8/YPLBp9ST7vLBC2P394syQac8sWx7oADq/YpIOw
+ccQzriEIHb0hsbiPXfaEVxYG7cdsdxTH78w10lgYWdF71VUYNZnUv2wOmKwxoZQs
+wXQa+gX96+KJAlcQKQkcrjl0/SY7/vMoPh43yGZyOuKFd9AwqCwagW06moAXrQAR
+AQABiQIlBBgBAgAPAhsMBQJRII+sBQkL0jB6AAoJEJu4Y7D1G7iKQjsQAJH0B3OP
+vE/8pKf7umGjzHFY7lIwXU2aZ6eNWGycxjhdNJxuBhQ1rcZAu/tT6Uv5AjnfjwaD
+2gYuYDRqDGnifAR55YX5/lZzLKGfkQXFSnGyC53hGx0BoU++jmRjCn4JJz2ncYap
+2gQ8c5O37olp4zzykVPwbiXeluWfTc5RaR3U2A/YmRRNRgu8dacPSQw1RoJo/A46
+Xlru92cLjBt5I6RatGTkgSMy2u2zc+kQNmRz+kN8zhTbMy0K410VBM0PSIksXK59
+YtQJlgr5zwfDlWk972HLorJu37GamBmv3MV6/nyIr9oofLNkY4wGm2KIqwRAcjEM
+K6JWwHUMrz/5EwxLO5tjQnzftbAuTgy4kaRqs1ecF5VVwbL2Ot2DqKnej/umjqMP
+xI5azBsh2o/2sIHMyPjiD+cOGGs8I+/rcnWFqm91GNZCnLMBjozbcFhOFhZ6XEsM
+8JiT6We8y/GOwm/NyE1t9hS6p52eDxEERqnvfan+tOzUIssw16TBmeFrPfxegKBX
+5j8v5jaNi0todmh5XIDUD3XJNphFDlDBK5QakCC/XicmH7qm5Rx3jQy4eLbMAtX9
+URDq829mV/Y6BuUAQQnURFvNoN1GXK2se8amRgb+2ELVyPUU2J+vZcJF424iI8qE
+djLV9x5r8l9XFbkJJq9Te9/EI0iuDhH6qbCBuQINBE/exNYBEAD25MRg7Xt8ZOmo
+oeWYOg1lcwkUmxD28fF0EaNAvhYd8aGv71uTT4sDdtOyBAQxdHu+3aGJbXFECciS
+GZvbZcP3TJDmw/97aIn1z5VHAFQiOFF9RxrlaFxxAbaRw8w9hfgxBLKe1VlVJjUr
+txsPQt0W3Cuow7TKr6FGoQzOoxCQnqHWWAXhZ4dJA06g8TH4XdvuRMYaKdl6psgJ
+EH3GnKQZ6Xfzv4CC0icavOcfVBi3egtAl6bEko2LM7OQp1IWlW06gIKIOrzDWF3C
+3+8bW6dYvXslP/hALbd5g5UiLoprqqXuUUZmWHi5VjSC+6hiS1fKqP0t/AbfbZF5
+/2iFfqcjNAIaeZvcE3kb8chR9k9F+LBfc5Rp4f03l75TmAQ7ZJJPAzM/Sv7XiGwA
+ekPosZl0UtWn+eQcTNVlLci0LvQY3NYU46Y/AKw0WKQuDgSEmjNxBB4NA9BP5kHD
+DgtNM963OeSGuyRsB82hwGYXShBnBvtg4i/Xu+0x2iw1U0Ad2MNbsz9VdUXVZefh
+Ww8fayjAvHPptnHTJ2DXukn7fot33LXx6bwoNfUlA6u4ZvVMpF3naA0RYHY+3rBF
+wVm0kd1lJ72uBFzyo7bzUQicPwKIHZfy6ajzo1XNy6M9DX96djpC5iSoFHm/waFt
+H/0vCpqntPg/DMp1Wbr3orKNEU7URQARAQABiQREBBgBAgAPAhsCBQJRII/DBQkG
+5WVtAinBXSAEGQECAAYFAk/exNYACgkQ4sL0XWMvWr17sw/8Cg0UoN4DMgFgUr44
+fjTFi36UOg2AbPuh8QbqC80Eh7wX+v6Gqc3OZi600YmT/JaPIwdc8YQqZaQKbu8Y
+JzadQMLSkeD85Je9g2zKjygc7Lwiv7UTYL9aF5OptUecRyaE0QQeQ4chQq3zhowG
+vBsfbIAJXvloP+T//mocO7mNmjfw1iU9nt/RKBFn5l7mHIpfOyQcdunC9sU8pgNA
+NGpenHEvjchvAkQUAvEAXAKiF6/+O4SjzLOPZLNh/oJLByhynPicpb8K74pV+ngh
+htOWL/3+QnjxeallGFBJPKmHwUD8bZUpCYJS3H/KPmVSa/P+F/zGkANjBvtmdX54
+288CAUgeNRSOKaXTxP3Vnla160WTishV9Dcjodjn7JDnhHOX6b9NpXYskR3k8G9P
+Sh6ggTmZJ2fRzkgk9SSUxjJXr+VznEng59emcmeD1T4HyC7nHhef5oLH/pyPt2h5
+fTsORUwcPNYVGWQZiEy2YY45EvMuW/FFGlEdNzByUGyvCKONK7/3ipWdnJv4OaVk
+teljbVl9sxRqecIcOAuAx7SbH8J7uxNlw0HiXMTTIiH+NvQwMyHQkSoRUG5IkBeO
+P+7B2DdS37Caw/kNWcCXwYe8zFVOch99m0wkI9vWBtpIstUDaeelHSSw8T6UjYF2
+Rgr/I45P4vJdmh0ZywBdjhIWqx8JEJu4Y7D1G7iKZqUQAJ4NZ5/BGEq0HTI8trdS
+DSTnphm2Iasi5CpDDLTak59rNkWjulxnZ2c/qflMY7/K1ZGD13kpelK0nWTfKXi5
+kVrq2E/6b/1Lp3GfVaxAgih9rPrcfp7cit8403WUTKYkmb+2a79Y/Nf5T8MV2e18
+MpzZkA+3XffHXQzzscyhBOTzZ4wjvT+uC3coRGwIgJchAd00yKgrPMYox0eEAAhB
+OIaYj85EHbdA1B2wdrQBwNPM6pN1kFvZKOAfTAPNSYeFEQVmnGya5jg9+RIeouxE
+SFEDsoe0kKwZeQF5ZaAiU7V1EJEefTnHVVhkULo9w19M25jdka9MGFyaiZrL0Epd
+N7+tYwQG2qzOY+JScUzIOYcFKPTMF33x2crMssMaX2HEI5JX/Y9lPGZMwEWwEtxa
++V5rJzZOpx0FZlBA8aLgn1hChjmbyTXXP+/cyo48v2Pgkk5WBqBJZzYGGH6FX399
+Hr8S1fzrwqO7+3vMzNuBZBbKH9rEtIAh6UqvhDpqZPj5T1dIWlhb4kfMcBZ3+fE2
+eJj31fIr5/QhPxUQ77Ca9nrMwxoMmPy3TJHjBNLOTAEHgefIBpFUt3ZtBayCWTsu
+eC/NmDLUR23oBvfEfm6beglClTGshZel7UdTNRGr5793K62KdM6XCT61VrH9g5T1
+YGX9xIlFt+fyh76GksQSYwhv
+=BVQL
+-----END PGP PUBLIC KEY BLOCK-----
+pub   1024D/EC88A0BF 2006-11-09
+uid                  Philip M. Gollucci <pgollucci@p6m7g8.com>
+sub   2048g/315B27A0 2006-11-09
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.2.2 (FreeBSD)
+
+mQGiBEVSy4ARBADrOOinwIJ4itmRYZkw8cecNVGDP/VwcD3p8rlYsjZe1MNEZhuR
+9nsNb+QOTHdY2iw92zsXYsYuk3kFEppGf+pomFnfUARJiMYkV02USvACRNSN+aRt
+d2y8FCmhBZinx1niYhOAD8J+B97/IUKXqEBOygpHXKQz3xN3770CNef1NwCgweIx
+0jReKJvR9uUgfqhps+EEdPsEAOmN37+bs+WaG+u/cd3Q/bHqDs7bG/GiM3beLop0
+HQLu68yE8KjZYDuKojFVJcvupAzP1suV7XaaUhBY0xJWLmGI9ZwU71yTTsDqex4b
+G3qQ+4gqYEzIVQkWHquHlBeH6Ipjgw+I0XctPklIGnA87pztTfycKy/Xk/6RnlBA
+29ujBADHA1PYdImHpsPbko+OkjOjdGjS/29kAUmEsWSVZ/PAVgs92glGHjBTZDWv
+QzvsDmceTWS8LCAQivo4FzZvn4hbMA5nhU3Nz5KwvA9fe2LhiSyMoKILk3D3odSr
+w/bZF/0SOZgBynz1AcC+jaj+rTGF3pb72RKLYZa8ZRCyzJpUYrQpUGhpbGlwIE0u
+IEdvbGx1Y2NpIDxwZ29sbHVjY2lAcDZtN2c4LmNvbT6IYAQTEQIAIAUCRVLLgAIb
+AwYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEBMkm0/siKC/X+8AoLnY1ra0mDdJ
+8KzdBWBRgm1wG4JGAJ9C4K7yr1bF/LKXKzXWXJ7K+E5YT7kCDQRFUsuMEAgAm0d1
+14gWPOe4RaOYy9S3bsJlKww/eLF7pC4oQKi+aWf914Q0+iJ6XcPW5dJRZkZ8ZQEM
+zwhDPn15mxedfuN2CQldgyi6DQKbAsNwnUKd5Ro6S0rcsNF4hJ9G7ZfTiSD58Vox
+aGSexJwToB5GrmqshrTBr4zfy0nGOo/GfzqADz/hMIDjLMIDQYah1ihidZ+w3XOx
+ei0aUsC45ZnoeAipiL8xlRljDq6h8dmTmXGBlyY8VaXghYkLhoF9bWZ6dUukVUIp
+OI2KyQzOIa48X6wLD4FbnIdg9uvcwItmdgelPAZqiJbsbk7MktYNHwbMbOR+W7JK
+we5eCKhiddD4v/ysmwADBggAhsI/RXL1qLwssop2cDs5oETekHHjRb/aDg2xLbL7
+KdB3wSnYPYwG5EmAc2jukCZonDEJYTZ1RePaK6QtPyHNZPWwYS4gZsQbTgNUmWvU
+r69VwBg8i1USADlKiMCLvoiMOyNEQp56yrwAVldP9UWs3p0laTZTwaNeqDS0m0by
+gDNTPuX5xIHwTe66dF2e6YKSXEEIqlluaHydK+K/l/Osxx8I+DcH3rkzi+/9bCk+
+iq3Q+qZh9uT2DadAbbPe/jHtcBzoQ2qFan0rNDOFGDkMGbF0y2cnjc9DXBLymcsd
+UTsRkhsB/Mq5+aN4sG7SXT7DwDesMz6jNdkqrYP1fNsMdYhJBBgRAgAJBQJFUsuM
+AhsMAAoJEBMkm0/siKC/mrMAn3/s778nZ6gU4+yCIwoVpf94/FYaAJ9XKasQwdyU
+QrnWO3UkWeAgmGQ70w==
+=wxvV
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub   1024D/0E44CF0C 2001-06-19
+      Key fingerprint = 6D0C 7498 5535 060B 2330  0BFE 47F6 969D 0E44 CF0C
+uid                  Joe Orton <jorton@redhat.com>
+sig 3        0E44CF0C 2001-06-19  Joe Orton <jorton@redhat.com>
+sig 2        78688BF5 2004-04-01  Nalin Dahyabhai <nalin.dahyabhai@pobox.com>
+sig 1        D39DA0E3 2004-11-28  Jason Harris <jharris@widomaker.com>
+sig          D23A41C8 2004-12-21  Douglas J Hunley <doug@hunley.homeip.net>
+sig 2        6F9E049D 2005-06-25  Pim Rupert <info@pimrupert.nl>
+sub   1024g/54F12E58 2001-06-19
+sig          0E44CF0C 2001-06-19  Joe Orton <jorton@redhat.com>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.7 (GNU/Linux)
+
+mQGiBDsvsLgRBACsHi7eM94mA9jlBxxwLC4ntK0Mj9WWm85V0C1y0Ei1MGz7q6Vu
+WdxKgkNMauWrqKCBDQxOI3q5InZd/tZcOXQzGMtA6DxdAa50ZthfCbo0+8bfm00a
+wCa5s/1x2tu7zuqcA7/3nOscZgss2k1RrZIALFimfXvq6hkchQyj9mnfKwCg1aOA
+Wk7psAeH7UZgBqGHLcEKLjsD/11APufZVhmQtwKP8+yVe4d6UI7e2r4lURoT942g
+tLlye1Rvh+FggkWjxKrwmyUaTW4jNDWEO1Sy1KCy/zb17lDQJReBNb4Q6wQwuySL
+QqpFYUy3LtCJHnWsriC2d/iuLbBuQJxxQQQ0B0gichI+pqyZN2fmtiyucA3EzXv2
+8WQQA/9eSsUHv1nq+t0mbOBg1wpo0qlofJ96kM6kh8tzD6SxsHx6WDqE2TkZ+6Kf
+Lr6yFo4XLY+5DOZ5XgR5LBTyH4PH8M5gZkqfzDTCJfk4qc2XzVW91zSbzQ0fMGWq
+CU937R2LwnIWyVXjBgT8QLO58ZW8/X17YIGcgqHW1i4VD7XwR7QdSm9lIE9ydG9u
+IDxqb3J0b25AcmVkaGF0LmNvbT6IVwQTEQIAFwUCOy+wuAULBwoDBAMVAwIDFgIB
+AheAAAoJEEf2lp0ORM8M6boAnAz/+oVQGgGcHIpF9ugtJumGRApTAJ4liHEQvna0
+FOuzpUZ6kMT3sgIaBIhGBBIRAgAGBQJAbHSUAAoJEDebzld4aIv1rb8An333fo64
+a38vUnnO6rRdVquUpYC4AJ9x3lLonu/WI5WmDHjTy1Ar2kDt/4hGBBERAgAGBQJB
+qmYnAAoJEEsqSJfTnaDjyOEAn13slJuH8G6VVPpV2m9S7FxRWh0iAKCEUKMYF+ZI
+mQIyWAv/y1Y7A0chi4hGBBARAgAGBQJByJzOAAoJELGJ9rTSOkHIqX4An0obHgj3
+3Oiudie1rqgHj1mxxAprAJ4ps3XhNLDkxtLgwdao85VYj34w4IhGBBIRAgAGBQJC
+vW/eAAoJEPxPSY5vngSdRqwAn3BthXNxPJBzDHRBgZ5d/1xzmFfqAJ0eJfe52uvk
+h6ZzEc1sdl0sjKuea7kBDQQ7L7C6EAQA3lBouLYzyMT83ZtRUNgYmDZqNai1crEl
+kuctL678IwQoEr4zGWTfwIb+vXkqf1VL2HJRXMTamrDfWo/Vy6ZiyB9IRpXNcNXT
+dYmf6wXqPZqOCK9Q1mp/sWJGafHVbjDsWzGYTl9XiJUrMBPwPIlLj9SEvNwG7Qrh
+jbrsBKkTWwcAAwUD/RWNLmA2OGhkkau62AHi2i20+zmPGLH0AnyaIPJAB6HaZCxU
+uOSNBIRsaZoOoizzvaF6Qtaa7KJw3SUviWTfyAv4Lob+bo0e9MdI2olIvjg7VOi5
+wNPldVa4Cs4desqeXecJowP71gFV/NBdBPr2DLMXG3aOhtRZkG7aueoUkuk+iEYE
+GBECAAYFAjsvsLoACgkQR/aWnQ5EzwyKgACcD+v7ABREHJd0RglLfFoAuCcZ7FoA
+oNQYheE5UpBrTY6qK063clE3Gt2J
+=NWjz
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub   2048R/4DAA1988 2008-08-20
+      Key fingerprint = 7CDB ED10 0806 5521 82F9  8844 E8E7 E00B 4DAA 1988
+uid                  Bojan Smojver <bojan@rexursive.com>
+sig 3        4DAA1988 2008-08-20  Bojan Smojver <bojan@rexursive.com>
+sub   2048R/9E49284A 2008-08-20 [expires: 2018-08-18]
+sig          4DAA1988 2008-08-20  Bojan Smojver <bojan@rexursive.com>
+sub   2048R/CAA19524 2008-08-20 [expires: 2018-08-18]
+sig          4DAA1988 2008-08-20  Bojan Smojver <bojan@rexursive.com>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.9 (GNU/Linux)
+
+mQENBEisAUUBCACoFc8Bm0Ipb03fNXgilmTiMgjWkVVddy/XliF7mnfiASZ97vwB
+tQyyD+3M0Gi0VvL282+EfbOdDkCSuD0b+DNGVIinY6YBCdyvOEWoduPPB3fEg8B7
+NZiDmuv6K3IvZnL74xFnEuq+U2CV2M6OAZW/yRtGvWRG3sa06IiyNPgipIy7zytn
+qh9FhMJJQepFAOa6+i+8peMHQtcQtK/sHJLG6GtX0Lo69aYKzmDDgzxZM4wLvBmy
+H4LqgYDPXmvf/e2hqBfHJCDyH5pk+nIWngNWjuXg3fo/v47tOWfv65Z3ZETWbE7z
+PrUD2P7AKvBfR7cKTl+VameyZsvOZsY/hA+DABEBAAG0I0JvamFuIFNtb2p2ZXIg
+PGJvamFuQHJleHVyc2l2ZS5jb20+iQE2BBMBAgAgBQJIrAFFAhsDBgsJCAcDAgQV
+AggDBBYCAwECHgECF4AACgkQ6OfgC02qGYjSQQf+M/ESq8WUviexEHItvTWka6yC
+gd2sZzhU9z58fhFZaFu+48GXo8dUojlGRPP665bLUu3pKiSG4UQhDjcrxkew+4g4
+g9Jhox3IN4F5istfHEcQD9X9VWDOtz00kESNg3PiwUUk4N4H0fwkohGz4yfEZXIT
+ZNsyRPLFljd3jZoQLRPtraPnxxXP99KE+3D4CswNwNDbEvWj6GxTRGCncCFlP5dI
+PXgwcQxx75sQoulk49hOpzLq03jhJAUqe0kWmJAXKwqpAXr77FWhOD4rET7v/Mu3
+piT4TN5S7vjjrSTLGb/OlyHDtOhBg+En0WxlkwLbJITEJbPhE01Phiri8IuFu7kB
+DQRIrAF0AQgAyJfi/My7CKJEGWTE1x6KwttHR/k2mPzfM5+Icr0Bhko5ODkCewf2
+EmS4bO09ltZHotwCYMefLRQnaPtCYsvdF1qGnCy9a7rgZpCEpG2+YxaaDvVbmMV4
+zNnKO3o3pjAnO9rRAM77SWW4XWK/CF2MRIlg52Z0dPNDv3SOOGwYN7Dv5iKHNxTU
+k2DjK0FJId4r/hvZH0pNwl0shvwzfmgZLLubGUp6zGelZ0bYbi6T80uappgFGZY4
+ozldu8/eX49KA6o9AZuGPEQKuyX7V/oHsx6atCDMUso97spVVGKQlDfAKGUsUfdM
+YwMO0NhAag9F7JyVpuadmVyV9icBxFBLywARAQABiQJEBBgBAgAPBQJIrAF0AhsC
+BQkSzAMAASkJEOjn4AtNqhmIwF0gBBkBAgAGBQJIrAF0AAoJEHGtyF6eSShKTw0I
+AK/gyCXyNFjt+FHIaTu3Y2rCdvv0n+UWOrsimnKkARVKq16GYoEN2N14LhqJhWfB
+mRMwL6WdXla6ZoppD1uzb9EVzdhkKW3fsBmHBlnGjgdOGvL/W/hEbsEd4qg35vGb
+pZo8t842GBnbkbN5ealREvg9Sk74uXjEKeesiw8LCgPrP8MzkaKH9L8/2IvHDy+u
+/4FPRdAfi+lr1K+RhJVAu3n36SesLpwSek0kdmoDi+Ie1QDMJ37Wq/RTmzXmmYEG
+H88rkTIyAHLwjZr5Pn+g1SPOJeRfTiRbMI0RyR20LVuaig9JXzfBwERIDCABH2ZD
+CIQaG2bLMFCvzmKxqIcxC2pcWQf9HSr9nVN0qqS6u40+F2DxHPZ5j0/GJZXRrGOu
+t8OOQ7wrBZ51BzmU66noFGz3ftjPROZFxf1XDdJKqOQVbl9mrY23L2g88UKN3TLh
+6wUjUAnnvRdar705r10iSdxFTehEXXTimJCMSJwFyj9VQxZSPbW+kvL6aSp4usC+
+3vVYErgt75sMFmo8XtI09kzBtZM4aqknoXmZ1Ck8QPpuLunQ4pT9mkYqCwTZaskD
+PD/jX8iP8YX+q0641fYbsz1kCE6ur+6RuxJTnowLBHaIR+Da0+OwpmEVMyM5YJQn
+qPsUIbmLK8YuDA0QgUu2jezEa1Y9oRjp/6M8UnEqP1hPZ89ckbkBDQRIrAIkAQgA
+wgjaTGzpE0BZPF6iZy222vHrnsQKvVnQ3JysXSXLSK7DNsikHMGhHTUAPxjIJ2Jg
+NCWf0QBfmOqLLYyTgnakkMKGs6jsLtPAyx/myKWEyU+YZYIhx4LbP7Vy2fjPdKo3
+VLli+Mjx0Nd0tb69Km1U87CPbO3deWxIarGixKqv7+v6xn68W/qg1y6I6jZbN7uf
+pdV9fdpqDI7lnuw67nOq1kzePoqN0XvaXKfc5nMz2CmJdjgLtYfsFbKVe3pqTJ4j
+tTIhMtgcoQ5XcVOsCygAhH088geOuKPYG702onXz5lnErG1KINEKWKC6BRdGi0Dy
+whewJ0hSRwpDEIvkV4rMBQARAQABiQElBBgBAgAPBQJIrAIkAhsMBQkSzAMAAAoJ
+EOjn4AtNqhmIuw8H/jQF8pEz49P0wnzMS3KLOkXcM94rQTTyX0KLwruxMa5Sk2IT
+r+CGgSNpEbOmy2NUWu+om/NIA+iOloM0bbWAZBDUObQ0EMbCI8P/60wvULrJOj80
+MwWITqBV4h5HB2q/gS+1cxIw9+oj6CwGLi1GqFeIVKReLE9aSKwLnjViWMkovc+z
+x9TN5Zp9Z5K1nGDLDXOccor9YzLgjx6lfYaEXnp0rHjoG49JPDz2iA5l4KX1j4IM
+1Euoi8/o+V0G46az5UqFDE7e574kygY/9XqfLBWEJKni+fnnOIrl8AIM27h3k1wU
+tFgJorzNs2GGEpj+kU2A27zmLWqL5fqDzY45SbI=
+=h/J9
+-----END PGP PUBLIC KEY BLOCK-----
+pub   1024D/6F9522D8 2004-02-22
+      Key fingerprint = A8BA 9617 EF3B CCAC 3B29  B869 EDB1 0589 6F95 22D8
+uid                  Issac Goldstand <margol@beamartyr.net>
+sig 3        6F9522D8 2004-02-22  Issac Goldstand <margol@beamartyr.net>
+sig          63F69B0E 2004-02-26  Gaal Yahas <gaal@forum2.org>
+sig 3        12B9AA69 2004-02-26  Tal Kelrich <tal@musicgenome.com>
+sig 3        EBD27418 2004-02-26  Yuval Kogman (primary) <nothingmuch@woobling.org>
+sig 3        9FC881FE 2004-02-28  Zohar Kelrich <lumi@musicgenome.com>
+sig          015AFC8A 2007-11-18  Bertrand Delacretaz <bdelacretaz@apache.org>
+sig          152924AF 2007-11-21  Sander Temme <sander@temme.net>
+sig          1CE17EDC 2007-12-18  Matthias Wessendorf <matzew@apache.org>
+sig          2046D0F5 2007-11-16  Henry Jen (slowhog) <henryjen@ztune.net>
+sig          3AB8598B 2007-11-16  Jay D. McHugh <jaydm@apache.org>
+sig          6210BFC0 2008-04-26  Jean-Frederic Clere <jfclere@apache.org>
+sig          65D5E39A 2007-11-15  Ben Speakmon (ASF Code Signing Key) <bspeakmon@apache.org>
+sig          69CEEB1B 2007-11-20  Michelle Caisse <michelle@caisse.us>
+sig 3        6F9522D8 2004-02-22  Issac Goldstand <margol@beamartyr.net>
+sig          6FD05E49 2007-11-17  David A. Rush (KY7DR) <david@rushtone.com>
+sig          8780226E 2007-11-16  Nathan Beyer <ndbeyer@apache.org>
+sig          88C3A5A5 2007-11-16  Philippe M. Chiasson (Home) <gozer@ectoplasm.org>
+sig          9C85222B 2007-11-15  Henning Schmiedehausen <hps@intermeta.de>
+sig          9D3AFD4F 2007-11-20  Theodore W. Leung <twl@sauria.com>
+sig          A79C6E18 2007-11-16  Bjorn-Erik G Townsend (Gmail) <eriktown@gmail.com>
+sig          B3B4D98B 2007-11-20  Timothy Olsen <tolsen@alum.mit.edu>
+sig          B8CE306E 2008-04-21  Oystein Grovlen <oysteing@apache.org>
+sig          C3110611 2007-11-15  Petar Tahchiev <paranoiabla@gmail.com>
+sig          E04F9A89 2007-11-15  Roy T. Fielding <fielding@gbiv.com>
+sig          E41EDC7E 2007-12-05  Carsten Ziegeler <cziegeler@apache.org>
+sig          EB51FBBA 2007-11-18  Marshall I Schor (Code Signing Key) <schor@apache.org>
+sig          F5BB52CD 2007-11-19  Yegor Kozlov <yegor.kozlov@gmail.com>
+sig          F79B7715 2007-11-20  Felix Meschberger <fmeschbe@apache.org>
+sig          FE6A7BC1 2007-11-20  Paritosh Shah <shah.paritosh@gmail.com>
+sub   1024g/6741A3F9 2004-02-22
+sig          6F9522D8 2004-02-22  Issac Goldstand <margol@beamartyr.net>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.1 (GNU/Linux)
+
+mQGiBEA4Z/MRBADgHIqs9R8lj7gPlUps8D3JgLJEEDnCCVabppX6+pdogmNdTYPz
+tjp8KLHjBSfqq+r4aUxp92CtZzTlpSAEEn9uo/dgb+/4233Eg4hpSff2f2fZzvpJ
+b6I4BaqF1SWVoGkVxZQGcC3yLFxQAc25UgA6DCJcFCd7InY4q+w4cw8AswCg1Igv
+BI6gYpVegrlQqYUVlfxE4p0EAJDbJTtaChXFEc3oR9JeTzN36NUTNpnq0L1/RNfb
+U/5hy2bt6YUWn2wtpwClGmA1IOxTO2bep8UvoQ8F8v/wgdQazlcS6wdo3dDm+hB2
+MFDy9qrGtXAsvNii1VK2O7XQHa60K+ZDGKNyGmuzXy8ujAvUE2YXD0LJH1pwBalr
+vrLfBACUU8Ch4aRwXHSwFyvNEQb/ICKc2wOk278JB8uRSavdmbaDeAKoWj+7LTx7
+H0xcwUyP960dJea8CYYGSrr5IESOH6sFjwy8Dv7P/xo3COf5kO2KfhoBL+ABEJvG
+VmNFsoNCkiNXGjkBLJTwav0/R2pYRxQp04h/ctVrJr+lto6z3bQmSXNzYWMgR29s
+ZHN0YW5kIDxtYXJnb2xAYmVhbWFydHlyLm5ldD6IWQQTEQIAGQUCQDhn8wQLBwMC
+AxUCAwMWAgECHgECF4AACgkQ7bEFiW+VItgf4wCgpUd2Ln/cCyPgV4V09kqM6+g3
+ObMAoK/qeEztO7STfdgcKJnAR2GQvB9PiEYEEBECAAYFAkA+YAwACgkQN2uCuGP2
+mw7l3ACgmPGmdtk+n1jQkPNlmy1cgIVPcGgAoI6vVfqJ9+AcnwehoagbD3f5LLeI
+iEYEExECAAYFAkA+P4kACgkQ/sGarBK5qmnIYACgslT6Mb6VfEvs/qN7GoWN/oZ/
+jgEAoKhcKA6gqbWBsh/ihQijlF6zICssiEYEExECAAYFAkA+ZzYACgkQVCwRwOvS
+dBjipwCeNnKqRspkZufe4XjL2GFQdTXaaZQAn1Gm/O5Fah42HxoNt3PrXh3WFnTA
+iEYEExECAAYFAkA/5f0ACgkQdW1LhZ/Igf6nAgCeOHExK0HUSqXQq9vKik0ZkzFK
++VAAoIq8NmLML388JYGLMK32/HegJAF8iEYEEBECAAYFAkdAlWYACgkQN/aP9QFa
+/Ir4hwCfTY2KuaV1ysNFb32LW6VEYZccmVgAnRACJIthab6J0zQIj5cAlW7vfrHr
+iKkEEBECAGkFAkdDlCcgHFNhbmRlciBUZW1tZSA8c2FuZGVyQHRlbW1lLm5ldD4i
+HFNhbmRlciBUZW1tZSA8c2N0ZW1tZUBhcGFjaGUub3JnPh4cU2FuZGVyIFRlbW1l
+IDxzYW5kZXJAbWFjLmNvbT4ACgkQsr68QBUpJK9cGgCg18E4t5jbxd4N72X2AD3v
+cEzTDNkAoLUp1EObt5Yr/mFkTKPSZwRP7EVCiEYEEBECAAYFAkdnnDMACgkQQMKr
+HBzhftxAZgCfeHQhdRf04uxEd5rS9mN1gF0ZnloAoIgsXNemGq2wGuJJAmeauDoC
+kVBqiEYEEBECAAYFAkc9FkcACgkQLNaoAyBG0PUzcACfchAh4Apr6TdP1ka8FuT1
+vog45ZAAniQVb/yl+MqqkniL0Hfm2FgQ5ozCiEYEEBECAAYFAkc9KaAACgkQEYjo
+3Dq4WYtzXACdHRQrXQs+jQgce2HfsWPrTvtWYswAoLCdJK+/Qi97OXN4wl9bK64K
+1J47iEYEEBECAAYFAkgToLIACgkQD0UKJmIQv8DIAwCcCqxidJW2K7tISWyNhtXc
+tx9CEysAn0nrx8zdzoYWu4PpBTtbtTDGSckNiEYEEBECAAYFAkc81CsACgkQr9Wc
+wWXV45oWNACgqhI1zGHGeBVOIWeO4327fyX9ofAAoIeO37Tzg01Pp60XL+O4DVtR
+Vy1DiEYEEBECAAYFAkdDITEACgkQ7U7vsGnO6xuXAwCfTi8nBpinhmeqPzRX+VWr
+0RI4E0UAnivZbcH4U1voSgMpktFbZU7n+mB8iFkEExECABkFAkA4Z/MECwcDAgMV
+AgMDFgIBAh4BAheAAAoJEO2xBYlvlSLYH+MAoK5j0uJMhQf/4xaIheZzvjHfY1iT
+AJ4srgH4IvO2TWXSm6AqVfNrewcM8YhGBBARAgAGBQJHP2VsAAoJEDk1+i5v0F5J
+MIAAnAqV9gjU5LWnBc1wH5p9neWG1xiaAKCFQ4r58AqzoT+4sg+9AIeojnaYEIhG
+BBARAgAGBQJHPQiHAAoJEAC+ZrSHgCJuna4AoJL0tN6xbBO3464JGL+cZ7PLctGd
+AJ9SThD+6rkdxkNWx4dE/WgAZBOLh4hGBBARAgAGBQJHPOkuAAoJEMsyoQeIw6Wl
+s/YAn1x4nHnsstMIDDwGMhlGPKHW098pAJ4+LobR2VHsotRXr9gP/KzuWRa3DYhx
+BBARAgAxBQJHPNClKhxIZW5uaW5nIFNjaG1pZWRlaGF1c2VuIDxocHNAaW50ZXJt
+ZXRhLmRlPgAKCRAyhk5BnIUiKwoWAJwJWiTd2ovhOMfYh9jKXPkLMo4tJgCfbC47
+nhNOLMmdgMn7PZFwz/qU58aIRgQQEQIABgUCR0NSdQAKCRBgKNb8nTr9T6QLAJ95
+ktuG881Ko2iQaJ5kJe7hgyuyWACfdFIR3F4Jq94PO6kl9s+DC6jWF/yIRgQQEQIA
+BgUCRz0GzgAKCRDBPTDYp5xuGCuvAJ9RRtzJQsXCVwngAC8NVhcONBcWbQCdEDWJ
+LvqrDRJKEI7Cbk1Y/O5s1QuIRgQQEQIABgUCR0MGHQAKCRCw4Bj8s7TZi2iwAJ49
+sIqrZNVGTzozxTDu495RuH9+fwCeKtXFaRDaXa0IxK8lkslQ5RJ7rB2IRgQQEQIA
+BgUCSAw+3wAKCRChYGPsuM4wbpUNAJ9Nd9CGW1bSJcOKaKAo2K7iEsNVcACdGo4m
+SicMkhN2gmFkHQP0wjLyNkSJARwEEAECAAYFAkc8uzIACgkQGWWFUMMRBhH0+gf/
+bPEbwV3zjIaUyYPiXIGa2jmdi1G46ms6yEdKg2T3Lg0+AxR5CkQWlF+b6L1L/bAM
+qAH0vd+zHFlmiKSHGIhqDz2mmR2kc1eMxd050l6qXASHIWa0QbaMTImmDEkXaIVD
+QI1dttqQKgOJEPgta07kUXSW+zT2SVQ4IurK+4RwrUupoKPm0trC2kM+keCieCpR
+f3c2q46Quy7qfMkfby1cwtU9gjz0k+A03TvLXDcpNNJOTPfQByEkOjBxF6UZatay
+YFEpLdA83hqIdLGm/ziU85Mk6VR5We2PcD74ZEI9R1BSaqjmuofZOqSW9kYg10Kn
+6vFG4hMxgy9B9S02DVmNiIhGBBARAgAGBQJHO8qYAAoJEFuWgBDgT5qJUDgAn3J0
+7BVslyH4YOpXRy5nEX349iPUAJ9YUYUjm6cKg4pWvoxYQqQPcGAGoYhGBBARAgAG
+BQJHVqzSAAoJEBMuSdTkHtx+RfEAnRqCsQ+oUS/XUjyHJwTvnJuqgOQZAJ4kpGHe
+4oTQ2xSJRr99LTGdXPcGj4hGBBARAgAGBQJHQIXvAAoJENbd8DHrUfu6ef4AoJCh
+cQ7PqkcXM/sch93zD7UusXqBAJ44UgUdUzoy5HinUz9Ui2MPigKe9IhGBBARAgAG
+BQJHQOv2AAoJEGk0CgL1u1LNttwAni6t9y5HOrn5ORAqeBbxcs3UAKIXAJ4+lLWm
+nCbL58/zcSElL6PygS5PaYhvBBARAgAvBQJHQpwHKBxGZWxpeCBNZXNjaGJlcmdl
+ciA8Zm1lc2NoYmVAYXBhY2hlLm9yZz4ACgkQXif4bvebdxWczwCglDy01EwcQmqW
+OsXoT393qOCdTLMAn0DKeU+zNU+aeISGLxErfSqIlSMuiEYEEBECAAYFAkdDGN8A
+CgkQ/4h7uv5qe8EStgCgoO0CH/6VsY8TJYTsmxdSJuHj17gAoIyuvO31979r4bkx
+lOlau/qbyxWguQENBEA4Z/QQBAC0cGDsns4j+wtllwA/npIQX/GP7IBp+ySSDHMJ
+upoLXSktZwmiQ0y8vNbbJcofqSrb888WxSERxGlhM5fiNg6KVJ84EYR39oK1r/qs
+Y2DRnDUJY7SwwzP58/cUOvOp7Z3smXsX8pFN4iCntQhhIcddLdRCm/o2s5QG1B+W
+Q/M4AwADBQP/a7/zLwfG+/JJl0LBG8I4BK3tJko1sjOs5VBxO9kw779Rjw6NQqWy
+25QS+UXNL0BMwSR0/MRsekNo0mmXLOtpPzWZf04Q2vVkM87Vuciev5xD8GdrIyjg
+QEdF/PIOuMSDR58X/5MhcFCPbQEsiR9CDIzpkoyFkfZqBv1HYAkHRWOIRgQYEQIA
+BgUCQDhn9AAKCRDtsQWJb5Ui2IccAKCVJoJc4s/AXocLLtjXDdMjU1V3+wCgw3EG
+j42b8RDsM44NwP9oQj99Qyo=
+=awFp
+-----END PGP PUBLIC KEY BLOCK-----
+pub   1024D/E55B0D0E 2007-01-01
+      Key fingerprint = 3E6A C004 854F 3A7F 0356  6B59 2FF0 6894 E55B 0D0E
+uid                  "Guenter Knauf" ("CODE SIGNING KEY") <fuankg@apache.org>
+sub   4096g/CB11FC40 2007-01-01 [expired: 2011-12-31]
+sub   4096R/31D9665F 2012-08-21
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v2.0.16 (GNU/Linux)
+
+mQGiBEWZmwYRBAD0q6ODLHHR2D/8L7yANKOviQZwhRDOxfxIL3PoZ/xN/bMPeo8t
+wcv6Wh/VnIdz153kl2EkdYhCNbc+d0g/WMfFNe7ch8hqeYJKKQBj2fViS30ZLfju
+EwVesWzr7kUah2ETHC2Lo+vd0+x2yLsTriWUhK/ZU+85MTZRs5HX4e03NwCg5SpM
+iJp1pLwJGEt1zsAfIqUVfXcD/3uOlJamsYXmNGtEsndP3V67gsQxrleWWrLQzkt5
+WP/Myq5uY3XtIa0j6NE9TZtXwFQzVoeLQhpUg8bMuPRg3VzB5oq3ClkS09w38xyF
+eEZlNjeJg9TfvDk4bYpLKHtJeFn3pFR13Ojz+r7AHo/wbcO/Jho6XXLJPCjeMBFg
+MVagA/oDalIMI9cUVmM5In2WexaGuYqOaLD/2CEpNpL2zppv/5ES75oU1I6bNVw8
+jVI5pHIVn7wTH4ja3GfK238uncqot4SM6DxdW1F4Gj4cKG1YXyPbD+kqqX4IrzFW
+VL92VtA7LJdt2t/z+OFg2StDKiKtpGdSGcWEimDu7RapK251d7Q4Ikd1ZW50ZXIg
+S25hdWYiICgiQ09ERSBTSUdOSU5HIEtFWSIpIDxmdWFua2dAYXBhY2hlLm9yZz6I
+YAQTEQIAIAIbAwYLCQgHAwIEFQIIAwQWAgMBAh4BAheABQJQM6Z8AAoJEC/waJTl
+Ww0OlsYAnR2HF7kXtBC+SzidVezJf56EqiXjAJ9EW1h4g5opnNFAp8sghh48aJii
+RLkEDQRFmZtOEBAAwlQPuku80T82g6aS1HpnsXyzxG+k1k0Nj66ZvRM0f8gQKmGa
+nVTsbmjXRD1Q0N/WR3F5ynrk+dvgdN0/IqBxR+Ek6L0hYFqa0Mp8Rqw70M7oUI5i
+wMa/873koCnBhFet6Eu91mVPOSE9mdVIw/vlq8KT8VuxcqpvUKYgjC9hHK3GQnia
+R4JKkCQjk4ZynQiDckKcfaR765GYvw3Fq+v92Ebrdu5qYh4Tq2ncEY6qfCcxTu6T
+HXNPVgX+A+5ASlcLAxMAD1W25//abwPdvBIZ/76nXXGnZI4NQDQQf1W3btrcHxQU
+XrvHM1DTV70wlifIA3xjuWTIRr31gXv5QVrVQdn58AhWoHB2eSGX/jhHzQfghS/F
+kBIt//THDNDYhNtqHLz6SihMHNDIUcBNNZDF1tO2slsrAtKkooX1J91lBtWRWwkU
+3VK1HttMhAB5xUswbn3XExKK/J7IiI2M+Qz/QIKVIWcPyYmPBUkwtNtVRiGPcq2O
+MF2BEKRVyCZa1rQuPNRLv2iuFD7iaRfMMakWGIY2uIeLAy3KNS6VbH0qa7LUfeUv
+0Be2yyEAr5luMwomWzAHpW4xhCLG0kjMiNCceTJwASG6eTg/JpWxcXca8M0ZvcbV
+BZ7nzvwDRBCtH0W+9w+gNwgtToE4UnglrO4TsXtWwOyLfv+GaVQIngqH4lsAAwUQ
+AL/VaXfDuLOe1j3jn1sKjDIfIHzTS0THdxpP3B0WahZ7xHAtuFdd8jXiCmIGi9hK
+O99Mn5xsW3/cEPVfTjkXbfsgUc5xHsC8zJ9BCHctkgPvaHUJ7lAyZbW+y+CrW+dp
+CN49Y8H50NhwjiHiwT7GynNKnOxMFg/aZKLBVFFOzjqtDQ8qjiPdgAldO/tV7/WV
+4HTZvGUqQloEqqMjWTJO+fw9Mau/ejvBBuz/P78XkCku8cST6hjg89FXgyB0J7TL
+3ykvJltIS1gBNK6BF3N2es4qIaT/MUUbB5wdpltYt1HZHBUtvF8ywySuTu3ymyYf
+LQdRt+e32tMWgbWL00d2YJDeEOFeylBbOErzHI+tqxAQlwigKzHyUQkNKel2MRmd
+saiHMlc8Btj6YsFTf+sXnLo/zkq3BLVJd9qRS+udbbT02TIVhKybbJbxtgg5ajhD
+zOuRHb+RhpqjAaM6HGM2Vv1y3OLSzAN981LyEKgqIG2cwmNmubQLgwi1UDhcrTLl
+aXpFB+SHpvZPsnBQ329YKurlIV/rL38ZajIIMYPmk6bZIqTW0cwy7aHLXgBEgIpU
+jHDBOnq80rcyc4dauctgU1muYFh6y47yqtxmTkHu5nwTbZEn6/l1/FfoGCRMkLtw
+RdDm/4BfuuPExBNkplzglJ/cMAvvr0/mwv+tqvQTT0CMiE8EGBECAA8FAkWZm04C
+GwwFCQlmAYAACgkQL/BolOVbDQ4R3ACdHuJ0qhGNF2HmkKxkEvyQ8XYBKGYAoI/V
+BpQ3XajbV/CPs3YP4qBMddA/uQINBFAzpr4BEACwaErsS6S1riB00wvUfcKpl9UL
+JDEXlpL2ut8tc3L6YmxemBl+qHMqNFRkaHkCF1jWKGGdCt4Pjuj9SX80n9R0Hclg
+Yp58Q5C2ud3qvorf4Pyd+A5c5cyRXLovcwdybxcHgsBGbPjLijyG60ahhZV6R3XK
+oGjs4iFckNBlXXMmQXJvrGqtzF0j9FaRw1vmFbxmkhYz6lFHd+0iZgtYIuhYxaXj
+i4sJ750CWnaq8Nhvfgx3KjcoQDGFwH6iBPNw9U72eXVgVZdRBiNOphoXqpiGsehg
+gChIFDeZhWfL9MpDMHZDeLyHfBPItbjmJLV18FV5nomRSwk9q0E7BysdF/fNO6bg
+6+sJtrpbztgVySRkBO89XS/ZyAxmNaE5Ta4oysZPKQMCtzFK/9fFtIPf/Ue/c+b2
+1yjCGfg1AxFjdfAQ8sLS+tR4kDSNCTGS0W/rms4D0vGYlcCGRHj8DSForckm8hcD
+Q2fJzZdocgIWEiPGlOZlYZqO1NTGwvDdhMXOsgQoDxLeKWLz5UdCiskYi0A+leeP
+VTzrg+VisMUeKEIkcoZFSb/6Zdwg0yoso6QuuAvzMsUbe2JlUd22JyI2ZPbRqHL6
+KJidYkf0gj+34bVH+Bh/LKseviDhsp1RWPQQA6Y98ZYUIuPl4TXb9bEfzHe08Xc1
+6MkatgyaeD4cmc7+fwARAQABiQJoBBgRAgAJBQJQM6a+AhsCAikJEC/waJTlWw0O
+wV0gBBkBAgAGBQJQM6a+AAoJEMv/VdIx2WZf2s8QAJw3S3KEd9OPoh0Vh7pFdPqq
+QM3VsRyYB6lyLj1LmFgg9N5nnakPQfW3uI0B5/ChjVbETp97f5T4idLjTZthTEzW
+fRZWwqJy90sMpQuxXl+bQueAtzAsPoWrbAEbiJOrj61VPIBXUeFs5ryqehn/TSoI
+MbBeqIXODcYefbySoH8QYNl6Rx3CE10L/8Jc9Rf2JDhwrh0B1inUnQPdewMnUU8i
+9pcowyazIAHnM7RPyDd5lJCVYol3NFmga/xdR2J4tzTgism9uSAcDzm5haQWI4Gf
+JqITzsTGKI412WiCwkQTTVQ21r3Bqtvv8II6FX4rufx4+Yxel98r63JcRHqEXekX
+uLw869fO0p/QgI16aQc64355a8uk77Vb+8zHZLGVJYxQrC7ifSxwHao7JOfvZr8n
+AvZQzD8ElVJpRMSPib3c/J645zcWO5Jb7tybjS2Jki2SZ+deIr+ZeiN9rOHwUqWY
+9J6hdUHAdSq0k3EC0ZNAnZ0Te0h31sBV9PJ+XvGojwWExL3PSfRvptMq/Qp451xP
+V78eroPTPuFEhs41kgf+GOryaNyiLf6i+0+oGDBvAu9/nqey+X7jaPYNZGObm89K
+oVahczAX7sWtVza3tKA4GpNosKD6kvhAob6bYjzYW3hdiDwfotQinYX1nHjWaVHb
+hcDlnYi4YedwLzL1kncZ/JQAoLwCPW4ja02VCN6NaTzPXbXMtNvGAJ9IBx1qXxRY
+x8eFsL1d9kVuIT0J+g==
+=R3ET
+-----END PGP PUBLIC KEY BLOCK-----
+pub   4096R/39FF092C 2010-01-19
+      Key fingerprint = 5B51 81C2 C0AB 13E5 9DA3  F7A3 EC58 2EB6 39FF 092C
+uid                  Jeff Trawick (CODE SIGNING KEY) <trawick@apache.org>
+sig 3        39FF092C 2010-01-19  Jeff Trawick (CODE SIGNING KEY) <trawick@apache.org>
+sub   4096R/E4799D69 2010-01-19
+sig          39FF092C 2010-01-19  Jeff Trawick (CODE SIGNING KEY) <trawick@apache.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v2.0.14 (GNU/Linux)
+
+mQINBEtVvNgBEADNtkCqSEaFoGGAYR36TllgPuwMOfYbu7fubmVR1JDtozJrl4RI
+KAjkCTvybouecd+LFS2ta/RLn5tAUYfHrJYC/M9xpcAaBbMQgRkykZtfshcLIrzZ
+pnLmpQtuqauvYjAojHiO+2LI087vvF1tJHbL8Ui+pOjybYbMyQdmGOHggi95ct1I
+4fATHth2UWVsQZ5Uy2SpwNBgiVFcLKFW6ePeGhkJi962Ehu/7OJWgBlLq6EVn5Bh
+ZuOpHM8nlEsHnbmspZDMU5Wn/zHeq33MsWUxk/A0o2J6ifa3bMEpIW/dgNsE3DEJ
+szWll3+kmV01XIsyORy8NUTuUdpjmPQxK+JczORYO5JaZAhRMURIrlym8ISrltbc
+AbiDQQrKr8DxPpB5A4cQ0RVWxgePPldN/CSfW8HqIUYLShrLXuaq48+cntw+BNET
+8tyyeXaDVYvbyJNUJcIJbUjbO0tzB544EbCLZVxur2g4JlDSIP4WeO5NHuGIUnAT
+4Oy9EuCHSRfdjWvVtFcja2NTkznqOG9pkRRFU2RW5Q77eVP4qqZj2QKblqdz2aOT
+9VQU2Q+Y8V/SjN3XTPxYIrB9kTFOlx3tw6jB4kuNcFCEnw7t1REGWANBoT9g5aOd
+f5oCPhfhNN3UmTaRnRErUb1eA7y3D0IxNTzWxpY5thkf0UT5kbAiJC8sHQARAQAB
+tDRKZWZmIFRyYXdpY2sgKENPREUgU0lHTklORyBLRVkpIDx0cmF3aWNrQGFwYWNo
+ZS5vcmc+iQI3BBMBCgAhBQJLVbzYAhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheA
+AAoJEOxYLrY5/wksOZwQAIMiODkpgLXKVFWXyBbNWRA3GOM8HmM6lTOJYMxoPjF9
+urHN6NC71rHAN16YHu+WZyL40BAg0kZBtFYv1TNKNFy4e/GETD/JiHYoVA2hQGqM
+wWNDxREXtWySvkqpM+snkcLezeAaL7EPJhdLwkDSftrffOY0D3tR6Qwh66dfELvT
+/93wCm8eMPkNdK40p7iNl6YOwEqK1UBOfDyYSqcTn2xjYyXEyVlFIkKWTPIRlPmt
+1vQsiLlKMIzkSWa4foc60RC4jULD59DQT+M0Y1hME1a1gbVNBwliQ3uyVKUwtCPQ
+Gv5gLSb3Vy+37nLcpg8nL3X3EPXYTQTah6oaUhyFaBgsaGV5FVMV3f+dSQMcb9Tu
+PsDO1HJFy7MhKVP040oE27XTvSEjaF1gIP0g9VvimSN52JD98vsd50A62BlgNR88
+IH1U6oi8ndfDb4nVbiANOLwMgqMySvlt0NYMUglucMUBsNk39sJPqA13LQHBjuOS
+/vEQ7e02KfnDBbSVIt0RKQMOlA2F5aDxc9zGHDyphNFvY+EMEeXSQ+akg02eW1A8
+qjCcZqOFC+cHdHRaJ1OaNAHlhwXbQmZOnIDtYNAn+Cmu0lUaZ8pzTutCHmUqyIMX
+YiLQ7dtnro+IM7d/dumcB1Yf/QiESJwGYV25FXk6KZK4FTU7kE75LVjbeQDKazfR
+uQINBEtVvNgBEACz3jqVi+aTqq+DCxTg+uBOj2Da9clD/e6DQ3xiyWczAmc9nbWY
+42K/hT/kQ4x+WGR2N70A0eEJxnpf6nT+FaVf4xVj8wtcheVJPHnSKXMst8jmpePv
+EyUjQ+7bhxdz5orznunB+VEgVCLMHo2nOHzsxIDA+BKSxm97Yw8DFh7aXyRiZc2G
++5Wu8PcpD4G62SX603hwSi5NZVrMKxqUPtStqoSoqQmei0U331q8kjCZrBLBH4C2
+mvZdLSBHv1vQOwDr+2/4nCd2AR4Ehkvmg21c6WComXBZI0cXTXHH0307RQK9Mb5u
+zmm4luY47CoYf2wQtK08fmqvmXZaxYVvw0oFCy1m2AV8Mjrqt+kEjgMG2duqDxD0
+/Mm+fDyTy6BVqxAdXFIYkJh1cIinyBVClPUGJnI9nYNOPm+NvKJZtqiGoPQ+B61r
+H3FBGTLlF1QSQFopgKM+sk0qBpJqFZv1vKtuhmE+dREgYKJHAfafGAmdOV/btdgm
+sYNcNWiNwVRKU33hEfhxXgrYc65WBip7On91ZvKgeVQAXOD0oWdc/3YqewoeS6Xf
+TodA1drvU0nOIy6qhq8UR03ACrnIapFcYP/UfEanl1fAeW/T9oYWDHXzuVEz52fd
+xM+8h5SJbEB6PQpqq8wvdzech39R8catBvMTnkndeO6OvRq+Q6g3d5sY1wARAQAB
+iQIfBBgBCgAJBQJLVbzYAhsMAAoJEOxYLrY5/wks7AIQAIFIRdVv80ONrKdhC+7q
+pl4y/G3MO8COktIWOwZF82ThlYA5v8C7EPFuKvd++TLhoV7iqVRfCh+EdNV4QcKG
+QbMVlq5ebuA2yHXZDfYzzOeU2p9sCkfETIXsZj9kwhtnzCYrGNbTcOGNnA6S7xjB
+YGcpXI/NOGSp5XgLt7j4uFFT70VAy/kGaqDjTwLI2w8HY+d8J7S46M2Xms2f4XuY
+RQqf+rwk3VCRhnkjFJfLUB0aEQtK2dlHO5eA9uN9Q12mNvVICbImOywoGPHD/bk2
+W8waBHTGsjqOBs6V94BUCAbjMCNkx5YHMfq0654BpwmLxn/cXAuzrJaCvNSSXml1
+/2INF9aeGi7cI6ShErY66B+cFr59Jf6HNaduTt+o6CDy9mt8PJhtd5G/mD0UVYWf
+p3S0qb69KutBenWC94uSoRi5lduclNQkZttqFSl6qpzm6IWlMT7J38XZXzfYPVdR
+tXnIuuJhf5MM6+sasTwnRSXgpdlTnQGlWO+oISJWQiR9ZUUs0gc7thQr7qVs4PIQ
+A72U4xqzjlTZWwWyxqhiiFRrFk2ACpg3mvnvqErNxJYUvE7YJQqBL5WKOTBbOyVv
+mFpbUjf8M8vIvxfmaXDyDkpOX1dmSGLG9gQTGuq7MBKh+UTSMaS25JDHKHuAhEs2
+hTA/zcAcwy7UE0ycrzubKC3E
+=f1ck
+-----END PGP PUBLIC KEY BLOCK-----
+pub   4096R/791485A8 2010-11-04
+      Key fingerprint = A93D 62EC C3C8 EA12 DB22  0EC9 34EA 76E6 7914 85A8
+uid                  Jim Jagielski (Release Signing Key) <jim@apache.org>
+sig 3        791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
+sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
+uid                  Jim Jagielski <jim@jaguNET.com>
+sig 3        791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
+sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
+uid                  Jim Jagielski <jim@jimjag.com>
+sig 3        791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
+sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
+sub   4096R/9B6D9BF7 2010-11-04
+sig          791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v2.0.16 (Darwin)
+
+mQINBEzSCGYBEADM35SrGvF8jjtPHoVtoU3LKaFqqYInTOKiGeBxkCReGSQrUL+g
+nvEqs69xSnHffHY8MwjsJY/k0zaegHgivWW3fjiA53oFnu6yTl30PeNN+l5QS7kR
+zWk1mHL+Hl1FV9Rorso1lQrokTYBxkE6g/1F36QNmgn3ckdyXV3t98WI+elj4Uf2
+uQkc9W/sozfI6iEzmZVfViULARS219uMYT3obC7RE6yVDIsYwByO1fXxeLSCnzNs
+POBRGuqgkY46o4Lbb2EMCAYC5/pxiAtV6pGqDa5izZ9Wt5rQEsnGdBaa95cZcLAg
+MiTXuE9bXjMcHsWR+38rgfGZ/4RVYs3R3NpspnnONRawCZAdwHX5Ns5WdBEZv8/g
+Q62LBm4r9x0UkkfA32m5vAt7VhE95RHfJH7suN7eoC6wdXRKzuy+sPt7OHBKWmKJ
+k4Ve6oGxosI7zur/LKYafyQtdzp/KNpPTfxcAAs0GZnFmAtk9g6044aNPZ8BpPqN
+UY928g+WI4OhEfb42W0DiVfONvZGR06buNhdbNwaqdPeefCjErFSblLitSlUzvYb
+n2YjDP2WySP0xFjIfkcaUjkv74kVQVD9haWdQJF0qukuAR3YzDr5djXhkHv1x3WQ
+trC95tOaH2ZCB5K6NMZra2t9I3i9bOYYMLhq4cRCIazzI0FNsVaOuPUZ4wARAQAB
+tDRKaW0gSmFnaWVsc2tpIChSZWxlYXNlIFNpZ25pbmcgS2V5KSA8amltQGFwYWNo
+ZS5vcmc+iQI6BBMBCgAkAhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJM0gpi
+AhkBAAoJEDTqduZ5FIWom/AQAKqOyCOLUHQPif9BlYF/TrCutkE1q03xIVsOLv6t
+sefueqHIa9pa4Cg+5AWHO9HwmCrOmJijC34Zu1CW8fKy/ClGS2DY6vcsZ22MrSo6
+FkgcDqk+X9aqx38G3MKpOb416JEENwSS7WQK6j+C+BefoS7aqYarsD6TdSReVHO9
+y+ksbKVMRhgxj3yQZ1fPYSZLWGCyl/VQGDG92l0LsaCw+di8DKOM7lOY9vRfuQIV
+rqu3dyY8cgvnux156kqKJOfOCHa6GMl9NiUDQpWCWCuYRBm5RsNIRD7S4nRz2K8M
+obfgwY75rW4iayAEfbLznbtzarMDS8yl0UIuAVEHJtIZ2oCnpcptv0dHD+zkMHW9
+eNmZBaHz57buHla0VmEFT3DImAq6eRYveI1pDE0YCp6IjgYd0rysz232lkbMCZOP
+wnOwp7UbSOqX9Pfiyct7iEZXMH71QBpNr6sKKHcfwUPQ2Qmd+hmmj9aFbYCmbiP1
+DrQU8uqqmQx241tpMgu40c9v+ym55ZS8DEgtFrsvQ2xhud2gYlx29kKhfMWmhf9K
+M3U1hibkY9V31IsgpbLkXGg1dny2dzzzUih5gIViScs4kC100SurlLQQCROWQtTl
+RmkZAU33IYucwJW75iuv5gxyZkOsD29QXNSHGEUe0BooakzrnKlhriuzvaGXKhRF
+JYosiEYEEBEKAAYFAkzSCcAACgkQizpgHwjJdeVlSgCePJsV6CDpUawSxj0/ceuB
+Ht1u2vUAoOc7vAkh3ihIjKpbf7XU/XnDf2NYiQIcBBABAgAGBQJM0sMzAAoJEJu4
+Y7D1G7iKnBYP/3aYH+gw1dmAV+/ytfaEFioFpkB5v4nMUDrZnlnM1xSLsxSsqyWx
+rxDpvGVf7VN9bMrXm1oKXBwnpnrdXvBeaHmH7cIjpN7sp8L1QQ2g+6B9Vml3DQmS
+VWnX8YwiFYPfVEpLvlIGlA9lc+n1JfAPsxH3qb+L+g+4qUW3LAvGNTi63t9rjT8g
+RYzWFcYBTruLdT2MdXIYpVGCdYvM2+QwLFcSsgNaK6LHuF5gW9lPz8fAVkgJ6M0g
+cFQK/AiKaFIicX8bGIQX3YCdo2gaE76CbJiICN6h32AnlukwISeYkfmEHl7VOx6q
+qIY7jjmP9p9Cmv5qQGy7UhwXFko5dBHvaG9Ac6N/FskXxBt87+TEort4ghcHPSa2
+EV355h0kRPeChOfTjTHHZi7RfS+YVOoaQVPyxe79GHX5La4lQn81uylrU99Sow+2
+QNuB61exOPyHgT/QBXDZ/0fucUW36uEKT4YSFAHV9lGpGywwLkKqyHNA3VGGf3Xc
++FpOzlxlfD/TYzPklbPiOddznGFa3gTsoNHvHjaG0XbA6coErCuchF3zDVVtBZ1f
+f3HdYH9m7NoRHcoUVqj00lixJ8PqMyS1CzXJ9fFRo5G1LB80CkPryY1rW9+IewoA
+2fKAuE0GWtQbVR8+I0KjOv0kOzMzA2exZ+cYME6sK2I9bfEJCXLAQFdTiQIcBBAB
+CgAGBQJM1t6BAAoJEJrilv0C6fZbyxIP/jvJ6wNcj1ko/mZpJTsIkXxOJxc9JF5e
+5aCl8rpoXubmWB6zDZKoiJ1Jwl0pxVKRfiHwlP5NO5jne6Njj6xia6rBcHkh0o7f
+5JMDNSVehej97y9jc2dX1+kNmzf9eJZTeE8CUqBELY673L/dITg1eOgmwbvFZ50t
+Tc+PnP5eHTlXRcIdb3mRVHmwjlvFVb4fxy9DEkDOUK3ZsKpWUMl2a5XUURwKOwGW
+sQ+9CwHd3reSSI8GEtutQTZTc1XTTbukYRYjyHpY9nRWE7+dd5jgv6Jv184Za5bR
+CtILNmYjgJFtb2/5djLNErAIpGIg31+sABq8D1whe/AQhq9duTkc0+sNQdP9Abc9
+FkTeat3vFk7D+L1YFMY6Q1EcM97SbsBTf/I4Grm7ndNGEBHgi2RN9CxToTpPzkzG
+Uz2soE8ccB6aInbPldbxmwarZ8WZbMNC0hLa4PKmFfD6ptP4cDkY+F+qQLV1h1bo
+4Ccse/dDXfE4h0j23+uowGvT0ZXU9Uq2cpaij+9Y3clMVgly5aHDYv7a7CXznMO8
+fjyh3ZcQOjvNEusRPH2c5akiOYWF+xz7cqvzL+CI4SX43NFK9A/lSnJiFfMzus34
+nqydBsJLYCOx0CZAz+aLwkxFJzcmre3Qv/8Grnw3gQfGBHa/OPiHKQ4zIZncVYqI
+y7UHY0KiTZVuiQIcBBABCgAGBQJM1wKOAAoJENIc0iPujg3VOTcP+gKPRPv+Gbs/
+X/8x3G7rwIuo14+1xKBJZco8kmSGWEpos/DKPo9Aw5Gcgz6gOlh2EVWyGjwaoXdE
+mhPLOhyTf7EVbUuIpmLZGoA4AAR4OnJRxGjmwTCkPoUZ+U8lzSG6VpSRmmTOylZV
+Hs6kmaRzvC0puxAdUEYL21IbQyLODXR0k3DmjY3LLssPMPiXuT428HVvCiJdPu0s
+b3jEViA65E7cipu1nF0PJBUBNAqVMHyydXT/yXKxHVLCJOHWeD3ZUzorxRc0e+Vj
+PfVtaY/nR1GDLKm3AtUDYZNXIB4YfYpwtulrlfNv+ia60ejAQZDyjx+eG0r+cw7v
+L8WwrAZLC5NitH6I8xESKzdJ8sTGnfVdexMsUvwvFPBJ3jNoxZI8my35BK/snap3
+eBDj2sNU8tE0R0L09QpytwMQorqRFha86kcrmsPB6po83za3xoli7GiI6P6pW64W
+2X8d1sLLUM7BcPyWYZ/Ps7chnHb4eRUVHuAuDG/v7GNzHzFWEbCV+/lTjCXCVnRL
+VOfwkMjWi2HN/GifrDVEiXyqGW2uGpLT05a1ppNu8fMvNwqzIm3If5o9wqdU0Pjf
+mFWRKILqoXuE9nWdtfXrAMBK3t1nV/HuMVrwuvMIPo2yPTxb2oHlrsqY9HuWYugm
+5TIo/bbUGHduo2VAKOoYmk6Hg8a6h7WCtB9KaW0gSmFnaWVsc2tpIDxqaW1AamFn
+dU5FVC5jb20+iQI3BBMBCgAhBQJM0gjBAhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4B
+AheAAAoJEDTqduZ5FIWoA80P/18XFs37N7+D8VFB8NsU3kBTvh9UZx2x+ZGcHIH0
+MnEgzACcoOsSSFdcOwgkc2gVGBEgynM1HSmSgtSpxPGrW1UzmKRN5hN9bq/B6hyi
+7xAEFyMiOUcTobH85eSAbFuxv1Gb6PbKtnlcZWx5YNlAOi+7OBD2g5lAA7waT5sM
+DisxOlgkTYvzn2ouOwnQ2RG8I+qd/htswvgo1wI7GZJcnf9ZFn4ejsJmXoTmC6+Q
+J7iI2K/YbSCs/tGy9yowTx0QRO4cOF2Wa2bo33ALCSaNjMOEsu3TTDMCdV/1T6Ys
+6ppxfKbT5/bOhWpfGye+mCArMrV1gr9ydo9WcGXkbDWeg+3j+hpsUGmp809fzono
+ziZb10TRIa7C9sY+Np+WHPNgZ31RHLY6RWXweqBjkDOPcJyD/tnC6sRugY/CDuRV
+eWxfKgUKHaVNLj7XxCTWazxZVT55WFvvNknugSjjp2FKlnHb3lR/KtIUp6YLvSIr
+VgdyDAbXW2CV1kamuFrA35bAazXsyvEXye+P8B+lA/pd0achXqxzIlBj0tKNob4u
+gCQ3AN/E6Pivjg+o/N+8Uzwiu45yKvuUGmtnKJQTdNF/+5E6QYm95c26VpMYxhq6
+CEISO+GhJnbPB8ND19AUEoNGrvRROE4FsiGNpUWN4/KPW2Pc+mt8Q/yqOnWQM1GQ
+xznxiEYEEBEKAAYFAkzSChoACgkQizpgHwjJdeXSpQCgp3af5lJ3s12S9jF9Ipdp
+zwVnkPIAoOJEjS3pAs9uuGdImfYzGKc7c8f4iQIcBBABAgAGBQJM0sMzAAoJEJu4
+Y7D1G7iKse4P/ipNLcumGrfCuRk2jpUChmhIc51wdJGeTF3+GPkXYjEckX2nWTqg
+KElf0yPfaU8XMqzLnp13tCYg8a8XE/MZR0O6byIbQ3ODr/WASQZ+xhMawSmSiMEu
+EWX/VKs2+4hhDaVbC7PluVXoOLz4sgSIU1/QxJoarD8rqIWYZFoS4mp/rlAkiNsw
+mM2xeA6sqUTj9hSRQJeqnLI7B5eN2VCB+yooeY8k4AraG8XGJCHwcJprksIPqi4R
+EzaE6VNrtA59GKFK37z7kA1//yBm0kCoqkCkC8LFYDEnQhQXdZrZL7zHLQRP9hNG
+3CxnKUkD1HzRYNxRemC5Mmvxfj6xCRtBI6bhlNUpKzYWqfslXvVXPy+diJLhbXj9
+u5I2W5AKMlgO00Eg4JRp9WcvOqsVaVD4Tlet8uuIIeLuC28l3w8fjm7TCrHjcjN5
+CH0QWH0nRTNaIR2ogFvIwYAsR9rIN4qJzNy9crYLJEJwcVgTh3tVW4qr8jn7sjVt
+MeF3JIZIDGGE/b4ZSeceTdaJ5QsFoXmRT0SEFyRtbT8pE8WhNma7Jl0d2/b/qLV8
+H8n32AKoByuV1Vd3HOaT3XN1yACren64JCqZZCyNNRWa9Wu2fEH428nYjcqMCZQw
+PuPyRNQsPnvU1fNHzmPEkA3UtVYwsKtFxnUmCfo30klOhzPTZrl4L1I7iQIcBBAB
+CgAGBQJM1t6BAAoJEJrilv0C6fZbNrIQAIX1DqlW7CAI6irpaPq+l5s22nBolPce
+MLMhHPgp/vB7JqV6wMDUc33aFDCkDuSFewDQKaf1BSaAQHWCxRfVSkgY/YqBx4vJ
+xE24M9ljvH/PEDruCHAem5Aij7TWmPFTKGhV1h4Rt9CWWvSxZQaNFQgUxq+W7HwO
+gIxugYiNz7NKt8mdzl/48S4rSf0mvsQ55Z2xM+GMrYMQqAcunIiLNGoaXk6z+B5k
+Qmm8T9UnR8cegG6AxIvcFm23KahUWjIYfhLFa/Xeg4ddVwaeN6lhwLOwmzEh9qeg
+gOTreZvh/5i7Wwk/LbnRElm/ejkj62p7sxE7RzRNGdWagTRbZO6rfEZQYNoWNnej
+jjG0MP2YIXNMEZ8LmLF+r0RWJMzVoLHsTxSD7c4vSNjhERuPgG2XM/OsxX8KN/Zb
+Eo/dn2I9vQ7Oa27E7hGvHGzlj+UR3yTdoSoao3gJs9GDqwdyRwFLALMzwRmp1z3r
+/4CTowRsebJI9G/G1U+fGJig8RupFnSrh7vMRMsp5JHQ/+aC21UcJ1jk+6P76wJR
+BCSYg5gLdMvkK8SxmPGbDD4PrQP2ZkqQjl+ivh9IXKnjle1QgnOWebRMV9LXc8dv
+WfEawbavR8bmu9CHZeAqfHFSaflU3A82fX3d+3Pnvq/zQVddJRnUMFju2lxPgsFu
+Skzw/eotq+xqiQIcBBABCgAGBQJM1wKOAAoJENIc0iPujg3VGS0QAJRIkubc5Uca
+otfdf3fDQwoc8+hN1hMjV5spdQOl8W6dC3fskVoVL/OJ0rCXLFeCCciB2CrXdVMF
+xNVDfLisYSY9pvKd+Oku9eMK1ncC/D7Sm3XXMHShAUqnCA/dFhIyY1LEDL03qqTW
+PjmCXFO45jA0pGwlbpT92GVxOui8sUL/YFZQ1Z1mQTpiiZj/qsScivI8P++PMOqu
+IzuXgK1qGhuHS+DnuxKo5xDvVvOfiPhLW0A0EcjmZ94hedCxCkN8JpzdGOnM/WEI
+X1RNvUML4nqz3CK0CGQfzpttb7PmNDYprw8td99Z3rK79CA9CdhRA1sREnNxfeWd
+L/+8EyBm6zHHNwA+kwMCFx8iDeDF86bcia0WQiOihFW23yT4J8XtzrNcMMdaduOy
+f6MupTn6eNlsQDOCm1kLFffkCnrUStS8NB7yhOQhGfEJbllHeq3esgoA1ivSpp41
+mtDdrlE9m/MFilrrvv8VNAaTZqptqJIASRIE3b03SVskqcgzTId0V6AkpvzKArrS
+2ratHqDE4Z3Kv5Mo69nq9iju+WvRF2dY2XY2z4otX82byFIsqP4kaKTuhfBXKwW9
+SCFWANj2wwbFtoOngjbLZPXS3d1tgVokPDpJfgGEEDgMIyyabN/BJ3By/EJn9GiA
+m/UKO72aI4Hk/0RfGi+mYyJRO83Zrt/AtB5KaW0gSmFnaWVsc2tpIDxqaW1Aamlt
+amFnLmNvbT6JAjcEEwEKACEFAkzSCNsCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgEC
+F4AACgkQNOp25nkUhajI9hAAuSZHbMznyoM0ANPP2bTkkFwT9WkdB33Tdbs+5893
+sDnq59xT4Z80JcXzH3WFtQ76J4GYtU87DpGZUsYt8EZOo+rGUySGDOw7BbaNR9vq
+pMrH2ZMJFAx1GsL22csHhXOiZNdvoL3Ns7k7ni3/dcJpVp5RUFgWyBUyybymAE0X
+kv1ER8sPha/aZvbQg5Xr0pKKA+mU3G/1KEC0prVsb7j6U2BoZGfP/5Svk22ZrCqT
+uImBXVNu+Mz+7LjZKnityc6ZTx2pFiJMPBI1XiXO40ix7ctyMM+QtKUPkSnGsJn3
+JPasomIL6SrDjAVHu1HdnqAYUWvjc038rj+/ntuvqoH7NYZDvA7sFcZjZyhSt2ci
+46G9aCX7KZh7JH4pMG028E80jDofWSFxHxXVHo7ERBghKRhkjj1lAwdnrT3lTED7
+TX0oJbFwAT6h1+rjWJOOGlQpFPQ5+0LkcyTiq9790agphfm8RF4oVqTaCFdbltr6
+s1a6Va0H2z68Rp7wAs0jmjEZoMC9G06BsWqXb8/RwtsOhDfQqdevnEyk6ejecX+0
+YaA1Y7jVvfiho3nCHVBKO2UVpv3TpEShnVug/hl0oY9UZIsGe41JMp88CL2MJZt0
+HUvbSFOrNNdzSpi1jOaJ/UkWcC4kIUTUqwomD1hz8adqUUhR/dMWUXevHvdoF7lu
+95iIRgQQEQoABgUCTNIJ/gAKCRCLOmAfCMl15R6vAJoCZeiA1glNhoaQIcQlzKBt
+aSTN8wCgvfk6xZ1+PYU2b0pmBS14mg4DYHWJAhwEEAECAAYFAkzSwzMACgkQm7hj
+sPUbuIpeChAAwxvkZYeJME3ox3WKbqYb54PeKKB+J9dSHQs3bvu2yWq0+pMUEmx6
+tdAPjP0VgGvjulfy2VrM4wUgBJ4CzPAM0KRsRiYE7C3cLQ2D3Uj35r4ws+UfkD4Z
+DKoCMPKcfSOVFiv706JgJojIgaDJqYMn2b7y3HkA2yGuPQ0kWG9HxuOjdrbLB64y
+ipkukAXFWcYskUcEgQfU19mmYHIKErjXPCc3AV2TCYdd6zgj3WpJ6aBd+dxJ456C
+OvlIVx+AlCb0LhnQJtfU0B1lhSwU+eqbMN6ttkNgkxAtkBz7hAM7rQQvOAhrOhTn
+FQakkqhOj1bEp1ofwi+EfPjv2162a149cavWCbsPnxvjlhbAkHq/upk+a9glSELP
+7M9U4W04e/kFGQh3QaMxw829cc9tmysHxmKi79btfLNJMEzwzXhRsY1uoJ+MkCA9
+GIzOzFC+VzGcEPWXwFUszozj7wTTBwdd9FaF75pJ6SZ01cIrCv9agUnYHST62nYF
+Kwy7gtBm9eVLSjUA2l/avp99GVexdKy+HfWVgOP/d90UZgX6gsnemB1C2u0LjNQr
+cfm7+8EsgekJNZqOdQqqHwJYEV2BHu3YXNAlFYCvROd/+ffqLhbgH2QMD6zOhBZ8
+MCN0KjC+WrGsN1F3jfNN5iETymZu3icu+aSBO55czPQgcFa4JgPoKyqJAhwEEAEK
+AAYFAkzW3oEACgkQmuKW/QLp9lvPvg/+J58Vek+EyGg3u7pACHDru4UilxwLcnUU
+Ywip+xCWmyHYjVRxyenkUgHAu1O3yDuFNf2tKW4cFCZ8KVhpsOiz6EKQHHitwh5R
+2vh7gT+4lcOJSiMOq5yrGvJlVdsqf6HjDielzPBS6ByVblqsl2GoiP6tw41nenYM
+5jDWpvRnO53qp/bOmlAGP6ej8WJOtF2dlr1rDmz4+XGh7NqvytWYu2GLPKSx5PCA
+7e+vdwEvuE1MdwJQ81izI/0HXL39jqw5fKUyci+cs07dTUrzXftm3qE0j6+H/y/1
+rK2QY7xqBsQUsGRV+tYSPFaahQFF+QxF+SfQRhjo2BXJkiw2Q8hcN9TKEzdY3Ngi
+LH06G4nVOC4YmRIeMsdPfQSUQLPgpWfjzB9Twf3gNIyN78vfu4gB3AQlcpuAgGVe
+4xAZwjrbUJVSVLa27C5ZS0vlU0Kl79KLRmj30UBt6DjrGrj4IZduzUyvJ2+L+hp/
+LzOEJIjyzdfpLhoLfeb/ceMY6OXt/lqLLSgdeU84uOdpQM82LvVfKUqkcJEribhS
+N+CpV/1xsWmoDihCS79w7OsaJxmMu7a9ksxJsuKxmFABMOaZ4lhdU5T8NaYXCpuH
+ti0aKFFWqdDu2sYUUAmMpj1pW+K2bFl4qwKUvsi8xbWlzBlR8vOtTJAnYEC1ErR4
+QieuW7Myj+eJAhwEEAEKAAYFAkzXAo4ACgkQ0hzSI+6ODdWmvxAAgrvSD8lIIVyp
+NvKNWKXjIMLIlUqcH5I4SmKcixB6UL80j2+z17WT6wcvvgV54uM49yTa8KLpBBwB
+d8a1WfsWyVQNZV7RiwSnl/WwNua/rv/krKlVmDvcKIcwgJiBTkc0jYcrMwKg07S3
+zla6mg/nhwlfNhdeKDLHG7CMNhNmLxmwTtoUfFMW8sxVATcX73eHBAhpHMDAbXzA
+xVdyTS5i4eO7vXddBq2sKIEecXZ8r1eqNsCR0VhNEbh8o2bKwt3sZYqVdI/eaEiS
+25sWzx+lCXKYycxOfBcQJKTle6NShTNa9bPq2cUiYJPZNAgd7lGdOoPYD5DqjIFL
+z6TcqW4PWNjnZkiamyue9lbI99whCUkemnRDM+tIS/0N76FN7ROom9Sxm5+vL6Ei
+B5TXJe7gK4/CanENhSPO5h2MtD5EiFV+ALv6eQzjG+VuBh7GfZPR1wX2hhOkhbBd
+p0aQITE5X8EfkLbYwvDCkKFVXknc+XfbAqczCoLIT+MC+TQPVRwiZoOhjA7Oh0mn
+Q9keDiWfkMpMFDeu6+l3Im2xYDNzCTdSPlGLOZt15tUIonw55gOf88ScMPP7ri2A
+cGxHP6fpgB8KRqjiMrEkuqDWJ26Q6/4K4CxMt4zC7F0PZNDjsJfMFrgBBOnGeEzZ
+3uwBU/OPixA2toAFaryvY84tEFOAqCS5Ag0ETNII5QEQAO1cyflVhAw/kl1NI9ZS
+GfcFmulOt9hM6PyKihstoppuLWdMWZ2OY7ZEnS2Ots6kkZ4GY4ak/p19sDHlC6O4
+x/dlYMLcbd8kpIE0naTshCRCuPPVwiiXCtlp6odemYpxgDgGCnEJ7NaW4AeauNUN
+R2VrTS76htpuMvgGydqmZ7RHGtwTRp9QYniRkvoO3Yf06E0YSpFv9r729h7gE26y
+bjCzlKHqYek5GgWlD2zeW9Dj/6y792sasQ0mYbp1Z4hR7/jFXfXq5LgTJUUDypRY
+Emzg34nnRYwRtRsi0+Gahpfxzph3Pw2r/OSrNV6N9/1mtN2pB1UpwxbrFgSw6A/W
+6004LXX0OR5ZazKYgwpmiQqF1hYjIijQr6ej4Kzk+lHglz+F78U4Oa1XVlpX52lS
+7Cxze2pKhg44TybpzeivmvPPuC5kY6SBk+JFWi+YOR79CaJG2fH74DIJJsqoBeHU
+FsS/IyFs7aO348ySyz7AUgn/yUopH/B1re6fMqtfxJez6ZFn0ZUbB5oZg4F4sPBz
+YJLPhmqItqTISaaUGVoiD3GLxEVV9DeqWevsWmt+RlnyV+R6OZuZ1YR6usYNLbEU
+1PY5VgAjgri+/GS6ujwXDbo78kZU/RVqTA6f2Ns19Zmcyw/P2zdCLy691gm7Fzke
++zGrreMscTP7mcPz7LlhtI0BABEBAAGJAh8EGAEKAAkFAkzSCOUCGwwACgkQNOp2
+5nkUhaj0ARAApkyrWmGDwiUC4Y/0vzjH18pJt/MlPv+4YC9YtW0hgqjWrWzaWh4H
+LP1CkQUUAzZHm6x9bM/AKq1y4j7uSoeH5kFrZJxIM3ikzbw5MI+ZjWlGjGjaaVRL
+rrD3i06P3FrQvpvNSfs7imggenLVgiVSaumzIHVN2VDLjQycUTXlYInyXJZuTdMl
+5SWrHdBxKmaWXp0HTbuKDEDRDj6IQUaf+FaV/y2nSZl+XmjLaq+1SRDATVWlASaJ
+/YDSU0JVtp4IMtpzifhiP/AdgCx87/QpwT6zNfX4WHEF01scSjfC2ahl1+sH5S+s
+h+fDQd7ApuWCVfkRKJ2/tn05jg5qkSSxp4hRCYDr3eDdhYMzatFzKulfFhusWBPt
+SuqYp2B3KM7Gs/cjJ9gE79TDcSIdT2tQxr1iR6aWbFP5tgijUjcOV3i/GQqZGRz3
+FHA26GvRHR9X4WOcxE7XfaCRbDcRBBOqiHWLI7pOzPPreoTeRWzUkZXEjhr0lyVP
+TC/AHoAenOjlxy1V+NEahyBQCT+WgLMgA+Kr0dZBLAz1E7U7FAcjOlLeNKSFaUMi
+G38f7S/D8UVWuHHd/G5skc1KIMHL/jnTS6q9o97SfmqmVZ24pKHKF0lM6UM2rRz8
+E/274DCVg+wK/pQiWn9O1zQQRh9KIJACgd71jF6z4RMaRUcvpYYaywc=
+=qdRu
+-----END PGP PUBLIC KEY BLOCK-----
+pub   4096R/6D5954FA 2009-11-17
+      Key fingerprint = 65B2 D44F E74B D5E3 DE3A  C3F0 8278 1DE4 6D59 54FA
+uid                  Eric Covener <covener@apache.org>
+sig 3        6D5954FA 2012-03-25  Eric Covener <covener@apache.org>
+sig          62B2963F 2010-11-04  Dan Poirier <dan@poirier.us>
+sig          7C408737 2010-11-04  Joseph Edward Bergmark (CODE SIGNING KEY) <bergmark@apache.org>
+sig          02E9F65B 2010-11-04  Luc Maisonobe <Luc.Maisonobe@c-s.fr>
+sig          D01E0E18 2010-11-16  Jean-Sebastien Delfino <jsdelfino@apache.org>
+sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
+sig          F2F27A06 2010-12-30  Carsten Ziegeler (CODE SIGNING KEY) <cziegeler@apache.org>
+sig          4DCAA88F 2010-11-04  Thomas Dudziak (CODE SIGNING KEY) <tomdz@apache.org>
+sig          1824BDC1 2010-11-11  Brett Porter (Release Signing Key) <brett@apache.org>
+sig          82A7FBCD 2010-11-04  Antoine Levy-Lambert (CODE SIGNING KEY) <antoine@apache.org>
+sig          7C408737 2010-11-04  Joseph Edward Bergmark (CODE SIGNING KEY) <bergmark@apache.org>
+sig          791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
+sig          F51BB88A 2010-11-04  Sander Temme <sander@temme.net>
+sig          D84E41AE 2010-11-04  Nick Burch <nick@gagravarr.org>
+uid                  Eric Covener <ecovener@us.ibm.com>
+sig 3        6D5954FA 2012-03-25  Eric Covener <covener@apache.org>
+sub   4096R/2B4C4B38 2009-11-17
+sig          6D5954FA 2009-11-17  Eric Covener <covener@apache.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.11 (GNU/Linux)
+
+mQINBEsCKnYBEACb/ldlhkVPPopZa4HvQhckhpQCQBE105N6Q7IPpzq9djl4K9QH
+TVSOvnhTd0s3J+7bB08jsYbaN2xMLLLZxjGW+EsQppXIsrY6K0m/aJfAb7MtdgoM
+a/r9G5r04hQtRcc4ivMVHnFemM0A2sls56wUwVI9OHC2BPwBSoacTwSFOwwV4mSB
+XivBkRPfIFVk8iaH3G4Zc8/KxgoPXJxX6rQ3AZxx0ad7hh6FKGgNxgOKNTwkQoZn
+hj7edM0KlSkzQ8O9asRx27H/8Vv5oRP8tsy0VYSR/FPzny3cJfOhyw3px/mZSOhq
+loAOLtTqBkvyTC+888rfMJDlozWEKqNeallzTTBQ38Y6iSskNMihpp6RXAiStrYO
+oO/OlqBuSxXvplI3EWilIvEkzpzyWt/uiQnmclGSU6uhLMKby96QpfWOQaa9CIJQ
+liMth7eisGKci4z7lom0q//fPQpbKIqk0bhFZeQeld01Ozy+s0rhZA1CD0P/e4yk
+0nQVPPMih9wiYKvdr8lO+cLSt7Ugme1JX0l5jP3JyomiLPNEfyeWGpwO8d4YSSoF
+UVJctLKBw1UR3rCwladOcf1iriqtwOfpy3wPtrxByxU4jBIR0stcpIhkMs1Qfde0
+RT6POBpPlNrGBoiOXwAAQv8zqy/z7yiTDhYTvWqSx/J5rpkKdxvvg6l/KwARAQAB
+tCFFcmljIENvdmVuZXIgPGNvdmVuZXJAYXBhY2hlLm9yZz6JAjoEEwEKACQCGwMF
+CwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAk9vLA0CGQEACgkQgngd5G1ZVPoe8A//
+bxCqDeTMU5SGPVOGQHW7NHXUyc8CsxNPB8rHlyMiaU5UwvB7+uM7EWprJvpBqRQ/
+9rRIFfhFndKmbAjIjNbGNQjk6oTQo9kE2RE7XiOjWMAN86g1SrhwNrGkrxqH47n/
+NRiMvaN4VMkONJzwCPSAe6ek2p8stl66wquZZf4+H/fkwmH4aDQ0SSCv98HyI1xk
+xbjbKDgtBS2XMZzjYFtjP1+2goPCdcaLGo2knU/NI1x/yu7I3WBu1gqvNd20jplS
+3z3ROwUxs9T/ejsF5Zh+SkDOd8tyr2RwDUDuqVx1DLhuAXcTHzo2Lk9vnieJjzHx
+pnMMvP4g88edXYKa6GSwUbGM/cPJVzoOkFnemb1iEABN2v0fgIUXNnIWCESZiLMA
+Dac1wKI3xr7wo0q7G0s+8n0LF5mxDU7/tQXlxj5FvocfHKtygNwlar3c/DAH3q2Q
+bDjsmPC0CMnOs7dAaRxYSZUk9EqMmXMQguBDsA8rP82ygxBctDxeY5X9dB1bfZVN
+loUcPhOQm8QmQwiNHEJ52bDmM6NGigR8mR9Z8sNK8f263YHFAzfRLNVtuFEDuQNr
+B+ThWttBshtLivEGiKUOHTemg34H55O4QE0JPGYKfNjY8CagkefTfdv1rhwT8JF6
+n4KJrcF7DuKn4/5yw0fic6222v3nkhw7XZZg3iD0r96JAn0EEAECAGcFAkzSvhUh
+HERhbiBQb2lyaWVyIDxwb2lyaWVyQGFwYWNoZS5vcmc+IBxEYW4gUG9pcmllciA8
+cG9pcmllckBwb2JveC5jb20+HRxEYW4gUG9pcmllciA8ZGFuQHBvaXJpZXIudXM+
+AAoJEJz6KwFispY/oR4P/Rc1LC0eZ5u72JN+ttH49FVZvbmJa53C5377m2BRThdp
+K18H/soJdMADXN+pJQrdtOI5Ue0c5OtB9k6sCt6TN+/6mFH2Jepm99GQwBbuhfBw
+viOQjCi/tpLeYLPF4tOiSUQycTuDeopnS0zWRmXP0nllZN13UzwVf3/Zdzit9S2y
+/NyalyNp2n2Ec57guRxXpwx8JxK0eUveBV+5lGkXIcaLHohujdtnBISiJy1gPfNk
+xbVkeeLjw19pxCzjbQEvCWtQ5/+nn01U2CVO6z7sE+cVS4PzgnudADKlR04jgNno
+FXtCLaDg4oO3aZdZrHgOA7aGWmDsgzlcI7ZHuf1wQrVCnMyBkyp26U577jsfmeC0
+yPJarc0fABbVv5faMy7BJ77OjpglgjxYm0Arg7rUBDsb8WkjthSSQC/GdqzmE1t6
+eBxeTFoROZbZX2XAZjNSCRQBBD0aHUmw4VA+tUPSGvbh+J1nfg4FhUOhiOCCrDQR
+duKDZ2Wr2j+nQ+BK6RfS3rk7rZletqb2GCGnc/FM9PY5lwoFhztOu/RVrzGqpi2C
+oIVWxxpxZ7XY3RnLyV9WlTirz7EoI7eO7N057VdAhc+9KSxBy9Nte+CiFhGkRS4q
+wcOGrdlqW39+tMAQOdMltU7rPwzVKMaZRRRKOyp/4MORuk4Qo4gyRBadEsnc+uS4
+iQJdBBABAgBHBQJM0terQBxKb3NlcGggRWR3YXJkIEJlcmdtYXJrIChDT0RFIFNJ
+R05JTkcgS0VZKSA8YmVyZ21hcmtAYXBhY2hlLm9yZz4ACgkQsNmRtHxAhzeb3g/9
+Eix4HD4Jzb95gAbKLzoYgks/Ql+PJpYFdx+kbJ1gmgU3uuKPpaVZIZUIxw9nfk8M
+N4zqZkdjreUlGbfPlxQUN4lxIDoQyv6PMmVc0pxy1KZ899/yrhuzsTXadzIvrbyP
+vrWkEUFuawhuaIqU8Fy9Mw6PNlOznkaZsnqYoXD71LVTkv/k1msnGH79YPqfmdTk
+D/JgtV+nXCxVChNmBzHTMccV4n/WKPJZNCgDVXHpkuC4IxYDwds6TfMXR3KMACCn
+FSFnRGOJJhhwHjbK3ilsX4+raICeJd/gSuBTGkIlJ5jewYvngRwM6jr0zs2Nf7xb
+Ypx1pQYh8emkiy13bCgYm+xmIBEg1pnkk0wlqZ2pxH6Qv42PVubsm6CNFVeOGdnS
+SuYr5ulhuSTaG5iK2cddDadZscv/M2zySwORVMkJo3QLT8fp+3Vl9qd+MnnmOR+i
+UtO+ZDTLx4pLSE4tOk26PIG0SJALAUZHX7OviUykOZvKzMBUwg5TUnoBdyXupd+C
+L2GnPjZvmFLaZthKt/2WPK+bAxT5530dAjcGOJYdd881SuCUTy4IF9+qw2WrsKJa
+TNRZtPKlhtybaF2ylTpVkH5SJntm43mXuldcHbMyf/ZaAW1e+5pQiHdKyw4ZNkWw
+nla4zFjkFOeLRvmX2om7L12oc+OaW16HM9UZxhe1ymaJAhwEEAEKAAYFAkzSngYA
+CgkQmuKW/QLp9lt72Q//coD/XlxKxYC4z2/b6iALiAoM1IUHbrIf7D9v5MFfjU/D
+iEl7wRtsvCsTPGYELs5sbh2QUcgu/FTD4UhMS2e1oO4NUfB4n7wjz2/g16IRR1dE
+6U6M6xpsgMA1y+MtrMOVShjcQPwTleFvlnPq0KRSemtqoZ3f3r+l7Zg+KxCxIUCi
+r5TP4HBO1vYIPIkNnnxcumVqU5qs6QUuZbfCsAQjd5b0UksiOrgxNM9TgZVBrd2o
+s+hS9osarxtDVpMlcDjtQf5+hyMEm6Ao4pCxyua/sTNFEH+BxmVYHgDaSompVNUE
+vAkYDcuJAUPbjU+BHnokhx/h0eQDROjgl96VNA2EyBKPuClrdPslxQeK8IcD4rHO
+SWMjtxPTw8dT2JSJGfUPYpQ7d9qYraJaESu+rzpFQhVzTnFSdqsnlqtzjoXRfNe+
+aMEt6fgvm36lzfsgLWfrsGUdQJ6cma2+B5osI3vB3PQUZ/0HGoEW1nQM/3RUsnb2
+95dB3A3bzhJDrtGthhg84ztxBnj9WnVllb8CXPpTLJmS1ZWeqgdpIX4lkSYdS1OL
+CvJWIYurZ4TC0EKFQ3nScnU0tXLsS9cnjpqQVH5cZU8kZU8cOIlmG9GhYqQjGGPz
+BsBXJ/NcGCJLgYmK6ks6btdvPrOeez6G3HNQPI6e6i0X+n5XGWBUkHdv7FL1mSCI
+dQQQEQIANQUCTOJSoi4cSmVhbi1TZWJhc3RpZW4gRGVsZmlubyA8anNkZWxmaW5v
+QGFwYWNoZS5vcmc+AAoJEKR9Hi3QHg4YtswAoIj238Jwspzp1VJ6jdF03OTym+uT
+AJ4+G5xZO8b00Yjnfx0YSyjFvOiCzIjKBBARAgCKBQJM0rRDHxxKaW0gSmFnaWVs
+c2tpIDxqaW1AYXBhY2hlLm9yZz4gHEppbSBKYWdpZWxza2kgPGppbUBqYWd1TkVU
+LmNvbT4fHEppbSBKYWdpZWxza2kgPGppbUBqaW1qYWcuY29tPiIcSmltIEphZ2ll
+bHNraSA8amltakBjb3ZhbGVudC5uZXQ+AAoJEIs6YB8IyXXlqTcAnRUlfUyIBr5K
+sisrAkeThmeA7gCXAKDo/DLtoAHtda8clNwhnsXxfUJ3U4kCHAQQAQoABgUCTRxN
+tgAKCRA/z1Kf8vJ6BnX9D/0cenA1sQ8jbmjEWOlp4G6mwuHlorD2UVWf/vpJjdbk
+HTQXPwdN7UtQiDlB6BMynKOoJzzbp9W8x3tBHgUL63LoehMtmUDzmy519quSIpzY
+S21SHPn1WukZSK3Q26gmNbr5spxeDJJsy9jPMLDiHbM7CVmjEyh+e0ms7L1nqXdo
+i7d/wBVakfor3MLnrGrpqWHCMnjRHgEKUSOQ3f/aH0kMIzo4G7+7i9/E/F5n64qL
+wGFB7odaOIUIRMiqGGUTQ5FWtNrUP3PZiUyYlyd2wK3uBVJf9eS4/6o6vGQ+VFRu
+h8L78OMsqEnDl0Fc+y2Nw0s0P3u2KBwvjnWerG8QDDs1SYsohhG6SDZiwT/4/ubQ
+8WaYptTZ77TgDdYKd+0Z5of0l816QIl1LX+nNcq7kVRnRbvz+chUecbe/7/cslka
+hx0MlwCRUAaxVEbUTaysRffsF54qneagDGHb4L3VqAN0iTKxbWVnRtemb7/wYNlU
+ri1NrYTY304oNHkCYdiByeddOBmGBb/pYRYaoXve8O2upaGCaWWwvBVjLtGgAScf
+dhuJxaLZ6zu0AWPKs6alqX7SAmYsY35NjvY4JZINM8JWdeMUyj3A2O0CpQGPIoso
+YNJM1I05ivDaakLpTjhX0bhxiYyxlgBQ/kRChKpmX6fPOvXu5LaMBb3EwUxq8Mld
+sokCUgQQAQIAPAUCTNLNqDUcVGhvbWFzIER1ZHppYWsgKENPREUgU0lHTklORyBL
+RVkpIDx0b21kekBhcGFjaGUub3JnPgAKCRDqTcrcTcqojxaSD/0V9cRKcomCfYr4
+8yPBt4TbOet0w9Rhq4sdwrRyisJEO+nRnTIwXTZ3WIDYhm2aISKODFa4RHedoxj9
+hdRbDAJuRIA+o9/MHlaA1MMVMUSWp4AoPh2ESqvq/krtrrbTXHa9xgQkL9B0uY5A
+amYf1Fqe2F00LpqlF4meDPQBSqH9AZtQhf6omRqoWy0jZk0EcgqaxpDBROke+aqi
+S1f78N2asNR2wkHsh2NOhEiSd3rsypHvm8DgrVBdUjn8+Tqs6qEKChC8FfRmScek
+H9+P1grd6rly9L6zcl1N4PAz2Om7jbwCgUfWoK7gZ9Cj9DJ/+H7NMhlh6ap6BBaW
+ZVduCZtGzTYxuJp4hSZOFi/BdzJG5BToIq0EUaRQbySTNGBOsZvP1u2zB4BH6D7T
+PxSztSRMkPcA7wyE3cqH8zxWofmxwIDUqgCb9/2fy+JAwUSvEV3fxXum3SB3rY2u
+7AY4s9LJkFuBWA/MmZbcfSTwtTpmPXUr54uLyDtRejO/aRCrleKZ0ZcZ7v69HPqh
+9RdNHyepaJBjWoo5yRS7qiy9yE3h22TeZcBLMe4Fm2m39LisHYNx5+w9ihgfeYtb
+wEePnRM0ZIf95Tn0VZo8XOZ5SHRJMDj5j9oHNxI0Qa+eLhhoXmcVsqNUaUnPYthY
+Nw8fd7ke/aoOubOC8ZabJKGdlGE2XIkCUwQQAQIAPQUCTNttQTYcQnJldHQgUG9y
+dGVyIChSZWxlYXNlIFNpZ25pbmcgS2V5KSA8YnJldHRAYXBhY2hlLm9yZz4ACgkQ
+4TYIihgkvcE+DBAAjiH/wW/C6Fj0fTUqKJGTCqdShYWudeJ84NCvnCwKGsBqk0Kn
+xzd4I5yhdf0YKTIuGk43KL+MsW+EkGQisQ5/zkufuhJAT20kOQ0cwEH9Z1GCmkfx
+Jtb2gH2dK3FAWbYLUCHxvko7XOerEaaJQu2P5xqct7Y21kpPGvNYlqnQh66iAp1E
+HmtkMHs6nfbCR562aDB8KhvPlC0DWjoKN0ll2+xCSfORY1aavWpiAmRFk+0Arrsn
+BgrZz0xpfVOZe/aq+dPFoJbyZya0XJ8SyRQl1yx3L9IkwO1LiTEVLLIlANSQZp9t
+e+PC3eE2Iim4gg9fi6vfSjYf1NMOrM8p/S5wSwmrSxV7iMG20L7iEMvyEkknaxfJ
+K7cRRb2sB9/ddRc1sPtJ1c5V1FVvbwcYB8xN7jeJOr5oR1DMoM08OQZEnwQLGdQG
+sJoJFny2nAUUjziNDDgREmm+nHscd65eABtxMABUxpOA++uSl4pzvQnCKc5r9/+/
+vReW442HBAucVUC7Lu9CgWz4g0qrB8A0nl9ZPcznNJ/gED2GHgSq7w+U4Z2OVOn6
+ah4p7FPrragEy2DHHQPGJb9KbuQP6RiEJCslIgnQV9BxxeuBSdvKpBPuAEhZl17k
+7Jak1NUgxIXPWYsC4CcsL1q7f9FUnq284L2ZyUFLGo8a8FyfMpJbxO5wUkSJAloE
+EAECAEQFAkzSuNg9HEFudG9pbmUgTGV2eS1MYW1iZXJ0IChDT0RFIFNJR05JTkcg
+S0VZKSA8YW50b2luZUBhcGFjaGUub3JnPgAKCRBe+tn+gqf7zYl7EACWU2qLqTP8
+dCreA2aJHlWjFIaIuNwlOZ+fytsAlKjSdTFoul+PxIBk28+flEZPFooYmpzyEJxL
+s605m5gX2N5QQMjEGGHs5dNQ5EzT7mn+y+lLvQCAWvuP9F6OkxvsK+VOEK7B1eDl
+I4+xw8NvTJonOidAVtrw3398RDb1e4WiU8WiReRGzsyUDU8MzvODslTnqY1dgwaA
+xaGvbNcGSSpcDOD3BdY9iEXm4x0p8y4SamP9aBSQfo2szO+gRO4T7RRmjlC6urqP
+XVQWl0tdqG7zd19i+Mvjo9gqxCZVaqzl/sO4jRP7ZbgBIk4eIkm+fZ8qwVYXpYjA
+AKToQZvPnft7hHf5q90oC5CJh+1U7y4V9BJuMebrkHeo4I1cIoCTbz49vH0r4rmj
+v8oNVlINlqgWcqzjUp5nQf9n2kyDBCRuj0oiKOuqPyriTf5MyrdXSs1V8Ib8v/Ko
+GwHtc2/PiSjZ3h6r9TNIgxCTTYzTEUk55l8ap1+1WekEwUa+zdKe2ShZcRXFgJ+v
+3m8PNeECSOwI4SmjPJWB63CJuej9QT6cQ1gIN/T7PD3WOc4btSipaiT4dYgIhFbQ
+FlTwRgQ2+XBlpzRczvNczvQMvySFPYwDzQqvHKcXilBf2YKbF5hGWSgDXQLdGyKT
+LukuB0YfzxrXYkIoIyuZIQ84Z58qXaEAYokCXQQQAQIARwUCTNLRrUAcSm9zZXBo
+IEVkd2FyZCBCZXJnbWFyayAoQ09ERSBTSUdOSU5HIEtFWSkgPGJlcmdtYXJrQGFw
+YWNoZS5vcmc+AAoJELDZkbR8QIc3nMAP/jav4fF573xHr4c2jT/Iujt82+s/lefd
+Pw1GOwHaDrEB4bL0AlC+MnHCR8T6HkoXJRFIzUzfyrA/hyjzlfXLn/RvfSMFkvoF
+tpPzjT5QC2DcagF9Yz7YfaPK78VcKIpmqCP1j4FT4kJMsOMKOpi0Bw0zJEDIxJPL
+ByIf6V9bWelkk/IepTxM1dfwSzzM9F9nq8hsmp5daUDsnehTscoomrv4CU8tJ8+V
+uDRoWMZi4FECMoxWrZpwhj4dD2Ocgep7fPN9Q1pHf0Wn1Sdbzywin9rBL98UEH2V
+BDv6fli2QlyU9zbww62LcTdR8SjlE5fVTt4CUBDnBm3PEIPVkbBeDXriQunVwVNm
+afZPbvfLZ3IEUoVfk7Pho6ivwRelb1u70eyP0zudWb8q8G5Qquhb1rq6Ib5SM0XS
+D5knEIJQLAEBbbul+SqBW/lcaLLp29mquK1Ci5xC+bBWaY4Yn8x/8Zc0RiJPX16M
+uYAaHj/sgJW4nI/BrqftKcFsB7tYFvRE1NBMGIFepq5NcZfWhWbYYglRJOc7TSx2
+jZksSMdfcMEy3nUEn8jnjge+tmKi4gE7KqLMhoD0y1u2dJ9dHshMi5IcM8SsNJNN
+fqxBzOI61aS3wxNTOtDA33/6c0Mz8D6CkftRDPlEqa0JyHJdVXIJHk1tCcshEMBX
+jEhmJrv0Ty5aiQKTBBABAgB9BQJM0rQoNRxKaW0gSmFnaWVsc2tpIChSZWxlYXNl
+IFNpZ25pbmcgS2V5KSA8amltQGFwYWNoZS5vcmc+IBxKaW0gSmFnaWVsc2tpIDxq
+aW1AamFndU5FVC5jb20+HxxKaW0gSmFnaWVsc2tpIDxqaW1AamltamFnLmNvbT4A
+CgkQNOp25nkUhag2xQ/8D8Rt8++/KUdrXTeM5ID0HZ0FAUe9DNarE6XAT/EWt3Ch
+4leZCX3gAbH/Fw1/G/txURqmcwH8/U54QHvJJA0GDHigeealRawZbTYXMzwmscBq
+x1on5ztGD+IHWlNaY+oBlvLX6QEIMWBXaywrSNM8fru6Rc5yOs7K3yHgRRWn4t4X
+iuMR0eEJRkDD/rJ07yvg0KamtApvK49k+qiPjKU3optLNIlGV5pP+vSSqxWD0Dsp
+XEUAlpgTlhHyajHflFCubdaW+IXJuw2ux9JO6dCNJh0Uoylm6/udrUm97196Tq6a
+AjZi61ClCGpTg0yGNokvCgRDbrFt4W1TtGwH/iJ0tJq2PDNUm4ATaORlE29q8XmI
+g/wi/77pf96XMgQ4F+HOIilS0FGxszBXHoxzYDUmkUB1vVNJvIL29/HjPSFbCZWP
+GFlBulwSw1YNRIxa/msV95WdvygbauaR40Rpy3VeOZKUm7JR+wPbbq5XHK1SK0rQ
+mCllPwM7FqSgk3Lqs5/DrNFlXtUuk/3ZP3fTJ4MRGgRWktjmwb342imeqi740bA4
+i8oBuQcTpHWmHfEBnQvvYVTqHNbXLL5lmA2TbR7aSQWCiXmw8wk79MNWmwbTU/8R
+TzaRdDFwDkAhhbk3ETqe2mh9oZgaZk+ZdmpakJ4jCN71NcKKrar3G8tyI5/aRRmJ
+AqkEEAECAJMFAkzS47EgHFNhbmRlciBUZW1tZSA8c2FuZGVyQHRlbW1lLm5ldD4i
+HFNhbmRlciBUZW1tZSA8c2N0ZW1tZUBhcGFjaGUub3JnPh0cU2FuZGVyIFRlbW1l
+IDxzYW5kZXJAbWUuY29tPiocU2FuZGVyIFRlbW1lIDxzY3RlbW1lQGtleXNpbnRo
+ZWNsb3VkLmNvbT4ACgkQm7hjsPUbuIobZA//c9PVF5LXRY1WtK7R9lM3e2nSdr7z
+/A5Cj4REWOTjPRMXo515XNmb0od3reGRv2yDtXfyvyjoYA6FU7y64INBWyLWPZMW
+5glKEwn9ILVxdD4z3XIJFy+XNPVIRZ1QJRrcMh7B7P4eTPQDPRKdh6xyitYsfYhq
+UKX/YQ2lrxqmwEPd1KMGW77rjctHJxF93YNiqvr0O9fYF1jeKHa4w+wjcNbCuiej
+AQoV6LbeggUtyk3xZWobPLQt1Lr3JG58le5TUjAXyWPdakTGwRRx8NXUmJ7ciwLA
+XUaq3jNMkunQ49JHgY89d3if4yhUyko4Im8I0FE1eV6YFK1aaPv+e4OUCgyGeexw
+MTyNl/b6fnllbtupBM8sTE/a/6LbOrcnieSD+qe2WLptU+E+HO8S4NUUahChtvtG
+bgQOv8Z9xqCQUvFTxUl6P7i2u+goXSnmhT8AjoaqcysTPGFPHY14C6hJFIGZ3Pt7
+hOpcX6/weF1bF79GLbn48SVpEzafMnxIjwNfxbJ/MWKZtsubwfEORycasiqx6PfT
+R46ILZlQVWK16w3rzkz+wZAsIof48vdT4/6dYHh+fPxlb3hKQoXQv4x/QPPIaH6v
+2N6HH2GYnt5j6lg/+Sm/DaGZ1YQAmo8UVDwrkSWDK7OfLd4A5IE7dMsk9CvXD3NZ
+qHk1jGlPs7/Oi6iJBBwEEAEIAAYFAkzS9KQACgkQiq+I1thOQa6thx//W1V4IxcK
+WJSWGsaxHSCCYCxkye2uUvPYfZq/i+sHVVdMJQDTE1sC2dnblXlXRlSnHma/0v8+
+EQ9CgnG0PHFFqVJIYsK8JFer+lyNTFtGvSnjnKd8VXkbShoLTrmUeCyuWI1egdI9
+xsj1pK0hOnG8QvjkPrDsI0faW9N5sobRCmPfgcibFEqAvJDkAnM6p61ZbDtIby6O
+m/5J7gGMD0bTY0S2qChaUDXslcZtX+1gnz8HQr+buciH9nmJcyB+rzo0RdVO6WRx
+jdZDOpQ/70fTCL6b2G1ge0qMbrxoryqyxBOEDx3a1S0BWjp/6LxKtuwGLEQk6pBQ
+jjmxihyk7Djk2uwq6q+gsgwoaReHAvxg27lNYoIKtJfrysNxBjCqGpP76e4Azltz
+YUkabobTXart5pLUS742ow8e4z0P2hOjaylWnd/8fJbpzQ5/y5tPUEkgFqywwnap
+sbvNiUKUP2D05hFIbgo+16KUSqA0pPElvsY/yng0hRRm/tirT7qFd2gWCLKUpZVZ
+WZ27QTjdykS/0yeGM9tSLMca6YSdmA5J3ja8vimEKyjgyFYKVklSdZT1rmctKaBJ
+3+QKHz1Af8pfwMVxROfyxDTZIhyAi4JU9gQvBzkV9ZDLATydBopl1jM0zaclKrpe
+l+iicq6jnpmQ8A6Vc2uf0qTJnASY/wrM0YasfB0DA+VSHH6Dz4mHUoTowlkEiRh5
+rCOz7DnginbiKtrfFbBim8XaLhmW03TMgIy/bHbMDdM07JAK948/l3m0O4x3Wudf
+V86Nv6yhCq8VgMSR367KYIdoSrUMmuY8+FZuWBcF/6UvNRMXR6XDNMG0LqJgXMLL
+cCwcEIHMDJe1iZnG0WmYAUBcIZpIUOrRpc7OyRbX0+QzpFPsvWoXJJVSShHbKs5p
+0xxigsJFgphBktkXHu8KfOfj1Xv/6zXFxA3MJY7qFsVFostJfV3uF41CeRvUkycU
+smTFT7/1TK4jk8JAeAQHcEtcAQsCNYCVuL6nByp/XiBX80lvGSLwxGbtiJmJpxgv
+IpQoEj7txxxculijvk1eBwUQOBAoZOH3h0Mm1e/qf11bxa6Kpwky7PNFl5pmdwrV
+TbGj2Zdz41T7D9w6gaRk3llvyI9TfPRVF7ZPKdW+tBYHISXzBGG6P9Vc4WTrM+s6
+ZFlomdmunNJ+67T0tBDNdOI8ezBoCnHxzDHvrQyxxCcyE8BIQ6yJP4DdcL+NuQgB
+oml3bu+esIx2iuMgAxNzJsuNWdyTO6lk7Yq2EGsaDHxpn+zOeV1wPy70C9LZLZnS
+OpNdD2+NmULShTVEEox2wsAjWew+JHOt/5+fi+kvLQyhVOGKLz25+ZUo0IaDV6zf
+hNboMC8xAWlIirQiRXJpYyBDb3ZlbmVyIDxlY292ZW5lckB1cy5pYm0uY29tPokC
+NwQTAQoAIQUCT28rmAIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRCCeB3k
+bVlU+v0rEACK5ekMAENEslmKQIpY45mE9j6MQ7Ppx760fiCamutk3+HnaEap1i3H
+5K6zwsnEtJzp187N3mfHrJsT85bpATHh0ODj+mR9OhmaI4fdHeUpSXXPLBrxTo2l
+C5ucvJ1v8QWyyuYPruSoGJdjecOHjEovPKM1b7gXVqkgUMhY3PTgM5MdfMbhSVfN
+4Y50dOALkMaHloseOLHG+xN88i/G2CoKfp0lFCo2Y6RLSp6y7nRAt9wcCvS8raDc
+pdEMogRRm02krAjJKqxUvL20VqtDDeJ/v2wHcDAvOd8wREM0laNhq8BT7Gh8poEG
+dZDERFR6DIdvEfd/++vt4xujI9WTjIPOjyGIPS5QxGKSrf+6AWy7zAJOgEHgfY0E
+pWgL+4FXmjYASe3esdt+QUiPHXIk3TBEzcGZdkbI+K1A8zLiGNkhtsw9s3JdZJEz
+N6ZOMQQ3Ph2DoVtsdhVZPkg3muVHO1XbwmT//bJvCaD5rWQ7lqDwikBHhL8DmTwj
+dvIbgqsy4VGq49ZHd4QcDCKE+Cjopo7bcayyTPLnf4Qg3IUg5hTy2LQJ4Ynf9Vu5
+CHNF21zhduwzOXOi9Or73tlD9EbvvwijFE2fRRG8Qqw6At6IpAuP2LXfRGPWnA9q
+emZKR6HPPX4hXHQC8jgz6HnAambfkyq5jmLdz42KDgIO8vQtqqQqdLkCDQRLAip2
+ARAA4qluKGH1/ETwJSLmGjH6+sGx43kwSlK/EczWFNpLdfsjbTtIFlQbaRtm2A7L
+IJOr/Sircp0+Av9gZuT7HPp2NcvgS1FKWhqAFoi/2Ijis4j/NjcYZHtF/A7Dgm9C
+UB+kVMq1ekICClaBcs7LrY73XQLdCrF5y7A4RPmUj9s0Ma89TPw1lzYN+9nhKkhe
+IJogkDj/qLAwO0qwWHLJ/blIYTLMUHc/wE0w7Vx2elNoY/9m3rKtpGKl0y/cVTUi
+ZEdk3uiXRDCcksoFV8CYw4JvfY1HkYBf3S0M5WCUJPme+zjOo1eQxiCRMcBwNP34
+ZhE01/8+iBGNNOW3fjQA7DQsAgiOeTkpSg4ntv2W7VQQIUz23M/pmZcsd6+N2+89
+lzooSwPC2wTn39nkKmzMQ8NunpKg+5fA1TLpndghBaJH75XT/KZSlGvThwXYVwni
+wdFIZORzgM4ZNh7vsEGH96KSZ+xaA0uF9VWxYCAGCZPkxrevhxF1lUyAmr5ByOCK
+D5FDUuLoUO8102Ka7/fsRSnZbwwzIEqPdJgnnKIwSTcFQm6KnMovvK/51k1HJpoE
+Gj3TJqIJrGrxlTEk0czQG6dn717cNiRjXaNWfJRvEEEALpXaPQ1PJlXnbISACEf6
+ugJ40xxGJg64X6zl/SuqrjDfnv53iQxxv2vY5Xk8sPg3LyMAEQEAAYkCHwQYAQoA
+CQUCSwIqdgIbDAAKCRCCeB3kbVlU+n9LD/0byiox8rw+vXwUd4IjWh/i5WRms08Y
+eaoHXz2VAIjnwj+tYx97ANRdmmHzYMXilnmO2SgEg/Gz+xNvwRUcyG1jMagTNarg
+j1CeNjBZpHrxV1XWlfH+82TbwJAay+vEQlNvyESGT3GF+8FtdNUz3fK3okWqUyC4
+aDDSUAwXvdF8L/HduaO7IO/yyPE/mo7cK/ziIiVLM/ypMTLmkKmVxzHEN973xp1h
+vsKgdjcY7NKegHiLrdAGonV+re+Oed5y2GKp0pvX8K+p2ClGieYL1dOzH0bS72jW
+5QVfLO7tvMuutff4dXY9x7vaFyXxJTkQeO89wOU6zIydnaTo/MbLKaoJXZzJXrJj
+JlXcECrN9LBLOFADMsi46TraoC4uTJ0hqg5hQu2gaZTRP2/bnUiV7CEqwJ7VRdQk
+YsscNurLharQ86+xhB6UkH6zqFk4ElFElgR3W+X778VOipYXj2F2d2s2OxQ32z2K
+Hi7W34/qmi56p5gOao/XjkdekzYamUmh1tonixj+ZpzDXJnslr1z99LZTI/FVFkW
+wLONiEssCb1BC7GH17Q24hogaRZ3j8mAt2YEQFhFu2Yf7P1Gks8iPXTsUB8ylljE
+LgUETGmAQpBLAuK3Y8xNsK5kWXU+GkgIrKd/hWk897R1WwGXxqlWuvNdPjMVTG17
++d0Rh8SR8ykGuA==
+=+Q9G
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub   4096R/7EB5F61A 2015-10-01
+      Key fingerprint = 8935 9267 45E1 CE7E 3ED7  48F6 EC99 EE26 7EB5 F61A 
+      uid               Yann Ylavic <ylavic@apache.org>
+      uid               Yann Ylavic <ylavic.dev@gmail.com>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v2
+
+mQINBFYNNTIBEAD77QsLP77W0f4zwQu1YRSVvnOSbSWmaYA2G3rnIJ6TTubVj4QA
+juPGJphGcH4BN8ypOY5aeC5q0F5u2LWMP7Kq4Hz/YMqHlfIzEOWbkE+Q1CbIda1C
+6SsL2FLHDBONZrVkOJWkcZ8MP3av3IYwMu0EgAo01OvxPeHKNzhc23z9uTSEEAKL
+9nOy8CYGd2ng8J8Z94vVwpoR65ggKwZOAXat2uVnnGgdZBDoce/74pP+uMDg/vg4
+hnLq64+1ZndvbPchqVJZvwROXaFpB74QbulO/juezs5megMeH55ZaYIjcRxGr26z
+X7o4N2R5ydSlwSW3jZx/WL15yOLfOiMdSdRME6mtuvEBb8M53L/taGmWzaZV7JDt
+6WIHLwUvJsm4z7YGF5n7F4dIsuDFQUx/+3lIGLsYOZU7Ha491Gqxs+aU0TNuFT7B
+d1iM2M4DU7RMMRS5j+v7TRiw5W0yoO8OQ4ESxYFN8FXPdRRseqfw1k1jumFY0cdJ
+plxNXz3f45aNui3XpLZX4yHzNfnMc+rqw9STvy/rJSEvtsaT2PwlO0nEVdFuP+vV
+OAnc6GffrsvHKo9cQn8x+8ibcLQXUaIolm6TB76RUDaljF5bmMHI/VzwN7+fQhng
+jYuuAyukq0/nXSSY2O1KCXC6QRCqZdWP7AAXhVqwfuv/H1wanL3IladjRQARAQAB
+tB9ZYW5uIFlsYXZpYyA8eWxhdmljQGFwYWNoZS5vcmc+iQI3BBMBCAAhBQJWDTUy
+AhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEOyZ7iZ+tfYavX8QAOIjsT51
+DE5Fu7k/Bau7DbmQmQbUOMqBpOxS6BrmSDWy3wLuI1uJQb5NpyfmnYtPQhQp84vF
+JYOsW6IG8kZLLHImniBDeurzu55o+8eZzBwHQMn5zdhIQXpDld1EVdSrECCeYVkQ
+gN4Zf18X0hrznZhZQX13oKsfJCuzNM7cPdhEZd+1Xm8sFazh5GDkYKdhpYvhexce
+/Y+IJeqz4VxPd59LHfua1YQYqAymcmPU8Tz4i/WjvwHUGXJArWu0Uv9q7ZIfvi+t
+Si/FYOUoCLWvcvXDxvKA46Fyyx1Ph1FQK/jzLwdkLnTUoFpB8NiJAC6t3u+UQy/F
+rm6BR4x8Tanncg+bF5szxEWl7N76b8nXlp8OL6G+1Skaod+OLjtPZRO3NX86Vt1/
+UsA8wyPi8o32w0y0G0JFTN6EMQ0b7UZd0gtBKnUQCLs4P/vxjvABKfKBmApGa08y
+sdvIe5GQ3PXJ9WbKiNDtFP5ceyYhi0kcm+Zx4PnF+INOHZUaEkacDt1LuSuB3Prs
+U37F1Svk1eJaCCeo6KflErdHUriabZe81ywiNvoCuCoRwOtVqXvC2eLYD+egBdrJ
+GFqcTbTu1h6HXnuILLiiPUHt2JPAXeMS9Ks5stbrZrScp/oWYGKJxuBKykQ899vk
++g+9IAERUtybCGQw8z1SROgr12E7INj9KxCiiEYEExEKAAYFAlYePJIACgkQLrlG
+goiBdAILZACfVEboy31a75Uf/4E6AejriBb7ewYAmgJPY2XYrN37sNKon3RRQCqZ
+HMnhiQIcBBABAgAGBQJWDnfsAAoJEBk/GAq1XZl3gO4P/39cOhS07pUoN+pYl8IK
+XpIURnSmgd2UbKEG8c2osh7FecQd4iGaVzkfFLdB6VBs5tCgVup2ov/4+brSIQJH
+V9YNUGUrzJJfY2IKCjxXfyaKFW368UKl1eyQzdUYdG0S1ThIm3Vs4YQkWJcpRRdf
+kvMekM2/QU0vWDCPPWEIscc6BHxkuVKwzzMyWeoY9CQYayL+elxYVaHG+9M4OdU5
+sAERQJFuvrRW6NAqfRd8yK1msUnDRcwocmlckJ6vqj1/JuMjJFXER1H8968ummec
+n18YEWwL9Aos2jKZwrzqwiBJHgQq5ciPpb63Ev/HiJ2Qv5PN+zSQjNePcpR1LXPr
+msTwJVf6B3MUWbFkX1ppFvJ3VME9L0kAoVVgCBAi0uDd2FfXH2+iq80WUWBpis0J
+Y+xS919Jr5rCaSPRVVw3RhB7lFOdeKiVOKivCtL16pHlxPrFfbMBVNmHeUfem0u7
+UxVSP/Arc4f4P12Cp+iQgApanqJoGwWVqaMoJm6BptXiRF2Bmr4JyIzi9mORR0p0
+zSP5EQtDs1GVHaRrg+nl4xAn7os0k1lCcCTHfKUH5ECOW83pAnYmfgUMa0cbV9p5
+Ed3PhSuaA8l76ypCWtJNQrDdkRoWzuRzixst7PyDaPgakck/fxythCUe7NNcFRkv
+cbqy57gLN+bWGtBJRmEug6jLiQIcBBABAgAGBQJWFOC9AAoJEO04c/XTJicipjAP
+/iLKF6MBqq1eIZBjlirCHdkkHEwPoDNANW/c2NG0XZ2SHyOtpp67YIK3kFj52MaB
+CQV7Tov/PbIESyNU8+HsHWV7GKPzpLSseZqz0F/TzM7JhF/cA7BAyxFyScI2U6Hv
+jL9ODaZmiTpkG5VLFhB7fTzUQk5LnDyNL7D9A7htZz5alemQ14RncEEg92EJ1g/V
+b8Oww/6XuRvcjm+4llrp0ybrbmi5lv/IgI7s6/NjR2XERHb10hxaENhsdNJ+Z9cc
+yB3ivD4qjJ0+HsDewxXClvoHmbPwIoFGfYGly/I1JbH7MASRzsn+1WJrQSU4D/dw
+v1ESwF8f241jiqpF6gze6CZj+4cvHqMBqQFsUIGpoTwLxCiOMgamcgz5+NfeVE6N
+FOaVuVNtiwa8PukFvJ21PWSB9fs2qCjpU7CxUa3W/Vq7iHyTe3F7qu4e0yUT0u+E
+gsrTDL6eEmh17hW8icePwJk7WyivwaggvwPPXK0gMV94po0dvb2ekbBaqN9vxrts
+rgCjeACecS0RPQmkUlArmsfpYnmvky2Pl+Q6HedAKwje+BKcGchvHe17FO9G4YdL
+Pa1mpzdiDcYWErp66tl0Ikz8OC6JzMlafLmYBO6H2AGOdF4qov7ixIQEIBHTB6iq
+K1MYpOJItjj5jEbJIUi7X03ugYvKR+Y3LwCwRCmn+BofiQIcBBABCgAGBQJWFX/A
+AAoJEGgijAHsH2WFL78P/jeb96X0jNctPdRS2pU5xYDt1wy9ak8/RTLadACJdAhl
+5TeEDSfpHqO/j/asUh5wvozmQp6cj9mkjGlbgOnOF3cgcInOE9/PLe4uCrkEyq/f
+u2E+etkQdK2vW4CQ2BoPK5ayesu9IeKhzIOKcgBoiP6nPyjHxvH3QwPGPpH0UEj7
+C6Y56Ub4jQgfCnL3ivQtyMXxbpPaxbtmeFGSdjsQ8C8yYnilZrj2CuOtqIQuddrj
+B5gd+MdkjMmNhkhYDPtw08BzWyBkaSyVpoAmK3Jd7gl7TyVbrYdNy8zxCLh3akil
+p8jgd58YPPoxTAQg96Mp5Opzc47ZWgmjAeyxhuFWmqomugTx9G5xarRODhJ0MJ5j
+REnWB2OgDJqP1BplgHSDCBY6epl6rp+hoORczVY6C0zNMHIQiob8AWsaTro/ychK
+NrzJhyT9x8gsAErqRQbF+zELdHEpKgTV6Pf7HGrfWxsEIoVPEyWZRn2msaV/u+7w
+Bk8cnEaYFvy0vODhAWGRTXsrdpIv7mbHNZq4f8XoIr+ZFJaoJVizVtma/GrTkr65
+MTr5tKoBl7vZqX6IDYzFpkZZE+JAG7l06iceIEaaa6MqnGiGu67QC5T0oY6Qhf1z
+/Z8mXfvWWtvikv2crScAMPv7mHjWudTCSovvmG4fKuQURTKd58GUWgcMWz7UAgUK
+iQI6BBMBCAAkAhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJWH49qAhkBAAoJ
+EOyZ7iZ+tfYaR9kQAKz/GbiAvJdyWnHe7r7a1EXmecp9YgfJVRQnqZUZj43qwlzQ
+xz1aWyWPYurjzkoHIkp9y3JOJYtd8DETOwDRhVkAeIirrENnpRdHNgpTXqNQQbXD
+uxlRHQXghDhucvLbYcYw02L8sB4+4AudJZ0RVfjVhA9zyXqXT+7Cq2010swsI/HB
+ySRp9m3O4hhxFDJVriNGr5ONB/xzMWkH0UC8sxJ8zhwoBVhj7IEjOKDPKRARvBCi
+S+r7tnJ1guU+Idx1ug2SwhylY52dVQn7vC7asMPGK5uObNEMuxHqAqB0PconrR8Z
+L5cw8ZryEtEMoIjNeKdguRC0mTOXJNqj8uvzfKMTt2B0YEmfscsspkS0JsDm0abl
+ZI+DVW/OBBevYp1oTQGZWUGTiefXUXcCsPXTutNQzDv9M7maY9P0Pes0U3GtP7XX
+tBQTW2OJVQQMwIaGYsLqsUPwBGoWC9pE5kRZoeIbwn3HSxDoTjObkGw3HHPLQt14
+5NEmDbmBn478ixVsZqHYTFHEfJ53fg3Xj42kwvDNkQQVjRY2/vanMT+sKCdhiuKW
+4BhXeY5gAfKEs9RyNxWiiOY4a9YkWgSSiPbvqr34ZKEn5RrUjE9bfyyzCRtILo5f
+sIAkcGFnDYH+DCoCJqqiTYmyC3PzJSuR0/vlS8rkjtUZuJv8aJZSU1+OWFYutCJZ
+YW5uIFlsYXZpYyA8eWxhdmljLmRldkBnbWFpbC5jb20+iQI3BBMBCAAhBQJWH49j
+AhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEOyZ7iZ+tfYamioQALz1Pc84
+Qih1B6dNB23dlrgCb0AlBISO291FOQrcCjTyaVsauRRJ2rTHkxokKj8QoJFLiKjY
+sxlc96fo7hgKuQFgKHjg/rn4hhlT4VjZUL2+vkHPvG8wcn1bSxFxqmminuGK2O96
+mIJbUbv0koSBxFsBnOSdB9kQh6oOsMaBExTwfVzlEc/f/83uYBVr6yxenDSJsh/a
+nDwV1SkemMCklvnFSiUX3IfXcXA0rkT8fqQ8n07BwZiTLPGLLSbLsfme3wotVfwQ
+c4QR0/MKUmI8Ebh9KI1CE540oGnzEbUHxUS05ux1hn6/QemmONMyfbNrYXUIBV6N
+MZr2r7FxAYCnN4JiyjSmGp5TSiRsSoGYGANXsIgQfwsKDxZ4iJfQQ/0FCZquFTaL
+uPlFq3H414PJhcARQJJFFvioTorju29VoI5VcykSrjbHW9nA65KbKm/9sM2Tk2S5
+a5veUhNR0Haudj+EVrhmruNSlGMVO5s2l8s5wJ2U8oVZYhISfsU5rD/GVE+Rs/2S
+dPk+5LhFQwy6qqWNd+RqrXS/KB1HVmsR2HzCc3QuEdaODRVijSJHc6z+nzp/2DIw
+ynVg8j51qWbQ74l+gRSa2gb/Da8SkraFAgDynT163UBUqInEVaeKHt4YxG2KWERx
+480bebA+8ZBJX5zcKyw9RWtp/Wd3zyWBEevLuQINBFYNNTIBEAC9L/sTGgqzpzlf
+ZKCAVsqCC4+a3gYi+WUqG3K21C0bC1UoBrTmt//pg7BIjM5+ThM2IUOEcx5ORidw
+oMOPNyC8UHC1AaaoWpD5Xo1hYrTQkKwHaJMZGOuidqR5VahPn1MH7DwatE9LacW1
+zB8e67idzloZZm3YhXteDg0oX5nGWYm8vIzBfbORrTrX5GIP+m0mDP29kBcSLWB9
+XuLYJVABmNoGYi9liTAFjP6tbJexTwNc5R0jAX+b5oeMQyfKT37mylz1jTj7LyeK
+Yl1OIz+NmmmvRNpT24BOGET5c3Wm5hH7cLSk1vo/ragDRTySVJSsHUI1wnonY6IH
+/obUXIylgwFz04/8pQG7UGVQqxv4b1dPWAPn+uH0YMgvlDBvjbyBc4U3mw33ST5l
+zf0iCv1Kqqc35aGJ/eKUQj+0fpA0dRze7q3YKf59GlrMiAWqj2jBMLqm5zZuWhYD
+yh3FX2zawJ73vbVyCod7XfImGwPRwtj+BCsYGAbtLoS6UNo4irPgcNeYenLba/WQ
+Um3rClDNVjrj/bRgBhplKgyNcOLwPsrdzgANgTAUJffVDYB1Fnx6nsbcvaSSddZh
+N33lkTSsuVCC3pJczf8T8t6c1DK+knXeQl7WDZJ3OPoVHT7CtBqcYrGvtCVK2AkI
+ariyM1Wzzf+Rs9ved8Wohb7n0BrJewARAQABiQIfBBgBCAAJBQJWDTUyAhsMAAoJ
+EOyZ7iZ+tfYaiusQAKwQ/0q+KTmNg5W1PDCoC7t5KAYFZzJ8HRXIl7sgC4Ji8aPC
+v77LcPrrnRu1X86c095C//SLziRQlYjPUCP0Uc7fILWj799wtwv+hk8qWlT4n/zY
+QJ5xULlRGaDGRRYbWs/Y+EdEjgXvtm0t0ZrEt3C4z3J9FKwTtwmC/WGQumhyZcNN
+RLckCWEJCIpaZO7Dgnjwwrfg2a7t/WrqV/PX/CVNPM3b89K/KMe9NTZqhWThp602
+41d511+LEaxVFIHerEE/PpBL3ve95iyZFKyaR40uREeGEMU4AziODv4GY05NSFTe
+MapgoNwSwot/hteq6O6qGR0xx75Our3Ioeo2jbgfD8Dbv0QnkP2+Q5rIsOJOTH3Y
+Cxgc3zL+v1c6GjYplmQMNzulxsz9Bshd/yJzHrXRKJf7hUPIRt7K88Ynm+ta2dZn
+OwxHMtlkzbgOWegmPL+I+dqAJnNCcR3u203ee9JnmbDgft/BYNagagmGPZLVjLxa
+E5vzRXsJWbDLzQm7S0iX3rITbN8+9S09Ay3+Dh+VDSxea6sds+fFDXLjA84S2Oia
+vCr+rwKKFmELVryPtyTMwKN7TIcBLYvEavmuDXEgiFVrTo9zuD9abzFVsukYUmrr
+RhplyEYU+XWCp51Nbk3gFX2eZwIU5OQBLUNHE5pVzNVvxuIpAnzMMmLxhfTj
+=+Xpk
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub   rsa2048/1AD84DFF 2011-06-16
+      Key fingerprint = B9E8 213A EFB8 61AF 35A4  1F2C 995E 3522 1AD8 4DFF
+      uid               Daniel Ruggeri (http://home.apache.org/~druggeri/) <druggeri@apache.org>
+      uid               Daniel Ruggeri <DRuggeri@primary.net>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQENBE36jjEBCADLvVAeRbmk/cChq8p9TvCPI+Q5FGOUlrD2YQ3c2kZLY8ktzH3L
+c4PsOxVv/xIm4TymaMt4A0uujSV9EOp7go2NYLWZQ3eSUVKS0U+4QwQRG6QKDlnG
+M+VH4Ayz38FCzi/jiXrHuWgiU7kkoYQzbC48XmhRh+e+80aOYpeHa/rNMR0vp7+K
+iDwUJCq/e+3NQVSkkbYliBE3SjuSoIMUtaGeORB73zn7DqmH5ZLPbWKcbcsjzW0N
+1ih8g5wqVzvlE52V1/UhT3DEY/7ZXuDX+Ox/Sg4DhtJLPnDfV1Oq4iIPB4Rlso6O
+XufC636gdFhUXAAJ0xGctuC0xcZ2ddQJLrrrABEBAAG0JURhbmllbCBSdWdnZXJp
+IDxEUnVnZ2VyaUBwcmltYXJ5Lm5ldD6JATwEEwECACYCGyMGCwkIBwMCBBUCCAME
+FgIDAQIeAQIXgAUCVtsDSgUJEkZ2mQAKCRCZXjUiGthN/wo1B/9n+yDlliJTYPI1
+EV+WHnS6BEnOc4iYbqU9D7VFbrNc879LUODcpNHd80R0Bmlq9v3jYNCkWMbf3gFW
+4KHQNtD2Ha0EAT9O3hCgUglXrGaVLNWsHsVCfe4WalFAs3HQR1uPda2k7WCRneq6
+LWia9lAO0qU6RMEG7IqSXeNVKUGxA04dZUs7VqNgcJilRu5kHJrvE7E/XWBuOpwU
+74CCt72m00we0nnLjsI2YPvNCQxh30S9hVwyfp+b5n+PeT4kvfffSJLty0SO2k1S
+aC/IeEucCLYuJix9VDNa0VjD9aEtaeTRqDyytuYiv4rmepMJlNvNqm+rBPU5AIpy
+iAPmu3FXiQE8BBMBAgAmBQJN+o4xAhsjBQkJZgGABgsJCAcDAgQVAggDBBYCAwEC
+HgECF4AACgkQmV41IhrYTf9qVwf/Z5t/AiOJS+M7w02RXYLvkX200Bn+03cUD2Q+
+YSld9ygrvTsf4AW5Raemzs/2meAMuB4BsQVt2Fq4XBojYQ/feV93zHk3Zg+50E3d
+sOhyw0NaMNuiWLCD5rLEFor7dqjahZkE+QgPLePPCA52bAbHaSujIInRDbjg9Fkx
+I7kuyXycvPWgV4KWwQwrb2ub1p2xfIIZ75b9HxM31Le+LAX64tIPd5SbXG6KQlDn
+cvhwsA0TJLzEeFBEgovYVdfvIPzJqCvQ/fxmc7qNbO4//63UIfpnDQqMNYyD3tLY
+8FtIIb8zEUC7D04lTF9ikzXW0zeV7VUI2SDPpfV10NkEGnjmookCHAQQAQIABgUC
+VzV50AAKCRBdR2xh/7CPzUKjD/9OD5Psbdz6ZXfXcnxp8luX7I4XNoiH7EELNzy6
+2FHVmfseQ+y2UqfZFQ8XZhu7cd6BJ3zoGndymzMLxmXWYTWYz4hQc403xt/7osKx
+kJYTXfTqXXbyoRB0hhLH1pMgfwEo1WhYaf35jykL3+5i0C8WBqmh/Z8868gx1UZO
+FJuNwjL9O4X9ZXF3EsR4Fiyh2uaY4cidvRspFdA451CjwW09fS1tc/x4IOXMiCEn
+xt4ZA6LEBk4WZkOTL0Dts3m22e2uebE4TC/56E2ldeHxoePDNwHGVQNPU9GyNSbM
+gdzdNVJAnrhDQMRA8aETRdcKXPaUKZA7fmyF6R3tB2XuKyhr6f6Knrcv3Myl6V1C
+5A3oUYP2KKkZXKp06v3H4ymYk9FKrHupA8aY/YvNmjyrP2aV02psPUEncxTIxXqi
+eekfLDHyfP7/Zbndcu2ozWpatBp8moKqwH4qawMQBu20leTmUe/3R+QCwnAiK693
+sOpC4O+NK+YJrdqY3D9mhX57N0DDNeTCYnKbSxONQWUl/dBOXkn3hMpT8PWuLiO3
+fbA6+gAT3Zr2boXQD5PibsbclP40T9Us3ftvBLSbTySiRmLsx/m3T3sYB8p+8HGd
+QITFy/Bnd5tsIwjaBrCPPgDA0rdfb/Qe9JN3IHOb46yHOi2BkBUgFX6ellVl/dUW
+eTkz24kCHAQTAQgABgUCVzV3RAAKCRD/H0B8DTwkMNvVD/wMQIqGlXSCC+XjK22W
+SXXNNU3fgrIlL/OvmRjSjzJtQN07FfPowbVEA66Xl/xR0yaW6TdxSOfz8qgYJizi
+JgAQMIQRF3AjrjWgSqnjG8v15KGe2zrAgkjhhfXR6cmte4YDyJqhNjWEuFSsJ942
+51ltC/EwMZ3yEoL53m+cCWfJgL5Jhm3xHBxZjbuDzM2Haw4LidO8a149exCVYQUm
+AB0WBBELUAzHkedNW4Yv7bfIvPDUCJupnXHc4qZgB0gF3HZi3H9V3jzMl96VajWX
+WQ7jNupsER8Ot5gFAndz1JSR8NOJFhY3lqfnJPnALpRVwWA7O1kSAPhk8zAsFfzX
+y2zOV/IRao4LLG0r30ypYNPo3Q6Zu/j9Rnd3HB7kQphoxlBV05ZvotQFQhopXpc5
+lpGS8Hm1YcwnvV8qqPQ0Ki4SfHe4eEckb0W8FHuFktsAw9y/+U6moRtIJDru9t2N
+zC2RqToom2/7/UhNUE2dy7RuUDgvlDRBQ2HUxMXYIJw6mBPiyb2pRtRj+A9TNAHh
+qJjcAxz+JSTWIvGtW/CC+JRBGSq5XhCFZh5g55RwBeWwJi7E8y2nH1MM6e8zBY7T
+3L+HOAE/rzTlYmYQ2BANt3tvJm5hQOEDhr1gx74TPORsjox+/AlRaF7mo3Gc17wC
+5bejV99CgsXfS9H6Q5C2QzQkZYkCHAQQAQIABgUCVziWfQAKCRDtOHP10yYnIuOS
+EACfImSRxVG4QX9qzQ67hQ48orCs3FJHhaoTm9/wpkZkw3UwNGIC9uJsAW8HIVHq
+WILG3dFZgs+AK3kqGxJLE1gy7Vf08BnSqTlV1mXfdnqntfOQGRwz9SbXrWy71NLy
+Qa5+/vIZEa+IIMuRcDoxT46TJCG1OUF/cwU+9/qlV9FYcFptCpc+govLlDcbLzK8
+PGohUrTtGW37H6pOkfok3uoOt9YSyautOLZB9SSN1O1PpBXKYlNJc5lE/V/F83B7
+1r938FMskv0R4DdjKcItm+oZaVZJvigWtcQvQc15LP00dEDmUF69LQq6proJ3uTB
+PfLkGxVvmbOgsZRfS+Ck6YMfeak3QrPIrK9TumMMpL+Xb+gL3ptfUussGg14vwOi
+nTiCQarxAe8Gt2+8sFMZ3R6HCUcUZDjleOpT5OR1bQzsKJp4HyajHwIxwvaAXgP3
+C/frK7QOSx98QEeDlYaVbVLuxzLomNupxf47fh5mEG+jTyTeeDa7NRXmJNktPvD5
+Wnf97czFO6giesIIbMbCSt7vBG3UY4UpbBZMZbOBZIbG5N+RUPfZuC54SDR5KBWd
+X9sdUklIFacmuBvkXzxOhfhRssNCZA9FeB5k9t/NnfUD8TfTbQ8+Di7f0+ISWzfm
+glFVT7EhzacyoJ+lUAdU02lNu/FsvGeFBJ+gQdsnmy6OEIkBIgQQAQIADAUCV7kO
+xgUDABJ1AAAKCRCXELibyletfDaqCAC8nznqKPG2Gstyt4rgaTJNp1uCtRqapqTk
+ZHwos534/N4HGndX0Q/FwnKQUxlKevobUNUvjcUKVhgVFdMtYra6rHbbMFVQCS0T
+05lXpwZEXIXWUD4A4q0+8rjGi1lMAzPfl9A02MrltTlZj+d6N1aPL/7MOYkf7ToS
+vx03FxPXT+n//GW7pKrNL2eRi0Ohp/l67Z1OxSP6GnJUUYtj/iWZk4D9hgpuz9EE
+rn+OBA58bJqaxxiVMUl8hIM4soLP3Sn3/IdWx0709l8mGmQoAQf9admARvrvXyRk
+PCzgiU7rGaBeBG6W57moK34aw95KBxXxm7HHmCdBOjZzsKY0u8HtiQEiBBABAgAM
+BQJXuQ7jBQMAEnUAAAoJEJcQuJvKV618FzoIAJgZgVs2hyUsp1JnwXDA1FQf2gAz
+Mudj76m0zvTWop7asGfDH6JXFdejvU9T4gqKM51x51gWMC5wu9hv84HVTS5Xpbg1
+NbyUdZw99rcAJW4yR4Rs6uBNgg5V5IajS5Ej8advG6EKjXQMxsDWiorHinJMlO0F
+CwerN8+gAUBcPpOvkP+C37jyIN6NW6bwNatshENgsYPnMz1H3A3Wa0YUuraWejmC
+B+FmXOUYbzHJ1gGSzYkPrnsJUuIG4g8/fuapeAVrlg15iR+3ZR4EVdsvjBoryaxY
+Xb+HhNFPSpMo7DkAw2f/QmivlMf9FH0yd3XaLcimz5gyjqROd13SAADiURCJASIE
+EAECAAwFAlfb32UFAwASdQAACgkQlxC4m8pXrXwwzggAy1oiSzfhakoz7HNhrOSK
+stREvzBnWPryJFbjTUDguG8en/KPrJS+eutpDxbkJ2uCNvRMr8mt0VGVjGjOEB56
+4cyzDTfxjWxuTUzGiffh6Sr7pHNUp/GMGX9TZWucyWgTKHys5UxcHpLang5ua1IC
+Bm4VZiZi+CUNgBqt8n7rZiNE1nEwB9tXOGU/YBiicqjvrR6XN+mhiqjE/6h5VGVf
+lY2uIxt2XS3/v2Paegmlq45XNbCN1gWp9URQ62X7wS22sG1aiekI5H1CAoegR6LZ
+Cpgs3DZUzJVUVAiQMuhJ6Ok/G5WUkOOLL9sD/wKqNX2qV8qgdLPlBNYiA7FDgQfu
+QYkBIgQQAQIADAUCV+0C/wUDABJ1AAAKCRCXELibyletfA+nCACR+OywI/TYh7RR
+Zh5yV9V0784KAlyv+ybQ3EUnXu15d3hYB9X47UI6c/f5sLGO254fzFvVrfkFNZ5R
+PxbGL7mC6N0IozmnEJoQEyV0XWz3dnbVghqo+lbIBzvRH5jeSjR7uME8cBZAbBb7
+uQOCTmPvLV0rsEoeZPtNBfs4744WwonM0304ox2DH/72Kxwff0nsCl7fgTN3f8YT
+Hz7hkqnGPDNnmf9cELAFz1TWzH6j4S1gsFSYCxxSNtDLRUkNUhVUhClWM5mV5NUz
+DPkhEUh28RJmFChQp/s62jF6zfU50AqwAAiLemdyA9jXlSrGsuGCzZLiNJSqJ3ms
+WP6KglueiQEiBBABAgAMBQJX/iaRBQMAEnUAAAoJEJcQuJvKV618XpUIAK9PahDY
+xZt0pG6Zby+KA1aRfkW3baa/0NWal8W41s3CsJ1B9znayheB+6PEoVOr/pADbQxX
+IRGUbdaAZ2qTGDBcJ40fItfuSfwEvkKkqhsDabE/ZBzxhDiO7r6T5raI0P8gnmox
+QYjHOaqmzFN4nMbBZpi2y3K6QqfC5ufHZ35E6JmVkzrcBMVd42IUTEZ2a29B75am
+WNUZQtxrtLhV0GAE28bCQzhvJQiQO9Cpcc30o2zoBfWeJYErKp3BSMojzPaEbHts
+vGqiiNvn9ogoR1IXDv2KzwTJeipeKExzTGI/PB/0FUyjrpolBro3kzlIR7Ol8OCl
+t2VuBqdOTm26iEWJASIEEAECAAwFAlgP8rYFAwASdQAACgkQlxC4m8pXrXwhjQf9
+FTCiokUb1XT7wmMIl3dPU7KAVW5UgQKzNH5K5ST2if6Q9YDgDvioS7RM8vcyzGuC
+t/GU3F4RcQkbBm8jkFnJC9spgSI+Ft7EkIgTdryeWpivZpIrx+FSyLcFnNzbIV0S
+3Z5O8su7PeAlZ+6UCGIM7LFCvj9f9d2C5+8rIp8/0j8eCG9EQCLluZ0xdJNjm96c
+IXKzzkNUUuoXH8shbakvFqO3iX48DbhKNdv+dskhfK4rQjb3rDZn1lVS5uVt4l2L
+woS259xUTQr27Ym652kdq/+CZrw9inPMmjzJbmBMS6zL9NevdvfEG77XOxp/rdYe
+gh+yMnGPj4kQW7KKpoyEhIkBIgQQAQIADAUCWCG+/gUDABJ1AAAKCRCXELibylet
+fK+8B/94+FXcO/DONjHrGnZ409sjIPAiRUsOCnrcmqDeB8Lio8kx6VHXk5rwN3xb
+UoBYx+p2AOQBP67wLQbwCUcy5fguY+JuuJGdvFlUGO8B8B9z4jLO+NRBf8OkY8Ky
+sR2akBsRGT6aw3VVHCmVyknfotzdDpMzg6TIIqDhuE0TPAqz0KOGJ64dbrc4FMFy
+6UAdHTv+I8BE590WuHOGZi3FAyUwV0mRfi3aC+gTlDNhwG7qEhIdgNrYnDWsQic/
+DSQWM56Toyx0Pv1N0/pa/oEbC/Q2BvcMFjMqGwm6UUkWsh8KxLqyGUsvkjgfvPC1
++Zpc5CkL/EGFiP6mzTydeGWLJhnRiQEiBBABAgAMBQJYMuNeBQMAEnUAAAoJEJcQ
+uJvKV6186HwH/3u7DVkXEf6IZY4d+MzUaDSQpHxq2HCotSwrqJ1QnLLXxPpyPl0D
+5VlwY2P3/+HxP7xrG2QQpL88K1bQSCvc6gwS9U/VBbVtsAgVY9nUCsqcl7KOa1hu
+TrUDJHIepYUd48SCcgnYu9Wbiz7ZXdTcbJMJ3uaVi3Hux3v/YGTDyNjnseQoM+Uv
+lT3yoQ4niGPSnfMclykpdr5X1vnQ8EgW9BlBhoZSki9sxRCzGlIS4+UdT/resy4S
+eFvOiRGJJIdciRfECqiB2ha2xwxN85l2aM/ejzmq67LqDKQHR6SOq5C/Dopkcoim
+CJgdEp52wCQ4r6SjJsTB1cdCzNt5nfe20EOJASIEEAECAAwFAlhVK5MFAwASdQAA
+CgkQlxC4m8pXrXwsPggAwxMlujaxb8dzKOQF7qIO+LH4hIwH0f3hcxiBAdhKy+1t
+w4a/iFeBzrvFYQmakiW/0/5rMXurwzzrlhYCimznNZUN8Iae6XLaZ5s2sU2Bi/Z6
+jzZjza3EcT1XZYnLz3piuREZ4jPR1ZrHQpFkeSxx4gf9sUHYre1N4fyA4tPZeDyt
+Ohd0/paAmak1a6LiBZElFs3ZE7lWH/W0utviT/iO6BPMwrar/iFt97KM5YPxVhpR
+33ugRxeato2zddLFURnf2rdZZHp+C2A5oJUAKSFqKmh8EPDCh2bQhnDlhdMcktRg
+1vkBoB6FJmUQxvk6Q51nEFTIrX6us8yuKzls1gm72YkBIgQQAQIADAUCWGb1oQUD
+ABJ1AAAKCRCXELibyletfJDLCACZX0uwMOKAIvBvTF/yhsvVFhDQjPHtNLTk+/5R
+SdaeOKYweh6Hy1JN/RpjJ6+2N+sjj+1+0rkWVHnZ8ApeOelGFgj/C+Xw9D7yhuYb
+KHZlKgEcLofaQKJ+hwon0TuJEYY4EcXgCLESPGpHRa35z8eFlkvfh+msTTgAs6H5
+AbTIU6cxNJOZDH34R2NYuAHfjiMeBVH7iP76QqLjJPWclq7O7dkz5s4bjd2o7Pjf
+GsOx3Ea6jKqf9Z4TqgTgEjIs/bLipMmiDUXJ8N0Dz7UUjTASsWReCpp3ldDjy3Pu
+5dk+7B8CDtPd1iSK+FoKVSxqbItgTkrbXW3ScXTdOHBPxQVniQEiBBABAgAMBQJY
+eMHsBQMAEnUAAAoJEJcQuJvKV618PJYH/RWpJgwmAZROizAqyqaEXjQqeBUYhdAi
+UQ6nN7xDcR1CMyZmfRbZwQ7FZmfHhVdu7ywTRHmIRboN1qiYHIV/tphPr+WMdIhc
+xYZaAgJQVKM9LuwK459jHlDMZmGzMHSdngqM3ivuQKdN7+kghUqzZ2KwrAT+qTyS
+ixBAxWicqJIeRrA8wVlzSFoK7py3Pxe6MsEWSRxg0tSOgfQl17zXnVNmldsg3Ym1
+CHe4rtOz01b0sYT5qtiq6ybgp5D592H80ObDplAYhJwEM5E8X+EYQnfUFE1XkGZh
+c0knY6tizJQwvo26/KQsj3uw4Njd8uzShSERhcDKqfrg+0FA8JtqAYCJASIEEAEC
+AAwFAliJ5XMFAwASdQAACgkQlxC4m8pXrXwJYgf+Jh8nVamv2rDhPl7MHfqZHkus
+I2WHqRL6XY/3VFPL0mzmQm/0dBo8zuq4dYOnHe329BZpQ3oN9krZlWE+37AkHcxg
+alzeyavvDnR1hlgYhoKWAdTNdIvJ+L12LeCKOBHnlfxPe2Zug8wy8VOKUNk4qLNK
+Pd+BhhRvBrE9Djk8hI5zmQl2Lf3Ibvu0A/voF0un5esSd/h3eVJJTLaOuUh3q3FA
+M2jCx8pfa/l7nT4OBmArAQBZg5FSbk12rYXpcSVRGP2sQeKao8AqF10Hvk5Muhfe
+EfPBCJN0yCdNyN5/GgqHnZkhueVS+t07c32/DUdldCoHjtsCrkXdlScsDRH1SIkC
+HAQQAQIABgUCWHRekwAKCRA/kCwnbtm+IaUIEACDez9J+cHghzfWjHsFOMsBgzto
+ZQEjoRhZhQ428yHj2Q83qVmwifF2K8gdb6cjNrgnisJiSgvE6l5swUFWXhszieJp
+RhoE5nHDUVqh0jh7qwvbvM3SLaB8LLFhEq1CufD1u1YoB36dT90b6rXVXzM2i8Kw
+gd9cFDMJX4FEXlYzjMG9hUYv+OwCaL5cfJqS9qEh549igCmAXyJeqTORmCDqq5LQ
+6d6oUb7Cw7guCd3V3cXMxlnfcGDbTJQaMsfhCOHW/tIx46yvBSbJR1IixmnpMnx9
+WxhKUFj7KvYf0UVh0YrGndq0jLIeMZ9ZDIivPEfdAqjHra+uoyl2f39hev4sV2H0
+GbxtjfXfxvkchJhGj8PhjgmS5F8JqSRK515ewKK8Xv2H4W4yKguQkifrf3FgH9ct
+pjU0dLgZSxUITj1OhLP7Grf8E9lRzP0F83Es47n7WZovrb85/xOrUMlHkyOCmeBa
+koXhtXU3gk95h2ESZZH4j52N//o2VxVTQGlrchLu2lUz6IplC9zqHi0I1y+XHIM+
+jPySVmwL202fK8WxKWO3s1DSf4gEStXd3OumjSsg0kUjtFGS3fXzHmD9fkO58Nmn
+9L9tgIv4vysNmZ5JdSWEyxgkU8hZju5qYovnRcX5D1gR5735jblUIpcczG8ZSMBA
+LM23bxCFXoMPPCAGRIkCHAQQAQgABgUCV0NoqAAKCRCU0zajbRWTCq5oEACByjSD
+nsrJRnPjncDNefv7XWINDI+9FgU1DYjFK8J8VZifgXNMlxir/1MhkWanRa1RFXyo
+SMqr2M/H+M5HPw7GHxwrlWkG62ReO3WuRSHS5shYpzQWbwIGx/rvWKJ014Q2qaPC
+B+TQ28iLfEJASguNmcAOUe0adOiG7AX3GSqh68TWYK70Fr9ddV0uyYI2uzCn5mMe
+IoTRxu7wGufN01jzzqPd6MDtdxCxStOq4rMqZLfkAdphWiiF2nqxiMIY7Hte9YeQ
+t+Amx1zRHuPwS988v9JcpNj4e5ZKzpXQoCNW4ujJpx87H/g7BsM6XKBE1LdLJhv8
+evOMmxjhOYuBd1P2Zrl9REn78iPKKvy9H7brFCI40tQ+B9XbXub7OuvqNoGSQjeQ
+J/xqVZW7xnAsmoEL4JCY8u1eD6Tn0dJP3OaQ1lAYt85nbOKtkFREA9UfI68Ac4Qw
+MGjG1bA6d/NawTTT09LLPU40PTTBfeDQCGKS+xxyh4LrVAFuP2x2Mx21tb3TtJzf
+R2KRuLN+iDD8eL3BRKxq75cjm/Tz2hdaNBSrDDu4EXViify2DQoQVd1WexJpQkuN
+aTLzXqEXXwE39szkYurvcWVUXdaQKRkSK8+fe3BiH/PmJShH5QpDexBbyNJdAEMQ
+tMYNSfU/7hvrvW8AzA6Tn16WO7D9nRWwmhRBF4kCHAQQAQoABgUCV0OuvAAKCRBi
+1I+tFqDeAYzVEACv9yu2yGzMsrIYcCgzhCi2alYMgPqvsLYlId4DFHhemkiZhBkg
+RMrQ336kyuDvSi8bEoJlXwfaLDcpSUxPOD0m/LveIvOF1z5clCMx+uR4MPzf8+5p
+d2EYeH8RG/x20ELvoH/1gYtAo+iUqJPW2owibBbyVgXlLS1L5zT9NFgPj5qi1D8U
+6v9NPjdv3NGd5hJvFXv0lBeiuO+4UA18csLwhTr9eJqbe3NJqAkKeMIB8vnUXG9U
+h6UmaX+dzniLhI4OYnIenzyps69VLGUF0VvCMJC7cSr514pyKkhskpSNtYiA5Opg
+pXWwtZp1URm1RcDK1spgVrF7V9DgcpsoHRWByp2S5vRWkspmn0nZ+3+XQ+r9SbYF
+Ljz1dT/3TmnIz35a3bf/yegzwXNZOJlSuSjGidZVzAQ7jT+HRGpoYkURyN3mvDwW
+B5qOi9TcVIUtuOhuywLuIY+9Oh3VwoLE56p6MtNanJRQ6Zrf3vXz7h5AwN4epRb9
+SOTNPsS3GtbX4bbI9Z3gMD0QuwdP0PnlkQkdQFNLNJ949nJcQWX4/GJqs7b3Zy1W
+UZd4bFyqGTv0ejcMYUhXjIFjOPb2tmnNk2XtLZbIdo6Y0965HadcZUin+AwzolkH
+zlUBxTa+RkDS/l0pbrBMmIoyrcixF+nAmk1SOCPACHV1IP8Hn9NhavlZXIkBIgQQ
+AQIADAUCWJqFqAUDABJ1AAAKCRCXELibyletfK3UB/9/Ao8Bv1srj96NF6YoPhcq
+TzQ//XZyBhhCo9CgqQeTtHH/FfGs3eZMkVDLKeX+mSBa+wNN6vb/6FVpQPvLa4RX
+fxynTbyx6F5CUousMBqx1vXSR/wxn1AKAO4Zwr/QjpZDUgQQHcotzo2q94aG0i/C
+IqfDzm15tCO1PKewGtVBagHI0kjvO0722b7iJ61MtwnN0Ig3nd1YFRuPQiyAzhTM
+2miEpOUV/IP3i07yjHrPOjrvoZqMPU3/3+qCRztY9o9TYSu30DY2/06pd84QIAfx
+44yrAz4lXJAHYF89Cf22gf5s1Pu6ucyLptwP+1XVraGXABXi9JEaBgrW3nqz+YTX
+iQEiBBABAgAMBQJYrCxBBQMAEnUAAAoJEJcQuJvKV618OcIIAKdIKjMWCjQ9cG99
+HnQ204RTCLugt3WRXB29dfYaQYAZn0X3ZWOyWnLfe0VhSBhG94Ww5I1FyE5aBWUn
+F1+osKkNqTOTUpiRA85KX8OOalgLHByhGm12Dz2aMHZnAJJnaaJji6O3KE+TwQRT
+FLSn0NJBUyQuNlH2//s/UCXwciOnj723icoEZnlalNuWh+4Bm69euHZnKRNWd2pP
+9WOail89C89IWiTLGt3KNJy3bDnlwnaQr6mi0Tfv06F1HqKw5eo1UPpwAL1h6+cq
+R15EIzfdT5iFcS1NWWBqErirTjm7LTMZaQXB3uwr019RjA7MW0VolOBo1oAJgh8A
+8pWPrL6JASEEEAECAAwFAljPG7QFAwASdQAACgkQlxC4m8pXrXxOPgf4ldwkCFIh
+OPqt5kR+WQ/waVv8h17W/r9zsB4qUaNQYtP8BuG2HV4zxMqGlfOj74QHhfWRz3Vn
+MpMKhRCbaMp5w7ajbhMC6NmK+47eWO7ize9kwasqTlnB2jfefzEdNETC5EZ4Yfnv
+T1mfdz+9o/BsnTmSo+mi8BhmgOc71+e4DxuDxZJOx4hUBFbR49A89wK24y9LGuwX
+dS6/eITIjIuIoo3z58jzLIYaJpnl6JHsUKWuw/NqSbFZEgevUddP3u+yoXyJ21N/
+m6YdO5CdJNNnY4bNgokE3QTLGesK/S+b3mkcAwQJgmAK6QnbsNnWA3xR26YWsMye
+qhdRpdIYVmBUiQIcBBABAgAGBQJZHXjvAAoJEAqdr2cTuGNJMUsQAK4yxvZPh0fp
+URgdTYH6z9/INZNP0A0ZtV29pDnCFU4p2W7qW+OqjfzpX+umT1OiundHdfSxp0hn
+pSezrX8mezN5dC6Pshu1HLE2K4RBOuIacL/VFCASseuT5Wwc9JljDw+P6qnozR7T
+rbrpDcPkLjGk7EJ8KK8yUXcya6pwk2dVvCB245RSF+U7LJDRQeadnI8qkwW7O2Xf
+cR7BLpz6Zto05KCA13tERVkeCher5Jpx/PSPUh0Nxxj5mDcv1HwOQ+fNkJXkalUi
+JW9rugjdAAlXYWfvT65J74gAxhA21Www99Vy50ixPNAgYPrVnbhvTkDO2xSbAWwf
+vDK73VnFqAXip0mkiF7xX/GOErNb2MzZKK77vi+J+JZgdPcsJUeVvqKnCQT9xhTL
+LMMqa2kkK+Ha8HqAuvuA3uGP4jLdjisOBoyeBy/VSPMNjcOyxeraJOYebLwZLgtg
+z2YQHI7gX+8fdphl+vhI2j7dQwJbHtQOYbe9VoKFq3Cq2NPTIrRxTQW8I5f34zvD
+12EsfATnoThTeg2vdsrBX5CcPXgg0bAJSBod5tJco8riVWCQpJlvrF67oxH1ZOJA
+LEffg9eEdvnJXcpEib86vpwNkvzwLdgCAxXDhcbExKxAD9TrwOa004IgldNV99q5
+7Tte0yaqwZkAkV43KLevNxxqiN/KeDa6iQIcBBABCAAGBQJZG5lsAAoJEOQDLcTv
+DPOK+9cQAIBrQecI5SWNnu/TzMuGXMoO1twetkHB0sjtDiz0vx+oco8Lvykfucrb
++nkIU7kjLwnMlTblCLbHd8qqVaY6ogoBjzMddVDG5gNYzK5Prbf2fZve6vRUL08+
+w9BcRSVI7Eroq7GHekaegQrRZk9HfNMxhCZ9hCV/N7ZgiT6wQ0yaF+uWrcxxg8X3
+gm22zxjVF6ZcKydAA/a571MB6BG0hSynW7bUQfRlFSdlComOcDNZDfHZBFW0p+ZS
+qlPT1r0WFpKn/uTltOvUftZ+XZ/6nmOtkXfu6wpkXgAvqsOdVlxoMz5iYlnU5z/W
+jYTPo3eK5iyQ5upvYi6wx7nWNzXaw9KJ80MlbomAGGwuaXox6ZZuwnDikUnCeXP4
+03ANHArUGeZsD5+kN2n892qyzTojkXklns1REpSA85+ffYgPZCih1599LdtKBgqK
+WvBu/r3l0pUUWOyrkpkWFZhgi1+Xqd4VLydr+JniNsuLj2Iyl78K6R1B9Kjdzmvq
+DyJWetzwjv+cpRjYpae0WxnjW+sTiXqB7xANR+QSqd1T9cxG5C0ws0cb1nRK82rW
+3rbRZdCB7piHPmcvX3iiUnlW0fyOAkdaqymFpfVkkoBO6Af7snmFMx78NECN+pIN
+wmVKucGeLVeB0UkBHuCAieCepr310cpsLpWSuyppE8SpZlNB1chNiQIcBBABCAAG
+BQJZHJMXAAoJED+q0s1ey7MUsEQP/inrCUSi3Bg4ZwGq9nndSrHCDoRBqGKBejN4
+sFWRRMK1neL+zILcbjZPLDhkPy2o/cd0cvJcUIssuCPfnJWXjeOb7wuGeXiXJhqQ
+R5BxOzJ7/Zxa9/XZK2LwEFzxknGav8xRCG0FIEKCA9oFTnyFes6me7bVHq0DBYP6
+7DjF6N0qQaZT2YwILZFCB43M14ZxOEyVzG0P3pv49Lw7OIQJggmnpOkN2RG2upzD
+wvHbQDXb8HD5JyOTkw4VCSFu1MBNtkYjwy+XM5MGfOpecqV/xZbY4sB40qc5DHbT
+FmMniTTH9N/EcSf4RdZOklShqIdZmC9g43Yoz5/Du3uFOlmQE/af6vitbKMcLkop
+jtnDwubKKYJR7HeWnFmiHoV/aD81u5h4H3KQwhr4kWsywwI1+yC2OokYWYIJdjp7
+P+qtv9IA5y8HDbhpHEUMrZIv6edVPoK+iEbkC7FpkYTBM4J+ERgHdGxtFBppPbaK
+ISbsoJz2Z0rsAE7OpaTcOdLZ0em8MTAsxlefZcyOWXhptqbUC+/p92yzMrAdFp4K
+x+rzZm3E7netwZe61o8yw+HUEu96oFxWR001eGwVBt5MjAbw564mjzsv8+7fXASA
+iPuLoHVZA7RoOnhp9XG4fM4K8aFpdKzNfFsH9G/ygbF/IQUulf1RYAHpraRRtz4p
+NeqP96htiQIcBBABCgAGBQJZG6jVAAoJEG8M2ucAtomd+r8P/2VpqAh1ajLRP2fv
+mQnLb7keFv8io5KDlx/HOrqmiQ3ZYKOCjJvFYv0G1VwdassGEWEGqjt5W13YfHhS
+YpSQp6Z9GN98ohOBES6NSfVkAjmoplOb6unPlMYcceAvDyei3f1Es7njiUjj/f3I
+5R6Tq2j+wuySva3t7MrDqMWQi+LUvDWACj1n9yJtMHz3vceC7xo/7S7/ca+ubsHE
+ueBr/MKvVH28H26Hej9/wzGYyocuq7OVtTMzfwAre2DK6UJq08WWJoqZjikpYfqF
+dW5ZkFrXznyGJQ6Nmh+A3uvlTFXOI9QAlLZfsaYnIOHb+H8rmUuM1rsFMv9OJzwL
+13cjwdpc0g2OcBFV3/omuVHol/UaF9cApfQJewV3MazKokb6y/doq02h+mc/W95N
+i9RMVTSvSpOKmkdzunTWfh8lhkG0oZt5xobCGDxd2QrdO5/zmVYCQyXo0VGCOQjO
+h+nzuyFBvyl6eXtWM/LIeMw/nzMXkxENdgpCbJgR5V/IqmXr0pneOB8MH5yI86za
+t9arS4+t72Z3XEyEIglGZgms/PvRBrMR/3HCsUy8aSN2qNkIPzpT+5lPqJJ+ba+V
+i5g47r6bH6IMDsOs9jKCQuMOCGWNZHKJIwdUnulJP9tGxAfnQse63kK/cHiXep5X
+T0tQISnVYTsR3XHKcqLWAESiMPsDiQIcBBABCgAGBQJZHipqAAoJEKKrCB8mUY/u
+RGEP/3KC5ZV9b3t3e1xQLH9Sh/RXosBHHeoAI3Q9Se290xpcpK5WaeZbd0sx8MXe
+PpL7Y5luoc5rv/F5C07r2XIq8JLIQCDVdjjvrf+lJh4gqCid0oWbnVTzNFj5ocZ3
+mPCE0q2/3UchohlIx6/sGpKffpYt3Oc5NR6LWllukrbazBi64s/x8OliC833IhrN
+xsreuUn/vl5SiALtO/tkb2dKMiJBc7WOJOay+XMviWNgUyoL0vSEeXMKgGqjYjpC
+OhurriVHDDniJ8cGnhGATIoGqhYtUlI2ZTSosrYs2YV12b2Dpt2SJnVoy2fHhZTk
+yoICJmBrVggTpffsD8H/qT6k6Qm15T7oxpKrpuxTugP0VIHALNNCYazbDaNyxXG+
+/sBbhX1JPrgCAy09eG+cimJANrZXJpLa6ToWuGShopM55g6RTTFKV74p2m1SRCEH
+3Pny935AmhQyJLHhjGm+PIlyR8k4GvstzXDi2NIanmDRVw6tgndIHcP4UUYP+4cb
++7tJYBYcnJCvnrM48BK3+aTQD2MjPCUAAa8J6X+D9a/d0HAjhIkZL+Hage08845O
+Tw2c5NdSpLPZiaV+5FEw4nn7s5U3k/bWGC2PFf6OIly5X7gW0rFBnBy6tArMz//u
+txHOXkmVIEbOqxLrXz6LT384/ltMqFqChU+K6LoenFJc5VtgiQIiBBMBCgAMBQJZ
+G5DRBYMHhh+AAAoJEMHtu5ykAP1QZYQP/i+FmF1LIkNY/KQ2njbYcwKcqF5KsHc7
+6IIgw7XGAs08mBZQniQRmfPyG/uRrgWc0vNdKopUZ0bRQmcLAC0fivqE1E5PEsJQ
+wHBLmzVQeqzJ2Muhl3izmT1TSIOCdsPZRHnq3Kq7Zho6uzjsQAek57t604y7eZuh
+5QR5OAMggWWqEFE1YZP7cEdBw3pyfMdG6Y+rhivON1dK+DVxVQ229NFMOSIEKRl4
+fR5TosbaoXHZqs6TQC7d7jOoT4DxVtzC4sZqc6hcDJuR6pyekLG1W3Z1xViJw4WI
+1xRo2NpPnVGd1ZIQVvqYCj3wj/fnADGyuSJvv5eYRpQqX6nsHc2fosdZsYFBF01V
+/eHjJ936HM3I1sEqGbNIk7DwtA0/GPTG82PKRj07kTytrOKfqMbuuXTuglPcg6Rr
+pMCboQ3VcJEEP28w9f2KmPNy20CWU78DkPH3RjJMyTz6/3lN+RMyRM7PpqoCPH7P
+IKTJmGq4jk10j54opV9bwnQEWThQv+Xp7eUQRAxOdF7tkOtMKSqPL3U+d0jCSKou
+aithN+REwBA8Z5i9jJkbsmKZ9YMRFPRRxnfp9c3fvE+OUEFxUBIpRuDW3jizzFqt
+eN+wrCw5dDjx5uaROSNOl8fSRcu/KaqvT0izzTekHeHt5IyOK0ewyz0gwWpm0bbO
+qN6H7HdMsX2JiQEcBBABCAAGBQJZKDh7AAoJEAPClpScF1DFnh8H/2Nd7MCANmdY
+ME1r7xBxIPaTFeKag74TzYjYmSLjmsOuhjyqgbEGC7yoGgdb/zjoZhxAaNAGqYRY
+xQQ1r+Em1iu7RBHRa+9CjQmcJdE94mJf06G2s/M1/wFg3AnXzSedtkf+fkgCkCtD
+p/4hAfI6brrVcsi7ExAaTG3UVGyqGmRfD3GqZx+ljLFcQWGxmJ5rFtHfIkbyyxvH
+CJ7zxfhbETBX1SBpLS5eqffxpikmhbt1jtmFujjlrv68gIWJ4M52fsM2qb8SwLTW
+dPDulCS5c3f7Lvj/gYgBFHW96r05HQVyZTWaxBTWQuOP+1ZcXD7uwqs7tnkdOwmh
+ptKAtFTRTWqJAhwEEAEKAAYFAlkojKwACgkQnEn0IUcIVRjqMxAAnQk5LSR4/HlE
+wir0QjRIL4mtfL8m43gbuLRgZ6zvpi53t+VhmaDyzweAPeRBSVQ4KHHvXEQyjgjm
+lOrGg90NSAde3h5TSx19+pcApNGzQcTKbB6opK1NvCWf7DHeCcix9zgesSpEAwST
+rTn9SG92Om9fZojNKhXJA4VD/hb2fyXZhs4LgNs0Rg3WkksYKrWdIlynx/MzoFDC
+oukpXKMsnwZclwhAbyhQ63tG6l2cgmMUo+leyORsX6yUiCrtz7eR2lTo4U2ELE1Q
+F+0pTKH+bEQv62T6FsbuRqzZEjjtrR8ECaTVRqJPFT72OBW6dhWgJ5djC2JKR26O
+z1SmWgEWSald7jQZ+JTvS06zJ0KicPBPJjd+iIpgjhnZgSZaj7iB7wR9/Xftye32
+dHgyHmdFpxuqjJqSC7zsIPieBrzkaoQaH95z6E6pApfo6Iecw0SltDKe2BkK37/Q
+jYfH43j5IUuo7YaUkrkLx5wfRSmnqd25tP914jxI76HvlJr4fqkMkhQguwSsImS0
+1ZTpvA7zAzgkIJFTinTyTOx797fjuA94PYLQcGSY8RkMG4E1ZXUQ/wyKzNntey7X
+4xf6v1FWqwFm4FZ+yYw7GY5m04HXDBvDwRmUOGGO/MjLjKhWu4z8KRCUE/0oJ5rx
+bN287GzZAZK9gDaPVFKqWHiOrcc5TSaJAiIEEwEKAAwFAlkk9CMFgweGH4AACgkQ
+A+K/Hg+1K8buiw/9F7/xI70mxSBN9SzOCB5Twz0rikBWxzZnDOvUW8SUh/VrRVas
+C1nJ8Mv74eVu7df0qNi4SuVtuftzIfcdmn0VYdkWKhZJ9wDkUeE7/2rTu0sJtMyM
+MKw7/AyMprDFKJxVHfuVckv4u1Lt5v2JuFpvLsQ3qLFshefYbuZ49vtKjgJeYclF
+a5BUFY3J2nUrXoyzAxkEpu+05TRJ18tqWW+SYL6UntJLJxQL1pPDnz8/BW5AJVoW
+aGGVKS908IGYwFvtDZIkR/OO/4cqenANos2oRMvo7IveaS4gBwEuU73vJySBzHW5
+UAbJX41KGqp6uVjOCL6DcsDxHVgXhago+9jgc3OUo+1oT5eUviX7k4ru3St0HGhX
+a9c+Xp6D5g6Z1OLqQmRpGqQO1oR4Af04wh6dKiNhbFnd9oP3kmQqzGZOVp2YJsvT
+EbCZmLa3bX/Il8wy0hgMD53jhO38ZXJuH6vJYVLT7/0u1YoGRcAw1DhwslTzPjMo
+EK2X4+rzytN5KOivDznP9qy1vGJbpNc8DLcO6zMbAlSdmXvamqjbO6u8RWOeyViu
+KTU7ek9pzlrMqwYm4/Z3X/NfcbzWJmJmgLpeASNcKUuks3cIOx2uWrVBTFiI+JYL
+Q4FiFPKyBeAignGpHLateWULJSq8PztTNhQnndD9Qxb9cLUVuhdjMAPltZrR/wAA
+SCD/AABIGwEQAAEBAAAAAAAAAAAAAAAA/9j/4AAQSkZJRgABAgEBLAEsAAD/4Q10
+RXhpZgAATU0AKgAAAAgACgEPAAIAAAASAAAAhgEQAAIAAAAMAAAAmAESAAMAAAAB
+AAEAAAEaAAUAAAABAAAApAEbAAUAAAABAAAArAEoAAMAAAABAAIAAAExAAIAAAAU
+AAAAtAEyAAIAAAAUAAAAyAITAAMAAAABAAIAAIdpAAQAAAABAAAA3AAAAxROSUtP
+TiBDT1JQT1JBVElPTgBOSUtPTiBEMzAwUwAAAAEsAAAAAQAAASwAAAABQWRvYmUg
+UGhvdG9zaG9wIDcuMAAyMDE2OjAzOjA1IDEwOjM2OjE4AAAmgpoABQAAAAEAAAKq
+gp0ABQAAAAEAAAKyiCIAAwAAAAEAAQAAiCcAAwAAAAEAyAAAkAAABwAAAAQwMjIx
+kAMAAgAAABQAAAK6kAQAAgAAABQAAALOkQEABwAAAAQBAgMAkQIABQAAAAEAAALi
+kgQACgAAAAEAAALqkgUABQAAAAEAAALykgcAAwAAAAEAAgAAkggAAwAAAAEAAAAA
+kgkAAwAAAAEADQAAkgoABQAAAAEAAAL6kpAAAgAAAAM3NQAAkpEAAgAAAAM3NQAA
+kpIAAgAAAAM3NQAAoAAABwAAAAQwMTAwoAEAAwAAAAEAAQAAoAIABAAAAAEAAABW
+oAMABAAAAAEAAACAohcAAwAAAAEAAgAAowAABwAAAAEDAAAAowEABwAAAAEBAAAA
+owIABwAAAAgAAAMCpAEAAwAAAAEAAAAApAIAAwAAAAEAAQAApAMAAwAAAAEAAAAA
+pAQABQAAAAEAAAMKpAUAAwAAAAEAaQAApAYAAwAAAAEAAAAApAcAAwAAAAEAAAAA
+pAgAAwAAAAEAAAAApAkAAwAAAAEAAAAApAoAAwAAAAEAAAAApAwAAwAAAAEAAAAA
+6h0ACQAAAAEAAAAAAAAAAAAAAAoAAAnEAAAAOAAAAAoyMDEyOjAzOjI0IDA5OjE0
+OjQ5ADIwMTI6MDM6MjQgMDk6MTQ6NDkAAAAAAQAAAAEAAAAAAAAABgAAAB4AAAAK
+AAACvAAAAAoAAgACAAEBAgAAAAEAAAABAAAABgEDAAMAAAABAAYAAAEaAAUAAAAB
+AAADYgEbAAUAAAABAAADagEoAAMAAAABAAIAAAIBAAQAAAABAAADcgICAAQAAAAB
+AAAJ+gAAAAAAAABIAAAAAQAAAEgAAAAB/9j/4AAQSkZJRgABAgEASABIAAD/7QAM
+QWRvYmVfQ00AAf/uAA5BZG9iZQBkgAAAAAH/2wCEAAwICAgJCAwJCQwRCwoLERUP
+DAwPFRgTExUTExgRDAwMDAwMEQwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwB
+DQsLDQ4NEA4OEBQODg4UFA4ODg4UEQwMDAwMEREMDAwMDAwRDAwMDAwMDAwMDAwM
+DAwMDAwMDAwMDAwMDAwMDP/AABEIAIAAVgMBIgACEQEDEQH/3QAEAAb/xAE/AAAB
+BQEBAQEBAQAAAAAAAAADAAECBAUGBwgJCgsBAAEFAQEBAQEBAAAAAAAAAAEAAgME
+BQYHCAkKCxAAAQQBAwIEAgUHBggFAwwzAQACEQMEIRIxBUFRYRMicYEyBhSRobFC
+IyQVUsFiMzRygtFDByWSU/Dh8WNzNRaisoMmRJNUZEXCo3Q2F9JV4mXys4TD03Xj
+80YnlKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vY3R1dnd4eXp7fH1+f3EQACAgEC
+BAQDBAUGBwcGBTUBAAIRAyExEgRBUWFxIhMFMoGRFKGxQiPBUtHwMyRi4XKCkkNT
+FWNzNPElBhaisoMHJjXC0kSTVKMXZEVVNnRl4vKzhMPTdePzRpSkhbSVxNTk9KW1
+xdXl9VZmdoaWprbG1ub2JzdHV2d3h5ent8f/2gAMAwEAAhEDEQA/AOtlPKilKjXs
+pUS5NKzerdf6b0pv6zZNpEtpZq8/+Q/tJKdFz4Ud64PO+vmfaSMStmOzsT73f9L2
+qh/zo64XT9rfqdOB/BLVNPpm9LeuBwvrp1Spw+0BuTX3Dhtd/nsXT9K+sXT+pxWx
+xqyCP5l+hP8AUd9F6Sqdfem3qMpShamW8pKBOoSSU//Q6uUlGU6jXuL9aevjo2EB
+VBy75bSD2H51v9leZ3W5GTY621xe5+rnuOpP9Zb314yDk/WA0gy2hrKwPAn3v/6p
+aGL9WsQ0M9SZIBJ+KbKYjv1ZIQMnj2sdOvEaBGbU8gDw4Xb0/VLpz2aOcJ81Zq+p
+uFuHvO0c6IDKCu9kjq8AK7QRDTr28kSux9LwdQRqDwRHgvTG/VHp2hbOniqXWPqd
+hPxn2VSx7QSI8UePwR7fij+rHWrM+g0ZJnIpAh3dzfF38tbi88+rt9mH12mt7oaX
+bD20d7dV6EixkKJ1CSY/SCSCqf/R6hOoylOmqjXvm/1laXfWm8Dk2MGn9Vq6ug/o
+2jwAWRm4Ys+td2SSLKX1iyst1iA2v3f1XIWf1XLqs21Wsx6xo0OAcXR+cocgMiAG
+xi9INvX4Za5u2dVdr9phcH0z6xZbsgMsfXY0mAWDaumOdbXV9oa5r2kQGyJlNojQ
+sgIkLBejqnbqqnVX+nh2u8Gklc7ifW7qN73VVY9ToMSbFs15Ts3HczKqNTi2Hxq2
+D+cHKTos6vntNM9cxXs5NrTHkTK9CJ1XEYOI+r6zjFMkU3O1Pg0bmrtZTmE7qJ9w
+SUSfcEkkP//S6aVDIYbKLa2mC9jmg+ZCknlRsgNG3lsBhFewumwAbieRMqvl9L3W
+m0MBdwDPbwWjkUNoyro+k4yR5fm/9UpCwFsKqbBb1CRvvq4VfSSLRuaGiDx2B5hd
+aem05HTsfZLRUNuyfadNvvWFdlU0PFlphvA0mSuhweq4LsRkP+lDQAJ1PwTgSTqq
+UQBoHFp+q9H2hrn0vD2SGuZrAOnYrbxemnHoNLPVfOm6wwBP0p1Vuq9rrHVuG1ze
+QrTyAyB4J248mMiuwvs47ekYOJbk9RxqW2ZcucdzjoDH6NrW/R9oRidUYVek+7IA
+htrWyPFw03KvKdG2PLwgADfe1fnJJvzkk5if/9PpAU6hKeVGvavUqK3477do9Rg0
+fGsA6iVz2RlGmh1gBMcBdW4BzS12oIgjyK5XPrOJe+q36HIJ4LezlFkjsWxgnQIt
+yXWZWdDXEMb2LiFsdPx8vHktvr9OQateTEO7fSVB9eLTY3Krx2vg6vboQtTA69jZ
+JbS3Ge/WA0agGUBVaaBlNdTq26s6/Ju3MLXWVNJZZWdzSW/Tqe5vs9y3w47Qe5Eq
+s19DNuOxrWOa3dsboAERj/UcGD4u+CIWk9GFt73tFZ0a0n5oUoRzcSzMuxWWt+0V
+Oh9R0cPzvon6SnKfWzXkbJX/ADklGfckgh//1OhlPKiCko7XspWB9bcSy/GD6jD4
+LQfMe9q3pXOda67Q/qbejVQ9zWufe/8AdcB7Km/yv9IgdQa6arobgd9PteX6f1R9
+Vn2bK0aNHNd4rbxeq4GIwurLWOBJBaOZ4lU7ekjNsnYCR+cQr2J9WMBsG2ve7wJM
+fcmHhOuzOOMaaHxK/R8zN6j1P7TSCag0tseZieB/aXZ4lQrr/lH6RKz8HGqpaK6m
+BjW8BogKp1/rgprPT8N/6d4i6wf4Np5b/wAa9GEZZJCMBqUEiETKRcPrdVOX9YH9
+Rx3loraGktP0nM9rXLpMPIGTi13AyXN939YaP/6S5eoAMgCPJaHRs+qh78W9wYHu
+3Vk8SfpNWjn5XgwREfVKG5/evdoxzcWQk6CTuTqkoyks1sv/1d6VS6l1vp3S9v2y
+3a5+rWNG50fvR+6iZ2djYGM/KyXba2feT2Y3+U5eX9Tz7up592ZcTDyS1vO1g+gz
++y1NhDi32XSlT0HVvrrlZYdX04HGxhp6p/nH/D/RNXNYWYaep1ZDySC+Hk8nf7XH
+/pIdVptYQ/2smGR2QbGGTPbupTEcNAaFaJG76h9B6df6VrmkgsPE9itUX1DUu0C5
+nBsNuLTfqC9gn4jQp+oZzqmejSf0juT+6FTjjlOQjEWW6ZxjHiOzf6v9ZLgTiYB2
+k6WW9x5N/lLLxhA11MySeST3Kq49Ue48+PmtCpsLa5bBHFGh8x+aTm5sxyHXboEo
+gR5rOtudfmH0xLK/a09ifznK3lWllW1ph7/a0+H7zv7Kz7ngbaKPpN0kefKmmWKI
+dFnVrhgWYpduYYa0zq33D2/1UlmM2+hY0HuJd2mQkofbhvwjfj/w/lZOI9/6v0f/
+1uY+tXWv2jlmml04tB21/wAp359n/kFi7QGR3dyokkannspMPt1UwAAoLSeqNzYa
+GjQBScJGvPdSjci4+BmZz7G4VRtdQwvsIjQfP6TkTQFlTbq6z9l6bTSwS4AgvHIM
+n2tWcOpZAuFgjaNNh1kfynfvIJa52pM/FSbT4psYmPy6dSepXSlxfNrWgehwcinJ
+qD6jxo5p5B81er5XLY9tuLYLK+e47Efulbf7QYcN+RWdY2hvcOOkK9iy2PVpIBry
+hrp1XyLhY6ws12exg8/zv+kqhPpQyv3XP5PhKGx5poB/Odwog202tA/nHQT5T2QM
+rr+W6QG96DPspo/P5B80k3rEmRyOT5pJ9R/Dh+iNf2v/2f/tD9JQaG90b3Nob3Ag
+My4wADhCSU0EJQAAAAAAEAAAAAAAAAAAAAAAAAAAAAA4QklNA+0AAAAAABABLAAA
+AAEAAQEsAAAAAQABOEJJTQQmAAAAAAAOAAAAAAAAAAAAAD+AAAA4QklNBA0AAAAA
+AAQAAAAeOEJJTQQZAAAAAAAEAAAAHjhCSU0D8wAAAAAACQAAAAAAAAAAAQA4QklN
+BAoAAAAAAAEAADhCSU0nEAAAAAAACgABAAAAAAAAAAE4QklNA/UAAAAAAEgAL2Zm
+AAEAbGZmAAYAAAAAAAEAL2ZmAAEAoZmaAAYAAAAAAAEAMgAAAAEAWgAAAAYAAAAA
+AAEANQAAAAEALQAAAAYAAAAAAAE4QklNA/gAAAAAAHAAAP//////////////////
+//////////8D6AAAAAD/////////////////////////////A+gAAAAA////////
+/////////////////////wPoAAAAAP////////////////////////////8D6AAA
+OEJJTQQIAAAAAAAQAAAAAQAAAkAAAAJAAAAAADhCSU0EHgAAAAAABAAAAAA4QklN
+BBoAAAAAA2UAAAAGAAAAAAAAAAAAAACAAAAAVgAAABgAUAByAG8AZgBpAGwAZQAg
+ACgAcgBlAHMAaQB6AGUAZAApACAALQAgAHQAaQBuAHkAAAABAAAAAAAAAAAAAAAA
+AAAAAAAAAAEAAAAAAAAAAAAAAFYAAACAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAA
+AAAAAAAAAAAAAAAAEAAAAAEAAAAAAABudWxsAAAAAgAAAAZib3VuZHNPYmpjAAAA
+AQAAAAAAAFJjdDEAAAAEAAAAAFRvcCBsb25nAAAAAAAAAABMZWZ0bG9uZwAAAAAA
+AAAAQnRvbWxvbmcAAACAAAAAAFJnaHRsb25nAAAAVgAAAAZzbGljZXNWbExzAAAA
+AU9iamMAAAABAAAAAAAFc2xpY2UAAAASAAAAB3NsaWNlSURsb25nAAAAAAAAAAdn
+cm91cElEbG9uZwAAAAAAAAAGb3JpZ2luZW51bQAAAAxFU2xpY2VPcmlnaW4AAAAN
+YXV0b0dlbmVyYXRlZAAAAABUeXBlZW51bQAAAApFU2xpY2VUeXBlAAAAAEltZyAA
+AAAGYm91bmRzT2JqYwAAAAEAAAAAAABSY3QxAAAABAAAAABUb3AgbG9uZwAAAAAA
+AAAATGVmdGxvbmcAAAAAAAAAAEJ0b21sb25nAAAAgAAAAABSZ2h0bG9uZwAAAFYA
+AAADdXJsVEVYVAAAAAEAAAAAAABudWxsVEVYVAAAAAEAAAAAAABNc2dlVEVYVAAA
+AAEAAAAAAAZhbHRUYWdURVhUAAAAAQAAAAAADmNlbGxUZXh0SXNIVE1MYm9vbAEA
+AAAIY2VsbFRleHRURVhUAAAAAQAAAAAACWhvcnpBbGlnbmVudW0AAAAPRVNsaWNl
+SG9yekFsaWduAAAAB2RlZmF1bHQAAAAJdmVydEFsaWduZW51bQAAAA9FU2xpY2VW
+ZXJ0QWxpZ24AAAAHZGVmYXVsdAAAAAtiZ0NvbG9yVHlwZWVudW0AAAARRVNsaWNl
+QkdDb2xvclR5cGUAAAAATm9uZQAAAAl0b3BPdXRzZXRsb25nAAAAAAAAAApsZWZ0
+T3V0c2V0bG9uZwAAAAAAAAAMYm90dG9tT3V0c2V0bG9uZwAAAAAAAAALcmlnaHRP
+dXRzZXRsb25nAAAAAAA4QklNBBQAAAAAAAQAAAABOEJJTQQMAAAAAAoWAAAAAQAA
+AFYAAACAAAABBAAAggAAAAn6ABgAAf/Y/+AAEEpGSUYAAQIBAEgASAAA/+0ADEFk
+b2JlX0NNAAH/7gAOQWRvYmUAZIAAAAAB/9sAhAAMCAgICQgMCQkMEQsKCxEVDwwM
+DxUYExMVExMYEQwMDAwMDBEMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMAQ0L
+Cw0ODRAODhAUDg4OFBQODg4OFBEMDAwMDBERDAwMDAwMEQwMDAwMDAwMDAwMDAwM
+DAwMDAwMDAwMDAwMDAz/wAARCACAAFYDASIAAhEBAxEB/90ABAAG/8QBPwAAAQUB
+AQEBAQEAAAAAAAAAAwABAgQFBgcICQoLAQABBQEBAQEBAQAAAAAAAAABAAIDBAUG
+BwgJCgsQAAEEAQMCBAIFBwYIBQMMMwEAAhEDBCESMQVBUWETInGBMgYUkaGxQiMk
+FVLBYjM0coLRQwclklPw4fFjczUWorKDJkSTVGRFwqN0NhfSVeJl8rOEw9N14/NG
+J5SkhbSVxNTk9KW1xdXl9VZmdoaWprbG1ub2N0dXZ3eHl6e3x9fn9xEAAgIBAgQE
+AwQFBgcHBgU1AQACEQMhMRIEQVFhcSITBTKBkRShsUIjwVLR8DMkYuFygpJDUxVj
+czTxJQYWorKDByY1wtJEk1SjF2RFVTZ0ZeLys4TD03Xj80aUpIW0lcTU5PSltcXV
+5fVWZnaGlqa2xtbm9ic3R1dnd4eXp7fH/9oADAMBAAIRAxEAPwDrZTyopSo17KVE
+uTSs3q3X+m9Kb+s2TaRLaWavP/kP7SSnRc+FHeuDzvr5n2kjErZjs7E+93/S9qof
+86OuF0/a36nTgfwS1TT6ZvS3rgcL66dUqcPtAbk19w4bXf57F0/SvrF0/qcVscas
+gj+ZfoT/AFHfRekqnX3pt6jKUoWplvKSgTqEklP/0OrlJRlOo17i/Wnr46NhAVQc
+u+W0g9h+db/ZXmd1uRk2OttcXufq57jqT/WW99eMg5P1gNIMtoaysDwJ97/+qWhi
+/VrENDPUmSASfimymI79WSEDJ49rHTrxGgRm1PIA8OF29P1S6c9mjnCfNWavqbhb
+h7ztHOiAygrvZI6vACu0EQ069vJErsfS8HUEag8ER4L0xv1R6doWzp4ql1j6nYT8
+Z9lUse0EiPFHj8Ee34o/qx1qzPoNGSZyKQId3c3xd/LW4vPPq7fZh9dpre6Gl2w9
+tHe3VehIsZCidQkmP0gkgqn/0eoTqMpTpqo175v9ZWl31pvA5NjBp/VauroP6No8
+AFkZuGLPrXdkkiyl9YsrLdYgNr939VyFn9Vy6rNtVrMesaNDgHF0fnKHIDIgBsYv
+SDb1+GWubtnVXa/aYXB9M+sWW7IDLH12NJgFg2rpjnW11faGua9pEBsiZTaI0LIC
+JCwXo6p26qp1V/p4drvBpJXO4n1u6je91VWPU6DEmxbNeU7Nx3MyqjU4th8atg/n
+Byk6LOr57TTPXMV7OTa0x5EyvQidVxGDiPq+s4xTJFNztT4NG5q7WU5hO6ifcElE
+n3BJJD//0umlQyGGyi2tpgvY5oPmQpJ5UbIDRt5bAYRXsLpsAG4nkTKr5fS91ptD
+AXcAz28Fo5FDaMq6PpOMkeX5v/VKQsBbCqmwW9Qkb76uFX0ki0bmhog8dgeYXWnp
+tOR07H2S0VDbsn2nTb71hXZVNDxZaYbwNJkrocHquC7EZD/pQ0ACdT8E4Ek6qlEA
+aBxafqvR9oa59Lw9khrmawDp2K28Xppx6DSz1XzpusMAT9KdVbqva6x1bhtc3kK0
+8gMgeCduPJjIrsL7OO3pGDiW5PUcaltmXLnHc46Ax+ja1v0faEYnVGFXpPuyAIba
+1sjxcNNyrynRtjy8IAA33tX5ySb85JOYn//T6QFOoSnlRr2r1Kit+O+3aPUYNHxr
+AOolc9kZRpodYATHAXVuAc0tdqCII8iuVz6ziXvqt+hyCeC3s5RZI7FsYJ0CLcl1
+mVnQ1xDG9i4hbHT8fLx5Lb6/TkGrXkxDu30lQfXi02Nyq8dr4Or26ELUwOvY2SW0
+txnv1gNGoBlAVWmgZTXU6turOvybtzC11lTSWWVnc0lv06nub7Pct8OO0HuRKrNf
+Qzbjsa1jmt3bG6ABEY/1HBg+LvgiFpPRhbe97RWdGtJ+aFKEc3EszLsVlrftFTof
+UdHD876J+kpyn1s15GyV/wA5JRn3JIIf/9ToZTyogpKO17KVgfW3Esvxg+ow+C0H
+zHvat6VznWuu0P6m3o1UPc1rn3v/AHXAeypv8r/SIHUGumq6G4HfT7Xl+n9UfVZ9
+mytGjRzXeK28XquBiMLqy1jgSQWjmeJVO3pIzbJ2AkfnEK9ifVjAbBtr3u8CTH3J
+h4TrszjjGmh8Sv0fMzeo9T+00gmoNLbHmYngf2l2eJUK6/5R+kSs/BxqqWiupgY1
+vAaICqdf64Kaz0/Df+neIusH+DaeW/8AGvRhGWSQjAalBIhEykXD63VTl/WB/Ucd
+5aK2hpLT9JzPa1y6TDyBk4tdwMlzfd/WGj/+kuXqADIAjyWh0bPqoe/FvcGB7t1Z
+PEn6TVo5+V4MERH1Shuf3r3aMc3FkJOgk7k6pKMpLNbL/9XelUupdb6d0vb9st2u
+fq1jRudH70fuomdnY2BjPysl22tn3k9mN/lOXl/U8+7qefdmXEw8ktbztYPoM/st
+TYQ4t9l0pU9B1b665WWHV9OBxsYaeqf5x/w/0TVzWFmGnqdWQ8kgvh5PJ3+1x/6S
+HVabWEP9rJhkdkGxhkz27qUxHDQGhWiRu+ofQenX+la5pILDxPYrVF9Q1LtAuZwb
+Dbi036gvYJ+I0KfqGc6pno0n9I7k/uhU445TkIxFlumcYx4js3+r/WS4E4mAdpOl
+lvceTf5Sy8YQNdTMknkk9yquPVHuPPj5rQqbC2uWwRxRofMfmk5ubMch126BKIEe
+azrbnX5h9MSyv2tPYn85yt5VpZVtaYe/2tPh+87+ys+54G2ij6TdJHnyppliiHRZ
+1a4YFmKXbmGGtM6t9w9v9VJZjNvoWNB7iXdpkJKH24b8I34/8P5WTiPf+r9H/9bm
+PrV1r9o5ZppdOLQdtf8AKd+fZ/5BYu0Bkd3cqJJGp57KTD7dVMAAKC0nqjc2Gho0
+AUnCRrz3Uo3IuPgZmc+xuFUbXUML7CI0Hz+k5E0BZU26us/Zem00sEuAILxyDJ9r
+VnDqWQLhYI2jTYdZH8p37yCWudqTPxUm0+KbGJj8unUnqV0pcXza1oHocHIpyag+
+o8aOaeQfNXq+Vy2Pbbi2CyvnuOxH7pW3+0GHDfkVnWNob3DjpCvYstj1aSAa8oa6
+dV8i4WOsLNdnsYPP87/pKoT6UMr91z+T4ShseaaAfzncKINtNrQP5x0E+U9kDK6/
+lukBvegz7KaPz+QfNJN6xJkcjk+aSfUfw4fojX9r/9k4QklNBCEAAAAAAFUAAAAB
+AQAAAA8AQQBkAG8AYgBlACAAUABoAG8AdABvAHMAaABvAHAAAAATAEEAZABvAGIA
+ZQAgAFAAaABvAHQAbwBzAGgAbwBwACAANwAuADAAAAABADhCSU0EBgAAAAAABwAD
+AAAAAQEA/+ESSGh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8APD94cGFja2V0
+IGJlZ2luPSfvu78nIGlkPSdXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQnPz4KPD9h
+ZG9iZS14YXAtZmlsdGVycyBlc2M9IkNSIj8+Cjx4OnhhcG1ldGEgeG1sbnM6eD0n
+YWRvYmU6bnM6bWV0YS8nIHg6eGFwdGs9J1hNUCB0b29sa2l0IDIuOC4yLTMzLCBm
+cmFtZXdvcmsgMS41Jz4KPHJkZjpSREYgeG1sbnM6cmRmPSdodHRwOi8vd3d3Lncz
+Lm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjJyB4bWxuczppWD0naHR0cDov
+L25zLmFkb2JlLmNvbS9pWC8xLjAvJz4KCiA8cmRmOkRlc2NyaXB0aW9uIGFib3V0
+PSd1dWlkOmUxZjZmZGE5LWUyZWYtMTFlNS1hYzQ3LWRkYTJjNDYwZjdlYScKICB4
+bWxuczp4YXBNTT0naHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyc+CiAg
+PHhhcE1NOkRvY3VtZW50SUQ+YWRvYmU6ZG9jaWQ6cGhvdG9zaG9wOmUxZjZmZGEy
+LWUyZWYtMTFlNS1hYzQ3LWRkYTJjNDYwZjdlYTwveGFwTU06RG9jdW1lbnRJRD4K
+IDwvcmRmOkRlc2NyaXB0aW9uPgoKPC9yZGY6UkRGPgo8L3g6eGFwbWV0YT4KICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+IAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAog
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAK
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
+ICAgICAgICAgICAgCjw/eHBhY2tldCBlbmQ9J3cnPz7/4gxYSUNDX1BST0ZJTEUA
+AQEAAAxITGlubwIQAABtbnRyUkdCIFhZWiAHzgACAAkABgAxAABhY3NwTVNGVAAA
+AABJRUMgc1JHQgAAAAAAAAAAAAAAAAAA9tYAAQAAAADTLUhQICAAAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFjcHJ0AAABUAAA
+ADNkZXNjAAABhAAAAGx3dHB0AAAB8AAAABRia3B0AAACBAAAABRyWFlaAAACGAAA
+ABRnWFlaAAACLAAAABRiWFlaAAACQAAAABRkbW5kAAACVAAAAHBkbWRkAAACxAAA
+AIh2dWVkAAADTAAAAIZ2aWV3AAAD1AAAACRsdW1pAAAD+AAAABRtZWFzAAAEDAAA
+ACR0ZWNoAAAEMAAAAAxyVFJDAAAEPAAACAxnVFJDAAAEPAAACAxiVFJDAAAEPAAA
+CAx0ZXh0AAAAAENvcHlyaWdodCAoYykgMTk5OCBIZXdsZXR0LVBhY2thcmQgQ29t
+cGFueQAAZGVzYwAAAAAAAAASc1JHQiBJRUM2MTk2Ni0yLjEAAAAAAAAAAAAAABJz
+UkdCIElFQzYxOTY2LTIuMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAWFlaIAAAAAAAAPNRAAEAAAABFsxYWVogAAAAAAAA
+AAAAAAAAAAAAAFhZWiAAAAAAAABvogAAOPUAAAOQWFlaIAAAAAAAAGKZAAC3hQAA
+GNpYWVogAAAAAAAAJKAAAA+EAAC2z2Rlc2MAAAAAAAAAFklFQyBodHRwOi8vd3d3
+LmllYy5jaAAAAAAAAAAAAAAAFklFQyBodHRwOi8vd3d3LmllYy5jaAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABkZXNjAAAAAAAA
+AC5JRUMgNjE5NjYtMi4xIERlZmF1bHQgUkdCIGNvbG91ciBzcGFjZSAtIHNSR0IA
+AAAAAAAAAAAAAC5JRUMgNjE5NjYtMi4xIERlZmF1bHQgUkdCIGNvbG91ciBzcGFj
+ZSAtIHNSR0IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZGVzYwAAAAAAAAAsUmVmZXJl
+bmNlIFZpZXdpbmcgQ29uZGl0aW9uIGluIElFQzYxOTY2LTIuMQAAAAAAAAAAAAAA
+LFJlZmVyZW5jZSBWaWV3aW5nIENvbmRpdGlvbiBpbiBJRUM2MTk2Ni0yLjEAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAHZpZXcAAAAAABOk/gAUXy4AEM8UAAPtzAAE
+EwsAA1yeAAAAAVhZWiAAAAAAAEwJVgBQAAAAVx/nbWVhcwAAAAAAAAABAAAAAAAA
+AAAAAAAAAAAAAAAAAo8AAAACc2lnIAAAAABDUlQgY3VydgAAAAAAAAQAAAAABQAK
+AA8AFAAZAB4AIwAoAC0AMgA3ADsAQABFAEoATwBUAFkAXgBjAGgAbQByAHcAfACB
+AIYAiwCQAJUAmgCfAKQAqQCuALIAtwC8AMEAxgDLANAA1QDbAOAA5QDrAPAA9gD7
+AQEBBwENARMBGQEfASUBKwEyATgBPgFFAUwBUgFZAWABZwFuAXUBfAGDAYsBkgGa
+AaEBqQGxAbkBwQHJAdEB2QHhAekB8gH6AgMCDAIUAh0CJgIvAjgCQQJLAlQCXQJn
+AnECegKEAo4CmAKiAqwCtgLBAssC1QLgAusC9QMAAwsDFgMhAy0DOANDA08DWgNm
+A3IDfgOKA5YDogOuA7oDxwPTA+AD7AP5BAYEEwQgBC0EOwRIBFUEYwRxBH4EjASa
+BKgEtgTEBNME4QTwBP4FDQUcBSsFOgVJBVgFZwV3BYYFlgWmBbUFxQXVBeUF9gYG
+BhYGJwY3BkgGWQZqBnsGjAadBq8GwAbRBuMG9QcHBxkHKwc9B08HYQd0B4YHmQes
+B78H0gflB/gICwgfCDIIRghaCG4IggiWCKoIvgjSCOcI+wkQCSUJOglPCWQJeQmP
+CaQJugnPCeUJ+woRCicKPQpUCmoKgQqYCq4KxQrcCvMLCwsiCzkLUQtpC4ALmAuw
+C8gL4Qv5DBIMKgxDDFwMdQyODKcMwAzZDPMNDQ0mDUANWg10DY4NqQ3DDd4N+A4T
+Di4OSQ5kDn8Omw62DtIO7g8JDyUPQQ9eD3oPlg+zD88P7BAJECYQQxBhEH4QmxC5
+ENcQ9RETETERTxFtEYwRqhHJEegSBxImEkUSZBKEEqMSwxLjEwMTIxNDE2MTgxOk
+E8UT5RQGFCcUSRRqFIsUrRTOFPAVEhU0FVYVeBWbFb0V4BYDFiYWSRZsFo8WshbW
+FvoXHRdBF2UXiReuF9IX9xgbGEAYZRiKGK8Y1Rj6GSAZRRlrGZEZtxndGgQaKhpR
+GncanhrFGuwbFBs7G2MbihuyG9ocAhwqHFIcexyjHMwc9R0eHUcdcB2ZHcMd7B4W
+HkAeah6UHr4e6R8THz4faR+UH78f6iAVIEEgbCCYIMQg8CEcIUghdSGhIc4h+yIn
+IlUigiKvIt0jCiM4I2YjlCPCI/AkHyRNJHwkqyTaJQklOCVoJZclxyX3JicmVyaH
+Jrcm6CcYJ0kneierJ9woDSg/KHEooijUKQYpOClrKZ0p0CoCKjUqaCqbKs8rAis2
+K2krnSvRLAUsOSxuLKIs1y0MLUEtdi2rLeEuFi5MLoIuty7uLyQvWi+RL8cv/jA1
+MGwwpDDbMRIxSjGCMbox8jIqMmMymzLUMw0zRjN/M7gz8TQrNGU0njTYNRM1TTWH
+NcI1/TY3NnI2rjbpNyQ3YDecN9c4FDhQOIw4yDkFOUI5fzm8Ofk6Njp0OrI67zst
+O2s7qjvoPCc8ZTykPOM9Ij1hPaE94D4gPmA+oD7gPyE/YT+iP+JAI0BkQKZA50Ep
+QWpBrEHuQjBCckK1QvdDOkN9Q8BEA0RHRIpEzkUSRVVFmkXeRiJGZ0arRvBHNUd7
+R8BIBUhLSJFI10kdSWNJqUnwSjdKfUrESwxLU0uaS+JMKkxyTLpNAk1KTZNN3E4l
+Tm5Ot08AT0lPk0/dUCdQcVC7UQZRUFGbUeZSMVJ8UsdTE1NfU6pT9lRCVI9U21Uo
+VXVVwlYPVlxWqVb3V0RXklfgWC9YfVjLWRpZaVm4WgdaVlqmWvVbRVuVW+VcNVyG
+XNZdJ114XcleGl5sXr1fD19hX7NgBWBXYKpg/GFPYaJh9WJJYpxi8GNDY5dj62RA
+ZJRk6WU9ZZJl52Y9ZpJm6Gc9Z5Nn6Wg/aJZo7GlDaZpp8WpIap9q92tPa6dr/2xX
+bK9tCG1gbbluEm5rbsRvHm94b9FwK3CGcOBxOnGVcfByS3KmcwFzXXO4dBR0cHTM
+dSh1hXXhdj52m3b4d1Z3s3gReG54zHkqeYl553pGeqV7BHtje8J8IXyBfOF9QX2h
+fgF+Yn7CfyN/hH/lgEeAqIEKgWuBzYIwgpKC9INXg7qEHYSAhOOFR4Wrhg6GcobX
+hzuHn4gEiGmIzokziZmJ/opkisqLMIuWi/yMY4zKjTGNmI3/jmaOzo82j56QBpBu
+kNaRP5GokhGSepLjk02TtpQglIqU9JVflcmWNJaflwqXdZfgmEyYuJkkmZCZ/Jpo
+mtWbQpuvnByciZz3nWSd0p5Anq6fHZ+Ln/qgaaDYoUehtqImopajBqN2o+akVqTH
+pTilqaYapoum/adup+CoUqjEqTepqaocqo+rAqt1q+msXKzQrUStuK4trqGvFq+L
+sACwdbDqsWCx1rJLssKzOLOutCW0nLUTtYq2AbZ5tvC3aLfguFm40blKucK6O7q1
+uy67p7whvJu9Fb2Pvgq+hL7/v3q/9cBwwOzBZ8Hjwl/C28NYw9TEUcTOxUvFyMZG
+xsPHQce/yD3IvMk6ybnKOMq3yzbLtsw1zLXNNc21zjbOts83z7jQOdC60TzRvtI/
+0sHTRNPG1EnUy9VO1dHWVdbY11zX4Nhk2OjZbNnx2nba+9uA3AXcit0Q3ZbeHN6i
+3ynfr+A24L3hROHM4lPi2+Nj4+vkc+T85YTmDeaW5x/nqegy6LzpRunQ6lvq5etw
+6/vshu0R7ZzuKO6070DvzPBY8OXxcvH/8ozzGfOn9DT0wvVQ9d72bfb794r4Gfio
++Tj5x/pX+uf7d/wH/Jj9Kf26/kv+3P9t////7gAOQWRvYmUAZAAAAAAB/9sAhAAK
+BwcHCAcKCAgKDwoICg8SDQoKDRIUEBASEBAUEQwMDAwMDBEMDAwMDAwMDAwMDAwM
+DAwMDAwMDAwMDAwMDAwMAQsMDBUTFSIYGCIUDg4OFBQODg4OFBEMDAwMDBERDAwM
+DAwMEQwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAz/wAARCACAAFYDAREAAhEB
+AxEB/90ABAAL/8QBogAAAAcBAQEBAQAAAAAAAAAABAUDAgYBAAcICQoLAQACAgMB
+AQEBAQAAAAAAAAABAAIDBAUGBwgJCgsQAAIBAwMCBAIGBwMEAgYCcwECAxEEAAUh
+EjFBUQYTYSJxgRQykaEHFbFCI8FS0eEzFmLwJHKC8SVDNFOSorJjc8I1RCeTo7M2
+F1RkdMPS4ggmgwkKGBmElEVGpLRW01UoGvLj88TU5PRldYWVpbXF1eX1ZnaGlqa2
+xtbm9jdHV2d3h5ent8fX5/c4SFhoeIiYqLjI2Oj4KTlJWWl5iZmpucnZ6fkqOkpa
+anqKmqq6ytrq+hEAAgIBAgMFBQQFBgQIAwNtAQACEQMEIRIxQQVRE2EiBnGBkTKh
+sfAUwdHhI0IVUmJy8TMkNEOCFpJTJaJjssIHc9I14kSDF1STCAkKGBkmNkUaJ2R0
+VTfyo7PDKCnT4/OElKS0xNTk9GV1hZWltcXV5fVGVmZ2hpamtsbW5vZHV2d3h5en
+t8fX5/c4SFhoeIiYqLjI2Oj4OUlZaXmJmam5ydnp+So6SlpqeoqaqrrK2ur6/9oA
+DAMBAAIRAxEAPwCb1ytsdXFXVxVaWxVYz4Fa5nArueKu54q3zxVrnirXM1xV/9Ca
+1ytsdXFWicVSrWfMel6Ov+lS1nIqtum7n5/yf7LAtMI1D8xNSmJFnEltH2J+NyP9
+l8P/AAuNJS3/ABb5gLVN7Judug/CmNJTGw896vCyi54XMXcMOLf8GmCkMv0fzPpu
+q0jjYxXRG8EmxP8AqN9l8VTeuKHVxVoncYEv/9GZ1ytsdirH/N/mQaHYARUN7cVW
+AH9kD7Uv+xwK8knmubqV5pXLvIas7Ekk/wCthTVrVR679KbDDa0rJC5AA3odsFpp
+eI5lIoh37eI7Y2ilSKSSBwwqpFCD0II/lxS9H8pa7LqNu1vdGtzCAQ3d18W/yxkU
+FkNcCGidxil//9KZVytsdXAryn8wLk3XmQwBqrbokQHgSOb/APEsUhM7TypZG3j9
+SvIqCT7kZinIXMEAmEPkvTHTZnFffCJlTAIuHyLYc1+M8R12yQkWJiE1XyXpnwle
+W3WtN8khLtb8j2D2sksNUkRSQR4jEFBFsL8sXEll5hgikaiFjGewo3w75YeTQe56
+hgQ0T8QxV//TmGVtjq4FeT+a0L+b7kAbmRBt/qrgPJlHmzS3P7pR4AZhOcm1kVZe
+NaHJRUphH8Jp1OTYo+KvHfLA1lB6xJ6VjM/gpJ+7Eq8lghr5gs3TqZlNPYkHJjk0
+y5vTid8WC0n4hir/AP/Ul9cqbHVHfFWA31kJfOM90SJYHjEsbLuAQFj+L/VbK5EE
+bN0IkHcKOo6xewycYpkt4hUKGAYtT9rIRgGyUi7SfM9610qSyRyKTQFBxxlCkwnf
+NlzahLFCLlWWRSKBaitciLbSQgrPzrqc8jQxWsLcTSpk6D5ZZbSQn0V21/bOl5CY
+mKkSBfiWhH2g2KvPdPs3i82i0apEM7bmnRBVcn0aJc3oFcWK0n4hir//1ZbXKmxZ
+coZbaWNTRnRlBHiRgPJlE0QWI6chEXBmrKFHItuRWv8ATMW3Y5NyhrzSOUxmCAvS
+gap6eGETa+BBRaMRMvJQi0NKbUB60yRmoxhmx0qC50y24VVYQF9Ovwt8PH48A5KQ
+k0HlK3+sq0kDh0BCum5AO3UH/hsmJFhKMbut2QWelm2tzCnrSBtuUpoBX7Vd/wDj
+XIgKTamui6fZS3ep2sCyX1WYl2Owan7tVX7PwjJEmkwgCd/4kQT/ALWTDiyFEhZX
+4xixf//WlmVNjdcVYzc26W95cFftMakdqdV/4lmLIbkOwjK4grhKClMg2BAT3cFv
+IJJiVQbA0rU4gWyLKNP1jT3s0Ak3YhFAFfiPyy2PJqINo6G4VpWiYcXU7jCCxI2t
+GSMoSg8MkWtACH0pJ7gCiTKtR/Mw25fdgA3ZmdR/qoeuWOEtr8eBL//XlYOVNjq4
+qgtUt43tpJeAMqAUenxUB3FchMWGzHKixe5u2gt3kUEkdBmNVlzuKhaTtLd6hxVi
+qJXYswH8csAphZknmm215bcitzF6VVMNDsSBRu32sNoopnDqFxdT8o2VpYlJSWM8
+1JX7cTsvwfFgKQf9KyUMeCnuRXJtZKHluHdRGRRVJ6d8IaZy6KNck1rK/HgS/wD/
+0JTXKmxuuKuZVdSrCqsKEexxSwzUYzZ3EkM3931DHoVPRsx5R3cyE7CBkjtIJEu4
+7VXod3TYimAE8mzYb1xJvpvmK1uysC2jyb0CjcA165MmmIkDyDJ1e3TjaxqqMq8v
+TXYAY82slVR/UcRj5t8sVQB1CzkvZ7RJl+swtSSEmjCo5fZP2tj+zlgiatxpHdVr
+ihZX4sCX/9GT1ypsbrirdcUsa86WUlxaK8RpJQqD7g81yB2NtkNwQwjTNXkhk+q3
+Zoo2ZG61xlDqGWPJWxZDZ6xp1mjPGyo4JIKjrXpXIcJLaZhU0O+v9T1b63CCYQpW
+VzXjXoB/rZMig1RPEfJntnCscf8AlH7ROVtjz3XoYLzzLJqdtIUEahCVP2nT4VbN
+nocJkLP0f7twdVMA0PqZXY3QurSKcGpZfi9mGz/8NmLlhwyIZRNi1WvxZSzf/9KT
+A5S2N4q6uKWK695ht31VdDhAdlRpLiT+VwvwRL/lU/vMZx9NssZ9VJFLoy38lfTB
+I/bIyuMqb5RBTGz8paclDLHzbwJNPuriZlRjDKtPtYoEWOFAiLsFUUGQZoLzH5gE
+EbabZPW5cUnkX/daHqo/4tbMzTaY5DZ/u3Hz5hAf02MwqAgAFNumb4CuTqSbTPQ9
+Rht3ktJ3CB25RE9OR2Zc12twkniDkYZgbFP6981TmP8A/9OSVylsS/Vdf0vSeH12
+bgziqxqOTUH7VB+zk4wJQZAML1nz7eXgePTAbW0G3rH+9c+3++ly6GMDcsDJiVhe
+mDVobmQkgvSRj1If4WJ/4LIZBYZYzRD0LTLj0pmUkGM9K9QcwnYJyLiEblhQYFCS
+615pmBNlpx4MdpZh9oDwX/KzN02m49z9DjZ83DsPqSe1Wg3qSTUk9ST3ObyMQBQd
+XI2jhQU98mwSqaZri9PpiqR1VT2J6M2Uk2WwCgj49ZnGnS2jNyQ0VWr8SnkPhr/K
+32coOCPGJdWzjNU//9Q5v9RtdOtXu7p+MSfeT2RR/M2VxiSabCaeP6tqM+q6jPez
+E0kYlUrXig+wg/1VzJAoU1EoWGUzIQ/wR14x07ZKJtBUJIzU17d8hIJZzYSma0gn
+3BkQFvmNjmBIbuwibFt6lqDwx+hA375huf5R4/62ZGn05mbP0NWbNwih9SW20VPi
+PXx983cI0HVyNplCtMtDB13MUh4oaSSfCh8P5m/2OCR2UBLJ3A4W9v8AaXao9/tV
+yqR6BsA6lYnH6tIoPccm7VqMA5J6v//ViPnDXv0nemGBq2duSsdP2m/bk/41TLYR
+oIkbY/xAQju3XJ0xUnWihRsB0GCkrmAK79e+EhU2h1z6ppUECCrgMC46g8j8K+/+
+VmPHELMpN5zERACVDVbkTCQU4jbgd6j/ACm/mzIGaQOzj8LJNPuYLqESRHpsyHqD
+75sMcxIbNEhSYxdctDBL7mcStK0Zr6fwIPf9r/hsgZMgEEW9GkcfxXD/AGj4Vyq6
+2H1M+aK+rp9TNv8A7srUH365Pg9NMb3f/9bl5JA5Hr2+eZDBch+GpwhXU5GuNWhW
+ttOvtQeRbGEzNboXlIpRV+n7Tf5ORnIBkAgSjvuxr7nBSrlg8cIitoi2lltJRLF1
+6MvZh/KcnEmJsMTuyAakhsXuYmo1OIXuHO1PozO8QGNhp4d6S5HMEAP7bdMqB4Qz
+5laDLBMgH961Ca70r2wbg/0l5ph6xJqD8Q6t75fbCn//2YkBPwQTAQgAKQUCVtsP
+xQIbIwUJEkZ2mQcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJleNSIa2E3/
+qzcH/0xVu6Mdd8hfK9D8eet5VweB64YheqrZbjZxGkqDYFxdgDw/zjtBJJZtm2Qg
+bWsKuc4KxiFuQxdh66PMVqs5w9DkruPd013KUQKO/LEN0d7dK2vvyLMJYCqT4Hlt
+tzFKCjQdh2cWB7axYmbqzGfVs/amaKPQUi8xdrQx5NUmJwNyqOTxiqf2vN4hzGg7
+4iV2/hjRHZL7uUjLxXYx6+1udPbNtKkue2ul9IDR+880iA9U9+nhV258Y6VfJmdC
+SoELQaQ8DNJoZVOicqnC8Qb1u6Rue/2bx2uCOhnnpaFP4rmdFYUkauI5/htwO5B2
+9EfJlzXsEYuvRE270JVSAo1oRByJAT8EEwEIACkFAlbbCyUCGyMFCRJGdpkHCwkI
+BwMCAQYVCAIJCgsEFgIDAQIeAQIXgAAKCRCZXjUiGthN/8K0B/9nam8iQ1ZmSlag
+cNgAKpf3Bk5O20nV3XbZ28fYnBp1sh2Gv0dz3IsqRgiPMha+6YqvVYZfA5g8Sp0A
+JAPpSIIWG3R0oz+3NFLjfuiiGJYxjgJA+QONCQhQfX6Esq9igcTjAgNSknXf8opi
+pIniufjnx1mxHGRUXrr+YtbzEUKji0RbKO4xXeCH9GSeT4otqkkKkhx79t4AifOf
+sMNLPCdQACK9ulOecIPeKcwGfN5xLj7qWCwM8Vn6XwysoFZv7G2feiB3JZLmbgmO
+MFlR3Q90d3j2vFW2wEHT23j7xYkNYjwL6bLqjyhPWmqA4FhDdbO2TDnZiaqQF/sR
+lAR02PAEiQIiBBMBCAAMBQJXNXaKBYMHhh+AAAoJEP8fQHwNPCQweyQP/ixm6TzT
+BaBb1/Oy8L9KyTZ5JFq6ZVKcMkOFgzsk5yeA+v/UH2maJ4aB1fR58ijuSGsELTji
+jEVchUta4jyETfR4KtnQXbxnKQqoRMbz7wLENiei0ZO1MIXrmofsiUZQZcefnb4T
+TZqpaRqtYgOuS7MDmufIdVg476TnhecqKre35JKCEtrWWgBqOdCLvNLVjbVrR5sQ
+oVHEkReDDGif9G8Rz5+ciSqlNMn3UjcPDWbmj5CvrzYLkt3bsUwovHQ6I9w1BwjP
+YwRLiR6oqtkHda0M+yCEmwAbcat5s43YAdF9BPOjDNcx0Fb0sOrZPsySQ2IgjNnp
+kc/1SaE9eTWrTOLkHy9tlYznuLjDKLPk0GjNWDV+042uc7iui5aX/6wH3A3yxyB/
+X3n5fxAc3Xr03k8pk7D7bWOFbgRMi1dw2la5gmq87THQ1ZrXGA05d/k8cOM28SQT
+ahe/zmjT4SAvW+W6zNQW2hX98ngmx9ReiW/zzmQBdnISziWc0vvJo3vuaops9DXH
+jvQfrpnwXSOjM1fliPftobeeMr07a6ellDY0sVNlu/thx9xTcyOE/AgWngiTnpOY
+wZ4h9iVhXMI9l8pXFF+/uy5sknJTXEr1m6iFHfmpGi3ADi2ZpOZO1JS+awmmwgAI
+TjawPAwE/BgrRxWMz9gS05Hj/yKo8VY8VWV9iQIcBBABAgAGBQJXOJZ9AAoJEO04
+c/XTJiciR0MQAI+vqI4X8wyVzn4pbYAUyz043Yy/iK+jaky7egLTDR4DUCrzHRuR
+C0Im4daqVJe9Bi1Do3rb8zqddC39Jgeqiu35HnqOln8eXEn/BKgCz3NLDDjcYPHp
+6mQiaFY3BLh1PebKU7dxSsCeXXs1s198i1yz55O+nq1ah1Xia2GA8N45UYiCivSp
+9lu0ZiOUaTG3d4ub6KMizor9DxKfM4NCHYofX3v6ryiuLWhq5a2XnhMmPhfemjcf
+Hey4rtQEleonr7ohCxKu8Z+GpV3M/wdFhClkq9pXvAageUM2xa/d2Cb9NlwLDnh5
+RWi48pQzjFfvG76fjm6vRs0wG4iPSeKjNo34WPF175n4feO9snnfMFAdomWBmUP7
+cNmozymWeG4etOeumeT78x0X2ie3aZ5nkr9rRnXz4jiiX7jQ91+xNjHtebkXtyEz
+9LapwUjeGzgefxhnxYutG1HV2uYULd8Wy8F0p20uEfRtPAuqdtMhQhQB/MqtUlKv
+N5TKRQx4v9FtUNqz8tfCYM8jjytyG9F+G6t6pR/v35V36mtrm8vbCqwBKLgnY89t
+eXN6bBNpJiQiPI0q3zosbUwJ7cAOMEf5NdqpU+LJ2vqTzqLvSyserHpBU9GNVER3
+Y2mtsU9NiQoxQVSgAaz9ORuyD0I3Do6l4YFht/WeZItV0kdooULUvFRQiQIcBBAB
+AgAGBQJYdF6TAAoJED+QLCdu2b4hkpMP/ihBdj2CR95ZU3PuV1DcRtXnNpt/YVZt
+2OB8Kl76dQp+2+9Ci1Di+nVH/Hb2PEi7TDNGgnycWiOcbJfy8N1nwcvbO5jRYRWf
+x+AxbzgLKLB3kVoJG5ostAJ1gLtOXzN+43odS0zCf/7QVx0V91y1DSvQrw3QqY/y
+TujzuYItoodurZGxiy137KF+sZpmnW7kY2fYEqy9Cb3K9BBoltfVjMt0WQl6UoHK
+oB3zHpDE0zYAGWsZDU+1LV+P3+jNYiLisjLPDwp+sExLROqf4iRxehDLszYx1Ztd
+ghNmQtDH06xZuLeewhhW1so4eZoyJaJ+nxjsFoQsm6HO8adqcCDnm0GXpWPgX81r
+12TN0TV0B90V9AU8IGW+WDSWV0nKvU1YTd/1vCpHGtnT8L9fmiLjLi7HkBSydjuv
+mMK7zAg5784EEE6Od37pSkyAbJSoTNYtvA6zQQIS2QAfHmCxO+8H8JdAzR8FBSRe
+i+TWt0n+LPrJEmsDUs3jiEVIbn9jzSSgxa4P176F2t+1C2a91Kaam0AIj/KhHhuo
+dCsZKTeT8S8x91FNLk8tvfdsYrzWT+l0W49wRgdk8VWLskxng30piERZNCsimkax
+uwPRchNRNzomaOB4xNvdc4AW/0SBUYA7E4RruD/AI+vAjVuACs1oJ1NhECasI/xA
+gAv4tvkHpt7diQIcBBABCAAGBQJXQ2ioAAoJEJTTNqNtFZMKLf8P/2yWBCq2CgIE
+5vRZAcRkV8UJM6F7rcSphEH3rgfsU1jobxVPQst4/pacx+5q7LR/heBwhUzC6jT9
+Rwv15FljRFpG0dudXTGervEa/3ZWD7Z4qtJIolPFSOV0ozbu1IZ7POmnQkisNxru
+1uUYjXpUVuiPa0MFVWiy2oVHquY8Y0Gb/CUHPMX/gAETgp+mPsOFjcN1nu30kxHO
+yNw7TRWKigI/iZWDOlZffnZyIGIrvGXor2yTdZntEb2FjiY4K5140cXO2g7WNEu6
+ZkTczUU+eQ0SvOySc3oSOOZbtx4dngsQ41w0oLd6MI7H8zjTk7EM/XqzXdL7vwSw
+tamgVTadw2FSjGdcMyUY8o8zmG3O3wI7SCdEGpBD/E3fg/OHgbXUYDvpejq4bJSO
+b+mjrMoLYd4hD67mpl08bpSG7eUDXRebp7hOQr8lgL8i2peuyVSO8S5ZH+5R0yoC
+iwG3BhHCJ9fC50iKSPv5JNlRfxM2BBzpidA+dQ92KBxREP82AmhEZgJ5OC/rBBJM
+OJGkwr4acf1eiV2Ot4EV3yek3ttVR20C+4PwzqjjvWiIavdRguQAahX2Tq0DTWxd
+E2XroNyoqDazPBmwH5P9gDwn8Nm8FZJRHyuSkUPL4cB9RG3aSWOgCRoaYW+TEW71
+w56J871ENbdxicikBmnOC6Wxrfz0FnO3iQIcBBABCgAGBQJXQ668AAoJEGLUj60W
+oN4BDRwQAIEzBuFGQQxl3OSca76ImRHJc5e2ocIeho9txBjFPHjZuwoAfnaesnNk
+1Rl+Nh0I3LM6QnJUKLCUrnPRxoRFCabU9xtOv4Qsexxj92H21PwiPBWI5ky+uCwc
+LRl69Ranl6ePNmVSz6cSm1S4is5l9Enw2ZIwdJulOrhxAfqD71D861co2Xyp9uvK
+lb/HZ2uQXPtIyBBo/3+DCQxnym76ZJlPF1O4E6++Eqr8X1WMSp/xFKEAxGX6bsDV
+doKuDer9wgwtliKPP/RDXDv/TgsCBcrSKF9ee0EW+AgnEE4cb1qJmfXpHJm7s2PM
+PtMTycGOBZXQohPDNPuyFHku6SRMdu91FsWn3zZzx94Zyss1sj/DqCUG+XzzTzxT
+ULfVsusOIu0JGSy2d+VAnirlm6eJ31/47qlVZBpk0gXcD4Udiilx++OjpNLWZ2ut
+sb+RIQMh1yEFukpCkS7H5yvHs4Oxwnv7I4EOrAo3LJSdCP5vU7M4bzaym43QWdZ3
+53SvNnosgqRdEVGFWGcA1/+3L/QvqHYFTagPcgxmp8pZnvUSDl1xEL/wGNrG7bi7
+NmQKMpAzBkQ4YSu1N5XM3+aBikQGtz/F8j4nZxymO94enQRtYNkX7m3Kayzu88Ku
+ZyrxgqO7U9EUS+Z6hu0ggLPChtxaZbefVfabQw7+XywPNLaZbiQ+iQIcBBABAgAG
+BQJZHXjvAAoJEAqdr2cTuGNJF4gP/2vjd6oJnKpznGiMLZ5vTW+ogc/cVVD2dtvI
+8AtjomA0ix3qhBqOLRaHS66J+PvOH/58SXQPpCHZNQXBv3vD5zKx4J/oHeakTfss
+IjzE7s+BpQpxz5ZtLHKw6Vc3DE1OgszpE7pgmrHUPZnzmXprCQPOgipw3l4igcsc
+MSeAJnXE7tQYD+Pl5op5LqbRbuKe3lYJ3uxZDCiq7SiVf28Z6/WypT9nfkfYd/Hm
+CfzLy5xTPSDsuNVNui5Cgmew0Cf/C8tEUmSLN526Cuy4PFWSHmj9qF2dwRn4kfp2
+54hLRGzZiX0cV/bB4csD99poGkk3Np2d7mOLtgiIJVWSa31hbGXRmF2aVIUr1fuo
+Te5Io3IuDJTYTb2DbOiuOZdvcU7HOfZeI0QhfxYHDMEK9n57rp3CvCmRohovz+hT
+tNSGYXFYzKln6xnZ2FS/o6i/gzAzT9CImJxH/9smAMMtEaeHVAkwBTRxSG+ozRw1
+niWnfgS9hP+ChtilqtjSnFz23Gf0jZxJxaGMPh3v/+D1YefCj7z0bhmRfe2zn+L5
+dUW9yv+jknMlTS+uJsbDdAj5cvkh2P72M0fWqz4iLVEGog5jYfhmIIleX/N3TcBH
+J45znBoTom+j1z5UJ6s4GqVfk4RD9WoeYI6nvHHtNHW9wea4OfDy5uFDOgNUkdE7
+xOffwNBDiQIcBBABCAAGBQJZG5lsAAoJEOQDLcTvDPOKe5sP/2qo26tzH/1JVXwV
+ooIqUWnlv/TXvYm+ZdvP+inIqbh5Wd+UL1q2l0gLKk44AWAVRNWij47tMqjXXq6i
+cD2KH1xvT5z4OworFt/36q0pE7uipTJE6rACTwrhTA/Oc9rmgKw1bE025U4cnAuU
+IgM5QvSQwCzHF5G3N7yEweclY5FFDizx0AYC6OupBywFs0QhMaw0Fb+zZ/2IYW/0
+QxxEEEy19yDZVwq/90bu1YqYYGXNJQrds7j/9X+B1U+Fc0IwugHCRZi4oFR3YEKK
+FL3m8CvEaUJGhIcmJpvxYvLxTxjRXFihTH4i9SEyT+pKs5zclF/yEe5cyk3xhhj6
+Y7AUD7BB04M51QloX5jKZ0R7+qtwV0pvrSmDQf+QCcmbBhdJoUpRcKn7OH8ZxQFt
+T+54dc7M8PdubXr5O31unvXmcZRGex/yBW176h6seEzy+u2G1YHUe99Y56dfcsbV
+qy73gEmTetgYVLArp2js3SbbqZdtcWabtAz4HzEQ+M0zzzgDXpZECh16IpyklYKH
+fGaG7mj82FghcmnOR1GOXIdxs7nldjkgeaT99cw16ODj1QKKwqWX6GJPPRxcsiYT
+HCPtWIief03HAQu4WTRK771725mlp6HWTKvUm8BLIuATrWVdqMIoalHwQys3efJf
+OGJGVHz6zylCjFOq4TsQa8Gju4WMiQIcBBABCAAGBQJZHJMXAAoJED+q0s1ey7MU
+U0MP/2isC7IgIm4si7UpeQcJ1x3iJhGl5XWvk1HtvkO1SjurrFyU9XNSVmFZRRFk
+wZtfiyoEJs6tD7COKOHwwj+CYFtricsc6DSEbqCtk5/Zk6f0yuVCuYBkeE0auZM2
+clwtiJV7Xtqk3VW+hyjaIjro0LmAof+ttJtPlsboV16VIwieVMFv+4T2PTGEkPkg
+VGHV2kuMDjt0x9Jo1RQUb3fMs03na9X0nGtqDt0Grr0lVAx0Igkf95aQ4ii9JnCz
+GkeyxwengUJj7fcLfBwoRTrNnlaWk/GfphgT2IRjMy1hqyi4vopdMn+CyXqggWld
+HZj5RdlVNSM4mmanWowa2uY9fspVDKNpaE4PmN55hdQnKAuDe/HVE4c9KxmKnNVW
+JGvT2cDL+/mS4wNIdV9nQjbJ583XXsijhjFS/0EfA6xkBAdd8/y4Vk4f3bpAAWIy
+VzvhRh3m4BpXzhNvDlfgv1t1s2Meo8izurha6zCqZHsRcQpP/+AjKBjx/v/H/qnx
+8IbQNy8IYmDcqhP+DPQGC+Xdf/TSPm8ODR0ReeXxm5/3UV8Ls6bp0r97jVtWtDUI
+BkqTaDU5xCGGMvxqHWLv5FJnH/cvkVuEiT7jA14YROXhBZubF77Wbfdm/2NTabre
+ug7DST0CrsgHwogx9Td207I9UYSPHp1z0aLIs9jZyVh+/suuiQIcBBABCgAGBQJZ
+G6jVAAoJEG8M2ucAtomd6OMP+waj7f6VlYxOrgFhRTqiG6Va76BQ1fOFD+yU9QOV
+am/KcHhxubarMeNzRQl3Is7XK1a/OTIINOq+cpHfkZK0LvEXxhYkfL3oh5ZVzKHM
+AmdYFoxfehUcAtGzoQVIvg5YLkqeHpxlhoiP8UMDBk4bHXl7NFR3w1cxbrl4Gd8m
+zaIv1Oba+ZnkXjm5K6HL6MLVzthj0N4kvpP/leiDxgjyE4qB71V6dKAVhTnNwep3
+zY0C7Z2h0kB7+indNmukWC+le6zKjmvg3fkM7YDqSlS02Hx/bM3r/81s1jT9aOAH
+j+DVwu7XBQIXISKT9tYwySslc4bCbcAO9Nnn4HhWZ8Y+vEgq+LBGHMLW2hJZqp2c
+d6GrWFlmqb/iQs+h72Tf0Qk03c369vFyIVGG++3wCDr5Nsp5o77lvsgt5/yByAV/
+EB/uhYATX3e/X5IREUhaLBMkGkDY3l4LNYyZ8N2dd7HOG9kdpZuB25YeZ9itboCa
+Id5KCnAINwrA/LcqVjve3sv0l8zzIvhs85YgjTyR7Jc1/9JH7uLWtw4bmH30neX3
+O41/jWxonQhgd5yRQDh/cnqOBvQxXUQTv9y15mySCBZ0brcWwMwTx4AQtTq6k8co
+jOvCGbK2t1Siltcc7nyYOSW0Pbhkxsr91TlBF2UtLpw6qGqD9mxUDCFvYWrj1D2t
+LOYyiQIcBBABCgAGBQJZHipqAAoJEKKrCB8mUY/ulb0QAIq3fUQ5F1sQFEKrz/tC
+vsOb6BeqpOBbZqiCPX5wL/QpFEMJnVmk7Pm51opgHrNm4FE2dPlsotv3WEsSLAmO
+ImTCa0MS1NQvZ9KM3q3xQTKyM7M8gMw7sr8XMc8L9uXGjFWcbUXrD7AFMvZ+bwCL
+Voc/GH63StQJkwVUW3Hv46Jzhi31dBhNhm0hWkcmGYCPsZBX81a/5m6VYD/D+4hf
+gxnPLM9rAjWt1MUvvRyHRTTg7L8gtZKmVcygeTd09l2oh2WM5s43EonfRzx1wOwC
+X5GCkVZyL8z5QheO+O+GzL5OzggVTLbgycNK3iiot+rfiUu7BbV9UbUMDXMlFoLB
+7g40SJh72Wucc8EeqIs8b7P/FYHT5B3uIUpqjlUv4O3q5cXvA3hUi9fzgCo/86Mh
+v1TfJ4lYY+UFwI5SHUbyNt0wbA+wlXj5lA1M70q+U8wlj6bJHd6BmgURkaSQdc1D
+nm3bm3gE9L0BFfVWXrcyyz40pNPYrW9+bxWqU7er9lsn9ZgtyLnwvRmMVhLzL7Mz
+uMA0Tn4AT7+kAZNr+2NgeO297frNY369ZYc+XrD593lg2OqXWDzFcDEOd+1u4t6d
+slXqyzwlq50hKfS3ogzjJoL/8Pihe/6JClgYOb3bPw240Qm5OBKek+XFokK//mTJ
+L7EEqN8pT+ArWRdw/mxbpRaIiQIiBBMBCgAMBQJZG5DRBYMHhh+AAAoJEMHtu5yk
+AP1Qs58P/iVRPCtcnA57rB5E60ZCHg8ZAj16/7I5+NTq67LdaGWpX8KyoL4kiXVH
+VdPdAk45OHpcDGdmBb+UgfgNeCPugBWfL2ZRmw0K6BJtUcz+kDKKqxUtDWiTOgMS
+vDLmW5BtBrebx9dpemZaZGUnu+j+s5aEiMO8ofmQQqXQyteh+QlGk83FLNY04B3Q
+yvxM7poNgU6sEDG857ygOIRbbDh5PMHSstweU1ArMkfs3/cnOWOdHnn0b1Q1SRkA
+w9K1s0cY2HVJjxM/HdcUqFaGRh78PykN5IFXh0A22xha4oJKVNJIhDmPDw0nJwKw
+OjO2ZbxkJN5CsQASym/afsfJ6Ws8ehXP4eV69fixb7suhFdAYLXTL/PJzXJmYBOY
+0Qvem/C4cHpAwrR9iLID7pO/zM4dS9VvAR4hixS6q0+O0wEvnQs3ixvIkykf2KBL
+4C25f19SViRw8/Ys+dhgCTMv3836bIp3MPHqz3ZCe+mVnrY67v6Z0ObvXQ0krCju
+zIpGUT5tKaMsbNqqSWltr8XlMoiWG2RPIB2cX5QZ6R7WTIKcF5hanspvOjf0EtlR
+xWD0iD3k9pOAOTLUA9kb9L5h01s1zFDQ4d3hdOhR4+/7/K+eFS7JF+kX6VoqVGFz
+Sr8Z9WHgFPizbg7mrAdWyGEW2f33pRLJ/E87+XYCC8xWu/5pbHWHiQEcBBABCAAG
+BQJZKDh7AAoJEAPClpScF1DFTyoH/0y1LVfmNqr/Ep2HpHogmCOj4YAAHDC4clnO
+gD+ZcRz2hfKUUkq6Ra364jWhagYG5UQChVjrBMzZcOL8iykvE315CbsYU0Uaanal
+WLub06YisX6ph5CQkkApGXzVtbdX5lJFCSwk4eYha8RLyas709D1Gtx01PQ4aQsC
+2m1dBJEP97ie8P0lWe/aTMsR/Z6aVkBcMRu3wuoq6OhdL7bEiZIjU4EV04j7UhoO
+YVEr/a+054CMPHNJ9KN3u8+jSyywndVUogYnxSFHhginoikCtHy6+4//XA9OBUmV
+dI3yRxs34vDV2nGru3GI6wSZy6q+iGCFGQeutN9CL7m+kyBlE2aJAhwEEAEKAAYF
+AlkojKwACgkQnEn0IUcIVRhRIw/9FcP0kGv1S+IKN9GbcWvP5ENdl5BySMKrnLQl
+cB6+w4DhGhsSX4Z3k2Do34u8nsE0wWq+SYLI0pBmByvdwuVvXu/Cfhr0g3uF0sHj
+MR5sGtmKHqXx9dP6Tf58H8TZJ703l/6ODhoLIFKaa/UxkopPBOXJKD1nxWe4dbVk
+NeW7Ws6uUFc0ruCEomCuVDRkSqrX/HiznlIk+ZhlTpIHxkB0naeaS3KCXHZioB6Z
+zR5CgxwJmGyaztgZV6JYSJKG8nV0qPaKy5XCbsG5XSXrRNkJar2AnwXj8zrcoKBl
+AdMHWUDJQgTtBAuHlLbK43iBux5InbwPynPHmzi/CZLX9f6j9mLLXglgaWwifvo+
+WkjmTVbxPInHhYts43AdX4rlcQZWhU4hsV1vtCz0bwd/nPNYYg6Def9Ouy55a7t4
+8xhdGEn/6HpY0c+ZrIoTWlrSpHU9x9Vn0WW1aTxl/fRaqSjWIf4ZxAMBMHd+B85h
+FiL//SX9FxC3aoGykh4PxeAEAg4bHmtkBz0j7sf61QK8PGIIDJHj6cKrRpLHaOAN
+ysYpRCGs3YuxX4ebqyVoec996Ue1H94eRvRNhFW4AMlhBBVRA4tGs9Dt+wNSvsxk
+fnaIWB48IIqdroVhgY0XqZkLGoUz/w0zlKvHnsdeu5+lgzhXZfFXEbE63pbmYNx6
+rp6YebWJAiIEEwEKAAwFAlkk9CMFgweGH4AACgkQA+K/Hg+1K8bnPg/6A8uDMlmN
+3ldvwbPIgiH4MMHqtqF7j/SnD/HtwQXegP97PqEvyWEqIkfYQa2C+jw3tDAbHZuB
++cXZcKLBx828zdNXW2ayxdFGDkDT3kMHA73NdNL1Vtc2nwIJOCB5J29nLLj7thrV
+oeezdtJnbk5bepYMxMLQ9wPUVs6L7LBKzRB3E0pfveFd67ou5FCkWADjob1CMgjt
+RPucwU+9vNxlbtpvLVMBEmcykRvQR8GcevP7cxnwQUU9HUO9WayXpJfUpFp/vMZ/
+hARlINUlunvbv/4U/G6QeJTptaFuEdApI3vsCL9OiQRE87E6VFJDiP8Yb1o2AyKA
+QboNjqIoUfLFgHQ4PZ8GEyQ9+QHl6r7lE/YPZnxXtDCc0hPrpSNjAND9fJfYp0Og
+weqIEodq9TAFElN7euynO+f3dGUzOl192zb+qYc6CSUgnwaLL8lRPD5TabnQYXV8
+f18wYS0nfz3ELp0nwj1FE1TptUw9WbRFeuuqlMUJYm6a2oGkkg0k1d5YLeMu9Nle
+0cMF2S97sIbsKNdJorsk8o4BMQ1Nl2aDzyu7Bp0mjG5beRGY8nqA7mamh2lxGFbF
+6hiOnyF9v9Pk0bGsmt7MIyq0R/Db0eiA2zXUwWgLu1DkyL8r3F0xPYD0Kq5FrGGk
+Ts78wMpz/g7BcQ5sZsDJ6pjR5XQRBOSj6/K0SERhbmllbCBSdWdnZXJpIChodHRw
+Oi8vaG9tZS5hcGFjaGUub3JnL35kcnVnZ2VyaS8pIDxkcnVnZ2VyaUBhcGFjaGUu
+b3JnPokBPAQTAQIAJgUCVzibRgIbIwUJEkZ2mQYLCQgHAwIEFQIIAwQWAgMBAh4B
+AheAAAoJEJleNSIa2E3/6voIAJJozyy7ECSeN+e4hLdgeBXxe5lNQmrpUYLLkFlT
+c9zvFJOXY9B2oiTkoXzasLbY/2NDJXN+PAVu8C9LCduRPxmd547LCX1AE8dxlKe1
+D/gvwgnpIcqJGg1lW8f9zurtjuJIGRElwJN37WO87lLqK/QedQLsGhS6K67sRd2l
+oOkQ07jnMo4K9QBYmqFc/lsRR82wWFNjGq4jA53t6AmeHqpY2MjPRLhiIIIUPYPq
+QwGePR6KF33W3F+CAOygUK7harbg3TYKSEC6CfU7KHmbjmwWR4C3TyTXEReqQcI/
+kMrvH7XbiOMryJlsUOEhLRE9ghsvyWpZBp1uyLPjY2LtEkiJAhwEEAECAAYFAlh0
+XpMACgkQP5AsJ27ZviEYnQ//bXkE4o06RCIq0SYWrCpYzfI2i42tHpALrsSdZNhb
+rv8pVJKqprOPr6bbKMiv57bmKjUcfpNse9m4Rl8IJ6mpm9VRAlj1uRTt1PsVUa0A
+ZiPD5oFdODeG8Y+1UTUrCJOmvdq0q1yuvDYEPpKtae5gQah+y7YzpMJKqwNu+hFy
+3q7BG1sXNTCbDM7po1wYT9yuQdROmAbz1ETq2WKRiA2v88YQvv5wQ2RRlEPKXQGA
+vQIKoaAq5ZSDyBttkjQLyn6ITD66+kUSgN5jGeecLqKqd81uOfItrF7ilVq5yxw5
+aW+f1auJtoMVnpCbnbVPBSGns1dlsTjw/y4NFTrnIO7kIDLYcvrz4l+7gc1m4iPX
+lgaBx916oWuf4eaD/1k+KLVF7UzcXy25eqGtVEjh9K56f/C/8GjkqM2VCuScW7Jv
+8jCR0/y2qivkwvyZDqtkC2dfir1K3mMN6OhdzfFsdEUN4n1J0KfaqrUNgoWYjdqA
+KqT2c9896v71FDcWFLHcCOdNma387dtD/ekuuk70xosVSBZ1rVg3FF9mpSDCJqu8
+SanNRxuPGcbdNbXpmsEH5Syb5sTJnejV5LfZsCr7ITGukEtbHH5C9w3Z0L3Y8aGE
+iA13lwkr871Rt2XZ3uz5O4MHp6iiBcfZQXizjPUFpApeJf2wSzp4gWZ0J3tC4cqZ
+XNCJAhwEEAEIAAYFAldDaKgACgkQlNM2o20Vkwpkng/9FiXf3F3EcDkwE7Ur6OfL
+3H3KOo/2s4WK+Tla2TliLJd+UGiU+1N+kwItPsV8uNEjS388zDqyRTO8TeX39Vpz
+bI+ehNxd37Xnqnh2PiBcnAqdzvciQxJFkZzZuQGuYnlCp6pSFd4jCUhDBbeFEIIP
+5eXpJOUqphcDl9wKCBJf2Zgx2izax64jzdMtnvEJogE4FTdqRUBwyclHgWj+d347
+HlIJ3vVnSiWlQAK3gFjNnBLqtkOwazigHqzkWZnQXu3HtZTELbUjji+d38ULKZJ/
+nzBykiqKCnl2y3J2Hx58eRmKcM5U7lYZwKW9BHINGDu8JM1Wyuua9Omb9nFL/ROo
+CUP1BwlgYeH5kDqdbRb2YL3xoyZs+juBes8Os00Xi5QfwgOlfb8McmhogZy3ztFz
+0EZGqPmmG8YhX0gkAR1/YvSOwmS3br8c3ymk/zDZPJRDRPu6ASB9wxkXXkAQpj5P
+srO5jGV/kl0XsDlKndnxyjOqE+5QkkeFEM8b9OpF7ZmTdGxbf5ssfy1NXC62iZ4j
+7BZORjYWN194Y9jEl6YZ35q0bGfvRUp5HdCpMKB0X5Iz2/ZlkPCcfILUTspfLm9M
+VXCnl17KCIKXIFsWmS2VeqFgLWHPPgtp8BM8KDKVWYoGqXzJLWnv4m3wmPMKQXIV
+LBqNKjOuR9Wrq2jFoRrUgHWJAhwEEAEKAAYFAldDrrsACgkQYtSPrRag3gEjXA/9
+FSwSeHUccComnRLTTRY8GIAZGjEckRKKDS0bWNAqa6fbCAO0wQUi6vKWYZX8671N
+q7xP7atjd1ELGJQ0T4ZJL/3uGmLqjpI/ptknqHq1sikJGjODac+8ZiSh7YOOvjP3
+mBL+2me/I15bVx+k5sOiRdtpMTXOMC/NS++TmT9XIPFNqSyr0i8OVyKXtsiXcJm5
+q0gYxjwvq/CiL2hco5Nh8rosyqZDOLREzw9eGshgFu++y4831Tnmd6PkfweM2DT3
+HA3YH3NVbtiZknkgXw0F0xBjRWL9C1DEMnaF/zPdO0XTV0CJT/nA3T3XZdCNK81E
+yJL+DVdEEkg94tRKAChM3TuBt1ks05K//U/ddPAsM2RtbLTF3VwYZeuTwh+nBqEZ
+lRC3CFxibl7ujSvMM1e8L/5P4ZB6Q0VgwRB3pZUd5YetfMTb/aTGSFiK9yThvpBl
+wnXizin9fiFg1nrElbtPTQnJ4KZgODLu31qRwod+EZHOOcJNtFfSPwBaNSe9jsPK
+fxrwamh2YAXPlTkwqU+Jc3O7XdLy865AMxm0AOFmyuJUsw9DVwP3XhvUe4iSjfOX
+FL/8KFcbnj7mJENdqLBjjRntOrBufdlsfdkhBPEiRY2DRIEK3s/RjPu3rKKo3ioE
+xHjCr4GShu+9EY/j+VbI3nvFbsKeEqFdFDegk5bipMmJAhwEEAECAAYFAlkdeO8A
+CgkQCp2vZxO4Y0nekA//UW4puqD6hWIiSruKOynZ15HuOwgIwS3zibKrw5gMF3S1
+Q6eKAcB2FjEJGMSLXygFQc86HQwlEXhzFMq4+3KTZmdb1q4S0CZ5v67v6vFgvTtG
+4NcFZHD6vcLGUAFUhNxvNvvloaWPAG/Q85klLa4brHyu6SKryaZX0Jc7wEAz78hg
+jHw0xbuW+6WLdpYj1358meFhXXRyotWGKyX8C7mgtgayT0mIeZY2P8DS79CHcyDD
+M5u+o5dppBuqeBjzVDuR29zdPq5EM77Zupc1mc2tnclDa2ZfxCe3W1vrXajWXSKQ
+e7Axlw+LiJoHr/mpoHJ+JCzLNgaQa/696FDg36D/l6rMu5h1SoYhUU1fvmO9MmUI
+cGJ+pPGvcC/SuOkCrHw2UbKbuxA7j3zjqvO6UU1IOikYul92mNwkYJ7IxDgcBpT7
+6Xb5chnaYyiAAzVvIjoKjWnJXOdNW3qAIP/BTMbDB14L80KDWb7qStidhnDztSxi
+gE9PxlxHlWbbtYKC8dQGJLCQEwrARCXBKChXchFMiVeYoey9viwTa0tpxnVjrAsP
+pHDWQjlfQT+/kpJTZlkyKMH1ANY/XJ4ZspGwg4BL+8/fzgJV8xOiibVKzeGxymfN
+GYrEptUFiGEWr/pzsrcR1K5y/EdIy+N4pagaPYSzUf+BboOwlSX2vgXO3KVjt1eJ
+AhwEEAEIAAYFAlkbmWwACgkQ5AMtxO8M84rAgxAAjeJzP9NLVHI+h7bQcGGBNPBq
+aQEhcH0xgUefu0BfOPerXLcrB/jubAKj0yhcsx4psYLyU9mVoDz6skD23VHzuyTm
+Hu59L7l470CExDylLdmnomfcQH+hrwzWfNkK1kagevn/g0APZt+pFRmirMZHrq2c
+ODdOV0wPYoCeuQ1mAcd6HXiis/LbEGGKn+vFlapjSS1YqQH8q7guSJNWrx+FechC
+1kK1SPeskpzsZ/sBEWhQtTudyrvZH88Ib7T/K/TMJ5dWi3eQgZsTl0VB4JvWQsJV
+Dw9Kzg+kKWAYfElW9o4lavolm+K/bZZP5Ych8rfiiVBRJmAK9W1KpjKzIMJzWq/h
+c2C4SZ4zE9lSuJRWrF22Sebh1lkboF/gDro7Wu/LJF+TKnH5kTjAM9TV2T1Y267q
+Wo03DhQ65NhtO0qFm663DUtKxScl3pD1IhP+5H03qXrlp7Jzu4FB8BakUWYiAFzQ
+h1FWFDusYg731QIRLCpCWYgMf5FRuZXqm+FZ+0Fyi+a0CMWzbVTw2S592HEYvjNh
++dz+2DN96za5jUvsUlTRpGfP+vULEgXcCkyUk5D1DmN3DofLJPIcUXfw3yLuiZO7
+9JXvGcqPew5VG38LmIHNPZBlM2w+Jy2La0R3zdGsohS1v5rnx0aQ4q6FYeUvyFta
+IPydQmCHJO3w6ZKBOj2JAhwEEAEIAAYFAlkckxcACgkQP6rSzV7LsxQ+Pg//cU75
+FwlbfMZhG57+K25fGSlSDURID2t84Vu8E7fiFVQLEDInmcLEnBv9ePoKT28HT4Zw
+SmOs0ETSfbeQeSHivceo1EpFHwZBBp1mY9QpjWzb/ZdcJvJXitp11IC2cGh9+rSa
+4oNDBx7te4aiyli+SRQB/IKJrIHumxhlThAF+5eOeaTZCkPY5RnaV1EV7+vNb08W
+K4f6aJH8OKT04WXtYvs/G7TAEqSLJpDujVblGVcQ+Jgi7jSAMqZTlUvOERRH7qcN
+0zf0ZNkO7EQnpPgo1sDQBLFkd4hvq7R6o6stnil9iEmqtyn/IjfQ1vEyuCwqSnIg
+b2UUNNfxtmLTjKR2iQ9zFCXV+yL4GCiUfjgMhBjj2Avfx0TcoFrGEywDg6zJG6hp
+umkAQLTnW1Tp7/GfexIe3ZpibkZMysZ7i//+HbYrm3tXLCkbc4JKM44pfSVp6+c/
+M+mrgTJ1BYBgm5vtJtdy15ZGtDAUedXdX+ikjLOe6dltYqcv3xbYGMxcqK30rgEr
+0qJIW00lra0K/DsHB+qWnxtyrse+RCsb8PXgTKgSAQgA3S/tzZeV0fmyHT027giL
+5FejZUwLE6Qe1NX3UJVEarHoJTg3PZZvAw90VVnheCOgvynwed/ur/iYy5HGoG7X
+u5lTIX3XchTr5LnsEJGDvvKWTQbrLYD7lIyqtEqJAhwEEAEKAAYFAlkbqNUACgkQ
+bwza5wC2iZ2aXg/8D3qNdolGQP5x5yPp/WcEm4pA2U1fPpoC9WB/6JZ08Mtolhue
+QDwy9swTeCjeS/bVWEkTUCIvgYsCT79iYwCMaUURd1gcGDHw7PRFzc1vI+s9peV0
+ghUS45kkO7yVdM5Lj0cnqaEfdsRH9PEPOJePUfWx1FC1MGpTDQWW+xjcII+JGlVY
+5uyNdr1XyiVsSZr/+KgGfmbKGP3+OqOJlGziyRSJNufUzpJ+6ARw0rVHN59nujWS
+3DPFcGvjS+xMicmDPeW0KH7r2HhmNJXZYP/0RcrSuHb2Hbofn4bg0s21K7m66I/9
+ckTR3L2tN7xfDDNCS0Pa27J24HpukfiM+mB6CmUUAZhimH5DjCpCAX2IQSWhItBn
+8SMqYwkvXSXKYnG1Sga15+mi3OyZwGwci0LG59Q1A9TnQP+sbqB/94ezO0rE2O+d
+ho/qfpyVJITUGTVZeiPK7bCQzezJMlqc4RjlBhqERGah4qZBSCMsbB3uU38f9FT2
+Y8lky+O9IFgH2UhpyeqjF+/Zn27dxUsDUo/e0/hlJxFGXCX/QOxf8OwSWDuX/5ej
+6Wj9cTpT2pUGA6XVRdzLnUHLSR5Hfv80jXDV4OObs/CAX7WHf5Jm+JWeL8kylvBl
+YE1Cs8nb28pGeA72MXANrVN0h4IXROTLwPQiRc+wFSywE0xWumCpChsHZiSJAhwE
+EAEKAAYFAlkeKmcACgkQoqsIHyZRj+4sCQ//Roje6BPFmLmBHl9ox1QGB5cpO0fY
+SkWeiPrs46rb0J0ywxKX+8KIMJZ+hOLxPnNdC7936PCE2o631Qq23yX8Ltb/8+px
+QFthNy/2JAVIJ8TyN8twvV7GpWxQXzg+g/kXwGwroJXarXr/GrBlOZQLRYWEsgEM
+1fp1bLVWUr+i4FEDzTcISz2sOEAfMeUxZp76yt+B0dE6n6HskBzHKUp5OQDmzd/d
+N+7G07QHq+vS+eLyWGDKMKUKqQukcgzSa4DGF0n7fTjQFcbGhyHGGEn4bMHpsFyE
+coIQF3NTuYkNEFoW+sPpcMz1Ax5tTDBpj1P+MZRPOn7Vvk1UqWJzUFkA6gFPM/Rd
+XtNI1cgxL7Jrwv+KNi42EVnO2Bx6WCK9wbNIvRKkxO3dDT9PtqWr/N2FaGd7fbqh
+jHNoH4O7vyOCDZzK/FaqC4umHFDRILeuzYSpptQBWI8a/qXnyalbOFH/4u6nZpGB
+8ddu8hnqpbUXszaLhELAzg+o0ne1mdKhk6MVR4Xl9n4MpRnEjh223TJyK/ybX5MH
+nXklDZwIYRPloya+76CmTLQ9sTQnCk/Mk5UMgzc940mqZjaYwVvbDkp32H/rcEt+
+Upmoz7Uyu/0PVitjUPKObSd/wEgBejNwB48wiBP2dhVrUgpICTYgfI2vEfuXbabn
+lg38G/rB/6LxP6iJAiIEEwEKAAwFAlkbkNEFgweGH4AACgkQwe27nKQA/VALtBAA
+ndpygMjAtdVMAkbqVOfYePc3zPEKmMABPdtxvicRS2B9XG1VWvnJY4lnE/dHbmpN
+J966p9QBaqKGSOm4MncIMRvLP2lGUC/dYN+ZhFUYD2wVMY/dwjS05iZn64FiM1hu
+697vReIs0ou1VQnD/efOjlRHeAKOWY8FmownJFAZlh3Z3ZlPJvL5RqPck0Sk/cVW
+oHiBjmgaefWdY92XO+NC1iORUOs2tPFSifCX6L4by4h+mX1uZI71FswZF5L2xaRr
+0F2zSBsY9Tdf7FgnM+kB5A8IUyZDzljW5PeNTIPZfGzFF1SpaZsPDUGTbRgPA7AK
+XWh1nUpPkkjA37h+Cr0xOP4tJ9IuLHP9UxuowWW1eVgc4CU6xSExcCxtustkhc2X
+wEaEYLVOtXL7AWJM0kGuNWp222fO9ZY04Z6eKU3Vg2INYan2TSWuAaP2Fzz/se1K
+MGd42cYT5n+KK84lvIDg1Tr/a+e7jOL/Tlviq3FSX/gUckcTGuyEFyoe9ecwS8Ye
+1bsSzA9pY2zkA4TeSV5Ggvyj0te/HlhHDGRd6m6ak60LT1Z+JK1Oc3u9QgOCB/6g
+K+JD24BbCyCXYLsSmMM8vXQiLi2BAaJejeyI/faGLkriFYaSmcZe/xHuIMX6uUgm
+24WFybzfpJ+SNMNe+YWKXZXKUeGdGoTbjKSq3ZDPMRqJARwEEAEIAAYFAlkoOHsA
+CgkQA8KWlJwXUMUQCggAp07Pi+4BfAr4BDVelp+QtMPwaNOkAWoeNtD77W38Bklk
+4VtsqOnQY47bUoauKznR8sDp4JrA7565/Ntm3zIqSIUs4RQfGNqtkf3/frj/7C3W
+l7pVn3lJTPexImFjk9p99oraH3/KPInlcwIErk/QqjeUQwBxrt614/b5RGhl42LC
+SpMfxXyiU7F0udEZFxUazD/2WkgHdCd4NvrW8UTJaD/iLOtmsVGOP9mZVnzNGPe2
+hYspk2Nt73iUNq9VA0ZM4NlvBrwmHsBXL7XJobM6PGfwgV92rvYF3vu9pzKwdXRC
+xsy5+WghHOymW42s3XmqquNX+WDJuKZuuhpncMaySIkCHAQQAQoABgUCWSiMpwAK
+CRCcSfQhRwhVGDPFD/4rL3ss/juwKEmnSAQLpNOau/Dg+IomJWXwKsdrPgqMAPBz
+pkIpQIPKWexUP+gDSsyEP9vHuiy63GICh1WdYBhxhhFeLubHoezn6zhv06Ki+Ppn
+OW0IImPS6L4DSALWLCiCrfZ/zAGch139gG5gbvZG9JzO1RU+JYfMbmE9E1z4aZNL
+f0Rqg+23pxVes1JIFGwND1t0sQaFOvVJNERnPGnWsK0MQT8xvCZk0QABJxLSdxmo
+z6PUCaIa+iGU1wNYjMUYb3mS2nPcrfCvyUgP7gTNXolLbVAGPAMkLo+r01dVL/pU
+wuGuw0Bq4mTVeHZ3QabmJvXhef19CVFk7aaPH/kNnGOrYE6aL7llcUyRZPW/9sva
+no5qtg40vsQLCTVIpRC0J0fKUEZrjb4Qjt3TwUczpaqVeA1TjVx49pePhZGdcMYM
+aysIi+gyK/HU9MdTj55KceaDRJVOp4GTRxKNZsm29FKZENKT3bWnZwCARbTsOoQI
+C/pRirK/gqJwgxLj4YLqqX5Ura2UpiQDSfQ+5LRZlakIilDggXkDhiCjM2zV/YXT
+5bCpehsTYbV0VS2pLy/8H3mClHwa+ouYXVDWMguzLeziAlZcvfmi8pLWOtVK2AjR
+y4dwD0fgOonknQ3AIXVC8Kjd+Kfh1ZZpZuXV95AxUHzNILIF5zUHYjuT1QPfK4kC
+IgQTAQoADAUCWST0IwWDB4YfgAAKCRAD4r8eD7Urxvl3EACpR8VFIze3/24Ixwc1
+/luHayr7eSNIFB1NbDlt74Ly6hq9stqY8Z9o6WL/zlwSXIT5wZH8fMt7O8tvNw1a
+qmPaclaIUjxcvcoPJUlZghgd2x6Osp11D019K3NyJxS2mPEruT1bQ3olnfokFKCz
+CAY64rq8BOf9RLZC09RW8Ey8mbL+oNUbAhO3lC3DALNgx6+lDvoAoRoMJiRzGNB7
+iteRz//nLEP/7rRuFjtyXnsMVFMi36u9KjeL2PTpAiEAPJM/pEekBU7Ap/9gm5Ap
+uCmvnhZPPIuCr/AsRKPhu3Chmy3lnkGqFmy6juoF1bbwNG6x8fVwHg/uz7d2elI1
+i1MWd7hbgwG0j2xqCwlcQWXDLdAmEgEs7G6whjb8lNaLTJ9N5+D29wqC5iNjg5ry
+i4q18X9RnHbzNNTaTPbg/N9Zd/7kj8Zez5UwkZZR5FbOevP0KklWuKHRQekVE4AG
+Wzv3tVFc3ZPyURqLp9g06k41/w/aGwYd/mASLvT5gjFWRQybWNLjrngqxjrUp2ez
+wO8hQSz7Ode9YN55eUWyffOB7SRC7QJ26JpiJhM41lyMH7PT9f34NciDaiFqkdm2
+WkeXuTYuUuqWS31vqZy3/Zv4prhDLrxisW9myX8tOLeKYAWOnyRvlreVPwmUWtO+
+h1z06/lzTE9CkPHe6GNaf9SK+rkBDQRN+o4xAQgA69rko9rydX8LLuI8RaXcgF9e
+jwT2m/unETjfHsZfMJB0S9XfEh5v1VHBhk1SX61kVWP3WndGVUMW+WmSxGXpMwp7
+aVqnwkakz1NaAjOTh1nJZERVGw0dpFnCY69zqwtJjIMTXdEGhCoTLq7vbWEgPf5O
+r5q1L31dblXqfedkXIDNWP7eA983eSSdZiQ2yOkVXf/Q5QBBhcya1xvX7zv79BBB
+rU9wsENOwr6YFq2nsqQZN3/Xi854TKljHUPxlUgMScCZ04vRPdfif0AnevvTd1Fx
+g/WEJ0e//F6x+iiyNwtVGDbTfSoMDm+PTXibVhZSDiSRBjY9205nX1Cm/vr30wAR
+AQABiQEkBBgBAgAPAhsMBQJW2wNKBQkSRnaZAAoJEJleNSIa2E3/EcIH91Yd4yuR
+7VDjD/65RoMVUbxs7lvQiJyRyiGn3TW+2WvIFACvZkgTeG/M1fBr523+h2Bd6VAf
+NuKkNYK01EuUw2bmwr3jXEntwN+J30AuZcwvt32yBEir8yke5xct7FVSkVzT5ZXe
+lZ0aYQg0im2HreU9uqvLIizaoq0xY0u1EmhvXrSuN95fegVY8Stk6lUOolDQzvdj
+e9yNN/lLgoGEVaoozX8gUdPn9JG4Mk45DV9Q08u8gXRRofDJ/sILJ/foP3TJgfC7
+vcFMsZn+pEDvx5H6D0rB62lclDYtT48ZzLcBJTX3wu1Gc1t9vZVsCOGfrMizIZ5f
+1hWw8puPN82Rdg==
+=5heD
+-----END PGP PUBLIC KEY BLOCK-----
+
+pub   4096R/DC55C003 2019-05-11
+uid                  Daniel Ruggeri (http://home.apache.org/~druggeri/) <druggeri@apache.org>
+uid                  Daniel Ruggeri <druggeri@primary.net>
+uid                  [jpeg image of size 13027]
+sub   4096R/14FF4720 2019-05-11
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFzW1OEBEACnouF1HJ/EYUIoa1XjLqXIONwrclBAbUmmHDTLAIs/6ocOpfNv
+gUS0MU8ukgmwWFOUcLNZ0c1qYA10rYWvEmvMSXUUlSlwfad8UcV/rL5KvIk+c6Be
+X/Fe84IEGgWksO5kKLS4br1HX9xZpmZPelgdhhPqAZu149xBqf8y2lgq0BqHzT6b
+8MvSILCddaMjR+mf+GD5jqw/srJZTnJQNAtFiUOvUCn/z3A8OikgGEOetMaSkYRl
+eNTGeq6X4R1i1iyCfj/h0YksC+Tgy1A7JYOBL2wdOGYO8YS+TpUhWmVNWHrA2oJ6
+GamEZhZ/+McmfkKxsAmeVD7prBs+2oW2HyDAcnVIRX+y/4n4EwmSjfcMeIDwmvOz
+jy0M2uOZsgSzfIEbnmGrPRM5AavW3z1tx6cYeaYPLKUEpooVJUN4vQih4Inj3m5D
+N4gqCLEHNUNMLCZNoZSrrjLesgb2tbJoFghs1rJfiEQJAtY8Q1dXCkcEJVYPybhS
+m1w7Ph+5KGOhRqzQAduoLb2YKRsReN+K2PCHpebcprnVkLSYYLKSCPtY5CAk4QXj
+EkeAM/+WSBE0c4dA5GYRYKc+J3OdN/DjvouOGrgkcFZyfCq0fJjbXgJjOX1qXMRl
+vOWUuIupdnpi+ud+tLf8JyxTECBOR+NxngxTn3Z1hjSCUD82szxmVsfYHQARAQAB
+tEhEYW5pZWwgUnVnZ2VyaSAoaHR0cDovL2hvbWUuYXBhY2hlLm9yZy9+ZHJ1Z2dl
+cmkvKSA8ZHJ1Z2dlcmlAYXBhY2hlLm9yZz6JAjgEEwEIACIFAlzW1QoCGwMGCwkI
+BwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJECqxKnrcVcADuq4QAKDUeH+7FE5qIIY7
+bFxwPT0LsF+SKTT6arXbtMtI5aSf3vlkiWhHXQ3KNs2UGtDOMQxApGtn1NRy/k76
+RJIW/0hAZhDQL44yho0dePbxyN3hes5nKIcoOr4cuHEEO5EnuQxSlefB4bropcRr
+7J0M+tSXjwCafwibW8zKsvMNDS2viRnSwj0Ve5uZ5hLs+aEZlExIMiN92dTcIhft
+BDj+AJGRIuRMh/u1QQeE6XpDO8vOKqmLgqMfs1VUuO7vD+80HsZg00qfSYlt/KNs
+ibhkGULsKJZFE2PPOXEdGzjjsXswpcufYRLqmkKFJMzFGqR8gRTj+RHK0yIjOmgR
+/eDMK4iElwTUovxBe9jCI0OT/xPEjHL9GuxIQQs8A8pU4hI/8mvcySjHPpz9vy8e
+U4lZxnif5CuNhsWWxQx4rGuucBs7shyULyKeUw/g8HQONc8/GBuvscNBw0tVJO+Q
+iYSDm2k4mYwqd9gjjAE+Mz+KNNd8lEQ+ULTKNkMDlYRpdq7Ujs1NwGw1g22XPGGF
+ihseLhSOeo3zYReoCE3swPyxdM0ONaIdZ602aapVyWzNZhspcSi9ZtMCq39xrEL3
+3THZvWJ9Kh/jTdKyg5KkDAdMIdKWJD5zNjYW1fuvvdNktPaQmlEgdJsp4fYrGjDU
+ANxSvYoGOSQcT0DbQK7ZlcRHUwjZiQEcBBABCAAGBQJc1tbWAAoJEJleNSIa2E3/
+duUH/3QnffSZ85W6XzqoBqH5PbsiYomTzfWvuQG05RcId+vm8lUQZ61G9gk27cGv
+4neZnq2SweBztQdYNrzPhm2aMyMmxhuPdwOdgYkFgy63KyGYpl4qVIkAaevAs0NN
+lUpDmUSXRpA6zOxrMvZWkAHnAsbNdYg5qYQA5hSV3nTMNmO62IY6q4eG2G4PYEaH
+tF8fdHl1qSYxKiFgSYKQXs5QCNG/YBqlUd3NSS2FSAzJu8DM/LXnaztvHy8P/xva
+p8hsfmAtbjgNg+AbLUXVxtBi8nO6WrPH4rRw3CaayVFQrSrb+gDaEgfmkwz1BVQt
+9IPW8JF9eV0FQZqr2UiMIsEEfsa0JURhbmllbCBSdWdnZXJpIDxkcnVnZ2VyaUBw
+cmltYXJ5Lm5ldD6JAjgEEwEIACIFAlzW1OECGwMGCwkIBwMCBhUIAgkKCwQWAgMB
+Ah4BAheAAAoJECqxKnrcVcAD0pIP/2DpmVIrfuciY0lMiYI//wovUHPkPXFhRFDC
+yWuxURr13ZID45chXDd4GF5DvtsIbzXHNJhYSNoThUQGxm9+Jdlv/KQH30/2mfY+
+CMn3jhO6gCgREU9cElxUp+d8r0bgId6bUfWuwDHfjmZ1Jt9Hs+zijiM+Bz/ak+Ys
+jIGIN3eCcsDoS4oFQSPb6gDcZSySC4WMp34NJSz7oSctXpvfEMkvmKAm2eDyWuw7
+cinsz9aQDc/t+YpsFFhjDAxL8AoTQehH1F0fiKOAF54GDNJkpxIJBMCkF7kXpcTz
+k2xZI+kpCNj4Sd7t/tdD1vQkaLICkfZf3kpWjHFSsP3Y4gn8/LbUn/ubB122gLUr
+JAIJ0YgU/x+JE1RX/GZZZc1kB1rJtHh6qiniQVYDgZh66NbR54BJimY83/0FTRtq
+I+QSgc3tacm8hV9pyc2hf26zKGD9ncfAFwACmRKolY2TKb4MyL5ABCr2h/2qlHwR
+pq3G9xdOGdzo52Xk7u2vwRrP/Q8dSLHoMEx/zazSfO+Surgz6Ls3f1SEYnzvNqJy
+fZyka7obfJz92NmiUVR5NKN5pPbDStWr7D5rKKzaRt4wTTyb0YFX/eDat7a/yVth
+zhB14uIGSl9aV4vi5kf1ZwNP996o4abLdEe/f32ht/0TLhHrU7fq2fWi+7ua6WaA
+E6LjSxa6iQEcBBABCAAGBQJc1tbWAAoJEJleNSIa2E3/OkQIAJFu3LCmheInFj5S
+Z29bx5hSVwQR/SGb8YQhGOKCPwHe+F0OyuIbjrMDCFYlFvsPADpuL880vx7HN0ki
+swDeUqscb+9gBhsIwqh7RXLbRUHlldufjjtmWe3cKzafVLD9RsruMVo3hgZmedWp
+YaQaWI9EbUwGpgSLHBaE3X3rYnBblp14ThoupymA0u55z0u4EBIg8e/ab8/TYk5A
+sZf3MamMY/DctPeGgkJNRDtR4IwtNfnUTW/GNRn0AEns/NFcNHUE9BePJ0n05J1E
+RAiX6aV7D18+OpTFOSw97w54Rp1VLRDYfxVkMjEPxRueaJWylCz0cf3m9ScARUeg
+kN6mJmfR/wAAMvn/AAAy9AEQAAEBAAAAAAAAAAAAAAAA/9j/4AAQSkZJRgABAQEA
+YABgAAD/4Q9uRXhpZgAATU0AKgAAAAgABwESAAMAAAABAAEAAAEaAAUAAAABAAAA
+YgEbAAUAAAABAAAAagEoAAMAAAABAAIAAAExAAIAAAAUAAAAcgEyAAIAAAAUAAAA
+hodpAAQAAAABAAAAmgAAAMYBLAAAAAEAAAEsAAAAAQAAQWRvYmUgUGhvdG9zaG9w
+IDcuMAAyMDE5OjA0OjA4IDA4OjEwOjU4AAADoAEAAwAAAAH//wAAoAIABAAAAAEA
+AAWMoAMABAAAAAEAAAWMAAAAAAAAAAYBAwADAAAAAQAGAAABGgAFAAAAAQAAARQB
+GwAFAAAAAQAAARwBKAADAAAAAQACAAACAQAEAAAAAQAAASQCAgAEAAAAAQAADkIA
+AAAAAAAASAAAAAEAAABIAAAAAf/Y/+AAEEpGSUYAAQIBAEgASAAA/+0ADEFkb2Jl
+X0NNAAL/7gAOQWRvYmUAZIAAAAAB/9sAhAAMCAgICQgMCQkMEQsKCxEVDwwMDxUY
+ExMVExMYEQwMDAwMDBEMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMAQ0LCw0O
+DRAODhAUDg4OFBQODg4OFBEMDAwMDBERDAwMDAwMEQwMDAwMDAwMDAwMDAwMDAwM
+DAwMDAwMDAwMDAz/wAARCACAAIADASIAAhEBAxEB/90ABAAI/8QBPwAAAQUBAQEB
+AQEAAAAAAAAAAwABAgQFBgcICQoLAQABBQEBAQEBAQAAAAAAAAABAAIDBAUGBwgJ
+CgsQAAEEAQMCBAIFBwYIBQMMMwEAAhEDBCESMQVBUWETInGBMgYUkaGxQiMkFVLB
+YjM0coLRQwclklPw4fFjczUWorKDJkSTVGRFwqN0NhfSVeJl8rOEw9N14/NGJ5Sk
+hbSVxNTk9KW1xdXl9VZmdoaWprbG1ub2N0dXZ3eHl6e3x9fn9xEAAgIBAgQEAwQF
+BgcHBgU1AQACEQMhMRIEQVFhcSITBTKBkRShsUIjwVLR8DMkYuFygpJDUxVjczTx
+JQYWorKDByY1wtJEk1SjF2RFVTZ0ZeLys4TD03Xj80aUpIW0lcTU5PSltcXV5fVW
+ZnaGlqa2xtbm9ic3R1dnd4eXp7fH/9oADAMBAAIRAxEAPwDri4t1CnVlEkt7qBJI
+UGQAZCJCrplkO3ArMurMFXbLANO6C+CNUei2Wpcp28FEoJLgi2NZMlDdbjYw33O2
+9wO5/qhBAB6Oxi/RCtArmLPrIWH06WiriHOG4x+9CgPrDnl0GwsMEz7SOUuIL+Av
+UvKgx2q5+j60PdZ6VwFnnt2mR29v561MPqeFk7Sx+0u4Dv8AyX0UeII4SHTB0Ra+
+UFqLWdUUN6kwiWOEKvW7RDy7nNYYSU18hzS+U9dzWjlZF2XYbCFOuy140RWv/9Dt
+GVAqLsck6KdbuEdoBSJXgW5T8Yh+vCDbWRPktexoWflGutlj3fRYC53wA3JzFIUX
+muq9UGCNx1tf9DSQ3+W9cxd1Oy6wlxc93Lxw4T5P/k/RVonL6nkvsgvsJnYNTB+j
+OvsYrFX1b6nbJFYYP5R5A7SPoqEz11Z44zWjRqtuO1zpeNdXjXw/zXN+m1TDrRAa
+dzdQRMnbru/zFs4/1Wz9o9RzOdWySCt7D+q2BW1u+wvsESYHKHGF/tl41+Nl2Vh7
+i4Hh0e4z9Jvp7fepV321NtfXu3QA2s/Rc6driZ/k/wCv84vTcfo+AKtoaNxEFy5n
+629Jx63MLK2l0ECR2/dAA2tRsrSAk+rvXGZBZh2v3PcAGHXR0fzf7vu/NXRs5Xmm
+DbdVd6WySwy1w7QZ3B38lel1PFgbY3h4Dh/aG5SwLDMNylqjk1y2EWgaKVzdE5b0
+cC7Hb6h0RseoQiXt96JQ3RFa/wD/0e1qHCO3RBqIgIwISK8Ir3hoMrF6lcTRcxhh
+zmODfiQtXLcNpWJkNcXE+B4TujHLdwvqVtd9qc4APhogdhJXVMa57u/wXNfV2luJ
+1DqLHPa1jHNbLiBzLlq5HXelY5LBls9QdgQJPxdtVWYN6NzGQIiy67aXtIlv3mP4
+q3TVrMgeS56nrT8pm2hzXu12+4EHv9Jpc1V8r6z2YhltBfBg7nRqNHQP5LkyINsk
+iK3e0ZA41KxPrJQ6x1dh/m+Cs7A+tfVch4caam1nXaHsDon82d66Jlv25jq2tbZT
+YwOm0kEElzLKv0dbm+2GWNepgwSHWngfRrORv+meBH/kV3uIZoqPixv5AuO+y+n1
+G3CrD3XMc5np7HAyNQ9joDXt/lsXZYlN1ONjttYWO9Nuh8QPcNJUsd2DJs6dA0U7
+RooUHRTtcITuqzo5WQP0iJQNFC9zS9Epc0BOWv8A/9Lr63HRHbuQ6gICstCJK4Bp
+ZAJ0Vf7Hv5ErRe0EojKwGz3R6LJDV5W2l9N2U5jq91lNjXPrlryfUHpOf9Jvspf6
+PqfyFy2Xh5jh7BTiVgxW5zQ+xzRp6jt36Tc781dn9ibh9UzQJ9LM23VCTAdqL2N/
+te9Sdh0t9xknzVWUjZsN2OONARNxIBvrq4f1OwMmjqAddYTTscHSILnOI2NeP5Mb
+lr/WD6pnJf61RNhBD2scRoPz6/5XuRsayiux7rCG1sIB7QTqtr9p9OfQxv2ittto
+Iqa9wBcQPotb9J/9lIGyTtouMSAAASLeU6V9VsGu17rcOHWa2S9zRP8AJDNi6rpm
+A3EY1tW4MA0a4yQs7H6uG2eheDXc3XY78rf3ls0Zdd7JaYeOyUTe5ROJiKA08Gv1
+m3Hw2HLcxzTkEUW3VNBeAfobuPaq+HQKc26yh7nYuRVVYA4k/pPc1zhuJ+ltWpkV
+Nvx3UuJDHkBxABMT/KVcY7MUMxqzLKmw0+X5sqSMSZg9BqxmYjhlEfNL0104dP8A
+nRbdTtELLtLWmEWluijk1y0qfq1HBtyX+oZRK8l5Gie6gb+ESikeCK0P/9PtKfoh
+WGhVKnBoEqw25sJFfsp8ApG0BpQ32A8IL3OIOiNhaQSizdljd/euSPmNqyc3qH2e
+tz3g6aCPEq8+6xjpHZZWfVXZuY+QyzUEctP/AJi5QZY9ftbHLyr0nps4/Vcym7Gq
+DRNjXbiWugz8va5E6Tk9Ubc1jqxFe11VloaA2T7ve/Z70BvRRjs9U5fpVNmd9Yd8
+Pe3bYtHCz+jY7XMdcHBxHqaEkgiNjHPG6ncgNNmXU6k19aYdcvtybaKA0W5Z94qr
+dutDAffe51Ptx6W/v2emuk6F67MYsucbLKyQLDALmz7d0fyVCnK6dX02zMxqBU22
+C4nV7y32N9Un3ezajY9foMkGW2+5vwKHXRBO4vd0M8X3YJZjuDbPa4uJIhs7T9AH
+d9L6DvYpVnc4nUyeTynxwX4uQ86y2B8vcmohTwrdq5buujoUDRPeNE9MQntjan3q
+x1o497feiY7dErx70SgaJy1//9Tp3XEaJxfGhQdJ1Kd3KC9tNslJ1nih1nQJ3pK6
+LHYeQq2XhVZFLm/ReNWO80ZUes9Vq6VhuvfrYf5th7/vPP8AIa1Lh4tO6Yk2KecP
+UThdRyMXLadjiHAHUbdsNc3+R9LciVYXSfUZl2OLm7votPtkD85oV7rXScXqBDLA
+Q5hPpWtMOaHfuu+i7euat6bmUE0nKJZPdgkf9JQiiLumweIGqsdHos3rGNY1mO0t
+FTZc1wJAlv5pd/Kn2LY6S1zcSit7S0VtJh30pcS73rA+r/RqjYLXF172wQ+yIbHd
+tf0P6q6iqt1bhu+7xR0qgtAJNl2cYOdU6tkbnsIaTxJB27v7S4/6o/W7M6vbbjZ9
+VVVtTWlr6g5mslj2WV2Of+cPzV2GKdWxyNFx9/S8Xp31qz8jGcdmbFrmGIZYXF1w
+ZH5r7H71NgqUhA/pbfYtMbJ06PXV5m3unfmz3WZW/e3zHKmEpcUSQdwx8I7NveHO
+kqxTCz2ko9dpA+CAlqk4xVh//9XcNgJBBRpkArOqt3cK6La66S+1wY0fnH+H739l
+LquGobNR0hNlZOPi0m/IeKqxpJ7n9xjfpPesPL+sQpdtxwGju97dzv7NYO1v9tYe
+d1S7LLTdc64tJI3ANAn91rfapI4SdTp+bIIHro6uX9aL33GjCr9IgSHvALuJ9279
+HW3/ALcXN9Tvsurs9Wx1rtp32OmXEg73/wDmP5iOxp2vvJnf7GjyH0v/ACKrZLIp
+eXENDgQC4x925TCIGwpdQGz1XQc5ud0bDtcZtrrbTbPO6r9Ef8700suis2FxHJny
+XK/V3PswsnIxH/ze7dtPYuHuldO/J3t4kHsVnzjwyI8WSJBAdvplApY0jUka/ArQ
+DQ90+CwOn5j6trew08VpjODA57uE20kOi7NrxqnPcR7RJXIHJfk5Vt7p1O34kavP
++e7ai9V6k80WPmBwwHu4/RVSms0tYyeGiT4nurnJQuRyH9H0x85bo2+rrUX3GpzK
+rPTtLSK3kAw78zcHfSYo4HX91rcbPZ6dpaP0zRtbu42OY7+V+exAqdpI0I57qrfb
+6d7joQHAxyNrvd/35XMmKE9x9eq3hBesrex7dzHB7eJBlHrEhchTlXY7/UxLoEyW
+u10/df8Av/21t4X1hoL21ZLPT3/RsbqP7f8A5h/22qk+VlE3H1D/AJyCNNH/1rDn
+jGYbX6N4juSsvK6k+10n4DyCfqOb65G3RjZDB5eJ/lLKse759lZxwERfVsQjwjxS
+22F3bTlBcZMAanQfEpNt8UnNDtRwnrmt1Lq7qQMfBAJaNvruE/E1sP8A1b1gWjIu
+t9TIc61zuXO1W1ZiguLlE4rSIKZKF7ljlEnctOvPy8Qsfta+oNDJcCYj/p/9Jdp0
+O6rqOJvx3h+2N7O7D+67/vq5X7OQIiR4HgoWKczpmU3O6ZYWPYfc3nT9y1n+Foco
+8mHiGm6YkxPcPo1VT2mC2Y+CsXscREwGtLnuJ0aAJc5zvot2rMp+uvQ/2bXmZZdT
+lOlr8NrS5+9v0nMP0fs7/wDB2uXO9T+uWV1Kuymmp1OO/iskNYYO5vrOb+mu/qey
+tVo4ZyNH0juf2MhnEDe0nXfrPXU8UYVTbWVn3W2yGnx9Njdr938pDxfrviWuaM7H
+fSeDZUd7f+23bXt/znrBdji6w23udbY4yY0CmMIHRrAPxV2AlAAQ0iOh1+1iMpk3
+b3PT+pYOYAcHIZeQJ2jR4H8up+2xLNtorv3OGtjQ6PhLf++rimdMdvDgYc3hw0I/
+quC2mszMplYyrjaagWscfpQTu97h9P8AtqcTkRqNV4kezonqWK3RjQT5ItWZ6hg1
+bQfFU2UVVAcAo1dkGADCNldZf//Z/9sAQwAIBgYHBgUIBwcHCQkICgwUDQwLCwwZ
+EhMPFB0aHx4dGhwcICQuJyAiLCMcHCg3KSwwMTQ0NB8nOT04MjwuMzQy/9sAQwEJ
+CQkMCwwYDQ0YMiEcITIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIy
+MjIyMjIyMjIyMjIyMjIy/8AAEQgBAAEAAwEiAAIRAQMRAf/EAB8AAAEFAQEBAQEB
+AAAAAAAAAAABAgMEBQYHCAkKC//EALUQAAIBAwMCBAMFBQQEAAABfQECAwAEEQUS
+ITFBBhNRYQcicRQygZGhCCNCscEVUtHwJDNicoIJChYXGBkaJSYnKCkqNDU2Nzg5
+OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6g4SFhoeIiYqSk5SVlpeY
+mZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2drh4uPk5ebn6Onq
+8fLz9PX29/j5+v/EAB8BAAMBAQEBAQEBAQEAAAAAAAABAgMEBQYHCAkKC//EALUR
+AAIBAgQEAwQHBQQEAAECdwABAgMRBAUhMQYSQVEHYXETIjKBCBRCkaGxwQkjM1Lw
+FWJy0QoWJDThJfEXGBkaJicoKSo1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdo
+aWpzdHV2d3h5eoKDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLD
+xMXGx8jJytLT1NXW19jZ2uLj5OXm5+jp6vLz9PX29/j5+v/aAAwDAQACEQMRAD8A
+9LklcPwR0HYelIty46kfkKbJ978B/KoH602Box3rZ+8P++RUwu2I6j/vkVheaytg
+VbjlJHNSVcsy3Dk9R+QrOuZGPp+QqwzZJqrNyatESZnyM27qPyFVZpHA6j8hV6SP
+5qpzJwaDIz3mbPX9BTRO3qPyFOkTnmodvNICcTN6j8hVuCV89R+QrPWrtv8AepIa
+Zs20jcdPyFaccr46j/vkVlW3atGPpWiKRaEz+o/IU4TP6j/vkVAKcOtAEpmf1H/f
+IqJ5n9R+QpT0qFzigQ7znz1H5CpUmf1H5CqgPNSoaBlwTP6j/vkUvmv6j/vkVAtS
+UASiV/Uf98ip45Xz1H/fIqqtWIxzTEXopn9R/wB8irSSNjkj8hVGOrSdKljRYLtj
+r+lQvK47j8hSluKryuMdaEhsqXUr88j/AL5FUN756j/vkVYuJBmqRkGetWZMtxyv
+nqP++RV2Kd968jqP4RWSsw9alS4w6896BlWU/OR7D+VQtipJP9YT7D+VRkZFZmxC
+FBepgvFRAENTy3FKwgY8VDIeaR5cVXaXcapITHNzUEqZFS0yQ/L1oaJKEsfNQGH2
+q059aiL81IrEPlc1agjwaiLKi73YKo7ms651+OMMtv8Agx7/AIUm0iowbOnWWOBQ
+ZHVR2yaZLr9pAQoBbJxntXC3GpSud7vkE5PPI9arrqXmSBzlllGAV7f/AF6XMzZU
+0d2PE24nZEuMcDPNNHipgMtCp5wetcQZCN7+aQpPNPjuSIRvfLdOe/H6UczHyo9A
+h8SW8oIkiZD7HNW4762uVzFKDnseK8vm1KVXKAEyHlSehq3Zaw5APG4fdHc9qfMy
+XTR6R3qVa43T/EcjAbnLNkghvaugs9atpwN+Yye56CmpIlwaNlTTxUSEEAqQQehF
+SCrIJFqwhqqpqdDTEXIzVhWqpGamU8UgJXk4qhcz7QeasydKybwnnNMTKVzeYbrV
+P7XnvUF3ncaqoSTTJNVbj3p4mO9ee9UIlY1dihJdevUUDL7p8/4D+VAiz2qcgb/w
+H8qeFGKzOhIovHjtUBQ4NaTRgmm+QCOlTcOUxJVOTUSxkmtaa361B5GKtGTViiQR
+2qCQkVfljAqpOuFoEZlxJhqqXN9HZwiSQgsfup6+9PvpVgjaaToOgPc9q4HVNVuJ
+LmTfnaen+z/9aspStoaU4X1Zo3uty3ExZpPlU8f3R68VmtdO5kIAaTkBT6dfxFZE
+t66riWI7Wzz6k98VEvmhVeOUggdGGf8AJqNzY2Y9RleMlhjB+dCP6+tSwvDiQpuM
+bsGwpwVP+FZ8KSsd7gAlcEjkH/CrEcTIQRjbk5/wPsaLjsTrO8bSI0nfIOOvP6Gp
+EuzOskTAK/JPoCP/ANVQ7Fcdc7TuAz+lEdriUzxAuQcOp64/yadwsWGnmmXI+fBD
+Lg9wKoG5m8qNUzHIHKnHp/nNa1tpUgH7skCQ/L7EGpbjT5Yywhi3sww7hc47cUrj
+5SpJJJFCJt534LcHrWrDqjxQIZjnfhcg9c9MVjNFOHkAXBUYUnoO34mnX4kuIoot
+yr5Y6KfucY/OhCPRtC14FY0dx5RO3BP3feuvGMAg5B6GvFrDVFtY0i8t5OduFHP1
+r0PwnqwuUa1duR80eTnj0rWEuhlOPVHUCpkqEVMgrUyLMYqyo4qCMVaRaQIjkXIr
+Nuo61nXiqc6cU0Jo5y5gGTxVQQc9K2bmPmqezmq6EEcUXPStCCP51+oqKJOavQr8
+6fUUhjGb5/wH8qkQ1XZvn/AfyqVKyZ0omAzTgtNWpF6VNyyCRAe1QMgxVtutQPjF
+WjKSM+WP5qo3CADritGZsNWPrNyLbTZ5uu1Dim9jK12ef+INYE908aNiNDtU+vrX
+NoxkyRuK9ORTpcfaS80mQeiity00O5vVVwQikZHy1ySZ2xWlkc9JEcbSGx6cH/8A
+XSqq5KJuVhyCB1H0rsYvBzu/zucDocYrTTwbbeWNwIb1BqedGns2zg4N2dyup4z0
+4/GrqQNO+GBVyODj9K7q38J2cZ3YJOPWr8fh+13D5MAelHtEUqLOMsdBuZ13eSe/
+OK3LbwvKrqShLFeuMc+hrtbaOG2jCIgAFXY3TI4pc9x8ljCsvDQlDEqBv56d60Zv
+DqiPAXHPbtW5C69iMVbBDDkVolczk7Hn+p+Ho/sxRYViVur9STXm95pUMMjoQCQf
+vbiPzr3XV4ENs5x0HFeS6tbLLNICP3me3emS9Vc5m2kiilKsSqDgbm6j8K6XS5Vi
+ljnhYho2BIJrmLyzMUmY8ZHH0rS01HbEhYlAMZznNUiGe0qdyqw6MAanjrP0yUza
+ZbSMCCUGcmtCOuhHKy5EOKtoOKqwjiriDihjEYcVVmXg1dYcVVlHBoQmZFytUsfN
+WjcjrVLHNWZj415q9Avzr9RVSIc1fhHzp9RSGZzff/AfyqRBTCPn/AfyqaMVkdA9
+alWmCnjpU9TToMbrVeU8danc4rPuJCKuJlMq3D4aue8SXBj0eYhVbIxgmta5l5rA
+1j/SLGeLuVOM+tE9iI7o8yj2PeCNVG4v3PA+lev6dbJDYxAAD5RnFePWgWHUv7zb
+8k4969lsG3WMX+6K5JndSJycdB+Ap6BiOSKaAe1WYYi3bPvXOzrjsMVe279KnjGO
+N4/KphaHb94flSLAqnl/pilqO44IMjgGrcI45AqONEUjlj9TVxGj4+UfnVx3IkSR
+r7AVYUkdKiBXtTx61ujnauVNWY/ZWGe1eaXkYlnk4G8HAOOten3UZmiZT6VwuoWx
+trp+vsSOtUiGcddwlweFAzgg8H65o061KEFs5Xgen4VauJElkOVOVPTv75p1uCzn
+CgqTnB7VdjNnpWlHOl2x/wBitKOsvRjnS4Qe3HStWOt1scz3LsPariCqkI6VdQcU
+mCFI4qrKOKtnpVaXpQhsyrodaokc1o3Q61QxzWhkyWIcir8I+dfqKpxdRV6EfOn1
+FIZl/wAX4D+VTR1BuG78B/KpUfiszpTJ+1LTN9G6o6l9Bsp4NZd0cZq/I9Zty2c1
+aZlMybp+ay5vmzkZB4IrUmTLVTlj4oZkeYahbm11krjADcY9O1eq6W3+gQ/7org/
+EcGzW4TjaHC8ge/NdzaXVpbRJE04ZlUfLGC7fpmuWomd9Frc1BnGSM0huzGeelYN
+94ysrY+WqMfcjH6Viz+NbWY7Fcp3OE3H+dY+zZ0e0ijvY9UXacnpUcmpRgZzjn1r
+h7XXo5nBjmaQ56NHt/qa2IvKvY2zKo7qc52mpcWjSMos6IXzcHICn3qVdWtoD+/n
+VMHu1cPfS3WXhSXKxY3bTjGfX8BXM3d1PDPuS6CjkEZxmrjG25E5dj2VvE+nxfda
+SQdyqHH5mrVn4giu2C29vuJ6bpVWvFrKBrj5p9QkOf4QDzXT2ENujRiC+ZZV5CsS
+ufoDWlzLlbPUnuZImQ3FuYo3IXzBIGVSeme454qrq+nQ3kDx4j84DIGRmsq2vnu9
+HubGUly8TAZ9ccc/XFbsNnZ3EMZeyTeVBOc5BxzzVq1jKSkjyG5tWt55lK5YMc56
+/wCeKnt1HlArwwwc4xx9K1fFsVzp2sERaelxCfmwZCrY9m9frVfRrC41VJPJilSM
+52C4j2lD6E9Py61d9LkJNux1+g8aVHznJJ46VtR1W0rSHtNNSFp43kUchRgH6VaT
+itYtNaHPOLT1L0HarqHiqEParqHimyUSmq8vSpS1VpX4NCBlC5HWqO3mrVy/vVQO
+M1oZliLrV+H76fUVnI4zVyKQb157ikMxS3z9ew/lUivUJ+/+A/lT0BNZm2pYD08G
+o1Q1IEpFq5DKaz5utaEqmqbRkmmTIoNGSaia1zzWqIPan/Z+OlBmcTqFvp95eX0E
+zqlxa237ouwXLnJ4z14HT3qU3Lf8IhbmL5ZJYVU47etaupCz+0zCaNJcwGJ4pEDK
+wznv3HNZbWyR6BbQRqFjVfk29AMnFc1SSex3Uqco6s424hsrWJftjtJJ94oD+tc/
+d6pZwyfuLBlPRSRXVTeHo7y7lubxnCZGxM9cdz/hUMtnaJL8qNNJ0C7NxqE11NHB
+v4TnLC+maVi42ho2I5wcYx17V634GkmvtGQt/qxwpUYyMVx0GkNLkPBGrvgYA+6M
+85r0jw1Gljaw2qqAir29amdmrF04yi2zJ8QabdRz4aMvHKDGDnhQfun8Gx+BNeeX
+Gi3KX+2UYRThwWwxPce1fQNzaR3NkY3UHJyM1zGqeGI7tzPgeZ/FnoarVIFaTPJ/
++EOlu7pZYmaNQemc4Brr7PwY8kAH29o1AGImwy/XnofpWrD4flgcAIwU+jEit+xs
+BEnQkjpupc7D2cY6oytJ0q9sciRt6r0ZWP8AI12dizbQT0qvb2525Y8k1ejj2jj1
+ojcibvuQavpVvqcIE0asQOp61lTj7Jp4trNSTFhVGep9z6V0eeMZrg9cv9R0nXVj
+jytv9/dj72f8OlXUlZXDDU3KdluQ67FqVglrepeTqScMgb5c/SustJvtFtDMesiA
+n61mXEw1jQckBmWRR+daVtGIYI4h/AuKdBe+2trFY2SdFRktUzQiPFWVPFU4zVlT
+xXWeWPd8Cs+5mwDzVqUnFZV4Tg0ITKdxcjPWqouOagut2TVYOaok147j3qxHc/Ov
+PcVjozE1aiyXXr1FBSLW0b/wH8qmQCo+r/gP5VMnWsjdIlUVIoGKavSnr0qC0iGQ
+ZNVygzVp+tRY+arREkCRA4qVosLTogM1I+AtMxZ5d4vtbqz8SxXUUsixT4IAPAPe
+ukaLdAAAoAUYAAxVzxFYLf6c4C5kj+dPrWfa3Hmxbf7pwf5/1rhqR5ZM9anVVWlH
+utCo1g7ZyqkH/ZpE00dCu0Z6AAZrZXAXk4qvK3bJ/Cs22jRRKJhihOFUe5rasIcq
+GDYJrFlkHnRw55ZgCfSrp1aCxbbuHt7ULVFcrT0OztvmiC5zUV6FjibfwPWsbTPE
+McofJHy8nnpT08UaTqgmtobqOV8FSEOcGtk04mLpyUhIrwF8Bs1eilXcDxn+dcXe
+G40pvMyTEev+zVyy1uOdRiQN7VjFs3lBW0O6iZGXgilLGM4PesCz1PDhS3Xoa2ln
+WVQTW6kmjklBxZYTgVjeIbZ71o4o4DI4U9ByBWwpGOKa7GOVWyu0kAeuaqSurEU5
+cs+ZGDo9i9lZtDKMNvDFe4xzV5OTV29KLGXX7z8VSjrajHljYxxVV1JXZajFW0HF
+V4R0q2g4rRnORSLxWbdR5BrXdeKo3CcU0SznrmHnpVXyRWtcpzVPZzVkkMcPIq9D
+CN6/UUyJOavwIN6/UUhoqj7/AOA/lVhBUAxv/AfyqdayOolHSnqKRakXGKmw7kLD
+5qZxmpZOKrk/NVozkydTjFKzDHWoNxqOSXAoMxZgDXOvb/Z7i4KrhSwI962Xm4PN
+Ub3JhyBkZ5OOlYVY3R0YaXLK3crNP8vXtVaa4CpkGobgkMvOK53Wb+RCkKHlzj8K
+5Grnpxdlc1k2zbnZgAOhzXH6l9og1B3F3KyDoobj8RVyLVESExPLnaMk96xLovPc
+F42xuPYdB2rSEbbmc6jexs6drptiY3jVmkHGTkcV02mapZRTRyrFGJXAAAXGB+Fc
+FJotxJFEyod6kAFc5NdRpmmeUkTXd1FEwXBVmq7pEJzk7nVXt6J7aVnyoz8ucHI9
+a8+uH8u+L2dwYmLfKV6Ee4rpLprKytZZbq/fyVy22GMkY7c9MVzlrYXuuXP9oWtn
+Jaafu+Qzffkx3x6VNluDcjsPDepvdFoLtNk0Zw2D+oruYmZFGTxjqO9cTp9n5N+J
+UwNyKCMdMV2K/wCqTnmlDcc9kasEm5awNf1CS2usRyo+XjCw5+bfkYx9QfyzWtBJ
++7z0qnqWnWk7Wt1NbRPMpJWRl+YYORz7Vskm9TmlJx1JfMeQ/O2cdPSpo6rR9atR
+iulKyOSTbd2XYe1XF6VVg7VcTpQxDXHFVJhwavMOKqTDrRETMe5XmqRHNaNyOapY
+5qyB0S8ir8C/Ov1FVIhyKvwj50+ooKRlA/P+A/lViM1VPEn4D+VPEmKxOlsvqafn
+FUlm460/zvei5OpLIagY80xpSTxTCSaExco4uKglbjrSspzxUUikjGaLi5StJLtJ
+5pFuBjrUcymqjK2eM0rj5Ste/LLsA4IJDdq53V7KSZFljI3rn8M10swLxYOSRyKy
+Wl2sysODXHNNSPRpS5o6nnwhuYJmVrSabq37thn9as212jjcLeSFjnKtGXYY9hXa
+QwR7ydoDdRjim311b2IDNbKzHvj+tO41FIq2VpcPKhE9y0fVgCFzXSQWkchMNrbQ
+weZEUeRxvkye4rkj4nhh27bcKx7c81cTxiFYBYghPAK8jPvVK5TdPrc7M+ErO9kt
+5NQc3H2dNkavwp5zkr0J96v3MEEUSjAVANoHTFc/4d1O5vpGa53jYR9Cata9qDqu
+1c8N90dj2qXroQ2NSMrdtjnnIrbjbEWOflFVbJUntVk+VmA5HoaeGB4OMDpTSsyX
+K6NBZGYKBxk4FaGoJizhI/hOP0rOslL3EZI4XvWxqC509vZga2juc9XYy4xVyIVT
+jNXIiK3ucti9CKuKOKqQkYq2poYCkcVUmHWrTEYqtKRQmDMu5HWqRHNX7jvVPHNX
+czsSRDmr0A+dPqKqRDmr0I+dPqKYznpJP3h+g/lUZk561FM2JD9B/KoN7E9axN0X
+VlNSCTNUd5AGKBKwpDuaG6nA1URyakBNIaJy3FRtg0wk0wuaBitGDUTW4p2+jfTF
+crm1BPSue1bT5LeTeoJjbof6V1O6orhRJAyMoKkcg1nUimrmlKTUrHnV9fSW17ao
+uSDlmGe1bAaK/t2JQbeOpzWD4w06aBoryLc0UeVYDsDWVZay8SbXJMeM+wFY8l1d
+G7qcsmmXbzRpJX/cx8luC3AFWtJ8NXTXDyXDBVAzjGTV6x1KCZlXOeAdx7e1TNrJ
+tbhmUgBVHJPJFF3sUlHc6W1+zWMPzyfKwCgZxmsTUXNxfb1mwG5I7A496z7nXUnV
+kTaFb5kzzz6GsuDUkkgZZgzSM4C4bGcjOPfmrhHqZVJ30Oy8KyvHFcNM7Zc5K54B
+/wADW/aqZG3HIWue0e2kjtyZlCTOecHt2FdJB8qgDGAOnah7jimkbFn94cbSKvah
+OkGkXU8gYpFE0jBRk4UZ4/KqFsflGQRitERrcwPA/wB2RCh+hGKcXqTNaHDWXjzw
+1d42aksZOB+9QrXURTKyqysGUjIIOQRXzDfQGxvrm0ljw1vI0Z4xypI/pXu/hS+3
+6LaoTkeWMe3Fdns7xbRDpqx2cU+Mc1aS5GOtYQmx3qQXPvWPMZchttcDFVpLgVnG
+696Z5+T1o5gVMtSvuqIKDUe/NPVhT5w9kWIxyKuwj51+oqklW4GxIv1FUmRKFjjp
+SS/4D+VNQHPNPlOGP0H8qYrVBoh7dKbTj92m0Ek8fSph0qCLpU4oKQGomqY9KiYc
+0AyM0tBpKBDhUN1cRW0QaVgoZgi+5JxT3dIkLyOEQdWY4ArzXxh4ga4mPksRHByg
+9x3qow59C4K7uddfwo6yRyKHByCCOo9K831bwtdWUjyWJMsRP+r6Ff8AGvTXkE9u
+k6gMsqK4I9CM1SeAMxGfvcVxRbR1zipI8pTVLiymCywOGUd1qSbWXuGDIkrZGGAB
+INdjqNkAxwACay/KKNjaMA/witOZb2M+R9zLs7bUrsoiwsqk4JbjFdzougx20iXE
+376fjZleE4xwKp6fHvdV2nkcV2unWiiMsSF4+WhyYKCQkYKtwenTA5q/agEjcB07
+jrR9mUY+UAn1p0WM/Lk+vHFSWlc2Lf7mDwT2rQt8jis6AkEZH41oQdRTREjwz4v+
+F57DxFJq1nbu9peJ5kxRc+XIPvE+gIwfzrpfDZaLTLZeeI1/HgV0njiVZbYxBirK
+pII6g1zOkyCOCIE84r0cBPncl2Dlajc62KTegPfvTs1RhmCsP7pq92rOvS5J+TMX
+oGaUUlKKxEPU1IHNRDrTxUM1Wxaik7GrUUmHX6is5TirEbHcv1FOLJmlY5yZvnP0
+H8qiR/mpjzfN+A/lTA3zZqzBMvg5WkpIiCtFAMliPNWBVRThqtKeKBoeajen1g65
+4jg0xzbxr511jOwHhPrTjFydkWot7GpLLHAm+V1RB3Y4FYV74qtYAwtkafHVuiiu
+M1jVL24Ia4YyBuRsfgfgaqW7SXMTLOdsQI3BT29Pqa6Y0Ety1BLc0LrxBdaihvJp
+HVGJEEXQAf3sfyrltTkLQyEnqK0ryUyP8oAA4AHQCsnUj/oz/StbJLQt7HpnhC9G
+o+EdPbdl44vKf6rx/KtURrn6etedfDvVfIe6sHbC7hIg+o5/lXo28EEgDn17141S
+PLNm0HeJm38CvIehz1GKyjZjzNxXGO9b9z1LDvWeTtYZCn8KVw5SxplruOAu4V1l
+muEC9Mdfc1l6eF8lfmA47VqwKM8CqTE1YtOPlyxyTxgdTUcSY/hCZ5pSecHqD+VT
+qoIGcYoEieBlIBByD3q35yxx9eQKzTKIxis3VdTENsxB5x60XsiWrs57xNqPnvNh
+uWfy1qhCSqKB2FZ80zXWoBf4YRk/7x6/pV6LPpXsZdS5KfM+pcn0Ni1uSAATkVav
+dXfTrQXHkGaEff2nBX3+lY8RI56VoRuk0LQSD5JFKkfWuupSjNWZm4l7T9esNQA8
+uQox/hk4rUrzG7hntLby1ifMRK71+bOPXHNbfh/xDOqpbXJLcfKHUg/hXBUwv8hL
+guh2o608VTtr+3uW2K4En909auCuGcJRdpIaTW49Rmp0Hzr9RUMfWrUYy6/WlHcm
+exw7P8/4D+VODc1n+fmXk9hVpD0Nas5UacDVO3WqUB6Ul7qtvaAIcyzf8806j6nt
+SSbdkaWb2LlUrjxHYWmUEnnSDqsfOPxrmdR1ie43JM4CH/llHwv4nvWI+pugxGqq
+OwArphQ6yNY0rbnTXHi+5mdljt2iT13cmuWuJ2luHkkOWZiSaik1OVuGqn5pLZNb
+pJbGmnQdeTEx7Rzg5FWtpgtxF/F1b61HZos1yHb7sY3nP6VLcEs2e7UwKMnXHXNU
+tSTFsVHXHNaQjJl9hWffy2+0xvPErk9GcA0nsS2ZOnXTadrcMoOAx2tXrFjqC3EK
+5OfxryPVIWimTIwQwrq9HvmWJQx7cHNediI+8OErOx3pnHrVeUxtnB2mqcMxdMnm
+gkN3zXLY2TNTT7gxfK0nFdFaXiYwCSK4+HjHWtS2lZcULQbOladSw571Os6hOO9Y
+iyEjP4024vSkX3j9KaZL2Ld5fBCeR+dczqt+WiZycKOme5p80zyvuOc+mawtamMj
+pAp+78z/AFPAH9aulD2lRRDZXEsw3keec5diTWnG5Dc8j1FRpEFs0UdMU6I4XB7V
+9HFJKxJeTJznmp1YKcHp71TRypFW92UzjIqwKd+VFw65++Ax/wA/hUEDR7xG4yuc
+/Q+op+osoaFs5yCM4rPL4kV8H61D0YGg73FvcM0o81DyroOR9R/h+Vamm+JnUKkp
+WZTx1+YVjrdpKgVifY0jiN8FlDkdG7j8aicIzVnqM9DtL63nYBZArnnaxwa1Yx86
+/UV5cs7928xcfdY4I/GtjQ/E09tMkNySyZ4STr+B71xTwdtYGc43WhkuuHyParUM
+vyjPagwgt+ArL1K8EJMUZ+tc8IOTsc0I8zLd1qm1TGjlR32nk/j2rFluhtKrhVPO
+BVGSc4PNVWmJbrXbGKirI6kktixLKDnmqTnc3WnMSefzqIggd6YwO3rURpWJ/wAK
+RRvkVSwUMQCewpCNO0Ty7QMR80h3fh2rJ1PxBaaflV/0if8AuoeB9TVbV9XknUxW
++6ODoD0Zx/Qe1cvJGWaok2tjOc30HX2v397uUyeVGf4I+M1QVA4wetWTaHHSkSIq
+3IrBxbephZt6l+PUCunqkr+eUPzRTDt2Kt1rc07V7Dy1G4xj0Y5x+Nc8bYSpgiqW
+2WylzgEZ6EcGiUf5ldFqTieuadN93DZQjII5BFauzocdfSuC8L+JIQY7W6cKM4jY
+/wAPsfb3r023t1lhV0JAP901xVIOLOmDTWhXiGKuwhCRgHNH2Qg8N+YqaKB84Z+v
+YCs2zSxYBbZ6VRmYk4/XFaLKFiA5JNVJ0S3gkublhHDGMsT2pJ9EHKUW2woZH6fT
+JPsK5S/1nS4L7yru5WO4ZvMZWz8o7A46HFUvE/ia6uB5VrmBMZXH3gOnPvXnszIj
+E53sTkmvSoU/YLme7MKlXse22t5a30Cm1uIpl/6ZsDTkXLEYrwlLiWOTfE7RuOhQ
+4roNO8ba3ZYElwLhB2mGTj69a7I4pP4kQq66nrSHBKt1qzDJsOG+6f0ridO+IGnX
+W1L6J7aTpuHzL/iP1rqrW7tryESW86TJ/eQ5xXRGpGWzNVJPYl1OEvHGc5Ct19iK
+pCAcAk1cvHK6ZM3JKAMKwTqLnksMAU5bjujUEEY708BQMbuO2awm1UDoTUJv5XJA
+J5NRzIOZHSgxg9R+dKPLY4JBGehFc7H57nljWjalw4BJ61SkNM3765FtwOZGHA9B
+jrXI3U252Oc5PerlzeS3Mpkf7zLx/wDW9qy5ckn5T+VckI8qsZwjyqxA0mahZ9rH
+60rq2TwePaoW3HIwc/SqKJw+eafnIqmuRxz+VSByOOaAJWFQyL6VOPmHSmtGcdDR
+YDEuIWZjVYW2D0rZeL5un6VE0PsfypWM2jPEGRUb2nPArT2Y6rS+WSOhosFjJSLB
+PFOkgSRCrjINaBg56VG0BI5BH0FKwrHPXFk9q+SCU/hYV1vhHxvPo8qW17mWzY4P
+PK+9UOMeXKmUPtVC40sxNujBaJuntWUqSZKTi7o+hrWS3vbWO4gcSROMqw71N5Kg
+cAV474I8VXHh2aW3vUeTTcEkjnY3bHv7Vc1v4p3dzG8Nhb/Z4zwGz8xHuf8ACuGW
+FlzWWx0KsranoWp67Y6aSrkzTgcQxckfU9BXA+JPEd1qEam7ljtrWNtywIOCexJ7
+1wsmr6tdSZFw0YPZBimFHlINzLJKR03NnFdVGhCGtrsiVVyVkN1C/m1CZvJDbD1Y
+9TVZNNkblzitJML91KkCu4+7W7gm7sy5b7meNPRepFBtUHbNaYtieufyqVLTPY0/
+ZoOVGL9n9B+lWLNrm0mEltLJE4/iQkGtgWQz0/SrCWIB4Xn6VSpjsjV07xRcPbS2
+1/D5oeNlEicHOOMjp17iqCJM4Xc2eO1WLazG4HH1GK1EtgAMJgVtZ9S0myjBZZXk
+Vdjt1XjH6VOse0dDSM4HQH8KdjRIVFAIx+tWoiA6jpz1NUP3jHIBqeESBwcNwfSm
+hn//2YkCOAQTAQgAIgUCXNbVKQIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AA
+CgkQKrEqetxVwAOgWBAAgewnppKesDIFGGNarl/JUkhLUyNxLS1MhtOhES+i6NOK
+x1GcM1/E9aw5Jyc8lcJp5jn5mkQ4JX8PXXfXbemAdfMih7y51Cx/RwYwUskqkA25
+Y6pm02vhXxIaWmHTDnNDgsPWGAOpm8guzHFZZmGlmF25TDu0MsiJDy/j09Y3w0he
+7TIKWVz04z8Lj+g7YOfAAQQDMVo1ShxtbgOFdnRJeOcYZlENUd99y99+Zsdk3Ubc
+keQsEUnW6S8rjuZi3zsjE+yeddY8Mnl/yyzCutv1lvrfk/WZ7ZYuhPBNveDTOEyl
+N4/guRkVyyfs9k4Yo2LowW2lDoNoN48UlrxJEHXZ+9qad+7oTjYJ4tUNUCeb38gE
+obp4McQqeHYWK4hsVS0nJnJ3toLCYJ8dfMJ/MEFdr3qmOLi7J3y6PFtuJr0bGQ4k
+wwObqLqxb94I5AnOM4STWDc3JtsxwnnrLCX+1ehzFaCOHr/aiWDpypL1WsIoV0R8
+wr+e5Ujysbn9VsnNtmKigUvV7pMPEx0SYRf6x9GM9OnNiw9LW6AfEYR6N8sx5iBi
++tHWlbQRYF5j/HCf7INXmX7vA26nKObQU6rhyaSFJzvHvWbJUqT2kxqCoqOjf04p
+dSVKgG0bSnKJZLin4yZ+PJ0oQnOClSGxDpI4Yn4Cst6S/MjOMmtmZDFe5sl3zZ+J
+ARwEEAEIAAYFAlzW1tYACgkQmV41IhrYTf+BtQf+JEhjggRITJD0hCUPf14WCn1e
+Zg+p1CqOcypxB2S66W9tOg9zTGAIcMWh/erhC185oyqXWGNQE5BtvPmMbeQ0vabF
+a1C42+vPuPB045qbcOOrGPA/WiiY4iYkvXMy5FlLXEEYA2I27+HaHHO4sxZhclkN
+VnMxHCh6MBdXYHbR3AdhPOR8fcg29IsMk8QqIsV8lKrv1NDXgdF6y5Pa764dnqkk
+rere7WEv3uOpv0MC80qjZosxQB4Mypd8YmS3aKM/B9R9nBBCDFAeJPlCENMb5ZdD
+Nk4uNCYuAaAoLLlC0v823zhiAi/8hkBD+XxSWNPQtoJzx78hXflH0fGOiPzLC7kC
+DQRc1tThARAAxNRrcpany4fujNqaDiUTFzlsrtRo1dzkGOishbDEl+1m2HCHbo2Z
+lXcXqd+e9YTsidCaPHbYPP1VoE4Be9yaicK5yRXl843W0Y7nIuCJOAFtqIrDBuFX
+hZuFUL1rMNdUfuZlYOBnWXxVAvZpacpY03Y2hHkumlWe13wngKJWZt089VWiqDIK
+xaXwIG6MirppxarFNUgf6J+z0ZK5Qn1Xl0JRsyZ6BCxNv7vNfH2EgaYS983Cljec
+cgVHO0SQ5saJIjyj3sdfo/4FxnrGdgNufIPCknSE+7TsBuowRyVZf6L5IKtFYFhA
+Wo4zG9NveJdFcVsuUxKzSZeOBvAuCq5+r89Mw6NrxaaBvINCE1pGJK4Q7EIfgyDu
+sr7xnlUhGuwQM1GKSRp95IeOYlmnWoAcPfMIxR3Mu6Hg593xCd8jVB6nbtcUKD5S
+DOmvo7NFQxLbX4adLwqf2/VMfks8mBgJUG+Cx0L/aQpPL9NA2FjxTwNjdVpbmt+Q
+acABBzoQ7XQzdOG9K+cJVODLZo3RNN4G1FGiTIJuxYWTFXNWVv+RSn1RmdIf5kdF
+K1LUfOrPvZM3FX2OkGy++61kHIxOIT/D0ednGz/fgly3ff8EuxSNCikVlhuxYtx8
+QnMvMOFpEb13Jj+F9pQ1O/8V9PsSo7kk5wuHC01CBodHc5Gu0clhBm0AEQEAAYkC
+HwQYAQgACQUCXNbU4QIbDAAKCRAqsSp63FXAA728EAChAYvY4KgqJyrUd6OGDq2w
+7USK1bwsMXK73nKY5gGwmuyv5U9ZesIY7gNS6SCWuPNH+zRPJ2pzUHTsZz+S5/Cp
+OW/LnEa6908J6drNyzkKgH1gciwwnWRjYg/dHOxTh3GBTag+IOubvZSHyLbPcgTx
+NQpdftuDSnmBTJKpsRVUQNT8AL2yqz7lDH4Gr2RMtNYVX11P/reQiGvQpjvVNWGO
+AmJaC79ZTKvk6MP9yHKskoF0VMsf7LwNzR9YY14ZoaPziObDN2xgcqzhP5QeoQFO
+D6jbT1D22797v5j7hGOrdTalJ6hbOvrTDfpIKLouk3QfblIBU7Be93rIrOIdgzPh
+RrsxjdGnY5v9AdSMO8nT1xOWhJvyZhsPEcRhdf4EE15wohOQEu9HwS/51qfGjaYG
+Fj2vQfXOKs2jA3zIMDmnEk4g5ZC/PsltbB7jyza6jjncIYcv9r/CMkS7s7NUivXD
+RtwvDgfBfC20+FDeOIIDUGd7B24Oge0a5tER+9np2n8w5Ayn/saajZO1O0kSQW7b
+Iox2IWgDPkDdGC/aRpg1IX6vJrEJgxS0pDQf0FH0Auy3uqgBuFNYa4erzFxSYHGW
+NrZCp0H4kt/ZaEnE9n4LKD94yF8bTw6lO5/yidRBoVe28l34aKMvzr62cqezzjIJ
+B+RdjYxImSzlmE2uJO6PKA==
+=Om41
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/httpd.spec b/httpd.spec
index e5bd540..cb54fb4 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,36 +13,40 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.41
-Release: 6%{?dist}
+Release: 7%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
-Source2: httpd.logrotate
-Source3: instance.conf
-Source4: httpd-ssl-pass-dialog
-Source5: httpd.tmpfiles
-Source6: httpd.service
-Source7: action-graceful.sh
-Source8: action-configtest.sh
-Source9: server-status.conf
-Source10: httpd.conf
-Source11: 00-base.conf
-Source12: 00-mpm.conf
-Source13: 00-lua.conf
-Source14: 01-cgi.conf
-Source15: 00-dav.conf
-Source16: 00-proxy.conf
-Source17: 00-ssl.conf
-Source18: 01-ldap.conf
-Source19: 00-proxyhtml.conf
-Source20: userdir.conf
-Source21: ssl.conf
-Source22: welcome.conf
-Source23: manual.conf
-Source24: 00-systemd.conf
-Source25: 01-session.conf
-Source26: 10-listen443.conf
-Source27: httpd.socket
-Source28: 00-optional.conf
+Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
+# gpg key file downloaded and verified by luhliarik
+# https://httpd.apache.org/dev/verification.html
+Source2: https://dist.apache.org/repos/dist/release/httpd/KEYS
+Source3: httpd.logrotate
+Source4: instance.conf
+Source5: httpd-ssl-pass-dialog
+Source6: httpd.tmpfiles
+Source7: httpd.service
+Source8: action-graceful.sh
+Source9: action-configtest.sh
+Source10: server-status.conf
+Source11: httpd.conf
+Source12: 00-base.conf
+Source13: 00-mpm.conf
+Source14: 00-lua.conf
+Source15: 01-cgi.conf
+Source16: 00-dav.conf
+Source17: 00-proxy.conf
+Source18: 00-ssl.conf
+Source19: 01-ldap.conf
+Source20: 00-proxyhtml.conf
+Source21: userdir.conf
+Source22: ssl.conf
+Source23: welcome.conf
+Source24: manual.conf
+Source25: 00-systemd.conf
+Source26: 01-session.conf
+Source27: 10-listen443.conf
+Source28: httpd.socket
+Source29: 00-optional.conf
 Source30: README.confd
 Source31: README.confmod
 Source32: httpd.service.xml
@@ -55,6 +59,7 @@ Source43: httpd-ssl-gencerts
 Source44: httpd@.service
 Source45: config.layout
 Source46: apachectl.sh
+
 # build/scripts patches
 Patch2: httpd-2.4.9-apxs.patch
 Patch3: httpd-2.4.1-deplibs.patch
@@ -195,6 +200,7 @@ The mod_session module and associated backends provide an abstract
 interface for storing and accessing per-user session data.
 
 %prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q
 %patch2 -p1 -b .apxs
 %patch3 -p1 -b .deplibs
@@ -740,6 +746,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Nov 11 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.41-7
+- add automatic source tarball signature verification in %prep section
+
 * Fri Oct  4 2019 Joe Orton <jorton@redhat.com> - 2.4.41-6
 - mod_cgid/mod_cgi: further upstream consolidation patches
 
diff --git a/sources b/sources
index c6aa939..974c309 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 SHA512 (httpd-2.4.41.tar.bz2) = 350cc7dcd2c439e0590338fa6da3f44df44f9bb885c381e91f91b14c2f48597f6f0bbac0ea118a8a67eaa70ae7edbb769beace368643ed73f6daee44c307b335
+SHA512 (httpd-2.4.41.tar.bz2.asc) = 3c9173dcaf4e170d87f7cca99e6878424b01d009869742b9077421dbae60acbd102d696e03fccd927f9d688e30f07f9d2d78473ce0bbfbb4a3090ae365121c44

From 087f93d4806e936210483ff6e255682b836fdf42 Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Mon, 11 Nov 2019 17:37:37 +0100
Subject: [PATCH 190/359] Added missing BuildRequires for verifing src tarball

---
 httpd.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/httpd.spec b/httpd.spec
index cb54fb4..5181a15 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -95,6 +95,7 @@ BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto
 BuildRequires: perl-interpreter, perl-generators, systemd-devel
 BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0
+BuildRequires: gnupg2
 Requires: /etc/mime.types, system-logos-httpd
 Obsoletes: httpd-suexec
 Provides: webserver

From 9d23b8bc3a358208a045aba71fbe07696c9850fd Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 13 Nov 2019 17:39:53 +0000
Subject: [PATCH 191/359] apachectl: in graceful/graceful-stop, only signal
 main process (#1758798) Resolves: rhbz#1758798

---
 apachectl.sh | 4 ++--
 httpd.spec   | 5 ++++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/apachectl.sh b/apachectl.sh
index e0f6f78..766cfba 100755
--- a/apachectl.sh
+++ b/apachectl.sh
@@ -39,14 +39,14 @@ start|stop|restart|status)
     ;;
 graceful)
     if /usr/bin/systemctl -q is-active $SVC; then
-        /usr/bin/systemctl kill --signal=SIGUSR1 $SVC
+        /usr/bin/systemctl kill --signal=SIGUSR1 --kill-who=main $SVC
     else
         /usr/bin/systemctl start $SVC
     fi
     ERROR=$?
     ;;
 graceful-stop)
-    /usr/bin/systemctl kill --signal=SIGWINCH $SVC
+    /usr/bin/systemctl kill --signal=SIGWINCH --kill-who=main $SVC
     ERROR=$?
     ;;
 configtest|-t)
diff --git a/httpd.spec b/httpd.spec
index 5181a15..46d518f 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.41
-Release: 7%{?dist}
+Release: 8%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -747,6 +747,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Nov 13 2019 Joe Orton <jorton@redhat.com> - 2.4.41-8
+- apachectl: in graceful/graceful-stop, only signal main process (#1758798)
+
 * Mon Nov 11 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.41-7
 - add automatic source tarball signature verification in %prep section
 

From 401f5d1ca77b71fa5dd446d556ad9c795f3261b0 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 21 Nov 2019 16:54:17 +0000
Subject: [PATCH 192/359] mod_ssl: fix request body buffering w/TLSv1.3 PHA
 (#1775146) Resolves: rhbz#1775146

---
 httpd-2.4.41-r1870095.patch | 119 ++++++++++++++++++++++++++++++++++++
 httpd.spec                  |   7 ++-
 2 files changed, 125 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.41-r1870095.patch

diff --git a/httpd-2.4.41-r1870095.patch b/httpd-2.4.41-r1870095.patch
new file mode 100644
index 0000000..5f5b2e2
--- /dev/null
+++ b/httpd-2.4.41-r1870095.patch
@@ -0,0 +1,119 @@
+# ./pullrev.sh 1870095
+http://svn.apache.org/viewvc?view=revision&revision=1870095
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1775146
+
+--- httpd-2.4.41/modules/ssl/ssl_engine_kernel.c
++++ httpd-2.4.41/modules/ssl/ssl_engine_kernel.c
+@@ -114,6 +114,45 @@
+     return result;
+ }
+ 
++/* If a renegotiation is required for the location, and the request
++ * includes a message body (and the client has not requested a "100
++ * Continue" response), then the client will be streaming the request
++ * body over the wire already.  In that case, it is not possible to
++ * stop and perform a new SSL handshake immediately; once the SSL
++ * library moves to the "accept" state, it will reject the SSL packets
++ * which the client is sending for the request body.
++ *
++ * To allow authentication to complete in the hook, the solution used
++ * here is to fill a (bounded) buffer with the request body, and then
++ * to reinject that request body later.
++ *
++ * This function is called to fill the renegotiation buffer for the
++ * location as required, or fail.  Returns zero on success or HTTP_
++ * error code on failure.
++ */
++static int fill_reneg_buffer(request_rec *r, SSLDirConfigRec *dc)
++{
++    int rv;
++    apr_size_t rsize;
++
++    /* ### this is HTTP/1.1 specific, special case for protocol? */
++    if (r->expecting_100 || !ap_request_has_body(r)) {
++        return 0;
++    }
++
++    rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE : dc->nRenegBufferSize;
++    if (rsize > 0) {
++        /* Fill the I/O buffer with the request body if possible. */
++        rv = ssl_io_buffer_fill(r, rsize);
++    }
++    else {
++        /* If the reneg buffer size is set to zero, just fail. */
++        rv = HTTP_REQUEST_ENTITY_TOO_LARGE;
++    }
++
++    return rv;
++}
++
+ #ifdef HAVE_TLSEXT
+ static int ap_array_same_str_set(apr_array_header_t *s1, apr_array_header_t *s2)
+ {
+@@ -814,41 +853,14 @@
+         }
+     }
+ 
+-    /* If a renegotiation is now required for this location, and the
+-     * request includes a message body (and the client has not
+-     * requested a "100 Continue" response), then the client will be
+-     * streaming the request body over the wire already.  In that
+-     * case, it is not possible to stop and perform a new SSL
+-     * handshake immediately; once the SSL library moves to the
+-     * "accept" state, it will reject the SSL packets which the client
+-     * is sending for the request body.
+-     *
+-     * To allow authentication to complete in this auth hook, the
+-     * solution used here is to fill a (bounded) buffer with the
+-     * request body, and then to reinject that request body later.
+-     */
+-    if (renegotiate && !renegotiate_quick
+-        && !r->expecting_100
+-        && ap_request_has_body(r)) {
+-        int rv;
+-        apr_size_t rsize;
+-
+-        rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE :
+-                                                dc->nRenegBufferSize;
+-        if (rsize > 0) {
+-            /* Fill the I/O buffer with the request body if possible. */
+-            rv = ssl_io_buffer_fill(r, rsize);
+-        }
+-        else {
+-            /* If the reneg buffer size is set to zero, just fail. */
+-            rv = HTTP_REQUEST_ENTITY_TOO_LARGE;
+-        }
+-
+-        if (rv) {
++    /* Fill reneg buffer if required. */
++    if (renegotiate && !renegotiate_quick) {
++        rc = fill_reneg_buffer(r, dc);
++        if (rc) {
+             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02257)
+                           "could not buffer message body to allow "
+                           "SSL renegotiation to proceed");
+-            return rv;
++            return rc;
+         }
+     }
+ 
+@@ -1132,7 +1144,18 @@
+             }
+         }
+ 
++        /* Fill reneg buffer if required. */
+         if (change_vmode) {
++            rc = fill_reneg_buffer(r, dc);
++            if (rc) {
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO()
++                              "could not buffer message body to allow "
++                              "TLS Post-Handshake Authentication to proceed");
++                return rc;
++            }
++        }
++
++        if (change_vmode) {
+             char peekbuf[1];
+ 
+             if (r->connection->master) {
diff --git a/httpd.spec b/httpd.spec
index 46d518f..7ad5c6c 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.41
-Release: 8%{?dist}
+Release: 9%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -87,6 +87,7 @@ Patch42: httpd-2.4.41-r1828172+.patch
 Patch58: httpd-2.4.34-r1738878.patch
 Patch60: httpd-2.4.34-enable-sslv3.patch
 Patch61: httpd-2.4.41-r1865749.patch
+Patch62: httpd-2.4.41-r1870095.patch
 
 # Security fixes
 
@@ -227,6 +228,7 @@ interface for storing and accessing per-user session data.
 %patch58 -p1 -b .r1738878
 %patch60 -p1 -b .enable-sslv3
 %patch61 -p1 -b .r1865749
+%patch62 -p1 -b .r1870095
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -747,6 +749,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Nov 21 2019 Joe Orton <jorton@redhat.com> - 2.4.41-9
+- mod_ssl: fix request body buffering w/TLSv1.3 PHA (#1775146)
+
 * Wed Nov 13 2019 Joe Orton <jorton@redhat.com> - 2.4.41-8
 - apachectl: in graceful/graceful-stop, only signal main process (#1758798)
 

From b3ceae982ac37ef9c23ab794ab0b300da6d9d5ff Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 21 Nov 2019 16:56:37 +0000
Subject: [PATCH 193/359] mod_ssl: fix request body buffering w/TLSv1.3 PHA
 (#1775146)

---
 ...-r1870095.patch => httpd-2.4.41-r1870095+.patch | 14 ++++++--------
 httpd.spec                                         |  2 +-
 2 files changed, 7 insertions(+), 9 deletions(-)
 rename httpd-2.4.41-r1870095.patch => httpd-2.4.41-r1870095+.patch (96%)

diff --git a/httpd-2.4.41-r1870095.patch b/httpd-2.4.41-r1870095+.patch
similarity index 96%
rename from httpd-2.4.41-r1870095.patch
rename to httpd-2.4.41-r1870095+.patch
index 5f5b2e2..f29e6f2 100644
--- a/httpd-2.4.41-r1870095.patch
+++ b/httpd-2.4.41-r1870095+.patch
@@ -1,7 +1,6 @@
-# ./pullrev.sh 1870095
+# ./pullrev.sh 1870095 1870097
 http://svn.apache.org/viewvc?view=revision&revision=1870095
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1775146
+http://svn.apache.org/viewvc?view=revision&revision=1870097
 
 --- httpd-2.4.41/modules/ssl/ssl_engine_kernel.c
 +++ httpd-2.4.41/modules/ssl/ssl_engine_kernel.c
@@ -98,22 +97,21 @@ https://bugzilla.redhat.com/show_bug.cgi?id=1775146
          }
      }
  
-@@ -1132,7 +1144,18 @@
+@@ -1132,6 +1144,17 @@
              }
          }
  
 +        /* Fill reneg buffer if required. */
-         if (change_vmode) {
++        if (change_vmode) {
 +            rc = fill_reneg_buffer(r, dc);
 +            if (rc) {
-+                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO()
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10228)
 +                              "could not buffer message body to allow "
 +                              "TLS Post-Handshake Authentication to proceed");
 +                return rc;
 +            }
 +        }
 +
-+        if (change_vmode) {
+         if (change_vmode) {
              char peekbuf[1];
  
-             if (r->connection->master) {
diff --git a/httpd.spec b/httpd.spec
index 7ad5c6c..51ea1da 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -87,7 +87,7 @@ Patch42: httpd-2.4.41-r1828172+.patch
 Patch58: httpd-2.4.34-r1738878.patch
 Patch60: httpd-2.4.34-enable-sslv3.patch
 Patch61: httpd-2.4.41-r1865749.patch
-Patch62: httpd-2.4.41-r1870095.patch
+Patch62: httpd-2.4.41-r1870095+.patch
 
 # Security fixes
 

From 11b0ed9c902132a4a3e400d68233c76ba2d05807 Mon Sep 17 00:00:00 2001
From: "FeRD (Frank Dana)" <ferdnyc@gmail.com>
Date: Sat, 7 Dec 2019 21:27:47 -0500
Subject: [PATCH 194/359] Add man page for Fedora apachectl

---
 apachectl.xml | 173 ++++++++++++++++++++++++++++++++++++++++++++++++++
 httpd.spec    |  11 +++-
 2 files changed, 182 insertions(+), 2 deletions(-)
 create mode 100644 apachectl.xml

diff --git a/apachectl.xml b/apachectl.xml
new file mode 100644
index 0000000..0294374
--- /dev/null
+++ b/apachectl.xml
@@ -0,0 +1,173 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+  "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">[
+
+]>
+<!--
+ Copyright 2018 Red Hat, Inc.
+
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<refentry>
+  <refentryinfo>
+    <title>apachectl</title>
+    <productname>httpd</productname>
+    <corpauthor>Apache Software Foundation</corpauthor>
+    <editor><contrib>Fedora man page</contrib><surname>Dana</surname><firstname>Frank</firstname><email>ferdnyc@gmail.com</email></editor>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>apachectl</refentrytitle>
+    <manvolnum>8</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>apachectl</refname>
+    <refpurpose>Server control interface for httpd</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv id='synopsis'>
+    <cmdsynopsis>
+      <command>apachectl</command>
+      <arg choice='opt'><replaceable>command</replaceable> </arg>
+      <sbr/>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+
+<!-- body begins here -->
+  <refsect1 id='description'>
+    <title>DESCRIPTION</title>
+
+    <para><command>apachectl</command> is a front end to the Apache HyperText
+    Transfer Protocol (HTTP) server. It is designed to help the
+    administrator control the functioning of the Apache
+    <command>httpd</command> daemon.</para>
+
+    <para>The <command>apachectl</command> script takes one-word arguments like
+    <option>start</option>,
+    <option>restart</option>, and
+    <option>stop</option>, and translates them
+    into appropriate signals to <command>httpd</command>.</para>
+
+    <para>The <command>apachectl</command> script returns a 0 exit value on
+    success, and &gt;0 if an error occurs.</para>
+
+  </refsect1>
+
+  <refsect1 id='options'>
+    <title>OPTIONS</title>
+    <variablelist remap='TP'>
+      <varlistentry>
+        <term><option>start</option></term>
+        <listitem>
+          <para>Start the Apache <command>httpd</command> daemon. Gives an error if it
+          is already running. This is equivalent to <command>systemctl start httpd.service</command>.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>stop</option></term>
+        <listitem>
+          <para>Stops the Apache <command>httpd</command> daemon. This is equivalent to
+          <command>systemctl stop httpd.service</command>.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>restart</option></term>
+        <listitem>
+          <para>Restarts the Apache <command>httpd</command> daemon. If the daemon is
+          not running, it is started. This is equivalent
+          to <command>systemctl restart httpd.service</command>.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>status</option></term>
+        <listitem>
+          <para>Displays a brief status report. This is equivalent to <command>systemctl status httpd.service.</command></para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>graceful</option></term>
+        <listitem>
+          <para>Gracefully restarts the Apache <command>httpd</command> daemon. If the
+          daemon is not running, it is started. This differs from a normal
+          restart in that currently open connections are not aborted. A side
+          effect is that old log files will not be closed immediately. This
+          means that if used in a log rotation script, a substantial delay may
+          be necessary to ensure that the old log files are closed before
+          processing them. This is equivalent to
+          <command>systemctl kill --signal=SIGUSR1 --kill-who=main httpd.service</command>.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>graceful-stop</option></term>
+        <listitem>
+          <para>Gracefully stops the Apache <command>httpd</command> daemon.
+          This differs from a normal stop in that currently open connections are not
+          aborted. A side effect is that old log files will not be closed immediately.
+          This is equivalent to
+          <command>systemctl kill --signal=SIGWINCH --kill-who=main httpd.service</command>.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>configtest</option></term>
+        <listitem>
+          <para>Run a configuration file syntax test. It parses the configuration
+          files and either reports <literal>Syntax Ok</literal>
+          or detailed information about the particular syntax error. This is
+          equivalent to <command>httpd -t</command>.</para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+
+    <para>The following options were available in earlier versions but have been removed.</para>
+
+    <variablelist remap='TP'>
+      <varlistentry>
+        <term><option>fullstatus</option></term>
+        <listitem>
+          <para>Displays a full status report from <literal>mod_status</literal>.
+          For this to work, you need to have <literal>mod_status</literal> enabled
+          on your server and a text-based browser such as <command>lynx</command>
+          available on your system. The URL used to access the status report
+          can be set by editing the <literal>STATUSURL</literal> variable in the
+          script.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>startssl</option></term>
+        <listitem>
+          <para>To start <command>httpd</command> with SSL support, you should edit
+          your configuration file to include the relevant directives and then
+          use the normal <command>apachectl start</command>.</para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1 id='bugs'>
+    <title>BUGS</title>
+    <para>Please report bugs by filing an issue against the "httpd" component of the "Fedora"
+    project, in <ulink url='https://bugzilla.redhat.com/'>RedHat Bugzilla</ulink>.</para>
+  </refsect1>
+
+</refentry>
diff --git a/httpd.spec b/httpd.spec
index 51ea1da..8c94a49 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.41
-Release: 9%{?dist}
+Release: 10%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -59,6 +59,7 @@ Source43: httpd-ssl-gencerts
 Source44: httpd@.service
 Source45: config.layout
 Source46: apachectl.sh
+Source47: apachectl.xml
 
 # build/scripts patches
 Patch2: httpd-2.4.9-apxs.patch
@@ -269,6 +270,9 @@ xmlto man ./httpd.conf.xml
 xmlto man $RPM_SOURCE_DIR/htcacheclean.service.xml
 xmlto man $RPM_SOURCE_DIR/httpd.service.xml
 
+# apachectl.xml => apachectl.8
+xmlto man %{SOURCE47}
+
 : Building with MMN %{mmn}, MMN-ISA %{mmnisa}
 : Default MPM is %{mpm}, vendor string is '%{vstring}'
 
@@ -498,7 +502,7 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.logrotate \
 # Install man pages
 install -d $RPM_BUILD_ROOT%{_mandir}/man8 $RPM_BUILD_ROOT%{_mandir}/man5
 install -m 644 -p httpd.service.8 httpd-init.service.8 httpd.socket.8 \
-        httpd@.service.8 htcacheclean.service.8 \
+        httpd@.service.8 htcacheclean.service.8 apachectl.8 \
         $RPM_BUILD_ROOT%{_mandir}/man8
 install -m 644 -p httpd.conf.5 \
         $RPM_BUILD_ROOT%{_mandir}/man5
@@ -749,6 +753,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Sat Dec  7 2019 FeRD (Frank Dana) <ferdnyc@gmail.com> - 2.4.41-10
+- apachectl: Add man page for Fedora version
+
 * Thu Nov 21 2019 Joe Orton <jorton@redhat.com> - 2.4.41-9
 - mod_ssl: fix request body buffering w/TLSv1.3 PHA (#1775146)
 

From cf848007cc4315eb14c5901f5c90d23ece194bab Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 2 Dec 2019 16:38:59 +0000
Subject: [PATCH 195/359] Fix documentation of posttrans and expand text.

---
 httpd.service.xml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/httpd.service.xml b/httpd.service.xml
index c518549..a57c2d6 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -175,12 +175,16 @@ Wants=network-online.target</programlisting>
       <para>System packages (including the httpd package itself) may
       restart the httpd service automatically after packages are
       upgraded, installed, or removed. This is done using the
-      <command>systemctl reload httpd.service</command>, which
-      produces a <emphasis>graceful</emphasis> restart by default as
-      described above.</para>
+      <command>systemctl try-restart httpd.service</command>, which
+      stops then starts the service if it is running.</para>
 
-      <para>To suppress automatic reloads entirely, create the file
-      <filename>/etc/sysconfig/httpd-disable-posttrans</filename>.</para>
+      <para>To disable automatic restarts, create the file
+      <filename>/etc/sysconfig/httpd-disable-posttrans</filename>.
+      When <command>httpd</command> interfaces are added in an update,
+      it may not be safe to <emphasis>reload</emphasis> a running
+      service after upgrading, if updated modules require interfaces
+      only available in the updated httpd.  It is recommended to allow
+      automatic restarts for this reason.</para>
     </refsect2>
 
     <refsect2>

From 73594f69fff617d374554b08158ee6fd644b98c2 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 6 Jan 2020 12:51:23 +0000
Subject: [PATCH 196/359] add compatibility section, remove deprecated options,
 add see also

---
 .gitignore    |  1 +
 apachectl.xml | 84 +++++++++++++++++++++++++++++++--------------------
 2 files changed, 52 insertions(+), 33 deletions(-)

diff --git a/.gitignore b/.gitignore
index d92b5da..351e025 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,3 +34,4 @@ x86_64
 /htcacheclean.service.8
 /httpd.conf.5
 /httpd-2.4.41.tar.bz2.asc
+/apachectl.8
diff --git a/apachectl.xml b/apachectl.xml
index 0294374..223e35d 100644
--- a/apachectl.xml
+++ b/apachectl.xml
@@ -4,7 +4,7 @@
 
 ]>
 <!--
- Copyright 2018 Red Hat, Inc.
+ Copyright 2020 Red Hat, Inc.
 
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements. See the NOTICE file distributed with
@@ -25,7 +25,7 @@
   <refentryinfo>
     <title>apachectl</title>
     <productname>httpd</productname>
-    <corpauthor>Apache Software Foundation</corpauthor>
+    <corpauthor>Apache Software Foundation and contributors</corpauthor>
     <editor><contrib>Fedora man page</contrib><surname>Dana</surname><firstname>Frank</firstname><email>ferdnyc@gmail.com</email></editor>
   </refentryinfo>
 
@@ -49,7 +49,7 @@
 
 <!-- body begins here -->
   <refsect1 id='description'>
-    <title>DESCRIPTION</title>
+    <title>Description</title>
 
     <para><command>apachectl</command> is a front end to the Apache HyperText
     Transfer Protocol (HTTP) server. It is designed to help the
@@ -65,10 +65,42 @@
     <para>The <command>apachectl</command> script returns a 0 exit value on
     success, and &gt;0 if an error occurs.</para>
 
+    <refsect2 id="compatibility">
+      <title>Compatibility</title>
+
+      <para>The version of <command>apachectl</command> used on this
+      system is a replacement script intended to be mostly (but not
+      completely) compatible with version provided with
+      <emphasis>Apache httpd</emphasis>.  This
+      <command>apachectl</command> mostly acts as a wrapper around
+      <command>systemctl</command> and manipulates the
+      <command>systemd</command> service for <command>httpd</command>.
+      The interface to the <emphasis>Apache</emphasis> version of
+      <command>apachectl</command> is described at <ulink
+      url="https://httpd.apache.org/docs/2.4/programs/apachectl.html"/>.</para>
+
+      <para>The following differences are present in the version of
+      <command>apachectl</command> present on this system:
+
+      <itemizedlist>
+        <listitem><para>Option arguments passed when starting
+        <command>httpd</command> are not allowed.  These should be
+        configured in the systemd service directly (see <citerefentry><refentrytitle>httpd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>).</para></listitem>
+
+        <listitem><para>The <command>"fullstatus"</command> option is
+        not available.</para></listitem>
+
+        <listitem><para>The <command>"status"</command> option does
+        not use or rely on the running server's
+        <emphasis>server-status</emphasis> output.</para></listitem>
+      </itemizedlist>
+
+      </para>
+    </refsect2>
   </refsect1>
 
   <refsect1 id='options'>
-    <title>OPTIONS</title>
+    <title>Options</title>
     <variablelist remap='TP'>
       <varlistentry>
         <term><option>start</option></term>
@@ -131,43 +163,29 @@
         <term><option>configtest</option></term>
         <listitem>
           <para>Run a configuration file syntax test. It parses the configuration
-          files and either reports <literal>Syntax Ok</literal>
+          files and either reports <literal>Syntax OK</literal>
           or detailed information about the particular syntax error. This is
           equivalent to <command>httpd -t</command>.</para>
         </listitem>
       </varlistentry>
     </variablelist>
-
-    <para>The following options were available in earlier versions but have been removed.</para>
-
-    <variablelist remap='TP'>
-      <varlistentry>
-        <term><option>fullstatus</option></term>
-        <listitem>
-          <para>Displays a full status report from <literal>mod_status</literal>.
-          For this to work, you need to have <literal>mod_status</literal> enabled
-          on your server and a text-based browser such as <command>lynx</command>
-          available on your system. The URL used to access the status report
-          can be set by editing the <literal>STATUSURL</literal> variable in the
-          script.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>startssl</option></term>
-        <listitem>
-          <para>To start <command>httpd</command> with SSL support, you should edit
-          your configuration file to include the relevant directives and then
-          use the normal <command>apachectl start</command>.</para>
-        </listitem>
-      </varlistentry>
-    </variablelist>
   </refsect1>
 
   <refsect1 id='bugs'>
-    <title>BUGS</title>
-    <para>Please report bugs by filing an issue against the "httpd" component of the "Fedora"
-    project, in <ulink url='https://bugzilla.redhat.com/'>RedHat Bugzilla</ulink>.</para>
+    <title>Bugs</title>
+    <para>Please report bugs by filing an issue in Bugzilla via <ulink url='https://bugzilla.redhat.com/'/>.</para>
+  </refsect1>
+
+    <refsect1>
+    <title>See also</title>
+
+    <para>
+    <citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>httpd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>httpd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    </para>
   </refsect1>
 
 </refentry>

From 289df822ec41f3a324edfa270f8bd162ce300446 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 6 Jan 2020 14:04:38 +0000
Subject: [PATCH 197/359] apachectl(8): update authors

---
 apachectl.xml | 4 ++--
 httpd.spec    | 5 ++++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/apachectl.xml b/apachectl.xml
index 223e35d..5e40832 100644
--- a/apachectl.xml
+++ b/apachectl.xml
@@ -25,8 +25,8 @@
   <refentryinfo>
     <title>apachectl</title>
     <productname>httpd</productname>
-    <corpauthor>Apache Software Foundation and contributors</corpauthor>
-    <editor><contrib>Fedora man page</contrib><surname>Dana</surname><firstname>Frank</firstname><email>ferdnyc@gmail.com</email></editor>
+    <author><contrib>Apache man page</contrib><othername>Apache Software Foundation contributors</othername></author>
+    <author><contrib>Fedora man page</contrib><surname>Dana</surname><firstname>Frank</firstname></author>
   </refentryinfo>
 
   <refmeta>
diff --git a/httpd.spec b/httpd.spec
index 8c94a49..a08e7df 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.41
-Release: 10%{?dist}
+Release: 11%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -753,6 +753,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Jan  6 2020 Joe Orton <jorton@redhat.com> - 2.4.41-11
+- apachectl(8): update authors
+
 * Sat Dec  7 2019 FeRD (Frank Dana) <ferdnyc@gmail.com> - 2.4.41-10
 - apachectl: Add man page for Fedora version
 

From 603815e57425ae84e2f094a1b5f9b922f2c7a292 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 20 Jan 2020 09:09:56 +0000
Subject: [PATCH 198/359] mod_systemd: fix timeouts on reload w/ExtendedStatus
 off (#1590877) Resolves: rhbz#1590877

---
 ...ystemd.patch => httpd-2.4.41-systemd.patch | 77 +++++++++----------
 httpd.spec                                    |  7 +-
 2 files changed, 41 insertions(+), 43 deletions(-)
 rename httpd-2.4.33-systemd.patch => httpd-2.4.41-systemd.patch (76%)

diff --git a/httpd-2.4.33-systemd.patch b/httpd-2.4.41-systemd.patch
similarity index 76%
rename from httpd-2.4.33-systemd.patch
rename to httpd-2.4.41-systemd.patch
index 7f5ee3b..5369bd9 100644
--- a/httpd-2.4.33-systemd.patch
+++ b/httpd-2.4.41-systemd.patch
@@ -1,5 +1,5 @@
---- httpd-2.4.33/modules/arch/unix/config5.m4.systemd
-+++ httpd-2.4.33/modules/arch/unix/config5.m4
+--- httpd-2.4.41/modules/arch/unix/config5.m4.systemd
++++ httpd-2.4.41/modules/arch/unix/config5.m4
 @@ -18,6 +18,16 @@
    fi
  ])
@@ -17,9 +17,9 @@
  APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
  
  APACHE_MODPATH_FINISH
---- httpd-2.4.33/modules/arch/unix/mod_systemd.c.systemd
-+++ httpd-2.4.33/modules/arch/unix/mod_systemd.c
-@@ -0,0 +1,223 @@
+--- httpd-2.4.41/modules/arch/unix/mod_systemd.c.systemd
++++ httpd-2.4.41/modules/arch/unix/mod_systemd.c
+@@ -0,0 +1,218 @@
 +/* Licensed to the Apache Software Foundation (ASF) under one or more
 + * contributor license agreements.  See the NOTICE file distributed with
 + * this work for additional information regarding copyright ownership.
@@ -87,8 +87,15 @@
 +    return apr_psprintf(p, "%s port %u", addr, sa->port);
 +}
 +
++/* Report the service is ready in post_config, which could be during
++ * startup or after a reload.  The server could still hit a fatal
++ * startup error after this point during ap_run_mpm(), so this is
++ * perhaps too early, but by post_config listen() has been called on
++ * the TCP ports so new connections will not be rejected.  There will
++ * always be a possible async failure event simultaneous to the
++ * service reporting "ready", so this should be good enough. */
 +static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
-+                               apr_pool_t *ptemp, server_rec *s)
++                               apr_pool_t *ptemp, server_rec *main_server)
 +{
 +    ap_listen_rec *lr;
 +    apr_size_t plen = sizeof describe_listeners;
@@ -117,25 +124,23 @@
 +        }
 +    }
 +
-+    sd_journal_print(LOG_INFO, "Server configured, listening on: %s", describe_listeners);
++    sd_notify(0, "READY=1\n"
++              "STATUS=Configuration loaded.\n");
++
++    sd_journal_print(LOG_INFO, "Server configured, listening on: %s",
++                     describe_listeners);
 +
 +    return OK;
 +}
 +
 +static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
 +{
-+    int rv;
-+
 +    mainpid = getpid();
-+
-+    rv = sd_notifyf(0, "READY=1\n"
-+                    "STATUS=Started, listening on: %s\n"
-+                    "MAINPID=%" APR_PID_T_FMT,
-+                    describe_listeners, mainpid);
-+    if (rv < 0) {
-+        ap_log_perror(APLOG_MARK, APLOG_ERR, 0, p, APLOGNO(02395)
-+                     "sd_notifyf returned an error %d", rv);
-+    }
++    
++    sd_notifyf(0, "READY=1\n"
++               "STATUS=Started, listening on: %s\n"
++               "MAINPID=%" APR_PID_T_FMT,
++               describe_listeners, mainpid);
 +
 +    return OK;
 +}
@@ -145,19 +150,18 @@
 +    ap_sload_t sload;
 +    apr_interval_time_t up_time;
 +    char bps[5];
-+    int rv;
 +
 +    if (!ap_extended_status) {
-+        /* Nothing useful to report if ExtendedStatus disabled. */
++        /* Nothing useful to report with ExtendedStatus disabled. */
 +        return DECLINED;
 +    }
 +    
 +    ap_get_sload(&sload);
 +
 +    if (sload.access_count == 0) {
-+        rv = sd_notifyf(0, "READY=1\n"
-+                        "STATUS=Running, listening on: %s\n",
-+                        describe_listeners);
++        sd_notifyf(0, "READY=1\n"
++                   "STATUS=Running, listening on: %s\n",
++                   describe_listeners);
 +    }
 +    else {
 +        /* up_time in seconds */
@@ -167,16 +171,11 @@
 +        apr_strfsize((unsigned long)((float) (sload.bytes_served)
 +                                     / (float) up_time), bps);
 +
-+        rv = sd_notifyf(0, "READY=1\n"
-+                        "STATUS=Total requests: %lu; Idle/Busy workers %d/%d;"
-+                        "Requests/sec: %.3g; Bytes served/sec: %sB/sec\n",
-+                        sload.access_count, sload.idle, sload.busy,
-+                        ((float) sload.access_count) / (float) up_time, bps);
-+    }
-+
-+    if (rv < 0) {
-+        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02396)
-+                     "sd_notifyf returned an error %d", rv);
++        sd_notifyf(0, "READY=1\n"
++                   "STATUS=Total requests: %lu; Idle/Busy workers %d/%d;"
++                   "Requests/sec: %.3g; Bytes served/sec: %sB/sec\n",
++                   sload.access_count, sload.idle, sload.busy,
++                   ((float) sload.access_count) / (float) up_time, bps);
 +    }
 +
 +    /* Shutdown httpd when nothing is sent for shutdown_timer seconds. */
@@ -184,13 +183,9 @@
 +        /* mpm_common.c: INTERVAL_OF_WRITABLE_PROBES is 10 */
 +        shutdown_counter += 10;
 +        if (shutdown_timer > 0 && shutdown_counter >= shutdown_timer) {
-+            rv = sd_notifyf(0, "READY=1\n"
-+                            "STATUS=Stopped as result of IdleShutdown "
-+                            "timeout.");
-+            if (rv < 0) {
-+                ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02804)
-+                            "sd_notifyf returned an error %d", rv);
-+            }
++            sd_notifyf(0, "READY=1\n"
++                       "STATUS=Stopped as result of IdleShutdown "
++                       "timeout.");
 +            kill(mainpid, AP_SIG_GRACEFUL);
 +        }
 +    }
@@ -208,7 +203,7 @@
 +    /* Enable ap_extended_status. */
 +    ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
 +    /* Grab the listener config. */
-+    ap_hook_post_config(systemd_post_config, NULL, NULL, APR_HOOK_LAST);
++    ap_hook_post_config(systemd_post_config, NULL, NULL, APR_HOOK_REALLY_LAST);
 +    /* We know the PID in this hook ... */
 +    ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST);
 +    /* Used to update httpd's status line using sd_notifyf */
diff --git a/httpd.spec b/httpd.spec
index a08e7df..5c59152 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.41
-Release: 11%{?dist}
+Release: 12%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -72,7 +72,7 @@ Patch23: httpd-2.4.39-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
 Patch27: httpd-2.4.2-icons.patch
-Patch29: httpd-2.4.33-systemd.patch
+Patch29: httpd-2.4.41-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
 Patch31: httpd-2.4.33-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
@@ -753,6 +753,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Jan 20 2020 Joe Orton <jorton@redhat.com> - 2.4.41-12
+- mod_systemd: fix timeouts on reload w/ExtendedStatus off (#1590877)
+
 * Mon Jan  6 2020 Joe Orton <jorton@redhat.com> - 2.4.41-11
 - apachectl(8): update authors
 

From 002dac01c917649fb91cddc4358ff7d88898a386 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 29 Jan 2020 04:28:08 +0000
Subject: [PATCH 199/359] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 5c59152..2d5e847 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.41
-Release: 12%{?dist}
+Release: 13%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -753,6 +753,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.41-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
 * Mon Jan 20 2020 Joe Orton <jorton@redhat.com> - 2.4.41-12
 - mod_systemd: fix timeouts on reload w/ExtendedStatus off (#1590877)
 

From 76f6dc7dfc2f81c6dd329feb2c6870528cef76ab Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Tue, 31 Mar 2020 16:30:12 +0200
Subject: [PATCH 200/359] new version 2.4.43 (#1819023)

---
 .gitignore                                    |    2 +
 httpd-2.4.25-detect-systemd.patch             |   75 -
 httpd-2.4.34-r1738878.patch                   |  130 -
 httpd-2.4.38-r1830819+.patch                  |  677 ------
 httpd-2.4.41-r1865749.patch                   |   14 -
 httpd-2.4.41-systemd.patch                    |  240 --
 ....4.9-apxs.patch => httpd-2.4.43-apxs.patch |   12 +-
 ...x.patch => httpd-2.4.43-cachehardmax.patch |   16 +-
 ...imit.patch => httpd-2.4.43-corelimit.patch |   15 +-
 ...eplibs.patch => httpd-2.4.43-deplibs.patch |   13 +-
 httpd-2.4.43-detect-systemd.patch             |   33 +
 ...3.patch => httpd-2.4.43-enable-sslv3.patch |   21 +-
 ...-export.patch => httpd-2.4.43-export.patch |   40 +-
 ....2-icons.patch => httpd-2.4.43-icons.patch |   14 +-
 ...172+.patch => httpd-2.4.43-r1828172+.patch | 2113 ++++++++---------
 ...929+.patch => httpd-2.4.43-r1842929+.patch |   93 +-
 ...61269.patch => httpd-2.4.43-r1861269.patch |   14 +-
 ...793+.patch => httpd-2.4.43-r1861793+.patch |  202 +-
 ...095+.patch => httpd-2.4.43-r1870095+.patch |   16 +-
 ...elinux.patch => httpd-2.4.43-selinux.patch |   23 +-
 ...ch => httpd-2.4.43-socket-activation.patch |    2 +-
 ...patch => httpd-2.4.43-sslciphdefault.patch |   15 +-
 ....patch => httpd-2.4.43-sslmultiproxy.patch |   56 +-
 ...patch => httpd-2.4.43-sslprotdefault.patch |   21 +-
 httpd.spec                                    |   52 +-
 sources                                       |    5 +-
 26 files changed, 1395 insertions(+), 2519 deletions(-)
 delete mode 100644 httpd-2.4.25-detect-systemd.patch
 delete mode 100644 httpd-2.4.34-r1738878.patch
 delete mode 100644 httpd-2.4.38-r1830819+.patch
 delete mode 100644 httpd-2.4.41-r1865749.patch
 delete mode 100644 httpd-2.4.41-systemd.patch
 rename httpd-2.4.9-apxs.patch => httpd-2.4.43-apxs.patch (85%)
 rename httpd-2.4.4-cachehardmax.patch => httpd-2.4.43-cachehardmax.patch (86%)
 rename httpd-2.4.1-corelimit.patch => httpd-2.4.43-corelimit.patch (72%)
 rename httpd-2.4.1-deplibs.patch => httpd-2.4.43-deplibs.patch (70%)
 create mode 100644 httpd-2.4.43-detect-systemd.patch
 rename httpd-2.4.34-enable-sslv3.patch => httpd-2.4.43-enable-sslv3.patch (76%)
 rename httpd-2.4.39-export.patch => httpd-2.4.43-export.patch (77%)
 rename httpd-2.4.2-icons.patch => httpd-2.4.43-icons.patch (59%)
 rename httpd-2.4.41-r1828172+.patch => httpd-2.4.43-r1828172+.patch (92%)
 rename httpd-2.4.39-r1842929+.patch => httpd-2.4.43-r1842929+.patch (75%)
 rename httpd-2.4.39-r1861269.patch => httpd-2.4.43-r1861269.patch (66%)
 rename httpd-2.4.37-r1861793+.patch => httpd-2.4.43-r1861793+.patch (88%)
 rename httpd-2.4.41-r1870095+.patch => httpd-2.4.43-r1870095+.patch (89%)
 rename httpd-2.4.25-selinux.patch => httpd-2.4.43-selinux.patch (76%)
 rename httpd-2.4.17-socket-activation.patch => httpd-2.4.43-socket-activation.patch (99%)
 rename httpd-2.4.34-sslciphdefault.patch => httpd-2.4.43-sslciphdefault.patch (75%)
 rename httpd-2.4.33-sslmultiproxy.patch => httpd-2.4.43-sslmultiproxy.patch (70%)
 rename httpd-2.4.37-sslprotdefault.patch => httpd-2.4.43-sslprotdefault.patch (85%)

diff --git a/.gitignore b/.gitignore
index 351e025..b337b6b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,3 +35,5 @@ x86_64
 /httpd.conf.5
 /httpd-2.4.41.tar.bz2.asc
 /apachectl.8
+/httpd-2.4.43.tar.bz2.asc
+/KEYS
diff --git a/httpd-2.4.25-detect-systemd.patch b/httpd-2.4.25-detect-systemd.patch
deleted file mode 100644
index f8e302b..0000000
--- a/httpd-2.4.25-detect-systemd.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-diff -uap httpd-2.4.25/acinclude.m4.detectsystemd httpd-2.4.25/acinclude.m4
-diff -uap httpd-2.4.25/acinclude.m4.detectsystemd httpd-2.4.25/acinclude.m4
-diff -uap httpd-2.4.25/acinclude.m4.detectsystemd httpd-2.4.25/acinclude.m4
---- httpd-2.4.25/acinclude.m4.detectsystemd
-+++ httpd-2.4.25/acinclude.m4
-@@ -604,6 +604,30 @@
-   fi
- ])
- 
-+AC_DEFUN(APACHE_CHECK_SYSTEMD, [                                                                        
-+dnl Check for systemd support for listen.c's socket activation.
-+case $host in
-+*-linux-*)
-+   if test -n "$PKGCONFIG" && $PKGCONFIG --exists libsystemd; then
-+      SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd`
-+   elif test -n "$PKGCONFIG" && $PKGCONFIG --exists libsystemd-daemon; then
-+      SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd-daemon`
-+   else
-+      AC_CHECK_LIB(systemd-daemon, sd_notify, SYSTEMD_LIBS="-lsystemd-daemon")
-+   fi
-+   if test -n "$SYSTEMD_LIBS"; then
-+      AC_CHECK_HEADERS(systemd/sd-daemon.h)
-+      if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
-+        AC_MSG_WARN([Your system does not support systemd.])
-+      else
-+        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
-+        AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
-+      fi
-+   fi
-+   ;;
-+esac
-+])
-+
- dnl
- dnl APACHE_EXPORT_ARGUMENTS
- dnl Export (via APACHE_SUBST) the various path-related variables that
-diff -uap httpd-2.4.25/configure.in.detectsystemd httpd-2.4.25/configure.in
---- httpd-2.4.25/configure.in.detectsystemd
-+++ httpd-2.4.25/configure.in
-@@ -234,6 +234,7 @@
-   AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG])
-   APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`])
-   APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs`])
-+  APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)])
- else
-   AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/])
- fi
-@@ -504,6 +510,8 @@
-     AC_DEFINE(HAVE_GMTOFF, 1, [Define if struct tm has a tm_gmtoff field])
- fi
- 
-+APACHE_CHECK_SYSTEMD
-+
- dnl ## Set up any appropriate OS-specific environment variables for apachectl
- 
- case $host in
-@@ -668,6 +676,7 @@
- APACHE_SUBST(BUILTIN_LIBS)
- APACHE_SUBST(SHLIBPATH_VAR)
- APACHE_SUBST(OS_SPECIFIC_VARS)
-+APACHE_SUBST(HTTPD_LIBS)
- 
- PRE_SHARED_CMDS='echo ""'
- POST_SHARED_CMDS='echo ""'
---- httpd-2.4.25/Makefile.in.detectsystemd
-+++ httpd-2.4.25/Makefile.in
-@@ -4,7 +4,7 @@
- 
- PROGRAM_NAME         = $(progname)
- PROGRAM_SOURCES      = modules.c
--PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(PCRE_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
-+PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
- PROGRAM_PRELINK      = $(COMPILE) -c $(top_srcdir)/server/buildmark.c
- PROGRAM_DEPENDENCIES = \
-   server/libmain.la \
diff --git a/httpd-2.4.34-r1738878.patch b/httpd-2.4.34-r1738878.patch
deleted file mode 100644
index 5af48f5..0000000
--- a/httpd-2.4.34-r1738878.patch
+++ /dev/null
@@ -1,130 +0,0 @@
---- httpd-2.4.34/modules/proxy/ajp_header.c.r1738878
-+++ httpd-2.4.34/modules/proxy/ajp_header.c
-@@ -213,7 +213,8 @@
- 
- static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
-                                           request_rec *r,
--                                          apr_uri_t *uri)
-+                                          apr_uri_t *uri,
-+                                          const char *secret)
- {
-     int method;
-     apr_uint32_t i, num_headers = 0;
-@@ -293,17 +294,15 @@
-                    i, elts[i].key, elts[i].val);
-     }
- 
--/* XXXX need to figure out how to do this
--    if (s->secret) {
-+    if (secret) {
-         if (ajp_msg_append_uint8(msg, SC_A_SECRET) ||
--            ajp_msg_append_string(msg, s->secret)) {
-+            ajp_msg_append_string(msg, secret)) {
-             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(03228)
--                   "Error ajp_marshal_into_msgb - "
-+                   "ajp_marshal_into_msgb: "
-                    "Error appending secret");
-             return APR_EGENERAL;
-         }
-     }
-- */
- 
-     if (r->user) {
-         if (ajp_msg_append_uint8(msg, SC_A_REMOTE_USER) ||
-@@ -671,7 +670,8 @@
- apr_status_t ajp_send_header(apr_socket_t *sock,
-                              request_rec *r,
-                              apr_size_t buffsize,
--                             apr_uri_t *uri)
-+                             apr_uri_t *uri,
-+                             const char *secret)
- {
-     ajp_msg_t *msg;
-     apr_status_t rc;
-@@ -683,7 +683,7 @@
-         return rc;
-     }
- 
--    rc = ajp_marshal_into_msgb(msg, r, uri);
-+    rc = ajp_marshal_into_msgb(msg, r, uri, secret);
-     if (rc != APR_SUCCESS) {
-         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(00988)
-                "ajp_send_header: ajp_marshal_into_msgb failed");
---- httpd-2.4.34/modules/proxy/ajp.h.r1738878
-+++ httpd-2.4.34/modules/proxy/ajp.h
-@@ -413,12 +413,14 @@
-  * @param sock      backend socket
-  * @param r         current request
-  * @param buffsize  max size of the AJP packet.
-+ * @param secret    authentication secret
-  * @param uri       requested uri
-  * @return          APR_SUCCESS or error
-  */
- apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r,
-                              apr_size_t buffsize,
--                             apr_uri_t *uri);
-+                             apr_uri_t *uri,
-+                             const char *secret);
- 
- /**
-  * Read the ajp message and return the type of the message.
---- httpd-2.4.34/modules/proxy/mod_proxy_ajp.c.r1738878
-+++ httpd-2.4.34/modules/proxy/mod_proxy_ajp.c
-@@ -193,6 +193,7 @@
-     apr_off_t content_length = 0;
-     int original_status = r->status;
-     const char *original_status_line = r->status_line;
-+    const char *secret = NULL;
- 
-     if (psf->io_buffer_size_set)
-        maxsize = psf->io_buffer_size;
-@@ -202,12 +203,15 @@
-        maxsize = AJP_MSG_BUFFER_SZ;
-     maxsize = APR_ALIGN(maxsize, 1024);
- 
-+    if (*conn->worker->s->secret)
-+        secret = conn->worker->s->secret;
-+
-     /*
-      * Send the AJP request to the remote server
-      */
- 
-     /* send request headers */
--    status = ajp_send_header(conn->sock, r, maxsize, uri);
-+    status = ajp_send_header(conn->sock, r, maxsize, uri, secret);
-     if (status != APR_SUCCESS) {
-         conn->close = 1;
-         ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00868)
---- httpd-2.4.34/modules/proxy/mod_proxy.c.r1738878
-+++ httpd-2.4.34/modules/proxy/mod_proxy.c
-@@ -319,6 +319,12 @@
-                                 (int)sizeof(worker->s->upgrade));
-         }
-     }
-+    else if (!strcasecmp(key, "secret")) {
-+        if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) {
-+            return apr_psprintf(p, "Secret length must be < %d characters",
-+                                (int)sizeof(worker->s->secret));
-+        }
-+    }
-     else if (!strcasecmp(key, "responsefieldsize")) {
-         long s = atol(val);
-         if (s < 0) {
---- httpd-2.4.34/modules/proxy/mod_proxy.h.r1738878
-+++ httpd-2.4.34/modules/proxy/mod_proxy.h
-@@ -357,6 +357,7 @@
- #define PROXY_WORKER_MAX_HOSTNAME_SIZE  64
- #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
- #define PROXY_BALANCER_MAX_STICKY_SIZE  64
-+#define PROXY_WORKER_MAX_SECRET_SIZE    64
- 
- #define PROXY_RFC1035_HOSTNAME_SIZE	256
- 
-@@ -453,6 +454,7 @@
-     char      hostname_ex[PROXY_RFC1035_HOSTNAME_SIZE];  /* RFC1035 compliant version of the remote backend address */
-     apr_size_t   response_field_size; /* Size of proxy response buffer in bytes. */
-     unsigned int response_field_size_set:1;
-+    char      secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */
- } proxy_worker_shared;
- 
- #define ALIGNED_PROXY_WORKER_SHARED_SIZE (APR_ALIGN_DEFAULT(sizeof(proxy_worker_shared)))
diff --git a/httpd-2.4.38-r1830819+.patch b/httpd-2.4.38-r1830819+.patch
deleted file mode 100644
index 7df5ff6..0000000
--- a/httpd-2.4.38-r1830819+.patch
+++ /dev/null
@@ -1,677 +0,0 @@
-# ./pullrev.sh 1830819 1830836 1830912 1830913 1830927 1831168 1831173
-
-http://svn.apache.org/viewvc?view=revision&revision=1830819
-http://svn.apache.org/viewvc?view=revision&revision=1830912
-http://svn.apache.org/viewvc?view=revision&revision=1830913
-http://svn.apache.org/viewvc?view=revision&revision=1830927
-http://svn.apache.org/viewvc?view=revision&revision=1831168
-http://svn.apache.org/viewvc?view=revision&revision=1831173
-http://svn.apache.org/viewvc?view=revision&revision=1835240
-http://svn.apache.org/viewvc?view=revision&revision=1835242
-
-diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
-index d276fea..5467d23 100644
---- httpd-2.4.38/modules/ssl/ssl_engine_config.c.r1830819+
-+++ httpd-2.4.38/modules/ssl/ssl_engine_config.c
-@@ -916,7 +916,9 @@
-     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
-     const char *err;
- 
--    if ((err = ssl_cmd_check_file(cmd, &arg))) {
-+    /* Only check for non-ENGINE based certs. */
-+    if (!modssl_is_engine_id(arg)
-+        && (err = ssl_cmd_check_file(cmd, &arg))) {
-         return err;
-     }
- 
-@@ -932,7 +934,9 @@
-     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
-     const char *err;
- 
--    if ((err = ssl_cmd_check_file(cmd, &arg))) {
-+    /* Check keyfile exists for non-ENGINE keys. */
-+    if (!modssl_is_engine_id(arg)
-+        && (err = ssl_cmd_check_file(cmd, &arg))) {
-         return err;
-     }
- 
---- httpd-2.4.38/modules/ssl/ssl_engine_init.c.r1830819+
-+++ httpd-2.4.38/modules/ssl/ssl_engine_init.c
-@@ -1228,12 +1228,18 @@
-                 (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i,
-                                           const char *));
-          i++) {
-+        EVP_PKEY *pkey;
-+        const char *engine_certfile = NULL;
-+
-         key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i);
- 
-         ERR_clear_error();
- 
-         /* first the certificate (public key) */
--        if (mctx->cert_chain) {
-+        if (modssl_is_engine_id(certfile)) {
-+            engine_certfile = certfile;
-+        }
-+        else if (mctx->cert_chain) {
-             if ((SSL_CTX_use_certificate_file(mctx->ssl_ctx, certfile,
-                                               SSL_FILETYPE_PEM) < 1)) {
-                 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02561)
-@@ -1262,12 +1268,46 @@
- 
-         ERR_clear_error();
- 
--        if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
--                                         SSL_FILETYPE_PEM) < 1) &&
--            (ERR_GET_FUNC(ERR_peek_last_error())
--                != X509_F_X509_CHECK_PRIVATE_KEY)) {
-+        if (modssl_is_engine_id(keyfile)) {
-+            apr_status_t rv;
-+
-+            cert = NULL;
-+            
-+            if ((rv = modssl_load_engine_keypair(s, ptemp, vhost_id,
-+                                                 engine_certfile, keyfile,
-+                                                 &cert, &pkey))) {
-+                return rv;
-+            }
-+
-+            if (cert) {
-+                if (SSL_CTX_use_certificate(mctx->ssl_ctx, cert) < 1) {
-+                    ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10137)
-+                                 "Failed to configure engine certificate %s, check %s",
-+                                 key_id, certfile);
-+                    ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
-+                    return APR_EGENERAL;
-+                }
-+
-+                /* SSL_CTX now owns the cert. */
-+                X509_free(cert);
-+            }                    
-+            
-+            if (SSL_CTX_use_PrivateKey(mctx->ssl_ctx, pkey) < 1) {
-+                ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10130)
-+                             "Failed to configure private key %s from engine",
-+                             keyfile);
-+                ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
-+                return APR_EGENERAL;
-+            }
-+
-+            /* SSL_CTX now owns the key */
-+            EVP_PKEY_free(pkey);
-+        }
-+        else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
-+                                              SSL_FILETYPE_PEM) < 1)
-+                 && (ERR_GET_FUNC(ERR_peek_last_error())
-+                     != X509_F_X509_CHECK_PRIVATE_KEY)) {
-             ssl_asn1_t *asn1;
--            EVP_PKEY *pkey;
-             const unsigned char *ptr;
- 
-             ERR_clear_error();
-@@ -1354,8 +1394,9 @@
-     /*
-      * Try to read DH parameters from the (first) SSLCertificateFile
-      */
--    if ((certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *)) &&
--        (dhparams = ssl_dh_GetParamFromFile(certfile))) {
-+    certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *);
-+    if (certfile && !modssl_is_engine_id(certfile)
-+        && (dhparams = ssl_dh_GetParamFromFile(certfile))) {
-         SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);
-         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
-                      "Custom DH parameters (%d bits) for %s loaded from %s",
-@@ -1367,10 +1408,10 @@
-     /*
-      * Similarly, try to read the ECDH curve name from SSLCertificateFile...
-      */
--    if ((certfile != NULL) && 
--        (ecparams = ssl_ec_GetParamFromFile(certfile)) &&
--        (nid = EC_GROUP_get_curve_name(ecparams)) &&
--        (eckey = EC_KEY_new_by_curve_name(nid))) {
-+    if (certfile && !modssl_is_engine_id(certfile)
-+        && (ecparams = ssl_ec_GetParamFromFile(certfile))
-+        && (nid = EC_GROUP_get_curve_name(ecparams)) 
-+        && (eckey = EC_KEY_new_by_curve_name(nid))) {
-         SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey);
-         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541)
-                      "ECDH curve %s for %s specified in %s",
---- httpd-2.4.38/modules/ssl/ssl_engine_pphrase.c.r1830819+
-+++ httpd-2.4.38/modules/ssl/ssl_engine_pphrase.c
-@@ -143,8 +143,6 @@
-     const char *key_id = asn1_table_vhost_key(mc, p, sc->vhost_id, idx);
-     EVP_PKEY *pPrivateKey = NULL;
-     ssl_asn1_t *asn1;
--    unsigned char *ucp;
--    long int length;
-     int nPassPhrase = (*pphrases)->nelts;
-     int nPassPhraseRetry = 0;
-     apr_time_t pkey_mtime = 0;
-@@ -221,7 +219,7 @@
-          * is not empty. */
-         ERR_clear_error();
- 
--        pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file, NULL,
-+        pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file,
-                                              ssl_pphrase_Handle_CB, &ppcb_arg);
-         /* If the private key was successfully read, nothing more to
-            do here. */
-@@ -351,19 +349,12 @@
-         nPassPhrase++;
-     }
- 
--    /*
--     * Insert private key into the global module configuration
--     * (we convert it to a stand-alone DER byte sequence
--     * because the SSL library uses static variables inside a
--     * RSA structure which do not survive DSO reloads!)
--     */
--    length = i2d_PrivateKey(pPrivateKey, NULL);
--    ucp = ssl_asn1_table_set(mc->tPrivateKey, key_id, length);
--    (void)i2d_PrivateKey(pPrivateKey, &ucp); /* 2nd arg increments */
-+    /* Cache the private key in the global module configuration so it
-+     * can be used after subsequent reloads. */
-+    asn1 = ssl_asn1_table_set(mc->tPrivateKey, key_id, pPrivateKey);
- 
-     if (ppcb_arg.nPassPhraseDialogCur != 0) {
-         /* remember mtime of encrypted keys */
--        asn1 = ssl_asn1_table_get(mc->tPrivateKey, key_id);
-         asn1->source_mtime = pkey_mtime;
-     }
- 
-@@ -614,3 +605,288 @@
-      */
-     return (len);
- }
-+
-+
-+#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
-+
-+/* OpenSSL UI implementation for passphrase entry; largely duplicated
-+ * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be
-+ * worth trying to shift pphrase handling over to the UI API
-+ * completely. */
-+static int passphrase_ui_open(UI *ui)
-+{
-+    pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui);
-+    SSLSrvConfigRec *sc = mySrvConfig(ppcb->s);
-+
-+    ppcb->nPassPhraseDialog++;
-+    ppcb->nPassPhraseDialogCur++;
-+
-+    /*
-+     * Builtin or Pipe dialog
-+     */
-+    if (sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN
-+        || sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
-+        if (sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
-+            if (!readtty) {
-+                ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s,
-+                             APLOGNO(10143)
-+                             "Init: Creating pass phrase dialog pipe child "
-+                             "'%s'", sc->server->pphrase_dialog_path);
-+                if (ssl_pipe_child_create(ppcb->p,
-+                            sc->server->pphrase_dialog_path)
-+                        != APR_SUCCESS) {
-+                    ap_log_error(APLOG_MARK, APLOG_ERR, 0, ppcb->s,
-+                                 APLOGNO(10144)
-+                                 "Init: Failed to create pass phrase pipe '%s'",
-+                                 sc->server->pphrase_dialog_path);
-+                    return 0;
-+                }
-+            }
-+            ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, APLOGNO(10145)
-+                         "Init: Requesting pass phrase via piped dialog");
-+        }
-+        else { /* sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN */
-+#ifdef WIN32
-+            ap_log_error(APLOG_MARK, APLOG_ERR, 0, ppcb->s, APLOGNO(10146)
-+                         "Init: Failed to create pass phrase pipe '%s'",
-+                         sc->server->pphrase_dialog_path);
-+            return 0;
-+#else
-+            /*
-+             * stderr has already been redirected to the error_log.
-+             * rather than attempting to temporarily rehook it to the terminal,
-+             * we print the prompt to stdout before EVP_read_pw_string turns
-+             * off tty echo
-+             */
-+            apr_file_open_stdout(&writetty, ppcb->p);
-+
-+            ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, APLOGNO(10147)
-+                         "Init: Requesting pass phrase via builtin terminal "
-+                         "dialog");
-+#endif
-+        }
-+
-+        /*
-+         * The first time display a header to inform the user about what
-+         * program he actually speaks to, which module is responsible for
-+         * this terminal dialog and why to the hell he has to enter
-+         * something...
-+         */
-+        if (ppcb->nPassPhraseDialog == 1) {
-+            apr_file_printf(writetty, "%s mod_ssl (Pass Phrase Dialog)\n",
-+                            AP_SERVER_BASEVERSION);
-+            apr_file_printf(writetty,
-+                            "A pass phrase is required to access the private key.\n");
-+        }
-+        if (ppcb->bPassPhraseDialogOnce) {
-+            ppcb->bPassPhraseDialogOnce = FALSE;
-+            apr_file_printf(writetty, "\n");
-+            apr_file_printf(writetty, "Private key %s (%s)\n",
-+                            ppcb->key_id, ppcb->pkey_file);
-+        }
-+    }
-+
-+    return 1;
-+}
-+
-+static int passphrase_ui_read(UI *ui, UI_STRING *uis)
-+{
-+    pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui);
-+    SSLSrvConfigRec *sc = mySrvConfig(ppcb->s);
-+    const char *prompt;
-+    int i;
-+    int bufsize;
-+    int len;
-+    char *buf;
-+
-+    prompt = UI_get0_output_string(uis);
-+    if (prompt == NULL) {
-+        prompt = "Enter pass phrase:";
-+    }
-+
-+    /*
-+     * Get the maximum expected size and allocate the buffer
-+     */
-+    bufsize = UI_get_result_maxsize(uis);
-+    buf = apr_pcalloc(ppcb->p, bufsize);
-+
-+    if (sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN
-+        || sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
-+        /*
-+         * Get the pass phrase through a callback.
-+         * Empty input is not accepted.
-+         */
-+        for (;;) {
-+            if (sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
-+                i = pipe_get_passwd_cb(buf, bufsize, "", FALSE);
-+            }
-+            else { /* sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN */
-+                i = EVP_read_pw_string(buf, bufsize, "", FALSE);
-+            }
-+            if (i != 0) {
-+                OPENSSL_cleanse(buf, bufsize);
-+                return 0;
-+            }
-+            len = strlen(buf);
-+            if (len < 1){
-+                apr_file_printf(writetty, "Apache:mod_ssl:Error: Pass phrase"
-+                                "empty (needs to be at least 1 character).\n");
-+                apr_file_puts(prompt, writetty);
-+            }
-+            else {
-+                break;
-+            }
-+        }
-+    }
-+    /*
-+     * Filter program
-+     */
-+    else if (sc->server->pphrase_dialog_type == SSL_PPTYPE_FILTER) {
-+        const char *cmd = sc->server->pphrase_dialog_path;
-+        const char **argv = apr_palloc(ppcb->p, sizeof(char *) * 3);
-+        char *result;
-+
-+        ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, APLOGNO(10148)
-+                     "Init: Requesting pass phrase from dialog filter "
-+                     "program (%s)", cmd);
-+
-+        argv[0] = cmd;
-+        argv[1] = ppcb->key_id;
-+        argv[2] = NULL;
-+
-+        result = ssl_util_readfilter(ppcb->s, ppcb->p, cmd, argv);
-+        apr_cpystrn(buf, result, bufsize);
-+        len = strlen(buf);
-+    }
-+
-+    /*
-+     * Ok, we now have the pass phrase, so give it back
-+     */
-+    ppcb->cpPassPhraseCur = apr_pstrdup(ppcb->p, buf);
-+    UI_set_result(ui, uis, buf);
-+
-+    /* Clear sensitive data. */
-+    OPENSSL_cleanse(buf, bufsize);
-+    return 1;
-+}
-+
-+static int passphrase_ui_write(UI *ui, UI_STRING *uis)
-+{
-+    pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui);
-+    SSLSrvConfigRec *sc;
-+    const char *prompt;
-+
-+    sc = mySrvConfig(ppcb->s);
-+
-+    if (sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN
-+        || sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
-+        prompt = UI_get0_output_string(uis);
-+        apr_file_puts(prompt, writetty);
-+    }
-+
-+    return 1;
-+}
-+
-+static int passphrase_ui_close(UI *ui)
-+{
-+    /*
-+     * Close the pipes if they were opened
-+     */
-+    if (readtty) {
-+        apr_file_close(readtty);
-+        apr_file_close(writetty);
-+        readtty = writetty = NULL;
-+    }
-+    return 1;
-+}
-+
-+static apr_status_t pp_ui_method_cleanup(void *uip)
-+{
-+    UI_METHOD *uim = uip;
-+    
-+    UI_destroy_method(uim);
-+
-+    return APR_SUCCESS;
-+}
-+
-+static UI_METHOD *get_passphrase_ui(apr_pool_t *p)
-+{
-+    UI_METHOD *ui_method = UI_create_method("Passphrase UI");
-+
-+    UI_method_set_opener(ui_method, passphrase_ui_open);
-+    UI_method_set_reader(ui_method, passphrase_ui_read);
-+    UI_method_set_writer(ui_method, passphrase_ui_write);
-+    UI_method_set_closer(ui_method, passphrase_ui_close);
-+
-+    apr_pool_cleanup_register(p, ui_method, pp_ui_method_cleanup,
-+                              pp_ui_method_cleanup);
-+    
-+    return ui_method;
-+}
-+
-+
-+apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
-+                                        const char *vhostid,
-+                                        const char *certid, const char *keyid,
-+                                        X509 **pubkey, EVP_PKEY **privkey)
-+{
-+    SSLModConfigRec *mc = myModConfig(s);
-+    ENGINE *e;
-+    UI_METHOD *ui_method = get_passphrase_ui(p);
-+    pphrase_cb_arg_t ppcb;
-+
-+    memset(&ppcb, 0, sizeof ppcb);
-+    ppcb.s = s;
-+    ppcb.p = p;
-+    ppcb.bPassPhraseDialogOnce = TRUE;
-+    ppcb.key_id = vhostid;
-+    ppcb.pkey_file = keyid;
-+
-+    if (!mc->szCryptoDevice) {
-+        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10131)
-+                     "Init: Cannot load private key `%s' without engine",
-+                     keyid);
-+        return ssl_die(s);
-+    }
-+
-+    if (!(e = ENGINE_by_id(mc->szCryptoDevice))) {
-+        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10132)
-+                     "Init: Failed to load Crypto Device API `%s'",
-+                     mc->szCryptoDevice);
-+        ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
-+        return ssl_die(s);
-+    }
-+
-+    if (APLOGdebug(s)) {
-+        ENGINE_ctrl_cmd_string(e, "VERBOSE", NULL, 0);
-+    }
-+
-+    if (certid) {
-+        struct {
-+            const char *cert_id;
-+            X509 *cert;
-+        } params = { certid, NULL };
-+
-+        if (!ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &params, NULL, 1)) {
-+            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10136)
-+                         "Init: Unable to get the certificate");
-+            ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
-+            return ssl_die(s);
-+        }
-+
-+        *pubkey = params.cert;
-+    }
-+
-+    *privkey = ENGINE_load_private_key(e, keyid, ui_method, &ppcb);
-+    if (*privkey == NULL) {
-+        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10133)
-+                     "Init: Unable to get the private key");
-+        ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
-+        return ssl_die(s);
-+    }
-+
-+    ENGINE_free(e);
-+
-+    return APR_SUCCESS;
-+}
-+#endif
---- httpd-2.4.38/modules/ssl/ssl_private.h.r1830819+
-+++ httpd-2.4.38/modules/ssl/ssl_private.h
-@@ -1002,21 +1002,28 @@
- apr_status_t ssl_load_encrypted_pkey(server_rec *, apr_pool_t *, int,
-                                      const char *, apr_array_header_t **);
- 
-+/* Load public and/or private key from the configured ENGINE. Private
-+ * key returned as *pkey.  certid can be NULL, in which case *pubkey
-+ * is not altered.  Errors logged on failure. */
-+apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
-+                                        const char *vhostid,
-+                                        const char *certid, const char *keyid,
-+                                        X509 **pubkey, EVP_PKEY **privkey);
-+
- /**  Diffie-Hellman Parameter Support  */
- DH           *ssl_dh_GetParamFromFile(const char *);
- #ifdef HAVE_ECC
- EC_GROUP     *ssl_ec_GetParamFromFile(const char *);
- #endif
- 
--unsigned char *ssl_asn1_table_set(apr_hash_t *table,
--                                  const char *key,
--                                  long int length);
--
--ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table,
--                               const char *key);
--
--void ssl_asn1_table_unset(apr_hash_t *table,
--                          const char *key);
-+/* Store the EVP_PKEY key (serialized into DER) in the hash table with
-+ * key, returning the ssl_asn1_t structure pointer. */
-+ssl_asn1_t *ssl_asn1_table_set(apr_hash_t *table, const char *key,
-+                               EVP_PKEY *pkey);
-+/* Retrieve the ssl_asn1_t structure with given key from the hash. */
-+ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table, const char *key);
-+/* Remove and free the ssl_asn1_t structure with given key. */
-+void ssl_asn1_table_unset(apr_hash_t *table, const char *key);
- 
- /**  Mutex Support  */
- int          ssl_mutex_init(server_rec *, apr_pool_t *);
-@@ -1109,6 +1116,10 @@
- int ssl_is_challenge(conn_rec *c, const char *servername, 
-                      X509 **pcert, EVP_PKEY **pkey);
- 
-+/* Returns non-zero if the cert/key filename should be handled through
-+ * the configured ENGINE. */
-+int modssl_is_engine_id(const char *name);
-+
- #endif /* SSL_PRIVATE_H */
- /** @} */
- 
---- httpd-2.4.38/modules/ssl/ssl_util.c.r1830819+
-+++ httpd-2.4.38/modules/ssl/ssl_util.c
-@@ -192,45 +192,37 @@
-     return TRUE;
- }
- 
--/*
-- * certain key data needs to survive restarts,
-- * which are stored in the user data table of s->process->pool.
-- * to prevent "leaking" of this data, we use malloc/free
-- * rather than apr_palloc and these wrappers to help make sure
-- * we do not leak the malloc-ed data.
-- */
--unsigned char *ssl_asn1_table_set(apr_hash_t *table,
--                                  const char *key,
--                                  long int length)
-+/* Decrypted private keys are cached to survive restarts.  The cached
-+ * data must have lifetime of the process (hence malloc/free rather
-+ * than pools), and uses raw DER since the EVP_PKEY structure
-+ * internals may not survive across a module reload. */
-+ssl_asn1_t *ssl_asn1_table_set(apr_hash_t *table, const char *key,
-+                               EVP_PKEY *pkey)
- {
-     apr_ssize_t klen = strlen(key);
-     ssl_asn1_t *asn1 = apr_hash_get(table, key, klen);
-+    apr_size_t length = i2d_PrivateKey(pkey, NULL);
-+    unsigned char *p;
- 
--    /*
--     * if a value for this key already exists,
--     * reuse as much of the already malloc-ed data
--     * as possible.
--     */
-+    /* Re-use structure if cached previously. */
-     if (asn1) {
-         if (asn1->nData != length) {
--            free(asn1->cpData); /* XXX: realloc? */
--            asn1->cpData = NULL;
-+            asn1->cpData = ap_realloc(asn1->cpData, length);
-         }
-     }
-     else {
-         asn1 = ap_malloc(sizeof(*asn1));
-         asn1->source_mtime = 0; /* used as a note for encrypted private keys */
--        asn1->cpData = NULL;
--    }
--
--    asn1->nData = length;
--    if (!asn1->cpData) {
-         asn1->cpData = ap_malloc(length);
-+
-+        apr_hash_set(table, key, klen, asn1);
-     }
- 
--    apr_hash_set(table, key, klen, asn1);
-+    asn1->nData = length;
-+    p = asn1->cpData;
-+    i2d_PrivateKey(pkey, &p); /* increases p by length */
- 
--    return asn1->cpData; /* caller will assign a value to this */
-+    return asn1;
- }
- 
- ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table,
-@@ -480,3 +472,13 @@
- }
- 
- #endif /* #if APR_HAS_THREADS && MODSSL_USE_OPENSSL_PRE_1_1_API */
-+
-+int modssl_is_engine_id(const char *name)
-+{
-+#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
-+    /* ### Can handle any other special ENGINE key names here? */
-+    return strncmp(name, "pkcs11:", 7) == 0;
-+#else
-+    return 0;
-+#endif
-+}
---- httpd-2.4.38/modules/ssl/ssl_util_ssl.c.r1830819+
-+++ httpd-2.4.38/modules/ssl/ssl_util_ssl.c
-@@ -74,7 +74,7 @@
- **  _________________________________________________________________
- */
- 
--EVP_PKEY *modssl_read_privatekey(const char* filename, EVP_PKEY **key, pem_password_cb *cb, void *s)
-+EVP_PKEY *modssl_read_privatekey(const char *filename, pem_password_cb *cb, void *s)
- {
-     EVP_PKEY *rc;
-     BIO *bioS;
-@@ -83,7 +83,7 @@
-     /* 1. try PEM (= DER+Base64+headers) */
-     if ((bioS=BIO_new_file(filename, "r")) == NULL)
-         return NULL;
--    rc = PEM_read_bio_PrivateKey(bioS, key, cb, s);
-+    rc = PEM_read_bio_PrivateKey(bioS, NULL, cb, s);
-     BIO_free(bioS);
- 
-     if (rc == NULL) {
-@@ -107,41 +107,9 @@
-             BIO_free(bioS);
-         }
-     }
--    if (rc != NULL && key != NULL) {
--        if (*key != NULL)
--            EVP_PKEY_free(*key);
--        *key = rc;
--    }
-     return rc;
- }
- 
--typedef struct {
--    const char *pass;
--    int pass_len;
--} pass_ctx;
--
--static int provide_pass(char *buf, int size, int rwflag, void *baton)
--{
--    pass_ctx *ctx = baton;
--    if (ctx->pass_len > 0) {
--        if (ctx->pass_len < size) {
--            size = (int)ctx->pass_len;
--        }
--        memcpy(buf, ctx->pass, size);
--    }
--    return ctx->pass_len;
--}
--
--EVP_PKEY   *modssl_read_encrypted_pkey(const char *filename, EVP_PKEY **key, 
--                                       const char *pass, apr_size_t pass_len)
--{
--    pass_ctx ctx;
--    
--    ctx.pass = pass;
--    ctx.pass_len = pass_len;
--    return modssl_read_privatekey(filename, key, provide_pass, &ctx);
--}
--
- /*  _________________________________________________________________
- **
- **  Smart shutdown
---- httpd-2.4.38/modules/ssl/ssl_util_ssl.h.r1830819+
-+++ httpd-2.4.38/modules/ssl/ssl_util_ssl.h
-@@ -64,8 +64,11 @@
- void        modssl_init_app_data2_idx(void);
- void       *modssl_get_app_data2(SSL *);
- void        modssl_set_app_data2(SSL *, void *);
--EVP_PKEY   *modssl_read_privatekey(const char *, EVP_PKEY **, pem_password_cb *, void *);
--EVP_PKEY   *modssl_read_encrypted_pkey(const char *, EVP_PKEY **, const char *, apr_size_t);
-+
-+/* Read private key from filename in either PEM or raw base64(DER)
-+ * format, using password entry callback cb and userdata. */
-+EVP_PKEY   *modssl_read_privatekey(const char *filename, pem_password_cb *cb, void *ud);
-+
- int         modssl_smart_shutdown(SSL *ssl);
- BOOL        modssl_X509_getBC(X509 *, int *, int *);
- char       *modssl_X509_NAME_ENTRY_to_string(apr_pool_t *p, X509_NAME_ENTRY *xsne,
diff --git a/httpd-2.4.41-r1865749.patch b/httpd-2.4.41-r1865749.patch
deleted file mode 100644
index d79a559..0000000
--- a/httpd-2.4.41-r1865749.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-# ./pullrev.sh 1865749
-http://svn.apache.org/viewvc?view=revision&revision=1865749
-
---- httpd-2.4.41/modules/proxy/mod_proxy_balancer.c.r1865749
-+++ httpd-2.4.41/modules/proxy/mod_proxy_balancer.c
-@@ -1104,7 +1104,7 @@
-     if (apr_uri_parse(r->pool, ref, &uri) || !uri.hostname)
-         return 0;
- 
--    return strcmp(uri.hostname, ap_get_server_name(r)) == 0;
-+    return strcasecmp(uri.hostname, ap_get_server_name(r)) == 0;
- }
- 
- /* Manages the loadfactors and member status
diff --git a/httpd-2.4.41-systemd.patch b/httpd-2.4.41-systemd.patch
deleted file mode 100644
index 5369bd9..0000000
--- a/httpd-2.4.41-systemd.patch
+++ /dev/null
@@ -1,240 +0,0 @@
---- httpd-2.4.41/modules/arch/unix/config5.m4.systemd
-+++ httpd-2.4.41/modules/arch/unix/config5.m4
-@@ -18,6 +18,16 @@
-   fi
- ])
- 
-+APACHE_MODULE(systemd, Systemd support, , , all, [
-+  if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
-+    AC_MSG_WARN([Your system does not support systemd.])
-+    enable_systemd="no"
-+  else
-+    APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS])
-+    enable_systemd="yes"
-+  fi
-+])
-+
- APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
- 
- APACHE_MODPATH_FINISH
---- httpd-2.4.41/modules/arch/unix/mod_systemd.c.systemd
-+++ httpd-2.4.41/modules/arch/unix/mod_systemd.c
-@@ -0,0 +1,218 @@
-+/* Licensed to the Apache Software Foundation (ASF) under one or more
-+ * contributor license agreements.  See the NOTICE file distributed with
-+ * this work for additional information regarding copyright ownership.
-+ * The ASF licenses this file to You under the Apache License, Version 2.0
-+ * (the "License"); you may not use this file except in compliance with
-+ * the License.  You may obtain a copy of the License at
-+ *
-+ *     http://www.apache.org/licenses/LICENSE-2.0
-+ *
-+ * Unless required by applicable law or agreed to in writing, software
-+ * distributed under the License is distributed on an "AS IS" BASIS,
-+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-+ * See the License for the specific language governing permissions and
-+ * limitations under the License.
-+ * 
-+ */
-+
-+#include <stdint.h>
-+#include <ap_config.h>
-+#include "ap_mpm.h"
-+#include <http_core.h>
-+#include <httpd.h>
-+#include <http_log.h>
-+#include <apr_version.h>
-+#include <apr_pools.h>
-+#include <apr_strings.h>
-+#include "unixd.h"
-+#include "scoreboard.h"
-+#include "mpm_common.h"
-+
-+#include "systemd/sd-daemon.h"
-+#include "systemd/sd-journal.h"
-+
-+#if APR_HAVE_UNISTD_H
-+#include <unistd.h>
-+#endif
-+
-+static int shutdown_timer = 0;
-+static int shutdown_counter = 0;
-+static unsigned long bytes_served;
-+static pid_t mainpid;
-+static char describe_listeners[50];
-+
-+static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
-+                              apr_pool_t *ptemp)
-+{
-+    sd_notify(0,
-+              "RELOADING=1\n"
-+              "STATUS=Reading configuration...\n");
-+    ap_extended_status = 1;
-+    return OK;
-+}
-+
-+static char *dump_listener(ap_listen_rec *lr, apr_pool_t *p)
-+{
-+    apr_sockaddr_t *sa = lr->bind_addr;
-+    char addr[128];
-+
-+    if (apr_sockaddr_is_wildcard(sa)) {
-+        return apr_pstrcat(p, "port ", apr_itoa(p, sa->port), NULL);
-+    }
-+
-+    apr_sockaddr_ip_getbuf(addr, sizeof addr, sa);
-+
-+    return apr_psprintf(p, "%s port %u", addr, sa->port);
-+}
-+
-+/* Report the service is ready in post_config, which could be during
-+ * startup or after a reload.  The server could still hit a fatal
-+ * startup error after this point during ap_run_mpm(), so this is
-+ * perhaps too early, but by post_config listen() has been called on
-+ * the TCP ports so new connections will not be rejected.  There will
-+ * always be a possible async failure event simultaneous to the
-+ * service reporting "ready", so this should be good enough. */
-+static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
-+                               apr_pool_t *ptemp, server_rec *main_server)
-+{
-+    ap_listen_rec *lr;
-+    apr_size_t plen = sizeof describe_listeners;
-+    char *p = describe_listeners;
-+
-+    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
-+        return OK;
-+
-+    for (lr = ap_listeners; lr; lr = lr->next) {
-+        char *s = dump_listener(lr, ptemp);
-+
-+        if (strlen(s) + 3 < plen) {
-+            char *newp = apr_cpystrn(p, s, plen);
-+            if (lr->next)
-+                newp = apr_cpystrn(newp, ", ", 3);
-+            plen -= newp - p;
-+            p = newp;
-+        }
-+        else {
-+            if (plen < 4) {
-+                p = describe_listeners + sizeof describe_listeners - 4;
-+                plen = 4;
-+            }
-+            apr_cpystrn(p, "...", plen);
-+            break;
-+        }
-+    }
-+
-+    sd_notify(0, "READY=1\n"
-+              "STATUS=Configuration loaded.\n");
-+
-+    sd_journal_print(LOG_INFO, "Server configured, listening on: %s",
-+                     describe_listeners);
-+
-+    return OK;
-+}
-+
-+static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
-+{
-+    mainpid = getpid();
-+    
-+    sd_notifyf(0, "READY=1\n"
-+               "STATUS=Started, listening on: %s\n"
-+               "MAINPID=%" APR_PID_T_FMT,
-+               describe_listeners, mainpid);
-+
-+    return OK;
-+}
-+
-+static int systemd_monitor(apr_pool_t *p, server_rec *s)
-+{
-+    ap_sload_t sload;
-+    apr_interval_time_t up_time;
-+    char bps[5];
-+
-+    if (!ap_extended_status) {
-+        /* Nothing useful to report with ExtendedStatus disabled. */
-+        return DECLINED;
-+    }
-+    
-+    ap_get_sload(&sload);
-+
-+    if (sload.access_count == 0) {
-+        sd_notifyf(0, "READY=1\n"
-+                   "STATUS=Running, listening on: %s\n",
-+                   describe_listeners);
-+    }
-+    else {
-+        /* up_time in seconds */
-+        up_time = (apr_uint32_t) apr_time_sec(apr_time_now() -
-+                                              ap_scoreboard_image->global->restart_time);
-+
-+        apr_strfsize((unsigned long)((float) (sload.bytes_served)
-+                                     / (float) up_time), bps);
-+
-+        sd_notifyf(0, "READY=1\n"
-+                   "STATUS=Total requests: %lu; Idle/Busy workers %d/%d;"
-+                   "Requests/sec: %.3g; Bytes served/sec: %sB/sec\n",
-+                   sload.access_count, sload.idle, sload.busy,
-+                   ((float) sload.access_count) / (float) up_time, bps);
-+    }
-+
-+    /* Shutdown httpd when nothing is sent for shutdown_timer seconds. */
-+    if (sload.bytes_served == bytes_served) {
-+        /* mpm_common.c: INTERVAL_OF_WRITABLE_PROBES is 10 */
-+        shutdown_counter += 10;
-+        if (shutdown_timer > 0 && shutdown_counter >= shutdown_timer) {
-+            sd_notifyf(0, "READY=1\n"
-+                       "STATUS=Stopped as result of IdleShutdown "
-+                       "timeout.");
-+            kill(mainpid, AP_SIG_GRACEFUL);
-+        }
-+    }
-+    else {
-+        shutdown_counter = 0;
-+    }
-+
-+    bytes_served = sload.bytes_served;
-+
-+    return DECLINED;
-+}
-+
-+static void systemd_register_hooks(apr_pool_t *p)
-+{
-+    /* Enable ap_extended_status. */
-+    ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
-+    /* Grab the listener config. */
-+    ap_hook_post_config(systemd_post_config, NULL, NULL, APR_HOOK_REALLY_LAST);
-+    /* We know the PID in this hook ... */
-+    ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST);
-+    /* Used to update httpd's status line using sd_notifyf */
-+    ap_hook_monitor(systemd_monitor, NULL, NULL, APR_HOOK_MIDDLE);
-+}
-+
-+static const char *set_shutdown_timer(cmd_parms *cmd, void *dummy,
-+                                      const char *arg)
-+{
-+    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
-+    if (err != NULL) {
-+        return err;
-+    }
-+
-+    shutdown_timer = atoi(arg);
-+    return NULL;
-+}
-+
-+static const command_rec systemd_cmds[] =
-+{
-+AP_INIT_TAKE1("IdleShutdown", set_shutdown_timer, NULL, RSRC_CONF,
-+     "Number of seconds in idle-state after which httpd is shutdown"),
-+    {NULL}
-+};
-+
-+AP_DECLARE_MODULE(systemd) = {
-+    STANDARD20_MODULE_STUFF,
-+    NULL,
-+    NULL,
-+    NULL,
-+    NULL,
-+    systemd_cmds,
-+    systemd_register_hooks,
-+};
diff --git a/httpd-2.4.9-apxs.patch b/httpd-2.4.43-apxs.patch
similarity index 85%
rename from httpd-2.4.9-apxs.patch
rename to httpd-2.4.43-apxs.patch
index 7016dec..b1185b2 100644
--- a/httpd-2.4.9-apxs.patch
+++ b/httpd-2.4.43-apxs.patch
@@ -1,8 +1,8 @@
 diff --git a/support/apxs.in b/support/apxs.in
-index ad1287f..efcfcf6 100644
+index b2705fa..c331631 100644
 --- a/support/apxs.in
 +++ b/support/apxs.in
-@@ -25,7 +25,18 @@ package apxs;
+@@ -35,7 +35,18 @@ if ($ddi >= 0) {
  
  my %config_vars = ();
  
@@ -19,10 +19,10 @@ index ad1287f..efcfcf6 100644
 +
 +my $installbuilddir = $libdir . "/httpd/build";
 +
- get_config_vars("$installbuilddir/config_vars.mk",\%config_vars);
+ get_config_vars($destdir . "$installbuilddir/config_vars.mk",\%config_vars);
  
  # read the configuration variables once
-@@ -275,7 +286,7 @@ if ($opt_g) {
+@@ -285,7 +296,7 @@ if ($opt_g) {
      $data =~ s|%NAME%|$name|sg;
      $data =~ s|%TARGET%|$CFG_TARGET|sg;
      $data =~ s|%PREFIX%|$prefix|sg;
@@ -31,7 +31,7 @@ index ad1287f..efcfcf6 100644
  
      my ($mkf, $mods, $src) = ($data =~ m|^(.+)-=#=-\n(.+)-=#=-\n(.+)|s);
  
-@@ -453,11 +464,11 @@ if ($opt_c) {
+@@ -463,11 +474,11 @@ if ($opt_c) {
      my $ldflags = "$CFG_LDFLAGS";
      if ($opt_p == 1) {
          
@@ -45,7 +45,7 @@ index ad1287f..efcfcf6 100644
              chomp($apu_libs);
          }
          
-@@ -672,8 +683,8 @@ __DATA__
+@@ -682,8 +693,8 @@ __DATA__
  
  builddir=.
  top_srcdir=%PREFIX%
diff --git a/httpd-2.4.4-cachehardmax.patch b/httpd-2.4.43-cachehardmax.patch
similarity index 86%
rename from httpd-2.4.4-cachehardmax.patch
rename to httpd-2.4.43-cachehardmax.patch
index de360ce..755f822 100644
--- a/httpd-2.4.4-cachehardmax.patch
+++ b/httpd-2.4.43-cachehardmax.patch
@@ -1,8 +1,8 @@
 diff --git a/modules/cache/cache_util.h b/modules/cache/cache_util.h
-index eec38f3..1a2d5ee 100644
+index 6b92151..4c42a8e 100644
 --- a/modules/cache/cache_util.h
 +++ b/modules/cache/cache_util.h
-@@ -194,6 +194,9 @@ typedef struct {
+@@ -195,6 +195,9 @@ typedef struct {
      unsigned int store_nostore_set:1;
      unsigned int enable_set:1;
      unsigned int disable_set:1;
@@ -13,10 +13,10 @@ index eec38f3..1a2d5ee 100644
  
  /* A linked-list of authn providers. */
 diff --git a/modules/cache/mod_cache.c b/modules/cache/mod_cache.c
-index 4f2d3e0..30c88f4 100644
+index 3b9aa4f..8268503 100644
 --- a/modules/cache/mod_cache.c
 +++ b/modules/cache/mod_cache.c
-@@ -1299,6 +1299,11 @@ static apr_status_t cache_save_filter(ap_filter_t *f, apr_bucket_brigade *in)
+@@ -1455,6 +1455,11 @@ static apr_status_t cache_save_filter(ap_filter_t *f, apr_bucket_brigade *in)
              exp = date + dconf->defex;
          }
      }
@@ -28,7 +28,7 @@ index 4f2d3e0..30c88f4 100644
      info->expire = exp;
  
      /* We found a stale entry which wasn't really stale. */
-@@ -1717,7 +1722,9 @@ static void *create_dir_config(apr_pool_t *p, char *dummy)
+@@ -1954,7 +1959,9 @@ static void *create_dir_config(apr_pool_t *p, char *dummy)
  
      /* array of providers for this URL space */
      dconf->cacheenable = apr_array_make(p, 10, sizeof(struct cache_enable));
@@ -39,7 +39,7 @@ index 4f2d3e0..30c88f4 100644
      return dconf;
  }
  
-@@ -1767,7 +1774,10 @@ static void *merge_dir_config(apr_pool_t *p, void *basev, void *addv) {
+@@ -2004,7 +2011,10 @@ static void *merge_dir_config(apr_pool_t *p, void *basev, void *addv) {
      new->enable_set = add->enable_set || base->enable_set;
      new->disable = (add->disable_set == 0) ? base->disable : add->disable;
      new->disable_set = add->disable_set || base->disable_set;
@@ -51,7 +51,7 @@ index 4f2d3e0..30c88f4 100644
      return new;
  }
  
-@@ -2096,12 +2106,18 @@ static const char *add_cache_disable(cmd_parms *parms, void *dummy,
+@@ -2332,12 +2342,18 @@ static const char *add_cache_disable(cmd_parms *parms, void *dummy,
  }
  
  static const char *set_cache_maxex(cmd_parms *parms, void *dummy,
@@ -71,7 +71,7 @@ index 4f2d3e0..30c88f4 100644
      return NULL;
  }
  
-@@ -2309,7 +2325,7 @@ static const command_rec cache_cmds[] =
+@@ -2545,7 +2561,7 @@ static const command_rec cache_cmds[] =
                     "caching is enabled"),
      AP_INIT_TAKE1("CacheDisable", add_cache_disable, NULL, RSRC_CONF|ACCESS_CONF,
                    "A partial URL prefix below which caching is disabled"),
diff --git a/httpd-2.4.1-corelimit.patch b/httpd-2.4.43-corelimit.patch
similarity index 72%
rename from httpd-2.4.1-corelimit.patch
rename to httpd-2.4.43-corelimit.patch
index 96f8486..dd4b874 100644
--- a/httpd-2.4.1-corelimit.patch
+++ b/httpd-2.4.43-corelimit.patch
@@ -1,13 +1,8 @@
-
-Bump up the core size limit if CoreDumpDirectory is
-configured.
-
-Upstream-Status: Was discussed but there are competing desires;
-	there are portability oddities here too.
-
---- httpd-2.4.1/server/core.c.corelimit
-+++ httpd-2.4.1/server/core.c
-@@ -4433,6 +4433,25 @@ static int core_post_config(apr_pool_t *
+diff --git a/server/core.c b/server/core.c
+index 79b2a82..dc0f17a 100644
+--- a/server/core.c
++++ b/server/core.c
+@@ -4996,6 +4996,25 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte
      }
      apr_pool_cleanup_register(pconf, NULL, ap_mpm_end_gen_helper,
                                apr_pool_cleanup_null);
diff --git a/httpd-2.4.1-deplibs.patch b/httpd-2.4.43-deplibs.patch
similarity index 70%
rename from httpd-2.4.1-deplibs.patch
rename to httpd-2.4.43-deplibs.patch
index b73c21d..c60f5a5 100644
--- a/httpd-2.4.1-deplibs.patch
+++ b/httpd-2.4.43-deplibs.patch
@@ -1,11 +1,8 @@
-
-Link straight against .la files.
-
-Upstream-Status: vendor specific
-
---- httpd-2.4.1/configure.in.deplibs
-+++ httpd-2.4.1/configure.in
-@@ -707,9 +707,9 @@ APACHE_HELP_STRING(--with-suexec-umask,u
+diff --git a/configure.in b/configure.in
+index f8f9442..f276550 100644
+--- a/configure.in
++++ b/configure.in
+@@ -786,9 +786,9 @@ APACHE_SUBST(INSTALL_SUEXEC)
  
  dnl APR should go after the other libs, so the right symbols can be picked up
  if test x${apu_found} != xobsolete; then
diff --git a/httpd-2.4.43-detect-systemd.patch b/httpd-2.4.43-detect-systemd.patch
new file mode 100644
index 0000000..448f7d7
--- /dev/null
+++ b/httpd-2.4.43-detect-systemd.patch
@@ -0,0 +1,33 @@
+diff --git a/Makefile.in b/Makefile.in
+index ea8366e..06b8c5a 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -4,7 +4,7 @@ CLEAN_SUBDIRS = test
+ 
+ PROGRAM_NAME         = $(progname)
+ PROGRAM_SOURCES      = modules.c
+-PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(PCRE_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
++PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
+ PROGRAM_PRELINK      = $(COMPILE) -c $(top_srcdir)/server/buildmark.c
+ PROGRAM_DEPENDENCIES = \
+   server/libmain.la \
+diff --git a/configure.in b/configure.in
+index f276550..a63eada 100644
+--- a/configure.in
++++ b/configure.in
+@@ -234,6 +234,7 @@ if test "$PCRE_CONFIG" != "false"; then
+   AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG])
+   APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`])
+   APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs`])
++  APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)])
+ else
+   AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/])
+ fi
+@@ -679,6 +682,7 @@ APACHE_SUBST(OS_DIR)
+ APACHE_SUBST(BUILTIN_LIBS)
+ APACHE_SUBST(SHLIBPATH_VAR)
+ APACHE_SUBST(OS_SPECIFIC_VARS)
++APACHE_SUBST(HTTPD_LIBS)
+ 
+ PRE_SHARED_CMDS='echo ""'
+ POST_SHARED_CMDS='echo ""'
diff --git a/httpd-2.4.34-enable-sslv3.patch b/httpd-2.4.43-enable-sslv3.patch
similarity index 76%
rename from httpd-2.4.34-enable-sslv3.patch
rename to httpd-2.4.43-enable-sslv3.patch
index a2eba80..2861605 100644
--- a/httpd-2.4.34-enable-sslv3.patch
+++ b/httpd-2.4.43-enable-sslv3.patch
@@ -1,9 +1,8 @@
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1623165
-
---- httpd-2.4.34/modules/ssl/ssl_engine_config.c.enable-sslv3
-+++ httpd-2.4.34/modules/ssl/ssl_engine_config.c
-@@ -1474,6 +1474,10 @@
+diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
+index 979489c..3d6443b 100644
+--- a/modules/ssl/ssl_engine_config.c
++++ b/modules/ssl/ssl_engine_config.c
+@@ -1485,6 +1485,10 @@ static const char *ssl_cmd_protocol_parse(cmd_parms *parms,
  #endif
          else if (strcEQ(w, "all")) {
              thisopt = SSL_PROTOCOL_ALL;
@@ -14,9 +13,11 @@ https://bugzilla.redhat.com/show_bug.cgi?id=1623165
          }
          else {
              return apr_pstrcat(parms->temp_pool,
---- httpd-2.4.34/modules/ssl/ssl_engine_init.c.enable-sslv3
-+++ httpd-2.4.34/modules/ssl/ssl_engine_init.c
-@@ -537,6 +537,28 @@
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index b0fcf81..ab6f263 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -568,6 +568,28 @@ static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s,
  }
  #endif
  
@@ -45,7 +46,7 @@ https://bugzilla.redhat.com/show_bug.cgi?id=1623165
  static apr_status_t ssl_init_ctx_protocol(server_rec *s,
                                            apr_pool_t *p,
                                            apr_pool_t *ptemp,
-@@ -687,9 +709,13 @@
+@@ -735,9 +757,13 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
      }
      if (prot == TLS1_1_VERSION && protocol & SSL_PROTOCOL_TLSV1) {
          prot = TLS1_VERSION;
diff --git a/httpd-2.4.39-export.patch b/httpd-2.4.43-export.patch
similarity index 77%
rename from httpd-2.4.39-export.patch
rename to httpd-2.4.43-export.patch
index b20a6e7..0d9fd72 100644
--- a/httpd-2.4.39-export.patch
+++ b/httpd-2.4.43-export.patch
@@ -5,9 +5,11 @@ to do so indirectly.
 
 Upstream: https://svn.apache.org/r1861685 (as new default-off configure option)
 
---- httpd-2.4.39/Makefile.in.export
-+++ httpd-2.4.39/Makefile.in
-@@ -4,8 +4,15 @@
+diff --git a/Makefile.in b/Makefile.in
+index 9eeb5c7..8746a10 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test
  
  PROGRAM_NAME         = $(progname)
  PROGRAM_SOURCES      = modules.c
@@ -24,9 +26,24 @@ Upstream: https://svn.apache.org/r1861685 (as new default-off configure option)
  PROGRAM_DEPENDENCIES = \
    server/libmain.la \
    $(BUILTIN_LIBS) \
---- httpd-2.4.39/server/main.c.export
-+++ httpd-2.4.39/server/main.c
-@@ -835,17 +835,3 @@
+diff --git a/server/Makefile.in b/server/Makefile.in
+index 1fa3344..116850b 100644
+--- a/server/Makefile.in
++++ b/server/Makefile.in
+@@ -12,7 +12,7 @@ LTLIBRARY_SOURCES = \
+ 	connection.c listen.c util_mutex.c \
+ 	mpm_common.c mpm_unix.c mpm_fdqueue.c \
+ 	util_charset.c util_cookies.c util_debug.c util_xml.c \
+-	util_filter.c util_pcre.c util_regex.c exports.c \
++	util_filter.c util_pcre.c util_regex.c \
+ 	scoreboard.c error_bucket.c protocol.c core.c request.c provider.c \
+ 	eoc_bucket.c eor_bucket.c core_filters.c \
+ 	util_expr_parse.c util_expr_scan.c util_expr_eval.c
+diff --git a/server/main.c b/server/main.c
+index 62e06df..17c09ee 100644
+--- a/server/main.c
++++ b/server/main.c
+@@ -835,17 +835,3 @@ int main(int argc, const char * const argv[])
      return !OK;
  }
  
@@ -44,14 +61,3 @@ Upstream: https://svn.apache.org/r1861685 (as new default-off configure option)
 -    return ap_ugly_hack;
 -}
 -#endif
---- httpd-2.4.39/server/Makefile.in.export
-+++ httpd-2.4.39/server/Makefile.in
-@@ -12,7 +12,7 @@
- 	connection.c listen.c util_mutex.c \
- 	mpm_common.c mpm_unix.c mpm_fdqueue.c \
- 	util_charset.c util_cookies.c util_debug.c util_xml.c \
--	util_filter.c util_pcre.c util_regex.c exports.c \
-+	util_filter.c util_pcre.c util_regex.c \
- 	scoreboard.c error_bucket.c protocol.c core.c request.c provider.c \
- 	eoc_bucket.c eor_bucket.c core_filters.c \
- 	util_expr_parse.c util_expr_scan.c util_expr_eval.c
diff --git a/httpd-2.4.2-icons.patch b/httpd-2.4.43-icons.patch
similarity index 59%
rename from httpd-2.4.2-icons.patch
rename to httpd-2.4.43-icons.patch
index 1341999..21518d7 100644
--- a/httpd-2.4.2-icons.patch
+++ b/httpd-2.4.43-icons.patch
@@ -1,12 +1,8 @@
-
-- Fix config for /icons/ dir to allow symlink to poweredby.png.
-- Avoid using coredump GIF for a directory called "core"
-
-Upstream-Status: vendor specific patch
-
---- httpd-2.4.2/docs/conf/extra/httpd-autoindex.conf.in.icons
-+++ httpd-2.4.2/docs/conf/extra/httpd-autoindex.conf.in
-@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable Ver
+diff --git a/docs/conf/extra/httpd-autoindex.conf.in b/docs/conf/extra/httpd-autoindex.conf.in
+index 51b02ed..0e8b626 100644
+--- a/docs/conf/extra/httpd-autoindex.conf.in
++++ b/docs/conf/extra/httpd-autoindex.conf.in
+@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable VersionSort
  Alias /icons/ "@exp_iconsdir@/"
  
  <Directory "@exp_iconsdir@">
diff --git a/httpd-2.4.41-r1828172+.patch b/httpd-2.4.43-r1828172+.patch
similarity index 92%
rename from httpd-2.4.41-r1828172+.patch
rename to httpd-2.4.43-r1828172+.patch
index 72b124b..3487600 100644
--- a/httpd-2.4.41-r1828172+.patch
+++ b/httpd-2.4.43-r1828172+.patch
@@ -1,1063 +1,8 @@
-# ./pullrev.sh 1828172 1862968 1863191 1867878 1867882 1867968 1867970 1867971
-http://svn.apache.org/viewvc?view=revision&revision=1828172
-http://svn.apache.org/viewvc?view=revision&revision=1862968
-http://svn.apache.org/viewvc?view=revision&revision=1863191
-http://svn.apache.org/viewvc?view=revision&revision=1867878
-http://svn.apache.org/viewvc?view=revision&revision=1867882
-http://svn.apache.org/viewvc?view=revision&revision=1867968
-http://svn.apache.org/viewvc?view=revision&revision=1867970
-http://svn.apache.org/viewvc?view=revision&revision=1867971
-
---- httpd-2.4.41/modules/generators/mod_cgi.c
-+++ httpd-2.4.41/modules/generators/mod_cgi.c
-@@ -92,6 +92,10 @@
-     apr_size_t  bufbytes;
- } cgi_server_conf;
- 
-+typedef struct {
-+    apr_interval_time_t timeout;
-+} cgi_dirconf;
-+
- static void *create_cgi_config(apr_pool_t *p, server_rec *s)
- {
-     cgi_server_conf *c =
-@@ -112,6 +116,12 @@
-     return overrides->logname ? overrides : base;
- }
- 
-+static void *create_cgi_dirconf(apr_pool_t *p, char *dummy)
-+{
-+    cgi_dirconf *c = (cgi_dirconf *) apr_pcalloc(p, sizeof(cgi_dirconf));
-+    return c;
-+}
-+
- static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg)
- {
-     server_rec *s = cmd->server;
-@@ -150,6 +160,17 @@
-     return NULL;
- }
- 
-+static const char *set_script_timeout(cmd_parms *cmd, void *dummy, const char *arg)
-+{
-+    cgi_dirconf *dc = dummy;
-+
-+    if (ap_timeout_parameter_parse(arg, &dc->timeout, "s") != APR_SUCCESS) {
-+        return "CGIScriptTimeout has wrong format";
-+    }
-+
-+    return NULL;
-+}
-+
- static const command_rec cgi_cmds[] =
- {
- AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF,
-@@ -158,6 +179,9 @@
-      "the maximum length (in bytes) of the script debug log"),
- AP_INIT_TAKE1("ScriptLogBuffer", set_scriptlog_buffer, NULL, RSRC_CONF,
-      "the maximum size (in bytes) to record of a POST request"),
-+AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_CONF,
-+     "The amount of time to wait between successful reads from "
-+     "the CGI script, in seconds."),
-     {NULL}
- };
- 
-@@ -471,23 +495,26 @@
-                           apr_filepath_name_get(r->filename));
-         }
-         else {
-+            cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module);
-+            apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
-+
-             apr_pool_note_subprocess(p, procnew, APR_KILL_AFTER_TIMEOUT);
- 
-             *script_in = procnew->out;
-             if (!*script_in)
-                 return APR_EBADF;
--            apr_file_pipe_timeout_set(*script_in, r->server->timeout);
-+            apr_file_pipe_timeout_set(*script_in, timeout);
- 
-             if (e_info->prog_type == RUN_AS_CGI) {
-                 *script_out = procnew->in;
-                 if (!*script_out)
-                     return APR_EBADF;
--                apr_file_pipe_timeout_set(*script_out, r->server->timeout);
-+                apr_file_pipe_timeout_set(*script_out, timeout);
- 
-                 *script_err = procnew->err;
-                 if (!*script_err)
-                     return APR_EBADF;
--                apr_file_pipe_timeout_set(*script_err, r->server->timeout);
-+                apr_file_pipe_timeout_set(*script_err, timeout);
-             }
-         }
-     }
-@@ -541,212 +568,10 @@
-     return APR_SUCCESS;
- }
- 
--static void discard_script_output(apr_bucket_brigade *bb)
--{
--    apr_bucket *e;
--    const char *buf;
--    apr_size_t len;
--    apr_status_t rv;
--
--    for (e = APR_BRIGADE_FIRST(bb);
--         e != APR_BRIGADE_SENTINEL(bb);
--         e = APR_BUCKET_NEXT(e))
--    {
--        if (APR_BUCKET_IS_EOS(e)) {
--            break;
--        }
--        rv = apr_bucket_read(e, &buf, &len, APR_BLOCK_READ);
--        if (rv != APR_SUCCESS) {
--            break;
--        }
--    }
--}
--
- #if APR_FILES_AS_SOCKETS
--
--/* A CGI bucket type is needed to catch any output to stderr from the
-- * script; see PR 22030. */
--static const apr_bucket_type_t bucket_type_cgi;
--
--struct cgi_bucket_data {
--    apr_pollset_t *pollset;
--    request_rec *r;
--};
--
--/* Create a CGI bucket using pipes from script stdout 'out'
-- * and stderr 'err', for request 'r'. */
--static apr_bucket *cgi_bucket_create(request_rec *r,
--                                     apr_file_t *out, apr_file_t *err,
--                                     apr_bucket_alloc_t *list)
--{
--    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
--    apr_status_t rv;
--    apr_pollfd_t fd;
--    struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data);
--
--    APR_BUCKET_INIT(b);
--    b->free = apr_bucket_free;
--    b->list = list;
--    b->type = &bucket_type_cgi;
--    b->length = (apr_size_t)(-1);
--    b->start = -1;
--
--    /* Create the pollset */
--    rv = apr_pollset_create(&data->pollset, 2, r->pool, 0);
--    if (rv != APR_SUCCESS) {
--        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01217)
--                     "apr_pollset_create(); check system or user limits");
--        return NULL;
--    }
--
--    fd.desc_type = APR_POLL_FILE;
--    fd.reqevents = APR_POLLIN;
--    fd.p = r->pool;
--    fd.desc.f = out; /* script's stdout */
--    fd.client_data = (void *)1;
--    rv = apr_pollset_add(data->pollset, &fd);
--    if (rv != APR_SUCCESS) {
--        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01218)
--                     "apr_pollset_add(); check system or user limits");
--        return NULL;
--    }
--
--    fd.desc.f = err; /* script's stderr */
--    fd.client_data = (void *)2;
--    rv = apr_pollset_add(data->pollset, &fd);
--    if (rv != APR_SUCCESS) {
--        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01219)
--                     "apr_pollset_add(); check system or user limits");
--        return NULL;
--    }
--
--    data->r = r;
--    b->data = data;
--    return b;
--}
--
--/* Create a duplicate CGI bucket using given bucket data */
--static apr_bucket *cgi_bucket_dup(struct cgi_bucket_data *data,
--                                  apr_bucket_alloc_t *list)
--{
--    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
--    APR_BUCKET_INIT(b);
--    b->free = apr_bucket_free;
--    b->list = list;
--    b->type = &bucket_type_cgi;
--    b->length = (apr_size_t)(-1);
--    b->start = -1;
--    b->data = data;
--    return b;
--}
--
--/* Handle stdout from CGI child.  Duplicate of logic from the _read
-- * method of the real APR pipe bucket implementation. */
--static apr_status_t cgi_read_stdout(apr_bucket *a, apr_file_t *out,
--                                    const char **str, apr_size_t *len)
--{
--    char *buf;
--    apr_status_t rv;
--
--    *str = NULL;
--    *len = APR_BUCKET_BUFF_SIZE;
--    buf = apr_bucket_alloc(*len, a->list); /* XXX: check for failure? */
--
--    rv = apr_file_read(out, buf, len);
--
--    if (rv != APR_SUCCESS && rv != APR_EOF) {
--        apr_bucket_free(buf);
--        return rv;
--    }
--
--    if (*len > 0) {
--        struct cgi_bucket_data *data = a->data;
--        apr_bucket_heap *h;
--
--        /* Change the current bucket to refer to what we read */
--        a = apr_bucket_heap_make(a, buf, *len, apr_bucket_free);
--        h = a->data;
--        h->alloc_len = APR_BUCKET_BUFF_SIZE; /* note the real buffer size */
--        *str = buf;
--        APR_BUCKET_INSERT_AFTER(a, cgi_bucket_dup(data, a->list));
--    }
--    else {
--        apr_bucket_free(buf);
--        a = apr_bucket_immortal_make(a, "", 0);
--        *str = a->data;
--    }
--    return rv;
--}
--
--/* Read method of CGI bucket: polls on stderr and stdout of the child,
-- * sending any stderr output immediately away to the error log. */
--static apr_status_t cgi_bucket_read(apr_bucket *b, const char **str,
--                                    apr_size_t *len, apr_read_type_e block)
--{
--    struct cgi_bucket_data *data = b->data;
--    apr_interval_time_t timeout;
--    apr_status_t rv;
--    int gotdata = 0;
--
--    timeout = block == APR_NONBLOCK_READ ? 0 : data->r->server->timeout;
--
--    do {
--        const apr_pollfd_t *results;
--        apr_int32_t num;
--
--        rv = apr_pollset_poll(data->pollset, timeout, &num, &results);
--        if (APR_STATUS_IS_TIMEUP(rv)) {
--            if (timeout) {
--                ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, data->r, APLOGNO(01220)
--                              "Timeout waiting for output from CGI script %s",
--                              data->r->filename);
--                return rv;
--            }
--            else {
--                return APR_EAGAIN;
--            }
--        }
--        else if (APR_STATUS_IS_EINTR(rv)) {
--            continue;
--        }
--        else if (rv != APR_SUCCESS) {
--            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, data->r, APLOGNO(01221)
--                          "poll failed waiting for CGI child");
--            return rv;
--        }
--
--        for (; num; num--, results++) {
--            if (results[0].client_data == (void *)1) {
--                /* stdout */
--                rv = cgi_read_stdout(b, results[0].desc.f, str, len);
--                if (APR_STATUS_IS_EOF(rv)) {
--                    rv = APR_SUCCESS;
--                }
--                gotdata = 1;
--            } else {
--                /* stderr */
--                apr_status_t rv2 = log_script_err(data->r, results[0].desc.f);
--                if (APR_STATUS_IS_EOF(rv2)) {
--                    apr_pollset_remove(data->pollset, &results[0]);
--                }
--            }
--        }
--
--    } while (!gotdata);
--
--    return rv;
--}
--
--static const apr_bucket_type_t bucket_type_cgi = {
--    "CGI", 5, APR_BUCKET_DATA,
--    apr_bucket_destroy_noop,
--    cgi_bucket_read,
--    apr_bucket_setaside_notimpl,
--    apr_bucket_split_notimpl,
--    apr_bucket_copy_notimpl
--};
--
-+#define WANT_CGI_BUCKET
- #endif
-+#include "cgi_common.h"
- 
- static int cgi_handler(request_rec *r)
- {
-@@ -766,6 +591,8 @@
-     apr_status_t rv;
-     cgi_exec_info_t e_info;
-     conn_rec *c;
-+    cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module);
-+    apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
- 
-     if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
-         return DECLINED;
-@@ -925,10 +752,7 @@
-     AP_DEBUG_ASSERT(script_in != NULL);
- 
- #if APR_FILES_AS_SOCKETS
--    apr_file_pipe_timeout_set(script_in, 0);
--    apr_file_pipe_timeout_set(script_err, 0);
--
--    b = cgi_bucket_create(r, script_in, script_err, c->bucket_alloc);
-+    b = cgi_bucket_create(r, dc->timeout, script_in, script_err, c->bucket_alloc);
-     if (b == NULL)
-         return HTTP_INTERNAL_SERVER_ERROR;
- #else
-@@ -938,111 +762,7 @@
-     b = apr_bucket_eos_create(c->bucket_alloc);
-     APR_BRIGADE_INSERT_TAIL(bb, b);
- 
--    /* Handle script return... */
--    if (!nph) {
--        const char *location;
--        char sbuf[MAX_STRING_LEN];
--        int ret;
--
--        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
--                                                        APLOG_MODULE_INDEX)))
--        {
--            ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err);
--
--            /*
--             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
--             * does not set an explicit status and ap_meets_conditions, which
--             * is called by ap_scan_script_header_err_brigade, detects that
--             * the conditions of the requests are met and the response is
--             * not modified.
--             * In this case set r->status and return OK in order to prevent
--             * running through the error processing stack as this would
--             * break with mod_cache, if the conditions had been set by
--             * mod_cache itself to validate a stale entity.
--             * BTW: We circumvent the error processing stack anyway if the
--             * CGI script set an explicit status code (whatever it is) and
--             * the only possible values for ret here are:
--             *
--             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
--             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
--             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
--             * processing of the response of the CGI script, e.g broken headers
--             * or a crashed CGI process).
--             */
--            if (ret == HTTP_NOT_MODIFIED) {
--                r->status = ret;
--                return OK;
--            }
--
--            return ret;
--        }
--
--        location = apr_table_get(r->headers_out, "Location");
--
--        if (location && r->status == 200) {
--            /* For a redirect whether internal or not, discard any
--             * remaining stdout from the script, and log any remaining
--             * stderr output, as normal. */
--            discard_script_output(bb);
--            apr_brigade_destroy(bb);
--            apr_file_pipe_timeout_set(script_err, r->server->timeout);
--            log_script_err(r, script_err);
--        }
--
--        if (location && location[0] == '/' && r->status == 200) {
--            /* This redirect needs to be a GET no matter what the original
--             * method was.
--             */
--            r->method = "GET";
--            r->method_number = M_GET;
--
--            /* We already read the message body (if any), so don't allow
--             * the redirected request to think it has one.  We can ignore
--             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
--             */
--            apr_table_unset(r->headers_in, "Content-Length");
--
--            ap_internal_redirect_handler(location, r);
--            return OK;
--        }
--        else if (location && r->status == 200) {
--            /* XXX: Note that if a script wants to produce its own Redirect
--             * body, it now has to explicitly *say* "Status: 302"
--             */
--            return HTTP_MOVED_TEMPORARILY;
--        }
--
--        rv = ap_pass_brigade(r->output_filters, bb);
--    }
--    else /* nph */ {
--        struct ap_filter_t *cur;
--
--        /* get rid of all filters up through protocol...  since we
--         * haven't parsed off the headers, there is no way they can
--         * work
--         */
--
--        cur = r->proto_output_filters;
--        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
--            cur = cur->next;
--        }
--        r->output_filters = r->proto_output_filters = cur;
--
--        rv = ap_pass_brigade(r->output_filters, bb);
--    }
--
--    /* don't soak up script output if errors occurred writing it
--     * out...  otherwise, we prolong the life of the script when the
--     * connection drops or we stopped sending output for some other
--     * reason */
--    if (rv == APR_SUCCESS && !r->connection->aborted) {
--        apr_file_pipe_timeout_set(script_err, r->server->timeout);
--        log_script_err(r, script_err);
--    }
--
--    apr_file_close(script_err);
--
--    return OK;                      /* NOT r->status, even if it has changed. */
-+    return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err);
- }
- 
- /*============================================================================
-@@ -1277,7 +997,7 @@
- AP_DECLARE_MODULE(cgi) =
- {
-     STANDARD20_MODULE_STUFF,
--    NULL,                        /* dir config creater */
-+    create_cgi_dirconf,          /* dir config creater */
-     NULL,                        /* dir merger --- default is to override */
-     create_cgi_config,           /* server config */
-     merge_cgi_config,            /* merge server config */
---- httpd-2.4.41/modules/generators/config5.m4
-+++ httpd-2.4.41/modules/generators/config5.m4
-@@ -78,4 +78,15 @@
- 
- APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
- 
-+AC_ARG_ENABLE(cgid-fdpassing,
-+  [APACHE_HELP_STRING(--enable-cgid-fdpassing,Enable experimental mod_cgid support for fd passing)],
-+  [if test "$enableval" = "yes"; then
-+     AC_CHECK_DECL(CMSG_DATA,
-+       [AC_DEFINE([HAVE_CGID_FDPASSING], 1, [Enable FD passing support in mod_cgid])],
-+       [AC_MSG_ERROR([cannot support mod_cgid fd-passing on this system])], [
-+#include <sys/types.h>
-+#include <sys/socket.h>])
-+  fi
-+])
-+
- APACHE_MODPATH_FINISH
---- httpd-2.4.41/modules/generators/mod_cgid.c
-+++ httpd-2.4.41/modules/generators/mod_cgid.c
-@@ -342,15 +342,19 @@
-     return close(fd);
- }
- 
--/* deal with incomplete reads and signals
-- * assume you really have to read buf_size bytes
-- */
--static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
-+/* Read from the socket dealing with incomplete messages and signals.
-+ * Returns 0 on success or errno on failure.  Stderr fd passed as
-+ * auxiliary data from other end is written to *errfd, or else stderr
-+ * fileno if not present. */
-+static apr_status_t sock_readhdr(int fd, int *errfd, void *vbuf, size_t buf_size)
- {
--    char *buf = vbuf;
-     int rc;
-+#ifndef HAVE_CGID_FDPASSING
-+    char *buf = vbuf;
-     size_t bytes_read = 0;
- 
-+    if (errfd) *errfd = 0;
-+    
-     do {
-         do {
-             rc = read(fd, buf + bytes_read, buf_size - bytes_read);
-@@ -365,9 +369,60 @@
-         }
-     } while (bytes_read < buf_size);
- 
-+   
-+#else /* with FD passing */
-+    struct msghdr msg = {0};
-+    struct iovec vec = {vbuf, buf_size};
-+    struct cmsghdr *cmsg;
-+    union {  /* union to ensure alignment */
-+        struct cmsghdr cm;
-+        char buf[CMSG_SPACE(sizeof(int))];
-+    } u;
-+    
-+    msg.msg_iov = &vec;
-+    msg.msg_iovlen = 1;
-+
-+    if (errfd) {
-+        msg.msg_control = u.buf;
-+        msg.msg_controllen = sizeof(u.buf);
-+        *errfd = 0;
-+    }
-+    
-+    /* use MSG_WAITALL to skip loop on truncated reads */
-+    do {
-+        rc = recvmsg(fd, &msg, MSG_WAITALL);
-+    } while (rc < 0 && errno == EINTR);
-+
-+    if (rc == 0) {
-+        return ECONNRESET;
-+    }
-+    else if (rc < 0) {
-+        return errno;
-+    }
-+    else if (rc != buf_size) {
-+        /* MSG_WAITALL should ensure the recvmsg blocks until the
-+         * entire length is read, but let's be paranoid. */
-+        return APR_INCOMPLETE;
-+    }
-+
-+    if (errfd
-+        && (cmsg = CMSG_FIRSTHDR(&msg)) != NULL
-+        && cmsg->cmsg_len == CMSG_LEN(sizeof(*errfd))
-+        && cmsg->cmsg_level == SOL_SOCKET
-+        && cmsg->cmsg_type == SCM_RIGHTS) {
-+        *errfd = *((int *) CMSG_DATA(cmsg));
-+    }
-+#endif
-+    
-     return APR_SUCCESS;
- }
- 
-+/* As sock_readhdr but without auxiliary fd passing. */
-+static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
-+{
-+    return sock_readhdr(fd, NULL, vbuf, buf_size);
-+}
-+
- /* deal with signals
-  */
- static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
-@@ -384,7 +439,7 @@
-     return APR_SUCCESS;
- }
- 
--static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
-+static apr_status_t sock_writev(int fd, int auxfd, request_rec *r, int count, ...)
- {
-     va_list ap;
-     int rc;
-@@ -399,9 +454,39 @@
-     }
-     va_end(ap);
- 
-+#ifndef HAVE_CGID_FDPASSING
-     do {
-         rc = writev(fd, vec, count);
-     } while (rc < 0 && errno == EINTR);
-+#else
-+    {
-+        struct msghdr msg = { 0 };
-+        struct cmsghdr *cmsg;
-+        union { /* union for alignment */
-+            char buf[CMSG_SPACE(sizeof(int))];
-+            struct cmsghdr align;
-+        } u;
-+
-+        msg.msg_iov = vec;
-+        msg.msg_iovlen = count;
-+
-+        if (auxfd) {
-+            msg.msg_control = u.buf;
-+            msg.msg_controllen = sizeof(u.buf);
-+
-+            cmsg = CMSG_FIRSTHDR(&msg);
-+            cmsg->cmsg_level = SOL_SOCKET;
-+            cmsg->cmsg_type = SCM_RIGHTS;
-+            cmsg->cmsg_len = CMSG_LEN(sizeof(int));
-+            *((int *) CMSG_DATA(cmsg)) = auxfd;
-+        }
-+
-+        do {
-+            rc = sendmsg(fd, &msg, 0);
-+        } while (rc < 0 && errno == EINTR);
-+    }
-+#endif
-+    
-     if (rc < 0) {
-         return errno;
-     }
-@@ -410,7 +495,7 @@
- }
- 
- static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
--                            cgid_req_t *req)
-+                            int *errfd, cgid_req_t *req)
- {
-     int i;
-     char **environ;
-@@ -421,7 +506,7 @@
-     r->server = apr_pcalloc(r->pool, sizeof(server_rec));
- 
-     /* read the request header */
--    stat = sock_read(fd, req, sizeof(*req));
-+    stat = sock_readhdr(fd, errfd, req, sizeof(*req));
-     if (stat != APR_SUCCESS) {
-         return stat;
-     }
-@@ -479,14 +564,15 @@
-     return APR_SUCCESS;
- }
- 
--static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
--                             int req_type)
-+static apr_status_t send_req(int fd, apr_file_t *errpipe, request_rec *r,
-+                             char *argv0, char **env, int req_type)
- {
-     int i;
-     cgid_req_t req = {0};
-     apr_status_t stat;
-     ap_unix_identity_t * ugid = ap_run_get_suexec_identity(r);
-     core_dir_config *core_conf = ap_get_core_module_config(r->per_dir_config);
-+    int errfd;
- 
- 
-     if (ugid == NULL) {
-@@ -507,16 +593,21 @@
-     req.args_len = r->args ? strlen(r->args) : 0;
-     req.loglevel = r->server->log.level;
- 
-+    if (errpipe)
-+        apr_os_file_get(&errfd, errpipe);
-+    else
-+        errfd = 0;
-+    
-     /* Write the request header */
-     if (req.args_len) {
--        stat = sock_writev(fd, r, 5,
-+        stat = sock_writev(fd, errfd, r, 5,
-                            &req, sizeof(req),
-                            r->filename, req.filename_len,
-                            argv0, req.argv0_len,
-                            r->uri, req.uri_len,
-                            r->args, req.args_len);
-     } else {
--        stat = sock_writev(fd, r, 4,
-+        stat = sock_writev(fd, errfd, r, 4,
-                            &req, sizeof(req),
-                            r->filename, req.filename_len,
-                            argv0, req.argv0_len,
-@@ -531,7 +622,7 @@
-     for (i = 0; i < req.env_count; i++) {
-         apr_size_t curlen = strlen(env[i]);
- 
--        if ((stat = sock_writev(fd, r, 2, &curlen, sizeof(curlen),
-+        if ((stat = sock_writev(fd, 0, r, 2, &curlen, sizeof(curlen),
-                                 env[i], curlen)) != APR_SUCCESS) {
-             return stat;
-         }
-@@ -582,20 +673,34 @@
-     }
- }
- 
-+/* Callback executed in the forked child process if exec of the CGI
-+ * script fails.  For the fd-passing case, output to stderr goes to
-+ * the client (request handling thread) and is logged via
-+ * ap_log_rerror there.  For the non-fd-passing case, the "fake"
-+ * request_rec passed via userdata is used to log. */
- static void cgid_child_errfn(apr_pool_t *pool, apr_status_t err,
-                              const char *description)
- {
--    request_rec *r;
-     void *vr;
- 
-     apr_pool_userdata_get(&vr, ERRFN_USERDATA_KEY, pool);
--    r = vr;
--
--    /* sure we got r, but don't call ap_log_rerror() because we don't
--     * have r->headers_in and possibly other storage referenced by
--     * ap_log_rerror()
--     */
--    ap_log_error(APLOG_MARK, APLOG_ERR, err, r->server, APLOGNO(01241) "%s", description);
-+    if (vr) {
-+        request_rec *r = vr;
-+        
-+        /* sure we got r, but don't call ap_log_rerror() because we don't
-+         * have r->headers_in and possibly other storage referenced by
-+         * ap_log_rerror()
-+         */
-+        ap_log_error(APLOG_MARK, APLOG_ERR, err, r->server, APLOGNO(01241) "%s", description);
-+    }
-+    else {
-+        const char *logstr;
-+        
-+        logstr = apr_psprintf(pool, APLOGNO(01241) "error spawning CGI child: %s (%pm)\n",
-+                              description, &err);
-+        fputs(logstr, stderr);
-+        fflush(stderr);
-+    }
- }
- 
- static int cgid_server(void *data)
-@@ -669,7 +774,7 @@
-     }
- 
-     while (!daemon_should_exit) {
--        int errfileno = STDERR_FILENO;
-+        int errfileno;
-         char *argv0 = NULL;
-         char **env = NULL;
-         const char * const *argv;
-@@ -709,7 +814,7 @@
-         r = apr_pcalloc(ptrans, sizeof(request_rec));
-         procnew = apr_pcalloc(ptrans, sizeof(*procnew));
-         r->pool = ptrans;
--        stat = get_req(sd2, r, &argv0, &env, &cgid_req);
-+        stat = get_req(sd2, r, &argv0, &env, &errfileno, &cgid_req);
-         if (stat != APR_SUCCESS) {
-             ap_log_error(APLOG_MARK, APLOG_ERR, stat,
-                          main_server, APLOGNO(01248)
-@@ -741,6 +846,16 @@
-             continue;
-         }
- 
-+        if (errfileno == 0) {
-+            errfileno = STDERR_FILENO;
-+        }
-+        else {
-+            ap_log_error(APLOG_MARK, APLOG_DEBUG, rv, main_server,
-+                          "using passed fd %d as stderr", errfileno);
-+            /* Limit the received fd lifetime to pool lifetime */
-+            apr_pool_cleanup_register(ptrans, (void *)((long)errfileno),
-+                                      close_unix_socket, close_unix_socket);
-+        }
-         apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool);
-         apr_os_file_put(&inout, &sd2, 0, r->pool);
- 
-@@ -800,7 +915,10 @@
-             close(sd2);
-         }
-         else {
--            apr_pool_userdata_set(r, ERRFN_USERDATA_KEY, apr_pool_cleanup_null, ptrans);
-+            if (errfileno == STDERR_FILENO) {
-+                /* Used by cgid_child_errfn without fd-passing. */
-+                apr_pool_userdata_set(r, ERRFN_USERDATA_KEY, apr_pool_cleanup_null, ptrans);
-+            }
- 
-             argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args);
- 
-@@ -1099,6 +1217,33 @@
-     return ret;
- }
- 
-+/* Soak up stderr from a script and redirect it to the error log.
-+ * TODO: log_scripterror() and this could move to cgi_common.h. */
-+static apr_status_t log_script_err(request_rec *r, apr_file_t *script_err)
-+{
-+    char argsbuffer[HUGE_STRING_LEN];
-+    char *newline;
-+    apr_status_t rv;
-+    cgid_server_conf *conf = ap_get_module_config(r->server->module_config, &cgid_module);
-+
-+    while ((rv = apr_file_gets(argsbuffer, HUGE_STRING_LEN,
-+                               script_err)) == APR_SUCCESS) {
-+
-+        newline = strchr(argsbuffer, '\n');
-+        if (newline) {
-+            char *prev = newline - 1;
-+            if (prev >= argsbuffer && *prev == '\r') {
-+                newline = prev;
-+            }
-+
-+            *newline = '\0';
-+        }
-+        log_scripterror(r, conf, r->status, 0, argsbuffer);
-+    }
-+
-+    return rv;
-+}
-+
- static int log_script(request_rec *r, cgid_server_conf * conf, int ret,
-                       char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
-                       apr_file_t *script_err)
-@@ -1204,6 +1349,13 @@
-     return ret;
- }
- 
-+/* Pull in CGI bucket implementation. */
-+#define cgi_server_conf cgid_server_conf
-+#ifdef HAVE_CGID_FDPASSING
-+#define WANT_CGI_BUCKET
-+#endif
-+#include "cgi_common.h"
-+
- static int connect_to_daemon(int *sdptr, request_rec *r,
-                              cgid_server_conf *conf)
- {
-@@ -1270,27 +1422,6 @@
-     return OK;
- }
- 
--static void discard_script_output(apr_bucket_brigade *bb)
--{
--    apr_bucket *e;
--    const char *buf;
--    apr_size_t len;
--    apr_status_t rv;
--
--    for (e = APR_BRIGADE_FIRST(bb);
--         e != APR_BRIGADE_SENTINEL(bb);
--         e = APR_BUCKET_NEXT(e))
--    {
--        if (APR_BUCKET_IS_EOS(e)) {
--            break;
--        }
--        rv = apr_bucket_read(e, &buf, &len, APR_BLOCK_READ);
--        if (rv != APR_SUCCESS) {
--            break;
--        }
--    }
--}
--
- /****************************************************************
-  *
-  * Actual cgid handling...
-@@ -1395,6 +1526,7 @@
- 
- static int cgid_handler(request_rec *r)
- {
-+    conn_rec *c = r->connection;
-     int retval, nph, dbpos;
-     char *argv0, *dbuf;
-     apr_bucket_brigade *bb;
-@@ -1404,10 +1536,11 @@
-     int seen_eos, child_stopped_reading;
-     int sd;
-     char **env;
--    apr_file_t *tempsock;
-+    apr_file_t *tempsock, *script_err, *errpipe_out;
-     struct cleanup_script_info *info;
-     apr_status_t rv;
-     cgid_dirconf *dc;
-+    apr_interval_time_t timeout;
- 
-     if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
-         return DECLINED;
-@@ -1416,7 +1549,7 @@
-     conf = ap_get_module_config(r->server->module_config, &cgid_module);
-     dc = ap_get_module_config(r->per_dir_config, &cgid_module);
- 
--    
-+    timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
-     is_included = !strcmp(r->protocol, "INCLUDED");
- 
-     if ((argv0 = strrchr(r->filename, '/')) != NULL) {
-@@ -1469,6 +1602,17 @@
-     }
-     */
- 
-+#ifdef HAVE_CGID_FDPASSING
-+    rv = apr_file_pipe_create(&script_err, &errpipe_out, r->pool);
-+    if (rv) {
-+        return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10176)
-+                               "could not create pipe for stderr");
-+    }
-+#else
-+    script_err = NULL;
-+    errpipe_out = NULL;
-+#endif
-+    
-     /*
-      * httpd core function used to add common environment variables like
-      * DOCUMENT_ROOT. 
-@@ -1481,12 +1625,16 @@
-         return retval;
-     }
- 
--    rv = send_req(sd, r, argv0, env, CGI_REQ);
-+    rv = send_req(sd, errpipe_out, r, argv0, env, CGI_REQ);
-     if (rv != APR_SUCCESS) {
-         ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01268)
-                      "write to cgi daemon process");
-     }
- 
-+    /* The write-end of the pipe is only used by the server, so close
-+     * it here. */
-+    if (errpipe_out) apr_file_close(errpipe_out);
-+    
-     info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
-     info->conf = conf;
-     info->r = r;
-@@ -1508,12 +1656,7 @@
-      */
- 
-     apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
--    if (dc->timeout > 0) { 
--        apr_file_pipe_timeout_set(tempsock, dc->timeout);
--    }
--    else { 
--        apr_file_pipe_timeout_set(tempsock, r->server->timeout);
--    }
-+    apr_file_pipe_timeout_set(tempsock, timeout);
-     apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket);
- 
-     /* Transfer any put/post args, CERN style...
-@@ -1605,114 +1748,19 @@
-      */
-     shutdown(sd, 1);
- 
--    /* Handle script return... */
--    if (!nph) {
--        conn_rec *c = r->connection;
--        const char *location;
--        char sbuf[MAX_STRING_LEN];
--        int ret;
--
--        bb = apr_brigade_create(r->pool, c->bucket_alloc);
--        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
--        APR_BRIGADE_INSERT_TAIL(bb, b);
--        b = apr_bucket_eos_create(c->bucket_alloc);
--        APR_BRIGADE_INSERT_TAIL(bb, b);
--
--        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
--                                                        APLOG_MODULE_INDEX)))
--        {
--            ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL);
--
--            /*
--             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
--             * does not set an explicit status and ap_meets_conditions, which
--             * is called by ap_scan_script_header_err_brigade, detects that
--             * the conditions of the requests are met and the response is
--             * not modified.
--             * In this case set r->status and return OK in order to prevent
--             * running through the error processing stack as this would
--             * break with mod_cache, if the conditions had been set by
--             * mod_cache itself to validate a stale entity.
--             * BTW: We circumvent the error processing stack anyway if the
--             * CGI script set an explicit status code (whatever it is) and
--             * the only possible values for ret here are:
--             *
--             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
--             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
--             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
--             * processing of the response of the CGI script, e.g broken headers
--             * or a crashed CGI process).
--             */
--            if (ret == HTTP_NOT_MODIFIED) {
--                r->status = ret;
--                return OK;
--            }
--
--            return ret;
--        }
--
--        location = apr_table_get(r->headers_out, "Location");
--
--        if (location && location[0] == '/' && r->status == 200) {
--
--            /* Soak up all the script output */
--            discard_script_output(bb);
--            apr_brigade_destroy(bb);
--            /* This redirect needs to be a GET no matter what the original
--             * method was.
--             */
--            r->method = "GET";
--            r->method_number = M_GET;
--
--            /* We already read the message body (if any), so don't allow
--             * the redirected request to think it has one. We can ignore
--             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
--             */
--            apr_table_unset(r->headers_in, "Content-Length");
--
--            ap_internal_redirect_handler(location, r);
--            return OK;
--        }
--        else if (location && r->status == 200) {
--            /* XXX: Note that if a script wants to produce its own Redirect
--             * body, it now has to explicitly *say* "Status: 302"
--             */
--            discard_script_output(bb);
--            apr_brigade_destroy(bb);
--            return HTTP_MOVED_TEMPORARILY;
--        }
--
--        rv = ap_pass_brigade(r->output_filters, bb);
--        if (rv != APR_SUCCESS) { 
--            ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r,
--                          "Failed to flush CGI output to client");
--        }
--    }
--
--    if (nph) {
--        conn_rec *c = r->connection;
--        struct ap_filter_t *cur;
--
--        /* get rid of all filters up through protocol...  since we
--         * haven't parsed off the headers, there is no way they can
--         * work
--         */
--
--        cur = r->proto_output_filters;
--        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
--            cur = cur->next;
--        }
--        r->output_filters = r->proto_output_filters = cur;
--
--        bb = apr_brigade_create(r->pool, c->bucket_alloc);
--        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
--        APR_BRIGADE_INSERT_TAIL(bb, b);
--        b = apr_bucket_eos_create(c->bucket_alloc);
--        APR_BRIGADE_INSERT_TAIL(bb, b);
--        ap_pass_brigade(r->output_filters, bb);
--    }
-+    bb = apr_brigade_create(r->pool, c->bucket_alloc);
-+#ifdef HAVE_CGID_FDPASSING
-+    b = cgi_bucket_create(r, dc->timeout, tempsock, script_err, c->bucket_alloc);
-+    if (b == NULL)
-+        return HTTP_INTERNAL_SERVER_ERROR; /* should call log_scripterror() w/ _UNAVAILABLE? */
-+#else
-+    b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
-+#endif
-+    APR_BRIGADE_INSERT_TAIL(bb, b);
-+    b = apr_bucket_eos_create(c->bucket_alloc);
-+    APR_BRIGADE_INSERT_TAIL(bb, b);
- 
--    return OK; /* NOT r->status, even if it has changed. */
-+    return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err);
- }
- 
- 
-@@ -1829,7 +1877,7 @@
-         return retval;
-     }
- 
--    send_req(sd, r, command, env, SSI_REQ);
-+    send_req(sd, NULL, r, command, env, SSI_REQ);
- 
-     info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
-     info->conf = conf;
---- httpd-2.4.41/modules/generators/cgi_common.h
-+++ httpd-2.4.41/modules/generators/cgi_common.h
+diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h
+new file mode 100644
+index 0000000..85c9685
+--- /dev/null
++++ b/modules/generators/cgi_common.h
 @@ -0,0 +1,359 @@
 +/* Licensed to the Apache Software Foundation (ASF) under one or more
 + * contributor license agreements.  See the NOTICE file distributed with
@@ -1418,3 +363,1051 @@ http://svn.apache.org/viewvc?view=revision&revision=1867971
 +
 +    return OK;                      /* NOT r->status, even if it has changed. */
 +}
+diff --git a/modules/generators/config5.m4 b/modules/generators/config5.m4
+index bf29521..0863553 100644
+--- a/modules/generators/config5.m4
++++ b/modules/generators/config5.m4
+@@ -78,4 +78,15 @@ fi
+ 
+ APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
+ 
++AC_ARG_ENABLE(cgid-fdpassing,
++  [APACHE_HELP_STRING(--enable-cgid-fdpassing,Enable experimental mod_cgid support for fd passing)],
++  [if test "$enableval" = "yes"; then
++     AC_CHECK_DECL(CMSG_DATA,
++       [AC_DEFINE([HAVE_CGID_FDPASSING], 1, [Enable FD passing support in mod_cgid])],
++       [AC_MSG_ERROR([cannot support mod_cgid fd-passing on this system])], [
++#include <sys/types.h>
++#include <sys/socket.h>])
++  fi
++])
++
+ APACHE_MODPATH_FINISH
+diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c
+index 7e4b126..f438b35 100644
+--- a/modules/generators/mod_cgi.c
++++ b/modules/generators/mod_cgi.c
+@@ -92,6 +92,10 @@ typedef struct {
+     apr_size_t  bufbytes;
+ } cgi_server_conf;
+ 
++typedef struct {
++    apr_interval_time_t timeout;
++} cgi_dirconf;
++
+ static void *create_cgi_config(apr_pool_t *p, server_rec *s)
+ {
+     cgi_server_conf *c =
+@@ -112,6 +116,12 @@ static void *merge_cgi_config(apr_pool_t *p, void *basev, void *overridesv)
+     return overrides->logname ? overrides : base;
+ }
+ 
++static void *create_cgi_dirconf(apr_pool_t *p, char *dummy)
++{
++    cgi_dirconf *c = (cgi_dirconf *) apr_pcalloc(p, sizeof(cgi_dirconf));
++    return c;
++}
++
+ static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg)
+ {
+     server_rec *s = cmd->server;
+@@ -150,6 +160,17 @@ static const char *set_scriptlog_buffer(cmd_parms *cmd, void *dummy,
+     return NULL;
+ }
+ 
++static const char *set_script_timeout(cmd_parms *cmd, void *dummy, const char *arg)
++{
++    cgi_dirconf *dc = dummy;
++
++    if (ap_timeout_parameter_parse(arg, &dc->timeout, "s") != APR_SUCCESS) {
++        return "CGIScriptTimeout has wrong format";
++    }
++
++    return NULL;
++}
++
+ static const command_rec cgi_cmds[] =
+ {
+ AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF,
+@@ -158,6 +179,9 @@ AP_INIT_TAKE1("ScriptLogLength", set_scriptlog_length, NULL, RSRC_CONF,
+      "the maximum length (in bytes) of the script debug log"),
+ AP_INIT_TAKE1("ScriptLogBuffer", set_scriptlog_buffer, NULL, RSRC_CONF,
+      "the maximum size (in bytes) to record of a POST request"),
++AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_CONF,
++     "The amount of time to wait between successful reads from "
++     "the CGI script, in seconds."),
+     {NULL}
+ };
+ 
+@@ -466,23 +490,26 @@ static apr_status_t run_cgi_child(apr_file_t **script_out,
+                           apr_filepath_name_get(r->filename));
+         }
+         else {
++            cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module);
++            apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
++
+             apr_pool_note_subprocess(p, procnew, APR_KILL_AFTER_TIMEOUT);
+ 
+             *script_in = procnew->out;
+             if (!*script_in)
+                 return APR_EBADF;
+-            apr_file_pipe_timeout_set(*script_in, r->server->timeout);
++            apr_file_pipe_timeout_set(*script_in, timeout);
+ 
+             if (e_info->prog_type == RUN_AS_CGI) {
+                 *script_out = procnew->in;
+                 if (!*script_out)
+                     return APR_EBADF;
+-                apr_file_pipe_timeout_set(*script_out, r->server->timeout);
++                apr_file_pipe_timeout_set(*script_out, timeout);
+ 
+                 *script_err = procnew->err;
+                 if (!*script_err)
+                     return APR_EBADF;
+-                apr_file_pipe_timeout_set(*script_err, r->server->timeout);
++                apr_file_pipe_timeout_set(*script_err, timeout);
+             }
+         }
+     }
+@@ -536,209 +563,12 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv,
+     return APR_SUCCESS;
+ }
+ 
+-static void discard_script_output(apr_bucket_brigade *bb)
+-{
+-    apr_bucket *e;
+-    const char *buf;
+-    apr_size_t len;
+-
+-    for (e = APR_BRIGADE_FIRST(bb);
+-         e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e);
+-         e = APR_BRIGADE_FIRST(bb))
+-    {
+-        if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) {
+-            break;
+-        }
+-        apr_bucket_delete(e);
+-    }
+-}
+-
+ #if APR_FILES_AS_SOCKETS
+-
+-/* A CGI bucket type is needed to catch any output to stderr from the
+- * script; see PR 22030. */
+-static const apr_bucket_type_t bucket_type_cgi;
+-
+-struct cgi_bucket_data {
+-    apr_pollset_t *pollset;
+-    request_rec *r;
+-};
+-
+-/* Create a CGI bucket using pipes from script stdout 'out'
+- * and stderr 'err', for request 'r'. */
+-static apr_bucket *cgi_bucket_create(request_rec *r,
+-                                     apr_file_t *out, apr_file_t *err,
+-                                     apr_bucket_alloc_t *list)
+-{
+-    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
+-    apr_status_t rv;
+-    apr_pollfd_t fd;
+-    struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data);
+-
+-    APR_BUCKET_INIT(b);
+-    b->free = apr_bucket_free;
+-    b->list = list;
+-    b->type = &bucket_type_cgi;
+-    b->length = (apr_size_t)(-1);
+-    b->start = -1;
+-
+-    /* Create the pollset */
+-    rv = apr_pollset_create(&data->pollset, 2, r->pool, 0);
+-    if (rv != APR_SUCCESS) {
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01217)
+-                     "apr_pollset_create(); check system or user limits");
+-        return NULL;
+-    }
+-
+-    fd.desc_type = APR_POLL_FILE;
+-    fd.reqevents = APR_POLLIN;
+-    fd.p = r->pool;
+-    fd.desc.f = out; /* script's stdout */
+-    fd.client_data = (void *)1;
+-    rv = apr_pollset_add(data->pollset, &fd);
+-    if (rv != APR_SUCCESS) {
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01218)
+-                     "apr_pollset_add(); check system or user limits");
+-        return NULL;
+-    }
+-
+-    fd.desc.f = err; /* script's stderr */
+-    fd.client_data = (void *)2;
+-    rv = apr_pollset_add(data->pollset, &fd);
+-    if (rv != APR_SUCCESS) {
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01219)
+-                     "apr_pollset_add(); check system or user limits");
+-        return NULL;
+-    }
+-
+-    data->r = r;
+-    b->data = data;
+-    return b;
+-}
+-
+-/* Create a duplicate CGI bucket using given bucket data */
+-static apr_bucket *cgi_bucket_dup(struct cgi_bucket_data *data,
+-                                  apr_bucket_alloc_t *list)
+-{
+-    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
+-    APR_BUCKET_INIT(b);
+-    b->free = apr_bucket_free;
+-    b->list = list;
+-    b->type = &bucket_type_cgi;
+-    b->length = (apr_size_t)(-1);
+-    b->start = -1;
+-    b->data = data;
+-    return b;
+-}
+-
+-/* Handle stdout from CGI child.  Duplicate of logic from the _read
+- * method of the real APR pipe bucket implementation. */
+-static apr_status_t cgi_read_stdout(apr_bucket *a, apr_file_t *out,
+-                                    const char **str, apr_size_t *len)
+-{
+-    char *buf;
+-    apr_status_t rv;
+-
+-    *str = NULL;
+-    *len = APR_BUCKET_BUFF_SIZE;
+-    buf = apr_bucket_alloc(*len, a->list); /* XXX: check for failure? */
+-
+-    rv = apr_file_read(out, buf, len);
+-
+-    if (rv != APR_SUCCESS && rv != APR_EOF) {
+-        apr_bucket_free(buf);
+-        return rv;
+-    }
+-
+-    if (*len > 0) {
+-        struct cgi_bucket_data *data = a->data;
+-        apr_bucket_heap *h;
+-
+-        /* Change the current bucket to refer to what we read */
+-        a = apr_bucket_heap_make(a, buf, *len, apr_bucket_free);
+-        h = a->data;
+-        h->alloc_len = APR_BUCKET_BUFF_SIZE; /* note the real buffer size */
+-        *str = buf;
+-        APR_BUCKET_INSERT_AFTER(a, cgi_bucket_dup(data, a->list));
+-    }
+-    else {
+-        apr_bucket_free(buf);
+-        a = apr_bucket_immortal_make(a, "", 0);
+-        *str = a->data;
+-    }
+-    return rv;
+-}
+-
+-/* Read method of CGI bucket: polls on stderr and stdout of the child,
+- * sending any stderr output immediately away to the error log. */
+-static apr_status_t cgi_bucket_read(apr_bucket *b, const char **str,
+-                                    apr_size_t *len, apr_read_type_e block)
+-{
+-    struct cgi_bucket_data *data = b->data;
+-    apr_interval_time_t timeout;
+-    apr_status_t rv;
+-    int gotdata = 0;
+-
+-    timeout = block == APR_NONBLOCK_READ ? 0 : data->r->server->timeout;
+-
+-    do {
+-        const apr_pollfd_t *results;
+-        apr_int32_t num;
+-
+-        rv = apr_pollset_poll(data->pollset, timeout, &num, &results);
+-        if (APR_STATUS_IS_TIMEUP(rv)) {
+-            if (timeout) {
+-                ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, data->r, APLOGNO(01220)
+-                              "Timeout waiting for output from CGI script %s",
+-                              data->r->filename);
+-                return rv;
+-            }
+-            else {
+-                return APR_EAGAIN;
+-            }
+-        }
+-        else if (APR_STATUS_IS_EINTR(rv)) {
+-            continue;
+-        }
+-        else if (rv != APR_SUCCESS) {
+-            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, data->r, APLOGNO(01221)
+-                          "poll failed waiting for CGI child");
+-            return rv;
+-        }
+-
+-        for (; num; num--, results++) {
+-            if (results[0].client_data == (void *)1) {
+-                /* stdout */
+-                rv = cgi_read_stdout(b, results[0].desc.f, str, len);
+-                if (APR_STATUS_IS_EOF(rv)) {
+-                    rv = APR_SUCCESS;
+-                }
+-                gotdata = 1;
+-            } else {
+-                /* stderr */
+-                apr_status_t rv2 = log_script_err(data->r, results[0].desc.f);
+-                if (APR_STATUS_IS_EOF(rv2)) {
+-                    apr_pollset_remove(data->pollset, &results[0]);
+-                }
+-            }
+-        }
+-
+-    } while (!gotdata);
+-
+-    return rv;
+-}
+-
+-static const apr_bucket_type_t bucket_type_cgi = {
+-    "CGI", 5, APR_BUCKET_DATA,
+-    apr_bucket_destroy_noop,
+-    cgi_bucket_read,
+-    apr_bucket_setaside_notimpl,
+-    apr_bucket_split_notimpl,
+-    apr_bucket_copy_notimpl
+-};
+-
++#define WANT_CGI_BUCKET
+ #endif
+ 
++#include "cgi_common.h"
++
+ static int cgi_handler(request_rec *r)
+ {
+     int nph;
+@@ -757,6 +587,8 @@ static int cgi_handler(request_rec *r)
+     apr_status_t rv;
+     cgi_exec_info_t e_info;
+     conn_rec *c;
++    cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module);
++    apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
+ 
+     if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
+         return DECLINED;
+@@ -916,10 +748,7 @@ static int cgi_handler(request_rec *r)
+     AP_DEBUG_ASSERT(script_in != NULL);
+ 
+ #if APR_FILES_AS_SOCKETS
+-    apr_file_pipe_timeout_set(script_in, 0);
+-    apr_file_pipe_timeout_set(script_err, 0);
+-
+-    b = cgi_bucket_create(r, script_in, script_err, c->bucket_alloc);
++    b = cgi_bucket_create(r, dc->timeout, script_in, script_err, c->bucket_alloc);
+     if (b == NULL)
+         return HTTP_INTERNAL_SERVER_ERROR;
+ #else
+@@ -929,111 +758,7 @@ static int cgi_handler(request_rec *r)
+     b = apr_bucket_eos_create(c->bucket_alloc);
+     APR_BRIGADE_INSERT_TAIL(bb, b);
+ 
+-    /* Handle script return... */
+-    if (!nph) {
+-        const char *location;
+-        char sbuf[MAX_STRING_LEN];
+-        int ret;
+-
+-        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+-                                                        APLOG_MODULE_INDEX)))
+-        {
+-            ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err);
+-
+-            /*
+-             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
+-             * does not set an explicit status and ap_meets_conditions, which
+-             * is called by ap_scan_script_header_err_brigade, detects that
+-             * the conditions of the requests are met and the response is
+-             * not modified.
+-             * In this case set r->status and return OK in order to prevent
+-             * running through the error processing stack as this would
+-             * break with mod_cache, if the conditions had been set by
+-             * mod_cache itself to validate a stale entity.
+-             * BTW: We circumvent the error processing stack anyway if the
+-             * CGI script set an explicit status code (whatever it is) and
+-             * the only possible values for ret here are:
+-             *
+-             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
+-             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
+-             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
+-             * processing of the response of the CGI script, e.g broken headers
+-             * or a crashed CGI process).
+-             */
+-            if (ret == HTTP_NOT_MODIFIED) {
+-                r->status = ret;
+-                return OK;
+-            }
+-
+-            return ret;
+-        }
+-
+-        location = apr_table_get(r->headers_out, "Location");
+-
+-        if (location && r->status == 200) {
+-            /* For a redirect whether internal or not, discard any
+-             * remaining stdout from the script, and log any remaining
+-             * stderr output, as normal. */
+-            discard_script_output(bb);
+-            apr_brigade_destroy(bb);
+-            apr_file_pipe_timeout_set(script_err, r->server->timeout);
+-            log_script_err(r, script_err);
+-        }
+-
+-        if (location && location[0] == '/' && r->status == 200) {
+-            /* This redirect needs to be a GET no matter what the original
+-             * method was.
+-             */
+-            r->method = "GET";
+-            r->method_number = M_GET;
+-
+-            /* We already read the message body (if any), so don't allow
+-             * the redirected request to think it has one.  We can ignore
+-             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
+-             */
+-            apr_table_unset(r->headers_in, "Content-Length");
+-
+-            ap_internal_redirect_handler(location, r);
+-            return OK;
+-        }
+-        else if (location && r->status == 200) {
+-            /* XXX: Note that if a script wants to produce its own Redirect
+-             * body, it now has to explicitly *say* "Status: 302"
+-             */
+-            return HTTP_MOVED_TEMPORARILY;
+-        }
+-
+-        rv = ap_pass_brigade(r->output_filters, bb);
+-    }
+-    else /* nph */ {
+-        struct ap_filter_t *cur;
+-
+-        /* get rid of all filters up through protocol...  since we
+-         * haven't parsed off the headers, there is no way they can
+-         * work
+-         */
+-
+-        cur = r->proto_output_filters;
+-        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
+-            cur = cur->next;
+-        }
+-        r->output_filters = r->proto_output_filters = cur;
+-
+-        rv = ap_pass_brigade(r->output_filters, bb);
+-    }
+-
+-    /* don't soak up script output if errors occurred writing it
+-     * out...  otherwise, we prolong the life of the script when the
+-     * connection drops or we stopped sending output for some other
+-     * reason */
+-    if (rv == APR_SUCCESS && !r->connection->aborted) {
+-        apr_file_pipe_timeout_set(script_err, r->server->timeout);
+-        log_script_err(r, script_err);
+-    }
+-
+-    apr_file_close(script_err);
+-
+-    return OK;                      /* NOT r->status, even if it has changed. */
++    return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err);
+ }
+ 
+ /*============================================================================
+@@ -1268,7 +993,7 @@ static void register_hooks(apr_pool_t *p)
+ AP_DECLARE_MODULE(cgi) =
+ {
+     STANDARD20_MODULE_STUFF,
+-    NULL,                        /* dir config creater */
++    create_cgi_dirconf,          /* dir config creater */
+     NULL,                        /* dir merger --- default is to override */
+     create_cgi_config,           /* server config */
+     merge_cgi_config,            /* merge server config */
+diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c
+index 9f4282c..102d2b3 100644
+--- a/modules/generators/mod_cgid.c
++++ b/modules/generators/mod_cgid.c
+@@ -342,15 +342,19 @@ static apr_status_t close_unix_socket(void *thefd)
+     return close(fd);
+ }
+ 
+-/* deal with incomplete reads and signals
+- * assume you really have to read buf_size bytes
+- */
+-static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
++/* Read from the socket dealing with incomplete messages and signals.
++ * Returns 0 on success or errno on failure.  Stderr fd passed as
++ * auxiliary data from other end is written to *errfd, or else stderr
++ * fileno if not present. */
++static apr_status_t sock_readhdr(int fd, int *errfd, void *vbuf, size_t buf_size)
+ {
+-    char *buf = vbuf;
+     int rc;
++#ifndef HAVE_CGID_FDPASSING
++    char *buf = vbuf;
+     size_t bytes_read = 0;
+ 
++    if (errfd) *errfd = 0;
++    
+     do {
+         do {
+             rc = read(fd, buf + bytes_read, buf_size - bytes_read);
+@@ -365,9 +369,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
+         }
+     } while (bytes_read < buf_size);
+ 
++   
++#else /* with FD passing */
++    struct msghdr msg = {0};
++    struct iovec vec = {vbuf, buf_size};
++    struct cmsghdr *cmsg;
++    union {  /* union to ensure alignment */
++        struct cmsghdr cm;
++        char buf[CMSG_SPACE(sizeof(int))];
++    } u;
++    
++    msg.msg_iov = &vec;
++    msg.msg_iovlen = 1;
++
++    if (errfd) {
++        msg.msg_control = u.buf;
++        msg.msg_controllen = sizeof(u.buf);
++        *errfd = 0;
++    }
++    
++    /* use MSG_WAITALL to skip loop on truncated reads */
++    do {
++        rc = recvmsg(fd, &msg, MSG_WAITALL);
++    } while (rc < 0 && errno == EINTR);
++
++    if (rc == 0) {
++        return ECONNRESET;
++    }
++    else if (rc < 0) {
++        return errno;
++    }
++    else if (rc != buf_size) {
++        /* MSG_WAITALL should ensure the recvmsg blocks until the
++         * entire length is read, but let's be paranoid. */
++        return APR_INCOMPLETE;
++    }
++
++    if (errfd
++        && (cmsg = CMSG_FIRSTHDR(&msg)) != NULL
++        && cmsg->cmsg_len == CMSG_LEN(sizeof(*errfd))
++        && cmsg->cmsg_level == SOL_SOCKET
++        && cmsg->cmsg_type == SCM_RIGHTS) {
++        *errfd = *((int *) CMSG_DATA(cmsg));
++    }
++#endif
++    
+     return APR_SUCCESS;
+ }
+ 
++/* As sock_readhdr but without auxiliary fd passing. */
++static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
++{
++    return sock_readhdr(fd, NULL, vbuf, buf_size);
++}
++
+ /* deal with signals
+  */
+ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
+@@ -384,7 +439,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
+     return APR_SUCCESS;
+ }
+ 
+-static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
++static apr_status_t sock_writev(int fd, int auxfd, request_rec *r, int count, ...)
+ {
+     va_list ap;
+     int rc;
+@@ -399,9 +454,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
+     }
+     va_end(ap);
+ 
++#ifndef HAVE_CGID_FDPASSING
+     do {
+         rc = writev(fd, vec, count);
+     } while (rc < 0 && errno == EINTR);
++#else
++    {
++        struct msghdr msg = { 0 };
++        struct cmsghdr *cmsg;
++        union { /* union for alignment */
++            char buf[CMSG_SPACE(sizeof(int))];
++            struct cmsghdr align;
++        } u;
++
++        msg.msg_iov = vec;
++        msg.msg_iovlen = count;
++
++        if (auxfd) {
++            msg.msg_control = u.buf;
++            msg.msg_controllen = sizeof(u.buf);
++
++            cmsg = CMSG_FIRSTHDR(&msg);
++            cmsg->cmsg_level = SOL_SOCKET;
++            cmsg->cmsg_type = SCM_RIGHTS;
++            cmsg->cmsg_len = CMSG_LEN(sizeof(int));
++            *((int *) CMSG_DATA(cmsg)) = auxfd;
++        }
++
++        do {
++            rc = sendmsg(fd, &msg, 0);
++        } while (rc < 0 && errno == EINTR);
++    }
++#endif
++    
+     if (rc < 0) {
+         return errno;
+     }
+@@ -410,7 +495,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
+ }
+ 
+ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
+-                            cgid_req_t *req)
++                            int *errfd, cgid_req_t *req)
+ {
+     int i;
+     char **environ;
+@@ -421,7 +506,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
+     r->server = apr_pcalloc(r->pool, sizeof(server_rec));
+ 
+     /* read the request header */
+-    stat = sock_read(fd, req, sizeof(*req));
++    stat = sock_readhdr(fd, errfd, req, sizeof(*req));
+     if (stat != APR_SUCCESS) {
+         return stat;
+     }
+@@ -479,14 +564,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
+     return APR_SUCCESS;
+ }
+ 
+-static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
+-                             int req_type)
++static apr_status_t send_req(int fd, apr_file_t *errpipe, request_rec *r,
++                             char *argv0, char **env, int req_type)
+ {
+     int i;
+     cgid_req_t req = {0};
+     apr_status_t stat;
+     ap_unix_identity_t * ugid = ap_run_get_suexec_identity(r);
+     core_dir_config *core_conf = ap_get_core_module_config(r->per_dir_config);
++    int errfd;
+ 
+ 
+     if (ugid == NULL) {
+@@ -507,16 +593,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
+     req.args_len = r->args ? strlen(r->args) : 0;
+     req.loglevel = r->server->log.level;
+ 
++    if (errpipe)
++        apr_os_file_get(&errfd, errpipe);
++    else
++        errfd = 0;
++    
+     /* Write the request header */
+     if (req.args_len) {
+-        stat = sock_writev(fd, r, 5,
++        stat = sock_writev(fd, errfd, r, 5,
+                            &req, sizeof(req),
+                            r->filename, req.filename_len,
+                            argv0, req.argv0_len,
+                            r->uri, req.uri_len,
+                            r->args, req.args_len);
+     } else {
+-        stat = sock_writev(fd, r, 4,
++        stat = sock_writev(fd, errfd, r, 4,
+                            &req, sizeof(req),
+                            r->filename, req.filename_len,
+                            argv0, req.argv0_len,
+@@ -531,7 +622,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
+     for (i = 0; i < req.env_count; i++) {
+         apr_size_t curlen = strlen(env[i]);
+ 
+-        if ((stat = sock_writev(fd, r, 2, &curlen, sizeof(curlen),
++        if ((stat = sock_writev(fd, 0, r, 2, &curlen, sizeof(curlen),
+                                 env[i], curlen)) != APR_SUCCESS) {
+             return stat;
+         }
+@@ -582,20 +673,34 @@ static void daemon_signal_handler(int sig)
+     }
+ }
+ 
++/* Callback executed in the forked child process if exec of the CGI
++ * script fails.  For the fd-passing case, output to stderr goes to
++ * the client (request handling thread) and is logged via
++ * ap_log_rerror there.  For the non-fd-passing case, the "fake"
++ * request_rec passed via userdata is used to log. */
+ static void cgid_child_errfn(apr_pool_t *pool, apr_status_t err,
+                              const char *description)
+ {
+-    request_rec *r;
+     void *vr;
+ 
+     apr_pool_userdata_get(&vr, ERRFN_USERDATA_KEY, pool);
+-    r = vr;
+-
+-    /* sure we got r, but don't call ap_log_rerror() because we don't
+-     * have r->headers_in and possibly other storage referenced by
+-     * ap_log_rerror()
+-     */
+-    ap_log_error(APLOG_MARK, APLOG_ERR, err, r->server, APLOGNO(01241) "%s", description);
++    if (vr) {
++        request_rec *r = vr;
++        
++        /* sure we got r, but don't call ap_log_rerror() because we don't
++         * have r->headers_in and possibly other storage referenced by
++         * ap_log_rerror()
++         */
++        ap_log_error(APLOG_MARK, APLOG_ERR, err, r->server, APLOGNO(01241) "%s", description);
++    }
++    else {
++        const char *logstr;
++        
++        logstr = apr_psprintf(pool, APLOGNO(01241) "error spawning CGI child: %s (%pm)\n",
++                              description, &err);
++        fputs(logstr, stderr);
++        fflush(stderr);
++    }
+ }
+ 
+ static int cgid_server(void *data)
+@@ -669,7 +774,7 @@ static int cgid_server(void *data)
+     }
+ 
+     while (!daemon_should_exit) {
+-        int errfileno = STDERR_FILENO;
++        int errfileno;
+         char *argv0 = NULL;
+         char **env = NULL;
+         const char * const *argv;
+@@ -709,7 +814,7 @@ static int cgid_server(void *data)
+         r = apr_pcalloc(ptrans, sizeof(request_rec));
+         procnew = apr_pcalloc(ptrans, sizeof(*procnew));
+         r->pool = ptrans;
+-        stat = get_req(sd2, r, &argv0, &env, &cgid_req);
++        stat = get_req(sd2, r, &argv0, &env, &errfileno, &cgid_req);
+         if (stat != APR_SUCCESS) {
+             ap_log_error(APLOG_MARK, APLOG_ERR, stat,
+                          main_server, APLOGNO(01248)
+@@ -741,6 +846,16 @@ static int cgid_server(void *data)
+             continue;
+         }
+ 
++        if (errfileno == 0) {
++            errfileno = STDERR_FILENO;
++        }
++        else {
++            ap_log_error(APLOG_MARK, APLOG_DEBUG, rv, main_server,
++                          "using passed fd %d as stderr", errfileno);
++            /* Limit the received fd lifetime to pool lifetime */
++            apr_pool_cleanup_register(ptrans, (void *)((long)errfileno),
++                                      close_unix_socket, close_unix_socket);
++        }
+         apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool);
+         apr_os_file_put(&inout, &sd2, 0, r->pool);
+ 
+@@ -800,7 +915,10 @@ static int cgid_server(void *data)
+             close(sd2);
+         }
+         else {
+-            apr_pool_userdata_set(r, ERRFN_USERDATA_KEY, apr_pool_cleanup_null, ptrans);
++            if (errfileno == STDERR_FILENO) {
++                /* Used by cgid_child_errfn without fd-passing. */
++                apr_pool_userdata_set(r, ERRFN_USERDATA_KEY, apr_pool_cleanup_null, ptrans);
++            }
+ 
+             argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args);
+ 
+@@ -1099,6 +1217,33 @@ static int log_scripterror(request_rec *r, cgid_server_conf * conf, int ret,
+     return ret;
+ }
+ 
++/* Soak up stderr from a script and redirect it to the error log.
++ * TODO: log_scripterror() and this could move to cgi_common.h. */
++static apr_status_t log_script_err(request_rec *r, apr_file_t *script_err)
++{
++    char argsbuffer[HUGE_STRING_LEN];
++    char *newline;
++    apr_status_t rv;
++    cgid_server_conf *conf = ap_get_module_config(r->server->module_config, &cgid_module);
++
++    while ((rv = apr_file_gets(argsbuffer, HUGE_STRING_LEN,
++                               script_err)) == APR_SUCCESS) {
++
++        newline = strchr(argsbuffer, '\n');
++        if (newline) {
++            char *prev = newline - 1;
++            if (prev >= argsbuffer && *prev == '\r') {
++                newline = prev;
++            }
++
++            *newline = '\0';
++        }
++        log_scripterror(r, conf, r->status, 0, argsbuffer);
++    }
++
++    return rv;
++}
++
+ static int log_script(request_rec *r, cgid_server_conf * conf, int ret,
+                       char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
+                       apr_file_t *script_err)
+@@ -1204,6 +1349,13 @@ static int log_script(request_rec *r, cgid_server_conf * conf, int ret,
+     return ret;
+ }
+ 
++/* Pull in CGI bucket implementation. */
++#define cgi_server_conf cgid_server_conf
++#ifdef HAVE_CGID_FDPASSING
++#define WANT_CGI_BUCKET
++#endif
++#include "cgi_common.h"
++
+ static int connect_to_daemon(int *sdptr, request_rec *r,
+                              cgid_server_conf *conf)
+ {
+@@ -1270,23 +1422,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
+     return OK;
+ }
+ 
+-static void discard_script_output(apr_bucket_brigade *bb)
+-{
+-    apr_bucket *e;
+-    const char *buf;
+-    apr_size_t len;
+-
+-    for (e = APR_BRIGADE_FIRST(bb);
+-         e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e);
+-         e = APR_BRIGADE_FIRST(bb))
+-    {
+-        if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) {
+-            break;
+-        }
+-        apr_bucket_delete(e);
+-    }
+-}
+-
+ /****************************************************************
+  *
+  * Actual cgid handling...
+@@ -1391,6 +1526,7 @@ static apr_status_t cleanup_script(void *vptr)
+ 
+ static int cgid_handler(request_rec *r)
+ {
++    conn_rec *c = r->connection;
+     int retval, nph, dbpos;
+     char *argv0, *dbuf;
+     apr_bucket_brigade *bb;
+@@ -1400,10 +1536,11 @@ static int cgid_handler(request_rec *r)
+     int seen_eos, child_stopped_reading;
+     int sd;
+     char **env;
+-    apr_file_t *tempsock;
++    apr_file_t *tempsock, *script_err, *errpipe_out;
+     struct cleanup_script_info *info;
+     apr_status_t rv;
+     cgid_dirconf *dc;
++    apr_interval_time_t timeout;
+ 
+     if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
+         return DECLINED;
+@@ -1412,7 +1549,7 @@ static int cgid_handler(request_rec *r)
+     conf = ap_get_module_config(r->server->module_config, &cgid_module);
+     dc = ap_get_module_config(r->per_dir_config, &cgid_module);
+ 
+-    
++    timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
+     is_included = !strcmp(r->protocol, "INCLUDED");
+ 
+     if ((argv0 = strrchr(r->filename, '/')) != NULL) {
+@@ -1465,6 +1602,17 @@ static int cgid_handler(request_rec *r)
+     }
+     */
+ 
++#ifdef HAVE_CGID_FDPASSING
++    rv = apr_file_pipe_create(&script_err, &errpipe_out, r->pool);
++    if (rv) {
++        return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10176)
++                               "could not create pipe for stderr");
++    }
++#else
++    script_err = NULL;
++    errpipe_out = NULL;
++#endif
++    
+     /*
+      * httpd core function used to add common environment variables like
+      * DOCUMENT_ROOT. 
+@@ -1477,12 +1625,16 @@ static int cgid_handler(request_rec *r)
+         return retval;
+     }
+ 
+-    rv = send_req(sd, r, argv0, env, CGI_REQ);
++    rv = send_req(sd, errpipe_out, r, argv0, env, CGI_REQ);
+     if (rv != APR_SUCCESS) {
+         ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01268)
+                      "write to cgi daemon process");
+     }
+ 
++    /* The write-end of the pipe is only used by the server, so close
++     * it here. */
++    if (errpipe_out) apr_file_close(errpipe_out);
++    
+     info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
+     info->conf = conf;
+     info->r = r;
+@@ -1504,12 +1656,7 @@ static int cgid_handler(request_rec *r)
+      */
+ 
+     apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
+-    if (dc->timeout > 0) { 
+-        apr_file_pipe_timeout_set(tempsock, dc->timeout);
+-    }
+-    else { 
+-        apr_file_pipe_timeout_set(tempsock, r->server->timeout);
+-    }
++    apr_file_pipe_timeout_set(tempsock, timeout);
+     apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket);
+ 
+     /* Transfer any put/post args, CERN style...
+@@ -1601,114 +1748,19 @@ static int cgid_handler(request_rec *r)
+      */
+     shutdown(sd, 1);
+ 
+-    /* Handle script return... */
+-    if (!nph) {
+-        conn_rec *c = r->connection;
+-        const char *location;
+-        char sbuf[MAX_STRING_LEN];
+-        int ret;
+-
+-        bb = apr_brigade_create(r->pool, c->bucket_alloc);
+-        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-        b = apr_bucket_eos_create(c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-
+-        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+-                                                        APLOG_MODULE_INDEX)))
+-        {
+-            ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL);
+-
+-            /*
+-             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
+-             * does not set an explicit status and ap_meets_conditions, which
+-             * is called by ap_scan_script_header_err_brigade, detects that
+-             * the conditions of the requests are met and the response is
+-             * not modified.
+-             * In this case set r->status and return OK in order to prevent
+-             * running through the error processing stack as this would
+-             * break with mod_cache, if the conditions had been set by
+-             * mod_cache itself to validate a stale entity.
+-             * BTW: We circumvent the error processing stack anyway if the
+-             * CGI script set an explicit status code (whatever it is) and
+-             * the only possible values for ret here are:
+-             *
+-             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
+-             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
+-             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
+-             * processing of the response of the CGI script, e.g broken headers
+-             * or a crashed CGI process).
+-             */
+-            if (ret == HTTP_NOT_MODIFIED) {
+-                r->status = ret;
+-                return OK;
+-            }
+-
+-            return ret;
+-        }
+-
+-        location = apr_table_get(r->headers_out, "Location");
+-
+-        if (location && location[0] == '/' && r->status == 200) {
+-
+-            /* Soak up all the script output */
+-            discard_script_output(bb);
+-            apr_brigade_destroy(bb);
+-            /* This redirect needs to be a GET no matter what the original
+-             * method was.
+-             */
+-            r->method = "GET";
+-            r->method_number = M_GET;
+-
+-            /* We already read the message body (if any), so don't allow
+-             * the redirected request to think it has one. We can ignore
+-             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
+-             */
+-            apr_table_unset(r->headers_in, "Content-Length");
+-
+-            ap_internal_redirect_handler(location, r);
+-            return OK;
+-        }
+-        else if (location && r->status == 200) {
+-            /* XXX: Note that if a script wants to produce its own Redirect
+-             * body, it now has to explicitly *say* "Status: 302"
+-             */
+-            discard_script_output(bb);
+-            apr_brigade_destroy(bb);
+-            return HTTP_MOVED_TEMPORARILY;
+-        }
+-
+-        rv = ap_pass_brigade(r->output_filters, bb);
+-        if (rv != APR_SUCCESS) { 
+-            ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r,
+-                          "Failed to flush CGI output to client");
+-        }
+-    }
+-
+-    if (nph) {
+-        conn_rec *c = r->connection;
+-        struct ap_filter_t *cur;
+-
+-        /* get rid of all filters up through protocol...  since we
+-         * haven't parsed off the headers, there is no way they can
+-         * work
+-         */
+-
+-        cur = r->proto_output_filters;
+-        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
+-            cur = cur->next;
+-        }
+-        r->output_filters = r->proto_output_filters = cur;
+-
+-        bb = apr_brigade_create(r->pool, c->bucket_alloc);
+-        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-        b = apr_bucket_eos_create(c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-        ap_pass_brigade(r->output_filters, bb);
+-    }
++    bb = apr_brigade_create(r->pool, c->bucket_alloc);
++#ifdef HAVE_CGID_FDPASSING
++    b = cgi_bucket_create(r, dc->timeout, tempsock, script_err, c->bucket_alloc);
++    if (b == NULL)
++        return HTTP_INTERNAL_SERVER_ERROR; /* should call log_scripterror() w/ _UNAVAILABLE? */
++#else
++    b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
++#endif
++    APR_BRIGADE_INSERT_TAIL(bb, b);
++    b = apr_bucket_eos_create(c->bucket_alloc);
++    APR_BRIGADE_INSERT_TAIL(bb, b);
+ 
+-    return OK; /* NOT r->status, even if it has changed. */
++    return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err);
+ }
+ 
+ 
+@@ -1825,7 +1877,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
+         return retval;
+     }
+ 
+-    send_req(sd, r, command, env, SSI_REQ);
++    send_req(sd, NULL, r, command, env, SSI_REQ);
+ 
+     info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
+     info->conf = conf;
diff --git a/httpd-2.4.39-r1842929+.patch b/httpd-2.4.43-r1842929+.patch
similarity index 75%
rename from httpd-2.4.39-r1842929+.patch
rename to httpd-2.4.43-r1842929+.patch
index 0bf7292..b926195 100644
--- a/httpd-2.4.39-r1842929+.patch
+++ b/httpd-2.4.43-r1842929+.patch
@@ -1,13 +1,20 @@
-# ./pullrev.sh 1842929 1842931 1852982 1853631 1857731
-http://svn.apache.org/viewvc?view=revision&revision=1842929
-http://svn.apache.org/viewvc?view=revision&revision=1842931
-http://svn.apache.org/viewvc?view=revision&revision=1852982
-http://svn.apache.org/viewvc?view=revision&revision=1857731
-http://svn.apache.org/viewvc?view=revision&revision=1853631
-
---- httpd-2.4.39/acinclude.m4.r1842929+
-+++ httpd-2.4.39/acinclude.m4
-@@ -45,6 +45,7 @@
+diff --git a/Makefile.in b/Makefile.in
+index 06b8c5a..9eeb5c7 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -213,6 +213,7 @@ install-cgi:
+ install-other:
+ 	@test -d $(DESTDIR)$(logfiledir) || $(MKINSTALLDIRS) $(DESTDIR)$(logfiledir)
+ 	@test -d $(DESTDIR)$(runtimedir) || $(MKINSTALLDIRS) $(DESTDIR)$(runtimedir)
++	@test -d $(DESTDIR)$(statedir) || $(MKINSTALLDIRS) $(DESTDIR)$(statedir)
+ 	@for ext in dll x; do \
+ 		file=apachecore.$$ext; \
+ 		if test -f $$file; then \
+diff --git a/acinclude.m4 b/acinclude.m4
+index 95232f5..5d9d669 100644
+--- a/acinclude.m4
++++ b/acinclude.m4
+@@ -45,6 +45,7 @@ AC_DEFUN([APACHE_GEN_CONFIG_VARS],[
    APACHE_SUBST(installbuilddir)
    APACHE_SUBST(runtimedir)
    APACHE_SUBST(proxycachedir)
@@ -15,7 +22,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1853631
    APACHE_SUBST(other_targets)
    APACHE_SUBST(progname)
    APACHE_SUBST(prefix)
-@@ -663,6 +664,7 @@
+@@ -688,6 +689,7 @@ AC_DEFUN([APACHE_EXPORT_ARGUMENTS],[
    APACHE_SUBST_EXPANDED_ARG(runtimedir)
    APACHE_SUBST_EXPANDED_ARG(logfiledir)
    APACHE_SUBST_EXPANDED_ARG(proxycachedir)
@@ -23,9 +30,11 @@ http://svn.apache.org/viewvc?view=revision&revision=1853631
  ])
  
  dnl 
---- httpd-2.4.39/configure.in.r1842929+
-+++ httpd-2.4.39/configure.in
-@@ -41,7 +41,7 @@
+diff --git a/configure.in b/configure.in
+index a63eada..c8f9aa2 100644
+--- a/configure.in
++++ b/configure.in
+@@ -41,7 +41,7 @@ dnl Something seems broken here.
  AC_PREFIX_DEFAULT(/usr/local/apache2)
  
  dnl Get the layout here, so we can pass the required variables to apr
@@ -34,8 +43,10 @@ http://svn.apache.org/viewvc?view=revision&revision=1853631
  
  dnl reparse the configure arguments.
  APR_PARSE_ARGUMENTS
---- httpd-2.4.39/include/ap_config_layout.h.in.r1842929+
-+++ httpd-2.4.39/include/ap_config_layout.h.in
+diff --git a/include/ap_config_layout.h.in b/include/ap_config_layout.h.in
+index 2b4a70c..e076f41 100644
+--- a/include/ap_config_layout.h.in
++++ b/include/ap_config_layout.h.in
 @@ -60,5 +60,7 @@
  #define DEFAULT_REL_LOGFILEDIR "@rel_logfiledir@"
  #define DEFAULT_EXP_PROXYCACHEDIR "@exp_proxycachedir@"
@@ -44,9 +55,11 @@ http://svn.apache.org/viewvc?view=revision&revision=1853631
 +#define DEFAULT_REL_STATEDIR "@rel_statedir@"
  
  #endif /* AP_CONFIG_LAYOUT_H */
---- httpd-2.4.39/include/http_config.h.r1842929+
-+++ httpd-2.4.39/include/http_config.h
-@@ -757,6 +757,14 @@
+diff --git a/include/http_config.h b/include/http_config.h
+index f9c2d77..c229bc9 100644
+--- a/include/http_config.h
++++ b/include/http_config.h
+@@ -757,6 +757,14 @@ AP_DECLARE(char *) ap_server_root_relative(apr_pool_t *p, const char *fname);
   */
  AP_DECLARE(char *) ap_runtime_dir_relative(apr_pool_t *p, const char *fname);
  
@@ -61,19 +74,11 @@ http://svn.apache.org/viewvc?view=revision&revision=1853631
  /* Finally, the hook for dynamically loading modules in... */
  
  /**
---- httpd-2.4.39/Makefile.in.r1842929+
-+++ httpd-2.4.39/Makefile.in
-@@ -213,6 +213,7 @@
- install-other:
- 	@test -d $(DESTDIR)$(logfiledir) || $(MKINSTALLDIRS) $(DESTDIR)$(logfiledir)
- 	@test -d $(DESTDIR)$(runtimedir) || $(MKINSTALLDIRS) $(DESTDIR)$(runtimedir)
-+	@test -d $(DESTDIR)$(statedir) || $(MKINSTALLDIRS) $(DESTDIR)$(statedir)
- 	@for ext in dll x; do \
- 		file=apachecore.$$ext; \
- 		if test -f $$file; then \
---- httpd-2.4.39/modules/dav/fs/mod_dav_fs.c.r1842929+
-+++ httpd-2.4.39/modules/dav/fs/mod_dav_fs.c
-@@ -29,6 +29,10 @@
+diff --git a/modules/dav/fs/mod_dav_fs.c b/modules/dav/fs/mod_dav_fs.c
+index addfd7e..2389f8f 100644
+--- a/modules/dav/fs/mod_dav_fs.c
++++ b/modules/dav/fs/mod_dav_fs.c
+@@ -29,6 +29,10 @@ typedef struct {
  
  extern module AP_MODULE_DECLARE_DATA dav_fs_module;
  
@@ -84,7 +89,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1853631
  const char *dav_get_lockdb_path(const request_rec *r)
  {
      dav_fs_server_conf *conf;
-@@ -57,6 +61,24 @@
+@@ -57,6 +61,24 @@ static void *dav_fs_merge_server_config(apr_pool_t *p,
      return newconf;
  }
  
@@ -109,7 +114,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1853631
  /*
   * Command handler for the DAVLockDB directive, which is TAKE1
   */
-@@ -87,6 +109,8 @@
+@@ -87,6 +109,8 @@ static const command_rec dav_fs_cmds[] =
  
  static void register_hooks(apr_pool_t *p)
  {
@@ -118,9 +123,11 @@ http://svn.apache.org/viewvc?view=revision&revision=1853631
      dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL,
                               APR_HOOK_MIDDLE);
      dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE);
---- httpd-2.4.39/server/core.c.r1842929+
-+++ httpd-2.4.39/server/core.c
-@@ -129,6 +129,8 @@
+diff --git a/server/core.c b/server/core.c
+index 3db9d61..79b2a82 100644
+--- a/server/core.c
++++ b/server/core.c
+@@ -129,6 +129,8 @@ AP_DECLARE_DATA int ap_main_state = AP_SQ_MS_INITIAL_STARTUP;
  AP_DECLARE_DATA int ap_run_mode = AP_SQ_RM_UNKNOWN;
  AP_DECLARE_DATA int ap_config_generation = 0;
  
@@ -129,7 +136,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1853631
  static void *create_core_dir_config(apr_pool_t *a, char *dir)
  {
      core_dir_config *conf;
-@@ -1409,12 +1411,15 @@
+@@ -1409,12 +1411,15 @@ AP_DECLARE(const char *) ap_resolve_env(apr_pool_t *p, const char * word)
      return res_buf;
  }
  
@@ -147,7 +154,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1853631
  }
  
  /*
-@@ -3113,6 +3118,24 @@
+@@ -3120,6 +3125,24 @@ static const char *set_runtime_dir(cmd_parms *cmd, void *dummy, const char *arg)
      return NULL;
  }
  
@@ -172,7 +179,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1853631
  static const char *set_timeout(cmd_parms *cmd, void *dummy, const char *arg)
  {
      const char *err = ap_check_cmd_context(cmd, NOT_IN_DIR_CONTEXT);
-@@ -4407,6 +4430,8 @@
+@@ -4414,6 +4437,8 @@ AP_INIT_TAKE1("ServerRoot", set_server_root, NULL, RSRC_CONF | EXEC_ON_READ,
    "Common directory of server-related files (logs, confs, etc.)"),
  AP_INIT_TAKE1("DefaultRuntimeDir", set_runtime_dir, NULL, RSRC_CONF | EXEC_ON_READ,
    "Common directory for run-time files (shared memory, locks, etc.)"),
@@ -181,7 +188,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1853631
  AP_INIT_TAKE1("ErrorLog", set_server_string_slot,
    (void *)APR_OFFSETOF(server_rec, error_fname), RSRC_CONF,
    "The filename of the error log"),
-@@ -4934,8 +4959,7 @@
+@@ -4941,8 +4966,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem
  
      if (!saved_server_config_defines)
          init_config_defines(pconf);
@@ -189,9 +196,9 @@ http://svn.apache.org/viewvc?view=revision&revision=1853631
 -                              apr_pool_cleanup_null);
 +    apr_pool_cleanup_register(pconf, NULL, reset_config, apr_pool_cleanup_null);
  
-     ap_regcomp_set_default_cflags(AP_REG_DOLLAR_ENDONLY);
+     ap_regcomp_set_default_cflags(AP_REG_DEFAULT);
  
-@@ -5163,6 +5187,27 @@
+@@ -5170,6 +5194,27 @@ AP_DECLARE(int) ap_state_query(int query)
      }
  }
  
diff --git a/httpd-2.4.39-r1861269.patch b/httpd-2.4.43-r1861269.patch
similarity index 66%
rename from httpd-2.4.39-r1861269.patch
rename to httpd-2.4.43-r1861269.patch
index 4142e3c..9bff242 100644
--- a/httpd-2.4.39-r1861269.patch
+++ b/httpd-2.4.43-r1861269.patch
@@ -1,12 +1,8 @@
-# ./pullrev.sh r1861269
-http://svn.apache.org/viewvc?view=revision&revision=r1861269
-
-Allows "httpd -L" etc to work before httpd-init.service has run,
-if mod_ssl is installed.
-
---- httpd-2.4.37/modules/ssl/ssl_engine_config.c
-+++ httpd-2.4.37/modules/ssl/ssl_engine_config.c
-@@ -904,8 +904,14 @@
+diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
+index b53f3f8..979489c 100644
+--- a/modules/ssl/ssl_engine_config.c
++++ b/modules/ssl/ssl_engine_config.c
+@@ -812,8 +812,14 @@ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd,
  static const char *ssl_cmd_check_file(cmd_parms *parms,
                                        const char **file)
  {
diff --git a/httpd-2.4.37-r1861793+.patch b/httpd-2.4.43-r1861793+.patch
similarity index 88%
rename from httpd-2.4.37-r1861793+.patch
rename to httpd-2.4.43-r1861793+.patch
index 22886e2..d1afb60 100644
--- a/httpd-2.4.37-r1861793+.patch
+++ b/httpd-2.4.43-r1861793+.patch
@@ -1,12 +1,8 @@
-# ./pullrev.sh 1861793 1862611 1862612
-http://svn.apache.org/viewvc?view=revision&revision=1861793
-
-http://svn.apache.org/viewvc?view=revision&revision=1862611
-http://svn.apache.org/viewvc?view=revision&revision=1862612
-
---- httpd-2.4.37/configure.in
-+++ httpd-2.4.37/configure.in
-@@ -500,6 +500,28 @@
+diff --git a/configure.in b/configure.in
+index cb43246..0bb6b0d 100644
+--- a/configure.in
++++ b/configure.in
+@@ -465,6 +465,28 @@ LIBS=""
  AC_SEARCH_LIBS(crypt, crypt)
  CRYPT_LIBS="$LIBS"
  APACHE_SUBST(CRYPT_LIBS)
@@ -35,9 +31,89 @@ http://svn.apache.org/viewvc?view=revision&revision=1862612
  LIBS="$saved_LIBS"
  
  dnl See Comment #Spoon
---- httpd-2.4.37/support/htpasswd.c
-+++ httpd-2.4.37/support/htpasswd.c
-@@ -109,17 +109,21 @@
+diff --git a/docs/man/htpasswd.1 b/docs/man/htpasswd.1
+index d0ad7e8..2bf8405 100644
+--- a/docs/man/htpasswd.1
++++ b/docs/man/htpasswd.1
+@@ -27,16 +27,16 @@ htpasswd \- Manage user files for basic authentication
+ .SH "SYNOPSIS"
+  
+ .PP
+-\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR
++\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR
+  
+ .PP
+-\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR
++\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR
+  
+ .PP
+-\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR
++\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR
+  
+ .PP
+-\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR
++\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR
+  
+ 
+ .SH "SUMMARY"
+@@ -48,7 +48,7 @@ htpasswd \- Manage user files for basic authentication
+ Resources available from the Apache HTTP server can be restricted to just the users listed in the files created by \fBhtpasswd\fR\&. This program can only manage usernames and passwords stored in a flat-file\&. It can encrypt and display password information for use in other types of data stores, though\&. To use a DBM database see dbmmanage or htdbm\&.
+  
+ .PP
+-\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA1, or the system's \fBcrypt()\fR routine\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&.
++\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA-1, or the system's \fBcrypt()\fR routine\&. SHA-2-based hashes (SHA-256 and SHA-512) are supported for \fBcrypt()\fR\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&.
+  
+ .PP
+ This manual page only lists the command line arguments\&. For details of the directives necessary to configure user authentication in httpd see the Apache manual, which is part of the Apache distribution or can be found at http://httpd\&.apache\&.org/\&.
+@@ -73,17 +73,26 @@ Display the results on standard output rather than updating a file\&. This is us
+ \fB-m\fR
+ Use MD5 encryption for passwords\&. This is the default (since version 2\&.2\&.18)\&.  
+ .TP
++\fB-2\fR
++Use SHA-256 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&.  
++.TP
++\fB-5\fR
++Use SHA-512 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&.  
++.TP
+ \fB-B\fR
+ Use bcrypt encryption for passwords\&. This is currently considered to be very secure\&.  
+ .TP
+ \fB-C\fR
+ This flag is only allowed in combination with \fB-B\fR (bcrypt encryption)\&. It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17)\&.  
+ .TP
++\fB-r\fR
++This flag is only allowed in combination with \fB-2\fR or \fB-5\fR\&. It sets the number of hash rounds used for the SHA-2 algorithms (higher is more secure but slower; the default is 5,000)\&.  
++.TP
+ \fB-d\fR
+ Use \fBcrypt()\fR encryption for passwords\&. This is not supported by the httpd server on Windows and Netware\&. This algorithm limits the password length to 8 characters\&. This algorithm is \fBinsecure\fR by today's standards\&. It used to be the default algorithm until version 2\&.2\&.17\&.  
+ .TP
+ \fB-s\fR
+-Use SHA encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&.  
++Use SHA-1 (160-bit) encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&.  
+ .TP
+ \fB-p\fR
+ Use plaintext passwords\&. Though \fBhtpasswd\fR will support creation on all platforms, the httpd daemon will only accept plain text passwords on Windows and Netware\&.  
+@@ -152,10 +161,13 @@ The use of the \fB-b\fR option is discouraged, since when it is used the unencry
+ When using the \fBcrypt()\fR algorithm, note that only the first 8 characters of the password are used to form the password\&. If the supplied password is longer, the extra characters will be silently discarded\&.
+  
+ .PP
+-The SHA encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&.
++The SHA-1 encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&.
++ 
++.PP
++The SHA-1 and \fBcrypt()\fR formats are insecure by today's standards\&.
+  
+ .PP
+-The SHA and \fBcrypt()\fR formats are insecure by today's standards\&.
++The SHA-2-based \fBcrypt()\fR formats (SHA-256 and SHA-512) are supported on most modern Unix systems, and follow the specification at https://www\&.akkadia\&.org/drepper/SHA-crypt\&.txt\&.
+  
+ .SH "RESTRICTIONS"
+  
+diff --git a/support/htpasswd.c b/support/htpasswd.c
+index 73b291d..7366dcb 100644
+--- a/support/htpasswd.c
++++ b/support/htpasswd.c
+@@ -109,17 +109,21 @@ static void usage(void)
              "for it." NL
          " -i  Read password from stdin without verification (for script usage)." NL
          " -m  Force MD5 encryption of the password (default)." NL
@@ -62,7 +138,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1862612
              "MD5 algorithm." NL,
          BCRYPT_DEFAULT_COST
      );
-@@ -178,7 +182,7 @@
+@@ -178,7 +182,7 @@ static void check_args(int argc, const char *const argv[],
      if (rv != APR_SUCCESS)
          exit(ERR_SYNTAX);
  
@@ -71,9 +147,11 @@ http://svn.apache.org/viewvc?view=revision&revision=1862612
          switch (opt) {
          case 'c':
              *mask |= APHTP_NEWFILE;
---- httpd-2.4.37/support/passwd_common.c
-+++ httpd-2.4.37/support/passwd_common.c
-@@ -185,10 +185,15 @@
+diff --git a/support/passwd_common.c b/support/passwd_common.c
+index 664e509..d45657c 100644
+--- a/support/passwd_common.c
++++ b/support/passwd_common.c
+@@ -185,10 +185,15 @@ int mkhash(struct passwd_ctx *ctx)
  #if CRYPT_ALGO_SUPPORTED
      char *cbuf;
  #endif
@@ -91,7 +169,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1862612
      }
  
      if (ctx->passwd == NULL) {
-@@ -246,6 +251,34 @@
+@@ -246,6 +251,34 @@ int mkhash(struct passwd_ctx *ctx)
          break;
  #endif /* CRYPT_ALGO_SUPPORTED */
  
@@ -126,7 +204,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1862612
  #if BCRYPT_ALGO_SUPPORTED
      case ALG_BCRYPT:
          rv = apr_generate_random_bytes((unsigned char*)salt, 16);
-@@ -294,6 +327,19 @@
+@@ -294,6 +327,19 @@ int parse_common_options(struct passwd_ctx *ctx, char opt,
      case 's':
          ctx->alg = ALG_APSHA;
          break;
@@ -146,7 +224,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1862612
      case 'p':
          ctx->alg = ALG_PLAIN;
  #if !PLAIN_ALGO_SUPPORTED
-@@ -324,11 +370,12 @@
+@@ -324,11 +370,12 @@ int parse_common_options(struct passwd_ctx *ctx, char opt,
          return ERR_ALG_NOT_SUPP;
  #endif
          break;
@@ -161,8 +239,10 @@ http://svn.apache.org/viewvc?view=revision&revision=1862612
                  return ERR_SYNTAX;
              }
              ctx->cost = num;
---- httpd-2.4.37/support/passwd_common.h
-+++ httpd-2.4.37/support/passwd_common.h
+diff --git a/support/passwd_common.h b/support/passwd_common.h
+index 660081e..f1b3cd7 100644
+--- a/support/passwd_common.h
++++ b/support/passwd_common.h
 @@ -28,6 +28,8 @@
  #include "apu_version.h"
  #endif
@@ -181,7 +261,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1862612
  
  #define BCRYPT_DEFAULT_COST 5
  
-@@ -84,7 +88,7 @@
+@@ -84,7 +88,7 @@ struct passwd_ctx {
      apr_size_t      out_len;
      char            *passwd;
      int             alg;
@@ -190,81 +270,3 @@ http://svn.apache.org/viewvc?view=revision&revision=1862612
      enum {
          PW_PROMPT = 0,
          PW_ARG,
---- httpd-2.4.37/docs/man/htpasswd.1
-+++ httpd-2.4.37/docs/man/htpasswd.1
-@@ -27,16 +27,16 @@
- .SH "SYNOPSIS"
-  
- .PP
--\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR
-+\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR
-  
- .PP
--\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR
-+\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR
-  
- .PP
--\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR
-+\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR
-  
- .PP
--\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR
-+\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR
-  
- 
- .SH "SUMMARY"
-@@ -48,7 +48,7 @@
- Resources available from the Apache HTTP server can be restricted to just the users listed in the files created by \fBhtpasswd\fR\&. This program can only manage usernames and passwords stored in a flat-file\&. It can encrypt and display password information for use in other types of data stores, though\&. To use a DBM database see dbmmanage or htdbm\&.
-  
- .PP
--\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA1, or the system's \fBcrypt()\fR routine\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&.
-+\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA-1, or the system's \fBcrypt()\fR routine\&. SHA-2-based hashes (SHA-256 and SHA-512) are supported for \fBcrypt()\fR\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&.
-  
- .PP
- This manual page only lists the command line arguments\&. For details of the directives necessary to configure user authentication in httpd see the Apache manual, which is part of the Apache distribution or can be found at http://httpd\&.apache\&.org/\&.
-@@ -73,6 +73,12 @@
- \fB-m\fR
- Use MD5 encryption for passwords\&. This is the default (since version 2\&.2\&.18)\&.  
- .TP
-+\fB-2\fR
-+Use SHA-256 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&.  
-+.TP
-+\fB-5\fR
-+Use SHA-512 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&.  
-+.TP
- \fB-B\fR
- Use bcrypt encryption for passwords\&. This is currently considered to be very secure\&.  
- .TP
-@@ -79,11 +85,14 @@
- \fB-C\fR
- This flag is only allowed in combination with \fB-B\fR (bcrypt encryption)\&. It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17)\&.  
- .TP
-+\fB-r\fR
-+This flag is only allowed in combination with \fB-2\fR or \fB-5\fR\&. It sets the number of hash rounds used for the SHA-2 algorithms (higher is more secure but slower; the default is 5,000)\&.  
-+.TP
- \fB-d\fR
- Use \fBcrypt()\fR encryption for passwords\&. This is not supported by the httpd server on Windows and Netware\&. This algorithm limits the password length to 8 characters\&. This algorithm is \fBinsecure\fR by today's standards\&. It used to be the default algorithm until version 2\&.2\&.17\&.  
- .TP
- \fB-s\fR
--Use SHA encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&.  
-+Use SHA-1 (160-bit) encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&.  
- .TP
- \fB-p\fR
- Use plaintext passwords\&. Though \fBhtpasswd\fR will support creation on all platforms, the httpd daemon will only accept plain text passwords on Windows and Netware\&.  
-@@ -152,11 +161,14 @@
- When using the \fBcrypt()\fR algorithm, note that only the first 8 characters of the password are used to form the password\&. If the supplied password is longer, the extra characters will be silently discarded\&.
-  
- .PP
--The SHA encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&.
-+The SHA-1 encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&.
-  
- .PP
--The SHA and \fBcrypt()\fR formats are insecure by today's standards\&.
-+The SHA-1 and \fBcrypt()\fR formats are insecure by today's standards\&.
-  
-+.PP
-+The SHA-2-based \fBcrypt()\fR formats (SHA-256 and SHA-512) are supported on most modern Unix systems, and follow the specification at https://www\&.akkadia\&.org/drepper/SHA-crypt\&.txt\&.
-+ 
- .SH "RESTRICTIONS"
-  
- .PP
diff --git a/httpd-2.4.41-r1870095+.patch b/httpd-2.4.43-r1870095+.patch
similarity index 89%
rename from httpd-2.4.41-r1870095+.patch
rename to httpd-2.4.43-r1870095+.patch
index f29e6f2..3fc8dfb 100644
--- a/httpd-2.4.41-r1870095+.patch
+++ b/httpd-2.4.43-r1870095+.patch
@@ -1,10 +1,8 @@
-# ./pullrev.sh 1870095 1870097
-http://svn.apache.org/viewvc?view=revision&revision=1870095
-http://svn.apache.org/viewvc?view=revision&revision=1870097
-
---- httpd-2.4.41/modules/ssl/ssl_engine_kernel.c
-+++ httpd-2.4.41/modules/ssl/ssl_engine_kernel.c
-@@ -114,6 +114,45 @@
+diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
+index cbab6a3..765aa4b 100644
+--- a/modules/ssl/ssl_engine_kernel.c
++++ b/modules/ssl/ssl_engine_kernel.c
+@@ -114,6 +114,45 @@ static int has_buffered_data(request_rec *r)
      return result;
  }
  
@@ -50,7 +48,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1870097
  #ifdef HAVE_TLSEXT
  static int ap_array_same_str_set(apr_array_header_t *s1, apr_array_header_t *s2)
  {
-@@ -814,41 +853,14 @@
+@@ -814,41 +853,14 @@ static int ssl_hook_Access_classic(request_rec *r, SSLSrvConfigRec *sc, SSLDirCo
          }
      }
  
@@ -97,7 +95,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1870097
          }
      }
  
-@@ -1132,6 +1144,17 @@
+@@ -1132,6 +1144,17 @@ static int ssl_hook_Access_modern(request_rec *r, SSLSrvConfigRec *sc, SSLDirCon
              }
          }
  
diff --git a/httpd-2.4.25-selinux.patch b/httpd-2.4.43-selinux.patch
similarity index 76%
rename from httpd-2.4.25-selinux.patch
rename to httpd-2.4.43-selinux.patch
index fa4614a..3c3176f 100644
--- a/httpd-2.4.25-selinux.patch
+++ b/httpd-2.4.43-selinux.patch
@@ -1,11 +1,8 @@
-
-Log the SELinux context at startup.
-
-Upstream-Status: unlikely to be any interest in this upstream
-
---- httpd-2.4.1/configure.in.selinux
-+++ httpd-2.4.1/configure.in
-@@ -458,6 +458,11 @@ fopen64
+diff --git a/configure.in b/configure.in
+index c8f9aa2..cb43246 100644
+--- a/configure.in
++++ b/configure.in
+@@ -484,6 +484,11 @@ getloadavg
  dnl confirm that a void pointer is large enough to store a long integer
  APACHE_CHECK_VOID_PTR_LEN
  
@@ -17,9 +14,11 @@ Upstream-Status: unlikely to be any interest in this upstream
  AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
  [AC_TRY_RUN(#define _GNU_SOURCE
  #include <unistd.h>
---- httpd-2.4.1/server/core.c.selinux
-+++ httpd-2.4.1/server/core.c
-@@ -58,6 +58,10 @@
+diff --git a/server/core.c b/server/core.c
+index dc0f17a..7ed9527 100644
+--- a/server/core.c
++++ b/server/core.c
+@@ -59,6 +59,10 @@
  #include <unistd.h>
  #endif
  
@@ -30,7 +29,7 @@ Upstream-Status: unlikely to be any interest in this upstream
  /* LimitRequestBody handling */
  #define AP_LIMIT_REQ_BODY_UNSET         ((apr_off_t) -1)
  #define AP_DEFAULT_LIMIT_REQ_BODY       ((apr_off_t) 0)
-@@ -4452,6 +4456,28 @@ static int core_post_config(apr_pool_t *
+@@ -5015,6 +5019,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte
      }
  #endif
  
diff --git a/httpd-2.4.17-socket-activation.patch b/httpd-2.4.43-socket-activation.patch
similarity index 99%
rename from httpd-2.4.17-socket-activation.patch
rename to httpd-2.4.43-socket-activation.patch
index dbdd80c..511f476 100644
--- a/httpd-2.4.17-socket-activation.patch
+++ b/httpd-2.4.43-socket-activation.patch
@@ -1,5 +1,5 @@
 diff --git a/server/listen.c b/server/listen.c
-index a8e9e6f..1a6c1d3 100644
+index 5242c2a..e2e028a 100644
 --- a/server/listen.c
 +++ b/server/listen.c
 @@ -34,6 +34,10 @@
diff --git a/httpd-2.4.34-sslciphdefault.patch b/httpd-2.4.43-sslciphdefault.patch
similarity index 75%
rename from httpd-2.4.34-sslciphdefault.patch
rename to httpd-2.4.43-sslciphdefault.patch
index 6060f24..85ae568 100644
--- a/httpd-2.4.34-sslciphdefault.patch
+++ b/httpd-2.4.43-sslciphdefault.patch
@@ -1,11 +1,8 @@
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1109119
-
-Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
-
---- httpd-2.4.34/modules/ssl/ssl_engine_config.c.sslciphdefault
-+++ httpd-2.4.34/modules/ssl/ssl_engine_config.c
-@@ -774,9 +774,11 @@
+diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
+index 97778a8..27e7a53 100644
+--- a/modules/ssl/ssl_engine_config.c
++++ b/modules/ssl/ssl_engine_config.c
+@@ -778,9 +778,11 @@ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd,
      }
      
      if (!strcmp("SSL", arg1)) {
@@ -19,7 +16,7 @@ Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
              dc->szCipherSuite = arg2;
          }
          else {
-@@ -1540,8 +1542,10 @@
+@@ -1544,8 +1546,10 @@ const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *cmd,
      }
      
      if (!strcmp("SSL", arg1)) {
diff --git a/httpd-2.4.33-sslmultiproxy.patch b/httpd-2.4.43-sslmultiproxy.patch
similarity index 70%
rename from httpd-2.4.33-sslmultiproxy.patch
rename to httpd-2.4.43-sslmultiproxy.patch
index 679f229..349c4ae 100644
--- a/httpd-2.4.33-sslmultiproxy.patch
+++ b/httpd-2.4.43-sslmultiproxy.patch
@@ -1,39 +1,30 @@
-From ce2d1d7d4b2bebe34cf37fdeb30d35050092c5b5 Mon Sep 17 00:00:00 2001
-From: Rob Crittenden <rcrit@cow.greyoak.com>
-Date: Thu, 12 Apr 2018 14:36:28 -0400
-Subject: [PATCH] httpd-2.4.18-sslmultiproxy.patch
-
----
- modules/ssl/mod_ssl.c         | 24 ++++++++++++++++++++++--
- modules/ssl/ssl_engine_vars.c | 18 +++++++++++++++++-
- 2 files changed, 39 insertions(+), 3 deletions(-)
-
 diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
-index 48d64cb..42e85a3 100644
-diff -uap httpd-2.4.33/modules/ssl/mod_ssl.c.sslmultiproxy httpd-2.4.33/modules/ssl/mod_ssl.c
---- httpd-2.4.33/modules/ssl/mod_ssl.c.sslmultiproxy
-+++ httpd-2.4.33/modules/ssl/mod_ssl.c
-@@ -444,12 +444,19 @@
+index 12617b2..0fe7464 100644
+--- a/modules/ssl/mod_ssl.c
++++ b/modules/ssl/mod_ssl.c
+@@ -459,6 +459,10 @@ static int ssl_hook_pre_config(apr_pool_t *pconf,
      return OK;
  }
  
 +static APR_OPTIONAL_FN_TYPE(ssl_engine_disable) *othermod_engine_disable;
 +static APR_OPTIONAL_FN_TYPE(ssl_engine_set) *othermod_engine_set;
++
 +
  static SSLConnRec *ssl_init_connection_ctx(conn_rec *c,
-                                            ap_conf_vector_t *per_dir_config)
- {
+                                            ap_conf_vector_t *per_dir_config,
+                                            int new_proxy)
+@@ -466,6 +470,10 @@ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c,
      SSLConnRec *sslconn = myConnConfig(c);
-     SSLSrvConfigRec *sc;
+     int need_setup = 0;
  
 +    if (othermod_engine_disable) {
 +        othermod_engine_disable(c);
 +    }
 +
-     if (sslconn) {
-         return sslconn;
-     }
-@@ -508,6 +515,10 @@
+     /* mod_proxy's (r->)per_dir_config has the lifetime of the request, thus
+      * it uses ssl_engine_set() to reset sslconn->dc when reusing SSL backend
+      * connections, so we must fall through here. But in the case where we are
+@@ -544,6 +552,10 @@ static int ssl_engine_set(conn_rec *c,
  {
      SSLConnRec *sslconn;
      int status;
@@ -43,8 +34,8 @@ diff -uap httpd-2.4.33/modules/ssl/mod_ssl.c.sslmultiproxy httpd-2.4.33/modules/
 +    }
      
      if (proxy) {
-         sslconn = ssl_init_connection_ctx(c, per_dir_config);
-@@ -537,12 +548,18 @@
+         sslconn = ssl_init_connection_ctx(c, per_dir_config, 1);
+@@ -572,12 +584,18 @@ static int ssl_engine_set(conn_rec *c,
  
  static int ssl_proxy_enable(conn_rec *c)
  {
@@ -65,7 +56,7 @@ diff -uap httpd-2.4.33/modules/ssl/mod_ssl.c.sslmultiproxy httpd-2.4.33/modules/
  }
  
  int ssl_init_ssl_connection(conn_rec *c, request_rec *r)
-@@ -730,6 +747,9 @@
+@@ -753,6 +771,9 @@ static void ssl_register_hooks(apr_pool_t *p)
                        APR_HOOK_MIDDLE);
  
      ssl_var_register(p);
@@ -75,10 +66,11 @@ diff -uap httpd-2.4.33/modules/ssl/mod_ssl.c.sslmultiproxy httpd-2.4.33/modules/
  
      APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
      APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
-diff -uap httpd-2.4.33/modules/ssl/ssl_engine_vars.c.sslmultiproxy httpd-2.4.33/modules/ssl/ssl_engine_vars.c
---- httpd-2.4.33/modules/ssl/ssl_engine_vars.c.sslmultiproxy
-+++ httpd-2.4.33/modules/ssl/ssl_engine_vars.c
-@@ -54,6 +54,8 @@
+diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c
+index 5724f18..81c56ba 100644
+--- a/modules/ssl/ssl_engine_vars.c
++++ b/modules/ssl/ssl_engine_vars.c
+@@ -54,6 +54,8 @@ static char *ssl_var_lookup_ssl_cipher(apr_pool_t *p, SSLConnRec *sslconn, char
  static void  ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algkeysize);
  static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var);
  static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl);
@@ -87,7 +79,7 @@ diff -uap httpd-2.4.33/modules/ssl/ssl_engine_vars.c.sslmultiproxy httpd-2.4.33/
  
  static SSLConnRec *ssl_get_effective_config(conn_rec *c)
  {
-@@ -68,7 +70,9 @@
+@@ -68,7 +70,9 @@ static SSLConnRec *ssl_get_effective_config(conn_rec *c)
  static int ssl_is_https(conn_rec *c)
  {
      SSLConnRec *sslconn = ssl_get_effective_config(c);
@@ -98,7 +90,7 @@ diff -uap httpd-2.4.33/modules/ssl/ssl_engine_vars.c.sslmultiproxy httpd-2.4.33/
  }
  
  static const char var_interface[] = "mod_ssl/" AP_SERVER_BASEREVISION;
-@@ -137,6 +141,9 @@
+@@ -137,6 +141,9 @@ void ssl_var_register(apr_pool_t *p)
  {
      char *cp, *cp2;
  
@@ -108,7 +100,7 @@ diff -uap httpd-2.4.33/modules/ssl/ssl_engine_vars.c.sslmultiproxy httpd-2.4.33/
      APR_REGISTER_OPTIONAL_FN(ssl_is_https);
      APR_REGISTER_OPTIONAL_FN(ssl_var_lookup);
      APR_REGISTER_OPTIONAL_FN(ssl_ext_list);
-@@ -271,6 +278,15 @@
+@@ -271,6 +278,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r,
       */
      if (result == NULL && c != NULL) {
          SSLConnRec *sslconn = ssl_get_effective_config(c);
diff --git a/httpd-2.4.37-sslprotdefault.patch b/httpd-2.4.43-sslprotdefault.patch
similarity index 85%
rename from httpd-2.4.37-sslprotdefault.patch
rename to httpd-2.4.43-sslprotdefault.patch
index 546fa1f..d089823 100644
--- a/httpd-2.4.37-sslprotdefault.patch
+++ b/httpd-2.4.43-sslprotdefault.patch
@@ -1,5 +1,5 @@
 diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
-index 55c237e..5467d23 100644
+index 27e7a53..b53f3f8 100644
 --- a/modules/ssl/ssl_engine_config.c
 +++ b/modules/ssl/ssl_engine_config.c
 @@ -119,7 +119,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
@@ -11,19 +11,20 @@ index 55c237e..5467d23 100644
      mctx->protocol_set        = 0;
  
      mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET;
-@@ -262,6 +262,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
- {
+@@ -263,6 +263,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
      if (add->protocol_set) {
+         mrg->protocol_set = 1;
          mrg->protocol = add->protocol;
 +        mrg->protocol_set = 1;
      }
      else {
-         mrg->protocol = base->protocol;
+         mrg->protocol_set = base->protocol_set;
+
 diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
-index e3f62fe..31fc0e6 100644
+index bfad47a..b0fcf81 100644
 --- a/modules/ssl/ssl_engine_init.c
 +++ b/modules/ssl/ssl_engine_init.c
-@@ -568,6 +568,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -577,6 +577,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
      MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL;
      char *cp;
      int protocol = mctx->protocol;
@@ -31,7 +32,7 @@ index e3f62fe..31fc0e6 100644
      SSLSrvConfigRec *sc = mySrvConfig(s);
  #if OPENSSL_VERSION_NUMBER >= 0x10100000L
      int prot;
-@@ -577,12 +578,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -586,12 +587,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
       *  Create the new per-server SSL context
       */
      if (protocol == SSL_PROTOCOL_NONE) {
@@ -55,7 +56,7 @@ index e3f62fe..31fc0e6 100644
  #ifndef OPENSSL_NO_SSL3
                       (protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""),
  #endif
-@@ -595,7 +602,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -604,7 +611,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
  #endif
  #endif
                       NULL);
@@ -65,7 +66,7 @@ index e3f62fe..31fc0e6 100644
  
      ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s,
                   "Creating new SSL context (protocols: %s)", cp);
-@@ -696,13 +704,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -705,13 +713,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
          prot = SSL3_VERSION;
  #endif
      } else {
@@ -87,7 +88,7 @@ index e3f62fe..31fc0e6 100644
  
      /* Next we scan for the minimal protocol version we should provide,
       * but we do not allow holes between max and min */
-@@ -726,7 +736,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -731,7 +741,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
          prot = SSL3_VERSION;
      }
  #endif
diff --git a/httpd.spec b/httpd.spec
index 2d5e847..6c16a2d 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.41
-Release: 13%{?dist}
+Version: 2.4.43
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -62,33 +62,29 @@ Source46: apachectl.sh
 Source47: apachectl.xml
 
 # build/scripts patches
-Patch2: httpd-2.4.9-apxs.patch
-Patch3: httpd-2.4.1-deplibs.patch
+Patch2: httpd-2.4.43-apxs.patch
+Patch3: httpd-2.4.43-deplibs.patch
 # Needed for socket activation and mod_systemd patch
-Patch19: httpd-2.4.25-detect-systemd.patch
+Patch19: httpd-2.4.43-detect-systemd.patch
 # Features/functional changes
-Patch21: httpd-2.4.39-r1842929+.patch
-Patch23: httpd-2.4.39-export.patch
-Patch24: httpd-2.4.1-corelimit.patch
-Patch25: httpd-2.4.25-selinux.patch
-Patch27: httpd-2.4.2-icons.patch
-Patch29: httpd-2.4.41-systemd.patch
-Patch30: httpd-2.4.4-cachehardmax.patch
-Patch31: httpd-2.4.33-sslmultiproxy.patch
-Patch34: httpd-2.4.17-socket-activation.patch
-Patch36: httpd-2.4.38-r1830819+.patch
-Patch38: httpd-2.4.34-sslciphdefault.patch
-Patch39: httpd-2.4.37-sslprotdefault.patch
-Patch40: httpd-2.4.39-r1861269.patch
-Patch41: httpd-2.4.37-r1861793+.patch
-Patch42: httpd-2.4.41-r1828172+.patch
+Patch21: httpd-2.4.43-r1842929+.patch
+Patch23: httpd-2.4.43-export.patch
+Patch24: httpd-2.4.43-corelimit.patch
+Patch25: httpd-2.4.43-selinux.patch
+Patch27: httpd-2.4.43-icons.patch
+Patch30: httpd-2.4.43-cachehardmax.patch
+Patch31: httpd-2.4.43-sslmultiproxy.patch
+Patch34: httpd-2.4.43-socket-activation.patch
+Patch38: httpd-2.4.43-sslciphdefault.patch
+Patch39: httpd-2.4.43-sslprotdefault.patch
+Patch40: httpd-2.4.43-r1861269.patch
+Patch41: httpd-2.4.43-r1861793+.patch
+Patch42: httpd-2.4.43-r1828172+.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
-Patch58: httpd-2.4.34-r1738878.patch
-Patch60: httpd-2.4.34-enable-sslv3.patch
-Patch61: httpd-2.4.41-r1865749.patch
-Patch62: httpd-2.4.41-r1870095+.patch
+Patch60: httpd-2.4.43-enable-sslv3.patch
+Patch62: httpd-2.4.43-r1870095+.patch
 
 # Security fixes
 
@@ -215,20 +211,16 @@ interface for storing and accessing per-user session data.
 %patch24 -p1 -b .corelimit
 %patch25 -p1 -b .selinux
 %patch27 -p1 -b .icons
-%patch29 -p1 -b .systemd
 %patch30 -p1 -b .cachehardmax
 #patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
-%patch36 -p1 -b .r1830819+
 %patch38 -p1 -b .sslciphdefault
 %patch39 -p1 -b .sslprotdefault
 %patch40 -p1 -b .r1861269
 %patch41 -p1 -b .r1861793+
 %patch42 -p1 -b .r1828172+
 
-%patch58 -p1 -b .r1738878
 %patch60 -p1 -b .enable-sslv3
-%patch61 -p1 -b .r1865749
 %patch62 -p1 -b .r1870095
 
 # Patch in the vendor string
@@ -329,6 +321,7 @@ export LYNX_PATH=/usr/bin/links
         --enable-cgid --enable-cgi \
         --enable-cgid-fdpassing \
         --enable-authn-anon --enable-authn-alias \
+        --enable-systemd \
         --disable-imagemap --disable-file-cache \
         --disable-http2 \
         --disable-md \
@@ -753,6 +746,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Mar 31 2020 Lubos Uhliarik <luhliari@redhat.com> - 2.4.43-1
+- new version 2.4.43 (#1819023)
+
 * Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.41-13
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 
diff --git a/sources b/sources
index 974c309..9c6c825 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,3 @@
-SHA512 (httpd-2.4.41.tar.bz2) = 350cc7dcd2c439e0590338fa6da3f44df44f9bb885c381e91f91b14c2f48597f6f0bbac0ea118a8a67eaa70ae7edbb769beace368643ed73f6daee44c307b335
-SHA512 (httpd-2.4.41.tar.bz2.asc) = 3c9173dcaf4e170d87f7cca99e6878424b01d009869742b9077421dbae60acbd102d696e03fccd927f9d688e30f07f9d2d78473ce0bbfbb4a3090ae365121c44
+SHA512 (httpd-2.4.43.tar.bz2) = 16cfeecc8f6fab6eca478065a384bdf1872f7ac42206b0bc2bcac6c0d9c576f392c07107201f39e0601dec1bbafcb33d66153544de4d87d79b9a52094d334b64
+SHA512 (httpd-2.4.43.tar.bz2.asc) = 7a1a12d6f58d8235dcf8b23bae3960e99dc99764928752f870f32e654aa5e3cf78a38fb14f3cb84c5a8ab9b05095beec4739a50c6efcf22e3ecbdf0255ac783d
+SHA512 (KEYS) = b776ca20863f8d9e4f66e8b56cbe020de34af5b268e93776d482392171f0e0aeee4f8d74477d128dc9fd24b30bbe33b39439964f1bd22a99782f1e4a08c85056

From 8c4dc8876b5dc692728f3e94441896bfa2a37aa1 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 7 Feb 2020 11:44:02 +0000
Subject: [PATCH 201/359] Tweak wording.

---
 httpd.service.xml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/httpd.service.xml b/httpd.service.xml
index a57c2d6..695c112 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -282,9 +282,9 @@ Wants=network-online.target</programlisting>
     <refsect2>
       <title>Instantiated services</title>
 
-      <para>The <command>httpd@.service</command> unit is an
-      instantiated template service. An instance of this unit will be
-      started using the configuration file
+      <para>The <command>httpd@.service</command> unit is a template
+      for creating instantiated services. An instance of this unit
+      will be started using the configuration file
       <filename>/etc/httpd/conf/INSTANCE.conf</filename>, where
       <emphasis>INSTANCE</emphasis> is replaced with the instance
       name.  For example, <command>systemctl start

From 356046ff988e13622bb6a3687012cd71423f4e38 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 17 Apr 2020 08:50:06 +0100
Subject: [PATCH 202/359] mod_ssl: fix leak in OCSP stapling code (PR 63687,
 r1876548) mod_systemd: restore descriptive startup logging

---
 KEYS                           | 8682 --------------------------------
 httpd-2.4.43-mod_systemd.patch |   96 +
 httpd-2.4.43-r1876548.patch    |   82 +
 httpd.spec                     |   10 +-
 pullrev.sh                     |    2 +-
 5 files changed, 188 insertions(+), 8684 deletions(-)
 delete mode 100644 KEYS
 create mode 100644 httpd-2.4.43-mod_systemd.patch
 create mode 100644 httpd-2.4.43-r1876548.patch

diff --git a/KEYS b/KEYS
deleted file mode 100644
index 9784650..0000000
--- a/KEYS
+++ /dev/null
@@ -1,8682 +0,0 @@
-This file contains the PGP keys of various developers that work on
-the Apache HTTP Server and its subprojects.
-
-Please don't use these keys for email unless you have asked the owner
-because some keys are only used for code signing.
-
-Please realize that this file itself or the public key servers may be
-compromised.  You are encouraged to validate the authenticity of these keys in
-an out-of-band manner.  For information about our validation and signing
-policies, please read http://httpd.apache.org/dev/verification.html.
-
-Apache users: pgp < KEYS
-Apache developers: 
-        (pgpk -ll <your name> && pgpk -xa <your name>) >> this file.
-      or
-        (gpg --fingerprint --list-sigs <your name>
-             && gpg --armor --export <your name>) >> this file.
-
-Apache developers: please ensure that your key is also available via the
-PGP keyservers (such as pgpkeys.mit.edu).
-
-Type Bits/KeyID    Date       User ID
-pub  1024/2719AF35 1995/05/13 Ben Laurie <ben@algroup.co.uk>
-                              Ben Laurie <ben@gonzo.ben.algroup.co.uk>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 2.6.3ia
-
-mQCNAi+0jQEAAAEEAK7oX0FeNncaHfa1v+V7SMUviAm8qB8orWG0zvja4ZtSrHVg
-/PMwppUh44t5ERA9lltRBdHu30+YSh8a1dYt1XOD83nknzj9rhtpFAPqyywlLVhN
-VY3PVLyMbULw27aEAGc+StFqrDoUQ0+j9QU/YH/IyVN9rBaJyhsIDEUnGa81AAUR
-tB5CZW4gTGF1cmllIDxiZW5AYWxncm91cC5jby51az6JARUDBRAyb2Doc3AsNzyk
-Yh0BARa6CACUBnsP9Vb+T/PvNYKVQBIODz+90tz5GozWwCVfPVSaRd8Dz+oF1sFs
-YCz/KuxqBhL5PkiCuSMfOVlPA5nirjoktMF/af5saZqhPr5rvr67Z1OzZnVDvWe4
-DhFrn8EoLrY5YNJhUwfINnZqyKaQu8TW6p4caLkTCW0KM+4ztTe74xRG9NeE+K0+
-0RMpAF3jEY36LGRjq6miazt2bVZQDTl6CuWE+gAaFlX2ojV7e1xdxVvpBIEc34MP
-g9ORJ0evx1QilMt1VyGcS/pe4IQgjdJqjU/4fzqFZkT2nntQMbV9kQyNe2+qfqP7
-giTryIanmBAfd3oOCTsRz2VKPfdhCqCRiQB1AwUQMRdzEEyr2GZv4ALJAQEuhAL6
-A8I84BR+87uNAHD0ZJkTM73WdyMEGvAKBvrZK/g0VLYj0NtgkSuRJfrXnGkuh27I
-ZrjfL952Q/mXgMtHhJHJ9YfenGFWSEDHnolNzKOzTQJpE01IZ3nWv7ezA9N1LZVC
-iQCVAgUQMROrdRsIDEUnGa81AQEUNgQAlvyjt534RDQd2AYGoZriaFzjaL7dTCRH
-4b1zxuWBNWf3pI4W0iwU02Q5rEWEmY5DLl6/ie+vcQKOWSqXVgnM/s6EARdKEN56
-d6PzkwszgfEybDYrcAxReJcTCcV8ItJer/iqpBLgtaxyUpI77NvKcDGHp6BgYpnv
-1lNkH0FISK+JAJUDBRAwtzlWdGx7qH+PTVkBARFWA/99NTCMihlOZS7LmHDVic/q
-H1K1DVdMcv0iL39+7Pq4+AA/ET8dWIgcjaIreSqAZTpjwU1pMPaWgecDD1rEMCYX
-R+JoofLJ24BLcSlpXJ/gWMifYNxqdDeMRkw/aW/kaXQJWIz+oDYNuOyi5VvB6faF
-6Lm7P5cw1mX0I5rYc3woh7QoQmVuIExhdXJpZSA8YmVuQGdvbnpvLmJlbi5hbGdy
-b3VwLmNvLnVrPokAlQIFEDEXgCUbCAxFJxmvNQEBiL8D/3MLjfHGvuByqP1VFQrF
-QeMNd2aIQuC7ys3lkDvrLkkPJQANua0/MdDaZk6F5pCGcTmmmaJOjcOcCheD7FU5
-w9zxkQGR3Swr3opFHSr/CkEl83jRy3oq1MFydWoGajQjIr/c23X8zr+XntPyO6VX
-q5He4RrTiXeAEFBzz+J+R+EQ
-=zh1u
------END PGP PUBLIC KEY BLOCK-----
-
-
-Type Bits KeyID      Created    Expires    Algorithm       Use
-sec+ 1024 0xA99F75DD 1997-01-24 ---------- RSA             Sign & Encrypt 
-f16    Fingerprint16 = F7 E5 6D 20 58 AA B0 65  ED 0D B1 66 03 BA 9C C6
-uid  Rodent of Unusual Size <Ken.Coar@Golux.Com>
-uid  Rodent of Unusual Size <coar@Apache.Org>
-uid  Rodent of Unusual Size <Coar@Raleigh.IBM.Com>
-uid  Rodent of Unusual Size <Ken.Coar@MeepZor.Com>
-uid  Rodent of Unusual Size <Ken@Coar.Org>
-uid  Ken A L Coar <Coar@DECUS.Org>
-uid  Rodent of Unusual Size <Coar@DECUS.Org>
-uid  Rodent of Unusual Size <coar@ACM.Org>
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: PGPfreeware 5.0i for non-commercial use
-
-mQCNAzLpIyUAAAEEAN9KC8CxTeozPYJjsnhFpJ14d4Hhf2M6OTgqPQFRHOswM/3j
-B7IW0s+HwVyQ5/SjIlo+8ur9X7yaj1FS2GQmKD1x9LKeHRAoosBIs33okRtoeDRy
-ufTaTyQTwLklxClWm3JEef4xZioun1mtWbpz0yVEOCSZcRvtnJrNPMCpn3XdAAUR
-tCtSb2RlbnQgb2YgVW51c3VhbCBTaXplIDxLZW4uQ29hckBHb2x1eC5Db20+iQCV
-AwUQNiiZ2JrNPMCpn3XdAQGlgwP+JLlZvNV/fJ2azKIwjibDa4n2LUDxa7ofKboU
-QL+D7FD24zQcmzmkBQm/BL/FSUtxZasJkvdVbU98N3G4h3C4AyErfQOFcrepyGAB
-M88onQ1DbQ6tiUA3gw9gIB+2l1C5R8wBOtlwoRJM4GFvjjtRp+KaQqvN3f+lLMMt
-hKYB70mJAJUDBRAz3QWlms08wKmfdd0BAQMfBAC1c+9gr7ELthxwzYGTB7LiBk+p
-UABsPG/hT9z/cTGN8YQbK6VXV74sPAaeyD/t56xFUI9CRktZCinXp2cxvbNTe3Q0
-MLtD/PlCSRsgwsEIoM+1An1S3qOXWiGBXoXl/DgRzz9GVnB04m5/SP9XLE4Tmz+1
-X/Gu4TJnRjZZxN4xoYkAPwMFEDb44af9b4jGIdCnGxECiFUAnR3RORpXVyclwFEl
-euOwoynPQbY6AJ9H5rwHnz4gkE+AVp95++HmyeDkYIkAlQMFEDb45Ogxpj2W7BQL
-gQEBaS4D/R+EzfuRPiX5LgV7C70xtplIgS1iK+h0ddkPAr3P3zPxY0AEOjM81hiz
-Ol2Kf0TUMhhcLqO0UjNK9EyIHpO+Bf7pQoV050XYvcIwzNyVez5VCbDM7JA+vVeG
-/Pb+O/tPyEs7peSpdJAP4Kbg4Eu4b6+1QTLKrBCTWkEuNHABOuzDiQCVAwUQNzs2
-CairDeBjG1dJAQGb7AQAzHChrwaosl01sLcmlItrsqmzSFL5hbLor9Wh8UjVeYxX
-FMVgTQGs/AwN1B0W8PApOsz8mg0pSJm8VPHv+pc4Z9eNhUokfUsRJ4LHjREpr3Gh
-+5LoZ53nk1f62VQSOCxOOJ50cAH2rqv/ym9EVCaZ7evfHIR7/KH5+sVpcs14c/2J
-AEYEEBECAAYFAjhv6QUACgkQF1lVzkO+5qgYaACfaA4rC0EaP5yxR0wEYiGmgy6O
-ZhMAoNt4cGFIMI3x2VI9hyi/ZoUiu0zOiQA/AwUQOtYm5d26ZLosMS0vEQK8VgCf
-Tw+RZ/xUlB/5YfyrK9fb/VKGm0wAoK3bRHDa/MMxxFtO2c0SqOKxbTKGiQBGBBAR
-AgAGBQI7FOmzAAoJEJcWsik7qjrgJlwAnjRjnKXy4jj1pAFnFFUebJ/+Ur8kAJ4+
-DTV/SegKBL3jSua5ISqm+LBOjokARgQQEQIABgUCO4p7LQAKCRC/S9DmBJ24edNS
-AKD4ddoiLbPhQkQtGHjy9BlwUSdg3ACg+1fpy3UjWHzCWqWYSh33aneZuXa0KFJv
-ZGVudCBvZiBVbnVzdWFsIFNpemUgPGNvYXJAQXBhY2hlLk9yZz6JAJUDBRA2KJmI
-ms08wKmfdd0BAT3yBADEDHAn++77n7bLA/u9QYM2LBQHnXdw5Is8YGHpHcNZVDA8
-CtRTOdub8rhe9qgsid/jEry0hT9Sygfx/ry5ntjmF12ltnxBDPdZuU2DaHaIh/zB
-UAv0hyaQeAXEYiV9J75GrDkTj5Jrrnd623uyIRoMZPKYb+oqsZ4HjIe/w+CDfokA
-PwMFEDb44bT9b4jGIdCnGxECzDAAoNR8md7KvzarecOh/6NpTb5r8JXJAJ0aJtTz
-soNXpLaVwSMiGdm5ts2qOYkAlQMFEDb45PYxpj2W7BQLgQEBxKID/11Dft+UeLdd
-kIDFjaJGrIOfQ11y+QlJWaQ2Him/qNzNP8w8ZJ/meAb4PMSeQOI3PVKulf8vMp3Z
-0Jh2irfn1ycqsui4kDe6azvd5PultRKTRljtwVIDuqsrVMVq/zNAC2bN6CUnkkdZ
-2O7a5qIkDDYnyRzAEwKhJxleWrXYHiIhiQCVAwUQNzs2GqirDeBjG1dJAQHcYgP/
-eRCEQW5DJ6JQol5HQ26UnjBfQGdXsRvpT6gFNCDy/Nv+b886WC9j99T3IU+AztXf
-OPfPh7oU/2yC0VOmSaZS9SQ/PuuFdNhMggR8Q7goWothdBsMOUyO3iYrQCRnV3mL
-NsOT+/gpSt9diLujs7SpiQeHZmQaNMQUrJPBp7tTbsaJAD8DBRA61ibv3bpkuiwx
-LS8RAvHXAJ95ifArYzouYPB3clib/568TqHeVQCgxgEb1xJ4AgjZibMl34g+19wb
-G3CJAEYEEBECAAYFAjsU6ocACgkQlxayKTuqOuCaDwCfTHOoCNtoYenYgqa2LgUC
-62mEqFUAn25xLhvjjODMpWry5uAA2NR1k00KtC1Sb2RlbnQgb2YgVW51c3VhbCBT
-aXplIDxDb2FyQFJhbGVpZ2guSUJNLkNvbT6JAJUDBRA2KKJpms08wKmfdd0BAWcz
-A/9xfbUofCDogPs2gbMQrGx9kT90SBEYcWnlPq/Ocj1871ZlnYeYhJaMSOuLnMAC
-Ze9AbadYRgVVwXWhamH+d0uAvCw98ixmI9emPUsPuiifk8Re8mWQV+kcOqIbjE45
-FtsZYFy/WyqTHp2OSl/JcugwPfrlhrMW4q6selY/ABBEkokAPwMFEDb44b/9b4jG
-IdCnGxECNOMAn3K6caoKqMtKGrqRwoFaCPjBgOi5AKCc1dP5HAtyFloQGxS2fAwJ
-p9Dp8okAlQMFEDb45QAxpj2W7BQLgQEBX1gD/1O/9VxXp2a8yrlV2qJ6xJ9U3fCL
-/OVUTrgDgzw/219jeXgiG0CAM0ApZ7NSqk95aRSKZqWoJvTY5K+P4RuGoMJ1JYjQ
-i2fXiCSHo4fDF2RPTXxqCorQq6M8csJqpQykiUQRd6HfKSURk1WRfvGqi2iwiCQG
-ipqd0kmzyQ2WSEjviQA/AwUQOtYm9926ZLosMS0vEQKW5wCgiIdzdam+8MnCpvrp
-5ooDS+XqJi0AoL6kVPnu/uDN4WVIIaO3rOYeW+SViQBGBBARAgAGBQI7FOqHAAoJ
-EJcWsik7qjrg+S4An1wT/kE/gbX3qmG3oEGY78r56mM0AJwOEJ5QA1bl/wDeHeyH
-tHd2qw/lVbQtUm9kZW50IG9mIFVudXN1YWwgU2l6ZSA8S2VuLkNvYXJATWVlcFpv
-ci5Db20+iQCVAwUQN7GHT5rNPMCpn3XdAQHIuQP9G3RaObWL3iI2xoIWs3s6L0LF
-noFv/RrK0NHEDy0YEm9LqeVp86F9QvOA+kh3ySfVPtxbwsMAswAkqbvWNi7U2Xz0
-V9KJmnEnJFLmjHoTBNpahTGFTnOxcH4X+57mAAzbCWyXFvGsT2b8orset0QVqDhV
-hwOLGKLlXWzDiQdrY1+JAD8DBRA61icB3bpkuiwxLS8RAkGnAJ9m1mvfaHA5Z3FU
-JyzUpuS7xd4NcQCg5XMoJgXHC1Gngqn6jAh+Dn3TDVqJAEYEEBECAAYFAjsU6ocA
-CgkQlxayKTuqOuCHpACfU7nZUI2Pj5dS46VZpVygxMl6dAEAnA751ZlwgIYWnZyh
-uqKcJzbwdV2fiQA/AwUQOt88Av1viMYh0KcbEQKqwgCgyDsKH89EE1W7/b8cfns3
-OrI+3DUAoNBYnQdsW6Uk45iQWyODnV3jUIgQtCVSb2RlbnQgb2YgVW51c3VhbCBT
-aXplIDxLZW5AQ29hci5Pcmc+iQCVAwUQN7Gd35rNPMCpn3XdAQHcoQQArrWwFNeS
-A5Yu1nEXevfStfkSUQqzA6qsREPgrczIOgsCfDR/RA/1P7GcxiOvY5mtckuvgkP0
-A9atWkCFX4A0UzerKAKaSirUd/V6Dm8w3hOR/e66I/rbQifZoV/KqvofRsxESV4U
-+uXoBsleePwhpmDarpx1BlMJrjwhDDmGaVaJAD8DBRA61icL3bpkuiwxLS8RAn9y
-AJ0YXmF4g4/6GVCilTjxhZWL6acAvgCgwfYFTgB7gdCg9+3LL2jsc6bC4OCJAEYE
-EBECAAYFAjsU6ocACgkQlxayKTuqOuDA9gCeLlDfQW6ryZS8S00/LKsdvdVF0R4A
-nipUMGGyTIHYvgX+SI8vfZu3lUwwiQA/AwUQOt88D/1viMYh0KcbEQI9bgCg7T2u
-7Hzf/HG7s+m5So67+ixdngYAnjTlgTJNKSRLspsZVVumNM9YgxdjtB1LZW4gQSBM
-IENvYXIgPENvYXJAREVDVVMuT3JnPokAlQMFEDNNn5SazTzAqZ913QEByxcD/RkT
-z31D9IdedFAd8dseUv7TZkSSnZNctg5fZSlxL8kOWQKzclLFmEmnxRkTsIm/jtLF
-g2B8rEtKCfvbnOIvUFVIJLYtLPgBEWPFRrDpBx0eaLdWmogD534En/gsc5Yh1XTB
-G4Vveq39iZPcuP1Zc/fhmsNTvdgsdpbLyDquYH+riQA/AwUQNNhoI1F+HqlP3KvB
-EQJbxQCgxoQqL3hPPRxUhG3jFPIfiMGokUgAoPXYHWM63hFwomWAkaN6qSAHPKe/
-iQA/AwUQM9vDdGfM5V5WR8xwEQL2iQCdFQX3I1x2K94zlI740/VKtpv+2g8An3Wk
-FnyJR/3SJA88j/cujVv7kLX0iQBGBBARAgAGBQI2treyAAoJEBPfD2hdwuxYIq4A
-oKI1iXIAvt6KWLnde4nH4fJYvT58AJ99QNGbxthzYLnyFL3M/6jmQIk4b4kARgQQ
-EQIABgUCNu/SaQAKCRBrQHp6H3FQjZO3AKDQQnUS2qMjw3D/Oy6UlMVxZEYPUgCe
-LsZj8ZIUcKkfuhtKycVaIK2wC9mJAEYEEBECAAYFAjhJyKwACgkQURMkRYnG89BU
-PgCfa7gmUGgguVXend9EzB1h1TqQErYAoJai8ymv6wYxUXR8/OjoY9eB3CIJiQA/
-AwUQNvjhlv1viMYh0KcbEQKGGgCdFsmDuwfAnU9UFyxhSoyvdkcOcwYAoLp5e1SL
-6ZmIvITFg++VkDvR/j4UiQCVAwUQNvjkzzGmPZbsFAuBAQFdWgP/bv9a9t3J/xZY
-44wb0holsJFuZWOVYKeF9RFIWd0sJXut7yUeWZ5g760eFSEX0QDHfiq3KOT3XO9l
-hcNnDRBInMbBnawbBneLpzM58ZaRnw10HwsOl49Ekc9nHZBBM47mqy1BlGXMi+Yk
-Kh3W2MsuitHkAYwZuNalrqYhqghwooeJAD4DBRA61icU3bpkuiwxLS8RAuD2AKDr
-q4JAQFljMpudc569P131/RjPrwCYqxVlo0cbfFBihV06y5LHjQEd44kARgQQEQIA
-BgUCOxTqhwAKCRCXFrIpO6o64HEaAJ4wLnOLuRX5U21MFOUzIZOumrItcACdH9DA
-YvOpnnkjPNSNGjaI1oh2w9+0J1JvZGVudCBvZiBVbnVzdWFsIFNpemUgPENvYXJA
-REVDVVMuT3JnPokAPwMFEDb44dT9b4jGIdCnGxECfaUAoLEJ3t6nXT15EskyH+83
-pKZe4zkIAKClLlJ7vTuZ5fcjOsqVURNrs4o/cIkAlQMFEDb45Qoxpj2W7BQLgQEB
-QjQD/3DOozCF5e6JkMXJ5HGVrAxbDpRs4SJCrLFX3GuTeGsVCniOf0WTy6+cXuod
-zu1ZbRVlji9YKO2ufoWvH6AEPEVnHYp25T0dtMya/mwEI010dCrj4oXTaYikz2lu
-WTDPgKcHk+mYNDHREOOcN0/CO6RWTZIhok3Su4zBYL0YTg/RiQA/AwUQOtYnG926
-ZLosMS0vEQJe2gCg+51l8oZ1DQAL5hzKeW3pY5Vg2gkAoMlzmol5cvtxt9wFyrjw
-L39LL0fstCVSb2RlbnQgb2YgVW51c3VhbCBTaXplIDxjb2FyQEFDTS5Pcmc+iQCV
-AwUQOsoapprNPMCpn3XdAQHxkAP7BJ4KshrO4m+T2/l5OepLDQAGWxIg5XK05upw
-mgNPO6enptNjT+Quu78GYOKgVQww3eQoIlxFiEQ7Kccc0gFBhZVoqhrZ7mALrY5l
-HPN5Gy68PlpZ7LJoeYm694LlbwcWa2IAs2K7pfWft/36t3LRBt3NKOyOFVSCGPoi
-U+LiZuuJAD8DBRA61icj3bpkuiwxLS8RAhflAKCyngJ8wc9VaBIA+qaMFxCdGbIw
-egCfbseHoGcorOi0OS6B2ev8hZbJt1aJAEYEEBECAAYFAjsU6ocACgkQlxayKTuq
-OuDvlgCfcKf4eO+Y/ojSavGhITOWjBxgPG8Anja9yfJLediLcTlQwsycsWVMx3wh
-iQA/AwUQOt88GP1viMYh0KcbEQIyoQCeIFtr399fYt4MqRBfvGo59oE3A5sAn0yV
-t89HbY/x/sBXuksvBGxFGhgs
-=GI5x
------END PGP PUBLIC KEY BLOCK-----
-
-Type Bits KeyID      Created    Expires    Algorithm       Use
-sec  1024 0x302DA568 2001-02-13 ---------- DSS             Sign & Encrypt 
-f20    Fingerprint20 = DE29 FB39 71E7 1543 FD2D  C049 508E AEC5 302D A568
-sub  1024 0x04E15F28 2001-02-13 ---------- Diffie-Hellman                 
-f20    Fingerprint20 = C41F 1F5C 6485 0100 B21B  EB14 A14E 77B6 04E1 5F28
-uid  Rodent of Unusual Size (DSA) <Ken.Coar@Golux.Com>
-uid  Rodent of Unusual Size (DSA) <coar@Apache.Org>
-uid  Rodent of Unusual Size (DSA) <Coar@Raleigh.IBM.Com>
-uid  Rodent of Unusual Size (DSA) <Ken.Coar@MeepZor.Com>
-uid  Rodent of Unusual Size (DSA) <Ken@Coar.Org>
-uid  Rodent of Unusual Size (DSA) <coar@ACM.Org>
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: PGPfreeware 5.0i for non-commercial use
-
-mQGiBDqJD0sRBADmh5EfoFA8VC/c7+BlG5l4+RBIcYlkvYFZcLbS2fPgkHDndrrp
-5xIeYCFvnnRSVGkQbAfl4Gj62fGcyaI9QIbLAByGeqSoM+DbiEzIyR+QQNpBq+bo
-V1JWaXiuI8d4sdf5ZyTH2nT1EUWVPiBgeXHYtdnjoh7IpG5ETH2miBs7swCgvcJr
-y3Lwa8FfgVtCXFeI5E8wAm0EALOtxh6HwJbTWGAFJFA9RWw2oShLmovYGtdnxcY+
-wHX12oCkanKd26Nr09O+onh/xiQ0mSql3v6SUPnCfyC/qCLeuO2w4vspDlFMbBP0
-I+XFUt16Owldxvmy5fHvhChs7YSZqkVCMx5i+NTvyd51P9aELFG6A/7x3z/tpmyn
-Be8wBAC8l29qjxJSNDsIMMf0cw8STUtNKN9SknKVpQektHb+x+3wreUESPByrgfl
-cTm7y1ulg8rVazynsSVjMCRtmZIfboV2mhsgOu08aZ3bXPpWiHSJ5NR97jdH8s3I
-xuiyQ84PHHVjyLAIh28nAkIvbPRtgt7M581dPpKknHvqz1sW6LQxUm9kZW50IG9m
-IFVudXN1YWwgU2l6ZSAoRFNBKSA8S2VuLkNvYXJAR29sdXguQ29tPokAVgQTEQIA
-FgUCOokPSwQLCgQDAxUDAgMWAgECF4AACgkQUI6uxTAtpWj/KACfccB9nTN1VpGP
-zL2c11ya9ApunAsAn0zhuYOoDZsUCbKooUIg4zH3+nFziQBWBBMRAgAWBQI6iQ9L
-BAsKBAMDFQMCAxYCAQIXgAAKCRBQjq7FMC2laP8oAJ9LlFZKQo9K+VFVsIu44z+H
-GniLfwCffPkZqEjG6nSJYV50x0bjnVb8GDuJAEYEEBECAAYFAjsU6ugACgkQlxay
-KTuqOuDQRwCfbpsHlgt++QSd1BRy8yHqrUupApMAnjcY03RsdplzcGr+xuiiRjo1
-quipiQCVAwUQO+FSL5rNPMCpn3XdAQGqgAP/VUU1o7ZxsEZJYUq8R4wErYxlMr1U
-IGpVkPhMmlSnJyTN2KbZGcGkbiQ7+prdjj/tk5MVssVTP8JHEjS2pXc5/Gpf01oM
-opK2h7K1fEX2NH3F3Ow7yEt1/kGtNhgaEBYUVO8TqZaba6ikqXn/vYFQpprSUThg
-pOk4kk/7eggUxRaJAD8DBRA74VKU3bpkuiwxLS8RAu8aAKCLrqGScZZ3pWXcvnsF
-7Zu3Cq/X8wCgssm+gUsZtncub+LPqEWcrS7MVqW0LlJvZGVudCBvZiBVbnVzdWFs
-IFNpemUgKERTQSkgPGNvYXJAQXBhY2hlLk9yZz6JAFYEExECABYFAjrKH6IECwoE
-AwMVAwIDFgIBAheAAAoJEFCOrsUwLaVoixAAnjACHycu39VEG/T/HnNY8iJt3TFH
-AJ97peKuDSVTTLWtfwBHv/y05+ieNokARgQQEQIABgUCOxTq6gAKCRCXFrIpO6o6
-4FBhAJ4orS3X+GJ64mXjzqU9YFd9XYKBTQCfapw8Ss2Fy/HZgPd1CeUuBuM+9/WJ
-AJUDBRA74VI5ms08wKmfdd0BAaVhBADN5lhtY+wUn21GCQHP8aRfL+efIVhDlOE+
-uKY+SAK+FgMM97r3eVEVC6r/eWeXOV6hCUNcpnawy2mwck1XwJ/uAkmvXPZevP1Y
-P+8We9NL16ECH5Ow/oSz1i+ASKsDH06HpALC5VhPfZ1qIc2M+n7xhhPUFS8g42w5
-yfrHDS97OYkAPwMFEDvhUqfdumS6LDEtLxEC+xUAnAuKRZ5OyM3wZWZhUOFu2+1m
-RYuVAKCjjuLsMfV8KDlFyEc3QXvdyhyJYbQzUm9kZW50IG9mIFVudXN1YWwgU2l6
-ZSAoRFNBKSA8Q29hckBSYWxlaWdoLklCTS5Db20+iQBWBBMRAgAWBQI6yh/NBAsK
-BAMDFQMCAxYCAQIXgAAKCRBQjq7FMC2laAFLAJ9B4SLn9nVY1NWW7yZLiJl5CIoE
-fACfVJFGZ+CgvozX8nt7kRXcsu+FZiaJAEYEEBECAAYFAjsU6uoACgkQlxayKTuq
-OuC92QCfTrmLK2FBGB6auc0Llz91JtM8vPQAnRI4xh+uenrt0Mijf00tKBDL8O+A
-tDNSb2RlbnQgb2YgVW51c3VhbCBTaXplIChEU0EpIDxLZW4uQ29hckBNZWVwWm9y
-LkNvbT6JAFYEExECABYFAjrKH+cECwoEAwMVAwIDFgIBAheAAAoJEFCOrsUwLaVo
-6WoAoLPiSCJ+ZpzTBxGbUMkmm8jidlpZAKCTFBQddW1FkHuKFMUae9S3gOQVsYkA
-RgQQEQIABgUCOxTq6wAKCRCXFrIpO6o64ErDAJ4pyRV1ShT0E4TegsZQ0IQ6wM/g
-oACeJQNXftu7U/bVZuNkLfXnD7SKwNOJAJUDBRA74VJKms08wKmfdd0BAcANA/9M
-g1QCcgmg6t4HTaZ3caeI8nNZ/LjWs8MNWi0Z8OGytEwOgwIrG/DzoCPRQY/IlMya
-gEspYEDO1kjrk37HcUeO8aOWkEjXt+0uFDLfQGKJnusyb+ekjw+JxOUzM8gMH/mR
-ePJM+zx+ZU9dJU1rvbwXrtPwJpYX8xSf1L0J1p0ih4kAPwMFEDvhUrHdumS6LDEt
-LxECD5UAn3gLjfBN18lmbw73leBq3+XKjI5gAKDBXQHmIc0zRT9VgszOGZG+XfRk
-nLQrUm9kZW50IG9mIFVudXN1YWwgU2l6ZSAoRFNBKSA8S2VuQENvYXIuT3JnPokA
-VgQTEQIAFgUCOsof+wQLCgQDAxUDAgMWAgECF4AACgkQUI6uxTAtpWi5swCeJrPK
-y5D9fDm/H9nbsXLQTuo5QdUAn21AiEiqhurk46M747SqLpNJmgqFiQBGBBARAgAG
-BQI7FOrrAAoJEJcWsik7qjrghWsAmgOEE0Fh3Xcml6sk5boGNVRgg5+YAJ9lKBe/
-9SY/DssCK8LV4gSCdhRCnIkAlQMFEDvhUlaazTzAqZ913QEBzWED/0gy/fbatnok
-wtHz2P8xEAZ47ObQ52IhjxaG5GCkfdSEF5x+EUQaNeO+u3O2k3LakNO1/YN2BC36
-MuZeO/rU6bJro1r3ct5G5TODdb5MNSnf6rUath4T1BvHi3P5sdhB4e04WlenUscB
-AbEpo2zfEMn6QDvmrc6Mr+WpnVCb2gJiiQA/AwUQO+FSvd26ZLosMS0vEQIRiQCf
-cdu11Fj7Uotcb4R9mrM7MGYVptEAoMDImlcyl2w/jf3vjPnoNmrzD6YqtCtSb2Rl
-bnQgb2YgVW51c3VhbCBTaXplIChEU0EpIDxjb2FyQEFDTS5Pcmc+iQBWBBMRAgAW
-BQI6yiAkBAsKBAMDFQMCAxYCAQIXgAAKCRBQjq7FMC2laIlXAKCWqXUTcphAK7wQ
-lpLXYTIpq45cKgCfV7S+4kkw8A/Sg3/v9rzbTIFTKfWJAEYEEBECAAYFAjsU6usA
-CgkQlxayKTuqOuChhQCfXC1x2yzBiRp61UJM4ILFM79TtU0AoIUYBWyxpU6eS2kU
-mHnBZlHzkZJiiQCVAwUQO+FSYJrNPMCpn3XdAQGqygP/XT9IZzBm42ZeG7hIh8Nq
-UwPinkv1AP0lqUX8ME9hIcBOtmpSwvqHV4aa8RBzStth7ob2XXvJyjl/oBgxjTkQ
-mdPwqsYGT6CQWm8q3roJe2oASahYgGinkgivKi5KNCLwdpst+0nEcTb2L8GDOJ0d
-cWmBRVoKlQPNKI44uL68XCWJAD8DBRA74VLL3bpkuiwxLS8RAsATAKClx09xbGW7
-VDKSZi+HXLpy83R1fwCgo5dkvND4CEAJD4XyNol2Ygj/j2+5AQ0EOokPURAEAPb9
-XCxUtIXh12LmwYNk0PA9TWNJM1Mgo20rwUsZUdLHOZNuXCUfYIjHjw951K1KqpXG
-Cv4On/0SVXagXZs9yI+y4Emkz6qPhr9nAzHexH+ykn+ROaP0zNKtPPgp5CQcHz9F
-Xyz90XZuU48Tly20a9qo0v21dhVh0D4tulkS3pAHAAMFBADUgNY87Tsz3ndoonHo
-JUFfzwlm5gOknvxE0Sk8dgYzYPrcLX9ZETpSoTWepbjfSe2F1voTscMkV2WhKMSr
-dtzFrd8PjvOo8tXLkPL72vyUgw7BDFnfLvIaLtHAQu0BqfHaORhH5ufFZLXrOXvH
-GaYfx/kSbFOpjK/KCrYgLzF3r4kARgQYEQIABgUCOokPUQAKCRBQjq7FMC2laDSz
-AKCv+P8evU1SsJcZdjTcfyQzcN7FowCfRZE55mNxbmQZH8RiK/ssP3gcEwiJAEYE
-GBECAAYFAjqJD1EACgkQUI6uxTAtpWg0swCeIya+hFw4LjTi4KyK8puAMTMNsNkA
-oLSGqJ147DJuA6/pNp9OXD1q98vj
-=DZH6
------END PGP PUBLIC KEY BLOCK-----
-
-Type Bits KeyID      Created    Expires    Algorithm       Use
-sec+ 1024 0x2C312D2F 1998-10-17 ---------- DSS             Sign & Encrypt 
-f20    Fingerprint20 = 1315 5B0E 9E63 4F42 BF6C  163F DDBA 64BA 2C31 2D2F
-sub  2048 0xC9D00816 1998-10-17 ---------- Diffie-Hellman                 
-f20    Fingerprint20 = F05E 8A42 A306 92F1 7B32  E3DE 2B88 4A28 C9D0 0816
-uid  Rodent of Unusual Size (DSS) <Ken.Coar@Golux.Com>
-uid  Rodent of Unusual Size (DSS) <coar@Apache.Org>
-uid  Rodent of Unusual Size (DSS) <Ken.Coar@MeepZor.Com>
-uid  Rodent of Unusual Size (DSS) <Coar@Raleigh.IBM.Com>
-uid  Rodent of Unusual Size (DSS) <Ken@Coar.Org>
-uid  Rodent of Unusual Size (DSS) <coar@DECUS.Org>
-uid  Rodent of Unusual Size <coar@ACM.Org>
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: PGPfreeware 5.0i for non-commercial use
-
-mQGiBDYpIJsRBADkH4H8YqFaBHE7lTb+DkZ12CLXq7Hk41DA/HU+KM2CrGOExK4r
-DO9zVa7zjMbjhskYMK9AVTPC+f+LrDk4PtTJrRrh6DKZf8loEhgChrUpSDBvlByw
-sWiAxWqIWAdNy0POXuZNyW+XPc6u/bKgn61pe9UARKI+qqxIouRxfPJuOQCg/7q0
-syYsnWFiUTOMF7/ku6PHdhEEAJVpl3PaqW5BExYKrdDLKfQ0H7jLXXOABul4bDzm
-pjUx5Wmkq2zhh75v4bGQRBdCCTAd3EAowVsk2VbhUY/oQ/bfv7lK32PNTrhtA9Af
-adueeU6hDQcH2YV0U7AnaYHlRbiYxc6ASGZdSNiPL8CYLuP3KQ7eSWjRqG+iEa1T
-5nHkBADWMdJJ10rUeLSoqUKGnDhVDt7T7H7EuEcgPrERksztzBc/bkOFZg+aRlFo
-Z8on8LURDDjtQkHgy1X3ZZMNi7RlKOfEVVBQAwaxqUzxv8gGKBhu41TZfksJ6e6j
-q4ew51wBKl0dLfnsWGdxrzbFvQr42KIia51VW81fuEWWbePGgLQxUm9kZW50IG9m
-IFVudXN1YWwgU2l6ZSAoRFNTKSA8S2VuLkNvYXJAR29sdXguQ29tPokASwQQEQIA
-CwUCNikgmwQLAwECAAoJEN26ZLosMS0v09sAoK4Pkxh5nK6rASGHMm6yJ1vAcj59
-AJ9Bc1TmkW2hfjy+h/qupI3GSGKAPIkARgQQEQIABgUCNu/URQAKCRBrQHp6H3FQ
-jQTMAKCeQ/gtRkp14n4IPb5XUFgaiuxVAgCgooJ/PF27EtttYAcQQrCj1boFxgWJ
-AD8DBRA2+OJt/W+IxiHQpxsRAvTAAKDOlNLFMosEetY77WXXcecvjt6SKACg28M5
-aGHwbNgMCYAMc5N6CyJ6P1iJAJUDBRA2+OSuMaY9luwUC4EBAa6hBACSL40yvCXR
-8KqrNh8YbXYQsWsauIWiHfjXrMjlYpGPjU8aYsn0dhGYNsiYZwVKkTJMogRtiNeF
-RpaTJcjTQA0D7G2d+eq2YULmuPeLoHXCp2+xjh77SD9Ybb8cOl7iNNNEGXrza4aE
-X0Y6/bAH+IizlIXapirzyV40bilv1sh5v4kAlQMFEDc7NZaoqw3gYxtXSQEBc0oE
-AJrDIhOcHRPtJTYGig3+dBuKOpVh6KXg6t0oWbr5+xopEBlAjFJdJouk/lkzlXGo
-XmJIqodvlwcSBrANO9ntJNTZGZ0fIbrk/a+j6NE46xb5UqDlkKN9n8Giw+kWvCbi
-eRneb+JKLDtr4241tMEG9DnizsoHEeX75iIdWRTkjSK0iQBGBBARAgAGBQI4EBU+
-AAoJEPq7n7kJORDtSGYAoJ1UO1rpepVGPj3fK79ZkdNuz6MXAKC0cVfKK6V0HlH8
-lnJkNe+4zOqwiIkARgQQEQIABgUCOCrN7AAKCRDdIMImBDBlVl24AJ9oDUfkD5Wz
-Y6xwHuiVRSqApSeKRQCgzR7imurkIfa62k7ozQA7cBSGY7WJAEYEEBECAAYFAjqJ
-ELYACgkQUI6uxTAtpWgUvQCgmUw/9s6iwO9yC2e8KustCEZTtBAAn13ziXenfoWz
-yc0uIhuNQSo9/9obiQCVAwUQO+FRk5rNPMCpn3XdAQFQeQP/diFqVU8L0XIRUHqv
-TklJ5NVCFxb1DgkRjPQgQc6URSr+u9d7+sUe+XIj3UD/V0ib+lmTribpe/OUSlTg
-TAJGH3WmXxxJaPigbQL4cSmuvdQ/aU/pxZzcUW4OpVjbOlBzo9zchP1wWFmQYYai
-hi+vjB63HgrUotJfI/JoZ8eook+0LlJvZGVudCBvZiBVbnVzdWFsIFNpemUgKERT
-UykgPGNvYXJAQXBhY2hlLk9yZz6JAEsEEBECAAsFAjYpIigECwMBAgAKCRDdumS6
-LDEtLzFfAJ9ptM0H+S2O1EuUoRWwh4frOdkH/ACgwtUhdrNQctOzp1jzuXefRLek
-zZuJAD8DBRA2+OJ//W+IxiHQpxsRAmm5AJ0QTZhmPKYuRZ1wLeEISwSVoTxPDwCe
-Kn/V8i9uXG5SrjJIqzM52C9nNu+JAJUDBRA2+OTHMaY9luwUC4EBAa7LA/9i3oYk
-i2PT43SKo/WXMEfEUp0SZrBqaYhJn0LWOuGeBB3ta+ijQzVF6KV8dlwX115Y/rd8
-xHV4QEQqGD1ofC0QWXGc1TJl7l/yv25nHE+9/+JnPp3xAwYfW+IJca7pVcNxceNO
-v3xKH/yDc36qtAVkB9IZZ6kXAktQbzUbTi+lQIkAlQMFEDc7NbCoqw3gYxtXSQEB
-5bED/iThb1hGo0sSEiF5LReuq5GIIliy9Ju0lYGG7sjF+HuGa+l3VCp7uh+axFSR
-KKeAYZfN+arHujpqcYHKeMdJreRsIEm3bBLgcMboiVjqqJQ2Kz8rw0Ax1dcS43tU
-2E7XfbDhVRHee8H2BNAEoCE2qMBZ2qEargC69lPVunSs1LWLiQBGBBARAgAGBQI6
-iRC9AAoJEFCOrsUwLaVoijsAoJ4P63/fTU1SS0CsJcrGLav5q3vaAKCHK1eUxe+d
-PtPYaeZuLmvmcTdcOIkAlQMFEDvhUaeazTzAqZ913QEB7vID/3ny3JaTnCgeFt4p
-LZ0nuv7UaywuvXj/6RgH/4MLEWHVXagvgfgEML/jmFw3j7VzxE78pEWt41R+Kfpj
-ZK4YQS9LgZLCM6UENe/ejijeljOTAGYRlei46O3nMyZXCkLsq+YFoVd7Gn+yplaw
-Quiy7snl9ChUsGMLCjAa3jZt4QRTtDNSb2RlbnQgb2YgVW51c3VhbCBTaXplIChE
-U1MpIDxLZW4uQ29hckBNZWVwWm9yLkNvbT6JAEsEEBECAAsFAjexiO8ECwMBAgAK
-CRDdumS6LDEtL+PCAKCK+FbSDw/QtyB6U03NXEviaQmUNACg6d9pt5X9/E/utW0p
-KeX4Yws0BieJAEYEEBECAAYFAjqJEL0ACgkQUI6uxTAtpWgkhQCbBvzYd4A/V7uB
-LHmEqz52teOoVt4AoLgZMi2vfQwqv13ED/y3zspL625ciQCVAwUQO+FRwprNPMCp
-n3XdAQHc4wP/V9gdW71Ygc1Jr8hxmMODtq4auSsqg4mfOHpP7Z6vbAhLFn1RTAYY
-pIhTYX/Y5514f8yWmDyL8/ePGrvZlHqpu8MNDlju37kdSS78+KlUf3XCA6s0RlXA
-VDovcmbAGVQmNQKf2tlJEPmipTZmExF5tMGM7H2Ob7w7nvSgwiXZm4q0M1JvZGVu
-dCBvZiBVbnVzdWFsIFNpemUgKERTUykgPENvYXJAUmFsZWlnaC5JQk0uQ29tPokA
-SwQQEQIACwUCN7GJGAQLAwECAAoJEN26ZLosMS0vkGUAoPbhp3yi/BeC6zR2mv16
-XARtVlAwAKCE8kHKDREPKA/E7KpH6dHEx8BBzokARgQQEQIABgUCOokQvQAKCRBQ
-jq7FMC2laJlUAKCG8lAf70mA++RFLykYKh6uouPYXwCdEvy1e48Py7VD/M+q8c0V
-Zw3a92e0K1JvZGVudCBvZiBVbnVzdWFsIFNpemUgKERTUykgPEtlbkBDb2FyLk9y
-Zz6JAEsEEBECAAsFAjexna0ECwMBAgAKCRDdumS6LDEtLyKeAJ9N38ClCaouEyFL
-uCqlojSCcInEMgCg6fgtZXAoi9KyGP1JPhwFstk3hSyJAEYEEBECAAYFAjqJEL0A
-CgkQUI6uxTAtpWjwFACfbO9rVnMASuQuBNr5S0v6QvEJHUwAnR9Q4cYjXPQ8Q+B5
-ozX3QKSo4fLMiQCVAwUQO+FR2prNPMCpn3XdAQFhywP/VwKYdMizq+z/3wqqMoG/
-e7XIkTEllE8O8fPa/mg9S1Gdf3ysErKmPoxwzhA2NiI+1ItxaFhmSnb3FolzGB1r
-XOdPUn74T8PJAdycmmwLqY9jq6qzx3qva+O/KBkp4RH5Y4Jrd8R1w2IfNGllvI83
-/QixXihNUYZChg+0wbAx7Wu0LVJvZGVudCBvZiBVbnVzdWFsIFNpemUgKERTUykg
-PGNvYXJAREVDVVMuT3JnPokASwQQEQIACwUCNikhawQLAwECAAoJEN26ZLosMS0v
-urAAoLIKrWymZ44LD56dmUSbp0Im3HX9AKCPXngeaVD2FV9yb4xyEr3aAPb8p4kA
-PwMFEDb44nj9b4jGIdCnGxECo8wAoOw5N9z4B7faBmnTBDetulfBfhGqAJ9gGzaA
-V6Hp0D8dNO9V+MxZETY9d4kAlQMFEDb45Lkxpj2W7BQLgQEBKYwD/0ng4LDO9Dpm
-6m0AxD2EzOsdN0eGB0VdfEJfeWxM/TAnHlecPL1Aq8XXex8LSvDemfATtQIXeOld
-Ye2np5szUpY2MBTCLr53kNuPmDLOYhNCzQnB9w6QtaXHlDINGyTjTQ9S2r+YhCtc
-Qb5LPS4uY79qE4GVMmkvI+60/n02YlJRtCVSb2RlbnQgb2YgVW51c3VhbCBTaXpl
-IDxjb2FyQEFDTS5Pcmc+iQBLBBARAgALBQI6yhqCBAsDAQIACgkQ3bpkuiwxLS/t
-3ACcCjcL+TpZYClEaxwdFM4SFgha8TAAn2qAC65Jedqiwrhy3MTDaUII0pdKiQCV
-AwUQO+FR6ZrNPMCpn3XdAQHnUwQAkYJGSM95uGyAu2M4ndw4oIm61olaZE4LlGnJ
-Pl3rmf51A9VxLGSCGWDuZ8BBvPiwu2A+sf9j+FY4f3r9/lNf+wGb1dnnv0uo2D59
-CbUGkPsGmV0YRet9AAwy0RXXWL1QZ7f3AH6R6JVymMNupE0z+qupNjlBP+k93Xx5
-M+krQM+5Ag0ENikgnBAIAPZCV7cIfwgXcqK61qlC8wXo+VMROU+28W65Szgg2gGn
-VqMU6Y9AVfPQB8bLQ6mUrfdMZIZJ+AyDvWXpF9Sh01D49Vlf3HZSTz09jdvOmeFX
-klnN/biudE/F/Ha8g8VHMGHOfMlm/xX5u/2RXscBqtNbno2gpXI61Brwv0YAWCvl
-9Ij9WE5J280gtJ3kkQc2azNsOA1FHQ98iLMcfFstjvbzySPAQ/ClWxiNjrtVjLhd
-ONM0/XwXV0OjHRhs3jMhLLUq/zzhsSlAGBGNfISnCnLWhsQDGcgHKXrKlQzZlp+r
-0ApQmwJG0wg9ZqRdQZ+cfL2JSyIZJrqrol7DVekyCzsAAgIH/As5pFqpFu0udUuY
-2p4I+ck+xrOOv949yjVrx5PiCIHhPyyUNJO2P4DJULgIzAFnpKZnuXY35UXmsHN9
-85MnHzvk9nk0b0HylxomBFrrw7xUHwZgD0qXCbDp6gDyDa+SY2zmBho8V/dTK7nq
-tuUEfqzUY7rCb+26p2pRvdetHmCXR5/yQ5cWvNw8AyGCbx+7C8ta2y6arWz24ZP3
-2MvenLXrpGeAiuZRKqWnCALksSxNUT0NMqmTghkL29Qcw2F5br/MTz4KnE0znvt9
-q3zLK+upIxoqTsKaqK2yiSuI/lMbl1NPH+/Bw2Er1VBcCNB14/2cqit421pMiCm2
-0dChqOKJAD8DBRg2KSCc3bpkuiwxLS8RAt8CAKDSmRCvou1moFG3fWUxweRlndgL
-XgCg6ajZ164aAHwQStdF9x+Jn96GQTg=
-=e95K
------END PGP PUBLIC KEY BLOCK-----
-
-pub  1024D/08C975E5 1999-04-14 Jim Jagielski <jim@apache.org>
-sig        08C975E5 1999-04-14 Jim Jagielski <jim@apache.org>
-uid                            Jim Jagielski <jim@jaguNET.com>
-sig        08C975E5 2001-04-03 Jim Jagielski <jim@apache.org>
-uid                            Jim Jagielski <jim@jimjag.com>
-sig 3      08C975E5 2002-11-11 Jim Jagielski <jim@apache.org>
-sub  2048g/4CCDB430 1999-04-14
-sig        08C975E5 1999-04-14 Jim Jagielski <jim@apache.org>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.2.1 (Darwin)
-
-mQGiBDcUl9QRBADl5tF8kOD0uddlnl9qsaG70/hwujGTsSXATnqoLseTsWORoVXf
-oBklokEAGmT2+Cl8XIXZ31Wh+GaJ3CTbEv8Ok1vapOt+ltPgOKzZEB4uP25EbhC2
-LWf+lUoafcd2Xi0KBV4fqXqEEuDGP1TAdZ6k7NVqgpjvbJ5TdqL0LrWOOwCg/0b4
-+/p/avQr+uZRU2rdmYu/b/0D/2LnjcEqUjsslh2e9m0OgAu+gnYAmQH6Dbnp+iKl
-jffWPChwIMFZd/7FnGOzYDzoqnzTFyA4VE5PHWL61V2lpHJWB21K9D6rbEcx0iYB
-AHHxZQEmxSBU6PmGnbF+2P7vC0Jz9gZ5dCbjtGboYxd00/XQlZwCs8jHueTpSfx9
-n7dYBACFpW+v2pSlG0ReiS6Ult3gaGWiw81D0nFVvCp5BlxgQDymyF1MS6FbCj/g
-FGILosMhlsIHTFaC0DD0LSXyN1rm0ykPvi+vULIlKNJwW7fCi+33j1Azx+zfMNeO
-T5vqAfF6cvsZ6qPb9CcYvU4jEKvkovA1U3jMFehqcGkTV5sfvbQeSmltIEphZ2ll
-bHNraSA8amltQGFwYWNoZS5vcmc+iE4EEBECAA4ECwMCAQIZAQUCNxSX1QAKCRCL
-OmAfCMl15UklAKDq2PsXa7PbJPtGlXblJjD1OZgjTwCgkCz0EAdWS4Fuhi0mmSm7
-h1gtH/W0H0ppbSBKYWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT6ISwQQEQIACwUC
-OsodagQLAwIBAAoJEIs6YB8IyXXlajkAoL2wNKsEorxLhZQAPRNa8kcv5uaCAKCc
-KvWB5TIgPvXc9KIyu7YwfYiLg7QeSmltIEphZ2llbHNraSA8amltQGppbWphZy5j
-b20+iFwEExECABwFAj3P+LMCGwMECwcDAgMVAgMDFgIBAh4BAheAAAoJEIs6YB8I
-yXXlb3AAoOOU1s/F8PJAxYQwAQmlKxYUnZHdAJ9uIWY2w2UUMpTw45tkJ3xplawX
-Y7kCDQQ3FJfVEAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bxbrlLOCDaAadWoxTp
-j0BV89AHxstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJPPT2N286Z4VeSWc39
-uK50T8X8dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrUGvC/RgBYK+X0iP1Y
-TknbzSC0neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVbGI2Ou1WMuF040zT9
-fBdXQ6MdGGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcpesqVDNmWn6vQClCb
-AkbTCD1mpF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAggAhIc3ERhHN8t/+GDWhvPR
-ZrSEaRVOc6GmccQ65lIktR3YahcpL/KM2k8o3yJgroavIugxteaBrncT5muxMrAn
-AP6pkBAVa1xStg2ExVt1Jz8qohPNtqZaNHeObtXLCsz7xqR2FRguBzhCgoIUcv+e
-Jx9H7Cld1UpSFwIURtyyLLcwLbJa0mBC1tS6L+dxivmGaUQyU2ywMYyGAfJBGIYk
-GMx5v3GwXkaYxvQaaAUIeeHTTo9tglPBwuCr2Upw3CwM5g8q0BVxX337ybUO/hx9
-oiFijBTo6UR4dmSuroSW9N2KP7/mnZirNR0hBXVeVSVApKspoSk9Dolp15jR6kFH
-5YhGBBgRAgAGBQI3FJfVAAoJEIs6YB8IyXXlME4AniogMeV3YLNf6C1Y2+k8F3rt
-0S/OAKDHF+wfxLDzCxsoQbwesIUAKgb7Hg==
-=5VyJ
------END PGP PUBLIC KEY BLOCK-----
-
-Type Bits/KeyID    Date       User ID
-pub  2048/DD919C31 1996/12/24 sameer@c2.net
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 2.6.3ia
-
-mQENAzK/QZIAAAEIALrsEjuGlt6wkHy8fx2wPSkH7paAqJHDCbO1W/GMVs41BsH1
-xpyBi9lOtUXHsDC8Obx/TES4/xVPSsFKPQLa9Q/OsxjXmEPBvQ5PZdOXJ5zmRMI1
-1cfUp2s8w6i+IS68IWRKdPMshGWFGar1YUPM1UpVME7U+uGD3wgdC4DrVJHzS5Eh
-gEDyQ9FPb+8CpsRO3AvUPzsZGG8Iy/9GiLzmaJG34zZ5fv5X7sr89xiWJ21ehk+X
-ePO9kvq+nzfOCCK6a3GZD4g3KJX/Pm3oKeaXeL8WSCCPzpNbtRJk3ofeN7Zm1K0L
-yChPiyui+OO063/WASv52bxUIlmzbX82a92RnDEABRG0DXNhbWVlckBjMi5uZXSJ
-ARUDBRAyv0GTbX82a92RnDEBAfqVB/9GSzADIVqY0faFOLN6+E3qqg3hPRLBvjgC
-5cvTlwT7W64zI+aiSZuN+xAXq+3lnKtmzn45F3hD7gBxRPJbSKsObn2zU4UcqW/o
-qoiYEnO9EhoBomwPUbVy8C00CWvDLfeF4L5r+2oXgilTsCojSaWJX0QoPCwRQao1
-YwZ6CqAA78vdbBNkmA0WrPsVqwd3ijgFapcX671AqiT+pDbvK646I6uGPXJzN3ZU
-vFuDim9D2uNk9CfvPhKGscr4qqP40TnNn5fjSsmrFyFxYsdwo7I4TFpnsEPOw226
-GU+TR7zdwnByP72AxPEBJ/F22LwNyreuph+fRpWCnCf+9gVW9Heh
-=jS5Z
------END PGP PUBLIC KEY BLOCK-----
-
- ===========================
-Rob Hartill <robh@imdb.com>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 2.6.2
-
-mQCNAzG6VfMAAAEEAOvtvphFG/D02vGLENBl5OVPgEJgP9E1xhUgKTZnJstv30kD
-h1IqeIBkEAy5bpKapCbvvxukyQErhB0efTi2v5yTAlz5pVjgWM5Sa8CyTXJmXPHH
-EuOfy1DqaiQSmZ6KWX0ygw3gKDZMiNMf06UURLLYtRlGKSYY3WVj2u2UCmS9AAUR
-tB5Sb2JlcnQgSGFydGlsbCA8cm9iaEBpbWRiLmNvbT6JAJUDBRAx5eIAZWPa7ZQK
-ZL0BAU2XBACXfopMzC8kW3KEqq+N9W9fkGNgy//8XqQ77FmfPQPbO4X7Zn3cyO46
-MxvPP+92zSyN3dyj/xWZYoRLwll+ync9d4KUFwKw45DALAvz1CKHMOpQPD7dIWdE
-9poJQrcbKeOqLcGZTu/hY90gWBUZ++9umR8X8lyh/WEgcUolfgYHew==
-=upYh
------END PGP PUBLIC KEY BLOCK-----
-
-Type Bits/KeyID    Date       User ID
-pub  1024/631B5749 1996/06/21 Randy Terbush <randy@zyzzyva.com>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 2.6.3
-
-mQCNAzHLBS8AAAEEANGFXb9o0NPVfVjSLvQh1j3fN6cMeVNA5BGUJ6HZGP/NDxTE
-i8hwejJqakkU4ux/g6Kqckrx3h8WR7OXZZ+R8CsA0bg9Sr42ndEQCUISgArg+lXZ
-gRUniARPPA7tamTSq8v1mnxqy9s26Ht2rAG2D6IiK/7v0JlezKirDeBjG1dJAAUR
-tCFSYW5keSBUZXJidXNoIDxyYW5keUB6eXp6eXZhLmNvbT6JAJUDBRAxywUwqKsN
-4GMbV0kBAegnA/sH63WyfwMFmn3nWe8T/5IXO/QkMYoMGLS1i7IxMY9O8BVvKQM+
-oxEcJdFAG7zPZkpgKzTBxmExz5hMZ9hwJ42XhrslWoP7JVvADJcdthrUAYW9W+jx
-GcDYAW3qW5DpKsQchfvXq9QOBDxP+Kbbe2B8xGEyGUhLkacISFTrIhhQSg==
-=8P8s
------END PGP PUBLIC KEY BLOCK-----
-
-Type bits      keyID      Date       User ID
-RSA  1024      0x49A563D9 1997/02/24 Mark Cox <mark@awe.com>
-                                     Mark Cox <mjc@apache.org>
-                                     Mark Cox <mjc@redhat.com>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: PGP 6.5.8
-
-mQCNAzMRY/IAAAEEAOloTOU0f4w7FDRMM6kA/6XazXxJ/HH8dsmb6E7RuYfVlXsd
-kCwxUBOkyW+AYhkHbYUwnB5qBoFUyLrbLGuwKHW1KnAwgbeZLTH5nqQLpA0RLGVZ
-v3tzImKUdyyxBphZWC4IeEgUbl9cc+piOsEJ8QzF7gnqwWo/Ku6tTP1JpWPZAAUR
-tBdNYXJrIENveCA8bWFya0Bhd2UuY29tPokAlQMFEDQvYTHurUz9SaVj2QEB/hMD
-/ix6pAa+4ZgFQNRAc7fC+I4uGWvXoI8N8wtgiJi//8Kc1vjtvTylLPKVBDsy1ihs
-bVOjD3NUEkH95TNI3QhVeCwJPl2e3GgFl253hj8Jai9snHj75pXjQXq0NxQ/JRSr
-EAqrFM7+yRLPs7zDwsMoc2Ox5emq4joVa3syZUEwW7LxiQEVAwUQNLELtdZUWxzP
-wQD1AQFWIQf/RtyM8Rw01RdQXH5fA2jLaQlwD/VG1dlxqAcLKVQIKR77iBPdfcrW
-LyexGgQmltuVTGs5U1XPf7dff21NP79aglvD9hll82L5wZQybNpy2o6/66EPp4OW
-F1/WG7JhuCRfy53H983ERZnqGD4YeBafLHI9oGAixZ9G/+cFsxPde3Lv7Ij/1Hwp
-eNAHJQibBkpdq29Kye/+PHgE0HTMSapYXN/YVTCpEFzE46YnD/BjzZ/E1UClvcsW
-ZVoqPR46HARVQNu+MfoR/WSBAOj65Dt5oBZTcLoQ7TyDcd4gvLhdzLUo+kboGTjt
-HLvesaAWKLSWtKY6G8Iy7R5+Ms0helLFaIkARgQQEQIABgUCOG/pBQAKCRAXWVXO
-Q77mqABMAKCgO+LVARom7t/XmRw4w4TO9IkM9gCgh2URPU7tqECsr+WuVfC/v/7e
-vVWJAD8DBRA02GubUX4eqU/cq8ERAgUbAKCO913wXBCqiBfQBT5F6koRZRRvbQCf
-fJ+Y14jFEx+cfCdDIUjjD0l4/diJAEYEEBECAAYFAjvQk5wACgkQVZbdDOm/ZT0n
-TQCfdqn38SRRYeIG3+LIPqBdODr39JwAmgOH2/N2hjA2Z/4QMOjrQ4gIgpAPiQBG
-BBARAgAGBQI7zAqEAAoJEKFQ/C2FqPeL7C8AnRr7d0vN+E1W218XjItFonLw42qT
-AJ4xUrPsSduizUQnOuzdR8x2x4yEyIkARgQQEQIABgUCOjcVtAAKCRDe3YS5RDds
-3Dz/AJ9UaB2vKuteTC+gm80f028DPbmCegCg3ZM1Rt2WMDS/wHW7nQJ/xnyg8PuJ
-AD8DBRA6ynJX/W+IxiHQpxsRAjd/AKCSXqSmTnrzlnpgYwMESQiKQxfOywCeNuUy
-0q65a+C/ayC7t6F6ih9+bcW0GU1hcmsgQ294IDxtamNAYXBhY2hlLm9yZz6JAJUD
-BRA54aHP7q1M/UmlY9kBASf1BACwKxBv5osTZpJIiKsdim/P2LHOtU91Ne8kxTdr
-78Q86cHSz8V0ExA/FWKkOPgEHAIncXItNH0t3pGtUbAcYuT830Y7OJgLZdEWszQc
-bsp72nlK0ceZ6SFRE/ouDlcnyaiou28l4JGlttqi08yO6LcX3sQD8wDaQhoUoCe9
-wg/eaokAlQMFEDrLUyUbCAxFJxmvNQEB3XgD/2M9X5cgqjItm4vH9CjkAEOvfYh0
-KjDTy9/WA0mVDcXvV9RZGMMnWmSKg1yDZp4A8lWEQkk6VxZEMwW1PTtsFlOAyEQT
-2QiRQtS6tFTj8X9aZ6a0PeYF5PyS20hvJzYXpbogkemBFtUDmsfXToSoO6Uz1E3q
-eTYYIMB01pImXvdpiQBGBBARAgAGBQI70JOfAAoJEFWW3Qzpv2U9XQYAmwfOqWaT
-wJFN0bz/9PLlxJRO0J+ZAKCHUML3L2N1yqR0CXTO2C40fDjsMokAPwMFEDrKcnL9
-b4jGIdCnGxECMsMAoPGRixfMANAdwK0OwFjayMH0GV0PAJ4kP7UxlR3DkU/5wTOZ
-dGL/zRRHJrQZTWFyayBDb3ggPG1qY0ByZWRoYXQuY29tPokAlQMFEDnhofnurUz9
-SaVj2QEBJxcD/017e1bFJGNcISL2dIvINhnXnzHxL6B66exG+8+1pFkR8e/EvgEv
-XHMs2+AqDfUxkb1PNSoq/u/m/VpJGEWoObuSkiwiqUYrmXcJGElUQyHMLDKSLQQh
-G4PkeSp0T2yX+Fk+5F3vIOdK53jsD21zXqB5QD7TjCLSGkU+BiLuLGX6iQBGBBAR
-AgAGBQI70JOfAAoJEFWW3Qzpv2U9p6kAn3lo65wMqy/XbG+RgeJlrQQk0v5tAJ9e
-zLVU5oVtfnH6JvAZFvi8sudRhokARgQQEQIABgUCO8wKigAKCRChUPwthaj3i4gq
-AKC67ZkCrpAZWQKPJdwTw6zn6GsyVwCfQyoy5lGIuGBu0je6You3NEakk36JAD8D
-BRA6ynJ4/W+IxiHQpxsRAsw3AKCqcCFo5uzU7XEom82HnvX7kSPDtACeIqOnzHMb
-ArpmDAcknLxcmsjp2J4=
-=WGLR
------END PGP PUBLIC KEY BLOCK-----
-
-Type Bits/KeyID    Date       User ID
-pub  1024/2F90A69D 1997/02/24 Paul Sutton <paul@ukweb.com>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 2.6.3ia
-
-mQCNAzMRsB0AAAEEAKj2XYYEGcZhT69x4gskQ3xz+KMTLn7gKSqqcyyeinJ0ZjLl
-6AJjb1/68nGsF+IIY+IJS+5smq8do1qpC3UZcmw423Sg8F71GeqDO4HZXOAOieVy
-rpVs6S5TaXlJOcrC7zZCx+iql97+xJFjUGkkS7j/jIkx1AajzMNkSr0vkKadAAUR
-tBxQYXVsIFN1dHRvbiA8cGF1bEB1a3dlYi5jb20+iQCVAwUQMxGwHcNkSr0vkKad
-AQGrigP9F43zbiOigYel+JCMiB0HK/UdqSrf3xWxHIKWKNhQNjhnyeF+jKQwFld6
-7KQYsqZIpHsWLWmSk0AmKQOUIw+DxclDxBL2dT4p+CjgTgIAcbvPpahWkBAw/E+c
-EGTiYbe+Y3sHJhhP+d0TOLmsETG9tpi7gFZ6FfNcWPxFMdxGrf4=
-=0jQW
------END PGP PUBLIC KEY BLOCK-----
-
-Type bits/keyID    Date       User ID
-pub  1024/BA20321D 1997/06/05 Chuck Murcko <chuck@topsail.org>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 2.6.2
-
-mQCNAzOW7moAAAEEAMYZlNOxWCjLR/PosadbG+xsrB2unid2LiYoakTFiDIBaZjx
-bu6hNmVZPYfKOXQcqrCu0EY3uVLP/L89bST5pfIZOzz8GTm33zrETgfzpXYyFdbX
-eZ5vc6aa3+7zmI7h/aU567P9ruB2C/RBLl1A59wmPRRVvjEIAkI4bAO6IDIdAAUR
-tCBDaHVjayBNdXJja28gPGNodWNrQHRvcHNhaWwub3JnPg==
-=vUdL
------END PGP PUBLIC KEY BLOCK-----
-
-Type Bits/KeyID    Date       User ID
-pub  1024/26BB437D 1997/04/28 Ralf S. Engelschall <rse@engelschall.com>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 2.6.3ia
-
-mQCNAzNko/QAAAEEANZ2kpN/oMkz4tqzxvKPZws/XwsD0Y+E5/y7P2DIw4uHS/4N
-syQbgkdrZhPBlXDv68DQioHXWsb904qyr7iZB1LC5ItK9MgqlK+Z2mvPqsGbHM8J
-+oYib8kf2zJ6HvrYrP7NYB0tN9YYum2ICtx+hIi6aKGXdB1ATA5erwYmu0N9AAUR
-tClSYWxmIFMuIEVuZ2Vsc2NoYWxsIDxyc2VAZW5nZWxzY2hhbGwuY29tPokAlQMF
-EDNko/QOXq8GJrtDfQEBKVoD/2K/+4pcwhxok+FkuLwC5Pnuh/1oeOYHiKYwx0Z3
-p09RLvDtNldr6VD+aL9JltxdPTARzZ8M50UqoF9jMr25GifheFYhilww41OVZA3e
-cLXlLgda1+t0vWs3Eg/i2b0arQQDaIq7PeRdjdEDgwnG4xBaqaAqfgxwOXJ+LPWF
-hiXZ
-=K7lL
------END PGP PUBLIC KEY BLOCK-----
-
-Type bits/keyID    Date       User ID
-pub  1024/45B91DF1 1996/03/02 Doug MacEachern <dougm@osf.org>      
-                                                            
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 2.6.2
-
-mQCNAzE4lesAAAEEAKJYS1vL2iB3owwiZdCxp3JyvSNaC7h1p2jQXcJvY10gqyZm
-VffDwFoSvJM1JdCx3o1mb3JpZ2OTV4SrDDkzcSpTXelgyh7k9O3HB7oG6pHTML9g
-Dq9ZKydShMIvIJos7KuLWoM/eeeejtkv7r/gWsGHAyKbT8fs3r7nlmxFuR3xAAUX
-tB9Eb3VnIE1hY0VhY2hlcm4gPGRvdWdtQG9zZi5vcmc+
-=yaR9
------END PGP PUBLIC KEY BLOCK-----
-
-Type Bits/KeyID    Date       User ID
-pub  1023/163751F5 1997/08/18 Dean Gaudet <dgaudet@arctic.org>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 2.6.3a
-
-mQCNAzP30QgAAAED/1k8hPKsJj8Il/TfhP1JIRGwnXuzfQ/etv+MZJMzeNeKa8OX
-Kw0d4e1S/KdJ+AZwWQp3ZMDoX2ghZ79X4DDDLEAc/Fmy0Gg8t89CP+xJk7b4EHjk
-F7HX69BRJp3On4aRTXRND3WviqEmn5ppzbBkTenF9WWudLRbqrc4NnoWN1H1AAUR
-tCBEZWFuIEdhdWRldCA8ZGdhdWRldEBhcmN0aWMub3JnPokAlQMFEDP30Qm3ODZ6
-FjdR9QEB9VQD/0+zumFj1zzYZ1+bS9Az36gijDUb8rlEVf/lBShx4VEvha8fsRRy
-vkwnmJyupYvGtrSIYAwB0VK+GZPZa7XfZvUCM83AZY9vGpE0LwW2Vcz9kWZdJ0t+
-B7zJElmBUrmj9aW6ICmSNbOBwVo1Y7hg6lPSFFMOOECFpT1WuTXXYpNA
-=KWcF
------END PGP PUBLIC KEY BLOCK-----
-
-
-pub  1024R/EE65E321 1998-10-22 Martin Kraemer <martin at apache.org>
-sig         BB1D9F6D 1998-11-09   ct magazine CERTIFICATE <pgpCA at ct.heise.de>
-sig         E2449019 1998-10-22   Martin Kraemer <Martin.Kraemer at Fujitsu-Siemens.com>
-sig         EE65E321 1998-10-22   Martin Kraemer <martin at apache.org>
-sig         43BEE6A8 2000-01-03   Michael Cook <MBCook at MBCook.com>
-sig         49A563D9 2001-04-04   Mark Cox <mjc at redhat.com>
-sig         F88341D9 2001-11-18   Lars Eilebrecht <lars at eilebrecht.org>
-sig         4F09F055 2003-04-21   Daniel Schemmel <daniel at schemmel-ac.de>
-sig 3       CC78C893 2003-11-18   Rich Bowen <rbowen at rcbowen.com>
-sig         D20BA2ED 2001-06-03   ruf at tik <ruf at tik.ee.ethz.ch>
-sig 2       F43C2F92 2002-11-25   Bruno Lustosa <bruno at lustosa.net>
-rev         30B94B5C 2002-12-28   imacat (¨Ìº¿¿ß) <imacat at mail.imacat.idv.tw>
-sig 3       3BAA3AE0 2003-11-18   Rasmus Lerdorf <rasmus at lerdorf.com>
-sig 2       4C9165B6 2003-11-18   Aaron Mulder <ammulder at alumni.princeton.edu>
-sig 3       88C3A5A5 2003-11-18   Philippe M. Chiasson (http://perl.apache.org/) <gozer at apache.org>
-sig         84F9264F 2003-04-21   Harno <ask me>
-sig 3       30B94B5C 2002-10-09   imacat (¨Ìº¿¿ß) <imacat at mail.imacat.idv.tw>
-sig 3       A54DA2DF 2003-11-18   Erin Mulder <meara at alumni.princeton.edu>
-sig 2       A1D69759 2003-11-24   Michael Kellen <idsfa at visi.com>
-sig         152924AF 2003-11-22   Sander Temme <sander at temme.net>
-sig         964F31D9 2003-11-22   [User-ID nicht gefunden]
-sig 3       76D83CC6 2003-11-22   Manoj Kasichainula <manoj at apache.org>
-sig 3       CE19D5C6 2003-11-18   Jamie Wallingford (legobuff) <jamie at legobuff.com>
-sig 3       F5FC4B42 2003-11-21   Theodore W. Leung <twl at sauria.com>
-sig         FD093C41 2003-11-23   James M. Turner <turner at blackbear.com>
-sig 3       A11D56FB 2003-11-25   Geoffrey Young (http://www.modperlcookbook.org/~geoff/) <geoff at modperlcookbook.org>
-sig 2       65FDCDEE 2003-11-23   James Howison <james at freelancepropaganda.com>
-sig         40581837 2003-11-27   Nick Kew <nick at webthing.com>
-sig 3       D147B776 2003-11-28   Mitch Comstock (RAID) <mcomstock at raidworks.com>
-sig 3       142B509B 2003-11-28   Glenn L. Nielsen <glenn at mail.more.net>
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.2.3 (FreeBSD)
-
-mQCNAzYvawcAAAEEAO/lLOQVYsUS+l7yan+Rzr0ehfWRqlgeNsV4DQ0xTuQewD9K
-5lm7ujRwutxlNaf5dXjE24mlsiRN8KDp+fKwm7Wtqv490xmhzS/6y8ekwB02P4fi
-/JJNX1PbLS0cL6+bz2dFqLDhh03Ovz3G16Y9he5mrJ2PNOWa9Dfj9F/uZeMhAAUR
-tCJNYXJ0aW4gS3JhZW1lciA8bWFydGluQGFwYWNoZS5vcmc+iQCVAwUQNkcAbUS4
-3da7HZ9tAQFUnAP+PrKa3YFKp9XTrANmORex4kOyNpM1adS8zM6bTcHyIkH4WitB
-b2nRbqOdOuSwbh655aSStluIxY66CValeL+6E7MCEqQ/UlzzMVmdbMyWSYwDlkV3
-gQkg3vE6bgFlWlLLr2HnkllY3ISEChDWh8x7fRKLy+8ZBGW89ZXOGkhIb9mJAJUD
-BRA2L2ueKwLDReJEkBkBAbeGBACKM1FCmQC583/IHyw7rDlvnsZKeKvdbbLGSnmJ
-NWOyf4VgkC8OCKmwPnWLOOIK44/JsT2Yonih2r+04FBqYo6SsMgBqOBJqKktHvtx
-bD3VfUUkkV8kZ4ituecWTx0zj1Oa0QiCiv8HHvdsmQB0mj07mWQz1CamXPSwHYn+
-t+fJOIkAlQMFEDYva2c34/Rf7mXjIQEBcNQEAOrt4+o2LwcCiJp3bOF9WZMirpMQ
-QJISqXBnom3r2eB+k1a/Jig1sePSzPxneW9EgWIrWg0EfK+u2kMgvTJynDUux9zL
-4qnECmZT+ESEm+P8rPKeecOfUHgDjQlTUCneOX5p0TbdvJm+TcJVjXjoVrYv6hZg
-InYw+jlvF5e/sdI8iEYEEBECAAYFAjhv6QUACgkQF1lVzkO+5qgJ7wCglwijjcMK
-mq7F50Yc1+rpktcbYqgAnivId+oJ9iwi/18y6Y6t5zxk53i8iQCVAwUQOsp2y+6t
-TP1JpWPZAQH6sAQA1jbAPT5GEWyV7gKNeAmWOBo5JA8+ETmtvDAIGg37wsNhNBQG
-kCP+pN9CuzREKCSOLgZ5KXYpLWsYLJz1X7ZztR2kFmBGPHspYBdJsrzmvydyODHC
-ZgN9Bh0/vmWWKPY3047pkZOIiQ5ldSqaXtmYMzzSVe2vC6VqKQUkZUCNQJ2JAJID
-BRA79yw8Po+38viDQdkBAVwVA+IDjCUtGZoWG2GUN7OoaABSZWqtQfetBL58G71h
-Umv6IhTq1IBm3FDTosZeh6IN+vcSlVvq67F+y9gRDWdsu5Sl2J9n9ZUDUymysQFQ
-++B65oZaJpS8pD09aWAt7CkvthkYD7UXpzQau7fq59XRxZiN+bDAHtSBf4TMi+On
-B4hGBBARAgAGBQI+pFcNAAoJEDGGzQRPCfBVmHMAoO48YN2ZQBVtGaKnYQZpqeka
-zsHvAKCumrigMBBhhUiZq5XLLohV9GU2bIhGBBMRAgAGBQI/uphrAAoJEFz9N/rM
-eMiTc/0AoIN7/2mNfxYll+7LYDVlWG/zWENzAJ9O5SzBY/v7nHJ6tuD+VETweIir
-BokAlQMFEDsaVtNoOT9M0gui7QEBGvAD/jHgMCvKihnRNm3k2+nDUTHFn6blxG6k
-jRtL1DJGQD5cATbhxMx9ioQtD1q87KCj54pcGQ8HbTL8frQbyPX6yFjpSPILIPCX
-WF6NVHZ9GCi3SOo39HNFxCQZUpVof49gmGOgL/qwfu7mi/sBEJP7c3FeyFnvewYE
-2a9SBhZUWdb2iEYEEhECAAYFAj3iUNoACgkQiNfNvfQ8L5L+qwCfdgPwwfKJxDGH
-7S+8llIfUtQAsRMAoI4J55ch47lhayilgtr/MzqoS8k/iEkEMBECAAkFAj4NNagC
-HQAACgkQi9gubzC5S1yB4QCggBPo0gnQXYxXXovq++XB06XkyE8AnAr8Z8v89p/x
-Z5f8Jhv3+arjeJQtiEYEExECAAYFAj+6g54ACgkQlxayKTuqOuDBXgCdE6UopS7i
-xaU0PlutyqcEE6HLlaMAn3tjDl+8GTNjFa3i/yI9VGssa2L+iEYEEhECAAYFAj+5
-3/cACgkQuSRSrEyRZbaJrwCeOVTRdXKeHI8NZGbEKIpBSD2942IAn2jD5cP1e6iZ
-QBp/KcxFSs1BPGzLiEYEExECAAYFAj+5wvYACgkQyzKhB4jDpaX2cQCfSx4yFkoJ
-vJEmA6faBkggxB8cRLkAn0t1PJ2ujChDobTDZyQTGbHaH6RRiQIVAwUQPqRYgc1j
-0d2E+SZPAQJy5BAAiC9vzladIopS40igR8djtOq7qc0h9JqTXN1NXl6sbLPyh8VG
-Ty6CLRTcqw3dvKoj7WSW1ICGOAw1N6UE8g6ErpEcJ7UhZ6JWYcHDAcS7rWNYnPqE
-g4Vz2yprdzJYo38ACD3o81O7ko+KvwFsT+PYquZsc2OsjWH9GNwBGiSugyEJA3nk
-N9S7YMmJ5LriOofMze1fl8wnaoCx55RliOIYe7T5l65hokvQ7u2AT/z/Wca/qSuI
-iz7bNznLyyUT15OILl/WgXtDyhh1dL0C3K0dDxkbCmUB1DoT5Qp03w7fleT8diOh
-Squk9181iUKI85teeGkIMzPff8Th7liyxFFiFse8Q+xbtvN+3/jtnK59ArCpc6uS
-xWBdwoE66Unf63mmiGvEbkgoZ+aAsxm5LkP3v7VHHUJOtESfijLq3QSv2vrobxDH
-ejLgtMU9MQbPLV8s2mcRWeLrMJuFNRRNSEfJLEhG7FtvX8RzEz5kkgaHgSdyJ6Ht
-DHo5MNIl9WkY/oFrh+jo+8j8eh1i81pZyAxPd+FRsDiyGTBtNJLQoARJV+YAY3D0
-Xa5Gmd4p2X2M47koDgHeA5HOpmfB0wuQOYDNnILdhIuHVB1GRcicJGMVx7DOXVJa
-5hoTbHoIz0XlpLsafMIQym/K3x6sP3MybzefD83MaJ+Ilat+T3FxctedvHmIRgQT
-EQIABgUCPaREVQAKCRCL2C5vMLlLXNEgAJ4iYCTPB23/Flm7qNroUl6GVX28CQCf
-RrordYeSP+K7QSxk4IL8PAEbSJOIRgQTEQIABgUCP7mlEwAKCRAQ+kyIpU2i37G6
-AJ4n3x4exHlJaJ0b0aplo7IhezqhzACgmZyzlypniz1CgWFKayMzNdYv5uGIRgQS
-EQIABgUCP8FT2wAKCRDMITAgodaXWVUxAJ91OzkZlLqXZRx40R7Gw5AxUq0fAACf
-ZUrGzdZMoFh4VLmXs9UwjPIkqQ+IRgQQEQIABgUCP7+tkwAKCRCyvrxAFSkkr6ju
-AKDwXK9W+Khm1OACepHiwBjqhs0g0gCfVZCH8N3c9BWUNzvdWl1SY/5v7iuIRgQQ
-EQIABgUCP7+twQAKCRDBHntHlk8x2Z+aAJ9+DwDEdvuehFeJsocl75danlHX9wCf
-SmZLWzDCnXESPG+Nt0zKlOB8VQeJARwEEwECAAYFAj+/yA8ACgkQBurPqnbYPMbk
-bgf/bwdAlRX30Ys7o8Yw0KjnyurkboF5jgGveYQ6ycT7cqOnrT6/68QvNtx9v1Vl
-AqXGbo+vW3N0vPKmyoOk+vVDTjnzOcF56i9fzkRg4kUT0NuDdYS12Ducg7V2bHoB
-oDYErKCPhAMpHlIXH82Y2KjtlJ42QXbjM2PHhp4jRVrVaGEDzpKMJ4J8vy9RsQP6
-VhIBlIkJfEQyAcRzrQPMXTL43q2nSej40OPfwPttPViF4AZcI0WjXSrSUl1TDei1
-2vxatJVQU+5pAnXqNptS5z0CRzew9FbmUtRASf4I6KbUFAEHoactAmSqO+nVQwya
-t8B4F5cVdI61GbAIltn3dJeSY4hGBBMRAgAGBQI/uavWAAoJEKge5knOGdXGNJ0A
-n1fgKsQjBZ9IInHEgxfXuBFBmWYuAKCwL4eokLlqwfoKISp9nb+Q0cVaWIhGBBMR
-AgAGBQI/vdF+AAoJEL66K4f1/EtCFcIAoLso4QP/YJF3MvQb0UD0KgixM5IWAJ91
-gPVA+HGquzcbvBRsuWSbXW/6xIhGBBARAgAGBQI/wSPnAAoJEBoJ0YP9CTxBwBoA
-oLQl8sQPadNHQxlEOE9VDvTHKd0OAKClJufnKrR+QqWdyLj3oWdaPNxlH4hGBBMR
-AgAGBQI/wq8yAAoJEAlaRdyhHVb78VwAn3T3DlfLsALf1p2Fmb8M4AjSm4qrAKDI
-/71tcIrH9SOXnaEUYdn/drhRcohGBBIRAgAGBQI/v/ykAAoJEOyZPWNl/c3u+yYA
-n2DGGUr3635ok+rBGpKTNQShReckAJ9MZN+4nDJUbXdM+mF+yMEIxtKkEohGBBAR
-AgAGBQI/xiDTAAoJEG0LxzpAWBg3tp8An1L06fIxRRms2VFp+jJmEcBz8xGaAKCK
-ff6vbVmqxbVQGcAhd3kQGMOTjYhGBBMRAgAGBQI/x9hmAAoJEKR0DznRR7d26TAA
-nRdPRJLDgffciI89IDzxI/OSOFJxAKCG3SDpdF3M2VpRJUdb088MsOk0BYhGBBMR
-AgAGBQI/x2/kAAoJEPo8jSYUK1Cbb6AAnROPVUmurToM36vGQ6UBUzFtb00+AJwI
-EGe6WyTrfx947xo6gB8GL5A0fpkAbQM0SmQyAAABAwDjeySbW44+mRRLLW0Eteh3
-fwT5cHW3MzBmkNDIt14374uQ6uPi3/G7YW/GFrvKcSG/upLZn81poLIVsMTTWM2m
-P4qoB+9s5YGEhuHWKKMwuMo+Zzr9QXOcUOvXcv3lNNEABRG0Ik1hcnRpbiBLcmFl
-bWVyIDxtYXJ0aW5AYXBhY2hlLm9yZz6JAHUDBRA2L2c/UOvXcv3lNNEBAYdFAwCS
-+ei8zQhw/82vG2n7cpU3PoIMNW1Pg1ipJ3Y74hwmj8AWzK5X7BJ3VRS5Y4TOZeG4
-AVIaUwUBvrTz4fRqNbgC9oo6nF7wLKYnGNmUpAGZQscXRT9hkmFSqk6F5pUbI/aJ
-AHUDBRA2L2b/NirXWI85Tj0BAYF6Av4zz/Q5QPvtiEzAJuPKObKSJp0EdA4Ga0JO
-cr751xRNKlAqNwnGxY3MUTupLW3IDQ3CJk1bpxWJr7q9ufv5g/yZJqCTSvRNw3+J
-ePJaWw9N/OGT1SmKvXBx9aApv0/ZXAuJAJUDBRA6n1qpKwLDReJEkBkBAc3wA/9Z
-/ZnF0QkP71AeqPes3FXvYsUH3d8uIBSz+KJoQa/SvB573sW1C50i+JEWnVe8fAQs
-wQQ+F8q/kJal+eqJvap6+ro3KRG1CGa28acuRzHchSmG6GJpUqOXrFfo4sbFCEXI
-s2Wmwho7d7AtnrN8lsfqYmaz1Uc/yl+wHJUJUIubCw==
-=Pz1L
------END PGP PUBLIC KEY BLOCK-----
-Type bits      keyID      Date       User ID
-RSA   768      0xFDE534D1 1997/10/19 Martin Kraemer <martin@apache.org>
-sig            0xFDE534D1             Martin Kraemer <martin@apache.org>
-sig            0xE2449019             Martin Kraemer <Martin.Kraemer@Fujitsu-Siemens.com>
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 2.6.3ia
-
-mQBtAzRKZDIAAAEDAON7JJtbjj6ZFEstbQS16Hd/BPlwdbczMGaQ0Mi3Xjfvi5Dq
-4+Lf8bthb8YWu8pxIb+6ktmfzWmgshWwxNNYzaY/iqgH72zlgYSG4dYoozC4yj5n
-Ov1Bc5xQ69dy/eU00QAFEbQiTWFydGluIEtyYWVtZXIgPG1hcnRpbkBhcGFjaGUu
-b3JnPokAlQMFEDqfWqkrAsNF4kSQGQEBzfAD/1n9mcXRCQ/vUB6o96zcVe9ixQfd
-3y4gFLP4omhBr9K8HnvexbULnSL4kRadV7x8BCzBBD4Xyr+QlqX56om9qnr6ujcp
-EbUIZrbxpy5HMdyFKYboYmlSo5esV+jixsUIRcizZabCGjt3sC2es3yWx+piZrPV
-Rz/KX7AclQlQi5sLiQB1AwUQNi9nP1Dr13L95TTRAQGHRQMAkvnovM0IcP/Nrxtp
-+3KVNz6CDDVtT4NYqSd2O+IcJo/AFsyuV+wSd1UUuWOEzmXhuAFSGlMFAb608+H0
-ajW4AvaKOpxe8CymJxjZlKQBmULHF0U/YZJhUqpOheaVGyP2iQB1AwUQNi9m/zYq
-11iPOU49AQGBegL+M8/0OUD77YhMwCbjyjmykiadBHQOBmtCTnK++dcUTSpQKjcJ
-xsWNzFE7qS1tyA0NwiZNW6cVia+6vbn7+YP8mSagk0r0TcN/iXjyWlsPTfzhk9Up
-ir1wcfWgKb9P2VwL
-=ZxgG
------END PGP PUBLIC KEY BLOCK-----
-
-
-Type Bits/KeyID    Date       User ID
-pub  1024/EC140B81 1997/04/10 Dirk-Willem van Gulik <dirkx@webweaving.org>
-                              Dirk-Willem van Gulik <Dirk.vanGulik@jrc.it>
-                              Dirk-Willem van Gulik <dirkx@webweaving.nl>
-                              Dirk-Willem van Gulik <dirkx@dds.nl>
-                              Dirk-Willem van Gulik <dirkx@bigfoot.com>
-                              Dirk-Willem van Gulik <dirkx@technologist.com>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 2.6.3i
-
-mQCNAzNNOsMAAAEEAJmwazRhNJB4mQkvp0rrxLkeOAxR9fGBXgJNa6HHdLv7YHwx
-mwMorHYDCAMypO1yuznNTaMVT1z3cS+yqhOkTVxwNI1mxW6Zts1kOJB9pWuU33sk
-sUuCkLHXMgyvP9cms6gcYgB5g3UP6M/aQ4T017+Gk/7crlH87DGmPZbsFAuBAAUR
-tCxEaXJrLVdpbGxlbSB2YW4gR3VsaWsgPGRpcmt4QHdlYndlYXZpbmcub3JnPokA
-lQMFEDRZ5+0xpj2W7BQLgQEB/KAD/1xniFNLHp+jxIVrEL6HcI06QZUYPvRuarWq
-3aI2gdeXej59Ry96MOo2MU3MsuQ+wW+6gEJAuyCp2jyYfzF/8winNcFWc738s/hX
-fRYCJe4bvtMcnhBV7GAlTgyw00fcrnaJaQ811+QwKnZvXXWb+QuoXC4ddTon25w4
-XHLjtDZHtCxEaXJrLVdpbGxlbSB2YW4gR3VsaWsgPERpcmsudmFuR3VsaWtAanJj
-Lml0PokAlQMFEDNNOsMxpj2W7BQLgQEBzW8EAItAEaeuIzPIVlKOk1LnHlYc4FyW
-aiNJC2+rRmftYu2bIp/JFuXu3xC0U0byyHu0p+Y1pcAnt2YrqmYUfM0d2cx1b4+L
-8RQR4SGKhq9jWKS3icfKoyMnGiD2CeI8/Xx8V6b8Xg0QqsdlS0kz//qGCDWMz0vi
-oxzasVEvFjqAse03tCtEaXJrLVdpbGxlbSB2YW4gR3VsaWsgPGRpcmt4QHdlYndl
-YXZpbmcubmw+iQCVAwUQNFnn1DGmPZbsFAuBAQE0vAP/aOb/rXsE256tpi0+CRp6
-cd9b1oBmw894UK+Cf4DeNHWehPWJog4y0eNFUcAMdLIdubDzc6Kfxw5QyJt2EAXr
-05XuJ2DJdG24S/aPzGq+6VzL7Nq7pylXuhrACTgeesaceEpUd/NeOCOyzNR7i8qM
-zbGFtU7fH1ipfJjN6fXLo5K0JERpcmstV2lsbGVtIHZhbiBHdWxpayA8ZGlya3hA
-ZGRzLm5sPokAlQMFEDRZ58Expj2W7BQLgQEBGRwD/jdUjCJXFcAbjx3Y2pWUkR7C
-hwJTohM2TvhFp80Ffbhh1xT961XGuHL5l41fRAIg9FEHjQKNVfXeisLH68Qh73cF
-5xuNE6c1x1VSqfDLl9fXZ6TA35qt0G599T67jmVai4F/LjHWDI1O6UvPRuZE3O7m
-eRaCfbPLAJ1ztFujtS3btClEaXJrLVdpbGxlbSB2YW4gR3VsaWsgPGRpcmt4QGJp
-Z2Zvb3QuY29tPokAlQMFEDRZ56Qxpj2W7BQLgQEBvOED/1LhhPP5OkeCCEMVnmyZ
-jZexzv6XOH2I5qH0iuozsI987sSK+zfv8O0wEBwjUOQqBuzlvjKImYQ/oqR89egQ
-AinPc4z1b3kgeGyqrmtea6ScmpKufcWUBbhH0qsXF41eU3ArKY4kB9znV+/PacCe
-VrOD8roFaxIDZ2nW9FS0mriOtC5EaXJrLVdpbGxlbSB2YW4gR3VsaWsgPGRpcmt4
-QHRlY2hub2xvZ2lzdC5jb20+iQCVAwUQNFnnjTGmPZbsFAuBAQEaHwP/Q2Rs6MIu
-z8all/xildFOPfRAX73InwBeInr1O4UU4l6yWRvuLkg+m6O8eJSHo21SNZBCu9gM
-FoQsd0jVOitUr8+w2WkypBlJo5wl1nCw/1sLU4AxtBb0jyADvJzxFCeje/FkxEvs
-6Y3eLxpJRBylbg6KFOsmSY46DyGc49B6cZo=
-=xUw/
------END PGP PUBLIC KEY BLOCK-----
-
-Type Bits KeyID      Created    Expires    Algorithm       Use
-sec+ 1024 0xF08E012A 1998-02-19 ---------- DSS             Sign & Encrypt
-sub  2048 0xD8F8125A 1998-02-19 ---------- Diffie-Hellman
-uid  Dean Gaudet <dgaudet@arctic.org>
-uid  Dean Gaudet <dgaudet-djg20@arctic.org>
-uid  Dean Gaudet <dgaudet@apache.org>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: PGPfreeware 5.0i for non-commercial use
-
-mQGiBDTsCJkRBADJmDUiJL0xUaxg0yw7+VqqFUL6sjWxZeZ7kQZs4dyN3R1ilBUG
-KmOXE6qSfb6Pi0qEmgCz1K7g1KaglMRrpANY4h1CjziEVmTH5s3ocxe77w2uaou1
-gHJERIqQuC4/z0DwFqq61ZVf5dUQTD8OmfOwG4pFs51Si9WS03ueVEFQFwCg/9Z2
-j6UzCLyUABpWeV1v4m0w82kEAK96GyKDcT20TymKJnMKuwya+ZwqrULH3Sdi2Mwi
-1GOH7aomG2fK4D2yxWx5xTiYhmYNnRoopgu/Kv5a4x43tOKS3zeADMnHIw9dMSn9
-4Kba8vfKbZnlOgt9veV+iWZv7N2aS2z7w/i53Y6LAlV1hAIMvGJ3zLfmShZs0LDI
-Ya18A/wNcdJazUk9mLGIoycCYOk5YhWL9sCaCBdmdfDPu++rLnqROSWkmfYkOTt+
-pG9SPnvv3XrX/SEwM8gYfpbZwrFDJFI9W63lc9hdSosFD+8xiRl6h2gKRwWvc1Ry
-xIt3+gUrZxovNxBOv98BoSf/j3lkldU+ZjDGlCplRHSndxlN/bQgRGVhbiBHYXVk
-ZXQgPGRnYXVkZXRAYXJjdGljLm9yZz6JAEsEEBECAAsFAjTsCJkECwMBAgAKCRB9
-bb/R8I4BKqqzAKDc/4H9iOXJxVE0yCEHeTQ2gAHfhgCg7VSq7eNhiJhBgblQav/R
-XOhaHj20JkRlYW4gR2F1ZGV0IDxkZ2F1ZGV0LWRqZzIwQGFyY3RpYy5vcmc+iQBL
-BBARAgALBQI07AjSBAsDAQIACgkQfW2/0fCOASoWOACfb+8OVvy6FCqN2MxdCqp6
-gffNbYgAoOxlTa4NjCUUO9dfLFFYpDfGrRy7tCBEZWFuIEdhdWRldCA8ZGdhdWRl
-dEBhcGFjaGUub3JnPokASwQQEQIACwUCNOwI/gQLAwECAAoJEH1tv9HwjgEqiC8A
-oJDu1HTuGOfChFSJJ31XvV8tnlo5AKCFceck4veIMP8pDC0f5UBGGC3mZLkCDQQ0
-7AiZEAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bxbrlLOCDaAadWoxTpj0BV89AH
-xstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJPPT2N286Z4VeSWc39uK50T8X8
-dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrUGvC/RgBYK+X0iP1YTknbzSC0
-neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVbGI2Ou1WMuF040zT9fBdXQ6Md
-GGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcpesqVDNmWn6vQClCbAkbTCD1m
-pF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAggAhb3cBmR67H4+9Rj4FeTwJ8kflX6I
-pp2AeXXZiffiPVBv5cGzGn2RkGPAZqbp2AkrCb4TrJH//1GPdR8VmPeEGsm6u0uT
-0M404l/4IW1FFQ4JBpTENPn4NYBHkKBNkPcls/ip0lSjlmLGVQVOtDOaFD7n44xV
-hT4WpptCripg/5kymDmK9c8hv6rPUvNoVrDdWR4//MCvNAZvGq2bZGdFTyd5Tn6D
-AmwbvL/UwgiDnm95qBBfCZtmGkkFaoOePtBevWFaviFZM2pErPRcjY8A/1cZsycj
-JPMFYqBKGDIk76ulDSjU0Q8dqhCEDf0o2oQEg6msjDtetVFEDw9yJe0AGIkAPwMF
-GDTsCJl9bb/R8I4BKhECBKgAoNRtRaRMdYNwajSO7056eKazCGSDAKDShamaRjAe
-ThQ1KefmJKyzfcosZQ==
-=25Cv
------END PGP PUBLIC KEY BLOCK-----
-
-
-Type Bits/KeyID    Date       User ID
-pub  999R/F88341D9 1994-11-08 Lars Eilebrecht <lars@hyperreal.org>
-uid                           Lars Eilebrecht <sfx@unix-ag.org>
-uid                           Lars Eilebrecht <lars@apache.org>
-uid                           Lars Eilebrecht <Lars.Eilebrecht@unix-ag.org>
-uid                           Lars Eilebrecht <SFX@unix-ag.uni-siegen.de>
-uid                           Lars Eilebrecht <lars@eilebrecht.net>
-uid                           Lars Eilebrecht <lars@eilebrecht.org>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.2.1 (GNU/Linux)
-
-mQCKAi6+wOsAAAED53PJgrIYS7iHbZn0ycrnzS03fwvwsDpoAVouoqqBSVNoVXH+
-lL+8HzX/fADvNyk1lYi5kTiYR2meKB1p0qpvj4bQ8ZEmcBemhV0FbESJ4CxIgy6V
-euxOD3v9gauyf1u4lkfyLIsCepuJqpkH+aOviE9VhTcE/D6Pt/L4g0HZAAURtCRM
-YXJzIEVpbGVicmVjaHQgPGxhcnNAaHlwZXJyZWFsLm9yZz6JAJUDBRA3pN73pBlG
-R0SoBbUBAahrA/9/Pyd+R/2vz0is/Tuu6aniMYb5O09OWypVtJ+1QB0Hr2pTB7MR
-Spb8ljpMTT+Mv+hE9RZm0lxwW6OgYbosrDCwpw39Tfs89UjFJMmCj+UyThmpt52k
-g3MkcRD7C7J0w+RVV+EPs67vLya3wKRRXKa5i3I1RlznleiJwxxGAgaxOokAlAMF
-EzeoM6P9LZCSqJB7JQEB9XYD9R+ZzFmtJuclCbKR7zZcB/5lqpbmuDRMStAaBIq7
-KZ019tbuyj8RGdc04UFBAVL31pwHl2hrBTsCw0ZsVudvRg1ufn9KwNQnmO4j9fbE
-fYJ1gNDgTaf0zMZ5KdKAhNtw0Wx8tAntvqjcxM//h4lSMn8HWiYlRqNFSxRT0nGT
-CxqJAJMDBRA3peHbT37mpPWwmrUBAXpIA+kBT2YJm3tep61cxMn64OlY+i/OOt05
-Of+fcJwPwD4q0hxXCeWMYSueDvavvJG4+42T1O8xLPCeR6cqe8PBtXlRbyY4b6cI
-mFRuOsFlqEtpXNmJ9AY2KIU8bhZBuzckS6oXGxbM40PiXsIwREib3J5OY6G4YG23
-8LpTheINpKmJAJUDBRA3nOBupMNFzIvCD00BAXGEA/98Rkn6Ncn9BgFUJlLskcsw
-Bn45IJhIJtLYIqyjSWZY9iGPU41txPPcqi2k2atn03ThUufQc4V1R6pnLZwijeoA
-pd3AuXv7o0wRj/zi9lrhpQpE5L/9YzJ+uGkHTMjMBSks74IR87QVebdMxSvFYBPK
-QbwAVohgOBdZyNYyiCn3SokBFQMFEDecWF2urbkCPI45bQEBc40IAJ7NUAL5a5Bh
-qUDf60pLZlYonowEbAnnkT+0pnp70JD1w4+bi1dSa/iboU4Kedf9tqGnPlC6LhN+
-uPWSyJcZ4AxkyhBPoezUdpKDYxezLbSlnsWPpjSHo2iYani7uSDFjppTq5vmmkPW
-lW2NuI9DvXtDS6UnHJa31CqvVl60vmuyQyceI75UK/Qe4kZRgfFQsLrCWpiw6fLu
-KB9NWm5wVt09ZN4U3Zo7eSNVZfSSqzkPKgXR21yD79Qs66PxjM+SH6PrbD6UEtkW
-llB42nzdiQ/8MGNCFLgnaYqUkLe58Y2oicWy7OxC+wWPxuvCW64TF8uGkDlF8ors
-J5DTX6c57HqJAJUDBRA3ovk3JBRJVbhWhOUBAWmRA/92NqJsbkEExxDNrAeQB5Y0
-draruR6h4BTWreJtFH4WitgnqOvU8ylveGLMLiv/cZKRmZuDaBncoQ+mdCMOeZNB
-qW0xGKS4nm+rTw7LlG0DjyO/fDTe8LXdQBxR5hDcm+ynfH/Q16x2Nov7DO9NBvkq
-vvp/nj2KzGH8wrgsHFzOkIkBFQIFEzeOINlR6m16P5LTsQEBE2cH/00BLuWwe/bX
-DqL9+qxsx+Ko53cuJj6ZLwc7UU/YKEW4/9q7EVG3slfbl4aPWWURH5XCpn0iDpKc
-fEvgsbGe6yEoxpDQkj2fTnU9z1B7aitb2u/a1NMhdgNBOHvU0p9dVlaanqsGG0zV
-KE2yxZOa5R7H27PESjK2vT0NxljuUV0zV65oQgb3zT8a1DNnpvbVcPskTSrPiecm
-p8B3sH0OdG9mCAEfO2QDLcg9+XDOH7M1BvH/x6eo3ccj4TUAIx0GCz3LsEenAxkw
-18Bgdu25jhBcjdgNj1yvEbD/+vc6iL3HkuPbDt2jtc25QVRNPYtMDPVOXCzRovAJ
-WOEMaLb74hiJAJUCBRA3jiC/xEaR6Lw5pc0BAZshBACeTZNGRkwDJC4BKFan90qG
-RCAxkzFCVxyFjetBqwkeFsWM4E1dKxPoObjR0lrsXt+IbxZ0xUQB6yquCyIWZvyl
-v4y77ZxBfklHQwOZimA1rinxgOsZozdAJY5OztaScc5fKEDmMGlbc8Kn0UL7k3+p
-FOF+XuMktL3ZUt9nyEbU0YkBFQMFEDeOS7Cec+sKTVjuUQEB4I0H/Aw3vqOo4y12
-XODHVnRiRcZ4fRunqF5KsqHdBuf3Bh8fH99iwlIV6rj7Rdod9OjE10ARCvoxiaYj
-Ev+DF88+xam77IkDks0IGU3ou+c2RjPI9h189FWG8q5m04ZcHtvo3GnGvmgaD5wd
-setAM/xg4279gktoUi/o/Xi6DpJ0mx0VBOuTVwnVEKoCUWJtWrOjVEF4teSrI8n4
-Mb+Y/Cche/iu8l3t9fnny90RfOg1r6jSJi7wy9XSgVangSCjWlrn/gbYmsH7wb2B
-9BUfsiEu2HAZVAIGuOZeU0nqDl4Z91aMK8scVBKBHmeST7dYB6KqXyQaGmDDsxU2
-5ks5GBPChuOJARUDBRA3jOyQaxYS8X0sCakBAd2hCAChV00lh5v4uicK+hHrL6uz
-FI0KgtehTYBLC21EW++q3g4UtVw5bg4ksGgM0cN3T2O3VJ+OIeYp2aW0DUTGVymF
-SZ7Ezt+J+YTq1PeDVpqWI16z/qvyGCJwNLWU39QnX9gYPTfoB0bYTCqnp1CZ6l/n
-E4skqiryJCyoy/icDBsErz8WkPS7R5mJlNtmO9T0WSh6w6AXQrsKKorl1p/dcyYM
-Fr+ggJ7fq1xzufnUdRi+S8rWQbIqcgIKIrGrSaHqKkf4zIHn1QBJO5HomHmLT5pp
-d6SUbXCnTFDk05uSmZHT4g4/wyqhxkWlGtyTMjDluboRUIFXR3Q1cvBMiZII0r4S
-iQCVAwUQN4uW+cmGeh06atyFAQFuigP6AltjOGhRcEg5rc3wrSZqk6fpVucw9qhh
-QKPv5aBTWtIJdIQy1mls00V4QjPW2PFGWpQJSl0ZXTLIgrr/rlBQRziJ8WFMmLhE
-c/TH1ZUSfC3P2YMd9rWxIA6Nk4c7qDmR7bYE6cvndRCEws5NCmvpigY+30tVXBU5
-bK1zgVmR/E+JARUDBRM3ieTK4clqXikoFOUBAUjKB/9FstalvSqDeMHbcYdRiC5x
-AyDA5fU6ZY1keaTSQY9qPCVfHji87wbJge2kmIxA+ldpQQQB7t3z7ktPV25o29dk
-aZpRHllDfzGd7heJPBC0DXEIXu3XZRUG19Baxt2VZ8JA/v/bzL1o/i/sLTEvDk4q
-OeB6LZrvRcK7COFYlSByZXmWcbZGV39qzykG+NxrfXqOwz4NZqebewj3e0cQ/cGv
-csRnh2IsMMfWXDOfioUgLsYQzuVP9imGhRtYzkIf0vf5A+YRBBXLvrAmp3qpJqLm
-D0pSYYGXxwbGEfLqXa2lbjDToRfDvyGfFtgen1AfgaUIKiqRVTRCvxf9ZuvQXiac
-iQCSAwUQN4UudD6Pt/L4g0HZAQGagQPjBZRiXtA4UeXk+J1zYjYKf6dq//K9Fi7z
-9U4obGoY0e0k1OcOGWEa5DWhl3vftOaiWejmU4gXveYcdVCly6fNoX1T8EAmu2Dt
-/qFxyZ8RSWb+ncTqYGM1PFVWmvJBmDfz4zg88gNLnIfxzYravVCvBpaSRjhouBPY
-BegjWUuIRgQQEQIABgUCOG/pBQAKCRAXWVXOQ77mqCkzAKCT40AAdAWiS+62IuYS
-YdYpBzKs1wCgzFg2kH7H0vpchKnpk5W/0R2qcUGJAJUDBRA61hGfms08wKmfdd0B
-AfifBADG9LL4HjrFMfyx2b5g/TqWOpB5eJa5WVvwTgPuYYgEFeD+xQ0AnsU+dpd5
-+jyPEdoV3+soL/sg4jbCo3YcHvWZmdo7h76Y6xQLMTFedDGR8IFfeT/X9Be07mb0
-xbVM+Wdy3N71Ua0Tg4nQWbTh5LokCO0lKwCNdu/rB6V9/qKJt4g/AwUQOtYol926
-ZLosMS0vEQIv1wCdGHwC5HayJ+XUosOG9t+qnkBFefcAoL6YCaOqC/YSrDW5jkbB
-ZBB+oKxkiQCVAwUQPL2DzQ9HL1s0103BAQH6igQAiB9kefGNX8/a53jdLcgD9qUs
-VFC1B8zQXPVPwqTv20LVx5TktTfISnupUGMrrh+xNHNN1ay3GkZ0EfbUBAthn0Cy
-gWq06QXyCRyacl4sne+Y+1D51HvvVHCzanXzuaLj0MdCx6Vc2wdCaONFhzqRtUF4
-YZlGAZLEuLqmNqwVPQKIRgQQEQIABgUCPQM/OQAKCRCXFrIpO6o64MRiAJ41B8/Q
-fCbyEIaIssIpaVEmI6If4ACdHBRZcOMhdBVPzBHUG+xOQTO1U/WIPwMFED0ZvGvb
-0kX8s7KhLBEC/NUAnjRj0EuDSbYocYlv2DjVLIibIa8JAKC+N4o91dBh/9CuMPfa
-z9vPKCDsyIhGBBMRAgAGBQI9Z7LJAAoJECxw4sZEMXOc0TAAmwUfeGq6mFWbi6fZ
-OtmmEzQg1mcmAJ4sEqOsUBJg45taUqfsbfCSvaZPKYhGBBMRAgAGBQI9pETZAAoJ
-EIvYLm8wuUtcjmoAnjW65Rh4NdDrhpwYrQ7MqTQBY5IAAJkBG8gWL9hJCyPGM8Wf
-dBwTP4UrWYkAlQMFEz2a8A2z4b7txQbzsQEBV28D/32OJ7GOos9ei5fNp1Njmxrk
-bozjcZK1pSrpTzQQ1BMNLHr+4YPMaTbXX+CqBBOEZKZaeDeAVT1v+EMEHm4o3Ubp
-Bebeyzdwnu29fh5Iz0iOIn2J6YInAt1RxjYosiY9n9tR5l9jkB1QSk5fXWEth25z
-PyYceq7GyiZXslcNiyvgiEYEEBECAAYFAj3YIQYACgkQXUFK4eAFycuG6ACfe0Jj
-SFuU7UQYRzM7bMlcP1SBYtMAn2oFVZTyasM1HST2S8UpxP3n1StLiEYEExECAAYF
-Aj3YF1AACgkQatVs/hkxGwC/jQCcDgaoS8X7hJH8hvwnwVEnPypGOW0AoNAkWdA6
-8HkLjfMjqJE6I10zx8qyiEYEExECAAYFAj3YEhQACgkQyXxQllwcOtd4NwCg0G3A
-M7MqkjQNyI4d1VSQI4N0fu8AoLQA9Wwoz5uc1Gxpaf3w/gjuQQe6iEYEExECAAYF
-Aj3YIHoACgkQ/A+FifiUvhJmigCfVHlN3xXMFNDb3Ff62nYfT8dPBlIAn1TFMV5+
-OM/WS/pS0EfBbfCLp62FiEYEEhECAAYFAj3YJrkACgkQNhUi14Kre9Ga+QCgzbbI
-qTwpnIaFGJefGdtCtmYOaqgAn0jbjCRVi2hoed0UG2D+wiEafE6BiEYEExECAAYF
-Aj3YIx8ACgkQZjW2wN6IXdPO2QCgrCq8WNdXJQBHKNy0xLmOfOIIRhAAn01YjYrh
-v5UF8/HbW80LQJjFISvliQIVAwUQPdgj3CQOZvzFnDJwAQLxuQ/+MbaPOSJZ/cLX
-V1m1opESzQ16OXeYdMrpTRpNaXVyOfhu/gwuhSp3M0l3K5RAb7jVhei9Yed+P7/U
-8O14JC912YSfJxod6O0cg++GExyJliJMYXdnVfU/HJeBuXI9lgAhMx9xHopEmNxG
-4d1ZJUQA3GP9n29go8RwQc30t3z2QTX6tQEk41MIZmWFMAWmLN3o9s7QmwnKMHFH
-EVgD/QpC9W8t1aHtMFxsweJ+FdsAuyCejCcu0xxW04yN2VSQMM8nFYZpkV6bwl9j
-9R3Uni4mDtML31xxJ+ciZPXb8ue2EnLnx1tSeORGyj/2qTyB2zInNxI0idyhX5cZ
-ZYjbn/D35fuKVJO2PUzn0LKMExABkJ30M5pN1Q0iTVkYXLB2QqM/8MX3582bHg5I
-+kj5rYlFixYlqI+V7PBv5Y+fkiiKWfPhqOniwtX1y5MTuOxYvdx1AtVZnE3BQYrL
-7Sr5CMf9M0vvaAh3zjx9OYpUq/NklJhYLs/D0XJ45HEEfv4ZaVjVZHxsstgurows
-H6My6cFTDf5gtBgRut/dXLjM7Ax1QRoqFuk9pW5+MrcZtgi/RdEl//MWF0b5vdo8
-38PbMO4EfRlZucmVE6u4tx3B4VSQl+Cf6ye5C2rey1zr548wGZYBWO5m7be8nwHw
-ahzy8pFWR5o9REnzD/7La+qUuVM0jJSJAJUDBRA92CROMaY9luwUC4EBAWmfBACO
-SpwHkNx3uKZeiQeIHur9MVfh+hUuS/Sr1MxjmnHbATqQ6svHkXZ3fm+RhJNChv9I
-apMRsMfDXgW+11P0kwLWuGsaWSDdO8L7AlQjG4vAVZGa3RfbYFL/dWzzJMZhMMRZ
-K4GABGFJt2b8go/RycyDW5TkPTDs/7oeulDfqvPCSohGBBARAgAGBQI92BsvAAoJ
-ELK+vEAVKSSvj7wAoOTZLlnlRLmbiqy9O4oGdI4e7K4VAJsEXFoMtImL9VCPJ5xY
-3Fr/O/FLVohGBBARAgAGBQI93I4EAAoJEFWR4sBmZMB42ZYAni7JWxTE+uRlHTaN
-1Mt9humWf7JXAJwIOaNK+whZiPpuVSy7uSUaozPqIIhGBBMRAgAGBQI93T35AAoJ
-EDRKhE11HX8nMdgAn0gIl6XfePxdBe0u/VncEC9ttk/zAJ9wX4dZlgIKfyVKTVUM
-sQRPm3Ep3YhGBBMRAgAGBQI93Ws2AAoJEEzETQAR34fpj8IAnjzJaWos8DsyMxAL
-YAGKji13z1QRAJ48+B0pijAIS6QsK0rZI9mJd/6KwIkAlQMFEz3dIQtksM0FGHvW
-jQEBMgED/2nl2SchT5r3rITPNvKJSXqEi3ZJk9KC9tEX6NsgHBDufnHMlFmPzWF8
-CIY1Esfk91i6IScbtdIJDCXxTbeI6VQY2EZGAbCaz+VyJRD/daEM/aRjopjxLLlr
-49QEW+YFib2a0QzViWYfdYzB2VFBEOaoGvabHrAsfaRUAZtHDGkNiQCVAwUTPd+M
-ze6tTP1JpWPZAQHPPQP+O0DPnE+N1kUDH0r+96E1CGfeLYAPGUJM1BZVj11DplKP
-lrB3oK2fjxd3zvBbPdJqKrq4/mtxeGXlgOS1n5Wjmtb9Z+k8/aCG2Hw8qg7lzWQQ
-wJxMqDxogERkmshVXT9svhLGwurYY00tNEU1IDV0zTEtCz+CxXpv5sTnyJjJFCiI
-RgQTEQIABgUCPeHubQAKCRAxNjTku5KeVPzIAKCfuxJYXBWle20SqWNlbPpWN+rO
-wgCdHMJI9FmbIkU9wvapRCNQ12Ze18uIRgQTEQIABgUCPeQBxAAKCRDtomXYNFh4
-DngVAJwPbACWWWL3lnUZZisChi50pO7cdACgsjxddmEKCXt11Uds3iBzZOq8pRKI
-RgQTEQIABgUCPhWzowAKCRBadar9ZAHxYQ3yAKDErPthqfaOcfpBRfChi3YfuW9B
-yACfbksBj0KxStjXNIlC2L5SBLpVHtOISQQwEQIACQUCPg01+gIdAAAKCRCL2C5v
-MLlLXDpLAJ0edFHjJfn3buJwBEUXFOOg2yZ5uQCggJcEFvWyrhLkCwXuluFcnS6Z
-uge0IUxhcnMgRWlsZWJyZWNodCA8c2Z4QHVuaXgtYWcub3JnPokAlQMFEzeoM+39
-LZCSqJB7JQEBpE8D/AunAbzd6eYOmNwVXWh6krunrxduJrLPMwBye0H2g1nHVvho
-o9q17Drfl72Lo/Ku2Gs19TVp+KLNk6vcol8ULAdQYftPhIUF8Hf2D2dARMlvjLr+
-fQoYYRS1GX9OoEN4G8PntE0P2aGplVuf45mUpEFaPYwW22FjFykBw7SFp/7iiD8D
-BRA3il+CVuaW53sMD6YRAjTGAJ908hV1PrzsbnTbVr/dbQZYkXrklACdFtqhkXLa
-focMmhudI7IQcccjkTiJARUDBRA3lMiLrq25AjyOOW0BAQudB/45xavMfDwL5K2A
-K1CZEmkwUQLqJJ+e4FMCnT0sUhZ1fO4Yj/HHJ8MYBZ1QHAfyYyE7vConUzGy6m2l
-4amT5uJ/XcibobrUMlTSC1nKl97+vpy8bUOiMTV6xT7iw/vxkPX5tYGORJs0T9hP
-qCqJ+2iT9Owq+bxHL1bBEe9FkExDdjQRO0PMBACiNjvgK3pN0bPaunYINePrNjR2
-3k2cd90+M0XAKCIgaC9LDPB/JeA4HZ9qntofCp0QplzBKOOk2iVKYf+XGVEisRGP
-EaoRYaoMQO0/errELoyY2r3jTTb+FtR8saeZmDsNPiHrZlbXrZcBWXz6pZVyY1OV
-HKDg1HP1iQEVAgUTN4n7alHqbXo/ktOxAQGeVQf9E4rasb5UWITWjmiKloegcwkA
-+YYJ+cGUQEw/EttFrbQERZVtC7q3yhPGGlURcvukJyxkghnTWj62IBtEA+OQ6RNd
-OqLmqQc4CqqCWd4GvoGdtmc2IJHEp2G0k+pknoFs9jzGETDRW+8B++mNPeZJuyRp
-FWHKLWrsECfbgmCIYqr/i7HDvBncTDWLWdPlKUT4p8S4+T6cnPx7WdNOYUumCT/1
-Tbze5eb7w4fXheWzP7/EV+jyHxO7yOw286HID5JyB9U/wcAR2duoNKpF47I9yAkv
-7XR/uLAbaNmNgscc5lmZKWuTnOBkrldFKIFCWJ/uRA7eCTq4aZVGHQBm8cud8okA
-lQIFEDeJ+pzERpHovDmlzQEBnkkD/2gHyW4NojEQMZ7eepxwy1JKADIJ4TBi6R43
-RxlT9H2TeWxX9CnOxUngtJMW9vuAf/M11gY6r3c0xgPkAVUCvaZcL/OfBa0cP6TF
-RcQySxJZTyFqyeb3RDgwg+aWnaRNG4XuCDx77A8YH/CQZZ1z13hHptE+u26ZMe8o
-6wC+qJ4oiQCVAwUQNikcGZrNPMCpn3XdAQEqEgP/WcMgFopVyTTFrFdCn8lHh2ew
-rBQPfykIsS7aUh/Io+K2i2rK+q7q3EnJK3fjokCj0BtP00l0gBD+7LmrVel00yxB
-RyW5qnIU2VzEmqcMRVhi8XRvm7gojrlcW6aKeGaCs9sW/hrXXsng6/v/4BS/sGxK
-pWTF378IMwQsXDjP7WWJAJIDBRAzzQ7YPo+38viDQdkBAcaXA+du8KHJjdox8QpJ
-iJiA/mDFRfINUYo9whMvqCwGYojVkkcY9pVkx4bFWV7cxed/gA+/ayaqxYWVAsfl
-urxuOrizLrt/1aZxH6tkLA9HesyFL0gxSMbMv7OJJ8r4HzHl3Mx5m+74xmxrMj/Z
-qowMjezFHKoAQQDR+B1/QkkTfIkAlQMFEDYbWZExpj2W7BQLgQEBurUD/2sDxRYC
-nrqc/Qb0NS0GZ57+pqg6HlkgxOgPwpDYu4kk/4gX6kA7Qgmx28k9oPHihHT+huq5
-al+5ezaC0ZrEUwvrcgbNfxAacTMPOqxjuJD5GEOU7+W8357yJP7nfzSe/IM3D/ZU
-MuFAxH0mYP3gDDD7T0CqBEWbJm9kzxaZ+R8OiD8DBRA61ihT3bpkuiwxLS8RAh8k
-AJ4rm5LDty/7QrAM92rq7JEUuQ7INgCeO7LTLOw9jOqZDwdp8JrC9s2nhyGJAJUD
-BRA8vYPND0cvWzTXTcEBAcXgBACfG2fGomWNVzTCwRzuwZxFfPkRSOAxu2Dt3JlI
-JuCl9Ku+3f8tTaGgOUDvym0suzhz5/PeMvilsrdPI/dsx2FeNZXE1c1Y+kBNmYEX
-MmdGHJGatkdlHEeiFKOwhc17E8CPrk8XzkcwW8N8L7G480hOb9t9jjvN+og1I7Dj
-uUUC/4hGBBARAgAGBQI9Az9AAAoJEJcWsik7qjrgVSEAnRcnEEMrkgFw161OtpTS
-a6giTqsUAJsEDO9X6vwPmGgO/nkeDWce/VATPIg/AwUQPRm8jNvSRfyzsqEsEQKE
-WQCgj+POQEwEMtvcVKA6Z3/ZjoFT+TMAn1ZK+xwgUQnp8eTClAACRIvkuv00iEUE
-ExECAAYFAj1nss4ACgkQLHDixkQxc5xFpQCWMKBv2yd23G73gc0JAGYW8rmGSQCf
-UyGiZ6zDQ+HwKwvlFkWvd+Mn33OJAJUDBRA2VRZbYlyoKdWSjeUBASW/BACnKm/2
-FjN86jOtAH1ir8XdiWzTBCynV9F8A7dxOuEKCaf+6ILgfM3pmRl78GggE9ZesrKT
-hxB6+azt5ln3vOnXBKYwwyiyn6dAjBjYKQCjXUnPr6lYWpn2nDfi5jGg8Wd3GLvC
-BegSMeN54TrvvQqgjb6rnDrO3PfStT7HfKnk7ohGBBMRAgAGBQI9pETXAAoJEIvY
-Lm8wuUtcAlwAoIgGWg4/teriietB5v7akloDwBDGAKCp6ijRdWQaMJ8mOkGRWZpY
-Kjl4X4kAlQMFEz2a8Aiz4b7txQbzsQEBNcIEAJ1Zcp1UYCY15Pua1qLME6Shrh/x
-U+KQIUkbU9aoHRLtMJ9ZyK3nIpN2Z8wuz6YJZ58+gFLuwx8kuw+E9j8yRBwmrw/J
-SViBPa8AZvdWx7qE5wb4wKL3JzDmhbLyD6tdq8k/K8PIKILn0og1lSanOAzWWB6J
-y8UcJf4qstXNxR8CiEYEEBECAAYFAj3YIQgACgkQXUFK4eAFycvpowCePnhazYAL
-xZ+J1VJ14CJsqbhVeKQAnRa7TCTSMLRZ9tKG2IP5h9d4UU3jiEYEExECAAYFAj3Y
-F2oACgkQatVs/hkxGwABbwCePGUylMh9ebstpcYvmVp1Ge0/a2sAoMhsIjfO3mZo
-I9TRG11eH0T0bWPuiEYEExECAAYFAj3YEgwACgkQyXxQllwcOtdbbwCgq1bWegCT
-2Om9MBEOatVMxMGIBb8AoMkDiPAaflgi/sNQqj/fJz5W48K1iEYEExECAAYFAj3Y
-IIkACgkQ/A+FifiUvhLdvACeKIGPl8brem8WCV2DyODB4WEof/8Anin3nbi9soQ5
-tB7Wufk9ubya+yOciEYEEhECAAYFAj3YJrYACgkQNhUi14Kre9HgPACfc1+WD8bA
-p/MCHOUXl75Pq/ynhkkAnAhPJxhwbwmJQAPe93FJK0CWT7xFiEYEExECAAYFAj3Y
-IxYACgkQZjW2wN6IXdN+8gCfckABgKVKMH7z9zOOuZQXZnEYUk4An3uK8GiwIoyP
-PoZlxyYSG3pFZPFAiQIVAwUQPdgVECQOZvzFnDJwAQIueRAAg0qcWjnN86oZUuqZ
-cT3df8pdRukrtrameId7JOT92eIcfSZ0e3TOuZvf9j4CapGoDP7fTtBjvN8sW7QY
-B4jMida0/Jp2iubPAxO/BCOoMthDZLaERp5K+YcrIWskofCOfZys9e0PKwL0pOsH
-XIOCuHai/s6rWPAuSNxo+M7lJ2gkvcFTopAbnC1T2r4Tl6xhd3EqRiI/meHAHSVP
-vhmqGWYCSJjM0I2JReTAlyzXu3t0lPSjsedlHnY1mjSN4dxcuuUglc3WCln6JntM
-RYUMZ1UlsrBMbfGYyxzcxSO8nkV6n5+95BrAkV2ncmSFbt3dX36Np1gPJW4leobC
-FXrP6SEF0pUAXQSXdunXR2/fnxlq2kSHGvNMDKSLJMx7POhaD/A7X5uTCID/t3ND
-ep1AUSBfk7NkNRsA1VzRP+2BUxOFPscNB7mDoQQIXX3ccUWFwiJuQ05CrCsCUerv
-BQlBXEwXIyBl+ZvJTpY9jpp1NI31GBTcHA1kyS/DCCzTDhkg9gAuYDEUuxtN/YcV
-BbbKl2mT7VF4s7k5DYJwBRDX2pJrdzGebiPRs0IVDI/dHocTTDlxf++r3mB4J506
-82i+kVmwJ7HrLkgXlitZxeesTCFY+Et7qEZLENaJV3jScYPEkJ8zGSRnNsa7ySj/
-5Ky50SjTHjyu94ODQRJ61j/OweOIRgQQEQIABgUCPdga0QAKCRCyvrxAFSkkr1iZ
-AJ9P1L/Kcnu5YO3Ffjt3BCt8iBN1AwCg5yilElAdPPY4T0+C2169KeO1seuIRgQQ
-EQIABgUCPdwsCwAKCRBVkeLAZmTAeMjDAJ9rjShqH9hddmcjx8OtjAI+9qY1bwCg
-hlWGanggTHNIXXRJeJm/nHja+4uIRgQTEQIABgUCPd099gAKCRA0SoRNdR1/JzsQ
-AKCgxC8Ud97WqPsvn+Leszd/82wtQQCfWHEzkf6CXB0AjItFv2lavhQPZsCIRQQT
-EQIABgUCPd1rMAAKCRBMxE0AEd+H6UQ9AJ4n96TMb6dFairFj6i5PneMP5VNtACX
-eFF09NN7EhhdOydNuSD2o2WFCYkAlQMFEz3dIQFksM0FGHvWjQEB9FAD/0jbvqVv
-oFwjXFu2GBlUu2oRCFpwbo5xAydPpL6H1/PHtkzNMkzuLdY7rintSRZebUGDbnlk
-4MMOmqqg59YHNv7X9Gf9hwMGiMjZ0VVyQs5+cC927n9WGbPMybbimCbPcnFZ34ug
-h3tqb7+UyvPdlMJBvywqipu3vYKj6htITnIEiQCVAwUTPd+M0u6tTP1JpWPZAQFE
-zwQAsO6P8DH2bTvJJsEl7GCaet0XkSO8WEXgU7GDsA7BAdKA4WGxf4Hp7FvT2znp
-A76paD8com79YcmsULidmh3WVrCGG6tb4ydt91CU8V4Bugr/0/auhfpNnOY6H+eJ
-d4OgF8NcNmjM3Jt7l1ZNRvDFqyyS4fXeJGHyBwMhrHO1EfyIRgQTEQIABgUCPeHu
-YAAKCRAxNjTku5KeVGP8AJ4q2zuDiIgArirtTfI+s+hjThAX1ACfbamjwnJY0wKj
-ouenyM0kX20/aeuIRgQTEQIABgUCPeQBvwAKCRDtomXYNFh4DgHWAJ9s68ZI0exd
-RgoL/QycXDNUxFSqgACfdtMFKtINALcJ07vOOu6K1BSRU9GIRgQTEQIABgUCPhWz
-oAAKCRBadar9ZAHxYUfwAJ4lfEdpwATb3PXKccqsZ3frQ1Z9cwCgiRq8qM3CCqow
-5rqV0fLr5kwWN6mISQQwEQIACQUCPg01+gIdAAAKCRCL2C5vMLlLXIfZAJ0T9uMZ
-PqUMpcfRweoqtr0lbKu+nwCfdtyKm1Er1qQdEMBgN2B8EtrMotO0IUxhcnMgRWls
-ZWJyZWNodCA8bGFyc0BhcGFjaGUub3JnPokAlQMFEzeoNAP9LZCSqJB7JQEBoyYD
-+wXn4TqjNwDe+7JGRng/4TXtjYnzCrdeoEmc3b5LCtv4MadCSOfeBvDA7ZwXcEoo
-KXvd/M4B4o6QA4SqUcJU5pDqdgP7nFD3IRzx/8XRy+OODciAPHrmZUelNIQ2S3vM
-kjpjjUf0/lQ1jVWiGllmlxCNe7+O+q+iCJOVsN64Er72iQCSAwUQN4UuKD6Pt/L4
-g0HZAQFWvQPmPTlwE9IfrBcb6afTEb6hWewTcwLZckphgwNjcuDBccv193gl8MOh
-PG+wFv2c+jKwndV19NvHeB0r1HE0+lYqLxQI0DTGZTVGDfyQBJMKBOMLOdB5Qk12
-gNOXC7F8Ulhx9w/LlBs31MRsl3e6TY5JyzclPP8qNSI1DhBBBzSJAJUDBRA61hFP
-ms08wKmfdd0BAT6mA/oDuaRfJMUpypSCFrVgprN5fCNDz4hosv+rmkt0A5Ks+Xf5
-Z+BzjCnJxSjUwxNI1z+F2NDDgLXZG9xl0oC2ib4snH7lfWee//zJNr1OqDAOp+D6
-BWfDr41Eu+AYsZdikbZ9sRkilGbGRkx6EjOO+AB5sLwwvZtN2Y9vNBxkR3byKYg/
-AwUQOtYorN26ZLosMS0vEQI2lgCgvvVmipxqIKxd70Gw/P7GZSOM57gAnjMD/8OI
-u7bFfryVUKVIJiVmyPa6iQCVAwUQPL2DzA9HL1s0103BAQGAuAQArIZWUAWR1Dm8
-ahwIXAlGKMGtqJVkbVu4c+Ziwax7qGvIf7sTD7WQFAbytyEK0guirnqSodXOGLLW
-SVrvzB/8d9C7PDK8zDpzatmoA5CXxPWYKGtdB7OjrA32eTuSrwf6S9+OdJXi4960
-CYTUq2D7FyLR3SU/MyvljRLhLIZoq06IRgQQEQIABgUCPQM/QAAKCRCXFrIpO6o6
-4Nd6AJ9U7VCOElgSVuZoFcZa+aIoj21C9wCfe4SCgoM/khv9TNLCLn1OpwzFGeCI
-PwMFED0ZvH3b0kX8s7KhLBECGjwAn2N/LvnT38Ip4KXU5sg4ZFVhYASKAJ9DjJK1
-rgsWcKjjSgWM2ESgYiA+sohGBBMRAgAGBQI9Z7LOAAoJECxw4sZEMXOcf1EAnR5P
-O0gfDHPjKml0u5NpVDXCIYFPAJ9lnk0E5tDzrMtzIBAyvb5UyJPxUIhGBBMRAgAG
-BQI9pETZAAoJEIvYLm8wuUtc7GcAn1ryTaOMH725FdVBWv4vVOBp+Q34AKCNS4HN
-i50ZMJkfAXR99aGlCoz9PokAlQMFEz2a8A2z4b7txQbzsQEBl30D/0/Lo7Cz1mVP
-GlqS6DNbAoeJdmEIvuM6iITmp/Iw2BanBiyI7XsDEw50lhq4PqR3k+Un2vRKnFP3
-FvhD1b1iuyzAiTR2q9OZzDRURRlGnVcZ2qNoduzWQqrmXCDEeWWTEEe9GYO/j2R/
-PYiJrlWmBHC/44EUjcZZ2fkQh4xZJ0A9iQCVAwUQPdgVPBsIDEUnGa81AQGXWwP8
-CXqiBsIZej3+4R05GTZsmWofAMiCrK6BW3dqGj3BQsVjuwAC2Jy1FIXRdnLkyyW6
-qZGzed67nr4cs83WcnITk2p8cei6pmu8tQRwQFlayrIMbn/RzAqguocbNprdnYT1
-aAlJOYPcPfr8/CCHVyuMn1kdkcRGh0O5enLsG/IZ5++IRgQQEQIABgUCPdghCAAK
-CRBdQUrh4AXJy1MoAKCOBamdjWJX7lm8IQh4+Yxl0LS8RgCfUWMqettiFD0g+CeM
-X3yWxDwXvs6IRgQTEQIABgUCPdgXagAKCRBq1Wz+GTEbACrmAJwPGPKlh/TVffbX
-Znc9W4YKmv0CtACeICRk74geAZX+FTMVf2vojnn5aXeIRgQTEQIABgUCPdgSFAAK
-CRDJfFCWXBw612SjAJ9Tw8gPCHWJAXgoJJqFjIkVCB8uGwCg5hbOzUzwDBXkqcX7
-4XBeXF0YnoqIRgQTEQIABgUCPdggiQAKCRD8D4WJ+JS+EhhMAJ9fCvK4SG7U2Ain
-BgARpPzFW/xS5QCffbmKs4pbgGY+bMX7toNRDPPVO3WIRgQSEQIABgUCPdgmuQAK
-CRA2FSLXgqt70WtSAKCZNK3C7QttpKa83LUu9PxKDhTzMACfR77FFd4vrY7uuDiQ
-wSvWAMqPnO+IRgQTEQIABgUCPdgjHwAKCRBmNbbA3ohd0w0fAJ4qt8RjiNFJmoGk
-4ZiREGmJGK7CNACeIK4AmENr/kjihSVzN3oS4CybhA+JAhUDBRA92CPbJA5m/MWc
-MnABAuj2EACQ2kVZwBBIoz0NKZIvyla7/Xi0+xvaY3qeAAoM1LpYvlNDUkFZOwwV
-nSNNXbFmdVjqJs6TOoeMRDOZNeTwJwzCV6RM/OI+Wwv6Ji3ZhF61IHlR7wSS6KVX
-aeuHPvLIW1LTWF5yDEu+QckAoG18Q9rPAXMVKGdcKiMvc7jz8qUt6rT0myEJP51j
-4DNXAFlxKVDgSiXjE71a0DkHgsYZU1JLbO467iRkbA6L+c9aKTu4EuCjUVr5E3rl
-Z7EB6uki2b77MbBVCFYblaIPPz0guf2CZPgLeFiSViqVUypuIGjKOsrGlkb3aya0
-AMtc46vGYZ4kO7ulfUHSscJ/SmSNkONbzjTmpGbEdc4OqI+1UJovEWM8CFopXypE
-UOvKeARzO73JF3JE2er/zRngOOhliWn8Jy1NeAt9bKQ7Fg6VD/p6CNcjkfEy2mri
-UtR1o6oezQCRSPBbURceZIaX2FWHAi+L9ohLTfzk0Ff4s9i48U2eoIIVcVfDWIFJ
-zQa9dB7EEmaEsseMHnqRxtz0oQCR0ihKSeHKt3vSnVzEEvNcwoKstH/cbi12T1Vp
-PBRmMSs1oNbpDZAeuNvvVM9b+XAkV42dTSs80ukjnlRSP8bRhf2qvaYDKv7GT+st
-EkOGNQmzH7H+4fIH6JfnH6K7QoPARfyFZEjhHtEZnOMILxaxvbhn7IkAlQMFED3Y
-JE0xpj2W7BQLgQEBPnUD/3B7Q3rFd+Rc6QESia5oZAiv7DlU0YpKbnqf36nShgpA
-BZn3gIVXIzlijVZoQNZe5Y9vVv0LBBCAX3+hTu+q8y8lUYcDvrKyQHoIKzg2cfAl
-sKDqAfCRd1wo/ePZgrpFQXjWgpmfJnFxKvU00XPiLcViHIX9ut2+mik3L+RVCP0G
-iEYEEBECAAYFAj3YGy8ACgkQsr68QBUpJK82zACcClM78giKcJReGZ5v3g2MNhwP
-SlkAoPPnlCWqDcOSnv7zWilUdiC08+D0iEYEEBECAAYFAj3cjhAACgkQVZHiwGZk
-wHiTFQCg7ScJ5CKs0d95DwfYfFQeYRXnagEAoNVnZ1LyCt9gm4C+k7lcxuPS2xae
-iEYEExECAAYFAj3dPfkACgkQNEqETXUdfydraACggSLLr4mP8iCTyqtmihdk1Ldy
-N70An0sGk21GGI8QOF0fHHtwFfoT5za8iEYEExECAAYFAj3dazYACgkQTMRNABHf
-h+nd4QCcD2eLYdwrQNPJxjsJx+5AIhdIS/UAnihAavuB4SaijBBmH92tGzw3iGuI
-iEYEExECAAYFAj3dIgYACgkQXP03+sx4yJMYbgCgpPZG7Xg2AKb8sI4aD9PuU+Qs
-5YwAoLlQjy7gvlv6OPNn8ygxp3JrBkEHiQCVAwUTPd0hC2SwzQUYe9aNAQFo4QP/
-VjYmvIsDDOg4kRD9zDgyNMrqpJNIGTDN4gOAt6H4vmUN7qY9laYLarMLrJQg/9+m
-7NYuC6IzDlY1Bu1YnOR0OnVtL+WV2EPQuee2YzqAH0qmY2ZQxKc6QfqfqwvAwK4y
-NU7xXvTOAeSNZ7pOqpj62l1puOYbMFqWM5BKykSQr26JAJUDBRM934zS7q1M/Uml
-Y9kBAXX0BACUFIWyTCWZMRZL8Eex1LzvIFpzojkm26V3mIbZp3E6RV13zjqatIJX
-EPFe3qiWGgGHKIaLOt0N2R/A9LLWuYhE016uu3xQQmWgh8XbeKU9VtD9j7eqNiq2
-iVRnQlkR8Z1Jrv8Y0LsvBU2LC83nf8Z0UEYCOxS6ghKc8EFnK0UyRIhGBBMRAgAG
-BQI94e5tAAoJEDE2NOS7kp5UTroAnR15zCxKXR2bok0hFXYW7Qpzk51mAKCf04rW
-temf5aASKwJ9iGwmYhaVg4hGBBMRAgAGBQI95AHEAAoJEO2iZdg0WHgOET4AoJNA
-zn8VI0d03B5PmlecuJiVhivsAKCRlpbeLXdAwwVJPDtC0UcTa/A1mIhGBBMRAgAG
-BQI+FbOjAAoJEFp1qv1kAfFh8rcAoO3xdFE+dO+R4GMptC+cEmYu38JJAKCPcw/Z
-HK33u5NTITecwuqtHNuwbohJBDARAgAJBQI+DTX6Ah0AAAoJEIvYLm8wuUtcvosA
-njKNyxNGBDXk0S/UDxrOEc52JAS/AJ9Pl8MKXgL3kakVr9HgxauwuTpfr7QtTGFy
-cyBFaWxlYnJlY2h0IDxMYXJzLkVpbGVicmVjaHRAdW5peC1hZy5vcmc+iQCVAwUT
-N6g0Fv0tkJKokHslAQFZqAP9EWFA4Cr0GU4MzDAdpaEl8DuVztob+QtWFSgzAtZ8
-/pYnboE/gDWev/ODGzxh89Wg7qOBA1bu6ZatUtUR9KOEU0W9DzeprtSPQ9nmq7DY
-jBo+EvxrRZUXrxM2niJ1kpu13zM0n2tgEmn76RdRQ2wAAfmnzqF7e1PpIR57tg20
-1hOIPwMFEDeKX5FW5pbnewwPphECcNwAmgL5p1ev2W9XyQEy6ylAtga2XBGgAKD9
-nQvjRYGBhAjC6QJ2VWlOtWc+hokBFQMFEDeUyIuurbkCPI45bQEBbXwH/18e2qOB
-Y1iNFYbNqxfAdKItzH6KvA1dsZ0of/JGgXXK6iTcdpPq2vl/RYTpmwLVErhhBRik
-n4XxtNUxigMS0U6IUKesyggHLrXPY3hwGKAvV+QmB/YosTqtWJi885oEIv5uMlJ2
-mO39jjqYAnR2CqoKH1B0b4wRFdpcP5IPYiL9Z4F0zniFxFQ46Vd/pet4K49KVP5b
-nI3yw0x9/t+nbJjee8XDP0Vxcg6A7QoaJU1RKpGWrKsYfBlOGPh/gixcCQbrpsNs
-sPiSplWdxT+xctQpIviPn8UsAgF1WV0jLZyQmtoZ+JvYVR0nrBUNJVQGrsSPbI9f
-0dJXaiM3ddE7dbuJARUCBRM3ift7Ueptej+S07EBAUktB/0Q+oYJVnLw+j6eDPv7
-wzXtFRHcNnv2Wn1eGH/NL3fe6/wglaiZ8tw7kcY9TQWdqCidjSkJSmKCW3O3uNtD
-dRF1kVoEzjMQJLOKY+wHDT5TKemKoNATJPTNp/HJiV2XCVnCR/vvqIrG6n9ct1gZ
-AlTVdqtwHeZ5x3qLQapo26RzYM3Liblhn1vGg0VuO9tgbscZDWDkrRVV2Hr6FIOz
-1PF8INOv9Gm6IJkIQ+fToOz84TNk5ubQUeHbLAjH8fKaaIOYhebrSQVNEAgLQys0
-rhB+B1TVLIiXE76pXk596vwVGii1Cejm0HyX7EhQKMF+IX3kiwnHbdW+6Sx6LkKD
-FzvDiQCVAgUQN4n6usRGkei8OaXNAQGTKAP9GLjMHw1oZ+lTu5B+UVJf7HTQZecE
-jGw33t5w1vvyleNcjl/iEsyNb/g6LMuahmldh1J7SZt615Jw6p6AzXZxk2ispmum
-e+37O0VKPNGZ2IUs0mFhAJ8yzTAZXcMh2SPzUW5gL7HznskNOpxTctope9PlqRGQ
-T+Qmmsc+y6VzfMyJAJIDBRAzzQwFPo+38viDQdkBAa31A+dPvsRw1zWvyMDp2aQw
-qIawIi2wiFl56lYfpkwWWjsdftuK0HHe+gek0aJ1vLwJFlrivroEukF1JaK3kS/o
-b2u/TNIZ4MKWjfhbkJW40Y7gCKCUJPzh6hDw1nYfc4N9XKnwubiRVdW2ig1HVoKZ
-UN9Ad034m30jMHEzqXbO4IkAlQMFEDrWEWuazTzAqZ913QEBaOkD/1ga4Z9KUKzs
-LMcCrqX/4H9p8iJ/wRecXL6CcnyEK/xcm/flhsRZLnNiNMOusW2RIeZSzntjYmK7
-7CUH5UEFb+ryf4LXKoFXV1FOLqnwcJ3JGIX4pf7HnPtcVblX0zrwAwjoCikLsM/c
-s7xVcC7cMUdUb5tgh9RvYcbOtDB54wGxiD8DBRA61ihe3bpkuiwxLS8RAkebAKDL
-Ofbxii5qPiMxr5keCdzwprztxACbBrZie4yvYdXwpylwrJ88o2+n6eiJAJUDBRA8
-vYPND0cvWzTXTcEBAZrkBACLGS/AiGBBDtOK1CzMUneK0DdYkVBk+qXxvFllOfZj
-varNz8wOyACkSB37ZzsxAmq5Dvu2td0HDUkLsvhrmJHIddd2YVIlg6ScWMkKDVmo
-N2t0rPIffFxr4lkeIFXr6LeJXEz2zPmldT+VNVlzIiPHiZuBXqNXAL0ILrt5aHTo
-O4hGBBARAgAGBQI9Az9AAAoJEJcWsik7qjrgpBMAnjVge968Imw+z1aOVDFh5glu
-LuR4AJ4qjQ0A6dN6h6F+xsHUUrMbgVP5a4g/AwUQPRm8w9vSRfyzsqEsEQIFBwCe
-P2q55CzSI50XAhoP1Ps90lttg48An3sPoV5oZr8vNI9dOhrlOEUPJkZsiEYEExEC
-AAYFAj1nss4ACgkQLHDixkQxc5yjyACggstQvc5IdrafzY+XFrlNo9NoWccAn3+w
-jcgbUdR50oVbIsjTbO9p28+oiEYEExECAAYFAj2kRNkACgkQi9gubzC5S1yTgACg
-rO4DT0Pk1EJVg7kUpLL9gJjZQBAAn29oAuoqSk+TbmFLR1Mip/xyJCpxiQCVAwUT
-PZrwDbPhvu3FBvOxAQFAfgQAhcL/YD94uQgNYnlNA8WyQt0iCp6k534X2B4P+mR2
-fAnsvb47pK+POPPXku+MDQLGt1L7fWXn2HV0/IXMrA8vjDBXQdHi56ACB77LKlb/
-RkgjBsJ5sxSaqKm3kknCPU303ypSu/bx0/v2NAsA5dsa3MMOZbw551cpwSAUxDqt
-Q16IRgQQEQIABgUCPdghCAAKCRBdQUrh4AXJy2m5AJ9MdOQSizBm2+c0oe+r+m+v
-AW0y7wCggAwJCQPzsAohf5ZLwrokLrsNEGuIRgQTEQIABgUCPdgXawAKCRBq1Wz+
-GTEbAOS3AKC854HXJSr3q15MXWJ2aRpsgrODXwCfatZhrw0eCToappL6QVO+emvf
-v7OIRgQTEQIABgUCPdgSFAAKCRDJfFCWXBw616euAKD4bhe/A/1YlMCW8VEeMz1q
-8q3jsACggYVijk5n/GXTAYagYLuHt2sS3TeIRgQTEQIABgUCPdggiQAKCRD8D4WJ
-+JS+EmSAAJ9VUKqSxwDnt5DOBDOIDrkBeFSLuACfYozztzIvA7dcpRJfbQqhSwfY
-aoOIRgQSEQIABgUCPdgmuQAKCRA2FSLXgqt70aUyAJ9ZnFBaA2KO+QjMMoJrY/JR
-w0d22ACg8D/KhGNnqu04hx5uIHRB/U6WQIqIRgQTEQIABgUCPdgjHwAKCRBmNbbA
-3ohd0/Z5AJ0d9ItcBgBA2jYFZPYM2ndkpiMnsACdFNRsQDPvu+0IKuUhUG8QDOqC
-RiOJAhUDBRA92CPeJA5m/MWcMnABAi0jEACTNnLtJQyLh985/pcpL20ehr7OLhW5
-aAdzodMCoqXrPGlkJPe6/OAP2RtG/g2E8yL4VVVcShcV0WlvHnNIX5KE14LSKjY3
-5iVdSGDzItTuZuXPgzLjzo8pwFW9OCdG48TdGgxrGLAJRcWzWqNat+ZY6C4mQu3E
-/pqv8Twif9J0QeXb1TBiAjg1mDCKpFSb2Eh3KWxNxRqZRrx54BTh5CqeISl/ISDQ
-+hQLvD3LrISGfgGDGmlTs6Bltd7PM4wO1MeonSprzgwGqWPVIrWTsD9YQJRGZ9r7
-tPztqeqPk0TIgKQvhS8W0Vf22ZWSNLS62CZtX8EYdD6snN7tfBbG39UszgyQ4EPw
-ds8My80NZ87oP+xIiycllMXGcdN7KjwE2Ai4HNzk5H+6cpUwHNhmV3eVkKyVlEdU
-vXJUywrb94ivGn/loBUwDw7ghCKnDEFxNBiL6vYgkezG92ajaYhjyRynBqALL//V
-07W1+5CdMkr1/MoDOQjGYgkf5+vT3At90gYXvrD2hZ5XwW95Zw+2A6gPOZBDa3iG
-r72smcD3ny/v1NjXC/aKpN4Od6nSI2wNeqm2b2AFHkpSySdWLG1TAc0rVaOw5y13
-vbWNiwP4i4RRIb9mkHpUU5yGLEZJ9CjT+K7OkxAg7A8i079b+xjEBJ6nXMLrxSaZ
-XXYc5h5TDGbLxokAlQMFED3YJE8xpj2W7BQLgQEB8HcEAJSAz9moNPBm4kNtG7yu
-z5gkIlFa6cOmaJB5dnAW3OphxoyC5bac1SBADT6XVTgVNtBwvbk7MwDDp85idhOA
-GDahLBmrFVV+O6o7OjexJhlcTab+eC/pOQrxfG0pYpqk6IsIVNRjHM9LOjngYV2d
-2OZjJ93wPxmYdlkFDjEaL+2kiEYEEBECAAYFAj3YGy0ACgkQsr68QBUpJK9B4wCe
-JPHrZa7bBzVcqPOqdbUyJ8Tn5OkAnR8dm0MWvYtqRYdK4/COcxbkBzlkiEYEEBEC
-AAYFAj3cjeMACgkQVZHiwGZkwHizXgCfZNz44hhBeJvbPj5xN41qnzxpX9cAn0Ug
-9dhPASUF16va6ZW++e8+WGaKiEYEExECAAYFAj3dPfkACgkQNEqETXUdfyeB8ACg
-2hn69wNnJQ3SaUZMoM49SGKxw5cAn2259C7IAho7Wnypa/76Vfv2qD8UiEYEExEC
-AAYFAj3dazYACgkQTMRNABHfh+n8MQCcDfaZ/LmpH2g2izNcTNpic2Isu+8AnRXI
-dHIrQKbKDOnCcTRuqeJBe+1ziQCVAwUTPd0hC2SwzQUYe9aNAQE/OwP7B0Qt69z6
-BP555Yo+PtaDPFJMOtWFsYnlx5/P1b3Y7y8HLnmWAa0bY83SPAKjvLHeQh904vEN
-mopBk5plRPpz/e+T8EJZL10BaZys3KeVncMMiVdfxCMiusu+U3uiWeXbjpauyQjZ
-N2YfdhvZ30yVYRT7KBt+XuRKRHVW+fl4IgSJAJUDBRM934zS7q1M/UmlY9kBAV+W
-BACm/UKONS/oG8Jecyc6HZkaHJnWADYT2EypyaE3OvXNEimaU6S/xLrm2EywbOHQ
-L6IHr8GLZjpln5SXWO/ve+H+kZOERO+jIFUysFDoG7d+S4Zex/dFCULsZCVbaMLj
-G2IPmTsbbJptllGcENNdzl+QlEdWMNiWszv6SCBRnsDNFYhGBBMRAgAGBQI94e5t
-AAoJEDE2NOS7kp5UnP4AnRfUpx/baaGqTO69gRbzLK1exu1WAKCBjqiAjNETihto
-PJ5cku6Hu++Rw4hGBBMRAgAGBQI95AHEAAoJEO2iZdg0WHgO42AAnjIcf+CQlXYR
-eKV47t+DHDvXshn6AKCxSaDbodEOC1Z92ltAsImD+MG7wYhGBBMRAgAGBQI+FbOj
-AAoJEFp1qv1kAfFh1jMAnAmgt9XJeko49kxYxctaaIBj1QoSAKDv2fMPZruYf48g
-C/UmCIkLrbl+pYhJBDARAgAJBQI+DTX6Ah0AAAoJEIvYLm8wuUtcxFkAn0+f5UD6
-GBmz671Jv+/zIG8Qs9z2AJ9ctlW2IAlEXD3QSEoLK4mNnICiWLQxTGFycyBgU0ZY
-JyBFaWxlYnJlY2h0IDxTRlhAdW5peC1hZy51bmktc2llZ2VuLmRlPokAVQMFEDD5
-fUoJNGLsuYI5PQEBF9gCAJQqYY+CSP8r6HWCJaQtjDzrPoX072jD1YUgmWdBFX2Y
-E2aS0F0A4lKJWAb0xyZ4wWcl2aM5Z/3X+DAR0IClsJiIRgQQEQIABgUCNra3sgAK
-CRAT3w9oXcLsWDX0AKDf7NZOZSFYpvRorhOUgBFSoGQ8UwCgxreAMZgT6o+/Ew0S
-6kw3yXpJyWeJAJUCBRAw+O6OHdm2eHD917EBAfj1A/4/cYEEa7jN8+ptmxZKsfZ0
-xOP2dxsPnicDT4VR16MHN6rkVrto782XSiRx3ZUsd9RjUmfHZA3mHoJIGo6JRFVO
-eyjg3LEASSSfZr4YFkhutnf0lDlJOeEKhqvIw/dSO7MDwdLxhOqAFv9UzAlpOm4G
-Lx9p1N61xDl1dIYEnY9cOIkAlQMFEDD5QYseKXCPGoSZUQEByFYD/jqPx2u8D1aQ
-zKHvZqS9PUYSsPMTgn10FR/tp2c9Ch60f+BQ96fOUCzmRt94Iq1iMZsJ0oTyLLf6
-wf/Mdb1LhvsGf7rXFATh25OUpPx1qPUWstSToHSn0+Zf8e1B0p6PJ96duI6rimoc
-8NKppOwSmRvqAD3ATCKpMiOSwWe9+mBZiQBVAgUQMPlE+T40zOw5+FkbAQHkSgIA
-g0xBZlmf7XavacVJwJJx/lNoqmb5jox8Sy9WDS2u94QnviJtsUOjwAFnaDoWDN8P
-EAxvE2xRBoyuGHRNpIL0TIkAdQMFEDMR9XVLXCU0Hmjw3QEBftADALeK5boLfjNz
-xZ7g1VPHw6k6QwSUESwiPJCmGTIT5f941YhHqohgwN5kGR9XDxWCCJAqQfFvbxhi
-Zv0zu4HvQ7FYLVLO2zwZrVvOfR259jvGDFpPqRBq1ccxTNXuvf2a44kAlQIFEDD5
-QnyFat0badac6QEBCCMEAKV60AedWZyXWokcwWIbW/PLgNTCh8JL1vijXGnBvT2P
-uA0L7/rCXPhbb20Arrq+P6xbGFxi42iWieeU2T5zN5IlPObT6cPeRWJkxPnaSf8Z
-D33Y1almcuhhYMUc7lkL7yqSo1J8TRVCSxjQ4W0+QDUFIEvrigb5Scd7zYHGOqoS
-iQDuAwUQMOFRHordZNYSzXUpAQFOeQbBASAkyTxIdH7aIGY4lDbH6S/gtWY+nyF1
-ooIF1+8kOatKm4SCsFYUj08OlLAXs1Ys+oRI+dajl13xh7KfNjPdoKIhcA5QHSsb
-y26MXV1Kf+QVQIyqCq9s85TexK/q1WUQIgCHrsZM0efrUgiEszQobi/16WjQuT9K
-lbBFE8llb+W1AECmO1H6O4U6Krrzr54T2QoEIiYIi2EF4T9x/ol/C5Lj7W6L4yaS
-Squc7z7Ttt2NuRZNLNMveXXa/+0zanwXCqmzjXL7ecgQ7Orsix/jMGN/DZkp5dsR
-eokAVQIFEDD4zdqb2lGD8IQbEQEBjYUB/2eiJQSOIXRm/LXnpTIGNpH9yKtPDQcs
-soCQCOPB6k3tHCiFugT3AZCajKKCbUSU1+kZLfH0SnvyDxnhxqslt3iJAJUCBRAw
-+R5/voJFl2Zsya0BAVlWA/0eFxcSJrCcc6WspLfB5eJKUDVmFh3eWnvNUBZWv73y
-KZQanlVq9vfaVGztcQbeBBT4uWsmvAhsF7PLkbByp97u9dY3064tZiqYjAVrdePQ
-bFJOZRQpxPYFaOVMWHKTNr29SOQynqP/Pw7mM9RUIV8DsRqgaiK/oIENXze0NL+a
-s4kBFQMFEDEsVXTwiYRjAFcYEQEBWnwH/jmcYmaqYHgN4jGc2zq9e7+GIy/yeDd6
-Ya3MvLLIdK5kwWzR1jn0UdMsxpQF3rKQki8wZ0kDKYdjF3NwJedSyuM+PO4gEMab
-uZP2Sq4OWoWSO1+aJL4k3EY5l5KW216frDLOid2Tjo8TtbVsrUl1uf95SsG482lE
-ZW1GwQPUEEhgGD57MGfgjykTblLJNhCN8uA1lY7mmznAnjcuEy3wfVCGPNaF31zs
-k/othcGdH9W3n3mbrjyAhkCMZRBYtx3d4QxAIDSfB7vQulwAp2Ink+3VWLZWB9eF
-E5OvwiypG1jYXfyOUkDD24oyits1OVN7z3KJQNVGpUgXJH7Q0Nok5pmJAJUDBRM3
-qDQn/S2QkqiQeyUBASpPA/0Z0rLxeX8MgmxAwon/DVmw7K6pkvp8fd7FkLfVjxfo
-OTxc3ZHDQqQ7Y+Mw2leyN3R+nn1f2zBMP+F/WBEivtS+H+nadd/IFIOvj9VQekru
-3HsgHdmiUhlW+2brv4fy98cqT1cQWAUXXj5pW8oeiNdne2xG3pabvyecnjeB1XIe
-vokAkgMFEDzHIq0+j7fy+INB2QEBcVsD52j29s0zprKtUQc3w/46DAmFDKzcDMin
-N4levHlq3BrUGtmCD08CoJoG0RjC5nykWUOyMTYMF2V5UNm69vFZTqj2D0+p5gFu
-Mu1Yi58Pt936dQ2vw9x9yScnvSsGD4KrdBvAGD3OMCFuLDSXj42CrNKVEQJTD3yR
-nNK/h1tbiEYEEBECAAYFAj0DP0AACgkQlxayKTuqOuCeSwCggVvzIE9C73tVUvil
-R7R5usmUsBoAn2InryHTX7AsmLBzBjaI79xbPPdJiD8DBRA9GbzS29JF/LOyoSwR
-Ari5AJ9k8ZhNyiR6grJAwa4Iigq/oGVpkACfT3vl1YHpwt+yUMvOov/yhzKhZauI
-RgQTEQIABgUCPWeyzgAKCRAscOLGRDFznNZOAJ0bH1y2CWmpHxtcykhGSi89wQmM
-mwCgii8iieGXBawlNPJeAER2FJXymoKIRgQTEQIABgUCPaRE2QAKCRCL2C5vMLlL
-XAGuAJ9Y8YH+Gs1xngyJesAkLHnqyhyMWgCfRTMZ7apjOcrXs+0j53vcYeSIIruJ
-AJUDBRM9mvANs+G+7cUG87EBAYlvBACUWlrJjgP01FqtwFCaUleVttYBWmjYCXub
-Hj+ZU42BCfsRgiB6YdChS2wv8uA9GPn0o+OKIoTv3mPKphHHJKZn3+lhLBDsjghc
-B2nwv6Qxv0mMdS/1LjVYxCrXilMPTKWZYfbHHDIeOI/56lwceVFLeHsfFOkuZUsX
-RIVoo/KmbohGBBARAgAGBQI92CEIAAoJEF1BSuHgBcnLdowAoIkKRS3UN5p1Jds9
-69DxGb47DutDAJ4/+UpAcRAeU4FUlfOg553W8SZnSohGBBMRAgAGBQI92BdrAAoJ
-EGrVbP4ZMRsAhd0An3M4p6RM8Wg3FS5N0SXYdN6fEixLAJkBm1N9j7rVPFrPysB0
-Qb47cFYqpIhGBBMRAgAGBQI92BIUAAoJEMl8UJZcHDrXT4MAn2TD0Ep1qO/PKx6r
-7oWdOT0m0793AJ0fZsoJew+uvBEU7ZRia1vGXErQCYhGBBMRAgAGBQI92CCJAAoJ
-EPwPhYn4lL4S7PYAmweDkE1fdzHdraYzjkylmrvtKAImAJ4gH2LkSlXMXH8c6IBF
-YY58GyMAsYhGBBIRAgAGBQI92Ca5AAoJEDYVIteCq3vRIIoAoPzstX0RqEi9O6Kt
-/V3coeAYt+06AJoCRNIdj7Gf9jfQesdixpx27EVvH4hGBBMRAgAGBQI92CMfAAoJ
-EGY1tsDeiF3T5lkAnit9whQcSy6TVvtl7XUhHJGT4bMEAJwNAwvXBvNbycwJstzK
-P0LFL5SwqokCFQMFED3YI98kDmb8xZwycAECXdcP/A/As+JysKxhur5LcAsZ+QCa
-J272Kg9dBvsPr2d7IdvLyJzs7E4C8IXabvjaYAiZrA4cHBS0tEfK2+3WCUo5P5uh
-l3zKxhddzNul+2ilqu0yJu/+Ag078qRL2QVfHrrdRb7HWeHhMTjlIXMVHU0lUKmj
-dzySe40DNmOgQcRjfd+4vSWW3rUAiV5IbeRE5ZR37ZGDIyS0Zx443VukLwL/oO1C
-CA2eiNDhluJs1yeBjs8MzWMsX5P5KV53QCJjOT9IE+xUEoGskUD1DtJCJGbEXiql
-hpfw4wyNaxLBeh+mxSVLazg88JfcoNcHEQ11lJ7hKiZewJhl2oTxmPIxPcCshr4K
-SETyHsKw2FxQ3zJW/GONM7QLP7wf57wIJy3bKMPkWHgRUeQFjG9/CDdQRz0iwLwz
-OWaoLr7JS6oRepB8reukM4J5yb1+a92TW7YPe9r2xznSKWYlWrIZx01hTyRWkQIP
-aOIYBrf2gThaZXX/uluJNi97H/wDh+Qk+oY7DVK52i7KA5F4N/yRHIzeh9meLJpM
-8oo0y4mMTgSD6r+Sbk4YDYI8QYapkOnppeUW7PPD1JSjKPkEQOaZ/HGc6JZf4Xb8
-D5mtULc4MJ5x4kVsL6cmMyl6u+CFlGPpMSD1J33XH91muHgOPukP/pBzSLzznsz4
-2D6DD113mrGgdhYQIeIsiQCVAwUQPdgkUDGmPZbsFAuBAQGS9gP+OOi6LUmn10LC
-AWfoi6QXGBdS5bEMbXrKv925dH8SLa44LKcwG/U6WeZMZKznUPMkCglUCG+LoQoK
-WL+MGyHUbUwVDzWKzwsGdOR3T/dROMiUgw4GyciGGFnBfMoIB4L0mdWk7rzN8Io3
-aS4r6Fu3ADiHP8NCLwJvJngS+8in3MCIRgQQEQIABgUCPdgbLgAKCRCyvrxAFSkk
-rwfZAJ9DsO1nxRuw/yB9OCmoDwqjQXZkEwCeMczpSwyDe96Ocat18hg/nJUPsTSI
-RgQQEQIABgUCPdyN2QAKCRBVkeLAZmTAeM9wAKCh46jDqmzsLMkYaG7cJxk2blX/
-EgCgiEmEEAAa4dvte2GQddnyV6ZGZoGIRgQTEQIABgUCPd09+QAKCRA0SoRNdR1/
-JwoHAKDJK83QGRvh8bdVUhJZzsbJRNjglgCgmF9Xa1NIrqMDgp+it9BlETtYRf2I
-RgQTEQIABgUCPd1rNgAKCRBMxE0AEd+H6QwjAJ91JzeXNaCoxAYaLxFXVbjUB0GU
-7QCfc3Q69ITy1wYaU04JZaPjIrxgYIyJAJUDBRM93SELZLDNBRh71o0BAV6OA/9u
-YIcNjG3B41EwpdeiR2+xLjsbBAIek3d+Ojuf+oOmk3tdxRJ5Irt0x5twaJ8qLAMh
-f6oxu0C3rg6r9pAJM3aUEhu+KondpcnMgtrHew1qDxaegMqeogwb0gcBdJxYlwY6
-EuBU9PROHwhbNw/Ger3d9f1L/JgK85Kdsgu+6VC9O4kAlQMFEz3fjNLurUz9SaVj
-2QEBTC8D/RZ8sYP3QQvx9EZxfsM3gPlkXDGzfV3WuC/40pZn/p6BxXzeJommIkOl
-/7voAT+a4fHlWkkPe2gOJbPwJqYnNg/owAMhQFGbBCGPnWtRK6t9RwLRAleOJzkW
-GNH0oj/XniTl+Dl7xN6ZZQ0RHIzwJrzxPQI1S8tzeDx2w05l6mOsiEYEExECAAYF
-Aj3h7m0ACgkQMTY05LuSnlT/5gCgthoEVzwmErtYzsQ21Njy3hoDH1cAnjyCEFAX
-C216923CIpTeQowdhHfEiEYEExECAAYFAj3kAcQACgkQ7aJl2DRYeA7ayQCZAYHb
-SiLL9Zctr4y6UCqU3AhPbqcAoMJ5tDR63Cl1jbSxRcvhdsPaxVFKiEYEExECAAYF
-Aj4Vs6MACgkQWnWq/WQB8WGyLACfT83t7Y+df2bdiyVs9SKOipgMg88AoL4i1IEp
-1aMwRStOCSkGrqfGcbNbiEkEMBECAAkFAj4NNfoCHQAACgkQi9gubzC5S1xnSQCg
-nq30ULvQwLVltJ9Nq15HMhcV8a4An0QxsO2gBI+LlgZZg3knkpHHAU8ztDNMYXJz
-IGBTRlgnIEVpbGVicmVjaHQgPFNGWEBhcHBsMS5ocnoudW5pLXNpZWdlbi5kZT6J
-AJIDBTA8xyNNPo+38viDQdkBAd07A+dAkaK08KXYxLiO0AuO8uZLsD+n5dxSMtpw
-zwk+fRboA7qWAzmDp4+0w09lSrxP77M8M/NMKVRedFPKEM1xQftkdhSqhq+5ZguI
-8FdDmrjBsRV3lR8MTfBEuNE8d2SZB079qnZd8pOhIxdwA2AODmswzpwZ3oOEcbag
-KViC+4kAVQMFEDD5fY4JNGLsuYI5PQEBW0kB/0s9AqawHqJ/0rO9jsMhk3vuHNgw
-VF4DoKTL5EDIORETccAf4UZVJo+JzmjYxc1f2RkwkMkk/N9afKZmcNSYzteJAJQC
-BRAux7auD0cvWzTXTcEBATNVA/jU+bTUqnlZdrf6KgCv+hDOs6VO538cExQNsBl7
-x82Djbp8Q5t21YEV8LiFN1imuLYqHXqDEHt7qtroNaBYXgnR24QjI3urel+kYMib
-ZWxGrq382C2apReaEDmQ1qtEzP+kXexaawAzKMo8VKWMnXjQYBLZohuUqfciE9A7
-OQF1iQBVAgUQL9JDvxEZCRz6lM9/AQG2xwH+IQAJZEvldNHzeikez18Txy12EnJ9
-k+za2rjPVnlX7+teIY3VNO1homUgwqjoOHpZkdGgdOdmufOglT3Rqrk5FYkAlQIF
-EDD47t0d2bZ4cP3XsQEBdGsD/3F8CAWhAI+A/0oczJ2tzUPxDOGk54gB3VSB+Hel
-IdkcAwqGLeh8BD9dcXwcCOmw1pUIXVIA8xjl5jsSsb/17YuL4hzsDtSqo0bRzsg3
-+ISP6LtqdG57VzGeclb9FmpMlu5GHeysU22HfwkynvBwfvMJI/IdaW99SSaF81rI
-JsF4iQCVAgUQLs1+vx4pcI8ahJlRAQHwXAP8CKLDWFLJ7Fc3JZ0MnuPxW79M9nRQ
-wL2TI/Vd4lCUSiDOUdEvjU45MLmLgU+4OZNPeXaBSLkN4z8PUkxGEEvSeCFE7u04
-VNq1GJ2aC+fHVFzuWbp0LsezqDSnm6xvBxz40yEaZnkXu3+66kXZV/E4BNIkCaB5
-V2qXxrBIg0D10iCJAFUCBRAw+UUZPjTM7Dn4WRsBAah7AgCIWR/HNt+V20bDueCO
-9mhwGirq5E7TJU+C9xT+3BeZXmyy/AR7tWJdKnC6laGDLnMko3CWr/XRKD+rC050
-nNsriQBVAwUQL9M7ykMGd0cf7QM7AQFbNAH/dXBIx96GTyGsnUmcT1IxdUhN6fdz
-Z2OgN5imUdb5HsBurEalWuDDuJcPMPAFO4Htq78LqRd8HhdWfQxtm2rhpokAlQIF
-EC/TPkdGsYn74N6qbQEBe7QD+we/Mvd4GqIwzAvDcH4jSoe5eXAYdDjQPltYNzu2
-CxOVu2f3zoOB96Tro56lOx9zbAoZg8bQSkCCImV6ZzYODbdxe+ubfBD6zJo40CeG
-uvvAh35l5nzUlqjzHY4CVuMpDJ1GrBoYBdWfH5TTZHx+YH1vRq/FHApYCqmucb5I
-QuXMiQCVAgUQLxgZ6khfqy8j2SvjAQGc7QP/VHgeVQzjcJSPF2KfNyKM4nFE17uJ
-5emnvE2f1K4mi0NV4IsNEVKmYXYQVvQoPKhfZtjXzE9P2xa0gxi/heKBIHB+5H5K
-n4nUIt0/7POYhltkFz7cbnEzqeKm9oqXUOSFKUup51bh2aDWsqAI5dgod3MdRxqd
-40TiuShaVXAbmuGJAJUCBRAv0bftSUmmLBOdkOEBAc1GBADKJ3N1BTYxqJ/Bf6Jn
-NDzwN63x9iEuht9RTen0Wq1tT8JOwlpcd8IB5uoDvcX1eZQ4wSfpVZm5i8/9TGYY
-OuOnhUW7oLQWGzl8BOs5jaygYXIVbnlTjc8FjyAPAWbUdi8OgopADoSoJeJ3YPDz
-vFFIPIIdFVChkzwytDCke2QqRokAVQIFEC/SFz55jBgMe7ddiQEBqSAB/2a5delC
-8N/4Je09dRG52wPU9y417g+ExtyBnhFd89cG0adtu8jddmtz22rxCiY9Zn1q2Wk/
-PV7dbJmAWiMF+GqJAJUCBRAw+ULYhWrdG2nWnOkBAQUwA/9AUqFQsXW9kMi5RooI
-TiQbRynunPh2aqadVnuLZoAhxp16c+EQYpc4Qi6jLPBVemHdS4PW8vJegF1pJtDZ
-4VfLNwwkIxj7Y0hU8A4BcHUIfFdOER7SwbW/i7QTU8u3vNHfmgIodv19D7rFxEzq
-qPxMHRpIs8/IOG9L3zc3kV8rnYkARQIFEC6+xa2V04tRZnGpVQEBTi0Bf1grk33L
-BHO89ViuQTEJbQoJzb7s9IYpjT9hcT5eIOa6t7vItN3aj27lcH68Us8vpokAVQIF
-EC/S7ZyZNU6jaP3/TQEB25sCAJyZCXeC915C4DbNKaoc2sIRd2aMgiW05ZzxYUI8
-mMO3pzZwF2a7Cg5iSdZYYMwpe9OWHqU+AhXHd+GWGhvHEUqJAFUCBRAw+M4sm9pR
-g/CEGxEBAYOpAgDY/Zq9tIHGEWeHg357k0pEr7Y7yqMdBLTPlJwAIIocVKubzQmQ
-xHqIWUmQUf6dqZLXErvnHZOWwRR7c5GjU7fNiQCVAgUQMPke2r6CRZdmbMmtAQGO
-zAP/U3CbvKhXqyPupOIppb1LcNAPcspe3B6IN1gXSWn3rUhaS7IG6vhpgE1E5Arz
-bMVCoo0p+yb4Ve743oBhDbMRQkRSRP1FCCayt9TWrTrtmij51yTlPbO4f7+SqYX2
-3bwa/iOPFVOK3oL3Y0SFyK6007jyQrfYFPaaBfbDu12zobiJAJUCBRAv0zhK5cuG
-DKtEoMkBAf+9BACMYzfvQzBwh+a1D17/SPSfO1DBDXx1cwD50zI0eIatz4kLvW7n
-OPHCY7tHVW/tlIBp/0+yUX/XXzBLp8WD0E/4s7lPgPjjAwlN+Iwy/fRDhJ/Gf0Nf
-03eJjMvU9MeaUI58JBCq8LjnVdtxcQKqapYcSogjz//jD+H3KuX/kX+5eYkBFQMF
-EDEsVbzwiYRjAFcYEQEBVCoH/2OA43qNfPmQH69ASpdeD9vXSit6fDi3J6l4eo7g
-X00YlpxSba0Hxh/cN6UL6YtkUbg2U00M4TuHjqtoOYMvTMrVNYbS0VaVcAZ5poy0
-Vs9Fhqq+MuGVC24N4WuTbHwaaXYBypOWPgabbyC/9+2QZM7ZIgV37NGW3N32UeG0
-lNcQzhPh0tAaHzsbm6n2awmbwIzAguTSeEddx/MZ2IOjSkAgKjn3gjlVpBp3PwSu
-1QKzF4wvKP/Z0A82Nn0TyDT5wm+H/+D7p8DqxM2usy8V34Da2kCdfW6D2/6PQwZb
-zTlpKvYEplZ0xJKqxDLYl3d9SgFPy1QkR/+9Jse12ZBefzeJAJUDBRM3qDRS/S2Q
-kqiQeyUBAfIXA/44omiNe1tswtoLSbqmatLQQDliRtXu0OzXGnXxkKRI+InHk+aU
-ziuuJr8l1oTFFKvbxKvEjzaMJNbOvN9LkMgEH7XKOcWfkbk+WWKj8d32pLuUNeh0
-WgXiUBH8crNeEhDD+yvH4rj+Ihy5ly8E4TxNBLFANFU2labWkMMLaOa7iIkAVQIF
-EC/SVx/9mEr5stbwpQEBz+sB/2uYnno7jRBUPzTf5tTXNKJITXH4VRG35x4CyjOq
-j21oWhEgZdNrwymzBK3IAuckqnIOQYSdN9F0BFVC1wTNgmeJAJIDBRA8xyMUPo+3
-8viDQdkBAQiAA+YlSJjf9yMCd2qZ8AYhGVF3PvN0KIaxSFVDVLoCbKSJXTv/0biX
-1MPVHIgVjQOSWe9uVfWgIzhogTBmQbymuGGZOzCejzoiVXaFwcM2Gi3+bau3+Zcg
-3qMp4E3oUSpMPjRu+JPXS78sF0SkRbkJocS5znUVnthUSC14Dprzf7QzTGFycyBg
-U0ZYJyBFaWxlYnJlY2h0IDxTRlhAYXBwbDIuaHJ6LnVuaS1zaWVnZW4uZGU+iQCS
-AwUwPMci2z6Pt/L4g0HZAQHWaAPjBALNx2Em/tfMwY2tsJAmcvTlZ9IPXRp1z3Ll
-03pL8cu6WZwhMN4ej/BO/noZYTCCk0M/3UyYupSrhuVR8R+N1ds3FBZbX29bP/B7
-9WuOEUmaesMhLli5mzNs54dTGAExbjqC1ZnescaiFcIEZy/Ns7kUA6rWbhDywfKG
-aZGJAJUCBRAw+UKqhWrdG2nWnOkBAeh7A/0aKD0eqRZ0orAnq05T4UrwyNoJdh1D
-BcNAmSeSSlZY+RhQ2aeY5dMoYAhQsHhbhO0VIDDpLxnhKBD2XsoqWnLK1SHDtumg
-kMnqy00HeiU4DrghHhL5IwcIqjq1TUhDzOU1j80HO0OyA7Sk7Ak/sTRrTuj4tvgK
-2WqHWU7aeLV5AokA7gMFEDDhUjOK3WTWEs11KQEBgTUGwQGH8Ic7zNaUlRmYm5J8
-R375iP8CrJ/xILbET69VsR2aDG2MA2z8NBBkV1ARrAC2YWa9sO91yCyf3NAI6I1o
-qtbv/09Im/s0bTu66dWrqRAiuTB3Ou+gHJ0fc85gTWcBd9/xS/mNlZb1/ZXjkBaY
-dl0Bzm72c3+HqZjHzT3nlxVY5HCi15J4iDgCuCPzeo1r8QgGmsbP7fD+0Hka7tlX
-b87WxPZt+nkjGS9xmLrNHw5/vJpcN4+fzevzhTQD8IcsUr0QcZUH9jZpm6xWpibP
-F5z7FzXTorguf+WJAFUCBRAw+M4Lm9pRg/CEGxEBAd1UAf94iAKTp+jf8y/G7sgR
-J0Msz+jOHXjK9nPoW8L9Uq1KnnWCiqxXmMj3AoA0iOict47sYm5uM76Woe+wRWwZ
-D7CkiQCVAgUQMPke/r6CRZdmbMmtAQEP1AP+Igi85SrIpEFaMeAkPvOiyTENAf9h
-WEm7n3OgIQ4kbBcU8uVPdx6Z4wJpUtrle+gOcthZn9t8jmcV328X0bDBuY/z/Hf1
-nc3bEp8mkPx4fmKe7kDC0iyR9eOZxmFJ8OC/ZekBoWKDPfAgG35duQ9HEknF+oPm
-gnXKzSo17RTqOPKJARUDBRAxLFWu8ImEYwBXGBEBActWB/9xboWXOY54i8n/fIHu
-+FI6WmK+djTSIqfPMKlYs5qxoLg09rOGo0h7AFrTUpK5qYiJxiTNeTwx5pOrkRpB
-8nID4211ZKb/f+K8pag7gpqoltU+fFoOcHYoEf7aarQEnitLiLaNVm6ilu0wAdX6
-VBQdpUfzbphoU9r7jbkD8f45qqfYR2QvzR+kgmwAKy51g8MYIpLfNwyOylUrVxeo
-1EPMg5nwj9e3I0QmnDXJEZ+3iOufiWP2NTjLS/qwU63qOm68CbJE3+l5vCNgnDVh
-7r3swySfScRp8fnkS35d90E5g2bdJv8naDyPYlVWE3okq4VjIzWS8rXdGTLdKIs9
-TMP3iQCVAwUTN6g0Of0tkJKokHslAQHbHQP9Fq5S9UeaqdsUY0cEkKZzkQpud3CB
-FRL5uNy/TLEikV2yXGJlqKyiKo1CpGs8sIjprs/ASVN9DTNvc+86C4szLjNgFRq2
-m52ivF4OyxAgTLQCQ3KEi05SnM1SgC/OKX6rPR1Ss0w8C9UQP+jeKYL21UJjxUtE
-08npogtN5IgjNrSJAJIDBRA8xyFgPo+38viDQdkBAQ4wA+da39v4prHsJRFyCimD
-qqOaMBA31weXM9+VwXtiJK+xYdY2W1WHuk/LgSEiCG3XRI7SkdhLSA+8e9zX/8bX
-Z1GfFoN2iBxa8Zx+s4e15e3fwFPqnpOOGf1g5pOtPgrrT9NYgOF9w7GuSfVUk4Ks
-SVuP33rURLGnfY4xupUk5LQlTGFycyBFaWxlYnJlY2h0IDxsYXJzQGVpbGVicmVj
-aHQubmV0PokAkgMFEzzHJII+j7fy+INB2QEBI8ID51RHz7Ph6vGOZL++1VlLq8UH
-ynvnTuhlFwsGSrsdD1lZs/NGUIOrAt6XiDREmdl6EXXzynzVvgt1a2uuvWXd8LLC
-0iO0IvVgf9VhejQu2Hy7dkePWSWXr6WDk0Np3su214B9Wg2pOuNnZI4Da6ZQhSdi
-PiGYwHpsMBwQMXj8iEYEEBECAAYFAj0DP0AACgkQlxayKTuqOuDjkACfWbR5le9Z
-2r7pQYjgZoxnwdmHQcEAoIKxUG3XN+giUetPdAzKUcqI1Fk6iD8DBRA9Gbyf29JF
-/LOyoSwRAndOAJ4xoxylpNNYHf6uCYArmxQTxvwP8wCfXiwiBYiLgJreewbY4N58
-Z2qDy9eIRQQTEQIABgUCPWeyzgAKCRAscOLGRDFznK7lAJUeHMiB7cf3RR7FrvgS
-V5CnCu5qAJ430yl+G052F3d5eMpNx8yKYJob0YhGBBMRAgAGBQI9pETZAAoJEIvY
-Lm8wuUtcz6YAn0N+Tu+fDOpTCRlJ8XDM7utgansJAKCcaWk9WmhU60dp8MLfmrdT
-k7tTrIkAlQMFEz2a8A2z4b7txQbzsQEB2g0EANQfBdutEsim81MQeLu+7IslJJq1
-fY2oiPxBifuE8qHG8KjwTrrVSgHiPbCAr8YmAYtJLXRmVCO3p726sIEJk5+fhq+l
-pLgq4/aay9DwtV6N8Un8tkMU62mV4MVoBfkxchCAvYJFV0JFPBW1Y3YJs7TU3EjA
-2lR4pBwhK1s2VO+5iEYEEBECAAYFAj3YIQgACgkQXUFK4eAFycse7ACghPizmKwu
-kMGfHkycZ7BMbXZOd5gAoIUTQE9SNhpI61W9PuWttMKJGthhiEYEExECAAYFAj3Y
-F2sACgkQatVs/hkxGwC1BQCdEocdvgS3BSSM33sEVtMahZ5N0y4AnRjCy7YlOUaj
-rhSlDUUJKcH/9+nSiEYEExECAAYFAj3YEhQACgkQyXxQllwcOtetsgCg5JGjx3qz
-e3iguiCz1YeGWvhZUREAoN4wPchwgEIPZQTQccm39Ssr14vOiEYEExECAAYFAj3Y
-IIkACgkQ/A+FifiUvhLfCACeNrIoRYmww8AlGuzC2icyAIO4HqoAnR0WxMvgNJ8L
-p9vWaHcjSs6au/MiiEYEEhECAAYFAj3YJrkACgkQNhUi14Kre9Go1ACePRg49ZH2
-KmW+vaDHRrbwXdSNGwAAoLejkLTJq6rpFCOwMtiQ4O4+xiCriEYEExECAAYFAj3Y
-Ix8ACgkQZjW2wN6IXdPC4gCfYnFZ5ZDlATc/oDFQ7ZhaNKyWBVEAoJhPQc4xbV09
-eH+xDkKKutvPh6LiiQIVAwUQPdgj3SQOZvzFnDJwAQLlUg//Tog10d4EAAmXKRhV
-cF8osK1dEZ4i0O+0zd7W84uzngRVPSP9fVjIcKEAq44MZplPQ8dLijlBbMrb+7C6
-uUSphkk88DyGjPUbH5HBUmXIyLPK4A+I5WDTRspYh5zj82PQ8EEgnPeY5SDFoAOm
-vemG5Msr8BT1FwdrOPbZnaZyoLDPpg/XdTDFljOnrdQ0LR7qL7yG7UJrP1z2kCzv
-S4CJRdcxdaGiPOnl4Yqp7vWe1whcpjBVsmFA/rzrhK/zLHaGn/yHQhi9g3ExK0Jh
-kJIP8g26UpCLKSJ57/3ClK9l7vHVDX7g6r4+lKzmH9P8RuOlOjabp6KCwSsMEIpV
-FS/F76+V+i4IYCe+lgXqlLbrFodN6FogwhzfceBx4H+XPEf+/Bm/QD3ArbNNbBQN
-Dcf45feOJFopmIueWuGVVUiJ4lin1WfRCRZOA/LF9wYXBkEKV+Xje/mkY18r1YFE
-5I/ZtaviwIQs6kaD7DerTWpbVbxRv5RaVDIo3NozxkvBZZV+8EXm5k5TXfxy6nbv
-dsQm/UV8Ac8MYjVVTlLYI3jS8wMtZMKZV/XRuw82syYQL09a1hTQYyjbeuXEGYhN
-6frqSoHl+1rNFZ/Y74Oah4oPb50lH3kW3OUWvH7xORcCmz89wwNC5FFX6xxKpT9d
-MlyoPcuhd6+F67meaZjqwZ8KwdOJAJUDBRA92CROMaY9luwUC4EBAUqkA/4poVCt
-2CWOvGyCVg9CedyT+F552IzQuWM2BsuMdwgfmEbzz63G6ohDXzN9LxF1E9hqe8RC
-hVCR4EYkVV3SHwK6ZKKU2TTUcf9PR6mZKXSKmb2eEY1PrmgmfQLtONWXU28v5PZl
-WseLXKnJsPtRhDq3ybWRUETNrYkzggb8xpWeFYhGBBARAgAGBQI93I35AAoJEFWR
-4sBmZMB4+6IAnjFQD73eU0GAv1G9FcrxZkLLK5+uAJ9QRU9eaKbh9ppE9XB45Yp0
-l6uLLIhGBBMRAgAGBQI93T35AAoJEDRKhE11HX8nensAoJR8foKDOiBir79UIAQI
-aqKZj2q+AJ9byxSuWrEYIjLgNX1n/6gKkfz/3YhGBBMRAgAGBQI93Ws2AAoJEEzE
-TQAR34fpPQIAnRw1AOmI/Zu2jIF7gs9lYDT674zCAJ9Trf3hkd6fJ6Ht0TDB5Afu
-4h3r34hGBBMRAgAGBQI93SIKAAoJEFz9N/rMeMiTfIkAn0f2xve55OEI2swMZtY6
-khgTslz4AKCtFr6G5Ao1BdOFkbLfZ7e/EqieEIkAlQMFEz3dIQtksM0FGHvWjQEB
-y0IEAJyShUw6Ce3rhVoWxsu1Y8trO54vonyZ/Fvi1iVfWThK7HOtY3n7FbePg7V6
-riUV4oNWVakIgABi7uO/g9r3pcmBmifUMPKz0Qjo6+evA5d3ZalcVRFamSFlBRCr
-VRzVgL9JRkWvlb+nh1gZc4zaLpynsG23v6ou5rXa2c0/cyQwiQCVAwUTPd+M0u6t
-TP1JpWPZAQGwuQQAo1u0FeIUyYCczjgqvnmVGSWdy5eEV5nW9OxhsOJd7wjEVDEZ
-8iHprLLcvOfYdNxx5yLkh48bPFzuey56HEz0QVWK0Ezr32k9WygrpbsDLdApGiqG
-umQbvfLdmmk3F9Llyb58qLuVHyJGa1l4YYXCQOoLVMNekIhPVULh/XVxtn6IRgQT
-EQIABgUCPeHubQAKCRAxNjTku5KeVN52AJoCU3QuScdnWAKYXH+KFNni07/CswCf
-XZXXuOybaZLZgjCXrK3ATbZshe6IRgQTEQIABgUCPeQBxAAKCRDtomXYNFh4DuPA
-AKCcdiby1x35ME9t6YNfyTgTT50USQCfaKoyi7KNaTE63XH+14o92ikJ+PSIRgQT
-EQIABgUCPhWzowAKCRBadar9ZAHxYRwYAJwJ8wzH6IwMH7lo3gYRqduVfH/evACc
-CpFNrs6EaZEzGacXtVgnjnwXTPuISQQwEQIACQUCPg01+gIdAAAKCRCL2C5vMLlL
-XHbbAKCsKVO8v606BEYa2TwRlFqgXq21igCgnqU4zpGi7HKxMhEqhe/NaIL2dkq0
-JUxhcnMgRWlsZWJyZWNodCA8bGFyc0BlaWxlYnJlY2h0Lm9yZz6JAJIDBRM8xyTM
-Po+38viDQdkBAZUGA+dj7+znMU4Q8yWMiPRL6RSLKCWZf3IPHwPgRoiIAKy6FMOU
-vWC4TbduBqcApI7+Xuzy2V6HLSlf9XGILj/aFI1zw905705ON2fRKeueBrVZ0576
-izfTmNxSZit8MTt9rQWInnVhU6omrTCqzdVJTu2lTcAeeAa00kPm1fvBMIhGBBAR
-AgAGBQI9Az9AAAoJEJcWsik7qjrghSEAnAu8h2Wz42zg0w8qQBWCKK8U0RGKAJ4y
-PTXtnRyKse96SwajcZGeUQwdTYg/AwUQPRm8sNvSRfyzsqEsEQJZHQCfSsP5J6Aw
-+fgdHGx1KiYf973EYYIAoNxaj5ZrXhKG/+9fEWEDNNkqND5MiEYEExECAAYFAj1n
-ss4ACgkQLHDixkQxc5xvcgCfb5ua8g8L87M9risSGJX8TrWTHc8An12HAxgXcMdd
-uIEag3T5FH7lU4cUiEYEExECAAYFAj2kRNkACgkQi9gubzC5S1zOwgCeJRqvA8Kt
-dTW5ytZe2Pk3Sj1JhFoAnR/XXJxDswWiIfsmyYamwlRfZ0joiQCVAwUTPZrwDbPh
-vu3FBvOxAQGQjgQAhBKgFpJtp2AoEXPh+5Qw3VA9ooXGUmdI6XvIWRGPL+cduO6Y
-Fz3JyvD60P/kBVCqq7GaTPCKFeaedpZbEOa2FdtuCi04sCgLX1DO97JhdeW/+7Oe
-bnIt2yGd7sZH3GDOy61VI2iTxrvVWzAFf+JLwCByvOprFLly860Gy7jjbvaIRgQQ
-EQIABgUCPdghCAAKCRBdQUrh4AXJy/NlAJ0fFmMipOTp6vslz2O9spLapldGxwCc
-CJ6lzCXC32O5QCSOEkr0ab7ZXeKIRgQTEQIABgUCPdgXawAKCRBq1Wz+GTEbAOLM
-AKCBYhZPY2It9Gs4OB9InCJo4FLtbwCeMKiPDrlf51uUKOLsWh9ClNrY5baIRgQT
-EQIABgUCPdgSFAAKCRDJfFCWXBw614gTAKCUmNiiyFPS49Ba7cs3HRvpQZW0ZACg
-wV7OY3Em3StOxlyrC6dsbjdVvgmIRgQTEQIABgUCPdggiQAKCRD8D4WJ+JS+Esrp
-AJ0SLYNh5KZE5+CICruBXMxkCuA4JQCfa6K1vj53RYafQNH0xKwFZEGh0JeIRgQS
-EQIABgUCPdgmuQAKCRA2FSLXgqt70SbiAKCmuozsDmD/08yLEvdd0V+s7X0yJQCe
-K0NausfA2RcjMUTVul9YzjcMF3aIRgQTEQIABgUCPdgjHwAKCRBmNbbA3ohd08DG
-AJ912o5jWryb486jhE6VtCET38+AlwCfe4eA6J0qr/NrZLQUPOcuCWfwPACJAhUD
-BRA92CPeJA5m/MWcMnABAk9iD/99S+k6PW8u+F/wF5ZmBQAtchOewRw/q+wOC66O
-BZbxIGn4C8R6I6vjHUP+e6zdjABWqfFAqwlYEkjm60MPBm77Of1Bd9NAEPpzg6zI
-6WOQdg7jCUMbZOrQ5HCSCvo5qEXaCN4qvVLPjL5MamTiQio0fdGZqUL+Xtz5Ypy5
-/K5aW6XKfLuFpIAvc56mSFHNKjFYi+94+avI417s6P+MPgijz5zbQkZqbrLaCGLX
-njZVxMX/Dz+mKk82U0oVsQL2ht6TXQWy2co+KAMlDCKZIOJVfCJBRjeo5/vfjMad
-GuDPnlKTJAZe5gtATr6jukvllg94UxwUyv8bFsV+khBKdd5gvGwoPgq2DTSOVbk5
-FeZRY7SSMHMPsqjl2ARHArNeYR3S3maTExwTkWKAHifNY9SUuscoyVnlNFPhqRDz
-oLbH/TnCNBxDzf8ZqdEjNpO0nhPm/ej4edGj495Pgt+6m63B2dtEkUYfpnf6oS9h
-ubCfTdVbuJBihySKtL2LDTCuWnySsj7QarNFXYWHQT/Lj4AeEXxGeec/z0m1N7De
-5wmdO8qjZsi4810xTj01FhmUm/Cf4ejnP+pnF1fU4biOHTML0lSaBvk9qjU+uhoN
-r28wXYKVq3vvQn1kXUWWubBI5k1TnpNPxIT2cZuVySxalmtIAHtI8519oOr8rJKG
-PhDgzokAlQMFED3YJE8xpj2W7BQLgQEBgtMD/0kxmNPp2SM3hzv6ELGLPrhluGA1
-f40+tvea157/xcGYDTr7370KUoKOAG9eGsjtp9aCCOUr/zBdrdMdkdEP4VsdPNUF
-MqvS+DU8DcqaD13Tjkzz7+TqTO8Q/iYvPjd9khXNlk8zPh+a4sdaoaYz3vAzovfj
-A9QlcWXgy0ISToYhiEYEEBECAAYFAj3cje4ACgkQVZHiwGZkwHiu1gCcDf/xdDgy
-zOh2gxa4vdxe267zd9YAoNurihcjNyCAF/iK41q2Kq2rJQUCiEYEExECAAYFAj3d
-PfkACgkQNEqETXUdfyfW8wCgpF9UPAyc7cl6fJkiHBvonLpW+JYAoKCH86A7kK0b
-nfeQLq74LgIk0xG+iEYEExECAAYFAj3dazYACgkQTMRNABHfh+kk3ACfZo/G108n
-HpPjrQxOLRVsGw9d1OcAn3ZxDF5jXOdx3/WmQgW55+qQcKfniEYEExECAAYFAj3d
-IgoACgkQXP03+sx4yJMoQQCfVxNJAYt9MBJhFmR6JPAC9l+1ckIAnjyfT5fwq/dZ
-2ZFX7DbaihqDu9mgiQCVAwUTPd0hC2SwzQUYe9aNAQElxwP/VDAgsM5UfwB5UX/s
-TR01+8Qo9C0rlEES/P6BXOIZGfBKQ5b48c6FnbSQaPV9ofWjim2Ypu5htAXj+0KK
-Ujsfpx2AUia1aBo/c8p5mGe/Ts8vkIGMLkzUC4LmtXPRPc+ytyJQuiT+NXE9ufY0
-Mn6i6mgku9brMAi9NIqZnNdPQH2JAJUDBRM934zS7q1M/UmlY9kBASVaA/9XCoos
-OyUY+I3ERk+oosbc49AS0K837NkqvZGabAGx/Mwf2kL1naqerdMCS1wpcccYkZvi
-W4copWlDb9AfRr1C99CuoPX5LGvc5gKrNVvsOUrGrBBfhu8vjzOwD0k+eAqvegLt
-MxfkCjM1Ap3pZu6e4sClFIuKEOmUSQcRdtYMN4hGBBMRAgAGBQI94e5tAAoJEDE2
-NOS7kp5USlMAn0XYhqQFMLM/tpswZqkIudQDFeZNAJ9SuhSeAjnPyM0Qb9xWik6/
-CLsn3YhGBBMRAgAGBQI95AHEAAoJEO2iZdg0WHgOP2cAnRcINt425OHmBhMm8uJF
-Q/PDOYYNAJ9Nw9juAd6Zqu1N1vx9HVgWluNSEIhGBBMRAgAGBQI+FbOjAAoJEFp1
-qv1kAfFh+KoAoKy03qRC6JP9ehyNTJm8TGQ5uBDUAKCUvfLtj/ofHRhqDE60RjWV
-MLLBPohJBDARAgAJBQI+DTX6Ah0AAAoJEIvYLm8wuUtc4IEAn2T1HffAKkajXTJp
-Hn+RctMlc3txAJ49LFjccadq2/QGIPU4aVmPOLGk1g==
-=yvlm
------END PGP PUBLIC KEY BLOCK-----
-
-
-
-Type Bits/KeyID    Date       User ID
-pub  1024/28AA55C5 2000/03/02 Daniel Lopez Ridruejo <ridruejo@apache.org>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 2.6.2
-
-mQCNAzi+5mgAAAEEAKRyfbHaGoNuWwHVSa/5mRbWdhDTkR26z3Uwq4KdCZ2Wp+b0
-VF4Tfh6d4IoK2jXKBUlUfq+v7FYzSzYdPCmwB9L9cHlaU/ItfcWD2G7rIHyO/lGn
-VXK/BGUPoOhT2yeO8tf6oe81hmN5VzqqhG/SWEkwlJASRX3ApyanqCooqlXFAAUR
-tCtEYW5pZWwgTG9wZXogUmlkcnVlam8gPHJpZHJ1ZWpvQGFwYWNoZS5vcmc+iQCV
-AwUQOMAjHyanqCooqlXFAQF9swQAnVrUersSbO/SrT+nnwgRPL/xRMjGCQe93gUe
-JPcOOYU2be1tFGynJl842SIDPTHcJVg1hHReO93K4jvQKsbmT5zrzIlQ7hVB2u48
-WNcgsIKWIxcGaMp4+qsDOhN7Fh7vIEZdRRYhL7YcGKZ2WnXOZnGsKSD8VZenycwQ
-cAA4xkA=
-=3hIM
------END PGP PUBLIC KEY BLOCK-----  
-
-Type Bits KeyID      Created    Expires    Algorithm       Use
-sec+ 2048 0xC808A7BF 2000-03-09 ---------- RSA             Sign & Encrypt
-uid  rbb@apache.org
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: PGPfreeware 5.0i for non-commercial use
-
-mQENAzjHNiMAAAEIAK+iTnKRHymuUYmRRe6JlH3oN4GfpakM6CITpS0aM/piJBX8
-MNgcCUK2tz8MSCqAlfF+2r0hGRMSQ+UpXqLXcJaCkGIvXtlKmxCcCX6R+LDCnzoa
-QvOar3+rKFFJyiauyV7VPucZZhFKesReG6o53uoOAd0jyzcV9TdpAIn4Xl8W617T
-L98GdODY9jK0zfgGo2bSgPpo2YswlDCGbYzRX6bfEGmAbP4t4UnP1ikVCE3NTIyz
-gT4kywMb5AT1Tm3FbwTx7rXc/nL20t22VTJMjyCxqPrOTs91PxdXyTAQUKY82x+U
-ZgW39f6aKrJHDEJtxOyym+B5NpYgeP5QQsgIp78ABRG0DnJiYkBhcGFjaGUub3Jn
-iQEVAwUQOMc2I3j+UELICKe/AQE4yAgAkNXkalNn8Xi+v3BFCmHLlB7PKlItzlS2
-PnMcTJPgzO8w+PyXc5lzS3dnqLEBoCwRazEZh8ncVbeBJz1LjQU67gvCBqyFl+3n
-r+Z8k6cJYw1AzSK9FLAgOEtG8IdE+jsPq39xORpu6Dhsuln++G1xaK6fePeAEgR3
-qH7gog/SFCa9QXQd85wsGRlQlmMwe/HDyoRd/iHg3X7mr4yB+zYkxYKDD+TKlSqq
-V23n0H4n3oTI10PfaB8LDYVuPiQvIRn08XKUv0Att1KPH6iJTIJ/KRbZyGb2J+1r
-RO1nBGw+qaOAw4wUQXOpJyXVUeanIt1tSe8Gczlf/uxJZdCNSpgeqIkAPwMFEDjH
-OY/9b4jGIdCnGxECdl8AnAvSwMQ2v2ryh2NLL4FgfVLCjb40AJoDu0jaEqUinZnp
-oMBmjFgtsDYp+w==
-=5ByY
------END PGP PUBLIC KEY BLOCK-----
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 2.6.2
-
-mQCNAzjJAagAAAEEAKkko/H+E4+c7OXgiNfBCwlU/PrxPovDS3/JCKuILnflbNtC
-Lxbqvf7LccZ4LoiHOKd3+G4V8BgaTndqADx4crEsS0BpNrJdshPmXajzkdQeo6jN
-nts6QJ8/mlL4Q+s2/8dnleCrgDkzP4DpAIRGK9OARE/TKmUFUonO2YYGoUwFAAUR
-tA5yYmJAYXBhY2hlLm9yZw==
-=dGNO
------END PGP PUBLIC KEY BLOCK-----
-
-
-Type Bits KeyID      Created    Expires    Algorithm       Use
-sec+ 1024 0x00ADEBF5 2000-01-25 ---------- RSA             Sign & Encrypt 
-uid  Marc Slemko <marcs@znep.com>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: PGPfreeware 5.0i for non-commercial use
-
-mQCNAziM6n8AAAEEAODTLW2h2homp9NCjlsNdQQQACaUgrEm0sO0Lr1BVSp35fFQ
-a6XtrIxQXwcvBqM0py1ea2zcmYqnv6vY+7i6sBnxiNNugH3ShBnOYeCaO6AzQNaN
-2OvLkB7+1AoDmbU4a/+APtLrhzYzUj4DmwSmr7wTwdO06PsdM1Qv/g4Arev1AAUR
-tBxNYXJjIFNsZW1rbyA8bWFyY3NAem5lcC5jb20+iQCVAwUQOIzqf1Qv/g4Arev1
-AQFTZgP/Q+/pcNsCncKr4x39f/N5zXine0zQaKY46ek+PCUrhDm5N8cFTyijE7V0
-huRDVENAFkwtznz/H7BN0vtMRlvUQJOPFa2UaN8zIbcMIzSbiNEx5nvfFeT/Gr52
-GtnrQ+BvczfaauJ0Zw4p5uq6na/+0iyEf17d4qrhIBftlO3Ti+M=
-=+laC
------END PGP PUBLIC KEY BLOCK-----
-
-
-Type bits      keyID      Date       User ID
-RSA  1024      0x62C48B29 1996/01/22 *** DEFAULT SIGNING KEY ***
-                                     Ask Bjoern Hansen <ask@netcetera.dk>
-                                     Ask Bjoern Hansen <ask@plys.net>
-                                     Ask Bjoern Hansen <ask@perl.org>
-                                     Ask Bjoern Hansen <ask@apache.org>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: PGP 6.5.1
-
-mQCNAjEC6XcAAAEEALdrW5rH+2XOKX2zAPQmgomvHGADJedG4Dxf3Ci3HpGmKazV
-Uoo/f7Vf21ldvBBYC2CMpJU5uiMstNdrJ8Rx0KDBH2pLXsfE4XvVm8cGLbHcJycj
-cZsYl4yppOufL/76kmpP7q0Jni/pXrkYg2mLG3lCN3JoZqX9tvkoKP1ixIspAAUR
-tCRBc2sgQmpvZXJuIEhhbnNlbiA8YXNrQG5ldGNldGVyYS5kaz6JAJUDBRA1eczx
-+Sgo/WLEiykBAZIjA/4+uCJi5WD0p3EFzOnmkZRxf8egjQlFdBDVR7sixVToZCze
-oZZ9EVianFbwv8XU0McA7FLSUala0FIxRtmOs8/yN96rhBqJnYfLxu3b/ZRpBf4Z
-UExXQbussUX7AsPUmFim9Xp8mTy7xDEpcfiBnGY9Dtx+nmSvyLO38W5VvKP1qYkA
-PwMFEDV7CdYJPTjw/8ByixECHSsAoKUySg0ht56Rjsct6ViXjWfVEF1xAKCldK5x
-LXMjefgsiuW3n5seRVogQokARgQQEQIABgUCNgEYdgAKCRBoqAGJariS5S72AJ9N
-JsXpts88tCq7uZiirWlL54vTUwCg4A2urEUCEPuSz5deMyMX4lpjN5GJAJUDBRA5
-Ix6ndTAZgHu8twkBAZDHA/0fiaJSxGAxIdgYQY1KqYJGWg/E7Gwn87kZyiRHKUaJ
-gP4IA4PVnh0rMtTTo+CWyzcqMPjRAZNDW4ECWymrqqNrYgqy/NrcN4h7LZC5wmnW
-hXF3HdgAgxIn7m2YQOLluNqIrhVKga5G9/xytZLsF15qZbvjyX4mqToOsRqAtUBI
-ALQgQXNrIEJqb2VybiBIYW5zZW4gPGFza0BwbHlzLm5ldD6JAJUDBRAz6gMS+Sgo
-/WLEiykBAd9fA/9YdBn26x/7DE0by/Zzelfxu8o4AgZOV0AuWqZJebXKjeFmkJ0B
-lZRaC+NUcvpXOcANP6berJknvAMjNfTD1wi89XUVlbisDSW3UMR7Op8EpYjqLTo5
-u+KmyS+ehhQjA3somcJc8fBdnGJZ17cKWEbzJK+oJBvnzpjtgtvw6/oH/okAlQMF
-EDV5zQX5KCj9YsSLKQEBbk0EAJ+CwSbR4QQ2pgyXV7U4P4+1xSXa8U6IuI7AX9Fm
-LNlDu7a8DnJt8trZxjBcEMZcfoSNmbjIzMotzl0vvtDpqYgKfJ5Dd3eUTRCDYYS7
-8DoYcuB0cunBoGijkHS/2IkucAZGgcnNjPdhm7EnDJ/4F5VR9ZByqXiAIhZ746bs
-Z+nrtCBBc2sgQmpvZXJuIEhhbnNlbiA8YXNrQHBlcmwub3JnPokAlQMFEDkjD+v5
-KCj9YsSLKQEBEK0EAJBYAopnB9/dun1G0t+TKWVwGQUi56sWd5bwLypHklf/fy2V
-QPjCz9QoI0L/jAguBrqCfwtlIHRHMwzvvNWLRtuA8oiTDl4w2gO2vjy7V3Y4qneA
-3U5CYRT/ekvK42d+aHA6yMeHSPlNEQg09Idmee5Lub7kV8ejjtRZ8s3jcZ0utCJB
-c2sgQmpvZXJuIEhhbnNlbiA8YXNrQGFwYWNoZS5vcmc+iQCVAwUQOSMQB/koKP1i
-xIspAQGtCwP9FFWCZN2540lomDAY6tXt7Q3AhP/CkAec5i/lsv21sUl09jlZQnr/
-Kc8hL1lPOuAlLFGqso3zL7KMVlrOIng+R/E5fcYpE60QhhIoHdvlxFKTJ5GZq7DG
-stCrR34q2A4OWtoC7tF0Uu+Ew2ontVgvqsrgq4qt0h3yh/kABp/8mRw=
-=GGxP
------END PGP PUBLIC KEY BLOCK-----
-
-
-Type bits/keyID    Date       User ID
-pub  2048/10FDE075 2000/10/09 William A. Rowe, Jr. <wrowe@rowe-clan.net>
-          Key fingerprint =  33 16 9B 46 FC 12 D4 01  CA 6D DB D7 DE EA 4F D7
-                              wrowe@lnd.com
-                              wrowe@apache.org
-                              wrowe@covalent.net
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 5.0
-Comment: PGP Key Server 0.9.4+patch2
-
-mQENAznhOVsAAAEIAKuVs0grRRD6sNsgkr78WHvgpxf7ExaKI/bWEtS7eiFwJ+JE
-qP/ceM/zpot1wzUyNAVC+wiOJaj8CXyFrrmsjRM6zO5hRE/Hkf4me4ZviDP2lJTH
-suoTIcmSRdY6q3dIFQJVWPeDU2JhjAE313R/U6G/uJ9yVK86YPEC/b5Wr1XIDwDR
-GE9X58tZgMTDftYM/1wxeQNNF9kyFQky/45H/iXOirj52RI+gchkZfgRbfTSbF8r
-zSvs+JTHJBiSv4SpcPMq/ZTsxju6BIxb+PVaRVthIGcgRrgSgjPyTQYuPzcw0Zi3
-W3zfhlXCYngtumV9AM1uv5teiKlP9xOoeRD94HUABRG0KldpbGxpYW0gQS4gUm93
-ZSwgSnIuIDx3cm93ZUByb3dlLWNsYW4ubmV0PokAlQMFEDrRq1BTB0fmI+nqtQEB
-XhkEAKv4yJlR5l9hxDkK1L4/tW77LPAd+8dlJW+KaciyrfbBw9mphtzCrcSYsMbB
-4i6UEIezgp7MGftxSYAB78B/Cz2f0MOntgddqlsVHhNe4b+sgjrgXu/Dgu6S0b0M
-09oTvsc6RBjnUmfMlpXcWmK2a0MFpY+ppsYXPo8hM5Bulg6UiQBGBBARAgAGBQI7
-UhsoAAoJEFWR4sBmZMB4zVYAoNJR6RMw3ayHjelXGtInTeTDfAseAKD6npDv9S6B
-o84AO4er+DrQFY3X9IhGBBARAgAGBQI6yntXAAoJEJcWsik7qjrgOx0An28zO34Q
-FSSM2TkmqCWUdIplhp+XAJ9t2KpAJxanRh978KeU7C8SPHV7rYhGBBARAgAGBQI7
-pXfnAAoJELymmQeGwEBXsHYAnRwiIsFfDoqXdCdQyucm/5a3a/DJAKCtgvY6AXZX
-oBcAA895Q3fsjrMFr4kBFQMFEDnhOVv3E6h5EP3gdQEBjLMH+QF/daZ3aqh2/EtF
-uIOMNUQw+sF4mxgp7HQvhvwgfbOzT3uczqgtLlVd/a4rcPd6LxD4j7HdNXCJaOn3
-ANgaZkqUyNOMyS5Z3Fiyjq8o1t4lFcFo6Vk5Y24G78OnZ19Dvw/KayiYFcVVoEJX
-9WssFmq6VwKJyx68pg2tMfDKiCOG2tZ+LWZnsQd60ceBp3MyKKAHMQQu3B2mo0xm
-603JeobTxBydxrJ7b9LXYAcqcm7CdJ3ELutUQr7oQu/bcDhnphdlEjqZqWDQ6I06
-lxU9MSxdO1hpM0bShzmXZwKXClDP3w0+2DG/Udy2Qj/6F7RUNmUkBfiC5HQEb8se
-FF18pjaJAD8DBRA6ynRH/W+IxiHQpxsRAnNrAKCS2i4ohDFHz4x4r3zGkE8YhzYw
-QQCeJwSRE+py6XqEg+G3yc4uHGVWxwK0DXdyb3dlQGxuZC5jb22IRgQQEQIABgUC
-Osp7WgAKCRCXFrIpO6o64Bb7AJ9inF86z/jFF6YZApvfn6qr7sLnZgCZAfEGCtLX
-dNrH8cKmm3Tf2wge1CWIRgQQEQIABgUCO6V36AAKCRC8ppkHhsBAV1NrAJ0SlSBe
-ofgRiXMWo57hWKiB9Oo5kwCbBCSGL2v1Uw0fH1MbGm94/4h+g5qJARUDBRA54TxE
-9xOoeRD94HUBAeOuB/921e4vBxTPe6cFR5EnBJxfTerVSktVGVqn/00PVYjlZ21E
-IF2AG/8o0znIPXBxUcGC/rRi/rF+bnsnf4P1rPD8wMEpd6W1MOBQzVzQ33DY5a4D
-BaktKwK06vEZuJbTCTLH71TXVgr4SwrjTFLGUnMHB1xnM663LbL/fnLLpOY1Rs79
-dTUsuSbkCgYnA4dXwHlzThWGSpwc0dEwwbdNOzegs/vSV0e2fk6HJB2tnfOYsmyv
-PHTlLocaicq//I4Wl3Cx2ouruF241N/nNTXMU12em9G1cTu241tipdlXXzSlhQho
-qKyY72qRpYg1HeA18GmIjE2beKWE4Gv7IqlNU1loiQA/AwUQOsp0Yv1viMYh0Kcb
-EQLDlQCfYh70u5epjTvR4fSQcY9NpL2LzUUAnRZ4gidgRImYkhGsbqmmcvxwMFyo
-tBB3cm93ZUBhcGFjaGUub3JniQCVAwUQOtGriFMHR+Yj6eq1AQGzEwQAgKsP0KRO
-htk3QFUvb8P+RWUeiuVv4VzHcwfCFSsfdxWqK+OgxYqWidhJTtBTmcbnfFVljsq4
-HM4zaL4n1HR4ew4CDQ9CFWJYx2h0vL7ncJK+gvZgkHsDOdDtMLPtSOrq0/hylxq2
-fviZQQ+qxKYp4U5rPI3f+RL2k3KHQqGwCyOJAEYEEBECAAYFAjtSG1gACgkQVZHi
-wGZkwHgf5ACfVErPDVqxQ9vRdrkZRUc0cLUuqfIAn2dNPjPLSg+jdsz6DRsKmZBJ
-bNYGiEYEEBECAAYFAjrKe1kACgkQlxayKTuqOuD3LgCeK/rmg0vWNyP7BYDZEdUa
-hNdi+oMAnAhax0Y/HeJ7FiTK0J8wVrS1HhWviEYEEBECAAYFAjuld+gACgkQvKaZ
-B4bAQFfnRwCfXw1NgX1fJXT5aXKxIHrTms3+dgwAnjSlu4dds1jxMreB0iTFuz9z
-sVR6iQEVAwUQOeE8IfcTqHkQ/eB1AQEevAgAi9jAfi75hpYxTkniV6fo5x7Ftde2
-zkZZ4nMo24vMkiEQOcSGv8/IrAYFWOrUPRBwPTPH9AzcSIlrW9lAYEqKOns/1Qva
-6adU3EJ//QY11zzaT3AEp/rgudIIsIUeGisJgGObSz1lOtOf6AHdNdhfR6GV1SKL
-h5hrsU2Gi/xVvOULn9vhXGe42V+8OedCP9N9UgxAIgvjxiIFC/j8eZJB5dghlckt
-Ms/ZvosU6yF44yzcvk5tf25MSJGlnkITuOBn3f9RToWkXDjRjsTXZfhFjYN/2ZGn
-CSs1iJHuE7UWvqL4qcjI3kzaLcT4yVWuwvC14J5Lag4fKWwiaQQ7O8VGcYkAPwMF
-EDrKdFr9b4jGIdCnGxECoSoAniXuoavR+ikLMFjPzq4x0bpD3N1DAJwJK0b5uXnZ
-Jp644mvIFlzFmY4cYLQSd3Jvd2VAY292YWxlbnQubmV0iQCVAwUQOtMhGlMHR+Yj
-6eq1AQHtZgP/eRSF36yvWktiUoGnPgCr9mcC5k3IfsyNYZU09iMM6KyEA+YNNQS5
-PyW2rodOeSpI+kze9CcVovBVnN7mydrzi2tGDu5mS20gwD6L66aZb7UyRB1H2kmI
-olkmRIN/VR1PJ794qllgU0KdWnjdCxsn/rCwhRGu021INtgMBFdAgZaJAEYEEBEC
-AAYFAjtSG4AACgkQVZHiwGZkwHjIaACggQI9vwb+WHSy6pZ+9Bj0yW9g068An2ha
-jJliSh4II5EI0MUAo7yhiuzPiEYEEBECAAYFAjrKe1oACgkQlxayKTuqOuCtxgCf
-RlLBfmRwczoFl1pAD//oAbC7jToAn2EAejckcE/hIPHuRq5UpKlhumY3iEYEEBEC
-AAYFAjuld+gACgkQvKaZB4bAQFesPwCgpSH1pRHHk20vi0M8cjOAivZQckwAn3WW
-s2Q8i3BNxDwYPhYzqyBRyZIkiQEVAwUQOeE+rPcTqHkQ/eB1AQFpfgf/T23qlkH/
-/oxtKHZPeZyobAy4jury203tMp+2uvcUJ3WrAOZ4ci17nIB0WwQSNpHd0YMEx37j
-rpqrx1cgfUQW5bf9zPY2go9mCvqBEXkxeaG/uLBoifxdAlxT5jBI7CycI5rGmu3n
-q9ZfdtmxM9XzJzOJX8Y0b+nM4BMtG1B5P0fAHryS4wSEHZNbEX/twp8aE4bK9+9s
-WQxJESfcgAVQmYNNTI9ibexdCcWLlu0kCjmOs1CG/jAjxPMgkYQ3IXhVuwKE+agR
-QOv2LCUgC+tBdH7qif8zXKR4td/wEgwcxzCJCril5zmVZhhsRMPC2Hf3f9bAMGTU
-M568+aKglxGgRYkAPwMFEDrKdGf9b4jGIdCnGxECE1sAoOwHZW+fIvuZ9m74Liko
-Svnm3b8WAJ9sKeuYzFUrRi7+TMHG+5qjYCkaug==
-=e23Z
------END PGP PUBLIC KEY BLOCK-----
-
-pub   4096R/B55D9977 2008-04-09 [expires: 2018-07-07]
-      Key fingerprint = B1B9 6F45 DFBD CCF9 7401  9235 193F 180A B55D 9977
-uid                  William A. Rowe, Jr. <wrowe@rowe-clan.net>
-uid                  William A. Rowe, Jr. <wrowe@apache.org>
-uid                  William A. Rowe, Jr. <wrowe@vmware.com>
-sub   4096R/CB9B9EC5 2008-04-09 [expired: 2009-07-03]
-sub   4096g/FF1392F5 2008-04-09 [expired: 2009-07-03]
-sub   4096R/C10FE28B 2008-04-09 [expired: 2009-07-03]
-sub   4096R/7F7214A7 2009-07-09 [expired: 2011-07-09]
-sub   4096R/7715D89C 2009-07-09 [expired: 2011-07-09]
-sub   4096g/FCDC8C20 2009-07-09 [expired: 2011-07-09]
-sub   4096R/60C5442D 2011-08-31 [expires: 2013-08-30]
-sub   4096R/17886D66 2011-08-31 [expires: 2013-08-30]
-sub   4096g/E25AC108 2011-08-31 [expires: 2013-08-30]
-sub   4096R/9088F565 2013-06-28 [expires: 2018-06-27]
-sub   4096R/DE8FC860 2013-06-28 [expires: 2018-06-27]
-sub   4096g/E1758474 2013-06-28 [expires: 2018-06-27]
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.9 (GNU/Linux)
-
-mQINBEf810gBEADSwwRqdmepv91pr6k18+X7Xmgr+TM7DXUSxjGEZ6zkJkK9VEBn
-WKIV37768nvZXFl6kxTvMfRNlwotlDHz2WA94fDOA5cTsH6AcRVx+5SNKbGBhDSz
-HJ58K43f1EpiVMZnrwcZPMZrB3tfJt6E3fzwTtmXJCrqPil5WmBA1LDX1C2dmqlN
-qdLMWTo/ZBFGz5SzP7L9cKmcedGIn4QWNQHsraDTwkFPTRmj+KkweElR02ZJpHIW
-qPhKaGnGYzdjFgrCzUt9V68LUIt8CY4zHnpmqbVqHPMTtmQ/iyZFrTqeVk+NAu/M
-lEG9scechJ3DHYw81zZSZ4l7HH9IVcAscY8l2oTHPQHAc4+MDzjtz6w+/aOIlQy4
-16LGWl1ykAe1K7cYRvkwCpaA4+pT1YddWWHASGcgxyjzv1INlJWAsaNIaP0XycaO
-InZSwl5v7q/dmDNc7LaISodASvgPkcY8mivZBtkmdNZkVjAtz4ZD8Zu5d+UNEcaR
-X1i6tBDnNC2PepZ1AVpsoQKlMLi0szc9k37Azg0vikihmkGF34NyYjHoDEh2Dv3h
-A83VxxcGcZ1cx+lCkt37Pfiz+OQoYGTyFVOWxzxW54HYCSYEd+czIumIlzrqVXLZ
-Z9gRsEL8vmiaCR6/RJ4fZnCJjZytSvZSdeBnVZwUdX8Jy2S4mLFvj5wKzwARAQAB
-tCpXaWxsaWFtIEEuIFJvd2UsIEpyLiA8d3Jvd2VAcm93ZS1jbGFuLm5ldD6JARwE
-EAECAAYFAkf84YsACgkQ9xOoeRD94HUvUwf/dZgDnw/2QH04f3y/QjNimz+HOj4G
-Im0WSWk/qrv+xy5wyeou5D8LOBymGsDkP89Jg8AyWrC43L3AYhunvIqnFrB30v2l
-Wo97v6ye5y/9JzODSHvtDDMttmtHymZZHIAAJWgwBYp88b1jL7H8Al1nLT1gbL13
-3UTNi9SfKXCZubD+DFNPanIVkvmU+igufEuxzWouS1F7C4LqfgKZXG710Z71pKQK
-6nIVabXXErEvSHW8clXU2WaeJeG5z9QbMXx65zQ/54XtuVilfJ3daDWPCbg/uF4y
-JMh8vcGtueXfN1RrZyJZ2jyBWW4HjUdkfG8mUyCIPAk4WVz3hy+ZXDYb7YhGBBAR
-AgAGBQJH/UZRAAoJEJA4TZo1x+lCOmQAn2pNvQmEH1H09C5kJ0T8avI42SpOAJ97
-JIqllYY3+Nk1siYgUxLDBbnjMohGBBARAgAGBQJH/cajAAoJEBg4H9dLG+aYpesA
-oLAAEhc4iJZWSX87F2c5oyGeffCNAKCNka1vAfc/0wpbvZLc66DmYbCyf4hGBBAR
-AgAGBQJH/dw5AAoJEHPdjBYBUwI1u/wAn3hhiKsgmnEMrbXtxgK3d7pxM7+fAJwN
-+CB5kLynlnmdOZ4vWc+Gi6hM/YhGBBARAgAGBQJH/k+ZAAoJEP1viMYh0KcbPGsA
-njM51ugZdOXyGqttC28NlcOk+Cl1AKD6VkMlsVjGeaTAKWPVECMdu2A3WohGBBAR
-AgAGBQJH/1OAAAoJEDyaQgQMCIW06PoAoJ/3i4XmPjfmG0WzNepS2QNiO4jNAJ9a
-17edZ5coTQq54NG6XJ8+/l0ZlohGBBARAgAGBQJIAhtsAAoJEPXCYBZM7tdfrYEA
-oIEifF+e56erz+GWTgITWdJzKa/XAJ4yPbLnufvrPriGgvD3tK6Zwr6ZfYhGBBAR
-AgAGBQJIBT81AAoJEI6jsGhMdlfxg8IAoJGBeaZhyCMYmsZEx23KVvtC50BmAKDB
-V8pZ3ru0QWhn/o3Q6MY5ln1exYhGBBARAgAGBQJID05EAAoJEBhhwyLFYBSyECYA
-n0FWhEjTF3qUvdV+ZAOHbZOM2ZeqAKDJO9t5ehmazXq32sFXwXWnRKGcQYhGBBAR
-AgAGBQJIIhYHAAoJEA9FCiZiEL/AheEAoJGzINXsl4qKWLHxLw8KGgjPdKKNAJ9l
-UieGObbQG15y7Tbpf2Ze8zH5AIhGBBMRAgAGBQJH/6qVAAoJEEwEKBgxGj3l2/QA
-oIcqKyuWn1MC60v31tVtH+7J5sxFAJ4+ns7bDTln/x1j8Z7ztgP3qfNjHYhGBBMR
-AgAGBQJICfc8AAoJEN6A5lYZ+SkYbhUAn28xqwl2wzKdGibIe0Zg5G5IiVkkAKCt
-MwuhpeikPAHakSEBhWhQitHu+ohrBBMRAgArBQJH/StHJBpodHRwczovL3d3dy5j
-YWNlcnQub3JnL2Nwcy5waHAjcDUuMgAKCRB/WE+eTdnRxK7mAKDC2wOJgFNkW/4/
-GniKayVsRdfKwACffQrONiUpNQCr16wnLNZTkFEhJDGInAQQAQIABgUCR/5N9gAK
-CRAxpj2W7BQLgYhPA/9LAqibEUsg4ZVV9ntrH5NmOoIQuNOJTj4FVj9AEWj2hNyh
-XzGs+vCfTdwJZQ7R3EpqoQ6J2B3ivXcLvDQwtpw3cVsNwgHp/FMIQPq+PIYqc01T
-HGHqfQkd9NclsbFrM3920TE7Wp7PW2od3IjG81lInJOPmPVghZ2YZvkOOUzUo4hG
-BBARAgAGBQJIQgvkAAoJELK+vEAVKSSvzNwAnik5Qboq2TA0N9ujcf1qTdY/1ylH
-AJ474I3CsKrb+DnwOYQhySdWoOnp7YhGBBARAgAGBQJIWURXAAoJENUzTnWxMT3i
-ITUAnArmUDweW+BemwfyDl0pSg1eZ5nYAKC2lWPEHhMOWbHMeZrofXqP3O6+mIhG
-BBARAgAGBQJJGjROAAoJEFuWgBDgT5qJtf4AnjT05yrvzenyJl/afFsTtcoGC+8a
-AKCR9C284hNXrNMBGG+/TDC7cpm59IkCVAQTAQIAPgIbAwYLCQgHAwIEFQIIAwQW
-AgMBAh4BAheAAhkBBQkTQze1BQJM0s6dFBhodHRwOi8vcGdwLm1pdC5lZHUvAAoJ
-EBk/GAq1XZl3fDIP/R6JuS/WSlcX2zbcCw0j8aejHf60AgJXCkUxL6bqj2R1sfFh
-7T1Ov4iuqnPSkGXz4IAAh65uDoCzGPebwkzqP3BurNrUthjQgEp9SdKSyPCUQaWi
-n/0M+ct/nCmzVfc5H2jF1TRICgjJsBH8GZ5yD7JAlSdgRVzMAaL/dZJac5zho27T
-sLMKvbjbj09sNnUM9+d1dLlT/vq9gSQZWFfVrqe7ReXgHp3U4da04k6wiKIgbxkg
-UiPuUjUmmNZ0hUeOTAMnWqqSJZXMQZWvD4kuiS8roFtiasyGaN9AlUppFmj2CvJb
-Oque2M9q0Q1lfxphezpsTK/0ZudbdGHJQbd9fiQp2BALnH5RPAzzl/N4nK9tkbUP
-gQt6sx/wfaXUPnXqirb7Gr5WBesuCAKb8hqlWH3xt3LKhxYiaSDelMJJA69OkOG9
-aTSAZOfLijp9zia3dDhZkmuXOYYh+E7TXTPmf0nCxJy1GNRrb+/e3/X+IN6imN8a
-6VV/7BNnRL4aacdywmTxu/pbz9tpvcenyRs4gQuBVkG8/MtzD2+y4p+8U5iiKYzN
-+HS1/zS5tQ7YErRtWzzF2u7WzVN8y7w6HMhgdO7HtQxff0pm3OXa4OQS7QzKh5YH
-8elPgKindPy6y3DyX/2DbOaRY4oxYsqpBWyJeEocFyR3TeXNDTzDeQMscHs6tCdX
-aWxsaWFtIEEuIFJvd2UsIEpyLiA8d3Jvd2VAYXBhY2hlLm9yZz6JARwEEAECAAYF
-Akf84YsACgkQ9xOoeRD94HVekAf/Q9xaanBwcGPPtaqHy9534g2rQhIyO4aSUXX6
-hSztKBu0sSTVofsHW0H9tOMcC0cHfoakIPBXYFmFbo2ofc4CJLoOVF110ac3XmTt
-bFMoO4ZBmd80tlLpgeE2R2e+XwOJcGwP+NHmBHJ+jQvJqyIdNv95cyzpaEWYO5i5
-81g/jqEqVhb9QLBaQBI9hE2hTpSTQlS8AlBUiBn4efQZj4RmZ++lRxSIY0GncjRk
-thmentxIWZ+u3oR7Mzz9D0d82rBIy6mnws469t5yKdcDtsLsd75sqGUnJ7/27Q4N
-DsqqMXO6ZtPtDvnEk5R0LRqRm3PPVKKRsFSmw80CbpyC6wCVv4hGBBARAgAGBQJH
-/UZRAAoJEJA4TZo1x+lCRpYAn2OH8WaHucmGOuXuocAzerQq+gYPAKDboz+zevbn
-QaGf2mRewuqPajGVD4hGBBARAgAGBQJH/canAAoJEBg4H9dLG+aY6C0AoMhRRXj8
-9ESEt+NIFYcez54oKGwrAJ9dPV4tZlhXANlbjYDk8gWX1eBp7IhGBBARAgAGBQJH
-/dxCAAoJEHPdjBYBUwI1eMUAn0+N5yTMT3C52umNxAhV8yWrqDCoAJ40+S+Wlr4J
-XgucB98S0pGR2DFkXYhGBBARAgAGBQJH/k+ZAAoJEP1viMYh0KcbrS0AoPTWYltK
-wRLFc4eMVnqt8jva518SAJ9Kaah/amDGEK1Bfy05fjeXZYcWQ4hGBBARAgAGBQJH
-/1OAAAoJEDyaQgQMCIW00YQAnRdVVcsHKnYlddfNrNdqbDwQtJX4AJ4ngGYjjSQu
-X4xqr79EgpqEAzWDSYhGBBARAgAGBQJIAhtsAAoJEPXCYBZM7tdfJFQAnRTKR6bC
-gaTMEIeH5bMIUYdkzfzeAJ41/R0maanZeFx88D4hjZ/2wuXcKIhGBBARAgAGBQJI
-BT81AAoJEI6jsGhMdlfxc70An0T+27SsGmdOxgDAo7ulDfnwqZlqAJ428eaU3mCx
-Vse174q8RBPsY793mIhGBBARAgAGBQJID05MAAoJEBhhwyLFYBSyKFQAn1v7gFZY
-VyktjaoVINe3oiCq6NrnAJ4kQQzmqvKj0Yg/+1NGoyoqV1Xx8IhGBBARAgAGBQJI
-IhYHAAoJEA9FCiZiEL/AIxkAoKnH4okkKrPXnX33l/WnCfVYoch7AJ42bTa+0arq
-9YsCG5X3BeReXftHK4hGBBMRAgAGBQJH/6qVAAoJEEwEKBgxGj3leagAnj+0nNT7
-ynpN6DIuxfIJmXhjmB3xAKCxoFsmpw5yzuvwIo/foM5Da6+yEYhGBBMRAgAGBQJI
-Cfc+AAoJEN6A5lYZ+SkYbFcAn1ONz6o2scpC+URV4TBbUXmw9iIAAJ9vz9bm0Akm
-JWfg/AMFfFb6jyHnBYhrBBMRAgArBQJH/StKJBpodHRwczovL3d3dy5jYWNlcnQu
-b3JnL2Nwcy5waHAjcDUuMgAKCRB/WE+eTdnRxKn/AKDX8Pd//IP1xFq8gf0QpJ0w
-y3VcvACfZ4g0hx0gQOwhNB1/9Gkc175ahI6InAQQAQIABgUCR/5N9gAKCRAxpj2W
-7BQLgf47A/4sPG9KJkB7xJOYDqpFK/n29JOSGJGQGAHs+2PAxwQbXZZ1ON7ogzAk
-Op7ka+ORzYOTHiDj4MyYdZzmqUER3biC6aIISN7VcMAj908y3bteIPE2dhikKgfw
-P2XU5WWskpZwaQM3bffF9RZbFYCy67BGQ88/kRO4W1+0EOMv7+Idn4hFBBARAgAG
-BQJIQgvkAAoJELK+vEAVKSSvi3UAmPZ2cfNJjXhGHshKIJUwR3/hWNYAnR+R+a9I
-2v8dhBOQSr3d7MfZSICBiEYEEBECAAYFAkhZRFsACgkQ1TNOdbExPeJ+ZQCgrle8
-p4Gh2/9F9bfQ3Y0h7QsqPeIAniUqC11Q2Ttd5KdFI8s/SmGEp2b1iEYEEBECAAYF
-AkkaNFQACgkQW5aAEOBPmonfsQCdGBYTaE7e/94gJZANZhUDGWK5jFsAnROzFVjG
-u7Ld7VDyWaWrSjTIvdaPiQJRBBMBAgA7AhsDBgsJCAcDAgQVAggDBBYCAwECHgEC
-F4AFCRNDN7UFAkzSzqEUGGh0dHA6Ly9wZ3AubWl0LmVkdS8ACgkQGT8YCrVdmXcG
-3Q//dKZmBj5+Gyn3Nm3H3mt3Q/ZUr3x7rPA0ERRHunGyx0tUyaFWyPyQngTDfAA5
-oXdHFmKUmooKTTLS1kCp2GapQGro/0tG52agg7fPmYLjCaTHmGp9nRDA5OVqfOH+
-stJQjDcnABWx1Qpa0kjLer5Ul9lyHtF7fu+heiZmnnXvbpPi05/s7zGmOtgmsiKi
-TV+csYLorOaLnKfh582cjE0JNtYvj30v57WM83Ia90cDeW6lT7/z+9FA7XZj3HWV
-fFGV1BB0AYs91/dxZQpb+gE+2S1RcoXnkab5LeFHDyR4LXLHXK++Cc9JlCMMnDtM
-IJV40OnCZe+KbM5rVuTwAOhMt5dziT5/u+GXibKu5KCG7Qiu1QKj4n8pZpNEEJ8T
-bzy9qPVNY4/HrU//tqihiMCKfZv1B96GuOX1KS7GRiaIQJphyeqg0wYX4TbpDs+F
-cynajWCjw/cJRvr+UgFjS8t7s7wLHiZfrJEmF1qSZi+R2igVHRPydcrsLCmMWYvk
-UTflCNMvEWF9Uk4VOb1KYG4fkHsSF8cC7/2zCbF+m/ZEKcHxnN+KxFMAUqg3qUh7
-ina5lyeeOl4pIi6xSZ/7U1WdRjQoh/vQRAhtwO/6S9jULaV0tIth/OuE0C7Vrtdi
-EzFq5RHT/Nw0ziEG9UfRj5mvRQZpaV9Gwo88WvvnxS+tYYi0J1dpbGxpYW0gQS4g
-Um93ZSwgSnIuIDx3cm93ZUB2bXdhcmUuY29tPokCPAQTAQIAJgUCTNLPXgIbAwUJ
-E0M3tQYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEBk/GAq1XZl31qkQALtXQmmX
-N5gww4xJpTOjjs6Fq+jqqArWO/nrAkdg4f0syovOb6h59o9hzQH1kWHTlzXCF3up
-eY1kw/RJ3q+8TPfVzfGNagxM2pxVMVsyDk+TC5n5z7+B9cphx/VzuWvZjUfS73Zg
-+RFgNsLhE5ykmYDsxnBc9/YxL4UWWKXO2vq/i65uzyFLrWeyJlVyocbGZkxWt3/a
-5m/J2J/V9tkrK+h9mFKdijCixanVvefjhAXPBXVFDonJE2zdx+3Mt1szjwQOBEFo
-ZywvWUQ1pn90qPjj/LR0fHbEpiP1i2mkrlwRAkiKF/OhdS1tMb3gH/Ile/Qs2Zs/
-l01+h4joQzYGHGzzoBSAphKaWAASWDzWFxvnxvizAn+M+eBFIBdMFPqKC5iFnpwm
-471wmI2BVcVZ4bfjZTEgE5Kt9kPEMZ0JpsmgXt4cnbQZwadZ7YSsaJjpZdozNCp9
-MmxawnNvyKi/DVOVUZY+S6eyQSiPq3p4IIsbT+87C3n6HfRICcPl8NUxRYMjY7Wq
-WTQrFZeDTqlu+YtoPVMAcPAmH5rS1VHJMIXELjFc6wCEvJF7xRiAAQhIXwuQETwM
-qqG29kViHqv3/A6XGK0tmmoMCcNSASYT1tbqmcb3+mrUzQmyUXTb2xJ1zTxLxZS9
-elE4eb1hxPLbQo4qd3E8fMDQi39pYkl+up50uQINBEf83woBEADgCTSoU3Euh4hD
-c3+yB62683MtDiG4DGCQaL9QmK4HyLV1u0bLO7S5eWIsWpdRGWnKSIObAocmsYQt
-Fd13imrdZBGuHcvRAyBrG4/SzsRImo2iQUE6yi9q+BI4Nif5kJDm8rT5RCyTER4l
-gTx/ZAsa1LvAwPN6a1PXQeNICeJqNWBzbZWbGx2br4gqjtpG0vHq1zoM9LrhZCEW
-sFXICBT7sN71W6e6brJ//VLPeMX3nCvotP6V192sxiaT3AMhkfhtY7oxv0rNmaVV
-9rL4Fd9drxmTfykQ90IGHRxBrWc4GzU5dshoAT1MSiZbMTOAVwnZcvpq6PFXg6kb
-ZA+cpb8J+jyBXFNfdPEkrX36JJZGkdyJrqqqg9xwY7SFq4ipFZ81a+a9KCXlmV6y
-6bmUm7cMrhOKEjE8/3AfqgIlafs0lhIwI1SQmU1dCGDL9dpWeQ79nZWEu18GjtPe
-UNtCL8ACgEPhrxUAJM6Or/bGFrJy+/ZvUV84TB6PYFO6id/SVN+/yvPAEdTbwI3Z
-tdtwNJx9MLSVwOOuc40KRlXB6dTpjDUJ1mvQuwQXST6bYStIRY8uF0wzf8raO4Lu
-/6EUCBW05fYC8HAkZGBsivm/YCymjB57mpz53ovuLcwAp3pNmnRWDpKiGVwJdN0B
-uNCxuUUgioEoF4p56IS5YQQSVP0VWwARAQABiQREBBgBAgAPBQJH/N8KAhsCBQkC
-UUMAAikJEBk/GAq1XZl3wV0gBBkBAgAGBQJH/N8KAAoJEIFUZ7bLm57F2doP/2w/
-H6COAjjzcLUosembG9DnC9e5I30OQxZKGUQ4mNJD5nQT0euuNoH284KXeoBTaFRz
-kdXU68BK4SDEXotH4vwXStzK8gMp/dmpr3lGwS0BHHElDxFNwk4b5y7lYCJt93N1
-IQbAEtZCqv/Dfn8y+7hOmMociDxgZgai1cYym9YCVkOPOl2ikBK7V3XRPXKKcYx9
-IslI6TH2HnTRN1xzjggq04IwT0o7u1wMB72xU8kaUgrUHYio0Smh0memClUhwCEQ
-d1ic9nrg3TOvlAw4V18NHglQemwVtpRgAGOZNwXaLIEUBfvTKhva3ZVA3yeoaYuP
-CVFE9X91z+sGdRydFJde4m1b8W4gf2Mv2RnrW5EgfdisLgXRw3C2xo8qrh3R8Gx0
-pLv2VJJT8n/o0Ij+w4BsXYWTD0jAuC6bEfHNraqqihsWf0C7N1T2QVCcwbzxANUO
-oYegFfCrz5RqjemsmDTZkCJXxRR6RcvW2wHtXI/K4HULUBTvPl4FWFEtmO5LxcRR
-BfeeXHrrOFmQ+zFwb8O6MoQIvmOSylB1BDi5nZ1v8ojvhHkqufMpqtK8RN7DO4MW
-BSavjOApAgX9HpChQeFEbvpWy8zKsljfhnvhgBL88kMQ3Oq/1KQlthmVVqYmPvd5
-oIcYWo+oAcnY/RAGVYLmLAo7a6Z+ms17VeSP35aDH3YP/0sX0ipnzstwA19ULQAK
-UhjMKGGv0dt0gkT1/ZXO5GZVWx63VcJbWWMzRsTzGYLZzl1//RCMSRdDbqzWBKYT
-4w1dU9chORG4Bgnj28cPS2CNHrLzgkPtcJWcpyXo6cuaRKXrZ8W2Jyz9jKltTPSX
-bxOnGvQ1YkRhhzSDyhU/KBguo1IiAXgTBMgO/LL0R12PMETIepBMrPz5YZhIZpKm
-rqTayjpLu2n7xBHu12XOnwm/kRqmBHFxyAFQ3VxWeXVzhVvk4JKWajyzRZQrRSv7
-8rULuAw22llzi/EGY6oTzEQvEJipA9OtcJx0+NKcLfBgYO0dh4bPvA1iW1BFfE9x
-t1eCjDl1WHPAZXLWTJO/OpkDzsgcWlggC0gpgE64lsriKpUtCTbnGei3VdlBNNar
-A/JsudJUehMEh7t1W5bJPrCaoeyZOMqlDxcshUFfa0CFiytOn1ILcc6okhytwo+v
-NjndBupTdfE0IVwBxNE/SqBbn3cwQ2B6z8sZnrHKIe+dOI5yK7CndAr1GkAdhSvC
-TS/ctOnWpsX/rWEk5bIsmeXVYjJTVVbaPer8VC2Bvxdhdob5LpMfMhRsJnoC7Fjd
-7X/CHQlkQVwiMixanJqTzA/DCr0M5ahZHAKBw7rdhTOdK5UyM6yzszxFvpwT6btY
-yRM8MRdtqZPgn/7CUVl+sViiuQQNBEf8328QEADucL8UtxhlP8R0C9vmyextchzk
-AjvhoYZP5XGk15gx5yM7W525vTI+G2v7jWgfv4G2WsACQ4CJTEAy5bYzQ8jjGUdh
-phhug5G2CQgaY0F+sQWeoBNeZZ7ngRepppL4QcfsJmk7sQNu5u0F/ryK3kRleyv1
-WspmQ78Id+/fh6VNSR22ILNi+AuhK412bUc0tJRhC/JOIMr5Gt1HGUnlu15cgAKf
-L03MHnfpiB5qCdUkdvdGjT3UkHfBVrpIlTWBhZUsJmbpBTOwpseXyLjr8/dXXc8h
-o5XnzeSYZF0rZNSMc5PkpCiBdVNiyYSfIFzSCedwCC/8MYWCfxTvfjEiTP9/m+pA
-6Q1POAGYvFqTSNLiDie8qhOHHVUlJ0J8WyUmi8k6yOktGQj/EbHvMRduMUTwqUzv
-RzdsURvZ0KY6207dsTRhJEplS2n6WFAnYdovWBtoNSKhsqLg1GpXufJdZTWCsDIz
-3y09IcNLdMa6ybJqV6pK8dGMATBlIbXuPjlwlcfOLeJlx7mxH4R6SwTaPV8koOX2
-3aX2SNDnvrTMLR/u8s4aFGn/hqJ4Gs0J3SBhRLWyPNNXPXYXd8VZosnfoQ/ZAYkK
-KYQMLxisP7I9SRavSKJ2Db3n3rKQbaFNULxrmqgZiiSO9NEYKAaQfU+wwcPURmhc
-9UItS5ZFGmqzUnJ1EwADBhAAvrDHdNE7TtA171w737weox1PJmHdCeOIWUttom29
-cBkSa6J8EfAebYOxcn2sjOfWDdrJb6n6z2SHRHG15rTJ/eDFH8f3ol2L7VNzq52o
-HPnkUwnrJJv6TD/f7B+48qhrgF5c6ujOUC4QwpdeZ5jz3qzXl9onXt8SedT9yVt5
-KAquEDVaeBZdUiE728zBD951JvUzrRmJ1hYODBxbhxmLPihoZyNYaAPWkoSXnLFM
-Yc1PIrRygvwDJfviEtd021nYt0NDjves9v8KdFT2SX5NtsIg5GnpraURtCr1PMbZ
-mTKiBHTO3tnin1Okg65ZzoUsVA0hOCIYXNxDS3MPAkJOWTqBphT7bbAC0vdSuMr5
-lMZmuNjR/MmG2xvVHxQZvlUJi/F4ZltV1oo5ugz+XzEGgO5L/lX3LpKIcS76dUXZ
-aQ9nSoc5jtKZOYBQD71CGXYvtb0dpKPYuAMuwODaf0dz3DUD7e0AJDgOD4neXcpR
-Ml4s2QZzFhTyu04pEROLGomBcfT7PkaRPyPeumrEuNHuC52Sv7zO4ZOiwaOLzsUF
-yzf/y4sho1NvwunOJ3QSrXdAnOo2VxE+amQwkfetfknL2P/PFdshtSiq+L6RcDW3
-b09R4H4yO2yUJ5cQRrU8aicGFjf/QzFdFUz6jhm0Nynvw5uIRp5VDNmaZWul1o/p
-nimJAiUEGAECAA8FAkf8328CGwwFCQJRQwAACgkQGT8YCrVdmXe4fA/9HKVc+cjk
-OQdhkWFqkRv0gQl4fC9yQnakRJgJ8G3hG6j1ai0FZYiRRFJYSJf3MNMIbilLWDTm
-UEp/EVz/c6lkuT4Et1ZktVwnZF/QObOfWVvxStvM/RvL9cu4KmLeVqCW4p0LzCYM
-EbMj5VeeBiLtxrmGHbhiqRPhprczn17or15S1lBewzDMKbKC0if7TeO8FMTHwHGF
-P/bCdn6ZWcAFnNlHYF8Ywbwxr7UybztGx/QKb7XOZh8b/y5+lq8m1EWZJ8SW35R/
-uuWU2XS3vtYVo/Oe48NFf5qSmddqZCQhMO+ajGC6gBa/MvA0dIO7E5YIa+M50Ttp
-Qt+GzlUlc4RThTIYEjB/+LmG7PltSg9WmkMsaOdWOJtToKVGsM9ENDML62qAJI1U
-dc+69tn0/VGxcT8gIJFnnQ9CmN2lhgurOztnmKBf6Ms0MWnFJKp+lFN054RyNnBJ
-1qO/+w081u8/zKv6+Ypp8AixBjlABori2yVv9gpD0xa5yYEu3hZuuZ5TKcZZXraW
-BVPWmsh9w0ECIV4ZAZ+08M7sUstU3jSIYl/28QYe5bxEP/XqTiLyygw9AXGOSFAZ
-s2nK47+dOOJ6MEcfFHvPt1JoYx9dKSAhk9nYjSO6foHPBggM5M0ZgFaik2r4iQqM
-MNw8ogqFfMwOBLbzvyviBi2v2M9VWNzE2M65Ag0ER/zicQEQAL/crQrnyzcQtKya
-51YvMr+hCl0LU6wcIKvvbdI71ydqaQY0TvO/AAOWWcz5AI8W/bgqV898Wk1g26Nd
-NQKxzEzikeSvx9qsZhNeqqx0B44chCI9TTGuLs0i4YoohQuFXBtz3tC1CdytFtJ4
-UODseqH+s1vALjrxJGgLdEPU7CEmDGQTYheK11+Mz1h91OS835d/qct00Cqzxn6M
-m+ehXqsy7lGsSL/mWKQLf9yDg1DduAXqlmsmjiM8kaRkpfx4ghh7E4O2LPT3kdme
-4CQTt+BQGdkV3JEkWc92WWufGSEqtVUcHN2pvVXcWM90cbpAbKh7pPn4Nx7hV9th
-NZfjNBSIFXYTdmFmu0i+w9dHxtSelRwnzNM/CLL13x8s4rXAiG/v8eAr7FCVFRHZ
-52absma6zTqBMoxn80jCoC7Bk5EEvn8dV0tEkrgvjRHZ/mc7A6OpZX3dj6B9lf0j
-WXlkRiYTor6SHW5IsdQuv5KwoE3kkUfCD8w2QAhGcXT1sylBpoLNXgMFX46OS+g1
-+CE0G3l8vxfrFSE0l1GqzpRl5ZiZ5ECKdk0wkRe6HPXNE4WnBNupC5fiSuZ3H4Ki
-j8RK6HpbVhZa1Rpb0yf0fpkoPhBNw1kXjOBziQ2LspHDAhY22VJWxbINnqBvsf5j
-dAVw9uHuswFBwGmV5nhNHurZLwujABEBAAGJAiUEGAECAA8FAkf84nECGwwFCQJR
-QwAACgkQGT8YCrVdmXcOXg/+IoNiOxeMxeQYe/XBcJAcBBZPDLVQhJQ5KqgWYnbF
-w6lrK1nKzbuCGQNGp3RubWwsax2yQxTcN0vzhe/WvShEnXwfTxF+9XrTxYqx9ZJo
-2Phs+f08Xe70RDP9Kc+BNzIHI9uXA53VeGWOAenkxFBu2Qd4vKJzmRR66TbNDiHs
-Yh9k5+FAW+0wUf8YSca5RYEuXksf3XMA66edUcWpPvd6eWf6YDnK1pq+Kd9oB506
-1iDzUmkjV+0Lr8z46d8mo9BDfx7gX7hwF3T5/eodB/gKuBrPup8151j1fGI7QKUI
-swIfq/82qC6iP/jKEPFa0g+V4naSWp1TrBh8wyJU3Bi0tHbUfSj1zrMnPq4lJDtp
-mfQb5lmJbuE4VKBRPTtkETF4DjYsQOE8iQiwo8uyMP0H1xX9PKPQOD/YakQ2Wlkq
-cggfo2QO7bCKIeF5UmwB5x5ZPEZ7XnHJ7T7iavS8f4qAEn/Xnx+pzMzWteaHahkY
-B7M1XcU8QmrUC4fpbVwVOet7zfFKdH277LzKmDEbxpuFkj0fHHF2GmVZacEiCyOB
-vOZlrUiDY/IFlYr+3wc3mJWHKkfYVTB3x8Tks3aaq758t6lOic32ZiDWWWBcHQCl
-bgWAMFKEh21yRQ7DkmPwv/p2SRJvRaDQUKOoESzJKPkDaPN6GvqZhJZLXJo+VENO
-ENy5Ag0ESlU/sgEQAKynd0bz8BthKrW/ksESoqLhcOKuDVyR54Znirswjo3rhYp8
-5eQWd12H4c+ffdaxtTLL+TXRKGylDQTapfMUx5W6f/R2ei0ihr9RyOVKPODCVLfu
-NZIomf2qUMUbAoGyIUfxbg1fFsymaCJtGD6Raer2GCEPP6EFsq5IBii+As5FiP7K
-Iv0JHsKK5tKHLsg+hp4wvQi4TLaBuZ2TWnCM5JrBFZFzsVSTeFgMOG+H2nz7WWbg
-o4/+75Sj6venFu1+cxGZPZ+2MQyONTVnSkc6jGqiaEXqapfSJXMwhd0JiWwR7Pu6
-lmnVDL4C7E7O+Z0pB9tkCAizwVK/dOg4eukPYAdNTSO/D5yXcQ4g9lPNTnmAAYKa
-REfuQTZduP4f898ZqjHr45wqgX9LdBZ7noRNQAZJ+Nq+uQomRNBfBMhTrJq9UUhc
-vKsIMZ/FkF7Ft8LhSVvSY6/P+IbwXxEkQtSiuP4GWfHCBz89vgPZ8BkBA/Y1FzPK
-xkIXRtEAlo9YeEAH94/Ehc67YlynLVoVMpMTngdA12+2QwzpCxvPDmZiaXRTBEDm
-5aitEGxC52z0RPOS/Wov5gnwdBB3fzpwMvPab8eWIQ2E4tB2deEU4EkjZkOdOtPh
-fHd1C3dz/X2EkKG/NVdM5U/+GItR8OvapnXxZWPPPyNNFQAb8beKw7v7gnchABEB
-AAGJBEQEGAECAA8FAkpVP7ICGwIFCQPCZwACKQkQGT8YCrVdmXfBXSAEGQECAAYF
-AkpVP7IACgkQo0i5hH9yFKdrow/+PMOFDxC4Jl9hdtn6Ab2Fq6RtOdWpxQ8/heWN
-pVB+15Zh0pxMJ+oBuaLnrs0iZuQXJnUW3UpkoxS6TyRhJTi7cNE+5b3k4jn1oC8Q
-M8xKU39+iKx3i6Yranc2+ov6/OvcHXqT+d/oM7PwQ1asYnQqU7GrLxrMAsk4zF16
-7FTYTxrA2gPVZXQSnoh4pH6PLx1K3vsVGDqd2ePB9pJ97I8e7AFvQbOGq+KdM4Xc
-TaV0JbF1GbUgAEukXAsHnSlnCj6lbzTTbF1VdnsgzStS0PI+9lEZjeWQ9qvy/G9L
-fjeJKdaJWW4wbuSTwZdgmY+NOAC2ZRkGzIKB5zPbvkzc6vJQjFeiq5VyryRUplVb
-pm3pIyRL/xeat8Z491bTnPVuyAlhndHG8yGw1zE8nGoo50UbwvhUCpY29RE/exjf
-kaR6LCRRIduL8evca0EHGBVhB7fXFW4YFhxCWDe0dgC5NSurgZs6OXaIF4EvLkhS
-7pgKqN9EagMo6IvGyuf8FpLKdmTwL3X30Y2lvhi2D9hd38+VNV1mumA8ul76pcqa
-Tnu48l26qJ8HvhWrUC0/prylYO/aGrUjeyOt82/sQZ/7hfGR+yJTpKv9bEaJkPIB
-Y7zXfPOObLfii8BfMDCXBH+kN9gvqjw5rxGxWj5gYGnzwreQMXZune1f+m5bD9F4
-O0mxcBMJLw/+P8R6kbImzrYoBR+ktbs++q7bq/FJe5Wye1Oa70AuJy5zs26Xxc7a
-zw7rMv6QiOY66PJS2Pcl9H+kH4stL5CvqiGcsSNo/7KEyrfEY1s14jAg/5iHHkxI
-f4UYG1Bnef9mUHf8TdDDpgPQPUsC8gAPDG4sT79iSfX9F3SVquDaE6Wm/KPRpOxm
-MuM12qwNpD5jlIHM8MjDolKTHasVCRxtyTop644FGlo5bkndTJqfY3YMZYLFO2yf
-LaL8hGPelwKO4RI4de7jtMEI+r0VJwUNfEtQR8EgradjKrG2BdXZi0Jok20aIA6a
-RKe1bh3C6yOe/RkHsbMLF7iJP+YYjqx7d/uk7wDRu8p/iIp6O6JGKC81Dn+dUjCd
-Sg0uaENW9Kl9dGRahB5VWwRewlS4SiORhV/t7PcCoMEkVCkgx+bJSf6W/+HObAb7
-ZL4rmGm9uLzIrmWfk77FWmkKUv2hyNdg4ByUpt6w8J2n5rexBqcgWAoLhPWzylSj
-XKPQEE/3gfWsMyIFBoxSyQiFpdK/JEZTU7IDmCQJIrhxOjBuaTqo/s7ArYBSJkkw
-aXQwkamOTF289QgF/lpyUBg5vFS9EBThLDcgMtTspU+F185TnJ13pDXOVd7DyFl2
-3W1dDhToo5hj2JqYnwZIpIWM4CHQsV2E+hXpWJNd2AIo84IA/oOOOZS5Ag0ESlVA
-/wEQALW6VJKYN/3q7MPYiqXB9I7W8I3jctnoZFYHC65U5FGARcEuiNyDmR5C4K20
-Cutc1hCXwPC/vt4k7JtF/d20XNeBY4RNS1E294c5MEFWhpnrq1zZoDWDllQaqOYv
-6UbyXdt/WOAEci7BBNoXCnk7t3aqtNSVe9ZsUiTKNt0hD5Lz8fzw6cBRoUOdOKmv
-QR/wNLxqF9V4xZiJJmIqeXggyHcaTB25j01xdx684GpFIWWBgUGyY0KWd2M0vxgO
-8G9Ih1nPdRo4gNofslMHwLN2eElZk2mbsXVbTSL/mCpmrn1iIcztpkVW7X2VZiFt
-7h+JJk9kfGFIYix6/xJ9oEnU9youerAcjC1To+6kss1XrBC6UOf2m+asUUo+EwDh
-gdQ01f3ihKfIoNctKXXNYYbpIzIFudrVRf8n8RlxgfSgJlvqZ6E4pQEhKe1I+T7O
-Zy76YSv+f2jgFFqt1p3As+fOVFIu7ePQd8vLx9Ft4/H6oYw2fCfI77aOGr5so2nK
-/yCpHsBDfWrv7Bll5tVJfqnd5wPCgDY875LcOa5jI9Y6yr0tWD9BpR5H8TfH7s+E
-qEog+a01a2G+k1Kw6WOVrqRztkCyTcbRb19bS4Q6nDZPyvo6435lEtKjOlvd5FVj
-p5KFg1osdklRTNVX4kk0++J8ul1ld8jq8Za/MW3vse0SRYoZABEBAAGJAiUEGAEC
-AA8FAkpVQP8CGwwFCQPCZwAACgkQGT8YCrVdmXdPBBAAx9KH3COxe4WLBtwtYZqX
-Vm/pe0BzEBxOZf5h3IyZFhHkxWeBje3g6tr1rsER84ed039TAQV2vbQCYd0lyLbV
-O3ZmHRDvLTG02dzTU0pSN2yJr1aQeGLrxlRdT92jaTYRLfocP8pkTJ22UJvoSsm5
-vEyFe3HMFJUHqQMG59oe3/YkZkBDr9CDFytWmp85C9+Iql4/hxKVZNabpIRC67w0
-SCxoeEU3c41RIcGj7ZHfNcco6LiUhhXG66dp5Vmc6P8QDIypdpywK5FzpsMuxlj4
-0gBmNR6tBqq/eCtRpM3HTh4XzwHgLoa9NgbUwQFjYC3nRgYciymmoWBcVl39AQ2R
-VdE3ZoRS7ZS+v4E3D6DJfpZO8yuumT7Jk6RBUzBKWSktwH03brJmoZUWq/sX56ff
-H1UkmZY7e45Z9iaQp6152UX3T8E3eQtbKKgzQN9rw2hjOszswZmeMX58IcflHgQs
-KTnpHgcwHeLZ9nEUCU7l/tZ9bOfcmPFGSkzOE8o7EWfOcDABKph5ruY4l0vA0ALD
-wcFm0xbXw7UYiiMiS1FiIgX3YyA72MhiOWOS7uUDmUU1dB0ikPoegZLrLIwRQ3+r
-1ZGcveIEAniailyvzjZ2MJCtffRiD69TDwII4w3ksW1bE76kIqgdRf35/j8mtdAX
-cFpjhKP1yEE0pvDC4IvHiaO5BA0ESlVAPxAQAM+PIW4juuY/121KxUNWHYGrUz6f
-Oyh7g4U8AqfTbugJfL8zbwNO6PWh31iYZ5sN0maraW8HsC/Qy/1tE2+xb0khni5T
-fhb947oYGUbMga+SVXXq4kz24Bgo1nMnj0QXP4wnhyJIfgcQqmaMYDVxwRZLvqZt
-s0Fs7N6azsuOH+XBN642RjE7EBrpMn73AoYIsik8j8a2S81g0bcjfYXFSfn6tKLv
-BjiCemRnPmnDHPd2iiVb5AYpIrqInCyVp1c26Eq3Bs5nQH9riKIwgF1sCxVxVWU8
-p+E3iQP9N6IkVKfe5srDJ2WTsnbxZ+tjpgdmmGkYBoEgYdBheAfJzet9PPEc5WU5
-5dHOp7kA9bfx8+YAPLyEjf3t2LesVyTHmGG1lmDz5h9VY7GnTno3CyTJZxj2DiyE
-0oKzBKIzJ5lL6taHMSLL8rPskdm/Luefiwb84qihcDvS3jpFNG6BrlZx+GNtkBPu
-ZioPZyaLxmf3xlqXbGZc6bOg4302EnuzQhnj+2QEWJo1KMIdaHLnQRjFfQIuceow
-EPGbq2qTSbnwz5y/pXVyDpVgfDF6jsiwec7ngMsLntYJJEpwLCy8U0c0VL+vg3ES
-GNnNqrFD1GOVNo6ckIX859ZJFBdAhocok7cG3ZFpaIUwQ9AapgtY6zPBeqragjQm
-dpevdslK03nzxR8zAAMGD/4nIUkehuylxTm//WZLO6Q7LEH0s5shWj/GwaqzW/eC
-IMcgxOtVZUXgwSKWly0zLh0Xm2vGg22AE88zgZOz0mJUdYch24vykr9giCoCF5fU
-Ji6quVJPC7JXCt6K/tcJSzf81j89HkOfRHFf57YKFpiKLbOBpMroHpUiL225HEwT
-nk7UGTjH8fcHAp0Zt0u0QQtPvX7Uwt2A28F1HJCLt3P6cdTbcupVdUy5MTxghjfc
-tubpBbo/Gxt5kJ6c1U0U4SaOjaxdVznotJpNvcpUAw4cu29XpkZgN+NhEHFHm/o8
-I102J/r9CCFBax9sWMBI3kD2J2jgo15YcQLHvNQMT0HXopM9f968NGy2gFkXyCjS
-ZWlKIB6hsJQWfnIeiGOsqhyGowbESYN7UsCgM06A/2L+3yU7NjQ+LZ4PgPKqk4wI
-LmV6NEnTX/9bkarcLqWCt1KX6g+6IgGbvJ96eiI8ZwPxI3C3MuSHNiY1NSP8EiKE
-V3ds+OOIdV+yl3gQ4lW/2z6gBicpoElkN39Yq7tcO7rWgrj9oQyPslo35Jx3d53h
-T+6ytK8g9d3PRrvF9ckr9eZ5JfWuy20jIs0WZrDeHTm5Sn4eWiwFo/Mk1vrFLvOr
-KwLWN++k/ltz2nsqT1073O9yn5tPJvuCG4hJyNiYWkXKQnLXD2IuD4a8hreDIGn+
-JYkCJQQYAQIADwUCSlVAPwIbDAUJA8JnAAAKCRAZPxgKtV2ZdyjJEADDKmjRcK6u
-c9icCLbeFsAH29z7hrjpVMRMVn895p2bFHqaX5iP59GanVczflkDM1HTqiSd9x6s
-acIBlJyiPsvPzV6EnLqKOZU7vMZVOOmJ35QNEXY3fnLQeicrc0M+W1vOSWb0uEEI
-EUA/azzyKT3OBmB2OeztDbS3DkQFY/Vc/f9bgJYV2yJOv5LlL9EGw7T421ewKyqa
-ECpg87OW5J6f5Ia3Wos3nKfqIlqWsMVIRE1tuHqoLu3Wioy6fADYOaiSMO/Reez5
-cTQWzkJvbW8kGRYaFIolEnYMtBiDz7IODE9QvWD0RCt49MAXAVUcdrHqdSSrtNaH
-KeOTFwexXc89v8ESGhDNfG5B+gg7Pz1008EGXP7oWpkT6oPv5nz+bPmM99brR4kJ
-6D0EcD0RM21VLxZX+VCBTPKxlltU1w8uRS7Ra+Myze784PBpYLj7p0KIV2t84pM3
-zUv6VSGsPrg5YCIA1ARJgEg6fmZoto4OqQbvXHEeSpb8Utbow6cBrj7RmT6fcimo
-YnbDIae5sRfcLXcNqPxX4XFd1ZWza7lw8SCVyUE4yPAseTMPk/qlVJX5HuohIZ7H
-bwDdatc5zSO8EIlPi0WsaV9OoZ68rSOoOVzbE8gVoZOCpwzUYHYc8/xuUIS9WZWp
-f6p1tsImabq7D4ZXvixijfDd/1jHxA04LLkCDQROXbvMARAA1y0p3gdbrfj6XSeg
-vNGfN2bTjtdLEjIyX9y9DBAeSxTAPUdaN+kS7DxfsiCR068QNw56RPoXJeE61OPh
-XkOGwalSP0M1yE9fS7Ym/9onQdUhrUetzftueqcW/oLAOXwcxwbZ9iWIbr+vSx2k
-bIMe+0m9T7IUXna9IO3XiE4c3SQxWuxhKyTm6sOcC7pqUY6PvhN/zRQvnNEmr4VX
-xoqkNsw7tpWYXKRHhz1GFMAeVXsuqYOVohbkxOSp2NyUsoffCpmfShT1VGJwDckY
-ywQ8VkAyQpr1zpOX4ZgaMlpsipPHZ9Ab9UbLqB8+4SaFEo2wqOvJ71JdIrHwa+/U
-BGwh4X5AGH5uyEfbSH3SyzG9TLZQUF310khDivVdkINYfifGuLJMrQaIe7aRtK5y
-9p2zP9VBFel6OJgK3m9A7f+GNvVzq4C/YK4o8pqOmPI0Rc2ZGihvq50A4I8st3aN
-jm8QXAWIgVu+7ZPZqp0qD2xFQ+Qa7o3BcTWzPM4vT6Kb2Kmju+HhddXGK+bAeW1Y
-BzUOhy4kWBTE1+YwheJYG5na+bNSeOmpdOCDOfT6uWTaVfKnqDaIe5Qq54QRNiGw
-I4cKv9Ccb1vt8k4VmhQ9NEVGqiEH5Vq7WfrDIWWIFNuq7I1F5WoqQrYrnVrX1w36
-2kk0Za22tSBKDjWD+Yd36CKyofMAEQEAAYkERAQYAQIADwUCTl27zAIbAgUJA8Jn
-AAIpCRAZPxgKtV2Zd8FdIAQZAQIABgUCTl27zAAKCRBVk7ypYMVELcQ4D/9yesl4
-2hO75XeLIgjBDbMYZSMIRlrj6CQa58LQvlKw5+9QuYXGCh0YHyuQ3o4A7CPplNYl
-dY9V++griWfGofs8xoX2t4La8kjTIHSmNcvUVuYm5cmlJlkUUqadPXtAzB8Kz/0E
-vvNq6j2D98TlViUj55JfXy+GDv47A4jQ+71uFiRv3JwI52s7DYuZY1P1FHzGRW31
-v41UJEr8LivleiIOstJQZ7rsIi4mL3dFu+vV17dhSHA/lNLKk0dADwI46EYLLiL0
-nQgA9oKBNX06ZszE7tVPat+vos+sEkbHBlwnX4FidnOkmXs2Ek8xtKn6pwYj7flI
-733dY8HlgcTKMYr4vKoxKKKfLElRm9baY8wb9reYUAMEFL0VOgYY8EL3csoGdhfd
-MGXk77WgwPt5KOFNuoPn9VZdNMcIpIyEvVkTdqo/QAqR4bo1zliVOPGKGnhyEZps
-CwhcPLSIxMjIyj5Cyiyj+2alGf4UEbdjdAOYqQ63yIi3oY+YBWVxIN3SQlM94XsV
-mh4bxaF6pVRoEBWYr21QVFY6jA7RCWzDkIf0eCFkvbP1JQe9iQ6cB4TsAYqPyyut
-E0rGOefeA8db+cg5TFqAg4IAr+x1XtMM8waGYMpaouCpdM9aritMzcbKXJKzvfYa
-JHyY65UdTFlYgPrmmTXgLVSYPytXBJsrFBFGC9BhEAC/iPjm2pYfxOCUBiOZIFHm
-KZE1BXcMR91kZUdIjlSKsIrKDWi3ZsxgCx+jAGr3BraOVX6PkRsKJmDSraU0zE8E
-FEDMh0MgVobFm88lodJcgn8SHGogS8iyfRuiO9WLrNaktbaZUy8eSVHYY8A2fLrB
-w7iIJPM8WSf1N+vwZqmEq5kdw45po8OkzoHcVzWnQddBnBY4rlhcApzSjyRSygXw
-lcgmnpXYcNf20MsB951QyroSkOLVqLTeI8VPWK/djq7s0Q/nqEC5RAZ9x9mTn+xt
-PLJNLsJ4VKAnoWbVs5wzSxr7ZxO5eZvjsPQC7cJB9HNkNaFNYURS5paIj8RMFzZK
-oicU9r0nAXMYzFJOt7bfVcBe3qoPYkBYnZC+yswCnwacmZQWrzMbm8FZITdXgtaF
-DS7u4P6t9jxW2QwfKVtTGJHqM+VsjpgTMa6GHUfqLBoMz7sbbXHAHnUd9P2IRS1E
-hYsjvD88rrUHOM78sEfLS4kHbKhv7TPRFRqGVJ1Ul0umKEvNMezvv0OQgOLdnhEU
-TmHNTFE5GGFuQ/dijb1bju2I3FyIiRtviv1fqRxTHWRA7kHUtL+95dFq1EcmoBiP
-ZDWW6tkKxqP8ZBEnBMdC46IwUEWXy1lMaBHodJEEtGUFrw2KS8VWDhgAK+BLKWqD
-36HsZhw3C0wnx2+IlMt9rLkCDQROXbwJARAA5HFImRF3mJI3fv3bEndHfK0tkzVN
-KD838cq6gfwxuJYy9sutatfLRlE/WVjS07t/7vaL/9BKiwwWmdqhPyXoANPadM3v
-6KWbV7h/MM9zTV4ViI8z8u6TXgBkQzqe+YRS1s1LLqNGeh32VTCjkzpIgf/IcOnu
-oYqhx+5cqNCl/26YGMp4tzxcAGCWwzqhhOD4UkHD0ksTy5RB0NCqb4gIPP5eh11l
-+PRm6n9kgc4T9zSgCzb01Pu0bO8jWTM0+q/JxxanweM47Kjg6cxq9djQNLFlaqGq
-Ft4SUGqsVgfJusHBs+0gfM7C24BQ3Z9n4lupv+tcI6GlPaR4lqQ2zHjLclDzPwOP
-Qa0IlkohQ3E5gGUPij2jrF4a1zXOPsd19XCu/yrkDsr5NPagZDvDxCTwOvvc0yCk
-+N+xt061WWIINYnSN1cvEpvfCy5MfQy/ZSSNy35QwI13IWimRyFIwUBJOBItNPfa
-Ye4C/QkvLJGsmVq2KZR+uSzjEeTWCRlXPiwqqYefWxA63vhCg1TRN7Cof5ktD1TX
-XAhwMAO0BjXgou3/ajF1CCXmvSJvIyW8gPeKd8fPv0qhVpvCdQOcQINsKjQKz6Rj
-r2wxGZhFwfMU83S8BWe+IPex5KxI8I6kGgoQbXjlwHY5pv0wSaBhr7bJtID8K/O4
-ZjHhv+IxW2FUfjcAEQEAAYkCJQQYAQIADwUCTl28CQIbDAUJA8JnAAAKCRAZPxgK
-tV2Zd7nlEACray+U3dgfA7t2HkuOybWjy1a89YLaGovc6rItTQ9HTEr5cHmcOC/p
-4cCtRLB+25PCl4PfRC5aVyMGzFmQ8HxZdhn923dYvdhuVY7Mnm7IKZrmkf+NnsyR
-8NJSdKoCbV/Yjcq8YHguswlzQXOfMbz2dAD39TG5JipjWCoRyKC7QI+BwPBBcpKu
-p7ALK7IkzYnjwGThM4ocbNsjPIIva4Du1DdPvB+bhrHOdUJ1FCqID23yWrAUXvM7
-TKhkl0vvIhe5wJ8jEMFVCJU1i2Xw3D01FOykQ4GHui/kL7Ddm91Vlls9v4dJQjWs
-jSo136cPld1O4Z4bNd3PBZpfJuJfs0NepX4+XGcmgk3HdeGgImmfc3LqVGcaz14O
-cnDy4IPxRHY6W2/+S8+UFxz1vHDAAX96wYIdadkkk1WjOLpyKhy/hCnlbyL0mx0v
-yQZYCPTCY1E/Olt/uNuoRU0e//ynKZJeqvF1qqH+gNI1UQYtvlqRAVdugxXPC9af
-uMGyaazcT1IFUPLmpuaxmUSIsSBOctVbKtF3rjluo1VTwr+6j2Bm1CDCXwcLWvm4
-pALWtGnNPEgnDm3IhR9H3ORWR8ibPv2a5SdJ/wQwawjWtz45s9xITpXlemNxOUke
-CET1h6v4C4t0bqzinFzi8CwrR/uI7ACdzkhOHU465ffR3IfRiNHi3rkEDQROXbwv
-EBAAsYX0xg2Ca/OjLFNiaxyZRjcNIyQGon1Jgh7ybfSAXbXnoVaG8yWf0O0si3jM
-JsNkBtGhRRM+TmJxRVqRj8vgrYBOq6FvSsbfKKnsbdL8Uxvna+t1SwdQ72CXWctb
-F10LNfNo6LGwdWpyoXQAop9Ny14TLEgj8lT2WwVd+Q+tWtlZKsFYVyLXwW1ZEF5+
-hpesFdMtNL48JHcdOSHN0L28DU4b2V1m9D2eZkMcbZEd9ePYKclwfU75fYxaSpWD
-nAXKfAPR10vpL+H7CjFxiYSDnsSQPO83fQvVrTDyPacR0HDbO0VeZ9N6JAs9p6QM
-QJwywUhvW/IMvbN5xvLK7Vqy4ODoej9vSGj5QqT826Yhpy5pP28MmSlAqseDiSNn
-qLvrAqmIhu+KAQo/Kesbbxh69SI0zeGu1+Dj7bnoSgvFvNiyNOY+YsIpx0GnSXS5
-mQPdxvwHuWcVaIZk+ZDQq9cLQq1PXQHyiKbLSnhrnUbKJGs42ecyKZ0ZXxndbEUi
-5MRoqw6OIvzpPYWAwShenMZTpMAT3zS78+m1BYZMbVVUHlwlhOSw3uzzm8klmF52
-jJLFVtDBfW9uJtk28ZYHwUwXhUi28BVAgnzq6IbN78cv/GRJYxSRiXwKhAS2+/Gl
-ul4gC60a8qNL3GJTqZ1Rul1XT576acS7QBzWthxI1lNSOH8AAwUP/1NTZ/iaW1/2
-wH8+4taP2ksHKbESzZ3g7qhZ+wB+iWQbC/jb25ECr9uJ9KEEhIsXonKr/SzIPjHO
-0rQZjl2I78dNIvUjwsG/hkKHv3m9qZU4Jv4hvAh3K3e8vct9YSpzpRtGRQ2fqEdF
-32Xkhyns8T8AdU0rpysDYxYd2Y0u0lkZqZSXPfvwuvWehkL5n3iHM2wDBxPnlRTw
-FC0L802HjIu0b3OSr08PdLQwFVrICFMS7oTNSxqd3SVsCe7Z5yCpuAi2tdKwxPNt
-s52wwRHZmyC8HiAMnOkuwNcnH2TeU+DDkHCiKDFV9DJFw5xNJHaEVAJJlsV4a2p/
-0GZDrtzND/YVoFSQxgBlfCLFL2kko8AyW1BjGomTpgJ1mWXMi8sPGzpY/MjHDGMv
-vzVhL0YfDKTddmClqxFoeNYFf0C82yb1JejvjAo5AFKrjWzEtwBo320jSHte6v4B
-RvzEsA8136wfnkID0SHPk/KxE9K5djqROQ5hn/+WZzE2trqqQLlWIoe9MCfF+B6h
-fKHw9CoyXRRfWlu7K8F+411dYoo5oFgbJ3FDGsVtZNhCRES/xn5klz538AIUWiv2
-qy7LJvvejPAKpnTziUEqkGfNmv5Q9Q/pN6xJsreJb03p3JLGTddeicNacr2ElEDq
-pOWEbpxL2IBOdNYuYKYQdaxCUxmPwEBjiQIlBBgBAgAPBQJOXbwvAhsMBQkDwmcA
-AAoJEBk/GAq1XZl3mwIQAI5IMKuMerWu++Yyt7JgoqP9B6pAE3bh3OaKTWaWVzaf
-0HSezNU6gV/yc5UVezARSS5R+/lmp1RprfKxt1ZtuU5cKHYdSbr781vULvnFIffF
-Jlqw2VV3TOlNxGammzyFvxE+CLUC0yQ0tlNrc7wVjZDjN2mz28TqOeZsBfHknBQK
-WgtmUbWRCqm6ZeZHFHja2Yt5u5exhChbg4hX23ao/w9raTlly6iaahqNYgJhcnlN
-REY9ecV723E7IaF43/bXfLnDJiA5nCqSCP6PM7yEWnxQVo1uyijfzIqzRBNrh99X
-G//ucPt+h9JveabuZE63NQTvSWdPQY+fUYze1YlPfdRgsTcm5hJ5e91tAubH2Fv5
-LkIIUzIwdD3Cv6c9inQzHw0DUzbL2YxiWDQU0LMNU5OtlHxjx3Rv0ScoyLN4cyJY
-glZCMHsYRzsFqwAdCJVNoEQTxZrTCTWtST0f9CECbzcZlIVtzi3/IkoEExWxy3Mf
-uekIcECixRXyxfvdFEIGwnAI/rlzTl5H2HxKjdo3MFWAJtCpk9DMx8gc7VLVpVnt
-WhZwzVxsGytW3CU5cz9/uuYlWKHlf7b7MOaDw2cQhhID9FZV3owuhPFRWvhr3LrS
-R0YkaPdUIXEHu3dXm62u1t8ADQLnrqI1d5P2u9Hhy5BohUd+QYaLwq9IXZ65cNN3
-uQINBFHNxxoBEAC7nB1AFiIke6oUVZh1zKL8+Si7dlQ0J4Gcwi8jhxSVnfgfrCYg
-tLCo4zdKnQSdh8jrTDW7oxiuSIbkzRReg7sTGA8b0TUyTemndGXNb/ULzQj4KbZW
-o9lRtBMbpuGM0R6SNX0bc8hTJ54hH4FLL+l0hYSrRZcZ9WNdcOleOQNX+fU67x+l
-70lLIECoje2+C4Cq1bhcVXF1Qy6DS+4DLvZgMoySguUyAyp4ivVcGdMxkzS/iKvZ
-drLiONn2hlt+m6j3h7dLdAQKBLRD9+njE248t/+aij966chB3BywmF3F0Val72rs
-J2bxqRVS6xxeoUZZout/qIpX2Y/pF5slpzvADWdm3XG4a0tANsgixpZ7qQwHFXn0
-1Pz2NGrur37pvbAk964XZJ11oCROBkQArCMGRrjHwyyUbcoaGdxBdDiAoaBhyl5J
-vU9QCs/r+0D4w6wqknfAl7S0jX7+6Nr1JaRJAmzivKeA8xGu7iJlM0dLa+bvauCz
-G56HCVxJdSuDb+A6ILa/Rv3KktwWDn3lVI7KEl5lBnfotTSgl30QetaI03zw2mMI
-sSrifRm7yGwnLctJXc7ZmqZQdGWEO3ydh5ae8yTc+smgnl4fA557To0Tv+vdY6XA
-2ulV3TdvmlCL7lnhV0lYq/xMJ6KknH4T4ZbB7lMG+1jJXrxSFL8kZxcqZwARAQAB
-iQREBBgBAgAPBQJRzccaAhsCBQkJZgGAAikJEBk/GAq1XZl3wV0gBBkBAgAGBQJR
-zccaAAoJEI77GWKQiPVldFIP/j5m0erquVWssZyomy/2jCDK/fDPz0ppUWpg4grp
-UAWUHRfNvE07HopTnY0U7XQMSC4bCiljsKtec8M7T08RqGOiIRaGr2FzaLXEBDEQ
-0K5P85hjMKAZWoGCvE7yspeVEKuid0VBXtDLl9X0b6Kz1z/JhfKsv+OusJOAAzVz
-TA5gvjhRcV6Opy4Q4k99JFIep4ZRHompWVjcTH5VPf0JsRv5CRZ4CZd2/2htCw0U
-lF0MSdqDErEQGD98LdMf/2kYUA2RYxhaG/h87Rk1ArXrD1Xp1b5qe0Rp5JZsaCes
-6/FHE/jHINigsGUHEZ5Nf4vWgKfrB2ih3WUkGHGpYFlTp26Vz+HEUAlkqktYDS8Y
-dUeP0A9oG6yxh02QNdk50Wm945xIbuQLPiUOjc6AL+mKQMGGgNlhpY28FvnHZlot
-lseXj59a77ebk3ISSy0Bp540wxiNQypTltjsIhvVvEywpBYrWFRyOxe6vSj2LinE
-U8YmQbRo8eC75gRWrdMgWZF51Z0qF91S6RW0n881HEtXG8eH3ACjkbq5f4LP7rPX
-KMT2sJCOW2aZRephlznfpZ6pMo0HgdbYRUkZjchABgKt8+Y26H2kBGnvsFW98gdm
-RBULGBtoifNRz3D8L51ivfeVTSyH+lDPLmNurFVGH2d/Mu45vRxAQHLzIY7XIHbp
-fgLsevwP/AqjbDpvLF9N5oInovr1fJAOnRvdaxrrngGft+FC63Er5soDaZPktK5j
-nINrSCkZiCTCG/xtPBLynj4yRvmgwcjtw6aEGtnAoz41JkPmddhj9pThAkuObZ6E
-HQZPV3NQBCYvw9qDod1ZJ517QB+AMYmQxIRkjf7g68J6J4+9VVZDP53WXolF/CaF
-g5S+UqD3Vw2bCKRTq2JkXw0Cfe3zbq/xz/jGU613/PU9pgi8hKioozQATxvCfgZP
-pm+FYTgbtsYXYTjXciRTxpoXggW9bGl2ICYrIfRtDNQFBcgTSylPIDqqrBawYkA3
-jZm4vnw1SavMzWh1gh0QCJPtn8LxtjVL0Ck1qgwlVlWSI+GpPyOaU+KgefVvn7qK
-eum2OagJjIPwnDf+N02DFx+JGRcVAU+4wblDHi0chP5fH65YrXmd7d5QfpEuTKdI
-5J0EuEm4PFz8gXptzOwllwKV7wDBGzdEIZlt4hXjixEw2o8gKu58s7qZcPApb7c6
-ec15km0oZJpd41+ZxuUUdWmnsQvyJHe61O5g5CXqiGz6lSlZp92Ai4RJwVuivn2P
-ropwMXvZ+D7BWI8ETXzWtYknZWG1F7Dbhe5WIuAGt5NGug4BXOXeuSvfazFo0MKR
-CqG4TNe+Iwee+yub6bGVcPu5R2EMjHa+koR0YdTu3sRbJPZzQ72CuQINBFHNx18B
-EAC8lhILAFOFiS/PFhYxGKfN+Tv8g1HaSIGCFKPXUUT0YwYhJCgwHklbV7cFagmx
-HGHELRFW9Jzw2SV6r0206CsBrlAxWXX1QjI60eBdiIZjhSTycG0VcnUCDnI27uJO
-tNy/UBZtmClsuuCx2GGCsgYSNucek44mFvmvsaK8ytENZS6lRriW6l9th8hE/Lj+
-Ss7LRmSVPRf7aN2X8o5Z5OMXf7kS2R8ScFAGG9lkyr0YETg1NPVE1HUBV+jof1vk
-LVprA2bURqld1nKKOr6HKLuxM5eZ7jNraCoSAhPPrfOSl0YAt+hZ8ZepwfvFgaek
-3V85VjVT79cOzkdHMbDzCsaNhS0tM5qZL/UZTcgRtHgH/2mHHLFJ+k3fd4rY0QUq
-5ngBHo2PwWx26Lc7izfvwPzY0A1zuLU4YqozppoWhVMoIoZ5dPrU76Bd9IfrbZ0u
-M6KJ9nItWQEOA/PrfydSur6578gHbkA1umGCkLQuizAqmXQ5yU3Nf3RI4j6zbRN0
-3DIw7vVN1BD2eL2x1w9vKjjcsdKuRUS0aehfa9WE9WKEUyY8dzouzl8RAgLaRcot
-y/N6jVMi55gxLX2j4PtdVChXC0CkuG3iH6Mlbuc9XmqOBag8u+TRXvNN45UN6nbr
-SlHz0QAQ7SbMH5JEK//3EaSvrzWFni6fOpOCoxjIIPNJJwARAQABiQIlBBgBAgAP
-BQJRzcdfAhsMBQkJZgGAAAoJEBk/GAq1XZl3cA4QAIJAIc0DDP8JrkDjKO3Cf4wx
-mBSzR4PUWrgRbG+A+XMNzYNQGASbst014ckSNKRAmsrzSvBINBOAVliGZIbI6d7u
-jbvQWHrSyQxdyiDrPrz2P0qwMu927SGDeZB5513rSDaH6D2U4QI53V3yOxiWcAIp
-LUrg/j2LQsMUSkUe9vO78nKw9oFdPHhzTgVgICmvTilKYzIkVjInz8ke4I+EA439
-2FLq58A3lw9MgWi0XEVnR9c+ddorR1I5Ku28NnVkjeXA+2uQFYRtcnSxx9PXttwt
-pSossDyJD2K5H1pjpF0GyzCVTvBJgHLTZ/bOHfQNDLv29yRVczCjiyujNEM1Sm/k
-4V0IFBB5nUDX0xDhNRL51tXJQ0HhpeJI1oDzCvKWtLhF2qxH7bx/uYJBF3GhFQ0f
-Or6zqDf1lnJnJTElY/pbt1teZsrbATPqCQnDkNhG9z8JMceGYl0nz31CaWI3sBGg
-TCY9JdRLLIWQygaN7jOlyRWnTpnKRgJQ/dOotrf9DWvgrUYIiPA7pubQdwww3GAG
-5Ieb9jnJtc8YCnM+AgWAqQoDxM49zKjkOy287UqGLO0+pL+wjEk+dDsMuqwba71a
-OhQo6gZzfG/eHmKCCPITbSqaAD/DD9QRhULz99GGybdnLPoAiurrANxL4e0UkpDF
-L/nyyG8tKpwEuF8T7f7kuQQNBFHNx6MQEACbR1gnAryeceHHc3ljQxERLFBCBZ4V
-cQkDYxxpQRMsk5ZvxH3u2I9w9oKgJNou9ZI8XLluqg25CM1DGUKKoV7CDsdaP7GC
-gE6OMj+VhPr9mjKsTzYyHLMaLPSOX7t/mfT7SbbZovknXIz7U4UeLT9djTlP4pen
-FFv0csVRAuETPrlCHFut59evYoGlVax10I9+T+aC3v2OY0yB9vukxalccvFL2RdT
-lV//ElMNrPe7BoSVrBlSycDZqYsU53QxCdDCWJ7+43iQave09edVmVscxZpiVoHd
-vcz5j3u/krMY57QEem1ZFhygsYaG0A1n1XJ3cn5nf6oIJvG6kHZ8mgoi+89rfbg8
-w/N3lUH1ZABLgzN+hJ+byexHc6epQbH+ZVmJEnMPtmND9Wcpg14gaXH+1ygvTnW1
-FusFDatdmM43UJ4M+mP4scA2s0Iix9xXHmbbEQLWp3C/n3R3n6ImTtoekAfH3IOt
-4eoMU0qgIn6VhL91/aGBxQVhSPWR2XxkS7gClCxWAatRMWWf6Vg2uuJeVra1x6Yq
-iVrsEx7446G4fkv/z3jqUl7gdt/KBlCg0BYE1meBqJSnCvvgDXmJ8lEU32L0IE/A
-9WkKCMMx74+GdBKATCuBGskJrOwb8dCVXBN0fq4fg/SBKjWY3JoQAX9JcXmcg4oB
-jGWpLUX5zU3CNwADBQ//X6WxF5cmQo0gu7mMjGkWo+Xdl26afEDhTppucb/rxZka
-Emucxt0R7kzqyxjqrp3SNJhmhmtSm9UkhSyvKHH1R2jSF3VrWRZYRrUgf0PJLelI
-WGRPWcnlw6WcmB3imgMEtLKcwRvhqUhgC/wc8kyPD24sDb33dOdnqRsyfX1PRPbB
-csQzSbQfnoZZDDnJbxuNOnJYHquRo2OIWCKPjchfSoe1U3JioZwD9yYQj/6Y5RU1
-5Fk8OutmJr49FT9I62qQOwGJ4BKI9FRTX+y8rCF3dNOpgxTABmXjqAl9SfghIIjk
-SXgPNhKioxQ/mciuji+2Hdoim3IxCg0GJZxFxpyNTQWR27kn/p4NhwpLnRnF/qD6
-b1N54pL3o9VRLgVR700+/vSu81ipl9aurYUrVsDtupcEzzKpyb+Z+A6nwrAQb/Cb
-SBnCoV4w5wU2MPeLHNE+gp8VLbS+CYgUpchFu/XKkgTIqgGIvQ8FBvJh3leU89XS
-qvRb92qkZ+LQbpDbpaJGM6G9huijVsAChmYEKy9lFa9/fH1I81E7M6q+AawWyiEI
-KBBVLToH4GS0TWkADrEZ6LI5+P0IkplDm5ttOsepfX//fqkAJLhfy0Slu0KE7hvr
-S2RDjnjrUFAJhv/7fKKzZ7j8BkUINXWK4gcytkzkBUPF2mfpUH9CCetirVwVvHKJ
-AiUEGAECAA8FAlHNx6MCGwwFCQlmAYAACgkQGT8YCrVdmXeEAxAAnH4mQOYOh/49
-0YmWPrt5mKG0rv3kNTOOx+TlBpcXOI+RFv4JliFFfmclqhdHyaveRZ4Ho1hPGaoJ
-RM+rlB0nJoWFo44hN3dQ0Qdv3WsD9ewzi/D1ODKsvYZmxd7S5gH0K/wr+g/ZUHMI
-FeARHbviBkQM/bq9PDdYK8vDbTzix9Xk2nH/zIWSjnY3Bj16Gyn0Tkxc3gsUal1P
-ypTuMbaznHB9SljvkbM9p+iG7Q5bG6tfUv6eJR3Ex0J4OcnVEEJrpq3rDzrH10XL
-rvYXSofAYjz2sQ/NpKdfL4dOxLiD/67hEXKjZEH8Pp53ZxMNCC7sdaTWkaLgcCE9
-fzQX8g3vmZAXMPU2ET1CNjkl9QvCx9yRGnY6VN6pvRmQjo/L2UhCqN9xWcUEmyhB
-lLkSzcaIyhpaQ9lLTXu6uA8Bh9XyksLo+4uqbfuc3hK9vkKqoJNP+hR/sdHqgEjX
-Ks093B643nXVe40az5flt7xKlR7PI/FVm9ALoL25seBQbSNRemZixLiFAQev5hYc
-/75PaDozWbhVWsK/IN4dSdHOk5fjaJyIANPRPm0jvYhh9+snJ8A7+Q1Bwfw6nbbd
-cQnZiHSbaFn3zkK4fkxzqnPGov3PlB4WZjmQLwzbUmZ3pReGA7z5R9MjT6ZhTpzg
-CAf4F0UC9mAucwHZOkjI0HulK1HliZc=
-=prMe
------END PGP PUBLIC KEY BLOCK-----
-
-Type bits      keyID      Date       User ID
-RSA  2048      0xB96CD0C7 2001/01/04 *** DEFAULT SIGNING KEY ***
-                                     Bill Stoddard <bill@wstoddard.com>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: PGP 6.5.8
-
-mQENAzpT47cAAAEIALLL4JXm/9vHTouYSWrdDvAvNNxa6UwOZ1Sp6urCgGtuRLz3
-ysFFY4hlfIhSUvMdBuLMY5X73Tzg0+LpzCBuvRHasSUWO/5UMlTdS4LnI6oIS+7T
-Nc//iwPQaH+P3CU2QScftyI0kS6kxr49Ejf4UZrJwMXsgvk+oDzRIdx1X8F4A5oW
-oAUl2njrqVodbO9nPifBPlooHg84Cm3r1xgMK8OPPSEiVnmypmwTXE0fMsxAmW/6
-AqPf6x54tKmAyFY6UWM1bX/XhjVlwUu0Ax7ndBTKgw2ZCZA3TY3GQTPNbiK7eOpr
-PUYN69EIKwtyFZHDSalkVpaZB44/nZygsbls0McABRG0IkJpbGwgU3RvZGRhcmQg
-PGJpbGxAd3N0b2RkYXJkLmNvbT6JARUDBRA6U+O3nZygsbls0McBAazZCACW0+ss
-3zAcpJNVI8rBZGwRSCEHW+NVRCQvrT4WiXQmb0fcTMJD8WD7kkMrYxaDuRzx4Iqr
-nwdTqzc0MieM8j0lqa7zaoncxYFh/iLeeZKvK1988UIrVmFDslRQpnzeSXLjUWnF
-1JYsS9+sYt8NBJGSIGXALji8QwcjpjRagzNjyO9YEs3TkGqdNslTQo1LJ2ZNIH6T
-aIWoTdnoU9WUUldsSQEbYB6JNNP67eiFTRZZnKradoQ0PVBXtYZAw1zOp5y/xPH+
-72vhKLk7+Tt3zaV/SmoB52ssE7AXazdQtHfH3N5XXtZJvjIIf/Y/Svw+OaJ2nD3n
-Jn3b7QtvWvkY2geD
-=0D9G
------END PGP PUBLIC KEY BLOCK-----
-
-
-Type bits      keyID      Date       User ID
-RSA  2048      0x423FF2F1 2001/03/16 *** DEFAULT SIGNING KEY ***
-                                     Paul J. Reder <rederpj@raleigh.ibm.com>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: PGP 6.5.8
-
-mQENAzqyerAAAAEIAMPeottLIzgSNklzro66gEnshbRLeb8MRwlivgOMxl5MgDpx
-sH44MPaYKaB1owFQdVSSA+k8ARrxSbki46mQvK53+t1yUeVtaPu85GBta4Q2paXJ
-+2/JVB83Qt8ZdkR7bA3Rxet+Poye4wqZcNQW271FS+sUkTvhAF6nb+5nWFNyKkTe
-ApG9eudukksFd4Uh6ekMjpOX0HPUXoyzf7CmwSERZIny+qwK0dkKkr6qKvZZOEXu
-wjnFgQoqcj242usLpGUfrGZCDQsOheGmaWH+RxrmccOqqqfmjo/EoHNjmEvfRSDP
-Mviq9p574VRsKdt3smkyo63DcaguX/FV7EI/8vEABRG0J1BhdWwgSi4gUmVkZXIg
-PHJlZGVycGpAcmFsZWlnaC5pYm0uY29tPokBFQMFEDqyerBf8VXsQj/y8QEBX5AH
-/iGMf93L2+1NP2MHZzuggQrcRcf7fkOdVRfx0GcMUFuet4G/0Qg/NKy24J2xMVLI
-E03//bn99c47BmGWlSrsuKM3nHXDtLHfmX9ajWB2x5TGLsQqCubfvGyxviFKyUKr
-tVLrvOmfiOGZkbRjD1r1mjNKWONKgUcjgFmSqsZPnZsclNjOMnqENVwOtSS14r0K
-YMquMP/sk7xDNZlRVUPEVn2TlLSBJp0NiAzwzbafbszX6xHLRJzE23hCGjl0ZnX+
-zkBusLpUGkuRkK6phJO6pg0E41D5QRnts3pHaDQ4EI6jEnWwlIsavrHh0mAw6ocf
-oO+6PlKrPkqjgRSHYewLqnU=
-=WB/Q
------END PGP PUBLIC KEY BLOCK-----
-
-
-Type bits      keyID      Date       User ID
-RSA  2048      0x6BBA9D5D 2002/04/08 *** DEFAULT SIGNING KEY ***
-                                     Cliff Woolley <jwoolley@apache.org>
-sig            0x6BBA9D5D             Cliff Woolley <jwoolley@apache.org>
-sig            0xCC8B0F7E             Aaron Bannert <aaron@clove.org>
-DSS  1024      0xB0D5F771 2001/07/24 Cliff Woolley <jwoolley@virginia.edu>
-sig            0xB0D5F771             Cliff Woolley <jwoolley@virginia.edu>
-sig            0x6BBA9D5D             Cliff Woolley <jwoolley@apache.org>
-sig            0xCC8B0F7E             Aaron Bannert <aaron@clove.org>
-
-Key 0x6BBA9D5D fingerprint =  B777 8235 B7D0 36BC
-                              A8E7 C012 842F 3E99
-Key 0xB0D5F771 fingerprint =  3DE0 24AF DA7A 4B15
-                              CB6C 1441 0F81 AA8A
-                              B0D5 F771
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: PGP 6.5.8
-
-mQGiBDyyDL0RBAD7CpRGu7Gvtrp/J/wDKgOxLpX8xLTFTXFnncHctLYKMta6nQ1y
-pQpx5WhrVyE3wkVPTHbDfd+mtviD8muBLAVdtiVbpN8YxRPxg4KAY+yzpBtIEsUW
-xXc2C6JHgwlxmW+WNEUvBTllsG2m5FDuLiMw9UA7mGYsLChbt8S7T92YEQCg/1NP
-toNBVqZ6X9n97L9SaZuykh8EALlUMsXlSauI/CjHbOB8/kXcBah2p33/eD35vEt8
-GVMwASc6N7u5fwnlCeEKRkLVZD0nmZ/8/50eQyQdL6MCPDyFERBMKlAs8VbpfwQH
-Z3odHJcSbLEddmm3Y7ToCTpid03FO/UgonPbu/N//BNuu/WLimO6I3ZC9EYAMwWW
-zzhEBACv3IIwjrkJHLxJZh6NJjoXJL5/w0FgRA+C08/nZBxcBWElavk1ukpxyB2v
-23P531IljA8MT8VyQktNSzfAccQuvY3gIweDEgPXxpc5c1MqNihixDtZvAtoBqyr
-nmKWgl1WeW26oe1eg/0XmpCSg5klaeF7EV0EV5DYUczNP5Ecv7QjQ2xpZmYgV29v
-bGxleSA8andvb2xsZXlAYXBhY2hlLm9yZz6JAE4EEBECAA4FAjyyDL0ECwMBAgIZ
-AQAKCRA2FSLXgqt70TzVAKCr/RJ3yVYBNdkZTW5e2PFFhHfZhgCfYBAPdm+WomzF
-qHvigpnQ7KjXNuCJARwEEAEBAAYFAjyyDVAACgkQ1zqQuGu6nV2XRggAuGaGWQRp
-apcTcrsPALlzUuzFOTApMePxmtaB66fKm6zdV6FpC4iSW5zaMZOZTNDOWD5541qe
-Rl3JtP+lo/ZrY91gO9mmjkB5cnXQrzLP84rfL1LELgTgSJ3lcCFqgp6dJr3NI0UF
-eMYcAu/OjjUQ9JNoNsxVjTvuxnslSOekQWU28CjD11/pm4n0VPlbPJosHv4wbncF
-DplifohuXoQnJX7a2JbCTn0+YDvUe9+aMj6A1/qftgv4msvxqL7f8d8cZ5vwK+CC
-VfcVNsFYf/EblFH9X05e4nBt/P58SnLLWxsCg6foNKpuK83SjPpTAYA2s8+AJ9CA
-054a+swKXbFWDbkCDQQ8sg01EAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bxbrlL
-OCDaAadWoxTpj0BV89AHxstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJPPT2N
-286Z4VeSWc39uK50T8X8dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrUGvC/
-RgBYK+X0iP1YTknbzSC0neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVbGI2O
-u1WMuF040zT9fBdXQ6MdGGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcpesqV
-DNmWn6vQClCbAkbTCD1mpF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAgf/bu2YeGmA
-ks94lBudJLT6kil4hSw1J8JuKPAEJNiXLupxmrMDOegB306y/GGIQg92kbgbMANl
-wrsg3NXrnMe65PluraGnIovnh9KO9i4XSkIWdB3zQgTlkxhtfZ8NJHB/ihSnxtTa
-u8zmJ1514QJzHH6lDlCzYNhS4tPvR6deIoUwzSupi8L8DKNhS/dwlvKmKQXMpII4
-PULCDT7/nFbB35GmA0E6vM4ZnmHaZNDv448OxoePR8bKy0RpdNIznKHV8MbhI5il
-2IfzbiqJ0HIGtZJCaJSfIv2+qWsQf2JbY+uln+KiWwSkUI1MvqUHKKmC4/eMPVSK
-xsm2vrikocYSgokARgQYEQIABgUCPLINNQAKCRA2FSLXgqt70d0RAJ4gArDns42K
-44A6p/EkdHPvPRt2UACg1PdswGHhdskOJmGc6rftbDon2jyZAQ0DPLIMKAAAAQgA
-zLpNBiA2pEnKa2OocaCvTSiYn1mSnXPbtqsBQdodIeq0zm8x1YizTWzhyocjIwM0
-N1i2QdFY8RQfmiqjoEOthzPCpP/3/K+BUYOpaq1Oro67DvmDnS8tOFvhQG2cDLcq
-LXW1v9cDTSiRLP6cNZVyYYtlQAPoIkOVbnzBE2nHSeS5nv67XmDIvTNZJFlFHnUr
-cbZ1Lcbg5blL94teRFNaVRaCVpBKGiIE3XycgWV5+MBVKRH0XOnmcyaOS0VaFIr7
-o/g0WjZ2Cn8lipjEx3KSi0cERIqZQFMfqTGC7oVuuyOrtvp6S3/9ltmtndkzJ7so
-RMRnjS9eZW3XOpC4a7qdXQAFEbQjQ2xpZmYgV29vbGxleSA8andvb2xsZXlAYXBh
-Y2hlLm9yZz6JARUDBRA8sgwo1zqQuGu6nV0BAaZLB/9tR1ZYc2tB4uFGqa1YJbIq
-7qRYESrESkeePJvt5A1WF2n39zY7RwRECBuUhZe3GJVohac+kZ85pS6WbtihrO8I
-HSuSm0HPvfkoedk21Md/zUzaaq+gKE/0eaPO1UycwZk8F8jv4uC2tKBwfbZyay5L
-fQ8YcYM6XFzV0uY4oJF7x7jTaNT6iyQtsPPo6UAxNwcaZFdQ1Yz/ZFvl0vK3ssYz
-h00QsYxy1TJGaqHXO26FlIBzP24xl//jbMVS88DKmltO07O1ZzZ0H8gvX5u9AYeO
-S4jt7wJlJql5jQGQ781ZybGAzBma11ixK5XItq2mVaAQdJdOqMiTmJvWgE5/ymoQ
-iQBGBBARAgAGBQI8shKPAAoJECFFSvDMiw9+E3cAoJCOGqlkIY3JXY7rYHqICrz8
-D7eRAKDOQjhlMF3OOD6KlGtnuBpdhpK6rw==
-=gjEJ
------END PGP PUBLIC KEY BLOCK-----
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: PGP 6.5.8
-
-mQGiBDteBSwRBADAFBGWcqz40R9Ne7jX6zyk1XMqVsab4LNZMzd67n9J/Qni34Wq
-5ZMHKUUqMYgIgKjUB4J7J56XVoPEujGBxG7kb5HOi4Vt8C8jg3FF551yM2WgamVT
-cvEKwHeltYeIyYdq4DLCBt5GENA+/amakMS8LiHWPSz9+/RLzOUJABLuuQCg/y5p
-WzAw0lIO0OoFz2U1RLQ+RZkEAL33hMq4C9yfGsEKkSp7od8koJ7Uw6SvZEbRLaiv
-pxjDCeqM0Kd4CNyVgprdnnYmMxtsQQ8B1Hu9NE4///h1Gk1LWZnXw1/aTbZZKL21
-JPqkxdjRnqAztOuFo5pO0+EGG6Tg9euTjr4rZ9VhAYaO53Yhv+uDDaVB14HXtMMl
-bw+1BACNRHYjHxJPrRTF4u8lwgEsUC15hPUQZyqCOtYrWcu/FcfEluduA9E/7OTj
-+DblPWViPLb3+9ojjwA9A3MRFA80nJTMbloSdNsTvMq+UFmk2MkKS7qsAMjLRC9P
-nbHA5tzzHuVscDZDLp7otIKaAGAqrxLXPc0DMM0JB6WG0A5N2bQlQ2xpZmYgV29v
-bGxleSA8andvb2xsZXlAdmlyZ2luaWEuZWR1PokATgQQEQIADgUCO14FLAQLAwEC
-AhkBAAoJEA+Bqoqw1fdxNb4AoNLFL4QgmbCEZhyVk1PwtC4oqmujAKCjymGdDhbi
-SruZ7t/Qo0bvGpDa3IkBHAQQAQEABgUCPLIM3wAKCRDXOpC4a7qdXdBbCACjf9kq
-TL7qzPfsiy+yaC7f2TVv9pzNMv6Qv+ep/zkNGYxHHokM6OQtGf4B4v7BLZ/23BS6
-Vikn77Q1OTtqtM5YTXwLOGIqjqgp1fwxIPAN0yekfAuGQi/gOpGVlRrOT0V/g/Yh
-aoHdvhHo65pObnm2sCOt6hPJwbns2lgoVoWdlNkbsuU8oU8oFGY18Gxm1gNpMJsQ
-48RHsFeVErIh3DA1tkCLOMQ0HpqVH7185JlKq9qaU5yAmUNSFfuHN/RHYWAKAN8R
-mN4EhVLigxEk9/qU2lJ0RdSonGjCQU8WXGM00V4z6Oael9d6q1bsYKidYq6lvN1Q
-jKAZTCVLNP+J81p8iQBGBBARAgAGBQI8sfqxAAoJECFFSvDMiw9+8FwAoIHAupTX
-tAqACQ4JWN4THVPZgQHLAJ9n7mpZ3H0Jk9JsT7gkfB6lYxR0EJkBDQM7ZJxaAAAB
-CACrn+bx3ALwnnFGAODsQJXtYmjarJ3IgknCW5G7NQgpv1rrN0DqqU6d1Xy+82aC
-q9ixXXgoq3Tf4yPD2QqLCd26ZORYWxP5wmcdzE1HRgBXbFZ0DdHdUa5180mRRukg
-X3JmU53s89tiEh8RH0ijqd7C88yGaHQFfgWmcbmAsBfyJ+pGyoyag630j/U1d9Pb
-/7LMILYtyeFMY39T5xPIcEBA8zBCWp2kqp5aO+lSSB5ZnjOZpnwYc+EMoGL4+oTT
-gPGHh/8P8OD35sik545t55XUX+KTPaP+T32s/FRyMf25GQg5bHOvczGarr99ZxOJ
-yck94fk2UeEufMeL87Y3EUs5AAURtCVDbGlmZiBXb29sbGV5IDxqd29vbGxleUB2
-aXJnaW5pYS5lZHU+iQEVAwUQO2ScWseL87Y3EUs5AQFQKwgAn0iyFJcsYTov0q8J
-Q1sfPZLYxo6Um4G2Sc2FmctlE+sc3GUc5IwpWQAfD7kQKJih1skL6HE2/yqPU2UJ
-Ah9e8JeVqo34mBBJtUk9f+OTWauEIexCtaGpnRDT0JFOgBpBugzOnE7Z22SlaTAe
-wi3OT9Mwv6UoTs/kt3oO8jZLemypUvgnWLtEpNAwFxgZXPtdC7EKs4eJhyjRdT+h
-CIVKvwKlzRVSHtgPhYpGT0l/BCOF9qNGQ8QJcu1U0YyDXhPzU9Ymqzs4GJYFmNI4
-iQWIJhaegDYdFCIRzYv6/giTdccm4EfvjX/CgONsJHAAE1ldd0iElLX/A2se5oS8
-1VCpI4kBFQMFEDyyDNnXOpC4a7qdXQEBn4IH/1/cvLPV1AB5u4SlKIknGlwkKBN2
-UqLRxkEi9AeMAiAatgnbT7WD4mIbGpn6ITOzYZUA9wmxHvWCMIZGh0y83Z93E31+
-7zr/8W8qEdYR9416LXBEosWoh43vPXpmysFdXSwO8S5BYy+sIC2XRamvVYae1LxF
-XNFY257pBSfbABtVtMdwo7LNNxNO1xpS4HFwoIHAmgH25dlD2AgrTjacNg1I2sPN
-h/KWU8eOFbMdKpDYkhQiKhvObO4uND3JALTsjUqk9XYgxk1fTejS/o+c3BfQ79Bk
-xo0Va2Sg8JA3lk5MaQPf4BRqGeZqqjNbogHhO2VzTwXgH5tY6kP+AR0vqlM=
-=8dFY
------END PGP PUBLIC KEY BLOCK-----
-
-
-pub  1024D/751D7F27 1999-08-19 Graham Leggett <minfrin@apache.org>
-     Key fingerprint = EB13 8C6A F0FC 6910 01B1  6D93 344A 844D 751D 7F27
-uid                            Graham Leggett <minfrin@sharp.fm>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.0.7 (GNU/Linux)
-
-mQGiBDe8doYRBADX8dv5WHSCk8CDrqMFs7eB3MHEIeWanX+7e43s2NTuDhxWUOOg
-vWFYFM0aQrGGvJ3xT/8DrI3V6KdtBK1W/h2PjWNXoD1RsmBQZUzFx3PR+I+dwv+T
-iMWgrIpD9x93AUvvTUYDDVq7NcYMDyL1/Le3Bm1u9MhwucTBD+jhgtKULwCg//5c
-4yS482vmqWdR1nGLcqPGvo0EAK/2NvcgF28KhUPMMAkjl0YrGTmwbTLGJPbSK4nl
-BbGlzn5QpNTf5llSVUwmWVZmoidmBf6ghuu3XNr/uwM16BagVa4wIPHolFlQsDUy
-HMkVgtMrTHYHFdXZSPbQhU5UGzgF6QCgGHtzSISyHtiqXG+50xVPV8ku/bIJdws7
-ntrxA/95BJqZ71mVjBm+GHF4NBsSAkB5zeFcKBZaetLU6YAA3I2P8OMG5abCcr7H
-p/g5pDHMvYW9vA5OvmBW69TAem2K02ifohjXA3RSfdqeZ/VOvySTHKaHM158a8Ad
-BIMWFy8jgrT9rmwntPvofFD9xKh50XiJ1waJBj7rjvr8QyoQ9bQhR3JhaGFtIExl
-Z2dldHQgPG1pbmZyaW5Ac2hhcnAuZm0+iEsEEBECAAsFAje8doYECwMBAgAKCRA0
-SoRNdR1/J8r3AKCdGB5mx8Vm6KAA2Fs/HtNzWTw+mACgzdv86/7AmHCTy5uH6mbj
-ZeK/feaIRgQTEQIABgUCPdw82gAKCRBq1Wz+GTEbAAN5AJ9lGlLwQVv8nyYdKYBy
-AP0M+17DIwCfZTyc/PJQHxCGH2ESqD+T5ElQMX+IRgQTEQIABgUCPaRGlQAKCRCL
-2C5vMLlLXF6YAJ0WgqBLoX4b8bujrYe6PiRWZPm7aACglDrNXoM8TU93F/n3OgYx
-btxDuxSIRgQQEQIABgUCPdxChAAKCRBVkeLAZmTAeCkCAJ454pYX8Lc+cPkqE0Ph
-f8HeTEg18wCeMwbCbcyQ0ZhEnnUtWwuawxgAeNOJAJUDBRA93EdVms08wKmfdd0B
-AbwiA/sFXOdYaAD5FoUrBPhxxMIWMru2h2LZd3A1/jLhcptO2GQGCMafFje9b1YC
-APGsUgAtm128PzvvoOzge1tSUwGEWlQlEacDJo7REb++hOtycjccBUVMxaojlkwz
-Gfff6u9Z68EbRM+UpZMRWV39j6s/Yl0yFwU6emQjPKpWQH5OcYg/AwUQPdxHdt26
-ZLosMS0vEQIkegCfZyX6DAKQXY5eYzuGuZZRl+0Ug/YAn0w5TNjR1Og+eYT6tal5
-XcyBYY+GiQEcBBABAQAGBQI93Q0DAAoJEPcTqHkQ/eB1qRsH/RpjHaZOHbpsNFeQ
-KuPwxObBw6Rd72ut0N+N4ESVJSorytzCH//5rPmurmyMjtQ+b7qzohxDWMU8/ZJx
-RJ6GpI+m55S+lyz6X1t8bDt9P1T5nAbsALOvsFQEv70pVYNtSg4sK5AAqLCJOdh9
-5+FQJJK7sMVLShB9Jo2okVVripGxZOKqTi4lhCdmVmWgAMKhODoXg8IOPjxO/hZq
-oGP3cT5OW9hFYTmyECpMItTLYzcB2d3cTyYMaCg0kebMbuq+gAilho2NKRnZ0rJY
-9I5ObSL0F/q1Ji7gCoTi/FkqWa/dz7kTzJdyov8Th0Fkt22uvlKbInfuFgjnFsoA
-PFj6TpSIRgQTEQIABgUCPd0jKwAKCRCLOmAfCMl15aqFAJ9JlvmUZ+lIPP0OjQO/
-HM45FRalpQCgn6Kq7NSq3bPmc6bpkmBtEbdMOhuInAQQAQIABgUCPd0w0wAKCRAx
-pj2W7BQLgR9oBACIOv5kNRdT2EEHeb66cjooslW8omWRiuLD3a/i0wZBCI0lFoie
-HvH/ppJ1ELGMGCB7aBsahyBbDkxUMpPKOHwd5bu1p3qqUcqXbZw/GFjLyee8VwKD
-iyYMm22O6J9Sduw4ypdS41mGmlPvdkV/Jrp57/3fYyxnu8tX790aohTPgIiZBBMB
-AQAGBQI93TyXAAoJED6Pt/L4g0HZ4r4D5RnD0dfRtzX1iXFofoQ1TA1Hv1uIrdKG
-WqBFR28exzkyY1rUgD1ob6kA2phT91YYuAKq0D0DIdL4plIK3XJqmirN0KkWyQXh
-avEIOSVb24EMP8T1IWzQMVLsfJEJGZA9UrlVvSnjFvi6zDbk/AjpCG/oJOWhrNCC
-yReDWRKGiEYEEBECAAYFAj3cRhYACgkQvrorh/X8S0Iv4gCg4PgxsbODf5rnxHwY
-HzixdRl4hLMAn0f9VJRwdgH7s4eEHyjcFPpjsPe/tCNHcmFoYW0gTGVnZ2V0dCA8
-bWluZnJpbkBhcGFjaGUub3JnPohXBBMRAgAXBQI8su+QBQsHCgMEAxUDAgMWAgEC
-F4AACgkQNEqETXUdfyeoZQCg7MBpKayIclyy0m8J8ftN2hTjGSwAoPcPHDXDSXvp
-xRGpXBl9tlTOJVt/iEYEExECAAYFAj3cPPIACgkQatVs/hkxGwAgRACfTr4PRP6s
-6BtADfk1nSlxH+PjDUsAoL7GXrtCAeg9RUtRhk2K83VuHkrmiEYEExECAAYFAj2k
-RpcACgkQi9gubzC5S1wxsQCeKI3eJH2RLpP60M1uhMjNNOE2wqgAnA9GAOgdm1uR
-wnJyy9oO/k+m8u3riQCVAwUQPdxHXZrNPMCpn3XdAQFpIgQAzv8Sg+KAfH3mfPp3
-qyfUgcP2gQ8fpkEvGKCQl5xIWuWu+x4xK5CDLI/cl9xS3aJxG/0CrjtxdDE/nriQ
-Kpqyy3CXgX2QMca4Ud1SQm/Ij5mJqzpxungBVnvgXPH+HGyO8WVTb+ehEalKOz9b
-dtXNrxzBdjzAYTD5ce41Bwl+XmOIPwMFED3cR4HdumS6LDEtLxEC1EQAn3bSMKFo
-Uy0Qbn1AMQETscj/d+c1AKCloVdOiAlxq5UolYRgq9zX0w8mjYhGBBARAgAGBQI9
-3EoeAAoJEFWR4sBmZMB4+ycAn22HECjtgHXC7u9Ky74S1eqAkm/dAKDCQ0A++NEq
-D2UBVDX49rj8YtcZh4kBHAQQAQEABgUCPd0NIQAKCRD3E6h5EP3gdXIPCACak1UE
-LD9x7+rIZ1EhTRrgZBy4o7yj7xMMUzGd8jSmjjLyz2pcUA7WL4+qMlgtq27ZNb7V
-dSeJpumvlnYDU/vPwJwgAlochQnl5CfYMVlnjrHnmKaZD9N4m+53UgabFm+N7yip
-bL8MBs/m3K/EaRosNwRZyOfjbC688jV9mjj0//fHlBzj9DAjqMDoNpIMOnZNkwPd
-2lsW7UHNWoYq14j0BEWNjtduvgqb7vHavOfUr9CDa/kEeFRkxWkz0uFMAFdP/nw+
-5yMtMwqVaE2bhIBRr4/vqkejKt4ZHIhhPI8Om65ERrdp6Dd/LM2+nmqBz8YHqRuj
-LsjM+YoxkqlMJoriiEYEExECAAYFAj3dIzQACgkQizpgHwjJdeX1hACeIcBnwo0C
-ZpwKg8iHUuh+E/bfqdgAoLPwaGaaRwPMNvluSV+PNdLZ14PsiJwEEAECAAYFAj3d
-MNQACgkQMaY9luwUC4GJ0AP/dFH5CtCF/FZrHNzX2sSQRtO0szMd7GFc5DCbD8yw
-ugDJBiS3a2YU8LcT79JW8kA6UL20EokQVqCmkVdNaUVaFRxGITwcGJ3Kvek6DK0c
-UoWI/1R3B5INg5LAW1yfO74nyiZg6JqdZl3INbxDL73FwlZj79j7gSo5eZcolmuu
-cheImQQTAQEABgUCPd08mgAKCRA+j7fy+INB2e+cA+dwXZgI8S+Z0P5X7eqg1bWo
-lrq1DUTwWLCYq9OctBwrVDQkj0G30hBvUAiv2aXnTbtn/itcEA+eQg0cA9/zY+RA
-a9mVVXdewFqI5GOkoVkivGzGpTdhNWrDvMLkK40XyIgoaT2mhxe4GerdVNA86Oyn
-QNB5QTY5HEetIhK797kCDQQ3vHaGEAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bx
-brlLOCDaAadWoxTpj0BV89AHxstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJP
-PT2N286Z4VeSWc39uK50T8X8dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrU
-GvC/RgBYK+X0iP1YTknbzSC0neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVb
-GI2Ou1WMuF040zT9fBdXQ6MdGGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcp
-esqVDNmWn6vQClCbAkbTCD1mpF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAggAosBU
-cLsuvpn43c3M9txCs8fPDzeQL/0HGpcjNg2EaETggZJf8zlPvYOWMZgT8y64C86m
-PUIILYh2wcZX+SXaETfKcxN3iVvMCjr/BOzUQcIOvUWyR6vpAj49MGvG7PLodbai
-iIWmY6OCeMhQlnpMOiEGjyB0wnH/ImgxC/2Bppap4/Wl/kevVojKgS1V9zCHplI3
-3wmFaqPPYKV7jtlCyKYZY2jTiNjKourukAV/wXR7QgujP4NrqoSGQWXgXBWlEn+S
-Dh80jZoXuz1t6n5Pv7iY8UaFUzdFUQX8PipHWRBmX3W0WTZBbfONKI9qoswDp4zz
-7JV6y5fVnvNKUMnAp4g/AwUYN7x2hjRKhE11HX8nEQJ97QCgtVUJ4AhFQT4j6Da0
-+DR0+1BGPD0AoPiJO6zeeh5I/4g6m5QHXjeL2raZ
-=qXzK
------END PGP PUBLIC KEY BLOCK-----
-
-
-pub  1024D/6D791A41 2001-10-26 Greg Ames <gregames@apache.org>
-     Key fingerprint = FA51 765D 3CE4 EB83 BFE1  BDB7 605E 165A 6D79 1A41
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.0.4 (GNU/Linux)
-Comment: For info see http://www.gnupg.org
-
-mQGiBDvZp3cRBACm75cSDrKQCCGZIv8QL/AvcNMidSpnuZn1Huvxq28bgl1eh3br
-2JHBb8CYh1ijUNk9EQeB/fl6go8NiuWeLLVZkJGnqQRZSVGe+ukpZFLPFGb3mgGS
-lBmO/88gQ3gld5Cfumy7VRmMA3EtLCQlI25h74RcPIw5Gzil7pSj9N4JywCgsLDR
-olk/+Y4kTdHW1PTt0YbBETED+waq/aICopOLAtEC8W/G2uexi/m+FPXWwM80Mkxh
-K+2tjZX9oxzQQ+/GDeFId3q5NbSndscAFMq57ZI9/daenkdGLQqG8gaO0Hto24dG
-YNft/w92i5beYG0CPJoIFspCY46GeYaV0HoKaRkLVfcxXqN9UKvKmH18HhO6GO27
-idRMA/4l24wu/Qbp20PvEKTEAsPWQSfUjtbMECUdpmzC3/ZG6SWO1cICV/b+QlSC
-p5agjTesvno7GJC5IVs09RAkW6NmX4wVLY1LROPIzCriJKoKfgEeJcEqXPZu8q2R
-S3U2UPe0PEzzHjdWZlwps+iSr1qafaxRfZsnUXMU8X5KsV6GFbQfR3JlZyBBbWVz
-IDxncmVnYW1lc0BhcGFjaGUub3JnPohdBBMRAgAdBQI72ad3BQkSzAMABQsHCgME
-AxUDAgMWAgECF4AACgkQYF4WWm15GkGFuwCfaWyKPP8/CtIqgZkIBxUB4QqYwiMA
-niSB7MFpia1iTSSLg7e9dum5wrasuQENBDvZp4UQBACBHtkysTqPXCHqzsr75CSL
-7SbdmLQQamlMxw0crksTfDZyPIr6AVfZcojd+EHO/6bHU270FxuIwfR5n2NejIIx
-oZzjkTJ/TAa2r5qFy1XoUMnodF4qSNPq/JTajIaHXTSgNtPfuw098h3ommZ8XGSh
-OMEovonFFjNNXYCHeY5EBwAECwP+OJdDyBkt9r4Zr/5mbhsQJ78TlKhDpDy094zW
-/pHgULSEsVKbGbRGcDLYnTZ8Hjs7pCuyGy7uaCuWArRrnAzP40LNHEao7svl1VmR
-wZFsisZ10D5kRB8MRVh7ckdOqxq/lSC8AfMBaTmN81Z2ljMWQ7SEvdCGq5OU2wn7
-O59wAOmITAQYEQIADAUCO9mnhQUJEswDAAAKCRBgXhZabXkaQSHkAKCUveQ2Ews0
-yTd8V9Co3kVUq0E02QCfccreS0fXB9D57p8qPvXRWvJGiRs=
-=SVx5
------END PGP PUBLIC KEY BLOCK-----
-
-pub  1024D/E04F9A89 2001-04-03 Roy T. Fielding <fielding@gbiv.com>
-     Key fingerprint = CBA5 A7C2 1EC1 4331 4C41  393E 5B96 8010 E04F 9A89
-uid                            Roy T. Fielding <roy.fielding@day.com>
-uid                            Roy T. Fielding <fielding@apache.org>
-uid                            Roy T. Fielding <fielding@cox.net>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.1 (Darwin)
-
-mQGiBDrKHnYRBADjqUE4qp5WS3rI51oKVZOMLPyYI8lNwf8NwJ6LwfquU/DfiCf3
-K4CWKej721VMgT3zkd+PK/hGl8XpKGZIZIsPyZnvUOfPW9k+bxn3WtUiprwwVvBi
-3YLOpKcubthMg9+Eh2IweR6iY/Jeoj8hk9+B1Yd7vq/Y1Dd6Hrn+NsqCDwCglzPc
-5hfMjdVqU5l6O32udxhSRR0D/AgTSYi3PXJvJHzesRPQ7BMkwwxpl0C/D0WxRvIR
-LlI6zAEgk5Du/JrmHqC5GCE7TF9gqM9BNCbJTnMupIMxM8hi+JwyhUqrpTEgri8f
-OcNf/6KoaU+SeHMhxTR8Ji+n7Nb5ohYn+qRUnyLZ4i27AQU3IXOgmRgBhrlOdQyD
-8zOsA/9/5YCQKeOUZscFSxk5V+lHAaRTUpUuxQ7CglWw/6sFZ8OqSWkYKB/+5C2f
-uBAXsZpBsN9fjlIxwJJJJLT0nowlRrANg/h+QComqo6ddRbJWImrUah9wo+arBZG
-nmFAFRD9FUjRJfllnQ627YivQvBda2/RSRUEyr+nPkUfxE4q3bQmUm95IFQuIEZp
-ZWxkaW5nIDxyb3kuZmllbGRpbmdAZGF5LmNvbT6IXwQTEQIAHwUCQY74bgIbAwcL
-CQgHAwIBAxUCAwMWAgECHgECF4AACgkQW5aAEOBPmokqrgCcC0KoXTZwGMuUEv9b
-c2ddPD2Ggd8Anj0JI6lG+iLuXusECs0Ipr1XQLxLiEYEExECAAYFAkGiWWkACgkQ
-BJfVkRK/55pyngCePS7ilC3pXrOMzwUCI/DQeCMoga4An3cgD0t6j2/T8nuB5h67
-Ze/LyaC1iEYEExECAAYFAkGaiCkACgkQMJF5cimLx9CgmwCgk3QCimNqLIcic0CR
-+wNgBgp+gFgAnRixBUNQ9GLqJJWKbeMZ7b4i6TwfiEYEExECAAYFAkGalNAACgkQ
-yX6cq3d1tHkmjwCgrSID1cu/xLIAA2ehOm8NMYWkG5oAoJzSZh1lT/kRwzHLwd+/
-IO316iobiEYEEhECAAYFAkGjAgMACgkQB2FzsZKExFKnPwCdEQRk8+Z8n8IFnhQn
-1T6jXM7GLLoAoIP0sSWpQIs4z7zhRPjCqcAoKFnjiEYEExECAAYFAkGalnIACgkQ
-XP03+sx4yJOmCQCfTixepfWLoiTqs1GTz6u737iP80MAoM0TnDk54Q8CbWYJ/9zY
-6PCBwr6tiEYEExECAAYFAkGajQ4ACgkQF2rZyNGqiWJE7ACdHH2D5KlwbLgUFKzp
-zng9JRU6hKsAnitj4Shya0KoWQPiNkFHgB0CX8ZHiEYEExECAAYFAkGbzpMACgkQ
-XUFK4eAFyct6RQCfWQcbqL74JP946GValnxfJhhsQmEAnjm4jWAWWL3KtfXeOCgV
-MbBhL/a/iJwEEwECAAYFAkGZgZgACgkQMaY9luwUC4FfOQP+K20bh55JEs49DkMM
-gScH6P9DsCvZee+MNhjzLijzyWrdnMCRMEb4ye+cdPQxD+M+Wl0iaO61AMMqUCno
-D6DDo20hhzU8kn5LneOJ93pcz1hjkpzof02FG+2sf6B5x/BdQshgL1ySiXrPb74q
-s7gKuybtDtkobLRnKPuSESE/Lk+IRQQTEQIABgUCQZqKSwAKCRD8D4WJ+JS+Enqi
-AJ0XZi3M3rfMuqe7tIagqiIeIlrm/wCXcrzjI78YE4XEeThe9a2kIIdIOohGBBMR
-AgAGBQJBsRgPAAoJEN6ihzgyivIERxcAoIuSWSOTjocSQyedzgDeTDEs9r4AAKCo
-F4H183O7HWf0pomjCRQh/4f3RYhGBBMRAgAGBQJBq3mCAAoJEM4BpH4cQ9hQk9UA
-oJmXaSH3C0f9RfNUWtbM8TPBLoB+AJ4qqFgkYYfkDg9Cij28yyMa82tQE4hGBBIR
-AgAGBQJBujwZAAoJEAEFZrzkE2OSx9UAni1LSdTKkDgpDcGEiAlZ1WpKQmAaAJ9W
-Um5hl+2qSn/AVaMvGsp0XtgYVYhGBBARAgAGBQJBsBhLAAoJELK+vEAVKSSvVOsA
-nAgKhSKJKOI3uBTfP1/blI/04BwzAJwPuS+s8QgwTUkxQWicyrq9pg2XjYhGBBIR
-AgAGBQJB4viIAAoJEEzETQAR34fpsTMAn3DvE1Esp8Wc5JH8uaVjndouHtSeAJ9N
-c+wBHb+a5/RIZAJy1Jt2Nfl0tYhGBBMRAgAGBQJBzkgcAAoJEME58VMjy3oqokQA
-n0doBXF9FSeMRZV7u/ERU0n3qrVWAJ9ddFnxQU6Kra2eQpuBx57oPqoHAYhGBBMR
-AgAGBQJCLiKFAAoJEALjkFHlgLNjWywAn08xy+7kZwLdHaFi16sdKm5oxsKuAKCm
-r+MA/c7dvOb7f4Fh2vu/l1ITdIhGBBARAgAGBQJC3OR1AAoJEOyrDnuD5q4NFxIA
-ni0tkRV7SDBFmZ7BhbqSsdpmLxo4AKCu3nRFWT+6MAY4v4JeTm8MrV7moIhGBBAR
-AgAGBQJC4NkeAAoJEIzjdrgc1IYfkMQAn0t4Kh6txi12LJSkr4mc0P+AhQ75AJ9k
-OjklBQCS7C1hlluI+oGhlLwKTYhGBBMRAgAGBQJC3rBQAAoJEP1viMYh0KcbHu0A
-njNACpi5qo516Ohk4EiYmKFsNO+OAKDsu7NVsPst/s25q4qGT1H2p49kGYhGBBMR
-AgAGBQJC3rqPAAoJEDLJ5M42QstLJsAAoLbRG9j6wci/e/oLkYTbJpaRWlVjAKCl
-cvH1xY7KUnFRU063pqmJufzpsohGBBMRAgAGBQJC32zmAAoJEFCOrsUwLaVoI3IA
-oL13PvN9g6/ApleNvcrGWJXlWqn3AJ0RbsVM6fCpYgsdsjE8kyjU/S2JsIhGBBMR
-AgAGBQJC32zpAAoJEN26ZLosMS0vRMwAoIV8hheV4kG8fp2jVYr47RzWFvxbAKCv
-8O9RmTGmEd1BJ4NPJZfcU195WIicBBMBAgAGBQJC3seiAAoJEDfj9F/uZeMhyKYE
-AMoJv8QYRTXgpoUnT/IG34i4/sxCvL6yUmaMJPUN4zE/VvVpSb4gMHwVCKg5+fcg
-7OdyA2OG405nmkvCCZSZFdWslifh+smzbYLSTKWMaEIupFFntKH9ynOLXjewoSux
-lY4EreMrxqRhTdXXaIpzLw86hcz3rLptfvhyezFtIOPGiJwEEwECAAYFAkLfbOMA
-CgkQms08wKmfdd3jiAP/RHxhO/f4LLOaSPnVENjNK7st8D0MXHDXbDQYerEmJwuz
-7DT+uup9Sn/3NRA27vtDXJ9UgwVUYuuO2MJ4Ij6U+RbTcGwh9WElnACOaXKhv4Xs
-pdt8/7TA5BNcHL72RYzY58oj4hHN5WfyIO6kKa1TE+Ta+T/QHZOV1Hk5jQfIXTKI
-RgQTEQIABgUCQuDsuAAKCRDJtabs4td03wPaAJ95/ud8yHueG8HminBF4JB8BdYb
-lgCeNp3z89IspuW5AXQ85pIMeJF3U2y0JVJveSBULiBGaWVsZGluZyA8ZmllbGRp
-bmdAYXBhY2hlLm9yZz6IVwQTEQIAFwULBwoDBAMVAwIDFgIBAheABQJBjvlFAAoJ
-EFuWgBDgT5qJ0sAAnRsrrqrOFCISuF4mRulEeGXclRjWAJ9IxE/dEuR54aRjmELH
-2TxUFg/T3YkAlQMFEDrKbLcbCAxFJxmvNQEBvdAD/0pvyvL/ZC0GFpqdtApJX9eL
-yaR6bDkfNh/OrnFYu0s7Efb2j6KMFef9fx90gJ3gRSJj6ngX5eY4uejUGLoVx7aQ
-qJZePZedwy77uxEyI+SBlVJU8ArsL8ZjR2M/4TqSbw6+fJ/Y2KZECmoVpz7tTgFv
-eWNZxXKDbNkAVLwRQT+OiQEcBBABAQAGBQI6ynZpAAoJEPcTqHkQ/eB1+gIH/055
-hND4xOZqJo/+5AgkLx5f+M164bX7/WZVaSIDZbYF3AwCejYvdxh6e9wJ8ZP3ZyID
-jNtAEwZDCtDWNPUod5cgO2bVtQmxbIRXi7B1Wo/IaJVSbdmbWfE4exXiOumMS4n6
-oDYGOxVqUD4NkPbc2RxL9dKpF22o8+VUMwFOrClsb9X0KOa6FpHetCCyQnxsySbk
-wsT3ATCa1lpkaoWOCaAIAi5lH1eaxWvf4PbChH/E5NknS7y2a+duAZtZSKKzj6MI
-MpdiAk8tAF8wlvdZ8aN7BGFmX90evFcw+U/oHODlFog6yGNZIUx70TPVR1zdhgxw
-aCUmp4RS7vZA0tI8aBSIPwMFEEBfU1zMsutG52z20BECzRgAniaAcrtVanVO2Qrl
-0s59C1Fx+um1AJ9aB64YaNz6AYZgKfF+hsIldgp6Z4kCHAQQAQIABgUCPdlGwAAK
-CRAkDmb8xZwycPc5EACzRyV4vUKrRtXKx5mdnQ0IHx8d3x/qcIBQ1Y/2QM3LU4DR
-zeYV7fV8TIv3iBfxd1625BOx2LAbQ8ElDl7PLD4E/29dB7MwhtYJjqurR5yOh+6n
-nWcvJoz8owR6hS2DJ/i03+A9dzn9YpQRvmMOnACVrpL7IZZ2V+Kqk4TN3G4LGSfd
-LM/vpYsb2Ghqr5MQ3/F89LxuJZn74m1dCvCwBAoJf2RQlNesIb/irMsfU7Y5Fs0h
-5HHONNdiwTGIO7VEHyWvJlQ4rMSOp/rAw8k5uAdgHK6SMn10ogEj+qKUOcnHSeqg
-hXnFBorhHdb3Qmqc2s30b/YtItk5EIyXsARV6mdr55wtn0hp3wX8d3ct0zcMsYsl
-IlNuAXqQUCH2NO7Yjz2LF3K0A3cBz+PcXGjkXD/bUPsZG1DhbDwoxh8YeKGXZ0k4
-MKeb775EF5jgMT+cArHqi/OLqs1OcJNjYy35+plQSMSM0BPCdk7P+bcf4YOGRDei
-AukLnA+Dkl1CAzBDhFS9y231tLfob7w9CMoAXXF+E8mAG0QuLpVMta/JgMiOx3O7
-xs5t5JWOMIdv3FA8tSNdiviA3DIr1nhphoLu0mzGlD4W1dyczh5MBx8kCYgS+nS3
-ASd8NR9OSYuelOsRn0ykyThbVaewnY8VrwUsmp5JOCXAPWj2SOT7KQNmRa+GPYkC
-HAQQAQIABgUCPqRYcgAKCRDNY9HdhPkmT/o2D/42zg5Qwy77OvS37qEO371dsJsV
-IUSSi1lb9s8+GlwzyufGdlFkhgQ67q4vI0esl32DrdXwA4aVfuwp+HXj1nTuW0l+
-otOnvtt2UWtZgHHlVl6LLfGxMM+Ez1AaXym934adTRwoJ77jqeNO/G1t/Fvh8Cws
-8bM5nIOvcFYVFEF+67DFsNgiEjKztICy/0nNSWOE07vWWOXXsQacLemPRsG/zRVd
-45BNib5rBCLQFLqA5D6FXO4PLXCNb1ltsJENs/mN+MseihtQ82h2ENALOEiDCuOi
-f3D8bX8ZY+BwLbQn9iROzalaj7OJIJitAGfOFrdvD2Y6cZ8puakTYOzmBALPmSzS
-kViEMrjnUQoTxSK9fu9DCQ/UfUpDLuec9rCPrsJl2cQxW+rZ9UncxaEq6soa9ccZ
-niO2y+0R5b4hIOIxO9quZnYwHwdE9bIeEfjAzAN3vCwQh2VEkaL45qpGJdenwcc0
-yiayliiYVvt0PA63F1Hg7fpirLceJNtWW3u8Thiz5RcsDx0PxTREiixjhTPtCc1X
-Trv3QPR9QgGBp5W4Zd3xYDLrAS8+2ddlLIobWK7YEsr8s7aNce26FXwJRnnPeZL5
-LUkCXXiIJ+LZAvyWnVEOS1qNtE95HSTVZkhkUYxDf8BHchuRIFvlIVajKz1CuP9x
-mvu7WjsV9D4weEcJZohGBBARAgAGBQI9e3QXAAoJEAkiEpbxiQSLJXwAoJ0zFfYi
-1mAUhrWxvZW+doXeuDvxAJsHdbykofeTkQtvD9CyjO0XdF2wqYhGBBARAgAGBQI+
-pFcNAAoJEDGGzQRPCfBVWkMAnioUdcTH1PuioPpVojukOAeUH+AvAJ9EXXfWIgsa
-tgzCTDaPFs1lzFqe+ohGBBARAgAGBQI/whdoAAoJEInYTK9GsmLGTyAAoIVutvAn
-c0nj27Rqp+EYbx6YsbsaAJ4p7w/+fZjEa0wsf5Hy1r82UxHWg4hGBBARAgAGBQJA
-I7WkAAoJENtdJwgR1Yk9XmQAn0rLEaoX4IpXbDbVM1Yxf71vvgVZAJ9XMdPdVtk1
-LpDO4qv83rzLwWwo/YiZBBIBAgAGBQI/ym+aAAoJED6Pt/L4g0HZQp4D50gsuxjD
-1o0ZlS8sNxNhZHgaxohzBTgavEIY2ltnNUxshRdMtoBMx9tVvmZQFI4Dil57m4WB
-9fE0eMI5yQSUcVZd/Wj56uyrb4xwcZfWxU3k9uChf/eyqpEtH/V50DLdK1WUgGVU
-ndcWSNAPxKgCd3RbUxAEZx7B9zNf0I5GiEYEEhECAAYFAj3iURUACgkQiNfNvfQ8
-L5IdLQCghH3YKiAJRmA5vSVPqcDrGY2/jmgAnjBuzJlZtfpu7Q8twmFpXf2Fcbv2
-iJwEEwECAAYFAj/CgYoACgkQN+P0X+5l4yHW2AP+NpYD54gNj9Ll96pKXeEH7+Dl
-XNmeZwQSyY5F9V4luQaO2Qt15O+YK9eHOMnb32U2bwOo/LrDuraC0L63EOFalkNU
-TkRHXLrt5uZc6+Jz9KhoxNcv5rtoIKsi0p9a06d6yx3ppkfZHwqIxdAC8YRAvyhe
-WeZIZi3phb1let7y3F6IRgQTEQIABgUCPaRG0QAKCRCL2C5vMLlLXJtyAJ9N/nWN
-2dCv+92Z697B/SSJyvoLvQCfaI7sopLLYw+aVPdj4vykTZIdwJKIRgQTEQIABgUC
-PdiF5gAKCRBmNbbA3ohd0+P7AJ97IR6ryjBehFyut0EboKhdVN4mtgCgrwnqzg/M
-f/+142L7aT3TeKYKfKCIRgQTEQIABgUCP7ppgwAKCRDLMqEHiMOlpTTXAJ9GxCno
-937c9EpYtek6c+RkrheWNwCeKWKyFYAjFklOk7J23KII18XNq16IRgQTEQIABgUC
-P7qSXgAKCRBc/Tf6zHjIk9T+AJwIbe3CG+SZEyz6IliuRTAs3R3V1ACgspn53noF
-uYBKawQvI5718Di+BpWIRgQTEQIABgUCP8HFwQAKCRA2FSLXgqt70U9LAKCoGLVF
-3oBqemNHB/VMvL08pmRT4wCeKr1wCr+vM3wjDriHf5Xx6FEoJKuIRgQTEQIABgUC
-P8IaZAAKCRCJ2EyvRrJixkInAKCF5uuqPNCP1F+m7z9fR/nIJb3qeACfRcJhJmXY
-lNNLonnExeQT0hjOYYaIRgQTEQIABgUCQBXUSgAKCRAVP6DNdaZ2kndiAJ9eTafo
-NOGtPDsjQQB/LEpX8Nqg+ACeKEqMt8CgNKCBqQE2DuxjUOY/cjyIRgQTEQIABgUC
-QWVtyQAKCRA7KW1RzBhaO3XNAKCyI2RhtJ1IFIjJd8STppArFxLjSACgkL809tt4
-gdjw0ocpzW/9OzY+QQqIRgQTEQIABgUCQWVudgAKCRA2Or8wn8PVfj9EAJ4ltkHf
-zOrj1LD83ArlaUPP6Sy9eQCgqIY4Nsnrfb8h3J1tgQUPDxiQH6+IRgQTEQIABgUC
-QXA6EAAKCRAPkZbeblLCnjRnAKDlCfbsdTR+la6YbpNf0Aq0+DH3xQCfVuKzP9Ws
-0sSX3UklvGJAYMmYbN2ISQQwEQIACQUCPg03yQIdAAAKCRCL2C5vMLlLXPO9AJoC
-/yIz2xDEryTy37M27KTIAheuwACdEskgLXTBtz28QrFmPFx2OVg/lT+IRgQTEQIA
-BgUCQZomGgAKCRCLOmAfCMl15W/YAKCtdn5CG/LaBJ7DjRV8N5XjK8JxggCgnq7S
-lDL+JQGB6LRBL5TdcXas/teIRgQTEQIABgUCQaJZaQAKCRAEl9WREr/nmpBNAKCl
-/IZ+aETlq3NzYHkF0KSdmIrvKgCfSjDLzQWgoUDTLX0gxfXh1+0X3PaIRgQTEQIA
-BgUCQZqIKQAKCRAwkXlyKYvH0LwOAKC2lY8Ulzv7vv91eORNdJr4GRNAkgCfZJgR
-MWXhcilBCSKpKbQhNWbNBdWIRgQQEQIABgUCQZlVcQAKCRDJfFCWXBw61y6gAKD2
-jC8aqDOejUjA3krguJUQcdTvawCfT20bNihqtriktT6pjZcSLRJAW+OJARwEEwEC
-AAYFAj+/wGsACgkQBurPqnbYPMYnvQf+Mgvva9ljDjZXI+kLdEnPA86EHnANzh1P
-4VnC0a0Eq4o218U6C+9oUekhwz4wD2jAZUdoC4qwDtrFtHh76hDycfxciw7QgTbi
-LNKBD82a0P+ZuMFL6omfBzoeBlvswvvg/G+1LBSSPJTHV9nOpgoSDFZcKfrcX819
-KrKxeKGJXUIbYsOhX+PVNSGzPkNGjk+8jxWM6SiueIpQUJTQqa+9eKcR8/YuLmyG
-RhJMQrmJO8/wRFqblkOwASta18bdgYNHDpQuvRWgLhqHLM1P99AKaP+qGmyXP2qq
-DMh5Zy9TjRo06O0CiGPcioQ5PDDxrqnhqxEYQuwrvXJDFSvuj7BCqYhGBBMRAgAG
-BQJBmpTQAAoJEMl+nKt3dbR5MbgAn0YbFWKhffr32B6yuApTBZdXEkHRAJ4qqFjW
-qgYqBJx8XS5AdAY9dY65n4hGBBIRAgAGBQJBowIDAAoJEAdhc7GShMRSdakAn1TS
-35CiLVymIbX8h9mP0a/6nog8AJ0eibyHC9WX/n0FRiGrjvlvL0eHP4hGBBIRAgAG
-BQJAMBtjAAoJEC6L0IDMac7t4y4AoJhqI3bieTdIsLXoAkHPNQRljxaUAKCEgjL7
-xBbbcAXM8x4RiRmWZY2uy4hGBBMRAgAGBQJBmo0OAAoJEBdq2cjRqolikOwAoJbo
-SnWnLET+R/tlHslqWcek7VMIAJ4rrxd46qybfMYQHrrV6OtCS1v4w4hGBBMRAgAG
-BQJBm86KAAoJEF1BSuHgBcnLJdAAnjCisIbl9GuHD9qyQC5L9w1575xLAJ44OKIf
-WenBu2WzkBW32n5EnJ6pgohXBBMRAgAXBQI6yh52BQsHCgMEAxUDAgMWAgECF4AA
-CgkQW5aAEOBPmomWqACeNI36SXKcu0TyZGCk2E9qSU6Op1kAni0/pV25oQZXiEzk
-pFjt0Zvk6AXiiJwEEwECAAYFAkGZgZgACgkQMaY9luwUC4GhxgP/czUSd2of63/G
-3ldibnJrhUDxV3tHkkGkmi0CfwNf2LxE2VNwmw+ZZpptz0G2j87f/jBv+EBaPSRV
-yIbXe0kBwRwQ+kiTiIWyATPNN7yppPWSkyyQA9UrnzMzGa4fKMVYN8iNi0xG1fRP
-2WdVgGsz+rcOmpNo8hW6jo/ryNSXTD6IRgQTEQIABgUCP73P3wAKCRC+uiuH9fxL
-Qh6hAJkB/2nKwGgFeFEtt1cLtGBb1bsEAgCcCtguj2Eeqt0zMkT/ZBFXrwZryx2I
-RgQTEQIABgUCQZqKSwAKCRD8D4WJ+JS+EmvcAJ9N3mAC14G6QJaPYb70PnxkHjoc
-dgCfWC3ka9sEtarAymMa7MVdUocN0gyIRgQTEQIABgUCQaF9VAAKCRDLuVBj4NR3
-ba8IAJ9ixzfPZAwD5mSqmXtlW6tmYWEpGACglCCsKNik7J+wNiD1kxsRsgqQmaWI
-RgQTEQIABgUCQaVY/QAKCRCXZ4pyLS2qUrsmAKCwtWTP7YGz/T0P2IsUNByypl6Q
-2gCg+heYYJOVlGCLVfd/hXOncYKduNKIRgQTEQIABgUCQbEYDwAKCRDeooc4Mory
-BKMZAJ9q2Qrztrh7kZm1g2YhZVSHnVRALwCg3e4qeKmDQDPC6A+MEjyRzP7Sp0eI
-RgQTEQIABgUCQat5ggAKCRDOAaR+HEPYUGjcAJ9l7+VtHy+N1GPZXlcycSecdVCD
-YwCfUUytcVT9mzlkKW5SYDFh4rG23bOIRgQSEQIABgUCQbo8GQAKCRABBWa85BNj
-kuruAJwO+zspSq1zjUsQR2raH4pZ756xSQCeKX/+pYQYxPjDmxcWHcNbUb36PHyI
-RgQQEQIABgUCP7+tlQAKCRCyvrxAFSkkr9upAJ9NykpPMb6dRQ9FqwvweU/JXWDl
-GACg5zIfIAa9xAbqnCGziPwyKHF80PiIRgQQEQIABgUCP7+txAAKCRDBHntHlk8x
-2YmVAJwPRpDo/Nd3G3x/H+PjEOpq1QTFbgCfZ3O8gup1FVTtBlVEm+A1bQ1UqQqI
-RgQSEQIABgUCQeL4iwAKCRBMxE0AEd+H6YdpAJ0fVSCcrYcHXNGL65AsRr+6q197
-/gCfcKJFL6ZjOQ9jTju4XZ8HBoOQdDuIRgQTEQIABgUCQc5IFwAKCRDBOfFTI8t6
-Kuk0AJ0W/8WdV3g5G04/q6KODnQeuRBjiQCdHIGVdz3D096jg4ecVFkbiyVbS02I
-RgQTEQIABgUCQi4igwAKCRAC45BR5YCzY+t+AKDq8sy+taTxZ/Xlixt2U1A9jJF0
-lgCgnKQ4szOAerQOkkUH9KtVH0IBWDuIRgQQEQIABgUCQtzkdQAKCRDsqw57g+au
-DRMTAKDMYhafsynKXcWd/TMpNLLFTYSoywCgva6DByBZUrSmHQ0RQsrREUXhrAeI
-RgQQEQIABgUCQuDZHgAKCRCM43a4HNSGH6IVAKCqzk+V4RY4iKcXd+q4gDEU77F7
-7QCgpsK7JxEBCcZLAwSu78+v1Sd1LnGIRgQTEQIABgUCQt6wTwAKCRD9b4jGIdCn
-G9d2AKCOg8hb2mcwgTrwmdw3r/AlCD4kDgCcC/tJ/L3m8qxXeWPnqSOfYV2wuR6I
-RgQTEQIABgUCQt66jwAKCRAyyeTONkLLS3tNAKC3fajKlLewGgI19nqLS2gCpUZ1
-KwCfQBZ6gQ2fBSyH0GM6FUwQMpC1+wCIRgQTEQIABgUCQt9s5gAKCRBQjq7FMC2l
-aF77AKCugNqDPjHcOQMT+SXb0mOgUIVinACgg3m8nB/umwcl0rCjj4dTJldECuSI
-RgQTEQIABgUCQt9s6QAKCRDdumS6LDEtL16AAJwOEHZyEsnlLhZ8EPaDR2l+DrTD
-WQCeOUP6WWydX0oScKgxvrxQelD7mXaInAQTAQIABgUCQt9s4wAKCRCazTzAqZ91
-3YNEBACGZdqQctLIW89il1EOTdaETEFiBOZIgrTuMtbaLKCWjVLEZhRXwP7YOmG1
-VQ0/oareK36O0J+0dXQ/datCWbq7nKg8ah6v7OgsoSaL4SDbkXJRomJouE5+Le9p
-weASnNSnzXDI3iT4/VLNziNS+Px7MvprZfWqW7EtrWcZFNH8u4kBIgQQAQIADAUC
-QtEVQAUDABJ1AAAKCRCXELibyletfP5lB/9hCdsNGnB1hEFuC2MKOAxXyii4WUSh
-SZnAGU1KFmgPR1VT7ansRcfr1M7kAWadgbvZMKpiMfw/YUoDk70S+HV33klqYaBo
-G/ys8tlpB06wXLBgOG/ZXsgXVcfV+gKhBUHJ22yFyUGpwUE6841Z30P6QPEnGlnl
-OaYkj2Bzsu8oJ+v1zPjQMQzbWXflg/9qVm6GSmvkHi71uExVd9mmyXriK7AzgEkg
-fRjIsHgaHRANQgEHXpQIYb74jigpaZ58/iPsBuaJvtkU3D7K/pJh8ykVl4iogY2Q
-v1L4iFpwzJ8moXFZNl6/8WQKyclu4hvetUjqVhdv+TDnloY9IfBYzYSviQEiBBAB
-AgAMBQJC0br5BQMAEnUAAAoJEJcQuJvKV618RZsH/04shIbSOSb/oGQBKp5o/jZf
-+y22LiOcvYuTFNmW7sC881yyWOAOXzvNSiqpLVBv+nPbNX2Zhu4JFKAcx+iD0E27
-8LuQwHt+mzYHg9jIacDF3gMPVMNUcWkdDcjilU8F01VuLe+EbtzPAv3wzH71njl3
-vp8hRhtJQ2Ljxd8rwtVmY+wj82+itO62bBI0R4jbPREA9FQUzqqlU9e37F5xyHeE
-GGFQGUaNNnU29bvZNhooF3Bp5n7nRbub9NH4NgoDSf4LIUhcJv5iExG2FgnnY1Ge
-1zEs2hjLlF2XEDaRZzuABDZkL4Cb8GB62YQIp+1sr0j1V+0phAKhuU//CfBZKp2I
-RgQTEQIABgUCQuDsuAAKCRDJtabs4td032/bAKC4/52AK7s02dRiB9TEyU1BTtIy
-jACgj0K7oUN3EdbRpvq4JztHnOGYNKyIRgQTEQIABgUCQuDtLQAKCRA39o/1AVr8
-ihrzAKDtlkrBk5yLVlFmB8cR9kXRdjw4CACeKxN8s4YBIhSi+dogdt4aBUz8j2q0
-IlJveSBULiBGaWVsZGluZyA8ZmllbGRpbmdAY294Lm5ldD6IXwQTEQIAHwUCQY74
-FwIbAwcLCQgHAwIBAxUCAwMWAgECHgECF4AACgkQW5aAEOBPmonYRwCglIthafvY
-gHvdYcvlQ42kkh16xq8An2KEveQwXY/rxzIfVdQOnXaPEMbLiEYEExECAAYFAkGa
-JhoACgkQizpgHwjJdeXLRACglVV7g4bLAU4cGCtVk4tAmZXpJo0AoJB13hnyxZ8L
-YaDz34DLslck+NjuiEYEExECAAYFAkGiWWkACgkQBJfVkRK/55rWlgCgop+hFNtg
-2mgo4QwbNpekeoF9+W8An1NNDP5O4HefD+V29AI1bPBkFo/AiEYEExECAAYFAkGa
-iCkACgkQMJF5cimLx9AyBACeLg3ys33NRvTcf5syppUh+9QDM6kAn18oB7U//NvK
-C0UzaU41suy0Gp7oiEYEEBECAAYFAkGZVXEACgkQyXxQllwcOtfSwQCcDlcuiPiR
-wtT7AQhYbMqqQt7cP9IAoKvtg9RBPm2C9ONLi1ZE5mPU2Wr6iQEcBBMBAgAGBQJB
-mUkOAAoJEAbqz6p22DzGAIkH/RANUKVj/mKV5ymNYV+2TLQdgRLLwf2Ilhh4x42+
-S9ugvOt9r010E7othLiRK266VfwhL4Mf1xT9tJolQtnP2VlGc+38URqYzr5aiwEO
-i5DKVPwZLf45Ih/+QYYaqetVCqR9QgxA00bNcVX520l2dp5nPmidMlb7SiQfLcsK
-/wUf9HV904GYzLPdNLMAo4AlPcC0ercNNAmJ7u5eR04RvZH3vonsvbLYAdv6HMew
-Gu87apHbMysxYNEFmpOTLqlo5L13DUrrcqUxA5kcu5h6j8GLRd1ClrB9JiJy+i/+
-UMGHIpPML/F8Crn/q4uN0hO4ZctuXKbMcRRqbQuPbYdiupWIRgQTEQIABgUCQZqU
-0AAKCRDJfpyrd3W0eQJEAJ4nI4H5yMJfhWdyRRY3Mk52n78ItgCfRNwz3MAo300v
-Y+akLcBAfwZVAdGIRgQSEQIABgUCQaMCAwAKCRAHYXOxkoTEUsX5AKCJwjAIDWv7
-x9NihTSYNb3ADNoPAQCeKHIXbSwKUmElwqVOJjybOSkc2GyIRgQTEQIABgUCQZqW
-cgAKCRBc/Tf6zHjIk8EJAJ4y9C4RTKgDIEfQEOLy8o8t1YL8WgCfRRLfkgc80b5C
-6bQwqgsPqVv0Q9eIRgQTEQIABgUCQZqNDwAKCRAXatnI0aqJYgsEAJ96xxxx1KYZ
-wWqu2ipWRgWGfFBnXwCeLHiXZwaFmQxyPjF0Y6/tMghg2kKIRgQTEQIABgUCQZvO
-kwAKCRBdQUrh4AXJy2jEAKCRhGu5f92Ih9S5+dwJ8LXiVc2IXACeP4/RMeJOqVP4
-2X8tru8WO/zYVdmInAQTAQIABgUCQZmBmAAKCRAxpj2W7BQLgcpiA/wMi9uNybWt
-sUkqMP51apjy7TAzY1DeR79xYyGy6E9+SWUJrUdpNQEvnCe65nMTFMZZkcuAkgGf
-aUpdxXsElt9N/cJmPyrstjRPsCINx3smRXLZfSAJdBxqfYjjxBO9VP4fc0CVsDXK
-oT9IYhO/0SmnP9g7P8SbEDIrtngZW7x/MohGBBMRAgAGBQJBmopLAAoJEPwPhYn4
-lL4S+IUAn3+70bfqGU/TxmjBV6y+UHaDr/htAJ9kS3gum+7tNmdJAqe1Ciavd6tj
-y4hGBBMRAgAGBQJBpVj4AAoJEJdninItLapSQyYAnRpjXaBU/YFfE/wzp6vo1A70
-zc4RAJ9KTuhI7QrSpjw1JCHeTxlR7lWxrYhGBBIRAgAGBQJBqolAAAoJEL66K4f1
-/EtC8QoAn3BJOW5EsHdCiTn471tOOK14QAsjAKDvJapbKzFtqjqGnYw2PWFEgBM/
-cYhGBBMRAgAGBQJBsRgPAAoJEN6ihzgyivIElLsAoJBsB4geBs+0jWI68y7B++HO
-4191AKD/MBrOIS3Is3BQieJvW4VsmPnaGohGBBMRAgAGBQJBq3mCAAoJEM4BpH4c
-Q9hQLtAAn3QUB+AdMyrhrH9Q0oxH4SXMN0VFAKCJHawjZ8I/DEOBjFPk6/VvCCjY
-OIhGBBIRAgAGBQJBujwZAAoJEAEFZrzkE2OS0AUAniHEQ3sRR6jR/7pXvLA9+sEb
-sEEfAJ4mckbMJYjC25GEYY/mshzavDq4NYhGBBARAgAGBQJBsBhUAAoJELK+vEAV
-KSSvDRQAn0Il+opfKW9MXiBtmmkGw1AooD+YAJ9JA6Y1a10IpgDiaf8PT8eNeJkr
-vYhGBBIRAgAGBQJB4viLAAoJEEzETQAR34fpN/gAniYfvgliN9PVsZHLE6lrxhMR
-IFQuAJ0QGzJtLUn2Wc4BiXb3kIFqGBQ374hGBBMRAgAGBQJBzkgcAAoJEME58VMj
-y3oqex0AnjOW+na6KMKM1oi/K9HSXCwyeTHfAJ4hSZuvs97N+Y5m7iPkr5fbXWyv
-2ohGBBARAgAGBQJC3OR1AAoJEOyrDnuD5q4N8wkAn2aRsbRUXZE4YxcWU1ShUJ6J
-/8pWAJ9oQvyzkiqk93vNJMw1hXOC3oX1b4hGBBARAgAGBQJC4NkeAAoJEIzjdrgc
-1IYfzPcAmwdnttRdoFx7LLzvKsx8gEdKKoeJAKCNiWCu71cp5Q5MGONEAmHiw91+
-FYhGBBMRAgAGBQJC3rBQAAoJEP1viMYh0KcbvPwAn082hYWUPqOUZVSVZDcWbvzj
-szKWAKCqVYxFZlWxP3ocJS1FTg8nwkAVs4hGBBMRAgAGBQJC3rqPAAoJEDLJ5M42
-QstLgrIAoIHjFAfBlsvQZCiBzEetlYL5iBOHAJ9iQfuFs/AIsuRAka4YjVgCb7ox
-DohGBBMRAgAGBQJC32zmAAoJEFCOrsUwLaVoATsAn3L1nGKnz1jIiUfZZDSQfGRJ
-sjL2AJsH7D/rc/ovbhHGoDFdHfP9WllqA4hGBBMRAgAGBQJC32zpAAoJEN26ZLos
-MS0v6cIAoP5oa2V+9TXOB+qXe4eTAiMUk3+gAKDgXYJs8iV6udwIYaq2d5KUY18Q
-bYicBBMBAgAGBQJC3seiAAoJEDfj9F/uZeMhmxcEAJCbwGZVbVmw8D7+nbiYAWdL
-4QUTm2y25Mest45jxpHj4XvNv80oLhh8UrQGMZFy4ydmi3lfQVerHl7QZ7In2hGh
-9ZDF6jAMDfR7pC54J55USf3s+PiMadqzTiIThdLD/yTeRVUn6KUv3RlCGqpfLh9X
-k/paB1V26Wpny6/A3MxbiJwEEwECAAYFAkLfbOMACgkQms08wKmfdd2KogP/aKPu
-QivvCNOg0smXso+p7RyP4imM2fnYfZKyIdztxfBCYPP02qClRBspmHmhLvNgZ+Ih
-PUm5lGodC9wYbcSurkpfRXDX8ImDBCZRJJxOmsD3qV5xQcmIJt35QiylBRrf/hBU
-yh+yeFGhebmplE9bAfo1S+B7azzdVtTCZlITCOuIRgQTEQIABgUCQuDsuAAKCRDJ
-tabs4td030I8AJ4tY6o5CNXMg85r9sn/T1XgxCf+JACgm3VUQb3crIBldo4E7ELs
-OlWKTCO0I1JveSBULiBGaWVsZGluZyA8ZmllbGRpbmdAZ2Jpdi5jb20+iGIEExEC
-ACICGwMHCwkIBwMCAQMVAgMDFgIBAh4BAheABQJBjv4aAhkBAAoJEFuWgBDgT5qJ
-GNYAnjO6NCBUeUnbCfpLr/TT+V05Ai3NAJ9w9U+xwdJqrNblobxTZofw/Zb394hG
-BBMRAgAGBQJBmiYYAAoJEIs6YB8IyXXlQO4An2CCetfVTn21dtjauCtRmqbMATLP
-AKDZtmMzLFJGQtbGUuhU1bcb+GY1IIhGBBMRAgAGBQJBollmAAoJEASX1ZESv+ea
-+KIAoKGdYYE6onP/naeAMIc9Ik9FlW3MAKDDJB5Yv9rdMUGhVbqtYf4zQuBvRIhG
-BBMRAgAGBQJBmogoAAoJEDCReXIpi8fQa+4AoKaD1nsE4UgDubabko3KGfJFoedY
-AKCEF53SoAmE6PbASnDJ9Ik+fT8t5IhGBBARAgAGBQJBmVVrAAoJEMl8UJZcHDrX
-mOEAoMS0ZWF6F70fDvqFOieN6OPLnxTOAJ9aHvFmaoVTreA5jh6uh6zi8lljvIkB
-HAQTAQIABgUCQZlJCQAKCRAG6s+qdtg8xoZGB/9TcMq82G3eLnFDST6aPeoTCI/P
-DXnjg0INoWDyDXWrogLTGH4Euy/A6Az2qjWNBIE4iDT+OgeWFgGm5WHMxsAYAjzQ
-Oo0myVPJqxTGpRO319NI0Z4yyNDuIpsIz0wGWrN5OnOykZvOBRyMTR13bS8Bbsez
-gUdloa0MrFknJ/4oFquLFmoAHPeR7uulzaU2zyXvZ+k30DlA+6XfvOw7zOQaiAog
-RXfTrqEORmMpJqm6CHYtE2agnVHWnjnbCnOk4k46JTakGxag+yRwrpvsvdb/W4v6
-U55Q3fUdANOjHBmav3i8Wtf4K46sbYmEmqjexMYMsmhlONt8xxRPGsTbnFNkiEYE
-ExECAAYFAkGalM4ACgkQyX6cq3d1tHn40gCfadmQp3jfm8qAHtMF95jAGL69z9wA
-mwd65tfWocFWyOsx5WmfWDwRkKY5iEYEEBECAAYFAkGeEXoACgkQJ0aiJIc88a0m
-zACg6RISZOTkaIKTsTXGdO9Ief+1ixEAoKQ/B2tXzDwr03+cZ4mUHM8ZgoEriEYE
-EhECAAYFAkGjAgMACgkQB2FzsZKExFKhwACfVcYhM+6DVpb9ezMdt/D7suT+ui8A
-njQLpOz/O8xZJ+YfrXiigwkhJHp4iEYEExECAAYFAkGalm8ACgkQXP03+sx4yJNy
-YwCeOrQVc1LgdZsBzwBf+e7x/0/atbsAnjPuftS2naF3js1ZJa2Zg4mH3xM3iEYE
-ExECAAYFAkGajQkACgkQF2rZyNGqiWKSyACgun9gfZ2906QTXzwVKCyc7gCe8LYA
-nA1OD8ycF/voOHhnIUTUeD9gDOE3iEYEExECAAYFAkGbzpMACgkQXUFK4eAFycsY
-8wCfbkSGlU/uTfFCixTZw5T8/qHz2bQAoIFN04VyQbl3eTwZrndB6RGIpwhRiJwE
-EwECAAYFAkGZgZYACgkQMaY9luwUC4Gk1gP9E0ctfYyBxSYLf4BCzZHrf3LTfErN
-57cT4xJlZgoPhu+QiypAGvBd+HzJIypfk2xtMBmh4eVC4h6xEfayKZYiUQcXM5um
-qWPoejwypfiEirKMzyyBhhiRrhX101ZsKU3H1WT/hoDW1Fj5QyQHdU2Cy3H/N9kJ
-ffPvDYtwbBgc+2eIRgQTEQIABgUCQZqKPQAKCRD8D4WJ+JS+EsitAJ9WzgasMNX+
-VbNkCFzu0PKB3kRGvQCfTvBTqsCiJ7nSMjyQ9PS6LQO5MIOIRgQTEQIABgUCQaVY
-8gAKCRCXZ4pyLS2qUlpMAJ916tBgim3Jn+/NwDv3xp+MyEJe4wCgwawHk24C8hMG
-lid7m6TeifMHe2CIRgQSEQIABgUCQaqJPQAKCRC+uiuH9fxLQtFRAKCTwt7TpFr2
-QzGZ7zd65bMxqU+GPQCfXtbuVrNOb0pOW2FHfCsZnQ5Mj8KIRgQTEQIABgUCQbEY
-DAAKCRDeooc4MoryBBQ8AKD8Vak3rfHFjimL5Q9pR2lLGY6cAwCg2n4JgEHjlfOF
-r3hUjkpETcG4xdyIRgQTEQIABgUCQat5eQAKCRDOAaR+HEPYUKVsAKDCmpZ8fmUN
-EuXCyoL4Jprk1k2rpwCgkh5iH7bQc+nrct6qg9rTRZXJRI+IRgQSEQIABgUCQbo8
-GAAKCRABBWa85BNjklhbAJ9k0oKaUQPE/2wpEw4filsdii+qxACfVHxThFduOA0h
-sytzvRmUPOeNrJCIRgQQEQIABgUCQbAYXgAKCRCyvrxAFSkkryVJAKD7GQrehzhO
-noT8K/ifs0dSiBU1QACfTufX2kmNV6g9+2fBny01e75IFHaIRgQTEQIABgUCQb40
-2gAKCRDoMBhIFqjTqysKAJ96Ou8DkmXiL2ouHaawKxsXTeH3zwCfZBKeJm4oIEF5
-3QuB+WPr/tEnaeWIRgQSEQIABgUCQeL4iwAKCRBMxE0AEd+H6VTIAJ9DqsVxJS4m
-kADD5Uml2cjK2lk+QACfU7Ggp2szss9E8mY/uIH9NEvifDaIRgQTEQIABgUCQc5I
-HAAKCRDBOfFTI8t6Kh0kAJ0Uky1vHTiKQehy0Q0VYDtE7DQ+rwCcCLaE4hsCzmk0
-P7Xes3JpFuMnDx6JAhwEEwECAAYFAkGa7kEACgkQJPjfwmx8T11ZCw/+MqiwBNEF
-tGJOeXbMN88hfLeomTcRmnewd2QFtPDvE3zUyCOr+O3qVweOHH5uSsc7L/Xv/in5
-kPOU8QgGh5m7ChfKyB8t0MTmYZtQ69Dd68FWZOW8lMmrwu+NUyQ/FAcM7CHidkaf
-sVHx2EE6in9W8tzlZWQBPQFTQfKGth9s/x+UHZntwsKXfQE9KZQUu1XW+LeKmCP8
-wfCKSCoSe2wVTecLSBNSUfgLm3lU7W8JuY42PsjOnDWrhH6nA1HJKVWL3EnE48LY
-nU5fwyfUvOjvK0B3ieq1U0wzQJfp3Qs/5YwOyZj5OCn4+mzuDELH9ewvngIm4JkC
-Pg/rPp59v4Ew4wQRQPdy0COEJhUoXhobNDcqsBBh5MO4IDNK1Wr6UMG5LiRZy+hd
-bmVhzudlgSFMozp46Ah0B0jF4SpQAbaQCkVGiR22SGhl9pIRPeiv4rX1mZHx8x0x
-yNweDl/xTgj52jalscmkvg9DjHY4KTebFP0fnJQ3mm5kBo0HVb724+dR1I8hcigu
-42SiLDvXY6dhO05N98jceSHEvqDdXjVcAXMjqA8LCYqaWbd75xc060Con0qK0ynP
-q5hqSWk6IRIAVZF1ODWqxWt+SihMT3s61sGfQopxcSjAV34gnECrX5FWD7l09Q/v
-nIULGIi2+e+kS/CuU1putPH2D5/kE8774/mIRgQQEQIABgUCQtzkcQAKCRDsqw57
-g+auDYfFAJ9hZL3fmrXrLx5NpEn8bBgW1JQ1LgCgu2Mspu0TEQEx/Ni/1P1uDGsp
-rHqIRgQQEQIABgUCQuDZGwAKCRCM43a4HNSGH3onAJ0fP3lBAFOp84iaeXIsTOnF
-NKH9UQCeM91DA4FnM23QPM+EDOC7aScpOyCIRgQTEQIABgUCQt6wTAAKCRD9b4jG
-IdCnG0kvAKC3AAF56eR0KVFsfup1sw5WR/T8lgCg3+I89dms6CEBF0Dhkt8AeN7w
-VCmIRgQTEQIABgUCQt66hQAKCRAyyeTONkLLS70vAKC3ZI1p4QABXJpmj6mpX69W
-2qjGagCfe+x+Gz86TWXrA4Tx4O9oh/6vqFmIRgQTEQIABgUCQt9s5AAKCRBQjq7F
-MC2laKc2AJ9OgaYLbOtoPPbCFLW0SV4U703ApACgqqiljnK1G4dStQ0Vk7hfRZw0
-rQaIRgQTEQIABgUCQt9s5wAKCRDdumS6LDEtL/bgAJ4jgI9x/ZPMhfH/EFL36fVg
-e3RvxgCfdXMaJx1Z6H1tu1YPDpFk0Op8OseInAQTAQIABgUCQt7HmgAKCRA34/Rf
-7mXjIfGOBADRGrzCutbk7Ls/BeqmEq2y7VnGaOHiukp4p7Giaj9tNnTZspkU3+kX
-vNkA8jjzoTYpU6Mv41KQuW7/7DfPhRRSgupJgQVlxqAM7b/aSzXBu6our6kdksH0
-m8ZIq7efF4cHsRb/12sAn5NRi3VDXGnnYFudNdYQ59XVeZFgNHAkwoicBBMBAgAG
-BQJC32zhAAoJEJrNPMCpn3XdS7QD/22wUAgq5s8YyWq3yjJC2fFQTPoc8mrf7puL
-8KK9W259YBUY5NtuAjkfQ9L9hNx90HIMsa5Tsp/StbKbaU+v80NQ5pXgd2z209Tr
-mPwgt5CHOnEEo7hp6hmhFeQMgwCLsMYmaWp7YYE/W0MGO+HjijHc5ynffubt4Vrw
-YOFwxaDqiEYEExECAAYFAkLg7LcACgkQybWm7OLXdN/sxACfaPr1gyfLBqufCBnN
-EiktSb7quooAnip19UPZQ/DF9PerM7WW0YE2X8xCiEYEExECAAYFAkLg7SsACgkQ
-N/aP9QFa/IpZbQCg2Uf6sa8Ls4uMwhd/gDJDefB/i4QAn1XFkAGlZKp6NT0cXwHl
-5g0gg3fVuQENBDrKHoIQBAD0LtmKeekw1walkGK8OAvKJpBT4Wm4AhPmnHNh3MFR
-jCAit8ULZEW0XDHs/5IHOFRpxyKKpSynzRNGGM2Yi9DvW5acn5H4Us1Vc8CBx1TH
-K+zC7AU7yS9TCR51VDPEONIp2mcd0eayB2R9iGiu9KV/Rj8+H//YGF2sCvAqXwOK
-HwAECwQAs+bNP78S1L78v4mj57xptLLWlsTxXkZd1JCiosXitNmGLYsLtBldAtlu
-XFllS2IjDZPV9Kp74ofgaO4wh01Qprk4Gn5SrSI7Oj6YH8DA/gggw7v//hEBLimN
-75okfqfzBhNTXNIxH6zhuo80RcfX0J/rZQ4Adu/aXeYpR7E36CqIRgQYEQIABgUC
-OsoeggAKCRBbloAQ4E+aicVhAJ4oVY04egiOWbZj8DoBLuPjiwiGpACfZTuOsSKB
-xkA8JT6eXcJrBJhGbcY=
-=KQRI
------END PGP PUBLIC KEY BLOCK-----
-
-pub  1024/E2226795 1999/09/19 Justin R. Erenkrantz <justin@erenkrantz.com>
-          Key fingerprint =  3C 01 6F 2B 76 46 21 BB  54 9C 66 B5 16 A9 64 95  E2 22 67 95
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 5.0
-Comment: PGP Key Server 0.9.4+patch2
-
-mQGiBDflD4IRBADqhgm28jVQWqu8ogG/NvYOSySYc4MhrXFqOQrRxJOcAxdc03fR
-Mu7RtAa4hXpNfjOLIfxY0cc6aqKJLlOuZAUxNNFWIcuO3xSWsPrwflaBsATt+0jw
-qc8zOqjQ+Eiejk+IWc+43+7ZggQ83ROhsX3njjdgZnCT6eSHbQwlBIAAWQCg/49v
-YeqveSr+JkWhCi45/NPHtfEEALPZcuaaTHyN5HBn9YjSIE+0S9R6fsdfIbD5OZok
-I4U8+SWPVHX7oDrW+vNhqQUE2u+kPTobjERqzSxT94sTx+93jUaI+H9CKb4x0i0j
-/4K0oPcBhlCsrIJR83IOqsw0+583OR9sIdKQ4H2aoPA5fWbE8swGpct9v/habHH1
-zty3BADfT4fbzDoryBzZGFIuaBaDjV36rWMf479Z8UfuWTcmODDilnitD1/JZekd
-uZ26A2pIDymYCl/YA1Ajel37ltL2uBBrj0RbqXJaco4qi/13d2P8wFcbj1qdvw8Q
-8b+BFeY6Wipa4YQQWWBl2DXpkQPbn6lp4fgH7re52Ifp+S67R7QsSnVzdGluIFIu
-IEVyZW5rcmFudHogPGp1c3RpbkBlcmVua3JhbnR6LmNvbT6IRgQQEQIABgUCO7q1
-XgAKCRAhRUrwzIsPfu3uAKC0/0sWPB/kb0R4IQLZ0puhGf0UkACglccPWwJoxlRP
-X7OXoyOAmh8ncyiIRgQQEQIABgUCOY+ykAAKCRBQENNBPZ/lLfXNAJ0TjsYqhnzD
-NTbjVRGhnBPtW7vkoQCePatWc3674bPrLqWjyxxsnQrC4IiJAEYEEBECAAYFAjiP
-jpMACgkQt5EJtVU3GBmGqwCg59ldjSguiatxd4GG8Zf8qYzYju8AoJlTLIxcu358
-M4o+x1SSCh6duWlbiQBGBBARAgAGBQI4uHwLAAoJEPkzzAXOnKkZXasAoLWUMtVp
-WejgEsi1a+83sxkI6OteAJ4zq9rOxZAnRf3EViBrYQYt8eSYRLQnSnVzdGluIFIu
-IEVyZW5rcmFudHogPGplcmVua3JhQHVjaS5lZHU+iEYEEBECAAYFAju6tWIACgkQ
-IUVK8MyLD343IACeJgsqw2TLSfqPg7vZXNr+YlE+ydYAoIgBr19QKzLvoOjiEYIh
-ybmYNKaUiEYEEBECAAYFAjmPspIACgkQUBDTQT2f5S3FPQCdFEcc43lyLLz3pHLi
-7fb438rJmo0An0CObwroeyH+JCYNTNWAAYJ7Q5B6iQBGBBARAgAGBQI4j46jAAoJ
-ELeRCbVVNxgZqSgAn1ggB/CwEj83gXMvC9jJ6M6dCB7dAKDsO36uuJEnET4AsBOK
-70w1dYtu5YkARgQQEQIABgUCOLh8LwAKCRD5M8wFzpypGSgEAKD840jlZGA4WdvW
-kwXTlqcb5GKhqQCfWQ0R+87LPP/mpFK9i7U71OlrtJi0Kkp1c3RpbiBSLiBFcmVu
-a3JhbnR6IDxqZXJlbmtyYW50ekBhY20ub3JnPohGBBARAgAGBQI7urViAAoJECFF
-SvDMiw9+9QgAnipmohCeCe6plQqqsNGFsJ74WVruAJ9Xtx5In/LzmIwHtoCGrcFy
-yA7y/4hGBBARAgAGBQI5j7KSAAoJEFAQ00E9n+UtbdIAn0pyUurPEG1GGSpt4pNQ
-6gXXv8idAJ9Bt1Wu4GZSLRjhFFR0BMU9Ce+VALQrSnVzdGluIFIuIEVyZW5rcmFu
-dHogPGplcmVua3JhQGljcy51Y2kuZWR1PohGBBARAgAGBQI7urViAAoJECFFSvDM
-iw9+o04AoMeojDRRWw0K3JN9D+IC0PJM8MCAAJ0VawIzQDYB/zot51ZbEgiNcZS1
-74hGBBARAgAGBQI5j7KSAAoJEFAQ00E9n+UtiI4Ani+W1CfvgzAJNeoTsazs6f8H
-m5sUAJ9l3DJCeC/HfoVBoyhgZea0xWADa4kARgQQEQIABgUCOI+OqwAKCRC3kQm1
-VTcYGS22AKDgckbOfjX0fJ91PFaZiosj1/Wm2QCgtfPhTwnIYWXisDJKxGKcPlOn
-2WSJAEYEEBECAAYFAji4fFUACgkQ+TPMBc6cqRkSNACgwk46PQfEpIvZMP4cQp+3
-ChdFFUsAnjYoMe2KLySYfmN7c/5dUMMs1/oBtC1KdXN0aW4gUi4gRXJlbmtyYW50
-eiA8amVyZW5rQHVjZi5pY3MudWNpLmVkdT6IRgQQEQIABgUCO7q1YgAKCRAhRUrw
-zIsPfqCbAJ4jIArOZ3d5SjYXfl+inSl05Y+VEgCfbg72HIziChfV/rnoqDsWgbM2
-+M6IRgQQEQIABgUCOY+ykgAKCRBQENNBPZ/lLZ5DAJ4+Qv/6TF8iXRKdruxagqRL
-8v02bACffoxhfnEGNeWpk9kwbPV1+dKnfee0LUp1c3RpbiBSLiBFcmVua3JhbnR6
-IDxqZXJlbmtyYW50ekBhcGFjaGUub3JnPohXBBMRAgAXBQI7urQPBQsHCgMEAxUD
-AgMWAgECF4AACgkQFqlkleIiZ5XccQCeP3nBu8yevFJjVlEanG30vNOk6bUAoKUM
-BJh/uKGoQhoKjtRmAbva9LhYiEYEEBECAAYFAju6tWIACgkQIUVK8MyLD34d4ACe
-OZSsg4uMubn8phNFpoYKsYIIbM0An3f5XVvuNFqRhZq65So4Ibda+GsvtC1KdXN0
-aW4gUi4gRXJlbmtyYW50eiA8amVyZW5rcmFudHpAZWJ1aWx0LmNvbT6IVgQTEQIA
-FgUCObPdKAQLCgQDAxUDAgMWAgECF4AACgkQFqlkleIiZ5Uk8ACg+2tSClNalnwI
-CghNlALE48ypaZUAoM3FyTiZHgop2uSDjBWkS5qnrf/tiEYEEBECAAYFAju6tWIA
-CgkQIUVK8MyLD35NmwCfbIdBIg9SCiCckGyiWYLpst3fmjYAoLXxrih1AHEjXN36
-bvX8VjuK3ZsHuQINBDflD4MQCAD2Qle3CH8IF3KiutapQvMF6PlTETlPtvFuuUs4
-INoBp1ajFOmPQFXz0AfGy0OplK33TGSGSfgMg71l6RfUodNQ+PVZX9x2Uk89PY3b
-zpnhV5JZzf24rnRPxfx2vIPFRzBhznzJZv8V+bv9kV7HAarTW56NoKVyOtQa8L9G
-AFgr5fSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY7288kjwEPwpVsYjY67
-VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy1obEAxnIByl6ypUM
-2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XpMgs7AAICB/4uMRus4MO2
-fRm+/sz3o/6Vu1TQk1ZAb6qDhwrkArfnj7UjNCWqn0B9eaubF96vTokb6hBtv3FS
-BZ5TDvngAbFvZEjNpXGfoW4GkoRdDKNpYoI8RLTKjlRKiaEl+f1e9WxQp7iyP4o0
-VAxAW0f/sQwzLGIpMS1PajO2mBBtSW32e7Zgy4C/AA914Fb4AR8wkoDPvr8q3P0D
-vwtnmd0pSPeAfGqY8QtTKjjPdAyETp1JIqH+uVlrij5CwtAd3wJBN4GMfXotztEI
-TA8um8xS/4EnWSOROTf3NNhv9MrTvMYpPsodCD/d0IJ7lce4hV5vzZ6hYX07gvcJ
-4LQrqG9b3yLNiEYEGBECAAYFAjflD4MACgkQFqlkleIiZ5WSSACfQA6CboJi79Li
-SbEJZT7+4wK4UJwAoLCn2Gpg718hDIGZUzC2avajRNUT
-=6s4E
------END PGP PUBLIC KEY BLOCK-----
-
-pub  1024D/2CF86427 2002-02-01 Ian Holsman <ianh@apache.org>
-     Key fingerprint = 67D4 D4C4 79ED D9EC 88E1  734C AB7A 60BC 2CF8 6427
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.0.6 (GNU/Linux)
-Comment: For info see http://www.gnupg.org
-
-mQGiBDxa7bMRBAC0kClufzb9tqQfQa+qs2E7sQYd5ag53w0nHKAW+9Q/5C1y0Gaq
-enp+p6FafJZdP4vIgmLw/4TWinNkLqJRSA2om2TLy29AznCGWbIvCuSX74WUa2Ec
-PIh2Lc/NpDQ743mocBc+XoLYBNESpGHPnpT5niYTvRLHjzxp0XLNk7Gc8wCgjR6/
-aKd+8vTZcDjh/3xZhsQos9MEAIQI/z97PtRnohkj5HVRXi2a7oQ8G4tPegfntz4Z
-n3jfq0WXNoMEWo7jrYUpJiy6L0y/tiuPfctb7RUJ5wfkdZmGjQ3x9NuGRq5jQstA
-neCxsIyl2f1qtwaV4IgfhVrfUvJhI1BQq7d5sqePjXmPNKfouYcNKeGOvZXbbswF
-oso6A/9MFgWcBOBx9h3wsoVQcYUo5nsUzq8a0AeTYKz6kUMPtVgFLmOxuJrKB2dX
-g+A/o+r1n4D/SYcCoiHBArUGuCjOU5ni6gC5mPKtlo8VpYpNV6tj8yx0ntyr4hu6
-KMcTdJwHs8KpfkWp/H1SXpy38ypUEQx7yZztpZnNiRMizDhDDbQdSWFuIEhvbHNt
-YW4gPGlhbmhAYXBhY2hlLm9yZz6IXQQTEQIAHQUCPFrtswUJBaOagAULBwoDBAMV
-AwIDFgIBAheAAAoJEKt6YLws+GQnhzwAmwfeZnT1FY3DfzE9IFkKKiJ1LhPRAJ48
-mi4txMWmwcQUv5N9PSgS6m5Ml7kBDQQ8Wu22EAQAyHiY98UhNYD1rJLJw81S/1Fc
-N/P657bqIbhPWifOHDaUpJEKY8YARxB5TucTCr2bF11fs0tlc8i+xqQjjIxlspFf
-d0b9mjzd0h8DfnN+Vbh8J/HrCN2l7EM9gbp9vh4sAfwFh4ObC0Z/ULnIpPw2s8U3
-v19WDLUz+OOaYvl8lU8AAwUEALd/VRU9DzAHefcJLrQkVbyaafq43FyQ0pp5HNO2
-FUYx3HohVKFHjPckCM6iOdFPixqNCTCutTT0ED8gTQ1f9zzNBqHx7RBlHcXQjPRV
-0Tzl+HWcTED7BL1i3rCRpWWguhZ7KYArjcPlngrDocshbWVYmUcE2KqIIRTkwbHW
-urXCiEsEGBECAAwFAjxa7bYFCQWjmoAACgkQq3pgvCz4ZCfAhwCXU8ZfULcXJERI
-YZ/OXV64q33OPgCeOftkLN7nxOPBn0so9h/rwSYo3qSZAaIEPFrtsxEEALSQKW5/
-Nv22pB9Br6qzYTuxBh3lqDnfDSccoBb71D/kLXLQZqp6en6noVp8ll0/i8iCYvD/
-hNaKc2QuolFIDaibZMvLb0DOcIZZsi8K5JfvhZRrYRw8iHYtz82kNDvjeahwFz5e
-gtgE0RKkYc+elPmeJhO9EsePPGnRcs2TsZzzAKCNHr9op37y9NlwOOH/fFmGxCiz
-0wQAhAj/P3s+1GeiGSPkdVFeLZruhDwbi096B+e3PhmfeN+rRZc2gwRajuOthSkm
-LLovTL+2K499y1vtFQnnB+R1mYaNDfH024ZGrmNCy0Cd4LGwjKXZ/Wq3BpXgiB+F
-Wt9S8mEjUFCrt3myp4+NeY80p+i5hw0p4Y69ldtuzAWiyjoD/0wWBZwE4HH2HfCy
-hVBxhSjmexTOrxrQB5NgrPqRQw+1WAUuY7G4msoHZ1eD4D+j6vWfgP9JhwKiIcEC
-tQa4KM5TmeLqALmY8q2WjxWlik1Xq2PzLHSe3KviG7ooxxN0nAezwql+Ran8fVJe
-nLfzKlQRDHvJnO2lmc2JEyLMOEMNtB1JYW4gSG9sc21hbiA8aWFuaEBhcGFjaGUu
-b3JnPohdBBMRAgAdBQI8Wu2zBQkFo5qABQsHCgMEAxUDAgMWAgECF4AACgkQq3pg
-vCz4ZCeHPACbB95mdPUVjcN/MT0gWQoqInUuE9EAnjyaLi3ExabBxBS/k309KBLq
-bkyXuQENBDxa7bYQBADIeJj3xSE1gPWsksnDzVL/UVw38/rntuohuE9aJ84cNpSk
-kQpjxgBHEHlO5xMKvZsXXV+zS2VzyL7GpCOMjGWykV93Rv2aPN3SHwN+c35VuHwn
-8esI3aXsQz2Bun2+HiwB/AWHg5sLRn9Qucik/DazxTe/X1YMtTP445pi+XyVTwAD
-BQQAt39VFT0PMAd59wkutCRVvJpp+rjcXJDSmnkc07YVRjHceiFUoUeM9yQIzqI5
-0U+LGo0JMK61NPQQPyBNDV/3PM0GofHtEGUdxdCM9FXRPOX4dZxMQPsEvWLesJGl
-ZaC6FnspgCuNw+WeCsOhyyFtZViZRwTYqoghFOTBsda6tcKISwQYEQIADAUCPFrt
-tgUJBaOagAAKCRCremC8LPhkJ8CHAJdTxl9QtxckREhhn85dXrirfc4+AJ45+2Qs
-3ufE48GfSyj2H+vBJijepA==
-=XyM+
------END PGP PUBLIC KEY BLOCK-----
-
-pub  1024D/CC8B0F7E 2001-10-02 Aaron Bannert <abannert@kuci.org>
-     Key fingerprint = 937F B399 4A24 2BA9 BF49  E930 2145 4AF0 CC8B 0F7E
-uid                            Aaron Bannert <aaron@clove.org>
-uid                            Aaron Bannert <aaron@covalent.net>
-uid                            Aaron Bannert <aaron@apache.org>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQGiBDu5G8kRBACUCvGTlqgxnukt9kkjFPIpr/xsyGJjq9XJ7SEMx8caA6uMAxtU
-mBcbBFqiyYz2zp019B/RYdXkpyoKVYyxoTdpkkCp5leZwoPJob+kcTkAApfTf5Rq
-xs3AbY8e/R3XAaqdhwMsBJ4Vsu96qE0/JRajf+0sw+kGN1HNCI0z1cKWKwCg30x1
-zjFAQBf5QZP29z4pijNAPT0D/3L75dA2cBhG+hXkvbaAPf6ophD/owMku7vHqYLj
-SUHw8Cc1C+uXGbRvK4cYVFS7wfo/FiNCHxawdPWeak910/d3UsoUsrNcSSz95Vnl
-RxSlYG71KKUi7us3dOEGzOnv62+zRUwA/Y32aLPkTwV+U4qC+zqYGGz/DUPsbeN5
-AY75A/9jACi6Tjd5kgi584FHYIlJKsoej5YRr5mz5tvVQnwCHsySzvKZhFNA+Naw
-kImlDBtN5r6SzWaONCa2sW2cSbECfpmvmGl3uJe9uVvbs6lEhZPNggKQgYNzdJQU
-HlvKHK1e09IPLFOE2xd/De11d9rFDnv/AUtIJrl439en7EziL7QfQWFyb24gQmFu
-bmVydCA8YWFyb25AY2xvdmUub3JnPohXBBMRAgAXBQI7uRvJBQsHCgMEAxUDAgMW
-AgECF4AACgkQIUVK8MyLD36GmQCgt177yUba4wl27GeLLngmvioBc+cAnApbnspx
-CWUm61QppZdYAz44QwPSiEYEEBECAAYFAju6stAACgkQFqlkleIiZ5XUngCglWG4
-DejI6MJ496Vu1Tysc6J+ozsAoIe9QsA50cxCZalaxUrBT/XtT7HfiQEcBBABAQAG
-BQI8RgEgAAoJEPcTqHkQ/eB1H9IH/0aV16LSzf1pimZLuARbymfdJK4/+wQ29H9D
-XWf4wDLdBJvUMkHcN9YxsslTmhqlvudpqCbbrBXu0Q0en3Qa3gxlG8c2pxCFpNrE
-vi7bCiCcpmS+OUPT4PAMz3P2Mmzx+i9/Y7yCSdb2eZOjakTz4EvYcn7naTz6TOQ6
-WvjkOA2kgz2fER+ciXF40A+465KxwyNJJlMVffRPm6PMgifTIGDqcewYo69uvltE
-XweTzh2mX0FBOuBgi6NiI3Yu18LhWtpBXrLmz52eQBrrnUXDvuNYoWbHsxM/56Vf
-BFxzUUd38ChFziaCsGvz5HbreDA523qe4k+r3YG0E5zU70kTAW2IRgQQEQIABgUC
-PFrxagAKCRCremC8LPhkJ54XAJ9cZpEYbISKfHfd2aXI3orydfv8VQCeLXVQbC4I
-U5vLvPQLx2uEMNr9csOIPwMFEDyuIwT9b4jGIdCnGxECG8wAnigF7KzIbslopWCe
-fPGBgVv0bcHmAKDmVyKvqAj90Ejni/LngyPrkSWbuIkBHAQQAQEABgUCPLINwQAK
-CRDXOpC4a7qdXVYFCACHrv4T0OjkSWpTVLHYm85Rtk6oS2PvbLKxmVYbBMG3B2bO
-quVLhjFBbaQyUkr3ks1ebWcjgnJCf72DrUwbBIjtbm+BjpRTvqmQai/lkf4oyFb9
-nVcX0iUR0t4uf/ecsz2rjBLlVYmAxUi4GXPnAAmFJtego1qJbEuHUuh5ZNGJuaxZ
-Pk1Qnu+5VMN9VBbXOFT5Nvnt2WQBrxYM+5SbxszF4BmpztIFoa64QrheRLIQ3jd0
-S2+xyQsNCFVfwYIvMQqVmCNC623sBhGrFiJffTdJv5Y8JcQwBSfU8KnBB+XNirDq
-LiUUI4m2xBE0Vhg8dFLnSi8yshKjTOBNQegmcC2MiEYEEBECAAYFAjyznowACgkQ
-W5aAEOBPmol1jQCfYu3bWUJ27UUERTXpWuCx0wGgi6MAoJbXTrlFWVN/ihAOeyoM
-+K8J1lA4iEYEEBECAAYFAjy01ucACgkQZjW2wN6IXdO/bgCglVvYECJYH9LS56Ug
-dx00l8NenM8AoIoyiqIRs27asHxwz4CRUAzM5SxStCJBYXJvbiBCYW5uZXJ0IDxh
-YXJvbkBjb3ZhbGVudC5uZXQ+iFcEExECABcFAju5HOoFCwcKAwQDFQMCAxYCAQIX
-gAAKCRAhRUrwzIsPfp/ZAKCcug8zNT2WbAXMt4PPJUzhPKch7gCglldxj1byfdKv
-9NJnrQLTQ6mXsmaIRgQQEQIABgUCO7qy0wAKCRAWqWSV4iJnlZVJAJ9/sAIUBPzG
-HfjRVuvkEPehgv5qpwCgm6FdzGwUXScv3jkqHGf8K5B3RNaJARwEEAEBAAYFAjxG
-AVgACgkQ9xOoeRD94HUX/QgAp4deUjwvISoeBoB7KmD67ccpcvSscBtFzpWVbJIm
-QSJEWkMwqU7ga616NgEV8e3BbOlpUrRCJg3l1lWGMVHFMlG7YRIDrCT91+M2IA0H
-0G0VCilPg4nUhx4vEww9H5gQkNAI2l4ep9B7LJD/EYMvIOfJ2W6SX/cip36/eHAy
-YjZbKw3+Af785A7H7lWWI+Umphq/rd103FcwCx4m7KGuZKZJlQse6l9PQqWcyjbP
-RrwD/WNUEhP8eXgy8/+XrHpqo9g4XMi4YVTqxc5nJ3iNYei6+iy2mK6Um4GNJANR
-70TNQBe3UlMFfvEZFQ8SrSxBBXk7Z7tdgi0/tb1saT7D4ohGBBARAgAGBQI8WvFv
-AAoJEKt6YLws+GQnsEkAnRlkBVgiZ9pkgU4k+Ab16M2bTYhzAJ4wWf4JZASGJM5z
-CVFQVpLsTcZAE4g/AwUQPK4jMf1viMYh0KcbEQKWqACg6oVtZOFNBi2KUiaiekea
-+YROANQAnRaTUuA6FZT+8+8BGy75en8FJTWiiEYEEBECAAYFAjyznpIACgkQW5aA
-EOBPmok1nwCdEaXD1JKXsqNwir4cDfH4JOHvH8UAn3CbHK98MQOAv30O1E86F0HB
-CfUSiEYEEBECAAYFAjy01uwACgkQZjW2wN6IXdNaUgCcDgHxmicULGB2TbKrslpg
-COhS2UkAnjgsAMSQLAPkvC4r+1gXa4c/e1v6tCBBYXJvbiBCYW5uZXJ0IDxhYXJv
-bkBhcGFjaGUub3JnPohXBBMRAgAXBQI7uR0qBQsHCgMEAxUDAgMWAgECF4AACgkQ
-IUVK8MyLD36V4QCfdB9Kqiag3T98Y6tQ5YSb259XJnYAoM9fQ30sbQxfmNKuOHbk
-IuPuU24wiEYEEBECAAYFAju6stMACgkQFqlkleIiZ5V/dwCcDxamuhlGgk3a+T0V
-bIRp6Qy8bB0AoK6jwOfUwTn5YJTsVH8k2D/lwWBNiQEcBBABAQAGBQI8RgFCAAoJ
-EPcTqHkQ/eB1q90H/j1MMsFAQ6XpIpTSWNAt/wR9qp7ZIAv6KdrbYX3akO3bPy3b
-KL+7gDjEAqVGHzEBjTnqU7erDaI2Ms2RVBFhx/jI5RwT02KHSw3OJkSKN002yVxQ
-igBSmIm7aKig8Uk632x2ncQz/pLHk61jJ2h/62enIhROGCQvrbArZAdAzqxTrSkp
-YZ0IJqfHgttzxXgllHgAqTia7dbMMymYDUH1xdSyD7SfyA0dsJ4M9HhSgXFzmOIH
-/dXR6jMrj39jSHsVMHyaMn2WWEj/AHSqvQ5J+Hi1EmLpA4NC6sVOhttG/c9B6SZ4
-xVDrH+qciaL7fFBB7EsCXMYpYsfbybZ+rGuMGtGIRgQQEQIABgUCPFrxbwAKCRCr
-emC8LPhkJ6s9AJ9Elq2KHVPSqEbv0KEX+qd1izAW6QCffYVRnR0OVdB624DHWIbq
-BAKSsoSIPwMFEDyuIxL9b4jGIdCnGxECd5oAnjKUT4SFF4VIDS3HEc8BHGM4zqIx
-AKDzxSD8YeZ0xw4cWb7JQYzpWmzmkIhGBBARAgAGBQI8s56SAAoJEFuWgBDgT5qJ
-8D8AoIyG5L6TBB4IJWQ+hwfNrD9IwVXBAJoDckFzbkgxnvhIczlY33Q+EqoMgYhG
-BBARAgAGBQI8tNbsAAoJEGY1tsDeiF3TlFsAn374e8DpYNe6vJM9istjZ1EWnFpq
-AJwKMiSR90qBquj46vhZ7BYszuYKnbQhQWFyb24gQmFubmVydCA8YWJhbm5lcnRA
-a3VjaS5vcmc+iFcEExECABcFAju5Sa8FCwcKAwQDFQMCAxYCAQIXgAAKCRAhRUrw
-zIsPfnzfAJ9rFBBJky98n6vzgvqtl+3HNU6q0ACgxaSLwy0Ki6Ii/eTzqNm8fL34
-IX2IRgQQEQIABgUCO7qy0wAKCRAWqWSV4iJnlZksAJwO02q9t/zo5HypYme1NNZE
-XkJf2wCdEmnVSdzJypGpZSod+8z+yWeH0P+JARwEEAEBAAYFAjxGAUwACgkQ9xOo
-eRD94HXDwwf/ZrEtrxyCqkBk6epTjn+JIXhx4hyk2/7fWXIFduJee2Mkfum+ERP7
-fn5mAYblwCaVMG93av2zb2gkZySCGsdmF8W9/ntPKf3HZ9ZBbRXNamtYyIPHGmb+
-wJPENiGZcKkCgACw8SJ7/nbGu0ctJpgyWEg0vDc/A30zR1/GxGddTpJ5wIRdhss3
-JBZQnFXolu802XmOfnj0IZ+ddw8AlWKS2kQj5de1lc1/iMTObBaF2dxbIjFpKRN+
-ZuTsWTbS+ESNNKKoFHjoRwu+kScKh4EG4YXsH9lvEePHRNFVWJ4H4Iu3OZQ028Ll
-dqnCs19XhV5jTR1iRESKsEvFzqsbDH2/DYhGBBARAgAGBQI8WvFvAAoJEKt6YLws
-+GQn+h8AnjSdURKLWjGTe2tyZ6uFgZfHNFHtAJ0dqyM2kQE0hqvbna1ekOKhhJxJ
-PIg/AwUQPK4jJv1viMYh0KcbEQJd5gCeNxmgjYHc8Rbskd/Rx6G4GLD8bf8AoKMb
-KOkABzz/lMkWnFoSQTORgoByiEYEEBECAAYFAjyznpIACgkQW5aAEOBPmomJlQCf
-YbwuwJSHLxlZ5X2e3S7NY1do6TUAnRi2BeKlVOINxZAgFsdzWtbyta8GiEYEEBEC
-AAYFAjy01uwACgkQZjW2wN6IXdPTvACeKekzrpxWT0kznQkzCsrWT95xQL4Ani5w
-hJTuQ4e2PItb0kLCyoRgMMmYuQINBDu5HBQQCACKePczRQE1gIWH6LZaCDY8pINs
-W6SHl4MXDnBPgnuZ9H/6kFr++2OXatVKlAoQ3mK0sN/py/HeGkMwKBI9lWVldPik
-4pgDhdmZU3B3spA+TTCBWNpKyXGY2c7P+ougUvwQAysifhxOGAvr1R6TpBqeSdZ7
-4ZzMPhHLSJGwOSq3BJ/uaViRzZORbVmUFV8s1Og3UlHdvoK+blnbj6eMVyrQ/n+U
-LviDnPDxasWhP4an+v8c4Gk2qsAz1XmXccn7S4pa9x/yxiXLNHHrr90Dd0h5Lvvv
-hgcQTUFbEwwcdfzKKaiOtuq6qA0Rki/wBBabEtLPzCgBIpUj2lUZZrySVR/7AAMF
-B/0a9jaU9Gc25ZygMtftWMVIXEGG7aTqm95Q3ZebYRlpxnJJUkNyLuj09IwBuV7a
-XkpEBdACHNTyPwl3khmswjxQO5tWj6JEvdijxMEHu8JtfTq43zRAc62bMq6uJshW
-Nd1oVu7pS4JQGmJvUyZjJ+Q9iiyY92XtdSyN0QnB0BeXHyHJB7ZeHbzALkOBDKUJ
-yK50/ACJz5JFXabvc0c0zwveU46rFFa2Vdqv2Tf3exL4Gix/Pd8cKfknrssXoIwm
-UvpESL92XUUSm7Ozy43+UWq2J55NSLNuqNtZyoMJWiLv3RpBn1DdGbXpuIeyDHCD
-MM59GnqTdrJWcVQ9WJ/9txxziEYEGBECAAYFAju5HBQACgkQIUVK8MyLD35AfACZ
-AcAS375Fg+hea6FxD9qnqpaZpjMAoLY7tAaEc1bKdJ/8Za3ZPT/GON9J
-=SyIW
------END PGP PUBLIC KEY BLOCK-----
-
-pub  1024/3A4E7AC9 2000/10/11 Brad Nicholes <bnicholes@novell.com>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>
-
-mQGiBDnkyK0RBADedOdiCuVtn2awUpoc02Gq+BCHRjy/lnZ9p4wdgJPJIdImcEZo
-agfLwU8iDY4L+w71FMiZjR6Lp0dRK5TupeUD/NWEsDM7we4KjafK1tGN9QlkXAtZ
-WulDyUoR6c1cTNeMPowL8/MMs4IP1VGL+9SUjSsoJOm8VBu66NLne/WnfQCg/4bs
-0pNeQCtdzCzeNnTFbDSFd7cD/2FWSh+CMrhhC9tqDjfkvLrjcTj1bEpOI/qYb8Ir
-eivywJQ5u/tvIkW856SubuBDFRy9kMlJEJL7y8pxD+6xm4ZYexznLS2AjaiseqLE
-tgR+AXtgjebiM7gQ/hOtDJjpTPeA5hLYIsDYYrXds7FTeYhsJVeXZpZt6T0Uqqjk
-aIe7BADXsfg4lz9/ecmHjo4VAOII6A+Ax2P0FTkxSXqPfIK1AGebIpAGE9nrc9t3
-hKkaqFztHM/OS5/QFs0G+RBnSyMUd/HXUFSl71Bf8F9dq/CdhNK0KXnOuZqpXZaT
-WuD3Fl96HsCXYF2Dvzwf7Yoyai/3wX+f04VZbBKuLM+AsZmG67QkQnJhZCBOaWNo
-b2xlcyA8Ym5pY2hvbGVzQG5vdmVsbC5jb20+iQBOBBARAgAOBQI55MitBAsDAgEC
-GQEACgkQ9V3wKTpOesnSzwCfQ73nPsRRK31if54rQKcVaa1A+68Aniks/MIcwGUC
-xSxJZpCGICkXhueyuQENBDnkyLMQBADZi2ehJNymtM1VOMCzWkamCuIWaDZzUOmK
-Hz7pFnceoFC2xynrUI+AJIzFqqiWqovQqv4V3GloRdWcw9Ye2IIi7H25r6v00Ng7
-kL1TzFpjC6yoHGXgEzYFfxa63plWCRGdfWU+3yzg7lQAF9a/ATUxXUXl+uIebQbo
-ZI1Wt4l1kwACAgQA0bT3PCO4TT0yhTuS+Rgk3ROqZTNhmMAnrTpHW70E4N4hgBe1
-1ZEralIhzT/1/dpsPbouDMMUer6voDcAyq7kCZobu/84LKhvCgFLQAF7PAz6g5Rc
-sPsoVv09UYYVgVi96EeGciA6ozVSGsVfNwEzZX7QOBoyrFozlNlX2Y+oF8iJAEYE
-GBECAAYFAjnkyLMACgkQ9V3wKTpOesksrwCgwQImPBW83G11skRygzwEOm9DWHoA
-oPpwZLqqLg4/dGQ0ZK0Qm3HXok7W
-=YgRS
------END PGP PUBLIC KEY BLOCK-----
-
-pub  1024D/DE885DD3 2002-04-10 Sander Striker <striker@apache.org>
-     Key fingerprint = 4C1E ADAD B4EF 5007 579C  919C 6635 B6C0 DE88 5DD3
-sig        DE885DD3 2002-04-10  Sander Striker <striker@apache.org>
-uid                            Sander Striker <striker@striker.nl>
-sig        DE885DD3 2002-04-10  Sander Striker <striker@apache.org>
-sub  2048g/532D14CA 2002-04-10
-sig        DE885DD3 2002-04-10  Sander Striker <striker@apache.org>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.0.6 (GNU/Linux)
-Comment: For info see http://www.gnupg.org
-
-mQGiBDy0wXgRBAD1J8+8rBKAXD3Z9n7LhdQ+gDcYIDw/sN0cZGz5kpc/1YWWaMQg
-ArmoNW7y+BBwNu6Cn42Nid16avSC86H1zBzOdQscDc9/WLwBCiFDCSHB98+UId25
-JGS2cRSE6vt2oDOy99Ent8Eh3f165e0rWVdc7NMOcFGhCTquAFbqMfxYzwCgvGIC
-KcMeykaY5QSHrX+ckJmc2QEEANDc4ZRPVF7cQ2wR2OIYzh5oXInhFFnyW2vYbTsx
-NwREbizoKXqG7rmTmOQPz6DsifJEo97QrFrSOcD9FI6aUpDmu1Ns06QSjmzCSS6i
-R1xPXBp5//2jcWjLs8td30N+AfwFnnB45sy8ILWel1CkGhdPoiHdI8Q0nJWahVwU
-PKz1A/9xPsk9k0quKrhEKI7sYZFJn/vy77gh4/k26/jk7JERonO8ECDDlo+r/hfF
-op8A/ljW2BDm6VxHSBUkIJvULUbN8rxvQGnpKplv9jgiwBHoPhKZ/TX7KvXAvdPg
-bx8Z4EfSVJRQs7j/v/IhM8xn8tu0EEW+Fg1SHCFWV5iqe6aTZrQjU2FuZGVyIFN0
-cmlrZXIgPHN0cmlrZXJAc3RyaWtlci5ubD6IVwQTEQIAFwUCPLTBeAULBwoDBAMV
-AwIDFgIBAheAAAoJEGY1tsDeiF3T18kAn2kAzhMXT0tOg5GvGVNi+rc+dpZcAJ4z
-rKA/8TnQ88Lqq/OOwkuC/TXrHohGBBARAgAGBQI8z5oyAAoJEBapZJXiImeVyywA
-n1wPiGQVC6Kwdz1XlXrFL6/yC98mAJ9MZZgOr/Kyh2mDgwqWi+Fa/bgqarQjU2Fu
-ZGVyIFN0cmlrZXIgPHN0cmlrZXJAYXBhY2hlLm9yZz6IVwQTEQIAFwUCPLTB5gUL
-BwoDBAMVAwIDFgIBAheAAAoJEGY1tsDeiF3TQNMAn0ear3DqKydi9oTzfBYFCidn
-YhqJAJ9fvKcU27+jJCRHIPp3lQPX0C+UQIhGBBARAgAGBQI8z5o1AAoJEBapZJXi
-ImeVXd0AoP+AlwMBWr5fJ9pERjvKmnnNJE5oAKCJTRBYnB/aYkt8/aqPMVtl3k1L
-NrkCDQQ8tMGJEAgA2F8v1AMPGI7cv7cWuySfnd2CV7SXOZQpc3Pfv2UHgYP+1lTL
-NJoRtfwXMiNjrEwgLrpLy7F0nHnVqb6MBYv/Dhx6eO7MoejJUc2pADijCS3Qcg5n
-7hCZ+pWvCjdZAfZhHB1cpSm0FVuc07jrJYTbI/qsdbUHQ4r1jcIZR/ZU4mTnFgnE
-bAw4NxSGJ8ikFNNfviDdb3O/XAYS27dgJcGHOHaQi54dWkJpYt5vayUHYt85pOMH
-MR1AwkvM3AiqPO3688VbV6mIlGS9XvBr11kbZ5EHUCDPFJl5AMjX2fg4lMQu/ONj
-rbxCqbJppPLLXu/MwfrV9Y4pb7L+riWqdQwEOwADBggAgOqiXCSsRXmbxC0hYNj3
-UCY9KKy6CmCwExigG8Irs3aqC3cPGi9/9lpuniMN5F9ieN/BJysJHAFWN8f3z4UC
-fQH6os3ewQDZqoFrgkHqlrAjej8qD0X5Ue0dozXLuMFe05X1XCkTff9wXI88uRxq
-+5s7cedGqZQUixpN15oK9FZSORPPxjGsUe8NVMsplYvH/2xt7tXzDfE09zwT2qnM
-voQte/WBoVYdVCigUIeArRqNyCsk1yGUfiBcmJFHCyhKNtYNAUwWGPv8AmTAb5yf
-FFVprAMbDlv2yhiTnEj7AvEC+OP1RH0Z4j0TDlpeKHoZtu3uP/gp7Mshs7ssE2mV
-qohGBBgRAgAGBQI8tMGJAAoJEGY1tsDeiF3TPewAnj9AmBMuS8QvsuS5hUhSWNZ/
-uLN6AJ9FK1Wz3vBRoTloK5D3D3UaJ4x7Hg==
-=AHY5
------END PGP PUBLIC KEY BLOCK-----
-
-pub  1024D/E005C9CB 2002-08-15 Greg Stein <gstein@lyra.org>
-     Key fingerprint = 01E4 7536 0FCC F1D0 F24B  9D14 5D41 4AE1 E005 C9CB
-sig        E005C9CB 2002-08-15  Greg Stein <gstein@lyra.org>
-uid                            Greg Stein <gstein@apache.org>
-sig        E005C9CB 2002-08-15  Greg Stein <gstein@lyra.org>
-uid                            Greg Stein <gstein@collab.net>
-sig        E005C9CB 2002-08-15  Greg Stein <gstein@lyra.org>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.0.6 (GNU/Linux)
-Comment: For info see http://www.gnupg.org
-
-mQGiBD1bRO4RBACFxCQEk8j9a9SSzVIFUg6EKAXabSii1f2vyhdsj7yLd4E2nybA
-6907ohpFkIHdOGWAasKKDRG3rpL1X37c5dxUYgGFGyfbe7FapUPP0azq/Wsfn8Ax
-6D0jcIHJKZg+L0zHqxSwItiyiSqt2YGRUO42Bo/8SF7PHnv5TNKQZOjBIwCgmyiQ
-lVmqE7NiM2oR3P0kYUDDcWMD/j0v3uyNKPTTOgapzRM7ThACv/6KmF600HH4ZbHg
-3B2JTaoHiCDoYs1kp/8F65N6KG8S8wzJb1ErpbZSCqy7ZjjFm+NDRsTkFHPZngUS
-l4ctAthOwgg93STorWE+XRF9ZjzL/XcQog2XV3ZMZAGq0prgX0LjZ8lHWPkvYv63
-EEJIA/430y8P+3refqpeO2UtsrUeDaYEkNJg379USVdI1VDJXdS1G5lCRkNiRcyU
-im6ZcgOlgf+7KNuBv9urIwk7GkcPl4QHHFk2Fex2+k2JDxn+8gafjG1O2bkDKEyi
-csHOWFouQvxLhglC8WJCmPQtMwMWzVpNlOnKyN6MPyvFz0CKc7QeR3JlZyBTdGVp
-biA8Z3N0ZWluQGFwYWNoZS5vcmc+iFcEExECABcFAj1b0FwFCwcKAwQDFQMCAxYC
-AQIXgAAKCRBdQUrh4AXJyzFQAJ973oVmfVyH0w4cs8SljCxwPnhUCACfebmWhkt1
-aYuu0vSX34Req3TPZ9e0HkdyZWcgU3RlaW4gPGdzdGVpbkBjb2xsYWIubmV0PohX
-BBMRAgAXBQI9W9BsBQsHCgMEAxUDAgMWAgECF4AACgkQXUFK4eAFycvhKQCdEvec
-2nvVEx6OC95oTwYZSM2B0NoAn0Ju156UP6IwGwczI0UGYuezk/4xtBxHcmVnIFN0
-ZWluIDxnc3RlaW5AbHlyYS5vcmc+iFcEExECABcFAj1b1JEFCwcKAwQDFQMCAxYC
-AQIXgAAKCRBdQUrh4AXJy2W3AJ9Q/SnukhlOxz2vHahHiQ7ZgDE5qwCfeCn6PL3H
-VMW9xLKJtU0O+Fep6a4=
-=2Mbf
------END PGP PUBLIC KEY BLOCK-----
-
-pub  1024D/8103A37E 2002-07-18 Andre Malo <nd@apache.org>
-     Key fingerprint = 92CC EF0A A7DD 46AC 3A0F  498B CA69 3974 8103 A37E
-sig 3       8103A37E 2003-01-01   Andre Malo <nd@apache.org>
-sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
-sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
-sig 3       2261D073 2003-01-02   Astrid Kessler (Kess) <kess@kess-net.de>
-sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
-sig         75A67692 2003-03-18   Erik Abele <erik@codefaktor.de>
-sig         B3B2A12C 2003-05-13   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
-sig 3       F43C2F92 2003-10-03   Bruno Lustosa <bruno@lustosa.net>
-uid                            Andr\xe9\x20Malo <nd@perlig.de>
-sig 3       8103A37E 2002-07-18   Andre Malo <nd@apache.org>
-sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
-sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
-sig 3       2261D073 2003-01-02   Astrid Kessler (Kess) <kess@kess-net.de>
-sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
-sig         75A67692 2003-03-18   Erik Abele <erik@codefaktor.de>
-sig         B3B2A12C 2003-05-13   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
-sig 3       F43C2F92 2003-10-03   Bruno Lustosa <bruno@lustosa.net>
-uid                            Andre Malo <ndparker@gmx.net>
-sig 3       8103A37E 2002-07-18   Andre Malo <nd@apache.org>
-sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
-sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
-sig 3       2261D073 2003-01-02   Astrid Kessler (Kess) <kess@kess-net.de>
-sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
-sig         75A67692 2003-03-18   Erik Abele <erik@codefaktor.de>
-sig         B3B2A12C 2003-05-13   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
-sig 3       F43C2F92 2003-10-03   Bruno Lustosa <bruno@lustosa.net>
-sub  2048g/E71FD3A6 2002-07-18
-sig         8103A37E 2002-07-18   Andre Malo <nd@apache.org>
-sub  2048G/3EC3A5BB 2002-07-18
-rev         8103A37E 2003-11-28   Andre Malo <nd@apache.org>
-sig         8103A37E 2002-07-18   Andre Malo <nd@apache.org>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.2.3 (GNU/Linux)
-
-mQGiBD020E8RBACVdPw0jDJ4jXKx8hBllu73Vmoxz8amOq6J92XH0Ch3obgHKTa/
-JndsxvYFDy4onZItPXbb4TC8uJGwi717eU+w8dHvB/R972JveKgb0HMeHcrGFOvS
-+AlggjSCSxGht0UzwvwQgTZAdWfM+14g0K7yPtpMr4eh3QjYI3Q65lZ21wCgwNS/
-9Jl0adHrs3VzLFpT669fcMMEAIaesoMbtU0YaSyKN6ohU612G3pNXG23FeqbOXTY
-twhKxtefcG0xmssI4ylq4jxxn4iLQHJUn9wI/oS/rksJjdBWICq3vah6FV3NUev7
-LZcJ1X/TntztE0SKSdwjngW4jhzxnZlteCVRmeejIgotj0xOwBzRfNGpW8E9JJdA
-uWeTA/4/b2+jlkcWnIYrfy0HwTeeN2Dzd0p1S+egfkFZOfD15G1iRCSVsDVaHyeL
-2n9NMfjVlHV/OzuW1/786IpvwFXwy/4HUm7b3DwG6p1GIUFFgyk4CjezzUqBAaJK
-vfiaGWAmPR/gVdPSI94RduQNBhvxFupdH6QsyXw8Rxp+dYM7WbQaQW5kcmUgTWFs
-byA8bmRAYXBhY2hlLm9yZz6IXwQTEQIAFwUCPhN4hgULBwoDBAMVAwIDFgIBAheA
-ABIJEMppOXSBA6N+B2VHUEcAAQFcggCdHaBDTO7VXi01WGveomeSLIvx//cAn3ov
-xRtZ5FkPALFK8Gu3aqJOf3osiJkEEwECAAYFAj514TUACgkQPo+38viDQdneGgPn
-RL56FbdifkKziqJVkXLNdPeHAH924v/k0SAoX4Z7UlLuzKGF9pyjeOl4XOWuD5yv
-FyjPMByZmeVOzPdsjPRAo+6y72POePrXvxZn6wdy/gEgceWxCC23DOdq0iIN581E
-Hc8mcKTrLj2ND1WPCNjz6iO74qoUKGxM3WbJpfeIRgQTEQIABgUCPnXlXQAKCRCi
-EVrhX2uLcmOPAJ9Lyg2fvTxGVamEwgvP1cf7/VU35ACgsFKVNlQ3qlSmPgeKDYr3
-cE3QfcWIRgQTEQIABgUCPhOHsQAKCRDu0eo5ImHQcwvLAJ4tsiuDE2UY17kdNlbW
-JUbGQim5bACeP/31gQEQBPKbbhSungcj/uiZHcOIPwMFED5119b9b4jGIdCnGxEC
-KCsAoNiERBYp3lGM/e041l/Dp4NalwfoAJ4vPM9qLN+CwKKqkPcFWT361dd9mohG
-BBARAgAGBQI+d6vlAAoJEBU/oM11pnaSFgYAnRXQPTwosdoB2tkdAixHt6r0SX5d
-AKCF3u+4wK/1/3NJLbe0rsthERhpE4g/AwUQPsEPa9vSRfyzsqEsEQL7MgCggSp9
-AlkHuIEjWqWe+cf71MI0/m4AoNqapfJAGP3nrFopelr8X3SmXOLCiEYEExECAAYF
-Aj99kD4ACgkQiNfNvfQ8L5JSDgCgtO3NvDQuGjMttuzQQ2q72/TKg0AAni7N9ZNz
-IYiK2tDIGHuZpvJKey7NtBlBbmRy6SBNYWxvIDxuZEBwZXJsaWcuZGU+iF8EExEC
-ABcFAj020E8FCwcKAwQDFQMCAxYCAQIXgAASCRDKaTl0gQOjfgdlR1BHAAEBkhUA
-oJeJ/RvFnduhbVt7aBX525PsY2PEAJwIsvADai6FHkyc0awF8XwLjF3MoYiZBBMB
-AgAGBQI+deEvAAoJED6Pt/L4g0HZAiQD50pdd3/xn1Ue76fQ9zShqBpP0YliD9Iu
-Co0Gh3PfATMYDbXqNThtC6jEDOyyeR8ZiJsJGwTh2eSRRVK6YURYy8ef7FWXiT8P
-MeMThCqui3mL3oovpZXTX7S7dkwY84OaWIyTc42Y0Yf+sI0WW0LTwnKId/NtxF5r
-nfmrcgkgiEYEExECAAYFAj515VQACgkQohFa4V9ri3J1UQCeJ6XBQjbUpYRgsndw
-2MD4p2WS8vUAn1Pe+uc60dzzIyzbJMLLI2CVro5+iEYEExECAAYFAj4Th6kACgkQ
-7tHqOSJh0HOCRwCeJkoqsG6ofuGk1lZS/6EBwupfppQAn1cs8TPKywSVEF5/kXpz
-MbFKMoAHiD8DBRA+ddfM/W+IxiHQpxsRAkHHAKD0TvgAFQkaIm3ihevb0A9bZdo6
-jQCdEG+yxufIV7YrMdR+ACF2YBRmQi6IRgQQEQIABgUCPner4gAKCRAVP6DNdaZ2
-kprhAJ0RKBvHof+L2PUAACwcNYxPmcdZzACfQn45gJqhY3iTuaSrxbtt9Uj+GAWI
-PwMFED7BD2Lb0kX8s7KhLBECfpEAn2SgNqS1FFCAa0qswKr+0VXRCLlBAKDvAj4o
-Fj0vMELaxdqLRpofJo6aDYhGBBMRAgAGBQI/fZA/AAoJEIjXzb30PC+SKbkAoIZv
-HORjyXUWiVtvZp5IbOg7PpmAAJ91B+sAXSC0KZAYdKiREaU1LuRIz7QdQW5kcmUg
-TWFsbyA8bmRwYXJrZXJAZ214Lm5ldD6IXwQTEQIAFwUCPTbeIQULBwoDBAMVAwID
-FgIBAheAABIJEMppOXSBA6N+B2VHUEcAAQGl9ACeLEMFRQIDIyptxewoPoarWpv+
-PJsAoKSt98+huyZ8ZnJbi3rDyUs99FWViJkEEwECAAYFAj514TUACgkQPo+38viD
-QdkofgPncrDfQy1Eqthl6zSIuqcy40VnIhZl6oG1QKQkpJFlWnfwBXGnxs3S91ZT
-xePXizV8ZEsTMxo9WpYOVkWF3f6OUFs0wEvRWNbH1OFZ+J7m/04xk0aeWSaTBc0B
-qDRDexm/kh7baUm7AHPVv5t6d4F9q2Udip1XSaEEXjGFW6+IRgQTEQIABgUCPnXl
-XQAKCRCiEVrhX2uLcnROAJ4qfuGagTHfXOQZxgtbv/xNBuDTmgCbBxmInYjKqVi5
-PGc6WqRjXlGEtWGIRgQTEQIABgUCPhOHsQAKCRDu0eo5ImHQc/y0AJ9Ygmr9qBZp
-gKtGY92gycOjY/nI+gCeOOMDnT20bRwsUY0KsPzfc3/n/lCIPwMFED511939b4jG
-IdCnGxECtWQAnjSqf+kk+QE0ySD/dmGKtV6m7rZmAKDHJOzT1DbySPVPYsRI71Zy
-LXRMyohGBBARAgAGBQI+d6vlAAoJEBU/oM11pnaSMpgAnjQjqqitLpaXEVX4xMyh
-c+SWwwqfAJ99J4WGSjx2TP6jH5F+g3eIBvTgUYg/AwUQPsEPdNvSRfyzsqEsEQKo
-KQCeMNi3xC7+A0W360cw2sVo3LFmEIMAoPiQkWR9p2nw2ZBw6fwFSC6ZjfG/iEYE
-ExECAAYFAj99kD8ACgkQiNfNvfQ8L5ILRwCfR8G61cs1o2rtGRuLRVxkHFdLauEA
-nR7PIdcv7egOVuEq7nI1/mVGyJ7UuQINBD020FwQCACzjBVkgyKm/qUtaK2pLCcA
-TUKioRrdEROiw85ojD83rtV5mW1XrvFfwekCbWMyBvDAlF+jF0IjjKaH7o8Q3I9q
-S4md8cetsH0PMpDqgxzX2sGXUO5oBckJ8InJM6QVj/FyUHmCaqcttaIJWSZBpv97
-NWKDrgscC5rCbmsZL0Hi1kLfxfllQvq0snP/88wWInRFyHrqHu3XVmyeA+08LJae
-GX9T1zPvKL+nXO+7TBswxGszE1lJmkafKnGzg2NLpZKKZTUNaFJhQnPqMsGNu9x7
-fwqE9avYnNLyIrYPy+fSZPsMtn2VS1TkbhVPQOMhq8J6k2WiHSd+/rNx41X+6N/3
-AAMFB/0UOqYx/526cVcqufmTUjsZ/ZHa52VYL64czno5u8D0Y7yw96rKFscnNbRu
-l6kY4RBZ3VRqWBPE8OLlNPU4NkpV3FsFnj3e1e+nmv4dRTHGENy4ufESDcu50JxT
-4obM5FjbdfAH81MPGZee97O2CYP+usTS8I/6fd4D4wsU24WAfpKIuHChjgpUAFOG
-9386j7TpRCMZfLQk7bIzZsa6fnNWxfdJGAfPrsKMAIc5JY4HHIfTjr8fZpe3Dxy8
-cxc+ZWdi6TUU2L9BAhsAh4OhuqnAN1/AChB1sCbe0zr8eLSwMkzvjBhYXBCpRDqR
-1BafVsRm09g03ZOeUVX8aFVN3Dm1iE4EGBECAAYFAj020FwAEgkQymk5dIEDo34H
-ZUdQRwABARO0AJ9KSq4YtCH0mEvc7bmtEYMg61OlzgCcDbnaS4zc3461d1GAxef2
-vZwJNc+5Ag0EPTbc1xQIALLx5n1nvDmOVjAGvYwXphGXDTdK2yoy5qhElUs3LtgV
-2pCsLmh0USK1IXc2pJN/XWq3FKkQd3W85LisWcCF5GvYlKlYS2Y1NG5k5TOcdAx8
-4ZtIxu6a79we6dJCQ4QPQMHDCxejw1Zflgg8Ml8Jex9CgVsTH9dR2OunrnPFdWB1
-M7zanFa0oMOpSMtn8s2YyMES2SeiBlX/ZDDlPvwBAW0nfwJ6X6ybPq0WD134W73t
-UqwU0lkXTtIVejix+3sUE7tHo/Q8u4Yr57uZlhgCCG5vYuMTmyRW7qSb2QkrNULf
-6aR5BLN/3ghrmX3VkcZzsuuvi4eWNjFFBsB9sxNRo48ABAsIAK0QfXGaO9utxSWy
-eOITFbv6p8rbsyv175hBeozB1mpEK8F01NJV5BkHGd03uOAjWo1e0IbJFdESG0tf
-wy7GbvbA+b6NP6fg7BvX/i3ca8XrdwAoasaMck1+RyUO8CCRqc2RY3V1ngL7z824
-Vn113QO7bngykdbO8Ub4A+LYoFv7QMgtjlbKCS4PTx8dHKfQWVz1a8F1qUIb6Abe
-UNt8GiehiUfZ2YaUE3CiMR0CYQYZJ61R8CmAw/ZwiKjbbde10n8uMhWOMmgCG5J4
-QCB1TAsBrH2fU+aMiobSp9Hz7UDdjDN1728LVdoEeaA5oArDhcEoIzwZ/Rgb4VxQ
-ZB7NGE6IYAQoEQIAIAUCP8am1RkdAmdudXBnIHZ1bG5lcmFiaWxpdHkgOi0oAAoJ
-EMppOXSBA6N+zfQAn3hYxwNd6/Zh9/9vSrBjnil4d1AMAJoD9Vi2J6DhxHDrUiw2
-i+8RU+4msYhOBBgRAgAGBQI9NtzXABIJEMppOXSBA6N+B2VHUEcAAQGSjACeKvXX
-kfcE8otR7xgRu/nO0LOLjSIAoK4gCL2NJ80W8HgC8JIAkHU25Lv+
-=93VU
------END PGP PUBLIC KEY BLOCK-----
-
-pub  1024D/75A67692 2002-09-28 Erik Abele <erik@codefaktor.de>
-     Key fingerprint = D395 C757 3A68 B979 6D38  C258 153F A0CD 75A6 7692
-sig         75A67692 2002-11-23   Erik Abele <erik@codefaktor.de>
-sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
-sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
-sig 3       2261D073 2003-03-17   Astrid Kessler (Kess) <kess@kess-net.de>
-sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
-sig         B3B2A12C 2003-05-13   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
-sig 3       8103A37E 2003-04-04   Andre Malo <nd@apache.org>
-uid                            Erik Abele <erikabele@apache.org>
-sig 3       75A67692 2002-11-23   Erik Abele <erik@codefaktor.de>
-sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
-sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
-sig 3       2261D073 2003-03-17   Astrid Kessler (Kess) <kess@kess-net.de>
-sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
-sig         B3B2A12C 2003-05-13   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
-sig 3       8103A37E 2003-04-04   Andre Malo <nd@apache.org>
-sub  2048g/A680673F 2002-09-28
-     Key fingerprint = F2A1 2400 3799 B66C 7530  19E8 D8D1 82E4 A680 673F
-sig         75A67692 2002-09-28   Erik Abele <erik@codefaktor.de>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.2.1 (GNU/Linux)
-
-mQGiBD2WL90RBACfr70TIDSk7pcnS895qhkiBp1A3wunMVIshhmxNpjxxJAWnZ+5
-wS8rvtwksMmjW7LCK8UA6Jt0avsc12qyufiR+pfhMXVtJmGQc6VPHd/mQcQS6SM0
-/G7xpt7V4mRB2gIZULFlaSb2eJNFNo9faAJOv3pjnG30ON9MBHy7kJwo0wCgreok
-3H1+Jbv2X9NPSfh76QoiPQ0D/j1GsAIiZ18TFPD6UA5Xwh0f4jBNLNK50/xgJxvC
-adVAP0RPd6xgqYQLThMEQHyX79rVnlmW4HdtjvcxzqY5yQ4fTGTrEvMn2kj+UPA9
-xQfc2Lb0dHdkxguSicMpkVXKTP01avEpdIRO2zHVYKNeX75pKYQujD8Qq0QS+SsI
-4WvVBACFhAgGxxnoFzxprEmg9wkGaeiF6RlTLtTyHHqRdubdUkaa+rH2AWtSQ0h/
-acyePAvl2ScpGbt325TPfAQcW9ewCno02a80/7TfzOrktSZrM3yxVQz7cZYoZRup
-GUaN42eWUFRaOusRTBJyC1VBXeAkKJy2ZkgqVsbG0jx5kMFOPbQfRXJpayBBYmVs
-ZSA8ZXJpa0Bjb2RlZmFrdG9yLmRlPohGBBARAgAGBQI94AzpAAoJEBU/oM11pnaS
-KigAnj3zryS/aoPAoaxMhJAh8MPDtN2GAJ9R6/wC2EYBpAK2WiJzCUFfC1Ho0Ig/
-AwUQPnXZXv1viMYh0KcbEQLpLACfd1VwFJi67I9ZgGfGg+wgBny3kU4AoLszthWa
-cm3dHZl9ZzEdhNVWbEgDiJkEEwECAAYFAj5137IACgkQPo+38viDQdlNEgPkDd2a
-99kBVGY+PguJVGSIgtBYdmpu5DpmUfWaibtJUnIAxOk7AT9Ke7kaHAkp+JevV/d5
-4Hpy1pD2bYUitk4LfiprBtd5FtuT1/Qmk3d244mP1O857tVpUdOwKTN31hAr9E/u
-T1eMf7Yx0iVOuopiFAzYVFqZ0DgdIjPS0NWIRgQTEQIABgUCPnXaWwAKCRDu0eo5
-ImHQc9X5AJ0Z5IxYs2/x7XkMtOpdkOrvfkX+FwCfcjIzrpa/vOdIAXL3safBoMlu
-PgeIRgQTEQIABgUCPnXf+gAKCRCiEVrhX2uLcnA+AJ9czJ5JfRoGLaDeBwGk/Ydn
-XPeIrQCguUK5wJHnLE1TJUb1lrt/n45dCY2IPwMFED7BB1Xb0kX8s7KhLBECS3YA
-oI6mca0xDsxDc2jVfPMWBHy+M73tAJ96CL0jNtDe29PvmQiqWL+XBH1e8YhGBBMR
-AgAGBQI+jc/QAAoJEMppOXSBA6N+7QYAnj2Ci1JyfoDLYozP0+P8rcF9fUHPAKCz
-eEHJcMEBY4/Iie+inr7aD17+ibQhRXJpayBBYmVsZSA8ZXJpa2FiZWxlQGFwYWNo
-ZS5vcmc+iFcEExECABcFAj3gA1cFCwcKAwQDFQMCAxYCAQIXgAAKCRAVP6DNdaZ2
-kqTcAJ9b6SqN/SWtyDhAjwwVxhDAgpqYFQCgpOFZZ07RA3tLNBmPPsPVyOjhWC6I
-PwMFED512Wb9b4jGIdCnGxECzzQAoLVx22FhrxOpd2K5sa4/UE5t7croAJ9kHMrl
-tZt832fOmscRoAG2OHjDT4iZBBMBAgAGBQI+dd+8AAoJED6Pt/L4g0HZ/ycD5Aov
-I0RWvFNQsKh5/5vp6PRmsGPHGsptgZcYbkBh78ivkysASoyPAXyRGakeszeMoXgG
-qNb0WMInaIp/EKxiYH8xYq8FcGlX7vkRhM1zJkJsbWvsSNhR8+MgQ2D5KmVEeo/+
-OG8c0XLo6wQUa3Y5SwGCQtBFbbZwZHzRLgphiEUEExECAAYFAj512mAACgkQ7tHq
-OSJh0HOZuwCeIGKuddy18n7LrQ9onHIBN1u0iHYAmOKdJHhl9EV7d3VgTgdVtNDV
-Iu6IRgQTEQIABgUCPnXgCAAKCRCiEVrhX2uLcopTAJ9Lbh6cy8flzIn33YWb5Ao1
-S2bw+QCgp5Wxf86vhw9zy3zZa7WRN6sf3J+IPwMFED7BB2Db0kX8s7KhLBEChYsA
-nRosJaTfQroNwWkNesdYJd8kX2QzAKC13PFvlD5QiuP3cGJdpjF0uGVTC4hGBBMR
-AgAGBQI+jc/XAAoJEMppOXSBA6N+2qEAnjWL4KKHF7uiniUJ7J+8ickC/zubAJ9L
-Opt07eUYMEoLmDgcgWt8AEQaL7kCDQQ9li/uEAgAjhxXvtN1+g5/Aa40FFAJiRKh
-G6Yoa4oCA99HJEubjH6FKGfWE3j07WFpQ99jPcTdeEAEla+8I1VMLkF2kR4V+0oK
-0ilxRs2t/6V+h7KsqLtivGOCEIO8/uRLG8RUJos6LSHeda8KYEJm2K92gPX/PQC6
-mqZlToSyj4pun+mUMqM6Hbe05Updygij3ly7h1YQRLb1dUOIb/Ju9R4c3TnFQgFr
-j64c2hldJY4SPcM9rL5ffOj3TUnMLsaMdoLrML04H5wiIK11wpsx3bFeGcafoXHb
-wh21RxDK/KOVc9RUbw35H1Gahnr6ERnAOBz1SJHp30y2zDsVg27I0BCj81eANwAD
-BQf/RrdNtskNbuNSxsL/ULN94lSwowDlpcIgIRbFEfqyvCvjGDuNVz6AlHsierCW
-tIn7sD5bEKIGgJKFaNbAuIuBJ+PGhzlL7SCGWW9S9B19JbXBF/oBzvmdbs3HPm3T
-X3qAuvhVZ1b9F+mJTB6+Ub9/c/Ya1FugXzHfPyaJBpestQXSQGmgaAQd3+Y9YLHI
-tQJumfW/AWTCq5gFnTa87QpN+GsLIx3v49wtu9S+aRgEpl4Dbbf5LwCYtI51xomu
-Efdb4M2v+frqgvP7Wq9L0c5DPmqFrslVzE+i13eoPJxYv/uMdmEtdZG9JZgZSimb
-0LeNsqGJ8KZuFXrUIOCSUCIu9IhGBBgRAgAGBQI9li/uAAoJEBU/oM11pnaSshMA
-njooG5OC36mXXMf7EpADoF6hdVpOAJ9dg1mmlKY4jAKuyCAnJT4U5yjE7A==
-=Yf4N
------END PGP PUBLIC KEY BLOCK-----
-pub  1024D/2261D073 2003-01-01 Astrid Kessler (Kess) <kess@kess-net.de>
-     Key fingerprint = FA39 B617 B614 93FD 2835  03E7 EED1 EA39 2261 D073
-sig 3       2261D073 2003-04-04   Astrid Kessler (Kess) <kess@kess-net.de>
-uid                            Astrid Keáler (Kess) <kess@kess-net.de>
-sig 3       2261D073 2003-01-01   Astrid Kessler (Kess) <kess@kess-net.de>
-sig         8103A37E 2003-01-01   Andre Malo <nd@apache.org>
-sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
-sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
-sig         75A67692 2003-03-18   Erik Abele <erik@codefaktor.de>
-sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
-sig         B3B2A12C 2003-05-20   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
-uid                            Astrid Keáler (Kess) <kess@arsnoctre.de>
-sig 3       2261D073 2003-01-01   Astrid Kessler (Kess) <kess@kess-net.de>
-sig         8103A37E 2003-01-01   Andre Malo <nd@apache.org>
-sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
-sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
-sig         75A67692 2003-03-18   Erik Abele <erik@codefaktor.de>
-sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
-sig         B3B2A12C 2003-05-20   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
-uid                            Astrid Keáler (Kess) <kess@apache.org>
-sig 3       2261D073 2003-01-01   Astrid Kessler (Kess) <kess@kess-net.de>
-sig         8103A37E 2003-01-01   Andre Malo <nd@apache.org>
-sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
-sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
-sig         75A67692 2003-03-18   Erik Abele <erik@codefaktor.de>
-sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
-sig         B3B2A12C 2003-05-20   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
-uid                            Astrid Keáler (Kess) <astrid.kessler@bayercropscience.com>
-sig 3       2261D073 2003-01-01   Astrid Kessler (Kess) <kess@kess-net.de>
-sig         8103A37E 2003-01-01   Andre Malo <nd@apache.org>
-sig 3       F88341D9 2003-03-17   Lars Eilebrecht <lars@eilebrecht.org>
-sig         21D0A71B 2003-03-17   Dirk-Willem van Gulik <dirkx@tribalknowledgegroup.com>
-sig         75A67692 2003-03-18   Erik Abele <erik@codefaktor.de>
-sig 3       5F6B8B72 2003-03-17   Stefan Bodewig <bodewig@apache.org>
-sig         B3B2A12C 2003-05-20   ct magazine CERTIFICATE <pgpCA@ct.heise.de>
-sub  2048g/A676B84D 2003-01-01
-sig         2261D073 2003-01-01   Astrid Kessler (Kess) <kess@kess-net.de>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.2.1 (MingW32)
-
-mQGiBD4TcBQRBADAwVM+jE6VQUNhOHL/0L+VsWC/n5tMEbINSYUj+7KFrWqlTLgc
-nVA9vOGlScm+STor7YaE5Uhni6WK9TfmMBrLL/qPBVVH+jh3J4AYv9IzNuqmIyV6
-eLhQ90jcL59orD2EnbVf9S+Xa1+5zatxPFH97aqd+wTbhiGhNGXyyrwk1wCgkgBy
-hImcmBHd11v8e8ECbn+h8o0D/RJAfUKKfQtJjJk8+gng0adRgqYL/XT1F8PTcFir
-MIvLrXXDv8X0JZ9PZ/AomV+9S0spqT9jStRIohALb7LiiWfwdOeE96tUNe8bgqUx
-SIJRku3NXJlQgxwI1eQr3kVT+vYwqhc+Pd4mngrmcDqRDgYqBRdvVU8xqVM/dU5O
-VzPzA/4jrpenZJl5SWDPFn4Al7enlvnYOd0ptvGO/tL58MHvJiAlFlB2xewiX/S5
-GYsidApV1+U3dCUyQadOxb9ZijGC/x6ck9Td+i0BMEC508tUCmWC64JYCEnbOi8x
-OzpQMUIM6KvfuY+4HqWe6efhnDFfrFQUl4Net7gVVvaKzwzSwrQoQXN0cmlkIEtl
-w6FsZXIgKEtlc3MpIDxrZXNzQGtlc3MtbmV0LmRlPohZBBMRAgAZBAsHAwIDFQID
-AxYCAQIeAQIXgAUCPhNwFgAKCRDu0eo5ImHQc106AJ4sQFbRVLQIFoi73RTzRI3J
-yL3wrwCcCxDCMy8ry7JvHUnsdryCMC80s3CIRgQQEQIABgUCPhN6UgAKCRDKaTl0
-gQOjfkrRAJ4z+GgWkgcNOAVuJ3AxJRSPlGS/qQCfWmfU1ioB/a8SZoegKDYMfKpl
-4zmImQQTAQIABgUCPnXgiwAKCRA+j7fy+INB2S6VA+dVyKV0awmH56wznCWWNGMC
-F2qzYAV/KfTETppEofVUFO7wHy/jle352Ucdu19aA5e/H3+2hiutS+8ORO8QMv/1
-mziMskrKTbT7xc9C7PQNOIdyM/EqanD4LF4aFIFKpvxRWumaxU9h1jImfabJHZg/
-jE6jWm0Fwj2qlD2tVYg/AwUQPnXYBP1viMYh0KcbEQLugACeKn1RUCsBWc/x7eEo
-yE/RAHVaw38AoPdmhDP9iH+SvDV/5UlJG2C4Qe5oiEYEEBECAAYFAj53pNwACgkQ
-FT+gzXWmdpKRyQCeNqFBkH4iNDL/rNPwgydSXykRSmoAnA36OwlYpSflMRCQjxc0
-KeAth72xiEYEExECAAYFAj515YIACgkQohFa4V9ri3JibgCfaqVNUK/VvMEzuI96
-dH4kGhmMJx0AoMNkxWQXpFugNbFqrGRgurHS3YO7iEYEEBECAAYFAj7KI1MACgkQ
-29JF/LOyoSzx1gCferfhaazwRtniE6H9Px/JuxF4X64AnjWMiRahZyqUOyLjn9NB
-Xe/VMfmptClBc3RyaWQgS2XDoWxlciAoS2VzcykgPGtlc3NAYXJzbm9jdHJlLmRl
-PohcBBMRAgAcBQI+E3h8AhsDBAsHAwIDFQIDAxYCAQIeAQIXgAAKCRDu0eo5ImHQ
-c9UpAKCOMBmZlo9iUnkIZpmojoxWMTWx2ACcC1TkKFzgp9YmuD4VkMR5kx6KKAaI
-RgQQEQIABgUCPhN6UgAKCRDKaTl0gQOjfqs9AJ91seXqRoGQegd5Sg5b1aawf5O2
-bACcCENC93l4uzFkZHLnikMdsPLXe72ImQQTAQIABgUCPnXgjQAKCRA+j7fy+INB
-2UwHA+deIxwJw9zoaRBIovlFpvFs82DdI736enhui0dZihSRbrCaT5TocOICf2S9
-gxBqksIaVX66OgQRmZzURAlTNE/9AgVMwuKPMxQNTIfqhsYYlSI+6F0kDlZPfRaR
-fZR20FV8ZEjITSlVxrcSXtAgJjErxdpM9TO7aBwc8Aen5Yg/AwUQPnXYGv1viMYh
-0KcbEQIwaQCgniOy83lysIlHKCGOC6HjRmnXhgQAn3SkuVSh6ELutSyPw6t+9vs1
-173ciEYEEBECAAYFAj53pOAACgkQFT+gzXWmdpKQlACdH8uC2kyy138l+dAgAz8q
-ht7aP1UAnRkHNPAzmsIZpxrQfI2XrO6R+ORFiEYEExECAAYFAj515YkACgkQohFa
-4V9ri3IklACgqtZocUtEssgWVHHtXvoRHKohHLQAoLfhSrQWl0U5xUFyMwdw7ICV
-LwELiEYEEBECAAYFAj7KI4EACgkQ29JF/LOyoSz4QgCgiT4OGQjPTFCIfqfiKaFx
-whYXxwcAnj4pmD1Zb5kv9bKQvLh+2f6elgXQtCdBc3RyaWQgS2XDoWxlciAoS2Vz
-cykgPGtlc3NAYXBhY2hlLm9yZz6IXAQTEQIAHAUCPhN41gIbAwQLBwMCAxUCAwMW
-AgECHgECF4AACgkQ7tHqOSJh0HOaagCeNgrOmUUahKTedv0Fjuumt+l26kwAnR20
-ZDRi63Yi1rEzpL7eNJ9lBUMHiEYEEBECAAYFAj4TelIACgkQymk5dIEDo371lACf
-aHoV/aWNsQiCTN/E7XkisU9rdWsAnA8EwJWG59zff1/r5FC+JY6IXNeaiJkEEwEC
-AAYFAj514I0ACgkQPo+38viDQdlj9QPmOhr2tdOghp2QBupznGUik/ogva/ZvDWU
-KbGrMP0dDoX2PvIahrRruonKBbrElWkPqmKFW1MkXS+lU6gFeYDzrze2iE4AT3dQ
-Muw6iY3yUr9jVJHEwMNZKk0FXx5l9FKYEhlFgoWxfOWhM4/CkxRTcyxGpNycG/kl
-Yasn9SuIPwMFED512Ar9b4jGIdCnGxECcUQAn1bhun0zd9C2I/of4vonPwLUKkKE
-AJ0ZQ82v+t313pFt2EiO1AqjX5pRLYhFBBARAgAGBQI+d6TgAAoJEBU/oM11pnaS
-pfsAmOd4LVw+9C+Q5BAVU64nXaSRTLUAniB4Lr1H/H2EUgU7QtImvAF4dSddiEYE
-ExECAAYFAj515YgACgkQohFa4V9ri3JOuACgmo/f2GmjPHO2W+W6O+I4cGFCT0oA
-niL5Y4zh9JjaJpIcJXiS4g+HyAMNiEYEEBECAAYFAj7KI28ACgkQ29JF/LOyoSz3
-rACg+9HCA3XInNfIM8bpqF4fC8LypjEAoOwrJcD/NFoETB5Gl2KlvFnWTQdGtDtB
-c3RyaWQgS2XDoWxlciAoS2VzcykgPGFzdHJpZC5rZXNzbGVyQGJheWVyY3JvcHNj
-aWVuY2UuY29tPohcBBMRAgAcBQI+E3kIAhsDBAsHAwIDFQIDAxYCAQIeAQIXgAAK
-CRDu0eo5ImHQc1amAJ0V0IX6W57sUsgP3jaHy9sdL/BHGgCcC1aGh5+WhdCYSQNf
-DMtsRmVrbeuIRgQQEQIABgUCPhN6UgAKCRDKaTl0gQOjflloAJsGWsl/jfrxjyTk
-Fx9kHHmtkZHY4wCcDj503AAQHNAUO9qswSSHvayTry6ImQQTAQIABgUCPnXgjQAK
-CRA+j7fy+INB2cyhA+Y+5CHNOHYOpw/gcYUIfc1OeX4IKWgZJImlySe8Pydzx5oJ
-275HAdcRvJEehXIaeCCPNHve20gGZWrBQowpMrO3AZXaHm3LKgW2jVwWNNgbo0jy
-7kvnijeujQlZC/wNRbetIoBdQIrPraywZgNYeaEAmSaW4TigavZTg1nr9Ig/AwUQ
-PnXYIv1viMYh0KcbEQIL8QCgq989k6yY2OkOIDF8QUxsG6bVegoAoKDNrIPhwPD6
-gj4rwK1TtFpE/s9AiEYEEBECAAYFAj53pOAACgkQFT+gzXWmdpKXEQCfbcQs7zcD
-Qb1OEwR7FwpSn7CxLn0AnjuK8206aC6qwVliEoIgmakZoVumiEYEExECAAYFAj51
-5YkACgkQohFa4V9ri3JouQCg4Y6nfjgAmkSA8STWFvCx+EMO3kwAoIMylSE2Kr5p
-VKnVqHSihrmFa9N5iEYEEBECAAYFAj7KI44ACgkQ29JF/LOyoSxk6ACgltr57L02
-sWUhaPWojTRQTG+FgsUAoIRw+CjYOaoHJgbjJhLhH7GefSHBtChBc3RyaWQgS2Vz
-c2xlciAoS2VzcykgPGtlc3NAa2Vzcy1uZXQuZGU+iF8EExECAB8CGwMECwcDAgMV
-AgMDFgIBAh4BAheAAhkBBQI+jgk/AAoJEO7R6jkiYdBzkEYAmwauRVlLQWfQQWYL
-2oETUR5r2LWMAJ4li2XuW3+Q9ieAcYVgLW5JVrIDkbkCDQQ+E3BzEAgAoNcpH15I
-EiWXX5dHI2H94Qnrff0Xl4j1Wdh+P/JJNDA8FrOWCMcGSR+RCDPYiZ+R1bNskmiU
-2fBnb/KrdVPVtGYc+Fm/51PeA7oxV/hyI7JudyouEm5JW4x9JzNcDXjnVWxt5Ovd
-dJX5CDU6NmELPycKArRAxuS970htnGXf9MzhBsqjCWyiq226r1d7irnXXqL7+nC0
-DPOcyV1FNoralULY3qpf7k6oxadjJ24x4Eo3GbZrse7IJzdO6ojfros9Mo0VVnnC
-0lRh4BHpOGNav8DENySNcWKUqCFSG6Pp8fvz5Py5pHP81sLDewaBp3wMrtKWt613
-N15Kuoy8FbeTdwADBQgAnNdV0mjGHWoOe+D4s61mm8OsawGSk5VvmxgClcO1uYO2
-hlCpRgpSSVwoy7Gk1BAH8iPRR0/zTk6tR/Yqgc57BIDSD/FSfDOEMj0FkOt07DEq
-dAqyqF1QQlmznMV8qWXCaVXZf4e3a1zTS233RU6ue7uF5iAvqSN1AOoh3dEk8WVl
-Na+Pdtao346XOK+bVDruJt9yRtW4AlR95Oy+FqPSSF0DzaH5MDFPCBJjZFuWAtOT
-pyKV7bqrREbzDiNNWHY9D24wk4jTvXakNPNWU2LSIt2MFvX7JUZHr39AOIuzOq7Y
-Hg6fISaeVG9bFLioCzvLHHwO98U3dkvXZWBMDRv1F4hGBBgRAgAGBQI+E3BzAAoJ
-EO7R6jkiYdBzo9MAniGRGjIDno4FmOE32kgt2U5LEvIrAJ46RiKuEJ7Yf6tf9CPQ
-d6rncSGIlA==
-=SNQD
------END PGP PUBLIC KEY BLOCK-----
-
-pub   1024D/208F5064 2003-06-13
-      Key fingerprint = 984F B335 0C1D 5C7A 3282  255B B31B 213D 208F 5064
-uid                  Joe Schaefer <joe@sunstarsys.com>
-sig 3        208F5064 2003-06-13  Joe Schaefer <joe@sunstarsys.com>
-uid                  Joe Schaefer <joes@apache.org>
-sig 3        208F5064 2003-06-13  Joe Schaefer <joe@sunstarsys.com>
-sub   1024g/ED4260B6 2003-06-13
-sig          208F5064 2003-06-13  Joe Schaefer <joe@sunstarsys.com>
-sub   1024D/F8B0462F 2003-06-13 [expires: 2007-07-19]
-sig          208F5064 2005-07-19  Joe Schaefer <joe@sunstarsys.com>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.1 (GNU/Linux)
-
-mQGiBD7qX7gRBACxF9D8+GYaiLC/c7eyNwuxQJtbkm6myjuhUoZsG6o0Z4SPNqP7
-dlQn3uYIQeRrT3pZjXCpcxYAq10c2QpDNR/Ip3w20FXF/QDGZZ/B+DRAY0Te7jv5
-Jri2qRcJXOaoUuLV+BhG0w05dzcNrgONMJKMR+TXjod4M8HQdXDb9PDXkwCgjPAt
-zuoroLjvjz6GeWYiYmwWhzUEAKM3cqxbWUdsjho6RD29KBAAcc30W/qPzVZ/+ofJ
-SoIgnf/ZnF3ZszVQM8qZYzvE7bgMrZJPDcb6SNGM4sX3D3yBAL+KldKlC2pZriL+
-Uv68e4zVpf+7mMEtk0GoQLoG4QQ7XgHA6O+mIoL+zu0I+VwReEjrdOlRBjXrMfr+
-L+GEA/4q0Zk8TP8iIh+su09UHlIU2c8LloRGmxiPXw6GJHgLbY6Aa/DotLBHFLNJ
-LGD0zHhKqUl2n20FSB0fLikNppETF+gpp+6jzbfMGd8HAcfOgyh2VB8ShNuz68PT
-mZEQuUAPOS3iyo7BUnpFiPnv3NqVqPq9LyR6batV3StDVeyhC7QhSm9lIFNjaGFl
-ZmVyIDxqb2VAc3Vuc3RhcnN5cy5jb20+iFwEExECABwECwcDAgMVAgMDFgIBAh4B
-AheAAhkBBQI+6l+5AAoJELMbIT0gj1BkUf4Aniwfn4mUmtfAw3S4HRg1mbKjk20O
-AJ9HkxMkzG70xfROQXVClz5FAUp3RLQeSm9lIFNjaGFlZmVyIDxqb2VzQGFwYWNo
-ZS5vcmc+iFwEExECABwFAj7qYDMCGwMECwcDAgMVAgMDFgIBAh4BAheAAAoJELMb
-IT0gj1BkSUgAn22n8mLipL2NJM6jrD0alAeoDwiAAJ44564cvmM02Y0d705OFHgr
-eftiwLkBDQQ+6l/DEAQAkXQA7401V378j6PeasecoTwIxp4fQen+AICPeoYeuZKK
-qZeRh9Y0U8uAfNVdqNPSt+lgzQnoEpLdUSf5TWUPukter9mxxf8jATQ1W2Urrt+W
-xHw6cjJs1qdHXVJ8eWl4lJZon/JhcP6UnmKFCSse2SM/moywzMNKb4Ti6tHrsIMA
-AwYD/R6O4woc04s5fZn2XJjbZIcbLWemNpCMaRQa4ikHSwmh7HFZHwcU90W628Ms
-mK5nK7W9bZwydwfO82fPX95/RWVZitT22pLdKVxwjxxlE37cHcA8PMCMzLZ6BEly
-Hx8+3NNrtOT45C/gDlcutrdUBX6teLQECUe1o/a+7eh1qoIUiEYEGBECAAYFAj7q
-X8MACgkQsxshPSCPUGRaBQCgiVKCXgOCVhyy4TzQDrKio4aaG80AnjjgOcR1sjdE
-tCiRm4U1mjhlfYkGuQGiBD7qYc8RBADDggTr2/IrPdiP0L7iVRu1xXf/5+UU1/Bp
-ff8Em1afNH13ptnBrhI5ifMUFGwJoANUtfGEXCAynB6pCamEq3pAscNdNGst0/ul
-y4kLp1NJXdjvgw1wozRjnkJmIVTLa8Yg+aoYPC+tj5+74zmO5QvY9ZHXvdtYnrAM
-tViV0gouAwCgnhjt06CpXVYOJURDvlw7nvDkssUD/0idmaMKUCp2KzNL4v3uUN8L
-KF8pdUAOF0zPUl0w30KrWw9bO3sGmFfB7BQ9RYqzifcg1Ks/m1qVG56q3gf2ux60
-Uz7nB9VX1Q0GXj3vpq2jz5QEEu/PJ5ZWN21ZoD6PhHTtYAwEukq5XeNxjPa4Hf/9
-16TqlebaFcc9U6ObObw/A/4go6icBzpStu6wZzS/A7RzBfaRhn5wUjaVRkI4NyMJ
-TWBrCkVTwtnNxGawMZyxdwwCHido2SuGgp3vze/Nw0PX0V/QdJPvOA230dNstAeo
-KfMTki2MmCnFOZGSvznjb5XIOeVoUWYW5KeZd1JvFZbxbAdyqfKZV4M1LPZG/aI/
-U4hMBBgRAgAMBQJC3OzXBQkHtPIIAAoJELMbIT0gj1Bkma8AnjfgRtuon/0wgMZn
-GA2FZPS3vn7uAJ4xC/LsaX+zc3ON5nLs7sNBpV07tw==
-=8SJS
------END PGP PUBLIC KEY BLOCK-----
-
-Type Bits/KeyID    Date       User ID
-pub  1024/0300A2E9 1997/10/12 Jeff Trawick <trawick@ibm.net>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: 2.6.2
-
-mQCNAzRAzqIAAAEEAMJUorgTyMEZPP+vXvmW/W+kdoCqAx7PFNpepvxTsTc5CQLt
-Up9PvWrCGT/lAWO6qQkOsyNju/g5c/+cbJv3G0h4bOZPBEbRH3pkmAOAFUVUdmIu
-FM+piYLdoAeEcE5+bmvWpzddkuiRRNIsMjmNjuNkqgOtYEZnGaCc8zADAKLpAAUR
-tB5KZWZmIFRyYXdpY2sgPHRyYXdpY2tAaWJtLm5ldD4=
-=E80M
------END PGP PUBLIC KEY BLOCK-----
-pub  1024D/A879FCF5 2001-11-06 Gregory Trubetskoy (Grisha) <grisha@ispol.com>
-     Key fingerprint = F8C2 405F 8893 395E 4DA8  68BA A01D BC9E A879 FCF5
-sig 3       A879FCF5 2001-11-06   Gregory Trubetskoy (Grisha) <grisha@ispol.com>
-sub  2048g/0596F229 2001-11-06 [expires: 2006-11-05]
-sig         A879FCF5 2001-11-06   Gregory Trubetskoy (Grisha) <grisha@ispol.com>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.2.2 (FreeBSD)
-
-mQGiBDvoUEkRBAC2ZKj/jb6WQEPH3pU3dfC654tnYU80UlbBo6HUUgj9CB6QtECr
-GsV771OqbBm4YAxpIo1QCpCSqnQyE38TEayuEs+BVWgh3WvZb3mNHz/5NFc2kEpt
-i9YxGUkQ9/2sSEvGSVbEYitbghjLAFzQxuPfxUhxW8GnDBSOdLhF7Qy7PwCgiJwq
-406ZJz5UGvzuFgpMZsyRm6sD/AyAM3eeTMARQbYa2cKBFDwgy6wLZl+llDGYmT9G
-D+N1uyyLtiqNwR2ANBJC7gJVfNtVFIMLnQ3ms/nVFzTugQKyunlg2Koq+3ORDw2w
-Hc/IJZiDlW+oyYeKZNpze7FKFalC2BzKA2QJDG7sHOHuqN6GA3FpFpw+LnxPTjgX
-OOPaBAC16on5pd6AXuC1BoJ/TAJgXlirlRysJQbcRVMBgb3sUouXcg2NvHGheVzd
-BEwRRZWH5oSxQW+C/dcJJIzF5je49TgBUzKuKSIdZ7x7fM9mm83lVa9mFVE3DLZ9
-sL7f4QRcefAUdCvwl/9bQq5fx3ZiT2v12FNPkZKfoDpFvKbPrrQuR3JlZ29yeSBU
-cnViZXRza295IChHcmlzaGEpIDxncmlzaGFAaXNwb2wuY29tPohdBBMRAgAdBQI7
-6FBJBQkJZgGABQsHCgMEAxUDAgMWAgECF4AACgkQoB28nqh5/PVGIwCfXKn6dGHw
-ypchTj31SPs0mG8mmdMAnjmIG097j3WbwlA0cnLkd9cuyYq0uQINBDvoUG4QCADO
-YvhOJQ5hYohZJrSrsMZMe49HBdiPnguxa6tVBbXwnJwPgk6ceYliKMhXe76r1cQz
-pgqyVSXVqeM+dxlIb8+Oxjm78OcGXlGhRoN/0MdU5yvj05UnPhKX9PE0nfTHhP7P
-ROEs1EBfSkKjBFri+pvPw6QS/3wAundM0sO3OcZgrZJhbpaKCwocI+QnVaXjOzPk
-vhguMT1jboQH3H4qKHgu13neQ0T6g+29UkN6cr3lj8izTb78htybgKY+btRuF9IT
-19yCa598prBka8F3weCTgrYm0D7gNA5Mh93TMvmuQT1xwL7KWrTpDF39mUJjdrs9
-LufCe6dVlCw/fs6Ler+LAAMGB/4ktRdYZB7IGXKzAm3Ga1mhM0uUsMEFnE04npKj
-hA9VL2LbyGspHf+LH11SdN1SO3fOBN/6t82zI6/52oX5k5on/Ssa1Gjh86camewk
-0DWHmnDSySsRU67ClBlRl0ZFTqVYld8NxzXihXN7OzJSIJQ2clz68iegVOg1zbWD
-DhB/Hlysx72UOXLHi/KaXHMlW5A6lAmY61Qf9C0TR9Hcc5BJGimwF+hPNw0kIGw3
-oPYo6VGeFdm6P0LDVElw/gbQxjKW+qy3GYsINGZz2lYlz4H4DJkpW9gGFsM7l10M
-/baQqcg9BpBrOE7QTzfFK3GLzrNV+zf8dseRLvLnZ92HYqoKiEwEGBECAAwFAjvo
-UG4FCQlmAYAACgkQoB28nqh5/PVs8wCcCsMhi1SacFM1kpsM+JPdT/KN0qwAnA48
-NdqzrIzzrrlvI8FkkZZzKggV
-=kwZz
------END PGP PUBLIC KEY BLOCK-----
-
-
-
-
-pub  1024D/E76CF6D0 2001-04-09 Stas Bekman <stas@stason.org>
-sub  2048g/01611FBE 2001-04-09
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.0.4 (FreeBSD)
-Comment: For info see http://www.gnupg.org
-
-mQGiBDrSKd8RBADpBhHzpCEB/tWZTNZ0B4oMSMsWBnukkYADPy7ydBUOZHw17ddL
-oKj8IOveqkX9Fdl7e32At1cd25kitU2nNXeQWt27C47LfDVR0iPfnVg+YE4jfDDb
-rnDAcMKROqjvTTwAuGw8S+m+yqmS2xXsKIBN8A7druhT8R3xg1uBBsueHQCg/ytA
-mFM+SjmUXumdid73ZmyK8Y0EANA2uWUEUVQ7PFipydmy2AWY/ZwYrrh79wLy6hch
-zF294PU8Ubx/lqENzZBLNfMTeA9l8mbc1jF+up1IBpG/0DRGiCDtWLBDjTGorIFo
-ow2zkUKK603x+qpdXV0ghxBkb8KalUQrFAh4fr4gSdnvLhLP70C6hS6g3MbJYNHf
-v78kA/9u9y05+tZyNTzeeEcFWXTJX4t2GT4G3J+85fjpxiO21bjNg/I3kUxEyIDc
-sjsr0G0yfbSIdAKK88BC/YlRR9WfYKwd8vvH9VUyroYgo8ufFYvhhBZZwP+FWw60
-mvY5EWLPk5g7rwT8Fqrg5y8rVSXTsZs/baesQPqkhFLXT+g5TrQdU3RhcyBCZWtt
-YW4gPHN0YXNAc3Rhc29uLm9yZz6ISwQQEQIACwUCOtIp3wQLAwECAAoJEMyy60bn
-bPbQnXQAnj8fmeXLyodcHPASyt376IUzsar4AKC98XkNtS8gl4AfCCfOUkGNrh59
-B4icBBABAQAGBQI60Z9MAAoJEFMHR+Yj6eq1eLsD/inQzkDNOsCDEbOF9calmv/C
-QkRZps0kLKEnxk9bS3SnwYZN3PbtZDNh4ImrrZ/xqBdkOds95jZm5Mo4mJUTzpX0
-gK2gEhajjeWUdQ4k0QZ7pb722DQ69PMJReNZQQkcV+rY3SaRLugeDUIzpexvcO1w
-i4lKffrvJNVN0I/Yim4UiEYEEBECAAYFAjtSGwoACgkQVZHiwGZkwHhcpgCeNoZu
-zqc9rVB62+Igb4pu6l65Bu8AniM2tGWqq6tFGLqvYtA7DC0mlFfhiEYEEBECAAYF
-AjtXsjcACgkQyzKhB4jDpaXnwwCfSUCu5OKxMNtHZWQwv2HMt/DlgFYAnjoAbCqy
-96V/aY/0rHMhPWlhd4SJuQINBDrSKd8QCAD2Qle3CH8IF3KiutapQvMF6PlTETlP
-tvFuuUs4INoBp1ajFOmPQFXz0AfGy0OplK33TGSGSfgMg71l6RfUodNQ+PVZX9x2
-Uk89PY3bzpnhV5JZzf24rnRPxfx2vIPFRzBhznzJZv8V+bv9kV7HAarTW56NoKVy
-OtQa8L9GAFgr5fSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY7288kjwEPw
-pVsYjY67VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy1obEAxnI
-Byl6ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XpMgs7AAICB/47
-TeZ/O+z41M9MMI2/4aKBqbfIWNzcWl+71KZwPymTQO5F+WR9fSlS+qTNz+h3gi+l
-bAEQ4dI2d+tUZX6q5cszNn/60ffxUbEqa3uBIkOaE+ZuoFSM4I/3IWlZqH7q2x3N
-Q/oQgthLOU7c8HnCv3hHL4a1nsvVZze7zT4Rasb07+kGydlYpkoVhFEp012s0PJT
-vDHG062vs0sx9HmknX6Nu1y91UQCFE7GVfkixk991s/7qHbKNW3u7FC1F0WrwMDa
-Sgp27uJmn8E+tFrb8mpLqvJko2852EL9xKWGDDUqI/sRtZtuxdTcqsLBRyGJqxFy
-0yA+GHeueqiS5YeEX1Z1iD8DBRg60infzLLrRuds9tARAvtZAJ9YzzyCiEYU/s9p
-NVbVevC9/OkwYQCg5fViSXktQM035ki0W14ocNEpXdI=
-=oamg
------END PGP PUBLIC KEY BLOCK-----
-
-
-
-pub  1024D/42721F00 2004-01-17 Paul Querna <chip@force-elite.com>
-     Key fingerprint = 39F6 691A 0ECF 0C50 E8BB  849C F788 75F6 4272 1F00
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.2.4 (Darwin)
-
-mQGiBEAJtaERBACrYSun+13XY5xobkfAojSZXeYiLCGrqpRQJiRbSQCQEFIhCqTp
-5Q3q5wcHFqx9da3EpF9Dl9yw7BP/R1nvWw68/eGKMusjyvjF9vVKFFCnaB0YwWuh
-tViq/+OVnVrkPKNtpkBcg4Rl14tEKqOVRAMX+GaPLZTb0J4/rSfqWMitVwCg0ZfQ
-pHJRuYqQDMUlWlg5kdMAxl0EAIGHa1q5fx81qd4jOd39C9ujkSak0GTlTWQptvMM
-LrUbbC0YCYKydKK00QG5sW/oSZd0emdn/0ITaM3v7Pe/JqinaUitIBeyIrLIYKFC
-TIArG7mqCJWHmGXhG0wkI53T/yE0ErkgDMN4U3jTD2ZcbV+UXqygHAtR3qM+uIsJ
-H/hYA/wMj3cOKwMBWfac3i/mrnJVdOXMaXzLrB6EjISWRhQrrlKVBsgqkPEdKwYb
-S1hieaoeZ0UIt2T72Un/KUZinBYYGZAzXSFQNNqiyvy1v5WeVMjaEHOHHWLbqzX5
-3ycf4o9B802MIBS6F0UGpCAEnakZzT+2GG0B/z8RTF6eHpRBv7QbUGF1bCBRdWVy
-bmEgPGNoaXBAY3lhbi5jb20+iF4EExECAB4FAkDwYsgCGwMGCwkIBwMCAxUCAwMW
-AgECHgECF4AACgkQ94h19kJyHwA1pwCfYThV8T/7hCKtGOBUgVABymqtER8An1Dq
-UrHIVDhb8JkD/pXxjf1g5pVWiEYEEhECAAYFAkGjAIEACgkQB2FzsZKExFLdCwCf
-bxMTetsoC3REjFbIGddDZQOICUkAoIY9m2AOUZmx21CniAK4ihNq1As8iEYEEhEC
-AAYFAkG6O+IACgkQAQVmvOQTY5JrygCgiW8vzmmKQ3lbIRUpHyQ1D9vubdYAniuO
-5P3M5v2glVmplF2kma3lu9SriEYEExECAAYFAkGaiAcACgkQMJF5cimLx9ADZwCf
-WWqyc5FAe+exeZeuOzL+F2Zj4bMAoLVY32mEOzifj3gRU84v7Wm2HxAMiEYEExEC
-AAYFAkGaug8ACgkQW5aAEOBPmomgLwCghP2fgryoG0IqPtp9NHWIuecwhqYAn1M+
-VmigV5yC/PXqZXhxCUX8YTZUiEYEExECAAYFAkGiWNwACgkQBJfVkRK/55qYPACf
-SReNPV+c0HhjCPgRT9/oZLw/E0UAn3uz9WHSWqxBrmvpoAXUFlBGqYZeiEYEExEC
-AAYFAkGjS4kACgkQ3bpkuiwxLS+jzwCfeziDXPZWK2KIhNEYW9XnBxfRzPsAoNXw
-LWYxPgO35kBQ8KTvoJbta0HTiEYEExECAAYFAkGjS5IACgkQUI6uxTAtpWj2PgCf
-buJ0M+q0RjVJFZ9FsttqXzCYr8EAn0/J280RJzAAvGARJkRztdZmkC+XiEYEExEC
-AAYFAkGkL9MACgkQF2rZyNGqiWKJtgCgkf0628uDGiANtRsnVqTC2T0ZXbkAoIVp
-cBe1RZIrVZ3I/d1ZM07u8Rm1iEYEExECAAYFAkGrePsACgkQzgGkfhxD2FBqPgCg
-mtjV6A54A0n+cWj5QNXhNoUKLGwAn3FXjBUNPsEDliW9cWBYS6ceRF1FiJwEEwEB
-AAYFAkGjTT0ACgkQms08wKmfdd2zFgQAwloFiGEZ4n+WrOMzzT9eued90SSVW42c
-6JyJA+nChSaGtT50XBxXDHxWtr3rtleQn/MqnFpFdi+LMCREJzc3Og3V86M+ndj/
-6xftMyig0VW0lC8FvDu9WSso4ny3MZt2vUmOqUBH7ConCFIhjEdjS4dCuq1+RhmH
-o+R7TDImU9eInAQTAQIABgUCQZmBbgAKCRAxpj2W7BQLgafeBACXLa0nkaexTqjG
-EhG/kksIC3TXR6IiH4i+VcTzuMEuv+T7uDrdhZjc7jroeLWWl5XyLCASyhI6LP/3
-lrK+UdO3AnNA+PDuzVYqaC4dDMj9kdDbEzKYcrVPbKymuTVzR4l+XSgWz5kOyoDW
-Nsqk6VxuK+/KdnuXdZ8K938HVBuIZYhGBBIRAgAGBQJB4sieAAoJEEzETQAR34fp
-yXIAnj1YBCHiGmdN6GjkM4oTyvVRWhluAJ9yWdPGw5wrlsRtAl9WHVqnZ3iPMIhG
-BBMRAgAGBQJBzqlGAAoJEME58VMjy3oqkFIAnRXkYqT6dfMckUaBZNCi+V9zi4kr
-AJ9qKT38Kfs36TFRt/WxmFZLysz7D7QiUGF1bCBRdWVybmEgPGNoaXBAZm9yY2Ut
-ZWxpdGUuY29tPohgBBMRAgAhAhsDBgsJCAcDAgMVAgMDFgIBAh4BAheABQJA8Gcf
-AhkBAAoJEPeIdfZCch8Au7UAlRmVWI3GpMbVSxFf1w/jj5I3S6MAnRfzZ8URA5C6
-pzb5X+WecPVrON+TiEYEEBECAAYFAkGeEXoACgkQJ0aiJIc88a3YbACgmixFO0rw
-BdROgUtYIUlYBLxucQUAoOb2Ki8PKEQlMl+gpaP4qwy+3E5kiEYEEhECAAYFAkGj
-AIEACgkQB2FzsZKExFI/XQCfViYZu5AcqGa3aZynBgUAd9A8ekUAn2skGwDzd3Jl
-y14qCWF+qCNyyej/iEYEEhECAAYFAkG6O+EACgkQAQVmvOQTY5KaCwCfUwLt98Pq
-aVgks/658RVhhlUNqLoAn2RyNQ9njp0HEc0cjeowpU5s4BumiEYEExECAAYFAkGa
-iAYACgkQMJF5cimLx9AjeQCfSWiedjEzebbt7il5PXHgvJx40pwAn1bbP6iVk7yv
-3nM3xKTtD1mHWzr+iEYEExECAAYFAkGaugsACgkQW5aAEOBPmomvzACfY2Jx3c5a
-GKEdKJBazjboun4g97cAn3RbDFtb8MDJe5bQVQ3X/vysdAQ8iEYEExECAAYFAkGi
-WNkACgkQBJfVkRK/55qh1gCfYVBinwZQBDLLWdOhFf9wYWcqEU0An0k9HWExIUFF
-3uItQ+K9Z7C3NGuqiEYEExECAAYFAkGjS48ACgkQ3bpkuiwxLS9JqACgrZy8c176
-z1zxMnKVgiLZ1xjjaI4AoLeLarplmadavnMPcGhF+TXH4Q2GiEYEExECAAYFAkGj
-S5gACgkQUI6uxTAtpWhjFQCeMEJH780DFHpbXWSyOvs29cYuPFgAoLmUNcUQbx0c
-iinkYFD8VdeReHodiEYEExECAAYFAkGkL9IACgkQF2rZyNGqiWJ1UQCgs3YJAx0P
-6pinCMhzunuIJTVBbRsAoLfF0lN2LW6Cy6mHBMIG0YB9Y0zSiEYEExECAAYFAkGr
-ePUACgkQzgGkfhxD2FBueACfdLtQ1wegmW1s934n4tDQH0dfpnAAoJbdfKwLrDNC
-agh6BwGF+Kd5hJKDiEYEExECAAYFAkG+MhkACgkQ6DAYSBao06uOFQCeNpMgvhNE
-MqsT3UWkDBjau2vTYcgAnRp3f65Wls0+Af794qZa9TtJFnqliF4EExECAB4FAkAJ
-taECGwMGCwkIBwMCAxUCAwMWAgECHgECF4AACgkQ94h19kJyHwD4kQCeO13BXjGC
-MLvj7PxuXmav149yFccAoMb8DRP1u4pTz2aE38nKCHtO4kwGiJwEEwEBAAYFAkGj
-TUIACgkQms08wKmfdd2aBgP7Bs3M4QnfAXFNf3pnWEIPhlS9JVsShwZEBe7U3saH
-6vLdGUTOqxU7fT7nohhGV+XDCAHpWLBI/odavlQguZiTYQf/RHaSxdtoXUuwSpvt
-NlFgYdp6ex/B2llg5Qof18LMHy1R5A9lm7M2Av+DDhi1ErYV59S59SryCU0PeREN
-KoKInAQTAQIABgUCQZmBbAAKCRAxpj2W7BQLgS6bA/9Ds417wgIpgS6frkCtyKAu
-otIL7JQ1Lqsbv4+CZeqi52ERxzGqryxBWx9YY58bwv+px9dOOnm33zesf4hx/IVr
-nD82bnrmdA1qWqXPPfLAwYdKh98gWPnYkhH9RCrYnudCTFjNezS5+xRENQyYX1qT
-UlAE+x2nffKxnLJ2845gTYhGBBIRAgAGBQJB4sihAAoJEEzETQAR34fp/cYAniEX
-EYhEkx0osaS407/sVzK1CAd/AJwJW0ZL0nAyjjsqpgOM0ba3IpKxg4hGBBMRAgAG
-BQJBzqlKAAoJEME58VMjy3oqDZkAn0Dulg3UtHdiI5EaABr9C5rN9lsnAJwIkeGz
-T+S6kfIkuSH9/Nafyd6r97QgUGF1bCBRdWVybmEgPHBxdWVybmFAYXBhY2hlLm9y
-Zz6IXgQTEQIAHgUCQPBidAIbAwYLCQgHAwIDFQIDAxYCAQIeAQIXgAAKCRD3iHX2
-QnIfAFiFAKCVt9mEsKqCe4o1K1HmOAT4OmdiOgCgnCr58C1CTeBYMjzgiLteqSl4
-Bx+IRgQSEQIABgUCQaMAgQAKCRAHYXOxkoTEUit6AJ9sVkHFsNXow160c1h70DYF
-nMduxQCcDdNa8lNoauvnKBq6Jv7B9JBaKEWIRgQSEQIABgUCQbo74gAKCRABBWa8
-5BNjkiZQAJ45YgPe6LiBIyGPI3LFsLPPaHp62QCfc6UHkdWCgsvHg8GhjSD5wwHX
-UHuIRgQTEQIABgUCQZqIBwAKCRAwkXlyKYvH0NHwAJ946lD+sO4+bWSWVG7fGtgN
-f3B32wCfRTezxng6aLluB/QWspObQEpvfXiIRgQTEQIABgUCQZq6DwAKCRBbloAQ
-4E+aiVMeAJ9o25E+6sOTxI4KxYfPLfHgip/QEwCeMTzPbYVlryWT2px1syjvjXkd
-tEWIRgQTEQIABgUCQaJY3AAKCRAEl9WREr/nmrG8AKDGq14Su7iLDYm5Z7/4LJSU
-8/MF1gCePdaPGg0vmnWonKZJApyEEuwvDJOIRgQTEQIABgUCQaNLjwAKCRDdumS6
-LDEtLzrTAJ9aq2KOnzSclCF1BBuF9tE6Ykwi7wCfWOrw/mBKr0tolIcQ5esUinIB
-RkSIRgQTEQIABgUCQaNLmAAKCRBQjq7FMC2laG3NAKCkzGOfXP+ONhWD0oAvIhjN
-AccyVwCeKlQjucbMdl7uEkWrf1Gya8pThu6IRgQTEQIABgUCQaQv0wAKCRAXatnI
-0aqJYpemAJ9GdLeZi96/h6Jg68z2ZDeSc53g3wCeJo7A6QuCXXM/rcmfJqCEbB5A
-0G2IRgQTEQIABgUCQat4+wAKCRDOAaR+HEPYUPLQAKDAMgt9qlL55JIRygMXhdiw
-kJD0TQCfQlGUyCYz4I3IYVbgpWtf4uq4KDyInAQTAQEABgUCQaNNQgAKCRCazTzA
-qZ913fUWA/49r5W+Y5V4RRWGWgaXd8JLAQ2yu88qZsIam35F997tRS1uqZOoEWds
-6r6F9XVXwOUt2xsZSe34+jRfKWAXZdcmTyMIMTInhCcmukPCzEcRRLd3PBgIBPDM
-vMgGGLKjDjjh5QZ/IpYdiVKaiY1IN92OLm6sKXh3SeXAjWlt1fK1d4icBBMBAgAG
-BQJBmYFuAAoJEDGmPZbsFAuBxiQD/R9audVADYECPnTSp+YZJeB+LSDh84FGrWRm
-61yKp2qGIorhhzf1zZ77QMS45Zy3hEct4Bx6/YSpieL2PPzMKhag+6LNY2W46QYN
-k+d9v+ru3MMSHYoNfIqo70GOV6zad4fUMYywtYhDEalyMyPB3pP8jrmHt8m5ahws
-sfJKn3fQiEYEEhECAAYFAkHiyKIACgkQTMRNABHfh+k6TQCeJk1afbGzsIN/doC0
-0HvYiHCmk7oAnRd4SefB12lqKxB7+rOETvWu5pqRiEYEExECAAYFAkHOqUoACgkQ
-wTnxUyPLeirbGQCbBQL/YdNEhAR+QojUCsGLg46B89QAmQF109O9TS5Eqrn9+C5f
-3bck6qbEtCBQYXVsIFF1ZXJuYSA8Y2hpcEBjb3JlbGFuZHMuY29tPoheBBMRAgAe
-BQJA8GKZAhsDBgsJCAcDAgMVAgMDFgIBAh4BAheAAAoJEPeIdfZCch8Ak0UAnjpl
-plE4Mw3PM3j9nSHOoXrzzglPAJ42khRlgk6TMfnUTU41h1FXA51bCohGBBIRAgAG
-BQJBowCBAAoJEAdhc7GShMRSXd4Anivb6tq25jFqiaoFJmqkNoi3/vdCAJ40ZK68
-cP0Q6ib2yiOWdjlmftGXXYhGBBIRAgAGBQJBujviAAoJEAEFZrzkE2OSFoAAn3Wb
-daZJ0raIS5NIOQcrca8sELZdAJ9y3+9st6AXjDXSRsghu59Zg3zfQYhGBBMRAgAG
-BQJBmogHAAoJEDCReXIpi8fQl3IAn24VtuU4CYAkDfSJhPRPbdwXC9oYAJ9KSvz3
-7QG2mZnimcoopCQy2g1z9YhGBBMRAgAGBQJBmroPAAoJEFuWgBDgT5qJhogAnRL0
-IF9/2Exe712BeoVWPK5eBSi2AJoDzWCbp7wr1nALbPllkqApkll2S4hGBBMRAgAG
-BQJBoljcAAoJEASX1ZESv+eashwAoIwuyzeeGal/ZWkKIxBbordqIl6bAKCj4iFg
-Kya4SFt/bd5ZKBzWWv16AohGBBMRAgAGBQJBo0uPAAoJEN26ZLosMS0vJroAnjeL
-RzjPkxFDmABQPshdkftFzAoXAKD7qaB4eHmYqZyDZ4n4dLpukmer44hGBBMRAgAG
-BQJBo0uYAAoJEFCOrsUwLaVoLuIAn2deIMzEBk9KTdIITM5cBUiPccGBAJ9PguKy
-15iLmZE1EduTLoY750KnTYhGBBMRAgAGBQJBpC/TAAoJEBdq2cjRqoliyFIAn0Ar
-xe90GYJrXOPsan0RbBWfrIzYAKCku4aJi4Fy9OweqRet0wzeyYzEE4hGBBMRAgAG
-BQJBq3j7AAoJEM4BpH4cQ9hQD4wAoLgEBvKXRJbdgpHKAynebPFc7+xTAKDCie3Y
-g9nTInyAkBR+woMlo8IP4oicBBMBAQAGBQJBo01CAAoJEJrNPMCpn3XdiXwD/1O4
-ya08P1YxIYn7owU2DFVj65++T97WO+yOvkZnPuT88anrx2lci915sXAQYZh1o4Qx
-HIsterJrJB31p3iokJzQxMt6K6HMzITDdNh4mvGoNAaSNurqhIeqmk2UpuLuDe1f
-gART4fCmgMxglgIlMBI6UyhP0RhzHx+qePRHxf4hiJwEEwECAAYFAkGZgW4ACgkQ
-MaY9luwUC4HNuQP/cQUltjk6iJq10+NLv97/vw7+eij/z8kBwfe7przIchSoApFa
-ADyVDuIMmZcSU/PbwlPRebESQrQ84q6jHqpG3ZMhvIT0EEOWmS+8Ga1FhwqXjNrY
-AsNlAFa/tfUPAPTj2M7kTt3Dq4UD2xXywY9Rja3Q+khSttGqQGEq+qB6a4eIRgQS
-EQIABgUCQeLIogAKCRBMxE0AEd+H6ZS7AJ94jbsCZKDncSb/JktR+O3R6XjmLQCf
-W8zLP/1780h7U+SeGZRx1K2uNDqIRgQTEQIABgUCQc6pSgAKCRDBOfFTI8t6KlUH
-AJwOQx8xEJeGwce+D3DtawU+uf/JdQCeIIL5AT7+oEK1IzZDN7klXB/4zii5Ag0E
-QAm1shAIALfqB4jeQyzKfybVkA8PksS9yD4hmjaYIo6XaQ6GAJsgYOVcWINPzcHt
-2rjQNxScSjkNApTxttpgRRVP2s8RCR9Vkn8S2t76SKm85mgmuTT3iVNjyIbtQEqQ
-cpN7LDJAq2LbGIDt1fdvmhkI2gNNqnbWMsAxsJkws3r0JHsCxD8jraXKvBQ83tFT
-Kqi9ZeQ1nW4dc5s1/p40OLrsq3ww23CfnP9Oxp+8rvggWyE1Rr4xb6hnYN7mSLNe
-u6xlycRopG12Rkvh5QLrKNr7D/GV1j6IGTqh4aRm+z9o/1Wwxz0WkaEyN7uFbQg5
-hscBBHJBKT1Q8evrJpTEUyzA8mrBO6sAAwYH/i2ygbxLRdqgRcjgqaWCkIDwUTJ+
-c6kIQmpPH9RMMpwnbU9kcGENCjhmFVIvbcUk9xBqQgUqSq9a8zZUrwuBauNCOmVX
-wruGyIXAYjlUXvxMOpTgEku6PlpKiDhmcv1Wb21dTz020ID5gpAa7s0T82VC3ciG
-JmYTiQut/Dz6W1X/vKkPtQ8UEQ7LTkNOyg7ys16FpktXYq/MxAhgQ5rRLqEwIPe1
-sjClgK4Lnzh5o6ue6pa6VAd+Bwpfy9i4yh3+CEgjWjq9DyciR6x6j2de+k0hQW6k
-V01gLPtduJnaPo+XWlHMonhKSlsPK10RMuVC901oLZYZSKOwMgpG5EGx2OSISQQY
-EQIACQUCQAm1sgIbDAAKCRD3iHX2QnIfAJZLAKCuvcDan/KMsSsAjM/rHTf8G0AK
-nQCfbbvCK0fwZcra7ofd1z1Up1+ID94=
-=xYye
------END PGP PUBLIC KEY BLOCK-----
-
-
-pub   1024D/F39B3750 2005-07-14
-      Key fingerprint = 29A2 BA84 8177 B738 7827  7FA4 75CA A2A3 F39B 3750
-uid                  Colm MacCarthaigh <colm@apache.org>
-uid                  Colm MacCarthaigh <colm@stdlib.net>
-uid                  Colm MacCarthaigh <colm.maccarthaigh@heanet.ie>
-sub   2048g/2C7157D3 2005-07-14
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.1 (GNU/Linux)
-
-mQGiBELW4V8RBACRZw1GIal1EKcPqtPyTAEtvtSQqv/ZLj3l9ne9kNHFgp52TyRp
-vV1JRwrlptNhClkBFD2/o6OAOvR2YcDvWXkoNGIlbgrsRaU9H9l7ZVFU5titPj+s
-69hHn2aGox8mpWay0jfRLpNiA+hxHpo9Txh30Yzsian0+vCm2cr6H/IkswCg68o5
-MB/AahASaRJBBDS0kFOjWssEAIFEq0yBFbRljS4Ia43IKiIYCsMTesNAvpaoHLMI
-ARvgEkLxXYQr9ZPjIxTPVXzKIuM7sE7Q0JkOa1ACkI3UM61dRaZ8CTHCt4zIOGMN
-WP8FCUgFyu1/DMIcgFo86x1jM5YNdz09wezqvhpYwf0rAdTCyk3Jz57Wx9iJyX8L
-JYAeBACRXYr7D6/xwE6nnVHebuUI20uM3UqAVfELKfEju0A5iiqFu42qXTHYpvds
-AdA7bC8YEWQLK35q9v5Kyrp6IrMVJJlo3701Kjpoqn+Wqo0dKsG3devB4jIN53lJ
-Bglx3Woxo7pPAoeHyPMxxZbPpeox+0cfj4SAh+sECdUgTq0nQ7QjQ29sbSBNYWND
-YXJ0aGFpZ2ggPGNvbG1AYXBhY2hlLm9yZz6IXgQTEQIAHgUCQyCIgwIbAwYLCQgH
-AwIDFQIDAxYCAQIeAQIXgAAKCRB1yqKj85s3UNOyAKCOR2bfAWqBqP9AlRb3VXvU
-9CJcQACg34GFUHLb79GWPAq1eq2Q/rkWWbyIRgQQEQIABgUCQyCPUQAKCRDAyIND
-MMiiiOhAAKCXDn/0uoJ8kEbOzf5biPYnU8qKWwCglSSuY/6TfRfuVpBK+v5U+/F/
-pOqIRgQTEQIABgUCQyCXyAAKCRBc/Tf6zHjIk37oAKDs8rL+BAWNpg1AH8H7QCPE
-Z71AvgCfUZFeA6Lny8eSTLHp8xfCeKR+lz+IRgQTEQIABgUCQyTKEwAKCRCKB01M
-P37h8sjtAJ9oNlVkhM8eC1iZ63mOWk88RWp0fgCfVZJxv4U951SfwAN5JNUEJndZ
-wUWIRgQTEQIABgUCQyTeJAAKCRDYa/eUZKL/ajBFAJ0W2Lwg8NrYpeaatsOlPM+k
-P47JpwCgoDoETU6/KOltBn1aEkN0B5jMzdmIRgQTEQIABgUCQyVXBQAKCRA9ckWS
-wp73hyhwAKDYGgg4PwdoozFscPHWpL0Bqd5K8gCeK0+3GoMoyLmdVX/JVRpFLZSP
-dW60I0NvbG0gTWFjQ2FydGhhaWdoIDxjb2xtQHN0ZGxpYi5uZXQ+iF4EExECAB4F
-AkLW4V8CGwMGCwkIBwMCAxUCAwMWAgECHgECF4AACgkQdcqio/ObN1BDlACdHWGv
-tR1w9KrHSUpmQNVx9REVHNUAnA31s2SibQsdJ216/538PMYZgPLuiEYEEBECAAYF
-AkLe3ewACgkQymk5dIEDo34hrgCfXMyiE43e4tc7cH16VbWwzdniE/8AoIPKexDT
-a4m8vyiDa1GceK4GUyAjiEYEEBECAAYFAkLfTJQACgkQQeoJoFeTSY+H4wCfa7rE
-7djok2b+s95HBeF/NwZNPt0AmwZCMbG29o/bofeRUDs2CGGPvbh3iEYEEBECAAYF
-AkLfkvAACgkQAQVmvOQTY5I2rACfTY/W7cCeTUU281TxYgQQeNWrYRUAoI8NOyQx
-KEQ7kijRdscRjhSR4ui+iEYEEBECAAYFAkLkdwwACgkQjON2uBzUhh+VugCeL6uG
-G78nPzFwsP5WhksIYtv/RZwAnjmoEOofv0VZeXlQoSoFUuc/TgVViEYEEBECAAYF
-AkLkkh8ACgkQBJE0Quobo42bRgCggRA4xgADvjofITsuFd58PoORq0MAn3CGP0Tf
-6tgw4aYDwcc01Ha1JSQDiEYEEBECAAYFAkLlyfMACgkQYRlqLjM+ToS0AwCglahs
-pxQ6jze8IEAsweOfPLy28jgAn0vbj101OnrjEsIsuryv440kWY7eiEYEEBECAAYF
-AkLqZfMACgkQsr68QBUpJK/9nwCfYeo2Hyjboyba2vC93cAi0VKePnsAnREn2lG1
-4sz6s+O+q3Uwy7is8V7ZiEYEEBECAAYFAkMgj1MACgkQwMiDQzDIoogUXACgkCQV
-93N8bGlp/8Pctql/loQU0LEAoJ2sAiDDyPTfmcSYp0eI6tGl03XViEYEEhECAAYF
-AkLetSkACgkQi5YpQ/wkPzzHzQCeNsAOFJDT/bJpCEkL91yOyynw4JkAn0ctxG0M
-oevrTNSIgAIy0fmWmErKiEYEEhECAAYFAkLhNrAACgkQohFa4V9ri3IFfQCcCr4X
-XeFigTwF2F2WhBNIslhVY4EAnRF6/HIFGofC/wvrl72tQnwUIo7PiJwEEwECAAYF
-AkLerMUACgkQMaY9luwUC4EqDgP+MSHyBB9UmfjFQtrveCJJg8fxhUiiuX6f3/jP
-/TeeI9RHRVFLTR2j2ZK/OOjtUAZo9WC0XYNd/Uh/aVhqrxfFI/J9M90Iarsi1zAj
-Vj4sqjDIPW4ucvP5E21mscTKP+Jdcn3OBU46OXHppbRZhhqgWVN6DcPudgozQ71T
-hyZ/noqInAQTAQIABgUCQt7IeQAKCRA34/Rf7mXjIcqqBADerPaJID4FtbTgR3WB
-fsGV9TPMCLl3GBI+u+G0dJghrS3HsYzysBI9ZSTfsaxhK/5BtlbiHelv7xReyzZB
-R3LppWQuwILQWYI+PHbnVfQu8VbBS5th2V/JTdEwU5Udj4e4yUSEIEJJDyVMWVu4
-TuWCxfdGxyzvyrZC1UaqFhWunIicBBMBAgAGBQJC320vAAoJEJrNPMCpn3XdX8sD
-/2eBp9JWolVXYnm55sQXrwkin0jr7mDWa5ms755RGXJHjIaEpBHt9KDKknFpRv4v
-5lWQhsJQ3XjVhGGnwI360Zut0W+8Jtx9WS4UOLeWQwSbLa2miyNlbY1Dl0Lc7mri
-PTfp/aIk6PQrwlR9KR3X44eRphk2lX0pCalvNefEVXg9iEYEExECAAYFAkLesT0A
-CgkQ/W+IxiHQpxsbfQCfSBKiIFQAZ3ms+jdifoew4LjuRE4An3FqSIfHdjT7QS/G
-SteEDyEi/+35iEYEExECAAYFAkLeu4IACgkQMsnkzjZCy0vSuwCcDdk8GhXVselq
-w1P6KfIGB46paI8AoNODV1J8WOivefexZF132lBYbGc9iEYEExECAAYFAkLe2eIA
-CgkQ7tHqOSJh0HOcxACfQIaSKmPV6ul9JL7Tw6bZV6LoZ1IAnR/1dq5qI6L/XY5w
-3/hy8rNzLjNGiEYEExECAAYFAkLfbTAACgkQUI6uxTAtpWiQkgCglhRN4h56a2NX
-4PubTaTpt4s+cFEAn2zOK6T9rlGYd5QFynZj0k1GuO9aiEYEExECAAYFAkLfbTIA
-CgkQ3bpkuiwxLS/10QCg+3rbZys4iQ4vW4qS6R2yJNlrh3IAnj2tyMmRrsEtW+bN
-OvUrJY4gL1bRiEYEExECAAYFAkLg7QYACgkQybWm7OLXdN+EdACgrgKHTCgj307w
-0FOioXe9uPEbU+4AnjM4lBi94Nm84BgE6esZDvXbVOfSiEYEExECAAYFAkLg7aQA
-CgkQN/aP9QFa/IpM0QCgowfVv1Z98utS0tXToJL6zS1KYiQAnAqdbSAtRxK8xpnr
-vc9LnpsukMF0iEYEExECAAYFAkLg78MACgkQW5aAEOBPmolTvACfWWiuidASBspI
-UeoZysIMfcXSDKEAn2gdALzsW+uvVT4LKNeKzsbzIs/TiEYEExECAAYFAkLiYsYA
-CgkQbZiNF4cxXDEgIQCghR7mWPIoOJv5sZn2YB+iKKKQUPkAoPLQlPiDgZM0L66w
-7KFMcPuSlj2IiEYEExECAAYFAkLjWt4ACgkQEy5J1OQe3H7SgQCgg+1G28fkCt2K
-Npsdcv3hKRY9wkkAoKMdsQHQQl9LeSQtxmnVoWgtSWXliEYEExECAAYFAkLjuE4A
-CgkQbQvHOkBYGDcQmgCfcaUPfWx3tzbMhgPIaxnC+2+4GGgAn3UmWcL4y6CuafGo
-TVEJ3pnbaHCBiEYEExECAAYFAkLj7ckACgkQMoZOQZyFIisAbwCfR8Gv59/k1CNl
-ThPvjfqOA9v7zpIAoIlyWt6VamIUF6V1DJkUsLdMUiFliEYEExECAAYFAkLlEN0A
-CgkQUnkvr5l4r4aw2ACg4PcNmqWg0tmU78SCYb5sft9arAUAoKlzLyVwbgx8o+sV
-xooCVLbq5Pn1iEYEExECAAYFAkLlEcoACgkQa3OhBipiP3LtPACeNNzQK6+M7+iW
-GRoa/3x91WTXupMAnjppF3NKvRFM1bPBuPHkMQrlZ3L5iEYEExECAAYFAkLmmagA
-CgkQaOuMdvjqKWeCIQCePj1/DGvnWdsE8vVH6LYIIBCmQDIAoI9KyCTP31ETSRBO
-+dkitssPvMO1iEYEExECAAYFAkLnYYsACgkQbpR1lMFSQxqbcACfS19GZMulB7qB
-5QvGKpFncsHE4i8AnAgs0jgBO4sWj987Wkm9xKb+6lF8iEYEExECAAYFAkMgl8gA
-CgkQXP03+sx4yJMg6QCgsjBgLZbMkacGPnXJQmR9OxPtUU4AoNusKhziIkJWlHWa
-uz8H9NuNp51riEYEExECAAYFAkMkyhMACgkQigdNTD9+4fIOkQCfSerkxohvKdRG
-uBh6/BbhoRyYY8oAoIdSEiSASDsllD6ABxpmFaLD0VjXiEYEExECAAYFAkMk3iQA
-CgkQ2Gv3lGSi/2r8rwCePvkHpYFFVmwaoyxDiWyAJIuO/ZkAoIfEGl2o1seOiM8Y
-pNIwqANE8Gt6iEYEExECAAYFAkMlVwUACgkQPXJFksKe94fKugCfSGLdAfgTPYNP
-JIddiYbExRj4tusAoNsqjlS7j0FiwuLxn2KhU0XdNR9otC9Db2xtIE1hY0NhcnRo
-YWlnaCA8Y29sbS5tYWNjYXJ0aGFpZ2hAaGVhbmV0LmllPoheBBMRAgAeBQJDIJFV
-AhsDBgsJCAcDAgMVAgMDFgIBAh4BAheAAAoJEHXKoqPzmzdQdvoAnRX9Td7jsxuJ
-tPtZTUuSzFP8ayWOAKDPnEXHSMWf83yGbYmYbjd1k6AVGYhGBBMRAgAGBQJDIJfB
-AAoJEFz9N/rMeMiTMNQAoO26cgCXNIHA1BXzt1Gc1YMx//urAJ4p9quyQ/0qhf5t
-A9FGXGX4nqYbc4hGBBMRAgAGBQJDJMoPAAoJEIoHTUw/fuHySjQAoIby3eTBkcvq
-Cvl2NWPrQJxPubd/AJ0QlXBRAJBycD6Hgf2Y1bcneLGKE4hGBBMRAgAGBQJDJN4h
-AAoJENhr95Rkov9qAwAAoNVYqqIIF2uvZSD4eKScYFb6u7n1AKDKFRSOjSeRHVXz
-GUd3UbUB+xny1IhGBBMRAgAGBQJDJVb6AAoJED1yRZLCnveHWC8AniAJhbJpdSR6
-lIzSkPbvJLRwdH5TAKDQ4aoyMe7914J9MgnkcVBraBhJj7kCDQRC1uF9EAgAgaod
-PcwlIct4wWAHDxe413Bgw6/v/kNp4Q0nbnLwQ++gsN3sCkK0O6qASsed+Ffsjhn2
-VEjAF03RT2T8Ir7AuA++EuWuAphBDTZLF/ARszSnYWEz3cELsuuqj1yXl4Gc3mj6
-1vDmST7g3iPxNbWGZNf0jinD1ycRYd+ZSs+5yQzOt6g2VtAE8DneL4M0o+tXZXlv
-Rl67PlrYbRIE81VYTm2C+k3eF0PWsdDyL8lPmV6ryIjvDK/EKLGynIQN2yWASzqZ
-Ql9mJGdwHKXMNxG5R0AQc0auJjk47sCj8ktP8+k6MPy2y2ZGv0PtSNSogROwMvJp
-MpqWoMtZdmrkXuGn9wADBQf/QAbCM0qCv6ogLmfsyyBubl42DkB8vMgRYoY0/kQW
-3qKBnIsCHhuQfYRX9oV+LVtq7vNd1NQe0HFMW3ZxOLA7e0lVPf2vJUWGG2wBWHOs
-2BxnS/691KUeB7NUA3MeiqaiPW5IM1+pWT5+/Ps9mJXnSHYYqaJdDHSiKeAvEYRz
-qGlwn1KpopIhtLZRMwio1ez5aNAQ6otD0vHFit3X+SCkl6+1+tvEfPTupUpbjBsG
-3geL3D1csPC45KsMCE7zwqAnXiVTYCGXumFEBS6b4bfh2uM8fZP2Sy0xEP0nxzmD
-mK5ERs8R3rshRHFZiil/qtqlMfucZER4XxWZidEoath1xYhJBBgRAgAJBQJC1uF9
-AhsMAAoJEHXKoqPzmzdQTTsAnRwKwOe+n2LgPgqAReIqMvbIHUxEAKDbuZIzxAtk
-Wq8UfA31IsLnxfIOGQ==
-=95yW
------END PGP PUBLIC KEY BLOCK-----
-
-
-pub   1024D/311A3DE5 2005-10-02
-      Key fingerprint = 120A 8667 241A EDD4 A78B  4610 4C04 2818 311A 3DE5
-uid                  Ruediger Pluem <rpluem@apache.org>
-sig 3        311A3DE5 2009-08-12  Ruediger Pluem <rpluem@apache.org>
-sig 3        311A3DE5 2005-10-02  Ruediger Pluem <rpluem@apache.org>
-sub   2048g/A21CD598 2005-10-02
-sig          311A3DE5 2005-10-02  Ruediger Pluem <rpluem@apache.org>
-sub   4096R/5185BA1C 2009-08-12
-sig          311A3DE5 2009-08-12  Ruediger Pluem <rpluem@apache.org>
-sub   4096g/3B3BAB8F 2009-08-12
-sig          311A3DE5 2009-08-12  Ruediger Pluem <rpluem@apache.org>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.5 (GNU/Linux)
-
-mQGiBEM/yAsRBACVZVt6oK9fpc9B/7vPny00aHnuhDQ0MsM5rbEGZ57aBnmHYyX0
-gTKLWGBXhlkos0hxBBIc9UUbOmaVBp4VFu0rz8IQ2OUZ93J7lR/khRG3wlmYx25Z
-CcN0tOFmiZuyV+J9zNP/dBdBfUqDwcJD8zmA7u8NLeUWljJJdKv8wcZ2/wCgwN+/
-PWz58JCvsvphQT1QjzP8a6UD/3DsCYMq0m2dOi3YXxtHpeF2Kn+k4BXnFt5dkPsd
-O2MN5m66Ky3MndeIPj81Bw9ssc9zZGcP2PHej9mZPjKDQaJn0GkHem2sVQ5uDcbG
-JCy7UKjgLqBl/AAJs3+0KdArvWVxsxBUl6wViAxUytwdsgK1KUA3Qyfj7oAM3p4S
-iAWlBACVIZO0u3LzAN5halnEcsjWrCdNpvOLB7aopNMYQRm0X2OXgFWRuLa6X4/g
-yA/aDZg5xbSBVzC9VwMS3Os1hqwuFW0DuP0PAal1KIRL2dzD/1XIuRBz7N1WgeSq
-MqNqjFL8RuTh9jHlWOnHKd7GOitJazv2TNgP0KQgRoPKklas97QiUnVlZGlnZXIg
-UGx1ZW0gPHJwbHVlbUBhcGFjaGUub3JnPoheBBMRAgAeAh4BAheABQJKgx+aBQsJ
-CAcDBRUKCQgLBRYCAwEAAAoJEEwEKBgxGj3lOlgAoLLpqsZ5MXiNaNgPeaqD+NEF
-xzVLAJ9PmcaWHklV/BB2D4BloSt6LVtURohGBBARAgAGBQJEouU2AAoJEJA4TZo1
-x+lCEToAn0oaavCybTxvhrlRfAzUM6OXu7WSAKDgZKHzg9LLLITk9KBU1lNbtW1Y
-iohGBBARAgAGBQJEovOrAAoJEPdiuCXvtpTqZBMAnid4GvSulpSWKIetS5tXPpTV
-BFwRAJwMKS+OoH2ZrvhFP5BteT85qxbei4icBBABAgAGBQJEqThgAAoJEDfj9F/u
-ZeMhN30EAI7VnOAkWSv6uLoznFQYQC4/qAWY3pQzJJeEhEFWGdujc52Pqqlxrp7Y
-Ny8XkVNcM8JzZhBwx8ABAv6nGQF+Qov1OOzAZ4jAVd05kd51CAEFoWozIDUUeHoR
-Kyh4F02dJC0r3tn45zHIS6FzHxfIKoStrOdwfyreDg+gCZXbvRcCiEYEEBECAAYF
-AkSpOFIACgkQMsnkzjZCy0vHfwCgwAxPDq+A5glMd3kLkHJCIViJV8wAn1ne2QjM
-37U0E9AVUugkamnqcv0+iEYEEBECAAYFAkSqs3EACgkQNYuqM1D5YRYnlgCfdXa1
-F2wMsCEqR3Wgi/koDqAgXQYAnju0aFixh59qW8a5wkXK7T4BEtJtiEYEEBECAAYF
-AkSn0RcACgkQ1TNOdbExPeK/xgCgnEkD7fjmoWo1m3Jq2LFFS1II2BcAoKqNxupM
-Dwf9abpHvrApLg1147sPiEYEEBECAAYFAkSqyNgACgkQ+zfaQDMuY83TogCglcjo
-XiiKKuSth8WSzZvcUX513bcAn3uPk3VS5+jMKPAAcgt2IPI8qUcBiQEiBBABAgAM
-BQJECpypBQMAEnUAAAoJEJcQuJvKV6188n8IALHU0NZRB1aLUCJgHYxtvR3DPH7Y
-3lbiScdJMeKBI7JvzUL5sfoglgLJ+BIhJonvWVVnDsFURH90OhCVO8QyRH0Io/e2
-pV0Cq6MXQreIrwin1U3sqI5Z17tIilYzVUguq3NhVB6iO79KyHnYE6mR1vOP6PXO
-ZFMbpJHoCpa99ZoTEljSnrW5LAtfeDL0Ha/1pS/GC80mqgC1cANA2kh0FTy07exj
-u3f7eA4F6BF4n91YW6MZNohIHNb/E+rhZliJZ0dmm74cOwSYRo4QtOuOsRnfPz0r
-cDOsCNO5jbw4ZnAXReijao7HqILV2qt31uLIDyAdrYyIJ0D60sQpHc3FezSInAQQ
-AQIABgUCRjoHnwAKCRCazTzAqZ913UkpBACfWnkg8FpqkSY4hVUN+S2lxJP1LrcT
-kRAbjJ/ECd+7DagMkrp4qq1nRuTIZ1qni/dgLb1bHCbbQl2XII2zdEMwi5bB5PEQ
-ggcjGtEiB5tdsUyYZPnZjh3asQJStQ0rjP2pLARa1DPaYq5PiRJQ/lbjZFsMbaQh
-q9ysPPUuo5GHcYhGBBARAgAGBQJGOOKlAAoJEBVFs/7iIt5PBegAoJsY6fMRMVkd
-l5wbYRQPWcmvnqEwAJ4zaFXcLgOGzwQwVTakYQICj+W8A4hGBBARAgAGBQJGOOeD
-AAoJEGPQra6REgPkOE8AnjTb3rP//+I/WJBLeO194cmB5ZnKAJ0Ug2nG0bxINnga
-tODVO3CUh2ggjohGBBARAgAGBQJGOgefAAoJEFCOrsUwLaVo3asAnRW3Crwy/oRg
-Kuxh/+5OqjB4bo30AKCqgFXmSuCtuVMf+IBQu28JgBGLyIhGBBARAgAGBQJGOgef
-AAoJEN26ZLosMS0v3asAn0RbVVSQy/li97fKim2w81ILLctDAJ4v6OaPJmmAyeXq
-tSAsQ1Zm4dIN9ohGBBARAgAGBQJGPJHXAAoJEJhw7/PxL2ByD+UAoIxHuxKNL+pj
-PicrmIpKNigqe2XXAJoDHBqC7dGawg2eUsXS2g6+VJ/xWIhGBBMRAgAGBQJGPaBW
-AAoJEC65RoKIgXQCSpEAniORwuCyXUKIDFnQOEbAo5CfCnueAKCTw/OrIlakDL6H
-ktMcUMjHSPTNMohGBBARAgAGBQJGPhfcAAoJEFQiDSzIdBVc3bYAoITYcorsUW1f
-OamHAXMcflZDZEvqAJ9LhDRlZWaa2OGfRGmWrwRAwz1GFYhGBBARAgAGBQJGPhV/
-AAoJED4qb8JfKYgk8yoAn3BNCMpwqdV3LauYt0pTH1Qgvct2AJoCK2zdA5NGT74j
-NMqJHQXQysXZlohGBBARAgAGBQJGPdZXAAoJEPXCYBZM7tdfElsAnjSx5Am1oSrn
-Q7cUsLN1FPnOuTLsAJoD/T6wr2X08EP1DW8ndgBhGgrVVYhGBBARAgAGBQJGPfS8
-AAoJEKBy1NBDWMWE0SQAn0kYZ4EZRAZd6DdUV3DI05g1ZWQZAJ4k2nO3s5wg1RpU
-uujnoG4/WJeaq4hGBBARAgAGBQJGPgWDAAoJEAKlpgULfmz6dsEAoLMOj9qxLNdC
-3+bMXicJmUW9ePgSAJ4s13w3tDI6kbd9CLreIp31ICRjFIhGBBMRAgAGBQJGPbGb
-AAoJEOHh8rCZDtSqYtEAoIhyMN6rv0nT5gwNLV0c/Fa6+q0gAJ4+pr7oAZRLKtkR
-s/X6N33r36pJwohGBBARAgAGBQJGOPZiAAoJEHPdjBYBUwI1E7sAoIU1S8Impr3j
-MlGYrnwBamrSAwaEAJ9LAER9Xg6pCTM/1O69g+KaB244cohGBBARAgAGBQJGRhFG
-AAoJEKIRWuFfa4tyDJsAoKP5GAZyWTJ4SJpqCnizTk+dF150AJ42/QN+tsYbDVwN
-gQGSJl8dcJp+0IhxBBARAgAxBQJGSMVhKhxIZW5uaW5nIFNjaG1pZWRlaGF1c2Vu
-IDxocHNAaW50ZXJtZXRhLmRlPgAKCRAyhk5BnIUiK+WwAJ971xK0A2wXxrflodgE
-RBMq9/2m/wCfTUHo0b5y/aNj86HZOG+AxPLsM9CIRgQQEQIABgUCRkC1hAAKCRBt
-C8c6QFgYN2GnAJ0STXI6kDmBOQwJ7bIDZmVWs7mODQCeNwrDrhMAT0NGVWjhTeHX
-VWlFQ6mIRgQQEQIABgUCRkxEPQAKCRAfISPDa9hyoA+nAKDjxtQhZzz/0g6DScIn
-Qvh/Dgi2nwCgrmlR69W53euVDo08J3YtidwYkauIRgQQEQIABgUCRkx8lgAKCRAP
-RQomYhC/wAY1AJwIYQe+QvKCVFEUHR44HJhG9lThIQCgsHTzbz2rUZ2bFbEM3YpY
-hvKiqYeIRgQTEQIABgUCRlKlMQAKCRAD9oy93oiEoO3yAKDbaloGpJocFy1lMQX3
-ynEngTUOZwCgxGiYdithfO8Y8x4iaQWmyDqasl+IRgQQEQIABgUCRlJuCwAKCRAy
-wdbvDxQ7wV/+AJ0TbDMo7whcttqwtRIF9arL/aXJhgCgpVFxorts5yIisMXi/eVL
-5cUBTPaIRgQQEQIABgUCRlJuGAAKCRDLrr45pGxMoe+2AKC0e9ZZH9qep25JXFab
-WEG8UKsG6ACfR4VuOIIPKzBvSf9JuvGpjf7PlDuIqQQQEQIAaQUCRlPKpCAcU2Fu
-ZGVyIFRlbW1lIDxzYW5kZXJAdGVtbWUubmV0PiIcU2FuZGVyIFRlbW1lIDxzY3Rl
-bW1lQGFwYWNoZS5vcmc+HhxTYW5kZXIgVGVtbWUgPHNhbmRlckBtYWMuY29tPgAK
-CRCyvrxAFSkkr5V6AJwNVQSjFWYlRNyc5UB/Ylg1gVeRXQCdHuVvpnO/fxbjB+jw
-ILowxjbuFA6IRgQQEQIABgUCRl7VYwAKCRCahtfM0arqYOk8AJ9yFSe3EsBciiRX
-xTsXWHxH5aLBZwCgnLDW0bWkjd6CKStV62+Hg2FeNQSIRgQQEQIABgUCRqVKXAAK
-CRA5vlGhCEyRE7UjAKCU1AiErvVAmkZ+GeXUKHRfEQz6HwCfdQIV8YVaWBbvRgMl
-W1zVYGe91GWIRgQQEQIABgUCRq3MAQAKCRAzzWczr17EUhWfAJ9HbK0CO07DTZkV
-Nlnm3CmwOc4MvwCgwXLE1EjDufwxipQfwSPu0JRZioCIRgQSEQIABgUCR/0s+AAK
-CRCLlilD/CQ/PDErAJ9VEaLs+nFOJdiQzBZcNyUSVRpeFACfbjqUkvIecDdcI3lO
-JgVPjN6RhZKIawQTEQIAKwUCR/0m7iQaaHR0cHM6Ly93d3cuY2FjZXJ0Lm9yZy9j
-cHMucGhwI3A1LjIACgkQf1hPnk3Z0cSrogCeOYYQ0/P4O5X9/9d4pFPXa5h04nUA
-oJgZVFJ6d4wqBzQLW2FRIkkEifeFiEYEEBECAAYFAkf9xPMACgkQGDgf10sb5phu
-xwCggcEsz1tnzCqMNgwGTb8TrMHMZYQAn1muuBraWNZ8cPyDvFs+AzBCDksMiEYE
-EBECAAYFAkf99pAACgkQveChm7bpBvP2FACgmGDtfKQC0m9Ub3cwlLh1DMo0deYA
-n0IwhPcbQ/DewoJ69ijrYH+9d+whiJwEEAECAAYFAkf+TWkACgkQMaY9luwUC4FX
-YQP+NGCaVfHgIKVbeJ6TP45W+1p5mCL08V2AH0wYZ2v8UBgZrdMqCTJilA82FEps
-aUQWijC72YASpqwhkjpZk5Fn70WjT96x9Ire4jRR/QvBkitTF4RU1vf4nUrWdgHD
-9Gk4FYu9gq6qqyiSPWZq/OHkVGeFY6cM1w2TcTsrVNJDI2CIRgQQEQIABgUCR/31
-aQAKCRD3iHX2QnIfAB0gAKC21tFnvtiBIpqpUbqZw49VdvBEpACgiKtx89FFaxm0
-fEEu74aPz3fToTGIRgQQEQIABgUCR/5OywAKCRD9b4jGIdCnG9nvAJ9G8sOnzViU
-EdTJGeZzBeqrc5voyQCfa+wT8YN6a+Ep2B3rDtWs9d44EI2IRgQTEQIABgUCR/4L
-qwAKCRCBLyCFwtUL+w7SAJ0fMVEcuUltW+XJ0GCo4oWiqBcNDwCcC/pnKkKvrEWE
-3v6hUXEwHx0ZYZOIygQQEQIAigUCSAN5GR8cSmltIEphZ2llbHNraSA8amltQGFw
-YWNoZS5vcmc+IBxKaW0gSmFnaWVsc2tpIDxqaW1AamFndU5FVC5jb20+HxxKaW0g
-SmFnaWVsc2tpIDxqaW1AamltamFnLmNvbT4iHEppbSBKYWdpZWxza2kgPGppbWpA
-Y292YWxlbnQubmV0PgAKCRCLOmAfCMl15Ul6AKCiNufW+YV3obsLnrgRPyYd+KO8
-ngCguSjH+XXdANHTFECh1V2D3U5mXWaIRgQQEQIABgUCSAU+6wAKCRCOo7BoTHZX
-8XMyAKDJyeqX3oj0wRNGFVSkbjpV54i4xwCfYPtfmHBQL3GcnisIso3ien8aR2WI
-RgQTEQIABgUCSAnx0wAKCRDegOZWGfkpGIXXAKCoQHJFIIhXJ1LWWb1kRNpvdOq+
-AwCdHAwDQhohnLXFQC6C3Iu3Lr7+3oSJARwEEAECAAYFAkgInxUACgkQGWWFUMMR
-BhEFxAgApqRcZhmICKF0ZMuEBE7M+saRsgBTRoNnmsNKZ0g3kKk0bzKTtztZ4JhS
-7Lvck2ljO3DoLbrjRAPzYfaZk3rUWk1RAhrHC223XqBmIGhK05LLjuGrZZaPZBMv
-gPte4928Sc8b2U3lTAMwbTdG47gO2t3l5gFR9ZrsyHDw/gJtJ0k1VBWIssRrKnuT
-fPfJzO0U5bFuESVPaQ+u5+V+HjyXyrwBtn8daHp+PEz7Z9puXSLHqR2mTeWxGWtH
-S17Bb3CMwjKrfxG3lg/FCDryfu78XCpwjYOQouMcST2CKcPNkgKBQ3+GDbYKUOO3
-v8FpTQbK0ACOasTEjOF6KbKjMTtpGohGBBARAgAGBQJH/0xyAAoJEDyaQgQMCIW0
-tEAAniYkVrwPIJE/JQT9Gxk+nlB583MUAJ46HnOLwBuAUB1K/opKGUrrF+RD6ohG
-BBARAgAGBQJID00aAAoJEBhhwyLFYBSy2u0An3vnCXWczd0VR+suMEmyrpciAg5Q
-AJ9q7EBbQVSKom183DKkHuE8LShoNIhyBBARAgAyBQJIC2TXKxxCZXJuZCBGb25k
-ZXJtYW5uIChBU0YpIDxiZXJuZGZAYXBhY2hlLm9yZz4ACgkQs5fdGlNtq+0LSwCf
-VB1kPOLsUsJr7dOAPxGIo9bfWzkAn3HeFym3oPtJVbrMT1wIMUgAsZoRiQIcBBAB
-AgAGBQJIRASPAAoJEBk/GAq1XZl3bxkQAJ26wvx+BepGzI8u7X4UMKLclnTLBrtk
-uXxsPfLBHFAVS+quwkFoglUb9a3mNyRv9DR4F3/yBCZpUlvquPsPSQDW4CDODjKQ
-f0hiDMmCMrUWaLRbgWSb5HHk8V+RLtHb3l/37ywu1ezw2OF4Ue+xl5WIYDNiYEOa
-GCCbVoVwUtFUSHcIPSd6hr6coeXK/p/vcpc1WUSeYukmFFiyCy2ODRpfpA3Yjclh
-vCAklryyK0xOapIjIfUCbDfM56/8AS5Dy9AGnw5v8l80gRCD3FpSnUE8cyHCi9zc
-I4dYdSNO+ZuL0TexMno9rlJDBgbGYWYbmgEW8CRSv7jzVHSGaPYmdFA3bu2YdJmr
-vsKgONflOwEoP2naJVb6SSRHc+OHh+BAAZIUXPPLr0v68Ps1/fW2UzMmiPhgCJjf
-z8uo7dOdMzjVT4GgMhGnQuG64r0aHpX3AT53go4j9uk1rMWSikK5t6VacpqMUsqf
-VXo5VpADSRA7g2zBTbFUw11tWFrx7+M2jelvXobiWgBZ6jG+1XM7IvHrnN5j5M4I
-+lWfbeIRlMMZJHnQnJDh8/4op2VQGt7VxURjN3cePI4IEJlRZ+Q1NjxDYSXkooXh
-Bx4RKYn/6fya4z7KDdBSMQRFLaZ+Hf9tQezj8PYyNO4xR0eJSeBUjXCqPePvJVOt
-B4NBC5uayBK+iEYEEBECAAYFAkl4Y98ACgkQi9gubzC5S1ypMgCgoTq8fqFbEpAV
-0c5K/Sg2Xc6JyqgAn0vOkLBBNh9WHHX6h9lh4ZGdjy6ZiEYEEBECAAYFAknKiAYA
-CgkQyceSTlEEfWYV4QCghWf8038x2jzjS2axOqnpPq2Q8PIAnjXYCVtSVTWlslK7
-xGBRkHueNFPOiEYEEBECAAYFAknP8aEACgkQJMGjeGoBexf9iwCgn6GB5Mo10dSG
-CT2+0JFcjv3aBIQAnAiuKtxLXe8ExsR2i3L5ANvFr92QiEYEEBECAAYFAknSWIgA
-CgkQrrAaFTt8dbFNYQCgkhqCyFMpSXHYl6OL0P2K2OgSBEEAoJIYWaQJGOy6DG2o
-3A44Jzc1GPQ7iEYEEBECAAYFAkpkJYUACgkQPPOSHMbURO3CsQCbB1x0IE2o0atR
-R2cjxjHYiE4EIwsAn3puLQANhPOhv9QkIDrZzBfXukwviFkEExECABkFAkM/yAsE
-CwcDAgMVAgMDFgIBAh4BAheAAAoJEEwEKBgxGj3lflgAni+OIjcWhfBnBaSXI/gK
-eWE4OyENAJ9cOfR5IZcmedhkBhy6dNBZDbgcibkCDQRDP8gYEAgAt1UbMmoZ/uoL
-StEC0SfcgbLVG3yTG6xFH5qL5t7w7HEboBvY9OkXYqHIMklC3MHJUv+BlRfhevo9
-R3DdeOY36AuYE5xwp2LXOzmDFtmqZ5aYD7269jXj5v0Vc41PK3XkQgltzKQWTvHe
-RD9r9Dm6MXQ/2n+/TfDfnpgVpW+rXvU+SXUru41+3kZREg3NeWMfPcI7earv8Vh9
-mEzHFtF49QauFa4E4cvvQnl5YD//Hpxube7qG3JDp7tQ4HYp+xX5HIuU+c545Up0
-NGWSpm2HnwnMzht6NEsVipWl7ncz2ESUJ3oHt4gDi2g3ODzZPndrQwr7U7qLuLCK
-n6wFTGMctwAEDQf+IjolfpRrijLrrMVtta9PO6KWNFZgQolOTN5E+Nbt+evFGCUz
-NNcDVlyozm3ls9NaHOUGUKtwUhgN4qGDyuB0DkWtqNMTEF5xzi2FLyzYqSZJjx/i
-kFI64D2hj1Tclkgz56cJtnjoS6U3OkQ7oS1mHDjjo0LXLY0X7nbyxwqE4XdLeYOF
-ilrvHIqJX0KBTrZTl5HHr9ZhR+Ho6ygcI+ip22gxhvqVXNWTFzJ84J/Zq3YJLqZW
-eDui1EzF/xFOIJeclm1HX24FX6VIsZgkhbPx0jG/QvYJDMnTmoZMePzz+EZdOvg6
-ycoCggtiZi8g6JLJjJdAWtcfSVEjIL8WR3G5qohGBBgRAgAGBQJDP8gYAAoJEEwE
-KBgxGj3lzTMAoKHiIZqz5SVGSwJftzHnZEeBhIZCAKCIYF7dohQgEGpBGmOUNo80
-QmAF2rkCDQRKgyDdARAAz3bbM3oSSxSUiDKmtpevW675+ygVoRMDJAeIiUZ9UQ8z
-cYbsGLqesgwmjtUGCHP+Fn1sV7eJLgyfHvBsRqloGVb1TIGdlElxwIz1UIBBD2pF
-4taTTGYugoau5kPN0Ds3PNdjB42Tn/W4mtnuAECKOftoJjWFHTuJuFyPjQ12dfW/
-epoFx+twNwvD6/YMqzDNZmDiaOcqxQyiVhal+re1ATkU/1we9rNcbI5lbahYnvYO
-Q4xiz7qavtiC2yY7moZicT+YMb9+AmMu/U/OGLkihVKi87N3cB1aUd2h7AM5CSoo
-ASFu5zFYinP6rLCo5H+91rgOMiLvwjI+5H28yhoKKM6udaZ7cwgMp+CaD/db3ruy
-HC330uYlG7byyNiucPXxiFTnUZb+9UOPEg99vs0RWDfHuGSf7EXADKR93cUNv30D
-Tlab2r+KNVgCn+pJJNLGvbAAfQ8VihpHP2YiX4gnuoAKBhEszwM+/eLjwPbZKylL
-ngkmJPvYIDm6FLJ7R7ubkL6SvNjPXWQy2TAm8O+saJLsrFVzpr2t8YkEtbuJmCT2
-8HHmz7H+30NC3SAUmy5biv/iXwnVP0dKSbGEXz63KKGm56ys9xusY+QbZjChAMeL
-CmiFhNVVtWsbK9rQeF227bL2YyE8md5sxX/9BYrbrM3zq2ERJ24o46ZmK/vtxC0A
-EQEAAYkCaAQYEQIACQUCSoMg3QIbAgIpCRBMBCgYMRo95cFdIAQZAQIABgUCSoMg
-3QAKCRDm1b7RUYW6HJMcD/96/KQo7RWGEpzad5TSxWaQYULuzWo9wolPbKFAJvDv
-l1EljIYvuvJjaPWX5a7YAivMg7nlEVknI+sGRG3BbYWRGnRaYOVjUT4OyrL//mdd
-N6CDMm7HXpPGk62pQORRE8F/+kfzxcx8cHwerdhwm3lGPx8Ibhw+ZjkUwOY3DBNu
-RcKDSlFMQN08R58tO0A6rDw5wereC9Ys+/853xWuwKxNmaGfE9AB9oZN2n4Ruxr2
-albiH0qSqTp1Iplv6JtGsqbQ5o7fLA2PeEltyPdj3oAHLIHq8rgD8T15YxpLHNP2
-a2tqZOqu6PMLRY0A3/2SLPq7gg1XuIXwLuCO5Irdlcf8FXxQZwSOg1BxAZXNquka
-TLBcZeHJlbiVuSzMG+PA9iYxwT1gCrqW9pkIiqQcpiZvuFHxsQRDhhkScA8ktTsT
-HJMiLp77cqhRYZG9BQGR5vMxJ7vFkOiSWkhaYC1VeQjn4FdkLryuXARU+VDzwqTn
-3EUABqyFAp8ZbdVLZAcqMAjTQdkQsHFPCz+2XKcAchQIcFILSCKwZLhuZaP23PT/
-qKdXOpWPVVFRBkcuDYC3pw/Tri39VJygF0/tIPHTmI6C6Etzd6okk+k1Itdt47Bv
-SDNtfCxBQ28tOYoc1ACKZOyWswE2o/00IzlHMMiBHcLerUM9DSvcjzKwvtS10l6t
-860PAJsFaZ70asd3WhQ3GQa+jXYrzeQ64wCfTYyzVKKECOc27nsw/t9mwwPUMYO5
-BA0ESoMhPRAQAIKs8QdUzoQIWxF9oaXQuYsCWBp3waN+G5eObOd51tfsZCVjng+r
-79R2w+qmYLg1ooySby36etxLxgKbA45oPBMTulNGKyJB39PcYZuc5OeicmciLIt5
-ziXdWjt5b4+8BiGGa+fsMblmDRDpgxLPgilYIT/8F7q7+ciHUnpOMnSH9UgOZphX
-65F4LgvNIrre7eBAXaN2dqIdHNCay3rOqU9Qy8lfHKTVepytDPCdmmTLpM28wZ0X
-MktK64pVkr6lTEZUjJzsuumYw7EzA7/U8B9RKmfeU0q9FfWsZASd3ys9Uu/re596
-q3FxwT7RAXwCOn9GszE5ZBFvMngBtsBhSYAhS8N30EDKdsc/0QH9PYtbO4E6Z8nc
-RF5TDp+6CY3u24MxNz1TwzOClcz9ZLYgTj6kNl8RNKTvd1JFcgT+18uBCBdQJxi8
-XH7PhsBZgy/UieX9T+NYcvC2xHIeP5O5/z6AgFqE62sYso87EgNxrZH2FI1tg6oG
-4JjsLzykORX29cUpKV95j65M6DKeb0eF61u7pk8r4qzdeaNTjnbm2cZf9/9F/rzZ
-sdz8Pl1DUwJdgLZCQBlFVrN9IbAzgMAQdHeSK9UDk5pLtwVhKwEL5JqzM90IuBK9
-GYH3Gvg8ZNTndL4n8q6sD56sWsXceUi19yQoLaxAuOORvxXQCy+YDb4nAAMFD/wM
-aEBi+TMG/iWTG7oCD5PJjf0T8FUriMTZWnbKCNznFaFlMyiV+ZFb7+dwVIt62n6T
-ijq60EwknzRnA2/urUBL39s2qeK9jU3KNeBlHSFRM/5Pjqlpy7ox3fH90fg0H4OG
-DlZlg4R2WfdeAgk9TjlMhWO6fjvSHtkoccP4OhGpefzBU1ujlIAYyIDNxSDQDrGE
-Dc5urTWcLp86eC6M3UXNopQVskITvjasc+/C9uAsto7xa/dBSwTsY4xHpQF0d3y9
-uu1ygO46Xq0N6nUVGgF7iM/OnL1sVyE82ccn2ikqfgY/l7gQXg/+POxxRlBAcGHX
-XtFrMf0eycxz+nB1Hh7dB71PnV7WRB63SvTJNKIBBQkEy194ob6gAKzazq8pXsZg
-pmnd6iEW6AP+8PcMsoYQJ6OdIqZneTQVfoiPyNG8XDygjwH/svXA4NUBdEskTHrk
-dVrDyWoCTNlY2jUmCC/is6ZfYK/fyR7KuF4D5uXL15NPK4FsLQbq6v428GVL+e+c
-HxztgILe+HKWv/h5YGaOOyVq+lUv5LopYt4poxnlC1npI2bNej5K+XyeQMsdCr1n
-3GlyqNFugRsIf/F+osARZfgfxNPXOekwlEnI2cQYJggwqLH9+zw5JnAksX3/57aE
-WeKvE4cuaQBx+qSS3NEb0Lq9If4CATs17eI/gPNT8ohJBBgRAgAJBQJKgyE9AhsM
-AAoJEEwEKBgxGj3lzDEAn1njbzNxuWwU9Qc0mPdkVrUIK0FBAJ906vRPI7J1KIh2
-DBlOT12zgK3B8A==
-=E5qG
------END PGP PUBLIC KEY BLOCK-----
-
-
-pub   1024D/83E6AE0D 2003-05-08 [expires: 2008-08-18]
-      Key fingerprint = D694 DAB9 8F4E 68A8 4C17  F011 ECAB 0E7B 83E6 AE0D
-uid                  Maxime Petazzoni (Bulix.org) <maxime.petazzoni@bulix.org>
-uid                  Maxime Petazzoni (Bulix.org) <sam@bulix.org>
-uid                  Maxime Petazzoni (Apache Software Foundation) <maxime@apache.org>
-sub   1024g/EA644EE9 2003-05-08
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.2 (GNU/Linux)
-
-mQGiBD66FGARBACW/hHKwrc3NIMstpxwopJI2h7KMr70Ecmn5i6NFOPr8I8smABx
-dIBNE0E07oCWKlS5mT47mio6wY46j5Q3EUmxbfZDlox7IO+R+1+s6OpLDz6QyLpW
-BtcaGkHNHaZPB4ouyd4T640ni1mp0b1G4awlgLxJRVcP/AtJCWVJTcNc4wCg4I8r
-v3+yQ+oW3QDExgGN23AQxIUD/0N4aLkdzJNv7DmDto7cwqQ1+hmPVHsyG+M1oKxl
-isx7NpCbicumMyvaIrFekUbpX2jtdP4zK3F/l4BvlR8YfgDrk7QmDT4eCUMNLviu
-d23aEehFtfP83O/IjXt1CjVW5n8IWNY0jwEygY/9bOQNI5XX3LcJvyMwqZorUSts
-n/EuA/4zRkE3Y+p/gRNv1f8F1exV3Cn2pb5ROi6tmMbpvB8Lmx41hZylsbZQdNty
-s5roYdGJGAL100x/KplV72zigDlpSAFZzKP9ArcO8w5SiJiyqYQWuB6UKB3fH9eE
-inL+caa8CQY/Tr2NGIR45t03h2i3zD1MrKulZz47kCZYbztSOrQ5TWF4aW1lIFBl
-dGF6em9uaSAoQnVsaXgub3JnKSA8bWF4aW1lLnBldGF6em9uaUBidWxpeC5vcmc+
-iGcEExECACcCGwMGCwkIBwMCAxUCAwMWAgECHgECF4ACGQEFAkGOAVMFCQnvQvMA
-CgkQ7KsOe4Pmrg03XACePWqWwPgqWx07CfmVr/vHodYJI7YAoLIJanI8VZV4dHIB
-VXZf0Kgf3VlgiEYEExECAAYFAkGFmWsACgkQCbw14+5QZGFbKQCfUVJPpvg9taHb
-i3fopt+oStAtJ/0AoNrjNX3IQZVGW0A2BrcELzHWA1GSiGEEExECACECGwMGCwkI
-BwMCAxUCAwMWAgECHgECF4AFAkCWj6YCGQEACgkQ7KsOe4Pmrg0dwQCZAUZX8G4U
-6MBxPaN6SDXmV7AB8lwAnjjlVWgagBa+sGW//R/jNYlozb4FiEwEExECAAwFAkGT
-EiQFgwcWRS8ACgkQzTD+AjVP2VIqFgCfSMoeN3UXC6tGlnDJfrJJJJ9hb8EAnRwz
-xS785bagDzRQTrD72+kuukB4iEwEEhECAAwFAkG7qckFgwbtrYoACgkQlF9N1bY0
-ib0UuACgsjxfNyZkqZmfyLyLmeLaBIiR35kAn1EP8g8JnpQaatFUiWXzETr1u2EX
-iEYEEhECAAYFAkJC8CQACgkQv04Nz8dVki/mbACgx35U9znQ49Mw7gEEb/PkM9SN
-OXYAoL/OYqIQUqnnxjNUWdQHHqua+dDgiEwEExECAAwFAkKE3+kFgwYkd2oACgkQ
-9lPLMJjT96f6ogCfXfb7Jn7PWfeT5xqOFd5jahaL/aAAoLQdE/nmBOVqvAKXNKn8
-KlwFQeKDiEYEExECAAYFAkLb2vAACgkQW5aAEOBPmoncOACdE4Sqz035hyYWfqqx
-JYw+wKrB0MsAniUauUXnaedm5baA3MpLmKE14vmkiEwEEBECAAwFAkLc4GMFgwXM
-dvAACgkQ94h19kJyHwBIDQCgnIhgESJ8p6OUuEqLZonnGozpJZAAnjbKeqeHuRaK
-Lqtd/PSQKpjcsoLpiEYEExECAAYFAkLdBIEACgkQXP03+sx4yJPdPgCg6uOAE+5N
-EK/x+AoyXSi8Y8m/v6EAn3m1F0kFeAQOQOFWz+XCXFmp49GniEwEEBECAAwFAkLj
-kskFgwXFxIoACgkQhUnvgY6MdEhTDACgjLv4eCSEm68dlStlK/Ii3jrgKcoAn0lq
-qZdlIaK9LA2KRIM7p3JjpdHliEwEEBECAAwFAkLkElYFgwXFRP0ACgkQbQvHOkBY
-GDfyZQCeM7mtFt4c3RA2bVPmd9mxnY6k1bMAoIQbVZ1G3d7YP6oLATygKPx+689v
-iEwEExECAAwFAkMOxUgFgwWakgsACgkQf7o9T+sfU2R2fACgiz19Npntlekc7KXo
-eqIqfQW2EwMAoJVfMZjd5HSu+WX/DJLDGG/P38iTiEwEEBECAAwFAkMOvUcFgwWa
-mgwACgkQS3OlVpbZQYk52gCfXD1k4WEozb+oDW4g8w8mPnyD43kAn1es9XXb/sOP
-s2QSQpSuPQgKVjduiEYEEBECAAYFAkNM5uwACgkQF4qBnPu4WxVB8gCeMcL7DkgF
-9m1IwvS5vlNJ+ZZTtrUAn3BqUvaxgXS6PrbhzqV4ca6h5xRYtCxNYXhpbWUgUGV0
-YXp6b25pIChCdWxpeC5vcmcpIDxzYW1AYnVsaXgub3JnPohkBBMRAgAkAhsDBgsJ
-CAcDAgMVAgMDFgIBAh4BAheABQJBjgFXBQkJ70LzAAoJEOyrDnuD5q4NJPcAn3Ii
-MneIS7QSFFqbBuWXg1CtKmfbAJwPdXZaz8/XeNwl1IRqHcuF26sVU4hGBBMRAgAG
-BQJBhZluAAoJEAm8NePuUGRhVgEAnjECm7Za8pLWh986UN0dALCf6fPcAKC9JwmR
-xhk4Z/Jttho6m15LqYotSIhMBBMRAgAMBQJBkxIkBYMHFkUvAAoJEM0w/gI1T9lS
-pMoAnjMWb7SCcrNZWJ3eSdlSFk8ZPXcaAJ47na71eks2kL8yXB3fp2HWNOx2Rohe
-BBMRAgAeBQJBhZkfAhsDBgsJCAcDAgMVAgMDFgIBAh4BAheAAAoJEOyrDnuD5q4N
-PA4An3CRhtEOJ6sJvjTCzSv9vCuSeCCPAJ974rjwU4SCJ/gco7XMM1SZIgvIEYhM
-BBIRAgAMBQJBu6nJBYMG7a2KAAoJEJRfTdW2NIm98LcAoINh9Pw9fhCMf4tbGhKs
-cS1HVNacAJ4obCxEt7Z88ptYUtrlSru9aZNO/IhGBBIRAgAGBQJCQvApAAoJEL9O
-Dc/HVZIvr4oAoJWNbuFkt7K2hxNLSu8b2r80z7jpAJ9+6/MOCJ2Msvdy2y2XF8xE
-9L8jZ4hMBBMRAgAMBQJChN/pBYMGJHdqAAoJEPZTyzCY0/enS0UAnREbV//LESUt
-zmMSxefuLEHtk+rZAKChzgpgSVLEsKVQQh30GfQgRVWcj4hGBBMRAgAGBQJC29r0
-AAoJEFuWgBDgT5qJZIoAn3Ly8SL/FjA00L0l0gY+sjVR4oLvAKCPEw2fPgMDIRJw
-mPeV+Co+W07GnohMBBARAgAMBQJC3OBjBYMFzHbwAAoJEPeIdfZCch8AFNkAn1Vt
-31nqcgesRmOtfQnjQBFx5hC4AJ951q/b1oUn47FvyyJtfp+PUWuLX4hGBBMRAgAG
-BQJC3QSFAAoJEFz9N/rMeMiTVA8AnAlVBaQjW+twEAbgbWqFaF6dEsGLAKDbwimF
-XXTU9ZWQsDzpO8/r1fXW3ohMBBARAgAMBQJC45LJBYMFxcSKAAoJEIVJ74GOjHRI
-uHAAn1+BUjTwapsuQ5xy6mOhQVR3uhuzAJ4kz7GyZTQXveowgl3wuLr+zHW3C4hM
-BBARAgAMBQJC5BJWBYMFxUT9AAoJEG0LxzpAWBg3+z4AmwbyGsGW5goY5n1Y7n8l
-XvRNbek6AJ0eftBgNzQ8Wyliw2zrqrCx79ZS7IhMBBMRAgAMBQJDDsVIBYMFmpIL
-AAoJEH+6PU/rH1NkS6IAn30i+PkmC8Y1lrEVxZpSD/iJzcKKAJoCUkHRy6T0KJ1b
-TvFORa9yOD1wrYhMBBARAgAMBQJDDr1HBYMFmpoMAAoJEEtzpVaW2UGJUOcAoKyG
-1VXvxK830zLq3hnNP4DGCBc7AJ9JDp7sE9EjcgxsBlA7yYxKCHTPdIhGBBARAgAG
-BQJDTObxAAoJEBeKgZz7uFsVv2MAn0jeoqWUiSYQ7HULy/30CQNOFwa0AJ0bWNrM
-bnyLVOPsg2rDq1bGMGyMsrQ/TWF4aW1lIFBldGF6em9uaSAoTm92YS1tYWcub3Jn
-KSA8bWF4aW1lLnBldGF6em9uaUBub3ZhLW1hZy5vcmc+iGQEMBECACQFAkHkYDAd
-HSBUaGlzIGVtYWlsIG5vIGxvbmdlciBleGlzdHMACgkQ7KsOe4Pmrg2UrwCgqr4T
-NWfG6S1eplFbu9rXumEgezcAnjyz2jhtfVGCCsj2Z3AgAyDl8wCJiEwEEhECAAwF
-AkG7qckFgwbtrYoACgkQlF9N1bY0ib1QKQCgotl+L/SfrQrnD76obkGPzNuFqaQA
-n1Mj8Wk9FNf/hAsSZzCAbV3tgbI3iF4EExECAB4FAj+NhncCGwMGCwkIBwMCAxUC
-AwMWAgECHgECF4AACgkQ7KsOe4Pmrg0zuwCfSIJWxDK4Gkx7BsvaO0AZOCgapFwA
-nA+oKOaDt6GlxoqAhxuUiPo0xKZwiEYEExECAAYFAkGFmW4ACgkQCbw14+5QZGER
-zgCeIe3ZGHUjzz/UyQW25Yf7s9/8VBcAn2J2p0ZUHEdntWqlOTi6v3jxiVe/iEwE
-ExECAAwFAkGTEiQFgwcWRS8ACgkQzTD+AjVP2VKubgCgkVieHF2C0HYExlUCR8e+
-hkJjrQUAniPb3LEwUfj3OofUfREw/I8DGLbCiGQEExECACQCGwMGCwkIBwMCAxUC
-AwMWAgECHgECF4AFAkGOAVcFCQnvQvMACgkQ7KsOe4Pmrg2kHACgqrNFxaQR3e2r
-jyZ9yt9HThYvbc8An1yP6cOovt1AZ5p6OdU9R8AXBf+PtDJNYXhpbWUgUGV0YXp6
-b25pIChOb3ZhLW1hZy5vcmcpIDxzYW1Abm92YS1tYWcub3JnPohkBDARAgAkBQJB
-5GA/HR0gVGhpcyBlbWFpbCBubyBsb25nZXIgZXhpc3RzAAoJEOyrDnuD5q4NGJYA
-niQNlo383vzVTSeUdbLew6yRsGzFAJ47Jeh7vghc8e/gdRzqYcAoQuEyaohGBBAR
-AgAGBQI/k77UAAoJEO6QdfU5abv28oIAoMexl17WRE9fGmCPjeS5oCEy+gAyAKCH
-hRHg53SWgJUPQ6VuDL6cwUNUzYhZBBMRAgAZBQI+uhRgBAsHAwIDFQIDAxYCAQIe
-AQIXgAAKCRDsqw57g+auDVyAAJ9V0z5uUuipuRG/5YlUD91mFGonLgCdHKSWkg7d
-LmcA0I2fecVd3tyCD6KIRgQTEQIABgUCQFDzaQAKCRAw/hG7Ima1Z1NmAJ9vkgu5
-88uiz+IK/Vrz7bl4/j3T6QCfR+sEvZJIK4+BF3twAOgeqj+torOIRgQTEQIABgUC
-P7+2ngAKCRAXioGc+7hbFVSeAJ978TzTftJwzHQik2uipMjBC/BDjgCgh/VdE2kq
-A7uycb0AmqOFEG9nzz6IRgQTEQIABgUCP325YQAKCRBfSAZpCvvNYNaTAKCAApn8
-SL3+AeBH8jT/5U1zuhf6ZQCfXAFBAuFRtlf+iml+MOFccjDUlcOIRgQTEQIABgUC
-PwSSpAAKCRCrz3ACPcJ28S1jAJ9NMBTPc/16nQWrC9k8+ZL9l23zkgCgxbM23/yQ
-xAZwLzxFY4M3F1OKptKITAQSEQIADAUCQbupyQWDBu2tigAKCRCUX03VtjSJvSIn
-AJ9zZMfRjjsaG+mrQAT4RAZkOVqICACfc2FH/vtiAsoHPUnQDoq9f3ohgB6IRgQT
-EQIABgUCQYWZbgAKCRAJvDXj7lBkYa1nAJ9NgL+MQmis6wQ69+TTXYI0tJaG7gCg
-3ghKMJfGtbzNi4RxTZnqviTr49qITAQTEQIADAUCQZMSJAWDBxZFLwAKCRDNMP4C
-NU/ZUucTAJ9hGzCVYM3PvY5ci+L9OkJeg3JZ9ACdHk9ajnEBXBXQiHxPrSvEkYpG
-dX2IXwQTEQIAHwQLBwMCAxUCAwMWAgECHgECF4AFAkGOAVcFCQnvQvMACgkQ7KsO
-e4Pmrg2KmQCfThDO0PQglZ/QyjLq8a+t2nT+p78AoJtiOntKvb3zitjuIf/9l5i/
-to9otEFNYXhpbWUgUGV0YXp6b25pIChBcGFjaGUgU29mdHdhcmUgRm91bmRhdGlv
-bikgPG1heGltZUBhcGFjaGUub3JnPohkBBMRAgAkBQJC84EGAhsDBQkJ70LzBgsJ
-CAcDAgMVAgMDFgIBAh4BAheAAAoJEOyrDnuD5q4N1ZQAn3JZ4otgS3ogdgCGKFeQ
-hhT0PDaPAKDFBgOlH8LdGitENSoZOWVEXSw3ZYhMBBMRAgAMBQJDDsVIBYMFmpIL
-AAoJEH+6PU/rH1NkU58An3zcPhOI4SgSr/I7cGuHH4NrqKDnAJ4k2IaWtkxtYV1s
-S8VcANTKSEZJDYhMBBARAgAMBQJDDr1HBYMFmpoMAAoJEEtzpVaW2UGJ3usAn2kN
-ttPGuLGa65+6LJdavi9inG9LAJ4uTToi+StbM2uYMStiL/iOKyuoA7kBDQQ+uhRh
-EAQA0gQ6m2hdo3t55hByLXkQTf2zficxXaW9S8gA9mePQwyqpQcDD5wCXMCmhhnb
-XGdFtqs9GlRLK/VcGwkP9L8FedS/u/jtwtbE8aTI9BBE2QVGkRvEb0y38j23pCbQ
-EwRdv9RrGNxAFhCDlJiHFxBAE+dabJt9YCLEUXPmqXh6FocAAwUD/1rAGpdLLsez
-qBxeXYZPzefwNtxhbpEXs71sBC9+ijZnYoGFa1Acnqh3vJH1DXvLC0RDTnqWma/3
-QsHJJtH9Bfbo0M3zKWs5aaV+yu/2XPDGMiOLm1F47EfGFfb4lCWGasq1onD8zIME
-W7kB+6jaDOq+qsu77eWL2kbD/FyC1aNJiEYEGBECAAYFAj66FGEACgkQ7KsOe4Pm
-rg1PfwCeKe4JSyAC0hmnPn9sBOQIgsG2s28AoJ7gJ9zLdb4SquLE0vvfZeKQtLYh
-=DmIO
------END PGP PUBLIC KEY BLOCK-----
-pub   1024D/40581837 2000-10-23
-      Key fingerprint = 4535 10BD A6C5 8556 24E0  0923 6D0B C73A 4058 1837
-uid                  Nick Kew <nick@webthing.com>
-sub   1024g/6A4AF32A 2000-10-23
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.2 (GNU/Linux)
-
-mQGiBDnzkd4RBADgCTgS7k/tgx1KaZ+yI5PdpA9slDq9FNGOaP9U6GXhQPDz+Vwp
-+DRn62/+k5Er8dN05ioycjNe2oaKRCHW29d+yXC5GeeAhovHYr+uwp1C1wkV8M2L
-m/3LcKizSja1UYsvqucYzBCKYtcK5ttEQmQAa24p9ZhE59Yl3fqpiilffwCglnu6
-eoXfGPxl9/hEitpc7lObQGcEAJSloC5SClhhqS3F2bw46AhrJ73BZ9kOcDe6dlJo
-J29SHt8rE9U2mN5WdLJpSyuwpHOK+xCjnW2JrVxn0xGVAsQ9g5T3FNTDbf1X+a37
-2pO6wAyvtsIH9ZC0JU5lfg/a1+2rGEl37T6tlPW6l3RVUkCPpiyYoaft3SNxslOd
-xJDcBADBtiNxviA3H+x6GXc978PvyjypsESU2JNZRaCI86yyT/dj8VRwVwUPzurm
-0vDqJNfeXbBEGQwp+Wj0C0ZiG30U0/R3rltEdz4Tn/CKH2WXAUkQAdevgOVB1rkU
-eoqjkGnvhwntq6WuHPYaT5pASpiC2wU4HDu7RJcRF1uj0PnVe7QcTmljayBLZXcg
-PG5pY2tAd2VidGhpbmcuY29tPohXBBMRAgAXBQI585HeBQsHCgMEAxUDAgMWAgEC
-F4AACgkQbQvHOkBYGDdpugCfco5ZqB5qIKHYOgfIA05mgc2WXqgAoI2SRD4E9UHY
-Tdx2EaqMfC9teG9TiJwEEwECAAYFAj/CgIoACgkQN+P0X+5l4yGyPgQA3psQD8uA
-j2QoX2bhCLG8rLwYyJfN4eqMvHwQK3iTUDKAF6qEcfnVyXQi8Tu5OY37maq/QOpw
-rHi+/50eiBVtStsqXbsHLKO2xxQGEaCSSehYMp5mQSiJmfKvyLTjlCb0BnesBWvD
-kRMbiEc3F9zzOIcUTt/pPV/YEXmrICM0HPeIRgQTEQIABgUCP7ppdQAKCRDLMqEH
-iMOlpYI+AJ9X3J4vcPGJrZqSMToGS5pzNYRPUACdHyrJ+Rt/ShkqVnJtaM+ONsQj
-H8GIRgQTEQIABgUCP7qPYQAKCRBc/Tf6zHjIk18PAKD1JRdPczkSbx75iHqEfooy
-O7FlBACeKkMmIs03OfCAOB5VW4YsF0x79E6IRgQTEQIABgUCP8exJwAKCRCkdA85
-0Ue3djCnAJ93/9aXFWDyqq4n9SjR2RW/Rcp1jgCff/eiV+vtiZwn1k324Cgqpjjc
-ITOIRgQTEQIABgUCP8OH/gAKCRD6PI0mFCtQm5CrAJ4yOwyw0kjJ23CVpL/AQ5so
-5f41JQCcDrDu5DPpL6sTJrUlnWB78S+14V2IRgQSEQIABgUCP7xo0QAKCRDsmT1j
-Zf3N7klmAJ4t4NE/syVP1xqfN7f9c9yc0IjTagCgmOv08ypx//V3x3/2sH/Qzr4q
-m66IRgQQEQIABgUCP8BknQAKCRAaCdGD/Qk8QbpcAKCZjXmmLt+vFPChYsA2VafU
-TJFCzQCfYPRG2bFBd3iZntiHAqLKpTRy8DiIRgQQEQIABgUCP7+tkwAKCRCyvrxA
-FSkkrwFsAJwKLTY7SnbEi4m0VLR6/JrjzBRZxQCguYUsuBvze88BDVIRX0epyK21
-RhaIRgQQEQIABgUCP7+twgAKCRDBHntHlk8x2fzLAKDgadjCownEBcSPk5zbg/Jh
-/HqFPQCgok3nbkTIvD3ottYB3+RjkQaDD1+JARwEEgECAAYFAj+/xR0ACgkQBurP
-qnbYPMbsLgf/foiuojq63JT4kDNAGSiBnk7NShOC9MRc4odQifQI6stCp1b0nn4h
-d1o/OlBZ1TZfXW/dyW+dMxYlkiaaV/WdbHY4r/ImynGR88aLgG6YVwl1oVUbHY+w
-ImAZLH/rJp4uafWtzX7/p21hVCeS9DckmR9Px23l5UPQyYZLHuI+iZdP0hhPkM0m
-rwC/km8UTuJ4o7+Y0+Zwl75TcTuBe5WodeRkbnIv46cnd6WyJjlgRfz+R2e6gJlG
-ysBkit62Qsl4qIKry+/F/jvy6nOJjJWNjtHTFQs5ijNHGhIagJUvytTFuNcNg3db
-MBEA88D2Js2n0qwLLh1a2aq2T++sj3Jae4hGBBMRAgAGBQI/uaNIAAoJEBD6TIil
-TaLfK7sAoNPyR6W2qBRLEn1usNwpKJcH9nMrAKCeLD1bpWkVXrbCJNsbRLZQcUVg
-MohGBBMRAgAGBQI/uasYAAoJEKge5knOGdXGnXgAoMMltbfOC8a0jhMzzLS0c2s5
-VoGGAKC1UMyYcatFXUT4m+Of45z/+xUL1IhGBBMRAgAGBQI/vc+wAAoJEL66K4f1
-/EtC25QAoNvrYI4Gz40AHHWuSNU3GcuC98GoAJ4w9jfiVYWDftQ020FEKMzDFFdk
-VohGBBIRAgAGBQI/udRNAAoJELkkUqxMkWW22kwAn2XBo4h4t1jxReXckDKhy+7r
-AgqeAJ9uvifvKci3nnfkcKvy/rsGmJC+44hGBBIRAgAGBQI/wVDVAAoJEMwhMCCh
-1pdZMdkAn2kkyMexCUuKCEHPoc2luhU1cuprAJ4peVxHFvyur9mBN0UQ5v2VGVnX
-sohGBBMRAgAGBQI/yuaJAAoJEGhad8ruVlUOIaQAoIX9Au+wI+URjTKwADRf2uHv
-EtDzAJ43TC/BwVHYDpsBu/+7Fjv4wqOY5YhGBBMRAgAGBQI/zd4FAAoJEBMuSdTk
-Htx+ZCoAoKJyCqZuCf0tN/z3NBNWaPgqU4C9AJwPztLCMNJ7J9skWbndk74IdiJX
-M4hGBBMRAgAGBQI/y4vVAAoJEAlaRdyhHVb7g7wAoLvvB/TarlHX/a2jm+BXFPdw
-V9e7AJ9AcySdlGowiXXtEW1cCPyQ+teqnohGBBMRAgAGBQI/0M5fAAoJEGQHhtmt
-v54amD0AoKdcXerf53vHCRVVjeJIdPugbM9OAJ4x8qs74w+PfZ9a+jwK7Mw9EYOt
-XIiZBBIBAgAGBQI/ym90AAoJED6Pt/L4g0HZEXAD50Gfce2rIDHB4DSf5BZyL2Qt
-NhbM3Qr61TlmlduTsyHWTruY1mB95nX/KPGaTiCWBqo95yrf1pcUn4rVH7Im7gyD
-XF82j/QYLSH1rN9CN9ESsFBjaGzi0BoRAAlqgaAELJAoQLsl53vAAaYQiWtaybd9
-u5UNIX7xy/pmYHNpiEYEEBECAAYFAkBVneAACgkQGFXfHI9FVgaXgACgonzAibvO
-s/UHFomOC1R94nKM9HcAnjmjgDH4Q/XOtpJX1Av6ZqTsJo7liEYEEhECAAYFAkAw
-G0cACgkQLovQgMxpzu1GygCfYyI+cF1P8qZvscDQJwwscBktk40AnRnz6qzzAfOS
-LZ9xYJ0s1IQnMGGViEYEExECAAYFAkAV0+kACgkQFT+gzXWmdpJuYwCfYxbaEOfR
-JQXdRj2BlYA0rbUaQ0YAn1MIZa+mkXo2LBwJgufuNVHKfFMuiD8DBRBAX1NazLLr
-Ruds9tARAn2XAJ9/ozPEegLNIXDRFHil+yEe/wz/2gCfXYXgwLrwoyeID7RIrwdc
-hIORke6IRgQTEQIABgUCQY7oHgAKCRBbloAQ4E+aiTqZAJ9SiogzAQfXUoeV12aT
-7PmwkqiulgCeJp8F5t6kEaBrA5yurTKX+6e5uV2IRgQQEQIABgUCP8IXWQAKCRCJ
-2EyvRrJixs9uAKCHjl+/UO32mu6ikEU6gmYFMLqB3QCdH+3pfTEDcGAvStQpZzE7
-ys/vZmCIRgQQEQIABgUCQt7ToAAKCRDKaTl0gQOjfpfQAKCkkLYJL5/0yrhd045h
-bIcgTN+9YQCfS64ZOAN1lh3l/SjlXLHWDzXmjlWIRgQQEQIABgUCQt9FqAAKCRBB
-6gmgV5NJj7p8AKCcfGPPWrDaq3SodTopRts4Kmo8EACgjJRLCg2DHKAzise70OVN
-THGYLm2IRgQQEQIABgUCQt+G2QAKCRAEYzpXfCAJQexCAJ97xbwzZhMOOXiM4aj5
-Ulzrja9nVwCdFZsZgtozofpvmZaHeEtKucxGG3qIRgQQEQIABgUCQt+SVwAKCRAB
-BWa85BNjkr5mAJ9qlkrrGciNUdkcGGjfAb444/G9rgCfTVtutNz831bCqDowpSqZ
-M5bAuUOIRgQQEQIABgUCQuAc7gAKCRCM43a4HNSGH39EAJ98iw5WB5CZOXHbhEPw
-dUnTSVKwkwCfcWJD5Yr0bSriF9aVLChmAzi9jjCIRgQQEQIABgUCQuOlhgAKCRAE
-kTRC6hujjbJoAJ9Mw8UfCDIttO0SGqaodq932IIUngCgj+E2QuHkF0TyMApSaEIO
-w8NOPsKIRgQQEQIABgUCQuSFYgAKCRBhGWouMz5OhB7XAKC4J7nTmBWA6cn67C0B
-vja2bxzRrwCeMAWS6xn1tBZ1vm6vP2A6WtNRWlmIRgQSEQIABgUCQt6mVwAKCRCL
-lilD/CQ/PGZGAJ0RRqxeZpOhWoM2ADUfrkqTkTXk+wCfWiWHJ64H7Ubs7z58fBsi
-M69wpeuIRgQTEQIABgUCQoptEwAKCRDI4/o2Nmo3W05JAJ9arsg7sN3ft5siNuGB
-pnd3Q01ToQCdHjxosGdQalkXeymtXD8SjACn1x6IRgQTEQIABgUCQt6v4QAKCRD9
-b4jGIdCnG4UIAKCJOOihLbPfW+c2CrkE6nEPxQ29SQCgkBCbx+h8aMEyqJqjPWpd
-QvfQofuIRgQTEQIABgUCQt66EwAKCRAyyeTONkLLSyDiAJ94yVjfasZoGZodSR/2
-kYqF4ZQEdQCgvOrzez4RP1JCHWsFTn15tUQgNh2IRgQTEQIABgUCQt7UjgAKCRDu
-0eo5ImHQc6jEAJ921c05ZPfI+9uWI97wsopfW+PDFACfQ/PxEyEzeCXbYFoEUe7B
-tOgp1AyIRgQTEQIABgUCQt9sXgAKCRBQjq7FMC2laOH/AKCwImpjMHoE9H7sQx7L
-I+9m1PmOeQCdH4x9T3vUF4gHL8BypAse/UuLQbmIRgQTEQIABgUCQt9sYAAKCRDd
-umS6LDEtLxjpAKDoV9vn0QheFsQLYuUeDF/5m20TkgCgwkSVcCDP/7m6aZ8blA/h
-cAeKrJCIRgQTEQIABgUCQuDsmAAKCRDJtabs4td03wkIAKCmhOt1jrHnnknNr623
-OtngC3yhkwCeMH2xnonwIboYmyo3hzC84VHzr1SIRgQTEQIABgUCQuDs5gAKCRA3
-9o/1AVr8ilTiAKCLvPNLPVjXY8epjHhSxkRY6+HU2wCfZnVkzoW+c7NQ0G7Db5/G
-rMjEgdyIRgQTEQIABgUCQuJhxQAKCRBtmI0XhzFcMY0AAJwKmpwnqrX8aDV2+t+E
-uTrM4i+42wCcDiK/v3y0jmXbylU5eZ93mrealSKIRgQTEQIABgUCQuNVMwAKCRAT
-LknU5B7cflj2AJ9ZTTFhGTJALO2/xVX8eVGucVbO5QCfe3mRMPaSx5nKne3TQWIR
-2Pck102IRgQTEQIABgUCQuNkkgAKCRB1yqKj85s3UN2KAKCH9B6mMup+BSkf/qog
-WTp+wkzt8ACfdLzMTdNnt15YpS0TEmSNrq0waweIRgQTEQIABgUCQuPrZQAKCRDy
-AsuClhyUYN+TAKCQGVfmlOhNu/L67ZmneL1KA7iMXACePs6DOTSlIh0LKzGvZh0H
-8jAwtR2IRgQTEQIABgUCQuPs9AAKCRAyhk5BnIUiKxpRAKCHGnESODZlUhkrPZ9G
-bKZj/WKMgACfY7HDgvOuK7N9evmNB1+8dUTZnuyIRgQTEQIABgUCQuUQeAAKCRBS
-eS+vmXivhsKnAJ9a1Pp8ZyZWTtryRgeRyIZ6CaG9DACeJtY83ZL2LatOpgfcLCt5
-U/F2okmIRgQTEQIABgUCQuURcgAKCRBrc6EGKmI/cllgAJ9LOwF1qeUlQplpr+mn
-mlLB9JyV+gCg8d75X/XaHWMYCqBs8dh0E/0zf6GIRgQTEQIABgUCQudgyQAKCRBu
-lHWUwVJDGoW3AKCvlrR3dxaHHPAa3Gxae3NTu9/j+ACdG66gH2TAfa9qSx/E+9Df
-H0pdIseInAQTAQIABgUCQt6sNQAKCRAxpj2W7BQLgUYIBACQv85g415QDF40KBaq
-b+3GMOtrHq0gbhG/xq8EfVq2NN+W4jRBgpDIdj17zgTgDy1Xby/04UK+7CMNhAFA
-li5QXPQgO+iKgmV3Dvdzml9P+IGGb7CjU7/oANNfJoCwFUeZanizFzZepTkyci9x
-H5OHcfe4Lhiq18wCmlb4nkG7wYicBBMBAgAGBQJC32xcAAoJEJrNPMCpn3XdRfoD
-/i0tYfOTUwa3OQ8hj9RUx9KTYJe/M0vGuyuNxEWdRB5R6AUolIeboIunb5auAbRb
-ubrVbXjRkvJS5wCqOO7WyL49w9G4BVAO0Uw+QptION+UdpV9ZfXHd+nsgDuiRkVM
-yhX0336SoD57RyiT5rglKpKOCb7l4e12S0dVr15PXc7IiQEcBBMBAgAGBQJC/ToO
-AAoJEFwyh8czExtlBa4H/jj+/4NJgM7ciC0A45ySTdJZY+DYFJyRCu5bCPkcYS6A
-3PKInXc8RgFykWfz0X57UtobvH+s0O+Gyg6ArSErEHXsCZGYlHPpcACgFLiLS7yE
-gEpzDLClmSIMmb7kRGr9LX5RyQhAPAjszlIk9jPdcn3jkTtvr+oHrVLmTy8tcW3u
-d9G8oD7PCZAeD2P8XA2eHiY+9/oPu5y/cJKLYl3J+gL6Ptk7jngft3hwr/6X/dAc
-bE9h09ZS9ZRmf28NiCEBJ6meswMA8C2ocJLmW+7X2Cctfo2LIPpvI0uKzvAeh+Hl
-/97HmmyArknk8qEFYHNh5sI7yT8okbuZ5daI0Ibp1NKIRgQTEQIABgUCQv04lgAK
-CRB+iDZMgoRJhB28AJ4wWlHXGXU73JYV3b/A5l0gdVF+qwCeKkLJspvZ+BF2cV3u
-4FKwIeq4FaqIRQQSEQIABgUCQuE1ugAKCRCiEVrhX2uLchEGAJUSSguS2p3XVs6l
-3ssMx/Cm11RoAJ4hazOLz9zi9bkkZe4Jsnj8t8dkPIhGBBARAgAGBQJDJH2xAAoJ
-EPwPhYn4lL4SDsgAniHK2LhZ+mFApRlM1EHt1XwuZic7AJ9DK42czJ0hWYRJuUge
-gH1hRJM3l7kBDQQ585IFEAQAqsJfRx6LMF9sBtHmNf83j1V2SCVv4NK8OoPcKWBg
-MKQxnDkpWD7DdV69p6azP6N/ENfmK8qsSiXHUUEwOS2UMct7T3Tqi5f/EAVSgw4T
-rTC9dgpafTUpU5A8MW7h+Psm0XDwmwlqREUvyK2gqnpVaMXhZIVU71yTeXxy/3Vs
-7ysAAwUD/iJg+Bc0iZ7LNnW1xZuvc4/6LOEGelQpmM5SPr+gG6DHXhR+TrUMDt7R
-e+WkPGS8yqqxZ/4JefF5X6KgQwDadfQAYldFwW0XakOBCP17yK3aJsYtdaxTyx5e
-R0LuGbxVdMz3u/UtY1Txn72wlEEqnPhNokbvAI50jyc71TTXWKaviEYEGBECAAYF
-AjnzkgUACgkQbQvHOkBYGDcHiwCeNV4G2NP0SvG75RaqmYvnvbyC1xUAn1qF30A0
-W/Kdk2iuwPLJw9rN5PFA
-=WPl7
------END PGP PUBLIC KEY BLOCK-----
-pub   4096R/F51BB88A 2009-11-04 [expires: 2016-02-17]
-      Key fingerprint = FC5A 6FC6 2E25 2DFD 8007  EE23 9BB8 63B0 F51B B88A
-uid                  Sander Temme <sander@temme.net>
-sig          152924AF 2009-11-04  Sander Temme <sander@temme.net>
-sig          D3262722 2010-01-01  Jean-Frederic Clere (Apache signing key) <jfclere@apache.org>
-sig          3C7705CF 2009-12-13  David Fisher <dave2wave@comcast.net>
-sig          D84E41AE 2009-11-30  Nick Burch <nick@gagravarr.org>
-sig          D1F99590 2010-03-18  Josh Micich (Software engineer) <josh@gildedtree.com>
-sig          B55D9977 2010-01-26  William A. Rowe, Jr. <wrowe@rowe-clan.net>
-sig          3F0A04B6 2010-01-26  Geoff Greer (Work) <geoff@floobits.com>
-sig          5D7BBC5A 2010-01-26  Leif Hedstrom (CODE SIGNING KEY) <zwoop@apache.org>
-sig          1824BDC1 2010-08-26  Brett Porter (Release Signing Key) <brett@apache.org>
-sig          B1669287 2010-11-10  Kathey Marsden <kmarsden@apache.org>
-sig          D01E0E18 2010-11-16  Jean-Sebastien Delfino <jsdelfino@apache.org>
-sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
-sig          6D5954FA 2010-11-04  Eric Covener <covener@apache.org>
-sig          F2F27A06 2010-12-30  Carsten Ziegeler (CODE SIGNING KEY) <cziegeler@apache.org>
-sig          4DCAA88F 2010-11-04  Thomas Dudziak (CODE SIGNING KEY) <tomdz@apache.org>
-sig          82A7FBCD 2010-11-04  Antoine Levy-Lambert (CODE SIGNING KEY) <antoine@apache.org>
-sig          7C408737 2010-11-04  Joseph Edward Bergmark (CODE SIGNING KEY) <bergmark@apache.org>
-sig          791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
-sig          0E371A09 2011-01-05  Sander Temme <Sander.Temme@thalesesec.com>
-sig 2        F2EFD0F0 2010-11-05  Christopher David Schultz (Christopher David Schultz) <chris@christopherschultz.net>
-sig 3     X  4336B448 2011-06-23  Scott Mustard <scott@mustard.net>
-sig          4E24517C 2011-11-10  Hyrum K. Wright (Personal) <hyrum@hyrumwright.org>
-sig          C4FC9A65 2011-11-10  Bernd Bohmann <bommel@apache.org>
-sig          1F49ECA5 2011-11-10  Ulrich StŠrk <uli@apache.org>
-sig          F5CBAE6B 2011-11-12  Akitoshi Yoshida (CODE SIGNING KEY) <ay@apache.org>
-sig          352ACF76 2011-11-10  Richard Keith Turner (CODE SIGNING KEY) <keith@deenlo.com>
-sig          B84508EC 2011-11-11  Bryan W. Call <bcall@apache.org>
-sig          2A239C2C 2011-11-21  Christian Mueller (CODE SIGNING KEY) <cmueller@apache.org>
-sig          0208FC11 2011-11-14  Carlos Sanchez <carlos@apache.org>
-sig          97C87790 2011-11-17  Paolo Castagna <castagna@apache.org>
-sig          088335A9 2011-11-24  Chris Darroch (CODE SIGNING KEY) <chrisd@apache.org>
-sig 2        41CEFDE0 2011-12-13  Stefan Fritsch <sf@sfritsch.de>
-sig 3        F51BB88A 2013-02-17  Sander Temme <sander@temme.net>
-sig 3        F51BB88A 2009-11-05  Sander Temme <sander@temme.net>
-uid                  Sander Temme <sander@me.com>
-sig          152924AF 2009-11-04  Sander Temme <sander@temme.net>
-sig          D3262722 2010-01-01  Jean-Frederic Clere (Apache signing key) <jfclere@apache.org>
-sig          3C7705CF 2009-12-13  David Fisher <dave2wave@comcast.net>
-sig          D84E41AE 2009-11-30  Nick Burch <nick@gagravarr.org>
-sig          D1F99590 2010-03-18  Josh Micich (Software engineer) <josh@gildedtree.com>
-sig          B55D9977 2010-01-26  William A. Rowe, Jr. <wrowe@rowe-clan.net>
-sig          3F0A04B6 2010-01-26  Geoff Greer (Work) <geoff@floobits.com>
-sig          5D7BBC5A 2010-01-26  Leif Hedstrom (CODE SIGNING KEY) <zwoop@apache.org>
-sig          1824BDC1 2010-08-26  Brett Porter (Release Signing Key) <brett@apache.org>
-sig          B1669287 2010-11-10  Kathey Marsden <kmarsden@apache.org>
-sig          D01E0E18 2010-11-16  Jean-Sebastien Delfino <jsdelfino@apache.org>
-sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
-sig          6D5954FA 2010-11-04  Eric Covener <covener@apache.org>
-sig          F2F27A06 2010-12-30  Carsten Ziegeler (CODE SIGNING KEY) <cziegeler@apache.org>
-sig          4DCAA88F 2010-11-04  Thomas Dudziak (CODE SIGNING KEY) <tomdz@apache.org>
-sig          82A7FBCD 2010-11-04  Antoine Levy-Lambert (CODE SIGNING KEY) <antoine@apache.org>
-sig          7C408737 2010-11-04  Joseph Edward Bergmark (CODE SIGNING KEY) <bergmark@apache.org>
-sig          791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
-sig          0E371A09 2011-01-05  Sander Temme <Sander.Temme@thalesesec.com>
-sig 2        F2EFD0F0 2010-11-05  Christopher David Schultz (Christopher David Schultz) <chris@christopherschultz.net>
-sig 3     X  4336B448 2011-06-23  Scott Mustard <scott@mustard.net>
-sig          4E24517C 2011-11-10  Hyrum K. Wright (Personal) <hyrum@hyrumwright.org>
-sig          C4FC9A65 2011-11-10  Bernd Bohmann <bommel@apache.org>
-sig          1F49ECA5 2011-11-10  Ulrich StŠrk <uli@apache.org>
-sig          352ACF76 2011-11-10  Richard Keith Turner (CODE SIGNING KEY) <keith@deenlo.com>
-sig          B84508EC 2011-11-11  Bryan W. Call <bcall@apache.org>
-sig          F5CBAE6B 2011-11-12  Akitoshi Yoshida (CODE SIGNING KEY) <ay@apache.org>
-sig          2A239C2C 2011-11-21  Christian Mueller (CODE SIGNING KEY) <cmueller@apache.org>
-sig          0208FC11 2011-11-14  Carlos Sanchez <carlos@apache.org>
-sig          088335A9 2011-11-24  Chris Darroch (CODE SIGNING KEY) <chrisd@apache.org>
-sig 2        41CEFDE0 2011-12-13  Stefan Fritsch <sf@sfritsch.de>
-sig 3        F51BB88A 2013-02-17  Sander Temme <sander@temme.net>
-sig 3        F51BB88A 2009-11-04  Sander Temme <sander@temme.net>
-uid                  [jpeg image of size 22992]
-sig          152924AF 2009-11-04  Sander Temme <sander@temme.net>
-sig          D3262722 2010-01-01  Jean-Frederic Clere (Apache signing key) <jfclere@apache.org>
-sig          3C7705CF 2009-12-13  David Fisher <dave2wave@comcast.net>
-sig          D84E41AE 2009-11-30  Nick Burch <nick@gagravarr.org>
-sig          D1F99590 2010-03-18  Josh Micich (Software engineer) <josh@gildedtree.com>
-sig          B55D9977 2010-01-26  William A. Rowe, Jr. <wrowe@rowe-clan.net>
-sig          3F0A04B6 2010-01-26  Geoff Greer (Work) <geoff@floobits.com>
-sig          5D7BBC5A 2010-01-26  Leif Hedstrom (CODE SIGNING KEY) <zwoop@apache.org>
-sig          1824BDC1 2010-08-26  Brett Porter (Release Signing Key) <brett@apache.org>
-sig          B1669287 2010-11-10  Kathey Marsden <kmarsden@apache.org>
-sig          6D5954FA 2010-11-04  Eric Covener <covener@apache.org>
-sig          F2F27A06 2010-12-30  Carsten Ziegeler (CODE SIGNING KEY) <cziegeler@apache.org>
-sig          0E371A09 2011-01-05  Sander Temme <Sander.Temme@thalesesec.com>
-sig 2        F2EFD0F0 2010-11-05  Christopher David Schultz (Christopher David Schultz) <chris@christopherschultz.net>
-sig 3     X  4336B448 2011-06-23  Scott Mustard <scott@mustard.net>
-sig          4E24517C 2011-11-10  Hyrum K. Wright (Personal) <hyrum@hyrumwright.org>
-sig          C4FC9A65 2011-11-10  Bernd Bohmann <bommel@apache.org>
-sig          1F49ECA5 2011-11-10  Ulrich StŠrk <uli@apache.org>
-sig          352ACF76 2011-11-10  Richard Keith Turner (CODE SIGNING KEY) <keith@deenlo.com>
-sig          B84508EC 2011-11-11  Bryan W. Call <bcall@apache.org>
-sig          F5CBAE6B 2011-11-12  Akitoshi Yoshida (CODE SIGNING KEY) <ay@apache.org>
-sig          34884E85 2011-11-25  Robin Hugh Johnson <robbat2@orbis-terrarum.net>
-sig          2A239C2C 2011-11-21  Christian Mueller (CODE SIGNING KEY) <cmueller@apache.org>
-sig          0208FC11 2011-11-14  Carlos Sanchez <carlos@apache.org>
-sig          088335A9 2011-11-24  Chris Darroch (CODE SIGNING KEY) <chrisd@apache.org>
-sig 2        41CEFDE0 2011-12-13  Stefan Fritsch <sf@sfritsch.de>
-sig 3        F51BB88A 2013-02-17  Sander Temme <sander@temme.net>
-sig 3        F51BB88A 2009-11-04  Sander Temme <sander@temme.net>
-uid                  Sander Temme <sctemme@apache.org>
-sig          152924AF 2009-11-04  Sander Temme <sander@temme.net>
-sig          D3262722 2010-01-01  Jean-Frederic Clere (Apache signing key) <jfclere@apache.org>
-sig          3C7705CF 2009-12-13  David Fisher <dave2wave@comcast.net>
-sig          D84E41AE 2009-11-30  Nick Burch <nick@gagravarr.org>
-sig          D1F99590 2010-03-18  Josh Micich (Software engineer) <josh@gildedtree.com>
-sig          B55D9977 2010-01-26  William A. Rowe, Jr. <wrowe@rowe-clan.net>
-sig          3F0A04B6 2010-01-26  Geoff Greer (Work) <geoff@floobits.com>
-sig          5D7BBC5A 2010-01-26  Leif Hedstrom (CODE SIGNING KEY) <zwoop@apache.org>
-sig          1824BDC1 2010-08-26  Brett Porter (Release Signing Key) <brett@apache.org>
-sig          B1669287 2010-11-10  Kathey Marsden <kmarsden@apache.org>
-sig          D01E0E18 2010-11-16  Jean-Sebastien Delfino <jsdelfino@apache.org>
-sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
-sig          6D5954FA 2010-11-04  Eric Covener <covener@apache.org>
-sig          F2F27A06 2010-12-30  Carsten Ziegeler (CODE SIGNING KEY) <cziegeler@apache.org>
-sig          4DCAA88F 2010-11-04  Thomas Dudziak (CODE SIGNING KEY) <tomdz@apache.org>
-sig          82A7FBCD 2010-11-04  Antoine Levy-Lambert (CODE SIGNING KEY) <antoine@apache.org>
-sig          7C408737 2010-11-04  Joseph Edward Bergmark (CODE SIGNING KEY) <bergmark@apache.org>
-sig          791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
-sig          0E371A09 2011-01-05  Sander Temme <Sander.Temme@thalesesec.com>
-sig 2        F2EFD0F0 2010-11-05  Christopher David Schultz (Christopher David Schultz) <chris@christopherschultz.net>
-sig 3     X  4336B448 2011-06-23  Scott Mustard <scott@mustard.net>
-sig          4E24517C 2011-11-10  Hyrum K. Wright (Personal) <hyrum@hyrumwright.org>
-sig          C4FC9A65 2011-11-10  Bernd Bohmann <bommel@apache.org>
-sig          1F49ECA5 2011-11-10  Ulrich StŠrk <uli@apache.org>
-sig          352ACF76 2011-11-10  Richard Keith Turner (CODE SIGNING KEY) <keith@deenlo.com>
-sig          B84508EC 2011-11-11  Bryan W. Call <bcall@apache.org>
-sig          F5CBAE6B 2011-11-12  Akitoshi Yoshida (CODE SIGNING KEY) <ay@apache.org>
-sig          2A239C2C 2011-11-21  Christian Mueller (CODE SIGNING KEY) <cmueller@apache.org>
-sig          0208FC11 2011-11-14  Carlos Sanchez <carlos@apache.org>
-sig          088335A9 2011-11-24  Chris Darroch (CODE SIGNING KEY) <chrisd@apache.org>
-sig          E1303A99 2011-12-02  Marshall I Schor (Code Signing Key 2) <schor@apache.org>
-sig 2        41CEFDE0 2011-12-13  Stefan Fritsch <sf@sfritsch.de>
-sig 3        F51BB88A 2013-02-17  Sander Temme <sander@temme.net>
-sig 3        F51BB88A 2009-11-04  Sander Temme <sander@temme.net>
-uid                  Sander Temme <sctemme@keysinthecloud.com>
-sig          6D5954FA 2010-11-04  Eric Covener <covener@apache.org>
-sig          F2F27A06 2010-12-30  Carsten Ziegeler (CODE SIGNING KEY) <cziegeler@apache.org>
-sig          4DCAA88F 2010-11-04  Thomas Dudziak (CODE SIGNING KEY) <tomdz@apache.org>
-sig          82A7FBCD 2010-11-04  Antoine Levy-Lambert (CODE SIGNING KEY) <antoine@apache.org>
-sig          7C408737 2010-11-04  Joseph Edward Bergmark (CODE SIGNING KEY) <bergmark@apache.org>
-sig          791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
-sig          D84E41AE 2010-11-04  Nick Burch <nick@gagravarr.org>
-sig          0E371A09 2011-01-05  Sander Temme <Sander.Temme@thalesesec.com>
-sig 2        F2EFD0F0 2010-11-05  Christopher David Schultz (Christopher David Schultz) <chris@christopherschultz.net>
-sig 3     X  4336B448 2011-06-23  Scott Mustard <scott@mustard.net>
-sig          4E24517C 2011-11-10  Hyrum K. Wright (Personal) <hyrum@hyrumwright.org>
-sig          C4FC9A65 2011-11-10  Bernd Bohmann <bommel@apache.org>
-sig          1F49ECA5 2011-11-10  Ulrich StŠrk <uli@apache.org>
-sig          352ACF76 2011-11-10  Richard Keith Turner (CODE SIGNING KEY) <keith@deenlo.com>
-sig          B84508EC 2011-11-11  Bryan W. Call <bcall@apache.org>
-sig          5D7BBC5A 2011-11-11  Leif Hedstrom (CODE SIGNING KEY) <zwoop@apache.org>
-sig          2A239C2C 2011-11-21  Christian Mueller (CODE SIGNING KEY) <cmueller@apache.org>
-sig          D3262722 2012-02-11  Jean-Frederic Clere (Apache signing key) <jfclere@apache.org>
-sig          0208FC11 2011-11-14  Carlos Sanchez <carlos@apache.org>
-sig          088335A9 2011-11-24  Chris Darroch (CODE SIGNING KEY) <chrisd@apache.org>
-sig 2        41CEFDE0 2011-12-13  Stefan Fritsch <sf@sfritsch.de>
-sig 3        F51BB88A 2013-02-17  Sander Temme <sander@temme.net>
-sig          D01E0E18 2010-11-16  Jean-Sebastien Delfino <jsdelfino@apache.org>
-sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
-sig 3        F51BB88A 2013-02-05  Sander Temme <sander@temme.net>
-sig 3        F51BB88A 2010-10-11  Sander Temme <sander@temme.net>
-sub   4096R/48BCACC6 2009-11-04 [expires: 2016-02-17]
-sig          F51BB88A 2013-02-17  Sander Temme <sander@temme.net>
-sub   4096R/632F5ABD 2012-06-18 [expires: 2016-02-17]
-sig          F51BB88A 2013-02-17  Sander Temme <sander@temme.net>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
-Comment: GPGTools - http://gpgtools.org
-
-mQINBErx+bIBEADFBcP1jJ1LFue4GUVlmDbqG6fbdE+jYG3ITo/EXLcGfjfOyR7D
-vkdXOXFJ1uzo7NHjleVuu5V+XKrsK1ZIFq07c9eGcqByOC9FOzAZFkC46iuoDM8w
-rhm5x4GeKTPqRfoZzSqoHe43Uqurw3KT2ltQraM0XDVdkqGjh9P6VVY2Yxz3afih
-syO1f2cmWSDnOGj0LmLUCgMa6YGswJh5eD6VvMNGI1NnluD7PCrsgKOp2CUOE+9R
-kzy0IbbY6Xc3hO29EHBYAES0H9e09rCASlQpkqNkZ0eA1YdmFv8oGWpZnPb19X3z
-y4hrbz616toOruKINMb8U07Y66d8xnj0wHbmjdLoZREJb3GnLIyKOHvsMwJueCWB
-+t6aILtGIFHFvvvP7IooVBI7jfLPhjPSPGHeQQf2K9w2X4xYMs+fhedFZMa1LYjm
-mb64TVNvjB5AG02S1yaRWz73kRJ/vhNnKOZbUab+bYlzkb9ae+rCYg8YTif1CKSX
-03PuTs/ccJtmZFfj6xNIcooKs1YY4BvWhFMrjtuAOcXlSmgbooV55sJKbWTPmdLX
-5jZrhs620II6fZ8wNBmb0+97IxC9SzRh+cfe1JPM6W1extE8j+HXnXovsk5FHKhi
-BQwLiLE/BZIDvSOj1cggqVvoWaoKiwbNNbGGm9HO5g/+ysonTg84SDs6lQARAQAB
-tB9TYW5kZXIgVGVtbWUgPHNhbmRlckB0ZW1tZS5uZXQ+iEYEEBECAAYFAkrx/JkA
-CgkQsr68QBUpJK+7/gCgp9v0Jbz4vP0GKZcNPhqJs7MuP0wAni/6duAbG+RPP/2e
-rBXBuDpq1qgiiQIcBBABAgAGBQJLPcnoAAoJEO04c/XTJici+H8QAKt02h69emh6
-ILw95dehF9oCggNwrl2W4JS8vwMNe9v0edroDCknPYtK+5UsikW3d7vGBuHGVFKD
-UDyWxvmT1v5CcJQHGoGLNzQzc3nplPHbFbYdzuxkmJ4aVBeX6WqQ9y6c4e6uQB0t
-APzNvdGW6Oajg/sunMJKeO+m9IROq0alK3DFw9ilVJVpHXmfK29MIj+j+KTOO/CM
-nGrfl50mzRV62qhzV/Kud50qpZSvI3rBP9p1oz9/DAbpsbC2/Zh31+FEXblrE7J5
-TxBedJJqCyDf9pvFi+Xqx2vivxpgx79SjotDx02o+GFka1UWSdKQNg0Vo5vXV486
-o+yTwgZyI89FwvuRaBwEcfA++tTcDbrpaiFd1sABvZuWwDhBt2Oe1uTaUg+0m5He
-20+snyk5nrH7+5cF0r3ocHxsALCNLh+51K+0NIyPLF3VcrYMSaPEdHGbYcAEaDiy
-J0EUR8jj9h/TEF+Yf2Czo5sOLV8+C/CEaHpuj4JCzOilHGGEjGUmeaiagQs6Oj+1
-KcY4ILYnM0MaGqa2p64pTasUDYnCMySZKihdqTTwYLmmCMlSdTiS9kFx9qhUoscb
-Z66FameAzqyfUDezjpExkB4TQLk4eeUPnDnhH9gkXXVBPBJbiBlUW+1ljscCVINS
-kx3Ozmtl2uqn65zPCq0BxzA/c9cJcboJiQIcBBABCgAGBQJLJUYvAAoJEDF8bfg8
-dwXPtUQP/2+nqnjP9eQqI90eCUgDF11nSzPhq/3kGBEgdELRNOkhwr8qfnt+dCA8
-2zayHFy2fdwhpCeqO8Xrz6ByBgmolDKuZm6BZvEEBvQjae8nTU6ZWfR19iYUIFA3
-1oXLR+a2soTr0bYF2JSn80gyfALjbqStkR5abHmrbMtAXKdoG6DTBkIVBpjpODN7
-qLVrTi37zxVzqDdBMm2gAZUczsELB+Tf+2dCHIukIFNZrG4B6ttQrv4J3qPfp7A2
-yqYNXMYQwNK4RZ69uzDFKHLzIoJrBDkABU/JibSr6/+1Lp+CzUqYU0EGAiyhdOdO
-1LK1WsyI0Q7BOXNFU2XEijtfFjcHeDoiehKB+5U44meWf/ShTz7XnBUTvhfWrDT2
-L8G0F9XOSU6L/Yu0KxNiaUHX8GCTBuHERj/iiGX4REL1QAdzdJVygeBJHHOJubqC
-8DwKo9mQFfox9jJPDwlcHUix8qf4PCB+RhbrykGLZR7FWJhDEMFC3MXlkZLOqisj
-rfU+tGdDvz6uvHa3zwrYzN7u3q6ontDRkckTNxYCI5TsYazqNwQnsBgd1eZY0Veo
-etjfN3cdGR3sGtLICvHWjm2rqV6586Z3LTLOo0+zPKcV0QXMdo1UPgLHuSwycCLr
-vH9ogos6w+RZKQ/2Zn+PNadik4AlGsJn5NAzeYbLLAfvSr7YjiwqiQQcBBABCAAG
-BQJLFDXNAAoJEIqviNbYTkGuE/0f/0vnfSfYJE5URq0UR7zGmZuY6MQDEe5nHdrT
-j+5tWeatSQTOI8lNHlkUPSRuRv4caN6fBZw5mM7xbUhz6u0tqbO26euazAQVp2fC
-NQcBPWbEHLoxJF0ZkEDctVtYoshajtr9tdFxv/4p6HIsfIf0l4aoQBsdS8jxxJOS
-kN1ZrtYyBMz732OxvScwgd/rKphMLu65iT8YiQyPEVBd9glDVlASa10QOhQyyTcJ
-mfdkGzbYxAI8u5qFDhtWVPP1wSbJ53DGPjkmtG4J57bJtaxcz019bVK9LoY8Jemi
-J0t5Tu5GJZBLxO/0wfGAdb7c0ggws4yIwqARnKxLKJC4dbUVQlE34W9Ql59s3drJ
-uy6inOLr92D4iyKwuMkWvJtmrhwTgUcEam4giXsOGYQIWyHGheTHdwVN7XJfjUgd
-dCVvdjc5tJvA6zrXNhVm1SZM63SwvZ27zY8SgJz3nl89hT+iEaLE9Fp7+YqzdOXf
-kfm5Vp/y2y1qNNJ8nFn9gSHMBidHDwN/B1lGn5KBc3p34Iw047q+o+qi4YOV4VEq
-fHzwOTXD9vADvllRM1y19i22fUj0ke5tT6OX9djHfqzFQvUo0XAHXEL54lvAqoMQ
-11JYreYMKULtI4wE+CGqte4G2Bw1yCzyD5m6FIUlBFwcmJhnhkdjDr/dzOBaFtzG
-27zsd6GlQoPfDCjuE7/3/5nolpRzxrOWzBP0O4AiGOPnnmcRJtmDdDgx/QOuX5t5
-kazagZPkiUr0BFODjskJdFF5ojTx2n2cw3WsaU/55dQxSYVR3LKHLPI6Cu/CmAIV
-7mAJPe2pzJvWsH4xjuaFUTRBsBvBuRxsKeoVCc5RvEizqZS4x2SdziKGZi/SgILH
-GuYDwVRbZJRs7cYNkeQFeqZegj9SzkgITJsWa5ZgoCKZasSW6t+Z9i0fFZWPYzsa
-NdwcH12wPS5ZN4ToVwcjkfMv24zrE6Y/SPHLYYeDvNzbIjbCSxmarYlbwX36mEpZ
-CfwaGWCQ14hDKKgiRuICgsOMWJMeocZHQZnTN6EBv4b8TqHHh4Ux1HOnkC1B5V/5
-MjVsyWvqxRq7i74bk9sm6ZfvqFNHmm0jc/t50x4so5CHqD8KUXmDRf9myFj27tWl
-Br59qdnftjk3bXBtplmWagkOrG9SE/eqb40BzqkBxFirCByFnGTkdvhxZTtbJTWd
-7KBR/f+SEij1P+CTf8iXzj1aDGzYS1O65D9OJRt3YNLLxZWD4sI+Y4ggF1ZbKQYf
-/3NMfWrJvc6Q7HDTPr6D/C5VSb2D0ycZx9ZEbbMiLYYhAbF5di0Mg1d8LY8NlZvo
-nkDd0PrwMjJKUGdlG/IXm+yUOs7ugTxssf/Rml7+Jlpa+Rbju2OIRgQQEQIABgUC
-S6J7ZwAKCRCGC77m0fmVkKppAJ9ZetTyKSx0sBhWwccZAAmRrS8hSgCgqyFAGP/v
-B2RpQA9XtWaYdcc166WJAhwEEAECAAYFAktfZQQACgkQGT8YCrVdmXdQCg//VL7e
-PcPmYCOCu+Zka9xeFZzgV/l0/grgC36IuicZVCa93lj3gmtvTnbm3Fh83avsB5tZ
-DnWujFu3SfqqqRz1VWSwcGdobpQooL+LH9p6jXNkQLVfWKI4giNLzPCP7imWpjy3
-v3x5cRAKGQ9xuTARqTvG5ZZBaeoBOP4bVsZ3CS2LnvfZLq5z4/D3wSLGKsBvsJcX
-b8eoxkqpWVFlIl5LCziA7Eqs7hKNSKhryyvbfjVYROOyNOqhKQJlyg2Z2hfVdn8g
-EGJ5e9qL9vSNJA46GIpnx7hf/1WXdVyohkAWbKIJdjUDfy6/c+hAovKwONacY92u
-7Ly4TyyZHOj4D4wF2q3LJCGAXhp6DlOW8qDSfOUOszT4MAR2l2HyUniP+p21yc84
-cC2OMyFGtLPeInlO6xt2rXFlsfLqv9sdG2Bx+yS2qVa1+KSCmMvnLGPI3u9jT46/
-UtjrnV+HfdH5BiFzfSMLnILTgUAlsg/XeyaZtQt2BAnAZLASD7G8yawoW7elIOFD
-kWoSpA3S8Nu0QZt8VaeXsHW59W+1myojN2FPab2NiGlfCiWtWCtjH/ihYcIrkCLf
-14WLOaTCz7rSxKlMMwZXvwHXBHr+tGDHkmqLJwYtsS/IEUYqw4M6lU3dSMXBu02o
-Yzfx0bWntoTsjgFlcFU9OPhNFceyhvnGqKl7eEyJAhwEEAECAAYFAktfdS4ACgkQ
-VWu/8D8KBLYvihAAru3HWQkjUn0XZzsR9fOFU9Zq3OMdq5NyCnSrtVQPLhhJV9Bl
-euoMk8Y1zsyHljQ4OClWUXV6bFso+a13BmeieRvh0GhRBKY8HldaBaFsIuooPyap
-NOSwoBVsdXREXpecTIhfVgR42rms+GJNvmCDbQnbFLAH5UvR+jLLMoDzEJkCSf+d
-S63FkItHNzbuAsdf76Ggtk9el9N0bFBSt4fKPr8l6sA1PhyPbHiSL30Lie5Lga0P
-Si51YBJPZbH/0Br55Z3pzq5vqTam8RtLl/zN02mD9vSu7Vm1Wi7mYwqgFbTlYG/5
-t1YASu7ovHDui4I503f2+yTkGYcps+DXnLUfceBwUy1u7NgPuOoiotYQKwx6zLJO
-QuDX5upj/ZdQJ6xim6f5g7wOwikEnGFAh7Z0W/q2/lVxwXqQf7xqQLUkDym3Aje9
-519rEmm3/2vM23E9ZkDwVMZjM4U9619y64YwigjEteQ9cvyXXmkL19x3Alxzurwj
-CJnhM3FnFF2ISzsWbVFvbfP7DE8QVzjiflsUD3IqhIyBBtaRQRL5p7fOrRUGnKM0
-/dmUbSPj1Hb95yB1mDBdwP0T/pXaDxD89D1pxSaPpQAHnvpQoCICQT241SCh+60i
-g2GFQXcXdKa+Tdd9ggKeh8i0tffTt69FRZQ5eorS4MOVUaEgTWzPhBkvk0CJAhwE
-EAEKAAYFAktfZUwACgkQUz3vFV17vFpDtw/+P3CRrcBDZs/VHYPrs70dkUp7KC/C
-GKOD0jLOe455FUpk6LQTwH9rwtk+2F8gfY+i5j9+aHqj1U19p5kpU6sOnv0UXUhg
-YgX+rbIj8eSPPhTnj9pP43W8tfdt1bhT655t5VXGdzElNuV0SPLSl6WkREH3GsIZ
-YQSVSOqfcbj15+eWZWD6VdOkvCxOVvGGCbx3JDx9yVgCWpwp0zcO0EeyJYTCcOJg
-7Phpcekt+ek6S65vUYVt78ggdLXmrfiMIOCzc7BtECmHHBpUNlCLMSD9Ms68sbUt
-miHysFQbo4YHLHw97B3qvU4xGhn0lFOrBQBOjv3NXcbGGjvjqWHhtWVq8Fzv5RCm
-UkGz/qosxAgWD1rVGdOUIFX5m8IFAy77/C+OI2gdUebzsxcvAJpfWrl7fMVu0aim
-Q7kT8w2IQsSPw0Y1Uz0vtWQyZQDyEK2YMBqWuuVGA0d+DWa9DRKEDbUTFfnzoejh
-ep+5hIj76fIyDfF3h2SRTfFrsu1luZAyIsuxsryuH5xPH7mxlnNbSStHe9JUTFm5
-DG92Ls62jnxcxVwL3gFPr7jjCazz7sI1sd50OY/TydXflwn6qLy+TT3WODTjfzEi
-vzyqutiEtJDJtXZd7XHztpK1/2I+mLBaHGB5jHg+SV2zilRix1Ud35RTs+HL6J5r
-/0p9bamIRQm5HsuJAhwEEAEKAAYFAkx2khwACgkQ4TYIihgkvcFD1A/9FYpfwTQX
-gFjolMgWbfYCUsp//8CRX1P8r4ttw7u8kkEe4IYpObasVoZzaJZD+89n6/1Kx4uB
-ozPhwmoEYsBAsLtTKMEt0T0U7/ZDD4c4ZhNYVSTbQawn/pcf4jSy919tzMeqHfrM
-0IFwARK24C02BOrRzboiJU+1pXGaL8ivbEv66IC/aNC5B5lqN20bX/imXaj4KKiO
-i9Z8NnWHH+5UTGVIX+f8y1ADkGzs8SxkLl4Bc4AJUa0yDKoy2OpYc+0KOYRjTfdy
-YhcVfdQbd6xDujArpzBnDP1nzHAXdUae+sMr8X0sUEo+8Izoku4Dj/J2SyqQ1tt2
-I40z6cfgOsn36bQUdouBEPm5PL/92sCI95O4ZB8LUJxKySI+AHgxqm4WMMy6FZ3x
-HOyH84+cc340CRNPMUcr85eTrCPnbafId8W4/P7RWHNJRtItmO3tZC82OgujqLd9
-Z5VbsAGgK7E4Q7JaM1bRoCw8C+gSpkSUoVyVWzs1e4FO9UMkJUE4ExOQ3ZEQhybp
-X/fSSrjX5Lz54MUCWKS6ADiQ9PgmmARtGWxIcnkHnAEQy0Ref8EfMtvqsgTnu9gI
-dOObLMPn0a434kppMPK7JCUG5R6xc95sUexyZGDTDSynJYhGwmWX10iWz7jrdpup
-k1LipcVzSi5LmE/efcGJFo4UfeOcfh+wD+2IRgQQEQIABgUCTNsu6wAKCRAbSHfp
-sWaSh8siAJ91oX1vi7kLBJ98UWMKbVKSJL5CbgCcD380dJQuYlUYmtBcVAZNKhh/
-1emIdQQQEQIANQUCTOJSoi4cSmVhbi1TZWJhc3RpZW4gRGVsZmlubyA8anNkZWxm
-aW5vQGFwYWNoZS5vcmc+AAoJEKR9Hi3QHg4YANYAoJjhPnn2X9aUeepb6HzKkP2R
-EJTOAJwMqNSRlUdSQUBfUC93xCAS6sUJFYjKBBARAgCKBQJM0rRDHxxKaW0gSmFn
-aWVsc2tpIDxqaW1AYXBhY2hlLm9yZz4gHEppbSBKYWdpZWxza2kgPGppbUBqYWd1
-TkVULmNvbT4fHEppbSBKYWdpZWxza2kgPGppbUBqaW1qYWcuY29tPiIcSmltIEph
-Z2llbHNraSA8amltakBjb3ZhbGVudC5uZXQ+AAoJEIs6YB8IyXXlWaQAn1tiQjM4
-MyZA2v4GlT2Te9p05dSTAKCRpuwROcbdZlTLygOhH9j0/1lXXYkCHAQQAQoABgUC
-TNK09wAKCRCCeB3kbVlU+gW/D/9Utj7lCI9FR3vViba7MUi3QrP+mIIm9lIS6bR1
-HuhYT8XUDB4QSgPvSsvjz5Z9Iv1w0nAjFJsWUSyLPCuPCpD+v69yUTHhI8r7Td4h
-62DcFPW4OcUzhtLjO8lngxRcFOtnJGHsrDwOFCUsPi/S/8yixxBnIyFmCya3O7k+
-GIVk3J1ULeFxl/6LuVOFnFsoqRdIlQF6H/LhZFqTR8ZvdeUISpZ0jVIwqBW8aHaf
-VLDtup9UeIK2mHALxGmlT+yt5bH9xHSaLi0hT7HKig1P7AiELZplJy+e5DiosLmc
-4ajiIhCs1C+AZPU8LY3trFATpf6vStMnNOOcbRFEaTZpGNWTmHIDtdXOGGPzD/6i
-u0klzQk1UCzxQfGpdsMfR0UAkQfaKcQ0pfG8JKs1zpw2PMtx7u4qjzlraiEem0/g
-YJ2lbuYZ5gJ1VFN2PnTjQae/vmxDpX1nZDluuvPRFZNt/eGBrOOOSSwTQW8z4Qqb
-vtrKyUBK7T9OUkVMxnDi6YQZB0srGIloVYQ75I5dphJOesA4gHRDGyoqFMB9j+4E
-1DrdpEwfmj6cgcf1MNU2b5kLPJQXitydBXKO/FIg5gHvayUV06pn4TVcewMSIU/X
-c+HOjnhX4vP4BpYOSU4bJz4c9XOssnePF2qCzRGZCUCdPRIMy/+7MpABD44Owg2n
-fYifb4kCHAQQAQoABgUCTRxM4AAKCRA/z1Kf8vJ6BhXHD/4zDnnROmQOakmNbUvQ
-rcD+ZLiE/4bXrVyiG6d/BrFkng+wpUZaWPDZMEtTY1xpm2XBkqv+LX4QGwJt/m3X
-279nRauba3rkcn6qo/2352ESfEpF0QG6NzT6GlhCdUSl5kuw2nIX4QqloeuG20co
-R8ffU/nzfnxv5+Edd7NVpuxjJ73kk5r9RWo1yz8l1HTnAruezga8LFwGsJpJB1KJ
-Jp224LWcmnP5Fibt9/e124KldY8yNXgVKdNML9ejElEeAJ2PsSn+el5LfXC/k7cs
-J19/EcIuw2rfYfYphJnz7pPuDqbw2XxII6KLy+JpXNalc1xsDbcq3aqI6Wbtbz+5
-zjJaZ1sXEj+Uky8bc+HogscJYiOAzjkXKpWab4njRSHxCL7pG10Om2oNZuRDNs4P
-StOhbreVHUW6VSlCl95embICTRWfEQ2d3NX73DxhVZVsEiGhwPdb9BA1Sy994QKi
-8KB5SB7jgv+M5UY70Phtdoblrnq4iGaEFvVw4p9szfWdkghCw8rI7HHMkKeU3Uzp
-QWs3niPk61WGseWFjJGrs184dAOTmzWEthPu0hfyaMYE9Pe4gr58jG7GlH7q41kv
-EBczVyS04wPQapFHCVYFhhLfdF4TM0dmW2/PYD4MULse+5ko5ZMjQYWXxEcS6KiV
-Vwtv6RywMOKzGQQb+yK6TycILokCUgQQAQIAPAUCTNLNqTUcVGhvbWFzIER1ZHpp
-YWsgKENPREUgU0lHTklORyBLRVkpIDx0b21kekBhcGFjaGUub3JnPgAKCRDqTcrc
-Tcqoj+ksD/97lFmqIfbJKNxGSACbAoR/CmKLEy8bHLWpPcm0e95PDKC8byDDab6M
-cADwsECHZaKgHizynRn1OcmBSHVrcA8eHwwBHqxV71Ocu5M6IhQ2nU1aW7V2+d02
-8XiKich++KUDqtzighIjvOYTBtuFAl33vdggAY1PEl57UsPWy8PxNjJW0i1VMaGb
-oOw1lnoCgxN99VkuaKrEefL2p9xUp+yBZItEKJEuSpQkbNp8ANkHAhbjJrmA5shY
-IDTlsVqGADMt44cw0ugiQtqDwWjo/bXwZzoFWcC9a8Z55bj4w+atrPzCUsOuKpqH
-q0DU5+SnvTHLzXoreKfdRq+uNvfczRjx1AZlft1hmr0m0Y0yw+oktNRLbZzXUAJC
-5P+PDkKOmb82r0dFtF9uea2kX1gsCEP55dUnKk1Ego/gm68vlxLP1VnaLPRgLpKP
-W/mUsnuTY/7tmGzj2XUhAqwJWVv5rhS5/UaqucgH9nXnaZIrvLS9SWu3LzZ5SLXK
-Pw1ir9YZC1pTPrtd6nXPnJEffNbuhKH8/3A3UIt3NVEN9oBxmJiof9jRBWKyf1DS
-U13aP/wGmCCOiU7gN1I+BLMM3ZqP0WF0Mb6Y4mR6cAFHY+Ug/UjLX21okPE6djKG
-1B7UeGSUwJGcof6PU67dxaJfUmk47+DIQoOb8aP2whFZ197D7CitG4kCWgQQAQIA
-RAUCTNK42j0cQW50b2luZSBMZXZ5LUxhbWJlcnQgKENPREUgU0lHTklORyBLRVkp
-IDxhbnRvaW5lQGFwYWNoZS5vcmc+AAoJEF762f6Cp/vNNX4QANyh0StE9iY6zxHO
-B2/fkK93itUVxQx5VsZ7/FkWs1Um01gRaDJ3so2VYtGJoH6wFGKy29VWj2zNLhDv
-7VUUnosBuasnZXgcjXCW6OgEg+t/fnuNXAHXLEIaqZsZwYgx80rJEMIAW2NEhxyd
-zAj3m1gOf5urOqPpyDKcyB1VA3AVKa/08K6aS2Aa2xIZqt0ghGj3NVPBgRhkB+MH
-XmZypmbhRVZZn6bWXs0lhYdmBruljW2u5fgHJIS7Jdl5yvz3DaF9MizzaHvYBDWC
-3w1hbdE95cTWhPp8dRsp0sbJAzPHf3BgkaAP08e/v4txUmqlSw4JfxFecWt0JV64
-qT2tKotVQrqIeMOgimPJ9ovhfqOlAKBvzJCBZ6T8d9bcs/xThqCSMPaQCh+PiN9T
-7/h8xxfG7+gfGP5fwOOCEOVkKFi+9xMXye1vx4A2qWh1ScALs92GvhMwy1PYoLfj
-fsEgeYvRGtAX2TMKkyOsHQMqDGOdRxb6yFeBMZPQD6SQaNHOt6l2gIqstnTy9Vk+
-I9MUT3ynmSX/rkF7YVdPkDJP6kUAsxI3rACZrZz8gN0SIH8/3+WaT39+OQXVLleP
-/BbkKBtxnopi5De72CTG1ocwJZz00ZvZdi1/DvElLs7ia/5IyNEviCw7m2EQdvLS
-Szl2/Py3pYz1/rfmQkC39FOQ1neOiQJdBBABAgBHBQJM0tGrQBxKb3NlcGggRWR3
-YXJkIEJlcmdtYXJrIChDT0RFIFNJR05JTkcgS0VZKSA8YmVyZ21hcmtAYXBhY2hl
-Lm9yZz4ACgkQsNmRtHxAhzdp/hAAtF/zQVGiDrcSQuuYGU7Ez01J2Xk/9LSZ819Q
-3jsWopdQYzxGCmK+V8plEkGLIcM/jsK+NLAhZVzt7qg64vy3MTQ7anvjYx+1+mX1
-Z0p/g/r5IXXQ73Deg0RPPEtScM7ZanFlBUTniMEkZPt8qo5CZw23MeP2E4fl3UzH
-y1vt0CyB1dOJjsy9XPXLX258ON9IBnjS5s99fKqnCs2k0VFyNkOlsIdWzsvFCoQl
-7URnEEUI4OrrvftxQHouql3x2SxE9K7pIHZewg631W+UXuH72BC02kIXrHixu7yQ
-IE84fLzaptZJWZ9Xgoigk12L40ygMQbc4zbRfoVYGymn/jdZ6W/4TG9ksq8FHFi5
-eZNg+hv8YwFabfYH9cshjh1+ldUbHKE1YbY5TpXQ9wNZOu0XHMsvo/pijcptUiC8
-yvmeP1Ky7dyJb7PkoOcQ3cjf31wGiGP0cgDhw1FbS14g2OI+fng7Ns+9LLOZ34/Q
-ryK+hBLppEdAnLgAvIZzyuydK6KbdIPEzotffoJJ8PfEPoYa7ZHZZq3fJTno+DO8
-mhEi9V2jHkpDZDTNUkRYEIevSnfD8F/44bjvZHUy63T9Hrr+DTjqG2ucCDZeAkaM
-ue/NRXev53RIJ8AHLTUG2dbfb+GHfC/OkkwFe64ZO0is/SucfzHqQArAUB5mo5B+
-RC0o9huJApMEEAECAH0FAkzStCk1HEppbSBKYWdpZWxza2kgKFJlbGVhc2UgU2ln
-bmluZyBLZXkpIDxqaW1AYXBhY2hlLm9yZz4gHEppbSBKYWdpZWxza2kgPGppbUBq
-YWd1TkVULmNvbT4fHEppbSBKYWdpZWxza2kgPGppbUBqaW1qYWcuY29tPgAKCRA0
-6nbmeRSFqOljEAC+JPGA6EtNP7fhaBEuLL2dhgTs4vPGvWivygw4WKR4ONGVEMBC
-QQCxafRxXdUQEjvRTxxdnI/2S7VpGvQlEjSAPkVcwuX+lwxPYb/7L8D78a11AtAx
-nxN16QsDBG7s4m+aBBfjn+keQ1lIdScVqU20ZB4y0qrJb5Zv2hfaDUlg+99VS08V
-ohymSFPEFzUWDufyCC/nJbPnrKZppbBHZmJT6WZm8y0i+oC65ZbRCxaMV8FVRhcm
-iafXeZoC/SURf4YSX5tgI8++/Ydwzxp2wxI1NCxKzsG7sERjLmtoXi9lrDLlWJnh
-bO5Yid6/7EXqzHjcWmUqag6jldJVQRjUR8G7Coj5zUjuEUZRlTM8tllrWLLSamuK
-hyk1q+UB5gDTIqGDpFxj/SvdKeScL0fzsCmnroaLMXtd+QCBHmEk2umA9hb2N3bc
-q2Ht9+zZ5av1RHkNdT0L7l3TiFgyP8cx/qw5of/ZTQzcvD+Nsl3ijShyvihNHstP
-YDeANCcHdRlnmH6fusZGGV9t3H8O1kGIGi2R4Pw6pUDPuO1BHfA11Ld2uCuVbJwC
-+2aG8tl8v7XzSovCrn6cZW5oPxnT724UMZ1ms2ECMu0Re+4T/q5r1N93vmqHj2AN
-Am/Kh0l4xBlO/W4lpVqmZUOsdup5mKQMLQWEgxBYLNgEqimt1u0kP1qmn4hGBBAR
-AgAGBQJNJK0WAAoJEH4q/cwONxoJUOEAoI9DIpUl7gHypVqz0P+tyWxVCrioAJ0e
-WiOrsUygqDUpDl2Nt050piF1LIhGBBIRAgAGBQJM1CP3AAoJEPQmjufy79DwdTQA
-nj0qTVNFNlZowBK9Kd1N00InXD1aAJ9kJylYaybYhPt23ACM6kusl8lSAIkCIgQT
-AQIADAUCTgOM3wWDApIJwAAKCRCMleyeQza0SCGLD/46iT/p9bOgVqY0qvmLztka
-jJsnQt58C9H1iQsNHR/dO9geiDtwBPYI3CqkuesZBVJkH3m+wK2eXILd47tvnq+V
-46utdYMqiZteW1zkKGjKrx6waZvH+WnEKeFMioRBy1FVWRPlVoAPPjyMy+LHP6O3
-hW1As1o98EUO2OeUVm2wB6q0x/CoIBhB3B04Oi3SPB0GHXeS3spWNZ2L2t6wlbVp
-W4OmNZ+iO0dgGmbxH7rjAhjBwRfzaem80sPH6hcyZas6S0MDW7TM9gL1Q28NQT/y
-TZ/yIGRTbus2pIsd3oFtAZgZSLggkQKHMj8RiCtstEXHJ+zBi5fFaF/fJ7+H9piD
-KzeRnPgtzF1uhZBLJk1+LxS1oJpFQziUE1BhjJz+Yo8c1YssrY/6PXXWn2f/FkR6
-4yQ6Idz1bM+oOwQLz236aI4lM5hHTqg4LW1dE7DHO4M6oQC08IArZaOYcJysSWMJ
-RiqkGOMU2SGorMP8toOMyFIA/AtJXuL1sPeCJsNQRdYvjqK9E/5hp876Go8TmwRk
-q13atCN6Lq5Mztp1X6wEgCTaEKjZWZiMEMjMHsltLTxpFrg1Nud+TqqvP/jLTIIV
-MELxQptX1XNx+x4wFB5RfgRI1eSKoFxiqDrdfIoXA33/cAMR92H/TLn+DKrqV+jL
-h6LWgGRLIHlu81YVDtdSLIhGBBARAgAGBQJOvCRSAAoJEAsDrm5OJFF8ZbAAnijm
-8R9IBFruKm6dgtAtNeb1zl6SAKCmy53zCniulyKX0CB9xdLcxnRBMIhGBBARAgAG
-BQJOvCmzAAoJEKvWMuzE/JplVHgAni1gnNV+TXRf1Hgbd5jljJ/pl+sAAJ9jScDd
-4xk3PyFh6u3M7yevfL47N4hGBBARAgAGBQJOvE7tAAoJEC8+XTEfSeylrQMAoKwR
-cQeCGc89oDGga6l/fMmvHar1AKCNhI3x+P3v9DQsIfV8fiRoVIFPy4kCGwQQAQIA
-BgUCTr5o3wAKCRD7Yz3o9cuua4/0D/iTDQFDtOwSW4ICZn3vbmbJVbyvHkqPxany
-6XoUpfsMrwoQnwLCwDYpmYDvPCpORPHOEoWh/rkMyFOdTpntxsGxboi8qgK0hSej
-pVFFyhtVLagmSImbFiZeK0BghhE5+3/ijmv4NBeoBdL4Mww+6+DVMMjAGHM498ev
-m2+nsX0f8YHVxhxFdoLpIa65+KtZ34Is1giL09E9fz085VaJEIjXV9RzgMeAexH4
-VXFkDlJ1tgHZujXbaAiJtV+k/JH3J6l2rGsLQKotb+xxAOdVX6b0xkO6YFsEvAQM
-5zwfdL5eZ4Nm7Krog+wIlWVc1Ofv365S9Qkq3pk75xAAB/lTWzVdrxCTLvOxW5eq
-VCu9z7I+yzs2ykGWZuTV2QozWRREyQsBR5A8SbNJRs4ShyKtrD7yGkk3cKhtcghM
-8Oe4VjhAR7hzrKaTmwASF+Z8w9tQGCqXX7jtDF1rrzxJTR9AkYAorjN0vdmtXo2G
-SNCQJs+Q9sai43TqJODXTSFIMQ0ia0D06Bgs0SmIjk5VhmgsAQ3i8KM270tnBcis
-YUwbHFDNzc+vAc/pRzkoYyn6T8iCNZq/wEHwukueFawO+/HxgmnWpVKcEKMIkt5S
-qlCoOwFsoEo4IZuJeLj0B4rT13CGBylgHj+JwFpEvmNDR4NfJjurRTiM+5Y+sKDg
-4t0tOTBYiQIcBBABAgAGBQJOvF9aAAoJEJqs+1Y1Ks92jmcP/2Vt8wxbMi3Ke0yR
-3l2UK6ExTiePVmbDfny8nqv7Q1TeFhDyHkyc4RhB2u2tKjqq2ZnEKp7tSXFW7icV
-Gjpsz4ZuEzYEAD6tAUP3kQHUmzQ0ZJlqBzsqk3pajTYML+krpv6ghP9arLRGowcm
-Wbsi1+Op6BJZIfTXWqTcIRtQ7VBTXRkFH0ori7tfh7KhiQFLRVOXbIg0koxwrFq7
-j15gT86qvIp4tEJ1POZfPY+XVrcQNBj1gtIEt/iBdhw2p+qH2f5pb6S/sSWn1vK2
-k1SUwqS5GnkWh4jPEgTXMxt5gPx5je6DU289oYNzXgN7DMSyFLtkFe1dCsS0WtHy
-4I69HS28R5kVYIMOnT1Iq7ef9VcdGgVEyWe+46E2O/iXl3jKJfvOJ3vh+lmYpwrK
-eWXeryiirVTPPY9O1vzNfLEfgAklZvTQZ3ypvVulJny/jKkZgJd4uxPj3uNcPwwB
-9AwH/HY06Z3BaC77/IuhFqQOvS/a1lwfXi0WpwEO17MzcOV+tZ2AGQ/lTelGBM2b
-YCBzFDD2PXhDEYhN537hjM+tVYtfdLcZih0Up4Nq13CsMlQjNDu099zaX5Y5j5os
-RPS49TzGHRzbB9e94I1viX65Cm/Wosx9dAcz71T0cFFwNkbH9XSqTPnuD0cZ7EQo
-0dD6CGxu0QmhGH8FSmja7KNf/kmliQIcBBABAgAGBQJOvVKJAAoJEE0VQRC4RQjs
-WbkQAIWh3uAccrqd3pRySW8JJNRSiXQre/OPvgukM/mc46DB9rgdndILZkeiGDdz
-M1Mc7LEB/yCyLFzZstpaVQgq9sLy8bMqkJyIx+a7eOgu8LjV2pRYQtGgAZQqmDgF
-Op9ZRsF4fcdUwRLfl8ZSju3w4s/3mkuPQpGPD1ZbL1ixyOhEp3qUvdOUIrHBBtWe
-Tedv/XhRTBzdd8KOImcnyqHNMdb7U7JSWSdF+CWq9uvU5LREaJNvV27+dtJzEGXT
-d1/SpPDhNR+9AYsy8Y3VhAQLZFB449fnTvmtqANcXM2PBGOm6jN20olDDswthg7n
-duK1kfJ7TROmMApAFR7+k/zqOmD2dh0pJGg0wWICW0Q9y4a49ffP9hTiNPCUCEBZ
-pDN87GmE3BkmTy3bVKeKNfyT7wLhAneGKFlJwVX4f1eF+V3n5iGow+Vu5XqjxffN
-HErbVykamVff80BSez3N91v1woUd3ky6pZP/pSY9FFA3XGgutfXGRNYKcMxq5evY
-UhPbaEsz4ozdD1VjITP9XcgZF5+K7rT2M15fMVOlN0dQaBASKSJjpy8gq5lNVyYu
-kCd4Q2a64KklGiDKISEKquijVg4mMmx5JMYKLjoQj7g0FkKAC+cwn6LRCdnhqFiB
-/f3+fZi7VvZxY/Hia8xzeD3ak5Hs+4Inj3CReZrfCxmKDlSiiQIcBBABAgAGBQJO
-yst+AAoJEImh9lEqI5wsaK4QAMBTfRkRKOryFif/5XBkPDYeMW6UHLwratUZDfHp
-CZXPGklGJwdz/H44WgNkklmuxmI1DRFkTQf4LzEaxGOnzLtBVDG93WLPOZvQfuVi
-7wg4J0HzybQwqwjWWMOSEdN100rdvoC2AFot6VdbxrQT30ZwK0qqd53h5GLDA326
-QTOXGRhi4Si0FgNkQq1++V890Yp03kXPFOiN6HiD/s40NkKUzfYD1OvYYK0/R9qD
-55arUx1nuRerEp24zTNOjT+33gDrGrCd6l/ieDMkgRCdh7G0LN+gHcjUN8f56/oW
-TfPHzeNI1RA4hqGn1YzSUXgZglO4P5RRMobs/FdbVLFIu8nFMDkDQB9wIHc1xPGr
-6cj5K4uSYrgvhXYDDGutA0GSuEvU7M3T7bwMEAIdql+oyYswlbbhyI6RIvIJx2PW
-GqboBVagx4wqvWCjJjZBDPmQG+pTpSGtwLz+HvLHZ2JczpKJmuox3qkaJk1gAUDn
-yvf7Mkxe2snk8fdnhkgTBb3dG4EbYKK95/rpkiqW/SN71ZbgFkmBkyJzWYhR45z9
-0aSo1oeScah0toTYGb/8BOq9qP9xVK1M/ZxGVQq535NgZSXBBUhP0RAg0Xw34FgG
-HVs7n27fClcAh+BUeg9T2BOdONOyFzXAN2rUJsj05Mpl50S4f5IRbfHHTFljq1T9
-PmbHiQIcBBABCgAGBQJOwWQKAAoJEE68DJ8CCPwRGAYQALDQI8RGxyBY90UKBnwe
-Q/mVtUjT9BgL+DPJ8Vmgk+AldFyStiZViKi1DGNzkHE1aYj42yZLdp55W/SfLgM/
-moXtz31uCX1t6eCds23JKxp1YT5I9GOsaajYL99vRMXhnhrYpSJ2ax3RYIEINv9o
-dAgb/QQLHYWfzf7b9luMx/sYV/ArweW4UMqsb6cfF1GgwvpbMAHBqp4JPr4BvYdA
-Jn9U4fOK9RcztS0r/NTBbiWrgU/WKVOkyr9gTfYqktgcpQkI3UzOb+g4kWv9BrDj
-C0+VQ+cltXCN2HMurTLQL8M0wKGeqqVxFk095DHlDDuKOV0dLC8eULnx2UdAWvdS
-Pkn5ohN1hVdEzLwsp3bpHjqj9yoMiyGIBJcmnEj/4uJyB1Su0MNQBI20A+zLLONu
-Ii0zLeLoaWpq2HtEFA8CvXNfMfpMzp864a09PtRWOQhdt5pHMnDgr3oWmJsWsPow
-o9ah3WMCc57tjPP+XvGYqbHD0KrKmycOJuNidFI1UVZH23afyPG+IOAdGDevHXiu
-Ue2UHGH7UJmsVZO5dHn3yUzoSoMMhRW+S/CpGKVX32VizoHgPzTCqrtaW/lnD6uS
-aMNuhlIPRMw3/GOrTXzjb+pqkkRFjHiNL59eJW263L4E8guvCUMmHYy6pltkiX6y
-GDfemnN3EKCK5Ut/sq9Sn9j6iQIcBBABCgAGBQJOxZdAAAoJEARUjz2XyHeQojkP
-/0nUKMl0mR48juHl5c3vGp9mt+rtfqBABR4+OeuuysKhX+0T0OtW7M40mZEJB0YW
-8bxT/2HH5IbitMmgSLAhkQaUr/XMWX2fHFfvzMLwZMmRtaIjB1IKE3eZgraUpmZc
-weeDGZxqOL3ROKhZtzLms14IOWkERhRVad4oj5sAKV7hJf/Q8Gep+lDmecVST/Jq
-ucmKdbGry/0rLVeRp8snbKygLQXrohRgATyjsbP3ssXU/Tz9ccWvu8Npb/rbK6aV
-rbVcF98OcaG55QimUty1eSq3DmVk1adcVe70Sj6OL+UACb9SpLI/AnuOgiwIJIHe
-pVs3bM9FH4KzJ87l23JQW6eKb1F9dTOwjTpgeaAHGsR7KVl7wyF45E5kOOt9mT+X
-CzRGnXVmnfaBXT9wbDj3kUvSgmRpX/NWCVCTqK9PGUwIkqD4pFYpwjH/BwB2m2Uk
-eGeLQWlVFf62+GXxkAbTzuBTgQSAY8kISrUKIiKBbbXPk7+HGuxXbKCa/SD9dOEs
-HWVuiiqYx4260PyeXUJRx/uKt8ehCQ5l6AGexIH7VXHNfkZSNQ9blKRHP3w1DxOC
-tqnMai4/+3hxEzRURB5fymOultmhEWbc1wkR4TjLq8hlrNUECf8nx50iOHelYPY9
-TDHcZlKhYj4JgVafwpBlWtJGRHcAnnRU+X/7P0D/5k9SiQIcBBABCgAGBQJOzZfR
-AAoJEPVP5kgIgzWpUr4P/RF+F0RPzARKJgm9zdY3V0lSQyEKIfHl8G9f95vWcIxz
-Vgb2W+eg80d5b07jalpvwFsqtsQqSDZH/REu0bZJkHuHCNWaKy1St7FvN+y+bv2C
-4asM35NYvO8H41Jmjex+2pE86mDI7U6NRMiyzq1Vbx+PKhq13idgGhCR5dnaX27R
-hHfjvfL7aQWIE1QRYNiHl6TAjmSTVWfRIJBZ6QB0ldw7CVbNnIoNhOd9gU4E48jQ
-rvBaUwVcQddesw0CfnxcdywvH0svxDVu0KImilfWWd+q3bSrtXmvIMDgAXoQ9mB2
-Es+IAgypIrD1+O7PDMCSu2o5MLTRph7+0bjFYUH+eh47T5OMrMhGOSArkalROzZ/
-naTBkMXsbh8QJEdrDJiZaomyQqcksF4SXFkEWBOVnKOWxOR/Ki80TCXRQAaZq/o6
-/mo1DMOPXVMTJrE7+EV1VGcUH5Vw20sL7ZA3WSMngtLYG3VA1ntO4oTrrTtR89Aa
-XLYwAWWJCOr4969eYy/xIeKk0EsEI/tbzY8n+sGH6EhiGM5fsBqHSPeqR0mpJGfi
-IGh5D2EP0fuMBznxYy/9+NVDQ4mad+16UMaV4lUG2TVoVofvVa/JiHc85VIh5B44
-eemGjnQxVfadPkbbiIF4IYA9UC5P2xhnOy++axdxjrAiU+qIsSp7V0C63UUDPwBD
-iQIcBBIBCAAGBQJO5uJeAAoJEMaHXzVBzv3gEscP/0aN6q0nv8z7lEJQdqOy72J2
-oYFCbZbNYQEGJdEirX24wa+Gki8ElQGB9XmupcVejq2m+J/ypPBzS9KKUonLxZtF
-FBQAJmcw+H5rOgFaSq+gyxGZMLmhBSU7RP4oYa1fE98DYlyf/a6zcnCEwyfU0zhy
-Z8cfItStoF0wc0K1+KTa3d4yr+AwYOj/CKS/NyMwPJORjtt4PpE5fo4VC8FQvKZ6
-zwS3tcVXoYciEhD70E8sfBx7rTgNHnm5I8bGIauCcTo2D5WHKq//Qw/3ZdibuX8c
-G/lgIu5AYGSNo8DIkqB1ayr4U6QzRJgSEogcBKfpeJid/jGkf/HLfSpQRnY+Lsa6
-CzPBLNerEVMEXIFtbxyX9dy8UAnN8TgjVc7vra1NCaQCQOvAXq0BKlIfHAnwCS61
-naGN7f74e8meQ596GtsnNsjmeviGaVrhCCeeYc1qL15WKjlCeqAH7JDESlH7Ioqx
-8sg4dofT4yv9tBFWpmvLRhTYnjJvtEj56YsOaEy6hGGI49hDGGte+UbSbQsJRxOV
-P9mM9Rbhjl7RKuREHIFJVhvNMHJ2Ch+2PczYWqG49EPl63I2/SB96+3982JCfK5V
-f52sfZG8kDv/6h1a34Z0fRCJkVeLdrQBmfsaLoLDKioL2cKEtxtuJVSnFS90hlvd
-MCXcJYJxysDNFjPdPBgFiQJABBMBAgAqAhsDAh4BAheABQsJCAcDBRUKCQgLBRYC
-AwEAAhkBBQJRII9HBQkL0jAVAAoJEJu4Y7D1G7iK2McP/jYqrS0KdYp8ljvXV+/o
-AHobtCmmclaZKHr8qOLSIxUcUiRTCRXNH4sn3KGYI4lpJc4y/HAoSPbRbrDj6rG2
-CI6P+VzgLcg0YKzu0vELCsmowWbp2E05F4Gqusyfk7wdjofgCInKLG+6xCaf74hU
-bdNyb8Sr4uo+qkAwHXqeo8SwE1hG1lDlCqhpaHJF5ms2EEyqIZjcrzfKvvvsJhZj
-v8iu1nAO1AlwGxfNVoxzvGTTPYT/PfpG1ZqZVrAchgGwLhbdRx3xgiMznUsza2bs
-7rF2UXesRsjGxfI87PrfEvNSszkyx2uzB6PKT1UwUfvZH1+37LH0/IxTYyRBxlVg
-PpIqp5UX5o3grpXwRSqFxSLxSyVHnhH0pe+2pLpFgR5a0dTx4CS5RBcgWm4Wkoh9
-W78qyumJFE5aAmeZCfKb3uZu9jzVcVi6+4rjVJg2q9QJzfbyQtzHwbF3I2+FcEv1
-hcXSkLoRAbCIta2eqRH4z0efY0pRXYr1xHM54J5JU12bGj4oDqJlKMy1m2hxlI2S
-FW95/SaDLesl65uuz79DRlwy3Q0FqYaUD44XRtQ3AGeGltvM+kPPRO+Sq29fzcQ5
-WzJU3A5yYmUgG/jn3acpjhO1TaHJvQEMXZEPR8b4nRoGzosJgTKH8A9lQhqCgxOV
-kItTt220wNwVbiT9z4kX6B8diQJABBMBAgAqAhsDAh4BAheABQsJCAcDBRUKCQgL
-BRYCAwEABQkFo5ztBQJK8yZuAhkBAAoJEJu4Y7D1G7iKgK0P/ix3+2ytJxlD55dQ
-n2Tf1nQ4BiQNn7hEjL8j8n2OyZEWIMiB8pgeQmFDaiwBQVhuadsIBO+Rwp8bhZ8S
-Ah1usxRSEJfNijMeVIrb1KHQ61XxYcRHCYViFfB0v37iTyIyc0y0tMyEvcjav5Qs
-cEMH9HGPnKC5P5z0vXwZJjG/ZwiLIw4wNMA/1xMY0ubifQC8RcGMQY/2VAn2Mo8l
-5h7081HfrUG7hDGkQiIqLWeZehbxRNBqXevrqzTnVQ87Q2Q8t/xQgjbMvl6T75l9
-rQqM8LYMLJjdlJyRSFmozy0fACrhhlwSrJFXfXN+AnQed57fHqW3FhxolDTDf7OD
-jczt17rLoCq7AZ3o8iF+9FRaQES/LgeJmwolpHjPMsrz7HJ1h69zOBbEZJuNDkfm
-TN2T0cCZWA1cmRaXRVv2I4zUBmBEn3R5HJjoWmcpVx6vMAG1WMtANWSdaqvZHgB9
-zbqWL76rafMQzstl5q3ZScr7g2E2Sp0F4ua+iH3HW0uuZOZMYjpkjGO3MXD6LcCW
-dZ48PjjJZWIKYIEhf4GtTl2fhi/hSYJybGsytWOg2qlATCEZe1N3lBHM/VbUFQYE
-0GH1vdhnD6px4zPGFMY0MBBKKdmCSJpmY9jaVnHJEgpUN1BCqtqusFOolqclbe+y
-pxTfL1SUjhQSWGfYMAzs3923/3S8tBxTYW5kZXIgVGVtbWUgPHNhbmRlckBtZS5j
-b20+iEYEEBECAAYFAkrx/pkACgkQsr68QBUpJK+GJACg91JqNc2mEePLqAJL5nZf
-cCIfUfgAoNWyrSnCEhKRTzOhD1BxZ1G8zajDiQIcBBABAgAGBQJLPcnoAAoJEO04
-c/XTJiciCawP/2zNbZ/O2YuVMT8Jyauw4oC3DFi0QN+ilXjCmDXRPWoff1aB7KIt
-GTbss/kmRZ4yYUwsN65g9/39R/uR4pV6aDLAGHky+3Rbze9eRJeZZn86TmFWXNjk
-5hgPgyu/RRMxVW0ruYWguskapzlZW8GG0jvlMOzRxgN0gR5m5cT3dEUyo/Xkxx+I
-1Dsd4FDwy3hT1fEMi5kFO1gcxMyoXYGOliSi5v30tMHdVq+gTpukHZoIrK5h6caR
-nMz3cJ4pooh9KCtTDT5MwFB+R8PzVocKbZG/DiJTyFIc+g8Bo/+YJtxx2+4wVpKi
-9z9Be6raL5BHRvmuIPb4OerbR2VPk5nrPu2SKCUUiGy3hzTQDupd7XoAlFHA4H8G
-Z+WRAASEqHlhmAL0/1j2CWQwd9iViNyJFmol6EDwAYgYsNk1jQf+/p3hphpCk0E5
-MCsF+/pGajM+w6oy+aTbCCxKawWyXJwVBxo+E9eljHISqeySYPBRzOKCkcAnmxzp
-xFqmVH4N0BaowYeN+ta39k1ielVzGbUPdx61hxqM9UHbrISnYhxc+3hGoAt5pUvO
-Uns1QiKMZux4qpu2hTeCmGaoBmUcbRCIodmpAvVXacfBbTUL11D4slxVxTslruNe
-DaVpsmUwrhun7I4tdheoaiau1KxvTTKaCFwA3QGAIa+M6R6GDRUQFrTIiQIcBBAB
-CgAGBQJLJUYwAAoJEDF8bfg8dwXPyasQALVodGpN983ope5ZY90q5+pmfbbGQvej
-DL1zPMhCkJM9TJjEtWVTUxslli6gEkZkzpQULbr9uMEsCFv3l0BsZhPqAuiFCyMv
-6LxJGs+TRS6q11Y/PiySR2vMHk4AYdx9ixQDB26MVlQEUrYe0rQjiCjTEO0D1nJT
-VpZlynHFLLNuG1FpVPLfRbNNBQGrMMnNdc9eF62iXm+Emy5odzUfKU0hxRyjyhrf
-NQqSuh4FF6fbsNGJpsPX5ca+mmMn16A1DQ3jvLmwHLn/GPhTozwaNKli56OT6Zu8
-AY730hIM1fANFoPGtuEdI/2QDy2obRE5jcWX1/U7t5DFMO/pT3fS7EhqPhWcqPqO
-g3sFeXVH29/Q1hjC1UqOI9qD4/snPaFVAei7rP8YKYiAIOIBPiAWW5nfiC4BFhew
-kQ4h1upl1ZD2QGKOrHB7PAqL4sYixw+R7SWIkeVDSTEJmq/CxmBM0fvGVlk1TQbR
-ZGqnXSojgA9sP+ZQdZy+NtPOxx6YpNzii9Y6qD9Fmu02F3d2GZVAmvaUGkSz2ndY
-arCvNhf/Z+uUlkEn20KG6o5n1aqD6t8hjD5izmGFYcPl/wfVugqOATn18NH3hp8t
-rBGZAx68ZX4nS00TLnmXji/gvC42hZXbalDm3l6p8w2/8oWmK5Sblcxq/DiCeovd
-zVGsIXTDcDDDiQQcBBABCAAGBQJLFDXNAAoJEIqviNbYTkGuR0gf/1EbrQHogVgR
-rJT3uWBsCGCarbG0VAgJtjhVAA1jX2TnLT/LefbPlrJjRtrOemuOncyO/qcc/1aC
-IVdSnIh9HEKqabIQZT9RjQCKyo7wU7GAEW96SETudwJaRQn9by2dZj8hOoxSX+lx
-5IHFsJzGE4dAK+OQDQMt0bvHvsS1EGAibYdcaCW8cNoUtMMmC0j5WqapV2arOATX
-Z0p/go83rRCPgBQ8Y8XsPBJrphjpBhzV7YE7P75nzf26HuLHWQmVN0vDEAwU5nDR
-PppBARwYXE/zRGQMTN0qHdNNhyP/FRFocTV8Z3hbE/7u9+l9iNkPcQWg3KbHTWn0
-1UioCxFTCU2CdJcK/9ayuSUOCOOsmnNr3mNw8fEP5D16QwQGI7IPoJwRr4sCwa1t
-mbx2QxVGaNI6Bo/uLOvRDwxnCkZNNT0tu7eHujFsvivk+dNRygxEHrW9eiKCzzkN
-hoQYCc3Wmgw9gTExcIW1JEXWW2ILsHXd1O8JD3aHjtRm9vLefNzIonaZRugJNC3w
-NBb3cD5u3fkUuOui9ydjfD/Q82dkfDKIyr30T5bEhrHZjsjH9Bl/LMAwoVKGwXTf
-n72v8tfoo5CzuKVlEgnpRVQ+uKSKfN/YL5Cb/3xKXpD/EgGPMO5pnQaSjP6L/eIM
-618Y58x/Tn1fz1jc0UR1zCUxLmogkGzaRyBHQzITkoouYJ3iM4VJiiSI4S18eFwR
-ZKQSErneYwCKUYNEQRT1I/kkHZV1Unk3m5rcD6JiS5e/Oihs6xvPZveGG4maOQo8
-NIEoPjwS218SJVQFs5TU9aUSF2BO+PNfrTDt7OMDR5ltqRvUd7iWVjg3y0LFluz2
-D0Z4E7movViMdS8UgKC7OSfKuhYubZ2BxDln//djzGQvCrRdAbNOgNa6pbldYmIE
-iaxEjamCGkTPuV3EjdQ6we8H2WpMUCzTQ6L5rUyaw1Qq+8UlW4PFLmpcYkj9+g2V
-v9zQwH81iqW7w5wOrqiMksYacKIX3NM2F1G4C4Aj/cQsnQ9EuqPufBEaFjhtSUym
-aQefv7zSG8u3sL6KVg0+CMnvGrjNEz8vQBWDcOC4Pcf77oA0Ao7l/me7bsxKO9Mo
-5k8J6bRPoTjVo1wr8lLe0FViU1LGLKVF0SmhqXh8yT4YkSsLAHiYVcnYFTcpS9TQ
-dC/VknQXzOSXA0Z4eNl4uEKnRQ9BsYkfQc4afYFU3hQ9Lq7ul6GyjPMf8QGNF6kJ
-ZpJXPgI/c2g18uFmH3zE9jTElS4qt2ioiFBUr+wvu1QFi9nTeYue4to0KcdLXzQA
-RCQUJV7VeLUbYRCgRjS1HYZoJVUI2gqmuY9pHBMNJC2uU8jBkg2yKoahc/51LE5l
-r9TO2gBiwmaIRgQQEQIABgUCS6J7ZwAKCRCGC77m0fmVkLsMAKCuDuZOSIv74T0Y
-TNWdr5+J3ICV9QCfRCZLEvW3RJ4W8gHtKfmiDWIl1mKJAhwEEAECAAYFAktfZQQA
-CgkQGT8YCrVdmXfJOQ/8C7/g0FEt8NcQHuFRkbGrM9W/CF8rvocsDdH6e9rwLZAv
-shkVy+5OKruN9IYsSJDXNu8XK5S+yAGqp2LH1UjP+G2dDzW5vh3AILfTW5SgJlhQ
-ygTIbKPWKMhDwtQuxlj13uj5mPpUIwQMU4WTgKcpIzhihGuqdUvuQsamUpeL3NLE
-JcHYCGRo47VAWnEmTiI1PMAB3wTmI4e5x7NfftQXeTPaMon6tA3cNkt/J+xxeVJo
-Z4Sv/bSbD2pMa2LU76JJ4C3KQ7QPSTgMMYTBkOEkyZYsoIxYbM14TpJka+9mUDBZ
-7i4oDg6rbngzN19FsV9psTsCOE9tFcLa/bzBqqryXZ0QdNK1XNYz6j7jxBmAy4fq
-EEPRS1qfFOrc5GT7g082sjEHt0W8iosvNxKPav/29DQnlhyTkPu//lzBOHR3qdIF
-7f2b8EkxPj7NkpTcgdFWCvQPFVzTdrByEwvjMARVwdQRkr86DW+d+iPzm5Kr+ZBN
-zy4LUic43u5PU9AUvTbMPtJZI8qpY9V4i/F9E8lbcW8THs/6oE1aIh/TEzFFGEdB
-TZD1JjYHMjJXCGTxBzY7vqXfdBtc3v4t+hXCK8HOsAJC318E8RrIwuPXV3KENVI/
-ds/Jz3cLbuZS3S6olf+3EEzo/xlc1wuwK1Rg1+/uoCCSzvc0DtC+t5K0xVonNyeJ
-AhwEEAECAAYFAktfdTQACgkQVWu/8D8KBLazdA//UkwKVnNaL9QO4h6plQBFsoci
-jpQEW3tL4UuPLa9Q0nV6X1NZKdsBK9HFuMdnjkksYByDcknYqFzOcOdnkuYBh5Fs
-2LlHx+BkJHxAd23cbC/KJyovx9e0DkxFkAJRfu0db9pCxg9m03v2Jp8FV1GChCUe
-xnbMQjT1HTH9AA+OEKVGc8V2AFzzfEqAfM5T8ex4SGBadISLaDjVLnof0F5nw0PW
-ZIWhgQnwS7YiHN2UobcesflijE6Vaf0ZMQ/sEEe6wuNxFUlaQlzulXU9YES32GTs
-dyC9HM/mtQQDex7O5prTxRFJekDVjE1rZ+467Pa3fB5X6naZcUa79VgKp8VJUXHK
-wBKVwer7vnYyPUWbNFkAOiXONRGSASsTpP1cBIbMs5Hp0LPJDVjKaFzDXRb8cmZt
-yxlEHWVyFUvk00CD/ykmJZ9mPD5jrsba9ACHTfB4CJkzd5wEffm4pw0GThiuSmkJ
-7DMI2K6OAUl9/bbGVWdvwZEPEeffvLbPHfhTGxNjw9QLfGFAwnOdw2fnEhHmuq08
-/Tuh0+nHqFlCr7sSTjbCefOgeKDbMaZR3bXTkGZ1aKZizMx3ZVSuHjD5QKkubNkl
-zVhWIxpW5BRroHVQgNhaROR8jAuR13ZVntZde+QgmnpirPQQcYesxc05Dq2Vda0f
-23MdVI1XoeOmWSUroK+JAhwEEAEKAAYFAktfZUwACgkQUz3vFV17vFpitRAAldOr
-AktkrVYn9HkaokKTjsFCOCNWpiGQelP2XtJrYFJqNs0kzxtefA4FrWN9xXCwJu3+
-G+zuFU8NWKq2UB2N/5BrUVPZFiZ889KjtC1j9x7SJADlayZdNmcPRI1g/nev7jLO
-gUec/Dyh4zDxxHd2FWuRNPERfimpiLJ7UMxSsyxgDgUQHyu9g5ULB0t7wSEzEB8J
-0jqENr4qbbIrq+padIjMZlKi+dxkvMDaEIcm1juley5ePehFDIUzRYmv8C22wyAX
-QUsL6hvR6Js1GOAg9lauW/JMJeqrhkIeD3A7pIT4E49jqc6UeqDk6Ix1Eh/7ZgMe
-Br7AyctllxJbH0fDQiTV6vuMXAa33f709leXhn2PGXkXI4OEVyxQIKOsLBOJdvWY
-MB5Bt1mN0T+sG1Pktop/ZDXRdMAzbWHJDxxWqIRsPsz1NBebzHw5B97lTp7e3CwE
-19HOBug6R+dv3HzLbCiWzxjz7hcIxBwT/KsSvpduUqQolSZhro1UhQt1lWuTPT/C
-qXZQaW4SJeiKYpgXHK1w/sQIMWFiWa8BPGFcE4f8qa8W/TuOMhqIODd1e484UpYO
-0L34wwiXoiY09/qQ86YzX2NAi1DT8CAGXu+CzllFdN78zig73n9fnhZE4MDFnB/B
-kOezUtXWY0jIizn71yMyKyj+JDVtSqNem9W3XQCJAhwEEAEKAAYFAkx2khwACgkQ
-4TYIihgkvcEjHg//YlmM3WXZeu87DRwLD61S+rAqK2rHekif6Xb7G7acbeXiWmaD
-Kgoyk0o5UZmIrquZvCKFx3tEjvqpVLTV7rLpy/0S9dlNdgAd+QhB+zYXKNJ97JX3
-AwvWSz6SHOXo873z7ReI2Ph3c5nqYs9Am3osWynJwOv3KIxave8W+7z73xbuyUZK
-pZL2wS2f4Ng9CNDkLIRW3AoeGV1ZIEdmQ6IqAtqFHTgI+oeaKksLbbGOS9TjG0kj
-58V+TcFS6Myf2FT/8Oa5Zd/vrJZBb8TT2YveuYoa1oheoRCW7t0i/olsVMchK/vD
-gJNAHr/985AHi+wbIal/vH28SMy3z/eTSCec339E3N7XFHSzipaUD8FNQy7runfo
-zLgd/l2/omPBfLEjZhSzGZSpcnL9xlHr2M7iTVLiYBgGV0gXVT2V6f3jYfHUtBbK
-neu7T50SBXX5I6r5YlEnjY7KSbOm4ixNkPRj+ExGMyOg+akcZvNBPinuO5I0XbfG
-YQx+XqN3oD/3c28dGbL0EXUI/zb8yG6MAfbZL9vmm7bBCB1gExAcLi/FHcEd4gj1
-sInQD12QSZxJHpxv+ctJPDN77RG90fqqfoibsxGHX7tOwQebspaDK5DSU3BrzeDB
-0flWBIZCC8aabQbUfykvRg3U9eopt+6Ny14GOrg1++WRttTnHASiCLkPm9iIRgQQ
-EQIABgUCTNsu6wAKCRAbSHfpsWaSh/1fAKCFCR55YV97JMNHT4Ezwe15hIq0kQCf
-WFcpcUyo4ZpWZ6Kh15b5rnxpmzWIdQQQEQIANQUCTOJSoi4cSmVhbi1TZWJhc3Rp
-ZW4gRGVsZmlubyA8anNkZWxmaW5vQGFwYWNoZS5vcmc+AAoJEKR9Hi3QHg4YANYA
-oJjhPnn2X9aUeepb6HzKkP2REJTOAJwMqNSRlUdSQUBfUC93xCAS6sUJFYjKBBAR
-AgCKBQJM0rRDHxxKaW0gSmFnaWVsc2tpIDxqaW1AYXBhY2hlLm9yZz4gHEppbSBK
-YWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT4fHEppbSBKYWdpZWxza2kgPGppbUBq
-aW1qYWcuY29tPiIcSmltIEphZ2llbHNraSA8amltakBjb3ZhbGVudC5uZXQ+AAoJ
-EIs6YB8IyXXlWaQAn1tiQjM4MyZA2v4GlT2Te9p05dSTAKCRpuwROcbdZlTLygOh
-H9j0/1lXXYkCHAQQAQoABgUCTNK09wAKCRCCeB3kbVlU+pNdD/9BM8Oi/xVaeuux
-DQ2Mf4Smv55ZTI1D4EC/BA/I5ctWkxm/xwEdJ2Hcd0Q6aPTNQlJuhzbnwRmRU65j
-osF+NiK4lI0EfV55KP+HEO85v3IrjiO9H0xoV5/L7NDKHaPMEXP7RKMiiw3Ogful
-u3SvzH6ZiOZ4ZvvkkFpMsiKJaeKIey0S8IW+CHDdFbbnmNbhsIyPv9XgHDii94gv
-LbgtL/RaKEV4Av3wpYuCd8GlyOmiJlGZ8Z4PNwpRmTB5h5DJGPzDq1jPlBf/9avL
-ukhgHWqFmGjpbRRl35mL/d7LbAramuSYoZREiP1CMLPbKMWxaYuT4f1Q6z0ykTNa
-8zVQfeP40V/L4QtmNrkfgQxKY6TRByckBupsq9p8AJUZj6tj2csXPCm0REyBzkoG
-ZcH/3PV2sCa/PAd/v+uJCT+mYwNdUvHImrG0gcwqgj4laewxB8QUrl6ghFWNsjvL
-rcZxAX1qBvPftM4Mg1QihVSPOl9HM3kck632Y5DKAxgS9aqXk6Z/hvQ+i2L4PGKN
-U+ubhpClk7J4aaLLr3B3vyTmg7vZb/el/fHyJZ5O5qh5d9XyuTjINSdSisMdTf57
-UldOjJlnCg4ij3Y765P5EoTEIa+5DLh3sHiX6VM3kHQAdJ8Fzg1dslxqhcmPVvLC
-p9L8UJcqrYqMgSN6ExYP/rAq7gx8k4kCHAQQAQoABgUCTRxM4AAKCRA/z1Kf8vJ6
-Bu11D/0cu/nu3LDNyiyDSPKd9PTkds6o3Oa26eqHTZ9CEgjdJktqbZ6qIGaovcD7
-oawiHcBWC3GY5ZhV70JCE2gufOgBEz7pQGMqNOM5WiUowznwbJIJnl75KbHC+6S7
-T801HGkOdYY2Zs8zLPGJ/wzK2oYGqWgiQrlKUyMBGkN3bFPPPAJ4fhZhkY3Qwyz8
-j+D+CF0QGWlnHtgMef9mN5TSxtJoVRDZnK9voxvW0fP9Ro2z1fLzBc9zcvjTVYk3
-2c/wKSFto/ANgqmlHo4SSuDNoCqN8VRVuF4QBpdc9Hf/LAJFq5eKMRWWB3ABVEBF
-2WygXtDGsFBb1P0raXJAC4RkmlbRqp5KiTnYATlQ6d60ApCIT+Z8LewrREbcmJyM
-5MAH3pVPd+OhtTnSXNSHXfGak5E7LSkCnchV+NoaHPXHy0tXC3O3d8bkWk53RsjE
-OCtCFWPcRVdWauNQE78SqP0VZqeLl7PDzMe6MFV+kB5ELg+LR7UtLgSbQCmJXpOe
-2TDPl6on7Q2kOvT22nUQLfuaoXvwTgW3NgIlizHSkiYc+N/iofTFfJbv+scZj7Km
-PnqrBpMx2sdxDrYowTvCd/0gsgofH6wI1Grd8YhBMuzIZ5qDqHNvXS6P8ClhzZQt
-TmYBKa5C5/2deSmOwRptlVWL95mhYNvHabGmIpdZkOlbtSRmOokCUgQQAQIAPAUC
-TNLNqTUcVGhvbWFzIER1ZHppYWsgKENPREUgU0lHTklORyBLRVkpIDx0b21kekBh
-cGFjaGUub3JnPgAKCRDqTcrcTcqoj+ksD/97lFmqIfbJKNxGSACbAoR/CmKLEy8b
-HLWpPcm0e95PDKC8byDDab6McADwsECHZaKgHizynRn1OcmBSHVrcA8eHwwBHqxV
-71Ocu5M6IhQ2nU1aW7V2+d028XiKich++KUDqtzighIjvOYTBtuFAl33vdggAY1P
-El57UsPWy8PxNjJW0i1VMaGboOw1lnoCgxN99VkuaKrEefL2p9xUp+yBZItEKJEu
-SpQkbNp8ANkHAhbjJrmA5shYIDTlsVqGADMt44cw0ugiQtqDwWjo/bXwZzoFWcC9
-a8Z55bj4w+atrPzCUsOuKpqHq0DU5+SnvTHLzXoreKfdRq+uNvfczRjx1AZlft1h
-mr0m0Y0yw+oktNRLbZzXUAJC5P+PDkKOmb82r0dFtF9uea2kX1gsCEP55dUnKk1E
-go/gm68vlxLP1VnaLPRgLpKPW/mUsnuTY/7tmGzj2XUhAqwJWVv5rhS5/UaqucgH
-9nXnaZIrvLS9SWu3LzZ5SLXKPw1ir9YZC1pTPrtd6nXPnJEffNbuhKH8/3A3UIt3
-NVEN9oBxmJiof9jRBWKyf1DSU13aP/wGmCCOiU7gN1I+BLMM3ZqP0WF0Mb6Y4mR6
-cAFHY+Ug/UjLX21okPE6djKG1B7UeGSUwJGcof6PU67dxaJfUmk47+DIQoOb8aP2
-whFZ197D7CitG4kCWgQQAQIARAUCTNK42j0cQW50b2luZSBMZXZ5LUxhbWJlcnQg
-KENPREUgU0lHTklORyBLRVkpIDxhbnRvaW5lQGFwYWNoZS5vcmc+AAoJEF762f6C
-p/vNNX4QANyh0StE9iY6zxHOB2/fkK93itUVxQx5VsZ7/FkWs1Um01gRaDJ3so2V
-YtGJoH6wFGKy29VWj2zNLhDv7VUUnosBuasnZXgcjXCW6OgEg+t/fnuNXAHXLEIa
-qZsZwYgx80rJEMIAW2NEhxydzAj3m1gOf5urOqPpyDKcyB1VA3AVKa/08K6aS2Aa
-2xIZqt0ghGj3NVPBgRhkB+MHXmZypmbhRVZZn6bWXs0lhYdmBruljW2u5fgHJIS7
-Jdl5yvz3DaF9MizzaHvYBDWC3w1hbdE95cTWhPp8dRsp0sbJAzPHf3BgkaAP08e/
-v4txUmqlSw4JfxFecWt0JV64qT2tKotVQrqIeMOgimPJ9ovhfqOlAKBvzJCBZ6T8
-d9bcs/xThqCSMPaQCh+PiN9T7/h8xxfG7+gfGP5fwOOCEOVkKFi+9xMXye1vx4A2
-qWh1ScALs92GvhMwy1PYoLfjfsEgeYvRGtAX2TMKkyOsHQMqDGOdRxb6yFeBMZPQ
-D6SQaNHOt6l2gIqstnTy9Vk+I9MUT3ynmSX/rkF7YVdPkDJP6kUAsxI3rACZrZz8
-gN0SIH8/3+WaT39+OQXVLleP/BbkKBtxnopi5De72CTG1ocwJZz00ZvZdi1/DvEl
-Ls7ia/5IyNEviCw7m2EQdvLSSzl2/Py3pYz1/rfmQkC39FOQ1neOiQJdBBABAgBH
-BQJM0tGrQBxKb3NlcGggRWR3YXJkIEJlcmdtYXJrIChDT0RFIFNJR05JTkcgS0VZ
-KSA8YmVyZ21hcmtAYXBhY2hlLm9yZz4ACgkQsNmRtHxAhzdp/hAAtF/zQVGiDrcS
-QuuYGU7Ez01J2Xk/9LSZ819Q3jsWopdQYzxGCmK+V8plEkGLIcM/jsK+NLAhZVzt
-7qg64vy3MTQ7anvjYx+1+mX1Z0p/g/r5IXXQ73Deg0RPPEtScM7ZanFlBUTniMEk
-ZPt8qo5CZw23MeP2E4fl3UzHy1vt0CyB1dOJjsy9XPXLX258ON9IBnjS5s99fKqn
-Cs2k0VFyNkOlsIdWzsvFCoQl7URnEEUI4OrrvftxQHouql3x2SxE9K7pIHZewg63
-1W+UXuH72BC02kIXrHixu7yQIE84fLzaptZJWZ9Xgoigk12L40ygMQbc4zbRfoVY
-Gymn/jdZ6W/4TG9ksq8FHFi5eZNg+hv8YwFabfYH9cshjh1+ldUbHKE1YbY5TpXQ
-9wNZOu0XHMsvo/pijcptUiC8yvmeP1Ky7dyJb7PkoOcQ3cjf31wGiGP0cgDhw1Fb
-S14g2OI+fng7Ns+9LLOZ34/QryK+hBLppEdAnLgAvIZzyuydK6KbdIPEzotffoJJ
-8PfEPoYa7ZHZZq3fJTno+DO8mhEi9V2jHkpDZDTNUkRYEIevSnfD8F/44bjvZHUy
-63T9Hrr+DTjqG2ucCDZeAkaMue/NRXev53RIJ8AHLTUG2dbfb+GHfC/OkkwFe64Z
-O0is/SucfzHqQArAUB5mo5B+RC0o9huJApMEEAECAH0FAkzStCk1HEppbSBKYWdp
-ZWxza2kgKFJlbGVhc2UgU2lnbmluZyBLZXkpIDxqaW1AYXBhY2hlLm9yZz4gHEpp
-bSBKYWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT4fHEppbSBKYWdpZWxza2kgPGpp
-bUBqaW1qYWcuY29tPgAKCRA06nbmeRSFqOljEAC+JPGA6EtNP7fhaBEuLL2dhgTs
-4vPGvWivygw4WKR4ONGVEMBCQQCxafRxXdUQEjvRTxxdnI/2S7VpGvQlEjSAPkVc
-wuX+lwxPYb/7L8D78a11AtAxnxN16QsDBG7s4m+aBBfjn+keQ1lIdScVqU20ZB4y
-0qrJb5Zv2hfaDUlg+99VS08VohymSFPEFzUWDufyCC/nJbPnrKZppbBHZmJT6WZm
-8y0i+oC65ZbRCxaMV8FVRhcmiafXeZoC/SURf4YSX5tgI8++/Ydwzxp2wxI1NCxK
-zsG7sERjLmtoXi9lrDLlWJnhbO5Yid6/7EXqzHjcWmUqag6jldJVQRjUR8G7Coj5
-zUjuEUZRlTM8tllrWLLSamuKhyk1q+UB5gDTIqGDpFxj/SvdKeScL0fzsCmnroaL
-MXtd+QCBHmEk2umA9hb2N3bcq2Ht9+zZ5av1RHkNdT0L7l3TiFgyP8cx/qw5of/Z
-TQzcvD+Nsl3ijShyvihNHstPYDeANCcHdRlnmH6fusZGGV9t3H8O1kGIGi2R4Pw6
-pUDPuO1BHfA11Ld2uCuVbJwC+2aG8tl8v7XzSovCrn6cZW5oPxnT724UMZ1ms2EC
-Mu0Re+4T/q5r1N93vmqHj2ANAm/Kh0l4xBlO/W4lpVqmZUOsdup5mKQMLQWEgxBY
-LNgEqimt1u0kP1qmn4hGBBARAgAGBQJNJK0WAAoJEH4q/cwONxoJHQIAn2msette
-hgxjatfizrygcPR/2MG1AJ0TfFlSZEdBVOcbyeQp9QHR44imhohGBBIRAgAGBQJM
-1CP3AAoJEPQmjufy79DwrF8AoKX1C2MHxi+3OURgekLqqLhhXcmsAJsGXHUPOxWI
-AO8gWdOUbSan0395mYkCIgQTAQIADAUCTgOM3wWDApIJwAAKCRCMleyeQza0SER2
-EACxkaUEHDutAFu1isg+H4N1+w1j++I4VbbminesbaWRl3X8or0CFeGJD7aFCZ10
-oj1tYwDQ79+lv7Nza7UgbM369lteJzF/uzHy0now2r1pfqZ/LDTegTbDaLx0l1l6
-T1RPr9Z7udWADOG9o2FfaPZx1sKZvHGdBAIQP0QGIwNaesXTOBALELN5YqFFJGw/
-QvZPjgrhiVekV3CecWtRe5F8oYPV2K4zwV1hOzD8t8nmK8U4C++vK6alVC7iQt7D
-1uyMeeX/Sj5wWdXQUo8PKauzDSRO7J786j7nl+c04OI83uij75nckwpKoaSKVuaJ
-1CIiAObWnU4X5qiWXhbO/D1iYDu9U/hbKrcBR6AAgF5UTLd8gc4cmMxMh156OMMv
-fbovNeLiMvtk+I59RMoFXR+M6vrF0IpPLuTD1v0HLvog2FEuBvDbXDeQp0CpR8xC
-VjiLGDNWBjtNnYYWUFBUY8AjmOjmlOKyhVyGzZKY2OFsTRaYHnpoWVWDbxMwdF4x
-OU2WiPp57gvxdLDuRugeyZ7at0uJ9qULzPdmY85ZpQ24iC6IvGeKbvbBRy03NO2f
-kC5QYiZ5GkjIdjMUJUAkBUnDRVfNWfxCt4WWDOj/b2Dx9j+wLlvoYSp8vJMOgzdY
-RCmLP4ILYHestBxjX5XL4/jP/ermAtE3Z1stjHPT0WypDohGBBARAgAGBQJOvCRS
-AAoJEAsDrm5OJFF8OV0Ani98tYfmIfP5XZQ5OB7i0utm+mUvAJ9i4Avj7LjRTUS/
-/Y8WEjwECKU/V4hGBBARAgAGBQJOvCmzAAoJEKvWMuzE/Jpl5R8An1XRpZqcpO/O
-Xhxah6XLsEpOyZwiAKC19goK1pK3aCPjqUQEZeTwjux3OYhGBBARAgAGBQJOvE7t
-AAoJEC8+XTEfSeylBJgAn3BMgHkHaW7aRruEYxqv6DRs2zotAKDSVf9WP7k8QRNM
-fX2OGjq0NY6AsokCHAQQAQIABgUCTrxfWgAKCRCarPtWNSrPdsfjD/9qBA81KkYP
-OINOIgYogWlJJ1v2glEbcICRvuBIOSpFgQqdT9cLyXrCl38Akhh+kO+A2PEtkBOw
-5fDMyENbO3scVOXSIui6SvqDZsTUhcua2jHSWILg1EYr0mWDa7WrbWWcFNna60QP
-M+sjYRAkO0oGES7xfg7mb12vHetZVlv6fitIRRBSXDnx09QrvmsVxj528TuR6l0Z
-p15MgqAALntYZRkgOwajBIlMcbYkFJg4PsOIzV2ucVYruoPaBpjRnh2AON6qaXF2
-k+0Hbt2DNwB1ZrV/CLlpWmrrgWdyBiO/niqxD5xJaYIr0A9aW01cdgp7kwEGvTXZ
-t3qpNr+Dc/Dqgjt94GoEEHJ+ugiifGD+kyox2kXIlNMT38FdorLxmTEPiyAQBDrS
-kQGXmZGW2ua05Ns6ElU5WDLpdqZlOg2GjQY7LHzuXNbILiKleoIMdkc1EmSRpLjd
-IeyGo94V2ae9G+R345KAsmZfP4Yszkb5W86KBDUErw3MY5wye6DdXPZKpy2w9XWh
-lMsz114+xpcJjo1Fv9/GlHSIoeEUBVl+TxoeVa8pjUOjWO7aCuf4ZXk9vfLhIJYw
-WfH9zlT7sTH+yQ2S1PqpfAhrYUNjxy05ZmSHKR0/QfLb/WmIVD5D7zoG8F5pV4uC
-WtMVuOHEId6U7W4/3BSKv2+qaOWKKy5+aYkCHAQQAQIABgUCTr1SiQAKCRBNFUEQ
-uEUI7JBKD/93jZP1q/wInzVCBN0zl5PI3Af9v4q8qoazYHrtaUxm8Zba0EmZlpLF
-H0VfgHxTnSQo5gJfSoN2fi/jcaSpr7hZozLw9eMkEL1XLbGb4LiOlwIR7bRhq+xh
-OTuSSJRi0VWdjaPZOXTnyefnkSgGe9bnW/imulKrto+c63rSfr2pL/xSPOu9wgbK
-fdRuhYQOZcnG39zDhFwYYGbLsriyJFxoc6F9u/5RRURVd67XQ/ZpdgjjkuebpmvG
-Hn3OTmsEnMJQrkeib/S7Oylv1Yhb9QlRIDEvsoOZGeEF/hAvlHDDYR8zAKpfOjSy
-eApK7sPaZp85+BUQ7ciT9Ty0bhMMNQRP3Bj/M6SpsVzgMUmUN9B4Mip7Kr5XDtY7
-CiGf7u212r1MOTZ/o0Wmh++66QI7rw0b6GmUlnJORJz7D+YiVfY0knRgU1dt0FYq
-+qLUjVneqRmp5gfx4+5BWtOESYrITZUvc8VKTOYgRIeD4aJ13+IPhdCfDbWoH7YX
-e8z+lt2hLOE2KLiIoa15XQAI5t0hKEQQt1rYe+nEKB1k/azSgUtLh7uVUhYFJnKq
-3643pTKFoWJIuEUIaf2m96hZiUXFRxXWV3PIa2/GElJpdVZIPtwoliOcUDWn8Jpp
-o3OIM0wwHyuYjFq2rbgiyxygFAIlSZgMJvTnYASL+kUYQYZHWQu9zYkCHAQQAQIA
-BgUCTr5o4AAKCRD7Yz3o9cuuaxSaD/4qIpKpgCw4oe4DkpUlTgJM4RRtC5Wyd98/
-zavht3X9I/n+/rfrLVUgOiofHWGgBAD8U8RxUDw8EfW8ohR+U+u9RIBHUR57VFF0
-zU09F+UbI8m99paOb31vI2EratGOd6kmDIcVgaIBhY2JRbNxuet1bC6fphouPga/
-aUQtxISKwG6sUpWugCgD9oVtg2UhUfj6eH8A6Or4ARu9s5m1JbyDl9XEHY2v8LbM
-joyxd4kCWsYcuwqluE8BoEJw+R2QDra0y2voNcfgGMvnLbJFn1ivufgqLdtG5r3h
-2xnA7idL0jvp9YMXEFbVMzP+BnUxKIOnSo8hTDxfgwkiJbFqlgQIxzmAUjGAg9Ve
-rssFWUMsFs0Bm7gkiNhU76OFt+RdX3RmoQIDeUMUlJ56jvWi0wY1orNuTG5anu0o
-OiWHZAkVeptiiiAHF6sJlV4YeCzDXID6cz8+iVSK3ARlQnvwgzOfJzs+rs9AbtSU
-9BSWQNEaAcG1Cln1pjIeK9GasNBW+xLHxQNYUJWk+jmBMrRz5AXn8jzMv6BvRzVy
-weYosn0DhKuK7LAtFX8mmxPX2JGCC69Q/FYXVEvRuh4iI5P6heppDcEtRh/+oviv
-ZeIrAWLTij200V0t+XVRhAM03Q/sPKqKWN4W0ye2wpAD5RNwaPotS/dE6HhO+fsi
-0HcJmVg9IIkCHAQQAQIABgUCTsrLfgAKCRCJofZRKiOcLJ7ND/9NGFshib9CgkmD
-BG0M48kfXydfV6B/DQdtYRsPXQDmS8slTakrQQRBtNHFyX+YCYKRAPVgoTzn46X5
-e2CrF8Bi+qySJP4e7rP9F3DQG1LqPoYJPBdx68v23x1Uv4vJ/q8vTD3kWdktxWM7
-HxJwJnJCkiitg8JeYfdJAe7pjahN/ve/gMlbUUS9lzUqCmBVRIwxiVE2lPml54h6
-dtDtzKu942y9SzxgkQKRPIkKjN3ZUWHTkT+kE7KOh1cc3SyB9P6A2alm8GoYe6ky
-tmgvI1u6NtUPNMvPycLyWYIesORNwtD0ALzSRDRbbALEMby46xWBNddDR/3TKpdc
-bUFFjoXZTGGnSB/HD6b5fuul0tvzYebnyBzwNppd/WgGr1LeXYDUUohHWs63CKLF
-KH9EZmAYyPDKTIyIstmC5rndiBczHMlkKvPQcXId5QTNVIDS7ze/jRgX+yAqEump
-0Jt2S0V27km3NQoj0VpahzJYn/3xqchj+gRFoc2IwVxcqKP1ouV0Igmy2ddJRoQl
-VbsZ8fDdiIOP0tWDroZhy08lxmeC48YHoY46dqlVV3qOulmj5CwJttsaGV8N6UuW
-uplS7pqXioR+XBSsg4uGx2ht5jS5Ka/H3BJk+7QyUSKyfLbboamf5m9aQsDtuErF
-KsYMy4Aoh/dg2SgFFUNC4k5/oDz4sYkCHAQQAQoABgUCTsFkCgAKCRBOvAyfAgj8
-Ea1/D/4kr5cLC+J58QXTpFvDtem2Yf8KrQDMKm4pb3Abw3L5VA9w+z+AqzhKMwHY
-8WgakY0dA1uxnAl0hSZTg9oAt32vPzRZL1dCthHSSVr9iykWrJ0GPndVcPiJc3z5
-UIoSXZ9kN7HDBk0Fk4o9guWBMPmJ2BFrwsDjD6zW5L3xPzxhYN+D58e6VjRg6YoD
-vwUCLXwm1xtHPGBSM4CiLu8GC7VmBVL0k5x7FeczVaeCIF6uwgLHu/cb0dt7kJaD
-U6VodDOadM3xd7MRwU5v63gwR4JmqH85lZFYI7phjbVhnWOKMpUYYoNHT2Iuk36p
-ojyrwbMM0EqWA5WFvqNvedqwzJJ9GGTRx0zkrgM0i93GpQI8IvIC2QJXZcA5BcpQ
-ggQyVitnxb9ZNnp/YDDeIUmvRVCbc4IYtzwpYEGCESCW6gEFjafYdYyajKEGRmb9
-0/+69YbTBweOdihGMWrqhQpCE5caOj2e9LL0ZgGlmioSBALvfcVvGbte3XE9na1P
-dBFN2osybG+uZXld0uoa8OmSdjL+1LqBRyLIVHyRUIQZLfr+KtokMWK8GlL5WCPF
-i6RZOZcQ/KXWadTb++/Le+6qatmzyQ5B00ZNzBsUvmYBXbX75VeaEOWXelAU1OWG
-erO2SDEPifkaC+pHP1Ud+vH3SjeF3KoBENqBpkEKGUi937bpWYkCHAQQAQoABgUC
-Ts2X0QAKCRD1T+ZICIM1qafXD/9PLM0s0X635yhWfZRFxd8fM4NWiBMx5dgVMR3E
-aq+iXjeNJqqMt8u1MQvYqIXrzm+uOTJ5nBbh0UoWmXO02XBgIWENccgA8wWy17X1
-E/GKWYMFhr8ond32N7+kn/7ftrBQZasbBXSdz0zNFTi7B3ilZnq19whN8A63ctYC
-GNMxKfu31F/Mp4Ukz4oiNsXmBq4+2SLfoR6xZ8xomDEcpRDPu0yQM7q5YWEF9KNJ
-E9fsZ1ltRxoson6jjpGbwGS4N1MMlJrWndwKhz5ZwPWdMCiiAZW6X7ZvE5So7J1n
-CWR+NxnJAFqVwp9PZxjiiKCIHZPz8m20qm5CoCR/j/hk+hLbL5cB+ie8wgushd1O
-V6P9GV6ld4umM3Qh57cmZBZwhQoouDpjMHeMEK/P9EEjPKizfhF8T4qVVQEpQlJQ
-7U13xR9PuQh8ofDs2qDplKpZR0BVSBxQb7l2JNDJsjwxKiqeGrFhEu4RaeuXl7do
-PWHsJqTbxul49M6lh1IMn06XYlMxR/dViMmPCh710T4ShyPQHr3ubz3gQPNyUsJk
-FkiBCBTJ4A3yVgdsSLMCv2TCUYlVGgazIyXYj6CGlj5C9X7b2PFGOsmIuuMWJrZu
-K64ISrbZUU7weXYn7d9NCCzUFCZHWNxM5MqdKBHy6jVONdksvgXmmGJ32sN4WJDM
-5wutm4kCHAQSAQgABgUCTubiXgAKCRDGh181Qc794DR3EACrmqG2CZRKvWPToU9c
-YFMbTNQR7tMB3Iuz0Cks/JzgRpRnBIg3tNoWpJfuQeTYV/rWgbov9hF42X1aahKh
-yO7iAT5uc4n5C8YoWzvkViGDtkueOGcCgOV/DlMsYtaUlPpgAqqFwCwiboJShsRy
-d2Jxg1KxMbJK/b4iFYSqox0tqUT/E4+7fFkayY9hbG6VfX1Dt/rv+kWPcqcvbEFq
-U2ZOQ91QGic7ZLZ6TWkkJtmJnOc8q8WLzUz6jKPqJNwa4bcxc1+I5/fOVS2xlaOx
-ZXqX4eWSTy7Jx2Ya7ise6H+WDt7r3M+n8NgqpT7KHzd6ZDel/NXHL9HpL1sVvfBd
-nkTNnUH2ZAL4QN5u2FdZkR4N8sJ7VFbHFbpQTP7pFAWM5NxPhXcOvZz7CCYrCw0/
-3xSaQk2M7jUp2JbnWq/fxRzwBXG9YUe6ZzFmovgX9MjCf1kPQohKBjSZyfefB/7y
-IBO1gN/lq9R4KzeVqbBUHTv1yytEfhmSdiJD6Zn1I0+rBj0lOPFBh7FavZ8Mf3qa
-nBQdYwfviMIEsw1rxwi+m9q5RwPzN4c10GLxPyA9HiveA4dj8DI2bD/mHymhjM5E
-Di8plId5A2mqfb36CYVgi3zVgF6fdkSclqXJgmaO53Q0UCCl7qnKaBQiUvZ4m50S
-vun+iQyHOgf1OJocid27Fe0eaokCPQQTAQIAJwIbAwULCQgHAwUVCgkICwUWAgMB
-AAIeAQIXgAUCUSCPTgUJC9IwFQAKCRCbuGOw9Ru4igXDD/4wg4dxsAhXkOWYQb/8
-rN0plsvZHkacnRc3w0h6+5FfvNMbuUQY0YW3kD3APerX9mkYBsQbloY9d7KXMl7M
-ATQtdXl07HZZMS1PXEyIWPk5es1tHpfR+6NAU3nJyJdniSO/8GDjhiN4sq++uIF4
-NMvZC6/7XG4uT39BlPFqRHpFxLu9uJuzNkiQnPkHQZ08r9FKq854/KGDtaV1aAzP
-s4f1cghvh2JOrioKkNuS3yXWIn6AxhXmvYhufqHXajCBovv/Edwf+ErkZ6uYgJg7
-EjjU0f8sDsyoEThV0ChBcvIaxhYEne5QNRpcaLMU0w+/u03DTbKUmOGeYyOToB4y
-5HIhuiNB47DtFY0K9FQbT9gw4MOuQkVLX9WG9Ksnc7cPPHL2B6DtLER2lMczp3eW
-rftx4q+CcI/jfWDrpDN1a2MI1fwR0cxCF7tSxGWl3EmFnjC38qMWQvXWMXsFqGUI
-sTOGEmd4w1L2xnYVRXDh6Ic9OmYu95iIgUE064E8xeurDAM5ela2C9KVXcpefkU8
-0vuq8FqNofZzvV/LVQczE5W+O8b+pqh+PUa9vLbv3ukdDe+zJm9E4/bGF7NjPgjT
-YBkb7L0PQLb1zsAUj0oo9HdyEPwHf971N745js2m3jQrKAgAuUOXBFnpAQ8qhhxk
-eacb87oIzHdX8TdtqaSqAg18M4kCPQQTAQIAJwUCSvH9lAIbAwUJBaOc7QULCQgH
-AwUVCgkICwUWAgMBAAIeAQIXgAAKCRCbuGOw9Ru4iq3HD/0SKrQhKwuBcYSSbRNn
-i5w0l6erZ/ZllogFTHyn2J6sAYtG/GxJ268xBVhXgmSpXWt3G+809rYh8BMKp+UN
-4sMuphTs/eT61LTDjoPIACN7R1FxWjlhK1PzsaV6dlfQXaePjr8r1vqV99kl8Khx
-iAWpLBJVDjyCXlv5vTGzX/PuZdnE3R1OkVhjHANcWLr9M5j86WgORhhR1KkDpB+B
-pwYbCCg46yJqkRVF1FZsns9nYyMnbqCq4mTkRgj2hSoAzBgJ7WFpdJ0qSo++lWxR
-r54pXTgZHda+GVO4I1APyyyO0Xl+BBwwNbpxT1PyaBgz7/x4lTf1vng/8dKzJc7k
-cHQftTgcRdDMhzjoqBAR7P5hACK84mjcSfB4a4THBAW9hO7rGHFWs/kVoZbRy6+m
-n9Gk8bm3xyzR3kGSSSA2S3/LYxmNfBRXNPvG9M1j6/KPa2dLBdBB/09Zk/lgHtoc
-lOW25dHcAlieYSbqJH46WJmK+YANzwfJwd1ofSuvM3iXBRdcuGvTZ8LHpq3Aspgv
-2MwwDtZUyjOMUoC1JSUIVLRfM3498RGVd1K6kOU2IVM5fFG33fFjzbmDMqZa2dcw
-w42/Vk0XIjLOUoA9/BdmZsX1l+YoyiCWm8KPzMWMjpeuxKCgdjTW67wB5ReU8Amp
-rzaaAByaElVk1FZiiZH3MJEhRNH/AABZ5v8AAFnhARAAAQEAAAAAAAAAAAAAAAD/
-2P/gABBKRklGAAECAQBIAEgAAP/hC+RFeGlmAABNTQAqAAAACAAHARIAAwAAAAEA
-AQAAARoABQAAAAEAAABiARsABQAAAAEAAABqASgAAwAAAAEAAgAAATEAAgAAABQA
-AAByATIAAgAAABQAAACGh2kABAAAAAEAAACcAAAAyAAAAEgAAAABAAAASAAAAAFB
-ZG9iZSBQaG90b3Nob3AgNy4wADIwMDQ6MDk6MjggMTY6NTk6NTkAAAAAA6ABAAMA
-AAAB//8AAKACAAQAAAABAAAASKADAAQAAAABAAAAZQAAAAAAAAAGAQMAAwAAAAEA
-BgAAARoABQAAAAEAAAEWARsABQAAAAEAAAEeASgAAwAAAAEAAgAAAgEABAAAAAEA
-AAEmAgIABAAAAAEAAAq2AAAAAAAAAEgAAAABAAAASAAAAAH/2P/gABBKRklGAAEC
-AQBIAEgAAP/tAAxBZG9iZV9DTQAC/+4ADkFkb2JlAGSAAAAAAf/bAIQADAgICAkI
-DAkJDBELCgsRFQ8MDA8VGBMTFRMTGBEMDAwMDAwRDAwMDAwMDAwMDAwMDAwMDAwM
-DAwMDAwMDAwMDAENCwsNDg0QDg4QFA4ODhQUDg4ODhQRDAwMDAwREQwMDAwMDBEM
-DAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM/8AAEQgAZQBIAwEiAAIRAQMRAf/d
-AAQABf/EAT8AAAEFAQEBAQEBAAAAAAAAAAMAAQIEBQYHCAkKCwEAAQUBAQEBAQEA
-AAAAAAAAAQACAwQFBgcICQoLEAABBAEDAgQCBQcGCAUDDDMBAAIRAwQhEjEFQVFh
-EyJxgTIGFJGhsUIjJBVSwWIzNHKC0UMHJZJT8OHxY3M1FqKygyZEk1RkRcKjdDYX
-0lXiZfKzhMPTdePzRieUpIW0lcTU5PSltcXV5fVWZnaGlqa2xtbm9jdHV2d3h5en
-t8fX5/cRAAICAQIEBAMEBQYHBwYFNQEAAhEDITESBEFRYXEiEwUygZEUobFCI8FS
-0fAzJGLhcoKSQ1MVY3M08SUGFqKygwcmNcLSRJNUoxdkRVU2dGXi8rOEw9N14/NG
-lKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vYnN0dXZ3eHl6e3x//aAAwDAQACEQMR
-AD8ApEsBc1rCHEA7gD+c5273AfSUX33sDfVY7f8AS0iNA3d7v0n76J+zQ7i2t/h7
-W/8AfNqKzp2U72sLT8N4P/QepuEtbjC5ruvs9oLj4NEk6WNW5i/VPqtmMC51dT3t
-BDHaFpjbt/O8FZ6WMXplDXQftbwA8udv2/1JXS4djH0NcHAl+syoTluVD7WxHFUb
-Ly3/ADTzmMc0bXOAEEaSfzvcqFnS87pziMmrbW+CLGmROohzl3GRl10yCdVJj6Mm
-stIa9p0c0wQkMgurtRx6XVPAbgGvMGWw7wB266LMx2B/qMLA1gBLBzE6ua//AK41
-dd136vvprflYcOr131+7c1pH5kbty5KjfVZL9W6iSTpP/Wm/9UpeK9mIgjddhAF7
-Q8bmtBmDBJH0klBroa4EPcXyNxcwxrOm5zPBJFb1f//Q50fYC0jexrteSf7Lvoha
-PT8an1vtAcG00/pD7gZAHsb/AG3LmG5DnEe0ElbGRl47MYYtRO8AG1wES4JTmQKo
-arYQBN2dHQb1kPsL7T7nHTlWh9Yb6gPRc8g6OaDB+LHfvLDwaHWuFhEAj2/BbmPh
-MIBIUHCNqbgGi7uvdSdWHPe6yDo4gTHbd/KXVfVzrVF+Jv1e5uh2gB4/sH6S592H
-Wa4AUMPI/ZwsqsZ6lNnYaOHnW795EitQgx0e2q690/JsOMxxeTLXhzSyP5Lt8LI+
-sPTvsuJ9s6c1rmM0vre7sfova7+sszHsJb64eL9fba4Q8D92wt9y38ap2f0jIIf7
-ntcAABpA8/3koZZiVDVjniiY2Xjj1G4aOxmGOYd4f2Ulm23XV6myQJA0B1/d1CSt
-cR21avtDwf/R4MNuxLW+u11dldgLmkQ4fncFEtNgyHVmTY50a+ZVmnqW81ixrXND
-jsqs9zABztf/ADlP/W3LRysSrI6o3MY1oaS1zthLmyWz7S5Nn0XYgZXXTV0MGkNa
-1vgAFq4+0SHLCyHWUvAG90/RDNB85UGZ+aIfD2tcY2vAJ0TGyOz1EtGnIKhdi13i
-J1VB19owftI1IMEKjT9Yb67Gse0e/wCjAJkcfmo3fRJoO3bhPpwrDv2mCRH8VD6u
-davxcltQcC55DS08O/1/lI+LmjqGI6sge5pAIWN9VcUOy7Ls6W0YweQ+CZcwGPa2
-Xe1MIoaLJa7tbrdVN+bayktrpfkFrQOGhzi3dCSoW51j9zCxmpP6QAk8/S9xd9JJ
-WOPw6U16N34v/9LmL+k42S+cF7aLRuIxrHSx+7tiZT9u7/icnZZ/wli0K6siivHZ
-ZW6sta0WscIcHARDwVNvUuj9UxHUjEbjZdQfbWKdK7A0e+m2v83+Q5qDjdSrvqZX
-Ltzo2AmSBy1rif5KbLUeTJh9MiL+YOvTXXcPcEPIqrYNBqFGqxzP4IN73WgwSSeC
-FGJW2qFOxgYoswX1yCTqB8EGvp9Dn/A6rPxW5TNte97Q2CHDnTsrjbHVXEgyHan4
-o34IoXu7dFOPSz9EyHASYELBzMiujottmO3bbkO9F24AkifWtjT+UtnCyA+t5d+Y
-06rG6zlfVqy6vpWUX1iuXmyl383ZZ9L+S/axlbkhr9FsqjGXc6B5mpjwQdpIBE6d
-klfxfqjmZedbT9oZXh1PAGbYTD2kb2elU3dvdsPvSTtPmatm6rwf/9Oh076k9c6X
-ltzrq6jVW1zrHNfq0fv+9qyQKaswOja5upD9CG/mtH5j+V7LVmUmpxugMiHE6gz7
-dv8AaXC9e6H0a6+12Kx1LGncytrjsDhrNbY9rf5CRjqQBZrzUJAAGRoA7/1nOrLX
-gHsQq9eH6FztpNlZMhrnO08YITFzqONWEz8Edj67miDr3UMW6C3K6qngiuQSZaTY
-TAj+S1NTgWY7y++917n8l0AD+S0JsWmprp38KzZYCW1s99jiGtaNSSU6WyCfNHlW
-irAuYHbX3gVtI0Ik7pEf1VxOf05+LS219hsse73O7a+P8pd1kZeLgVtty8KnqGM0
-kvtbuNlLvovbbX/od3+EZ/bVzp/Vvqhluc1+DQKi0kt2kkQPpAf4St3/AG5WkBIa
-9OrFKUZWOvR5LC+sV1eK1rcdpqxwK2tDzMAbnO9wd/WSXaUdM+oua1zqK/QaS0A1
-l0bneTg/+qkhx+IpZ6arXip//9Spf9bs3PfjYe4Nre+uW8DQg7i7+StkPrtsdscH
-tgajVeattDbaiSdoc2Y8O66novXun03Oota6mszteSX6/uu/OTxkGOQFaS3PXwV9
-3lmxyMbMoHSPn/zuJO5m7cCC0tJBaeRBVc47Q/c0lh8lo5GTh33ssxrG2C1pnb+8
-zxH9RyY0Bwkcqoe4bkNgJCpDQgtWui4nSw/ctPp+PXTNlj9r3gsbYTqHOG1kEoGO
-xzTtLfmq/WnWuycDGpguFvrFh4d6bXOax39b3Ixs+PgiZrrXj2czPuyTUepUuNlQ
-ivLe3SeGtyHsH0N/0LVkvcaHC+g7ayZIH5p/eZ/JVrHzxXb6jBu9STbV/g9hGz0t
-kbfo/TVS6sYtwrEuxbhupJ7T9Kp39VSYZ6CMjr/LRbzHL5OH3uHhgf8AG/vSi6/S
-sq7I9SuvI9C4w8Ena10aOY535u5qSwqnnGvHdrTIB7t/dST/AGxx8X8ra3EeHh6X
-b//V4LOGLI+yF514eAB/J2wVev8AsHq/oC8CRpEgn8791zVzKSGff6fRs8h84+bc
-fL/3X9V9CrNBOH6Qh25vp7SCOD9o36N/wf8A01uV+lOnzXkKSght1+v7GTJXHOv3
-j/e/wuJ9mHoSsvqPo/tTGgv9aTs2c8O+ivLUk6Xyny/R3Wx+Yftezv8AsPo5H2Ta
-GSJ7nnWN35u76K0qHdGb0TIGTVXYzZ9PIseywu/N+y1UU3MbZ/o/0y86SUQ/aP73
-/ozeP81O/cq5b/L8sf579P2nayPo187p9s8x/KSWKkr32uL16b/R/9n/7RCMUGhv
-dG9zaG9wIDMuMAA4QklNBCUAAAAAABAAAAAAAAAAAAAAAAAAAAAAOEJJTQPtAAAA
-AAAQAEgAAAABAAEASAAAAAEAAThCSU0EJgAAAAAADgAAAAAAAAAAAAA/gAAAOEJJ
-TQQNAAAAAAAEAAAAHjhCSU0EGQAAAAAABAAAAB44QklNA/MAAAAAAAkAAAAAAAAA
-AAEAOEJJTQQKAAAAAAABAAA4QklNJxAAAAAAAAoAAQAAAAAAAAABOEJJTQP1AAAA
-AABIAC9mZgABAGxmZgAGAAAAAAABAC9mZgABAKGZmgAGAAAAAAABADIAAAABAFoA
-AAAGAAAAAAABADUAAAABAC0AAAAGAAAAAAABOEJJTQP4AAAAAABwAAD/////////
-////////////////////A+gAAAAA/////////////////////////////wPoAAAA
-AP////////////////////////////8D6AAAAAD/////////////////////////
-////A+gAADhCSU0ECAAAAAAAEAAAAAEAAAJAAAACQAAAAAA4QklNBB4AAAAAAAQA
-AAAAOEJJTQQaAAAAAANVAAAABgAAAAAAAAAAAAAAZQAAAEgAAAAQAE4AZQB3AE8A
-cgBsAGUAYQBuAHMAUwBxAHUAYQByAGUAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEA
-AAAAAAAAAAAAAEgAAABlAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAA
-AAAAEAAAAAEAAAAAAABudWxsAAAAAgAAAAZib3VuZHNPYmpjAAAAAQAAAAAAAFJj
-dDEAAAAEAAAAAFRvcCBsb25nAAAAAAAAAABMZWZ0bG9uZwAAAAAAAAAAQnRvbWxv
-bmcAAABlAAAAAFJnaHRsb25nAAAASAAAAAZzbGljZXNWbExzAAAAAU9iamMAAAAB
-AAAAAAAFc2xpY2UAAAASAAAAB3NsaWNlSURsb25nAAAAAAAAAAdncm91cElEbG9u
-ZwAAAAAAAAAGb3JpZ2luZW51bQAAAAxFU2xpY2VPcmlnaW4AAAANYXV0b0dlbmVy
-YXRlZAAAAABUeXBlZW51bQAAAApFU2xpY2VUeXBlAAAAAEltZyAAAAAGYm91bmRz
-T2JqYwAAAAEAAAAAAABSY3QxAAAABAAAAABUb3AgbG9uZwAAAAAAAAAATGVmdGxv
-bmcAAAAAAAAAAEJ0b21sb25nAAAAZQAAAABSZ2h0bG9uZwAAAEgAAAADdXJsVEVY
-VAAAAAEAAAAAAABudWxsVEVYVAAAAAEAAAAAAABNc2dlVEVYVAAAAAEAAAAAAAZh
-bHRUYWdURVhUAAAAAQAAAAAADmNlbGxUZXh0SXNIVE1MYm9vbAEAAAAIY2VsbFRl
-eHRURVhUAAAAAQAAAAAACWhvcnpBbGlnbmVudW0AAAAPRVNsaWNlSG9yekFsaWdu
-AAAAB2RlZmF1bHQAAAAJdmVydEFsaWduZW51bQAAAA9FU2xpY2VWZXJ0QWxpZ24A
-AAAHZGVmYXVsdAAAAAtiZ0NvbG9yVHlwZWVudW0AAAARRVNsaWNlQkdDb2xvclR5
-cGUAAAAATm9uZQAAAAl0b3BPdXRzZXRsb25nAAAAAAAAAApsZWZ0T3V0c2V0bG9u
-ZwAAAAAAAAAMYm90dG9tT3V0c2V0bG9uZwAAAAAAAAALcmlnaHRPdXRzZXRsb25n
-AAAAAAA4QklNBBEAAAAAAAEBADhCSU0EFAAAAAAABAAAAAE4QklNBAwAAAAACtIA
-AAABAAAASAAAAGUAAADYAABVOAAACrYAGAAB/9j/4AAQSkZJRgABAgEASABIAAD/
-7QAMQWRvYmVfQ00AAv/uAA5BZG9iZQBkgAAAAAH/2wCEAAwICAgJCAwJCQwRCwoL
-ERUPDAwPFRgTExUTExgRDAwMDAwMEQwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM
-DAwBDQsLDQ4NEA4OEBQODg4UFA4ODg4UEQwMDAwMEREMDAwMDAwRDAwMDAwMDAwM
-DAwMDAwMDAwMDAwMDAwMDAwMDP/AABEIAGUASAMBIgACEQEDEQH/3QAEAAX/xAE/
-AAABBQEBAQEBAQAAAAAAAAADAAECBAUGBwgJCgsBAAEFAQEBAQEBAAAAAAAAAAEA
-AgMEBQYHCAkKCxAAAQQBAwIEAgUHBggFAwwzAQACEQMEIRIxBUFRYRMicYEyBhSR
-obFCIyQVUsFiMzRygtFDByWSU/Dh8WNzNRaisoMmRJNUZEXCo3Q2F9JV4mXys4TD
-03Xj80YnlKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vY3R1dnd4eXp7fH1+f3EQAC
-AgECBAQDBAUGBwcGBTUBAAIRAyExEgRBUWFxIhMFMoGRFKGxQiPBUtHwMyRi4XKC
-kkNTFWNzNPElBhaisoMHJjXC0kSTVKMXZEVVNnRl4vKzhMPTdePzRpSkhbSVxNTk
-9KW1xdXl9VZmdoaWprbG1ub2JzdHV2d3h5ent8f/2gAMAwEAAhEDEQA/AKRLAXNa
-whxAO4A/nOdu9wH0lF997A31WO3/AEtIjQN3e79J++ifs0O4trf4e1v/AHzais6d
-lO9rC0/DeD/0HqbhLW4wua7r7PaC4+DRJOljVuYv1T6rZjAudXU97QQx2haY27fz
-vBWeljF6ZQ10H7W8APLnb9v9SV0uHYx9DXBwJfrMqE5blQ+1sRxVGy8t/wA085jH
-NG1zgBBGkn873KhZ0vO6c4jJq21vgixpkTqIc5dxkZddMgnVSY+jJrLSGvadHNME
-JDILq7Ucel1TwG4BrzBlsO8AduuizMdgf6jCwNYASwcxOrmv/wCuNXXdd+r76a35
-WHDq9d9fu3NaR+ZG7cuSo31WS/Vuokk6T/1pv/VKXivZiII3XYQBe0PG5rQZgwSR
-9JJQa6GuBD3F8jcXMMazpuczwSRW9X//0OdH2AtI3sa7Xkn+y76IWj0/Gp9b7QHB
-tNP6Q+4GQB7G/wBty5huQ5xHtBJWxkZeOzGGLUTvABtcBEuCU5kCqGq2EATdnR0G
-9ZD7C+0+5x05VofWG+oD0XPIOjmgwfix37yw8Gh1rhYRAI9vwW5j4TCASFBwjam4
-Bou7r3UnVhz3usg6OIEx23fyl1X1c61Rfib9XubodoAeP7B+kufdh1muAFDDyP2c
-LKrGepTZ2Gjh51u/eRIrUIMdHtquvdPybDjMcXky14c0sj+S7fCyPrD077LifbOn
-Na5jNL63u7H6L2u/rLMx7CW+uHi/X22uEPA/dsLfct/Gqdn9IyCH+57XAAAaQPP9
-5KGWYlQ1Y54omNl449RuGjsZhjmHeH9lJZtt11epskCQNAdf3dQkrXEdtWr7Q8H/
-0eDDbsS1vrtdXZXYC5pEOH53BRLTYMh1Zk2OdGvmVZp6lvNYsa1zQ47KrPcwAc7X
-/wA5T/1ty0crEqyOqNzGNaGktc7YS5sls+0uTZ9F2IGV101dDBpDWtb4ABauPtEh
-ywsh1lLwBvdP0QzQfOVBmfmiHw9rXGNrwCdExsjs9RLRpyCoXYtd4idVQdfaMH7S
-NSDBCo0/WG+uxrHtHv8AowCZHH5qN30SaDt24T6cKw79pgkR/FQ+rnWr8XJbUHAu
-eQ0tPDv9f5SPi5o6hiOrIHuaQCFjfVXFDsuy7OltGMHkPgmXMBj2tl3tTCKGiyWu
-7W63VTfm2spLa6X5Ba0Dhoc4t3QkqFudY/cwsZqT+kAJPP0vcXfSSVjj8OlNejd+
-L//S5i/pONkvnBe2i0biMax0sfu7YmU/bu/4nJ2Wf8JYtCurIorx2WVurLWtFrHC
-HBwEQ8FTb1Lo/VMR1IxG42XUH21inSuwNHvptr/N/kOag43Uq76mVy7c6NgJkgct
-a4n+Smy1HkyYfTIi/mDr0113D3BDyKq2DQahRqscz+CDe91oMEknghRiVtqhTsYG
-KLMF9cgk6gfBBr6fQ5/wOqz8VuUzbXve0Nghw507K42x1VxIMh2p+KN+CKF7u3RT
-j0s/RMhwEmBCwczIro6LbZjt225DvRduAJIn1rY0/lLZwsgPreXfmNOqxus5X1as
-ur6VlF9Yrl5spd/N2WfS/kv2sZW5Ia/RbKoxl3OgeZqY8EHaSAROnZJX8X6o5mXn
-W0/aGV4dTwBm2Ew9pG9npVN3b3bD70k7T5mrZuq8H//TodO+pPXOl5bc66uo1Vtc
-6xzX6tH7/vaskCmrMDo2ubqQ/Qhv5rR+Y/ley1ZlJqcboDIhxOoM+3b/AGlwvXuh
-9GuvtdisdSxp3Mra47A4azW2Pa3+QkY6kAWa81CQABkaAO/9Zzqy14B7EKvXh+hc
-7aTZWTIa5ztPGCExc6jjVhM/BHY+u5og691DFugtyuqp4IrkEmWk2EwI/ktTU4Fm
-O8vvvde5/JdAA/ktCbFpqa6d/Cs2WAltbPfY4hrWjUklOlsgnzR5VoqwLmB2194F
-bSNCJO6RH9VcTn9Ofi0ttfYbLHu9zu2vj/KXdZGXi4FbbcvCp6hjNJL7W7jZS76L
-221/6Hd/hGf21c6f1b6oZbnNfg0CotJLdpJED6QH+Erd/wBuVpASGvTqxSlGVjr0
-eSwvrFdXita3HaascCtrQ8zAG5zvcHf1kl2lHTPqLmtc6iv0GktANZdG53k4P/qp
-IcfiKWemq14qf//UqX/W7Nz342HuDa3vrlvA0IO4u/krZD67bHbHB7YGo1XmrbQ2
-2oknaHNmPDuup6L17p9NzqLWuprM7Xkl+v7rvzk8ZBjkBWktz18Ffd5ZscjGzKB0
-j5/87iTuZu3AgtLSQWnkQVXOO0P3NJYfJaORk4d97LMaxtgtaZ2/vM8R/UcmNAcJ
-HKqHuG5DYCQqQ0ILVrouJ0sP3LT6fj10zZY/a94LG2E6hzhtZBKBjsc07S35qv1p
-1rsnAxqYLhb6xYeHem1zmsd/W9yMbPj4Ima6149nMz7sk1HqVLjZUIry3t0nhrch
-7B9Df9C1ZL3GhwvoO2smSB+af3mfyVax88V2+owbvUk21f4PYRs9LZG36P01UurG
-LcKxLsW4bqSe0/Sqd/VUmGegjI6/y0W8xy+Th97h4YH/ABv70ouv0rKuyPUrryPQ
-uMPBJ2tdGjmOd+buaksKp5xrx3a0yAe7f3Uk/wBscfF/K2txHh4el2//1eCzhiyP
-shedeHgAfydsFXr/ALB6v6AvAkaRIJ/O/dc1cykhn3+n0bPIfOPm3Hy/91/VfQqz
-QTh+kIdub6e0gjg/aN+jf8H/ANNblfpTp815CkoIbdfr+xkyVxzr94/3v8LifZh6
-ErL6j6P7UxoL/Wk7NnPDvory1JOl8p8v0d1sfmH7Xs7/ALD6OR9k2hkie551jd+b
-u+itKh3Rm9EyBk1V2M2fTyLHssLvzfstVFNzG2f6P9MvOklEP2j+9/6M3j/NTv3K
-uW/y/LH+e/T9p2sj6NfO6fbPMfyklipK99ri9em/0f/ZOEJJTQQhAAAAAABVAAAA
-AQEAAAAPAEEAZABvAGIAZQAgAFAAaABvAHQAbwBzAGgAbwBwAAAAEwBBAGQAbwBi
-AGUAIABQAGgAbwB0AG8AcwBoAG8AcAAgADcALgAwAAAAAQA4QklNBAYAAAAAAAcA
-CAAAAAEBAP/hEkhodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvADw/eHBhY2tl
-dCBiZWdpbj0n77u/JyBpZD0nVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkJz8+Cjw/
-YWRvYmUteGFwLWZpbHRlcnMgZXNjPSJDUiI/Pgo8eDp4YXBtZXRhIHhtbG5zOng9
-J2Fkb2JlOm5zOm1ldGEvJyB4OnhhcHRrPSdYTVAgdG9vbGtpdCAyLjguMi0zMywg
-ZnJhbWV3b3JrIDEuNSc+CjxyZGY6UkRGIHhtbG5zOnJkZj0naHR0cDovL3d3dy53
-My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIycgeG1sbnM6aVg9J2h0dHA6
-Ly9ucy5hZG9iZS5jb20vaVgvMS4wLyc+CgogPHJkZjpEZXNjcmlwdGlvbiBhYm91
-dD0ndXVpZDpkYWJlYjcxYS0xMWE4LTExZDktYWVmOS04MDNmYjlmNDliNmUnCiAg
-eG1sbnM6eGFwTU09J2h0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9tbS8nPgog
-IDx4YXBNTTpEb2N1bWVudElEPmFkb2JlOmRvY2lkOnBob3Rvc2hvcDpkYWJlYjcx
-Ni0xMWE4LTExZDktYWVmOS04MDNmYjlmNDliNmU8L3hhcE1NOkRvY3VtZW50SUQ+
-CiA8L3JkZjpEZXNjcmlwdGlvbj4KCjwvcmRmOlJERj4KPC94OnhhcG1ldGE+CiAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAK
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-IAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAog
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgIAo8P3hwYWNrZXQgZW5kPSd3Jz8+/+4ADkFkb2JlAGRAAAAA
-Af/bAIQAAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB
-AQICAgICAgICAgICAwMDAwMDAwMDAwEBAQEBAQEBAQEBAgIBAgIDAwMDAwMDAwMD
-AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMD/8AAEQgAZQBI
-AwERAAIRAQMRAf/dAAQACf/EAaIAAAAGAgMBAAAAAAAAAAAAAAcIBgUECQMKAgEA
-CwEAAAYDAQEBAAAAAAAAAAAABgUEAwcCCAEJAAoLEAACAQMEAQMDAgMDAwIGCXUB
-AgMEEQUSBiEHEyIACDEUQTIjFQlRQhZhJDMXUnGBGGKRJUOhsfAmNHIKGcHRNSfh
-UzaC8ZKiRFRzRUY3R2MoVVZXGrLC0uLyZIN0k4Rlo7PD0+MpOGbzdSo5OkhJSlhZ
-WmdoaWp2d3h5eoWGh4iJipSVlpeYmZqkpaanqKmqtLW2t7i5usTFxsfIycrU1dbX
-2Nna5OXm5+jp6vT19vf4+foRAAIBAwIEBAMFBAQEBgYFbQECAxEEIRIFMQYAIhNB
-UQcyYRRxCEKBI5EVUqFiFjMJsSTB0UNy8BfhgjQlklMYY0TxorImNRlUNkVkJwpz
-g5NGdMLS4vJVZXVWN4SFo7PD0+PzKRqUpLTE1OT0laW1xdXl9ShHV2Y4doaWprbG
-1ub2Z3eHl6e3x9fn90hYaHiImKi4yNjo+DlJWWl5iZmpucnZ6fkqOkpaanqKmqq6
-ytrq+v/aAAwDAQACEQMRAD8ALBPU4OCryWJxO1czS5CopsTVx5OjxOalpoP7ybvz
-X8b+3zNDi54qjM1k4qp4aWlOm6xCULGEBHyw63QxwsCJV4jjWpYg8ak5PBeFeoku
-JGW2ZSyHVC1SDwpTTUY4Co1HPoOm/Lbz3thqTAndW3Nwpn1SqzzpS09FBhaapxmL
-wVJk6QZyGh3VVUOOqq7cKqkUFIyRyQTr40jiMi3Zr+eYRukitGQ5IHbU0BWuTmpP
-rinXoIrC2tnmXw5EYGMVejEUqG044Upxpw9ehzqNu7x35uBnxWPzOXllqYp0x2Fx
-lNkcpVmooN/YeCA1UNIlNFVySTJIrzf5pAEYFXb29fXCwPdTXd2Vi1UpgE9jetPX
-jnhTz6Y2y0luYrCKysy9yEJLVJUd6eQ9AOH5+XVpfWH8qD5T7h62oKyvynX+y83m
-9rYielwGbp6nG5rZuUgxUOMmxE89PHlsfkqGSPH008E5AlRJpIZkfxxkhCPmRpVv
-I441ZJI101AoCFAr6/aPl0OP6owxNYt9QySRSOXoa6gWJx5f8Wel6f5TvduExOVx
-cUe18xlYcTh3oslSTTUsuRrIGpjkqRcwtT4FnrWrKgfcuI5otBIjKsAtF3qSNET6
-Q+LQAlSKGgOTX1rT+delT8trI71vlMJJpqU1AJBpjyx/k6KpuT4xd5fGOuqaftPY
-VRjNs7khoqij3ViMicpj582IsvQPQZnMUiQUVFVyUjUiIjmORzp1WDaFEmz7hb3Q
-eAUWTBFcMaca+XDAz8+gxvO0z7WDeBfEgOpWoaqqk9tPOg4nA6Dz76lo6HdFc1Nm
-YqzHNjtyaVpRQ0Vf/d+eato46CqNZaOdqeVojKNaeNnLppXR7PAro5laOiLkHzPy
-HzJ/l0QmWJUEAYNIwoKZUUNammaKP29Eg6+wcWc/vbganblNjMJT0mTye3Me7NkZ
-sZNXyffZTFbihMstDPUQbxxbSSU4qXEixRF0gEt5ELTVZUaiowrSnA1AINPnn/N0
-oEazvJcFGZgwBzTyPcPlpr+3p5ws0UEXa2Mh3TStX4bC0Ne1SMJXpSZGsrqO0eTq
-xSxpCK9BVQwqkbPIscNvKwmKJdXEi3YMzajHUEqcilOP+D06TH9C4sVkgqNRGmvC
-h+H+R6//0C/H45RZIgw772DnWRR4pZtpbR1htWrVHNtefEFdTc+m3+x9zH+67ctV
-LxCD5UT/AIvrG1d9uKESQSV4Zr/Ov8+l3i/jp2bkFlxuAyO26xxDUVGjFR9h46v8
-CCGWqmhqMBveCuHhSnDftsXSMMBZS4LM22/TRhzeII8CpqAD5cDQDyr6npVa7r9V
-M0KWpeQLWmgE0HGmMkf4Orxfi9TdWfFPYuKyskOQm7r3Hh6Ki3Pkc7uAbxXai3lU
-rtmrr4JqykWuWZ5nDNNPGkwSZiRxjNzzzhd315d2NjcaoIiRrWtDk10hiTUcK8PT
-rKXkflW2trK0uLq1Ec8iqxQ4PDANAMH0/b1dz03uDDZjZGDyVNmKXITZuN8iZzWi
-ead5rFmZpZ5pCx0882uDYce98l7jt67TDFJfJ9Y7MWBYaq1pmprX7ePl0p5ltLpN
-xm/xVhAgABAxSnyFOs+/e2tu7ISeKtmjNREousj6EEjNEsURK3a8/lGmwufxf8Kd
-75ug2yVraGPXKBWv4fL09a8fl03tHL0+5qJddIq0xx8/y6n4XMbJ7U2/X46tptu7
-jxtWjUuUw9SKHLUsy6SrtJSzLKraWLBXtrRhe6sODfZN6g3aIyRyr468QDn/ACHo
-u3HbZ9ulCyxtoPAkfP8AZ1St85P5fmc2Pgd09sdKpQ5rakMWTm3JsuVdz/3i23gq
-rEVkMs235KCfMNmsXBVeP7mJo0lWA69MvjA9j2y3+dPAt7kBkHaCak54fIcePQD3
-Tlq2m+qurSiTMdTKAADTJocH504HPWvDsQZfaO4Hq8zHJX0EseUppKiszmShmoIM
-g9HURQ0VN/opxNTDRUdRSGVI/vWeeWR5ZW1ufZ8yEoFeEsePFh5gjOk4xWg8+PQL
-W6ignPhXChQMnTXyKnFacCR9nTXj62Skos7TVWO3ZlqzOLW0q5So3X1pkJqOnlyl
-DkIJaKDOZvAtTwQjHx+Old/H5T5GXWPa208KG2MZVjJQ4JNRXHmvDh0kvpWuLw3O
-uMLUHANOHl9vn1//0aaaQ9DSUNRTnc2zcdlDTZqLTV5DcVMs0r1NWMJkn+025jYI
-6v7GSLzxRSQxJUJdPQWJE4u9oljKm8QSUNcsK5NG4caUHyOeoyew3hJVYWDMgIzp
-U0GNS5PCvA5x0cb4+da7Rk3fH2NR5yjxmxuulG/6vTvChyEmRxtFjpJtuYdaeOsg
-kes3FlYokDRx5CHWXBZBGZFD/N292Vpss6wXJa4lJREVjUVxU8KaeJzToScobDeX
-G92813YqkMNGLMigauIA9ajhTh060fzLizm4q7LbtqWkzGZrqiahETZSonjhEzSP
-9v8Aa1lK0NKpPDA6W5tq59wdbWSxQOzgVIHz/b69ZIJBI8saRmpGT5YrTHy8h0Oc
-X8wveuzoKL+5OV3dWUlSXxuZwtFmUoMk8Eg/Zr9t5KZ5zQ5uiezRCo1B+UdtJ9Bf
-By7aTTmR9NWP8+NccAOje4a/MaoIjQV8uIHUjJ/PT5KZbA0WSz26dw7okp6yqp4c
-nk8DRU2TnwZliloZ8tFFUvSyZyFI2sCw0sWGtkKhT6TYLIRjw2Ooj14emT0WJFeq
-WYxBKGtOH5YHV/H8uf5nbJ7A6pOdK12cyWGkjo6mLbuLoqLe1G4gRSq7Wra5kyyS
-hLQww1WqcowgRmBj9o7B4to3Apca9B+GRaa1b5V+IfL86dFW9W099bgQhRSoKPXS
-wHDPkeOafKvR6ds/Oz4/dqbhquq8RlcnuWurKevwu46LObZyuympGm81JW4nK0uf
-Sgngq1hDCRU4BPDXuAe3PPi7dcW8MkTyxsQCzARkE8K8Rj16IIuSr26trm6qkaKC
-dNfEqPOlOP8AxfVd/wDMI+Oo6k6mbuv4xYnA5nA7amFD2ps/eO5JzLFiq2eFMVuD
-CZKKbwzquSlSnnp5g7+uOSI+lx7lfYOfkvV0qY5JS9B5kNSvFa0FBT06iLmH27ij
-DvGHtjo1NSulkrk6W/EK1+z7OqPZPkJu+OSSnyfSuz8gYHnjqRR7pZFBpI/JUhZa
-rB1UTyQpclCyuQrEAhWsPhv9xXQ9ihkPofTJ/wBR6jGTlkAak3J1QUAqDnVhR/q/
-w9f/0tWGh7ArcjJAHw2OrqyeTwRrGtSJ2eSRUhhaKEhZpXLWFkNz9AfdzYwICVnK
-imcj/D5fZ0TLfXJm0eCC58qGv7OrHd/dtbAwPW1N1JtKtr489SU1DVdhZ2mo48Mu
-Tz9BSLJUmpSeD7iSpoQDSwvyywq3qHkk1RvPrub0yTD9IEhRWp40qPt8/wDY6kmx
-iSO3XS1GABJp/Ppl6M2NXbwyFHuipp5Yaato6afGxToWkWjEgjuf7OqY3Y/kg3/P
-stvoJIGNvTurmn8q+v8Aq9epU2Ea7f6pqnUAP9XpnPVqXX3SeJqIYKipo6d5LqGV
-o1upvqJ/SACQf6fT25YWhcgMTq8/zr/q/l0IZ5kVa18ujFV3T+3qnBPTRU8Klaco
-qiNVRmY6nuLWNmPHHs4NupShB4f6v9jpHHIAwqgKmv5V6THTvYcfxoi3ltPc21m3
-RsLdkZhkpcZUQYjc+JaoZ0OS2jmnp5loc7jahlqKaKZJKSqdfDMl3EiEFzEiSCSW
-MNpPA8DXGfMH59FO97a0qRyWThWNa+n2Eeny9c1x0ZDYW4J6jHydgxbnpeySa2F8
-VvrN4f8Ahu+qOhSoQUeJ3VX4yrjyVXkKWkCwN941YmlAIXXSUAN312um8FYwY6im
-O5T51pxH24p6dObVbCxiVmDRkfEtaoR6qPL8qZ49W79cbVrfkV8Re4potzTR5Dcm
-2dz0NLjcXjcdFPjXose0ypNNXUzVE9Vk56UsHm1xheUOsagf8ibRLKxniuHhuoJQ
-wUYrw4nj3ZHnw6B/OW5QpdR2slsr200RUs1TTiMDh24+Y+fWm3uTd279uLJXTbqj
-mpMfNkKWleLHbfrY4q2GKZ3xoqq3DQwpOYItMg1u4S11KsL5D3kG8bbA89zejxEY
-ALpzpbt1DFdJOKmgOcmnUHJYbPcyPGlmTE/GhNNQFQCQRkUrQfLHX//T1MaXG7v6
-g3Ph133htwbS3JtPf2DrMli8pjHos7RR06wZWkqVx9fCoqaaVFWWHgxVCAaGsQwc
-lVvpnQpxJHp5cP59ILcQvuhdHqPDDfzAp8ulduafOw9gZjblWaybcmX3TJiZUqIJ
-6epkqctWeWoqpKOoL1NOxikHpf1oCRx7A9vAy/qA0Ra/yx+2v+fqSrTS4W3YDU5U
-Hz45/kKdX89JbShxWMwmNRFJoMXQY+SVuCXhijWVyT/q5Be3tHJE11Lqpknj59SX
-YhY/BiDgRqv/ABX+Do/fX/8ADKFZ6TI3jkacCOXR4wsiqBo+hB1/Ukk/4W59mFvH
-HEQGGkHzz0a+F46HRIC44ivEdDH91QQSR0oeGWKaNm8g0h0VjcFtX+pAJ/wt9Pah
-glKVBHTa2zolWXSScD/J0kt29XYHfdM1MldC9WpDxAqksbXC3Vx/aUcXsRz7Kry1
-WYEKakdWEb2qBpVIU+v+Dpu3N0vmNjdMbrmXPzYupixVfk6WSnijWBo1iI8tdUMn
-3M8aKvAd7Aj/AFrECbHA14WlbiDwwOH+Dovv7uRoGS3TuQU/4rpNfy6vmfvXqnsr
-C7VpMnTZDK5/KUO3qzGZAzS4zcJqJYoFg/yeopkGRnSQtTLWJMjav2XVi0T1vJ5N
-n/x7bzpuFOCK5FKaT6/6jjoFzWiboBFeVZD5+an1/l5fn1Vv82tubT3/AN173wOy
-6rC7P2LnfkVlMLiKCmqIYcXt/G53fGUxdHkosc1U9QKWmiSa0knjUoFQWFlGRE8k
-jcsiO+Ym8eOByxqdPwagW+WoEL9pPUV7pJafWwGyQaYVkVhRV1kA0YBclqqwLniK
-U6//1NcrafyTXLT7UotzYjbWaw9Pm647Z6/7DppdybGxdHh5Jvvp8Pumomot39aR
-pApMhxFbRxPJM8hgbkAyeWG5ijWVCGKsTXOQTkHjQD8ugrD4kMvixkUVlJ/P/D0c
-zs7qna/ZPyexHdWFxO36DFZCs21nMrHtHMZncO1pK+v2jQ18UOByWXpaKvyGOgqt
-CwyVESTmOwlu4JMXeK0M97aJr+k8QgEkEj1JI+fl1k/tXL0U3LfLm9tpF3IniMQC
-AQWKoKVxQAmvQz9hZLO7Ly1JFSx7yyEk8cr4yg2zVU2LoqaaKI1CvXVlYhgeqqSo
-SJWDkvYAAG/uoFy0pjVwiHgfWn+Xo1e2tUhllMLSygVopyaCuBiny9T0k8N3t3LC
-mOziU+98LjMlkKijOC3RSUFZkjLTRwSyVEv2lPDNFSVLylI6hlRGdXC30n365W/j
-j1eNUfMcOvbI9vc67s2lzbspAo54jORnqwWs3ruil6STtalElVPTVVPj6ikKu0ka
-v+wsIQam1x1Eh1G1j9Px7aEF2bRLnxBWuR8vt6EtxdxxSsrCqMgOP8PRYto/zBN7
-7azmCwmaxVLbcZZsI9PgMpXDJ0oqqmhWSJcXBVzRuKqlcMrGMgKX/SVPtTCb8xqU
-RTXh60GOH+z0Dt13G0ivore53J1kehUaGIzwGrhX5/t6tx6z7npvkl1Hmts1dLjZ
-Xym1srj6GrxZqJKWqgqaWakmjlFSDNDWQVFQheO/05UD2mWZ3mcMoBFftp6H/D1o
-RSQPpMusNQ1/wfl/Pqsr+Vd1hBle2d37375irMP1309iOxMnT7nmw2Wzi1ef2PiM
-rNRRy4bCU+QzWSpMLX0iVMjRwHylFiRi7WBPeqkm8WVowJgZwWX1IBNB+wV8uiq6
-gurTa7y9WPS4oobFACRnP9GtBx6rh3T3jnc8c9gq3a2xdc2RrJ13ZR0OXr6+Xx5W
-aobK0UWUy+WxxGTCl2EkLWErcBufcgm8vxDJD9c7QtxUkUNKUrgEUpx9BTqK49vg
-+q8WhZoziuAAcmlMZJPX/9WirfHxL617NzEM/Qm5ML1tvOE7xqaXpXfW7XyOxt7T
-54VVJHQ/Hzv3cSYmhzFdU1AWaj2xvQYzNmGQQxZHJVKPGFnguBGsYP8AZv2HLgMD
-keTAE/I08ugeG8MSLk1p54weFTw+w4+fRwMDtrsTYeC6gwW5Nq57Z02D25t6k3tt
-vO0VXj87h9wUeMo6CiodwY+tpqauonnSMMokQFLAH8Fo4v0AluJX1KFYmhx3E0pn
-z8+sw+Wdziu/b/ZoWp4iwquM00sQf9Xqej6bS25gd6UtstSQySRxxGOQszeSRALX
-KaHUg8AqQbfn3qGaKZdDqAB/kp09b2UgK3MZJUfl+fSQ7A2ztvA08SUmPpoqqB/Q
-yK5kTUjErqZ5Xk4UkXNhbm/19q2AWMRRkaWyQPT/AC06XPZrGTPJVy37Py/M9HC6
-H6xo9w9H5/bprKOeeb/clBSsy6nipZkrGp4ICxMkjnkm13PtQIy1qVDAj/UOkswZ
-WVpk7ANPDGf9X5dBXt74+7Fr84ojv/k1YTUCnNLKEmRwkrItZDVCLV/tPjYDg+0u
-SAVkZTmtD08bQi3E2gaTw1Cp/I+nViuy9pbA2Ziok2vtxKTJ0lDPUVSUNBHQpVS0
-9MZVneOJTHUSER3JFi+oc+y24ZImCjDU4/PojewlE6AyDwS3n8z/AC6qd7k7CwXX
-3ws35uXrbCx4zePamZqeo8ouZoMXk8hWY+XMxdib4moY5sfPTzV4x2VhppJKRaer
-o440kilVgQzW2Qi53GK6SI/pI4NRWrvTz+wH59G3udZrsPLFhtEtyPqJLwSgAgdn
-hlMg5oGFR5H8uqPNr4nKUlXj6v8AhGaqaaDIUM9TGmNmEk9NFVQy1MQaaDnzQIR9
-eSfZxuNrd3ltd2kSlJZYnQNQnSWUgH8iaj7OoBaS2aKZBcIpZSoz5lSAcdf/1iG4
-35JfED5a9SZjZdP8edv9P95bKot89obSo+qnkwXW/b2LwGCqqncXWW+9q1NJNFga
-7G0Ua1OLr6JQ0cRnjkdvLJN7DVyb3l6WG5ineTbJJNDh3JKBsBhU40kDIPDiDx6O
-DaWXMNtNGEEe5RxFkCqArmOuCR5kE+X59B/1t8jcB2DtXbO33q802QykOPTb9DlK
-ufL5HH4SGClrsHicrkqyomrp6ahw4RKWolURNHF4VdnhY+682wpbSLLEC0cqKfzH
-ma+vQ59sd6gn2G62O5NLyKXUh8mViNSn0K04/Po4O1twVuGZoyLELrhYOFCegsde
-kEqLck24A9xsby5S40Mua46niymtFslUU0Uz59BzvbNZDdVLW/Zz5WprqyoaOGtx
-aTL4EdTBIqMoKpCFkKhzZtR1Aj2JbaEzwO8kxBPpXHy/z9JH3FBKiw2hbSeB+H9n
-r09dX0PaGIGJ2w+5N94SDF1GOq4ctRGKevqY6KoM8tDWVElIyzrUqul/QjsPo31v
-aG2naRlaVljOcYpT/L03dbg0cIc2YcKxqpzxwPtH59GPxu4cjtPd9fWUVZNLQ5Nj
-WVkMzOJaWslkLTSlfSPHUuSxFvQ9/wAe2b55bOd3VyY2P7CfM/4erWV9b3VqbaRK
-OvCv+D8v8HVhPS3YdPntubjqssyqMJtvITGeVtKrDFJCqnyE6VNn0i9ubD2lE/1D
-RVrQt9lf29E11A097bxQVLu60p/q4dVr/MjtT+W1uHduy/iF2vV782pSbOXK7nyW
-7uotxtBF1X2Z2jNDSZWrqY5xWYfcsWK25t3D1xp6qOSrp/vJIDNGGkHsRvZbvHaJ
-ebPKEBqzKQCHPADhWhHmPn0AOfN027dd7m27fZjNLAiorhiGWoBNc6QyGoIyMA04
-jqurrD+Uh273D3hv/ZJ7f2ZtHonY+66PF03yX35kNwjD7/2llMTQZ/AVPX2xcI2V
-r905ePb2RpajIIs0FDQVEq00tWsnp9mO1blNuNpHLBFpn+GTUaCNhxFPM18vShJF
-eoW3LZpLDdLuzWTXEKMj+TIwqCAPMg5+YNOv/9cpfx0/ko/OH4kdq4nvze20usch
-s3Z23N1ZfeGSwnYdJFWbLpFSCrXc1PS5/CQkDH0tI0c4hWRXppZQwKkxuk5p2i7/
-AHPLQKzArQBga0IweGCel3LG620W5ozhkiKMCSOFfMD1pj8+q/YqfZu0e4qLIpBL
-hMvh1nrqqg3LU0+CrcZg6lZaXGYnHVdPKm1txU1VHkKYS+JIKj7hIRSoVkYe1O7p
-b/uh4dxTRfNbAKKZLgA0A8+HlwyT0xywbqPmBL3aonl2+K41uRkJEW0lnP4RVhxx
-UgDqzPbs2OzENBVqw+1rKN4mYMNSSPH4/Vyb6Rcc29w2/hSTxlVqafsHWTkT6UY1
-7CB/sfz6Bvb3UcfX+7cn/D6rMbq2tkapqynxe4t2blQYepnl8lemPyFBVvU01FMz
-kxRyx1EVOzcLp49jCCK0ngirIUlApUcDw40/w06U2sNwXdLa+aGQmvdpYV+WrgK+
-QPDh0dvBbV21moqyh27HmKOsrKuSoxNTkO0Nw1iYKgNBBDBTRRYzC0dRXVEeQDuZ
-XmiDRto08X9mMVhAwJO4qFpjJJ/ZTP2n16rdjf444vqd0iKqKNoiSrGvnUkUpThX
-5dQdo9B7h60ys+X3z2duLtHK55JWr6zNJR0mPxuklqTE4THUsN6ahpIZNOqWSaom
-b1SOTawf3iOPxY2iJMWmh4ZNePRfBcskckRYmQsTqNK/yoKfLy6Vnae5odo9DdkY
-OizE+FzPZNJj9i4itoaqpo66hetro8xVVlBV0MtPWU01PjsRJeaJkeMstjci5UZR
-biKUAMUbgcg+VP2V49NxR3F3L4SXTRsVJ1KaMuKVU8QQSOHWsF3r8dcp1Js7Dbsz
-m7Mjurc+4N0TwZXNU7VVVjooKmmrqqqNfW1Sy1s2UqqkROZpWuxL3FwPY42nfX3C
-5kt3jSK1CUUYrWuAKeXHHl1E3MXKf7p22K+M8k+4vMdbZppoSSa1Na+ZOerJ+l/5
-iO89vdWYahoupMBXbR6loMT19isZT9h52DI1WPwlFJk8vkqSLKYjKpU09Tka+prZ
-tbPKxqDcsFX3q4v9v268ttrkLCVxrLAdpZmPxN/Ex+3AHRftvLm47rtV9vkRT6eG
-TRoLHWQqhiVFOAB4VqfLr//Q2/8AavbuzKvamVrN8x4ul2+KF6XJ1WVpRXYnIwZO
-WPGfwapiq4JKSuXKtUiBaYq4qDJo0nVb2c8zwWu0xT3txdqLREq4Jyopk0FSf2dM
-bBBd7vdWu2W0Oq7mcIle0EnyJNAB8zinWqX87fg98N97713vlep9q5/YWGxFbJn9
-vbT21umvn2Bh914wyVzZHaeEloIqbFYOvr6aOcY8M8KFmWMIulEKoeW+bN+26K/f
-l+L6JImeJprllkCkYMUSISQVoQZGGDSgHV/9cnb+Sdx3rlTZd9CW13IkN4VtUYy6
-SpaIyuzaVjkqv6WCw1kmopV9VVuU2HZ4knq8FV1D1b6VaR8aZnL1Kqqkk0pYlhpF
-15H0+kOSRhLlXFMVFOsmbUtJaCLirAGvH7K9C7g8xgN64+h+2rkE0iutQqTLFIqr
-qXWWYgBgAGFufZ/ZRxFKk9p9OlUU8xUgINXDP+r06HnrHZu2cfWCZt0TpLTs8yRS
-VbaNaqGPmkBVWR72Ckfi/wDj7MntoGRhHOQwHCv+XpMxufCfXGCK/wCr8+hm3Fno
-q2pwe18Ks24NyZisocRhsNiw1Vkcrlq+qWKlgo6dSZZfK8gTU2lF5YkAE+yC+dYw
-VaTNftPRd4lJRMRhRX1wBnH+AefXDfnavWPx1wGG3T3R8Yelvlp1NhMpWVe4+wcF
-U7lzPYfQm5apaTBbhxHYG0YK6iSv69jylA1OMzi5Hip6lClbDTuYmkFWz7DZSWca
-XUKvK9GqcqcYFfKgPHgeoy3/AJj3GbcZpraaSCJOwKpKtQHJI8iTkjy4dGS6A+WH
-8ofuTJZjHZv4s9A02zq3B1dfVYWLbG4q/K0FTjscals1jcc8la289nZMKwrUpYv4
-xhyfO9LU0ayzwpNz2G42KOe9g2aK6sirMFQUkRgO0UrRkJGSKEVrnpXBvFhvuzQW
-MXMF3b8yQM+sTyD6e4hJr2YBjmQVGltSTDCsrdpFbZfxr/kWd5UOVrtgbQm6vxlV
-l9q0UNX1/nt9Lip90bspnBgp6HL47cVDEKSvgmonkSGKmaOLUwCMhIRi3natznC7
-psd3aSMkR1aj266BtRJpRXJCkcQCaDHReN6u9ktLRNu5hhmLmRnj0fBpcqpyKkyJ
-R8HAIHX/0S9b5/m49z/IfLdMdH/xmhxW09y716xWpxUDClpFkxeWxdeMpkcxJUpe
-LDR0slUNDwxXQ3v7OZ9j2y+WW33VkNtJ/atKaLorqcsaig0g1zkdIrXfd3s7q3ut
-mhkbcIyfBSIapGkoQgQUJJLUpg16szgzGB3Znc1JgMrR5zENQUBeoo5qWviaoXUt
-SY6r9vxM4Y6uCPzf3NGyb5tHMe33N1sO5217tkZMYkhLaQyAApQVGAR6GhGCOsdO
-ZeU+ZuTd2gsOadou9v3pwJWhuFXWUckhwTQgEg+vmOOOqxK7FLlf4tT1GNq8bPjs
-xmMVU4yvi0VlBPjsjPTGCoVGZCTHErq6kq6OrqSDzhZzFbNZ7lewaCumVhQ8R3Gg
-I/1Dro3yRdx7vy3tN6sgfXboag+emjD7aj7eghl6+x9JlTX4yvrcBX3sz0jaaefn
-gVFMytSyH+pAjJ/PsNpuEkeFkIA6GQt9LkoBQ8KdCFtzZG86yoD0m9auISE+QwUd
-LHPL6NAEREk6RrpH5Rh7WR7tPJhJs/6qDpmeExReCyfpnP2fn/k6PP0D1/tzZbVe
-4Nz7kqMJnM/RZHaeJ3hkK2D+JUe49x4iuxm3oaCvyKS0cFUclLGygp4gsbal0g+z
-/ZNsXe72KzvrsQwyKwaQkAIukktU4A8vz9egTv253exWcm4bHtz3e6xPGYYVUu0k
-mtaKFXLUyaDyHp1TH35u/sqq2tkPlDsnJZjc+0ccMTsj5AZ/BkUsGeiNNjsJge4t
-x7YoNK4Gtz0E1LjtwRskmPrpRS1asJZ6mNNe1vPKy3T8tbjC4WLtjcrVGKEoQj+Y
-GmvdRsedQem/enk/bIVg32yuILfmK4AlurRGIKNKA5KLwAVj3Kp4k6RRT1XzmMnJ
-sOtpN+7ArpMftaqqKeurKXFTSU52tk5pFaHOYGSJllpsTPO48iIw+1lPptGbJPaq
-IhVSDFkkfbw/L/B1jU0jSkxuCswpQ8K8cdWC/FbtLdnZD7r2vtrt3/Rj2BkJsbvK
-hrJ8nJt7b27lwqRUecwGSzVGirianK4uQVVFUSaI6Wop6gF1WZPHFXPnLtjHbz7w
-kR0BdIVV1sGdsEAkAKta+Wehfybv9vse82FxdbJBeaSxZZxqSiiqYOMtVXUjKkGo
-I6//0tTCh3PHQ7q2PWVs9RFj6fObXWtNGxSpjoZqujpq0w8Mschp5nAYA6Sbjkez
-vfIxPtV/C8WotEwoTgkjAPyP+Dp7kq6l27mvly6ju/p3ivIyJgNRj1MF1gZB0A1p
-6jq+/wCFvzx+P2zN6ZTr/eGIz3Xe2aqPKSYjceUy+d7CFLWRzJNT4vOtV0Mmd1Gn
-LKk4jkWyKGA/V7inkrmbeOTL3e4ttFsNi3GNS8EztHGsqgqWjkjUlCyUU1Wh0jIO
-espvej7u+8+6lny5c2XMcu/897Wxi1mKOGeSFu+hEjBJNDd6qXqAToJGOje9hdjd
-R9h7229uXrLd+3910G+sFkoZ5sMZKeVM/shqKGtSuoKuGlq6XIT4DK0rNHJGrmOl
-YkAC5DUc8e4Xm5Wq2xRoCHP+M/VAiQkdrlFIVadqmpFePQL27lvmj23u4uWucLGW
-13BlEiJJEsJKEAagEZ1cE1JYUqScdN1RsiLK05npYkaYKWKBbM31U/W/FueeP9f2
-iurUMp0rQj16GUF+FcBx2eR+zp+6+xGRxtUMfVYqNo1lOiqYOJViNvTYgLbVx7Ys
-da0QxDjxpx6d3O5ikgQqxqRn+Z6CL5p5Dddf2T8RusdkpSVWUg7Vqu3KvA1kbyYj
-cLdabQ3BmsbtjLJHHKkdDm4KespmmeOSOmedZ3VhGfYui2Nd+2vdNoeoS8heM0JD
-Baajppmo01p50p1HW4b6+xyQbxBM8dzBKpjdSVIkY6ENRWncwHzrTz6qL2F3pBtn
-dD7kw9LPm13Sa6p7C2NJUH/RrJsyux4wNRsmr23VYlsHkaGswtXKuSaoiqKf7upR
-KRYvtomUIxtYctWm37Xt5asDnvYBnY6qgGtSc5JrwpXz6yR9t/u/7t7iyXXMnufb
-rFc38Qa3ikZgQkdQ7VRgwloKheCgHVSpALrvDblL1Hu+i2/SPVZXp3selqsx1zXZ
-IvUQYqOpkl/inXuUqZC6VE+H1eKN3bXU0jRSn1M9pt5J5pTeoGs70Bb1K1A/EpyG
-HnTyIHmOscvvE+x0/tPzFBc7W01zyjdoGglZSND8HhdhjUpyhOWQ1yQeg72tm6vq
-/feP1xHIY3F19JlsfR1LXTMbbaq/yvC1er9R8KvTPe40lWP19i66to5YLqxmXVE6
-kAnhQ8OGcH/BjrHUl2VJAKNwGc16/9PUl70i6uSrgfp6t3tUxtXSWp93YvCUWOgp
-wtGcV/B6yjy9fkKpmrS4f7yCFlgCk3cuqi3mAWItJjt8kxh0dwdVBB8tJVmrmvED
-HRNy99QdytvrRGG8aP4SSPiPEMFH20P8ujTb3ToqTdTP17Ub4o6KKrozFTTUdLka
-Ktysz1EuTjhrauuxWcxdNj5z4Y3FPWQVkIEwWmJNOMfN6KtZxEqF3Sjawp1IRq7a
-EhADSlRQ0NaE8eumHsUefI9xtBuK20vLRlTQZiYrlTitFjE2pTmgLIFFKFurVtuy
-bKmqfjo20qOPH16bg28uy48PkqLMY6eRcRkf9Lcm6J4MTgjSNLs41OtDHMyZFYbu
-+qPSD+V/6xrf3xsdD2+l/FE1ETTUaaFfEbj8J0/lTqHvdyO2Hu3uh5rvL1t48eXQ
-PBCxiCj+H4RM7EoMacAE1qBk9Wk7eG1fuYzA8hF/3leOEU+q5vpdZS45+npt7Hs/
-0viNUmlfQU/w9AYfVeCvHRXHHV/PoYaIbI8o8bR+T03CJAUvbm7eQP8AX68e7H6S
-i0/1enTcn1FWqD/OnREvkOuzj8oOkzTz72Xe/wBzlP7vLs2ljkyuj+7eb8/8McVk
-cYg+y8n3f3K/Y/Z+b7n9jyeyvmn99fuZP6t6v3l4sXh6eNfFT08vX5V8uhLyWdqF
-+/75W0Nr4UlfqiBB8JrrJBOr+DSNerT4fdTqoffDdJPs7uEdPxYGnwH8QxYnaWoq
-6zJajuHRXvjky1NQ5P8Aga5tKqSgWRtDRSQRysBGkksbt9d9VaHeAf3vVqhf7IfF
-TS3xHspgqPKpyaZZcnn3PX3k5f8A6zq7ctizvPptJCqTo7w+gPGprUOy6mpqIWtV
-6OtsXKfDug+FfbtF2ZsfrXdm34toEybm7+7T7P697Hrt2yxQ/wAKXozY/VnTvZ21
-sVu+hrSn8IaXcNZWVZV/uhT07SaTtzP/AFh5WXYFvP3x4y6mU9hH9JAAgjpg1kOM
-0rjou99191pNg3WX3Lls4vaEsn6W2rFKq/77Dz3Lw3jzlviP06IHoEUrnrX/AOwA
-gx20hrqnyyVtSMQ9VFTx1tTgwtnkzcVPNJBRVr0pgMyQPUQrVAhGZTqGV7+Obe2+
-rCifSdWk1WtM8QMVrSorw65XXIsRdXgsGdrDUdBkCqxXV26wpZQ9KVAJHHPX/9mI
-RgQQEQIABgUCSvH+twAKCRCyvrxAFSkkr7RwAJsFbGcXzq7Dlj/5fvyGG20oHQ71
-zQCgskn1egtpBybXwtADPQ1OSan6GXSJAhwEEAECAAYFAks9yegACgkQ7Thz9dMm
-JyIL9BAArndUyab5gn298I0S15DSvd3g47AlTFXDhoq3yDAWoWi/58se+dq4Dpjb
-entEm8gjsN/La0U7VtyVgQHV2fO3ErSnFAkRAJfLf+6//u0dMi0mKQbPUK8Z/Q1a
-Dq97WyP+28CaFFEj7s4gB2MQgH+kmlok5/IE6mojFbHHMtJG3GFost5cfAKUt7G0
-9KJmZOj5Nh46LGVogoHdYhRpfW57avrQh5HfIbegOUnE6oxn0jwWPNrHzMPpFwcC
-BU4wmXbCQwENqVjgfiVkkAP5ICzR/sWBKPlc51XYiwPIal4tKg96zZlezeGEc2wK
-HI1i+aQmlVuKFzA7vQzjHf/RFinXDauB/xB9anC/z0yF8hCpr80LZ/92mLWuG4Nq
-FJGfIA/DDCL6uXhanml8Oz2UbHwphCVmaJgb9fetGfNNYmfDtpxGzh/kOOqA7oj7
-aTqfT96zHD4L/b7n9SXfe9elttgDbjz0WFDyLmY1Bsh1kch+b3kCfHBqJgaiAppM
-4TDwiBLXu/+uI9b9G3Lt2yw3canz1Wi5mHOfa3bSf5ctvTRCLkLyy8SdE9mg3FZZ
-hizdXqNSVO2Ik2YsfdbI4PIQYGtrFY2U1BlMe1I6z/2mDZ1kLVGEqh9C+NENg/KY
-CFDNn2GLkNo4eHcThdEAPUI4NLRVUWH18wl+A1s9ak8032jP236JAhwEEAEKAAYF
-AkslRjEACgkQMXxt+Dx3Bc/GwxAAmneII98fueCMyxS8u65PaGmaRh+xZiAN8BAj
-s55aKs5K6KHTOUTlTdSzfIYDtywzQp1B1dM5fNlyk9/zAwYSlBa8KGXTKgQjx4U8
-Ge13Md7nCDDgZQHJCXcpPW/w9zWJ/VXGBaxV3AEn19Y2LeSim6B7GXG1eiKiHypn
-Su2T/lLlrO3Mn3VYhSP6j2ZFQc9ryD3RhEICgfcsxdo7Y/tWRTWc5HfsvDcw9Vn9
-LHIUURANnMlnMjyy3aQZMH/tA6/Im5arNLU2ApcEkX9kPjBn+eoKEOGYuOhvnV2s
-YS6qxME9D2+Xx6ykmk4r/D7iUEnyNdYf7/euQG8e0NXeeygR7kliltzMXF4iAM7c
-wwcMRvFiYUb4ML70IZCoZcUvxGbVbnvqoAP3Pk60GNZ4n3XN0Ikj9Ym/c2ghUgky
-bY86fKs2tFYrNSjkbRJecmb+COnPEQCbpWgv5oPROg8NuUyEc2jJx+/BnMCONAt2
-h1/7UQ/KA3GlkoTDVIzDMHPSu2bF4TOz/UzjfQetj2RJHc5xi+AuIdGsuoqdnNF5
-C2I20FmH7iVN0GxetnKvyobtDgJG6ohO8RFuOuWY66bVvUhRwf3aHH9CJSxk5YV8
-XzGoij0JoHamw5P7NCPZWvaHSDt+iOkuvgEQqSMsmId9xwoYzk7GrB0vLev62V5p
-UvZ+q9qJBBwEEAEIAAYFAksUNc0ACgkQiq+I1thOQa4MoyAAnpy+eTgbQ1xJy62W
-Tqy6nFPXcp2mApwCTB+vK6Km7niYBYTw52SYIEC/Sf9FOU5CskFgYMerw5/8oBKu
-C1JRGINxjjOI1tOZAiywROVkHrjQ7CxCh6kjoAhQPhMjECVUx7vmwmraI51aOkLh
-ZJZ3XkB8PO6pybR5+k4zr4JBA5EL6gEFEpKymazrZBh+6CqgmQfF0m78eSQ2OsVK
-sG8yeHxtZJ9Oo7O6yAWpzazOyDxaFKoet9+5cv8KI14187Sk+68tSrFhyNbasmIc
-DjYbTieT/o5e6Pxy4wMvEkAkpRLlvEKg3BJOcw16mr6U+gCTQ1UfchBxFdATG0LX
-HCTGX82nRZ8AzIhE1+RPwKJz0ixsDGQ6mLW98l/PZn7GPv94XNKSp86i2g689onY
-Z2wVA/dfbzxXe7Q4/THenn8sj91xMTs1F/BcUy7jUpE7ErHxngxs1AUN3tAsd73k
-l31L84y1O16vaQxLLer6sEmvpRQvzXIW/RVNN4PlylyDgXVI8yUixB+UXuKkLe9r
-Cu8Z7Z2kzJem3DY4twliIBqet7+AYlTWgzg5gT8Iq+omb1VGaBtBXrlnSrVoSaH6
-obcUNWlA/Nmkj6qd39iIoywJrI4mjfXtQ300/pIPIGDpZi5xckd55s75PeZ9WyML
-jF+ljOlcY1F1qbfl1TTx4L2ofzvvEbh/T+qQa79fKFPsmqoZaSG3Nad2KHpGJR1T
-PFjZD/EktKuNg6m3iWd4fDi+oICcmBjG+lQQwZhaeFwtEnU2/JfNOzS8OfPi/73d
-vX8nuaYdjCFnWs0NM3kLrebwcmy6gGskFmocn0rC50jJZ8Cs94CEKPHL5aN5jmpX
-gRX0SjGURvMZDvICc0UJgqLPbnoWHbaKm5b0/ICobdjCx5cg9GJ8u6OVkst86Nne
-WCqDSWWtawnH1WySkGQPBB9Y3nxH5j9aGr+jmCiCOrWbKS9KnbDq+JlDicO0YYww
-iZkVSZfLWVOwFMhUfCbLNsMKGo62jEJd4tSCHk2Ic+xcKw71SEeFx6jgaMrV/Ic8
-anr+dQG2F7Oy3VBOe7a1JxPBg1R+r+Trtk6t0NTbGXhzevY0qmInqeCxAAC7+KYT
-jgcL/YMt9BfQa9I02jNQ5FhvToCGZ9fHtUjjLnLoinv8JJI33aC+oQCmbldNHSdW
-kYBMSNcAzMV8kSGZ8YSN/brYEcD1QuLIq+EOsAZw4AC/iknrxLeUHoyuumS3sRlq
-/jfy3WPQ8M9wYP+z2w2+ZVkTb0LoYjbyL0FBOZfArQQ0WgkR/NuSGMV7dKz0i/xd
-XYuLFn9p+sYNfSpt/lV61zYWdxsou9dCW7difwnhE2rkjNync6ox8tAkdKFBr3fd
-5xnnUohGBBARAgAGBQJLontnAAoJEIYLvubR+ZWQ0IoAn0RtPgyMyGDQu7Pw7rXC
-ELQr0KFFAKDPCtIYyMgp06G+UGsCG4d1LnYaJIkCHAQQAQIABgUCS19lBAAKCRAZ
-PxgKtV2Zd4+7D/9sLmLfudG2tt7So9qf63bOYFHNvisHGxZjQFivM8V8VRToeSnP
-gteVCxsX/tbpwcWs3dLzHDjEEeHIBBVKco9HVuTudiL2rh11+1BJsjFIsoeZwcBs
-Q0rCtwKHSDmaSZRmKSgRIwz6V5fOHViPrzQiqH5L69ngmoBTfXI6gtmMo1plexf3
-b3tMHY4J/29Y9EjtfGiToUtcVW+MD1n1U+iI6IdsJETPlE8i2xfmeIADUQFjTbXL
-g4mGga6lyxiONE2dyJCGqPL8ctyt+OU55vVn5vqx2oxI4jdTURlHf9mhEMc47tgT
-E2HfbZbB8GLxbWnDFgQiZJZECfU3vG4IgUvgxDYNIvl2er1ZQxIgy3+PsbMC1OGC
-V1cHl40HJns5AueMQ8cbx1cEvkpvxighlaxq5AKb0EXvs0G/r0HU7yfj4HwDETJV
-8mpmCwllHxBh8bnVBBlDlebrintFjSYr6jdhdb95ZJjlgnbkSiknHBvqQ5V8w4eb
-8+YOBH7aKwbhmhL+Pwc7ATrHeJFVunzsWFgoUyrr5k0eyz59vTGuis6K5CzzA0Oi
-KIPupexetjOF4B+4eSYGLxlmO+1wPhHnisOTTyFN/32UaJ92ozvw8rW2VuywW8Xy
-rQ+F8hyj1xy3sopoU61dLOAJXbCPYLcCRvHlsPONqjM9jK7DSggf+XZuEIkCHAQQ
-AQIABgUCS191NQAKCRBVa7/wPwoEttuED/oCXyVB884L+Z2/CvELYowDzRmIeuZn
-sc4eqlS1Oyio4Dxl6PZM+BkScFNV7LH3904tYqo7YNcoLZ5Vbu1j8OaAJGcvBf5S
-MMcZfEULzLmUAKhPZ/J3XkIRMcd9gS0NwCvwxPq4wR9Iigf2UkzcGdVqvJ3U+FNv
-Z6DXRt1C3FRbZfGqHtkuNJKp405PiuE+ASyJQe8B16tEGvcohklACTijQzmipp+J
-D9O4Frf+iGWimrdObDXZdjg8zfOsruL1y5PqQ2hUPMLIt0Mm75g9QDcW/HhE1sDj
-MSQmdx8cQerrBof3KfNiW7EeWAyBJ7+lGPS2UxWIiiLYEvxtv2KgheffdRNouhW7
-ykijxop4YLuf3jPB89hY8xLKFiqM/OWH7z0fP/bJip+w7B5mgmZSRmemJDVl6SMU
-7xQ3UjLRASswc1YaiNatcWFXFaNR0+oBbLBoz8tHQ2kKzGWrbO10bcxV/dJsqkDo
-gzK7d+l1VCwaI4CALFVVwWgt9szWqWAKamGv/9u8hS1bUi2IshG879Hgmbb4KlEb
-/rYcOc2t1gT3h/7OD0tuWbUM+DSlK2Cdgb+V/kYH8pzkuYbOXvt09veA7QwijBrW
-7AjOyZXc8NmlDUEayTZIeGxIdEmsgFidV64zBXOZ6w4ySJpau38RYiVu/XRrSXxD
-Tw51NtJauVn/qokCHAQQAQoABgUCS19lTAAKCRBTPe8VXXu8WvHkEACF65H8WZTx
-06KHKRKNpTMPNc8PNUKoly0mNYCA068r+lFWKBfjrE2F08Xl/W+GaO2q0367yTAq
-xR4PTPDttGLxFUBWN/H/LdpcAxeDLHu2W/uK/ZF36rpHLCcVvL0XgyB7+Fj3ThdV
-RNlW2denBQmuR7LhNEulqznPNiiKJ3kR2LjdFQVzPv/IKIWPrCQoNyDt7oGzJV8j
-IZMHxIdAlxrcy6t1jUN99VhOrDZEVG0htFb4iSbzeUUjZRwYds+6twaVzAkrkqPu
-sxRD2KyQiXlk1PM27p54YReVpYKb8qOKfBuuIYxNrZ35qklv+6H0xKwXLibsuI5d
-jlVwrA9RXSKcna+VVnBB7m7WKdDqueG5mxXSYOLlrZjq7Aujwv+TWYGG5jVHSux+
-XtxjvhIkv47UjjUqmV6PUnZj6lwFuoHXCCPQ6GMSc+XZlx7tEf7EdTTxzfrn8n/x
-T22bYQSHCwisV7TCNEKZp76A9MwA2GT4hTspHN6Ty7aMouCI4I7eofXtRAysXnD/
-4tpgpTldTIFN54jNI3//N5XXOEueRBF/WzR4rzHguyLoyEhbxEnDwbXuWZjfFgvT
-NR5F+4l4YLFmkz9ofPG4CWQg2xlU4M9bWeydik2V10yEJXquZVYdmPbcR64ZzeCr
-HkMmbsJ2Dtt0etzdl+t0hvzrSardywR68okCHAQQAQoABgUCTHaSHAAKCRDhNgiK
-GCS9wcSiEAC89ttxfq/uPRMY6NLAUivhjqvNkM/bPcUjKmj2LcvSBz4lGzAPHWJQ
-HakHgrPREhknWck7/d9jYYxDblRJ8Gu89v2KI2NCxc7PX5XeRhDWH11FQ1oorazc
-hxW/v47Hv05ffDRlbpTKQalrtOzyLs8yqXgfG/vrYcNEjQimCHhYPenzsndp4rcA
-97IAtOdhDEomQSw4c14QAqqZpoDMNQ72CapjAEgp/Xkgw+kQDertNw1gD0r3m4Hr
-75CVR4HaX5ii5aUAUUjClb95ktbZ7HjROCVoO6NLnv+9Vogozcfrh8gnU/g3DcOU
-TyOyK2Du6mGrcdaUHVcfSMCfmmQaBnGioDWManP6WhkAohSBS0HZVvXhNeb6fMzT
-AEoj9G2m/lzsG/Kg9HN4b6Vdot3EjzAKLPyG281aorUvIQFB+B01Ija5h1AjzdGr
-EyNguhV1QoGduvNJCHNACWBjZVo/LKV+VAi9W9yr7Dn3z0VP364I2YVpOYHQ3Cg6
-uf35ZsVHrGZdNw7xAo9BqzIGNA/+Xe6EgxlSEmEu7x6+1KkqxHPPk5gtJr2dKzA+
-T4toWbKSq5F5V50hPeqVsPdxqKjzNBKlL6/g1DYfwna8Cp+d6+peMRR6MSYaaXKb
-xaCRTQg1k0bQ89oQPSUPtIWA3wjdXAA4P1ARMP2N7R6mnJjbbwdxoIhGBBARAgAG
-BQJM2y7rAAoJEBtId+mxZpKHgzYAoIB+nrJL7I5Cr4QvhhlO/El6jlzkAJ4+6Qk9
-14NQmFDVRrmLzA/3Q1NXsokCHAQQAQoABgUCTNK09wAKCRCCeB3kbVlU+n18D/40
-xttbcnGbNQor5wN14MjgHRFYKPKYLfqp5iZw3hKhBW5Eg8tvofO2covZcIs42aef
-gL/h84nae40YjW06BE9yNZVYXbZzvXSzoerJbKdYcuYGklKRAqfJ3vKP672uU7Zo
-HQBmgGMLhegVsLuaOJJfzMmOKqSueJJrDy6c03wkcYsj+liK2I8cU2eUewlLN0U0
-38xp1CZbru+zV43Rwq/Clpuk5BqeM56d5szzwELHOm4ijLTFLBc8qr5l+KDEHJE9
-30MIu+2PkTzKo5BRm7XNhWq4/1ouKiAfXGDrwqdM3jo34/CyDLwF1mZtw4HNSqZt
-tBjS8IJoXa/Hkktqob9+hFAPtayBXxJZhNgnjsu7tTbOIsVHanqFGYShA0DDaycB
-s5nkPkCAuDNp9t6+jijWiNtB2UeP/bJHogLrn6Mv/2W600L6lCXA9gqMRY8jXReP
-tT7oZriamSYgWbQndXXAFCOVM3wVC0JQ36IVDsjHmd1aZoQ42euq5vu+dK+kSWei
-DSPWHJiSiD1LauAyEyGKn4XKOvFLn2e1L/BZAuUTsjyei5iTpSYpouz+S9MsCDGM
-PTDJaKYWURp3/qI5y9c4Sd8xO5EhmbUZhsHFWqu2vi9/b4bFKhz1MGPsXDk6kHD1
-KiSaqxR2Q4epslWdyfwesw7d34X5YSV49wvLGVGUfIkCHAQQAQoABgUCTRxM4AAK
-CRA/z1Kf8vJ6BkhxEACeYh6BXFa2ZYWYg+aOYoKd4RxXh7XBX7Ah7driPWsNTcyd
-hq0VP2CY2trx96qdK/Xf5yHZ83UHuVIwtkr2M4+K3o9iWPXli9LedetXaF4l7PFL
-yYZwYu19HifJn6t7DN8bNa7lkFu5TgL8Fm8e3BxTcQIoOomyDxYm4y051QISeWxT
-9m4oPSO4JBd/IFB74zxUf997m4Lhm01mLuyEFQSYIi39UHFIwcbRdSNaA5AHwi6M
-kL5ip2nRj1QaP6J5JeH5efBta4oLgSPrma1V16Jp10tqtfpot7K0mEIaRQaSpj9n
-M/kgvsbU9T6MFZSvvT/sBTAEH2q8pRt4APIV8mU/bM0tuyQ/FVHYvamzSmPgKNLs
-+6LnupuGBS+N+RO1xJ50rzCvVMQ4LhBCcdinshhXH492MKt3VlcN6djQs9iZhopl
-j3aqT083WG75ylLuoQwaB3jmCV+J9VUTT1U6tTlrJnnx9w8vHbOITIMEs+rmSS/9
-RRZr+7h5bIwKPqTHhA1qVjruJ4L30sGMsc6uaCwF9mHbpjXy54PcoMpcXLgvj+9w
-WGz9EB+3k5cbVZLe33qLGnTv4zlENskZNbzqTqPlDhuFYW0pOr8Mf5Vt9xNjTNuF
-5xUVYQMED+6xIwwYX05IkRT5fCJ/2rIgnvw+VjMCbLZ70pQetF7dgmrtRUwiY4hG
-BBARAgAGBQJNJK0WAAoJEH4q/cwONxoJAksAnjoZfzZrAyGlje7G6GVFV4Vi4O/P
-AJ0d7KcNvSGi20pr2h57Krc+XepjQYhGBBIRAgAGBQJM1CP3AAoJEPQmjufy79Dw
-RQkAoMDto1YFid3+0mq+lHsczMCKphVNAKCL1z17V2sx8lGyYYMjBk0plCdHxokC
-IgQTAQIADAUCTgOM3wWDApIJwAAKCRCMleyeQza0SGUtD/9yG6sly5LmoXvJSJfD
-Wv1hHP84El0NOf5JklVQgohzXjyRF3GM3hDzCItzx24718hoZpPoPJaguPLjZaoM
-AINeqbC0bUA6VAHR3iLwPmFEPsB2ynKOJza0nd2MJgYyjM6U2G+lGzSMGKaXcAG7
-4nr6tWJqqPrkg4a4wv4UP3H9mt7HydiLN+QqNDr9pJ1fiQik8RIRPLgIyhfh+1nb
-DuvupK9H7ZMBTsnz5MwOWHCnj6Dx0M2wCi4WuT9lA3hgOYMrrNO9DCw0+8GKt3YO
-24Ivw5VsN613slD8BsOiWkVWuhifCJLFih7ZRqMFC5uvhZAmBSRjXPTtvAGde5hm
-nnrE42XiRUnw4ikOObAFJ2KYgcOlhDTTOjzejrEPE+EPcuRB4GtyCMCtEEpzJcY7
-OXKhSpC8JByNzOdyjDfRpzEorU5Tsjaao6ILH1WJgAyYyosKc3aCtjSnkrmMLyc2
-iUd/LHwyHGToqoQCHVmAh9KL8L2x/MgkT6naJwB9a7KzwggMmNQhd2xOB/+6hDOW
-FuxBNFl8CBt+TiDs3E8BrS18uKQrvUa117boqOewjqmwJMGKTLsmEHNWVjDFkG2/
-oES3xo2+qpfwWlMhLhMxjwqzYSRrI74aGWZFQEnUGlVObThx3saIXD1uUAeZ9dL1
-6+wjEOQWleL/MwEVADJUePpEb4hGBBARAgAGBQJOvCRSAAoJEAsDrm5OJFF8/NUA
-mwfjmRqfaHmFbln2cyO97algu0mTAJ9vf+imI8yoxL9V2l2GiC/kDr4tiohGBBAR
-AgAGBQJOvCmzAAoJEKvWMuzE/JplCNAAoL9zXofnh2dSzIkxqBKouJ8NYgTdAKDu
-2wNCqRTDeDRiVjKpyWai3hpb5YhGBBARAgAGBQJOvE7tAAoJEC8+XTEfSeylyzMA
-nA9C7nFOFX7+22k1zd+NIRScXChuAJ9l4Vt9JMe2J6FcfjIQqqvSeVi83YkCHAQQ
-AQIABgUCTrxfWgAKCRCarPtWNSrPduWDD/0UdjOwVrlh22EdHqJJk2O3kLrOG/sx
-2Y2QNI1cTD97xfl2MrOMv0h4mrDuinY8y2Fx60gTpa/7ChII/lExXKr7sHshj6og
-RegdY2eVp9YmCiLZ9bLQA+vXQ7Efj9PdnunYEvSDL4eQEiw05UHujsH6H2l3un8i
-H6O+Jqi1iaS6izKfbgD5R/KWQEiSLfS/zlqRm0+B+fNkuKKgvLwquDuvGGa5SmkJ
-lESNdYOmGxgP5jE/EcxhpAAc2B5nKjhPtwFBSrATJ/u8BoyzS/+msl6Ig+jWJ7VY
-waax2SJ0b+lLCbJn19AMMF5+zlllk0iFgJ0M47XcFvXdWEoOkxWuI7YH9bQeAUbp
-WOSTxM7VnA5UQS/N3bEb6npVHzSCAv2UTB5U3t5zbTFEOoXA+5MzICoex/3O3Idd
-brIOZIXf1GSaYIT4TwycB6UXLnUSBcwYV33g0IzILbqjbh27wCLeJF5wmMgU8xLO
-0vGr23yXK9bBpBjWQcmME9q1kJXJ439RfjnoUBFeoyE/XpoJ0j5Km085c1ZWDzUY
-6BRJjEMrM9kN1U3TfXLEHrmAA1Lw1EgAmxnrgX70WgnG1Y0EfNMbnJG1bHV0+46E
-cjn0t0PuWX0KwwMMO2xw1UUqedk+Jq3j3LbRXuFMdD2TcAewj0QFp9gE8lQSt4k6
-MiUXuDTDCXVBt4kCHAQQAQIABgUCTr1SiQAKCRBNFUEQuEUI7HkLEACS/yoMCNKp
-PB5/7pgraYwv+ddNTmt0XCDypJKLPk3aU+6Zv47ixzWb0fsDCZrBQsgP8jz8iIeQ
-kge2rMlxajaKi92xIYSKYbLIENBYa07OKEJ4uQS78ajrSwtEMX5EczjyNMapFp6e
-46FBMILhYGMEAt0MjvYC+7fEWE/i+QW9X4K3N/sjxV8BqTHYTLh5c9tsVhLCZeZe
-5V7bct1HvElJ290ABk8XNMDUlrHuDQAmftJ6E0K4MaNFlA7pB3dje+bTX5lWo5RV
-bfZ//E45cNOvtNWZx0ArM3OqFhyiusH3Wi/RgKDZtRJCY3tshpV8sLtH/T2eCXKE
-8t956zCn5elZi5NxUiADSbzfyC0rUl3pftgsdOFBxRbwWpUkGGBE/ho8leXB4Jfu
-FTva6+OnUTD2c1t0qpDvwNwsVkOLQgdVXtfV5/PYTmcdKzqfHeP8en8gFZPPO7kQ
-xlDUHDNZGK7Jff+J4spFRDNksfgntIUHZ7qcQgRrIAlGj7zS9Y+bnfgTsqnpbsq4
-tDA+Cd7H3VxK3NF7bdrLhDFSeYdeOnRuZoUygJ0HRZelmYrRpLMtWW0HQaT12IbR
-gIh/1UI2aUBoTALm+T4qeRxbTW/r1yDF/gv0f7soyJ/8aiUqt8/TdD0t03ZwTjQq
-Q2wtca+4dJOKggHAYh8aL9BsD1WOitiFM4kCHAQQAQIABgUCTr5o4QAKCRD7Yz3o
-9cuua7f0D/9g6YtdXYH36VClOJ5zhCH/NIboXJu51NYN9j5Rv1SIywXlEkSfET0g
-WOIDpLGuFWFNnKdz9V+7u1pqgNgAyG5CFDiprXB4Yl8popy3sYiHD8Ga2LFbd114
-+xYmHi3o/RmdTf1O8WMZDeusnlkMWfuBXW1PTIBnD5BuMlOu6DzBMLwbsj5cDH+g
-H7VPeq6Uop6CiGL8H6atpHfbK2pahfsWr/lLefFXmpmd7DRXXDqg1z1yc10N5J0d
-Bzi1Bc5+1MTqASkuz9gl6Anuki0wwpZkiQcsicstxNjr6ZPPCORNBhm+dEM1JOKz
-9ifFtRJ47gb4vsQTxmK6G6QZbmYGT/cQxnc12JNWWMz0a9Zl/Qb7k0cyhp60rbHQ
-FxlrJAd2CsE5RBu2hCCN/I2rorM4UueRpsIqKCiMKDjgwHjY6m1juI98TqYwYMpb
-P/3gXwVSzDw9N+krIUc+y3qwjLxJIRhUIYYiIILkK2Kx+YGZCR9qGOuY/lEFRMee
-Q79ZpMtCYX2OHDi6CU6VUGYZ5bds70IMWO5AAteADg15jKwbBdoUlSNONMTx/+hF
-R/Dy46+IIwHDgQPGxrcfB/ngvHK7R/52Tx54KOfEk9JYcy1BRyjypEpB0kmoOkNM
-wbsll28tKbTsL9fUjBpRG3fzdkl+ew8oORVk+tLS/pcmR+yjYta2y4hGBBARAgAG
-BQJO0ATUAAoJELJ7lE40iE6F4QsAnR1R23XrLJXjoXBpMTjB9LlIFV+AAJ45TiGU
-FxHKJNPTsEUNvFLpSiO46IkCHAQQAQIABgUCTsrLgAAKCRCJofZRKiOcLPk1EAC4
-+q7bo7QhakHUSRD1CVNo2ZfHsyFmXSyUOCAHkzhtkrPwolrLqYB+NDfESyOn8RvO
-nEEUOOLhaaTfXc3BZlP1uiDtpiNHPevgNkiCSsBK2nMuaCBUzKmxzAqdrfrh/Lji
-PUhMXOD7mTskzvDGRFHiuUQs2DPhjORNnX0wDpVd0Jzop5FzUiiCovlVVZLfuq43
-O7tcbb5xH2JGQCTvTMYC0W7w7LdXrRF/dR2ny9asadDq4y+EOifX/scpCVcG/rX7
-780aoaSF+OzYwFdpAPabY47uS0sTfmfD7MTDladjDF8oQEZ6BxZ7GQB5Qwt2F/Ae
-uODTnS88OeK+K5StHBtLOmgA+tPH7hfhXMddNTnmukI8CgGsppwYtyu5XazSZLQV
-ytQ6gCmLdhYBdk/3/7juQ13r0Ew/V/tEem39KCH2/cm54PLcHZxCHgMQ9FBZ79+c
-atwFKCFaJeqAXdxsoiN06zxFGnLNy867aiP9d/DkWeoGOnfesK3WkYKl0b3ShQsa
-ZCaRgQA3EYbtlM/FNQxdzgNENfhMune9wqrIaMNQyyH4MA5SGWMb2AN8kd1Fzofc
-ixvoNIneEDiqkE6dYScwOn7LdJ5VBHQVb/dHsmE/aUAbmFa73VP9FtnDEFjZZ3VG
-NWHYF7bDmg/0RNKnFbHtwGkHpQOnu0PzKvNH/j5EYIkCHAQQAQoABgUCTsFkCgAK
-CRBOvAyfAgj8ERcfD/wOQE7biSCEjhJE6E0dcItAsCStJx2PVuo3CW5JgHKuEk2u
-yasRGL2jxC9dc1hDH586OmCHliaxFI8VnhFGQ5EELvyqWmC2iLMI2Y8uYq9Ph9zE
-hJT/g41HUv6Z71ce8oLbGBztoIWK9FMsIPcoLILiFx5phWRtcmK/thKcYVk0c588
-pVRytgtjI53gIPXj3c804jWfgKbCbPBRErTEl5j2GOV7M04WTuBOinQA2f5w4wDp
-05Zz7Zub5U/5i3+PaRH1a0ai7VgfgobkPs8OS1EVPdBCORQJbcc7f+sADd9ERn0Q
-AZkGxB1a8/cz9J1mpHTgGpctdGYfQqgvPJSVDVEEIBmZ894dObukPxyiSAF2q07r
-XF00sEqYSJsJ/1Yti0DsReOdrMmBWDN2CRQImu9oVYk3jUySEpu6b1kslZ/5CDoj
-PRrfbdXO5XULEX0FLE/ieQj8+Y98tPRw9boJ04EKmVdEySCIE2Dqvn5xpZStpl63
-jEind33FNOL3Ndt1NXwrNFfwMw6O32xNaUWI7tpdXfkeHgawzoZKWhnqZVOxZUZp
-jyVaTxFOGm+qU3IRAsPHpQDvsHOCBxqpYh93hLoYI+uQReLB8nI5K+2/3uFfjQeO
-McDpMyVNMtaa32FOjaWEiFlSu4Rp8qRv7G4ujfvy2VELk0STDTUy+4zNBq8U/4kC
-HAQQAQoABgUCTs2X0QAKCRD1T+ZICIM1qenOD/9cbWZVYOuUIZ/8ZTi4tBHckLjh
-iIFyBlgAwOKwhYIxOaZnQ/jDLIQuUwwpPfCVM2hooR45gz02A+racUwvhL7exoYp
-htx0KeMqxzsWIlWKLvPm9oN3HF4DD0iH/l4ctBr/5VM8FhDZeNA+M7PispziM/L1
-SUl6lm7nD2CaCh/R6AGyiDB4AXhnKQCPGJUjY0UlJcCfOvEAnpE+4P3/IDl4T2vm
-1pTfGLBxJv94SxjuGR+Lx9kCMeO196ixl4EAwBEibIc4LVGfOjzPtc4rNVPM3S7h
-WatdTgMDXThaoFOnDErlFOSdcmw71A/+mEa1luUr27+/KBSlnmdWcGFTjxqDVOD3
-ETmAXAOBGp3VNb71Fd5bCOYguVvAxlJl5lZ5OUqaNM0FjNrz/XWRVj+ROxo6uMD5
-9R10wdvFGjdFLn6Vfwi3mwaepDUZfepA+URQvsKX4puZAX+5U61fIqFFOTgXAnJb
-D2p/HsnieNx5bWyWqpM9YI9OVYfDnxdnUXcAPz8S2MxosEOGy/QvljQ84gnlh+/u
-ElFCnU4voT4dZNnEC0BaseUs1cXQ2UDUA4f4xXFDkuzevEjFdGSANVT2XkcFv9QY
-HFXShTAJILVvDx/9lFfqW7BpsMX6jPlGxsbmgLr9KTbOOtiw3JwnI428F1Mgc1Og
-L47C5uP9pbGD0zAg+IkCHAQSAQgABgUCTubiXgAKCRDGh181Qc794LvND/90tpSk
-f2l9JI336EfjjtsUShmzqTolRrMGDuH0ibIAMNsYwMrl7cBdQitUoPIQM/BuO0hW
-fnbXcH2h4P3IynNeCjO1aHQE9pEb+KbnwWVj+cXnIHNczWDuI6qXQ4ELcIK2gnsc
-VZFP3dj8S76D4lgQn3qLkocMdOJOo3U64WJ846b0FdIpUX00231FRS1eA6V+KdWv
-VjOHA/fprV4gWPQGuRMF4UQ/Ll66Rbyzl3PlzYFwr2tOyyJF0UUDCpU2AWN/xegM
-vXHHc2cJ/C0TP37W8y5lrbS8wDcyKFoPDua9zhPr+wZteF0GVxYXzC3i1DHBAhH5
-tjWHXk+QHEa+jzwoxYmEYmJ2LgxEDT0Fzytn1y52OCu+uhWznVWUiURnGhF6c5l7
-eJXDq/1lHkO0hoAxLAIfbU6gEgfjy2foOGxOTtnJZY45vANa1MAvH2vbemGAWONM
-65HeIBgNhgO245FZ7jCJ0ss8ZvM4NhVi0Vvh/z2yjQguvAEEIqBnV3um8Dh0Qxf7
-cbsRfbPyoHHwX+0o7mS1xXspI/Rzhc+lYzqbY2FW5F/qLrJ1KwZH3zR8POReKgLN
-Dbg3hstxy584NxbM5D64ux89y9W41oZmEohiLIH2REgnLIkfPJFmn+k+D3Tlk2fX
-CTUkkRo/ADpifwKQ23v74CUusv05NqLSmRH8aYkCPQQTAQIAJwIbAwULCQgHAwUV
-CgkICwUWAgMBAAIeAQIXgAUCUSCPTgUJC9IwFQAKCRCbuGOw9Ru4irAaD/4/7pgA
-xHEyLq1tcTh8u7Vpv/dtumNm6sM8PRRcLNWaHWlHN0qCkGdvaNHCZkBFQiXGi8FM
-HZYfhIzuCHsoId5gC2bHmaZfIWveHhMPGXo5KttyWUNZc58Vr6/yssYg+7IUj3TW
-VSJHcx4nZDDfdl3p29fiWx8alI5Eme3NFOtTLlKKMz1zRIQdUMMfsBGyFe9bZE6X
-kmrDJkj6lLUNp4Xw/34NtlgnrAvNmsdTGR9SWhB4LNJTxZUWq2+2mRLD3OEW61qF
-T0zRdSPxvdFloQ/XQKAdSNv2V/7wIcPdB2HFZdyf+SFnBytX3IQ7LnQZoiTZ4Pfo
-+MA68fPjrJEAtdmHDoWhk73ToNbd8veyTFWNBCsVee3oLKh2LDnTFnObG8Ba4YSN
-ivTRkpkt3rtgUJCF06b9S8GWg1vsIgVQJgv4mTCu5+YjApefGOHA4I2r5NfxqRbL
-FM25C86LYS3z70PD5kNAPqcrvtd4bOvo+mICHPYMTWSDvlmYLFAgtSx2EDtyGZ4w
-4et2lLhhEPPQEGfOrM5IxhviW3thBPl0QGpSKY3XdviyWTZ8nzjuOoW3bdBhgpAO
-jK6nzYGUuaxIRPv+UsRZ0R+j+cjiigyY5RnHqMxMT2VZ+hpej9HfJaTkla9bJlDu
-THTpzGHNemLOJdHFv00RFlCNZb2bTY59CeBBOokCPQQTAQIAJwUCSvH9HAIbAwUJ
-BaOc7QULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRCbuGOw9Ru4ig2aEACU2sdb
-jNYVomdNeLTEkHpF8TWURZ2Gbh5HSqv3kNklpDUONU4f/mhuIyVLQ72LkRIGylwY
-VgyfOEYB3kgTEEqtgj1XqEcAvJCafMiE5fGrBr8yGchFtSq05btZtnJW60rKDksU
-8VhKsAJ9anj1Lt8hWeG9LhJJ8JX3pZ7gPSmDDe81Pk70SiYOfdB5j91hU2quy6TQ
-SxuNRspsElHuoIo/DU5sayTG6JBjtCrbKTscHfW4uT7JQQof34rZ9XLk79YYPoII
-DczXcsvg9Wx1kFQ96Y3GKCj+RL+2Vhw6MFWqJ+jlPOUJ8V1LfyC3Yc2+/hQR9KZ/
-g2QnYBHw19huvO55qnGEvCNn4RwueZOBGh0XDBw6ZGxaWlxf54y3i02djDpwkmgq
-16CrrkpBz25nYs0INiBxRwjN9xgEbBiRo39lkouvBKc2Si8wyaJhKD09A3w4i1QQ
-xlgD19VoUqk/80Yway9DbZMwh+tmpEtVXB+vaNqfIwINMabjsZPPiSj+8wlxLHOd
-QHH4gGovxVaeUHQ/BZVKVZAFu/fD5+pasxQ0IpZAcneKoZOxShpeRpzkP00rCvaL
-si67YU/ak6LxBHWcTJQxcLytml0TdC0wk0WODCC+rEhQ+jM2uDnlr6N/EDuujqJr
-bqGfHNFyl8a6b/9l7S/b6gHRdkx96jfu2097t7QhU2FuZGVyIFRlbW1lIDxzY3Rl
-bW1lQGFwYWNoZS5vcmc+iEYEEBECAAYFAkrx/wUACgkQsr68QBUpJK8ikQCgty0w
-1I+K7W/Lx8BYFR+m04MfFEwAoK5ldisJ8CmsyWR68OT6RocYZVjxiQIcBBABAgAG
-BQJLPcnoAAoJEO04c/XTJici/FkQAIJDo9PW3CY4Qu2pTlwuMVBSB9RHNO1UJLyP
-Geo6pBhN3KnpJu9ClqfmGjF/Ln/hXTlX2S9LxLp5/YU2l7JZ7kyfMd3nlW4tZQyP
-PUzgYwGNaAsWPdF2baYs8fk420ahff23RT/aIu2kU8kLy3J6B3daJ+bflm09+dfZ
-cbQXBFsHYq+3r1R/F3FmUIbFAZ092CeMdiLPRNF07c3uCi6g+NyxEdUVK2GlYUlv
-RwFf3PUy4lydUMjaRvuEoHENJOObQFci5D+P/VmROkhd50noDEWUyFAieY3CXz1T
-0Vy+8BmXCI1Aa+7/EpFh6V9DZBI7xWi1M8gg/xCD0EmgnUVmZrxUdWMsrVu95dJF
-Bpl3rcsRQ28ur9fnFf2b4E9ouN0kJGX7uThUf8aeteB0cjatEThLEUBhXY+hl47r
-e6ois/aLN/SzwUYBHpGowCbvGMztj429qhbZYB3lkF/do3U8b9+x5Y4T6cjs8hMN
-uEXi7Qah57WGGePJLfeGKSerKdt2yMG3ji9xzIAYUOnUeQEo4FE5TbNlBClcMtMP
-2qb0OFmaZTN0dFz6So8eaKfM2yB9q7rhIydMlRmXXSWlaA1UQ29bPsC8Uyqs3EEn
-xjDy3TipjJYbSzQjosKGLt4HsbEdWjNng8mMaLVwtxlZGNnEGmPI5vdnSdv3zuMt
-M4GU78PViQIcBBABCgAGBQJLJUYyAAoJEDF8bfg8dwXP6gAP/01RptxEUiIP74GR
-Nbd97arDQVY97KibVDH+SsgRgmTo46Mwed4FK9eK8v4EvulcnX4H0nCBoa9mI0Cp
-ttI89V60HE604KLdejSKQ95ceiI24HXZE/jxZz5nk7sZdkGsLgEOSs61rLI/cX9B
-aMAE6fRxks/44D9WyP4aDy4AFzO/rhKQb1+6qnb0icZ71G4nExIOhZkv1d61SxXx
-+HzVHeKhayxG21k3IB2sm1LMFzzCqp8Plg6RonSiLNyrDLRdrNFAB5IUa/vcA/uT
-6y8+lKSGfYhfxBLoz1SJ6TnXDgMvC5gfdooKZElcribYrXBWe37yRbCQ5JDvyOF2
-Mn5jLl1ffqM9Y0LtFRU3azdtTRwls/p/kcmSGZq31ijR1UQFxcWakPnwDr04+1xI
-p4nweqZGMk6vCQr04Sxo6j6gFXQJx88cMgY9r3TW3+Jv8ko/s/CAr/1dqsQPgqEP
-Gx9FtsCwBL65MvuJBVCWxHTOTWEwNAMkf3umHttfSOH3t1IiLheTSjEpexTr1lS0
-00IzkNULuOj8Imw1Yx6BYOoW3kPysBts/rnEa2xrQMO/OptXaW+byCaxDoZToa5X
-GrCJuIkMHw+ago9mtl59GnWkAZhF4us6J1vplq/ciHbcG8ZA8so4Qpu93kyZziMU
-nBdPpYIXeySSgbTlpsrS+39o3PdeiQQcBBABCAAGBQJLFDXNAAoJEIqviNbYTkGu
-HSkf/A60mrVc6B10BitxoSUfdPYeQlqgnk1KWtprknb/Xm7PdEl8dw/MRiPtvzYR
-+/NSaxEzuFRxoAa31SZxFsjhPWNFwqsZ+n6SZCNHiZow0PwGBbs9Ss5QuitX9MTs
-1Zcx1cdJmhhSc18Q94VW461Dkk6BXAKdufXpfDlRur63Ju3GRKxQTpv1eBwf23YN
-J1hBwjj6h7Ai9otMDnlcW5KtFvwwIyp8i23YKzUHy6K/Y1SuGvGXQzeIoD7ejSli
-ddrAkRuBQBaT3WO2NtIEQIP/cey3ib0CuV5LjnMZx4wNkfJ6KKzYPbmXIu/8pWTR
-wTNxOzc4pYIhaMmWg4W/QA0mtCN5nfu3qvKVTQuda+vXGimDFSfkBbeIMUQ5vkEJ
-Sf/vlg3Tv/t9P0AsmevgOi8hhN1s+utDefqeET+dj7VFcrKhonOli+Zy9xmzIWDW
-sv6gvMxxfnwvWW2McGyh3dE6bbUr4SRHamAn8CKYMmelnzEFIWYZ+iwBkTgoSm9u
-RG0aTL3Uek9DGMWJQ0SaQ8GfRDpMAlb2h5V02IMri0kVU02QM+5P8ovzkAVfwxuY
-LwBr6vrtki9C4qHq7mMI0KTFcGEqPtpLcj0d7WuvGqbYvJtj5b3SQecd/JwA25kQ
-96VjlZZ0A8LTjL5Vbbj7XO0jsW4YhwquTTCKfSLxS+dl4lrKI6uwshKE12AKRPpN
-iqU9/N8OY2hqh1sPzVwW/wAObcdxXcxvrQKIAEhl16C5GkUq1fDzNQekNVQ+NteH
-Wshj2ECT3x9Q/LZ9qCoM6MGTgcHA4IGlWLQ+lpgsxiaOsb03ffHCB/irKovRkjvj
-H9LBiBNlLaO9VDBntWDxFnVPKXK9nytmcmM25mzVzOVmGDw2wzsSf6bHB36GdYjB
-2vm2opxlpKj/9Iww/5TCfMIKQqi0ynG02dX5YjxWOtKX4cP46KnkaNRS8cTXaROg
-wTIpZc4D34JPwj/Vqa0oFOWXV/6ffMpwFKz6hlIVeUK/arAmhGe5NgVe+yDHCkV8
-/43ZhLRFrhh1WCv1akdrtYy2KR6IBbxrp+gag4Nm7p1S01pT6gjNVW/22CtJ7my+
-iai5mtURJzTb1gR2i2eUG5U8YIwN2cthWLbcdAunQ2LyWMAN5yAHi16VTb+uOC69
-utPyIKm9hxgvLOT82UoBrmYnFRD2NXhL7CmaUqNub1nTJQ6S4Pr1In6I7QrzQw9x
-xXqq3wBKbxwKVfAXhfF75QT2AeXG3tZIXSQU1A3juJax7wyF+lA0NTKR05Kd4Qll
-QEUaR6PmuD03fhd/tLGNLLGcA19/+7ud+c4Y5JxTVOCQRt5muPWLOtcgx+2r6e/C
-W1cdRchhNo27u0gjua/YoVokAOSIRgQQEQIABgUCS6J7ZwAKCRCGC77m0fmVkD48
-AJ4uPH8gQC1E8JYQ4QBx284gmbxyEQCgiUAoLrJ4wIGvk1fAmaZfitrSM+GJAhwE
-EAECAAYFAktfZQQACgkQGT8YCrVdmXelJQ/8DHbNvWQRM925jeUlmQYcfQeUcRS8
-2xacCWx9gwa5WzpUsLkxfb3hiPkWaD0g7AJfpXjDZhCYhWpvh1/4JayI31r5n9uL
-uhJrs8vF0+l0kMvfqbnOQ7SR4C5U4zmqQx9f0gzOfZhe6U+/2p1QnCWfDXAG1zrP
-wX0wPPaiObLJwqI4smVHIGlciFI08ZSuIO3RWCFp5gilDXmIcIxeNlC6+NbBOM+y
-XT15gGjFcxk8dTdDlYXBHv0O4sh0Nyw2UgLDRY07K4jYtpmsD28DvATc9xUMlwEA
-SCq2L18ZChBqbp7UwO26bptk5xa9PRYovNGJ1rnyW5MCBOooH/Du/8op/xEBf0tA
-h1s6AEyryTWMIRehDFoyhkw70RiLaiV7J6trElEzVxmPGMMWrBQ+OnHGoTMWc9/T
-lxCd1zGbtLZnMp+Xv1Xj+2aHmK2ojgJBwy++QbhsoH0Z0lokMhD5WlM8Rr7hSyVB
-YosqrYsaoR14yjFxm+f5cYJxfVzsPFCcG6JgykkzBZbeRfrh2/0NNKBWygY5r/df
-c70TwqxTbgffoJTZnTVlkpxgLy4KG72uqYf53TH05BFT4LXaLnVn8pWxQr3NR2ZN
-LM1ZMhP3d041rmBuhvHVg3Rg6H5oQZS8/aJs7McyQa1G0Ge3jOIr5LXG9LHJJY+f
-oVtaTAqCTEY3XoWJAhwEEAECAAYFAktfdTQACgkQVWu/8D8KBLa/TRAAnjYP9bVA
-bUK+3af1LsoY2SMG5uk8XLFT2KvRkazG3+Fb6K/WBU6fWQwHVYlC+mIJiRtViS+v
-xsJgEJNLAVMRm2O2/pKrYGDICxdrUoBvB+4m1d26un23zfsQSk0sepKqO+qwVZ0X
-EPGKgv/RqrixfcaIZRZsbIYdQd9rT10/THdCiRwmh3FTohcGKxKWCik/A7AC/9Vj
-QdbRQysQicUkZXHBVVgVPXB4oVbVAkT6Ccg/NEG506DTcLmSyiLp9R4fv4NeThy7
-CjeQleiHg4fflRC1fS3kBIpeLq7i6ZxJFMdo93HuT0fcVxOIYByAoTTktcKg/Qb4
-Qyd281rcOFpzQ8MJ2WWAgjmpR7LG+ihWOjutaWLTlmlFjZK7fdNLOq5JSpRpErQM
-4cDwzVuj4oibLvOzdiR6Tx2+Ux04tMTkZw6p4cfMpdLjMzAasAu6IcrCEfv4tL05
-Eo/kDHLHTiW14EP9U89GgSFfK7UwjPPKyZdj+v7GwQFANA7Vte9tAYgMgWALARq2
-1tgmfu9OZIVbf5fWfr361+vqp6a8vK54aD6ZZmvKYwVsK4F+7Q/tPxMLAbE0Qs1t
-CyYJToaYRkvDKwESEv1ajLc+vsC8Q+5/ckmr8gE3fHlR1mqrfYW4WQl8s0SXF/0i
-ggP67OrGDsNX8jknfV9INUw1mxwJme9sTcuJAhwEEAEKAAYFAktfZUwACgkQUz3v
-FV17vFqYChAAgG02Y0ck0hvD4wC1N49euSkxPGO0viDSveA5w443i3cIQW+mNhAt
-YRR6fm5EYpMX8ArnbSWZKColrx1lnAF+pb7qGm/1iKhWLxjtg/UwylMXum3eIcy2
-RYsCM9bOvaQsUF0T0daSk7Wf3zXKZKZjOR7U1atfAQ/m83VapuZHdQ7RrQdzZGOA
-t6J5rDyS4LUY8sB9Ux0hSYoMPXhcIhd7vIOYIuxElJZcR6ufdTQnhNJ2T6x1n9RG
-OOsB6DRgaQ/XCbJ2wZquCYWXNmWjGR4GfzrRVwDHYXk0Y2C62QdX9Gf05rFqlNPG
-8eitSnjsWDbaz/oDiV1pb9zWxDwA2Wa+7Tme8J95/snVDxTikj8oBdl5mePyKp5K
-Cfxu9BARzBu6A5Zryooly9t2N2yWvTCvrDmWQOkP5u7CsJX5BfSaLFzQ7HIQb+nL
-0IweTgKqAED+WJx0EZOltWQHLJNaT+5TOMhqHNZ3D+1ZaDJWPXp1ggYqhtCHbCp2
-qzla/6pWrruETjA8sN7R8hKLq2LEHfuC3+hnMkpPuMgHd8noq1FNHPWB7ywAghrK
-WPoWhxXabTBi4aLUdNo2toZzmQalG0I0WbjQJa1A/2MI27vqvO+84IrTbkZpcdn2
-+A4/xBH+L3YrzlQ6JVCUkLGsERmev/JNktib17Psp7mGzfOgow5tJnmJAhwEEAEK
-AAYFAkx2khwACgkQ4TYIihgkvcHwdBAAvehXDEApOST9KS9Vhke1FE6Dn7xK9ujq
-tWqVis097pyLW+LyWaQdYlg9aQkD9kYxd929BaOVLLKdTfP4Ce08hSgkrJ4XJJC5
-z5vAIZar2z4cGdvYM8vbjQg6O8++tud8FKs1T4OOVFXqjjzjdcdrNZ0vuNdCghH6
-u+4Uf+LkelalGsEUi6DCBJiwnwNsYGCuKijc57ZqbTYJ2jcCTVPDjRrVIpRikn/y
-OxKlqJHzwrrVNSbiCNWrvgg9iJLXNWJBvg+cXtAVzXTQQEhIrdcUI6s81piz7s3A
-4EQQRKN4+ovxvkbnn5YXZKzv0I0b0Juz/6VRxiLnV9mcPjInFeF0jiyM85SC45a7
-TEBaTZQNP6cbROqWCaiVf0mLf1Id49ZpiHR8G8IywOgHb7K12poaETfMpje6KrVj
-zHmVOPR7cgGtwgpPR7uDHaHogVzJdPybIx4pBGADa9VOHXwJzMJdGSR9Gg3N/ARY
-2m0tHGkSpgpYBKib9D/hpiApTRqZ/0Lz0Tk+f/Mu9Y3VrOm6Yj1ocleX+1OW8png
-XLewnFIBgXIyvD0Yn2MM3ZF2PsIxVO+wU60cznwQ3tXOu+lzJLV77oqtSEL86SIi
-PDhZRIwr1KX4YJlwqB3DS6wv4ag0sCO4uVZW0vHTYFSoRbqsUVQh8XkhYSO5jgQD
-A8KJMLntuoiIRgQQEQIABgUCTNsu6wAKCRAbSHfpsWaSh6g+AJ9IxqG15LJm8Z+W
-kVQ+RxxCMp/FgwCgtKTq7T078n0bepdi+3dtrdOexveIdQQQEQIANQUCTOJSoi4c
-SmVhbi1TZWJhc3RpZW4gRGVsZmlubyA8anNkZWxmaW5vQGFwYWNoZS5vcmc+AAoJ
-EKR9Hi3QHg4YANYAoJjhPnn2X9aUeepb6HzKkP2REJTOAJwMqNSRlUdSQUBfUC93
-xCAS6sUJFYjKBBARAgCKBQJM0rRDHxxKaW0gSmFnaWVsc2tpIDxqaW1AYXBhY2hl
-Lm9yZz4gHEppbSBKYWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT4fHEppbSBKYWdp
-ZWxza2kgPGppbUBqaW1qYWcuY29tPiIcSmltIEphZ2llbHNraSA8amltakBjb3Zh
-bGVudC5uZXQ+AAoJEIs6YB8IyXXlWaQAn1tiQjM4MyZA2v4GlT2Te9p05dSTAKCR
-puwROcbdZlTLygOhH9j0/1lXXYkCHAQQAQoABgUCTNK09wAKCRCCeB3kbVlU+sPx
-D/4pOEtn3XmEjdtGVMe0ihQw4QCX4SesrmaFbB6hGL+ltf/7FupbqMXJ61jmBDza
-EzBpEul91nyQ57fYMCIXiTDwxV+nW4xO19/uPTxxdCNDiCDz8NRN+YnSWebculTD
-0sFMZe+Y9LvCRqQE2T8N+P4yCn+RUcj2Ch9qZ9hHQIEzWidMigUJ1nnZno943Obn
-ekoJM/7/oUFPxG/AqzV665wh/wUotbaSM16uLVI1ikOhaNSfTF+T2/Do2Zvwiqzv
-FUoG4Y/PYJvFEIevRn4XuAaw1mvf3FCF2bnjcuPRChApZKX2YEWlF3+UINDF1l0v
-ktao8mMJgUKhiXXtURK+CNYDWyAbQyqmp9QY2En35ktiZDWKoiWjJ3QiDL3RznGW
-6g6F9hKhY3wwB2On/lbn8w67skFPyTdKNwONU/Jz5vppIPryGHsrwiX1fP5klO4M
-j91tZrofhcaBqZPrpmQHfDHj5Rw0k1ztptPybqaRxhPYyachBnbgRztC8EO/k0RS
-fcihdLyMHjLax+r64ONZuFFC8awePmC5QuA+s8VlZctmuLd2A8Gdudt/x7IkNIEQ
-H7ZgaOM8j73ng40rcHkZQW33isbaMZJtizyQs7mzzMBeaxyzkv2y62pKnYg7WS32
-HQAiStgZL1hjRMqhaH8/ScZ1jbWQnZDMfVnyZk4DdudwRokCHAQQAQoABgUCTRxM
-4AAKCRA/z1Kf8vJ6BqIXD/9rPWy7oBCeNjjUxP0CqxQQH8N4R5iHSdcHm0001DhB
-YBYJFG6/kyO5Cg75wyT4Of2utEdLo5Rystr5ZdbQ9fAarf+aLSu2/BKMR2iXdegc
-SQtDUzVbMmtSMy00LAXzwQ74pW5w/822B1vodQn1iKJI6zVbkCPx0GOnHEiaPjBV
-hLwEeimrlVpfUD/xEQgqGIDj56eOOxgAS+QnNOBT+KcZ/+VND72hsVL+0iiGGF8x
-h+l896P/vgJem6XQlpVWfrsxETPSjnDXYpTaW2Qyk+mtgsfhmwigtDS2nFZZM0/V
-WW/nxpoTDqIIFK9G8pd6cmRBJxiYeC9SQ/ddhWVVsyxAC1nti95pv8GtZVJh9umO
-91mouH7m8Z75vUYjiAOF0eD90oAjAo/lCy0H4MrvkHj29+5MFMUi37SrdVB6aKWz
-UnVhoZWDhEtGPro5awcipdjlwoUNurmGF0E5sUMbybxhTPrdr0o050AG9dDa+M+v
-yFy3UKHmErJxAxY7A0IsZ3M/ikrZ6RIR9UOhv/5w7Yvpy8PDOJYMGOpKUZSp4Wg5
-Rjb6EqMrp0Xor47Cw5CV1fHnuMYYpTCv8nID0BdCYBXTOLp2zVdj5gHUSbC1VIzq
-3e3HuhiupHc2GWahgPKtt2iymDEqzFCduuDho3zu9v7uCCsntURNFKsAXZWrgHK8
-EokCUgQQAQIAPAUCTNLNqTUcVGhvbWFzIER1ZHppYWsgKENPREUgU0lHTklORyBL
-RVkpIDx0b21kekBhcGFjaGUub3JnPgAKCRDqTcrcTcqoj+ksD/97lFmqIfbJKNxG
-SACbAoR/CmKLEy8bHLWpPcm0e95PDKC8byDDab6McADwsECHZaKgHizynRn1OcmB
-SHVrcA8eHwwBHqxV71Ocu5M6IhQ2nU1aW7V2+d028XiKich++KUDqtzighIjvOYT
-BtuFAl33vdggAY1PEl57UsPWy8PxNjJW0i1VMaGboOw1lnoCgxN99VkuaKrEefL2
-p9xUp+yBZItEKJEuSpQkbNp8ANkHAhbjJrmA5shYIDTlsVqGADMt44cw0ugiQtqD
-wWjo/bXwZzoFWcC9a8Z55bj4w+atrPzCUsOuKpqHq0DU5+SnvTHLzXoreKfdRq+u
-NvfczRjx1AZlft1hmr0m0Y0yw+oktNRLbZzXUAJC5P+PDkKOmb82r0dFtF9uea2k
-X1gsCEP55dUnKk1Ego/gm68vlxLP1VnaLPRgLpKPW/mUsnuTY/7tmGzj2XUhAqwJ
-WVv5rhS5/UaqucgH9nXnaZIrvLS9SWu3LzZ5SLXKPw1ir9YZC1pTPrtd6nXPnJEf
-fNbuhKH8/3A3UIt3NVEN9oBxmJiof9jRBWKyf1DSU13aP/wGmCCOiU7gN1I+BLMM
-3ZqP0WF0Mb6Y4mR6cAFHY+Ug/UjLX21okPE6djKG1B7UeGSUwJGcof6PU67dxaJf
-Umk47+DIQoOb8aP2whFZ197D7CitG4kCWgQQAQIARAUCTNK42j0cQW50b2luZSBM
-ZXZ5LUxhbWJlcnQgKENPREUgU0lHTklORyBLRVkpIDxhbnRvaW5lQGFwYWNoZS5v
-cmc+AAoJEF762f6Cp/vNNX4QANyh0StE9iY6zxHOB2/fkK93itUVxQx5VsZ7/FkW
-s1Um01gRaDJ3so2VYtGJoH6wFGKy29VWj2zNLhDv7VUUnosBuasnZXgcjXCW6OgE
-g+t/fnuNXAHXLEIaqZsZwYgx80rJEMIAW2NEhxydzAj3m1gOf5urOqPpyDKcyB1V
-A3AVKa/08K6aS2Aa2xIZqt0ghGj3NVPBgRhkB+MHXmZypmbhRVZZn6bWXs0lhYdm
-BruljW2u5fgHJIS7Jdl5yvz3DaF9MizzaHvYBDWC3w1hbdE95cTWhPp8dRsp0sbJ
-AzPHf3BgkaAP08e/v4txUmqlSw4JfxFecWt0JV64qT2tKotVQrqIeMOgimPJ9ovh
-fqOlAKBvzJCBZ6T8d9bcs/xThqCSMPaQCh+PiN9T7/h8xxfG7+gfGP5fwOOCEOVk
-KFi+9xMXye1vx4A2qWh1ScALs92GvhMwy1PYoLfjfsEgeYvRGtAX2TMKkyOsHQMq
-DGOdRxb6yFeBMZPQD6SQaNHOt6l2gIqstnTy9Vk+I9MUT3ynmSX/rkF7YVdPkDJP
-6kUAsxI3rACZrZz8gN0SIH8/3+WaT39+OQXVLleP/BbkKBtxnopi5De72CTG1ocw
-JZz00ZvZdi1/DvElLs7ia/5IyNEviCw7m2EQdvLSSzl2/Py3pYz1/rfmQkC39FOQ
-1neOiQJdBBABAgBHBQJM0tGrQBxKb3NlcGggRWR3YXJkIEJlcmdtYXJrIChDT0RF
-IFNJR05JTkcgS0VZKSA8YmVyZ21hcmtAYXBhY2hlLm9yZz4ACgkQsNmRtHxAhzdp
-/hAAtF/zQVGiDrcSQuuYGU7Ez01J2Xk/9LSZ819Q3jsWopdQYzxGCmK+V8plEkGL
-IcM/jsK+NLAhZVzt7qg64vy3MTQ7anvjYx+1+mX1Z0p/g/r5IXXQ73Deg0RPPEtS
-cM7ZanFlBUTniMEkZPt8qo5CZw23MeP2E4fl3UzHy1vt0CyB1dOJjsy9XPXLX258
-ON9IBnjS5s99fKqnCs2k0VFyNkOlsIdWzsvFCoQl7URnEEUI4OrrvftxQHouql3x
-2SxE9K7pIHZewg631W+UXuH72BC02kIXrHixu7yQIE84fLzaptZJWZ9Xgoigk12L
-40ygMQbc4zbRfoVYGymn/jdZ6W/4TG9ksq8FHFi5eZNg+hv8YwFabfYH9cshjh1+
-ldUbHKE1YbY5TpXQ9wNZOu0XHMsvo/pijcptUiC8yvmeP1Ky7dyJb7PkoOcQ3cjf
-31wGiGP0cgDhw1FbS14g2OI+fng7Ns+9LLOZ34/QryK+hBLppEdAnLgAvIZzyuyd
-K6KbdIPEzotffoJJ8PfEPoYa7ZHZZq3fJTno+DO8mhEi9V2jHkpDZDTNUkRYEIev
-SnfD8F/44bjvZHUy63T9Hrr+DTjqG2ucCDZeAkaMue/NRXev53RIJ8AHLTUG2dbf
-b+GHfC/OkkwFe64ZO0is/SucfzHqQArAUB5mo5B+RC0o9huJApMEEAECAH0FAkzS
-tCk1HEppbSBKYWdpZWxza2kgKFJlbGVhc2UgU2lnbmluZyBLZXkpIDxqaW1AYXBh
-Y2hlLm9yZz4gHEppbSBKYWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT4fHEppbSBK
-YWdpZWxza2kgPGppbUBqaW1qYWcuY29tPgAKCRA06nbmeRSFqOljEAC+JPGA6EtN
-P7fhaBEuLL2dhgTs4vPGvWivygw4WKR4ONGVEMBCQQCxafRxXdUQEjvRTxxdnI/2
-S7VpGvQlEjSAPkVcwuX+lwxPYb/7L8D78a11AtAxnxN16QsDBG7s4m+aBBfjn+ke
-Q1lIdScVqU20ZB4y0qrJb5Zv2hfaDUlg+99VS08VohymSFPEFzUWDufyCC/nJbPn
-rKZppbBHZmJT6WZm8y0i+oC65ZbRCxaMV8FVRhcmiafXeZoC/SURf4YSX5tgI8++
-/Ydwzxp2wxI1NCxKzsG7sERjLmtoXi9lrDLlWJnhbO5Yid6/7EXqzHjcWmUqag6j
-ldJVQRjUR8G7Coj5zUjuEUZRlTM8tllrWLLSamuKhyk1q+UB5gDTIqGDpFxj/Svd
-KeScL0fzsCmnroaLMXtd+QCBHmEk2umA9hb2N3bcq2Ht9+zZ5av1RHkNdT0L7l3T
-iFgyP8cx/qw5of/ZTQzcvD+Nsl3ijShyvihNHstPYDeANCcHdRlnmH6fusZGGV9t
-3H8O1kGIGi2R4Pw6pUDPuO1BHfA11Ld2uCuVbJwC+2aG8tl8v7XzSovCrn6cZW5o
-PxnT724UMZ1ms2ECMu0Re+4T/q5r1N93vmqHj2ANAm/Kh0l4xBlO/W4lpVqmZUOs
-dup5mKQMLQWEgxBYLNgEqimt1u0kP1qmn4hGBBARAgAGBQJNJK0WAAoJEH4q/cwO
-NxoJqXUAn04GJX6IamiK46TpBngfZXuSjh31AJwNfYn8nS/y9cFvQQaYA26RhuWc
-johGBBIRAgAGBQJM1CP3AAoJEPQmjufy79DwttsAoIpYpCX704vSyDTCWig5IFJm
-nBafAJ9nvPSQApkry5XlHAlv2E5LBADCy4kCIgQTAQIADAUCTgOM3wWDApIJwAAK
-CRCMleyeQza0SH02D/4qYvbItCLYBo/9/Aq4zvrZXFfveXqbo5oAQ5SXBmaPjOjy
-OqGMjtH0suxtYWoWsxqKwMYg6uiA7o1IIYnGNvwxsIy01uchCpjiiF4SUKbYYd88
-ort8wgUF3BQlDfweEAzsu8tKVkyqr9zNK4t9sfvINVCxwrEbCvyim62tLIxaVhYP
-uxufJ8Dw/dLULmC6vpVHfMrRAwanGqCB1eAejzPDzXEaIHKMUTFlMKV+FwgTN89D
-VzWCACmPglm/8PrPw7O/wpSuojp6nZXJcCycIT0CvgDJvO3ENnxrHYn6J9coznIN
-rGdfLdZ6c22xxHlR/HsWXnKILlrMg6EZKVtdr17puqgsjTiKAsHkRvMa5whc+HgV
-XPNI7RbFGKFvB+xtrgW4adQzqWVkQaKNSyVqy8+rzsRxrmQDaOn7aHyVMuBl7Z/J
-FXjxFzZnERWxwYgQAUoWhsZmx8ccewvb0ddJNCn95bvY3LYJ4M2c8naInEbo/yJG
-Qj0/3u6IJZd2UaPElEutdac9acrySukO3OJkyI6yqebNwL/zrj23RX6a/Oarz73M
-VkiPvQjPuKCkPJ/6jfI3hCl0wPBbFDsQ9kHoIf/QN0KCtIqU+FZI/jh7UkObROaz
-d1xi4P4VZ3hjKmPJW9dfvsqZ/NdJBm7mCBca7kE0yxi98NCIl4GE/goxiN5oQohG
-BBARAgAGBQJOvCRSAAoJEAsDrm5OJFF8U1MAn2DXWP/j3r1dYXO0PGegOBYBgLfO
-AKCD51Kab80lGi6JoGjeWfPlUJC/9IhGBBARAgAGBQJOvCmzAAoJEKvWMuzE/Jpl
-ojsAoOdCrU8aEY4F8P8qZm5v/lKm45l8AKDN3B4NPlrN4UMLSrtu/dJXsfm5EIhG
-BBARAgAGBQJOvE7tAAoJEC8+XTEfSeyle9UAn3VdMEXENr1qB2cPydMYbe++KQzF
-AJ9iPNmBm5Hu6gWHgxjCatBFYbrgoYkCHAQQAQIABgUCTrxfWgAKCRCarPtWNSrP
-dm/QD/91O5fgoLIfpkZHTPkh3dwzorQbOn2k3XXHNzsnzeCG1B83YWPQh7bwEeAt
-7JYFiGqjrlYKpfuE2oBUP+86nLGdAWbVX1rXWFXVKRtrVNYMwsPNDzO7aWCgej89
-JFl7vuZe7sls2oS5FIodJ2GE8hu+tID7iy81lgpWIto5u2XBUT+Cdf5jy9AqPG/F
-kxqMfxzHFuEQsiW7lB1ZGl7nO5SyZ9EKnQHa+2MXikZcPQfp1LQmu7KtufyFm2lc
-q8KVFp0LkBblxOK4+v68Zg9t+6gqVAA47MtbIxSr61mE+uDXfSuEDKPAlbyFLHLV
-e8WCW0lDq+O9RIxQn5nejr/xkGqzHOaKZ4uLaZfTTRIpIVdnufcQakUISKXrge21
-vNRWetaMn3H5pNd7nCj8PjVTgIuwHzHrE32NoVjmY+5Br3zQE8mBUf7CRxYIe0co
-6pSiGF+sOb90vUIaysfCKh+7ovd1VfBDKnBpaGLE42q4l/9ddkiXvuFrDcLMFSgx
-HCjpOeJGLfh5Y6Zk/q9Vv1Qa/T9gGsUDNb0ZfMsIzmMNnts+KJotHxqSkI8M7rLB
-LgxutUKaiNj7gocaQJY/dz1tgk/baJGL1crYvq9Ih6kd05SX+7NvN9T+PcCWi4XI
-FAVDkthcbm3kH12AS53Gd3bYY/Du7RxS/QT/zJHg46grKR061IkCHAQQAQIABgUC
-Tr1SiQAKCRBNFUEQuEUI7JI7D/9qoxkG5/63D8mimhfEQwxSBCITRqQ/HcnGaEp/
-530izpGL614zlGeB+Ss0KEbr/Pnw1AePEwD8IAfxthBq17UmFqSjDOSq6ANQBske
-CL3Ilrs6mMdJZRWjY1JiS8Wz06jW8SE/his0FvmIXCIs8exNjS/4ClXF+NTvk8N1
-OXNukTv4G1cRsal8ohy286rHIlkkSW1hY5glYHcMg2BCJ5Z4hZavYhwsKxfBjrb2
-OBB2IeWHicQ37r1V8IcE+1M/qg1L0X0uKF7rw3/09w5WjmoI3CAhK+r3gY6+PMch
-TC+j+HLz20RukZHHKaCSoDXbBJj+MDgMnq+FhhDA3ig+zknE0qBKsm3P82CNfyBY
-vGaw0pXBvQHiuBEimLajUucg4RDzFNYBwdOGIt8nTq3Ari3pGSC5HYqCP41aLPKz
-o1FTz5BFdHkIHXyMq9UPhcQfr0tM8Hoq+lqrwVigds+pV93PJe+M51t7AKTrJ8kP
-4hdiZSWE85UiW5giGA8C7N2mOUBiUjl9HKbsZQ6Cn3F7mWN7FZYyWjSZ5lSVJDxK
-M6r10BFNZuYbBmh0bl/J4bL/mwSvYP/depiTtafM1nA/+sYL/7W9qwr69HITaDmw
-tPiO2vZ0sG68v2nrqcuwxLiAp7su3MyIcmT3VNLedISh7Y09D3MI0WRmCuyQJUWA
-Xq6XTIkCHAQQAQIABgUCTr5o4gAKCRD7Yz3o9cuua8DzD/94qJyLF7Re+o+M1GGB
-SX2h/o0IwxUUjB950SIiHilplUjnBVDSuzNay9RqrX3L6uIWwvIfgdXn+MHyX/k3
-CtxKN1XrUhGFS197cFx5h9rS2DHx+ntlX5NyhnZtRycSBQMnaxj75GyzD2ZE1dBs
-O/ki7Y0Y9BI4bxu9zCLnKvDawc0Y7XkFjxV0KnPYgFTEKcVxtVZHy7cwxWwENjeq
-+JFI5PQW1TmFm5EzIfjBtE85jcveMhWu4mLfPmbvByhb9N5O0rsSzTeOtgwypSH9
-JjVbXWAB3bM2vwxzDq5ARlS6hSNrNTCLQY0VVs4adLVVbxF3rOaSl2zXtaXh54LZ
-RGkfgaeYpPeCRfjdwQwBj3tHdYOpZR/ZJbgS9OcdTioHj0QSYW//BQViAwwm9lCm
-IgQdX+qgdrBYtKFLQ0b6WmhFSRa6zPjdIxgN9mSa/Nx7NZVOerxBWkHGIkadLvnY
-AiIaLmWRX58u/2y1FzpXABW9QRAWtbjUQZYZXeqrvXwXAEE8RDPiQz1egrEjm4js
-gtOobHBRBVDuqPZdPCt766E+tdBo2bEjcjvfVaADiWWjgHwH4f7Kr1uBe1jeqmFJ
-DCpsJF5X7izsdMrDsdC2UaCK5UeWQXhgyDAvjaPioAV8LCwVaom596PgxXTPwnf4
-KXCeZjrsAjL1XfEMH7BlBKvjYYkCHAQQAQIABgUCTsrLfwAKCRCJofZRKiOcLP5M
-D/wONbynmOipqbqF/vIkuRcPq8BcYhiA5M3FzPiZXH4rgl7aCN7iV5SU/oilbP3s
-cHgv7pN5Y6aLxVipvp5UELrNxT2zUNJUbmyoKOEu0NJ72emXDX/KGjqqLZ1W/jRI
-TZR3w+cc3dOzx9MH8XdirfLWi+cpk7k48UC3VeEICB0EVYQ1oA4CG+BOFva0/gw/
-oRmlMIzG5ItH4wyUZCYICNP9njmLyjjsxvXdSNhGil8tQs6ywMuVi4u65L3FDTu5
-cbDUs67DsJZNH11UpPQOBFX21JS+tairMkJW8nF9t+5vrWWFE6KIWShTPx0QfDYu
-tve4rvtUkC7K532KNCliVb4G3oJAuwAWdM1OImNRf9VVg36FJFnimVN9IkwIkN8e
-EjwyVEbr4aseADECz8SNS1hYeSp5PzY3Tj/L5rXYvzmkq1EjijPT8O3TiVmfe8RU
-apDrrTM+by0wyp0915+XRjatErqI1kO/Pxf5nnOCl/DNCml1LqjeZTzUQRKrvNDb
-CDMSXzG3cqHR3Cmt0qF3wQ8jUKifFeJ4AlJm/BkkPfyxhD1tnIOAA6Kq/qg3empa
-bBrrYUbp77+Fk+5VRivEN/Z9NfrnF77SDsUsRe9sbl8BFPtiKb40wkopkcA36Za1
-OW0JfxJwJj34zovJoL0jrIhqb6GbRqlfy/KqsXcVlKcmeIkCHAQQAQoABgUCTsFk
-CwAKCRBOvAyfAgj8EbP/EAClSVH+M+jOf8Zaf/UGOOSHBP8K9ktC064V+gsNBClC
-XWhq7y+MC93ER0Ghiv0VRKQBPZS+ZisaoUN3nIvVkQM1ZFnQ8giQqDoXFbZJ8Wf+
-AexJkwSvlE2fmnwWykCtaKA+FHfeJs/YS2BoYbHMBrMLvZmZw41lvFIjv9k+OFNF
-pjZuEuCfQnZxb07ecyR3qBZHdRBeOEfrswJzlek6bSkjBVEioh359KkXl5266uHp
-bpO5yYAvwRvWbzgZ+aQeeyGzcoBrws9/u1Jcwmc7IWjr/Crk7pYgwiXHT4Z91ZqT
-XOeSuu+iMZCnb+R0pNH5Xbn81yQJjyoHa120bZj0OArnmNRTtASq1+yh5xsn9OTy
-bznWNpZUnPtOl+XeS4rfGxYpzhXYKHBUN5+4cPH2eYpyoOH7uGdPHaJ6WP42Nf5m
-joDBu9MZJPNuTbgNk9Ei1qC+7fNkXUF9VVfzgp7lIL+1gCvW+iPz1OSEjgCctGBN
-FyccapuzEMIBVOZ/s0HSc2DRNfPvubUbeRoaVbFlWusOWgoXGsqkyMSFKV+pBeVO
-CRK01g2RkfpZ69CdKAWB49ean6OaF6Z93Vtdbt/QRm9XsWI8w6FZzFudaUhyFnY7
-EhkeN5e2DOxjhqciBuOndM272i0m6WcScEudr/65WKQoSWgnBQsGKeeQQFxn1qxH
-pIkCHAQQAQoABgUCTs2X0QAKCRD1T+ZICIM1qUhhD/9s3yVu9p0bM01hIdLt5tju
-PXlSciGRXn/d3BgI/IRDwfYdgRq2yLym81iFRoEy0s2TF1VtdTJiXcpET/XP2sIC
-JwKmAzUAH+BYpfY0G6/uXkXfc5ZtCK/QEQz0G20Etb+vQQN/JYhgQKJKVPEh0Qor
-3McQbDpjjktL66npTE/aZ+Pnop3Qqf4Y3fP+j1/It436B+5AEcacahxnpchZMU+e
-XBn1WhxZqm2zeZcKyR4Zqg2/oGt2vrm92rqME5LaeebjKHWA0gRXAldK+uAedTaD
-P0c+JPem4W1K+CIvyaS7qsxch2LSSqCSyhBOS+yRtd4E7IHX7Kp4P/ZxrPVyUbOk
-fw4MNtPizvR2sA6FVElzfUFDD6Axjc7oqxOKaPc2vrG8CFpomvRwDnBcdnIU3NQt
-QMs5I7t5VONwGuBd68G81qbLlHWUIqHs6T+n5XIvUuh1WIfloEK+A5cJiiXWIyLz
-ucjDg3yAjXuvzrddbngdT+hMBkwwJKFVMkTvFiJ82IXBsR+MBA5WUAp+jr4x51RE
-y5IpIvtY7ux1Z9HORrm5jxeDoU0AmDDaTW1MIC1SkX+Pti8tKC6mOZJ8d5/rCQ2Y
-GU6PVIhcrsb8fGojASrnLeT4QmFpOssWxPCni9hwPZqUIvgBKgB4TMJtgsz7dls6
-A2rAm90NWb7CjEFVluy3uIkCHAQQAQoABgUCTtkqEgAKCRBzJfkC4TA6mZKQD/9F
-79MIbd3EDvrpM/oaLuVzQuNE6Ma6ZauB9LRFE6oRWDMUjC0cQSXGA6JM441J1WMB
-ngj3X6Wg922gVBBiptZvQUnMyPOS72UwJ9mCdS40lcJOtZjs31HY+/f3j6LJkZ1A
-8FKQn9nE6ceYVk0OXP5Nb01exXwPoAUZqAxqfzEAPyyvKXiP/6A8AxWg3/k+6mhM
-LeLB+5pnHeci65u+FU4UKWPLqqyuqv+UxCSrra6vozWmmtU6WlRtvteu4Y5aerqA
-vFaJCeO759IonXfPs4TzFjMvrW34jTHmYCV6vVqbOHu5qC2FKgtzGwlKd+MDGOCd
-2ekhd4MbbrIxp/GXfIbp3+vrIzkNpD32DgoniYlbrpBToxTJA9iebpcZ/BWtbT/P
-Uaa4imoAh4oPrZvj/iVzfatZ70FPC+Mg9I/3PWuV9sxbffFNNcywh/uGjI2WcJGs
-FTYTaTU7z4HnewDLJRYDYwO9/MjSb2mCsg8cG2ANiWZfHn2quCyn/gEGe0ffMjPn
-e2ZycUCReUo0ZcnEqz9VvakgwVSL9SiQrDsE8VNr76UeY+8m7rwTME5RMrM7nyFz
-tR89kPeD0jgnepBUyO+RpBSCexboKJ/GZqCRkiDpeRQUjzbLJX7IyULiqo3ufWvf
-KZqEUZ1qVAOCH3MbUFyAsBWALAVAXo8HS7y89nqt6YkCHAQSAQgABgUCTubiXgAK
-CRDGh181Qc794IzrD/48aDMZ6/fuonNVJR4PRd4mqU47Wc+S3URCMa3t3GGiXGkE
-PPhKfiubw+szqOu6ob9ZrAXXatPGaP/gT+rfP2Qy8I1ed6ors3p9pqa4+4v2fFZ2
-rkIinfw7hJcQuGJw/fBfP2EtpP2EU8KMR/QZvavxtk63BXD9Ed66chTqo0EEQrh6
-EUWEkBGBkrfPKH7FdwdWhhfNsI0EpE1l8vPD+bjobKRO4ByfwKVEOFA+6Cd7uh73
-LTuCnmRH+qRPLnNCZcoiNNR54U3SETod8wBEiCmo4HR3AVGYIEG1faUr7Dz6tXOo
-57lp2ced2AJANNw8kZ1R+5OhWY6J5ydTaqSBsk68pQtvHW1FqRBR5K0gq4ns8GJc
-g/yj6Tyy9iH2IxF2O7EzDS0Z/ZG4T8L4HMO6HfkUVGK95s1Pka/M3Lz2X8SFH42h
-Y396xN63SJOXfhXeOwDvtaFkgOvE26gqMN1JK8oyuzCsN8/8G98k0ObdM19rwkpQ
-+zgQ5Z59I6m3v5szC9B55ikeTYB7EDDPxdibfMCya6GUvzkGpfCNb8ba4oA+nwTB
-kVk8+ROWqQUuKgSaYdEnEH8yxoTdMC6J6VTO+1f1qNKH2oGmSWqEl1xsVo1ZABnP
-iiRjQsLbxJ5WcHKDGVz+74Q2DL3XpoLCsYHzWv4aSdExllc1Fpf9YZDfb86Rk4kC
-PQQTAQIAJwIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCUSCPTwUJC9IwFQAK
-CRCbuGOw9Ru4ikDJEACVgT5YdZm2QBnh0OKno6u+ZwD2eIBfNJMXZAWdkXzY8JZ3
-QR4wOq9WfUhFB/Zl3qj1KfFc7W5IxsTdHELN0+eOlOg7GwiLbirJFLIUDgJm+sSi
-Mr+6To/B9NKhvUDVt/GtxfpFo9CbJ0neS7A9cp8l8lI+GJHsRmW2rrS8a+hyxJV7
-TGnMmjfOtWpjjGPbw0nu+ncLSGJcBSyMDMlsG9HPSg1faggRSQ/irR+OP2gm+/1E
-iDz5L13m5iYNj4SDnf7VmLN0AFPlaNL/k82cQgWtcGCE3WPI5tqK9JOqB5zX6Mq2
-qopON8Z+QaWYzaPiHulDkXuXNkQ7jcBb+iO9kYipM2PnRa+LGfgGh1SoMZxX3heE
-F1YPktzjBi5lW/0sCJ5BxIhhpQF0XfFKjn6Dbe35/Xyc3dnfHCcUh8ytSUPAiwlT
-saYFuiO7dnATLSAP1qQtQmZJvPTyL3W5CDYjUPOZiCp1TVTEfY3u4cjAhgdM8N6G
-qzCgoaZfeOH9wW2u9d/pwUlDE0i7KAvMkQbwPlcmQaIKBQxjv+K3f3+gViv8uU7g
-mDrk5A7WILZmbxnj2iRPDWxnClR/VoM414HmbqoDD5dX5h7Ldd49Z83fSK9NNhM0
-EpTVfHyXV/CmO2IKxxecPqum1CFxbx46b7qMEpRMHtdMRLuIag7Hh0XTi84JYIkC
-PQQTAQIAJwUCSvH9aQIbAwUJBaOc7QULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAK
-CRCbuGOw9Ru4ij+JD/0TuZUtNamxHdmvZjXlhREZWIa77qbS6d2hWsKUTBjIYSsU
-n4yglHZIsd5/p7IC+/Ri9ar9TFGvWtori7hTtM//vdfUUqYWQQdQMSEHp0UNxtQU
-/eKQHaXfxLKHlU9Mxic0h/G2M8KW2hq6986Vyma25LdAJ+ez7GBaYgJa9Z8GAOri
-uGVOimDNRN/OS3L9WS5AwYLaNClQTsRLLicqyF6TRY8NFEh6/07iaHGgsEfsJraI
-Zl9MpNhdg5TWfPBQ/ZDAYliCLJvNe5TjmRUAyz4Nb57QLrM0hbGdq0VnXvuUbERC
-AIn7ZrWZJdo+qUzoQ8VM3PnUt0Ptyd2/+oMfNv5hz3wcqZW/3sgGXziHA+q2VcU1
-thXxutQa9bgz52G5CLgGuXW92QrtPggbhpbaXKUMz9zYBLp9nSehNa48MGPk39JG
-7fe9SQmj9xw/xkmyI1RSPJMFMauGKUEMo2FPqlTFj5FP8READcOk3Rq3NpkX7vOr
-E/ECcg8A8UvV3N74n9CsWyburuXl/DGbZaXIHe6VaDe+fTpmGTZiow5GR2R1bsUB
-rvQXDEo7BeR3xksZ30GlW/KTsoWQ7okGX00XUdUzACESgXJWMD5AD0ZnWw0VDYJF
-9IsCf9qKkmX5nLMSqTUIqvrUiZvoF5qn0Cgvr4o1TUsiTrPY/V5FIgIft1XvurQp
-U2FuZGVyIFRlbW1lIDxzY3RlbW1lQGtleXNpbnRoZWNsb3VkLmNvbT6JAhwEEAEK
-AAYFAkzStPcACgkQgngd5G1ZVPoC4A/+JySuHv8UBK1iqOnltmdRYR6b190wTuo9
-Ir/iBFq7ofqxmEoxWqVct6lfqDNebAbIjgaAwoOoaKHkeyhZlcmCfsVj3QFAiwq9
-hkxP09hkHSVWvFh3CK1X9kYny7ljBMbx423ISyEZj+Lf3AjrjxI9KbRdNY3jMlUr
-f55pWTT4w6JR/qsIVx4E5g5wnVNBRI+Oqn0SijElfy0qA7UiMvz+sxAUXQnpC9c8
-1jp4RLgW16FazwwMq0vpb0NqszrTNF1Uwl2k8V6qC3fnrbb9w5b2zDRMeEmHunVs
-CEODOREkQHT/OdO982AxOp03uH3MQPYbiUOAgUlUwGJi866jBu01jiROl+CihFIX
-PidQeL6+Uz9aurk7H/gXAafwFBxcURn7zsyH/pb19HPfxg2TiOR8ZUgqQ5ytcAe4
-ONI/tVU3yUs/l2QvqqRKI+Cwi0iPeKh70Ny+lb5gjPN0lxAwYjCOZLJtQ1osFABX
-S7RcoZvCO7jdf5A+WdMm4fqB3FBTVpuZofU84GB91S8l9/qj02h1ZUDzUUiydsm2
-d+HHaGXYsx1oxgJWHSZ68tTrLSttFXi0R//VizGEfrYejMvU1z3Mrt/nn/Oua0UE
-sMK6U9nzSepflXeHa7q/xtdQ/5jNo5bXpI7TQEMe4dFoIC6NyxVvbYrrdPQZcGS9
-6GqyfG6d8qiJAhwEEAEKAAYFAk0cTOAACgkQP89Sn/LyegZ9Ew//YSC4hvz6fcDi
-uFTgpVEie1epmUhUTHe2lCSb7BErla9umRu3PAe+YyaHpunnKeA75541vA6navE6
-pp9bLpPllMc2OoDWOOk7REgLgPJkJPFiCWYeTpowHRvkT/qJV6BgJuehr3uODF0f
-/fVkaCXCOfZowEzu6NuXGfZ9qxwkM8SgQASRqDgcOkR6V4ricaT/lVx6Y+iz+3ua
-16CJDTMi2YHOwSV+MXDDujk66ebD55IYZeA+0B4I1YYKNhX7FJrTWYVGZ2XDaSBR
-5sPzohEPfswxQMeTV5ZwJRgax5Mzu6Ln4GiqVrk6uB/JRAabNN3IPq4pkTV1dt+c
-CxIEhLV/QjJ+DeiMyqBs60/LdeME89yFRsXsAKkP4bSsUpzVvmOHp1gz5AhqGec9
-Dmp72qLFM+/m9Ng+mxiZgaKyjENcKJhraO5YzdHgskfNu26yoJjqwgpRSoQ9P9GE
-zDh3wNd0sVaiVDQKHOPfpVYAFxst4/s4K6ZpMRXofm6wiABKwTRFHbE4Pd7bioBK
-A3UPkr3n4AoAo/bmlgQiS0jwMB40q9ynSkUKO99zyDybSFbeVCRmGU62k422AdhL
-rcwy26Tj3yHkpqLft8FBDjdOuGQcQVMP7PUD1p75FlrGdZw2Tpxqp4p4cWIydzSn
-xftt3ZB8ik4zwj0VU7Nel1uH6hepyvWJAlIEEAECADwFAkzSzak1HFRob21hcyBE
-dWR6aWFrIChDT0RFIFNJR05JTkcgS0VZKSA8dG9tZHpAYXBhY2hlLm9yZz4ACgkQ
-6k3K3E3KqI/pLA//e5RZqiH2ySjcRkgAmwKEfwpiixMvGxy1qT3JtHveTwygvG8g
-w2m+jHAA8LBAh2WioB4s8p0Z9TnJgUh1a3APHh8MAR6sVe9TnLuTOiIUNp1NWlu1
-dvndNvF4ionIfvilA6rc4oISI7zmEwbbhQJd973YIAGNTxJee1LD1svD8TYyVtIt
-VTGhm6DsNZZ6AoMTffVZLmiqxHny9qfcVKfsgWSLRCiRLkqUJGzafADZBwIW4ya5
-gObIWCA05bFahgAzLeOHMNLoIkLag8Fo6P218Gc6BVnAvWvGeeW4+MPmraz8wlLD
-riqah6tA1Ofkp70xy816K3in3Uavrjb33M0Y8dQGZX7dYZq9JtGNMsPqJLTUS22c
-11ACQuT/jw5Cjpm/Nq9HRbRfbnmtpF9YLAhD+eXVJypNRIKP4JuvL5cSz9VZ2iz0
-YC6Sj1v5lLJ7k2P+7Zhs49l1IQKsCVlb+a4Uuf1GqrnIB/Z152mSK7y0vUlrty82
-eUi1yj8NYq/WGQtaUz67Xep1z5yRH3zW7oSh/P9wN1CLdzVRDfaAcZiYqH/Y0QVi
-sn9Q0lNd2j/8BpggjolO4DdSPgSzDN2aj9FhdDG+mOJkenABR2PlIP1Iy19taJDx
-OnYyhtQe1HhklMCRnKH+j1Ou3cWiX1JpOO/gyEKDm/Gj9sIRWdfew+worRuJAloE
-EAECAEQFAkzSuNo9HEFudG9pbmUgTGV2eS1MYW1iZXJ0IChDT0RFIFNJR05JTkcg
-S0VZKSA8YW50b2luZUBhcGFjaGUub3JnPgAKCRBe+tn+gqf7zTV+EADcodErRPYm
-Os8Rzgdv35Cvd4rVFcUMeVbGe/xZFrNVJtNYEWgyd7KNlWLRiaB+sBRistvVVo9s
-zS4Q7+1VFJ6LAbmrJ2V4HI1wlujoBIPrf357jVwB1yxCGqmbGcGIMfNKyRDCAFtj
-RIccncwI95tYDn+bqzqj6cgynMgdVQNwFSmv9PCumktgGtsSGardIIRo9zVTwYEY
-ZAfjB15mcqZm4UVWWZ+m1l7NJYWHZga7pY1truX4BySEuyXZecr89w2hfTIs82h7
-2AQ1gt8NYW3RPeXE1oT6fHUbKdLGyQMzx39wYJGgD9PHv7+LcVJqpUsOCX8RXnFr
-dCVeuKk9rSqLVUK6iHjDoIpjyfaL4X6jpQCgb8yQgWek/HfW3LP8U4agkjD2kAof
-j4jfU+/4fMcXxu/oHxj+X8DjghDlZChYvvcTF8ntb8eANqlodUnAC7Pdhr4TMMtT
-2KC3437BIHmL0RrQF9kzCpMjrB0DKgxjnUcW+shXgTGT0A+kkGjRzrepdoCKrLZ0
-8vVZPiPTFE98p5kl/65Be2FXT5AyT+pFALMSN6wAma2c/IDdEiB/P9/lmk9/fjkF
-1S5Xj/wW5CgbcZ6KYuQ3u9gkxtaHMCWc9NGb2XYtfw7xJS7O4mv+SMjRL4gsO5th
-EHby0ks5dvz8t6WM9f635kJAt/RTkNZ3jokCXQQQAQIARwUCTNLRq0AcSm9zZXBo
-IEVkd2FyZCBCZXJnbWFyayAoQ09ERSBTSUdOSU5HIEtFWSkgPGJlcmdtYXJrQGFw
-YWNoZS5vcmc+AAoJELDZkbR8QIc3af4QALRf80FRog63EkLrmBlOxM9NSdl5P/S0
-mfNfUN47FqKXUGM8RgpivlfKZRJBiyHDP47CvjSwIWVc7e6oOuL8tzE0O2p742Mf
-tfpl9WdKf4P6+SF10O9w3oNETzxLUnDO2WpxZQVE54jBJGT7fKqOQmcNtzHj9hOH
-5d1Mx8tb7dAsgdXTiY7MvVz1y19ufDjfSAZ40ubPfXyqpwrNpNFRcjZDpbCHVs7L
-xQqEJe1EZxBFCODq6737cUB6Lqpd8dksRPSu6SB2XsIOt9VvlF7h+9gQtNpCF6x4
-sbu8kCBPOHy82qbWSVmfV4KIoJNdi+NMoDEG3OM20X6FWBspp/43Welv+ExvZLKv
-BRxYuXmTYPob/GMBWm32B/XLIY4dfpXVGxyhNWG2OU6V0PcDWTrtFxzLL6P6Yo3K
-bVIgvMr5nj9Ssu3ciW+z5KDnEN3I399cBohj9HIA4cNRW0teINjiPn54OzbPvSyz
-md+P0K8ivoQS6aRHQJy4ALyGc8rsnSuim3SDxM6LX36CSfD3xD6GGu2R2Wat3yU5
-6PgzvJoRIvVdox5KQ2Q0zVJEWBCHr0p3w/Bf+OG472R1Mut0/R66/g046htrnAg2
-XgJGjLnvzUV3r+d0SCfABy01BtnW32/hh3wvzpJMBXuuGTtIrP0rnH8x6kAKwFAe
-ZqOQfkQtKPYbiQKTBBABAgB9BQJM0rQpNRxKaW0gSmFnaWVsc2tpIChSZWxlYXNl
-IFNpZ25pbmcgS2V5KSA8amltQGFwYWNoZS5vcmc+IBxKaW0gSmFnaWVsc2tpIDxq
-aW1AamFndU5FVC5jb20+HxxKaW0gSmFnaWVsc2tpIDxqaW1AamltamFnLmNvbT4A
-CgkQNOp25nkUhajpYxAAviTxgOhLTT+34WgRLiy9nYYE7OLzxr1or8oMOFikeDjR
-lRDAQkEAsWn0cV3VEBI70U8cXZyP9ku1aRr0JRI0gD5FXMLl/pcMT2G/+y/A+/Gt
-dQLQMZ8TdekLAwRu7OJvmgQX45/pHkNZSHUnFalNtGQeMtKqyW+Wb9oX2g1JYPvf
-VUtPFaIcpkhTxBc1Fg7n8ggv5yWz56ymaaWwR2ZiU+lmZvMtIvqAuuWW0QsWjFfB
-VUYXJomn13maAv0lEX+GEl+bYCPPvv2HcM8adsMSNTQsSs7Bu7BEYy5raF4vZawy
-5ViZ4WzuWInev+xF6sx43FplKmoOo5XSVUEY1EfBuwqI+c1I7hFGUZUzPLZZa1iy
-0mpriocpNavlAeYA0yKhg6RcY/0r3SnknC9H87App66GizF7XfkAgR5hJNrpgPYW
-9jd23Kth7ffs2eWr9UR5DXU9C+5d04hYMj/HMf6sOaH/2U0M3Lw/jbJd4o0ocr4o
-TR7LT2A3gDQnB3UZZ5h+n7rGRhlfbdx/DtZBiBotkeD8OqVAz7jtQR3wNdS3drgr
-lWycAvtmhvLZfL+180qLwq5+nGVuaD8Z0+9uFDGdZrNhAjLtEXvuE/6ua9Tfd75q
-h49gDQJvyodJeMQZTv1uJaVapmVDrHbqeZikDC0FhIMQWCzYBKoprdbtJD9app+J
-BBwEEAEIAAYFAkzS6h4ACgkQiq+I1thOQa5y3R//az+kyS9sQUUivWaEKjhqoOB7
-IJJE7E3/YkPiaLnehNI2S27K6FY2h+skpjuIa8kAM38GUAA74KjdCiS4S4aPhCvL
-C/c2zNMVtGCk6EDGaRuU8Nx0wKyMGHqTfAtSxubmNTbR/+iBNakV2DahcDJhuKbM
-1FM/IE2vbObjtG87UZ5RjqjQRKE0ZnE1zyTV/jlQoHMjQFgMZdf3J8vpOt+YX/Fd
-jOvX5+YbIgnpoA23j4wIQQdXjnJaax5gdKkeUugOCItwEq5h/tvcR+tUkfcoEUPS
-IsAFx5nlxBWAGwdG8ag+D9m/d4I/UtEAdegrG+L9Fv/dE46sBkWrZeF896RpJF1f
-7iNOS2wOHXQ16/sMyy0j1zlUGZi156a92lf7sv7S/gy8qZ/uM8MGslEoJKAvNbsT
-e0u4D1eV+NHIKy7XgcxdOvd0JFLChUK9vSrNq15c+armNHAo5p+HRNrI+A+hbWAh
-kn7Tje7FoVMbq04kngcPXpin+z8G9WURG21a4WQP2s/nJ9yC7cgb+olXi+iNvliZ
-qEdF5p4nYRYUG5mPOScNSFmZj3fKN7wTWA8eoY33ag/V0KEiZVc2WJV+A7bUqFNx
-FGQdLDtSHgUyZM+g4Tre03F7GbJG7K7i/TxP0vW8wz8JXuJsvY+AoCmagFA0tXNV
-MrdzhnnMPN6SobrDcHRWQ9OHjz5CJ292qono6RWXUz0bzh355QW0bFCK24Mpa4oh
-hkR+wrJxgCdKsn51vr2I0NxWIn/3rTUn8OpFOI6QUVEJq9GfQYaJLiYBx3/XRNde
-zXDNPSbeZV6fHPNwhPS9rKmciTdRc87B8xIeT47J0+MJdYJqlEG4yvLl5hmhJYOZ
-C7O/tenlu+MVdB2UkAUQUIBLxoYN4OU2VRk4il/38V4Q8SY9CTU2ET5up/YuA5Fx
-b+Mj+jatRkVR9meAeEf6Nc2x8HmkIllVVPpz6qckMYBcVD2fc1dENguRarnQLFAO
-Igfu9aZN3AhnZypNcPgDkCS6fsOpoQZP6DRLZBPx9wVWQf5JLsrMBZ73+dDjl3Io
-TzXXVQLkrg+tb/849BYRwDkNHqaSFvoBugpSTMyPTiDU5nkp6z4mnyZuSFUfn1+u
-JMctBRdzF25/6+I5fP98R5infEz27PniId5FRKjfZYw3fV61NPUOHmeCSXbzqYfk
-vAENo9mLBq8jXCmkJ0fYoGHZuHXCnqkKU9cZEQ3fh23G6VCEJb0EvFVTlkRF+LDw
-LyyCH2pk1IJ/GPZ17NcOE0kNVVi87VaegcyNnDlnbIJQv063fPoQio8uN1qzqTGL
-Ce5GoGo+BJUCdSnywsXCBIoK8zwUwWP7R0mcvuGFyVcTrTbXQEfMa2eHIreaGohG
-BBARAgAGBQJNJK0WAAoJEH4q/cwONxoJNHwAn0Rbwtm8qdQ5naHtPtxTbqnvnwtj
-AKCTQ3ol1F/J9UgLlL9NlVyloleXc4hGBBIRAgAGBQJM1CP3AAoJEPQmjufy79Dw
-ZGYAnjktFpzU/3R+t2gei7E+XRTEJ/LSAJ96mGaEJprAgZ7R+p1Ae9eJBaqORYkC
-IgQTAQIADAUCTgOM3wWDApIJwAAKCRCMleyeQza0SNteD/4pjQpHD3OkcJY+yCD3
-zD5U3HKXRLigrR3SfRivz33EqlivC4FGvIUxbfxdiJlMhwW58J5+BrbiXkxgeVsu
-DfdKacjv+ro87i3NqJUGvCrmZFKN+p8PuuDZqD8jDHIWVMgUA9qXrrIwDdvdS6jT
-EsgmHaa0pVE8xQD8T+6DaVZOjbsZHn0iJLzrRjy5dg0ENOel82uTwFl5gNg/UB40
-66q5gASaTFzRr+qL54OnNmUrX4R459Hot6FogYUTowGzordQhFT88fJArfqdngYp
-Pq4sM29erxyTksUCwRv1wcmeUX26GuPzk3bIu+ExdyQJHJ+28p6DNmScvi1dXI7T
-/VnklisMprm+DFtMgz3eI/db9It6E+/W9+PSh4Xr5so9gShtO+ucJfeXHqKyrC/w
-Nw+eZKt7IKXWqXoXyNTKylOwyzqXUI5GFpgkn1QgZlpQI1dSQnd2ja1VANDMQNX+
-V07ytN28tEW8g4uqkR73hkrva0bUKwN+sEyTdjkAe45hCnZCVeCH06Rc8A0XcuYg
-wCTM6sElRlpoc+I0UWepls8DDYkIgOHyWUUMNq25odJ34dyMZuTBnsdQ8IacTxNk
-hh+ktkOgyL97F44PdSdt6mv4/heWeb9Bf+WNOtxGRU17lTh5A/Vo1PmTPY373dCL
-j91026aATwx7VUXxtJ3Oneeg6IhGBBARAgAGBQJOvCRSAAoJEAsDrm5OJFF8XuEA
-n2DV1RIKuYAhGkDeyDgYn6kpN++FAKCdbrXNf8O8oPD4zE71CvAFozTVbohGBBAR
-AgAGBQJOvCmzAAoJEKvWMuzE/JplcGAAoLYAV/Yr5kKua2wRMjdiJYIl/forAKDQ
-zQ5hksBZkPt7nqs/o5zmnc2VPYhGBBARAgAGBQJOvE7tAAoJEC8+XTEfSeylMMUA
-n1oAP8vd9CwWq6EWFfXk6jTzFucCAKCCjAjUess2a+L/Peg98anM93FiaIkCHAQQ
-AQIABgUCTrxfWgAKCRCarPtWNSrPdhsnD/9LAOJueJWvuZkxvP6oKYMdcb3AE5DM
-tNkSSEylxYK2/mM5pR/B7BEvK9pr0/So6TtGo6UNjSXfXIZeNiTqruSTdkF3Higj
-eo4M+xHVvDx2kQCg4mta4rHGOC8TAXQydAfl+i3XCr1F12oAEMB90KxzwbMuyGyD
-um6QuRfVAqHUOJdvwuz1WnqlUtMOE8eZweHdUKjgC/h7SRwqukzWnub37HFBDASE
-qxZ3m+D0INEpwiD7NkYvgqK2g7aIsRngY+6qwCCORc1rBM4ELzob2nLOymoeytD2
-uokM+1xK8mYhbxpi74xtrmUUaLHmv+WNcqFQNTGtrI4Wj6d0iuaeKxj2sLwVYfAe
-oGwwlO4ise0ZhHszXFKwCLyRyFuV4tZabS4d+7wMhztF7zoOMUCXXGUBdgDCHh+Y
-XSZxUFFTyL0unvnsS+YBHq5+V8VPJlB6q46IHs4TAcc9iwNDiGsLvuKZm0TRE7xG
-lztdRvvSZoc/ZMuPMia3HSO107H23qoiVxQTMkJQoDaFqzKM0M2Jnhy3fkpm+1xy
-J04XIFtcHzZ4+Fr+299l8prnHLRQoWqhiG+KK8CJtXXQ8iRsXbaFInmE+WxOc6OG
-VFiLad1tq19HW0rDpbLVggB/KPhR1j0UizpW6I0xFVivZXKn+6zO+B41+eTaNQcj
-crt3eLG0MXpCFYkCHAQQAQIABgUCTr1SiQAKCRBNFUEQuEUI7BwJEACTAIkrbKWj
-zxMS4JGJYeAaAU3uWOdyGHJ3lahQ6WFoe/L0ipY4j82bVmgHRb/pGcV4yM34x6b1
-FYM8kwFNqFUReDb14cB/6e9U4jBrGNIEgkuOOL5h716WJX/7jzh18+Wm2SNt+yug
-HTgP9QAPqRM28+ACuOD5H02ay6E2KZ08bmjNZWSmHA234UdaXhHV+lqdTgMc5dLh
-rLEX6+eve7vrJV6LCB6aq4SKu4UqTexWg7mtEluqZLZXarNnQssH1qPfkyivV1Xh
-1NfUgpOgtWVRydg0eFNE9Ux0CXLNZt3yil/0iaRBVFjr5M+J/lWoXo2M+Jn54pjw
-w2/VcQMYjOAt5WjG928gNEFDBZk3b0eM0jKWVY6xiDa/nMOzKqtEzL0Bu9v9brOf
-KOsgS/0vwKJg4Ktdt9UBhayDSUGeHWT2JP9pdx7+yYLrnGRT/1KnGeguNf8YHRxt
-EaYWcbaxR9GFPi9ZJ6/vzZq0cjFwoeU95hneZixmABCitJxAJ7HNEFzg7EApol4J
-rwtNuuMjwu1cCuf61UYtWBdCzNQG8OwivH3mZ9L3COmz6HMjp4uX4HegfYP8FPIx
-JQXtj//dZvDE9sGsZkqVvfwRJ8LisHGApPCPPWPK4P3DxyPzhoO7jVN6K/Pbmx4T
-/a7MhVCaohMAXOu2SpKQ2QzIdveExio3hokCHAQQAQoABgUCTrxp8AAKCRBTPe8V
-XXu8WnO6D/493waxI2i0yS5EO2vexL4t/E/RbGxvXGR4o1ldd9jWoZs259OFxsVt
-zgyq+PMTcxD0IrrbU4P1yj0jNfH3AE5SIgyunhWgP1oinKu83S4Qu8n6/1D25ehe
-Vozd+dI1fnKIgJM+0fHpKBftsbWXV6IX75doSsFH+afKQpKaQO4W8ybOFf097fMY
-M9Bpx8iF2h6kW1AJ4D73wFjcEYylEuuEPoupF+S/h6PYL+MfxvBmZtyUZtnYApCR
-0wkEZ2uAIQbeBjqsUmLKpta0dswDAlTSVokb6oNMFVEVn2QgiDKkba+kU3GsNf0H
-tdmdVLqGl+GOzG1ZM8V4WEbZtsBBqne9eLIyeUxwkPeyM+1g1+0E8d3ZCCb+e+pj
-1dMfu+TtoHblXH9og4hMOqOLR2/U342nHDtlSrETwYrF95FTTImsTIaz/4ZpSGHs
-C7otMHxWcDW5ek1QFDcMcruLp/k9uphHsL7x6ezlB9QQRlJURfW3rhkQ9QKv60ou
-8RCywl791cmaeKypDWut4dbAcEAU/52j3wCVkjv+PdO5THjBAvlWCe+ETz7zWwRi
-+uRbq91Dtg9zZBh/KjuwdNrCPjlhNr/DySKhDOdCTg6ayZgx6chijTjMqhxuorDe
-orqWSRoMHcUbGCN1VNBicVcTvwLp0ZNGnIFv2tWa1NBsAHeTvJWIVYkCHAQQAQIA
-BgUCTsrLfwAKCRCJofZRKiOcLJttD/oDmttJnZ3a4BPd7AqZEPBjxGY/5MQanMF0
-tAYU6YxHHKXdfE6PRKaZv9sJHtPBWS6tTlYdUgntnxy7qYiuOAW/UUssdThqTb+E
-HrfPnZ68AEF9DbjlVp7cTvFS8jYICVQ3lelvwGLXvbQzLj3+4pnNPSGAEAfCPkOl
-y5imicTIjxnJ27i3T2BzjyhMRvhyV0OxEk2Y4D2FLLi/oeN4hUyxZrm2hP38kIYB
-UREX29W9XAya/BtI38N89StU5eHauLi5ywdIYWQMB0b2YIHqnplqRDN0W2h8kwZQ
-0DAVl7bRlTt0opVPDgntNi1ny66GVMA60JIIkQkb9NgQpDC+FLD+7Hn+MstGWhlm
-B/gA5tVQ5FU4vu7z+sOAXtrQyHrhqp4+QmMak+5HiKnM9cs65oAq6rj6WmF+g6g0
-4ksUlJakx+Ea0ervIhmwHMbuC6o2x3mTxibcldJ1brGIw3MNvF/vLJ2gkmon1xqw
-6xqn3Kii8OsZcigVFVxn3lAwb8XcKDJbM7gDosTZpluAlwlhZvP1zVT+0yjyLjcx
-blomgt27j1VWCRr6ue3Enth0vkQzEwjPHWi3Iy2DKBzcHmp5f5SyedFsbxUBVHyv
-S65af3/Thknsx005snZWBYj8JV/y81qHeMMRaTSrEoiQ+pzWx8r5btCTm1t/oOs3
-93gK5Ks9zYkCHAQQAQIABgUCTzZvaQAKCRDtOHP10yYnIidIEADM/xEu1TWcOfex
-vNUK/o3epLpRCT890C6ZXK+xI2hfIUObjEnUqNVuCQ8bRRWBlIVzeDw94elw08il
-uZcHJgr2mrNVXTi9Gg5Trp45DQdnSMwxbZAAwCrW+2JibIDpNAe3cCk4hSyN6yz2
-IXICt4mrO2WH9TsHXXXUQhq3bkQHontc1sRcZtPA9JZP2imhkYoLyjUXQhq2zpDm
-KbcukskpImiElzsdWAox27LabZRkKTWEithjtdD2qHg64UgHG4GTPnupEcBZ0y5o
-8WtCXXywpk7CUGnvIyzVuzWFusyrFfp6Cjq7H0K2hg9+d5JJBH3408tt84djDNXJ
-fcg/EWSNr/vmC8haJh7nHM+aeVCu0ztZrqxS4fgTA/jl5XGdf0Q04Je7Y8FYGQ20
-9PQnyujQyP4Pi9ye93RV3mh/Ki2OBFem0x2siG9ER4o37CpryRZg6AnKJ8RButid
-B5Xb8PqCC2Pxw/xl1UYUp8aqO3nOknlbn7D8q5+LGEANLZKz6sVMYRAvgknXi7OE
-hZbV38TtNuo1YCEI0WGUkTIUVd1dZ1S4EpqecIbIXH8SvzWrcVbbRS/j5F7gayc8
-1Jxpf98x1bHmd4r81rNXTpUyRPC9eseayK6Xh58ZIL4uzO//I8QFIob7tl27uYOp
-w1sO3QLVx8sLBJt6/fWAHFJuqk7954kCHAQQAQoABgUCTsFkCwAKCRBOvAyfAgj8
-EW4dEACv8cNDV2ayt7zYxvCUrBNTKjVhfvn/YF6lRnEKHc+9iBd3M9jLRBK0V3cR
-dSsVeXndvmUrmE52H6WLXKjJP44M/VRSvcgbhMoF1FBMkwueebG+xVrQbsoa161i
-NPv6zf7S0WLf078CoER3F0yMnTJUgR1ejiMQ5MK+EECcXhDwaPLAw6HlijqQJnul
-UkT1+fO5asy7F1QYQLp/5uCmSWfzUTfLNavWH2p1imtOJsl4koQvyZGSx5me1STS
-p5M22VhrcmzxawBeNWSc5YZcZNXaszvqCKT4Or6XEWASWfV8i9SN/yK5VZgFO1fO
-4WbuwD8820GWTRCSw6YQ80Bc8xpKJ9aPQBEnpQQ1hX/S1RJ1LnxR/iH852aP0tB6
-1HNcvE3PpJnmKfzZBsCER0VVuiBG5wwo7fILfSrjeKs/U1KHS6dmWj8uZB/r1tpV
-T0uGW5VG9o/CuIvZrVUsPIVYzH4st/JxOTW8wu1ade+VxC+ZAfDu0kBR3u9q2/3l
-fQaOim2+SZ9+PPbRnWClXQXaqQrg+bXSUFWveBqGAm4g8Hm9qRLweoeV611DMIcI
-/jSrzWudNSJrSgfdMySwQd7g/G7NHmb3AIUEZFPtG5PPSKnPhV9cR3BM0SooOaLa
-zgnCRuH0KZyMNOEXSTFCcE+4X5y2UlkNL9aVF3DTynhZO76r9IkCHAQQAQoABgUC
-Ts2X0QAKCRD1T+ZICIM1qZZuD/9vUi+1nCzf8kjkJnXuRhfFgskBDim/SLOhu+S5
-tIM7ui/xqCZWFUGEwRTR5kgNGEsTbPJ/x1glP0apQ7yaD6rWGbwqlbCqd1/KieGx
-NBkMdyK9JzfZkf44+Euypbac5shmIC4kLNN4ksgzLkqTnTr1ApPNrlLSOqVgr97C
-4WEDuKKPXrIkVvRCfGy5cjjXFBe+sG6b+PqYkyjC5y9m7WECW9wc92t/9pzXvk82
-sfPFzcF/0d+0bUF6GpImTCk78OMjVyjZ+WFq6RJF+yQx+k1ic71Huc6kk4ODPrMk
-7QawlWdsMbNPuPELhu4vu8DZj4bfgOy/77jCM2lkE6we+8cQ6FX73PlzlHV8qWQr
-e3yzuK+cbBZJ64XCyeiG+qcVLPORw+Saa6AZikp2g3LxmKK1q+MHUtAJbfyJvHrF
-V4w96kQsHnCAt6SznocMxn2JniUxtOrq1ykUbdGmR34WBzb/UsnAxgrIau+5y8S9
-pR9aBTmWw+AKOB1GG/zQcGJL/5nHrg/wxfnCIfO/1hOAH01LGLRMF+Ih77A03GtE
-sTRrtH0clT7HFb+aWTp4xuaLorPJ3CBoNT9lcI7HkkaAyN75Yd/WKZZbIKqAwX/M
-oKhn/DG+6EnS8MwuVCxMKNXftYIyhhZXttH9Erz8SUiQw2cTt6Nq1YjSoXwq/T3c
-EdYte4kCHAQSAQgABgUCTubiXgAKCRDGh181Qc794KfdEACInc7tkSJdiBsjlYME
-RWmGCMgjyPYbkIn8ZWCnfY0CkH6axy7znZ1XtAYg/ms0SFfkZiC/7Trs9XV//fR/
-BE+Y2Ry8bTuDjIiuAlJikYGc2mc5bm72jFg7ujx4AdlQY++FV6+8YAqtAYqqmNFq
-uxM95R9B6AbBEs3xYSEvD/flSOrvE+oC5d4rPnGIfKHKD2DaHbc7MednAz8txBgf
-kznk4zy3Ebx9joHmxTVbqsH8ydLTvFR0YUQxjQe8Whzeuu0dv0HZIiflygch1UqA
-mxMfM4+Zdw1dn2wyUAhFAmPlrMW0neoYdtXpNGL9fHGubfKHrFcmf56vtfffT2Jg
-mP4JlAsIkoYXLDDrtpfQtM1c9pgWs1ZWKakKzLWM+doW0vg1EJBv7ArCht/Ymlpy
-OOWpTY2cCWPxx5CWifOd+ZPmEL4vk0hJT7ZSrspR7/IykMe8ZA/CQEspM4yFoIbz
-1BCINzKcjZcurygRxlMUL+aZk0Fobgx3eijAOMX8yDbRkiL9Q0DA+zoH953Oqjqd
-mmVmP88Lsd1DxXEkt2wpedO1rUsGFjjSpfDP4NB5NRIjnx7Y/PLus3iyY2CSxcDe
-oBwB05GTZ3hqqV7tXVsV9xiGpLxD5kZfhBs1D4vf04dzvqp7/u/ORvislSNaSFxW
-eL2/4fr7ZxL/+1QvIuOSr7+WPIkCPgQTAQIAKAIbAwYLCQgHAwIGFQgCCQoLBBYC
-AwECHgECF4AFAlEgj08FCQvSMBUACgkQm7hjsPUbuIqV6RAAsyR7D1OSKh8WC41h
-ayD1W1MvqO6BfxCOgvQpoIp1ctEM43oI+fYjYxXEBeeiDpPv01ozQbwd7HSkCf0/
-1h0IvZNCZiUn004Mz2gmwSKjHl9oq5cOlhgJZB3RUbz4O+vo+vxkL8H/Mgfc3SSA
-9TdPWyTMn9m3YM46Ql7an0Q4Km9Gei03wkKoz48GJFw6/pnDgZP1mTq7JEYrQeBQ
-nX/5aUtsflXJr+riUIAHO6vjCy0AIN5b5D69/01+I6dk7Iw80kR+TFeT/0nJPiHX
-BRz8TDiZg/gJrdY2AykxmdAyZAop9IBJk3zGub7Aswn4V3oW+UIQ1pjIXH/bqciW
-RP/VAsz7kyg6cCteWO+Vtew86QOi3+1k82+QYrrDIKQP9rDhgKDr5CLHnr9HEYXr
-hV8liag1SNB2KTvDCiPPMscpDq/MWV+kdboq5m4ybOQGEUvpwQrjVGrPwyywkD7k
-3PqSpvy63p33zabbJHQjevopsDdDFzxlhH2NKJDH6WI7Sszk9q0VS5WCtneQ+8zb
-o4p/1nTVCSE0Leedy1LekUHDPUQ6pziGbjEU0JsvZNRC9RrKFUsnKTndgsQxlMwV
-2QiK/BfNwVkFReyEO5HEMvXXBZSR0JG4IJbYO9Tgzaxd/qOn1nD2RuO6h6O8CXX4
-ObQvMD6ANZOrQ6WClXKEKqnhuDWIdQQQEQIANQUCTOJSoi4cSmVhbi1TZWJhc3Rp
-ZW4gRGVsZmlubyA8anNkZWxmaW5vQGFwYWNoZS5vcmc+AAoJEKR9Hi3QHg4YANYA
-oJjhPnn2X9aUeepb6HzKkP2REJTOAJwMqNSRlUdSQUBfUC93xCAS6sUJFYjKBBAR
-AgCKBQJM0rRDHxxKaW0gSmFnaWVsc2tpIDxqaW1AYXBhY2hlLm9yZz4gHEppbSBK
-YWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT4fHEppbSBKYWdpZWxza2kgPGppbUBq
-aW1qYWcuY29tPiIcSmltIEphZ2llbHNraSA8amltakBjb3ZhbGVudC5uZXQ+AAoJ
-EIs6YB8IyXXlWaQAn1tiQjM4MyZA2v4GlT2Te9p05dSTAKCRpuwROcbdZlTLygOh
-H9j0/1lXXYkCOAQTAQIAIgUCURGZrQIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgEC
-F4AACgkQm7hjsPUbuIoS3RAAwLclnEpqvrPmnsvHXmxJviuBBsWXrBD6ces9BuV5
-LdCZr+Biuud0A/xtkNl9/2RiCx78qhszwNkNTGtyCUNuQXwPfkG0hdRr+qSuKds0
-/zx59DBGN+duxoxJOVSVFvQ/LG4QGi8xXauLzoBcCOJmdEJycdgvFkP7cRE2A6yI
-5C9FmHurJ43TZQHCdU5O5+3B7rmrPRaVnVy5/j1sVCgJcpFAWdsLC7JdFo3vyzEO
-BP8DIVE8eSVd74+Db0QCvF/LaWkUUM1noG8yXB8cnG7rEHQpg9T3y+pmKVtUIvoP
-DbNA3OfsNKCmo5ym1ps4yeX63F5SMZ4JgNXHEB5sSbdL6uFnyrFEeH6zb4u5pjdd
-g9cBRFLkAIUVpIISaWcGVNIe52YpJOqM9aQAzx2zVVfrB/0PHEex9zs+hQJLeUPu
-LI7QXKyEXD2xW4WtIaZxg9PgenzFWm+zTZkgaMW48EYW783xsq/dgia0i3s1mYSQ
-2STwGsM7whqUJdrNd5kybdaa17JRNXLtTEZU2mHtMKqfSFwOQ5KEnePLPTxl9KkR
-k8xrQH5F2MKgyQtZRLvWC7jJRceYilJ2K4XkT85xGzqumIa9ABrxeqZMlKSldaAF
-GYtSJr3m8TT9RVUTl9i2SJqlOEtuN5XlN+1zzhHAdzP/hxq35qunvgkatAm30DL/
-1HyJAj4EEwECACgFAkyyd3wCGwMFCQWjnO0GCwkIBwMCBhUIAgkKCwQWAgMBAh4B
-AheAAAoJEJu4Y7D1G7iKdjoP/jI+g2MfdwcYeulAtehiHpxWXU1HCXHblLdqLTNj
-DFHQ9KQaAi2yOhi/z6XRzZRCtBBrTqfOHEHl8h27v6Hlbg/J3XKz/Lgf87NUMoZ2
-YehvFvLGOCbt9AAMURTmTBOd9tmqR7GeG6IkeiIu5u0izyKezy0CX/6oyXkLyr7E
-Xd6n7D57T5LscmxlhsFW2bumFE+b3uvhfyeUyVH8yxNJGmAE+FB5PTb6WWT+yihQ
-I9Chq5qJVyEud+FM4XkbaqjyJCzzJf5ExU4uwbjWBd/fAVRgs8XGxfXPCJ66GurB
-FeMubHTIxKRnXqbcgYMeNNSFW27ZA5QHq0bForY2oWI2vzZtQu8EyJS94yKxRlwr
-Uvo+L2pjP2MOQGXcodSkYboEbNJrs0001+FBP+gTngK++pF1ihEcRoXLX4qXMwTn
-PdUuZ5T2PERIup6EwA1uFViNCa/RnaFFNSkNBkE9BcoZBUSGcCjZPzAgdTNbdv7O
-3QlZW6tBpKD9cXFzLinhElR1H454jEP7FqRYu42/TllgdNJh+GfLLHATRSe4dk9Q
-8ujOGXSbAoTwz6DHn6OrfRbXf6VrnjwSBC0wJ4lx7Oh5IspsBZtyK//GeMUa/0J/
-uXYLPNlDbBUckMm9e5lOt5PSa1AkM/bIxBvJc/XIOCcXVK/0iHI1KbaT9S3Am5xO
-BJM1uQINBErx+bIBEACvms9F9tvCbiiomUNcohHhHV+poRDb97luSQkXWqYYb4N0
-npxgAe+YzJCI2aKBZvLxIzET5w0foXvCDafrMvZ0nQHO1cqG4fFDqJYtietXW9CB
-d4kFn5pQJs1/8ZU/9/skQkw0zOJivfhHOnDza5JY6JmsS7By2fHJWfmkPU+5GSs0
-+MmEJ1yQRTg0L0gYwyap2sYxOWb5h41mf1tPnEnZXT/T90E5YKtmAd6G3khuiuTj
-VoMvuqMk6ueVjK+B0mSmcg0rrwPa21rO7ymouL3CIoCniA0SoxeuvVqGv92fjxFh
-0a3brpyBIUj0SidVu8DGjlP5lFE7s6dX0hDYr8wWxOLOxHUvk02JQwoTy5UYe3jU
-g8cbGdACX99ATPstfdBmzMmhrJsJKGB7NzzZqMk15e7oxBEQhLG6gDCrpE5l+e/K
-TQH0x6R58IzyStlZYCcTYOS+80CGu3pQtIL6QXxnTAPx14Kb81a8h0+HRX4dELCM
-nNUAWnQvNaihTb7+yfVaJvBe8/YPLBp9ST7vLBC2P394syQac8sWx7oADq/YpIOw
-ccQzriEIHb0hsbiPXfaEVxYG7cdsdxTH78w10lgYWdF71VUYNZnUv2wOmKwxoZQs
-wXQa+gX96+KJAlcQKQkcrjl0/SY7/vMoPh43yGZyOuKFd9AwqCwagW06moAXrQAR
-AQABiQIlBBgBAgAPAhsMBQJRII+sBQkL0jB6AAoJEJu4Y7D1G7iKQjsQAJH0B3OP
-vE/8pKf7umGjzHFY7lIwXU2aZ6eNWGycxjhdNJxuBhQ1rcZAu/tT6Uv5AjnfjwaD
-2gYuYDRqDGnifAR55YX5/lZzLKGfkQXFSnGyC53hGx0BoU++jmRjCn4JJz2ncYap
-2gQ8c5O37olp4zzykVPwbiXeluWfTc5RaR3U2A/YmRRNRgu8dacPSQw1RoJo/A46
-Xlru92cLjBt5I6RatGTkgSMy2u2zc+kQNmRz+kN8zhTbMy0K410VBM0PSIksXK59
-YtQJlgr5zwfDlWk972HLorJu37GamBmv3MV6/nyIr9oofLNkY4wGm2KIqwRAcjEM
-K6JWwHUMrz/5EwxLO5tjQnzftbAuTgy4kaRqs1ecF5VVwbL2Ot2DqKnej/umjqMP
-xI5azBsh2o/2sIHMyPjiD+cOGGs8I+/rcnWFqm91GNZCnLMBjozbcFhOFhZ6XEsM
-8JiT6We8y/GOwm/NyE1t9hS6p52eDxEERqnvfan+tOzUIssw16TBmeFrPfxegKBX
-5j8v5jaNi0todmh5XIDUD3XJNphFDlDBK5QakCC/XicmH7qm5Rx3jQy4eLbMAtX9
-URDq829mV/Y6BuUAQQnURFvNoN1GXK2se8amRgb+2ELVyPUU2J+vZcJF424iI8qE
-djLV9x5r8l9XFbkJJq9Te9/EI0iuDhH6qbCBuQINBE/exNYBEAD25MRg7Xt8ZOmo
-oeWYOg1lcwkUmxD28fF0EaNAvhYd8aGv71uTT4sDdtOyBAQxdHu+3aGJbXFECciS
-GZvbZcP3TJDmw/97aIn1z5VHAFQiOFF9RxrlaFxxAbaRw8w9hfgxBLKe1VlVJjUr
-txsPQt0W3Cuow7TKr6FGoQzOoxCQnqHWWAXhZ4dJA06g8TH4XdvuRMYaKdl6psgJ
-EH3GnKQZ6Xfzv4CC0icavOcfVBi3egtAl6bEko2LM7OQp1IWlW06gIKIOrzDWF3C
-3+8bW6dYvXslP/hALbd5g5UiLoprqqXuUUZmWHi5VjSC+6hiS1fKqP0t/AbfbZF5
-/2iFfqcjNAIaeZvcE3kb8chR9k9F+LBfc5Rp4f03l75TmAQ7ZJJPAzM/Sv7XiGwA
-ekPosZl0UtWn+eQcTNVlLci0LvQY3NYU46Y/AKw0WKQuDgSEmjNxBB4NA9BP5kHD
-DgtNM963OeSGuyRsB82hwGYXShBnBvtg4i/Xu+0x2iw1U0Ad2MNbsz9VdUXVZefh
-Ww8fayjAvHPptnHTJ2DXukn7fot33LXx6bwoNfUlA6u4ZvVMpF3naA0RYHY+3rBF
-wVm0kd1lJ72uBFzyo7bzUQicPwKIHZfy6ajzo1XNy6M9DX96djpC5iSoFHm/waFt
-H/0vCpqntPg/DMp1Wbr3orKNEU7URQARAQABiQREBBgBAgAPAhsCBQJRII/DBQkG
-5WVtAinBXSAEGQECAAYFAk/exNYACgkQ4sL0XWMvWr17sw/8Cg0UoN4DMgFgUr44
-fjTFi36UOg2AbPuh8QbqC80Eh7wX+v6Gqc3OZi600YmT/JaPIwdc8YQqZaQKbu8Y
-JzadQMLSkeD85Je9g2zKjygc7Lwiv7UTYL9aF5OptUecRyaE0QQeQ4chQq3zhowG
-vBsfbIAJXvloP+T//mocO7mNmjfw1iU9nt/RKBFn5l7mHIpfOyQcdunC9sU8pgNA
-NGpenHEvjchvAkQUAvEAXAKiF6/+O4SjzLOPZLNh/oJLByhynPicpb8K74pV+ngh
-htOWL/3+QnjxeallGFBJPKmHwUD8bZUpCYJS3H/KPmVSa/P+F/zGkANjBvtmdX54
-288CAUgeNRSOKaXTxP3Vnla160WTishV9Dcjodjn7JDnhHOX6b9NpXYskR3k8G9P
-Sh6ggTmZJ2fRzkgk9SSUxjJXr+VznEng59emcmeD1T4HyC7nHhef5oLH/pyPt2h5
-fTsORUwcPNYVGWQZiEy2YY45EvMuW/FFGlEdNzByUGyvCKONK7/3ipWdnJv4OaVk
-teljbVl9sxRqecIcOAuAx7SbH8J7uxNlw0HiXMTTIiH+NvQwMyHQkSoRUG5IkBeO
-P+7B2DdS37Caw/kNWcCXwYe8zFVOch99m0wkI9vWBtpIstUDaeelHSSw8T6UjYF2
-Rgr/I45P4vJdmh0ZywBdjhIWqx8JEJu4Y7D1G7iKZqUQAJ4NZ5/BGEq0HTI8trdS
-DSTnphm2Iasi5CpDDLTak59rNkWjulxnZ2c/qflMY7/K1ZGD13kpelK0nWTfKXi5
-kVrq2E/6b/1Lp3GfVaxAgih9rPrcfp7cit8403WUTKYkmb+2a79Y/Nf5T8MV2e18
-MpzZkA+3XffHXQzzscyhBOTzZ4wjvT+uC3coRGwIgJchAd00yKgrPMYox0eEAAhB
-OIaYj85EHbdA1B2wdrQBwNPM6pN1kFvZKOAfTAPNSYeFEQVmnGya5jg9+RIeouxE
-SFEDsoe0kKwZeQF5ZaAiU7V1EJEefTnHVVhkULo9w19M25jdka9MGFyaiZrL0Epd
-N7+tYwQG2qzOY+JScUzIOYcFKPTMF33x2crMssMaX2HEI5JX/Y9lPGZMwEWwEtxa
-+V5rJzZOpx0FZlBA8aLgn1hChjmbyTXXP+/cyo48v2Pgkk5WBqBJZzYGGH6FX399
-Hr8S1fzrwqO7+3vMzNuBZBbKH9rEtIAh6UqvhDpqZPj5T1dIWlhb4kfMcBZ3+fE2
-eJj31fIr5/QhPxUQ77Ca9nrMwxoMmPy3TJHjBNLOTAEHgefIBpFUt3ZtBayCWTsu
-eC/NmDLUR23oBvfEfm6beglClTGshZel7UdTNRGr5793K62KdM6XCT61VrH9g5T1
-YGX9xIlFt+fyh76GksQSYwhv
-=BVQL
------END PGP PUBLIC KEY BLOCK-----
-pub   1024D/EC88A0BF 2006-11-09
-uid                  Philip M. Gollucci <pgollucci@p6m7g8.com>
-sub   2048g/315B27A0 2006-11-09
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.2.2 (FreeBSD)
-
-mQGiBEVSy4ARBADrOOinwIJ4itmRYZkw8cecNVGDP/VwcD3p8rlYsjZe1MNEZhuR
-9nsNb+QOTHdY2iw92zsXYsYuk3kFEppGf+pomFnfUARJiMYkV02USvACRNSN+aRt
-d2y8FCmhBZinx1niYhOAD8J+B97/IUKXqEBOygpHXKQz3xN3770CNef1NwCgweIx
-0jReKJvR9uUgfqhps+EEdPsEAOmN37+bs+WaG+u/cd3Q/bHqDs7bG/GiM3beLop0
-HQLu68yE8KjZYDuKojFVJcvupAzP1suV7XaaUhBY0xJWLmGI9ZwU71yTTsDqex4b
-G3qQ+4gqYEzIVQkWHquHlBeH6Ipjgw+I0XctPklIGnA87pztTfycKy/Xk/6RnlBA
-29ujBADHA1PYdImHpsPbko+OkjOjdGjS/29kAUmEsWSVZ/PAVgs92glGHjBTZDWv
-QzvsDmceTWS8LCAQivo4FzZvn4hbMA5nhU3Nz5KwvA9fe2LhiSyMoKILk3D3odSr
-w/bZF/0SOZgBynz1AcC+jaj+rTGF3pb72RKLYZa8ZRCyzJpUYrQpUGhpbGlwIE0u
-IEdvbGx1Y2NpIDxwZ29sbHVjY2lAcDZtN2c4LmNvbT6IYAQTEQIAIAUCRVLLgAIb
-AwYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEBMkm0/siKC/X+8AoLnY1ra0mDdJ
-8KzdBWBRgm1wG4JGAJ9C4K7yr1bF/LKXKzXWXJ7K+E5YT7kCDQRFUsuMEAgAm0d1
-14gWPOe4RaOYy9S3bsJlKww/eLF7pC4oQKi+aWf914Q0+iJ6XcPW5dJRZkZ8ZQEM
-zwhDPn15mxedfuN2CQldgyi6DQKbAsNwnUKd5Ro6S0rcsNF4hJ9G7ZfTiSD58Vox
-aGSexJwToB5GrmqshrTBr4zfy0nGOo/GfzqADz/hMIDjLMIDQYah1ihidZ+w3XOx
-ei0aUsC45ZnoeAipiL8xlRljDq6h8dmTmXGBlyY8VaXghYkLhoF9bWZ6dUukVUIp
-OI2KyQzOIa48X6wLD4FbnIdg9uvcwItmdgelPAZqiJbsbk7MktYNHwbMbOR+W7JK
-we5eCKhiddD4v/ysmwADBggAhsI/RXL1qLwssop2cDs5oETekHHjRb/aDg2xLbL7
-KdB3wSnYPYwG5EmAc2jukCZonDEJYTZ1RePaK6QtPyHNZPWwYS4gZsQbTgNUmWvU
-r69VwBg8i1USADlKiMCLvoiMOyNEQp56yrwAVldP9UWs3p0laTZTwaNeqDS0m0by
-gDNTPuX5xIHwTe66dF2e6YKSXEEIqlluaHydK+K/l/Osxx8I+DcH3rkzi+/9bCk+
-iq3Q+qZh9uT2DadAbbPe/jHtcBzoQ2qFan0rNDOFGDkMGbF0y2cnjc9DXBLymcsd
-UTsRkhsB/Mq5+aN4sG7SXT7DwDesMz6jNdkqrYP1fNsMdYhJBBgRAgAJBQJFUsuM
-AhsMAAoJEBMkm0/siKC/mrMAn3/s778nZ6gU4+yCIwoVpf94/FYaAJ9XKasQwdyU
-QrnWO3UkWeAgmGQ70w==
-=wxvV
------END PGP PUBLIC KEY BLOCK-----
-
-pub   1024D/0E44CF0C 2001-06-19
-      Key fingerprint = 6D0C 7498 5535 060B 2330  0BFE 47F6 969D 0E44 CF0C
-uid                  Joe Orton <jorton@redhat.com>
-sig 3        0E44CF0C 2001-06-19  Joe Orton <jorton@redhat.com>
-sig 2        78688BF5 2004-04-01  Nalin Dahyabhai <nalin.dahyabhai@pobox.com>
-sig 1        D39DA0E3 2004-11-28  Jason Harris <jharris@widomaker.com>
-sig          D23A41C8 2004-12-21  Douglas J Hunley <doug@hunley.homeip.net>
-sig 2        6F9E049D 2005-06-25  Pim Rupert <info@pimrupert.nl>
-sub   1024g/54F12E58 2001-06-19
-sig          0E44CF0C 2001-06-19  Joe Orton <jorton@redhat.com>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.7 (GNU/Linux)
-
-mQGiBDsvsLgRBACsHi7eM94mA9jlBxxwLC4ntK0Mj9WWm85V0C1y0Ei1MGz7q6Vu
-WdxKgkNMauWrqKCBDQxOI3q5InZd/tZcOXQzGMtA6DxdAa50ZthfCbo0+8bfm00a
-wCa5s/1x2tu7zuqcA7/3nOscZgss2k1RrZIALFimfXvq6hkchQyj9mnfKwCg1aOA
-Wk7psAeH7UZgBqGHLcEKLjsD/11APufZVhmQtwKP8+yVe4d6UI7e2r4lURoT942g
-tLlye1Rvh+FggkWjxKrwmyUaTW4jNDWEO1Sy1KCy/zb17lDQJReBNb4Q6wQwuySL
-QqpFYUy3LtCJHnWsriC2d/iuLbBuQJxxQQQ0B0gichI+pqyZN2fmtiyucA3EzXv2
-8WQQA/9eSsUHv1nq+t0mbOBg1wpo0qlofJ96kM6kh8tzD6SxsHx6WDqE2TkZ+6Kf
-Lr6yFo4XLY+5DOZ5XgR5LBTyH4PH8M5gZkqfzDTCJfk4qc2XzVW91zSbzQ0fMGWq
-CU937R2LwnIWyVXjBgT8QLO58ZW8/X17YIGcgqHW1i4VD7XwR7QdSm9lIE9ydG9u
-IDxqb3J0b25AcmVkaGF0LmNvbT6IVwQTEQIAFwUCOy+wuAULBwoDBAMVAwIDFgIB
-AheAAAoJEEf2lp0ORM8M6boAnAz/+oVQGgGcHIpF9ugtJumGRApTAJ4liHEQvna0
-FOuzpUZ6kMT3sgIaBIhGBBIRAgAGBQJAbHSUAAoJEDebzld4aIv1rb8An333fo64
-a38vUnnO6rRdVquUpYC4AJ9x3lLonu/WI5WmDHjTy1Ar2kDt/4hGBBERAgAGBQJB
-qmYnAAoJEEsqSJfTnaDjyOEAn13slJuH8G6VVPpV2m9S7FxRWh0iAKCEUKMYF+ZI
-mQIyWAv/y1Y7A0chi4hGBBARAgAGBQJByJzOAAoJELGJ9rTSOkHIqX4An0obHgj3
-3Oiudie1rqgHj1mxxAprAJ4ps3XhNLDkxtLgwdao85VYj34w4IhGBBIRAgAGBQJC
-vW/eAAoJEPxPSY5vngSdRqwAn3BthXNxPJBzDHRBgZ5d/1xzmFfqAJ0eJfe52uvk
-h6ZzEc1sdl0sjKuea7kBDQQ7L7C6EAQA3lBouLYzyMT83ZtRUNgYmDZqNai1crEl
-kuctL678IwQoEr4zGWTfwIb+vXkqf1VL2HJRXMTamrDfWo/Vy6ZiyB9IRpXNcNXT
-dYmf6wXqPZqOCK9Q1mp/sWJGafHVbjDsWzGYTl9XiJUrMBPwPIlLj9SEvNwG7Qrh
-jbrsBKkTWwcAAwUD/RWNLmA2OGhkkau62AHi2i20+zmPGLH0AnyaIPJAB6HaZCxU
-uOSNBIRsaZoOoizzvaF6Qtaa7KJw3SUviWTfyAv4Lob+bo0e9MdI2olIvjg7VOi5
-wNPldVa4Cs4desqeXecJowP71gFV/NBdBPr2DLMXG3aOhtRZkG7aueoUkuk+iEYE
-GBECAAYFAjsvsLoACgkQR/aWnQ5EzwyKgACcD+v7ABREHJd0RglLfFoAuCcZ7FoA
-oNQYheE5UpBrTY6qK063clE3Gt2J
-=NWjz
------END PGP PUBLIC KEY BLOCK-----
-
-pub   2048R/4DAA1988 2008-08-20
-      Key fingerprint = 7CDB ED10 0806 5521 82F9  8844 E8E7 E00B 4DAA 1988
-uid                  Bojan Smojver <bojan@rexursive.com>
-sig 3        4DAA1988 2008-08-20  Bojan Smojver <bojan@rexursive.com>
-sub   2048R/9E49284A 2008-08-20 [expires: 2018-08-18]
-sig          4DAA1988 2008-08-20  Bojan Smojver <bojan@rexursive.com>
-sub   2048R/CAA19524 2008-08-20 [expires: 2018-08-18]
-sig          4DAA1988 2008-08-20  Bojan Smojver <bojan@rexursive.com>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.9 (GNU/Linux)
-
-mQENBEisAUUBCACoFc8Bm0Ipb03fNXgilmTiMgjWkVVddy/XliF7mnfiASZ97vwB
-tQyyD+3M0Gi0VvL282+EfbOdDkCSuD0b+DNGVIinY6YBCdyvOEWoduPPB3fEg8B7
-NZiDmuv6K3IvZnL74xFnEuq+U2CV2M6OAZW/yRtGvWRG3sa06IiyNPgipIy7zytn
-qh9FhMJJQepFAOa6+i+8peMHQtcQtK/sHJLG6GtX0Lo69aYKzmDDgzxZM4wLvBmy
-H4LqgYDPXmvf/e2hqBfHJCDyH5pk+nIWngNWjuXg3fo/v47tOWfv65Z3ZETWbE7z
-PrUD2P7AKvBfR7cKTl+VameyZsvOZsY/hA+DABEBAAG0I0JvamFuIFNtb2p2ZXIg
-PGJvamFuQHJleHVyc2l2ZS5jb20+iQE2BBMBAgAgBQJIrAFFAhsDBgsJCAcDAgQV
-AggDBBYCAwECHgECF4AACgkQ6OfgC02qGYjSQQf+M/ESq8WUviexEHItvTWka6yC
-gd2sZzhU9z58fhFZaFu+48GXo8dUojlGRPP665bLUu3pKiSG4UQhDjcrxkew+4g4
-g9Jhox3IN4F5istfHEcQD9X9VWDOtz00kESNg3PiwUUk4N4H0fwkohGz4yfEZXIT
-ZNsyRPLFljd3jZoQLRPtraPnxxXP99KE+3D4CswNwNDbEvWj6GxTRGCncCFlP5dI
-PXgwcQxx75sQoulk49hOpzLq03jhJAUqe0kWmJAXKwqpAXr77FWhOD4rET7v/Mu3
-piT4TN5S7vjjrSTLGb/OlyHDtOhBg+En0WxlkwLbJITEJbPhE01Phiri8IuFu7kB
-DQRIrAF0AQgAyJfi/My7CKJEGWTE1x6KwttHR/k2mPzfM5+Icr0Bhko5ODkCewf2
-EmS4bO09ltZHotwCYMefLRQnaPtCYsvdF1qGnCy9a7rgZpCEpG2+YxaaDvVbmMV4
-zNnKO3o3pjAnO9rRAM77SWW4XWK/CF2MRIlg52Z0dPNDv3SOOGwYN7Dv5iKHNxTU
-k2DjK0FJId4r/hvZH0pNwl0shvwzfmgZLLubGUp6zGelZ0bYbi6T80uappgFGZY4
-ozldu8/eX49KA6o9AZuGPEQKuyX7V/oHsx6atCDMUso97spVVGKQlDfAKGUsUfdM
-YwMO0NhAag9F7JyVpuadmVyV9icBxFBLywARAQABiQJEBBgBAgAPBQJIrAF0AhsC
-BQkSzAMAASkJEOjn4AtNqhmIwF0gBBkBAgAGBQJIrAF0AAoJEHGtyF6eSShKTw0I
-AK/gyCXyNFjt+FHIaTu3Y2rCdvv0n+UWOrsimnKkARVKq16GYoEN2N14LhqJhWfB
-mRMwL6WdXla6ZoppD1uzb9EVzdhkKW3fsBmHBlnGjgdOGvL/W/hEbsEd4qg35vGb
-pZo8t842GBnbkbN5ealREvg9Sk74uXjEKeesiw8LCgPrP8MzkaKH9L8/2IvHDy+u
-/4FPRdAfi+lr1K+RhJVAu3n36SesLpwSek0kdmoDi+Ie1QDMJ37Wq/RTmzXmmYEG
-H88rkTIyAHLwjZr5Pn+g1SPOJeRfTiRbMI0RyR20LVuaig9JXzfBwERIDCABH2ZD
-CIQaG2bLMFCvzmKxqIcxC2pcWQf9HSr9nVN0qqS6u40+F2DxHPZ5j0/GJZXRrGOu
-t8OOQ7wrBZ51BzmU66noFGz3ftjPROZFxf1XDdJKqOQVbl9mrY23L2g88UKN3TLh
-6wUjUAnnvRdar705r10iSdxFTehEXXTimJCMSJwFyj9VQxZSPbW+kvL6aSp4usC+
-3vVYErgt75sMFmo8XtI09kzBtZM4aqknoXmZ1Ck8QPpuLunQ4pT9mkYqCwTZaskD
-PD/jX8iP8YX+q0641fYbsz1kCE6ur+6RuxJTnowLBHaIR+Da0+OwpmEVMyM5YJQn
-qPsUIbmLK8YuDA0QgUu2jezEa1Y9oRjp/6M8UnEqP1hPZ89ckbkBDQRIrAIkAQgA
-wgjaTGzpE0BZPF6iZy222vHrnsQKvVnQ3JysXSXLSK7DNsikHMGhHTUAPxjIJ2Jg
-NCWf0QBfmOqLLYyTgnakkMKGs6jsLtPAyx/myKWEyU+YZYIhx4LbP7Vy2fjPdKo3
-VLli+Mjx0Nd0tb69Km1U87CPbO3deWxIarGixKqv7+v6xn68W/qg1y6I6jZbN7uf
-pdV9fdpqDI7lnuw67nOq1kzePoqN0XvaXKfc5nMz2CmJdjgLtYfsFbKVe3pqTJ4j
-tTIhMtgcoQ5XcVOsCygAhH088geOuKPYG702onXz5lnErG1KINEKWKC6BRdGi0Dy
-whewJ0hSRwpDEIvkV4rMBQARAQABiQElBBgBAgAPBQJIrAIkAhsMBQkSzAMAAAoJ
-EOjn4AtNqhmIuw8H/jQF8pEz49P0wnzMS3KLOkXcM94rQTTyX0KLwruxMa5Sk2IT
-r+CGgSNpEbOmy2NUWu+om/NIA+iOloM0bbWAZBDUObQ0EMbCI8P/60wvULrJOj80
-MwWITqBV4h5HB2q/gS+1cxIw9+oj6CwGLi1GqFeIVKReLE9aSKwLnjViWMkovc+z
-x9TN5Zp9Z5K1nGDLDXOccor9YzLgjx6lfYaEXnp0rHjoG49JPDz2iA5l4KX1j4IM
-1Euoi8/o+V0G46az5UqFDE7e574kygY/9XqfLBWEJKni+fnnOIrl8AIM27h3k1wU
-tFgJorzNs2GGEpj+kU2A27zmLWqL5fqDzY45SbI=
-=h/J9
------END PGP PUBLIC KEY BLOCK-----
-pub   1024D/6F9522D8 2004-02-22
-      Key fingerprint = A8BA 9617 EF3B CCAC 3B29  B869 EDB1 0589 6F95 22D8
-uid                  Issac Goldstand <margol@beamartyr.net>
-sig 3        6F9522D8 2004-02-22  Issac Goldstand <margol@beamartyr.net>
-sig          63F69B0E 2004-02-26  Gaal Yahas <gaal@forum2.org>
-sig 3        12B9AA69 2004-02-26  Tal Kelrich <tal@musicgenome.com>
-sig 3        EBD27418 2004-02-26  Yuval Kogman (primary) <nothingmuch@woobling.org>
-sig 3        9FC881FE 2004-02-28  Zohar Kelrich <lumi@musicgenome.com>
-sig          015AFC8A 2007-11-18  Bertrand Delacretaz <bdelacretaz@apache.org>
-sig          152924AF 2007-11-21  Sander Temme <sander@temme.net>
-sig          1CE17EDC 2007-12-18  Matthias Wessendorf <matzew@apache.org>
-sig          2046D0F5 2007-11-16  Henry Jen (slowhog) <henryjen@ztune.net>
-sig          3AB8598B 2007-11-16  Jay D. McHugh <jaydm@apache.org>
-sig          6210BFC0 2008-04-26  Jean-Frederic Clere <jfclere@apache.org>
-sig          65D5E39A 2007-11-15  Ben Speakmon (ASF Code Signing Key) <bspeakmon@apache.org>
-sig          69CEEB1B 2007-11-20  Michelle Caisse <michelle@caisse.us>
-sig 3        6F9522D8 2004-02-22  Issac Goldstand <margol@beamartyr.net>
-sig          6FD05E49 2007-11-17  David A. Rush (KY7DR) <david@rushtone.com>
-sig          8780226E 2007-11-16  Nathan Beyer <ndbeyer@apache.org>
-sig          88C3A5A5 2007-11-16  Philippe M. Chiasson (Home) <gozer@ectoplasm.org>
-sig          9C85222B 2007-11-15  Henning Schmiedehausen <hps@intermeta.de>
-sig          9D3AFD4F 2007-11-20  Theodore W. Leung <twl@sauria.com>
-sig          A79C6E18 2007-11-16  Bjorn-Erik G Townsend (Gmail) <eriktown@gmail.com>
-sig          B3B4D98B 2007-11-20  Timothy Olsen <tolsen@alum.mit.edu>
-sig          B8CE306E 2008-04-21  Oystein Grovlen <oysteing@apache.org>
-sig          C3110611 2007-11-15  Petar Tahchiev <paranoiabla@gmail.com>
-sig          E04F9A89 2007-11-15  Roy T. Fielding <fielding@gbiv.com>
-sig          E41EDC7E 2007-12-05  Carsten Ziegeler <cziegeler@apache.org>
-sig          EB51FBBA 2007-11-18  Marshall I Schor (Code Signing Key) <schor@apache.org>
-sig          F5BB52CD 2007-11-19  Yegor Kozlov <yegor.kozlov@gmail.com>
-sig          F79B7715 2007-11-20  Felix Meschberger <fmeschbe@apache.org>
-sig          FE6A7BC1 2007-11-20  Paritosh Shah <shah.paritosh@gmail.com>
-sub   1024g/6741A3F9 2004-02-22
-sig          6F9522D8 2004-02-22  Issac Goldstand <margol@beamartyr.net>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.1 (GNU/Linux)
-
-mQGiBEA4Z/MRBADgHIqs9R8lj7gPlUps8D3JgLJEEDnCCVabppX6+pdogmNdTYPz
-tjp8KLHjBSfqq+r4aUxp92CtZzTlpSAEEn9uo/dgb+/4233Eg4hpSff2f2fZzvpJ
-b6I4BaqF1SWVoGkVxZQGcC3yLFxQAc25UgA6DCJcFCd7InY4q+w4cw8AswCg1Igv
-BI6gYpVegrlQqYUVlfxE4p0EAJDbJTtaChXFEc3oR9JeTzN36NUTNpnq0L1/RNfb
-U/5hy2bt6YUWn2wtpwClGmA1IOxTO2bep8UvoQ8F8v/wgdQazlcS6wdo3dDm+hB2
-MFDy9qrGtXAsvNii1VK2O7XQHa60K+ZDGKNyGmuzXy8ujAvUE2YXD0LJH1pwBalr
-vrLfBACUU8Ch4aRwXHSwFyvNEQb/ICKc2wOk278JB8uRSavdmbaDeAKoWj+7LTx7
-H0xcwUyP960dJea8CYYGSrr5IESOH6sFjwy8Dv7P/xo3COf5kO2KfhoBL+ABEJvG
-VmNFsoNCkiNXGjkBLJTwav0/R2pYRxQp04h/ctVrJr+lto6z3bQmSXNzYWMgR29s
-ZHN0YW5kIDxtYXJnb2xAYmVhbWFydHlyLm5ldD6IWQQTEQIAGQUCQDhn8wQLBwMC
-AxUCAwMWAgECHgECF4AACgkQ7bEFiW+VItgf4wCgpUd2Ln/cCyPgV4V09kqM6+g3
-ObMAoK/qeEztO7STfdgcKJnAR2GQvB9PiEYEEBECAAYFAkA+YAwACgkQN2uCuGP2
-mw7l3ACgmPGmdtk+n1jQkPNlmy1cgIVPcGgAoI6vVfqJ9+AcnwehoagbD3f5LLeI
-iEYEExECAAYFAkA+P4kACgkQ/sGarBK5qmnIYACgslT6Mb6VfEvs/qN7GoWN/oZ/
-jgEAoKhcKA6gqbWBsh/ihQijlF6zICssiEYEExECAAYFAkA+ZzYACgkQVCwRwOvS
-dBjipwCeNnKqRspkZufe4XjL2GFQdTXaaZQAn1Gm/O5Fah42HxoNt3PrXh3WFnTA
-iEYEExECAAYFAkA/5f0ACgkQdW1LhZ/Igf6nAgCeOHExK0HUSqXQq9vKik0ZkzFK
-+VAAoIq8NmLML388JYGLMK32/HegJAF8iEYEEBECAAYFAkdAlWYACgkQN/aP9QFa
-/Ir4hwCfTY2KuaV1ysNFb32LW6VEYZccmVgAnRACJIthab6J0zQIj5cAlW7vfrHr
-iKkEEBECAGkFAkdDlCcgHFNhbmRlciBUZW1tZSA8c2FuZGVyQHRlbW1lLm5ldD4i
-HFNhbmRlciBUZW1tZSA8c2N0ZW1tZUBhcGFjaGUub3JnPh4cU2FuZGVyIFRlbW1l
-IDxzYW5kZXJAbWFjLmNvbT4ACgkQsr68QBUpJK9cGgCg18E4t5jbxd4N72X2AD3v
-cEzTDNkAoLUp1EObt5Yr/mFkTKPSZwRP7EVCiEYEEBECAAYFAkdnnDMACgkQQMKr
-HBzhftxAZgCfeHQhdRf04uxEd5rS9mN1gF0ZnloAoIgsXNemGq2wGuJJAmeauDoC
-kVBqiEYEEBECAAYFAkc9FkcACgkQLNaoAyBG0PUzcACfchAh4Apr6TdP1ka8FuT1
-vog45ZAAniQVb/yl+MqqkniL0Hfm2FgQ5ozCiEYEEBECAAYFAkc9KaAACgkQEYjo
-3Dq4WYtzXACdHRQrXQs+jQgce2HfsWPrTvtWYswAoLCdJK+/Qi97OXN4wl9bK64K
-1J47iEYEEBECAAYFAkgToLIACgkQD0UKJmIQv8DIAwCcCqxidJW2K7tISWyNhtXc
-tx9CEysAn0nrx8zdzoYWu4PpBTtbtTDGSckNiEYEEBECAAYFAkc81CsACgkQr9Wc
-wWXV45oWNACgqhI1zGHGeBVOIWeO4327fyX9ofAAoIeO37Tzg01Pp60XL+O4DVtR
-Vy1DiEYEEBECAAYFAkdDITEACgkQ7U7vsGnO6xuXAwCfTi8nBpinhmeqPzRX+VWr
-0RI4E0UAnivZbcH4U1voSgMpktFbZU7n+mB8iFkEExECABkFAkA4Z/MECwcDAgMV
-AgMDFgIBAh4BAheAAAoJEO2xBYlvlSLYH+MAoK5j0uJMhQf/4xaIheZzvjHfY1iT
-AJ4srgH4IvO2TWXSm6AqVfNrewcM8YhGBBARAgAGBQJHP2VsAAoJEDk1+i5v0F5J
-MIAAnAqV9gjU5LWnBc1wH5p9neWG1xiaAKCFQ4r58AqzoT+4sg+9AIeojnaYEIhG
-BBARAgAGBQJHPQiHAAoJEAC+ZrSHgCJuna4AoJL0tN6xbBO3464JGL+cZ7PLctGd
-AJ9SThD+6rkdxkNWx4dE/WgAZBOLh4hGBBARAgAGBQJHPOkuAAoJEMsyoQeIw6Wl
-s/YAn1x4nHnsstMIDDwGMhlGPKHW098pAJ4+LobR2VHsotRXr9gP/KzuWRa3DYhx
-BBARAgAxBQJHPNClKhxIZW5uaW5nIFNjaG1pZWRlaGF1c2VuIDxocHNAaW50ZXJt
-ZXRhLmRlPgAKCRAyhk5BnIUiKwoWAJwJWiTd2ovhOMfYh9jKXPkLMo4tJgCfbC47
-nhNOLMmdgMn7PZFwz/qU58aIRgQQEQIABgUCR0NSdQAKCRBgKNb8nTr9T6QLAJ95
-ktuG881Ko2iQaJ5kJe7hgyuyWACfdFIR3F4Jq94PO6kl9s+DC6jWF/yIRgQQEQIA
-BgUCRz0GzgAKCRDBPTDYp5xuGCuvAJ9RRtzJQsXCVwngAC8NVhcONBcWbQCdEDWJ
-LvqrDRJKEI7Cbk1Y/O5s1QuIRgQQEQIABgUCR0MGHQAKCRCw4Bj8s7TZi2iwAJ49
-sIqrZNVGTzozxTDu495RuH9+fwCeKtXFaRDaXa0IxK8lkslQ5RJ7rB2IRgQQEQIA
-BgUCSAw+3wAKCRChYGPsuM4wbpUNAJ9Nd9CGW1bSJcOKaKAo2K7iEsNVcACdGo4m
-SicMkhN2gmFkHQP0wjLyNkSJARwEEAECAAYFAkc8uzIACgkQGWWFUMMRBhH0+gf/
-bPEbwV3zjIaUyYPiXIGa2jmdi1G46ms6yEdKg2T3Lg0+AxR5CkQWlF+b6L1L/bAM
-qAH0vd+zHFlmiKSHGIhqDz2mmR2kc1eMxd050l6qXASHIWa0QbaMTImmDEkXaIVD
-QI1dttqQKgOJEPgta07kUXSW+zT2SVQ4IurK+4RwrUupoKPm0trC2kM+keCieCpR
-f3c2q46Quy7qfMkfby1cwtU9gjz0k+A03TvLXDcpNNJOTPfQByEkOjBxF6UZatay
-YFEpLdA83hqIdLGm/ziU85Mk6VR5We2PcD74ZEI9R1BSaqjmuofZOqSW9kYg10Kn
-6vFG4hMxgy9B9S02DVmNiIhGBBARAgAGBQJHO8qYAAoJEFuWgBDgT5qJUDgAn3J0
-7BVslyH4YOpXRy5nEX349iPUAJ9YUYUjm6cKg4pWvoxYQqQPcGAGoYhGBBARAgAG
-BQJHVqzSAAoJEBMuSdTkHtx+RfEAnRqCsQ+oUS/XUjyHJwTvnJuqgOQZAJ4kpGHe
-4oTQ2xSJRr99LTGdXPcGj4hGBBARAgAGBQJHQIXvAAoJENbd8DHrUfu6ef4AoJCh
-cQ7PqkcXM/sch93zD7UusXqBAJ44UgUdUzoy5HinUz9Ui2MPigKe9IhGBBARAgAG
-BQJHQOv2AAoJEGk0CgL1u1LNttwAni6t9y5HOrn5ORAqeBbxcs3UAKIXAJ4+lLWm
-nCbL58/zcSElL6PygS5PaYhvBBARAgAvBQJHQpwHKBxGZWxpeCBNZXNjaGJlcmdl
-ciA8Zm1lc2NoYmVAYXBhY2hlLm9yZz4ACgkQXif4bvebdxWczwCglDy01EwcQmqW
-OsXoT393qOCdTLMAn0DKeU+zNU+aeISGLxErfSqIlSMuiEYEEBECAAYFAkdDGN8A
-CgkQ/4h7uv5qe8EStgCgoO0CH/6VsY8TJYTsmxdSJuHj17gAoIyuvO31979r4bkx
-lOlau/qbyxWguQENBEA4Z/QQBAC0cGDsns4j+wtllwA/npIQX/GP7IBp+ySSDHMJ
-upoLXSktZwmiQ0y8vNbbJcofqSrb888WxSERxGlhM5fiNg6KVJ84EYR39oK1r/qs
-Y2DRnDUJY7SwwzP58/cUOvOp7Z3smXsX8pFN4iCntQhhIcddLdRCm/o2s5QG1B+W
-Q/M4AwADBQP/a7/zLwfG+/JJl0LBG8I4BK3tJko1sjOs5VBxO9kw779Rjw6NQqWy
-25QS+UXNL0BMwSR0/MRsekNo0mmXLOtpPzWZf04Q2vVkM87Vuciev5xD8GdrIyjg
-QEdF/PIOuMSDR58X/5MhcFCPbQEsiR9CDIzpkoyFkfZqBv1HYAkHRWOIRgQYEQIA
-BgUCQDhn9AAKCRDtsQWJb5Ui2IccAKCVJoJc4s/AXocLLtjXDdMjU1V3+wCgw3EG
-j42b8RDsM44NwP9oQj99Qyo=
-=awFp
------END PGP PUBLIC KEY BLOCK-----
-pub   1024D/E55B0D0E 2007-01-01
-      Key fingerprint = 3E6A C004 854F 3A7F 0356  6B59 2FF0 6894 E55B 0D0E
-uid                  "Guenter Knauf" ("CODE SIGNING KEY") <fuankg@apache.org>
-sub   4096g/CB11FC40 2007-01-01 [expired: 2011-12-31]
-sub   4096R/31D9665F 2012-08-21
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v2.0.16 (GNU/Linux)
-
-mQGiBEWZmwYRBAD0q6ODLHHR2D/8L7yANKOviQZwhRDOxfxIL3PoZ/xN/bMPeo8t
-wcv6Wh/VnIdz153kl2EkdYhCNbc+d0g/WMfFNe7ch8hqeYJKKQBj2fViS30ZLfju
-EwVesWzr7kUah2ETHC2Lo+vd0+x2yLsTriWUhK/ZU+85MTZRs5HX4e03NwCg5SpM
-iJp1pLwJGEt1zsAfIqUVfXcD/3uOlJamsYXmNGtEsndP3V67gsQxrleWWrLQzkt5
-WP/Myq5uY3XtIa0j6NE9TZtXwFQzVoeLQhpUg8bMuPRg3VzB5oq3ClkS09w38xyF
-eEZlNjeJg9TfvDk4bYpLKHtJeFn3pFR13Ojz+r7AHo/wbcO/Jho6XXLJPCjeMBFg
-MVagA/oDalIMI9cUVmM5In2WexaGuYqOaLD/2CEpNpL2zppv/5ES75oU1I6bNVw8
-jVI5pHIVn7wTH4ja3GfK238uncqot4SM6DxdW1F4Gj4cKG1YXyPbD+kqqX4IrzFW
-VL92VtA7LJdt2t/z+OFg2StDKiKtpGdSGcWEimDu7RapK251d7Q4Ikd1ZW50ZXIg
-S25hdWYiICgiQ09ERSBTSUdOSU5HIEtFWSIpIDxmdWFua2dAYXBhY2hlLm9yZz6I
-YAQTEQIAIAIbAwYLCQgHAwIEFQIIAwQWAgMBAh4BAheABQJQM6Z8AAoJEC/waJTl
-Ww0OlsYAnR2HF7kXtBC+SzidVezJf56EqiXjAJ9EW1h4g5opnNFAp8sghh48aJii
-RLkEDQRFmZtOEBAAwlQPuku80T82g6aS1HpnsXyzxG+k1k0Nj66ZvRM0f8gQKmGa
-nVTsbmjXRD1Q0N/WR3F5ynrk+dvgdN0/IqBxR+Ek6L0hYFqa0Mp8Rqw70M7oUI5i
-wMa/873koCnBhFet6Eu91mVPOSE9mdVIw/vlq8KT8VuxcqpvUKYgjC9hHK3GQnia
-R4JKkCQjk4ZynQiDckKcfaR765GYvw3Fq+v92Ebrdu5qYh4Tq2ncEY6qfCcxTu6T
-HXNPVgX+A+5ASlcLAxMAD1W25//abwPdvBIZ/76nXXGnZI4NQDQQf1W3btrcHxQU
-XrvHM1DTV70wlifIA3xjuWTIRr31gXv5QVrVQdn58AhWoHB2eSGX/jhHzQfghS/F
-kBIt//THDNDYhNtqHLz6SihMHNDIUcBNNZDF1tO2slsrAtKkooX1J91lBtWRWwkU
-3VK1HttMhAB5xUswbn3XExKK/J7IiI2M+Qz/QIKVIWcPyYmPBUkwtNtVRiGPcq2O
-MF2BEKRVyCZa1rQuPNRLv2iuFD7iaRfMMakWGIY2uIeLAy3KNS6VbH0qa7LUfeUv
-0Be2yyEAr5luMwomWzAHpW4xhCLG0kjMiNCceTJwASG6eTg/JpWxcXca8M0ZvcbV
-BZ7nzvwDRBCtH0W+9w+gNwgtToE4UnglrO4TsXtWwOyLfv+GaVQIngqH4lsAAwUQ
-AL/VaXfDuLOe1j3jn1sKjDIfIHzTS0THdxpP3B0WahZ7xHAtuFdd8jXiCmIGi9hK
-O99Mn5xsW3/cEPVfTjkXbfsgUc5xHsC8zJ9BCHctkgPvaHUJ7lAyZbW+y+CrW+dp
-CN49Y8H50NhwjiHiwT7GynNKnOxMFg/aZKLBVFFOzjqtDQ8qjiPdgAldO/tV7/WV
-4HTZvGUqQloEqqMjWTJO+fw9Mau/ejvBBuz/P78XkCku8cST6hjg89FXgyB0J7TL
-3ykvJltIS1gBNK6BF3N2es4qIaT/MUUbB5wdpltYt1HZHBUtvF8ywySuTu3ymyYf
-LQdRt+e32tMWgbWL00d2YJDeEOFeylBbOErzHI+tqxAQlwigKzHyUQkNKel2MRmd
-saiHMlc8Btj6YsFTf+sXnLo/zkq3BLVJd9qRS+udbbT02TIVhKybbJbxtgg5ajhD
-zOuRHb+RhpqjAaM6HGM2Vv1y3OLSzAN981LyEKgqIG2cwmNmubQLgwi1UDhcrTLl
-aXpFB+SHpvZPsnBQ329YKurlIV/rL38ZajIIMYPmk6bZIqTW0cwy7aHLXgBEgIpU
-jHDBOnq80rcyc4dauctgU1muYFh6y47yqtxmTkHu5nwTbZEn6/l1/FfoGCRMkLtw
-RdDm/4BfuuPExBNkplzglJ/cMAvvr0/mwv+tqvQTT0CMiE8EGBECAA8FAkWZm04C
-GwwFCQlmAYAACgkQL/BolOVbDQ4R3ACdHuJ0qhGNF2HmkKxkEvyQ8XYBKGYAoI/V
-BpQ3XajbV/CPs3YP4qBMddA/uQINBFAzpr4BEACwaErsS6S1riB00wvUfcKpl9UL
-JDEXlpL2ut8tc3L6YmxemBl+qHMqNFRkaHkCF1jWKGGdCt4Pjuj9SX80n9R0Hclg
-Yp58Q5C2ud3qvorf4Pyd+A5c5cyRXLovcwdybxcHgsBGbPjLijyG60ahhZV6R3XK
-oGjs4iFckNBlXXMmQXJvrGqtzF0j9FaRw1vmFbxmkhYz6lFHd+0iZgtYIuhYxaXj
-i4sJ750CWnaq8Nhvfgx3KjcoQDGFwH6iBPNw9U72eXVgVZdRBiNOphoXqpiGsehg
-gChIFDeZhWfL9MpDMHZDeLyHfBPItbjmJLV18FV5nomRSwk9q0E7BysdF/fNO6bg
-6+sJtrpbztgVySRkBO89XS/ZyAxmNaE5Ta4oysZPKQMCtzFK/9fFtIPf/Ue/c+b2
-1yjCGfg1AxFjdfAQ8sLS+tR4kDSNCTGS0W/rms4D0vGYlcCGRHj8DSForckm8hcD
-Q2fJzZdocgIWEiPGlOZlYZqO1NTGwvDdhMXOsgQoDxLeKWLz5UdCiskYi0A+leeP
-VTzrg+VisMUeKEIkcoZFSb/6Zdwg0yoso6QuuAvzMsUbe2JlUd22JyI2ZPbRqHL6
-KJidYkf0gj+34bVH+Bh/LKseviDhsp1RWPQQA6Y98ZYUIuPl4TXb9bEfzHe08Xc1
-6MkatgyaeD4cmc7+fwARAQABiQJoBBgRAgAJBQJQM6a+AhsCAikJEC/waJTlWw0O
-wV0gBBkBAgAGBQJQM6a+AAoJEMv/VdIx2WZf2s8QAJw3S3KEd9OPoh0Vh7pFdPqq
-QM3VsRyYB6lyLj1LmFgg9N5nnakPQfW3uI0B5/ChjVbETp97f5T4idLjTZthTEzW
-fRZWwqJy90sMpQuxXl+bQueAtzAsPoWrbAEbiJOrj61VPIBXUeFs5ryqehn/TSoI
-MbBeqIXODcYefbySoH8QYNl6Rx3CE10L/8Jc9Rf2JDhwrh0B1inUnQPdewMnUU8i
-9pcowyazIAHnM7RPyDd5lJCVYol3NFmga/xdR2J4tzTgism9uSAcDzm5haQWI4Gf
-JqITzsTGKI412WiCwkQTTVQ21r3Bqtvv8II6FX4rufx4+Yxel98r63JcRHqEXekX
-uLw869fO0p/QgI16aQc64355a8uk77Vb+8zHZLGVJYxQrC7ifSxwHao7JOfvZr8n
-AvZQzD8ElVJpRMSPib3c/J645zcWO5Jb7tybjS2Jki2SZ+deIr+ZeiN9rOHwUqWY
-9J6hdUHAdSq0k3EC0ZNAnZ0Te0h31sBV9PJ+XvGojwWExL3PSfRvptMq/Qp451xP
-V78eroPTPuFEhs41kgf+GOryaNyiLf6i+0+oGDBvAu9/nqey+X7jaPYNZGObm89K
-oVahczAX7sWtVza3tKA4GpNosKD6kvhAob6bYjzYW3hdiDwfotQinYX1nHjWaVHb
-hcDlnYi4YedwLzL1kncZ/JQAoLwCPW4ja02VCN6NaTzPXbXMtNvGAJ9IBx1qXxRY
-x8eFsL1d9kVuIT0J+g==
-=R3ET
------END PGP PUBLIC KEY BLOCK-----
-pub   4096R/39FF092C 2010-01-19
-      Key fingerprint = 5B51 81C2 C0AB 13E5 9DA3  F7A3 EC58 2EB6 39FF 092C
-uid                  Jeff Trawick (CODE SIGNING KEY) <trawick@apache.org>
-sig 3        39FF092C 2010-01-19  Jeff Trawick (CODE SIGNING KEY) <trawick@apache.org>
-sub   4096R/E4799D69 2010-01-19
-sig          39FF092C 2010-01-19  Jeff Trawick (CODE SIGNING KEY) <trawick@apache.org>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v2.0.14 (GNU/Linux)
-
-mQINBEtVvNgBEADNtkCqSEaFoGGAYR36TllgPuwMOfYbu7fubmVR1JDtozJrl4RI
-KAjkCTvybouecd+LFS2ta/RLn5tAUYfHrJYC/M9xpcAaBbMQgRkykZtfshcLIrzZ
-pnLmpQtuqauvYjAojHiO+2LI087vvF1tJHbL8Ui+pOjybYbMyQdmGOHggi95ct1I
-4fATHth2UWVsQZ5Uy2SpwNBgiVFcLKFW6ePeGhkJi962Ehu/7OJWgBlLq6EVn5Bh
-ZuOpHM8nlEsHnbmspZDMU5Wn/zHeq33MsWUxk/A0o2J6ifa3bMEpIW/dgNsE3DEJ
-szWll3+kmV01XIsyORy8NUTuUdpjmPQxK+JczORYO5JaZAhRMURIrlym8ISrltbc
-AbiDQQrKr8DxPpB5A4cQ0RVWxgePPldN/CSfW8HqIUYLShrLXuaq48+cntw+BNET
-8tyyeXaDVYvbyJNUJcIJbUjbO0tzB544EbCLZVxur2g4JlDSIP4WeO5NHuGIUnAT
-4Oy9EuCHSRfdjWvVtFcja2NTkznqOG9pkRRFU2RW5Q77eVP4qqZj2QKblqdz2aOT
-9VQU2Q+Y8V/SjN3XTPxYIrB9kTFOlx3tw6jB4kuNcFCEnw7t1REGWANBoT9g5aOd
-f5oCPhfhNN3UmTaRnRErUb1eA7y3D0IxNTzWxpY5thkf0UT5kbAiJC8sHQARAQAB
-tDRKZWZmIFRyYXdpY2sgKENPREUgU0lHTklORyBLRVkpIDx0cmF3aWNrQGFwYWNo
-ZS5vcmc+iQI3BBMBCgAhBQJLVbzYAhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheA
-AAoJEOxYLrY5/wksOZwQAIMiODkpgLXKVFWXyBbNWRA3GOM8HmM6lTOJYMxoPjF9
-urHN6NC71rHAN16YHu+WZyL40BAg0kZBtFYv1TNKNFy4e/GETD/JiHYoVA2hQGqM
-wWNDxREXtWySvkqpM+snkcLezeAaL7EPJhdLwkDSftrffOY0D3tR6Qwh66dfELvT
-/93wCm8eMPkNdK40p7iNl6YOwEqK1UBOfDyYSqcTn2xjYyXEyVlFIkKWTPIRlPmt
-1vQsiLlKMIzkSWa4foc60RC4jULD59DQT+M0Y1hME1a1gbVNBwliQ3uyVKUwtCPQ
-Gv5gLSb3Vy+37nLcpg8nL3X3EPXYTQTah6oaUhyFaBgsaGV5FVMV3f+dSQMcb9Tu
-PsDO1HJFy7MhKVP040oE27XTvSEjaF1gIP0g9VvimSN52JD98vsd50A62BlgNR88
-IH1U6oi8ndfDb4nVbiANOLwMgqMySvlt0NYMUglucMUBsNk39sJPqA13LQHBjuOS
-/vEQ7e02KfnDBbSVIt0RKQMOlA2F5aDxc9zGHDyphNFvY+EMEeXSQ+akg02eW1A8
-qjCcZqOFC+cHdHRaJ1OaNAHlhwXbQmZOnIDtYNAn+Cmu0lUaZ8pzTutCHmUqyIMX
-YiLQ7dtnro+IM7d/dumcB1Yf/QiESJwGYV25FXk6KZK4FTU7kE75LVjbeQDKazfR
-uQINBEtVvNgBEACz3jqVi+aTqq+DCxTg+uBOj2Da9clD/e6DQ3xiyWczAmc9nbWY
-42K/hT/kQ4x+WGR2N70A0eEJxnpf6nT+FaVf4xVj8wtcheVJPHnSKXMst8jmpePv
-EyUjQ+7bhxdz5orznunB+VEgVCLMHo2nOHzsxIDA+BKSxm97Yw8DFh7aXyRiZc2G
-+5Wu8PcpD4G62SX603hwSi5NZVrMKxqUPtStqoSoqQmei0U331q8kjCZrBLBH4C2
-mvZdLSBHv1vQOwDr+2/4nCd2AR4Ehkvmg21c6WComXBZI0cXTXHH0307RQK9Mb5u
-zmm4luY47CoYf2wQtK08fmqvmXZaxYVvw0oFCy1m2AV8Mjrqt+kEjgMG2duqDxD0
-/Mm+fDyTy6BVqxAdXFIYkJh1cIinyBVClPUGJnI9nYNOPm+NvKJZtqiGoPQ+B61r
-H3FBGTLlF1QSQFopgKM+sk0qBpJqFZv1vKtuhmE+dREgYKJHAfafGAmdOV/btdgm
-sYNcNWiNwVRKU33hEfhxXgrYc65WBip7On91ZvKgeVQAXOD0oWdc/3YqewoeS6Xf
-TodA1drvU0nOIy6qhq8UR03ACrnIapFcYP/UfEanl1fAeW/T9oYWDHXzuVEz52fd
-xM+8h5SJbEB6PQpqq8wvdzech39R8catBvMTnkndeO6OvRq+Q6g3d5sY1wARAQAB
-iQIfBBgBCgAJBQJLVbzYAhsMAAoJEOxYLrY5/wks7AIQAIFIRdVv80ONrKdhC+7q
-pl4y/G3MO8COktIWOwZF82ThlYA5v8C7EPFuKvd++TLhoV7iqVRfCh+EdNV4QcKG
-QbMVlq5ebuA2yHXZDfYzzOeU2p9sCkfETIXsZj9kwhtnzCYrGNbTcOGNnA6S7xjB
-YGcpXI/NOGSp5XgLt7j4uFFT70VAy/kGaqDjTwLI2w8HY+d8J7S46M2Xms2f4XuY
-RQqf+rwk3VCRhnkjFJfLUB0aEQtK2dlHO5eA9uN9Q12mNvVICbImOywoGPHD/bk2
-W8waBHTGsjqOBs6V94BUCAbjMCNkx5YHMfq0654BpwmLxn/cXAuzrJaCvNSSXml1
-/2INF9aeGi7cI6ShErY66B+cFr59Jf6HNaduTt+o6CDy9mt8PJhtd5G/mD0UVYWf
-p3S0qb69KutBenWC94uSoRi5lduclNQkZttqFSl6qpzm6IWlMT7J38XZXzfYPVdR
-tXnIuuJhf5MM6+sasTwnRSXgpdlTnQGlWO+oISJWQiR9ZUUs0gc7thQr7qVs4PIQ
-A72U4xqzjlTZWwWyxqhiiFRrFk2ACpg3mvnvqErNxJYUvE7YJQqBL5WKOTBbOyVv
-mFpbUjf8M8vIvxfmaXDyDkpOX1dmSGLG9gQTGuq7MBKh+UTSMaS25JDHKHuAhEs2
-hTA/zcAcwy7UE0ycrzubKC3E
-=f1ck
------END PGP PUBLIC KEY BLOCK-----
-pub   4096R/791485A8 2010-11-04
-      Key fingerprint = A93D 62EC C3C8 EA12 DB22  0EC9 34EA 76E6 7914 85A8
-uid                  Jim Jagielski (Release Signing Key) <jim@apache.org>
-sig 3        791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
-sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
-uid                  Jim Jagielski <jim@jaguNET.com>
-sig 3        791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
-sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
-uid                  Jim Jagielski <jim@jimjag.com>
-sig 3        791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
-sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
-sub   4096R/9B6D9BF7 2010-11-04
-sig          791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v2.0.16 (Darwin)
-
-mQINBEzSCGYBEADM35SrGvF8jjtPHoVtoU3LKaFqqYInTOKiGeBxkCReGSQrUL+g
-nvEqs69xSnHffHY8MwjsJY/k0zaegHgivWW3fjiA53oFnu6yTl30PeNN+l5QS7kR
-zWk1mHL+Hl1FV9Rorso1lQrokTYBxkE6g/1F36QNmgn3ckdyXV3t98WI+elj4Uf2
-uQkc9W/sozfI6iEzmZVfViULARS219uMYT3obC7RE6yVDIsYwByO1fXxeLSCnzNs
-POBRGuqgkY46o4Lbb2EMCAYC5/pxiAtV6pGqDa5izZ9Wt5rQEsnGdBaa95cZcLAg
-MiTXuE9bXjMcHsWR+38rgfGZ/4RVYs3R3NpspnnONRawCZAdwHX5Ns5WdBEZv8/g
-Q62LBm4r9x0UkkfA32m5vAt7VhE95RHfJH7suN7eoC6wdXRKzuy+sPt7OHBKWmKJ
-k4Ve6oGxosI7zur/LKYafyQtdzp/KNpPTfxcAAs0GZnFmAtk9g6044aNPZ8BpPqN
-UY928g+WI4OhEfb42W0DiVfONvZGR06buNhdbNwaqdPeefCjErFSblLitSlUzvYb
-n2YjDP2WySP0xFjIfkcaUjkv74kVQVD9haWdQJF0qukuAR3YzDr5djXhkHv1x3WQ
-trC95tOaH2ZCB5K6NMZra2t9I3i9bOYYMLhq4cRCIazzI0FNsVaOuPUZ4wARAQAB
-tDRKaW0gSmFnaWVsc2tpIChSZWxlYXNlIFNpZ25pbmcgS2V5KSA8amltQGFwYWNo
-ZS5vcmc+iQI6BBMBCgAkAhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJM0gpi
-AhkBAAoJEDTqduZ5FIWom/AQAKqOyCOLUHQPif9BlYF/TrCutkE1q03xIVsOLv6t
-sefueqHIa9pa4Cg+5AWHO9HwmCrOmJijC34Zu1CW8fKy/ClGS2DY6vcsZ22MrSo6
-FkgcDqk+X9aqx38G3MKpOb416JEENwSS7WQK6j+C+BefoS7aqYarsD6TdSReVHO9
-y+ksbKVMRhgxj3yQZ1fPYSZLWGCyl/VQGDG92l0LsaCw+di8DKOM7lOY9vRfuQIV
-rqu3dyY8cgvnux156kqKJOfOCHa6GMl9NiUDQpWCWCuYRBm5RsNIRD7S4nRz2K8M
-obfgwY75rW4iayAEfbLznbtzarMDS8yl0UIuAVEHJtIZ2oCnpcptv0dHD+zkMHW9
-eNmZBaHz57buHla0VmEFT3DImAq6eRYveI1pDE0YCp6IjgYd0rysz232lkbMCZOP
-wnOwp7UbSOqX9Pfiyct7iEZXMH71QBpNr6sKKHcfwUPQ2Qmd+hmmj9aFbYCmbiP1
-DrQU8uqqmQx241tpMgu40c9v+ym55ZS8DEgtFrsvQ2xhud2gYlx29kKhfMWmhf9K
-M3U1hibkY9V31IsgpbLkXGg1dny2dzzzUih5gIViScs4kC100SurlLQQCROWQtTl
-RmkZAU33IYucwJW75iuv5gxyZkOsD29QXNSHGEUe0BooakzrnKlhriuzvaGXKhRF
-JYosiEYEEBEKAAYFAkzSCcAACgkQizpgHwjJdeVlSgCePJsV6CDpUawSxj0/ceuB
-Ht1u2vUAoOc7vAkh3ihIjKpbf7XU/XnDf2NYiQIcBBABAgAGBQJM0sMzAAoJEJu4
-Y7D1G7iKnBYP/3aYH+gw1dmAV+/ytfaEFioFpkB5v4nMUDrZnlnM1xSLsxSsqyWx
-rxDpvGVf7VN9bMrXm1oKXBwnpnrdXvBeaHmH7cIjpN7sp8L1QQ2g+6B9Vml3DQmS
-VWnX8YwiFYPfVEpLvlIGlA9lc+n1JfAPsxH3qb+L+g+4qUW3LAvGNTi63t9rjT8g
-RYzWFcYBTruLdT2MdXIYpVGCdYvM2+QwLFcSsgNaK6LHuF5gW9lPz8fAVkgJ6M0g
-cFQK/AiKaFIicX8bGIQX3YCdo2gaE76CbJiICN6h32AnlukwISeYkfmEHl7VOx6q
-qIY7jjmP9p9Cmv5qQGy7UhwXFko5dBHvaG9Ac6N/FskXxBt87+TEort4ghcHPSa2
-EV355h0kRPeChOfTjTHHZi7RfS+YVOoaQVPyxe79GHX5La4lQn81uylrU99Sow+2
-QNuB61exOPyHgT/QBXDZ/0fucUW36uEKT4YSFAHV9lGpGywwLkKqyHNA3VGGf3Xc
-+FpOzlxlfD/TYzPklbPiOddznGFa3gTsoNHvHjaG0XbA6coErCuchF3zDVVtBZ1f
-f3HdYH9m7NoRHcoUVqj00lixJ8PqMyS1CzXJ9fFRo5G1LB80CkPryY1rW9+IewoA
-2fKAuE0GWtQbVR8+I0KjOv0kOzMzA2exZ+cYME6sK2I9bfEJCXLAQFdTiQIcBBAB
-CgAGBQJM1t6BAAoJEJrilv0C6fZbyxIP/jvJ6wNcj1ko/mZpJTsIkXxOJxc9JF5e
-5aCl8rpoXubmWB6zDZKoiJ1Jwl0pxVKRfiHwlP5NO5jne6Njj6xia6rBcHkh0o7f
-5JMDNSVehej97y9jc2dX1+kNmzf9eJZTeE8CUqBELY673L/dITg1eOgmwbvFZ50t
-Tc+PnP5eHTlXRcIdb3mRVHmwjlvFVb4fxy9DEkDOUK3ZsKpWUMl2a5XUURwKOwGW
-sQ+9CwHd3reSSI8GEtutQTZTc1XTTbukYRYjyHpY9nRWE7+dd5jgv6Jv184Za5bR
-CtILNmYjgJFtb2/5djLNErAIpGIg31+sABq8D1whe/AQhq9duTkc0+sNQdP9Abc9
-FkTeat3vFk7D+L1YFMY6Q1EcM97SbsBTf/I4Grm7ndNGEBHgi2RN9CxToTpPzkzG
-Uz2soE8ccB6aInbPldbxmwarZ8WZbMNC0hLa4PKmFfD6ptP4cDkY+F+qQLV1h1bo
-4Ccse/dDXfE4h0j23+uowGvT0ZXU9Uq2cpaij+9Y3clMVgly5aHDYv7a7CXznMO8
-fjyh3ZcQOjvNEusRPH2c5akiOYWF+xz7cqvzL+CI4SX43NFK9A/lSnJiFfMzus34
-nqydBsJLYCOx0CZAz+aLwkxFJzcmre3Qv/8Grnw3gQfGBHa/OPiHKQ4zIZncVYqI
-y7UHY0KiTZVuiQIcBBABCgAGBQJM1wKOAAoJENIc0iPujg3VOTcP+gKPRPv+Gbs/
-X/8x3G7rwIuo14+1xKBJZco8kmSGWEpos/DKPo9Aw5Gcgz6gOlh2EVWyGjwaoXdE
-mhPLOhyTf7EVbUuIpmLZGoA4AAR4OnJRxGjmwTCkPoUZ+U8lzSG6VpSRmmTOylZV
-Hs6kmaRzvC0puxAdUEYL21IbQyLODXR0k3DmjY3LLssPMPiXuT428HVvCiJdPu0s
-b3jEViA65E7cipu1nF0PJBUBNAqVMHyydXT/yXKxHVLCJOHWeD3ZUzorxRc0e+Vj
-PfVtaY/nR1GDLKm3AtUDYZNXIB4YfYpwtulrlfNv+ia60ejAQZDyjx+eG0r+cw7v
-L8WwrAZLC5NitH6I8xESKzdJ8sTGnfVdexMsUvwvFPBJ3jNoxZI8my35BK/snap3
-eBDj2sNU8tE0R0L09QpytwMQorqRFha86kcrmsPB6po83za3xoli7GiI6P6pW64W
-2X8d1sLLUM7BcPyWYZ/Ps7chnHb4eRUVHuAuDG/v7GNzHzFWEbCV+/lTjCXCVnRL
-VOfwkMjWi2HN/GifrDVEiXyqGW2uGpLT05a1ppNu8fMvNwqzIm3If5o9wqdU0Pjf
-mFWRKILqoXuE9nWdtfXrAMBK3t1nV/HuMVrwuvMIPo2yPTxb2oHlrsqY9HuWYugm
-5TIo/bbUGHduo2VAKOoYmk6Hg8a6h7WCtB9KaW0gSmFnaWVsc2tpIDxqaW1AamFn
-dU5FVC5jb20+iQI3BBMBCgAhBQJM0gjBAhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4B
-AheAAAoJEDTqduZ5FIWoA80P/18XFs37N7+D8VFB8NsU3kBTvh9UZx2x+ZGcHIH0
-MnEgzACcoOsSSFdcOwgkc2gVGBEgynM1HSmSgtSpxPGrW1UzmKRN5hN9bq/B6hyi
-7xAEFyMiOUcTobH85eSAbFuxv1Gb6PbKtnlcZWx5YNlAOi+7OBD2g5lAA7waT5sM
-DisxOlgkTYvzn2ouOwnQ2RG8I+qd/htswvgo1wI7GZJcnf9ZFn4ejsJmXoTmC6+Q
-J7iI2K/YbSCs/tGy9yowTx0QRO4cOF2Wa2bo33ALCSaNjMOEsu3TTDMCdV/1T6Ys
-6ppxfKbT5/bOhWpfGye+mCArMrV1gr9ydo9WcGXkbDWeg+3j+hpsUGmp809fzono
-ziZb10TRIa7C9sY+Np+WHPNgZ31RHLY6RWXweqBjkDOPcJyD/tnC6sRugY/CDuRV
-eWxfKgUKHaVNLj7XxCTWazxZVT55WFvvNknugSjjp2FKlnHb3lR/KtIUp6YLvSIr
-VgdyDAbXW2CV1kamuFrA35bAazXsyvEXye+P8B+lA/pd0achXqxzIlBj0tKNob4u
-gCQ3AN/E6Pivjg+o/N+8Uzwiu45yKvuUGmtnKJQTdNF/+5E6QYm95c26VpMYxhq6
-CEISO+GhJnbPB8ND19AUEoNGrvRROE4FsiGNpUWN4/KPW2Pc+mt8Q/yqOnWQM1GQ
-xznxiEYEEBEKAAYFAkzSChoACgkQizpgHwjJdeXSpQCgp3af5lJ3s12S9jF9Ipdp
-zwVnkPIAoOJEjS3pAs9uuGdImfYzGKc7c8f4iQIcBBABAgAGBQJM0sMzAAoJEJu4
-Y7D1G7iKse4P/ipNLcumGrfCuRk2jpUChmhIc51wdJGeTF3+GPkXYjEckX2nWTqg
-KElf0yPfaU8XMqzLnp13tCYg8a8XE/MZR0O6byIbQ3ODr/WASQZ+xhMawSmSiMEu
-EWX/VKs2+4hhDaVbC7PluVXoOLz4sgSIU1/QxJoarD8rqIWYZFoS4mp/rlAkiNsw
-mM2xeA6sqUTj9hSRQJeqnLI7B5eN2VCB+yooeY8k4AraG8XGJCHwcJprksIPqi4R
-EzaE6VNrtA59GKFK37z7kA1//yBm0kCoqkCkC8LFYDEnQhQXdZrZL7zHLQRP9hNG
-3CxnKUkD1HzRYNxRemC5Mmvxfj6xCRtBI6bhlNUpKzYWqfslXvVXPy+diJLhbXj9
-u5I2W5AKMlgO00Eg4JRp9WcvOqsVaVD4Tlet8uuIIeLuC28l3w8fjm7TCrHjcjN5
-CH0QWH0nRTNaIR2ogFvIwYAsR9rIN4qJzNy9crYLJEJwcVgTh3tVW4qr8jn7sjVt
-MeF3JIZIDGGE/b4ZSeceTdaJ5QsFoXmRT0SEFyRtbT8pE8WhNma7Jl0d2/b/qLV8
-H8n32AKoByuV1Vd3HOaT3XN1yACren64JCqZZCyNNRWa9Wu2fEH428nYjcqMCZQw
-PuPyRNQsPnvU1fNHzmPEkA3UtVYwsKtFxnUmCfo30klOhzPTZrl4L1I7iQIcBBAB
-CgAGBQJM1t6BAAoJEJrilv0C6fZbNrIQAIX1DqlW7CAI6irpaPq+l5s22nBolPce
-MLMhHPgp/vB7JqV6wMDUc33aFDCkDuSFewDQKaf1BSaAQHWCxRfVSkgY/YqBx4vJ
-xE24M9ljvH/PEDruCHAem5Aij7TWmPFTKGhV1h4Rt9CWWvSxZQaNFQgUxq+W7HwO
-gIxugYiNz7NKt8mdzl/48S4rSf0mvsQ55Z2xM+GMrYMQqAcunIiLNGoaXk6z+B5k
-Qmm8T9UnR8cegG6AxIvcFm23KahUWjIYfhLFa/Xeg4ddVwaeN6lhwLOwmzEh9qeg
-gOTreZvh/5i7Wwk/LbnRElm/ejkj62p7sxE7RzRNGdWagTRbZO6rfEZQYNoWNnej
-jjG0MP2YIXNMEZ8LmLF+r0RWJMzVoLHsTxSD7c4vSNjhERuPgG2XM/OsxX8KN/Zb
-Eo/dn2I9vQ7Oa27E7hGvHGzlj+UR3yTdoSoao3gJs9GDqwdyRwFLALMzwRmp1z3r
-/4CTowRsebJI9G/G1U+fGJig8RupFnSrh7vMRMsp5JHQ/+aC21UcJ1jk+6P76wJR
-BCSYg5gLdMvkK8SxmPGbDD4PrQP2ZkqQjl+ivh9IXKnjle1QgnOWebRMV9LXc8dv
-WfEawbavR8bmu9CHZeAqfHFSaflU3A82fX3d+3Pnvq/zQVddJRnUMFju2lxPgsFu
-Skzw/eotq+xqiQIcBBABCgAGBQJM1wKOAAoJENIc0iPujg3VGS0QAJRIkubc5Uca
-otfdf3fDQwoc8+hN1hMjV5spdQOl8W6dC3fskVoVL/OJ0rCXLFeCCciB2CrXdVMF
-xNVDfLisYSY9pvKd+Oku9eMK1ncC/D7Sm3XXMHShAUqnCA/dFhIyY1LEDL03qqTW
-PjmCXFO45jA0pGwlbpT92GVxOui8sUL/YFZQ1Z1mQTpiiZj/qsScivI8P++PMOqu
-IzuXgK1qGhuHS+DnuxKo5xDvVvOfiPhLW0A0EcjmZ94hedCxCkN8JpzdGOnM/WEI
-X1RNvUML4nqz3CK0CGQfzpttb7PmNDYprw8td99Z3rK79CA9CdhRA1sREnNxfeWd
-L/+8EyBm6zHHNwA+kwMCFx8iDeDF86bcia0WQiOihFW23yT4J8XtzrNcMMdaduOy
-f6MupTn6eNlsQDOCm1kLFffkCnrUStS8NB7yhOQhGfEJbllHeq3esgoA1ivSpp41
-mtDdrlE9m/MFilrrvv8VNAaTZqptqJIASRIE3b03SVskqcgzTId0V6AkpvzKArrS
-2ratHqDE4Z3Kv5Mo69nq9iju+WvRF2dY2XY2z4otX82byFIsqP4kaKTuhfBXKwW9
-SCFWANj2wwbFtoOngjbLZPXS3d1tgVokPDpJfgGEEDgMIyyabN/BJ3By/EJn9GiA
-m/UKO72aI4Hk/0RfGi+mYyJRO83Zrt/AtB5KaW0gSmFnaWVsc2tpIDxqaW1Aamlt
-amFnLmNvbT6JAjcEEwEKACEFAkzSCNsCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgEC
-F4AACgkQNOp25nkUhajI9hAAuSZHbMznyoM0ANPP2bTkkFwT9WkdB33Tdbs+5893
-sDnq59xT4Z80JcXzH3WFtQ76J4GYtU87DpGZUsYt8EZOo+rGUySGDOw7BbaNR9vq
-pMrH2ZMJFAx1GsL22csHhXOiZNdvoL3Ns7k7ni3/dcJpVp5RUFgWyBUyybymAE0X
-kv1ER8sPha/aZvbQg5Xr0pKKA+mU3G/1KEC0prVsb7j6U2BoZGfP/5Svk22ZrCqT
-uImBXVNu+Mz+7LjZKnityc6ZTx2pFiJMPBI1XiXO40ix7ctyMM+QtKUPkSnGsJn3
-JPasomIL6SrDjAVHu1HdnqAYUWvjc038rj+/ntuvqoH7NYZDvA7sFcZjZyhSt2ci
-46G9aCX7KZh7JH4pMG028E80jDofWSFxHxXVHo7ERBghKRhkjj1lAwdnrT3lTED7
-TX0oJbFwAT6h1+rjWJOOGlQpFPQ5+0LkcyTiq9790agphfm8RF4oVqTaCFdbltr6
-s1a6Va0H2z68Rp7wAs0jmjEZoMC9G06BsWqXb8/RwtsOhDfQqdevnEyk6ejecX+0
-YaA1Y7jVvfiho3nCHVBKO2UVpv3TpEShnVug/hl0oY9UZIsGe41JMp88CL2MJZt0
-HUvbSFOrNNdzSpi1jOaJ/UkWcC4kIUTUqwomD1hz8adqUUhR/dMWUXevHvdoF7lu
-95iIRgQQEQoABgUCTNIJ/gAKCRCLOmAfCMl15R6vAJoCZeiA1glNhoaQIcQlzKBt
-aSTN8wCgvfk6xZ1+PYU2b0pmBS14mg4DYHWJAhwEEAECAAYFAkzSwzMACgkQm7hj
-sPUbuIpeChAAwxvkZYeJME3ox3WKbqYb54PeKKB+J9dSHQs3bvu2yWq0+pMUEmx6
-tdAPjP0VgGvjulfy2VrM4wUgBJ4CzPAM0KRsRiYE7C3cLQ2D3Uj35r4ws+UfkD4Z
-DKoCMPKcfSOVFiv706JgJojIgaDJqYMn2b7y3HkA2yGuPQ0kWG9HxuOjdrbLB64y
-ipkukAXFWcYskUcEgQfU19mmYHIKErjXPCc3AV2TCYdd6zgj3WpJ6aBd+dxJ456C
-OvlIVx+AlCb0LhnQJtfU0B1lhSwU+eqbMN6ttkNgkxAtkBz7hAM7rQQvOAhrOhTn
-FQakkqhOj1bEp1ofwi+EfPjv2162a149cavWCbsPnxvjlhbAkHq/upk+a9glSELP
-7M9U4W04e/kFGQh3QaMxw829cc9tmysHxmKi79btfLNJMEzwzXhRsY1uoJ+MkCA9
-GIzOzFC+VzGcEPWXwFUszozj7wTTBwdd9FaF75pJ6SZ01cIrCv9agUnYHST62nYF
-Kwy7gtBm9eVLSjUA2l/avp99GVexdKy+HfWVgOP/d90UZgX6gsnemB1C2u0LjNQr
-cfm7+8EsgekJNZqOdQqqHwJYEV2BHu3YXNAlFYCvROd/+ffqLhbgH2QMD6zOhBZ8
-MCN0KjC+WrGsN1F3jfNN5iETymZu3icu+aSBO55czPQgcFa4JgPoKyqJAhwEEAEK
-AAYFAkzW3oEACgkQmuKW/QLp9lvPvg/+J58Vek+EyGg3u7pACHDru4UilxwLcnUU
-Ywip+xCWmyHYjVRxyenkUgHAu1O3yDuFNf2tKW4cFCZ8KVhpsOiz6EKQHHitwh5R
-2vh7gT+4lcOJSiMOq5yrGvJlVdsqf6HjDielzPBS6ByVblqsl2GoiP6tw41nenYM
-5jDWpvRnO53qp/bOmlAGP6ej8WJOtF2dlr1rDmz4+XGh7NqvytWYu2GLPKSx5PCA
-7e+vdwEvuE1MdwJQ81izI/0HXL39jqw5fKUyci+cs07dTUrzXftm3qE0j6+H/y/1
-rK2QY7xqBsQUsGRV+tYSPFaahQFF+QxF+SfQRhjo2BXJkiw2Q8hcN9TKEzdY3Ngi
-LH06G4nVOC4YmRIeMsdPfQSUQLPgpWfjzB9Twf3gNIyN78vfu4gB3AQlcpuAgGVe
-4xAZwjrbUJVSVLa27C5ZS0vlU0Kl79KLRmj30UBt6DjrGrj4IZduzUyvJ2+L+hp/
-LzOEJIjyzdfpLhoLfeb/ceMY6OXt/lqLLSgdeU84uOdpQM82LvVfKUqkcJEribhS
-N+CpV/1xsWmoDihCS79w7OsaJxmMu7a9ksxJsuKxmFABMOaZ4lhdU5T8NaYXCpuH
-ti0aKFFWqdDu2sYUUAmMpj1pW+K2bFl4qwKUvsi8xbWlzBlR8vOtTJAnYEC1ErR4
-QieuW7Myj+eJAhwEEAEKAAYFAkzXAo4ACgkQ0hzSI+6ODdWmvxAAgrvSD8lIIVyp
-NvKNWKXjIMLIlUqcH5I4SmKcixB6UL80j2+z17WT6wcvvgV54uM49yTa8KLpBBwB
-d8a1WfsWyVQNZV7RiwSnl/WwNua/rv/krKlVmDvcKIcwgJiBTkc0jYcrMwKg07S3
-zla6mg/nhwlfNhdeKDLHG7CMNhNmLxmwTtoUfFMW8sxVATcX73eHBAhpHMDAbXzA
-xVdyTS5i4eO7vXddBq2sKIEecXZ8r1eqNsCR0VhNEbh8o2bKwt3sZYqVdI/eaEiS
-25sWzx+lCXKYycxOfBcQJKTle6NShTNa9bPq2cUiYJPZNAgd7lGdOoPYD5DqjIFL
-z6TcqW4PWNjnZkiamyue9lbI99whCUkemnRDM+tIS/0N76FN7ROom9Sxm5+vL6Ei
-B5TXJe7gK4/CanENhSPO5h2MtD5EiFV+ALv6eQzjG+VuBh7GfZPR1wX2hhOkhbBd
-p0aQITE5X8EfkLbYwvDCkKFVXknc+XfbAqczCoLIT+MC+TQPVRwiZoOhjA7Oh0mn
-Q9keDiWfkMpMFDeu6+l3Im2xYDNzCTdSPlGLOZt15tUIonw55gOf88ScMPP7ri2A
-cGxHP6fpgB8KRqjiMrEkuqDWJ26Q6/4K4CxMt4zC7F0PZNDjsJfMFrgBBOnGeEzZ
-3uwBU/OPixA2toAFaryvY84tEFOAqCS5Ag0ETNII5QEQAO1cyflVhAw/kl1NI9ZS
-GfcFmulOt9hM6PyKihstoppuLWdMWZ2OY7ZEnS2Ots6kkZ4GY4ak/p19sDHlC6O4
-x/dlYMLcbd8kpIE0naTshCRCuPPVwiiXCtlp6odemYpxgDgGCnEJ7NaW4AeauNUN
-R2VrTS76htpuMvgGydqmZ7RHGtwTRp9QYniRkvoO3Yf06E0YSpFv9r729h7gE26y
-bjCzlKHqYek5GgWlD2zeW9Dj/6y792sasQ0mYbp1Z4hR7/jFXfXq5LgTJUUDypRY
-Emzg34nnRYwRtRsi0+Gahpfxzph3Pw2r/OSrNV6N9/1mtN2pB1UpwxbrFgSw6A/W
-6004LXX0OR5ZazKYgwpmiQqF1hYjIijQr6ej4Kzk+lHglz+F78U4Oa1XVlpX52lS
-7Cxze2pKhg44TybpzeivmvPPuC5kY6SBk+JFWi+YOR79CaJG2fH74DIJJsqoBeHU
-FsS/IyFs7aO348ySyz7AUgn/yUopH/B1re6fMqtfxJez6ZFn0ZUbB5oZg4F4sPBz
-YJLPhmqItqTISaaUGVoiD3GLxEVV9DeqWevsWmt+RlnyV+R6OZuZ1YR6usYNLbEU
-1PY5VgAjgri+/GS6ujwXDbo78kZU/RVqTA6f2Ns19Zmcyw/P2zdCLy691gm7Fzke
-+zGrreMscTP7mcPz7LlhtI0BABEBAAGJAh8EGAEKAAkFAkzSCOUCGwwACgkQNOp2
-5nkUhaj0ARAApkyrWmGDwiUC4Y/0vzjH18pJt/MlPv+4YC9YtW0hgqjWrWzaWh4H
-LP1CkQUUAzZHm6x9bM/AKq1y4j7uSoeH5kFrZJxIM3ikzbw5MI+ZjWlGjGjaaVRL
-rrD3i06P3FrQvpvNSfs7imggenLVgiVSaumzIHVN2VDLjQycUTXlYInyXJZuTdMl
-5SWrHdBxKmaWXp0HTbuKDEDRDj6IQUaf+FaV/y2nSZl+XmjLaq+1SRDATVWlASaJ
-/YDSU0JVtp4IMtpzifhiP/AdgCx87/QpwT6zNfX4WHEF01scSjfC2ahl1+sH5S+s
-h+fDQd7ApuWCVfkRKJ2/tn05jg5qkSSxp4hRCYDr3eDdhYMzatFzKulfFhusWBPt
-SuqYp2B3KM7Gs/cjJ9gE79TDcSIdT2tQxr1iR6aWbFP5tgijUjcOV3i/GQqZGRz3
-FHA26GvRHR9X4WOcxE7XfaCRbDcRBBOqiHWLI7pOzPPreoTeRWzUkZXEjhr0lyVP
-TC/AHoAenOjlxy1V+NEahyBQCT+WgLMgA+Kr0dZBLAz1E7U7FAcjOlLeNKSFaUMi
-G38f7S/D8UVWuHHd/G5skc1KIMHL/jnTS6q9o97SfmqmVZ24pKHKF0lM6UM2rRz8
-E/274DCVg+wK/pQiWn9O1zQQRh9KIJACgd71jF6z4RMaRUcvpYYaywc=
-=qdRu
------END PGP PUBLIC KEY BLOCK-----
-pub   4096R/6D5954FA 2009-11-17
-      Key fingerprint = 65B2 D44F E74B D5E3 DE3A  C3F0 8278 1DE4 6D59 54FA
-uid                  Eric Covener <covener@apache.org>
-sig 3        6D5954FA 2012-03-25  Eric Covener <covener@apache.org>
-sig          62B2963F 2010-11-04  Dan Poirier <dan@poirier.us>
-sig          7C408737 2010-11-04  Joseph Edward Bergmark (CODE SIGNING KEY) <bergmark@apache.org>
-sig          02E9F65B 2010-11-04  Luc Maisonobe <Luc.Maisonobe@c-s.fr>
-sig          D01E0E18 2010-11-16  Jean-Sebastien Delfino <jsdelfino@apache.org>
-sig          08C975E5 2010-11-04  Jim Jagielski <jim@apache.org>
-sig          F2F27A06 2010-12-30  Carsten Ziegeler (CODE SIGNING KEY) <cziegeler@apache.org>
-sig          4DCAA88F 2010-11-04  Thomas Dudziak (CODE SIGNING KEY) <tomdz@apache.org>
-sig          1824BDC1 2010-11-11  Brett Porter (Release Signing Key) <brett@apache.org>
-sig          82A7FBCD 2010-11-04  Antoine Levy-Lambert (CODE SIGNING KEY) <antoine@apache.org>
-sig          7C408737 2010-11-04  Joseph Edward Bergmark (CODE SIGNING KEY) <bergmark@apache.org>
-sig          791485A8 2010-11-04  Jim Jagielski (Release Signing Key) <jim@apache.org>
-sig          F51BB88A 2010-11-04  Sander Temme <sander@temme.net>
-sig          D84E41AE 2010-11-04  Nick Burch <nick@gagravarr.org>
-uid                  Eric Covener <ecovener@us.ibm.com>
-sig 3        6D5954FA 2012-03-25  Eric Covener <covener@apache.org>
-sub   4096R/2B4C4B38 2009-11-17
-sig          6D5954FA 2009-11-17  Eric Covener <covener@apache.org>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.11 (GNU/Linux)
-
-mQINBEsCKnYBEACb/ldlhkVPPopZa4HvQhckhpQCQBE105N6Q7IPpzq9djl4K9QH
-TVSOvnhTd0s3J+7bB08jsYbaN2xMLLLZxjGW+EsQppXIsrY6K0m/aJfAb7MtdgoM
-a/r9G5r04hQtRcc4ivMVHnFemM0A2sls56wUwVI9OHC2BPwBSoacTwSFOwwV4mSB
-XivBkRPfIFVk8iaH3G4Zc8/KxgoPXJxX6rQ3AZxx0ad7hh6FKGgNxgOKNTwkQoZn
-hj7edM0KlSkzQ8O9asRx27H/8Vv5oRP8tsy0VYSR/FPzny3cJfOhyw3px/mZSOhq
-loAOLtTqBkvyTC+888rfMJDlozWEKqNeallzTTBQ38Y6iSskNMihpp6RXAiStrYO
-oO/OlqBuSxXvplI3EWilIvEkzpzyWt/uiQnmclGSU6uhLMKby96QpfWOQaa9CIJQ
-liMth7eisGKci4z7lom0q//fPQpbKIqk0bhFZeQeld01Ozy+s0rhZA1CD0P/e4yk
-0nQVPPMih9wiYKvdr8lO+cLSt7Ugme1JX0l5jP3JyomiLPNEfyeWGpwO8d4YSSoF
-UVJctLKBw1UR3rCwladOcf1iriqtwOfpy3wPtrxByxU4jBIR0stcpIhkMs1Qfde0
-RT6POBpPlNrGBoiOXwAAQv8zqy/z7yiTDhYTvWqSx/J5rpkKdxvvg6l/KwARAQAB
-tCFFcmljIENvdmVuZXIgPGNvdmVuZXJAYXBhY2hlLm9yZz6JAjoEEwEKACQCGwMF
-CwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAk9vLA0CGQEACgkQgngd5G1ZVPoe8A//
-bxCqDeTMU5SGPVOGQHW7NHXUyc8CsxNPB8rHlyMiaU5UwvB7+uM7EWprJvpBqRQ/
-9rRIFfhFndKmbAjIjNbGNQjk6oTQo9kE2RE7XiOjWMAN86g1SrhwNrGkrxqH47n/
-NRiMvaN4VMkONJzwCPSAe6ek2p8stl66wquZZf4+H/fkwmH4aDQ0SSCv98HyI1xk
-xbjbKDgtBS2XMZzjYFtjP1+2goPCdcaLGo2knU/NI1x/yu7I3WBu1gqvNd20jplS
-3z3ROwUxs9T/ejsF5Zh+SkDOd8tyr2RwDUDuqVx1DLhuAXcTHzo2Lk9vnieJjzHx
-pnMMvP4g88edXYKa6GSwUbGM/cPJVzoOkFnemb1iEABN2v0fgIUXNnIWCESZiLMA
-Dac1wKI3xr7wo0q7G0s+8n0LF5mxDU7/tQXlxj5FvocfHKtygNwlar3c/DAH3q2Q
-bDjsmPC0CMnOs7dAaRxYSZUk9EqMmXMQguBDsA8rP82ygxBctDxeY5X9dB1bfZVN
-loUcPhOQm8QmQwiNHEJ52bDmM6NGigR8mR9Z8sNK8f263YHFAzfRLNVtuFEDuQNr
-B+ThWttBshtLivEGiKUOHTemg34H55O4QE0JPGYKfNjY8CagkefTfdv1rhwT8JF6
-n4KJrcF7DuKn4/5yw0fic6222v3nkhw7XZZg3iD0r96JAn0EEAECAGcFAkzSvhUh
-HERhbiBQb2lyaWVyIDxwb2lyaWVyQGFwYWNoZS5vcmc+IBxEYW4gUG9pcmllciA8
-cG9pcmllckBwb2JveC5jb20+HRxEYW4gUG9pcmllciA8ZGFuQHBvaXJpZXIudXM+
-AAoJEJz6KwFispY/oR4P/Rc1LC0eZ5u72JN+ttH49FVZvbmJa53C5377m2BRThdp
-K18H/soJdMADXN+pJQrdtOI5Ue0c5OtB9k6sCt6TN+/6mFH2Jepm99GQwBbuhfBw
-viOQjCi/tpLeYLPF4tOiSUQycTuDeopnS0zWRmXP0nllZN13UzwVf3/Zdzit9S2y
-/NyalyNp2n2Ec57guRxXpwx8JxK0eUveBV+5lGkXIcaLHohujdtnBISiJy1gPfNk
-xbVkeeLjw19pxCzjbQEvCWtQ5/+nn01U2CVO6z7sE+cVS4PzgnudADKlR04jgNno
-FXtCLaDg4oO3aZdZrHgOA7aGWmDsgzlcI7ZHuf1wQrVCnMyBkyp26U577jsfmeC0
-yPJarc0fABbVv5faMy7BJ77OjpglgjxYm0Arg7rUBDsb8WkjthSSQC/GdqzmE1t6
-eBxeTFoROZbZX2XAZjNSCRQBBD0aHUmw4VA+tUPSGvbh+J1nfg4FhUOhiOCCrDQR
-duKDZ2Wr2j+nQ+BK6RfS3rk7rZletqb2GCGnc/FM9PY5lwoFhztOu/RVrzGqpi2C
-oIVWxxpxZ7XY3RnLyV9WlTirz7EoI7eO7N057VdAhc+9KSxBy9Nte+CiFhGkRS4q
-wcOGrdlqW39+tMAQOdMltU7rPwzVKMaZRRRKOyp/4MORuk4Qo4gyRBadEsnc+uS4
-iQJdBBABAgBHBQJM0terQBxKb3NlcGggRWR3YXJkIEJlcmdtYXJrIChDT0RFIFNJ
-R05JTkcgS0VZKSA8YmVyZ21hcmtAYXBhY2hlLm9yZz4ACgkQsNmRtHxAhzeb3g/9
-Eix4HD4Jzb95gAbKLzoYgks/Ql+PJpYFdx+kbJ1gmgU3uuKPpaVZIZUIxw9nfk8M
-N4zqZkdjreUlGbfPlxQUN4lxIDoQyv6PMmVc0pxy1KZ899/yrhuzsTXadzIvrbyP
-vrWkEUFuawhuaIqU8Fy9Mw6PNlOznkaZsnqYoXD71LVTkv/k1msnGH79YPqfmdTk
-D/JgtV+nXCxVChNmBzHTMccV4n/WKPJZNCgDVXHpkuC4IxYDwds6TfMXR3KMACCn
-FSFnRGOJJhhwHjbK3ilsX4+raICeJd/gSuBTGkIlJ5jewYvngRwM6jr0zs2Nf7xb
-Ypx1pQYh8emkiy13bCgYm+xmIBEg1pnkk0wlqZ2pxH6Qv42PVubsm6CNFVeOGdnS
-SuYr5ulhuSTaG5iK2cddDadZscv/M2zySwORVMkJo3QLT8fp+3Vl9qd+MnnmOR+i
-UtO+ZDTLx4pLSE4tOk26PIG0SJALAUZHX7OviUykOZvKzMBUwg5TUnoBdyXupd+C
-L2GnPjZvmFLaZthKt/2WPK+bAxT5530dAjcGOJYdd881SuCUTy4IF9+qw2WrsKJa
-TNRZtPKlhtybaF2ylTpVkH5SJntm43mXuldcHbMyf/ZaAW1e+5pQiHdKyw4ZNkWw
-nla4zFjkFOeLRvmX2om7L12oc+OaW16HM9UZxhe1ymaJAhwEEAEKAAYFAkzSngYA
-CgkQmuKW/QLp9lt72Q//coD/XlxKxYC4z2/b6iALiAoM1IUHbrIf7D9v5MFfjU/D
-iEl7wRtsvCsTPGYELs5sbh2QUcgu/FTD4UhMS2e1oO4NUfB4n7wjz2/g16IRR1dE
-6U6M6xpsgMA1y+MtrMOVShjcQPwTleFvlnPq0KRSemtqoZ3f3r+l7Zg+KxCxIUCi
-r5TP4HBO1vYIPIkNnnxcumVqU5qs6QUuZbfCsAQjd5b0UksiOrgxNM9TgZVBrd2o
-s+hS9osarxtDVpMlcDjtQf5+hyMEm6Ao4pCxyua/sTNFEH+BxmVYHgDaSompVNUE
-vAkYDcuJAUPbjU+BHnokhx/h0eQDROjgl96VNA2EyBKPuClrdPslxQeK8IcD4rHO
-SWMjtxPTw8dT2JSJGfUPYpQ7d9qYraJaESu+rzpFQhVzTnFSdqsnlqtzjoXRfNe+
-aMEt6fgvm36lzfsgLWfrsGUdQJ6cma2+B5osI3vB3PQUZ/0HGoEW1nQM/3RUsnb2
-95dB3A3bzhJDrtGthhg84ztxBnj9WnVllb8CXPpTLJmS1ZWeqgdpIX4lkSYdS1OL
-CvJWIYurZ4TC0EKFQ3nScnU0tXLsS9cnjpqQVH5cZU8kZU8cOIlmG9GhYqQjGGPz
-BsBXJ/NcGCJLgYmK6ks6btdvPrOeez6G3HNQPI6e6i0X+n5XGWBUkHdv7FL1mSCI
-dQQQEQIANQUCTOJSoi4cSmVhbi1TZWJhc3RpZW4gRGVsZmlubyA8anNkZWxmaW5v
-QGFwYWNoZS5vcmc+AAoJEKR9Hi3QHg4YtswAoIj238Jwspzp1VJ6jdF03OTym+uT
-AJ4+G5xZO8b00Yjnfx0YSyjFvOiCzIjKBBARAgCKBQJM0rRDHxxKaW0gSmFnaWVs
-c2tpIDxqaW1AYXBhY2hlLm9yZz4gHEppbSBKYWdpZWxza2kgPGppbUBqYWd1TkVU
-LmNvbT4fHEppbSBKYWdpZWxza2kgPGppbUBqaW1qYWcuY29tPiIcSmltIEphZ2ll
-bHNraSA8amltakBjb3ZhbGVudC5uZXQ+AAoJEIs6YB8IyXXlqTcAnRUlfUyIBr5K
-sisrAkeThmeA7gCXAKDo/DLtoAHtda8clNwhnsXxfUJ3U4kCHAQQAQoABgUCTRxN
-tgAKCRA/z1Kf8vJ6BnX9D/0cenA1sQ8jbmjEWOlp4G6mwuHlorD2UVWf/vpJjdbk
-HTQXPwdN7UtQiDlB6BMynKOoJzzbp9W8x3tBHgUL63LoehMtmUDzmy519quSIpzY
-S21SHPn1WukZSK3Q26gmNbr5spxeDJJsy9jPMLDiHbM7CVmjEyh+e0ms7L1nqXdo
-i7d/wBVakfor3MLnrGrpqWHCMnjRHgEKUSOQ3f/aH0kMIzo4G7+7i9/E/F5n64qL
-wGFB7odaOIUIRMiqGGUTQ5FWtNrUP3PZiUyYlyd2wK3uBVJf9eS4/6o6vGQ+VFRu
-h8L78OMsqEnDl0Fc+y2Nw0s0P3u2KBwvjnWerG8QDDs1SYsohhG6SDZiwT/4/ubQ
-8WaYptTZ77TgDdYKd+0Z5of0l816QIl1LX+nNcq7kVRnRbvz+chUecbe/7/cslka
-hx0MlwCRUAaxVEbUTaysRffsF54qneagDGHb4L3VqAN0iTKxbWVnRtemb7/wYNlU
-ri1NrYTY304oNHkCYdiByeddOBmGBb/pYRYaoXve8O2upaGCaWWwvBVjLtGgAScf
-dhuJxaLZ6zu0AWPKs6alqX7SAmYsY35NjvY4JZINM8JWdeMUyj3A2O0CpQGPIoso
-YNJM1I05ivDaakLpTjhX0bhxiYyxlgBQ/kRChKpmX6fPOvXu5LaMBb3EwUxq8Mld
-sokCUgQQAQIAPAUCTNLNqDUcVGhvbWFzIER1ZHppYWsgKENPREUgU0lHTklORyBL
-RVkpIDx0b21kekBhcGFjaGUub3JnPgAKCRDqTcrcTcqojxaSD/0V9cRKcomCfYr4
-8yPBt4TbOet0w9Rhq4sdwrRyisJEO+nRnTIwXTZ3WIDYhm2aISKODFa4RHedoxj9
-hdRbDAJuRIA+o9/MHlaA1MMVMUSWp4AoPh2ESqvq/krtrrbTXHa9xgQkL9B0uY5A
-amYf1Fqe2F00LpqlF4meDPQBSqH9AZtQhf6omRqoWy0jZk0EcgqaxpDBROke+aqi
-S1f78N2asNR2wkHsh2NOhEiSd3rsypHvm8DgrVBdUjn8+Tqs6qEKChC8FfRmScek
-H9+P1grd6rly9L6zcl1N4PAz2Om7jbwCgUfWoK7gZ9Cj9DJ/+H7NMhlh6ap6BBaW
-ZVduCZtGzTYxuJp4hSZOFi/BdzJG5BToIq0EUaRQbySTNGBOsZvP1u2zB4BH6D7T
-PxSztSRMkPcA7wyE3cqH8zxWofmxwIDUqgCb9/2fy+JAwUSvEV3fxXum3SB3rY2u
-7AY4s9LJkFuBWA/MmZbcfSTwtTpmPXUr54uLyDtRejO/aRCrleKZ0ZcZ7v69HPqh
-9RdNHyepaJBjWoo5yRS7qiy9yE3h22TeZcBLMe4Fm2m39LisHYNx5+w9ihgfeYtb
-wEePnRM0ZIf95Tn0VZo8XOZ5SHRJMDj5j9oHNxI0Qa+eLhhoXmcVsqNUaUnPYthY
-Nw8fd7ke/aoOubOC8ZabJKGdlGE2XIkCUwQQAQIAPQUCTNttQTYcQnJldHQgUG9y
-dGVyIChSZWxlYXNlIFNpZ25pbmcgS2V5KSA8YnJldHRAYXBhY2hlLm9yZz4ACgkQ
-4TYIihgkvcE+DBAAjiH/wW/C6Fj0fTUqKJGTCqdShYWudeJ84NCvnCwKGsBqk0Kn
-xzd4I5yhdf0YKTIuGk43KL+MsW+EkGQisQ5/zkufuhJAT20kOQ0cwEH9Z1GCmkfx
-Jtb2gH2dK3FAWbYLUCHxvko7XOerEaaJQu2P5xqct7Y21kpPGvNYlqnQh66iAp1E
-HmtkMHs6nfbCR562aDB8KhvPlC0DWjoKN0ll2+xCSfORY1aavWpiAmRFk+0Arrsn
-BgrZz0xpfVOZe/aq+dPFoJbyZya0XJ8SyRQl1yx3L9IkwO1LiTEVLLIlANSQZp9t
-e+PC3eE2Iim4gg9fi6vfSjYf1NMOrM8p/S5wSwmrSxV7iMG20L7iEMvyEkknaxfJ
-K7cRRb2sB9/ddRc1sPtJ1c5V1FVvbwcYB8xN7jeJOr5oR1DMoM08OQZEnwQLGdQG
-sJoJFny2nAUUjziNDDgREmm+nHscd65eABtxMABUxpOA++uSl4pzvQnCKc5r9/+/
-vReW442HBAucVUC7Lu9CgWz4g0qrB8A0nl9ZPcznNJ/gED2GHgSq7w+U4Z2OVOn6
-ah4p7FPrragEy2DHHQPGJb9KbuQP6RiEJCslIgnQV9BxxeuBSdvKpBPuAEhZl17k
-7Jak1NUgxIXPWYsC4CcsL1q7f9FUnq284L2ZyUFLGo8a8FyfMpJbxO5wUkSJAloE
-EAECAEQFAkzSuNg9HEFudG9pbmUgTGV2eS1MYW1iZXJ0IChDT0RFIFNJR05JTkcg
-S0VZKSA8YW50b2luZUBhcGFjaGUub3JnPgAKCRBe+tn+gqf7zYl7EACWU2qLqTP8
-dCreA2aJHlWjFIaIuNwlOZ+fytsAlKjSdTFoul+PxIBk28+flEZPFooYmpzyEJxL
-s605m5gX2N5QQMjEGGHs5dNQ5EzT7mn+y+lLvQCAWvuP9F6OkxvsK+VOEK7B1eDl
-I4+xw8NvTJonOidAVtrw3398RDb1e4WiU8WiReRGzsyUDU8MzvODslTnqY1dgwaA
-xaGvbNcGSSpcDOD3BdY9iEXm4x0p8y4SamP9aBSQfo2szO+gRO4T7RRmjlC6urqP
-XVQWl0tdqG7zd19i+Mvjo9gqxCZVaqzl/sO4jRP7ZbgBIk4eIkm+fZ8qwVYXpYjA
-AKToQZvPnft7hHf5q90oC5CJh+1U7y4V9BJuMebrkHeo4I1cIoCTbz49vH0r4rmj
-v8oNVlINlqgWcqzjUp5nQf9n2kyDBCRuj0oiKOuqPyriTf5MyrdXSs1V8Ib8v/Ko
-GwHtc2/PiSjZ3h6r9TNIgxCTTYzTEUk55l8ap1+1WekEwUa+zdKe2ShZcRXFgJ+v
-3m8PNeECSOwI4SmjPJWB63CJuej9QT6cQ1gIN/T7PD3WOc4btSipaiT4dYgIhFbQ
-FlTwRgQ2+XBlpzRczvNczvQMvySFPYwDzQqvHKcXilBf2YKbF5hGWSgDXQLdGyKT
-LukuB0YfzxrXYkIoIyuZIQ84Z58qXaEAYokCXQQQAQIARwUCTNLRrUAcSm9zZXBo
-IEVkd2FyZCBCZXJnbWFyayAoQ09ERSBTSUdOSU5HIEtFWSkgPGJlcmdtYXJrQGFw
-YWNoZS5vcmc+AAoJELDZkbR8QIc3nMAP/jav4fF573xHr4c2jT/Iujt82+s/lefd
-Pw1GOwHaDrEB4bL0AlC+MnHCR8T6HkoXJRFIzUzfyrA/hyjzlfXLn/RvfSMFkvoF
-tpPzjT5QC2DcagF9Yz7YfaPK78VcKIpmqCP1j4FT4kJMsOMKOpi0Bw0zJEDIxJPL
-ByIf6V9bWelkk/IepTxM1dfwSzzM9F9nq8hsmp5daUDsnehTscoomrv4CU8tJ8+V
-uDRoWMZi4FECMoxWrZpwhj4dD2Ocgep7fPN9Q1pHf0Wn1Sdbzywin9rBL98UEH2V
-BDv6fli2QlyU9zbww62LcTdR8SjlE5fVTt4CUBDnBm3PEIPVkbBeDXriQunVwVNm
-afZPbvfLZ3IEUoVfk7Pho6ivwRelb1u70eyP0zudWb8q8G5Qquhb1rq6Ib5SM0XS
-D5knEIJQLAEBbbul+SqBW/lcaLLp29mquK1Ci5xC+bBWaY4Yn8x/8Zc0RiJPX16M
-uYAaHj/sgJW4nI/BrqftKcFsB7tYFvRE1NBMGIFepq5NcZfWhWbYYglRJOc7TSx2
-jZksSMdfcMEy3nUEn8jnjge+tmKi4gE7KqLMhoD0y1u2dJ9dHshMi5IcM8SsNJNN
-fqxBzOI61aS3wxNTOtDA33/6c0Mz8D6CkftRDPlEqa0JyHJdVXIJHk1tCcshEMBX
-jEhmJrv0Ty5aiQKTBBABAgB9BQJM0rQoNRxKaW0gSmFnaWVsc2tpIChSZWxlYXNl
-IFNpZ25pbmcgS2V5KSA8amltQGFwYWNoZS5vcmc+IBxKaW0gSmFnaWVsc2tpIDxq
-aW1AamFndU5FVC5jb20+HxxKaW0gSmFnaWVsc2tpIDxqaW1AamltamFnLmNvbT4A
-CgkQNOp25nkUhag2xQ/8D8Rt8++/KUdrXTeM5ID0HZ0FAUe9DNarE6XAT/EWt3Ch
-4leZCX3gAbH/Fw1/G/txURqmcwH8/U54QHvJJA0GDHigeealRawZbTYXMzwmscBq
-x1on5ztGD+IHWlNaY+oBlvLX6QEIMWBXaywrSNM8fru6Rc5yOs7K3yHgRRWn4t4X
-iuMR0eEJRkDD/rJ07yvg0KamtApvK49k+qiPjKU3optLNIlGV5pP+vSSqxWD0Dsp
-XEUAlpgTlhHyajHflFCubdaW+IXJuw2ux9JO6dCNJh0Uoylm6/udrUm97196Tq6a
-AjZi61ClCGpTg0yGNokvCgRDbrFt4W1TtGwH/iJ0tJq2PDNUm4ATaORlE29q8XmI
-g/wi/77pf96XMgQ4F+HOIilS0FGxszBXHoxzYDUmkUB1vVNJvIL29/HjPSFbCZWP
-GFlBulwSw1YNRIxa/msV95WdvygbauaR40Rpy3VeOZKUm7JR+wPbbq5XHK1SK0rQ
-mCllPwM7FqSgk3Lqs5/DrNFlXtUuk/3ZP3fTJ4MRGgRWktjmwb342imeqi740bA4
-i8oBuQcTpHWmHfEBnQvvYVTqHNbXLL5lmA2TbR7aSQWCiXmw8wk79MNWmwbTU/8R
-TzaRdDFwDkAhhbk3ETqe2mh9oZgaZk+ZdmpakJ4jCN71NcKKrar3G8tyI5/aRRmJ
-AqkEEAECAJMFAkzS47EgHFNhbmRlciBUZW1tZSA8c2FuZGVyQHRlbW1lLm5ldD4i
-HFNhbmRlciBUZW1tZSA8c2N0ZW1tZUBhcGFjaGUub3JnPh0cU2FuZGVyIFRlbW1l
-IDxzYW5kZXJAbWUuY29tPiocU2FuZGVyIFRlbW1lIDxzY3RlbW1lQGtleXNpbnRo
-ZWNsb3VkLmNvbT4ACgkQm7hjsPUbuIobZA//c9PVF5LXRY1WtK7R9lM3e2nSdr7z
-/A5Cj4REWOTjPRMXo515XNmb0od3reGRv2yDtXfyvyjoYA6FU7y64INBWyLWPZMW
-5glKEwn9ILVxdD4z3XIJFy+XNPVIRZ1QJRrcMh7B7P4eTPQDPRKdh6xyitYsfYhq
-UKX/YQ2lrxqmwEPd1KMGW77rjctHJxF93YNiqvr0O9fYF1jeKHa4w+wjcNbCuiej
-AQoV6LbeggUtyk3xZWobPLQt1Lr3JG58le5TUjAXyWPdakTGwRRx8NXUmJ7ciwLA
-XUaq3jNMkunQ49JHgY89d3if4yhUyko4Im8I0FE1eV6YFK1aaPv+e4OUCgyGeexw
-MTyNl/b6fnllbtupBM8sTE/a/6LbOrcnieSD+qe2WLptU+E+HO8S4NUUahChtvtG
-bgQOv8Z9xqCQUvFTxUl6P7i2u+goXSnmhT8AjoaqcysTPGFPHY14C6hJFIGZ3Pt7
-hOpcX6/weF1bF79GLbn48SVpEzafMnxIjwNfxbJ/MWKZtsubwfEORycasiqx6PfT
-R46ILZlQVWK16w3rzkz+wZAsIof48vdT4/6dYHh+fPxlb3hKQoXQv4x/QPPIaH6v
-2N6HH2GYnt5j6lg/+Sm/DaGZ1YQAmo8UVDwrkSWDK7OfLd4A5IE7dMsk9CvXD3NZ
-qHk1jGlPs7/Oi6iJBBwEEAEIAAYFAkzS9KQACgkQiq+I1thOQa6thx//W1V4IxcK
-WJSWGsaxHSCCYCxkye2uUvPYfZq/i+sHVVdMJQDTE1sC2dnblXlXRlSnHma/0v8+
-EQ9CgnG0PHFFqVJIYsK8JFer+lyNTFtGvSnjnKd8VXkbShoLTrmUeCyuWI1egdI9
-xsj1pK0hOnG8QvjkPrDsI0faW9N5sobRCmPfgcibFEqAvJDkAnM6p61ZbDtIby6O
-m/5J7gGMD0bTY0S2qChaUDXslcZtX+1gnz8HQr+buciH9nmJcyB+rzo0RdVO6WRx
-jdZDOpQ/70fTCL6b2G1ge0qMbrxoryqyxBOEDx3a1S0BWjp/6LxKtuwGLEQk6pBQ
-jjmxihyk7Djk2uwq6q+gsgwoaReHAvxg27lNYoIKtJfrysNxBjCqGpP76e4Azltz
-YUkabobTXart5pLUS742ow8e4z0P2hOjaylWnd/8fJbpzQ5/y5tPUEkgFqywwnap
-sbvNiUKUP2D05hFIbgo+16KUSqA0pPElvsY/yng0hRRm/tirT7qFd2gWCLKUpZVZ
-WZ27QTjdykS/0yeGM9tSLMca6YSdmA5J3ja8vimEKyjgyFYKVklSdZT1rmctKaBJ
-3+QKHz1Af8pfwMVxROfyxDTZIhyAi4JU9gQvBzkV9ZDLATydBopl1jM0zaclKrpe
-l+iicq6jnpmQ8A6Vc2uf0qTJnASY/wrM0YasfB0DA+VSHH6Dz4mHUoTowlkEiRh5
-rCOz7DnginbiKtrfFbBim8XaLhmW03TMgIy/bHbMDdM07JAK948/l3m0O4x3Wudf
-V86Nv6yhCq8VgMSR367KYIdoSrUMmuY8+FZuWBcF/6UvNRMXR6XDNMG0LqJgXMLL
-cCwcEIHMDJe1iZnG0WmYAUBcIZpIUOrRpc7OyRbX0+QzpFPsvWoXJJVSShHbKs5p
-0xxigsJFgphBktkXHu8KfOfj1Xv/6zXFxA3MJY7qFsVFostJfV3uF41CeRvUkycU
-smTFT7/1TK4jk8JAeAQHcEtcAQsCNYCVuL6nByp/XiBX80lvGSLwxGbtiJmJpxgv
-IpQoEj7txxxculijvk1eBwUQOBAoZOH3h0Mm1e/qf11bxa6Kpwky7PNFl5pmdwrV
-TbGj2Zdz41T7D9w6gaRk3llvyI9TfPRVF7ZPKdW+tBYHISXzBGG6P9Vc4WTrM+s6
-ZFlomdmunNJ+67T0tBDNdOI8ezBoCnHxzDHvrQyxxCcyE8BIQ6yJP4DdcL+NuQgB
-oml3bu+esIx2iuMgAxNzJsuNWdyTO6lk7Yq2EGsaDHxpn+zOeV1wPy70C9LZLZnS
-OpNdD2+NmULShTVEEox2wsAjWew+JHOt/5+fi+kvLQyhVOGKLz25+ZUo0IaDV6zf
-hNboMC8xAWlIirQiRXJpYyBDb3ZlbmVyIDxlY292ZW5lckB1cy5pYm0uY29tPokC
-NwQTAQoAIQUCT28rmAIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRCCeB3k
-bVlU+v0rEACK5ekMAENEslmKQIpY45mE9j6MQ7Ppx760fiCamutk3+HnaEap1i3H
-5K6zwsnEtJzp187N3mfHrJsT85bpATHh0ODj+mR9OhmaI4fdHeUpSXXPLBrxTo2l
-C5ucvJ1v8QWyyuYPruSoGJdjecOHjEovPKM1b7gXVqkgUMhY3PTgM5MdfMbhSVfN
-4Y50dOALkMaHloseOLHG+xN88i/G2CoKfp0lFCo2Y6RLSp6y7nRAt9wcCvS8raDc
-pdEMogRRm02krAjJKqxUvL20VqtDDeJ/v2wHcDAvOd8wREM0laNhq8BT7Gh8poEG
-dZDERFR6DIdvEfd/++vt4xujI9WTjIPOjyGIPS5QxGKSrf+6AWy7zAJOgEHgfY0E
-pWgL+4FXmjYASe3esdt+QUiPHXIk3TBEzcGZdkbI+K1A8zLiGNkhtsw9s3JdZJEz
-N6ZOMQQ3Ph2DoVtsdhVZPkg3muVHO1XbwmT//bJvCaD5rWQ7lqDwikBHhL8DmTwj
-dvIbgqsy4VGq49ZHd4QcDCKE+Cjopo7bcayyTPLnf4Qg3IUg5hTy2LQJ4Ynf9Vu5
-CHNF21zhduwzOXOi9Or73tlD9EbvvwijFE2fRRG8Qqw6At6IpAuP2LXfRGPWnA9q
-emZKR6HPPX4hXHQC8jgz6HnAambfkyq5jmLdz42KDgIO8vQtqqQqdLkCDQRLAip2
-ARAA4qluKGH1/ETwJSLmGjH6+sGx43kwSlK/EczWFNpLdfsjbTtIFlQbaRtm2A7L
-IJOr/Sircp0+Av9gZuT7HPp2NcvgS1FKWhqAFoi/2Ijis4j/NjcYZHtF/A7Dgm9C
-UB+kVMq1ekICClaBcs7LrY73XQLdCrF5y7A4RPmUj9s0Ma89TPw1lzYN+9nhKkhe
-IJogkDj/qLAwO0qwWHLJ/blIYTLMUHc/wE0w7Vx2elNoY/9m3rKtpGKl0y/cVTUi
-ZEdk3uiXRDCcksoFV8CYw4JvfY1HkYBf3S0M5WCUJPme+zjOo1eQxiCRMcBwNP34
-ZhE01/8+iBGNNOW3fjQA7DQsAgiOeTkpSg4ntv2W7VQQIUz23M/pmZcsd6+N2+89
-lzooSwPC2wTn39nkKmzMQ8NunpKg+5fA1TLpndghBaJH75XT/KZSlGvThwXYVwni
-wdFIZORzgM4ZNh7vsEGH96KSZ+xaA0uF9VWxYCAGCZPkxrevhxF1lUyAmr5ByOCK
-D5FDUuLoUO8102Ka7/fsRSnZbwwzIEqPdJgnnKIwSTcFQm6KnMovvK/51k1HJpoE
-Gj3TJqIJrGrxlTEk0czQG6dn717cNiRjXaNWfJRvEEEALpXaPQ1PJlXnbISACEf6
-ugJ40xxGJg64X6zl/SuqrjDfnv53iQxxv2vY5Xk8sPg3LyMAEQEAAYkCHwQYAQoA
-CQUCSwIqdgIbDAAKCRCCeB3kbVlU+n9LD/0byiox8rw+vXwUd4IjWh/i5WRms08Y
-eaoHXz2VAIjnwj+tYx97ANRdmmHzYMXilnmO2SgEg/Gz+xNvwRUcyG1jMagTNarg
-j1CeNjBZpHrxV1XWlfH+82TbwJAay+vEQlNvyESGT3GF+8FtdNUz3fK3okWqUyC4
-aDDSUAwXvdF8L/HduaO7IO/yyPE/mo7cK/ziIiVLM/ypMTLmkKmVxzHEN973xp1h
-vsKgdjcY7NKegHiLrdAGonV+re+Oed5y2GKp0pvX8K+p2ClGieYL1dOzH0bS72jW
-5QVfLO7tvMuutff4dXY9x7vaFyXxJTkQeO89wOU6zIydnaTo/MbLKaoJXZzJXrJj
-JlXcECrN9LBLOFADMsi46TraoC4uTJ0hqg5hQu2gaZTRP2/bnUiV7CEqwJ7VRdQk
-YsscNurLharQ86+xhB6UkH6zqFk4ElFElgR3W+X778VOipYXj2F2d2s2OxQ32z2K
-Hi7W34/qmi56p5gOao/XjkdekzYamUmh1tonixj+ZpzDXJnslr1z99LZTI/FVFkW
-wLONiEssCb1BC7GH17Q24hogaRZ3j8mAt2YEQFhFu2Yf7P1Gks8iPXTsUB8ylljE
-LgUETGmAQpBLAuK3Y8xNsK5kWXU+GkgIrKd/hWk897R1WwGXxqlWuvNdPjMVTG17
-+d0Rh8SR8ykGuA==
-=+Q9G
------END PGP PUBLIC KEY BLOCK-----
-
-pub   4096R/7EB5F61A 2015-10-01
-      Key fingerprint = 8935 9267 45E1 CE7E 3ED7  48F6 EC99 EE26 7EB5 F61A 
-      uid               Yann Ylavic <ylavic@apache.org>
-      uid               Yann Ylavic <ylavic.dev@gmail.com>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v2
-
-mQINBFYNNTIBEAD77QsLP77W0f4zwQu1YRSVvnOSbSWmaYA2G3rnIJ6TTubVj4QA
-juPGJphGcH4BN8ypOY5aeC5q0F5u2LWMP7Kq4Hz/YMqHlfIzEOWbkE+Q1CbIda1C
-6SsL2FLHDBONZrVkOJWkcZ8MP3av3IYwMu0EgAo01OvxPeHKNzhc23z9uTSEEAKL
-9nOy8CYGd2ng8J8Z94vVwpoR65ggKwZOAXat2uVnnGgdZBDoce/74pP+uMDg/vg4
-hnLq64+1ZndvbPchqVJZvwROXaFpB74QbulO/juezs5megMeH55ZaYIjcRxGr26z
-X7o4N2R5ydSlwSW3jZx/WL15yOLfOiMdSdRME6mtuvEBb8M53L/taGmWzaZV7JDt
-6WIHLwUvJsm4z7YGF5n7F4dIsuDFQUx/+3lIGLsYOZU7Ha491Gqxs+aU0TNuFT7B
-d1iM2M4DU7RMMRS5j+v7TRiw5W0yoO8OQ4ESxYFN8FXPdRRseqfw1k1jumFY0cdJ
-plxNXz3f45aNui3XpLZX4yHzNfnMc+rqw9STvy/rJSEvtsaT2PwlO0nEVdFuP+vV
-OAnc6GffrsvHKo9cQn8x+8ibcLQXUaIolm6TB76RUDaljF5bmMHI/VzwN7+fQhng
-jYuuAyukq0/nXSSY2O1KCXC6QRCqZdWP7AAXhVqwfuv/H1wanL3IladjRQARAQAB
-tB9ZYW5uIFlsYXZpYyA8eWxhdmljQGFwYWNoZS5vcmc+iQI3BBMBCAAhBQJWDTUy
-AhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEOyZ7iZ+tfYavX8QAOIjsT51
-DE5Fu7k/Bau7DbmQmQbUOMqBpOxS6BrmSDWy3wLuI1uJQb5NpyfmnYtPQhQp84vF
-JYOsW6IG8kZLLHImniBDeurzu55o+8eZzBwHQMn5zdhIQXpDld1EVdSrECCeYVkQ
-gN4Zf18X0hrznZhZQX13oKsfJCuzNM7cPdhEZd+1Xm8sFazh5GDkYKdhpYvhexce
-/Y+IJeqz4VxPd59LHfua1YQYqAymcmPU8Tz4i/WjvwHUGXJArWu0Uv9q7ZIfvi+t
-Si/FYOUoCLWvcvXDxvKA46Fyyx1Ph1FQK/jzLwdkLnTUoFpB8NiJAC6t3u+UQy/F
-rm6BR4x8Tanncg+bF5szxEWl7N76b8nXlp8OL6G+1Skaod+OLjtPZRO3NX86Vt1/
-UsA8wyPi8o32w0y0G0JFTN6EMQ0b7UZd0gtBKnUQCLs4P/vxjvABKfKBmApGa08y
-sdvIe5GQ3PXJ9WbKiNDtFP5ceyYhi0kcm+Zx4PnF+INOHZUaEkacDt1LuSuB3Prs
-U37F1Svk1eJaCCeo6KflErdHUriabZe81ywiNvoCuCoRwOtVqXvC2eLYD+egBdrJ
-GFqcTbTu1h6HXnuILLiiPUHt2JPAXeMS9Ks5stbrZrScp/oWYGKJxuBKykQ899vk
-+g+9IAERUtybCGQw8z1SROgr12E7INj9KxCiiEYEExEKAAYFAlYePJIACgkQLrlG
-goiBdAILZACfVEboy31a75Uf/4E6AejriBb7ewYAmgJPY2XYrN37sNKon3RRQCqZ
-HMnhiQIcBBABAgAGBQJWDnfsAAoJEBk/GAq1XZl3gO4P/39cOhS07pUoN+pYl8IK
-XpIURnSmgd2UbKEG8c2osh7FecQd4iGaVzkfFLdB6VBs5tCgVup2ov/4+brSIQJH
-V9YNUGUrzJJfY2IKCjxXfyaKFW368UKl1eyQzdUYdG0S1ThIm3Vs4YQkWJcpRRdf
-kvMekM2/QU0vWDCPPWEIscc6BHxkuVKwzzMyWeoY9CQYayL+elxYVaHG+9M4OdU5
-sAERQJFuvrRW6NAqfRd8yK1msUnDRcwocmlckJ6vqj1/JuMjJFXER1H8968ummec
-n18YEWwL9Aos2jKZwrzqwiBJHgQq5ciPpb63Ev/HiJ2Qv5PN+zSQjNePcpR1LXPr
-msTwJVf6B3MUWbFkX1ppFvJ3VME9L0kAoVVgCBAi0uDd2FfXH2+iq80WUWBpis0J
-Y+xS919Jr5rCaSPRVVw3RhB7lFOdeKiVOKivCtL16pHlxPrFfbMBVNmHeUfem0u7
-UxVSP/Arc4f4P12Cp+iQgApanqJoGwWVqaMoJm6BptXiRF2Bmr4JyIzi9mORR0p0
-zSP5EQtDs1GVHaRrg+nl4xAn7os0k1lCcCTHfKUH5ECOW83pAnYmfgUMa0cbV9p5
-Ed3PhSuaA8l76ypCWtJNQrDdkRoWzuRzixst7PyDaPgakck/fxythCUe7NNcFRkv
-cbqy57gLN+bWGtBJRmEug6jLiQIcBBABAgAGBQJWFOC9AAoJEO04c/XTJicipjAP
-/iLKF6MBqq1eIZBjlirCHdkkHEwPoDNANW/c2NG0XZ2SHyOtpp67YIK3kFj52MaB
-CQV7Tov/PbIESyNU8+HsHWV7GKPzpLSseZqz0F/TzM7JhF/cA7BAyxFyScI2U6Hv
-jL9ODaZmiTpkG5VLFhB7fTzUQk5LnDyNL7D9A7htZz5alemQ14RncEEg92EJ1g/V
-b8Oww/6XuRvcjm+4llrp0ybrbmi5lv/IgI7s6/NjR2XERHb10hxaENhsdNJ+Z9cc
-yB3ivD4qjJ0+HsDewxXClvoHmbPwIoFGfYGly/I1JbH7MASRzsn+1WJrQSU4D/dw
-v1ESwF8f241jiqpF6gze6CZj+4cvHqMBqQFsUIGpoTwLxCiOMgamcgz5+NfeVE6N
-FOaVuVNtiwa8PukFvJ21PWSB9fs2qCjpU7CxUa3W/Vq7iHyTe3F7qu4e0yUT0u+E
-gsrTDL6eEmh17hW8icePwJk7WyivwaggvwPPXK0gMV94po0dvb2ekbBaqN9vxrts
-rgCjeACecS0RPQmkUlArmsfpYnmvky2Pl+Q6HedAKwje+BKcGchvHe17FO9G4YdL
-Pa1mpzdiDcYWErp66tl0Ikz8OC6JzMlafLmYBO6H2AGOdF4qov7ixIQEIBHTB6iq
-K1MYpOJItjj5jEbJIUi7X03ugYvKR+Y3LwCwRCmn+BofiQIcBBABCgAGBQJWFX/A
-AAoJEGgijAHsH2WFL78P/jeb96X0jNctPdRS2pU5xYDt1wy9ak8/RTLadACJdAhl
-5TeEDSfpHqO/j/asUh5wvozmQp6cj9mkjGlbgOnOF3cgcInOE9/PLe4uCrkEyq/f
-u2E+etkQdK2vW4CQ2BoPK5ayesu9IeKhzIOKcgBoiP6nPyjHxvH3QwPGPpH0UEj7
-C6Y56Ub4jQgfCnL3ivQtyMXxbpPaxbtmeFGSdjsQ8C8yYnilZrj2CuOtqIQuddrj
-B5gd+MdkjMmNhkhYDPtw08BzWyBkaSyVpoAmK3Jd7gl7TyVbrYdNy8zxCLh3akil
-p8jgd58YPPoxTAQg96Mp5Opzc47ZWgmjAeyxhuFWmqomugTx9G5xarRODhJ0MJ5j
-REnWB2OgDJqP1BplgHSDCBY6epl6rp+hoORczVY6C0zNMHIQiob8AWsaTro/ychK
-NrzJhyT9x8gsAErqRQbF+zELdHEpKgTV6Pf7HGrfWxsEIoVPEyWZRn2msaV/u+7w
-Bk8cnEaYFvy0vODhAWGRTXsrdpIv7mbHNZq4f8XoIr+ZFJaoJVizVtma/GrTkr65
-MTr5tKoBl7vZqX6IDYzFpkZZE+JAG7l06iceIEaaa6MqnGiGu67QC5T0oY6Qhf1z
-/Z8mXfvWWtvikv2crScAMPv7mHjWudTCSovvmG4fKuQURTKd58GUWgcMWz7UAgUK
-iQI6BBMBCAAkAhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJWH49qAhkBAAoJ
-EOyZ7iZ+tfYaR9kQAKz/GbiAvJdyWnHe7r7a1EXmecp9YgfJVRQnqZUZj43qwlzQ
-xz1aWyWPYurjzkoHIkp9y3JOJYtd8DETOwDRhVkAeIirrENnpRdHNgpTXqNQQbXD
-uxlRHQXghDhucvLbYcYw02L8sB4+4AudJZ0RVfjVhA9zyXqXT+7Cq2010swsI/HB
-ySRp9m3O4hhxFDJVriNGr5ONB/xzMWkH0UC8sxJ8zhwoBVhj7IEjOKDPKRARvBCi
-S+r7tnJ1guU+Idx1ug2SwhylY52dVQn7vC7asMPGK5uObNEMuxHqAqB0PconrR8Z
-L5cw8ZryEtEMoIjNeKdguRC0mTOXJNqj8uvzfKMTt2B0YEmfscsspkS0JsDm0abl
-ZI+DVW/OBBevYp1oTQGZWUGTiefXUXcCsPXTutNQzDv9M7maY9P0Pes0U3GtP7XX
-tBQTW2OJVQQMwIaGYsLqsUPwBGoWC9pE5kRZoeIbwn3HSxDoTjObkGw3HHPLQt14
-5NEmDbmBn478ixVsZqHYTFHEfJ53fg3Xj42kwvDNkQQVjRY2/vanMT+sKCdhiuKW
-4BhXeY5gAfKEs9RyNxWiiOY4a9YkWgSSiPbvqr34ZKEn5RrUjE9bfyyzCRtILo5f
-sIAkcGFnDYH+DCoCJqqiTYmyC3PzJSuR0/vlS8rkjtUZuJv8aJZSU1+OWFYutCJZ
-YW5uIFlsYXZpYyA8eWxhdmljLmRldkBnbWFpbC5jb20+iQI3BBMBCAAhBQJWH49j
-AhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEOyZ7iZ+tfYamioQALz1Pc84
-Qih1B6dNB23dlrgCb0AlBISO291FOQrcCjTyaVsauRRJ2rTHkxokKj8QoJFLiKjY
-sxlc96fo7hgKuQFgKHjg/rn4hhlT4VjZUL2+vkHPvG8wcn1bSxFxqmminuGK2O96
-mIJbUbv0koSBxFsBnOSdB9kQh6oOsMaBExTwfVzlEc/f/83uYBVr6yxenDSJsh/a
-nDwV1SkemMCklvnFSiUX3IfXcXA0rkT8fqQ8n07BwZiTLPGLLSbLsfme3wotVfwQ
-c4QR0/MKUmI8Ebh9KI1CE540oGnzEbUHxUS05ux1hn6/QemmONMyfbNrYXUIBV6N
-MZr2r7FxAYCnN4JiyjSmGp5TSiRsSoGYGANXsIgQfwsKDxZ4iJfQQ/0FCZquFTaL
-uPlFq3H414PJhcARQJJFFvioTorju29VoI5VcykSrjbHW9nA65KbKm/9sM2Tk2S5
-a5veUhNR0Haudj+EVrhmruNSlGMVO5s2l8s5wJ2U8oVZYhISfsU5rD/GVE+Rs/2S
-dPk+5LhFQwy6qqWNd+RqrXS/KB1HVmsR2HzCc3QuEdaODRVijSJHc6z+nzp/2DIw
-ynVg8j51qWbQ74l+gRSa2gb/Da8SkraFAgDynT163UBUqInEVaeKHt4YxG2KWERx
-480bebA+8ZBJX5zcKyw9RWtp/Wd3zyWBEevLuQINBFYNNTIBEAC9L/sTGgqzpzlf
-ZKCAVsqCC4+a3gYi+WUqG3K21C0bC1UoBrTmt//pg7BIjM5+ThM2IUOEcx5ORidw
-oMOPNyC8UHC1AaaoWpD5Xo1hYrTQkKwHaJMZGOuidqR5VahPn1MH7DwatE9LacW1
-zB8e67idzloZZm3YhXteDg0oX5nGWYm8vIzBfbORrTrX5GIP+m0mDP29kBcSLWB9
-XuLYJVABmNoGYi9liTAFjP6tbJexTwNc5R0jAX+b5oeMQyfKT37mylz1jTj7LyeK
-Yl1OIz+NmmmvRNpT24BOGET5c3Wm5hH7cLSk1vo/ragDRTySVJSsHUI1wnonY6IH
-/obUXIylgwFz04/8pQG7UGVQqxv4b1dPWAPn+uH0YMgvlDBvjbyBc4U3mw33ST5l
-zf0iCv1Kqqc35aGJ/eKUQj+0fpA0dRze7q3YKf59GlrMiAWqj2jBMLqm5zZuWhYD
-yh3FX2zawJ73vbVyCod7XfImGwPRwtj+BCsYGAbtLoS6UNo4irPgcNeYenLba/WQ
-Um3rClDNVjrj/bRgBhplKgyNcOLwPsrdzgANgTAUJffVDYB1Fnx6nsbcvaSSddZh
-N33lkTSsuVCC3pJczf8T8t6c1DK+knXeQl7WDZJ3OPoVHT7CtBqcYrGvtCVK2AkI
-ariyM1Wzzf+Rs9ved8Wohb7n0BrJewARAQABiQIfBBgBCAAJBQJWDTUyAhsMAAoJ
-EOyZ7iZ+tfYaiusQAKwQ/0q+KTmNg5W1PDCoC7t5KAYFZzJ8HRXIl7sgC4Ji8aPC
-v77LcPrrnRu1X86c095C//SLziRQlYjPUCP0Uc7fILWj799wtwv+hk8qWlT4n/zY
-QJ5xULlRGaDGRRYbWs/Y+EdEjgXvtm0t0ZrEt3C4z3J9FKwTtwmC/WGQumhyZcNN
-RLckCWEJCIpaZO7Dgnjwwrfg2a7t/WrqV/PX/CVNPM3b89K/KMe9NTZqhWThp602
-41d511+LEaxVFIHerEE/PpBL3ve95iyZFKyaR40uREeGEMU4AziODv4GY05NSFTe
-MapgoNwSwot/hteq6O6qGR0xx75Our3Ioeo2jbgfD8Dbv0QnkP2+Q5rIsOJOTH3Y
-Cxgc3zL+v1c6GjYplmQMNzulxsz9Bshd/yJzHrXRKJf7hUPIRt7K88Ynm+ta2dZn
-OwxHMtlkzbgOWegmPL+I+dqAJnNCcR3u203ee9JnmbDgft/BYNagagmGPZLVjLxa
-E5vzRXsJWbDLzQm7S0iX3rITbN8+9S09Ay3+Dh+VDSxea6sds+fFDXLjA84S2Oia
-vCr+rwKKFmELVryPtyTMwKN7TIcBLYvEavmuDXEgiFVrTo9zuD9abzFVsukYUmrr
-RhplyEYU+XWCp51Nbk3gFX2eZwIU5OQBLUNHE5pVzNVvxuIpAnzMMmLxhfTj
-=+Xpk
------END PGP PUBLIC KEY BLOCK-----
-
-pub   rsa2048/1AD84DFF 2011-06-16
-      Key fingerprint = B9E8 213A EFB8 61AF 35A4  1F2C 995E 3522 1AD8 4DFF
-      uid               Daniel Ruggeri (http://home.apache.org/~druggeri/) <druggeri@apache.org>
-      uid               Daniel Ruggeri <DRuggeri@primary.net>
-
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1
-
-mQENBE36jjEBCADLvVAeRbmk/cChq8p9TvCPI+Q5FGOUlrD2YQ3c2kZLY8ktzH3L
-c4PsOxVv/xIm4TymaMt4A0uujSV9EOp7go2NYLWZQ3eSUVKS0U+4QwQRG6QKDlnG
-M+VH4Ayz38FCzi/jiXrHuWgiU7kkoYQzbC48XmhRh+e+80aOYpeHa/rNMR0vp7+K
-iDwUJCq/e+3NQVSkkbYliBE3SjuSoIMUtaGeORB73zn7DqmH5ZLPbWKcbcsjzW0N
-1ih8g5wqVzvlE52V1/UhT3DEY/7ZXuDX+Ox/Sg4DhtJLPnDfV1Oq4iIPB4Rlso6O
-XufC636gdFhUXAAJ0xGctuC0xcZ2ddQJLrrrABEBAAG0JURhbmllbCBSdWdnZXJp
-IDxEUnVnZ2VyaUBwcmltYXJ5Lm5ldD6JATwEEwECACYCGyMGCwkIBwMCBBUCCAME
-FgIDAQIeAQIXgAUCVtsDSgUJEkZ2mQAKCRCZXjUiGthN/wo1B/9n+yDlliJTYPI1
-EV+WHnS6BEnOc4iYbqU9D7VFbrNc879LUODcpNHd80R0Bmlq9v3jYNCkWMbf3gFW
-4KHQNtD2Ha0EAT9O3hCgUglXrGaVLNWsHsVCfe4WalFAs3HQR1uPda2k7WCRneq6
-LWia9lAO0qU6RMEG7IqSXeNVKUGxA04dZUs7VqNgcJilRu5kHJrvE7E/XWBuOpwU
-74CCt72m00we0nnLjsI2YPvNCQxh30S9hVwyfp+b5n+PeT4kvfffSJLty0SO2k1S
-aC/IeEucCLYuJix9VDNa0VjD9aEtaeTRqDyytuYiv4rmepMJlNvNqm+rBPU5AIpy
-iAPmu3FXiQE8BBMBAgAmBQJN+o4xAhsjBQkJZgGABgsJCAcDAgQVAggDBBYCAwEC
-HgECF4AACgkQmV41IhrYTf9qVwf/Z5t/AiOJS+M7w02RXYLvkX200Bn+03cUD2Q+
-YSld9ygrvTsf4AW5Raemzs/2meAMuB4BsQVt2Fq4XBojYQ/feV93zHk3Zg+50E3d
-sOhyw0NaMNuiWLCD5rLEFor7dqjahZkE+QgPLePPCA52bAbHaSujIInRDbjg9Fkx
-I7kuyXycvPWgV4KWwQwrb2ub1p2xfIIZ75b9HxM31Le+LAX64tIPd5SbXG6KQlDn
-cvhwsA0TJLzEeFBEgovYVdfvIPzJqCvQ/fxmc7qNbO4//63UIfpnDQqMNYyD3tLY
-8FtIIb8zEUC7D04lTF9ikzXW0zeV7VUI2SDPpfV10NkEGnjmookCHAQQAQIABgUC
-VzV50AAKCRBdR2xh/7CPzUKjD/9OD5Psbdz6ZXfXcnxp8luX7I4XNoiH7EELNzy6
-2FHVmfseQ+y2UqfZFQ8XZhu7cd6BJ3zoGndymzMLxmXWYTWYz4hQc403xt/7osKx
-kJYTXfTqXXbyoRB0hhLH1pMgfwEo1WhYaf35jykL3+5i0C8WBqmh/Z8868gx1UZO
-FJuNwjL9O4X9ZXF3EsR4Fiyh2uaY4cidvRspFdA451CjwW09fS1tc/x4IOXMiCEn
-xt4ZA6LEBk4WZkOTL0Dts3m22e2uebE4TC/56E2ldeHxoePDNwHGVQNPU9GyNSbM
-gdzdNVJAnrhDQMRA8aETRdcKXPaUKZA7fmyF6R3tB2XuKyhr6f6Knrcv3Myl6V1C
-5A3oUYP2KKkZXKp06v3H4ymYk9FKrHupA8aY/YvNmjyrP2aV02psPUEncxTIxXqi
-eekfLDHyfP7/Zbndcu2ozWpatBp8moKqwH4qawMQBu20leTmUe/3R+QCwnAiK693
-sOpC4O+NK+YJrdqY3D9mhX57N0DDNeTCYnKbSxONQWUl/dBOXkn3hMpT8PWuLiO3
-fbA6+gAT3Zr2boXQD5PibsbclP40T9Us3ftvBLSbTySiRmLsx/m3T3sYB8p+8HGd
-QITFy/Bnd5tsIwjaBrCPPgDA0rdfb/Qe9JN3IHOb46yHOi2BkBUgFX6ellVl/dUW
-eTkz24kCHAQTAQgABgUCVzV3RAAKCRD/H0B8DTwkMNvVD/wMQIqGlXSCC+XjK22W
-SXXNNU3fgrIlL/OvmRjSjzJtQN07FfPowbVEA66Xl/xR0yaW6TdxSOfz8qgYJizi
-JgAQMIQRF3AjrjWgSqnjG8v15KGe2zrAgkjhhfXR6cmte4YDyJqhNjWEuFSsJ942
-51ltC/EwMZ3yEoL53m+cCWfJgL5Jhm3xHBxZjbuDzM2Haw4LidO8a149exCVYQUm
-AB0WBBELUAzHkedNW4Yv7bfIvPDUCJupnXHc4qZgB0gF3HZi3H9V3jzMl96VajWX
-WQ7jNupsER8Ot5gFAndz1JSR8NOJFhY3lqfnJPnALpRVwWA7O1kSAPhk8zAsFfzX
-y2zOV/IRao4LLG0r30ypYNPo3Q6Zu/j9Rnd3HB7kQphoxlBV05ZvotQFQhopXpc5
-lpGS8Hm1YcwnvV8qqPQ0Ki4SfHe4eEckb0W8FHuFktsAw9y/+U6moRtIJDru9t2N
-zC2RqToom2/7/UhNUE2dy7RuUDgvlDRBQ2HUxMXYIJw6mBPiyb2pRtRj+A9TNAHh
-qJjcAxz+JSTWIvGtW/CC+JRBGSq5XhCFZh5g55RwBeWwJi7E8y2nH1MM6e8zBY7T
-3L+HOAE/rzTlYmYQ2BANt3tvJm5hQOEDhr1gx74TPORsjox+/AlRaF7mo3Gc17wC
-5bejV99CgsXfS9H6Q5C2QzQkZYkCHAQQAQIABgUCVziWfQAKCRDtOHP10yYnIuOS
-EACfImSRxVG4QX9qzQ67hQ48orCs3FJHhaoTm9/wpkZkw3UwNGIC9uJsAW8HIVHq
-WILG3dFZgs+AK3kqGxJLE1gy7Vf08BnSqTlV1mXfdnqntfOQGRwz9SbXrWy71NLy
-Qa5+/vIZEa+IIMuRcDoxT46TJCG1OUF/cwU+9/qlV9FYcFptCpc+govLlDcbLzK8
-PGohUrTtGW37H6pOkfok3uoOt9YSyautOLZB9SSN1O1PpBXKYlNJc5lE/V/F83B7
-1r938FMskv0R4DdjKcItm+oZaVZJvigWtcQvQc15LP00dEDmUF69LQq6proJ3uTB
-PfLkGxVvmbOgsZRfS+Ck6YMfeak3QrPIrK9TumMMpL+Xb+gL3ptfUussGg14vwOi
-nTiCQarxAe8Gt2+8sFMZ3R6HCUcUZDjleOpT5OR1bQzsKJp4HyajHwIxwvaAXgP3
-C/frK7QOSx98QEeDlYaVbVLuxzLomNupxf47fh5mEG+jTyTeeDa7NRXmJNktPvD5
-Wnf97czFO6giesIIbMbCSt7vBG3UY4UpbBZMZbOBZIbG5N+RUPfZuC54SDR5KBWd
-X9sdUklIFacmuBvkXzxOhfhRssNCZA9FeB5k9t/NnfUD8TfTbQ8+Di7f0+ISWzfm
-glFVT7EhzacyoJ+lUAdU02lNu/FsvGeFBJ+gQdsnmy6OEIkBIgQQAQIADAUCV7kO
-xgUDABJ1AAAKCRCXELibyletfDaqCAC8nznqKPG2Gstyt4rgaTJNp1uCtRqapqTk
-ZHwos534/N4HGndX0Q/FwnKQUxlKevobUNUvjcUKVhgVFdMtYra6rHbbMFVQCS0T
-05lXpwZEXIXWUD4A4q0+8rjGi1lMAzPfl9A02MrltTlZj+d6N1aPL/7MOYkf7ToS
-vx03FxPXT+n//GW7pKrNL2eRi0Ohp/l67Z1OxSP6GnJUUYtj/iWZk4D9hgpuz9EE
-rn+OBA58bJqaxxiVMUl8hIM4soLP3Sn3/IdWx0709l8mGmQoAQf9admARvrvXyRk
-PCzgiU7rGaBeBG6W57moK34aw95KBxXxm7HHmCdBOjZzsKY0u8HtiQEiBBABAgAM
-BQJXuQ7jBQMAEnUAAAoJEJcQuJvKV618FzoIAJgZgVs2hyUsp1JnwXDA1FQf2gAz
-Mudj76m0zvTWop7asGfDH6JXFdejvU9T4gqKM51x51gWMC5wu9hv84HVTS5Xpbg1
-NbyUdZw99rcAJW4yR4Rs6uBNgg5V5IajS5Ej8advG6EKjXQMxsDWiorHinJMlO0F
-CwerN8+gAUBcPpOvkP+C37jyIN6NW6bwNatshENgsYPnMz1H3A3Wa0YUuraWejmC
-B+FmXOUYbzHJ1gGSzYkPrnsJUuIG4g8/fuapeAVrlg15iR+3ZR4EVdsvjBoryaxY
-Xb+HhNFPSpMo7DkAw2f/QmivlMf9FH0yd3XaLcimz5gyjqROd13SAADiURCJASIE
-EAECAAwFAlfb32UFAwASdQAACgkQlxC4m8pXrXwwzggAy1oiSzfhakoz7HNhrOSK
-stREvzBnWPryJFbjTUDguG8en/KPrJS+eutpDxbkJ2uCNvRMr8mt0VGVjGjOEB56
-4cyzDTfxjWxuTUzGiffh6Sr7pHNUp/GMGX9TZWucyWgTKHys5UxcHpLang5ua1IC
-Bm4VZiZi+CUNgBqt8n7rZiNE1nEwB9tXOGU/YBiicqjvrR6XN+mhiqjE/6h5VGVf
-lY2uIxt2XS3/v2Paegmlq45XNbCN1gWp9URQ62X7wS22sG1aiekI5H1CAoegR6LZ
-Cpgs3DZUzJVUVAiQMuhJ6Ok/G5WUkOOLL9sD/wKqNX2qV8qgdLPlBNYiA7FDgQfu
-QYkBIgQQAQIADAUCV+0C/wUDABJ1AAAKCRCXELibyletfA+nCACR+OywI/TYh7RR
-Zh5yV9V0784KAlyv+ybQ3EUnXu15d3hYB9X47UI6c/f5sLGO254fzFvVrfkFNZ5R
-PxbGL7mC6N0IozmnEJoQEyV0XWz3dnbVghqo+lbIBzvRH5jeSjR7uME8cBZAbBb7
-uQOCTmPvLV0rsEoeZPtNBfs4744WwonM0304ox2DH/72Kxwff0nsCl7fgTN3f8YT
-Hz7hkqnGPDNnmf9cELAFz1TWzH6j4S1gsFSYCxxSNtDLRUkNUhVUhClWM5mV5NUz
-DPkhEUh28RJmFChQp/s62jF6zfU50AqwAAiLemdyA9jXlSrGsuGCzZLiNJSqJ3ms
-WP6KglueiQEiBBABAgAMBQJX/iaRBQMAEnUAAAoJEJcQuJvKV618XpUIAK9PahDY
-xZt0pG6Zby+KA1aRfkW3baa/0NWal8W41s3CsJ1B9znayheB+6PEoVOr/pADbQxX
-IRGUbdaAZ2qTGDBcJ40fItfuSfwEvkKkqhsDabE/ZBzxhDiO7r6T5raI0P8gnmox
-QYjHOaqmzFN4nMbBZpi2y3K6QqfC5ufHZ35E6JmVkzrcBMVd42IUTEZ2a29B75am
-WNUZQtxrtLhV0GAE28bCQzhvJQiQO9Cpcc30o2zoBfWeJYErKp3BSMojzPaEbHts
-vGqiiNvn9ogoR1IXDv2KzwTJeipeKExzTGI/PB/0FUyjrpolBro3kzlIR7Ol8OCl
-t2VuBqdOTm26iEWJASIEEAECAAwFAlgP8rYFAwASdQAACgkQlxC4m8pXrXwhjQf9
-FTCiokUb1XT7wmMIl3dPU7KAVW5UgQKzNH5K5ST2if6Q9YDgDvioS7RM8vcyzGuC
-t/GU3F4RcQkbBm8jkFnJC9spgSI+Ft7EkIgTdryeWpivZpIrx+FSyLcFnNzbIV0S
-3Z5O8su7PeAlZ+6UCGIM7LFCvj9f9d2C5+8rIp8/0j8eCG9EQCLluZ0xdJNjm96c
-IXKzzkNUUuoXH8shbakvFqO3iX48DbhKNdv+dskhfK4rQjb3rDZn1lVS5uVt4l2L
-woS259xUTQr27Ym652kdq/+CZrw9inPMmjzJbmBMS6zL9NevdvfEG77XOxp/rdYe
-gh+yMnGPj4kQW7KKpoyEhIkBIgQQAQIADAUCWCG+/gUDABJ1AAAKCRCXELibylet
-fK+8B/94+FXcO/DONjHrGnZ409sjIPAiRUsOCnrcmqDeB8Lio8kx6VHXk5rwN3xb
-UoBYx+p2AOQBP67wLQbwCUcy5fguY+JuuJGdvFlUGO8B8B9z4jLO+NRBf8OkY8Ky
-sR2akBsRGT6aw3VVHCmVyknfotzdDpMzg6TIIqDhuE0TPAqz0KOGJ64dbrc4FMFy
-6UAdHTv+I8BE590WuHOGZi3FAyUwV0mRfi3aC+gTlDNhwG7qEhIdgNrYnDWsQic/
-DSQWM56Toyx0Pv1N0/pa/oEbC/Q2BvcMFjMqGwm6UUkWsh8KxLqyGUsvkjgfvPC1
-+Zpc5CkL/EGFiP6mzTydeGWLJhnRiQEiBBABAgAMBQJYMuNeBQMAEnUAAAoJEJcQ
-uJvKV6186HwH/3u7DVkXEf6IZY4d+MzUaDSQpHxq2HCotSwrqJ1QnLLXxPpyPl0D
-5VlwY2P3/+HxP7xrG2QQpL88K1bQSCvc6gwS9U/VBbVtsAgVY9nUCsqcl7KOa1hu
-TrUDJHIepYUd48SCcgnYu9Wbiz7ZXdTcbJMJ3uaVi3Hux3v/YGTDyNjnseQoM+Uv
-lT3yoQ4niGPSnfMclykpdr5X1vnQ8EgW9BlBhoZSki9sxRCzGlIS4+UdT/resy4S
-eFvOiRGJJIdciRfECqiB2ha2xwxN85l2aM/ejzmq67LqDKQHR6SOq5C/Dopkcoim
-CJgdEp52wCQ4r6SjJsTB1cdCzNt5nfe20EOJASIEEAECAAwFAlhVK5MFAwASdQAA
-CgkQlxC4m8pXrXwsPggAwxMlujaxb8dzKOQF7qIO+LH4hIwH0f3hcxiBAdhKy+1t
-w4a/iFeBzrvFYQmakiW/0/5rMXurwzzrlhYCimznNZUN8Iae6XLaZ5s2sU2Bi/Z6
-jzZjza3EcT1XZYnLz3piuREZ4jPR1ZrHQpFkeSxx4gf9sUHYre1N4fyA4tPZeDyt
-Ohd0/paAmak1a6LiBZElFs3ZE7lWH/W0utviT/iO6BPMwrar/iFt97KM5YPxVhpR
-33ugRxeato2zddLFURnf2rdZZHp+C2A5oJUAKSFqKmh8EPDCh2bQhnDlhdMcktRg
-1vkBoB6FJmUQxvk6Q51nEFTIrX6us8yuKzls1gm72YkBIgQQAQIADAUCWGb1oQUD
-ABJ1AAAKCRCXELibyletfJDLCACZX0uwMOKAIvBvTF/yhsvVFhDQjPHtNLTk+/5R
-SdaeOKYweh6Hy1JN/RpjJ6+2N+sjj+1+0rkWVHnZ8ApeOelGFgj/C+Xw9D7yhuYb
-KHZlKgEcLofaQKJ+hwon0TuJEYY4EcXgCLESPGpHRa35z8eFlkvfh+msTTgAs6H5
-AbTIU6cxNJOZDH34R2NYuAHfjiMeBVH7iP76QqLjJPWclq7O7dkz5s4bjd2o7Pjf
-GsOx3Ea6jKqf9Z4TqgTgEjIs/bLipMmiDUXJ8N0Dz7UUjTASsWReCpp3ldDjy3Pu
-5dk+7B8CDtPd1iSK+FoKVSxqbItgTkrbXW3ScXTdOHBPxQVniQEiBBABAgAMBQJY
-eMHsBQMAEnUAAAoJEJcQuJvKV618PJYH/RWpJgwmAZROizAqyqaEXjQqeBUYhdAi
-UQ6nN7xDcR1CMyZmfRbZwQ7FZmfHhVdu7ywTRHmIRboN1qiYHIV/tphPr+WMdIhc
-xYZaAgJQVKM9LuwK459jHlDMZmGzMHSdngqM3ivuQKdN7+kghUqzZ2KwrAT+qTyS
-ixBAxWicqJIeRrA8wVlzSFoK7py3Pxe6MsEWSRxg0tSOgfQl17zXnVNmldsg3Ym1
-CHe4rtOz01b0sYT5qtiq6ybgp5D592H80ObDplAYhJwEM5E8X+EYQnfUFE1XkGZh
-c0knY6tizJQwvo26/KQsj3uw4Njd8uzShSERhcDKqfrg+0FA8JtqAYCJASIEEAEC
-AAwFAliJ5XMFAwASdQAACgkQlxC4m8pXrXwJYgf+Jh8nVamv2rDhPl7MHfqZHkus
-I2WHqRL6XY/3VFPL0mzmQm/0dBo8zuq4dYOnHe329BZpQ3oN9krZlWE+37AkHcxg
-alzeyavvDnR1hlgYhoKWAdTNdIvJ+L12LeCKOBHnlfxPe2Zug8wy8VOKUNk4qLNK
-Pd+BhhRvBrE9Djk8hI5zmQl2Lf3Ibvu0A/voF0un5esSd/h3eVJJTLaOuUh3q3FA
-M2jCx8pfa/l7nT4OBmArAQBZg5FSbk12rYXpcSVRGP2sQeKao8AqF10Hvk5Muhfe
-EfPBCJN0yCdNyN5/GgqHnZkhueVS+t07c32/DUdldCoHjtsCrkXdlScsDRH1SIkC
-HAQQAQIABgUCWHRekwAKCRA/kCwnbtm+IaUIEACDez9J+cHghzfWjHsFOMsBgzto
-ZQEjoRhZhQ428yHj2Q83qVmwifF2K8gdb6cjNrgnisJiSgvE6l5swUFWXhszieJp
-RhoE5nHDUVqh0jh7qwvbvM3SLaB8LLFhEq1CufD1u1YoB36dT90b6rXVXzM2i8Kw
-gd9cFDMJX4FEXlYzjMG9hUYv+OwCaL5cfJqS9qEh549igCmAXyJeqTORmCDqq5LQ
-6d6oUb7Cw7guCd3V3cXMxlnfcGDbTJQaMsfhCOHW/tIx46yvBSbJR1IixmnpMnx9
-WxhKUFj7KvYf0UVh0YrGndq0jLIeMZ9ZDIivPEfdAqjHra+uoyl2f39hev4sV2H0
-GbxtjfXfxvkchJhGj8PhjgmS5F8JqSRK515ewKK8Xv2H4W4yKguQkifrf3FgH9ct
-pjU0dLgZSxUITj1OhLP7Grf8E9lRzP0F83Es47n7WZovrb85/xOrUMlHkyOCmeBa
-koXhtXU3gk95h2ESZZH4j52N//o2VxVTQGlrchLu2lUz6IplC9zqHi0I1y+XHIM+
-jPySVmwL202fK8WxKWO3s1DSf4gEStXd3OumjSsg0kUjtFGS3fXzHmD9fkO58Nmn
-9L9tgIv4vysNmZ5JdSWEyxgkU8hZju5qYovnRcX5D1gR5735jblUIpcczG8ZSMBA
-LM23bxCFXoMPPCAGRIkCHAQQAQgABgUCV0NoqAAKCRCU0zajbRWTCq5oEACByjSD
-nsrJRnPjncDNefv7XWINDI+9FgU1DYjFK8J8VZifgXNMlxir/1MhkWanRa1RFXyo
-SMqr2M/H+M5HPw7GHxwrlWkG62ReO3WuRSHS5shYpzQWbwIGx/rvWKJ014Q2qaPC
-B+TQ28iLfEJASguNmcAOUe0adOiG7AX3GSqh68TWYK70Fr9ddV0uyYI2uzCn5mMe
-IoTRxu7wGufN01jzzqPd6MDtdxCxStOq4rMqZLfkAdphWiiF2nqxiMIY7Hte9YeQ
-t+Amx1zRHuPwS988v9JcpNj4e5ZKzpXQoCNW4ujJpx87H/g7BsM6XKBE1LdLJhv8
-evOMmxjhOYuBd1P2Zrl9REn78iPKKvy9H7brFCI40tQ+B9XbXub7OuvqNoGSQjeQ
-J/xqVZW7xnAsmoEL4JCY8u1eD6Tn0dJP3OaQ1lAYt85nbOKtkFREA9UfI68Ac4Qw
-MGjG1bA6d/NawTTT09LLPU40PTTBfeDQCGKS+xxyh4LrVAFuP2x2Mx21tb3TtJzf
-R2KRuLN+iDD8eL3BRKxq75cjm/Tz2hdaNBSrDDu4EXViify2DQoQVd1WexJpQkuN
-aTLzXqEXXwE39szkYurvcWVUXdaQKRkSK8+fe3BiH/PmJShH5QpDexBbyNJdAEMQ
-tMYNSfU/7hvrvW8AzA6Tn16WO7D9nRWwmhRBF4kCHAQQAQoABgUCV0OuvAAKCRBi
-1I+tFqDeAYzVEACv9yu2yGzMsrIYcCgzhCi2alYMgPqvsLYlId4DFHhemkiZhBkg
-RMrQ336kyuDvSi8bEoJlXwfaLDcpSUxPOD0m/LveIvOF1z5clCMx+uR4MPzf8+5p
-d2EYeH8RG/x20ELvoH/1gYtAo+iUqJPW2owibBbyVgXlLS1L5zT9NFgPj5qi1D8U
-6v9NPjdv3NGd5hJvFXv0lBeiuO+4UA18csLwhTr9eJqbe3NJqAkKeMIB8vnUXG9U
-h6UmaX+dzniLhI4OYnIenzyps69VLGUF0VvCMJC7cSr514pyKkhskpSNtYiA5Opg
-pXWwtZp1URm1RcDK1spgVrF7V9DgcpsoHRWByp2S5vRWkspmn0nZ+3+XQ+r9SbYF
-Ljz1dT/3TmnIz35a3bf/yegzwXNZOJlSuSjGidZVzAQ7jT+HRGpoYkURyN3mvDwW
-B5qOi9TcVIUtuOhuywLuIY+9Oh3VwoLE56p6MtNanJRQ6Zrf3vXz7h5AwN4epRb9
-SOTNPsS3GtbX4bbI9Z3gMD0QuwdP0PnlkQkdQFNLNJ949nJcQWX4/GJqs7b3Zy1W
-UZd4bFyqGTv0ejcMYUhXjIFjOPb2tmnNk2XtLZbIdo6Y0965HadcZUin+AwzolkH
-zlUBxTa+RkDS/l0pbrBMmIoyrcixF+nAmk1SOCPACHV1IP8Hn9NhavlZXIkBIgQQ
-AQIADAUCWJqFqAUDABJ1AAAKCRCXELibyletfK3UB/9/Ao8Bv1srj96NF6YoPhcq
-TzQ//XZyBhhCo9CgqQeTtHH/FfGs3eZMkVDLKeX+mSBa+wNN6vb/6FVpQPvLa4RX
-fxynTbyx6F5CUousMBqx1vXSR/wxn1AKAO4Zwr/QjpZDUgQQHcotzo2q94aG0i/C
-IqfDzm15tCO1PKewGtVBagHI0kjvO0722b7iJ61MtwnN0Ig3nd1YFRuPQiyAzhTM
-2miEpOUV/IP3i07yjHrPOjrvoZqMPU3/3+qCRztY9o9TYSu30DY2/06pd84QIAfx
-44yrAz4lXJAHYF89Cf22gf5s1Pu6ucyLptwP+1XVraGXABXi9JEaBgrW3nqz+YTX
-iQEiBBABAgAMBQJYrCxBBQMAEnUAAAoJEJcQuJvKV618OcIIAKdIKjMWCjQ9cG99
-HnQ204RTCLugt3WRXB29dfYaQYAZn0X3ZWOyWnLfe0VhSBhG94Ww5I1FyE5aBWUn
-F1+osKkNqTOTUpiRA85KX8OOalgLHByhGm12Dz2aMHZnAJJnaaJji6O3KE+TwQRT
-FLSn0NJBUyQuNlH2//s/UCXwciOnj723icoEZnlalNuWh+4Bm69euHZnKRNWd2pP
-9WOail89C89IWiTLGt3KNJy3bDnlwnaQr6mi0Tfv06F1HqKw5eo1UPpwAL1h6+cq
-R15EIzfdT5iFcS1NWWBqErirTjm7LTMZaQXB3uwr019RjA7MW0VolOBo1oAJgh8A
-8pWPrL6JASEEEAECAAwFAljPG7QFAwASdQAACgkQlxC4m8pXrXxOPgf4ldwkCFIh
-OPqt5kR+WQ/waVv8h17W/r9zsB4qUaNQYtP8BuG2HV4zxMqGlfOj74QHhfWRz3Vn
-MpMKhRCbaMp5w7ajbhMC6NmK+47eWO7ize9kwasqTlnB2jfefzEdNETC5EZ4Yfnv
-T1mfdz+9o/BsnTmSo+mi8BhmgOc71+e4DxuDxZJOx4hUBFbR49A89wK24y9LGuwX
-dS6/eITIjIuIoo3z58jzLIYaJpnl6JHsUKWuw/NqSbFZEgevUddP3u+yoXyJ21N/
-m6YdO5CdJNNnY4bNgokE3QTLGesK/S+b3mkcAwQJgmAK6QnbsNnWA3xR26YWsMye
-qhdRpdIYVmBUiQIcBBABAgAGBQJZHXjvAAoJEAqdr2cTuGNJMUsQAK4yxvZPh0fp
-URgdTYH6z9/INZNP0A0ZtV29pDnCFU4p2W7qW+OqjfzpX+umT1OiundHdfSxp0hn
-pSezrX8mezN5dC6Pshu1HLE2K4RBOuIacL/VFCASseuT5Wwc9JljDw+P6qnozR7T
-rbrpDcPkLjGk7EJ8KK8yUXcya6pwk2dVvCB245RSF+U7LJDRQeadnI8qkwW7O2Xf
-cR7BLpz6Zto05KCA13tERVkeCher5Jpx/PSPUh0Nxxj5mDcv1HwOQ+fNkJXkalUi
-JW9rugjdAAlXYWfvT65J74gAxhA21Www99Vy50ixPNAgYPrVnbhvTkDO2xSbAWwf
-vDK73VnFqAXip0mkiF7xX/GOErNb2MzZKK77vi+J+JZgdPcsJUeVvqKnCQT9xhTL
-LMMqa2kkK+Ha8HqAuvuA3uGP4jLdjisOBoyeBy/VSPMNjcOyxeraJOYebLwZLgtg
-z2YQHI7gX+8fdphl+vhI2j7dQwJbHtQOYbe9VoKFq3Cq2NPTIrRxTQW8I5f34zvD
-12EsfATnoThTeg2vdsrBX5CcPXgg0bAJSBod5tJco8riVWCQpJlvrF67oxH1ZOJA
-LEffg9eEdvnJXcpEib86vpwNkvzwLdgCAxXDhcbExKxAD9TrwOa004IgldNV99q5
-7Tte0yaqwZkAkV43KLevNxxqiN/KeDa6iQIcBBABCAAGBQJZG5lsAAoJEOQDLcTv
-DPOK+9cQAIBrQecI5SWNnu/TzMuGXMoO1twetkHB0sjtDiz0vx+oco8Lvykfucrb
-+nkIU7kjLwnMlTblCLbHd8qqVaY6ogoBjzMddVDG5gNYzK5Prbf2fZve6vRUL08+
-w9BcRSVI7Eroq7GHekaegQrRZk9HfNMxhCZ9hCV/N7ZgiT6wQ0yaF+uWrcxxg8X3
-gm22zxjVF6ZcKydAA/a571MB6BG0hSynW7bUQfRlFSdlComOcDNZDfHZBFW0p+ZS
-qlPT1r0WFpKn/uTltOvUftZ+XZ/6nmOtkXfu6wpkXgAvqsOdVlxoMz5iYlnU5z/W
-jYTPo3eK5iyQ5upvYi6wx7nWNzXaw9KJ80MlbomAGGwuaXox6ZZuwnDikUnCeXP4
-03ANHArUGeZsD5+kN2n892qyzTojkXklns1REpSA85+ffYgPZCih1599LdtKBgqK
-WvBu/r3l0pUUWOyrkpkWFZhgi1+Xqd4VLydr+JniNsuLj2Iyl78K6R1B9Kjdzmvq
-DyJWetzwjv+cpRjYpae0WxnjW+sTiXqB7xANR+QSqd1T9cxG5C0ws0cb1nRK82rW
-3rbRZdCB7piHPmcvX3iiUnlW0fyOAkdaqymFpfVkkoBO6Af7snmFMx78NECN+pIN
-wmVKucGeLVeB0UkBHuCAieCepr310cpsLpWSuyppE8SpZlNB1chNiQIcBBABCAAG
-BQJZHJMXAAoJED+q0s1ey7MUsEQP/inrCUSi3Bg4ZwGq9nndSrHCDoRBqGKBejN4
-sFWRRMK1neL+zILcbjZPLDhkPy2o/cd0cvJcUIssuCPfnJWXjeOb7wuGeXiXJhqQ
-R5BxOzJ7/Zxa9/XZK2LwEFzxknGav8xRCG0FIEKCA9oFTnyFes6me7bVHq0DBYP6
-7DjF6N0qQaZT2YwILZFCB43M14ZxOEyVzG0P3pv49Lw7OIQJggmnpOkN2RG2upzD
-wvHbQDXb8HD5JyOTkw4VCSFu1MBNtkYjwy+XM5MGfOpecqV/xZbY4sB40qc5DHbT
-FmMniTTH9N/EcSf4RdZOklShqIdZmC9g43Yoz5/Du3uFOlmQE/af6vitbKMcLkop
-jtnDwubKKYJR7HeWnFmiHoV/aD81u5h4H3KQwhr4kWsywwI1+yC2OokYWYIJdjp7
-P+qtv9IA5y8HDbhpHEUMrZIv6edVPoK+iEbkC7FpkYTBM4J+ERgHdGxtFBppPbaK
-ISbsoJz2Z0rsAE7OpaTcOdLZ0em8MTAsxlefZcyOWXhptqbUC+/p92yzMrAdFp4K
-x+rzZm3E7netwZe61o8yw+HUEu96oFxWR001eGwVBt5MjAbw564mjzsv8+7fXASA
-iPuLoHVZA7RoOnhp9XG4fM4K8aFpdKzNfFsH9G/ygbF/IQUulf1RYAHpraRRtz4p
-NeqP96htiQIcBBABCgAGBQJZG6jVAAoJEG8M2ucAtomd+r8P/2VpqAh1ajLRP2fv
-mQnLb7keFv8io5KDlx/HOrqmiQ3ZYKOCjJvFYv0G1VwdassGEWEGqjt5W13YfHhS
-YpSQp6Z9GN98ohOBES6NSfVkAjmoplOb6unPlMYcceAvDyei3f1Es7njiUjj/f3I
-5R6Tq2j+wuySva3t7MrDqMWQi+LUvDWACj1n9yJtMHz3vceC7xo/7S7/ca+ubsHE
-ueBr/MKvVH28H26Hej9/wzGYyocuq7OVtTMzfwAre2DK6UJq08WWJoqZjikpYfqF
-dW5ZkFrXznyGJQ6Nmh+A3uvlTFXOI9QAlLZfsaYnIOHb+H8rmUuM1rsFMv9OJzwL
-13cjwdpc0g2OcBFV3/omuVHol/UaF9cApfQJewV3MazKokb6y/doq02h+mc/W95N
-i9RMVTSvSpOKmkdzunTWfh8lhkG0oZt5xobCGDxd2QrdO5/zmVYCQyXo0VGCOQjO
-h+nzuyFBvyl6eXtWM/LIeMw/nzMXkxENdgpCbJgR5V/IqmXr0pneOB8MH5yI86za
-t9arS4+t72Z3XEyEIglGZgms/PvRBrMR/3HCsUy8aSN2qNkIPzpT+5lPqJJ+ba+V
-i5g47r6bH6IMDsOs9jKCQuMOCGWNZHKJIwdUnulJP9tGxAfnQse63kK/cHiXep5X
-T0tQISnVYTsR3XHKcqLWAESiMPsDiQIcBBABCgAGBQJZHipqAAoJEKKrCB8mUY/u
-RGEP/3KC5ZV9b3t3e1xQLH9Sh/RXosBHHeoAI3Q9Se290xpcpK5WaeZbd0sx8MXe
-PpL7Y5luoc5rv/F5C07r2XIq8JLIQCDVdjjvrf+lJh4gqCid0oWbnVTzNFj5ocZ3
-mPCE0q2/3UchohlIx6/sGpKffpYt3Oc5NR6LWllukrbazBi64s/x8OliC833IhrN
-xsreuUn/vl5SiALtO/tkb2dKMiJBc7WOJOay+XMviWNgUyoL0vSEeXMKgGqjYjpC
-OhurriVHDDniJ8cGnhGATIoGqhYtUlI2ZTSosrYs2YV12b2Dpt2SJnVoy2fHhZTk
-yoICJmBrVggTpffsD8H/qT6k6Qm15T7oxpKrpuxTugP0VIHALNNCYazbDaNyxXG+
-/sBbhX1JPrgCAy09eG+cimJANrZXJpLa6ToWuGShopM55g6RTTFKV74p2m1SRCEH
-3Pny935AmhQyJLHhjGm+PIlyR8k4GvstzXDi2NIanmDRVw6tgndIHcP4UUYP+4cb
-+7tJYBYcnJCvnrM48BK3+aTQD2MjPCUAAa8J6X+D9a/d0HAjhIkZL+Hage08845O
-Tw2c5NdSpLPZiaV+5FEw4nn7s5U3k/bWGC2PFf6OIly5X7gW0rFBnBy6tArMz//u
-txHOXkmVIEbOqxLrXz6LT384/ltMqFqChU+K6LoenFJc5VtgiQIiBBMBCgAMBQJZ
-G5DRBYMHhh+AAAoJEMHtu5ykAP1QZYQP/i+FmF1LIkNY/KQ2njbYcwKcqF5KsHc7
-6IIgw7XGAs08mBZQniQRmfPyG/uRrgWc0vNdKopUZ0bRQmcLAC0fivqE1E5PEsJQ
-wHBLmzVQeqzJ2Muhl3izmT1TSIOCdsPZRHnq3Kq7Zho6uzjsQAek57t604y7eZuh
-5QR5OAMggWWqEFE1YZP7cEdBw3pyfMdG6Y+rhivON1dK+DVxVQ229NFMOSIEKRl4
-fR5TosbaoXHZqs6TQC7d7jOoT4DxVtzC4sZqc6hcDJuR6pyekLG1W3Z1xViJw4WI
-1xRo2NpPnVGd1ZIQVvqYCj3wj/fnADGyuSJvv5eYRpQqX6nsHc2fosdZsYFBF01V
-/eHjJ936HM3I1sEqGbNIk7DwtA0/GPTG82PKRj07kTytrOKfqMbuuXTuglPcg6Rr
-pMCboQ3VcJEEP28w9f2KmPNy20CWU78DkPH3RjJMyTz6/3lN+RMyRM7PpqoCPH7P
-IKTJmGq4jk10j54opV9bwnQEWThQv+Xp7eUQRAxOdF7tkOtMKSqPL3U+d0jCSKou
-aithN+REwBA8Z5i9jJkbsmKZ9YMRFPRRxnfp9c3fvE+OUEFxUBIpRuDW3jizzFqt
-eN+wrCw5dDjx5uaROSNOl8fSRcu/KaqvT0izzTekHeHt5IyOK0ewyz0gwWpm0bbO
-qN6H7HdMsX2JiQEcBBABCAAGBQJZKDh7AAoJEAPClpScF1DFnh8H/2Nd7MCANmdY
-ME1r7xBxIPaTFeKag74TzYjYmSLjmsOuhjyqgbEGC7yoGgdb/zjoZhxAaNAGqYRY
-xQQ1r+Em1iu7RBHRa+9CjQmcJdE94mJf06G2s/M1/wFg3AnXzSedtkf+fkgCkCtD
-p/4hAfI6brrVcsi7ExAaTG3UVGyqGmRfD3GqZx+ljLFcQWGxmJ5rFtHfIkbyyxvH
-CJ7zxfhbETBX1SBpLS5eqffxpikmhbt1jtmFujjlrv68gIWJ4M52fsM2qb8SwLTW
-dPDulCS5c3f7Lvj/gYgBFHW96r05HQVyZTWaxBTWQuOP+1ZcXD7uwqs7tnkdOwmh
-ptKAtFTRTWqJAhwEEAEKAAYFAlkojKwACgkQnEn0IUcIVRjqMxAAnQk5LSR4/HlE
-wir0QjRIL4mtfL8m43gbuLRgZ6zvpi53t+VhmaDyzweAPeRBSVQ4KHHvXEQyjgjm
-lOrGg90NSAde3h5TSx19+pcApNGzQcTKbB6opK1NvCWf7DHeCcix9zgesSpEAwST
-rTn9SG92Om9fZojNKhXJA4VD/hb2fyXZhs4LgNs0Rg3WkksYKrWdIlynx/MzoFDC
-oukpXKMsnwZclwhAbyhQ63tG6l2cgmMUo+leyORsX6yUiCrtz7eR2lTo4U2ELE1Q
-F+0pTKH+bEQv62T6FsbuRqzZEjjtrR8ECaTVRqJPFT72OBW6dhWgJ5djC2JKR26O
-z1SmWgEWSald7jQZ+JTvS06zJ0KicPBPJjd+iIpgjhnZgSZaj7iB7wR9/Xftye32
-dHgyHmdFpxuqjJqSC7zsIPieBrzkaoQaH95z6E6pApfo6Iecw0SltDKe2BkK37/Q
-jYfH43j5IUuo7YaUkrkLx5wfRSmnqd25tP914jxI76HvlJr4fqkMkhQguwSsImS0
-1ZTpvA7zAzgkIJFTinTyTOx797fjuA94PYLQcGSY8RkMG4E1ZXUQ/wyKzNntey7X
-4xf6v1FWqwFm4FZ+yYw7GY5m04HXDBvDwRmUOGGO/MjLjKhWu4z8KRCUE/0oJ5rx
-bN287GzZAZK9gDaPVFKqWHiOrcc5TSaJAiIEEwEKAAwFAlkk9CMFgweGH4AACgkQ
-A+K/Hg+1K8buiw/9F7/xI70mxSBN9SzOCB5Twz0rikBWxzZnDOvUW8SUh/VrRVas
-C1nJ8Mv74eVu7df0qNi4SuVtuftzIfcdmn0VYdkWKhZJ9wDkUeE7/2rTu0sJtMyM
-MKw7/AyMprDFKJxVHfuVckv4u1Lt5v2JuFpvLsQ3qLFshefYbuZ49vtKjgJeYclF
-a5BUFY3J2nUrXoyzAxkEpu+05TRJ18tqWW+SYL6UntJLJxQL1pPDnz8/BW5AJVoW
-aGGVKS908IGYwFvtDZIkR/OO/4cqenANos2oRMvo7IveaS4gBwEuU73vJySBzHW5
-UAbJX41KGqp6uVjOCL6DcsDxHVgXhago+9jgc3OUo+1oT5eUviX7k4ru3St0HGhX
-a9c+Xp6D5g6Z1OLqQmRpGqQO1oR4Af04wh6dKiNhbFnd9oP3kmQqzGZOVp2YJsvT
-EbCZmLa3bX/Il8wy0hgMD53jhO38ZXJuH6vJYVLT7/0u1YoGRcAw1DhwslTzPjMo
-EK2X4+rzytN5KOivDznP9qy1vGJbpNc8DLcO6zMbAlSdmXvamqjbO6u8RWOeyViu
-KTU7ek9pzlrMqwYm4/Z3X/NfcbzWJmJmgLpeASNcKUuks3cIOx2uWrVBTFiI+JYL
-Q4FiFPKyBeAignGpHLateWULJSq8PztTNhQnndD9Qxb9cLUVuhdjMAPltZrR/wAA
-SCD/AABIGwEQAAEBAAAAAAAAAAAAAAAA/9j/4AAQSkZJRgABAgEBLAEsAAD/4Q10
-RXhpZgAATU0AKgAAAAgACgEPAAIAAAASAAAAhgEQAAIAAAAMAAAAmAESAAMAAAAB
-AAEAAAEaAAUAAAABAAAApAEbAAUAAAABAAAArAEoAAMAAAABAAIAAAExAAIAAAAU
-AAAAtAEyAAIAAAAUAAAAyAITAAMAAAABAAIAAIdpAAQAAAABAAAA3AAAAxROSUtP
-TiBDT1JQT1JBVElPTgBOSUtPTiBEMzAwUwAAAAEsAAAAAQAAASwAAAABQWRvYmUg
-UGhvdG9zaG9wIDcuMAAyMDE2OjAzOjA1IDEwOjM2OjE4AAAmgpoABQAAAAEAAAKq
-gp0ABQAAAAEAAAKyiCIAAwAAAAEAAQAAiCcAAwAAAAEAyAAAkAAABwAAAAQwMjIx
-kAMAAgAAABQAAAK6kAQAAgAAABQAAALOkQEABwAAAAQBAgMAkQIABQAAAAEAAALi
-kgQACgAAAAEAAALqkgUABQAAAAEAAALykgcAAwAAAAEAAgAAkggAAwAAAAEAAAAA
-kgkAAwAAAAEADQAAkgoABQAAAAEAAAL6kpAAAgAAAAM3NQAAkpEAAgAAAAM3NQAA
-kpIAAgAAAAM3NQAAoAAABwAAAAQwMTAwoAEAAwAAAAEAAQAAoAIABAAAAAEAAABW
-oAMABAAAAAEAAACAohcAAwAAAAEAAgAAowAABwAAAAEDAAAAowEABwAAAAEBAAAA
-owIABwAAAAgAAAMCpAEAAwAAAAEAAAAApAIAAwAAAAEAAQAApAMAAwAAAAEAAAAA
-pAQABQAAAAEAAAMKpAUAAwAAAAEAaQAApAYAAwAAAAEAAAAApAcAAwAAAAEAAAAA
-pAgAAwAAAAEAAAAApAkAAwAAAAEAAAAApAoAAwAAAAEAAAAApAwAAwAAAAEAAAAA
-6h0ACQAAAAEAAAAAAAAAAAAAAAoAAAnEAAAAOAAAAAoyMDEyOjAzOjI0IDA5OjE0
-OjQ5ADIwMTI6MDM6MjQgMDk6MTQ6NDkAAAAAAQAAAAEAAAAAAAAABgAAAB4AAAAK
-AAACvAAAAAoAAgACAAEBAgAAAAEAAAABAAAABgEDAAMAAAABAAYAAAEaAAUAAAAB
-AAADYgEbAAUAAAABAAADagEoAAMAAAABAAIAAAIBAAQAAAABAAADcgICAAQAAAAB
-AAAJ+gAAAAAAAABIAAAAAQAAAEgAAAAB/9j/4AAQSkZJRgABAgEASABIAAD/7QAM
-QWRvYmVfQ00AAf/uAA5BZG9iZQBkgAAAAAH/2wCEAAwICAgJCAwJCQwRCwoLERUP
-DAwPFRgTExUTExgRDAwMDAwMEQwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwB
-DQsLDQ4NEA4OEBQODg4UFA4ODg4UEQwMDAwMEREMDAwMDAwRDAwMDAwMDAwMDAwM
-DAwMDAwMDAwMDAwMDAwMDP/AABEIAIAAVgMBIgACEQEDEQH/3QAEAAb/xAE/AAAB
-BQEBAQEBAQAAAAAAAAADAAECBAUGBwgJCgsBAAEFAQEBAQEBAAAAAAAAAAEAAgME
-BQYHCAkKCxAAAQQBAwIEAgUHBggFAwwzAQACEQMEIRIxBUFRYRMicYEyBhSRobFC
-IyQVUsFiMzRygtFDByWSU/Dh8WNzNRaisoMmRJNUZEXCo3Q2F9JV4mXys4TD03Xj
-80YnlKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vY3R1dnd4eXp7fH1+f3EQACAgEC
-BAQDBAUGBwcGBTUBAAIRAyExEgRBUWFxIhMFMoGRFKGxQiPBUtHwMyRi4XKCkkNT
-FWNzNPElBhaisoMHJjXC0kSTVKMXZEVVNnRl4vKzhMPTdePzRpSkhbSVxNTk9KW1
-xdXl9VZmdoaWprbG1ub2JzdHV2d3h5ent8f/2gAMAwEAAhEDEQA/AOtlPKilKjXs
-pUS5NKzerdf6b0pv6zZNpEtpZq8/+Q/tJKdFz4Ud64PO+vmfaSMStmOzsT73f9L2
-qh/zo64XT9rfqdOB/BLVNPpm9LeuBwvrp1Spw+0BuTX3Dhtd/nsXT9K+sXT+pxWx
-xqyCP5l+hP8AUd9F6Sqdfem3qMpShamW8pKBOoSSU//Q6uUlGU6jXuL9aevjo2EB
-VBy75bSD2H51v9leZ3W5GTY621xe5+rnuOpP9Zb314yDk/WA0gy2hrKwPAn3v/6p
-aGL9WsQ0M9SZIBJ+KbKYjv1ZIQMnj2sdOvEaBGbU8gDw4Xb0/VLpz2aOcJ81Zq+p
-uFuHvO0c6IDKCu9kjq8AK7QRDTr28kSux9LwdQRqDwRHgvTG/VHp2hbOniqXWPqd
-hPxn2VSx7QSI8UePwR7fij+rHWrM+g0ZJnIpAh3dzfF38tbi88+rt9mH12mt7oaX
-bD20d7dV6EixkKJ1CSY/SCSCqf/R6hOoylOmqjXvm/1laXfWm8Dk2MGn9Vq6ug/o
-2jwAWRm4Ys+td2SSLKX1iyst1iA2v3f1XIWf1XLqs21Wsx6xo0OAcXR+cocgMiAG
-xi9INvX4Za5u2dVdr9phcH0z6xZbsgMsfXY0mAWDaumOdbXV9oa5r2kQGyJlNojQ
-sgIkLBejqnbqqnVX+nh2u8Gklc7ifW7qN73VVY9ToMSbFs15Ts3HczKqNTi2Hxq2
-D+cHKTos6vntNM9cxXs5NrTHkTK9CJ1XEYOI+r6zjFMkU3O1Pg0bmrtZTmE7qJ9w
-SUSfcEkkP//S6aVDIYbKLa2mC9jmg+ZCknlRsgNG3lsBhFewumwAbieRMqvl9L3W
-m0MBdwDPbwWjkUNoyro+k4yR5fm/9UpCwFsKqbBb1CRvvq4VfSSLRuaGiDx2B5hd
-aem05HTsfZLRUNuyfadNvvWFdlU0PFlphvA0mSuhweq4LsRkP+lDQAJ1PwTgSTqq
-UQBoHFp+q9H2hrn0vD2SGuZrAOnYrbxemnHoNLPVfOm6wwBP0p1Vuq9rrHVuG1ze
-QrTyAyB4J248mMiuwvs47ekYOJbk9RxqW2ZcucdzjoDH6NrW/R9oRidUYVek+7IA
-htrWyPFw03KvKdG2PLwgADfe1fnJJvzkk5if/9PpAU6hKeVGvavUqK3477do9Rg0
-fGsA6iVz2RlGmh1gBMcBdW4BzS12oIgjyK5XPrOJe+q36HIJ4LezlFkjsWxgnQIt
-yXWZWdDXEMb2LiFsdPx8vHktvr9OQateTEO7fSVB9eLTY3Krx2vg6vboQtTA69jZ
-JbS3Ge/WA0agGUBVaaBlNdTq26s6/Ju3MLXWVNJZZWdzSW/Tqe5vs9y3w47Qe5Eq
-s19DNuOxrWOa3dsboAERj/UcGD4u+CIWk9GFt73tFZ0a0n5oUoRzcSzMuxWWt+0V
-Oh9R0cPzvon6SnKfWzXkbJX/ADklGfckgh//1OhlPKiCko7XspWB9bcSy/GD6jD4
-LQfMe9q3pXOda67Q/qbejVQ9zWufe/8AdcB7Km/yv9IgdQa6arobgd9PteX6f1R9
-Vn2bK0aNHNd4rbxeq4GIwurLWOBJBaOZ4lU7ekjNsnYCR+cQr2J9WMBsG2ve7wJM
-fcmHhOuzOOMaaHxK/R8zN6j1P7TSCag0tseZieB/aXZ4lQrr/lH6RKz8HGqpaK6m
-BjW8BogKp1/rgprPT8N/6d4i6wf4Np5b/wAa9GEZZJCMBqUEiETKRcPrdVOX9YH9
-Rx3loraGktP0nM9rXLpMPIGTi13AyXN939YaP/6S5eoAMgCPJaHRs+qh78W9wYHu
-3Vk8SfpNWjn5XgwREfVKG5/evdoxzcWQk6CTuTqkoyks1sv/1d6VS6l1vp3S9v2y
-3a5+rWNG50fvR+6iZ2djYGM/KyXba2feT2Y3+U5eX9Tz7up592ZcTDyS1vO1g+gz
-+y1NhDi32XSlT0HVvrrlZYdX04HGxhp6p/nH/D/RNXNYWYaep1ZDySC+Hk8nf7XH
-/pIdVptYQ/2smGR2QbGGTPbupTEcNAaFaJG76h9B6df6VrmkgsPE9itUX1DUu0C5
-nBsNuLTfqC9gn4jQp+oZzqmejSf0juT+6FTjjlOQjEWW6ZxjHiOzf6v9ZLgTiYB2
-k6WW9x5N/lLLxhA11MySeST3Kq49Ue48+PmtCpsLa5bBHFGh8x+aTm5sxyHXboEo
-gR5rOtudfmH0xLK/a09ifznK3lWllW1ph7/a0+H7zv7Kz7ngbaKPpN0kefKmmWKI
-dFnVrhgWYpduYYa0zq33D2/1UlmM2+hY0HuJd2mQkofbhvwjfj/w/lZOI9/6v0f/
-1uY+tXWv2jlmml04tB21/wAp359n/kFi7QGR3dyokkannspMPt1UwAAoLSeqNzYa
-GjQBScJGvPdSjci4+BmZz7G4VRtdQwvsIjQfP6TkTQFlTbq6z9l6bTSwS4AgvHIM
-n2tWcOpZAuFgjaNNh1kfynfvIJa52pM/FSbT4psYmPy6dSepXSlxfNrWgehwcinJ
-qD6jxo5p5B81er5XLY9tuLYLK+e47Efulbf7QYcN+RWdY2hvcOOkK9iy2PVpIBry
-hrp1XyLhY6ws12exg8/zv+kqhPpQyv3XP5PhKGx5poB/Odwog202tA/nHQT5T2QM
-rr+W6QG96DPspo/P5B80k3rEmRyOT5pJ9R/Dh+iNf2v/2f/tD9JQaG90b3Nob3Ag
-My4wADhCSU0EJQAAAAAAEAAAAAAAAAAAAAAAAAAAAAA4QklNA+0AAAAAABABLAAA
-AAEAAQEsAAAAAQABOEJJTQQmAAAAAAAOAAAAAAAAAAAAAD+AAAA4QklNBA0AAAAA
-AAQAAAAeOEJJTQQZAAAAAAAEAAAAHjhCSU0D8wAAAAAACQAAAAAAAAAAAQA4QklN
-BAoAAAAAAAEAADhCSU0nEAAAAAAACgABAAAAAAAAAAE4QklNA/UAAAAAAEgAL2Zm
-AAEAbGZmAAYAAAAAAAEAL2ZmAAEAoZmaAAYAAAAAAAEAMgAAAAEAWgAAAAYAAAAA
-AAEANQAAAAEALQAAAAYAAAAAAAE4QklNA/gAAAAAAHAAAP//////////////////
-//////////8D6AAAAAD/////////////////////////////A+gAAAAA////////
-/////////////////////wPoAAAAAP////////////////////////////8D6AAA
-OEJJTQQIAAAAAAAQAAAAAQAAAkAAAAJAAAAAADhCSU0EHgAAAAAABAAAAAA4QklN
-BBoAAAAAA2UAAAAGAAAAAAAAAAAAAACAAAAAVgAAABgAUAByAG8AZgBpAGwAZQAg
-ACgAcgBlAHMAaQB6AGUAZAApACAALQAgAHQAaQBuAHkAAAABAAAAAAAAAAAAAAAA
-AAAAAAAAAAEAAAAAAAAAAAAAAFYAAACAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAA
-AAAAAAAAAAAAAAAAEAAAAAEAAAAAAABudWxsAAAAAgAAAAZib3VuZHNPYmpjAAAA
-AQAAAAAAAFJjdDEAAAAEAAAAAFRvcCBsb25nAAAAAAAAAABMZWZ0bG9uZwAAAAAA
-AAAAQnRvbWxvbmcAAACAAAAAAFJnaHRsb25nAAAAVgAAAAZzbGljZXNWbExzAAAA
-AU9iamMAAAABAAAAAAAFc2xpY2UAAAASAAAAB3NsaWNlSURsb25nAAAAAAAAAAdn
-cm91cElEbG9uZwAAAAAAAAAGb3JpZ2luZW51bQAAAAxFU2xpY2VPcmlnaW4AAAAN
-YXV0b0dlbmVyYXRlZAAAAABUeXBlZW51bQAAAApFU2xpY2VUeXBlAAAAAEltZyAA
-AAAGYm91bmRzT2JqYwAAAAEAAAAAAABSY3QxAAAABAAAAABUb3AgbG9uZwAAAAAA
-AAAATGVmdGxvbmcAAAAAAAAAAEJ0b21sb25nAAAAgAAAAABSZ2h0bG9uZwAAAFYA
-AAADdXJsVEVYVAAAAAEAAAAAAABudWxsVEVYVAAAAAEAAAAAAABNc2dlVEVYVAAA
-AAEAAAAAAAZhbHRUYWdURVhUAAAAAQAAAAAADmNlbGxUZXh0SXNIVE1MYm9vbAEA
-AAAIY2VsbFRleHRURVhUAAAAAQAAAAAACWhvcnpBbGlnbmVudW0AAAAPRVNsaWNl
-SG9yekFsaWduAAAAB2RlZmF1bHQAAAAJdmVydEFsaWduZW51bQAAAA9FU2xpY2VW
-ZXJ0QWxpZ24AAAAHZGVmYXVsdAAAAAtiZ0NvbG9yVHlwZWVudW0AAAARRVNsaWNl
-QkdDb2xvclR5cGUAAAAATm9uZQAAAAl0b3BPdXRzZXRsb25nAAAAAAAAAApsZWZ0
-T3V0c2V0bG9uZwAAAAAAAAAMYm90dG9tT3V0c2V0bG9uZwAAAAAAAAALcmlnaHRP
-dXRzZXRsb25nAAAAAAA4QklNBBQAAAAAAAQAAAABOEJJTQQMAAAAAAoWAAAAAQAA
-AFYAAACAAAABBAAAggAAAAn6ABgAAf/Y/+AAEEpGSUYAAQIBAEgASAAA/+0ADEFk
-b2JlX0NNAAH/7gAOQWRvYmUAZIAAAAAB/9sAhAAMCAgICQgMCQkMEQsKCxEVDwwM
-DxUYExMVExMYEQwMDAwMDBEMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMAQ0L
-Cw0ODRAODhAUDg4OFBQODg4OFBEMDAwMDBERDAwMDAwMEQwMDAwMDAwMDAwMDAwM
-DAwMDAwMDAwMDAwMDAz/wAARCACAAFYDASIAAhEBAxEB/90ABAAG/8QBPwAAAQUB
-AQEBAQEAAAAAAAAAAwABAgQFBgcICQoLAQABBQEBAQEBAQAAAAAAAAABAAIDBAUG
-BwgJCgsQAAEEAQMCBAIFBwYIBQMMMwEAAhEDBCESMQVBUWETInGBMgYUkaGxQiMk
-FVLBYjM0coLRQwclklPw4fFjczUWorKDJkSTVGRFwqN0NhfSVeJl8rOEw9N14/NG
-J5SkhbSVxNTk9KW1xdXl9VZmdoaWprbG1ub2N0dXZ3eHl6e3x9fn9xEAAgIBAgQE
-AwQFBgcHBgU1AQACEQMhMRIEQVFhcSITBTKBkRShsUIjwVLR8DMkYuFygpJDUxVj
-czTxJQYWorKDByY1wtJEk1SjF2RFVTZ0ZeLys4TD03Xj80aUpIW0lcTU5PSltcXV
-5fVWZnaGlqa2xtbm9ic3R1dnd4eXp7fH/9oADAMBAAIRAxEAPwDrZTyopSo17KVE
-uTSs3q3X+m9Kb+s2TaRLaWavP/kP7SSnRc+FHeuDzvr5n2kjErZjs7E+93/S9qof
-86OuF0/a36nTgfwS1TT6ZvS3rgcL66dUqcPtAbk19w4bXf57F0/SvrF0/qcVscas
-gj+ZfoT/AFHfRekqnX3pt6jKUoWplvKSgTqEklP/0OrlJRlOo17i/Wnr46NhAVQc
-u+W0g9h+db/ZXmd1uRk2OttcXufq57jqT/WW99eMg5P1gNIMtoaysDwJ97/+qWhi
-/VrENDPUmSASfimymI79WSEDJ49rHTrxGgRm1PIA8OF29P1S6c9mjnCfNWavqbhb
-h7ztHOiAygrvZI6vACu0EQ069vJErsfS8HUEag8ER4L0xv1R6doWzp4ql1j6nYT8
-Z9lUse0EiPFHj8Ee34o/qx1qzPoNGSZyKQId3c3xd/LW4vPPq7fZh9dpre6Gl2w9
-tHe3VehIsZCidQkmP0gkgqn/0eoTqMpTpqo175v9ZWl31pvA5NjBp/VauroP6No8
-AFkZuGLPrXdkkiyl9YsrLdYgNr939VyFn9Vy6rNtVrMesaNDgHF0fnKHIDIgBsYv
-SDb1+GWubtnVXa/aYXB9M+sWW7IDLH12NJgFg2rpjnW11faGua9pEBsiZTaI0LIC
-JCwXo6p26qp1V/p4drvBpJXO4n1u6je91VWPU6DEmxbNeU7Nx3MyqjU4th8atg/n
-Byk6LOr57TTPXMV7OTa0x5EyvQidVxGDiPq+s4xTJFNztT4NG5q7WU5hO6ifcElE
-n3BJJD//0umlQyGGyi2tpgvY5oPmQpJ5UbIDRt5bAYRXsLpsAG4nkTKr5fS91ptD
-AXcAz28Fo5FDaMq6PpOMkeX5v/VKQsBbCqmwW9Qkb76uFX0ki0bmhog8dgeYXWnp
-tOR07H2S0VDbsn2nTb71hXZVNDxZaYbwNJkrocHquC7EZD/pQ0ACdT8E4Ek6qlEA
-aBxafqvR9oa59Lw9khrmawDp2K28Xppx6DSz1XzpusMAT9KdVbqva6x1bhtc3kK0
-8gMgeCduPJjIrsL7OO3pGDiW5PUcaltmXLnHc46Ax+ja1v0faEYnVGFXpPuyAIba
-1sjxcNNyrynRtjy8IAA33tX5ySb85JOYn//T6QFOoSnlRr2r1Kit+O+3aPUYNHxr
-AOolc9kZRpodYATHAXVuAc0tdqCII8iuVz6ziXvqt+hyCeC3s5RZI7FsYJ0CLcl1
-mVnQ1xDG9i4hbHT8fLx5Lb6/TkGrXkxDu30lQfXi02Nyq8dr4Or26ELUwOvY2SW0
-txnv1gNGoBlAVWmgZTXU6turOvybtzC11lTSWWVnc0lv06nub7Pct8OO0HuRKrNf
-Qzbjsa1jmt3bG6ABEY/1HBg+LvgiFpPRhbe97RWdGtJ+aFKEc3EszLsVlrftFTof
-UdHD876J+kpyn1s15GyV/wA5JRn3JIIf/9ToZTyogpKO17KVgfW3Esvxg+ow+C0H
-zHvat6VznWuu0P6m3o1UPc1rn3v/AHXAeypv8r/SIHUGumq6G4HfT7Xl+n9UfVZ9
-mytGjRzXeK28XquBiMLqy1jgSQWjmeJVO3pIzbJ2AkfnEK9ifVjAbBtr3u8CTH3J
-h4TrszjjGmh8Sv0fMzeo9T+00gmoNLbHmYngf2l2eJUK6/5R+kSs/BxqqWiupgY1
-vAaICqdf64Kaz0/Df+neIusH+DaeW/8AGvRhGWSQjAalBIhEykXD63VTl/WB/Ucd
-5aK2hpLT9JzPa1y6TDyBk4tdwMlzfd/WGj/+kuXqADIAjyWh0bPqoe/FvcGB7t1Z
-PEn6TVo5+V4MERH1Shuf3r3aMc3FkJOgk7k6pKMpLNbL/9XelUupdb6d0vb9st2u
-fq1jRudH70fuomdnY2BjPysl22tn3k9mN/lOXl/U8+7qefdmXEw8ktbztYPoM/st
-TYQ4t9l0pU9B1b665WWHV9OBxsYaeqf5x/w/0TVzWFmGnqdWQ8kgvh5PJ3+1x/6S
-HVabWEP9rJhkdkGxhkz27qUxHDQGhWiRu+ofQenX+la5pILDxPYrVF9Q1LtAuZwb
-Dbi036gvYJ+I0KfqGc6pno0n9I7k/uhU445TkIxFlumcYx4js3+r/WS4E4mAdpOl
-lvceTf5Sy8YQNdTMknkk9yquPVHuPPj5rQqbC2uWwRxRofMfmk5ubMch126BKIEe
-azrbnX5h9MSyv2tPYn85yt5VpZVtaYe/2tPh+87+ys+54G2ij6TdJHnyppliiHRZ
-1a4YFmKXbmGGtM6t9w9v9VJZjNvoWNB7iXdpkJKH24b8I34/8P5WTiPf+r9H/9bm
-PrV1r9o5ZppdOLQdtf8AKd+fZ/5BYu0Bkd3cqJJGp57KTD7dVMAAKC0nqjc2Gho0
-AUnCRrz3Uo3IuPgZmc+xuFUbXUML7CI0Hz+k5E0BZU26us/Zem00sEuAILxyDJ9r
-VnDqWQLhYI2jTYdZH8p37yCWudqTPxUm0+KbGJj8unUnqV0pcXza1oHocHIpyag+
-o8aOaeQfNXq+Vy2Pbbi2CyvnuOxH7pW3+0GHDfkVnWNob3DjpCvYstj1aSAa8oa6
-dV8i4WOsLNdnsYPP87/pKoT6UMr91z+T4ShseaaAfzncKINtNrQP5x0E+U9kDK6/
-lukBvegz7KaPz+QfNJN6xJkcjk+aSfUfw4fojX9r/9k4QklNBCEAAAAAAFUAAAAB
-AQAAAA8AQQBkAG8AYgBlACAAUABoAG8AdABvAHMAaABvAHAAAAATAEEAZABvAGIA
-ZQAgAFAAaABvAHQAbwBzAGgAbwBwACAANwAuADAAAAABADhCSU0EBgAAAAAABwAD
-AAAAAQEA/+ESSGh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8APD94cGFja2V0
-IGJlZ2luPSfvu78nIGlkPSdXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQnPz4KPD9h
-ZG9iZS14YXAtZmlsdGVycyBlc2M9IkNSIj8+Cjx4OnhhcG1ldGEgeG1sbnM6eD0n
-YWRvYmU6bnM6bWV0YS8nIHg6eGFwdGs9J1hNUCB0b29sa2l0IDIuOC4yLTMzLCBm
-cmFtZXdvcmsgMS41Jz4KPHJkZjpSREYgeG1sbnM6cmRmPSdodHRwOi8vd3d3Lncz
-Lm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjJyB4bWxuczppWD0naHR0cDov
-L25zLmFkb2JlLmNvbS9pWC8xLjAvJz4KCiA8cmRmOkRlc2NyaXB0aW9uIGFib3V0
-PSd1dWlkOmUxZjZmZGE5LWUyZWYtMTFlNS1hYzQ3LWRkYTJjNDYwZjdlYScKICB4
-bWxuczp4YXBNTT0naHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyc+CiAg
-PHhhcE1NOkRvY3VtZW50SUQ+YWRvYmU6ZG9jaWQ6cGhvdG9zaG9wOmUxZjZmZGEy
-LWUyZWYtMTFlNS1hYzQ3LWRkYTJjNDYwZjdlYTwveGFwTU06RG9jdW1lbnRJRD4K
-IDwvcmRmOkRlc2NyaXB0aW9uPgoKPC9yZGY6UkRGPgo8L3g6eGFwbWV0YT4KICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-IAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAog
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAK
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
-ICAgICAgICAgICAgCjw/eHBhY2tldCBlbmQ9J3cnPz7/4gxYSUNDX1BST0ZJTEUA
-AQEAAAxITGlubwIQAABtbnRyUkdCIFhZWiAHzgACAAkABgAxAABhY3NwTVNGVAAA
-AABJRUMgc1JHQgAAAAAAAAAAAAAAAAAA9tYAAQAAAADTLUhQICAAAAAAAAAAAAAA
-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFjcHJ0AAABUAAA
-ADNkZXNjAAABhAAAAGx3dHB0AAAB8AAAABRia3B0AAACBAAAABRyWFlaAAACGAAA
-ABRnWFlaAAACLAAAABRiWFlaAAACQAAAABRkbW5kAAACVAAAAHBkbWRkAAACxAAA
-AIh2dWVkAAADTAAAAIZ2aWV3AAAD1AAAACRsdW1pAAAD+AAAABRtZWFzAAAEDAAA
-ACR0ZWNoAAAEMAAAAAxyVFJDAAAEPAAACAxnVFJDAAAEPAAACAxiVFJDAAAEPAAA
-CAx0ZXh0AAAAAENvcHlyaWdodCAoYykgMTk5OCBIZXdsZXR0LVBhY2thcmQgQ29t
-cGFueQAAZGVzYwAAAAAAAAASc1JHQiBJRUM2MTk2Ni0yLjEAAAAAAAAAAAAAABJz
-UkdCIElFQzYxOTY2LTIuMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-AAAAAAAAAAAAAAAAAAAAAAAAWFlaIAAAAAAAAPNRAAEAAAABFsxYWVogAAAAAAAA
-AAAAAAAAAAAAAFhZWiAAAAAAAABvogAAOPUAAAOQWFlaIAAAAAAAAGKZAAC3hQAA
-GNpYWVogAAAAAAAAJKAAAA+EAAC2z2Rlc2MAAAAAAAAAFklFQyBodHRwOi8vd3d3
-LmllYy5jaAAAAAAAAAAAAAAAFklFQyBodHRwOi8vd3d3LmllYy5jaAAAAAAAAAAA
-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABkZXNjAAAAAAAA
-AC5JRUMgNjE5NjYtMi4xIERlZmF1bHQgUkdCIGNvbG91ciBzcGFjZSAtIHNSR0IA
-AAAAAAAAAAAAAC5JRUMgNjE5NjYtMi4xIERlZmF1bHQgUkdCIGNvbG91ciBzcGFj
-ZSAtIHNSR0IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZGVzYwAAAAAAAAAsUmVmZXJl
-bmNlIFZpZXdpbmcgQ29uZGl0aW9uIGluIElFQzYxOTY2LTIuMQAAAAAAAAAAAAAA
-LFJlZmVyZW5jZSBWaWV3aW5nIENvbmRpdGlvbiBpbiBJRUM2MTk2Ni0yLjEAAAAA
-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAHZpZXcAAAAAABOk/gAUXy4AEM8UAAPtzAAE
-EwsAA1yeAAAAAVhZWiAAAAAAAEwJVgBQAAAAVx/nbWVhcwAAAAAAAAABAAAAAAAA
-AAAAAAAAAAAAAAAAAo8AAAACc2lnIAAAAABDUlQgY3VydgAAAAAAAAQAAAAABQAK
-AA8AFAAZAB4AIwAoAC0AMgA3ADsAQABFAEoATwBUAFkAXgBjAGgAbQByAHcAfACB
-AIYAiwCQAJUAmgCfAKQAqQCuALIAtwC8AMEAxgDLANAA1QDbAOAA5QDrAPAA9gD7
-AQEBBwENARMBGQEfASUBKwEyATgBPgFFAUwBUgFZAWABZwFuAXUBfAGDAYsBkgGa
-AaEBqQGxAbkBwQHJAdEB2QHhAekB8gH6AgMCDAIUAh0CJgIvAjgCQQJLAlQCXQJn
-AnECegKEAo4CmAKiAqwCtgLBAssC1QLgAusC9QMAAwsDFgMhAy0DOANDA08DWgNm
-A3IDfgOKA5YDogOuA7oDxwPTA+AD7AP5BAYEEwQgBC0EOwRIBFUEYwRxBH4EjASa
-BKgEtgTEBNME4QTwBP4FDQUcBSsFOgVJBVgFZwV3BYYFlgWmBbUFxQXVBeUF9gYG
-BhYGJwY3BkgGWQZqBnsGjAadBq8GwAbRBuMG9QcHBxkHKwc9B08HYQd0B4YHmQes
-B78H0gflB/gICwgfCDIIRghaCG4IggiWCKoIvgjSCOcI+wkQCSUJOglPCWQJeQmP
-CaQJugnPCeUJ+woRCicKPQpUCmoKgQqYCq4KxQrcCvMLCwsiCzkLUQtpC4ALmAuw
-C8gL4Qv5DBIMKgxDDFwMdQyODKcMwAzZDPMNDQ0mDUANWg10DY4NqQ3DDd4N+A4T
-Di4OSQ5kDn8Omw62DtIO7g8JDyUPQQ9eD3oPlg+zD88P7BAJECYQQxBhEH4QmxC5
-ENcQ9RETETERTxFtEYwRqhHJEegSBxImEkUSZBKEEqMSwxLjEwMTIxNDE2MTgxOk
-E8UT5RQGFCcUSRRqFIsUrRTOFPAVEhU0FVYVeBWbFb0V4BYDFiYWSRZsFo8WshbW
-FvoXHRdBF2UXiReuF9IX9xgbGEAYZRiKGK8Y1Rj6GSAZRRlrGZEZtxndGgQaKhpR
-GncanhrFGuwbFBs7G2MbihuyG9ocAhwqHFIcexyjHMwc9R0eHUcdcB2ZHcMd7B4W
-HkAeah6UHr4e6R8THz4faR+UH78f6iAVIEEgbCCYIMQg8CEcIUghdSGhIc4h+yIn
-IlUigiKvIt0jCiM4I2YjlCPCI/AkHyRNJHwkqyTaJQklOCVoJZclxyX3JicmVyaH
-Jrcm6CcYJ0kneierJ9woDSg/KHEooijUKQYpOClrKZ0p0CoCKjUqaCqbKs8rAis2
-K2krnSvRLAUsOSxuLKIs1y0MLUEtdi2rLeEuFi5MLoIuty7uLyQvWi+RL8cv/jA1
-MGwwpDDbMRIxSjGCMbox8jIqMmMymzLUMw0zRjN/M7gz8TQrNGU0njTYNRM1TTWH
-NcI1/TY3NnI2rjbpNyQ3YDecN9c4FDhQOIw4yDkFOUI5fzm8Ofk6Njp0OrI67zst
-O2s7qjvoPCc8ZTykPOM9Ij1hPaE94D4gPmA+oD7gPyE/YT+iP+JAI0BkQKZA50Ep
-QWpBrEHuQjBCckK1QvdDOkN9Q8BEA0RHRIpEzkUSRVVFmkXeRiJGZ0arRvBHNUd7
-R8BIBUhLSJFI10kdSWNJqUnwSjdKfUrESwxLU0uaS+JMKkxyTLpNAk1KTZNN3E4l
-Tm5Ot08AT0lPk0/dUCdQcVC7UQZRUFGbUeZSMVJ8UsdTE1NfU6pT9lRCVI9U21Uo
-VXVVwlYPVlxWqVb3V0RXklfgWC9YfVjLWRpZaVm4WgdaVlqmWvVbRVuVW+VcNVyG
-XNZdJ114XcleGl5sXr1fD19hX7NgBWBXYKpg/GFPYaJh9WJJYpxi8GNDY5dj62RA
-ZJRk6WU9ZZJl52Y9ZpJm6Gc9Z5Nn6Wg/aJZo7GlDaZpp8WpIap9q92tPa6dr/2xX
-bK9tCG1gbbluEm5rbsRvHm94b9FwK3CGcOBxOnGVcfByS3KmcwFzXXO4dBR0cHTM
-dSh1hXXhdj52m3b4d1Z3s3gReG54zHkqeYl553pGeqV7BHtje8J8IXyBfOF9QX2h
-fgF+Yn7CfyN/hH/lgEeAqIEKgWuBzYIwgpKC9INXg7qEHYSAhOOFR4Wrhg6GcobX
-hzuHn4gEiGmIzokziZmJ/opkisqLMIuWi/yMY4zKjTGNmI3/jmaOzo82j56QBpBu
-kNaRP5GokhGSepLjk02TtpQglIqU9JVflcmWNJaflwqXdZfgmEyYuJkkmZCZ/Jpo
-mtWbQpuvnByciZz3nWSd0p5Anq6fHZ+Ln/qgaaDYoUehtqImopajBqN2o+akVqTH
-pTilqaYapoum/adup+CoUqjEqTepqaocqo+rAqt1q+msXKzQrUStuK4trqGvFq+L
-sACwdbDqsWCx1rJLssKzOLOutCW0nLUTtYq2AbZ5tvC3aLfguFm40blKucK6O7q1
-uy67p7whvJu9Fb2Pvgq+hL7/v3q/9cBwwOzBZ8Hjwl/C28NYw9TEUcTOxUvFyMZG
-xsPHQce/yD3IvMk6ybnKOMq3yzbLtsw1zLXNNc21zjbOts83z7jQOdC60TzRvtI/
-0sHTRNPG1EnUy9VO1dHWVdbY11zX4Nhk2OjZbNnx2nba+9uA3AXcit0Q3ZbeHN6i
-3ynfr+A24L3hROHM4lPi2+Nj4+vkc+T85YTmDeaW5x/nqegy6LzpRunQ6lvq5etw
-6/vshu0R7ZzuKO6070DvzPBY8OXxcvH/8ozzGfOn9DT0wvVQ9d72bfb794r4Gfio
-+Tj5x/pX+uf7d/wH/Jj9Kf26/kv+3P9t////7gAOQWRvYmUAZAAAAAAB/9sAhAAK
-BwcHCAcKCAgKDwoICg8SDQoKDRIUEBASEBAUEQwMDAwMDBEMDAwMDAwMDAwMDAwM
-DAwMDAwMDAwMDAwMDAwMAQsMDBUTFSIYGCIUDg4OFBQODg4OFBEMDAwMDBERDAwM
-DAwMEQwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAz/wAARCACAAFYDAREAAhEB
-AxEB/90ABAAL/8QBogAAAAcBAQEBAQAAAAAAAAAABAUDAgYBAAcICQoLAQACAgMB
-AQEBAQAAAAAAAAABAAIDBAUGBwgJCgsQAAIBAwMCBAIGBwMEAgYCcwECAxEEAAUh
-EjFBUQYTYSJxgRQykaEHFbFCI8FS0eEzFmLwJHKC8SVDNFOSorJjc8I1RCeTo7M2
-F1RkdMPS4ggmgwkKGBmElEVGpLRW01UoGvLj88TU5PRldYWVpbXF1eX1ZnaGlqa2
-xtbm9jdHV2d3h5ent8fX5/c4SFhoeIiYqLjI2Oj4KTlJWWl5iZmpucnZ6fkqOkpa
-anqKmqq6ytrq+hEAAgIBAgMFBQQFBgQIAwNtAQACEQMEIRIxQQVRE2EiBnGBkTKh
-sfAUwdHhI0IVUmJy8TMkNEOCFpJTJaJjssIHc9I14kSDF1STCAkKGBkmNkUaJ2R0
-VTfyo7PDKCnT4/OElKS0xNTk9GV1hZWltcXV5fVGVmZ2hpamtsbW5vZHV2d3h5en
-t8fX5/c4SFhoeIiYqLjI2Oj4OUlZaXmJmam5ydnp+So6SlpqeoqaqrrK2ur6/9oA
-DAMBAAIRAxEAPwCb1ytsdXFXVxVaWxVYz4Fa5nArueKu54q3zxVrnirXM1xV/9Ca
-1ytsdXFWicVSrWfMel6Ov+lS1nIqtum7n5/yf7LAtMI1D8xNSmJFnEltH2J+NyP9
-l8P/AAuNJS3/ABb5gLVN7Judug/CmNJTGw896vCyi54XMXcMOLf8GmCkMv0fzPpu
-q0jjYxXRG8EmxP8AqN9l8VTeuKHVxVoncYEv/9GZ1ytsdirH/N/mQaHYARUN7cVW
-AH9kD7Uv+xwK8knmubqV5pXLvIas7Ekk/wCthTVrVR679KbDDa0rJC5AA3odsFpp
-eI5lIoh37eI7Y2ilSKSSBwwqpFCD0II/lxS9H8pa7LqNu1vdGtzCAQ3d18W/yxkU
-FkNcCGidxil//9KZVytsdXAryn8wLk3XmQwBqrbokQHgSOb/APEsUhM7TypZG3j9
-SvIqCT7kZinIXMEAmEPkvTHTZnFffCJlTAIuHyLYc1+M8R12yQkWJiE1XyXpnwle
-W3WtN8khLtb8j2D2sksNUkRSQR4jEFBFsL8sXEll5hgikaiFjGewo3w75YeTQe56
-hgQ0T8QxV//TmGVtjq4FeT+a0L+b7kAbmRBt/qrgPJlHmzS3P7pR4AZhOcm1kVZe
-NaHJRUphH8Jp1OTYo+KvHfLA1lB6xJ6VjM/gpJ+7Eq8lghr5gs3TqZlNPYkHJjk0
-y5vTid8WC0n4hir/AP/Ul9cqbHVHfFWA31kJfOM90SJYHjEsbLuAQFj+L/VbK5EE
-bN0IkHcKOo6xewycYpkt4hUKGAYtT9rIRgGyUi7SfM9610qSyRyKTQFBxxlCkwnf
-NlzahLFCLlWWRSKBaitciLbSQgrPzrqc8jQxWsLcTSpk6D5ZZbSQn0V21/bOl5CY
-mKkSBfiWhH2g2KvPdPs3i82i0apEM7bmnRBVcn0aJc3oFcWK0n4hir//1ZbXKmxZ
-coZbaWNTRnRlBHiRgPJlE0QWI6chEXBmrKFHItuRWv8ATMW3Y5NyhrzSOUxmCAvS
-gap6eGETa+BBRaMRMvJQi0NKbUB60yRmoxhmx0qC50y24VVYQF9Ovwt8PH48A5KQ
-k0HlK3+sq0kDh0BCum5AO3UH/hsmJFhKMbut2QWelm2tzCnrSBtuUpoBX7Vd/wDj
-XIgKTamui6fZS3ep2sCyX1WYl2Owan7tVX7PwjJEmkwgCd/4kQT/ALWTDiyFEhZX
-4xixf//WlmVNjdcVYzc26W95cFftMakdqdV/4lmLIbkOwjK4grhKClMg2BAT3cFv
-IJJiVQbA0rU4gWyLKNP1jT3s0Ak3YhFAFfiPyy2PJqINo6G4VpWiYcXU7jCCxI2t
-GSMoSg8MkWtACH0pJ7gCiTKtR/Mw25fdgA3ZmdR/qoeuWOEtr8eBL//XlYOVNjq4
-qgtUt43tpJeAMqAUenxUB3FchMWGzHKixe5u2gt3kUEkdBmNVlzuKhaTtLd6hxVi
-qJXYswH8csAphZknmm215bcitzF6VVMNDsSBRu32sNoopnDqFxdT8o2VpYlJSWM8
-1JX7cTsvwfFgKQf9KyUMeCnuRXJtZKHluHdRGRRVJ6d8IaZy6KNck1rK/HgS/wD/
-0JTXKmxuuKuZVdSrCqsKEexxSwzUYzZ3EkM3931DHoVPRsx5R3cyE7CBkjtIJEu4
-7VXod3TYimAE8mzYb1xJvpvmK1uysC2jyb0CjcA165MmmIkDyDJ1e3TjaxqqMq8v
-TXYAY82slVR/UcRj5t8sVQB1CzkvZ7RJl+swtSSEmjCo5fZP2tj+zlgiatxpHdVr
-ihZX4sCX/9GT1ypsbrirdcUsa86WUlxaK8RpJQqD7g81yB2NtkNwQwjTNXkhk+q3
-Zoo2ZG61xlDqGWPJWxZDZ6xp1mjPGyo4JIKjrXpXIcJLaZhU0O+v9T1b63CCYQpW
-VzXjXoB/rZMig1RPEfJntnCscf8AlH7ROVtjz3XoYLzzLJqdtIUEahCVP2nT4VbN
-nocJkLP0f7twdVMA0PqZXY3QurSKcGpZfi9mGz/8NmLlhwyIZRNi1WvxZSzf/9KT
-A5S2N4q6uKWK695ht31VdDhAdlRpLiT+VwvwRL/lU/vMZx9NssZ9VJFLoy38lfTB
-I/bIyuMqb5RBTGz8paclDLHzbwJNPuriZlRjDKtPtYoEWOFAiLsFUUGQZoLzH5gE
-EbabZPW5cUnkX/daHqo/4tbMzTaY5DZ/u3Hz5hAf02MwqAgAFNumb4CuTqSbTPQ9
-Rht3ktJ3CB25RE9OR2Zc12twkniDkYZgbFP6981TmP8A/9OSVylsS/Vdf0vSeH12
-bgziqxqOTUH7VB+zk4wJQZAML1nz7eXgePTAbW0G3rH+9c+3++ly6GMDcsDJiVhe
-mDVobmQkgvSRj1If4WJ/4LIZBYZYzRD0LTLj0pmUkGM9K9QcwnYJyLiEblhQYFCS
-615pmBNlpx4MdpZh9oDwX/KzN02m49z9DjZ83DsPqSe1Wg3qSTUk9ST3ObyMQBQd
-XI2jhQU98mwSqaZri9PpiqR1VT2J6M2Uk2WwCgj49ZnGnS2jNyQ0VWr8SnkPhr/K
-32coOCPGJdWzjNU//9Q5v9RtdOtXu7p+MSfeT2RR/M2VxiSabCaeP6tqM+q6jPez
-E0kYlUrXig+wg/1VzJAoU1EoWGUzIQ/wR14x07ZKJtBUJIzU17d8hIJZzYSma0gn
-3BkQFvmNjmBIbuwibFt6lqDwx+hA375huf5R4/62ZGn05mbP0NWbNwih9SW20VPi
-PXx983cI0HVyNplCtMtDB13MUh4oaSSfCh8P5m/2OCR2UBLJ3A4W9v8AaXao9/tV
-yqR6BsA6lYnH6tIoPccm7VqMA5J6v//ViPnDXv0nemGBq2duSsdP2m/bk/41TLYR
-oIkbY/xAQju3XJ0xUnWihRsB0GCkrmAK79e+EhU2h1z6ppUECCrgMC46g8j8K+/+
-VmPHELMpN5zERACVDVbkTCQU4jbgd6j/ACm/mzIGaQOzj8LJNPuYLqESRHpsyHqD
-75sMcxIbNEhSYxdctDBL7mcStK0Zr6fwIPf9r/hsgZMgEEW9GkcfxXD/AGj4Vyq6
-2H1M+aK+rp9TNv8A7srUH365Pg9NMb3f/9bl5JA5Hr2+eZDBch+GpwhXU5GuNWhW
-ttOvtQeRbGEzNboXlIpRV+n7Tf5ORnIBkAgSjvuxr7nBSrlg8cIitoi2lltJRLF1
-6MvZh/KcnEmJsMTuyAakhsXuYmo1OIXuHO1PozO8QGNhp4d6S5HMEAP7bdMqB4Qz
-5laDLBMgH961Ca70r2wbg/0l5ph6xJqD8Q6t75fbCn//2YkBPwQTAQgAKQUCVtsP
-xQIbIwUJEkZ2mQcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJleNSIa2E3/
-qzcH/0xVu6Mdd8hfK9D8eet5VweB64YheqrZbjZxGkqDYFxdgDw/zjtBJJZtm2Qg
-bWsKuc4KxiFuQxdh66PMVqs5w9DkruPd013KUQKO/LEN0d7dK2vvyLMJYCqT4Hlt
-tzFKCjQdh2cWB7axYmbqzGfVs/amaKPQUi8xdrQx5NUmJwNyqOTxiqf2vN4hzGg7
-4iV2/hjRHZL7uUjLxXYx6+1udPbNtKkue2ul9IDR+880iA9U9+nhV258Y6VfJmdC
-SoELQaQ8DNJoZVOicqnC8Qb1u6Rue/2bx2uCOhnnpaFP4rmdFYUkauI5/htwO5B2
-9EfJlzXsEYuvRE270JVSAo1oRByJAT8EEwEIACkFAlbbCyUCGyMFCRJGdpkHCwkI
-BwMCAQYVCAIJCgsEFgIDAQIeAQIXgAAKCRCZXjUiGthN/8K0B/9nam8iQ1ZmSlag
-cNgAKpf3Bk5O20nV3XbZ28fYnBp1sh2Gv0dz3IsqRgiPMha+6YqvVYZfA5g8Sp0A
-JAPpSIIWG3R0oz+3NFLjfuiiGJYxjgJA+QONCQhQfX6Esq9igcTjAgNSknXf8opi
-pIniufjnx1mxHGRUXrr+YtbzEUKji0RbKO4xXeCH9GSeT4otqkkKkhx79t4AifOf
-sMNLPCdQACK9ulOecIPeKcwGfN5xLj7qWCwM8Vn6XwysoFZv7G2feiB3JZLmbgmO
-MFlR3Q90d3j2vFW2wEHT23j7xYkNYjwL6bLqjyhPWmqA4FhDdbO2TDnZiaqQF/sR
-lAR02PAEiQIiBBMBCAAMBQJXNXaKBYMHhh+AAAoJEP8fQHwNPCQweyQP/ixm6TzT
-BaBb1/Oy8L9KyTZ5JFq6ZVKcMkOFgzsk5yeA+v/UH2maJ4aB1fR58ijuSGsELTji
-jEVchUta4jyETfR4KtnQXbxnKQqoRMbz7wLENiei0ZO1MIXrmofsiUZQZcefnb4T
-TZqpaRqtYgOuS7MDmufIdVg476TnhecqKre35JKCEtrWWgBqOdCLvNLVjbVrR5sQ
-oVHEkReDDGif9G8Rz5+ciSqlNMn3UjcPDWbmj5CvrzYLkt3bsUwovHQ6I9w1BwjP
-YwRLiR6oqtkHda0M+yCEmwAbcat5s43YAdF9BPOjDNcx0Fb0sOrZPsySQ2IgjNnp
-kc/1SaE9eTWrTOLkHy9tlYznuLjDKLPk0GjNWDV+042uc7iui5aX/6wH3A3yxyB/
-X3n5fxAc3Xr03k8pk7D7bWOFbgRMi1dw2la5gmq87THQ1ZrXGA05d/k8cOM28SQT
-ahe/zmjT4SAvW+W6zNQW2hX98ngmx9ReiW/zzmQBdnISziWc0vvJo3vuaops9DXH
-jvQfrpnwXSOjM1fliPftobeeMr07a6ellDY0sVNlu/thx9xTcyOE/AgWngiTnpOY
-wZ4h9iVhXMI9l8pXFF+/uy5sknJTXEr1m6iFHfmpGi3ADi2ZpOZO1JS+awmmwgAI
-TjawPAwE/BgrRxWMz9gS05Hj/yKo8VY8VWV9iQIcBBABAgAGBQJXOJZ9AAoJEO04
-c/XTJiciR0MQAI+vqI4X8wyVzn4pbYAUyz043Yy/iK+jaky7egLTDR4DUCrzHRuR
-C0Im4daqVJe9Bi1Do3rb8zqddC39Jgeqiu35HnqOln8eXEn/BKgCz3NLDDjcYPHp
-6mQiaFY3BLh1PebKU7dxSsCeXXs1s198i1yz55O+nq1ah1Xia2GA8N45UYiCivSp
-9lu0ZiOUaTG3d4ub6KMizor9DxKfM4NCHYofX3v6ryiuLWhq5a2XnhMmPhfemjcf
-Hey4rtQEleonr7ohCxKu8Z+GpV3M/wdFhClkq9pXvAageUM2xa/d2Cb9NlwLDnh5
-RWi48pQzjFfvG76fjm6vRs0wG4iPSeKjNo34WPF175n4feO9snnfMFAdomWBmUP7
-cNmozymWeG4etOeumeT78x0X2ie3aZ5nkr9rRnXz4jiiX7jQ91+xNjHtebkXtyEz
-9LapwUjeGzgefxhnxYutG1HV2uYULd8Wy8F0p20uEfRtPAuqdtMhQhQB/MqtUlKv
-N5TKRQx4v9FtUNqz8tfCYM8jjytyG9F+G6t6pR/v35V36mtrm8vbCqwBKLgnY89t
-eXN6bBNpJiQiPI0q3zosbUwJ7cAOMEf5NdqpU+LJ2vqTzqLvSyserHpBU9GNVER3
-Y2mtsU9NiQoxQVSgAaz9ORuyD0I3Do6l4YFht/WeZItV0kdooULUvFRQiQIcBBAB
-AgAGBQJYdF6TAAoJED+QLCdu2b4hkpMP/ihBdj2CR95ZU3PuV1DcRtXnNpt/YVZt
-2OB8Kl76dQp+2+9Ci1Di+nVH/Hb2PEi7TDNGgnycWiOcbJfy8N1nwcvbO5jRYRWf
-x+AxbzgLKLB3kVoJG5ostAJ1gLtOXzN+43odS0zCf/7QVx0V91y1DSvQrw3QqY/y
-TujzuYItoodurZGxiy137KF+sZpmnW7kY2fYEqy9Cb3K9BBoltfVjMt0WQl6UoHK
-oB3zHpDE0zYAGWsZDU+1LV+P3+jNYiLisjLPDwp+sExLROqf4iRxehDLszYx1Ztd
-ghNmQtDH06xZuLeewhhW1so4eZoyJaJ+nxjsFoQsm6HO8adqcCDnm0GXpWPgX81r
-12TN0TV0B90V9AU8IGW+WDSWV0nKvU1YTd/1vCpHGtnT8L9fmiLjLi7HkBSydjuv
-mMK7zAg5784EEE6Od37pSkyAbJSoTNYtvA6zQQIS2QAfHmCxO+8H8JdAzR8FBSRe
-i+TWt0n+LPrJEmsDUs3jiEVIbn9jzSSgxa4P176F2t+1C2a91Kaam0AIj/KhHhuo
-dCsZKTeT8S8x91FNLk8tvfdsYrzWT+l0W49wRgdk8VWLskxng30piERZNCsimkax
-uwPRchNRNzomaOB4xNvdc4AW/0SBUYA7E4RruD/AI+vAjVuACs1oJ1NhECasI/xA
-gAv4tvkHpt7diQIcBBABCAAGBQJXQ2ioAAoJEJTTNqNtFZMKLf8P/2yWBCq2CgIE
-5vRZAcRkV8UJM6F7rcSphEH3rgfsU1jobxVPQst4/pacx+5q7LR/heBwhUzC6jT9
-Rwv15FljRFpG0dudXTGervEa/3ZWD7Z4qtJIolPFSOV0ozbu1IZ7POmnQkisNxru
-1uUYjXpUVuiPa0MFVWiy2oVHquY8Y0Gb/CUHPMX/gAETgp+mPsOFjcN1nu30kxHO
-yNw7TRWKigI/iZWDOlZffnZyIGIrvGXor2yTdZntEb2FjiY4K5140cXO2g7WNEu6
-ZkTczUU+eQ0SvOySc3oSOOZbtx4dngsQ41w0oLd6MI7H8zjTk7EM/XqzXdL7vwSw
-tamgVTadw2FSjGdcMyUY8o8zmG3O3wI7SCdEGpBD/E3fg/OHgbXUYDvpejq4bJSO
-b+mjrMoLYd4hD67mpl08bpSG7eUDXRebp7hOQr8lgL8i2peuyVSO8S5ZH+5R0yoC
-iwG3BhHCJ9fC50iKSPv5JNlRfxM2BBzpidA+dQ92KBxREP82AmhEZgJ5OC/rBBJM
-OJGkwr4acf1eiV2Ot4EV3yek3ttVR20C+4PwzqjjvWiIavdRguQAahX2Tq0DTWxd
-E2XroNyoqDazPBmwH5P9gDwn8Nm8FZJRHyuSkUPL4cB9RG3aSWOgCRoaYW+TEW71
-w56J871ENbdxicikBmnOC6Wxrfz0FnO3iQIcBBABCgAGBQJXQ668AAoJEGLUj60W
-oN4BDRwQAIEzBuFGQQxl3OSca76ImRHJc5e2ocIeho9txBjFPHjZuwoAfnaesnNk
-1Rl+Nh0I3LM6QnJUKLCUrnPRxoRFCabU9xtOv4Qsexxj92H21PwiPBWI5ky+uCwc
-LRl69Ranl6ePNmVSz6cSm1S4is5l9Enw2ZIwdJulOrhxAfqD71D861co2Xyp9uvK
-lb/HZ2uQXPtIyBBo/3+DCQxnym76ZJlPF1O4E6++Eqr8X1WMSp/xFKEAxGX6bsDV
-doKuDer9wgwtliKPP/RDXDv/TgsCBcrSKF9ee0EW+AgnEE4cb1qJmfXpHJm7s2PM
-PtMTycGOBZXQohPDNPuyFHku6SRMdu91FsWn3zZzx94Zyss1sj/DqCUG+XzzTzxT
-ULfVsusOIu0JGSy2d+VAnirlm6eJ31/47qlVZBpk0gXcD4Udiilx++OjpNLWZ2ut
-sb+RIQMh1yEFukpCkS7H5yvHs4Oxwnv7I4EOrAo3LJSdCP5vU7M4bzaym43QWdZ3
-53SvNnosgqRdEVGFWGcA1/+3L/QvqHYFTagPcgxmp8pZnvUSDl1xEL/wGNrG7bi7
-NmQKMpAzBkQ4YSu1N5XM3+aBikQGtz/F8j4nZxymO94enQRtYNkX7m3Kayzu88Ku
-ZyrxgqO7U9EUS+Z6hu0ggLPChtxaZbefVfabQw7+XywPNLaZbiQ+iQIcBBABAgAG
-BQJZHXjvAAoJEAqdr2cTuGNJF4gP/2vjd6oJnKpznGiMLZ5vTW+ogc/cVVD2dtvI
-8AtjomA0ix3qhBqOLRaHS66J+PvOH/58SXQPpCHZNQXBv3vD5zKx4J/oHeakTfss
-IjzE7s+BpQpxz5ZtLHKw6Vc3DE1OgszpE7pgmrHUPZnzmXprCQPOgipw3l4igcsc
-MSeAJnXE7tQYD+Pl5op5LqbRbuKe3lYJ3uxZDCiq7SiVf28Z6/WypT9nfkfYd/Hm
-CfzLy5xTPSDsuNVNui5Cgmew0Cf/C8tEUmSLN526Cuy4PFWSHmj9qF2dwRn4kfp2
-54hLRGzZiX0cV/bB4csD99poGkk3Np2d7mOLtgiIJVWSa31hbGXRmF2aVIUr1fuo
-Te5Io3IuDJTYTb2DbOiuOZdvcU7HOfZeI0QhfxYHDMEK9n57rp3CvCmRohovz+hT
-tNSGYXFYzKln6xnZ2FS/o6i/gzAzT9CImJxH/9smAMMtEaeHVAkwBTRxSG+ozRw1
-niWnfgS9hP+ChtilqtjSnFz23Gf0jZxJxaGMPh3v/+D1YefCj7z0bhmRfe2zn+L5
-dUW9yv+jknMlTS+uJsbDdAj5cvkh2P72M0fWqz4iLVEGog5jYfhmIIleX/N3TcBH
-J45znBoTom+j1z5UJ6s4GqVfk4RD9WoeYI6nvHHtNHW9wea4OfDy5uFDOgNUkdE7
-xOffwNBDiQIcBBABCAAGBQJZG5lsAAoJEOQDLcTvDPOKe5sP/2qo26tzH/1JVXwV
-ooIqUWnlv/TXvYm+ZdvP+inIqbh5Wd+UL1q2l0gLKk44AWAVRNWij47tMqjXXq6i
-cD2KH1xvT5z4OworFt/36q0pE7uipTJE6rACTwrhTA/Oc9rmgKw1bE025U4cnAuU
-IgM5QvSQwCzHF5G3N7yEweclY5FFDizx0AYC6OupBywFs0QhMaw0Fb+zZ/2IYW/0
-QxxEEEy19yDZVwq/90bu1YqYYGXNJQrds7j/9X+B1U+Fc0IwugHCRZi4oFR3YEKK
-FL3m8CvEaUJGhIcmJpvxYvLxTxjRXFihTH4i9SEyT+pKs5zclF/yEe5cyk3xhhj6
-Y7AUD7BB04M51QloX5jKZ0R7+qtwV0pvrSmDQf+QCcmbBhdJoUpRcKn7OH8ZxQFt
-T+54dc7M8PdubXr5O31unvXmcZRGex/yBW176h6seEzy+u2G1YHUe99Y56dfcsbV
-qy73gEmTetgYVLArp2js3SbbqZdtcWabtAz4HzEQ+M0zzzgDXpZECh16IpyklYKH
-fGaG7mj82FghcmnOR1GOXIdxs7nldjkgeaT99cw16ODj1QKKwqWX6GJPPRxcsiYT
-HCPtWIief03HAQu4WTRK771725mlp6HWTKvUm8BLIuATrWVdqMIoalHwQys3efJf
-OGJGVHz6zylCjFOq4TsQa8Gju4WMiQIcBBABCAAGBQJZHJMXAAoJED+q0s1ey7MU
-U0MP/2isC7IgIm4si7UpeQcJ1x3iJhGl5XWvk1HtvkO1SjurrFyU9XNSVmFZRRFk
-wZtfiyoEJs6tD7COKOHwwj+CYFtricsc6DSEbqCtk5/Zk6f0yuVCuYBkeE0auZM2
-clwtiJV7Xtqk3VW+hyjaIjro0LmAof+ttJtPlsboV16VIwieVMFv+4T2PTGEkPkg
-VGHV2kuMDjt0x9Jo1RQUb3fMs03na9X0nGtqDt0Grr0lVAx0Igkf95aQ4ii9JnCz
-GkeyxwengUJj7fcLfBwoRTrNnlaWk/GfphgT2IRjMy1hqyi4vopdMn+CyXqggWld
-HZj5RdlVNSM4mmanWowa2uY9fspVDKNpaE4PmN55hdQnKAuDe/HVE4c9KxmKnNVW
-JGvT2cDL+/mS4wNIdV9nQjbJ583XXsijhjFS/0EfA6xkBAdd8/y4Vk4f3bpAAWIy
-VzvhRh3m4BpXzhNvDlfgv1t1s2Meo8izurha6zCqZHsRcQpP/+AjKBjx/v/H/qnx
-8IbQNy8IYmDcqhP+DPQGC+Xdf/TSPm8ODR0ReeXxm5/3UV8Ls6bp0r97jVtWtDUI
-BkqTaDU5xCGGMvxqHWLv5FJnH/cvkVuEiT7jA14YROXhBZubF77Wbfdm/2NTabre
-ug7DST0CrsgHwogx9Td207I9UYSPHp1z0aLIs9jZyVh+/suuiQIcBBABCgAGBQJZ
-G6jVAAoJEG8M2ucAtomd6OMP+waj7f6VlYxOrgFhRTqiG6Va76BQ1fOFD+yU9QOV
-am/KcHhxubarMeNzRQl3Is7XK1a/OTIINOq+cpHfkZK0LvEXxhYkfL3oh5ZVzKHM
-AmdYFoxfehUcAtGzoQVIvg5YLkqeHpxlhoiP8UMDBk4bHXl7NFR3w1cxbrl4Gd8m
-zaIv1Oba+ZnkXjm5K6HL6MLVzthj0N4kvpP/leiDxgjyE4qB71V6dKAVhTnNwep3
-zY0C7Z2h0kB7+indNmukWC+le6zKjmvg3fkM7YDqSlS02Hx/bM3r/81s1jT9aOAH
-j+DVwu7XBQIXISKT9tYwySslc4bCbcAO9Nnn4HhWZ8Y+vEgq+LBGHMLW2hJZqp2c
-d6GrWFlmqb/iQs+h72Tf0Qk03c369vFyIVGG++3wCDr5Nsp5o77lvsgt5/yByAV/
-EB/uhYATX3e/X5IREUhaLBMkGkDY3l4LNYyZ8N2dd7HOG9kdpZuB25YeZ9itboCa
-Id5KCnAINwrA/LcqVjve3sv0l8zzIvhs85YgjTyR7Jc1/9JH7uLWtw4bmH30neX3
-O41/jWxonQhgd5yRQDh/cnqOBvQxXUQTv9y15mySCBZ0brcWwMwTx4AQtTq6k8co
-jOvCGbK2t1Siltcc7nyYOSW0Pbhkxsr91TlBF2UtLpw6qGqD9mxUDCFvYWrj1D2t
-LOYyiQIcBBABCgAGBQJZHipqAAoJEKKrCB8mUY/ulb0QAIq3fUQ5F1sQFEKrz/tC
-vsOb6BeqpOBbZqiCPX5wL/QpFEMJnVmk7Pm51opgHrNm4FE2dPlsotv3WEsSLAmO
-ImTCa0MS1NQvZ9KM3q3xQTKyM7M8gMw7sr8XMc8L9uXGjFWcbUXrD7AFMvZ+bwCL
-Voc/GH63StQJkwVUW3Hv46Jzhi31dBhNhm0hWkcmGYCPsZBX81a/5m6VYD/D+4hf
-gxnPLM9rAjWt1MUvvRyHRTTg7L8gtZKmVcygeTd09l2oh2WM5s43EonfRzx1wOwC
-X5GCkVZyL8z5QheO+O+GzL5OzggVTLbgycNK3iiot+rfiUu7BbV9UbUMDXMlFoLB
-7g40SJh72Wucc8EeqIs8b7P/FYHT5B3uIUpqjlUv4O3q5cXvA3hUi9fzgCo/86Mh
-v1TfJ4lYY+UFwI5SHUbyNt0wbA+wlXj5lA1M70q+U8wlj6bJHd6BmgURkaSQdc1D
-nm3bm3gE9L0BFfVWXrcyyz40pNPYrW9+bxWqU7er9lsn9ZgtyLnwvRmMVhLzL7Mz
-uMA0Tn4AT7+kAZNr+2NgeO297frNY369ZYc+XrD593lg2OqXWDzFcDEOd+1u4t6d
-slXqyzwlq50hKfS3ogzjJoL/8Pihe/6JClgYOb3bPw240Qm5OBKek+XFokK//mTJ
-L7EEqN8pT+ArWRdw/mxbpRaIiQIiBBMBCgAMBQJZG5DRBYMHhh+AAAoJEMHtu5yk
-AP1Qs58P/iVRPCtcnA57rB5E60ZCHg8ZAj16/7I5+NTq67LdaGWpX8KyoL4kiXVH
-VdPdAk45OHpcDGdmBb+UgfgNeCPugBWfL2ZRmw0K6BJtUcz+kDKKqxUtDWiTOgMS
-vDLmW5BtBrebx9dpemZaZGUnu+j+s5aEiMO8ofmQQqXQyteh+QlGk83FLNY04B3Q
-yvxM7poNgU6sEDG857ygOIRbbDh5PMHSstweU1ArMkfs3/cnOWOdHnn0b1Q1SRkA
-w9K1s0cY2HVJjxM/HdcUqFaGRh78PykN5IFXh0A22xha4oJKVNJIhDmPDw0nJwKw
-OjO2ZbxkJN5CsQASym/afsfJ6Ws8ehXP4eV69fixb7suhFdAYLXTL/PJzXJmYBOY
-0Qvem/C4cHpAwrR9iLID7pO/zM4dS9VvAR4hixS6q0+O0wEvnQs3ixvIkykf2KBL
-4C25f19SViRw8/Ys+dhgCTMv3836bIp3MPHqz3ZCe+mVnrY67v6Z0ObvXQ0krCju
-zIpGUT5tKaMsbNqqSWltr8XlMoiWG2RPIB2cX5QZ6R7WTIKcF5hanspvOjf0EtlR
-xWD0iD3k9pOAOTLUA9kb9L5h01s1zFDQ4d3hdOhR4+/7/K+eFS7JF+kX6VoqVGFz
-Sr8Z9WHgFPizbg7mrAdWyGEW2f33pRLJ/E87+XYCC8xWu/5pbHWHiQEcBBABCAAG
-BQJZKDh7AAoJEAPClpScF1DFTyoH/0y1LVfmNqr/Ep2HpHogmCOj4YAAHDC4clnO
-gD+ZcRz2hfKUUkq6Ra364jWhagYG5UQChVjrBMzZcOL8iykvE315CbsYU0Uaanal
-WLub06YisX6ph5CQkkApGXzVtbdX5lJFCSwk4eYha8RLyas709D1Gtx01PQ4aQsC
-2m1dBJEP97ie8P0lWe/aTMsR/Z6aVkBcMRu3wuoq6OhdL7bEiZIjU4EV04j7UhoO
-YVEr/a+054CMPHNJ9KN3u8+jSyywndVUogYnxSFHhginoikCtHy6+4//XA9OBUmV
-dI3yRxs34vDV2nGru3GI6wSZy6q+iGCFGQeutN9CL7m+kyBlE2aJAhwEEAEKAAYF
-AlkojKwACgkQnEn0IUcIVRhRIw/9FcP0kGv1S+IKN9GbcWvP5ENdl5BySMKrnLQl
-cB6+w4DhGhsSX4Z3k2Do34u8nsE0wWq+SYLI0pBmByvdwuVvXu/Cfhr0g3uF0sHj
-MR5sGtmKHqXx9dP6Tf58H8TZJ703l/6ODhoLIFKaa/UxkopPBOXJKD1nxWe4dbVk
-NeW7Ws6uUFc0ruCEomCuVDRkSqrX/HiznlIk+ZhlTpIHxkB0naeaS3KCXHZioB6Z
-zR5CgxwJmGyaztgZV6JYSJKG8nV0qPaKy5XCbsG5XSXrRNkJar2AnwXj8zrcoKBl
-AdMHWUDJQgTtBAuHlLbK43iBux5InbwPynPHmzi/CZLX9f6j9mLLXglgaWwifvo+
-WkjmTVbxPInHhYts43AdX4rlcQZWhU4hsV1vtCz0bwd/nPNYYg6Def9Ouy55a7t4
-8xhdGEn/6HpY0c+ZrIoTWlrSpHU9x9Vn0WW1aTxl/fRaqSjWIf4ZxAMBMHd+B85h
-FiL//SX9FxC3aoGykh4PxeAEAg4bHmtkBz0j7sf61QK8PGIIDJHj6cKrRpLHaOAN
-ysYpRCGs3YuxX4ebqyVoec996Ue1H94eRvRNhFW4AMlhBBVRA4tGs9Dt+wNSvsxk
-fnaIWB48IIqdroVhgY0XqZkLGoUz/w0zlKvHnsdeu5+lgzhXZfFXEbE63pbmYNx6
-rp6YebWJAiIEEwEKAAwFAlkk9CMFgweGH4AACgkQA+K/Hg+1K8bnPg/6A8uDMlmN
-3ldvwbPIgiH4MMHqtqF7j/SnD/HtwQXegP97PqEvyWEqIkfYQa2C+jw3tDAbHZuB
-+cXZcKLBx828zdNXW2ayxdFGDkDT3kMHA73NdNL1Vtc2nwIJOCB5J29nLLj7thrV
-oeezdtJnbk5bepYMxMLQ9wPUVs6L7LBKzRB3E0pfveFd67ou5FCkWADjob1CMgjt
-RPucwU+9vNxlbtpvLVMBEmcykRvQR8GcevP7cxnwQUU9HUO9WayXpJfUpFp/vMZ/
-hARlINUlunvbv/4U/G6QeJTptaFuEdApI3vsCL9OiQRE87E6VFJDiP8Yb1o2AyKA
-QboNjqIoUfLFgHQ4PZ8GEyQ9+QHl6r7lE/YPZnxXtDCc0hPrpSNjAND9fJfYp0Og
-weqIEodq9TAFElN7euynO+f3dGUzOl192zb+qYc6CSUgnwaLL8lRPD5TabnQYXV8
-f18wYS0nfz3ELp0nwj1FE1TptUw9WbRFeuuqlMUJYm6a2oGkkg0k1d5YLeMu9Nle
-0cMF2S97sIbsKNdJorsk8o4BMQ1Nl2aDzyu7Bp0mjG5beRGY8nqA7mamh2lxGFbF
-6hiOnyF9v9Pk0bGsmt7MIyq0R/Db0eiA2zXUwWgLu1DkyL8r3F0xPYD0Kq5FrGGk
-Ts78wMpz/g7BcQ5sZsDJ6pjR5XQRBOSj6/K0SERhbmllbCBSdWdnZXJpIChodHRw
-Oi8vaG9tZS5hcGFjaGUub3JnL35kcnVnZ2VyaS8pIDxkcnVnZ2VyaUBhcGFjaGUu
-b3JnPokBPAQTAQIAJgUCVzibRgIbIwUJEkZ2mQYLCQgHAwIEFQIIAwQWAgMBAh4B
-AheAAAoJEJleNSIa2E3/6voIAJJozyy7ECSeN+e4hLdgeBXxe5lNQmrpUYLLkFlT
-c9zvFJOXY9B2oiTkoXzasLbY/2NDJXN+PAVu8C9LCduRPxmd547LCX1AE8dxlKe1
-D/gvwgnpIcqJGg1lW8f9zurtjuJIGRElwJN37WO87lLqK/QedQLsGhS6K67sRd2l
-oOkQ07jnMo4K9QBYmqFc/lsRR82wWFNjGq4jA53t6AmeHqpY2MjPRLhiIIIUPYPq
-QwGePR6KF33W3F+CAOygUK7harbg3TYKSEC6CfU7KHmbjmwWR4C3TyTXEReqQcI/
-kMrvH7XbiOMryJlsUOEhLRE9ghsvyWpZBp1uyLPjY2LtEkiJAhwEEAECAAYFAlh0
-XpMACgkQP5AsJ27ZviEYnQ//bXkE4o06RCIq0SYWrCpYzfI2i42tHpALrsSdZNhb
-rv8pVJKqprOPr6bbKMiv57bmKjUcfpNse9m4Rl8IJ6mpm9VRAlj1uRTt1PsVUa0A
-ZiPD5oFdODeG8Y+1UTUrCJOmvdq0q1yuvDYEPpKtae5gQah+y7YzpMJKqwNu+hFy
-3q7BG1sXNTCbDM7po1wYT9yuQdROmAbz1ETq2WKRiA2v88YQvv5wQ2RRlEPKXQGA
-vQIKoaAq5ZSDyBttkjQLyn6ITD66+kUSgN5jGeecLqKqd81uOfItrF7ilVq5yxw5
-aW+f1auJtoMVnpCbnbVPBSGns1dlsTjw/y4NFTrnIO7kIDLYcvrz4l+7gc1m4iPX
-lgaBx916oWuf4eaD/1k+KLVF7UzcXy25eqGtVEjh9K56f/C/8GjkqM2VCuScW7Jv
-8jCR0/y2qivkwvyZDqtkC2dfir1K3mMN6OhdzfFsdEUN4n1J0KfaqrUNgoWYjdqA
-KqT2c9896v71FDcWFLHcCOdNma387dtD/ekuuk70xosVSBZ1rVg3FF9mpSDCJqu8
-SanNRxuPGcbdNbXpmsEH5Syb5sTJnejV5LfZsCr7ITGukEtbHH5C9w3Z0L3Y8aGE
-iA13lwkr871Rt2XZ3uz5O4MHp6iiBcfZQXizjPUFpApeJf2wSzp4gWZ0J3tC4cqZ
-XNCJAhwEEAEIAAYFAldDaKgACgkQlNM2o20Vkwpkng/9FiXf3F3EcDkwE7Ur6OfL
-3H3KOo/2s4WK+Tla2TliLJd+UGiU+1N+kwItPsV8uNEjS388zDqyRTO8TeX39Vpz
-bI+ehNxd37Xnqnh2PiBcnAqdzvciQxJFkZzZuQGuYnlCp6pSFd4jCUhDBbeFEIIP
-5eXpJOUqphcDl9wKCBJf2Zgx2izax64jzdMtnvEJogE4FTdqRUBwyclHgWj+d347
-HlIJ3vVnSiWlQAK3gFjNnBLqtkOwazigHqzkWZnQXu3HtZTELbUjji+d38ULKZJ/
-nzBykiqKCnl2y3J2Hx58eRmKcM5U7lYZwKW9BHINGDu8JM1Wyuua9Omb9nFL/ROo
-CUP1BwlgYeH5kDqdbRb2YL3xoyZs+juBes8Os00Xi5QfwgOlfb8McmhogZy3ztFz
-0EZGqPmmG8YhX0gkAR1/YvSOwmS3br8c3ymk/zDZPJRDRPu6ASB9wxkXXkAQpj5P
-srO5jGV/kl0XsDlKndnxyjOqE+5QkkeFEM8b9OpF7ZmTdGxbf5ssfy1NXC62iZ4j
-7BZORjYWN194Y9jEl6YZ35q0bGfvRUp5HdCpMKB0X5Iz2/ZlkPCcfILUTspfLm9M
-VXCnl17KCIKXIFsWmS2VeqFgLWHPPgtp8BM8KDKVWYoGqXzJLWnv4m3wmPMKQXIV
-LBqNKjOuR9Wrq2jFoRrUgHWJAhwEEAEKAAYFAldDrrsACgkQYtSPrRag3gEjXA/9
-FSwSeHUccComnRLTTRY8GIAZGjEckRKKDS0bWNAqa6fbCAO0wQUi6vKWYZX8671N
-q7xP7atjd1ELGJQ0T4ZJL/3uGmLqjpI/ptknqHq1sikJGjODac+8ZiSh7YOOvjP3
-mBL+2me/I15bVx+k5sOiRdtpMTXOMC/NS++TmT9XIPFNqSyr0i8OVyKXtsiXcJm5
-q0gYxjwvq/CiL2hco5Nh8rosyqZDOLREzw9eGshgFu++y4831Tnmd6PkfweM2DT3
-HA3YH3NVbtiZknkgXw0F0xBjRWL9C1DEMnaF/zPdO0XTV0CJT/nA3T3XZdCNK81E
-yJL+DVdEEkg94tRKAChM3TuBt1ks05K//U/ddPAsM2RtbLTF3VwYZeuTwh+nBqEZ
-lRC3CFxibl7ujSvMM1e8L/5P4ZB6Q0VgwRB3pZUd5YetfMTb/aTGSFiK9yThvpBl
-wnXizin9fiFg1nrElbtPTQnJ4KZgODLu31qRwod+EZHOOcJNtFfSPwBaNSe9jsPK
-fxrwamh2YAXPlTkwqU+Jc3O7XdLy865AMxm0AOFmyuJUsw9DVwP3XhvUe4iSjfOX
-FL/8KFcbnj7mJENdqLBjjRntOrBufdlsfdkhBPEiRY2DRIEK3s/RjPu3rKKo3ioE
-xHjCr4GShu+9EY/j+VbI3nvFbsKeEqFdFDegk5bipMmJAhwEEAECAAYFAlkdeO8A
-CgkQCp2vZxO4Y0nekA//UW4puqD6hWIiSruKOynZ15HuOwgIwS3zibKrw5gMF3S1
-Q6eKAcB2FjEJGMSLXygFQc86HQwlEXhzFMq4+3KTZmdb1q4S0CZ5v67v6vFgvTtG
-4NcFZHD6vcLGUAFUhNxvNvvloaWPAG/Q85klLa4brHyu6SKryaZX0Jc7wEAz78hg
-jHw0xbuW+6WLdpYj1358meFhXXRyotWGKyX8C7mgtgayT0mIeZY2P8DS79CHcyDD
-M5u+o5dppBuqeBjzVDuR29zdPq5EM77Zupc1mc2tnclDa2ZfxCe3W1vrXajWXSKQ
-e7Axlw+LiJoHr/mpoHJ+JCzLNgaQa/696FDg36D/l6rMu5h1SoYhUU1fvmO9MmUI
-cGJ+pPGvcC/SuOkCrHw2UbKbuxA7j3zjqvO6UU1IOikYul92mNwkYJ7IxDgcBpT7
-6Xb5chnaYyiAAzVvIjoKjWnJXOdNW3qAIP/BTMbDB14L80KDWb7qStidhnDztSxi
-gE9PxlxHlWbbtYKC8dQGJLCQEwrARCXBKChXchFMiVeYoey9viwTa0tpxnVjrAsP
-pHDWQjlfQT+/kpJTZlkyKMH1ANY/XJ4ZspGwg4BL+8/fzgJV8xOiibVKzeGxymfN
-GYrEptUFiGEWr/pzsrcR1K5y/EdIy+N4pagaPYSzUf+BboOwlSX2vgXO3KVjt1eJ
-AhwEEAEIAAYFAlkbmWwACgkQ5AMtxO8M84rAgxAAjeJzP9NLVHI+h7bQcGGBNPBq
-aQEhcH0xgUefu0BfOPerXLcrB/jubAKj0yhcsx4psYLyU9mVoDz6skD23VHzuyTm
-Hu59L7l470CExDylLdmnomfcQH+hrwzWfNkK1kagevn/g0APZt+pFRmirMZHrq2c
-ODdOV0wPYoCeuQ1mAcd6HXiis/LbEGGKn+vFlapjSS1YqQH8q7guSJNWrx+FechC
-1kK1SPeskpzsZ/sBEWhQtTudyrvZH88Ib7T/K/TMJ5dWi3eQgZsTl0VB4JvWQsJV
-Dw9Kzg+kKWAYfElW9o4lavolm+K/bZZP5Ych8rfiiVBRJmAK9W1KpjKzIMJzWq/h
-c2C4SZ4zE9lSuJRWrF22Sebh1lkboF/gDro7Wu/LJF+TKnH5kTjAM9TV2T1Y267q
-Wo03DhQ65NhtO0qFm663DUtKxScl3pD1IhP+5H03qXrlp7Jzu4FB8BakUWYiAFzQ
-h1FWFDusYg731QIRLCpCWYgMf5FRuZXqm+FZ+0Fyi+a0CMWzbVTw2S592HEYvjNh
-+dz+2DN96za5jUvsUlTRpGfP+vULEgXcCkyUk5D1DmN3DofLJPIcUXfw3yLuiZO7
-9JXvGcqPew5VG38LmIHNPZBlM2w+Jy2La0R3zdGsohS1v5rnx0aQ4q6FYeUvyFta
-IPydQmCHJO3w6ZKBOj2JAhwEEAEIAAYFAlkckxcACgkQP6rSzV7LsxQ+Pg//cU75
-FwlbfMZhG57+K25fGSlSDURID2t84Vu8E7fiFVQLEDInmcLEnBv9ePoKT28HT4Zw
-SmOs0ETSfbeQeSHivceo1EpFHwZBBp1mY9QpjWzb/ZdcJvJXitp11IC2cGh9+rSa
-4oNDBx7te4aiyli+SRQB/IKJrIHumxhlThAF+5eOeaTZCkPY5RnaV1EV7+vNb08W
-K4f6aJH8OKT04WXtYvs/G7TAEqSLJpDujVblGVcQ+Jgi7jSAMqZTlUvOERRH7qcN
-0zf0ZNkO7EQnpPgo1sDQBLFkd4hvq7R6o6stnil9iEmqtyn/IjfQ1vEyuCwqSnIg
-b2UUNNfxtmLTjKR2iQ9zFCXV+yL4GCiUfjgMhBjj2Avfx0TcoFrGEywDg6zJG6hp
-umkAQLTnW1Tp7/GfexIe3ZpibkZMysZ7i//+HbYrm3tXLCkbc4JKM44pfSVp6+c/
-M+mrgTJ1BYBgm5vtJtdy15ZGtDAUedXdX+ikjLOe6dltYqcv3xbYGMxcqK30rgEr
-0qJIW00lra0K/DsHB+qWnxtyrse+RCsb8PXgTKgSAQgA3S/tzZeV0fmyHT027giL
-5FejZUwLE6Qe1NX3UJVEarHoJTg3PZZvAw90VVnheCOgvynwed/ur/iYy5HGoG7X
-u5lTIX3XchTr5LnsEJGDvvKWTQbrLYD7lIyqtEqJAhwEEAEKAAYFAlkbqNUACgkQ
-bwza5wC2iZ2aXg/8D3qNdolGQP5x5yPp/WcEm4pA2U1fPpoC9WB/6JZ08Mtolhue
-QDwy9swTeCjeS/bVWEkTUCIvgYsCT79iYwCMaUURd1gcGDHw7PRFzc1vI+s9peV0
-ghUS45kkO7yVdM5Lj0cnqaEfdsRH9PEPOJePUfWx1FC1MGpTDQWW+xjcII+JGlVY
-5uyNdr1XyiVsSZr/+KgGfmbKGP3+OqOJlGziyRSJNufUzpJ+6ARw0rVHN59nujWS
-3DPFcGvjS+xMicmDPeW0KH7r2HhmNJXZYP/0RcrSuHb2Hbofn4bg0s21K7m66I/9
-ckTR3L2tN7xfDDNCS0Pa27J24HpukfiM+mB6CmUUAZhimH5DjCpCAX2IQSWhItBn
-8SMqYwkvXSXKYnG1Sga15+mi3OyZwGwci0LG59Q1A9TnQP+sbqB/94ezO0rE2O+d
-ho/qfpyVJITUGTVZeiPK7bCQzezJMlqc4RjlBhqERGah4qZBSCMsbB3uU38f9FT2
-Y8lky+O9IFgH2UhpyeqjF+/Zn27dxUsDUo/e0/hlJxFGXCX/QOxf8OwSWDuX/5ej
-6Wj9cTpT2pUGA6XVRdzLnUHLSR5Hfv80jXDV4OObs/CAX7WHf5Jm+JWeL8kylvBl
-YE1Cs8nb28pGeA72MXANrVN0h4IXROTLwPQiRc+wFSywE0xWumCpChsHZiSJAhwE
-EAEKAAYFAlkeKmcACgkQoqsIHyZRj+4sCQ//Roje6BPFmLmBHl9ox1QGB5cpO0fY
-SkWeiPrs46rb0J0ywxKX+8KIMJZ+hOLxPnNdC7936PCE2o631Qq23yX8Ltb/8+px
-QFthNy/2JAVIJ8TyN8twvV7GpWxQXzg+g/kXwGwroJXarXr/GrBlOZQLRYWEsgEM
-1fp1bLVWUr+i4FEDzTcISz2sOEAfMeUxZp76yt+B0dE6n6HskBzHKUp5OQDmzd/d
-N+7G07QHq+vS+eLyWGDKMKUKqQukcgzSa4DGF0n7fTjQFcbGhyHGGEn4bMHpsFyE
-coIQF3NTuYkNEFoW+sPpcMz1Ax5tTDBpj1P+MZRPOn7Vvk1UqWJzUFkA6gFPM/Rd
-XtNI1cgxL7Jrwv+KNi42EVnO2Bx6WCK9wbNIvRKkxO3dDT9PtqWr/N2FaGd7fbqh
-jHNoH4O7vyOCDZzK/FaqC4umHFDRILeuzYSpptQBWI8a/qXnyalbOFH/4u6nZpGB
-8ddu8hnqpbUXszaLhELAzg+o0ne1mdKhk6MVR4Xl9n4MpRnEjh223TJyK/ybX5MH
-nXklDZwIYRPloya+76CmTLQ9sTQnCk/Mk5UMgzc940mqZjaYwVvbDkp32H/rcEt+
-Upmoz7Uyu/0PVitjUPKObSd/wEgBejNwB48wiBP2dhVrUgpICTYgfI2vEfuXbabn
-lg38G/rB/6LxP6iJAiIEEwEKAAwFAlkbkNEFgweGH4AACgkQwe27nKQA/VALtBAA
-ndpygMjAtdVMAkbqVOfYePc3zPEKmMABPdtxvicRS2B9XG1VWvnJY4lnE/dHbmpN
-J966p9QBaqKGSOm4MncIMRvLP2lGUC/dYN+ZhFUYD2wVMY/dwjS05iZn64FiM1hu
-697vReIs0ou1VQnD/efOjlRHeAKOWY8FmownJFAZlh3Z3ZlPJvL5RqPck0Sk/cVW
-oHiBjmgaefWdY92XO+NC1iORUOs2tPFSifCX6L4by4h+mX1uZI71FswZF5L2xaRr
-0F2zSBsY9Tdf7FgnM+kB5A8IUyZDzljW5PeNTIPZfGzFF1SpaZsPDUGTbRgPA7AK
-XWh1nUpPkkjA37h+Cr0xOP4tJ9IuLHP9UxuowWW1eVgc4CU6xSExcCxtustkhc2X
-wEaEYLVOtXL7AWJM0kGuNWp222fO9ZY04Z6eKU3Vg2INYan2TSWuAaP2Fzz/se1K
-MGd42cYT5n+KK84lvIDg1Tr/a+e7jOL/Tlviq3FSX/gUckcTGuyEFyoe9ecwS8Ye
-1bsSzA9pY2zkA4TeSV5Ggvyj0te/HlhHDGRd6m6ak60LT1Z+JK1Oc3u9QgOCB/6g
-K+JD24BbCyCXYLsSmMM8vXQiLi2BAaJejeyI/faGLkriFYaSmcZe/xHuIMX6uUgm
-24WFybzfpJ+SNMNe+YWKXZXKUeGdGoTbjKSq3ZDPMRqJARwEEAEIAAYFAlkoOHsA
-CgkQA8KWlJwXUMUQCggAp07Pi+4BfAr4BDVelp+QtMPwaNOkAWoeNtD77W38Bklk
-4VtsqOnQY47bUoauKznR8sDp4JrA7565/Ntm3zIqSIUs4RQfGNqtkf3/frj/7C3W
-l7pVn3lJTPexImFjk9p99oraH3/KPInlcwIErk/QqjeUQwBxrt614/b5RGhl42LC
-SpMfxXyiU7F0udEZFxUazD/2WkgHdCd4NvrW8UTJaD/iLOtmsVGOP9mZVnzNGPe2
-hYspk2Nt73iUNq9VA0ZM4NlvBrwmHsBXL7XJobM6PGfwgV92rvYF3vu9pzKwdXRC
-xsy5+WghHOymW42s3XmqquNX+WDJuKZuuhpncMaySIkCHAQQAQoABgUCWSiMpwAK
-CRCcSfQhRwhVGDPFD/4rL3ss/juwKEmnSAQLpNOau/Dg+IomJWXwKsdrPgqMAPBz
-pkIpQIPKWexUP+gDSsyEP9vHuiy63GICh1WdYBhxhhFeLubHoezn6zhv06Ki+Ppn
-OW0IImPS6L4DSALWLCiCrfZ/zAGch139gG5gbvZG9JzO1RU+JYfMbmE9E1z4aZNL
-f0Rqg+23pxVes1JIFGwND1t0sQaFOvVJNERnPGnWsK0MQT8xvCZk0QABJxLSdxmo
-z6PUCaIa+iGU1wNYjMUYb3mS2nPcrfCvyUgP7gTNXolLbVAGPAMkLo+r01dVL/pU
-wuGuw0Bq4mTVeHZ3QabmJvXhef19CVFk7aaPH/kNnGOrYE6aL7llcUyRZPW/9sva
-no5qtg40vsQLCTVIpRC0J0fKUEZrjb4Qjt3TwUczpaqVeA1TjVx49pePhZGdcMYM
-aysIi+gyK/HU9MdTj55KceaDRJVOp4GTRxKNZsm29FKZENKT3bWnZwCARbTsOoQI
-C/pRirK/gqJwgxLj4YLqqX5Ura2UpiQDSfQ+5LRZlakIilDggXkDhiCjM2zV/YXT
-5bCpehsTYbV0VS2pLy/8H3mClHwa+ouYXVDWMguzLeziAlZcvfmi8pLWOtVK2AjR
-y4dwD0fgOonknQ3AIXVC8Kjd+Kfh1ZZpZuXV95AxUHzNILIF5zUHYjuT1QPfK4kC
-IgQTAQoADAUCWST0IwWDB4YfgAAKCRAD4r8eD7Urxvl3EACpR8VFIze3/24Ixwc1
-/luHayr7eSNIFB1NbDlt74Ly6hq9stqY8Z9o6WL/zlwSXIT5wZH8fMt7O8tvNw1a
-qmPaclaIUjxcvcoPJUlZghgd2x6Osp11D019K3NyJxS2mPEruT1bQ3olnfokFKCz
-CAY64rq8BOf9RLZC09RW8Ey8mbL+oNUbAhO3lC3DALNgx6+lDvoAoRoMJiRzGNB7
-iteRz//nLEP/7rRuFjtyXnsMVFMi36u9KjeL2PTpAiEAPJM/pEekBU7Ap/9gm5Ap
-uCmvnhZPPIuCr/AsRKPhu3Chmy3lnkGqFmy6juoF1bbwNG6x8fVwHg/uz7d2elI1
-i1MWd7hbgwG0j2xqCwlcQWXDLdAmEgEs7G6whjb8lNaLTJ9N5+D29wqC5iNjg5ry
-i4q18X9RnHbzNNTaTPbg/N9Zd/7kj8Zez5UwkZZR5FbOevP0KklWuKHRQekVE4AG
-Wzv3tVFc3ZPyURqLp9g06k41/w/aGwYd/mASLvT5gjFWRQybWNLjrngqxjrUp2ez
-wO8hQSz7Ode9YN55eUWyffOB7SRC7QJ26JpiJhM41lyMH7PT9f34NciDaiFqkdm2
-WkeXuTYuUuqWS31vqZy3/Zv4prhDLrxisW9myX8tOLeKYAWOnyRvlreVPwmUWtO+
-h1z06/lzTE9CkPHe6GNaf9SK+rkBDQRN+o4xAQgA69rko9rydX8LLuI8RaXcgF9e
-jwT2m/unETjfHsZfMJB0S9XfEh5v1VHBhk1SX61kVWP3WndGVUMW+WmSxGXpMwp7
-aVqnwkakz1NaAjOTh1nJZERVGw0dpFnCY69zqwtJjIMTXdEGhCoTLq7vbWEgPf5O
-r5q1L31dblXqfedkXIDNWP7eA983eSSdZiQ2yOkVXf/Q5QBBhcya1xvX7zv79BBB
-rU9wsENOwr6YFq2nsqQZN3/Xi854TKljHUPxlUgMScCZ04vRPdfif0AnevvTd1Fx
-g/WEJ0e//F6x+iiyNwtVGDbTfSoMDm+PTXibVhZSDiSRBjY9205nX1Cm/vr30wAR
-AQABiQEkBBgBAgAPAhsMBQJW2wNKBQkSRnaZAAoJEJleNSIa2E3/EcIH91Yd4yuR
-7VDjD/65RoMVUbxs7lvQiJyRyiGn3TW+2WvIFACvZkgTeG/M1fBr523+h2Bd6VAf
-NuKkNYK01EuUw2bmwr3jXEntwN+J30AuZcwvt32yBEir8yke5xct7FVSkVzT5ZXe
-lZ0aYQg0im2HreU9uqvLIizaoq0xY0u1EmhvXrSuN95fegVY8Stk6lUOolDQzvdj
-e9yNN/lLgoGEVaoozX8gUdPn9JG4Mk45DV9Q08u8gXRRofDJ/sILJ/foP3TJgfC7
-vcFMsZn+pEDvx5H6D0rB62lclDYtT48ZzLcBJTX3wu1Gc1t9vZVsCOGfrMizIZ5f
-1hWw8puPN82Rdg==
-=5heD
------END PGP PUBLIC KEY BLOCK-----
-
-pub   4096R/DC55C003 2019-05-11
-uid                  Daniel Ruggeri (http://home.apache.org/~druggeri/) <druggeri@apache.org>
-uid                  Daniel Ruggeri <druggeri@primary.net>
-uid                  [jpeg image of size 13027]
-sub   4096R/14FF4720 2019-05-11
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBFzW1OEBEACnouF1HJ/EYUIoa1XjLqXIONwrclBAbUmmHDTLAIs/6ocOpfNv
-gUS0MU8ukgmwWFOUcLNZ0c1qYA10rYWvEmvMSXUUlSlwfad8UcV/rL5KvIk+c6Be
-X/Fe84IEGgWksO5kKLS4br1HX9xZpmZPelgdhhPqAZu149xBqf8y2lgq0BqHzT6b
-8MvSILCddaMjR+mf+GD5jqw/srJZTnJQNAtFiUOvUCn/z3A8OikgGEOetMaSkYRl
-eNTGeq6X4R1i1iyCfj/h0YksC+Tgy1A7JYOBL2wdOGYO8YS+TpUhWmVNWHrA2oJ6
-GamEZhZ/+McmfkKxsAmeVD7prBs+2oW2HyDAcnVIRX+y/4n4EwmSjfcMeIDwmvOz
-jy0M2uOZsgSzfIEbnmGrPRM5AavW3z1tx6cYeaYPLKUEpooVJUN4vQih4Inj3m5D
-N4gqCLEHNUNMLCZNoZSrrjLesgb2tbJoFghs1rJfiEQJAtY8Q1dXCkcEJVYPybhS
-m1w7Ph+5KGOhRqzQAduoLb2YKRsReN+K2PCHpebcprnVkLSYYLKSCPtY5CAk4QXj
-EkeAM/+WSBE0c4dA5GYRYKc+J3OdN/DjvouOGrgkcFZyfCq0fJjbXgJjOX1qXMRl
-vOWUuIupdnpi+ud+tLf8JyxTECBOR+NxngxTn3Z1hjSCUD82szxmVsfYHQARAQAB
-tEhEYW5pZWwgUnVnZ2VyaSAoaHR0cDovL2hvbWUuYXBhY2hlLm9yZy9+ZHJ1Z2dl
-cmkvKSA8ZHJ1Z2dlcmlAYXBhY2hlLm9yZz6JAjgEEwEIACIFAlzW1QoCGwMGCwkI
-BwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJECqxKnrcVcADuq4QAKDUeH+7FE5qIIY7
-bFxwPT0LsF+SKTT6arXbtMtI5aSf3vlkiWhHXQ3KNs2UGtDOMQxApGtn1NRy/k76
-RJIW/0hAZhDQL44yho0dePbxyN3hes5nKIcoOr4cuHEEO5EnuQxSlefB4bropcRr
-7J0M+tSXjwCafwibW8zKsvMNDS2viRnSwj0Ve5uZ5hLs+aEZlExIMiN92dTcIhft
-BDj+AJGRIuRMh/u1QQeE6XpDO8vOKqmLgqMfs1VUuO7vD+80HsZg00qfSYlt/KNs
-ibhkGULsKJZFE2PPOXEdGzjjsXswpcufYRLqmkKFJMzFGqR8gRTj+RHK0yIjOmgR
-/eDMK4iElwTUovxBe9jCI0OT/xPEjHL9GuxIQQs8A8pU4hI/8mvcySjHPpz9vy8e
-U4lZxnif5CuNhsWWxQx4rGuucBs7shyULyKeUw/g8HQONc8/GBuvscNBw0tVJO+Q
-iYSDm2k4mYwqd9gjjAE+Mz+KNNd8lEQ+ULTKNkMDlYRpdq7Ujs1NwGw1g22XPGGF
-ihseLhSOeo3zYReoCE3swPyxdM0ONaIdZ602aapVyWzNZhspcSi9ZtMCq39xrEL3
-3THZvWJ9Kh/jTdKyg5KkDAdMIdKWJD5zNjYW1fuvvdNktPaQmlEgdJsp4fYrGjDU
-ANxSvYoGOSQcT0DbQK7ZlcRHUwjZiQEcBBABCAAGBQJc1tbWAAoJEJleNSIa2E3/
-duUH/3QnffSZ85W6XzqoBqH5PbsiYomTzfWvuQG05RcId+vm8lUQZ61G9gk27cGv
-4neZnq2SweBztQdYNrzPhm2aMyMmxhuPdwOdgYkFgy63KyGYpl4qVIkAaevAs0NN
-lUpDmUSXRpA6zOxrMvZWkAHnAsbNdYg5qYQA5hSV3nTMNmO62IY6q4eG2G4PYEaH
-tF8fdHl1qSYxKiFgSYKQXs5QCNG/YBqlUd3NSS2FSAzJu8DM/LXnaztvHy8P/xva
-p8hsfmAtbjgNg+AbLUXVxtBi8nO6WrPH4rRw3CaayVFQrSrb+gDaEgfmkwz1BVQt
-9IPW8JF9eV0FQZqr2UiMIsEEfsa0JURhbmllbCBSdWdnZXJpIDxkcnVnZ2VyaUBw
-cmltYXJ5Lm5ldD6JAjgEEwEIACIFAlzW1OECGwMGCwkIBwMCBhUIAgkKCwQWAgMB
-Ah4BAheAAAoJECqxKnrcVcAD0pIP/2DpmVIrfuciY0lMiYI//wovUHPkPXFhRFDC
-yWuxURr13ZID45chXDd4GF5DvtsIbzXHNJhYSNoThUQGxm9+Jdlv/KQH30/2mfY+
-CMn3jhO6gCgREU9cElxUp+d8r0bgId6bUfWuwDHfjmZ1Jt9Hs+zijiM+Bz/ak+Ys
-jIGIN3eCcsDoS4oFQSPb6gDcZSySC4WMp34NJSz7oSctXpvfEMkvmKAm2eDyWuw7
-cinsz9aQDc/t+YpsFFhjDAxL8AoTQehH1F0fiKOAF54GDNJkpxIJBMCkF7kXpcTz
-k2xZI+kpCNj4Sd7t/tdD1vQkaLICkfZf3kpWjHFSsP3Y4gn8/LbUn/ubB122gLUr
-JAIJ0YgU/x+JE1RX/GZZZc1kB1rJtHh6qiniQVYDgZh66NbR54BJimY83/0FTRtq
-I+QSgc3tacm8hV9pyc2hf26zKGD9ncfAFwACmRKolY2TKb4MyL5ABCr2h/2qlHwR
-pq3G9xdOGdzo52Xk7u2vwRrP/Q8dSLHoMEx/zazSfO+Surgz6Ls3f1SEYnzvNqJy
-fZyka7obfJz92NmiUVR5NKN5pPbDStWr7D5rKKzaRt4wTTyb0YFX/eDat7a/yVth
-zhB14uIGSl9aV4vi5kf1ZwNP996o4abLdEe/f32ht/0TLhHrU7fq2fWi+7ua6WaA
-E6LjSxa6iQEcBBABCAAGBQJc1tbWAAoJEJleNSIa2E3/OkQIAJFu3LCmheInFj5S
-Z29bx5hSVwQR/SGb8YQhGOKCPwHe+F0OyuIbjrMDCFYlFvsPADpuL880vx7HN0ki
-swDeUqscb+9gBhsIwqh7RXLbRUHlldufjjtmWe3cKzafVLD9RsruMVo3hgZmedWp
-YaQaWI9EbUwGpgSLHBaE3X3rYnBblp14ThoupymA0u55z0u4EBIg8e/ab8/TYk5A
-sZf3MamMY/DctPeGgkJNRDtR4IwtNfnUTW/GNRn0AEns/NFcNHUE9BePJ0n05J1E
-RAiX6aV7D18+OpTFOSw97w54Rp1VLRDYfxVkMjEPxRueaJWylCz0cf3m9ScARUeg
-kN6mJmfR/wAAMvn/AAAy9AEQAAEBAAAAAAAAAAAAAAAA/9j/4AAQSkZJRgABAQEA
-YABgAAD/4Q9uRXhpZgAATU0AKgAAAAgABwESAAMAAAABAAEAAAEaAAUAAAABAAAA
-YgEbAAUAAAABAAAAagEoAAMAAAABAAIAAAExAAIAAAAUAAAAcgEyAAIAAAAUAAAA
-hodpAAQAAAABAAAAmgAAAMYBLAAAAAEAAAEsAAAAAQAAQWRvYmUgUGhvdG9zaG9w
-IDcuMAAyMDE5OjA0OjA4IDA4OjEwOjU4AAADoAEAAwAAAAH//wAAoAIABAAAAAEA
-AAWMoAMABAAAAAEAAAWMAAAAAAAAAAYBAwADAAAAAQAGAAABGgAFAAAAAQAAARQB
-GwAFAAAAAQAAARwBKAADAAAAAQACAAACAQAEAAAAAQAAASQCAgAEAAAAAQAADkIA
-AAAAAAAASAAAAAEAAABIAAAAAf/Y/+AAEEpGSUYAAQIBAEgASAAA/+0ADEFkb2Jl
-X0NNAAL/7gAOQWRvYmUAZIAAAAAB/9sAhAAMCAgICQgMCQkMEQsKCxEVDwwMDxUY
-ExMVExMYEQwMDAwMDBEMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMAQ0LCw0O
-DRAODhAUDg4OFBQODg4OFBEMDAwMDBERDAwMDAwMEQwMDAwMDAwMDAwMDAwMDAwM
-DAwMDAwMDAwMDAz/wAARCACAAIADASIAAhEBAxEB/90ABAAI/8QBPwAAAQUBAQEB
-AQEAAAAAAAAAAwABAgQFBgcICQoLAQABBQEBAQEBAQAAAAAAAAABAAIDBAUGBwgJ
-CgsQAAEEAQMCBAIFBwYIBQMMMwEAAhEDBCESMQVBUWETInGBMgYUkaGxQiMkFVLB
-YjM0coLRQwclklPw4fFjczUWorKDJkSTVGRFwqN0NhfSVeJl8rOEw9N14/NGJ5Sk
-hbSVxNTk9KW1xdXl9VZmdoaWprbG1ub2N0dXZ3eHl6e3x9fn9xEAAgIBAgQEAwQF
-BgcHBgU1AQACEQMhMRIEQVFhcSITBTKBkRShsUIjwVLR8DMkYuFygpJDUxVjczTx
-JQYWorKDByY1wtJEk1SjF2RFVTZ0ZeLys4TD03Xj80aUpIW0lcTU5PSltcXV5fVW
-ZnaGlqa2xtbm9ic3R1dnd4eXp7fH/9oADAMBAAIRAxEAPwDri4t1CnVlEkt7qBJI
-UGQAZCJCrplkO3ArMurMFXbLANO6C+CNUei2Wpcp28FEoJLgi2NZMlDdbjYw33O2
-9wO5/qhBAB6Oxi/RCtArmLPrIWH06WiriHOG4x+9CgPrDnl0GwsMEz7SOUuIL+Av
-UvKgx2q5+j60PdZ6VwFnnt2mR29v561MPqeFk7Sx+0u4Dv8AyX0UeII4SHTB0Ra+
-UFqLWdUUN6kwiWOEKvW7RDy7nNYYSU18hzS+U9dzWjlZF2XYbCFOuy140RWv/9Dt
-GVAqLsck6KdbuEdoBSJXgW5T8Yh+vCDbWRPktexoWflGutlj3fRYC53wA3JzFIUX
-muq9UGCNx1tf9DSQ3+W9cxd1Oy6wlxc93Lxw4T5P/k/RVonL6nkvsgvsJnYNTB+j
-OvsYrFX1b6nbJFYYP5R5A7SPoqEz11Z44zWjRqtuO1zpeNdXjXw/zXN+m1TDrRAa
-dzdQRMnbru/zFs4/1Wz9o9RzOdWySCt7D+q2BW1u+wvsESYHKHGF/tl41+Nl2Vh7
-i4Hh0e4z9Jvp7fepV321NtfXu3QA2s/Rc6driZ/k/wCv84vTcfo+AKtoaNxEFy5n
-629Jx63MLK2l0ECR2/dAA2tRsrSAk+rvXGZBZh2v3PcAGHXR0fzf7vu/NXRs5Xmm
-DbdVd6WySwy1w7QZ3B38lel1PFgbY3h4Dh/aG5SwLDMNylqjk1y2EWgaKVzdE5b0
-cC7Hb6h0RseoQiXt96JQ3RFa/wD/0e1qHCO3RBqIgIwISK8Ir3hoMrF6lcTRcxhh
-zmODfiQtXLcNpWJkNcXE+B4TujHLdwvqVtd9qc4APhogdhJXVMa57u/wXNfV2luJ
-1DqLHPa1jHNbLiBzLlq5HXelY5LBls9QdgQJPxdtVWYN6NzGQIiy67aXtIlv3mP4
-q3TVrMgeS56nrT8pm2hzXu12+4EHv9Jpc1V8r6z2YhltBfBg7nRqNHQP5LkyINsk
-iK3e0ZA41KxPrJQ6x1dh/m+Cs7A+tfVch4caam1nXaHsDon82d66Jlv25jq2tbZT
-YwOm0kEElzLKv0dbm+2GWNepgwSHWngfRrORv+meBH/kV3uIZoqPixv5AuO+y+n1
-G3CrD3XMc5np7HAyNQ9joDXt/lsXZYlN1ONjttYWO9Nuh8QPcNJUsd2DJs6dA0U7
-RooUHRTtcITuqzo5WQP0iJQNFC9zS9Epc0BOWv8A/9Lr63HRHbuQ6gICstCJK4Bp
-ZAJ0Vf7Hv5ErRe0EojKwGz3R6LJDV5W2l9N2U5jq91lNjXPrlryfUHpOf9Jvspf6
-PqfyFy2Xh5jh7BTiVgxW5zQ+xzRp6jt36Tc781dn9ibh9UzQJ9LM23VCTAdqL2N/
-te9Sdh0t9xknzVWUjZsN2OONARNxIBvrq4f1OwMmjqAddYTTscHSILnOI2NeP5Mb
-lr/WD6pnJf61RNhBD2scRoPz6/5XuRsayiux7rCG1sIB7QTqtr9p9OfQxv2ittto
-Iqa9wBcQPotb9J/9lIGyTtouMSAAASLeU6V9VsGu17rcOHWa2S9zRP8AJDNi6rpm
-A3EY1tW4MA0a4yQs7H6uG2eheDXc3XY78rf3ls0Zdd7JaYeOyUTe5ROJiKA08Gv1
-m3Hw2HLcxzTkEUW3VNBeAfobuPaq+HQKc26yh7nYuRVVYA4k/pPc1zhuJ+ltWpkV
-Nvx3UuJDHkBxABMT/KVcY7MUMxqzLKmw0+X5sqSMSZg9BqxmYjhlEfNL0104dP8A
-nRbdTtELLtLWmEWluijk1y0qfq1HBtyX+oZRK8l5Gie6gb+ESikeCK0P/9PtKfoh
-WGhVKnBoEqw25sJFfsp8ApG0BpQ32A8IL3OIOiNhaQSizdljd/euSPmNqyc3qH2e
-tz3g6aCPEq8+6xjpHZZWfVXZuY+QyzUEctP/AJi5QZY9ftbHLyr0nps4/Vcym7Gq
-DRNjXbiWugz8va5E6Tk9Ubc1jqxFe11VloaA2T7ve/Z70BvRRjs9U5fpVNmd9Yd8
-Pe3bYtHCz+jY7XMdcHBxHqaEkgiNjHPG6ncgNNmXU6k19aYdcvtybaKA0W5Z94qr
-dutDAffe51Ptx6W/v2emuk6F67MYsucbLKyQLDALmz7d0fyVCnK6dX02zMxqBU22
-C4nV7y32N9Un3ezajY9foMkGW2+5vwKHXRBO4vd0M8X3YJZjuDbPa4uJIhs7T9AH
-d9L6DvYpVnc4nUyeTynxwX4uQ86y2B8vcmohTwrdq5buujoUDRPeNE9MQntjan3q
-x1o497feiY7dErx70SgaJy1//9Tp3XEaJxfGhQdJ1Kd3KC9tNslJ1nih1nQJ3pK6
-LHYeQq2XhVZFLm/ReNWO80ZUes9Vq6VhuvfrYf5th7/vPP8AIa1Lh4tO6Yk2KecP
-UThdRyMXLadjiHAHUbdsNc3+R9LciVYXSfUZl2OLm7votPtkD85oV7rXScXqBDLA
-Q5hPpWtMOaHfuu+i7euat6bmUE0nKJZPdgkf9JQiiLumweIGqsdHos3rGNY1mO0t
-FTZc1wJAlv5pd/Kn2LY6S1zcSit7S0VtJh30pcS73rA+r/RqjYLXF172wQ+yIbHd
-tf0P6q6iqt1bhu+7xR0qgtAJNl2cYOdU6tkbnsIaTxJB27v7S4/6o/W7M6vbbjZ9
-VVVtTWlr6g5mslj2WV2Of+cPzV2GKdWxyNFx9/S8Xp31qz8jGcdmbFrmGIZYXF1w
-ZH5r7H71NgqUhA/pbfYtMbJ06PXV5m3unfmz3WZW/e3zHKmEpcUSQdwx8I7NveHO
-kqxTCz2ko9dpA+CAlqk4xVh//9XcNgJBBRpkArOqt3cK6La66S+1wY0fnH+H739l
-LquGobNR0hNlZOPi0m/IeKqxpJ7n9xjfpPesPL+sQpdtxwGju97dzv7NYO1v9tYe
-d1S7LLTdc64tJI3ANAn91rfapI4SdTp+bIIHro6uX9aL33GjCr9IgSHvALuJ9279
-HW3/ALcXN9Tvsurs9Wx1rtp32OmXEg73/wDmP5iOxp2vvJnf7GjyH0v/ACKrZLIp
-eXENDgQC4x925TCIGwpdQGz1XQc5ud0bDtcZtrrbTbPO6r9Ef8700suis2FxHJny
-XK/V3PswsnIxH/ze7dtPYuHuldO/J3t4kHsVnzjwyI8WSJBAdvplApY0jUka/ArQ
-DQ90+CwOn5j6trew08VpjODA57uE20kOi7NrxqnPcR7RJXIHJfk5Vt7p1O34kavP
-+e7ai9V6k80WPmBwwHu4/RVSms0tYyeGiT4nurnJQuRyH9H0x85bo2+rrUX3GpzK
-rPTtLSK3kAw78zcHfSYo4HX91rcbPZ6dpaP0zRtbu42OY7+V+exAqdpI0I57qrfb
-6d7joQHAxyNrvd/35XMmKE9x9eq3hBesrex7dzHB7eJBlHrEhchTlXY7/UxLoEyW
-u10/df8Av/21t4X1hoL21ZLPT3/RsbqP7f8A5h/22qk+VlE3H1D/AJyCNNH/1rDn
-jGYbX6N4juSsvK6k+10n4DyCfqOb65G3RjZDB5eJ/lLKse759lZxwERfVsQjwjxS
-22F3bTlBcZMAanQfEpNt8UnNDtRwnrmt1Lq7qQMfBAJaNvruE/E1sP8A1b1gWjIu
-t9TIc61zuXO1W1ZiguLlE4rSIKZKF7ljlEnctOvPy8Qsfta+oNDJcCYj/p/9Jdp0
-O6rqOJvx3h+2N7O7D+67/vq5X7OQIiR4HgoWKczpmU3O6ZYWPYfc3nT9y1n+Foco
-8mHiGm6YkxPcPo1VT2mC2Y+CsXscREwGtLnuJ0aAJc5zvot2rMp+uvQ/2bXmZZdT
-lOlr8NrS5+9v0nMP0fs7/wDB2uXO9T+uWV1Kuymmp1OO/iskNYYO5vrOb+mu/qey
-tVo4ZyNH0juf2MhnEDe0nXfrPXU8UYVTbWVn3W2yGnx9Njdr938pDxfrviWuaM7H
-fSeDZUd7f+23bXt/znrBdji6w23udbY4yY0CmMIHRrAPxV2AlAAQ0iOh1+1iMpk3
-b3PT+pYOYAcHIZeQJ2jR4H8up+2xLNtorv3OGtjQ6PhLf++rimdMdvDgYc3hw0I/
-quC2mszMplYyrjaagWscfpQTu97h9P8AtqcTkRqNV4kezonqWK3RjQT5ItWZ6hg1
-bQfFU2UVVAcAo1dkGADCNldZf//Z/9sAQwAIBgYHBgUIBwcHCQkICgwUDQwLCwwZ
-EhMPFB0aHx4dGhwcICQuJyAiLCMcHCg3KSwwMTQ0NB8nOT04MjwuMzQy/9sAQwEJ
-CQkMCwwYDQ0YMiEcITIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIy
-MjIyMjIyMjIyMjIyMjIy/8AAEQgBAAEAAwEiAAIRAQMRAf/EAB8AAAEFAQEBAQEB
-AAAAAAAAAAABAgMEBQYHCAkKC//EALUQAAIBAwMCBAMFBQQEAAABfQECAwAEEQUS
-ITFBBhNRYQcicRQygZGhCCNCscEVUtHwJDNicoIJChYXGBkaJSYnKCkqNDU2Nzg5
-OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6g4SFhoeIiYqSk5SVlpeY
-mZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2drh4uPk5ebn6Onq
-8fLz9PX29/j5+v/EAB8BAAMBAQEBAQEBAQEAAAAAAAABAgMEBQYHCAkKC//EALUR
-AAIBAgQEAwQHBQQEAAECdwABAgMRBAUhMQYSQVEHYXETIjKBCBRCkaGxwQkjM1Lw
-FWJy0QoWJDThJfEXGBkaJicoKSo1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdo
-aWpzdHV2d3h5eoKDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLD
-xMXGx8jJytLT1NXW19jZ2uLj5OXm5+jp6vLz9PX29/j5+v/aAAwDAQACEQMRAD8A
-9LklcPwR0HYelIty46kfkKbJ978B/KoH602Box3rZ+8P++RUwu2I6j/vkVheaytg
-VbjlJHNSVcsy3Dk9R+QrOuZGPp+QqwzZJqrNyatESZnyM27qPyFVZpHA6j8hV6SP
-5qpzJwaDIz3mbPX9BTRO3qPyFOkTnmodvNICcTN6j8hVuCV89R+QrPWrtv8AepIa
-Zs20jcdPyFaccr46j/vkVlW3atGPpWiKRaEz+o/IU4TP6j/vkVAKcOtAEpmf1H/f
-IqJ5n9R+QpT0qFzigQ7znz1H5CpUmf1H5CqgPNSoaBlwTP6j/vkUvmv6j/vkVAtS
-UASiV/Uf98ip45Xz1H/fIqqtWIxzTEXopn9R/wB8irSSNjkj8hVGOrSdKljRYLtj
-r+lQvK47j8hSluKryuMdaEhsqXUr88j/AL5FUN756j/vkVYuJBmqRkGetWZMtxyv
-nqP++RV2Kd968jqP4RWSsw9alS4w6896BlWU/OR7D+VQtipJP9YT7D+VRkZFZmxC
-FBepgvFRAENTy3FKwgY8VDIeaR5cVXaXcapITHNzUEqZFS0yQ/L1oaJKEsfNQGH2
-q059aiL81IrEPlc1agjwaiLKi73YKo7ms651+OMMtv8Agx7/AIUm0iowbOnWWOBQ
-ZHVR2yaZLr9pAQoBbJxntXC3GpSud7vkE5PPI9arrqXmSBzlllGAV7f/AF6XMzZU
-0d2PE24nZEuMcDPNNHipgMtCp5wetcQZCN7+aQpPNPjuSIRvfLdOe/H6UczHyo9A
-h8SW8oIkiZD7HNW4762uVzFKDnseK8vm1KVXKAEyHlSehq3Zaw5APG4fdHc9qfMy
-XTR6R3qVa43T/EcjAbnLNkghvaugs9atpwN+Yye56CmpIlwaNlTTxUSEEAqQQehF
-SCrIJFqwhqqpqdDTEXIzVhWqpGamU8UgJXk4qhcz7QeasydKybwnnNMTKVzeYbrV
-P7XnvUF3ncaqoSTTJNVbj3p4mO9ee9UIlY1dihJdevUUDL7p8/4D+VAiz2qcgb/w
-H8qeFGKzOhIovHjtUBQ4NaTRgmm+QCOlTcOUxJVOTUSxkmtaa361B5GKtGTViiQR
-2qCQkVfljAqpOuFoEZlxJhqqXN9HZwiSQgsfup6+9PvpVgjaaToOgPc9q4HVNVuJ
-LmTfnaen+z/9aspStoaU4X1Zo3uty3ExZpPlU8f3R68VmtdO5kIAaTkBT6dfxFZE
-t66riWI7Wzz6k98VEvmhVeOUggdGGf8AJqNzY2Y9RleMlhjB+dCP6+tSwvDiQpuM
-bsGwpwVP+FZ8KSsd7gAlcEjkH/CrEcTIQRjbk5/wPsaLjsTrO8bSI0nfIOOvP6Gp
-EuzOskTAK/JPoCP/ANVQ7Fcdc7TuAz+lEdriUzxAuQcOp64/yadwsWGnmmXI+fBD
-Lg9wKoG5m8qNUzHIHKnHp/nNa1tpUgH7skCQ/L7EGpbjT5Yywhi3sww7hc47cUrj
-5SpJJJFCJt534LcHrWrDqjxQIZjnfhcg9c9MVjNFOHkAXBUYUnoO34mnX4kuIoot
-yr5Y6KfucY/OhCPRtC14FY0dx5RO3BP3feuvGMAg5B6GvFrDVFtY0i8t5OduFHP1
-r0PwnqwuUa1duR80eTnj0rWEuhlOPVHUCpkqEVMgrUyLMYqyo4qCMVaRaQIjkXIr
-Nuo61nXiqc6cU0Jo5y5gGTxVQQc9K2bmPmqezmq6EEcUXPStCCP51+oqKJOavQr8
-6fUUhjGb5/wH8qkQ1XZvn/AfyqVKyZ0omAzTgtNWpF6VNyyCRAe1QMgxVtutQPjF
-WjKSM+WP5qo3CADritGZsNWPrNyLbTZ5uu1Dim9jK12ef+INYE908aNiNDtU+vrX
-NoxkyRuK9ORTpcfaS80mQeiity00O5vVVwQikZHy1ySZ2xWlkc9JEcbSGx6cH/8A
-XSqq5KJuVhyCB1H0rsYvBzu/zucDocYrTTwbbeWNwIb1BqedGns2zg4N2dyup4z0
-4/GrqQNO+GBVyODj9K7q38J2cZ3YJOPWr8fh+13D5MAelHtEUqLOMsdBuZ13eSe/
-OK3LbwvKrqShLFeuMc+hrtbaOG2jCIgAFXY3TI4pc9x8ljCsvDQlDEqBv56d60Zv
-DqiPAXHPbtW5C69iMVbBDDkVolczk7Hn+p+Ho/sxRYViVur9STXm95pUMMjoQCQf
-vbiPzr3XV4ENs5x0HFeS6tbLLNICP3me3emS9Vc5m2kiilKsSqDgbm6j8K6XS5Vi
-ljnhYho2BIJrmLyzMUmY8ZHH0rS01HbEhYlAMZznNUiGe0qdyqw6MAanjrP0yUza
-ZbSMCCUGcmtCOuhHKy5EOKtoOKqwjiriDihjEYcVVmXg1dYcVVlHBoQmZFytUsfN
-WjcjrVLHNWZj415q9Avzr9RVSIc1fhHzp9RSGZzff/AfyqRBTCPn/AfyqaMVkdA9
-alWmCnjpU9TToMbrVeU8danc4rPuJCKuJlMq3D4aue8SXBj0eYhVbIxgmta5l5rA
-1j/SLGeLuVOM+tE9iI7o8yj2PeCNVG4v3PA+lev6dbJDYxAAD5RnFePWgWHUv7zb
-8k4969lsG3WMX+6K5JndSJycdB+Ap6BiOSKaAe1WYYi3bPvXOzrjsMVe279KnjGO
-N4/KphaHb94flSLAqnl/pilqO44IMjgGrcI45AqONEUjlj9TVxGj4+UfnVx3IkSR
-r7AVYUkdKiBXtTx61ujnauVNWY/ZWGe1eaXkYlnk4G8HAOOten3UZmiZT6VwuoWx
-trp+vsSOtUiGcddwlweFAzgg8H65o061KEFs5Xgen4VauJElkOVOVPTv75p1uCzn
-CgqTnB7VdjNnpWlHOl2x/wBitKOsvRjnS4Qe3HStWOt1scz3LsPariCqkI6VdQcU
-mCFI4qrKOKtnpVaXpQhsyrodaokc1o3Q61QxzWhkyWIcir8I+dfqKpxdRV6EfOn1
-FIZl/wAX4D+VTR1BuG78B/KpUfiszpTJ+1LTN9G6o6l9Bsp4NZd0cZq/I9Zty2c1
-aZlMybp+ay5vmzkZB4IrUmTLVTlj4oZkeYahbm11krjADcY9O1eq6W3+gQ/7org/
-EcGzW4TjaHC8ge/NdzaXVpbRJE04ZlUfLGC7fpmuWomd9Frc1BnGSM0huzGeelYN
-94ysrY+WqMfcjH6Viz+NbWY7Fcp3OE3H+dY+zZ0e0ijvY9UXacnpUcmpRgZzjn1r
-h7XXo5nBjmaQ56NHt/qa2IvKvY2zKo7qc52mpcWjSMos6IXzcHICn3qVdWtoD+/n
-VMHu1cPfS3WXhSXKxY3bTjGfX8BXM3d1PDPuS6CjkEZxmrjG25E5dj2VvE+nxfda
-SQdyqHH5mrVn4giu2C29vuJ6bpVWvFrKBrj5p9QkOf4QDzXT2ENujRiC+ZZV5CsS
-ufoDWlzLlbPUnuZImQ3FuYo3IXzBIGVSeme454qrq+nQ3kDx4j84DIGRmsq2vnu9
-HubGUly8TAZ9ccc/XFbsNnZ3EMZeyTeVBOc5BxzzVq1jKSkjyG5tWt55lK5YMc56
-/wCeKnt1HlArwwwc4xx9K1fFsVzp2sERaelxCfmwZCrY9m9frVfRrC41VJPJilSM
-52C4j2lD6E9Py61d9LkJNux1+g8aVHznJJ46VtR1W0rSHtNNSFp43kUchRgH6VaT
-itYtNaHPOLT1L0HarqHiqEParqHimyUSmq8vSpS1VpX4NCBlC5HWqO3mrVy/vVQO
-M1oZliLrV+H76fUVnI4zVyKQb157ikMxS3z9ew/lUivUJ+/+A/lT0BNZm2pYD08G
-o1Q1IEpFq5DKaz5utaEqmqbRkmmTIoNGSaia1zzWqIPan/Z+OlBmcTqFvp95eX0E
-zqlxa237ouwXLnJ4z14HT3qU3Lf8IhbmL5ZJYVU47etaupCz+0zCaNJcwGJ4pEDK
-wznv3HNZbWyR6BbQRqFjVfk29AMnFc1SSex3Uqco6s424hsrWJftjtJJ94oD+tc/
-d6pZwyfuLBlPRSRXVTeHo7y7lubxnCZGxM9cdz/hUMtnaJL8qNNJ0C7NxqE11NHB
-v4TnLC+maVi42ho2I5wcYx17V634GkmvtGQt/qxwpUYyMVx0GkNLkPBGrvgYA+6M
-85r0jw1Gljaw2qqAir29amdmrF04yi2zJ8QabdRz4aMvHKDGDnhQfun8Gx+BNeeX
-Gi3KX+2UYRThwWwxPce1fQNzaR3NkY3UHJyM1zGqeGI7tzPgeZ/FnoarVIFaTPJ/
-+EOlu7pZYmaNQemc4Brr7PwY8kAH29o1AGImwy/XnofpWrD4flgcAIwU+jEit+xs
-BEnQkjpupc7D2cY6oytJ0q9sciRt6r0ZWP8AI12dizbQT0qvb2525Y8k1ejj2jj1
-ojcibvuQavpVvqcIE0asQOp61lTj7Jp4trNSTFhVGep9z6V0eeMZrg9cv9R0nXVj
-jytv9/dj72f8OlXUlZXDDU3KdluQ67FqVglrepeTqScMgb5c/SustJvtFtDMesiA
-n61mXEw1jQckBmWRR+daVtGIYI4h/AuKdBe+2trFY2SdFRktUzQiPFWVPFU4zVlT
-xXWeWPd8Cs+5mwDzVqUnFZV4Tg0ITKdxcjPWqouOagut2TVYOaok147j3qxHc/Ov
-PcVjozE1aiyXXr1FBSLW0b/wH8qmQCo+r/gP5VMnWsjdIlUVIoGKavSnr0qC0iGQ
-ZNVygzVp+tRY+arREkCRA4qVosLTogM1I+AtMxZ5d4vtbqz8SxXUUsixT4IAPAPe
-ukaLdAAAoAUYAAxVzxFYLf6c4C5kj+dPrWfa3Hmxbf7pwf5/1rhqR5ZM9anVVWlH
-utCo1g7ZyqkH/ZpE00dCu0Z6AAZrZXAXk4qvK3bJ/Cs22jRRKJhihOFUe5rasIcq
-GDYJrFlkHnRw55ZgCfSrp1aCxbbuHt7ULVFcrT0OztvmiC5zUV6FjibfwPWsbTPE
-McofJHy8nnpT08UaTqgmtobqOV8FSEOcGtk04mLpyUhIrwF8Bs1eilXcDxn+dcXe
-G40pvMyTEev+zVyy1uOdRiQN7VjFs3lBW0O6iZGXgilLGM4PesCz1PDhS3Xoa2ln
-WVQTW6kmjklBxZYTgVjeIbZ71o4o4DI4U9ByBWwpGOKa7GOVWyu0kAeuaqSurEU5
-cs+ZGDo9i9lZtDKMNvDFe4xzV5OTV29KLGXX7z8VSjrajHljYxxVV1JXZajFW0HF
-V4R0q2g4rRnORSLxWbdR5BrXdeKo3CcU0SznrmHnpVXyRWtcpzVPZzVkkMcPIq9D
-CN6/UUyJOavwIN6/UUhoqj7/AOA/lVhBUAxv/AfyqdayOolHSnqKRakXGKmw7kLD
-5qZxmpZOKrk/NVozkydTjFKzDHWoNxqOSXAoMxZgDXOvb/Z7i4KrhSwI962Xm4PN
-Ub3JhyBkZ5OOlYVY3R0YaXLK3crNP8vXtVaa4CpkGobgkMvOK53Wb+RCkKHlzj8K
-5Grnpxdlc1k2zbnZgAOhzXH6l9og1B3F3KyDoobj8RVyLVESExPLnaMk96xLovPc
-F42xuPYdB2rSEbbmc6jexs6drptiY3jVmkHGTkcV02mapZRTRyrFGJXAAAXGB+Fc
-FJotxJFEyod6kAFc5NdRpmmeUkTXd1FEwXBVmq7pEJzk7nVXt6J7aVnyoz8ucHI9
-a8+uH8u+L2dwYmLfKV6Ee4rpLprKytZZbq/fyVy22GMkY7c9MVzlrYXuuXP9oWtn
-Jaafu+Qzffkx3x6VNluDcjsPDepvdFoLtNk0Zw2D+oruYmZFGTxjqO9cTp9n5N+J
-UwNyKCMdMV2K/wCqTnmlDcc9kasEm5awNf1CS2usRyo+XjCw5+bfkYx9QfyzWtBJ
-+7z0qnqWnWk7Wt1NbRPMpJWRl+YYORz7Vskm9TmlJx1JfMeQ/O2cdPSpo6rR9atR
-iulKyOSTbd2XYe1XF6VVg7VcTpQxDXHFVJhwavMOKqTDrRETMe5XmqRHNaNyOapY
-5qyB0S8ir8C/Ov1FVIhyKvwj50+ooKRlA/P+A/lViM1VPEn4D+VPEmKxOlsvqafn
-FUlm460/zvei5OpLIagY80xpSTxTCSaExco4uKglbjrSspzxUUikjGaLi5StJLtJ
-5pFuBjrUcymqjK2eM0rj5Ste/LLsA4IJDdq53V7KSZFljI3rn8M10swLxYOSRyKy
-Wl2sysODXHNNSPRpS5o6nnwhuYJmVrSabq37thn9as212jjcLeSFjnKtGXYY9hXa
-QwR7ydoDdRjim311b2IDNbKzHvj+tO41FIq2VpcPKhE9y0fVgCFzXSQWkchMNrbQ
-weZEUeRxvkye4rkj4nhh27bcKx7c81cTxiFYBYghPAK8jPvVK5TdPrc7M+ErO9kt
-5NQc3H2dNkavwp5zkr0J96v3MEEUSjAVANoHTFc/4d1O5vpGa53jYR9Cata9qDqu
-1c8N90dj2qXroQ2NSMrdtjnnIrbjbEWOflFVbJUntVk+VmA5HoaeGB4OMDpTSsyX
-K6NBZGYKBxk4FaGoJizhI/hOP0rOslL3EZI4XvWxqC509vZga2juc9XYy4xVyIVT
-jNXIiK3ucti9CKuKOKqQkYq2poYCkcVUmHWrTEYqtKRQmDMu5HWqRHNX7jvVPHNX
-czsSRDmr0A+dPqKqRDmr0I+dPqKYznpJP3h+g/lUZk561FM2JD9B/KoN7E9axN0X
-VlNSCTNUd5AGKBKwpDuaG6nA1URyakBNIaJy3FRtg0wk0wuaBitGDUTW4p2+jfTF
-crm1BPSue1bT5LeTeoJjbof6V1O6orhRJAyMoKkcg1nUimrmlKTUrHnV9fSW17ao
-uSDlmGe1bAaK/t2JQbeOpzWD4w06aBoryLc0UeVYDsDWVZay8SbXJMeM+wFY8l1d
-G7qcsmmXbzRpJX/cx8luC3AFWtJ8NXTXDyXDBVAzjGTV6x1KCZlXOeAdx7e1TNrJ
-tbhmUgBVHJPJFF3sUlHc6W1+zWMPzyfKwCgZxmsTUXNxfb1mwG5I7A496z7nXUnV
-kTaFb5kzzz6GsuDUkkgZZgzSM4C4bGcjOPfmrhHqZVJ30Oy8KyvHFcNM7Zc5K54B
-/wADW/aqZG3HIWue0e2kjtyZlCTOecHt2FdJB8qgDGAOnah7jimkbFn94cbSKvah
-OkGkXU8gYpFE0jBRk4UZ4/KqFsflGQRitERrcwPA/wB2RCh+hGKcXqTNaHDWXjzw
-1d42aksZOB+9QrXURTKyqysGUjIIOQRXzDfQGxvrm0ljw1vI0Z4xypI/pXu/hS+3
-6LaoTkeWMe3Fdns7xbRDpqx2cU+Mc1aS5GOtYQmx3qQXPvWPMZchttcDFVpLgVnG
-696Z5+T1o5gVMtSvuqIKDUe/NPVhT5w9kWIxyKuwj51+oqklW4GxIv1FUmRKFjjp
-SS/4D+VNQHPNPlOGP0H8qYrVBoh7dKbTj92m0Ek8fSph0qCLpU4oKQGomqY9KiYc
-0AyM0tBpKBDhUN1cRW0QaVgoZgi+5JxT3dIkLyOEQdWY4ArzXxh4ga4mPksRHByg
-9x3qow59C4K7uddfwo6yRyKHByCCOo9K831bwtdWUjyWJMsRP+r6Ff8AGvTXkE9u
-k6gMsqK4I9CM1SeAMxGfvcVxRbR1zipI8pTVLiymCywOGUd1qSbWXuGDIkrZGGAB
-INdjqNkAxwACay/KKNjaMA/witOZb2M+R9zLs7bUrsoiwsqk4JbjFdzougx20iXE
-376fjZleE4xwKp6fHvdV2nkcV2unWiiMsSF4+WhyYKCQkYKtwenTA5q/agEjcB07
-jrR9mUY+UAn1p0WM/Lk+vHFSWlc2Lf7mDwT2rQt8jis6AkEZH41oQdRTREjwz4v+
-F57DxFJq1nbu9peJ5kxRc+XIPvE+gIwfzrpfDZaLTLZeeI1/HgV0njiVZbYxBirK
-pII6g1zOkyCOCIE84r0cBPncl2Dlajc62KTegPfvTs1RhmCsP7pq92rOvS5J+TMX
-oGaUUlKKxEPU1IHNRDrTxUM1Wxaik7GrUUmHX6is5TirEbHcv1FOLJmlY5yZvnP0
-H8qiR/mpjzfN+A/lTA3zZqzBMvg5WkpIiCtFAMliPNWBVRThqtKeKBoeajen1g65
-4jg0xzbxr511jOwHhPrTjFydkWot7GpLLHAm+V1RB3Y4FYV74qtYAwtkafHVuiiu
-M1jVL24Ia4YyBuRsfgfgaqW7SXMTLOdsQI3BT29Pqa6Y0Ety1BLc0LrxBdaihvJp
-HVGJEEXQAf3sfyrltTkLQyEnqK0ryUyP8oAA4AHQCsnUj/oz/StbJLQt7HpnhC9G
-o+EdPbdl44vKf6rx/KtURrn6etedfDvVfIe6sHbC7hIg+o5/lXo28EEgDn17141S
-PLNm0HeJm38CvIehz1GKyjZjzNxXGO9b9z1LDvWeTtYZCn8KVw5SxplruOAu4V1l
-muEC9Mdfc1l6eF8lfmA47VqwKM8CqTE1YtOPlyxyTxgdTUcSY/hCZ5pSecHqD+VT
-qoIGcYoEieBlIBByD3q35yxx9eQKzTKIxis3VdTENsxB5x60XsiWrs57xNqPnvNh
-uWfy1qhCSqKB2FZ80zXWoBf4YRk/7x6/pV6LPpXsZdS5KfM+pcn0Ni1uSAATkVav
-dXfTrQXHkGaEff2nBX3+lY8RI56VoRuk0LQSD5JFKkfWuupSjNWZm4l7T9esNQA8
-uQox/hk4rUrzG7hntLby1ifMRK71+bOPXHNbfh/xDOqpbXJLcfKHUg/hXBUwv8hL
-guh2o608VTtr+3uW2K4En909auCuGcJRdpIaTW49Rmp0Hzr9RUMfWrUYy6/WlHcm
-exw7P8/4D+VODc1n+fmXk9hVpD0Nas5UacDVO3WqUB6Ul7qtvaAIcyzf8806j6nt
-SSbdkaWb2LlUrjxHYWmUEnnSDqsfOPxrmdR1ie43JM4CH/llHwv4nvWI+pugxGqq
-OwArphQ6yNY0rbnTXHi+5mdljt2iT13cmuWuJ2luHkkOWZiSaik1OVuGqn5pLZNb
-pJbGmnQdeTEx7Rzg5FWtpgtxF/F1b61HZos1yHb7sY3nP6VLcEs2e7UwKMnXHXNU
-tSTFsVHXHNaQjJl9hWffy2+0xvPErk9GcA0nsS2ZOnXTadrcMoOAx2tXrFjqC3EK
-5OfxryPVIWimTIwQwrq9HvmWJQx7cHNediI+8OErOx3pnHrVeUxtnB2mqcMxdMnm
-gkN3zXLY2TNTT7gxfK0nFdFaXiYwCSK4+HjHWtS2lZcULQbOladSw571Os6hOO9Y
-iyEjP4024vSkX3j9KaZL2Ld5fBCeR+dczqt+WiZycKOme5p80zyvuOc+mawtamMj
-pAp+78z/AFPAH9aulD2lRRDZXEsw3keec5diTWnG5Dc8j1FRpEFs0UdMU6I4XB7V
-9HFJKxJeTJznmp1YKcHp71TRypFW92UzjIqwKd+VFw65++Ax/wA/hUEDR7xG4yuc
-/Q+op+osoaFs5yCM4rPL4kV8H61D0YGg73FvcM0o81DyroOR9R/h+Vamm+JnUKkp
-WZTx1+YVjrdpKgVifY0jiN8FlDkdG7j8aicIzVnqM9DtL63nYBZArnnaxwa1Yx86
-/UV5cs7928xcfdY4I/GtjQ/E09tMkNySyZ4STr+B71xTwdtYGc43WhkuuHyParUM
-vyjPagwgt+ArL1K8EJMUZ+tc8IOTsc0I8zLd1qm1TGjlR32nk/j2rFluhtKrhVPO
-BVGSc4PNVWmJbrXbGKirI6kktixLKDnmqTnc3WnMSefzqIggd6YwO3rURpWJ/wAK
-RRvkVSwUMQCewpCNO0Ty7QMR80h3fh2rJ1PxBaaflV/0if8AuoeB9TVbV9XknUxW
-+6ODoD0Zx/Qe1cvJGWaok2tjOc30HX2v397uUyeVGf4I+M1QVA4wetWTaHHSkSIq
-3IrBxbephZt6l+PUCunqkr+eUPzRTDt2Kt1rc07V7Dy1G4xj0Y5x+Nc8bYSpgiqW
-2WylzgEZ6EcGiUf5ldFqTieuadN93DZQjII5BFauzocdfSuC8L+JIQY7W6cKM4jY
-/wAPsfb3r023t1lhV0JAP901xVIOLOmDTWhXiGKuwhCRgHNH2Qg8N+YqaKB84Z+v
-YCs2zSxYBbZ6VRmYk4/XFaLKFiA5JNVJ0S3gkublhHDGMsT2pJ9EHKUW2woZH6fT
-JPsK5S/1nS4L7yru5WO4ZvMZWz8o7A46HFUvE/ia6uB5VrmBMZXH3gOnPvXnszIj
-E53sTkmvSoU/YLme7MKlXse22t5a30Cm1uIpl/6ZsDTkXLEYrwlLiWOTfE7RuOhQ
-4roNO8ba3ZYElwLhB2mGTj69a7I4pP4kQq66nrSHBKt1qzDJsOG+6f0ridO+IGnX
-W1L6J7aTpuHzL/iP1rqrW7tryESW86TJ/eQ5xXRGpGWzNVJPYl1OEvHGc5Ct19iK
-pCAcAk1cvHK6ZM3JKAMKwTqLnksMAU5bjujUEEY708BQMbuO2awm1UDoTUJv5XJA
-J5NRzIOZHSgxg9R+dKPLY4JBGehFc7H57nljWjalw4BJ61SkNM3765FtwOZGHA9B
-jrXI3U252Oc5PerlzeS3Mpkf7zLx/wDW9qy5ckn5T+VckI8qsZwjyqxA0mahZ9rH
-60rq2TwePaoW3HIwc/SqKJw+eafnIqmuRxz+VSByOOaAJWFQyL6VOPmHSmtGcdDR
-YDEuIWZjVYW2D0rZeL5un6VE0PsfypWM2jPEGRUb2nPArT2Y6rS+WSOhosFjJSLB
-PFOkgSRCrjINaBg56VG0BI5BH0FKwrHPXFk9q+SCU/hYV1vhHxvPo8qW17mWzY4P
-PK+9UOMeXKmUPtVC40sxNujBaJuntWUqSZKTi7o+hrWS3vbWO4gcSROMqw71N5Kg
-cAV474I8VXHh2aW3vUeTTcEkjnY3bHv7Vc1v4p3dzG8Nhb/Z4zwGz8xHuf8ACuGW
-FlzWWx0KsranoWp67Y6aSrkzTgcQxckfU9BXA+JPEd1qEam7ljtrWNtywIOCexJ7
-1wsmr6tdSZFw0YPZBimFHlINzLJKR03NnFdVGhCGtrsiVVyVkN1C/m1CZvJDbD1Y
-9TVZNNkblzitJML91KkCu4+7W7gm7sy5b7meNPRepFBtUHbNaYtieufyqVLTPY0/
-ZoOVGL9n9B+lWLNrm0mEltLJE4/iQkGtgWQz0/SrCWIB4Xn6VSpjsjV07xRcPbS2
-1/D5oeNlEicHOOMjp17iqCJM4Xc2eO1WLazG4HH1GK1EtgAMJgVtZ9S0myjBZZXk
-Vdjt1XjH6VOse0dDSM4HQH8KdjRIVFAIx+tWoiA6jpz1NUP3jHIBqeESBwcNwfSm
-hn//2YkCOAQTAQgAIgUCXNbVKQIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AA
-CgkQKrEqetxVwAOgWBAAgewnppKesDIFGGNarl/JUkhLUyNxLS1MhtOhES+i6NOK
-x1GcM1/E9aw5Jyc8lcJp5jn5mkQ4JX8PXXfXbemAdfMih7y51Cx/RwYwUskqkA25
-Y6pm02vhXxIaWmHTDnNDgsPWGAOpm8guzHFZZmGlmF25TDu0MsiJDy/j09Y3w0he
-7TIKWVz04z8Lj+g7YOfAAQQDMVo1ShxtbgOFdnRJeOcYZlENUd99y99+Zsdk3Ubc
-keQsEUnW6S8rjuZi3zsjE+yeddY8Mnl/yyzCutv1lvrfk/WZ7ZYuhPBNveDTOEyl
-N4/guRkVyyfs9k4Yo2LowW2lDoNoN48UlrxJEHXZ+9qad+7oTjYJ4tUNUCeb38gE
-obp4McQqeHYWK4hsVS0nJnJ3toLCYJ8dfMJ/MEFdr3qmOLi7J3y6PFtuJr0bGQ4k
-wwObqLqxb94I5AnOM4STWDc3JtsxwnnrLCX+1ehzFaCOHr/aiWDpypL1WsIoV0R8
-wr+e5Ujysbn9VsnNtmKigUvV7pMPEx0SYRf6x9GM9OnNiw9LW6AfEYR6N8sx5iBi
-+tHWlbQRYF5j/HCf7INXmX7vA26nKObQU6rhyaSFJzvHvWbJUqT2kxqCoqOjf04p
-dSVKgG0bSnKJZLin4yZ+PJ0oQnOClSGxDpI4Yn4Cst6S/MjOMmtmZDFe5sl3zZ+J
-ARwEEAEIAAYFAlzW1tYACgkQmV41IhrYTf+BtQf+JEhjggRITJD0hCUPf14WCn1e
-Zg+p1CqOcypxB2S66W9tOg9zTGAIcMWh/erhC185oyqXWGNQE5BtvPmMbeQ0vabF
-a1C42+vPuPB045qbcOOrGPA/WiiY4iYkvXMy5FlLXEEYA2I27+HaHHO4sxZhclkN
-VnMxHCh6MBdXYHbR3AdhPOR8fcg29IsMk8QqIsV8lKrv1NDXgdF6y5Pa764dnqkk
-rere7WEv3uOpv0MC80qjZosxQB4Mypd8YmS3aKM/B9R9nBBCDFAeJPlCENMb5ZdD
-Nk4uNCYuAaAoLLlC0v823zhiAi/8hkBD+XxSWNPQtoJzx78hXflH0fGOiPzLC7kC
-DQRc1tThARAAxNRrcpany4fujNqaDiUTFzlsrtRo1dzkGOishbDEl+1m2HCHbo2Z
-lXcXqd+e9YTsidCaPHbYPP1VoE4Be9yaicK5yRXl843W0Y7nIuCJOAFtqIrDBuFX
-hZuFUL1rMNdUfuZlYOBnWXxVAvZpacpY03Y2hHkumlWe13wngKJWZt089VWiqDIK
-xaXwIG6MirppxarFNUgf6J+z0ZK5Qn1Xl0JRsyZ6BCxNv7vNfH2EgaYS983Cljec
-cgVHO0SQ5saJIjyj3sdfo/4FxnrGdgNufIPCknSE+7TsBuowRyVZf6L5IKtFYFhA
-Wo4zG9NveJdFcVsuUxKzSZeOBvAuCq5+r89Mw6NrxaaBvINCE1pGJK4Q7EIfgyDu
-sr7xnlUhGuwQM1GKSRp95IeOYlmnWoAcPfMIxR3Mu6Hg593xCd8jVB6nbtcUKD5S
-DOmvo7NFQxLbX4adLwqf2/VMfks8mBgJUG+Cx0L/aQpPL9NA2FjxTwNjdVpbmt+Q
-acABBzoQ7XQzdOG9K+cJVODLZo3RNN4G1FGiTIJuxYWTFXNWVv+RSn1RmdIf5kdF
-K1LUfOrPvZM3FX2OkGy++61kHIxOIT/D0ednGz/fgly3ff8EuxSNCikVlhuxYtx8
-QnMvMOFpEb13Jj+F9pQ1O/8V9PsSo7kk5wuHC01CBodHc5Gu0clhBm0AEQEAAYkC
-HwQYAQgACQUCXNbU4QIbDAAKCRAqsSp63FXAA728EAChAYvY4KgqJyrUd6OGDq2w
-7USK1bwsMXK73nKY5gGwmuyv5U9ZesIY7gNS6SCWuPNH+zRPJ2pzUHTsZz+S5/Cp
-OW/LnEa6908J6drNyzkKgH1gciwwnWRjYg/dHOxTh3GBTag+IOubvZSHyLbPcgTx
-NQpdftuDSnmBTJKpsRVUQNT8AL2yqz7lDH4Gr2RMtNYVX11P/reQiGvQpjvVNWGO
-AmJaC79ZTKvk6MP9yHKskoF0VMsf7LwNzR9YY14ZoaPziObDN2xgcqzhP5QeoQFO
-D6jbT1D22797v5j7hGOrdTalJ6hbOvrTDfpIKLouk3QfblIBU7Be93rIrOIdgzPh
-RrsxjdGnY5v9AdSMO8nT1xOWhJvyZhsPEcRhdf4EE15wohOQEu9HwS/51qfGjaYG
-Fj2vQfXOKs2jA3zIMDmnEk4g5ZC/PsltbB7jyza6jjncIYcv9r/CMkS7s7NUivXD
-RtwvDgfBfC20+FDeOIIDUGd7B24Oge0a5tER+9np2n8w5Ayn/saajZO1O0kSQW7b
-Iox2IWgDPkDdGC/aRpg1IX6vJrEJgxS0pDQf0FH0Auy3uqgBuFNYa4erzFxSYHGW
-NrZCp0H4kt/ZaEnE9n4LKD94yF8bTw6lO5/yidRBoVe28l34aKMvzr62cqezzjIJ
-B+RdjYxImSzlmE2uJO6PKA==
-=Om41
------END PGP PUBLIC KEY BLOCK-----
diff --git a/httpd-2.4.43-mod_systemd.patch b/httpd-2.4.43-mod_systemd.patch
new file mode 100644
index 0000000..8d7922e
--- /dev/null
+++ b/httpd-2.4.43-mod_systemd.patch
@@ -0,0 +1,96 @@
+
+More verbose startup logging for mod_systemd.
+
+--- httpd-2.4.43/modules/arch/unix/mod_systemd.c.mod_systemd
++++ httpd-2.4.43/modules/arch/unix/mod_systemd.c
+@@ -29,11 +29,14 @@
+ #include "mpm_common.h"
+ 
+ #include "systemd/sd-daemon.h"
++#include "systemd/sd-journal.h"
+ 
+ #if APR_HAVE_UNISTD_H
+ #include <unistd.h>
+ #endif
+ 
++static char describe_listeners[30];
++
+ static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
+                               apr_pool_t *ptemp)
+ {
+@@ -44,6 +47,20 @@
+     return OK;
+ }
+ 
++static char *dump_listener(ap_listen_rec *lr, apr_pool_t *p)
++{
++    apr_sockaddr_t *sa = lr->bind_addr;
++    char addr[128];
++
++    if (apr_sockaddr_is_wildcard(sa)) {
++        return apr_pstrcat(p, "port ", apr_itoa(p, sa->port), NULL);
++    }
++
++    apr_sockaddr_ip_getbuf(addr, sizeof addr, sa);
++
++    return apr_psprintf(p, "%s port %u", addr, sa->port);
++}
++
+ /* Report the service is ready in post_config, which could be during
+  * startup or after a reload.  The server could still hit a fatal
+  * startup error after this point during ap_run_mpm(), so this is
+@@ -51,19 +68,51 @@
+  * the TCP ports so new connections will not be rejected.  There will
+  * always be a possible async failure event simultaneous to the
+  * service reporting "ready", so this should be good enough. */
+-static int systemd_post_config(apr_pool_t *p, apr_pool_t *plog,
++static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
+                                apr_pool_t *ptemp, server_rec *main_server)
+ {
++    ap_listen_rec *lr;
++    apr_size_t plen = sizeof describe_listeners;
++    char *p = describe_listeners;
++
++    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
++        return OK;
++
++    for (lr = ap_listeners; lr; lr = lr->next) {
++        char *s = dump_listener(lr, ptemp);
++
++        if (strlen(s) + 3 < plen) {
++            char *newp = apr_cpystrn(p, s, plen);
++            if (lr->next)
++                newp = apr_cpystrn(newp, ", ", 3);
++            plen -= newp - p;
++            p = newp;
++        }
++        else {
++            if (plen < 4) {
++                p = describe_listeners + sizeof describe_listeners - 4;
++                plen = 4;
++            }
++            apr_cpystrn(p, "...", plen);
++            break;
++        }
++    }
++
+     sd_notify(0, "READY=1\n"
+               "STATUS=Configuration loaded.\n");
++
++    sd_journal_print(LOG_INFO, "Server configured, listening on: %s",
++                     describe_listeners);
++
+     return OK;
+ }
+ 
+ static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
+ {
+     sd_notifyf(0, "READY=1\n"
+-               "STATUS=Processing requests...\n"
+-               "MAINPID=%" APR_PID_T_FMT, getpid());
++               "STATUS=Started, listening on: %s\n"
++               "MAINPID=%" APR_PID_T_FMT,
++               describe_listeners, getpid());
+ 
+     return OK;
+ }
diff --git a/httpd-2.4.43-r1876548.patch b/httpd-2.4.43-r1876548.patch
new file mode 100644
index 0000000..130ea17
--- /dev/null
+++ b/httpd-2.4.43-r1876548.patch
@@ -0,0 +1,82 @@
+# ./pullrev.sh 1876548
+http://svn.apache.org/viewvc?view=revision&revision=1876548
+
+--- httpd-2.4.43/modules/ssl/ssl_util_stapling.c
++++ httpd-2.4.43/modules/ssl/ssl_util_stapling.c
+@@ -130,6 +130,7 @@
+     X509 *issuer = NULL;
+     OCSP_CERTID *cid = NULL;
+     STACK_OF(OPENSSL_STRING) *aia = NULL;
++    int rv = 1; /* until further notice */
+ 
+     if (x == NULL)
+         return 0;
+@@ -154,16 +155,18 @@
+             SSL_CTX_set_tlsext_status_cb(mctx->ssl_ctx, stapling_cb);
+             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(10177) "OCSP stapling added via hook");
+         }
+-        return 1;
++        goto cleanup;
+     }
+     
+     if (mctx->stapling_enabled != TRUE) {
+         /* mod_ssl's own implementation is not enabled */
+-        return 1;
++        goto cleanup;
+     }
+     
+-    if (X509_digest(x, EVP_sha1(), idx, NULL) != 1)
+-        return 0;
++    if (X509_digest(x, EVP_sha1(), idx, NULL) != 1) {
++        rv = 0;
++        goto cleanup;
++    }
+ 
+     cinf = apr_hash_get(stapling_certinfo, idx, sizeof(idx));
+     if (cinf) {
+@@ -177,18 +180,18 @@
+                            APLOGNO(02814) "ssl_stapling_init_cert: no OCSP URI "
+                            "in certificate and no SSLStaplingForceURL "
+                            "configured for server %s", mctx->sc->vhost_id);
+-            return 0;
++            rv = 0;
+         }
+-        return 1;
++        goto cleanup;
+     }
+ 
+     cid = OCSP_cert_to_id(NULL, x, issuer);
+-    X509_free(issuer);
+     if (!cid) {
+         ssl_log_xerror(SSLLOG_MARK, APLOG_ERR, 0, ptemp, s, x, APLOGNO(02815)
+                        "ssl_stapling_init_cert: can't create CertID "
+                        "for OCSP request");
+-        return 0;
++        rv = 0;
++        goto cleanup;
+     }
+ 
+     aia = X509_get1_ocsp(x);
+@@ -197,7 +200,8 @@
+         ssl_log_xerror(SSLLOG_MARK, APLOG_ERR, 0, ptemp, s, x,
+                        APLOGNO(02218) "ssl_stapling_init_cert: no OCSP URI "
+                        "in certificate and no SSLStaplingForceURL set");
+-        return 0;
++        rv = 0;
++        goto cleanup;
+     }
+ 
+     /* At this point, we have determined that there's something to store */
+@@ -218,8 +222,10 @@
+                    mctx->sc->vhost_id);
+ 
+     apr_hash_set(stapling_certinfo, cinf->idx, sizeof(cinf->idx), cinf);
+-    
+-    return 1;
++
++cleanup:
++    X509_free(issuer);
++    return rv;
+ }
+ 
+ static certinfo *stapling_get_certinfo(server_rec *s, X509 *x, modssl_ctx_t *mctx,
diff --git a/httpd.spec b/httpd.spec
index 6c16a2d..a882444 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.43
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -68,6 +68,7 @@ Patch3: httpd-2.4.43-deplibs.patch
 Patch19: httpd-2.4.43-detect-systemd.patch
 # Features/functional changes
 Patch21: httpd-2.4.43-r1842929+.patch
+Patch22: httpd-2.4.43-mod_systemd.patch
 Patch23: httpd-2.4.43-export.patch
 Patch24: httpd-2.4.43-corelimit.patch
 Patch25: httpd-2.4.43-selinux.patch
@@ -85,6 +86,7 @@ Patch42: httpd-2.4.43-r1828172+.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
 Patch62: httpd-2.4.43-r1870095+.patch
+Patch63: httpd-2.4.43-r1876548.patch
 
 # Security fixes
 
@@ -207,6 +209,7 @@ interface for storing and accessing per-user session data.
 %patch19 -p1 -b .detectsystemd
 
 %patch21 -p1 -b .r1842929+
+%patch22 -p1 -b .mod_systemd
 %patch23 -p1 -b .export
 %patch24 -p1 -b .corelimit
 %patch25 -p1 -b .selinux
@@ -222,6 +225,7 @@ interface for storing and accessing per-user session data.
 
 %patch60 -p1 -b .enable-sslv3
 %patch62 -p1 -b .r1870095
+%patch63 -p1 -b .r1876548
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -746,6 +750,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Apr 17 2020 Joe Orton <jorton@redhat.com> - 2.4.43-2
+- mod_ssl: fix leak in OCSP stapling code (PR 63687, r1876548)
+- mod_systemd: restore descriptive startup logging
+
 * Tue Mar 31 2020 Lubos Uhliarik <luhliari@redhat.com> - 2.4.43-1
 - new version 2.4.43 (#1819023)
 
diff --git a/pullrev.sh b/pullrev.sh
index efe221f..f50e4db 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -7,7 +7,7 @@ fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
 #repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.41
+ver=2.4.43
 prefix="httpd-${ver}"
 suffix="r$1${2:++}"
 fn="${prefix}-${suffix}.patch"

From 8a0df3f30f691d203ebac4cae13fe255a2f5e020 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 17 Apr 2020 11:57:16 +0100
Subject: [PATCH 203/359] Allow adding patches to the pullrev list.

---
 pullrev.sh | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/pullrev.sh b/pullrev.sh
index f50e4db..ada0076 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -9,7 +9,7 @@ repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
 #repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
 ver=2.4.43
 prefix="httpd-${ver}"
-suffix="r$1${2:++}"
+suffix="${SUFFIX:-r$1${2:++}}"
 fn="${prefix}-${suffix}.patch"
 vcurl="http://svn.apache.org/viewvc?view=revision&revision="
 
@@ -23,8 +23,12 @@ fi
 
 new=0
 for r in $*; do
-   if ! grep -q "${vcurl}${r}" ${fn}; then
-       echo "${vcurl}${r}"
+   case $r in
+        http*) url=$r ;;
+        *) url=${vcurl}${r} ;;
+   esac
+   if ! grep -q "^${url}" ${fn}; then
+       echo "${url}"
        new=1
    fi
 done >> ${fn}
@@ -35,10 +39,17 @@ prev=/dev/null
 for r in $*; do
     echo "+ fetching ${r}"
     this=`mktemp /tmp/pullrevXXXXXX`
-    svn diff -c ${r} ${repo} | filterdiff --remove-timestamps --clean -x 'CHANGES' -x '*/next-number' -x 'STATUS' \
-        -x '*.xml' --addprefix="${prefix}/" > ${this}
+    case $r in
+        http*) curl -s "$r" | filterdiff --strip=3 ;;
+        *) svn diff -c ${r} ${repo}  ;;
+    esac | filterdiff --remove-timestamps --clean \
+                      -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' \
+                      --addprefix="${prefix}/" > ${this}
     next=`mktemp /tmp/pullrevXXXXXX`
-    combinediff --quiet ${prev} ${this} > ${next}
+    if ! combinediff -w ${prev} ${this} > ${next}; then
+        echo "Failed combining previous ${prev} with ${this}";
+        exit 1
+    fi
     rm -f "${this}"
     [ "${prev}" = "/dev/null" ] || rm -f "${prev}"
     prev=${next}

From 4928626a29a74bfd947620825381214542d7a8e2 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 17 Apr 2020 11:57:47 +0100
Subject: [PATCH 204/359] mod_ssl: updated coalescing filter to improve TLS
 efficiency

---
 httpd-2.4.43-sslcoalesce.patch | 192 +++++++++++++++++++++++++++++++++
 httpd.spec                     |   7 +-
 2 files changed, 198 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.43-sslcoalesce.patch

diff --git a/httpd-2.4.43-sslcoalesce.patch b/httpd-2.4.43-sslcoalesce.patch
new file mode 100644
index 0000000..ef1f728
--- /dev/null
+++ b/httpd-2.4.43-sslcoalesce.patch
@@ -0,0 +1,192 @@
+
+http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_io.c?r1=1836237&r2=1836236&pathrev=1836237&view=patch
+http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_io.c?r1=1873985&r2=1876037&view=patch
+
+--- httpd-2.4.43/modules/ssl/ssl_engine_io.c.sslcoalesce
++++ httpd-2.4.43/modules/ssl/ssl_engine_io.c
+@@ -1585,18 +1585,32 @@
+ }
+ 
+ 
+-/* ssl_io_filter_output() produces one SSL/TLS message per bucket
++/* ssl_io_filter_output() produces one SSL/TLS record per bucket
+  * passed down the output filter stack.  This results in a high
+- * overhead (network packets) for any output comprising many small
+- * buckets.  SSI page applied through the HTTP chunk filter, for
+- * example, may produce many brigades containing small buckets -
+- * [chunk-size CRLF] [chunk-data] [CRLF].
++ * overhead (more network packets & TLS processing) for any output
++ * comprising many small buckets.  SSI output passed through the HTTP
++ * chunk filter, for example, may produce many brigades containing
++ * small buckets - [chunk-size CRLF] [chunk-data] [CRLF].
+  *
+- * The coalescing filter merges many small buckets into larger buckets
+- * where possible, allowing the SSL I/O output filter to handle them
+- * more efficiently. */
++ * Sending HTTP response headers as a separate TLS record to the
++ * response body also reveals information to a network observer (the
++ * size of headers) which can be significant.
++ *
++ * The coalescing filter merges data buckets with the aim of producing
++ * fewer, larger TLS records - without copying/buffering all content
++ * and introducing unnecessary overhead.
++ *
++ * ### This buffering could be probably be done more comprehensively
++ * ### in ssl_io_filter_output itself. 
++ * 
++ * ### Another possible performance optimisation in particular for the
++ * ### [HEAP] [FILE] HTTP response case is using a brigade rather than
++ * ### a char array to buffer; using apr_brigade_write() to append
++ * ### will use already-allocated memory from the HEAP, reducing # of
++ * ### copies.
++ */
+ 
+-#define COALESCE_BYTES (2048)
++#define COALESCE_BYTES (AP_IOBUFSIZE)
+ 
+ struct coalesce_ctx {
+     char buffer[COALESCE_BYTES];
+@@ -1609,11 +1623,12 @@
+     apr_bucket *e, *upto;
+     apr_size_t bytes = 0;
+     struct coalesce_ctx *ctx = f->ctx;
++    apr_size_t buffered = ctx ? ctx->bytes : 0; /* space used on entry */
+     unsigned count = 0;
+ 
+     /* The brigade consists of zero-or-more small data buckets which
+-     * can be coalesced (the prefix), followed by the remainder of the
+-     * brigade.
++     * can be coalesced (referred to as the "prefix"), followed by the
++     * remainder of the brigade.
+      *
+      * Find the last bucket - if any - of that prefix.  count gives
+      * the number of buckets in the prefix.  The "prefix" must contain
+@@ -1628,24 +1643,97 @@
+          e != APR_BRIGADE_SENTINEL(bb)
+              && !APR_BUCKET_IS_METADATA(e)
+              && e->length != (apr_size_t)-1
+-             && e->length < COALESCE_BYTES
+-             && (bytes + e->length) < COALESCE_BYTES
+-             && (ctx == NULL
+-                 || bytes + ctx->bytes + e->length < COALESCE_BYTES);
++             && e->length <= COALESCE_BYTES
++             && (buffered + bytes + e->length) <= COALESCE_BYTES;
+          e = APR_BUCKET_NEXT(e)) {
+-        if (e->length) count++; /* don't count zero-length buckets */
+-        bytes += e->length;
++        /* don't count zero-length buckets */
++        if (e->length) {
++            bytes += e->length;
++            count++;
++        }
+     }
++
++    /* If there is room remaining and the next bucket is a data
++     * bucket, try to include it in the prefix to coalesce.  For a
++     * typical [HEAP] [FILE] HTTP response brigade, this handles
++     * merging the headers and the start of the body into a single TLS
++     * record. */
++    if (bytes + buffered > 0
++        && bytes + buffered < COALESCE_BYTES
++        && e != APR_BRIGADE_SENTINEL(bb)
++        && !APR_BUCKET_IS_METADATA(e)) {
++        apr_status_t rv = APR_SUCCESS;
++
++        /* For an indeterminate length bucket (PIPE/CGI/...), try a
++         * non-blocking read to have it morph into a HEAP.  If the
++         * read fails with EAGAIN, it is harmless to try a split
++         * anyway, split is ENOTIMPL for most PIPE-like buckets. */
++        if (e->length == (apr_size_t)-1) {
++            const char *discard;
++            apr_size_t ignore;
++
++            rv = apr_bucket_read(e, &discard, &ignore, APR_NONBLOCK_READ);
++            if (rv != APR_SUCCESS && !APR_STATUS_IS_EAGAIN(rv)) {
++                ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, f->c, APLOGNO(10232)
++                              "coalesce failed to read from %s bucket",
++                              e->type->name);
++                return AP_FILTER_ERROR;
++            }
++        }
++
++        if (rv == APR_SUCCESS) {
++            /* If the read above made the bucket morph, it may now fit
++             * entirely within the buffer.  Otherwise, split it so it does
++             * fit. */
++            if (e->length > COALESCE_BYTES
++                || e->length + buffered + bytes > COALESCE_BYTES) {
++                rv = apr_bucket_split(e, COALESCE_BYTES - (buffered + bytes));
++            }
++
++            if (rv == APR_SUCCESS && e->length == 0) {
++                /* As above, don't count in the prefix if the bucket is
++                 * now zero-length. */
++            }
++            else if (rv == APR_SUCCESS) {
++                ap_log_cerror(APLOG_MARK, APLOG_TRACE4, 0, f->c,
++                              "coalesce: adding %" APR_SIZE_T_FMT " bytes "
++                              "from split %s bucket, total %" APR_SIZE_T_FMT,
++                              e->length, e->type->name, bytes + buffered);
++
++                count++;
++                bytes += e->length;
++                e = APR_BUCKET_NEXT(e);
++            }
++            else if (rv != APR_ENOTIMPL) {
++                ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, f->c, APLOGNO(10233)
++                              "coalesce: failed to split data bucket");
++                return AP_FILTER_ERROR;
++            }
++        }
++    }
++
+     upto = e;
+ 
+-    /* Coalesce the prefix, if:
+-     * a) more than one bucket is found to coalesce, or
+-     * b) the brigade contains only a single data bucket, or
+-     * c) the data bucket is not last but we have buffered data already.
++    /* Coalesce the prefix, if any of the following are true:
++     * 
++     * a) the prefix is more than one bucket
++     * OR
++     * b) the prefix is the entire brigade, which is a single bucket
++     *    AND the prefix length is smaller than the buffer size,
++     * OR
++     * c) the prefix is a single bucket
++     *    AND there is buffered data from a previous pass.
++     * 
++     * The aim with (b) is to buffer a small bucket so it can be
++     * coalesced with future invocations of this filter.  e.g.  three
++     * calls each with a single 100 byte HEAP bucket should get
++     * coalesced together.  But an invocation with a 8192 byte HEAP
++     * should pass through untouched.
+      */
+     if (bytes > 0
+         && (count > 1
+-            || (upto == APR_BRIGADE_SENTINEL(bb))
++            || (upto == APR_BRIGADE_SENTINEL(bb)
++                && bytes < COALESCE_BYTES)
+             || (ctx && ctx->bytes > 0))) {
+         /* If coalescing some bytes, ensure a context has been
+          * created. */
+@@ -1656,7 +1744,8 @@
+ 
+         ap_log_cerror(APLOG_MARK, APLOG_TRACE4, 0, f->c,
+                       "coalesce: have %" APR_SIZE_T_FMT " bytes, "
+-                      "adding %" APR_SIZE_T_FMT " more", ctx->bytes, bytes);
++                      "adding %" APR_SIZE_T_FMT " more (buckets=%u)",
++                      ctx->bytes, bytes, count);
+ 
+         /* Iterate through the prefix segment.  For non-fatal errors
+          * in this loop it is safe to break out and fall back to the
+@@ -1671,7 +1760,8 @@
+             if (APR_BUCKET_IS_METADATA(e)
+                 || e->length == (apr_size_t)-1) {
+                 ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, f->c, APLOGNO(02012)
+-                              "unexpected bucket type during coalesce");
++                              "unexpected %s bucket during coalesce",
++                              e->type->name);
+                 break; /* non-fatal error; break out */
+             }
+ 
diff --git a/httpd.spec b/httpd.spec
index a882444..2e877b3 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.43
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -81,6 +81,7 @@ Patch39: httpd-2.4.43-sslprotdefault.patch
 Patch40: httpd-2.4.43-r1861269.patch
 Patch41: httpd-2.4.43-r1861793+.patch
 Patch42: httpd-2.4.43-r1828172+.patch
+Patch43: httpd-2.4.43-sslcoalesce.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -222,6 +223,7 @@ interface for storing and accessing per-user session data.
 %patch40 -p1 -b .r1861269
 %patch41 -p1 -b .r1861793+
 %patch42 -p1 -b .r1828172+
+%patch43 -p1 -b .sslcoalesce
 
 %patch60 -p1 -b .enable-sslv3
 %patch62 -p1 -b .r1870095
@@ -750,6 +752,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Apr 17 2020 Joe Orton <jorton@redhat.com> - 2.4.43-3
+- mod_ssl: updated coalescing filter to improve TLS efficiency
+
 * Fri Apr 17 2020 Joe Orton <jorton@redhat.com> - 2.4.43-2
 - mod_ssl: fix leak in OCSP stapling code (PR 63687, r1876548)
 - mod_systemd: restore descriptive startup logging

From f9940ab5014ae2eec7b81332b9de3ccea65cfa24 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 20 Apr 2020 15:26:31 +0100
Subject: [PATCH 205/359] Fix grammar.

---
 httpd.service.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd.service.xml b/httpd.service.xml
index 695c112..243ce1e 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -302,7 +302,7 @@ Wants=network-online.target</programlisting>
       paths, and <command>Listen</command> to choose different ports.
       The example configuration file
       <filename>/usr/share/doc/httpd/instance.conf</filename>
-      demonstrates how to make such changes using
+      demonstrates how to make such changes using the
       <option>HTTPD_INSTANCE</option> variable.</para>
 
       <para>It can be useful to configure instances of

From 5a137a36d42e9a35a18bc32aee148c34b057c930 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 1 May 2020 09:41:37 +0100
Subject: [PATCH 206/359] Add patch for r1877251 from upstream.

---
 httpd-2.4.43-r1861793+.patch | 59 ++++++++++++++++++------------------
 1 file changed, 29 insertions(+), 30 deletions(-)

diff --git a/httpd-2.4.43-r1861793+.patch b/httpd-2.4.43-r1861793+.patch
index d1afb60..ca77453 100644
--- a/httpd-2.4.43-r1861793+.patch
+++ b/httpd-2.4.43-r1861793+.patch
@@ -1,8 +1,8 @@
 diff --git a/configure.in b/configure.in
 index cb43246..0bb6b0d 100644
---- a/configure.in
-+++ b/configure.in
-@@ -465,6 +465,28 @@ LIBS=""
+--- httpd-2.4.43/configure.in.r1861793+
++++ httpd-2.4.43/configure.in
+@@ -465,6 +465,28 @@
  AC_SEARCH_LIBS(crypt, crypt)
  CRYPT_LIBS="$LIBS"
  APACHE_SUBST(CRYPT_LIBS)
@@ -31,11 +31,9 @@ index cb43246..0bb6b0d 100644
  LIBS="$saved_LIBS"
  
  dnl See Comment #Spoon
-diff --git a/docs/man/htpasswd.1 b/docs/man/htpasswd.1
-index d0ad7e8..2bf8405 100644
---- a/docs/man/htpasswd.1
-+++ b/docs/man/htpasswd.1
-@@ -27,16 +27,16 @@ htpasswd \- Manage user files for basic authentication
+--- httpd-2.4.43/docs/man/htpasswd.1.r1861793+
++++ httpd-2.4.43/docs/man/htpasswd.1
+@@ -27,16 +27,16 @@
  .SH "SYNOPSIS"
   
  .PP
@@ -56,7 +54,7 @@ index d0ad7e8..2bf8405 100644
   
  
  .SH "SUMMARY"
-@@ -48,7 +48,7 @@ htpasswd \- Manage user files for basic authentication
+@@ -48,7 +48,7 @@
  Resources available from the Apache HTTP server can be restricted to just the users listed in the files created by \fBhtpasswd\fR\&. This program can only manage usernames and passwords stored in a flat-file\&. It can encrypt and display password information for use in other types of data stores, though\&. To use a DBM database see dbmmanage or htdbm\&.
   
  .PP
@@ -65,7 +63,7 @@ index d0ad7e8..2bf8405 100644
   
  .PP
  This manual page only lists the command line arguments\&. For details of the directives necessary to configure user authentication in httpd see the Apache manual, which is part of the Apache distribution or can be found at http://httpd\&.apache\&.org/\&.
-@@ -73,17 +73,26 @@ Display the results on standard output rather than updating a file\&. This is us
+@@ -73,17 +73,26 @@
  \fB-m\fR
  Use MD5 encryption for passwords\&. This is the default (since version 2\&.2\&.18)\&.  
  .TP
@@ -93,7 +91,7 @@ index d0ad7e8..2bf8405 100644
  .TP
  \fB-p\fR
  Use plaintext passwords\&. Though \fBhtpasswd\fR will support creation on all platforms, the httpd daemon will only accept plain text passwords on Windows and Netware\&.  
-@@ -152,10 +161,13 @@ The use of the \fB-b\fR option is discouraged, since when it is used the unencry
+@@ -152,10 +161,13 @@
  When using the \fBcrypt()\fR algorithm, note that only the first 8 characters of the password are used to form the password\&. If the supplied password is longer, the extra characters will be silently discarded\&.
   
  .PP
@@ -109,11 +107,9 @@ index d0ad7e8..2bf8405 100644
   
  .SH "RESTRICTIONS"
   
-diff --git a/support/htpasswd.c b/support/htpasswd.c
-index 73b291d..7366dcb 100644
---- a/support/htpasswd.c
-+++ b/support/htpasswd.c
-@@ -109,17 +109,21 @@ static void usage(void)
+--- httpd-2.4.43/support/htpasswd.c.r1861793+
++++ httpd-2.4.43/support/htpasswd.c
+@@ -109,17 +109,21 @@
              "for it." NL
          " -i  Read password from stdin without verification (for script usage)." NL
          " -m  Force MD5 encryption of the password (default)." NL
@@ -138,7 +134,7 @@ index 73b291d..7366dcb 100644
              "MD5 algorithm." NL,
          BCRYPT_DEFAULT_COST
      );
-@@ -178,7 +182,7 @@ static void check_args(int argc, const char *const argv[],
+@@ -178,7 +182,7 @@
      if (rv != APR_SUCCESS)
          exit(ERR_SYNTAX);
  
@@ -147,11 +143,16 @@ index 73b291d..7366dcb 100644
          switch (opt) {
          case 'c':
              *mask |= APHTP_NEWFILE;
-diff --git a/support/passwd_common.c b/support/passwd_common.c
-index 664e509..d45657c 100644
---- a/support/passwd_common.c
-+++ b/support/passwd_common.c
-@@ -185,10 +185,15 @@ int mkhash(struct passwd_ctx *ctx)
+--- httpd-2.4.43/support/passwd_common.c.r1861793+
++++ httpd-2.4.43/support/passwd_common.c
+@@ -179,16 +179,21 @@
+ int mkhash(struct passwd_ctx *ctx)
+ {
+     char *pw;
+-    char salt[16];
++    char salt[17];
+     apr_status_t rv;
+     int ret = 0;
  #if CRYPT_ALGO_SUPPORTED
      char *cbuf;
  #endif
@@ -169,7 +170,7 @@ index 664e509..d45657c 100644
      }
  
      if (ctx->passwd == NULL) {
-@@ -246,6 +251,34 @@ int mkhash(struct passwd_ctx *ctx)
+@@ -246,6 +251,34 @@
          break;
  #endif /* CRYPT_ALGO_SUPPORTED */
  
@@ -204,7 +205,7 @@ index 664e509..d45657c 100644
  #if BCRYPT_ALGO_SUPPORTED
      case ALG_BCRYPT:
          rv = apr_generate_random_bytes((unsigned char*)salt, 16);
-@@ -294,6 +327,19 @@ int parse_common_options(struct passwd_ctx *ctx, char opt,
+@@ -294,6 +327,19 @@
      case 's':
          ctx->alg = ALG_APSHA;
          break;
@@ -224,7 +225,7 @@ index 664e509..d45657c 100644
      case 'p':
          ctx->alg = ALG_PLAIN;
  #if !PLAIN_ALGO_SUPPORTED
-@@ -324,11 +370,12 @@ int parse_common_options(struct passwd_ctx *ctx, char opt,
+@@ -324,11 +370,12 @@
          return ERR_ALG_NOT_SUPP;
  #endif
          break;
@@ -239,10 +240,8 @@ index 664e509..d45657c 100644
                  return ERR_SYNTAX;
              }
              ctx->cost = num;
-diff --git a/support/passwd_common.h b/support/passwd_common.h
-index 660081e..f1b3cd7 100644
---- a/support/passwd_common.h
-+++ b/support/passwd_common.h
+--- httpd-2.4.43/support/passwd_common.h.r1861793+
++++ httpd-2.4.43/support/passwd_common.h
 @@ -28,6 +28,8 @@
  #include "apu_version.h"
  #endif
@@ -261,7 +260,7 @@ index 660081e..f1b3cd7 100644
  
  #define BCRYPT_DEFAULT_COST 5
  
-@@ -84,7 +88,7 @@ struct passwd_ctx {
+@@ -84,7 +88,7 @@
      apr_size_t      out_len;
      char            *passwd;
      int             alg;

From 2ffd69f4e0e8359a6f701374514091e7fd107bba Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 6 Jul 2020 16:45:00 +0100
Subject: [PATCH 207/359] Fix typo.

---
 httpd-2.4.43-r1861793+.patch | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd-2.4.43-r1861793+.patch b/httpd-2.4.43-r1861793+.patch
index ca77453..08e96cb 100644
--- a/httpd-2.4.43-r1861793+.patch
+++ b/httpd-2.4.43-r1861793+.patch
@@ -116,7 +116,7 @@ index cb43246..0bb6b0d 100644
 -        " -B  Force bcrypt encryption of the password (very secure)." NL
 +        " -2  Force SHA-256 crypt() hash of the password (very secure)." NL
 +        " -5  Force SHA-512 crypt() hash of the password (very secure)." NL
-+        " -B  Force bcrypt aencryption of the password (very secure)." NL
++        " -B  Force bcrypt encryption of the password (very secure)." NL
          " -C  Set the computing time used for the bcrypt algorithm" NL
          "     (higher is more secure but slower, default: %d, valid: 4 to 17)." NL
 +        " -r  Set the number of rounds used for the SHA-256, SHA-512 algorithms" NL

From c8206d083bfcd2895d316af2c7302dd2672e0f52 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 7 Jul 2020 09:59:31 +0100
Subject: [PATCH 208/359] use gettid() directly and use it for built-in
 ErrorLogFormat

---
 httpd-2.4.43-gettid.patch | 84 +++++++++++++++++++++++++++++++++++++++
 httpd.spec                |  7 +++-
 2 files changed, 90 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.43-gettid.patch

diff --git a/httpd-2.4.43-gettid.patch b/httpd-2.4.43-gettid.patch
new file mode 100644
index 0000000..894696a
--- /dev/null
+++ b/httpd-2.4.43-gettid.patch
@@ -0,0 +1,84 @@
+From d4e5b6e1e5585d341d1e51f1ddc637c099111076 Mon Sep 17 00:00:00 2001
+From: Joe Orton <jorton@redhat.com>
+Date: Tue, 7 Jul 2020 09:48:01 +0100
+Subject: [PATCH] Check and use gettid() directly with glibc 2.30+.
+
+* configure.in: Check for gettid() and define HAVE_SYS_GETTID if
+  gettid() is only usable via syscall().
+
+* server/log.c (log_tid): Use gettid() directly if available.
+---
+ configure.in | 14 +++++++++-----
+ server/log.c |  8 ++++++--
+ 2 files changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/configure.in b/configure.in
+index 423d58d4b9a..60cbf7b7f81 100644
+--- httpd-2.4.43/configure.in.gettid
++++ httpd-2.4.43/configure.in
+@@ -500,7 +500,8 @@
+ timegm \
+ getpgid \
+ fopen64 \
+-getloadavg
++getloadavg \
++gettid
+ )
+ 
+ dnl confirm that a void pointer is large enough to store a long integer
+@@ -511,16 +512,19 @@
+    APR_ADDTO(HTTPD_LIBS, [-lselinux])
+ ])
+ 
+-AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
++if test $ac_cv_func_gettid = no; then
++  # On Linux before glibc 2.30, gettid() is only usable via syscall()
++  AC_CACHE_CHECK([for gettid() via syscall], ap_cv_gettid,
+ [AC_TRY_RUN(#define _GNU_SOURCE
+ #include <unistd.h>
+ #include <sys/syscall.h>
+ #include <sys/types.h>
+ int main(int argc, char **argv) {
+ pid_t t = syscall(SYS_gettid); return t == -1 ? 1 : 0; },
+-[ac_cv_gettid=yes], [ac_cv_gettid=no], [ac_cv_gettid=no])])
+-if test "$ac_cv_gettid" = "yes"; then
+-    AC_DEFINE(HAVE_GETTID, 1, [Define if you have gettid()])
++  [ap_cv_gettid=yes], [ap_cv_gettid=no], [ap_cv_gettid=no])])
++  if test "$ap_cv_gettid" = "yes"; then
++      AC_DEFINE(HAVE_SYS_GETTID, 1, [Define if you have gettid() via syscall()])
++  fi
+ fi
+ 
+ dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs
+--- httpd-2.4.43/server/log.c.gettid
++++ httpd-2.4.43/server/log.c
+@@ -625,14 +625,18 @@
+ #if APR_HAS_THREADS
+     int result;
+ #endif
+-#if HAVE_GETTID
++#if defined(HAVE_GETTID) || defined(HAVE_SYS_GETTID)
+     if (arg && *arg == 'g') {
++#ifdef HAVE_GETTID
++        pid_t tid = gettid();
++#else
+         pid_t tid = syscall(SYS_gettid);
++#endif
+         if (tid == -1)
+             return 0;
+         return apr_snprintf(buf, buflen, "%"APR_PID_T_FMT, tid);
+     }
+-#endif
++#endif /* HAVE_GETTID || HAVE_SYS_GETTID */
+ #if APR_HAS_THREADS
+     if (ap_mpm_query(AP_MPMQ_IS_THREADED, &result) == APR_SUCCESS
+         && result != AP_MPMQ_NOT_SUPPORTED)
+@@ -966,7 +970,7 @@
+ #if APR_HAS_THREADS
+         field_start = len;
+         len += cpystrn(buf + len, ":tid ", buflen - len);
+-        item_len = log_tid(info, NULL, buf + len, buflen - len);
++        item_len = log_tid(info, "g", buf + len, buflen - len);
+         if (!item_len)
+             len = field_start;
+         else
diff --git a/httpd.spec b/httpd.spec
index 2e877b3..15bddb5 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.43
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -72,6 +72,7 @@ Patch22: httpd-2.4.43-mod_systemd.patch
 Patch23: httpd-2.4.43-export.patch
 Patch24: httpd-2.4.43-corelimit.patch
 Patch25: httpd-2.4.43-selinux.patch
+Patch26: httpd-2.4.43-gettid.patch
 Patch27: httpd-2.4.43-icons.patch
 Patch30: httpd-2.4.43-cachehardmax.patch
 Patch31: httpd-2.4.43-sslmultiproxy.patch
@@ -214,6 +215,7 @@ interface for storing and accessing per-user session data.
 %patch23 -p1 -b .export
 %patch24 -p1 -b .corelimit
 %patch25 -p1 -b .selinux
+%patch26 -p1 -b .gettid
 %patch27 -p1 -b .icons
 %patch30 -p1 -b .cachehardmax
 #patch31 -p1 -b .sslmultiproxy
@@ -752,6 +754,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Jul  7 2020 Joe Orton <jorton@redhat.com> - 2.4.43-4
+- use gettid() directly and use it for built-in ErrorLogFormat
+
 * Fri Apr 17 2020 Joe Orton <jorton@redhat.com> - 2.4.43-3
 - mod_ssl: updated coalescing filter to improve TLS efficiency
 

From c592b007f9409a9f23a74f458ea86d27e7fdc667 Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Thu, 9 Jul 2020 16:59:57 +0200
Subject: [PATCH 209/359] Remove %ghosted /etc/sysconfig/httpd file (#1850082)

---
 httpd.spec | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 15bddb5..3b80a87 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.43
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -647,7 +647,6 @@ exit $rv
 %exclude %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
 
 %config(noreplace) %{_sysconfdir}/sysconfig/htcacheclean
-%ghost %{_sysconfdir}/sysconfig/httpd
 %{_prefix}/lib/tmpfiles.d/httpd.conf
 
 %dir %{_libexecdir}/initscripts/legacy-actions/httpd
@@ -754,6 +753,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jul 09 2020 Lubos Uhliarik <luhliari@redhat.com> - 2.4.43-5
+- Remove %ghosted /etc/sysconfig/httpd file (#1850082)
+
 * Tue Jul  7 2020 Joe Orton <jorton@redhat.com> - 2.4.43-4
 - use gettid() directly and use it for built-in ErrorLogFormat
 

From 426fad198c1e4c2dda4fefe8dc1c7ad09c482338 Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Fri, 10 Jul 2020 00:39:43 +0200
Subject: [PATCH 210/359] fix macro in mod_lua for lua 4.5

---
 httpd-2.4.43-lua-resume.patch | 95 +++++++++++++++++++++++++++++++++++
 httpd.spec                    |  7 ++-
 2 files changed, 101 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.43-lua-resume.patch

diff --git a/httpd-2.4.43-lua-resume.patch b/httpd-2.4.43-lua-resume.patch
new file mode 100644
index 0000000..c954338
--- /dev/null
+++ b/httpd-2.4.43-lua-resume.patch
@@ -0,0 +1,95 @@
+diff --git a/modules/lua/mod_lua.c b/modules/lua/mod_lua.c
+index 05f1e44..be3bedf 100644
+--- a/modules/lua/mod_lua.c
++++ b/modules/lua/mod_lua.c
+@@ -342,7 +342,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil
+ {
+     apr_pool_t *pool;
+     ap_lua_vm_spec *spec;
+-    int n, rc;
++    int n, rc, nres;
+     lua_State *L;
+     lua_filter_ctx *ctx;    
+     ap_lua_server_cfg *server_cfg = ap_get_module_config(r->server->module_config,
+@@ -410,7 +410,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil
+             /* If a Lua filter is interested in filtering a request, it must first do a yield, 
+              * otherwise we'll assume that it's not interested and pretend we didn't find it.
+              */
+-            rc = lua_resume(L, 1);
++            rc = lua_resume(L, 1, &nres);
+             if (rc == LUA_YIELD) {
+                 if (f->frec->providers == NULL) { 
+                     /* Not wired by mod_filter */
+@@ -432,7 +432,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil
+ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade *pbbIn)
+ {
+     request_rec *r = f->r;
+-    int rc;
++    int rc, nres;
+     lua_State *L;
+     lua_filter_ctx* ctx;
+     conn_rec *c = r->connection;
+@@ -492,7 +492,7 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade
+             lua_setglobal(L, "bucket");
+             
+             /* If Lua yielded, it means we have something to pass on */
+-            if (lua_resume(L, 0) == LUA_YIELD) {
++            if (lua_resume(L, 0, &nres) == LUA_YIELD) {
+                 size_t olen;
+                 const char* output = lua_tolstring(L, 1, &olen);
+                 if (olen > 0) { 
+@@ -524,7 +524,7 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade
+             apr_bucket *pbktEOS;
+             lua_pushnil(L);
+             lua_setglobal(L, "bucket");
+-            if (lua_resume(L, 0) == LUA_YIELD) {
++            if (lua_resume(L, 0, &nres) == LUA_YIELD) {
+                 apr_bucket *pbktOut;
+                 size_t olen;
+                 const char* output = lua_tolstring(L, 1, &olen);
+@@ -558,7 +558,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f,
+                                        apr_off_t nBytes) 
+ {
+     request_rec *r = f->r;
+-    int rc, lastCall = 0;
++    int rc, lastCall = 0, nres;
+     lua_State *L;
+     lua_filter_ctx* ctx;
+     conn_rec *c = r->connection;
+@@ -621,7 +621,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f,
+             lua_setglobal(L, "bucket");
+             
+             /* If Lua yielded, it means we have something to pass on */
+-            if (lua_resume(L, 0) == LUA_YIELD) {
++            if (lua_resume(L, 0, &nres) == LUA_YIELD) {
+                 size_t olen;
+                 const char* output = lua_tolstring(L, 1, &olen);
+                 pbktOut = apr_bucket_heap_create(output, olen, 0, c->bucket_alloc);
+@@ -643,7 +643,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f,
+             apr_bucket *pbktEOS = apr_bucket_eos_create(c->bucket_alloc);
+             lua_pushnil(L);
+             lua_setglobal(L, "bucket");
+-            if (lua_resume(L, 0) == LUA_YIELD) {
++            if (lua_resume(L, 0, &nres) == LUA_YIELD) {
+                 apr_bucket *pbktOut;
+                 size_t olen;
+                 const char* output = lua_tolstring(L, 1, &olen);
+diff --git a/modules/lua/mod_lua.h b/modules/lua/mod_lua.h
+index 0e49cdc..8921b87 100644
+--- a/modules/lua/mod_lua.h
++++ b/modules/lua/mod_lua.h
+@@ -48,7 +48,13 @@
+ #if LUA_VERSION_NUM > 501
+ /* Load mode for lua_load() */
+ #define lua_load(a,b,c,d)  lua_load(a,b,c,d,NULL)
+-#define lua_resume(a,b)    lua_resume(a, NULL, b)
++
++#if LUA_VERSION_NUM > 503
++#define lua_resume(a,b,c)    lua_resume(a, NULL, b, c)
++#else
++#define lua_resume(a,b,c)    lua_resume(a, NULL, b)
++#endif
++
+ #define luaL_setfuncs_compat(a,b) luaL_setfuncs(a,b,0)
+ #else
+ #define lua_rawlen(L,i)    lua_objlen(L, (i))
diff --git a/httpd.spec b/httpd.spec
index 3b80a87..6afff49 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.43
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -83,6 +83,7 @@ Patch40: httpd-2.4.43-r1861269.patch
 Patch41: httpd-2.4.43-r1861793+.patch
 Patch42: httpd-2.4.43-r1828172+.patch
 Patch43: httpd-2.4.43-sslcoalesce.patch
+Patch44: httpd-2.4.43-lua-resume.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -226,6 +227,7 @@ interface for storing and accessing per-user session data.
 %patch41 -p1 -b .r1861793+
 %patch42 -p1 -b .r1828172+
 %patch43 -p1 -b .sslcoalesce
+%patch44 -p1 -b .luaresume
 
 %patch60 -p1 -b .enable-sslv3
 %patch62 -p1 -b .r1870095
@@ -753,6 +755,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jul 09 2020 Lubos Uhliarik <luhliari@redhat.com> - 2.4.43-6
+- fix macro in mod_lua for lua 4.5
+
 * Thu Jul 09 2020 Lubos Uhliarik <luhliari@redhat.com> - 2.4.43-5
 - Remove %ghosted /etc/sysconfig/httpd file (#1850082)
 

From 52aed83c50236925be6401091587d877a2bc4567 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Tue, 28 Jul 2020 01:01:27 +0000
Subject: [PATCH 211/359] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 6afff49..4ea3c83 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.43
-Release: 6%{?dist}
+Release: 7%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -755,6 +755,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.43-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
 * Thu Jul 09 2020 Lubos Uhliarik <luhliari@redhat.com> - 2.4.43-6
 - fix macro in mod_lua for lua 4.5
 

From 845520ec3dcb56c2a32cf3d6c9f1805865ad022f Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Tue, 25 Aug 2020 15:09:53 +0200
Subject: [PATCH 212/359] new version 2.4.46 remove obsolete parts of this spec
 file fix systemd detection patch

---
 .gitignore                                    |  1 +
 httpd-2.4.43-detect-systemd.patch             | 18 +++-
 httpd-2.4.43-r1876548.patch                   | 82 -------------------
 ...ume.patch => httpd-2.4.46-lua-resume.patch | 40 +++++++--
 httpd.spec                                    | 25 ++----
 sources                                       |  4 +-
 6 files changed, 58 insertions(+), 112 deletions(-)
 delete mode 100644 httpd-2.4.43-r1876548.patch
 rename httpd-2.4.43-lua-resume.patch => httpd-2.4.46-lua-resume.patch (75%)

diff --git a/.gitignore b/.gitignore
index b337b6b..09a5a07 100644
--- a/.gitignore
+++ b/.gitignore
@@ -37,3 +37,4 @@ x86_64
 /apachectl.8
 /httpd-2.4.43.tar.bz2.asc
 /KEYS
+/httpd-2.4.46.tar.bz2.asc
diff --git a/httpd-2.4.43-detect-systemd.patch b/httpd-2.4.43-detect-systemd.patch
index 448f7d7..540687f 100644
--- a/httpd-2.4.43-detect-systemd.patch
+++ b/httpd-2.4.43-detect-systemd.patch
@@ -1,5 +1,5 @@
 diff --git a/Makefile.in b/Makefile.in
-index ea8366e..06b8c5a 100644
+index 0b088ac..9eeb5c7 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -4,7 +4,7 @@ CLEAN_SUBDIRS = test
@@ -11,8 +11,20 @@ index ea8366e..06b8c5a 100644
  PROGRAM_PRELINK      = $(COMPILE) -c $(top_srcdir)/server/buildmark.c
  PROGRAM_DEPENDENCIES = \
    server/libmain.la \
+diff --git a/acinclude.m4 b/acinclude.m4
+index 2a7e5d1..eb28321 100644
+--- a/acinclude.m4
++++ b/acinclude.m4
+@@ -624,6 +624,7 @@ case $host in
+       if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
+         AC_MSG_WARN([Your system does not support systemd.])
+       else
++        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
+         AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
+       fi
+    fi
 diff --git a/configure.in b/configure.in
-index f276550..a63eada 100644
+index 3618a5a..74a782b 100644
 --- a/configure.in
 +++ b/configure.in
 @@ -234,6 +234,7 @@ if test "$PCRE_CONFIG" != "false"; then
@@ -23,7 +35,7 @@ index f276550..a63eada 100644
  else
    AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/])
  fi
-@@ -679,6 +682,7 @@ APACHE_SUBST(OS_DIR)
+@@ -710,6 +711,7 @@ APACHE_SUBST(OS_DIR)
  APACHE_SUBST(BUILTIN_LIBS)
  APACHE_SUBST(SHLIBPATH_VAR)
  APACHE_SUBST(OS_SPECIFIC_VARS)
diff --git a/httpd-2.4.43-r1876548.patch b/httpd-2.4.43-r1876548.patch
deleted file mode 100644
index 130ea17..0000000
--- a/httpd-2.4.43-r1876548.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-# ./pullrev.sh 1876548
-http://svn.apache.org/viewvc?view=revision&revision=1876548
-
---- httpd-2.4.43/modules/ssl/ssl_util_stapling.c
-+++ httpd-2.4.43/modules/ssl/ssl_util_stapling.c
-@@ -130,6 +130,7 @@
-     X509 *issuer = NULL;
-     OCSP_CERTID *cid = NULL;
-     STACK_OF(OPENSSL_STRING) *aia = NULL;
-+    int rv = 1; /* until further notice */
- 
-     if (x == NULL)
-         return 0;
-@@ -154,16 +155,18 @@
-             SSL_CTX_set_tlsext_status_cb(mctx->ssl_ctx, stapling_cb);
-             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(10177) "OCSP stapling added via hook");
-         }
--        return 1;
-+        goto cleanup;
-     }
-     
-     if (mctx->stapling_enabled != TRUE) {
-         /* mod_ssl's own implementation is not enabled */
--        return 1;
-+        goto cleanup;
-     }
-     
--    if (X509_digest(x, EVP_sha1(), idx, NULL) != 1)
--        return 0;
-+    if (X509_digest(x, EVP_sha1(), idx, NULL) != 1) {
-+        rv = 0;
-+        goto cleanup;
-+    }
- 
-     cinf = apr_hash_get(stapling_certinfo, idx, sizeof(idx));
-     if (cinf) {
-@@ -177,18 +180,18 @@
-                            APLOGNO(02814) "ssl_stapling_init_cert: no OCSP URI "
-                            "in certificate and no SSLStaplingForceURL "
-                            "configured for server %s", mctx->sc->vhost_id);
--            return 0;
-+            rv = 0;
-         }
--        return 1;
-+        goto cleanup;
-     }
- 
-     cid = OCSP_cert_to_id(NULL, x, issuer);
--    X509_free(issuer);
-     if (!cid) {
-         ssl_log_xerror(SSLLOG_MARK, APLOG_ERR, 0, ptemp, s, x, APLOGNO(02815)
-                        "ssl_stapling_init_cert: can't create CertID "
-                        "for OCSP request");
--        return 0;
-+        rv = 0;
-+        goto cleanup;
-     }
- 
-     aia = X509_get1_ocsp(x);
-@@ -197,7 +200,8 @@
-         ssl_log_xerror(SSLLOG_MARK, APLOG_ERR, 0, ptemp, s, x,
-                        APLOGNO(02218) "ssl_stapling_init_cert: no OCSP URI "
-                        "in certificate and no SSLStaplingForceURL set");
--        return 0;
-+        rv = 0;
-+        goto cleanup;
-     }
- 
-     /* At this point, we have determined that there's something to store */
-@@ -218,8 +222,10 @@
-                    mctx->sc->vhost_id);
- 
-     apr_hash_set(stapling_certinfo, cinf->idx, sizeof(cinf->idx), cinf);
--    
--    return 1;
-+
-+cleanup:
-+    X509_free(issuer);
-+    return rv;
- }
- 
- static certinfo *stapling_get_certinfo(server_rec *s, X509 *x, modssl_ctx_t *mctx,
diff --git a/httpd-2.4.43-lua-resume.patch b/httpd-2.4.46-lua-resume.patch
similarity index 75%
rename from httpd-2.4.43-lua-resume.patch
rename to httpd-2.4.46-lua-resume.patch
index c954338..1a22008 100644
--- a/httpd-2.4.43-lua-resume.patch
+++ b/httpd-2.4.46-lua-resume.patch
@@ -1,5 +1,27 @@
+diff --git a/modules/lua/config.m4 b/modules/lua/config.m4
+index 29fd563..abeba1c 100644
+--- a/modules/lua/config.m4
++++ b/modules/lua/config.m4
+@@ -34,7 +34,7 @@ AC_DEFUN([CHECK_LUA_PATH], [dnl
+     fi
+ ])
+ 
+-dnl Check for Lua 5.3/5.2/5.1 Libraries
++dnl Check for Lua Libraries
+ dnl CHECK_LUA(ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND])
+ dnl Sets:
+ dnl  LUA_CFLAGS
+@@ -44,7 +44,7 @@ AC_DEFUN([CHECK_LUA],
+ 
+ AC_ARG_WITH(
+     lua,
+-    [AC_HELP_STRING([--with-lua=PATH],[Path to the Lua 5.3/5.2/5.1 prefix])],
++    [AC_HELP_STRING([--with-lua=PATH],[Path to the Lua installation prefix])],
+     lua_path="$withval",
+     :)
+ 
 diff --git a/modules/lua/mod_lua.c b/modules/lua/mod_lua.c
-index 05f1e44..be3bedf 100644
+index 05f1e44..18b628c 100644
 --- a/modules/lua/mod_lua.c
 +++ b/modules/lua/mod_lua.c
 @@ -342,7 +342,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil
@@ -34,7 +56,7 @@ index 05f1e44..be3bedf 100644
              
              /* If Lua yielded, it means we have something to pass on */
 -            if (lua_resume(L, 0) == LUA_YIELD) {
-+            if (lua_resume(L, 0, &nres) == LUA_YIELD) {
++            if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) {
                  size_t olen;
                  const char* output = lua_tolstring(L, 1, &olen);
                  if (olen > 0) { 
@@ -43,7 +65,7 @@ index 05f1e44..be3bedf 100644
              lua_pushnil(L);
              lua_setglobal(L, "bucket");
 -            if (lua_resume(L, 0) == LUA_YIELD) {
-+            if (lua_resume(L, 0, &nres) == LUA_YIELD) {
++            if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) {
                  apr_bucket *pbktOut;
                  size_t olen;
                  const char* output = lua_tolstring(L, 1, &olen);
@@ -61,7 +83,7 @@ index 05f1e44..be3bedf 100644
              
              /* If Lua yielded, it means we have something to pass on */
 -            if (lua_resume(L, 0) == LUA_YIELD) {
-+            if (lua_resume(L, 0, &nres) == LUA_YIELD) {
++            if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) {
                  size_t olen;
                  const char* output = lua_tolstring(L, 1, &olen);
                  pbktOut = apr_bucket_heap_create(output, olen, 0, c->bucket_alloc);
@@ -70,15 +92,15 @@ index 05f1e44..be3bedf 100644
              lua_pushnil(L);
              lua_setglobal(L, "bucket");
 -            if (lua_resume(L, 0) == LUA_YIELD) {
-+            if (lua_resume(L, 0, &nres) == LUA_YIELD) {
++            if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) {
                  apr_bucket *pbktOut;
                  size_t olen;
                  const char* output = lua_tolstring(L, 1, &olen);
 diff --git a/modules/lua/mod_lua.h b/modules/lua/mod_lua.h
-index 0e49cdc..8921b87 100644
+index 0e49cdc..72b4de7 100644
 --- a/modules/lua/mod_lua.h
 +++ b/modules/lua/mod_lua.h
-@@ -48,7 +48,13 @@
+@@ -48,7 +48,15 @@
  #if LUA_VERSION_NUM > 501
  /* Load mode for lua_load() */
  #define lua_load(a,b,c,d)  lua_load(a,b,c,d,NULL)
@@ -87,7 +109,9 @@ index 0e49cdc..8921b87 100644
 +#if LUA_VERSION_NUM > 503
 +#define lua_resume(a,b,c)    lua_resume(a, NULL, b, c)
 +#else
-+#define lua_resume(a,b,c)    lua_resume(a, NULL, b)
++/* ### For version < 5.4, assume that exactly one stack item is on the
++ * stack, which is what the code did before but seems dubious. */
++#define lua_resume(a,b,c)    (*(c) = 1, lua_resume(a, NULL, b))
 +#endif
 +
  #define luaL_setfuncs_compat(a,b) luaL_setfuncs(a,b,0)
diff --git a/httpd.spec b/httpd.spec
index 4ea3c83..f0778fc 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.43
-Release: 7%{?dist}
+Version: 2.4.46
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -83,13 +83,12 @@ Patch40: httpd-2.4.43-r1861269.patch
 Patch41: httpd-2.4.43-r1861793+.patch
 Patch42: httpd-2.4.43-r1828172+.patch
 Patch43: httpd-2.4.43-sslcoalesce.patch
-Patch44: httpd-2.4.43-lua-resume.patch
+Patch44: httpd-2.4.46-lua-resume.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
 Patch62: httpd-2.4.43-r1870095+.patch
-Patch63: httpd-2.4.43-r1876548.patch
 
 # Security fixes
 
@@ -100,7 +99,6 @@ BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0
 BuildRequires: gnupg2
 Requires: /etc/mime.types, system-logos-httpd
-Obsoletes: httpd-suexec
 Provides: webserver
 Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release}
 Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa}
@@ -231,7 +229,6 @@ interface for storing and accessing per-user session data.
 
 %patch60 -p1 -b .enable-sslv3
 %patch62 -p1 -b .r1870095
-%patch63 -p1 -b .r1876548
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -558,17 +555,6 @@ exit 0
 %postun
 %systemd_postun httpd.service htcacheclean.service httpd.socket
 
-# Trigger for conversion from SysV, per guidelines at:
-# https://fedoraproject.org/wiki/Packaging:ScriptletSnippets#Systemd
-%triggerun -- httpd < 2.2.21-5
-# Save the current service runlevel info
-# User must manually run systemd-sysv-convert --apply httpd
-# to migrate them to systemd targets
-/usr/bin/systemd-sysv-convert --save httpd.service >/dev/null 2>&1 ||:
-
-# Run these because the SysV package being removed won't do them
-/sbin/chkconfig --del httpd >/dev/null 2>&1 || :
-
 %posttrans
 test -f /etc/sysconfig/httpd-disable-posttrans || \
   /bin/systemctl try-restart --no-block httpd.service htcacheclean.service >/dev/null 2>&1 || :
@@ -755,6 +741,11 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Aug 25 2020 Lubos Uhliarik <luhliari@redhat.com> - 2.4.46-1
+- new version 2.4.46
+- remove obsolete parts of this spec file
+- fix systemd detection patch
+
 * Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.43-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 
diff --git a/sources b/sources
index 9c6c825..a7871fb 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.43.tar.bz2) = 16cfeecc8f6fab6eca478065a384bdf1872f7ac42206b0bc2bcac6c0d9c576f392c07107201f39e0601dec1bbafcb33d66153544de4d87d79b9a52094d334b64
-SHA512 (httpd-2.4.43.tar.bz2.asc) = 7a1a12d6f58d8235dcf8b23bae3960e99dc99764928752f870f32e654aa5e3cf78a38fb14f3cb84c5a8ab9b05095beec4739a50c6efcf22e3ecbdf0255ac783d
+SHA512 (httpd-2.4.46.tar.bz2) = 5936784bb662e9d8a4f7fe38b70c043b468114d931cd10ea831bfe74461ea5856b64f88f42c567ab791fc8907640a99884ba4b6a600f86d661781812735b6f13
+SHA512 (httpd-2.4.46.tar.bz2.asc) = 1f54c20d1aeedb7c745eb72acd79e1ed61d547b22c3dbe53cd3274ed3d897543cd8c49181d4b15d79c12755746cf0a2464d620f69e254ac3f998760133094df0
 SHA512 (KEYS) = b776ca20863f8d9e4f66e8b56cbe020de34af5b268e93776d482392171f0e0aeee4f8d74477d128dc9fd24b30bbe33b39439964f1bd22a99782f1e4a08c85056

From 2c7ae799ebf1eff410f1e2afc7ece9b9c68f3012 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 7 Jul 2020 11:57:10 +0100
Subject: [PATCH 213/359] Fix build w/o glibc 2.30.

---
 httpd-2.4.43-gettid.patch | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/httpd-2.4.43-gettid.patch b/httpd-2.4.43-gettid.patch
index 894696a..f80b3a7 100644
--- a/httpd-2.4.43-gettid.patch
+++ b/httpd-2.4.43-gettid.patch
@@ -16,7 +16,7 @@ diff --git a/configure.in b/configure.in
 index 423d58d4b9a..60cbf7b7f81 100644
 --- httpd-2.4.43/configure.in.gettid
 +++ httpd-2.4.43/configure.in
-@@ -500,7 +500,8 @@
+@@ -478,7 +500,8 @@
  timegm \
  getpgid \
  fopen64 \
@@ -26,7 +26,7 @@ index 423d58d4b9a..60cbf7b7f81 100644
  )
  
  dnl confirm that a void pointer is large enough to store a long integer
-@@ -511,16 +512,19 @@
+@@ -489,16 +512,19 @@
     APR_ADDTO(HTTPD_LIBS, [-lselinux])
  ])
  
@@ -52,6 +52,15 @@ index 423d58d4b9a..60cbf7b7f81 100644
  dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs
 --- httpd-2.4.43/server/log.c.gettid
 +++ httpd-2.4.43/server/log.c
+@@ -55,7 +55,7 @@
+ #include "ap_mpm.h"
+ #include "ap_listen.h"
+ 
+-#if HAVE_GETTID
++#if HAVE_SYS_GETTID
+ #include <sys/syscall.h>
+ #include <sys/types.h>
+ #endif
 @@ -625,14 +625,18 @@
  #if APR_HAS_THREADS
      int result;

From 2281270aa8f5ee409eb02032f3a3d1f22c99730a Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 27 Aug 2020 11:26:08 +0100
Subject: [PATCH 214/359] - sanitize CFLAGS used by /usr/bin/apxs by default
 (#1873020) - add vendor-apxs script in libdir/httpd/build which exposes full
 CFLAGS - redefine _httpd_apxs RPM macro to use vendor-apxs

---
 httpd.spec | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index f0778fc..4ef9658 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.46
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -430,7 +430,7 @@ echo %{mmnisa} > $RPM_BUILD_ROOT%{_includedir}/httpd/.mmn
 mkdir -p $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d
 cat > $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d/macros.httpd <<EOF
 %%_httpd_mmn %{mmnisa}
-%%_httpd_apxs %%{_bindir}/apxs
+%%_httpd_apxs %%{_libdir}/httpd/build/vendor-apxs
 %%_httpd_modconfdir %%{_sysconfdir}/httpd/conf.modules.d
 %%_httpd_confdir %%{_sysconfdir}/httpd/conf.d
 %%_httpd_contentdir %{contentdir}
@@ -525,6 +525,23 @@ sed -i '/.*DEFAULT_..._LIBEXECDIR/d;/DEFAULT_..._INSTALLBUILDDIR/d' \
 sed -i '/instdso/s,top_srcdir,top_builddir,' \
     $RPM_BUILD_ROOT%{_libdir}/httpd/build/special.mk
 
+# vendor-apxs uses an unsanitized config_vars.mk which may
+# have dependencies on redhat-rpm-config.  apxs uses the
+# config_vars.mk with a sanitized config_vars.mk
+cp -p $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk \
+      $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk
+
+# Sanitize CFLAGS in standard config_vars.mk
+sed '/^CFLAGS/s,-Wall .*,-Wall,' \
+    -i $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk
+
+sed 's/config_vars.mk/vendor_config_vars.mk/' \
+    $RPM_BUILD_ROOT%{_bindir}/apxs \
+    > $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs
+touch -r $RPM_BUILD_ROOT%{_bindir}/apxs \
+      $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs
+chmod 755 $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs
+
 # Remove unpackaged files
 rm -vf \
       $RPM_BUILD_ROOT%{_libdir}/*.exp \
@@ -738,9 +755,15 @@ exit $rv
 %dir %{_libdir}/httpd/build
 %{_libdir}/httpd/build/*.mk
 %{_libdir}/httpd/build/*.sh
+%{_libdir}/httpd/build/vendor-apxs
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Aug 27 2020 Joe Orton <jorton@redhat.com> - 2.4.46-2
+- sanitize CFLAGS used by /usr/bin/apxs by default (#1873020)
+- add vendor-apxs script in libdir/httpd/build which exposes full CFLAGS
+- redefine _httpd_apxs RPM macro to use vendor-apxs
+
 * Tue Aug 25 2020 Lubos Uhliarik <luhliari@redhat.com> - 2.4.46-1
 - new version 2.4.46
 - remove obsolete parts of this spec file

From 7584eb0a54bc3d7e9928ac965b7bb93e7e45de50 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 27 Aug 2020 15:27:12 +0100
Subject: [PATCH 215/359] strip /usr/bin/apxs CFLAGS further

---
 httpd.spec | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 4ef9658..80133a6 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.46
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -532,7 +532,7 @@ cp -p $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk \
       $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk
 
 # Sanitize CFLAGS in standard config_vars.mk
-sed '/^CFLAGS/s,-Wall .*,-Wall,' \
+sed '/^CFLAGS/s,=.*$,= -O2 -g -Wall,' \
     -i $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk
 
 sed 's/config_vars.mk/vendor_config_vars.mk/' \
@@ -759,9 +759,12 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Aug 27 2020 Joe Orton <jorton@redhat.com> - 2.4.46-3
+- strip /usr/bin/apxs CFLAGS further
+
 * Thu Aug 27 2020 Joe Orton <jorton@redhat.com> - 2.4.46-2
 - sanitize CFLAGS used by /usr/bin/apxs by default (#1873020)
-- add vendor-apxs script in libdir/httpd/build which exposes full CFLAGS
+- add $libdir/httpd/build/vendor-apxs which exposes full CFLAGS
 - redefine _httpd_apxs RPM macro to use vendor-apxs
 
 * Tue Aug 25 2020 Lubos Uhliarik <luhliari@redhat.com> - 2.4.46-1

From c8bf9e154099a01a8f30dde2e71cdb5d9fe40842 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 27 Aug 2020 18:02:26 +0100
Subject: [PATCH 216/359] use make macros (Tom Stellard)

---
 httpd.spec | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 80133a6..3d1ba7c 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.46
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -333,12 +333,12 @@ export LYNX_PATH=/usr/bin/links
         --disable-http2 \
         --disable-md \
         $*
-make %{?_smp_mflags}
+%make_build
 
 %install
 rm -rf $RPM_BUILD_ROOT
 
-make DESTDIR=$RPM_BUILD_ROOT install
+%make_install
 
 # Install systemd service files
 mkdir -p $RPM_BUILD_ROOT%{_unitdir}
@@ -759,6 +759,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Aug 27 2020 Joe Orton <jorton@redhat.com> - 2.4.46-4
+- use make macros (Tom Stellard)
+
 * Thu Aug 27 2020 Joe Orton <jorton@redhat.com> - 2.4.46-3
 - strip /usr/bin/apxs CFLAGS further
 

From b2e312a36c3cb324c9692c02aed328007698b8d1 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 6 Nov 2020 13:27:22 +0000
Subject: [PATCH 217/359] add %_httpd_requires to macros

---
 httpd.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 3d1ba7c..6c2e8e6 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.46
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -435,6 +435,7 @@ cat > $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d/macros.httpd <<EOF
 %%_httpd_confdir %%{_sysconfdir}/httpd/conf.d
 %%_httpd_contentdir %{contentdir}
 %%_httpd_moddir %%{_libdir}/httpd/modules
+%%_httpd_requires Requires: httpd-mmn = %%{_httpd_mmn}
 EOF
 
 # Handle contentdir
@@ -759,6 +760,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Nov  6 2020 Joe Orton <jorton@redhat.com> - 2.4.46-5
+- add %%_httpd_requires to macros
+
 * Thu Aug 27 2020 Joe Orton <jorton@redhat.com> - 2.4.46-4
 - use make macros (Tom Stellard)
 

From c1307960e6ed2760d7c0f9b2871cbc6b3a555dcf Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 17 Dec 2020 10:38:29 +0000
Subject: [PATCH 218/359] move mod_lua to a subpackage Recommends: both mod_lua
 and mod_http2

---
 httpd.spec | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 6c2e8e6..b162123 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.46
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -104,7 +104,7 @@ Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release}
 Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa}
 Requires: httpd-tools = %{version}-%{release}
 Requires: httpd-filesystem = %{version}-%{release}
-Requires: mod_http2
+Recommends: mod_http2, mod_lua
 Requires(pre): httpd-filesystem
 Requires(preun): systemd-units
 Requires(postun): systemd-units
@@ -169,7 +169,7 @@ Requires: sscg >= 2.2.0, /usr/bin/hostname
 Conflicts: openssl-libs < 1:1.0.1h-4
 
 %description -n mod_ssl
-The mod_ssl module provides strong cryptography for the Apache Web
+The mod_ssl module provides strong cryptography for the Apache HTTP
 server via the Secure Sockets Layer (SSL) and Transport Layer
 Security (TLS) protocols.
 
@@ -201,6 +201,14 @@ Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 The mod_session module and associated backends provide an abstract
 interface for storing and accessing per-user session data.
 
+%package -n mod_lua
+Summary: Lua scripting support for the Apache HTTP Server
+Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+
+%description -n mod_lua
+The mod_lua module allows the server to be extended with scripts
+written in the Lua programming language.
+
 %prep
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q
@@ -649,6 +657,7 @@ exit $rv
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/*.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/00-ssl.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf
+%exclude %{_sysconfdir}/httpd/conf.modules.d/00-lua.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/01-ldap.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
 
@@ -673,6 +682,7 @@ exit $rv
 %exclude %{_libdir}/httpd/modules/mod_proxy_html.so
 %exclude %{_libdir}/httpd/modules/mod_xml2enc.so
 %exclude %{_libdir}/httpd/modules/mod_session*.so
+%exclude %{_libdir}/httpd/modules/mod_lua.so
 
 %dir %{contentdir}/error
 %dir %{contentdir}/error/include
@@ -749,6 +759,10 @@ exit $rv
 %{_libdir}/httpd/modules/mod_auth_form.so
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
 
+%files -n mod_lua
+%{_libdir}/httpd/modules/mod_lua.so
+%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-lua.conf
+
 %files devel
 %{_includedir}/httpd
 %{_bindir}/apxs
@@ -760,6 +774,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Dec 17 2020 Joe Orton <jorton@redhat.com> - 2.4.46-6
+- move mod_lua to a subpackage
+- Recommends: both mod_lua and mod_http2
+
 * Fri Nov  6 2020 Joe Orton <jorton@redhat.com> - 2.4.46-5
 - add %%_httpd_requires to macros
 

From ddb1839a16326249781b1e7eba2b3906532a16c0 Mon Sep 17 00:00:00 2001
From: Tom Stellard <tstellar@redhat.com>
Date: Sat, 19 Dec 2020 00:31:57 +0000
Subject: [PATCH 219/359] Add BuildRequires: make

https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot
---
 httpd.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/httpd.spec b/httpd.spec
index b162123..7828a0d 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -177,6 +177,7 @@ Security (TLS) protocols.
 Summary: HTML and XML content filters for the Apache HTTP Server
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 BuildRequires: libxml2-devel
+BuildRequires: make
 Epoch: 1
 Obsoletes: mod_proxy_html < 1:2.4.1-2
 

From f61dfedf8a250220f23a8f50f7a8197c73e613a4 Mon Sep 17 00:00:00 2001
From: aegorenk <aegorenk@redhat.com>
Date: Wed, 20 Jan 2021 15:46:18 +0100
Subject: [PATCH 220/359] prevent htcacheclean from while break when first file
 processed

---
 httpd-2.4.46-htcacheclean-dont-break.patch | 13 +++++++++++++
 httpd.spec                                 |  7 ++++++-
 2 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.46-htcacheclean-dont-break.patch

diff --git a/httpd-2.4.46-htcacheclean-dont-break.patch b/httpd-2.4.46-htcacheclean-dont-break.patch
new file mode 100644
index 0000000..e52318a
--- /dev/null
+++ b/httpd-2.4.46-htcacheclean-dont-break.patch
@@ -0,0 +1,13 @@
+diff --git a/support/htcacheclean.c b/support/htcacheclean.c
+index 958ba6d..0a7fe3c 100644
+--- a/support/htcacheclean.c
++++ b/support/htcacheclean.c
+@@ -557,8 +557,6 @@ static int list_urls(char *path, apr_pool_t *pool, apr_off_t round)
+                                         }
+                                     }
+                                 }
+-
+-                                break;
+                             }
+                         }
+                     }
diff --git a/httpd.spec b/httpd.spec
index 7828a0d..dd13440 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.46
-Release: 6%{?dist}
+Release: 7%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -89,6 +89,7 @@ Patch44: httpd-2.4.46-lua-resume.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
 Patch62: httpd-2.4.43-r1870095+.patch
+Patch63: httpd-2.4.46-htcacheclean-dont-break.patch
 
 # Security fixes
 
@@ -238,6 +239,7 @@ written in the Lua programming language.
 
 %patch60 -p1 -b .enable-sslv3
 %patch62 -p1 -b .r1870095
+%patch63 -p1 -b .htcacheclean-dont-break
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -775,6 +777,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Jan 20 2021 Artem Egorenkov <aegorenk@redhat.com> - 2.4.46-7
+- prevent htcacheclean from while break when first file processed
+
 * Thu Dec 17 2020 Joe Orton <jorton@redhat.com> - 2.4.46-6
 - move mod_lua to a subpackage
 - Recommends: both mod_lua and mod_http2

From 74ee2f12bd87c4ea627b907bc6e4528f64c37d9c Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Tue, 26 Jan 2021 13:36:50 +0000
Subject: [PATCH 221/359] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index dd13440..9c7f2b8 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.46
-Release: 7%{?dist}
+Release: 8%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -777,6 +777,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.46-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
 * Wed Jan 20 2021 Artem Egorenkov <aegorenk@redhat.com> - 2.4.46-7
 - prevent htcacheclean from while break when first file processed
 

From 74333afc91fe0d824c0135cf71b4fd5987aa3eed Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Mon, 1 Feb 2021 15:48:58 +0100
Subject: [PATCH 222/359] Resolves: #1914182 - RFE: CustomLog should be able to
 use journald

---
 httpd-2.4.43-logjournal.patch | 87 +++++++++++++++++++++++++++++++++++
 httpd.spec                    |  7 ++-
 2 files changed, 93 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.43-logjournal.patch

diff --git a/httpd-2.4.43-logjournal.patch b/httpd-2.4.43-logjournal.patch
new file mode 100644
index 0000000..cfbd9dc
--- /dev/null
+++ b/httpd-2.4.43-logjournal.patch
@@ -0,0 +1,87 @@
+diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4
+index 762e773..0848d2e 100644
+--- a/modules/loggers/config.m4
++++ b/modules/loggers/config.m4
+@@ -5,6 +5,8 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]])
+ APACHE_MODPATH_INIT(loggers)
+ 	
+ APACHE_MODULE(log_config, logging configuration.  You won't be able to log requests to the server without this module., , , yes)
++APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS])
++
+ APACHE_MODULE(log_debug, configurable debug logging, , , most)
+ APACHE_MODULE(log_forensic, forensic logging)
+ 
+diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c
+index 996c09c..50a056a 100644
+--- a/modules/loggers/mod_log_config.c
++++ b/modules/loggers/mod_log_config.c
+@@ -172,6 +172,10 @@
+ #include <limits.h>
+ #endif
+ 
++#ifdef HAVE_SYSTEMD
++#include <systemd/sd-journal.h>
++#endif
++
+ #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b"
+ 
+ module AP_MODULE_DECLARE_DATA log_config_module;
+@@ -1638,6 +1642,25 @@ static apr_status_t ap_default_log_writer( request_rec *r,
+ 
+     return rv;
+ }
++
++static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd,
++                                        int priority)
++{
++#ifdef HAVE_SYSTEMD
++    int fd;
++
++    fd = sd_journal_stream_fd("httpd", priority, 0);
++    if (fd < 0) return fd;
++
++    /* This is an AF_UNIX socket fd so is more pipe-like than
++     * file-like (the fd is neither seekable or readable), and use of
++     * apr_os_pipe_put_ex() allows cleanup registration. */
++    return apr_os_pipe_put_ex(outfd, &fd, 1, p);
++#else
++    return APR_ENOTIMPL;
++#endif
++}
++
+ static void *ap_default_log_writer_init(apr_pool_t *p, server_rec *s,
+                                         const char* name)
+ {
+@@ -1650,6 +1673,32 @@ static void *ap_default_log_writer_init(apr_pool_t *p, server_rec *s,
+         }
+         return ap_piped_log_write_fd(pl);
+     }
++    else if (strncasecmp(name, "journald:", 9) == 0) {
++        int priority;
++        const char *err = ap_parse_log_level(name + 9, &priority);
++        apr_status_t rv;
++        apr_file_t *fd;
++
++        if (err == NULL && priority > LOG_DEBUG) {
++            err = "TRACE level debugging not supported with journald";
++        }
++
++        if (err) {
++            ap_log_error(APLOG_MARK, APLOG_ERR, APR_EBADPATH, s, 
++                         "invalid journald log priority name %s: %s",
++                         name, err);
++            return NULL;
++        }
++
++        rv = wrap_journal_stream(p, &fd, priority);
++        if (rv) {
++            ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, 
++                         "could not open journald log stream");
++            return NULL;
++        }
++
++        return fd;
++    }
+     else {
+         const char *fname = ap_server_root_relative(p, name);
+         apr_file_t *fd;
diff --git a/httpd.spec b/httpd.spec
index 9c7f2b8..6f5ef66 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.46
-Release: 8%{?dist}
+Release: 9%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -84,6 +84,7 @@ Patch41: httpd-2.4.43-r1861793+.patch
 Patch42: httpd-2.4.43-r1828172+.patch
 Patch43: httpd-2.4.43-sslcoalesce.patch
 Patch44: httpd-2.4.46-lua-resume.patch
+Patch45: httpd-2.4.43-logjournal.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -236,6 +237,7 @@ written in the Lua programming language.
 %patch42 -p1 -b .r1828172+
 %patch43 -p1 -b .sslcoalesce
 %patch44 -p1 -b .luaresume
+%patch45 -p1 -b .logjournal
 
 %patch60 -p1 -b .enable-sslv3
 %patch62 -p1 -b .r1870095
@@ -777,6 +779,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Feb 01 2021 Lubos Uhliarik <luhliari@redhat.com> - 2.4.46-9
+- Resolves: #1914182 - RFE: CustomLog should be able to use journald
+
 * Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.46-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 

From 5bdf9e2fd6638b499b3ad993da52203458a075fd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Branislav=20N=C3=A1ter?= <bnater@redhat.com>
Date: Fri, 5 Feb 2021 14:45:30 +0100
Subject: [PATCH 223/359] plan with Tier1 tests for Fedora CI

---
 plans/tier1.fmf | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 plans/tier1.fmf

diff --git a/plans/tier1.fmf b/plans/tier1.fmf
new file mode 100644
index 0000000..3aa33db
--- /dev/null
+++ b/plans/tier1.fmf
@@ -0,0 +1,7 @@
+summary: CI plan with Tier1 beakerlib tests
+discover:
+    how: fmf
+    url: https://src.fedoraproject.org/tests/httpd.git
+    filter: 'tier: 1'
+execute:
+    how: tmt

From 04cd38464804c14749802af2e3bb81c2b3e54cd3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Branislav=20N=C3=A1ter?= <bnater@redhat.com>
Date: Fri, 5 Feb 2021 15:18:16 +0100
Subject: [PATCH 224/359] fmf metadata added

---
 .fmf/version | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 .fmf/version

diff --git a/.fmf/version b/.fmf/version
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/.fmf/version
@@ -0,0 +1 @@
+1

From 355f667417ebf8224fcb62d078f3f6bd7038028d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Branislav=20N=C3=A1ter?= <bnater@redhat.com>
Date: Fri, 12 Feb 2021 12:53:10 +0100
Subject: [PATCH 225/359] php test replaced with simplier smoke

---
 tests/httpd-php-mysql-sanity-test/PURPOSE     |   3 -
 .../httpd-php-mysql-sanity-test/new_mysql.php |  12 ---
 .../httpd-php-mysql-sanity-test/old_mysql.php |  12 ---
 .../php_mysql_test.conf                       |   5 -
 .../php_mysql_test.sql                        |   6 --
 tests/httpd-php-mysql-sanity-test/runtest.sh  | 102 ------------------
 .../Makefile                                  |  24 ++---
 tests/smoke/PURPOSE                           |   3 +
 tests/smoke/runtest.sh                        |  64 +++++++++++
 tests/tests.yml                               |   2 +-
 10 files changed, 79 insertions(+), 154 deletions(-)
 delete mode 100644 tests/httpd-php-mysql-sanity-test/PURPOSE
 delete mode 100644 tests/httpd-php-mysql-sanity-test/new_mysql.php
 delete mode 100644 tests/httpd-php-mysql-sanity-test/old_mysql.php
 delete mode 100644 tests/httpd-php-mysql-sanity-test/php_mysql_test.conf
 delete mode 100644 tests/httpd-php-mysql-sanity-test/php_mysql_test.sql
 delete mode 100755 tests/httpd-php-mysql-sanity-test/runtest.sh
 rename tests/{httpd-php-mysql-sanity-test => smoke}/Makefile (65%)
 create mode 100644 tests/smoke/PURPOSE
 create mode 100755 tests/smoke/runtest.sh

diff --git a/tests/httpd-php-mysql-sanity-test/PURPOSE b/tests/httpd-php-mysql-sanity-test/PURPOSE
deleted file mode 100644
index 59b3931..0000000
--- a/tests/httpd-php-mysql-sanity-test/PURPOSE
+++ /dev/null
@@ -1,3 +0,0 @@
-PURPOSE of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
-Description: test fetching data from mysqldb/mariadb through php
-Author: Karel Srot <ksrot@redhat.com>
diff --git a/tests/httpd-php-mysql-sanity-test/new_mysql.php b/tests/httpd-php-mysql-sanity-test/new_mysql.php
deleted file mode 100644
index 6087b11..0000000
--- a/tests/httpd-php-mysql-sanity-test/new_mysql.php
+++ /dev/null
@@ -1,12 +0,0 @@
-<?php
-$db = mysqli_connect("localhost", "root");
-if (!$db) {
-    die("Could not connect");
-}
-if (!mysqli_select_db($db, "php_mysql_test")) {
-    die("Could not select database");
-}
-$res = mysqli_query($db, "SELECT * from foobar");
-$row = mysqli_fetch_assoc($res);
-printf("%s is %d\n", $row['name'], $row['value']);
-?>
diff --git a/tests/httpd-php-mysql-sanity-test/old_mysql.php b/tests/httpd-php-mysql-sanity-test/old_mysql.php
deleted file mode 100644
index 8904c58..0000000
--- a/tests/httpd-php-mysql-sanity-test/old_mysql.php
+++ /dev/null
@@ -1,12 +0,0 @@
-<?php
-$db = mysql_connect("localhost", "root");
-if (!$db) {
-    die("Could not connect");
-}
-if (!mysql_select_db("php_mysql_test")) {
-    die("Could not select database");
-}
-$res = mysql_query("SELECT * from foobar");
-$row = mysql_fetch_assoc($res);
-printf("%s is %d\n", $row['name'], $row['value']);
-?>
diff --git a/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf b/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf
deleted file mode 100644
index d03c3c3..0000000
--- a/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf
+++ /dev/null
@@ -1,5 +0,0 @@
-
-Alias /php_mysql_test /var/www/php_mysql_test
-
-<Directory /var/www/php_mysql_test>
-</Directory>
diff --git a/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql b/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql
deleted file mode 100644
index ad931ac..0000000
--- a/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql
+++ /dev/null
@@ -1,6 +0,0 @@
-
-CREATE DATABASE php_mysql_test;
-USE php_mysql_test;
-
-CREATE TABLE foobar (name VARCHAR(10), value INTEGER);
-INSERT INTO foobar VALUES("fish", 42);
diff --git a/tests/httpd-php-mysql-sanity-test/runtest.sh b/tests/httpd-php-mysql-sanity-test/runtest.sh
deleted file mode 100755
index 6fa8315..0000000
--- a/tests/httpd-php-mysql-sanity-test/runtest.sh
+++ /dev/null
@@ -1,102 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
-#   Description: test fetching data from mysqldb/mariadb through php
-#   Author: Karel Srot <ksrot@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-# Include Beaker environment
-[ -e /usr/bin/rhts-environment.sh ] && . /usr/bin/rhts-environment.sh
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-PACKAGES="${PACKAGES:-httpd}"
-REQUIRES="${REQUIRES:-php $DB}"
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "rlImport httpd/http" 0 "Import httpd library"
-        if rlIsRHEL 5 6 && [ $httpCOLLECTION = 0 ]; then
-            DB="mysql-server"
-            rlRun "rlImport mysql/basic" 0 "Import mysqld library"
-            SERVICE=${mysqlServiceName}
-        else
-            DB="mariadb-server"
-            rlRun "rlImport mariadb55/basic" 0 "Import mariadb library"
-            SERVICE=${mariadbServiceName}
-        fi
-	# install also php-mysql on rhel-6 (instead of php-mysqlnd on rhel-7)
-        rlRun "rlImport php/utils"
-        phpPdoPhpMysqlSetup
-        rlAssertRpm --all
-        rlRun "rlServiceStart $SERVICE" 0
-        rlRun "echo DROP DATABASE php_mysql_test | mysql -u root" 0,1
-        rlRun "mysql --verbose -u root < php_mysql_test.sql"
-        rlRun "httpStop" 0 "Stop httpd if running"
-        rlRun "> $httpLOGDIR/error_log"
-        rlRun "rm -rvf $httpROOTDIR/php_mysql_test"
-        rlRun "mkdir -v $httpROOTDIR/php_mysql_test"
-        rlRun "cp -v php_mysql_test.conf $httpCONFDIR/conf.d/"
-        php_version=`rlCheckRpm php`
-        if [[ $php_version =~ php-7* ]] || [[ $php_version =~ php-5.[5-6]* ]]; then
-            rlRun "cp -v new_mysql.php $httpROOTDIR/php_mysql_test/mysql.php"
-        else
-            rlRun "cp -v old_mysql.php $httpROOTDIR/php_mysql_test/mysql.php"
-        fi
-        rlRun "sed -i 's|/var/www|$httpROOTDIR|' $httpCONFDIR/conf.d/php_mysql_test.conf"
-        rlRun "chown -R apache:  $httpROOTDIR/php_mysql_test"
-        #rlRun "restorecon  $httpROOTDIR/php_mysql_test"
-        selinuxenabled && rlRun "chcon -Rv -t httpd_sys_content_t $httpROOTDIR/php_mysql_test"
-        rlRun "httpStart" 0 "Start httpd"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        URL="http://localhost/php_mysql_test/"
-        RETVAL=0
-        tries=`seq 1 10`
-
-        for n in ${tries}; do
-            output=`curl -s $URL/mysql.php`
-            rv=$?
-            echo "PHP output ${n}: ${rv} x${output}y"
-            [ ${rv} -ne 0 -o "x${output}y" != "xfish is 42y" ] && RETVAL=66
-        done
-
-        if [ $RETVAL -ne 0 ]; then
-            rlFail
-        else
-            rlPass
-        fi
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "rm -f $httpCONFDIR/conf.d/php_mysql_test.conf"
-        rlRun "rm -rf $httpROOTDIR/php_mysql_test"
-        rlRun "echo DROP DATABASE php_mysql_test | mysql -u root"
-        rlRun "rlServiceRestore ${SERVICE}" 0
-        rlRun "httpStop" 0 "Stop httpd if running"
-	# uninstall php-mysql on rhel-6 if it was installed during setup
-        phpPdoPhpMysqlCleanup
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
diff --git a/tests/httpd-php-mysql-sanity-test/Makefile b/tests/smoke/Makefile
similarity index 65%
rename from tests/httpd-php-mysql-sanity-test/Makefile
rename to tests/smoke/Makefile
index a688236..6abde94 100644
--- a/tests/httpd-php-mysql-sanity-test/Makefile
+++ b/tests/smoke/Makefile
@@ -1,12 +1,12 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #
-#   Makefile of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
-#   Description: test fetching data from mysqldb/mariadb through php
-#   Author: Karel Srot <ksrot@redhat.com>
+#   Makefile of /CoreOS/httpd/Sanity/smoke
+#   Description: Simple check of httpd test page
+#   Author: Branislav Nater <bnater@redhat.com>
 #
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #
-#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#   Copyright (c) 2021 Red Hat, Inc.
 #
 #   This copyrighted material is made available to anyone wishing
 #   to use, modify, copy, or redistribute it subject to the terms
@@ -24,12 +24,12 @@
 #
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-export TEST=/CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+export TEST=/CoreOS/httpd/Sanity/smoke
 export TESTVERSION=1.0
 
 BUILT_FILES=
 
-FILES=$(METADATA) runtest.sh Makefile PURPOSE new_mysql.php old_mysql.php php_mysql_test.sql php_mysql_test.conf
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
 
 .PHONY: all install download clean
 
@@ -43,25 +43,23 @@ clean:
 	rm -f *~ $(BUILT_FILES)
 
 
--include /usr/share/rhts/lib/rhts-make.include
+include /usr/share/rhts/lib/rhts-make.include
 
 $(METADATA): Makefile
-	@echo "Owner:           Karel Srot <ksrot@redhat.com>" > $(METADATA)
+	@echo "Owner:           Branislav Nater <bnater@redhat.com>" > $(METADATA)
 	@echo "Name:            $(TEST)" >> $(METADATA)
 	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
 	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     test fetching data from mysqldb/mariadb through php" >> $(METADATA)
+	@echo "Description:     Simple check of httpd test page" >> $(METADATA)
 	@echo "Type:            Sanity" >> $(METADATA)
 	@echo "TestTime:        5m" >> $(METADATA)
 	@echo "RunFor:          httpd" >> $(METADATA)
-	@echo "Requires:        httpd php php-zts php-mysqlnd mysql-server mariadb-server" >> $(METADATA)
+	@echo "Requires:        httpd mod_ssl" >> $(METADATA)
 	@echo "RhtsRequires:    library(httpd/http)" >> $(METADATA)
-	@echo "RhtsRequires:    library(mysql/basic)" >> $(METADATA)
-	@echo "RhtsRequires:    library(mariadb55/basic)" >> $(METADATA)
-	@echo "RhtsRequires:    library(php/utils)" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
 
 	rhts-lint $(METADATA)
diff --git a/tests/smoke/PURPOSE b/tests/smoke/PURPOSE
new file mode 100644
index 0000000..510e749
--- /dev/null
+++ b/tests/smoke/PURPOSE
@@ -0,0 +1,3 @@
+PURPOSE of /CoreOS/httpd/Sanity/smoke
+Description: Simple check of httpd
+Author: Branislav Nater <bnater@redhat.com>
diff --git a/tests/smoke/runtest.sh b/tests/smoke/runtest.sh
new file mode 100755
index 0000000..f65c8ba
--- /dev/null
+++ b/tests/smoke/runtest.sh
@@ -0,0 +1,64 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/httpd/Sanity/smoke
+#   Description: Simple check of httpd test page
+#   Author: Branislav Nater <bnater@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2021 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGES="${PACKAGES:-httpd}"
+REQUIRES=${REQUIRES:-}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport --all" 0 "Importing Beaker libraries" || rlDie
+        rlAssertRpm --all
+        rlFileBackup --clean ${httpCONFDIR}/conf/
+        rlFileBackup --clean ${httpCONFDIR}/conf.d/
+        rlFileBackup --clean ${httpCONFDIR}/conf.modules.d/
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "httpStart" 0 "Start httpd"
+        rlRun "httpStatus" 0 "Check status"
+        rlRun "httpStop" 0 "Stop httpd"
+
+        rlRun "httpSecureStart" 0 "Start httpd with ssl"
+        rlRun "httpInstallCa $(hostname)" 0 "Install CA"
+        rlRun "httpSecureStatus" 0 "Check status"
+        rlRun "httpRemoveCa" 0 "Remove CA"
+        rlRun "httpSecureStop" 0 "Stop httpd with ssl"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rlFileRestore" 0 "Restoring original configuration"
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalEnd
+rlJournalPrintText
diff --git a/tests/tests.yml b/tests/tests.yml
index e0ef0be..802bea0 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -6,7 +6,7 @@
     tags:
     - classic
     tests:
-    - httpd-php-mysql-sanity-test
+    - smoke
     required_packages:
     - findutils         # beakerlib needs find command
     - which             # smoke requires which command

From a2204eef190301180f6362bc8ff8f4dc4beb83ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Branislav=20N=C3=A1ter?= <bnater@redhat.com>
Date: Mon, 15 Feb 2021 13:58:24 +0100
Subject: [PATCH 226/359] Skip STI tests in favour of TMT tests (fedora-ci
 issue#206)

---
 tests/{tests.yml => ignore_tests.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename tests/{tests.yml => ignore_tests.yml} (100%)

diff --git a/tests/tests.yml b/tests/ignore_tests.yml
similarity index 100%
rename from tests/tests.yml
rename to tests/ignore_tests.yml

From 2c9507d609c091c1843286c5e039e2868d77cc33 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 23 Feb 2021 16:44:24 +0000
Subject: [PATCH 227/359] add Conflicts: with mod_nss

---
 httpd-2.4.43-sslmultiproxy.patch | 118 -------------------------------
 httpd.spec                       |   9 ++-
 2 files changed, 6 insertions(+), 121 deletions(-)
 delete mode 100644 httpd-2.4.43-sslmultiproxy.patch

diff --git a/httpd-2.4.43-sslmultiproxy.patch b/httpd-2.4.43-sslmultiproxy.patch
deleted file mode 100644
index 349c4ae..0000000
--- a/httpd-2.4.43-sslmultiproxy.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
-index 12617b2..0fe7464 100644
---- a/modules/ssl/mod_ssl.c
-+++ b/modules/ssl/mod_ssl.c
-@@ -459,6 +459,10 @@ static int ssl_hook_pre_config(apr_pool_t *pconf,
-     return OK;
- }
- 
-+static APR_OPTIONAL_FN_TYPE(ssl_engine_disable) *othermod_engine_disable;
-+static APR_OPTIONAL_FN_TYPE(ssl_engine_set) *othermod_engine_set;
-+
-+
- static SSLConnRec *ssl_init_connection_ctx(conn_rec *c,
-                                            ap_conf_vector_t *per_dir_config,
-                                            int new_proxy)
-@@ -466,6 +470,10 @@ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c,
-     SSLConnRec *sslconn = myConnConfig(c);
-     int need_setup = 0;
- 
-+    if (othermod_engine_disable) {
-+        othermod_engine_disable(c);
-+    }
-+
-     /* mod_proxy's (r->)per_dir_config has the lifetime of the request, thus
-      * it uses ssl_engine_set() to reset sslconn->dc when reusing SSL backend
-      * connections, so we must fall through here. But in the case where we are
-@@ -544,6 +552,10 @@ static int ssl_engine_set(conn_rec *c,
- {
-     SSLConnRec *sslconn;
-     int status;
-+
-+    if (othermod_engine_set) {
-+        return othermod_engine_set(c, per_dir_config, proxy, enable);
-+    }
-     
-     if (proxy) {
-         sslconn = ssl_init_connection_ctx(c, per_dir_config, 1);
-@@ -572,12 +584,18 @@ static int ssl_engine_set(conn_rec *c,
- 
- static int ssl_proxy_enable(conn_rec *c)
- {
--    return ssl_engine_set(c, NULL, 1, 1);
-+    if (othermod_engine_set)
-+        return othermod_engine_set(c, NULL, 1, 1);
-+    else
-+        return ssl_engine_set(c, NULL, 1, 1);
- }
- 
- static int ssl_engine_disable(conn_rec *c)
- {
--    return ssl_engine_set(c, NULL, 0, 0);
-+    if (othermod_engine_set)
-+        return othermod_engine_set(c, NULL, 0, 0);
-+    else
-+        return ssl_engine_set(c, NULL, 0, 0);
- }
- 
- int ssl_init_ssl_connection(conn_rec *c, request_rec *r)
-@@ -753,6 +771,9 @@ static void ssl_register_hooks(apr_pool_t *p)
-                       APR_HOOK_MIDDLE);
- 
-     ssl_var_register(p);
-+    
-+    othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable);
-+    othermod_engine_set = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_set);
- 
-     APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
-     APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
-diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c
-index 5724f18..81c56ba 100644
---- a/modules/ssl/ssl_engine_vars.c
-+++ b/modules/ssl/ssl_engine_vars.c
-@@ -54,6 +54,8 @@ static char *ssl_var_lookup_ssl_cipher(apr_pool_t *p, SSLConnRec *sslconn, char
- static void  ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algkeysize);
- static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var);
- static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl);
-+static APR_OPTIONAL_FN_TYPE(ssl_is_https) *othermod_is_https;
-+static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *othermod_var_lookup;
- 
- static SSLConnRec *ssl_get_effective_config(conn_rec *c)
- {
-@@ -68,7 +70,9 @@ static SSLConnRec *ssl_get_effective_config(conn_rec *c)
- static int ssl_is_https(conn_rec *c)
- {
-     SSLConnRec *sslconn = ssl_get_effective_config(c);
--    return sslconn && sslconn->ssl;
-+
-+    return (sslconn && sslconn->ssl)
-+        || (othermod_is_https && othermod_is_https(c));
- }
- 
- static const char var_interface[] = "mod_ssl/" AP_SERVER_BASEREVISION;
-@@ -137,6 +141,9 @@ void ssl_var_register(apr_pool_t *p)
- {
-     char *cp, *cp2;
- 
-+    othermod_is_https = APR_RETRIEVE_OPTIONAL_FN(ssl_is_https);
-+    othermod_var_lookup = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup);
-+
-     APR_REGISTER_OPTIONAL_FN(ssl_is_https);
-     APR_REGISTER_OPTIONAL_FN(ssl_var_lookup);
-     APR_REGISTER_OPTIONAL_FN(ssl_ext_list);
-@@ -271,6 +278,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r,
-      */
-     if (result == NULL && c != NULL) {
-         SSLConnRec *sslconn = ssl_get_effective_config(c);
-+
-+        if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
-+            && (!sslconn || !sslconn->ssl) && othermod_var_lookup) {
-+            /* For an SSL_* variable, if mod_ssl is not enabled for
-+             * this connection and another SSL module is present, pass
-+             * through to that module. */
-+            return othermod_var_lookup(p, s, c, r, var);
-+        }
-+
-         if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
-             && sslconn && sslconn->ssl)
-             result = ssl_var_lookup_ssl(p, sslconn, r, var+4);
diff --git a/httpd.spec b/httpd.spec
index 6f5ef66..f6e5c7a 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.46
-Release: 9%{?dist}
+Release: 10%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -75,7 +75,6 @@ Patch25: httpd-2.4.43-selinux.patch
 Patch26: httpd-2.4.43-gettid.patch
 Patch27: httpd-2.4.43-icons.patch
 Patch30: httpd-2.4.43-cachehardmax.patch
-Patch31: httpd-2.4.43-sslmultiproxy.patch
 Patch34: httpd-2.4.43-socket-activation.patch
 Patch38: httpd-2.4.43-sslciphdefault.patch
 Patch39: httpd-2.4.43-sslprotdefault.patch
@@ -169,6 +168,8 @@ Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 Requires: sscg >= 2.2.0, /usr/bin/hostname
 # Require an OpenSSL which supports PROFILE=SYSTEM
 Conflicts: openssl-libs < 1:1.0.1h-4
+# mod_ssl/mod_nss cannot both be loaded simultaneously
+Conflicts: mod_nss
 
 %description -n mod_ssl
 The mod_ssl module provides strong cryptography for the Apache HTTP
@@ -228,7 +229,6 @@ written in the Lua programming language.
 %patch26 -p1 -b .gettid
 %patch27 -p1 -b .icons
 %patch30 -p1 -b .cachehardmax
-#patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch38 -p1 -b .sslciphdefault
 %patch39 -p1 -b .sslprotdefault
@@ -779,6 +779,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Feb 23 2021 Joe Orton <jorton@redhat.com> - 2.4.46-10
+- add Conflicts: with mod_nss
+
 * Mon Feb 01 2021 Lubos Uhliarik <luhliari@redhat.com> - 2.4.46-9
 - Resolves: #1914182 - RFE: CustomLog should be able to use journald
 

From 04961f16338adfe7aa842f716fc069040675cf5b Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 23 Feb 2021 16:50:29 +0000
Subject: [PATCH 228/359] drop use of apr_ldap_rebind (r1878890, #1847585)

---
 httpd-2.4.46-r1878890.patch | 116 ++++++++++++++++++++++++++++++++++++
 httpd.spec                  |   3 +
 pullrev.sh                  |   2 +-
 3 files changed, 120 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.46-r1878890.patch

diff --git a/httpd-2.4.46-r1878890.patch b/httpd-2.4.46-r1878890.patch
new file mode 100644
index 0000000..b75d53e
--- /dev/null
+++ b/httpd-2.4.46-r1878890.patch
@@ -0,0 +1,116 @@
+# ./pullrev.sh 1878890
+
+http://svn.apache.org/viewvc?view=revision&revision=1878890
+
+--- httpd-2.4.46/include/util_ldap.h.r1878890
++++ httpd-2.4.46/include/util_ldap.h
+@@ -32,7 +32,6 @@
+ #if APR_MAJOR_VERSION < 2
+ /* The LDAP API is currently only present in APR 1.x */
+ #include "apr_ldap.h"
+-#include "apr_ldap_rebind.h"
+ #else
+ #define APR_HAS_LDAP 0
+ #endif
+--- httpd-2.4.46/modules/ldap/util_ldap.c.r1878890
++++ httpd-2.4.46/modules/ldap/util_ldap.c
+@@ -140,6 +140,38 @@
+     return OK;
+ }
+ 
++/* For OpenLDAP with the 3-arg version of ldap_set_rebind_proc(), use
++ * a simpler rebind callback than the implementation in APR-util.
++ * Testing for API version >= 3001 appears safe although OpenLDAP
++ * 2.1.x (API version = 2004) also has the 3-arg API. */
++#if APR_HAS_OPENLDAP_LDAPSDK && defined(LDAP_API_VERSION) && LDAP_API_VERSION >= 3001
++
++#define uldap_rebind_init(p) APR_SUCCESS /* noop */
++
++static int uldap_rebind_proc(LDAP *ld, const char *url, ber_tag_t request,
++                             ber_int_t msgid, void *params)
++{
++    util_ldap_connection_t *ldc = params;
++
++    return ldap_bind_s(ld, ldc->binddn, ldc->bindpw, LDAP_AUTH_SIMPLE);
++}
++
++static apr_status_t uldap_rebind_add(util_ldap_connection_t *ldc)
++{
++    ldap_set_rebind_proc(ldc->ldap, uldap_rebind_proc, ldc);
++    return APR_SUCCESS;
++}
++
++#else /* !APR_HAS_OPENLDAP_LDAPSDK */
++
++#define USE_APR_LDAP_REBIND
++#include <apr_ldap_rebind.h>
++
++#define uldap_rebind_init(p) apr_ldap_rebind_init(p)
++#define uldap_rebind_add(ldc) apr_ldap_rebind_add((ldc)->rebind_pool, \
++                                                  (ldc)->ldap, (ldc)->binddn, \
++                                                  (ldc)->bindpw)
++#endif
+ 
+ 
+ /* ------------------------------------------------------------------ */
+@@ -181,6 +213,13 @@
+     util_ldap_connection_t *ldc = param;
+ 
+     if (ldc) {
++#ifdef USE_APR_LDAP_REBIND
++        /* forget the rebind info for this conn */
++        if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
++            apr_pool_clear(ldc->rebind_pool);
++        }
++#endif
++
+         if (ldc->ldap) {
+             if (ldc->r) { 
+                 ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, ldc->r, "LDC %pp unbind", ldc); 
+@@ -189,12 +228,6 @@
+             ldc->ldap = NULL;
+         }
+         ldc->bound = 0;
+-
+-        /* forget the rebind info for this conn */
+-        if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
+-            apr_ldap_rebind_remove(ldc->ldap);
+-            apr_pool_clear(ldc->rebind_pool);
+-        }
+     }
+ 
+     return APR_SUCCESS;
+@@ -330,7 +363,7 @@
+ 
+     if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
+         /* Now that we have an ldap struct, add it to the referral list for rebinds. */
+-        rc = apr_ldap_rebind_add(ldc->rebind_pool, ldc->ldap, ldc->binddn, ldc->bindpw);
++        rc = uldap_rebind_add(ldc);
+         if (rc != APR_SUCCESS) {
+             ap_log_error(APLOG_MARK, APLOG_ERR, rc, r->server, APLOGNO(01277)
+                     "LDAP: Unable to add rebind cross reference entry. Out of memory?");
+@@ -855,6 +888,7 @@
+         /* whether or not to keep this connection in the pool when it's returned */
+         l->keep = (st->connection_pool_ttl == 0) ? 0 : 1;
+ 
++#ifdef USE_APR_LDAP_REBIND
+         if (l->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
+             if (apr_pool_create(&(l->rebind_pool), l->pool) != APR_SUCCESS) {
+                 ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r, APLOGNO(01286)
+@@ -865,6 +899,7 @@
+                 return NULL;
+             }
+         }
++#endif
+ 
+         if (p) {
+             p->next = l;
+@@ -3051,7 +3086,7 @@
+     }
+ 
+     /* Initialize the rebind callback's cross reference list. */
+-    apr_ldap_rebind_init (p);
++    (void) uldap_rebind_init(p);
+ 
+ #ifdef AP_LDAP_OPT_DEBUG
+     if (st->debug_level > 0) {
diff --git a/httpd.spec b/httpd.spec
index f6e5c7a..233a247 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -88,6 +88,7 @@ Patch45: httpd-2.4.43-logjournal.patch
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
+Patch61: httpd-2.4.46-r1878890.patch
 Patch62: httpd-2.4.43-r1870095+.patch
 Patch63: httpd-2.4.46-htcacheclean-dont-break.patch
 
@@ -240,6 +241,7 @@ written in the Lua programming language.
 %patch45 -p1 -b .logjournal
 
 %patch60 -p1 -b .enable-sslv3
+%patch61 -p1 -b .r1878890
 %patch62 -p1 -b .r1870095
 %patch63 -p1 -b .htcacheclean-dont-break
 
@@ -781,6 +783,7 @@ exit $rv
 %changelog
 * Tue Feb 23 2021 Joe Orton <jorton@redhat.com> - 2.4.46-10
 - add Conflicts: with mod_nss
+- drop use of apr_ldap_rebind (r1878890, #1847585)
 
 * Mon Feb 01 2021 Lubos Uhliarik <luhliari@redhat.com> - 2.4.46-9
 - Resolves: #1914182 - RFE: CustomLog should be able to use journald
diff --git a/pullrev.sh b/pullrev.sh
index ada0076..27bbcb3 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -7,7 +7,7 @@ fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
 #repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.43
+ver=2.4.46
 prefix="httpd-${ver}"
 suffix="${SUFFIX:-r$1${2:++}}"
 fn="${prefix}-${suffix}.patch"

From f88f49a8c6c057795e68ad001d80ff50d801822a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Branislav=20N=C3=A1ter?= <bnater@redhat.com>
Date: Thu, 25 Feb 2021 13:31:31 +0100
Subject: [PATCH 229/359] Don't run all tier1 tests

---
 plans/{tier1.fmf => all.fmf} | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
 rename plans/{tier1.fmf => all.fmf} (60%)

diff --git a/plans/tier1.fmf b/plans/all.fmf
similarity index 60%
rename from plans/tier1.fmf
rename to plans/all.fmf
index 3aa33db..e98ae64 100644
--- a/plans/tier1.fmf
+++ b/plans/all.fmf
@@ -1,7 +1,6 @@
-summary: CI plan with Tier1 beakerlib tests
+summary: Test plan with all beakerlib tests
 discover:
     how: fmf
     url: https://src.fedoraproject.org/tests/httpd.git
-    filter: 'tier: 1'
 execute:
     how: tmt

From 28153dbcc10727f155e28cc9a0865d918570e03e Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Wed, 31 Mar 2021 14:11:00 +0200
Subject: [PATCH 230/359] Resolves: #1934739 - Apache trademark update - new
 logo

---
 apache-poweredby.png | Bin 0 -> 5714 bytes
 httpd.spec           |  12 ++++++++++--
 welcome.conf         |   2 +-
 3 files changed, 11 insertions(+), 3 deletions(-)
 create mode 100644 apache-poweredby.png

diff --git a/apache-poweredby.png b/apache-poweredby.png
new file mode 100644
index 0000000000000000000000000000000000000000..5663a23ad527e8983d82529485a0dc7f33230a08
GIT binary patch
literal 5714
zcmV-Y7Om-tP)<h;3K|Lk000e1NJLTq002+`002-31^@s6juG;$00009a7bBm000id
z000id0mpBsWB>pF8FWQhbW?9;ba!ELWdL_~cP?peYja~^aAhuUa%Y?FJQ@H172ioj
zK~#9!<y{F>R9BkDPP&uK={cS0nPjHBllTy15k(W++ZY{VToSiHRlQe$;)X_9L}gbj
zcX5wVBSvFP;u4JezAHgRM8ySn5djq!RB&J5pZi_vm9L5_EsA<3>3QeeBlXt%zW3jM
z|9@Rve#Na@aPZq&t-hUB6eF}cX_iK(-=@(?N7*>f#!WUJ8OKfIJ{;SMa|3izcz{m#
ziAJM&%jN&e)~Qpce+$s*y98+UUmC$EXM?Ia%8mD$t`Wt~4A3|Jr9d+n41dsQq!t>T
zn8IGN#0h}CXxwKMnyS@Gofw#}{BD5@2?=?fEwcd(xZD@Lv_7aiMMe##UVZvnJ>ET}
z7wyZ)p!FLz(zgq~qlm~Td%<MOUjGH=^1E85jHeCNXr;@xUQ8?M`M*hqk(8I0M<-66
zq`mtx=*-!(w0y<NO6Nxn8A>@hCumsG2%0tfYs$NLkz!)w`7r=GVdA9c1IgwRpp}MT
zZog^p__EPS7i>}4wCOV_JNpRz@Z%!BZ)kKZ9XfQ_bdIPGqSL3(P~z|;vunqU9Z%b~
z?=byd_VaR@F>@CGd-w<gW$e#19SiBzhd)Or1zH2Mknv#6Zw@$76a}_a*V>}Cb?ett
z?u84Ky6k5fFfiN<)S{vyv-9VEGmloRTxGUz_SbW$xVV^3o;<}rz~Ss{3hvR99|KTD
zSFdvL!3OXg0QdrmT>ZITU-P#@bzO~WhRq3QA2~t^!-kuF_y1xb^$G3I|1Kyf<UCG3
zHgVEq+Ol<<+4W0*N~Jk-zu|ym>0+tJCk`_mPfPoSeq6Me&Ye3)gNMf0%O6Xa)YkoK
zz;)=*;WeW=Vm2{Q!i=wG(ym>*O)oQb`j@nm{hmB^8XY`zh*ME?Y#cuZ-lqf?Kwv2E
zxn;{%8aE-?^n1<Pwe<Cz6w~i-7c8Ws$Bwb(+uH%DEvDdIUakV%t^0qn2k*0-OiWw?
z9nZ<3h2Q@`$rC5jwQJWn)nJsC-r+AkAS}Y{nx9gaall568A~fyt)|@ET<Y1|Tp9y>
zEX~XVS(Ki>hw}6DsdwLgrsMlFGbw4r$m*y*dzi}e*O$fb{%%xU%_afrI(Pm&h4vp{
z;(hrA1#Ed%@G7Vvkf8GUVEzy$5D=M}2RPrGkUWutZHt%U-UGuU%mf6^zjpmPr~GQ_
zk0%(2@2Lu&za)9F2jyFv0G7|?%a`d3CM2NGWn}E<x?A6VUzj8=co(Sc?Addi&&4Gq
zR$FlffC-7iou!25;~iB2kA0ngum|KR9|($ofRF-%&8QGSf$1+=yo4@axxy(7d=8+^
zoHd(*x`)t9ut*#og-(~y6+DlTxZ**eG=QZP05U(CsaUF5dQ+!Oe-V{jXR5_Ac5VWb
z>i!x{U_GctdcFQXI(P2%?{FCS>-Dt)M6o%uZhErw$Fq@UbTp^|Vvf^zA|#Zhzz7SE
zr1R%<xzONh$$&7E1rf@Y?3F7;W=!6OE>^&S(C8bm$JB7#IT837vwfGq26iflqO{j3
z(wV6$Gc9kvX6-uqB|V)}7nnLIQ8uk)Wq9$DrMA?DeejyV$>3xb^A|RsSoVw}XMxB*
z%#7+yN)!W>H-z#F&>#iV_w1z|J9lwP91<O4(gAnu*vTnUws)0M4*ol}wFJ1c*t6o;
zxa$-U8B3{#c_!Uf-V9W=dd*rBSm1ZE)c`>P$vbcU0?SD}VupM?d$B*gOkEW!i7oT8
zisP0;LWNzp#+oh$3j1#14<^uHS^T_w1s%xBGP4dUhW?^PBQ;YCBqEm@_fy=X?#*;x
zRx-`4gOyWiusK9lTi7t$xoUh*r|+V?L64rjO{xbd50oYw>;N$<>!6wBH8SB{UAu<7
zsTz1w-+ANVH*Tp9=DN|n*=}@ax_ep4BsbAIHNv6$e0$xFrQFGG$!4kVZD&*mB^gu(
z{SM9m{5^8i7&HH#VysltiAjc5uRcg|TL<tk?tkq@cW1a$$z=B%7YxGdHjDrt=y;BU
zDCXJ~E?_4|TV4zgFr1#SCcc?BpD)|2gNNwmty>fxImq&1Th-=w47_jdr&NH)Mj89N
z{O(uoR65n2ZcV7&(l%cVa<@lH+cFEaq8Rl;H@q!RG8EyXM~_ipa1WE49SXAiTh^V_
z_WItM<Q4(&jN>T-u#_+3S!@|kV*n<*^?1H;(Kogwp|O%SZrV(bA3x^Kk1uD;v^?k1
zb9KXt7{;>;VBqggOQW&lCUDgSu5<7|tKMF%bQO*UHNm?YQ@iceSdUW1^R5HHdns-?
z@-pUp@Jn~PJ;_}g6&3Zyph1J)WV+^`5LmJdE-@Z2S_2RSq1*su9}9y(s}=j(j-FWr
zfB+QY78^Eh<jOKUD)>U1HgB<fc$wNd-sK_QHH)G>im%3b(2bF`cQNUEl7U!i0&tGo
zqmn7^=WmU7Zxt36^Y@5|sL+Ur!HHp!gEe7cLn=840z_%PC4g|;T5eWM(DPO;C#_cB
z`nghwkvF`+t5&b!u61*VfS95tcn}(w!oBuf9^^?^27A)gXwQNh2KQw*l05cYOZ3Pt
ziucH8z&>T8{7Sq#541-{Mm8B38QC&CJgO6;M#1u)+{U&LDzWhi^z`Xd6L@fwnXxE&
zXrzxS1E`a}Rh~2`Y6zFUM~)ulF%A5-VKd&4B<a7@1hBA=_o#w?-c&fiix`k}CDQZj
zqM@Et6yrglNX6JwMRl#xQXV~K9CyRv-C^_FkjV3_sV=4R36QK<vfzCP)WEjAbm=np
zGFQHtK2lBaE(Cfvz1YL&X@1W-l;5Wg754X9eQBUq@#P2xWE7*wA<uv;iu35>fWeUA
zfLe3gOr^0@oY$@2z&*y6zCQ$jEOfqWYD(P;A;RnDwRLkYNIsMo<U<#``;_MO@>yIE
z%BZowH!&ayK=P$M#Pg~x9ng+YY?bvwc!8827qj3Hbi7`DLMvT#=<s37{Yh$4-<dAH
zlg@RkN9X<PQm&Q_$!AJlu+P(rA&eS(*P(*G3LwM0;v9SoGxwz9RR&P2pQ<Edvls{B
zw}|*F_rYXC*ib=%<#0Ht1>VU|>iL~+@B8G;r@nNyb3HoOwcd$bP2HWjVqLnRXA~LC
zC=x*S;y_+3h<eB2q#~Y4QFSUjT;XjF4u0D*O9~S9)aldQT?M9U7&)3p#9+oL^uFzC
zftTu{c_pVsgAFI!)TdKz>k|W#&VJ@Q;#?O7<mZecHH;c{&w$Ji@fNG|yw8Jz{>I+v
zX%zu1<H8g9dA7_M#4pl*N#`-%apRLM&6)_c06gf?aNr^Dh6hf3*nm#7YCsIgou}K?
zKYXSm2a?XpKn5@nwe_}>gC1>j->0;<>JA3|#~|MbOQ$Im$_3vov>9To(1il)sR7>J
zcbfh6pj)FGY|v3ZzvDU0-=`BT>km8Gx&fW~m{DW9`gEp)FP#C9UF)7X*Uk5Br}z(b
z(wHg(D2fAJDl$W#?L-z7qG^!C(1mR2elAY<>ejZbT1{qU)oMf-2i+TG9dG!->f_Dc
z&&g>4AQ?4Q09k&zZT+8en$-`>Y4(A;Qvj5twhnk`zH;H-6H^{uPdaw|xXJQBrj!i;
ze^CRx1Fj7{57cV>m<<LXMx(N<x{V@_)b~rvuJ5<=i0=oxv+I43nO(2pscfHykB|8J
z73cW)IK}g0Oc<ylfcnh<@R+;<?kbt;zyo2j*`<j)Y0DIvEI;7dnE0pwaRnPWMldOh
zE$f5Eamb?)9rp5@<iy9<P#P0<jw3G0e7^A$Ceo=>r@0C<drk@un)k61o@CTH+}Yq|
zyw}7p)3r%?CIc_C0>tvHnvDko$Y&I32IPZmk7oaHY8*vDO!hiiaZ$0!+UWNMO`q`<
z&so{9aT8ZvknD4v8P&svk5JWo+wa<B-F~47Wn#FpQLD*@{jQBOloY81k}dZzrw5{{
zE{U(ZI23RZ^}U@+eXdP>_X*9)GlZrD5G#Oe8o_~lMv*d*rEDZ0diS4B_dT+A+f+p?
z9y$tOs52*??)u@6dxRFWS7=TQNMb-{>=zoZF{8)|Aj`5`8)q{BcaRENfTI8wJ7C7d
zIcw6p-CDl8Tlna4n$VJd5k4dUxld>j!GJ7NQsjOaNTKn$teSp*Qze${;1a&z0Du#n
zHR<ib$A+E4|I#j@6)_+wP53Zxcg+^F(ixC@gnu$Ho0Ad9GDelVGF_W$RSU*f*{M(=
zM2<P2KsrT@fz7*BXq(SKq#Z&V0+73Fwn}6`mdX?<1G%?m^Cwu|48XoB;pea#v(*6r
z)15KnO+v@^n}znYMfijmkhD$s`0fs&b$kUywq_LBiY$P9uv2KIO0eFT|5$ZJ+FJIN
z9piyBV!s=NPrutJbfir}2Lh1Wg!U;6$de36+Ri9)hZ&F`F(6wmQfvA0!bL~2w=A6r
z_70s+*Qh!Z-r1_vt80bMH`fWD5d)F{<c9Y;^sS)Cc8nrFVSu(Z0l8CXU7qIJ##c1}
zwc=QZoC%H~?+j&nMXhcvRtsHejnIV{khIRVQ#u1ORY{Q+K(0~K`z<GtqND=J?smJg
zkUr~B*(nqG)dH}lCUK?kIjs`95rACf+GQXE^3gh>6RkH<r4h)Q?VfBA+BQ%NJfkDw
zDICdn?%XkD*TSJ<CGW@NP(|vqRhPcKqdFPw%LMI~p9Kvq7XoOd;9tDTH6X!^A{9Vx
z5IQESOMMmjK*%sdLcB7>xodZtS(X~2l*ZqOlsA~}P-Ken4M!$ya54O0QO%&-R6$1!
zNMb-vUoQBcSRwcmsB$%<O6Af{^-(ohsRmCfXYYd|A!X<mMLo*8yZPTP;HfS~0Ww*k
zfs36TO#3QgEa1;oo$(a6!SBv;58Jg=(9=(XL`z)7U?Y&6B4r>~3f(f-dUR4XXfKC!
zk?Z~7!2?cZGPT{jdDF}*k68Jr(PL%)*U>VtUg97Xj<9#K$(}LX0Wi@$>Z8fEqaH34
zLM|;90{1U<)z1Tvse;HTQfCCxf9Zk-A#Z|O)ulc$6Yl|U6H3VL-@ngGYuBz@Pn(%Q
zk>3+_e@OK(^2A$}@*k}w+t@koFe>~XduBV<Bc{zb&*;&~o<n<2tUZLLxkaRX|6Y%X
zMM6*s1Co|7id-s4CzjRJeLllI{H>|ABUH_L&}yY1%OY@8Pi@+~neN`b%S&;Q7mkEd
zR3;#mnG=mD&8<wzqS(sO>`j1g@1)0i#4aD_5tBRKBbp|73@w@O)+>Zj;*oD_^;$8v
zR^P~p?$MgbwFl3b>@hem***Ln)dYt|^A|SvD{_e~5=bp;nNekmWCA1{J$m$r!XgG4
z-&g#wGGpiIZM?OJV<6gD2|lV$tj}oAIATB&19IsY&-hJaJY(7K7#h#U1O{xf$IvSb
z$PZMdKAp5so;xzIkivKG-aYzi=Il!E){jx(v;E>(n*lX6XsAXa_HB(O*wvoNkMvA9
zGRiZa#(2gBvcI3;Z-B~xd_2Y@X5IwP*e+}dzoy>O6?<8GhcV;E^R#8uFr#%qm3^T+
z#aAa?ss@M$o+FiOBzY&bP4Y_Wl;oMX&ES<-l;k}uYJ^uJ8N3pR0Z9zVN25JsZ!sXd
zsJC>bW{gno*-9or`U=W)AuuY{AZw+97nXmayG8X1Q^a&zAcp#d{xRM=Y4I@cBw|3$
zNbpX|80IychI<X83Lq1=8fqt~W^wrI^|g^vCWmk>=Z=(SR3AW~pbGxs!-u>EP)<6x
zD;vY8(p-2^7CUkWp>$f$UeIr|ED0D=&)^m9Gb$<8dt_w1_lULeK8ApJZ^Pn5FGFae
zcTzWlui<Sqc^<Qxe3h#UCAr(SZ8v4wg4)p7LRlmU)de}>#&gcuUApnSoH=|QWUa~@
zO7X3x!Rn+v%A|9RCe@Va9b3n+K;x47N=%)R@rG80S6x)zj2gx*%W_?0VW9p6?FP`E
z06g$Hj)RU>;}u$IwY3|K7&)p^BDR%s08;`c_gE;l@b|~PHPmPH1pc@CjMoM=FubWE
zc5<oLV|@6@Q>Jnq4|(3Gq{lv_u|Q2hHkyrIGvIwI9MO~Bv;1lphEby{0f;Ug&sp+M
z*cd5ivJUbYJ228`d?U4~4h7nBlnqM|`W!NBk^2Y`l~NYT<w#*hDvOo8=$mXMz3X6<
zO6+Fo>cUq#emutn9@;S3S;C)>J}u!s6Bf9*P!08@tme<ioK+TJL&t+~cwS=)yaOsv
z@7}$~TNlVlq_CB%>8Z8e8wN!;SQ0k)pLH*`e|PHFG--uKlG=xchW^o+z@a?=dqyH}
zA7GJL3n#(gA<=ft5rT2z<SCWYcpcp;O8%ui&M00E{v@)jdz(nP8tMwO29mj6=3tvT
zP#f=@q?MK-$ZhSJuw%>1%WdX5;yC<%R*t1Pt>zC67#vB&u0(;&qYLp>tsJ`vMh#xc
z0MYu3VngsSczjVZD@oFS>vTFdCXiYN=%haE9+Qk8^@-)Z;7I|WR+?!~o;)%2cd#7D
z1%e;YV*fEvv>IW*JV(Lv4+x|VO~N<G2E1CMw6v72UcF}K7=>3^>1kFDBvHY2W!4Ns
ztp+?AO^_$ALU-WB+O`cUZ`Y>#DElK`dYesl;2B2VHmXMffU@-B#*G`i-yk}NpzE8w
zOaUyC=9T@mz{9a0$K?upM(G}^st3l5_9ImVuvya{R{})o2Yb(lx`C!W%6)TE=F<K9
z4|uU7z(Mr@I=7({k_>p^rAyqJfTE1+zgzgdsdNpwkEp;zqYNm}09%o^m*cRy;vi47
zTd??RBx>BKN2a}<G@w%8<t|>#r?~iM?V*Oo#Bq<Yk~*Ogl$4a18UP`mQP$-Ea9LRy
zEm`{0vl_s`Luu0Fsk{nRq1L21o#)vjosBBa3qzvq+cW;xF)+toz_COTpGBrDlHHYH
z!Leys_z2H2z{1~fj3T=h1%og%(M1Fw10H27Y@wVBwU^vc#9C11=8GuMZb{7)bu2wl
z3d}9|=adRCOfI?oCo*c`a);|lR#VWM@XVRB+}R-m22V41;`cxNXx4!7H`5LjeN}AP
z&Q%>yE0huwRRaJ+X;nbV-Y71n+qZA?4ob?dzUXCRR#By33nmI=D$`5jcU7atz|ZVy
zd;GkCWmi~O$W5=kd-rjMk7_CTIH*r<vuEvkoGbUWvDy|{6hC$OEpPAxGG%v=BP~W?
z5rDE#uZ)rlRLCQ+4acV3bQb&%lGK)6i{fwugDN*V(?|ZU`bl#kqm%l<5os@gSgvx5
zWaR)A%0V40Lm2#!$S>9(#j}WE{Hj92IaI0l;}TnxZrB133NFkrYmH>*&YRDdv-}&q
zYiyU}qu-bQd!rw+hReUw#)DRj2N~_*!^m)Qg5beD4zV!>UgO`@GOg~0dRr9vAyE;9
zdyH3YVL)UX<I}~8{|=+rxGx)NwKx~ofXYlMX1~(*e~zs8>vn+D8~^|S07*qoM6N<$
Ef>Uh;{Qv*}

literal 0
HcmV?d00001

diff --git a/httpd.spec b/httpd.spec
index 233a247..7837c37 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.46
-Release: 10%{?dist}
+Release: 11%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -60,6 +60,7 @@ Source44: httpd@.service
 Source45: config.layout
 Source46: apachectl.sh
 Source47: apachectl.xml
+Source48: apache-poweredby.png
 
 # build/scripts patches
 Patch2: httpd-2.4.43-apxs.patch
@@ -100,7 +101,7 @@ BuildRequires: perl-interpreter, perl-generators, systemd-devel
 BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0
 BuildRequires: gnupg2
-Requires: /etc/mime.types, system-logos-httpd
+Requires: /etc/mime.types, system-logos-httpd >= 34.0.1
 Provides: webserver
 Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release}
 Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa}
@@ -270,6 +271,9 @@ if test "x${vmmn}" != "x%{mmn}"; then
    exit 1
 fi
 
+# A new logo which comes together with a new test page
+cp %{SOURCE48} ./docs/icons/apache_pb3.png
+
 # Provide default layout
 cp $RPM_SOURCE_DIR/config.layout .
 
@@ -485,6 +489,7 @@ rm -v $RPM_BUILD_ROOT%{docroot}/html/*.html \
 ln -s ../../pixmaps/poweredby.png \
         $RPM_BUILD_ROOT%{contentdir}/icons/poweredby.png
 
+
 # symlinks for /etc/httpd
 rmdir $RPM_BUILD_ROOT/etc/httpd/{state,run}
 ln -s ../..%{_localstatedir}/log/httpd $RPM_BUILD_ROOT/etc/httpd/logs
@@ -781,6 +786,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Mar 31 2021 Lubos Uhliarik <luhliari@redhat.com> - 2.4.46-11
+- Resolves: #1934739 - Apache trademark update - new logo
+
 * Tue Feb 23 2021 Joe Orton <jorton@redhat.com> - 2.4.46-10
 - add Conflicts: with mod_nss
 - drop use of apr_ldap_rebind (r1878890, #1847585)
diff --git a/welcome.conf b/welcome.conf
index b279c2f..a5e221b 100644
--- a/welcome.conf
+++ b/welcome.conf
@@ -16,4 +16,4 @@
 </Directory>
 
 Alias /.noindex.html /usr/share/httpd/noindex/index.html
-Alias /poweredby.png /usr/share/httpd/icons/apache_pb2.png
+Alias /poweredby.png /usr/share/httpd/icons/apache_pb3.png

From b4800b58926dd52e3e2a244a1c4dc8cba29b8e00 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 9 Apr 2021 09:40:47 +0100
Subject: [PATCH 231/359] use OOMPolicy=continue in httpd.service,
 httpd@.service (#1947475) Resolves: rhbz#1947475

---
 httpd.service     |  1 +
 httpd.service.xml | 31 +++++++++++++++++++++++++------
 httpd.spec        |  5 ++++-
 httpd@.service    |  1 +
 4 files changed, 31 insertions(+), 7 deletions(-)

diff --git a/httpd.service b/httpd.service
index 6ff4e8b..c5b5e08 100644
--- a/httpd.service
+++ b/httpd.service
@@ -27,6 +27,7 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful
 KillSignal=SIGWINCH
 KillMode=mixed
 PrivateTmp=true
+OOMPolicy=continue
 
 [Install]
 WantedBy=multi-user.target
diff --git a/httpd.service.xml b/httpd.service.xml
index 243ce1e..c6bf865 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -225,15 +225,34 @@ Wants=network-online.target</programlisting>
       types. See
       <citerefentry><refentrytitle>httpd_selinux</refentrytitle><manvolnum>8</manvolnum></citerefentry>
       for more information.</para>
+    </refsect2>
 
-      <para>The httpd service enables <emphasis>PrivateTmp</emphasis>
-      by default. The <filename>/tmp</filename> and
-      <filename>/var/tmp</filename> directories available within the
-      httpd process (and CGI scripts, etc) are not shared by other
-      processes. See
+    <refsect2>
+      <title>Process policies and restrictions</title>
+
+      <para>The httpd service uses the following options:
+
+      <itemizedlist>
+        <listitem><para><emphasis>PrivateTmp</emphasis> is enabled by
+        default. The <filename>/tmp</filename> and
+        <filename>/var/tmp</filename> directories available within the
+        httpd process (and CGI scripts, etc) are not shared by other
+        processes.</para></listitem>
+
+        <listitem><para><emphasis>OOMPolicy</emphasis> is set to
+        <emphasis>continue</emphasis> by default.  Under the default
+        Out-of-Memory policy, the entire service will be terminated if
+        any process is killed by the kernel OOM killer.  By setting
+        the policy to <emphasis>continue</emphasis>, httpd will
+        continue to run (and recover) if a single child is terminated
+        because of excess memory consumption.</para></listitem>
+      </itemizedlist>
+
+      See
       <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      and
+      <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
       for more information.</para>
-
     </refsect2>
 
     <refsect2>
diff --git a/httpd.spec b/httpd.spec
index 7837c37..df03cee 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.46
-Release: 11%{?dist}
+Release: 12%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -786,6 +786,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Apr  9 2021 Joe Orton <jorton@redhat.com> - 2.4.46-12
+- use OOMPolicy=continue in httpd.service, httpd@.service (#1947475)
+
 * Wed Mar 31 2021 Lubos Uhliarik <luhliari@redhat.com> - 2.4.46-11
 - Resolves: #1934739 - Apache trademark update - new logo
 
diff --git a/httpd@.service b/httpd@.service
index 7649dff..84424fb 100644
--- a/httpd@.service
+++ b/httpd@.service
@@ -20,6 +20,7 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful -f conf/%i.conf
 KillSignal=SIGWINCH
 KillMode=mixed
 PrivateTmp=true
+OOMPolicy=continue
 
 [Install]
 WantedBy=multi-user.target

From 8bb6632217f7d76ec777cbe805057d6d9c2b2fb1 Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Mon, 3 May 2021 12:36:09 +0200
Subject: [PATCH 232/359] Related: #1934739 - Apache trademark update - new
 logo

---
 httpd.spec | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index df03cee..06d743d 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.46
-Release: 12%{?dist}
+Release: 13%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -101,7 +101,7 @@ BuildRequires: perl-interpreter, perl-generators, systemd-devel
 BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0
 BuildRequires: gnupg2
-Requires: /etc/mime.types, system-logos-httpd >= 34.0.1
+Requires: /etc/mime.types, system-logos(httpd-logo-ng)
 Provides: webserver
 Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release}
 Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa}
@@ -460,7 +460,7 @@ EOF
 # Handle contentdir
 mkdir $RPM_BUILD_ROOT%{contentdir}/noindex \
       $RPM_BUILD_ROOT%{contentdir}/server-status
-ln -s ../../fedora-testpage/index.html \
+ln -s ../../testpage/index.html \
       $RPM_BUILD_ROOT%{contentdir}/noindex/index.html
 install -m 644 -p docs/server-status/* \
         $RPM_BUILD_ROOT%{contentdir}/server-status
@@ -786,6 +786,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon May 03 2021 Lubos Uhliarik <luhliari@redhat.com> - 2.4.46-13
+- Related: #1934739 - Apache trademark update - new logo
+
 * Fri Apr  9 2021 Joe Orton <jorton@redhat.com> - 2.4.46-12
 - use OOMPolicy=continue in httpd.service, httpd@.service (#1947475)
 

From cd47f2b89285e14cc949ed2634f150774e6a16dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 2 Jun 2021 13:49:32 +0200
Subject: [PATCH 233/359] new version 2.4.48 Resolves: #1964746 - httpd-2.4.48
 is available

---
 .gitignore                                    |   1 +
 httpd-2.4.43-r1870095+.patch                  | 115 -----------
 httpd-2.4.43-sslcoalesce.patch                | 192 ------------------
 httpd-2.4.46-lua-resume.patch                 | 119 -----------
 ...-export.patch => httpd-2.4.48-export.patch |   6 +-
 ...929+.patch => httpd-2.4.48-r1842929+.patch |  27 +--
 ...78890.patch => httpd-2.4.48-r1878890.patch |  32 +--
 httpd.spec                                    |  20 +-
 sources                                       |   6 +-
 9 files changed, 46 insertions(+), 472 deletions(-)
 delete mode 100644 httpd-2.4.43-r1870095+.patch
 delete mode 100644 httpd-2.4.43-sslcoalesce.patch
 delete mode 100644 httpd-2.4.46-lua-resume.patch
 rename httpd-2.4.43-export.patch => httpd-2.4.48-export.patch (93%)
 rename httpd-2.4.43-r1842929+.patch => httpd-2.4.48-r1842929+.patch (91%)
 rename httpd-2.4.46-r1878890.patch => httpd-2.4.48-r1878890.patch (80%)

diff --git a/.gitignore b/.gitignore
index 09a5a07..ea4148c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,3 +38,4 @@ x86_64
 /httpd-2.4.43.tar.bz2.asc
 /KEYS
 /httpd-2.4.46.tar.bz2.asc
+/httpd-2.4.48.tar.bz2.asc
diff --git a/httpd-2.4.43-r1870095+.patch b/httpd-2.4.43-r1870095+.patch
deleted file mode 100644
index 3fc8dfb..0000000
--- a/httpd-2.4.43-r1870095+.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
-index cbab6a3..765aa4b 100644
---- a/modules/ssl/ssl_engine_kernel.c
-+++ b/modules/ssl/ssl_engine_kernel.c
-@@ -114,6 +114,45 @@ static int has_buffered_data(request_rec *r)
-     return result;
- }
- 
-+/* If a renegotiation is required for the location, and the request
-+ * includes a message body (and the client has not requested a "100
-+ * Continue" response), then the client will be streaming the request
-+ * body over the wire already.  In that case, it is not possible to
-+ * stop and perform a new SSL handshake immediately; once the SSL
-+ * library moves to the "accept" state, it will reject the SSL packets
-+ * which the client is sending for the request body.
-+ *
-+ * To allow authentication to complete in the hook, the solution used
-+ * here is to fill a (bounded) buffer with the request body, and then
-+ * to reinject that request body later.
-+ *
-+ * This function is called to fill the renegotiation buffer for the
-+ * location as required, or fail.  Returns zero on success or HTTP_
-+ * error code on failure.
-+ */
-+static int fill_reneg_buffer(request_rec *r, SSLDirConfigRec *dc)
-+{
-+    int rv;
-+    apr_size_t rsize;
-+
-+    /* ### this is HTTP/1.1 specific, special case for protocol? */
-+    if (r->expecting_100 || !ap_request_has_body(r)) {
-+        return 0;
-+    }
-+
-+    rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE : dc->nRenegBufferSize;
-+    if (rsize > 0) {
-+        /* Fill the I/O buffer with the request body if possible. */
-+        rv = ssl_io_buffer_fill(r, rsize);
-+    }
-+    else {
-+        /* If the reneg buffer size is set to zero, just fail. */
-+        rv = HTTP_REQUEST_ENTITY_TOO_LARGE;
-+    }
-+
-+    return rv;
-+}
-+
- #ifdef HAVE_TLSEXT
- static int ap_array_same_str_set(apr_array_header_t *s1, apr_array_header_t *s2)
- {
-@@ -814,41 +853,14 @@ static int ssl_hook_Access_classic(request_rec *r, SSLSrvConfigRec *sc, SSLDirCo
-         }
-     }
- 
--    /* If a renegotiation is now required for this location, and the
--     * request includes a message body (and the client has not
--     * requested a "100 Continue" response), then the client will be
--     * streaming the request body over the wire already.  In that
--     * case, it is not possible to stop and perform a new SSL
--     * handshake immediately; once the SSL library moves to the
--     * "accept" state, it will reject the SSL packets which the client
--     * is sending for the request body.
--     *
--     * To allow authentication to complete in this auth hook, the
--     * solution used here is to fill a (bounded) buffer with the
--     * request body, and then to reinject that request body later.
--     */
--    if (renegotiate && !renegotiate_quick
--        && !r->expecting_100
--        && ap_request_has_body(r)) {
--        int rv;
--        apr_size_t rsize;
--
--        rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE :
--                                                dc->nRenegBufferSize;
--        if (rsize > 0) {
--            /* Fill the I/O buffer with the request body if possible. */
--            rv = ssl_io_buffer_fill(r, rsize);
--        }
--        else {
--            /* If the reneg buffer size is set to zero, just fail. */
--            rv = HTTP_REQUEST_ENTITY_TOO_LARGE;
--        }
--
--        if (rv) {
-+    /* Fill reneg buffer if required. */
-+    if (renegotiate && !renegotiate_quick) {
-+        rc = fill_reneg_buffer(r, dc);
-+        if (rc) {
-             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02257)
-                           "could not buffer message body to allow "
-                           "SSL renegotiation to proceed");
--            return rv;
-+            return rc;
-         }
-     }
- 
-@@ -1132,6 +1144,17 @@ static int ssl_hook_Access_modern(request_rec *r, SSLSrvConfigRec *sc, SSLDirCon
-             }
-         }
- 
-+        /* Fill reneg buffer if required. */
-+        if (change_vmode) {
-+            rc = fill_reneg_buffer(r, dc);
-+            if (rc) {
-+                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10228)
-+                              "could not buffer message body to allow "
-+                              "TLS Post-Handshake Authentication to proceed");
-+                return rc;
-+            }
-+        }
-+
-         if (change_vmode) {
-             char peekbuf[1];
- 
diff --git a/httpd-2.4.43-sslcoalesce.patch b/httpd-2.4.43-sslcoalesce.patch
deleted file mode 100644
index ef1f728..0000000
--- a/httpd-2.4.43-sslcoalesce.patch
+++ /dev/null
@@ -1,192 +0,0 @@
-
-http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_io.c?r1=1836237&r2=1836236&pathrev=1836237&view=patch
-http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_io.c?r1=1873985&r2=1876037&view=patch
-
---- httpd-2.4.43/modules/ssl/ssl_engine_io.c.sslcoalesce
-+++ httpd-2.4.43/modules/ssl/ssl_engine_io.c
-@@ -1585,18 +1585,32 @@
- }
- 
- 
--/* ssl_io_filter_output() produces one SSL/TLS message per bucket
-+/* ssl_io_filter_output() produces one SSL/TLS record per bucket
-  * passed down the output filter stack.  This results in a high
-- * overhead (network packets) for any output comprising many small
-- * buckets.  SSI page applied through the HTTP chunk filter, for
-- * example, may produce many brigades containing small buckets -
-- * [chunk-size CRLF] [chunk-data] [CRLF].
-+ * overhead (more network packets & TLS processing) for any output
-+ * comprising many small buckets.  SSI output passed through the HTTP
-+ * chunk filter, for example, may produce many brigades containing
-+ * small buckets - [chunk-size CRLF] [chunk-data] [CRLF].
-  *
-- * The coalescing filter merges many small buckets into larger buckets
-- * where possible, allowing the SSL I/O output filter to handle them
-- * more efficiently. */
-+ * Sending HTTP response headers as a separate TLS record to the
-+ * response body also reveals information to a network observer (the
-+ * size of headers) which can be significant.
-+ *
-+ * The coalescing filter merges data buckets with the aim of producing
-+ * fewer, larger TLS records - without copying/buffering all content
-+ * and introducing unnecessary overhead.
-+ *
-+ * ### This buffering could be probably be done more comprehensively
-+ * ### in ssl_io_filter_output itself. 
-+ * 
-+ * ### Another possible performance optimisation in particular for the
-+ * ### [HEAP] [FILE] HTTP response case is using a brigade rather than
-+ * ### a char array to buffer; using apr_brigade_write() to append
-+ * ### will use already-allocated memory from the HEAP, reducing # of
-+ * ### copies.
-+ */
- 
--#define COALESCE_BYTES (2048)
-+#define COALESCE_BYTES (AP_IOBUFSIZE)
- 
- struct coalesce_ctx {
-     char buffer[COALESCE_BYTES];
-@@ -1609,11 +1623,12 @@
-     apr_bucket *e, *upto;
-     apr_size_t bytes = 0;
-     struct coalesce_ctx *ctx = f->ctx;
-+    apr_size_t buffered = ctx ? ctx->bytes : 0; /* space used on entry */
-     unsigned count = 0;
- 
-     /* The brigade consists of zero-or-more small data buckets which
--     * can be coalesced (the prefix), followed by the remainder of the
--     * brigade.
-+     * can be coalesced (referred to as the "prefix"), followed by the
-+     * remainder of the brigade.
-      *
-      * Find the last bucket - if any - of that prefix.  count gives
-      * the number of buckets in the prefix.  The "prefix" must contain
-@@ -1628,24 +1643,97 @@
-          e != APR_BRIGADE_SENTINEL(bb)
-              && !APR_BUCKET_IS_METADATA(e)
-              && e->length != (apr_size_t)-1
--             && e->length < COALESCE_BYTES
--             && (bytes + e->length) < COALESCE_BYTES
--             && (ctx == NULL
--                 || bytes + ctx->bytes + e->length < COALESCE_BYTES);
-+             && e->length <= COALESCE_BYTES
-+             && (buffered + bytes + e->length) <= COALESCE_BYTES;
-          e = APR_BUCKET_NEXT(e)) {
--        if (e->length) count++; /* don't count zero-length buckets */
--        bytes += e->length;
-+        /* don't count zero-length buckets */
-+        if (e->length) {
-+            bytes += e->length;
-+            count++;
-+        }
-     }
-+
-+    /* If there is room remaining and the next bucket is a data
-+     * bucket, try to include it in the prefix to coalesce.  For a
-+     * typical [HEAP] [FILE] HTTP response brigade, this handles
-+     * merging the headers and the start of the body into a single TLS
-+     * record. */
-+    if (bytes + buffered > 0
-+        && bytes + buffered < COALESCE_BYTES
-+        && e != APR_BRIGADE_SENTINEL(bb)
-+        && !APR_BUCKET_IS_METADATA(e)) {
-+        apr_status_t rv = APR_SUCCESS;
-+
-+        /* For an indeterminate length bucket (PIPE/CGI/...), try a
-+         * non-blocking read to have it morph into a HEAP.  If the
-+         * read fails with EAGAIN, it is harmless to try a split
-+         * anyway, split is ENOTIMPL for most PIPE-like buckets. */
-+        if (e->length == (apr_size_t)-1) {
-+            const char *discard;
-+            apr_size_t ignore;
-+
-+            rv = apr_bucket_read(e, &discard, &ignore, APR_NONBLOCK_READ);
-+            if (rv != APR_SUCCESS && !APR_STATUS_IS_EAGAIN(rv)) {
-+                ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, f->c, APLOGNO(10232)
-+                              "coalesce failed to read from %s bucket",
-+                              e->type->name);
-+                return AP_FILTER_ERROR;
-+            }
-+        }
-+
-+        if (rv == APR_SUCCESS) {
-+            /* If the read above made the bucket morph, it may now fit
-+             * entirely within the buffer.  Otherwise, split it so it does
-+             * fit. */
-+            if (e->length > COALESCE_BYTES
-+                || e->length + buffered + bytes > COALESCE_BYTES) {
-+                rv = apr_bucket_split(e, COALESCE_BYTES - (buffered + bytes));
-+            }
-+
-+            if (rv == APR_SUCCESS && e->length == 0) {
-+                /* As above, don't count in the prefix if the bucket is
-+                 * now zero-length. */
-+            }
-+            else if (rv == APR_SUCCESS) {
-+                ap_log_cerror(APLOG_MARK, APLOG_TRACE4, 0, f->c,
-+                              "coalesce: adding %" APR_SIZE_T_FMT " bytes "
-+                              "from split %s bucket, total %" APR_SIZE_T_FMT,
-+                              e->length, e->type->name, bytes + buffered);
-+
-+                count++;
-+                bytes += e->length;
-+                e = APR_BUCKET_NEXT(e);
-+            }
-+            else if (rv != APR_ENOTIMPL) {
-+                ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, f->c, APLOGNO(10233)
-+                              "coalesce: failed to split data bucket");
-+                return AP_FILTER_ERROR;
-+            }
-+        }
-+    }
-+
-     upto = e;
- 
--    /* Coalesce the prefix, if:
--     * a) more than one bucket is found to coalesce, or
--     * b) the brigade contains only a single data bucket, or
--     * c) the data bucket is not last but we have buffered data already.
-+    /* Coalesce the prefix, if any of the following are true:
-+     * 
-+     * a) the prefix is more than one bucket
-+     * OR
-+     * b) the prefix is the entire brigade, which is a single bucket
-+     *    AND the prefix length is smaller than the buffer size,
-+     * OR
-+     * c) the prefix is a single bucket
-+     *    AND there is buffered data from a previous pass.
-+     * 
-+     * The aim with (b) is to buffer a small bucket so it can be
-+     * coalesced with future invocations of this filter.  e.g.  three
-+     * calls each with a single 100 byte HEAP bucket should get
-+     * coalesced together.  But an invocation with a 8192 byte HEAP
-+     * should pass through untouched.
-      */
-     if (bytes > 0
-         && (count > 1
--            || (upto == APR_BRIGADE_SENTINEL(bb))
-+            || (upto == APR_BRIGADE_SENTINEL(bb)
-+                && bytes < COALESCE_BYTES)
-             || (ctx && ctx->bytes > 0))) {
-         /* If coalescing some bytes, ensure a context has been
-          * created. */
-@@ -1656,7 +1744,8 @@
- 
-         ap_log_cerror(APLOG_MARK, APLOG_TRACE4, 0, f->c,
-                       "coalesce: have %" APR_SIZE_T_FMT " bytes, "
--                      "adding %" APR_SIZE_T_FMT " more", ctx->bytes, bytes);
-+                      "adding %" APR_SIZE_T_FMT " more (buckets=%u)",
-+                      ctx->bytes, bytes, count);
- 
-         /* Iterate through the prefix segment.  For non-fatal errors
-          * in this loop it is safe to break out and fall back to the
-@@ -1671,7 +1760,8 @@
-             if (APR_BUCKET_IS_METADATA(e)
-                 || e->length == (apr_size_t)-1) {
-                 ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, f->c, APLOGNO(02012)
--                              "unexpected bucket type during coalesce");
-+                              "unexpected %s bucket during coalesce",
-+                              e->type->name);
-                 break; /* non-fatal error; break out */
-             }
- 
diff --git a/httpd-2.4.46-lua-resume.patch b/httpd-2.4.46-lua-resume.patch
deleted file mode 100644
index 1a22008..0000000
--- a/httpd-2.4.46-lua-resume.patch
+++ /dev/null
@@ -1,119 +0,0 @@
-diff --git a/modules/lua/config.m4 b/modules/lua/config.m4
-index 29fd563..abeba1c 100644
---- a/modules/lua/config.m4
-+++ b/modules/lua/config.m4
-@@ -34,7 +34,7 @@ AC_DEFUN([CHECK_LUA_PATH], [dnl
-     fi
- ])
- 
--dnl Check for Lua 5.3/5.2/5.1 Libraries
-+dnl Check for Lua Libraries
- dnl CHECK_LUA(ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND])
- dnl Sets:
- dnl  LUA_CFLAGS
-@@ -44,7 +44,7 @@ AC_DEFUN([CHECK_LUA],
- 
- AC_ARG_WITH(
-     lua,
--    [AC_HELP_STRING([--with-lua=PATH],[Path to the Lua 5.3/5.2/5.1 prefix])],
-+    [AC_HELP_STRING([--with-lua=PATH],[Path to the Lua installation prefix])],
-     lua_path="$withval",
-     :)
- 
-diff --git a/modules/lua/mod_lua.c b/modules/lua/mod_lua.c
-index 05f1e44..18b628c 100644
---- a/modules/lua/mod_lua.c
-+++ b/modules/lua/mod_lua.c
-@@ -342,7 +342,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil
- {
-     apr_pool_t *pool;
-     ap_lua_vm_spec *spec;
--    int n, rc;
-+    int n, rc, nres;
-     lua_State *L;
-     lua_filter_ctx *ctx;    
-     ap_lua_server_cfg *server_cfg = ap_get_module_config(r->server->module_config,
-@@ -410,7 +410,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil
-             /* If a Lua filter is interested in filtering a request, it must first do a yield, 
-              * otherwise we'll assume that it's not interested and pretend we didn't find it.
-              */
--            rc = lua_resume(L, 1);
-+            rc = lua_resume(L, 1, &nres);
-             if (rc == LUA_YIELD) {
-                 if (f->frec->providers == NULL) { 
-                     /* Not wired by mod_filter */
-@@ -432,7 +432,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil
- static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade *pbbIn)
- {
-     request_rec *r = f->r;
--    int rc;
-+    int rc, nres;
-     lua_State *L;
-     lua_filter_ctx* ctx;
-     conn_rec *c = r->connection;
-@@ -492,7 +492,7 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade
-             lua_setglobal(L, "bucket");
-             
-             /* If Lua yielded, it means we have something to pass on */
--            if (lua_resume(L, 0) == LUA_YIELD) {
-+            if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) {
-                 size_t olen;
-                 const char* output = lua_tolstring(L, 1, &olen);
-                 if (olen > 0) { 
-@@ -524,7 +524,7 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade
-             apr_bucket *pbktEOS;
-             lua_pushnil(L);
-             lua_setglobal(L, "bucket");
--            if (lua_resume(L, 0) == LUA_YIELD) {
-+            if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) {
-                 apr_bucket *pbktOut;
-                 size_t olen;
-                 const char* output = lua_tolstring(L, 1, &olen);
-@@ -558,7 +558,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f,
-                                        apr_off_t nBytes) 
- {
-     request_rec *r = f->r;
--    int rc, lastCall = 0;
-+    int rc, lastCall = 0, nres;
-     lua_State *L;
-     lua_filter_ctx* ctx;
-     conn_rec *c = r->connection;
-@@ -621,7 +621,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f,
-             lua_setglobal(L, "bucket");
-             
-             /* If Lua yielded, it means we have something to pass on */
--            if (lua_resume(L, 0) == LUA_YIELD) {
-+            if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) {
-                 size_t olen;
-                 const char* output = lua_tolstring(L, 1, &olen);
-                 pbktOut = apr_bucket_heap_create(output, olen, 0, c->bucket_alloc);
-@@ -643,7 +643,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f,
-             apr_bucket *pbktEOS = apr_bucket_eos_create(c->bucket_alloc);
-             lua_pushnil(L);
-             lua_setglobal(L, "bucket");
--            if (lua_resume(L, 0) == LUA_YIELD) {
-+            if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) {
-                 apr_bucket *pbktOut;
-                 size_t olen;
-                 const char* output = lua_tolstring(L, 1, &olen);
-diff --git a/modules/lua/mod_lua.h b/modules/lua/mod_lua.h
-index 0e49cdc..72b4de7 100644
---- a/modules/lua/mod_lua.h
-+++ b/modules/lua/mod_lua.h
-@@ -48,7 +48,15 @@
- #if LUA_VERSION_NUM > 501
- /* Load mode for lua_load() */
- #define lua_load(a,b,c,d)  lua_load(a,b,c,d,NULL)
--#define lua_resume(a,b)    lua_resume(a, NULL, b)
-+
-+#if LUA_VERSION_NUM > 503
-+#define lua_resume(a,b,c)    lua_resume(a, NULL, b, c)
-+#else
-+/* ### For version < 5.4, assume that exactly one stack item is on the
-+ * stack, which is what the code did before but seems dubious. */
-+#define lua_resume(a,b,c)    (*(c) = 1, lua_resume(a, NULL, b))
-+#endif
-+
- #define luaL_setfuncs_compat(a,b) luaL_setfuncs(a,b,0)
- #else
- #define lua_rawlen(L,i)    lua_objlen(L, (i))
diff --git a/httpd-2.4.43-export.patch b/httpd-2.4.48-export.patch
similarity index 93%
rename from httpd-2.4.43-export.patch
rename to httpd-2.4.48-export.patch
index 0d9fd72..439f768 100644
--- a/httpd-2.4.43-export.patch
+++ b/httpd-2.4.48-export.patch
@@ -6,7 +6,7 @@ to do so indirectly.
 Upstream: https://svn.apache.org/r1861685 (as new default-off configure option)
 
 diff --git a/Makefile.in b/Makefile.in
-index 9eeb5c7..8746a10 100644
+index 40c7076..ac98e5f 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test
@@ -27,7 +27,7 @@ index 9eeb5c7..8746a10 100644
    server/libmain.la \
    $(BUILTIN_LIBS) \
 diff --git a/server/Makefile.in b/server/Makefile.in
-index 1fa3344..116850b 100644
+index 8111877..f00bb3f 100644
 --- a/server/Makefile.in
 +++ b/server/Makefile.in
 @@ -12,7 +12,7 @@ LTLIBRARY_SOURCES = \
@@ -36,7 +36,7 @@ index 1fa3344..116850b 100644
  	util_charset.c util_cookies.c util_debug.c util_xml.c \
 -	util_filter.c util_pcre.c util_regex.c exports.c \
 +	util_filter.c util_pcre.c util_regex.c \
- 	scoreboard.c error_bucket.c protocol.c core.c request.c provider.c \
+ 	scoreboard.c error_bucket.c protocol.c core.c request.c ssl.c provider.c \
  	eoc_bucket.c eor_bucket.c core_filters.c \
  	util_expr_parse.c util_expr_scan.c util_expr_eval.c
 diff --git a/server/main.c b/server/main.c
diff --git a/httpd-2.4.43-r1842929+.patch b/httpd-2.4.48-r1842929+.patch
similarity index 91%
rename from httpd-2.4.43-r1842929+.patch
rename to httpd-2.4.48-r1842929+.patch
index b926195..f83a21d 100644
--- a/httpd-2.4.43-r1842929+.patch
+++ b/httpd-2.4.48-r1842929+.patch
@@ -1,8 +1,8 @@
 diff --git a/Makefile.in b/Makefile.in
-index 06b8c5a..9eeb5c7 100644
+index 6747aea..40c7076 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -213,6 +213,7 @@ install-cgi:
+@@ -233,6 +233,7 @@ install-cgi:
  install-other:
  	@test -d $(DESTDIR)$(logfiledir) || $(MKINSTALLDIRS) $(DESTDIR)$(logfiledir)
  	@test -d $(DESTDIR)$(runtimedir) || $(MKINSTALLDIRS) $(DESTDIR)$(runtimedir)
@@ -11,7 +11,7 @@ index 06b8c5a..9eeb5c7 100644
  		file=apachecore.$$ext; \
  		if test -f $$file; then \
 diff --git a/acinclude.m4 b/acinclude.m4
-index 95232f5..5d9d669 100644
+index b6ef442..98f1441 100644
 --- a/acinclude.m4
 +++ b/acinclude.m4
 @@ -45,6 +45,7 @@ AC_DEFUN([APACHE_GEN_CONFIG_VARS],[
@@ -22,7 +22,7 @@ index 95232f5..5d9d669 100644
    APACHE_SUBST(other_targets)
    APACHE_SUBST(progname)
    APACHE_SUBST(prefix)
-@@ -688,6 +689,7 @@ AC_DEFUN([APACHE_EXPORT_ARGUMENTS],[
+@@ -665,6 +666,7 @@ AC_DEFUN([APACHE_EXPORT_ARGUMENTS],[
    APACHE_SUBST_EXPANDED_ARG(runtimedir)
    APACHE_SUBST_EXPANDED_ARG(logfiledir)
    APACHE_SUBST_EXPANDED_ARG(proxycachedir)
@@ -31,7 +31,7 @@ index 95232f5..5d9d669 100644
  
  dnl 
 diff --git a/configure.in b/configure.in
-index a63eada..c8f9aa2 100644
+index 37346b2..f303784 100644
 --- a/configure.in
 +++ b/configure.in
 @@ -41,7 +41,7 @@ dnl Something seems broken here.
@@ -56,7 +56,7 @@ index 2b4a70c..e076f41 100644
  
  #endif /* AP_CONFIG_LAYOUT_H */
 diff --git a/include/http_config.h b/include/http_config.h
-index f9c2d77..c229bc9 100644
+index 77657ae..384a90f 100644
 --- a/include/http_config.h
 +++ b/include/http_config.h
 @@ -757,6 +757,14 @@ AP_DECLARE(char *) ap_server_root_relative(apr_pool_t *p, const char *fname);
@@ -124,10 +124,10 @@ index addfd7e..2389f8f 100644
                               APR_HOOK_MIDDLE);
      dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE);
 diff --git a/server/core.c b/server/core.c
-index 3db9d61..79b2a82 100644
+index d135764..c2176b9 100644
 --- a/server/core.c
 +++ b/server/core.c
-@@ -129,6 +129,8 @@ AP_DECLARE_DATA int ap_main_state = AP_SQ_MS_INITIAL_STARTUP;
+@@ -142,6 +142,8 @@ AP_DECLARE_DATA int ap_main_state = AP_SQ_MS_INITIAL_STARTUP;
  AP_DECLARE_DATA int ap_run_mode = AP_SQ_RM_UNKNOWN;
  AP_DECLARE_DATA int ap_config_generation = 0;
  
@@ -136,7 +136,7 @@ index 3db9d61..79b2a82 100644
  static void *create_core_dir_config(apr_pool_t *a, char *dir)
  {
      core_dir_config *conf;
-@@ -1409,12 +1411,15 @@ AP_DECLARE(const char *) ap_resolve_env(apr_pool_t *p, const char * word)
+@@ -1444,13 +1446,16 @@ AP_DECLARE(const char *) ap_resolve_env(apr_pool_t *p, const char * word)
      return res_buf;
  }
  
@@ -147,6 +147,7 @@ index 3db9d61..79b2a82 100644
      ap_server_config_defines = saved_server_config_defines;
      saved_server_config_defines = NULL;
      server_config_defined_vars = NULL;
+     ap_runtime_dir = NULL;
 -    return OK;
 +    core_state_dir = NULL;
 +
@@ -154,7 +155,7 @@ index 3db9d61..79b2a82 100644
  }
  
  /*
-@@ -3120,6 +3125,24 @@ static const char *set_runtime_dir(cmd_parms *cmd, void *dummy, const char *arg)
+@@ -3220,6 +3225,24 @@ static const char *set_runtime_dir(cmd_parms *cmd, void *dummy, const char *arg)
      return NULL;
  }
  
@@ -179,7 +180,7 @@ index 3db9d61..79b2a82 100644
  static const char *set_timeout(cmd_parms *cmd, void *dummy, const char *arg)
  {
      const char *err = ap_check_cmd_context(cmd, NOT_IN_DIR_CONTEXT);
-@@ -4414,6 +4437,8 @@ AP_INIT_TAKE1("ServerRoot", set_server_root, NULL, RSRC_CONF | EXEC_ON_READ,
+@@ -4521,6 +4544,8 @@ AP_INIT_TAKE1("ServerRoot", set_server_root, NULL, RSRC_CONF | EXEC_ON_READ,
    "Common directory of server-related files (logs, confs, etc.)"),
  AP_INIT_TAKE1("DefaultRuntimeDir", set_runtime_dir, NULL, RSRC_CONF | EXEC_ON_READ,
    "Common directory for run-time files (shared memory, locks, etc.)"),
@@ -188,7 +189,7 @@ index 3db9d61..79b2a82 100644
  AP_INIT_TAKE1("ErrorLog", set_server_string_slot,
    (void *)APR_OFFSETOF(server_rec, error_fname), RSRC_CONF,
    "The filename of the error log"),
-@@ -4941,8 +4966,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem
+@@ -5055,8 +5080,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem
  
      if (!saved_server_config_defines)
          init_config_defines(pconf);
@@ -198,7 +199,7 @@ index 3db9d61..79b2a82 100644
  
      ap_regcomp_set_default_cflags(AP_REG_DEFAULT);
  
-@@ -5170,6 +5194,27 @@ AP_DECLARE(int) ap_state_query(int query)
+@@ -5303,6 +5327,27 @@ AP_DECLARE(int) ap_state_query(int query)
      }
  }
  
diff --git a/httpd-2.4.46-r1878890.patch b/httpd-2.4.48-r1878890.patch
similarity index 80%
rename from httpd-2.4.46-r1878890.patch
rename to httpd-2.4.48-r1878890.patch
index b75d53e..7f8ca57 100644
--- a/httpd-2.4.46-r1878890.patch
+++ b/httpd-2.4.48-r1878890.patch
@@ -1,9 +1,7 @@
-# ./pullrev.sh 1878890
-
-http://svn.apache.org/viewvc?view=revision&revision=1878890
-
---- httpd-2.4.46/include/util_ldap.h.r1878890
-+++ httpd-2.4.46/include/util_ldap.h
+diff --git a/include/util_ldap.h b/include/util_ldap.h
+index 28e0760..edb8a81 100644
+--- a/include/util_ldap.h
++++ b/include/util_ldap.h
 @@ -32,7 +32,6 @@
  #if APR_MAJOR_VERSION < 2
  /* The LDAP API is currently only present in APR 1.x */
@@ -12,9 +10,11 @@ http://svn.apache.org/viewvc?view=revision&revision=1878890
  #else
  #define APR_HAS_LDAP 0
  #endif
---- httpd-2.4.46/modules/ldap/util_ldap.c.r1878890
-+++ httpd-2.4.46/modules/ldap/util_ldap.c
-@@ -140,6 +140,38 @@
+diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c
+index 120f268..a5f7995 100644
+--- a/modules/ldap/util_ldap.c
++++ b/modules/ldap/util_ldap.c
+@@ -140,6 +140,38 @@ static int util_ldap_handler(request_rec *r)
      return OK;
  }
  
@@ -53,7 +53,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1878890
  
  
  /* ------------------------------------------------------------------ */
-@@ -181,6 +213,13 @@
+@@ -181,6 +213,13 @@ static apr_status_t uldap_connection_unbind(void *param)
      util_ldap_connection_t *ldc = param;
  
      if (ldc) {
@@ -67,7 +67,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1878890
          if (ldc->ldap) {
              if (ldc->r) { 
                  ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, ldc->r, "LDC %pp unbind", ldc); 
-@@ -189,12 +228,6 @@
+@@ -189,12 +228,6 @@ static apr_status_t uldap_connection_unbind(void *param)
              ldc->ldap = NULL;
          }
          ldc->bound = 0;
@@ -80,7 +80,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1878890
      }
  
      return APR_SUCCESS;
-@@ -330,7 +363,7 @@
+@@ -330,7 +363,7 @@ static int uldap_connection_init(request_rec *r,
  
      if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
          /* Now that we have an ldap struct, add it to the referral list for rebinds. */
@@ -89,7 +89,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1878890
          if (rc != APR_SUCCESS) {
              ap_log_error(APLOG_MARK, APLOG_ERR, rc, r->server, APLOGNO(01277)
                      "LDAP: Unable to add rebind cross reference entry. Out of memory?");
-@@ -855,6 +888,7 @@
+@@ -856,6 +889,7 @@ static util_ldap_connection_t *
          /* whether or not to keep this connection in the pool when it's returned */
          l->keep = (st->connection_pool_ttl == 0) ? 0 : 1;
  
@@ -97,15 +97,15 @@ http://svn.apache.org/viewvc?view=revision&revision=1878890
          if (l->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
              if (apr_pool_create(&(l->rebind_pool), l->pool) != APR_SUCCESS) {
                  ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r, APLOGNO(01286)
-@@ -865,6 +899,7 @@
-                 return NULL;
+@@ -867,6 +901,7 @@ static util_ldap_connection_t *
              }
+             apr_pool_tag(l->rebind_pool, "util_ldap_rebind");
          }
 +#endif
  
          if (p) {
              p->next = l;
-@@ -3051,7 +3086,7 @@
+@@ -3054,7 +3089,7 @@ static int util_ldap_post_config(apr_pool_t *p, apr_pool_t *plog,
      }
  
      /* Initialize the rebind callback's cross reference list. */
diff --git a/httpd.spec b/httpd.spec
index 06d743d..17d0745 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.46
-Release: 13%{?dist}
+Version: 2.4.48
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -68,9 +68,9 @@ Patch3: httpd-2.4.43-deplibs.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.43-detect-systemd.patch
 # Features/functional changes
-Patch21: httpd-2.4.43-r1842929+.patch
+Patch21: httpd-2.4.48-r1842929+.patch
 Patch22: httpd-2.4.43-mod_systemd.patch
-Patch23: httpd-2.4.43-export.patch
+Patch23: httpd-2.4.48-export.patch
 Patch24: httpd-2.4.43-corelimit.patch
 Patch25: httpd-2.4.43-selinux.patch
 Patch26: httpd-2.4.43-gettid.patch
@@ -82,15 +82,12 @@ Patch39: httpd-2.4.43-sslprotdefault.patch
 Patch40: httpd-2.4.43-r1861269.patch
 Patch41: httpd-2.4.43-r1861793+.patch
 Patch42: httpd-2.4.43-r1828172+.patch
-Patch43: httpd-2.4.43-sslcoalesce.patch
-Patch44: httpd-2.4.46-lua-resume.patch
 Patch45: httpd-2.4.43-logjournal.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
-Patch61: httpd-2.4.46-r1878890.patch
-Patch62: httpd-2.4.43-r1870095+.patch
+Patch61: httpd-2.4.48-r1878890.patch
 Patch63: httpd-2.4.46-htcacheclean-dont-break.patch
 
 # Security fixes
@@ -237,13 +234,10 @@ written in the Lua programming language.
 %patch40 -p1 -b .r1861269
 %patch41 -p1 -b .r1861793+
 %patch42 -p1 -b .r1828172+
-%patch43 -p1 -b .sslcoalesce
-%patch44 -p1 -b .luaresume
 %patch45 -p1 -b .logjournal
 
 %patch60 -p1 -b .enable-sslv3
 %patch61 -p1 -b .r1878890
-%patch62 -p1 -b .r1870095
 %patch63 -p1 -b .htcacheclean-dont-break
 
 # Patch in the vendor string
@@ -786,6 +780,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Jun 02 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.48-1
+- new version 2.4.48
+- Resolves: #1964746 - httpd-2.4.48 is available
+
 * Mon May 03 2021 Lubos Uhliarik <luhliari@redhat.com> - 2.4.46-13
 - Related: #1934739 - Apache trademark update - new logo
 
diff --git a/sources b/sources
index a7871fb..5e6cb0c 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.46.tar.bz2) = 5936784bb662e9d8a4f7fe38b70c043b468114d931cd10ea831bfe74461ea5856b64f88f42c567ab791fc8907640a99884ba4b6a600f86d661781812735b6f13
-SHA512 (httpd-2.4.46.tar.bz2.asc) = 1f54c20d1aeedb7c745eb72acd79e1ed61d547b22c3dbe53cd3274ed3d897543cd8c49181d4b15d79c12755746cf0a2464d620f69e254ac3f998760133094df0
-SHA512 (KEYS) = b776ca20863f8d9e4f66e8b56cbe020de34af5b268e93776d482392171f0e0aeee4f8d74477d128dc9fd24b30bbe33b39439964f1bd22a99782f1e4a08c85056
+SHA512 (httpd-2.4.48.tar.bz2) = 6c250626f1e7d10428a92d984fd48ff841effcc8705f7816ab71b681bbd51d0012ad158dcd13763fe7d630311f2de258b27574603140d648be42796ab8326724
+SHA512 (httpd-2.4.48.tar.bz2.asc) = 9f125de75107b04dd01f71e9e233b1602658b49e38371931b98dc1092be8df05cf7243b5564fa2f56f46544bef61a54a721dee5ca17ce823a2302a7c3698a195
+SHA512 (KEYS) = 7ab66c64eaa4a152e88a913993c8ea0d9c46fd5865788e7b32a9619784d245cef8bddd9700368e3d63ce88ed94df8933e5892878523dc0fce697331136bb829e

From f518496d8ff918bf8423efb92452650d4d400374 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 15 Apr 2021 10:30:33 +0100
Subject: [PATCH 234/359] Note that changing Listen may break if httpd.service
 is enabled at boot time.

---
 httpd.conf | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/httpd.conf b/httpd.conf
index 6ab68cb..609b2e2 100644
--- a/httpd.conf
+++ b/httpd.conf
@@ -38,8 +38,10 @@ ServerRoot "/etc/httpd"
 # ports, instead of the default. See also the <VirtualHost>
 # directive.
 #
-# Change this to Listen on specific IP addresses as shown below to 
-# prevent Apache from glomming onto all bound IP addresses.
+# Change this to Listen on a specific IP address, but note that if
+# httpd.service is enabled to run at boot time, the address may not be
+# available when the service starts.  See the httpd.service(8) man
+# page for more information.
 #
 #Listen 12.34.56.78:80
 Listen 80

From e7a3b438f271241697f035185b686bb592f42cb3 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 16 Jul 2021 17:02:03 +0100
Subject: [PATCH 235/359] mod_cgi/mod_cgid: update to unification from trunk

---
 ...172+.patch => httpd-2.4.48-r1828172+.patch | 1146 +++++++++++++++--
 httpd.spec                                    |    8 +-
 2 files changed, 1058 insertions(+), 96 deletions(-)
 rename httpd-2.4.43-r1828172+.patch => httpd-2.4.48-r1828172+.patch (54%)

diff --git a/httpd-2.4.43-r1828172+.patch b/httpd-2.4.48-r1828172+.patch
similarity index 54%
rename from httpd-2.4.43-r1828172+.patch
rename to httpd-2.4.48-r1828172+.patch
index 3487600..37f1855 100644
--- a/httpd-2.4.43-r1828172+.patch
+++ b/httpd-2.4.48-r1828172+.patch
@@ -1,9 +1,12 @@
+
+https://github.com/apache/httpd/pull/209
+
 diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h
 new file mode 100644
-index 0000000..85c9685
+index 0000000000..69df73ce68
 --- /dev/null
 +++ b/modules/generators/cgi_common.h
-@@ -0,0 +1,359 @@
+@@ -0,0 +1,629 @@
 +/* Licensed to the Apache Software Foundation (ASF) under one or more
 + * contributor license agreements.  See the NOTICE file distributed with
 + * this work for additional information regarding copyright ownership.
@@ -33,6 +36,22 @@ index 0000000..85c9685
 +#include "httpd.h"
 +#include "util_filter.h"
 +
++static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgi_pfn_gtv;
++static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgi_pfn_ps;
++
++/* These functions provided by mod_cgi.c/mod_cgid.c still. */
++static int log_script(request_rec *r, cgi_server_conf * conf, int ret,
++                      char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
++                      apr_file_t *script_err);
++static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
++                                apr_bucket_brigade *bb, char *s);
++static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f,
++                                apr_bucket_brigade *bb, const char *command);
++
++/* Read and discard all output from the brigade.  Note that with the
++ * CGI bucket, the brigade will become empty once the script's stdout
++ * is closed (or on error/timeout), but the stderr output may not have
++ * been entirely captured at this point. */
 +static void discard_script_output(apr_bucket_brigade *bb)
 +{
 +    apr_bucket *e;
@@ -50,6 +69,166 @@ index 0000000..85c9685
 +    }
 +}
 +
++static int log_scripterror(request_rec *r, cgi_server_conf *conf, int ret,
++                           apr_status_t rv, const char *logno,
++                           const char *error)
++{
++    apr_file_t *f = NULL;
++    apr_finfo_t finfo;
++    char time_str[APR_CTIME_LEN];
++
++    /* Intentional no APLOGNO */
++    /* Callee provides APLOGNO in error text */
++    ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,
++                  "%sstderr from %s: %s", logno ? logno : "", r->filename, error);
++
++    /* XXX Very expensive mainline case! Open, then getfileinfo! */
++    if (!conf->logname ||
++        ((apr_stat(&finfo, conf->logname,
++                   APR_FINFO_SIZE, r->pool) == APR_SUCCESS) &&
++         (finfo.size > conf->logbytes)) ||
++        (apr_file_open(&f, conf->logname,
++                       APR_APPEND|APR_WRITE|APR_CREATE, APR_OS_DEFAULT,
++                       r->pool) != APR_SUCCESS)) {
++        return ret;
++    }
++
++    /* "%% [Wed Jun 19 10:53:21 1996] GET /cgi-bin/printenv HTTP/1.0" */
++    apr_ctime(time_str, apr_time_now());
++    apr_file_printf(f, "%%%% [%s] %s %s%s%s %s\n", time_str, r->method, r->uri,
++                    r->args ? "?" : "", r->args ? r->args : "", r->protocol);
++    /* "%% 500 /usr/local/apache/cgi-bin */
++    apr_file_printf(f, "%%%% %d %s\n", ret, r->filename);
++
++    apr_file_printf(f, "%%error\n%s\n", error);
++
++    apr_file_close(f);
++    return ret;
++}
++
++/* Soak up stderr from a script and redirect it to the error log.
++ */
++static apr_status_t log_script_err(request_rec *r, apr_file_t *script_err)
++{
++    char argsbuffer[HUGE_STRING_LEN];
++    char *newline;
++    apr_status_t rv;
++    cgi_server_conf *conf = ap_get_module_config(r->server->module_config, &cgi_module);
++
++    while ((rv = apr_file_gets(argsbuffer, HUGE_STRING_LEN,
++                               script_err)) == APR_SUCCESS) {
++
++        newline = strchr(argsbuffer, '\n');
++        if (newline) {
++            char *prev = newline - 1;
++            if (prev >= argsbuffer && *prev == '\r') {
++                newline = prev;
++            }
++
++            *newline = '\0';
++        }
++        log_scripterror(r, conf, r->status, 0, APLOGNO(01215), argsbuffer);
++    }
++
++    return rv;
++}
++
++static apr_status_t cgi_handle_exec(include_ctx_t *ctx, ap_filter_t *f,
++                                    apr_bucket_brigade *bb)
++{
++    char *tag = NULL;
++    char *tag_val = NULL;
++    request_rec *r = f->r;
++    char *file = r->filename;
++    char parsed_string[MAX_STRING_LEN];
++
++    if (!ctx->argc) {
++        ap_log_rerror(APLOG_MARK,
++                      (ctx->flags & SSI_FLAG_PRINTING)
++                          ? APLOG_ERR : APLOG_WARNING,
++                      0, r, APLOGNO(03195)
++                      "missing argument for exec element in %s", r->filename);
++    }
++
++    if (!(ctx->flags & SSI_FLAG_PRINTING)) {
++        return APR_SUCCESS;
++    }
++
++    if (!ctx->argc) {
++        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
++        return APR_SUCCESS;
++    }
++
++    if (ctx->flags & SSI_FLAG_NO_EXEC) {
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01228) "exec used but not allowed "
++                      "in %s", r->filename);
++        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
++        return APR_SUCCESS;
++    }
++
++    while (1) {
++        cgi_pfn_gtv(ctx, &tag, &tag_val, SSI_VALUE_DECODED);
++        if (!tag || !tag_val) {
++            break;
++        }
++
++        if (!strcmp(tag, "cmd")) {
++            apr_status_t rv;
++
++            cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
++                       SSI_EXPAND_LEAVE_NAME);
++
++            rv = include_cmd(ctx, f, bb, parsed_string);
++            if (rv != APR_SUCCESS) {
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01229) "execution failure "
++                              "for parameter \"%s\" to tag exec in file %s",
++                              tag, r->filename);
++                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
++                break;
++            }
++        }
++        else if (!strcmp(tag, "cgi")) {
++            apr_status_t rv;
++
++            cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
++                       SSI_EXPAND_DROP_NAME);
++
++            rv = include_cgi(ctx, f, bb, parsed_string);
++            if (rv != APR_SUCCESS) {
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01230) "invalid CGI ref "
++                              "\"%s\" in %s", tag_val, file);
++                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
++                break;
++            }
++        }
++        else {
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01231) "unknown parameter "
++                          "\"%s\" to tag exec in %s", tag, file);
++            SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
++            break;
++        }
++    }
++
++    return APR_SUCCESS;
++}
++
++/* Hook to register exec= handling with mod_include. */
++static void cgi_optfns_retrieve(void)
++{
++    APR_OPTIONAL_FN_TYPE(ap_register_include_handler) *cgi_pfn_reg_with_ssi;
++
++    cgi_pfn_reg_with_ssi = APR_RETRIEVE_OPTIONAL_FN(ap_register_include_handler);
++    cgi_pfn_gtv          = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_get_tag_and_value);
++    cgi_pfn_ps           = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_parse_string);
++
++    if (cgi_pfn_reg_with_ssi && cgi_pfn_gtv && cgi_pfn_ps) {
++        /* Required by mod_include filter. This is how mod_cgi registers
++         *   with mod_include to provide processing of the exec directive.
++         */
++        cgi_pfn_reg_with_ssi("exec", cgi_handle_exec);
++    }
++}
++
 +#ifdef WANT_CGI_BUCKET
 +/* A CGI bucket type is needed to catch any output to stderr from the
 + * script; see PR 22030. */
@@ -261,6 +440,13 @@ index 0000000..85c9685
 +        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
 +                                                        APLOG_MODULE_INDEX)))
 +        {
++            /* In the case of a timeout reading script output, clear
++             * the brigade to avoid a second attempt to read the
++             * output. */
++            if (ret == HTTP_GATEWAY_TIME_OUT) {
++                apr_brigade_cleanup(bb);
++            }
++
 +            ret = log_script(r, conf, ret, logdata, sbuf, bb, script_err);
 +
 +            /*
@@ -363,8 +549,95 @@ index 0000000..85c9685
 +
 +    return OK;                      /* NOT r->status, even if it has changed. */
 +}
++
++/* Read the request body and write it to fd 'script_out', using 'bb'
++ * as temporary bucket brigade.  If 'logbuf' is non-NULL, the first
++ * logbufbytes of stdout are stored in logbuf. */
++static apr_status_t cgi_handle_request(request_rec *r, apr_file_t *script_out,
++                                       apr_bucket_brigade *bb,
++                                       char *logbuf, apr_size_t logbufbytes)
++{
++    int seen_eos = 0;
++    int child_stopped_reading = 0;
++    apr_status_t rv;
++    int dbpos = 0;
++
++    do {
++        apr_bucket *bucket;
++
++        rv = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES,
++                            APR_BLOCK_READ, HUGE_STRING_LEN);
++
++        if (rv != APR_SUCCESS) {
++            return rv;
++        }
++
++        for (bucket = APR_BRIGADE_FIRST(bb);
++             bucket != APR_BRIGADE_SENTINEL(bb);
++             bucket = APR_BUCKET_NEXT(bucket))
++        {
++            const char *data;
++            apr_size_t len;
++
++            if (APR_BUCKET_IS_EOS(bucket)) {
++                seen_eos = 1;
++                break;
++            }
++
++            /* We can't do much with this. */
++            if (APR_BUCKET_IS_FLUSH(bucket)) {
++                continue;
++            }
++
++            /* If the child stopped, we still must read to EOS. */
++            if (child_stopped_reading) {
++                continue;
++            }
++
++            /* read */
++            rv = apr_bucket_read(bucket, &data, &len, APR_BLOCK_READ);
++            if (rv) {
++                return rv;
++            }
++
++            if (logbufbytes && dbpos < logbufbytes) {
++                int cursize;
++
++                if ((dbpos + len) > logbufbytes) {
++                    cursize = logbufbytes - dbpos;
++                }
++                else {
++                    cursize = len;
++                }
++                memcpy(logbuf + dbpos, data, cursize);
++                dbpos += cursize;
++            }
++
++            /* Keep writing data to the child until done or too much time
++             * elapses with no progress or an error occurs.
++             */
++            rv = apr_file_write_full(script_out, data, len, NULL);
++
++            if (rv != APR_SUCCESS) {
++                /* silly script stopped reading, soak up remaining message */
++                child_stopped_reading = 1;
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(02651)
++                              "Error writing request body to script %s", 
++                              r->filename);
++            }
++        }
++        apr_brigade_cleanup(bb);
++    }
++    while (!seen_eos);
++
++    if (logbuf) {
++        logbuf[dbpos] = '\0';
++    }
++
++    return APR_SUCCESS;
++}
 diff --git a/modules/generators/config5.m4 b/modules/generators/config5.m4
-index bf29521..0863553 100644
+index bf295217e0..086355353b 100644
 --- a/modules/generators/config5.m4
 +++ b/modules/generators/config5.m4
 @@ -78,4 +78,15 @@ fi
@@ -384,21 +657,36 @@ index bf29521..0863553 100644
 +
  APACHE_MODPATH_FINISH
 diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c
-index 7e4b126..f438b35 100644
+index 7e4b126c10..421124a0cb 100644
 --- a/modules/generators/mod_cgi.c
 +++ b/modules/generators/mod_cgi.c
-@@ -92,6 +92,10 @@ typedef struct {
+@@ -61,9 +61,6 @@
+ 
+ module AP_MODULE_DECLARE_DATA cgi_module;
+ 
+-static APR_OPTIONAL_FN_TYPE(ap_register_include_handler) *cgi_pfn_reg_with_ssi;
+-static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgi_pfn_gtv;
+-static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgi_pfn_ps;
+ static APR_OPTIONAL_FN_TYPE(ap_cgi_build_command) *cgi_build_command;
+ 
+ /* Read and discard the data in the brigade produced by a CGI script */
+@@ -92,6 +89,15 @@ typedef struct {
      apr_size_t  bufbytes;
  } cgi_server_conf;
  
 +typedef struct {
 +    apr_interval_time_t timeout;
 +} cgi_dirconf;
++
++#if APR_FILES_AS_SOCKETS
++#define WANT_CGI_BUCKET
++#endif
++#include "cgi_common.h"
 +
  static void *create_cgi_config(apr_pool_t *p, server_rec *s)
  {
      cgi_server_conf *c =
-@@ -112,6 +116,12 @@ static void *merge_cgi_config(apr_pool_t *p, void *basev, void *overridesv)
+@@ -112,6 +118,12 @@ static void *merge_cgi_config(apr_pool_t *p, void *basev, void *overridesv)
      return overrides->logname ? overrides : base;
  }
  
@@ -411,7 +699,7 @@ index 7e4b126..f438b35 100644
  static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg)
  {
      server_rec *s = cmd->server;
-@@ -150,6 +160,17 @@ static const char *set_scriptlog_buffer(cmd_parms *cmd, void *dummy,
+@@ -150,6 +162,17 @@ static const char *set_scriptlog_buffer(cmd_parms *cmd, void *dummy,
      return NULL;
  }
  
@@ -429,7 +717,7 @@ index 7e4b126..f438b35 100644
  static const command_rec cgi_cmds[] =
  {
  AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF,
-@@ -158,6 +179,9 @@ AP_INIT_TAKE1("ScriptLogLength", set_scriptlog_length, NULL, RSRC_CONF,
+@@ -158,67 +181,12 @@ AP_INIT_TAKE1("ScriptLogLength", set_scriptlog_length, NULL, RSRC_CONF,
       "the maximum length (in bytes) of the script debug log"),
  AP_INIT_TAKE1("ScriptLogBuffer", set_scriptlog_buffer, NULL, RSRC_CONF,
       "the maximum size (in bytes) to record of a POST request"),
@@ -439,7 +727,68 @@ index 7e4b126..f438b35 100644
      {NULL}
  };
  
-@@ -466,23 +490,26 @@ static apr_status_t run_cgi_child(apr_file_t **script_out,
+-static int log_scripterror(request_rec *r, cgi_server_conf * conf, int ret,
+-                           apr_status_t rv, char *logno, char *error)
+-{
+-    apr_file_t *f = NULL;
+-    apr_finfo_t finfo;
+-    char time_str[APR_CTIME_LEN];
+-    int log_flags = rv ? APLOG_ERR : APLOG_ERR;
+-
+-    /* Intentional no APLOGNO */
+-    /* Callee provides APLOGNO in error text */
+-    ap_log_rerror(APLOG_MARK, log_flags, rv, r,
+-                  "%s%s: %s", logno ? logno : "", error, r->filename);
+-
+-    /* XXX Very expensive mainline case! Open, then getfileinfo! */
+-    if (!conf->logname ||
+-        ((apr_stat(&finfo, conf->logname,
+-                   APR_FINFO_SIZE, r->pool) == APR_SUCCESS) &&
+-         (finfo.size > conf->logbytes)) ||
+-        (apr_file_open(&f, conf->logname,
+-                       APR_APPEND|APR_WRITE|APR_CREATE, APR_OS_DEFAULT,
+-                       r->pool) != APR_SUCCESS)) {
+-        return ret;
+-    }
+-
+-    /* "%% [Wed Jun 19 10:53:21 1996] GET /cgi-bin/printenv HTTP/1.0" */
+-    apr_ctime(time_str, apr_time_now());
+-    apr_file_printf(f, "%%%% [%s] %s %s%s%s %s\n", time_str, r->method, r->uri,
+-                    r->args ? "?" : "", r->args ? r->args : "", r->protocol);
+-    /* "%% 500 /usr/local/apache/cgi-bin */
+-    apr_file_printf(f, "%%%% %d %s\n", ret, r->filename);
+-
+-    apr_file_printf(f, "%%error\n%s\n", error);
+-
+-    apr_file_close(f);
+-    return ret;
+-}
+-
+-/* Soak up stderr from a script and redirect it to the error log.
+- */
+-static apr_status_t log_script_err(request_rec *r, apr_file_t *script_err)
+-{
+-    char argsbuffer[HUGE_STRING_LEN];
+-    char *newline;
+-    apr_status_t rv;
+-    cgi_server_conf *conf = ap_get_module_config(r->server->module_config, &cgi_module);
+-
+-    while ((rv = apr_file_gets(argsbuffer, HUGE_STRING_LEN,
+-                               script_err)) == APR_SUCCESS) {
+-        newline = strchr(argsbuffer, '\n');
+-        if (newline) {
+-            *newline = '\0';
+-        }
+-        log_scripterror(r, conf, r->status, 0, APLOGNO(01215), argsbuffer);
+-    }
+-
+-    return rv;
+-}
+-
+ static int log_script(request_rec *r, cgi_server_conf * conf, int ret,
+                       char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
+                       apr_file_t *script_err)
+@@ -466,23 +434,26 @@ static apr_status_t run_cgi_child(apr_file_t **script_out,
                            apr_filepath_name_get(r->filename));
          }
          else {
@@ -469,7 +818,7 @@ index 7e4b126..f438b35 100644
              }
          }
      }
-@@ -536,209 +563,12 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv,
+@@ -536,234 +507,30 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv,
      return APR_SUCCESS;
  }
  
@@ -490,7 +839,7 @@ index 7e4b126..f438b35 100644
 -    }
 -}
 -
- #if APR_FILES_AS_SOCKETS
+-#if APR_FILES_AS_SOCKETS
 -
 -/* A CGI bucket type is needed to catch any output to stderr from the
 - * script; see PR 22030. */
@@ -674,24 +1023,139 @@ index 7e4b126..f438b35 100644
 -    apr_bucket_copy_notimpl
 -};
 -
-+#define WANT_CGI_BUCKET
- #endif
- 
-+#include "cgi_common.h"
-+
+-#endif
+-
  static int cgi_handler(request_rec *r)
  {
      int nph;
-@@ -757,6 +587,8 @@ static int cgi_handler(request_rec *r)
+-    apr_size_t dbpos = 0;
++    apr_size_t dbufsize;
+     const char *argv0;
+     const char *command;
+     const char **argv;
+     char *dbuf = NULL;
+     apr_file_t *script_out = NULL, *script_in = NULL, *script_err = NULL;
+-    apr_bucket_brigade *bb;
++    conn_rec *c = r->connection;
++    apr_bucket_brigade *bb = apr_brigade_create(r->pool, c->bucket_alloc);
+     apr_bucket *b;
+     int is_included;
+-    int seen_eos, child_stopped_reading;
+     apr_pool_t *p;
+     cgi_server_conf *conf;
      apr_status_t rv;
      cgi_exec_info_t e_info;
-     conn_rec *c;
+-    conn_rec *c;
 +    cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module);
 +    apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
  
      if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
          return DECLINED;
-@@ -916,10 +748,7 @@ static int cgi_handler(request_rec *r)
+     }
+ 
+-    c = r->connection;
+-
+     is_included = !strcmp(r->protocol, "INCLUDED");
+ 
+     p = r->main ? r->main->pool : r->pool;
+@@ -832,83 +599,24 @@ static int cgi_handler(request_rec *r)
+         return HTTP_INTERNAL_SERVER_ERROR;
+     }
+ 
+-    /* Transfer any put/post args, CERN style...
+-     * Note that we already ignore SIGPIPE in the core server.
+-     */
+-    bb = apr_brigade_create(r->pool, c->bucket_alloc);
+-    seen_eos = 0;
+-    child_stopped_reading = 0;
++    /* Buffer for logging script stdout. */
+     if (conf->logname) {
+-        dbuf = apr_palloc(r->pool, conf->bufbytes + 1);
+-        dbpos = 0;
++        dbufsize = conf->bufbytes;
++        dbuf = apr_palloc(r->pool, dbufsize + 1);
+     }
+-    do {
+-        apr_bucket *bucket;
+-
+-        rv = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES,
+-                            APR_BLOCK_READ, HUGE_STRING_LEN);
+-
+-        if (rv != APR_SUCCESS) {
+-            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01225)
+-                          "Error reading request entity data");
+-            return ap_map_http_request_error(rv, HTTP_BAD_REQUEST);
+-        }
+-
+-        for (bucket = APR_BRIGADE_FIRST(bb);
+-             bucket != APR_BRIGADE_SENTINEL(bb);
+-             bucket = APR_BUCKET_NEXT(bucket))
+-        {
+-            const char *data;
+-            apr_size_t len;
+-
+-            if (APR_BUCKET_IS_EOS(bucket)) {
+-                seen_eos = 1;
+-                break;
+-            }
+-
+-            /* We can't do much with this. */
+-            if (APR_BUCKET_IS_FLUSH(bucket)) {
+-                continue;
+-            }
+-
+-            /* If the child stopped, we still must read to EOS. */
+-            if (child_stopped_reading) {
+-                continue;
+-            }
+-
+-            /* read */
+-            apr_bucket_read(bucket, &data, &len, APR_BLOCK_READ);
+-
+-            if (conf->logname && dbpos < conf->bufbytes) {
+-                int cursize;
+-
+-                if ((dbpos + len) > conf->bufbytes) {
+-                    cursize = conf->bufbytes - dbpos;
+-                }
+-                else {
+-                    cursize = len;
+-                }
+-                memcpy(dbuf + dbpos, data, cursize);
+-                dbpos += cursize;
+-            }
+-
+-            /* Keep writing data to the child until done or too much time
+-             * elapses with no progress or an error occurs.
+-             */
+-            rv = apr_file_write_full(script_out, data, len, NULL);
+-
+-            if (rv != APR_SUCCESS) {
+-                /* silly script stopped reading, soak up remaining message */
+-                child_stopped_reading = 1;
+-            }
+-        }
+-        apr_brigade_cleanup(bb);
++    else {
++        dbufsize = 0;
++        dbuf = NULL;
+     }
+-    while (!seen_eos);
+ 
+-    if (conf->logname) {
+-        dbuf[dbpos] = '\0';
++    /* Read the request body. */
++    rv = cgi_handle_request(r, script_out, bb, dbuf, dbufsize);
++    if (rv) {
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01225)
++                      "Error reading request entity data");
++        return ap_map_http_request_error(rv, HTTP_BAD_REQUEST);
+     }
++
+     /* Is this flush really needed? */
+     apr_file_flush(script_out);
+     apr_file_close(script_out);
+@@ -916,10 +624,7 @@ static int cgi_handler(request_rec *r)
      AP_DEBUG_ASSERT(script_in != NULL);
  
  #if APR_FILES_AS_SOCKETS
@@ -703,7 +1167,7 @@ index 7e4b126..f438b35 100644
      if (b == NULL)
          return HTTP_INTERNAL_SERVER_ERROR;
  #else
-@@ -929,111 +758,7 @@ static int cgi_handler(request_rec *r)
+@@ -929,111 +634,7 @@ static int cgi_handler(request_rec *r)
      b = apr_bucket_eos_create(c->bucket_alloc);
      APR_BRIGADE_INSERT_TAIL(bb, b);
  
@@ -816,7 +1280,121 @@ index 7e4b126..f438b35 100644
  }
  
  /*============================================================================
-@@ -1268,7 +993,7 @@ static void register_hooks(apr_pool_t *p)
+@@ -1147,107 +748,9 @@ static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f,
+     return APR_SUCCESS;
+ }
+ 
+-static apr_status_t handle_exec(include_ctx_t *ctx, ap_filter_t *f,
+-                                apr_bucket_brigade *bb)
+-{
+-    char *tag = NULL;
+-    char *tag_val = NULL;
+-    request_rec *r = f->r;
+-    char *file = r->filename;
+-    char parsed_string[MAX_STRING_LEN];
+-
+-    if (!ctx->argc) {
+-        ap_log_rerror(APLOG_MARK,
+-                      (ctx->flags & SSI_FLAG_PRINTING)
+-                          ? APLOG_ERR : APLOG_WARNING,
+-                      0, r, APLOGNO(03195)
+-                      "missing argument for exec element in %s", r->filename);
+-    }
+-
+-    if (!(ctx->flags & SSI_FLAG_PRINTING)) {
+-        return APR_SUCCESS;
+-    }
+-
+-    if (!ctx->argc) {
+-        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-        return APR_SUCCESS;
+-    }
+-
+-    if (ctx->flags & SSI_FLAG_NO_EXEC) {
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01228) "exec used but not allowed "
+-                      "in %s", r->filename);
+-        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-        return APR_SUCCESS;
+-    }
+-
+-    while (1) {
+-        cgi_pfn_gtv(ctx, &tag, &tag_val, SSI_VALUE_DECODED);
+-        if (!tag || !tag_val) {
+-            break;
+-        }
+-
+-        if (!strcmp(tag, "cmd")) {
+-            apr_status_t rv;
+-
+-            cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
+-                       SSI_EXPAND_LEAVE_NAME);
+-
+-            rv = include_cmd(ctx, f, bb, parsed_string);
+-            if (rv != APR_SUCCESS) {
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01229) "execution failure "
+-                              "for parameter \"%s\" to tag exec in file %s",
+-                              tag, r->filename);
+-                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-                break;
+-            }
+-        }
+-        else if (!strcmp(tag, "cgi")) {
+-            apr_status_t rv;
+-
+-            cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
+-                       SSI_EXPAND_DROP_NAME);
+-
+-            rv = include_cgi(ctx, f, bb, parsed_string);
+-            if (rv != APR_SUCCESS) {
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01230) "invalid CGI ref "
+-                              "\"%s\" in %s", tag_val, file);
+-                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-                break;
+-            }
+-        }
+-        else {
+-            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01231) "unknown parameter "
+-                          "\"%s\" to tag exec in %s", tag, file);
+-            SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-            break;
+-        }
+-    }
+-
+-    return APR_SUCCESS;
+-}
+-
+-
+-/*============================================================================
+- *============================================================================
+- * This is the end of the cgi filter code moved from mod_include.
+- *============================================================================
+- *============================================================================*/
+-
+-
+ static int cgi_post_config(apr_pool_t *p, apr_pool_t *plog,
+                                 apr_pool_t *ptemp, server_rec *s)
+ {
+-    cgi_pfn_reg_with_ssi = APR_RETRIEVE_OPTIONAL_FN(ap_register_include_handler);
+-    cgi_pfn_gtv          = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_get_tag_and_value);
+-    cgi_pfn_ps           = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_parse_string);
+-
+-    if ((cgi_pfn_reg_with_ssi) && (cgi_pfn_gtv) && (cgi_pfn_ps)) {
+-        /* Required by mod_include filter. This is how mod_cgi registers
+-         *   with mod_include to provide processing of the exec directive.
+-         */
+-        cgi_pfn_reg_with_ssi("exec", handle_exec);
+-    }
+-
+     /* This is the means by which unusual (non-unix) os's may find alternate
+      * means to run a given command (e.g. shebang/registry parsing on Win32)
+      */
+@@ -1263,12 +766,13 @@ static void register_hooks(apr_pool_t *p)
+     static const char * const aszPre[] = { "mod_include.c", NULL };
+     ap_hook_handler(cgi_handler, NULL, NULL, APR_HOOK_MIDDLE);
+     ap_hook_post_config(cgi_post_config, aszPre, NULL, APR_HOOK_REALLY_FIRST);
++    ap_hook_optional_fn_retrieve(cgi_optfns_retrieve, NULL, NULL, APR_HOOK_MIDDLE);
+ }
+ 
  AP_DECLARE_MODULE(cgi) =
  {
      STANDARD20_MODULE_STUFF,
@@ -826,10 +1404,38 @@ index 7e4b126..f438b35 100644
      create_cgi_config,           /* server config */
      merge_cgi_config,            /* merge server config */
 diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c
-index 9f4282c..102d2b3 100644
+index 2258a683b7..dddfb25254 100644
 --- a/modules/generators/mod_cgid.c
 +++ b/modules/generators/mod_cgid.c
-@@ -342,15 +342,19 @@ static apr_status_t close_unix_socket(void *thefd)
+@@ -80,11 +80,6 @@ module AP_MODULE_DECLARE_DATA cgid_module;
+ 
+ static int cgid_start(apr_pool_t *p, server_rec *main_server, apr_proc_t *procnew);
+ static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *main_server);
+-static int handle_exec(include_ctx_t *ctx, ap_filter_t *f, apr_bucket_brigade *bb);
+-
+-static APR_OPTIONAL_FN_TYPE(ap_register_include_handler) *cgid_pfn_reg_with_ssi;
+-static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgid_pfn_gtv;
+-static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgid_pfn_ps;
+ 
+ static apr_pool_t *pcgi = NULL;
+ static pid_t daemon_pid;
+@@ -220,6 +215,15 @@ typedef struct {
+ #endif
+ } cgid_req_t;
+ 
++#define cgi_server_conf cgid_server_conf
++#define cgi_module cgid_module
++
++#ifdef HAVE_CGID_FDPASSING
++/* Pull in CGI bucket implementation. */
++#define WANT_CGI_BUCKET
++#endif
++#include "cgi_common.h"
++
+ /* This routine is called to create the argument list to be passed
+  * to the CGI script.  When suexec is enabled, the suexec path, user, and
+  * group are the first three arguments to be passed; if not, all three
+@@ -342,15 +346,19 @@ static apr_status_t close_unix_socket(void *thefd)
      return close(fd);
  }
  
@@ -854,7 +1460,7 @@ index 9f4282c..102d2b3 100644
      do {
          do {
              rc = read(fd, buf + bytes_read, buf_size - bytes_read);
-@@ -365,9 +369,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
+@@ -365,9 +373,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
          }
      } while (bytes_read < buf_size);
  
@@ -915,7 +1521,7 @@ index 9f4282c..102d2b3 100644
  /* deal with signals
   */
  static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
-@@ -384,7 +439,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
+@@ -384,7 +443,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
      return APR_SUCCESS;
  }
  
@@ -924,7 +1530,7 @@ index 9f4282c..102d2b3 100644
  {
      va_list ap;
      int rc;
-@@ -399,9 +454,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
+@@ -399,9 +458,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
      }
      va_end(ap);
  
@@ -964,7 +1570,7 @@ index 9f4282c..102d2b3 100644
      if (rc < 0) {
          return errno;
      }
-@@ -410,7 +495,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
+@@ -410,7 +499,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
  }
  
  static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
@@ -973,7 +1579,7 @@ index 9f4282c..102d2b3 100644
  {
      int i;
      char **environ;
-@@ -421,7 +506,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
+@@ -421,7 +510,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
      r->server = apr_pcalloc(r->pool, sizeof(server_rec));
  
      /* read the request header */
@@ -982,14 +1588,29 @@ index 9f4282c..102d2b3 100644
      if (stat != APR_SUCCESS) {
          return stat;
      }
-@@ -479,14 +564,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
+@@ -431,6 +520,14 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
+         return APR_SUCCESS;
+     }
+ 
++    /* Sanity check the structure received. */
++    if (req->env_count < 0 || req->uri_len == 0
++        || req->filename_len > APR_PATH_MAX || req->filename_len == 0
++        || req->argv0_len > APR_PATH_MAX || req->argv0_len == 0
++        || req->loglevel > APLOG_TRACE8) {
++        return APR_EINVAL;
++    }
++    
+     /* handle module indexes and such */
+     rconf = (void **)ap_create_request_config(r->pool);
+ 
+@@ -479,14 +576,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
      return APR_SUCCESS;
  }
  
 -static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
 -                             int req_type)
 +static apr_status_t send_req(int fd, apr_file_t *errpipe, request_rec *r,
-+                             char *argv0, char **env, int req_type)
++                             const char *argv0, char **env, int req_type)
  {
      int i;
      cgid_req_t req = {0};
@@ -1000,7 +1621,7 @@ index 9f4282c..102d2b3 100644
  
  
      if (ugid == NULL) {
-@@ -507,16 +593,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
+@@ -507,16 +605,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
      req.args_len = r->args ? strlen(r->args) : 0;
      req.loglevel = r->server->log.level;
  
@@ -1024,7 +1645,7 @@ index 9f4282c..102d2b3 100644
                             &req, sizeof(req),
                             r->filename, req.filename_len,
                             argv0, req.argv0_len,
-@@ -531,7 +622,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
+@@ -531,7 +634,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
      for (i = 0; i < req.env_count; i++) {
          apr_size_t curlen = strlen(env[i]);
  
@@ -1033,7 +1654,7 @@ index 9f4282c..102d2b3 100644
                                  env[i], curlen)) != APR_SUCCESS) {
              return stat;
          }
-@@ -582,20 +673,34 @@ static void daemon_signal_handler(int sig)
+@@ -582,20 +685,34 @@ static void daemon_signal_handler(int sig)
      }
  }
  
@@ -1076,7 +1697,7 @@ index 9f4282c..102d2b3 100644
  }
  
  static int cgid_server(void *data)
-@@ -669,7 +774,7 @@ static int cgid_server(void *data)
+@@ -670,7 +787,7 @@ static int cgid_server(void *data)
      }
  
      while (!daemon_should_exit) {
@@ -1085,7 +1706,7 @@ index 9f4282c..102d2b3 100644
          char *argv0 = NULL;
          char **env = NULL;
          const char * const *argv;
-@@ -709,7 +814,7 @@ static int cgid_server(void *data)
+@@ -710,7 +827,7 @@ static int cgid_server(void *data)
          r = apr_pcalloc(ptrans, sizeof(request_rec));
          procnew = apr_pcalloc(ptrans, sizeof(*procnew));
          r->pool = ptrans;
@@ -1094,7 +1715,7 @@ index 9f4282c..102d2b3 100644
          if (stat != APR_SUCCESS) {
              ap_log_error(APLOG_MARK, APLOG_ERR, stat,
                           main_server, APLOGNO(01248)
-@@ -741,6 +846,16 @@ static int cgid_server(void *data)
+@@ -742,6 +859,16 @@ static int cgid_server(void *data)
              continue;
          }
  
@@ -1111,7 +1732,7 @@ index 9f4282c..102d2b3 100644
          apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool);
          apr_os_file_put(&inout, &sd2, 0, r->pool);
  
-@@ -800,7 +915,10 @@ static int cgid_server(void *data)
+@@ -801,7 +928,10 @@ static int cgid_server(void *data)
              close(sd2);
          }
          else {
@@ -1123,55 +1744,103 @@ index 9f4282c..102d2b3 100644
  
              argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args);
  
-@@ -1099,6 +1217,33 @@ static int log_scripterror(request_rec *r, cgid_server_conf * conf, int ret,
+@@ -946,16 +1076,6 @@ static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp,
+         if (ret != OK ) {
+             return ret;
+         }
+-        cgid_pfn_reg_with_ssi = APR_RETRIEVE_OPTIONAL_FN(ap_register_include_handler);
+-        cgid_pfn_gtv          = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_get_tag_and_value);
+-        cgid_pfn_ps           = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_parse_string);
+-
+-        if ((cgid_pfn_reg_with_ssi) && (cgid_pfn_gtv) && (cgid_pfn_ps)) {
+-            /* Required by mod_include filter. This is how mod_cgid registers
+-             *   with mod_include to provide processing of the exec directive.
+-             */
+-            cgid_pfn_reg_with_ssi("exec", handle_exec);
+-        }
+     }
      return ret;
  }
+@@ -1066,41 +1186,6 @@ static const command_rec cgid_cmds[] =
+     {NULL}
+ };
  
-+/* Soak up stderr from a script and redirect it to the error log.
-+ * TODO: log_scripterror() and this could move to cgi_common.h. */
-+static apr_status_t log_script_err(request_rec *r, apr_file_t *script_err)
-+{
-+    char argsbuffer[HUGE_STRING_LEN];
-+    char *newline;
-+    apr_status_t rv;
-+    cgid_server_conf *conf = ap_get_module_config(r->server->module_config, &cgid_module);
-+
-+    while ((rv = apr_file_gets(argsbuffer, HUGE_STRING_LEN,
-+                               script_err)) == APR_SUCCESS) {
-+
-+        newline = strchr(argsbuffer, '\n');
-+        if (newline) {
-+            char *prev = newline - 1;
-+            if (prev >= argsbuffer && *prev == '\r') {
-+                newline = prev;
-+            }
-+
-+            *newline = '\0';
-+        }
-+        log_scripterror(r, conf, r->status, 0, argsbuffer);
-+    }
-+
-+    return rv;
-+}
-+
+-static int log_scripterror(request_rec *r, cgid_server_conf * conf, int ret,
+-                           apr_status_t rv, char *error)
+-{
+-    apr_file_t *f = NULL;
+-    struct stat finfo;
+-    char time_str[APR_CTIME_LEN];
+-    int log_flags = rv ? APLOG_ERR : APLOG_ERR;
+-
+-    /* Intentional no APLOGNO */
+-    /* Callee provides APLOGNO in error text */
+-    ap_log_rerror(APLOG_MARK, log_flags, rv, r,
+-                "%s: %s", error, r->filename);
+-
+-    /* XXX Very expensive mainline case! Open, then getfileinfo! */
+-    if (!conf->logname ||
+-        ((stat(conf->logname, &finfo) == 0)
+-         && (finfo.st_size > conf->logbytes)) ||
+-         (apr_file_open(&f, conf->logname,
+-                  APR_APPEND|APR_WRITE|APR_CREATE, APR_OS_DEFAULT, r->pool) != APR_SUCCESS)) {
+-        return ret;
+-    }
+-
+-    /* "%% [Wed Jun 19 10:53:21 1996] GET /cgid-bin/printenv HTTP/1.0" */
+-    apr_ctime(time_str, apr_time_now());
+-    apr_file_printf(f, "%%%% [%s] %s %s%s%s %s\n", time_str, r->method, r->uri,
+-            r->args ? "?" : "", r->args ? r->args : "", r->protocol);
+-    /* "%% 500 /usr/local/apache/cgid-bin */
+-    apr_file_printf(f, "%%%% %d %s\n", ret, r->filename);
+-
+-    apr_file_printf(f, "%%error\n%s\n", error);
+-
+-    apr_file_close(f);
+-    return ret;
+-}
+-
  static int log_script(request_rec *r, cgid_server_conf * conf, int ret,
                        char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
                        apr_file_t *script_err)
-@@ -1204,6 +1349,13 @@ static int log_script(request_rec *r, cgid_server_conf * conf, int ret,
-     return ret;
- }
+@@ -1221,7 +1306,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
+         ++connect_tries;
+         if ((sd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {
+             return log_scripterror(r, conf, HTTP_INTERNAL_SERVER_ERROR, errno,
+-                                   APLOGNO(01255) "unable to create socket to cgi daemon");
++                                   APLOGNO(01255), "unable to create socket to cgi daemon");
+         }
+         if (connect(sd, (struct sockaddr *)server_addr, server_addr_len) < 0) {
+             /* Save errno for later */
+@@ -1242,7 +1327,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
+             }
+             else {
+                 close(sd);
+-                return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, errno, APLOGNO(01257)
++                return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, errno, APLOGNO(01257),
+                                        "unable to connect to cgi daemon after multiple tries");
+             }
+         }
+@@ -1258,13 +1343,15 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
+         if (connect_errno == ENOENT &&
+             apr_time_sec(apr_time_now() - ap_scoreboard_image->global->restart_time) > 
+                 DEFAULT_CONNECT_STARTUP_DELAY) {
+-            return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno, 
+-                                   apr_pstrcat(r->pool, APLOGNO(02833) "ScriptSock ", sockname, " does not exist", NULL));
++            return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno,
++                                   APLOGNO(02833),
++                                   apr_pstrcat(r->pool,
++                                               "ScriptSock ", sockname, " does not exist", NULL));
+         }
  
-+/* Pull in CGI bucket implementation. */
-+#define cgi_server_conf cgid_server_conf
-+#ifdef HAVE_CGID_FDPASSING
-+#define WANT_CGI_BUCKET
-+#endif
-+#include "cgi_common.h"
-+
- static int connect_to_daemon(int *sdptr, request_rec *r,
-                              cgid_server_conf *conf)
- {
-@@ -1270,23 +1422,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
+         /* gotta try again, but make sure the cgid daemon is still around */
+         if (connect_errno != ENOENT && kill(daemon_pid, 0) != 0) {
+-            return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno, APLOGNO(01258)
++            return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno, APLOGNO(01258),
+                                    "cgid daemon is gone; is Apache terminating?");
+         }
+     }
+@@ -1272,23 +1359,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
      return OK;
  }
  
@@ -1195,16 +1864,32 @@ index 9f4282c..102d2b3 100644
  /****************************************************************
   *
   * Actual cgid handling...
-@@ -1391,6 +1526,7 @@ static apr_status_t cleanup_script(void *vptr)
+@@ -1374,7 +1444,9 @@ static apr_status_t get_cgi_pid(request_rec *r,  cgid_server_conf *conf, pid_t *
+         return stat;
+     }
+ 
+-    if (pid == 0) {
++    /* Don't accept zero as a pid here, calling kill(0, SIGTERM) etc
++     * later is unpleasant. */
++    if (*pid == 0) {
+         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01261)
+                       "daemon couldn't find CGI process for connection %lu",
+                       r->connection->id);
+@@ -1393,19 +1465,21 @@ static apr_status_t cleanup_script(void *vptr)
  
  static int cgid_handler(request_rec *r)
  {
+-    int retval, nph, dbpos;
 +    conn_rec *c = r->connection;
-     int retval, nph, dbpos;
++    int retval, nph;
      char *argv0, *dbuf;
-     apr_bucket_brigade *bb;
-@@ -1400,10 +1536,11 @@ static int cgid_handler(request_rec *r)
-     int seen_eos, child_stopped_reading;
+-    apr_bucket_brigade *bb;
++    apr_size_t dbufsize;
++    apr_bucket_brigade *bb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
+     apr_bucket *b;
+     cgid_server_conf *conf;
+     int is_included;
+-    int seen_eos, child_stopped_reading;
      int sd;
      char **env;
 -    apr_file_t *tempsock;
@@ -1216,7 +1901,7 @@ index 9f4282c..102d2b3 100644
  
      if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
          return DECLINED;
-@@ -1412,7 +1549,7 @@ static int cgid_handler(request_rec *r)
+@@ -1414,7 +1488,7 @@ static int cgid_handler(request_rec *r)
      conf = ap_get_module_config(r->server->module_config, &cgid_module);
      dc = ap_get_module_config(r->per_dir_config, &cgid_module);
  
@@ -1225,14 +1910,53 @@ index 9f4282c..102d2b3 100644
      is_included = !strcmp(r->protocol, "INCLUDED");
  
      if ((argv0 = strrchr(r->filename, '/')) != NULL) {
-@@ -1465,6 +1602,17 @@ static int cgid_handler(request_rec *r)
+@@ -1429,12 +1503,12 @@ static int cgid_handler(request_rec *r)
+     argv0 = r->filename;
+ 
+     if (!(ap_allow_options(r) & OPT_EXECCGI) && !is_scriptaliased(r)) {
+-        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01262)
++        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01262),
+                 "Options ExecCGI is off in this directory");
+     }
+ 
+     if (nph && is_included) {
+-        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01263)
++        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01263),
+                 "attempt to include NPH CGI script");
+     }
+ 
+@@ -1443,12 +1517,12 @@ static int cgid_handler(request_rec *r)
+ #error at mod_cgi.c for required code in this path.
+ #else
+     if (r->finfo.filetype == APR_NOFILE) {
+-        return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01264)
++        return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01264),
+                 "script not found or unable to stat");
+     }
+ #endif
+     if (r->finfo.filetype == APR_DIR) {
+-        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01265)
++        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01265),
+                 "attempt to invoke directory as script");
+     }
+ 
+@@ -1456,7 +1530,7 @@ static int cgid_handler(request_rec *r)
+         r->path_info && *r->path_info)
+     {
+         /* default to accept */
+-        return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01266)
++        return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01266),
+                                "AcceptPathInfo off disallows user's path");
+     }
+     /*
+@@ -1467,6 +1541,17 @@ static int cgid_handler(request_rec *r)
      }
      */
  
 +#ifdef HAVE_CGID_FDPASSING
 +    rv = apr_file_pipe_create(&script_err, &errpipe_out, r->pool);
 +    if (rv) {
-+        return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10176)
++        return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10176),
 +                               "could not create pipe for stderr");
 +    }
 +#else
@@ -1243,15 +1967,17 @@ index 9f4282c..102d2b3 100644
      /*
       * httpd core function used to add common environment variables like
       * DOCUMENT_ROOT. 
-@@ -1477,12 +1625,16 @@ static int cgid_handler(request_rec *r)
+@@ -1479,24 +1564,28 @@ static int cgid_handler(request_rec *r)
          return retval;
      }
  
 -    rv = send_req(sd, r, argv0, env, CGI_REQ);
 +    rv = send_req(sd, errpipe_out, r, argv0, env, CGI_REQ);
      if (rv != APR_SUCCESS) {
-         ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01268)
-                      "write to cgi daemon process");
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01268)
+-                     "write to cgi daemon process");
++        return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10245),
++                               "could not send request to cgi daemon");
      }
  
 +    /* The write-end of the pipe is only used by the server, so close
@@ -1261,7 +1987,23 @@ index 9f4282c..102d2b3 100644
      info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
      info->conf = conf;
      info->r = r;
-@@ -1504,12 +1656,7 @@ static int cgid_handler(request_rec *r)
+     rv = get_cgi_pid(r, conf, &(info->pid));
+ 
+-    if (APR_SUCCESS == rv){  
++    if (rv == APR_SUCCESS) {
+         apr_pool_cleanup_register(r->pool, info,
+-                              cleanup_script,
+-                              apr_pool_cleanup_null);
++                                  cleanup_script, apr_pool_cleanup_null);
+     }
+     else { 
+-        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, rv, r, "error determining cgi PID");
++        return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10246),
++                               "failed reading PID from cgi daemon");
+     }
+ 
+     /* We are putting the socket discriptor into an apr_file_t so that we can
+@@ -1506,95 +1595,25 @@ static int cgid_handler(request_rec *r)
       */
  
      apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
@@ -1274,8 +2016,103 @@ index 9f4282c..102d2b3 100644
 +    apr_file_pipe_timeout_set(tempsock, timeout);
      apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket);
  
-     /* Transfer any put/post args, CERN style...
-@@ -1601,114 +1748,19 @@ static int cgid_handler(request_rec *r)
+-    /* Transfer any put/post args, CERN style...
+-     * Note that we already ignore SIGPIPE in the core server.
+-     */
+-    bb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
+-    seen_eos = 0;
+-    child_stopped_reading = 0;
+-    dbuf = NULL;
+-    dbpos = 0;
++    /* Buffer for logging script stdout. */
+     if (conf->logname) {
+-        dbuf = apr_palloc(r->pool, conf->bufbytes + 1);
++        dbufsize = conf->bufbytes;
++        dbuf = apr_palloc(r->pool, dbufsize + 1);
+     }
+-    do {
+-        apr_bucket *bucket;
+-
+-        rv = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES,
+-                            APR_BLOCK_READ, HUGE_STRING_LEN);
+-
+-        if (rv != APR_SUCCESS) {
+-            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01270)
+-                          "Error reading request entity data");
+-            return ap_map_http_request_error(rv, HTTP_BAD_REQUEST);
+-        }
+-
+-        for (bucket = APR_BRIGADE_FIRST(bb);
+-             bucket != APR_BRIGADE_SENTINEL(bb);
+-             bucket = APR_BUCKET_NEXT(bucket))
+-        {
+-            const char *data;
+-            apr_size_t len;
+-
+-            if (APR_BUCKET_IS_EOS(bucket)) {
+-                seen_eos = 1;
+-                break;
+-            }
+-
+-            /* We can't do much with this. */
+-            if (APR_BUCKET_IS_FLUSH(bucket)) {
+-                continue;
+-            }
+-
+-            /* If the child stopped, we still must read to EOS. */
+-            if (child_stopped_reading) {
+-                continue;
+-            }
+-
+-            /* read */
+-            apr_bucket_read(bucket, &data, &len, APR_BLOCK_READ);
+-
+-            if (conf->logname && dbpos < conf->bufbytes) {
+-                int cursize;
+-
+-                if ((dbpos + len) > conf->bufbytes) {
+-                    cursize = conf->bufbytes - dbpos;
+-                }
+-                else {
+-                    cursize = len;
+-                }
+-                memcpy(dbuf + dbpos, data, cursize);
+-                dbpos += cursize;
+-            }
+-
+-            /* Keep writing data to the child until done or too much time
+-             * elapses with no progress or an error occurs.
+-             */
+-            rv = apr_file_write_full(tempsock, data, len, NULL);
+-
+-            if (rv != APR_SUCCESS) {
+-                /* silly script stopped reading, soak up remaining message */
+-                child_stopped_reading = 1;
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,  APLOGNO(02651)
+-                              "Error writing request body to script %s", 
+-                              r->filename);
+-
+-            }
+-        }
+-        apr_brigade_cleanup(bb);
++    else {
++        dbuf = NULL;
++        dbufsize = 0;
+     }
+-    while (!seen_eos);
+ 
+-    if (conf->logname) {
+-        dbuf[dbpos] = '\0';
++    /* Read the request body. */
++    rv = cgi_handle_request(r, tempsock, bb, dbuf, dbufsize);
++    if (rv) {
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01270)
++                      "Error reading request entity data");
++        return ap_map_http_request_error(rv, HTTP_BAD_REQUEST);
+     }
+ 
+     /* we're done writing, or maybe we didn't write at all;
+@@ -1603,125 +1622,22 @@ static int cgid_handler(request_rec *r)
       */
      shutdown(sd, 1);
  
@@ -1401,8 +2238,29 @@ index 9f4282c..102d2b3 100644
 +    return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err);
  }
  
+-
+-
+-
+-/*============================================================================
+- *============================================================================
+- * This is the beginning of the cgi filter code moved from mod_include. This
+- *   is the code required to handle the "exec" SSI directive.
+- *============================================================================
+- *============================================================================*/
++/* Handling include= for mod_include. */
+ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
+                                 apr_bucket_brigade *bb, char *s)
+ {
+@@ -1806,7 +1722,7 @@ static void add_ssi_vars(request_rec *r)
+ }
  
-@@ -1825,7 +1877,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
+ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
+-                       apr_bucket_brigade *bb, char *command)
++                       apr_bucket_brigade *bb, const char *command)
+ {
+     char **env;
+     int sd;
+@@ -1827,7 +1743,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
          return retval;
      }
  
@@ -1411,3 +2269,103 @@ index 9f4282c..102d2b3 100644
  
      info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
      info->conf = conf;
+@@ -1872,91 +1788,6 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
+     return APR_SUCCESS;
+ }
+ 
+-static apr_status_t handle_exec(include_ctx_t *ctx, ap_filter_t *f,
+-                                apr_bucket_brigade *bb)
+-{
+-    char *tag     = NULL;
+-    char *tag_val = NULL;
+-    request_rec *r = f->r;
+-    char *file = r->filename;
+-    char parsed_string[MAX_STRING_LEN];
+-
+-    if (!ctx->argc) {
+-        ap_log_rerror(APLOG_MARK,
+-                      (ctx->flags & SSI_FLAG_PRINTING)
+-                          ? APLOG_ERR : APLOG_WARNING,
+-                      0, r, APLOGNO(03196)
+-                      "missing argument for exec element in %s", r->filename);
+-    }
+-
+-    if (!(ctx->flags & SSI_FLAG_PRINTING)) {
+-        return APR_SUCCESS;
+-    }
+-
+-    if (!ctx->argc) {
+-        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-        return APR_SUCCESS;
+-    }
+-
+-    if (ctx->flags & SSI_FLAG_NO_EXEC) {
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01271) "exec used but not allowed "
+-                      "in %s", r->filename);
+-        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-        return APR_SUCCESS;
+-    }
+-
+-    while (1) {
+-        cgid_pfn_gtv(ctx, &tag, &tag_val, SSI_VALUE_DECODED);
+-        if (!tag || !tag_val) {
+-            break;
+-        }
+-
+-        if (!strcmp(tag, "cmd")) {
+-            apr_status_t rv;
+-
+-            cgid_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
+-                        SSI_EXPAND_LEAVE_NAME);
+-
+-            rv = include_cmd(ctx, f, bb, parsed_string);
+-            if (rv != APR_SUCCESS) {
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01272)
+-                              "execution failure for parameter \"%s\" "
+-                              "to tag exec in file %s", tag, r->filename);
+-                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-                break;
+-            }
+-        }
+-        else if (!strcmp(tag, "cgi")) {
+-            apr_status_t rv;
+-
+-            cgid_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
+-                        SSI_EXPAND_DROP_NAME);
+-
+-            rv = include_cgi(ctx, f, bb, parsed_string);
+-            if (rv != APR_SUCCESS) {
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01273) "invalid CGI ref "
+-                              "\"%s\" in %s", tag_val, file);
+-                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-                break;
+-            }
+-        }
+-        else {
+-            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01274) "unknown parameter "
+-                          "\"%s\" to tag exec in %s", tag, file);
+-            SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-            break;
+-        }
+-    }
+-
+-    return APR_SUCCESS;
+-}
+-/*============================================================================
+- *============================================================================
+- * This is the end of the cgi filter code moved from mod_include.
+- *============================================================================
+- *============================================================================*/
+-
+-
+ static void register_hook(apr_pool_t *p)
+ {
+     static const char * const aszPre[] = { "mod_include.c", NULL };
+@@ -1964,6 +1795,7 @@ static void register_hook(apr_pool_t *p)
+     ap_hook_pre_config(cgid_pre_config, NULL, NULL, APR_HOOK_MIDDLE);
+     ap_hook_post_config(cgid_init, aszPre, NULL, APR_HOOK_MIDDLE);
+     ap_hook_handler(cgid_handler, NULL, NULL, APR_HOOK_MIDDLE);
++    ap_hook_optional_fn_retrieve(cgi_optfns_retrieve, NULL, NULL, APR_HOOK_MIDDLE);
+ }
+ 
+ AP_DECLARE_MODULE(cgid) = {
diff --git a/httpd.spec b/httpd.spec
index 17d0745..dca53b0 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.48
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -81,7 +81,7 @@ Patch38: httpd-2.4.43-sslciphdefault.patch
 Patch39: httpd-2.4.43-sslprotdefault.patch
 Patch40: httpd-2.4.43-r1861269.patch
 Patch41: httpd-2.4.43-r1861793+.patch
-Patch42: httpd-2.4.43-r1828172+.patch
+Patch42: httpd-2.4.48-r1828172+.patch
 Patch45: httpd-2.4.43-logjournal.patch
 
 # Bug fixes
@@ -780,6 +780,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jul 16 2021 Joe Orton <jorton@redhat.com> - 2.4.48-2
+- mod_cgi/mod_cgid: update to unification from trunk
+- httpd.conf: add note on care with Listen and starting at boot
+
 * Wed Jun 02 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.48-1
 - new version 2.4.48
 - Resolves: #1964746 - httpd-2.4.48 is available

From a9fdea6de3cb29bdfaeb1f33e0889abb16e83c09 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 22 Jul 2021 07:46:13 +0000
Subject: [PATCH 236/359] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index dca53b0..d701c35 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.48
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -780,6 +780,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.48-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
 * Fri Jul 16 2021 Joe Orton <jorton@redhat.com> - 2.4.48-2
 - mod_cgi/mod_cgid: update to unification from trunk
 - httpd.conf: add note on care with Listen and starting at boot

From aee92c2c6a96e3d21560bdd5de702534dd68e323 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 6 Aug 2021 13:28:05 +0100
Subject: [PATCH 237/359] add OpenSSL 3.x compatibility patch

---
 httpd-2.4.48-openssl3.patch | 505 ++++++++++++++++++++++++++++++++++++
 httpd.spec                  |   7 +-
 pullrev.sh                  |   4 +-
 3 files changed, 513 insertions(+), 3 deletions(-)
 create mode 100644 httpd-2.4.48-openssl3.patch

diff --git a/httpd-2.4.48-openssl3.patch b/httpd-2.4.48-openssl3.patch
new file mode 100644
index 0000000..f218d16
--- /dev/null
+++ b/httpd-2.4.48-openssl3.patch
@@ -0,0 +1,505 @@
+
+https://github.com/apache/httpd/pull/258
+
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index 4da24eddcc..5d199cddaf 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -91,7 +91,6 @@ static int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)
+ 
+     return 1;
+ }
+-#endif
+ 
+ /*
+  * Grab well-defined DH parameters from OpenSSL, see the BN_get_rfc*
+@@ -171,6 +170,7 @@ DH *modssl_get_dh_params(unsigned keylen)
+         
+     return NULL; /* impossible to reach. */
+ }
++#endif
+ 
+ static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf,
+                                        server_rec *s)
+@@ -440,8 +440,9 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
+ 
+     modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */
+ 
++#if MODSSL_USE_OPENSSL_PRE_1_1_API
+     init_dh_params();
+-#if !MODSSL_USE_OPENSSL_PRE_1_1_API
++#else
+     init_bio_methods();
+ #endif
+ 
+@@ -834,7 +835,11 @@ static void ssl_init_ctx_callbacks(server_rec *s,
+ {
+     SSL_CTX *ctx = mctx->ssl_ctx;
+ 
++#if MODSSL_USE_OPENSSL_PRE_1_1_API
+     SSL_CTX_set_tmp_dh_callback(ctx,  ssl_callback_TmpDH);
++#else
++    SSL_CTX_set_dh_auto(ctx, 1);
++#endif
+ 
+     SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
+ 
+@@ -843,6 +848,23 @@ static void ssl_init_ctx_callbacks(server_rec *s,
+ #endif
+ }
+ 
++static APR_INLINE
++int modssl_CTX_load_verify_locations(SSL_CTX *ctx,
++                                     const char *file,
++                                     const char *path)
++{
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++    if (!SSL_CTX_load_verify_locations(ctx, file, path))
++        return 0;
++#else
++    if (file && !SSL_CTX_load_verify_file(ctx, file))
++        return 0;
++    if (path && !SSL_CTX_load_verify_dir(ctx, path))
++        return 0;
++#endif
++    return 1;
++}
++
+ static apr_status_t ssl_init_ctx_verify(server_rec *s,
+                                         apr_pool_t *p,
+                                         apr_pool_t *ptemp,
+@@ -883,10 +905,8 @@ static apr_status_t ssl_init_ctx_verify(server_rec *s,
+         ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,
+                      "Configuring client authentication");
+ 
+-        if (!SSL_CTX_load_verify_locations(ctx,
+-                                           mctx->auth.ca_cert_file,
+-                                           mctx->auth.ca_cert_path))
+-        {
++        if (!modssl_CTX_load_verify_locations(ctx, mctx->auth.ca_cert_file,
++                                                   mctx->auth.ca_cert_path)) {
+             ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01895)
+                     "Unable to configure verify locations "
+                     "for client authentication");
+@@ -971,6 +991,23 @@ static apr_status_t ssl_init_ctx_cipher_suite(server_rec *s,
+     return APR_SUCCESS;
+ }
+ 
++static APR_INLINE
++int modssl_X509_STORE_load_locations(X509_STORE *store,
++                                     const char *file,
++                                     const char *path)
++{
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++    if (!X509_STORE_load_locations(store, file, path))
++        return 0;
++#else
++    if (file && !X509_STORE_load_file(store, file))
++        return 0;
++    if (path && !X509_STORE_load_path(store, path))
++        return 0;
++#endif
++    return 1;
++}
++
+ static apr_status_t ssl_init_ctx_crl(server_rec *s,
+                                      apr_pool_t *p,
+                                      apr_pool_t *ptemp,
+@@ -1009,8 +1046,8 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s,
+     ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900)
+                  "Configuring certificate revocation facility");
+ 
+-    if (!store || !X509_STORE_load_locations(store, mctx->crl_file,
+-                                             mctx->crl_path)) {
++    if (!store || !modssl_X509_STORE_load_locations(store, mctx->crl_file,
++                                                           mctx->crl_path)) {
+         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901)
+                      "Host %s: unable to configure X.509 CRL storage "
+                      "for certificate revocation", mctx->sc->vhost_id);
+@@ -1239,6 +1276,31 @@ static int ssl_no_passwd_prompt_cb(char *buf, int size, int rwflag,
+    return 0;
+ }
+ 
++static APR_INLINE int modssl_DH_bits(DH *dh)
++{
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++    return DH_bits(dh);
++#else
++    return BN_num_bits(DH_get0_p(dh));
++#endif
++}
++
++/* SSL_CTX_use_PrivateKey_file() can fail either because the private
++ * key was encrypted, or due to a mismatch between an already-loaded
++ * cert and the key - a common misconfiguration - from calling
++ * X509_check_private_key().  This macro is passed the last error code
++ * off the OpenSSL stack and evaluates to true only for the first
++ * case.  With OpenSSL < 3 the second case is identifiable by the
++ * function code, but function codes are not used from 3.0. */
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_FUNC(ec) != X509_F_X509_CHECK_PRIVATE_KEY)
++#else
++#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_LIB != ERR_LIB_X509            \
++                                 || (ERR_GET_REASON(ec) != X509_R_KEY_TYPE_MISMATCH \
++                                     && ERR_GET_REASON(ec) != X509_R_KEY_VALUES_MISMATCH \
++                                     && ERR_GET_REASON(ec) != X509_R_UNKNOWN_KEY_TYPE))
++#endif
++
+ static apr_status_t ssl_init_server_certs(server_rec *s,
+                                           apr_pool_t *p,
+                                           apr_pool_t *ptemp,
+@@ -1249,7 +1311,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+     const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile;
+     int i;
+     X509 *cert;
+-    DH *dhparams;
++    DH *dh;
+ #ifdef HAVE_ECC
+     EC_GROUP *ecparams = NULL;
+     int nid;
+@@ -1344,8 +1406,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+         }
+         else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
+                                               SSL_FILETYPE_PEM) < 1)
+-                 && (ERR_GET_FUNC(ERR_peek_last_error())
+-                     != X509_F_X509_CHECK_PRIVATE_KEY)) {
++                 && CHECK_PRIVKEY_ERROR(ERR_peek_last_error())) {
+             ssl_asn1_t *asn1;
+             const unsigned char *ptr;
+ 
+@@ -1434,12 +1495,12 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+      */
+     certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *);
+     if (certfile && !modssl_is_engine_id(certfile)
+-        && (dhparams = ssl_dh_GetParamFromFile(certfile))) {
+-        SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);
++        && (dh = ssl_dh_GetParamFromFile(certfile))) {
++        SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh);
+         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
+                      "Custom DH parameters (%d bits) for %s loaded from %s",
+-                     DH_bits(dhparams), vhost_id, certfile);
+-        DH_free(dhparams);
++                     modssl_DH_bits(dh), vhost_id, certfile);
++        DH_free(dh);
+     }
+ 
+ #ifdef HAVE_ECC
+@@ -1490,6 +1551,7 @@ static apr_status_t ssl_init_ticket_key(server_rec *s,
+     char buf[TLSEXT_TICKET_KEY_LEN];
+     char *path;
+     modssl_ticket_key_t *ticket_key = mctx->ticket_key;
++    int res;
+ 
+     if (!ticket_key->file_path) {
+         return APR_SUCCESS;
+@@ -1517,11 +1579,22 @@ static apr_status_t ssl_init_ticket_key(server_rec *s,
+     }
+ 
+     memcpy(ticket_key->key_name, buf, 16);
+-    memcpy(ticket_key->hmac_secret, buf + 16, 16);
+     memcpy(ticket_key->aes_key, buf + 32, 16);
+-
+-    if (!SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx,
+-                                          ssl_callback_SessionTicket)) {
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++    memcpy(ticket_key->hmac_secret, buf + 16, 16);
++    res = SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx,
++                                           ssl_callback_SessionTicket);
++#else
++    ticket_key->mac_params[0] =
++        OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, buf + 16, 16);
++    ticket_key->mac_params[1] =
++        OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, "sha256", 0);
++    ticket_key->mac_params[2] =
++        OSSL_PARAM_construct_end();
++    res = SSL_CTX_set_tlsext_ticket_key_evp_cb(mctx->ssl_ctx,
++                                               ssl_callback_SessionTicket);
++#endif
++    if (!res) {
+         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01913)
+                      "Unable to initialize TLS session ticket key callback "
+                      "(incompatible OpenSSL version?)");
+@@ -1652,7 +1725,7 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s,
+         return ssl_die(s);
+     }
+ 
+-    X509_STORE_load_locations(store, pkp->ca_cert_file, NULL);
++    modssl_X509_STORE_load_locations(store, pkp->ca_cert_file, NULL);
+ 
+     for (n = 0; n < ncerts; n++) {
+         int i;
+@@ -2249,10 +2322,11 @@ apr_status_t ssl_init_ModuleKill(void *data)
+ 
+     }
+ 
+-#if !MODSSL_USE_OPENSSL_PRE_1_1_API
++#if MODSSL_USE_OPENSSL_PRE_1_1_API
++    free_dh_params();
++#else
+     free_bio_methods();
+ #endif
+-    free_dh_params();
+ 
+     return APR_SUCCESS;
+ }
+diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c
+index cabf753790..3db7077f1e 100644
+--- a/modules/ssl/ssl_engine_io.c
++++ b/modules/ssl/ssl_engine_io.c
+@@ -194,6 +194,10 @@ static int bio_filter_destroy(BIO *bio)
+ static int bio_filter_out_read(BIO *bio, char *out, int outl)
+ {
+     /* this is never called */
++    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
++    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
++                  "BUG: %s() should not be called", "bio_filter_out_read");
++    AP_DEBUG_ASSERT(0);
+     return -1;
+ }
+ 
+@@ -293,12 +297,20 @@ static long bio_filter_out_ctrl(BIO *bio, int cmd, long num, void *ptr)
+ static int bio_filter_out_gets(BIO *bio, char *buf, int size)
+ {
+     /* this is never called */
++    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
++    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
++                  "BUG: %s() should not be called", "bio_filter_out_gets");
++    AP_DEBUG_ASSERT(0);
+     return -1;
+ }
+ 
+ static int bio_filter_out_puts(BIO *bio, const char *str)
+ {
+     /* this is never called */
++    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
++    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
++                  "BUG: %s() should not be called", "bio_filter_out_puts");
++    AP_DEBUG_ASSERT(0);
+     return -1;
+ }
+ 
+@@ -533,22 +545,47 @@ static int bio_filter_in_read(BIO *bio, char *in, int inlen)
+ 
+ static int bio_filter_in_write(BIO *bio, const char *in, int inl)
+ {
++    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
++    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
++                  "BUG: %s() should not be called", "bio_filter_in_write");
++    AP_DEBUG_ASSERT(0);
+     return -1;
+ }
+ 
+ static int bio_filter_in_puts(BIO *bio, const char *str)
+ {
++    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
++    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
++                  "BUG: %s() should not be called", "bio_filter_in_puts");
++    AP_DEBUG_ASSERT(0);
+     return -1;
+ }
+ 
+ static int bio_filter_in_gets(BIO *bio, char *buf, int size)
+ {
++    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
++    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
++                  "BUG: %s() should not be called", "bio_filter_in_gets");
++    AP_DEBUG_ASSERT(0);
+     return -1;
+ }
+ 
+ static long bio_filter_in_ctrl(BIO *bio, int cmd, long num, void *ptr)
+ {
+-    return -1;
++    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
++    switch (cmd) {
++#ifdef BIO_CTRL_EOF
++    case BIO_CTRL_EOF:
++        return inctx->rc == APR_EOF;
++#endif
++    default:
++        break;
++    }
++    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
++                  "BUG: bio_filter_in_ctrl() should not be called with cmd=%i",
++                  cmd);
++    AP_DEBUG_ASSERT(0);
++    return 0;
+ }
+ 
+ #if MODSSL_USE_OPENSSL_PRE_1_1_API
+@@ -573,7 +610,7 @@ static BIO_METHOD bio_filter_in_method = {
+     bio_filter_in_read,
+     bio_filter_in_puts,         /* puts is never called */
+     bio_filter_in_gets,         /* gets is never called */
+-    bio_filter_in_ctrl,         /* ctrl is never called */
++    bio_filter_in_ctrl,         /* ctrl is called for EOF check */
+     bio_filter_create,
+     bio_filter_destroy,
+     NULL
+diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
+index b99dcf19d4..aced92d2d0 100644
+--- a/modules/ssl/ssl_engine_kernel.c
++++ b/modules/ssl/ssl_engine_kernel.c
+@@ -1685,6 +1685,7 @@ const authz_provider ssl_authz_provider_verify_client =
+ **  _________________________________________________________________
+ */
+ 
++#if MODSSL_USE_OPENSSL_PRE_1_1_API
+ /*
+  * Hand out standard DH parameters, based on the authentication strength
+  */
+@@ -1730,6 +1731,7 @@ DH *ssl_callback_TmpDH(SSL *ssl, int export, int keylen)
+ 
+     return modssl_get_dh_params(keylen);
+ }
++#endif
+ 
+ /*
+  * This OpenSSL callback function is called when OpenSSL
+@@ -2614,7 +2616,11 @@ int ssl_callback_SessionTicket(SSL *ssl,
+                                unsigned char *keyname,
+                                unsigned char *iv,
+                                EVP_CIPHER_CTX *cipher_ctx,
+-                               HMAC_CTX *hctx,
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++                               HMAC_CTX *hmac_ctx,
++#else
++                               EVP_MAC_CTX *mac_ctx,
++#endif
+                                int mode)
+ {
+     conn_rec *c = (conn_rec *)SSL_get_app_data(ssl);
+@@ -2641,7 +2647,13 @@ int ssl_callback_SessionTicket(SSL *ssl,
+         }
+         EVP_EncryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL,
+                            ticket_key->aes_key, iv);
+-        HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL);
++
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++        HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16,
++                     tlsext_tick_md(), NULL);
++#else
++        EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params);
++#endif
+ 
+         ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02289)
+                       "TLS session ticket key for %s successfully set, "
+@@ -2662,7 +2674,13 @@ int ssl_callback_SessionTicket(SSL *ssl,
+ 
+         EVP_DecryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL,
+                            ticket_key->aes_key, iv);
+-        HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL);
++
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++        HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16,
++                     tlsext_tick_md(), NULL);
++#else
++        EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params);
++#endif
+ 
+         ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02290)
+                       "TLS session ticket key for %s successfully set, "
+diff --git a/modules/ssl/ssl_engine_log.c b/modules/ssl/ssl_engine_log.c
+index 7dbbbdb55e..3b3ceacf0a 100644
+--- a/modules/ssl/ssl_engine_log.c
++++ b/modules/ssl/ssl_engine_log.c
+@@ -78,6 +78,16 @@ apr_status_t ssl_die(server_rec *s)
+     return APR_EGENERAL;
+ }
+ 
++static APR_INLINE
++unsigned long modssl_ERR_peek_error_data(const char **data, int *flags)
++{
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++    return ERR_peek_error_line_data(NULL, NULL, data, flags);
++#else
++    return ERR_peek_error_data(data, flags);
++#endif
++}
++
+ /*
+  * Prints the SSL library error information.
+  */
+@@ -87,7 +97,7 @@ void ssl_log_ssl_error(const char *file, int line, int level, server_rec *s)
+     const char *data;
+     int flags;
+ 
+-    while ((e = ERR_peek_error_line_data(NULL, NULL, &data, &flags))) {
++    while ((e = modssl_ERR_peek_error_data(&data, &flags))) {
+         const char *annotation;
+         char err[256];
+ 
+diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h
+index a6fc7513a2..b091c58c94 100644
+--- a/modules/ssl/ssl_private.h
++++ b/modules/ssl/ssl_private.h
+@@ -89,6 +89,9 @@
+ /* must be defined before including ssl.h */
+ #define OPENSSL_NO_SSL_INTERN
+ #endif
++#if OPENSSL_VERSION_NUMBER >= 0x30000000
++#include <openssl/core_names.h>
++#endif
+ #include <openssl/ssl.h>
+ #include <openssl/err.h>
+ #include <openssl/x509.h>
+@@ -134,13 +137,12 @@
+         SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL)
+ #define SSL_CTX_set_max_proto_version(ctx, version) \
+         SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL)
+-#elif LIBRESSL_VERSION_NUMBER < 0x2070000f
++#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */
+ /* LibreSSL before 2.7 declares OPENSSL_VERSION_NUMBER == 2.0 but does not
+  * include most changes from OpenSSL >= 1.1 (new functions, macros, 
+  * deprecations, ...), so we have to work around this...
+  */
+-#define MODSSL_USE_OPENSSL_PRE_1_1_API (1)
+-#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */
++#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f)
+ #else /* defined(LIBRESSL_VERSION_NUMBER) */
+ #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L)
+ #endif
+@@ -674,7 +676,11 @@ typedef struct {
+ typedef struct {
+     const char *file_path;
+     unsigned char key_name[16];
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+     unsigned char hmac_secret[16];
++#else
++    OSSL_PARAM mac_params[3];
++#endif
+     unsigned char aes_key[16];
+ } modssl_ticket_key_t;
+ #endif
+@@ -938,8 +944,16 @@ int          ssl_callback_ServerNameIndication(SSL *, int *, modssl_ctx_t *);
+ int          ssl_callback_ClientHello(SSL *, int *, void *);
+ #endif
+ #ifdef HAVE_TLS_SESSION_TICKETS
+-int         ssl_callback_SessionTicket(SSL *, unsigned char *, unsigned char *,
+-                                       EVP_CIPHER_CTX *, HMAC_CTX *, int);
++int ssl_callback_SessionTicket(SSL *ssl,
++                               unsigned char *keyname,
++                               unsigned char *iv,
++                               EVP_CIPHER_CTX *cipher_ctx,
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++                               HMAC_CTX *hmac_ctx,
++#else
++                               EVP_MAC_CTX *mac_ctx,
++#endif
++                               int mode);
+ #endif
+ 
+ #ifdef HAVE_TLS_ALPN
+@@ -1112,10 +1126,12 @@ void ssl_init_ocsp_certificates(server_rec *s, modssl_ctx_t *mctx);
+ 
+ #endif
+ 
++#if MODSSL_USE_OPENSSL_PRE_1_1_API
+ /* Retrieve DH parameters for given key length.  Return value should
+  * be treated as unmutable, since it is stored in process-global
+  * memory. */
+ DH *modssl_get_dh_params(unsigned keylen);
++#endif
+ 
+ /* Returns non-zero if the request was made over SSL/TLS.  If sslconn
+  * is non-NULL and the request is using SSL/TLS, sets *sslconn to the
diff --git a/httpd.spec b/httpd.spec
index d701c35..91e0ce6 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.48
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -75,6 +75,7 @@ Patch24: httpd-2.4.43-corelimit.patch
 Patch25: httpd-2.4.43-selinux.patch
 Patch26: httpd-2.4.43-gettid.patch
 Patch27: httpd-2.4.43-icons.patch
+Patch28: httpd-2.4.48-openssl3.patch
 Patch30: httpd-2.4.43-cachehardmax.patch
 Patch34: httpd-2.4.43-socket-activation.patch
 Patch38: httpd-2.4.43-sslciphdefault.patch
@@ -227,6 +228,7 @@ written in the Lua programming language.
 %patch25 -p1 -b .selinux
 %patch26 -p1 -b .gettid
 %patch27 -p1 -b .icons
+%patch28 -p1 -b .openssl3
 %patch30 -p1 -b .cachehardmax
 %patch34 -p1 -b .socketactivation
 %patch38 -p1 -b .sslciphdefault
@@ -780,6 +782,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Aug  6 2021 Joe Orton <jorton@redhat.com> - 2.4.48-4
+- add OpenSSL 3.x compatibility patch
+
 * Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.48-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
 
diff --git a/pullrev.sh b/pullrev.sh
index 27bbcb3..f7fb600 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then
 fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
-#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.46
+repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+ver=2.4.48
 prefix="httpd-${ver}"
 suffix="${SUFFIX:-r$1${2:++}}"
 fn="${prefix}-${suffix}.patch"

From f4a1af86c2020b698821d9061d1c3f40bfad81e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 6 Aug 2021 16:57:00 +0200
Subject: [PATCH 238/359] add symlink to system logo for noindex test page

---
 httpd.spec   | 8 +++++++-
 welcome.conf | 1 +
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 91e0ce6..cb5e9d6 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.48
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -485,6 +485,9 @@ rm -v $RPM_BUILD_ROOT%{docroot}/html/*.html \
 ln -s ../../pixmaps/poweredby.png \
         $RPM_BUILD_ROOT%{contentdir}/icons/poweredby.png
 
+# Symlink for the system logo
+ln -s ../../pixmaps/system_noindex_logo.png \
+        $RPM_BUILD_ROOT%{contentdir}/icons/system_noindex_logo.png
 
 # symlinks for /etc/httpd
 rmdir $RPM_BUILD_ROOT/etc/httpd/{state,run}
@@ -782,6 +785,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Aug 06 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.48-5
+- add symlink to system logo for noindex test page
+
 * Fri Aug  6 2021 Joe Orton <jorton@redhat.com> - 2.4.48-4
 - add OpenSSL 3.x compatibility patch
 
diff --git a/welcome.conf b/welcome.conf
index a5e221b..232c251 100644
--- a/welcome.conf
+++ b/welcome.conf
@@ -17,3 +17,4 @@
 
 Alias /.noindex.html /usr/share/httpd/noindex/index.html
 Alias /poweredby.png /usr/share/httpd/icons/apache_pb3.png
+Alias /system_noindex_logo.png /usr/share/httpd/icons/system_noindex_logo.png

From 6739add2357fcf8acdfc5cbbc41d0659f63e4034 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Mon, 9 Aug 2021 14:30:36 +0200
Subject: [PATCH 239/359] - fix testpage's symlink location

---
 httpd.spec | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index cb5e9d6..6e0b078 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.48
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -486,7 +486,7 @@ ln -s ../../pixmaps/poweredby.png \
         $RPM_BUILD_ROOT%{contentdir}/icons/poweredby.png
 
 # Symlink for the system logo
-ln -s ../../pixmaps/system_noindex_logo.png \
+ln -s ../../pixmaps/system-noindex-logo.png \
         $RPM_BUILD_ROOT%{contentdir}/icons/system_noindex_logo.png
 
 # symlinks for /etc/httpd
@@ -785,7 +785,7 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Fri Aug 06 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.48-5
+* Fri Aug 06 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.48-6
 - add symlink to system logo for noindex test page
 
 * Fri Aug  6 2021 Joe Orton <jorton@redhat.com> - 2.4.48-4

From 6622f1845a81159896cc0fb21aa743ef11298f08 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Mon, 9 Aug 2021 16:11:37 +0200
Subject: [PATCH 240/359] - Use symlink pointing to system logo only for RHEL
 for now, so we have no dangling links on Fedora and others.

---
 httpd.spec | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 6e0b078..48079c8 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.48
-Release: 6%{?dist}
+Release: 7%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -486,8 +486,10 @@ ln -s ../../pixmaps/poweredby.png \
         $RPM_BUILD_ROOT%{contentdir}/icons/poweredby.png
 
 # Symlink for the system logo
+%if 0%{?rhel} >= 9
 ln -s ../../pixmaps/system-noindex-logo.png \
         $RPM_BUILD_ROOT%{contentdir}/icons/system_noindex_logo.png
+%endif
 
 # symlinks for /etc/httpd
 rmdir $RPM_BUILD_ROOT/etc/httpd/{state,run}
@@ -785,7 +787,7 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Fri Aug 06 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.48-6
+* Fri Aug 06 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.48-7
 - add symlink to system logo for noindex test page
 
 * Fri Aug  6 2021 Joe Orton <jorton@redhat.com> - 2.4.48-4

From ed175de6b24b14b90d5454d0cf9bc218f0cddef8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Branislav=20N=C3=A1ter?= <bnater@redhat.com>
Date: Thu, 1 Jul 2021 17:42:02 +0200
Subject: [PATCH 241/359] Adding test plan with tier1 tests

---
 plans/tier1-public.fmf | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 plans/tier1-public.fmf

diff --git a/plans/tier1-public.fmf b/plans/tier1-public.fmf
new file mode 100644
index 0000000..c181caa
--- /dev/null
+++ b/plans/tier1-public.fmf
@@ -0,0 +1,7 @@
+summary: Public (Fedora) Tier1 beakerlib tests
+discover:
+    how: fmf
+    url: https://src.fedoraproject.org/tests/httpd.git
+    filter: 'tier: 1'
+execute:
+    how: tmt

From e7917f9dac2c67c64f1d5154619536cd08d97e78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Branislav=20N=C3=A1ter?= <bnater@redhat.com>
Date: Thu, 1 Jul 2021 18:04:27 +0200
Subject: [PATCH 242/359] Report separate results

---
 ci.fmf | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 ci.fmf

diff --git a/ci.fmf b/ci.fmf
new file mode 100644
index 0000000..c5aa0e0
--- /dev/null
+++ b/ci.fmf
@@ -0,0 +1 @@
+resultsdb-testcase: separate

From dc18834d53d3db121b9db562d362c0c703ee71c5 Mon Sep 17 00:00:00 2001
From: Sahana Prasad <sahana@redhat.com>
Date: Tue, 14 Sep 2021 19:04:25 +0200
Subject: [PATCH 243/359] Rebuilt with OpenSSL 3.0.0

---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 48079c8..fa2a75d 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.48
-Release: 7%{?dist}
+Release: 8%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -787,6 +787,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.4.48-8
+- Rebuilt with OpenSSL 3.0.0
+
 * Fri Aug 06 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.48-7
 - add symlink to system logo for noindex test page
 

From 817ac0a9a475f26768e49342e055307368258b74 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 17 Sep 2021 15:04:41 +0200
Subject: [PATCH 244/359] new version 2.4.49 (#2004776)

---
 .gitignore | 1 +
 httpd.spec | 7 +++++--
 sources    | 6 +++---
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index ea4148c..13567f6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,3 +39,4 @@ x86_64
 /KEYS
 /httpd-2.4.46.tar.bz2.asc
 /httpd-2.4.48.tar.bz2.asc
+/httpd-2.4.49.tar.bz2.asc
diff --git a/httpd.spec b/httpd.spec
index fa2a75d..bf19f96 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.48
-Release: 8%{?dist}
+Version: 2.4.49
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -787,6 +787,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Sep 16 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.49-1
+- new version 2.4.49 (#2004776)
+
 * Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.4.48-8
 - Rebuilt with OpenSSL 3.0.0
 
diff --git a/sources b/sources
index 5e6cb0c..8d356ef 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.48.tar.bz2) = 6c250626f1e7d10428a92d984fd48ff841effcc8705f7816ab71b681bbd51d0012ad158dcd13763fe7d630311f2de258b27574603140d648be42796ab8326724
-SHA512 (httpd-2.4.48.tar.bz2.asc) = 9f125de75107b04dd01f71e9e233b1602658b49e38371931b98dc1092be8df05cf7243b5564fa2f56f46544bef61a54a721dee5ca17ce823a2302a7c3698a195
-SHA512 (KEYS) = 7ab66c64eaa4a152e88a913993c8ea0d9c46fd5865788e7b32a9619784d245cef8bddd9700368e3d63ce88ed94df8933e5892878523dc0fce697331136bb829e
+SHA512 (httpd-2.4.49.tar.bz2) = 418e277232cf30a81d02b8554e31aaae6433bbea842bdb81e47a609469395cc4891183fb6ee02bd669edb2392c2007869b19da29f5998b8fd5c7d3142db310dd
+SHA512 (httpd-2.4.49.tar.bz2.asc) = f3d31cea838c2f965c6f7bea85afb85e4a12fbbcc5162fb8eebf2ba1e808326f99401e0c7f36bd4cb2f32bbac3c206d0bcb5f5b1b15237cb651c3b43d39f4cf4
+SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192

From 006b900bcd24ff22bae2f37d62fb423ddab71bc9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Branislav=20N=C3=A1ter?= <bnater@redhat.com>
Date: Tue, 21 Sep 2021 12:04:37 +0200
Subject: [PATCH 245/359] Adding gating configuration

---
 gating.yaml | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 gating.yaml

diff --git a/gating.yaml b/gating.yaml
new file mode 100644
index 0000000..d899fa6
--- /dev/null
+++ b/gating.yaml
@@ -0,0 +1,7 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_contexts: [bodhi_update_push_testing]
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier1-public.functional}

From f359686a9f13791c7b48f1050829e615a7f44f6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Branislav=20N=C3=A1ter?= <bnater@redhat.com>
Date: Tue, 21 Sep 2021 13:13:25 +0200
Subject: [PATCH 246/359] Fixing plan name

---
 gating.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gating.yaml b/gating.yaml
index d899fa6..c7a9f0c 100644
--- a/gating.yaml
+++ b/gating.yaml
@@ -4,4 +4,4 @@ product_versions:
 decision_contexts: [bodhi_update_push_testing]
 subject_type: koji_build
 rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier1-public.functional}
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}

From 59e7f24546153ddcf1351be5e67a0040a79051aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 22 Sep 2021 13:08:13 +0200
Subject: [PATCH 247/359] Rebuilt for CI testing

---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index bf19f96..81df51e 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.49
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -787,6 +787,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Sep 22 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.49-2
+- Rebuilt for CI testing
+
 * Thu Sep 16 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.49-1
 - new version 2.4.49 (#2004776)
 

From cd5aa0e938eef8e98eef9c9d163b8302e3c0296d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Branislav=20N=C3=A1ter?= <bnater@redhat.com>
Date: Wed, 22 Sep 2021 17:22:22 +0200
Subject: [PATCH 248/359] Use bodhi_update_push_stable decision context

---
 gating.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gating.yaml b/gating.yaml
index c7a9f0c..ce08116 100644
--- a/gating.yaml
+++ b/gating.yaml
@@ -1,7 +1,7 @@
 --- !Policy
 product_versions:
   - fedora-*
-decision_contexts: [bodhi_update_push_testing]
+decision_contexts: [bodhi_update_push_stable]
 subject_type: koji_build
 rules:
   - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}

From 71e41b5352bad307bab532adfab65bff4e312789 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 22 Sep 2021 18:35:12 +0200
Subject: [PATCH 249/359] Rebuilt for CI testing

---
 httpd.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 81df51e..db5971d 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.49
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -787,7 +787,7 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Wed Sep 22 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.49-2
+* Wed Sep 22 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.49-3
 - Rebuilt for CI testing
 
 * Thu Sep 16 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.49-1

From cbf5ce7a7e23fa2ff6bb3906c2f716045e1eddce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Tue, 5 Oct 2021 11:54:24 +0200
Subject: [PATCH 250/359] new version 2.4.50

---
 .gitignore | 1 +
 httpd.spec | 7 +++++--
 sources    | 4 ++--
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 13567f6..af7dee4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,3 +40,4 @@ x86_64
 /httpd-2.4.46.tar.bz2.asc
 /httpd-2.4.48.tar.bz2.asc
 /httpd-2.4.49.tar.bz2.asc
+/httpd-2.4.50.tar.bz2.asc
diff --git a/httpd.spec b/httpd.spec
index db5971d..d15c8bb 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.49
-Release: 3%{?dist}
+Version: 2.4.50
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -787,6 +787,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Oct 05 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.50-1
+- new version 2.4.50
+
 * Wed Sep 22 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.49-3
 - Rebuilt for CI testing
 
diff --git a/sources b/sources
index 8d356ef..63a8c16 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.49.tar.bz2) = 418e277232cf30a81d02b8554e31aaae6433bbea842bdb81e47a609469395cc4891183fb6ee02bd669edb2392c2007869b19da29f5998b8fd5c7d3142db310dd
-SHA512 (httpd-2.4.49.tar.bz2.asc) = f3d31cea838c2f965c6f7bea85afb85e4a12fbbcc5162fb8eebf2ba1e808326f99401e0c7f36bd4cb2f32bbac3c206d0bcb5f5b1b15237cb651c3b43d39f4cf4
+SHA512 (httpd-2.4.50.tar.bz2) = b1afbaf44e503b822ff2b443881dcb44a93aa55d496f88ae399a2e7def05f78590f266a16da1f2c0aac88e463b76fba20843b1e20a102e76c8269de6fae3e158
+SHA512 (httpd-2.4.50.tar.bz2.asc) = 31ec3cbf342905f63fc070ae51103a695736a0fc5689d38845a7802fa6b48d86bafd5afcf57f7bbee4435691093326ec5f07a904fd3fa877e0453a3830425776
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192

From 9c327bba1d45d53ebce3ba96c03d273b34f2ed93 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <patrick@puiterwijk.org>
Date: Thu, 7 Oct 2021 20:34:53 +0200
Subject: [PATCH 251/359] new version 2.4.51

---
 .gitignore | 1 +
 httpd.spec | 5 ++++-
 sources    | 5 ++---
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index af7dee4..bd6e204 100644
--- a/.gitignore
+++ b/.gitignore
@@ -41,3 +41,4 @@ x86_64
 /httpd-2.4.48.tar.bz2.asc
 /httpd-2.4.49.tar.bz2.asc
 /httpd-2.4.50.tar.bz2.asc
+/httpd-2.4.51.tar.bz2.asc
diff --git a/httpd.spec b/httpd.spec
index d15c8bb..77b51a8 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,7 +12,7 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.50
+Version: 2.4.51
 Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
@@ -787,6 +787,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Oct 07 2021 Patrick Uiterwijk <patrick@puiterwijk.org> - 2.4.51-1
+- new version 2.4.51
+
 * Tue Oct 05 2021 Luboš Uhliarik <luhliari@redhat.com> - 2.4.50-1
 - new version 2.4.50
 
diff --git a/sources b/sources
index 63a8c16..a3daaf4 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,2 @@
-SHA512 (httpd-2.4.50.tar.bz2) = b1afbaf44e503b822ff2b443881dcb44a93aa55d496f88ae399a2e7def05f78590f266a16da1f2c0aac88e463b76fba20843b1e20a102e76c8269de6fae3e158
-SHA512 (httpd-2.4.50.tar.bz2.asc) = 31ec3cbf342905f63fc070ae51103a695736a0fc5689d38845a7802fa6b48d86bafd5afcf57f7bbee4435691093326ec5f07a904fd3fa877e0453a3830425776
-SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192
+SHA512 (httpd-2.4.51.tar.bz2) = 9fb07c4b176f5c0485a143e2b1bb1085345ca9120b959974f68c37a8911a57894d2cb488b1b42fdf3102860b99e890204f5e9fa7ae3828b481119c563812cc66
+SHA512 (httpd-2.4.51.tar.bz2.asc) = c63f2b08eb0b7e688c4a89b4be1d968c9e4a3f09714ffc4fb9b2210b6694b8c90f4067aec63601ec41987507bba8dfcef15f54b8c0707cc49414c9c76dd5d8ce

From a8ac1433954955b14afb16e5d8e94026fe51496f Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <patrick@puiterwijk.org>
Date: Thu, 7 Oct 2021 20:39:11 +0200
Subject: [PATCH 252/359] Re-add KEYS file

---
 sources | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sources b/sources
index a3daaf4..edbf616 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,3 @@
 SHA512 (httpd-2.4.51.tar.bz2) = 9fb07c4b176f5c0485a143e2b1bb1085345ca9120b959974f68c37a8911a57894d2cb488b1b42fdf3102860b99e890204f5e9fa7ae3828b481119c563812cc66
 SHA512 (httpd-2.4.51.tar.bz2.asc) = c63f2b08eb0b7e688c4a89b4be1d968c9e4a3f09714ffc4fb9b2210b6694b8c90f4067aec63601ec41987507bba8dfcef15f54b8c0707cc49414c9c76dd5d8ce
+SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192

From 0da20265b49dee20822800585b9c12cc439fdf27 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 8 Oct 2021 08:49:54 +0100
Subject: [PATCH 253/359] Add comment on differences with upstream apachectl,
 no functional change.

---
 apachectl.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/apachectl.sh b/apachectl.sh
index 766cfba..823db3b 100755
--- a/apachectl.sh
+++ b/apachectl.sh
@@ -15,6 +15,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+###
+### NOTE: This is a replacement version of the "apachectl" script with
+### some differences in behaviour to the version distributed with
+### Apache httpd.  Please read the apachectl(8) man page for more
+### information.
+###
+
 if [ "x$1" = "x-k" ]; then
     shift
 fi

From 485637a10d7dcace7c60e54f5df10cf824dc421a Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 12 Oct 2021 13:53:59 +0100
Subject: [PATCH 254/359] mod_ssl: updated patch for OpenSSL 3.0 compatibility
 (#2007178)

---
 ...nssl3.patch => httpd-2.4.51-openssl3.patch | 104 +++++++++---------
 httpd.spec                                    |   7 +-
 2 files changed, 57 insertions(+), 54 deletions(-)
 rename httpd-2.4.48-openssl3.patch => httpd-2.4.51-openssl3.patch (83%)

diff --git a/httpd-2.4.48-openssl3.patch b/httpd-2.4.51-openssl3.patch
similarity index 83%
rename from httpd-2.4.48-openssl3.patch
rename to httpd-2.4.51-openssl3.patch
index f218d16..a4423c7 100644
--- a/httpd-2.4.48-openssl3.patch
+++ b/httpd-2.4.51-openssl3.patch
@@ -1,11 +1,9 @@
 
 https://github.com/apache/httpd/pull/258
 
-diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
-index 4da24eddcc..5d199cddaf 100644
---- a/modules/ssl/ssl_engine_init.c
-+++ b/modules/ssl/ssl_engine_init.c
-@@ -91,7 +91,6 @@ static int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)
+--- httpd-2.4.51/modules/ssl/ssl_engine_init.c.openssl3
++++ httpd-2.4.51/modules/ssl/ssl_engine_init.c
+@@ -91,7 +91,6 @@
  
      return 1;
  }
@@ -13,7 +11,7 @@ index 4da24eddcc..5d199cddaf 100644
  
  /*
   * Grab well-defined DH parameters from OpenSSL, see the BN_get_rfc*
-@@ -171,6 +170,7 @@ DH *modssl_get_dh_params(unsigned keylen)
+@@ -171,6 +170,7 @@
          
      return NULL; /* impossible to reach. */
  }
@@ -21,7 +19,7 @@ index 4da24eddcc..5d199cddaf 100644
  
  static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf,
                                         server_rec *s)
-@@ -440,8 +440,9 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
+@@ -440,8 +440,9 @@
  
      modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */
  
@@ -32,19 +30,19 @@ index 4da24eddcc..5d199cddaf 100644
      init_bio_methods();
  #endif
  
-@@ -834,7 +835,11 @@ static void ssl_init_ctx_callbacks(server_rec *s,
+@@ -862,7 +863,11 @@
  {
      SSL_CTX *ctx = mctx->ssl_ctx;
  
 +#if MODSSL_USE_OPENSSL_PRE_1_1_API
++    /* Note that for OpenSSL>=1.1, auto selection is enabled via
++     * SSL_CTX_set_dh_auto(,1) if no parameter is configured. */
      SSL_CTX_set_tmp_dh_callback(ctx,  ssl_callback_TmpDH);
-+#else
-+    SSL_CTX_set_dh_auto(ctx, 1);
 +#endif
  
      SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
  
-@@ -843,6 +848,23 @@ static void ssl_init_ctx_callbacks(server_rec *s,
+@@ -871,6 +876,23 @@
  #endif
  }
  
@@ -68,7 +66,7 @@ index 4da24eddcc..5d199cddaf 100644
  static apr_status_t ssl_init_ctx_verify(server_rec *s,
                                          apr_pool_t *p,
                                          apr_pool_t *ptemp,
-@@ -883,10 +905,8 @@ static apr_status_t ssl_init_ctx_verify(server_rec *s,
+@@ -911,10 +933,8 @@
          ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,
                       "Configuring client authentication");
  
@@ -81,7 +79,7 @@ index 4da24eddcc..5d199cddaf 100644
              ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01895)
                      "Unable to configure verify locations "
                      "for client authentication");
-@@ -971,6 +991,23 @@ static apr_status_t ssl_init_ctx_cipher_suite(server_rec *s,
+@@ -999,6 +1019,23 @@
      return APR_SUCCESS;
  }
  
@@ -105,7 +103,7 @@ index 4da24eddcc..5d199cddaf 100644
  static apr_status_t ssl_init_ctx_crl(server_rec *s,
                                       apr_pool_t *p,
                                       apr_pool_t *ptemp,
-@@ -1009,8 +1046,8 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s,
+@@ -1037,8 +1074,8 @@
      ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900)
                   "Configuring certificate revocation facility");
  
@@ -116,7 +114,7 @@ index 4da24eddcc..5d199cddaf 100644
          ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901)
                       "Host %s: unable to configure X.509 CRL storage "
                       "for certificate revocation", mctx->sc->vhost_id);
-@@ -1239,6 +1276,31 @@ static int ssl_no_passwd_prompt_cb(char *buf, int size, int rwflag,
+@@ -1267,6 +1304,31 @@
     return 0;
  }
  
@@ -148,7 +146,7 @@ index 4da24eddcc..5d199cddaf 100644
  static apr_status_t ssl_init_server_certs(server_rec *s,
                                            apr_pool_t *p,
                                            apr_pool_t *ptemp,
-@@ -1249,7 +1311,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+@@ -1277,7 +1339,7 @@
      const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile;
      int i;
      X509 *cert;
@@ -157,7 +155,7 @@ index 4da24eddcc..5d199cddaf 100644
  #ifdef HAVE_ECC
      EC_GROUP *ecparams = NULL;
      int nid;
-@@ -1344,8 +1406,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+@@ -1372,8 +1434,7 @@
          }
          else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
                                                SSL_FILETYPE_PEM) < 1)
@@ -167,13 +165,15 @@ index 4da24eddcc..5d199cddaf 100644
              ssl_asn1_t *asn1;
              const unsigned char *ptr;
  
-@@ -1434,12 +1495,12 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
+@@ -1462,13 +1523,22 @@
       */
      certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *);
      if (certfile && !modssl_is_engine_id(certfile)
 -        && (dhparams = ssl_dh_GetParamFromFile(certfile))) {
 -        SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);
 +        && (dh = ssl_dh_GetParamFromFile(certfile))) {
++        /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey()
++         * for OpenSSL 3.0+. */
 +        SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh);
          ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
                       "Custom DH parameters (%d bits) for %s loaded from %s",
@@ -182,9 +182,17 @@ index 4da24eddcc..5d199cddaf 100644
 +                     modssl_DH_bits(dh), vhost_id, certfile);
 +        DH_free(dh);
      }
++#if !MODSSL_USE_OPENSSL_PRE_1_1_API
++    else {
++        /* If no parameter is manually configured, enable auto
++         * selection. */
++        SSL_CTX_set_dh_auto(mctx->ssl_ctx, 1);
++    }
++#endif
  
  #ifdef HAVE_ECC
-@@ -1490,6 +1551,7 @@ static apr_status_t ssl_init_ticket_key(server_rec *s,
+     /*
+@@ -1518,6 +1588,7 @@
      char buf[TLSEXT_TICKET_KEY_LEN];
      char *path;
      modssl_ticket_key_t *ticket_key = mctx->ticket_key;
@@ -192,7 +200,7 @@ index 4da24eddcc..5d199cddaf 100644
  
      if (!ticket_key->file_path) {
          return APR_SUCCESS;
-@@ -1517,11 +1579,22 @@ static apr_status_t ssl_init_ticket_key(server_rec *s,
+@@ -1545,11 +1616,22 @@
      }
  
      memcpy(ticket_key->key_name, buf, 16);
@@ -219,7 +227,7 @@ index 4da24eddcc..5d199cddaf 100644
          ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01913)
                       "Unable to initialize TLS session ticket key callback "
                       "(incompatible OpenSSL version?)");
-@@ -1652,7 +1725,7 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s,
+@@ -1680,7 +1762,7 @@
          return ssl_die(s);
      }
  
@@ -228,7 +236,7 @@ index 4da24eddcc..5d199cddaf 100644
  
      for (n = 0; n < ncerts; n++) {
          int i;
-@@ -2249,10 +2322,11 @@ apr_status_t ssl_init_ModuleKill(void *data)
+@@ -2277,10 +2359,11 @@
  
      }
  
@@ -242,11 +250,9 @@ index 4da24eddcc..5d199cddaf 100644
  
      return APR_SUCCESS;
  }
-diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c
-index cabf753790..3db7077f1e 100644
---- a/modules/ssl/ssl_engine_io.c
-+++ b/modules/ssl/ssl_engine_io.c
-@@ -194,6 +194,10 @@ static int bio_filter_destroy(BIO *bio)
+--- httpd-2.4.51/modules/ssl/ssl_engine_io.c.openssl3
++++ httpd-2.4.51/modules/ssl/ssl_engine_io.c
+@@ -194,6 +194,10 @@
  static int bio_filter_out_read(BIO *bio, char *out, int outl)
  {
      /* this is never called */
@@ -257,7 +263,7 @@ index cabf753790..3db7077f1e 100644
      return -1;
  }
  
-@@ -293,12 +297,20 @@ static long bio_filter_out_ctrl(BIO *bio, int cmd, long num, void *ptr)
+@@ -293,12 +297,20 @@
  static int bio_filter_out_gets(BIO *bio, char *buf, int size)
  {
      /* this is never called */
@@ -278,7 +284,7 @@ index cabf753790..3db7077f1e 100644
      return -1;
  }
  
-@@ -533,22 +545,47 @@ static int bio_filter_in_read(BIO *bio, char *in, int inlen)
+@@ -533,22 +545,47 @@
  
  static int bio_filter_in_write(BIO *bio, const char *in, int inl)
  {
@@ -327,7 +333,7 @@ index cabf753790..3db7077f1e 100644
  }
  
  #if MODSSL_USE_OPENSSL_PRE_1_1_API
-@@ -573,7 +610,7 @@ static BIO_METHOD bio_filter_in_method = {
+@@ -573,7 +610,7 @@
      bio_filter_in_read,
      bio_filter_in_puts,         /* puts is never called */
      bio_filter_in_gets,         /* gets is never called */
@@ -336,11 +342,9 @@ index cabf753790..3db7077f1e 100644
      bio_filter_create,
      bio_filter_destroy,
      NULL
-diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
-index b99dcf19d4..aced92d2d0 100644
---- a/modules/ssl/ssl_engine_kernel.c
-+++ b/modules/ssl/ssl_engine_kernel.c
-@@ -1685,6 +1685,7 @@ const authz_provider ssl_authz_provider_verify_client =
+--- httpd-2.4.51/modules/ssl/ssl_engine_kernel.c.openssl3
++++ httpd-2.4.51/modules/ssl/ssl_engine_kernel.c
+@@ -1685,6 +1685,7 @@
  **  _________________________________________________________________
  */
  
@@ -348,7 +352,7 @@ index b99dcf19d4..aced92d2d0 100644
  /*
   * Hand out standard DH parameters, based on the authentication strength
   */
-@@ -1730,6 +1731,7 @@ DH *ssl_callback_TmpDH(SSL *ssl, int export, int keylen)
+@@ -1730,6 +1731,7 @@
  
      return modssl_get_dh_params(keylen);
  }
@@ -356,7 +360,7 @@ index b99dcf19d4..aced92d2d0 100644
  
  /*
   * This OpenSSL callback function is called when OpenSSL
-@@ -2614,7 +2616,11 @@ int ssl_callback_SessionTicket(SSL *ssl,
+@@ -2614,7 +2616,11 @@
                                 unsigned char *keyname,
                                 unsigned char *iv,
                                 EVP_CIPHER_CTX *cipher_ctx,
@@ -369,7 +373,7 @@ index b99dcf19d4..aced92d2d0 100644
                                 int mode)
  {
      conn_rec *c = (conn_rec *)SSL_get_app_data(ssl);
-@@ -2641,7 +2647,13 @@ int ssl_callback_SessionTicket(SSL *ssl,
+@@ -2640,7 +2646,13 @@
          }
          EVP_EncryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL,
                             ticket_key->aes_key, iv);
@@ -384,7 +388,7 @@ index b99dcf19d4..aced92d2d0 100644
  
          ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02289)
                        "TLS session ticket key for %s successfully set, "
-@@ -2662,7 +2674,13 @@ int ssl_callback_SessionTicket(SSL *ssl,
+@@ -2661,7 +2673,13 @@
  
          EVP_DecryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL,
                             ticket_key->aes_key, iv);
@@ -399,11 +403,9 @@ index b99dcf19d4..aced92d2d0 100644
  
          ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02290)
                        "TLS session ticket key for %s successfully set, "
-diff --git a/modules/ssl/ssl_engine_log.c b/modules/ssl/ssl_engine_log.c
-index 7dbbbdb55e..3b3ceacf0a 100644
---- a/modules/ssl/ssl_engine_log.c
-+++ b/modules/ssl/ssl_engine_log.c
-@@ -78,6 +78,16 @@ apr_status_t ssl_die(server_rec *s)
+--- httpd-2.4.51/modules/ssl/ssl_engine_log.c.openssl3
++++ httpd-2.4.51/modules/ssl/ssl_engine_log.c
+@@ -78,6 +78,16 @@
      return APR_EGENERAL;
  }
  
@@ -420,7 +422,7 @@ index 7dbbbdb55e..3b3ceacf0a 100644
  /*
   * Prints the SSL library error information.
   */
-@@ -87,7 +97,7 @@ void ssl_log_ssl_error(const char *file, int line, int level, server_rec *s)
+@@ -87,7 +97,7 @@
      const char *data;
      int flags;
  
@@ -429,10 +431,8 @@ index 7dbbbdb55e..3b3ceacf0a 100644
          const char *annotation;
          char err[256];
  
-diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h
-index a6fc7513a2..b091c58c94 100644
---- a/modules/ssl/ssl_private.h
-+++ b/modules/ssl/ssl_private.h
+--- httpd-2.4.51/modules/ssl/ssl_private.h.openssl3
++++ httpd-2.4.51/modules/ssl/ssl_private.h
 @@ -89,6 +89,9 @@
  /* must be defined before including ssl.h */
  #define OPENSSL_NO_SSL_INTERN
@@ -459,7 +459,7 @@ index a6fc7513a2..b091c58c94 100644
  #else /* defined(LIBRESSL_VERSION_NUMBER) */
  #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L)
  #endif
-@@ -674,7 +676,11 @@ typedef struct {
+@@ -681,7 +683,11 @@
  typedef struct {
      const char *file_path;
      unsigned char key_name[16];
@@ -471,7 +471,7 @@ index a6fc7513a2..b091c58c94 100644
      unsigned char aes_key[16];
  } modssl_ticket_key_t;
  #endif
-@@ -938,8 +944,16 @@ int          ssl_callback_ServerNameIndication(SSL *, int *, modssl_ctx_t *);
+@@ -945,8 +951,16 @@
  int          ssl_callback_ClientHello(SSL *, int *, void *);
  #endif
  #ifdef HAVE_TLS_SESSION_TICKETS
@@ -490,7 +490,7 @@ index a6fc7513a2..b091c58c94 100644
  #endif
  
  #ifdef HAVE_TLS_ALPN
-@@ -1112,10 +1126,12 @@ void ssl_init_ocsp_certificates(server_rec *s, modssl_ctx_t *mctx);
+@@ -1124,10 +1138,12 @@
  
  #endif
  
diff --git a/httpd.spec b/httpd.spec
index 77b51a8..0cd12da 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.51
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -75,7 +75,7 @@ Patch24: httpd-2.4.43-corelimit.patch
 Patch25: httpd-2.4.43-selinux.patch
 Patch26: httpd-2.4.43-gettid.patch
 Patch27: httpd-2.4.43-icons.patch
-Patch28: httpd-2.4.48-openssl3.patch
+Patch28: httpd-2.4.51-openssl3.patch
 Patch30: httpd-2.4.43-cachehardmax.patch
 Patch34: httpd-2.4.43-socket-activation.patch
 Patch38: httpd-2.4.43-sslciphdefault.patch
@@ -787,6 +787,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Oct 12 2021 Joe Orton <jorton@redhat.com> - 2.4.51-2
+- mod_ssl: updated patch for OpenSSL 3.0 compatibility (#2007178)
+
 * Thu Oct 07 2021 Patrick Uiterwijk <patrick@puiterwijk.org> - 2.4.51-1
 - new version 2.4.51
 

From 331f0eab0a43fa1bf94ad70189f5443e3607d0f0 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 12 Oct 2021 13:54:10 +0100
Subject: [PATCH 255/359] Add rpminspect waivers.

---
 rpminspect.yaml | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 rpminspect.yaml

diff --git a/rpminspect.yaml b/rpminspect.yaml
new file mode 100644
index 0000000..1b4f2fe
--- /dev/null
+++ b/rpminspect.yaml
@@ -0,0 +1,6 @@
+---
+badfuncs:
+  # mod_proxy uses inet_ntoa (safely) for IPv4 address matching,
+  # and APR interfaces for IPv6 addresses.
+  ignore:
+    - /usr/lib*/httpd/modules/mod_proxy.so

From 913d808969a8223ce7c7c242305fabc7c5eeed9e Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 12 Oct 2021 14:01:42 +0100
Subject: [PATCH 256/359] Bump to .51.

---
 pullrev.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pullrev.sh b/pullrev.sh
index f7fb600..87b7cd7 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then
 fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
-repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.48
+#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+ver=2.4.51
 prefix="httpd-${ver}"
 suffix="${SUFFIX:-r$1${2:++}}"
 fn="${prefix}-${suffix}.patch"

From 923974e191bcfae8a714c666e7ba75566c72aeb3 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 12 Oct 2021 14:01:48 +0100
Subject: [PATCH 257/359] - mod_deflate/core: add two brigade handling
 correctness fixes

---
 httpd-2.4.51-r1894150.patch | 17 +++++++++++++++++
 httpd-2.4.51-r1894152.patch | 36 ++++++++++++++++++++++++++++++++++++
 httpd.spec                  |  5 +++++
 3 files changed, 58 insertions(+)
 create mode 100644 httpd-2.4.51-r1894150.patch
 create mode 100644 httpd-2.4.51-r1894152.patch

diff --git a/httpd-2.4.51-r1894150.patch b/httpd-2.4.51-r1894150.patch
new file mode 100644
index 0000000..c8acff9
--- /dev/null
+++ b/httpd-2.4.51-r1894150.patch
@@ -0,0 +1,17 @@
+# ./pullrev.sh 1894150
+http://svn.apache.org/viewvc?view=revision&revision=1894150
+
+--- httpd-2.4.51/server/util_filter.c
++++ httpd-2.4.51/server/util_filter.c
+@@ -565,8 +565,9 @@
+                                          apr_bucket_brigade *bb)
+ {
+     if (next) {
+-        apr_bucket *e;
+-        if ((e = APR_BRIGADE_LAST(bb)) && APR_BUCKET_IS_EOS(e) && next->r) {
++        apr_bucket *e = APR_BRIGADE_LAST(bb);
++
++        if (e != APR_BRIGADE_SENTINEL(bb) && APR_BUCKET_IS_EOS(e) && next->r) {
+             /* This is only safe because HTTP_HEADER filter is always in
+              * the filter stack.   This ensures that there is ALWAYS a
+              * request-based filter that we can attach this to.  If the
diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch
new file mode 100644
index 0000000..95f5081
--- /dev/null
+++ b/httpd-2.4.51-r1894152.patch
@@ -0,0 +1,36 @@
+# ./pullrev.sh 1894152
+http://svn.apache.org/viewvc?view=revision&revision=1894152
+
+--- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152
++++ httpd-2.4.51/modules/filters/mod_deflate.c
+@@ -835,6 +835,7 @@
+     while (!APR_BRIGADE_EMPTY(bb))
+     {
+         apr_bucket *b;
++        apr_status_t rv;
+ 
+         /*
+          * Optimization: If we are a HEAD request and bytes_sent is not zero
+@@ -914,8 +915,6 @@
+         }
+ 
+         if (APR_BUCKET_IS_FLUSH(e)) {
+-            apr_status_t rv;
+-
+             /* flush the remaining data from the zlib buffers */
+             zRC = flush_libz_buffer(ctx, c, f->c->bucket_alloc, deflate,
+                                     Z_SYNC_FLUSH, NO_UPDATE_CRC);
+@@ -947,7 +946,12 @@
+         }
+ 
+         /* read */
+-        apr_bucket_read(e, &data, &len, APR_BLOCK_READ);
++        rv = apr_bucket_read(e, &data, &len, APR_BLOCK_READ);
++        if (rv) {
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(10298)
++                          "failed reading from %s bucket", e->type->name);
++            return rv;
++        }
+         if (!len) {
+             apr_bucket_delete(e);
+             continue;
diff --git a/httpd.spec b/httpd.spec
index 0cd12da..9c21ef8 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -90,6 +90,8 @@ Patch45: httpd-2.4.43-logjournal.patch
 Patch60: httpd-2.4.43-enable-sslv3.patch
 Patch61: httpd-2.4.48-r1878890.patch
 Patch63: httpd-2.4.46-htcacheclean-dont-break.patch
+Patch64: httpd-2.4.51-r1894150.patch
+Patch65: httpd-2.4.51-r1894152.patch
 
 # Security fixes
 
@@ -241,6 +243,8 @@ written in the Lua programming language.
 %patch60 -p1 -b .enable-sslv3
 %patch61 -p1 -b .r1878890
 %patch63 -p1 -b .htcacheclean-dont-break
+%patch64 -p1 -b .r1894150
+%patch65 -p1 -b .r1894152
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -789,6 +793,7 @@ exit $rv
 %changelog
 * Tue Oct 12 2021 Joe Orton <jorton@redhat.com> - 2.4.51-2
 - mod_ssl: updated patch for OpenSSL 3.0 compatibility (#2007178)
+- mod_deflate/core: add two brigade handling correctness fixes
 
 * Thu Oct 07 2021 Patrick Uiterwijk <patrick@puiterwijk.org> - 2.4.51-1
 - new version 2.4.51

From 34c723953e0376307087f3d5eaa2149f7c421d5f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Branislav=20N=C3=A1ter?= <bnater@redhat.com>
Date: Fri, 15 Oct 2021 16:31:44 +0200
Subject: [PATCH 258/359] Added gating for 'testing'

---
 gating.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/gating.yaml b/gating.yaml
index ce08116..e4c04e7 100644
--- a/gating.yaml
+++ b/gating.yaml
@@ -1,4 +1,13 @@
 --- !Policy
+product_versions:
+  - fedora-*
+decision_contexts: [bodhi_update_push_testing]
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
+
+#gating rawhide
+--- !Policy
 product_versions:
   - fedora-*
 decision_contexts: [bodhi_update_push_stable]

From 4916eeea5bf7043cec58d0b56ac1c8de2ff1bdcf Mon Sep 17 00:00:00 2001
From: Neal Gompa <ngompa@fedoraproject.org>
Date: Mon, 6 Dec 2021 19:35:37 -0500
Subject: [PATCH 259/359] Use NAME from os-release(5) for vendor string

Related: #2029071 httpd on CentOS identifies as RHEL
---
 httpd.spec | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 9c21ef8..31ff412 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -3,7 +3,7 @@
 %define suexec_caller apache
 %define mmn 20120211
 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits}
-%define vstring %(source /etc/os-release; echo ${REDHAT_SUPPORT_PRODUCT})
+%define vstring %(source /etc/os-release; echo ${NAME})
 %if 0%{?fedora} > 26 || 0%{?rhel} > 7
 %global mpm event
 %else
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.51
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -791,6 +791,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Dec 06 2021 Neal Gompa <ngompa@fedoraproject.org> - 2.4.51-3
+- Use NAME from os-release(5) for vendor string
+  Related: #2029071 - httpd on CentOS identifies as RHEL
+
 * Tue Oct 12 2021 Joe Orton <jorton@redhat.com> - 2.4.51-2
 - mod_ssl: updated patch for OpenSSL 3.0 compatibility (#2007178)
 - mod_deflate/core: add two brigade handling correctness fixes

From 47d608302424bd85de32bdd0f405fb217c8d1950 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 22 Dec 2021 08:13:43 +0000
Subject: [PATCH 260/359] update to 2.4.52

Resolves: rhbz#2034673
Resolves: rhbz#2034675
---
 .gitignore                  |   1 +
 httpd-2.4.51-openssl3.patch | 505 ------------------------------------
 httpd-2.4.51-r1894150.patch |  17 --
 httpd.spec                  |  11 +-
 sources                     |   4 +-
 5 files changed, 8 insertions(+), 530 deletions(-)
 delete mode 100644 httpd-2.4.51-openssl3.patch
 delete mode 100644 httpd-2.4.51-r1894150.patch

diff --git a/.gitignore b/.gitignore
index bd6e204..a6fac0d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -42,3 +42,4 @@ x86_64
 /httpd-2.4.49.tar.bz2.asc
 /httpd-2.4.50.tar.bz2.asc
 /httpd-2.4.51.tar.bz2.asc
+/httpd-2.4.52.tar.bz2.asc
diff --git a/httpd-2.4.51-openssl3.patch b/httpd-2.4.51-openssl3.patch
deleted file mode 100644
index a4423c7..0000000
--- a/httpd-2.4.51-openssl3.patch
+++ /dev/null
@@ -1,505 +0,0 @@
-
-https://github.com/apache/httpd/pull/258
-
---- httpd-2.4.51/modules/ssl/ssl_engine_init.c.openssl3
-+++ httpd-2.4.51/modules/ssl/ssl_engine_init.c
-@@ -91,7 +91,6 @@
- 
-     return 1;
- }
--#endif
- 
- /*
-  * Grab well-defined DH parameters from OpenSSL, see the BN_get_rfc*
-@@ -171,6 +170,7 @@
-         
-     return NULL; /* impossible to reach. */
- }
-+#endif
- 
- static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf,
-                                        server_rec *s)
-@@ -440,8 +440,9 @@
- 
-     modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */
- 
-+#if MODSSL_USE_OPENSSL_PRE_1_1_API
-     init_dh_params();
--#if !MODSSL_USE_OPENSSL_PRE_1_1_API
-+#else
-     init_bio_methods();
- #endif
- 
-@@ -862,7 +863,11 @@
- {
-     SSL_CTX *ctx = mctx->ssl_ctx;
- 
-+#if MODSSL_USE_OPENSSL_PRE_1_1_API
-+    /* Note that for OpenSSL>=1.1, auto selection is enabled via
-+     * SSL_CTX_set_dh_auto(,1) if no parameter is configured. */
-     SSL_CTX_set_tmp_dh_callback(ctx,  ssl_callback_TmpDH);
-+#endif
- 
-     SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
- 
-@@ -871,6 +876,23 @@
- #endif
- }
- 
-+static APR_INLINE
-+int modssl_CTX_load_verify_locations(SSL_CTX *ctx,
-+                                     const char *file,
-+                                     const char *path)
-+{
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+    if (!SSL_CTX_load_verify_locations(ctx, file, path))
-+        return 0;
-+#else
-+    if (file && !SSL_CTX_load_verify_file(ctx, file))
-+        return 0;
-+    if (path && !SSL_CTX_load_verify_dir(ctx, path))
-+        return 0;
-+#endif
-+    return 1;
-+}
-+
- static apr_status_t ssl_init_ctx_verify(server_rec *s,
-                                         apr_pool_t *p,
-                                         apr_pool_t *ptemp,
-@@ -911,10 +933,8 @@
-         ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,
-                      "Configuring client authentication");
- 
--        if (!SSL_CTX_load_verify_locations(ctx,
--                                           mctx->auth.ca_cert_file,
--                                           mctx->auth.ca_cert_path))
--        {
-+        if (!modssl_CTX_load_verify_locations(ctx, mctx->auth.ca_cert_file,
-+                                                   mctx->auth.ca_cert_path)) {
-             ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01895)
-                     "Unable to configure verify locations "
-                     "for client authentication");
-@@ -999,6 +1019,23 @@
-     return APR_SUCCESS;
- }
- 
-+static APR_INLINE
-+int modssl_X509_STORE_load_locations(X509_STORE *store,
-+                                     const char *file,
-+                                     const char *path)
-+{
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+    if (!X509_STORE_load_locations(store, file, path))
-+        return 0;
-+#else
-+    if (file && !X509_STORE_load_file(store, file))
-+        return 0;
-+    if (path && !X509_STORE_load_path(store, path))
-+        return 0;
-+#endif
-+    return 1;
-+}
-+
- static apr_status_t ssl_init_ctx_crl(server_rec *s,
-                                      apr_pool_t *p,
-                                      apr_pool_t *ptemp,
-@@ -1037,8 +1074,8 @@
-     ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900)
-                  "Configuring certificate revocation facility");
- 
--    if (!store || !X509_STORE_load_locations(store, mctx->crl_file,
--                                             mctx->crl_path)) {
-+    if (!store || !modssl_X509_STORE_load_locations(store, mctx->crl_file,
-+                                                           mctx->crl_path)) {
-         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901)
-                      "Host %s: unable to configure X.509 CRL storage "
-                      "for certificate revocation", mctx->sc->vhost_id);
-@@ -1267,6 +1304,31 @@
-    return 0;
- }
- 
-+static APR_INLINE int modssl_DH_bits(DH *dh)
-+{
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+    return DH_bits(dh);
-+#else
-+    return BN_num_bits(DH_get0_p(dh));
-+#endif
-+}
-+
-+/* SSL_CTX_use_PrivateKey_file() can fail either because the private
-+ * key was encrypted, or due to a mismatch between an already-loaded
-+ * cert and the key - a common misconfiguration - from calling
-+ * X509_check_private_key().  This macro is passed the last error code
-+ * off the OpenSSL stack and evaluates to true only for the first
-+ * case.  With OpenSSL < 3 the second case is identifiable by the
-+ * function code, but function codes are not used from 3.0. */
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_FUNC(ec) != X509_F_X509_CHECK_PRIVATE_KEY)
-+#else
-+#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_LIB != ERR_LIB_X509            \
-+                                 || (ERR_GET_REASON(ec) != X509_R_KEY_TYPE_MISMATCH \
-+                                     && ERR_GET_REASON(ec) != X509_R_KEY_VALUES_MISMATCH \
-+                                     && ERR_GET_REASON(ec) != X509_R_UNKNOWN_KEY_TYPE))
-+#endif
-+
- static apr_status_t ssl_init_server_certs(server_rec *s,
-                                           apr_pool_t *p,
-                                           apr_pool_t *ptemp,
-@@ -1277,7 +1339,7 @@
-     const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile;
-     int i;
-     X509 *cert;
--    DH *dhparams;
-+    DH *dh;
- #ifdef HAVE_ECC
-     EC_GROUP *ecparams = NULL;
-     int nid;
-@@ -1372,8 +1434,7 @@
-         }
-         else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
-                                               SSL_FILETYPE_PEM) < 1)
--                 && (ERR_GET_FUNC(ERR_peek_last_error())
--                     != X509_F_X509_CHECK_PRIVATE_KEY)) {
-+                 && CHECK_PRIVKEY_ERROR(ERR_peek_last_error())) {
-             ssl_asn1_t *asn1;
-             const unsigned char *ptr;
- 
-@@ -1462,13 +1523,22 @@
-      */
-     certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *);
-     if (certfile && !modssl_is_engine_id(certfile)
--        && (dhparams = ssl_dh_GetParamFromFile(certfile))) {
--        SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);
-+        && (dh = ssl_dh_GetParamFromFile(certfile))) {
-+        /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey()
-+         * for OpenSSL 3.0+. */
-+        SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh);
-         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
-                      "Custom DH parameters (%d bits) for %s loaded from %s",
--                     DH_bits(dhparams), vhost_id, certfile);
--        DH_free(dhparams);
-+                     modssl_DH_bits(dh), vhost_id, certfile);
-+        DH_free(dh);
-     }
-+#if !MODSSL_USE_OPENSSL_PRE_1_1_API
-+    else {
-+        /* If no parameter is manually configured, enable auto
-+         * selection. */
-+        SSL_CTX_set_dh_auto(mctx->ssl_ctx, 1);
-+    }
-+#endif
- 
- #ifdef HAVE_ECC
-     /*
-@@ -1518,6 +1588,7 @@
-     char buf[TLSEXT_TICKET_KEY_LEN];
-     char *path;
-     modssl_ticket_key_t *ticket_key = mctx->ticket_key;
-+    int res;
- 
-     if (!ticket_key->file_path) {
-         return APR_SUCCESS;
-@@ -1545,11 +1616,22 @@
-     }
- 
-     memcpy(ticket_key->key_name, buf, 16);
--    memcpy(ticket_key->hmac_secret, buf + 16, 16);
-     memcpy(ticket_key->aes_key, buf + 32, 16);
--
--    if (!SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx,
--                                          ssl_callback_SessionTicket)) {
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+    memcpy(ticket_key->hmac_secret, buf + 16, 16);
-+    res = SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx,
-+                                           ssl_callback_SessionTicket);
-+#else
-+    ticket_key->mac_params[0] =
-+        OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, buf + 16, 16);
-+    ticket_key->mac_params[1] =
-+        OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, "sha256", 0);
-+    ticket_key->mac_params[2] =
-+        OSSL_PARAM_construct_end();
-+    res = SSL_CTX_set_tlsext_ticket_key_evp_cb(mctx->ssl_ctx,
-+                                               ssl_callback_SessionTicket);
-+#endif
-+    if (!res) {
-         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01913)
-                      "Unable to initialize TLS session ticket key callback "
-                      "(incompatible OpenSSL version?)");
-@@ -1680,7 +1762,7 @@
-         return ssl_die(s);
-     }
- 
--    X509_STORE_load_locations(store, pkp->ca_cert_file, NULL);
-+    modssl_X509_STORE_load_locations(store, pkp->ca_cert_file, NULL);
- 
-     for (n = 0; n < ncerts; n++) {
-         int i;
-@@ -2277,10 +2359,11 @@
- 
-     }
- 
--#if !MODSSL_USE_OPENSSL_PRE_1_1_API
-+#if MODSSL_USE_OPENSSL_PRE_1_1_API
-+    free_dh_params();
-+#else
-     free_bio_methods();
- #endif
--    free_dh_params();
- 
-     return APR_SUCCESS;
- }
---- httpd-2.4.51/modules/ssl/ssl_engine_io.c.openssl3
-+++ httpd-2.4.51/modules/ssl/ssl_engine_io.c
-@@ -194,6 +194,10 @@
- static int bio_filter_out_read(BIO *bio, char *out, int outl)
- {
-     /* this is never called */
-+    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
-+    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
-+                  "BUG: %s() should not be called", "bio_filter_out_read");
-+    AP_DEBUG_ASSERT(0);
-     return -1;
- }
- 
-@@ -293,12 +297,20 @@
- static int bio_filter_out_gets(BIO *bio, char *buf, int size)
- {
-     /* this is never called */
-+    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
-+    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
-+                  "BUG: %s() should not be called", "bio_filter_out_gets");
-+    AP_DEBUG_ASSERT(0);
-     return -1;
- }
- 
- static int bio_filter_out_puts(BIO *bio, const char *str)
- {
-     /* this is never called */
-+    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
-+    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
-+                  "BUG: %s() should not be called", "bio_filter_out_puts");
-+    AP_DEBUG_ASSERT(0);
-     return -1;
- }
- 
-@@ -533,22 +545,47 @@
- 
- static int bio_filter_in_write(BIO *bio, const char *in, int inl)
- {
-+    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
-+    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
-+                  "BUG: %s() should not be called", "bio_filter_in_write");
-+    AP_DEBUG_ASSERT(0);
-     return -1;
- }
- 
- static int bio_filter_in_puts(BIO *bio, const char *str)
- {
-+    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
-+    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
-+                  "BUG: %s() should not be called", "bio_filter_in_puts");
-+    AP_DEBUG_ASSERT(0);
-     return -1;
- }
- 
- static int bio_filter_in_gets(BIO *bio, char *buf, int size)
- {
-+    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
-+    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
-+                  "BUG: %s() should not be called", "bio_filter_in_gets");
-+    AP_DEBUG_ASSERT(0);
-     return -1;
- }
- 
- static long bio_filter_in_ctrl(BIO *bio, int cmd, long num, void *ptr)
- {
--    return -1;
-+    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
-+    switch (cmd) {
-+#ifdef BIO_CTRL_EOF
-+    case BIO_CTRL_EOF:
-+        return inctx->rc == APR_EOF;
-+#endif
-+    default:
-+        break;
-+    }
-+    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
-+                  "BUG: bio_filter_in_ctrl() should not be called with cmd=%i",
-+                  cmd);
-+    AP_DEBUG_ASSERT(0);
-+    return 0;
- }
- 
- #if MODSSL_USE_OPENSSL_PRE_1_1_API
-@@ -573,7 +610,7 @@
-     bio_filter_in_read,
-     bio_filter_in_puts,         /* puts is never called */
-     bio_filter_in_gets,         /* gets is never called */
--    bio_filter_in_ctrl,         /* ctrl is never called */
-+    bio_filter_in_ctrl,         /* ctrl is called for EOF check */
-     bio_filter_create,
-     bio_filter_destroy,
-     NULL
---- httpd-2.4.51/modules/ssl/ssl_engine_kernel.c.openssl3
-+++ httpd-2.4.51/modules/ssl/ssl_engine_kernel.c
-@@ -1685,6 +1685,7 @@
- **  _________________________________________________________________
- */
- 
-+#if MODSSL_USE_OPENSSL_PRE_1_1_API
- /*
-  * Hand out standard DH parameters, based on the authentication strength
-  */
-@@ -1730,6 +1731,7 @@
- 
-     return modssl_get_dh_params(keylen);
- }
-+#endif
- 
- /*
-  * This OpenSSL callback function is called when OpenSSL
-@@ -2614,7 +2616,11 @@
-                                unsigned char *keyname,
-                                unsigned char *iv,
-                                EVP_CIPHER_CTX *cipher_ctx,
--                               HMAC_CTX *hctx,
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+                               HMAC_CTX *hmac_ctx,
-+#else
-+                               EVP_MAC_CTX *mac_ctx,
-+#endif
-                                int mode)
- {
-     conn_rec *c = (conn_rec *)SSL_get_app_data(ssl);
-@@ -2640,7 +2646,13 @@
-         }
-         EVP_EncryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL,
-                            ticket_key->aes_key, iv);
--        HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL);
-+
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+        HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16,
-+                     tlsext_tick_md(), NULL);
-+#else
-+        EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params);
-+#endif
- 
-         ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02289)
-                       "TLS session ticket key for %s successfully set, "
-@@ -2661,7 +2673,13 @@
- 
-         EVP_DecryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL,
-                            ticket_key->aes_key, iv);
--        HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL);
-+
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+        HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16,
-+                     tlsext_tick_md(), NULL);
-+#else
-+        EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params);
-+#endif
- 
-         ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02290)
-                       "TLS session ticket key for %s successfully set, "
---- httpd-2.4.51/modules/ssl/ssl_engine_log.c.openssl3
-+++ httpd-2.4.51/modules/ssl/ssl_engine_log.c
-@@ -78,6 +78,16 @@
-     return APR_EGENERAL;
- }
- 
-+static APR_INLINE
-+unsigned long modssl_ERR_peek_error_data(const char **data, int *flags)
-+{
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+    return ERR_peek_error_line_data(NULL, NULL, data, flags);
-+#else
-+    return ERR_peek_error_data(data, flags);
-+#endif
-+}
-+
- /*
-  * Prints the SSL library error information.
-  */
-@@ -87,7 +97,7 @@
-     const char *data;
-     int flags;
- 
--    while ((e = ERR_peek_error_line_data(NULL, NULL, &data, &flags))) {
-+    while ((e = modssl_ERR_peek_error_data(&data, &flags))) {
-         const char *annotation;
-         char err[256];
- 
---- httpd-2.4.51/modules/ssl/ssl_private.h.openssl3
-+++ httpd-2.4.51/modules/ssl/ssl_private.h
-@@ -89,6 +89,9 @@
- /* must be defined before including ssl.h */
- #define OPENSSL_NO_SSL_INTERN
- #endif
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000
-+#include <openssl/core_names.h>
-+#endif
- #include <openssl/ssl.h>
- #include <openssl/err.h>
- #include <openssl/x509.h>
-@@ -134,13 +137,12 @@
-         SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL)
- #define SSL_CTX_set_max_proto_version(ctx, version) \
-         SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL)
--#elif LIBRESSL_VERSION_NUMBER < 0x2070000f
-+#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */
- /* LibreSSL before 2.7 declares OPENSSL_VERSION_NUMBER == 2.0 but does not
-  * include most changes from OpenSSL >= 1.1 (new functions, macros, 
-  * deprecations, ...), so we have to work around this...
-  */
--#define MODSSL_USE_OPENSSL_PRE_1_1_API (1)
--#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */
-+#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f)
- #else /* defined(LIBRESSL_VERSION_NUMBER) */
- #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L)
- #endif
-@@ -681,7 +683,11 @@
- typedef struct {
-     const char *file_path;
-     unsigned char key_name[16];
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-     unsigned char hmac_secret[16];
-+#else
-+    OSSL_PARAM mac_params[3];
-+#endif
-     unsigned char aes_key[16];
- } modssl_ticket_key_t;
- #endif
-@@ -945,8 +951,16 @@
- int          ssl_callback_ClientHello(SSL *, int *, void *);
- #endif
- #ifdef HAVE_TLS_SESSION_TICKETS
--int         ssl_callback_SessionTicket(SSL *, unsigned char *, unsigned char *,
--                                       EVP_CIPHER_CTX *, HMAC_CTX *, int);
-+int ssl_callback_SessionTicket(SSL *ssl,
-+                               unsigned char *keyname,
-+                               unsigned char *iv,
-+                               EVP_CIPHER_CTX *cipher_ctx,
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+                               HMAC_CTX *hmac_ctx,
-+#else
-+                               EVP_MAC_CTX *mac_ctx,
-+#endif
-+                               int mode);
- #endif
- 
- #ifdef HAVE_TLS_ALPN
-@@ -1124,10 +1138,12 @@
- 
- #endif
- 
-+#if MODSSL_USE_OPENSSL_PRE_1_1_API
- /* Retrieve DH parameters for given key length.  Return value should
-  * be treated as unmutable, since it is stored in process-global
-  * memory. */
- DH *modssl_get_dh_params(unsigned keylen);
-+#endif
- 
- /* Returns non-zero if the request was made over SSL/TLS.  If sslconn
-  * is non-NULL and the request is using SSL/TLS, sets *sslconn to the
diff --git a/httpd-2.4.51-r1894150.patch b/httpd-2.4.51-r1894150.patch
deleted file mode 100644
index c8acff9..0000000
--- a/httpd-2.4.51-r1894150.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-# ./pullrev.sh 1894150
-http://svn.apache.org/viewvc?view=revision&revision=1894150
-
---- httpd-2.4.51/server/util_filter.c
-+++ httpd-2.4.51/server/util_filter.c
-@@ -565,8 +565,9 @@
-                                          apr_bucket_brigade *bb)
- {
-     if (next) {
--        apr_bucket *e;
--        if ((e = APR_BRIGADE_LAST(bb)) && APR_BUCKET_IS_EOS(e) && next->r) {
-+        apr_bucket *e = APR_BRIGADE_LAST(bb);
-+
-+        if (e != APR_BRIGADE_SENTINEL(bb) && APR_BUCKET_IS_EOS(e) && next->r) {
-             /* This is only safe because HTTP_HEADER filter is always in
-              * the filter stack.   This ensures that there is ALWAYS a
-              * request-based filter that we can attach this to.  If the
diff --git a/httpd.spec b/httpd.spec
index 31ff412..7c583c1 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.51
-Release: 3%{?dist}
+Version: 2.4.52
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -75,7 +75,6 @@ Patch24: httpd-2.4.43-corelimit.patch
 Patch25: httpd-2.4.43-selinux.patch
 Patch26: httpd-2.4.43-gettid.patch
 Patch27: httpd-2.4.43-icons.patch
-Patch28: httpd-2.4.51-openssl3.patch
 Patch30: httpd-2.4.43-cachehardmax.patch
 Patch34: httpd-2.4.43-socket-activation.patch
 Patch38: httpd-2.4.43-sslciphdefault.patch
@@ -90,7 +89,6 @@ Patch45: httpd-2.4.43-logjournal.patch
 Patch60: httpd-2.4.43-enable-sslv3.patch
 Patch61: httpd-2.4.48-r1878890.patch
 Patch63: httpd-2.4.46-htcacheclean-dont-break.patch
-Patch64: httpd-2.4.51-r1894150.patch
 Patch65: httpd-2.4.51-r1894152.patch
 
 # Security fixes
@@ -230,7 +228,6 @@ written in the Lua programming language.
 %patch25 -p1 -b .selinux
 %patch26 -p1 -b .gettid
 %patch27 -p1 -b .icons
-%patch28 -p1 -b .openssl3
 %patch30 -p1 -b .cachehardmax
 %patch34 -p1 -b .socketactivation
 %patch38 -p1 -b .sslciphdefault
@@ -243,7 +240,6 @@ written in the Lua programming language.
 %patch60 -p1 -b .enable-sslv3
 %patch61 -p1 -b .r1878890
 %patch63 -p1 -b .htcacheclean-dont-break
-%patch64 -p1 -b .r1894150
 %patch65 -p1 -b .r1894152
 
 # Patch in the vendor string
@@ -791,6 +787,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Dec 22 2021 Joe Orton <jorton@redhat.com> - 2.4.52-1
+- update to 2.4.52
+
 * Mon Dec 06 2021 Neal Gompa <ngompa@fedoraproject.org> - 2.4.51-3
 - Use NAME from os-release(5) for vendor string
   Related: #2029071 - httpd on CentOS identifies as RHEL
diff --git a/sources b/sources
index edbf616..ccf6e13 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.51.tar.bz2) = 9fb07c4b176f5c0485a143e2b1bb1085345ca9120b959974f68c37a8911a57894d2cb488b1b42fdf3102860b99e890204f5e9fa7ae3828b481119c563812cc66
-SHA512 (httpd-2.4.51.tar.bz2.asc) = c63f2b08eb0b7e688c4a89b4be1d968c9e4a3f09714ffc4fb9b2210b6694b8c90f4067aec63601ec41987507bba8dfcef15f54b8c0707cc49414c9c76dd5d8ce
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192
+SHA512 (httpd-2.4.52.tar.bz2) = 97c021c576022a9d32f4a390f62e07b5f550973aef2f299fd52defce1a9fa5d27bd4a676e7bf214373ba46063d34aecce42de62fdd93678a4e925cfcbb2afdf6
+SHA512 (httpd-2.4.52.tar.bz2.asc) = 59b8b86a9626525868ef72cfd8192102db0dc1e6a257040331b4a9abb872cbeace2fbc5c961c5dc35e7900eef987107ed3732e6527eb289fc9cf47654eec3f05

From d5e28192c4045e2a9b78f51ed763fe7b05386893 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 20 Jan 2022 12:29:29 +0000
Subject: [PATCH 261/359] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 7c583c1..c5b0b35 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.52
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -787,6 +787,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.52-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
 * Wed Dec 22 2021 Joe Orton <jorton@redhat.com> - 2.4.52-1
 - update to 2.4.52
 

From 545b11ecf3afe92e32207d094d9d539807c9b4c5 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 28 Jan 2022 12:02:05 +0000
Subject: [PATCH 262/359] use LIBTOOL=/usr/bin/libtool in the non-vendor
 config_vars.mk

---
 httpd.spec | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index c5b0b35..6eed48d 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.52
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -553,9 +553,12 @@ sed -i '/instdso/s,top_srcdir,top_builddir,' \
 cp -p $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk \
       $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk
 
-# Sanitize CFLAGS in standard config_vars.mk
-sed '/^CFLAGS/s,=.*$,= -O2 -g -Wall,' \
+# Sanitize CFLAGS & LIBTOOL in standard config_vars.mk
+sed -e '/^CFLAGS/s,=.*$,= -O2 -g -Wall,' \
+    -e '/^LIBTOOL/s,/.*/libtool,%{_bindir}/libtool,' \
     -i $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk
+diff -u $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk \
+     $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk || true
 
 sed 's/config_vars.mk/vendor_config_vars.mk/' \
     $RPM_BUILD_ROOT%{_bindir}/apxs \
@@ -787,6 +790,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jan 28 2022 Joe Orton <jorton@redhat.com> - 2.4.52-3
+- use LIBTOOL=/usr/bin/libtool in the non-vendor config_vars.mk
+
 * Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.52-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
 

From 98c306e3f2467bdb17e9664f4e1a7803105098a8 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 31 Jan 2022 08:23:58 +0000
Subject: [PATCH 263/359] add libtool to Requires: for httpd-devel (#2048281)

Resolves: rhbz#2048281
---
 httpd.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 6eed48d..dab255b 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.52
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -120,7 +120,7 @@ web server.
 
 %package devel
 Summary: Development interfaces for the Apache HTTP Server
-Requires: apr-devel, apr-util-devel, pkgconfig
+Requires: apr-devel, apr-util-devel, pkgconfig, libtool
 Requires: httpd = %{version}-%{release}
 
 %description devel
@@ -790,6 +790,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Jan 31 2022 Joe Orton <jorton@redhat.com> - 2.4.52-4
+- add libtool to Requires: for httpd-devel (#2048281)
+
 * Fri Jan 28 2022 Joe Orton <jorton@redhat.com> - 2.4.52-3
 - use LIBTOOL=/usr/bin/libtool in the non-vendor config_vars.mk
 

From af43dc5b98bddfb6c0e9d366b330b07b17f92f62 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 1 Feb 2022 08:59:37 +0000
Subject: [PATCH 264/359] rebuild for new OpenLDAP (#2032699)

Resolves: rhbz#2032699
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index dab255b..95dca7d 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.52
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -790,6 +790,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Feb  1 2022 Joe Orton <jorton@redhat.com> - 2.4.52-5
+- rebuild for new OpenLDAP (#2032699)
+
 * Mon Jan 31 2022 Joe Orton <jorton@redhat.com> - 2.4.52-4
 - add libtool to Requires: for httpd-devel (#2048281)
 

From cd09c3e5ec09991525f4223c7b03eb5ede6b1d37 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Thu, 17 Mar 2022 15:44:05 +0100
Subject: [PATCH 265/359] new version 2.4.53

fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719
---
 .gitignore                                       |  1 +
 ...md.patch => httpd-2.4.53-detect-systemd.patch | 16 ++++++++--------
 ....48-export.patch => httpd-2.4.53-export.patch | 13 +++----------
 httpd.spec                                       | 12 ++++++++----
 sources                                          |  4 ++--
 5 files changed, 22 insertions(+), 24 deletions(-)
 rename httpd-2.4.43-detect-systemd.patch => httpd-2.4.53-detect-systemd.patch (76%)
 rename httpd-2.4.48-export.patch => httpd-2.4.53-export.patch (83%)

diff --git a/.gitignore b/.gitignore
index a6fac0d..64b8899 100644
--- a/.gitignore
+++ b/.gitignore
@@ -43,3 +43,4 @@ x86_64
 /httpd-2.4.50.tar.bz2.asc
 /httpd-2.4.51.tar.bz2.asc
 /httpd-2.4.52.tar.bz2.asc
+/httpd-2.4.53.tar.bz2.asc
diff --git a/httpd-2.4.43-detect-systemd.patch b/httpd-2.4.53-detect-systemd.patch
similarity index 76%
rename from httpd-2.4.43-detect-systemd.patch
rename to httpd-2.4.53-detect-systemd.patch
index 540687f..d501b06 100644
--- a/httpd-2.4.43-detect-systemd.patch
+++ b/httpd-2.4.53-detect-systemd.patch
@@ -1,5 +1,5 @@
 diff --git a/Makefile.in b/Makefile.in
-index 0b088ac..9eeb5c7 100644
+index a2e9c82..bd8045c 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -4,7 +4,7 @@ CLEAN_SUBDIRS = test
@@ -12,10 +12,10 @@ index 0b088ac..9eeb5c7 100644
  PROGRAM_DEPENDENCIES = \
    server/libmain.la \
 diff --git a/acinclude.m4 b/acinclude.m4
-index 2a7e5d1..eb28321 100644
+index 97484c9..05abe18 100644
 --- a/acinclude.m4
 +++ b/acinclude.m4
-@@ -624,6 +624,7 @@ case $host in
+@@ -631,6 +631,7 @@ case $host in
        if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
          AC_MSG_WARN([Your system does not support systemd.])
        else
@@ -24,18 +24,18 @@ index 2a7e5d1..eb28321 100644
        fi
     fi
 diff --git a/configure.in b/configure.in
-index 3618a5a..74a782b 100644
+index cf437fe..521fc45 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -234,6 +234,7 @@ if test "$PCRE_CONFIG" != "false"; then
+@@ -239,6 +239,7 @@ if test "x$PCRE_CONFIG" != "x"; then
    AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG])
    APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`])
-   APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs`])
+   APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs8 2>/dev/null || $PCRE_CONFIG --libs`])
 +  APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)])
  else
-   AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/])
+   AC_MSG_ERROR([pcre(2)-config for libpcre not found. PCRE is required and available from http://pcre.org/])
  fi
-@@ -710,6 +711,7 @@ APACHE_SUBST(OS_DIR)
+@@ -734,6 +735,7 @@ APACHE_SUBST(OS_DIR)
  APACHE_SUBST(BUILTIN_LIBS)
  APACHE_SUBST(SHLIBPATH_VAR)
  APACHE_SUBST(OS_SPECIFIC_VARS)
diff --git a/httpd-2.4.48-export.patch b/httpd-2.4.53-export.patch
similarity index 83%
rename from httpd-2.4.48-export.patch
rename to httpd-2.4.53-export.patch
index 439f768..d240360 100644
--- a/httpd-2.4.48-export.patch
+++ b/httpd-2.4.53-export.patch
@@ -1,12 +1,5 @@
-
-Reduce size of httpd binary by telling linker to export all symbols
-from libmain.a, rather than bloating the symbol table with ap_hack_*
-to do so indirectly.
-
-Upstream: https://svn.apache.org/r1861685 (as new default-off configure option)
-
 diff --git a/Makefile.in b/Makefile.in
-index 40c7076..ac98e5f 100644
+index bd8045c..d6733a5 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test
@@ -40,10 +33,10 @@ index 8111877..f00bb3f 100644
  	eoc_bucket.c eor_bucket.c core_filters.c \
  	util_expr_parse.c util_expr_scan.c util_expr_eval.c
 diff --git a/server/main.c b/server/main.c
-index 62e06df..17c09ee 100644
+index 7da7aa2..e63d2eb 100644
 --- a/server/main.c
 +++ b/server/main.c
-@@ -835,17 +835,3 @@ int main(int argc, const char * const argv[])
+@@ -857,17 +857,3 @@ int main(int argc, const char * const argv[])
      return !OK;
  }
  
diff --git a/httpd.spec b/httpd.spec
index 95dca7d..713b5f9 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -12,8 +12,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.52
-Release: 5%{?dist}
+Version: 2.4.53
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -66,11 +66,11 @@ Source48: apache-poweredby.png
 Patch2: httpd-2.4.43-apxs.patch
 Patch3: httpd-2.4.43-deplibs.patch
 # Needed for socket activation and mod_systemd patch
-Patch19: httpd-2.4.43-detect-systemd.patch
+Patch19: httpd-2.4.53-detect-systemd.patch
 # Features/functional changes
 Patch21: httpd-2.4.48-r1842929+.patch
 Patch22: httpd-2.4.43-mod_systemd.patch
-Patch23: httpd-2.4.48-export.patch
+Patch23: httpd-2.4.53-export.patch
 Patch24: httpd-2.4.43-corelimit.patch
 Patch25: httpd-2.4.43-selinux.patch
 Patch26: httpd-2.4.43-gettid.patch
@@ -790,6 +790,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Mar 17 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-1
+- new version 2.4.53
+- fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719
+
 * Tue Feb  1 2022 Joe Orton <jorton@redhat.com> - 2.4.52-5
 - rebuild for new OpenLDAP (#2032699)
 
diff --git a/sources b/sources
index ccf6e13..36266ed 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
+SHA512 (httpd-2.4.53.tar.bz2) = 07ef59594251a30a864cc9cc9a58ab788c2d006cef85b728f29533243927c63cb063e0867f2a306f37324c3adb9cf7dcb2402f3516b05c2c6f32469d475dd756
+SHA512 (httpd-2.4.53.tar.bz2.asc) = 553df571cf8edda9146c2aaadce7e5a204f9aa8bd05b165dd81e2339db830c06bdb2b546321d3ab1dcc3133a7d37bbbeb31944b725d8a5fc6b6dc389a5c25686
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192
-SHA512 (httpd-2.4.52.tar.bz2) = 97c021c576022a9d32f4a390f62e07b5f550973aef2f299fd52defce1a9fa5d27bd4a676e7bf214373ba46063d34aecce42de62fdd93678a4e925cfcbb2afdf6
-SHA512 (httpd-2.4.52.tar.bz2.asc) = 59b8b86a9626525868ef72cfd8192102db0dc1e6a257040331b4a9abb872cbeace2fbc5c961c5dc35e7900eef987107ed3732e6527eb289fc9cf47654eec3f05

From d9ddc5dc92dab5509d5c763fd25ff7bfcd55b322 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 30 Mar 2022 19:33:41 +0200
Subject: [PATCH 266/359] Try to minimize httpd dependencies

- essential binaries moved to httpd-core package
- mod_brotli and mod_systemd are now in httpd main package together with
  .service files
- httpd is no longer linked (-lsystemd), all systemd functions moved to
  mod_systemd module which is now shipped in main httpd package
---
 00-base.conf                            |   1 -
 00-brotli.conf                          |   1 +
 httpd-2.4.53-separate-systemd-fns.patch | 264 ++++++++++++++++++++++++
 httpd.spec                              |  60 ++++--
 4 files changed, 307 insertions(+), 19 deletions(-)
 create mode 100644 00-brotli.conf
 create mode 100644 httpd-2.4.53-separate-systemd-fns.patch

diff --git a/00-base.conf b/00-base.conf
index 7cabce0..d0123d1 100644
--- a/00-base.conf
+++ b/00-base.conf
@@ -23,7 +23,6 @@ LoadModule authz_host_module modules/mod_authz_host.so
 LoadModule authz_owner_module modules/mod_authz_owner.so
 LoadModule authz_user_module modules/mod_authz_user.so
 LoadModule autoindex_module modules/mod_autoindex.so
-LoadModule brotli_module modules/mod_brotli.so
 LoadModule cache_module modules/mod_cache.so
 LoadModule cache_disk_module modules/mod_cache_disk.so
 LoadModule cache_socache_module modules/mod_cache_socache.so
diff --git a/00-brotli.conf b/00-brotli.conf
new file mode 100644
index 0000000..c2e0e9e
--- /dev/null
+++ b/00-brotli.conf
@@ -0,0 +1 @@
+LoadModule brotli_module modules/mod_brotli.so
diff --git a/httpd-2.4.53-separate-systemd-fns.patch b/httpd-2.4.53-separate-systemd-fns.patch
new file mode 100644
index 0000000..14c5f70
--- /dev/null
+++ b/httpd-2.4.53-separate-systemd-fns.patch
@@ -0,0 +1,264 @@
+diff --git a/acinclude.m4 b/acinclude.m4
+index 05abe18..97484c9 100644
+--- a/acinclude.m4
++++ b/acinclude.m4
+@@ -631,7 +631,6 @@ case $host in
+       if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
+         AC_MSG_WARN([Your system does not support systemd.])
+       else
+-        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
+         AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
+       fi
+    fi
+diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
+index eda1272..fc059fc 100644
+--- a/modules/arch/unix/mod_systemd.c
++++ b/modules/arch/unix/mod_systemd.c
+@@ -35,6 +35,15 @@
+ #include <unistd.h>
+ #endif
+ 
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_find_systemd_socket, (process_rec *, apr_port_t));
++
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_systemd_listen_fds, (int));
++
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_systemd_journal_stream_fd, (const char *, int, int));
++
+ static char describe_listeners[30];
+ 
+ static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
+@@ -145,8 +154,47 @@ static int systemd_monitor(apr_pool_t *p, server_rec *s)
+     return DECLINED;
+ }
+ 
++static int ap_find_systemd_socket(process_rec * process, apr_port_t port) {
++    int fdcount, fd;
++    int sdc = sd_listen_fds(0);
++
++    if (sdc < 0) {
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486)
++                      "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d",
++                      sdc);
++        return -1;
++    }
++
++    if (sdc == 0) {
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487)
++                      "find_systemd_socket: At least one socket must be set.");
++        return -1;
++    }
++
++    fdcount = atoi(getenv("LISTEN_FDS"));
++    for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) {
++        if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) {
++            return fd;
++        }
++    }
++
++    return -1;
++}
++
++static int ap_systemd_listen_fds(int unset_environment){
++    return sd_listen_fds(unset_environment);
++}
++
++static int ap_systemd_journal_stream_fd(const char *identifier, int priority, int level_prefix){
++    return sd_journal_stream_fd("httpd", priority, 0);
++}
++
+ static void systemd_register_hooks(apr_pool_t *p)
+ {
++    APR_REGISTER_OPTIONAL_FN(ap_systemd_listen_fds);
++    APR_REGISTER_OPTIONAL_FN(ap_find_systemd_socket);
++    APR_REGISTER_OPTIONAL_FN(ap_systemd_journal_stream_fd);
++
+     /* Enable ap_extended_status. */
+     ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
+     /* Signal service is ready. */
+diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4
+index 0848d2e..8af2299 100644
+--- a/modules/loggers/config.m4
++++ b/modules/loggers/config.m4
+@@ -5,7 +5,6 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]])
+ APACHE_MODPATH_INIT(loggers)
+ 	
+ APACHE_MODULE(log_config, logging configuration.  You won't be able to log requests to the server without this module., , , yes)
+-APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS])
+ 
+ APACHE_MODULE(log_debug, configurable debug logging, , , most)
+ APACHE_MODULE(log_forensic, forensic logging)
+diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c
+index 0b11f60..04f08ca 100644
+--- a/modules/loggers/mod_log_config.c
++++ b/modules/loggers/mod_log_config.c
+@@ -172,14 +172,16 @@
+ #include <limits.h>
+ #endif
+ 
+-#ifdef HAVE_SYSTEMD
+-#include <systemd/sd-journal.h>
+-#endif
+-
+ #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b"
+ 
+ module AP_MODULE_DECLARE_DATA log_config_module;
+ 
++#ifdef HAVE_SYSTEMD
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_systemd_journal_stream_fd, (const char *, int, int));
++
++#endif
++
+ 
+ static int xfer_flags = (APR_WRITE | APR_APPEND | APR_CREATE | APR_LARGEFILE);
+ static apr_fileperms_t xfer_perms = APR_OS_DEFAULT;
+@@ -1640,8 +1642,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd,
+ {
+ #ifdef HAVE_SYSTEMD
+     int fd;
++    APR_OPTIONAL_FN_TYPE(ap_systemd_journal_stream_fd) *systemd_journal_stream_fd;
++    
++    systemd_journal_stream_fd = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_journal_stream_fd);
++    if (systemd_journal_stream_fd == NULL) {
++        return APR_ENOTIMPL;
++    }
+ 
+-    fd = sd_journal_stream_fd("httpd", priority, 0);
++    fd = systemd_journal_stream_fd("httpd", priority, 0);
++    
+     if (fd < 0) return fd;
+ 
+     /* This is an AF_UNIX socket fd so is more pipe-like than
+diff --git a/server/listen.c b/server/listen.c
+index e2e028a..217caf2 100644
+--- a/server/listen.c
++++ b/server/listen.c
+@@ -34,10 +34,6 @@
+ #include <unistd.h>
+ #endif
+ 
+-#ifdef HAVE_SYSTEMD
+-#include <systemd/sd-daemon.h>
+-#endif
+-
+ /* we know core's module_index is 0 */
+ #undef APLOG_MODULE_INDEX
+ #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX
+@@ -65,6 +61,12 @@ static int send_buffer_size;
+ static int receive_buffer_size;
+ #ifdef HAVE_SYSTEMD
+ static int use_systemd = -1;
++
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_find_systemd_socket, (process_rec *, apr_port_t));
++
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_systemd_listen_fds, (int));
+ #endif
+ 
+ /* TODO: make_sock is just begging and screaming for APR abstraction */
+@@ -325,34 +327,6 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
+ }
+ 
+ #ifdef HAVE_SYSTEMD
+-
+-static int find_systemd_socket(process_rec * process, apr_port_t port) {
+-    int fdcount, fd;
+-    int sdc = sd_listen_fds(0);
+-
+-    if (sdc < 0) {
+-        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486)
+-                      "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d",
+-                      sdc);
+-        return -1;
+-    }
+-
+-    if (sdc == 0) {
+-        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487)
+-                      "find_systemd_socket: At least one socket must be set.");
+-        return -1;
+-    }
+-
+-    fdcount = atoi(getenv("LISTEN_FDS"));
+-    for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) {
+-        if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) {
+-            return fd;
+-        }
+-    }
+-
+-    return -1;
+-}
+-
+ static apr_status_t alloc_systemd_listener(process_rec * process,
+                                            int fd, const char *proto,
+                                            ap_listen_rec **out_rec)
+@@ -412,6 +386,14 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
+ {
+     ap_listen_rec *last, *new;
+     apr_status_t rv;
++    APR_OPTIONAL_FN_TYPE(ap_find_systemd_socket) *find_systemd_socket;
++
++    find_systemd_socket = APR_RETRIEVE_OPTIONAL_FN(ap_find_systemd_socket);
++
++    if (!find_systemd_socket)
++       return "Systemd socket activation is used, but mod_systemd is probably"
++               "not loaded";
++
+     int fd = find_systemd_socket(process, port);
+     if (fd < 0) {
+         return "Systemd socket activation is used, but this port is not "
+@@ -438,7 +420,6 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
+ 
+     return NULL;
+ }
+-
+ #endif /* HAVE_SYSTEMD */
+ 
+ static const char *alloc_listener(process_rec *process, const char *addr,
+@@ -707,6 +688,9 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+     int num_listeners = 0;
+     const char* proto;
+     int found;
++#ifdef HAVE_SYSTEMD
++    APR_OPTIONAL_FN_TYPE(ap_systemd_listen_fds) *systemd_listen_fds;
++#endif
+ 
+     for (ls = s; ls; ls = ls->next) {
+         proto = ap_get_server_protocol(ls);
+@@ -746,7 +730,10 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+                                 apr_pool_cleanup_null, s->process->pool);
+         }
+         else {
+-            sd_listen_fds(1);
++            systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds);
++            if (systemd_listen_fds != NULL) {
++                systemd_listen_fds(1);
++            }
+         }
+     }
+     else
+@@ -963,6 +950,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+     apr_port_t port;
+     apr_status_t rv;
+     const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
++#ifdef HAVE_SYSTEMD
++    APR_OPTIONAL_FN_TYPE(ap_systemd_listen_fds) *systemd_listen_fds;
++#endif
+ 
+     if (err != NULL) {
+         return err;
+@@ -973,7 +963,10 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+     }
+ #ifdef HAVE_SYSTEMD
+     if (use_systemd == -1) {
+-        use_systemd = sd_listen_fds(0) > 0;
++        systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds);
++        if (systemd_listen_fds != NULL) {
++            use_systemd = systemd_listen_fds(0) > 0;
++        }
+     }
+ #endif
+ 
diff --git a/httpd.spec b/httpd.spec
index 713b5f9..e1b6162 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -52,6 +52,7 @@ Source31: README.confmod
 Source32: httpd.service.xml
 Source33: htcacheclean.service.xml
 Source34: httpd.conf.xml
+Source35: 00-brotli.conf
 Source40: htcacheclean.service
 Source41: htcacheclean.sysconf
 Source42: httpd-init.service
@@ -83,6 +84,7 @@ Patch40: httpd-2.4.43-r1861269.patch
 Patch41: httpd-2.4.43-r1861793+.patch
 Patch42: httpd-2.4.48-r1828172+.patch
 Patch45: httpd-2.4.43-logjournal.patch
+Patch46: httpd-2.4.53-separate-systemd-fns.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -99,25 +101,33 @@ BuildRequires: perl-interpreter, perl-generators, systemd-devel
 BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0
 BuildRequires: gnupg2
-Requires: /etc/mime.types, system-logos(httpd-logo-ng)
+Requires: system-logos(httpd-logo-ng)
 Provides: webserver
-Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release}
-Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa}
-Requires: httpd-tools = %{version}-%{release}
-Requires: httpd-filesystem = %{version}-%{release}
+Requires: httpd-core = 0:%{version}-%{release}
 Recommends: mod_http2, mod_lua
-Requires(pre): httpd-filesystem
 Requires(preun): systemd-units
 Requires(postun): systemd-units
 Requires(post): systemd-units
-Conflicts: apr < 1.5.0-1
-Provides: mod_proxy_uwsgi = %{version}-%{release}
-Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2
 
 %description
 The Apache HTTP Server is a powerful, efficient, and extensible
 web server.
 
+%package core
+Summary: httpd minimal core
+Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release}
+Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa}
+Provides: mod_proxy_uwsgi = %{version}-%{release}
+Requires: /etc/mime.types
+Requires: httpd-tools = %{version}-%{release}
+Requires: httpd-filesystem = %{version}-%{release}
+Requires(pre): httpd-filesystem
+Conflicts: apr < 1.5.0-1
+Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2
+
+%description core
+The httpd-core package contains essential httpd binaries.
+
 %package devel
 Summary: Development interfaces for the Apache HTTP Server
 Requires: apr-devel, apr-util-devel, pkgconfig, libtool
@@ -236,6 +246,7 @@ written in the Lua programming language.
 %patch41 -p1 -b .r1861793+
 %patch42 -p1 -b .r1828172+
 %patch45 -p1 -b .logjournal
+%patch46 -p1 -b .separatesystemd
 
 %patch60 -p1 -b .enable-sslv3
 %patch61 -p1 -b .r1878890
@@ -372,7 +383,8 @@ install -m 644 $RPM_SOURCE_DIR/README.confmod \
     $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/README
 for f in 00-base.conf 00-mpm.conf 00-lua.conf 01-cgi.conf 00-dav.conf \
          00-proxy.conf 00-ssl.conf 01-ldap.conf 00-proxyhtml.conf \
-         01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf; do
+         01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf \
+         00-brotli.conf; do
   install -m 644 -p $RPM_SOURCE_DIR/$f \
         $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/$f
 done
@@ -649,7 +661,21 @@ set -x
 exit $rv
 
 %files
+%{_mandir}/man8/*
+%{_mandir}/man5/*
+%exclude %{_mandir}/man8/httpd-init.*
 
+%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-brotli.conf
+%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-systemd.conf
+%{_libdir}/httpd/modules/mod_brotli.so
+%{_libdir}/httpd/modules/mod_systemd.so
+
+%{_unitdir}/httpd.service
+%{_unitdir}/httpd@.service
+%{_unitdir}/htcacheclean.service
+%{_unitdir}/*.socket
+
+%files core
 %doc ABOUT_APACHE README CHANGES LICENSE VERSIONING NOTICE
 %doc docs/conf/extra/*.conf
 %doc instance.conf server-status.conf
@@ -659,6 +685,7 @@ exit $rv
 %{_sysconfdir}/httpd/state
 %{_sysconfdir}/httpd/run
 %dir %{_sysconfdir}/httpd/conf
+
 %config(noreplace) %{_sysconfdir}/httpd/conf/httpd.conf
 %config(noreplace) %{_sysconfdir}/httpd/conf/magic
 
@@ -670,7 +697,10 @@ exit $rv
 
 %dir %{_sysconfdir}/httpd/conf.modules.d
 %{_sysconfdir}/httpd/conf.modules.d/README
+
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/*.conf
+%exclude %{_sysconfdir}/httpd/conf.modules.d/00-brotli.conf
+%exclude %{_sysconfdir}/httpd/conf.modules.d/00-systemd.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/00-ssl.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/00-lua.conf
@@ -692,6 +722,8 @@ exit $rv
 %dir %{_libdir}/httpd
 %dir %{_libdir}/httpd/modules
 %{_libdir}/httpd/modules/mod*.so
+%exclude %{_libdir}/httpd/modules/mod_brotli.so
+%exclude %{_libdir}/httpd/modules/mod_systemd.so
 %exclude %{_libdir}/httpd/modules/mod_auth_form.so
 %exclude %{_libdir}/httpd/modules/mod_ssl.so
 %exclude %{_libdir}/httpd/modules/mod_*ldap.so
@@ -718,14 +750,6 @@ exit $rv
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd/proxy
 
-%{_mandir}/man8/*
-%{_mandir}/man5/*
-%exclude %{_mandir}/man8/httpd-init.*
-
-%{_unitdir}/httpd.service
-%{_unitdir}/httpd@.service
-%{_unitdir}/htcacheclean.service
-%{_unitdir}/*.socket
 
 %files filesystem
 %dir %{_sysconfdir}/httpd

From af40323aac32d8fc18f81d3d7ad398beec8ca1e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 30 Mar 2022 22:25:02 +0200
Subject: [PATCH 267/359] - bump package version

---
 httpd.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index e1b6162..74bf195 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.53
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -814,6 +814,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Mar 30 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-2
+- try to minimize httpd dependencies (new httpd-core package)
+- mod_systemd and mod_brotli are now in the main httpd package
+
 * Thu Mar 17 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-1
 - new version 2.4.53
 - fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719

From 72f074878a48f92d0432b8a06dca5de77f7a5073 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Thu, 31 Mar 2022 14:28:16 +0200
Subject: [PATCH 268/359] - add rhbz to ChangeLog and move OPT functions
 declaration

- OPT functions declaration move to header files
- added rhbz to ChangeLog
---
 httpd-2.4.53-separate-systemd-fns.patch | 88 +++++++++++++++----------
 httpd.spec                              |  1 +
 2 files changed, 55 insertions(+), 34 deletions(-)

diff --git a/httpd-2.4.53-separate-systemd-fns.patch b/httpd-2.4.53-separate-systemd-fns.patch
index 14c5f70..f495a44 100644
--- a/httpd-2.4.53-separate-systemd-fns.patch
+++ b/httpd-2.4.53-separate-systemd-fns.patch
@@ -10,6 +10,34 @@ index 05abe18..97484c9 100644
          AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
        fi
     fi
+diff --git a/include/ap_listen.h b/include/ap_listen.h
+index 58c2574..d5ed968 100644
+--- a/include/ap_listen.h
++++ b/include/ap_listen.h
+@@ -29,6 +29,7 @@
+ #include "apr_network_io.h"
+ #include "httpd.h"
+ #include "http_config.h"
++#include "apr_optional.h"
+ 
+ #ifdef __cplusplus
+ extern "C" {
+@@ -143,6 +144,15 @@ AP_DECLARE_NONSTD(const char *) ap_set_receive_buffer_size(cmd_parms *cmd,
+                                                            void *dummy,
+                                                            const char *arg);
+ 
++#ifdef HAVE_SYSTEMD
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_find_systemd_socket, (process_rec *, apr_port_t));
++
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_systemd_listen_fds, (int));
++#endif
++
++
+ #define LISTEN_COMMANDS \
+ AP_INIT_TAKE1("ListenBacklog", ap_set_listenbacklog, NULL, RSRC_CONF, \
+   "Maximum length of the queue of pending connections, as used by listen(2)"), \
 diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
 index eda1272..fc059fc 100644
 --- a/modules/arch/unix/mod_systemd.c
@@ -91,10 +119,10 @@ index 0848d2e..8af2299 100644
  APACHE_MODULE(log_debug, configurable debug logging, , , most)
  APACHE_MODULE(log_forensic, forensic logging)
 diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c
-index 0b11f60..04f08ca 100644
+index 0b11f60..c3f0a51 100644
 --- a/modules/loggers/mod_log_config.c
 +++ b/modules/loggers/mod_log_config.c
-@@ -172,14 +172,16 @@
+@@ -172,10 +172,6 @@
  #include <limits.h>
  #endif
  
@@ -105,17 +133,7 @@ index 0b11f60..04f08ca 100644
  #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b"
  
  module AP_MODULE_DECLARE_DATA log_config_module;
- 
-+#ifdef HAVE_SYSTEMD
-+APR_DECLARE_OPTIONAL_FN(int,
-+                        ap_systemd_journal_stream_fd, (const char *, int, int));
-+
-+#endif
-+
- 
- static int xfer_flags = (APR_WRITE | APR_APPEND | APR_CREATE | APR_LARGEFILE);
- static apr_fileperms_t xfer_perms = APR_OS_DEFAULT;
-@@ -1640,8 +1642,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd,
+@@ -1640,8 +1636,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd,
  {
  #ifdef HAVE_SYSTEMD
      int fd;
@@ -132,8 +150,23 @@ index 0b11f60..04f08ca 100644
      if (fd < 0) return fd;
  
      /* This is an AF_UNIX socket fd so is more pipe-like than
+diff --git a/modules/loggers/mod_log_config.h b/modules/loggers/mod_log_config.h
+index 877a593..bd52a98 100644
+--- a/modules/loggers/mod_log_config.h
++++ b/modules/loggers/mod_log_config.h
+@@ -69,6 +69,10 @@ APR_DECLARE_OPTIONAL_FN(ap_log_writer_init*, ap_log_set_writer_init,(ap_log_writ
+  */
+ APR_DECLARE_OPTIONAL_FN(ap_log_writer*, ap_log_set_writer, (ap_log_writer* func));
+ 
++#ifdef HAVE_SYSTEMD
++APR_DECLARE_OPTIONAL_FN(int, ap_systemd_journal_stream_fd, (const char *, int, int));
++#endif
++
+ #endif /* MOD_LOG_CONFIG */
+ /** @} */
+ 
 diff --git a/server/listen.c b/server/listen.c
-index e2e028a..217caf2 100644
+index e2e028a..aa6f91c 100644
 --- a/server/listen.c
 +++ b/server/listen.c
 @@ -34,10 +34,6 @@
@@ -147,20 +180,7 @@ index e2e028a..217caf2 100644
  /* we know core's module_index is 0 */
  #undef APLOG_MODULE_INDEX
  #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX
-@@ -65,6 +61,12 @@ static int send_buffer_size;
- static int receive_buffer_size;
- #ifdef HAVE_SYSTEMD
- static int use_systemd = -1;
-+
-+APR_DECLARE_OPTIONAL_FN(int,
-+                        ap_find_systemd_socket, (process_rec *, apr_port_t));
-+
-+APR_DECLARE_OPTIONAL_FN(int,
-+                        ap_systemd_listen_fds, (int));
- #endif
- 
- /* TODO: make_sock is just begging and screaming for APR abstraction */
-@@ -325,34 +327,6 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
+@@ -325,34 +321,6 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
  }
  
  #ifdef HAVE_SYSTEMD
@@ -195,7 +215,7 @@ index e2e028a..217caf2 100644
  static apr_status_t alloc_systemd_listener(process_rec * process,
                                             int fd, const char *proto,
                                             ap_listen_rec **out_rec)
-@@ -412,6 +386,14 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
+@@ -412,6 +380,14 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
  {
      ap_listen_rec *last, *new;
      apr_status_t rv;
@@ -210,7 +230,7 @@ index e2e028a..217caf2 100644
      int fd = find_systemd_socket(process, port);
      if (fd < 0) {
          return "Systemd socket activation is used, but this port is not "
-@@ -438,7 +420,6 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
+@@ -438,7 +414,6 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
  
      return NULL;
  }
@@ -218,7 +238,7 @@ index e2e028a..217caf2 100644
  #endif /* HAVE_SYSTEMD */
  
  static const char *alloc_listener(process_rec *process, const char *addr,
-@@ -707,6 +688,9 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+@@ -707,6 +682,9 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
      int num_listeners = 0;
      const char* proto;
      int found;
@@ -228,7 +248,7 @@ index e2e028a..217caf2 100644
  
      for (ls = s; ls; ls = ls->next) {
          proto = ap_get_server_protocol(ls);
-@@ -746,7 +730,10 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+@@ -746,7 +724,10 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
                                  apr_pool_cleanup_null, s->process->pool);
          }
          else {
@@ -240,7 +260,7 @@ index e2e028a..217caf2 100644
          }
      }
      else
-@@ -963,6 +950,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -963,6 +944,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
      apr_port_t port;
      apr_status_t rv;
      const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
@@ -250,7 +270,7 @@ index e2e028a..217caf2 100644
  
      if (err != NULL) {
          return err;
-@@ -973,7 +963,10 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -973,7 +957,10 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
      }
  #ifdef HAVE_SYSTEMD
      if (use_systemd == -1) {
diff --git a/httpd.spec b/httpd.spec
index 74bf195..ffbc289 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -815,6 +815,7 @@ exit $rv
 
 %changelog
 * Wed Mar 30 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-2
+- Resolves: #2070517 - Allow install httpd with smaller footprint
 - try to minimize httpd dependencies (new httpd-core package)
 - mod_systemd and mod_brotli are now in the main httpd package
 

From ee221cb72ccb1e6405dbef1634654f58d5c417a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Thu, 7 Apr 2022 14:41:27 +0200
Subject: [PATCH 269/359] Related: #2070517 - fix issue when mod_systemd is not
 loaded

---
 httpd-2.4.53-separate-systemd-fns.patch | 8 +++++---
 httpd.spec                              | 7 +++++--
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/httpd-2.4.53-separate-systemd-fns.patch b/httpd-2.4.53-separate-systemd-fns.patch
index f495a44..88b99ff 100644
--- a/httpd-2.4.53-separate-systemd-fns.patch
+++ b/httpd-2.4.53-separate-systemd-fns.patch
@@ -166,7 +166,7 @@ index 877a593..bd52a98 100644
  /** @} */
  
 diff --git a/server/listen.c b/server/listen.c
-index e2e028a..aa6f91c 100644
+index e2e028a..5d1c0e1 100644
 --- a/server/listen.c
 +++ b/server/listen.c
 @@ -34,10 +34,6 @@
@@ -224,7 +224,7 @@ index e2e028a..aa6f91c 100644
 +    find_systemd_socket = APR_RETRIEVE_OPTIONAL_FN(ap_find_systemd_socket);
 +
 +    if (!find_systemd_socket)
-+       return "Systemd socket activation is used, but mod_systemd is probably"
++       return "Systemd socket activation is used, but mod_systemd is probably "
 +               "not loaded";
 +
      int fd = find_systemd_socket(process, port);
@@ -270,7 +270,7 @@ index e2e028a..aa6f91c 100644
  
      if (err != NULL) {
          return err;
-@@ -973,7 +957,10 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -973,7 +957,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
      }
  #ifdef HAVE_SYSTEMD
      if (use_systemd == -1) {
@@ -278,6 +278,8 @@ index e2e028a..aa6f91c 100644
 +        systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds);
 +        if (systemd_listen_fds != NULL) {
 +            use_systemd = systemd_listen_fds(0) > 0;
++        } else {
++            use_systemd = 0;
 +        }
      }
  #endif
diff --git a/httpd.spec b/httpd.spec
index ffbc289..12b67c8 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.53
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -246,7 +246,7 @@ written in the Lua programming language.
 %patch41 -p1 -b .r1861793+
 %patch42 -p1 -b .r1828172+
 %patch45 -p1 -b .logjournal
-%patch46 -p1 -b .separatesystemd
+#patch46 -p1 -b .separatesystemd
 
 %patch60 -p1 -b .enable-sslv3
 %patch61 -p1 -b .r1878890
@@ -814,6 +814,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Apr 07 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-3
+- Related: #2070517 - fix issue when mod_systemd is not loaded
+
 * Wed Mar 30 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-2
 - Resolves: #2070517 - Allow install httpd with smaller footprint
 - try to minimize httpd dependencies (new httpd-core package)

From dd6a83760148669d65dbcc64ae5cfcd4b869d00d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Thu, 7 Apr 2022 14:44:01 +0200
Subject: [PATCH 270/359] Related: #2070517 - forgot to enable patch again

---
 httpd.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 12b67c8..a2cafc3 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -246,7 +246,7 @@ written in the Lua programming language.
 %patch41 -p1 -b .r1861793+
 %patch42 -p1 -b .r1828172+
 %patch45 -p1 -b .logjournal
-#patch46 -p1 -b .separatesystemd
+%patch46 -p1 -b .separatesystemd
 
 %patch60 -p1 -b .enable-sslv3
 %patch61 -p1 -b .r1878890

From 617530796774531ea87471f2cf8895b6127a0732 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 20 Apr 2022 14:34:09 +0100
Subject: [PATCH 271/359] switch to PCRE2 for new releases

---
 httpd.spec | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index a2cafc3..cf612b8 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -10,10 +10,18 @@
 %global mpm prefork
 %endif
 
+%if 0%{?fedora} > 36 || 0%{?rhel} > 9
+%bcond_without pcre2
+%bcond_with pcre
+%else
+%bcond_with pcre2
+%bcond_without pcre
+%endif
+
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.53
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -99,7 +107,13 @@ License: ASL 2.0
 BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto
 BuildRequires: perl-interpreter, perl-generators, systemd-devel
 BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
-BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0
+BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0
+%if %{with pcre2}
+BuildRequires: pcre2-devel
+%endif
+%if %{with pcre}
+BuildRequires: pcre-devel > 5.0
+%endif
 BuildRequires: gnupg2
 Requires: system-logos(httpd-logo-ng)
 Provides: webserver
@@ -300,6 +314,7 @@ xmlto man %{SOURCE47}
 
 : Building with MMN %{mmn}, MMN-ISA %{mmnisa}
 : Default MPM is %{mpm}, vendor string is '%{vstring}'
+: Regex Engine: PCRE=%{with pcre} PCRE2=%{with pcre2}
 
 %build
 # forcibly prevent use of bundled apr, apr-util, pcre
@@ -344,7 +359,12 @@ export LYNX_PATH=/usr/bin/links
         --with-suexec-uidmin=1000 --with-suexec-gidmin=1000 \
         --with-brotli \
         --enable-pie \
+%if %{with pcre2}
+        --with-pcre2 \
+%endif
+%if %{with pcre}
         --with-pcre \
+%endif
         --enable-mods-shared=all \
         --enable-ssl --with-ssl --disable-distcache \
         --enable-proxy --enable-proxy-fdpass \
@@ -814,6 +834,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Apr 20 2022 Joe Orton <jorton@redhat.com> - 2.4.53-4
+- switch to PCRE2 for new releases
+
 * Thu Apr 07 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-3
 - Related: #2070517 - fix issue when mod_systemd is not loaded
 

From 431047787e0c7db54ea8a8a1ea14676f8ad8b942 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 22 Apr 2022 13:16:56 +0200
Subject: [PATCH 272/359] don't use bomb.gif icon for all files/dirs ending
 with core

---
 httpd-2.4.43-icons.patch | 22 ----------------------
 httpd.spec               |  7 +++++--
 2 files changed, 5 insertions(+), 24 deletions(-)
 delete mode 100644 httpd-2.4.43-icons.patch

diff --git a/httpd-2.4.43-icons.patch b/httpd-2.4.43-icons.patch
deleted file mode 100644
index 21518d7..0000000
--- a/httpd-2.4.43-icons.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/docs/conf/extra/httpd-autoindex.conf.in b/docs/conf/extra/httpd-autoindex.conf.in
-index 51b02ed..0e8b626 100644
---- a/docs/conf/extra/httpd-autoindex.conf.in
-+++ b/docs/conf/extra/httpd-autoindex.conf.in
-@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable VersionSort
- Alias /icons/ "@exp_iconsdir@/"
- 
- <Directory "@exp_iconsdir@">
--    Options Indexes MultiViews
-+    Options Indexes MultiViews FollowSymlinks
-     AllowOverride None
-     Require all granted
- </Directory>
-@@ -53,7 +53,7 @@ AddIcon /icons/dvi.gif .dvi
- AddIcon /icons/uuencoded.gif .uu
- AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
- AddIcon /icons/tex.gif .tex
--AddIcon /icons/bomb.gif core
-+AddIcon /icons/bomb.gif core.
- 
- AddIcon /icons/back.gif ..
- AddIcon /icons/hand.right.gif README
diff --git a/httpd.spec b/httpd.spec
index cf612b8..804746d 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -21,7 +21,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.53
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -83,7 +83,7 @@ Patch23: httpd-2.4.53-export.patch
 Patch24: httpd-2.4.43-corelimit.patch
 Patch25: httpd-2.4.43-selinux.patch
 Patch26: httpd-2.4.43-gettid.patch
-Patch27: httpd-2.4.43-icons.patch
+Patch27: httpd-2.4.53-icons.patch
 Patch30: httpd-2.4.43-cachehardmax.patch
 Patch34: httpd-2.4.43-socket-activation.patch
 Patch38: httpd-2.4.43-sslciphdefault.patch
@@ -834,6 +834,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Apr 21 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-5
+- don't use bomb.gif icon for all files/dirs ending with core
+
 * Wed Apr 20 2022 Joe Orton <jorton@redhat.com> - 2.4.53-4
 - switch to PCRE2 for new releases
 

From 0a3bbfb33ab78b0980b94f7b5fdf7714a0be0283 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 22 Apr 2022 13:19:04 +0200
Subject: [PATCH 273/359] Add forgoten patch related to autoindex

---
 httpd-2.4.53-icons.patch | 50 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 httpd-2.4.53-icons.patch

diff --git a/httpd-2.4.53-icons.patch b/httpd-2.4.53-icons.patch
new file mode 100644
index 0000000..cd125b3
--- /dev/null
+++ b/httpd-2.4.53-icons.patch
@@ -0,0 +1,50 @@
+diff --git a/docs/conf/extra/httpd-autoindex.conf.in b/docs/conf/extra/httpd-autoindex.conf.in
+index 51b02ed..93a2b87 100644
+--- a/docs/conf/extra/httpd-autoindex.conf.in
++++ b/docs/conf/extra/httpd-autoindex.conf.in
+@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable VersionSort
+ Alias /icons/ "@exp_iconsdir@/"
+ 
+ <Directory "@exp_iconsdir@">
+-    Options Indexes MultiViews
++    Options Indexes MultiViews FollowSymlinks
+     AllowOverride None
+     Require all granted
+ </Directory>
+@@ -37,6 +37,7 @@ AddIconByType (TXT,/icons/text.gif) text/*
+ AddIconByType (IMG,/icons/image2.gif) image/*
+ AddIconByType (SND,/icons/sound2.gif) audio/*
+ AddIconByType (VID,/icons/movie.gif) video/*
++AddIconByType /icons/bomb.gif application/x-coredump
+ 
+ AddIcon /icons/binary.gif .bin .exe
+ AddIcon /icons/binhex.gif .hqx
+@@ -53,7 +54,6 @@ AddIcon /icons/dvi.gif .dvi
+ AddIcon /icons/uuencoded.gif .uu
+ AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
+ AddIcon /icons/tex.gif .tex
+-AddIcon /icons/bomb.gif core
+ 
+ AddIcon /icons/back.gif ..
+ AddIcon /icons/hand.right.gif README
+diff --git a/docs/conf/magic b/docs/conf/magic
+index bc891d9..6402b59 100644
+--- a/docs/conf/magic
++++ b/docs/conf/magic
+@@ -383,3 +383,16 @@
+ 4   string      moov        video/quicktime
+ 4   string      mdat        video/quicktime
+ 
++AddIconByType /icons/bomb.gif application/x-coredump
++
++#------------------------------------------------------------------------------
++# application/x-coredump for LE/BE ELF
++#
++0       string          \177ELF
++>5      byte            1
++>16     leshort         4               application/x-coredump
++
++0       string          \177ELF
++>5      byte            2
++>16     beshort         4               application/x-coredump
++

From 95aba987928cc886fb5acad00694c32da878174c Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 13 May 2022 15:52:12 +0100
Subject: [PATCH 274/359] use %set_build_flags macro (closes #20)

---
 httpd.spec | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 804746d..4a997dd 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -327,8 +327,7 @@ autoheader && autoconf || exit 1
 %{__perl} -pi -e "s:\@exp_installbuilddir\@:%{_libdir}/httpd/build:g" \
         support/apxs.in
 
-export CFLAGS=$RPM_OPT_FLAGS
-export LDFLAGS="-Wl,-z,relro,-z,now"
+%set_build_flags
 
 # Hard-code path to links to avoid unnecessary builddep
 export LYNX_PATH=/usr/bin/links
@@ -834,6 +833,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri May 13 2022 Joe Orton <jorton@redhat.com> - 2.4.53-5
+- use %%set_build_flags macro
+
 * Thu Apr 21 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-5
 - don't use bomb.gif icon for all files/dirs ending with core
 

From d72d3ea9004ce84445c702b0f416abf530a6efd5 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 13 May 2022 15:55:18 +0100
Subject: [PATCH 275/359] fix NVR.

---
 httpd.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 4a997dd..9ae15fc 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -21,7 +21,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.53
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -833,7 +833,7 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Fri May 13 2022 Joe Orton <jorton@redhat.com> - 2.4.53-5
+* Fri May 13 2022 Joe Orton <jorton@redhat.com> - 2.4.53-6
 - use %%set_build_flags macro
 
 * Thu Apr 21 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-5

From c2f1d6bf301e548fb3fe066802a7b45f4b59a1a8 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 16 May 2022 08:27:06 +0100
Subject: [PATCH 276/359] disable package notes

---
 httpd.spec | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 9ae15fc..2f6caaf 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -18,10 +18,13 @@
 %bcond_without pcre
 %endif
 
+# Similar issue to https://bugzilla.redhat.com/show_bug.cgi?id=2043092
+%undefine _package_note_flags
+
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.53
-Release: 6%{?dist}
+Release: 7%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -833,6 +836,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon May 16 2022 Joe Orton <jorton@redhat.com> - 2.4.53-7
+- disable package notes
+
 * Fri May 13 2022 Joe Orton <jorton@redhat.com> - 2.4.53-6
 - use %%set_build_flags macro
 

From 589318da661951c3153a52c0294a66724ebadf75 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 10 Jun 2022 00:05:19 +0200
Subject: [PATCH 277/359] new version 2.4.54

---
 .gitignore                                           |  1 +
 ....4.43-selinux.patch => httpd-2.4.54-selinux.patch | 12 ++++++------
 httpd.spec                                           |  9 ++++++---
 sources                                              |  4 ++--
 4 files changed, 15 insertions(+), 11 deletions(-)
 rename httpd-2.4.43-selinux.patch => httpd-2.4.54-selinux.patch (85%)

diff --git a/.gitignore b/.gitignore
index 64b8899..aa90701 100644
--- a/.gitignore
+++ b/.gitignore
@@ -44,3 +44,4 @@ x86_64
 /httpd-2.4.51.tar.bz2.asc
 /httpd-2.4.52.tar.bz2.asc
 /httpd-2.4.53.tar.bz2.asc
+/httpd-2.4.54.tar.bz2.asc
diff --git a/httpd-2.4.43-selinux.patch b/httpd-2.4.54-selinux.patch
similarity index 85%
rename from httpd-2.4.43-selinux.patch
rename to httpd-2.4.54-selinux.patch
index 3c3176f..3868b3b 100644
--- a/httpd-2.4.43-selinux.patch
+++ b/httpd-2.4.54-selinux.patch
@@ -1,8 +1,8 @@
 diff --git a/configure.in b/configure.in
-index c8f9aa2..cb43246 100644
+index 74015ca..8c0ee10 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -484,6 +484,11 @@ getloadavg
+@@ -508,6 +508,11 @@ getloadavg
  dnl confirm that a void pointer is large enough to store a long integer
  APACHE_CHECK_VOID_PTR_LEN
  
@@ -15,10 +15,10 @@ index c8f9aa2..cb43246 100644
  [AC_TRY_RUN(#define _GNU_SOURCE
  #include <unistd.h>
 diff --git a/server/core.c b/server/core.c
-index dc0f17a..7ed9527 100644
+index a6fa2fb..cf4cba4 100644
 --- a/server/core.c
 +++ b/server/core.c
-@@ -59,6 +59,10 @@
+@@ -65,6 +65,10 @@
  #include <unistd.h>
  #endif
  
@@ -28,8 +28,8 @@ index dc0f17a..7ed9527 100644
 +
  /* LimitRequestBody handling */
  #define AP_LIMIT_REQ_BODY_UNSET         ((apr_off_t) -1)
- #define AP_DEFAULT_LIMIT_REQ_BODY       ((apr_off_t) 0)
-@@ -5015,6 +5019,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte
+ #define AP_DEFAULT_LIMIT_REQ_BODY       ((apr_off_t) 1<<30) /* 1GB */
+@@ -5150,6 +5154,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte
      }
  #endif
  
diff --git a/httpd.spec b/httpd.spec
index 2f6caaf..80492b2 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -23,8 +23,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.53
-Release: 7%{?dist}
+Version: 2.4.54
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -84,7 +84,7 @@ Patch21: httpd-2.4.48-r1842929+.patch
 Patch22: httpd-2.4.43-mod_systemd.patch
 Patch23: httpd-2.4.53-export.patch
 Patch24: httpd-2.4.43-corelimit.patch
-Patch25: httpd-2.4.43-selinux.patch
+Patch25: httpd-2.4.54-selinux.patch
 Patch26: httpd-2.4.43-gettid.patch
 Patch27: httpd-2.4.53-icons.patch
 Patch30: httpd-2.4.43-cachehardmax.patch
@@ -836,6 +836,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jun 09 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-1
+- new version 2.4.54
+
 * Mon May 16 2022 Joe Orton <jorton@redhat.com> - 2.4.53-7
 - disable package notes
 
diff --git a/sources b/sources
index 36266ed..93b0ebf 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.53.tar.bz2) = 07ef59594251a30a864cc9cc9a58ab788c2d006cef85b728f29533243927c63cb063e0867f2a306f37324c3adb9cf7dcb2402f3516b05c2c6f32469d475dd756
-SHA512 (httpd-2.4.53.tar.bz2.asc) = 553df571cf8edda9146c2aaadce7e5a204f9aa8bd05b165dd81e2339db830c06bdb2b546321d3ab1dcc3133a7d37bbbeb31944b725d8a5fc6b6dc389a5c25686
+SHA512 (httpd-2.4.54.tar.bz2) = 228493b2ff32c4142c6e484d304f2ea12e467498605fe12adce2b61388d8efe7b2e96ae2fd0abd1dc88a5f12d625e007d8da0ae5628cff2a5272806754f41e18
+SHA512 (httpd-2.4.54.tar.bz2.asc) = 90a582b10bbcd054f62b6961194f7d97b1f0f56286cfd89e0a5c36248808365b4defade068340a1e9deeaee09dcd3e88810bee8951f9840fe666dab8861b757b
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192

From eeff44363350896ad4bfa111a0c097665dfa6af9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Thu, 16 Jun 2022 18:11:29 +0200
Subject: [PATCH 278/359] Fix bug in patched magic file for core files
 recognition

---
 httpd-2.4.53-icons.patch => httpd-2.4.54-icons.patch | 5 ++---
 httpd.spec                                           | 6 +++---
 2 files changed, 5 insertions(+), 6 deletions(-)
 rename httpd-2.4.53-icons.patch => httpd-2.4.54-icons.patch (93%)

diff --git a/httpd-2.4.53-icons.patch b/httpd-2.4.54-icons.patch
similarity index 93%
rename from httpd-2.4.53-icons.patch
rename to httpd-2.4.54-icons.patch
index cd125b3..efc0c4d 100644
--- a/httpd-2.4.53-icons.patch
+++ b/httpd-2.4.54-icons.patch
@@ -28,14 +28,13 @@ index 51b02ed..93a2b87 100644
  AddIcon /icons/back.gif ..
  AddIcon /icons/hand.right.gif README
 diff --git a/docs/conf/magic b/docs/conf/magic
-index bc891d9..6402b59 100644
+index bc891d9..9a41b44 100644
 --- a/docs/conf/magic
 +++ b/docs/conf/magic
-@@ -383,3 +383,16 @@
+@@ -383,3 +383,15 @@
  4   string      moov        video/quicktime
  4   string      mdat        video/quicktime
  
-+AddIconByType /icons/bomb.gif application/x-coredump
 +
 +#------------------------------------------------------------------------------
 +# application/x-coredump for LE/BE ELF
diff --git a/httpd.spec b/httpd.spec
index 80492b2..1c6b205 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.54
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -86,7 +86,7 @@ Patch23: httpd-2.4.53-export.patch
 Patch24: httpd-2.4.43-corelimit.patch
 Patch25: httpd-2.4.54-selinux.patch
 Patch26: httpd-2.4.43-gettid.patch
-Patch27: httpd-2.4.53-icons.patch
+Patch27: httpd-2.4.54-icons.patch
 Patch30: httpd-2.4.43-cachehardmax.patch
 Patch34: httpd-2.4.43-socket-activation.patch
 Patch38: httpd-2.4.43-sslciphdefault.patch
@@ -836,7 +836,7 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Thu Jun 09 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-1
+* Thu Jun 09 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-2
 - new version 2.4.54
 
 * Mon May 16 2022 Joe Orton <jorton@redhat.com> - 2.4.53-7

From e4ec9394be6afb68e49645cbd187fbd23667ba4d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 17 Jun 2022 11:39:49 +0100
Subject: [PATCH 279/359] update PCRE config selection Although PCRE 2 was only
 supposed to be used for Fedora > 36 it has always been configured for Fedora
 36 as well due to autoconf weirdness.

---
 httpd.spec | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 1c6b205..2038893 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -10,7 +10,7 @@
 %global mpm prefork
 %endif
 
-%if 0%{?fedora} > 36 || 0%{?rhel} > 9
+%if 0%{?fedora} > 35 || 0%{?rhel} > 9
 %bcond_without pcre2
 %bcond_with pcre
 %else
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.54
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -362,10 +362,10 @@ export LYNX_PATH=/usr/bin/links
         --with-brotli \
         --enable-pie \
 %if %{with pcre2}
-        --with-pcre2 \
+        --with-pcre2=%{_bindir}/pcre2-config \
 %endif
 %if %{with pcre}
-        --with-pcre \
+        --with-pcre=%{_bindir}/pcre-config \
 %endif
         --enable-mods-shared=all \
         --enable-ssl --with-ssl --disable-distcache \
@@ -836,6 +836,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jun 17 2022 Joe Orton <jorton@redhat.com> - 2.4.54-3
+- update PCRE config selection
+
 * Thu Jun 09 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-2
 - new version 2.4.54
 

From bdfad1ea95e7f8710aeb124f918c68e9efb9f1b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Mon, 27 Jun 2022 11:21:54 +0200
Subject: [PATCH 280/359] fix downgrade/upgrade issues

mod_ssl and other modules should depend only on httpd-core package
---
 httpd.spec | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 2038893..1533131 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.54
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -140,6 +140,7 @@ Requires: httpd-tools = %{version}-%{release}
 Requires: httpd-filesystem = %{version}-%{release}
 Requires(pre): httpd-filesystem
 Conflicts: apr < 1.5.0-1
+Conflicts: httpd < 2.4.53-2
 Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2
 
 %description core
@@ -148,7 +149,7 @@ The httpd-core package contains essential httpd binaries.
 %package devel
 Summary: Development interfaces for the Apache HTTP Server
 Requires: apr-devel, apr-util-devel, pkgconfig, libtool
-Requires: httpd = %{version}-%{release}
+Requires: httpd-core = %{version}-%{release}
 
 %description devel
 The httpd-devel package contains the APXS binary and other files
@@ -161,7 +162,7 @@ to install this package.
 
 %package manual
 Summary: Documentation for the Apache HTTP Server
-Requires: httpd = %{version}-%{release}
+Requires: httpd-core = 0:%{version}-%{release}
 BuildArch: noarch
 
 %description manual
@@ -191,7 +192,7 @@ Summary: SSL/TLS module for the Apache HTTP Server
 Epoch: 1
 BuildRequires: openssl-devel
 Requires(pre): httpd-filesystem
-Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 Requires: sscg >= 2.2.0, /usr/bin/hostname
 # Require an OpenSSL which supports PROFILE=SYSTEM
 Conflicts: openssl-libs < 1:1.0.1h-4
@@ -205,7 +206,7 @@ Security (TLS) protocols.
 
 %package -n mod_proxy_html
 Summary: HTML and XML content filters for the Apache HTTP Server
-Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 BuildRequires: libxml2-devel
 BuildRequires: make
 Epoch: 1
@@ -217,7 +218,7 @@ transform and modify HTML and XML content.
 
 %package -n mod_ldap
 Summary: LDAP authentication modules for the Apache HTTP Server
-Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 Requires: apr-util-ldap
 
 %description -n mod_ldap
@@ -226,7 +227,7 @@ authentication to the Apache HTTP Server.
 
 %package -n mod_session
 Summary: Session interface for the Apache HTTP Server
-Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 
 %description -n mod_session
 The mod_session module and associated backends provide an abstract
@@ -234,7 +235,7 @@ interface for storing and accessing per-user session data.
 
 %package -n mod_lua
 Summary: Lua scripting support for the Apache HTTP Server
-Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 
 %description -n mod_lua
 The mod_lua module allows the server to be extended with scripts
@@ -836,6 +837,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jun 24 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-4
+- fix downgrade/upgrade issues
+- mod_ssl and other modules should depend only on httpd-core package
+
 * Fri Jun 17 2022 Joe Orton <jorton@redhat.com> - 2.4.54-3
 - update PCRE config selection
 

From b4890cc0cc98a70762d115b1f7a580808cbb9c7b Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 21 Jul 2022 13:48:08 +0000
Subject: [PATCH 281/359] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 1533131..ba6a0c5 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.54
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -837,6 +837,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.54-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
 * Fri Jun 24 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-4
 - fix downgrade/upgrade issues
 - mod_ssl and other modules should depend only on httpd-core package

From 54cb3fa126b5f8f8dbff7297c840646b19ec0567 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Tue, 18 Oct 2022 02:37:04 +0200
Subject: [PATCH 282/359] Provide a sysusers.d file to get user() and group()
 provides (#2134430)

---
 httpd.spec     | 23 +++++++++++++----------
 httpd.sysusers |  2 ++
 2 files changed, 15 insertions(+), 10 deletions(-)
 create mode 100644 httpd.sysusers

diff --git a/httpd.spec b/httpd.spec
index ba6a0c5..3ab8372 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.54
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -73,6 +73,7 @@ Source45: config.layout
 Source46: apachectl.sh
 Source47: apachectl.xml
 Source48: apache-poweredby.png
+Source49: httpd.sysusers
 
 # build/scripts patches
 Patch2: httpd-2.4.43-apxs.patch
@@ -111,6 +112,7 @@ BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto
 BuildRequires: perl-interpreter, perl-generators, systemd-devel
 BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0
+BuildRequires: systemd-rpm-macros
 %if %{with pcre2}
 BuildRequires: pcre2-devel
 %endif
@@ -122,9 +124,7 @@ Requires: system-logos(httpd-logo-ng)
 Provides: webserver
 Requires: httpd-core = 0:%{version}-%{release}
 Recommends: mod_http2, mod_lua
-Requires(preun): systemd-units
-Requires(postun): systemd-units
-Requires(post): systemd-units
+%{?systemd_requires}
 
 %description
 The Apache HTTP Server is a powerful, efficient, and extensible
@@ -173,7 +173,7 @@ also be found at https://httpd.apache.org/docs/2.4/.
 %package filesystem
 Summary: The basic directory layout for the Apache HTTP Server
 BuildArch: noarch
-Requires(pre): /usr/sbin/useradd
+%{?sysusers_requires_compat}
 
 %description filesystem
 The httpd-filesystem package contains the basic directory layout
@@ -602,6 +602,9 @@ touch -r $RPM_BUILD_ROOT%{_bindir}/apxs \
       $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs
 chmod 755 $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs
 
+# Fix content dir in sysusers file and install it
+install -p -D -m 0644 %{SOURCE49} %{buildroot}%{_sysusersdir}/httpd.conf
+
 # Remove unpackaged files
 rm -vf \
       $RPM_BUILD_ROOT%{_libdir}/*.exp \
@@ -617,11 +620,7 @@ rm -vf \
 rm -rf $RPM_BUILD_ROOT/etc/httpd/conf/{original,extra}
 
 %pre filesystem
-getent group apache >/dev/null || groupadd -g 48 -r apache
-getent passwd apache >/dev/null || \
-  useradd -r -u 48 -g apache -s /sbin/nologin \
-    -d %{contentdir} -c "Apache" apache
-exit 0
+%sysusers_create_compat %{SOURCE49}
 
 %post
 %systemd_post httpd.service htcacheclean.service httpd.socket
@@ -785,6 +784,7 @@ exit $rv
 %dir %{contentdir}/icons
 %attr(755,root,root) %dir %{_unitdir}/httpd.service.d
 %attr(755,root,root) %dir %{_unitdir}/httpd.socket.d
+%{_sysusersdir}/httpd.conf
 
 %files tools
 %{_bindir}/*
@@ -837,6 +837,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Oct 13 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-6
+- Provide a sysusers.d file to get user() and group() provides (#2134430)
+
 * Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.54-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
 
diff --git a/httpd.sysusers b/httpd.sysusers
new file mode 100644
index 0000000..26fe0e4
--- /dev/null
+++ b/httpd.sysusers
@@ -0,0 +1,2 @@
+g apache 48
+u apache 48 "Apache" /usr/share/httpd /sbin/nologin

From 654ce8a373d1970c517a37c92c537ff7f86d2f39 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 30 Nov 2022 14:25:15 +0100
Subject: [PATCH 283/359] reduce AH03408 level to INFO in proxy_util.c

---
 httpd-2.4.54-proxy-util-loglevel.patch | 13 +++++++++++++
 httpd.spec                             |  7 ++++++-
 2 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.54-proxy-util-loglevel.patch

diff --git a/httpd-2.4.54-proxy-util-loglevel.patch b/httpd-2.4.54-proxy-util-loglevel.patch
new file mode 100644
index 0000000..e4db49e
--- /dev/null
+++ b/httpd-2.4.54-proxy-util-loglevel.patch
@@ -0,0 +1,13 @@
+diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
+index e488aa6..8267f1b 100644
+--- a/modules/proxy/proxy_util.c
++++ b/modules/proxy/proxy_util.c
+@@ -3121,7 +3121,7 @@ PROXY_DECLARE(apr_status_t) ap_proxy_check_connection(const char *scheme,
+                          "%s: backend socket is disconnected.", scheme);
+         }
+         else {
+-            ap_log_error(APLOG_MARK, APLOG_WARNING, 0, server, APLOGNO(03408)
++            ap_log_error(APLOG_MARK, APLOG_INFO, 0, server, APLOGNO(03408)
+                          "%s: reusable backend connection is not empty: "
+                          "forcibly closed", scheme);
+         }
diff --git a/httpd.spec b/httpd.spec
index 3ab8372..de6cd05 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.54
-Release: 6%{?dist}
+Release: 7%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -104,6 +104,7 @@ Patch60: httpd-2.4.43-enable-sslv3.patch
 Patch61: httpd-2.4.48-r1878890.patch
 Patch63: httpd-2.4.46-htcacheclean-dont-break.patch
 Patch65: httpd-2.4.51-r1894152.patch
+Patch66: httpd-2.4.54-proxy-util-loglevel.patch
 
 # Security fixes
 
@@ -270,6 +271,7 @@ written in the Lua programming language.
 %patch61 -p1 -b .r1878890
 %patch63 -p1 -b .htcacheclean-dont-break
 %patch65 -p1 -b .r1894152
+%patch66 -p1 -b .proxyutil-loglevel
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -837,6 +839,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Nov 30 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-7
+- reduce AH03408 level to INFO in proxy_util.c
+
 * Thu Oct 13 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-6
 - Provide a sysusers.d file to get user() and group() provides (#2134430)
 

From b0e7cd798ea4f3e364b1f2c4cbe768298705dc4d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 19 Dec 2022 14:49:23 +0000
Subject: [PATCH 284/359] define _httpd_statedir macro

---
 httpd.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index de6cd05..c2c75ee 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.54
-Release: 7%{?dist}
+Release: 8%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -488,6 +488,7 @@ cat > $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d/macros.httpd <<EOF
 %%_httpd_contentdir %{contentdir}
 %%_httpd_moddir %%{_libdir}/httpd/modules
 %%_httpd_requires Requires: httpd-mmn = %%{_httpd_mmn}
+%%_httpd_statedir %%{_localstatedir}/lib/httpd
 EOF
 
 # Handle contentdir
@@ -839,6 +840,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Dec 19 2022 Joe Orton <jorton@redhat.com> - 2.4.54-8
+- define _httpd_statedir macro
+
 * Wed Nov 30 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-7
 - reduce AH03408 level to INFO in proxy_util.c
 

From 8c54e332bbb7b718fffccdd9340bca2ae5ec9b3a Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 17 Jun 2022 12:21:04 +0100
Subject: [PATCH 285/359] - move SELinux context logging to mod_systemd from
 httpd binary

---
 ...-gettid.patch => httpd-2.4.54-gettid.patch | 18 ++--
 httpd-2.4.54-selinux.patch                    | 97 ++++++++++---------
 httpd.spec                                    | 18 +++-
 3 files changed, 71 insertions(+), 62 deletions(-)
 rename httpd-2.4.43-gettid.patch => httpd-2.4.54-gettid.patch (90%)

diff --git a/httpd-2.4.43-gettid.patch b/httpd-2.4.54-gettid.patch
similarity index 90%
rename from httpd-2.4.43-gettid.patch
rename to httpd-2.4.54-gettid.patch
index f80b3a7..dfc447b 100644
--- a/httpd-2.4.43-gettid.patch
+++ b/httpd-2.4.54-gettid.patch
@@ -14,9 +14,9 @@ Subject: [PATCH] Check and use gettid() directly with glibc 2.30+.
 
 diff --git a/configure.in b/configure.in
 index 423d58d4b9a..60cbf7b7f81 100644
---- httpd-2.4.43/configure.in.gettid
-+++ httpd-2.4.43/configure.in
-@@ -478,7 +500,8 @@
+--- httpd-2.4.54/configure.in.gettid
++++ httpd-2.4.54/configure.in
+@@ -502,22 +502,26 @@
  timegm \
  getpgid \
  fopen64 \
@@ -26,9 +26,7 @@ index 423d58d4b9a..60cbf7b7f81 100644
  )
  
  dnl confirm that a void pointer is large enough to store a long integer
-@@ -489,16 +512,19 @@
-    APR_ADDTO(HTTPD_LIBS, [-lselinux])
- ])
+ APACHE_CHECK_VOID_PTR_LEN
  
 -AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
 +if test $ac_cv_func_gettid = no; then
@@ -50,8 +48,8 @@ index 423d58d4b9a..60cbf7b7f81 100644
  fi
  
  dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs
---- httpd-2.4.43/server/log.c.gettid
-+++ httpd-2.4.43/server/log.c
+--- httpd-2.4.54/server/log.c.gettid
++++ httpd-2.4.54/server/log.c
 @@ -55,7 +55,7 @@
  #include "ap_mpm.h"
  #include "ap_listen.h"
@@ -61,7 +59,7 @@ index 423d58d4b9a..60cbf7b7f81 100644
  #include <sys/syscall.h>
  #include <sys/types.h>
  #endif
-@@ -625,14 +625,18 @@
+@@ -627,14 +627,18 @@
  #if APR_HAS_THREADS
      int result;
  #endif
@@ -82,7 +80,7 @@ index 423d58d4b9a..60cbf7b7f81 100644
  #if APR_HAS_THREADS
      if (ap_mpm_query(AP_MPMQ_IS_THREADED, &result) == APR_SUCCESS
          && result != AP_MPMQ_NOT_SUPPORTED)
-@@ -966,7 +970,7 @@
+@@ -968,7 +972,7 @@
  #if APR_HAS_THREADS
          field_start = len;
          len += cpystrn(buf + len, ":tid ", buflen - len);
diff --git a/httpd-2.4.54-selinux.patch b/httpd-2.4.54-selinux.patch
index 3868b3b..4d66bd8 100644
--- a/httpd-2.4.54-selinux.patch
+++ b/httpd-2.4.54-selinux.patch
@@ -1,24 +1,22 @@
 diff --git a/configure.in b/configure.in
 index 74015ca..8c0ee10 100644
---- a/configure.in
-+++ b/configure.in
-@@ -508,6 +508,11 @@ getloadavg
- dnl confirm that a void pointer is large enough to store a long integer
- APACHE_CHECK_VOID_PTR_LEN
- 
-+AC_CHECK_LIB(selinux, is_selinux_enabled, [
-+   AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported])
-+   APR_ADDTO(HTTPD_LIBS, [-lselinux])
-+])
-+
- AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
- [AC_TRY_RUN(#define _GNU_SOURCE
- #include <unistd.h>
-diff --git a/server/core.c b/server/core.c
-index a6fa2fb..cf4cba4 100644
---- a/server/core.c
-+++ b/server/core.c
-@@ -65,6 +65,10 @@
+--- httpd-2.4.54/modules/arch/unix/config5.m4.selinux
++++ httpd-2.4.54/modules/arch/unix/config5.m4
+@@ -23,6 +23,11 @@
+     AC_MSG_WARN([Your system does not support systemd.])
+     enable_systemd="no"
+   else
++    AC_CHECK_LIB(selinux, is_selinux_enabled, [
++      AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported])
++      APR_ADDTO(MOD_SYSTEMD_LDADD, [-lselinux])
++    ])
++  
+     APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS])
+   fi
+ ])
+--- httpd-2.4.54/modules/arch/unix/mod_systemd.c.selinux
++++ httpd-2.4.54/modules/arch/unix/mod_systemd.c
+@@ -35,6 +35,10 @@
  #include <unistd.h>
  #endif
  
@@ -26,35 +24,38 @@ index a6fa2fb..cf4cba4 100644
 +#include <selinux/selinux.h>
 +#endif
 +
- /* LimitRequestBody handling */
- #define AP_LIMIT_REQ_BODY_UNSET         ((apr_off_t) -1)
- #define AP_DEFAULT_LIMIT_REQ_BODY       ((apr_off_t) 1<<30) /* 1GB */
-@@ -5150,6 +5154,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte
-     }
- #endif
+ APR_DECLARE_OPTIONAL_FN(int,
+                         ap_find_systemd_socket, (process_rec *, apr_port_t));
  
-+#ifdef HAVE_SELINUX
-+    {
-+        static int already_warned = 0;
-+        int is_enabled = is_selinux_enabled() > 0;
-+        
-+        if (is_enabled && !already_warned) {
-+            security_context_t con;
-+            
-+            if (getcon(&con) == 0) {
-+                
-+                ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
-+                             "SELinux policy enabled; "
-+                             "httpd running as context %s", con);
-+                
-+                already_warned = 1;
-+                
-+                freecon(con);
-+            }
-+        }
-+    }
-+#endif
-+
-     return OK;
+@@ -70,6 +74,20 @@
+     return apr_psprintf(p, "%s port %u", addr, sa->port);
  }
  
++#ifdef HAVE_SELINUX
++static void log_selinux_context(void)
++{
++    char *con;
++
++    if (is_selinux_enabled() && getcon(&con) == 0) {
++        ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
++                     "SELinux policy enabled; "
++                     "httpd running as context %s", con);
++        freecon(con);
++    }
++}
++#endif
++
+ /* Report the service is ready in post_config, which could be during
+  * startup or after a reload.  The server could still hit a fatal
+  * startup error after this point during ap_run_mpm(), so this is
+@@ -87,6 +105,10 @@
+     if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
+         return OK;
+ 
++#ifdef HAVE_SELINUX
++    log_selinux_context();
++#endif
++    
+     for (lr = ap_listeners; lr; lr = lr->next) {
+         char *s = dump_listener(lr, ptemp);
+ 
diff --git a/httpd.spec b/httpd.spec
index c2c75ee..6908087 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.54
-Release: 8%{?dist}
+Release: 9%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -86,7 +86,7 @@ Patch22: httpd-2.4.43-mod_systemd.patch
 Patch23: httpd-2.4.53-export.patch
 Patch24: httpd-2.4.43-corelimit.patch
 Patch25: httpd-2.4.54-selinux.patch
-Patch26: httpd-2.4.43-gettid.patch
+Patch26: httpd-2.4.54-gettid.patch
 Patch27: httpd-2.4.54-icons.patch
 Patch30: httpd-2.4.43-cachehardmax.patch
 Patch34: httpd-2.4.43-socket-activation.patch
@@ -150,7 +150,7 @@ The httpd-core package contains essential httpd binaries.
 %package devel
 Summary: Development interfaces for the Apache HTTP Server
 Requires: apr-devel, apr-util-devel, pkgconfig, libtool
-Requires: httpd-core = %{version}-%{release}
+Requires: httpd-core = 0:%{version}-%{release}
 
 %description devel
 The httpd-devel package contains the APXS binary and other files
@@ -254,7 +254,6 @@ written in the Lua programming language.
 %patch22 -p1 -b .mod_systemd
 %patch23 -p1 -b .export
 %patch24 -p1 -b .corelimit
-%patch25 -p1 -b .selinux
 %patch26 -p1 -b .gettid
 %patch27 -p1 -b .icons
 %patch30 -p1 -b .cachehardmax
@@ -266,6 +265,7 @@ written in the Lua programming language.
 %patch42 -p1 -b .r1828172+
 %patch45 -p1 -b .logjournal
 %patch46 -p1 -b .separatesystemd
+%patch25 -p1 -b .selinux
 
 %patch60 -p1 -b .enable-sslv3
 %patch61 -p1 -b .r1878890
@@ -384,6 +384,13 @@ export LYNX_PATH=/usr/bin/links
         --disable-http2 \
         --disable-md \
         $*
+
+if grep -q ac_cv_have_threadsafe_pollset=no config.log; then
+   cat config.log
+   : Failed to find thread-safe APR.
+   exit 1
+fi
+
 %make_build
 
 %install
@@ -840,6 +847,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Dec 19 2022 Joe Orton <jorton@redhat.com> - 2.4.54-9
+- move SELinux context logging to mod_systemd
+
 * Mon Dec 19 2022 Joe Orton <jorton@redhat.com> - 2.4.54-8
 - define _httpd_statedir macro
 

From f5d2d48e1d86aaa0427d1b311d052d59a1c5d258 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 19 Dec 2022 16:46:44 +0000
Subject: [PATCH 286/359] Work around aarch64 build failures.

---
 httpd.spec | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/httpd.spec b/httpd.spec
index 6908087..b990f77 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -338,6 +338,13 @@ autoheader && autoconf || exit 1
 # Hard-code path to links to avoid unnecessary builddep
 export LYNX_PATH=/usr/bin/links
 
+%ifarch aarch64
+# The configure check for epoll_create() is failing. httpd/apr only
+# actually uses epoll_create1() so this test could be smarter. Work
+# around it for now.
+export ac_cv_func_epoll_create=yes
+%endif
+
 # Build the daemon
 ./configure \
         --prefix=%{_sysconfdir}/httpd \

From b568e5c39d5688ba45b3de376c25d56c4c385594 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 20 Dec 2022 09:43:24 +0000
Subject: [PATCH 287/359] htcacheclean.service: add [Install] section,
 PrivateTmp=yes,

  Environment=LANG=C (#2149714)
---
 htcacheclean.service | 5 +++++
 httpd.spec           | 6 +++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/htcacheclean.service b/htcacheclean.service
index d1e9d60..e3eeef9 100644
--- a/htcacheclean.service
+++ b/htcacheclean.service
@@ -7,5 +7,10 @@ Documentation=man:htcacheclean.service(8)
 Type=forking
 User=apache
 PIDFile=/run/httpd/htcacheclean/pid
+Environment=LANG=C
 EnvironmentFile=/etc/sysconfig/htcacheclean
 ExecStart=/usr/sbin/htcacheclean -P /run/httpd/htcacheclean/pid -d $INTERVAL -p $CACHE_ROOT -l $LIMIT $OPTIONS
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
diff --git a/httpd.spec b/httpd.spec
index b990f77..7271d9f 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.54
-Release: 9%{?dist}
+Release: 10%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -854,6 +854,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Dec 20 2022 Joe Orton <jorton@redhat.com> - 2.4.54-10
+- htcacheclean.service: add [Install] section, PrivateTmp=yes,
+  Environment=LANG=C (#2149714)
+
 * Mon Dec 19 2022 Joe Orton <jorton@redhat.com> - 2.4.54-9
 - move SELinux context logging to mod_systemd
 

From 24cb4dd8699242dfdb5c2c11c0be3fbc620800e1 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 19 Jan 2023 12:17:03 +0000
Subject: [PATCH 288/359] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 7271d9f..24b1365 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.54
-Release: 10%{?dist}
+Release: 11%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -854,6 +854,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.54-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
 * Tue Dec 20 2022 Joe Orton <jorton@redhat.com> - 2.4.54-10
 - htcacheclean.service: add [Install] section, PrivateTmp=yes,
   Environment=LANG=C (#2149714)

From a97f2e349c41c1599563dfb88056b807b5627e47 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Tue, 24 Jan 2023 16:50:25 +0100
Subject: [PATCH 289/359] prevent sscg writing /dhparams.pem

---
 httpd-init.service | 1 +
 httpd-ssl-gencerts | 1 +
 httpd.spec         | 7 +++++--
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/httpd-init.service b/httpd-init.service
index 3074778..704c314 100644
--- a/httpd-init.service
+++ b/httpd-init.service
@@ -8,5 +8,6 @@ ConditionPathExists=|!/etc/pki/tls/private/localhost.key
 [Service]
 Type=oneshot
 RemainAfterExit=no
+PrivateTmp=true
 
 ExecStart=/usr/libexec/httpd-ssl-gencerts
diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts
index 350f5b5..5c271f7 100755
--- a/httpd-ssl-gencerts
+++ b/httpd-ssl-gencerts
@@ -33,6 +33,7 @@ sscg -q                                                             \
      --cert-file           /etc/pki/tls/certs/localhost.crt         \
      --cert-key-file       /etc/pki/tls/private/localhost.key       \
      --ca-file             /etc/pki/tls/certs/localhost.crt         \
+     --dhparams-file       /tmp/dhparams.pem                        \
      --lifetime            365                                      \
      --hostname            $FQDN                                    \
      --email               root@$FQDN
diff --git a/httpd.spec b/httpd.spec
index 24b1365..d398834 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.54
-Release: 11%{?dist}
+Release: 12%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -194,7 +194,7 @@ Epoch: 1
 BuildRequires: openssl-devel
 Requires(pre): httpd-filesystem
 Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
-Requires: sscg >= 2.2.0, /usr/bin/hostname
+Requires: sscg >= 3.0.0-7, /usr/bin/hostname
 # Require an OpenSSL which supports PROFILE=SYSTEM
 Conflicts: openssl-libs < 1:1.0.1h-4
 # mod_ssl/mod_nss cannot both be loaded simultaneously
@@ -854,6 +854,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Jan 24 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-12
+- prevent sscg writing /dhparams.pem
+
 * Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.54-11
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 

From a9ebcc1200eda8cb7895d7bde559e5da3645fd2c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Tue, 24 Jan 2023 17:33:11 +0100
Subject: [PATCH 290/359] sscg in Fedora has --dhparams-file option available
 since 3.0.3

---
 httpd.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index d398834..9a9fde7 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -194,7 +194,7 @@ Epoch: 1
 BuildRequires: openssl-devel
 Requires(pre): httpd-filesystem
 Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
-Requires: sscg >= 3.0.0-7, /usr/bin/hostname
+Requires: sscg >= 3.0.3, /usr/bin/hostname
 # Require an OpenSSL which supports PROFILE=SYSTEM
 Conflicts: openssl-libs < 1:1.0.1h-4
 # mod_ssl/mod_nss cannot both be loaded simultaneously

From 85bd0d7cb0ee0834161ffe8b80f11067b099a2d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 25 Jan 2023 16:15:14 +0100
Subject: [PATCH 291/359] new version 2.4.55

---
 .gitignore                             |  1 +
 httpd-2.4.43-r1861269.patch            | 20 --------------------
 httpd-2.4.54-proxy-util-loglevel.patch | 13 -------------
 httpd.spec                             | 11 +++++------
 sources                                |  4 ++--
 5 files changed, 8 insertions(+), 41 deletions(-)
 delete mode 100644 httpd-2.4.43-r1861269.patch
 delete mode 100644 httpd-2.4.54-proxy-util-loglevel.patch

diff --git a/.gitignore b/.gitignore
index aa90701..65a4add 100644
--- a/.gitignore
+++ b/.gitignore
@@ -45,3 +45,4 @@ x86_64
 /httpd-2.4.52.tar.bz2.asc
 /httpd-2.4.53.tar.bz2.asc
 /httpd-2.4.54.tar.bz2.asc
+/httpd-2.4.55.tar.bz2.asc
diff --git a/httpd-2.4.43-r1861269.patch b/httpd-2.4.43-r1861269.patch
deleted file mode 100644
index 9bff242..0000000
--- a/httpd-2.4.43-r1861269.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
-index b53f3f8..979489c 100644
---- a/modules/ssl/ssl_engine_config.c
-+++ b/modules/ssl/ssl_engine_config.c
-@@ -812,8 +812,14 @@ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd,
- static const char *ssl_cmd_check_file(cmd_parms *parms,
-                                       const char **file)
- {
--    const char *filepath = ap_server_root_relative(parms->pool, *file);
-+    const char *filepath;
- 
-+    /* If only dumping the config, don't verify the paths */
-+    if (ap_state_query(AP_SQ_RUN_MODE) == AP_SQ_RM_CONFIG_DUMP) {
-+        return NULL;
-+    }
-+
-+    filepath = ap_server_root_relative(parms->pool, *file);
-     if (!filepath) {
-         return apr_pstrcat(parms->pool, parms->cmd->name,
-                            ": Invalid file path ", *file, NULL);
diff --git a/httpd-2.4.54-proxy-util-loglevel.patch b/httpd-2.4.54-proxy-util-loglevel.patch
deleted file mode 100644
index e4db49e..0000000
--- a/httpd-2.4.54-proxy-util-loglevel.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
-index e488aa6..8267f1b 100644
---- a/modules/proxy/proxy_util.c
-+++ b/modules/proxy/proxy_util.c
-@@ -3121,7 +3121,7 @@ PROXY_DECLARE(apr_status_t) ap_proxy_check_connection(const char *scheme,
-                          "%s: backend socket is disconnected.", scheme);
-         }
-         else {
--            ap_log_error(APLOG_MARK, APLOG_WARNING, 0, server, APLOGNO(03408)
-+            ap_log_error(APLOG_MARK, APLOG_INFO, 0, server, APLOGNO(03408)
-                          "%s: reusable backend connection is not empty: "
-                          "forcibly closed", scheme);
-         }
diff --git a/httpd.spec b/httpd.spec
index 9a9fde7..b1d332c 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -23,8 +23,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.54
-Release: 12%{?dist}
+Version: 2.4.55
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -92,7 +92,6 @@ Patch30: httpd-2.4.43-cachehardmax.patch
 Patch34: httpd-2.4.43-socket-activation.patch
 Patch38: httpd-2.4.43-sslciphdefault.patch
 Patch39: httpd-2.4.43-sslprotdefault.patch
-Patch40: httpd-2.4.43-r1861269.patch
 Patch41: httpd-2.4.43-r1861793+.patch
 Patch42: httpd-2.4.48-r1828172+.patch
 Patch45: httpd-2.4.43-logjournal.patch
@@ -104,7 +103,6 @@ Patch60: httpd-2.4.43-enable-sslv3.patch
 Patch61: httpd-2.4.48-r1878890.patch
 Patch63: httpd-2.4.46-htcacheclean-dont-break.patch
 Patch65: httpd-2.4.51-r1894152.patch
-Patch66: httpd-2.4.54-proxy-util-loglevel.patch
 
 # Security fixes
 
@@ -260,7 +258,6 @@ written in the Lua programming language.
 %patch34 -p1 -b .socketactivation
 %patch38 -p1 -b .sslciphdefault
 %patch39 -p1 -b .sslprotdefault
-%patch40 -p1 -b .r1861269
 %patch41 -p1 -b .r1861793+
 %patch42 -p1 -b .r1828172+
 %patch45 -p1 -b .logjournal
@@ -271,7 +268,6 @@ written in the Lua programming language.
 %patch61 -p1 -b .r1878890
 %patch63 -p1 -b .htcacheclean-dont-break
 %patch65 -p1 -b .r1894152
-%patch66 -p1 -b .proxyutil-loglevel
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -854,6 +850,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Jan 25 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.55-1
+- new version 2.4.55
+
 * Tue Jan 24 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.54-12
 - prevent sscg writing /dhparams.pem
 
diff --git a/sources b/sources
index 93b0ebf..042ceab 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.54.tar.bz2) = 228493b2ff32c4142c6e484d304f2ea12e467498605fe12adce2b61388d8efe7b2e96ae2fd0abd1dc88a5f12d625e007d8da0ae5628cff2a5272806754f41e18
-SHA512 (httpd-2.4.54.tar.bz2.asc) = 90a582b10bbcd054f62b6961194f7d97b1f0f56286cfd89e0a5c36248808365b4defade068340a1e9deeaee09dcd3e88810bee8951f9840fe666dab8861b757b
+SHA512 (httpd-2.4.55.tar.bz2) = 94982f7a1fedac8961fc17b5a22cf763ac28cb27ee6facab2e6a15b249b927773667493fd3f7354fb13fcb34a6f1afc1bdd5cf4b7be030cba1dfb523e40d43fb
+SHA512 (httpd-2.4.55.tar.bz2.asc) = 7e9f946a72a9106325ca1479123e9320e6749ba304d945ce48f4eb816710ad7fe6a2e0a9108c98d36a99eacd70c4984a1b5cb1b7e6690cdff77039c4a2732328
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192

From f03a62dad53d0b50a0818d6da0c289a5617e1e21 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 3 Feb 2023 14:50:41 +0100
Subject: [PATCH 292/359] rebuilt with new apr/apr-util

---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index b1d332c..a2ce930 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.55
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -850,6 +850,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Feb 03 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.55-2
+- rebuilt with new apr/apr-util
+
 * Wed Jan 25 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.55-1
 - new version 2.4.55
 

From 47674d08007e376a740a9e48fdc6c70ec23a7ea3 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 7 Mar 2023 14:20:57 +0000
Subject: [PATCH 293/359] build and load mod_authnz_fcgi

---
 00-base.conf | 1 +
 httpd.spec   | 7 +++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/00-base.conf b/00-base.conf
index d0123d1..bae2bf6 100644
--- a/00-base.conf
+++ b/00-base.conf
@@ -15,6 +15,7 @@ LoadModule authn_dbd_module modules/mod_authn_dbd.so
 LoadModule authn_dbm_module modules/mod_authn_dbm.so
 LoadModule authn_file_module modules/mod_authn_file.so
 LoadModule authn_socache_module modules/mod_authn_socache.so
+LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so
 LoadModule authz_core_module modules/mod_authz_core.so
 LoadModule authz_dbd_module modules/mod_authz_dbd.so
 LoadModule authz_dbm_module modules/mod_authz_dbm.so
diff --git a/httpd.spec b/httpd.spec
index a2ce930..819fe22 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.55
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -379,7 +379,7 @@ export ac_cv_func_epoll_create=yes
         --enable-cache \
         --enable-disk-cache \
         --enable-ldap --enable-authnz-ldap \
-        --enable-cgid --enable-cgi \
+        --enable-cgid --enable-cgi --enable-authnz-fcgi \
         --enable-cgid-fdpassing \
         --enable-authn-anon --enable-authn-alias \
         --enable-systemd \
@@ -850,6 +850,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Mar  7 2023 Joe Orton <jorton@redhat.com> - 2.4.55-3
+- build and load mod_authnz_fcgi
+
 * Fri Feb 03 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.55-2
 - rebuilt with new apr/apr-util
 

From 92c4708891a48466340a415d244738573376d98e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Thu, 9 Mar 2023 13:02:14 +0100
Subject: [PATCH 294/359] new version 2.4.56

---
 .gitignore | 1 +
 httpd.spec | 7 +++++--
 sources    | 4 ++--
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 65a4add..4001074 100644
--- a/.gitignore
+++ b/.gitignore
@@ -46,3 +46,4 @@ x86_64
 /httpd-2.4.53.tar.bz2.asc
 /httpd-2.4.54.tar.bz2.asc
 /httpd-2.4.55.tar.bz2.asc
+/httpd-2.4.56.tar.bz2.asc
diff --git a/httpd.spec b/httpd.spec
index 819fe22..c885e82 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -23,8 +23,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.55
-Release: 3%{?dist}
+Version: 2.4.56
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -850,6 +850,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Mar 09 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.56-1
+- new version 2.4.56
+
 * Tue Mar  7 2023 Joe Orton <jorton@redhat.com> - 2.4.55-3
 - build and load mod_authnz_fcgi
 
diff --git a/sources b/sources
index 042ceab..290079d 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.55.tar.bz2) = 94982f7a1fedac8961fc17b5a22cf763ac28cb27ee6facab2e6a15b249b927773667493fd3f7354fb13fcb34a6f1afc1bdd5cf4b7be030cba1dfb523e40d43fb
-SHA512 (httpd-2.4.55.tar.bz2.asc) = 7e9f946a72a9106325ca1479123e9320e6749ba304d945ce48f4eb816710ad7fe6a2e0a9108c98d36a99eacd70c4984a1b5cb1b7e6690cdff77039c4a2732328
+SHA512 (httpd-2.4.56.tar.bz2) = 5f12cd9878d822384b1bb163fea4d8edee5e7a0dd8b2389264387971268145cccc6a5a27ddf0436c5f1f631acc5fdc4874da2a47911483e421ca40bf783e0e12
+SHA512 (httpd-2.4.56.tar.bz2.asc) = 50f5e1f52e4a9a2f98d6831bc908e74a9d008978572246f668f2a1c6977014f30e77a8197f5db20a3500323f35e3d7d1a38b270cd0b7122aafc58d2df8132d4a
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192

From 4b92db25395917df048cf176d36b9d0e28b625d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Tue, 11 Apr 2023 13:10:55 +0200
Subject: [PATCH 295/359] new version 2.4.57

---
 .gitignore | 1 +
 httpd.spec | 5 ++++-
 sources    | 4 ++--
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 4001074..275485b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -47,3 +47,4 @@ x86_64
 /httpd-2.4.54.tar.bz2.asc
 /httpd-2.4.55.tar.bz2.asc
 /httpd-2.4.56.tar.bz2.asc
+/httpd-2.4.57.tar.bz2.asc
diff --git a/httpd.spec b/httpd.spec
index c885e82..8e8ee8b 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -23,7 +23,7 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.56
+Version: 2.4.57
 Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
@@ -850,6 +850,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Apr 11 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-1
+- new version 2.4.57
+
 * Thu Mar 09 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.56-1
 - new version 2.4.56
 
diff --git a/sources b/sources
index 290079d..ceb40e4 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.56.tar.bz2) = 5f12cd9878d822384b1bb163fea4d8edee5e7a0dd8b2389264387971268145cccc6a5a27ddf0436c5f1f631acc5fdc4874da2a47911483e421ca40bf783e0e12
-SHA512 (httpd-2.4.56.tar.bz2.asc) = 50f5e1f52e4a9a2f98d6831bc908e74a9d008978572246f668f2a1c6977014f30e77a8197f5db20a3500323f35e3d7d1a38b270cd0b7122aafc58d2df8132d4a
+SHA512 (httpd-2.4.57.tar.bz2) = 4d1e0a274ee90bdfb5f38d4a7d73a7367ed1c6388e26280e640014e49abc0df03683705b88dcfe2ec2da313dda4c7b4a3b86daffa1911f58e224eba89d82d155
+SHA512 (httpd-2.4.57.tar.bz2.asc) = 3d40491da7610b91894ea24d011da213c0ba4c04dbf3d5dbefac704ba55d9a56acf375dd61363f50291a748ef5f14e7d2dcba96b15a8ce448267bfeb26bf7ecd
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192

From 8d5ccc86d7ffe25b7942d624dcf79810d59c599d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 25 May 2023 08:39:00 +0100
Subject: [PATCH 296/359] - document that "apachectl -t" is supported
 (#2180884)

---
 apachectl.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apachectl.xml b/apachectl.xml
index 5e40832..34da42c 100644
--- a/apachectl.xml
+++ b/apachectl.xml
@@ -160,7 +160,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>configtest</option></term>
+        <term><option>configtest</option> | <option>-t</option></term>
         <listitem>
           <para>Run a configuration file syntax test. It parses the configuration
           files and either reports <literal>Syntax OK</literal>

From 3dbb71b2491f2f8384f5fdba9b8c74dd4da11a0e Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 23 Jun 2023 09:59:04 +0100
Subject: [PATCH 297/359] also sanitize LDFLAGS/CXXFLAGS in non-vendor
 config_vars.mk

---
 httpd.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 8e8ee8b..06173ae 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.57
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -602,7 +602,7 @@ cp -p $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk \
       $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk
 
 # Sanitize CFLAGS & LIBTOOL in standard config_vars.mk
-sed -e '/^CFLAGS/s,=.*$,= -O2 -g -Wall,' \
+sed -e '/^[A-Z]*FLAGS = /s,-specs[^ ]*,,g' \
     -e '/^LIBTOOL/s,/.*/libtool,%{_bindir}/libtool,' \
     -i $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk
 diff -u $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk \
@@ -850,6 +850,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jun 23 2023 Joe Orton <jorton@redhat.com> - 2.4.57-2
+- also sanitize LDFLAGS/CXXFLAGS in non-vendor config_vars.mk
+
 * Tue Apr 11 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-1
 - new version 2.4.57
 

From fd06e529c2de123a89111dde2b26b713b464f017 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 5 Jul 2023 12:13:09 +0100
Subject: [PATCH 298/359] - package /etc/systemd/httpd/httpd.service.d

---
 httpd.spec | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 06173ae..bb9f422 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -432,8 +432,9 @@ touch -r $RPM_SOURCE_DIR/00-mpm.conf \
 # install systemd override drop directory
 # Web application packages can drop snippets into this location if
 # they need ExecStart[pre|post].
-mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d
-mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d
+mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d \
+      $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d \
+      $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/httpd.service.d
 
 install -m 644 -p $RPM_SOURCE_DIR/10-listen443.conf \
       $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d/10-listen443.conf
@@ -797,6 +798,7 @@ exit $rv
 %dir %{contentdir}/icons
 %attr(755,root,root) %dir %{_unitdir}/httpd.service.d
 %attr(755,root,root) %dir %{_unitdir}/httpd.socket.d
+%attr(755,root,root) %dir %{_sysconfdir}/systemd/system/httpd.service.d
 %{_sysusersdir}/httpd.conf
 
 %files tools
@@ -850,7 +852,8 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Fri Jun 23 2023 Joe Orton <jorton@redhat.com> - 2.4.57-2
+* Wed Jul  5 2023 Joe Orton <jorton@redhat.com> - 2.4.57-2
+- package /etc/systemd/httpd/httpd.service.d
 - also sanitize LDFLAGS/CXXFLAGS in non-vendor config_vars.mk
 
 * Tue Apr 11 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-1

From 625e0ea487b869a57e56e3a9c6e846cc056e079d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 5 Jul 2023 12:23:54 +0100
Subject: [PATCH 299/359] - fix use of %patchN

---
 httpd.spec | 44 ++++++++++++++++++++++----------------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index bb9f422..d0cc281 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -243,31 +243,31 @@ written in the Lua programming language.
 %prep
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q
-%patch2 -p1 -b .apxs
-%patch3 -p1 -b .deplibs
+%patch -P2 -p1 -b .apxs
+%patch -P3 -p1 -b .deplibs
 
-%patch19 -p1 -b .detectsystemd
+%patch -P19 -p1 -b .detectsystemd
 
-%patch21 -p1 -b .r1842929+
-%patch22 -p1 -b .mod_systemd
-%patch23 -p1 -b .export
-%patch24 -p1 -b .corelimit
-%patch26 -p1 -b .gettid
-%patch27 -p1 -b .icons
-%patch30 -p1 -b .cachehardmax
-%patch34 -p1 -b .socketactivation
-%patch38 -p1 -b .sslciphdefault
-%patch39 -p1 -b .sslprotdefault
-%patch41 -p1 -b .r1861793+
-%patch42 -p1 -b .r1828172+
-%patch45 -p1 -b .logjournal
-%patch46 -p1 -b .separatesystemd
-%patch25 -p1 -b .selinux
+%patch -P21 -p1 -b .r1842929+
+%patch -P22 -p1 -b .mod_systemd
+%patch -P23 -p1 -b .export
+%patch -P24 -p1 -b .corelimit
+%patch -P26 -p1 -b .gettid
+%patch -P27 -p1 -b .icons
+%patch -P30 -p1 -b .cachehardmax
+%patch -P34 -p1 -b .socketactivation
+%patch -P38 -p1 -b .sslciphdefault
+%patch -P39 -p1 -b .sslprotdefault
+%patch -P41 -p1 -b .r1861793+
+%patch -P42 -p1 -b .r1828172+
+%patch -P45 -p1 -b .logjournal
+%patch -P46 -p1 -b .separatesystemd
+%patch -P25 -p1 -b .selinux
 
-%patch60 -p1 -b .enable-sslv3
-%patch61 -p1 -b .r1878890
-%patch63 -p1 -b .htcacheclean-dont-break
-%patch65 -p1 -b .r1894152
+%patch -P60 -p1 -b .enable-sslv3
+%patch -P61 -p1 -b .r1878890
+%patch -P63 -p1 -b .htcacheclean-dont-break
+%patch -P65 -p1 -b .r1894152
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h

From e2a22401edb396b1067848a7fc2ecbe7370646fe Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 5 Jul 2023 12:25:22 +0100
Subject: [PATCH 300/359] - fix httpd.service.d creation

---
 httpd.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index d0cc281..69027a9 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -433,8 +433,8 @@ touch -r $RPM_SOURCE_DIR/00-mpm.conf \
 # Web application packages can drop snippets into this location if
 # they need ExecStart[pre|post].
 mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d \
-      $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d \
-      $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/httpd.service.d
+      $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d
+mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/httpd.service.d
 
 install -m 644 -p $RPM_SOURCE_DIR/10-listen443.conf \
       $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d/10-listen443.conf

From e930ce73066ccc729792fecc7e728c731758842b Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 20 Jul 2023 06:29:23 +0000
Subject: [PATCH 301/359] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 69027a9..1048d64 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.57
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -852,6 +852,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.57-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
 * Wed Jul  5 2023 Joe Orton <jorton@redhat.com> - 2.4.57-2
 - package /etc/systemd/httpd/httpd.service.d
 - also sanitize LDFLAGS/CXXFLAGS in non-vendor config_vars.mk

From 454bf03452b41ccec6468e89a976d11d4bd2897f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 6 Oct 2023 15:47:34 +0200
Subject: [PATCH 302/359] SPDX migration

---
 httpd.spec | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 1048d64..7b322c1 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.57
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -105,8 +105,14 @@ Patch63: httpd-2.4.46-htcacheclean-dont-break.patch
 Patch65: httpd-2.4.51-r1894152.patch
 
 # Security fixes
+# Patch200: ...
+
+# Apache-2.0: everything
+# BSD-3-Clause: util_pcre.c, ap_regex.h
+# metamail AND HPND-sell-variant:: server/util_md5.c:
+# Spencer-94: modules/metadata/mod_mime_magic.c
+License: Apache-2.0 AND (BSD-3-Clause AND metamail AND HPND-sell-variant AND Spencer-94)
 
-License: ASL 2.0
 BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto
 BuildRequires: perl-interpreter, perl-generators, systemd-devel
 BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
@@ -852,6 +858,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Oct 06 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-4
+- SPDX migration
+
 * Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.57-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
 

From cdf2aaf5d2118d1c772052db35067ed8a7ab207e Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 18 Oct 2023 09:15:16 +0100
Subject: [PATCH 303/359] Minor wording tweaks.

---
 httpd.service.xml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/httpd.service.xml b/httpd.service.xml
index c6bf865..7dfdb97 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -175,7 +175,7 @@ Wants=network-online.target</programlisting>
       <para>System packages (including the httpd package itself) may
       restart the httpd service automatically after packages are
       upgraded, installed, or removed. This is done using the
-      <command>systemctl try-restart httpd.service</command>, which
+      <command>systemctl try-restart httpd.service</command> command, which
       stops then starts the service if it is running.</para>
 
       <para>To disable automatic restarts, create the file
@@ -183,8 +183,9 @@ Wants=network-online.target</programlisting>
       When <command>httpd</command> interfaces are added in an update,
       it may not be safe to <emphasis>reload</emphasis> a running
       service after upgrading, if updated modules require interfaces
-      only available in the updated httpd.  It is recommended to allow
-      automatic restarts for this reason.</para>
+      only available in the updated <command>httpd</command> binary.
+      It is recommended to allow automatic restarts for this
+      reason.</para>
     </refsect2>
 
     <refsect2>

From c9253b5bbf710374a7cf1e91af75841ffc474d67 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 20 Oct 2023 14:13:15 +0200
Subject: [PATCH 304/359] new version 2.4.58

---
 .gitignore                  |   1 +
 httpd-2.4.48-r1878890.patch | 116 ------------------------------------
 httpd.spec                  |   9 +--
 sources                     |   4 +-
 4 files changed, 8 insertions(+), 122 deletions(-)
 delete mode 100644 httpd-2.4.48-r1878890.patch

diff --git a/.gitignore b/.gitignore
index 275485b..cc7babc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -48,3 +48,4 @@ x86_64
 /httpd-2.4.55.tar.bz2.asc
 /httpd-2.4.56.tar.bz2.asc
 /httpd-2.4.57.tar.bz2.asc
+/httpd-2.4.58.tar.bz2.asc
diff --git a/httpd-2.4.48-r1878890.patch b/httpd-2.4.48-r1878890.patch
deleted file mode 100644
index 7f8ca57..0000000
--- a/httpd-2.4.48-r1878890.patch
+++ /dev/null
@@ -1,116 +0,0 @@
-diff --git a/include/util_ldap.h b/include/util_ldap.h
-index 28e0760..edb8a81 100644
---- a/include/util_ldap.h
-+++ b/include/util_ldap.h
-@@ -32,7 +32,6 @@
- #if APR_MAJOR_VERSION < 2
- /* The LDAP API is currently only present in APR 1.x */
- #include "apr_ldap.h"
--#include "apr_ldap_rebind.h"
- #else
- #define APR_HAS_LDAP 0
- #endif
-diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c
-index 120f268..a5f7995 100644
---- a/modules/ldap/util_ldap.c
-+++ b/modules/ldap/util_ldap.c
-@@ -140,6 +140,38 @@ static int util_ldap_handler(request_rec *r)
-     return OK;
- }
- 
-+/* For OpenLDAP with the 3-arg version of ldap_set_rebind_proc(), use
-+ * a simpler rebind callback than the implementation in APR-util.
-+ * Testing for API version >= 3001 appears safe although OpenLDAP
-+ * 2.1.x (API version = 2004) also has the 3-arg API. */
-+#if APR_HAS_OPENLDAP_LDAPSDK && defined(LDAP_API_VERSION) && LDAP_API_VERSION >= 3001
-+
-+#define uldap_rebind_init(p) APR_SUCCESS /* noop */
-+
-+static int uldap_rebind_proc(LDAP *ld, const char *url, ber_tag_t request,
-+                             ber_int_t msgid, void *params)
-+{
-+    util_ldap_connection_t *ldc = params;
-+
-+    return ldap_bind_s(ld, ldc->binddn, ldc->bindpw, LDAP_AUTH_SIMPLE);
-+}
-+
-+static apr_status_t uldap_rebind_add(util_ldap_connection_t *ldc)
-+{
-+    ldap_set_rebind_proc(ldc->ldap, uldap_rebind_proc, ldc);
-+    return APR_SUCCESS;
-+}
-+
-+#else /* !APR_HAS_OPENLDAP_LDAPSDK */
-+
-+#define USE_APR_LDAP_REBIND
-+#include <apr_ldap_rebind.h>
-+
-+#define uldap_rebind_init(p) apr_ldap_rebind_init(p)
-+#define uldap_rebind_add(ldc) apr_ldap_rebind_add((ldc)->rebind_pool, \
-+                                                  (ldc)->ldap, (ldc)->binddn, \
-+                                                  (ldc)->bindpw)
-+#endif
- 
- 
- /* ------------------------------------------------------------------ */
-@@ -181,6 +213,13 @@ static apr_status_t uldap_connection_unbind(void *param)
-     util_ldap_connection_t *ldc = param;
- 
-     if (ldc) {
-+#ifdef USE_APR_LDAP_REBIND
-+        /* forget the rebind info for this conn */
-+        if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
-+            apr_pool_clear(ldc->rebind_pool);
-+        }
-+#endif
-+
-         if (ldc->ldap) {
-             if (ldc->r) { 
-                 ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, ldc->r, "LDC %pp unbind", ldc); 
-@@ -189,12 +228,6 @@ static apr_status_t uldap_connection_unbind(void *param)
-             ldc->ldap = NULL;
-         }
-         ldc->bound = 0;
--
--        /* forget the rebind info for this conn */
--        if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
--            apr_ldap_rebind_remove(ldc->ldap);
--            apr_pool_clear(ldc->rebind_pool);
--        }
-     }
- 
-     return APR_SUCCESS;
-@@ -330,7 +363,7 @@ static int uldap_connection_init(request_rec *r,
- 
-     if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
-         /* Now that we have an ldap struct, add it to the referral list for rebinds. */
--        rc = apr_ldap_rebind_add(ldc->rebind_pool, ldc->ldap, ldc->binddn, ldc->bindpw);
-+        rc = uldap_rebind_add(ldc);
-         if (rc != APR_SUCCESS) {
-             ap_log_error(APLOG_MARK, APLOG_ERR, rc, r->server, APLOGNO(01277)
-                     "LDAP: Unable to add rebind cross reference entry. Out of memory?");
-@@ -856,6 +889,7 @@ static util_ldap_connection_t *
-         /* whether or not to keep this connection in the pool when it's returned */
-         l->keep = (st->connection_pool_ttl == 0) ? 0 : 1;
- 
-+#ifdef USE_APR_LDAP_REBIND
-         if (l->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
-             if (apr_pool_create(&(l->rebind_pool), l->pool) != APR_SUCCESS) {
-                 ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r, APLOGNO(01286)
-@@ -867,6 +901,7 @@ static util_ldap_connection_t *
-             }
-             apr_pool_tag(l->rebind_pool, "util_ldap_rebind");
-         }
-+#endif
- 
-         if (p) {
-             p->next = l;
-@@ -3054,7 +3089,7 @@ static int util_ldap_post_config(apr_pool_t *p, apr_pool_t *plog,
-     }
- 
-     /* Initialize the rebind callback's cross reference list. */
--    apr_ldap_rebind_init (p);
-+    (void) uldap_rebind_init(p);
- 
- #ifdef AP_LDAP_OPT_DEBUG
-     if (st->debug_level > 0) {
diff --git a/httpd.spec b/httpd.spec
index 7b322c1..4ff2d58 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -23,8 +23,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.57
-Release: 4%{?dist}
+Version: 2.4.58
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -100,7 +100,6 @@ Patch46: httpd-2.4.53-separate-systemd-fns.patch
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
-Patch61: httpd-2.4.48-r1878890.patch
 Patch63: httpd-2.4.46-htcacheclean-dont-break.patch
 Patch65: httpd-2.4.51-r1894152.patch
 
@@ -271,7 +270,6 @@ written in the Lua programming language.
 %patch -P25 -p1 -b .selinux
 
 %patch -P60 -p1 -b .enable-sslv3
-%patch -P61 -p1 -b .r1878890
 %patch -P63 -p1 -b .htcacheclean-dont-break
 %patch -P65 -p1 -b .r1894152
 
@@ -858,6 +856,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Oct 20 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.58-1
+- new version 2.4.58
+
 * Fri Oct 06 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-4
 - SPDX migration
 
diff --git a/sources b/sources
index ceb40e4..8ac3947 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.57.tar.bz2) = 4d1e0a274ee90bdfb5f38d4a7d73a7367ed1c6388e26280e640014e49abc0df03683705b88dcfe2ec2da313dda4c7b4a3b86daffa1911f58e224eba89d82d155
-SHA512 (httpd-2.4.57.tar.bz2.asc) = 3d40491da7610b91894ea24d011da213c0ba4c04dbf3d5dbefac704ba55d9a56acf375dd61363f50291a748ef5f14e7d2dcba96b15a8ce448267bfeb26bf7ecd
+SHA512 (httpd-2.4.58.tar.bz2) = d6e73bf413a507ec16b621ff635e178206207a9e9810ce3944b3dc98d39cde8f225307110167fc9da5822175796c8cb66f98be5b9f0d8b76dcd83a401d39b2c1
+SHA512 (httpd-2.4.58.tar.bz2.asc) = aa021b067fc84ae6a09d5ce321207622c6c08f22632ac7362318ca0505b84357d77d4ebc1f17fa2c3030ed9d9fd177e8fb989932caeef695e76936e010b63aa0
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192

From ac146d28f9397bf803ede12450d2acead287a21d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 2 Nov 2023 14:39:09 +0000
Subject: [PATCH 305/359] add dependency on apr-util-1(dbm) so a DBM provider
 is present

---
 httpd-2.4.58-properr.patch | 30 ++++++++++++++++++++++++++++++
 httpd.spec                 |  8 +++++++-
 2 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.58-properr.patch

diff --git a/httpd-2.4.58-properr.patch b/httpd-2.4.58-properr.patch
new file mode 100644
index 0000000..4071f25
--- /dev/null
+++ b/httpd-2.4.58-properr.patch
@@ -0,0 +1,30 @@
+--- httpd-2.4.58/modules/dav/fs/dbm.c.properr
++++ httpd-2.4.58/modules/dav/fs/dbm.c
+@@ -100,7 +100,7 @@
+     /* There might not be a <db> if we had problems creating it. */
+     if (db == NULL) {
+         errcode = 1;
+-        errstr = "Could not open property database.";
++        errstr = "Could not open database.";
+         if (APR_STATUS_IS_EDSOOPEN(status))
+             ap_log_error(APLOG_MARK, APLOG_CRIT, status, ap_server_conf, APLOGNO(00576)
+             "The DBM driver could not be loaded");
+@@ -147,7 +147,7 @@
+                      "mod_dav_fs: The DBM library '%s' could not be loaded: %s",
+                              err->reason, err->msg);
+         return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status,
+-                "Could not load library for property database.");
++                "Could not load library for DBM database.");
+     }
+     if ((status = apr_dbm_open2(&file, driver, pathname,
+                                ro ? APR_DBM_READONLY : APR_DBM_RWCREATE,
+@@ -162,6 +162,9 @@
+                 != APR_SUCCESS
+         && !ro) {
+         /* ### do something with 'status' */
++        ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, 
++                     "mod_dav_fs: apr_dbm_open() failed for %s (read-%s)",
++                     pathname, ro ? "only" : "write");
+ 
+         /* we can't continue if we couldn't open the file
+            and we need to write */
diff --git a/httpd.spec b/httpd.spec
index 4ff2d58..066d182 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.58
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -142,6 +142,9 @@ Provides: mod_proxy_uwsgi = %{version}-%{release}
 Requires: /etc/mime.types
 Requires: httpd-tools = %{version}-%{release}
 Requires: httpd-filesystem = %{version}-%{release}
+%if 0%{?fedora} > 39 || 0%{?rhel} > 9
+Requires: apr-util-1(dbm)%{_isa}
+%endif
 Requires(pre): httpd-filesystem
 Conflicts: apr < 1.5.0-1
 Conflicts: httpd < 2.4.53-2
@@ -856,6 +859,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Nov  2 2023 Joe Orton <jorton@redhat.com> - 2.4.58-2
+- add dependency on apr-util-1(dbm) so a DBM provider is present
+
 * Fri Oct 20 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.58-1
 - new version 2.4.58
 

From d69c709d67f1668d05fe7466b677ef5923b1c1f2 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 8 Dec 2023 11:09:28 +0000
Subject: [PATCH 306/359] Update pullrev.sh.

---
 pullrev.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pullrev.sh b/pullrev.sh
index 87b7cd7..703d376 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -7,7 +7,7 @@ fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
 #repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.51
+ver=2.4.58
 prefix="httpd-${ver}"
 suffix="${SUFFIX:-r$1${2:++}}"
 fn="${prefix}-${suffix}.patch"
@@ -43,7 +43,7 @@ for r in $*; do
         http*) curl -s "$r" | filterdiff --strip=3 ;;
         *) svn diff -c ${r} ${repo}  ;;
     esac | filterdiff --remove-timestamps --clean \
-                      -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' \
+                      -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' -x 'changes-entries/*' \
                       --addprefix="${prefix}/" > ${this}
     next=`mktemp /tmp/pullrevXXXXXX`
     if ! combinediff -w ${prev} ${this} > ${next}; then
@@ -62,4 +62,4 @@ echo "+ git add ${fn}"
 git add "${fn}"
 echo "+ spec template:"
 echo "PatchN: ${fn}"
-echo "%patchN -p1 -b .${suffix}"
+echo "%patch -PN -p1 -b .${suffix}"

From 5d639c7ccf9c83fe9fdbe28d95ed751f8d332620 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 8 Dec 2023 11:11:45 +0000
Subject: [PATCH 307/359] mod_dav_fs: add DAVLockDBType, use global lock around
 lockdb

---
 httpd-2.4.58-properr.patch   |  30 ---
 httpd-2.4.58-r1912477+.patch | 381 +++++++++++++++++++++++++++++++++++
 httpd.spec                   |   7 +-
 3 files changed, 387 insertions(+), 31 deletions(-)
 delete mode 100644 httpd-2.4.58-properr.patch
 create mode 100644 httpd-2.4.58-r1912477+.patch

diff --git a/httpd-2.4.58-properr.patch b/httpd-2.4.58-properr.patch
deleted file mode 100644
index 4071f25..0000000
--- a/httpd-2.4.58-properr.patch
+++ /dev/null
@@ -1,30 +0,0 @@
---- httpd-2.4.58/modules/dav/fs/dbm.c.properr
-+++ httpd-2.4.58/modules/dav/fs/dbm.c
-@@ -100,7 +100,7 @@
-     /* There might not be a <db> if we had problems creating it. */
-     if (db == NULL) {
-         errcode = 1;
--        errstr = "Could not open property database.";
-+        errstr = "Could not open database.";
-         if (APR_STATUS_IS_EDSOOPEN(status))
-             ap_log_error(APLOG_MARK, APLOG_CRIT, status, ap_server_conf, APLOGNO(00576)
-             "The DBM driver could not be loaded");
-@@ -147,7 +147,7 @@
-                      "mod_dav_fs: The DBM library '%s' could not be loaded: %s",
-                              err->reason, err->msg);
-         return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status,
--                "Could not load library for property database.");
-+                "Could not load library for DBM database.");
-     }
-     if ((status = apr_dbm_open2(&file, driver, pathname,
-                                ro ? APR_DBM_READONLY : APR_DBM_RWCREATE,
-@@ -162,6 +162,9 @@
-                 != APR_SUCCESS
-         && !ro) {
-         /* ### do something with 'status' */
-+        ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, 
-+                     "mod_dav_fs: apr_dbm_open() failed for %s (read-%s)",
-+                     pathname, ro ? "only" : "write");
- 
-         /* we can't continue if we couldn't open the file
-            and we need to write */
diff --git a/httpd-2.4.58-r1912477+.patch b/httpd-2.4.58-r1912477+.patch
new file mode 100644
index 0000000..6458df8
--- /dev/null
+++ b/httpd-2.4.58-r1912477+.patch
@@ -0,0 +1,381 @@
+# ./pullrev.sh 1912477 1912571 1912718 1913654 1914438
+http://svn.apache.org/viewvc?view=revision&revision=1912477
+http://svn.apache.org/viewvc?view=revision&revision=1912571
+http://svn.apache.org/viewvc?view=revision&revision=1912718
+http://svn.apache.org/viewvc?view=revision&revision=1913654
+http://svn.apache.org/viewvc?view=revision&revision=1914438
+
+--- httpd-2.4.58/modules/dav/fs/config6.m4.r1912477+
++++ httpd-2.4.58/modules/dav/fs/config6.m4
+@@ -20,4 +20,10 @@
+ 
+ APACHE_MODULE(dav_fs, DAV provider for the filesystem.  --enable-dav also enables mod_dav_fs., $dav_fs_objects, , $dav_fs_enable,,dav)
+ 
++if test "x$enable_dav_fs" = "xshared"; then
++    # The only symbol which needs to be exported is the module
++    # structure, so ask libtool to hide everything else:
++    APR_ADDTO(MOD_DAV_FS_LDADD, [-export-symbols-regex dav_fs_module])
++fi
++
+ APACHE_MODPATH_FINISH
+--- httpd-2.4.58/modules/dav/fs/dbm.c.r1912477+
++++ httpd-2.4.58/modules/dav/fs/dbm.c
+@@ -47,6 +47,10 @@
+ #include "http_log.h"
+ #include "http_main.h"      /* for ap_server_conf */
+ 
++#ifndef DEFAULT_PROPDB_DBM_TYPE
++#define DEFAULT_PROPDB_DBM_TYPE "default"
++#endif
++
+ APLOG_USE_MODULE(dav_fs);
+ 
+ struct dav_db {
+@@ -100,7 +104,7 @@
+     /* There might not be a <db> if we had problems creating it. */
+     if (db == NULL) {
+         errcode = 1;
+-        errstr = "Could not open property database.";
++        errstr = "Could not open database.";
+         if (APR_STATUS_IS_EDSOOPEN(status))
+             ap_log_error(APLOG_MARK, APLOG_CRIT, status, ap_server_conf, APLOGNO(00576)
+             "The DBM driver could not be loaded");
+@@ -129,10 +133,10 @@
+ /* dav_dbm_open_direct:  Opens a *dbm database specified by path.
+  *    ro = boolean read-only flag.
+  */
+-dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
+-                                dav_db **pdb)
++dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname,
++                                const char *dbmtype, int ro, dav_db **pdb)
+ {
+-#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
++#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
+     const apr_dbm_driver_t *driver;
+     const apu_err_t *err;
+ #endif
+@@ -141,13 +145,13 @@
+ 
+     *pdb = NULL;
+ 
+-#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
+-    if ((status = apr_dbm_get_driver(&driver, NULL, &err, p)) != APR_SUCCESS) {
++#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
++    if ((status = apr_dbm_get_driver(&driver, dbmtype, &err, p)) != APR_SUCCESS) {
+         ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, APLOGNO(10289)
+-                     "mod_dav_fs: The DBM library '%s' could not be loaded: %s",
+-                             err->reason, err->msg);
++                     "mod_dav_fs: The DBM library '%s' for '%s' could not be loaded: %s",
++                     err->reason, dbmtype, err->msg);
+         return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status,
+-                "Could not load library for property database.");
++                "Could not load library for database.");
+     }
+     if ((status = apr_dbm_open2(&file, driver, pathname,
+                                ro ? APR_DBM_READONLY : APR_DBM_RWCREATE,
+@@ -156,7 +160,7 @@
+         return dav_fs_dbm_error(NULL, p, status);
+     }
+ #else
+-    if ((status = apr_dbm_open(&file, pathname,
++    if ((status = apr_dbm_open_ex(&file, dbmtype, pathname,
+                                ro ? APR_DBM_READONLY : APR_DBM_RWCREATE,
+                                APR_OS_DEFAULT, p))
+                 != APR_SUCCESS
+@@ -206,7 +210,7 @@
+ 
+     /* ### do we need to deal with the umask? */
+ 
+-    return dav_dbm_open_direct(p, pathname, ro, pdb);
++    return dav_dbm_open_direct(p, pathname, DEFAULT_PROPDB_DBM_TYPE, ro, pdb);
+ }
+ 
+ void dav_dbm_close(dav_db *db)
+--- httpd-2.4.58/modules/dav/fs/lock.c.r1912477+
++++ httpd-2.4.58/modules/dav/fs/lock.c
+@@ -181,8 +181,7 @@
+ {
+     request_rec *r;                  /* for accessing the uuid state */
+     apr_pool_t *pool;                /* a pool to use */
+-    const char *lockdb_path;         /* where is the lock database? */
+-
++    const dav_fs_server_conf *conf;  /* lock database config & metadata */
+     int opened;                      /* we opened the database */
+     dav_db *db;                      /* if non-NULL, the lock database */
+ };
+@@ -292,6 +291,19 @@
+     return dav_compare_locktoken(lt1, lt2);
+ }
+ 
++static apr_status_t dav_fs_lockdb_cleanup(void *data)
++{
++    dav_lockdb *lockdb = data;
++
++    apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex);
++
++    if (lockdb->info->db) {
++        dav_dbm_close(lockdb->info->db);
++    }
++    
++    return APR_SUCCESS;
++}
++
+ /*
+ ** dav_fs_really_open_lockdb:
+ **
+@@ -300,15 +312,27 @@
+ static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb)
+ {
+     dav_error *err;
++    apr_status_t rv;
+ 
+     if (lockdb->info->opened)
+         return NULL;
+ 
++    rv = apr_global_mutex_lock(lockdb->info->conf->lockdb_mutex);
++    if (rv) {
++        return dav_new_error(lockdb->info->pool,
++                             HTTP_INTERNAL_SERVER_ERROR,
++                             DAV_ERR_LOCK_OPENDB, rv,
++                             "Could not lock mutex for lock database.");
++    }
++    
+     err = dav_dbm_open_direct(lockdb->info->pool,
+-                              lockdb->info->lockdb_path,
++                              lockdb->info->conf->lockdb_path,
++                              lockdb->info->conf->lockdb_type,
+                               lockdb->ro,
+                               &lockdb->info->db);
+     if (err != NULL) {
++        apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex);
++        
+         return dav_push_error(lockdb->info->pool,
+                               HTTP_INTERNAL_SERVER_ERROR,
+                               DAV_ERR_LOCK_OPENDB,
+@@ -316,6 +340,10 @@
+                               err);
+     }
+ 
++    apr_pool_cleanup_register(lockdb->info->pool, lockdb,
++                              dav_fs_lockdb_cleanup,
++                              dav_fs_lockdb_cleanup);
++
+     /* all right. it is opened now. */
+     lockdb->info->opened = 1;
+ 
+@@ -341,9 +369,9 @@
+     comb->pub.info = &comb->priv;
+     comb->priv.r = r;
+     comb->priv.pool = r->pool;
+-
+-    comb->priv.lockdb_path = dav_get_lockdb_path(r);
+-    if (comb->priv.lockdb_path == NULL) {
++    comb->priv.conf = dav_fs_get_server_conf(r);
++    
++    if (comb->priv.conf == NULL || comb->priv.conf->lockdb_path == NULL) {
+         return dav_new_error(r->pool, HTTP_INTERNAL_SERVER_ERROR,
+                              DAV_ERR_LOCK_NO_DB, 0,
+                              "A lock database was not specified with the "
+@@ -369,8 +397,8 @@
+ */
+ static void dav_fs_close_lockdb(dav_lockdb *lockdb)
+ {
+-    if (lockdb->info->db != NULL)
+-        dav_dbm_close(lockdb->info->db);
++    apr_pool_cleanup_run(lockdb->info->pool, lockdb,
++                         dav_fs_lockdb_cleanup);
+ }
+ 
+ /*
+--- httpd-2.4.58/modules/dav/fs/mod_dav_fs.c.r1912477+
++++ httpd-2.4.58/modules/dav/fs/mod_dav_fs.c
+@@ -14,31 +14,35 @@
+  * limitations under the License.
+  */
+ 
++#if !defined(_MSC_VER) && !defined(NETWARE)
++#include "ap_config_auto.h"
++#endif
++
+ #include "httpd.h"
+ #include "http_config.h"
++#include "http_core.h"
++#include "http_log.h"
+ #include "apr_strings.h"
+ 
+ #include "mod_dav.h"
+ #include "repos.h"
+ 
+-/* per-server configuration */
+-typedef struct {
+-    const char *lockdb_path;
+-
+-} dav_fs_server_conf;
+-
+ extern module AP_MODULE_DECLARE_DATA dav_fs_module;
+ 
+ #ifndef DEFAULT_DAV_LOCKDB
+ #define DEFAULT_DAV_LOCKDB "davlockdb"
+ #endif
++#ifndef DEFAULT_DAV_LOCKDB_TYPE
++#define DEFAULT_DAV_LOCKDB_TYPE "default"
++#endif
+ 
+-const char *dav_get_lockdb_path(const request_rec *r)
+-{
+-    dav_fs_server_conf *conf;
++static const char dav_fs_mutexid[] = "dav_fs-lockdb";
+ 
+-    conf = ap_get_module_config(r->server->module_config, &dav_fs_module);
+-    return conf->lockdb_path;
++static apr_global_mutex_t *dav_fs_lockdb_mutex;
++
++const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r)
++{
++    return ap_get_module_config(r->server->module_config, &dav_fs_module);
+ }
+ 
+ static void *dav_fs_create_server_config(apr_pool_t *p, server_rec *s)
+@@ -57,15 +61,50 @@
+ 
+     newconf->lockdb_path =
+         child->lockdb_path ? child->lockdb_path : parent->lockdb_path;
++    newconf->lockdb_type =
++        child->lockdb_type ? child->lockdb_type : parent->lockdb_type;
+ 
+     return newconf;
+ }
+ 
++static int dav_fs_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp)
++{
++    if (ap_mutex_register(pconf, dav_fs_mutexid, NULL, APR_LOCK_DEFAULT, 0))
++        return !OK;
++    return OK;
++}
++
++static void dav_fs_child_init(apr_pool_t *p, server_rec *s)
++{
++    apr_status_t rv;
++    
++    rv = apr_global_mutex_child_init(&dav_fs_lockdb_mutex,
++                                     apr_global_mutex_lockfile(dav_fs_lockdb_mutex),
++                                     p);
++    if (rv) {
++        ap_log_error(APLOG_MARK, APLOG_ERR, rv, s,
++                     APLOGNO(10488) "child init failed for mutex");
++    }                     
++}
++
+ static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog,
+                                        apr_pool_t *ptemp, server_rec *base_server)
+ {
+     server_rec *s;
++    apr_status_t rv;
+ 
++    /* Ignore first pass through the config. */
++    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
++        return OK;
++
++    rv = ap_global_mutex_create(&dav_fs_lockdb_mutex, NULL, dav_fs_mutexid, NULL,
++                                base_server, p, 0);
++    if (rv) {
++        ap_log_error(APLOG_MARK, APLOG_ERR, rv, base_server,
++                     APLOGNO(10489) "could not create lock mutex");
++        return !OK;
++    }                     
++    
+     for (s = base_server; s; s = s->next) {
+         dav_fs_server_conf *conf;
+ 
+@@ -74,6 +113,13 @@
+         if (!conf->lockdb_path) {
+             conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB);
+         }
++        if (!conf->lockdb_type) {
++            conf->lockdb_type = DEFAULT_DAV_LOCKDB_TYPE;
++        }
++
++        /* Mutex is common across all vhosts, but could have one per
++         * vhost if required. */
++        conf->lockdb_mutex = dav_fs_lockdb_mutex;
+     }
+ 
+     return OK;
+@@ -98,19 +144,36 @@
+     return NULL;
+ }
+ 
++/*
++ * Command handler for the DAVLockDBType directive, which is TAKE1
++ */
++static const char *dav_fs_cmd_davlockdbtype(cmd_parms *cmd, void *config,
++                                        const char *arg1)
++{
++    dav_fs_server_conf *conf = ap_get_module_config(cmd->server->module_config,
++                                                    &dav_fs_module);
++    conf->lockdb_type = arg1;
++
++    return NULL;
++}
++
+ static const command_rec dav_fs_cmds[] =
+ {
+     /* per server */
+     AP_INIT_TAKE1("DAVLockDB", dav_fs_cmd_davlockdb, NULL, RSRC_CONF,
+                   "specify a lock database"),
++    AP_INIT_TAKE1("DAVLockDBType", dav_fs_cmd_davlockdbtype, NULL, RSRC_CONF,
++                  "specify a lock database DBM type"),
+ 
+     { NULL }
+ };
+ 
+ static void register_hooks(apr_pool_t *p)
+ {
++    ap_hook_pre_config(dav_fs_pre_config, NULL, NULL, APR_HOOK_MIDDLE);
+     ap_hook_post_config(dav_fs_post_config, NULL, NULL, APR_HOOK_MIDDLE);
+-
++    ap_hook_child_init(dav_fs_child_init, NULL, NULL, APR_HOOK_MIDDLE);
++    
+     dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL,
+                              APR_HOOK_MIDDLE);
+     dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE);
+--- httpd-2.4.58/modules/dav/fs/repos.h.r1912477+
++++ httpd-2.4.58/modules/dav/fs/repos.h
+@@ -25,6 +25,8 @@
+ #ifndef _DAV_FS_REPOS_H_
+ #define _DAV_FS_REPOS_H_
+ 
++#include "util_mutex.h"
++
+ /* the subdirectory to hold all DAV-related information for a directory */
+ #define DAV_FS_STATE_DIR                ".DAV"
+ #define DAV_FS_STATE_FILE_FOR_DIR       ".state_for_dir"
+@@ -53,8 +55,8 @@
+ /* DBM functions used by the repository and locking providers */
+ extern const dav_hooks_db dav_hooks_db_dbm;
+ 
+-dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
+-                                dav_db **pdb);
++dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname,
++                                const char *dbmtype, int ro, dav_db **pdb);
+ void dav_dbm_get_statefiles(apr_pool_t *p, const char *fname,
+                             const char **state1, const char **state2);
+ dav_error * dav_dbm_delete(dav_db *db, apr_datum_t key);
+@@ -64,8 +66,15 @@
+ int dav_dbm_exists(dav_db *db, apr_datum_t key);
+ void dav_dbm_close(dav_db *db);
+ 
+-/* where is the lock database located? */
+-const char *dav_get_lockdb_path(const request_rec *r);
++/* Per-server configuration. */
++typedef struct {
++    const char *lockdb_path;
++    const char *lockdb_type;
++    apr_global_mutex_t *lockdb_mutex;
++} dav_fs_server_conf;
++
++/* Returns server configuration for the request. */
++const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r);
+ 
+ const dav_hooks_locks *dav_fs_get_lock_hooks(request_rec *r);
+ const dav_hooks_propdb *dav_fs_get_propdb_hooks(request_rec *r);
diff --git a/httpd.spec b/httpd.spec
index 066d182..bff884c 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.58
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -96,6 +96,7 @@ Patch41: httpd-2.4.43-r1861793+.patch
 Patch42: httpd-2.4.48-r1828172+.patch
 Patch45: httpd-2.4.43-logjournal.patch
 Patch46: httpd-2.4.53-separate-systemd-fns.patch
+Patch47: httpd-2.4.58-r1912477+.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -271,6 +272,7 @@ written in the Lua programming language.
 %patch -P45 -p1 -b .logjournal
 %patch -P46 -p1 -b .separatesystemd
 %patch -P25 -p1 -b .selinux
+%patch -P47 -p1 -b .r1912477+
 
 %patch -P60 -p1 -b .enable-sslv3
 %patch -P63 -p1 -b .htcacheclean-dont-break
@@ -859,6 +861,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Dec  8 2023 Joe Orton <jorton@redhat.com> - 2.4.58-3
+- mod_dav_fs: add DAVLockDBType, use global lock around lockdb
+
 * Thu Nov  2 2023 Joe Orton <jorton@redhat.com> - 2.4.58-2
 - add dependency on apr-util-1(dbm) so a DBM provider is present
 

From 3d4b4777ce7dcd6b777cc57052faeb192828f618 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 8 Dec 2023 11:55:58 +0000
Subject: [PATCH 308/359] - fix build with libxml2 2.12

---
 httpd-2.4.58-r1914013.patch | 14 ++++++++++++++
 httpd.spec                  |  2 ++
 2 files changed, 16 insertions(+)
 create mode 100644 httpd-2.4.58-r1914013.patch

diff --git a/httpd-2.4.58-r1914013.patch b/httpd-2.4.58-r1914013.patch
new file mode 100644
index 0000000..f9e0786
--- /dev/null
+++ b/httpd-2.4.58-r1914013.patch
@@ -0,0 +1,14 @@
+# ./pullrev.sh 1914013
+http://svn.apache.org/viewvc?view=revision&revision=1914013
+
+--- httpd-2.4.58/modules/filters/mod_xml2enc.c
++++ httpd-2.4.58/modules/filters/mod_xml2enc.c
+@@ -209,7 +209,7 @@
+   
+     /* to sniff, first we look for BOM */
+     if (ctx->xml2enc == XML_CHAR_ENCODING_NONE) {
+-        ctx->xml2enc = xmlDetectCharEncoding((const xmlChar*)ctx->buf,
++        ctx->xml2enc = xmlDetectCharEncoding((const unsigned char*)ctx->buf,
+                                              ctx->bytes); 
+         if (HAVE_ENCODING(ctx->xml2enc)) {
+             ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(01432)
diff --git a/httpd.spec b/httpd.spec
index bff884c..5bd2c4d 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -101,6 +101,7 @@ Patch47: httpd-2.4.58-r1912477+.patch
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
+Patch61: httpd-2.4.58-r1914013.patch
 Patch63: httpd-2.4.46-htcacheclean-dont-break.patch
 Patch65: httpd-2.4.51-r1894152.patch
 
@@ -275,6 +276,7 @@ written in the Lua programming language.
 %patch -P47 -p1 -b .r1912477+
 
 %patch -P60 -p1 -b .enable-sslv3
+%patch -P61 -p1 -b .r1914013
 %patch -P63 -p1 -b .htcacheclean-dont-break
 %patch -P65 -p1 -b .r1894152
 

From af4e8a43b66a9ed63903c84ca4b9be765bda87a1 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 12 Dec 2023 08:59:47 +0000
Subject: [PATCH 309/359] Note build fix.

---
 httpd.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/httpd.spec b/httpd.spec
index 5bd2c4d..f593ac4 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -865,6 +865,7 @@ exit $rv
 %changelog
 * Fri Dec  8 2023 Joe Orton <jorton@redhat.com> - 2.4.58-3
 - mod_dav_fs: add DAVLockDBType, use global lock around lockdb
+- fix build with libxml2 2.12
 
 * Thu Nov  2 2023 Joe Orton <jorton@redhat.com> - 2.4.58-2
 - add dependency on apr-util-1(dbm) so a DBM provider is present

From 16be14d05f9d8cf33661a58715a302be8872ce81 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 5 Jan 2024 11:48:45 +0000
Subject: [PATCH 310/359] fix OpenSSL 3.0 deprecation warnings (r1913912,
 r1915067)

mod_ssl: move to provider API for pkcs11 support (#2253014)
---
 httpd-2.4.58-r1913912+.patch | 847 +++++++++++++++++++++++++++++++++++
 httpd-2.4.58-r1914365.patch  | 219 +++++++++
 httpd.spec                   |  10 +-
 pullrev.sh                   |   6 +-
 4 files changed, 1079 insertions(+), 3 deletions(-)
 create mode 100644 httpd-2.4.58-r1913912+.patch
 create mode 100644 httpd-2.4.58-r1914365.patch

diff --git a/httpd-2.4.58-r1913912+.patch b/httpd-2.4.58-r1913912+.patch
new file mode 100644
index 0000000..c8ea8fa
--- /dev/null
+++ b/httpd-2.4.58-r1913912+.patch
@@ -0,0 +1,847 @@
+# ./pullrev.sh 1913912 1915067
+
+http://svn.apache.org/viewvc?view=revision&revision=1913912
+http://svn.apache.org/viewvc?view=revision&revision=1915067
+
+--- httpd-2.4.58/modules/ssl/mod_ssl.c.r1913912
++++ httpd-2.4.58/modules/ssl/mod_ssl.c
+@@ -25,8 +25,7 @@
+  */
+ 
+ #include "ssl_private.h"
+-#include "mod_ssl.h"
+-#include "mod_ssl_openssl.h"
++
+ #include "util_md5.h"
+ #include "util_mutex.h"
+ #include "ap_provider.h"
+@@ -75,11 +74,9 @@
+     SSL_CMD_SRV(SessionCache, TAKE1,
+                 "SSL Session Cache storage "
+                 "('none', 'nonenotnull', 'dbm:/path/to/file')")
+-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
+     SSL_CMD_SRV(CryptoDevice, TAKE1,
+                 "SSL external Crypto Device usage "
+                 "('builtin', '...')")
+-#endif
+     SSL_CMD_SRV(RandomSeed, TAKE23,
+                 "SSL Pseudo Random Number Generator (PRNG) seeding source "
+                 "('startup|connect builtin|file:/path|exec:/path [bytes]')")
+--- httpd-2.4.58/modules/ssl/mod_ssl_openssl.h.r1913912
++++ httpd-2.4.58/modules/ssl/mod_ssl_openssl.h
+@@ -30,14 +30,17 @@
+ 
+ /* OpenSSL headers */
+ 
+-#ifndef SSL_PRIVATE_H
+ #include <openssl/opensslv.h>
+-#if (OPENSSL_VERSION_NUMBER >= 0x10001000)
++#if OPENSSL_VERSION_NUMBER >= 0x30000000
++#include <openssl/macros.h> /* for OPENSSL_API_LEVEL */
++#endif
++#if OPENSSL_VERSION_NUMBER >= 0x10001000
+ /* must be defined before including ssl.h */
+ #define OPENSSL_NO_SSL_INTERN
+ #endif
+ #include <openssl/ssl.h>
+-#endif
++#include <openssl/evp.h>
++#include <openssl/x509.h>
+ 
+ /**
+  * init_server hook -- allow SSL_CTX-specific initialization to be performed by
+--- httpd-2.4.58/modules/ssl/ssl_engine_config.c.r1913912
++++ httpd-2.4.58/modules/ssl/ssl_engine_config.c
+@@ -27,6 +27,7 @@
+                                            damned if you don't.''
+                                                -- Unknown        */
+ #include "ssl_private.h"
++
+ #include "util_mutex.h"
+ #include "ap_provider.h"
+ 
+@@ -593,14 +594,15 @@
+     return NULL;
+ }
+ 
+-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
+ const char *ssl_cmd_SSLCryptoDevice(cmd_parms *cmd,
+                                     void *dcfg,
+                                     const char *arg)
+ {
+     SSLModConfigRec *mc = myModConfig(cmd->server);
+     const char *err;
++#if MODSSL_HAVE_ENGINE_API
+     ENGINE *e;
++#endif
+ 
+     if ((err = ap_check_cmd_context(cmd, GLOBAL_ONLY))) {
+         return err;
+@@ -609,13 +611,16 @@
+     if (strcEQ(arg, "builtin")) {
+         mc->szCryptoDevice = NULL;
+     }
++#if MODSSL_HAVE_ENGINE_API
+     else if ((e = ENGINE_by_id(arg))) {
+         mc->szCryptoDevice = arg;
+         ENGINE_free(e);
+     }
++#endif
+     else {
+         err = "SSLCryptoDevice: Invalid argument; must be one of: "
+               "'builtin' (none)";
++#if MODSSL_HAVE_ENGINE_API
+         e = ENGINE_get_first();
+         while (e) {
+             err = apr_pstrcat(cmd->pool, err, ", '", ENGINE_get_id(e),
+@@ -624,12 +629,12 @@
+              * on the 'old' e, per the docs in engine.h. */
+             e = ENGINE_get_next(e);
+         }
++#endif
+         return err;
+     }
+ 
+     return NULL;
+ }
+-#endif
+ 
+ const char *ssl_cmd_SSLRandomSeed(cmd_parms *cmd,
+                                   void *dcfg,
+--- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1913912
++++ httpd-2.4.58/modules/ssl/ssl_engine_init.c
+@@ -27,8 +27,7 @@
+                                   see Recursive.''
+                                         -- Unknown   */
+ #include "ssl_private.h"
+-#include "mod_ssl.h"
+-#include "mod_ssl_openssl.h"
++
+ #include "mpm_common.h"
+ #include "mod_md.h"
+ 
+@@ -218,6 +217,16 @@
+ }
+ #endif
+ 
++static APR_INLINE unsigned long modssl_runtime_lib_version(void)
++{
++#if MODSSL_USE_OPENSSL_PRE_1_1_API
++    return SSLeay();
++#else
++    return OpenSSL_version_num();
++#endif
++}
++
++
+ /*
+  *  Per-module initialization
+  */
+@@ -225,18 +234,22 @@
+                              apr_pool_t *ptemp,
+                              server_rec *base_server)
+ {
++    unsigned long runtime_lib_version = modssl_runtime_lib_version();
+     SSLModConfigRec *mc = myModConfig(base_server);
+     SSLSrvConfigRec *sc;
+     server_rec *s;
+     apr_status_t rv;
+     apr_array_header_t *pphrases;
+ 
+-    if (SSLeay() < MODSSL_LIBRARY_VERSION) {
++    AP_DEBUG_ASSERT(mc);
++
++    if (runtime_lib_version < MODSSL_LIBRARY_VERSION) {
+         ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(01882)
+                      "Init: this version of mod_ssl was compiled against "
+-                     "a newer library (%s, version currently loaded is %s)"
++                     "a newer library (%s (%s), version currently loaded is 0x%lX)"
+                      " - may result in undefined or erroneous behavior",
+-                     MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT);
++                    MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT,
++                    runtime_lib_version);
+     }
+ 
+     /* We initialize mc->pid per-process in the child init,
+@@ -313,11 +326,9 @@
+     /*
+      * SSL external crypto device ("engine") support
+      */
+-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
+     if ((rv = ssl_init_Engine(base_server, p)) != APR_SUCCESS) {
+         return rv;
+     }
+-#endif
+ 
+     ap_log_error(APLOG_MARK, APLOG_INFO, 0, base_server, APLOGNO(01883)
+                  "Init: Initialized %s library", MODSSL_LIBRARY_NAME);
+@@ -473,9 +484,9 @@
+  * Support for external a Crypto Device ("engine"), usually
+  * a hardware accelerator card for crypto operations.
+  */
+-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
+ apr_status_t ssl_init_Engine(server_rec *s, apr_pool_t *p)
+ {
++#if MODSSL_HAVE_ENGINE_API
+     SSLModConfigRec *mc = myModConfig(s);
+     ENGINE *e;
+ 
+@@ -507,10 +518,9 @@
+ 
+         ENGINE_free(e);
+     }
+-
++#endif
+     return APR_SUCCESS;
+ }
+-#endif
+ 
+ #ifdef HAVE_TLSEXT
+ static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s,
+@@ -1320,15 +1330,6 @@
+    return 0;
+ }
+ 
+-static APR_INLINE int modssl_DH_bits(DH *dh)
+-{
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
+-    return DH_bits(dh);
+-#else
+-    return BN_num_bits(DH_get0_p(dh));
+-#endif
+-}
+-
+ /* SSL_CTX_use_PrivateKey_file() can fail either because the private
+  * key was encrypted, or due to a mismatch between an already-loaded
+  * cert and the key - a common misconfiguration - from calling
+@@ -1354,15 +1355,10 @@
+     SSLModConfigRec *mc = myModConfig(s);
+     const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile;
+     int i;
+-    X509 *cert;
+-    DH *dh;
++    EVP_PKEY *pkey;
+ #ifdef HAVE_ECC
+-    EC_GROUP *ecparams = NULL;
+-    int nid;
+-    EC_KEY *eckey = NULL;
+-#endif
+-#ifndef HAVE_SSL_CONF_CMD
+-    SSL *ssl;
++    EC_GROUP *ecgroup = NULL;
++    int curve_nid = 0;
+ #endif
+ 
+     /* no OpenSSL default prompts for any of the SSL_CTX_use_* calls, please */
+@@ -1373,7 +1369,7 @@
+                 (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i,
+                                           const char *));
+          i++) {
+-        EVP_PKEY *pkey;
++        X509 *cert = NULL;
+         const char *engine_certfile = NULL;
+ 
+         key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i);
+@@ -1416,8 +1412,6 @@
+         if (modssl_is_engine_id(keyfile)) {
+             apr_status_t rv;
+ 
+-            cert = NULL;
+-            
+             if ((rv = modssl_load_engine_keypair(s, ptemp, vhost_id,
+                                                  engine_certfile, keyfile,
+                                                  &cert, &pkey))) {
+@@ -1488,22 +1482,21 @@
+          * assume that if SSL_CONF is available, it's OpenSSL 1.0.2 or later,
+          * and SSL_CTX_get0_certificate is implemented.)
+          */
+-        if (!(cert = SSL_CTX_get0_certificate(mctx->ssl_ctx))) {
++        cert = SSL_CTX_get0_certificate(mctx->ssl_ctx);
+ #else
+-        ssl = SSL_new(mctx->ssl_ctx);
++        {
++            SSL *ssl = SSL_new(mctx->ssl_ctx);
+         if (ssl) {
+             /* Workaround bug in SSL_get_certificate in OpenSSL 0.9.8y */
+             SSL_set_connect_state(ssl);
+             cert = SSL_get_certificate(ssl);
++                SSL_free(ssl);
++            }
+         }
+-        if (!ssl || !cert) {
+ #endif
++        if (!cert) {
+             ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02566)
+                          "Unable to retrieve certificate %s", key_id);
+-#ifndef HAVE_SSL_CONF_CMD
+-            if (ssl)
+-                SSL_free(ssl);
+-#endif
+             return APR_EGENERAL;
+         }
+ 
+@@ -1525,10 +1518,6 @@
+         }
+ #endif
+ 
+-#ifndef HAVE_SSL_CONF_CMD
+-        SSL_free(ssl);
+-#endif
+-
+         ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(02568)
+                      "Certificate and private key %s configured from %s and %s",
+                      key_id, certfile, keyfile);
+@@ -1538,15 +1527,33 @@
+      * Try to read DH parameters from the (first) SSLCertificateFile
+      */
+     certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *);
+-    if (certfile && !modssl_is_engine_id(certfile)
+-        && (dh = ssl_dh_GetParamFromFile(certfile))) {
+-        /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey()
+-         * for OpenSSL 3.0+. */
++    if (certfile && !modssl_is_engine_id(certfile)) {
++        int done = 0, num_bits = 0;
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++        DH *dh = modssl_dh_from_file(certfile);
++        if (dh) {
++            num_bits = DH_bits(dh);
+         SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh);
++            DH_free(dh);
++            done = 1;
++        }
++#else
++        pkey = modssl_dh_pkey_from_file(certfile);
++        if (pkey) {
++            num_bits = EVP_PKEY_get_bits(pkey);
++            if (!SSL_CTX_set0_tmp_dh_pkey(mctx->ssl_ctx, pkey)) {
++                EVP_PKEY_free(pkey);
++            }
++            else {
++                done = 1;
++            }
++        }
++#endif
++        if (done) {
+         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
+                      "Custom DH parameters (%d bits) for %s loaded from %s",
+-                     modssl_DH_bits(dh), vhost_id, certfile);
+-        DH_free(dh);
++                         num_bits, vhost_id, certfile);
++        }
+     }
+ #if !MODSSL_USE_OPENSSL_PRE_1_1_API
+     else {
+@@ -1561,13 +1568,27 @@
+      * Similarly, try to read the ECDH curve name from SSLCertificateFile...
+      */
+     if (certfile && !modssl_is_engine_id(certfile)
+-        && (ecparams = ssl_ec_GetParamFromFile(certfile))
+-        && (nid = EC_GROUP_get_curve_name(ecparams)) 
+-        && (eckey = EC_KEY_new_by_curve_name(nid))) {
++        && (ecgroup = modssl_ec_group_from_file(certfile))
++        && (curve_nid = EC_GROUP_get_curve_name(ecgroup))) {
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++        EC_KEY *eckey = EC_KEY_new_by_curve_name(curve_nid);
++        if (eckey) {
+         SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey);
++            EC_KEY_free(eckey);
++        }
++        else {
++            curve_nid = 0;
++        }
++#else
++        if (!SSL_CTX_set1_curves(mctx->ssl_ctx, &curve_nid, 1)) {
++            curve_nid = 0;
++        }
++#endif
++        if (curve_nid) {
+         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541)
+                      "ECDH curve %s for %s specified in %s",
+-                     OBJ_nid2sn(nid), vhost_id, certfile);
++                         OBJ_nid2sn(curve_nid), vhost_id, certfile);
++        }
+     }
+     /*
+      * ...otherwise, enable auto curve selection (OpenSSL 1.0.2)
+@@ -1575,18 +1596,20 @@
+      * ECDH is always enabled in 1.1.0 unless excluded from SSLCipherList
+      */
+ #if MODSSL_USE_OPENSSL_PRE_1_1_API
+-    else {
++    if (!curve_nid) {
+ #if defined(SSL_CTX_set_ecdh_auto)
+         SSL_CTX_set_ecdh_auto(mctx->ssl_ctx, 1);
+ #else
+-        eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
++        EC_KEY *eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
++        if (eckey) {
+         SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey);
++            EC_KEY_free(eckey);
++        }
+ #endif
+     }
+ #endif
+     /* OpenSSL assures us that _free() is NULL-safe */
+-    EC_KEY_free(eckey);
+-    EC_GROUP_free(ecparams);
++    EC_GROUP_free(ecgroup);
+ #endif
+ 
+     return APR_SUCCESS;
+--- httpd-2.4.58/modules/ssl/ssl_engine_io.c.r1913912
++++ httpd-2.4.58/modules/ssl/ssl_engine_io.c
+@@ -28,8 +28,7 @@
+                                   core keeps dumping.''
+                                             -- Unknown    */
+ #include "ssl_private.h"
+-#include "mod_ssl.h"
+-#include "mod_ssl_openssl.h"
++
+ #include "apr_date.h"
+ 
+ APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, proxy_post_handshake,
+@@ -2283,14 +2282,7 @@
+                               ssl_io_filter_cleanup, apr_pool_cleanup_null);
+ 
+     if (APLOG_CS_IS_LEVEL(c, mySrvFromConn(c), APLOG_TRACE4)) {
+-        BIO *rbio = SSL_get_rbio(ssl),
+-            *wbio = SSL_get_wbio(ssl);
+-        BIO_set_callback(rbio, ssl_io_data_cb);
+-        BIO_set_callback_arg(rbio, (void *)ssl);
+-        if (wbio && wbio != rbio) {
+-            BIO_set_callback(wbio, ssl_io_data_cb);
+-            BIO_set_callback_arg(wbio, (void *)ssl);
+-        }
++        modssl_set_io_callbacks(ssl);
+     }
+ 
+     return;
+@@ -2374,13 +2366,22 @@
+             "+-------------------------------------------------------------------------+");
+ }
+ 
+-long ssl_io_data_cb(BIO *bio, int cmd,
+-                    const char *argp,
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++static long modssl_io_cb(BIO *bio, int cmd, const char *argp,
++                         size_t len, int argi, long argl, int rc,
++                         size_t *processed)
++#else
++static long modssl_io_cb(BIO *bio, int cmd, const char *argp,
+                     int argi, long argl, long rc)
++#endif
+ {
+     SSL *ssl;
+     conn_rec *c;
+     server_rec *s;
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++    (void)len;
++    (void)processed;
++#endif
+ 
+     if ((ssl = (SSL *)BIO_get_callback_arg(bio)) == NULL)
+         return rc;
+@@ -2402,7 +2403,7 @@
+                     "%s: %s %ld/%d bytes %s BIO#%pp [mem: %pp] %s",
+                     MODSSL_LIBRARY_NAME,
+                     (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "write" : "read"),
+-                    rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"),
++                    (long)rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"),
+                     bio, argp, dump);
+             if (*dump != '\0' && argp != NULL)
+                 ssl_io_data_dump(c, s, argp, rc);
+@@ -2417,3 +2418,25 @@
+     }
+     return rc;
+ }
++
++static APR_INLINE void set_bio_callback(BIO *bio, void *arg)
++{
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++    BIO_set_callback_ex(bio, modssl_io_cb);
++#else
++    BIO_set_callback(bio, modssl_io_cb);
++#endif
++    BIO_set_callback_arg(bio, arg);
++}
++
++void modssl_set_io_callbacks(SSL *ssl)
++{
++    BIO *rbio = SSL_get_rbio(ssl),
++        *wbio = SSL_get_wbio(ssl);
++    if (rbio) {
++        set_bio_callback(rbio, ssl);
++    }
++    if (wbio && wbio != rbio) {
++        set_bio_callback(wbio, ssl);
++    }
++}
+--- httpd-2.4.58/modules/ssl/ssl_engine_kernel.c.r1913912
++++ httpd-2.4.58/modules/ssl/ssl_engine_kernel.c
+@@ -2581,6 +2581,7 @@
+             sc->server->pks->service_unavailable : 0; 
+         
+         ap_update_child_status_from_server(c->sbh, SERVER_BUSY_READ, c, s);
++
+         /*
+          * There is one special filter callback, which is set
+          * very early depending on the base_server's log level.
+@@ -2589,14 +2590,7 @@
+          * we need to set that callback here.
+          */
+         if (APLOGtrace4(s)) {
+-            BIO *rbio = SSL_get_rbio(ssl),
+-                *wbio = SSL_get_wbio(ssl);
+-            BIO_set_callback(rbio, ssl_io_data_cb);
+-            BIO_set_callback_arg(rbio, (void *)ssl);
+-            if (wbio && wbio != rbio) {
+-                BIO_set_callback(wbio, ssl_io_data_cb);
+-                BIO_set_callback_arg(wbio, (void *)ssl);
+-            }
++            modssl_set_io_callbacks(ssl);
+         }
+ 
+         return 1;
+--- httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c.r1913912
++++ httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c
+@@ -30,6 +30,8 @@
+                                            -- Clifford Stoll     */
+ #include "ssl_private.h"
+ 
++#include <openssl/ui.h>
++
+ typedef struct {
+     server_rec         *s;
+     apr_pool_t         *p;
+@@ -606,8 +608,7 @@
+     return (len);
+ }
+ 
+-
+-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
++#if MODSSL_HAVE_ENGINE_API
+ 
+ /* OpenSSL UI implementation for passphrase entry; largely duplicated
+  * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be
+@@ -831,7 +832,7 @@
+                                         const char *certid, const char *keyid,
+                                         X509 **pubkey, EVP_PKEY **privkey)
+ {
+-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
++#if MODSSL_HAVE_ENGINE_API
+     const char *c, *scheme;
+     ENGINE *e;
+     UI_METHOD *ui_method = get_passphrase_ui(p);
+--- httpd-2.4.58/modules/ssl/ssl_private.h.r1913912
++++ httpd-2.4.58/modules/ssl/ssl_private.h
+@@ -83,16 +83,13 @@
+ 
+ #include "ap_expr.h"
+ 
+-/* OpenSSL headers */
+-#include <openssl/opensslv.h>
+-#if (OPENSSL_VERSION_NUMBER >= 0x10001000)
+-/* must be defined before including ssl.h */
+-#define OPENSSL_NO_SSL_INTERN
+-#endif
+-#if OPENSSL_VERSION_NUMBER >= 0x30000000
+-#include <openssl/core_names.h>
++/* keep first for compat API */
++#ifndef OPENSSL_API_COMPAT
++#define OPENSSL_API_COMPAT 0x10101000 /* for ENGINE_ API */
+ #endif
+-#include <openssl/ssl.h>
++#include "mod_ssl_openssl.h"
++
++/* OpenSSL headers */
+ #include <openssl/err.h>
+ #include <openssl/x509.h>
+ #include <openssl/pem.h>
+@@ -102,12 +99,23 @@
+ #include <openssl/x509v3.h>
+ #include <openssl/x509_vfy.h>
+ #include <openssl/ocsp.h>
++#include <openssl/dh.h>
++#if OPENSSL_VERSION_NUMBER >= 0x30000000
++#include <openssl/core_names.h>
++#endif
+ 
+ /* Avoid tripping over an engine build installed globally and detected
+  * when the user points at an explicit non-engine flavor of OpenSSL
+  */
+-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
++#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) \
++    && (OPENSSL_VERSION_NUMBER < 0x30000000 \
++        || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \
++    && !defined(OPENSSL_NO_ENGINE)
+ #include <openssl/engine.h>
++#define MODSSL_HAVE_ENGINE_API 1
++#endif
++#ifndef MODSSL_HAVE_ENGINE_API
++#define MODSSL_HAVE_ENGINE_API 0
+ #endif
+ 
+ #if (OPENSSL_VERSION_NUMBER < 0x0090801f)
+@@ -142,10 +150,18 @@
+  * include most changes from OpenSSL >= 1.1 (new functions, macros, 
+  * deprecations, ...), so we have to work around this...
+  */
+-#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f)
++#if LIBRESSL_VERSION_NUMBER < 0x2070000f
++#define MODSSL_USE_OPENSSL_PRE_1_1_API 1
++#else
++#define MODSSL_USE_OPENSSL_PRE_1_1_API 0
++#endif
+ #else /* defined(LIBRESSL_VERSION_NUMBER) */
+-#define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L)
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#define MODSSL_USE_OPENSSL_PRE_1_1_API 1
++#else
++#define MODSSL_USE_OPENSSL_PRE_1_1_API 0
+ #endif
++#endif /* defined(LIBRESSL_VERSION_NUMBER) */
+ 
+ #if defined(OPENSSL_FIPS) || OPENSSL_VERSION_NUMBER >= 0x30000000L
+ #define HAVE_FIPS
+@@ -211,7 +227,10 @@
+ #endif
+ 
+ /* Secure Remote Password */
+-#if !defined(OPENSSL_NO_SRP) && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB)
++#if !defined(OPENSSL_NO_SRP) \
++    && (OPENSSL_VERSION_NUMBER < 0x30000000L \
++        || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \
++    && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB)
+ #define HAVE_SRP
+ #include <openssl/srp.h>
+ #endif
+@@ -254,6 +273,14 @@
+ #endif
+ #endif
+ 
++/* those may be deprecated */
++#ifndef X509_get_notBefore
++#define X509_get_notBefore  X509_getm_notBefore
++#endif
++#ifndef X509_get_notAfter
++#define X509_get_notAfter   X509_getm_notAfter
++#endif
++
+ #if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
+ #define HAVE_OPENSSL_KEYLOG
+ #endif
+@@ -1019,7 +1046,7 @@
+ /**  I/O  */
+ void         ssl_io_filter_init(conn_rec *, request_rec *r, SSL *);
+ void         ssl_io_filter_register(apr_pool_t *);
+-long         ssl_io_data_cb(BIO *, int, const char *, int, long, long);
++void         modssl_set_io_callbacks(SSL *ssl);
+ 
+ /* ssl_io_buffer_fill fills the setaside buffering of the HTTP request
+  * to allow an SSL renegotiation to take place. */
+@@ -1057,9 +1084,13 @@
+                                         X509 **pubkey, EVP_PKEY **privkey);
+ 
+ /**  Diffie-Hellman Parameter Support  */
+-DH           *ssl_dh_GetParamFromFile(const char *);
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++DH           *modssl_dh_from_file(const char *);
++#else
++EVP_PKEY     *modssl_dh_pkey_from_file(const char *);
++#endif
+ #ifdef HAVE_ECC
+-EC_GROUP     *ssl_ec_GetParamFromFile(const char *);
++EC_GROUP     *modssl_ec_group_from_file(const char *);
+ #endif
+ 
+ /* Store the EVP_PKEY key (serialized into DER) in the hash table with
+--- httpd-2.4.58/modules/ssl/ssl_util.c.r1913912
++++ httpd-2.4.58/modules/ssl/ssl_util.c
+@@ -476,7 +476,7 @@
+ 
+ int modssl_is_engine_id(const char *name)
+ {
+-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
++#if MODSSL_HAVE_ENGINE_API
+     /* ### Can handle any other special ENGINE key names here? */
+     return strncmp(name, "pkcs11:", 7) == 0;
+ #else
+--- httpd-2.4.58/modules/ssl/ssl_util_ssl.c.r1913912
++++ httpd-2.4.58/modules/ssl/ssl_util_ssl.c
+@@ -464,29 +464,52 @@
+ **  _________________________________________________________________
+ */
+ 
+-DH *ssl_dh_GetParamFromFile(const char *file)
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++DH *modssl_dh_from_file(const char *file)
+ {
+-    DH *dh = NULL;
++    DH *dh;
+     BIO *bio;
+ 
+     if ((bio = BIO_new_file(file, "r")) == NULL)
+         return NULL;
+     dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
+     BIO_free(bio);
+-    return (dh);
++
++    return dh;
++}
++#else
++EVP_PKEY *modssl_dh_pkey_from_file(const char *file)
++{
++    EVP_PKEY *pkey;
++    BIO *bio;
++
++    if ((bio = BIO_new_file(file, "r")) == NULL)
++        return NULL;
++    pkey = PEM_read_bio_Parameters(bio, NULL);
++    BIO_free(bio);
++
++    return pkey;
+ }
++#endif
+ 
+ #ifdef HAVE_ECC
+-EC_GROUP *ssl_ec_GetParamFromFile(const char *file)
++EC_GROUP *modssl_ec_group_from_file(const char *file)
+ {
+-    EC_GROUP *group = NULL;
++    EC_GROUP *group;
+     BIO *bio;
+ 
+     if ((bio = BIO_new_file(file, "r")) == NULL)
+         return NULL;
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+     group = PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL);
++#else
++    group = PEM_ASN1_read_bio((void *)d2i_ECPKParameters,
++                              PEM_STRING_ECPARAMETERS, bio,
++                              NULL, NULL, NULL);
++#endif
+     BIO_free(bio);
+-    return (group);
++
++    return group;
+ }
+ #endif
+ 
+--- httpd-2.4.58/modules/ssl/ssl_util_stapling.c.r1913912
++++ httpd-2.4.58/modules/ssl/ssl_util_stapling.c
+@@ -29,9 +29,9 @@
+                                             -- Alexei Sayle          */
+ 
+ #include "ssl_private.h"
++
+ #include "ap_mpm.h"
+ #include "apr_thread_mutex.h"
+-#include "mod_ssl_openssl.h"
+ 
+ APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, init_stapling_status,
+                                     (server_rec *s, apr_pool_t *p, 
+--- httpd-2.4.58/support/ab.c.r1913912
++++ httpd-2.4.58/support/ab.c
+@@ -166,13 +166,18 @@
+ 
+ #if defined(HAVE_OPENSSL)
+ 
+-#include <openssl/rsa.h>
++#include <openssl/evp.h>
+ #include <openssl/crypto.h>
+ #include <openssl/x509.h>
+ #include <openssl/pem.h>
+ #include <openssl/err.h>
+ #include <openssl/ssl.h>
+ #include <openssl/rand.h>
++#include <openssl/opensslv.h>
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#include <openssl/core_names.h>
++#endif
++
+ #define USE_SSL
+ 
+ #define SK_NUM(x) sk_X509_num(x)
+@@ -555,22 +560,33 @@
+  *
+  */
+ #ifdef USE_SSL
+-static long ssl_print_cb(BIO *bio,int cmd,const char *argp,int argi,long argl,long ret)
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++static long ssl_print_cb(BIO *bio, int cmd, const char *argp,
++                         size_t len, int argi, long argl, int ret,
++                         size_t *processed)
++#else
++static long ssl_print_cb(BIO *bio, int cmd, const char *argp,
++                         int argi, long argl, long ret)
++#endif
+ {
+     BIO *out;
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++    (void)len;
++    (void)processed;
++#endif
+ 
+     out=(BIO *)BIO_get_callback_arg(bio);
+     if (out == NULL) return(ret);
+ 
+     if (cmd == (BIO_CB_READ|BIO_CB_RETURN)) {
+         BIO_printf(out,"read from %p [%p] (%d bytes => %ld (0x%lX))\n",
+-                   bio, argp, argi, ret, ret);
++                   bio, argp, argi, (long)ret, (long)ret);
+         BIO_dump(out,(char *)argp,(int)ret);
+         return(ret);
+     }
+     else if (cmd == (BIO_CB_WRITE|BIO_CB_RETURN)) {
+         BIO_printf(out,"write to %p [%p] (%d bytes => %ld (0x%lX))\n",
+-                   bio, argp, argi, ret, ret);
++                   bio, argp, argi, (long)ret, (long)ret);
+         BIO_dump(out,(char *)argp,(int)ret);
+     }
+     return ret;
+@@ -765,17 +781,29 @@
+                         break;
+ #ifndef OPENSSL_NO_EC
+                     case EVP_PKEY_EC: {
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++                        size_t len;
++                        char cname[80];
++                        if (!EVP_PKEY_get_utf8_string_param(key, OSSL_PKEY_PARAM_GROUP_NAME,
++                                                            cname, sizeof(cname), &len)) {
++                            cname[0] = '?';
++                            len = 1;
++                        }
++                        cname[len] = '\0';
++#else
+                         const char *cname = NULL;
+                         EC_KEY *ec = EVP_PKEY_get1_EC_KEY(key);
+                         int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
+                         EC_KEY_free(ec);
+                         cname = EC_curve_nid2nist(nid);
+-                        if (!cname)
++                        if (!cname) {
+                             cname = OBJ_nid2sn(nid);
+-
++                            if (!cname)
++                                cname = "?";
++                        }
++#endif
+                         apr_snprintf(ssl_tmp_key, 128, "ECDH %s %d bits",
+-                                     cname,
+-                                     EVP_PKEY_bits(key));
++                                     cname, EVP_PKEY_bits(key));
+                         break;
+                         }
+ #endif
+@@ -1428,7 +1456,11 @@
+         SSL_set_bio(c->ssl, bio, bio);
+         SSL_set_connect_state(c->ssl);
+         if (verbosity >= 4) {
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++            BIO_set_callback_ex(bio, ssl_print_cb);
++#else
+             BIO_set_callback(bio, ssl_print_cb);
++#endif
+             BIO_set_callback_arg(bio, (void *)bio_err);
+         }
+ #ifdef HAVE_TLSEXT
diff --git a/httpd-2.4.58-r1914365.patch b/httpd-2.4.58-r1914365.patch
new file mode 100644
index 0000000..e7390eb
--- /dev/null
+++ b/httpd-2.4.58-r1914365.patch
@@ -0,0 +1,219 @@
+# ./pullrev.sh 1914365
+http://svn.apache.org/viewvc?view=revision&revision=1914365
+
+--- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1914365
++++ httpd-2.4.58/modules/ssl/ssl_engine_init.c
+@@ -1421,8 +1421,10 @@
+             if (cert) {
+                 if (SSL_CTX_use_certificate(mctx->ssl_ctx, cert) < 1) {
+                     ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10137)
+-                                 "Failed to configure engine certificate %s, check %s",
+-                                 key_id, certfile);
++                                 "Failed to configure certificate %s from %s, check %s",
++                                 key_id, mc->szCryptoDevice ?
++                                             mc->szCryptoDevice : "provider",
++                                 certfile);
+                     ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
+                     return APR_EGENERAL;
+                 }
+@@ -1433,8 +1435,9 @@
+             
+             if (SSL_CTX_use_PrivateKey(mctx->ssl_ctx, pkey) < 1) {
+                 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10130)
+-                             "Failed to configure private key %s from engine",
+-                             keyfile);
++                             "Failed to configure private key %s from %s",
++                             keyfile, mc->szCryptoDevice ?
++                                          mc->szCryptoDevice : "provider");
+                 ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
+                 return APR_EGENERAL;
+             }
+--- httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c.r1914365
++++ httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c
+@@ -31,6 +31,9 @@
+ #include "ssl_private.h"
+ 
+ #include <openssl/ui.h>
++#if MODSSL_HAVE_OPENSSL_STORE
++#include <openssl/store.h>
++#endif
+ 
+ typedef struct {
+     server_rec         *s;
+@@ -608,7 +611,7 @@
+     return (len);
+ }
+ 
+-#if MODSSL_HAVE_ENGINE_API
++#if MODSSL_HAVE_ENGINE_API || MODSSL_HAVE_OPENSSL_STORE
+ 
+ /* OpenSSL UI implementation for passphrase entry; largely duplicated
+  * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be
+@@ -826,13 +829,14 @@
+ }
+ #endif
+ 
+-
+-apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
++#if MODSSL_HAVE_ENGINE_API
++static apr_status_t modssl_load_keypair_engine(server_rec *s, apr_pool_t *p,
+                                         const char *vhostid,
+-                                        const char *certid, const char *keyid,
+-                                        X509 **pubkey, EVP_PKEY **privkey)
++                                               const char *certid,
++                                               const char *keyid,
++                                               X509 **pubkey,
++                                               EVP_PKEY **privkey)
+ {
+-#if MODSSL_HAVE_ENGINE_API
+     const char *c, *scheme;
+     ENGINE *e;
+     UI_METHOD *ui_method = get_passphrase_ui(p);
+@@ -906,6 +910,118 @@
+     ENGINE_free(e);
+ 
+     return APR_SUCCESS;
++}
++#endif
++
++#if MODSSL_HAVE_OPENSSL_STORE
++static OSSL_STORE_INFO *modssl_load_store_uri(server_rec *s, apr_pool_t *p,
++                                              const char *vhostid,
++                                              const char *uri, int info_type)
++{
++    OSSL_STORE_CTX *sctx;
++    UI_METHOD *ui_method = get_passphrase_ui(p);
++    pphrase_cb_arg_t ppcb;
++    OSSL_STORE_INFO *info = NULL;
++
++    memset(&ppcb, 0, sizeof ppcb);
++    ppcb.s = s;
++    ppcb.p = p;
++    ppcb.bPassPhraseDialogOnce = TRUE;
++    ppcb.key_id = vhostid;
++    ppcb.pkey_file = uri;
++
++    sctx = OSSL_STORE_open(uri, ui_method, &ppcb, NULL, NULL);
++    if (!sctx) {
++        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(10491)
++                     "Init: OSSL_STORE_open failed for PKCS#11 URI `%s'",
++                     uri);
++        return NULL;
++    }
++
++    while (!OSSL_STORE_eof(sctx)) {
++        info = OSSL_STORE_load(sctx);
++        if (!info)
++            break;
++
++        if (OSSL_STORE_INFO_get_type(info) == info_type)
++            break;
++
++        OSSL_STORE_INFO_free(info);
++        info = NULL;
++    }
++
++    OSSL_STORE_close(sctx);
++
++    return info;
++}
++
++static apr_status_t modssl_load_keypair_store(server_rec *s, apr_pool_t *p,
++                                              const char *vhostid,
++                                              const char *certid,
++                                              const char *keyid,
++                                              X509 **pubkey,
++                                              EVP_PKEY **privkey)
++{
++    OSSL_STORE_INFO *info = NULL;
++
++    *privkey = NULL;
++    *pubkey = NULL;
++
++    info = modssl_load_store_uri(s, p, vhostid, keyid, OSSL_STORE_INFO_PKEY);
++    if (!info) {
++        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10492)
++                     "Init: OSSL_STORE_INFO_PKEY lookup failed for private key identifier `%s'",
++                     keyid);
++        return ssl_die(s);
++    }
++
++    *privkey = OSSL_STORE_INFO_get1_PKEY(info);
++    OSSL_STORE_INFO_free(info);
++    if (!*privkey) {
++        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10493)
++                     "Init: OSSL_STORE_INFO_PKEY lookup failed for private key identifier `%s'",
++                     keyid);
++        return ssl_die(s);
++    }
++
++    if (certid) {
++        info = modssl_load_store_uri(s, p, vhostid, certid, OSSL_STORE_INFO_CERT);
++        if (!info) {
++            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10494)
++                         "Init: OSSL_STORE_INFO_CERT lookup failed for certificate identifier `%s'",
++                         keyid);
++            return ssl_die(s);
++        }
++
++        *pubkey = OSSL_STORE_INFO_get1_CERT(info);
++        OSSL_STORE_INFO_free(info);
++        if (!*pubkey) {
++            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10495)
++                     "Init: OSSL_STORE_INFO_CERT lookup failed for certificate identifier `%s'",
++                     certid);
++            return ssl_die(s);
++        }
++    }
++
++    return APR_SUCCESS;
++}
++#endif
++
++apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
++                                        const char *vhostid,
++                                        const char *certid, const char *keyid,
++                                        X509 **pubkey, EVP_PKEY **privkey)
++{
++#if MODSSL_HAVE_OPENSSL_STORE
++    SSLModConfigRec *mc = myModConfig(s);
++
++    if (!mc->szCryptoDevice)
++        return modssl_load_keypair_store(s, p, vhostid, certid, keyid,
++                                         pubkey, privkey);
++#endif
++#if MODSSL_HAVE_ENGINE_API
++    return modssl_load_keypair_engine(s, p, vhostid, certid, keyid,
++                                      pubkey, privkey);
+ #else
+     return APR_ENOTIMPL;
+ #endif
+--- httpd-2.4.58/modules/ssl/ssl_private.h.r1914365
++++ httpd-2.4.58/modules/ssl/ssl_private.h
+@@ -118,6 +118,15 @@
+ #define MODSSL_HAVE_ENGINE_API 0
+ #endif
+ 
++/* Use OpenSSL 3.x STORE for loading URI keys and certificates starting with
++ * OpenSSL 3.0
++ */
++#if OPENSSL_VERSION_NUMBER >= 0x30000000
++#define MODSSL_HAVE_OPENSSL_STORE 1
++#else
++#define MODSSL_HAVE_OPENSSL_STORE 0
++#endif
++
+ #if (OPENSSL_VERSION_NUMBER < 0x0090801f)
+ #error mod_ssl requires OpenSSL 0.9.8a or later
+ #endif
+--- httpd-2.4.58/modules/ssl/ssl_util.c.r1914365
++++ httpd-2.4.58/modules/ssl/ssl_util.c
+@@ -476,7 +476,7 @@
+ 
+ int modssl_is_engine_id(const char *name)
+ {
+-#if MODSSL_HAVE_ENGINE_API
++#if MODSSL_HAVE_ENGINE_API || MODSSL_HAVE_OPENSSL_STORE
+     /* ### Can handle any other special ENGINE key names here? */
+     return strncmp(name, "pkcs11:", 7) == 0;
+ #else
diff --git a/httpd.spec b/httpd.spec
index f593ac4..8bd81c5 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.58
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -97,6 +97,8 @@ Patch42: httpd-2.4.48-r1828172+.patch
 Patch45: httpd-2.4.43-logjournal.patch
 Patch46: httpd-2.4.53-separate-systemd-fns.patch
 Patch47: httpd-2.4.58-r1912477+.patch
+Patch48: httpd-2.4.58-r1913912+.patch
+Patch49: httpd-2.4.58-r1914365.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -274,6 +276,8 @@ written in the Lua programming language.
 %patch -P46 -p1 -b .separatesystemd
 %patch -P25 -p1 -b .selinux
 %patch -P47 -p1 -b .r1912477+
+%patch -P48 -p1 -b .r1913912
+%patch -P49 -p1 -b .r1914365
 
 %patch -P60 -p1 -b .enable-sslv3
 %patch -P61 -p1 -b .r1914013
@@ -863,6 +867,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jan  5 2024 Joe Orton <jorton@redhat.com> - 2.4.58-4
+- fix OpenSSL 3.0 deprecation warnings (r1913912, r1915067)
+- mod_ssl: move to provider API for pkcs11 support (#2253014)
+
 * Fri Dec  8 2023 Joe Orton <jorton@redhat.com> - 2.4.58-3
 - mod_dav_fs: add DAVLockDBType, use global lock around lockdb
 - fix build with libxml2 2.12
diff --git a/pullrev.sh b/pullrev.sh
index 703d376..7ace161 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -6,7 +6,7 @@ if [ $# -lt 1 ]; then
 fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
-#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
 ver=2.4.58
 prefix="httpd-${ver}"
 suffix="${SUFFIX:-r$1${2:++}}"
@@ -43,7 +43,9 @@ for r in $*; do
         http*) curl -s "$r" | filterdiff --strip=3 ;;
         *) svn diff -c ${r} ${repo}  ;;
     esac | filterdiff --remove-timestamps --clean \
-                      -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' -x 'changes-entries/*' \
+                      -x 'CHANGES' -x 'changes-entries/*.txt' \
+                      -x '*/next-number' -x 'STATUS' -x '*.xml' \
+                      -x '.github/*' \
                       --addprefix="${prefix}/" > ${this}
     next=`mktemp /tmp/pullrevXXXXXX`
     if ! combinediff -w ${prev} ${this} > ${next}; then

From fcc34b87be47c9a4d2931865ae235a7fe6743dbe Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 5 Jan 2024 11:55:23 +0000
Subject: [PATCH 311/359] Fix suffix.

---
 httpd.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 8bd81c5..dc3b6e9 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -276,7 +276,7 @@ written in the Lua programming language.
 %patch -P46 -p1 -b .separatesystemd
 %patch -P25 -p1 -b .selinux
 %patch -P47 -p1 -b .r1912477+
-%patch -P48 -p1 -b .r1913912
+%patch -P48 -p1 -b .r1913912+
 %patch -P49 -p1 -b .r1914365
 
 %patch -P60 -p1 -b .enable-sslv3

From ab864817dceb5ee4d715e71a70f8892ea6c53a17 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 5 Jan 2024 16:21:21 +0000
Subject: [PATCH 312/359] - renumber patches to apply in numerical order - use
 %autosetup

---
 httpd.spec | 70 ++++++++++++++++--------------------------------------
 1 file changed, 21 insertions(+), 49 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index dc3b6e9..2c71c87 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -81,31 +81,31 @@ Patch3: httpd-2.4.43-deplibs.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.53-detect-systemd.patch
 # Features/functional changes
-Patch21: httpd-2.4.48-r1842929+.patch
-Patch22: httpd-2.4.43-mod_systemd.patch
-Patch23: httpd-2.4.53-export.patch
-Patch24: httpd-2.4.43-corelimit.patch
-Patch25: httpd-2.4.54-selinux.patch
-Patch26: httpd-2.4.54-gettid.patch
-Patch27: httpd-2.4.54-icons.patch
-Patch30: httpd-2.4.43-cachehardmax.patch
-Patch34: httpd-2.4.43-socket-activation.patch
-Patch38: httpd-2.4.43-sslciphdefault.patch
-Patch39: httpd-2.4.43-sslprotdefault.patch
-Patch41: httpd-2.4.43-r1861793+.patch
-Patch42: httpd-2.4.48-r1828172+.patch
-Patch45: httpd-2.4.43-logjournal.patch
-Patch46: httpd-2.4.53-separate-systemd-fns.patch
-Patch47: httpd-2.4.58-r1912477+.patch
-Patch48: httpd-2.4.58-r1913912+.patch
-Patch49: httpd-2.4.58-r1914365.patch
+Patch20: httpd-2.4.48-r1842929+.patch
+Patch21: httpd-2.4.43-mod_systemd.patch
+Patch22: httpd-2.4.53-export.patch
+Patch23: httpd-2.4.43-corelimit.patch
+Patch24: httpd-2.4.54-gettid.patch
+Patch25: httpd-2.4.54-icons.patch
+Patch26: httpd-2.4.43-cachehardmax.patch
+Patch27: httpd-2.4.43-socket-activation.patch
+Patch28: httpd-2.4.43-sslciphdefault.patch
+Patch29: httpd-2.4.43-sslprotdefault.patch
+Patch30: httpd-2.4.43-r1861793+.patch
+Patch31: httpd-2.4.48-r1828172+.patch
+Patch32: httpd-2.4.43-logjournal.patch
+Patch33: httpd-2.4.53-separate-systemd-fns.patch
+Patch34: httpd-2.4.58-r1912477+.patch
+Patch35: httpd-2.4.58-r1913912+.patch
+Patch36: httpd-2.4.58-r1914365.patch
+Patch37: httpd-2.4.54-selinux.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
 Patch61: httpd-2.4.58-r1914013.patch
-Patch63: httpd-2.4.46-htcacheclean-dont-break.patch
-Patch65: httpd-2.4.51-r1894152.patch
+Patch62: httpd-2.4.46-htcacheclean-dont-break.patch
+Patch63: httpd-2.4.51-r1894152.patch
 
 # Security fixes
 # Patch200: ...
@@ -254,35 +254,7 @@ written in the Lua programming language.
 
 %prep
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
-%setup -q
-%patch -P2 -p1 -b .apxs
-%patch -P3 -p1 -b .deplibs
-
-%patch -P19 -p1 -b .detectsystemd
-
-%patch -P21 -p1 -b .r1842929+
-%patch -P22 -p1 -b .mod_systemd
-%patch -P23 -p1 -b .export
-%patch -P24 -p1 -b .corelimit
-%patch -P26 -p1 -b .gettid
-%patch -P27 -p1 -b .icons
-%patch -P30 -p1 -b .cachehardmax
-%patch -P34 -p1 -b .socketactivation
-%patch -P38 -p1 -b .sslciphdefault
-%patch -P39 -p1 -b .sslprotdefault
-%patch -P41 -p1 -b .r1861793+
-%patch -P42 -p1 -b .r1828172+
-%patch -P45 -p1 -b .logjournal
-%patch -P46 -p1 -b .separatesystemd
-%patch -P25 -p1 -b .selinux
-%patch -P47 -p1 -b .r1912477+
-%patch -P48 -p1 -b .r1913912+
-%patch -P49 -p1 -b .r1914365
-
-%patch -P60 -p1 -b .enable-sslv3
-%patch -P61 -p1 -b .r1914013
-%patch -P63 -p1 -b .htcacheclean-dont-break
-%patch -P65 -p1 -b .r1894152
+%autosetup -p1 -S gendiff
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h

From df3d3d1151513090e3ba649f03bdaa6817d87c5e Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 5 Jan 2024 16:21:32 +0000
Subject: [PATCH 313/359] - remove some old workarounds

---
 httpd.spec | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 2c71c87..a34b641 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -318,16 +318,6 @@ autoheader && autoconf || exit 1
 
 %set_build_flags
 
-# Hard-code path to links to avoid unnecessary builddep
-export LYNX_PATH=/usr/bin/links
-
-%ifarch aarch64
-# The configure check for epoll_create() is failing. httpd/apr only
-# actually uses epoll_create1() so this test could be smarter. Work
-# around it for now.
-export ac_cv_func_epoll_create=yes
-%endif
-
 # Build the daemon
 ./configure \
         --prefix=%{_sysconfdir}/httpd \

From 9e93ea3734c71f5ca0d57b5a1a2bea873d0408e5 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 20 Jan 2024 22:15:08 +0000
Subject: [PATCH 314/359] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index a34b641..396594c 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.58
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -829,6 +829,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.58-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
 * Fri Jan  5 2024 Joe Orton <jorton@redhat.com> - 2.4.58-4
 - fix OpenSSL 3.0 deprecation warnings (r1913912, r1915067)
 - mod_ssl: move to provider API for pkcs11 support (#2253014)

From 7fa757742fa45e9f48ffb6c6d7d53bd18dfdf521 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 24 Jan 2024 21:49:39 +0000
Subject: [PATCH 315/359] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 396594c..3b40eed 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.58
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -829,6 +829,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.58-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
 * Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.58-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 

From 756bc47b6f56edcff7e1408b0fac760177276a7e Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 7 Mar 2024 11:55:21 +0000
Subject: [PATCH 316/359] Add upstream tracking notes for patches.

---
 httpd-2.4.43-apxs.patch                    | 3 +++
 httpd-2.4.43-corelimit.patch               | 3 +++
 httpd-2.4.43-r1861793+.patch               | 5 +++--
 httpd-2.4.46-htcacheclean-dont-break.patch | 3 +++
 httpd-2.4.48-r1828172+.patch               | 2 ++
 httpd-2.4.48-r1842929+.patch               | 3 +++
 httpd-2.4.51-r1894152.patch                | 2 ++
 httpd-2.4.54-gettid.patch                  | 3 +++
 httpd-2.4.58-r1912477+.patch               | 2 ++
 httpd-2.4.58-r1913912+.patch               | 2 ++
 httpd-2.4.58-r1914013.patch                | 2 ++
 httpd-2.4.58-r1914365.patch                | 2 ++
 12 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/httpd-2.4.43-apxs.patch b/httpd-2.4.43-apxs.patch
index b1185b2..808d6a8 100644
--- a/httpd-2.4.43-apxs.patch
+++ b/httpd-2.4.43-apxs.patch
@@ -1,3 +1,6 @@
+
+Upstream-Status: local customisation
+
 diff --git a/support/apxs.in b/support/apxs.in
 index b2705fa..c331631 100644
 --- a/support/apxs.in
diff --git a/httpd-2.4.43-corelimit.patch b/httpd-2.4.43-corelimit.patch
index dd4b874..8c9899c 100644
--- a/httpd-2.4.43-corelimit.patch
+++ b/httpd-2.4.43-corelimit.patch
@@ -1,3 +1,6 @@
+
+Upstream-Status: local customisation
+
 diff --git a/server/core.c b/server/core.c
 index 79b2a82..dc0f17a 100644
 --- a/server/core.c
diff --git a/httpd-2.4.43-r1861793+.patch b/httpd-2.4.43-r1861793+.patch
index 08e96cb..89d0328 100644
--- a/httpd-2.4.43-r1861793+.patch
+++ b/httpd-2.4.43-r1861793+.patch
@@ -1,5 +1,6 @@
-diff --git a/configure.in b/configure.in
-index cb43246..0bb6b0d 100644
+
+Upstream-Status: proposed for 2.4.59
+
 --- httpd-2.4.43/configure.in.r1861793+
 +++ httpd-2.4.43/configure.in
 @@ -465,6 +465,28 @@
diff --git a/httpd-2.4.46-htcacheclean-dont-break.patch b/httpd-2.4.46-htcacheclean-dont-break.patch
index e52318a..919e9e3 100644
--- a/httpd-2.4.46-htcacheclean-dont-break.patch
+++ b/httpd-2.4.46-htcacheclean-dont-break.patch
@@ -1,3 +1,6 @@
+
+Upstream-Status: r1915508, proposed for 2.4.59
+
 diff --git a/support/htcacheclean.c b/support/htcacheclean.c
 index 958ba6d..0a7fe3c 100644
 --- a/support/htcacheclean.c
diff --git a/httpd-2.4.48-r1828172+.patch b/httpd-2.4.48-r1828172+.patch
index 37f1855..5f3be4c 100644
--- a/httpd-2.4.48-r1828172+.patch
+++ b/httpd-2.4.48-r1828172+.patch
@@ -1,6 +1,8 @@
 
 https://github.com/apache/httpd/pull/209
 
+Upstream-Status: in trunk, not proposed for 2.4.x
+
 diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h
 new file mode 100644
 index 0000000000..69df73ce68
diff --git a/httpd-2.4.48-r1842929+.patch b/httpd-2.4.48-r1842929+.patch
index f83a21d..c1837e7 100644
--- a/httpd-2.4.48-r1842929+.patch
+++ b/httpd-2.4.48-r1842929+.patch
@@ -1,3 +1,6 @@
+
+Upstream-Status: in trunk, not proposed for 2.4.x
+
 diff --git a/Makefile.in b/Makefile.in
 index 6747aea..40c7076 100644
 --- a/Makefile.in
diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch
index 95f5081..10c4b3f 100644
--- a/httpd-2.4.51-r1894152.patch
+++ b/httpd-2.4.51-r1894152.patch
@@ -1,6 +1,8 @@
 # ./pullrev.sh 1894152
 http://svn.apache.org/viewvc?view=revision&revision=1894152
 
+Upstream-Status: in trunk, not proposed for 2.4.x
+
 --- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152
 +++ httpd-2.4.51/modules/filters/mod_deflate.c
 @@ -835,6 +835,7 @@
diff --git a/httpd-2.4.54-gettid.patch b/httpd-2.4.54-gettid.patch
index dfc447b..88c956d 100644
--- a/httpd-2.4.54-gettid.patch
+++ b/httpd-2.4.54-gettid.patch
@@ -1,3 +1,6 @@
+
+Upstream-Status: everything but last hunk merged for 2.4.59
+
 From d4e5b6e1e5585d341d1e51f1ddc637c099111076 Mon Sep 17 00:00:00 2001
 From: Joe Orton <jorton@redhat.com>
 Date: Tue, 7 Jul 2020 09:48:01 +0100
diff --git a/httpd-2.4.58-r1912477+.patch b/httpd-2.4.58-r1912477+.patch
index 6458df8..eb3deff 100644
--- a/httpd-2.4.58-r1912477+.patch
+++ b/httpd-2.4.58-r1912477+.patch
@@ -5,6 +5,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1912718
 http://svn.apache.org/viewvc?view=revision&revision=1913654
 http://svn.apache.org/viewvc?view=revision&revision=1914438
 
+Upstream-Status: in trunk, not proposed for 2.4.x
+
 --- httpd-2.4.58/modules/dav/fs/config6.m4.r1912477+
 +++ httpd-2.4.58/modules/dav/fs/config6.m4
 @@ -20,4 +20,10 @@
diff --git a/httpd-2.4.58-r1913912+.patch b/httpd-2.4.58-r1913912+.patch
index c8ea8fa..f8fd4a4 100644
--- a/httpd-2.4.58-r1913912+.patch
+++ b/httpd-2.4.58-r1913912+.patch
@@ -3,6 +3,8 @@
 http://svn.apache.org/viewvc?view=revision&revision=1913912
 http://svn.apache.org/viewvc?view=revision&revision=1915067
 
+Upstream-Status: merged for 2.4.59
+
 --- httpd-2.4.58/modules/ssl/mod_ssl.c.r1913912
 +++ httpd-2.4.58/modules/ssl/mod_ssl.c
 @@ -25,8 +25,7 @@
diff --git a/httpd-2.4.58-r1914013.patch b/httpd-2.4.58-r1914013.patch
index f9e0786..02dcac3 100644
--- a/httpd-2.4.58-r1914013.patch
+++ b/httpd-2.4.58-r1914013.patch
@@ -1,6 +1,8 @@
 # ./pullrev.sh 1914013
 http://svn.apache.org/viewvc?view=revision&revision=1914013
 
+Upstream-Status: merged for 2.4.59
+
 --- httpd-2.4.58/modules/filters/mod_xml2enc.c
 +++ httpd-2.4.58/modules/filters/mod_xml2enc.c
 @@ -209,7 +209,7 @@
diff --git a/httpd-2.4.58-r1914365.patch b/httpd-2.4.58-r1914365.patch
index e7390eb..8512de3 100644
--- a/httpd-2.4.58-r1914365.patch
+++ b/httpd-2.4.58-r1914365.patch
@@ -1,6 +1,8 @@
 # ./pullrev.sh 1914365
 http://svn.apache.org/viewvc?view=revision&revision=1914365
 
+Upstream-Status: in trunk, not proposed for 2.4.x
+
 --- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1914365
 +++ httpd-2.4.58/modules/ssl/ssl_engine_init.c
 @@ -1421,8 +1421,10 @@

From dee54cd734ac9fb909a122b141005210c218dbfd Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 7 Mar 2024 13:04:06 +0000
Subject: [PATCH 317/359] - Updated Systemd security settings (closes #3)
 (Rahul Sundaram) - updated httpd.service(5) man page (Joe Orton)

---
 httpd.service     | 19 ++++++++++++++++++-
 httpd.service.xml | 24 +++++++++++++++++-------
 httpd.spec        |  6 +++++-
 httpd@.service    | 19 ++++++++++++++++++-
 4 files changed, 58 insertions(+), 10 deletions(-)

diff --git a/httpd.service b/httpd.service
index c5b5e08..b75e28c 100644
--- a/httpd.service
+++ b/httpd.service
@@ -26,8 +26,25 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful
 # Send SIGWINCH for graceful stop
 KillSignal=SIGWINCH
 KillMode=mixed
-PrivateTmp=true
+DevicePolicy=closed
+KeyringMode=private
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
 OOMPolicy=continue
+PrivateDevices=yes
+PrivateTmp=true
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=read-only
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectSystem=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
 
 [Install]
 WantedBy=multi-user.target
diff --git a/httpd.service.xml b/httpd.service.xml
index 7dfdb97..3ddbc9e 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -231,7 +231,16 @@ Wants=network-online.target</programlisting>
     <refsect2>
       <title>Process policies and restrictions</title>
 
-      <para>The httpd service uses the following options:
+      <para>The <command>httpd.service</command> unit enables a
+      variety of sandboxing options. Many of these prevent the service
+      from changing the system configuration - such as
+      <emphasis>ProtectClock</emphasis> and
+      <emphasis>ProtectKernelModules</emphasis>. See
+      <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      and
+      <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      for more information on these options. Particular notice should
+      be taken of the following:
 
       <itemizedlist>
         <listitem><para><emphasis>PrivateTmp</emphasis> is enabled by
@@ -247,13 +256,14 @@ Wants=network-online.target</programlisting>
         the policy to <emphasis>continue</emphasis>, httpd will
         continue to run (and recover) if a single child is terminated
         because of excess memory consumption.</para></listitem>
-      </itemizedlist>
 
-      See
-      <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-      and
-      <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-      for more information.</para>
+        <listitem><para><emphasis>ProtectHome</emphasis> is set to
+        <emphasis>read-only</emphasis> by default. CGI scripts run via
+        <emphasis>UserDir</emphasis> will not be able modify any
+        content in <filename>/home</filename> by
+        default.</para></listitem>
+      </itemizedlist></para>
+
     </refsect2>
 
     <refsect2>
diff --git a/httpd.spec b/httpd.spec
index 3b40eed..b2ea95b 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.58
-Release: 6%{?dist}
+Release: 7%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -829,6 +829,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Jan 15 2024 Rahul Sundaram <sundaram@fedoraproject.org> - 2.4.58-7
+- Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening
+- updated httpd.service(5) (Joe Orton)
+
 * Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.58-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 
diff --git a/httpd@.service b/httpd@.service
index 84424fb..8b20b90 100644
--- a/httpd@.service
+++ b/httpd@.service
@@ -19,8 +19,25 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful -f conf/%i.conf
 # Send SIGWINCH for graceful stop
 KillSignal=SIGWINCH
 KillMode=mixed
-PrivateTmp=true
+DevicePolicy=closed
+KeyringMode=private
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
 OOMPolicy=continue
+PrivateDevices=yes
+PrivateTmp=true
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=read-only
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectSystem=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
 
 [Install]
 WantedBy=multi-user.target

From 264f63b024fd9a66004460be7ea80195c27cc33f Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 7 Mar 2024 17:02:24 +0000
Subject: [PATCH 318/359] - ignore source file changes in rpminspect's
 "upstream" module

---
 rpminspect.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/rpminspect.yaml b/rpminspect.yaml
index 1b4f2fe..17e48d1 100644
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@@ -4,3 +4,18 @@ badfuncs:
   # and APR interfaces for IPv6 addresses.
   ignore:
     - /usr/lib*/httpd/modules/mod_proxy.so
+upstream:
+  ignore:
+    - *.xml
+    - *.service
+    - *.socket
+    - *.conf
+    - *.sysconf
+    - *.tmpfiles
+    - README.*
+    - *.sysusers
+    - *.png
+    - httpd-ssl-*
+    - config.layout
+    - action*.sh
+    - apachectl.*

From 5096106709c71826233d39ae724535d5795c6485 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 28 Mar 2024 12:42:59 +0000
Subject: [PATCH 319/359] Add gating configuration.

---
 gating.yaml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/gating.yaml b/gating.yaml
index e4c04e7..fb11fa9 100644
--- a/gating.yaml
+++ b/gating.yaml
@@ -14,3 +14,14 @@ decision_contexts: [bodhi_update_push_stable]
 subject_type: koji_build
 rules:
   - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
+
+#gating rhel
+--- !Policy
+product_versions:
+  - rhel-*
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}
+  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier2.functional}
+  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier3.functional}
+  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional}

From 27131dea8da568264571886f93bc0f30ff455eb3 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 28 Mar 2024 14:23:51 +0000
Subject: [PATCH 320/359] Update tracking.

---
 httpd-2.4.51-r1894152.patch | 2 +-
 httpd-2.4.54-selinux.patch  | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch
index 10c4b3f..20e6784 100644
--- a/httpd-2.4.51-r1894152.patch
+++ b/httpd-2.4.51-r1894152.patch
@@ -1,7 +1,7 @@
 # ./pullrev.sh 1894152
 http://svn.apache.org/viewvc?view=revision&revision=1894152
 
-Upstream-Status: in trunk, not proposed for 2.4.x
+Upstream-Status: merged for 2.4.59
 
 --- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152
 +++ httpd-2.4.51/modules/filters/mod_deflate.c
diff --git a/httpd-2.4.54-selinux.patch b/httpd-2.4.54-selinux.patch
index 4d66bd8..661b983 100644
--- a/httpd-2.4.54-selinux.patch
+++ b/httpd-2.4.54-selinux.patch
@@ -1,3 +1,6 @@
+
+Upstream-Status: in trunk not in 2.4.x
+
 diff --git a/configure.in b/configure.in
 index 74015ca..8c0ee10 100644
 --- httpd-2.4.54/modules/arch/unix/config5.m4.selinux

From 2ce898b07d9c7824441c032793f3dc1ed473088d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 28 Mar 2024 14:23:56 +0000
Subject: [PATCH 321/359] rebuild to fix changelog ordering

---
 httpd.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index b2ea95b..1bd5e95 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.58
-Release: 7%{?dist}
+Release: 8%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -829,7 +829,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Mon Jan 15 2024 Rahul Sundaram <sundaram@fedoraproject.org> - 2.4.58-7
+* Thu Mar 28 2024 Joe Orton <jorton@redhat.com> - 2.4.58-8
+- rebuild to fix changelog ordering
+
+* Mon Feb 15 2024 Rahul Sundaram <sundaram@fedoraproject.org> - 2.4.58-7
 - Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening
 - updated httpd.service(5) (Joe Orton)
 

From 1c126ced89f57ab99219139a2ccdd2f6d657927b Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 28 Mar 2024 14:25:42 +0000
Subject: [PATCH 322/359] really fix changelog ordering.

---
 httpd.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 1bd5e95..048057d 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -832,7 +832,7 @@ exit $rv
 * Thu Mar 28 2024 Joe Orton <jorton@redhat.com> - 2.4.58-8
 - rebuild to fix changelog ordering
 
-* Mon Feb 15 2024 Rahul Sundaram <sundaram@fedoraproject.org> - 2.4.58-7
+* Thu Mar 7 2024 Rahul Sundaram <sundaram@fedoraproject.org> - 2.4.58-7
 - Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening
 - updated httpd.service(5) (Joe Orton)
 

From 9ee4b1c3240908f7f663a0534198e600a4bc6cbc Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 5 Apr 2024 09:22:35 +0100
Subject: [PATCH 323/359] update to 2.4.59

---
 .gitignore                                    |   1 +
 httpd-2.4.43-r1861793+.patch                  | 272 ------
 httpd-2.4.46-htcacheclean-dont-break.patch    |  16 -
 httpd-2.4.51-r1894152.patch                   |  38 -
 httpd-2.4.54-gettid.patch                     |  94 --
 httpd-2.4.58-r1913912+.patch                  | 849 ------------------
 httpd-2.4.58-r1914013.patch                   |  16 -
 httpd-2.4.59-gettid.patch                     |  14 +
 ...172+.patch => httpd-2.4.59-unifycgid.patch | 292 +++---
 httpd.spec                                    |  16 +-
 sources                                       |   4 +-
 11 files changed, 168 insertions(+), 1444 deletions(-)
 delete mode 100644 httpd-2.4.43-r1861793+.patch
 delete mode 100644 httpd-2.4.46-htcacheclean-dont-break.patch
 delete mode 100644 httpd-2.4.51-r1894152.patch
 delete mode 100644 httpd-2.4.54-gettid.patch
 delete mode 100644 httpd-2.4.58-r1913912+.patch
 delete mode 100644 httpd-2.4.58-r1914013.patch
 create mode 100644 httpd-2.4.59-gettid.patch
 rename httpd-2.4.48-r1828172+.patch => httpd-2.4.59-unifycgid.patch (91%)

diff --git a/.gitignore b/.gitignore
index cc7babc..bdad39b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -49,3 +49,4 @@ x86_64
 /httpd-2.4.56.tar.bz2.asc
 /httpd-2.4.57.tar.bz2.asc
 /httpd-2.4.58.tar.bz2.asc
+/httpd-2.4.59.tar.bz2.asc
diff --git a/httpd-2.4.43-r1861793+.patch b/httpd-2.4.43-r1861793+.patch
deleted file mode 100644
index 89d0328..0000000
--- a/httpd-2.4.43-r1861793+.patch
+++ /dev/null
@@ -1,272 +0,0 @@
-
-Upstream-Status: proposed for 2.4.59
-
---- httpd-2.4.43/configure.in.r1861793+
-+++ httpd-2.4.43/configure.in
-@@ -465,6 +465,28 @@
- AC_SEARCH_LIBS(crypt, crypt)
- CRYPT_LIBS="$LIBS"
- APACHE_SUBST(CRYPT_LIBS)
-+
-+if test "$ac_cv_search_crypt" != "no"; then
-+   # Test crypt() with the SHA-512 test vector from https://akkadia.org/drepper/SHA-crypt.txt
-+   AC_CACHE_CHECK([whether crypt() supports SHA-2], [ap_cv_crypt_sha2], [
-+    AC_RUN_IFELSE([AC_LANG_PROGRAM([[
-+#include <crypt.h>
-+#include <stdlib.h>
-+#include <string.h>
-+
-+#define PASSWD_0 "Hello world!"
-+#define SALT_0 "\$6\$saltstring"
-+#define EXPECT_0 "\$6\$saltstring\$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjnQJu" \
-+               "esI68u4OTLiBFdcbYEdFCoEOfaS35inz1"
-+]], [char *result = crypt(PASSWD_0, SALT_0);
-+     if (!result) return 1;
-+     if (strcmp(result, EXPECT_0)) return 2;
-+])], [ap_cv_crypt_sha2=yes], [ap_cv_crypt_sha2=no])])
-+   if test "$ap_cv_crypt_sha2" = yes; then
-+     AC_DEFINE([HAVE_CRYPT_SHA2], 1, [Define if crypt() supports SHA-2 hashes])
-+   fi
-+fi
-+
- LIBS="$saved_LIBS"
- 
- dnl See Comment #Spoon
---- httpd-2.4.43/docs/man/htpasswd.1.r1861793+
-+++ httpd-2.4.43/docs/man/htpasswd.1
-@@ -27,16 +27,16 @@
- .SH "SYNOPSIS"
-  
- .PP
--\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR
-+\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR
-  
- .PP
--\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR
-+\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR
-  
- .PP
--\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR
-+\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR
-  
- .PP
--\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR
-+\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR
-  
- 
- .SH "SUMMARY"
-@@ -48,7 +48,7 @@
- Resources available from the Apache HTTP server can be restricted to just the users listed in the files created by \fBhtpasswd\fR\&. This program can only manage usernames and passwords stored in a flat-file\&. It can encrypt and display password information for use in other types of data stores, though\&. To use a DBM database see dbmmanage or htdbm\&.
-  
- .PP
--\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA1, or the system's \fBcrypt()\fR routine\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&.
-+\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA-1, or the system's \fBcrypt()\fR routine\&. SHA-2-based hashes (SHA-256 and SHA-512) are supported for \fBcrypt()\fR\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&.
-  
- .PP
- This manual page only lists the command line arguments\&. For details of the directives necessary to configure user authentication in httpd see the Apache manual, which is part of the Apache distribution or can be found at http://httpd\&.apache\&.org/\&.
-@@ -73,17 +73,26 @@
- \fB-m\fR
- Use MD5 encryption for passwords\&. This is the default (since version 2\&.2\&.18)\&.  
- .TP
-+\fB-2\fR
-+Use SHA-256 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&.  
-+.TP
-+\fB-5\fR
-+Use SHA-512 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&.  
-+.TP
- \fB-B\fR
- Use bcrypt encryption for passwords\&. This is currently considered to be very secure\&.  
- .TP
- \fB-C\fR
- This flag is only allowed in combination with \fB-B\fR (bcrypt encryption)\&. It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17)\&.  
- .TP
-+\fB-r\fR
-+This flag is only allowed in combination with \fB-2\fR or \fB-5\fR\&. It sets the number of hash rounds used for the SHA-2 algorithms (higher is more secure but slower; the default is 5,000)\&.  
-+.TP
- \fB-d\fR
- Use \fBcrypt()\fR encryption for passwords\&. This is not supported by the httpd server on Windows and Netware\&. This algorithm limits the password length to 8 characters\&. This algorithm is \fBinsecure\fR by today's standards\&. It used to be the default algorithm until version 2\&.2\&.17\&.  
- .TP
- \fB-s\fR
--Use SHA encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&.  
-+Use SHA-1 (160-bit) encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&.  
- .TP
- \fB-p\fR
- Use plaintext passwords\&. Though \fBhtpasswd\fR will support creation on all platforms, the httpd daemon will only accept plain text passwords on Windows and Netware\&.  
-@@ -152,10 +161,13 @@
- When using the \fBcrypt()\fR algorithm, note that only the first 8 characters of the password are used to form the password\&. If the supplied password is longer, the extra characters will be silently discarded\&.
-  
- .PP
--The SHA encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&.
-+The SHA-1 encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&.
-+ 
-+.PP
-+The SHA-1 and \fBcrypt()\fR formats are insecure by today's standards\&.
-  
- .PP
--The SHA and \fBcrypt()\fR formats are insecure by today's standards\&.
-+The SHA-2-based \fBcrypt()\fR formats (SHA-256 and SHA-512) are supported on most modern Unix systems, and follow the specification at https://www\&.akkadia\&.org/drepper/SHA-crypt\&.txt\&.
-  
- .SH "RESTRICTIONS"
-  
---- httpd-2.4.43/support/htpasswd.c.r1861793+
-+++ httpd-2.4.43/support/htpasswd.c
-@@ -109,17 +109,21 @@
-             "for it." NL
-         " -i  Read password from stdin without verification (for script usage)." NL
-         " -m  Force MD5 encryption of the password (default)." NL
--        " -B  Force bcrypt encryption of the password (very secure)." NL
-+        " -2  Force SHA-256 crypt() hash of the password (very secure)." NL
-+        " -5  Force SHA-512 crypt() hash of the password (very secure)." NL
-+        " -B  Force bcrypt encryption of the password (very secure)." NL
-         " -C  Set the computing time used for the bcrypt algorithm" NL
-         "     (higher is more secure but slower, default: %d, valid: 4 to 17)." NL
-+        " -r  Set the number of rounds used for the SHA-256, SHA-512 algorithms" NL
-+        "     (higher is more secure but slower, default: 5000)." NL
-         " -d  Force CRYPT encryption of the password (8 chars max, insecure)." NL
--        " -s  Force SHA encryption of the password (insecure)." NL
-+        " -s  Force SHA-1 encryption of the password (insecure)." NL
-         " -p  Do not encrypt the password (plaintext, insecure)." NL
-         " -D  Delete the specified user." NL
-         " -v  Verify password for the specified user." NL
-         "On other systems than Windows and NetWare the '-p' flag will "
-             "probably not work." NL
--        "The SHA algorithm does not use a salt and is less secure than the "
-+        "The SHA-1 algorithm does not use a salt and is less secure than the "
-             "MD5 algorithm." NL,
-         BCRYPT_DEFAULT_COST
-     );
-@@ -178,7 +182,7 @@
-     if (rv != APR_SUCCESS)
-         exit(ERR_SYNTAX);
- 
--    while ((rv = apr_getopt(state, "cnmspdBbDiC:v", &opt, &opt_arg)) == APR_SUCCESS) {
-+    while ((rv = apr_getopt(state, "cnmspdBbDi25C:r:v", &opt, &opt_arg)) == APR_SUCCESS) {
-         switch (opt) {
-         case 'c':
-             *mask |= APHTP_NEWFILE;
---- httpd-2.4.43/support/passwd_common.c.r1861793+
-+++ httpd-2.4.43/support/passwd_common.c
-@@ -179,16 +179,21 @@
- int mkhash(struct passwd_ctx *ctx)
- {
-     char *pw;
--    char salt[16];
-+    char salt[17];
-     apr_status_t rv;
-     int ret = 0;
- #if CRYPT_ALGO_SUPPORTED
-     char *cbuf;
- #endif
-+#ifdef HAVE_CRYPT_SHA2
-+    const char *setting;
-+    char method;
-+#endif
- 
--    if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT) {
-+    if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT
-+        && ctx->alg != ALG_CRYPT_SHA256 && ctx->alg != ALG_CRYPT_SHA512 ) {
-         apr_file_printf(errfile,
--                        "Warning: Ignoring -C argument for this algorithm." NL);
-+                        "Warning: Ignoring -C/-r argument for this algorithm." NL);
-     }
- 
-     if (ctx->passwd == NULL) {
-@@ -246,6 +251,34 @@
-         break;
- #endif /* CRYPT_ALGO_SUPPORTED */
- 
-+#ifdef HAVE_CRYPT_SHA2
-+    case ALG_CRYPT_SHA256:
-+    case ALG_CRYPT_SHA512:
-+        ret = generate_salt(salt, 16, &ctx->errstr, ctx->pool);
-+        if (ret != 0)
-+            break;
-+
-+        method = ctx->alg == ALG_CRYPT_SHA256 ? '5': '6';
-+
-+        if (ctx->cost) 
-+            setting = apr_psprintf(ctx->pool, "$%c$rounds=%d$%s",
-+                                   method, ctx->cost, salt);
-+        else
-+            setting = apr_psprintf(ctx->pool, "$%c$%s",
-+                                   method, salt);
-+
-+        cbuf = crypt(pw, setting);
-+        if (cbuf == NULL) {
-+            rv = APR_FROM_OS_ERROR(errno);
-+            ctx->errstr = apr_psprintf(ctx->pool, "crypt() failed: %pm", &rv);
-+            ret = ERR_PWMISMATCH;
-+            break;
-+        }
-+
-+        apr_cpystrn(ctx->out, cbuf, ctx->out_len - 1);
-+        break;
-+#endif /* HAVE_CRYPT_SHA2 */
-+
- #if BCRYPT_ALGO_SUPPORTED
-     case ALG_BCRYPT:
-         rv = apr_generate_random_bytes((unsigned char*)salt, 16);
-@@ -294,6 +327,19 @@
-     case 's':
-         ctx->alg = ALG_APSHA;
-         break;
-+#ifdef HAVE_CRYPT_SHA2
-+    case '2':
-+        ctx->alg = ALG_CRYPT_SHA256;
-+        break;
-+    case '5':
-+        ctx->alg = ALG_CRYPT_SHA512;
-+        break;
-+#else
-+    case '2':
-+    case '5':
-+        ctx->errstr = "SHA-2 crypt() algorithms are not supported on this platform.";
-+        return ERR_ALG_NOT_SUPP;
-+#endif
-     case 'p':
-         ctx->alg = ALG_PLAIN;
- #if !PLAIN_ALGO_SUPPORTED
-@@ -324,11 +370,12 @@
-         return ERR_ALG_NOT_SUPP;
- #endif
-         break;
--    case 'C': {
-+    case 'C':
-+    case 'r': {
-             char *endptr;
-             long num = strtol(opt_arg, &endptr, 10);
-             if (*endptr != '\0' || num <= 0) {
--                ctx->errstr = "argument to -C must be a positive integer";
-+                ctx->errstr = "argument to -C/-r must be a positive integer";
-                 return ERR_SYNTAX;
-             }
-             ctx->cost = num;
---- httpd-2.4.43/support/passwd_common.h.r1861793+
-+++ httpd-2.4.43/support/passwd_common.h
-@@ -28,6 +28,8 @@
- #include "apu_version.h"
- #endif
- 
-+#include "ap_config_auto.h"
-+
- #define MAX_STRING_LEN 256
- 
- #define ALG_PLAIN 0
-@@ -35,6 +37,8 @@
- #define ALG_APMD5 2
- #define ALG_APSHA 3
- #define ALG_BCRYPT 4
-+#define ALG_CRYPT_SHA256 5
-+#define ALG_CRYPT_SHA512 6
- 
- #define BCRYPT_DEFAULT_COST 5
- 
-@@ -84,7 +88,7 @@
-     apr_size_t      out_len;
-     char            *passwd;
-     int             alg;
--    int             cost;
-+    int             cost; /* cost for bcrypt, rounds for SHA-2 */
-     enum {
-         PW_PROMPT = 0,
-         PW_ARG,
diff --git a/httpd-2.4.46-htcacheclean-dont-break.patch b/httpd-2.4.46-htcacheclean-dont-break.patch
deleted file mode 100644
index 919e9e3..0000000
--- a/httpd-2.4.46-htcacheclean-dont-break.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-
-Upstream-Status: r1915508, proposed for 2.4.59
-
-diff --git a/support/htcacheclean.c b/support/htcacheclean.c
-index 958ba6d..0a7fe3c 100644
---- a/support/htcacheclean.c
-+++ b/support/htcacheclean.c
-@@ -557,8 +557,6 @@ static int list_urls(char *path, apr_pool_t *pool, apr_off_t round)
-                                         }
-                                     }
-                                 }
--
--                                break;
-                             }
-                         }
-                     }
diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch
deleted file mode 100644
index 20e6784..0000000
--- a/httpd-2.4.51-r1894152.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-# ./pullrev.sh 1894152
-http://svn.apache.org/viewvc?view=revision&revision=1894152
-
-Upstream-Status: merged for 2.4.59
-
---- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152
-+++ httpd-2.4.51/modules/filters/mod_deflate.c
-@@ -835,6 +835,7 @@
-     while (!APR_BRIGADE_EMPTY(bb))
-     {
-         apr_bucket *b;
-+        apr_status_t rv;
- 
-         /*
-          * Optimization: If we are a HEAD request and bytes_sent is not zero
-@@ -914,8 +915,6 @@
-         }
- 
-         if (APR_BUCKET_IS_FLUSH(e)) {
--            apr_status_t rv;
--
-             /* flush the remaining data from the zlib buffers */
-             zRC = flush_libz_buffer(ctx, c, f->c->bucket_alloc, deflate,
-                                     Z_SYNC_FLUSH, NO_UPDATE_CRC);
-@@ -947,7 +946,12 @@
-         }
- 
-         /* read */
--        apr_bucket_read(e, &data, &len, APR_BLOCK_READ);
-+        rv = apr_bucket_read(e, &data, &len, APR_BLOCK_READ);
-+        if (rv) {
-+            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(10298)
-+                          "failed reading from %s bucket", e->type->name);
-+            return rv;
-+        }
-         if (!len) {
-             apr_bucket_delete(e);
-             continue;
diff --git a/httpd-2.4.54-gettid.patch b/httpd-2.4.54-gettid.patch
deleted file mode 100644
index 88c956d..0000000
--- a/httpd-2.4.54-gettid.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-
-Upstream-Status: everything but last hunk merged for 2.4.59
-
-From d4e5b6e1e5585d341d1e51f1ddc637c099111076 Mon Sep 17 00:00:00 2001
-From: Joe Orton <jorton@redhat.com>
-Date: Tue, 7 Jul 2020 09:48:01 +0100
-Subject: [PATCH] Check and use gettid() directly with glibc 2.30+.
-
-* configure.in: Check for gettid() and define HAVE_SYS_GETTID if
-  gettid() is only usable via syscall().
-
-* server/log.c (log_tid): Use gettid() directly if available.
----
- configure.in | 14 +++++++++-----
- server/log.c |  8 ++++++--
- 2 files changed, 15 insertions(+), 7 deletions(-)
-
-diff --git a/configure.in b/configure.in
-index 423d58d4b9a..60cbf7b7f81 100644
---- httpd-2.4.54/configure.in.gettid
-+++ httpd-2.4.54/configure.in
-@@ -502,22 +502,26 @@
- timegm \
- getpgid \
- fopen64 \
--getloadavg
-+getloadavg \
-+gettid
- )
- 
- dnl confirm that a void pointer is large enough to store a long integer
- APACHE_CHECK_VOID_PTR_LEN
- 
--AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
-+if test $ac_cv_func_gettid = no; then
-+  # On Linux before glibc 2.30, gettid() is only usable via syscall()
-+  AC_CACHE_CHECK([for gettid() via syscall], ap_cv_gettid,
- [AC_TRY_RUN(#define _GNU_SOURCE
- #include <unistd.h>
- #include <sys/syscall.h>
- #include <sys/types.h>
- int main(int argc, char **argv) {
- pid_t t = syscall(SYS_gettid); return t == -1 ? 1 : 0; },
--[ac_cv_gettid=yes], [ac_cv_gettid=no], [ac_cv_gettid=no])])
--if test "$ac_cv_gettid" = "yes"; then
--    AC_DEFINE(HAVE_GETTID, 1, [Define if you have gettid()])
-+  [ap_cv_gettid=yes], [ap_cv_gettid=no], [ap_cv_gettid=no])])
-+  if test "$ap_cv_gettid" = "yes"; then
-+      AC_DEFINE(HAVE_SYS_GETTID, 1, [Define if you have gettid() via syscall()])
-+  fi
- fi
- 
- dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs
---- httpd-2.4.54/server/log.c.gettid
-+++ httpd-2.4.54/server/log.c
-@@ -55,7 +55,7 @@
- #include "ap_mpm.h"
- #include "ap_listen.h"
- 
--#if HAVE_GETTID
-+#if HAVE_SYS_GETTID
- #include <sys/syscall.h>
- #include <sys/types.h>
- #endif
-@@ -627,14 +627,18 @@
- #if APR_HAS_THREADS
-     int result;
- #endif
--#if HAVE_GETTID
-+#if defined(HAVE_GETTID) || defined(HAVE_SYS_GETTID)
-     if (arg && *arg == 'g') {
-+#ifdef HAVE_GETTID
-+        pid_t tid = gettid();
-+#else
-         pid_t tid = syscall(SYS_gettid);
-+#endif
-         if (tid == -1)
-             return 0;
-         return apr_snprintf(buf, buflen, "%"APR_PID_T_FMT, tid);
-     }
--#endif
-+#endif /* HAVE_GETTID || HAVE_SYS_GETTID */
- #if APR_HAS_THREADS
-     if (ap_mpm_query(AP_MPMQ_IS_THREADED, &result) == APR_SUCCESS
-         && result != AP_MPMQ_NOT_SUPPORTED)
-@@ -968,7 +972,7 @@
- #if APR_HAS_THREADS
-         field_start = len;
-         len += cpystrn(buf + len, ":tid ", buflen - len);
--        item_len = log_tid(info, NULL, buf + len, buflen - len);
-+        item_len = log_tid(info, "g", buf + len, buflen - len);
-         if (!item_len)
-             len = field_start;
-         else
diff --git a/httpd-2.4.58-r1913912+.patch b/httpd-2.4.58-r1913912+.patch
deleted file mode 100644
index f8fd4a4..0000000
--- a/httpd-2.4.58-r1913912+.patch
+++ /dev/null
@@ -1,849 +0,0 @@
-# ./pullrev.sh 1913912 1915067
-
-http://svn.apache.org/viewvc?view=revision&revision=1913912
-http://svn.apache.org/viewvc?view=revision&revision=1915067
-
-Upstream-Status: merged for 2.4.59
-
---- httpd-2.4.58/modules/ssl/mod_ssl.c.r1913912
-+++ httpd-2.4.58/modules/ssl/mod_ssl.c
-@@ -25,8 +25,7 @@
-  */
- 
- #include "ssl_private.h"
--#include "mod_ssl.h"
--#include "mod_ssl_openssl.h"
-+
- #include "util_md5.h"
- #include "util_mutex.h"
- #include "ap_provider.h"
-@@ -75,11 +74,9 @@
-     SSL_CMD_SRV(SessionCache, TAKE1,
-                 "SSL Session Cache storage "
-                 "('none', 'nonenotnull', 'dbm:/path/to/file')")
--#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
-     SSL_CMD_SRV(CryptoDevice, TAKE1,
-                 "SSL external Crypto Device usage "
-                 "('builtin', '...')")
--#endif
-     SSL_CMD_SRV(RandomSeed, TAKE23,
-                 "SSL Pseudo Random Number Generator (PRNG) seeding source "
-                 "('startup|connect builtin|file:/path|exec:/path [bytes]')")
---- httpd-2.4.58/modules/ssl/mod_ssl_openssl.h.r1913912
-+++ httpd-2.4.58/modules/ssl/mod_ssl_openssl.h
-@@ -30,14 +30,17 @@
- 
- /* OpenSSL headers */
- 
--#ifndef SSL_PRIVATE_H
- #include <openssl/opensslv.h>
--#if (OPENSSL_VERSION_NUMBER >= 0x10001000)
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000
-+#include <openssl/macros.h> /* for OPENSSL_API_LEVEL */
-+#endif
-+#if OPENSSL_VERSION_NUMBER >= 0x10001000
- /* must be defined before including ssl.h */
- #define OPENSSL_NO_SSL_INTERN
- #endif
- #include <openssl/ssl.h>
--#endif
-+#include <openssl/evp.h>
-+#include <openssl/x509.h>
- 
- /**
-  * init_server hook -- allow SSL_CTX-specific initialization to be performed by
---- httpd-2.4.58/modules/ssl/ssl_engine_config.c.r1913912
-+++ httpd-2.4.58/modules/ssl/ssl_engine_config.c
-@@ -27,6 +27,7 @@
-                                            damned if you don't.''
-                                                -- Unknown        */
- #include "ssl_private.h"
-+
- #include "util_mutex.h"
- #include "ap_provider.h"
- 
-@@ -593,14 +594,15 @@
-     return NULL;
- }
- 
--#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
- const char *ssl_cmd_SSLCryptoDevice(cmd_parms *cmd,
-                                     void *dcfg,
-                                     const char *arg)
- {
-     SSLModConfigRec *mc = myModConfig(cmd->server);
-     const char *err;
-+#if MODSSL_HAVE_ENGINE_API
-     ENGINE *e;
-+#endif
- 
-     if ((err = ap_check_cmd_context(cmd, GLOBAL_ONLY))) {
-         return err;
-@@ -609,13 +611,16 @@
-     if (strcEQ(arg, "builtin")) {
-         mc->szCryptoDevice = NULL;
-     }
-+#if MODSSL_HAVE_ENGINE_API
-     else if ((e = ENGINE_by_id(arg))) {
-         mc->szCryptoDevice = arg;
-         ENGINE_free(e);
-     }
-+#endif
-     else {
-         err = "SSLCryptoDevice: Invalid argument; must be one of: "
-               "'builtin' (none)";
-+#if MODSSL_HAVE_ENGINE_API
-         e = ENGINE_get_first();
-         while (e) {
-             err = apr_pstrcat(cmd->pool, err, ", '", ENGINE_get_id(e),
-@@ -624,12 +629,12 @@
-              * on the 'old' e, per the docs in engine.h. */
-             e = ENGINE_get_next(e);
-         }
-+#endif
-         return err;
-     }
- 
-     return NULL;
- }
--#endif
- 
- const char *ssl_cmd_SSLRandomSeed(cmd_parms *cmd,
-                                   void *dcfg,
---- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1913912
-+++ httpd-2.4.58/modules/ssl/ssl_engine_init.c
-@@ -27,8 +27,7 @@
-                                   see Recursive.''
-                                         -- Unknown   */
- #include "ssl_private.h"
--#include "mod_ssl.h"
--#include "mod_ssl_openssl.h"
-+
- #include "mpm_common.h"
- #include "mod_md.h"
- 
-@@ -218,6 +217,16 @@
- }
- #endif
- 
-+static APR_INLINE unsigned long modssl_runtime_lib_version(void)
-+{
-+#if MODSSL_USE_OPENSSL_PRE_1_1_API
-+    return SSLeay();
-+#else
-+    return OpenSSL_version_num();
-+#endif
-+}
-+
-+
- /*
-  *  Per-module initialization
-  */
-@@ -225,18 +234,22 @@
-                              apr_pool_t *ptemp,
-                              server_rec *base_server)
- {
-+    unsigned long runtime_lib_version = modssl_runtime_lib_version();
-     SSLModConfigRec *mc = myModConfig(base_server);
-     SSLSrvConfigRec *sc;
-     server_rec *s;
-     apr_status_t rv;
-     apr_array_header_t *pphrases;
- 
--    if (SSLeay() < MODSSL_LIBRARY_VERSION) {
-+    AP_DEBUG_ASSERT(mc);
-+
-+    if (runtime_lib_version < MODSSL_LIBRARY_VERSION) {
-         ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(01882)
-                      "Init: this version of mod_ssl was compiled against "
--                     "a newer library (%s, version currently loaded is %s)"
-+                     "a newer library (%s (%s), version currently loaded is 0x%lX)"
-                      " - may result in undefined or erroneous behavior",
--                     MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT);
-+                    MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT,
-+                    runtime_lib_version);
-     }
- 
-     /* We initialize mc->pid per-process in the child init,
-@@ -313,11 +326,9 @@
-     /*
-      * SSL external crypto device ("engine") support
-      */
--#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
-     if ((rv = ssl_init_Engine(base_server, p)) != APR_SUCCESS) {
-         return rv;
-     }
--#endif
- 
-     ap_log_error(APLOG_MARK, APLOG_INFO, 0, base_server, APLOGNO(01883)
-                  "Init: Initialized %s library", MODSSL_LIBRARY_NAME);
-@@ -473,9 +484,9 @@
-  * Support for external a Crypto Device ("engine"), usually
-  * a hardware accelerator card for crypto operations.
-  */
--#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
- apr_status_t ssl_init_Engine(server_rec *s, apr_pool_t *p)
- {
-+#if MODSSL_HAVE_ENGINE_API
-     SSLModConfigRec *mc = myModConfig(s);
-     ENGINE *e;
- 
-@@ -507,10 +518,9 @@
- 
-         ENGINE_free(e);
-     }
--
-+#endif
-     return APR_SUCCESS;
- }
--#endif
- 
- #ifdef HAVE_TLSEXT
- static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s,
-@@ -1320,15 +1330,6 @@
-    return 0;
- }
- 
--static APR_INLINE int modssl_DH_bits(DH *dh)
--{
--#if OPENSSL_VERSION_NUMBER < 0x30000000L
--    return DH_bits(dh);
--#else
--    return BN_num_bits(DH_get0_p(dh));
--#endif
--}
--
- /* SSL_CTX_use_PrivateKey_file() can fail either because the private
-  * key was encrypted, or due to a mismatch between an already-loaded
-  * cert and the key - a common misconfiguration - from calling
-@@ -1354,15 +1355,10 @@
-     SSLModConfigRec *mc = myModConfig(s);
-     const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile;
-     int i;
--    X509 *cert;
--    DH *dh;
-+    EVP_PKEY *pkey;
- #ifdef HAVE_ECC
--    EC_GROUP *ecparams = NULL;
--    int nid;
--    EC_KEY *eckey = NULL;
--#endif
--#ifndef HAVE_SSL_CONF_CMD
--    SSL *ssl;
-+    EC_GROUP *ecgroup = NULL;
-+    int curve_nid = 0;
- #endif
- 
-     /* no OpenSSL default prompts for any of the SSL_CTX_use_* calls, please */
-@@ -1373,7 +1369,7 @@
-                 (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i,
-                                           const char *));
-          i++) {
--        EVP_PKEY *pkey;
-+        X509 *cert = NULL;
-         const char *engine_certfile = NULL;
- 
-         key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i);
-@@ -1416,8 +1412,6 @@
-         if (modssl_is_engine_id(keyfile)) {
-             apr_status_t rv;
- 
--            cert = NULL;
--            
-             if ((rv = modssl_load_engine_keypair(s, ptemp, vhost_id,
-                                                  engine_certfile, keyfile,
-                                                  &cert, &pkey))) {
-@@ -1488,22 +1482,21 @@
-          * assume that if SSL_CONF is available, it's OpenSSL 1.0.2 or later,
-          * and SSL_CTX_get0_certificate is implemented.)
-          */
--        if (!(cert = SSL_CTX_get0_certificate(mctx->ssl_ctx))) {
-+        cert = SSL_CTX_get0_certificate(mctx->ssl_ctx);
- #else
--        ssl = SSL_new(mctx->ssl_ctx);
-+        {
-+            SSL *ssl = SSL_new(mctx->ssl_ctx);
-         if (ssl) {
-             /* Workaround bug in SSL_get_certificate in OpenSSL 0.9.8y */
-             SSL_set_connect_state(ssl);
-             cert = SSL_get_certificate(ssl);
-+                SSL_free(ssl);
-+            }
-         }
--        if (!ssl || !cert) {
- #endif
-+        if (!cert) {
-             ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02566)
-                          "Unable to retrieve certificate %s", key_id);
--#ifndef HAVE_SSL_CONF_CMD
--            if (ssl)
--                SSL_free(ssl);
--#endif
-             return APR_EGENERAL;
-         }
- 
-@@ -1525,10 +1518,6 @@
-         }
- #endif
- 
--#ifndef HAVE_SSL_CONF_CMD
--        SSL_free(ssl);
--#endif
--
-         ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(02568)
-                      "Certificate and private key %s configured from %s and %s",
-                      key_id, certfile, keyfile);
-@@ -1538,15 +1527,33 @@
-      * Try to read DH parameters from the (first) SSLCertificateFile
-      */
-     certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *);
--    if (certfile && !modssl_is_engine_id(certfile)
--        && (dh = ssl_dh_GetParamFromFile(certfile))) {
--        /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey()
--         * for OpenSSL 3.0+. */
-+    if (certfile && !modssl_is_engine_id(certfile)) {
-+        int done = 0, num_bits = 0;
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+        DH *dh = modssl_dh_from_file(certfile);
-+        if (dh) {
-+            num_bits = DH_bits(dh);
-         SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh);
-+            DH_free(dh);
-+            done = 1;
-+        }
-+#else
-+        pkey = modssl_dh_pkey_from_file(certfile);
-+        if (pkey) {
-+            num_bits = EVP_PKEY_get_bits(pkey);
-+            if (!SSL_CTX_set0_tmp_dh_pkey(mctx->ssl_ctx, pkey)) {
-+                EVP_PKEY_free(pkey);
-+            }
-+            else {
-+                done = 1;
-+            }
-+        }
-+#endif
-+        if (done) {
-         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
-                      "Custom DH parameters (%d bits) for %s loaded from %s",
--                     modssl_DH_bits(dh), vhost_id, certfile);
--        DH_free(dh);
-+                         num_bits, vhost_id, certfile);
-+        }
-     }
- #if !MODSSL_USE_OPENSSL_PRE_1_1_API
-     else {
-@@ -1561,13 +1568,27 @@
-      * Similarly, try to read the ECDH curve name from SSLCertificateFile...
-      */
-     if (certfile && !modssl_is_engine_id(certfile)
--        && (ecparams = ssl_ec_GetParamFromFile(certfile))
--        && (nid = EC_GROUP_get_curve_name(ecparams)) 
--        && (eckey = EC_KEY_new_by_curve_name(nid))) {
-+        && (ecgroup = modssl_ec_group_from_file(certfile))
-+        && (curve_nid = EC_GROUP_get_curve_name(ecgroup))) {
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+        EC_KEY *eckey = EC_KEY_new_by_curve_name(curve_nid);
-+        if (eckey) {
-         SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey);
-+            EC_KEY_free(eckey);
-+        }
-+        else {
-+            curve_nid = 0;
-+        }
-+#else
-+        if (!SSL_CTX_set1_curves(mctx->ssl_ctx, &curve_nid, 1)) {
-+            curve_nid = 0;
-+        }
-+#endif
-+        if (curve_nid) {
-         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541)
-                      "ECDH curve %s for %s specified in %s",
--                     OBJ_nid2sn(nid), vhost_id, certfile);
-+                         OBJ_nid2sn(curve_nid), vhost_id, certfile);
-+        }
-     }
-     /*
-      * ...otherwise, enable auto curve selection (OpenSSL 1.0.2)
-@@ -1575,18 +1596,20 @@
-      * ECDH is always enabled in 1.1.0 unless excluded from SSLCipherList
-      */
- #if MODSSL_USE_OPENSSL_PRE_1_1_API
--    else {
-+    if (!curve_nid) {
- #if defined(SSL_CTX_set_ecdh_auto)
-         SSL_CTX_set_ecdh_auto(mctx->ssl_ctx, 1);
- #else
--        eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
-+        EC_KEY *eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
-+        if (eckey) {
-         SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey);
-+            EC_KEY_free(eckey);
-+        }
- #endif
-     }
- #endif
-     /* OpenSSL assures us that _free() is NULL-safe */
--    EC_KEY_free(eckey);
--    EC_GROUP_free(ecparams);
-+    EC_GROUP_free(ecgroup);
- #endif
- 
-     return APR_SUCCESS;
---- httpd-2.4.58/modules/ssl/ssl_engine_io.c.r1913912
-+++ httpd-2.4.58/modules/ssl/ssl_engine_io.c
-@@ -28,8 +28,7 @@
-                                   core keeps dumping.''
-                                             -- Unknown    */
- #include "ssl_private.h"
--#include "mod_ssl.h"
--#include "mod_ssl_openssl.h"
-+
- #include "apr_date.h"
- 
- APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, proxy_post_handshake,
-@@ -2283,14 +2282,7 @@
-                               ssl_io_filter_cleanup, apr_pool_cleanup_null);
- 
-     if (APLOG_CS_IS_LEVEL(c, mySrvFromConn(c), APLOG_TRACE4)) {
--        BIO *rbio = SSL_get_rbio(ssl),
--            *wbio = SSL_get_wbio(ssl);
--        BIO_set_callback(rbio, ssl_io_data_cb);
--        BIO_set_callback_arg(rbio, (void *)ssl);
--        if (wbio && wbio != rbio) {
--            BIO_set_callback(wbio, ssl_io_data_cb);
--            BIO_set_callback_arg(wbio, (void *)ssl);
--        }
-+        modssl_set_io_callbacks(ssl);
-     }
- 
-     return;
-@@ -2374,13 +2366,22 @@
-             "+-------------------------------------------------------------------------+");
- }
- 
--long ssl_io_data_cb(BIO *bio, int cmd,
--                    const char *argp,
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+static long modssl_io_cb(BIO *bio, int cmd, const char *argp,
-+                         size_t len, int argi, long argl, int rc,
-+                         size_t *processed)
-+#else
-+static long modssl_io_cb(BIO *bio, int cmd, const char *argp,
-                     int argi, long argl, long rc)
-+#endif
- {
-     SSL *ssl;
-     conn_rec *c;
-     server_rec *s;
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+    (void)len;
-+    (void)processed;
-+#endif
- 
-     if ((ssl = (SSL *)BIO_get_callback_arg(bio)) == NULL)
-         return rc;
-@@ -2402,7 +2403,7 @@
-                     "%s: %s %ld/%d bytes %s BIO#%pp [mem: %pp] %s",
-                     MODSSL_LIBRARY_NAME,
-                     (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "write" : "read"),
--                    rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"),
-+                    (long)rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"),
-                     bio, argp, dump);
-             if (*dump != '\0' && argp != NULL)
-                 ssl_io_data_dump(c, s, argp, rc);
-@@ -2417,3 +2418,25 @@
-     }
-     return rc;
- }
-+
-+static APR_INLINE void set_bio_callback(BIO *bio, void *arg)
-+{
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+    BIO_set_callback_ex(bio, modssl_io_cb);
-+#else
-+    BIO_set_callback(bio, modssl_io_cb);
-+#endif
-+    BIO_set_callback_arg(bio, arg);
-+}
-+
-+void modssl_set_io_callbacks(SSL *ssl)
-+{
-+    BIO *rbio = SSL_get_rbio(ssl),
-+        *wbio = SSL_get_wbio(ssl);
-+    if (rbio) {
-+        set_bio_callback(rbio, ssl);
-+    }
-+    if (wbio && wbio != rbio) {
-+        set_bio_callback(wbio, ssl);
-+    }
-+}
---- httpd-2.4.58/modules/ssl/ssl_engine_kernel.c.r1913912
-+++ httpd-2.4.58/modules/ssl/ssl_engine_kernel.c
-@@ -2581,6 +2581,7 @@
-             sc->server->pks->service_unavailable : 0; 
-         
-         ap_update_child_status_from_server(c->sbh, SERVER_BUSY_READ, c, s);
-+
-         /*
-          * There is one special filter callback, which is set
-          * very early depending on the base_server's log level.
-@@ -2589,14 +2590,7 @@
-          * we need to set that callback here.
-          */
-         if (APLOGtrace4(s)) {
--            BIO *rbio = SSL_get_rbio(ssl),
--                *wbio = SSL_get_wbio(ssl);
--            BIO_set_callback(rbio, ssl_io_data_cb);
--            BIO_set_callback_arg(rbio, (void *)ssl);
--            if (wbio && wbio != rbio) {
--                BIO_set_callback(wbio, ssl_io_data_cb);
--                BIO_set_callback_arg(wbio, (void *)ssl);
--            }
-+            modssl_set_io_callbacks(ssl);
-         }
- 
-         return 1;
---- httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c.r1913912
-+++ httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c
-@@ -30,6 +30,8 @@
-                                            -- Clifford Stoll     */
- #include "ssl_private.h"
- 
-+#include <openssl/ui.h>
-+
- typedef struct {
-     server_rec         *s;
-     apr_pool_t         *p;
-@@ -606,8 +608,7 @@
-     return (len);
- }
- 
--
--#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
-+#if MODSSL_HAVE_ENGINE_API
- 
- /* OpenSSL UI implementation for passphrase entry; largely duplicated
-  * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be
-@@ -831,7 +832,7 @@
-                                         const char *certid, const char *keyid,
-                                         X509 **pubkey, EVP_PKEY **privkey)
- {
--#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
-+#if MODSSL_HAVE_ENGINE_API
-     const char *c, *scheme;
-     ENGINE *e;
-     UI_METHOD *ui_method = get_passphrase_ui(p);
---- httpd-2.4.58/modules/ssl/ssl_private.h.r1913912
-+++ httpd-2.4.58/modules/ssl/ssl_private.h
-@@ -83,16 +83,13 @@
- 
- #include "ap_expr.h"
- 
--/* OpenSSL headers */
--#include <openssl/opensslv.h>
--#if (OPENSSL_VERSION_NUMBER >= 0x10001000)
--/* must be defined before including ssl.h */
--#define OPENSSL_NO_SSL_INTERN
--#endif
--#if OPENSSL_VERSION_NUMBER >= 0x30000000
--#include <openssl/core_names.h>
-+/* keep first for compat API */
-+#ifndef OPENSSL_API_COMPAT
-+#define OPENSSL_API_COMPAT 0x10101000 /* for ENGINE_ API */
- #endif
--#include <openssl/ssl.h>
-+#include "mod_ssl_openssl.h"
-+
-+/* OpenSSL headers */
- #include <openssl/err.h>
- #include <openssl/x509.h>
- #include <openssl/pem.h>
-@@ -102,12 +99,23 @@
- #include <openssl/x509v3.h>
- #include <openssl/x509_vfy.h>
- #include <openssl/ocsp.h>
-+#include <openssl/dh.h>
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000
-+#include <openssl/core_names.h>
-+#endif
- 
- /* Avoid tripping over an engine build installed globally and detected
-  * when the user points at an explicit non-engine flavor of OpenSSL
-  */
--#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
-+#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) \
-+    && (OPENSSL_VERSION_NUMBER < 0x30000000 \
-+        || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \
-+    && !defined(OPENSSL_NO_ENGINE)
- #include <openssl/engine.h>
-+#define MODSSL_HAVE_ENGINE_API 1
-+#endif
-+#ifndef MODSSL_HAVE_ENGINE_API
-+#define MODSSL_HAVE_ENGINE_API 0
- #endif
- 
- #if (OPENSSL_VERSION_NUMBER < 0x0090801f)
-@@ -142,10 +150,18 @@
-  * include most changes from OpenSSL >= 1.1 (new functions, macros, 
-  * deprecations, ...), so we have to work around this...
-  */
--#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f)
-+#if LIBRESSL_VERSION_NUMBER < 0x2070000f
-+#define MODSSL_USE_OPENSSL_PRE_1_1_API 1
-+#else
-+#define MODSSL_USE_OPENSSL_PRE_1_1_API 0
-+#endif
- #else /* defined(LIBRESSL_VERSION_NUMBER) */
--#define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L)
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#define MODSSL_USE_OPENSSL_PRE_1_1_API 1
-+#else
-+#define MODSSL_USE_OPENSSL_PRE_1_1_API 0
- #endif
-+#endif /* defined(LIBRESSL_VERSION_NUMBER) */
- 
- #if defined(OPENSSL_FIPS) || OPENSSL_VERSION_NUMBER >= 0x30000000L
- #define HAVE_FIPS
-@@ -211,7 +227,10 @@
- #endif
- 
- /* Secure Remote Password */
--#if !defined(OPENSSL_NO_SRP) && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB)
-+#if !defined(OPENSSL_NO_SRP) \
-+    && (OPENSSL_VERSION_NUMBER < 0x30000000L \
-+        || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \
-+    && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB)
- #define HAVE_SRP
- #include <openssl/srp.h>
- #endif
-@@ -254,6 +273,14 @@
- #endif
- #endif
- 
-+/* those may be deprecated */
-+#ifndef X509_get_notBefore
-+#define X509_get_notBefore  X509_getm_notBefore
-+#endif
-+#ifndef X509_get_notAfter
-+#define X509_get_notAfter   X509_getm_notAfter
-+#endif
-+
- #if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
- #define HAVE_OPENSSL_KEYLOG
- #endif
-@@ -1019,7 +1046,7 @@
- /**  I/O  */
- void         ssl_io_filter_init(conn_rec *, request_rec *r, SSL *);
- void         ssl_io_filter_register(apr_pool_t *);
--long         ssl_io_data_cb(BIO *, int, const char *, int, long, long);
-+void         modssl_set_io_callbacks(SSL *ssl);
- 
- /* ssl_io_buffer_fill fills the setaside buffering of the HTTP request
-  * to allow an SSL renegotiation to take place. */
-@@ -1057,9 +1084,13 @@
-                                         X509 **pubkey, EVP_PKEY **privkey);
- 
- /**  Diffie-Hellman Parameter Support  */
--DH           *ssl_dh_GetParamFromFile(const char *);
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+DH           *modssl_dh_from_file(const char *);
-+#else
-+EVP_PKEY     *modssl_dh_pkey_from_file(const char *);
-+#endif
- #ifdef HAVE_ECC
--EC_GROUP     *ssl_ec_GetParamFromFile(const char *);
-+EC_GROUP     *modssl_ec_group_from_file(const char *);
- #endif
- 
- /* Store the EVP_PKEY key (serialized into DER) in the hash table with
---- httpd-2.4.58/modules/ssl/ssl_util.c.r1913912
-+++ httpd-2.4.58/modules/ssl/ssl_util.c
-@@ -476,7 +476,7 @@
- 
- int modssl_is_engine_id(const char *name)
- {
--#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
-+#if MODSSL_HAVE_ENGINE_API
-     /* ### Can handle any other special ENGINE key names here? */
-     return strncmp(name, "pkcs11:", 7) == 0;
- #else
---- httpd-2.4.58/modules/ssl/ssl_util_ssl.c.r1913912
-+++ httpd-2.4.58/modules/ssl/ssl_util_ssl.c
-@@ -464,29 +464,52 @@
- **  _________________________________________________________________
- */
- 
--DH *ssl_dh_GetParamFromFile(const char *file)
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+DH *modssl_dh_from_file(const char *file)
- {
--    DH *dh = NULL;
-+    DH *dh;
-     BIO *bio;
- 
-     if ((bio = BIO_new_file(file, "r")) == NULL)
-         return NULL;
-     dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
-     BIO_free(bio);
--    return (dh);
-+
-+    return dh;
-+}
-+#else
-+EVP_PKEY *modssl_dh_pkey_from_file(const char *file)
-+{
-+    EVP_PKEY *pkey;
-+    BIO *bio;
-+
-+    if ((bio = BIO_new_file(file, "r")) == NULL)
-+        return NULL;
-+    pkey = PEM_read_bio_Parameters(bio, NULL);
-+    BIO_free(bio);
-+
-+    return pkey;
- }
-+#endif
- 
- #ifdef HAVE_ECC
--EC_GROUP *ssl_ec_GetParamFromFile(const char *file)
-+EC_GROUP *modssl_ec_group_from_file(const char *file)
- {
--    EC_GROUP *group = NULL;
-+    EC_GROUP *group;
-     BIO *bio;
- 
-     if ((bio = BIO_new_file(file, "r")) == NULL)
-         return NULL;
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-     group = PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL);
-+#else
-+    group = PEM_ASN1_read_bio((void *)d2i_ECPKParameters,
-+                              PEM_STRING_ECPARAMETERS, bio,
-+                              NULL, NULL, NULL);
-+#endif
-     BIO_free(bio);
--    return (group);
-+
-+    return group;
- }
- #endif
- 
---- httpd-2.4.58/modules/ssl/ssl_util_stapling.c.r1913912
-+++ httpd-2.4.58/modules/ssl/ssl_util_stapling.c
-@@ -29,9 +29,9 @@
-                                             -- Alexei Sayle          */
- 
- #include "ssl_private.h"
-+
- #include "ap_mpm.h"
- #include "apr_thread_mutex.h"
--#include "mod_ssl_openssl.h"
- 
- APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, init_stapling_status,
-                                     (server_rec *s, apr_pool_t *p, 
---- httpd-2.4.58/support/ab.c.r1913912
-+++ httpd-2.4.58/support/ab.c
-@@ -166,13 +166,18 @@
- 
- #if defined(HAVE_OPENSSL)
- 
--#include <openssl/rsa.h>
-+#include <openssl/evp.h>
- #include <openssl/crypto.h>
- #include <openssl/x509.h>
- #include <openssl/pem.h>
- #include <openssl/err.h>
- #include <openssl/ssl.h>
- #include <openssl/rand.h>
-+#include <openssl/opensslv.h>
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+#include <openssl/core_names.h>
-+#endif
-+
- #define USE_SSL
- 
- #define SK_NUM(x) sk_X509_num(x)
-@@ -555,22 +560,33 @@
-  *
-  */
- #ifdef USE_SSL
--static long ssl_print_cb(BIO *bio,int cmd,const char *argp,int argi,long argl,long ret)
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+static long ssl_print_cb(BIO *bio, int cmd, const char *argp,
-+                         size_t len, int argi, long argl, int ret,
-+                         size_t *processed)
-+#else
-+static long ssl_print_cb(BIO *bio, int cmd, const char *argp,
-+                         int argi, long argl, long ret)
-+#endif
- {
-     BIO *out;
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+    (void)len;
-+    (void)processed;
-+#endif
- 
-     out=(BIO *)BIO_get_callback_arg(bio);
-     if (out == NULL) return(ret);
- 
-     if (cmd == (BIO_CB_READ|BIO_CB_RETURN)) {
-         BIO_printf(out,"read from %p [%p] (%d bytes => %ld (0x%lX))\n",
--                   bio, argp, argi, ret, ret);
-+                   bio, argp, argi, (long)ret, (long)ret);
-         BIO_dump(out,(char *)argp,(int)ret);
-         return(ret);
-     }
-     else if (cmd == (BIO_CB_WRITE|BIO_CB_RETURN)) {
-         BIO_printf(out,"write to %p [%p] (%d bytes => %ld (0x%lX))\n",
--                   bio, argp, argi, ret, ret);
-+                   bio, argp, argi, (long)ret, (long)ret);
-         BIO_dump(out,(char *)argp,(int)ret);
-     }
-     return ret;
-@@ -765,17 +781,29 @@
-                         break;
- #ifndef OPENSSL_NO_EC
-                     case EVP_PKEY_EC: {
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+                        size_t len;
-+                        char cname[80];
-+                        if (!EVP_PKEY_get_utf8_string_param(key, OSSL_PKEY_PARAM_GROUP_NAME,
-+                                                            cname, sizeof(cname), &len)) {
-+                            cname[0] = '?';
-+                            len = 1;
-+                        }
-+                        cname[len] = '\0';
-+#else
-                         const char *cname = NULL;
-                         EC_KEY *ec = EVP_PKEY_get1_EC_KEY(key);
-                         int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
-                         EC_KEY_free(ec);
-                         cname = EC_curve_nid2nist(nid);
--                        if (!cname)
-+                        if (!cname) {
-                             cname = OBJ_nid2sn(nid);
--
-+                            if (!cname)
-+                                cname = "?";
-+                        }
-+#endif
-                         apr_snprintf(ssl_tmp_key, 128, "ECDH %s %d bits",
--                                     cname,
--                                     EVP_PKEY_bits(key));
-+                                     cname, EVP_PKEY_bits(key));
-                         break;
-                         }
- #endif
-@@ -1428,7 +1456,11 @@
-         SSL_set_bio(c->ssl, bio, bio);
-         SSL_set_connect_state(c->ssl);
-         if (verbosity >= 4) {
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+            BIO_set_callback_ex(bio, ssl_print_cb);
-+#else
-             BIO_set_callback(bio, ssl_print_cb);
-+#endif
-             BIO_set_callback_arg(bio, (void *)bio_err);
-         }
- #ifdef HAVE_TLSEXT
diff --git a/httpd-2.4.58-r1914013.patch b/httpd-2.4.58-r1914013.patch
deleted file mode 100644
index 02dcac3..0000000
--- a/httpd-2.4.58-r1914013.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-# ./pullrev.sh 1914013
-http://svn.apache.org/viewvc?view=revision&revision=1914013
-
-Upstream-Status: merged for 2.4.59
-
---- httpd-2.4.58/modules/filters/mod_xml2enc.c
-+++ httpd-2.4.58/modules/filters/mod_xml2enc.c
-@@ -209,7 +209,7 @@
-   
-     /* to sniff, first we look for BOM */
-     if (ctx->xml2enc == XML_CHAR_ENCODING_NONE) {
--        ctx->xml2enc = xmlDetectCharEncoding((const xmlChar*)ctx->buf,
-+        ctx->xml2enc = xmlDetectCharEncoding((const unsigned char*)ctx->buf,
-                                              ctx->bytes); 
-         if (HAVE_ENCODING(ctx->xml2enc)) {
-             ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(01432)
diff --git a/httpd-2.4.59-gettid.patch b/httpd-2.4.59-gettid.patch
new file mode 100644
index 0000000..4857e37
--- /dev/null
+++ b/httpd-2.4.59-gettid.patch
@@ -0,0 +1,14 @@
+
+Upstream-Status: not pushed upstream
+
+--- httpd-2.4.54/server/log.c.gettid
++++ httpd-2.4.54/server/log.c
+@@ -968,7 +972,7 @@
+ #if APR_HAS_THREADS
+         field_start = len;
+         len += cpystrn(buf + len, ":tid ", buflen - len);
+-        item_len = log_tid(info, NULL, buf + len, buflen - len);
++        item_len = log_tid(info, "g", buf + len, buflen - len);
+         if (!item_len)
+             len = field_start;
+         else
diff --git a/httpd-2.4.48-r1828172+.patch b/httpd-2.4.59-unifycgid.patch
similarity index 91%
rename from httpd-2.4.48-r1828172+.patch
rename to httpd-2.4.59-unifycgid.patch
index 5f3be4c..54216e0 100644
--- a/httpd-2.4.48-r1828172+.patch
+++ b/httpd-2.4.59-unifycgid.patch
@@ -1,14 +1,41 @@
 
 https://github.com/apache/httpd/pull/209
 
-Upstream-Status: in trunk, not proposed for 2.4.x
-
+diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
+index ddacd4af19..6d4379d165 100644
+--- a/.github/workflows/linux.yml
++++ b/.github/workflows/linux.yml
+@@ -48,11 +48,11 @@ jobs:
+           - name: Shared MPMs, all-modules
+             config: --enable-mods-shared=reallyall --enable-mpms-shared=all
+           # -------------------------------------------------------------------------
+-          - name: Event MPM, all-modules, mod_cgid only
+-            config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi
++          - name: Event MPM, all-modules, mod_cgid fdpassing
++            config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi --enable-cgid-fdpassing
+           # -------------------------------------------------------------------------
+-          - name: Event MPM, all-modules, no CMSG_DATA
+-            config: --enable-mods-shared=reallyall --with-mpm=event ac_cv_have_decl_CMSG_DATA=no
++          - name: Event MPM, all-modules, mod_cgid w/o fdpassing
++            config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi
+           # -------------------------------------------------------------------------
+           - name: Default, all-modules + install
+             config: --enable-mods-shared=reallyall
+diff --git a/changes-entries/pr54221.txt b/changes-entries/pr54221.txt
+new file mode 100644
+index 0000000000..62b75ea4dd
+--- /dev/null
++++ b/changes-entries/pr54221.txt
+@@ -0,0 +1,3 @@
++  *) mod_cgid: Optional support for file descriptor passing, fixing
++     error log handling (configure --enable-cgid-fdpassing) on Unix
++     platforms. PR 54221.  [Joe Orton]
 diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h
 new file mode 100644
-index 0000000000..69df73ce68
+index 0000000000..66f9418f21
 --- /dev/null
 +++ b/modules/generators/cgi_common.h
-@@ -0,0 +1,629 @@
+@@ -0,0 +1,639 @@
 +/* Licensed to the Apache Software Foundation (ASF) under one or more
 + * contributor license agreements.  See the NOTICE file distributed with
 + * this work for additional information regarding copyright ownership.
@@ -37,6 +64,7 @@ index 0000000000..69df73ce68
 +
 +#include "httpd.h"
 +#include "util_filter.h"
++#include "util_script.h"
 +
 +static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgi_pfn_gtv;
 +static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgi_pfn_ps;
@@ -439,9 +467,18 @@ index 0000000000..69df73ce68
 +        char sbuf[MAX_STRING_LEN];
 +        int ret;
 +
-+        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
-+                                                        APLOG_MODULE_INDEX)))
-+        {
++        ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
++                                                   APLOG_MODULE_INDEX);
++
++        /* xCGI has its own body framing mechanism which we don't
++         * match against any provided Content-Length, so let the
++         * core determine C-L vs T-E based on what's actually sent.
++         */
++        if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
++            apr_table_unset(r->headers_out, "Content-Length");
++        apr_table_unset(r->headers_out, "Transfer-Encoding");
++
++        if (ret != OK) {
 +            /* In the case of a timeout reading script output, clear
 +             * the brigade to avoid a second attempt to read the
 +             * output. */
@@ -659,10 +696,18 @@ index bf295217e0..086355353b 100644
 +
  APACHE_MODPATH_FINISH
 diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c
-index 7e4b126c10..421124a0cb 100644
+index 1f7778617e..3799b06ce3 100644
 --- a/modules/generators/mod_cgi.c
 +++ b/modules/generators/mod_cgi.c
-@@ -61,9 +61,6 @@
+@@ -48,7 +48,6 @@
+ #include "http_protocol.h"
+ #include "http_main.h"
+ #include "http_log.h"
+-#include "util_script.h"
+ #include "ap_mpm.h"
+ #include "mod_core.h"
+ #include "mod_cgi.h"
+@@ -61,9 +60,6 @@
  
  module AP_MODULE_DECLARE_DATA cgi_module;
  
@@ -672,14 +717,10 @@ index 7e4b126c10..421124a0cb 100644
  static APR_OPTIONAL_FN_TYPE(ap_cgi_build_command) *cgi_build_command;
  
  /* Read and discard the data in the brigade produced by a CGI script */
-@@ -92,6 +89,15 @@ typedef struct {
-     apr_size_t  bufbytes;
- } cgi_server_conf;
+@@ -96,6 +92,11 @@ typedef struct {
+     apr_interval_time_t timeout;
+ } cgi_dirconf;
  
-+typedef struct {
-+    apr_interval_time_t timeout;
-+} cgi_dirconf;
-+
 +#if APR_FILES_AS_SOCKETS
 +#define WANT_CGI_BUCKET
 +#endif
@@ -688,44 +729,7 @@ index 7e4b126c10..421124a0cb 100644
  static void *create_cgi_config(apr_pool_t *p, server_rec *s)
  {
      cgi_server_conf *c =
-@@ -112,6 +118,12 @@ static void *merge_cgi_config(apr_pool_t *p, void *basev, void *overridesv)
-     return overrides->logname ? overrides : base;
- }
- 
-+static void *create_cgi_dirconf(apr_pool_t *p, char *dummy)
-+{
-+    cgi_dirconf *c = (cgi_dirconf *) apr_pcalloc(p, sizeof(cgi_dirconf));
-+    return c;
-+}
-+
- static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg)
- {
-     server_rec *s = cmd->server;
-@@ -150,6 +162,17 @@ static const char *set_scriptlog_buffer(cmd_parms *cmd, void *dummy,
-     return NULL;
- }
- 
-+static const char *set_script_timeout(cmd_parms *cmd, void *dummy, const char *arg)
-+{
-+    cgi_dirconf *dc = dummy;
-+
-+    if (ap_timeout_parameter_parse(arg, &dc->timeout, "s") != APR_SUCCESS) {
-+        return "CGIScriptTimeout has wrong format";
-+    }
-+
-+    return NULL;
-+}
-+
- static const command_rec cgi_cmds[] =
- {
- AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF,
-@@ -158,67 +181,12 @@ AP_INIT_TAKE1("ScriptLogLength", set_scriptlog_length, NULL, RSRC_CONF,
-      "the maximum length (in bytes) of the script debug log"),
- AP_INIT_TAKE1("ScriptLogBuffer", set_scriptlog_buffer, NULL, RSRC_CONF,
-      "the maximum size (in bytes) to record of a POST request"),
-+AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_CONF,
-+     "The amount of time to wait between successful reads from "
-+     "the CGI script, in seconds."),
+@@ -185,64 +186,6 @@ AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_C
      {NULL}
  };
  
@@ -790,37 +794,7 @@ index 7e4b126c10..421124a0cb 100644
  static int log_script(request_rec *r, cgi_server_conf * conf, int ret,
                        char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
                        apr_file_t *script_err)
-@@ -466,23 +434,26 @@ static apr_status_t run_cgi_child(apr_file_t **script_out,
-                           apr_filepath_name_get(r->filename));
-         }
-         else {
-+            cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module);
-+            apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
-+
-             apr_pool_note_subprocess(p, procnew, APR_KILL_AFTER_TIMEOUT);
- 
-             *script_in = procnew->out;
-             if (!*script_in)
-                 return APR_EBADF;
--            apr_file_pipe_timeout_set(*script_in, r->server->timeout);
-+            apr_file_pipe_timeout_set(*script_in, timeout);
- 
-             if (e_info->prog_type == RUN_AS_CGI) {
-                 *script_out = procnew->in;
-                 if (!*script_out)
-                     return APR_EBADF;
--                apr_file_pipe_timeout_set(*script_out, r->server->timeout);
-+                apr_file_pipe_timeout_set(*script_out, timeout);
- 
-                 *script_err = procnew->err;
-                 if (!*script_err)
-                     return APR_EBADF;
--                apr_file_pipe_timeout_set(*script_err, r->server->timeout);
-+                apr_file_pipe_timeout_set(*script_err, timeout);
-             }
-         }
-     }
-@@ -536,234 +507,30 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv,
+@@ -563,230 +506,23 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv,
      return APR_SUCCESS;
  }
  
@@ -963,11 +937,14 @@ index 7e4b126c10..421124a0cb 100644
 -                                    apr_size_t *len, apr_read_type_e block)
 -{
 -    struct cgi_bucket_data *data = b->data;
--    apr_interval_time_t timeout;
+-    apr_interval_time_t timeout = 0;
 -    apr_status_t rv;
 -    int gotdata = 0;
+-    cgi_dirconf *dc = ap_get_module_config(data->r->per_dir_config, &cgi_module);
 -
--    timeout = block == APR_NONBLOCK_READ ? 0 : data->r->server->timeout;
+-    if (block != APR_NONBLOCK_READ) {
+-        timeout = dc->timeout > 0 ? dc->timeout : data->r->server->timeout;
+-    }
 -
 -    do {
 -        const apr_pollfd_t *results;
@@ -1048,10 +1025,10 @@ index 7e4b126c10..421124a0cb 100644
      apr_status_t rv;
      cgi_exec_info_t e_info;
 -    conn_rec *c;
-+    cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module);
-+    apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
+     cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module);
+     apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
  
-     if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
+@@ -794,8 +530,6 @@ static int cgi_handler(request_rec *r)
          return DECLINED;
      }
  
@@ -1060,7 +1037,7 @@ index 7e4b126c10..421124a0cb 100644
      is_included = !strcmp(r->protocol, "INCLUDED");
  
      p = r->main ? r->main->pool : r->pool;
-@@ -832,83 +599,24 @@ static int cgi_handler(request_rec *r)
+@@ -864,83 +598,24 @@ static int cgi_handler(request_rec *r)
          return HTTP_INTERNAL_SERVER_ERROR;
      }
  
@@ -1157,7 +1134,7 @@ index 7e4b126c10..421124a0cb 100644
      /* Is this flush really needed? */
      apr_file_flush(script_out);
      apr_file_close(script_out);
-@@ -916,10 +624,7 @@ static int cgi_handler(request_rec *r)
+@@ -948,10 +623,7 @@ static int cgi_handler(request_rec *r)
      AP_DEBUG_ASSERT(script_in != NULL);
  
  #if APR_FILES_AS_SOCKETS
@@ -1169,7 +1146,7 @@ index 7e4b126c10..421124a0cb 100644
      if (b == NULL)
          return HTTP_INTERNAL_SERVER_ERROR;
  #else
-@@ -929,111 +634,7 @@ static int cgi_handler(request_rec *r)
+@@ -961,120 +633,7 @@ static int cgi_handler(request_rec *r)
      b = apr_bucket_eos_create(c->bucket_alloc);
      APR_BRIGADE_INSERT_TAIL(bb, b);
  
@@ -1179,9 +1156,18 @@ index 7e4b126c10..421124a0cb 100644
 -        char sbuf[MAX_STRING_LEN];
 -        int ret;
 -
--        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
--                                                        APLOG_MODULE_INDEX)))
--        {
+-        ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+-                                                   APLOG_MODULE_INDEX);
+-
+-        /* xCGI has its own body framing mechanism which we don't
+-         * match against any provided Content-Length, so let the
+-         * core determine C-L vs T-E based on what's actually sent.
+-         */
+-        if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
+-            apr_table_unset(r->headers_out, "Content-Length");
+-        apr_table_unset(r->headers_out, "Transfer-Encoding");
+-
+-        if (ret != OK) {
 -            ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err);
 -
 -            /*
@@ -1220,7 +1206,7 @@ index 7e4b126c10..421124a0cb 100644
 -             * stderr output, as normal. */
 -            discard_script_output(bb);
 -            apr_brigade_destroy(bb);
--            apr_file_pipe_timeout_set(script_err, r->server->timeout);
+-            apr_file_pipe_timeout_set(script_err, timeout);
 -            log_script_err(r, script_err);
 -        }
 -
@@ -1271,7 +1257,7 @@ index 7e4b126c10..421124a0cb 100644
 -     * connection drops or we stopped sending output for some other
 -     * reason */
 -    if (rv == APR_SUCCESS && !r->connection->aborted) {
--        apr_file_pipe_timeout_set(script_err, r->server->timeout);
+-        apr_file_pipe_timeout_set(script_err, timeout);
 -        log_script_err(r, script_err);
 -    }
 -
@@ -1282,7 +1268,7 @@ index 7e4b126c10..421124a0cb 100644
  }
  
  /*============================================================================
-@@ -1147,107 +748,9 @@ static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f,
+@@ -1188,107 +747,9 @@ static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f,
      return APR_SUCCESS;
  }
  
@@ -1390,7 +1376,7 @@ index 7e4b126c10..421124a0cb 100644
      /* This is the means by which unusual (non-unix) os's may find alternate
       * means to run a given command (e.g. shebang/registry parsing on Win32)
       */
-@@ -1263,12 +766,13 @@ static void register_hooks(apr_pool_t *p)
+@@ -1304,6 +765,7 @@ static void register_hooks(apr_pool_t *p)
      static const char * const aszPre[] = { "mod_include.c", NULL };
      ap_hook_handler(cgi_handler, NULL, NULL, APR_HOOK_MIDDLE);
      ap_hook_post_config(cgi_post_config, aszPre, NULL, APR_HOOK_REALLY_FIRST);
@@ -1398,18 +1384,19 @@ index 7e4b126c10..421124a0cb 100644
  }
  
  AP_DECLARE_MODULE(cgi) =
- {
-     STANDARD20_MODULE_STUFF,
--    NULL,                        /* dir config creater */
-+    create_cgi_dirconf,          /* dir config creater */
-     NULL,                        /* dir merger --- default is to override */
-     create_cgi_config,           /* server config */
-     merge_cgi_config,            /* merge server config */
 diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c
-index 2258a683b7..dddfb25254 100644
+index 4bab59f932..1d55b8dc48 100644
 --- a/modules/generators/mod_cgid.c
 +++ b/modules/generators/mod_cgid.c
-@@ -80,11 +80,6 @@ module AP_MODULE_DECLARE_DATA cgid_module;
+@@ -57,7 +57,6 @@
+ #include "http_protocol.h"
+ #include "http_main.h"
+ #include "http_log.h"
+-#include "util_script.h"
+ #include "ap_mpm.h"
+ #include "mpm_common.h"
+ #include "mod_suexec.h"
+@@ -80,11 +79,6 @@ module AP_MODULE_DECLARE_DATA cgid_module;
  
  static int cgid_start(apr_pool_t *p, server_rec *main_server, apr_proc_t *procnew);
  static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *main_server);
@@ -1421,7 +1408,7 @@ index 2258a683b7..dddfb25254 100644
  
  static apr_pool_t *pcgi = NULL;
  static pid_t daemon_pid;
-@@ -220,6 +215,15 @@ typedef struct {
+@@ -220,6 +214,15 @@ typedef struct {
  #endif
  } cgid_req_t;
  
@@ -1437,7 +1424,7 @@ index 2258a683b7..dddfb25254 100644
  /* This routine is called to create the argument list to be passed
   * to the CGI script.  When suexec is enabled, the suexec path, user, and
   * group are the first three arguments to be passed; if not, all three
-@@ -342,15 +346,19 @@ static apr_status_t close_unix_socket(void *thefd)
+@@ -342,15 +345,19 @@ static apr_status_t close_unix_socket(void *thefd)
      return close(fd);
  }
  
@@ -1462,7 +1449,7 @@ index 2258a683b7..dddfb25254 100644
      do {
          do {
              rc = read(fd, buf + bytes_read, buf_size - bytes_read);
-@@ -365,9 +373,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
+@@ -365,9 +372,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
          }
      } while (bytes_read < buf_size);
  
@@ -1523,7 +1510,7 @@ index 2258a683b7..dddfb25254 100644
  /* deal with signals
   */
  static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
-@@ -384,7 +443,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
+@@ -384,7 +442,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
      return APR_SUCCESS;
  }
  
@@ -1532,7 +1519,7 @@ index 2258a683b7..dddfb25254 100644
  {
      va_list ap;
      int rc;
-@@ -399,9 +458,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
+@@ -399,9 +457,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
      }
      va_end(ap);
  
@@ -1572,7 +1559,7 @@ index 2258a683b7..dddfb25254 100644
      if (rc < 0) {
          return errno;
      }
-@@ -410,7 +499,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
+@@ -410,7 +498,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
  }
  
  static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
@@ -1581,7 +1568,7 @@ index 2258a683b7..dddfb25254 100644
  {
      int i;
      char **environ;
-@@ -421,7 +510,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
+@@ -421,7 +509,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
      r->server = apr_pcalloc(r->pool, sizeof(server_rec));
  
      /* read the request header */
@@ -1590,7 +1577,7 @@ index 2258a683b7..dddfb25254 100644
      if (stat != APR_SUCCESS) {
          return stat;
      }
-@@ -431,6 +520,14 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
+@@ -431,6 +519,14 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
          return APR_SUCCESS;
      }
  
@@ -1605,7 +1592,7 @@ index 2258a683b7..dddfb25254 100644
      /* handle module indexes and such */
      rconf = (void **)ap_create_request_config(r->pool);
  
-@@ -479,14 +576,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
+@@ -479,14 +575,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
      return APR_SUCCESS;
  }
  
@@ -1623,7 +1610,7 @@ index 2258a683b7..dddfb25254 100644
  
  
      if (ugid == NULL) {
-@@ -507,16 +605,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
+@@ -507,16 +604,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
      req.args_len = r->args ? strlen(r->args) : 0;
      req.loglevel = r->server->log.level;
  
@@ -1647,7 +1634,7 @@ index 2258a683b7..dddfb25254 100644
                             &req, sizeof(req),
                             r->filename, req.filename_len,
                             argv0, req.argv0_len,
-@@ -531,7 +634,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
+@@ -531,7 +633,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
      for (i = 0; i < req.env_count; i++) {
          apr_size_t curlen = strlen(env[i]);
  
@@ -1656,7 +1643,7 @@ index 2258a683b7..dddfb25254 100644
                                  env[i], curlen)) != APR_SUCCESS) {
              return stat;
          }
-@@ -582,20 +685,34 @@ static void daemon_signal_handler(int sig)
+@@ -582,20 +684,34 @@ static void daemon_signal_handler(int sig)
      }
  }
  
@@ -1699,7 +1686,7 @@ index 2258a683b7..dddfb25254 100644
  }
  
  static int cgid_server(void *data)
-@@ -670,7 +787,7 @@ static int cgid_server(void *data)
+@@ -670,7 +786,7 @@ static int cgid_server(void *data)
      }
  
      while (!daemon_should_exit) {
@@ -1708,7 +1695,7 @@ index 2258a683b7..dddfb25254 100644
          char *argv0 = NULL;
          char **env = NULL;
          const char * const *argv;
-@@ -710,7 +827,7 @@ static int cgid_server(void *data)
+@@ -710,7 +826,7 @@ static int cgid_server(void *data)
          r = apr_pcalloc(ptrans, sizeof(request_rec));
          procnew = apr_pcalloc(ptrans, sizeof(*procnew));
          r->pool = ptrans;
@@ -1717,7 +1704,7 @@ index 2258a683b7..dddfb25254 100644
          if (stat != APR_SUCCESS) {
              ap_log_error(APLOG_MARK, APLOG_ERR, stat,
                           main_server, APLOGNO(01248)
-@@ -742,6 +859,16 @@ static int cgid_server(void *data)
+@@ -742,6 +858,16 @@ static int cgid_server(void *data)
              continue;
          }
  
@@ -1734,7 +1721,7 @@ index 2258a683b7..dddfb25254 100644
          apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool);
          apr_os_file_put(&inout, &sd2, 0, r->pool);
  
-@@ -801,7 +928,10 @@ static int cgid_server(void *data)
+@@ -801,7 +927,10 @@ static int cgid_server(void *data)
              close(sd2);
          }
          else {
@@ -1746,7 +1733,7 @@ index 2258a683b7..dddfb25254 100644
  
              argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args);
  
-@@ -946,16 +1076,6 @@ static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp,
+@@ -946,16 +1075,6 @@ static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp,
          if (ret != OK ) {
              return ret;
          }
@@ -1763,7 +1750,7 @@ index 2258a683b7..dddfb25254 100644
      }
      return ret;
  }
-@@ -1066,41 +1186,6 @@ static const command_rec cgid_cmds[] =
+@@ -1066,41 +1185,6 @@ static const command_rec cgid_cmds[] =
      {NULL}
  };
  
@@ -1805,7 +1792,7 @@ index 2258a683b7..dddfb25254 100644
  static int log_script(request_rec *r, cgid_server_conf * conf, int ret,
                        char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
                        apr_file_t *script_err)
-@@ -1221,7 +1306,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
+@@ -1221,7 +1305,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
          ++connect_tries;
          if ((sd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {
              return log_scripterror(r, conf, HTTP_INTERNAL_SERVER_ERROR, errno,
@@ -1814,7 +1801,7 @@ index 2258a683b7..dddfb25254 100644
          }
          if (connect(sd, (struct sockaddr *)server_addr, server_addr_len) < 0) {
              /* Save errno for later */
-@@ -1242,7 +1327,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
+@@ -1242,7 +1326,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
              }
              else {
                  close(sd);
@@ -1823,7 +1810,7 @@ index 2258a683b7..dddfb25254 100644
                                         "unable to connect to cgi daemon after multiple tries");
              }
          }
-@@ -1258,13 +1343,15 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
+@@ -1258,13 +1342,15 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
          if (connect_errno == ENOENT &&
              apr_time_sec(apr_time_now() - ap_scoreboard_image->global->restart_time) > 
                  DEFAULT_CONNECT_STARTUP_DELAY) {
@@ -1842,7 +1829,7 @@ index 2258a683b7..dddfb25254 100644
                                     "cgid daemon is gone; is Apache terminating?");
          }
      }
-@@ -1272,23 +1359,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
+@@ -1272,23 +1358,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
      return OK;
  }
  
@@ -1866,7 +1853,7 @@ index 2258a683b7..dddfb25254 100644
  /****************************************************************
   *
   * Actual cgid handling...
-@@ -1374,7 +1444,9 @@ static apr_status_t get_cgi_pid(request_rec *r,  cgid_server_conf *conf, pid_t *
+@@ -1374,7 +1443,9 @@ static apr_status_t get_cgi_pid(request_rec *r,  cgid_server_conf *conf, pid_t *
          return stat;
      }
  
@@ -1877,7 +1864,7 @@ index 2258a683b7..dddfb25254 100644
          ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01261)
                        "daemon couldn't find CGI process for connection %lu",
                        r->connection->id);
-@@ -1393,19 +1465,21 @@ static apr_status_t cleanup_script(void *vptr)
+@@ -1393,19 +1464,21 @@ static apr_status_t cleanup_script(void *vptr)
  
  static int cgid_handler(request_rec *r)
  {
@@ -1903,7 +1890,7 @@ index 2258a683b7..dddfb25254 100644
  
      if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
          return DECLINED;
-@@ -1414,7 +1488,7 @@ static int cgid_handler(request_rec *r)
+@@ -1414,7 +1487,7 @@ static int cgid_handler(request_rec *r)
      conf = ap_get_module_config(r->server->module_config, &cgid_module);
      dc = ap_get_module_config(r->per_dir_config, &cgid_module);
  
@@ -1912,7 +1899,7 @@ index 2258a683b7..dddfb25254 100644
      is_included = !strcmp(r->protocol, "INCLUDED");
  
      if ((argv0 = strrchr(r->filename, '/')) != NULL) {
-@@ -1429,12 +1503,12 @@ static int cgid_handler(request_rec *r)
+@@ -1429,12 +1502,12 @@ static int cgid_handler(request_rec *r)
      argv0 = r->filename;
  
      if (!(ap_allow_options(r) & OPT_EXECCGI) && !is_scriptaliased(r)) {
@@ -1927,7 +1914,7 @@ index 2258a683b7..dddfb25254 100644
                  "attempt to include NPH CGI script");
      }
  
-@@ -1443,12 +1517,12 @@ static int cgid_handler(request_rec *r)
+@@ -1443,12 +1516,12 @@ static int cgid_handler(request_rec *r)
  #error at mod_cgi.c for required code in this path.
  #else
      if (r->finfo.filetype == APR_NOFILE) {
@@ -1942,7 +1929,7 @@ index 2258a683b7..dddfb25254 100644
                  "attempt to invoke directory as script");
      }
  
-@@ -1456,7 +1530,7 @@ static int cgid_handler(request_rec *r)
+@@ -1456,7 +1529,7 @@ static int cgid_handler(request_rec *r)
          r->path_info && *r->path_info)
      {
          /* default to accept */
@@ -1951,7 +1938,7 @@ index 2258a683b7..dddfb25254 100644
                                 "AcceptPathInfo off disallows user's path");
      }
      /*
-@@ -1467,6 +1541,17 @@ static int cgid_handler(request_rec *r)
+@@ -1467,6 +1540,17 @@ static int cgid_handler(request_rec *r)
      }
      */
  
@@ -1969,7 +1956,7 @@ index 2258a683b7..dddfb25254 100644
      /*
       * httpd core function used to add common environment variables like
       * DOCUMENT_ROOT. 
-@@ -1479,24 +1564,28 @@ static int cgid_handler(request_rec *r)
+@@ -1479,24 +1563,28 @@ static int cgid_handler(request_rec *r)
          return retval;
      }
  
@@ -2005,7 +1992,7 @@ index 2258a683b7..dddfb25254 100644
      }
  
      /* We are putting the socket discriptor into an apr_file_t so that we can
-@@ -1506,95 +1595,25 @@ static int cgid_handler(request_rec *r)
+@@ -1506,95 +1594,25 @@ static int cgid_handler(request_rec *r)
       */
  
      apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
@@ -2114,7 +2101,7 @@ index 2258a683b7..dddfb25254 100644
      }
  
      /* we're done writing, or maybe we didn't write at all;
-@@ -1603,125 +1622,22 @@ static int cgid_handler(request_rec *r)
+@@ -1603,134 +1621,22 @@ static int cgid_handler(request_rec *r)
       */
      shutdown(sd, 1);
  
@@ -2131,9 +2118,18 @@ index 2258a683b7..dddfb25254 100644
 -        b = apr_bucket_eos_create(c->bucket_alloc);
 -        APR_BRIGADE_INSERT_TAIL(bb, b);
 -
--        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
--                                                        APLOG_MODULE_INDEX)))
--        {
+-        ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+-                                                   APLOG_MODULE_INDEX);
+-
+-        /* xCGI has its own body framing mechanism which we don't
+-         * match against any provided Content-Length, so let the
+-         * core determine C-L vs T-E based on what's actually sent.
+-         */
+-        if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
+-            apr_table_unset(r->headers_out, "Content-Length");
+-        apr_table_unset(r->headers_out, "Transfer-Encoding");
+-
+-        if (ret != OK) {
 -            ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL);
 -
 -            /*
@@ -2253,7 +2249,7 @@ index 2258a683b7..dddfb25254 100644
  static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
                                  apr_bucket_brigade *bb, char *s)
  {
-@@ -1806,7 +1722,7 @@ static void add_ssi_vars(request_rec *r)
+@@ -1815,7 +1721,7 @@ static void add_ssi_vars(request_rec *r)
  }
  
  static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
@@ -2262,7 +2258,7 @@ index 2258a683b7..dddfb25254 100644
  {
      char **env;
      int sd;
-@@ -1827,7 +1743,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
+@@ -1836,7 +1742,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
          return retval;
      }
  
@@ -2271,7 +2267,7 @@ index 2258a683b7..dddfb25254 100644
  
      info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
      info->conf = conf;
-@@ -1872,91 +1788,6 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
+@@ -1881,91 +1787,6 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
      return APR_SUCCESS;
  }
  
@@ -2363,7 +2359,7 @@ index 2258a683b7..dddfb25254 100644
  static void register_hook(apr_pool_t *p)
  {
      static const char * const aszPre[] = { "mod_include.c", NULL };
-@@ -1964,6 +1795,7 @@ static void register_hook(apr_pool_t *p)
+@@ -1973,6 +1794,7 @@ static void register_hook(apr_pool_t *p)
      ap_hook_pre_config(cgid_pre_config, NULL, NULL, APR_HOOK_MIDDLE);
      ap_hook_post_config(cgid_init, aszPre, NULL, APR_HOOK_MIDDLE);
      ap_hook_handler(cgid_handler, NULL, NULL, APR_HOOK_MIDDLE);
diff --git a/httpd.spec b/httpd.spec
index 048057d..7bb8b5a 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -23,8 +23,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.58
-Release: 8%{?dist}
+Version: 2.4.59
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -85,27 +85,22 @@ Patch20: httpd-2.4.48-r1842929+.patch
 Patch21: httpd-2.4.43-mod_systemd.patch
 Patch22: httpd-2.4.53-export.patch
 Patch23: httpd-2.4.43-corelimit.patch
-Patch24: httpd-2.4.54-gettid.patch
+Patch24: httpd-2.4.59-gettid.patch
 Patch25: httpd-2.4.54-icons.patch
 Patch26: httpd-2.4.43-cachehardmax.patch
 Patch27: httpd-2.4.43-socket-activation.patch
 Patch28: httpd-2.4.43-sslciphdefault.patch
 Patch29: httpd-2.4.43-sslprotdefault.patch
-Patch30: httpd-2.4.43-r1861793+.patch
-Patch31: httpd-2.4.48-r1828172+.patch
+Patch31: httpd-2.4.59-unifycgid.patch
 Patch32: httpd-2.4.43-logjournal.patch
 Patch33: httpd-2.4.53-separate-systemd-fns.patch
 Patch34: httpd-2.4.58-r1912477+.patch
-Patch35: httpd-2.4.58-r1913912+.patch
 Patch36: httpd-2.4.58-r1914365.patch
 Patch37: httpd-2.4.54-selinux.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
-Patch61: httpd-2.4.58-r1914013.patch
-Patch62: httpd-2.4.46-htcacheclean-dont-break.patch
-Patch63: httpd-2.4.51-r1894152.patch
 
 # Security fixes
 # Patch200: ...
@@ -829,6 +824,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Apr  5 2024 Joe Orton <jorton@redhat.com> - 2.4.59-1
+- update to 2.4.59
+
 * Thu Mar 28 2024 Joe Orton <jorton@redhat.com> - 2.4.58-8
 - rebuild to fix changelog ordering
 
diff --git a/sources b/sources
index 8ac3947..e8e92fb 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.58.tar.bz2) = d6e73bf413a507ec16b621ff635e178206207a9e9810ce3944b3dc98d39cde8f225307110167fc9da5822175796c8cb66f98be5b9f0d8b76dcd83a401d39b2c1
-SHA512 (httpd-2.4.58.tar.bz2.asc) = aa021b067fc84ae6a09d5ce321207622c6c08f22632ac7362318ca0505b84357d77d4ebc1f17fa2c3030ed9d9fd177e8fb989932caeef695e76936e010b63aa0
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192
+SHA512 (httpd-2.4.59.tar.bz2) = 209da0bbac5e2564d4590302515b35495be6402273ff4024aa93e85e44554c95e053201d606383936425a41e1b5b97e6b40055dcbb385eb691a5029a6f3158c2
+SHA512 (httpd-2.4.59.tar.bz2.asc) = 85237e204e57d930e2b7a85a21f8d593e81895f96350c3a345978538a536f3c0614ba89256905c0aa558880fc6fb10608b8dd7cbd026af326b1d83601c267f2d

From 26cf4a8749501f156c4984ec9c4f6f17449ee09a Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 15 Apr 2024 09:03:50 +0100
Subject: [PATCH 324/359] mod_ssl: add DH param handling fix (r1916863)

---
 httpd-2.4.59-r1916863.patch | 54 +++++++++++++++++++++++++++++++++++++
 httpd.spec                  |  6 ++++-
 pullrev.sh                  |  4 +--
 3 files changed, 61 insertions(+), 3 deletions(-)
 create mode 100644 httpd-2.4.59-r1916863.patch

diff --git a/httpd-2.4.59-r1916863.patch b/httpd-2.4.59-r1916863.patch
new file mode 100644
index 0000000..162662c
--- /dev/null
+++ b/httpd-2.4.59-r1916863.patch
@@ -0,0 +1,54 @@
+# ./pullrev.sh 1916863
+http://svn.apache.org/viewvc?view=revision&revision=1916863
+
+Upstream-Status: in trunk, not proposed for 2.4.x
+
+--- httpd-2.4.59/modules/ssl/ssl_engine_init.c
++++ httpd-2.4.59/modules/ssl/ssl_engine_init.c
+@@ -1416,6 +1416,7 @@
+     const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile;
+     int i;
+     EVP_PKEY *pkey;
++    int custom_dh_done = 0;
+ #ifdef HAVE_ECC
+     EC_GROUP *ecgroup = NULL;
+     int curve_nid = 0;
+@@ -1591,14 +1592,14 @@
+      */
+     certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *);
+     if (certfile && !modssl_is_engine_id(certfile)) {
+-        int done = 0, num_bits = 0;
++        int num_bits = 0;
+ #if OPENSSL_VERSION_NUMBER < 0x30000000L
+         DH *dh = modssl_dh_from_file(certfile);
+         if (dh) {
+             num_bits = DH_bits(dh);
+             SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh);
+             DH_free(dh);
+-            done = 1;
++            custom_dh_done = 1;
+         }
+ #else
+         pkey = modssl_dh_pkey_from_file(certfile);
+@@ -1608,18 +1609,18 @@
+                 EVP_PKEY_free(pkey);
+             }
+             else {
+-                done = 1;
++                custom_dh_done = 1;
+             }
+         }
+ #endif
+-        if (done) {
++        if (custom_dh_done) {
+             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
+                          "Custom DH parameters (%d bits) for %s loaded from %s",
+                          num_bits, vhost_id, certfile);
+         }
+     }
+ #if !MODSSL_USE_OPENSSL_PRE_1_1_API
+-    else {
++    if (!custom_dh_done) {
+         /* If no parameter is manually configured, enable auto
+          * selection. */
+         SSL_CTX_set_dh_auto(mctx->ssl_ctx, 1);
diff --git a/httpd.spec b/httpd.spec
index 7bb8b5a..864c8b7 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -24,7 +24,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.59
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -101,6 +101,7 @@ Patch37: httpd-2.4.54-selinux.patch
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
+Patch61: httpd-2.4.59-r1916863.patch
 
 # Security fixes
 # Patch200: ...
@@ -824,6 +825,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Apr 15 2024 Joe Orton <jorton@redhat.com> - 2.4.59-2
+- mod_ssl: add DH param handling fix (r1916863)
+
 * Fri Apr  5 2024 Joe Orton <jorton@redhat.com> - 2.4.59-1
 - update to 2.4.59
 
diff --git a/pullrev.sh b/pullrev.sh
index 7ace161..f21a7fb 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then
 fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
-repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.58
+#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+ver=2.4.59
 prefix="httpd-${ver}"
 suffix="${SUFFIX:-r$1${2:++}}"
 fn="${prefix}-${suffix}.patch"

From c83c1cdcee789c8f509204448b8b1f7c62295c49 Mon Sep 17 00:00:00 2001
From: Michal Srb <msrb@redhat.com>
Date: Wed, 17 Apr 2024 15:36:18 +0000
Subject: [PATCH 325/359] Fix rpminspect.yaml syntax

Any entries in the upstream inspection block that contain wildcards for glob(7) specification need to be wrapped in single quotes.

We are also changing the badfuncs block to allow the specific function in mod_proxy.so rather than ignoring the entire file.

Thanks to David Cantrell who discovered this problem (in OSCI-6724) and proposed the fix.
---
 rpminspect.yaml | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/rpminspect.yaml b/rpminspect.yaml
index 17e48d1..7696d42 100644
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@@ -2,20 +2,21 @@
 badfuncs:
   # mod_proxy uses inet_ntoa (safely) for IPv4 address matching,
   # and APR interfaces for IPv6 addresses.
-  ignore:
-    - /usr/lib*/httpd/modules/mod_proxy.so
+  allowed:
+    /usr/lib*/httpd/modules/mod_proxy.so:
+      - inet_ntoa
 upstream:
   ignore:
-    - *.xml
-    - *.service
-    - *.socket
-    - *.conf
-    - *.sysconf
-    - *.tmpfiles
-    - README.*
-    - *.sysusers
-    - *.png
-    - httpd-ssl-*
+    - '*.xml'
+    - '*.service'
+    - '*.socket'
+    - '*.conf'
+    - '*.sysconf'
+    - '*.tmpfiles'
+    - 'README.*'
+    - '*.sysusers'
+    - '*.png'
+    - 'httpd-ssl-*'
     - config.layout
-    - action*.sh
-    - apachectl.*
+    - 'action*.sh'
+    - 'apachectl.*'

From 53ecf37db77bbc8f033dfabe31590005d2c666f9 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 3 May 2024 08:59:53 +0100
Subject: [PATCH 326/359] apachectl(8): use BUG_REPORT_URL from /etc/os-release
 apachectl(8): fix grammar (#2278748) httpd.service.xml(8): mention
 ProtectSystem= setting

---
 apachectl.xml     |  5 +++--
 httpd.service.xml | 11 +++++++++--
 httpd.spec        | 13 +++++++++----
 3 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/apachectl.xml b/apachectl.xml
index 34da42c..fb3a86d 100644
--- a/apachectl.xml
+++ b/apachectl.xml
@@ -5,6 +5,7 @@
 ]>
 <!--
  Copyright 2020 Red Hat, Inc.
+ Copyright 2018 Frank Dana
 
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements. See the NOTICE file distributed with
@@ -70,7 +71,7 @@
 
       <para>The version of <command>apachectl</command> used on this
       system is a replacement script intended to be mostly (but not
-      completely) compatible with version provided with
+      completely) compatible with the version provided with
       <emphasis>Apache httpd</emphasis>.  This
       <command>apachectl</command> mostly acts as a wrapper around
       <command>systemctl</command> and manipulates the
@@ -173,7 +174,7 @@
 
   <refsect1 id='bugs'>
     <title>Bugs</title>
-    <para>Please report bugs by filing an issue in Bugzilla via <ulink url='https://bugzilla.redhat.com/'/>.</para>
+    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
   </refsect1>
 
     <refsect1>
diff --git a/httpd.service.xml b/httpd.service.xml
index 3ddbc9e..f8ec343 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -233,8 +233,8 @@ Wants=network-online.target</programlisting>
 
       <para>The <command>httpd.service</command> unit enables a
       variety of sandboxing options. Many of these prevent the service
-      from changing the system configuration - such as
-      <emphasis>ProtectClock</emphasis> and
+      from changing the system configuration or attributes of the
+      kernel - such as <emphasis>ProtectClock</emphasis> and
       <emphasis>ProtectKernelModules</emphasis>. See
       <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
       and
@@ -262,6 +262,13 @@ Wants=network-online.target</programlisting>
         <emphasis>UserDir</emphasis> will not be able modify any
         content in <filename>/home</filename> by
         default.</para></listitem>
+
+        <listitem><para><emphasis>ProtectSystem</emphasis> is set to
+        <emphasis>yes</emphasis> by default; this mounts various
+        system paths like <filename>/usr</filename> and
+        <filename>/boot</filename> as read-only by
+        default.</para></listitem>
+
       </itemizedlist></para>
 
     </refsect2>
diff --git a/httpd.spec b/httpd.spec
index 864c8b7..e40ab8a 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -4,6 +4,7 @@
 %define mmn 20120211
 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits}
 %define vstring %(source /etc/os-release; echo ${NAME})
+%define bugurl %(source /etc/os-release; echo ${BUG_REPORT_URL})
 %if 0%{?fedora} > 26 || 0%{?rhel} > 7
 %global mpm event
 %else
@@ -24,7 +25,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.59
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -289,13 +290,12 @@ s,@DOCROOT@,%{docroot},g
 s,@LOGDIR@,%{_localstatedir}/log/httpd,g
 ' < $RPM_SOURCE_DIR/httpd.conf.xml \
     > httpd.conf.xml
+sed 's|@BUG_REPORT_URL@|%{bugurl}|g' < $RPM_SOURCE_DIR/apachectl.xml > apachectl.xml
 
 xmlto man ./httpd.conf.xml
 xmlto man $RPM_SOURCE_DIR/htcacheclean.service.xml
 xmlto man $RPM_SOURCE_DIR/httpd.service.xml
-
-# apachectl.xml => apachectl.8
-xmlto man %{SOURCE47}
+xmlto man apachectl.xml
 
 : Building with MMN %{mmn}, MMN-ISA %{mmnisa}
 : Default MPM is %{mpm}, vendor string is '%{vstring}'
@@ -825,6 +825,11 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri May  3 2024 Joe Orton <jorton@redhat.com> - 2.4.59-3
+- apachectl(8): use BUG_REPORT_URL from /etc/os-release
+- apachectl(8): fix grammar (#2278748)
+- httpd.service.xml(8): mention ProtectSystem= setting
+
 * Mon Apr 15 2024 Joe Orton <jorton@redhat.com> - 2.4.59-2
 - mod_ssl: add DH param handling fix (r1916863)
 

From 72c8812120b423fe8a1b6dd473731b2394c98b57 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 8 May 2024 15:33:35 +0100
Subject: [PATCH 327/359] Patch tracking updates.

---
 httpd-2.4.43-deplibs.patch   | 3 +++
 httpd-2.4.53-export.patch    | 3 +++
 httpd-2.4.59-gettid.patch    | 2 +-
 httpd-2.4.59-unifycgid.patch | 2 ++
 4 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/httpd-2.4.43-deplibs.patch b/httpd-2.4.43-deplibs.patch
index c60f5a5..85b65dc 100644
--- a/httpd-2.4.43-deplibs.patch
+++ b/httpd-2.4.43-deplibs.patch
@@ -1,3 +1,6 @@
+
+Upstream-Status: local customisation, not needed upstream
+
 diff --git a/configure.in b/configure.in
 index f8f9442..f276550 100644
 --- a/configure.in
diff --git a/httpd-2.4.53-export.patch b/httpd-2.4.53-export.patch
index d240360..db5606e 100644
--- a/httpd-2.4.53-export.patch
+++ b/httpd-2.4.53-export.patch
@@ -1,3 +1,6 @@
+
+Upstream-Status: r1861685 in trunk, not proposed for 2.4.x
+
 diff --git a/Makefile.in b/Makefile.in
 index bd8045c..d6733a5 100644
 --- a/Makefile.in
diff --git a/httpd-2.4.59-gettid.patch b/httpd-2.4.59-gettid.patch
index 4857e37..fb1e549 100644
--- a/httpd-2.4.59-gettid.patch
+++ b/httpd-2.4.59-gettid.patch
@@ -1,5 +1,5 @@
 
-Upstream-Status: not pushed upstream
+Upstream-Status: r1917578 in trunk, proposed for 2.4.60
 
 --- httpd-2.4.54/server/log.c.gettid
 +++ httpd-2.4.54/server/log.c
diff --git a/httpd-2.4.59-unifycgid.patch b/httpd-2.4.59-unifycgid.patch
index 54216e0..0348b61 100644
--- a/httpd-2.4.59-unifycgid.patch
+++ b/httpd-2.4.59-unifycgid.patch
@@ -1,6 +1,8 @@
 
 https://github.com/apache/httpd/pull/209
 
+Upstream-Status: in trunk, proposed for 2.4.60
+
 diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
 index ddacd4af19..6d4379d165 100644
 --- a/.github/workflows/linux.yml

From cb9044baa2d9e45b551c97ccd028f61bee21828c Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 17 May 2024 10:10:06 +0100
Subject: [PATCH 328/359] - add a "Reporting Bugs" section to all custom man
 pages

---
 apachectl.xml            |  2 +-
 htcacheclean.service.xml |  5 +++++
 httpd.conf.xml           |  5 +++++
 httpd.service.xml        |  7 ++++++-
 httpd.spec               | 15 ++++++---------
 5 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/apachectl.xml b/apachectl.xml
index fb3a86d..217fbda 100644
--- a/apachectl.xml
+++ b/apachectl.xml
@@ -173,7 +173,7 @@
   </refsect1>
 
   <refsect1 id='bugs'>
-    <title>Bugs</title>
+    <title>Reporting Bugs</title>
     <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
   </refsect1>
 
diff --git a/htcacheclean.service.xml b/htcacheclean.service.xml
index 01b68e4..c2a98d1 100644
--- a/htcacheclean.service.xml
+++ b/htcacheclean.service.xml
@@ -106,6 +106,11 @@
     <filename>/etc/sysconfig/htcacheclean</filename></para>
   </refsect1>
 
+  <refsect1>
+    <title>Reporting Bugs</title>
+    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
+  </refsect1>
+
   <refsect1>
     <title>See also</title>
 
diff --git a/httpd.conf.xml b/httpd.conf.xml
index 13e5d69..5405017 100644
--- a/httpd.conf.xml
+++ b/httpd.conf.xml
@@ -241,6 +241,11 @@
       <filename>/etc/httpd/conf.modules.d</filename>
     </para>
   </refsect1>
+
+  <refsect1>
+    <title>Reporting Bugs</title>
+    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
+  </refsect1>
   
   <refsect1>
     <title>See also</title>
diff --git a/httpd.service.xml b/httpd.service.xml
index f8ec343..610b34c 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -368,7 +368,12 @@ ReloadPropagatedFrom=httpd.service</programlisting>
     <filename>/usr/lib/systemd/system/httpd@.service</filename>,
     <filename>/etc/systemd/systemd/httpd.service.d</filename></para>
   </refsect1>
-  
+
+  <refsect1>
+    <title>Reporting Bugs</title>
+    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
+  </refsect1>
+
   <refsect1>
     <title>See also</title>
 
diff --git a/httpd.spec b/httpd.spec
index e40ab8a..8da27de 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -284,18 +284,15 @@ cp %{SOURCE48} ./docs/icons/apache_pb3.png
 # Provide default layout
 cp $RPM_SOURCE_DIR/config.layout .
 
-sed '
+for f in httpd.conf htcacheclean.service httpd.service apachectl; do
+   sed '
 s,@MPM@,%{mpm},g
 s,@DOCROOT@,%{docroot},g
 s,@LOGDIR@,%{_localstatedir}/log/httpd,g
-' < $RPM_SOURCE_DIR/httpd.conf.xml \
-    > httpd.conf.xml
-sed 's|@BUG_REPORT_URL@|%{bugurl}|g' < $RPM_SOURCE_DIR/apachectl.xml > apachectl.xml
-
-xmlto man ./httpd.conf.xml
-xmlto man $RPM_SOURCE_DIR/htcacheclean.service.xml
-xmlto man $RPM_SOURCE_DIR/httpd.service.xml
-xmlto man apachectl.xml
+s|@BUG_REPORT_URL@|%{bugurl}|g
+' < $RPM_SOURCE_DIR/${f}.xml > ${f}.xml
+   xmlto man ${f}.xml
+done
 
 : Building with MMN %{mmn}, MMN-ISA %{mmnisa}
 : Default MPM is %{mpm}, vendor string is '%{vstring}'

From 6900761be4402e819e77db8c798aca461e3e9841 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 23 May 2024 16:44:31 +0100
Subject: [PATCH 329/359] mod_ssl: add engine bcond, disable ENGINE support by
 default for F41+

---
 httpd.spec | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 8da27de..8cb3825 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -19,13 +19,19 @@
 %bcond_without pcre
 %endif
 
+%if 0%{?fedora} > 40 || 0%{?rhel} > 9
+%bcond_with engine
+%else
+%bcond_without engine
+%endif
+
 # Similar issue to https://bugzilla.redhat.com/show_bug.cgi?id=2043092
 %undefine _package_note_flags
 
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.59
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -259,6 +265,12 @@ sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
 # Prevent use of setcap in "install-suexec-caps" target.
 sed -i '/suexec/s,setcap ,echo Skipping setcap for ,' Makefile.in
 
+%if %{without engine}
+: Forcibly disable ENGINE support in mod_ssl
+sed -i.engine '/^#define MODSSL_HAVE_ENGINE_API/{s/1/0/}' modules/ssl/ssl_private.h
+! diff -u modules/ssl/ssl_private.h{.engine,}
+%endif
+
 # Example conf for instances
 cp $RPM_SOURCE_DIR/instance.conf .
 sed < $RPM_SOURCE_DIR/httpd.conf >> instance.conf '
@@ -297,6 +309,7 @@ done
 : Building with MMN %{mmn}, MMN-ISA %{mmnisa}
 : Default MPM is %{mpm}, vendor string is '%{vstring}'
 : Regex Engine: PCRE=%{with pcre} PCRE2=%{with pcre2}
+: mod_ssl ENGINE support: %{with engine}
 
 %build
 # forcibly prevent use of bundled apr, apr-util, pcre
@@ -822,6 +835,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu May 23 2024 Joe Orton <jorton@redhat.com> - 2.4.59-4
+- mod_ssl: add engine bcond, disable ENGINE support by default for F41+
+
 * Fri May  3 2024 Joe Orton <jorton@redhat.com> - 2.4.59-3
 - apachectl(8): use BUG_REPORT_URL from /etc/os-release
 - apachectl(8): fix grammar (#2278748)

From 2c933bc9ee914f092b7290cf52dcf249c8ff9f90 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 23 May 2024 16:47:04 +0100
Subject: [PATCH 330/359] - mod_ssl: enable SSL_OP_NO_RENEGOTIATION (upstream
 PR#426)

---
 httpd-2.4.59-pr426.patch | 244 +++++++++++++++++++++++++++++++++++++++
 httpd.spec               |   1 +
 2 files changed, 245 insertions(+)
 create mode 100644 httpd-2.4.59-pr426.patch

diff --git a/httpd-2.4.59-pr426.patch b/httpd-2.4.59-pr426.patch
new file mode 100644
index 0000000..c0ede88
--- /dev/null
+++ b/httpd-2.4.59-pr426.patch
@@ -0,0 +1,244 @@
+
+https://github.com/apache/httpd/pull/426.patch
+
+Upstream-Status: in trunk, proposed for 2.4.60
+
+--- httpd-2.4.59/modules/ssl/ssl_engine_init.c.mr426
++++ httpd-2.4.59/modules/ssl/ssl_engine_init.c
+@@ -880,6 +880,13 @@
+     }
+ #endif
+ 
++#ifdef SSL_OP_NO_RENEGOTIATION
++    /* For server-side SSL_CTX, disable renegotiation by default.. */
++    if (!mctx->pkp) {
++        SSL_CTX_set_options(ctx, SSL_OP_NO_RENEGOTIATION);
++    }
++#endif
++
+ #ifdef SSL_OP_IGNORE_UNEXPECTED_EOF
+     /* For server-side SSL_CTX, enable ignoring unexpected EOF */
+     /* (OpenSSL 1.1.1 behavioural compatibility).. */
+@@ -908,6 +915,14 @@
+     }
+ }
+ 
++#ifdef SSL_OP_NO_RENEGOTIATION
++/* OpenSSL-level renegotiation protection. */
++#define MODSSL_BLOCKS_RENEG (0)
++#else
++/* mod_ssl-level renegotiation protection. */
++#define MODSSL_BLOCKS_RENEG (1)
++#endif
++
+ static void ssl_init_ctx_callbacks(server_rec *s,
+                                    apr_pool_t *p,
+                                    apr_pool_t *ptemp,
+@@ -921,7 +936,13 @@
+     SSL_CTX_set_tmp_dh_callback(ctx,  ssl_callback_TmpDH);
+ #endif
+ 
+-    SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
++    /* The info callback is used for debug-level tracing.  For OpenSSL
++     * versions where SSL_OP_NO_RENEGOTIATION is not available, the
++     * callback is also used to prevent use of client-initiated
++     * renegotiation.  Enable it in either case. */
++    if (APLOGdebug(s) || MODSSL_BLOCKS_RENEG) {
++        SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
++    }
+ 
+ #ifdef HAVE_TLS_ALPN
+     SSL_CTX_set_alpn_select_cb(ctx, ssl_callback_alpn_select, NULL);
+--- httpd-2.4.59/modules/ssl/ssl_engine_io.c.mr426
++++ httpd-2.4.59/modules/ssl/ssl_engine_io.c
+@@ -208,11 +208,13 @@
+ 
+     BIO_clear_retry_flags(bio);
+ 
++#ifndef SSL_OP_NO_RENEGOTIATION
+     /* Abort early if the client has initiated a renegotiation. */
+     if (outctx->filter_ctx->config->reneg_state == RENEG_ABORT) {
+         outctx->rc = APR_ECONNABORTED;
+         return -1;
+     }
++#endif
+ 
+     ap_log_cerror(APLOG_MARK, APLOG_TRACE6, 0, outctx->c,
+                   "bio_filter_out_write: %i bytes", inl);
+@@ -473,11 +475,13 @@
+ 
+     BIO_clear_retry_flags(bio);
+ 
++#ifndef SSL_OP_NO_RENEGOTIATION
+     /* Abort early if the client has initiated a renegotiation. */
+     if (inctx->filter_ctx->config->reneg_state == RENEG_ABORT) {
+         inctx->rc = APR_ECONNABORTED;
+         return -1;
+     }
++#endif
+ 
+     if (!inctx->bb) {
+         inctx->rc = APR_EOF;
+--- httpd-2.4.59/modules/ssl/ssl_engine_kernel.c.mr426
++++ httpd-2.4.59/modules/ssl/ssl_engine_kernel.c
+@@ -992,7 +992,7 @@
+ 
+             /* Toggle the renegotiation state to allow the new
+              * handshake to proceed. */
+-            sslconn->reneg_state = RENEG_ALLOW;
++            modssl_set_reneg_state(sslconn, RENEG_ALLOW);
+ 
+             SSL_renegotiate(ssl);
+             SSL_do_handshake(ssl);
+@@ -1019,7 +1019,7 @@
+              */
+             SSL_peek(ssl, peekbuf, 0);
+ 
+-            sslconn->reneg_state = RENEG_REJECT;
++            modssl_set_reneg_state(sslconn, RENEG_REJECT);
+ 
+             if (!SSL_is_init_finished(ssl)) {
+                 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02261)
+@@ -1078,7 +1078,7 @@
+         (sc->server->auth.verify_mode != SSL_CVERIFY_UNSET)) {
+         int vmode_inplace, vmode_needed;
+         int change_vmode = FALSE;
+-        int old_state, n, rc;
++        int n, rc;
+ 
+         vmode_inplace = SSL_get_verify_mode(ssl);
+         vmode_needed = SSL_VERIFY_NONE;
+@@ -1180,8 +1180,6 @@
+                 return HTTP_FORBIDDEN;
+             }
+             
+-            old_state = sslconn->reneg_state;
+-            sslconn->reneg_state = RENEG_ALLOW;
+             modssl_set_app_data2(ssl, r);
+ 
+             SSL_do_handshake(ssl);
+@@ -1191,7 +1189,6 @@
+              */
+             SSL_peek(ssl, peekbuf, 0);
+ 
+-            sslconn->reneg_state = old_state;
+             modssl_set_app_data2(ssl, NULL);
+ 
+             /*
+@@ -2263,8 +2260,8 @@
+ /*
+  * This callback function is executed while OpenSSL processes the SSL
+  * handshake and does SSL record layer stuff.  It's used to trap
+- * client-initiated renegotiations, and for dumping everything to the
+- * log.
++ * client-initiated renegotiations (where SSL_OP_NO_RENEGOTIATION is
++ * not available), and for dumping everything to the log.
+  */
+ void ssl_callback_Info(const SSL *ssl, int where, int rc)
+ {
+@@ -2276,14 +2273,12 @@
+         return;
+     }
+ 
+-    /* With TLS 1.3 this callback may be called multiple times on the first
+-     * negotiation, so the below logic to detect renegotiations can't work.
+-     * Fortunately renegotiations are forbidden starting with TLS 1.3, and
+-     * this is enforced by OpenSSL so there's nothing to be done here.
+-     */
+-#if SSL_HAVE_PROTOCOL_TLSV1_3
+-    if (SSL_version(ssl) < TLS1_3_VERSION)
+-#endif
++#ifndef SSL_OP_NO_RENEGOTIATION
++    /* With OpenSSL < 1.1.1 (implying TLS v1.2 or earlier), this
++     * callback is used to block client-initiated renegotiation.  With
++     * TLSv1.3 it is unnecessary since renegotiation is forbidden at
++     * protocol level.  Otherwise (TLSv1.2 with OpenSSL >=1.1.1),
++     * SSL_OP_NO_RENEGOTIATION is used to block renegotiation. */
+     {
+         SSLConnRec *sslconn;
+ 
+@@ -2308,6 +2303,7 @@
+             sslconn->reneg_state = RENEG_REJECT;
+         }
+     }
++#endif
+ 
+     s = mySrvFromConn(c);
+     if (s && APLOGdebug(s)) {
+--- httpd-2.4.59/modules/ssl/ssl_private.h.mr426
++++ httpd-2.4.59/modules/ssl/ssl_private.h
+@@ -558,6 +558,16 @@
+     apr_time_t     source_mtime;
+ } ssl_asn1_t;
+ 
++typedef enum {
++    RENEG_INIT = 0, /* Before initial handshake */
++    RENEG_REJECT,   /* After initial handshake; any client-initiated
++                     * renegotiation should be rejected */
++    RENEG_ALLOW,    /* A server-initiated renegotiation is taking
++                     * place (as dictated by configuration) */
++    RENEG_ABORT     /* Renegotiation initiated by client, abort the
++                     * connection */
++} modssl_reneg_state;
++
+ /**
+  * Define the mod_ssl per-module configuration structure
+  * (i.e. the global configuration for each httpd process)
+@@ -589,18 +599,13 @@
+         NON_SSL_SET_ERROR_MSG  /* Need to set the error message */
+     } non_ssl_request;
+ 
+-    /* Track the handshake/renegotiation state for the connection so
+-     * that all client-initiated renegotiations can be rejected, as a
+-     * partial fix for CVE-2009-3555. */
+-    enum {
+-        RENEG_INIT = 0, /* Before initial handshake */
+-        RENEG_REJECT,   /* After initial handshake; any client-initiated
+-                         * renegotiation should be rejected */
+-        RENEG_ALLOW,    /* A server-initiated renegotiation is taking
+-                         * place (as dictated by configuration) */
+-        RENEG_ABORT     /* Renegotiation initiated by client, abort the
+-                         * connection */
+-    } reneg_state;
++#ifndef SSL_OP_NO_RENEGOTIATION
++    /* For OpenSSL < 1.1.1, track the handshake/renegotiation state
++     * for the connection to block client-initiated renegotiations.
++     * For OpenSSL >=1.1.1, the SSL_OP_NO_RENEGOTIATION flag is used in
++     * the SSL * options state with equivalent effect. */
++    modssl_reneg_state reneg_state;
++#endif
+ 
+     server_rec *server;
+     SSLDirConfigRec *dc;
+@@ -1207,6 +1212,9 @@
+  * the configured ENGINE. */
+ int modssl_is_engine_id(const char *name);
+ 
++/* Set the renegotation state for connection. */
++void modssl_set_reneg_state(SSLConnRec *sslconn, modssl_reneg_state state);
++
+ #endif /* SSL_PRIVATE_H */
+ /** @} */
+ 
+--- httpd-2.4.59/modules/ssl/ssl_util_ssl.c.mr426
++++ httpd-2.4.59/modules/ssl/ssl_util_ssl.c
+@@ -612,3 +612,19 @@
+     }
+     return rv;
+ }
++
++void modssl_set_reneg_state(SSLConnRec *sslconn, modssl_reneg_state state)
++{
++#ifdef SSL_OP_NO_RENEGOTIATION
++    switch (state) {
++    case RENEG_ALLOW:
++        SSL_clear_options(sslconn->ssl, SSL_OP_NO_RENEGOTIATION);
++        break;
++    default:
++        SSL_set_options(sslconn->ssl, SSL_OP_NO_RENEGOTIATION);
++        break;
++    }
++#else
++    sslconn->reneg_state = state;
++#endif
++}
diff --git a/httpd.spec b/httpd.spec
index 8cb3825..246a014 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -837,6 +837,7 @@ exit $rv
 %changelog
 * Thu May 23 2024 Joe Orton <jorton@redhat.com> - 2.4.59-4
 - mod_ssl: add engine bcond, disable ENGINE support by default for F41+
+- mod_ssl: enable SSL_OP_NO_RENEGOTIATION (upstream PR#426)
 
 * Fri May  3 2024 Joe Orton <jorton@redhat.com> - 2.4.59-3
 - apachectl(8): use BUG_REPORT_URL from /etc/os-release

From b8ad0c4e43deaa3f57a87531cbf50ad6195054f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 3 Jul 2024 21:13:51 +0200
Subject: [PATCH 331/359] new version 2.4.61

---
 .gitignore                              |    1 +
 httpd-2.4.43-socket-activation.patch    |   28 +-
 httpd-2.4.53-separate-systemd-fns.patch |   18 +-
 httpd-2.4.59-gettid.patch               |   14 -
 httpd-2.4.59-r1916863.patch             |   54 -
 httpd-2.4.59-unifycgid.patch            | 2371 -----------------------
 httpd.spec                              |   30 +-
 sources                                 |    4 +-
 8 files changed, 41 insertions(+), 2479 deletions(-)
 delete mode 100644 httpd-2.4.59-gettid.patch
 delete mode 100644 httpd-2.4.59-r1916863.patch
 delete mode 100644 httpd-2.4.59-unifycgid.patch

diff --git a/.gitignore b/.gitignore
index bdad39b..ed7e100 100644
--- a/.gitignore
+++ b/.gitignore
@@ -50,3 +50,4 @@ x86_64
 /httpd-2.4.57.tar.bz2.asc
 /httpd-2.4.58.tar.bz2.asc
 /httpd-2.4.59.tar.bz2.asc
+/httpd-2.4.61.tar.bz2.asc
diff --git a/httpd-2.4.43-socket-activation.patch b/httpd-2.4.43-socket-activation.patch
index 511f476..77eaa45 100644
--- a/httpd-2.4.43-socket-activation.patch
+++ b/httpd-2.4.43-socket-activation.patch
@@ -1,8 +1,8 @@
 diff --git a/server/listen.c b/server/listen.c
-index 5242c2a..e2e028a 100644
+index 9577d60..d718db1 100644
 --- a/server/listen.c
 +++ b/server/listen.c
-@@ -34,6 +34,10 @@
+@@ -35,6 +35,10 @@
  #include <unistd.h>
  #endif
  
@@ -13,7 +13,7 @@ index 5242c2a..e2e028a 100644
  /* we know core's module_index is 0 */
  #undef APLOG_MODULE_INDEX
  #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX
-@@ -59,9 +63,12 @@ static int ap_listenbacklog;
+@@ -60,9 +64,12 @@ static int ap_listenbacklog;
  static int ap_listencbratio;
  static int send_buffer_size;
  static int receive_buffer_size;
@@ -27,7 +27,7 @@ index 5242c2a..e2e028a 100644
  {
      apr_socket_t *s = server->sd;
      int one = 1;
-@@ -94,20 +101,6 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
+@@ -95,20 +102,6 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
          return stat;
      }
  
@@ -48,7 +48,7 @@ index 5242c2a..e2e028a 100644
      /*
       * To send data over high bandwidth-delay connections at full
       * speed we must force the TCP window to open wide enough to keep the
-@@ -169,21 +162,37 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
+@@ -170,21 +163,37 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
      }
  #endif
  
@@ -100,7 +100,7 @@ index 5242c2a..e2e028a 100644
      }
  
  #ifdef WIN32
-@@ -315,6 +324,123 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
+@@ -335,6 +344,123 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
      return found;
  }
  
@@ -223,8 +223,8 @@ index 5242c2a..e2e028a 100644
 +
  static const char *alloc_listener(process_rec *process, const char *addr,
                                    apr_port_t port, const char* proto,
-                                   void *slave)
-@@ -495,7 +621,7 @@ static int open_listeners(apr_pool_t *pool)
+                                   const char *scope_id, void *slave,
+@@ -529,7 +655,7 @@ static int open_listeners(apr_pool_t *pool)
                  }
              }
  #endif
@@ -233,7 +233,7 @@ index 5242c2a..e2e028a 100644
                  ++num_open;
              }
              else {
-@@ -607,8 +733,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+@@ -641,8 +767,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
          }
      }
  
@@ -264,7 +264,7 @@ index 5242c2a..e2e028a 100644
      }
  
      for (lr = ap_listeners; lr; lr = lr->next) {
-@@ -698,7 +844,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
+@@ -732,7 +878,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
                              duplr->bind_addr);
                  return stat;
              }
@@ -273,7 +273,7 @@ index 5242c2a..e2e028a 100644
  #if AP_NONBLOCK_WHEN_MULTI_LISTEN
              use_nonblock = (ap_listeners && ap_listeners->next);
              stat = apr_socket_opt_set(duplr->sd, APR_SO_NONBLOCK, use_nonblock);
-@@ -825,6 +971,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -859,6 +1005,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
      if (argc < 1 || argc > 2) {
          return "Listen requires 1 or 2 arguments.";
      }
@@ -285,7 +285,7 @@ index 5242c2a..e2e028a 100644
  
      rv = apr_parse_addr_port(&host, &scope_id, &port, argv[0], cmd->pool);
      if (rv != APR_SUCCESS) {
-@@ -856,6 +1007,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -894,6 +1045,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
          ap_str_tolower(proto);
      }
  
@@ -295,6 +295,6 @@ index 5242c2a..e2e028a 100644
 +    }
 +#endif
 +
-     return alloc_listener(cmd->server->process, host, port, proto, NULL);
+     return alloc_listener(cmd->server->process, host, port, proto,
+                           scope_id, NULL, cmd->temp_pool);
  }
- 
diff --git a/httpd-2.4.53-separate-systemd-fns.patch b/httpd-2.4.53-separate-systemd-fns.patch
index 88b99ff..8db5c57 100644
--- a/httpd-2.4.53-separate-systemd-fns.patch
+++ b/httpd-2.4.53-separate-systemd-fns.patch
@@ -166,10 +166,10 @@ index 877a593..bd52a98 100644
  /** @} */
  
 diff --git a/server/listen.c b/server/listen.c
-index e2e028a..5d1c0e1 100644
+index d718db1..2a4e87a 100644
 --- a/server/listen.c
 +++ b/server/listen.c
-@@ -34,10 +34,6 @@
+@@ -35,10 +35,6 @@
  #include <unistd.h>
  #endif
  
@@ -180,7 +180,7 @@ index e2e028a..5d1c0e1 100644
  /* we know core's module_index is 0 */
  #undef APLOG_MODULE_INDEX
  #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX
-@@ -325,34 +321,6 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
+@@ -345,34 +341,6 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
  }
  
  #ifdef HAVE_SYSTEMD
@@ -215,7 +215,7 @@ index e2e028a..5d1c0e1 100644
  static apr_status_t alloc_systemd_listener(process_rec * process,
                                             int fd, const char *proto,
                                             ap_listen_rec **out_rec)
-@@ -412,6 +380,14 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
+@@ -432,6 +400,14 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
  {
      ap_listen_rec *last, *new;
      apr_status_t rv;
@@ -230,7 +230,7 @@ index e2e028a..5d1c0e1 100644
      int fd = find_systemd_socket(process, port);
      if (fd < 0) {
          return "Systemd socket activation is used, but this port is not "
-@@ -438,7 +414,6 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
+@@ -458,7 +434,6 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
  
      return NULL;
  }
@@ -238,7 +238,7 @@ index e2e028a..5d1c0e1 100644
  #endif /* HAVE_SYSTEMD */
  
  static const char *alloc_listener(process_rec *process, const char *addr,
-@@ -707,6 +682,9 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+@@ -741,6 +716,9 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
      int num_listeners = 0;
      const char* proto;
      int found;
@@ -248,7 +248,7 @@ index e2e028a..5d1c0e1 100644
  
      for (ls = s; ls; ls = ls->next) {
          proto = ap_get_server_protocol(ls);
-@@ -746,7 +724,10 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+@@ -780,7 +758,10 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
                                  apr_pool_cleanup_null, s->process->pool);
          }
          else {
@@ -260,7 +260,7 @@ index e2e028a..5d1c0e1 100644
          }
      }
      else
-@@ -963,6 +944,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -997,6 +978,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
      apr_port_t port;
      apr_status_t rv;
      const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
@@ -270,7 +270,7 @@ index e2e028a..5d1c0e1 100644
  
      if (err != NULL) {
          return err;
-@@ -973,7 +957,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -1007,7 +991,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
      }
  #ifdef HAVE_SYSTEMD
      if (use_systemd == -1) {
diff --git a/httpd-2.4.59-gettid.patch b/httpd-2.4.59-gettid.patch
deleted file mode 100644
index fb1e549..0000000
--- a/httpd-2.4.59-gettid.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-
-Upstream-Status: r1917578 in trunk, proposed for 2.4.60
-
---- httpd-2.4.54/server/log.c.gettid
-+++ httpd-2.4.54/server/log.c
-@@ -968,7 +972,7 @@
- #if APR_HAS_THREADS
-         field_start = len;
-         len += cpystrn(buf + len, ":tid ", buflen - len);
--        item_len = log_tid(info, NULL, buf + len, buflen - len);
-+        item_len = log_tid(info, "g", buf + len, buflen - len);
-         if (!item_len)
-             len = field_start;
-         else
diff --git a/httpd-2.4.59-r1916863.patch b/httpd-2.4.59-r1916863.patch
deleted file mode 100644
index 162662c..0000000
--- a/httpd-2.4.59-r1916863.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-# ./pullrev.sh 1916863
-http://svn.apache.org/viewvc?view=revision&revision=1916863
-
-Upstream-Status: in trunk, not proposed for 2.4.x
-
---- httpd-2.4.59/modules/ssl/ssl_engine_init.c
-+++ httpd-2.4.59/modules/ssl/ssl_engine_init.c
-@@ -1416,6 +1416,7 @@
-     const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile;
-     int i;
-     EVP_PKEY *pkey;
-+    int custom_dh_done = 0;
- #ifdef HAVE_ECC
-     EC_GROUP *ecgroup = NULL;
-     int curve_nid = 0;
-@@ -1591,14 +1592,14 @@
-      */
-     certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *);
-     if (certfile && !modssl_is_engine_id(certfile)) {
--        int done = 0, num_bits = 0;
-+        int num_bits = 0;
- #if OPENSSL_VERSION_NUMBER < 0x30000000L
-         DH *dh = modssl_dh_from_file(certfile);
-         if (dh) {
-             num_bits = DH_bits(dh);
-             SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh);
-             DH_free(dh);
--            done = 1;
-+            custom_dh_done = 1;
-         }
- #else
-         pkey = modssl_dh_pkey_from_file(certfile);
-@@ -1608,18 +1609,18 @@
-                 EVP_PKEY_free(pkey);
-             }
-             else {
--                done = 1;
-+                custom_dh_done = 1;
-             }
-         }
- #endif
--        if (done) {
-+        if (custom_dh_done) {
-             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
-                          "Custom DH parameters (%d bits) for %s loaded from %s",
-                          num_bits, vhost_id, certfile);
-         }
-     }
- #if !MODSSL_USE_OPENSSL_PRE_1_1_API
--    else {
-+    if (!custom_dh_done) {
-         /* If no parameter is manually configured, enable auto
-          * selection. */
-         SSL_CTX_set_dh_auto(mctx->ssl_ctx, 1);
diff --git a/httpd-2.4.59-unifycgid.patch b/httpd-2.4.59-unifycgid.patch
deleted file mode 100644
index 0348b61..0000000
--- a/httpd-2.4.59-unifycgid.patch
+++ /dev/null
@@ -1,2371 +0,0 @@
-
-https://github.com/apache/httpd/pull/209
-
-Upstream-Status: in trunk, proposed for 2.4.60
-
-diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
-index ddacd4af19..6d4379d165 100644
---- a/.github/workflows/linux.yml
-+++ b/.github/workflows/linux.yml
-@@ -48,11 +48,11 @@ jobs:
-           - name: Shared MPMs, all-modules
-             config: --enable-mods-shared=reallyall --enable-mpms-shared=all
-           # -------------------------------------------------------------------------
--          - name: Event MPM, all-modules, mod_cgid only
--            config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi
-+          - name: Event MPM, all-modules, mod_cgid fdpassing
-+            config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi --enable-cgid-fdpassing
-           # -------------------------------------------------------------------------
--          - name: Event MPM, all-modules, no CMSG_DATA
--            config: --enable-mods-shared=reallyall --with-mpm=event ac_cv_have_decl_CMSG_DATA=no
-+          - name: Event MPM, all-modules, mod_cgid w/o fdpassing
-+            config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi
-           # -------------------------------------------------------------------------
-           - name: Default, all-modules + install
-             config: --enable-mods-shared=reallyall
-diff --git a/changes-entries/pr54221.txt b/changes-entries/pr54221.txt
-new file mode 100644
-index 0000000000..62b75ea4dd
---- /dev/null
-+++ b/changes-entries/pr54221.txt
-@@ -0,0 +1,3 @@
-+  *) mod_cgid: Optional support for file descriptor passing, fixing
-+     error log handling (configure --enable-cgid-fdpassing) on Unix
-+     platforms. PR 54221.  [Joe Orton]
-diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h
-new file mode 100644
-index 0000000000..66f9418f21
---- /dev/null
-+++ b/modules/generators/cgi_common.h
-@@ -0,0 +1,639 @@
-+/* Licensed to the Apache Software Foundation (ASF) under one or more
-+ * contributor license agreements.  See the NOTICE file distributed with
-+ * this work for additional information regarding copyright ownership.
-+ * The ASF licenses this file to You under the Apache License, Version 2.0
-+ * (the "License"); you may not use this file except in compliance with
-+ * the License.  You may obtain a copy of the License at
-+ *
-+ *     http://www.apache.org/licenses/LICENSE-2.0
-+ *
-+ * Unless required by applicable law or agreed to in writing, software
-+ * distributed under the License is distributed on an "AS IS" BASIS,
-+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-+ * See the License for the specific language governing permissions and
-+ * limitations under the License.
-+ */
-+
-+#include "apr.h"
-+#include "apr_strings.h"
-+#include "apr_buckets.h"
-+#include "apr_lib.h"
-+#include "apr_poll.h"
-+
-+#define APR_WANT_STRFUNC
-+#define APR_WANT_MEMFUNC
-+#include "apr_want.h"
-+
-+#include "httpd.h"
-+#include "util_filter.h"
-+#include "util_script.h"
-+
-+static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgi_pfn_gtv;
-+static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgi_pfn_ps;
-+
-+/* These functions provided by mod_cgi.c/mod_cgid.c still. */
-+static int log_script(request_rec *r, cgi_server_conf * conf, int ret,
-+                      char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
-+                      apr_file_t *script_err);
-+static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
-+                                apr_bucket_brigade *bb, char *s);
-+static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f,
-+                                apr_bucket_brigade *bb, const char *command);
-+
-+/* Read and discard all output from the brigade.  Note that with the
-+ * CGI bucket, the brigade will become empty once the script's stdout
-+ * is closed (or on error/timeout), but the stderr output may not have
-+ * been entirely captured at this point. */
-+static void discard_script_output(apr_bucket_brigade *bb)
-+{
-+    apr_bucket *e;
-+    const char *buf;
-+    apr_size_t len;
-+
-+    for (e = APR_BRIGADE_FIRST(bb);
-+         e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e);
-+         e = APR_BRIGADE_FIRST(bb))
-+    {
-+        if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) {
-+            break;
-+        }
-+        apr_bucket_delete(e);
-+    }
-+}
-+
-+static int log_scripterror(request_rec *r, cgi_server_conf *conf, int ret,
-+                           apr_status_t rv, const char *logno,
-+                           const char *error)
-+{
-+    apr_file_t *f = NULL;
-+    apr_finfo_t finfo;
-+    char time_str[APR_CTIME_LEN];
-+
-+    /* Intentional no APLOGNO */
-+    /* Callee provides APLOGNO in error text */
-+    ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,
-+                  "%sstderr from %s: %s", logno ? logno : "", r->filename, error);
-+
-+    /* XXX Very expensive mainline case! Open, then getfileinfo! */
-+    if (!conf->logname ||
-+        ((apr_stat(&finfo, conf->logname,
-+                   APR_FINFO_SIZE, r->pool) == APR_SUCCESS) &&
-+         (finfo.size > conf->logbytes)) ||
-+        (apr_file_open(&f, conf->logname,
-+                       APR_APPEND|APR_WRITE|APR_CREATE, APR_OS_DEFAULT,
-+                       r->pool) != APR_SUCCESS)) {
-+        return ret;
-+    }
-+
-+    /* "%% [Wed Jun 19 10:53:21 1996] GET /cgi-bin/printenv HTTP/1.0" */
-+    apr_ctime(time_str, apr_time_now());
-+    apr_file_printf(f, "%%%% [%s] %s %s%s%s %s\n", time_str, r->method, r->uri,
-+                    r->args ? "?" : "", r->args ? r->args : "", r->protocol);
-+    /* "%% 500 /usr/local/apache/cgi-bin */
-+    apr_file_printf(f, "%%%% %d %s\n", ret, r->filename);
-+
-+    apr_file_printf(f, "%%error\n%s\n", error);
-+
-+    apr_file_close(f);
-+    return ret;
-+}
-+
-+/* Soak up stderr from a script and redirect it to the error log.
-+ */
-+static apr_status_t log_script_err(request_rec *r, apr_file_t *script_err)
-+{
-+    char argsbuffer[HUGE_STRING_LEN];
-+    char *newline;
-+    apr_status_t rv;
-+    cgi_server_conf *conf = ap_get_module_config(r->server->module_config, &cgi_module);
-+
-+    while ((rv = apr_file_gets(argsbuffer, HUGE_STRING_LEN,
-+                               script_err)) == APR_SUCCESS) {
-+
-+        newline = strchr(argsbuffer, '\n');
-+        if (newline) {
-+            char *prev = newline - 1;
-+            if (prev >= argsbuffer && *prev == '\r') {
-+                newline = prev;
-+            }
-+
-+            *newline = '\0';
-+        }
-+        log_scripterror(r, conf, r->status, 0, APLOGNO(01215), argsbuffer);
-+    }
-+
-+    return rv;
-+}
-+
-+static apr_status_t cgi_handle_exec(include_ctx_t *ctx, ap_filter_t *f,
-+                                    apr_bucket_brigade *bb)
-+{
-+    char *tag = NULL;
-+    char *tag_val = NULL;
-+    request_rec *r = f->r;
-+    char *file = r->filename;
-+    char parsed_string[MAX_STRING_LEN];
-+
-+    if (!ctx->argc) {
-+        ap_log_rerror(APLOG_MARK,
-+                      (ctx->flags & SSI_FLAG_PRINTING)
-+                          ? APLOG_ERR : APLOG_WARNING,
-+                      0, r, APLOGNO(03195)
-+                      "missing argument for exec element in %s", r->filename);
-+    }
-+
-+    if (!(ctx->flags & SSI_FLAG_PRINTING)) {
-+        return APR_SUCCESS;
-+    }
-+
-+    if (!ctx->argc) {
-+        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
-+        return APR_SUCCESS;
-+    }
-+
-+    if (ctx->flags & SSI_FLAG_NO_EXEC) {
-+        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01228) "exec used but not allowed "
-+                      "in %s", r->filename);
-+        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
-+        return APR_SUCCESS;
-+    }
-+
-+    while (1) {
-+        cgi_pfn_gtv(ctx, &tag, &tag_val, SSI_VALUE_DECODED);
-+        if (!tag || !tag_val) {
-+            break;
-+        }
-+
-+        if (!strcmp(tag, "cmd")) {
-+            apr_status_t rv;
-+
-+            cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
-+                       SSI_EXPAND_LEAVE_NAME);
-+
-+            rv = include_cmd(ctx, f, bb, parsed_string);
-+            if (rv != APR_SUCCESS) {
-+                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01229) "execution failure "
-+                              "for parameter \"%s\" to tag exec in file %s",
-+                              tag, r->filename);
-+                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
-+                break;
-+            }
-+        }
-+        else if (!strcmp(tag, "cgi")) {
-+            apr_status_t rv;
-+
-+            cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
-+                       SSI_EXPAND_DROP_NAME);
-+
-+            rv = include_cgi(ctx, f, bb, parsed_string);
-+            if (rv != APR_SUCCESS) {
-+                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01230) "invalid CGI ref "
-+                              "\"%s\" in %s", tag_val, file);
-+                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
-+                break;
-+            }
-+        }
-+        else {
-+            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01231) "unknown parameter "
-+                          "\"%s\" to tag exec in %s", tag, file);
-+            SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
-+            break;
-+        }
-+    }
-+
-+    return APR_SUCCESS;
-+}
-+
-+/* Hook to register exec= handling with mod_include. */
-+static void cgi_optfns_retrieve(void)
-+{
-+    APR_OPTIONAL_FN_TYPE(ap_register_include_handler) *cgi_pfn_reg_with_ssi;
-+
-+    cgi_pfn_reg_with_ssi = APR_RETRIEVE_OPTIONAL_FN(ap_register_include_handler);
-+    cgi_pfn_gtv          = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_get_tag_and_value);
-+    cgi_pfn_ps           = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_parse_string);
-+
-+    if (cgi_pfn_reg_with_ssi && cgi_pfn_gtv && cgi_pfn_ps) {
-+        /* Required by mod_include filter. This is how mod_cgi registers
-+         *   with mod_include to provide processing of the exec directive.
-+         */
-+        cgi_pfn_reg_with_ssi("exec", cgi_handle_exec);
-+    }
-+}
-+
-+#ifdef WANT_CGI_BUCKET
-+/* A CGI bucket type is needed to catch any output to stderr from the
-+ * script; see PR 22030. */
-+static const apr_bucket_type_t bucket_type_cgi;
-+
-+struct cgi_bucket_data {
-+    apr_pollset_t *pollset;
-+    request_rec *r;
-+    apr_interval_time_t timeout;
-+};
-+
-+/* Create a CGI bucket using pipes from script stdout 'out'
-+ * and stderr 'err', for request 'r'. */
-+static apr_bucket *cgi_bucket_create(request_rec *r,
-+                                     apr_interval_time_t timeout,
-+                                     apr_file_t *out, apr_file_t *err,
-+                                     apr_bucket_alloc_t *list)
-+{
-+    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
-+    apr_status_t rv;
-+    apr_pollfd_t fd;
-+    struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data);
-+
-+    /* Disable APR timeout handling since we'll use poll() entirely. */
-+    apr_file_pipe_timeout_set(out, 0);
-+    apr_file_pipe_timeout_set(err, 0);
-+    
-+    APR_BUCKET_INIT(b);
-+    b->free = apr_bucket_free;
-+    b->list = list;
-+    b->type = &bucket_type_cgi;
-+    b->length = (apr_size_t)(-1);
-+    b->start = -1;
-+
-+    /* Create the pollset */
-+    rv = apr_pollset_create(&data->pollset, 2, r->pool, 0);
-+    if (rv != APR_SUCCESS) {
-+        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01217)
-+                     "apr_pollset_create(); check system or user limits");
-+        return NULL;
-+    }
-+
-+    fd.desc_type = APR_POLL_FILE;
-+    fd.reqevents = APR_POLLIN;
-+    fd.p = r->pool;
-+    fd.desc.f = out; /* script's stdout */
-+    fd.client_data = (void *)1;
-+    rv = apr_pollset_add(data->pollset, &fd);
-+    if (rv != APR_SUCCESS) {
-+        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01218)
-+                     "apr_pollset_add(); check system or user limits");
-+        return NULL;
-+    }
-+
-+    fd.desc.f = err; /* script's stderr */
-+    fd.client_data = (void *)2;
-+    rv = apr_pollset_add(data->pollset, &fd);
-+    if (rv != APR_SUCCESS) {
-+        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01219)
-+                     "apr_pollset_add(); check system or user limits");
-+        return NULL;
-+    }
-+
-+    data->r = r;
-+    data->timeout = timeout;
-+    b->data = data;
-+    return b;
-+}
-+
-+/* Create a duplicate CGI bucket using given bucket data */
-+static apr_bucket *cgi_bucket_dup(struct cgi_bucket_data *data,
-+                                  apr_bucket_alloc_t *list)
-+{
-+    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
-+    APR_BUCKET_INIT(b);
-+    b->free = apr_bucket_free;
-+    b->list = list;
-+    b->type = &bucket_type_cgi;
-+    b->length = (apr_size_t)(-1);
-+    b->start = -1;
-+    b->data = data;
-+    return b;
-+}
-+
-+/* Handle stdout from CGI child.  Duplicate of logic from the _read
-+ * method of the real APR pipe bucket implementation. */
-+static apr_status_t cgi_read_stdout(apr_bucket *a, apr_file_t *out,
-+                                    const char **str, apr_size_t *len)
-+{
-+    char *buf;
-+    apr_status_t rv;
-+
-+    *str = NULL;
-+    *len = APR_BUCKET_BUFF_SIZE;
-+    buf = apr_bucket_alloc(*len, a->list); /* XXX: check for failure? */
-+
-+    rv = apr_file_read(out, buf, len);
-+
-+    if (rv != APR_SUCCESS && rv != APR_EOF) {
-+        apr_bucket_free(buf);
-+        return rv;
-+    }
-+
-+    if (*len > 0) {
-+        struct cgi_bucket_data *data = a->data;
-+        apr_bucket_heap *h;
-+
-+        /* Change the current bucket to refer to what we read */
-+        a = apr_bucket_heap_make(a, buf, *len, apr_bucket_free);
-+        h = a->data;
-+        h->alloc_len = APR_BUCKET_BUFF_SIZE; /* note the real buffer size */
-+        *str = buf;
-+        APR_BUCKET_INSERT_AFTER(a, cgi_bucket_dup(data, a->list));
-+    }
-+    else {
-+        apr_bucket_free(buf);
-+        a = apr_bucket_immortal_make(a, "", 0);
-+        *str = a->data;
-+    }
-+    return rv;
-+}
-+
-+/* Read method of CGI bucket: polls on stderr and stdout of the child,
-+ * sending any stderr output immediately away to the error log. */
-+static apr_status_t cgi_bucket_read(apr_bucket *b, const char **str,
-+                                    apr_size_t *len, apr_read_type_e block)
-+{
-+    struct cgi_bucket_data *data = b->data;
-+    apr_interval_time_t timeout = 0;
-+    apr_status_t rv;
-+    int gotdata = 0;
-+
-+    if (block != APR_NONBLOCK_READ) {
-+        timeout = data->timeout > 0 ? data->timeout : data->r->server->timeout;
-+    }
-+
-+    do {
-+        const apr_pollfd_t *results;
-+        apr_int32_t num;
-+
-+        rv = apr_pollset_poll(data->pollset, timeout, &num, &results);
-+        if (APR_STATUS_IS_TIMEUP(rv)) {
-+            if (timeout) {
-+                ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, data->r, APLOGNO(01220)
-+                              "Timeout waiting for output from CGI script %s",
-+                              data->r->filename);
-+                return rv;
-+            }
-+            else {
-+                return APR_EAGAIN;
-+            }
-+        }
-+        else if (APR_STATUS_IS_EINTR(rv)) {
-+            continue;
-+        }
-+        else if (rv != APR_SUCCESS) {
-+            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, data->r, APLOGNO(01221)
-+                          "poll failed waiting for CGI child");
-+            return rv;
-+        }
-+
-+        for (; num; num--, results++) {
-+            if (results[0].client_data == (void *)1) {
-+                /* stdout */
-+                rv = cgi_read_stdout(b, results[0].desc.f, str, len);
-+                if (APR_STATUS_IS_EOF(rv)) {
-+                    rv = APR_SUCCESS;
-+                }
-+                gotdata = 1;
-+            } else {
-+                /* stderr */
-+                apr_status_t rv2 = log_script_err(data->r, results[0].desc.f);
-+                if (APR_STATUS_IS_EOF(rv2)) {
-+                    apr_pollset_remove(data->pollset, &results[0]);
-+                }
-+            }
-+        }
-+
-+    } while (!gotdata);
-+
-+    return rv;
-+}
-+
-+static const apr_bucket_type_t bucket_type_cgi = {
-+    "CGI", 5, APR_BUCKET_DATA,
-+    apr_bucket_destroy_noop,
-+    cgi_bucket_read,
-+    apr_bucket_setaside_notimpl,
-+    apr_bucket_split_notimpl,
-+    apr_bucket_copy_notimpl
-+};
-+
-+#endif /* WANT_CGI_BUCKET */
-+
-+/* Handle the CGI response output, having set up the brigade with the
-+ * CGI or PIPE bucket as appropriate. */
-+static int cgi_handle_response(request_rec *r, int nph, apr_bucket_brigade *bb,
-+                               apr_interval_time_t timeout, cgi_server_conf *conf,
-+                               char *logdata, apr_file_t *script_err)
-+{
-+    apr_status_t rv;
-+    
-+    /* Handle script return... */
-+    if (!nph) {
-+        const char *location;
-+        char sbuf[MAX_STRING_LEN];
-+        int ret;
-+
-+        ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
-+                                                   APLOG_MODULE_INDEX);
-+
-+        /* xCGI has its own body framing mechanism which we don't
-+         * match against any provided Content-Length, so let the
-+         * core determine C-L vs T-E based on what's actually sent.
-+         */
-+        if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
-+            apr_table_unset(r->headers_out, "Content-Length");
-+        apr_table_unset(r->headers_out, "Transfer-Encoding");
-+
-+        if (ret != OK) {
-+            /* In the case of a timeout reading script output, clear
-+             * the brigade to avoid a second attempt to read the
-+             * output. */
-+            if (ret == HTTP_GATEWAY_TIME_OUT) {
-+                apr_brigade_cleanup(bb);
-+            }
-+
-+            ret = log_script(r, conf, ret, logdata, sbuf, bb, script_err);
-+
-+            /*
-+             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
-+             * does not set an explicit status and ap_meets_conditions, which
-+             * is called by ap_scan_script_header_err_brigade, detects that
-+             * the conditions of the requests are met and the response is
-+             * not modified.
-+             * In this case set r->status and return OK in order to prevent
-+             * running through the error processing stack as this would
-+             * break with mod_cache, if the conditions had been set by
-+             * mod_cache itself to validate a stale entity.
-+             * BTW: We circumvent the error processing stack anyway if the
-+             * CGI script set an explicit status code (whatever it is) and
-+             * the only possible values for ret here are:
-+             *
-+             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
-+             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
-+             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
-+             * processing of the response of the CGI script, e.g broken headers
-+             * or a crashed CGI process).
-+             */
-+            if (ret == HTTP_NOT_MODIFIED) {
-+                r->status = ret;
-+                return OK;
-+            }
-+
-+            return ret;
-+        }
-+
-+        location = apr_table_get(r->headers_out, "Location");
-+
-+        if (location && r->status == 200) {
-+            /* For a redirect whether internal or not, discard any
-+             * remaining stdout from the script, and log any remaining
-+             * stderr output, as normal. */
-+            discard_script_output(bb);
-+            apr_brigade_destroy(bb);
-+
-+            if (script_err) {
-+                apr_file_pipe_timeout_set(script_err, timeout);
-+                log_script_err(r, script_err);
-+            }
-+        }
-+
-+        if (location && location[0] == '/' && r->status == 200) {
-+            /* This redirect needs to be a GET no matter what the original
-+             * method was.
-+             */
-+            r->method = "GET";
-+            r->method_number = M_GET;
-+
-+            /* We already read the message body (if any), so don't allow
-+             * the redirected request to think it has one.  We can ignore
-+             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
-+             */
-+            apr_table_unset(r->headers_in, "Content-Length");
-+
-+            ap_internal_redirect_handler(location, r);
-+            return OK;
-+        }
-+        else if (location && r->status == 200) {
-+            /* XXX: Note that if a script wants to produce its own Redirect
-+             * body, it now has to explicitly *say* "Status: 302"
-+             */
-+            discard_script_output(bb);
-+            apr_brigade_destroy(bb);
-+            return HTTP_MOVED_TEMPORARILY;
-+        }
-+
-+        rv = ap_pass_brigade(r->output_filters, bb);
-+    }
-+    else /* nph */ {
-+        struct ap_filter_t *cur;
-+
-+        /* get rid of all filters up through protocol...  since we
-+         * haven't parsed off the headers, there is no way they can
-+         * work
-+         */
-+
-+        cur = r->proto_output_filters;
-+        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
-+            cur = cur->next;
-+        }
-+        r->output_filters = r->proto_output_filters = cur;
-+
-+        rv = ap_pass_brigade(r->output_filters, bb);
-+    }
-+
-+    /* don't soak up script output if errors occurred writing it
-+     * out...  otherwise, we prolong the life of the script when the
-+     * connection drops or we stopped sending output for some other
-+     * reason */
-+    if (script_err && rv == APR_SUCCESS && !r->connection->aborted) {
-+        apr_file_pipe_timeout_set(script_err, timeout);
-+        log_script_err(r, script_err);
-+    }
-+
-+    if (script_err) apr_file_close(script_err);
-+
-+    return OK;                      /* NOT r->status, even if it has changed. */
-+}
-+
-+/* Read the request body and write it to fd 'script_out', using 'bb'
-+ * as temporary bucket brigade.  If 'logbuf' is non-NULL, the first
-+ * logbufbytes of stdout are stored in logbuf. */
-+static apr_status_t cgi_handle_request(request_rec *r, apr_file_t *script_out,
-+                                       apr_bucket_brigade *bb,
-+                                       char *logbuf, apr_size_t logbufbytes)
-+{
-+    int seen_eos = 0;
-+    int child_stopped_reading = 0;
-+    apr_status_t rv;
-+    int dbpos = 0;
-+
-+    do {
-+        apr_bucket *bucket;
-+
-+        rv = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES,
-+                            APR_BLOCK_READ, HUGE_STRING_LEN);
-+
-+        if (rv != APR_SUCCESS) {
-+            return rv;
-+        }
-+
-+        for (bucket = APR_BRIGADE_FIRST(bb);
-+             bucket != APR_BRIGADE_SENTINEL(bb);
-+             bucket = APR_BUCKET_NEXT(bucket))
-+        {
-+            const char *data;
-+            apr_size_t len;
-+
-+            if (APR_BUCKET_IS_EOS(bucket)) {
-+                seen_eos = 1;
-+                break;
-+            }
-+
-+            /* We can't do much with this. */
-+            if (APR_BUCKET_IS_FLUSH(bucket)) {
-+                continue;
-+            }
-+
-+            /* If the child stopped, we still must read to EOS. */
-+            if (child_stopped_reading) {
-+                continue;
-+            }
-+
-+            /* read */
-+            rv = apr_bucket_read(bucket, &data, &len, APR_BLOCK_READ);
-+            if (rv) {
-+                return rv;
-+            }
-+
-+            if (logbufbytes && dbpos < logbufbytes) {
-+                int cursize;
-+
-+                if ((dbpos + len) > logbufbytes) {
-+                    cursize = logbufbytes - dbpos;
-+                }
-+                else {
-+                    cursize = len;
-+                }
-+                memcpy(logbuf + dbpos, data, cursize);
-+                dbpos += cursize;
-+            }
-+
-+            /* Keep writing data to the child until done or too much time
-+             * elapses with no progress or an error occurs.
-+             */
-+            rv = apr_file_write_full(script_out, data, len, NULL);
-+
-+            if (rv != APR_SUCCESS) {
-+                /* silly script stopped reading, soak up remaining message */
-+                child_stopped_reading = 1;
-+                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(02651)
-+                              "Error writing request body to script %s", 
-+                              r->filename);
-+            }
-+        }
-+        apr_brigade_cleanup(bb);
-+    }
-+    while (!seen_eos);
-+
-+    if (logbuf) {
-+        logbuf[dbpos] = '\0';
-+    }
-+
-+    return APR_SUCCESS;
-+}
-diff --git a/modules/generators/config5.m4 b/modules/generators/config5.m4
-index bf295217e0..086355353b 100644
---- a/modules/generators/config5.m4
-+++ b/modules/generators/config5.m4
-@@ -78,4 +78,15 @@ fi
- 
- APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
- 
-+AC_ARG_ENABLE(cgid-fdpassing,
-+  [APACHE_HELP_STRING(--enable-cgid-fdpassing,Enable experimental mod_cgid support for fd passing)],
-+  [if test "$enableval" = "yes"; then
-+     AC_CHECK_DECL(CMSG_DATA,
-+       [AC_DEFINE([HAVE_CGID_FDPASSING], 1, [Enable FD passing support in mod_cgid])],
-+       [AC_MSG_ERROR([cannot support mod_cgid fd-passing on this system])], [
-+#include <sys/types.h>
-+#include <sys/socket.h>])
-+  fi
-+])
-+
- APACHE_MODPATH_FINISH
-diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c
-index 1f7778617e..3799b06ce3 100644
---- a/modules/generators/mod_cgi.c
-+++ b/modules/generators/mod_cgi.c
-@@ -48,7 +48,6 @@
- #include "http_protocol.h"
- #include "http_main.h"
- #include "http_log.h"
--#include "util_script.h"
- #include "ap_mpm.h"
- #include "mod_core.h"
- #include "mod_cgi.h"
-@@ -61,9 +60,6 @@
- 
- module AP_MODULE_DECLARE_DATA cgi_module;
- 
--static APR_OPTIONAL_FN_TYPE(ap_register_include_handler) *cgi_pfn_reg_with_ssi;
--static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgi_pfn_gtv;
--static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgi_pfn_ps;
- static APR_OPTIONAL_FN_TYPE(ap_cgi_build_command) *cgi_build_command;
- 
- /* Read and discard the data in the brigade produced by a CGI script */
-@@ -96,6 +92,11 @@ typedef struct {
-     apr_interval_time_t timeout;
- } cgi_dirconf;
- 
-+#if APR_FILES_AS_SOCKETS
-+#define WANT_CGI_BUCKET
-+#endif
-+#include "cgi_common.h"
-+
- static void *create_cgi_config(apr_pool_t *p, server_rec *s)
- {
-     cgi_server_conf *c =
-@@ -185,64 +186,6 @@ AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_C
-     {NULL}
- };
- 
--static int log_scripterror(request_rec *r, cgi_server_conf * conf, int ret,
--                           apr_status_t rv, char *logno, char *error)
--{
--    apr_file_t *f = NULL;
--    apr_finfo_t finfo;
--    char time_str[APR_CTIME_LEN];
--    int log_flags = rv ? APLOG_ERR : APLOG_ERR;
--
--    /* Intentional no APLOGNO */
--    /* Callee provides APLOGNO in error text */
--    ap_log_rerror(APLOG_MARK, log_flags, rv, r,
--                  "%s%s: %s", logno ? logno : "", error, r->filename);
--
--    /* XXX Very expensive mainline case! Open, then getfileinfo! */
--    if (!conf->logname ||
--        ((apr_stat(&finfo, conf->logname,
--                   APR_FINFO_SIZE, r->pool) == APR_SUCCESS) &&
--         (finfo.size > conf->logbytes)) ||
--        (apr_file_open(&f, conf->logname,
--                       APR_APPEND|APR_WRITE|APR_CREATE, APR_OS_DEFAULT,
--                       r->pool) != APR_SUCCESS)) {
--        return ret;
--    }
--
--    /* "%% [Wed Jun 19 10:53:21 1996] GET /cgi-bin/printenv HTTP/1.0" */
--    apr_ctime(time_str, apr_time_now());
--    apr_file_printf(f, "%%%% [%s] %s %s%s%s %s\n", time_str, r->method, r->uri,
--                    r->args ? "?" : "", r->args ? r->args : "", r->protocol);
--    /* "%% 500 /usr/local/apache/cgi-bin */
--    apr_file_printf(f, "%%%% %d %s\n", ret, r->filename);
--
--    apr_file_printf(f, "%%error\n%s\n", error);
--
--    apr_file_close(f);
--    return ret;
--}
--
--/* Soak up stderr from a script and redirect it to the error log.
-- */
--static apr_status_t log_script_err(request_rec *r, apr_file_t *script_err)
--{
--    char argsbuffer[HUGE_STRING_LEN];
--    char *newline;
--    apr_status_t rv;
--    cgi_server_conf *conf = ap_get_module_config(r->server->module_config, &cgi_module);
--
--    while ((rv = apr_file_gets(argsbuffer, HUGE_STRING_LEN,
--                               script_err)) == APR_SUCCESS) {
--        newline = strchr(argsbuffer, '\n');
--        if (newline) {
--            *newline = '\0';
--        }
--        log_scripterror(r, conf, r->status, 0, APLOGNO(01215), argsbuffer);
--    }
--
--    return rv;
--}
--
- static int log_script(request_rec *r, cgi_server_conf * conf, int ret,
-                       char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
-                       apr_file_t *script_err)
-@@ -563,230 +506,23 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv,
-     return APR_SUCCESS;
- }
- 
--static void discard_script_output(apr_bucket_brigade *bb)
--{
--    apr_bucket *e;
--    const char *buf;
--    apr_size_t len;
--
--    for (e = APR_BRIGADE_FIRST(bb);
--         e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e);
--         e = APR_BRIGADE_FIRST(bb))
--    {
--        if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) {
--            break;
--        }
--        apr_bucket_delete(e);
--    }
--}
--
--#if APR_FILES_AS_SOCKETS
--
--/* A CGI bucket type is needed to catch any output to stderr from the
-- * script; see PR 22030. */
--static const apr_bucket_type_t bucket_type_cgi;
--
--struct cgi_bucket_data {
--    apr_pollset_t *pollset;
--    request_rec *r;
--};
--
--/* Create a CGI bucket using pipes from script stdout 'out'
-- * and stderr 'err', for request 'r'. */
--static apr_bucket *cgi_bucket_create(request_rec *r,
--                                     apr_file_t *out, apr_file_t *err,
--                                     apr_bucket_alloc_t *list)
--{
--    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
--    apr_status_t rv;
--    apr_pollfd_t fd;
--    struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data);
--
--    APR_BUCKET_INIT(b);
--    b->free = apr_bucket_free;
--    b->list = list;
--    b->type = &bucket_type_cgi;
--    b->length = (apr_size_t)(-1);
--    b->start = -1;
--
--    /* Create the pollset */
--    rv = apr_pollset_create(&data->pollset, 2, r->pool, 0);
--    if (rv != APR_SUCCESS) {
--        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01217)
--                     "apr_pollset_create(); check system or user limits");
--        return NULL;
--    }
--
--    fd.desc_type = APR_POLL_FILE;
--    fd.reqevents = APR_POLLIN;
--    fd.p = r->pool;
--    fd.desc.f = out; /* script's stdout */
--    fd.client_data = (void *)1;
--    rv = apr_pollset_add(data->pollset, &fd);
--    if (rv != APR_SUCCESS) {
--        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01218)
--                     "apr_pollset_add(); check system or user limits");
--        return NULL;
--    }
--
--    fd.desc.f = err; /* script's stderr */
--    fd.client_data = (void *)2;
--    rv = apr_pollset_add(data->pollset, &fd);
--    if (rv != APR_SUCCESS) {
--        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01219)
--                     "apr_pollset_add(); check system or user limits");
--        return NULL;
--    }
--
--    data->r = r;
--    b->data = data;
--    return b;
--}
--
--/* Create a duplicate CGI bucket using given bucket data */
--static apr_bucket *cgi_bucket_dup(struct cgi_bucket_data *data,
--                                  apr_bucket_alloc_t *list)
--{
--    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
--    APR_BUCKET_INIT(b);
--    b->free = apr_bucket_free;
--    b->list = list;
--    b->type = &bucket_type_cgi;
--    b->length = (apr_size_t)(-1);
--    b->start = -1;
--    b->data = data;
--    return b;
--}
--
--/* Handle stdout from CGI child.  Duplicate of logic from the _read
-- * method of the real APR pipe bucket implementation. */
--static apr_status_t cgi_read_stdout(apr_bucket *a, apr_file_t *out,
--                                    const char **str, apr_size_t *len)
--{
--    char *buf;
--    apr_status_t rv;
--
--    *str = NULL;
--    *len = APR_BUCKET_BUFF_SIZE;
--    buf = apr_bucket_alloc(*len, a->list); /* XXX: check for failure? */
--
--    rv = apr_file_read(out, buf, len);
--
--    if (rv != APR_SUCCESS && rv != APR_EOF) {
--        apr_bucket_free(buf);
--        return rv;
--    }
--
--    if (*len > 0) {
--        struct cgi_bucket_data *data = a->data;
--        apr_bucket_heap *h;
--
--        /* Change the current bucket to refer to what we read */
--        a = apr_bucket_heap_make(a, buf, *len, apr_bucket_free);
--        h = a->data;
--        h->alloc_len = APR_BUCKET_BUFF_SIZE; /* note the real buffer size */
--        *str = buf;
--        APR_BUCKET_INSERT_AFTER(a, cgi_bucket_dup(data, a->list));
--    }
--    else {
--        apr_bucket_free(buf);
--        a = apr_bucket_immortal_make(a, "", 0);
--        *str = a->data;
--    }
--    return rv;
--}
--
--/* Read method of CGI bucket: polls on stderr and stdout of the child,
-- * sending any stderr output immediately away to the error log. */
--static apr_status_t cgi_bucket_read(apr_bucket *b, const char **str,
--                                    apr_size_t *len, apr_read_type_e block)
--{
--    struct cgi_bucket_data *data = b->data;
--    apr_interval_time_t timeout = 0;
--    apr_status_t rv;
--    int gotdata = 0;
--    cgi_dirconf *dc = ap_get_module_config(data->r->per_dir_config, &cgi_module);
--
--    if (block != APR_NONBLOCK_READ) {
--        timeout = dc->timeout > 0 ? dc->timeout : data->r->server->timeout;
--    }
--
--    do {
--        const apr_pollfd_t *results;
--        apr_int32_t num;
--
--        rv = apr_pollset_poll(data->pollset, timeout, &num, &results);
--        if (APR_STATUS_IS_TIMEUP(rv)) {
--            if (timeout) {
--                ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, data->r, APLOGNO(01220)
--                              "Timeout waiting for output from CGI script %s",
--                              data->r->filename);
--                return rv;
--            }
--            else {
--                return APR_EAGAIN;
--            }
--        }
--        else if (APR_STATUS_IS_EINTR(rv)) {
--            continue;
--        }
--        else if (rv != APR_SUCCESS) {
--            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, data->r, APLOGNO(01221)
--                          "poll failed waiting for CGI child");
--            return rv;
--        }
--
--        for (; num; num--, results++) {
--            if (results[0].client_data == (void *)1) {
--                /* stdout */
--                rv = cgi_read_stdout(b, results[0].desc.f, str, len);
--                if (APR_STATUS_IS_EOF(rv)) {
--                    rv = APR_SUCCESS;
--                }
--                gotdata = 1;
--            } else {
--                /* stderr */
--                apr_status_t rv2 = log_script_err(data->r, results[0].desc.f);
--                if (APR_STATUS_IS_EOF(rv2)) {
--                    apr_pollset_remove(data->pollset, &results[0]);
--                }
--            }
--        }
--
--    } while (!gotdata);
--
--    return rv;
--}
--
--static const apr_bucket_type_t bucket_type_cgi = {
--    "CGI", 5, APR_BUCKET_DATA,
--    apr_bucket_destroy_noop,
--    cgi_bucket_read,
--    apr_bucket_setaside_notimpl,
--    apr_bucket_split_notimpl,
--    apr_bucket_copy_notimpl
--};
--
--#endif
--
- static int cgi_handler(request_rec *r)
- {
-     int nph;
--    apr_size_t dbpos = 0;
-+    apr_size_t dbufsize;
-     const char *argv0;
-     const char *command;
-     const char **argv;
-     char *dbuf = NULL;
-     apr_file_t *script_out = NULL, *script_in = NULL, *script_err = NULL;
--    apr_bucket_brigade *bb;
-+    conn_rec *c = r->connection;
-+    apr_bucket_brigade *bb = apr_brigade_create(r->pool, c->bucket_alloc);
-     apr_bucket *b;
-     int is_included;
--    int seen_eos, child_stopped_reading;
-     apr_pool_t *p;
-     cgi_server_conf *conf;
-     apr_status_t rv;
-     cgi_exec_info_t e_info;
--    conn_rec *c;
-     cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module);
-     apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
- 
-@@ -794,8 +530,6 @@ static int cgi_handler(request_rec *r)
-         return DECLINED;
-     }
- 
--    c = r->connection;
--
-     is_included = !strcmp(r->protocol, "INCLUDED");
- 
-     p = r->main ? r->main->pool : r->pool;
-@@ -864,83 +598,24 @@ static int cgi_handler(request_rec *r)
-         return HTTP_INTERNAL_SERVER_ERROR;
-     }
- 
--    /* Transfer any put/post args, CERN style...
--     * Note that we already ignore SIGPIPE in the core server.
--     */
--    bb = apr_brigade_create(r->pool, c->bucket_alloc);
--    seen_eos = 0;
--    child_stopped_reading = 0;
-+    /* Buffer for logging script stdout. */
-     if (conf->logname) {
--        dbuf = apr_palloc(r->pool, conf->bufbytes + 1);
--        dbpos = 0;
-+        dbufsize = conf->bufbytes;
-+        dbuf = apr_palloc(r->pool, dbufsize + 1);
-     }
--    do {
--        apr_bucket *bucket;
--
--        rv = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES,
--                            APR_BLOCK_READ, HUGE_STRING_LEN);
--
--        if (rv != APR_SUCCESS) {
--            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01225)
--                          "Error reading request entity data");
--            return ap_map_http_request_error(rv, HTTP_BAD_REQUEST);
--        }
--
--        for (bucket = APR_BRIGADE_FIRST(bb);
--             bucket != APR_BRIGADE_SENTINEL(bb);
--             bucket = APR_BUCKET_NEXT(bucket))
--        {
--            const char *data;
--            apr_size_t len;
--
--            if (APR_BUCKET_IS_EOS(bucket)) {
--                seen_eos = 1;
--                break;
--            }
--
--            /* We can't do much with this. */
--            if (APR_BUCKET_IS_FLUSH(bucket)) {
--                continue;
--            }
--
--            /* If the child stopped, we still must read to EOS. */
--            if (child_stopped_reading) {
--                continue;
--            }
--
--            /* read */
--            apr_bucket_read(bucket, &data, &len, APR_BLOCK_READ);
--
--            if (conf->logname && dbpos < conf->bufbytes) {
--                int cursize;
--
--                if ((dbpos + len) > conf->bufbytes) {
--                    cursize = conf->bufbytes - dbpos;
--                }
--                else {
--                    cursize = len;
--                }
--                memcpy(dbuf + dbpos, data, cursize);
--                dbpos += cursize;
--            }
--
--            /* Keep writing data to the child until done or too much time
--             * elapses with no progress or an error occurs.
--             */
--            rv = apr_file_write_full(script_out, data, len, NULL);
--
--            if (rv != APR_SUCCESS) {
--                /* silly script stopped reading, soak up remaining message */
--                child_stopped_reading = 1;
--            }
--        }
--        apr_brigade_cleanup(bb);
-+    else {
-+        dbufsize = 0;
-+        dbuf = NULL;
-     }
--    while (!seen_eos);
- 
--    if (conf->logname) {
--        dbuf[dbpos] = '\0';
-+    /* Read the request body. */
-+    rv = cgi_handle_request(r, script_out, bb, dbuf, dbufsize);
-+    if (rv) {
-+        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01225)
-+                      "Error reading request entity data");
-+        return ap_map_http_request_error(rv, HTTP_BAD_REQUEST);
-     }
-+
-     /* Is this flush really needed? */
-     apr_file_flush(script_out);
-     apr_file_close(script_out);
-@@ -948,10 +623,7 @@ static int cgi_handler(request_rec *r)
-     AP_DEBUG_ASSERT(script_in != NULL);
- 
- #if APR_FILES_AS_SOCKETS
--    apr_file_pipe_timeout_set(script_in, 0);
--    apr_file_pipe_timeout_set(script_err, 0);
--
--    b = cgi_bucket_create(r, script_in, script_err, c->bucket_alloc);
-+    b = cgi_bucket_create(r, dc->timeout, script_in, script_err, c->bucket_alloc);
-     if (b == NULL)
-         return HTTP_INTERNAL_SERVER_ERROR;
- #else
-@@ -961,120 +633,7 @@ static int cgi_handler(request_rec *r)
-     b = apr_bucket_eos_create(c->bucket_alloc);
-     APR_BRIGADE_INSERT_TAIL(bb, b);
- 
--    /* Handle script return... */
--    if (!nph) {
--        const char *location;
--        char sbuf[MAX_STRING_LEN];
--        int ret;
--
--        ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
--                                                   APLOG_MODULE_INDEX);
--
--        /* xCGI has its own body framing mechanism which we don't
--         * match against any provided Content-Length, so let the
--         * core determine C-L vs T-E based on what's actually sent.
--         */
--        if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
--            apr_table_unset(r->headers_out, "Content-Length");
--        apr_table_unset(r->headers_out, "Transfer-Encoding");
--
--        if (ret != OK) {
--            ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err);
--
--            /*
--             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
--             * does not set an explicit status and ap_meets_conditions, which
--             * is called by ap_scan_script_header_err_brigade, detects that
--             * the conditions of the requests are met and the response is
--             * not modified.
--             * In this case set r->status and return OK in order to prevent
--             * running through the error processing stack as this would
--             * break with mod_cache, if the conditions had been set by
--             * mod_cache itself to validate a stale entity.
--             * BTW: We circumvent the error processing stack anyway if the
--             * CGI script set an explicit status code (whatever it is) and
--             * the only possible values for ret here are:
--             *
--             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
--             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
--             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
--             * processing of the response of the CGI script, e.g broken headers
--             * or a crashed CGI process).
--             */
--            if (ret == HTTP_NOT_MODIFIED) {
--                r->status = ret;
--                return OK;
--            }
--
--            return ret;
--        }
--
--        location = apr_table_get(r->headers_out, "Location");
--
--        if (location && r->status == 200) {
--            /* For a redirect whether internal or not, discard any
--             * remaining stdout from the script, and log any remaining
--             * stderr output, as normal. */
--            discard_script_output(bb);
--            apr_brigade_destroy(bb);
--            apr_file_pipe_timeout_set(script_err, timeout);
--            log_script_err(r, script_err);
--        }
--
--        if (location && location[0] == '/' && r->status == 200) {
--            /* This redirect needs to be a GET no matter what the original
--             * method was.
--             */
--            r->method = "GET";
--            r->method_number = M_GET;
--
--            /* We already read the message body (if any), so don't allow
--             * the redirected request to think it has one.  We can ignore
--             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
--             */
--            apr_table_unset(r->headers_in, "Content-Length");
--
--            ap_internal_redirect_handler(location, r);
--            return OK;
--        }
--        else if (location && r->status == 200) {
--            /* XXX: Note that if a script wants to produce its own Redirect
--             * body, it now has to explicitly *say* "Status: 302"
--             */
--            return HTTP_MOVED_TEMPORARILY;
--        }
--
--        rv = ap_pass_brigade(r->output_filters, bb);
--    }
--    else /* nph */ {
--        struct ap_filter_t *cur;
--
--        /* get rid of all filters up through protocol...  since we
--         * haven't parsed off the headers, there is no way they can
--         * work
--         */
--
--        cur = r->proto_output_filters;
--        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
--            cur = cur->next;
--        }
--        r->output_filters = r->proto_output_filters = cur;
--
--        rv = ap_pass_brigade(r->output_filters, bb);
--    }
--
--    /* don't soak up script output if errors occurred writing it
--     * out...  otherwise, we prolong the life of the script when the
--     * connection drops or we stopped sending output for some other
--     * reason */
--    if (rv == APR_SUCCESS && !r->connection->aborted) {
--        apr_file_pipe_timeout_set(script_err, timeout);
--        log_script_err(r, script_err);
--    }
--
--    apr_file_close(script_err);
--
--    return OK;                      /* NOT r->status, even if it has changed. */
-+    return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err);
- }
- 
- /*============================================================================
-@@ -1188,107 +747,9 @@ static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f,
-     return APR_SUCCESS;
- }
- 
--static apr_status_t handle_exec(include_ctx_t *ctx, ap_filter_t *f,
--                                apr_bucket_brigade *bb)
--{
--    char *tag = NULL;
--    char *tag_val = NULL;
--    request_rec *r = f->r;
--    char *file = r->filename;
--    char parsed_string[MAX_STRING_LEN];
--
--    if (!ctx->argc) {
--        ap_log_rerror(APLOG_MARK,
--                      (ctx->flags & SSI_FLAG_PRINTING)
--                          ? APLOG_ERR : APLOG_WARNING,
--                      0, r, APLOGNO(03195)
--                      "missing argument for exec element in %s", r->filename);
--    }
--
--    if (!(ctx->flags & SSI_FLAG_PRINTING)) {
--        return APR_SUCCESS;
--    }
--
--    if (!ctx->argc) {
--        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
--        return APR_SUCCESS;
--    }
--
--    if (ctx->flags & SSI_FLAG_NO_EXEC) {
--        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01228) "exec used but not allowed "
--                      "in %s", r->filename);
--        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
--        return APR_SUCCESS;
--    }
--
--    while (1) {
--        cgi_pfn_gtv(ctx, &tag, &tag_val, SSI_VALUE_DECODED);
--        if (!tag || !tag_val) {
--            break;
--        }
--
--        if (!strcmp(tag, "cmd")) {
--            apr_status_t rv;
--
--            cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
--                       SSI_EXPAND_LEAVE_NAME);
--
--            rv = include_cmd(ctx, f, bb, parsed_string);
--            if (rv != APR_SUCCESS) {
--                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01229) "execution failure "
--                              "for parameter \"%s\" to tag exec in file %s",
--                              tag, r->filename);
--                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
--                break;
--            }
--        }
--        else if (!strcmp(tag, "cgi")) {
--            apr_status_t rv;
--
--            cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
--                       SSI_EXPAND_DROP_NAME);
--
--            rv = include_cgi(ctx, f, bb, parsed_string);
--            if (rv != APR_SUCCESS) {
--                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01230) "invalid CGI ref "
--                              "\"%s\" in %s", tag_val, file);
--                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
--                break;
--            }
--        }
--        else {
--            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01231) "unknown parameter "
--                          "\"%s\" to tag exec in %s", tag, file);
--            SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
--            break;
--        }
--    }
--
--    return APR_SUCCESS;
--}
--
--
--/*============================================================================
-- *============================================================================
-- * This is the end of the cgi filter code moved from mod_include.
-- *============================================================================
-- *============================================================================*/
--
--
- static int cgi_post_config(apr_pool_t *p, apr_pool_t *plog,
-                                 apr_pool_t *ptemp, server_rec *s)
- {
--    cgi_pfn_reg_with_ssi = APR_RETRIEVE_OPTIONAL_FN(ap_register_include_handler);
--    cgi_pfn_gtv          = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_get_tag_and_value);
--    cgi_pfn_ps           = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_parse_string);
--
--    if ((cgi_pfn_reg_with_ssi) && (cgi_pfn_gtv) && (cgi_pfn_ps)) {
--        /* Required by mod_include filter. This is how mod_cgi registers
--         *   with mod_include to provide processing of the exec directive.
--         */
--        cgi_pfn_reg_with_ssi("exec", handle_exec);
--    }
--
-     /* This is the means by which unusual (non-unix) os's may find alternate
-      * means to run a given command (e.g. shebang/registry parsing on Win32)
-      */
-@@ -1304,6 +765,7 @@ static void register_hooks(apr_pool_t *p)
-     static const char * const aszPre[] = { "mod_include.c", NULL };
-     ap_hook_handler(cgi_handler, NULL, NULL, APR_HOOK_MIDDLE);
-     ap_hook_post_config(cgi_post_config, aszPre, NULL, APR_HOOK_REALLY_FIRST);
-+    ap_hook_optional_fn_retrieve(cgi_optfns_retrieve, NULL, NULL, APR_HOOK_MIDDLE);
- }
- 
- AP_DECLARE_MODULE(cgi) =
-diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c
-index 4bab59f932..1d55b8dc48 100644
---- a/modules/generators/mod_cgid.c
-+++ b/modules/generators/mod_cgid.c
-@@ -57,7 +57,6 @@
- #include "http_protocol.h"
- #include "http_main.h"
- #include "http_log.h"
--#include "util_script.h"
- #include "ap_mpm.h"
- #include "mpm_common.h"
- #include "mod_suexec.h"
-@@ -80,11 +79,6 @@ module AP_MODULE_DECLARE_DATA cgid_module;
- 
- static int cgid_start(apr_pool_t *p, server_rec *main_server, apr_proc_t *procnew);
- static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *main_server);
--static int handle_exec(include_ctx_t *ctx, ap_filter_t *f, apr_bucket_brigade *bb);
--
--static APR_OPTIONAL_FN_TYPE(ap_register_include_handler) *cgid_pfn_reg_with_ssi;
--static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgid_pfn_gtv;
--static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgid_pfn_ps;
- 
- static apr_pool_t *pcgi = NULL;
- static pid_t daemon_pid;
-@@ -220,6 +214,15 @@ typedef struct {
- #endif
- } cgid_req_t;
- 
-+#define cgi_server_conf cgid_server_conf
-+#define cgi_module cgid_module
-+
-+#ifdef HAVE_CGID_FDPASSING
-+/* Pull in CGI bucket implementation. */
-+#define WANT_CGI_BUCKET
-+#endif
-+#include "cgi_common.h"
-+
- /* This routine is called to create the argument list to be passed
-  * to the CGI script.  When suexec is enabled, the suexec path, user, and
-  * group are the first three arguments to be passed; if not, all three
-@@ -342,15 +345,19 @@ static apr_status_t close_unix_socket(void *thefd)
-     return close(fd);
- }
- 
--/* deal with incomplete reads and signals
-- * assume you really have to read buf_size bytes
-- */
--static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
-+/* Read from the socket dealing with incomplete messages and signals.
-+ * Returns 0 on success or errno on failure.  Stderr fd passed as
-+ * auxiliary data from other end is written to *errfd, or else stderr
-+ * fileno if not present. */
-+static apr_status_t sock_readhdr(int fd, int *errfd, void *vbuf, size_t buf_size)
- {
--    char *buf = vbuf;
-     int rc;
-+#ifndef HAVE_CGID_FDPASSING
-+    char *buf = vbuf;
-     size_t bytes_read = 0;
- 
-+    if (errfd) *errfd = 0;
-+    
-     do {
-         do {
-             rc = read(fd, buf + bytes_read, buf_size - bytes_read);
-@@ -365,9 +372,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
-         }
-     } while (bytes_read < buf_size);
- 
-+   
-+#else /* with FD passing */
-+    struct msghdr msg = {0};
-+    struct iovec vec = {vbuf, buf_size};
-+    struct cmsghdr *cmsg;
-+    union {  /* union to ensure alignment */
-+        struct cmsghdr cm;
-+        char buf[CMSG_SPACE(sizeof(int))];
-+    } u;
-+    
-+    msg.msg_iov = &vec;
-+    msg.msg_iovlen = 1;
-+
-+    if (errfd) {
-+        msg.msg_control = u.buf;
-+        msg.msg_controllen = sizeof(u.buf);
-+        *errfd = 0;
-+    }
-+    
-+    /* use MSG_WAITALL to skip loop on truncated reads */
-+    do {
-+        rc = recvmsg(fd, &msg, MSG_WAITALL);
-+    } while (rc < 0 && errno == EINTR);
-+
-+    if (rc == 0) {
-+        return ECONNRESET;
-+    }
-+    else if (rc < 0) {
-+        return errno;
-+    }
-+    else if (rc != buf_size) {
-+        /* MSG_WAITALL should ensure the recvmsg blocks until the
-+         * entire length is read, but let's be paranoid. */
-+        return APR_INCOMPLETE;
-+    }
-+
-+    if (errfd
-+        && (cmsg = CMSG_FIRSTHDR(&msg)) != NULL
-+        && cmsg->cmsg_len == CMSG_LEN(sizeof(*errfd))
-+        && cmsg->cmsg_level == SOL_SOCKET
-+        && cmsg->cmsg_type == SCM_RIGHTS) {
-+        *errfd = *((int *) CMSG_DATA(cmsg));
-+    }
-+#endif
-+    
-     return APR_SUCCESS;
- }
- 
-+/* As sock_readhdr but without auxiliary fd passing. */
-+static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
-+{
-+    return sock_readhdr(fd, NULL, vbuf, buf_size);
-+}
-+
- /* deal with signals
-  */
- static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
-@@ -384,7 +442,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
-     return APR_SUCCESS;
- }
- 
--static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
-+static apr_status_t sock_writev(int fd, int auxfd, request_rec *r, int count, ...)
- {
-     va_list ap;
-     int rc;
-@@ -399,9 +457,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
-     }
-     va_end(ap);
- 
-+#ifndef HAVE_CGID_FDPASSING
-     do {
-         rc = writev(fd, vec, count);
-     } while (rc < 0 && errno == EINTR);
-+#else
-+    {
-+        struct msghdr msg = { 0 };
-+        struct cmsghdr *cmsg;
-+        union { /* union for alignment */
-+            char buf[CMSG_SPACE(sizeof(int))];
-+            struct cmsghdr align;
-+        } u;
-+
-+        msg.msg_iov = vec;
-+        msg.msg_iovlen = count;
-+
-+        if (auxfd) {
-+            msg.msg_control = u.buf;
-+            msg.msg_controllen = sizeof(u.buf);
-+
-+            cmsg = CMSG_FIRSTHDR(&msg);
-+            cmsg->cmsg_level = SOL_SOCKET;
-+            cmsg->cmsg_type = SCM_RIGHTS;
-+            cmsg->cmsg_len = CMSG_LEN(sizeof(int));
-+            *((int *) CMSG_DATA(cmsg)) = auxfd;
-+        }
-+
-+        do {
-+            rc = sendmsg(fd, &msg, 0);
-+        } while (rc < 0 && errno == EINTR);
-+    }
-+#endif
-+    
-     if (rc < 0) {
-         return errno;
-     }
-@@ -410,7 +498,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
- }
- 
- static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
--                            cgid_req_t *req)
-+                            int *errfd, cgid_req_t *req)
- {
-     int i;
-     char **environ;
-@@ -421,7 +509,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
-     r->server = apr_pcalloc(r->pool, sizeof(server_rec));
- 
-     /* read the request header */
--    stat = sock_read(fd, req, sizeof(*req));
-+    stat = sock_readhdr(fd, errfd, req, sizeof(*req));
-     if (stat != APR_SUCCESS) {
-         return stat;
-     }
-@@ -431,6 +519,14 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
-         return APR_SUCCESS;
-     }
- 
-+    /* Sanity check the structure received. */
-+    if (req->env_count < 0 || req->uri_len == 0
-+        || req->filename_len > APR_PATH_MAX || req->filename_len == 0
-+        || req->argv0_len > APR_PATH_MAX || req->argv0_len == 0
-+        || req->loglevel > APLOG_TRACE8) {
-+        return APR_EINVAL;
-+    }
-+    
-     /* handle module indexes and such */
-     rconf = (void **)ap_create_request_config(r->pool);
- 
-@@ -479,14 +575,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
-     return APR_SUCCESS;
- }
- 
--static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
--                             int req_type)
-+static apr_status_t send_req(int fd, apr_file_t *errpipe, request_rec *r,
-+                             const char *argv0, char **env, int req_type)
- {
-     int i;
-     cgid_req_t req = {0};
-     apr_status_t stat;
-     ap_unix_identity_t * ugid = ap_run_get_suexec_identity(r);
-     core_dir_config *core_conf = ap_get_core_module_config(r->per_dir_config);
-+    int errfd;
- 
- 
-     if (ugid == NULL) {
-@@ -507,16 +604,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
-     req.args_len = r->args ? strlen(r->args) : 0;
-     req.loglevel = r->server->log.level;
- 
-+    if (errpipe)
-+        apr_os_file_get(&errfd, errpipe);
-+    else
-+        errfd = 0;
-+    
-     /* Write the request header */
-     if (req.args_len) {
--        stat = sock_writev(fd, r, 5,
-+        stat = sock_writev(fd, errfd, r, 5,
-                            &req, sizeof(req),
-                            r->filename, req.filename_len,
-                            argv0, req.argv0_len,
-                            r->uri, req.uri_len,
-                            r->args, req.args_len);
-     } else {
--        stat = sock_writev(fd, r, 4,
-+        stat = sock_writev(fd, errfd, r, 4,
-                            &req, sizeof(req),
-                            r->filename, req.filename_len,
-                            argv0, req.argv0_len,
-@@ -531,7 +633,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
-     for (i = 0; i < req.env_count; i++) {
-         apr_size_t curlen = strlen(env[i]);
- 
--        if ((stat = sock_writev(fd, r, 2, &curlen, sizeof(curlen),
-+        if ((stat = sock_writev(fd, 0, r, 2, &curlen, sizeof(curlen),
-                                 env[i], curlen)) != APR_SUCCESS) {
-             return stat;
-         }
-@@ -582,20 +684,34 @@ static void daemon_signal_handler(int sig)
-     }
- }
- 
-+/* Callback executed in the forked child process if exec of the CGI
-+ * script fails.  For the fd-passing case, output to stderr goes to
-+ * the client (request handling thread) and is logged via
-+ * ap_log_rerror there.  For the non-fd-passing case, the "fake"
-+ * request_rec passed via userdata is used to log. */
- static void cgid_child_errfn(apr_pool_t *pool, apr_status_t err,
-                              const char *description)
- {
--    request_rec *r;
-     void *vr;
- 
-     apr_pool_userdata_get(&vr, ERRFN_USERDATA_KEY, pool);
--    r = vr;
--
--    /* sure we got r, but don't call ap_log_rerror() because we don't
--     * have r->headers_in and possibly other storage referenced by
--     * ap_log_rerror()
--     */
--    ap_log_error(APLOG_MARK, APLOG_ERR, err, r->server, APLOGNO(01241) "%s", description);
-+    if (vr) {
-+        request_rec *r = vr;
-+        
-+        /* sure we got r, but don't call ap_log_rerror() because we don't
-+         * have r->headers_in and possibly other storage referenced by
-+         * ap_log_rerror()
-+         */
-+        ap_log_error(APLOG_MARK, APLOG_ERR, err, r->server, APLOGNO(01241) "%s", description);
-+    }
-+    else {
-+        const char *logstr;
-+        
-+        logstr = apr_psprintf(pool, APLOGNO(01241) "error spawning CGI child: %s (%pm)\n",
-+                              description, &err);
-+        fputs(logstr, stderr);
-+        fflush(stderr);
-+    }
- }
- 
- static int cgid_server(void *data)
-@@ -670,7 +786,7 @@ static int cgid_server(void *data)
-     }
- 
-     while (!daemon_should_exit) {
--        int errfileno = STDERR_FILENO;
-+        int errfileno;
-         char *argv0 = NULL;
-         char **env = NULL;
-         const char * const *argv;
-@@ -710,7 +826,7 @@ static int cgid_server(void *data)
-         r = apr_pcalloc(ptrans, sizeof(request_rec));
-         procnew = apr_pcalloc(ptrans, sizeof(*procnew));
-         r->pool = ptrans;
--        stat = get_req(sd2, r, &argv0, &env, &cgid_req);
-+        stat = get_req(sd2, r, &argv0, &env, &errfileno, &cgid_req);
-         if (stat != APR_SUCCESS) {
-             ap_log_error(APLOG_MARK, APLOG_ERR, stat,
-                          main_server, APLOGNO(01248)
-@@ -742,6 +858,16 @@ static int cgid_server(void *data)
-             continue;
-         }
- 
-+        if (errfileno == 0) {
-+            errfileno = STDERR_FILENO;
-+        }
-+        else {
-+            ap_log_error(APLOG_MARK, APLOG_DEBUG, rv, main_server,
-+                          "using passed fd %d as stderr", errfileno);
-+            /* Limit the received fd lifetime to pool lifetime */
-+            apr_pool_cleanup_register(ptrans, (void *)((long)errfileno),
-+                                      close_unix_socket, close_unix_socket);
-+        }
-         apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool);
-         apr_os_file_put(&inout, &sd2, 0, r->pool);
- 
-@@ -801,7 +927,10 @@ static int cgid_server(void *data)
-             close(sd2);
-         }
-         else {
--            apr_pool_userdata_set(r, ERRFN_USERDATA_KEY, apr_pool_cleanup_null, ptrans);
-+            if (errfileno == STDERR_FILENO) {
-+                /* Used by cgid_child_errfn without fd-passing. */
-+                apr_pool_userdata_set(r, ERRFN_USERDATA_KEY, apr_pool_cleanup_null, ptrans);
-+            }
- 
-             argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args);
- 
-@@ -946,16 +1075,6 @@ static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp,
-         if (ret != OK ) {
-             return ret;
-         }
--        cgid_pfn_reg_with_ssi = APR_RETRIEVE_OPTIONAL_FN(ap_register_include_handler);
--        cgid_pfn_gtv          = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_get_tag_and_value);
--        cgid_pfn_ps           = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_parse_string);
--
--        if ((cgid_pfn_reg_with_ssi) && (cgid_pfn_gtv) && (cgid_pfn_ps)) {
--            /* Required by mod_include filter. This is how mod_cgid registers
--             *   with mod_include to provide processing of the exec directive.
--             */
--            cgid_pfn_reg_with_ssi("exec", handle_exec);
--        }
-     }
-     return ret;
- }
-@@ -1066,41 +1185,6 @@ static const command_rec cgid_cmds[] =
-     {NULL}
- };
- 
--static int log_scripterror(request_rec *r, cgid_server_conf * conf, int ret,
--                           apr_status_t rv, char *error)
--{
--    apr_file_t *f = NULL;
--    struct stat finfo;
--    char time_str[APR_CTIME_LEN];
--    int log_flags = rv ? APLOG_ERR : APLOG_ERR;
--
--    /* Intentional no APLOGNO */
--    /* Callee provides APLOGNO in error text */
--    ap_log_rerror(APLOG_MARK, log_flags, rv, r,
--                "%s: %s", error, r->filename);
--
--    /* XXX Very expensive mainline case! Open, then getfileinfo! */
--    if (!conf->logname ||
--        ((stat(conf->logname, &finfo) == 0)
--         && (finfo.st_size > conf->logbytes)) ||
--         (apr_file_open(&f, conf->logname,
--                  APR_APPEND|APR_WRITE|APR_CREATE, APR_OS_DEFAULT, r->pool) != APR_SUCCESS)) {
--        return ret;
--    }
--
--    /* "%% [Wed Jun 19 10:53:21 1996] GET /cgid-bin/printenv HTTP/1.0" */
--    apr_ctime(time_str, apr_time_now());
--    apr_file_printf(f, "%%%% [%s] %s %s%s%s %s\n", time_str, r->method, r->uri,
--            r->args ? "?" : "", r->args ? r->args : "", r->protocol);
--    /* "%% 500 /usr/local/apache/cgid-bin */
--    apr_file_printf(f, "%%%% %d %s\n", ret, r->filename);
--
--    apr_file_printf(f, "%%error\n%s\n", error);
--
--    apr_file_close(f);
--    return ret;
--}
--
- static int log_script(request_rec *r, cgid_server_conf * conf, int ret,
-                       char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
-                       apr_file_t *script_err)
-@@ -1221,7 +1305,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
-         ++connect_tries;
-         if ((sd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {
-             return log_scripterror(r, conf, HTTP_INTERNAL_SERVER_ERROR, errno,
--                                   APLOGNO(01255) "unable to create socket to cgi daemon");
-+                                   APLOGNO(01255), "unable to create socket to cgi daemon");
-         }
-         if (connect(sd, (struct sockaddr *)server_addr, server_addr_len) < 0) {
-             /* Save errno for later */
-@@ -1242,7 +1326,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
-             }
-             else {
-                 close(sd);
--                return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, errno, APLOGNO(01257)
-+                return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, errno, APLOGNO(01257),
-                                        "unable to connect to cgi daemon after multiple tries");
-             }
-         }
-@@ -1258,13 +1342,15 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
-         if (connect_errno == ENOENT &&
-             apr_time_sec(apr_time_now() - ap_scoreboard_image->global->restart_time) > 
-                 DEFAULT_CONNECT_STARTUP_DELAY) {
--            return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno, 
--                                   apr_pstrcat(r->pool, APLOGNO(02833) "ScriptSock ", sockname, " does not exist", NULL));
-+            return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno,
-+                                   APLOGNO(02833),
-+                                   apr_pstrcat(r->pool,
-+                                               "ScriptSock ", sockname, " does not exist", NULL));
-         }
- 
-         /* gotta try again, but make sure the cgid daemon is still around */
-         if (connect_errno != ENOENT && kill(daemon_pid, 0) != 0) {
--            return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno, APLOGNO(01258)
-+            return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno, APLOGNO(01258),
-                                    "cgid daemon is gone; is Apache terminating?");
-         }
-     }
-@@ -1272,23 +1358,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
-     return OK;
- }
- 
--static void discard_script_output(apr_bucket_brigade *bb)
--{
--    apr_bucket *e;
--    const char *buf;
--    apr_size_t len;
--
--    for (e = APR_BRIGADE_FIRST(bb);
--         e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e);
--         e = APR_BRIGADE_FIRST(bb))
--    {
--        if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) {
--            break;
--        }
--        apr_bucket_delete(e);
--    }
--}
--
- /****************************************************************
-  *
-  * Actual cgid handling...
-@@ -1374,7 +1443,9 @@ static apr_status_t get_cgi_pid(request_rec *r,  cgid_server_conf *conf, pid_t *
-         return stat;
-     }
- 
--    if (pid == 0) {
-+    /* Don't accept zero as a pid here, calling kill(0, SIGTERM) etc
-+     * later is unpleasant. */
-+    if (*pid == 0) {
-         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01261)
-                       "daemon couldn't find CGI process for connection %lu",
-                       r->connection->id);
-@@ -1393,19 +1464,21 @@ static apr_status_t cleanup_script(void *vptr)
- 
- static int cgid_handler(request_rec *r)
- {
--    int retval, nph, dbpos;
-+    conn_rec *c = r->connection;
-+    int retval, nph;
-     char *argv0, *dbuf;
--    apr_bucket_brigade *bb;
-+    apr_size_t dbufsize;
-+    apr_bucket_brigade *bb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
-     apr_bucket *b;
-     cgid_server_conf *conf;
-     int is_included;
--    int seen_eos, child_stopped_reading;
-     int sd;
-     char **env;
--    apr_file_t *tempsock;
-+    apr_file_t *tempsock, *script_err, *errpipe_out;
-     struct cleanup_script_info *info;
-     apr_status_t rv;
-     cgid_dirconf *dc;
-+    apr_interval_time_t timeout;
- 
-     if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
-         return DECLINED;
-@@ -1414,7 +1487,7 @@ static int cgid_handler(request_rec *r)
-     conf = ap_get_module_config(r->server->module_config, &cgid_module);
-     dc = ap_get_module_config(r->per_dir_config, &cgid_module);
- 
--    
-+    timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
-     is_included = !strcmp(r->protocol, "INCLUDED");
- 
-     if ((argv0 = strrchr(r->filename, '/')) != NULL) {
-@@ -1429,12 +1502,12 @@ static int cgid_handler(request_rec *r)
-     argv0 = r->filename;
- 
-     if (!(ap_allow_options(r) & OPT_EXECCGI) && !is_scriptaliased(r)) {
--        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01262)
-+        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01262),
-                 "Options ExecCGI is off in this directory");
-     }
- 
-     if (nph && is_included) {
--        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01263)
-+        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01263),
-                 "attempt to include NPH CGI script");
-     }
- 
-@@ -1443,12 +1516,12 @@ static int cgid_handler(request_rec *r)
- #error at mod_cgi.c for required code in this path.
- #else
-     if (r->finfo.filetype == APR_NOFILE) {
--        return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01264)
-+        return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01264),
-                 "script not found or unable to stat");
-     }
- #endif
-     if (r->finfo.filetype == APR_DIR) {
--        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01265)
-+        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01265),
-                 "attempt to invoke directory as script");
-     }
- 
-@@ -1456,7 +1529,7 @@ static int cgid_handler(request_rec *r)
-         r->path_info && *r->path_info)
-     {
-         /* default to accept */
--        return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01266)
-+        return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01266),
-                                "AcceptPathInfo off disallows user's path");
-     }
-     /*
-@@ -1467,6 +1540,17 @@ static int cgid_handler(request_rec *r)
-     }
-     */
- 
-+#ifdef HAVE_CGID_FDPASSING
-+    rv = apr_file_pipe_create(&script_err, &errpipe_out, r->pool);
-+    if (rv) {
-+        return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10176),
-+                               "could not create pipe for stderr");
-+    }
-+#else
-+    script_err = NULL;
-+    errpipe_out = NULL;
-+#endif
-+    
-     /*
-      * httpd core function used to add common environment variables like
-      * DOCUMENT_ROOT. 
-@@ -1479,24 +1563,28 @@ static int cgid_handler(request_rec *r)
-         return retval;
-     }
- 
--    rv = send_req(sd, r, argv0, env, CGI_REQ);
-+    rv = send_req(sd, errpipe_out, r, argv0, env, CGI_REQ);
-     if (rv != APR_SUCCESS) {
--        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01268)
--                     "write to cgi daemon process");
-+        return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10245),
-+                               "could not send request to cgi daemon");
-     }
- 
-+    /* The write-end of the pipe is only used by the server, so close
-+     * it here. */
-+    if (errpipe_out) apr_file_close(errpipe_out);
-+    
-     info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
-     info->conf = conf;
-     info->r = r;
-     rv = get_cgi_pid(r, conf, &(info->pid));
- 
--    if (APR_SUCCESS == rv){  
-+    if (rv == APR_SUCCESS) {
-         apr_pool_cleanup_register(r->pool, info,
--                              cleanup_script,
--                              apr_pool_cleanup_null);
-+                                  cleanup_script, apr_pool_cleanup_null);
-     }
-     else { 
--        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, rv, r, "error determining cgi PID");
-+        return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10246),
-+                               "failed reading PID from cgi daemon");
-     }
- 
-     /* We are putting the socket discriptor into an apr_file_t so that we can
-@@ -1506,95 +1594,25 @@ static int cgid_handler(request_rec *r)
-      */
- 
-     apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
--    if (dc->timeout > 0) { 
--        apr_file_pipe_timeout_set(tempsock, dc->timeout);
--    }
--    else { 
--        apr_file_pipe_timeout_set(tempsock, r->server->timeout);
--    }
-+    apr_file_pipe_timeout_set(tempsock, timeout);
-     apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket);
- 
--    /* Transfer any put/post args, CERN style...
--     * Note that we already ignore SIGPIPE in the core server.
--     */
--    bb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
--    seen_eos = 0;
--    child_stopped_reading = 0;
--    dbuf = NULL;
--    dbpos = 0;
-+    /* Buffer for logging script stdout. */
-     if (conf->logname) {
--        dbuf = apr_palloc(r->pool, conf->bufbytes + 1);
-+        dbufsize = conf->bufbytes;
-+        dbuf = apr_palloc(r->pool, dbufsize + 1);
-     }
--    do {
--        apr_bucket *bucket;
--
--        rv = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES,
--                            APR_BLOCK_READ, HUGE_STRING_LEN);
--
--        if (rv != APR_SUCCESS) {
--            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01270)
--                          "Error reading request entity data");
--            return ap_map_http_request_error(rv, HTTP_BAD_REQUEST);
--        }
--
--        for (bucket = APR_BRIGADE_FIRST(bb);
--             bucket != APR_BRIGADE_SENTINEL(bb);
--             bucket = APR_BUCKET_NEXT(bucket))
--        {
--            const char *data;
--            apr_size_t len;
--
--            if (APR_BUCKET_IS_EOS(bucket)) {
--                seen_eos = 1;
--                break;
--            }
--
--            /* We can't do much with this. */
--            if (APR_BUCKET_IS_FLUSH(bucket)) {
--                continue;
--            }
--
--            /* If the child stopped, we still must read to EOS. */
--            if (child_stopped_reading) {
--                continue;
--            }
--
--            /* read */
--            apr_bucket_read(bucket, &data, &len, APR_BLOCK_READ);
--
--            if (conf->logname && dbpos < conf->bufbytes) {
--                int cursize;
--
--                if ((dbpos + len) > conf->bufbytes) {
--                    cursize = conf->bufbytes - dbpos;
--                }
--                else {
--                    cursize = len;
--                }
--                memcpy(dbuf + dbpos, data, cursize);
--                dbpos += cursize;
--            }
--
--            /* Keep writing data to the child until done or too much time
--             * elapses with no progress or an error occurs.
--             */
--            rv = apr_file_write_full(tempsock, data, len, NULL);
--
--            if (rv != APR_SUCCESS) {
--                /* silly script stopped reading, soak up remaining message */
--                child_stopped_reading = 1;
--                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,  APLOGNO(02651)
--                              "Error writing request body to script %s", 
--                              r->filename);
--
--            }
--        }
--        apr_brigade_cleanup(bb);
-+    else {
-+        dbuf = NULL;
-+        dbufsize = 0;
-     }
--    while (!seen_eos);
- 
--    if (conf->logname) {
--        dbuf[dbpos] = '\0';
-+    /* Read the request body. */
-+    rv = cgi_handle_request(r, tempsock, bb, dbuf, dbufsize);
-+    if (rv) {
-+        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01270)
-+                      "Error reading request entity data");
-+        return ap_map_http_request_error(rv, HTTP_BAD_REQUEST);
-     }
- 
-     /* we're done writing, or maybe we didn't write at all;
-@@ -1603,134 +1621,22 @@ static int cgid_handler(request_rec *r)
-      */
-     shutdown(sd, 1);
- 
--    /* Handle script return... */
--    if (!nph) {
--        conn_rec *c = r->connection;
--        const char *location;
--        char sbuf[MAX_STRING_LEN];
--        int ret;
--
--        bb = apr_brigade_create(r->pool, c->bucket_alloc);
--        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
--        APR_BRIGADE_INSERT_TAIL(bb, b);
--        b = apr_bucket_eos_create(c->bucket_alloc);
--        APR_BRIGADE_INSERT_TAIL(bb, b);
--
--        ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
--                                                   APLOG_MODULE_INDEX);
--
--        /* xCGI has its own body framing mechanism which we don't
--         * match against any provided Content-Length, so let the
--         * core determine C-L vs T-E based on what's actually sent.
--         */
--        if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
--            apr_table_unset(r->headers_out, "Content-Length");
--        apr_table_unset(r->headers_out, "Transfer-Encoding");
--
--        if (ret != OK) {
--            ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL);
--
--            /*
--             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
--             * does not set an explicit status and ap_meets_conditions, which
--             * is called by ap_scan_script_header_err_brigade, detects that
--             * the conditions of the requests are met and the response is
--             * not modified.
--             * In this case set r->status and return OK in order to prevent
--             * running through the error processing stack as this would
--             * break with mod_cache, if the conditions had been set by
--             * mod_cache itself to validate a stale entity.
--             * BTW: We circumvent the error processing stack anyway if the
--             * CGI script set an explicit status code (whatever it is) and
--             * the only possible values for ret here are:
--             *
--             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
--             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
--             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
--             * processing of the response of the CGI script, e.g broken headers
--             * or a crashed CGI process).
--             */
--            if (ret == HTTP_NOT_MODIFIED) {
--                r->status = ret;
--                return OK;
--            }
--
--            return ret;
--        }
--
--        location = apr_table_get(r->headers_out, "Location");
--
--        if (location && location[0] == '/' && r->status == 200) {
--
--            /* Soak up all the script output */
--            discard_script_output(bb);
--            apr_brigade_destroy(bb);
--            /* This redirect needs to be a GET no matter what the original
--             * method was.
--             */
--            r->method = "GET";
--            r->method_number = M_GET;
--
--            /* We already read the message body (if any), so don't allow
--             * the redirected request to think it has one. We can ignore
--             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
--             */
--            apr_table_unset(r->headers_in, "Content-Length");
--
--            ap_internal_redirect_handler(location, r);
--            return OK;
--        }
--        else if (location && r->status == 200) {
--            /* XXX: Note that if a script wants to produce its own Redirect
--             * body, it now has to explicitly *say* "Status: 302"
--             */
--            discard_script_output(bb);
--            apr_brigade_destroy(bb);
--            return HTTP_MOVED_TEMPORARILY;
--        }
--
--        rv = ap_pass_brigade(r->output_filters, bb);
--        if (rv != APR_SUCCESS) { 
--            ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r,
--                          "Failed to flush CGI output to client");
--        }
--    }
--
--    if (nph) {
--        conn_rec *c = r->connection;
--        struct ap_filter_t *cur;
--
--        /* get rid of all filters up through protocol...  since we
--         * haven't parsed off the headers, there is no way they can
--         * work
--         */
--
--        cur = r->proto_output_filters;
--        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
--            cur = cur->next;
--        }
--        r->output_filters = r->proto_output_filters = cur;
--
--        bb = apr_brigade_create(r->pool, c->bucket_alloc);
--        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
--        APR_BRIGADE_INSERT_TAIL(bb, b);
--        b = apr_bucket_eos_create(c->bucket_alloc);
--        APR_BRIGADE_INSERT_TAIL(bb, b);
--        ap_pass_brigade(r->output_filters, bb);
--    }
-+    bb = apr_brigade_create(r->pool, c->bucket_alloc);
-+#ifdef HAVE_CGID_FDPASSING
-+    b = cgi_bucket_create(r, dc->timeout, tempsock, script_err, c->bucket_alloc);
-+    if (b == NULL)
-+        return HTTP_INTERNAL_SERVER_ERROR; /* should call log_scripterror() w/ _UNAVAILABLE? */
-+#else
-+    b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
-+#endif
-+    APR_BRIGADE_INSERT_TAIL(bb, b);
-+    b = apr_bucket_eos_create(c->bucket_alloc);
-+    APR_BRIGADE_INSERT_TAIL(bb, b);
- 
--    return OK; /* NOT r->status, even if it has changed. */
-+    return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err);
- }
- 
--
--
--
--/*============================================================================
-- *============================================================================
-- * This is the beginning of the cgi filter code moved from mod_include. This
-- *   is the code required to handle the "exec" SSI directive.
-- *============================================================================
-- *============================================================================*/
-+/* Handling include= for mod_include. */
- static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
-                                 apr_bucket_brigade *bb, char *s)
- {
-@@ -1815,7 +1721,7 @@ static void add_ssi_vars(request_rec *r)
- }
- 
- static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
--                       apr_bucket_brigade *bb, char *command)
-+                       apr_bucket_brigade *bb, const char *command)
- {
-     char **env;
-     int sd;
-@@ -1836,7 +1742,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
-         return retval;
-     }
- 
--    send_req(sd, r, command, env, SSI_REQ);
-+    send_req(sd, NULL, r, command, env, SSI_REQ);
- 
-     info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
-     info->conf = conf;
-@@ -1881,91 +1787,6 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
-     return APR_SUCCESS;
- }
- 
--static apr_status_t handle_exec(include_ctx_t *ctx, ap_filter_t *f,
--                                apr_bucket_brigade *bb)
--{
--    char *tag     = NULL;
--    char *tag_val = NULL;
--    request_rec *r = f->r;
--    char *file = r->filename;
--    char parsed_string[MAX_STRING_LEN];
--
--    if (!ctx->argc) {
--        ap_log_rerror(APLOG_MARK,
--                      (ctx->flags & SSI_FLAG_PRINTING)
--                          ? APLOG_ERR : APLOG_WARNING,
--                      0, r, APLOGNO(03196)
--                      "missing argument for exec element in %s", r->filename);
--    }
--
--    if (!(ctx->flags & SSI_FLAG_PRINTING)) {
--        return APR_SUCCESS;
--    }
--
--    if (!ctx->argc) {
--        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
--        return APR_SUCCESS;
--    }
--
--    if (ctx->flags & SSI_FLAG_NO_EXEC) {
--        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01271) "exec used but not allowed "
--                      "in %s", r->filename);
--        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
--        return APR_SUCCESS;
--    }
--
--    while (1) {
--        cgid_pfn_gtv(ctx, &tag, &tag_val, SSI_VALUE_DECODED);
--        if (!tag || !tag_val) {
--            break;
--        }
--
--        if (!strcmp(tag, "cmd")) {
--            apr_status_t rv;
--
--            cgid_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
--                        SSI_EXPAND_LEAVE_NAME);
--
--            rv = include_cmd(ctx, f, bb, parsed_string);
--            if (rv != APR_SUCCESS) {
--                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01272)
--                              "execution failure for parameter \"%s\" "
--                              "to tag exec in file %s", tag, r->filename);
--                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
--                break;
--            }
--        }
--        else if (!strcmp(tag, "cgi")) {
--            apr_status_t rv;
--
--            cgid_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
--                        SSI_EXPAND_DROP_NAME);
--
--            rv = include_cgi(ctx, f, bb, parsed_string);
--            if (rv != APR_SUCCESS) {
--                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01273) "invalid CGI ref "
--                              "\"%s\" in %s", tag_val, file);
--                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
--                break;
--            }
--        }
--        else {
--            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01274) "unknown parameter "
--                          "\"%s\" to tag exec in %s", tag, file);
--            SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
--            break;
--        }
--    }
--
--    return APR_SUCCESS;
--}
--/*============================================================================
-- *============================================================================
-- * This is the end of the cgi filter code moved from mod_include.
-- *============================================================================
-- *============================================================================*/
--
--
- static void register_hook(apr_pool_t *p)
- {
-     static const char * const aszPre[] = { "mod_include.c", NULL };
-@@ -1973,6 +1794,7 @@ static void register_hook(apr_pool_t *p)
-     ap_hook_pre_config(cgid_pre_config, NULL, NULL, APR_HOOK_MIDDLE);
-     ap_hook_post_config(cgid_init, aszPre, NULL, APR_HOOK_MIDDLE);
-     ap_hook_handler(cgid_handler, NULL, NULL, APR_HOOK_MIDDLE);
-+    ap_hook_optional_fn_retrieve(cgi_optfns_retrieve, NULL, NULL, APR_HOOK_MIDDLE);
- }
- 
- AP_DECLARE_MODULE(cgid) = {
diff --git a/httpd.spec b/httpd.spec
index 246a014..66e09d9 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -30,8 +30,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.59
-Release: 4%{?dist}
+Version: 2.4.61
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -92,23 +92,20 @@ Patch20: httpd-2.4.48-r1842929+.patch
 Patch21: httpd-2.4.43-mod_systemd.patch
 Patch22: httpd-2.4.53-export.patch
 Patch23: httpd-2.4.43-corelimit.patch
-Patch24: httpd-2.4.59-gettid.patch
-Patch25: httpd-2.4.54-icons.patch
-Patch26: httpd-2.4.43-cachehardmax.patch
-Patch27: httpd-2.4.43-socket-activation.patch
-Patch28: httpd-2.4.43-sslciphdefault.patch
-Patch29: httpd-2.4.43-sslprotdefault.patch
-Patch31: httpd-2.4.59-unifycgid.patch
-Patch32: httpd-2.4.43-logjournal.patch
-Patch33: httpd-2.4.53-separate-systemd-fns.patch
-Patch34: httpd-2.4.58-r1912477+.patch
-Patch36: httpd-2.4.58-r1914365.patch
-Patch37: httpd-2.4.54-selinux.patch
+Patch24: httpd-2.4.54-icons.patch
+Patch25: httpd-2.4.43-cachehardmax.patch
+Patch26: httpd-2.4.43-socket-activation.patch
+Patch27: httpd-2.4.43-sslciphdefault.patch
+Patch28: httpd-2.4.43-sslprotdefault.patch
+Patch29: httpd-2.4.43-logjournal.patch
+Patch30: httpd-2.4.53-separate-systemd-fns.patch
+Patch31: httpd-2.4.58-r1912477+.patch
+Patch32: httpd-2.4.58-r1914365.patch
+Patch33: httpd-2.4.54-selinux.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
-Patch61: httpd-2.4.59-r1916863.patch
 
 # Security fixes
 # Patch200: ...
@@ -835,6 +832,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Jul 03 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.61-1
+- new version 2.4.61
+
 * Thu May 23 2024 Joe Orton <jorton@redhat.com> - 2.4.59-4
 - mod_ssl: add engine bcond, disable ENGINE support by default for F41+
 - mod_ssl: enable SSL_OP_NO_RENEGOTIATION (upstream PR#426)
diff --git a/sources b/sources
index e8e92fb..08abe25 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
+SHA512 (httpd-2.4.61.tar.bz2) = 00656220ecc2b80788f539536553f0a3a57602fb981be22e63af87d0f98ffe5da3056e722ce52ae8cf9c2111ad1922b3aaea1fd7d69d0ed76795199203d593ff
+SHA512 (httpd-2.4.61.tar.bz2.asc) = fed6eb8ed866eba25c64bf89e959bca3dcc548134340c1c8cedbd78b93223dfd641fb2e6ab0d82f129504f7caf6f579b6f40ad03267fc9018efb0779ffcb2f64
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192
-SHA512 (httpd-2.4.59.tar.bz2) = 209da0bbac5e2564d4590302515b35495be6402273ff4024aa93e85e44554c95e053201d606383936425a41e1b5b97e6b40055dcbb385eb691a5029a6f3158c2
-SHA512 (httpd-2.4.59.tar.bz2.asc) = 85237e204e57d930e2b7a85a21f8d593e81895f96350c3a345978538a536f3c0614ba89256905c0aa558880fc6fb10608b8dd7cbd026af326b1d83601c267f2d

From d4e3bcb534f526463bb2e2efaa37eece4d121f62 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Sun, 14 Apr 2024 11:27:03 +0200
Subject: [PATCH 332/359] Add compat sbin Provides

In preparation for https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin.
rt requires /usr/sbin/apachectl.
perl-Plack requires /usr/sbin/httpd.
---
 httpd.spec | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/httpd.spec b/httpd.spec
index 66e09d9..d8f9fff 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -154,6 +154,14 @@ Conflicts: apr < 1.5.0-1
 Conflicts: httpd < 2.4.53-2
 Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2
 
+# Compat symlinks for Requires in other packages.
+%if "%{_sbindir}" == "%{_bindir}"
+# We rely on filesystem to create the symlink for us.
+Requires:           filesystem(unmerged-sbin-symlinks)
+Provides:           /usr/sbin/apachectl
+Provides:           /usr/sbin/httpd
+%endif
+
 %description core
 The httpd-core package contains essential httpd binaries.
 

From a58a25a2573323760178ca92b51d479cde8ed1da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Sun, 14 Apr 2024 19:14:39 +0200
Subject: [PATCH 333/359] Fix build when %_bindir==%_sbindir

Preparation for https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin.
The globs in %files were matching too many files, causing rpm
to report a file conflict for /usr/bin/suexec.
---
 httpd.spec | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index d8f9fff..42577f4 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -737,7 +737,8 @@ exit $rv
 %dir %{_libexecdir}/initscripts/legacy-actions/httpd
 %{_libexecdir}/initscripts/legacy-actions/httpd/*
 
-%{_sbindir}/ht*
+%{_sbindir}/httpd
+%{_sbindir}/htcacheclean
 %{_sbindir}/fcgistarter
 %{_sbindir}/apachectl
 %{_sbindir}/rotatelogs
@@ -790,7 +791,12 @@ exit $rv
 %{_sysusersdir}/httpd.conf
 
 %files tools
-%{_bindir}/*
+%{_bindir}/ab
+%{_bindir}/htdbm
+%{_bindir}/htdigest
+%{_bindir}/httxt2dbm
+%{_bindir}/htpasswd
+%{_bindir}/logresolve
 %{_mandir}/man1/*
 %doc LICENSE NOTICE
 %exclude %{_bindir}/apxs

From a2ee4184f20cba942f8bf65d53dcb8bd0abf7899 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Tue, 9 Jul 2024 13:20:10 +0200
Subject: [PATCH 334/359] Rebuilt for the bin-sbin merge

https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 42577f4..9581402 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.61
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -846,6 +846,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.4.61-2
+- Rebuilt for the bin-sbin merge
+
 * Wed Jul 03 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.61-1
 - new version 2.4.61
 

From 867a5dc05372a53af774b434e54854e812ada9fc Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 18 Jul 2024 09:25:07 +0000
Subject: [PATCH 335/359] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 9581402..3061e2c 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.61
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -846,6 +846,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.61-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
 * Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.4.61-2
 - Rebuilt for the bin-sbin merge
 

From ff21bd7facc8c4315f70fdd406f842f71ad50b4c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 19 Jul 2024 16:12:23 +0200
Subject: [PATCH 336/359] New version 2.4.62

---
 .gitignore                  |   1 +
 httpd-2.4.58-r1914365.patch | 221 ------------------------------------
 httpd.spec                  |  10 +-
 sources                     |   4 +-
 4 files changed, 9 insertions(+), 227 deletions(-)
 delete mode 100644 httpd-2.4.58-r1914365.patch

diff --git a/.gitignore b/.gitignore
index ed7e100..5bb7aaa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -51,3 +51,4 @@ x86_64
 /httpd-2.4.58.tar.bz2.asc
 /httpd-2.4.59.tar.bz2.asc
 /httpd-2.4.61.tar.bz2.asc
+/httpd-2.4.62.tar.bz2.asc
diff --git a/httpd-2.4.58-r1914365.patch b/httpd-2.4.58-r1914365.patch
deleted file mode 100644
index 8512de3..0000000
--- a/httpd-2.4.58-r1914365.patch
+++ /dev/null
@@ -1,221 +0,0 @@
-# ./pullrev.sh 1914365
-http://svn.apache.org/viewvc?view=revision&revision=1914365
-
-Upstream-Status: in trunk, not proposed for 2.4.x
-
---- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1914365
-+++ httpd-2.4.58/modules/ssl/ssl_engine_init.c
-@@ -1421,8 +1421,10 @@
-             if (cert) {
-                 if (SSL_CTX_use_certificate(mctx->ssl_ctx, cert) < 1) {
-                     ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10137)
--                                 "Failed to configure engine certificate %s, check %s",
--                                 key_id, certfile);
-+                                 "Failed to configure certificate %s from %s, check %s",
-+                                 key_id, mc->szCryptoDevice ?
-+                                             mc->szCryptoDevice : "provider",
-+                                 certfile);
-                     ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
-                     return APR_EGENERAL;
-                 }
-@@ -1433,8 +1435,9 @@
-             
-             if (SSL_CTX_use_PrivateKey(mctx->ssl_ctx, pkey) < 1) {
-                 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10130)
--                             "Failed to configure private key %s from engine",
--                             keyfile);
-+                             "Failed to configure private key %s from %s",
-+                             keyfile, mc->szCryptoDevice ?
-+                                          mc->szCryptoDevice : "provider");
-                 ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
-                 return APR_EGENERAL;
-             }
---- httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c.r1914365
-+++ httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c
-@@ -31,6 +31,9 @@
- #include "ssl_private.h"
- 
- #include <openssl/ui.h>
-+#if MODSSL_HAVE_OPENSSL_STORE
-+#include <openssl/store.h>
-+#endif
- 
- typedef struct {
-     server_rec         *s;
-@@ -608,7 +611,7 @@
-     return (len);
- }
- 
--#if MODSSL_HAVE_ENGINE_API
-+#if MODSSL_HAVE_ENGINE_API || MODSSL_HAVE_OPENSSL_STORE
- 
- /* OpenSSL UI implementation for passphrase entry; largely duplicated
-  * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be
-@@ -826,13 +829,14 @@
- }
- #endif
- 
--
--apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
-+#if MODSSL_HAVE_ENGINE_API
-+static apr_status_t modssl_load_keypair_engine(server_rec *s, apr_pool_t *p,
-                                         const char *vhostid,
--                                        const char *certid, const char *keyid,
--                                        X509 **pubkey, EVP_PKEY **privkey)
-+                                               const char *certid,
-+                                               const char *keyid,
-+                                               X509 **pubkey,
-+                                               EVP_PKEY **privkey)
- {
--#if MODSSL_HAVE_ENGINE_API
-     const char *c, *scheme;
-     ENGINE *e;
-     UI_METHOD *ui_method = get_passphrase_ui(p);
-@@ -906,6 +910,118 @@
-     ENGINE_free(e);
- 
-     return APR_SUCCESS;
-+}
-+#endif
-+
-+#if MODSSL_HAVE_OPENSSL_STORE
-+static OSSL_STORE_INFO *modssl_load_store_uri(server_rec *s, apr_pool_t *p,
-+                                              const char *vhostid,
-+                                              const char *uri, int info_type)
-+{
-+    OSSL_STORE_CTX *sctx;
-+    UI_METHOD *ui_method = get_passphrase_ui(p);
-+    pphrase_cb_arg_t ppcb;
-+    OSSL_STORE_INFO *info = NULL;
-+
-+    memset(&ppcb, 0, sizeof ppcb);
-+    ppcb.s = s;
-+    ppcb.p = p;
-+    ppcb.bPassPhraseDialogOnce = TRUE;
-+    ppcb.key_id = vhostid;
-+    ppcb.pkey_file = uri;
-+
-+    sctx = OSSL_STORE_open(uri, ui_method, &ppcb, NULL, NULL);
-+    if (!sctx) {
-+        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(10491)
-+                     "Init: OSSL_STORE_open failed for PKCS#11 URI `%s'",
-+                     uri);
-+        return NULL;
-+    }
-+
-+    while (!OSSL_STORE_eof(sctx)) {
-+        info = OSSL_STORE_load(sctx);
-+        if (!info)
-+            break;
-+
-+        if (OSSL_STORE_INFO_get_type(info) == info_type)
-+            break;
-+
-+        OSSL_STORE_INFO_free(info);
-+        info = NULL;
-+    }
-+
-+    OSSL_STORE_close(sctx);
-+
-+    return info;
-+}
-+
-+static apr_status_t modssl_load_keypair_store(server_rec *s, apr_pool_t *p,
-+                                              const char *vhostid,
-+                                              const char *certid,
-+                                              const char *keyid,
-+                                              X509 **pubkey,
-+                                              EVP_PKEY **privkey)
-+{
-+    OSSL_STORE_INFO *info = NULL;
-+
-+    *privkey = NULL;
-+    *pubkey = NULL;
-+
-+    info = modssl_load_store_uri(s, p, vhostid, keyid, OSSL_STORE_INFO_PKEY);
-+    if (!info) {
-+        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10492)
-+                     "Init: OSSL_STORE_INFO_PKEY lookup failed for private key identifier `%s'",
-+                     keyid);
-+        return ssl_die(s);
-+    }
-+
-+    *privkey = OSSL_STORE_INFO_get1_PKEY(info);
-+    OSSL_STORE_INFO_free(info);
-+    if (!*privkey) {
-+        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10493)
-+                     "Init: OSSL_STORE_INFO_PKEY lookup failed for private key identifier `%s'",
-+                     keyid);
-+        return ssl_die(s);
-+    }
-+
-+    if (certid) {
-+        info = modssl_load_store_uri(s, p, vhostid, certid, OSSL_STORE_INFO_CERT);
-+        if (!info) {
-+            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10494)
-+                         "Init: OSSL_STORE_INFO_CERT lookup failed for certificate identifier `%s'",
-+                         keyid);
-+            return ssl_die(s);
-+        }
-+
-+        *pubkey = OSSL_STORE_INFO_get1_CERT(info);
-+        OSSL_STORE_INFO_free(info);
-+        if (!*pubkey) {
-+            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10495)
-+                     "Init: OSSL_STORE_INFO_CERT lookup failed for certificate identifier `%s'",
-+                     certid);
-+            return ssl_die(s);
-+        }
-+    }
-+
-+    return APR_SUCCESS;
-+}
-+#endif
-+
-+apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
-+                                        const char *vhostid,
-+                                        const char *certid, const char *keyid,
-+                                        X509 **pubkey, EVP_PKEY **privkey)
-+{
-+#if MODSSL_HAVE_OPENSSL_STORE
-+    SSLModConfigRec *mc = myModConfig(s);
-+
-+    if (!mc->szCryptoDevice)
-+        return modssl_load_keypair_store(s, p, vhostid, certid, keyid,
-+                                         pubkey, privkey);
-+#endif
-+#if MODSSL_HAVE_ENGINE_API
-+    return modssl_load_keypair_engine(s, p, vhostid, certid, keyid,
-+                                      pubkey, privkey);
- #else
-     return APR_ENOTIMPL;
- #endif
---- httpd-2.4.58/modules/ssl/ssl_private.h.r1914365
-+++ httpd-2.4.58/modules/ssl/ssl_private.h
-@@ -118,6 +118,15 @@
- #define MODSSL_HAVE_ENGINE_API 0
- #endif
- 
-+/* Use OpenSSL 3.x STORE for loading URI keys and certificates starting with
-+ * OpenSSL 3.0
-+ */
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000
-+#define MODSSL_HAVE_OPENSSL_STORE 1
-+#else
-+#define MODSSL_HAVE_OPENSSL_STORE 0
-+#endif
-+
- #if (OPENSSL_VERSION_NUMBER < 0x0090801f)
- #error mod_ssl requires OpenSSL 0.9.8a or later
- #endif
---- httpd-2.4.58/modules/ssl/ssl_util.c.r1914365
-+++ httpd-2.4.58/modules/ssl/ssl_util.c
-@@ -476,7 +476,7 @@
- 
- int modssl_is_engine_id(const char *name)
- {
--#if MODSSL_HAVE_ENGINE_API
-+#if MODSSL_HAVE_ENGINE_API || MODSSL_HAVE_OPENSSL_STORE
-     /* ### Can handle any other special ENGINE key names here? */
-     return strncmp(name, "pkcs11:", 7) == 0;
- #else
diff --git a/httpd.spec b/httpd.spec
index 3061e2c..37a0e35 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -30,8 +30,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.61
-Release: 3%{?dist}
+Version: 2.4.62
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -100,8 +100,7 @@ Patch28: httpd-2.4.43-sslprotdefault.patch
 Patch29: httpd-2.4.43-logjournal.patch
 Patch30: httpd-2.4.53-separate-systemd-fns.patch
 Patch31: httpd-2.4.58-r1912477+.patch
-Patch32: httpd-2.4.58-r1914365.patch
-Patch33: httpd-2.4.54-selinux.patch
+Patch32: httpd-2.4.54-selinux.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -846,6 +845,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jul 19 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-1
+- new version 2.4.62
+
 * Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.61-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
 
diff --git a/sources b/sources
index 08abe25..2d4ff61 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.61.tar.bz2) = 00656220ecc2b80788f539536553f0a3a57602fb981be22e63af87d0f98ffe5da3056e722ce52ae8cf9c2111ad1922b3aaea1fd7d69d0ed76795199203d593ff
-SHA512 (httpd-2.4.61.tar.bz2.asc) = fed6eb8ed866eba25c64bf89e959bca3dcc548134340c1c8cedbd78b93223dfd641fb2e6ab0d82f129504f7caf6f579b6f40ad03267fc9018efb0779ffcb2f64
+SHA512 (httpd-2.4.62.tar.bz2) = 7db1876805d5c0f60f49bcb51f75cdf567120f2ff6349e68f084e9a86ae38265d9f1c67e7fca0082c9db136f3c408a88501ee11f26b1b68724ba240867171d77
+SHA512 (httpd-2.4.62.tar.bz2.asc) = ed4d59fca7e134aa378dddfd0d62973da99fe77a82a48e268e11262af8aca4a4e90133cc979fb39a4f9cb33abbebb10b1345cb52cfad6eb58fc84d3308bc5a39
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192

From 093221ab5b73abd6bafa33e0b866485b9a4e41a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Thu, 1 Aug 2024 13:47:10 +0200
Subject: [PATCH 337/359] Fix regression introduced by CVE-2024-38474 fix

---
 httpd-2.4.62-r1919325.patch | 242 ++++++++++++++++++++++++++++++++++++
 httpd.spec                  |   7 +-
 2 files changed, 248 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.62-r1919325.patch

diff --git a/httpd-2.4.62-r1919325.patch b/httpd-2.4.62-r1919325.patch
new file mode 100644
index 0000000..1b344e5
--- /dev/null
+++ b/httpd-2.4.62-r1919325.patch
@@ -0,0 +1,242 @@
+From a0a68b99d131741c1867cff321424892838fc4b3 Mon Sep 17 00:00:00 2001
+From: Yann Ylavic <ylavic@apache.org>
+Date: Sat, 27 Jul 2024 13:35:53 +0000
+Subject: [PATCH] mod_rewrite: Better question mark tracking to avoid
+ UnsafeAllow3F.  PR 69197.
+
+Track in do_expand() whether a '?' in the uri-path comes from a literal in
+the substitution string or from an expansion (variable, lookup, ...).
+In the former case it's safe to assume that it's the query-string separator
+but for the other case it's not (could be a decoded %3f from r->uri).
+
+This allows to avoid [UnsafeAllow3F] for most cases.
+
+
+Merges r1919325 from trunk
+Reviewed by: ylavic, covener, jorton
+Github: closes #462
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1919545 13f79535-47bb-0310-9956-ffa450edef68
+---
+ modules/mappers/mod_rewrite.c | 107 ++++++++++++++++++++++++++++------
+ 1 file changed, 89 insertions(+), 18 deletions(-)
+
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index f1c22e3235b..53fb1e91ffb 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -2376,9 +2376,16 @@ static APR_INLINE char *find_char_in_curlies(char *s, int c)
+  * of an earlier expansion to include expansion specifiers that
+  * are interpreted by a later expansion, producing results that
+  * were not intended by the administrator.
++ *
++ * unsafe_qmark if not NULL will be set to 1 or 0 if a question mark
++ * is found respectively in a literal or in a lookup/expansion (whether
++ * it's the first or last qmark depends on [QSL]). Should be initialized
++ * to -1 and remains so if no qmark is found.
+  */
+-static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
++static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry,
++                       int *unsafe_qmark)
+ {
++#define EXPAND_SPECIALS "\\$%"
+     result_list *result, *current;
+     result_list sresult[SMALL_EXPANSION];
+     unsigned spc = 0;
+@@ -2386,8 +2393,29 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+     char *p, *c;
+     apr_pool_t *pool = ctx->r->pool;
+ 
+-    span = strcspn(input, "\\$%");
+     inputlen = strlen(input);
++    if (!unsafe_qmark) {
++        span = strcspn(input, EXPAND_SPECIALS);
++    }
++    else {
++        span = strcspn(input, EXPAND_SPECIALS "?");
++        if (input[span] == '?') {
++            /* this qmark is not from an expansion thus safe */
++            *unsafe_qmark = 0;
++
++            /* keep tracking only if interested in the last qmark */
++            if (entry && (entry->flags & RULEFLAG_QSLAST)) {
++                do {
++                    span++;
++                    span += strcspn(input + span, EXPAND_SPECIALS "?");
++                } while (input[span] == '?');
++            }
++            else {
++                unsafe_qmark = NULL;
++                span += strcspn(input + span, EXPAND_SPECIALS);
++            }
++        }
++    }
+ 
+     /* fast exit */
+     if (inputlen == span) {
+@@ -2405,6 +2433,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+ 
+     /* loop for specials */
+     do {
++        int expanded = 0;
++
+         /* prepare next entry */
+         if (current->len) {
+             current->next = (spc < SMALL_EXPANSION)
+@@ -2450,6 +2480,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+                 current->len = span;
+                 current->string = p;
+                 outlen += span;
++
++                expanded = 1;
+                 p = endp + 1;
+             }
+ 
+@@ -2489,19 +2521,18 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+                     }
+ 
+                     /* reuse of key variable as result */
+-                    key = lookup_map(ctx->r, map, do_expand(key, ctx, entry));
+-
++                    key = lookup_map(ctx->r, map, do_expand(key, ctx, entry, NULL));
+                     if (!key && dflt && *dflt) {
+-                        key = do_expand(dflt, ctx, entry);
++                        key = do_expand(dflt, ctx, entry, NULL);
+                     }
+-
+-                    if (key) {
++                    if (key && *key) {
+                         span = strlen(key);
+                         current->len = span;
+                         current->string = key;
+                         outlen += span;
+                     }
+ 
++                    expanded = 1;
+                     p = endp + 1;
+                 }
+             }
+@@ -2531,8 +2562,9 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+                     current->len = span;
+                     current->string = bri->source + bri->regmatch[n].rm_so;
+                 }
+-
+                 outlen += span;
++
++                expanded = 1;
+             }
+ 
+             p += 2;
+@@ -2545,8 +2577,41 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+             ++outlen;
+         }
+ 
++        if (unsafe_qmark && expanded && current->len
++            && memchr(current->string, '?', current->len)) {
++            /* this qmark is from an expansion thus unsafe */
++            *unsafe_qmark = 1;
++
++            /* keep tracking only if interested in the last qmark */
++            if (!entry || !(entry->flags & RULEFLAG_QSLAST)) {
++                unsafe_qmark = NULL;
++            }
++        }
++
+         /* check the remainder */
+-        if (*p && (span = strcspn(p, "\\$%")) > 0) {
++        if (!unsafe_qmark) {
++            span = strcspn(p, EXPAND_SPECIALS);
++        }
++        else {
++            span = strcspn(p, EXPAND_SPECIALS "?");
++            if (p[span] == '?') {
++                /* this qmark is not from an expansion thus safe */
++                *unsafe_qmark = 0;
++
++                /* keep tracking only if interested in the last qmark */
++                if (entry && (entry->flags & RULEFLAG_QSLAST)) {
++                    do {
++                        span++;
++                        span += strcspn(p + span, EXPAND_SPECIALS "?");
++                    } while (p[span] == '?');
++                }
++                else {
++                    unsafe_qmark = NULL;
++                    span += strcspn(p + span, EXPAND_SPECIALS);
++                }
++            }
++        }
++        if (span > 0) {
+             if (current->len) {
+                 current->next = (spc < SMALL_EXPANSION)
+                                 ? &(sresult[spc++])
+@@ -2591,7 +2656,7 @@ static void do_expand_env(data_item *env, rewrite_ctx *ctx)
+     char *name, *val;
+ 
+     while (env) {
+-        name = do_expand(env->data, ctx, NULL);
++        name = do_expand(env->data, ctx, NULL, NULL);
+         if (*name == '!') {
+             name++;
+             apr_table_unset(ctx->r->subprocess_env, name);
+@@ -2725,7 +2790,7 @@ static void add_cookie(request_rec *r, char *s)
+ static void do_expand_cookie(data_item *cookie, rewrite_ctx *ctx)
+ {
+     while (cookie) {
+-        add_cookie(ctx->r, do_expand(cookie->data, ctx, NULL));
++        add_cookie(ctx->r, do_expand(cookie->data, ctx, NULL, NULL));
+         cookie = cookie->next;
+     }
+ 
+@@ -4014,7 +4079,7 @@ static int apply_rewrite_cond(rewritecond_entry *p, rewrite_ctx *ctx)
+     int basis;
+ 
+     if (p->ptype != CONDPAT_AP_EXPR)
+-        input = do_expand(p->input, ctx, NULL);
++        input = do_expand(p->input, ctx, NULL, NULL);
+ 
+     switch (p->ptype) {
+     case CONDPAT_FILE_EXISTS:
+@@ -4178,7 +4243,7 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p,
+     char *expanded;
+ 
+     if (p->forced_mimetype) {
+-        expanded = do_expand(p->forced_mimetype, ctx, p);
++        expanded = do_expand(p->forced_mimetype, ctx, p, NULL);
+ 
+         if (*expanded) {
+             ap_str_tolower(expanded);
+@@ -4192,7 +4257,7 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p,
+     }
+ 
+     if (p->forced_handler) {
+-        expanded = do_expand(p->forced_handler, ctx, p);
++        expanded = do_expand(p->forced_handler, ctx, p, NULL);
+ 
+         if (*expanded) {
+             ap_str_tolower(expanded);
+@@ -4329,12 +4394,18 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+ 
+     /* expand the result */
+     if (!(p->flags & RULEFLAG_NOSUB)) {
+-        newuri = do_expand(p->output, ctx, p);
++        int unsafe_qmark = -1;
++
++        if (p->flags & RULEFLAG_UNSAFE_ALLOW3F) {
++            newuri = do_expand(p->output, ctx, p, NULL);
++        }
++        else {
++            newuri = do_expand(p->output, ctx, p, &unsafe_qmark);
++        }
+         rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri,
+                     newuri));
+-        if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) &&
+-            ap_strcasestr(r->unparsed_uri, "%3f") &&
+-            ap_strchr_c(newuri, '?')) {
++
++        if (unsafe_qmark > 0) {
+             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10508)
+                     "Unsafe URL with %%3f URL rewritten without "
+                     "UnsafeAllow3F");
+
diff --git a/httpd.spec b/httpd.spec
index 37a0e35..4e3289a 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.62
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -105,6 +105,8 @@ Patch32: httpd-2.4.54-selinux.patch
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
+# https://bz.apache.org/bugzilla/show_bug.cgi?id=69197
+Patch61: httpd-2.4.62-r1919325.patch
 
 # Security fixes
 # Patch200: ...
@@ -845,6 +847,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Aug 01 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-2
+- Fix regression introduced by CVE-2024-38474 fix
+
 * Fri Jul 19 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-1
 - new version 2.4.62
 

From 8f936f8f7bbda6f6a53c19ffc1bb06dc91935c81 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Thu, 1 Aug 2024 15:38:12 +0200
Subject: [PATCH 338/359] Added openldap-devel build dependency

---
 httpd.spec | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 4e3289a..b93e654 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -121,6 +121,7 @@ BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto
 BuildRequires: perl-interpreter, perl-generators, systemd-devel
 BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0
+BuildRequires: openldap-devel
 BuildRequires: systemd-rpm-macros
 %if %{with pcre2}
 BuildRequires: pcre2-devel
@@ -847,8 +848,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Thu Aug 01 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-2
+* Thu Aug 01 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-3
 - Fix regression introduced by CVE-2024-38474 fix
+- added openldap-devel build dependency
 
 * Fri Jul 19 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-1
 - new version 2.4.62

From c521675754ad08edde37fc663ecb2340588d527a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 11 Oct 2024 14:35:30 +0200
Subject: [PATCH 339/359] mod_rewrite: regression fixes

---
 httpd-2.4.62-r1920980+.patch | 94 ++++++++++++++++++++++++++++++++++++
 httpd.spec                   |  9 +++-
 2 files changed, 102 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.62-r1920980+.patch

diff --git a/httpd-2.4.62-r1920980+.patch b/httpd-2.4.62-r1920980+.patch
new file mode 100644
index 0000000..42ca023
--- /dev/null
+++ b/httpd-2.4.62-r1920980+.patch
@@ -0,0 +1,94 @@
+
+https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1920566
+https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1920980
+
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index 53fb1e9..93ae7ac 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -2404,21 +2404,19 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry,
+             *unsafe_qmark = 0;
+ 
+             /* keep tracking only if interested in the last qmark */
+-            if (entry && (entry->flags & RULEFLAG_QSLAST)) {
+-                do {
+-                    span++;
+-                    span += strcspn(input + span, EXPAND_SPECIALS "?");
+-                } while (input[span] == '?');
+-            }
+-            else {
++            if (!entry || !(entry->flags & RULEFLAG_QSLAST)) {
+                 unsafe_qmark = NULL;
+-                span += strcspn(input + span, EXPAND_SPECIALS);
+             }
++
++            /* find the next real special char, any (last) qmark up to
++             * there is safe too
++             */
++            span += strcspn(input + span, EXPAND_SPECIALS);
+         }
+     }
+ 
+-    /* fast exit */
+-    if (inputlen == span) {
++    /* fast path (no specials) */
++    if (span >= inputlen) {
+         return apr_pstrmemdup(pool, input, inputlen);
+     }
+ 
+@@ -2599,16 +2597,14 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry,
+                 *unsafe_qmark = 0;
+ 
+                 /* keep tracking only if interested in the last qmark */
+-                if (entry && (entry->flags & RULEFLAG_QSLAST)) {
+-                    do {
+-                        span++;
+-                        span += strcspn(p + span, EXPAND_SPECIALS "?");
+-                    } while (p[span] == '?');
+-                }
+-                else {
++                if (!entry || !(entry->flags & RULEFLAG_QSLAST)) {
+                     unsafe_qmark = NULL;
+-                    span += strcspn(p + span, EXPAND_SPECIALS);
+                 }
++
++                /* find the next real special char, any (last) qmark up to
++                 * there is safe too
++                 */
++                span += strcspn(p + span, EXPAND_SPECIALS);
+             }
+         }
+         if (span > 0) {
+@@ -4284,6 +4280,7 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+     char *newuri = NULL;
+     request_rec *r = ctx->r;
+     int is_proxyreq = 0;
++    int prefix_added = 0;
+ 
+     ctx->uri = r->filename;
+ 
+@@ -4444,6 +4441,7 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+             rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
+                        newuri, ctx->perdir, newuri));
+             newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL);
++            prefix_added = 1;
+         }
+         else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) {
+             /* Not an absolute URI-path and the scheme (if any) is unknown,
+@@ -4457,6 +4455,7 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+                        newuri, newuri));
+ 
+             newuri = apr_pstrcat(r->pool, "/", newuri, NULL);
++            prefix_added = 1;
+         }
+     }
+ 
+@@ -4537,7 +4536,7 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+         return RULE_RC_MATCH;
+     }
+ 
+-    if (!(p->flags & RULEFLAG_UNC)) {
++    if (!((p->flags & RULEFLAG_UNC) || prefix_added)) {
+         /* merge leading slashes, unless they were literals in the sub */
+         if (!AP_IS_SLASH(p->output[0]) || !AP_IS_SLASH(p->output[1])) {
+             while (AP_IS_SLASH(r->filename[0]) &&
diff --git a/httpd.spec b/httpd.spec
index b93e654..43fa7dc 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.62
-Release: 2%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -107,6 +107,10 @@ Patch32: httpd-2.4.54-selinux.patch
 Patch60: httpd-2.4.43-enable-sslv3.patch
 # https://bz.apache.org/bugzilla/show_bug.cgi?id=69197
 Patch61: httpd-2.4.62-r1919325.patch
+# https://github.com/apache/httpd/pull/473
+# https://github.com/apache/httpd/commit/c91445b7f905587aa86ad552f4a1a3f29345e695
+Patch62: httpd-2.4.62-r1920980+.patch
+
 
 # Security fixes
 # Patch200: ...
@@ -848,6 +852,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Oct 11 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-4
+- mod_rewrite: regression fixes
+
 * Thu Aug 01 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-3
 - Fix regression introduced by CVE-2024-38474 fix
 - added openldap-devel build dependency

From 5bc2bd77739ef948c9b8cd733e955f1da254fd7d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Sun, 12 Jan 2025 14:30:37 +0100
Subject: [PATCH 340/359] Rebuilt for the bin-sbin merge (2nd attempt)

https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin
---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 43fa7dc..5b47408 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.62
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -852,6 +852,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.4.62-5
+- Rebuilt for the bin-sbin merge (2nd attempt)
+
 * Fri Oct 11 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-4
 - mod_rewrite: regression fixes
 

From 4bfb30c1fa2da3cbb064c0fbeea00d4d0c611965 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 17 Jan 2025 06:05:57 +0000
Subject: [PATCH 341/359] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild

---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 5b47408..1d84a2f 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.62
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -852,6 +852,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.62-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
 * Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.4.62-5
 - Rebuilt for the bin-sbin merge (2nd attempt)
 

From 6763440aa7164c462878d35379212d28eba22190 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 24 Jan 2025 14:25:33 +0100
Subject: [PATCH 342/359] new version 2.4.63

---
 .gitignore                                    |   1 +
 httpd-2.4.62-r1919325.patch                   | 242 ------------------
 httpd-2.4.62-r1920980+.patch                  |  94 -------
 ...477+.patch => httpd-2.4.63-r1912477+.patch |  80 +++---
 httpd.spec                                    |  15 +-
 sources                                       |   4 +-
 6 files changed, 49 insertions(+), 387 deletions(-)
 delete mode 100644 httpd-2.4.62-r1919325.patch
 delete mode 100644 httpd-2.4.62-r1920980+.patch
 rename httpd-2.4.58-r1912477+.patch => httpd-2.4.63-r1912477+.patch (85%)

diff --git a/.gitignore b/.gitignore
index 5bb7aaa..0969db5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -52,3 +52,4 @@ x86_64
 /httpd-2.4.59.tar.bz2.asc
 /httpd-2.4.61.tar.bz2.asc
 /httpd-2.4.62.tar.bz2.asc
+/httpd-2.4.63.tar.bz2.asc
diff --git a/httpd-2.4.62-r1919325.patch b/httpd-2.4.62-r1919325.patch
deleted file mode 100644
index 1b344e5..0000000
--- a/httpd-2.4.62-r1919325.patch
+++ /dev/null
@@ -1,242 +0,0 @@
-From a0a68b99d131741c1867cff321424892838fc4b3 Mon Sep 17 00:00:00 2001
-From: Yann Ylavic <ylavic@apache.org>
-Date: Sat, 27 Jul 2024 13:35:53 +0000
-Subject: [PATCH] mod_rewrite: Better question mark tracking to avoid
- UnsafeAllow3F.  PR 69197.
-
-Track in do_expand() whether a '?' in the uri-path comes from a literal in
-the substitution string or from an expansion (variable, lookup, ...).
-In the former case it's safe to assume that it's the query-string separator
-but for the other case it's not (could be a decoded %3f from r->uri).
-
-This allows to avoid [UnsafeAllow3F] for most cases.
-
-
-Merges r1919325 from trunk
-Reviewed by: ylavic, covener, jorton
-Github: closes #462
-
-
-git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1919545 13f79535-47bb-0310-9956-ffa450edef68
----
- modules/mappers/mod_rewrite.c | 107 ++++++++++++++++++++++++++++------
- 1 file changed, 89 insertions(+), 18 deletions(-)
-
-diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
-index f1c22e3235b..53fb1e91ffb 100644
---- a/modules/mappers/mod_rewrite.c
-+++ b/modules/mappers/mod_rewrite.c
-@@ -2376,9 +2376,16 @@ static APR_INLINE char *find_char_in_curlies(char *s, int c)
-  * of an earlier expansion to include expansion specifiers that
-  * are interpreted by a later expansion, producing results that
-  * were not intended by the administrator.
-+ *
-+ * unsafe_qmark if not NULL will be set to 1 or 0 if a question mark
-+ * is found respectively in a literal or in a lookup/expansion (whether
-+ * it's the first or last qmark depends on [QSL]). Should be initialized
-+ * to -1 and remains so if no qmark is found.
-  */
--static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
-+static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry,
-+                       int *unsafe_qmark)
- {
-+#define EXPAND_SPECIALS "\\$%"
-     result_list *result, *current;
-     result_list sresult[SMALL_EXPANSION];
-     unsigned spc = 0;
-@@ -2386,8 +2393,29 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
-     char *p, *c;
-     apr_pool_t *pool = ctx->r->pool;
- 
--    span = strcspn(input, "\\$%");
-     inputlen = strlen(input);
-+    if (!unsafe_qmark) {
-+        span = strcspn(input, EXPAND_SPECIALS);
-+    }
-+    else {
-+        span = strcspn(input, EXPAND_SPECIALS "?");
-+        if (input[span] == '?') {
-+            /* this qmark is not from an expansion thus safe */
-+            *unsafe_qmark = 0;
-+
-+            /* keep tracking only if interested in the last qmark */
-+            if (entry && (entry->flags & RULEFLAG_QSLAST)) {
-+                do {
-+                    span++;
-+                    span += strcspn(input + span, EXPAND_SPECIALS "?");
-+                } while (input[span] == '?');
-+            }
-+            else {
-+                unsafe_qmark = NULL;
-+                span += strcspn(input + span, EXPAND_SPECIALS);
-+            }
-+        }
-+    }
- 
-     /* fast exit */
-     if (inputlen == span) {
-@@ -2405,6 +2433,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
- 
-     /* loop for specials */
-     do {
-+        int expanded = 0;
-+
-         /* prepare next entry */
-         if (current->len) {
-             current->next = (spc < SMALL_EXPANSION)
-@@ -2450,6 +2480,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
-                 current->len = span;
-                 current->string = p;
-                 outlen += span;
-+
-+                expanded = 1;
-                 p = endp + 1;
-             }
- 
-@@ -2489,19 +2521,18 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
-                     }
- 
-                     /* reuse of key variable as result */
--                    key = lookup_map(ctx->r, map, do_expand(key, ctx, entry));
--
-+                    key = lookup_map(ctx->r, map, do_expand(key, ctx, entry, NULL));
-                     if (!key && dflt && *dflt) {
--                        key = do_expand(dflt, ctx, entry);
-+                        key = do_expand(dflt, ctx, entry, NULL);
-                     }
--
--                    if (key) {
-+                    if (key && *key) {
-                         span = strlen(key);
-                         current->len = span;
-                         current->string = key;
-                         outlen += span;
-                     }
- 
-+                    expanded = 1;
-                     p = endp + 1;
-                 }
-             }
-@@ -2531,8 +2562,9 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
-                     current->len = span;
-                     current->string = bri->source + bri->regmatch[n].rm_so;
-                 }
--
-                 outlen += span;
-+
-+                expanded = 1;
-             }
- 
-             p += 2;
-@@ -2545,8 +2577,41 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
-             ++outlen;
-         }
- 
-+        if (unsafe_qmark && expanded && current->len
-+            && memchr(current->string, '?', current->len)) {
-+            /* this qmark is from an expansion thus unsafe */
-+            *unsafe_qmark = 1;
-+
-+            /* keep tracking only if interested in the last qmark */
-+            if (!entry || !(entry->flags & RULEFLAG_QSLAST)) {
-+                unsafe_qmark = NULL;
-+            }
-+        }
-+
-         /* check the remainder */
--        if (*p && (span = strcspn(p, "\\$%")) > 0) {
-+        if (!unsafe_qmark) {
-+            span = strcspn(p, EXPAND_SPECIALS);
-+        }
-+        else {
-+            span = strcspn(p, EXPAND_SPECIALS "?");
-+            if (p[span] == '?') {
-+                /* this qmark is not from an expansion thus safe */
-+                *unsafe_qmark = 0;
-+
-+                /* keep tracking only if interested in the last qmark */
-+                if (entry && (entry->flags & RULEFLAG_QSLAST)) {
-+                    do {
-+                        span++;
-+                        span += strcspn(p + span, EXPAND_SPECIALS "?");
-+                    } while (p[span] == '?');
-+                }
-+                else {
-+                    unsafe_qmark = NULL;
-+                    span += strcspn(p + span, EXPAND_SPECIALS);
-+                }
-+            }
-+        }
-+        if (span > 0) {
-             if (current->len) {
-                 current->next = (spc < SMALL_EXPANSION)
-                                 ? &(sresult[spc++])
-@@ -2591,7 +2656,7 @@ static void do_expand_env(data_item *env, rewrite_ctx *ctx)
-     char *name, *val;
- 
-     while (env) {
--        name = do_expand(env->data, ctx, NULL);
-+        name = do_expand(env->data, ctx, NULL, NULL);
-         if (*name == '!') {
-             name++;
-             apr_table_unset(ctx->r->subprocess_env, name);
-@@ -2725,7 +2790,7 @@ static void add_cookie(request_rec *r, char *s)
- static void do_expand_cookie(data_item *cookie, rewrite_ctx *ctx)
- {
-     while (cookie) {
--        add_cookie(ctx->r, do_expand(cookie->data, ctx, NULL));
-+        add_cookie(ctx->r, do_expand(cookie->data, ctx, NULL, NULL));
-         cookie = cookie->next;
-     }
- 
-@@ -4014,7 +4079,7 @@ static int apply_rewrite_cond(rewritecond_entry *p, rewrite_ctx *ctx)
-     int basis;
- 
-     if (p->ptype != CONDPAT_AP_EXPR)
--        input = do_expand(p->input, ctx, NULL);
-+        input = do_expand(p->input, ctx, NULL, NULL);
- 
-     switch (p->ptype) {
-     case CONDPAT_FILE_EXISTS:
-@@ -4178,7 +4243,7 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p,
-     char *expanded;
- 
-     if (p->forced_mimetype) {
--        expanded = do_expand(p->forced_mimetype, ctx, p);
-+        expanded = do_expand(p->forced_mimetype, ctx, p, NULL);
- 
-         if (*expanded) {
-             ap_str_tolower(expanded);
-@@ -4192,7 +4257,7 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p,
-     }
- 
-     if (p->forced_handler) {
--        expanded = do_expand(p->forced_handler, ctx, p);
-+        expanded = do_expand(p->forced_handler, ctx, p, NULL);
- 
-         if (*expanded) {
-             ap_str_tolower(expanded);
-@@ -4329,12 +4394,18 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
- 
-     /* expand the result */
-     if (!(p->flags & RULEFLAG_NOSUB)) {
--        newuri = do_expand(p->output, ctx, p);
-+        int unsafe_qmark = -1;
-+
-+        if (p->flags & RULEFLAG_UNSAFE_ALLOW3F) {
-+            newuri = do_expand(p->output, ctx, p, NULL);
-+        }
-+        else {
-+            newuri = do_expand(p->output, ctx, p, &unsafe_qmark);
-+        }
-         rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri,
-                     newuri));
--        if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) &&
--            ap_strcasestr(r->unparsed_uri, "%3f") &&
--            ap_strchr_c(newuri, '?')) {
-+
-+        if (unsafe_qmark > 0) {
-             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10508)
-                     "Unsafe URL with %%3f URL rewritten without "
-                     "UnsafeAllow3F");
-
diff --git a/httpd-2.4.62-r1920980+.patch b/httpd-2.4.62-r1920980+.patch
deleted file mode 100644
index 42ca023..0000000
--- a/httpd-2.4.62-r1920980+.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-
-https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1920566
-https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1920980
-
-diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
-index 53fb1e9..93ae7ac 100644
---- a/modules/mappers/mod_rewrite.c
-+++ b/modules/mappers/mod_rewrite.c
-@@ -2404,21 +2404,19 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry,
-             *unsafe_qmark = 0;
- 
-             /* keep tracking only if interested in the last qmark */
--            if (entry && (entry->flags & RULEFLAG_QSLAST)) {
--                do {
--                    span++;
--                    span += strcspn(input + span, EXPAND_SPECIALS "?");
--                } while (input[span] == '?');
--            }
--            else {
-+            if (!entry || !(entry->flags & RULEFLAG_QSLAST)) {
-                 unsafe_qmark = NULL;
--                span += strcspn(input + span, EXPAND_SPECIALS);
-             }
-+
-+            /* find the next real special char, any (last) qmark up to
-+             * there is safe too
-+             */
-+            span += strcspn(input + span, EXPAND_SPECIALS);
-         }
-     }
- 
--    /* fast exit */
--    if (inputlen == span) {
-+    /* fast path (no specials) */
-+    if (span >= inputlen) {
-         return apr_pstrmemdup(pool, input, inputlen);
-     }
- 
-@@ -2599,16 +2597,14 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry,
-                 *unsafe_qmark = 0;
- 
-                 /* keep tracking only if interested in the last qmark */
--                if (entry && (entry->flags & RULEFLAG_QSLAST)) {
--                    do {
--                        span++;
--                        span += strcspn(p + span, EXPAND_SPECIALS "?");
--                    } while (p[span] == '?');
--                }
--                else {
-+                if (!entry || !(entry->flags & RULEFLAG_QSLAST)) {
-                     unsafe_qmark = NULL;
--                    span += strcspn(p + span, EXPAND_SPECIALS);
-                 }
-+
-+                /* find the next real special char, any (last) qmark up to
-+                 * there is safe too
-+                 */
-+                span += strcspn(p + span, EXPAND_SPECIALS);
-             }
-         }
-         if (span > 0) {
-@@ -4284,6 +4280,7 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
-     char *newuri = NULL;
-     request_rec *r = ctx->r;
-     int is_proxyreq = 0;
-+    int prefix_added = 0;
- 
-     ctx->uri = r->filename;
- 
-@@ -4444,6 +4441,7 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
-             rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
-                        newuri, ctx->perdir, newuri));
-             newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL);
-+            prefix_added = 1;
-         }
-         else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) {
-             /* Not an absolute URI-path and the scheme (if any) is unknown,
-@@ -4457,6 +4455,7 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
-                        newuri, newuri));
- 
-             newuri = apr_pstrcat(r->pool, "/", newuri, NULL);
-+            prefix_added = 1;
-         }
-     }
- 
-@@ -4537,7 +4536,7 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
-         return RULE_RC_MATCH;
-     }
- 
--    if (!(p->flags & RULEFLAG_UNC)) {
-+    if (!((p->flags & RULEFLAG_UNC) || prefix_added)) {
-         /* merge leading slashes, unless they were literals in the sub */
-         if (!AP_IS_SLASH(p->output[0]) || !AP_IS_SLASH(p->output[1])) {
-             while (AP_IS_SLASH(r->filename[0]) &&
diff --git a/httpd-2.4.58-r1912477+.patch b/httpd-2.4.63-r1912477+.patch
similarity index 85%
rename from httpd-2.4.58-r1912477+.patch
rename to httpd-2.4.63-r1912477+.patch
index eb3deff..35e5866 100644
--- a/httpd-2.4.58-r1912477+.patch
+++ b/httpd-2.4.63-r1912477+.patch
@@ -7,9 +7,11 @@ http://svn.apache.org/viewvc?view=revision&revision=1914438
 
 Upstream-Status: in trunk, not proposed for 2.4.x
 
---- httpd-2.4.58/modules/dav/fs/config6.m4.r1912477+
-+++ httpd-2.4.58/modules/dav/fs/config6.m4
-@@ -20,4 +20,10 @@
+diff --git a/modules/dav/fs/config6.m4 b/modules/dav/fs/config6.m4
+index dd26ec8..72fff9a 100644
+--- a/modules/dav/fs/config6.m4
++++ b/modules/dav/fs/config6.m4
+@@ -20,4 +20,10 @@ esac
  
  APACHE_MODULE(dav_fs, DAV provider for the filesystem.  --enable-dav also enables mod_dav_fs., $dav_fs_objects, , $dav_fs_enable,,dav)
  
@@ -20,8 +22,10 @@ Upstream-Status: in trunk, not proposed for 2.4.x
 +fi
 +
  APACHE_MODPATH_FINISH
---- httpd-2.4.58/modules/dav/fs/dbm.c.r1912477+
-+++ httpd-2.4.58/modules/dav/fs/dbm.c
+diff --git a/modules/dav/fs/dbm.c b/modules/dav/fs/dbm.c
+index 39ab4ad..4551f70 100644
+--- a/modules/dav/fs/dbm.c
++++ b/modules/dav/fs/dbm.c
 @@ -47,6 +47,10 @@
  #include "http_log.h"
  #include "http_main.h"      /* for ap_server_conf */
@@ -33,16 +37,7 @@ Upstream-Status: in trunk, not proposed for 2.4.x
  APLOG_USE_MODULE(dav_fs);
  
  struct dav_db {
-@@ -100,7 +104,7 @@
-     /* There might not be a <db> if we had problems creating it. */
-     if (db == NULL) {
-         errcode = 1;
--        errstr = "Could not open property database.";
-+        errstr = "Could not open database.";
-         if (APR_STATUS_IS_EDSOOPEN(status))
-             ap_log_error(APLOG_MARK, APLOG_CRIT, status, ap_server_conf, APLOGNO(00576)
-             "The DBM driver could not be loaded");
-@@ -129,10 +133,10 @@
+@@ -129,10 +133,10 @@ void dav_fs_ensure_state_dir(apr_pool_t * p, const char *dirname)
  /* dav_dbm_open_direct:  Opens a *dbm database specified by path.
   *    ro = boolean read-only flag.
   */
@@ -56,7 +51,7 @@ Upstream-Status: in trunk, not proposed for 2.4.x
      const apr_dbm_driver_t *driver;
      const apu_err_t *err;
  #endif
-@@ -141,13 +145,13 @@
+@@ -141,11 +145,12 @@ dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
  
      *pdb = NULL;
  
@@ -64,18 +59,16 @@ Upstream-Status: in trunk, not proposed for 2.4.x
 -    if ((status = apr_dbm_get_driver(&driver, NULL, &err, p)) != APR_SUCCESS) {
 +#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
 +    if ((status = apr_dbm_get_driver(&driver, dbmtype, &err, p)) != APR_SUCCESS) {
++
          ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, APLOGNO(10289)
 -                     "mod_dav_fs: The DBM library '%s' could not be loaded: %s",
 -                             err->reason, err->msg);
 +                     "mod_dav_fs: The DBM library '%s' for '%s' could not be loaded: %s",
 +                     err->reason, dbmtype, err->msg);
          return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status,
--                "Could not load library for property database.");
-+                "Could not load library for database.");
+                 "Could not load library for database.");
      }
-     if ((status = apr_dbm_open2(&file, driver, pathname,
-                                ro ? APR_DBM_READONLY : APR_DBM_RWCREATE,
-@@ -156,7 +160,7 @@
+@@ -156,7 +161,7 @@ dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
          return dav_fs_dbm_error(NULL, p, status);
      }
  #else
@@ -84,7 +77,7 @@ Upstream-Status: in trunk, not proposed for 2.4.x
                                 ro ? APR_DBM_READONLY : APR_DBM_RWCREATE,
                                 APR_OS_DEFAULT, p))
                  != APR_SUCCESS
-@@ -206,7 +210,7 @@
+@@ -206,7 +211,7 @@ static dav_error * dav_dbm_open(apr_pool_t * p, const dav_resource *resource,
  
      /* ### do we need to deal with the umask? */
  
@@ -93,9 +86,11 @@ Upstream-Status: in trunk, not proposed for 2.4.x
  }
  
  void dav_dbm_close(dav_db *db)
---- httpd-2.4.58/modules/dav/fs/lock.c.r1912477+
-+++ httpd-2.4.58/modules/dav/fs/lock.c
-@@ -181,8 +181,7 @@
+diff --git a/modules/dav/fs/lock.c b/modules/dav/fs/lock.c
+index ef18c4a..29d167d 100644
+--- a/modules/dav/fs/lock.c
++++ b/modules/dav/fs/lock.c
+@@ -181,8 +181,7 @@ struct dav_lockdb_private
  {
      request_rec *r;                  /* for accessing the uuid state */
      apr_pool_t *pool;                /* a pool to use */
@@ -105,7 +100,7 @@ Upstream-Status: in trunk, not proposed for 2.4.x
      int opened;                      /* we opened the database */
      dav_db *db;                      /* if non-NULL, the lock database */
  };
-@@ -292,6 +291,19 @@
+@@ -292,6 +291,19 @@ static int dav_fs_compare_locktoken(
      return dav_compare_locktoken(lt1, lt2);
  }
  
@@ -125,7 +120,7 @@ Upstream-Status: in trunk, not proposed for 2.4.x
  /*
  ** dav_fs_really_open_lockdb:
  **
-@@ -300,15 +312,27 @@
+@@ -300,15 +312,27 @@ static int dav_fs_compare_locktoken(
  static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb)
  {
      dav_error *err;
@@ -154,7 +149,7 @@ Upstream-Status: in trunk, not proposed for 2.4.x
          return dav_push_error(lockdb->info->pool,
                                HTTP_INTERNAL_SERVER_ERROR,
                                DAV_ERR_LOCK_OPENDB,
-@@ -316,6 +340,10 @@
+@@ -316,6 +340,10 @@ static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb)
                                err);
      }
  
@@ -165,7 +160,7 @@ Upstream-Status: in trunk, not proposed for 2.4.x
      /* all right. it is opened now. */
      lockdb->info->opened = 1;
  
-@@ -341,9 +369,9 @@
+@@ -341,9 +369,9 @@ static dav_error * dav_fs_open_lockdb(request_rec *r, int ro, int force,
      comb->pub.info = &comb->priv;
      comb->priv.r = r;
      comb->priv.pool = r->pool;
@@ -178,7 +173,7 @@ Upstream-Status: in trunk, not proposed for 2.4.x
          return dav_new_error(r->pool, HTTP_INTERNAL_SERVER_ERROR,
                               DAV_ERR_LOCK_NO_DB, 0,
                               "A lock database was not specified with the "
-@@ -369,8 +397,8 @@
+@@ -369,8 +397,8 @@ static dav_error * dav_fs_open_lockdb(request_rec *r, int ro, int force,
  */
  static void dav_fs_close_lockdb(dav_lockdb *lockdb)
  {
@@ -189,8 +184,10 @@ Upstream-Status: in trunk, not proposed for 2.4.x
  }
  
  /*
---- httpd-2.4.58/modules/dav/fs/mod_dav_fs.c.r1912477+
-+++ httpd-2.4.58/modules/dav/fs/mod_dav_fs.c
+diff --git a/modules/dav/fs/mod_dav_fs.c b/modules/dav/fs/mod_dav_fs.c
+index 2389f8f..4bf6c51 100644
+--- a/modules/dav/fs/mod_dav_fs.c
++++ b/modules/dav/fs/mod_dav_fs.c
 @@ -14,31 +14,35 @@
   * limitations under the License.
   */
@@ -238,7 +235,7 @@ Upstream-Status: in trunk, not proposed for 2.4.x
  }
  
  static void *dav_fs_create_server_config(apr_pool_t *p, server_rec *s)
-@@ -57,15 +61,50 @@
+@@ -57,15 +61,50 @@ static void *dav_fs_merge_server_config(apr_pool_t *p,
  
      newconf->lockdb_path =
          child->lockdb_path ? child->lockdb_path : parent->lockdb_path;
@@ -272,8 +269,9 @@ Upstream-Status: in trunk, not proposed for 2.4.x
                                         apr_pool_t *ptemp, server_rec *base_server)
  {
      server_rec *s;
+-
 +    apr_status_t rv;
- 
++
 +    /* Ignore first pass through the config. */
 +    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
 +        return OK;
@@ -289,7 +287,7 @@ Upstream-Status: in trunk, not proposed for 2.4.x
      for (s = base_server; s; s = s->next) {
          dav_fs_server_conf *conf;
  
-@@ -74,6 +113,13 @@
+@@ -74,6 +113,13 @@ static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog,
          if (!conf->lockdb_path) {
              conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB);
          }
@@ -303,7 +301,7 @@ Upstream-Status: in trunk, not proposed for 2.4.x
      }
  
      return OK;
-@@ -98,19 +144,36 @@
+@@ -98,19 +144,36 @@ static const char *dav_fs_cmd_davlockdb(cmd_parms *cmd, void *config,
      return NULL;
  }
  
@@ -341,8 +339,10 @@ Upstream-Status: in trunk, not proposed for 2.4.x
      dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL,
                               APR_HOOK_MIDDLE);
      dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE);
---- httpd-2.4.58/modules/dav/fs/repos.h.r1912477+
-+++ httpd-2.4.58/modules/dav/fs/repos.h
+diff --git a/modules/dav/fs/repos.h b/modules/dav/fs/repos.h
+index b164611..d3a55a5 100644
+--- a/modules/dav/fs/repos.h
++++ b/modules/dav/fs/repos.h
 @@ -25,6 +25,8 @@
  #ifndef _DAV_FS_REPOS_H_
  #define _DAV_FS_REPOS_H_
@@ -352,7 +352,7 @@ Upstream-Status: in trunk, not proposed for 2.4.x
  /* the subdirectory to hold all DAV-related information for a directory */
  #define DAV_FS_STATE_DIR                ".DAV"
  #define DAV_FS_STATE_FILE_FOR_DIR       ".state_for_dir"
-@@ -53,8 +55,8 @@
+@@ -53,8 +55,8 @@ dav_error * dav_fs_get_locknull_members(const dav_resource *resource,
  /* DBM functions used by the repository and locking providers */
  extern const dav_hooks_db dav_hooks_db_dbm;
  
@@ -363,7 +363,7 @@ Upstream-Status: in trunk, not proposed for 2.4.x
  void dav_dbm_get_statefiles(apr_pool_t *p, const char *fname,
                              const char **state1, const char **state2);
  dav_error * dav_dbm_delete(dav_db *db, apr_datum_t key);
-@@ -64,8 +66,15 @@
+@@ -64,8 +66,15 @@ void dav_dbm_freedatum(dav_db *db, apr_datum_t data);
  int dav_dbm_exists(dav_db *db, apr_datum_t key);
  void dav_dbm_close(dav_db *db);
  
diff --git a/httpd.spec b/httpd.spec
index 1d84a2f..a563b58 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -30,8 +30,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.62
-Release: 6%{?dist}
+Version: 2.4.63
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -99,18 +99,12 @@ Patch27: httpd-2.4.43-sslciphdefault.patch
 Patch28: httpd-2.4.43-sslprotdefault.patch
 Patch29: httpd-2.4.43-logjournal.patch
 Patch30: httpd-2.4.53-separate-systemd-fns.patch
-Patch31: httpd-2.4.58-r1912477+.patch
+Patch31: httpd-2.4.63-r1912477+.patch
 Patch32: httpd-2.4.54-selinux.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
-# https://bz.apache.org/bugzilla/show_bug.cgi?id=69197
-Patch61: httpd-2.4.62-r1919325.patch
-# https://github.com/apache/httpd/pull/473
-# https://github.com/apache/httpd/commit/c91445b7f905587aa86ad552f4a1a3f29345e695
-Patch62: httpd-2.4.62-r1920980+.patch
-
 
 # Security fixes
 # Patch200: ...
@@ -852,6 +846,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jan 24 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-1
+- new version 2.4.63
+
 * Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.62-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
 
diff --git a/sources b/sources
index 2d4ff61..f188c2a 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.62.tar.bz2) = 7db1876805d5c0f60f49bcb51f75cdf567120f2ff6349e68f084e9a86ae38265d9f1c67e7fca0082c9db136f3c408a88501ee11f26b1b68724ba240867171d77
-SHA512 (httpd-2.4.62.tar.bz2.asc) = ed4d59fca7e134aa378dddfd0d62973da99fe77a82a48e268e11262af8aca4a4e90133cc979fb39a4f9cb33abbebb10b1345cb52cfad6eb58fc84d3308bc5a39
+SHA512 (httpd-2.4.63.tar.bz2) = a804ca564dfee5907fe4ce4f36884815bace0621bc7b8c9aa7c99472a954aa19cb13733f90678ff3d58ab3c76cc0e33a27e1035dc1d8cb597a9622154c59ef48
+SHA512 (httpd-2.4.63.tar.bz2.asc) = 3496290be3ff202c820636f6c1548dda363eb6a5c6c1ae88e7154eb839a71c32b6531a33a5a62159601d4a079ed6d7bbbfcf9cbe143d0941b3ffcbed783db9bf
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192

From 52584b92651dbb041020e0f12152383e968acb34 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= <besser82@fedoraproject.org>
Date: Sat, 1 Feb 2025 19:54:38 +0100
Subject: [PATCH 343/359] Add explicit BR: libxcrypt-devel
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Björn Esser <besser82@fedoraproject.org>
---
 httpd.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index a563b58..a92de53 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.63
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -121,6 +121,7 @@ BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0
 BuildRequires: openldap-devel
 BuildRequires: systemd-rpm-macros
+BuildRequires: libxcrypt-devel
 %if %{with pcre2}
 BuildRequires: pcre2-devel
 %endif
@@ -846,6 +847,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 2.4.63-2
+- Add explicit BR: libxcrypt-devel
+
 * Fri Jan 24 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-1
 - new version 2.4.63
 

From d91306617e86ebb7f9d4ada7b457b0a699d87764 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 10 Feb 2025 14:53:51 +0000
Subject: [PATCH 344/359] sync default httpd.conf with upstream

---
 httpd.conf | 18 +++++++++++++++++-
 httpd.spec |  5 ++++-
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/httpd.conf b/httpd.conf
index 609b2e2..e49ab6a 100644
--- a/httpd.conf
+++ b/httpd.conf
@@ -151,7 +151,7 @@ DocumentRoot "/var/www/html"
     #
     # AllowOverride controls what directives may be placed in .htaccess files.
     # It can be "All", "None", or any combination of the keywords:
-    #   Options FileInfo AuthConfig Limit
+    #   AllowOverride FileInfo AuthConfig Limit
     #
     AllowOverride None
 
@@ -263,6 +263,15 @@ LogLevel warn
     Require all granted
 </Directory>
 
+<IfModule headers_module>
+    #
+    # Avoid passing HTTP_PROXY environment to CGI's on this or any proxied
+    # backend servers which have lingering "httpoxy" defects.
+    # 'Proxy' request header is undefined by the IETF, not listed by IANA
+    #
+    RequestHeader unset Proxy early
+</IfModule>
+
 <IfModule mime_module>
     #
     # TypesConfig points to the file containing the list of mappings from
@@ -340,6 +349,13 @@ AddDefaultCharset UTF-8
 #ErrorDocument 402 http://www.example.com/subscription_info.html
 #
 
+#
+# MaxRanges: Maximum number of Ranges in a request before
+# returning the entire resource, or one of the special
+# values 'default', 'none' or 'unlimited'.
+# Default setting is to accept 200 Ranges.
+#MaxRanges unlimited
+
 #
 # EnableMMAP and EnableSendfile: On systems that support it, 
 # memory-mapping or the sendfile syscall may be used to deliver
diff --git a/httpd.spec b/httpd.spec
index a92de53..295aff9 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.63
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -847,6 +847,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Feb 10 2025 Joe Orton <jorton@redhat.com> - 2.4.63-3
+- sync default httpd.conf with upstream
+
 * Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 2.4.63-2
 - Add explicit BR: libxcrypt-devel
 

From 243d8d79fbbf3adcc15a7be19ab6958bc0747a68 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 14 Feb 2025 08:05:47 +0000
Subject: [PATCH 345/359] - remove unused patch

---
 httpd-2.4.59-pr426.patch | 244 ---------------------------------------
 1 file changed, 244 deletions(-)
 delete mode 100644 httpd-2.4.59-pr426.patch

diff --git a/httpd-2.4.59-pr426.patch b/httpd-2.4.59-pr426.patch
deleted file mode 100644
index c0ede88..0000000
--- a/httpd-2.4.59-pr426.patch
+++ /dev/null
@@ -1,244 +0,0 @@
-
-https://github.com/apache/httpd/pull/426.patch
-
-Upstream-Status: in trunk, proposed for 2.4.60
-
---- httpd-2.4.59/modules/ssl/ssl_engine_init.c.mr426
-+++ httpd-2.4.59/modules/ssl/ssl_engine_init.c
-@@ -880,6 +880,13 @@
-     }
- #endif
- 
-+#ifdef SSL_OP_NO_RENEGOTIATION
-+    /* For server-side SSL_CTX, disable renegotiation by default.. */
-+    if (!mctx->pkp) {
-+        SSL_CTX_set_options(ctx, SSL_OP_NO_RENEGOTIATION);
-+    }
-+#endif
-+
- #ifdef SSL_OP_IGNORE_UNEXPECTED_EOF
-     /* For server-side SSL_CTX, enable ignoring unexpected EOF */
-     /* (OpenSSL 1.1.1 behavioural compatibility).. */
-@@ -908,6 +915,14 @@
-     }
- }
- 
-+#ifdef SSL_OP_NO_RENEGOTIATION
-+/* OpenSSL-level renegotiation protection. */
-+#define MODSSL_BLOCKS_RENEG (0)
-+#else
-+/* mod_ssl-level renegotiation protection. */
-+#define MODSSL_BLOCKS_RENEG (1)
-+#endif
-+
- static void ssl_init_ctx_callbacks(server_rec *s,
-                                    apr_pool_t *p,
-                                    apr_pool_t *ptemp,
-@@ -921,7 +936,13 @@
-     SSL_CTX_set_tmp_dh_callback(ctx,  ssl_callback_TmpDH);
- #endif
- 
--    SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
-+    /* The info callback is used for debug-level tracing.  For OpenSSL
-+     * versions where SSL_OP_NO_RENEGOTIATION is not available, the
-+     * callback is also used to prevent use of client-initiated
-+     * renegotiation.  Enable it in either case. */
-+    if (APLOGdebug(s) || MODSSL_BLOCKS_RENEG) {
-+        SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
-+    }
- 
- #ifdef HAVE_TLS_ALPN
-     SSL_CTX_set_alpn_select_cb(ctx, ssl_callback_alpn_select, NULL);
---- httpd-2.4.59/modules/ssl/ssl_engine_io.c.mr426
-+++ httpd-2.4.59/modules/ssl/ssl_engine_io.c
-@@ -208,11 +208,13 @@
- 
-     BIO_clear_retry_flags(bio);
- 
-+#ifndef SSL_OP_NO_RENEGOTIATION
-     /* Abort early if the client has initiated a renegotiation. */
-     if (outctx->filter_ctx->config->reneg_state == RENEG_ABORT) {
-         outctx->rc = APR_ECONNABORTED;
-         return -1;
-     }
-+#endif
- 
-     ap_log_cerror(APLOG_MARK, APLOG_TRACE6, 0, outctx->c,
-                   "bio_filter_out_write: %i bytes", inl);
-@@ -473,11 +475,13 @@
- 
-     BIO_clear_retry_flags(bio);
- 
-+#ifndef SSL_OP_NO_RENEGOTIATION
-     /* Abort early if the client has initiated a renegotiation. */
-     if (inctx->filter_ctx->config->reneg_state == RENEG_ABORT) {
-         inctx->rc = APR_ECONNABORTED;
-         return -1;
-     }
-+#endif
- 
-     if (!inctx->bb) {
-         inctx->rc = APR_EOF;
---- httpd-2.4.59/modules/ssl/ssl_engine_kernel.c.mr426
-+++ httpd-2.4.59/modules/ssl/ssl_engine_kernel.c
-@@ -992,7 +992,7 @@
- 
-             /* Toggle the renegotiation state to allow the new
-              * handshake to proceed. */
--            sslconn->reneg_state = RENEG_ALLOW;
-+            modssl_set_reneg_state(sslconn, RENEG_ALLOW);
- 
-             SSL_renegotiate(ssl);
-             SSL_do_handshake(ssl);
-@@ -1019,7 +1019,7 @@
-              */
-             SSL_peek(ssl, peekbuf, 0);
- 
--            sslconn->reneg_state = RENEG_REJECT;
-+            modssl_set_reneg_state(sslconn, RENEG_REJECT);
- 
-             if (!SSL_is_init_finished(ssl)) {
-                 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02261)
-@@ -1078,7 +1078,7 @@
-         (sc->server->auth.verify_mode != SSL_CVERIFY_UNSET)) {
-         int vmode_inplace, vmode_needed;
-         int change_vmode = FALSE;
--        int old_state, n, rc;
-+        int n, rc;
- 
-         vmode_inplace = SSL_get_verify_mode(ssl);
-         vmode_needed = SSL_VERIFY_NONE;
-@@ -1180,8 +1180,6 @@
-                 return HTTP_FORBIDDEN;
-             }
-             
--            old_state = sslconn->reneg_state;
--            sslconn->reneg_state = RENEG_ALLOW;
-             modssl_set_app_data2(ssl, r);
- 
-             SSL_do_handshake(ssl);
-@@ -1191,7 +1189,6 @@
-              */
-             SSL_peek(ssl, peekbuf, 0);
- 
--            sslconn->reneg_state = old_state;
-             modssl_set_app_data2(ssl, NULL);
- 
-             /*
-@@ -2263,8 +2260,8 @@
- /*
-  * This callback function is executed while OpenSSL processes the SSL
-  * handshake and does SSL record layer stuff.  It's used to trap
-- * client-initiated renegotiations, and for dumping everything to the
-- * log.
-+ * client-initiated renegotiations (where SSL_OP_NO_RENEGOTIATION is
-+ * not available), and for dumping everything to the log.
-  */
- void ssl_callback_Info(const SSL *ssl, int where, int rc)
- {
-@@ -2276,14 +2273,12 @@
-         return;
-     }
- 
--    /* With TLS 1.3 this callback may be called multiple times on the first
--     * negotiation, so the below logic to detect renegotiations can't work.
--     * Fortunately renegotiations are forbidden starting with TLS 1.3, and
--     * this is enforced by OpenSSL so there's nothing to be done here.
--     */
--#if SSL_HAVE_PROTOCOL_TLSV1_3
--    if (SSL_version(ssl) < TLS1_3_VERSION)
--#endif
-+#ifndef SSL_OP_NO_RENEGOTIATION
-+    /* With OpenSSL < 1.1.1 (implying TLS v1.2 or earlier), this
-+     * callback is used to block client-initiated renegotiation.  With
-+     * TLSv1.3 it is unnecessary since renegotiation is forbidden at
-+     * protocol level.  Otherwise (TLSv1.2 with OpenSSL >=1.1.1),
-+     * SSL_OP_NO_RENEGOTIATION is used to block renegotiation. */
-     {
-         SSLConnRec *sslconn;
- 
-@@ -2308,6 +2303,7 @@
-             sslconn->reneg_state = RENEG_REJECT;
-         }
-     }
-+#endif
- 
-     s = mySrvFromConn(c);
-     if (s && APLOGdebug(s)) {
---- httpd-2.4.59/modules/ssl/ssl_private.h.mr426
-+++ httpd-2.4.59/modules/ssl/ssl_private.h
-@@ -558,6 +558,16 @@
-     apr_time_t     source_mtime;
- } ssl_asn1_t;
- 
-+typedef enum {
-+    RENEG_INIT = 0, /* Before initial handshake */
-+    RENEG_REJECT,   /* After initial handshake; any client-initiated
-+                     * renegotiation should be rejected */
-+    RENEG_ALLOW,    /* A server-initiated renegotiation is taking
-+                     * place (as dictated by configuration) */
-+    RENEG_ABORT     /* Renegotiation initiated by client, abort the
-+                     * connection */
-+} modssl_reneg_state;
-+
- /**
-  * Define the mod_ssl per-module configuration structure
-  * (i.e. the global configuration for each httpd process)
-@@ -589,18 +599,13 @@
-         NON_SSL_SET_ERROR_MSG  /* Need to set the error message */
-     } non_ssl_request;
- 
--    /* Track the handshake/renegotiation state for the connection so
--     * that all client-initiated renegotiations can be rejected, as a
--     * partial fix for CVE-2009-3555. */
--    enum {
--        RENEG_INIT = 0, /* Before initial handshake */
--        RENEG_REJECT,   /* After initial handshake; any client-initiated
--                         * renegotiation should be rejected */
--        RENEG_ALLOW,    /* A server-initiated renegotiation is taking
--                         * place (as dictated by configuration) */
--        RENEG_ABORT     /* Renegotiation initiated by client, abort the
--                         * connection */
--    } reneg_state;
-+#ifndef SSL_OP_NO_RENEGOTIATION
-+    /* For OpenSSL < 1.1.1, track the handshake/renegotiation state
-+     * for the connection to block client-initiated renegotiations.
-+     * For OpenSSL >=1.1.1, the SSL_OP_NO_RENEGOTIATION flag is used in
-+     * the SSL * options state with equivalent effect. */
-+    modssl_reneg_state reneg_state;
-+#endif
- 
-     server_rec *server;
-     SSLDirConfigRec *dc;
-@@ -1207,6 +1212,9 @@
-  * the configured ENGINE. */
- int modssl_is_engine_id(const char *name);
- 
-+/* Set the renegotation state for connection. */
-+void modssl_set_reneg_state(SSLConnRec *sslconn, modssl_reneg_state state);
-+
- #endif /* SSL_PRIVATE_H */
- /** @} */
- 
---- httpd-2.4.59/modules/ssl/ssl_util_ssl.c.mr426
-+++ httpd-2.4.59/modules/ssl/ssl_util_ssl.c
-@@ -612,3 +612,19 @@
-     }
-     return rv;
- }
-+
-+void modssl_set_reneg_state(SSLConnRec *sslconn, modssl_reneg_state state)
-+{
-+#ifdef SSL_OP_NO_RENEGOTIATION
-+    switch (state) {
-+    case RENEG_ALLOW:
-+        SSL_clear_options(sslconn->ssl, SSL_OP_NO_RENEGOTIATION);
-+        break;
-+    default:
-+        SSL_set_options(sslconn->ssl, SSL_OP_NO_RENEGOTIATION);
-+        break;
-+    }
-+#else
-+    sslconn->reneg_state = state;
-+#endif
-+}

From cbd0a3cf612e54b38e9f2c46f403989166e55ba4 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 24 Jun 2025 11:43:21 +0100
Subject: [PATCH 346/359] mod_dav: add dav_get_base_path() API

---
 httpd-2.4.63-r1926064.patch | 54 +++++++++++++++++++++++++++++++++++++
 httpd.spec                  |  6 ++++-
 pullrev.sh                  |  5 ++--
 3 files changed, 61 insertions(+), 4 deletions(-)
 create mode 100644 httpd-2.4.63-r1926064.patch

diff --git a/httpd-2.4.63-r1926064.patch b/httpd-2.4.63-r1926064.patch
new file mode 100644
index 0000000..e8115c7
--- /dev/null
+++ b/httpd-2.4.63-r1926064.patch
@@ -0,0 +1,54 @@
+# ./pullrev.sh 1926064
+http://svn.apache.org/viewvc?view=revision&revision=1926064
+
+--- httpd-2.4.63/include/ap_mmn.h
++++ httpd-2.4.63/include/ap_mmn.h
+@@ -608,6 +608,7 @@
+  * 20120211.136 (2.4.63-dev) Add wait_io field to struct process_score
+  * 20120211.137 (2.4.63-dev) Add AP_MPMQ_CAN_WAITIO
+  * 20120211.138 (2.4.63-dev) Add is_host_matchable to proxy_worker_shared
++ * 20120211.139 (2.4.63-dev) Add dav_get_base_path() to mod_dav
+  */
+ 
+ #define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */
+@@ -615,7 +616,7 @@
+ #ifndef MODULE_MAGIC_NUMBER_MAJOR
+ #define MODULE_MAGIC_NUMBER_MAJOR 20120211
+ #endif
+-#define MODULE_MAGIC_NUMBER_MINOR 138                 /* 0...n */
++#define MODULE_MAGIC_NUMBER_MINOR 139                 /* 0...n */
+ 
+ /**
+  * Determine if the server's current MODULE_MAGIC_NUMBER is at least a
+only in patch2:
+--- httpd-2.4.63/modules/dav/main/mod_dav.c
++++ httpd-2.4.63/modules/dav/main/mod_dav.c
+@@ -250,6 +250,13 @@
+     return dav_get_provider(r)->search;
+ }
+ 
++DAV_DECLARE(const char *) dav_get_base_path(request_rec *r)
++{
++    dav_dir_conf *conf = ap_get_module_config(r->per_dir_config, &dav_module);
++
++    return conf && conf->base ? conf->base : NULL;
++}
++
+ /*
+  * Command handler for the DAV directive, which is TAKE1.
+  */
+only in patch2:
+--- httpd-2.4.63/modules/dav/main/mod_dav.h
++++ httpd-2.4.63/modules/dav/main/mod_dav.h
+@@ -430,6 +430,11 @@
+ DAV_DECLARE(dav_error *) dav_get_resource(request_rec *r, int label_allowed,
+                                           int use_checked_in, dav_resource **res_p);
+ 
++/*
++** If DavBasePath is configured for the request location, return the
++** configured path, otherwise NULL.
++*/
++DAV_DECLARE(const char *) dav_get_base_path(request_rec *r);
+ 
+ /* --------------------------------------------------------------------
+ **
diff --git a/httpd.spec b/httpd.spec
index 295aff9..a9cd66c 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.63
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -101,6 +101,7 @@ Patch29: httpd-2.4.43-logjournal.patch
 Patch30: httpd-2.4.53-separate-systemd-fns.patch
 Patch31: httpd-2.4.63-r1912477+.patch
 Patch32: httpd-2.4.54-selinux.patch
+Patch33: httpd-2.4.63-r1926064.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -847,6 +848,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Jun 24 2025 Joe Orton  <jorton@redhat.com> - 2.4.63-4
+- mod_dav: add dav_get_base_path() API
+
 * Mon Feb 10 2025 Joe Orton <jorton@redhat.com> - 2.4.63-3
 - sync default httpd.conf with upstream
 
diff --git a/pullrev.sh b/pullrev.sh
index f21a7fb..a87d0dc 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then
 fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
-#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.59
+repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+ver=$(rpm -q --specfile httpd.spec --qf '%{VERSION}\n' | sed 1q)
 prefix="httpd-${ver}"
 suffix="${SUFFIX:-r$1${2:++}}"
 fn="${prefix}-${suffix}.patch"
@@ -64,4 +64,3 @@ echo "+ git add ${fn}"
 git add "${fn}"
 echo "+ spec template:"
 echo "PatchN: ${fn}"
-echo "%patch -PN -p1 -b .${suffix}"

From 70f6633789e59838cad7e3b31f57bfdfaba65295 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 11 Jul 2025 16:10:54 +0200
Subject: [PATCH 347/359] new version 2.4.64

---
 .gitignore                                    |   1 +
 httpd-2.4.43-socket-activation.patch          | 300 ------------------
 httpd-2.4.53-separate-systemd-fns.patch       | 286 -----------------
 httpd-2.4.54-selinux.patch                    |  64 ----
 httpd-2.4.63-r1926064.patch                   |  54 ----
 ...md.patch => httpd-2.4.64-mod_systemd.patch |  32 +-
 httpd-2.4.64-separate-systemd-fns.patch       | 101 ++++++
 ...patch => httpd-2.4.64-sslprotdefault.patch |  21 +-
 httpd.spec                                    |  23 +-
 sources                                       |   4 +-
 10 files changed, 143 insertions(+), 743 deletions(-)
 delete mode 100644 httpd-2.4.43-socket-activation.patch
 delete mode 100644 httpd-2.4.53-separate-systemd-fns.patch
 delete mode 100644 httpd-2.4.54-selinux.patch
 delete mode 100644 httpd-2.4.63-r1926064.patch
 rename httpd-2.4.43-mod_systemd.patch => httpd-2.4.64-mod_systemd.patch (78%)
 create mode 100644 httpd-2.4.64-separate-systemd-fns.patch
 rename httpd-2.4.43-sslprotdefault.patch => httpd-2.4.64-sslprotdefault.patch (84%)

diff --git a/.gitignore b/.gitignore
index 0969db5..0453dd4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -53,3 +53,4 @@ x86_64
 /httpd-2.4.61.tar.bz2.asc
 /httpd-2.4.62.tar.bz2.asc
 /httpd-2.4.63.tar.bz2.asc
+/httpd-2.4.64.tar.bz2.asc
diff --git a/httpd-2.4.43-socket-activation.patch b/httpd-2.4.43-socket-activation.patch
deleted file mode 100644
index 77eaa45..0000000
--- a/httpd-2.4.43-socket-activation.patch
+++ /dev/null
@@ -1,300 +0,0 @@
-diff --git a/server/listen.c b/server/listen.c
-index 9577d60..d718db1 100644
---- a/server/listen.c
-+++ b/server/listen.c
-@@ -35,6 +35,10 @@
- #include <unistd.h>
- #endif
- 
-+#ifdef HAVE_SYSTEMD
-+#include <systemd/sd-daemon.h>
-+#endif
-+
- /* we know core's module_index is 0 */
- #undef APLOG_MODULE_INDEX
- #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX
-@@ -60,9 +64,12 @@ static int ap_listenbacklog;
- static int ap_listencbratio;
- static int send_buffer_size;
- static int receive_buffer_size;
-+#ifdef HAVE_SYSTEMD
-+static int use_systemd = -1;
-+#endif
- 
- /* TODO: make_sock is just begging and screaming for APR abstraction */
--static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
-+static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server, int do_bind_listen)
- {
-     apr_socket_t *s = server->sd;
-     int one = 1;
-@@ -95,20 +102,6 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
-         return stat;
-     }
- 
--#if APR_HAVE_IPV6
--    if (server->bind_addr->family == APR_INET6) {
--        stat = apr_socket_opt_set(s, APR_IPV6_V6ONLY, v6only_setting);
--        if (stat != APR_SUCCESS && stat != APR_ENOTIMPL) {
--            ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(00069)
--                          "make_sock: for address %pI, apr_socket_opt_set: "
--                          "(IPV6_V6ONLY)",
--                          server->bind_addr);
--            apr_socket_close(s);
--            return stat;
--        }
--    }
--#endif
--
-     /*
-      * To send data over high bandwidth-delay connections at full
-      * speed we must force the TCP window to open wide enough to keep the
-@@ -170,21 +163,37 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
-     }
- #endif
- 
--    if ((stat = apr_socket_bind(s, server->bind_addr)) != APR_SUCCESS) {
--        ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_CRIT, stat, p, APLOGNO(00072)
--                      "make_sock: could not bind to address %pI",
--                      server->bind_addr);
--        apr_socket_close(s);
--        return stat;
--    }
-+    if (do_bind_listen) {
-+#if APR_HAVE_IPV6
-+        if (server->bind_addr->family == APR_INET6) {
-+            stat = apr_socket_opt_set(s, APR_IPV6_V6ONLY, v6only_setting);
-+            if (stat != APR_SUCCESS && stat != APR_ENOTIMPL) {
-+                ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(00069)
-+                              "make_sock: for address %pI, apr_socket_opt_set: "
-+                              "(IPV6_V6ONLY)",
-+                              server->bind_addr);
-+                apr_socket_close(s);
-+                return stat;
-+            }
-+        }
-+#endif
- 
--    if ((stat = apr_socket_listen(s, ap_listenbacklog)) != APR_SUCCESS) {
--        ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_ERR, stat, p, APLOGNO(00073)
--                      "make_sock: unable to listen for connections "
--                      "on address %pI",
--                      server->bind_addr);
--        apr_socket_close(s);
--        return stat;
-+        if ((stat = apr_socket_bind(s, server->bind_addr)) != APR_SUCCESS) {
-+            ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_CRIT, stat, p, APLOGNO(00072)
-+                          "make_sock: could not bind to address %pI",
-+                          server->bind_addr);
-+            apr_socket_close(s);
-+            return stat;
-+        }
-+
-+        if ((stat = apr_socket_listen(s, ap_listenbacklog)) != APR_SUCCESS) {
-+            ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_ERR, stat, p, APLOGNO(00073)
-+                          "make_sock: unable to listen for connections "
-+                          "on address %pI",
-+                          server->bind_addr);
-+            apr_socket_close(s);
-+            return stat;
-+        }
-     }
- 
- #ifdef WIN32
-@@ -335,6 +344,123 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
-     return found;
- }
- 
-+#ifdef HAVE_SYSTEMD
-+
-+static int find_systemd_socket(process_rec * process, apr_port_t port) {
-+    int fdcount, fd;
-+    int sdc = sd_listen_fds(0);
-+
-+    if (sdc < 0) {
-+        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486)
-+                      "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d",
-+                      sdc);
-+        return -1;
-+    }
-+
-+    if (sdc == 0) {
-+        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487)
-+                      "find_systemd_socket: At least one socket must be set.");
-+        return -1;
-+    }
-+
-+    fdcount = atoi(getenv("LISTEN_FDS"));
-+    for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) {
-+        if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) {
-+            return fd;
-+        }
-+    }
-+
-+    return -1;
-+}
-+
-+static apr_status_t alloc_systemd_listener(process_rec * process,
-+                                           int fd, const char *proto,
-+                                           ap_listen_rec **out_rec)
-+{
-+    apr_status_t rv;
-+    struct sockaddr sa;
-+    socklen_t len = sizeof(struct sockaddr);
-+    apr_os_sock_info_t si;
-+    ap_listen_rec *rec;
-+    *out_rec = NULL;
-+
-+    memset(&si, 0, sizeof(si));
-+
-+    rv = getsockname(fd, &sa, &len);
-+
-+    if (rv != 0) {
-+        rv = apr_get_netos_error();
-+        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02489)
-+                      "getsockname on %d failed.", fd);
-+        return rv;
-+    }
-+
-+    si.os_sock = &fd;
-+    si.family = sa.sa_family;
-+    si.local = &sa;
-+    si.type = SOCK_STREAM;
-+    si.protocol = APR_PROTO_TCP;
-+
-+    rec = apr_palloc(process->pool, sizeof(ap_listen_rec));
-+    rec->active = 0;
-+    rec->next = 0;
-+
-+
-+    rv = apr_os_sock_make(&rec->sd, &si, process->pool);
-+    if (rv != APR_SUCCESS) {
-+        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02490)
-+                      "apr_os_sock_make on %d failed.", fd);
-+        return rv;
-+    }
-+
-+    rv = apr_socket_addr_get(&rec->bind_addr, APR_LOCAL, rec->sd);
-+    if (rv != APR_SUCCESS) {
-+        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02491)
-+                      "apr_socket_addr_get on %d failed.", fd);
-+        return rv;
-+    }
-+
-+    rec->protocol = apr_pstrdup(process->pool, proto);
-+
-+    *out_rec = rec;
-+
-+    return make_sock(process->pool, rec, 0);
-+}
-+
-+static const char *set_systemd_listener(process_rec *process, apr_port_t port,
-+                                        const char *proto)
-+{
-+    ap_listen_rec *last, *new;
-+    apr_status_t rv;
-+    int fd = find_systemd_socket(process, port);
-+    if (fd < 0) {
-+        return "Systemd socket activation is used, but this port is not "
-+                "configured in systemd";
-+    }
-+
-+    last = ap_listeners;
-+    while (last && last->next) {
-+        last = last->next;
-+    }
-+
-+    rv = alloc_systemd_listener(process, fd, proto, &new);
-+    if (rv != APR_SUCCESS) {
-+        return "Failed to setup socket passed by systemd using socket activation";
-+    }
-+
-+    if (last == NULL) {
-+        ap_listeners = last = new;
-+    }
-+    else {
-+        last->next = new;
-+        last = new;
-+    }
-+
-+    return NULL;
-+}
-+
-+#endif /* HAVE_SYSTEMD */
-+
- static const char *alloc_listener(process_rec *process, const char *addr,
-                                   apr_port_t port, const char* proto,
-                                   const char *scope_id, void *slave,
-@@ -529,7 +655,7 @@ static int open_listeners(apr_pool_t *pool)
-                 }
-             }
- #endif
--            if (make_sock(pool, lr) == APR_SUCCESS) {
-+            if (make_sock(pool, lr, 1) == APR_SUCCESS) {
-                 ++num_open;
-             }
-             else {
-@@ -641,8 +767,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
-         }
-     }
- 
--    if (open_listeners(s->process->pool)) {
--        return 0;
-+#ifdef HAVE_SYSTEMD
-+    if (use_systemd) {
-+        const char *userdata_key = "ap_open_systemd_listeners";
-+        void *data;
-+        /* clear the enviroment on our second run
-+        * so that none of our future children get confused.
-+        */
-+        apr_pool_userdata_get(&data, userdata_key, s->process->pool);
-+        if (!data) {
-+            apr_pool_userdata_set((const void *)1, userdata_key,
-+                                apr_pool_cleanup_null, s->process->pool);
-+        }
-+        else {
-+            sd_listen_fds(1);
-+        }
-+    }
-+    else
-+#endif
-+    {
-+        if (open_listeners(s->process->pool)) {
-+            return 0;
-+        }
-     }
- 
-     for (lr = ap_listeners; lr; lr = lr->next) {
-@@ -732,7 +878,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
-                             duplr->bind_addr);
-                 return stat;
-             }
--            make_sock(p, duplr);
-+            make_sock(p, duplr, 1);
- #if AP_NONBLOCK_WHEN_MULTI_LISTEN
-             use_nonblock = (ap_listeners && ap_listeners->next);
-             stat = apr_socket_opt_set(duplr->sd, APR_SO_NONBLOCK, use_nonblock);
-@@ -859,6 +1005,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
-     if (argc < 1 || argc > 2) {
-         return "Listen requires 1 or 2 arguments.";
-     }
-+#ifdef HAVE_SYSTEMD
-+    if (use_systemd == -1) {
-+        use_systemd = sd_listen_fds(0) > 0;
-+    }
-+#endif
- 
-     rv = apr_parse_addr_port(&host, &scope_id, &port, argv[0], cmd->pool);
-     if (rv != APR_SUCCESS) {
-@@ -894,6 +1045,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
-         ap_str_tolower(proto);
-     }
- 
-+#ifdef HAVE_SYSTEMD
-+    if (use_systemd) {
-+        return set_systemd_listener(cmd->server->process, port, proto);
-+    }
-+#endif
-+
-     return alloc_listener(cmd->server->process, host, port, proto,
-                           scope_id, NULL, cmd->temp_pool);
- }
diff --git a/httpd-2.4.53-separate-systemd-fns.patch b/httpd-2.4.53-separate-systemd-fns.patch
deleted file mode 100644
index 8db5c57..0000000
--- a/httpd-2.4.53-separate-systemd-fns.patch
+++ /dev/null
@@ -1,286 +0,0 @@
-diff --git a/acinclude.m4 b/acinclude.m4
-index 05abe18..97484c9 100644
---- a/acinclude.m4
-+++ b/acinclude.m4
-@@ -631,7 +631,6 @@ case $host in
-       if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
-         AC_MSG_WARN([Your system does not support systemd.])
-       else
--        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
-         AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
-       fi
-    fi
-diff --git a/include/ap_listen.h b/include/ap_listen.h
-index 58c2574..d5ed968 100644
---- a/include/ap_listen.h
-+++ b/include/ap_listen.h
-@@ -29,6 +29,7 @@
- #include "apr_network_io.h"
- #include "httpd.h"
- #include "http_config.h"
-+#include "apr_optional.h"
- 
- #ifdef __cplusplus
- extern "C" {
-@@ -143,6 +144,15 @@ AP_DECLARE_NONSTD(const char *) ap_set_receive_buffer_size(cmd_parms *cmd,
-                                                            void *dummy,
-                                                            const char *arg);
- 
-+#ifdef HAVE_SYSTEMD
-+APR_DECLARE_OPTIONAL_FN(int,
-+                        ap_find_systemd_socket, (process_rec *, apr_port_t));
-+
-+APR_DECLARE_OPTIONAL_FN(int,
-+                        ap_systemd_listen_fds, (int));
-+#endif
-+
-+
- #define LISTEN_COMMANDS \
- AP_INIT_TAKE1("ListenBacklog", ap_set_listenbacklog, NULL, RSRC_CONF, \
-   "Maximum length of the queue of pending connections, as used by listen(2)"), \
-diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
-index eda1272..fc059fc 100644
---- a/modules/arch/unix/mod_systemd.c
-+++ b/modules/arch/unix/mod_systemd.c
-@@ -35,6 +35,15 @@
- #include <unistd.h>
- #endif
- 
-+APR_DECLARE_OPTIONAL_FN(int,
-+                        ap_find_systemd_socket, (process_rec *, apr_port_t));
-+
-+APR_DECLARE_OPTIONAL_FN(int,
-+                        ap_systemd_listen_fds, (int));
-+
-+APR_DECLARE_OPTIONAL_FN(int,
-+                        ap_systemd_journal_stream_fd, (const char *, int, int));
-+
- static char describe_listeners[30];
- 
- static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
-@@ -145,8 +154,47 @@ static int systemd_monitor(apr_pool_t *p, server_rec *s)
-     return DECLINED;
- }
- 
-+static int ap_find_systemd_socket(process_rec * process, apr_port_t port) {
-+    int fdcount, fd;
-+    int sdc = sd_listen_fds(0);
-+
-+    if (sdc < 0) {
-+        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486)
-+                      "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d",
-+                      sdc);
-+        return -1;
-+    }
-+
-+    if (sdc == 0) {
-+        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487)
-+                      "find_systemd_socket: At least one socket must be set.");
-+        return -1;
-+    }
-+
-+    fdcount = atoi(getenv("LISTEN_FDS"));
-+    for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) {
-+        if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) {
-+            return fd;
-+        }
-+    }
-+
-+    return -1;
-+}
-+
-+static int ap_systemd_listen_fds(int unset_environment){
-+    return sd_listen_fds(unset_environment);
-+}
-+
-+static int ap_systemd_journal_stream_fd(const char *identifier, int priority, int level_prefix){
-+    return sd_journal_stream_fd("httpd", priority, 0);
-+}
-+
- static void systemd_register_hooks(apr_pool_t *p)
- {
-+    APR_REGISTER_OPTIONAL_FN(ap_systemd_listen_fds);
-+    APR_REGISTER_OPTIONAL_FN(ap_find_systemd_socket);
-+    APR_REGISTER_OPTIONAL_FN(ap_systemd_journal_stream_fd);
-+
-     /* Enable ap_extended_status. */
-     ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
-     /* Signal service is ready. */
-diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4
-index 0848d2e..8af2299 100644
---- a/modules/loggers/config.m4
-+++ b/modules/loggers/config.m4
-@@ -5,7 +5,6 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]])
- APACHE_MODPATH_INIT(loggers)
- 	
- APACHE_MODULE(log_config, logging configuration.  You won't be able to log requests to the server without this module., , , yes)
--APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS])
- 
- APACHE_MODULE(log_debug, configurable debug logging, , , most)
- APACHE_MODULE(log_forensic, forensic logging)
-diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c
-index 0b11f60..c3f0a51 100644
---- a/modules/loggers/mod_log_config.c
-+++ b/modules/loggers/mod_log_config.c
-@@ -172,10 +172,6 @@
- #include <limits.h>
- #endif
- 
--#ifdef HAVE_SYSTEMD
--#include <systemd/sd-journal.h>
--#endif
--
- #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b"
- 
- module AP_MODULE_DECLARE_DATA log_config_module;
-@@ -1640,8 +1636,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd,
- {
- #ifdef HAVE_SYSTEMD
-     int fd;
-+    APR_OPTIONAL_FN_TYPE(ap_systemd_journal_stream_fd) *systemd_journal_stream_fd;
-+    
-+    systemd_journal_stream_fd = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_journal_stream_fd);
-+    if (systemd_journal_stream_fd == NULL) {
-+        return APR_ENOTIMPL;
-+    }
- 
--    fd = sd_journal_stream_fd("httpd", priority, 0);
-+    fd = systemd_journal_stream_fd("httpd", priority, 0);
-+    
-     if (fd < 0) return fd;
- 
-     /* This is an AF_UNIX socket fd so is more pipe-like than
-diff --git a/modules/loggers/mod_log_config.h b/modules/loggers/mod_log_config.h
-index 877a593..bd52a98 100644
---- a/modules/loggers/mod_log_config.h
-+++ b/modules/loggers/mod_log_config.h
-@@ -69,6 +69,10 @@ APR_DECLARE_OPTIONAL_FN(ap_log_writer_init*, ap_log_set_writer_init,(ap_log_writ
-  */
- APR_DECLARE_OPTIONAL_FN(ap_log_writer*, ap_log_set_writer, (ap_log_writer* func));
- 
-+#ifdef HAVE_SYSTEMD
-+APR_DECLARE_OPTIONAL_FN(int, ap_systemd_journal_stream_fd, (const char *, int, int));
-+#endif
-+
- #endif /* MOD_LOG_CONFIG */
- /** @} */
- 
-diff --git a/server/listen.c b/server/listen.c
-index d718db1..2a4e87a 100644
---- a/server/listen.c
-+++ b/server/listen.c
-@@ -35,10 +35,6 @@
- #include <unistd.h>
- #endif
- 
--#ifdef HAVE_SYSTEMD
--#include <systemd/sd-daemon.h>
--#endif
--
- /* we know core's module_index is 0 */
- #undef APLOG_MODULE_INDEX
- #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX
-@@ -345,34 +341,6 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
- }
- 
- #ifdef HAVE_SYSTEMD
--
--static int find_systemd_socket(process_rec * process, apr_port_t port) {
--    int fdcount, fd;
--    int sdc = sd_listen_fds(0);
--
--    if (sdc < 0) {
--        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486)
--                      "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d",
--                      sdc);
--        return -1;
--    }
--
--    if (sdc == 0) {
--        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487)
--                      "find_systemd_socket: At least one socket must be set.");
--        return -1;
--    }
--
--    fdcount = atoi(getenv("LISTEN_FDS"));
--    for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) {
--        if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) {
--            return fd;
--        }
--    }
--
--    return -1;
--}
--
- static apr_status_t alloc_systemd_listener(process_rec * process,
-                                            int fd, const char *proto,
-                                            ap_listen_rec **out_rec)
-@@ -432,6 +400,14 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
- {
-     ap_listen_rec *last, *new;
-     apr_status_t rv;
-+    APR_OPTIONAL_FN_TYPE(ap_find_systemd_socket) *find_systemd_socket;
-+
-+    find_systemd_socket = APR_RETRIEVE_OPTIONAL_FN(ap_find_systemd_socket);
-+
-+    if (!find_systemd_socket)
-+       return "Systemd socket activation is used, but mod_systemd is probably "
-+               "not loaded";
-+
-     int fd = find_systemd_socket(process, port);
-     if (fd < 0) {
-         return "Systemd socket activation is used, but this port is not "
-@@ -458,7 +434,6 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
- 
-     return NULL;
- }
--
- #endif /* HAVE_SYSTEMD */
- 
- static const char *alloc_listener(process_rec *process, const char *addr,
-@@ -741,6 +716,9 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
-     int num_listeners = 0;
-     const char* proto;
-     int found;
-+#ifdef HAVE_SYSTEMD
-+    APR_OPTIONAL_FN_TYPE(ap_systemd_listen_fds) *systemd_listen_fds;
-+#endif
- 
-     for (ls = s; ls; ls = ls->next) {
-         proto = ap_get_server_protocol(ls);
-@@ -780,7 +758,10 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
-                                 apr_pool_cleanup_null, s->process->pool);
-         }
-         else {
--            sd_listen_fds(1);
-+            systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds);
-+            if (systemd_listen_fds != NULL) {
-+                systemd_listen_fds(1);
-+            }
-         }
-     }
-     else
-@@ -997,6 +978,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
-     apr_port_t port;
-     apr_status_t rv;
-     const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
-+#ifdef HAVE_SYSTEMD
-+    APR_OPTIONAL_FN_TYPE(ap_systemd_listen_fds) *systemd_listen_fds;
-+#endif
- 
-     if (err != NULL) {
-         return err;
-@@ -1007,7 +991,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
-     }
- #ifdef HAVE_SYSTEMD
-     if (use_systemd == -1) {
--        use_systemd = sd_listen_fds(0) > 0;
-+        systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds);
-+        if (systemd_listen_fds != NULL) {
-+            use_systemd = systemd_listen_fds(0) > 0;
-+        } else {
-+            use_systemd = 0;
-+        }
-     }
- #endif
- 
diff --git a/httpd-2.4.54-selinux.patch b/httpd-2.4.54-selinux.patch
deleted file mode 100644
index 661b983..0000000
--- a/httpd-2.4.54-selinux.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-
-Upstream-Status: in trunk not in 2.4.x
-
-diff --git a/configure.in b/configure.in
-index 74015ca..8c0ee10 100644
---- httpd-2.4.54/modules/arch/unix/config5.m4.selinux
-+++ httpd-2.4.54/modules/arch/unix/config5.m4
-@@ -23,6 +23,11 @@
-     AC_MSG_WARN([Your system does not support systemd.])
-     enable_systemd="no"
-   else
-+    AC_CHECK_LIB(selinux, is_selinux_enabled, [
-+      AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported])
-+      APR_ADDTO(MOD_SYSTEMD_LDADD, [-lselinux])
-+    ])
-+  
-     APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS])
-   fi
- ])
---- httpd-2.4.54/modules/arch/unix/mod_systemd.c.selinux
-+++ httpd-2.4.54/modules/arch/unix/mod_systemd.c
-@@ -35,6 +35,10 @@
- #include <unistd.h>
- #endif
- 
-+#ifdef HAVE_SELINUX
-+#include <selinux/selinux.h>
-+#endif
-+
- APR_DECLARE_OPTIONAL_FN(int,
-                         ap_find_systemd_socket, (process_rec *, apr_port_t));
- 
-@@ -70,6 +74,20 @@
-     return apr_psprintf(p, "%s port %u", addr, sa->port);
- }
- 
-+#ifdef HAVE_SELINUX
-+static void log_selinux_context(void)
-+{
-+    char *con;
-+
-+    if (is_selinux_enabled() && getcon(&con) == 0) {
-+        ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
-+                     "SELinux policy enabled; "
-+                     "httpd running as context %s", con);
-+        freecon(con);
-+    }
-+}
-+#endif
-+
- /* Report the service is ready in post_config, which could be during
-  * startup or after a reload.  The server could still hit a fatal
-  * startup error after this point during ap_run_mpm(), so this is
-@@ -87,6 +105,10 @@
-     if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
-         return OK;
- 
-+#ifdef HAVE_SELINUX
-+    log_selinux_context();
-+#endif
-+    
-     for (lr = ap_listeners; lr; lr = lr->next) {
-         char *s = dump_listener(lr, ptemp);
- 
diff --git a/httpd-2.4.63-r1926064.patch b/httpd-2.4.63-r1926064.patch
deleted file mode 100644
index e8115c7..0000000
--- a/httpd-2.4.63-r1926064.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-# ./pullrev.sh 1926064
-http://svn.apache.org/viewvc?view=revision&revision=1926064
-
---- httpd-2.4.63/include/ap_mmn.h
-+++ httpd-2.4.63/include/ap_mmn.h
-@@ -608,6 +608,7 @@
-  * 20120211.136 (2.4.63-dev) Add wait_io field to struct process_score
-  * 20120211.137 (2.4.63-dev) Add AP_MPMQ_CAN_WAITIO
-  * 20120211.138 (2.4.63-dev) Add is_host_matchable to proxy_worker_shared
-+ * 20120211.139 (2.4.63-dev) Add dav_get_base_path() to mod_dav
-  */
- 
- #define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */
-@@ -615,7 +616,7 @@
- #ifndef MODULE_MAGIC_NUMBER_MAJOR
- #define MODULE_MAGIC_NUMBER_MAJOR 20120211
- #endif
--#define MODULE_MAGIC_NUMBER_MINOR 138                 /* 0...n */
-+#define MODULE_MAGIC_NUMBER_MINOR 139                 /* 0...n */
- 
- /**
-  * Determine if the server's current MODULE_MAGIC_NUMBER is at least a
-only in patch2:
---- httpd-2.4.63/modules/dav/main/mod_dav.c
-+++ httpd-2.4.63/modules/dav/main/mod_dav.c
-@@ -250,6 +250,13 @@
-     return dav_get_provider(r)->search;
- }
- 
-+DAV_DECLARE(const char *) dav_get_base_path(request_rec *r)
-+{
-+    dav_dir_conf *conf = ap_get_module_config(r->per_dir_config, &dav_module);
-+
-+    return conf && conf->base ? conf->base : NULL;
-+}
-+
- /*
-  * Command handler for the DAV directive, which is TAKE1.
-  */
-only in patch2:
---- httpd-2.4.63/modules/dav/main/mod_dav.h
-+++ httpd-2.4.63/modules/dav/main/mod_dav.h
-@@ -430,6 +430,11 @@
- DAV_DECLARE(dav_error *) dav_get_resource(request_rec *r, int label_allowed,
-                                           int use_checked_in, dav_resource **res_p);
- 
-+/*
-+** If DavBasePath is configured for the request location, return the
-+** configured path, otherwise NULL.
-+*/
-+DAV_DECLARE(const char *) dav_get_base_path(request_rec *r);
- 
- /* --------------------------------------------------------------------
- **
diff --git a/httpd-2.4.43-mod_systemd.patch b/httpd-2.4.64-mod_systemd.patch
similarity index 78%
rename from httpd-2.4.43-mod_systemd.patch
rename to httpd-2.4.64-mod_systemd.patch
index 8d7922e..cad4a01 100644
--- a/httpd-2.4.43-mod_systemd.patch
+++ b/httpd-2.4.64-mod_systemd.patch
@@ -1,10 +1,12 @@
 
 More verbose startup logging for mod_systemd.
 
---- httpd-2.4.43/modules/arch/unix/mod_systemd.c.mod_systemd
-+++ httpd-2.4.43/modules/arch/unix/mod_systemd.c
-@@ -29,11 +29,14 @@
- #include "mpm_common.h"
+diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
+index 22482fd..b46d3ef 100644
+--- a/modules/arch/unix/mod_systemd.c
++++ b/modules/arch/unix/mod_systemd.c
+@@ -34,11 +34,14 @@
+ #endif
  
  #include "systemd/sd-daemon.h"
 +#include "systemd/sd-journal.h"
@@ -18,9 +20,9 @@ More verbose startup logging for mod_systemd.
  static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
                                apr_pool_t *ptemp)
  {
-@@ -44,6 +47,20 @@
-     return OK;
+@@ -63,6 +66,20 @@ static void log_selinux_context(void)
  }
+ #endif
  
 +static char *dump_listener(ap_listen_rec *lr, apr_pool_t *p)
 +{
@@ -39,21 +41,17 @@ More verbose startup logging for mod_systemd.
  /* Report the service is ready in post_config, which could be during
   * startup or after a reload.  The server could still hit a fatal
   * startup error after this point during ap_run_mpm(), so this is
-@@ -51,19 +68,51 @@
-  * the TCP ports so new connections will not be rejected.  There will
-  * always be a possible async failure event simultaneous to the
-  * service reporting "ready", so this should be good enough. */
--static int systemd_post_config(apr_pool_t *p, apr_pool_t *plog,
-+static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
+@@ -73,23 +90,52 @@ static void log_selinux_context(void)
+ static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
                                 apr_pool_t *ptemp, server_rec *main_server)
  {
 +    ap_listen_rec *lr;
 +    apr_size_t plen = sizeof describe_listeners;
 +    char *p = describe_listeners;
 +
-+    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
-+        return OK;
-+
+     if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
+         return OK;
+ 
 +    for (lr = ap_listeners; lr; lr = lr->next) {
 +        char *s = dump_listener(lr, ptemp);
 +
@@ -74,6 +72,10 @@ More verbose startup logging for mod_systemd.
 +        }
 +    }
 +
+ #ifdef HAVE_SELINUX
+     log_selinux_context();
+ #endif
+ 
      sd_notify(0, "READY=1\n"
                "STATUS=Configuration loaded.\n");
 +
diff --git a/httpd-2.4.64-separate-systemd-fns.patch b/httpd-2.4.64-separate-systemd-fns.patch
new file mode 100644
index 0000000..6947ee6
--- /dev/null
+++ b/httpd-2.4.64-separate-systemd-fns.patch
@@ -0,0 +1,101 @@
+diff --git a/acinclude.m4 b/acinclude.m4
+index 05abe18..97484c9 100644
+--- a/acinclude.m4
++++ b/acinclude.m4
+@@ -631,7 +631,6 @@ case $host in
+       if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
+         AC_MSG_WARN([Your system does not support systemd.])
+       else
+-        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
+         AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
+       fi
+    fi
+diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
+index af68249..7232a45 100644
+--- a/modules/arch/unix/mod_systemd.c
++++ b/modules/arch/unix/mod_systemd.c
+@@ -40,6 +40,9 @@
+ #include <unistd.h>
+ #endif
+ 
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_systemd_journal_stream_fd, (const char *, int, int));
++
+ static char describe_listeners[30];
+ 
+ static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
+@@ -217,10 +220,15 @@ static int ap_systemd_listen_fds(int unset_environment){
+     return sd_listen_fds(unset_environment);
+ }
+ 
++static int ap_systemd_journal_stream_fd(const char *identifier, int priority, int level_prefix){
++    return sd_journal_stream_fd("httpd", priority, 0);
++}
++
+ static void systemd_register_hooks(apr_pool_t *p)
+ {
+     APR_REGISTER_OPTIONAL_FN(ap_systemd_listen_fds);
+     APR_REGISTER_OPTIONAL_FN(ap_find_systemd_socket);
++    APR_REGISTER_OPTIONAL_FN(ap_systemd_journal_stream_fd);
+ 
+     /* Enable ap_extended_status. */
+     ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
+diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4
+index 0848d2e..8af2299 100644
+--- a/modules/loggers/config.m4
++++ b/modules/loggers/config.m4
+@@ -5,7 +5,6 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]])
+ APACHE_MODPATH_INIT(loggers)
+ 	
+ APACHE_MODULE(log_config, logging configuration.  You won't be able to log requests to the server without this module., , , yes)
+-APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS])
+ 
+ APACHE_MODULE(log_debug, configurable debug logging, , , most)
+ APACHE_MODULE(log_forensic, forensic logging)
+diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c
+index 694f447..a65b982 100644
+--- a/modules/loggers/mod_log_config.c
++++ b/modules/loggers/mod_log_config.c
+@@ -172,10 +172,6 @@
+ #include <limits.h>
+ #endif
+ 
+-#ifdef HAVE_SYSTEMD
+-#include <systemd/sd-journal.h>
+-#endif
+-
+ #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b"
+ 
+ module AP_MODULE_DECLARE_DATA log_config_module;
+@@ -1640,8 +1636,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd,
+ {
+ #ifdef HAVE_SYSTEMD
+     int fd;
++    APR_OPTIONAL_FN_TYPE(ap_systemd_journal_stream_fd) *systemd_journal_stream_fd;
++    
++    systemd_journal_stream_fd = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_journal_stream_fd);
++    if (systemd_journal_stream_fd == NULL) {
++        return APR_ENOTIMPL;
++    }
+ 
+-    fd = sd_journal_stream_fd("httpd", priority, 0);
++    fd = systemd_journal_stream_fd("httpd", priority, 0);
++    
+     if (fd < 0) return fd;
+ 
+     /* This is an AF_UNIX socket fd so is more pipe-like than
+diff --git a/modules/loggers/mod_log_config.h b/modules/loggers/mod_log_config.h
+index 877a593..bd52a98 100644
+--- a/modules/loggers/mod_log_config.h
++++ b/modules/loggers/mod_log_config.h
+@@ -69,6 +69,10 @@ APR_DECLARE_OPTIONAL_FN(ap_log_writer_init*, ap_log_set_writer_init,(ap_log_writ
+  */
+ APR_DECLARE_OPTIONAL_FN(ap_log_writer*, ap_log_set_writer, (ap_log_writer* func));
+ 
++#ifdef HAVE_SYSTEMD
++APR_DECLARE_OPTIONAL_FN(int, ap_systemd_journal_stream_fd, (const char *, int, int));
++#endif
++
+ #endif /* MOD_LOG_CONFIG */
+ /** @} */
+ 
diff --git a/httpd-2.4.43-sslprotdefault.patch b/httpd-2.4.64-sslprotdefault.patch
similarity index 84%
rename from httpd-2.4.43-sslprotdefault.patch
rename to httpd-2.4.64-sslprotdefault.patch
index d089823..6d97935 100644
--- a/httpd-2.4.43-sslprotdefault.patch
+++ b/httpd-2.4.64-sslprotdefault.patch
@@ -1,8 +1,8 @@
 diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
-index 27e7a53..b53f3f8 100644
+index 8fae1f8..c5dce7f 100644
 --- a/modules/ssl/ssl_engine_config.c
 +++ b/modules/ssl/ssl_engine_config.c
-@@ -119,7 +119,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
+@@ -127,7 +127,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
      mctx->ticket_key          = NULL;
  #endif
  
@@ -11,7 +11,7 @@ index 27e7a53..b53f3f8 100644
      mctx->protocol_set        = 0;
  
      mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET;
-@@ -263,6 +263,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
+@@ -268,6 +268,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
      if (add->protocol_set) {
          mrg->protocol_set = 1;
          mrg->protocol = add->protocol;
@@ -19,20 +19,19 @@ index 27e7a53..b53f3f8 100644
      }
      else {
          mrg->protocol_set = base->protocol_set;
-
 diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
-index bfad47a..b0fcf81 100644
+index 4e265b3..2fbd076 100644
 --- a/modules/ssl/ssl_engine_init.c
 +++ b/modules/ssl/ssl_engine_init.c
-@@ -577,6 +577,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -638,6 +638,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
      MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL;
      char *cp;
      int protocol = mctx->protocol;
 +    int protocol_set = mctx->protocol_set;
      SSLSrvConfigRec *sc = mySrvConfig(s);
  #if OPENSSL_VERSION_NUMBER >= 0x10100000L
-     int prot;
-@@ -586,12 +587,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+     /* default is highest supported version, will be overridden below */
+@@ -652,12 +653,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
       *  Create the new per-server SSL context
       */
      if (protocol == SSL_PROTOCOL_NONE) {
@@ -56,7 +55,7 @@ index bfad47a..b0fcf81 100644
  #ifndef OPENSSL_NO_SSL3
                       (protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""),
  #endif
-@@ -604,7 +611,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -670,7 +677,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
  #endif
  #endif
                       NULL);
@@ -66,7 +65,7 @@ index bfad47a..b0fcf81 100644
  
      ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s,
                   "Creating new SSL context (protocols: %s)", cp);
-@@ -705,13 +713,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -776,13 +784,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
          prot = SSL3_VERSION;
  #endif
      } else {
@@ -88,7 +87,7 @@ index bfad47a..b0fcf81 100644
  
      /* Next we scan for the minimal protocol version we should provide,
       * but we do not allow holes between max and min */
-@@ -731,7 +741,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -806,7 +816,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
          prot = SSL3_VERSION;
      }
  #endif
diff --git a/httpd.spec b/httpd.spec
index a9cd66c..15453d2 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -30,8 +30,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.63
-Release: 4%{?dist}
+Version: 2.4.64
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -89,19 +89,17 @@ Patch3: httpd-2.4.43-deplibs.patch
 Patch19: httpd-2.4.53-detect-systemd.patch
 # Features/functional changes
 Patch20: httpd-2.4.48-r1842929+.patch
-Patch21: httpd-2.4.43-mod_systemd.patch
+Patch21: httpd-2.4.64-mod_systemd.patch
 Patch22: httpd-2.4.53-export.patch
 Patch23: httpd-2.4.43-corelimit.patch
 Patch24: httpd-2.4.54-icons.patch
 Patch25: httpd-2.4.43-cachehardmax.patch
-Patch26: httpd-2.4.43-socket-activation.patch
-Patch27: httpd-2.4.43-sslciphdefault.patch
-Patch28: httpd-2.4.43-sslprotdefault.patch
-Patch29: httpd-2.4.43-logjournal.patch
-Patch30: httpd-2.4.53-separate-systemd-fns.patch
-Patch31: httpd-2.4.63-r1912477+.patch
-Patch32: httpd-2.4.54-selinux.patch
-Patch33: httpd-2.4.63-r1926064.patch
+Patch26: httpd-2.4.43-sslciphdefault.patch
+Patch27: httpd-2.4.64-sslprotdefault.patch
+Patch28: httpd-2.4.43-logjournal.patch
+Patch29: httpd-2.4.63-r1912477+.patch
+Patch30: httpd-2.4.64-selinux.patch
+Patch31: httpd-2.4.64-separate-systemd-fns.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -848,6 +846,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Jul 11 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-1
+- new version 2.4.64
+
 * Tue Jun 24 2025 Joe Orton  <jorton@redhat.com> - 2.4.63-4
 - mod_dav: add dav_get_base_path() API
 
diff --git a/sources b/sources
index f188c2a..c5568c0 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.63.tar.bz2) = a804ca564dfee5907fe4ce4f36884815bace0621bc7b8c9aa7c99472a954aa19cb13733f90678ff3d58ab3c76cc0e33a27e1035dc1d8cb597a9622154c59ef48
-SHA512 (httpd-2.4.63.tar.bz2.asc) = 3496290be3ff202c820636f6c1548dda363eb6a5c6c1ae88e7154eb839a71c32b6531a33a5a62159601d4a079ed6d7bbbfcf9cbe143d0941b3ffcbed783db9bf
+SHA512 (httpd-2.4.64.tar.bz2) = 299cb0d87a7e0e0a99d22bba7349b6b07c69222897410f9670af29896288d1f4e1da81d22ac9e1d8d6ea096e88044ab1dd34555b40a4b1b1cb3fd4b1d1897a7a
+SHA512 (httpd-2.4.64.tar.bz2.asc) = 1a28214c8468288477f706422ab3419e186ef37dc1eb55760a7e951605e08e295230b6d828948693a9d5ba247e352b205254c999763fa6845dab2f703152e1d8
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192

From 1f087eb8b1e670cc371e8ca639aa98de477311e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 11 Jul 2025 17:05:03 +0200
Subject: [PATCH 348/359] Remove obsolete patch

---
 httpd.spec | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 15453d2..702f62f 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -98,8 +98,7 @@ Patch26: httpd-2.4.43-sslciphdefault.patch
 Patch27: httpd-2.4.64-sslprotdefault.patch
 Patch28: httpd-2.4.43-logjournal.patch
 Patch29: httpd-2.4.63-r1912477+.patch
-Patch30: httpd-2.4.64-selinux.patch
-Patch31: httpd-2.4.64-separate-systemd-fns.patch
+Patch30: httpd-2.4.64-separate-systemd-fns.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243

From 47d73dc1b5021b420fca68e7ac1cbb5e1b441987 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Thu, 17 Jul 2025 14:49:12 +0200
Subject: [PATCH 349/359] Fix RewriteRule with inverted pattern and RewriteCond
 regression

---
 httpd-2.4.64-r1927270.patch | 25 +++++++++++++++++++++++++
 httpd.spec                  |  7 ++++++-
 2 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.64-r1927270.patch

diff --git a/httpd-2.4.64-r1927270.patch b/httpd-2.4.64-r1927270.patch
new file mode 100644
index 0000000..21b2b9d
--- /dev/null
+++ b/httpd-2.4.64-r1927270.patch
@@ -0,0 +1,25 @@
+From 6e59b124221014bd1c23053e9bb63fb3362387d9 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Wed, 16 Jul 2025 17:33:21 +0000
+Subject: [PATCH] rc already is set by result of expression eval
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1927270 13f79535-47bb-0310-9956-ffa450edef68
+---
+ modules/mappers/mod_rewrite.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index a6c35a0be1f..a71110bc76e 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -4283,9 +4283,6 @@ static cond_return_type apply_rewrite_cond(rewritecond_entry *p, rewrite_ctx *ct
+                             p->pattern - p->pskip, err);
+                 rc = COND_RC_NOMATCH;
+             }
+-            else {
+-                rc = COND_RC_MATCH;
+-            }
+             /* update briRC backref info */
+             if (rc && !(p->flags & CONDFLAG_NOTMATCH)) {
+                 ctx->briRC.source = source;
+
diff --git a/httpd.spec b/httpd.spec
index 702f62f..1e33f96 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.64
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -103,6 +103,8 @@ Patch30: httpd-2.4.64-separate-systemd-fns.patch
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
+# https://bz.apache.org/bugzilla/show_bug.cgi?id=69745
+Patch61: httpd-2.4.64-r1927270.patch
 
 # Security fixes
 # Patch200: ...
@@ -845,6 +847,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jul 17 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-2
+- Fix RewriteRule with inverted pattern and RewriteCond regression
+
 * Fri Jul 11 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-1
 - new version 2.4.64
 

From b4edf40a550e2f2ebd249a7442d9bddc8313ba08 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 24 Jul 2025 17:06:59 +0000
Subject: [PATCH 350/359] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild

---
 httpd.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 1e33f96..2952a56 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.64
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -847,6 +847,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.64-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
 * Thu Jul 17 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-2
 - Fix RewriteRule with inverted pattern and RewriteCond regression
 

From 4797340d3d5d3ed81b86cc82bafb3a654df93a54 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Wed, 6 Aug 2025 14:26:22 -0400
Subject: [PATCH 351/359] genssl: Disable dhparams generation

SSCG 3.0.3+ has a --no-dhparams-file argument, which we should use
instead of creating an unused one in a private /tmp path.

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
 httpd-ssl-gencerts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts
index 5c271f7..5a3d8ed 100755
--- a/httpd-ssl-gencerts
+++ b/httpd-ssl-gencerts
@@ -33,7 +33,7 @@ sscg -q                                                             \
      --cert-file           /etc/pki/tls/certs/localhost.crt         \
      --cert-key-file       /etc/pki/tls/private/localhost.key       \
      --ca-file             /etc/pki/tls/certs/localhost.crt         \
-     --dhparams-file       /tmp/dhparams.pem                        \
+     --no-dhparams-file                                             \
      --lifetime            365                                      \
      --hostname            $FQDN                                    \
      --email               root@$FQDN

From 817134c70cec8e5f183de160cface9d46dc27893 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Mon, 8 Sep 2025 16:29:34 +0200
Subject: [PATCH 352/359] Add tmpfiles.d rules for /var directories (bootc
 compatibility)

---
 httpd.spec     | 5 ++++-
 httpd.tmpfiles | 7 +++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 2952a56..20d6771 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.64
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -847,6 +847,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Sep 08 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-4
+- Add tmpfiles.d rules for /var directories (bootc compatibility)
+
 * Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.64-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
 
diff --git a/httpd.tmpfiles b/httpd.tmpfiles
index f148886..a845ab5 100644
--- a/httpd.tmpfiles
+++ b/httpd.tmpfiles
@@ -1,2 +1,9 @@
 d /run/httpd   710 root apache
 d /run/httpd/htcacheclean   700 apache apache
+d /var/log/httpd 700 root root -
+d /var/www       755 root root -
+d /var/www/html  755 root root -
+d /var/www/cgi-bin 755 root root -
+d /var/lib/httpd 700 apache apache -
+d /var/cache/httpd 700 apache apache -
+d /var/cache/httpd/proxy 700 apache apache -

From 04d6a208061cc5627fb7af9db8b9c6a8383ffbb6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Sat, 18 Oct 2025 03:30:41 +0200
Subject: [PATCH 353/359] new version 2.4.65

mod_proxy_hcheck: reschedule health checks after child process restart
---
 .gitignore                      |  1 +
 httpd-2.4.64-r1927270.patch     | 25 -------------
 httpd-2.4.65-hcheck-stuck.patch | 66 +++++++++++++++++++++++++++++++++
 httpd.spec                      | 11 ++++--
 sources                         |  4 +-
 5 files changed, 76 insertions(+), 31 deletions(-)
 delete mode 100644 httpd-2.4.64-r1927270.patch
 create mode 100644 httpd-2.4.65-hcheck-stuck.patch

diff --git a/.gitignore b/.gitignore
index 0453dd4..f2fccfd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -54,3 +54,4 @@ x86_64
 /httpd-2.4.62.tar.bz2.asc
 /httpd-2.4.63.tar.bz2.asc
 /httpd-2.4.64.tar.bz2.asc
+/httpd-2.4.65.tar.bz2.asc
diff --git a/httpd-2.4.64-r1927270.patch b/httpd-2.4.64-r1927270.patch
deleted file mode 100644
index 21b2b9d..0000000
--- a/httpd-2.4.64-r1927270.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 6e59b124221014bd1c23053e9bb63fb3362387d9 Mon Sep 17 00:00:00 2001
-From: Eric Covener <covener@apache.org>
-Date: Wed, 16 Jul 2025 17:33:21 +0000
-Subject: [PATCH] rc already is set by result of expression eval
-
-git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1927270 13f79535-47bb-0310-9956-ffa450edef68
----
- modules/mappers/mod_rewrite.c | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
-index a6c35a0be1f..a71110bc76e 100644
---- a/modules/mappers/mod_rewrite.c
-+++ b/modules/mappers/mod_rewrite.c
-@@ -4283,9 +4283,6 @@ static cond_return_type apply_rewrite_cond(rewritecond_entry *p, rewrite_ctx *ct
-                             p->pattern - p->pskip, err);
-                 rc = COND_RC_NOMATCH;
-             }
--            else {
--                rc = COND_RC_MATCH;
--            }
-             /* update briRC backref info */
-             if (rc && !(p->flags & CONDFLAG_NOTMATCH)) {
-                 ctx->briRC.source = source;
-
diff --git a/httpd-2.4.65-hcheck-stuck.patch b/httpd-2.4.65-hcheck-stuck.patch
new file mode 100644
index 0000000..315b9c2
--- /dev/null
+++ b/httpd-2.4.65-hcheck-stuck.patch
@@ -0,0 +1,66 @@
+--- a/modules/proxy/mod_proxy_hcheck.c
++++ b/modules/proxy/mod_proxy_hcheck.c
+@@ -989,12 +989,30 @@ static apr_status_t hc_watchdog_callback(int state
+     sctx_t *ctx = (sctx_t *)data;
+     server_rec *s = ctx->s;
+     proxy_server_conf *conf;
++    proxy_worker **workers;
++    proxy_worker *worker;
++    apr_time_t now;
++    int i, n;
+ 
++    conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module);
++    balancer = (proxy_balancer *)conf->balancers->elts;
++
+     switch (state) {
+         case AP_WATCHDOG_STATE_STARTING:
+             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(03258)
+                          "%s watchdog started.",
+                          HCHECK_WATHCHDOG_NAME);
++            /* set last update time for all workers */
++            now = apr_time_now();
++            for (i = 0; i < conf->balancers->nelts; i++, balancer++) {
++                workers = (proxy_worker **)balancer->workers->elts;
++                for (n = 0; n < balancer->workers->nelts; n++, ++workers) {
++                    worker = *workers;
++                    if (worker->s->updated == 0) {
++                        worker->s->updated = now;
++                    }
++                }
++            }
+ #if HC_USE_THREADS
+             if (tpsize && hctp == NULL) {
+                 rv =  apr_thread_pool_create(&hctp, tpsize,
+@@ -1020,21 +1038,13 @@ static apr_status_t hc_watchdog_callback(int state
+ 
+         case AP_WATCHDOG_STATE_RUNNING:
+             /* loop thru all workers */
+-            if (s) {
+-                int i;
+-                conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module);
+-                balancer = (proxy_balancer *)conf->balancers->elts;
+-                ctx->s = s;
++            {
++                now = apr_time_now();
+                 for (i = 0; i < conf->balancers->nelts; i++, balancer++) {
+-                    int n;
+-                    apr_time_t now;
+-                    proxy_worker **workers;
+-                    proxy_worker *worker;
+                     /* Have any new balancers or workers been added dynamically? */
+                     ap_proxy_sync_balancer(balancer, s, conf);
+                     workers = (proxy_worker **)balancer->workers->elts;
+-                    now = apr_time_now();
+-                    for (n = 0; n < balancer->workers->nelts; n++) {
++                    for (n = 0; n < balancer->workers->nelts; n++, workers++) {
+                         worker = *workers;
+                         if (!PROXY_WORKER_IS(worker, PROXY_WORKER_STOPPED) &&
+                             (worker->s->method != NONE) &&
+@@ -1074,7 +1084,6 @@ static apr_status_t hc_watchdog_callback(int state
+                                 hc_check(NULL, baton);
+                             }
+                         }
+-                        workers++;
+                     }
+                 }
+             }
diff --git a/httpd.spec b/httpd.spec
index 20d6771..9d718a5 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -30,8 +30,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.64
-Release: 4%{?dist}
+Version: 2.4.65
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -103,8 +103,7 @@ Patch30: httpd-2.4.64-separate-systemd-fns.patch
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
-# https://bz.apache.org/bugzilla/show_bug.cgi?id=69745
-Patch61: httpd-2.4.64-r1927270.patch
+Patch61: httpd-2.4.65-hcheck-stuck.patch
 
 # Security fixes
 # Patch200: ...
@@ -847,6 +846,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Sat Oct 18 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-1
+- new version 2.4.65
+- mod_proxy_hcheck: reschedule health checks after child process restart
+
 * Mon Sep 08 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-4
 - Add tmpfiles.d rules for /var directories (bootc compatibility)
 
diff --git a/sources b/sources
index c5568c0..8d4165c 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.64.tar.bz2) = 299cb0d87a7e0e0a99d22bba7349b6b07c69222897410f9670af29896288d1f4e1da81d22ac9e1d8d6ea096e88044ab1dd34555b40a4b1b1cb3fd4b1d1897a7a
-SHA512 (httpd-2.4.64.tar.bz2.asc) = 1a28214c8468288477f706422ab3419e186ef37dc1eb55760a7e951605e08e295230b6d828948693a9d5ba247e352b205254c999763fa6845dab2f703152e1d8
+SHA512 (httpd-2.4.65.tar.bz2) = 202f8bfe2aafcfbcd7315191d466e9c10b9a8c0abafb7864510b6e1abe4cb660aaacc2456aa77d43e48ef7a49e591d0b54170d3daf67abc3e06c3da1c63fdffc
+SHA512 (httpd-2.4.65.tar.bz2.asc) = edcf02be97567fb28fef78f757e3355802575782ab452eaea79da70812b20ef4ba49a609e409a9664ec2546720b303deebbd563f3079ce4e77d67b91816210d1
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192

From 23f7eb497eefd8e1fba1494b946e39757ec46e51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Tue, 4 Nov 2025 12:08:54 +0100
Subject: [PATCH 354/359] mod_ssl: Add SSLVHostSNIPolicy directive to set the
 compatibility level

  required for VirtualHost matching.
---
 httpd-2.4.65-sslvhostsnipolicy.patch | 545 +++++++++++++++++++++++++++
 httpd.spec                           |   7 +-
 2 files changed, 551 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.65-sslvhostsnipolicy.patch

diff --git a/httpd-2.4.65-sslvhostsnipolicy.patch b/httpd-2.4.65-sslvhostsnipolicy.patch
new file mode 100644
index 0000000..401882a
--- /dev/null
+++ b/httpd-2.4.65-sslvhostsnipolicy.patch
@@ -0,0 +1,545 @@
+From 0e0995bef84a66c9dabe75d6e81376896cc819bd Mon Sep 17 00:00:00 2001
+From: Joe Orton <jorton@apache.org> 
+Date: Tue, 4 Nov 2025 12:05:05 +0100
+Subject: [PATCH] [PATCH] mod_ssl: Add SSLVHostSNIPolicy directive to set the 
+ compatibility level required for VirtualHost matching.
+
+For "secure" and "authonly" modes, a hash of the policy-relevant vhost
+configuration is created and stored in the post_config hooks, reducing
+the runtime code complexity (and overhead).
+
+* modules/ssl/ssl_engine_kernel.c (ssl_check_vhost_sni_policy): New
+  function, replacing ssl_server_compatible et al.
+
+* modules/ssl/ssl_engine_config.c (ssl_cmd_SSLVHostSNIPolicy): New
+  function.
+
+* modules/ssl/ssl_engine_init.c (md5_strarray_cmp, md5_strarray_hash,
+  hash_sni_policy_pk, hash_sni_policy_auth, create_sni_policy_hash):
+  New functions.
+  (ssl_init_Module): Invoke create_sni_policy_hash to store the hash
+  for every SSLSrvConfigRec.
+
+* modules/ssl/ssl_private.h (SSLModConfigRec): Add snivh_policy field.
+  (SSLSrvConfigRec): Add sni_policy_hash field.
+
+PR: 69743
+GitHub: closes #561
+---
+ docs/manual/mod/mod_ssl.html.en |  77 +++++++++++++++++++
+ modules/ssl/mod_ssl.c           |   2 +
+ modules/ssl/ssl_engine_config.c |  41 ++++++++++
+ modules/ssl/ssl_engine_init.c   | 106 ++++++++++++++++++++++++++
+ modules/ssl/ssl_engine_kernel.c | 131 ++++++--------------------------
+ modules/ssl/ssl_private.h       |  17 +++++
+ 6 files changed, 265 insertions(+), 109 deletions(-)
+
+diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en
+index e2a4a99..95f0667 100644
+--- a/docs/manual/mod/mod_ssl.html.en
++++ b/docs/manual/mod/mod_ssl.html.en
+@@ -125,6 +125,7 @@ to provide the cryptography engine.</p>
+ <li><img alt="" src="../images/down.gif" /> <a href="#sslusestapling">SSLUseStapling</a></li>
+ <li><img alt="" src="../images/down.gif" /> <a href="#sslverifyclient">SSLVerifyClient</a></li>
+ <li><img alt="" src="../images/down.gif" /> <a href="#sslverifydepth">SSLVerifyDepth</a></li>
++<li><img alt="" src="../images/down.gif" /> <a href="#sslvhostsnipolicy">SSLVHostSNIPolicy</a></li>
+ </ul>
+ <h3>Bugfix checklist</h3><ul class="seealso"><li><a href="https://www.apache.org/dist/httpd/CHANGES_2.4">httpd changelog</a></li><li><a href="https://bz.apache.org/bugzilla/buglist.cgi?bug_status=__open__&amp;list_id=144532&amp;product=Apache%20httpd-2&amp;query_format=specific&amp;order=changeddate%20DESC%2Cpriority%2Cbug_severity&amp;component=mod_ssl">Known issues</a></li><li><a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2&amp;component=mod_ssl">Report a bug</a></li></ul><h3>See also</h3>
+ <ul class="seealso">
+@@ -2863,6 +2864,82 @@ known to the server (i.e. the CA's certificate is under
+ <div class="example"><h3>Example</h3><pre class="prettyprint lang-config">SSLVerifyDepth 10</pre>
+ </div>
+ 
++</div>
++<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
++<div class="directive-section"><h2><a name="SSLVHostSNIPolicy" id="SSLVHostSNIPolicy">SSLVHostSNIPolicy</a> <a name="sslvhostsnipolicy" id="sslvhostsnipolicy">Directive</a> <a title="Permanent link" href="#sslvhostsnipolicy" class="permalink">&para;</a></h2>
++<table class="directive">
++<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Set compatibility policy for SNI client access to virtual hosts.</td></tr>
++<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLVHostSNIPolicy strict|secure|authonly|insecure</code></td></tr>
++<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLVHostSNIPolicy secure</code></td></tr>
++<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
++<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
++<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr>
++<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in httpd 2.4.65 and later</td></tr>
++</table><p>This directive sets the policy applied when checking whether the
++<code class="directive"><a href="../mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>
++identified by the <code>Host</code> request header in an HTTP request
++is compatible with the <code class="directive"><a href="../mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code> identified from the SNI
++extension sent during the initial TLS connection handshake. If an HTTP
++request is associated with a virtual host which has an incompatible
++SSL/TLS configuration under the policy used, an HTTP error response
++with status code 421 ("Misdirected Request") will be sent.</p>
++
++<p>The policy also applies to TLS connections where an SNI extension
++is not sent during the handshake, implicitly using the default or
++first virtual host definition. If the Host header in an HTTP request
++on such a connection identifies any other non-default virtual host,
++the compatibility policy is tested.</p>
++
++<p>The <code>strict</code> policy blocks all HTTP requests which are
++identified with a different virtual host to that identifed by SNI.
++The <code>insecure</code> policy allows all HTTP requests regardless
++of virtual host identified; such a configuration may be vulnerable to
++<a href="https://httpd.apache.org/security/vulnerabilities_24.html">CVE-2025-23048</a>.
++</p>
++
++<p>The (default) <code>secure</code>, and <code>authonly</code>
++policies compare specific aspects of the SSL configuration for the two
++virtual hosts, which are grouped into two categories:
++
++<ul>
++  <li><strong>server certificate/key, or protocol/cipher
++  restrictions</strong>: directives which determine the server
++  certificate or key (<code class="directive"><a href="#sslcertificatekeyfile">SSLCertificateKeyFile</a></code> etc), cipher or
++  protocol restrictions (<code class="directive"><a href="#sslciphersuite">SSLCipherSuite</a></code> and <code class="directive"><a href="#sslprotocol">SSLProtocol</a></code>)</li>
++
++  <li><strong>client vertification and authentication
++  settings</strong>: directives which affect TLS client certificate
++  verification or authentication, such as <code class="directive"><a href="#sslverifyclient">SSLVerifyClient</a></code>, <code class="directive"><a href="#sslverifymode">SSLVerifyMode</a></code>, <code class="directive"><a href="#sslcacertificatepath">SSLCACertificatePath</a></code>, <code class="directive"><a href="#sslsrpverifierfile">SSLSRPVerifierFile</a></code>; any use of <code class="directive"><a href="#sslopensslconfcmd">SSLOpenSSLConfCmd</a></code></li>
++</ul>
++
++This table illustrates whether an HTTP request will be blocked or
++allowed when the virtual host configurations differ as described,
++under each different policy setting:
++
++<table class="bordered"><tr class="header">
++  <th>Policy mode</th>
++  <th>Any VirtualHost mismatch</th>
++  <th>Server certificate/key, <br />or protocol/cipher restrictions</th>
++  <th>Client verification/<br />authentication settings</th>
++</tr>
++<tr>
++  <td><code>strict</code><td>blocked</td><td>blocked</td><td>blocked</td></td>
++</tr>
++<tr class="odd">
++  <td><code>secure</code><td>allowed</td><td>blocked</td><td>blocked</td></td>
++</tr>
++<tr>
++  <td><code>authonly</code><td>allowed</td><td>blocked</td><td>allowed</td></td>
++</tr>
++<tr class="odd">
++  <td><code>insecure</code><td>allowed</td><td>allowed</td><td>allowed</td></td>
++</tr>
++</table>
++</p>
++<div class="example"><h3>Example</h3><pre class="prettyprint lang-config">SSLVHostSNIPolicy authonly</pre>
++</div>
++
++
+ </div>
+ </div>
+ <div class="bottomlang">
+diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
+index fb66d18..c0fdafd 100644
+--- a/modules/ssl/mod_ssl.c
++++ b/modules/ssl/mod_ssl.c
+@@ -80,6 +80,8 @@ static const command_rec ssl_config_cmds[] = {
+     SSL_CMD_SRV(RandomSeed, TAKE23,
+                 "SSL Pseudo Random Number Generator (PRNG) seeding source "
+                 "('startup|connect builtin|file:/path|exec:/path [bytes]')")
++    SSL_CMD_SRV(VHostSNIPolicy, TAKE1,
++                "SSL VirtualHost SNI compatibility policy setting")
+ 
+     /*
+      * Per-server context configuration directives
+diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
+index c5dce7f..31a1942 100644
+--- a/modules/ssl/ssl_engine_config.c
++++ b/modules/ssl/ssl_engine_config.c
+@@ -82,6 +82,9 @@ SSLModConfigRec *ssl_config_global_create(server_rec *s)
+ #ifdef HAVE_FIPS
+     mc->fips = UNSET;
+ #endif
++#ifdef HAVE_TLSEXT
++    mc->snivh_policy           = MODSSL_SNIVH_SECURE;
++#endi
+ 
+     apr_pool_userdata_set(mc, SSL_MOD_CONFIG_KEY,
+                           apr_pool_cleanup_null,
+@@ -1918,6 +1921,44 @@ const char  *ssl_cmd_SSLStrictSNIVHostCheck(cmd_parms *cmd, void *dcfg, int flag
+ #endif
+ }
+ 
++const char *ssl_cmd_SSLVHostSNIPolicy(cmd_parms *cmd, void *dcfg, const char *arg)
++{
++#ifdef HAVE_TLSEXT
++    SSLModConfigRec *mc = myModConfig(cmd->server);
++    const char *err;
++
++    if ((err = ap_check_cmd_context(cmd, GLOBAL_ONLY))) {
++        return err;
++    }
++    if (!mc) {
++        return "SSLVHostSNIPolicy cannot be used inside SSLPolicyDefine";
++    }
++
++    if (strcEQ(arg, "secure")) {
++        mc->snivh_policy = MODSSL_SNIVH_SECURE;
++    }
++    else if (strcEQ(arg, "strict")) {
++        mc->snivh_policy = MODSSL_SNIVH_STRICT;
++    }
++    else if (strcEQ(arg, "insecure")) {
++        mc->snivh_policy = MODSSL_SNIVH_INSECURE;
++    }
++    else if (strcEQ(arg, "authonly")) {
++        mc->snivh_policy = MODSSL_SNIVH_AUTHONLY;
++    }
++    else {
++        return apr_psprintf(cmd->pool, "Invalid SSLVhostSNIPolicy "
++                            "argument '%s'", arg);
++    }
++
++    return NULL;
++#else
++    return "SSLVHostSNIPolicy cannot be used, OpenSSL is not built with "
++        "support for TLS extensions and SNI indication. Refer to the "
++        "documentation, and build a compatible version of OpenSSL."
++#endif
++}
++
+ #ifdef HAVE_OCSP_STAPLING
+ 
+ const char *ssl_cmd_SSLStaplingCache(cmd_parms *cmd,
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index 2fbd076..64a9f32 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -186,6 +186,110 @@ static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf,
+                  modver, AP_SERVER_BASEVERSION, incver);
+ }
+ 
++#ifdef HAVE_TLSEXT
++/* Helper functions to create the SNI vhost policy hash. The policy
++ * hash captures the configuration elements relevant to the mode
++ * selected at runtime by SSLVHostSNIPolicy. */
++
++#define md5_str_update(ctx_, pfx_, str_) do { apr_md5_update(ctx_, pfx_, strlen(pfx_)); apr_md5_update(ctx_, str_, strlen(str_)); } while (0)
++#define md5_ifstr_update(ctx_, pfx_, str_) do { apr_md5_update(ctx_, pfx_, strlen(pfx_)); if (str_) apr_md5_update(ctx_, str_, strlen(str_)); } while (0)
++#define md5_fmt_update(ctx_, fmt_, i_) do { char s_[128]; apr_snprintf(s_, sizeof s_, fmt_, i_); \
++        apr_md5_update(ctx_, s_, strlen(s_)); } while (0)
++
++static int md5_strarray_cmp(const void *p1, const void *p2)
++{
++    return strcmp(*(char **)p1, *(char **)p2);
++}
++
++/* Hashes an array of strings in sorted order. */
++static void md5_strarray_hash(apr_pool_t *ptemp, apr_md5_ctx_t *hash,
++                              const char *pfx, apr_array_header_t *s)
++{
++    char **elts = apr_pmemdup(ptemp, s->elts, s->nelts * sizeof *elts);
++    int i;
++
++    qsort(elts, s->nelts, sizeof(char *), md5_strarray_cmp);
++
++    apr_md5_update(hash, pfx, strlen(pfx));
++    for (i = 0; i < s->nelts; i++) {
++        md5_str_update(hash, "elm:", elts[i]);
++    }
++}
++
++static void hash_sni_policy_pk(apr_pool_t *ptemp, apr_md5_ctx_t *hash, modssl_ctx_t *ctx)
++{
++    md5_fmt_update(hash, "protocol:%d", ctx->protocol);
++
++    md5_ifstr_update(hash, "ciphers:", ctx->auth.cipher_suite);
++    md5_ifstr_update(hash, "tls13_ciphers:", ctx->auth.tls13_ciphers);
++
++    md5_strarray_hash(ptemp, hash, "cert_files:", ctx->pks->cert_files);
++    md5_strarray_hash(ptemp, hash, "key_files:", ctx->pks->key_files);
++}
++
++static void hash_sni_policy_auth(apr_md5_ctx_t *hash, modssl_ctx_t *ctx)
++{
++    modssl_pk_server_t *pks = ctx->pks;
++    modssl_auth_ctx_t *a = &ctx->auth;
++
++    md5_fmt_update(hash, "verify_depth:%d", a->verify_depth);
++    md5_fmt_update(hash, "verify_mode:%d", a->verify_mode);
++
++    md5_ifstr_update(hash, "ca_name_path:", pks->ca_name_path);
++    md5_ifstr_update(hash, "ca_name_file:", pks->ca_name_file);
++    md5_ifstr_update(hash, "ca_cert_path:", a->ca_cert_path);
++    md5_ifstr_update(hash, "ca_cert_file:", a->ca_cert_file);
++    md5_ifstr_update(hash, "crl_path:", ctx->crl_path);
++    md5_ifstr_update(hash, "crl_file:", ctx->crl_file);
++    md5_fmt_update(hash, "crl_check_mask:%d", ctx->crl_check_mask);
++    md5_fmt_update(hash, "ocsp_mask:%d", ctx->ocsp_mask);
++    md5_fmt_update(hash, "ocsp_force_default:%d", ctx->ocsp_force_default);
++    md5_ifstr_update(hash, "ocsp_responder:", ctx->ocsp_responder);
++
++#ifdef HAVE_SRP
++    md5_ifstr_update(hash, "srp_vfile:", ctx->srp_vfile);
++#endif
++
++#ifdef HAVE_SSL_CONF_CMD
++    {
++        apr_array_header_t *parms = ctx->ssl_ctx_param;
++        int n;
++
++        for (n = 0; n < parms->nelts; n++) {
++            ssl_ctx_param_t *p = &APR_ARRAY_IDX(parms, n, ssl_ctx_param_t);
++
++            md5_str_update(hash, "param:", p->name);
++            md5_str_update(hash, "value:", p->value);
++        }
++    }
++#endif
++}
++#endif
++
++static char *create_sni_policy_hash(apr_pool_t *p, apr_pool_t *ptemp,
++                                    modssl_snivhpolicy_t policy,
++                                    SSLSrvConfigRec *sc)
++{
++    char *rv = NULL;
++#ifdef HAVE_TLSEXT
++    if (policy != MODSSL_SNIVH_STRICT && policy != MODSSL_SNIVH_INSECURE) {
++        apr_md5_ctx_t hash;
++        unsigned char digest[APR_MD5_DIGESTSIZE];
++
++        /* Create the vhost policy hash for comparison later. */
++        apr_md5_init(&hash);
++        hash_sni_policy_auth(&hash, sc->server);
++        if (policy == MODSSL_SNIVH_SECURE)
++            hash_sni_policy_pk(ptemp, &hash, sc->server);
++        apr_md5_final(digest, &hash);
++
++        rv = apr_palloc(p, 2 * APR_MD5_DIGESTSIZE + 1);
++        ap_bin2hex(digest, APR_MD5_DIGESTSIZE, rv); /* sets final '\0' */
++    }
++#endif
++    return rv;
++}
++
+ /*  _________________________________________________________________
+ **
+ **  Let other answer special connection attempts. 
+@@ -439,6 +543,8 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
+                 return rv;
+             }
+         }
++
++        sc->sni_policy_hash = create_sni_policy_hash(p, ptemp, mc->snivh_policy, sc);
+     }
+ 
+     /*
+diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
+index 33aa1f7..a6af633 100644
+--- a/modules/ssl/ssl_engine_kernel.c
++++ b/modules/ssl/ssl_engine_kernel.c
+@@ -101,112 +101,28 @@ static int fill_reneg_buffer(request_rec *r, SSLDirConfigRec *dc)
+ }
+ 
+ #ifdef HAVE_TLSEXT
+-static int ap_array_same_str_set(apr_array_header_t *s1, apr_array_header_t *s2)
++/* Check whether a transition from vhost sc1 to sc2 from SNI to Host:
++ * vhost selection is permitted according to the SSLVHostSNIPolicy
++ * setting.  Returns 1 if the policy treats the vhosts as compatible,
++ * else 0. */
++static int ssl_check_vhost_sni_policy(SSLSrvConfigRec *sc1,
++                                      SSLSrvConfigRec *sc2)
+ {
+-    int i;
+-    const char *c;
+-    
+-    if (s1 == s2) {
++    modssl_snivhpolicy_t policy = sc1->mc->snivh_policy;
++
++    /* Policy: insecure => allow everything. */
++    if (policy == MODSSL_SNIVH_INSECURE)
+         return 1;
+-    }
+-    else if (!s1 || !s2 || (s1->nelts != s2->nelts)) {
+-        return 0;
+-    }
+     
+-    for (i = 0; i < s1->nelts; i++) {
+-        c = APR_ARRAY_IDX(s1, i, const char *);
+-        if (!c || !ap_array_str_contains(s2, c)) {
+-            return 0;
+-        }
+-    }
+-    return 1;
+-}
+-
+-static int ssl_pk_server_compatible(modssl_pk_server_t *pks1, 
+-                                    modssl_pk_server_t *pks2) 
+-{
+-    if (!pks1 || !pks2) {
+-        return 0;
+-    }
+-    /* both have the same certificates? */
+-    if ((pks1->ca_name_path != pks2->ca_name_path)
+-        && (!pks1->ca_name_path || !pks2->ca_name_path 
+-            || strcmp(pks1->ca_name_path, pks2->ca_name_path))) {
+-        return 0;
+-    }
+-    if ((pks1->ca_name_file != pks2->ca_name_file)
+-        && (!pks1->ca_name_file || !pks2->ca_name_file 
+-            || strcmp(pks1->ca_name_file, pks2->ca_name_file))) {
+-        return 0;
+-    }
+-    if (!ap_array_same_str_set(pks1->cert_files, pks2->cert_files)
+-        || !ap_array_same_str_set(pks1->key_files, pks2->key_files)) {
+-        return 0;
+-    }
+-    return 1;
+-}
+-
+-static int ssl_auth_compatible(modssl_auth_ctx_t *a1, 
+-                               modssl_auth_ctx_t *a2) 
+-{
+-    if (!a1 || !a2) {
+-        return 0;
+-    }
+-    /* both have the same verification */
+-    if ((a1->verify_depth != a2->verify_depth)
+-        || (a1->verify_mode != a2->verify_mode)) {
+-        return 0;
+-    }
+-    /* both have the same ca path/file */
+-    if ((a1->ca_cert_path != a2->ca_cert_path)
+-        && (!a1->ca_cert_path || !a2->ca_cert_path 
+-            || strcmp(a1->ca_cert_path, a2->ca_cert_path))) {
+-        return 0;
+-    }
+-    if ((a1->ca_cert_file != a2->ca_cert_file)
+-        && (!a1->ca_cert_file || !a2->ca_cert_file 
+-            || strcmp(a1->ca_cert_file, a2->ca_cert_file))) {
+-        return 0;
+-    }
+-    /* both have the same ca cipher suite string */
+-    if ((a1->cipher_suite != a2->cipher_suite)
+-        && (!a1->cipher_suite || !a2->cipher_suite 
+-            || strcmp(a1->cipher_suite, a2->cipher_suite))) {
+-        return 0;
+-    }
+-    /* both have the same ca cipher suite string */
+-    if ((a1->tls13_ciphers != a2->tls13_ciphers)
+-        && (!a1->tls13_ciphers || !a2->tls13_ciphers 
+-            || strcmp(a1->tls13_ciphers, a2->tls13_ciphers))) {
+-        return 0;
+-    }
+-    return 1;
+-}
+-
+-static int ssl_ctx_compatible(modssl_ctx_t *ctx1, 
+-                              modssl_ctx_t *ctx2) 
+-{
+-    if (!ctx1 || !ctx2 
+-        || (ctx1->protocol != ctx2->protocol)
+-        || !ssl_auth_compatible(&ctx1->auth, &ctx2->auth)
+-        || !ssl_pk_server_compatible(ctx1->pks, ctx2->pks)) {
++    /* Policy: strict => fail for any vhost transition. */
++    if (policy == MODSSL_SNIVH_STRICT && sc1 != sc2)
+         return 0;
+-    }
+-    return 1;
+-}
+ 
+-static int ssl_server_compatible(server_rec *s1, server_rec *s2)
+-{
+-    SSLSrvConfigRec *sc1 = s1? mySrvConfig(s1) : NULL;
+-    SSLSrvConfigRec *sc2 = s2? mySrvConfig(s2) : NULL;
++    /* For authonly/secure policy, compare the hash. */
++    AP_DEBUG_ASSERT(sc1->sni_policy_hash);
++    AP_DEBUG_ASSERT(sc2->sni_policy_hash);
+ 
+-    /* both use the same TLS protocol? */
+-    if (!sc1 || !sc2 
+-        || !ssl_ctx_compatible(sc1->server, sc2->server)) {
+-        return 0;
+-    }
+-    
+-    return 1;
++    return strcmp(sc1->sni_policy_hash, sc2->sni_policy_hash) == 0;
+ }
+ #endif
+ 
+@@ -275,6 +191,8 @@ int ssl_hook_ReadReq(request_rec *r)
+         server_rec *handshakeserver = sslconn->server;
+         SSLSrvConfigRec *hssc = mySrvConfig(handshakeserver);
+ 
++        AP_DEBUG_ASSERT(hssc);
++
+         if ((servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name))) {
+             /*
+              * The SNI extension supplied a hostname. So don't accept requests
+@@ -315,19 +233,14 @@ int ssl_hook_ReadReq(request_rec *r)
+                            "which is required to access this server.<br />\n");
+             return HTTP_FORBIDDEN;
+         }
+-        if (r->server != handshakeserver
+-            && !ssl_server_compatible(sslconn->server, r->server)) {
+-            /*
+-             * The request does not select the virtual host that was
+-             * selected for handshaking and its SSL parameters are different
+-             */
+-
++        /* Enforce SSL SNI vhost compatibility policy. */
++        if (!ssl_check_vhost_sni_policy(sc, hssc)) {
+             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02032)
+                          "Hostname %s %s and hostname %s provided"
+-                         " via HTTP have no compatible SSL setup",
++                         " via HTTP have no compatible SSL setup for policy '%s'",
+                          servername ? servername : handshakeserver->server_hostname,
+                          servername ? "provided via SNI" : "(default host as no SNI was provided)",
+-                         r->hostname);
++                          r->hostname, MODSSL_SNIVH_NAME(sc->mc->snivh_policy));
+             return HTTP_MISDIRECTED_REQUEST;
+         }
+     }
+diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h
+index 2b18189..dbef182 100644
+--- a/modules/ssl/ssl_private.h
++++ b/modules/ssl/ssl_private.h
+@@ -556,6 +556,19 @@ typedef struct {
+     int          nBytes;
+ } ssl_randseed_t;
+ 
++/* SNI vhost compatibility policy. */
++typedef enum {
++    MODSSL_SNIVH_STRICT   = 0,
++    MODSSL_SNIVH_SECURE   = 1,
++    MODSSL_SNIVH_AUTHONLY = 2,
++    MODSSL_SNIVH_INSECURE = 3
++} modssl_snivhpolicy_t;
++
++/* Maps modssl_snivhpolicy_t back into a config option string. */
++#define MODSSL_SNIVH_NAME(p_) ((p_) == MODSSL_SNIVH_STRICT ? "strict" : \
++                               ((p_) == MODSSL_SNIVH_SECURE ? "secure" : \
++                                ((p_) == MODSSL_SNIVH_AUTHONLY ? "authonly" : "insecure" )))
++
+ /**
+  * Define the structure of an ASN.1 anything
+  */
+@@ -689,6 +702,8 @@ typedef struct {
+ #ifdef HAVE_FIPS
+     BOOL             fips;
+ #endif
++
++    modssl_snivhpolicy_t snivh_policy;
+ } SSLModConfigRec;
+ 
+ /** Structure representing configured filenames for certs and keys for
+@@ -843,6 +858,7 @@ struct SSLSrvConfigRec {
+     modssl_ctx_t    *server;
+ #ifdef HAVE_TLSEXT
+     ssl_enabled_t    strict_sni_vhost_check;
++    const char      *sni_policy_hash;
+ #endif
+ #ifndef OPENSSL_NO_COMP
+     BOOL             compression;
+@@ -918,6 +934,7 @@ const char  *ssl_cmd_SSLRequire(cmd_parms *, void *, const char *);
+ const char  *ssl_cmd_SSLUserName(cmd_parms *, void *, const char *);
+ const char  *ssl_cmd_SSLRenegBufferSize(cmd_parms *cmd, void *dcfg, const char *arg);
+ const char  *ssl_cmd_SSLStrictSNIVHostCheck(cmd_parms *cmd, void *dcfg, int flag);
++const char  *ssl_cmd_SSLVHostSNIPolicy(cmd_parms *cmd, void *dcfg, const char *arg);
+ const char *ssl_cmd_SSLInsecureRenegotiation(cmd_parms *cmd, void *dcfg, int flag);
+ 
+ const char  *ssl_cmd_SSLProxyEngine(cmd_parms *cmd, void *dcfg, int flag);
+-- 
+2.44.0
+
diff --git a/httpd.spec b/httpd.spec
index 9d718a5..6d06795 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.65
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -99,6 +99,7 @@ Patch27: httpd-2.4.64-sslprotdefault.patch
 Patch28: httpd-2.4.43-logjournal.patch
 Patch29: httpd-2.4.63-r1912477+.patch
 Patch30: httpd-2.4.64-separate-systemd-fns.patch
+Patch31: httpd-2.4.65-sslvhostsnipolicy.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -846,6 +847,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Nov 04 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-2
+- mod_ssl: Add SSLVHostSNIPolicy directive to set the compatibility level
+  required for VirtualHost matching.
+
 * Sat Oct 18 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-1
 - new version 2.4.65
 - mod_proxy_hcheck: reschedule health checks after child process restart

From 943e0af2d4905f60d87dc4bb49e886b79fed3909 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Tue, 4 Nov 2025 13:14:49 +0100
Subject: [PATCH 355/359] Fix typo in patch + include util_md5.h

mod_ssl: Add SSLVHostSNIPolicy directive to set the compatibility level
required for VirtualHost matching.
---
 httpd-2.4.65-sslvhostsnipolicy.patch | 30 ++++++++++++++++++----------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/httpd-2.4.65-sslvhostsnipolicy.patch b/httpd-2.4.65-sslvhostsnipolicy.patch
index 401882a..6767cbc 100644
--- a/httpd-2.4.65-sslvhostsnipolicy.patch
+++ b/httpd-2.4.65-sslvhostsnipolicy.patch
@@ -1,7 +1,7 @@
-From 0e0995bef84a66c9dabe75d6e81376896cc819bd Mon Sep 17 00:00:00 2001
-From: Joe Orton <jorton@apache.org> 
-Date: Tue, 4 Nov 2025 12:05:05 +0100
-Subject: [PATCH] [PATCH] mod_ssl: Add SSLVHostSNIPolicy directive to set the 
+From ba168444686368377c6e69373e20e6dae8ebb702 Mon Sep 17 00:00:00 2001
+From: Joe Orton <jorton@apache.org>
+Date: Tue, 4 Nov 2025 12:49:36 +0100
+Subject: [PATCH] [PATCH] mod_ssl: Add SSLVHostSNIPolicy directive to set the
  compatibility level required for VirtualHost matching.
 
 For "secure" and "authonly" modes, a hash of the policy-relevant vhost
@@ -29,10 +29,10 @@ GitHub: closes #561
  docs/manual/mod/mod_ssl.html.en |  77 +++++++++++++++++++
  modules/ssl/mod_ssl.c           |   2 +
  modules/ssl/ssl_engine_config.c |  41 ++++++++++
- modules/ssl/ssl_engine_init.c   | 106 ++++++++++++++++++++++++++
+ modules/ssl/ssl_engine_init.c   | 107 ++++++++++++++++++++++++++
  modules/ssl/ssl_engine_kernel.c | 131 ++++++--------------------------
  modules/ssl/ssl_private.h       |  17 +++++
- 6 files changed, 265 insertions(+), 109 deletions(-)
+ 6 files changed, 266 insertions(+), 109 deletions(-)
 
 diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en
 index e2a4a99..95f0667 100644
@@ -143,7 +143,7 @@ index fb66d18..c0fdafd 100644
      /*
       * Per-server context configuration directives
 diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
-index c5dce7f..31a1942 100644
+index c5dce7f..f856b18 100644
 --- a/modules/ssl/ssl_engine_config.c
 +++ b/modules/ssl/ssl_engine_config.c
 @@ -82,6 +82,9 @@ SSLModConfigRec *ssl_config_global_create(server_rec *s)
@@ -152,7 +152,7 @@ index c5dce7f..31a1942 100644
  #endif
 +#ifdef HAVE_TLSEXT
 +    mc->snivh_policy           = MODSSL_SNIVH_SECURE;
-+#endi
++#endif
  
      apr_pool_userdata_set(mc, SSL_MOD_CONFIG_KEY,
                            apr_pool_cleanup_null,
@@ -202,10 +202,18 @@ index c5dce7f..31a1942 100644
  
  const char *ssl_cmd_SSLStaplingCache(cmd_parms *cmd,
 diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
-index 2fbd076..64a9f32 100644
+index 2fbd076..1bf6ac4 100644
 --- a/modules/ssl/ssl_engine_init.c
 +++ b/modules/ssl/ssl_engine_init.c
-@@ -186,6 +186,110 @@ static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf,
+@@ -30,6 +30,7 @@
+ 
+ #include "mpm_common.h"
+ #include "mod_md.h"
++#include "util_md5.h"
+ 
+ static apr_status_t ssl_init_ca_cert_path(server_rec *, apr_pool_t *, const char *,
+                                           STACK_OF(X509_NAME) *, STACK_OF(X509_INFO) *);
+@@ -186,6 +187,110 @@ static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf,
                   modver, AP_SERVER_BASEVERSION, incver);
  }
  
@@ -316,7 +324,7 @@ index 2fbd076..64a9f32 100644
  /*  _________________________________________________________________
  **
  **  Let other answer special connection attempts. 
-@@ -439,6 +543,8 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
+@@ -439,6 +544,8 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
                  return rv;
              }
          }

From fb46d5df49d5e1b081507d639f028fd2fda0d267 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 12 Nov 2025 11:16:19 +0100
Subject: [PATCH 356/359] mod_ssl: SSLVHostSNIPolicy - Fix handling of STRICT
 mode

---
 httpd-2.4.65-sslvhostsnipolicy.patch | 41 ++++++++++++++--------------
 httpd.spec                           |  5 +++-
 2 files changed, 25 insertions(+), 21 deletions(-)

diff --git a/httpd-2.4.65-sslvhostsnipolicy.patch b/httpd-2.4.65-sslvhostsnipolicy.patch
index 6767cbc..0831efc 100644
--- a/httpd-2.4.65-sslvhostsnipolicy.patch
+++ b/httpd-2.4.65-sslvhostsnipolicy.patch
@@ -1,7 +1,7 @@
-From ba168444686368377c6e69373e20e6dae8ebb702 Mon Sep 17 00:00:00 2001
+From 0263d1e290bc029c5c059fdaa4f21ca9885f9c84 Mon Sep 17 00:00:00 2001
 From: Joe Orton <jorton@apache.org>
-Date: Tue, 4 Nov 2025 12:49:36 +0100
-Subject: [PATCH] [PATCH] mod_ssl: Add SSLVHostSNIPolicy directive to set the
+Date: Wed, 12 Nov 2025 11:11:41 +0100
+Subject: [PATCH] mod_ssl: Add SSLVHostSNIPolicy directive to set the
  compatibility level required for VirtualHost matching.
 
 For "secure" and "authonly" modes, a hash of the policy-relevant vhost
@@ -26,13 +26,13 @@ the runtime code complexity (and overhead).
 PR: 69743
 GitHub: closes #561
 ---
- docs/manual/mod/mod_ssl.html.en |  77 +++++++++++++++++++
+ docs/manual/mod/mod_ssl.html.en |  77 ++++++++++++++++++
  modules/ssl/mod_ssl.c           |   2 +
  modules/ssl/ssl_engine_config.c |  41 ++++++++++
- modules/ssl/ssl_engine_init.c   | 107 ++++++++++++++++++++++++++
- modules/ssl/ssl_engine_kernel.c | 131 ++++++--------------------------
- modules/ssl/ssl_private.h       |  17 +++++
- 6 files changed, 266 insertions(+), 109 deletions(-)
+ modules/ssl/ssl_engine_init.c   | 107 +++++++++++++++++++++++++
+ modules/ssl/ssl_engine_kernel.c | 133 ++++++--------------------------
+ modules/ssl/ssl_private.h       |  17 ++++
+ 6 files changed, 267 insertions(+), 110 deletions(-)
 
 diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en
 index e2a4a99..95f0667 100644
@@ -60,7 +60,7 @@ index e2a4a99..95f0667 100644
 +<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
 +<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 +<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr>
-+<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in httpd 2.4.65 and later</td></tr>
++<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in httpd 2.4.65 in Fedora Linux</td></tr>
 +</table><p>This directive sets the policy applied when checking whether the
 +<code class="directive"><a href="../mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>
 +identified by the <code>Host</code> request header in an HTTP request
@@ -334,7 +334,7 @@ index 2fbd076..1bf6ac4 100644
  
      /*
 diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
-index 33aa1f7..a6af633 100644
+index 33aa1f7..83ae90e 100644
 --- a/modules/ssl/ssl_engine_kernel.c
 +++ b/modules/ssl/ssl_engine_kernel.c
 @@ -101,112 +101,28 @@ static int fill_reneg_buffer(request_rec *r, SSLDirConfigRec *dc)
@@ -371,7 +371,10 @@ index 33aa1f7..a6af633 100644
 -    }
 -    return 1;
 -}
--
++    /* Policy: strict => fail for any vhost transition. */
++    if (policy == MODSSL_SNIVH_STRICT)
++        return sc1 == sc2;
+ 
 -static int ssl_pk_server_compatible(modssl_pk_server_t *pks1, 
 -                                    modssl_pk_server_t *pks2) 
 -{
@@ -395,7 +398,10 @@ index 33aa1f7..a6af633 100644
 -    }
 -    return 1;
 -}
--
++    /* For authonly/secure policy, compare the hash. */
++    AP_DEBUG_ASSERT(sc1->sni_policy_hash);
++    AP_DEBUG_ASSERT(sc2->sni_policy_hash);
+ 
 -static int ssl_auth_compatible(modssl_auth_ctx_t *a1, 
 -                               modssl_auth_ctx_t *a2) 
 -{
@@ -440,21 +446,16 @@ index 33aa1f7..a6af633 100644
 -        || (ctx1->protocol != ctx2->protocol)
 -        || !ssl_auth_compatible(&ctx1->auth, &ctx2->auth)
 -        || !ssl_pk_server_compatible(ctx1->pks, ctx2->pks)) {
-+    /* Policy: strict => fail for any vhost transition. */
-+    if (policy == MODSSL_SNIVH_STRICT && sc1 != sc2)
-         return 0;
+-        return 0;
 -    }
 -    return 1;
 -}
- 
+-
 -static int ssl_server_compatible(server_rec *s1, server_rec *s2)
 -{
 -    SSLSrvConfigRec *sc1 = s1? mySrvConfig(s1) : NULL;
 -    SSLSrvConfigRec *sc2 = s2? mySrvConfig(s2) : NULL;
-+    /* For authonly/secure policy, compare the hash. */
-+    AP_DEBUG_ASSERT(sc1->sni_policy_hash);
-+    AP_DEBUG_ASSERT(sc2->sni_policy_hash);
- 
+-
 -    /* both use the same TLS protocol? */
 -    if (!sc1 || !sc2 
 -        || !ssl_ctx_compatible(sc1->server, sc2->server)) {
diff --git a/httpd.spec b/httpd.spec
index 6d06795..9d762d8 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.65
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -847,6 +847,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Nov 12 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-3
+- mod_ssl: SSLVHostSNIPolicy - Fix handling of STRICT mode
+
 * Tue Nov 04 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-2
 - mod_ssl: Add SSLVHostSNIPolicy directive to set the compatibility level
   required for VirtualHost matching.

From f3e631b085b7583155b87f52d5f6b3096d3d4ffd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Thu, 27 Nov 2025 16:40:28 +0100
Subject: [PATCH 357/359] Improve default httpd LogFormats for better support
 diagnostics

---
 httpd.conf | 4 ++--
 httpd.spec | 5 ++++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/httpd.conf b/httpd.conf
index e49ab6a..2be277d 100644
--- a/httpd.conf
+++ b/httpd.conf
@@ -198,8 +198,8 @@ LogLevel warn
     # The following directives define some format nicknames for use with
     # a CustomLog directive (see below).
     #
-    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
-    LogFormat "%h %l %u %t \"%r\" %>s %b" common
+    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" PID: %P %{tid}P %T" combined
+    LogFormat "%h %l %u %t \"%r\" %>s %b PID: %P %{tid}P %T" common
 
     <IfModule logio_module>
       # You need to enable mod_logio.c to use %I and %O
diff --git a/httpd.spec b/httpd.spec
index 9d762d8..151bac6 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.65
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -847,6 +847,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Nov 27 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-4
+- Improve default httpd LogFormats for better support diagnostics
+
 * Wed Nov 12 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-3
 - mod_ssl: SSLVHostSNIPolicy - Fix handling of STRICT mode
 

From 0914a96ecc2516806333cb0e8b11cce87eb07110 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Mon, 1 Dec 2025 12:58:07 +0100
Subject: [PATCH 358/359] Improve default httpd LogFormats for better support
 diagnostics

---
 httpd.conf | 12 +++++++-----
 httpd.spec |  4 ++--
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/httpd.conf b/httpd.conf
index 2be277d..ad5c7ee 100644
--- a/httpd.conf
+++ b/httpd.conf
@@ -198,8 +198,9 @@ LogLevel warn
     # The following directives define some format nicknames for use with
     # a CustomLog directive (see below).
     #
-    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" PID: %P %{tid}P %T" combined
-    LogFormat "%h %l %u %t \"%r\" %>s %b PID: %P %{tid}P %T" common
+    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" PID: %P %{tid}P %T" combined_ext
+    LogFormat "%h %l %u %t \"%r\" %>s %b" common
 
     <IfModule logio_module>
       # You need to enable mod_logio.c to use %I and %O
@@ -216,10 +217,11 @@ LogLevel warn
     #CustomLog "logs/access_log" common
 
     #
-    # If you prefer a logfile with access, agent, and referer information
-    # (Combined Logfile Format) you can use the following directive.
+    # If you prefer a logfile with access, agent, referer, and process/thread
+    # information (an extended Combined Logfile Format), you can use the
+    # following directive.
     #
-    CustomLog "logs/access_log" combined
+    CustomLog "logs/access_log" combined_ext
 </IfModule>
 
 <IfModule alias_module>
diff --git a/httpd.spec b/httpd.spec
index 151bac6..91c8d2f 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -31,7 +31,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.65
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -847,7 +847,7 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Thu Nov 27 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-4
+* Thu Nov 27 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-5
 - Improve default httpd LogFormats for better support diagnostics
 
 * Wed Nov 12 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-3

From 0c203aeed682395c663f7afef328f754fa629b6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Tue, 9 Dec 2025 12:48:50 +0100
Subject: [PATCH 359/359] new version 2.4.66

---
 .gitignore                           |   1 +
 httpd-2.4.65-sslvhostsnipolicy.patch | 554 ---------------------------
 httpd.spec                           |   8 +-
 sources                              |   4 +-
 4 files changed, 8 insertions(+), 559 deletions(-)
 delete mode 100644 httpd-2.4.65-sslvhostsnipolicy.patch

diff --git a/.gitignore b/.gitignore
index f2fccfd..8df7f18 100644
--- a/.gitignore
+++ b/.gitignore
@@ -55,3 +55,4 @@ x86_64
 /httpd-2.4.63.tar.bz2.asc
 /httpd-2.4.64.tar.bz2.asc
 /httpd-2.4.65.tar.bz2.asc
+/httpd-2.4.66.tar.bz2.asc
diff --git a/httpd-2.4.65-sslvhostsnipolicy.patch b/httpd-2.4.65-sslvhostsnipolicy.patch
deleted file mode 100644
index 0831efc..0000000
--- a/httpd-2.4.65-sslvhostsnipolicy.patch
+++ /dev/null
@@ -1,554 +0,0 @@
-From 0263d1e290bc029c5c059fdaa4f21ca9885f9c84 Mon Sep 17 00:00:00 2001
-From: Joe Orton <jorton@apache.org>
-Date: Wed, 12 Nov 2025 11:11:41 +0100
-Subject: [PATCH] mod_ssl: Add SSLVHostSNIPolicy directive to set the
- compatibility level required for VirtualHost matching.
-
-For "secure" and "authonly" modes, a hash of the policy-relevant vhost
-configuration is created and stored in the post_config hooks, reducing
-the runtime code complexity (and overhead).
-
-* modules/ssl/ssl_engine_kernel.c (ssl_check_vhost_sni_policy): New
-  function, replacing ssl_server_compatible et al.
-
-* modules/ssl/ssl_engine_config.c (ssl_cmd_SSLVHostSNIPolicy): New
-  function.
-
-* modules/ssl/ssl_engine_init.c (md5_strarray_cmp, md5_strarray_hash,
-  hash_sni_policy_pk, hash_sni_policy_auth, create_sni_policy_hash):
-  New functions.
-  (ssl_init_Module): Invoke create_sni_policy_hash to store the hash
-  for every SSLSrvConfigRec.
-
-* modules/ssl/ssl_private.h (SSLModConfigRec): Add snivh_policy field.
-  (SSLSrvConfigRec): Add sni_policy_hash field.
-
-PR: 69743
-GitHub: closes #561
----
- docs/manual/mod/mod_ssl.html.en |  77 ++++++++++++++++++
- modules/ssl/mod_ssl.c           |   2 +
- modules/ssl/ssl_engine_config.c |  41 ++++++++++
- modules/ssl/ssl_engine_init.c   | 107 +++++++++++++++++++++++++
- modules/ssl/ssl_engine_kernel.c | 133 ++++++--------------------------
- modules/ssl/ssl_private.h       |  17 ++++
- 6 files changed, 267 insertions(+), 110 deletions(-)
-
-diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en
-index e2a4a99..95f0667 100644
---- a/docs/manual/mod/mod_ssl.html.en
-+++ b/docs/manual/mod/mod_ssl.html.en
-@@ -125,6 +125,7 @@ to provide the cryptography engine.</p>
- <li><img alt="" src="../images/down.gif" /> <a href="#sslusestapling">SSLUseStapling</a></li>
- <li><img alt="" src="../images/down.gif" /> <a href="#sslverifyclient">SSLVerifyClient</a></li>
- <li><img alt="" src="../images/down.gif" /> <a href="#sslverifydepth">SSLVerifyDepth</a></li>
-+<li><img alt="" src="../images/down.gif" /> <a href="#sslvhostsnipolicy">SSLVHostSNIPolicy</a></li>
- </ul>
- <h3>Bugfix checklist</h3><ul class="seealso"><li><a href="https://www.apache.org/dist/httpd/CHANGES_2.4">httpd changelog</a></li><li><a href="https://bz.apache.org/bugzilla/buglist.cgi?bug_status=__open__&amp;list_id=144532&amp;product=Apache%20httpd-2&amp;query_format=specific&amp;order=changeddate%20DESC%2Cpriority%2Cbug_severity&amp;component=mod_ssl">Known issues</a></li><li><a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2&amp;component=mod_ssl">Report a bug</a></li></ul><h3>See also</h3>
- <ul class="seealso">
-@@ -2863,6 +2864,82 @@ known to the server (i.e. the CA's certificate is under
- <div class="example"><h3>Example</h3><pre class="prettyprint lang-config">SSLVerifyDepth 10</pre>
- </div>
- 
-+</div>
-+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
-+<div class="directive-section"><h2><a name="SSLVHostSNIPolicy" id="SSLVHostSNIPolicy">SSLVHostSNIPolicy</a> <a name="sslvhostsnipolicy" id="sslvhostsnipolicy">Directive</a> <a title="Permanent link" href="#sslvhostsnipolicy" class="permalink">&para;</a></h2>
-+<table class="directive">
-+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Set compatibility policy for SNI client access to virtual hosts.</td></tr>
-+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLVHostSNIPolicy strict|secure|authonly|insecure</code></td></tr>
-+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLVHostSNIPolicy secure</code></td></tr>
-+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
-+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
-+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr>
-+<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in httpd 2.4.65 in Fedora Linux</td></tr>
-+</table><p>This directive sets the policy applied when checking whether the
-+<code class="directive"><a href="../mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>
-+identified by the <code>Host</code> request header in an HTTP request
-+is compatible with the <code class="directive"><a href="../mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code> identified from the SNI
-+extension sent during the initial TLS connection handshake. If an HTTP
-+request is associated with a virtual host which has an incompatible
-+SSL/TLS configuration under the policy used, an HTTP error response
-+with status code 421 ("Misdirected Request") will be sent.</p>
-+
-+<p>The policy also applies to TLS connections where an SNI extension
-+is not sent during the handshake, implicitly using the default or
-+first virtual host definition. If the Host header in an HTTP request
-+on such a connection identifies any other non-default virtual host,
-+the compatibility policy is tested.</p>
-+
-+<p>The <code>strict</code> policy blocks all HTTP requests which are
-+identified with a different virtual host to that identifed by SNI.
-+The <code>insecure</code> policy allows all HTTP requests regardless
-+of virtual host identified; such a configuration may be vulnerable to
-+<a href="https://httpd.apache.org/security/vulnerabilities_24.html">CVE-2025-23048</a>.
-+</p>
-+
-+<p>The (default) <code>secure</code>, and <code>authonly</code>
-+policies compare specific aspects of the SSL configuration for the two
-+virtual hosts, which are grouped into two categories:
-+
-+<ul>
-+  <li><strong>server certificate/key, or protocol/cipher
-+  restrictions</strong>: directives which determine the server
-+  certificate or key (<code class="directive"><a href="#sslcertificatekeyfile">SSLCertificateKeyFile</a></code> etc), cipher or
-+  protocol restrictions (<code class="directive"><a href="#sslciphersuite">SSLCipherSuite</a></code> and <code class="directive"><a href="#sslprotocol">SSLProtocol</a></code>)</li>
-+
-+  <li><strong>client vertification and authentication
-+  settings</strong>: directives which affect TLS client certificate
-+  verification or authentication, such as <code class="directive"><a href="#sslverifyclient">SSLVerifyClient</a></code>, <code class="directive"><a href="#sslverifymode">SSLVerifyMode</a></code>, <code class="directive"><a href="#sslcacertificatepath">SSLCACertificatePath</a></code>, <code class="directive"><a href="#sslsrpverifierfile">SSLSRPVerifierFile</a></code>; any use of <code class="directive"><a href="#sslopensslconfcmd">SSLOpenSSLConfCmd</a></code></li>
-+</ul>
-+
-+This table illustrates whether an HTTP request will be blocked or
-+allowed when the virtual host configurations differ as described,
-+under each different policy setting:
-+
-+<table class="bordered"><tr class="header">
-+  <th>Policy mode</th>
-+  <th>Any VirtualHost mismatch</th>
-+  <th>Server certificate/key, <br />or protocol/cipher restrictions</th>
-+  <th>Client verification/<br />authentication settings</th>
-+</tr>
-+<tr>
-+  <td><code>strict</code><td>blocked</td><td>blocked</td><td>blocked</td></td>
-+</tr>
-+<tr class="odd">
-+  <td><code>secure</code><td>allowed</td><td>blocked</td><td>blocked</td></td>
-+</tr>
-+<tr>
-+  <td><code>authonly</code><td>allowed</td><td>blocked</td><td>allowed</td></td>
-+</tr>
-+<tr class="odd">
-+  <td><code>insecure</code><td>allowed</td><td>allowed</td><td>allowed</td></td>
-+</tr>
-+</table>
-+</p>
-+<div class="example"><h3>Example</h3><pre class="prettyprint lang-config">SSLVHostSNIPolicy authonly</pre>
-+</div>
-+
-+
- </div>
- </div>
- <div class="bottomlang">
-diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
-index fb66d18..c0fdafd 100644
---- a/modules/ssl/mod_ssl.c
-+++ b/modules/ssl/mod_ssl.c
-@@ -80,6 +80,8 @@ static const command_rec ssl_config_cmds[] = {
-     SSL_CMD_SRV(RandomSeed, TAKE23,
-                 "SSL Pseudo Random Number Generator (PRNG) seeding source "
-                 "('startup|connect builtin|file:/path|exec:/path [bytes]')")
-+    SSL_CMD_SRV(VHostSNIPolicy, TAKE1,
-+                "SSL VirtualHost SNI compatibility policy setting")
- 
-     /*
-      * Per-server context configuration directives
-diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
-index c5dce7f..f856b18 100644
---- a/modules/ssl/ssl_engine_config.c
-+++ b/modules/ssl/ssl_engine_config.c
-@@ -82,6 +82,9 @@ SSLModConfigRec *ssl_config_global_create(server_rec *s)
- #ifdef HAVE_FIPS
-     mc->fips = UNSET;
- #endif
-+#ifdef HAVE_TLSEXT
-+    mc->snivh_policy           = MODSSL_SNIVH_SECURE;
-+#endif
- 
-     apr_pool_userdata_set(mc, SSL_MOD_CONFIG_KEY,
-                           apr_pool_cleanup_null,
-@@ -1918,6 +1921,44 @@ const char  *ssl_cmd_SSLStrictSNIVHostCheck(cmd_parms *cmd, void *dcfg, int flag
- #endif
- }
- 
-+const char *ssl_cmd_SSLVHostSNIPolicy(cmd_parms *cmd, void *dcfg, const char *arg)
-+{
-+#ifdef HAVE_TLSEXT
-+    SSLModConfigRec *mc = myModConfig(cmd->server);
-+    const char *err;
-+
-+    if ((err = ap_check_cmd_context(cmd, GLOBAL_ONLY))) {
-+        return err;
-+    }
-+    if (!mc) {
-+        return "SSLVHostSNIPolicy cannot be used inside SSLPolicyDefine";
-+    }
-+
-+    if (strcEQ(arg, "secure")) {
-+        mc->snivh_policy = MODSSL_SNIVH_SECURE;
-+    }
-+    else if (strcEQ(arg, "strict")) {
-+        mc->snivh_policy = MODSSL_SNIVH_STRICT;
-+    }
-+    else if (strcEQ(arg, "insecure")) {
-+        mc->snivh_policy = MODSSL_SNIVH_INSECURE;
-+    }
-+    else if (strcEQ(arg, "authonly")) {
-+        mc->snivh_policy = MODSSL_SNIVH_AUTHONLY;
-+    }
-+    else {
-+        return apr_psprintf(cmd->pool, "Invalid SSLVhostSNIPolicy "
-+                            "argument '%s'", arg);
-+    }
-+
-+    return NULL;
-+#else
-+    return "SSLVHostSNIPolicy cannot be used, OpenSSL is not built with "
-+        "support for TLS extensions and SNI indication. Refer to the "
-+        "documentation, and build a compatible version of OpenSSL."
-+#endif
-+}
-+
- #ifdef HAVE_OCSP_STAPLING
- 
- const char *ssl_cmd_SSLStaplingCache(cmd_parms *cmd,
-diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
-index 2fbd076..1bf6ac4 100644
---- a/modules/ssl/ssl_engine_init.c
-+++ b/modules/ssl/ssl_engine_init.c
-@@ -30,6 +30,7 @@
- 
- #include "mpm_common.h"
- #include "mod_md.h"
-+#include "util_md5.h"
- 
- static apr_status_t ssl_init_ca_cert_path(server_rec *, apr_pool_t *, const char *,
-                                           STACK_OF(X509_NAME) *, STACK_OF(X509_INFO) *);
-@@ -186,6 +187,110 @@ static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf,
-                  modver, AP_SERVER_BASEVERSION, incver);
- }
- 
-+#ifdef HAVE_TLSEXT
-+/* Helper functions to create the SNI vhost policy hash. The policy
-+ * hash captures the configuration elements relevant to the mode
-+ * selected at runtime by SSLVHostSNIPolicy. */
-+
-+#define md5_str_update(ctx_, pfx_, str_) do { apr_md5_update(ctx_, pfx_, strlen(pfx_)); apr_md5_update(ctx_, str_, strlen(str_)); } while (0)
-+#define md5_ifstr_update(ctx_, pfx_, str_) do { apr_md5_update(ctx_, pfx_, strlen(pfx_)); if (str_) apr_md5_update(ctx_, str_, strlen(str_)); } while (0)
-+#define md5_fmt_update(ctx_, fmt_, i_) do { char s_[128]; apr_snprintf(s_, sizeof s_, fmt_, i_); \
-+        apr_md5_update(ctx_, s_, strlen(s_)); } while (0)
-+
-+static int md5_strarray_cmp(const void *p1, const void *p2)
-+{
-+    return strcmp(*(char **)p1, *(char **)p2);
-+}
-+
-+/* Hashes an array of strings in sorted order. */
-+static void md5_strarray_hash(apr_pool_t *ptemp, apr_md5_ctx_t *hash,
-+                              const char *pfx, apr_array_header_t *s)
-+{
-+    char **elts = apr_pmemdup(ptemp, s->elts, s->nelts * sizeof *elts);
-+    int i;
-+
-+    qsort(elts, s->nelts, sizeof(char *), md5_strarray_cmp);
-+
-+    apr_md5_update(hash, pfx, strlen(pfx));
-+    for (i = 0; i < s->nelts; i++) {
-+        md5_str_update(hash, "elm:", elts[i]);
-+    }
-+}
-+
-+static void hash_sni_policy_pk(apr_pool_t *ptemp, apr_md5_ctx_t *hash, modssl_ctx_t *ctx)
-+{
-+    md5_fmt_update(hash, "protocol:%d", ctx->protocol);
-+
-+    md5_ifstr_update(hash, "ciphers:", ctx->auth.cipher_suite);
-+    md5_ifstr_update(hash, "tls13_ciphers:", ctx->auth.tls13_ciphers);
-+
-+    md5_strarray_hash(ptemp, hash, "cert_files:", ctx->pks->cert_files);
-+    md5_strarray_hash(ptemp, hash, "key_files:", ctx->pks->key_files);
-+}
-+
-+static void hash_sni_policy_auth(apr_md5_ctx_t *hash, modssl_ctx_t *ctx)
-+{
-+    modssl_pk_server_t *pks = ctx->pks;
-+    modssl_auth_ctx_t *a = &ctx->auth;
-+
-+    md5_fmt_update(hash, "verify_depth:%d", a->verify_depth);
-+    md5_fmt_update(hash, "verify_mode:%d", a->verify_mode);
-+
-+    md5_ifstr_update(hash, "ca_name_path:", pks->ca_name_path);
-+    md5_ifstr_update(hash, "ca_name_file:", pks->ca_name_file);
-+    md5_ifstr_update(hash, "ca_cert_path:", a->ca_cert_path);
-+    md5_ifstr_update(hash, "ca_cert_file:", a->ca_cert_file);
-+    md5_ifstr_update(hash, "crl_path:", ctx->crl_path);
-+    md5_ifstr_update(hash, "crl_file:", ctx->crl_file);
-+    md5_fmt_update(hash, "crl_check_mask:%d", ctx->crl_check_mask);
-+    md5_fmt_update(hash, "ocsp_mask:%d", ctx->ocsp_mask);
-+    md5_fmt_update(hash, "ocsp_force_default:%d", ctx->ocsp_force_default);
-+    md5_ifstr_update(hash, "ocsp_responder:", ctx->ocsp_responder);
-+
-+#ifdef HAVE_SRP
-+    md5_ifstr_update(hash, "srp_vfile:", ctx->srp_vfile);
-+#endif
-+
-+#ifdef HAVE_SSL_CONF_CMD
-+    {
-+        apr_array_header_t *parms = ctx->ssl_ctx_param;
-+        int n;
-+
-+        for (n = 0; n < parms->nelts; n++) {
-+            ssl_ctx_param_t *p = &APR_ARRAY_IDX(parms, n, ssl_ctx_param_t);
-+
-+            md5_str_update(hash, "param:", p->name);
-+            md5_str_update(hash, "value:", p->value);
-+        }
-+    }
-+#endif
-+}
-+#endif
-+
-+static char *create_sni_policy_hash(apr_pool_t *p, apr_pool_t *ptemp,
-+                                    modssl_snivhpolicy_t policy,
-+                                    SSLSrvConfigRec *sc)
-+{
-+    char *rv = NULL;
-+#ifdef HAVE_TLSEXT
-+    if (policy != MODSSL_SNIVH_STRICT && policy != MODSSL_SNIVH_INSECURE) {
-+        apr_md5_ctx_t hash;
-+        unsigned char digest[APR_MD5_DIGESTSIZE];
-+
-+        /* Create the vhost policy hash for comparison later. */
-+        apr_md5_init(&hash);
-+        hash_sni_policy_auth(&hash, sc->server);
-+        if (policy == MODSSL_SNIVH_SECURE)
-+            hash_sni_policy_pk(ptemp, &hash, sc->server);
-+        apr_md5_final(digest, &hash);
-+
-+        rv = apr_palloc(p, 2 * APR_MD5_DIGESTSIZE + 1);
-+        ap_bin2hex(digest, APR_MD5_DIGESTSIZE, rv); /* sets final '\0' */
-+    }
-+#endif
-+    return rv;
-+}
-+
- /*  _________________________________________________________________
- **
- **  Let other answer special connection attempts. 
-@@ -439,6 +544,8 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
-                 return rv;
-             }
-         }
-+
-+        sc->sni_policy_hash = create_sni_policy_hash(p, ptemp, mc->snivh_policy, sc);
-     }
- 
-     /*
-diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
-index 33aa1f7..83ae90e 100644
---- a/modules/ssl/ssl_engine_kernel.c
-+++ b/modules/ssl/ssl_engine_kernel.c
-@@ -101,112 +101,28 @@ static int fill_reneg_buffer(request_rec *r, SSLDirConfigRec *dc)
- }
- 
- #ifdef HAVE_TLSEXT
--static int ap_array_same_str_set(apr_array_header_t *s1, apr_array_header_t *s2)
-+/* Check whether a transition from vhost sc1 to sc2 from SNI to Host:
-+ * vhost selection is permitted according to the SSLVHostSNIPolicy
-+ * setting.  Returns 1 if the policy treats the vhosts as compatible,
-+ * else 0. */
-+static int ssl_check_vhost_sni_policy(SSLSrvConfigRec *sc1,
-+                                      SSLSrvConfigRec *sc2)
- {
--    int i;
--    const char *c;
--    
--    if (s1 == s2) {
-+    modssl_snivhpolicy_t policy = sc1->mc->snivh_policy;
-+
-+    /* Policy: insecure => allow everything. */
-+    if (policy == MODSSL_SNIVH_INSECURE)
-         return 1;
--    }
--    else if (!s1 || !s2 || (s1->nelts != s2->nelts)) {
--        return 0;
--    }
-     
--    for (i = 0; i < s1->nelts; i++) {
--        c = APR_ARRAY_IDX(s1, i, const char *);
--        if (!c || !ap_array_str_contains(s2, c)) {
--            return 0;
--        }
--    }
--    return 1;
--}
-+    /* Policy: strict => fail for any vhost transition. */
-+    if (policy == MODSSL_SNIVH_STRICT)
-+        return sc1 == sc2;
- 
--static int ssl_pk_server_compatible(modssl_pk_server_t *pks1, 
--                                    modssl_pk_server_t *pks2) 
--{
--    if (!pks1 || !pks2) {
--        return 0;
--    }
--    /* both have the same certificates? */
--    if ((pks1->ca_name_path != pks2->ca_name_path)
--        && (!pks1->ca_name_path || !pks2->ca_name_path 
--            || strcmp(pks1->ca_name_path, pks2->ca_name_path))) {
--        return 0;
--    }
--    if ((pks1->ca_name_file != pks2->ca_name_file)
--        && (!pks1->ca_name_file || !pks2->ca_name_file 
--            || strcmp(pks1->ca_name_file, pks2->ca_name_file))) {
--        return 0;
--    }
--    if (!ap_array_same_str_set(pks1->cert_files, pks2->cert_files)
--        || !ap_array_same_str_set(pks1->key_files, pks2->key_files)) {
--        return 0;
--    }
--    return 1;
--}
-+    /* For authonly/secure policy, compare the hash. */
-+    AP_DEBUG_ASSERT(sc1->sni_policy_hash);
-+    AP_DEBUG_ASSERT(sc2->sni_policy_hash);
- 
--static int ssl_auth_compatible(modssl_auth_ctx_t *a1, 
--                               modssl_auth_ctx_t *a2) 
--{
--    if (!a1 || !a2) {
--        return 0;
--    }
--    /* both have the same verification */
--    if ((a1->verify_depth != a2->verify_depth)
--        || (a1->verify_mode != a2->verify_mode)) {
--        return 0;
--    }
--    /* both have the same ca path/file */
--    if ((a1->ca_cert_path != a2->ca_cert_path)
--        && (!a1->ca_cert_path || !a2->ca_cert_path 
--            || strcmp(a1->ca_cert_path, a2->ca_cert_path))) {
--        return 0;
--    }
--    if ((a1->ca_cert_file != a2->ca_cert_file)
--        && (!a1->ca_cert_file || !a2->ca_cert_file 
--            || strcmp(a1->ca_cert_file, a2->ca_cert_file))) {
--        return 0;
--    }
--    /* both have the same ca cipher suite string */
--    if ((a1->cipher_suite != a2->cipher_suite)
--        && (!a1->cipher_suite || !a2->cipher_suite 
--            || strcmp(a1->cipher_suite, a2->cipher_suite))) {
--        return 0;
--    }
--    /* both have the same ca cipher suite string */
--    if ((a1->tls13_ciphers != a2->tls13_ciphers)
--        && (!a1->tls13_ciphers || !a2->tls13_ciphers 
--            || strcmp(a1->tls13_ciphers, a2->tls13_ciphers))) {
--        return 0;
--    }
--    return 1;
--}
--
--static int ssl_ctx_compatible(modssl_ctx_t *ctx1, 
--                              modssl_ctx_t *ctx2) 
--{
--    if (!ctx1 || !ctx2 
--        || (ctx1->protocol != ctx2->protocol)
--        || !ssl_auth_compatible(&ctx1->auth, &ctx2->auth)
--        || !ssl_pk_server_compatible(ctx1->pks, ctx2->pks)) {
--        return 0;
--    }
--    return 1;
--}
--
--static int ssl_server_compatible(server_rec *s1, server_rec *s2)
--{
--    SSLSrvConfigRec *sc1 = s1? mySrvConfig(s1) : NULL;
--    SSLSrvConfigRec *sc2 = s2? mySrvConfig(s2) : NULL;
--
--    /* both use the same TLS protocol? */
--    if (!sc1 || !sc2 
--        || !ssl_ctx_compatible(sc1->server, sc2->server)) {
--        return 0;
--    }
--    
--    return 1;
-+    return strcmp(sc1->sni_policy_hash, sc2->sni_policy_hash) == 0;
- }
- #endif
- 
-@@ -275,6 +191,8 @@ int ssl_hook_ReadReq(request_rec *r)
-         server_rec *handshakeserver = sslconn->server;
-         SSLSrvConfigRec *hssc = mySrvConfig(handshakeserver);
- 
-+        AP_DEBUG_ASSERT(hssc);
-+
-         if ((servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name))) {
-             /*
-              * The SNI extension supplied a hostname. So don't accept requests
-@@ -315,19 +233,14 @@ int ssl_hook_ReadReq(request_rec *r)
-                            "which is required to access this server.<br />\n");
-             return HTTP_FORBIDDEN;
-         }
--        if (r->server != handshakeserver
--            && !ssl_server_compatible(sslconn->server, r->server)) {
--            /*
--             * The request does not select the virtual host that was
--             * selected for handshaking and its SSL parameters are different
--             */
--
-+        /* Enforce SSL SNI vhost compatibility policy. */
-+        if (!ssl_check_vhost_sni_policy(sc, hssc)) {
-             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02032)
-                          "Hostname %s %s and hostname %s provided"
--                         " via HTTP have no compatible SSL setup",
-+                         " via HTTP have no compatible SSL setup for policy '%s'",
-                          servername ? servername : handshakeserver->server_hostname,
-                          servername ? "provided via SNI" : "(default host as no SNI was provided)",
--                         r->hostname);
-+                          r->hostname, MODSSL_SNIVH_NAME(sc->mc->snivh_policy));
-             return HTTP_MISDIRECTED_REQUEST;
-         }
-     }
-diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h
-index 2b18189..dbef182 100644
---- a/modules/ssl/ssl_private.h
-+++ b/modules/ssl/ssl_private.h
-@@ -556,6 +556,19 @@ typedef struct {
-     int          nBytes;
- } ssl_randseed_t;
- 
-+/* SNI vhost compatibility policy. */
-+typedef enum {
-+    MODSSL_SNIVH_STRICT   = 0,
-+    MODSSL_SNIVH_SECURE   = 1,
-+    MODSSL_SNIVH_AUTHONLY = 2,
-+    MODSSL_SNIVH_INSECURE = 3
-+} modssl_snivhpolicy_t;
-+
-+/* Maps modssl_snivhpolicy_t back into a config option string. */
-+#define MODSSL_SNIVH_NAME(p_) ((p_) == MODSSL_SNIVH_STRICT ? "strict" : \
-+                               ((p_) == MODSSL_SNIVH_SECURE ? "secure" : \
-+                                ((p_) == MODSSL_SNIVH_AUTHONLY ? "authonly" : "insecure" )))
-+
- /**
-  * Define the structure of an ASN.1 anything
-  */
-@@ -689,6 +702,8 @@ typedef struct {
- #ifdef HAVE_FIPS
-     BOOL             fips;
- #endif
-+
-+    modssl_snivhpolicy_t snivh_policy;
- } SSLModConfigRec;
- 
- /** Structure representing configured filenames for certs and keys for
-@@ -843,6 +858,7 @@ struct SSLSrvConfigRec {
-     modssl_ctx_t    *server;
- #ifdef HAVE_TLSEXT
-     ssl_enabled_t    strict_sni_vhost_check;
-+    const char      *sni_policy_hash;
- #endif
- #ifndef OPENSSL_NO_COMP
-     BOOL             compression;
-@@ -918,6 +934,7 @@ const char  *ssl_cmd_SSLRequire(cmd_parms *, void *, const char *);
- const char  *ssl_cmd_SSLUserName(cmd_parms *, void *, const char *);
- const char  *ssl_cmd_SSLRenegBufferSize(cmd_parms *cmd, void *dcfg, const char *arg);
- const char  *ssl_cmd_SSLStrictSNIVHostCheck(cmd_parms *cmd, void *dcfg, int flag);
-+const char  *ssl_cmd_SSLVHostSNIPolicy(cmd_parms *cmd, void *dcfg, const char *arg);
- const char *ssl_cmd_SSLInsecureRenegotiation(cmd_parms *cmd, void *dcfg, int flag);
- 
- const char  *ssl_cmd_SSLProxyEngine(cmd_parms *cmd, void *dcfg, int flag);
--- 
-2.44.0
-
diff --git a/httpd.spec b/httpd.spec
index 91c8d2f..45f21c9 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -30,8 +30,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.65
-Release: 5%{?dist}
+Version: 2.4.66
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -99,7 +99,6 @@ Patch27: httpd-2.4.64-sslprotdefault.patch
 Patch28: httpd-2.4.43-logjournal.patch
 Patch29: httpd-2.4.63-r1912477+.patch
 Patch30: httpd-2.4.64-separate-systemd-fns.patch
-Patch31: httpd-2.4.65-sslvhostsnipolicy.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
@@ -847,6 +846,9 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Dec 09 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.66-1
+- new version 2.4.66
+
 * Thu Nov 27 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-5
 - Improve default httpd LogFormats for better support diagnostics
 
diff --git a/sources b/sources
index 8d4165c..d84ddb9 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.65.tar.bz2) = 202f8bfe2aafcfbcd7315191d466e9c10b9a8c0abafb7864510b6e1abe4cb660aaacc2456aa77d43e48ef7a49e591d0b54170d3daf67abc3e06c3da1c63fdffc
-SHA512 (httpd-2.4.65.tar.bz2.asc) = edcf02be97567fb28fef78f757e3355802575782ab452eaea79da70812b20ef4ba49a609e409a9664ec2546720b303deebbd563f3079ce4e77d67b91816210d1
+SHA512 (httpd-2.4.66.tar.bz2) = 49031a3465d956ee3b755e65810b6c35561ddd5fac2c624a273b733c238e115b914cd7b246837e5a3090ccfded6e0b8b3059bfd1f8ce4419081c805a38d05a4b
+SHA512 (httpd-2.4.66.tar.bz2.asc) = 3fc7a4c6c0705adc3f8223ed3d6ebc45f09b7a19ab63a8b4d359835d2b592cf11f0fd0438a40b5a43c0684b36602484bb908bf46b0c068dd22bacc2c194e7fbd
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192