Do not use %autochangelog

It can't be used without %autorelease.
Use our own macro to add entries from SOURCE3: changelog to %changelog

    %add_changelog %SOURCE3

Also install changelog to /usr/share/doc/policycoreutils/changelog

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -239,3 +239,131 @@ policycoreutils-2.0.83.tgz
 /policycoreutils-2.5-rc1.tar.gz
 /policycoreutils-2.5.tar.gz
 /sepolgen-1.2.3.tar.gz
+/policycoreutils-2.6.tar.gz
+/sepolgen-2.6.tar.gz
+/policycoreutils-2.7.tar.gz
+/selinux-python-2.7.tar.gz
+/selinux-gui-2.7.tar.gz
+/selinux-sandbox-2.7.tar.gz
+/selinux-dbus-2.7.tar.gz
+/semodule-utils-2.7.tar.gz
+/restorecond-2.7.tar.gz
+/policycoreutils-2.8-rc1.tar.gz
+/restorecond-2.8-rc1.tar.gz
+/selinux-dbus-2.8-rc1.tar.gz
+/selinux-gui-2.8-rc1.tar.gz
+/selinux-python-2.8-rc1.tar.gz
+/selinux-sandbox-2.8-rc1.tar.gz
+/semodule-utils-2.8-rc1.tar.gz
+/policycoreutils-2.8-rc2.tar.gz
+/restorecond-2.8-rc2.tar.gz
+/selinux-dbus-2.8-rc2.tar.gz
+/selinux-gui-2.8-rc2.tar.gz
+/selinux-python-2.8-rc2.tar.gz
+/selinux-sandbox-2.8-rc2.tar.gz
+/semodule-utils-2.8-rc2.tar.gz
+/policycoreutils-2.8-rc3.tar.gz
+/restorecond-2.8-rc3.tar.gz
+/selinux-dbus-2.8-rc3.tar.gz
+/selinux-gui-2.8-rc3.tar.gz
+/selinux-python-2.8-rc3.tar.gz
+/selinux-sandbox-2.8-rc3.tar.gz
+/semodule-utils-2.8-rc3.tar.gz
+/policycoreutils-2.8.tar.gz
+/restorecond-2.8.tar.gz
+/selinux-dbus-2.8.tar.gz
+/selinux-gui-2.8.tar.gz
+/selinux-python-2.8.tar.gz
+/selinux-sandbox-2.8.tar.gz
+/semodule-utils-2.8.tar.gz
+/gui-po.tgz
+/policycoreutils-po.tgz
+/python-po.tgz
+/sandbox-po.tgz
+/policycoreutils-2.9-rc1.tar.gz
+/selinux-python-2.9-rc1.tar.gz
+/selinux-gui-2.9-rc1.tar.gz
+/selinux-sandbox-2.9-rc1.tar.gz
+/selinux-dbus-2.9-rc1.tar.gz
+/semodule-utils-2.9-rc1.tar.gz
+/restorecond-2.9-rc1.tar.gz
+/policycoreutils-2.9-rc2.tar.gz
+/restorecond-2.9-rc2.tar.gz
+/selinux-dbus-2.9-rc2.tar.gz
+/selinux-gui-2.9-rc2.tar.gz
+/selinux-python-2.9-rc2.tar.gz
+/selinux-sandbox-2.9-rc2.tar.gz
+/semodule-utils-2.9-rc2.tar.gz
+/policycoreutils-2.9.tar.gz
+/restorecond-2.9.tar.gz
+/selinux-dbus-2.9.tar.gz
+/selinux-gui-2.9.tar.gz
+/selinux-python-2.9.tar.gz
+/selinux-sandbox-2.9.tar.gz
+/semodule-utils-2.9.tar.gz
+/policycoreutils-3.0-rc1.tar.gz
+/restorecond-3.0-rc1.tar.gz
+/selinux-dbus-3.0-rc1.tar.gz
+/selinux-gui-3.0-rc1.tar.gz
+/selinux-python-3.0-rc1.tar.gz
+/selinux-sandbox-3.0-rc1.tar.gz
+/semodule-utils-3.0-rc1.tar.gz
+/policycoreutils-3.0.tar.gz
+/restorecond-3.0.tar.gz
+/selinux-dbus-3.0.tar.gz
+/selinux-gui-3.0.tar.gz
+/selinux-python-3.0.tar.gz
+/selinux-sandbox-3.0.tar.gz
+/semodule-utils-3.0.tar.gz
+/policycoreutils-3.1.tar.gz
+/restorecond-3.1.tar.gz
+/selinux-dbus-3.1.tar.gz
+/selinux-gui-3.1.tar.gz
+/selinux-python-3.1.tar.gz
+/selinux-sandbox-3.1.tar.gz
+/semodule-utils-3.1.tar.gz
+/policycoreutils-3.2-rc1.tar.gz
+/restorecond-3.2-rc1.tar.gz
+/selinux-dbus-3.2-rc1.tar.gz
+/selinux-gui-3.2-rc1.tar.gz
+/selinux-python-3.2-rc1.tar.gz
+/selinux-sandbox-3.2-rc1.tar.gz
+/semodule-utils-3.2-rc1.tar.gz
+/policycoreutils-3.2-rc2.tar.gz
+/restorecond-3.2-rc2.tar.gz
+/selinux-dbus-3.2-rc2.tar.gz
+/selinux-gui-3.2-rc2.tar.gz
+/selinux-python-3.2-rc2.tar.gz
+/selinux-sandbox-3.2-rc2.tar.gz
+/semodule-utils-3.2-rc2.tar.gz
+/selinux-3.2.tar.gz
+/selinux-3.3-rc2.tar.gz
+/selinux-3.3-rc3.tar.gz
+/selinux-3.3.tar.gz
+/selinux-3.4-rc1.tar.gz
+/selinux-3.4-rc2.tar.gz
+/selinux-3.4-rc3.tar.gz
+/selinux-3.4.tar.gz
+/selinux-3.5-rc1.tar.gz
+/selinux-3.5-rc2.tar.gz
+/selinux-3.5-rc3.tar.gz
+/selinux-3.5.tar.gz
+/selinux-policycoreutils.zip
+/selinux-python.zip
+/selinux-sandbox.zip
+/selinux-gui.zip
+/selinux-3.6-rc1.tar.gz
+/selinux-3.6-rc2.tar.gz
+/selinux-3.6.tar.gz
+/selinux-3.7.tar.gz
+/selinux-3.7.tar.gz.asc
+/selinux-3.8-rc1.tar.gz
+/selinux-3.8-rc1.tar.gz.asc
+/selinux-3.8-rc3.tar.gz
+/selinux-3.8-rc3.tar.gz.asc
+/selinux-3.8.tar.gz
+/selinux-3.8.tar.gz.asc
+/selinux-3.9-rc2.tar.gz
+/selinux-3.9-rc2.tar.gz.asc
+/selinux-3.9.tar.gz
+/selinux-3.9.tar.gz.asc

0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch

@@ -0,0 +1,25 @@
+From ce28d432bef8d1a346054b56a989e58533fecfa7 Mon Sep 17 00:00:00 2001
+From: Dan Walsh <dwalsh@redhat.com>
+Date: Fri, 14 Feb 2014 12:32:12 -0500
+Subject: [PATCH] Don't be verbose if you are not on a tty
+Content-type: text/plain
+
+---
+ policycoreutils/scripts/fixfiles | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
+index b7cd765c15e4..f2518e96e34c 100755
+--- a/policycoreutils/scripts/fixfiles
++++ b/policycoreutils/scripts/fixfiles
+@@ -108,6 +108,7 @@ exclude_dirs_from_relabelling() {
+ fullFlag=0
+ BOOTTIME=""
+ VERBOSE="-p"
++[ -t 1 ] || VERBOSE=""
+ FORCEFLAG=""
+ THREADS=""
+ RPMFILES=""
+-- 
+2.50.1
+

0002-sepolicy-generate-Handle-more-reserved-port-types.patch

@@ -0,0 +1,72 @@
+From 618ae48ebf1334f9380a9ae7460c553515f9c4ca Mon Sep 17 00:00:00 2001
+From: Masatake YAMATO <yamato@redhat.com>
+Date: Thu, 14 Dec 2017 15:57:58 +0900
+Subject: [PATCH] sepolicy-generate: Handle more reserved port types
+Content-type: text/plain
+
+Currently only reserved_port_t, port_t and hi_reserved_port_t are
+handled as special when making a ports-dictionary.  However, as fas as
+corenetwork.te.in of serefpolicy, unreserved_port_t and
+ephemeral_port_t should be handled in the same way, too.
+
+(Details) I found the need of this change when I was using
+selinux-polgengui.  Though tcp port 12345, which my application may
+use, was given to the gui, selinux-polgengui generates expected te
+file and sh file which didn't utilize the tcp port.
+
+selinux-polgengui checks whether a port given via gui is already typed
+or not.
+
+If it is already typed, selinux-polgengui generates a te file having
+rules to allow the application to use the port. (A)
+
+If not, it seems for me that selinux-polgengui is designed to generate
+a te file having rules to allow the application to own(?) the port;
+and a sh file having a command line to assign the application own type
+to the port. (B)
+
+As we can see the output of `semanage port -l' some of ports for
+specified purpose have types already.  The important point is that the
+rest of ports also have types already:
+
+    hi_reserved_port_t tcp 512-1023
+    hi_reserved_port_t udp 512-1023
+    unreserved_port_t tcp 1024-32767, 61001-65535
+    unreserved_port_t udp 1024-32767, 61001-65535
+    ephemeral_port_t tcp 32768-61000
+    ephemeral_port_t udp 32768-61000
+
+As my patch shows, the original selinux-polgengui ignored
+hi_reserved_port_t; though hi_reserved_port_t is assigned,
+selinux-polgengui considered ports 512-1023 are not used. As the
+result selinux-polgengui generates file sets of (B).
+
+For the purpose of selinux-polgengui, I think unreserved_port_t and
+ephemeral_port_t are treated as the same as hi_reserved_port_t.
+
+Signed-off-by: Masatake YAMATO <yamato@redhat.com>
+
+Fedora only patch:
+https://lore.kernel.org/selinux/20150610.190635.1866127952891120915.yamato@redhat.com/
+---
+ python/sepolicy/sepolicy/generate.py | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
+index adf65f27a822..f726ad51b775 100644
+--- a/python/sepolicy/sepolicy/generate.py
++++ b/python/sepolicy/sepolicy/generate.py
+@@ -100,7 +100,9 @@ def get_all_ports():
+     for p in sepolicy.info(sepolicy.PORT):
+         if p['type'] == "reserved_port_t" or \
+                 p['type'] == "port_t" or \
+-                p['type'] == "hi_reserved_port_t":
++                p['type'] == "hi_reserved_port_t" or \
++                p['type'] == "ephemeral_port_t" or \
++                p['type'] == "unreserved_port_t":
+             continue
+         dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range'))
+     return dict
+-- 
+2.50.1
+

0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch

@@ -0,0 +1,75 @@
+From 16fd581da479f80b8f8ff8ae8ff58a4f0a610d54 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Wed, 18 Jul 2018 09:09:35 +0200
+Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox
+Content-type: text/plain
+
+---
+ sandbox/sandbox     |  4 ++--
+ sandbox/sandbox.8   |  2 +-
+ sandbox/sandboxX.sh | 14 --------------
+ 3 files changed, 3 insertions(+), 17 deletions(-)
+
+diff --git a/sandbox/sandbox b/sandbox/sandbox
+index e3fd6119ed4d..e01425f0c637 100644
+--- a/sandbox/sandbox
++++ b/sandbox/sandbox
+@@ -270,7 +270,7 @@ class Sandbox:
+             copyfile(f, "/tmp", self.__tmpdir)
+             copyfile(f, "/var/tmp", self.__tmpdir)
+ 
+-    def __setup_sandboxrc(self, wm="/usr/bin/openbox"):
++    def __setup_sandboxrc(self, wm="/usr/bin/matchbox-window-manager"):
+         execfile = self.__homedir + "/.sandboxrc"
+         fd = open(execfile, "w+")
+         if self.__options.session:
+@@ -370,7 +370,7 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [-
+ 
+         parser.add_option("-W", "--windowmanager", dest="wm",
+                           type="string",
+-                          default="/usr/bin/openbox",
++                          default="/usr/bin/matchbox-window-manager",
+                           help=_("alternate window manager"))
+ 
+         parser.add_option("-l", "--level", dest="level",
+diff --git a/sandbox/sandbox.8 b/sandbox/sandbox.8
+index 095b9e27042d..1c1870190e51 100644
+--- a/sandbox/sandbox.8
++++ b/sandbox/sandbox.8
+@@ -80,7 +80,7 @@ Specifies the windowsize when creating an X based Sandbox. The default windowsiz
+ \fB\-W\fR \fB\-\-windowmanager\fR
+ Select alternative window manager to run within
+ .B sandbox \-X.
+-Default to /usr/bin/openbox.
++Default to /usr/bin/matchbox-window-manager.
+ .TP
+ \fB\-X\fR
+ Create an X based Sandbox for gui apps, temporary files for
+diff --git a/sandbox/sandboxX.sh b/sandbox/sandboxX.sh
+index 28169182ce42..e2a7ad9b2ac7 100644
+--- a/sandbox/sandboxX.sh
++++ b/sandbox/sandboxX.sh
+@@ -7,20 +7,6 @@ export TITLE="Sandbox $context -- `grep ^#TITLE: ~/.sandboxrc | /usr/bin/cut -b8
+ [ -z $3 ] && export DPI="96" || export DPI="$3"
+ trap "exit 0" HUP
+ 
+-mkdir -p ~/.config/openbox
+-cat > ~/.config/openbox/rc.xml << EOF
+-<openbox_config xmlns="http://openbox.org/3.4/rc"
+-		xmlns:xi="http://www.w3.org/2001/XInclude">
+-<applications>
+-  <application class="*">
+-    <decor>no</decor>
+-    <desktop>all</desktop>
+-    <maximized>yes</maximized>
+-  </application>
+-</applications>
+-</openbox_config>
+-EOF
+-
+ if [ "$WAYLAND_NATIVE" == "no" ]; then
+     if [ -z "$WAYLAND_DISPLAY" ]; then
+         DISPLAY_COMMAND='/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null'
+-- 
+2.50.1
+

0004-Use-SHA-2-instead-of-SHA-1.patch

@@ -0,0 +1,178 @@
+From 1a3fc195c6dc7fe51ef76e4484910f7b41161ccc Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Fri, 30 Jul 2021 14:14:37 +0200
+Subject: [PATCH] Use SHA-2 instead of SHA-1
+Content-type: text/plain
+
+The use of SHA-1 in RHEL9 is deprecated
+---
+ policycoreutils/setfiles/restorecon.8       | 10 +++++-----
+ policycoreutils/setfiles/restorecon_xattr.8 |  8 ++++----
+ policycoreutils/setfiles/restorecon_xattr.c | 12 ++++++------
+ policycoreutils/setfiles/setfiles.8         | 10 +++++-----
+ 4 files changed, 20 insertions(+), 20 deletions(-)
+
+diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8
+index 1134420e0e28..77dd05421d11 100644
+--- a/policycoreutils/setfiles/restorecon.8
++++ b/policycoreutils/setfiles/restorecon.8
+@@ -103,14 +103,14 @@ display usage information and exit.
+ ignore files that do not exist.
+ .TP
+ .B \-I
+-ignore digest to force checking of labels even if the stored SHA1 digest
+-matches the specfiles SHA1 digest. The digest will then be updated provided
++ignore digest to force checking of labels even if the stored SHA256 digest
++matches the specfiles SHA256 digest. The digest will then be updated provided
+ there are no errors. See the
+ .B NOTES
+ section for further details.
+ .TP
+ .B \-D
+-Set or update any directory SHA1 digests. Use this option to
++Set or update any directory SHA256 digests. Use this option to
+ enable usage of the
+ .IR security.sehash
+ extended attribute.
+@@ -208,7 +208,7 @@ the
+ .B \-D
+ option to
+ .B restorecon
+-will cause it to store a SHA1 digest of the default specfiles set in an extended
++will cause it to store a SHA256 digest of the default specfiles set in an extended
+ attribute named
+ .IR security.sehash
+ on each directory specified in
+@@ -225,7 +225,7 @@ for further details.
+ .sp
+ The
+ .B \-I
+-option will ignore the SHA1 digest from each directory specified in
++option will ignore the SHA256 digest from each directory specified in
+ .IR pathname \ ...
+ and provided the
+ .B \-n
+diff --git a/policycoreutils/setfiles/restorecon_xattr.8 b/policycoreutils/setfiles/restorecon_xattr.8
+index 51d12a4dbb80..09bfd8c40ab4 100644
+--- a/policycoreutils/setfiles/restorecon_xattr.8
++++ b/policycoreutils/setfiles/restorecon_xattr.8
+@@ -23,7 +23,7 @@ or
+ 
+ .SH "DESCRIPTION"
+ .B restorecon_xattr
+-will display the SHA1 digests added to extended attributes
++will display the SHA256 digests added to extended attributes
+ .I security.sehash
+ or delete the attribute completely. These attributes are set by
+ .BR restorecon (8)
+@@ -48,12 +48,12 @@ extended attribute and are automatically excluded from searches.
+ .sp
+ By default
+ .B restorecon_xattr
+-will display the SHA1 digests with "Match" appended if they match the default
++will display the SHA256 digests with "Match" appended if they match the default
+ specfile set or the
+ .I specfile
+ set used with the
+ .B \-f
+-option. Non-matching SHA1 digests will be displayed with "No Match" appended.
++option. Non-matching SHA256 digests will be displayed with "No Match" appended.
+ This feature can be disabled by the
+ .B \-n
+ option.
+@@ -87,7 +87,7 @@ Do not append "Match" or "No Match" to displayed digests.
+ recursively descend directories.
+ .TP
+ .B \-v
+-display SHA1 digest generated by specfile set (Note that this digest is not
++display SHA256 digest generated by specfile set (Note that this digest is not
+ used to match the
+ .I security.sehash
+ directory digest entries, and is shown for reference only).
+diff --git a/policycoreutils/setfiles/restorecon_xattr.c b/policycoreutils/setfiles/restorecon_xattr.c
+index 31fb82fd2099..bc22d3fd4560 100644
+--- a/policycoreutils/setfiles/restorecon_xattr.c
++++ b/policycoreutils/setfiles/restorecon_xattr.c
+@@ -38,7 +38,7 @@ int main(int argc, char **argv)
+ 	unsigned int xattr_flags = 0, delete_digest = 0, recurse = 0;
+ 	unsigned int delete_all_digests = 0, ignore_mounts = 0;
+ 	bool display_digest = false;
+-	char *sha1_buf, **specfiles, *fc_file = NULL, *pathname = NULL;
++	char *sha256_buf, **specfiles, *fc_file = NULL, *pathname = NULL;
+ 	unsigned char *fc_digest = NULL;
+ 	size_t i, fc_digest_len = 0, num_specfiles;
+ 
+@@ -133,8 +133,8 @@ int main(int argc, char **argv)
+ 			exit(-1);
+ 		}
+ 
+-		sha1_buf = malloc(fc_digest_len * 2 + 1);
+-		if (!sha1_buf) {
++		sha256_buf = malloc(fc_digest_len * 2 + 1);
++		if (!sha256_buf) {
+ 			fprintf(stderr,
+ 				"Error allocating digest buffer: %s\n",
+ 							    strerror(errno));
+@@ -143,16 +143,16 @@ int main(int argc, char **argv)
+ 		}
+ 
+ 		for (i = 0; i < fc_digest_len; i++)
+-			sprintf((&sha1_buf[i * 2]), "%02x", fc_digest[i]);
++			sprintf((&sha256_buf[i * 2]), "%02x", fc_digest[i]);
+ 
+-		printf("specfiles SHA1 digest: %s\n", sha1_buf);
++		printf("specfiles SHA256 digest: %s\n", sha256_buf);
+ 
+ 		printf("calculated using the following specfile(s):\n");
+ 		if (specfiles) {
+ 			for (i = 0; i < num_specfiles; i++)
+ 				printf("%s\n", specfiles[i]);
+ 		}
+-		free(sha1_buf);
++		free(sha256_buf);
+ 		printf("\n");
+ 	}
+ 
+diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
+index eabf0a1cf755..187f45131a1f 100644
+--- a/policycoreutils/setfiles/setfiles.8
++++ b/policycoreutils/setfiles/setfiles.8
+@@ -104,14 +104,14 @@ display usage information and exit.
+ ignore files that do not exist.
+ .TP
+ .B \-I
+-ignore digest to force checking of labels even if the stored SHA1 digest
+-matches the specfiles SHA1 digest. The digest will then be updated provided
++ignore digest to force checking of labels even if the stored SHA256 digest
++matches the specfiles SHA256 digest. The digest will then be updated provided
+ there are no errors. See the
+ .B NOTES
+ section for further details.
+ .TP
+ .B \-D
+-Set or update any directory SHA1 digests. Use this option to
++Set or update any directory SHA256 digests. Use this option to
+ enable usage of the
+ .IR security.sehash
+ extended attribute.
+@@ -270,7 +270,7 @@ the
+ .B \-D
+ option to
+ .B setfiles
+-will cause it to store a SHA1 digest of the
++will cause it to store a SHA256 digest of the
+ .B spec_file
+ set in an extended attribute named
+ .IR security.sehash
+@@ -291,7 +291,7 @@ for further details.
+ .sp
+ The
+ .B \-I
+-option will ignore the SHA1 digest from each directory specified in
++option will ignore the SHA256 digest from each directory specified in
+ .IR pathname \ ...
+ and provided the
+ .B \-n
+-- 
+2.50.1
+

0005-python-sepolicy-Fix-spec-file-dependencies.patch

@@ -0,0 +1,48 @@
+From 84b051139ab536519cc8e9c333483475d830d40b Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Tue, 30 May 2023 09:07:28 +0200
+Subject: [PATCH] python/sepolicy: Fix spec file dependencies
+Content-type: text/plain
+
+semanage is part of policycoreutils-python-utils package, selinuxenabled
+is part of libselinux-utils (required by ^^^) and restorecon/load_policy
+are part of policycoreutils (also required by policycoreutils-python-utils).
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+---
+ python/sepolicy/sepolicy/templates/spec.py | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/python/sepolicy/sepolicy/templates/spec.py b/python/sepolicy/sepolicy/templates/spec.py
+index 433c298a17e0..a6d4508bb670 100644
+--- a/python/sepolicy/sepolicy/templates/spec.py
++++ b/python/sepolicy/sepolicy/templates/spec.py
+@@ -11,18 +11,20 @@ Version:	1.0
+ Release:	1%{?dist}
+ Summary:	SELinux policy module for MODULENAME
+ 
+-Group:	System Environment/Base		
+-License:	GPLv2+	
++Group:	System Environment/Base
++License:	GPLv2+
+ # This is an example. You will need to change it.
++# For a complete guide on packaging your policy
++# see https://fedoraproject.org/wiki/SELinux/IndependentPolicy
+ URL:		http://HOSTNAME
+ Source0:	MODULENAME.pp
+ Source1:	MODULENAME.if
+ Source2:	DOMAINNAME_selinux.8
+ Source3:	DOMAINNAME_u
+ 
+-Requires: policycoreutils, libselinux-utils
+-Requires(post): selinux-policy-base >= %{selinux_policyver}, policycoreutils
+-Requires(postun): policycoreutils
++Requires: policycoreutils-python-utils, libselinux-utils
++Requires(post): selinux-policy-base >= %{selinux_policyver}, policycoreutils-python-utils
++Requires(postun): policycoreutils-python-utils
+ """
+ 
+ mid_section="""\
+-- 
+2.50.1
+

0006-sepolicy-Fix-detection-of-writeable-locations.patch

@@ -0,0 +1,65 @@
+From 98cd707e8106e9e77b179bccbeb4fd4004b4c601 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <lautrbach@redhat.com>
+Date: Mon, 5 May 2025 18:28:40 +0200
+Subject: [PATCH] sepolicy: Fix detection of writeable locations
+
+- update substitutions from /etc/dnf/var
+
+It seems that by default dnf api does not read /etc/dnf/var/* files to
+update substitutions and so it can't resolve correct mirror list when a
+variable is part of the link.
+
+- alway run query.run()
+
+Fixes:
+    Traceback (most recent call last):
+      File "/usr/lib/python3.12/site-packages/dnf/repo.py", line 574, in load
+        ret = self._repo.load()
+              ^^^^^^^^^^^^^^^^^
+      File "/usr/lib64/python3.12/site-packages/libdnf/repo.py", line 467, in load
+        return _repo.Repo_load(self)
+               ^^^^^^^^^^^^^^^^^^^^^
+    libdnf._error.Error: Failed to download metadata for repo 'baseos':
+    Cannot prepare internal mirrorlist: Status code: 404 for
+    https://mirrors.centos.org/metalink?repo=centos-baseos-$stream&arch=x86_64&protocol=https,http (IP:152.19.134.198)
+
+Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
+---
+ python/sepolicy/sepolicy/generate.py | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
+index f726ad51..a0314a70 100644
+--- a/python/sepolicy/sepolicy/generate.py
++++ b/python/sepolicy/sepolicy/generate.py
+@@ -1267,15 +1267,15 @@ allow %s_t %s_t:%s_socket name_%s;
+         import dnf
+ 
+         with dnf.Base() as base:
++            base.conf.substitutions.update_from_etc('/')
+             base.read_all_repos()
+             base.fill_sack(load_system_repo=True)
+ 
+             query = base.sack.query()
+ 
+-            pq = query.available()
+-            pq = pq.filter(file=self.program)
++            pq = query.filter(file=self.program)
+ 
+-            for pkg in pq:
++            for pkg in pq.run():
+                 self.rpms.append(pkg.name)
+                 for fname in pkg.files:
+                     for b in self.DEFAULT_DIRS:
+@@ -1288,7 +1288,7 @@ allow %s_t %s_t:%s_socket name_%s;
+                                 self.add_dir(fname)
+                 sq = query.available()
+                 sq = sq.filter(provides=pkg.source_name)
+-                for bpkg in sq:
++                for bpkg in sq.run():
+                     for fname in bpkg.files:
+                         for b in self.DEFAULT_DIRS:
+                             if b == "/etc":
+-- 
+2.49.0
+

0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch

@@ -0,0 +1,91 @@
+From ae251cfb85090126d5c1de62b94775fae3b43527 Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Wed, 10 Sep 2025 11:42:09 +0100
+Subject: [PATCH] setfiles: Add -A option to disable
+ SELINUX_RESTORECON_ADD_ASSOC
+
+SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes with
+multiple hard links or bind mounts that have differing contexts.
+However doing this involves building a large internal hashtable that
+stores the full path of every file examined by setfiles.  For
+filesystems that have very large numbers of files or long pathnames,
+this uses a lot of memory, which makes SELinux relabelling in
+constrained memory environments infeasible.
+
+This adds a new setfiles -A option that disables this tracking.
+
+For example, using setfiles to relabel a filesystem with 15 million
+files took 3.7GB of RAM.  Using this option, the same filesystem can
+be relabelled in 121MB (albeit with no warnings or errors possible for
+conflicting labels, but for our use case we don't care about that.)
+
+Fixes: https://issues.redhat.com/browse/RHEL-111505
+Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
+Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+---
+ policycoreutils/setfiles/setfiles.8 |  5 +++++
+ policycoreutils/setfiles/setfiles.c | 11 +++++++----
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
+index 187f4513..458f3f9f 100644
+--- a/policycoreutils/setfiles/setfiles.8
++++ b/policycoreutils/setfiles/setfiles.8
+@@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts.
+ .RB [ \-I | \-D ]
+ .RB [ \-T
+ .IR nthreads ]
++.RB [ \-A ]
+ .I spec_file
+ .IR pathname \ ...
+ 
+@@ -187,6 +188,10 @@ use up to
+ threads.  Specify 0 to create as many threads as there are available
+ CPU cores; 1 to use only a single thread (default); or any positive
+ number to use the given number of threads (if possible).
++.TP
++.B \-A
++do not track inodes with multiple hard links or bind mounts that would
++match different contexts (saves memory)
+ 
+ .SH "ARGUMENTS"
+ .TP
+diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
+index ad09f840..31034316 100644
+--- a/policycoreutils/setfiles/setfiles.c
++++ b/policycoreutils/setfiles/setfiles.c
+@@ -40,9 +40,9 @@ static __attribute__((__noreturn__)) void usage(const char *const name)
+ 			name, name);
+ 	} else {
+ 		fprintf(stderr,
+-			"usage:  %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n"
+-			"usage:  %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n"
+-			"usage:  %s -s [-diIDlmnpqvFUWT] spec_file\n",
++			"usage:  %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n"
++			"usage:  %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n"
++			"usage:  %s -s [-diIDlmnpqvAFUWT] spec_file\n",
+ 			name, name, name);
+ 	}
+ 	exit(-1);
+@@ -147,7 +147,7 @@ int main(int argc, char **argv)
+ 	const char *base;
+ 	int errors = 0;
+ 	const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:";
+-	const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:";
++	const char *sopts = "c:de:f:hiIDlmno:pqr:svACEFUR:W0T:";
+ 	const char *opts;
+ 	union selinux_callback cb;
+ 	long unsigned skipped_errors;
+@@ -375,6 +375,9 @@ int main(int argc, char **argv)
+ 			if (*optarg == '\0' || *endptr != '\0')
+ 				usage(argv[0]);
+ 			break;
++		case 'A':
++			r_opts.add_assoc = 0;
++			break;
+ 		case 'h':
+ 		case '?':
+ 			usage(argv[0]);
+-- 
+2.49.0
+

0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch

@@ -0,0 +1,98 @@
+From c1bd6ee62f2cedfb3709710fc46f2899b301c139 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Mon, 1 Sep 2025 18:17:10 +0200
+Subject: [PATCH] semanage: Reset active value when deleting boolean
+ customizations
+
+Currently, removal of boolean local customizations leaves their current
+(active) value untouched.
+
+After the removal is complete, semanage_bool_query will return the
+default value. But it needs to be called in a separate transaction.
+This makes the fix a bit awkward, but I have not found a way to query
+the default value before the first transation is committed.
+
+Fixes:
+  # getsebool smbd_anon_write
+  smbd_anon_write --> off
+  # semanage boolean -m1 smbd_anon_write
+  # semanage boolean -D
+  # getsebool smbd_anon_write
+  smbd_anon_write --> on
+  # manage boolean -l isemanage boolean --list | grep smbd_anon_write
+  smbd_anon_write                (on   ,  off)  Allow smbd to anon write
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+---
+ python/semanage/seobject.py | 43 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 43 insertions(+)
+
+diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
+index 10963e81..6d6188fd 100644
+--- a/python/semanage/seobject.py
++++ b/python/semanage/seobject.py
+@@ -2886,7 +2886,15 @@ class booleanRecords(semanageRecords):
+         self.__delete(name)
+         self.commit()
+ 
++        # New transaction to reset the boolean to its default value.
++        # Calling __reset_value in the same transaction as the removal of
++        # local customizations does nothing
++        self.begin()
++        self.__reset_value(name)
++        self.commit()
++
+     def deleteall(self):
++        deleted = []
+         (rc, self.blist) = semanage_bool_list_local(self.sh)
+         if rc < 0:
+             raise ValueError(_("Could not list booleans"))
+@@ -2895,10 +2903,45 @@ class booleanRecords(semanageRecords):
+ 
+         for boolean in self.blist:
+             name = semanage_bool_get_name(boolean)
++            deleted.append(name)
+             self.__delete(name)
+ 
+         self.commit()
+ 
++        # New transaction to reset all affected booleans to their default values.
++        # Calling __reset_value in the same transaction as the removal of
++        # local customizations does nothing
++        self.begin()
++
++        for boolean in deleted:
++            self.__reset_value(boolean)
++
++        self.commit()
++
++    # Set active value to default
++    # Note: this needs to be called in a new transaction after removing local customizations
++    # in order for semanage_bool_query to fetch the default value
++    # (as opposed to the current one -- set by the local customizations)
++    def __reset_value(self, name):
++        name = selinux.selinux_boolean_sub(name)
++
++        (rc, k) = semanage_bool_key_create(self.sh, name)
++        if rc < 0:
++            raise ValueError(_("Could not create a key for %s") % name)
++
++        (rc, b) = semanage_bool_query(self.sh, k)
++        if rc < 0:
++            raise ValueError(_("Could not query boolean %s") % name)
++
++        semanage_bool_set_value(b, semanage_bool_get_value(b))
++
++        rc = semanage_bool_set_active(self.sh, k, b)
++        if rc < 0:
++            raise ValueError(_("Could not set active value of boolean %s") % name)
++
++        semanage_bool_key_free(k)
++        semanage_bool_free(b)
++
+     def get_all(self, locallist=0):
+         ddict = {}
+         if locallist:
+-- 
+2.49.0
+

README.translations

@@ -0,0 +1,49 @@
+SELinux translations currently live in the following locations:
+
+- https://translate.fedoraproject.org/projects/selinux/
+  - contains 2 versions of translatable strings rhel8 (latest RHEL 8 release) and main (Fedora and RHEL 9)
+  - maintains large number of languages (several of which do not actually contain any translated strings)
+  - updated by community and partially by RH localization effort
+
+- SELinux source repositories (periodicaly updated from weblate)
+  - https://github.com/fedora-selinux/selinux
+    - used for Fedora, latest CentOS and RHEL 9
+  - https://github.com/SELinuxProject/selinux
+    - upstream repository
+
+How to update source files on weblate:
+  $ git clone git@github.com:fedora-selinux/selinux.git
+  $ cd selinux
+  # generate new potfiles
+  $ for p in policycoreutils python gui sandbox; do
+    cd $p/po
+    rm $p.pot
+    make $p.pot
+    sed -i 's/charset=CHARSET/charset=UTF-8/g' $p.pot
+    cd -
+    done
+  # https://translate.fedoraproject.org/projects/selinux/policycoreutils/en/
+  # Files -> Upload translations
+  # Repeat the process for python, gui and sandbox
+  # or use weblate command line tool (get your API key at https://translate.fedoraproject.org/accounts/profile/#api):
+  $ for p in policycoreutils python gui sandbox; do
+    wlc --key <API key> --url https://translate.fedoraproject.org/api/ upload --input $p/po/$p.pot selinux/$p/en --method=source
+    done
+
+How to pull new translations from weblate
+  $ git clone git@github.com:fedora-selinux/selinux.git
+  # https://translate.fedoraproject.org/projects/selinux/policycoreutils
+  # Files -> Download translation files as ZIP file (save in selinux source directory)
+  # Repeat the process for python, gui and sandbox
+  # or use weblate command line tool
+  $ for p in policycoreutils python gui sandbox; do
+    wlc --key <API key> --url https://translate.fedoraproject.org/api/ download selinux/$p --output selinux
+    done
+  # unzip archives
+  $ cd selinux
+  $ for p in policycoreutils python gui sandbox; do
+    unzip -o selinux-$p.zip -d ..
+    rm selinux-$p.zip
+    done
+  $ git add .
+  $ git commit

bachradsusi.gpg

@@ -0,0 +1,438 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBE97JQcBEAC/aeBxbuToAJokMiVxtMVFoUMgCbcVQDB21YhMq4i5a/HDzFno
+qVPhQjGViGTKXQYR7SnT8CCfC3ggG7hqU0oaWKN3D003V6e/ivTJwMKrQRFqf5/A
+vN7ELulXFxEt/ZjYmvTukpW5Li2AU7JBD0aO243Ld9jYdZOZn2zdfA8IpnE9Bmm3
+K/LO1Xb2F9ujF9faI5/IlJvdUFk3uiCKTSvM8kGwOmAwBI921Z5x/CYvy5kKEazU
+lUxMqECl+Tu2YS6NDhWYNkifAIZ7lsUvGjW3/wfh7AvmAQyt/CxOXu9LL2nGzFhw
+CIS4jVIxy5bDswNfHcaMX7B5WEyqTPtjzPAEMiLL4yHJZrHDPd26QHSaqtilVA4K
+AeTYbME8iZIdacquFEq02PO9qAM21O48OknCTSolF7z6nBkk6l26W3EL+Gz5I2Et
+3S9pab3FMjiiKVavM6UA5D0DQkNxxDn9blDXZyhX4HFrk+NnoETcGYFymPbbijgi
+kFC4339/Z1aK31aJLkxiana5mqLthD4jCeg3B8Cp5IurqPr8QEh3FH8ZZhtdx2fX
+TXHTmGQF/lXG4tg1eH5cb6wWGU93wD+5mf6czJlUZTY+kdevKtZCQnA0/2ENCOFW
+Jdm/oMTUw6ozPd474ctzWKeO78e8yMvZst/Zp3Gq6SD9kcoPgiuMQ+BOkwARAQAB
+tCRQZXRyIExhdXRyYmFjaCA8cGxhdXRyYmFAcmVkaGF0LmNvbT6JAjgEEwECACIF
+Ak97JQcCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEGOorUuYLENzy1MP
+/2c4fH8eXWbqoot/vLE+hJ14k0leYOQhVSo4lNlxRlbKNd5MQSX/QjkQgJNECbB3
+LM0KxE/zwVOZ+umvmxLxNskOxjubE6NzoF7Sm9ydoqjwzenIpR9BVtg71mfjBOoL
+PNrst7tHRE5btSnnnOS9ddt/y9JOIvQpkjtBTI2TfVcp2b4Domg7i4qU/hJ7hu45
+5oAi6rPPkr0pcGiDKTqi46l7+9orsj9Mxs1XTmrTMMB/eV6PCU7Fo4WJNXS8SXd3
+sEVxXvpyYjUTTnDuewjT1q8NL7anrsckS16WYSVGKzRhqtP1Vudt1F/D5cWKVqQp
+vQl/XW/uQS2IsgEWsbRmIAEZIUOy4TnuF494C/A+1BbJBdUr4Nl9zPH2bjrJeqYk
+TsvGQr1icgO4pUg5oC456htkqCxCuPRqqrGDAZBx54TldgPwvCo31+aPQJlOlWvI
+uWD/depp0De3oTK9FDnHh3swE0vyn4Ht96+vM+KNnDYgJ1FEaw1efYePFACobvEB
+o2ZpLbnDyqAT4MzfHpHSbwzUOk52ZOnkl/KrUIOxhXtf4dxRS6J70Rzb+HWS3rY/
+LgaMO5Q0BJfbvknguKmE8dO8jx0pTlVER9ujqp+bVPXmFMha1j8vyGhJ3eLJZaRL
+k3jgfRjiUUb4lNp+hXpvBwIYeFWl5kFVKg2aPywgnnFWiEYEExECAAYFAlBq4WgA
+CgkQ4J/vJdlkhKxmjQCfevlawFaGTx58nDFN+4j/2U6uaGcAn2g1sZcTUrEEYHdL
+byAyw1GNLksOiF4EEBEIAAYFAk99mCMACgkQ/2iSBAM3HxDivAD+Lu8U54iGgL5+
+h9KpeV+ZlHgIpj4cD+BVL85L6AQ3GP0A/1TwZ1tS6Ag3ut2G6AL2wewR3v9Mgu68
+E0M5esz5of4oiQEcBBMBAgAGBQJPh9ZuAAoJEBliWhMliBCHMSUH/30V/E930OTT
+oWeq+QKkTJuMF0lrA5NaAy+xWtrynMKoiAuM0KFNGPfrPehkoxR4D+MKXH+xh0j2
+bHl6fXOHJCKZLhCtsC/o8j7kkjIJjixBlwYMul21rxecke7Zt4XpxHARJx4208Lk
+ztpzOd7ZnDP6KYav3itpxK8Eyj4g8N2omoTQ2Dcd+sCa0jgRkyskpPxdt0fK0D04
+XW7b1LZkxwzwrAGSpjAZVzpKBXANcSmUQDAaIhGvYSKoiwVe2eaE5lUmvAaJQaTr
+Ud/LCIwFofTLSaBRX8fEOe+UwvW36VtynPyETyROeTMp//Cm5e2CQVPoDv79soyi
+E/oUW9DFDhCJARwEEwECAAYFAk+Oe6EACgkQlGXZM5TcxIlIRwf/VjfbN3eVf648
+vXvDctsXfucl37i6Yue2COJiGYuZOrN7wYxVvH2to8P3V53YV9OqDpJl2NXUro1V
+iUjFHuIKp23VbtyBAYsrLeTMmHLjnXlaUPSr6JUDHUQhCF34BTk17e9y7tXlEshF
+YVyPlGum7JhyarHB2rRdjQk8kyTqmQ4yHjw/nP/HlvVxdgb+mTmudTPVBafOT1R9
+MJ/SN2x4bclT4cQ0hjNEy/TsFzVduQj8yNOMFG9r6p1Vb+u1wn3BTANIh55R9aDh
+3JFFIV/jBTkxukxR5iyGQiR53nl0e0qnQFxpfhFGclh0RktjrHZ3DBAzcuYXp540
+Vu9aq9QuPIkCHAQQAQIABgUCT4bdRgAKCRDCPZG7HYJE34FtEACfqPwWSItk1lNX
+E0HOM1YuHXFfMGURF1AotskJatwtjGy9oDUQkjfsPROnWjgH9s0xD2UmlTrjJfWi
+BdH0kTLiExVUOmvnM9VFMRhYxQZMwiHecm4FZ5IWUz4e05oGCkHFbMswXEoEG+qq
+btOfLNpX67yy/JM6We+8PiXV/c2vaErpH5S8YChb5wD9lEWNM2aPBOUmbzONM1/f
+EFd8AF6fUVYN7htuyG1n5zTv+oowmO2c0terJRGmMgVuLugIEnKKhaQ+H1K6bdZJ
+7mX4xxx5izEyYeYhi9DhBHSwCLhWR+Yilqkc5U0nrF+3Z+Cb9THHppi071OIQ7pX
+rGsQSpDzGRXCw0nKEBm0Li13re8cOoHMlPD0RHWZEIRZGSYX1YKBtVuv4kpSq8GN
+85lZSDKGRNtbJBS7Qj4vyOlOrBO1eyyd4lepQCe2Ri3gU97rek52tOM+fAIibz7V
+b4a0qbbphrz6PVMbDGiBxM92+YpdDyZGyL7wJ4g6DhRRcEUQahlZ1n7y+YQ60ETs
+zt7+kD08Zi2BoJpiMHsFfoas2pot7VePFxGutwvq0p+OHSVlwkLgOaORPHumLA8u
+J3BGlJTHsErUB2EEgdc/Tv1vsZzEI3Zi+hqw1gcbke21Ii8aDfshbeKW9hYJAhnW
+m8VdF3n80UX5Eg56iybrLCjEyiAEYYkCHAQQAQIABgUCT7yYRAAKCRBOBfZjp6Qb
+nnyTD/4gVbq8H5ka7fVdSAnX65/kFn5xkqGzbpCkjcqe/5uI2CvdYtjeQ4K6sm7I
+5RLoyu/EE/JPbCRHiucsEak42WAZSRte/Wn2yTQpIb0mQ0wXJvuM+Hx7DSx2R12P
+9rIZ4mGo/rEtdG7Y9Vog9M/XGx7w5IqSw2DF2yiYQJXsOzHjphfYB8JfoqjW/73k
+n4E2IRJtCuWhfiJZJ+GEGceSBIredH3o01ThtbAeh/gzPRF3FU1361zyA1sXtmGe
+qwnhNL1spHRlpub3cvAXQ8RSYrNdiFZB5zohNt+iL+qzVWaUJo+vYZal1Co5/roI
+HN5nJef8kp1ngaYKvf1hIVvsdQsilVQIXKFWMd47aU6W8gPr1W2+U4yw+q+OXari
+eo7gpH7/OvMSe/3wOhGVD8KJrMwAVnr3M4wo2CM6zlwxPGdltQI+IxDD8NTGTmNT
+rRARYRQaFQyqd1SrVt4sSkeoegrpOG4oWXya/v4SeXHD4vt8vvvX3A4szB73a355
+IfbyRXDER3EfFfW5c+BnR3bxhfATTE6T0AKz1Gq30Xm2ycTGYCAZ2yBKewaegTpx
+3O/E6APTXUnVWTIPQay8T4iVUiLFs7W1UFMY/RvmIvKKFIQWcm5O0L+27PJK+YSx
+Uoo1Ivt1pclTuetbRbN8VnR3K9Pp5uZ4KLz6ZkffmJg2sOSu74kCHAQSAQgABgUC
+WWMlagAKCRAyfirUINN1OOtFD/4jW0ZMGigpruCnvY0nr47rA12X6dJ6+KIBE+XB
+QxuaQRjM5u44geksDwrqZ0nXrNvsa4SVwAhKVOrgMJVdzvUa1m2yeNCFHOTjln6Q
+GjZ5f3a6aj6n/X5tlPptdklUr9ucEwXVd5fFMpWAiwaqZt38I2u0Pi+/qHDt0kLy
+RSukmRPzRuS/kO1ugGO4aoO+sanVDl2Pq6LIwubL1Unk2HUerg8VCAyQrxYtZtHc
+coyhmBTlAb+EmZnUVbQZ3Uy3eA89OuNTBhJWCk8vqROFm257MiH6gvG/V8CTrJfz
+lpE+s9E6kxXhXpQWZUwtwWObq7vrJVkJhRwBsO9N2erxe+biBauFErYQPw3bg6xL
+1BJLxDWnKUlMWs5o+h7lyjp+1B/gbnnlrUIlpW8IKVZRHwRUPGRN07SbbEO1lDk5
+uJDMk+r2KrOUNVYCEp794P014xodkLvB8X7ml6tcABE4V9d4uVDX3SsktOLMvtWg
+nL6xWMoBYiVOXi3Rsm8vESBOb8JFQL/ItciUyAioM4Zjq5eqotVq90HMBO9kqcjC
+YsYEs6RACRmyE+TNmzGoucIPTwPEi5Ib4gj+LG6iPOBprk5DSjD7F0/wnQPoq8PY
+HIufb4+PgOXKf/ROQXDRLeD6eZBtPcDUJOgW19m7QcXZ8fvo6B91COe9jTF/H/i3
+A7NjR4kCHAQTAQgABgUCUQZ8hwAKCRDZsFd72T6Y/MoUD/9xxmXbPL2Zto6qECXs
+Q1GFuydiYlURxDsVUiuc1tSgEoDb8XcXl37l/IKX1QmcpvHMPzeT0g8sNwIXSnL6
+BNCnFcfrd0tEz8uBPxVnzMiGwaHP1kB6Vs6sNV31+CJcTz8BHHbOdXZnhHqXSb02
+SonqAYeWVSlE08Ejvq0HIWRn6NIGdGqv6icBExryJjS3ZChRFpvgAJwsVO5f6BKH
+oZnEn79uQR4XPHwuxRbm4hf6iYEbOhE7Hod6kTzS9vYIhyuTFTz5Kz/YxlMoZX/j
+TIYsX0nZ3r+Tshur8iUXJhKvvXVlGyrGO2HXfEuIpJqEx4/qM9jUNP0EE7aPzZ6f
+BP7Xq49Dx9lnZuSQ1jeXxEEpO+AND2xmnjCHr3EfgYZrrhCSxMQhvJh7wypkzu30
+D41BHPOPSotmM7WLceHWmYui0Wuq9X2hom5jq11XwACEtmNiP/odXjF0ovfK0d8l
+j/kivgrXAZdN/ONJapVSLkRMS71S6eln+urR9HfswEfM7IPt0cRwN1oNIhXmK14+
+XBWvvwvalfuxG2UfxD8K0JXMwARlpGlV8lXpuzDV8EcrvLipKpqiQWaJer64kaQb
+8qHEtT6+JNoGkymohrfeVagxKmPzDWR4v1a9lgZwY1FTRHNVPM0P8LWlN9q0CrYc
+poBwkhTMV1YJ1OBSrkM9IM2vsokCMwQTAQgAHRYhBGMZHOlBgwmGicq4237xN+yT
+Ww6vBQJjLRkzAAoJEH7xN+yTWw6vZSYP/36Bt4QhRtIh6HPWbHraFSl4omnuISu6
+lTHsqhik81nbIUiLZ5e/KN6ONSgD2jfMVQOLiPTQFOoxVZvOjaHmHvMuF7BCbr90
+Afh1qXW9txuPbVkhtC6hqIMn87b8UHEnt1l5MiafQnPHhoociqaqwfls/iu0nJGu
+Jf5eVMXpdeWRk+ckGkqP+tXp/0G933jibSdYqwG1Tsw9D98xnGV3a/+zIqRtJflp
+HPEjHPT6rVKAZxk7gkYSSsv6ONBwZHqwe9W1I+U4t6OPkGo5kNbMPBORB6/7B2Qo
+LHx3+KYZs1j6glI+F/8IX2+JSFs07saMnsDhE7w5FzmwWV2JcUt42RSf8DVub438
+jgA/Ht5yPROEJ87de78aD/t/gPq/Gm3bnUz1BW0jxBidjqg1qPOMYjC7n4dH8X0N
+cRfX6tWOdSXmDBbPg/vQi6CEIhsGVisKlnrgYi1wDZExU6UVMnBNvllUu9PXye+7
+51cIbrb+fwAWiwmu+AsL0qsjxZYo+9ozOLh9wLUhxOY5MZM82alN/mlUGzEiXN3R
+i7D3rDrNFHdI4LGGLbO2hjPYrG4hdNHS+6WbU6qYcpBEhrqBtnUjoVqIKP2boBLR
+ara7hHqVO120s8kgGtf/AoYpggD0H4qqUy4EFNjVdcL5T08w6ldQIYo7CEa1iHFt
+ML4bsPcJh8lciQIzBBIBCAAdFiEEcQCq365ubpQNLgrWVeRaWujKfIoFAmMsvIwA
+CgkQVeRaWujKfIqNXA//fjCpyIPPd6RnJhagWH8XCp5NB4cCT+LqAIR5yZfz1QE8
+Qbzpoobz9ysgXZ5XjLp/lbVffGyg986j0wUtSW1+g3kJcYXBUKjSWoBwwmZgyZky
+95U+uklY8CdPjSeuzr2I5X/LogHNH1378d9aEmQXBfX1uW5g4Aqgnl0OOgkCVzgs
+FFOO2o1j6svrrDVG52/mwXhNRm0yYK/hFB8T3PO2IvMQGDGJLHl6N5Kl7P2jtkyF
+Isi4AEzJeop/2GJYXQ+VkUTSNRKQj8oOS5qe9/0RkF9uqeamoc81n2But8MZN2fv
+R7ug2EuG2LHp9/pwu5ekohXmY8EtMbVbU7TYKgduK0FMBaK36jXN4Bapakfxr1z5
+pwdDjN4QiqUefBQlG1CJ6fGrqbdAupzRRDqN974rs5HafnbxioYRYjoo4H0zC8XN
+UwgmA2wrwIIY/cyNCSnUuT8yVAnroPiFgmMoL8RM7C5pHQYh0u3fXPfvNBswjXmR
+pJ6mhTqG6SS4qIaPhqoZqA1iyA6+Ua3YLBDT5wqvuqNMnfLtLUvMuridmlj97cRc
+srQIr022NdpafDQVAiVhZO0CRyFd/++XT35iiDoiv20+LewC0VVza466AE1fkAme
+rKlurlET8U/+U0JB6IP77ErjMgCzotV8e1DJkp/M37nMeNzazAb//ovsdkNM6P6J
+AjMEEwEIAB0WIQRFaBEoRJtl+IDGF5c6hKlGtLpirgUCYy3RvAAKCRA6hKlGtLpi
+rvhHD/99Lvgf+CjbhwC87CoKX84MyAyBlYACCSuySQBnEsVigz8sCVyTYDx52h1h
+/SEj7XfTylAfIl1CjUedH4w3hk+7IN4scmhf5eeEMvQd8q+Q/hWQcXIUpwgKOcVD
+NbUgYcbakJAPtilK1CeQvDdBD+aYoMsJTsII/f7FJzwjPM1XGf5EoODUC8BtQf/W
+KAVoESwwAUwN6Y5XeYSwMqu1s7IHs3yNYLV8C6A7EQPVaVVlORqI+33rKyqAhK5X
+ErNvAREQPYJMfRnQlIW7alSORwdG0JBgVLgV+jvoFo4a1AQImHDDtKxs2X5BCVG1
+I687uYDBy5Assl/VxRMIUpx5+zWvXyDZX/6nlL7AMokTlyosgP4iiifBS+5KMhan
+phMgnDXYIJE10V46Bdw2tjd7wMKey6BcKgfbZSvU5z+SuVnQXCyl3/blRML54I5o
+EomXPg6lgVxSb6BBnaJXzx4JKgLer5uom1OGsLgPMqEHRoO3bucr2xFdtq1Zegw4
+9S3qDhQ3bn8pg9JlYwmAAhBd3Xy5cPv01mV6ompOQ38SlMCJzcAGASdMw5scaxUl
+7MloV2Nl32HIzPjK47bF7aVOFX7Tz+rEFLmJCchqmUSdxi42rJyHKVRqiAlNfZ9S
+9FeaEfU+vBxOHsLNqVO7ErvrTafT5fjphZqvUTqZGCUiJUjPnYkCMwQTAQgAHRYh
+BOJeJUyO5NMDVUv1r+xwGh2klMXrBQJjL1NOAAoJEOxwGh2klMXrYaIP/ifHM9eU
+UT6JD0m6Oa3P3T161NhOvNqr71LDSztClsWo3XX0+ZK3wpjoC6vKqgx0Cc8OL1S2
+GqwCaxb5JqWpsoqR3NW6bTqTTUGREj/e0JHDeBzv57OEUTe4ea7qzqjhCX6iyzHa
+qDP9fiAogMQ7uT2oCghDV5yo4JUrG5brw8GkMLEvRSs2BEv7xFAySRaGwNj+oziZ
+VzL7sBzp1bCr5cwNZVYxoo3VAv6FUcExp1TydxzPVB8/VvxOa4zrht+hFTn6mjUi
+NHBc7DYECgh4jlDR6TnAdvpg0FsujTXiN6A0obOUl9jGz2uFmdY+2ojlVtzqKXoP
++PDz8o2zMrRoQYkni9VyIc536E4OFIhfO6CrThMjJjPNn22Tq+fzRYkWTrlJom9b
+nOldQ1BdUXQt2QNigdzqjhZTIgF5OEOTERh80dvwIbZ+7vN00BOsuncR5GUBQerU
+F6+SksVRAaOg2lyoDdxUQ+Z28RU8R/n7VjMV8ctFkQvHHLBqKkpET8LRh0C/jSNh
+gB8zLPc3Oa4wTf2xZWO58S18esbYMr74vRYrsACbmwxH5Tz+L6Br70Fmcz608+IQ
+ESKW3657gemZgFud3AGokzKG5AuWykSinydiZbK8MRGLsdfPUojaVIgXFqnWKtkH
+At9gkD8YbqGYzuVwBnljBNRdTUMk0ClgV6pjuQINBFom2R0BEAC9k1Ky6AIe9sPP
+xrgsrXRe0dyYcoHufzeU3jFssl3+S4cRuvYCzdZfRfdjfHa4n+CxTaOd7xkefwJg
+GpaR9KJbu8dqHm61GIiS5ZbMCRU8FAW6ohVeDqEwFrPAzZjtO41OTpeXCrPu5H5A
+Tg/kDnabzlD2H8JWAqr0DYRRhFtJUihXUey9zK03wSjUi5E1+YHUC/fOpbS+msNN
+945CeQNBN4Ljap9Q183Fkh0Wm4Q8C0OS1WN8a0XtqSALRCGAZ+EV6UrmQVP9PCC4
+/J0hoKQPv2bfpBAsrUGAO3Fnsw7804i2TY7O3JA8gGDYX6fwOVJMUXdD7FX7LM2P
+pESqAdPrjqmPqHT8cPfq27GYgqHv3N4hP9Rjt9wxmHYFbJT0YCHw2ZMiAO/VcvvN
+miGr590ZFiQEb1MJN1r+h5UDE1CtF6nTieirSXi9oMilHlo2NY5nAItv/T9PKk4X
++kaH3UoicMxrkT34tACGwxi4VIRYWL+ZquxE+bwXqAvbGJ0p3XbyREURCaO96J/2
+w951EvZErpFRQu4zzClmoMiNbwkQ8QdesSaqjMirlHyFI8T9BZrXbPazdVNUwfyR
+LFil1q/kgXjXeJDoje73UiyGhqhlVOlEbunGzCwEBzrtQdPTDeFQr476/4pe0v4u
+gdNYkL/gY8Izodn47d1XH68AuRSrzwARAQABiQI2BBgBCgAgFiEE6FPBhIsBhc9C
+hk3zY6itS5gsQ3MFAlom2R0CGyAACgkQY6itS5gsQ3PQSA/8CZGTxQDbD2oLkGb6
+tyECIs5A1RsfwJ9aj0R/HuEO39ki8yM88fwi8F5AfzNcmYwp0rxyYDDYM0itObSv
+A9WBB8YFZ2PKT1YHrwTzWbne+spmQYDRdFt+0Kx0JLvgv7SYvQ1jNdCazixH1SAM
+9O+Tn5oFybVHjRavWsQYHp1CvXY5kOHOEDHhz37pGwFvyVyFdSYS5PWT0+0XU/g6
+Uq2HeFCurhUGuDXJ6WA6Ipvmu0vbi8GpyeiWCRoG76sqbBfQ7dd0oDMUHitewWGq
+LP1Kioke9hu5p9CbkjYwGZjJWZEV6WHxOmICfFcBRPeIJyO8Kfa/vVBfQZj9fhqs
+3sHSfAGIdKIB3tX0qKhMRdu/QoM14YQ1yK80JTUUOcrKLDt6QJinF1UQ/OcYQqGB
+CXaRk1OKGFuuij16QudnX56+aYbNPltf7cLs1O7aodQcRxmMSgxSE/2ckthPYBsX
+PWuDMYZCb3e6JMWsdnCI7iPpoPFAJmId7SWJebXZxntoX6YwZ7Tx58/QMLEqxMfE
+ExQTAFg8/owvxCG12KaharLr4GpLx0aU39QEJenG1LqGLwiQh9Vxsejw+MkebZJE
+6zhs7XBpenrd5c9OFOtb/Goxwal/6UXz7a62jZ7wDNpJw9xOfC3/eX/56+6dLVef
+RFj/LOIu9reM4boTiY2dmGj1QC25Ag0EWibSSgEQAMhQB2Q329FSozPk7V6dYBO+
+jDBMr1jHWvNMCR/2DkwXfDAKK3haSWSqr51/wua9skFRezQvc9PhgvOIJi1jsxRf
+xNoM82a2OpYJdj16FG5RVQ/ApojiywNvp1YPJbmq4DfXSuUA6q+OephsFLrx2cPY
+nyDQaI6mrqTBecET4cdQTZK0nKKUPj3U2bI96zTBIYK8Kr7GMKXm8R1eV8bktwHT
+HyDjI7hN5EjZViYqZYDQ3jt2vC1Aj6XpFw5K7Sv6f0l91zyjfcu6Llsfo8xtRhAl
+lub8EBuO6ljJ5uWqDgjqTOkDXcIAUkhUCg8ztweR15zgJQQ/On0XDcHLtyi7zuQd
+xNaKYKkD3oROTqce+YbNN3qnP4bV0qa0JLlTOrE/0/zmif7Q1zYOidcmMgGeF6Gp
+pGQkkxY4gSKet8kD8h4AZXGlpFu4e9sue1ENDRmgWaqSzIWudMRZ3z0/s9EGNNiW
+60nwJ1NBoySeQEmnwMzAHXneRM9pRGQ1S3/CKttq/0eWEH3Y/Td9xi4DNvTXcvgJ
+uUUwoclWP2PCPg3zE+EQ1q/Kt2oYrT8NcemM9EO8btNzJ/Y1wSDLFAFNikHwYjTM
+86jWoeGhSM3fD9HJjfqoB41gDKvNIVlhQavhe6df4+AoCo/mGosLYAPFaHHdkmqn
+eT0Y0BnTRIS9yLcO8CBVABEBAAGJBGwEGAEIACAWIQToU8GEiwGFz0KGTfNjqK1L
+mCxDcwUCWibSSgIbAgJACRBjqK1LmCxDc8F0IAQZAQgAHRYhBNalthyaVTQWgpLb
+Z74iCR4+9iJ1BQJaJtJKAAoJEL4iCR4+9iJ1D2AP/1VMC8KOmzPYyiFY+1xHu2rv
+siB0f80GH1jXwDSM/IKvsH1axCD0hMV5sSi52epCov37czSlR3MpQjo0xK32wJB9
+26AgbzJYZO48qulDUXUhPWJ9bxiyIcxI/3KEspY1RMoWv8AfYA/qSma1cSdT4IMo
+SGJzPh3RyrUpeFP5QT02oGa5TuSQPiJwy/b9u+RVOi1SSqzHMJdKzZehGays65Pd
+jC8Xtf4ipdYRBr6mIyUISOB+FBkY2MttFzNDUBdDrOepyjStQLZ1vUXnYKIiSRHX
+o3XTW/W8fh72o26zeDbQcALywQMZqnwtrZluzKHZxF07whKmXvw9pUHXX6hbJDvm
+GVMxnB/F6grPNi/V+Bv75sKOdImgnJBUp1Jz7288SPbNQwrqFKV2ZD3f0PFmolFj
+Cz/Oc+UUk+swfnsT3pV6LClTThsOH8WlKJYxZLneX75HuVx4CmT+qv6GlFQuixjc
+H0LtsbbSjAx7J2LRNVtfI+2DfMcIi8KJxe69MAKGqqxDyDPSWeFrs0MHmyD6/6m+
+GTovgUT5jOZbR6GVKelW054bmby0zQevWnRieANVeFoFsnwclJnqKIRzQiGod1p1
+b8HhSCw4nOeOQSifaOf3zcnFhYyByDMOtl3/AqGoLp/61u3Bk9h+BP4VPR3RUWzc
+ggjmxJM0MrLzjaSXSedjzuQQAIq9g35FGpnaB8d/EjufED1TVSOkvNK/qJ+dD4Xz
+f5RvnbprofMnzfEyy8jJ1Vqc3QZQU3IDQt/Un2ZywX0OboKGAIn/gyfwdkpnxJ0j
+JoxRBuMplNpfNBw+oe0nFuozO9idFozKM+SWoE051/jvGHp1FqEPLnAAGeSbWB0L
+RlAsnMjc5u6+SKHeFGRKYg7U0sO7ZKbVIT4ZmRnsQLDakHwbAgfcIakh9Whj0Ou5
+r78Cs+DcM3XAdtZ04d81jV5TsveR8/Cn473c6dvPIfnA2P4uClTCaCDv+jXG2f9a
+FIuJhYCO+TdYs7qjAsXWngJUebRFiHbfSuYDw92/eqLdKD1Hoff4MnW5YOtDpp6E
+sdCDuINeRtUtnidw2vIPezX+xdmycXIq9Fb+GvKrIDsKu0VO8HObVviLa/RE11ds
+EHYlrarj4mqzS2MhvmU79Bazg9rDDB4WVs502n3uJaf6Sod/+ke1c3ff7AUPox2n
+pjH/bVmkZJsOq5EqcvlH3m2FZUHSFWS/yTR1rPuJoHBMHVc4OPlTuSqT3qmKL2vb
+vD1l3D4zHZs1paRLddYXiaex4qPU/0YpP61XU070MmFGYE8Z43TbMPHu/6LYBpw9
+p5Vj3VZwn2edNl4LGx+05hIABzM23I7JoQ44uPoTbohmYXF/DUGJ6h2LYdp81AVC
+lSFWuQINBE97JQcBEACpbBqvDl8J65jEhPjOWczcDVB+WfG7GBHB7T6RxSNFIahy
+mDqzx73zZD6n4NnZogPDPopYdRJ56u5AfF0bDZlgebl8+VEgPHGoay74Gf6k0B+c
+pEkp5PaWQHHEqXINotVg29hTsf1u0sb+yjgcc+9WHw3MtpChsgk8Rc5N8Xvr1FJc
+L+xynSvUCcLIwfgvLHYPPBYGIRpvz4ek/zgHvaGftDfnyMwrMbgi8kadrSb7PQgc
+eWeTL7CQN1B88TPJFqKt/QxMdXaPy+Cr3P4XVy5V3/QEVFUizrtCCqJgxHMAeCP5
+QxwYEWmA2zxUzGA/t/QUDFbccKt2BdpdKBFtHLliE+yn9FHw98JayjhAJxxeCkrp
+MED9N2aGHI1q44sbmeLKQ8EuIbCamfq7fqLXgkEy8jgivv2J9YfXejjjEobGLkss
+Jlxaq9JeQgFEVl6f0jJ0PgkYPd11RxTcVLy4RB417cxc9LHcoKdAtcgBTcZXPPYO
+L+eM9S7rTvFTna9IdF4bbnJFNjHDMhb/9XomxxBsekpTUXEm2DGoTpO2W/jwWcZY
+LVrdhikkkF8b88EdWk94fUTcFA90I+Ch0YbS8XGM/WIklrMGa0JpA4OQW5oMhKDn
+gqAcV7gxRYt6ylBPVh94/AIMz++wmfqBxETFP8HMgTVEApLBLjwru9B/4lRStwAR
+AQABiQIfBBgBAgAJBQJPeyUHAhsMAAoJEGOorUuYLENzegsQAL6NuhGuzQf2GELc
+O5J8/BW2yF9sxHWDLrw0Pntq8D35kgGfZLB52tN3DI4NwL0vE931bXC7ovi4kHPS
+sazv+WPUckYfJ7qskWVD1yDtHsADduwudJpAflfZ4VIvMJqJ7FUw5Fy9ennw/Idp
+H7LC+ubn6XT6Kh9oKvVmp+BQEOsdisjVw848Thik+gS08WvAjK9m+g7++FFwKy08
+5iXuuqZpvi94eU1QPvzxzzRZz6M4gQaz+pCq/5yf6I+Hu8G+5nq2foFN+G7FRkx7
+KJmJ3SAEsG3M23V9MKWON49ZbhTe5xW+1at/TKKoNGzNIYs07jApR2/E4J57yMWj
+zsAqg77hTDRiV0jhHl0DJw3RHFi3z+SrK+6ie6mrq8WEPj62q9qdM8dFs+y5X3UT
+x0nxly7GjOxxhi+Nt83PAG2wVFpqmhVLuyPnruvxzyrVFc8Dvx46DiKCzt4PPK/Y
++jnVIQ7Jr2Jm2ZCpzZZT5QNJuDp46mKHlNBkvSy3q3+pM6cM8vKSuCFd9+dw3dX/
+GptLebMrPOvLVDl4Bm9hSmG7rLpJy8U8Ns8pYSS1zaxHM8KqMaPuS/Zlx1SRIj/E
+afefnHd5fIlmsH9C2O5fb18SFjmD14FCLcVTG7bwh3ZfbGo9sOJSShPxppPW2OoT
+jwfANmj1cSg/VFr1d4HAEc83jFgumQINBGNZjyYBEACk7biPgvCVldNWq1CwVoJa
+/Fvc4T49tqxcc/sY4uVlGo6oSi4fQcXE9XKPPBuRLmvpmMWvODQLzPxJMWUfJq6L
+yYFmX2U9VRTcyITdmJs8itkEaDwq8BtXkeQfUDAVSFy6V6/uvVmNWD7pGXqJE1Gx
+uV44Ihlh6v2YyqSzDG/rZur771hke8VZmlKMVMs1RSeOBA3nUmvZQ58+uqkhJNYq
+OeQhxGIxDOHo7QhzTG+SlX+uQq6mzACKygVJJl33toaUwVAX5R02a0u67A5wC0wh
+AoLSHInc3P7ayivWV/iESAz+gMIkuvJWns/Ak14J7MTGgjD6rle7PNMsPDCCwQSc
+qA8F0x4OChCixbZGZn6Mr0u8+01VCEe2IjJwVUfFI/G4n1FZ1RAdqjkHfZJeD20L
+GHSbjJLcnqLLFx3LDpI5dAxo5K2kFvz0VowrB58aHoofW8/g8yZygGQ4Zpw4JnpU
+maPnMTiD5yvnFzEihM5L9DuaWqSK3sb9qzoaXABYRYI7OmX4B5nmMzFteHHq0tMt
+aKWf0HkAsCP0BLJcS9Oc1/0I0+gC4oKLRD8a4+kaEpNr6BXvWnj7Y1h0Zr/CZS6+
+gi34CxWMl2Q34OSqtS37mzzBu+UZxffPR0aV2RXcEpc0c5HW550Thq1NF9EmFOoy
+eG4J2ox9JRANZXLh/i7mNwARAQABtCVQZXRyIExhdXRyYmFjaCA8bGF1dHJiYWNo
+QHJlZGhhdC5jb20+iQJXBBMBCABBFiEEuGgoR3ZN9g31LZksvDkF8jUXnPEFAmNZ
+jyYCGwMFCQPCZwAFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQvDkF8jUX
+nPGeAA//ScQ3kJMqI6FRULXo0aF7CpafPXVWdvj+mfQMlZzuGwXXTmM42T0DXnXR
+BSjstWkmOXP/UqkN7bNeXH/S3D3GCJ2l0qx8Qp6fP0FloJIbemyxNtzl7yvAE7kW
+vuBuLvUdm23cntv49gAzj+ElDqCxtT6A6qaqM6r7DLUvw+G+r6gkeu1hNQbtRpEK
+9Dt8tHriQyI410qFRMbi3QxU+iTJ79HXwrXiYpX7V7T+ugiU9lgIiC/hWJCo6SY4
+knt9E6zhegUWN6zErl2HY8FBM2P9eHOTqToEOAhKeM1fXZvxe3m49fGq/spmRM1R
+UUl1V9WFEaMiLg/Z2rmbD8LX9YtfYlQCbEwyX2nkIP1QIcr/DEfcmCA2MXCQCgsq
+I/2XS3BTLPyjuqAYnXxrk+T/Cydcg4W3ZBYI/wT56GH02TQzB/wJsn0cW6EMG46V
+SDY/mZ2/gwi54G/Pqb2R3ZC9I7wQ6/FFxuu8myI/QVmEiTlvTxBoyOdNlliBQxCk
+Dczs1rxd/o8Wfjo1vwRHW84jZrCP3xr7xPJWuzsrmPU8kFHTgepGoY+4b/h3jGwl
+V103RpRUK4JidwHsmYDVk6pgeUH69hf0iVcbFfKiViFTR+DwjbAOxTdsFgsYYn+7
+hBj2l+pV/uzeA0akL2dkgfJc9pAf6ItRUnGC+RlntZ0Pf2NbwIS5Ag0EY1mPJgEQ
+AMRQDbNHBQ376nDF8miBZOAV1txpmbHc5D/X63PNapP0P1/I7SfcJU9D3wX8c4vm
+xkjEYtH23s4lmT1VLsU7PisS3MacRemm9pL2bD53hs9XQEuU9OtJsZn1ZJ+Ynh6i
+5sfW1bG3OiV/TWgYXW66GwE1hn9PuP8arodUmhEft+64G2u8Xtxr5yqlQJEUThV6
+280OJrxVbduaMi5C6UNeeGE5wuhfrQ0TNYZiwQ4KYbU3QhlWhHVjJlJ5hCLiktwF
+DyR24P+wlTIziWA407mo2enQT+mz3bO7Paf4mBionGsJMoADqBThf4B69BxjJ7Yg
+7oQVIZ7560YIRRmNo4tk5Mhep11OtQgZjZJR6MhWDaUO17w1qScrOPRj6G1IXP1R
+5NarydJpLyAVb/5WFZ5jxUGMGtq3mYn4nKbbHUg2WzvCJvPctDE6EV2vaiRy5N1f
+QjsHgSa29F2feh14p4ngFCmHjpdbcdjfv6rWL8tgkSpQlDdeHRRd1q03TKAg/byP
+auAHKzvV+iWlmw1f6KBWjeTn0fofmk9eeQ+P1j0a3/XTxMOjB34SzqPRWzmLPLF6
+YmujBK2gymM+JLirJFFzao1i4lgmxqkDhQoNYHXmVYEd7w+/qUYbfKwO9eJOWzuU
+WajxvJ1Vgv6z4CPy9if0gwfhrx0OOcIpBE/xZU+SwQQpABEBAAGJAjwEGAEIACYW
+IQS4aChHdk32DfUtmSy8OQXyNRec8QUCY1mPJgIbDAUJA8JnAAAKCRC8OQXyNRec
+8a+qD/4whGQ9J+td1iLFMpNRAqvuGtTnM6shZJNnC5CB56Cu7ElIpr74sk0R98Ia
+1pJlBcLALbYSrqwluZaLiRVDPdub6tGSRVssqQdZcKThz33waTru9IfLhCrRSNd0
+ZMHJaOG1ErU0noWw2d4ifVJK+vvuvMeEyNm4H5pZOYzYeikqVUYzS143cSzMEwtv
+PSdP5JkTQi4WNF09khH1D+QpJoXEgVEQla7Sr955Zdt3q5OlpYxxw+X62vslZ2OM
+iKZ14kWVSRbVQ+WdnjtRYS4vivB6ko9QL770jZ131hKhC/BcWpEYSjfPpVua2oKb
+ccKHXheIFEJ06kGkMeeoQPxmzPRBYIw/E+d5sZp7YXDyBGOAxBeiOaOnZ8vLBzy7
+2HFng3oB3hkVGTTHq+PsHdSSaRME3QrNpDsaGeSjw62FG3I4zK985GtrXAHEzN/F
+fd17srl4mcRQ+8QM/a+XbF/8ugjE/RHhhFf8sWVAPutYzVE8lF+uqcduPuq/rTcU
+BuzSVjnSRfXWqCokjh+ypUpHNUO8fZDzkTLuE5rwMG1xpPueDBTzvoGDQRqc2eoX
+pJnDBmdlz83zHsoR2gIHcdqyc/hCV+fTvR8E0v9ZG3Jr6RFgWdD008PsGxUevIDg
+MAYFwasZSTofEnzg49/WeIFU1rGB5HZVlmOJKZnKRuBiTakEP7kCDQRjWY9xARAA
+rEkjlUH4hoSQAkVJCWWk+nF+daAP5IszrGEQH7TyOVwXbRZndSPFSUqKU2kEgHbM
+m+wFYoZe95h9tjDh2sLCs338pVu5Chhz3dNseTF7/rbckw2rCU+JbalEiwck7tKL
+qobvbh77jnrbQnkrZNc+nMeHHLrYyc5gHW6cSn4UlU42MKmTlSeOG4Ly9wXhgaKC
+heIXNX3U/D682Tffl7Gopcm7pPZF92dwY4nIpCxU2ATimkSyulbhzk2CjZ1JYUJ1
+LHctMHm9F0LEGtc1GxDShzVZP8dOWpDs9BBwZDLXxCzC4rvZ+z5BJCDFbuNTKZQ5
+JEoW2sM8yP1LLZGXz44hsab1aPrvB3vcdS5ETP6bqT5267ZiotdhUifU/pTV5ze4
+7wNuaZenQtGd9olyh2dAqOk2DQrcBQFA0gRp55b4U62hLTYXxT+7jEbSVAxeXDPR
+qPvqh/4kVn86llYjV6dAoASN1wWz423QH3u4ZK+S6g8HZ0HrY2+NBYgqthb6H/X6
+FiF5VcHWstkk967g4Xt0PgN/rlCtpXh4WK9sScX/CFdOURsHlb78ZN2LexaYaVBq
+QuqvfHaAPJaIElXqMheZ8aYrO6Df4yzJ+6eTs3s4PqM6EMir5waFonx5Gh50X4xL
+9p7IVqgNPhQsU8Z5U5hGYbmUH766GtENv4CI1upFA1cAEQEAAYkCPAQYAQgAJhYh
+BLhoKEd2TfYN9S2ZLLw5BfI1F5zxBQJjWY9xAhsgBQkDwmcAAAoJELw5BfI1F5zx
+4cMP+wbjKu2xCr63oyn+lo7NqMDLBYl4zHunYTZhG/egDakVWp5Ikj5/k3i+hVSY
+fUyUhqQ/b/H096ropB7GA6EzS44GS+hLMdQOJOmEbjvAP/9dJDX2FQnYZzaA2f/e
+Ikgaw283oOLnmYz0x7YAW/oxlnPn+7Sg7DGGqqn3nKofDUUrowfX0tQGwkGmJJqQ
+gOH/ZfU4t51UCKzF6hWRbberBI8ezp24vYngA2kGef1fCUC+EIFhoYcdHHCtC1Ti
+KmOUaeB9ZMiVXkP60fmCLKObwcKTyYpAFPqM05xgsMPFaXN+fQ7YVAGpCdthk53N
+5Go+QqehwLoJk77CHZxIWJIf43p3UiuH1FsuXF7OdExzIhUSiUum6MoCI8BpVwn9
+uSKfXKLOdGDR6IJI8jqdC9LYoXqxZtDhpcqD70hFWJwJzZg+U2SvxZyhOqwtKXtD
+TDtee3yGzPacSAJD7mFURc/DRi62UBMiFcqO1YW/5LgC4yjtzo7MTQPkaGbQLduH
+IlCKa8pHWPqaLFdMawwqNrTNHWXCD4XxijJYwdAue3NUG/utekNm82mqnbbWw/AX
+URIzefQsbyqiNYMztudJ9hAS8yCdkfb9SKVIvWYPQ77tHltOZF7K/NzOGeJaJr8l
+vqZCfXpWmOduTpWaD2kIvU2Kx7gB4jXdMa2ai9N+/Hdr3lLouQINBGNZj8YBEADg
+Y6HOawiThxQVI+0uvAAU9yisew1SSVO6mAsQtZM7s7BpLA3RGPj3UGojZIeejA+k
+fq7A+PVLBhz/kSBTtw9/s3o4rlqNzz7SLaix6XKWCpHOBs84n3/LF6u9KMMVk9vT
+sjKz8iDF9mBR2bmCfLvEk0HDiMyApv5SbOsZMB8k5PWyK8HYPyMI5umEaOsaC3tA
+eihO3nzAxEf3oZl53J1pIw+ecdrQLbWbH0aqKngfCddD8Q0oMr/Iwly3W49+5eqJ
+oelR9/dut/dg0a3Nn1wIGYRzC62CCsF5IZwKdyPh7nilEUFpA5Vlz+HfIFch2LfR
+F3Q/GZD8fKzKxhjDIdgyaWSTsMbityKxX2G/pcjshyMsZT7I3Hx7SwQfFro58s2D
+FsFLEZgBhJv+nW/HckeedaveXmXdHKjtsa8+rvGADti4wohOl+N5tbpYW3/zR3AY
+qlh47hG0ikUJ8Tusnu865j3Z5mE+KqS68ypRVBMRrdJl2lGPDCnXGhl2720VPNMC
+/jB2Mgm/L1mvQM1jPfdC3KgokDAH5NMzKvav6A71aLSUJli3UdkGHkX5d5urs3k3
+WmCt7XeTb30MBvNzBcSYTbw2UGIRE8G0CFc3wtiWWiQKPeFXYhn0+COCoW/EXpIC
+VaAuMPMgcsldM13bKGyGo3NngsNEdopNFfr0KKW5XwARAQABiQRyBBgBCAAmFiEE
+uGgoR3ZN9g31LZksvDkF8jUXnPEFAmNZj8YCGwIFCQPCZwACQAkQvDkF8jUXnPHB
+dCAEGQEIAB0WIQQb4sD/CJSWIxAv0lZGlYgcJUUI0QUCY1mPxgAKCRBGlYgcJUUI
+0ZkHD/9TlRvAaZETf+pv4/IceeL3KHwj5lrC/gojXxN0AjhAXljLSRCu0EyICxZy
+3158h4k0vwjdv8699yHEN97PdF84m81mqxOz+juKBRHFK/EwAAgOdSlzGnUYgNkm
+mCROFWtjeneNWaFdEnq9MItx1OascPeyxnWMjq7LLYMSESP4tgUV5KdlaVAXR6q/
+833u27/NodkDcNH2UK+IyT+Kt/uCOoIIL4ttxo/PvZTphzV8n6s0sJJE3/BrRxgv
+CTkVU6zosyJsyau8/vayQYGPuBuEQVs4Tr+vZ42izbkHgElcZv9oYjJsxaqZqqMz
+fWPte7m6Pl/pvtmlhPmpZ+ej7y8SRysBV+3aHNXaE1J3sIOmYxighlgZapSjHl/A
+9N/KXdoLAjIZtBAOQ2ZFyRz/c2+VUqJgwiwdxoaFaYn2eUM+HSTbZfdGXBS/yyZL
+YsM+L4M2aizQvDIRXzy8vG0vpHQEvPlXL0Gg0gyk0fox0OsAP5CfXmHC/AvYOHM8
+y81X2QqDf33Au1RIgog4cLqq2wpXEARWbAj0BAMIeJoCDCu9Mz2juK1ui2wr8AZ0
+42PCUgZK6CdUI18AsvApUhPsNunF7ZOc5mFMuaEGjjWJvrTG3qyrCY73ySBiGXWo
+92ZB7FXu2MzgujPBEigByqeF6IV2x0EBHw/VrcxXq6Slgmik6G0SD/48l5mGCxM0
+Wr91raB9zQlwDbtD3PCbjA6DtkMrRyAq+81g75N6uiztGPCVw9n1HoGOSjN1hAhe
+SgQQlcXbDLpzfdPFowDEHclFFfUODCIOuF+FgmxlAz5Exr9JkJdozBFqRZ4iF/tf
+E5sHB0rzeUcY3J6VjTsjULjE4GSg5trsOc8GHUnFn9wwwkf9nR/Mr1RYcX0GkTcy
+iUskw+AoRz6svOfAWIDJY450wgD0MHZK08IfUUsYTGecoXcvWf/hITtv/Af5MpQA
+wuGEDltVDeu9EAu65SZlMkkMuQD1h3KOQjUJ6nY4a4M2CQ51ggs/c+vsemxsuYlG
+vSuhrfXt6HGD3dhsOEeyEvIcjjpP1Ku5mqrPhqXFli1swfohhYGGVO+fM7G3l7wF
+kAIi0B1szn0K13qRqBIwjnWL+orP1KLzvczCH6yD0FZY90CDdMtM0VB6AqT4BFh6
+5+ygjA4YiA7fFYBm8510ybUcNfzU3gUIJ5pF8MdGizO54tCPSK6U+iVRY4qfCFdu
+IiOZ7FUUn78VIxQUMYMrozy7kn/0PQZa7KKRbXJ8sg0sgrQapwpgUjdMwuYZPGGv
+1Jw5/+WUGWMbGxmlpHcEOmsPZpITH557M/kHyk9Ud0iKwciBI2mGLxiafCuLrUY4
+TknzOqbZgjdllcUG4cDBEQuBO/GSj1LUfpkCDQRnKRF7ARAAo5H9/6cStbyjWFeb
+G6qDn6pT+4v1rlbRZo0rYwWkDmEAjOZMRC9SJipTCdQeNFlv6HEiiCvl3bmZIqrZ
++zvLI6U1+2dH7k06xNqIFLTV0zbr+tUkOwspg5nr59KsuNP01WBS0ELzunO/zHj+
+BOEdPg1KvB0IQFtqAwaAfuny67YvTr9O7Yz07ZCfTxPtHf6FJ80FPeRa0LoZYnW4
+UmSGtm1f59VD9+qe4yhRtNanamXUKjf8BTw0rQwjoJhVT5Mg0Z6hW6fhFrD57Lgd
+8fBi5ZHHUlR4z1+nqGCUoHlHjc0JVyK8j8fofKafow/79ITaOqBzv+P3psY9ecBg
+7wGaOHrqzRzRxAfKYRO2IaFHRGnsEE8FnwSEL00uPVxpiiTavrLJFEjku9GmP3OY
+3rbwIPXbw1m9mZG1yAVbSEEf58WSWeoBp0O6qrwAdIbdgUX4BkQ8bX5MtUjXp5tm
+0StmjQiZ7O91cg0VuWtrfj/I4E3xtloNzhtG2QLI4s7iAL1orhClxEuZRO9alUCS
+cnRvhmw2Dh6sB6i56evcZdUFwxMXOByxfWr0fxX4QlR8jYqMPj7UMNj2PccTBOQX
+umIW2cdGEeni9vrE9cLfZRSNCwPWAXWtr1zQW54Jx5DjCGHobQk53Z7kE+MZVAje
+gOaT0u50cljBNfJootuln4+gbGMAEQEAAbQlUGV0ciBMYXV0cmJhY2ggPGxhdXRy
+YmFjaEByZWRoYXQuY29tPokCVwQTAQgAQRYhBGjSGCM0KhNoOus+TvtMaFtdwcE+
+BQJnKRF7AhsDBQkDwmcABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEPtM
+aFtdwcE+doMQAI5mnNA8aH0dfeOZnz/NrMwY6H7jK/+lYatCx05e1TfK+zz9feRK
+sxgP3Pjj0p9igo3jIdPcN5/YnlmVEeplDmSiKOOdendviy+sA8sukMo07Q+m1pYW
+NzFtyiZd+c44mp9I1l7h6rktIY9XDedrlAkNog1VlUet9eNpmgXt2OmJNDmYftWc
+KIpyw/ZLaubjRcAmxwsn7I6dWnT66Ffg9H8trcRlWipVWP8imO0EIpwC8RbhuNgk
+xjt/cVf3CEpzokF4n0k3nqYmt90NNtGc0kG5QAlTvlUuHpNWzuzvdAPtMy3KEaXI
+fu3IEZeIKCxSgWXTm7zRKUn0F6jKAsLXhK/WOA1Aa7NdAUwMxrEndfNoqBrusaLD
+lpzWU7USv2YT+Pf3aQ7u1szg2J8V5eqRP+E8wwe54RNCgQrcDgUq5abyncsvull3
+GqJvzvZC7/Q3Th/g5Wc+dRaGBz0O9FBuRPQwjrnB932xW1fDf17cScpVKAvV/jwn
+tpWXf7nSv2M0o9fihnTBl4d2c2EBKtTdp5W0IpeRl5uLad3AYoouP6RoZ+/Id/Zg
+NeaQKH/ZlCxk5S9GLzYhm665ysOYRkh7NfoThRtvAqAeDcTKWGDG1nQok2KKOSyq
+S81PT2AlMz7A26R0vsH/9lQ1uZFIhIGbxZXlGERZwXd1s+lgfWTbB5K+iQIzBBAB
+CAAdFiEEuGgoR3ZN9g31LZksvDkF8jUXnPEFAmcpGAUACgkQvDkF8jUXnPFdGQ/+
+L7uA7EMB+Yh0urhZuOltZSNtge6b+UbLZTd8DRsf044e+Z0NJWdQ2saLBptGhIcn
+as4Qd0gS+QkWB7lMrJ31uux15ZBjFsGtyqK+VoH8JIPvV8Mr5XojqA+UYUpXP6ns
+ILrdkUvNzpeA51IxYuVMWcut8SUVYzjD11YG1P8LFzydsImaYe7se+RE85F3/2Po
+kZNe0d0Gh36uyfJSND80XrrxLpROgabQgHNG0drL/DHjdoa3F0V5EUoG7NBwUrmB
+RlWKYCLUFfW+8mQn6RVK8JIV9WaHrzi/KAZLonZb5dCjO0e+Ol16pyUofLA8SN7B
+aqjens8ho297GtE3darkXmj5p3p4YPur/D+oZCNIH+BYMsht46VtE3v6V10P8KA2
+6MgNo5qME1Q0kC1DUYi68cPeDgrQBMWa+nF+m9i2aGeAyi3qDhZu03JLhOYAhv45
+OVRawm9vFqyKiBRANVogTRr+ch4zywaapwfVLQ+xiwVLqlT5n/iIzWCQ0hA15eKZ
+gJV0kTXL4OWKBeJqSNnnLVm4AhZ2OpKHMsjE7BEopvCe9JZWFIrjtQ9TrriByOx0
+3anWkmm7b4lZ1HKDOI/Cxyz8BZvYizo7hSOdGjLrFBTD/Wk0swvpzB4NKh5I6N7k
+gppXMTaWp36+KmQx66JzaZjepGl1VMNFdgiP6Sw6pO+5Ag0EZykRewEQAK4EY+06
+GeuX4wLlUqAMWCnbFELuhBZGWFLEIvP6WJS1WOvee45RVcpVfYMp3AqymiNRahAl
+RMtSQ9YtXSdlBPkhtNcoV/hqjcNywMdbsy+Rs27pRk/DJVC0yVL4ABrSSlwhfNa4
+6X4ZvPr8GGDvjAUhK6NXQ7WrZJxYR9/U0nqRGtGuPBLhFey1H60n5axP8+2f9pFC
+NbDJ13HbrhVju+RUeE8Gq5WJI5dea5SfYnXFERsT/zO+pw7ZaaSDmWKR1a88P6Bk
+DD7e63ZIaAa849M/Dz+OgzNEgbyRjvgbO0OEIrS2x61lGoW7F9prEgzj97NIiBu6
+qpNCYJefkpfPENrk+wmOUthJfh6E7uphlliQams6dqXAc3Z+xBN9jFf74RpzVmIP
+K/MFNr0EcUMFgURpBtaTrk4dGMh++v5i4qKxxwJHf4RsGCDsgH9ZZDemKz5q8uFN
+TI1kbTnsKNt+d7L45U+3/mRm4l22g8eu+AvD6R4GfKjsyzEFCyGK7TmVYj0Y+EGR
+9+YbRQ1GahXqtrR/aLC09LSyxQTqYfKU8KusnoceEbBOigEZUNPybpzibwHl1VEV
+9crR5eT8MPHgs8xdpjQ7gRuPi12fvc83unpUsNIHSCxZqXoilGsz2+zpX2si3PxB
+tK/tTo6ZFRLijhHs250Y1agp4MyXYq91A2VTABEBAAGJAjwEGAEIACYWIQRo0hgj
+NCoTaDrrPk77TGhbXcHBPgUCZykRewIbDAUJA8JnAAAKCRD7TGhbXcHBPozGD/0Y
+fkktGwGq2vPZUI/Fscv+VnEqVt94dBnS0/6GyYvhI7Tf81v+72URlQeX8TUQox9B
+8d3Aru5b2+iSkPcvH70PbY8jt/yTwHtSlFzf6+YPIl+oyTz7DoiILSjrO51ntl8g
+KmIb8Q9W74xV6VFIJ4m8rH04MKFpIlzUDq660JYQIGtOUFugSfg7aLVU/0j4WKKE
+KfAfg93wYTKKd+JgRFy4FZPriem7HvlUSi2VKffdrrUF/PX35X74iKdPQoEADZi8
+KkMZULDtyQ6ZOu2hiDpArjo5hDadKM314Z65VnM11hjiEhmTF3IyGBllb0qBIk0L
+nBVHuMYmiqBNJEbaqHLqIju8/RvFlYV+AMISeA7B68knbJcao13ogtDpuJ4hpgCj
+j2B1n0NWMcju0gteu1sfsIaQbWHevH2vgl5LJDCNtUJN/NoWB2Uov27wEvsongwY
+3du40TnM+5ejwf4r8D3wX+JpVCAhfr3Oc0knw14nRqFPAe1E7DNURJ8xfEV9iPRA
+swo6qoh7IIxNETUG1rywRExNt6tHsojx0Wb0I0IB7CnWRK9F6oNRp0S4kVgp+Jeh
+a9NGXFK2hn8qBD/rpUPsj/OdkiBN+C7Ai07rCNez+IKdnUfXkOJqLCOyeUwC9WPl
+uFPB9RnnghYM4xhMWf8XvSLOOk/vgPxiqR5ANLObsbkCDQRnKRLhARAAuh+b2Oxj
+9q+RRZ+pkDVf/M6P01yDmDhwtYHzi/LW8PFHC6iQlzMReyv1R5n3uCEpAZ++mdUe
+Cgo2TmFnYdpmxEgdaMIW98uqe4fuHhoXU2Mh4eiN7jyJvXQCsijCDYzifoj03HY7
+nTVjw4+BSSu9kA3/vEqU9A5YjG01MmVSMaIaTrqZqsnypK6r2exJa7YVRYwRqpLY
+C5ksikDVK9ftdfhjnsnYGS4pYyfMNSHY1KBMpHjT7wEkM+KZ2WRpjTZZ7nP9u4Lf
+fJMKgcclRgf+13CeSaJfVIhjJlxGVLkloE8XJbOeh2vkK257e9BenEFgQnyLCpGJ
+8YNsnsJVhxU1aA62dT7jmnOVMBhnGoNhMyzzfvUw0REz2VbpZBkiwZRfZ9MWUBsy
+bneH8NwzZMQQLCc/yo/jnPrmDS+tgl4CXGzBtpxPUZSMuY4tHZZ2vBb0zcfhY7P1
+CrHuylXLFzkOO/XRP3w1F8I1UqJCjdTKjdjCDF/VWtedHee1iEsSHxPGH8fHp4Qp
+rBDDwZ4NnfilYNHMDWm6U1bzhX2ynqcGArQSd1Ny/oL7JzE1qoH/nNrwVvOSSNWF
+UTXFXeLy+SOXJdFJpGP+/wV+gYfyczoUP6vmCdK1Hs15WQvKzyP/nmLS5uLilfxV
+KrxZDI6SNrS4f/XkHcGnYByFKUhq5gVN0ZcAEQEAAYkEcgQYAQgAJhYhBGjSGCM0
+KhNoOus+TvtMaFtdwcE+BQJnKRLhAhsCBQkDwmcAAkAJEPtMaFtdwcE+wXQgBBkB
+CAAdFiEEcgDrLD9eSIRjwM6ezcroySfGvjEFAmcpEuEACgkQzcroySfGvjExiQ//
+TKQ2Ci+sqNSVIcwg/k0Go1i4cA7lhKNdYRBCaIThB9jMqNg2zgPzgELBcaVJL8xw
+0E2x2ZvBejM4X+eTrmkdufcxHR8B/zBF8oPlD2pgs/zZmZEO1gq4Cdab7yIoVNNr
+foCZShxOCPR2wIixcYZtt5f7Z3zSXqkjIec6sTOedT75ZXrpQbvINeUkvOJfMCOi
+ailauvDfv8k5iJUVbP+Dx1vOc88bvewVJcbLID4HIRr/PS+k1D10zGbnF71TnxGZ
+r7anMZCSFCHJ5WV+BSwHHKtxRy+bJ1x9ML45Jcr1anTXeaHIeSKNzFBigJQSgHv0
+euegkD3Rmw+IcxNb4l536selaNR0UAwx1DC1qpjBtnE9/pXdTEsZQxq9kMrj0d+f
+VKFjOKADVIpkx7o0dZ1jmbUmdjQVyGDgHE+Emgdd726/2ftWriW2uPeUC6YZiqbt
+vBnCnwF+aV6P1nrE0BWJchLyBjDCe5Y2oXBAYF6xwpDPfMPr4oscqzPV4TWVULBi
+brtRWgSxmvinIGFx9T9wQCVfX254dqBaAEhRMImoT/YP+6evRZKqQODRhI44OG7u
+V71IVAJ8BHEBN8hxvQM3WPs1fhwMBFCyGfr/x/U4/c78R9JhxkU9VwmMbLGQP7VP
+1QgfiHqZpHMk8ZUmQn6KLeurzWcnwPFkwgFPZED8OQOMXxAAio3DhWr5KDd3mICH
+ALNY0A2ipb/JH6LSHxu0S3MLa/bF6PbqRY1+fKMT/cFVxln99rNUrX+hDRbc7qbh
+KkxvGmcnXnkcTHah9bfUghEanlKkBr1g1ik3zgEnpO/x3+X39Ov+ge92MDawV0nq
+k9R/9tS+ZD/ph72Q9kx3ZfVNSL0eWxjuwBzFW0Zwh5TAX4raSmyQCmAXi05O3YmN
+iq4arSUg5oAOMRZ+d96DsrAS4Sdtlx6/CuKTBzEaGPQLQ9wJNB0Vmd/eQWTP99KY
+cAdIwj5BJ5P0Z7+xhsVjQOntn4otnP6vN6RuDtYrS6M7TCN/ZeKCvN/G0nRac4D+
+IJX3CYYtYXgaoDuoetUWtc7O5PzHRETaBt/46ob2lzf6cT5QyVujTfz+i0rGEc63
+pvXK8mV+K7BFY/DHpdEhl1pDw2YYLbBmUthQWdsL6/TVvpMe/wZadvJ/by3AeRzQ
+eusUucuSo9UNN7Yj8u3dRhxNgsSiU96A/SFlAoB5s3Onh5K4WEVCBu/INjdi+r2B
+LJePSnA3I7VkRE9Haf1D28jtBzm3Xbft2rs3lO18FcCqw6kd7Ih3e0tZ8uUG9UDv
+qTDHTUHLAWvwrq38gKKAu2RMaU06A5kR87RcQiizxOwBIwiHuUWMU4/Hyx6fXsOD
+hEs0O6AFDarNDZGee2amKTAyZpG5Ag0EZykTxQEQAOwGV1boBD3vDLsoAT62nGxb
+SqXiBsObxnpWbNifOzM9BUGPOIpHsSH32PZGG/+LNjNdECfyyP1RysH5OT7j92Q8
+vgRQoG3X985gbOjYyZc0xvAkTSvWxOiy5CuF3X8sJ3NSerQDXwjP9qVqLVj/3FB8
+nka1HFS7KzC3Zo/kzCoxeZ3/hV3PTWIjcoJvtBSCKPZyOJxnRqWfi5BNJo3S2SR1
+mxV967zawXiZ8MeeBl6rLhOfCBtz9g+bqrXZYoenuMn5Js2mcH0haYeMSV3UWIC4
+kinzr1EJxs+L1/hVCVBNiiDc6DXcFXoz9ZVc9kjpZTOMoZVDkRkyOeen+5Sya9wK
+4teLmDLME4+pgeHCS/Wa4KrYyEWe7NpG1VTkSJnRS+fyYGTWtwEiuwT6J9U0t1d5
+hbxhM7YAhlnOEnNVmqa3Bq3yqJs9G/7gicZ7CIJ9JBHKTJzOnKfpGhxBSOgOoCOa
+WW6uVCzDqfrYPmCUIKQmanB441xJFGuHVPMLBjVjswoMKGkK3gM6KMRCDYQ53u6s
+FK+Jcl8HobBSezVIUKpKVX3IW9d506cE0FhSW/NvWJv0FIMVloyC2BpOjSWVgEwX
+tk/m3SKPsgCAcCqzi7xlloR8+E9C2xci9cdGG5faghgSjaP6j0qDww/slRPQJc5A
+DIeukkOYTCiSiDwQtblJABEBAAGJAjMEGAEIACcWIQRo0hgjNCoTaDrrPk77TGhb
+XcHBPgUCZykTxQMbIAQFCQPCZwAAADcWD/4qJRLn7TcMtRMF43Yn+dX+O13YrxBC
+T4n1QVmiPsGrUca4Vg1J+trV6IMsGrhktpiaV0qeL/km0h02m4gEDZKDyWWXdeWh
+EXFaTVy9yCpSXUWJl5gSXTSwxrqBWyWLlLLk4UT9l9sk5mMdy0JA8unobV4M/eXQ
+ggR11DL3ji7aO0hsqxyxXkJcawWjVGW5KL1EaoDKIJ/CwxOI5ipFueMIRQjQvw9A
+o/w2fq11qVXY9zknk6pFkp/RDHLes+wVHDtebZfJ9xV7Mb1mf/k03dT56GaA/U3E
+XvJ2FdgWR+zf+YMEa9MPDHYo2UNEvk9mOk247M8s+OeexdlkPgyKW5A8mtYuY/dR
+j8W6C4pLcMWa+d/vIUpm5Guw0F5q0AWk9/FbBe9HLztEevvRnuHXmfTZeto/nCAi
+Yg4pCj6p3JoN5CLebR8YtWm9AJBbX1kgVvqSU2VgwYIFsxBEz8Wu2h7z/eSCSeIg
+ARFbTlJ6cBrRkXCVyhbv0LPWWUfAUqiEtdGxrA4Xx/jKrI02JjRdW/bZkXjSka8K
++cDlpcr9ixBWW5LkWsOdiL8jExfTGw25FA7Wd1HiHnBv36Mu/zb+0/I63d+fLq93
+e3lmmVx9qQF8p5Okf4ojY9YoIHVkLS7t9AgFjm/ucmpEGbXxyPk2Cr3l+b5R41x3
+dBW9kxiuWpZN3Q==
+=iuRK
+-----END PGP PUBLIC KEY BLOCK-----

gating.yaml

@@ -0,0 +1,16 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_context: bodhi_update_push_testing
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
+
+--- !Policy
+product_versions:
+  - fedora-*
+decision_context: bodhi_update_push_stable
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
+

macros

@@ -0,0 +1,8 @@
+%add_changelog(changelog:) %{lua:
+  local f = io.open(arg[1], 'r')
+  if f then
+    local content = f:read('*all')
+    f:close()
+    print(content)
+  end
+}

make-rhat-patches.sh

@@ -1,40 +0,0 @@
-#!/bin/bash
-
-POLICYCOREUTILS_VERSION=2.4
-SEPOLGEN_VERSION=1.2.2
-BRANCH=master
-
-REBASEDIR=`mktemp -d rebase.XXXXXX`
-pushd $REBASEDIR
-
-git clone git@github.com:fedora-selinux/selinux.git
-pushd selinux; git checkout $BRANCH; COMMIT=`git rev-parse --verify HEAD`; popd
-
-# prepare policycoreutils-rhat.patch
-tar xfz ../policycoreutils-$POLICYCOREUTILS_VERSION.tar.gz
-pushd policycoreutils-$POLICYCOREUTILS_VERSION
-
-git init; git add .; git commit -m "init"
-cp -r ../selinux/policycoreutils/* .
-git add -A .
-
-git diff --cached --src-prefix=a/policycoreutils-$POLICYCOREUTILS_VERSION/ --dst-prefix=b/policycoreutils-$POLICYCOREUTILS_VERSION/ > ../../policycoreutils-rhat.patch
-
-popd
-
-#prepare sepolgen-rhat.patch
-tar xfz ../sepolgen-$SEPOLGEN_VERSION.tar.gz
-pushd sepolgen-$SEPOLGEN_VERSION
-
-git init; git add .; git commit -m "init"
-cp -r ../selinux/sepolgen/* .
-git add -A .
-
-git diff --cached --src-prefix=a/sepolgen-$SEPOLGEN_VERSION/ --dst-prefix=b/sepolgen-$SEPOLGEN_VERSION/ > ../../sepolgen-rhat.patch
-
-popd
-
-popd
-# echo rm -rf $REBASEDIR
-
-echo policycoreutils-rhat.patch and sepolgen-rhat.patch created from https://github.com/fedora-selinux/selinux/commit/$COMMIT

plans/selinux.fmf

@@ -0,0 +1,7 @@
+summary: selinux tests - Tier 1 | policycoreutils
+discover:
+    how: fmf
+    url: https://src.fedoraproject.org/tests/selinux
+    filter: "tier: 1 | component: policycoreutils & tags: generic, fedora"
+execute:
+    how: tmt

selinux-autorelabel

@@ -5,13 +5,38 @@
 
 # . /etc/init.d/functions
 
+# If the user has this (or similar) UEFI boot order:
+#
+#             Windows | grub | Linux
+#
+# And decides to boot into grub/Linux, then the reboot at the end of autorelabel
+# would cause the system to boot into Windows again, if the autorelabel was run.
+#
+# This function restores the UEFI boot order, so the user will boot into the
+# previously set (and expected) partition.
+efi_set_boot_next() {
+    # NOTE: The [ -x /usr/sbin/efibootmgr ] test is not sufficent -- it could
+    #       succeed even on system which is not EFI-enabled...
+    if ! efibootmgr > /dev/null 2>&1; then
+        return
+    fi
+
+    # NOTE: It it possible that some other services might be setting the
+    #       'BootNext' item for any reasons, and we shouldn't override it if so.
+    if ! efibootmgr | grep --quiet -e 'BootNext'; then
+        CURRENT_BOOT="$(efibootmgr | grep -e 'BootCurrent' | sed -re 's/(^.+:[[:space:]]*)([[:xdigit:]]+)/\2/')"
+        efibootmgr -n "${CURRENT_BOOT}" > /dev/null 2>&1
+    fi
+}
+
 relabel_selinux() {
-    # if /sbin/init is not labeled correctly this process is running in the
-    # wrong context, so a reboot will be required after relabel
+    # Switch SELinux to permissive mode, fix labeling issues (or execute shell
+    # and have the user fix them) and reboot the machine so that the correct
+    # labels are applied to all services.
     AUTORELABEL=
     . /etc/selinux/config
     echo "0" > /sys/fs/selinux/enforce
-    [ -x /bin/plymouth ] && plymouth --hide-splash
+    [ -x /bin/plymouth ] && plymouth --quit
 
     if [ "$AUTORELABEL" = "0" ]; then
 	echo
@@ -27,13 +52,25 @@ relabel_selinux() {
 	echo $"*** Relabeling could take a very long time, depending on file"
 	echo $"*** system size and speed of hard drives."
 
-	FORCE=`cat /.autorelabel`
-        [ -x "/usr/sbin/quotaoff" ] && /usr/sbin/quotaoff -aug
-	/sbin/fixfiles $FORCE restore > /dev/null 2>&1
+	OPTS=`cat /.autorelabel`
+	# by default, use as many threads as there are available
+	# another -T X in $OPTS will override the default value
+	OPTS="-T 0 $OPTS"
+
+	[ -x "/usr/sbin/quotaoff" ] && /usr/sbin/quotaoff -aug
+	echo
+	echo $"Running: /sbin/fixfiles $OPTS restore"
+	/sbin/fixfiles $OPTS restore
     fi
+
     rm -f  /.autorelabel
     /usr/lib/dracut/dracut-initramfs-restore
-    systemctl --force reboot
+    efi_set_boot_next
+    if [ -x /usr/bin/grub2-editenv ]; then
+        grub2-editenv - incr boot_indeterminate >/dev/null 2>&1
+    fi
+    sync
+    systemctl reboot
 }
 
 # Check to see if a full relabel is needed

selinux-autorelabel-generator.sh

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 
 # This systemd.generator(7) detects if SELinux is running and if the
 # user requested an autorelabel, and if so sets the default target to
@@ -18,6 +18,15 @@ fi
 set_target ()
 {
     ln -sf "$unitdir/selinux-autorelabel.target" "$earlydir/default.target"
+    AUTORELABEL="1"
+    source /etc/selinux/config
+    if [ "$AUTORELABEL" = "0" ]; then
+        mkdir -p "$earlydir/selinux-autorelabel.service.d"
+        cat > "$earlydir/selinux-autorelabel.service.d/tty.conf" <<EOF
+[Service]
+StandardInput=tty
+EOF
+    fi
 }
 
 if selinuxenabled; then

selinux-autorelabel-mark.service

@@ -13,3 +13,6 @@ ConditionPathExists=!/.autorelabel
 ExecStart=-/bin/touch /.autorelabel
 Type=oneshot
 RemainAfterExit=yes
+
+[Install]
+WantedBy=sysinit.target

selinux-autorelabel.service

@@ -11,4 +11,4 @@ ExecStart=/usr/libexec/selinux/selinux-autorelabel
 Type=oneshot
 TimeoutSec=0
 RemainAfterExit=yes
-StandardInput=tty
+StandardOutput=journal+console

sepolgen-fedora.patch

@@ -1,394 +0,0 @@
-diff --git sepolgen-1.2.3/ChangeLog sepolgen-1.2.3/ChangeLog
-index 7cc0a18..bda7a2e 100644
---- sepolgen-1.2.3/ChangeLog
-+++ sepolgen-1.2.3/ChangeLog
-@@ -1,3 +1,6 @@
-+	* Remove additional files when cleaning, from Nicolas Iooss.
-+	* Add support for TYPEBOUNDS statement in INTERFACE policy files, from Miroslav Grepl.
-+
- 1.2.3 2016-02-23
- 	* Support latest refpolicy interfaces, from Nicolas Iooss.
- 	* Make sepolgen-ifgen output deterministic with Python>=3.3, from Nicolas Iooss.
-diff --git sepolgen-1.2.3/src/sepolgen/Makefile sepolgen-1.2.3/src/sepolgen/Makefile
-index 9ac7651..d3aa771 100644
---- sepolgen-1.2.3/src/sepolgen/Makefile
-+++ sepolgen-1.2.3/src/sepolgen/Makefile
-@@ -11,5 +11,4 @@ install: all
- clean:
- 	rm -f parser.out parsetab.py
- 	rm -f *~ *.pyc
--
--
-+	rm -rf __pycache__
-diff --git sepolgen-1.2.3/src/sepolgen/access.py sepolgen-1.2.3/src/sepolgen/access.py
-index a5d8698..7606561 100644
---- sepolgen-1.2.3/src/sepolgen/access.py
-+++ sepolgen-1.2.3/src/sepolgen/access.py
-@@ -90,6 +90,8 @@ class AccessVector(util.Comparison):
-             self.audit_msgs = []
-             self.type = audit2why.TERULE
-             self.data = []
-+            self.obj_path = None
-+            self.base_type = None
-         # when implementing __eq__ also __hash__ is needed on py2
-         # if object is muttable __hash__ should be None
-         self.__hash__ = None
-@@ -138,6 +140,29 @@ class AccessVector(util.Comparison):
-         return "allow %s %s:%s %s;" % (self.src_type, self.tgt_type,
-                                         self.obj_class, self.perms.to_space_str())
- 
-+    def base_file_type(self):
-+        base_type_array = []
-+        base_type_array = [self.base_type, self.tgt_type, self.src_type]
-+        return base_type_array
-+
-+    def __cmp__(self, other):
-+        if self.src_type != other.src_type:
-+            return cmp(self.src_type, other.src_type)
-+        if self.tgt_type != other.tgt_type:
-+            return cmp(self.tgt_type, other.tgt_type)
-+        if self.obj_class != self.obj_class:
-+            return cmp(self.obj_class, other.obj_class)
-+        if len(self.perms) != len(other.perms):
-+            return cmp(len(self.perms), len(other.perms))
-+        x = list(self.perms)
-+        x.sort()
-+        y = list(other.perms)
-+        y.sort()
-+        for pa, pb in zip(x, y):
-+            if pa != pb:
-+                return cmp(pa, pb)
-+        return 0
-+
-     def _compare(self, other, method):
-         try:
-             x = list(self.perms)
-@@ -257,7 +282,8 @@ class AccessVectorSet:
-         for av in l:
-             self.add_av(AccessVector(av))
- 
--    def add(self, src_type, tgt_type, obj_class, perms, audit_msg=None, avc_type=audit2why.TERULE, data=[]):
-+    def add(self, src_type, tgt_type, obj_class, perms, obj_path=None,
-+            base_type=None, audit_msg=None, avc_type=audit2why.TERULE, data=[]):
-         """Add an access vector to the set.
-         """
-         tgt = self.src.setdefault(src_type, { })
-@@ -270,7 +296,9 @@ class AccessVectorSet:
-             access.src_type = src_type
-             access.tgt_type = tgt_type
-             access.obj_class = obj_class
-+            access.obj_path = obj_path
-             access.data = data
-+            access.base_type = base_type
-             access.type = avc_type
-             cls[obj_class, avc_type] = access
- 
-diff --git sepolgen-1.2.3/src/sepolgen/audit.py sepolgen-1.2.3/src/sepolgen/audit.py
-index 724d3ea..dad0724 100644
---- sepolgen-1.2.3/src/sepolgen/audit.py
-+++ sepolgen-1.2.3/src/sepolgen/audit.py
-@@ -176,6 +176,7 @@ class AVCMessage(AuditMessage):
-         self.exe = ""
-         self.path = ""
-         self.name = ""
-+        self.ino = ""
-         self.accesses = []
-         self.denial = True
-         self.type = audit2why.TERULE
-@@ -237,6 +238,10 @@ class AVCMessage(AuditMessage):
-                 self.exe = fields[1][1:-1]
-             elif fields[0] == "name":
-                 self.name = fields[1][1:-1]
-+            elif fields[0] == "path":
-+                self.path = fields[1][1:-1]
-+            elif fields[0] == "ino":
-+                self.ino = fields[1]
- 
-         if not found_src or not found_tgt or not found_class or not found_access:
-             raise ValueError("AVC message in invalid format [%s]\n" % self.message)
-@@ -361,7 +366,9 @@ class AuditParser:
-         self.path_msgs = []
-         self.by_header = { }
-         self.check_input_file = False
--                
-+        self.inode_dict = { }
-+        self.__store_base_types()
-+
-     # Low-level parsing function - tries to determine if this audit
-     # message is an SELinux related message and then parses it into
-     # the appropriate AuditMessage subclass. This function deliberately
-@@ -499,6 +506,61 @@ class AuditParser:
-         
-         return role_types
- 
-+    def __restore_path(self, name, inode):
-+        import subprocess
-+        import os
-+        path = ""
-+        # Optimizing
-+        if name == "" or inode == "":
-+            return path
-+        for d in self.inode_dict:
-+            if d == inode and self.inode_dict[d] == name:
-+                return path
-+            if d == inode and self.inode_dict[d] != name:
-+                return self.inode_dict[d]
-+        if inode not in self.inode_dict.keys():
-+            self.inode_dict[inode] = name
-+
-+        command = "locate -b '\%s'" % name
-+        try:
-+            output = subprocess.check_output(command,
-+                                             stderr=subprocess.STDOUT,
-+                                             shell=True,
-+                                             universal_newlines=True)
-+            try:
-+                ino = int(inode)
-+            except ValueError:
-+                pass
-+            for file in output.split("\n"):
-+                try:
-+                    if int(os.lstat(file).st_ino) == ino:
-+                        self.inode_dict[inode] = path = file
-+                        return path
-+                except:
-+                    pass
-+        except subprocess.CalledProcessError as e:
-+            pass
-+        return path
-+
-+    def __store_base_types(self):
-+        import sepolicy
-+        self.base_types = sepolicy.get_types_from_attribute("base_file_type")
-+
-+    def __get_base_type(self, tcontext, scontext):
-+        import sepolicy
-+        # Prevent unnecessary searching
-+        if (self.old_scontext == scontext and
-+            self.old_tcontext == tcontext):
-+            return
-+        self.old_scontext = scontext
-+        self.old_tcontext = tcontext
-+        for btype in self.base_types:
-+            if btype == tcontext:
-+                for writable in sepolicy.get_writable_files(scontext):
-+                    if writable.endswith(tcontext) and writable.startswith(scontext.rstrip("_t")):
-+                        return writable
-+                return 0
-+
-     def to_access(self, avc_filter=None, only_denials=True):
-         """Convert the audit logs access into a an access vector set.
- 
-@@ -517,16 +579,23 @@ class AuditParser:
-            audit logs parsed by this object.
-         """
-         av_set = access.AccessVectorSet()
-+        self.old_scontext = ""
-+        self.old_tcontext = ""
-         for avc in self.avc_msgs:
-             if avc.denial != True and only_denials:
-                 continue
-+            base_type = self.__get_base_type(avc.tcontext.type, avc.scontext.type)
-+            if avc.path == "":
-+                avc.path = self.__restore_path(avc.name, avc.ino)
-             if avc_filter:
-                 if avc_filter.filter(avc):
-                     av_set.add(avc.scontext.type, avc.tcontext.type, avc.tclass,
--                               avc.accesses, avc, avc_type=avc.type, data=avc.data)
-+                               avc.accesses, avc.path, base_type, avc,
-+                               avc_type=avc.type, data=avc.data)
-             else:
-                 av_set.add(avc.scontext.type, avc.tcontext.type, avc.tclass,
--                           avc.accesses, avc, avc_type=avc.type, data=avc.data)
-+                           avc.accesses, avc.path, base_type, avc,
-+                           avc_type=avc.type, data=avc.data)
-         return av_set
- 
- class AVCTypeFilter:
-diff --git sepolgen-1.2.3/src/sepolgen/policygen.py sepolgen-1.2.3/src/sepolgen/policygen.py
-index 34c8401..f374132 100644
---- sepolgen-1.2.3/src/sepolgen/policygen.py
-+++ sepolgen-1.2.3/src/sepolgen/policygen.py
-@@ -82,8 +82,9 @@ class PolicyGenerator:
-             self.module = refpolicy.Module()
- 
-         self.dontaudit = False
--
-+        self.mislabled = None
-         self.domains = None
-+
-     def set_gen_refpol(self, if_set=None, perm_maps=None):
-         """Set whether reference policy interfaces are generated.
- 
-@@ -153,6 +154,18 @@ class PolicyGenerator:
-         """Return the generated module"""
-         return self.module
- 
-+    def __restore_label(self, av):
-+        import selinux
-+        try:
-+            context = selinux.matchpathcon(av.obj_path, 0)
-+            split = context[1].split(":")[2]
-+            if split != av.tgt_type:
-+                self.mislabled = split
-+                return
-+        except OSError:
-+            pass
-+        self.mislabled = None
-+
-     def __add_allow_rules(self, avs):
-         for av in avs:
-             rule = refpolicy.AVRule(av)
-@@ -161,6 +174,34 @@ class PolicyGenerator:
-             rule.comment = ""
-             if self.explain:
-                 rule.comment = str(refpolicy.Comment(explain_access(av, verbosity=self.explain)))
-+            # base_type[0] == 0 means there exists a base type but not the path
-+            # base_type[0] == None means user isn't using base type
-+            # base_type[1] contains the target context
-+            # base_type[2] contains the source type
-+            base_type = av.base_file_type()
-+            if base_type[0] == 0 and av.type != audit2why.ALLOW:
-+                  rule.comment += "\n#!!!! WARNING: '%s' is a base type." % "".join(base_type[1])
-+            for perm in av.perms:
-+                if perm == "write" or perm == "create":
-+                    permission = True
-+                    break
-+                else:
-+                    permission = False
-+
-+            # Catch perms 'write' and 'create' for base types
-+            if (base_type[0] is not None and base_type[0] != 0
-+                and permission and av.type != audit2why.ALLOW):
-+                if av.obj_class == dir:
-+                    comp = "(/.*?)"
-+                else:
-+                    comp = ""
-+                rule.comment += "\n#!!!! WARNING '%s' is not allowed to write or create to %s.  Change the label to %s." % ("".join(base_type[2]), "".join(base_type[1]), "".join(base_type[0]))
-+                if av.obj_path != "":
-+                    rule.comment += "\n#!!!! $ semanage fcontext -a -t %s %s%s   \n#!!!! $ restorecon -R -v %s" % ("".join(base_type[0]), "".join(av.obj_path), "".join(comp) ,"".join(av.obj_path))
-+
-+            self.__restore_label(av)
-+            if self.mislabled is not None and av.type != audit2why.ALLOW:
-+                rule.comment += "\n#!!!! The file '%s' is mislabeled on your system.  \n#!!!! Fix with $ restorecon -R -v %s" % ("".join(av.obj_path), "".join(av.obj_path))
-             if av.type == audit2why.ALLOW:
-                 rule.comment += "\n#!!!! This avc is allowed in the current policy"
-             if av.type == audit2why.DONTAUDIT:
-diff --git sepolgen-1.2.3/src/sepolgen/refparser.py sepolgen-1.2.3/src/sepolgen/refparser.py
-index 9b1d0c8..2cef8e8 100644
---- sepolgen-1.2.3/src/sepolgen/refparser.py
-+++ sepolgen-1.2.3/src/sepolgen/refparser.py
-@@ -113,6 +113,7 @@ tokens = (
-     'AUDITALLOW',
-     'NEVERALLOW',
-     'PERMISSIVE',
-+    'TYPEBOUNDS',
-     'TYPE_TRANSITION',
-     'TYPE_CHANGE',
-     'TYPE_MEMBER',
-@@ -178,6 +179,7 @@ reserved = {
-     'auditallow' : 'AUDITALLOW',
-     'neverallow' : 'NEVERALLOW',
-     'permissive' : 'PERMISSIVE',
-+    'typebounds' : 'TYPEBOUNDS',
-     'type_transition' : 'TYPE_TRANSITION',
-     'type_change' : 'TYPE_CHANGE',
-     'type_member' : 'TYPE_MEMBER',
-@@ -502,6 +504,7 @@ def p_policy_stmt(p):
-     '''policy_stmt : gen_require
-                    | avrule_def
-                    | typerule_def
-+                   | typebound_def
-                    | typeattribute_def
-                    | roleattribute_def
-                    | interface_call
-@@ -823,6 +826,13 @@ def p_typerule_def(p):
-     t.file_name = p[7]
-     p[0] = t
- 
-+def p_typebound_def(p):
-+    '''typebound_def : TYPEBOUNDS IDENTIFIER comma_list SEMI'''
-+    t = refpolicy.TypeBound()
-+    t.type = p[2]
-+    t.tgt_types.update(p[3])
-+    p[0] = t
-+
- def p_bool(p):
-     '''bool : BOOL IDENTIFIER TRUE SEMI
-             | BOOL IDENTIFIER FALSE SEMI'''
-diff --git sepolgen-1.2.3/src/sepolgen/refpolicy.py sepolgen-1.2.3/src/sepolgen/refpolicy.py
-index 31b40d8..2ee029c 100644
---- sepolgen-1.2.3/src/sepolgen/refpolicy.py
-+++ sepolgen-1.2.3/src/sepolgen/refpolicy.py
-@@ -112,6 +112,9 @@ class Node(PolicyBase):
-     def typerules(self):
-         return filter(lambda x: isinstance(x, TypeRule), walktree(self))
- 
-+    def typebounds(self):
-+        return filter(lambda x: isinstance(x, TypeBound), walktree(self))
-+
-     def typeattributes(self):
-         """Iterate over all of the TypeAttribute children of this Interface."""
-         return filter(lambda x: isinstance(x, TypeAttribute), walktree(self))
-@@ -522,6 +525,19 @@ class TypeRule(Leaf):
-                                      self.tgt_types.to_space_str(),
-                                      self.obj_classes.to_space_str(),
-                                      self.dest_type)
-+class TypeBound(Leaf):
-+    """SElinux typebound statement.
-+
-+    This class represents a typebound statement.
-+    """
-+    def __init__(self, parent=None):
-+        Leaf.__init__(self, parent)
-+        self.type = ""
-+        self.tgt_types = IdSet()
-+
-+    def to_string(self):
-+        return "typebounds %s %s;" % (self.type, self.tgt_types.to_comma_str())
-+
- 
- class RoleAllow(Leaf):
-     def __init__(self, parent=None):
-diff --git sepolgen-1.2.3/tests/.gitignore sepolgen-1.2.3/tests/.gitignore
-new file mode 100644
-index 0000000..c120af8
---- /dev/null
-+++ sepolgen-1.2.3/tests/.gitignore
-@@ -0,0 +1,4 @@
-+module_compile_test.fc
-+module_compile_test.if
-+output
-+tmp/
-diff --git sepolgen-1.2.3/tests/Makefile sepolgen-1.2.3/tests/Makefile
-index 924a9be..e17eef2 100644
---- sepolgen-1.2.3/tests/Makefile
-+++ sepolgen-1.2.3/tests/Makefile
-@@ -4,8 +4,11 @@ clean:
- 	rm -f *~ *.pyc
- 	rm -f parser.out parsetab.py
- 	rm -f out.txt
-+	rm -f module_compile_test.fc
-+	rm -f module_compile_test.if
- 	rm -f module_compile_test.pp
- 	rm -f output
-+	rm -rf __pycache__ tmp
- 
- test:
- 	$(PYTHON) run-tests.py
-diff --git sepolgen-1.2.3/tests/module_compile_test.te sepolgen-1.2.3/tests/module_compile_test.te
-index 446c8dc..b365448 100644
---- sepolgen-1.2.3/tests/module_compile_test.te
-+++ sepolgen-1.2.3/tests/module_compile_test.te
-@@ -1,8 +1,8 @@
--module foo 1.0;
-+module module_compile_test 1.0;
- 
- require {
- 	type foo, bar;
- 	class file { read write };
- }
- 
--allow foo bar : file { read write };
-\ No newline at end of file
-+allow foo bar : file { read write };

sources

@@ -1,3 +1,6 @@
-59d33101d57378ce69889cc078addf90  policycoreutils_man_ru2.tar.bz2
-9ad9331b2133262fb3f774359a7f4761  policycoreutils-2.5.tar.gz
-d17b4072ed14d1f8d94ffd667ddc2864  sepolgen-1.2.3.tar.gz
+SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428ac90a0a73d7f3bd766a897062af142ba3cf39cdb79565ba78af960bcd2e35865cc26e14bf2305321780c918
+SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd
+SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733
+SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7
+SHA512 (selinux-3.9.tar.gz) = ccfe9c8907ef50e35cda1e8282a4e02e8d2e1749dabde856343f236724214c89d0bcd4e799f383961b990c5fb9a6b0191880a478a8930af447951c8b36689720
+SHA512 (selinux-3.9.tar.gz.asc) = 598498e3919c72e1b7e6db85250ac7b1ff26e33598fb94c29ee74569dddee407fca73961d9fbb245ecf5ff5a7ee0eaa83031f79b7f0b2d89661119d45bbf5954