From c3b5575c51a5db1089198de7a55142d88cead45b Mon Sep 17 00:00:00 2001 From: PatrikBuhr Date: Wed, 29 Jul 2020 08:31:15 +0200 Subject: [PATCH] Tested using CA signed cert Tested using a CA signed cert and trusting the CA. Added a README file describing how the keystore.jks and the truststore.jks can be created. Change-Id: I431e716f830a3dc1d02f9ac53dddca6a678ace43 Issue-ID: NONRTRIC-195 Signed-off-by: PatrikBuhr --- policy-agent/config/README | 41 +++++++++++++++++++++++++++++++++++++ policy-agent/config/keystore.jks | Bin 3587 -> 4987 bytes policy-agent/config/truststore.jks | Bin 2970 -> 3683 bytes 3 files changed, 41 insertions(+) create mode 100644 policy-agent/config/README diff --git a/policy-agent/config/README b/policy-agent/config/README new file mode 100644 index 00000000..6e50749a --- /dev/null +++ b/policy-agent/config/README @@ -0,0 +1,41 @@ +The keystore.jks and truststore.jks files are created by using the following commands (note that this is an example): + +1) Create a CA certificate and a private key: + +openssl genrsa -des3 -out CA-key.pem 2048 +openssl req -new -key CA-key.pem -x509 -days 1000 -out CA-cert.pem + +2) Create a keystore with a private key entry that is signed by the CA: + +keytool -genkeypair -alias policy_agent -keyalg RSA -keysize 2048 -keystore keystore.jks -validity 3650 -storepass policy_agent +keytool -certreq -alias policy_agent -file request.csr -keystore keystore.jks -ext san=dns:your.domain.com -storepass policy_agent +openssl x509 -req -days 365 -in request.csr -CA CA-cert.pem -CAkey CA-key.pem -CAcreateserial -out ca_signed-cert.pem +keytool -importcert -alias ca_cert -file CA-cert.pem -keystore keystore.jks -trustcacerts -storepass policy_agent +keytool -importcert -alias policy_agent -file ca_signed-cert.pem -keystore keystore.jks -trustcacerts -storepass policy_agent + + +3) Create a trust store containing the CA cert (to trust all certs signed by the CA): + +keytool -genkeypair -alias not_used -keyalg RSA -keysize 2048 -keystore truststore.jks -validity 3650 -storepass policy_agent +keytool -importcert -alias ca_cert -file CA-cert.pem -keystore truststore.jks -trustcacerts -storepass policy_agent + + +4) Command for listing of the contents of jks files, examples: +keytool -list -v -keystore keystore.jks -storepass policy_agent +keytool -list -v -keystore truststore.jks -storepass policy_agent + +## License + +Copyright (C) 2020 Nordix Foundation. All rights reserved. +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + diff --git a/policy-agent/config/keystore.jks b/policy-agent/config/keystore.jks index 4df793d588ac421c4f87c2597ad2bc64a0a1e9bd..122997ac7b9ad8a58b7a167916bfdf808f3f3e4b 100644 GIT binary patch delta 4893 zcmV+&6XNWH9Q!6BFoF|z0s#Xsf)g+X2`Yw2hW8Bt2LYgh6CnhG6CE&u6B&^rMt_}v zzXG@=0L#r~HFB+>f7mT~-+x3~2O=EuJ|nsR$YOsXe1{uEs}1TmLj{u_b#&Eu zSL>tmHyMt$=?Io3tiOd2hHH4!?iEmp|1g!9?=_^`brDxynn8-rR&t$t>X#rJozu@; zTs|xTtAqTT#zq$)Dy-jlZH4T|pLt5I4ysZ`VH0Z!<_rAzT6fWM_QG`-Qh(*aw*kWJ zv1ihuNNC+&el-rxxJ3r2L7ItzBA%U3El)fxWYlPK0#gzz{I(8HB_-FqS5KHcd0HP zXJ@zp5vn?x;SSxlovSEH>-ph8|0T?tUZ#7F*q$H)AiC1HsUc?1)PGY&!jm#9TR@0B z;rR_^yYocjy=T1EH)H3Tf$6a5?hxbK|iiF3wy0}NVmZs z=XK!b1MkZqWR@Kma({G`FY}=!SDd9^OIF^iI;oNTJXU;q$u2<8#DfWV1Rg5SYro>; zzu3xrPwW%&U_3NYhdaT3@bdA+-VeR^^<>KmSXI^W8W$xKsRxL3zxr=iSBv#Y0W1A~ zH%VEYkig@30R;?`UaI~iYNS0xG=BH1qK#0DO4j=Rg%T-IDKea0d z_{cG;G!!J`5*{(qujSHs3f!(rBXz7>mhZ4bQti8~=g@a|_$DutPtq0Smd%gLPUMqH z9F`xd9G6Q5N`HxxyNVQxuN%Fp2{D?;!ypP*^+upXhU3Ua)fZiks|DGFe@j`{)imxi z8A2k{K%oXRqjU~~;H*IAnw`bv#OddsQfaRaY~7HqAP)nbp5^xHk+m7-^`I4_RtTY= zpyyI0Exb_@NLlhN`^MCCP&ekN=tt-+xAa(Zh*@K&uS9vxb31arv(;D$rZ$$fEW z#z-(Fz4*`5-pi_QwYFq$cvS1nQQ;-3uhdkO8kQhis$+Jaynhe-ctgeg3zCkOqwN&ZNdoUqC) zTbP^0=@z$z?L^LoIyqeQRp$pYhK<}8Bt6C{p5IMQDk$u0W2_hgEwL2#M*I~|T&8Ch z$w}^*Mk?;x771FhF-$Ng1_>&LNQUoCXOh zhDe6@4FLxRpn?sJFoF$<0s#Opf(?R`xdk16P_kx2oCFWj9h4XDrd@i$H7w!S0s{cU zP=JCBNGI+g*VLMbzJ2h9i%qFDbM@gimoY;Owsa5~^omB>!eQU8%A4y$2g|J|8`wV# zPixzdyti39D0&%0-Y=*}idl4arw@t8O#Mh+DnO-30Wlq(A$2o}hDYS|f}45$Hqw57 z6tl|W+WxC<89~gd#Mgw?Flm&Fjn|A%J?itx_$qF~NpwgMeWV1*&QO=LimMk!MwJ8P zt@w*pH~oE)?#ixaNz8&LS^9fE)FV;9iIxeklOxC1XfwHEuu_fWN>bM>9wG0TM&$f5 zy>l60Y38lA*QgS4r_x1X^H+QqA%@k?i~5T;HEhYQ!)-#x?TQts+Ud9bY~|N~q42x} znfDD7QDX)Bv2fPQ2hJN@1L1G7&un*=Ten4r)A}ebJYy};0jMYw0nm=MWBD@63LgMZYyPT=miwz|m(l)7 z8em)Jy2jnMixgwg`2IotRx37 zyRbXnVTjU{E+n)kmqfG+)gK>TaOvEJXvi{XwU;kbYZDZE+9>b42nX4$5%UI!@TXWe z|9t@GBF4V!Fjgle*}|^8dV-$}L{Nl&Rs$|s0w*w(2Wgjmi}IHPOq%I`!PxWY5b%W* zNnhf*``=>J7@81|ArD%@j=f@GqkW4;Ab=`}8^>zup&Q#1qohb|>UwpBmPcuA>#|W9 z8DhB|;<)FO);4e#rrt|Jh(X(5@FJMoyj4TEOS%z>uF}`YJHbzC-fLOa>Ywk_cgc|V z&MxGZ7Gxpp;V#XA8P}7413@$phRe3t;Cl#;TU@47;@t)hi;QLwtjTWOxV={PWxG+{ ziRourwitES#Cud}u&o8%aLC)b|ET@Q5#c@}E^NAqm;5GW9);EERn3BHn_qm$oJEqk z&?ftsUXZ;v?eld3Oe6uaJzRzajRIXnH~aOrpLM08mHSml-izXYm(o6+(I`HvH=w6R zAZ~UQdpCd%5Oc~fz?hmI`lF_HNGjTqry$Dl8Y|WUUjc0Tv&ik{6Nl##Me`2`<6FgO zv6g#c;UkThJ{CYGM#mHP3qI7;JoNIfx{7bL?9O(;+I!Bekxk^hFVcY%)#F^q1cget z63_ho+k^XD{ zyfZBV*qni0bI}}-q~F}{fBB0`Baz1lL7IQ`tDTl8`zBz2TA2kE25}_a40Wbdcw^Lh zuGS_^9cH_=&%* z;?om_wOdJl0*m8~hr{X)Bn)Ph9~NdD_sujbXNKI1U?&~+sFv^86 zx6M0BIEu|_MZGGKl6d1ULHM*1avvv3fkR;Qa6cr&?&(*dG-G473Je7XGhFY0%LSTw z94dvaTEddLzUVB0@`DdK@?G)e*LInhi%kMyCswe;+9 z*oR?#B1`wO<^OIs+OMds!(+zhv&llHNL0UHA1mhDui{s_9t&)>wOW{XZ%eF6LFFZk ztr~(}8BZrq>37a_XfaDmSB{*vCKj5BGLzz}v$pOxO4pW}Etuf{$X1pH(CQ^OiGS3B zscXW2T?71S+&lA*fVaMHx0H%BJy;>?;xk{L8^0m#PTnLmoEIYV=}RuP{4=qY4LY^E z!FxkZ6Y;nl7FJi4Pbl-dqh;hDCd!I;n887kC3-hFy&}D`}4dQ{cwRp4K zd-E_eI=@jk%#X)rBEJWSw)?Yezvov7q4S_racM-!1+oQYUQ+l+fkj1Z8gZv)%jm19ejR{y-nm2q9I@AF+j)oHPR zT@6t8bt^m+c-@mD3M2fv{!RS=BgKkbn%o=VW~caOHip^V4wWKOMul5KmCPBfJQtqH zx_BUU9m-XJP-#~-J6BRg1OdE}A-^wsE628_r&Joxjk+Gya?J$J@-jH*Vr|0wq0_lT zug9I}+XYT4juX|265}$$zY6}piM(uo$qgpSJzoMCcF@hJ0-|%2dDF|Reo>Se*43t~ zj@fQfzQOnSAlS~#;)OzD41<_T&SGxiPVs(86$*s~Qr7v=j?&cn8`3HmeVs-1N%nzx z^r;*%>1fk=dc9T0o|_lY(OD*Ayp3>+*q3)^ZCrlqr1ah zQ;fkhY{T|ybgA8#(~N0h>QAKt;uzDNyH~9VvXe>1+uF{B!dmlzaYF>8c>ugx;Z!$T zyo7sH&H?(!6GpG^-5Ycg@F(1VdQmgx>h#68*s`{wh!{rxgTw`OM_CjVEw;rIhJB7y zl@VqT>F5{>D1o&Il7xEElB zh~?Rwx(WeE&kvtd9EPz)RA%Ni+69u3FDIA$1!7TzG~r$&z(IG!I~_3JY?~%)T>VJ& z^XkafQx!Js8eKN_jahz)u&FEVYRU?3oO6#ng^X(a zAXskZ>N4fVX4xadRAvhKWU}|k`n}zGm2x%v(CM&~02Zb@Jx}7`gxrO%zUoU7l9na+XNWw1#hze!{VE|3CW$DnkPbksn`1RhHE!`1MV@6 z+hWf{yWy2lThvc07Mz0i_(V-U9sMgj7h^mB${pGdg>!3&io;b5gT}oDrEy|pD<#P2 zI#7hU&nGORw2=dves&MBbJWQ^RrizEN4AHqY+&Wxy}|6*WqX5m|NA0`uA*aYV0Acgb$Xu-U z1wkUO{o)46{WJ zFMC|$Nh|^*9QDjj_2d#cK4IN_t$niFFdL*y759+ta09QQ%2ZerJCApvPc3|*C-gIC`!(lY zO|%JhN1p|062uMWaH(H&P<_e9P^~a`9_7Hl$-JC8sET!ZZ~${~%!6l=kbN*GPbkjLIZCQyA=NtV8^tNR(WV%qhI^q>Ocq{wM` zI#{sV_9ce~G=VkwDPfJd<}qcTX`d~Pnt}?{e%LVws?T-vj7~K(+fVJ~`+f0|ADh;;v*= delta 3482 zcmV;L4Q2BCCW9OzFoF&L0s#Xsf(^I^2`Yw2hW8Bt2LYgh4XFfz4W%%G4WW@DMt_?K z(`#wnRtf2EB-ydB%;bYsELQ>p0K-rOf&|E7ouL~52(TZ$8kwZ}nS<}zliV5|#e@-g zv0Mu>pHSp<|N8i0hgt8#0O%g5I#9*==cScjaocCX*EdeLm8{qF2yk-uCDL}Tve`11 zmXpF^4h&;Z=W2 zKm%Y)zD+41rKgHO$)?yQ#k|uIOxBv#rj8D$83bk7?<7VcCF&#?c0|$cJKIJ7Cp^$J z3bzyPHty|5qFp`lfdRh035-Jck=n>$TMm=l`r-v7Uh*gVWeP;9Wl~T}WPd(09Eot3 zd04|4{m4C-E4dj2g#Mf;f$${<)pf+EF1;4VnzAGUY{C_CsvnU?yD1N}bNea$flk^G*d^0Fw*eOvb90|z zVN{3tsV>+WwJ;fz5}AI(?0@=~5gY(Glzbk2aiD6lr%VXSEgWERucOAL4NGWi9@r=R zBZc%DDb2^qIelxX#6-~@7dq!K&@xH(y0z`(Sg}Z>VjNBaXk)F#At{rk#{H(i9eQ8d z?_iR@_9y~=dRI9rAdr?Pl&yO6p;NbL8bNcM6IJGCqWLXLb+9<;HXuYYH_Gl9H)4vOmvxjxm?YR|CfL3e8t#6j* zEiqlGekS?E_Q7k_CUuZ#m0s0ZQv{ty+&*#D2(9kDdb(Pe5?61IrXIEKpc~a@!r4_H zuFOVy%~~$%>GF`rxQAoR6*Zl#(5%qt2@u1((K8csDB0E_27eR5zS;dgdABVpR`>-k zmpB&;p~7n^u*Hz0_Qv={OzGIxWTh~XOLe5&7eJ{Vs0cu3`66Oe9>hgf%FO+MOvvB7 zW?NT_cgxC`%ztBfpD10PIp89=V01JD5q`i{S!Dm@RikK>fym(Hj!-aJQjsZpz&T&r z`4TeRQDw&Bu-G&Xf7LNzqBIrXc8M^y&4?vTII$JM>H!UVk+q~hrsxPRv5UQi#W~KI z{cnNttai_FpcX0YNCw>6cuA0gkQ~mw@%4grLs}|spMOWZ($u9bp0%vC-_O)b60hzn ztylZPT{0a(5nLP@8M5V<*^$~!1guLu9H~%2XI$(RPPN$hZ`_U3L2uk=oe|GPOl(W- z#C9(!^kMI}7i7k2@8U{TuO$B18b=FQwp-w}NYj;mHE}Ues-&{yA~n;Jhx0-?KK;m=!6aPjuX6h^T+6tNVmuS1%LlOaG#~T>Mnje zenf7_5zQ$6BUMXyF-$Ng1_>&LNQU2+ zJSy}|lEzG;ZoKL$E7_5ETbg}~4s9%s`sRjf6!Q!!pkb@WhcTZ?S=O~W@&j6_m{vT0 zjF`?PJa{z1Ol8+7xT`b~eXVy}tS#La{&1hE`bd=uKr2XZ202I55vVx4IN?cZYmG43 zvvD?UW{nOPpK;zUetjKKrL6>@a{5zxuQs*twEm(=Pn^7e*afN-I@m2Iy7&9G-5!CKTUJ@Z{;>NjcOWJF zhDEpc@j9jXJvjGJy<5G(OHMjTKk5S`Km}d|o(Sl#j@AeKJD}LcO@6&R=qAc1YyJwB zrnAeYDax_V+~C#MdRr^1!FfXAo)8no|AlREaOh2Bzx|_7!(aEch*(Z{xG<=Hn(z#G zJF?!`Oh9DgsvA+4+`dw*o2wJc!|r$l89|}Fl!Y-$&wPK_hTg+g2a`Q>t%i-ejR{N_ z8ORLk!IwvTF+d6rgb4&)sVTb zLZe@HeVfZTz|tz|-6Bwfp)0nzWqShbcmx1LZhFo#*rTmY3N&EoLagw2sCuT%TLvl( zV{3rAsU-9T0(C8BxkVM2Ve+01Ml4TN7qXBYtIlPxOGT>({9farNpKkNvPn#mjsVb{ zOrAp&1V9zdJ*oWZ&MwM-*Q3yH0HBCn{JUB`_RjzY#QPzn(F{0>XPI8zZ1k6^pq*n} z+if}+VPqf`-{cp!lv-0e^l%w!Qm z=l%xtyndKB`?Z5jI={3%mFV=O6XsRO7X9uDCqG2>3k6m?gFUO`6* zN6`B?LvImFE4Yq^eW?0(s_9K}N^Fal-T7&G@^4StluX8dRJ7@*io z-dw!T#gJ}Zy<5g6b^0#vQmtW=qjLj3r6sK!(!VMpj%O5qx!E(9riDsh>6AqhZf*lG=D)(Wfqf;aZ-jrZw`$ucFny*Jh1%W4)F^6!cA=Pv5GOH z(bXt2dtN_X>7ns--CEAZ=UV#POAvQHRc=r=WJqq_+KezA576y5s}9XOaNciOW(LZt zVMbwpiYO)at@h_o!iOIW##ac3uuv)>g#CoW=ASf6WLJCSR6mO*>=axg^gZ(t5sGtR z7U}YvFYITBGC7+u!(5JCYsME<&Mx?7t=d0{#bP>ZA*#Lm5|01$bK^$ekY1jR!Ixs% zLu&`4LTFWuAjs>hcxa2{Wq&x0Y^btR5j>paL=tdi=l!CUa0EW_N<6yHaO}OQ=KG3>pD{5v!_y z=}|QnoT3aq23KCMzm9IG%hOKu{*fhN(KUEPQ4}WtoWkbKzSQjuD7V<%r-)|weBRp=`VgyK}F)&6(H48 zZWB5TZ!3Z~o)7oA&$)iT`~G+#2{bk!AQ_TC!wjJmi9yGlUI#*f`2-qDasmzb zF9sqBV7LE@z}Dmhu*F|&`ge>VRR4EHeGLf8Cy<{b3FN0pVaT=r$A6!*k;5J0(Df$c z9vciqAapfjwY)d?n;wV^&|^qWARovq`=otw=)zv@lQWx46XZYfS?Qe5oBTnEIi9!jF;<6VzDT-uxHbIJ^VwPQ1MZ&~qXUE>4?-;PL98O)hLg@jxP-K2 zWYpYZNxVFn<2ZU<5nK6sxd%rLj@xpi z>L#HL1ad6YqO&)qe- zgJK8u?F=8gtBr|hyLwQeDW);PE#Uz5E>=E)_{3N87V-cSgoC&TO-6A^gLDTb~OT+)>Zh1$2lGZaR{# zeI*c5skN*9^0Rt>w@>YR&4|_U?Q=zt-42o zmcs4X5O%Z?TS-2{)2`JFG+OMwyuJU-dkYTIwr7%Q;RsP;5mw=FNZS;>m4ym&be}_Z zBNJ_eolRUwR(#vd*B-PjW>+cGCT{AD=9(!1{MiaqtX%b9zpxD``-ze$tNBpK`)sUB z(*-X%Rr!yE>vocu%U9ZR7T$KoPyw5$-@&Mx49vYO!m`5}-VwMe{A(L0%i51RyH2btJsOx^5)P%OA*5?HtyoQPndL8 zl$z)Uqp!ccM4H&7ndeE&*uq_@HXi@=!X(W_WcWx z^ZZPH#geK}!Ep}{dNft`Rs8(feDX=f+4JwP>#B^6Z^ZRrUu4k49pr~d?QXT&o;!4K zdavQSj`OzJ*y`8!POBO{?J8~)QZ}l}R+rI)V9z_DOPi7i)fiQZ(eO~RrJtUQZYkZ>ID;Fp}tmxv}9q4p_pvp zANU4c0CjAbm0m=tbET3l>KA{NK`Q6e0>Y}7xJu*s-trC_5*WGVI+eb0TE}ayl>1u7 zGcsU3&vM~JP#2>e^b0IGFPt#D-P)l>snD-1)i)Ki*Ym_-=R??(`qpvxbtO!5`K03y zT=gZOq3pLUvl+f^`d~Ls;^|0$@gu|cJ$muq)pWxmE`1r}tXvi;mB-77in zdcEY67$)R#q?>}dL5{rgc}rNRO9SkX`C5Y6=H7yxDJWERkS{)yA0e6R+}FCUAgO`m z`nM`6;ga;6v;Z8y9pD470r&#E0gnL=NS^-`7$xE4^v2F^kGUmf73GjfX<2D0DS1gG zfgK%=n~I8l*r)8$KvHx-Yt0jvZ(B_#`@1*c&I)1!!-Y`G`-kKZEL%+Yb5@*EUK?- z(xd&Jktw11ndM$Blh6@05wLYl;BSp}#iFp%4X>z~{v&(|^)!hQ0b=#&ez%r3g!%F& zi>7_F1b}z?^ZZRkiJM=kKd>wnHU#`)#=~-PLy}2eO{|! z^(UrkIxAi^UvcpykVU!k#+QqHeFZ;$FJ2i&fh+xWi`3)0oNf+RFeFhB8!e4W?^@F{ zcF{>{;&rE(xf8U#biev|Oi(}Iv)%rB$29F-(T^zC3FCR1O|dav*E7*y@^>6Q7I|`! zJ_jh<(#?cviLm9m=j{1>FsI57qp1%cc}gxTzExDiM9G%n)xAHZpnoT5sS9`CI^<~_ zT_2pC3W-hXi%a>fvNW`JBp9n;IzU0Oio^~#${ewY$9;Olhdm=LyLVLc!nVLw0M)iW zG%6ZqEqgfOcU#1>=>b{U(NTDgNrvYO<|3-=G{q@(06d%jO;~bI|hJTHgnswqaz+gF}49=PPK>b8w#3&FVm+zW~W2lFdrfN9Y%TW53^f`dMh*H zr2^|^v1d%N;H~vjV*_N!Ywd-*u2~d(fn1*1BQ~K-cdads!A*vNb7`EP*ZQa8tnNlc zobwG+TB(ceqN1FPINM95<&N!_(WI_;MjtNQbWkth7oV~4ck2gk#DbAT1FM*fMT?^2 zsd`^U-)Fzq6e_wtX@(lB`&MsU&6wI)CbQU1k=l0(u2_bJ`Ckpi{L>zelY^&*&Vdt$ z>)Fu0*{8*6AHiH4F4v+Z>>ic+WN3P`dWp3Z`ArgBn4$GDMdsVP-)p?PR4@iI?HPJL zHimW|$ZPD!GF#Ln!npcX8p}DPSu3)&b$_fg-XO%prpe0+__|O7w3OoJ8s2`KE)nxE z5RVqC9DHA_GaO+a$(pY90%2@DDHL=C)o5LzSLnYkKAryx5viGbu<|nVIh148OwsGNqS4XVw0 z99{@9l8bzp7JPK?k7V>TvG!u=Wd3xV&yc;8Q(++>Ec%i;WtV|USc&k4+kNJ@cn^tS zGnvp5JuYuW`_p`VW)t!l$3zmeB2h%S5<>QE@u*O6on|V= zm@{`XscM8Aih0KuCI;qUH|LjsVIXi*UD1E@AJRIlP(Bxh?%o|{FU-MC`Ssi;!WU2@v&z>tR6btK(* zS;U_V?=Wx|{H~BsSB<7VD_x{4ERdbEfS4rjXxFR-Vpz2Ts#14p5v$c1?{+9Dc|{Fiw(Wc2-{*RO59MWBw&n6U{kf8n9|X&x}R?w!c|n%rVQ>J)su z2RYdL*e=PS2yIo9`O8(@ukeIyJ7|w-_8H5BxrXZV+1TMn9{M(qlhN?jn@+FmC^t0l zyf7<8QT^%0&XN+Zu~W2|^Zl|2zgCet`iu1v_)m)WZ-Oe|^8|JFmNJ-`mTNJ|Y z$A5ip`4Kzyc!05YYc~!iS1#1Zjnb<$6=F|bcA*oY+@TD2!2!=yN5U5rzsH$NZnxc* zIC`;S+IhKu5O{%RYP&CBS{GIR?9Fz8yVO?3z$q62kHSEAV*GANf9iyFbIE=jd5YUJ zoK6+ERuu5|zWCwVjVU|^*|V$3GIo+*?*SXVCrsTto3cfgwEu33QbIR(hilwmD*w0q zpwa}!>Qoo3Uyc0IfN zsaQ8DRyxHXPr>N{Kh&Xc^}N0==%(x#E!KG8inua!1ZonJXf@|=Kg05zLb!BV75_ffj zbNFmv{8tpB{>E|{wvB}m-}c5#Xszt+REMIX^3Dr6)Os(4YDM+oJb_Xtl{Cq8>6+wRFhHm;0-`)hQ{Ssr;D;Ow|!qUXu!(2 zq$ZBdxf9wO(6YfoAA$_kuY1bMN96QVGGu6dv${BC0sOJK&0feNbIzh}JIYb9JuWq; zY9b(#43_y8kC%N_9j;XKNb^t9yLB14{+^B?B1S(fx)c!^-$MUsG;7Nscm!jl_sMPA z+>vuVE(w6>vw9j90Y&HYwTsVe677jkNXPF6uXwL(tyZ-G5P-jE=tIN literal 2970 zcmV;L3uW{$f(w=c0Ru3C3r_|KDuzgg_YDCD0ic2lKm>vdJTQU_I52_>GzJMOhDe6@ z4FLxRpn?k}FoFvq0s#Opf(sf32`Yw2hW8Bt2LUiC1_~;MNQUnk!<&S1&d80s{cUP=JC8;Of8&PuY87YB3?vJaFmk=hKhN=HC?3a@#7L z&JHsL&8dRS7#^N$^ZbpOHKqRU;L4WZA(jzFDM(!kwEQO>^1c5GhOdQpOG|Cm@Z z4@G`?VYyWWd{=_3JrhpfCJc1rJK+jr*-x9#txH0I2MC+(>*nbbLd1w{zfOQ|K7eq{ z2Rvo9MzlvsQNy~3nvUtg_IzjH$zM5A$6dS@aa}OFT+$LaTI%l-3(CiGUK)PyT*x=) z*7{Ge4wIR*;2XU!pa3$Z&rW_40it2uG}=-7K{?bW(pdIIXwj_*3yE z#8v)KJm9)+dsXojy}Qz-dKc(EQlwgA$#%153|l5j;aQj?$cte`yG9oF?I4UpRk1L$wBzzL;GIAOVBC>$kCs@VR*#PJ zrXg9w;>dfZYQ1N(uy#l=l#+x42~_5@&C3XE$1L4^n+cJ=2YQ~)1w^nVY?sZXlK zAyJY+JZhM9>o% z4wW|%Co4mWj`MR7A)=9o+;zvv{OGc_5#{CXR=JSiSsJZXgX#WY&aD;tuPjTapevWS zWZ(Fnt|O|!V-)CScWX#WRN0Q|85x2AUcTEd-yz&S-XPPBWE`^xA8*n#4^eAYJ6mhM zM`Gh=hmUSxd=OUEUv!5vLcS?w3JwiKqib1lYCdn+#!s>^Jz9>NIf`YabjTLw^M2>! z!e8tjPDsgVi(y2Qd*VY)oElss0^Ag{Q^HF(r&g120}LbsWi4WM+q0oX{p`|>a( z6=%hlr%|UV2D!w|%y{jf9okzrTiO%SQfh2&n@>AUpnMO~)5phY-(|m5iGaRnJdYUa zozzk_h+K62aSSG}cgtxrmWL@FG0KNJ%zXz81}*Ib5@18rYJ_EqzxdnmGv2@->iwHD z{k2=6$L=_vN`>zQ+P$1$1$6NV*;0ev9#WCy8bFVvDsj%QDr?^dyvVx5u;8wjS9M;d zv}B8mFf$qI3t#vS+U9W{zq!9Z?@_2`P<2rNW1|$_1k^RcY1X5w2&$>do)KdYen;;6 zypt?y;d0`dbu$WZ<_09-zjUGQs zTuDad#=v^cH~-;|4lupl6qDv+r2kHIk+M}pqJ7Vp=7b&kq&%(N_TBA$Lp;D&TsuhY zCF2np)ynoYb>Umx`<&sGs*CiYSB&UeOjyDOQOM5VFMop*Rh^5MWyDPZj&=!mh|!x& zMbeW27-?;T;pS8b?cX4h^z7UC>BH|spG282&A1O~Fm287xFY`ns1;nS$#7Z)0at#< z(T_ZXQTd#~N2p(jDS#BK3@T*}w*-RNH@;wP!=v;Mi73)=c(nusI&i3R*K52s!x&^= z0RFIB@;G5k9hs))b1clj|D8qoh)Dkt57Z6_$!5iw$$e z)l2XS00HC($@y8pb*gEL?Hcm6bK4ct6ImGvLv9*zaeDL!~o^Vk)1RPRfziyXghf;e}hj4yazRKOW0@gI3_dm14%}-1giTmW0Mvlp-g0vq(Ou#I7lISYfP3h&)a1nprOtGS?IR9O@wk z^i1Q#2={G)vt~VKkc>Ld>z)4t<5ijEuSjP%OeV@I!pw4wr0DAf1||(9Hjq21`k=*# zAXiY3xHExZEKPW9+sSd93kJaH_b5oRk|e#n)G7x6q*5Ib?jX)r%1=gA^smM6%Nuh& zZ8w!%^59y8%{Fcmpl~XNssM^L1?JnGg46z`aaDA;iEjyMX)+!@8F#5MVAMK+@-w=o1%)&)=l6Bnd7Qpe-rS&0Gr6&vIV%p%w_lixWMg58c z*z9&JYb$!veWAZo(4>q44BTc*E<2Bs z@-KyNUNX|%gE~R{3}2YZ0%%Wrqo2d_T2Akah4IVRSLeK4UE!%e{{$ZFLcHyRvyL4J zu-p9eAcm--)l6KQxw6wuQPufTr#p0xplr_{*H%q!a8D>0~C ziDcI*I5PM+9i~@W;k(1H48>+S!$VGar zx{-#bMdKep(65}Cu)}|069F@~S=Toebhn_Z*`snQmVx_a5d&!vaavXFrtA@2 zNW(jDB!(J;B$w6ziMrI%lL*xxKoNrHEm7&oR&T|Q(p5)1jh)6+h`oHYfkdCi>o4_< zMwR<}uU))WFkonPZqmU7zboX@_MCjL;t$U)$XSwr2&->0{Z`dZgPqH9e195&=^T>oQxZw+$LA0R&xlb&_9>2d8fhqP%xVoG9Q zw!MZfZs*1VE&atK#wL1#6^7 zN|&?X@##C6KUYDACNghv-8zMRQ-goZB`abIk5l_=>iKr6{Mi-0HM|L~1@Ln;zFOY=0( z`!GH*AutIB1uG5%0vZJX1QZ;{-^fwmJ9BSXS@DS~XCIT0hv5Vi6-ZbkEc{(!@-_H% Qc{7JogKecw0s{etph4!GyZ`_I -- 2.16.6