From a4f3b7a0889688eec51879f6315e499fb2ce2b29 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 12 Oct 2026 17:13:02 +0200 Subject: [PATCH] security review: SCANNERS.md, redacted scanner output, live evidence (demo-hp, public sites, hub 0.148.0 check) --- .../security-review-2026-10-12/SCANNERS.md | 81 + .../evidence/demo-hp-guest-reads.txt | 28 + .../evidence/demo-hp-host-reads.txt | 108 + .../evidence/demo-hp-lan-tcp-connect.txt | 1 + .../evidence/hub-0.148.0-live-check.txt | 7 + .../evidence/public-sites.txt | 29 + ...tleaks-app-catalog-felhom.eu.redacted.json | 22 + .../gitleaks-felhom-agent.redacted.json | 260 + .../gitleaks-felhom-controller.redacted.json | 141 + .../scanners/gitleaks-felhom.eu.redacted.json | 719 ++ .../gitleaks-homelab-manifests.count.json | 4 + .../scanners/gosec-felhom-agent.json | 1884 +++++ .../scanners/gosec-felhom-controller.json | 7532 +++++++++++++++++ .../scanners/gosec-felhom.eu.json | 3452 ++++++++ ...ovulncheck-binary-felhom-agent-0.154.0.txt | 327 + ...check-binary-felhom-controller-0.307.0.txt | 840 ++ .../govulncheck-binary-felhom-hub-0.146.0.txt | 840 ++ .../scanners/govulncheck-source-agent.txt | 794 ++ .../govulncheck-source-controller.txt | 1170 +++ .../scanners/govulncheck-source-hub.txt | 1133 +++ ...vy-cloudflare_cloudflared_2026.9.3.json.gz | Bin 0 -> 47877 bytes ...hu_admin_felhom-controller_0.307.0.json.gz | Bin 0 -> 384651 bytes ...ooplex.hu_admin_felhom-hub_0.146.0.json.gz | Bin 0 -> 59347 bytes ...ooplex.hu_admin_felhom-samba_1.1.0.json.gz | Bin 0 -> 133054 bytes ...vy-gtstef_filebrowser_1.5.6-stable.json.gz | Bin 0 -> 54999 bytes .../scanners/trivy-summary.txt | 82 + .../scanners/trivy-traefik_v3.7.13.json.gz | Bin 0 -> 39071 bytes 27 files changed, 19454 insertions(+) create mode 100644 documentation/audits/security-review-2026-10-12/SCANNERS.md create mode 100644 documentation/audits/security-review-2026-10-12/evidence/demo-hp-guest-reads.txt create mode 100644 documentation/audits/security-review-2026-10-12/evidence/demo-hp-host-reads.txt create mode 100644 documentation/audits/security-review-2026-10-12/evidence/demo-hp-lan-tcp-connect.txt create mode 100644 documentation/audits/security-review-2026-10-12/evidence/hub-0.148.0-live-check.txt create mode 100644 documentation/audits/security-review-2026-10-12/evidence/public-sites.txt create mode 100644 documentation/audits/security-review-2026-10-12/scanners/gitleaks-app-catalog-felhom.eu.redacted.json create mode 100644 documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom-agent.redacted.json create mode 100644 documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom-controller.redacted.json create mode 100644 documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom.eu.redacted.json create mode 100644 documentation/audits/security-review-2026-10-12/scanners/gitleaks-homelab-manifests.count.json create mode 100644 documentation/audits/security-review-2026-10-12/scanners/gosec-felhom-agent.json create mode 100644 documentation/audits/security-review-2026-10-12/scanners/gosec-felhom-controller.json create mode 100644 documentation/audits/security-review-2026-10-12/scanners/gosec-felhom.eu.json create mode 100644 documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-agent-0.154.0.txt create mode 100644 documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-controller-0.307.0.txt create mode 100644 documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-hub-0.146.0.txt create mode 100644 documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-agent.txt create mode 100644 documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-controller.txt create mode 100644 documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-hub.txt create mode 100644 documentation/audits/security-review-2026-10-12/scanners/trivy-cloudflare_cloudflared_2026.9.3.json.gz create mode 100644 documentation/audits/security-review-2026-10-12/scanners/trivy-gitea.dooplex.hu_admin_felhom-controller_0.307.0.json.gz create mode 100644 documentation/audits/security-review-2026-10-12/scanners/trivy-gitea.dooplex.hu_admin_felhom-hub_0.146.0.json.gz create mode 100644 documentation/audits/security-review-2026-10-12/scanners/trivy-gitea.dooplex.hu_admin_felhom-samba_1.1.0.json.gz create mode 100644 documentation/audits/security-review-2026-10-12/scanners/trivy-gtstef_filebrowser_1.5.6-stable.json.gz create mode 100644 documentation/audits/security-review-2026-10-12/scanners/trivy-summary.txt create mode 100644 documentation/audits/security-review-2026-10-12/scanners/trivy-traefik_v3.7.13.json.gz diff --git a/documentation/audits/security-review-2026-10-12/SCANNERS.md b/documentation/audits/security-review-2026-10-12/SCANNERS.md new file mode 100644 index 00000000..a06baa30 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/SCANNERS.md @@ -0,0 +1,81 @@ +# Scanner baseline — security review 2026-10-12 + +Standard (non-AI) tools, installed as user binaries under `/mnt/5_hdd/felhom.eu/tools/security/bin/` on DooPlex. +Nothing was installed system-wide or on any box. Raw output (redacted) is in `scanners/`. + +| tool | version | how installed | sha256 of the binary (first..last 4) | +|---|---|---|---| +| govulncheck | v1.1.4 | `go install golang.org/x/vuln/cmd/govulncheck@v1.1.4` | 6b04..2f5e | +| gosec | v2.22.4 | `go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4` | 3111..607e | +| gitleaks | 8.24.3 | GitHub release tarball, checked against the release checksums file | e183..72d3 | +| trivy | 0.74.0 | GitHub release tarball, checked against the release checksums file | d89b..d7b9 | + +Trivy note: releases 0.27–0.69.1 are no longer published upstream; 0.74.0 (2026-08-14) was the newest release older +than two weeks. + +## Reviewed commits + +controller `dcd89364a4` (v0.307.0) · agent `86adbcaf8a` (v0.154.0) · felhom.eu `c9b9432986` · catalog `1a642b43e7` · +homelab-manifests `fdd324bb62`. Shipped artifacts: controller image `0.307.0`, hub image `0.146.0`, agent binary +`0.154.0` (copied from demo-hp). + +## 1. govulncheck + +Commands: `govulncheck ./...` in each module (source mode), and `govulncheck -mode binary ` on the shipped +binaries. Source mode reports the stdlib of the LOCAL toolchain (go1.26.0), not the one that built the shipped +program, so the binary mode is the one that counts. + +| target | built with | vulnerabilities reported as reachable | triage | +|---|---|---|---| +| controller 0.307.0 binary | go1.24.13, x/crypto v0.31.0 | 62 (stdlib + x/crypto/ssh) | real → R-972 (toolchain) | +| hub 0.146.0 binary | go1.24.13, x/crypto v0.31.0 | 62 (stdlib + x/crypto/ssh) | real → R-972 | +| agent 0.154.0 binary | go1.26.0 | 27 (stdlib) | real → R-972 | +| source mode, three modules | local go1.26.0 | 46 / 45 / 27 | superseded by the binary rows | + +Mostly denial-of-service fixes; it includes html/template escaping fixes and x/crypto/ssh fixes. Go 1.24 is past the +Go support window (the two newest major releases: https://go.dev/doc/devel/release#policy). + +## 2. gitleaks + +Command: `gitleaks git --redact=100 --log-opts=--all -f json`, full history of all five repositories. +Redacted reports in `scanners/` (author name and e-mail dropped). Each hit was triaged by masked context only: the +line was shown with every long token replaced by its length and a hash prefix; no value was printed. + +| repo | hits | triage | +|---|---|---| +| felhom-controller | 12 | 4 were one live credential → R-950 (rotated 2026-10-12; withheld from the report file); the rest are test constants, docs and decoy fixtures | +| felhom-agent | 15 | all test fixtures | +| felhom.eu | 43 | 1 → R-950 (withheld); 5 are `manifests/felhom.secret.yaml` history → R-925; the rest are old evidence logs of throwaway demo apps (values compared by hash with the running demo apps: none match), test constants, public keys, fingerprints | +| app-catalog-felhom.eu | 1 | a health-probe URL, noise | +| homelab-manifests | 17 | private repository; locations kept off-git; not product. gitleaks did NOT flag R-908's key (note on R-908) | + +A credential found only in history counted until its rotation was checked: the old Gitea registry token in +felhom.eu history is not among the admin account's live tokens (compared by its last eight characters with the token +list); the old Resend key in hub.yaml history was rotated in June (hash differs from the live one). + +## 3. trivy image + +Command: `trivy image --image-src remote --scanners vuln -f json ` (registry API, no Docker daemon). + +| image | OS | fixable CRITICAL / HIGH (OS) | Go binary | triage | +|---|---|---|---|---| +| felhom-controller:0.307.0 | Debian 12.15 | 12 / 23 | felhom-controller go1.24.13 (34 HIGH) | real → R-972 | +| felhom-hub:0.146.0 | Alpine 3.21.8 | 0 / 2 | felhom-hub go1.24.13 (34 HIGH) | real → R-972 | +| felhom-samba:1.1.0 | Alpine 3.21.7 | 0 / 48 | — | real → R-972 | +| traefik:v3.7.13 | Alpine 3.24.2 | 0 / 0 | 4 HIGH (upstream) | upstream; R-979 (pins) | +| cloudflared:2026.9.3 | Debian 13.7 | 0 / 1 | 4 HIGH (upstream) | upstream | +| filebrowser 1.5.6-stable | Alpine 3.24.1 | 1 / 2 | 4 HIGH (upstream) | upstream | + +Not scanned: the 53 catalog app images → R-987. + +## 4. gosec (leads only) + +Command: `gosec -quiet -tests=false -fmt=json ./...` per module. Hits: controller 470, agent 117, hub 215. +Triage of the high-signal rules: G202 (SQL string building) — every hit builds `?` placeholders, noise. G402 (TLS +verify off) — each sits beside a certificate pin, noise. G407/G404 — the export cipher uses random IVs and scrypt, a +backoff jitter uses math/rand, noise. G101 — comments and constant names, noise. G304/G301/G306/G104 — bulk noise, +not filed. + +## 5. Proposed push gate + +Not wired in this session. Shape: R-986. diff --git a/documentation/audits/security-review-2026-10-12/evidence/demo-hp-guest-reads.txt b/documentation/audits/security-review-2026-10-12/evidence/demo-hp-guest-reads.txt new file mode 100644 index 00000000..6f8f0819 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/evidence/demo-hp-guest-reads.txt @@ -0,0 +1,28 @@ +# demo-hp guests 9201 (reads only) / 9202, 2026-10-12T15:13:29+02:00 +=== guest 9201 +permitrootlogin without-password +passwordauthentication yes +root L 2026-08-18 0 99999 7 -1 +*:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:25 [::1]:25 [::]:443 [::]:80 +controller privileged=false binds=[/opt/docker/stacks:/opt/docker/stacks /mnt:/mnt:rslave /var/run/docker.sock:/var/run/docker.sock /etc/felhom-bootstrap:/etc/felhom-bootstrap:ro felhom-controller-data:/opt/docker/felhom-controller] +644 root data/settings.json.bak +644 root data/settings.json +600 root data/family.json +600 root data/dashboard-sessions.json +600 root data/encryption.key +644 root data/settings.json.pre-gate-day +600 root data/setup-gate.key +600 root controller.yaml +=== guest 9202 +permitrootlogin without-password +passwordauthentication yes +root L 2026-09-13 0 99999 7 -1 +*:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:25 [::1]:25 [::]:443 [::]:80 +controller privileged=false binds=[/var/run/docker.sock:/var/run/docker.sock /etc/felhom-bootstrap:/etc/felhom-bootstrap:ro felhom-controller-data:/opt/docker/felhom-controller /opt/docker/stacks:/opt/docker/stacks /mnt:/mnt:rslave] +600 root data/family.json +644 root data/settings.json.bak +600 root data/setup-gate.key +600 root data/encryption.key +644 root data/settings.json +600 root data/dashboard-sessions.json +600 root controller.yaml diff --git a/documentation/audits/security-review-2026-10-12/evidence/demo-hp-host-reads.txt b/documentation/audits/security-review-2026-10-12/evidence/demo-hp-host-reads.txt new file mode 100644 index 00000000..7d2c78a4 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/evidence/demo-hp-host-reads.txt @@ -0,0 +1,108 @@ +# demo-hp host reads, 2026-10-12T15:13:29+02:00, via ssh demo-hp (read-only) +felhom-agent 0.154.0 +## listening sockets +tcp *:3128 users:(("spiceproxy +tcp *:8006 users:(("pveproxy +tcp 0.0.0.0:111 users:(("rpcbind",pid=689,fd=4),("systemd",pid=1,fd=169)) +tcp 0.0.0.0:22 users:(("sshd",pid=1010,fd=6)) +tcp 0.0.0.0:8822 users:(("sshd",pid=1004,fd=7)) +tcp 127.0.0.1:25 users:(("master",pid=1185,fd=13)) +tcp 127.0.0.1:53 users:(("dnsmasq",pid=1001,fd=7)) +tcp 127.0.0.1:85 users:(("pvedaemon +tcp 169.254.253.1:8443 users:(("felhom-agent",pid=1265,fd=16)) +tcp 192.168.0.104:53 users:(("dnsmasq",pid=1001,fd=5)) +tcp [::1]:25 users:(("master",pid=1185,fd=14)) +tcp [::]:111 users:(("rpcbind",pid=689,fd=6),("systemd",pid=1,fd=171)) +tcp [::]:22 users:(("sshd",pid=1010,fd=7)) +tcp [::]:8822 users:(("sshd",pid=1004,fd=6)) +udp 0.0.0.0:111 users:(("rpcbind",pid=689,fd=5),("systemd",pid=1,fd=170)) +udp 0.0.0.0:55675 +udp 10.77.0.3:51822 users:(("felhom-agent",pid=1265,fd=24)) +udp 127.0.0.1:323 users:(("chronyd",pid=777,fd=4)) +udp 127.0.0.1:53 users:(("dnsmasq",pid=1001,fd=6)) +udp 192.168.0.104:53 users:(("dnsmasq",pid=1001,fd=4)) +udp [::1]:323 users:(("chronyd",pid=777,fd=5)) +udp [::]:111 users:(("rpcbind",pid=689,fd=7),("systemd",pid=1,fd=172)) +udp [::]:55675 +## sshd -T (auth lines) +port 22 +listenaddress [::]:22 +listenaddress 0.0.0.0:22 +maxauthtries 6 +permitrootlogin yes +pubkeyauthentication yes +passwordauthentication yes +kbdinteractiveauthentication no +## nft felhom_oob + chain input { + type filter hook input priority filter - 5; policy accept; + iifname "wg-felhom" tcp dport @ssh_port ip saddr @operator_ips accept + iifname "wg-felhom" tcp dport @ssh_port drop + tcp dport @ssh_port iifname != "wg-felhom" drop +## sudoers.d +total 36 +-r--r----- 1 root root 1068 Apr 11 2026 README +-r--r----- 1 root root 24335 Oct 7 13:36 felhom-agent +-r--r----- 1 root root 1466 Oct 7 13:36 felhom-op +-r--r----- 1 root root 666 May 20 2023 zfs +## guest LXC 9201 (mac masked) +arch: amd64 +cores: 7 +features: nesting=1,keyctl=1 +hookscript: local:snippets/felhom-guest-hook.sh +hostname: demo-hp +memory: 25898 +mp0: local-lvm:vm-9201-disk-1,mp=/var/lib/felhom,backup=1,size=70G +mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives +mp9: /var/lib/felhom-agent/guests/9201/bootstrap,mp=/etc/felhom-bootstrap,ro=1 +net0: name=eth0,bridge=vmbr0,hwaddr=,ip=dhcp,type=veth +net1: name=eth1,bridge=vmbr9,hwaddr=,ip=169.254.253.2/30,type=veth +onboot: 1 +ostype: debian +rootfs: local-lvm:vm-9201-disk-0,size=32G +swap: 512 +unprivileged: 1 +## secret-file modes (paths/modes only) +600 felhom-agent:felhom-agent 2454 /etc/felhom-agent/agent.json +600 felhom-agent:felhom-agent 2498 /etc/felhom-agent/agent.json.night-0925-off +600 felhom-agent:felhom-agent 2451 /etc/felhom-agent/agent.json.pre-a4-retention +600 felhom-agent:felhom-agent 2451 /etc/felhom-agent/agent.json.pre-d44 +600 root:root 2451 /etc/felhom-agent/agent.json.pre-r672 +644 root:root 0 /etc/felhom/.bootstrap-done +644 root:root 7 /etc/felhom/appliance-pairing-code +644 root:root 3429 /etc/felhom/config-bundle.json +644 root:root 456 /etc/felhom/crash-guard.conf +644 root:root 131 /etc/felhom/operator-signers +644 root:root 61 /etc/felhom/os-trust.json +600 felhom-agent:felhom-agent 189 /var/lib/felhom-agent/backup-success-state.json +600 felhom-agent:felhom-agent 290 /var/lib/felhom-agent/controller-swap-9201.json +600 felhom-agent:felhom-agent 61 /var/lib/felhom-agent/drive-intents.json +600 felhom-agent:felhom-agent 64 /var/lib/felhom-agent/escrow-stage/restic_repo_password +600 felhom-agent:felhom-agent 93 /var/lib/felhom-agent/felhom-sshd/authorized_keys.felhom-op +600 felhom-agent:felhom-agent 5 /var/lib/felhom-agent/felhom-sshd/port +600 felhom-agent:felhom-agent 433 /var/lib/felhom-agent/felhom-sshd/sshd_config +600 felhom-agent:felhom-agent 67 /var/lib/felhom-agent/guest-binds.json +600 felhom-agent:felhom-agent 241 /var/lib/felhom-agent/guest-disk-trim.json +600 100000:100000 403 /var/lib/felhom-agent/guests/9201/bootstrap/bootstrap.json +600 felhom-agent:felhom-agent 234 /var/lib/felhom-agent/guests/9201/controller-restarts-24h.json +644 root:root 254 /var/lib/felhom-agent/guests/9202/bootstrap/bootstrap.json +600 felhom-agent:felhom-agent 31342 /var/lib/felhom-agent/journal.log +644 felhom-agent:felhom-agent 591 /var/lib/felhom-agent/local-api.crt +600 felhom-agent:felhom-agent 227 /var/lib/felhom-agent/local-api.key +600 felhom-agent:felhom-agent 82 /var/lib/felhom-agent/local-tokens.log +600 felhom-agent:felhom-agent 3196 /var/lib/felhom-agent/nonces.log +600 felhom-agent:felhom-agent 20 /var/lib/felhom-agent/os/last-night-run +600 felhom-agent:felhom-agent 79 /var/lib/felhom-agent/os/os-update-block.json +600 felhom-agent:felhom-agent 0 /var/lib/felhom-agent/os/pass.lock +600 felhom-agent:felhom-agent 148 /var/lib/felhom-agent/os/plan-20261005T025659Z-guest-apply.json +600 felhom-agent:felhom-agent 203 /var/lib/felhom-agent/os/plan-20261005T054446Z-guest-apply.json +600 felhom-agent:felhom-agent 203 /var/lib/felhom-agent/os/plan-20261005T061334Z-guest-apply.json +600 felhom-agent:felhom-agent 203 /var/lib/felhom-agent/os/plan-20261005T075541Z-guest-apply.json +600 felhom-agent:felhom-agent 2398 /var/lib/felhom-agent/pbsdr/agent.json.pre-seed +600 felhom-agent:felhom-agent 129 /var/lib/felhom-agent/pbsdr/marker.json +600 felhom-agent:felhom-agent 367 /var/lib/felhom-agent/restore-test-state.json +644 felhom-agent:felhom-agent 288 /var/lib/felhom-agent/units/mnt-hdd_1.mount +600 felhom-agent:felhom-agent 64 /var/lib/felhom-agent/wg/last-applied.sha +600 felhom-agent:felhom-agent 45 /var/lib/felhom-agent/wg/private.key +600 felhom-agent:felhom-agent 101 /var/lib/felhom-agent/wg/registered.json +600 felhom-agent:felhom-agent 327 /var/lib/felhom-agent/wg/wg-felhom.conf diff --git a/documentation/audits/security-review-2026-10-12/evidence/demo-hp-lan-tcp-connect.txt b/documentation/audits/security-review-2026-10-12/evidence/demo-hp-lan-tcp-connect.txt new file mode 100644 index 00000000..7f1ed5b9 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/evidence/demo-hp-lan-tcp-connect.txt @@ -0,0 +1 @@ +192.168.0.104 open TCP: [22, 53, 111, 3128, 8006] diff --git a/documentation/audits/security-review-2026-10-12/evidence/hub-0.148.0-live-check.txt b/documentation/audits/security-review-2026-10-12/evidence/hub-0.148.0-live-check.txt new file mode 100644 index 00000000..bc22ef29 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/evidence/hub-0.148.0-live-check.txt @@ -0,0 +1,7 @@ +# hub v0.148.0 live check 2026-10-12T16:58:46+02:00 from DooPlex (LAN; the ingress admits LAN, HU, IE) +A no credential GET /api/v1/customers -> 403 body names a customer: False body: Forbidden: global key required +C operator key GET /api/v1/customers -> 200 bytes 1247 +A no credential GET /api/v1/customers/ -> 403 body names a customer: False body: Forbidden: global key required +C operator key GET /api/v1/customers/ -> 200 bytes 2542 +A no credential GET /api/v1/customers//history -> 403 body names a customer: False body: Forbidden: global key required +C operator key GET /api/v1/customers//history -> 200 bytes 3 diff --git a/documentation/audits/security-review-2026-10-12/evidence/public-sites.txt b/documentation/audits/security-review-2026-10-12/evidence/public-sites.txt new file mode 100644 index 00000000..41a975b8 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/evidence/public-sites.txt @@ -0,0 +1,29 @@ +# public sites, read-only GETs at browsing rate, 2026-10-12T15:13:59+02:00, from DooPlex +== https://felhom.eu/ +HTTP/2 200 +x-frame-options: SAMEORIGIN +x-content-type-options: nosniff +strict-transport-security: max-age=31536000; includeSubDomains +== https://iso.felhom.eu/ +HTTP/2 404 +server: cloudflare +== https://stats.felhom.eu/ +HTTP/2 200 +content-security-policy: default-src 'self'; img-src 'self' https: data:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self' https:; frame-ancestors 'self' ; +strict-transport-security: max-age=31536000; includeSubDomains +== https://gitea.dooplex.hu/ +HTTP/2 200 +x-frame-options: SAMEORIGIN +strict-transport-security: max-age=31536000; includeSubDomains +== https://hub.felhom.eu/login +HTTP/2 200 +strict-transport-security: max-age=31536000; includeSubDomains +felhom.eu/.git/HEAD 404 +felhom.eu/scripts/ 403 +felhom.eu/.env 404 +felhom.eu/robots.txt 200 +== gitea anonymous repo list +[('admin/app-catalog-felhom.eu', 'public'), ('admin/felhom-agent', 'public'), ('admin/felhom-controller', 'public'), ('admin/felhom.eu', 'public'), ('admin/misc-scripts', 'public'), ('admin/recipe-importer', 'public'), ('admin/revfulop-calendar', 'public')] +== gitea sign-up page says: +['Registration is disabled.'] +gitea anon packages API 401 diff --git a/documentation/audits/security-review-2026-10-12/scanners/gitleaks-app-catalog-felhom.eu.redacted.json b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-app-catalog-felhom.eu.redacted.json new file mode 100644 index 00000000..42773e41 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-app-catalog-felhom.eu.redacted.json @@ -0,0 +1,22 @@ +{ + "withheld_P1_entries": 0, + "findings": [ + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 13, + "EndLine": 13, + "StartColumn": 53, + "EndColumn": 90, + "Secret": "REDACTED", + "File": "REPORT.md", + "SymlinkFile": "", + "Commit": "f51f794cf0f2d03206449bf7b79381be85879d32", + "Entropy": 3.9232519, + "Date": "2026-06-22T13:12:19Z", + "Message": "docs: REPORT for komga healthcheck fix\n\nCo-Authored-By: Claude Opus 4.8 (1M context) ", + "Tags": [], + "Fingerprint": "f51f794cf0f2d03206449bf7b79381be85879d32:REPORT.md:generic-api-key:13" + } + ] +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom-agent.redacted.json b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom-agent.redacted.json new file mode 100644 index 00000000..7dd285a3 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom-agent.redacted.json @@ -0,0 +1,260 @@ +{ + "withheld_P1_entries": 0, + "findings": [ + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 246, + "EndLine": 246, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "91b9405c81bd94f6f1067eed5ce866879363ba29", + "Entropy": 3.97006, + "Date": "2026-10-08T05:53:01Z", + "Message": "R-304: no 'wrong code' when earlier sealed packages were not all checked (424 older_unchecked)\n\nUnreleased; ships with tomorrow's release.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "91b9405c81bd94f6f1067eed5ce866879363ba29:internal/escrow/recover_retained_test.go:generic-api-key:246" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 247, + "EndLine": 247, + "StartColumn": 41, + "EndColumn": 126, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "91b9405c81bd94f6f1067eed5ce866879363ba29", + "Entropy": 3.9528196, + "Date": "2026-10-08T05:53:01Z", + "Message": "R-304: no 'wrong code' when earlier sealed packages were not all checked (424 older_unchecked)\n\nUnreleased; ships with tomorrow's release.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "91b9405c81bd94f6f1067eed5ce866879363ba29:internal/escrow/recover_retained_test.go:generic-api-key:247" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 295, + "EndLine": 295, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "91b9405c81bd94f6f1067eed5ce866879363ba29", + "Entropy": 3.9528196, + "Date": "2026-10-08T05:53:01Z", + "Message": "R-304: no 'wrong code' when earlier sealed packages were not all checked (424 older_unchecked)\n\nUnreleased; ships with tomorrow's release.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "91b9405c81bd94f6f1067eed5ce866879363ba29:internal/escrow/recover_retained_test.go:generic-api-key:295" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 30, + "EndLine": 30, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.9528196, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:30" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 102, + "EndLine": 102, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.9528196, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:102" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 103, + "EndLine": 103, + "StartColumn": 44, + "EndColumn": 129, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.9528196, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:103" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 125, + "EndLine": 125, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.9528196, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:125" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 151, + "EndLine": 151, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.9528196, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:151" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 169, + "EndLine": 169, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.97006, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:169" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 196, + "EndLine": 196, + "StartColumn": 43, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.97006, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:196" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 197, + "EndLine": 197, + "StartColumn": 40, + "EndColumn": 125, + "Secret": "REDACTED", + "File": "internal/escrow/recover_retained_test.go", + "SymlinkFile": "", + "Commit": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79", + "Entropy": 3.97006, + "Date": "2026-08-12T16:40:00Z", + "Message": "v0.129.0 \u2014 a correct code for an earlier package stops being called wrong (R-311)\n\nYesterday's drill proved a retained escrow package opens a set-aside store and\nrestores planted files byte-identical, while this agent answered the customer's\ncorrect code with \"the recovery code did not open the sealed bundle\". Nothing had\never tried the retained packages, so a correct-but-earlier code and a mistype were\ngenuinely indistinguishable.\n\nOffsiteKeyRecoverer gains an optional FetchRetained, consulted ONLY after the\ncurrent package refuses, so the ordinary recovery pays nothing for it and cannot\nfail because of it. A match returns ErrCodeOpensRetained wrapped in a\nRetainedOpenedError carrying the supersession date - no material, no code, no\npassword. The local API answers 422: a FIFTH status added to the R-224 switch,\nnever a restructuring of it.\n\nFail-safe in every direction. Nil fetcher, a hub too old for the route (404 is a\nclean \"none\"), a transport failure, a malformed package: each leaves the original\nrefusal standing. Attempts bounded at 6 because each unwrap is ~1s of scrypt.\n\nSeven tests with REAL age crypto - the two situations are indistinguishable AT\nTHE UNWRAP, so a faked unwrap would prove nothing. Red-proof asserted applied:\nremove the retained lookup and the fail-closed wrong-code error returns, which is\nthe lie in those exact words.", + "Tags": [], + "Fingerprint": "1db56bf8379df68ee23e7b000c5ff01bd76b5c79:internal/escrow/recover_retained_test.go:generic-api-key:197" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 243, + "EndLine": 243, + "StartColumn": 40, + "EndColumn": 77, + "Secret": "REDACTED", + "File": "internal/escrow/recover_test.go", + "SymlinkFile": "", + "Commit": "a2e914f683bd1fddbc843c5ebf38e71500ebf0b9", + "Entropy": 4, + "Date": "2026-08-06T05:55:15Z", + "Message": "v0.126.0: a fetch failure is not a wrong recovery code (R-224)\n\nA hub the agent could not reach was reported to the customer as a bad recovery\ncode. Measured live 2026-08-05 (CAMPAIGN-11 F3): hub firewalled off, a CORRECT\ncurrent code, and the customer told it did not open their package \u2014 in 0.0556s\nagainst ~1.0s for a real unseal. No unseal was attempted.\n\nThe discriminator existed here and this boundary threw it away: recover.go\nfails at four distinguishable points and the local-api handler had cases for\ntwo, with a default answering 'the recovery code did not open the sealed\nbundle, OR the bundle could not be fetched'.\n\nescrow.ErrBundleFetch now joins the fetch leg and the handler routes it to 502\nwith its own words \u2014 the code was NOT used. 502 not 4xx: the request was not\nbad, an upstream dependency failed. Four situations, four statuses: 502 fetch /\n400 fetched-and-refused / 404 no bundle / 409 predates the field. The\ncontroller classifies on the STATUS and never parses the sentence.\n\nA GREEN TEST NAMED THIS DEFECT AND DID NOT PREVENT IT.\nTestRecoverOffsiteRepoPassword_FetchErrorIsDistinct has said since v0.125.0\nthat the operator must not be sent to re-read their code because the hub was\nunreachable \u2014 and passed throughout, because it asserted this package's error\nSTRING one layer below the merge, and a string is not something a caller can\nbranch on. Re-pointed at the sentinel, with a consequence-level twin asserting\nthe status.\n\nRed-proofs: removing the %w join fails the sentinel test; deleting the handler\ncase makes fetch and wrong-code both answer 400 with the wrong-code sentence.\n\n29 packages ok, vet clean, agent gates OK.", + "Tags": [], + "Fingerprint": "a2e914f683bd1fddbc843c5ebf38e71500ebf0b9:internal/escrow/recover_test.go:generic-api-key:243" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 128, + "EndLine": 128, + "StartColumn": 9, + "EndColumn": 46, + "Secret": "REDACTED", + "File": "internal/pbsdr/wrapper_read_test.go", + "SymlinkFile": "", + "Commit": "b2ca63ee9fe3eec9454b05c7d8d8dd2ace51b35e", + "Entropy": 4.3565583, + "Date": "2026-07-21T08:12:31Z", + "Message": "v0.91.0 \u2014 the DR tier can no longer be `applied` and dead at the same time (R-39 + R-50b(a))\n\nCloses the agent half of R-39's fleet fix. Requires hub >=0.68.0 for the re-arm signal;\nthat hub is safe for 0.90.0 agents (unknown key dropped), so it deploys first.\n\nThree compounding defects let a box report `applied` while every PBS request 401'd:\n\n1. The re-key was INVISIBLE. An ep0 re-issue rotates the secret of an existing token, so\n token_id/fingerprint/datastore/namespace come back byte-identical and the descriptor\n content hash never moved \u2014 the converged agent short-circuited and never consumed the\n fresh secret. WirePBSDR.SecretGeneration (field-exact with the hub) is what moves the\n hash now, because descriptorHash marshals this struct.\n\n2. The agent could not READ its own credential. It writes /etc/pve/priv/storage/.pw\n through the root wrapper, but that dir is 0700 root:www-data and the wrapper had no\n read verb \u2014 so the target resolver got \"permission denied\" every cycle, warned, and\n skipped. The one loop that could have caught the 401 was blind BY CONSTRUCTION. Adds a\n narrow `read` verb (+ exactly one sudoers line, + a pbsdr-read capability row): one\n secret to stdout, no network, no mutation, never in argv (sudo logs argv), traversal\n refused by the id grammar, the dir allowlist AND a resolved-path prefix assertion.\n\n3. Nothing probed AUTHENTICATION. pbs.ProbeAuth (GET /version + an ErrUnauthorized\n sentinel) runs on the 15-minute collect path and its verdict becomes a loud\n `auth_failed` the hub escalates to a fresh mint. /version needs no datastore, namespace\n or privilege, so a 401 means the CREDENTIAL is bad; 403 is deliberately NOT treated as\n unauthorized, since re-keying a too-narrow token would mint forever without fixing\n anything. A transport error is UNKNOWN, never a rejection \u2014 otherwise every network\n blip burns a credential. Recovery self-clears.\n\nR-50b(a): the report now carries the installed wrapper's sha256 so drift against the\nvouched manifest value is answerable. Empty = unknown, never drift.\n\nThree red-proofs, all at the assertion level. Removing SecretGeneration fails the re-arm\ntest with \"consume calls=1, want 2\". Swallowing the probe result leaves State:applied\nAuthFailed:false \u2014 the July-18 shape exactly. Notably, deleting the wrapper's id charset\nguard alone does NOT open a traversal hole (readlink + the prefix assertion still catch\nit), so the isolating red-proof removes BOTH and shows the out-of-tree secret printed \u2014\nthe layering is real, and a single-guard red-proof would have passed vacuously.", + "Tags": [], + "Fingerprint": "b2ca63ee9fe3eec9454b05c7d8d8dd2ace51b35e:internal/pbsdr/wrapper_read_test.go:generic-api-key:128" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 22, + "EndLine": 22, + "StartColumn": 9, + "EndColumn": 83, + "Secret": "REDACTED", + "File": "internal/localapi/escrow_stage_test.go", + "SymlinkFile": "", + "Commit": "0c22b9bbf3c6a6d1411f9527df0ce40b26c5236e", + "Entropy": 3.6241388, + "Date": "2026-07-09T12:56:09Z", + "Message": "v0.77.0: fork-4 \u2014 escrow the offsite restic repo password under R\n\nIdentityBundle gains ResticRepoPassword (rides existing age-under-R\nWrapIdentityBundle; custody spike febdc56 proved a recovered value opens the\nreal repo). POST /escrow/stage-secret (withGuest, scopedFromBody) transiently\nstages the controller-pushed password (0600, atomic, NEVER logged), which the\nescrow-create ceremony auto-injects then wipes. Adds AttachResticPassword +\nStagedResticPasswordPath + WipeStagedResticPassword; EscrowStagePath injectable\nfor tests. Tests: bundle carries pw byte-exact + not-in-blob + wrong-R fails\nclosed; stage 0600 + non-secret ack + cross-guest 403 + value-not-in-log.\nAdditive; PBS-K escrow untouched. NOT yet live-validated (supervised ceremony).\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "0c22b9bbf3c6a6d1411f9527df0ce40b26c5236e:internal/localapi/escrow_stage_test.go:generic-api-key:22" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 49, + "EndLine": 49, + "StartColumn": 28, + "EndColumn": 69, + "Secret": "REDACTED", + "File": "internal/escrow/identity_test.go", + "SymlinkFile": "", + "Commit": "e4dfe5ccc7df4182255d44a0565ebcfe95aeb68a", + "Entropy": 4.060262, + "Date": "2026-06-11T07:48:36Z", + "Message": "slice 10D (agent): DR capstone \u2014 identity escrow + restore-mode consumption (v0.18.0)\n\nIdentity escrow wraps {tunnel_token,pbs_token} under the SAME R via age\n(scrypt+ChaCha20-Poly1305), reusing the K-escrow pty; wrong R fails closed.\nescrow.Create optionally emits the identity blob; escrow-create uploads it +\nthe non-secret directive; identity-consume recovers it (R by hand, never\nlogged). K-escrow + 10C Consume untouched. Closes slice 10 with hub v0.11.0;\noperator-side rotation model (hub holds no Cloudflare write-power).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) ", + "Tags": [], + "Fingerprint": "e4dfe5ccc7df4182255d44a0565ebcfe95aeb68a:internal/escrow/identity_test.go:generic-api-key:49" + } + ] +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom-controller.redacted.json b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom-controller.redacted.json new file mode 100644 index 00000000..3c503e0a --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom-controller.redacted.json @@ -0,0 +1,141 @@ +{ + "withheld_P1_entries": 4, + "findings": [ + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 272, + "EndLine": 272, + "StartColumn": 21, + "EndColumn": 52, + "Secret": "REDACTED", + "File": "controller/scripts/test_gate_decoys.py", + "SymlinkFile": "", + "Commit": "074ddda352e3e03388801c47f3848e5634379a1c", + "Entropy": 3.6168747, + "Date": "2026-10-05T19:54:41Z", + "Message": "R-576: go-parity gate also judges the CALL \u2014 arity vs printf verbs, and no key glued with +\n\nChecks 4 (ARITY) and 5 (NO-CONCAT) in i18n_go_parity.py: at every message-helper call\n(MsgError/MsgErrorf/Text/Msgf/msg/msgLang/msgHU/note) whose key is a literal hu.json knows,\nthe argument count must equal the Hungarian value's printf verbs; a known key literal may\nnever be an operand of +. 485 calls judged, 0 defects today. Decoys: a dropped argument and\na key+suffix concatenation on a real producer convict; a nested-paren argument is accepted.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "074ddda352e3e03388801c47f3848e5634379a1c:controller/scripts/test_gate_decoys.py:generic-api-key:272" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 151, + "EndLine": 151, + "StartColumn": 16, + "EndColumn": 53, + "Secret": "REDACTED", + "File": "controller/scripts/test_gate_decoys.py", + "SymlinkFile": "", + "Commit": "612c4170242760ab56aea8f43398a7e772898051", + "Entropy": 3.6841838, + "Date": "2026-09-17T12:50:57Z", + "Message": "v0.247.0: i18n spike \u2014 the dashboard can speak English, Hungarian byte-identical\n\nMessage bundles (internal/i18n) expanded into templates before parsing, one\ntemplate set per language. Launcher, /backups, /apps/ and the layout\nconverted; household language setting, POST /settings/language, ?lang= override,\nreport field. Parity test against fixtures captured from unconverted templates;\ncopy gates read templates expanded; new i18n_missing_gate.\n\nCo-Authored-By: Claude Opus 5 \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "612c4170242760ab56aea8f43398a7e772898051:controller/scripts/test_gate_decoys.py:generic-api-key:151" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 43, + "EndLine": 43, + "StartColumn": 8, + "EndColumn": 88, + "Secret": "REDACTED", + "File": "controller/internal/backup/offbox_offer_shapec_r241_test.go", + "SymlinkFile": "", + "Commit": "a491abef6c2043ff260fde5dd8a8c4be7d7456df", + "Entropy": 3.8961687, + "Date": "2026-08-07T09:33:42Z", + "Message": "R-241 part 2: the comparison the box already makes becomes the thing that offers recovery\n\nTHE FACT WAS COMPUTED EVERY CYCLE AND KEPT NOWHERE. EscrowAutoConfirmer.Reconcile\nhas compared the hub's restic_pw_sha256 against the local key on every ACK since\nSLICE 3. On the final-walk venue it logged, at 03:28:03Z and thirty-five minutes\nbefore the customer looked, \"the hub's escrow blob does not cover the CURRENT repo\npassword (hub hash 30ef574f != local 9b4a9a9d)\" - and dropped it. The recovery\nscreen, evaluating in the same process, went on asking a question that could not\nsee it.\n\nNow persisted: settings.HubEscrowKeySHA256 + HubEscrowKeyCheckedAt, recorded\nUNCONDITIONALLY in Reconcile beside RecordPresence and RecordSuperseded - same\nplace, same reason: the box that needs it most is the rebuilt one with no target,\non which every gate below returns early.\n\nOffsiteRecoveryOffer gains SHAPE (c): the hub holds a package for a key OTHER than\nthe one we are using. (a) and (b) are both proxies for that question and both have\nnow been wrong in opposite directions - (a) goes false the moment anything mints,\n(b) is unreachable while the escrow is pending.\n\nSEC 7.2, decided deliberately and stated in the code:\n - a KNOWN DIFFERENCE offers, however old the reading. Age is not gated on. Both\n sides are local; only the hub's half can be stale, and what the hub holds does\n not change without a ceremony THIS box runs, which refreshes the hash on the\n next ACK. Gating on age would make a box offline from the hub silently stop\n offering - the exact failure this session removes. CheckedAt is persisted for\n diagnosis, not as a gate.\n - an ABSENT hash falls back to (a)/(b) and does NOT offer. \"\" is the hub\n positively saying its package seals no repository password (legacy hash-less\n escrow). Nothing to compare, and offering would put a permanent screen in\n front of every legacy box.\n\nThe write damper: CheckedAt refreshes on every ack carrying a hash, but a save is\nskipped when both the hash and the UTC day are unchanged, so an idle box does not\nrewrite settings.json every fifteen minutes. It records WHEN WE LAST HEARD, not\nwhen it last changed - the R-100 distinction.\n\nTests: Scenario C (a differing key offers, with both proxies asserted false first),\nScenario D (a matching key offers nothing), fact 1 still required, shape (a) still\nworks, and both SEC 7.2 halves.\n\nRED-PROOFS, each with the mutation confirmed present in the file first:\n D) hubHash != localHash conjunct dropped -> Scenario D FAILS (a healthy box\n offered recovery forever); Scenario C still passes\n WIRING) RecordEscrowKeyHash removed from the EscrowAutoConfirmer literal in\n main.go -> TestMainWiresRecordEscrowKeyHash FAILS. This is the ships-inert\n shape: unwired, everything compiles, every test in the package passes, the\n auto-confirm still works, and shape (c) reads an empty hash forever.\n\nGreen: go build, go vet, go test ./... all pass.", + "Tags": [], + "Fingerprint": "a491abef6c2043ff260fde5dd8a8c4be7d7456df:controller/internal/backup/offbox_offer_shapec_r241_test.go:generic-api-key:43" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 85, + "EndLine": 85, + "StartColumn": 8, + "EndColumn": 89, + "Secret": "REDACTED", + "File": "REPORT.md", + "SymlinkFile": "", + "Commit": "3d3b4496f37708269b73f15772a66f6218f5f9ba", + "Entropy": 3.794148, + "Date": "2026-08-07T10:23:55Z", + "Message": "REPORT.md \u2014 R-241 fixed, deployed, live-validated on both demo boxes\n\nScenario A's live result first: on demo-hp in the rebuilt shape, no key was\nminted on the real start-up offsite-apply path, and the hub received the state\nit reports instead - offsite.state=awaiting_recovery_key with enabled:false.\nKey restored byte-identical afterwards.\n\nIncludes Q4's seven rows mapped to the three states, the SEC 7.2 choice and\nwhy, SEC 7.3's answer on the new-code button, every changed Hungarian string\nquoted, all nine red-proofs with what was mutated, the R-245 reasoning, and\nthree observations noticed but not acted on.", + "Tags": [], + "Fingerprint": "3d3b4496f37708269b73f15772a66f6218f5f9ba:REPORT.md:generic-api-key:85" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 86, + "EndLine": 86, + "StartColumn": 2, + "EndColumn": 89, + "Secret": "REDACTED", + "File": "REPORT.md", + "SymlinkFile": "", + "Commit": "3d3b4496f37708269b73f15772a66f6218f5f9ba", + "Entropy": 3.794148, + "Date": "2026-08-07T10:23:55Z", + "Message": "REPORT.md \u2014 R-241 fixed, deployed, live-validated on both demo boxes\n\nScenario A's live result first: on demo-hp in the rebuilt shape, no key was\nminted on the real start-up offsite-apply path, and the hub received the state\nit reports instead - offsite.state=awaiting_recovery_key with enabled:false.\nKey restored byte-identical afterwards.\n\nIncludes Q4's seven rows mapped to the three states, the SEC 7.2 choice and\nwhy, SEC 7.3's answer on the new-code button, every changed Hungarian string\nquoted, all nine red-proofs with what was mutated, the R-245 reasoning, and\nthree observations noticed but not acted on.", + "Tags": [], + "Fingerprint": "3d3b4496f37708269b73f15772a66f6218f5f9ba:REPORT.md:generic-api-key:86" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 258, + "EndLine": 258, + "StartColumn": 9, + "EndColumn": 34, + "Secret": "REDACTED", + "File": "controller/internal/stacks/samba_test.go", + "SymlinkFile": "", + "Commit": "0dcbea90b2b9fc2dc9194e6ae6b2db1796d77c1b", + "Entropy": 3.640224, + "Date": "2026-07-18T09:30:04Z", + "Message": "feat(samba): lifecycle \u2014 ensureSamba/ReconcileSamba/password/disable (R-7 slice 1, Part 2)\n\nensureSamba joins EnsureBaseStack after filebrowser, gated on SMB.Enabled\n(cloudflared conditional precedent); reconcile is idempotent (unchanged config +\nrunning container = ZERO compose calls, asserted via seam). Atomic tmp+fsync+\nrename config writes. Password applied via smbpasswd on STDIN (never argv/log/\nsettings). Disable = compose down, volumes + folders KEPT. samba added to\nIsProtectedStack in code (controller.yaml is golden-generated and predates it),\nwhich also makes the app-backup loops correctly skip it.", + "Tags": [], + "Fingerprint": "0dcbea90b2b9fc2dc9194e6ae6b2db1796d77c1b:controller/internal/stacks/samba_test.go:generic-api-key:258" + }, + { + "RuleID": "curl-auth-header", + "Description": "Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.", + "StartLine": 1413, + "EndLine": 1416, + "StartColumn": 2, + "EndColumn": 97, + "Secret": "REDACTED", + "File": "TASK2.md", + "SymlinkFile": "", + "Commit": "6713df2186aa87b5ad0862d678b5f5ddb1cc349f", + "Entropy": 3.8710182, + "Date": "2026-02-19T12:16:46Z", + "Message": "v0.15.5: Disaster recovery \u2014 Hub-based infra backup, auto-mount, restore UI\n\nComplete DR implementation (TASK2.md Phases 1-4):\n- Hub infra-backup push/pull endpoints (controller.yaml, disk layout, stacks)\n- Fresh-deployment detection pulls config from Hub, auto-mounts drives by UUID\n- Full-page restore UI with drive status, app table, sequential restore\n- docker-setup.sh shows DR instructions when customer_id is configured\n\nNew files: disk_layout.go, restore_scan.go, restore_app_linux.go,\nrestore_drives_linux.go, infra_backup.go, infra_pull.go,\nhandler_restore.go, restore.html\n\nCo-Authored-By: Claude Opus 4.6 ", + "Tags": [], + "Fingerprint": "6713df2186aa87b5ad0862d678b5f5ddb1cc349f:TASK2.md:curl-auth-header:1413" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 1638, + "EndLine": 1638, + "StartColumn": 4, + "EndColumn": 78, + "Secret": "REDACTED", + "File": "scripts/docker-setup.sh", + "SymlinkFile": "", + "Commit": "cdaa13711843fc9bb9bccf31b784ee68a4108966", + "Entropy": 3.8710182, + "Date": "2026-02-19T12:33:39Z", + "Message": "docker-setup.sh v5.0: Config wizard, controller deployment, FileBrowser rewrite\n\nComplete TASK.md implementation:\n- \u00a71: Version bump to 5.0.0, updated banner and header comment\n- \u00a73+\u00a74: Remove --cf-tunnel-token and --hdd-path CLI options (deprecated)\n- \u00a75: Rewrite install_filebrowser() with auto drive discovery from /mnt/\n- \u00a76: New install_controller() deploys felhom-controller with compose\n- \u00a77: Interactive run_config_wizard() generates controller.yaml\n- \u00a79: install_cloudflare_tunnel() reads from wizard variable\n- \u00a710: New execution order: infra \u2192 wizard \u2192 tunnel \u2192 filebrowser \u2192 controller\n- \u00a711: Fix print_summary() \u2014 controller URL, hub status, fix CUSTOMER_ID bug\n- \u00a712: Update print_help() for new workflow\n\nCo-Authored-By: Claude Opus 4.6 ", + "Tags": [], + "Fingerprint": "cdaa13711843fc9bb9bccf31b784ee68a4108966:scripts/docker-setup.sh:generic-api-key:1638" + } + ] +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom.eu.redacted.json b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom.eu.redacted.json new file mode 100644 index 00000000..2b2ae482 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-felhom.eu.redacted.json @@ -0,0 +1,719 @@ +{ + "withheld_P1_entries": 1, + "findings": [ + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 38, + "EndLine": 38, + "StartColumn": 287, + "EndColumn": 314, + "Secret": "REDACTED", + "File": "documentation/audits/r890-instructions-2026-10-06/tools/wgerwalk.py", + "SymlinkFile": "", + "Commit": "01d5dbd3e0325809147ccaf9fce4fa2efabf1c51", + "Entropy": 3.6168747, + "Date": "2026-10-06T12:03:28Z", + "Message": "Part C: R-644, R-763, R-764 closed (wger's fixes proven on 9202), R-762/R-717 stopped with reasons; STATUS, CONTEXT, REPORT (142 -> 137; 0 opened, 5 closed)\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "01d5dbd3e0325809147ccaf9fce4fa2efabf1c51:documentation/audits/r890-instructions-2026-10-06/tools/wgerwalk.py:generic-api-key:38" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 16, + "EndLine": 16, + "StartColumn": 3, + "EndColumn": 67, + "Secret": "REDACTED", + "File": "hub/internal/store/r879_box_seal_test.go", + "SymlinkFile": "", + "Commit": "5f060e3d1e669e8f0db89a88c14d18f7ac3a1141", + "Entropy": 4.4701757, + "Date": "2026-10-05T19:18:14Z", + "Message": "R-879: seal box API keys, owner passphrases, controller keys and PBS-DR tokens at rest\n\nhosts.api_key, customer_configs.api_key / retrieval_password and host_pbs_secrets.value now hold the\nR-821/R-133 seal (enc:v1:, OFFSITE_SECRET_KEY). The two API keys get an api_key_hash lookup twin\n(SHA-256, backfilled keyless in migrate()), so box authentication never needs the sealing key; a row\nwith no hash is matched on its plaintext only while it is plaintext. SealLegacyBoxSecrets seals legacy\nrows at start-up (idempotent, non-fatal). A sealed value that does not open sets SecretsUnreadable:\nserve/compare paths answer 500, saves refuse the record, the PBS token is not burned.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "5f060e3d1e669e8f0db89a88c14d18f7ac3a1141:hub/internal/store/r879_box_seal_test.go:generic-api-key:16" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 5, + "EndLine": 5, + "StartColumn": 84, + "EndColumn": 138, + "Secret": "REDACTED", + "File": "documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt", + "SymlinkFile": "", + "Commit": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa", + "Entropy": 4.8619704, + "Date": "2026-10-03T19:21:04Z", + "Message": "Off-site lock live: Parts D/E/F evidence, ep0 copy runbook, 06/07 facts, register (R-820/R-821/R-342 closed, R-825 opened+closed, R-95/R-822 narrowed, R-823/R-824/R-826/R-827/R-828/R-830 opened; 327 -> 330); hub window-sweep test (test-only)\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa:documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt:generic-api-key:5" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 7, + "EndLine": 7, + "StartColumn": 56, + "EndColumn": 110, + "Secret": "REDACTED", + "File": "documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt", + "SymlinkFile": "", + "Commit": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa", + "Entropy": 4.8619704, + "Date": "2026-10-03T19:21:04Z", + "Message": "Off-site lock live: Parts D/E/F evidence, ep0 copy runbook, 06/07 facts, register (R-820/R-821/R-342 closed, R-825 opened+closed, R-95/R-822 narrowed, R-823/R-824/R-826/R-827/R-828/R-830 opened; 327 -> 330); hub window-sweep test (test-only)\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa:documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt:generic-api-key:7" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 8, + "EndLine": 8, + "StartColumn": 56, + "EndColumn": 110, + "Secret": "REDACTED", + "File": "documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt", + "SymlinkFile": "", + "Commit": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa", + "Entropy": 4.8619704, + "Date": "2026-10-03T19:21:04Z", + "Message": "Off-site lock live: Parts D/E/F evidence, ep0 copy runbook, 06/07 facts, register (R-820/R-821/R-342 closed, R-825 opened+closed, R-95/R-822 narrowed, R-823/R-824/R-826/R-827/R-828/R-830 opened; 327 -> 330); hub window-sweep test (test-only)\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "207ad197468a36783f5c93ae73a3e9aad6ffd0fa:documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt:generic-api-key:8" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 14, + "EndLine": 14, + "StartColumn": 83, + "EndColumn": 126, + "Secret": "REDACTED", + "File": "documentation/audits/family-gate-2026-10-02/tools/fg_items.py", + "SymlinkFile": "", + "Commit": "e6d1ebd1525171a4e35c51d5d791af3a65e0707c", + "Entropy": 4.168296, + "Date": "2026-10-02T07:35:42Z", + "Message": "Family gate built + licence read: evidence (9202, bench, floor), licence table + SparkyFitness request draft (not sent), 01 \u00a75 family gate, 09 decision 64 built, capability map, register 422 -> 436 (R-767/R-780/R-787 closed; R-775/R-784 updated; R-788..R-801 opened), CONTEXT\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "e6d1ebd1525171a4e35c51d5d791af3a65e0707c:documentation/audits/family-gate-2026-10-02/tools/fg_items.py:generic-api-key:14" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 9, + "EndLine": 9, + "StartColumn": 83, + "EndColumn": 126, + "Secret": "REDACTED", + "File": "documentation/audits/permanent-gate-2026-10-01/tools/items12.py", + "SymlinkFile": "", + "Commit": "b50289074d92d6a23975fda65475adf8ba09bb73", + "Entropy": 4.168296, + "Date": "2026-10-01T19:26:23Z", + "Message": "Evidence: Part A (visitors apart \u2014 measurements, design, sweep, 9202 live) and the permanent-gate spike (items 1\u20136, VERDICT: PASS, build plan)\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "b50289074d92d6a23975fda65475adf8ba09bb73:documentation/audits/permanent-gate-2026-10-01/tools/items12.py:generic-api-key:9" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 184, + "EndLine": 184, + "StartColumn": 40, + "EndColumn": 67, + "Secret": "REDACTED", + "File": "documentation/audits/new-apps-2026-10-01/tools/newapp_box.py", + "SymlinkFile": "", + "Commit": "bc9c7b49346b664ed37aa60d52c1f9ee4c6acd1d", + "Entropy": 3.9068906, + "Date": "2026-10-01T17:52:32Z", + "Message": "New apps night: Radicale, Karakeep, Dawarich published; Grimmory held (R-775); fit table; R-765..R-775; STATUS, CONTEXT, report, evidence\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "bc9c7b49346b664ed37aa60d52c1f9ee4c6acd1d:documentation/audits/new-apps-2026-10-01/tools/newapp_box.py:generic-api-key:184" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 4, + "EndLine": 4, + "StartColumn": 14, + "EndColumn": 61, + "Secret": "REDACTED", + "File": "documentation/audits/night-rulings-2026-09-30/D/D3-wanderer-routes-probe.txt", + "SymlinkFile": "", + "Commit": "3159892fabbf5827c071c67cb5018e35223f55e0", + "Entropy": 4.0980687, + "Date": "2026-09-30T21:26:21Z", + "Message": "Both rulings built: same-tag re-tests (decision 52), image retention + the install hold (controller 0.284.2); golden 0.284.2\n\n- Decision 52: catalog 6a3ead9 (re-test entries, gates, decoys, the monthly command); proven end to end on 9202\n through the leg; runbook monthly-floating-retest.md; nothing to re-test on the engine lines today.\n- Decision 53 + R-741: controller v0.284.2 (0.284.0/0.284.1 never floored \u2014 two wiring faults found live on 9202);\n floor 0.284.2; one-time sweep 9202 26.6 -> 5.7 GB, demo-hp 24.3 -> 13.5 GB; the install hold proven as a stranger.\n- Golden 0.284.2 baked, round-trip identical, vouched (agent 0.138.0, min_agent 0.131.0); the gate prints OK.\n- Rows 377 -> 383: opened R-743..R-748, closed R-736, R-737, R-740, R-741, R-748; narrowed R-739, R-698, R-446.\n- register_shape_gate: a lettered id (R-88a) is a row too (R-748), with a decoy seen red.\n\nEvidence: documentation/audits/night-rulings-2026-09-30/, documentation/tests/golden-0.284.2-2026-09-30/.\nReport: REPORT-night-rulings-2026-09-30.md.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "3159892fabbf5827c071c67cb5018e35223f55e0:documentation/audits/night-rulings-2026-09-30/D/D3-wanderer-routes-probe.txt:generic-api-key:4" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 2, + "EndLine": 2, + "StartColumn": 20, + "EndColumn": 78, + "Secret": "REDACTED", + "File": "documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/cloudflare-dns.txt", + "SymlinkFile": "", + "Commit": "4951fc22836835b90b951cd1cbe21c797fc85ead", + "Entropy": 3.5413363, + "Date": "2026-09-30T07:49:41Z", + "Message": "Decisions 50 (apps off-site by default, R-720) and 51 (ep0 drill archives; restore test on own archives, R-727) recorded; Tester-2 read-only checklist\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "4951fc22836835b90b951cd1cbe21c797fc85ead:documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/cloudflare-dns.txt:generic-api-key:2" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 5, + "EndLine": 5, + "StartColumn": 236, + "EndColumn": 259, + "Secret": "REDACTED", + "File": "documentation/audits/signup-lock-2026-09-29/B/wd.sh", + "SymlinkFile": "", + "Commit": "8cadacb553ba5003800eb6c861f766054b36c8c1", + "Entropy": 3.5849626, + "Date": "2026-09-29T15:19:43Z", + "Message": "Sign-up lock 2026-09-29 evening: decisions 48/49 outcomes, two locks, wanderer closable, R-714/715/716 closed, R-717/718 opened; STATUS, CONTEXT, report\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "8cadacb553ba5003800eb6c861f766054b36c8c1:documentation/audits/signup-lock-2026-09-29/B/wd.sh:generic-api-key:5" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 5, + "EndLine": 5, + "StartColumn": 262, + "EndColumn": 292, + "Secret": "REDACTED", + "File": "documentation/audits/signup-lock-2026-09-29/B/wd.sh", + "SymlinkFile": "", + "Commit": "8cadacb553ba5003800eb6c861f766054b36c8c1", + "Entropy": 3.5849626, + "Date": "2026-09-29T15:19:43Z", + "Message": "Sign-up lock 2026-09-29 evening: decisions 48/49 outcomes, two locks, wanderer closable, R-714/715/716 closed, R-717/718 opened; STATUS, CONTEXT, report\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "8cadacb553ba5003800eb6c861f766054b36c8c1:documentation/audits/signup-lock-2026-09-29/B/wd.sh:generic-api-key:5" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 6, + "EndLine": 6, + "StartColumn": 84, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "documentation/audits/night-2026-09-23/chaos/round-01-run.txt", + "SymlinkFile": "", + "Commit": "3e58c184f62e3dc5048bbe935543c7fee0a55f0b", + "Entropy": 3.7709103, + "Date": "2026-09-23T22:24:04Z", + "Message": "night shift 2026-09-23: the record, the register, the morning note\n\nDRILL-night-2026-09-23.md: Parts A-E. 09 \u00a73 decisions 21 (operator word),\n22 and 23 (CC unattended, operator may reverse); \u00a76.4 parts 4 and 6\n(catalog half) shipped; \u00a76.1a residuals R-658/R-659. Register 330 -> 336:\nR-651..R-660 opened (R-658 and R-659 P1), R-650/R-640/R-499/R-626 closed.\nCapability map, nightly rotation (opengist), STATUS (one question: the\nfloor), CONTEXT, REPORT. The floor stays 0.266.0.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "3e58c184f62e3dc5048bbe935543c7fee0a55f0b:documentation/audits/night-2026-09-23/chaos/round-01-run.txt:generic-api-key:6" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 6, + "EndLine": 6, + "StartColumn": 84, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "documentation/audits/night-2026-09-23/chaos/round-01.log", + "SymlinkFile": "", + "Commit": "3e58c184f62e3dc5048bbe935543c7fee0a55f0b", + "Entropy": 3.7709103, + "Date": "2026-09-23T22:24:04Z", + "Message": "night shift 2026-09-23: the record, the register, the morning note\n\nDRILL-night-2026-09-23.md: Parts A-E. 09 \u00a73 decisions 21 (operator word),\n22 and 23 (CC unattended, operator may reverse); \u00a76.4 parts 4 and 6\n(catalog half) shipped; \u00a76.1a residuals R-658/R-659. Register 330 -> 336:\nR-651..R-660 opened (R-658 and R-659 P1), R-650/R-640/R-499/R-626 closed.\nCapability map, nightly rotation (opengist), STATUS (one question: the\nfloor), CONTEXT, REPORT. The floor stays 0.266.0.\n\nCo-Authored-By: Claude Opus 5.5 (1M context) \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "3e58c184f62e3dc5048bbe935543c7fee0a55f0b:documentation/audits/night-2026-09-23/chaos/round-01.log:generic-api-key:6" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 5, + "EndLine": 5, + "StartColumn": 84, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "documentation/audits/update-night-2026-09-21/apps/actualbudget/log.txt", + "SymlinkFile": "", + "Commit": "da20722e76a7367e311c7b5055038e5470f1586e", + "Entropy": 3.718129, + "Date": "2026-09-21T19:17:46Z", + "Message": "Update night 2026-09-21: Phase 0 and Phase 1 evidence, the drill method, and two instrument fixes\n\nINTERIM CHECKPOINT \u2014 evidence off the machine at the end of the phase that produced it (R-320),\nnot at the end of the session. Phases 2-5 follow in a later commit.\n\nPhase 0, all three mechanisms proven with their controls:\n- the fleet floor to 0.261.0 with its declared MinAgent \u2014 both demo boxes in 13 s, the hub\n logging `managed floor SERVED ... from declared (golden 0.258.0)`.\n- a PRIVATE DRILL CATALOG (admin/app-catalog-drill), so that broken, dummy, cross-repo and\n engine-major edges can be measured without the live catalog ever carrying one. Positive\n control quoted, and two negative controls: the live catalog's main and both real boxes'\n caches unchanged.\n- a throwaway image store on the scratch guest, which is what makes an UNATTENDED HOLD\n measurable at all: an edge that PASSES the within-a-major test and still fails.\n CompareImageRefs was proven to order host:port/ references by RUNNING it (4 positive cases\n + 1 negative control), not by reading it.\n\nPhase 1: real within-a-major upstream edges walked on guest 9202 through the product's own\nguarded Update, each app seeded and read back through its OWN front door (R-156), with a\nper-edge verdict record in 09's shape. `inconclusive` is never collapsed into `failed`.\n\nTWO INSTRUMENT FIXES, both in this repo's own evidence code:\n- 00-api-recipe.md said the app page is /app/; it is /apps/, and every call it described\n 404s. Corrected, with the session-expiry note that cost the same time.\n- unattended-caller.py's follow() read update_phase/updating off the API ENVELOPE, so both were\n always None and EVERY followed update ran to its 900 s timeout and was then recorded\n `timeout` and never-press-again. Fixed before B1 relied on it. R-623.\n\nNo controller, agent or hub code was written. The live catalog carries no broken reference.\n\nGates: repo_gates.py --fast \u2014 all 15 OK, exit 0.\n\nCo-Authored-By: Claude Opus 5 \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "da20722e76a7367e311c7b5055038e5470f1586e:documentation/audits/update-night-2026-09-21/apps/actualbudget/log.txt:generic-api-key:5" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 52, + "EndLine": 52, + "StartColumn": 84, + "EndColumn": 128, + "Secret": "REDACTED", + "File": "documentation/audits/update-night-2026-09-21/batchA.log", + "SymlinkFile": "", + "Commit": "da20722e76a7367e311c7b5055038e5470f1586e", + "Entropy": 3.718129, + "Date": "2026-09-21T19:17:46Z", + "Message": "Update night 2026-09-21: Phase 0 and Phase 1 evidence, the drill method, and two instrument fixes\n\nINTERIM CHECKPOINT \u2014 evidence off the machine at the end of the phase that produced it (R-320),\nnot at the end of the session. Phases 2-5 follow in a later commit.\n\nPhase 0, all three mechanisms proven with their controls:\n- the fleet floor to 0.261.0 with its declared MinAgent \u2014 both demo boxes in 13 s, the hub\n logging `managed floor SERVED ... from declared (golden 0.258.0)`.\n- a PRIVATE DRILL CATALOG (admin/app-catalog-drill), so that broken, dummy, cross-repo and\n engine-major edges can be measured without the live catalog ever carrying one. Positive\n control quoted, and two negative controls: the live catalog's main and both real boxes'\n caches unchanged.\n- a throwaway image store on the scratch guest, which is what makes an UNATTENDED HOLD\n measurable at all: an edge that PASSES the within-a-major test and still fails.\n CompareImageRefs was proven to order host:port/ references by RUNNING it (4 positive cases\n + 1 negative control), not by reading it.\n\nPhase 1: real within-a-major upstream edges walked on guest 9202 through the product's own\nguarded Update, each app seeded and read back through its OWN front door (R-156), with a\nper-edge verdict record in 09's shape. `inconclusive` is never collapsed into `failed`.\n\nTWO INSTRUMENT FIXES, both in this repo's own evidence code:\n- 00-api-recipe.md said the app page is /app/; it is /apps/, and every call it described\n 404s. Corrected, with the session-expiry note that cost the same time.\n- unattended-caller.py's follow() read update_phase/updating off the API ENVELOPE, so both were\n always None and EVERY followed update ran to its 900 s timeout and was then recorded\n `timeout` and never-press-again. Fixed before B1 relied on it. R-623.\n\nNo controller, agent or hub code was written. The live catalog carries no broken reference.\n\nGates: repo_gates.py --fast \u2014 all 15 OK, exit 0.\n\nCo-Authored-By: Claude Opus 5 \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "da20722e76a7367e311c7b5055038e5470f1586e:documentation/audits/update-night-2026-09-21/batchA.log:generic-api-key:52" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 25, + "EndLine": 25, + "StartColumn": 3, + "EndColumn": 45, + "Secret": "REDACTED", + "File": "hub/internal/web/bind_language_test.go", + "SymlinkFile": "", + "Commit": "9167cf53afbc9cf62fdc92ca248d37a493e915e7", + "Entropy": 4, + "Date": "2026-09-18T14:20:11Z", + "Message": "hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)\n\nThe hub has written every customer e-mail in Hungarian whatever the box was set\nto. The box has published its language since controller v0.247.0; nothing read\nit. Now it does.\n\nNothing an operator reads changes. The Hungarian mails are byte-identical, and\nthat is a diff rather than a reading: 56 goldens per language captured from\nv0.117.0 BEFORE any string moved, and all 56 Hungarian ones pass unchanged after\nevery sentence was routed through the new bundle.\n\n- internal/i18n: flat bundle, 79 keys, hu authoritative + hu fallback, ceiling 0.\n- customerMessages/severityLabels are DERIVED from the bundle, so a sentence is\n written in one place and all 40+ tests that read those maps still work.\n- Language order: last reported -> created-with -> hu. reports.language defaults\n to EMPTY, never hu: \"never told us\" is not \"chose Hungarian\".\n- message_customer on POST /api/v1/event, additive and optional forever, for the\n sentences the box composes and the hub cannot translate.\n- The bind page is per-language, and its `expired` state stays Hungarian: it is\n the state an unknown token lands in, so rendering a real English customer's\n token in English would make the LANGUAGE answer what the TEXT refuses to.\n\nTwo defects found inside the release:\n- R-581: the newest report was picked by received_at, which has SECOND\n granularity, so same-second reports tied and the winner was arbitrary. Ordered\n by the autoincrement id now. GetCustomers() still has the shape - row open.\n- R-582: the English copy-guard stems, ported word for word from Hungarian,\n convicted 141 honest sentences. The English claim is a phrase with a modal.\n\nR-555 closed: the language allowlist entry is out of wire_contract_gate.py.\nhub_copy_gate.py follows the sentences into the bundle - without that it would\nhave scanned four files that no longer hold any customer text and reported\nsuccess. Three new decoys incl. an innocent control.\n\nCo-Authored-By: Claude Opus 5 \nClaude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS", + "Tags": [], + "Fingerprint": "9167cf53afbc9cf62fdc92ca248d37a493e915e7:hub/internal/web/bind_language_test.go:generic-api-key:25" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 121, + "EndLine": 121, + "StartColumn": 11, + "EndColumn": 59, + "Secret": "REDACTED", + "File": "documentation/audits/evidence-rehearsal-2026-08-09/P1-demo-hp-after.txt", + "SymlinkFile": "", + "Commit": "b1afbb8a4d6c06e782da726785502323e4c163bb", + "Entropy": 4.851366, + "Date": "2026-08-09T08:59:44Z", + "Message": "Rehearsal 2026-08-09: the walk stops at P3 \u2014 R-273 blocks every install fleet-wide\n\nP1 uninstall, P2 preflight, P3 install. The install FAILED at step 5/8 in 44s,\nand the two rank-1 findings are both on the setting-up path a tester's visit is\nmade of. Eleven register rows minted (R-269..R-279); ceiling moves 268 -> 279.\n\nR-273 (RANK 1) \u2014 the hub vouches agent 0.128.0; that version was published as a\nGitea PACKAGE but never git-tagged. Since R-183 the installer correctly pins its\nconfig fetches to raw/tag/v, so every fresh install and every reinstall\nnow 404s as root, mid-install. Measured: main 200, v0.127.0 200, v0.128.0 404.\nThis is R-184 arriving; release-agent.sh:23 already documents the exact hazard.\nExisting boxes are fine (self-update takes the binary from the registry).\nNOT fixed here \u2014 publishing a release tag is outward-facing and the runbook says\nstop and report. One command unblocks it; it is in STATUS.md.\n\nR-272 (RANK 1) \u2014 Felhom's own uninstall leaves the condition that makes Felhom's\nown reinstall refuse. It installs dnsmasq at day-0, then on teardown removes the\nsnippet and RESTARTS the daemon unconstrained (process start time lands inside\nthe uninstall window), which grabs 0.0.0.0:53; the next preflight then refuses,\nand the message reads as though the owner's LAN DNS is at fault.\n\nR-274 \u2014 a local golden is adopted with no version and no sha check; the manifest\nvouch is consulted only on the fetch path. demo-hp's local copy is controller\n0.192.0 against a vouched 0.210.0, and below the 0.200.0 where the recovery\nscreen shipped. Not yet observed end-to-end (R-273 killed step 5 first).\n\nAlso: R-275 orphaned credential backups + uid reuse, R-276 the wg tunnel outlives\nthe uninstall, R-269/270/271 from the token rotation, R-277 three hub surfaces\nmisreport a healthy off-site tier, R-278 demo-felhom six days unprotected,\nR-279 no operator-triggerable off-site run.\n\nTwo hypotheses of mine were tested and REFUTED rather than shipped as findings:\nthe leftover sudoers file is inert (sudo skips dotted filenames), and demo-hp's\noff-site tier was healthy all along - I had misread the hub and said so.\n\nSTATUS.md records the three rulings \u00a78.3 asked for, with the floor CORRECTED to\nits live value 0.200.0 and the count corrected to twenty.", + "Tags": [], + "Fingerprint": "b1afbb8a4d6c06e782da726785502323e4c163bb:documentation/audits/evidence-rehearsal-2026-08-09/P1-demo-hp-after.txt:generic-api-key:121" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 194, + "EndLine": 194, + "StartColumn": 11, + "EndColumn": 59, + "Secret": "REDACTED", + "File": "documentation/audits/evidence-rehearsal-2026-08-09/GATE0-demo-hp-before.txt", + "SymlinkFile": "", + "Commit": "34646295dc27cf1b720ffea2bada87332aa8778b", + "Entropy": 4.851366, + "Date": "2026-08-09T08:34:57Z", + "Message": "Rehearsal 2026-08-09: pre-phase + Gate 0 recorded before the destructive walk\n\nVenue demo-hp, operator-approved at STOP 1. Records the state that P1 destroys,\nplus seven pre-walk findings, while they can still be checked against a live box.\n\nR-268 CLOSED \u2014 the leaked per-guest local-API token is rotated and the rotation\nis PROVEN in both directions (old refused, new accepted, channel up with a\npositive observable). Rotating it surfaced three defects:\n\n- an out-of-process rotation does NOT revoke the old token. The daemon serves\n Lookup from a stale index and re-reads only on a MISS, so a superseded token\n is a direct hit. Red-proved in a unit probe AND live on hardware; the shipped\n RemintCoherence test passes only because it looks up the NEW token first.\n- R-268's own recipe is incomplete: ensureLocalAPI returns early on a present\n local_api block, so writing bootstrap.json is not enough \u2014 the controller\n serves the old token from controller.yaml across restarts.\n- the agent-channel alarm never closes: the UP branch does not notify from an\n unseeded state, and the alarm's own remedy (\"re-bootstrap\") resets it.\n\nGate 0 complete: dataset planted in the Calibre library (coverage verified, not\nassumed) with two Hungarian accented filenames; the comparator watched FAILING\nthree ways including an NFC->NFD rename that renders identically; off-site run\ndriven through the product's own button; restore point recorded by identity as\nsnapshot 41c830db, confirmed to carry all four files.\n\nAlso corrects the record: demo-hp's off-site tier is HEALTHY. Three hub surfaces\nagreed it was absent and all three mislead \u2014 the panel showing 0 snapshots renders\nthe LOCAL tier, 162 KB rounds to 0.0 GB, and a two-day-old stuck event reads as\ncurrent. And the managed-update floor is live at 0.200.0, not 0.156.0.", + "Tags": [], + "Fingerprint": "34646295dc27cf1b720ffea2bada87332aa8778b:documentation/audits/evidence-rehearsal-2026-08-09/GATE0-demo-hp-before.txt:generic-api-key:194" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 366, + "EndLine": 366, + "StartColumn": 21, + "EndColumn": 108, + "Secret": "REDACTED", + "File": "documentation/tests/walk5-r201-2026-08-07/journal.md", + "SymlinkFile": "", + "Commit": "879007aaecea5b8123a3c6d0344063de16788535", + "Entropy": 3.8865879, + "Date": "2026-08-07T13:05:35Z", + "Message": "walk5 (R-201, fifth walk): Phase A journal \u2014 fixture built, sentinels proved by name\n\nWritten before the destruction, per \u00a79.9. A fresh install landed on the VOUCHED\nset with no hand upgrade (controller 0.206.0, agent 0.127.0) \u2014 R-239's delivery\ngap is closed for this run, which is the first of the five walks where the box\nunder test is the box a customer receives.\n\nBoth \u00a74.6 pre-destruction checks pass, neither previously exercised on a clean\nbox: the recovery offer is correctly SILENT (shape (c) compares equal \u2014 the two\nkey hashes are byte-identical on box and hub), and the restore page lists the app\nwith the future-backup toggle OFF (R-237's fix, which the last walk measured\nfailing).\n\nAlso recorded: the \u00a74.5 gate caught a harness fault (a toggle sent as enabled=1\nrather than enabled=on) that had produced a green 'ok' over a zero-snapshot\nrepository \u2014 the exact shape the gate exists for.", + "Tags": [], + "Fingerprint": "879007aaecea5b8123a3c6d0344063de16788535:documentation/tests/walk5-r201-2026-08-07/journal.md:generic-api-key:366" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 367, + "EndLine": 367, + "StartColumn": 8, + "EndColumn": 107, + "Secret": "REDACTED", + "File": "documentation/tests/walk5-r201-2026-08-07/journal.md", + "SymlinkFile": "", + "Commit": "879007aaecea5b8123a3c6d0344063de16788535", + "Entropy": 3.8865879, + "Date": "2026-08-07T13:05:35Z", + "Message": "walk5 (R-201, fifth walk): Phase A journal \u2014 fixture built, sentinels proved by name\n\nWritten before the destruction, per \u00a79.9. A fresh install landed on the VOUCHED\nset with no hand upgrade (controller 0.206.0, agent 0.127.0) \u2014 R-239's delivery\ngap is closed for this run, which is the first of the five walks where the box\nunder test is the box a customer receives.\n\nBoth \u00a74.6 pre-destruction checks pass, neither previously exercised on a clean\nbox: the recovery offer is correctly SILENT (shape (c) compares equal \u2014 the two\nkey hashes are byte-identical on box and hub), and the restore page lists the app\nwith the future-backup toggle OFF (R-237's fix, which the last walk measured\nfailing).\n\nAlso recorded: the \u00a74.5 gate caught a harness fault (a toggle sent as enabled=1\nrather than enabled=on) that had produced a green 'ok' over a zero-snapshot\nrepository \u2014 the exact shape the gate exists for.", + "Tags": [], + "Fingerprint": "879007aaecea5b8123a3c6d0344063de16788535:documentation/tests/walk5-r201-2026-08-07/journal.md:generic-api-key:367" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 129, + "EndLine": 129, + "StartColumn": 9, + "EndColumn": 52, + "Secret": "REDACTED", + "File": "hub/internal/web/render_test.go", + "SymlinkFile": "", + "Commit": "b93dd03f0a613e48422bc0745e4c2731ddbf9412", + "Entropy": 3.7487915, + "Date": "2026-07-09T06:23:41Z", + "Message": "GL-7 Part 1: passphrase hardening on the customer page (security)\n\nThe Setup Command panel rendered the per-customer retrieval passphrase (the\nsecret that fetches the WHOLE config) in cleartext twice \u2014 as #retrieval-pw\ntext and baked into the Option-3 curl's X-Retrieval-Password header \u2014 which\ncontradicts the panel's own \"never on the command line\" guidance. Now:\nthe retrieval password is MASKED by default (bullet run) with Reveal/Hide +\ncopy-secret controls (value lives in data-secret \u2014 the existing reveal\nmodel); the Option-3 debug command carries a \nplaceholder, never the secret. Render test asserts the secret is not baked\ninto any command + is masked by default; red-proof (bake it back) FAILS.\n(A zero-secret-in-DOM reveal-on-demand fetch is a noted follow-up, not this task.)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "b93dd03f0a613e48422bc0745e4c2731ddbf9412:hub/internal/web/render_test.go:generic-api-key:129" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 1, + "EndLine": 1, + "StartColumn": 36, + "EndColumn": 79, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_vaultwarden.json", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.164498, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_vaultwarden.json:generic-api-key:1" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 1, + "EndLine": 1, + "StartColumn": 36, + "EndColumn": 75, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_bookstack.json", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.324863, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_bookstack.json:generic-api-key:1" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 1, + "EndLine": 1, + "StartColumn": 79, + "EndColumn": 122, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_bookstack.json", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.324863, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_bookstack.json:generic-api-key:1" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 1, + "EndLine": 1, + "StartColumn": 35, + "EndColumn": 78, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.235926, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json:generic-api-key:1" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 1, + "EndLine": 1, + "StartColumn": 82, + "EndColumn": 134, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.235926, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json:generic-api-key:1" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 1, + "EndLine": 1, + "StartColumn": 138, + "EndColumn": 194, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.235926, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json:generic-api-key:1" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 28, + "EndLine": 28, + "StartColumn": 119, + "EndColumn": 162, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.164498, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:28" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 37, + "EndLine": 37, + "StartColumn": 120, + "EndColumn": 163, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.2803946, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:37" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 37, + "EndLine": 37, + "StartColumn": 167, + "EndColumn": 205, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 3.640224, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:37" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 43, + "EndLine": 43, + "StartColumn": 117, + "EndColumn": 156, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.324863, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:43" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 43, + "EndLine": 43, + "StartColumn": 160, + "EndColumn": 201, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.3285995, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:43" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 79, + "EndLine": 79, + "StartColumn": 120, + "EndColumn": 163, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 4.235926, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:79" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 79, + "EndLine": 79, + "StartColumn": 167, + "EndColumn": 205, + "Secret": "REDACTED", + "File": "documentation/tests/campaign2-evidence-2026-07-07/state/runner.log", + "SymlinkFile": "", + "Commit": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49", + "Entropy": 3.589898, + "Date": "2026-07-07T12:26:52Z", + "Message": "docs(tests): Campaign 2 report + evidence \u2014 DR primitives, self-update, storage, faults, endurance\n\nFull-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:\nONE genuine pilot-critical finding \u2014 the non-root agent cannot pct-restore the\nstandard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,\nmp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH\n--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing\nVM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated\nby one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/\ndryrun-journal/escrow-blob calibration issues; the product where actually exercised was\nhealthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state\n(auth off, notifications restored, no scratch leaks). No production code changed.\n\nEvidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).\n\n\ud83e\udd16 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.8 \nClaude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6", + "Tags": [], + "Fingerprint": "7714f1f6e4f76c65c9d82c15a6e890b0c007ac49:documentation/tests/campaign2-evidence-2026-07-07/state/runner.log:generic-api-key:79" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 88, + "EndLine": 88, + "StartColumn": 8, + "EndColumn": 56, + "Secret": "REDACTED", + "File": "manifests/hub.yaml", + "SymlinkFile": "", + "Commit": "0fcc7d8e6f97f68600842aa9483d1152efb633c8", + "Entropy": 3.7495818, + "Date": "2026-02-20T13:03:39Z", + "Message": "docs: add hub CHANGELOG.md, update ConfigMap with registry section\n\n- hub/CHANGELOG.md: new file with v0.2.0 and prior version history\n- manifests/hub.yaml: add registry config (version checker + template fetcher),\n pin image to v0.2.0, remove stale /healthz TODO comment\n\nCo-Authored-By: Claude Opus 4.6 ", + "Tags": [], + "Fingerprint": "0fcc7d8e6f97f68600842aa9483d1152efb633c8:manifests/hub.yaml:generic-api-key:88" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 84, + "EndLine": 84, + "StartColumn": 8, + "EndColumn": 61, + "Secret": "REDACTED", + "File": "manifests/hub.yaml", + "SymlinkFile": "", + "Commit": "c9abc6bb9e56291603c7a27f3060d8288e5bac97", + "Entropy": 4.572431, + "Date": "2026-02-16T18:45:09Z", + "Message": "added resend api key", + "Tags": [], + "Fingerprint": "c9abc6bb9e56291603c7a27f3060d8288e5bac97:manifests/hub.yaml:generic-api-key:84" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 10, + "EndLine": 10, + "StartColumn": 4, + "EndColumn": 84, + "Secret": "REDACTED", + "File": "manifests/felhom.secret.yaml", + "SymlinkFile": "", + "Commit": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141", + "Entropy": 5.356988, + "Date": "2026-02-11T07:50:08Z", + "Message": "initial move to gitea", + "Tags": [], + "Fingerprint": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141:manifests/felhom.secret.yaml:generic-api-key:10" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 20, + "EndLine": 20, + "StartColumn": 4, + "EndColumn": 62, + "Secret": "REDACTED", + "File": "manifests/felhom.secret.yaml", + "SymlinkFile": "", + "Commit": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141", + "Entropy": 4.572431, + "Date": "2026-02-11T07:50:08Z", + "Message": "initial move to gitea", + "Tags": [], + "Fingerprint": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141:manifests/felhom.secret.yaml:generic-api-key:20" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 32, + "EndLine": 32, + "StartColumn": 4, + "EndColumn": 57, + "Secret": "REDACTED", + "File": "manifests/felhom.secret.yaml", + "SymlinkFile": "", + "Commit": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141", + "Entropy": 4.572431, + "Date": "2026-02-11T07:50:08Z", + "Message": "initial move to gitea", + "Tags": [], + "Fingerprint": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141:manifests/felhom.secret.yaml:generic-api-key:32" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 41, + "EndLine": 41, + "StartColumn": 4, + "EndColumn": 81, + "Secret": "REDACTED", + "File": "manifests/felhom.secret.yaml", + "SymlinkFile": "", + "Commit": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141", + "Entropy": 3.8505487, + "Date": "2026-02-11T07:50:08Z", + "Message": "initial move to gitea", + "Tags": [], + "Fingerprint": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141:manifests/felhom.secret.yaml:generic-api-key:41" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 42, + "EndLine": 42, + "StartColumn": 4, + "EndColumn": 56, + "Secret": "REDACTED", + "File": "manifests/felhom.secret.yaml", + "SymlinkFile": "", + "Commit": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141", + "Entropy": 3.628928, + "Date": "2026-02-11T07:50:08Z", + "Message": "initial move to gitea", + "Tags": [], + "Fingerprint": "0b144a4d244afc3a9b06c5d0dc31c7e3a0fef141:manifests/felhom.secret.yaml:generic-api-key:42" + } + ] +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/gitleaks-homelab-manifests.count.json b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-homelab-manifests.count.json new file mode 100644 index 00000000..9ef08054 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gitleaks-homelab-manifests.count.json @@ -0,0 +1,4 @@ +{ + "note": "homelab-manifests is a PRIVATE repo (anonymous 404); its 17 hit locations are kept off-git on DooPlex: /mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/", + "hits": 17 +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom-agent.json b/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom-agent.json new file mode 100644 index 00000000..2282f883 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom-agent.json @@ -0,0 +1,1884 @@ +{ + "Golang errors": {}, + "Issues": [ + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int64", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/capacity_linux.go", + "code": "19: \t}\n20: \tfree := int64(st.Bfree) * bs\n21: \tused = total - free\n", + "line": "20", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int64", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/capacity_linux.go", + "code": "15: \tbs := int64(st.Bsize)\n16: \ttotal = int64(st.Blocks) * bs\n17: \tif total \u003c= 0 {\n", + "line": "16", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int -\u003e uint16", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/poke/poke.go", + "code": "130: func (l *Listener) serve(ctx context.Context, addr netip.Addr) error {\n131: \tbind := netip.AddrPortFrom(addr, uint16(l.port)).String()\n132: \tvar lc net.ListenConfig\n", + "line": "131", + "column": "41", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "295", + "url": "https://cwe.mitre.org/data/definitions/295.html" + }, + "rule_id": "G402", + "details": "TLS MinVersion too low.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/proxmox/tls.go", + "code": "72: \tdefault:\n73: \t\treturn \u0026tls.Config{}, nil // system roots; safe default\n74: \t}\n", + "line": "73", + "column": "11", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "295", + "url": "https://cwe.mitre.org/data/definitions/295.html" + }, + "rule_id": "G402", + "details": "TLS MinVersion too low.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/proxmox/tls.go", + "code": "69: \t\t}\n70: \t\treturn \u0026tls.Config{RootCAs: pool}, nil\n71: \n", + "line": "70", + "column": "11", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "295", + "url": "https://cwe.mitre.org/data/definitions/295.html" + }, + "rule_id": "G402", + "details": "TLS MinVersion too low.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/hub/client.go", + "code": "40: \t}\n41: \ttlsCfg := \u0026tls.Config{} // system roots\n42: \tif cfg.CAFile != \"\" {\n", + "line": "41", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "295", + "url": "https://cwe.mitre.org/data/definitions/295.html" + }, + "rule_id": "G402", + "details": "TLS InsecureSkipVerify set true.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/proxmox/tls.go", + "code": "47: \t\treturn \u0026tls.Config{\n48: \t\t\tInsecureSkipVerify: true, //nolint:gosec // replaced by the pin check below\n49: \t\t\tVerifyPeerCertificate: func(rawCerts [][]byte, _ [][]*x509.Certificate) error {\n", + "line": "48", + "column": "24", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "295", + "url": "https://cwe.mitre.org/data/definitions/295.html" + }, + "rule_id": "G402", + "details": "TLS InsecureSkipVerify set true.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/proxmox/tls.go", + "code": "36: \t\t// Caller opted in explicitly and by an honestly-named field.\n37: \t\treturn \u0026tls.Config{InsecureSkipVerify: true}, nil //nolint:gosec // documented, config-gated, off by default\n38: \n", + "line": "37", + "column": "42", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "295", + "url": "https://cwe.mitre.org/data/definitions/295.html" + }, + "rule_id": "G402", + "details": "TLS InsecureSkipVerify set true.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/pbs/pin.go", + "code": "22: \treturn \u0026tls.Config{\n23: \t\tInsecureSkipVerify: true, //nolint:gosec // replaced by the exact-cert pin below\n24: \t\tVerifyPeerCertificate: func(rawCerts [][]byte, _ [][]*x509.Certificate) error {\n", + "line": "23", + "column": "23", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/netstorage.go", + "code": "33: // git, never in a plaintext registry, never logged — same posture as the rotated Resend key).\n34: const defaultSmbCredsDir = \"/var/lib/felhom-agent/smb-creds\"\n35: \n", + "line": "34", + "column": "7", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/config/config.go", + "code": "264: \tdefaultLocalAPICert = \"/var/lib/felhom-agent/local-api.crt\"\n265: \tdefaultLocalAPIKey = \"/var/lib/felhom-agent/local-api.key\"\n266: )\n", + "line": "265", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/config/config.go", + "code": "262: const (\n263: \tdefaultLocalAPITokenStore = \"/var/lib/felhom-agent/local-tokens.log\"\n264: \tdefaultLocalAPICert = \"/var/lib/felhom-agent/local-api.crt\"\n", + "line": "263", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/proxmox/privileged.go", + "code": "78: \t\t}\n79: \t\tcmd = exec.CommandContext(ctx, sudo, append([]string{\"-n\", name}, args...)...)\n80: \t} else {\n", + "line": "79", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/privapplytest/check.go", + "code": "31: \t}\n32: \tout, _ := exec.Command(py, append(args, f)...).CombinedOutput()\n33: \treturn strings.TrimSpace(string(out))\n", + "line": "32", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/escrow_ceremony.go", + "code": "424: \t\targs := append([]string{\"-n\", \"-l\", \"--\", escrow.CeremonyBinary}, escrow.CeremonyArgs()...)\n425: \t\treturn exec.CommandContext(ctx, sudoPath, args...).Run()\n426: \t}\n", + "line": "425", + "column": "10", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/escrow_ceremony.go", + "code": "98: \t\targs := append([]string{\"-n\", escrow.CeremonyBinary}, escrow.CeremonyArgs()...)\n99: \t\tcmd := exec.CommandContext(ctx, sudoPath, args...)\n100: \t\tvar stdout, stderr bytes.Buffer\n", + "line": "99", + "column": "10", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/felhomsshd/manager.go", + "code": "217: \tp := strconv.Itoa(port)\n218: \tout, err := exec.Command(\"ss\", \"-Htln\", \"sport = :\"+p).Output()\n219: \tif err == nil \u0026\u0026 strings.TrimSpace(string(out)) != \"\" {\n", + "line": "218", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/felhomsshd/health.go", + "code": "144: func listenerPresent(port int) bool {\n145: \tout, err := exec.Command(\"ss\", \"-Htln\", \"sport = :\"+strconv.Itoa(port)).Output()\n146: \treturn err == nil \u0026\u0026 strings.TrimSpace(string(out)) != \"\"\n", + "line": "145", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/cmd/felhom-opsign/main.go", + "code": "194: \t}\n195: \tcmd := exec.Command(\"ssh-keygen\", \"-Y\", \"sign\", \"-n\", authz.Namespace, \"-f\", keyFile, msgPath)\n196: \tvar stderr bytes.Buffer\n", + "line": "195", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/cmd/felhom-agent/main.go", + "code": "1588: \tdir := filepath.Dir(cfg.Backup.PBSSecretPath(storageID))\n1589: \tcmd := exec.CommandContext(ctx, \"sudo\", \"-n\", pbsdr.WrapperPath, \"read\", storageID, dir)\n1590: \tvar out, errb bytes.Buffer\n", + "line": "1589", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/wgtunnel/manager.go", + "code": "194: func LoadAssignedAddr(stateDir string) (netip.Addr, bool) {\n195: \traw, err := os.ReadFile(filepath.Join(stateDir, \"wg\", markerName))\n196: \tif err != nil {\n", + "line": "195", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/wgtunnel/key.go", + "code": "54: \n55: \tif raw, rerr := os.ReadFile(path); rerr == nil {\n56: \t\tpriv, derr := decodeKey(raw)\n", + "line": "55", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/registry_known.go", + "code": "98: \t\t}\n99: \t\tdata, rerr := os.ReadFile(filepath.Join(unitDir, e.Name()))\n100: \t\tif rerr != nil {\n", + "line": "99", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/netmount.go", + "code": "528: \t\tautomountName := strings.TrimSuffix(e.Name(), \".mount\") + \".automount\"\n529: \t\tautomountData, aerr := os.ReadFile(filepath.Join(h.unitDir, automountName))\n530: \t\tif aerr != nil {\n", + "line": "529", + "column": "26", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/netmount.go", + "code": "523: \t\tmountPath := filepath.Join(h.unitDir, e.Name())\n524: \t\tmountData, rerr := os.ReadFile(mountPath)\n525: \t\tif rerr != nil || !strings.Contains(string(mountData), netUnitMarker) {\n", + "line": "524", + "column": "22", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/intent.go", + "code": "50: \ts := \u0026IntentStore{path: path, m: map[string]DriveIntent{}}\n51: \tdata, err := os.ReadFile(path)\n52: \tif err != nil {\n", + "line": "51", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/hostread.go", + "code": "150: \t}\n151: \tb, err := os.ReadFile(filepath.Join(r.sysBlockDir(), disk, \"removable\"))\n152: \tif err != nil {\n", + "line": "151", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/hostread.go", + "code": "131: \t}\n132: \tb, err := os.ReadFile(filepath.Join(r.sysBlockDir(), disk, \"queue\", \"rotational\"))\n133: \tif err != nil {\n", + "line": "132", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/claim.go", + "code": "221: \tname := filepath.Base(wholeDisk)\n222: \tb, err := os.ReadFile(filepath.Join(\"/sys/block\", name, \"ro\"))\n223: \tif err != nil {\n", + "line": "222", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/candidates.go", + "code": "105: func readSysBlockModel(name string) string {\n106: \tb, err := os.ReadFile(filepath.Join(\"/sys/block\", name, \"device\", \"model\"))\n107: \tif err != nil {\n", + "line": "106", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/candidates.go", + "code": "92: func readSysBlockSize(name string) int64 {\n93: \tb, err := os.ReadFile(filepath.Join(\"/sys/block\", name, \"size\"))\n94: \tif err != nil {\n", + "line": "93", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/selfupdate/executor.go", + "code": "212: \t}\n213: \tf, err := os.OpenFile(dest, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o644)\n214: \tif err != nil {\n", + "line": "213", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/restorespace/restorespace.go", + "code": "49: \t}\n50: \treturn os.ReadFile(name)\n51: }\n", + "line": "50", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/reconcile/journal.go", + "code": "197: func syncJournalDir(dir string) {\n198: \tif d, err := os.Open(dir); err == nil {\n199: \t\t_ = d.Sync()\n", + "line": "198", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/reconcile/journal.go", + "code": "91: \t}\n92: \tf, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o600)\n93: \tif err != nil {\n", + "line": "92", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/osupdate/unsent.go", + "code": "90: \tfor _, f := range files {\n91: \t\tb, err := os.ReadFile(f)\n92: \t\tif err != nil {\n", + "line": "91", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/osupdate/unsent.go", + "code": "37: \t_ = os.MkdirAll(dir, 0o700)\n38: \tf, err := os.OpenFile(filepath.Join(dir, \"pass.lock\"), os.O_CREATE|os.O_RDWR, 0o600)\n39: \tif err != nil {\n", + "line": "38", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/osupdate/leg.go", + "code": "260: func LoadSavedBlock(dir string) (b *hub.WireOSUpdate, savedAt time.Time, ok bool) {\n261: \traw, err := os.ReadFile(filepath.Join(dir, SavedBlockFile))\n262: \tif err != nil {\n", + "line": "261", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/osupdate/bundle.go", + "code": "142: \t}\n143: \tf, err := os.OpenFile(dest, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o600)\n144: \tif err != nil {\n", + "line": "143", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/mgmtplane/mgmtplane.go", + "code": "96: func readMarkerFile(path string) (string, bool) {\n97: \traw, err := os.ReadFile(path)\n98: \tif err != nil {\n", + "line": "97", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/tokenstore.go", + "code": "226: func syncDir(dir string) {\n227: \tif d, err := os.Open(dir); err == nil {\n228: \t\t_ = d.Sync()\n", + "line": "227", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/tokenstore.go", + "code": "66: \t}\n67: \tf, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o600)\n68: \tif err != nil {\n", + "line": "67", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/intermediary.go", + "code": "309: func procStarttime(pid string) string {\n310: \tdata, err := os.ReadFile(\"/proc/\" + pid + \"/stat\")\n311: \tif err != nil {\n", + "line": "310", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/intermediary.go", + "code": "159: \t}\n160: \tif cur, err := os.ReadFile(scriptPath); err != nil || string(cur) != sharedParentScript {\n161: \t\treturn true\n", + "line": "160", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/intermediary.go", + "code": "156: func sharedParentInstallStale(unitPath, scriptPath string) bool {\n157: \tif cur, err := os.ReadFile(unitPath); err != nil || string(cur) != sharedParentUnit {\n158: \t\treturn true\n", + "line": "157", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/guestbindstore.go", + "code": "31: \ts := \u0026GuestBindStore{path: path, m: map[int][]string{}}\n32: \tdata, err := os.ReadFile(path)\n33: \tif err != nil {\n", + "line": "32", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/formatjob.go", + "code": "49: \ts := \u0026FormatJobStore{path: path}\n50: \tdata, err := os.ReadFile(path)\n51: \tif err != nil {\n", + "line": "50", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/crashguard.go", + "code": "52: func readCrashGuardState(path string) (resp CrashGuardResponse, ok bool, reason string) {\n53: \tf, err := os.Open(path)\n54: \tif err != nil {\n", + "line": "53", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/backup_target.go", + "code": "190: \t}\n191: \tf, err := os.OpenFile(path, os.O_WRONLY|os.O_TRUNC, st.Mode().Perm())\n192: \tif err != nil {\n", + "line": "191", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/backup_target.go", + "code": "154: \t}\n155: \traw, err := os.ReadFile(path)\n156: \tif err != nil {\n", + "line": "155", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/lanresolver/loop.go", + "code": "103: func readCustomerID(path string) string {\n104: \tdata, err := os.ReadFile(path)\n105: \tif err != nil {\n", + "line": "104", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/lanresolver/lanresolver.go", + "code": "277: func (m *Manager) writeFileIfChanged(ctx context.Context, path, content, mode string) (bool, error) {\n278: \tif cur, err := os.ReadFile(path); err == nil \u0026\u0026 string(cur) == content {\n279: \t\treturn false, nil\n", + "line": "278", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/hub/cputemp.go", + "code": "173: func readFileTrim(path string) string {\n174: \tb, err := os.ReadFile(path)\n175: \tif err != nil {\n", + "line": "174", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/hub/collect.go", + "code": "500: func fileSHA256(path string) string {\n501: \tf, err := os.Open(path)\n502: \tif err != nil {\n", + "line": "501", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/hub/collect.go", + "code": "311: \t}\n312: \tb, err := os.ReadFile(path)\n313: \tif os.IsNotExist(err) {\n", + "line": "312", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/guesthook/netreassert.go", + "code": "82: \t}\n83: \tdata, err := os.ReadFile(\"/proc/\" + pid + \"/mountinfo\")\n84: \tif err != nil {\n", + "line": "83", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/guesthook/install.go", + "code": "54: \t}\n55: \tb, err := os.ReadFile(path)\n56: \tif err != nil {\n", + "line": "55", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/guesthook/heal.go", + "code": "116: func Heal(confPath string) (created []string, err error) {\n117: \tdata, readErr := os.ReadFile(confPath)\n118: \tif readErr != nil {\n", + "line": "117", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/identity.go", + "code": "160: \t}\n161: \treturn os.ReadFile(out)\n162: }\n", + "line": "161", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/identity.go", + "code": "135: \t}\n136: \treturn os.ReadFile(out)\n137: }\n", + "line": "136", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/escrow.go", + "code": "194: func copyFile(src, dst string, mode os.FileMode) error {\n195: \tb, err := os.ReadFile(src)\n196: \tif err != nil {\n", + "line": "195", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/escrow.go", + "code": "112: \n113: \tblob, err := os.ReadFile(blobPath)\n114: \tif err != nil {\n", + "line": "113", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "102: \ttmp := dest + \".tmp-\" + hex.EncodeToString(rnd[:])\n103: \tf, err := os.OpenFile(tmp, os.O_CREATE|os.O_WRONLY|os.O_EXCL, 0o600)\n104: \tif err != nil {\n", + "line": "103", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "95: \t}\n96: \tb, err := os.ReadFile(recovered)\n97: \tif err != nil {\n", + "line": "96", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/config/config.go", + "code": "858: \tif path != \"\" {\n859: \t\tb, err := os.ReadFile(path)\n860: \t\tif err != nil {\n", + "line": "859", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/backup/restoretest_state.go", + "code": "108: \ts := \u0026RestoreTestState{path: path, last: map[string]provenTier{}}\n109: \tdata, err := os.ReadFile(path)\n110: \tif err != nil {\n", + "line": "109", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/backup/backup_state.go", + "code": "56: \ts := \u0026BackupSuccessState{path: path, last: map[string]savedSuccess{}}\n57: \tdata, err := os.ReadFile(path)\n58: \tif err != nil {\n", + "line": "57", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/authz/noncestore.go", + "code": "190: func syncDir(dir string) {\n191: \tif d, err := os.Open(dir); err == nil {\n192: \t\t_ = d.Sync()\n", + "line": "191", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/authz/noncestore.go", + "code": "172: \t}\n173: \tif tf, err := os.OpenFile(tmp, os.O_WRONLY, 0o600); err == nil {\n174: \t\t_ = tf.Sync()\n", + "line": "173", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/authz/noncestore.go", + "code": "82: \t}\n83: \tf, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o600)\n84: \tif err != nil {\n", + "line": "83", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/cmd/felhom-opsign/main.go", + "code": "200: \t}\n201: \tsig, err := os.ReadFile(msgPath + \".sig\")\n202: \tif err != nil {\n", + "line": "201", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/cmd/felhom-agent/main.go", + "code": "3064: \t}\n3065: \tblob, err := os.ReadFile(blobPath)\n3066: \tif err != nil {\n", + "line": "3065", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/cmd/felhom-agent/main.go", + "code": "3031: \t}\n3032: \tblob, err := os.ReadFile(blobPath)\n3033: \tif err != nil {\n", + "line": "3032", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/cmd/felhom-agent/main.go", + "code": "1690: func readTrimmed(path string) (string, error) {\n1691: \tb, err := os.ReadFile(path)\n1692: \tif err != nil {\n", + "line": "1691", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G302", + "details": "Expect file permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/selfupdate/executor.go", + "code": "212: \t}\n213: \tf, err := os.OpenFile(dest, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o644)\n214: \tif err != nil {\n", + "line": "213", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G302", + "details": "Expect file permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/selfupdate/executor.go", + "code": "126: \t}\n127: \tif err := os.Chmod(staged, 0o755); err != nil {\n128: \t\t_ = os.Remove(staged)\n", + "line": "127", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/intent.go", + "code": "121: \t}\n122: \tif err := os.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {\n123: \t\treturn err\n", + "line": "122", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/guestbindstore.go", + "code": "124: \t}\n125: \tif err := os.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {\n126: \t\treturn err\n", + "line": "125", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/formatjob.go", + "code": "85: \t}\n86: \tif err := os.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {\n87: \t\treturn err\n", + "line": "86", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/controllerswap.go", + "code": "97: \tst.UpdatedAt = time.Now().UTC().Format(time.RFC3339)\n98: \tif err := os.MkdirAll(c.stateDir, 0o755); err != nil {\n99: \t\tc.logger.Error(\"controller-swap: mkdir state dir\", \"err\", err)\n", + "line": "98", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/fstrim/fstrim.go", + "code": "143: \t}\n144: \tif err := os.MkdirAll(filepath.Dir(t.statePath), 0o755); err != nil {\n145: \t\treturn err\n", + "line": "144", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/backup/restoretest_state.go", + "code": "279: \t}\n280: \tif err := os.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {\n281: \t\treturn err\n", + "line": "280", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/backup/backup_state.go", + "code": "144: \t}\n145: \tif err := os.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {\n146: \t\treturn err\n", + "line": "145", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/netmount.go", + "code": "412: \tstagePath := filepath.Join(h.stageDir, unitName)\n413: \tif err := os.WriteFile(stagePath, []byte(content), 0o644); err != nil {\n414: \t\treturn fmt.Errorf(\"netmount: staging unit %s: %w\", unitName, err)\n", + "line": "413", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/hostops.go", + "code": "255: \tstagePath := filepath.Join(h.stageDir, unitName)\n256: \tif err := os.WriteFile(stagePath, []byte(content), 0o644); err != nil {\n257: \t\treturn fmt.Errorf(\"storage: staging unit: %w\", err)\n", + "line": "256", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/cert.go", + "code": "96: \tkeyPEM := pem.EncodeToMemory(\u0026pem.Block{Type: \"EC PRIVATE KEY\", Bytes: keyDER})\n97: \tif err := os.WriteFile(certPath, certPEM, 0o644); err != nil {\n98: \t\treturn tls.Certificate{}, \"\", fmt.Errorf(\"localapi: write cert: %w\", err)\n", + "line": "97", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/felhomsshd/health.go", + "code": "45: \t// record the heal (best-effort; a failed marker write never fails the heal)\n46: \t_ = os.WriteFile(HealMarkerPath, []byte(now.UTC().Format(time.RFC3339)+\"\\n\"), 0o644)\n47: \tm.logger.Warn(\"felhomsshd: was down with a valid config — restarted (heal)\", \"port\", port)\n", + "line": "46", + "column": "6", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/wgtunnel/manager.go", + "code": "460: \t}\n461: \tos.Remove(m.lastAppliedPath())\n462: }\n", + "line": "461", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/storage/intent.go", + "code": "126: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n127: \t\tos.Remove(tmp)\n128: \t\treturn err\n", + "line": "127", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/selfupdate/executor.go", + "code": "222: \tif err := f.Sync(); err != nil {\n223: \t\tf.Close()\n224: \t\treturn \"\", err\n", + "line": "223", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/selfupdate/executor.go", + "code": "218: \tif _, err := io.Copy(io.MultiWriter(f, h), resp.Body); err != nil {\n219: \t\tf.Close()\n220: \t\treturn \"\", err\n", + "line": "219", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/poke/poke.go", + "code": "153: \t\t\u003c-ctx.Done()\n154: \t\tpc.Close()\n155: \t}()\n", + "line": "154", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/pbsdr/manager.go", + "code": "549: \tif _, err := f.Write(out); err != nil {\n550: \t\tf.Close()\n551: \t\treturn err\n", + "line": "550", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/pbsdr/manager.go", + "code": "460: \t}\n461: \tos.Remove(m.consumedFailedPath())\n462: \tmsg := \"\"\n", + "line": "461", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/pbs/probe.go", + "code": "44: \t}\n45: \tconn.Close()\n46: \treturn nil\n", + "line": "45", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/pbs/probe.go", + "code": "38: \t} else {\n39: \t\traw.SetDeadline(time.Now().Add(15 * time.Second))\n40: \t}\n", + "line": "39", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/pbs/probe.go", + "code": "36: \tif dl, ok := ctx.Deadline(); ok {\n37: \t\traw.SetDeadline(dl)\n38: \t} else {\n", + "line": "37", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/osupdate/unsent.go", + "code": "50: \t}\n51: \treturn func() { _ = syscall.Flock(int(f.Fd()), syscall.LOCK_UN); f.Close() }, true\n52: }\n", + "line": "51", + "column": "67", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/osupdate/unsent.go", + "code": "47: \tif err := syscall.Flock(int(f.Fd()), how); err != nil {\n48: \t\tf.Close()\n49: \t\treturn func() {}, false\n", + "line": "48", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/osupdate/bundle.go", + "code": "149: \tif _, err := io.Copy(io.MultiWriter(f, h), io.LimitReader(resp.Body, 4*1024*1024+1)); err != nil {\n150: \t\tf.Close()\n151: \t\treturn \"\", err\n", + "line": "150", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/guestbindstore.go", + "code": "129: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n130: \t\tos.Remove(tmp)\n131: \t\treturn err\n", + "line": "130", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/formatjob.go", + "code": "90: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n91: \t\tos.Remove(tmp)\n92: \t\treturn err\n", + "line": "91", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/debuglogs.go", + "code": "33: \t\t\tw.Write([]byte(line))\n34: \t\t\tw.Write([]byte(\"\\n\"))\n35: \t\t}\n", + "line": "34", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/debuglogs.go", + "code": "32: \t\tfor _, line := range s.logRing.Lines(0) {\n33: \t\t\tw.Write([]byte(line))\n34: \t\t\tw.Write([]byte(\"\\n\"))\n", + "line": "33", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/localapi/backup_target.go", + "code": "195: \tif _, err := f.Write(out); err != nil {\n196: \t\tf.Close()\n197: \t\treturn err\n", + "line": "196", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/lanresolver/lanresolver.go", + "code": "290: \t}\n291: \ttmp.Close()\n292: \t// R-861 (v0.146.0): a dnsmasq drop-in reaches /etc/dnsmasq.d only through the root checker, which allows exactly\n", + "line": "291", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/lanresolver/lanresolver.go", + "code": "287: \tif _, err := tmp.WriteString(content); err != nil {\n288: \t\ttmp.Close()\n289: \t\treturn false, fmt.Errorf(\"write temp: %w\", err)\n", + "line": "288", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/fstrim/fstrim.go", + "code": "148: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n149: \t\tos.Remove(tmp)\n150: \t\treturn err\n", + "line": "149", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/identity.go", + "code": "208: \t\tfd, err := syscall.Openat(dirfd, part, flags, 0)\n209: \t\tsyscall.Close(dirfd)\n210: \t\tif err != nil {\n", + "line": "209", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "121: \tif err := os.Rename(tmp, dest); err != nil {\n122: \t\tos.Remove(tmp)\n123: \t\treturn err\n", + "line": "122", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "117: \tif err := f.Close(); err != nil {\n118: \t\tos.Remove(tmp)\n119: \t\treturn err\n", + "line": "118", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "113: \t\tf.Close()\n114: \t\tos.Remove(tmp)\n115: \t\treturn err\n", + "line": "114", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "112: \tif err := f.Sync(); err != nil {\n113: \t\tf.Close()\n114: \t\tos.Remove(tmp)\n", + "line": "113", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "108: \t\tf.Close()\n109: \t\tos.Remove(tmp)\n110: \t\treturn err\n", + "line": "109", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/escrow/consume.go", + "code": "107: \tif _, err := f.Write(b); err != nil {\n108: \t\tf.Close()\n109: \t\tos.Remove(tmp)\n", + "line": "108", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/backup/restoretest_state.go", + "code": "284: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n285: \t\tos.Remove(tmp)\n286: \t\treturn err\n", + "line": "285", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-agent/internal/backup/backup_state.go", + "code": "149: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n150: \t\tos.Remove(tmp)\n151: \t\treturn err\n", + "line": "150", + "column": "3", + "nosec": false, + "suppressions": null + } + ], + "Stats": { + "files": 161, + "lines": 39508, + "nosec": 0, + "found": 117 + }, + "GosecVersion": "dev" +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom-controller.json b/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom-controller.json new file mode 100644 index 00000000..5a2d650f --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom-controller.json @@ -0,0 +1,7532 @@ +{ + "Golang errors": {}, + "Issues": [ + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int64", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pgconvert.go", + "code": "305: \t}\n306: \treturn int64(s.Bavail) * int64(s.Bsize), true\n307: }\n", + "line": "306", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int64", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "351: \t}\n352: \treturn int64(st.Bavail) * int64(st.Bsize)\n353: }\n", + "line": "352", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "190: \tif v, ok := guestMemTotalMB(); ok \u0026\u0026 v \u003e 0 {\n191: \t\treturn int(v), true\n192: \t}\n", + "line": "191", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "187: \tif v, ok := readCgroupMemLimitMB(cgroupRoot); ok \u0026\u0026 v \u003e 0 {\n188: \t\treturn int(v), true\n189: \t}\n", + "line": "188", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "79: \t}\n80: \treturn int(info.TotalMemMB), int(info.UsedMemMB), nil\n81: }\n", + "line": "80", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "79: \t}\n80: \treturn int(info.TotalMemMB), int(info.UsedMemMB), nil\n81: }\n", + "line": "80", + "column": "34", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "69: \t}\n70: \treturn int(info.TotalMemMB), nil\n71: }\n", + "line": "70", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/metrics/collector.go", + "code": "86: \t\tMemUsedMB: int(info.UsedMemMB),\n87: \t\tMemTotalMB: int(info.TotalMemMB),\n88: \t\tTempCelsius: info.TemperatureCelsius,\n", + "line": "87", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion uint64 -\u003e int", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/metrics/collector.go", + "code": "85: \t\tCPUPercent: info.CPUPercent,\n86: \t\tMemUsedMB: int(info.UsedMemMB),\n87: \t\tMemTotalMB: int(info.TotalMemMB),\n", + "line": "86", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int64 -\u003e uint64", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/mounts_linux.go", + "code": "72: \n73: \tbsize := uint64(stat.Bsize)\n74: \ttotal := stat.Blocks * bsize\n", + "line": "73", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int64 -\u003e uint64", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "271: \n272: \tbsize := uint64(stat.Bsize)\n273: \ttotal := stat.Blocks * bsize\n", + "line": "272", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int64 -\u003e uint64", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/fsclass.go", + "code": "31: func classifyFSMagic(ftype int64) string {\n32: \tu := uint64(ftype) \u0026 0xFFFFFFFF\n33: \tswitch u {\n", + "line": "32", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int64 -\u003e uint32", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1174: \t\t\toutFile.Close()\n1175: \t\t\tos.Chmod(target, os.FileMode(hdr.Mode))\n1176: \t\t}\n", + "line": "1175", + "column": "32", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int64 -\u003e uint32", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1158: \t\tcase tar.TypeDir:\n1159: \t\t\tif err := os.MkdirAll(target, os.FileMode(hdr.Mode)); err != nil {\n1160: \t\t\t\treturn err\n", + "line": "1159", + "column": "45", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int64 -\u003e uint32", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1126: \t\t\toutFile.Close()\n1127: \t\t\tos.Chmod(target, os.FileMode(hdr.Mode))\n1128: \t\t}\n", + "line": "1127", + "column": "32", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int64 -\u003e uint32", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1110: \t\tcase tar.TypeDir:\n1111: \t\t\tif err := os.MkdirAll(target, os.FileMode(hdr.Mode)); err != nil {\n1112: \t\t\t\treturn err\n", + "line": "1111", + "column": "45", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "190", + "url": "https://cwe.mitre.org/data/definitions/190.html" + }, + "rule_id": "G115", + "details": "integer overflow conversion int -\u003e uint", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/quiesce/breaker.go", + "code": "107: \t}\n108: \td := breakerBaseDelay \u003c\u003c uint(shift)\n109: \tif d \u003e breakerMaxDelay {\n", + "line": "108", + "column": "31", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "MEDIUM", + "cwe": { + "id": "338", + "url": "https://cwe.mitre.org/data/definitions/338.html" + }, + "rule_id": "G404", + "details": "Use of weak random number generator (math/rand or math/rand/v2 instead of crypto/rand)", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/report/waiter.go", + "code": "200: \t}\n201: \treturn w.jitterMin + time.Duration(rand.Int63n(int64(span)))\n202: }\n", + "line": "201", + "column": "37", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "1204", + "url": "https://cwe.mitre.org/data/definitions/1204.html" + }, + "rule_id": "G407", + "details": "Use of hardcoded IV/nonce for encryption by passing hardcoded slice/array", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "183: \t}\n184: \tstream := cipher.NewCTR(block, iv)\n185: \n", + "line": "184", + "column": "25", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "1204", + "url": "https://cwe.mitre.org/data/definitions/1204.html" + }, + "rule_id": "G407", + "details": "Use of hardcoded IV/nonce for encryption by passing hardcoded slice/array", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "87: \t}\n88: \tstream := cipher.NewCTR(block, iv)\n89: \tmac := hmac.New(sha256.New, hmKey)\n", + "line": "88", + "column": "25", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "HIGH", + "cwe": { + "id": "295", + "url": "https://cwe.mitre.org/data/definitions/295.html" + }, + "rule_id": "G402", + "details": "TLS InsecureSkipVerify set true.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/agentapi/client.go", + "code": "117: \ttlsCfg := \u0026tls.Config{\n118: \t\tInsecureSkipVerify: true, // self-signed leaf — the pin below is the real check\n119: \t\tVerifyPeerCertificate: func(rawCerts [][]byte, _ [][]*x509.Certificate) error {\n", + "line": "118", + "column": "23", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/infra/samba.go", + "code": "50: \tSambaPassdbVolume = \"samba-passdb\"\n51: \tSambaPassdbMount = \"/var/lib/samba\"\n52: )\n", + "line": "51", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox.go", + "code": "1654: // That was the last of the four manual interventions the 2026-08-04 drill needed.\n1655: const OffsiteStateNeedsCredential = \"needs_credential\"\n1656: \n", + "line": "1655", + "column": "7", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "LOW", + "cwe": { + "id": "79", + "url": "https://cwe.mitre.org/data/definitions/79.html" + }, + "rule_id": "G203", + "details": "The used method does not auto-escape HTML. This can potentially lead to 'Cross-site Scripting' vulnerabilities, in case the attacker controls the input.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/funcmap.go", + "code": "429: \t\t\tb, _ := json.Marshal(v)\n430: \t\t\treturn template.JS(b)\n431: \t\t},\n", + "line": "430", + "column": "11", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "LOW", + "cwe": { + "id": "79", + "url": "https://cwe.mitre.org/data/definitions/79.html" + }, + "rule_id": "G203", + "details": "The used method does not auto-escape HTML. This can potentially lead to 'Cross-site Scripting' vulnerabilities, in case the attacker controls the input.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/funcmap.go", + "code": "39: \thue := h.Sum32() % 360\n40: \treturn template.CSS(fmt.Sprintf(\"hsl(%d, 45%%, 38%%)\", hue))\n41: }\n", + "line": "40", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "LOW", + "cwe": { + "id": "79", + "url": "https://cwe.mitre.org/data/definitions/79.html" + }, + "rule_id": "G203", + "details": "The used method does not auto-escape HTML. This can potentially lead to 'Cross-site Scripting' vulnerabilities, in case the attacker controls the input.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/funcmap.go", + "code": "34: \tif hexColorRe.MatchString(brand) {\n35: \t\treturn template.CSS(brand)\n36: \t}\n", + "line": "35", + "column": "10", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "LOW", + "cwe": { + "id": "79", + "url": "https://cwe.mitre.org/data/definitions/79.html" + }, + "rule_id": "G203", + "details": "The used method does not auto-escape HTML. This can potentially lead to 'Cross-site Scripting' vulnerabilities, in case the attacker controls the input.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/csrf.go", + "code": "118: \ttoken := s.csrfToken(r)\n119: \treturn template.HTML(`\u003cinput type=\"hidden\" name=\"` + csrfFormField + `\" value=\"` + template.HTMLEscapeString(token) + `\"\u003e`)\n120: }\n", + "line": "119", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/netprobe_linux.go", + "code": "35: \tdefer cancel()\n36: \tcmd := exec.CommandContext(pctx, exe, \"--netprobe\", dir)\n37: \tcmd.SysProcAttr = \u0026syscall.SysProcAttr{\n", + "line": "36", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox.go", + "code": "282: \t}\n283: \tcmd := exec.CommandContext(ctx, \"ssh\", args...)\n284: \treturn cmd.CombinedOutput()\n", + "line": "283", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "893: \tdefer cancel()\n894: \tcmd := exec.CommandContext(cctx, \"rsync\", \"-a\", \"-n\", \"-i\", \"--checksum\",\n895: \t\tstrings.TrimRight(src, \"/\")+\"/\", strings.TrimRight(dst, \"/\")+\"/\")\n896: \tout, err := cmd.CombinedOutput()\n", + "line": "894-895", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "865: \tdefer cancel()\n866: \tcmd := exec.CommandContext(cctx, \"rsync\", \"-a\", \"--checksum\", \"--info=progress2\",\n867: \t\tstrings.TrimRight(src, \"/\")+\"/\", strings.TrimRight(dst, \"/\")+\"/\")\n868: \tstdout, err := cmd.StdoutPipe()\n", + "line": "866-867", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_restore.go", + "code": "469: \t// Trailing slashes: copy the CONTENTS of src into dst (same shape as rsyncMirror).\n470: \tcmd := exec.CommandContext(ctx, \"rsync\", \"-a\", \"--ignore-existing\", \"--itemize-changes\",\n471: \t\tstrings.TrimRight(src, \"/\")+\"/\", strings.TrimRight(dst, \"/\")+\"/\")\n472: \tout, err := cmd.CombinedOutput()\n", + "line": "470-471", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2.go", + "code": "699: \t// Trailing slashes: copy the CONTENTS of src into dst.\n700: \tcmd := exec.CommandContext(ctx, \"rsync\", \"-a\", \"--delete\", strings.TrimRight(src, \"/\")+\"/\", strings.TrimRight(dst, \"/\")+\"/\")\n701: \tout, err := cmd.CombinedOutput()\n", + "line": "700", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "78", + "url": "https://cwe.mitre.org/data/definitions/78.html" + }, + "rule_id": "G204", + "details": "Subprocess launched with a potential tainted input or cmd arguments", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_reconstitute.go", + "code": "121: \tdefer cancel()\n122: \tcmd := exec.CommandContext(ctx, \"rsync\", \"-a\", \"--itemize-changes\",\n123: \t\tstrings.TrimRight(src, \"/\")+\"/\", strings.TrimRight(dst, \"/\")+\"/\")\n124: \tout, err := cmd.CombinedOutput()\n", + "line": "122-123", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/session_store.go", + "code": "161: \ttmp := path + \".tmp\"\n162: \tfh, err := os.OpenFile(tmp, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o600)\n163: \tif err != nil {\n", + "line": "162", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/session_store.go", + "code": "78: \t}\n79: \tb, err := os.ReadFile(path)\n80: \tif err != nil {\n", + "line": "79", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/recovery_older_mail.go", + "code": "50: \tif p != \"\" {\n51: \t\tif b, err := os.ReadFile(p); err == nil {\n52: \t\t\tlast = strings.TrimSpace(string(b))\n", + "line": "51", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "221: func (lb *LogBuffer) LoadFrom(path string) {\n222: \tf, err := os.Open(path)\n223: \tif err != nil {\n", + "line": "222", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "185: \ttmp := path + \".tmp\"\n186: \tf, err := os.Create(tmp)\n187: \tif err != nil {\n", + "line": "186", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_download.go", + "code": "135: \t}\n136: \tf, err := os.Open(path)\n137: \tif err != nil {\n", + "line": "136", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/disk_health_state.go", + "code": "103: \t}\n104: \tdata, err := os.ReadFile(path)\n105: \tif err != nil {\n", + "line": "104", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/mounts_linux.go", + "code": "398: func HasFelhomRawMount(fstabPath, mountPath string) (rawPath string, ok bool) {\n399: \tf, err := os.Open(fstabPath)\n400: \tif err != nil {\n", + "line": "399", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/mounts_linux.go", + "code": "366: func ParseFstabUUID(fstabPath, mountPath string) string {\n367: \tf, err := os.Open(fstabPath)\n368: \tif err != nil {\n", + "line": "367", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/mounts_linux.go", + "code": "267: \tmodelPath := \"/sys/block/\" + disk + \"/device/model\"\n268: \tdata, err := os.ReadFile(modelPath)\n269: \tif err != nil {\n", + "line": "268", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/mounts_linux.go", + "code": "33: \ttestFile := filepath.Join(path, \".felhom-write-test\")\n34: \tf, err := os.Create(testFile)\n35: \tif err != nil {\n", + "line": "34", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "383: \tfor _, tempPath := range matches {\n384: \t\tdata, err := os.ReadFile(tempPath)\n385: \t\tif err != nil {\n", + "line": "384", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "352: \t\ttypePath := filepath.Join(zoneDir, \"type\")\n353: \t\ttypeData, err := os.ReadFile(typePath)\n354: \t\tsource := strings.TrimSpace(string(typeData))\n", + "line": "353", + "column": "20", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "337: \tfor _, tempPath := range matches {\n338: \t\tdata, err := os.ReadFile(tempPath)\n339: \t\tif err != nil {\n", + "line": "338", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "230: \t} {\n231: \t\tif b, err := os.ReadFile(p); err == nil {\n232: \t\t\tif v, err := strconv.ParseUint(strings.TrimSpace(string(b)), 10, 64); err == nil {\n", + "line": "231", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "210: \t// cgroup v1\n211: \tif b, err := os.ReadFile(filepath.Join(root, \"memory\", \"memory.limit_in_bytes\")); err == nil {\n212: \t\ts := strings.TrimSpace(string(b))\n", + "line": "211", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "200: \t// cgroup v2\n201: \tif b, err := os.ReadFile(filepath.Join(root, \"memory.max\")); err == nil {\n202: \t\ts := strings.TrimSpace(string(b))\n", + "line": "201", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "669: \t// Check if dst exists and has same content\n670: \tdstData, err := os.ReadFile(dst)\n671: \tif err == nil {\n", + "line": "670", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "663: func copyIfChanged(src, dst string) (bool, error) {\n664: \tsrcData, err := os.ReadFile(src)\n665: \tif err != nil {\n", + "line": "664", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "651: func writeIfChanged(data []byte, dst string) (bool, error) {\n652: \tif cur, err := os.ReadFile(dst); err == nil \u0026\u0026 sha256.Sum256(cur) == sha256.Sum256(data) {\n653: \t\treturn false, nil\n", + "line": "652", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "640: \tsrcHash := sha256.Sum256(srcData)\n641: \tdstData, err := os.ReadFile(dst)\n642: \tif err != nil {\n", + "line": "641", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "635: func (s *Syncer) logFileHashes(appName, filename, src, dst string) {\n636: \tsrcData, err := os.ReadFile(src)\n637: \tif err != nil {\n", + "line": "636", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "509: \t\t\t\t\t\t}\n510: \t\t\t\t\t} else if data, rerr := os.ReadFile(src); rerr != nil {\n511: \t\t\t\t\t\ts.logger.Printf(\"[WARN] [sync] %s: could not re-read the template to refresh its stored definition: %v\", appName, rerr)\n", + "line": "510", + "column": "30", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "482: \t\t\t\t\t// 2026-09-24 Part B, live finding). A fresh install takes the ladder's tested digest.\n483: \t\t\t\t\tcurrent, _ := os.ReadFile(dst)\n484: \t\t\t\t\trendered = stacks.CarryDigests(raw, current)\n", + "line": "483", + "column": "20", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "474: \t\t\tif filename == \"docker-compose.yml\" \u0026\u0026 filepath.Dir(src) == srcDir {\n475: \t\t\t\traw, rerr := os.ReadFile(src)\n476: \t\t\t\tif rerr != nil {\n", + "line": "475", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1342: \ttmp := p + \".tmp\"\n1343: \tf, err := os.OpenFile(tmp, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)\n1344: \tif err != nil {\n", + "line": "1343", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "664: \t\t}\n665: \t\tb, err := os.ReadFile(filepath.Join(dir, \".felhom.yml\"))\n666: \t\tif err == nil {\n", + "line": "665", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "470: \tif err != nil {\n471: \t\tif src, err = os.ReadFile(filepath.Join(dir, \".felhom.yml\")); err != nil {\n472: \t\t\treturn \"\", err\n", + "line": "471", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "468: func savePreUpdateMeta(dir string) (string, error) {\n469: \tsrc, err := os.ReadFile(filepath.Join(dir, appliedMetaDir, \".felhom.yml\"))\n470: \tif err != nil {\n", + "line": "469", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "333: func DeclaredVolumeNames(composePath string) (own, external []string, err error) {\n334: \tdata, err := os.ReadFile(composePath)\n335: \tif err != nil {\n", + "line": "334", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "121: func (m *Manager) storeAppliedMetaFrom(name, stackDir, src string) {\n122: \tb, err := os.ReadFile(src)\n123: \tif err == nil {\n", + "line": "122", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/signup_block.go", + "code": "66: \tp := m.signupBlockPath(name)\n67: \tif cur, err := os.ReadFile(p); err == nil \u0026\u0026 string(cur) == want {\n68: \t\treturn nil\n", + "line": "67", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/setup_gate.go", + "code": "263: \tp := m.setupGatePath(name)\n264: \tif cur, err := os.ReadFile(p); err == nil \u0026\u0026 string(cur) == want {\n265: \t\treturn gateHosts(rs), nil\n", + "line": "264", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/setup_gate.go", + "code": "116: func gateRoutersFromCompose(composePath string, env map[string]string) ([]gateRouter, error) {\n117: \tdata, err := os.ReadFile(composePath)\n118: \tif err != nil {\n", + "line": "117", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "214: \ttmp := path + \".tmp\"\n215: \tf, err := os.OpenFile(tmp, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, mode)\n216: \tif err != nil {\n", + "line": "215", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "199: \t\tp := filepath.Join(dir, f.name)\n200: \t\tif cur, err := os.ReadFile(p); err == nil \u0026\u0026 string(cur) == f.content {\n201: \t\t\tcontinue\n", + "line": "200", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pin.go", + "code": "162: \t}\n163: \tdata, err := os.ReadFile(composePath)\n164: \tif err != nil {\n", + "line": "163", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pgconvert.go", + "code": "898: func (d dockerPGConverter) Load(c, user, path string, skip map[string]bool) error {\n899: \tf, err := os.Open(path)\n900: \tif err != nil {\n", + "line": "899", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pgconvert.go", + "code": "829: func (d dockerPGConverter) DumpAll(c, user, path string) error {\n830: \tf, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)\n831: \tif err != nil {\n", + "line": "830", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pgconvert.go", + "code": "383: func validateDumpAll(path string) error {\n384: \tf, err := os.Open(path)\n385: \tif err != nil {\n", + "line": "384", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pgconvert.go", + "code": "252: func serviceDataVolume(composePath, service string) (key, dockerName string, err error) {\n253: \tdata, err := os.ReadFile(composePath)\n254: \tif err != nil {\n", + "line": "253", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pgconvert.go", + "code": "239: func composeProject(composePath string) string {\n240: \tdata, err := os.ReadFile(composePath)\n241: \tif err == nil {\n", + "line": "240", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1166: func fileSum(path string) (string, error) {\n1167: \tf, err := os.Open(path)\n1168: \tif err != nil {\n", + "line": "1167", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1105: \ttmp := dst + \".felhom-mig.tmp\"\n1106: \tout, err := os.OpenFile(tmp, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, fi.Mode().Perm())\n1107: \tif err != nil {\n", + "line": "1106", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1092: func copyFile(src, dst string) (int64, error) {\n1093: \tin, err := os.Open(src)\n1094: \tif err != nil {\n", + "line": "1093", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/metadata.go", + "code": "363: \tpath := filepath.Join(stackDir, \".felhom.yml\")\n364: \tdata, err := os.ReadFile(path)\n365: \tif err != nil {\n", + "line": "364", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/manager.go", + "code": "1721: \t\tcomposePath = filepath.Join(stackDir, \"docker-compose.yaml\")\n1722: \t\tdata, err = os.ReadFile(composePath)\n1723: \t\tif err != nil {\n", + "line": "1722", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/manager.go", + "code": "1718: \tcomposePath := filepath.Join(stackDir, \"docker-compose.yml\")\n1719: \tdata, err := os.ReadFile(composePath)\n1720: \tif err != nil {\n", + "line": "1719", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/manager.go", + "code": "1511: \tfor _, n := range names {\n1512: \t\tb, rerr := os.ReadFile(filepath.Join(dir, \"hold-logs\", n, \"compose-logs.txt\"))\n1513: \t\tif rerr == nil \u0026\u0026 strings.TrimSpace(string(b)) != \"\" {\n", + "line": "1512", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/ladder.go", + "code": "222: func loadMetadataFile(path string) (Metadata, error) {\n223: \tdata, err := os.ReadFile(path)\n224: \tif err != nil {\n", + "line": "223", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/ladder.go", + "code": "83: func LoadLadder(felhomPath string) ([]LadderEntry, error) {\n84: \tdata, err := os.ReadFile(felhomPath)\n85: \tif err != nil {\n", + "line": "84", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/kept.go", + "code": "207: func readKeptMarker(dir string) *KeptMarker {\n208: \tb, err := os.ReadFile(filepath.Join(dir, keptMarkerFile))\n209: \tif err != nil {\n", + "line": "208", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/kept.go", + "code": "111: func dirHasEntries(p string) bool {\n112: \tf, err := os.Open(p)\n113: \tif err != nil {\n", + "line": "112", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/installed.go", + "code": "90: func ParseComposeImages(composePath string) (map[string]string, error) {\n91: \tdata, err := os.ReadFile(composePath)\n92: \tif err != nil {\n", + "line": "91", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/install_hold.go", + "code": "71: \tp := m.installHoldPath(name)\n72: \tif cur, err := os.ReadFile(p); err == nil \u0026\u0026 string(cur) == want {\n73: \t\treturn gateHosts(rs), nil\n", + "line": "72", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "424: \tcomposePath := filepath.Join(dir, \"docker-compose.yml\")\n425: \tcur, err := os.ReadFile(composePath)\n426: \tif err != nil {\n", + "line": "425", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "326: \twant := infra.RenderControllerRoute(domain, wildcardTLS)\n327: \tif cur, err := os.ReadFile(routePath); err != nil || string(cur) != want {\n328: \t\tif err := os.WriteFile(routePath, []byte(want), 0o644); err != nil {\n", + "line": "327", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "292: \twant := infra.RenderServersTransports()\n293: \tif cur, err := os.ReadFile(path); err != nil || string(cur) != want {\n294: \t\tif err := os.WriteFile(path, []byte(want), 0o644); err != nil {\n", + "line": "293", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "242: \tfor name, spec := range files {\n243: \t\tcur, err := os.ReadFile(filepath.Join(dir, name))\n244: \t\tif err != nil || string(cur) != spec.Content {\n", + "line": "243", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "229: \twant := infra.RenderForwardedHeaders()\n230: \tif cur, err := os.ReadFile(path); err != nil || string(cur) != want {\n231: \t\tif err := os.WriteFile(path, []byte(want), 0o644); err != nil {\n", + "line": "230", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "136: \t\t}\n137: \t\tif cur, err := os.ReadFile(filepath.Join(dir, \"traefik.yml\")); err == nil \u0026\u0026\n138: \t\t\tstrings.Contains(string(cur), \"certResolver\") \u0026\u0026 !strings.Contains(files[\"traefik.yml\"].Content, \"certResolver\") {\n", + "line": "137", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/family_gate.go", + "code": "124: \tp := m.familyGatePath(name)\n125: \tif cur, err := os.ReadFile(p); err == nil \u0026\u0026 string(cur) == want {\n126: \t\treturn gateHosts(rs), nil\n", + "line": "125", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/deploy.go", + "code": "1415: \tfor _, p := range []string{filepath.Join(stackDir, \"docker-compose.yml\"), AppliedComposePath(stackDir)} {\n1416: \t\tif b, err := os.ReadFile(p); err == nil \u0026\u0026 ref.Match(b) {\n1417: \t\t\treturn false\n", + "line": "1416", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/deploy.go", + "code": "1062: \tpath := filepath.Join(stackDir, \"app.yaml\")\n1063: \tdata, err := os.ReadFile(path)\n1064: \tif err != nil {\n", + "line": "1063", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/delete.go", + "code": "987: \n988: \tdata, err := os.ReadFile(composePath)\n989: \tif err != nil {\n", + "line": "988", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/classify_binds.go", + "code": "43: func ParseComposeClassifiableBinds(composePath string) []appbackup.ComposeBind {\n44: \tdata, err := os.ReadFile(composePath)\n45: \tif err != nil {\n", + "line": "44", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/after_setup.go", + "code": "393: func composeMissingVars(composePath string, env map[string]string) []string {\n394: \tb, err := os.ReadFile(composePath)\n395: \tif err != nil {\n", + "line": "394", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/setup.go", + "code": "56: \n57: \tdata, err := os.ReadFile(path)\n58: \tif err != nil {\n", + "line": "57", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "735: \t\tlogger.Printf(\"[ERROR] [settings] primary settings corrupt (%v) — attempting recovery from .bak\", err)\n736: \t\tif bak, berr := os.ReadFile(path + \".bak\"); berr == nil {\n737: \t\t\ts2 := \u0026Settings{path: path, log: logger}\n", + "line": "736", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "721: \n722: \tdata, err := os.ReadFile(path)\n723: \tif err != nil {\n", + "line": "722", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selfupdate/state.go", + "code": "28: \tpath := filepath.Join(dataDir, stateFileName)\n29: \tdata, err := os.ReadFile(path)\n30: \tif err != nil {\n", + "line": "29", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/report/dr_recipe.go", + "code": "14: func readComposeFile(path string) string {\n15: \tdata, err := os.ReadFile(path)\n16: \tif err != nil {\n", + "line": "15", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/report/builder.go", + "code": "57: \tif configPath != \"\" {\n58: \t\tif data, err := os.ReadFile(configPath); err == nil {\n59: \t\t\th := sha256.Sum256(data)\n", + "line": "58", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/quiesce/nightowed.go", + "code": "88: \t}\n89: \tdata, err := os.ReadFile(p)\n90: \tif err != nil {\n", + "line": "89", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/nightchain/nightchain.go", + "code": "90: \tl := \u0026Ledger{path: path, d: ledgerData{Ended: map[Leg]time.Time{}}}\n91: \tb, err := os.ReadFile(path)\n92: \tswitch {\n", + "line": "91", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/metrics/sysinfo.go", + "code": "74: func readOSRelease(path string) string {\n75: \tf, err := os.Open(path)\n76: \tif err != nil {\n", + "line": "75", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/integrations/onlyoffice_filebrowser.go", + "code": "68: \n69: \tconfigData, err := os.ReadFile(configPath)\n70: \tif err != nil {\n", + "line": "69", + "column": "21", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/integrations/onlyoffice_filebrowser.go", + "code": "32: \n33: \tconfigData, err := os.ReadFile(configPath)\n34: \tif err != nil {\n", + "line": "33", + "column": "21", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/family/family.go", + "code": "128: \ttmp := s.path + \".tmp\"\n129: \tfh, err := os.OpenFile(tmp, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o600)\n130: \tif err != nil {\n", + "line": "129", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/crypto/crypto.go", + "code": "21: func LoadOrCreateKey(path string) ([]byte, error) {\n22: \tdata, err := os.ReadFile(path)\n23: \tif err == nil {\n", + "line": "22", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/config/config.go", + "code": "372: func FileHash(path string) (string, error) {\n373: \tdata, err := os.ReadFile(path)\n374: \tif err != nil {\n", + "line": "373", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/config/config.go", + "code": "334: func loadAndParse(path string) (*Config, error) {\n335: \tdata, err := os.ReadFile(path)\n336: \tif err != nil {\n", + "line": "335", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/bootstrap/bootstrap.go", + "code": "269: \t}\n270: \tcurrent, err := os.ReadFile(configPath)\n271: \tif err != nil {\n", + "line": "270", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/bootstrap/bootstrap.go", + "code": "185: \tbpath := Path()\n186: \tdata, err := os.ReadFile(bpath)\n187: \tif err != nil {\n", + "line": "186", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/bootstrap/bootstrap.go", + "code": "110: \tbpath := Path()\n111: \tdata, err := os.ReadFile(bpath)\n112: \tif err != nil {\n", + "line": "111", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "86: \ttmp := dst + \".felhom-restoring\"\n87: \tout, err := os.OpenFile(tmp, os.O_WRONLY|os.O_CREATE|os.O_EXCL, fi.Mode().Perm())\n88: \tif err != nil {\n", + "line": "87", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "80: func copyFilePreserving(src, dst string, fi fs.FileInfo) error {\n81: \tin, err := os.Open(src)\n82: \tif err != nil {\n", + "line": "81", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "65: func fileSHA(p string) ([]byte, error) {\n66: \tf, err := os.Open(p)\n67: \tif err != nil {\n", + "line": "66", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/shares_restore.go", + "code": "286: \tpassdb := filepath.Join(scratchJoin(scratch, m.sharesPayloadDir()), sharesPassdbName)\n287: \tif blob, rErr := os.ReadFile(passdb); rErr == nil \u0026\u0026 len(blob) \u003e 0 {\n288: \t\tif pErr := m.sharesPassdbRestorer()(blob); pErr != nil {\n", + "line": "287", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/shares_restore.go", + "code": "198: \tp := filepath.Join(scratchJoin(scratch, m.sharesPayloadDir()), sharesManifestName)\n199: \tblob, err := os.ReadFile(p)\n200: \tif err != nil {\n", + "line": "199", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/restore_unit.go", + "code": "91: \tnonSecret, unitSecrets = map[string]string{}, map[string]string{}\n92: \tdata, err := os.ReadFile(path)\n93: \tif err != nil {\n", + "line": "92", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "627: \ttmp := path + \".tmp\"\n628: \tf, err := os.OpenFile(tmp, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, perm)\n629: \tif err != nil {\n", + "line": "628", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "568: func readManifest(path string) *RecoveryManifest {\n569: \tdata, err := os.ReadFile(path)\n570: \tif err != nil {\n", + "line": "569", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "197: \t\tfor _, fname := range []string{\"docker-compose.yml\", \".felhom.yml\", \"app.yaml\"} {\n198: \t\t\tb, err := os.ReadFile(filepath.Join(composeDir, fname))\n199: \t\t\tif err != nil {\n", + "line": "198", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "141: \t\t}\n142: \t\tdata, err := os.ReadFile(src)\n143: \t\tif err != nil {\n", + "line": "142", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "566: \t}\n567: \tdata, rErr := os.ReadFile(filepath.Join(scratch, scratchMarkerName))\n568: \tif rErr != nil {\n", + "line": "567", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "466: \ttmp := final + \".tmp\"\n467: \tf, err := os.OpenFile(tmp, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)\n468: \tif err != nil {\n", + "line": "467", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_reconstitute.go", + "code": "473: \tfor _, fname := range []string{\"docker-compose.yml\", \".felhom.yml\"} {\n474: \t\tdata, rErr := os.ReadFile(filepath.Join(filepath.Dir(composePath), fname))\n475: \t\tif rErr != nil {\n", + "line": "474", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_placement.go", + "code": "188: func readRecordedAddress(appYAMLPath string) RecordedAddress {\n189: \traw, err := os.ReadFile(appYAMLPath)\n190: \tif err != nil {\n", + "line": "189", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/kept_load.go", + "code": "78: func unitHDDPath(unitDir string) string {\n79: \tb, err := os.ReadFile(filepath.Join(unitDir, \"compose\", \"app.yaml\"))\n80: \tif err != nil {\n", + "line": "79", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/data_versions.go", + "code": "83: func readDataStamps(unitDir string) map[string]DataStamp {\n84: \tdata, err := os.ReadFile(filepath.Join(unitDir, dataStampsFile))\n85: \tif err != nil {\n", + "line": "84", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/backup.go", + "code": "958: \t// while a writable handle syncs on every platform. Content is not modified.\n959: \tf, err := os.OpenFile(tmpPath, os.O_RDWR, 0)\n960: \tif err != nil {\n", + "line": "959", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/appstop_marker.go", + "code": "374: \ttmp := g.path + \".tmp\"\n375: \tf, err := os.OpenFile(tmp, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)\n376: \tif err != nil {\n", + "line": "375", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/assets/syncer.go", + "code": "333: func fileSHA256(path string) (string, error) {\n334: \tf, err := os.Open(path)\n335: \tif err != nil {\n", + "line": "334", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/assets/syncer.go", + "code": "297: \n298: \tout, err := os.Create(tmp)\n299: \tif err != nil {\n", + "line": "298", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1133: func extractTar(tarPath, destDir string) error {\n1134: \tf, err := os.Open(tarPath)\n1135: \tif err != nil {\n", + "line": "1134", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1079: func extractTarGz(tgzPath, destDir string) error {\n1080: \tf, err := os.Open(tgzPath)\n1081: \tif err != nil {\n", + "line": "1080", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1020: \t// Open the dump file\n1021: \tf, err := os.Open(dumpPath)\n1022: \tif err != nil {\n", + "line": "1021", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "863: func findDBServiceInCompose(composePath string) *dbServiceInfo {\n864: \tdata, err := os.ReadFile(composePath)\n865: \tif err != nil {\n", + "line": "864", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "713: \treturn e.withVolumeHelper(volName, func(cid string) error {\n714: \t\tf, err := os.Open(tarPath)\n715: \t\tif err != nil {\n", + "line": "714", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "646: func resolveHDDMounts(composePath string, env map[string]string) []string {\n647: \tdata, err := os.ReadFile(composePath)\n648: \tif err != nil {\n", + "line": "647", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "543: func readPlaintextAppYaml(path string) (map[string]string, error) {\n544: \tdata, err := os.ReadFile(path)\n545: \tif err != nil {\n", + "line": "544", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "304: \t// Read manifest\n305: \tmanifestData, err := os.ReadFile(filepath.Join(tmpDir, \"manifest.json\"))\n306: \tif err != nil {\n", + "line": "305", + "column": "23", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "130: func ReadManifestFromFAB(fabPath string) (*Manifest, error) {\n131: \tf, err := os.Open(fabPath)\n132: \tif err != nil {\n", + "line": "131", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/fabplan.go", + "code": "302: \t\t}\n303: \t\tf, err := os.Open(path)\n304: \t\tif err != nil {\n", + "line": "303", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/fabplan.go", + "code": "263: \t}\n264: \toutFile, err := os.Create(outputPath)\n265: \tif err != nil {\n", + "line": "264", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "940: \n941: \tout, err := os.Create(dst)\n942: \tif err != nil {\n", + "line": "941", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "934: func copyFile(src, dst string) error {\n935: \tin, err := os.Open(src)\n936: \tif err != nil {\n", + "line": "935", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "919: \n920: \tout, err := os.Create(dst)\n921: \tif err != nil {\n", + "line": "920", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "913: func gzipFile(src, dst string) error {\n914: \tin, err := os.Open(src)\n915: \tif err != nil {\n", + "line": "914", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "895: \n896: \t\tf, err := os.Open(path)\n897: \t\tif err != nil {\n", + "line": "896", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "855: func createTarGz(outputPath, sourceDir string) error {\n856: \toutFile, err := os.Create(outputPath)\n857: \tif err != nil {\n", + "line": "856", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "772: \treturn e.withVolumeHelper(volName, func(cid string) error {\n773: \t\tf, err := os.Create(tarPath)\n774: \t\tif err != nil {\n", + "line": "773", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "185: \n186: \tout, err := os.Create(outputPath)\n187: \tif err != nil {\n", + "line": "186", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "133: func DecryptFile(inputPath, outputPath, password string) error {\n134: \tin, err := os.Open(inputPath)\n135: \tif err != nil {\n", + "line": "134", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "63: \n64: \tout, err := os.Create(outputPath)\n65: \tif err != nil {\n", + "line": "64", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "57: func EncryptFile(inputPath, outputPath, password string) error {\n58: \tin, err := os.Open(inputPath)\n59: \tif err != nil {\n", + "line": "58", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "39: func IsEncryptedFAB(path string) (bool, error) {\n40: \tf, err := os.Open(path)\n41: \tif err != nil {\n", + "line": "40", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbservices.go", + "code": "65: func DBServiceNames(composePath string) ([]string, error) {\n66: \tdata, err := os.ReadFile(composePath)\n67: \tif err != nil {\n", + "line": "66", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "1028: \t}\n1029: \tf, err := os.Open(path)\n1030: \tif err != nil {\n", + "line": "1029", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "744: \n745: \tf, err := os.Open(dumpPath)\n746: \tif err != nil {\n", + "line": "745", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "454: \t// Large dumps (500MB+) would cause massive allocations on every 5-min cache refresh.\n455: \tf, err := os.Open(filePath)\n456: \tif err != nil {\n", + "line": "455", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "345: \t// Write output to tmp file\n346: \ttmpFile, err := os.Create(tmpPath)\n347: \tif err != nil {\n", + "line": "346", + "column": "18", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "233: var syncDumpDir = func(dir string) error {\n234: \td, err := os.Open(dir)\n235: \tif err != nil {\n", + "line": "234", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/appdata.go", + "code": "214: func ParseComposeNamedVolumes(composePath string) []AppDockerVolume {\n215: \tdata, err := os.ReadFile(composePath)\n216: \tif err != nil {\n", + "line": "215", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/appdata.go", + "code": "95: func ParseComposeImages(composePath string) []string {\n96: \tdata, err := os.ReadFile(composePath)\n97: \tif err != nil {\n", + "line": "96", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "3196: \tfor _, fname := range []string{\"docker-compose.yml\", \".felhom.yml\"} {\n3197: \t\tdata, err := os.ReadFile(filepath.Join(composeSrcDir, fname))\n3198: \t\tif err != nil {\n", + "line": "3197", + "column": "16", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "MEDIUM", + "cwe": { + "id": "409", + "url": "https://cwe.mitre.org/data/definitions/409.html" + }, + "rule_id": "G110", + "details": "Potential DoS vulnerability via decompression bomb", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1169: \t\t\t}\n1170: \t\t\tif _, err := io.Copy(outFile, tr); err != nil {\n1171: \t\t\t\toutFile.Close()\n", + "line": "1170", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "MEDIUM", + "cwe": { + "id": "409", + "url": "https://cwe.mitre.org/data/definitions/409.html" + }, + "rule_id": "G110", + "details": "Potential DoS vulnerability via decompression bomb", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1121: \t\t\t}\n1122: \t\t\tif _, err := io.Copy(outFile, tr); err != nil {\n1123: \t\t\t\toutFile.Close()\n", + "line": "1122", + "column": "17", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G305", + "details": "File traversal when extracting zip/tar archive", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1149: \n1150: \t\ttarget := filepath.Join(destDir, hdr.Name)\n1151: \n", + "line": "1150", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G305", + "details": "File traversal when extracting zip/tar archive", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1101: \n1102: \t\ttarget := filepath.Join(destDir, hdr.Name)\n1103: \n", + "line": "1102", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G302", + "details": "Expect file permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "195: \t}\n196: \tf, err := os.OpenFile(job.partPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0644)\n197: \tif err != nil {\n", + "line": "196", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G302", + "details": "Expect file permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/shares_payload.go", + "code": "143: \t// Tighten an inherited-loose mode from an older layout (the passdb archive lives here).\n144: \tif chErr := os.Chmod(dir, 0o700); chErr != nil {\n145: \t\tm.logger.Printf(\"[WARN] [shares] payload dir chmod failed: %v\", chErr)\n", + "line": "144", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/sharing_handlers.go", + "code": "393: \t\t}\n394: \t\tif err := os.MkdirAll(dir, 0o775); err != nil {\n395: \t\t\ts.logger.Printf(\"[ERROR] [sharing] mkdir failed: %v\", err)\n", + "line": "394", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "159: \texportDir := appexport.ExportDir(drive)\n160: \tif err := os.MkdirAll(exportDir, 0755); err != nil {\n161: \t\tlogx.Warnf(s.logger, \"[web] fab upload init: mkdir %s: %v\", exportDir, err)\n", + "line": "160", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_download.go", + "code": "96: \tsweepFabDownloads(s.fabDownloadDir(), time.Now(), fabDownloadTTL, s.logger)\n97: \tif err := os.MkdirAll(s.fabDownloadDir(), 0755); err != nil {\n98: \t\tjsonError(w, s.errText(r, err), http.StatusInternalServerError)\n", + "line": "97", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_download.go", + "code": "59: \t}\n60: \tif err := os.MkdirAll(s.fabDownloadDir(), 0755); err != nil {\n61: \t\tjsonError(w, s.errText(r, err), http.StatusInternalServerError)\n", + "line": "60", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "438: \t\t\tisNew = true\n439: \t\t\tif err := os.MkdirAll(dstDir, 0755); err != nil {\n440: \t\t\t\ts.logger.Printf(\"[WARN] [sync] Failed to create stack dir %s: %v\", dstDir, err)\n", + "line": "439", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "294: func (s *Syncer) gitCloneOrPull() error {\n295: \tif err := os.MkdirAll(filepath.Dir(s.cacheDir), 0755); err != nil {\n296: \t\treturn fmt.Errorf(\"creating cache parent dir: %w\", err)\n", + "line": "295", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1338: \t}\n1339: \tif err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {\n1340: \t\treturn err\n", + "line": "1339", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1055: \toutDir := filepath.Join(dir, \"hold-logs\", ts)\n1056: \tif err := os.MkdirAll(outDir, 0o755); err != nil {\n1057: \t\tm.logger.Printf(\"[ERROR] [stacks] update %s: cannot create the hold-log directory %s: %v — the hold still proceeds\", name, outDir, err)\n", + "line": "1056", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "477: \tmd := filepath.Join(dir, preUpdateMetaDir)\n478: \tif err := os.MkdirAll(md, 0o755); err != nil {\n479: \t\treturn \"\", err\n", + "line": "478", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "109: \td := filepath.Join(stackDir, appliedMetaDir)\n110: \tif err := os.MkdirAll(d, 0o755); err != nil {\n111: \t\treturn err\n", + "line": "110", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/signup_block.go", + "code": "61: \t}\n62: \tif err := os.MkdirAll(m.setupGateDir(), 0o755); err != nil {\n63: \t\treturn err\n", + "line": "62", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/setup_gate.go", + "code": "258: \t}\n259: \tif err := os.MkdirAll(m.setupGateDir(), 0o755); err != nil {\n260: \t\treturn nil, err\n", + "line": "259", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "189: func (m *Manager) writeSambaFiles(dir string, d infra.SambaData) (bool, error) {\n190: \tif err := os.MkdirAll(dir, 0o755); err != nil {\n191: \t\treturn false, fmt.Errorf(\"mkdir %s: %w\", dir, err)\n", + "line": "190", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1101: \t}\n1102: \tif err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {\n1103: \t\treturn 0, err\n", + "line": "1102", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1084: \t}\n1085: \tif err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {\n1086: \t\treturn err\n", + "line": "1085", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "969: \t\t\t}\n970: \t\t\tif err := os.MkdirAll(dst, 0o755); err != nil {\n971: \t\t\t\treturn err\n", + "line": "970", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "860: func rsyncCopy(ctx context.Context, src, dst string, onBytes func(int64)) error {\n861: \tif err := os.MkdirAll(dst, 0o755); err != nil {\n862: \t\treturn fmt.Errorf(\"mkdir %s: %w\", dst, err)\n", + "line": "861", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "829: \t}\n830: \tif err := os.MkdirAll(filepath.Dir(m.journalPath()), 0o755); err != nil {\n831: \t\treturn err\n", + "line": "830", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/manager.go", + "code": "370: \n371: \tif err := os.MkdirAll(cfg.Paths.StacksDir, 0755); err != nil {\n372: \t\treturn nil, fmt.Errorf(\"creating stacks directory %s: %w\", cfg.Paths.StacksDir, err)\n", + "line": "371", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/kept.go", + "code": "443: \t\tif _, err := os.Stat(unitHome); os.IsNotExist(err) {\n444: \t\t\tif err := os.MkdirAll(filepath.Dir(unitHome), 0o755); err == nil {\n445: \t\t\t\tif err := renameFn(it.UnitDir, unitHome); err == nil {\n", + "line": "444", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/kept.go", + "code": "419: \t\t_ = os.Remove(to) // an EMPTY leftover directory only (checked above)\n420: \t\tif err := os.MkdirAll(filepath.Dir(to), 0o755); err != nil {\n421: \t\t\treturn \"\", err\n", + "line": "420", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/kept.go", + "code": "173: \t\tto := filepath.Join(dest, rel)\n174: \t\tif err := os.MkdirAll(filepath.Dir(to), 0o755); err != nil {\n175: \t\t\tundo()\n", + "line": "174", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/kept.go", + "code": "151: \t}\n152: \tif err := os.MkdirAll(dest, 0o755); err != nil {\n153: \t\treturn \"\", fmt.Errorf(\"creating the kept folder: %w\", err)\n", + "line": "152", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/install_hold.go", + "code": "66: \t}\n67: \tif err := os.MkdirAll(m.setupGateDir(), 0o755); err != nil {\n68: \t\treturn nil, err\n", + "line": "67", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "390: func writeInfraFiles(dir string, files map[string]infra.FileSpec) error {\n391: \tif err := os.MkdirAll(dir, 0o755); err != nil {\n392: \t\treturn fmt.Errorf(\"mkdir: %w\", err)\n", + "line": "391", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "319: \tdynDir := filepath.Join(traefikDir, \"dynamic\")\n320: \tif err := os.MkdirAll(dynDir, 0o755); err != nil {\n321: \t\treturn fmt.Errorf(\"mkdir dynamic: %w\", err)\n", + "line": "320", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "287: \tdynDir := filepath.Join(traefikDir, \"dynamic\")\n288: \tif err := os.MkdirAll(dynDir, 0o755); err != nil {\n289: \t\treturn fmt.Errorf(\"mkdir dynamic: %w\", err)\n", + "line": "288", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "263: \tm.logger.Printf(\"[INFO] [infra] deploying filebrowser → %s\", dir)\n264: \tif err := os.MkdirAll(dir, 0o755); err != nil {\n265: \t\treturn fmt.Errorf(\"mkdir: %w\", err)\n", + "line": "264", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "224: \tdynDir := filepath.Join(traefikDir, \"dynamic\")\n225: \tif err := os.MkdirAll(dynDir, 0o755); err != nil {\n226: \t\treturn fmt.Errorf(\"mkdir dynamic: %w\", err)\n", + "line": "225", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "151: \t}\n152: \tif err := os.MkdirAll(filepath.Join(dir, \"certs\"), 0o755); err != nil {\n153: \t\treturn fmt.Errorf(\"mkdir certs: %w\", err)\n", + "line": "152", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "148: \tm.logger.Printf(\"[INFO] [infra] deploying traefik → %s\", dir)\n149: \tif err := os.MkdirAll(filepath.Join(dir, \"dynamic\"), 0o755); err != nil {\n150: \t\treturn fmt.Errorf(\"mkdir dynamic: %w\", err)\n", + "line": "149", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/image_retention.go", + "code": "390: \t\tlen(deleted), strings.Join(strings.Fields(firstLine(before)), \" \"), strings.Join(strings.Fields(firstLine(after)), \" \"))\n391: \t_ = os.MkdirAll(filepath.Dir(m.imageRetentionMarker()), 0o755)\n392: \t_ = os.WriteFile(m.imageRetentionMarker(), []byte(fmt.Sprintf(\"deleted %d\\n%s\\n\", len(deleted), strings.Join(deleted, \"\\n\"))), 0o644)\n", + "line": "391", + "column": "6", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/family_gate.go", + "code": "120: \t}\n121: \tif err := os.MkdirAll(m.setupGateDir(), 0o755); err != nil {\n122: \t\treturn nil, err\n", + "line": "121", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/setup.go", + "code": "81: \n82: \tif err := os.MkdirAll(filepath.Dir(s.path), 0755); err != nil {\n83: \t\treturn err\n", + "line": "82", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "542: func atomicWriteFile(path string, data []byte, perm os.FileMode) error {\n543: \tif err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {\n544: \t\treturn err\n", + "line": "543", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "857: \ttmpPath := s.path + \".tmp\"\n858: \tif err := os.MkdirAll(filepath.Dir(s.path), 0755); err != nil {\n859: \t\tif s.log != nil {\n", + "line": "858", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/recovery/info.go", + "code": "20: func GenerateRecoveryFile(info Info, version, outputDir string) error {\n21: \tif err := os.MkdirAll(outputDir, 0755); err != nil {\n22: \t\treturn fmt.Errorf(\"creating recovery info directory: %w\", err)\n", + "line": "21", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/quiesce/quiesce.go", + "code": "867: \t}\n868: \tif err := os.MkdirAll(filepath.Dir(l.markerPath), 0o755); err != nil {\n869: \t\treturn err\n", + "line": "868", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/nightchain/nightchain.go", + "code": "112: \tb, _ := json.MarshalIndent(l.d, \"\", \" \")\n113: \tif err := os.MkdirAll(filepath.Dir(l.path), 0o755); err != nil {\n114: \t\treturn err\n", + "line": "113", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/fillwatch/fillwatch.go", + "code": "356: \t}\n357: \tif err := os.MkdirAll(filepath.Dir(w.statePath), 0o755); err != nil {\n358: \t\treturn err\n", + "line": "357", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/bootstrap/bootstrap.go", + "code": "314: func writeFileAtomic(path string, b []byte) error {\n315: \tif err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {\n316: \t\treturn fmt.Errorf(\"config dir: %w\", err)\n", + "line": "315", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_restore.go", + "code": "463: func rsyncRestoreMissing(src, dst string) (int, error) {\n464: \tif err := os.MkdirAll(dst, 0755); err != nil {\n465: \t\treturn 0, fmt.Errorf(\"mkdir %s: %w\", dst, err)\n", + "line": "464", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2.go", + "code": "693: func rsyncMirror(src, dst string) error {\n694: \tif err := os.MkdirAll(dst, 0755); err != nil {\n695: \t\treturn fmt.Errorf(\"mkdir %s: %w\", dst, err)\n", + "line": "694", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/shares_restore.go", + "code": "114: \t}\n115: \tif err := os.MkdirAll(scratch, 0o755); err != nil {\n116: \t\treturn m.restoreDirError(scratch, err)\n", + "line": "115", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "250: \t}\n251: \tif err := os.MkdirAll(composeDir, 0755); err != nil {\n252: \t\treturn fmt.Errorf(\"creating recovery-unit compose dir: %w\", err)\n", + "line": "251", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "378: \t}\n379: \tif err := os.MkdirAll(scratch, 0o755); err != nil {\n380: \t\treturn m.restoreDirError(scratch, err)\n", + "line": "379", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_reconstitute.go", + "code": "235: \tdumpDir := AppDBDumpPath(nsRoot, stackName)\n236: \tif err := os.MkdirAll(dumpDir, 0755); err != nil {\n237: \t\treturn safetyDumpSet{}, util.MsgError(\"err.backup.a_biztonsagi_mentes_konyvtara_nem_hozhato\", err)\n", + "line": "236", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_reconstitute.go", + "code": "116: func rsyncRestoreOverwrite(src, dst string) (int, error) {\n117: \tif err := os.MkdirAll(dst, 0755); err != nil {\n118: \t\treturn 0, fmt.Errorf(\"mkdir %s: %w\", dst, err)\n", + "line": "117", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_proof.go", + "code": "319: func (m *Manager) restoreUnitReadOnly(ctx context.Context, stack, id, unitPath, scratch string) error {\n320: \tif err := os.MkdirAll(scratch, 0o755); err != nil {\n321: \t\treturn fmt.Errorf(\"proof scratch dir: %w\", err)\n", + "line": "320", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox.go", + "code": "1952: \t}\n1953: \tif err := os.MkdirAll(destDir, 0o755); err != nil {\n1954: \t\treturn m.restoreDirError(destDir, err)\n", + "line": "1953", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/backup.go", + "code": "859: \tdumpDir := AppVolumeDumpPath(m.namespaceRoot(drivePath), stackName)\n860: \tif err := os.MkdirAll(dumpDir, 0755); err != nil {\n861: \t\treturn fmt.Errorf(\"creating volume dump dir: %w\", err)\n", + "line": "860", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/appstop_marker.go", + "code": "370: \t}\n371: \tif err := os.MkdirAll(filepath.Dir(g.path), 0o755); err != nil {\n372: \t\treturn err\n", + "line": "371", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/assets/syncer.go", + "code": "95: \n96: \tif err := os.MkdirAll(s.assetsDir, 0755); err != nil {\n97: \t\ts.setError(fmt.Errorf(\"create assets dir: %w\", err))\n", + "line": "96", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1162: \t\tcase tar.TypeReg:\n1163: \t\t\tif err := os.MkdirAll(filepath.Dir(target), 0755); err != nil {\n1164: \t\t\t\treturn err\n", + "line": "1163", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1114: \t\tcase tar.TypeReg:\n1115: \t\t\tif err := os.MkdirAll(filepath.Dir(target), 0755); err != nil {\n1116: \t\t\t\treturn err\n", + "line": "1115", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "629: \n630: \t\tif err := os.MkdirAll(destPath, 0755); err != nil {\n631: \t\t\treturn fmt.Errorf(\"creating %s: %w\", destPath, err)\n", + "line": "630", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "376: \t\te.debugf(\"creating new stack directory: %s\", stackDir)\n377: \t\tif err := os.MkdirAll(stackDir, 0755); err != nil {\n378: \t\t\te.failJob(job, step, fmt.Sprintf(\"Könyvtár létrehozása sikertelen: %v\", err))\n", + "line": "377", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "799: \tvolDir := filepath.Join(dataDir, \"volumes\")\n800: \tos.MkdirAll(volDir, 0755)\n801: \n", + "line": "800", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "661: \thddDir := filepath.Join(dataDir, \"hdd\")\n662: \tos.MkdirAll(hddDir, 0755)\n663: \n", + "line": "662", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "389: \tdataDir := filepath.Join(tmpDir, \"data\")\n390: \tos.MkdirAll(dataDir, 0755)\n391: \n", + "line": "390", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "350: \tdbDir := filepath.Join(tmpDir, \"database\")\n351: \tos.MkdirAll(dbDir, 0755)\n352: \n", + "line": "351", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "322: \tconfigDir := filepath.Join(tmpDir, \"config\")\n323: \tif err := os.MkdirAll(configDir, 0755); err != nil {\n324: \t\te.failJob(job, step, err.Error())\n", + "line": "323", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "235: \te.debugf(\"export dest dir: %s\", destDir)\n236: \tif err := os.MkdirAll(destDir, 0755); err != nil {\n237: \t\te.failJob(job, step, fmt.Sprintf(\"Nem sikerült létrehozni az export könyvtárat: %v\", err))\n", + "line": "236", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/estimate.go", + "code": "116: \texportDir := ExportDir(destDrive)\n117: \tos.MkdirAll(exportDir, 0755)\n118: \test.DestFreeBytes = DiskFree(exportDir)\n", + "line": "117", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/userdata.go", + "code": "122: func EnsureDirOwned(path string, gid int) error {\n123: \tif err := os.MkdirAll(path, 0o755); err != nil {\n124: \t\treturn err\n", + "line": "123", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "281: \t// Ensure dump directory exists\n282: \tif err := os.MkdirAll(dumpDir, 0755); err != nil {\n283: \t\tresult.Error = fmt.Errorf(\"creating dump dir: %w\", err)\n", + "line": "282", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/netprobe.go", + "code": "45: \tnonce := randHexToken(32)\n46: \tif err := os.WriteFile(name, []byte(nonce), 0o644); err != nil {\n47: \t\treturn netProbeExitNoWrite\n", + "line": "46", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handlers.go", + "code": "3660: \tcompose := infra.RenderFileBrowserCompose(domain, storageMounts, keptGroups...)\n3661: \tif err := os.WriteFile(composePath, []byte(compose), 0644); err != nil {\n3662: \t\ts.logger.Printf(\"[ERROR] [web] Failed to write FileBrowser compose: %v\", err)\n", + "line": "3661", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handlers.go", + "code": "3648: \n3649: \tif err := os.WriteFile(configPath, []byte(fbConfig), 0644); err != nil {\n3650: \t\ts.logger.Printf(\"[ERROR] [web] Failed to write FileBrowser config: %v\", err)\n", + "line": "3649", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_debug.go", + "code": "705: \tmarkerPath := filepath.Join(s.cfg.Paths.DataDir, \".needs-setup\")\n706: \tif err := os.WriteFile(markerPath, []byte(\"debug-triggered\\n\"), 0644); err != nil {\n707: \t\twriteDebugJSON(w, http.StatusInternalServerError, false,\n", + "line": "706", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/disk_health_state.go", + "code": "154: \ttmp := path + \".tmp\"\n155: \tif err := os.WriteFile(tmp, data, 0644); err != nil {\n156: \t\treturn fmt.Errorf(\"writing temp disk-health state: %w\", err)\n", + "line": "155", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "678: \n679: \tif err := os.WriteFile(dst, srcData, 0644); err != nil {\n680: \t\treturn false, fmt.Errorf(\"writing %s: %w\", dst, err)\n", + "line": "679", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/sync/sync.go", + "code": "654: \t}\n655: \tif err := os.WriteFile(dst, data, 0644); err != nil {\n656: \t\treturn false, fmt.Errorf(\"writing %s: %w\", dst, err)\n", + "line": "655", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1152: \tif lerr == nil {\n1153: \t\tif err := os.WriteFile(ComposePathIn(dir), prevLive, 0o644); err != nil {\n1154: \t\t\tm.logger.Printf(\"[ERROR] [stacks] update %s: re-rendering the previous definition failed: %v\", name, err)\n", + "line": "1153", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1064: \tpath := filepath.Join(outDir, \"compose-logs.txt\")\n1065: \tif werr := os.WriteFile(path, []byte(out), 0o644); werr != nil {\n1066: \t\tm.logger.Printf(\"[ERROR] [stacks] update %s: could not write %s: %v\", name, path, werr)\n", + "line": "1065", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "910: \tif applied, aerr := LoadAppliedDefinition(dir); aerr == nil {\n911: \t\tif err := os.WriteFile(filepath.Join(dir, preUpdateAppliedFile), applied, 0o644); err == nil {\n912: \t\t\tentry.PrevApplied = filepath.Join(dir, preUpdateAppliedFile)\n", + "line": "911", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "893: \t}\n894: \tif err := os.WriteFile(filepath.Join(dir, preUpdateComposeFile), prevLive, 0o644); err != nil {\n895: \t\tfail(\"update.error.journal_failed\", \"saving the pre-update compose copy: \"+err.Error())\n", + "line": "894", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "480: \t}\n481: \tif err := os.WriteFile(filepath.Join(md, \".felhom.yml\"), src, 0o644); err != nil {\n482: \t\treturn \"\", err\n", + "line": "481", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/undo.go", + "code": "113: \ttmp := filepath.Join(d, \".felhom.yml.tmp\")\n114: \tif err := os.WriteFile(tmp, src, 0o644); err != nil {\n115: \t\treturn err\n", + "line": "114", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/signup_block.go", + "code": "70: \ttmp := p + \".tmp\"\n71: \tif err := os.WriteFile(tmp, []byte(want), 0o644); err != nil {\n72: \t\treturn err\n", + "line": "71", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/setup_gate.go", + "code": "267: \ttmp := p + \".tmp\"\n268: \tif err := os.WriteFile(tmp, []byte(want), 0o644); err != nil {\n269: \t\treturn nil, err\n", + "line": "268", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/remove_interrupted.go", + "code": "38: \tb, _ := json.Marshal(removeJournal{At: time.Now().UTC().Format(time.RFC3339), RemoveHDDData: removeHDDData, BackupPathsAsked: backupPaths})\n39: \treturn os.WriteFile(filepath.Join(stackDir, removePendingFile), append(b, '\\n'), 0o644)\n40: }\n", + "line": "39", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pin.go", + "code": "354: \t}\n355: \tif err := os.WriteFile(live, data, 0o644); err != nil {\n356: \t\treturn fmt.Errorf(\"rendering the catalog definition for %s: %w\", name, err)\n", + "line": "355", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/pin.go", + "code": "42: \ttmp := path + \".tmp\"\n43: \tif err := os.WriteFile(tmp, data, 0o644); err != nil {\n44: \t\treturn fmt.Errorf(\"writing %s: %w\", tmp, err)\n", + "line": "43", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/kept.go", + "code": "200: \tb, _ := json.MarshalIndent(marker, \"\", \" \")\n201: \tif err := os.WriteFile(filepath.Join(dest, keptMarkerFile), b, 0o644); err != nil {\n202: \t\tm.logger.Printf(\"[WARN] [stacks] kept %s: could not write the marker in %s: %v — listed without it\", name, dest, err)\n", + "line": "201", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/install_interrupted.go", + "code": "80: \t\t}\n81: \t\tif err := os.WriteFile(filepath.Join(c.dir, installInterruptedFile), []byte(time.Now().UTC().Format(time.RFC3339)+\"\\n\"), 0o644); err != nil {\n82: \t\t\tm.logger.Printf(\"[WARN] [stacks] install %s: cannot record the interruption for the page: %v\", c.name, err)\n", + "line": "81", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/install_interrupted.go", + "code": "36: \t_ = os.Remove(filepath.Join(stackDir, installInterruptedFile)) // a new install supersedes the old sentence\n37: \treturn os.WriteFile(filepath.Join(stackDir, installPendingFile), []byte(time.Now().UTC().Format(time.RFC3339)+\"\\n\"), 0o644)\n38: }\n", + "line": "37", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/install_hold.go", + "code": "75: \ttmp := p + \".tmp\"\n76: \tif err := os.WriteFile(tmp, []byte(want), 0o644); err != nil {\n77: \t\treturn nil, err\n", + "line": "76", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "434: \tout := composeImageLine.ReplaceAll(cur, []byte(\"${1}\"+infra.FileBrowserImage))\n435: \tif err := os.WriteFile(composePath, out, 0o644); err != nil {\n436: \t\treturn fmt.Errorf(\"write docker-compose.yml: %w\", err)\n", + "line": "435", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "327: \tif cur, err := os.ReadFile(routePath); err != nil || string(cur) != want {\n328: \t\tif err := os.WriteFile(routePath, []byte(want), 0o644); err != nil {\n329: \t\t\treturn fmt.Errorf(\"write controller route: %w\", err)\n", + "line": "328", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "293: \tif cur, err := os.ReadFile(path); err != nil || string(cur) != want {\n294: \t\tif err := os.WriteFile(path, []byte(want), 0o644); err != nil {\n295: \t\t\treturn fmt.Errorf(\"write servers-transports: %w\", err)\n", + "line": "294", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "275: \t}\n276: \tif err := os.WriteFile(filepath.Join(dir, \"config.yaml\"), []byte(config), 0o644); err != nil {\n277: \t\treturn fmt.Errorf(\"write config.yaml: %w\", err)\n", + "line": "276", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "272: \tconfig := infra.RenderFileBrowserConfig(nil, false)\n273: \tif err := os.WriteFile(composePath, []byte(compose), 0o644); err != nil {\n274: \t\treturn fmt.Errorf(\"write docker-compose.yml: %w\", err)\n", + "line": "273", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/infra.go", + "code": "230: \tif cur, err := os.ReadFile(path); err != nil || string(cur) != want {\n231: \t\tif err := os.WriteFile(path, []byte(want), 0o644); err != nil {\n232: \t\t\treturn fmt.Errorf(\"write forwarded headers: %w\", err)\n", + "line": "231", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/image_retention.go", + "code": "391: \t_ = os.MkdirAll(filepath.Dir(m.imageRetentionMarker()), 0o755)\n392: \t_ = os.WriteFile(m.imageRetentionMarker(), []byte(fmt.Sprintf(\"deleted %d\\n%s\\n\", len(deleted), strings.Join(deleted, \"\\n\"))), 0o644)\n393: \treturn deleted, true\n", + "line": "392", + "column": "6", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/family_gate.go", + "code": "128: \ttmp := p + \".tmp\"\n129: \tif err := os.WriteFile(tmp, []byte(want), 0o644); err != nil {\n130: \t\treturn nil, err\n", + "line": "129", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "882: \t// parsed + saved cleanly. Best-effort — a failed .bak must NOT fail the save.\n883: \tif err := os.WriteFile(s.path+\".bak\", data, 0644); err != nil \u0026\u0026 s.log != nil {\n884: \t\ts.log.Printf(\"[WARN] [settings] could not write .bak: %v\", err)\n", + "line": "883", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "864: \n865: \tif err := os.WriteFile(tmpPath, data, 0644); err != nil {\n866: \t\tos.Remove(tmpPath) // clean up partial file\n", + "line": "865", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "739: \t\t\t\tlogger.Printf(\"[WARN] [settings] recovered settings from .bak; re-promoting to primary\")\n740: \t\t\t\t_ = os.WriteFile(path, bak, 0644) // best-effort promote\n741: \t\t\t\ts2.LoadWarning = \"settings.json volt sérült — visszaállítva biztonsági másolatból\"\n", + "line": "740", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selfupdate/state.go", + "code": "53: \n54: \tif err := os.WriteFile(tmpPath, data, 0644); err != nil {\n55: \t\treturn fmt.Errorf(\"writing temp state file: %w\", err)\n", + "line": "54", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selftest/selftest.go", + "code": "122: \ttmpFile := filepath.Join(dataDir, \".selftest-\"+fmt.Sprintf(\"%d\", time.Now().UnixNano()))\n123: \tif err := os.WriteFile(tmpFile, []byte(\"test\"), 0644); err != nil {\n124: \t\treturn CheckResult{Name: \"Data directory\", Status: \"warn\", Message: fmt.Sprintf(\"not writable: %v\", err)}\n", + "line": "123", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/nightchain/nightchain.go", + "code": "116: \ttmp := l.path + \".tmp\"\n117: \tif err := os.WriteFile(tmp, b, 0o644); err != nil {\n118: \t\treturn err\n", + "line": "117", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/integrations/onlyoffice_filebrowser.go", + "code": "85: \ttmpPath := configPath + \".tmp\"\n86: \tif err := os.WriteFile(tmpPath, []byte(cleaned), 0644); err != nil {\n87: \t\tac.Logger.Printf(\"[ERROR] [integrations] OnlyOffice-FileBrowser revoke: %v\", err)\n", + "line": "86", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/integrations/onlyoffice_filebrowser.go", + "code": "50: \ttmpPath := configPath + \".tmp\"\n51: \tif err := os.WriteFile(tmpPath, []byte(configStr), 0644); err != nil {\n52: \t\tac.Logger.Printf(\"[ERROR] [integrations] OnlyOffice-FileBrowser apply: %v\", err)\n", + "line": "51", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/dockerexec/dockerexec.go", + "code": "91: \tfor _, n := range []string{\"docker\", \"docker-compose\"} {\n92: \t\tif err := os.WriteFile(filepath.Join(dir, n), []byte(\"#!/bin/sh\\nexit 0\\n\"), 0o755); err != nil {\n93: \t\t\tfmt.Fprintln(os.Stderr, \"R-650 stub:\", err)\n", + "line": "92", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_shares.go", + "code": "283: func (m *Manager) writeTier2Marker(destBase string) error {\n284: \treturn os.WriteFile(filepath.Join(destBase, tier2LayoutMarker), []byte(tier2LayoutVersion), 0o644)\n285: }\n", + "line": "284", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2.go", + "code": "410: \tm.tier2Reconcile(destBase, legRels)\n411: \tif err := os.WriteFile(markerPath, []byte(tier2LayoutVersion), 0644); err != nil {\n412: \t\tm.logger.Printf(\"[WARN] [backup] Tier 2 %s: layout marker write failed (restore will refuse until next run): %v\", stackName, err)\n", + "line": "411", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox.go", + "code": "535: \t\t}\n536: \t\tif err := os.WriteFile(m.offboxKnownHosts(), []byte(kh), 0o644); err != nil {\n537: \t\t\treturn fmt.Errorf(\"offbox known_hosts: %w\", err)\n", + "line": "536", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/assets/syncer.go", + "code": "323: \ttmp := path + \".tmp\"\n324: \tif err := os.WriteFile(tmp, data, 0644); err != nil {\n325: \t\ts.logger.Printf(\"[ERROR] [assets] Failed to save local manifest: %v\", err)\n", + "line": "324", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "590: \t}\n591: \treturn os.WriteFile(dst, []byte(sb.String()), 0644)\n592: }\n", + "line": "591", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "436: \te.debugf(\"manifest JSON: %d bytes\", len(manifestData))\n437: \tif err := os.WriteFile(filepath.Join(tmpDir, \"manifest.json\"), manifestData, 0644); err != nil {\n438: \t\te.failJob(job, step, err.Error())\n", + "line": "437", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G306", + "details": "Expect WriteFile permissions to be 0600 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "3200: \t\t}\n3201: \t\tif err := os.WriteFile(filepath.Join(stackDir, fname), data, 0644); err != nil {\n3202: \t\t\treturn fmt.Errorf(\"restoring %s from unit: %w\", fname, err)\n", + "line": "3201", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/session_store.go", + "code": "176: \tif err := fh.Close(); err != nil {\n177: \t\tos.Remove(tmp)\n178: \t\treturn err\n", + "line": "177", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/session_store.go", + "code": "172: \t\tfh.Close()\n173: \t\tos.Remove(tmp)\n174: \t\treturn err\n", + "line": "173", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/session_store.go", + "code": "171: \tif err := fh.Sync(); err != nil {\n172: \t\tfh.Close()\n173: \t\tos.Remove(tmp)\n", + "line": "172", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/session_store.go", + "code": "167: \t\tfh.Close()\n168: \t\tos.Remove(tmp)\n169: \t\treturn err\n", + "line": "168", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/session_store.go", + "code": "166: \tif _, err := fh.Write(b); err != nil {\n167: \t\tfh.Close()\n168: \t\tos.Remove(tmp)\n", + "line": "167", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/server.go", + "code": "1108: \tw.Header().Set(\"Cache-Control\", \"public, max-age=31536000, immutable\")\n1109: \tw.Write(data)\n1110: }\n", + "line": "1109", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/server.go", + "code": "1094: \tw.Header().Set(\"Cache-Control\", \"public, max-age=86400\")\n1095: \tw.Write(chartJS)\n1096: }\n", + "line": "1095", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/server.go", + "code": "1088: \tw.Header().Set(\"Cache-Control\", \"public, max-age=3600\")\n1089: \tw.Write(data)\n1090: }\n", + "line": "1089", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/server.go", + "code": "1030: \tw.Header().Set(\"Content-Type\", \"text/html; charset=utf-8\")\n1031: \tbuf.WriteTo(w)\n1032: }\n", + "line": "1031", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/server.go", + "code": "1003: \tw.Header().Set(\"Content-Type\", \"text/html; charset=utf-8\")\n1004: \tbuf.WriteTo(w)\n1005: }\n", + "line": "1004", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/server.go", + "code": "311: \tif _, err := os.Stat(fbResetFlag); err == nil {\n312: \t\tos.Remove(fbResetFlag)\n313: \t\tgo s.SyncFileBrowserMountsReset()\n", + "line": "312", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "209: \tif err := f.Close(); err != nil {\n210: \t\tos.Remove(tmp)\n211: \t\treturn err\n", + "line": "210", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "205: \t\tf.Close()\n206: \t\tos.Remove(tmp)\n207: \t\treturn err\n", + "line": "206", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "204: \tif err := f.Sync(); err != nil {\n205: \t\tf.Close()\n206: \t\tos.Remove(tmp)\n", + "line": "205", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "200: \t\tf.Close()\n201: \t\tos.Remove(tmp)\n202: \t\treturn err\n", + "line": "201", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "199: \tif err := w.Flush(); err != nil {\n200: \t\tf.Close()\n201: \t\tos.Remove(tmp)\n", + "line": "200", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "194: \t\t\tf.Close()\n195: \t\t\tos.Remove(tmp)\n196: \t\t\treturn err\n", + "line": "195", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/logbuffer.go", + "code": "193: \t\tif err := enc.Encode(e); err != nil {\n194: \t\t\tf.Close()\n195: \t\t\tos.Remove(tmp)\n", + "line": "194", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handlers.go", + "code": "3290: \tvar total int64\n3291: \tfilepath.Walk(path, func(_ string, info os.FileInfo, err error) error {\n3292: \t\tif err != nil || info.IsDir() {\n3293: \t\t\treturn nil\n3294: \t\t}\n3295: \t\ttotal += info.Size()\n3296: \t\treturn nil\n3297: \t})\n3298: \treturn total\n", + "line": "3291-3297", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "392: \tjob.file.Close()\n393: \tos.Remove(job.partPath)\n394: \tlogx.Warnf(s.logger, \"[web] fab upload idle-expired at %d/%d bytes — part deleted\",\n", + "line": "393", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "391: \n392: \tjob.file.Close()\n393: \tos.Remove(job.partPath)\n", + "line": "392", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "374: \tjob.file.Close()\n375: \tos.Remove(job.partPath)\n376: \tlogx.Infof(s.logger, \"[web] fab upload aborted by client at %d/%d bytes\", job.received, job.declared)\n", + "line": "375", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "373: \n374: \tjob.file.Close()\n375: \tos.Remove(job.partPath)\n", + "line": "374", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "340: \tif err := os.Rename(job.partPath, filepath.Join(dir, finalName)); err != nil {\n341: \t\tos.Remove(job.partPath)\n342: \t\tlogx.Warnf(s.logger, \"[web] fab upload finalize rename: %v\", err)\n", + "line": "341", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "333: \tif err := job.file.Close(); err != nil {\n334: \t\tos.Remove(job.partPath)\n335: \t\tjsonError(w, \"A fájl mentése sikertelen.\", http.StatusInternalServerError)\n", + "line": "334", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "327: \t\tjob.file.Close()\n328: \t\tos.Remove(job.partPath)\n329: \t\tlogx.Warnf(s.logger, \"[web] fab upload finalize fsync: %v\", err)\n", + "line": "328", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "326: \tif err := job.file.Sync(); err != nil {\n327: \t\tjob.file.Close()\n328: \t\tos.Remove(job.partPath)\n", + "line": "327", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "317: \t\tjob.file.Close()\n318: \t\tos.Remove(job.partPath)\n319: \t\tlogx.Warnf(s.logger, \"[web] fab upload finalize size mismatch: got %d, declared %d — part deleted\",\n", + "line": "318", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "316: \tif job.received != job.declared {\n317: \t\tjob.file.Close()\n318: \t\tos.Remove(job.partPath)\n", + "line": "317", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_upload.go", + "code": "75: \tw.WriteHeader(code)\n76: \tjson.NewEncoder(w).Encode(v)\n77: }\n", + "line": "76", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export_download.go", + "code": "155: \t}\n156: \tf.Close()\n157: \tif rmErr := os.Remove(path); rmErr != nil {\n", + "line": "156", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export.go", + "code": "22: \tw.WriteHeader(code)\n23: \tjson.NewEncoder(w).Encode(map[string]interface{}{\n24: \t\t\"ok\": false,\n25: \t\t\"error\": msg,\n26: \t})\n27: }\n", + "line": "23-26", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_export.go", + "code": "15: \tw.Header().Set(\"Content-Type\", \"application/json; charset=utf-8\")\n16: \tjson.NewEncoder(w).Encode(v)\n17: }\n", + "line": "16", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_debug.go", + "code": "361: \tw.Header().Set(\"Content-Type\", \"application/json\")\n362: \tjson.NewEncoder(w).Encode(dump)\n363: }\n", + "line": "362", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/handler_debug.go", + "code": "150: \t}\n151: \tjson.NewEncoder(w).Encode(resp)\n152: }\n", + "line": "151", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/web/disk_health_state.go", + "code": "158: \tif err := os.Rename(tmp, path); err != nil {\n159: \t\tos.Remove(tmp)\n160: \t\treturn fmt.Errorf(\"renaming disk-health state: %w\", err)\n", + "line": "159", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/mounts_linux.go", + "code": "38: \tf.Close()\n39: \tos.Remove(testFile)\n40: \treturn true\n", + "line": "39", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/mounts_linux.go", + "code": "37: \t}\n38: \tf.Close()\n39: \tos.Remove(testFile)\n", + "line": "38", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/system/info_linux.go", + "code": "295: \t}\n296: \tfmt.Sscanf(string(data), \"%f %f %f\", \u0026info.LoadAvg1, \u0026info.LoadAvg5, \u0026info.LoadAvg15)\n297: \tdebugf(\"[DEBUG] [system] readLoadAvg: raw=%q → 1m=%.2f 5m=%.2f 15m=%.2f\",\n", + "line": "296", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1357: \tif err := f.Close(); err != nil {\n1358: \t\tos.Remove(tmp)\n1359: \t\treturn err\n", + "line": "1358", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1353: \t\tf.Close()\n1354: \t\tos.Remove(tmp)\n1355: \t\treturn err\n", + "line": "1354", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1352: \tif err := f.Sync(); err != nil {\n1353: \t\tf.Close()\n1354: \t\tos.Remove(tmp)\n", + "line": "1353", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1348: \t\tf.Close()\n1349: \t\tos.Remove(tmp)\n1350: \t\treturn err\n", + "line": "1349", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/update.go", + "code": "1347: \tif _, err := f.Write(data); err != nil {\n1348: \t\tf.Close()\n1349: \t\tos.Remove(tmp)\n", + "line": "1348", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "237: \tif err := os.Rename(tmp, path); err != nil {\n238: \t\tos.Remove(tmp)\n239: \t\treturn err\n", + "line": "238", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "233: \tif err := os.Chmod(tmp, mode); err != nil {\n234: \t\tos.Remove(tmp)\n235: \t\treturn err\n", + "line": "234", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "229: \tif err := f.Close(); err != nil {\n230: \t\tos.Remove(tmp)\n231: \t\treturn err\n", + "line": "230", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "225: \t\tf.Close()\n226: \t\tos.Remove(tmp)\n227: \t\treturn err\n", + "line": "226", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "224: \tif err := f.Sync(); err != nil {\n225: \t\tf.Close()\n226: \t\tos.Remove(tmp)\n", + "line": "225", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "220: \t\tf.Close()\n221: \t\tos.Remove(tmp)\n222: \t\treturn err\n", + "line": "221", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/samba.go", + "code": "219: \tif _, err := f.Write(data); err != nil {\n220: \t\tf.Close()\n221: \t\tos.Remove(tmp)\n", + "line": "220", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1134: \tif err := os.Rename(tmp, dst); err != nil {\n1135: \t\tos.Remove(tmp)\n1136: \t\treturn 0, err\n", + "line": "1135", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1127: \tif err := os.Chmod(tmp, fi.Mode()); err != nil {\n1128: \t\tos.Remove(tmp)\n1129: \t\treturn 0, err\n", + "line": "1128", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1121: \tif err := out.Close(); err != nil {\n1122: \t\tos.Remove(tmp)\n1123: \t\treturn 0, err\n", + "line": "1122", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1117: \t\tout.Close()\n1118: \t\tos.Remove(tmp)\n1119: \t\treturn 0, err\n", + "line": "1118", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1116: \tif err := out.Sync(); err != nil {\n1117: \t\tout.Close()\n1118: \t\tos.Remove(tmp)\n", + "line": "1117", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1112: \t\tout.Close()\n1113: \t\tos.Remove(tmp)\n1114: \t\treturn 0, cerr\n", + "line": "1113", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "1111: \tif cerr != nil {\n1112: \t\tout.Close()\n1113: \t\tos.Remove(tmp)\n", + "line": "1112", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/migrate.go", + "code": "834: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n835: \t\tos.Remove(tmp)\n836: \t\treturn err\n", + "line": "835", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/healthprobe.go", + "code": "239: \t} else {\n240: \t\tconn.Close()\n241: \t\tdetail.Healthy = true\n", + "line": "240", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/filebrowser_password.go", + "code": "117: \tio.Copy(io.Discard, io.LimitReader(resp.Body, 1\u003c\u003c16))\n118: \tresp.Body.Close()\n119: \tif resp.StatusCode/100 != 2 {\n", + "line": "118", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/stacks/filebrowser_password.go", + "code": "116: \t}\n117: \tio.Copy(io.Discard, io.LimitReader(resp.Body, 1\u003c\u003c16))\n118: \tresp.Body.Close()\n", + "line": "117", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/setup.go", + "code": "129: func (s *SetupState) Remove() {\n130: \tos.Remove(s.path)\n131: }\n", + "line": "130", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/setup.go", + "code": "91: \tif err := os.Rename(tmp, s.path); err != nil {\n92: \t\tos.Remove(tmp)\n93: \t\treturn err\n", + "line": "92", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/setup.go", + "code": "87: \tif err := os.WriteFile(tmp, data, 0600); err != nil {\n88: \t\tos.Remove(tmp)\n89: \t\treturn err\n", + "line": "88", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/setup.go", + "code": "28: func ClearSetupMarker(dataDir string) {\n29: \tos.Remove(filepath.Join(dataDir, \".needs-setup\"))\n30: }\n", + "line": "29", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "551: \tif err := os.Rename(tmp, path); err != nil {\n552: \t\tos.Remove(tmp)\n553: \t\t// Rename fails on bind-mounted files (EBUSY). Fall back to direct write.\n", + "line": "552", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "547: \tif err := os.WriteFile(tmp, data, perm); err != nil {\n548: \t\tos.Remove(tmp)\n549: \t\treturn err\n", + "line": "548", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "417: \tsecretBytes := make([]byte, 32)\n418: \tcrand.Read(secretBytes)\n419: \tsessionSecret := hex.EncodeToString(secretBytes)\n", + "line": "418", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "392: \tif retrievalPassword != \"\" {\n393: \t\tsett.SetRetrievalPassword(retrievalPassword)\n394: \t}\n", + "line": "393", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "387: \t\tif err == nil {\n388: \t\t\tsett.SetPasswordHash(string(hash))\n389: \t\t}\n", + "line": "388", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "229: \t\ts.state.SetFormField(\"retrieval_password\", \"\")\n230: \t\ts.state.Save()\n231: \t\tvar msg string\n", + "line": "230", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "203: \tw.Header().Set(\"Cache-Control\", \"public, max-age=3600\")\n204: \tw.Write(data)\n205: }\n", + "line": "204", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "198: \t\tw.Header().Set(\"Content-Type\", \"text/css; charset=utf-8\")\n199: \t\tw.Write([]byte(minimalCSS))\n200: \t\treturn\n", + "line": "199", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/setup/handlers.go", + "code": "58: \tif s.isHubPreseeded() {\n59: \t\ts.state.Save()\n60: \t}\n", + "line": "59", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "873: \tif err := os.Rename(tmpPath, s.path); err != nil {\n874: \t\tos.Remove(tmpPath)\n875: \t\tif s.log != nil {\n", + "line": "874", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/settings/settings.go", + "code": "865: \tif err := os.WriteFile(tmpPath, data, 0644); err != nil {\n866: \t\tos.Remove(tmpPath) // clean up partial file\n867: \t\tif s.log != nil {\n", + "line": "866", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selfupdate/updater.go", + "code": "850: \t\tstate.CompletedAt = time.Now().UTC().Format(time.RFC3339)\n851: \t\tSaveState(u.dataDir, state)\n852: \t\tu.logger.Printf(\"[WARN] [selfupdate] Post-update startup: version mismatch (expected %s, running %s)\", state.TargetVersion, u.currentVer)\n", + "line": "851", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selfupdate/updater.go", + "code": "843: \t\tstate.CompletedAt = time.Now().UTC().Format(time.RFC3339)\n844: \t\tSaveState(u.dataDir, state)\n845: \t\tu.logger.Printf(\"[INFO] [selfupdate] Post-update startup: update successful (%s → %s)\", state.PreviousVersion, state.TargetVersion)\n", + "line": "844", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selfupdate/updater.go", + "code": "834: \t\tstate.CompletedAt = time.Now().UTC().Format(time.RFC3339)\n835: \t\tSaveState(u.dataDir, state)\n836: \t\tu.logger.Printf(\"[WARN] [selfupdate] Post-update startup: version parse error (current=%s, target=%s)\", u.currentVer, state.TargetVersion)\n", + "line": "835", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selfupdate/updater.go", + "code": "758: \t\tstate.CompletedAt = time.Now().UTC().Format(time.RFC3339)\n759: \t\tSaveState(u.dataDir, state)\n760: \t\tu.logger.Printf(\"[ERROR] [selfupdate] Agent swap request failed: %v\", err)\n", + "line": "759", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selfupdate/updater.go", + "code": "743: \t\tstate.CompletedAt = time.Now().UTC().Format(time.RFC3339)\n744: \t\tSaveState(u.dataDir, state)\n745: \t\tu.logger.Printf(\"[ERROR] [selfupdate] %v\", err)\n", + "line": "744", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selftest/selftest.go", + "code": "206: \t}\n207: \tresp.Body.Close()\n208: \n", + "line": "207", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/selftest/selftest.go", + "code": "125: \t}\n126: \tos.Remove(tmpFile)\n127: \n", + "line": "126", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/scheduler/scheduler.go", + "code": "362: \ts.mu.Unlock()\n363: \ts.runClaimed(s.ctx, job, quiet)\n364: }\n", + "line": "363", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/report/pusher.go", + "code": "206: \tio.Copy(io.Discard, resp.Body)\n207: \tresp.Body.Close()\n208: \n", + "line": "207", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/report/pusher.go", + "code": "205: \t}\n206: \tio.Copy(io.Discard, resp.Body)\n207: \tresp.Body.Close()\n", + "line": "206", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/report/pusher.go", + "code": "138: \t\trespBody, _ := io.ReadAll(io.LimitReader(resp.Body, maxPushResponseBytes))\n139: \t\tresp.Body.Close()\n140: \n", + "line": "139", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/recovery/info.go", + "code": "63: \tif err := os.Rename(tmp, path); err != nil {\n64: \t\tos.Remove(tmp)\n65: \t\treturn err\n", + "line": "64", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/recovery/info.go", + "code": "59: \tif err := os.WriteFile(tmp, []byte(content), 0600); err != nil {\n60: \t\tos.Remove(tmp)\n61: \t\treturn err\n", + "line": "60", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/quiesce/quiesce.go", + "code": "872: \tif err := os.WriteFile(tmp, data, 0o600); err != nil {\n873: \t\tos.Remove(tmp)\n874: \t\treturn err\n", + "line": "873", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/offsiteapply/seams.go", + "code": "233: \tif c != nil {\n234: \t\tc.Close()\n235: \t}\n", + "line": "234", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/notify/notifier.go", + "code": "1266: \t\tio.Copy(io.Discard, resp.Body)\n1267: \t\tresp.Body.Close()\n1268: \t}()\n", + "line": "1267", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/notify/notifier.go", + "code": "1265: \t\t}\n1266: \t\tio.Copy(io.Discard, resp.Body)\n1267: \t\tresp.Body.Close()\n", + "line": "1266", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/notify/notifier.go", + "code": "1164: \tio.Copy(io.Discard, resp.Body)\n1165: \tresp.Body.Close()\n1166: \n", + "line": "1165", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/notify/notifier.go", + "code": "1163: \t}\n1164: \tio.Copy(io.Discard, resp.Body)\n1165: \tresp.Body.Close()\n", + "line": "1164", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/notify/notifier.go", + "code": "329: \t\t\tio.Copy(io.Discard, resp.Body)\n330: \t\t\tresp.Body.Close()\n331: \n", + "line": "330", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/notify/notifier.go", + "code": "328: \t\t\t}\n329: \t\t\tio.Copy(io.Discard, resp.Body)\n330: \t\t\tresp.Body.Close()\n", + "line": "329", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/metrics/store.go", + "code": "79: \t\tif _, err := db.Exec(s); err != nil {\n80: \t\t\tdb.Close()\n81: \t\t\treturn nil, fmt.Errorf(\"schema: %w\", err)\n", + "line": "80", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/metrics/store.go", + "code": "41: \t\tif _, err := db.Exec(p); err != nil {\n42: \t\t\tdb.Close()\n43: \t\t\treturn nil, fmt.Errorf(\"pragma %q: %w\", p, err)\n", + "line": "42", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/metrics/store.go", + "code": "31: \tif walMode != \"wal\" {\n32: \t\tdb.Close()\n33: \t\treturn nil, fmt.Errorf(\"WAL mode not supported on this filesystem (got %q)\", walMode)\n", + "line": "32", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/metrics/store.go", + "code": "27: \tif err := db.QueryRow(\"PRAGMA journal_mode=WAL\").Scan(\u0026walMode); err != nil {\n28: \t\tdb.Close()\n29: \t\treturn nil, fmt.Errorf(\"set WAL mode: %w\", err)\n", + "line": "28", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/mailrelay/server.go", + "code": "147: \t\tpl.Close()\n148: \t\ttl.Close()\n149: \t\treturn fmt.Errorf(\"mailrelay: listen %s: %w\", s.opts.PlainNoTLSAddr, err)\n", + "line": "148", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/mailrelay/server.go", + "code": "146: \tif err != nil {\n147: \t\tpl.Close()\n148: \t\ttl.Close()\n", + "line": "147", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/mailrelay/server.go", + "code": "141: \tif err != nil {\n142: \t\tpl.Close()\n143: \t\treturn fmt.Errorf(\"mailrelay: listen TLS %s: %w\", s.opts.TLSAddr, err)\n", + "line": "142", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/family/family.go", + "code": "137: \tif err := fh.Sync(); err != nil {\n138: \t\tfh.Close()\n139: \t\treturn err\n", + "line": "138", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/family/family.go", + "code": "133: \tif _, err := fh.Write(b); err != nil {\n134: \t\tfh.Close()\n135: \t\treturn err\n", + "line": "134", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/dockerexec/dockerexec.go", + "code": "96: \t}\n97: \tos.Setenv(\"PATH\", dir+string(os.PathListSeparator)+os.Getenv(\"PATH\"))\n98: \treturn m.Run()\n", + "line": "97", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "111: \tif err := os.Link(tmp, dst); err != nil {\n112: \t\tos.Remove(tmp)\n113: \t\treturn err\n", + "line": "112", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "101: \tif err := out.Close(); err != nil {\n102: \t\tos.Remove(tmp)\n103: \t\treturn err\n", + "line": "102", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "97: \t\tout.Close()\n98: \t\tos.Remove(tmp)\n99: \t\treturn err\n", + "line": "98", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "96: \tif err := out.Sync(); err != nil {\n97: \t\tout.Close()\n98: \t\tos.Remove(tmp)\n", + "line": "97", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "92: \t\tout.Close()\n93: \t\tos.Remove(tmp)\n94: \t\treturn err\n", + "line": "93", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/tier2_whole.go", + "code": "91: \tif _, err := io.Copy(out, in); err != nil {\n92: \t\tout.Close()\n93: \t\tos.Remove(tmp)\n", + "line": "92", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/restore.go", + "code": "217: \t\t// Remove existing volume (ignore errors — may not exist)\n218: \t\tdockerexec.Command(\"docker\", \"volume\", \"rm\", \"-f\", volName).Run()\n219: \n", + "line": "218", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "641: \tif err := os.Rename(tmp, path); err != nil {\n642: \t\tos.Remove(tmp)\n643: \t\treturn err\n", + "line": "642", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "637: \tif err := f.Close(); err != nil {\n638: \t\tos.Remove(tmp)\n639: \t\treturn err\n", + "line": "638", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "633: \t\tf.Close()\n634: \t\tos.Remove(tmp)\n635: \t\treturn err\n", + "line": "634", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/recovery_unit.go", + "code": "632: \tif _, err := io.Copy(f, strings.NewReader(string(data))); err != nil {\n633: \t\tf.Close()\n634: \t\tos.Remove(tmp)\n", + "line": "633", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "481: \tif err := f.Close(); err != nil {\n482: \t\tos.Remove(tmp)\n483: \t\treturn err\n", + "line": "482", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "477: \t\tf.Close()\n478: \t\tos.Remove(tmp)\n479: \t\treturn err\n", + "line": "478", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "476: \tif err := f.Sync(); err != nil {\n477: \t\tf.Close()\n478: \t\tos.Remove(tmp)\n", + "line": "477", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "472: \t\tf.Close()\n473: \t\tos.Remove(tmp)\n474: \t\treturn err\n", + "line": "473", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "471: \tif _, err := f.Write(data); err != nil {\n472: \t\tf.Close()\n473: \t\tos.Remove(tmp)\n", + "line": "472", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/offbox_restore.go", + "code": "99: \tvar size int64\n100: \tfmt.Sscanf(strings.TrimSpace(lines[1]), \"%d\", \u0026size)\n101: \treturn size\n", + "line": "100", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/backup.go", + "code": "963: \tif err := f.Sync(); err != nil {\n964: \t\tf.Close()\n965: \t\treturn fmt.Errorf(\"syncing tmp dump: %w\", err)\n", + "line": "964", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/backup.go", + "code": "921: \t\tif !activeVols[name] \u0026\u0026 strings.HasSuffix(name, \".tar\") {\n922: \t\t\tos.Remove(filepath.Join(dumpDir, name))\n923: \t\t\tif m.isDebug() {\n", + "line": "922", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/backup.go", + "code": "917: \t\tif strings.HasSuffix(name, \".tar.tmp\") {\n918: \t\t\tos.Remove(filepath.Join(dumpDir, name))\n919: \t\t\tcontinue\n", + "line": "918", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/backup.go", + "code": "894: \t\t\t\tstackName, volName, err)\n895: \t\t\tos.Remove(tmpPath)\n896: \t\t\tdumpErrors = append(dumpErrors, volName)\n", + "line": "895", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/backup.go", + "code": "885: \t\t\t\tstackName, volName, strings.TrimSpace(string(out)), err)\n886: \t\t\tos.Remove(tmpPath)\n887: \t\t\tdumpErrors = append(dumpErrors, volName)\n", + "line": "886", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/appstop_marker.go", + "code": "391: \tif err := f.Close(); err != nil {\n392: \t\tos.Remove(tmp)\n393: \t\treturn err\n", + "line": "392", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/appstop_marker.go", + "code": "387: \t\tf.Close()\n388: \t\tos.Remove(tmp)\n389: \t\treturn err\n", + "line": "388", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/appstop_marker.go", + "code": "386: \tif err := f.Sync(); err != nil {\n387: \t\tf.Close()\n388: \t\tos.Remove(tmp)\n", + "line": "387", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/appstop_marker.go", + "code": "380: \t\tf.Close()\n381: \t\tos.Remove(tmp)\n382: \t\treturn err\n", + "line": "381", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/backup/appstop_marker.go", + "code": "379: \tif _, err := f.Write(data); err != nil {\n380: \t\tf.Close()\n381: \t\tos.Remove(tmp)\n", + "line": "380", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/assets/syncer.go", + "code": "308: \tif err := out.Close(); err != nil {\n309: \t\tos.Remove(tmp)\n310: \t\treturn err\n", + "line": "309", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/assets/syncer.go", + "code": "304: \t\tout.Close()\n305: \t\tos.Remove(tmp)\n306: \t\treturn err\n", + "line": "305", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/assets/syncer.go", + "code": "303: \tif _, err := io.Copy(out, resp.Body); err != nil {\n304: \t\tout.Close()\n305: \t\tos.Remove(tmp)\n", + "line": "304", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1174: \t\t\toutFile.Close()\n1175: \t\t\tos.Chmod(target, os.FileMode(hdr.Mode))\n1176: \t\t}\n", + "line": "1175", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1173: \t\t\t}\n1174: \t\t\toutFile.Close()\n1175: \t\t\tos.Chmod(target, os.FileMode(hdr.Mode))\n", + "line": "1174", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1170: \t\t\tif _, err := io.Copy(outFile, tr); err != nil {\n1171: \t\t\t\toutFile.Close()\n1172: \t\t\t\treturn err\n", + "line": "1171", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1126: \t\t\toutFile.Close()\n1127: \t\t\tos.Chmod(target, os.FileMode(hdr.Mode))\n1128: \t\t}\n", + "line": "1127", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1125: \t\t\t}\n1126: \t\t\toutFile.Close()\n1127: \t\t\tos.Chmod(target, os.FileMode(hdr.Mode))\n", + "line": "1126", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "1122: \t\t\tif _, err := io.Copy(outFile, tr); err != nil {\n1123: \t\t\t\toutFile.Close()\n1124: \t\t\t\treturn err\n", + "line": "1123", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "289: \tif e.debug {\n290: \t\tfilepath.Walk(tmpDir, func(path string, info os.FileInfo, err error) error {\n291: \t\t\tif err != nil {\n292: \t\t\t\treturn nil\n293: \t\t\t}\n294: \t\t\trel, _ := filepath.Rel(tmpDir, path)\n295: \t\t\tif info.IsDir() {\n296: \t\t\t\te.debugf(\" [dir] %s/\", rel)\n297: \t\t\t} else {\n298: \t\t\t\te.debugf(\" [file] %s (%s)\", rel, humanizeBytes(info.Size()))\n299: \t\t\t}\n300: \t\t\treturn nil\n301: \t\t})\n302: \t}\n", + "line": "290-301", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "255: \t\ttmpPath := tmp.Name()\n256: \t\ttmp.Close()\n257: \t\tdefer os.Remove(tmpPath)\n", + "line": "256", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/restore.go", + "code": "168: \ttmpPath := tmpFile.Name()\n169: \ttmpFile.Close()\n170: \tdefer os.Remove(tmpPath)\n", + "line": "169", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "955: \tvar total int64\n956: \tfilepath.Walk(dir, func(_ string, info os.FileInfo, err error) error {\n957: \t\tif err != nil || info.IsDir() {\n958: \t\t\treturn nil\n959: \t\t}\n960: \t\ttotal += info.Size()\n961: \t\treturn nil\n962: \t})\n963: \treturn total\n", + "line": "956-962", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "799: \tvolDir := filepath.Join(dataDir, \"volumes\")\n800: \tos.MkdirAll(volDir, 0755)\n801: \n", + "line": "800", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "785: \t\tif closeErr != nil {\n786: \t\t\tos.Remove(tarPath)\n787: \t\t\treturn fmt.Errorf(\"flushing %s: %w\", tarPath, closeErr)\n", + "line": "786", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "781: \t\tif err != nil {\n782: \t\t\tos.Remove(tarPath)\n783: \t\t\treturn fmt.Errorf(\"streaming volume %s: %s — %w\", volName, stderr, err)\n", + "line": "782", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "714: \t\t\te.logger.Printf(\"[WARN] Export: failed to tar %s (excluded from the bundle): %v\", mount, err)\n715: \t\t\tos.Remove(tarPath)\n716: \t\t} else {\n", + "line": "715", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "661: \thddDir := filepath.Join(dataDir, \"hdd\")\n662: \tos.MkdirAll(hddDir, 0755)\n663: \n", + "line": "662", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "644: \t\t\t}\n645: \t\t\tos.Remove(result.FilePath)\n646: \t\t}\n", + "line": "645", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "480: \t\t}\n481: \t\tos.Remove(targetPath)\n482: \t\ttargetPath = encPath\n", + "line": "481", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "476: \t\tif err := EncryptFile(targetPath, encPath, req.Password); err != nil {\n477: \t\t\tos.Remove(targetPath)\n478: \t\t\te.failJob(job, step, fmt.Sprintf(\"Titkosítás sikertelen: %v\", err))\n", + "line": "477", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "457: \tif err := createTarGz(targetPath, tmpDir); err != nil {\n458: \t\tos.Remove(targetPath)\n459: \t\te.failJob(job, step, fmt.Sprintf(\"Csomag készítése sikertelen: %v\", err))\n", + "line": "458", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "389: \tdataDir := filepath.Join(tmpDir, \"data\")\n390: \tos.MkdirAll(dataDir, 0755)\n391: \n", + "line": "390", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "368: \t\te.debugf(\"no database found for %s — skipping DB step\", req.StackName)\n369: \t\tos.Remove(dbDir)\n370: \t} else {\n", + "line": "369", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/export.go", + "code": "350: \tdbDir := filepath.Join(tmpDir, \"database\")\n351: \tos.MkdirAll(dbDir, 0755)\n352: \n", + "line": "351", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/estimate.go", + "code": "207: \tvar size int64\n208: \tfmt.Sscanf(strings.TrimSpace(lines[1]), \"%d\", \u0026size)\n209: \treturn size\n", + "line": "208", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/estimate.go", + "code": "160: \tvar size int64\n161: \tfmt.Sscanf(strings.Fields(string(out))[0], \"%d\", \u0026size)\n162: \treturn size\n", + "line": "161", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/estimate.go", + "code": "116: \texportDir := ExportDir(destDrive)\n117: \tos.MkdirAll(exportDir, 0755)\n118: \test.DestFreeBytes = DiskFree(exportDir)\n", + "line": "117", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appexport/crypto.go", + "code": "223: \tif !hmac.Equal(mac.Sum(nil), storedMAC) {\n224: \t\tos.Remove(outputPath)\n225: \t\treturn util.MsgError(\"err.appexport.jelszo_hibas_vagy_a_fajl_serult\")\n", + "line": "224", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "992: \t\t\tpath := filepath.Join(dumpDir, e.Name())\n993: \t\t\tos.Remove(path)\n994: \t\t\tlogger.Printf(\"[INFO] [backup] Cleaned up stale tmp file: %s\", e.Name())\n", + "line": "993", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "401: \tif err := os.Rename(tmpPath, finalPath); err != nil {\n402: \t\tos.Remove(tmpPath)\n403: \t\tresult.Error = fmt.Errorf(\"renaming dump file: %w\", err)\n", + "line": "402", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "390: \tif err != nil || stat.Size() == 0 {\n391: \t\tos.Remove(tmpPath)\n392: \t\tresult.Error = fmt.Errorf(\"dump produced empty file for %s\", db.ContainerName)\n", + "line": "391", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "381: \tif err := tmpFile.Close(); err != nil {\n382: \t\tos.Remove(tmpPath)\n383: \t\tresult.Error = fmt.Errorf(\"closing dump file: %w\", err)\n", + "line": "382", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "375: \tif err := tmpFile.Sync(); err != nil {\n376: \t\tos.Remove(tmpPath)\n377: \t\tresult.Error = fmt.Errorf(\"syncing dump file: %w\", err)\n", + "line": "376", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/appbackup/dbdump.go", + "code": "360: \tif err != nil {\n361: \t\tos.Remove(tmpPath)\n362: \t\terrMsg := stderr.String()\n", + "line": "361", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/api/router.go", + "code": "1606: \tw.Header().Set(\"Content-Type\", \"text/yaml; charset=utf-8\")\n1607: \tw.Write(data)\n1608: }\n", + "line": "1607", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/internal/api/router.go", + "code": "1579: \tif err := os.Rename(tmpPath, path); err != nil {\n1580: \t\tos.Remove(tmpPath)\n1581: \t\tif err := os.WriteFile(path, body, 0600); err != nil { // bind-mount fallback\n", + "line": "1580", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "3759: \tmainServer.Shutdown(shutdownCtx)\n3760: \tsetupServer.Shutdown(shutdownCtx)\n3761: \tlogger.Println(\"[INFO] Setup wizard stopped\")\n", + "line": "3760", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "3758: \tdefer shutdownCancel()\n3759: \tmainServer.Shutdown(shutdownCtx)\n3760: \tsetupServer.Shutdown(shutdownCtx)\n", + "line": "3759", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "3709: \t\tw.Header().Set(\"Content-Type\", \"application/json\")\n3710: \t\tjson.NewEncoder(w).Encode(map[string]interface{}{\n3711: \t\t\t\"ok\": true, \"message\": \"felhom-controller is healthy\",\n3712: \t\t\t\"setup_mode\": true, \"version\": Version,\n3713: \t\t})\n3714: \t})\n", + "line": "3710-3713", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "3238: func (a *stackAdapter) RefreshAndIsRunning(name string) bool {\n3239: \ta.mgr.RefreshStatus()\n3240: \ts, ok := a.mgr.GetStack(name)\n", + "line": "3239", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "2117: \t\t\t\t}\n2118: \t\t\t\tresp.Body.Close()\n2119: \t\t\t\treturn resp.StatusCode, latency, nil\n", + "line": "2118", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "2105: \t\t\t}\n2106: \t\t\tresp.Body.Close()\n2107: \t\t\treturn resp.StatusCode, latency, nil\n", + "line": "2106", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "1767: \t\t\t\t}\n1768: \t\t\t\thubPusher.PushOnce(r)\n1769: \t\t\t}\n", + "line": "1768", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "1094: \t\t\t} else {\n1095: \t\t\t\tsett.SetHubVerified(true, time.Now())\n1096: \t\t\t}\n", + "line": "1095", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom-controller/controller/cmd/controller/main.go", + "code": "1091: \t\t\tif resp.CustomerBlocked {\n1092: \t\t\t\tsett.SetHubVerified(false, time.Now())\n1093: \t\t\t\tlogger.Printf(\"[WARN] Customer blocked on Hub — new deployments may be restricted\")\n", + "line": "1092", + "column": "5", + "nosec": false, + "suppressions": null + } + ], + "Stats": { + "files": 276, + "lines": 94504, + "nosec": 0, + "found": 470 + }, + "GosecVersion": "dev" +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom.eu.json b/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom.eu.json new file mode 100644 index 00000000..c6f5d8cb --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/gosec-felhom.eu.json @@ -0,0 +1,3452 @@ +{ + "Golang errors": {}, + "Issues": [ + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/offsiteheal/reconciler.go", + "code": "51: // excluded upstream, by the declaration itself, rather than filtered out here.\n52: const StateNeedsCredential = \"needs_credential\"\n53: \n", + "line": "52", + "column": "7", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/monitor/offsite_delivery.go", + "code": "137: // are pinned together by TestDeclaredStateStringMatchesTheReconciler.\n138: const declaredNeedsCredential = \"needs_credential\"\n139: \n", + "line": "138", + "column": "7", + "nosec": false, + "suppressions": null + }, + { + "severity": "HIGH", + "confidence": "LOW", + "cwe": { + "id": "798", + "url": "https://cwe.mitre.org/data/definitions/798.html" + }, + "rule_id": "G101", + "details": "Potential hardcoded credentials", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/monitor/offsite_delivery.go", + "code": "34: \teventDeliveryStuck = \"offsite_delivery_stuck\" // hub-internal (not in allowedEventTypes, like pbsdr_*)\n35: \teventCredentialRestaged = \"offsite_credential_restaged\" // hub-internal\n36: \t// stuckAfter: consumed_awaiting_apply is normal for seconds (F10 repair: consume→applied in\n", + "line": "35", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "LOW", + "cwe": { + "id": "79", + "url": "https://cwe.mitre.org/data/definitions/79.html" + }, + "rule_id": "G203", + "details": "The used method does not auto-escape HTML. This can potentially lead to 'Cross-site Scripting' vulnerabilities, in case the attacker controls the input.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/server.go", + "code": "1016: \ttok := s.csrfToken(r)\n1017: \treturn template.HTML(`\u003cinput type=\"hidden\" name=\"_csrf\" value=\"` + template.HTMLEscapeString(tok) + `\"\u003e`)\n1018: }\n", + "line": "1017", + "column": "9", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "LOW", + "cwe": { + "id": "79", + "url": "https://cwe.mitre.org/data/definitions/79.html" + }, + "rule_id": "G203", + "details": "The used method does not auto-escape HTML. This can potentially lead to 'Cross-site Scripting' vulnerabilities, in case the attacker controls the input.", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/server.go", + "code": "153: \t\t\tb, _ := json.Marshal(v)\n154: \t\t\treturn template.JS(b)\n155: \t\t},\n", + "line": "154", + "column": "11", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/telemetry.go", + "code": "574: \t}\n575: \tquery := \"DELETE FROM app_log_issues WHERE id IN (\" + strings.Join(placeholders, \",\") + \")\"\n576: \tres, err := s.db.Exec(query, args...)\n", + "line": "575", + "column": "11", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/telemetry.go", + "code": "517: \t}\n518: \tquery := \"UPDATE app_log_issues SET dismissed_at = ? WHERE id IN (\" + strings.Join(placeholders, \",\") + \")\"\n519: \tres, err := s.db.Exec(query, args...)\n", + "line": "518", + "column": "11", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "225: \tfor _, t := range all {\n226: \t\tres, err := tx.Exec(`UPDATE `+t.table+` SET `+t.col+` = ? WHERE `+t.idCol+` = ? AND `+t.col+` = ?`, t.plain, t.id, t.sealed)\n227: \t\tif err != nil {\n", + "line": "226", + "column": "23", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "197: \tfor _, c := range r879Columns {\n198: \t\trows, err := s.db.Query(`SELECT ` + c.idCol + `, ` + c.col + ` FROM ` + c.table + ` WHERE ` + c.col + ` LIKE 'enc:v1:%'`)\n199: \t\tif err != nil {\n", + "line": "198", + "column": "27", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "143: \t\t\t} else {\n144: \t\t\t\t_, err = s.db.Exec(`UPDATE `+c.table+` SET `+c.col+` = ? WHERE `+c.idCol+` = ? AND `+c.col+` = ?`,\n145: \t\t\t\t\tsealed, r.id, r.v)\n", + "line": "144", + "column": "24", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "140: \t\t\tif c.withHash {\n141: \t\t\t\t_, err = s.db.Exec(`UPDATE `+c.table+` SET `+c.col+` = ?, api_key_hash = ? WHERE `+c.idCol+` = ? AND `+c.col+` = ?`,\n142: \t\t\t\t\tsealed, apiKeyHash(r.v), r.id, r.v)\n", + "line": "141", + "column": "24", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "118: \tfor _, c := range r879Columns {\n119: \t\trows, err := s.db.Query(`SELECT ` + c.idCol + `, ` + c.col + ` FROM ` + c.table +\n120: \t\t\t` WHERE ` + c.col + ` \u003c\u003e '' AND ` + c.col + ` NOT LIKE 'enc:v1:%'`)\n121: \t\tif err != nil {\n", + "line": "119-120", + "column": "27", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "96: \t\tfor _, r := range todo {\n97: \t\t\tif _, err := s.db.Exec(`UPDATE `+t.table+` SET api_key_hash = ? WHERE `+t.idCol+` = ? AND api_key = ?`,\n98: \t\t\t\tapiKeyHash(r.k), r.id, r.k); err != nil {\n", + "line": "97", + "column": "27", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "79: \tfor _, t := range []struct{ table, idCol string }{{\"hosts\", \"host_id\"}, {\"customer_configs\", \"customer_id\"}} {\n80: \t\trows, err := s.db.Query(`SELECT ` + t.idCol + `, api_key FROM ` + t.table +\n81: \t\t\t` WHERE api_key_hash = '' AND api_key \u003c\u003e '' AND api_key NOT LIKE 'enc:v1:%'`)\n82: \t\tif err != nil {\n", + "line": "80-81", + "column": "27", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/os_updates.go", + "code": "465: \t}\n466: \tq := `SELECT ` + osReportCols + ` FROM os_reports WHERE layer = ? AND host_id IN (?` + strings.Repeat(\",?\", len(hosts)-1) + `) ORDER BY id LIMIT 1`\n467: \targs := []any{layer}\n", + "line": "466", + "column": "7", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/os_updates.go", + "code": "434: func (s *Store) LatestHealthyOSReport(hostID, layer string, outcomes ...string) (*OSReport, error) {\n435: \tq := `SELECT ` + osReportCols + ` FROM os_reports WHERE host_id = ? AND layer = ? AND healthy = 1 AND outcome IN (?` +\n436: \t\tstrings.Repeat(\",?\", len(outcomes)-1) + `) ORDER BY id DESC LIMIT 1`\n437: \targs := []any{hostID, layer}\n", + "line": "435-436", + "column": "7", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "89", + "url": "https://cwe.mitre.org/data/definitions/89.html" + }, + "rule_id": "G202", + "details": "SQL string concatenation", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/customer_delete.go", + "code": "90: \tfor _, q := range residueQueries {\n91: \t\tif _, err := tx.Exec(`DELETE FROM `+q.table+` WHERE customer_id = ?`, customerID); err != nil {\n92: \t\t\treturn fmt.Errorf(\"PurgeCustomerResidue %s: purge %s: %w\", customerID, q.table, err)\n", + "line": "91", + "column": "24", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/assets/assets.go", + "code": "266: \ttmp := dst + \".tmp\"\n267: \tout, err := os.Create(tmp)\n268: \tif err != nil {\n", + "line": "267", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/assets/assets.go", + "code": "259: func copyFile(src, dst string) error {\n260: \tin, err := os.Open(src)\n261: \tif err != nil {\n", + "line": "260", + "column": "13", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/assets/assets.go", + "code": "244: func fileSHA256(path string) (string, error) {\n245: \tf, err := os.Open(path)\n246: \tif err != nil {\n", + "line": "245", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hubdb-check/main.go", + "code": "24: \tvar r result\n25: \traw, err := os.ReadFile(keyFile)\n26: \tif err != nil {\n", + "line": "25", + "column": "14", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "948: \n949: \tdata, err := os.ReadFile(path)\n950: \tif err != nil {\n", + "line": "949", + "column": "15", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "747: \t\tif wgAddr != \"\" \u0026\u0026 wgHostKey != \"\" \u0026\u0026 pokeKeyFile != \"\" {\n748: \t\t\tkeyPEM, err := os.ReadFile(pokeKeyFile)\n749: \t\t\tif os.IsNotExist(err) {\n", + "line": "748", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "712: \t\tif wgAddr != \"\" \u0026\u0026 wgHostKey != \"\" \u0026\u0026 tsKeyFile != \"\" {\n713: \t\t\tkeyPEM, err := os.ReadFile(tsKeyFile)\n714: \t\t\tif os.IsNotExist(err) {\n", + "line": "713", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "22", + "url": "https://cwe.mitre.org/data/definitions/22.html" + }, + "rule_id": "G304", + "details": "Potential file inclusion via variable", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "690: \t\tif wgAddr != \"\" \u0026\u0026 wgKeyFile != \"\" \u0026\u0026 wgHostKey != \"\" {\n691: \t\t\tkeyPEM, err := os.ReadFile(wgKeyFile)\n692: \t\t\tif err != nil {\n", + "line": "691", + "column": "19", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/assets/assets.go", + "code": "50: \n51: \tif err := os.MkdirAll(assetsDir, 0755); err != nil {\n52: \t\tlogger.Printf(\"[ERROR] Failed to create assets dir %s: %v\", assetsDir, err)\n", + "line": "51", + "column": "12", + "nosec": false, + "suppressions": null + }, + { + "severity": "MEDIUM", + "confidence": "HIGH", + "cwe": { + "id": "276", + "url": "https://cwe.mitre.org/data/definitions/276.html" + }, + "rule_id": "G301", + "details": "Expect directory permissions to be 0750 or less", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "180: \t// Ensure data dir exists\n181: \tos.MkdirAll(cfg.Server.DataDir, 0755)\n182: \n", + "line": "181", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/wgsync/client.go", + "code": "109: \tif dl, ok := ctx.Deadline(); ok {\n110: \t\tconn.SetDeadline(dl)\n111: \t}\n", + "line": "110", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/wgsync/client.go", + "code": "107: \tdefer client.Close()\n108: \tconn.SetDeadline(time.Time{}) // handshake done; session I/O below is bounded by the same conn\n109: \tif dl, ok := ctx.Deadline(); ok {\n", + "line": "108", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/wgsync/client.go", + "code": "102: \tif err != nil {\n103: \t\tconn.Close()\n104: \t\treturn fmt.Errorf(\"wgsync: ssh handshake %s: %w\", c.addr, err)\n", + "line": "103", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/wgsync/client.go", + "code": "98: \t} else {\n99: \t\tconn.SetDeadline(time.Now().Add(c.timeout))\n100: \t}\n", + "line": "99", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/wgsync/client.go", + "code": "96: \tif dl, ok := ctx.Deadline(); ok {\n97: \t\tconn.SetDeadline(dl)\n98: \t} else {\n", + "line": "97", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/server.go", + "code": "1115: \tw.Header().Set(\"Cache-Control\", \"public, max-age=3600\")\n1116: \tw.Write(data)\n1117: }\n", + "line": "1116", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/server.go", + "code": "956: \tw.WriteHeader(http.StatusOK)\n957: \tw.Write([]byte(`\u003chtml\u003e\u003chead\u003e\u003ctitle\u003eFelhom Hub — Bejelentkezés\u003c/title\u003e\u003c/head\u003e\u003cbody style=\"font-family:sans-serif;display:flex;justify-content:center;padding-top:4rem\"\u003e\u003cform method=\"post\" style=\"display:flex;flex-direction:column;gap:.75rem;width:300px\"\u003e\u003ch2\u003eFelhom Hub\u003c/h2\u003e\u003cinput type=\"password\" name=\"password\" placeholder=\"Jelszó\" autofocus style=\"padding:.5rem;border:1px solid #ccc;border-radius:4px\"\u003e\u003cbutton type=\"submit\" style=\"padding:.5rem;background:#0083D8;color:#fff;border:none;border-radius:4px;cursor:pointer\"\u003eBejelentkezés\u003c/button\u003e\u003c/form\u003e\u003c/body\u003e\u003c/html\u003e`))\n958: }\n", + "line": "957", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/server.go", + "code": "952: \t\tw.WriteHeader(http.StatusUnauthorized)\n953: \t\tw.Write([]byte(`\u003chtml\u003e\u003chead\u003e\u003ctitle\u003eFelhom Hub — Bejelentkezés\u003c/title\u003e\u003c/head\u003e\u003cbody style=\"font-family:sans-serif;display:flex;justify-content:center;padding-top:4rem\"\u003e\u003cform method=\"post\" style=\"display:flex;flex-direction:column;gap:.75rem;width:300px\"\u003e\u003ch2\u003eFelhom Hub\u003c/h2\u003e\u003cp style=\"color:red\"\u003eHibás jelszó\u003c/p\u003e\u003cinput type=\"password\" name=\"password\" placeholder=\"Jelszó\" autofocus style=\"padding:.5rem;border:1px solid #ccc;border-radius:4px\"\u003e\u003cbutton type=\"submit\" style=\"padding:.5rem;background:#0083D8;color:#fff;border:none;border-radius:4px;cursor:pointer\"\u003eBejelentkezés\u003c/button\u003e\u003c/form\u003e\u003c/body\u003e\u003c/html\u003e`))\n954: \t\treturn\n", + "line": "953", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/server.go", + "code": "482: \t\tw.Header().Set(\"Cache-Control\", \"public, max-age=31536000, immutable\")\n483: \t\tw.Write(data)\n484: \tcase path == \"/configuration\":\n", + "line": "483", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/server.go", + "code": "471: \t\tw.Header().Set(\"Cache-Control\", \"public, max-age=86400\")\n472: \t\tw.Write(chartJS)\n473: \tcase strings.HasPrefix(path, \"/static/fonts/\"):\n", + "line": "472", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/logtail.go", + "code": "63: \t\t\tw.Write([]byte(line))\n64: \t\t\tw.Write([]byte(\"\\n\"))\n65: \t\t}\n", + "line": "64", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/logtail.go", + "code": "62: \t\tfor _, line := range tail.Lines {\n63: \t\t\tw.Write([]byte(line))\n64: \t\t\tw.Write([]byte(\"\\n\"))\n", + "line": "63", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/logbundle.go", + "code": "112: \t\tw.Write([]byte(line))\n113: \t\tw.Write([]byte(\"\\n\"))\n114: \t}\n", + "line": "113", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/logbundle.go", + "code": "111: \tfor _, line := range lines {\n112: \t\tw.Write([]byte(line))\n113: \t\tw.Write([]byte(\"\\n\"))\n", + "line": "112", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/dr_recipe.go", + "code": "41: \tw.Header().Set(\"Content-Disposition\", \"attachment; filename=\\\"dr-recipe-\"+safeFilename(customerID)+\".json\\\"\")\n42: \tw.Write(out)\n43: \ts.logger.Printf(\"[INFO] DR-recipe downloaded for customer %s (v%d)\", customerID, assembled.RecipeVersion)\n", + "line": "42", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "1813: \tw.Header().Set(\"Content-Type\", \"application/json\")\n1814: \tjson.NewEncoder(w).Encode(map[string]interface{}{\"ok\": true, \"message\": \"Geo-restriction removed from Cloudflare.\"})\n1815: }\n", + "line": "1814", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "1806: \t\tw.WriteHeader(http.StatusBadGateway)\n1807: \t\tjson.NewEncoder(w).Encode(map[string]interface{}{\"ok\": false, \"error\": fmt.Sprintf(\"Cloudflare API error: %v\", err)})\n1808: \t\treturn\n", + "line": "1807", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "1797: \t\tw.WriteHeader(http.StatusBadRequest)\n1798: \t\tjson.NewEncoder(w).Encode(map[string]interface{}{\"ok\": false, \"error\": \"No domain configured for this customer\"})\n1799: \t\treturn\n", + "line": "1798", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "1791: \t\tw.WriteHeader(http.StatusBadRequest)\n1792: \t\tjson.NewEncoder(w).Encode(map[string]interface{}{\"ok\": false, \"error\": \"No Cloudflare API token configured for this customer\"})\n1793: \t\treturn\n", + "line": "1792", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "1775: \t\tw.WriteHeader(http.StatusNotFound)\n1776: \t\tjson.NewEncoder(w).Encode(map[string]interface{}{\"ok\": false, \"error\": \"Customer not found\"})\n1777: \t\treturn\n", + "line": "1776", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "1668: func (s *Server) renderConfigForm(w http.ResponseWriter, r *http.Request, isNew bool, cfg *store.CustomerConfig, overrides map[string]interface{}, errMsg string) {\n1669: \ts.templates.ExecuteTemplate(w, \"config_form.html\", s.configFormData(r, isNew, cfg, overrides, errMsg))\n1670: }\n", + "line": "1669", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "1125: \tw.Header().Set(\"Content-Type\", \"text/yaml; charset=utf-8\")\n1126: \tw.Write([]byte(yamlOutput))\n1127: }\n", + "line": "1126", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "653: \tif overrides == nil {\n654: \t\tjson.Unmarshal([]byte(cfg.ConfigJSON), \u0026overrides)\n655: \t}\n", + "line": "654", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "234: \t\t\t}\n235: \t\t\tjson.Unmarshal([]byte(customer.ReportJSON), \u0026rpt)\n236: \t\t\tcontrollerURL = rpt.ControllerURL\n", + "line": "235", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "210: \tif cfg != nil {\n211: \t\tjson.Unmarshal([]byte(cfg.ConfigJSON), \u0026overrides)\n212: \t}\n", + "line": "211", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "204: \tif customer != nil {\n205: \t\tjson.Unmarshal([]byte(customer.ReportJSON), \u0026report)\n206: \t}\n", + "line": "205", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/configs.go", + "code": "174: \t}\n175: \ts.templates.ExecuteTemplate(w, \"configs.html\", data)\n176: }\n", + "line": "175", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/web/apps.go", + "code": "167: \tcase \"selected\":\n168: \t\tr.ParseForm()\n169: \t\tidStrs := r.Form[\"issue_ids\"]\n", + "line": "168", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/tenantsync/client.go", + "code": "266: \tif dl, ok := ctx.Deadline(); ok {\n267: \t\tconn.SetDeadline(dl)\n268: \t}\n", + "line": "267", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/tenantsync/client.go", + "code": "264: \tdefer client.Close()\n265: \tconn.SetDeadline(time.Time{})\n266: \tif dl, ok := ctx.Deadline(); ok {\n", + "line": "265", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/tenantsync/client.go", + "code": "259: \tif err != nil {\n260: \t\tconn.Close()\n261: \t\treturn nil, nil, fmt.Errorf(\"tenantsync: ssh handshake %s: %w\", c.addr, err)\n", + "line": "260", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/tenantsync/client.go", + "code": "255: \t} else {\n256: \t\tconn.SetDeadline(time.Now().Add(c.timeout))\n257: \t}\n", + "line": "256", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/tenantsync/client.go", + "code": "253: \tif dl, ok := ctx.Deadline(); ok {\n254: \t\tconn.SetDeadline(dl)\n255: \t} else {\n", + "line": "254", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/wg.go", + "code": "184: \t}\n185: \trows.Close()\n186: \tif err := rows.Err(); err != nil {\n", + "line": "185", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/wg.go", + "code": "179: \t\tif err := rows.Scan(\u0026ip); err != nil {\n180: \t\t\trows.Close()\n181: \t\t\treturn \"\", err\n", + "line": "180", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/telemetry.go", + "code": "559: \t}\n560: \ts.db.Exec(\"UPDATE app_telemetry SET log_errors = 0, log_warnings = 0 WHERE app_name = ?\", appName)\n561: \treturn res.RowsAffected()\n", + "line": "560", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/telemetry.go", + "code": "479: \t\tif contextJSON.Valid \u0026\u0026 contextJSON.String != \"\" {\n480: \t\t\tjson.Unmarshal([]byte(contextJSON.String), \u0026ai.Context)\n481: \t\t}\n", + "line": "480", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/telemetry.go", + "code": "477: \t\t}\n478: \t\tjson.Unmarshal([]byte(affectedJSON), \u0026ai.AffectedCustomers)\n479: \t\tif contextJSON.Valid \u0026\u0026 contextJSON.String != \"\" {\n", + "line": "478", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/telemetry.go", + "code": "208: \t\tnewJSON, _ := json.Marshal(customers)\n209: \t\ttx.Exec(`UPDATE app_log_issues SET affected_customers = ? WHERE app_name = ? AND fingerprint = ?`,\n210: \t\t\tstring(newJSON), appName, fingerprint)\n211: \t}\n", + "line": "209-210", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/telemetry.go", + "code": "197: \tvar customers []string\n198: \tjson.Unmarshal([]byte(affectedJSON), \u0026customers)\n199: \tfound := false\n", + "line": "198", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "3287: \t\tif err != nil {\n3288: \t\t\ttx.Rollback()\n3289: \t\t}\n", + "line": "3288", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "2776: \t// ignore parse errors — show \"–\" on failure\n2777: \tjson.Unmarshal([]byte(reportJSON), \u0026report) //nolint:errcheck\n2778: \n", + "line": "2777", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "1470: \t}\n1471: \tjson.Unmarshal([]byte(c.ReportJSON), \u0026report)\n1472: \tc.CustomerName = report.CustomerName\n", + "line": "1471", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "915: \t}\n916: \trows.Close()\n917: \tchanged := []string{}\n", + "line": "916", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "910: \t\tif err := rows.Scan(\u0026r.id, \u0026r.ev); err != nil {\n911: \t\t\trows.Close()\n912: \t\t\treturn nil, err\n", + "line": "911", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "869: \ts.db.Exec(`ALTER TABLE hosts ADD COLUMN api_key_hash TEXT NOT NULL DEFAULT ''`)\n870: \ts.db.Exec(`ALTER TABLE customer_configs ADD COLUMN api_key_hash TEXT NOT NULL DEFAULT ''`)\n871: \t// Neither failure stops the hub: a row with no hash is matched on its plaintext key (GetHostByAPIKey),\n", + "line": "870", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "868: \t// the index is complete before any box reports, whatever happens to the sealing step in main.\n869: \ts.db.Exec(`ALTER TABLE hosts ADD COLUMN api_key_hash TEXT NOT NULL DEFAULT ''`)\n870: \ts.db.Exec(`ALTER TABLE customer_configs ADD COLUMN api_key_hash TEXT NOT NULL DEFAULT ''`)\n", + "line": "869", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "861: \t// R-833 (v0.129.0): the cap each window was opened with — an operator grant may raise it once.\n862: \ts.db.Exec(\"ALTER TABLE offsite_windows ADD COLUMN max_remove INTEGER\")\n863: \t// OS updates, guest fast lane (hub v0.130.0, `11` §8 step 2).\n", + "line": "862", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "799: \t// column already exists, which is fine on a fresh DB where the CREATE above already added it).\n800: \ts.db.Exec(\"ALTER TABLE appliance_registrations ADD COLUMN pairing_code TEXT NOT NULL DEFAULT ''\")\n801: \n", + "line": "800", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "657: \ts.db.Exec(`ALTER TABLE app_log_issues ADD COLUMN context_customer TEXT`)\n658: \ts.db.Exec(`ALTER TABLE app_log_issues ADD COLUMN dismissed_at DATETIME`)\n659: \n", + "line": "658", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "656: \ts.db.Exec(`ALTER TABLE app_log_issues ADD COLUMN context TEXT`)\n657: \ts.db.Exec(`ALTER TABLE app_log_issues ADD COLUMN context_customer TEXT`)\n658: \ts.db.Exec(`ALTER TABLE app_log_issues ADD COLUMN dismissed_at DATETIME`)\n", + "line": "657", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "655: \t// a genuinely NEW occurrence with last_seen \u003e dismissed_at resurfaces the row).\n656: \ts.db.Exec(`ALTER TABLE app_log_issues ADD COLUMN context TEXT`)\n657: \ts.db.Exec(`ALTER TABLE app_log_issues ADD COLUMN context_customer TEXT`)\n", + "line": "656", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "624: \t// (that method's own contract says so).\n625: \ts.db.Exec(`ALTER TABLE host_pbs_secrets ADD COLUMN generation INTEGER NOT NULL DEFAULT 0`)\n626: \n", + "line": "625", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "498: \t// legitimate future writer would have to prove first.\n499: \ts.db.Exec(`ALTER TABLE host_escrow ADD COLUMN stale_at DATETIME`)\n500: \n", + "line": "499", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "488: \t// instead of trusting blob-presence. NULL/'' = a legacy or password-less blob (never auto-confirms).\n489: \ts.db.Exec(`ALTER TABLE host_escrow ADD COLUMN restic_pw_sha256 TEXT`)\n490: \n", + "line": "489", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "482: \t// v0.93.0 report records that as a looked-at fact rather than a deduction.\n483: \ts.db.Exec(`ALTER TABLE host_escrow_superseded ADD COLUMN identity_blob BLOB`)\n484: \n", + "line": "483", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "474: \ts.db.Exec(`ALTER TABLE host_escrow ADD COLUMN identity_blob BLOB`)\n475: \ts.db.Exec(`ALTER TABLE host_escrow ADD COLUMN directive_json TEXT NOT NULL DEFAULT '{}'`)\n476: \n", + "line": "475", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "473: \ts.db.Exec(`ALTER TABLE hosts ADD COLUMN recovery_mode_until DATETIME`)\n474: \ts.db.Exec(`ALTER TABLE host_escrow ADD COLUMN identity_blob BLOB`)\n475: \ts.db.Exec(`ALTER TABLE host_escrow ADD COLUMN directive_json TEXT NOT NULL DEFAULT '{}'`)\n", + "line": "474", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "472: \t// secret is hub-held (the blobs need R, which the hub never has).\n473: \ts.db.Exec(`ALTER TABLE hosts ADD COLUMN recovery_mode_until DATETIME`)\n474: \ts.db.Exec(`ALTER TABLE host_escrow ADD COLUMN identity_blob BLOB`)\n", + "line": "473", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "340: \t\t// WAL checkpoint(TRUNCATE) so no plaintext lingers in the -wal sidecar either.\n341: \t\ts.db.Exec(`PRAGMA wal_checkpoint(TRUNCATE)`)\n342: \t\tif s.logger != nil {\n", + "line": "341", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "328: \tvar infraTables int\n329: \ts.db.QueryRow(`SELECT COUNT(*) FROM sqlite_master WHERE type='table'\n330: \t\tAND name IN ('infra_backup_versions','infra_backups')`).Scan(\u0026infraTables)\n331: \tif infraTables \u003e 0 {\n", + "line": "329-330", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "272: \t// v0.3.0: add channel column to notification_log (idempotent)\n273: \ts.db.Exec(\"ALTER TABLE notification_log ADD COLUMN channel TEXT NOT NULL DEFAULT 'customer'\")\n274: \n", + "line": "273", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "269: \t// v0.3.0: add cooldown_hours to customer_notifications (idempotent)\n270: \ts.db.Exec(\"ALTER TABLE customer_notifications ADD COLUMN cooldown_hours INTEGER DEFAULT 6\")\n271: \n", + "line": "270", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "222: \ts.db.Exec(\"ALTER TABLE reports ADD COLUMN language TEXT NOT NULL DEFAULT ''\")\n223: \ts.db.Exec(\"ALTER TABLE customer_configs ADD COLUMN language TEXT NOT NULL DEFAULT 'hu'\")\n224: \n", + "line": "223", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "221: \t// migrated DB before the sync.\n222: \ts.db.Exec(\"ALTER TABLE reports ADD COLUMN language TEXT NOT NULL DEFAULT ''\")\n223: \ts.db.Exec(\"ALTER TABLE customer_configs ADD COLUMN language TEXT NOT NULL DEFAULT 'hu'\")\n", + "line": "222", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "199: \t// at 1, so an already-running box records that as its baseline on its next report without restarting.\n200: \ts.db.Exec(\"ALTER TABLE customer_configs ADD COLUMN config_version INTEGER NOT NULL DEFAULT 1\")\n201: \n", + "line": "200", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "191: \t// it only ever applies to the exact floor it was declared for (see floor_declared.go). Idempotent.\n192: \ts.db.Exec(\"ALTER TABLE customer_configs ADD COLUMN min_controller_declared_min_agent TEXT NOT NULL DEFAULT ''\")\n193: \n", + "line": "192", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "187: \t// R-604 (v0.135.0): when the per-customer floor override was set (its age, on the System page).\n188: \ts.db.Exec(\"ALTER TABLE customer_configs ADD COLUMN min_controller_set_at TEXT NOT NULL DEFAULT ''\")\n189: \n", + "line": "188", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "185: \t// config). Idempotent.\n186: \ts.db.Exec(\"ALTER TABLE customer_configs ADD COLUMN min_controller_version TEXT NOT NULL DEFAULT ''\")\n187: \t// R-604 (v0.135.0): when the per-customer floor override was set (its age, on the System page).\n", + "line": "186", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "180: \t// v0.2.1: add status column to customer_configs (idempotent)\n181: \ts.db.Exec(\"ALTER TABLE customer_configs ADD COLUMN status TEXT NOT NULL DEFAULT 'active'\")\n182: \n", + "line": "181", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "177: \t// v0.1.8: add controller_url column (idempotent — ignore error if already exists)\n178: \ts.db.Exec(\"ALTER TABLE reports ADD COLUMN controller_url TEXT\")\n179: \n", + "line": "178", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/store.go", + "code": "112: \tif err := s.migrate(); err != nil {\n113: \t\tdb.Close()\n114: \t\treturn nil, fmt.Errorf(\"migrating database: %w\", err)\n", + "line": "113", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "209: \t\t}\n210: \t\trows.Close()\n211: \t}\n", + "line": "210", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "204: \t\t\tif err := rows.Scan(\u0026t.id, \u0026t.sealed); err != nil {\n205: \t\t\t\trows.Close()\n206: \t\t\t\treturn 0, err\n", + "line": "205", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "133: \t\t}\n134: \t\trows.Close()\n135: \t\tfor _, r := range todo {\n", + "line": "134", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "128: \t\t\tif err := rows.Scan(\u0026r.id, \u0026r.v); err != nil {\n129: \t\t\t\trows.Close()\n130: \t\t\t\treturn n, err\n", + "line": "129", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "94: \t\t}\n95: \t\trows.Close()\n96: \t\tfor _, r := range todo {\n", + "line": "95", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/r879_box_seal.go", + "code": "89: \t\t\tif err := rows.Scan(\u0026r.id, \u0026r.k); err != nil {\n90: \t\t\t\trows.Close()\n91: \t\t\t\treturn err\n", + "line": "90", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/os_updates.go", + "code": "71: \ts.db.Exec(`ALTER TABLE os_releases ADD COLUMN cancelled_at TEXT NOT NULL DEFAULT ''`)\n72: \ts.db.Exec(`ALTER TABLE os_releases ADD COLUMN cancel_reason TEXT NOT NULL DEFAULT ''`)\n73: \t// The kernel lane (hub v0.143.0, R-836, `09` §3 decision 172): every mail that told a household \"the box restarts\n", + "line": "72", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/os_updates.go", + "code": "70: \t}\n71: \ts.db.Exec(`ALTER TABLE os_releases ADD COLUMN cancelled_at TEXT NOT NULL DEFAULT ''`)\n72: \ts.db.Exec(`ALTER TABLE os_releases ADD COLUMN cancel_reason TEXT NOT NULL DEFAULT ''`)\n", + "line": "71", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/os_updates.go", + "code": "66: \t\t// unattended — operator may reverse). From hub v0.133.0 on, every approval under an override is marked.\n67: \t\ts.db.Exec(`UPDATE os_releases SET test = 1 WHERE approved_by = 'auto' AND EXISTS (SELECT 1 FROM os_candidates c\n68: \t\t\tWHERE c.fingerprint = os_releases.fingerprint\n69: \t\t\tAND (julianday(os_releases.approved_at) - julianday(c.first_seen)) * 24 \u003c 24)`)\n70: \t}\n", + "line": "67-69", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/os_updates.go", + "code": "54: \ts.db.Exec(`ALTER TABLE os_reports ADD COLUMN layer TEXT NOT NULL DEFAULT 'guest'`)\n55: \ts.db.Exec(`ALTER TABLE os_releases ADD COLUMN layer TEXT NOT NULL DEFAULT 'guest'`)\n56: \t// Test approvals end with the test (hub v0.133.0, `11` §5.3.1): an approval made while a TEST override is active\n", + "line": "55", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/os_updates.go", + "code": "53: \t// Host fast lane (hub v0.131.0): every report and release belongs to a LAYER; old rows are the guest's.\n54: \ts.db.Exec(`ALTER TABLE os_reports ADD COLUMN layer TEXT NOT NULL DEFAULT 'guest'`)\n55: \ts.db.Exec(`ALTER TABLE os_releases ADD COLUMN layer TEXT NOT NULL DEFAULT 'guest'`)\n", + "line": "54", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/offsite_seal.go", + "code": "142: \t}\n143: \trows.Close()\n144: \tn := 0\n", + "line": "143", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/offsite_seal.go", + "code": "135: \t\tif err := rows.Scan(\u0026r.id, \u0026r.v); err != nil {\n136: \t\t\trows.Close()\n137: \t\t\treturn 0, err\n", + "line": "136", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/logtail.go", + "code": "136: \t}\n137: \tjson.Unmarshal([]byte(linesJSON), \u0026t.Lines)\n138: \treturn t, nil\n", + "line": "137", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/logbundle.go", + "code": "222: \traw, err := io.ReadAll(io.LimitReader(zr, logBundleMaxRawBytes+1))\n223: \tzr.Close()\n224: \tif err != nil {\n", + "line": "223", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/host_recovery.go", + "code": "179: \t}\n180: \trows.Close()\n181: \tn := 0\n", + "line": "180", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/host_recovery.go", + "code": "172: \t\tif err := rows.Scan(\u0026r.id, \u0026r.v); err != nil {\n173: \t\t\trows.Close()\n174: \t\t\treturn 0, err\n", + "line": "173", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/deleted_customer_audit.go", + "code": "52: \t}\n53: \trows.Close()\n54: \tfor _, d := range dels {\n", + "line": "53", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/store/deleted_customer_audit.go", + "code": "39: \t\tif err := rows.Scan(\u0026id, \u0026at, \u0026legs); err != nil {\n40: \t\t\trows.Close()\n41: \t\t\treturn 0, 0, err\n", + "line": "40", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/poke/client.go", + "code": "114: \tif dl, ok := ctx.Deadline(); ok {\n115: \t\tconn.SetDeadline(dl)\n116: \t}\n", + "line": "115", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/poke/client.go", + "code": "112: \tdefer client.Close()\n113: \tconn.SetDeadline(time.Time{})\n114: \tif dl, ok := ctx.Deadline(); ok {\n", + "line": "113", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/poke/client.go", + "code": "107: \tif err != nil {\n108: \t\tconn.Close()\n109: \t\treturn fmt.Errorf(\"poke: ssh handshake %s: %w\", c.addr, err)\n", + "line": "108", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/poke/client.go", + "code": "103: \t} else {\n104: \t\tconn.SetDeadline(time.Now().Add(c.timeout))\n105: \t}\n", + "line": "104", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/poke/client.go", + "code": "101: \tif dl, ok := ctx.Deadline(); ok {\n102: \t\tconn.SetDeadline(dl)\n103: \t} else {\n", + "line": "102", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/offsitekeys/sshdialer.go", + "code": "66: \tif err != nil {\n67: \t\tconn.Close()\n68: \t\treturn nil, fmt.Errorf(\"offsitekeys: ssh handshake %s: %w\", addr, err)\n", + "line": "67", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/offsitekeys/service.go", + "code": "455: \t_, lerr := sh.Run(ctx, \"ls -d \"+path, nil)\n456: \tsh.Close()\n457: \tif lerr != nil {\n", + "line": "456", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/offsite/scanner.go", + "code": "48: \tif c != nil {\n49: \t\tc.Close()\n50: \t}\n", + "line": "49", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1095: \td.logger.Printf(\"[INFO] kernel notice (%s) emailed to the household of %s (lang=%s)\", kver, customerID, lang)\n1096: \td.store.LogNotification(customerID, \"kernel_notice\", \"info\", subject, \"sent\", \"\", \"customer\")\n1097: \treturn lang, nil\n", + "line": "1096", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1091: \t\td.logger.Printf(\"[ERROR] kernel notice (%s) to customer %s failed: %v\", kver, customerID, err)\n1092: \t\td.store.LogNotification(customerID, \"kernel_notice\", \"info\", subject, \"failed\", err.Error(), \"customer\")\n1093: \t\treturn lang, err\n", + "line": "1092", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1087: \t\t// The caller runs no kernel step on an error (no mail, no step) — exactly right for a held hub.\n1088: \t\td.store.LogNotification(customerID, \"kernel_notice\", \"info\", subject, \"held\", \"MAIL-HOLD marker present — dropped\", \"customer\")\n1089: \t\treturn lang, err\n", + "line": "1088", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1058: \td.logger.Printf(\"[INFO] self-bind link emailed to the registered address of %s\", customerID)\n1059: \td.store.LogNotification(customerID, \"selfbind_link\", \"info\", subject, \"sent\", \"\", \"customer\")\n1060: \treturn nil\n", + "line": "1059", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1054: \t\td.logger.Printf(\"[ERROR] self-bind link email to customer %s failed: %v\", customerID, err)\n1055: \t\td.store.LogNotification(customerID, \"selfbind_link\", \"info\", subject, \"failed\", err.Error(), \"customer\")\n1056: \t\treturn err\n", + "line": "1055", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1050: \tif err := d.deliver(\"self-bind link mail\", customerID, email, subject, body, nil); isHeld(err) {\n1051: \t\td.store.LogNotification(customerID, \"selfbind_link\", \"info\", subject, \"held\", \"MAIL-HOLD marker present — dropped\", \"customer\")\n1052: \t\treturn err\n", + "line": "1051", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1034: \td.logger.Printf(\"[INFO] claim %s email sent to the registered address of %s\", kind, customerID)\n1035: \td.store.LogNotification(customerID, eventType, \"info\", subject, \"sent\", \"\", \"customer\")\n1036: \treturn nil\n", + "line": "1035", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1030: \t\td.logger.Printf(\"[ERROR] claim %s email to customer %s failed: %v\", kind, customerID, err)\n1031: \t\td.store.LogNotification(customerID, eventType, \"info\", subject, \"failed\", err.Error(), \"customer\")\n1032: \t\treturn err\n", + "line": "1031", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "1026: \tif err := d.deliver(\"claim \"+kind+\" mail\", customerID, email, subject, body, nil); isHeld(err) {\n1027: \t\td.store.LogNotification(customerID, eventType, \"info\", subject, \"held\", \"MAIL-HOLD marker present — dropped\", \"customer\")\n1028: \t\treturn err\n", + "line": "1027", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "943: \td.logger.Printf(\"[INFO] Customer email sent for %s/%s\", customerID, eventType) // never the address (R-922)\n944: \td.store.LogNotification(customerID, eventType, severity, message, \"sent\", \"\", \"customer\")\n945: }\n", + "line": "944", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "939: \t\td.logger.Printf(\"[ERROR] Customer email failed for %s/%s: %v\", customerID, eventType, err)\n940: \t\td.store.LogNotification(customerID, eventType, severity, message, \"failed\", err.Error(), \"customer\")\n941: \t\treturn\n", + "line": "940", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "935: \t\td.forgetCustomerCooldown(cooldownKey)\n936: \t\td.store.LogNotification(customerID, eventType, severity, message, \"held\", \"MAIL-HOLD marker present — dropped\", \"customer\")\n937: \t\treturn\n", + "line": "936", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "902: \t\tif last, ok, err := d.store.LastCustomerSentAt(customerID, householdLivenessTypes); err == nil \u0026\u0026 ok \u0026\u0026 time.Since(last) \u003c householdLivenessQuiet {\n903: \t\t\td.store.LogNotification(customerID, eventType, severity, message, \"skipped\",\n904: \t\t\t\t\"liveness: the household hears this at most once per 7 days (R-873)\", \"customer\")\n905: \t\t\td.logger.Printf(\"[INFO] Customer mail skipped for %s/%s — the household was told about an outage %s ago (R-873: at most once per 7 days)\",\n", + "line": "903-904", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "872: \tif operatorOnlyEvents[eventType] {\n873: \t\td.store.LogNotification(customerID, eventType, severity, message, \"skipped\", \"operator_only\", \"customer\")\n874: \t\treturn\n", + "line": "873", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "664: \td.logger.Printf(\"[INFO] Operator email sent for %s/%s\", customerID, eventType)\n665: \td.store.LogNotification(customerID, eventType, severity, message, \"sent\", \"\", \"operator\")\n666: }\n", + "line": "665", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "659: \t\td.logger.Printf(\"[ERROR] Operator email failed for %s/%s: %v — retrying in %v\", customerID, eventType, err, operatorRetryDelays[0])\n660: \t\td.store.LogNotification(customerID, eventType, severity, message, \"failed\", err.Error(), \"operator\")\n661: \t\td.retryOperatorEmail(customerID, eventType, severity, message, subject, body, hdrs, 0)\n", + "line": "660", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "655: \t\td.mu.Unlock()\n656: \t\td.store.LogNotification(customerID, eventType, severity, message, \"held\", \"MAIL-HOLD marker present — dropped\", \"operator\")\n657: \t\treturn\n", + "line": "656", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "378: \td.logger.Printf(\"[INFO] Customer recovery email sent to %s for %s/%s\", prefs.Email, customerID, eventType)\n379: \td.store.LogNotification(customerID, eventType, severity, message, \"sent\", \"\", \"customer\")\n380: }\n", + "line": "379", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "374: \t\td.logger.Printf(\"[ERROR] Customer recovery email failed for %s/%s: %v\", customerID, eventType, err)\n375: \t\td.store.LogNotification(customerID, eventType, severity, message, \"failed\", err.Error(), \"customer\")\n376: \t\treturn\n", + "line": "375", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "370: \t\td.forgetCustomerCooldown(cooldownKey)\n371: \t\td.store.LogNotification(customerID, eventType, severity, message, \"held\", \"MAIL-HOLD marker present — dropped\", \"customer\")\n372: \t\treturn\n", + "line": "371", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "312: \td.logger.Printf(\"[INFO] Operator test email sent for %s\", customerID)\n313: \td.store.LogNotification(customerID, \"test\", \"info\", \"operator test copy\", \"sent\", \"\", \"operator\")\n314: }\n", + "line": "313", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "308: \t\td.logger.Printf(\"[ERROR] Operator test email failed for %s: %v\", customerID, err)\n309: \t\td.store.LogNotification(customerID, \"test\", \"info\", \"operator test copy\", \"failed\", err.Error(), \"operator\")\n310: \t\treturn\n", + "line": "309", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "304: \tif err := d.deliver(\"operator test mail\", \"operator\", d.operatorEmail, opSubject, opBody, priorityHeaders(\"critical\")); isHeld(err) {\n305: \t\td.store.LogNotification(customerID, \"test\", \"info\", \"operator test copy\", \"held\", \"MAIL-HOLD marker present — dropped\", \"operator\")\n306: \t\treturn\n", + "line": "305", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "286: \t\t\td.logger.Printf(\"[INFO] Test email sent to %s for %s\", prefs.Email, customerID)\n287: \t\t\td.store.LogNotification(customerID, \"test\", \"info\", \"Teszt értesítés\", \"sent\", \"\", \"customer\")\n288: \t\t}\n", + "line": "287", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "283: \t\t\td.logger.Printf(\"[ERROR] Test email to %s failed: %v\", prefs.Email, err)\n284: \t\t\td.store.LogNotification(customerID, \"test\", \"info\", \"Teszt értesítés\", \"failed\", err.Error(), \"customer\")\n285: \t\t} else {\n", + "line": "284", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "280: \t\tif err := d.deliver(\"test mail\", customerID, prefs.Email, subject, body, nil); isHeld(err) {\n281: \t\t\td.store.LogNotification(customerID, \"test\", \"info\", \"Teszt értesítés\", \"held\", \"MAIL-HOLD marker present — dropped\", \"customer\")\n282: \t\t} else if err != nil {\n", + "line": "281", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "117: \t\td.logger.Printf(\"[INFO] Operator email sent for %s/%s after retry %d\", customerID, eventType, n)\n118: \t\td.store.LogNotification(customerID, eventType, severity, message, \"sent\", fmt.Sprintf(\"after retry %d\", n), \"operator\")\n119: \t})\n", + "line": "118", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "112: \t\t\td.logger.Printf(\"[ERROR] Operator email retry %d failed for %s/%s: %v\", n, customerID, eventType, err)\n113: \t\t\td.store.LogNotification(customerID, eventType, severity, message, \"failed\", fmt.Sprintf(\"retry %d: %v\", n, err), \"operator\")\n114: \t\t\td.retryOperatorEmail(customerID, eventType, severity, message, subject, body, headers, n)\n", + "line": "113", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/notify/dispatcher.go", + "code": "108: \t\t\t\t// The hold began between tries: the mail is dropped like every other held mail, and the retries stop.\n109: \t\t\t\td.store.LogNotification(customerID, eventType, severity, message, \"held\", \"MAIL-HOLD marker present — dropped\", \"operator\")\n110: \t\t\t\treturn\n", + "line": "109", + "column": "5", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/mailrelay/relay.go", + "code": "90: \tif _, err := wc.Write(raw); err != nil {\n91: \t\twc.Close()\n92: \t\treturn fmt.Errorf(\"writing message: %w\", err)\n", + "line": "91", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/mailrelay/relay.go", + "code": "60: \tif err != nil {\n61: \t\tconn.Close()\n62: \t\treturn fmt.Errorf(\"smtp client: %w\", err)\n", + "line": "61", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/assets/assets.go", + "code": "277: \tif err := out.Close(); err != nil {\n278: \t\tos.Remove(tmp)\n279: \t\treturn err\n", + "line": "278", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/assets/assets.go", + "code": "273: \t\tout.Close()\n274: \t\tos.Remove(tmp)\n275: \t\treturn err\n", + "line": "274", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/assets/assets.go", + "code": "272: \tif _, err := io.Copy(out, in); err != nil {\n273: \t\tout.Close()\n274: \t\tos.Remove(tmp)\n", + "line": "273", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "537: \tw.Header().Set(\"Content-Type\", \"application/json\")\n538: \tjson.NewEncoder(w).Encode(map[string]interface{}{\n539: \t\t\"pubkey\": op.Pubkey, \"assigned_ip\": op.AssignedIP + \"/32\",\n540: \t})\n541: }\n", + "line": "538-540", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "513: \tw.WriteHeader(http.StatusOK)\n514: \tjson.NewEncoder(w).Encode(map[string]interface{}{\n515: \t\t\"pubkey\": req.Pubkey, \"assigned_ip\": req.AssignedIP + \"/32\", \"sync\": syncStatus, \"hosts_bumped\": bumped,\n516: \t})\n517: }\n", + "line": "514-516", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "454: \tw.Header().Set(\"Content-Type\", \"application/json\")\n455: \tjson.NewEncoder(w).Encode(map[string]interface{}{\"peers\": out})\n456: }\n", + "line": "455", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "431: \tw.WriteHeader(http.StatusOK)\n432: \tjson.NewEncoder(w).Encode(map[string]interface{}{\"status\": \"ok\", \"sync\": syncStatus})\n433: }\n", + "line": "432", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "309: \tw.WriteHeader(http.StatusOK)\n310: \tjson.NewEncoder(w).Encode(map[string]interface{}{\n311: \t\t\"pubkey\": req.Pubkey, \"assigned_ip\": ip + \"/32\", \"existed\": !changed,\n312: \t\t\"generation\": gen, \"sync\": syncStatus,\n313: \t})\n314: }\n", + "line": "310-313", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "219: \tw.WriteHeader(http.StatusOK)\n220: \tjson.NewEncoder(w).Encode(map[string]interface{}{\n221: \t\t\"pubkey\": req.Pubkey, \"assigned_ip\": ip + \"/32\", \"existed\": existed, \"sync\": syncStatus,\n222: \t})\n223: }\n", + "line": "220-222", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "169: \tw.Header().Set(\"Content-Type\", \"application/json\")\n170: \tjson.NewEncoder(w).Encode(map[string]interface{}{\n171: \t\t\"endpoint_id\": e.EndpointID, \"dns_name\": e.DNSName, \"wg_port\": e.WGPort,\n172: \t\t\"server_pubkey\": e.ServerPubkey, \"tunnel_subnet\": e.TunnelSubnet, \"pbs_tunnel_ip\": e.PBSTunnelIP,\n173: \t})\n174: }\n", + "line": "170-173", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/wg.go", + "code": "148: \tw.WriteHeader(http.StatusOK)\n149: \tw.Write([]byte(`{\"status\":\"ok\"}`))\n150: }\n", + "line": "149", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/pbsdr.go", + "code": "45: \tw.WriteHeader(http.StatusOK)\n46: \tjson.NewEncoder(w).Encode(map[string]string{\"token_secret\": secret})\n47: }\n", + "line": "46", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/mail.go", + "code": "170: \tw.WriteHeader(http.StatusOK)\n171: \tw.Write([]byte(`{\"status\":\"ok\"}`))\n172: }\n", + "line": "171", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "3004: \tw.Header().Set(\"Content-Type\", \"application/json\")\n3005: \tw.Write(data)\n3006: }\n", + "line": "3005", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2904: \tw.WriteHeader(http.StatusOK)\n2905: \tjson.NewEncoder(w).Encode(resp)\n2906: }\n", + "line": "2905", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2835: \tw.Header().Set(\"Content-Type\", \"text/yaml; charset=utf-8\")\n2836: \tw.Write([]byte(yamlOutput))\n2837: }\n", + "line": "2836", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2766: \tw.Header().Set(\"Content-Type\", \"application/json\")\n2767: \tjson.NewEncoder(w).Encode(resp)\n2768: }\n", + "line": "2767", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2689: \tw.WriteHeader(http.StatusOK)\n2690: \tw.Write([]byte(`{\"status\":\"ok\"}`))\n2691: }\n", + "line": "2690", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2622: \tw.WriteHeader(http.StatusOK)\n2623: \tw.Write([]byte(`{\"status\":\"ok\",\"sent\":true}`))\n2624: }\n", + "line": "2623", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2619: \th.logger.Printf(\"[INFO] Notification email sent to %s for %s/%s\", prefs.Email, payload.CustomerID, payload.EventType)\n2620: \th.store.LogNotification(payload.CustomerID, payload.EventType, payload.Severity, payload.Message, \"sent\", \"\", \"customer\")\n2621: \n", + "line": "2620", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2613: \t\th.logger.Printf(\"[ERROR] Failed to send notification email to %s: %v\", prefs.Email, sendErr)\n2614: \t\th.store.LogNotification(payload.CustomerID, payload.EventType, payload.Severity, payload.Message, \"failed\", sendErr.Error(), \"customer\")\n2615: \t\thttp.Error(w, \"Failed to send email\", http.StatusInternalServerError)\n", + "line": "2614", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2605: \t\tw.WriteHeader(http.StatusOK)\n2606: \t\tw.Write([]byte(`{\"status\":\"ok\",\"sent\":false,\"reason\":\"mail_hold\"}`))\n2607: \t\treturn\n", + "line": "2606", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2603: \tif err := h.mailHold.Check(\"customer event \"+payload.EventType, payload.CustomerID); err != nil {\n2604: \t\th.store.LogNotification(payload.CustomerID, payload.EventType, payload.Severity, payload.Message, \"held\", \"MAIL-HOLD marker present — dropped\", \"customer\")\n2605: \t\tw.WriteHeader(http.StatusOK)\n", + "line": "2604", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2597: \t\tw.WriteHeader(http.StatusOK)\n2598: \t\tw.Write([]byte(`{\"status\":\"ok\",\"sent\":false,\"reason\":\"no_api_key\"}`))\n2599: \t\treturn\n", + "line": "2598", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2595: \t\th.logger.Printf(\"[WARN] Resend API key not configured, cannot send notification email\")\n2596: \t\th.store.LogNotification(payload.CustomerID, payload.EventType, payload.Severity, payload.Message, \"skipped\", \"resend api key not configured\", \"customer\")\n2597: \t\tw.WriteHeader(http.StatusOK)\n", + "line": "2596", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2588: \t\tw.WriteHeader(http.StatusOK)\n2589: \t\tw.Write([]byte(`{\"status\":\"ok\",\"sent\":false,\"reason\":\"event_disabled\"}`))\n2590: \t\treturn\n", + "line": "2589", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2586: \t\th.logger.Printf(\"[INFO] Event %s not enabled for %s, skipping\", payload.EventType, payload.CustomerID)\n2587: \t\th.store.LogNotification(payload.CustomerID, payload.EventType, payload.Severity, payload.Message, \"skipped\", \"event not enabled\", \"customer\")\n2588: \t\tw.WriteHeader(http.StatusOK)\n", + "line": "2587", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2572: \t\tw.WriteHeader(http.StatusOK)\n2573: \t\tw.Write([]byte(`{\"status\":\"ok\",\"sent\":false,\"reason\":\"no_email\"}`))\n2574: \t\treturn\n", + "line": "2573", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2570: \t\th.logger.Printf(\"[INFO] No email configured for %s, skipping notification\", payload.CustomerID)\n2571: \t\th.store.LogNotification(payload.CustomerID, payload.EventType, payload.Severity, payload.Message, \"skipped\", \"no email configured\", \"customer\")\n2572: \t\tw.WriteHeader(http.StatusOK)\n", + "line": "2571", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2555: \t\tw.WriteHeader(http.StatusOK)\n2556: \t\tw.Write([]byte(`{\"status\":\"ok\",\"sent\":false,\"reason\":\"blocked\"}`))\n2557: \t\treturn\n", + "line": "2556", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2553: \t\th.logger.Printf(\"[INFO] Notification suppressed for blocked customer %s\", payload.CustomerID)\n2554: \t\th.store.LogNotification(payload.CustomerID, payload.EventType, payload.Severity, payload.Message, \"skipped\", \"customer blocked\", \"customer\")\n2555: \t\tw.WriteHeader(http.StatusOK)\n", + "line": "2554", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2513: \tw.Header().Set(\"Content-Type\", \"application/json\")\n2514: \tjson.NewEncoder(w).Encode(result)\n2515: }\n", + "line": "2514", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2473: \t// Return the full report JSON directly\n2474: \tw.Write([]byte(customer.ReportJSON))\n2475: }\n", + "line": "2474", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2456: \tw.Header().Set(\"Content-Type\", \"application/json\")\n2457: \tjson.NewEncoder(w).Encode(result)\n2458: }\n", + "line": "2457", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2413: \tw.WriteHeader(http.StatusOK)\n2414: \tw.Write([]byte(`{\"ok\":true}`))\n2415: }\n", + "line": "2414", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2104: \tw.WriteHeader(http.StatusOK)\n2105: \tjson.NewEncoder(w).Encode(resp)\n2106: }\n", + "line": "2105", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "2044: \tw.WriteHeader(http.StatusCreated)\n2045: \tjson.NewEncoder(w).Encode(map[string]interface{}{\"status\": \"ok\", \"job_id\": req.JobID})\n2046: }\n", + "line": "2045", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1993: \tw.WriteHeader(http.StatusOK)\n1994: \tjson.NewEncoder(w).Encode(map[string]interface{}{\"status\": \"ok\", \"generation\": gen})\n1995: }\n", + "line": "1994", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1939: \tw.WriteHeader(http.StatusOK)\n1940: \tw.Write([]byte(`{\"status\":\"ok\"}`))\n1941: }\n", + "line": "1940", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1912: \tw.WriteHeader(http.StatusOK)\n1913: \tjson.NewEncoder(w).Encode(map[string]interface{}{\"jobs\": out})\n1914: }\n", + "line": "1913", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1876: \tw.WriteHeader(http.StatusOK)\n1877: \tjson.NewEncoder(w).Encode(resp)\n1878: }\n", + "line": "1877", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1831: \tw.WriteHeader(http.StatusOK)\n1832: \tw.Write(resp)\n1833: }\n", + "line": "1832", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1795: \tw.WriteHeader(http.StatusOK)\n1796: \tw.Write([]byte(`{\"status\":\"ok\"}`))\n1797: }\n", + "line": "1796", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1353: \tw.WriteHeader(http.StatusOK)\n1354: \tw.Write([]byte(`{\"status\":\"ok\"}`))\n1355: }\n", + "line": "1354", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1212: \tw.WriteHeader(http.StatusCreated)\n1213: \tjson.NewEncoder(w).Encode(map[string]string{\"host_id\": hostID, \"api_key\": apiKey})\n1214: }\n", + "line": "1213", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1178: \t\tw.WriteHeader(http.StatusOK)\n1179: \t\tjson.NewEncoder(w).Encode(map[string]string{\"host_id\": existing.HostID, \"api_key\": existing.APIKey})\n1180: \t\treturn\n", + "line": "1179", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1108: \tw.WriteHeader(http.StatusCreated)\n1109: \tjson.NewEncoder(w).Encode(map[string]string{\"host_id\": hostID, \"api_key\": apiKey})\n1110: }\n", + "line": "1109", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "1047: \tw.WriteHeader(http.StatusOK)\n1048: \tjson.NewEncoder(w).Encode(resp)\n1049: }\n", + "line": "1048", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/handler.go", + "code": "674: \tw.WriteHeader(http.StatusOK)\n675: \tjson.NewEncoder(w).Encode(resp)\n676: }\n", + "line": "675", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/dr.go", + "code": "143: \tw.WriteHeader(http.StatusOK)\n144: \tjson.NewEncoder(w).Encode(map[string]any{\n145: \t\t\"host_id\": hostID, \"api_key_rotated\": true, \"new_api_key\": req.NewAPIKey,\n146: \t\t\"directive\": resp.Directive, \"k_escrow_b64\": resp.KEscrowB64, \"identity_escrow_b64\": resp.IdentityEscrowB64,\n147: \t})\n148: }\n", + "line": "144-147", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/dr.go", + "code": "46: \t}\n47: \tjson.Unmarshal(body, \u0026req)\n48: \tttl := defaultRecoveryTTL\n", + "line": "47", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/dr.go", + "code": "27: \tw.WriteHeader(code)\n28: \tjson.NewEncoder(w).Encode(v)\n29: }\n", + "line": "28", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/appliance.go", + "code": "227: \t\tw.WriteHeader(http.StatusOK)\n228: \t\tjson.NewEncoder(w).Encode(map[string]string{\n229: \t\t\t\"customer_id\": appl.CustomerID,\n230: \t\t\t\"retrieval_passphrase\": cc.RetrievalPassword,\n231: \t\t\t\"mode\": mode,\n232: \t\t\t\"extra_args\": appl.ExtraArgs,\n233: \t\t})\n234: \t\treturn\n", + "line": "228-233", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/internal/api/appliance.go", + "code": "164: \t// pairing_code is additive — a pre-v0.66.0 bootstrap ignores it and stays operator-bind-only.\n165: \tjson.NewEncoder(w).Encode(map[string]any{\n166: \t\t\"appliance_token\": token, \"poll_interval_sec\": 30, \"pairing_code\": configgen.FormatPairingCode(pairingCode),\n167: \t})\n168: }\n", + "line": "165-167", + "column": "2", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "635: \t\tw.WriteHeader(http.StatusOK)\n636: \t\tw.Write([]byte(\"ok\"))\n637: \t})\n", + "line": "636", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "631: \t\t\tw.WriteHeader(http.StatusServiceUnavailable)\n632: \t\t\tw.Write([]byte(\"db unhealthy\"))\n633: \t\t\treturn\n", + "line": "632", + "column": "4", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "196: \t\tcode := runUnsealBoxSecrets(dataStore, logger)\n197: \t\tdataStore.Close()\n198: \t\tos.Exit(code)\n", + "line": "197", + "column": "3", + "nosec": false, + "suppressions": null + }, + { + "severity": "LOW", + "confidence": "HIGH", + "cwe": { + "id": "703", + "url": "https://cwe.mitre.org/data/definitions/703.html" + }, + "rule_id": "G104", + "details": "Errors unhandled", + "file": "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/085d2786-7d5e-4cd5-ac2c-855c3c72d3e1/scratchpad/src/felhom.eu/hub/cmd/hub/main.go", + "code": "180: \t// Ensure data dir exists\n181: \tos.MkdirAll(cfg.Server.DataDir, 0755)\n182: \n", + "line": "181", + "column": "2", + "nosec": false, + "suppressions": null + } + ], + "Stats": { + "files": 112, + "lines": 38224, + "nosec": 0, + "found": 215 + }, + "GosecVersion": "dev" +} \ No newline at end of file diff --git a/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-agent-0.154.0.txt b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-agent-0.154.0.txt new file mode 100644 index 00000000..b0999439 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-agent-0.154.0.txt @@ -0,0 +1,327 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-6617 + HTTP/2 server crash due to HPACK encoder race in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6617 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.Client.Do + #4: http.Client.Do + #5: http.Cookie.String + Use '-show traces' to see the other 267 found symbols + +Vulnerability #2: GO-2026-6613 + HTTP/1 server connection desynchronization after 2xx CONNECT response in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6613 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.Client.Do + #3: http.Cookie.String + #4: http.Error + #5: http.HandlerFunc.ServeHTTP + Use '-show traces' to see the other 66 found symbols + +Vulnerability #3: GO-2026-6612 + Double flow control refund on HTTP/2 server streams in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6612 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.Client.Do + #4: http.Client.Do + #5: http.Cookie.String + Use '-show traces' to see the other 267 found symbols + +Vulnerability #4: GO-2026-6611 + Excessive CPU consumption from repeated initial window changes in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6611 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.Client.Do + #4: http.Client.Do + #5: http.Cookie.String + Use '-show traces' to see the other 271 found symbols + +Vulnerability #5: GO-2026-6610 + HTTP/2 transport accepts malformed framing-related headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6610 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.Client.Do + #2: http.Client.Do + #3: http.Transport.RoundTrip + #4: http.Transport.RoundTrip + #5: http.http2Transport.NewClientConn + Use '-show traces' to see the other 15 found symbols + +Vulnerability #6: GO-2026-6608 + Memory limit bypass when parsing MIME headers in net/textproto, + mime/multipart + More info: https://pkg.go.dev/vuln/GO-2026-6608 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.9 + Vulnerable symbols found: + #1: textproto.Reader.ReadMIMEHeader + +Vulnerability #7: GO-2026-6607 + Reject malformed ECH outer extension references in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6607 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.9 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.HandshakeContext + #3: tls.Conn.Read + #4: tls.Conn.Write + #5: tls.Dialer.DialContext + +Vulnerability #8: GO-2026-6605 + HTTP/1 client connection desynchronization after CONNECT rejection in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6605 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.Client.Do + #2: http.Transport.RoundTrip + +Vulnerability #9: GO-2026-6603 + HTTP/2 server memory exhaustion due to Trailer headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6603 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.Client.Do + #4: http.Client.Do + #5: http.Cookie.String + Use '-show traces' to see the other 267 found symbols + +Vulnerability #10: GO-2026-6218 + Avoid quadratic complexity in resolvePath in net/url + More info: https://pkg.go.dev/vuln/GO-2026-6218 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.6 + Vulnerable symbols found: + #1: url.URL.Parse + #2: url.URL.ResolveReference + +Vulnerability #11: GO-2026-6090 + Limit handshake messages we are willing to accept post-handshake in + crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6090 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.6 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.HandshakeContext + #3: tls.Conn.Read + #4: tls.Conn.Write + #5: tls.Dialer.DialContext + +Vulnerability #12: GO-2026-6089 + Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6089 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Vulnerable symbols found: + #1: http.Server.Serve + #2: http.Server.ServeTLS + +Vulnerability #13: GO-2026-5972 + Enforce maximum recursion depth in encoding/asn1 + More info: https://pkg.go.dev/vuln/GO-2026-5972 + Standard library + Found in: encoding/asn1@go1.26 + Fixed in: encoding/asn1@go1.26.6 + Vulnerable symbols found: + #1: asn1.Unmarshal + #2: asn1.UnmarshalWithParams + +Vulnerability #14: GO-2026-5856 + Invoking Encrypted Client Hello privacy leak in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-5856 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.5 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.HandshakeContext + #3: tls.Conn.Read + #4: tls.Conn.Write + #5: tls.Dialer.DialContext + +Vulnerability #15: GO-2026-5039 + Arbitrary inputs are included in errors without any escaping in + net/textproto + More info: https://pkg.go.dev/vuln/GO-2026-5039 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.4 + Vulnerable symbols found: + #1: textproto.Reader.ReadMIMEHeader + +Vulnerability #16: GO-2026-5037 + Inefficient candidate hostname parsing in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-5037 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.4 + Vulnerable symbols found: + #1: x509.Certificate.Verify + #2: x509.Certificate.VerifyHostname + #3: x509.HostnameError.Error + +Vulnerability #17: GO-2026-5026 + Invoking failure to reject ASCII-only Punycode-encoded labels in + golang.org/x/net/idna + More info: https://pkg.go.dev/vuln/GO-2026-5026 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Vulnerable symbols found: + #1: http.Client.Do + #2: http.Transport.RoundTrip + #3: http.http2ClientConn.RoundTrip + +Vulnerability #18: GO-2026-4971 + Panic in Dial and LookupPort when handling NUL byte on Windows in net + More info: https://pkg.go.dev/vuln/GO-2026-4971 + Standard library + Found in: net@go1.26 + Fixed in: net@go1.26.3 + Vulnerable symbols found: + #1: net.DialTimeout + #2: net.Dialer.Dial + #3: net.Dialer.DialContext + #4: net.Listen + #5: net.ListenConfig.Listen + Use '-show traces' to see the other 4 found symbols + +Vulnerability #19: GO-2026-4947 + Unexpected work during chain building in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4947 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Vulnerable symbols found: + #1: x509.Certificate.Verify + +Vulnerability #20: GO-2026-4946 + Inefficient policy validation in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4946 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Vulnerable symbols found: + #1: x509.Certificate.Verify + +Vulnerability #21: GO-2026-4918 + Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in + net/http/internal/http2 in golang.org/x/net + More info: https://pkg.go.dev/vuln/GO-2026-4918 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.3 + Vulnerable symbols found: + #1: http.Client.Do + #2: http.Transport.RoundTrip + #3: http.http2Transport.NewClientConn + #4: http.http2Transport.RoundTrip + #5: http.http2Transport.RoundTripOpt + Use '-show traces' to see the other 5 found symbols + +Vulnerability #22: GO-2026-4870 + Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection + retention and DoS in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-4870 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.2 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.HandshakeContext + #3: tls.Conn.Read + #4: tls.Conn.Write + #5: tls.Dialer.DialContext + +Vulnerability #23: GO-2026-4866 + Case-sensitive excludedSubtrees name constraints cause Auth Bypass in + crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4866 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Vulnerable symbols found: + #1: x509.Certificate.Verify + +Vulnerability #24: GO-2026-4602 + FileInfo can escape from a Root in os + More info: https://pkg.go.dev/vuln/GO-2026-4602 + Standard library + Found in: os@go1.26 + Fixed in: os@go1.26.1 + Vulnerable symbols found: + #1: os.File.ReadDir + #2: os.ReadDir + +Vulnerability #25: GO-2026-4601 + Incorrect parsing of IPv6 host literals in net/url + More info: https://pkg.go.dev/vuln/GO-2026-4601 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.1 + Vulnerable symbols found: + #1: url.Parse + #2: url.ParseRequestURI + #3: url.URL.Parse + #4: url.URL.UnmarshalBinary + +Vulnerability #26: GO-2026-4600 + Panic in name constraint checking for malformed certificates in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4600 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Vulnerable symbols found: + #1: x509.Certificate.Verify + +Vulnerability #27: GO-2026-4599 + Incorrect enforcement of email constraints in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4599 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Vulnerable symbols found: + #1: x509.Certificate.Verify + +Your code is affected by 27 vulnerabilities from the Go standard library. +This scan also found 9 vulnerabilities in packages you import and 13 +vulnerabilities in modules you require, but your code doesn't appear to call +these vulnerabilities. +Use '-show verbose' for more details. diff --git a/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-controller-0.307.0.txt b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-controller-0.307.0.txt new file mode 100644 index 00000000..ce3c4bfa --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-controller-0.307.0.txt @@ -0,0 +1,840 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-6617 + HTTP/2 server crash due to HPACK encoder race in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6617 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 3999 found symbols + +Vulnerability #2: GO-2026-6613 + HTTP/1 server connection desynchronization after 2xx CONNECT response in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6613 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 1388 found symbols + +Vulnerability #3: GO-2026-6612 + Double flow control refund on HTTP/2 server streams in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6612 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 3999 found symbols + +Vulnerability #4: GO-2026-6611 + Excessive CPU consumption from repeated initial window changes in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6611 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 4019 found symbols + +Vulnerability #5: GO-2026-6610 + HTTP/2 transport accepts malformed framing-related headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6610 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 647 found symbols + +Vulnerability #6: GO-2026-6609 + Lack of limit on size of parsed Range headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6609 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.ServeContent + #2: http.ServeContent + #3: http.ServeContent + #4: http.ServeContent + #5: http.ServeContent + Use '-show traces' to see the other 45 found symbols + +Vulnerability #7: GO-2026-6608 + Memory limit bypass when parsing MIME headers in net/textproto, + mime/multipart + More info: https://pkg.go.dev/vuln/GO-2026-6608 + Standard library + Found in: mime/multipart@go1.24.13 + Fixed in: mime/multipart@go1.26.9 + Vulnerable symbols found: + #1: multipart.Reader.NextPart + #2: multipart.Reader.NextRawPart + #3: multipart.Reader.ReadForm + #4: textproto.Reader.ReadContinuedLine + #5: textproto.Reader.ReadContinuedLineBytes + Use '-show traces' to see the other 2 found symbols + +Vulnerability #8: GO-2026-6607 + Reject malformed ECH outer extension references in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6607 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.26.9 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 31 found symbols + +Vulnerability #9: GO-2026-6605 + HTTP/1 client connection desynchronization after CONNECT rejection in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6605 + Standard library + Found in: net/http/httputil@go1.24.13 + Fixed in: net/http/httputil@go1.26.9 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 236 found symbols + +Vulnerability #10: GO-2026-6603 + HTTP/2 server memory exhaustion due to Trailer headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6603 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 3999 found symbols + +Vulnerability #11: GO-2026-6600 + Recognize yield as regexp preceder keyword in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6600 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.26.9 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #12: GO-2026-6599 + Reset context tracking on consecutive template expressions in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6599 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.26.9 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #13: GO-2026-6355 + Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6355 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 25 found symbols + +Vulnerability #14: GO-2026-6354 + Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6354 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 27 found symbols + +Vulnerability #15: GO-2026-6303 + Source-address critical option not enforced for non-public-key auth + callbacks in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6303 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.55.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #16: GO-2026-6218 + Avoid quadratic complexity in resolvePath in net/url + More info: https://pkg.go.dev/vuln/GO-2026-6218 + Standard library + Found in: net/url@go1.24.13 + Fixed in: net/url@go1.25.13 + Vulnerable symbols found: + #1: url.URL.Parse + #2: url.URL.Parse + #3: url.URL.ResolveReference + +Vulnerability #17: GO-2026-6091 + Fix Javascript regexp context tracking in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6091 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.13 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #18: GO-2026-6090 + Limit handshake messages we are willing to accept post-handshake in + crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6090 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.25.13 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 34 found symbols + +Vulnerability #19: GO-2026-6089 + Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6089 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.25.13 + Vulnerable symbols found: + #1: http.ListenAndServe + #2: http.ListenAndServe + #3: http.ListenAndServe + #4: http.ListenAndServe + #5: http.ListenAndServe + Use '-show traces' to see the other 75 found symbols + +Vulnerability #20: GO-2026-6088 + Add recursion depth guard during decode in encoding/xml + More info: https://pkg.go.dev/vuln/GO-2026-6088 + Standard library + Found in: encoding/xml@go1.24.13 + Fixed in: encoding/xml@go1.25.13 + Vulnerable symbols found: + #1: xml.Decoder.Decode + #2: xml.Decoder.DecodeElement + #3: xml.Decoder.RawToken + #4: xml.Decoder.Skip + #5: xml.Decoder.Token + Use '-show traces' to see the other 1 found symbols + +Vulnerability #21: GO-2026-5972 + Enforce maximum recursion depth in encoding/asn1 + More info: https://pkg.go.dev/vuln/GO-2026-5972 + Standard library + Found in: encoding/asn1@go1.24.13 + Fixed in: encoding/asn1@go1.25.13 + Vulnerable symbols found: + #1: asn1.Unmarshal + #2: asn1.UnmarshalWithParams + +Vulnerability #22: GO-2026-5932 + The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, + and has known security issues + More info: https://pkg.go.dev/vuln/GO-2026-5932 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: N/A + Vulnerable symbols found: + #1: armor.golang.org/x/crypto/openpgp/armor/* + #2: clearsign.golang.org/x/crypto/openpgp/clearsign/* + #3: elgamal.golang.org/x/crypto/openpgp/elgamal/* + #4: errors.golang.org/x/crypto/openpgp/errors/* + #5: openpgp.golang.org/x/crypto/openpgp/* + Use '-show traces' to see the other 2 found symbols + +Vulnerability #23: GO-2026-5856 + Invoking Encrypted Client Hello privacy leak in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-5856 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.25.12 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 35 found symbols + +Vulnerability #24: GO-2026-5039 + Arbitrary inputs are included in errors without any escaping in + net/textproto + More info: https://pkg.go.dev/vuln/GO-2026-5039 + Standard library + Found in: net/textproto@go1.24.13 + Fixed in: net/textproto@go1.25.11 + Vulnerable symbols found: + #1: textproto.Error.Error + #2: textproto.Reader.ReadCodeLine + #3: textproto.Reader.ReadMIMEHeader + #4: textproto.Reader.ReadMIMEHeader + #5: textproto.Reader.ReadResponse + +Vulnerability #25: GO-2026-5038 + Quadratic complexity in WordDecoder.DecodeHeader in mime + More info: https://pkg.go.dev/vuln/GO-2026-5038 + Standard library + Found in: mime@go1.24.13 + Fixed in: mime@go1.25.11 + Vulnerable symbols found: + #1: mime.WordDecoder.DecodeHeader + +Vulnerability #26: GO-2026-5037 + Inefficient candidate hostname parsing in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-5037 + Standard library + Found in: crypto/x509@go1.24.13 + Fixed in: crypto/x509@go1.25.11 + Vulnerable symbols found: + #1: x509.Certificate.Verify + #2: x509.Certificate.Verify + #3: x509.Certificate.Verify + #4: x509.Certificate.VerifyHostname + #5: x509.HostnameError.Error + +Vulnerability #27: GO-2026-5033 + Invoking pathological inputs can lead to client panic in + golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2026-5033 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: agent.ForwardToAgent + #2: agent.ForwardToAgent + #3: agent.ServeAgent + #4: agent.ServeAgent + +Vulnerability #28: GO-2026-5026 + Invoking failure to reject ASCII-only Punycode-encoded labels in + golang.org/x/net/idna + More info: https://pkg.go.dev/vuln/GO-2026-5026 + Standard library + Found in: net/http/internal/http2@go1.24.13 + Fixed in: net/http/internal/http2@go1.25.13 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 248 found symbols + +Vulnerability #29: GO-2026-5023 + Invoking VerifiedPublicKeyCallback permissions skip enforcement in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5023 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #30: GO-2026-5021 + Invoking auth bypass via unenforced @revoked status in + golang.org/x/crypto/ssh/knownhosts + More info: https://pkg.go.dev/vuln/GO-2026-5021 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: knownhosts.hostKeyDB.IsRevoked + +Vulnerability #31: GO-2026-5020 + Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5020 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 72 found symbols + +Vulnerability #32: GO-2026-5019 + Invoking bypass of FIDO/U2F security keys physical interaction in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5019 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.CertChecker.Authenticate + #2: ssh.CertChecker.Authenticate + #3: ssh.CertChecker.CheckCert + #4: ssh.CertChecker.CheckHostKey + #5: ssh.CertChecker.CheckHostKey + Use '-show traces' to see the other 31 found symbols + +Vulnerability #33: GO-2026-5018 + Invoking pathological RSA/DSA parameters may cause DoS in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5018 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 31 found symbols + +Vulnerability #34: GO-2026-5017 + Invoking client can cause server deadlock on unexpected responses in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5017 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Client.Listen + #2: ssh.Client.Listen + #3: ssh.Client.ListenTCP + #4: ssh.Client.ListenTCP + #5: ssh.Client.ListenUnix + Use '-show traces' to see the other 64 found symbols + +Vulnerability #35: GO-2026-5016 + Invoking memory leak when rejecting channels can lead to DoS in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5016 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.channel.Reject + #2: ssh.channel.Reject + +Vulnerability #36: GO-2026-5015 + Invoking server panic during CheckHostKey/Authenticate in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5015 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.CertChecker.Authenticate + #2: ssh.CertChecker.Authenticate + #3: ssh.CertChecker.CheckHostKey + #4: ssh.CertChecker.CheckHostKey + +Vulnerability #37: GO-2026-5014 + Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5014 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #38: GO-2026-5013 + Invoking byte arithmetic causes underflow and panic in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5013 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 51 found symbols + +Vulnerability #39: GO-2026-5006 + Invoking agent constraints dropped when forwarding keys in + golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2026-5006 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: agent.client.Add + #2: agent.keyring.Add + #3: agent.keyring.Add + +Vulnerability #40: GO-2026-5005 + Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2026-5005 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: agent.keyring.Add + #2: agent.keyring.Add + +Vulnerability #41: GO-2026-4986 + Quadratic string concatentation in consumeComment in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4986 + Standard library + Found in: net/mail@go1.24.13 + Fixed in: net/mail@go1.25.10 + Vulnerable symbols found: + #1: mail.AddressParser.Parse + #2: mail.AddressParser.Parse + #3: mail.AddressParser.ParseList + #4: mail.AddressParser.ParseList + #5: mail.Header.AddressList + Use '-show traces' to see the other 7 found symbols + +Vulnerability #42: GO-2026-4982 + Bypass of meta content URL escaping causes XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4982 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.10 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #43: GO-2026-4981 + Crash when handling long CNAME response in net + More info: https://pkg.go.dev/vuln/GO-2026-4981 + Standard library + Found in: net@go1.24.13 + Fixed in: net@go1.25.10 + Vulnerable symbols found: + #1: net.LookupCNAME + #2: net.LookupCNAME + #3: net.Resolver.LookupCNAME + #4: net.Resolver.LookupCNAME + +Vulnerability #44: GO-2026-4980 + Escaper bypass leads to XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4980 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.10 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #45: GO-2026-4977 + Quadratic string concatenation in consumePhrase in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4977 + Standard library + Found in: net/mail@go1.24.13 + Fixed in: net/mail@go1.25.10 + Vulnerable symbols found: + #1: mail.AddressParser.Parse + #2: mail.AddressParser.Parse + #3: mail.AddressParser.ParseList + #4: mail.AddressParser.ParseList + #5: mail.Header.AddressList + Use '-show traces' to see the other 5 found symbols + +Vulnerability #46: GO-2026-4976 + ReverseProxy forwards queries with more than urlmaxqueryparams parameters in + net/http/httputil + More info: https://pkg.go.dev/vuln/GO-2026-4976 + Standard library + Found in: net/http/httputil@go1.24.13 + Fixed in: net/http/httputil@go1.25.10 + Vulnerable symbols found: + #1: httputil.ReverseProxy.ServeHTTP + #2: httputil.ReverseProxy.ServeHTTP + +Vulnerability #47: GO-2026-4971 + Panic in Dial and LookupPort when handling NUL byte on Windows in net + More info: https://pkg.go.dev/vuln/GO-2026-4971 + Standard library + Found in: net@go1.24.13 + Fixed in: net@go1.25.10 + Vulnerable symbols found: + #1: net.Dial + #2: net.DialTimeout + #3: net.Dialer.Dial + #4: net.Dialer.DialContext + #5: net.Listen + Use '-show traces' to see the other 28 found symbols + +Vulnerability #48: GO-2026-4970 + Root escape via symlink plus trailing slash in os + More info: https://pkg.go.dev/vuln/GO-2026-4970 + Standard library + Found in: os@go1.24.13 + Fixed in: os@go1.25.12 + Vulnerable symbols found: + #1: os.OpenInRoot + #2: os.Root.Create + #3: os.Root.Open + #4: os.Root.OpenFile + #5: os.Root.OpenRoot + Use '-show traces' to see the other 6 found symbols + +Vulnerability #49: GO-2026-4947 + Unexpected work during chain building in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4947 + Standard library + Found in: crypto/x509@go1.24.13 + Fixed in: crypto/x509@go1.25.9 + Vulnerable symbols found: + #1: x509.Certificate.Verify + #2: x509.Certificate.Verify + #3: x509.Certificate.Verify + +Vulnerability #50: GO-2026-4946 + Inefficient policy validation in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4946 + Standard library + Found in: crypto/x509@go1.24.13 + Fixed in: crypto/x509@go1.25.9 + Vulnerable symbols found: + #1: x509.Certificate.Verify + #2: x509.Certificate.Verify + #3: x509.Certificate.Verify + +Vulnerability #51: GO-2026-4918 + Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in + net/http/internal/http2 in golang.org/x/net + More info: https://pkg.go.dev/vuln/GO-2026-4918 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.25.10 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 321 found symbols + +Vulnerability #52: GO-2026-4870 + Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection + retention and DoS in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-4870 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.25.9 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 34 found symbols + +Vulnerability #53: GO-2026-4869 + Unbounded allocation for old GNU sparse in archive/tar + More info: https://pkg.go.dev/vuln/GO-2026-4869 + Standard library + Found in: archive/tar@go1.24.13 + Fixed in: archive/tar@go1.25.9 + Vulnerable symbols found: + #1: tar.Reader.Next + +Vulnerability #54: GO-2026-4865 + JsBraceDepth Context Tracking Bugs (XSS) in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4865 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.9 + Vulnerable symbols found: + #1: template.Error.Error + #2: template.HTMLEscaper + #3: template.JSEscape + #4: template.JSEscapeString + #5: template.JSEscaper + Use '-show traces' to see the other 27 found symbols + +Vulnerability #55: GO-2026-4864 + TOCTOU permits root escape on Linux via Root.Chmod in os in + internal/syscall/unix + More info: https://pkg.go.dev/vuln/GO-2026-4864 + Standard library + Found in: internal/syscall/unix@go1.24.13 + Fixed in: internal/syscall/unix@go1.25.9 + Platforms: linux + Vulnerable symbols found: + #1: unix.Fchmodat + +Vulnerability #56: GO-2026-4603 + URLs in meta content attribute actions are not escaped in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4603 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.8 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #57: GO-2026-4602 + FileInfo can escape from a Root in os + More info: https://pkg.go.dev/vuln/GO-2026-4602 + Standard library + Found in: os@go1.24.13 + Fixed in: os@go1.25.8 + Vulnerable symbols found: + #1: os.File.ReadDir + #2: os.File.Readdir + #3: os.ReadDir + #4: os.dirFS.ReadDir + #5: os.rootFS.ReadDir + Use '-show traces' to see the other 1 found symbols + +Vulnerability #58: GO-2026-4601 + Incorrect parsing of IPv6 host literals in net/url + More info: https://pkg.go.dev/vuln/GO-2026-4601 + Standard library + Found in: net/url@go1.24.13 + Fixed in: net/url@go1.25.8 + Vulnerable symbols found: + #1: url.JoinPath + #2: url.Parse + #3: url.ParseRequestURI + #4: url.URL.Parse + #5: url.URL.Parse + Use '-show traces' to see the other 1 found symbols + +Vulnerability #59: GO-2025-4135 + Malformed constraint may cause denial of service in + golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2025-4135 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.45.0 + Vulnerable symbols found: + #1: agent.ForwardToAgent + #2: agent.ForwardToAgent + #3: agent.ServeAgent + #4: agent.ServeAgent + +Vulnerability #60: GO-2025-4134 + Unbounded memory consumption in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2025-4134 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.45.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #61: GO-2025-4116 + Potential denial of service in golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2025-4116 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.43.0 + Vulnerable symbols found: + #1: agent.agentKeyringSigner.Sign + #2: agent.agentKeyringSigner.SignWithAlgorithm + #3: agent.client.List + #4: agent.client.Sign + #5: agent.client.SignWithFlags + Use '-show traces' to see the other 1 found symbols + +Vulnerability #62: GO-2025-3487 + Potential denial of service in golang.org/x/crypto + More info: https://pkg.go.dev/vuln/GO-2025-3487 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.35.0 + Vulnerable symbols found: + #1: ssh.Client.Dial + #2: ssh.Client.DialContext + #3: ssh.Client.DialTCP + #4: ssh.Client.Listen + #5: ssh.Client.Listen + Use '-show traces' to see the other 117 found symbols + +Your code is affected by 62 vulnerabilities from 1 module and the Go standard library. +This scan found no other vulnerabilities in packages you import or modules you +require. +Use '-show verbose' for more details. diff --git a/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-hub-0.146.0.txt b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-hub-0.146.0.txt new file mode 100644 index 00000000..86cacdb6 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-binary-felhom-hub-0.146.0.txt @@ -0,0 +1,840 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-6617 + HTTP/2 server crash due to HPACK encoder race in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6617 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 3999 found symbols + +Vulnerability #2: GO-2026-6613 + HTTP/1 server connection desynchronization after 2xx CONNECT response in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6613 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 1388 found symbols + +Vulnerability #3: GO-2026-6612 + Double flow control refund on HTTP/2 server streams in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6612 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 3999 found symbols + +Vulnerability #4: GO-2026-6611 + Excessive CPU consumption from repeated initial window changes in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6611 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 4019 found symbols + +Vulnerability #5: GO-2026-6610 + HTTP/2 transport accepts malformed framing-related headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6610 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 647 found symbols + +Vulnerability #6: GO-2026-6609 + Lack of limit on size of parsed Range headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6609 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.ServeContent + #2: http.ServeContent + #3: http.ServeContent + #4: http.ServeContent + #5: http.ServeContent + Use '-show traces' to see the other 45 found symbols + +Vulnerability #7: GO-2026-6608 + Memory limit bypass when parsing MIME headers in net/textproto, + mime/multipart + More info: https://pkg.go.dev/vuln/GO-2026-6608 + Standard library + Found in: net/textproto@go1.24.13 + Fixed in: net/textproto@go1.26.9 + Vulnerable symbols found: + #1: multipart.Reader.NextPart + #2: multipart.Reader.NextRawPart + #3: multipart.Reader.ReadForm + #4: textproto.Reader.ReadContinuedLine + #5: textproto.Reader.ReadContinuedLineBytes + Use '-show traces' to see the other 2 found symbols + +Vulnerability #8: GO-2026-6607 + Reject malformed ECH outer extension references in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6607 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.26.9 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 31 found symbols + +Vulnerability #9: GO-2026-6605 + HTTP/1 client connection desynchronization after CONNECT rejection in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6605 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 236 found symbols + +Vulnerability #10: GO-2026-6603 + HTTP/2 server memory exhaustion due to Trailer headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6603 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.26.9 + Vulnerable symbols found: + #1: http.CanonicalHeaderKey + #2: http.CanonicalHeaderKey + #3: http.CanonicalHeaderKey + #4: http.CanonicalHeaderKey + #5: http.CanonicalHeaderKey + Use '-show traces' to see the other 3999 found symbols + +Vulnerability #11: GO-2026-6600 + Recognize yield as regexp preceder keyword in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6600 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.26.9 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #12: GO-2026-6599 + Reset context tracking on consecutive template expressions in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6599 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.26.9 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #13: GO-2026-6355 + Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6355 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 25 found symbols + +Vulnerability #14: GO-2026-6354 + Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6354 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 27 found symbols + +Vulnerability #15: GO-2026-6303 + Source-address critical option not enforced for non-public-key auth + callbacks in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6303 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.55.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #16: GO-2026-6218 + Avoid quadratic complexity in resolvePath in net/url + More info: https://pkg.go.dev/vuln/GO-2026-6218 + Standard library + Found in: net/url@go1.24.13 + Fixed in: net/url@go1.25.13 + Vulnerable symbols found: + #1: url.URL.Parse + #2: url.URL.Parse + #3: url.URL.ResolveReference + +Vulnerability #17: GO-2026-6091 + Fix Javascript regexp context tracking in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6091 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.13 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #18: GO-2026-6090 + Limit handshake messages we are willing to accept post-handshake in + crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6090 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.25.13 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 34 found symbols + +Vulnerability #19: GO-2026-6089 + Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6089 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.25.13 + Vulnerable symbols found: + #1: http.ListenAndServe + #2: http.ListenAndServe + #3: http.ListenAndServe + #4: http.ListenAndServe + #5: http.ListenAndServe + Use '-show traces' to see the other 75 found symbols + +Vulnerability #20: GO-2026-6088 + Add recursion depth guard during decode in encoding/xml + More info: https://pkg.go.dev/vuln/GO-2026-6088 + Standard library + Found in: encoding/xml@go1.24.13 + Fixed in: encoding/xml@go1.25.13 + Vulnerable symbols found: + #1: xml.Decoder.Decode + #2: xml.Decoder.DecodeElement + #3: xml.Decoder.RawToken + #4: xml.Decoder.Skip + #5: xml.Decoder.Token + Use '-show traces' to see the other 1 found symbols + +Vulnerability #21: GO-2026-5972 + Enforce maximum recursion depth in encoding/asn1 + More info: https://pkg.go.dev/vuln/GO-2026-5972 + Standard library + Found in: encoding/asn1@go1.24.13 + Fixed in: encoding/asn1@go1.25.13 + Vulnerable symbols found: + #1: asn1.Unmarshal + #2: asn1.UnmarshalWithParams + +Vulnerability #22: GO-2026-5932 + The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, + and has known security issues + More info: https://pkg.go.dev/vuln/GO-2026-5932 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: N/A + Vulnerable symbols found: + #1: armor.golang.org/x/crypto/openpgp/armor/* + #2: clearsign.golang.org/x/crypto/openpgp/clearsign/* + #3: elgamal.golang.org/x/crypto/openpgp/elgamal/* + #4: errors.golang.org/x/crypto/openpgp/errors/* + #5: openpgp.golang.org/x/crypto/openpgp/* + Use '-show traces' to see the other 2 found symbols + +Vulnerability #23: GO-2026-5856 + Invoking Encrypted Client Hello privacy leak in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-5856 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.25.12 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 35 found symbols + +Vulnerability #24: GO-2026-5039 + Arbitrary inputs are included in errors without any escaping in + net/textproto + More info: https://pkg.go.dev/vuln/GO-2026-5039 + Standard library + Found in: net/textproto@go1.24.13 + Fixed in: net/textproto@go1.25.11 + Vulnerable symbols found: + #1: textproto.Error.Error + #2: textproto.Reader.ReadCodeLine + #3: textproto.Reader.ReadMIMEHeader + #4: textproto.Reader.ReadMIMEHeader + #5: textproto.Reader.ReadResponse + +Vulnerability #25: GO-2026-5038 + Quadratic complexity in WordDecoder.DecodeHeader in mime + More info: https://pkg.go.dev/vuln/GO-2026-5038 + Standard library + Found in: mime@go1.24.13 + Fixed in: mime@go1.25.11 + Vulnerable symbols found: + #1: mime.WordDecoder.DecodeHeader + +Vulnerability #26: GO-2026-5037 + Inefficient candidate hostname parsing in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-5037 + Standard library + Found in: crypto/x509@go1.24.13 + Fixed in: crypto/x509@go1.25.11 + Vulnerable symbols found: + #1: x509.Certificate.Verify + #2: x509.Certificate.Verify + #3: x509.Certificate.Verify + #4: x509.Certificate.VerifyHostname + #5: x509.HostnameError.Error + +Vulnerability #27: GO-2026-5033 + Invoking pathological inputs can lead to client panic in + golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2026-5033 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: agent.ForwardToAgent + #2: agent.ForwardToAgent + #3: agent.ServeAgent + #4: agent.ServeAgent + +Vulnerability #28: GO-2026-5026 + Invoking failure to reject ASCII-only Punycode-encoded labels in + golang.org/x/net/idna + More info: https://pkg.go.dev/vuln/GO-2026-5026 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.25.13 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 248 found symbols + +Vulnerability #29: GO-2026-5023 + Invoking VerifiedPublicKeyCallback permissions skip enforcement in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5023 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #30: GO-2026-5021 + Invoking auth bypass via unenforced @revoked status in + golang.org/x/crypto/ssh/knownhosts + More info: https://pkg.go.dev/vuln/GO-2026-5021 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: knownhosts.hostKeyDB.IsRevoked + +Vulnerability #31: GO-2026-5020 + Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5020 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 72 found symbols + +Vulnerability #32: GO-2026-5019 + Invoking bypass of FIDO/U2F security keys physical interaction in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5019 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.CertChecker.Authenticate + #2: ssh.CertChecker.Authenticate + #3: ssh.CertChecker.CheckCert + #4: ssh.CertChecker.CheckHostKey + #5: ssh.CertChecker.CheckHostKey + Use '-show traces' to see the other 31 found symbols + +Vulnerability #33: GO-2026-5018 + Invoking pathological RSA/DSA parameters may cause DoS in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5018 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 31 found symbols + +Vulnerability #34: GO-2026-5017 + Invoking client can cause server deadlock on unexpected responses in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5017 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Client.Listen + #2: ssh.Client.Listen + #3: ssh.Client.ListenTCP + #4: ssh.Client.ListenTCP + #5: ssh.Client.ListenUnix + Use '-show traces' to see the other 64 found symbols + +Vulnerability #35: GO-2026-5016 + Invoking memory leak when rejecting channels can lead to DoS in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5016 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.channel.Reject + #2: ssh.channel.Reject + +Vulnerability #36: GO-2026-5015 + Invoking server panic during CheckHostKey/Authenticate in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5015 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.CertChecker.Authenticate + #2: ssh.CertChecker.Authenticate + #3: ssh.CertChecker.CheckHostKey + #4: ssh.CertChecker.CheckHostKey + +Vulnerability #37: GO-2026-5014 + Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5014 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #38: GO-2026-5013 + Invoking byte arithmetic causes underflow and panic in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5013 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: ssh.Dial + #2: ssh.Dial + #3: ssh.Dial + #4: ssh.Dial + #5: ssh.Dial + Use '-show traces' to see the other 51 found symbols + +Vulnerability #39: GO-2026-5006 + Invoking agent constraints dropped when forwarding keys in + golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2026-5006 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: agent.client.Add + #2: agent.keyring.Add + #3: agent.keyring.Add + +Vulnerability #40: GO-2026-5005 + Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2026-5005 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Vulnerable symbols found: + #1: agent.keyring.Add + #2: agent.keyring.Add + +Vulnerability #41: GO-2026-4986 + Quadratic string concatentation in consumeComment in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4986 + Standard library + Found in: net/mail@go1.24.13 + Fixed in: net/mail@go1.25.10 + Vulnerable symbols found: + #1: mail.AddressParser.Parse + #2: mail.AddressParser.Parse + #3: mail.AddressParser.ParseList + #4: mail.AddressParser.ParseList + #5: mail.Header.AddressList + Use '-show traces' to see the other 7 found symbols + +Vulnerability #42: GO-2026-4982 + Bypass of meta content URL escaping causes XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4982 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.10 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #43: GO-2026-4981 + Crash when handling long CNAME response in net + More info: https://pkg.go.dev/vuln/GO-2026-4981 + Standard library + Found in: net@go1.24.13 + Fixed in: net@go1.25.10 + Vulnerable symbols found: + #1: net.LookupCNAME + #2: net.LookupCNAME + #3: net.Resolver.LookupCNAME + #4: net.Resolver.LookupCNAME + +Vulnerability #44: GO-2026-4980 + Escaper bypass leads to XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4980 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.10 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #45: GO-2026-4977 + Quadratic string concatenation in consumePhrase in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4977 + Standard library + Found in: net/mail@go1.24.13 + Fixed in: net/mail@go1.25.10 + Vulnerable symbols found: + #1: mail.AddressParser.Parse + #2: mail.AddressParser.Parse + #3: mail.AddressParser.ParseList + #4: mail.AddressParser.ParseList + #5: mail.Header.AddressList + Use '-show traces' to see the other 5 found symbols + +Vulnerability #46: GO-2026-4976 + ReverseProxy forwards queries with more than urlmaxqueryparams parameters in + net/http/httputil + More info: https://pkg.go.dev/vuln/GO-2026-4976 + Standard library + Found in: net/http/httputil@go1.24.13 + Fixed in: net/http/httputil@go1.25.10 + Vulnerable symbols found: + #1: httputil.ReverseProxy.ServeHTTP + #2: httputil.ReverseProxy.ServeHTTP + +Vulnerability #47: GO-2026-4971 + Panic in Dial and LookupPort when handling NUL byte on Windows in net + More info: https://pkg.go.dev/vuln/GO-2026-4971 + Standard library + Found in: net@go1.24.13 + Fixed in: net@go1.25.10 + Vulnerable symbols found: + #1: net.Dial + #2: net.DialTimeout + #3: net.Dialer.Dial + #4: net.Dialer.DialContext + #5: net.Listen + Use '-show traces' to see the other 28 found symbols + +Vulnerability #48: GO-2026-4970 + Root escape via symlink plus trailing slash in os + More info: https://pkg.go.dev/vuln/GO-2026-4970 + Standard library + Found in: os@go1.24.13 + Fixed in: os@go1.25.12 + Vulnerable symbols found: + #1: os.OpenInRoot + #2: os.Root.Create + #3: os.Root.Open + #4: os.Root.OpenFile + #5: os.Root.OpenRoot + Use '-show traces' to see the other 6 found symbols + +Vulnerability #49: GO-2026-4947 + Unexpected work during chain building in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4947 + Standard library + Found in: crypto/x509@go1.24.13 + Fixed in: crypto/x509@go1.25.9 + Vulnerable symbols found: + #1: x509.Certificate.Verify + #2: x509.Certificate.Verify + #3: x509.Certificate.Verify + +Vulnerability #50: GO-2026-4946 + Inefficient policy validation in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4946 + Standard library + Found in: crypto/x509@go1.24.13 + Fixed in: crypto/x509@go1.25.9 + Vulnerable symbols found: + #1: x509.Certificate.Verify + #2: x509.Certificate.Verify + #3: x509.Certificate.Verify + +Vulnerability #51: GO-2026-4918 + Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in + net/http/internal/http2 in golang.org/x/net + More info: https://pkg.go.dev/vuln/GO-2026-4918 + Standard library + Found in: net/http@go1.24.13 + Fixed in: net/http@go1.25.10 + Vulnerable symbols found: + #1: http.Client.CloseIdleConnections + #2: http.Client.CloseIdleConnections + #3: http.Client.CloseIdleConnections + #4: http.Client.CloseIdleConnections + #5: http.Client.CloseIdleConnections + Use '-show traces' to see the other 321 found symbols + +Vulnerability #52: GO-2026-4870 + Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection + retention and DoS in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-4870 + Standard library + Found in: crypto/tls@go1.24.13 + Fixed in: crypto/tls@go1.25.9 + Vulnerable symbols found: + #1: tls.Conn.Handshake + #2: tls.Conn.Handshake + #3: tls.Conn.Handshake + #4: tls.Conn.Handshake + #5: tls.Conn.HandshakeContext + Use '-show traces' to see the other 34 found symbols + +Vulnerability #53: GO-2026-4869 + Unbounded allocation for old GNU sparse in archive/tar + More info: https://pkg.go.dev/vuln/GO-2026-4869 + Standard library + Found in: archive/tar@go1.24.13 + Fixed in: archive/tar@go1.25.9 + Vulnerable symbols found: + #1: tar.Reader.Next + +Vulnerability #54: GO-2026-4865 + JsBraceDepth Context Tracking Bugs (XSS) in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4865 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.9 + Vulnerable symbols found: + #1: template.Error.Error + #2: template.HTMLEscaper + #3: template.JSEscape + #4: template.JSEscapeString + #5: template.JSEscaper + Use '-show traces' to see the other 27 found symbols + +Vulnerability #55: GO-2026-4864 + TOCTOU permits root escape on Linux via Root.Chmod in os in + internal/syscall/unix + More info: https://pkg.go.dev/vuln/GO-2026-4864 + Standard library + Found in: internal/syscall/unix@go1.24.13 + Fixed in: internal/syscall/unix@go1.25.9 + Platforms: linux + Vulnerable symbols found: + #1: unix.Fchmodat + +Vulnerability #56: GO-2026-4603 + URLs in meta content attribute actions are not escaped in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4603 + Standard library + Found in: html/template@go1.24.13 + Fixed in: html/template@go1.25.8 + Vulnerable symbols found: + #1: template.Template.Execute + #2: template.Template.Execute + #3: template.Template.Execute + #4: template.Template.Execute + #5: template.Template.Execute + Use '-show traces' to see the other 9 found symbols + +Vulnerability #57: GO-2026-4602 + FileInfo can escape from a Root in os + More info: https://pkg.go.dev/vuln/GO-2026-4602 + Standard library + Found in: os@go1.24.13 + Fixed in: os@go1.25.8 + Vulnerable symbols found: + #1: os.File.ReadDir + #2: os.File.Readdir + #3: os.ReadDir + #4: os.dirFS.ReadDir + #5: os.rootFS.ReadDir + Use '-show traces' to see the other 1 found symbols + +Vulnerability #58: GO-2026-4601 + Incorrect parsing of IPv6 host literals in net/url + More info: https://pkg.go.dev/vuln/GO-2026-4601 + Standard library + Found in: net/url@go1.24.13 + Fixed in: net/url@go1.25.8 + Vulnerable symbols found: + #1: url.JoinPath + #2: url.Parse + #3: url.ParseRequestURI + #4: url.URL.Parse + #5: url.URL.Parse + Use '-show traces' to see the other 1 found symbols + +Vulnerability #59: GO-2025-4135 + Malformed constraint may cause denial of service in + golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2025-4135 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.45.0 + Vulnerable symbols found: + #1: agent.ForwardToAgent + #2: agent.ForwardToAgent + #3: agent.ServeAgent + #4: agent.ServeAgent + +Vulnerability #60: GO-2025-4134 + Unbounded memory consumption in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2025-4134 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.45.0 + Vulnerable symbols found: + #1: ssh.NewServerConn + #2: ssh.NewServerConn + #3: ssh.NewServerConn + #4: ssh.NewServerConn + #5: ssh.NewServerConn + Use '-show traces' to see the other 7 found symbols + +Vulnerability #61: GO-2025-4116 + Potential denial of service in golang.org/x/crypto/ssh/agent + More info: https://pkg.go.dev/vuln/GO-2025-4116 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.43.0 + Vulnerable symbols found: + #1: agent.agentKeyringSigner.Sign + #2: agent.agentKeyringSigner.SignWithAlgorithm + #3: agent.client.List + #4: agent.client.Sign + #5: agent.client.SignWithFlags + Use '-show traces' to see the other 1 found symbols + +Vulnerability #62: GO-2025-3487 + Potential denial of service in golang.org/x/crypto + More info: https://pkg.go.dev/vuln/GO-2025-3487 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.35.0 + Vulnerable symbols found: + #1: ssh.Client.Dial + #2: ssh.Client.DialContext + #3: ssh.Client.DialTCP + #4: ssh.Client.Listen + #5: ssh.Client.Listen + Use '-show traces' to see the other 117 found symbols + +Your code is affected by 62 vulnerabilities from 1 module and the Go standard library. +This scan found no other vulnerabilities in packages you import or modules you +require. +Use '-show verbose' for more details. diff --git a/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-agent.txt b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-agent.txt new file mode 100644 index 00000000..8e7641a1 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-agent.txt @@ -0,0 +1,794 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-6617 + HTTP/2 server crash due to HPACK encoder race in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6617 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + #120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + +Vulnerability #2: GO-2026-6613 + HTTP/1 server connection desynchronization after 2xx CONNECT response in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6613 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.CanonicalHeaderKey + #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #3: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader, which eventually calls http.Header.Del + #4: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.Header.Get + #5: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #8: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #9: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #10: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #11: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #12: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #13: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #14: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #15: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #16: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #17: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #20: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #21: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #22: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #23: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close, which eventually calls http.expectContinueReader.Close + #24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #25: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #27: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #28: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #29: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #30: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #32: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #34: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close, which eventually calls http.readTrackingBody.Close + #35: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #36: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #37: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #38: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #39: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + +Vulnerability #3: GO-2026-6612 + Double flow control refund on HTTP/2 server streams in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6612 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + #120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + +Vulnerability #4: GO-2026-6611 + Excessive CPU consumption from repeated initial window changes in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6611 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + #120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + +Vulnerability #5: GO-2026-6610 + HTTP/2 transport accepts malformed framing-related headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6610 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + +Vulnerability #6: GO-2026-6608 + Memory limit bypass when parsing MIME headers in net/textproto, + mime/multipart + More info: https://pkg.go.dev/vuln/GO-2026-6608 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.9 + Example traces found: + #1: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader + +Vulnerability #7: GO-2026-6607 + Reject malformed ECH outer extension references in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6607 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.9 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext + #2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #8: GO-2026-6605 + HTTP/1 client connection desynchronization after CONNECT rejection in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6605 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + +Vulnerability #9: GO-2026-6603 + HTTP/2 server memory exhaustion due to Trailer headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6603 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + #3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set + #5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest + #7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext + #9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth + #11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc + #13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + #15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown + #17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close + #19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read + #21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close + #23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read + #25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read + #27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close + #31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read + #33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read + #39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read + #41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close + #43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read + #45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error + #47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error + #57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error + #63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error + #69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error + #71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close + #73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read + #75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error + #77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error + #79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error + #81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read + #83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write + #85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader + #87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString + #89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close + #93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read + #95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read + #99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write + #101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read + #107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read + #113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read + #115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write + #117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader + #119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + #120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error + +Vulnerability #10: GO-2026-6218 + Avoid quadratic complexity in resolvePath in net/url + More info: https://pkg.go.dev/vuln/GO-2026-6218 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.6 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls url.URL.Parse + +Vulnerability #11: GO-2026-6090 + Limit handshake messages we are willing to accept post-handshake in + crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6090 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.6 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext + #2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #12: GO-2026-6089 + Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6089 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Example traces found: + #1: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS + +Vulnerability #13: GO-2026-5972 + Enforce maximum recursion depth in encoding/asn1 + More info: https://pkg.go.dev/vuln/GO-2026-5972 + Standard library + Found in: encoding/asn1@go1.26 + Fixed in: encoding/asn1@go1.26.6 + Example traces found: + #1: internal/hub/client.go:48:30: hub.NewClient calls x509.CertPool.AppendCertsFromPEM, which eventually calls asn1.Unmarshal + +Vulnerability #14: GO-2026-5856 + Invoking Encrypted Client Hello privacy leak in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-5856 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.5 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext + #2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #15: GO-2026-5039 + Arbitrary inputs are included in errors without any escaping in + net/textproto + More info: https://pkg.go.dev/vuln/GO-2026-5039 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.4 + Example traces found: + #1: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader + +Vulnerability #16: GO-2026-5037 + Inefficient candidate hostname parsing in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-5037 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.4 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify + #2: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.VerifyHostname + #3: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls x509.HostnameError.Error + +Vulnerability #17: GO-2026-5026 + Invoking failure to reject ASCII-only Punycode-encoded labels in + golang.org/x/net/idna + More info: https://pkg.go.dev/vuln/GO-2026-5026 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + +Vulnerability #18: GO-2026-4971 + Panic in Dial and LookupPort when handling NUL byte on Windows in net + More info: https://pkg.go.dev/vuln/GO-2026-4971 + Standard library + Found in: net@go1.26 + Fixed in: net@go1.26.3 + Example traces found: + #1: internal/storage/watchdog.go:404:22: storage.HostLiveness.Present calls net.DialTimeout + #2: internal/pbs/probe.go:31:27: pbs.ProbeFingerprint calls net.Dialer.DialContext + #3: internal/localapi/server.go:617:23: localapi.Server.Run calls net.Listen + #4: internal/poke/poke.go:133:28: poke.Listener.serve calls net.ListenConfig.ListenPacket + #5: internal/wgtunnel/manager.go:62:40: wgtunnel.netResolver.LookupIPv4 calls net.Resolver.LookupNetIP + +Vulnerability #19: GO-2026-4947 + Unexpected work during chain building in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4947 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify + +Vulnerability #20: GO-2026-4946 + Inefficient policy validation in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4946 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify + +Vulnerability #21: GO-2026-4918 + Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in + net/http/internal/http2 in golang.org/x/net + More info: https://pkg.go.dev/vuln/GO-2026-4918 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.3 + Example traces found: + #1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do + +Vulnerability #22: GO-2026-4870 + Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection + retention and DoS in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-4870 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.2 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext + #2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #23: GO-2026-4866 + Case-sensitive excludedSubtrees name constraints cause Auth Bypass in + crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4866 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify + +Vulnerability #24: GO-2026-4602 + FileInfo can escape from a Root in os + More info: https://pkg.go.dev/vuln/GO-2026-4602 + Standard library + Found in: os@go1.26 + Fixed in: os@go1.26.1 + Example traces found: + #1: internal/storage/netmount.go:512:28: storage.SudoHostOps.MigrateNetworkUnits calls os.ReadDir + +Vulnerability #25: GO-2026-4601 + Incorrect parsing of IPv6 host literals in net/url + More info: https://pkg.go.dev/vuln/GO-2026-4601 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.1 + Example traces found: + #1: internal/config/config.go:999:21: config.HubConfig.Validate calls url.Parse + #2: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS, which eventually calls url.ParseRequestURI + #3: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls url.URL.Parse + +Vulnerability #26: GO-2026-4600 + Panic in name constraint checking for malformed certificates in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4600 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify + +Vulnerability #27: GO-2026-4599 + Incorrect enforcement of email constraints in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4599 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify + +Your code is affected by 27 vulnerabilities from the Go standard library. +This scan also found 10 vulnerabilities in packages you import and 13 +vulnerabilities in modules you require, but your code doesn't appear to call +these vulnerabilities. +Use '-show verbose' for more details. diff --git a/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-controller.txt b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-controller.txt new file mode 100644 index 00000000..ece15620 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-controller.txt @@ -0,0 +1,1170 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-6617 + HTTP/2 server crash due to HPACK encoder race in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6617 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + #158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + +Vulnerability #2: GO-2026-6613 + HTTP/1 server connection desynchronization after 2xx CONNECT response in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6613 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which eventually calls http.CanonicalHeaderKey + #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #4: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #5: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #6: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #7: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader, which eventually calls http.Header.Del + #8: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #9: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #10: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #11: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #12: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #13: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #14: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #15: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #16: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #17: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #18: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #19: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #20: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #21: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #22: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #23: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #24: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #25: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #26: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #27: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #28: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #29: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #30: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #31: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #32: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #33: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #34: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #35: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #36: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #37: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close, which eventually calls http.expectContinueReader.Close + #38: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #39: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #40: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #41: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #42: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #43: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close, which eventually calls http.maxBytesReader.Close + #44: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #45: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #46: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #47: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #48: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #49: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close, which eventually calls http.readTrackingBody.Close + #50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #51: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #52: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #53: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #54: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #55: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #56: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #57: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + +Vulnerability #3: GO-2026-6612 + Double flow control refund on HTTP/2 server streams in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6612 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + #158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + +Vulnerability #4: GO-2026-6611 + Excessive CPU consumption from repeated initial window changes in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6611 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + #158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + +Vulnerability #5: GO-2026-6610 + HTTP/2 transport accepts malformed framing-related headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6610 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + +Vulnerability #6: GO-2026-6609 + Lack of limit on size of parsed Range headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6609 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + +Vulnerability #7: GO-2026-6608 + Memory limit bypass when parsing MIME headers in net/textproto, + mime/multipart + More info: https://pkg.go.dev/vuln/GO-2026-6608 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.9 + Example traces found: + #1: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue, which eventually calls multipart.Reader.ReadForm + #2: internal/mailrelay/policy.go:41:30: mailrelay.FromDomain calls mail.ReadMessage, which eventually calls textproto.Reader.ReadContinuedLine + #3: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader + +Vulnerability #8: GO-2026-6607 + Reject malformed ECH outer extension references in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6607 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.9 + Example traces found: + #1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake + #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read + #4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write + #5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #9: GO-2026-6605 + HTTP/1 client connection desynchronization after CONNECT rejection in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6605 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #3: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #4: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + +Vulnerability #10: GO-2026-6603 + HTTP/2 server memory exhaustion due to Trailer headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6603 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + #9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error + #11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get + #13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set + #15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values + #17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest + #19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext + #21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound + #23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect + #25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie + #27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue + #29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm + #31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue + #33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth + #35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile + #37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle + #39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc + #41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + #43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown + #45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie + #47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close + #49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read + #51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close + #53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read + #55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read + #57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write + #59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close + #61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read + #63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write + #65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write + #67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read + #69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read + #71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close + #73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read + #75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error + #77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error + #87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String + #89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error + #93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write + #95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write + #97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error + #99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error + #101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close + #103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read + #105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error + #107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error + #109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error + #111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read + #113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush + #115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write + #117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader + #119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString + #121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write + #123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close + #125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read + #127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String + #129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read + #131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write + #133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read + #135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read + #139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write + #143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read + #145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read + #147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush + #149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom + #151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write + #153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader + #155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString + #157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + #158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error + +Vulnerability #11: GO-2026-6600 + Recognize yield as regexp preceder keyword in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6600 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.9 + Example traces found: + #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate + +Vulnerability #12: GO-2026-6599 + Reset context tracking on consecutive template expressions in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6599 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.9 + Example traces found: + #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate + +Vulnerability #13: GO-2026-6355 + Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6355 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + +Vulnerability #14: GO-2026-6354 + Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6354 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + +Vulnerability #15: GO-2026-6218 + Avoid quadratic complexity in resolvePath in net/url + More info: https://pkg.go.dev/vuln/GO-2026-6218 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.6 + Example traces found: + #1: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls url.URL.Parse + +Vulnerability #16: GO-2026-6091 + Fix Javascript regexp context tracking in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6091 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.6 + Example traces found: + #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate + +Vulnerability #17: GO-2026-6090 + Limit handshake messages we are willing to accept post-handshake in + crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6090 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.6 + Example traces found: + #1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake + #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read + #4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write + #5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #18: GO-2026-6089 + Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6089 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Example traces found: + #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe + +Vulnerability #19: GO-2026-5972 + Enforce maximum recursion depth in encoding/asn1 + More info: https://pkg.go.dev/vuln/GO-2026-5972 + Standard library + Found in: encoding/asn1@go1.26 + Fixed in: encoding/asn1@go1.26.6 + Example traces found: + #1: internal/offsiteapply/seams.go:312:36: offsiteapply.PublicKeyOf calls ssh.ParsePrivateKey, which eventually calls asn1.Unmarshal + +Vulnerability #20: GO-2026-5856 + Invoking Encrypted Client Hello privacy leak in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-5856 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.5 + Example traces found: + #1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake + #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read + #4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write + #5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #21: GO-2026-5039 + Arbitrary inputs are included in errors without any escaping in + net/textproto + More info: https://pkg.go.dev/vuln/GO-2026-5039 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.4 + Example traces found: + #1: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader + +Vulnerability #22: GO-2026-5037 + Inefficient candidate hostname parsing in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-5037 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.4 + Example traces found: + #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.VerifyHostname + #3: internal/util/msgerr.go:150:18: util.ErrText calls x509.HostnameError.Error + +Vulnerability #23: GO-2026-5026 + Invoking failure to reject ASCII-only Punycode-encoded labels in + golang.org/x/net/idna + More info: https://pkg.go.dev/vuln/GO-2026-5026 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #3: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #4: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + +Vulnerability #24: GO-2026-5020 + Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5020 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + +Vulnerability #25: GO-2026-5019 + Invoking bypass of FIDO/U2F security keys physical interaction in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5019 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + +Vulnerability #26: GO-2026-5018 + Invoking pathological RSA/DSA parameters may cause DoS in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5018 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + #2: internal/offsiteapply/seams.go:321:44: offsiteapply.FingerprintOf calls ssh.ParseAuthorizedKey + #3: internal/offsiteapply/seams.go:312:36: offsiteapply.PublicKeyOf calls ssh.ParsePrivateKey + +Vulnerability #27: GO-2026-5017 + Invoking client can cause server deadlock on unexpected responses in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5017 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + +Vulnerability #28: GO-2026-5013 + Invoking byte arithmetic causes underflow and panic in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5013 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + +Vulnerability #29: GO-2026-4986 + Quadratic string concatentation in consumeComment in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4986 + Standard library + Found in: net/mail@go1.26 + Fixed in: net/mail@go1.26.3 + Example traces found: + #1: internal/mailrelay/policy.go:49:32: mailrelay.FromDomain calls mail.ParseAddress + #2: internal/mailrelay/policy.go:52:38: mailrelay.FromDomain calls mail.ParseAddressList + +Vulnerability #30: GO-2026-4982 + Bypass of meta content URL escaping causes XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4982 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.3 + Example traces found: + #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate + +Vulnerability #31: GO-2026-4980 + Escaper bypass leads to XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4980 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.3 + Example traces found: + #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate + +Vulnerability #32: GO-2026-4977 + Quadratic string concatenation in consumePhrase in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4977 + Standard library + Found in: net/mail@go1.26 + Fixed in: net/mail@go1.26.3 + Example traces found: + #1: internal/mailrelay/policy.go:49:32: mailrelay.FromDomain calls mail.ParseAddress + #2: internal/mailrelay/policy.go:52:38: mailrelay.FromDomain calls mail.ParseAddressList + +Vulnerability #33: GO-2026-4971 + Panic in Dial and LookupPort when handling NUL byte on Windows in net + More info: https://pkg.go.dev/vuln/GO-2026-4971 + Standard library + Found in: net@go1.26 + Fixed in: net@go1.26.3 + Example traces found: + #1: internal/stacks/healthprobe.go:227:30: stacks.Manager.probeTCP calls net.DialTimeout + #2: internal/offsiteapply/seams.go:227:28: offsiteapply.KeyscanScanner.Scan calls net.Dialer.DialContext + #3: internal/mailrelay/server.go:136:23: mailrelay.Server.Start calls net.Listen + #4: internal/web/clientaddr.go:68:25: web.peerResolver.has calls net.Resolver.LookupHost + +Vulnerability #34: GO-2026-4947 + Unexpected work during chain building in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4947 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #35: GO-2026-4946 + Inefficient policy validation in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4946 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #36: GO-2026-4918 + Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in + net/http/internal/http2 in golang.org/x/net + More info: https://pkg.go.dev/vuln/GO-2026-4918 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.3 + Example traces found: + #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections + #2: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do + #3: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get + #4: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head + +Vulnerability #37: GO-2026-4870 + Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection + retention and DoS in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-4870 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.2 + Example traces found: + #1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake + #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read + #4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write + #5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #38: GO-2026-4869 + Unbounded allocation for old GNU sparse in archive/tar + More info: https://pkg.go.dev/vuln/GO-2026-4869 + Standard library + Found in: archive/tar@go1.26 + Fixed in: archive/tar@go1.26.2 + Example traces found: + #1: internal/appexport/restore.go:145:22: appexport.ReadManifestFromFAB calls tar.Reader.Next + +Vulnerability #39: GO-2026-4866 + Case-sensitive excludedSubtrees name constraints cause Auth Bypass in + crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4866 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #40: GO-2026-4865 + JsBraceDepth Context Tracking Bugs (XSS) in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4865 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.2 + Example traces found: + #1: internal/util/msgerr.go:150:18: util.ErrText calls template.Error.Error + #2: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate + #3: internal/setup/handlers.go:78:25: setup.Server.loadTemplates calls template.Template.Funcs + #4: internal/web/server.go:392:26: web.parseTemplateSet calls template.Template.Parse + #5: internal/setup/handlers.go:80:13: setup.Server.loadTemplates calls template.Template.ParseFS + #6: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls template.context.String + +Vulnerability #41: GO-2026-4603 + URLs in meta content attribute actions are not escaped in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4603 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.1 + Example traces found: + #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate + +Vulnerability #42: GO-2026-4602 + FileInfo can escape from a Root in os + More info: https://pkg.go.dev/vuln/GO-2026-4602 + Standard library + Found in: os@go1.26 + Fixed in: os@go1.26.1 + Example traces found: + #1: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile, which eventually calls os.File.ReadDir + #2: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile, which eventually calls os.File.Readdir + #3: internal/backup/offbox_reconstitute.go:1110:32: backup.Manager.OffsiteScratchPair calls os.ReadDir + +Vulnerability #43: GO-2026-4601 + Incorrect parsing of IPv6 host literals in net/url + More info: https://pkg.go.dev/vuln/GO-2026-4601 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.1 + Example traces found: + #1: internal/web/family_gate.go:258:24: web.Server.ServeFamilyGateAuth calls url.Parse + #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls url.ParseRequestURI + #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls url.URL.Parse + +Vulnerability #44: GO-2026-4600 + Panic in name constraint checking for malformed certificates in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4600 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Example traces found: + #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #45: GO-2026-4599 + Incorrect enforcement of email constraints in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4599 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Example traces found: + #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #46: GO-2025-3487 + Potential denial of service in golang.org/x/crypto + More info: https://pkg.go.dev/vuln/GO-2025-3487 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.35.0 + Example traces found: + #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn + +Your code is affected by 46 vulnerabilities from 1 module and the Go standard library. +This scan also found 13 vulnerabilities in packages you import and 9 +vulnerabilities in modules you require, but your code doesn't appear to call +these vulnerabilities. +Use '-show verbose' for more details. diff --git a/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-hub.txt b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-hub.txt new file mode 100644 index 00000000..98bd56f2 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-hub.txt @@ -0,0 +1,1133 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-6617 + HTTP/2 server crash due to HPACK encoder race in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6617 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #3: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #4: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #5: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #6: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #7: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #8: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #9: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #10: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #11: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #12: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #13: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #14: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #15: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #16: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #17: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #18: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #19: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #20: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #21: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #22: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #23: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #24: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #25: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #26: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #27: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #28: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #29: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #30: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #31: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #32: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #33: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #34: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #35: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #36: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #37: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #38: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #39: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #40: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #41: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #42: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #43: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #44: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #45: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #46: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #47: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #48: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #49: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #50: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #51: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #52: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #53: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #54: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #55: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #56: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #57: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #58: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #59: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #60: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #61: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #62: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #63: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #64: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #65: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #66: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #67: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #68: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #69: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #70: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #71: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #72: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #73: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #74: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #75: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #76: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #77: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #78: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #79: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #80: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #81: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #82: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #83: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #84: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #85: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #86: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #87: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #88: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #89: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #90: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #91: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #92: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #93: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #94: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #95: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #96: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #97: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #98: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #99: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #100: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #101: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #102: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #103: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #104: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #105: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #106: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #107: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #108: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #109: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #110: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #111: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #112: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #113: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #114: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #115: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #116: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #117: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #118: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #119: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #120: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #121: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #122: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #123: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #124: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #125: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #126: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #127: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #128: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #129: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #130: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #131: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #132: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #133: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #134: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #135: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #136: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #137: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #138: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #139: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #140: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #141: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #142: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #143: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #144: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #145: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #146: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #147: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #148: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #149: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #150: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #151: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + #152: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + +Vulnerability #2: GO-2026-6613 + HTTP/1 server connection desynchronization after 2xx CONNECT response in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6613 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.CanonicalHeaderKey + #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #3: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #4: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader, which eventually calls http.Header.Del + #5: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #6: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #7: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #8: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #9: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #10: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #11: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #12: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #13: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #14: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #15: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #16: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #17: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #18: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #19: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #20: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #21: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #22: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #23: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #24: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #25: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #26: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #27: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #28: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #29: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #30: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #31: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #32: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #33: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.checkConnErrorWriter.Write + #34: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.chunkWriter.Write + #35: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #36: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.expectContinueReader.Close + #37: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #38: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #39: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #40: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #41: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #42: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #43: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #44: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #45: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #46: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.persistConnWriter.Write + #47: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.readTrackingBody.Close + #48: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #49: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #50: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #51: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #52: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #53: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #54: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + +Vulnerability #3: GO-2026-6612 + Double flow control refund on HTTP/2 server streams in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6612 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #3: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #4: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #5: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #6: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #7: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #8: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #9: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #10: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #11: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #12: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #13: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #14: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #15: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #16: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #17: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #18: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #19: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #20: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #21: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #22: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #23: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #24: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #25: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #26: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #27: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #28: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #29: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #30: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #31: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #32: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #33: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #34: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #35: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #36: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #37: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #38: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #39: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #40: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #41: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #42: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #43: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #44: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #45: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #46: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #47: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #48: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #49: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #50: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #51: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #52: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #53: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #54: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #55: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #56: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #57: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #58: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #59: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #60: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #61: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #62: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #63: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #64: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #65: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #66: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #67: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #68: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #69: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #70: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #71: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #72: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #73: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #74: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #75: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #76: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #77: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #78: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #79: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #80: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #81: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #82: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #83: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #84: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #85: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #86: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #87: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #88: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #89: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #90: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #91: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #92: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #93: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #94: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #95: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #96: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #97: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #98: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #99: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #100: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #101: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #102: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #103: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #104: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #105: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #106: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #107: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #108: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #109: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #110: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #111: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #112: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #113: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #114: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #115: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #116: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #117: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #118: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #119: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #120: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #121: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #122: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #123: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #124: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #125: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #126: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #127: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #128: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #129: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #130: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #131: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #132: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #133: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #134: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #135: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #136: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #137: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #138: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #139: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #140: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #141: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #142: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #143: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #144: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #145: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #146: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #147: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #148: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #149: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #150: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #151: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + #152: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + +Vulnerability #4: GO-2026-6611 + Excessive CPU consumption from repeated initial window changes in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6611 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #3: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #4: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #5: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #6: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #7: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #8: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #9: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #10: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #11: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #12: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #13: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #14: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #15: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #16: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #17: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #18: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #19: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #20: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #21: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #22: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #23: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #24: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #25: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #26: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #27: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #28: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #29: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #30: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #31: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #32: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #33: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #34: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #35: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #36: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #37: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #38: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #39: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #40: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #41: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #42: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #43: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #44: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #45: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #46: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #47: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #48: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #49: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #50: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #51: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #52: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #53: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #54: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #55: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #56: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #57: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #58: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #59: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #60: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #61: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #62: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #63: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #64: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #65: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #66: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #67: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #68: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #69: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #70: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #71: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #72: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #73: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #74: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #75: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #76: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #77: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #78: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #79: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #80: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #81: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #82: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #83: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #84: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #85: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #86: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #87: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #88: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #89: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #90: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #91: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #92: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #93: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #94: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #95: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #96: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #97: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #98: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #99: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #100: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #101: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #102: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #103: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #104: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #105: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #106: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #107: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #108: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #109: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #110: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #111: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #112: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #113: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #114: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #115: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #116: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #117: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #118: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #119: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #120: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #121: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #122: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #123: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #124: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #125: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #126: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #127: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #128: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #129: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #130: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #131: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #132: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #133: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #134: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #135: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #136: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #137: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #138: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #139: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #140: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #141: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #142: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #143: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #144: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #145: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #146: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #147: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #148: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #149: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #150: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #151: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + #152: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + +Vulnerability #5: GO-2026-6610 + HTTP/2 transport accepts malformed framing-related headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6610 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + +Vulnerability #6: GO-2026-6609 + Lack of limit on size of parsed Range headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6609 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + +Vulnerability #7: GO-2026-6608 + Memory limit bypass when parsing MIME headers in net/textproto, + mime/multipart + More info: https://pkg.go.dev/vuln/GO-2026-6608 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.9 + Example traces found: + #1: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue, which eventually calls multipart.Reader.ReadForm + #2: internal/mailrelay/relay.go:131:30: mailrelay.FromDomain calls mail.ReadMessage, which eventually calls textproto.Reader.ReadContinuedLine + #3: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader + +Vulnerability #8: GO-2026-6607 + Reject malformed ECH outer extension references in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6607 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.9 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #2: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #9: GO-2026-6605 + HTTP/1 client connection desynchronization after CONNECT rejection in + net/http + More info: https://pkg.go.dev/vuln/GO-2026-6605 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + +Vulnerability #10: GO-2026-6603 + HTTP/2 server memory exhaustion due to Trailer headers in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6603 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.9 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + #3: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #4: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error + #5: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #6: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get + #7: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #8: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set + #9: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #10: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest + #11: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #12: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext + #13: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #14: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound + #15: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #16: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect + #17: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #18: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth + #19: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #20: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie + #21: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #22: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue + #23: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #24: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm + #25: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #26: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth + #27: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #28: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush + #29: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #30: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline + #31: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #32: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile + #33: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #34: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle + #35: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #36: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc + #37: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #38: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + #39: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #40: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown + #41: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #42: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie + #43: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #44: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone + #45: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #46: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close + #47: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #48: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read + #49: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #50: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close + #51: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #52: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read + #53: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #54: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read + #55: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #56: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write + #57: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #58: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close + #59: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #60: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read + #61: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #62: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write + #63: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #64: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write + #65: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #66: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read + #67: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #68: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read + #69: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #70: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close + #71: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #72: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read + #73: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #74: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error + #75: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #76: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String + #77: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #78: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String + #79: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #80: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String + #81: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #82: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String + #83: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #84: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error + #85: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #86: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String + #87: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #88: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String + #89: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #90: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error + #91: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #92: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write + #93: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #94: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write + #95: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #96: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error + #97: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #98: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error + #99: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #100: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close + #101: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #102: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read + #103: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #104: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error + #105: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #106: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error + #107: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #108: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error + #109: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #110: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read + #111: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #112: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write + #113: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #114: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader + #115: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #116: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString + #117: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #118: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write + #119: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #120: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close + #121: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #122: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read + #123: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #124: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String + #125: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #126: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read + #127: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #128: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write + #129: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #130: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read + #131: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #132: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close + #133: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #134: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read + #135: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #136: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom + #137: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #138: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write + #139: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #140: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read + #141: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #142: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read + #143: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #144: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom + #145: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #146: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write + #147: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #148: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader + #149: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #150: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString + #151: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + #152: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error + +Vulnerability #11: GO-2026-6600 + Recognize yield as regexp preceder keyword in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6600 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.9 + Example traces found: + #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute + #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate + +Vulnerability #12: GO-2026-6599 + Reset context tracking on consecutive template expressions in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6599 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.9 + Example traces found: + #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute + #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate + +Vulnerability #13: GO-2026-6355 + Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6355 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Example traces found: + #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + +Vulnerability #14: GO-2026-6354 + Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-6354 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.56.0 + Example traces found: + #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + +Vulnerability #15: GO-2026-6218 + Avoid quadratic complexity in resolvePath in net/url + More info: https://pkg.go.dev/vuln/GO-2026-6218 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.6 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls url.URL.Parse + +Vulnerability #16: GO-2026-6091 + Fix Javascript regexp context tracking in html/template + More info: https://pkg.go.dev/vuln/GO-2026-6091 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.6 + Example traces found: + #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute + #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate + +Vulnerability #17: GO-2026-6090 + Limit handshake messages we are willing to accept post-handshake in + crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-6090 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.6 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #2: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #18: GO-2026-6089 + Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http + More info: https://pkg.go.dev/vuln/GO-2026-6089 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe + +Vulnerability #19: GO-2026-5972 + Enforce maximum recursion depth in encoding/asn1 + More info: https://pkg.go.dev/vuln/GO-2026-5972 + Standard library + Found in: encoding/asn1@go1.26 + Fixed in: encoding/asn1@go1.26.6 + Example traces found: + #1: internal/tenantsync/client.go:78:36: tenantsync.New calls ssh.ParsePrivateKey, which eventually calls asn1.Unmarshal + +Vulnerability #20: GO-2026-5856 + Invoking Encrypted Client Hello privacy leak in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-5856 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.5 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #2: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #21: GO-2026-5039 + Arbitrary inputs are included in errors without any escaping in + net/textproto + More info: https://pkg.go.dev/vuln/GO-2026-5039 + Standard library + Found in: net/textproto@go1.26 + Fixed in: net/textproto@go1.26.4 + Example traces found: + #1: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls textproto.Error.Error + #2: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader + #3: internal/mailrelay/relay.go:59:26: mailrelay.ResendSMTP.Send calls smtp.NewClient, which calls textproto.Reader.ReadResponse + +Vulnerability #22: GO-2026-5037 + Inefficient candidate hostname parsing in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-5037 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.4 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + #2: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.VerifyHostname + #3: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls x509.HostnameError.Error + +Vulnerability #23: GO-2026-5026 + Invoking failure to reject ASCII-only Punycode-encoded labels in + golang.org/x/net/idna + More info: https://pkg.go.dev/vuln/GO-2026-5026 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.6 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + +Vulnerability #24: GO-2026-5020 + Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5020 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + #2: internal/poke/client.go:129:23: poke.Client.Poke calls ssh.Session.Run + #3: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls ssh.channel.Write + +Vulnerability #25: GO-2026-5019 + Invoking bypass of FIDO/U2F security keys physical interaction in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5019 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + +Vulnerability #26: GO-2026-5018 + Invoking pathological RSA/DSA parameters may cause DoS in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5018 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + #2: internal/offsitekeys/offsitekeys.go:100:50: offsitekeys.KeyFingerprint calls ssh.ParseAuthorizedKey + #3: internal/tenantsync/client.go:78:36: tenantsync.New calls ssh.ParsePrivateKey + +Vulnerability #27: GO-2026-5017 + Invoking client can cause server deadlock on unexpected responses in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5017 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + #2: internal/poke/client.go:129:23: poke.Client.Poke calls ssh.Session.Run + +Vulnerability #28: GO-2026-5013 + Invoking byte arithmetic causes underflow and panic in + golang.org/x/crypto/ssh + More info: https://pkg.go.dev/vuln/GO-2026-5013 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.52.0 + Example traces found: + #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + +Vulnerability #29: GO-2026-4986 + Quadratic string concatentation in consumeComment in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4986 + Standard library + Found in: net/mail@go1.26 + Fixed in: net/mail@go1.26.3 + Example traces found: + #1: internal/mailrelay/relay.go:139:32: mailrelay.FromDomain calls mail.ParseAddress + #2: internal/mailrelay/relay.go:141:38: mailrelay.FromDomain calls mail.ParseAddressList + +Vulnerability #30: GO-2026-4982 + Bypass of meta content URL escaping causes XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4982 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.3 + Example traces found: + #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute + #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate + +Vulnerability #31: GO-2026-4980 + Escaper bypass leads to XSS in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4980 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.3 + Example traces found: + #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute + #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate + +Vulnerability #32: GO-2026-4977 + Quadratic string concatenation in consumePhrase in net/mail + More info: https://pkg.go.dev/vuln/GO-2026-4977 + Standard library + Found in: net/mail@go1.26 + Fixed in: net/mail@go1.26.3 + Example traces found: + #1: internal/mailrelay/relay.go:139:32: mailrelay.FromDomain calls mail.ParseAddress + #2: internal/mailrelay/relay.go:141:38: mailrelay.FromDomain calls mail.ParseAddressList + +Vulnerability #33: GO-2026-4971 + Panic in Dial and LookupPort when handling NUL byte on Windows in net + More info: https://pkg.go.dev/vuln/GO-2026-4971 + Standard library + Found in: net@go1.26 + Fixed in: net@go1.26.3 + Example traces found: + #1: internal/poke/client.go:97:33: poke.Client.Poke calls net.Dialer.DialContext + #2: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which calls net.Listen + +Vulnerability #34: GO-2026-4947 + Unexpected work during chain building in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4947 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #35: GO-2026-4946 + Inefficient policy validation in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4946 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #36: GO-2026-4918 + Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in + net/http/internal/http2 in golang.org/x/net + More info: https://pkg.go.dev/vuln/GO-2026-4918 + Standard library + Found in: net/http@go1.26 + Fixed in: net/http@go1.26.3 + Example traces found: + #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do + +Vulnerability #37: GO-2026-4870 + Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection + retention and DoS in crypto/tls + More info: https://pkg.go.dev/vuln/GO-2026-4870 + Standard library + Found in: crypto/tls@go1.26 + Fixed in: crypto/tls@go1.26.2 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext + #2: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls tls.Conn.Read + #3: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls tls.Conn.Write + #4: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls tls.Dialer.DialContext + +Vulnerability #38: GO-2026-4866 + Case-sensitive excludedSubtrees name constraints cause Auth Bypass in + crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4866 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.2 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #39: GO-2026-4865 + JsBraceDepth Context Tracking Bugs (XSS) in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4865 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.2 + Example traces found: + #1: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls template.Error.Error + #2: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute + #3: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate + #4: internal/web/server.go:169:46: web.New calls template.Template.Funcs + #5: internal/web/selfbind.go:129:63: web.buildBindTemplates calls template.Template.Parse + #6: internal/web/server.go:169:63: web.New calls template.Template.ParseFS + #7: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls template.context.String + +Vulnerability #40: GO-2026-4603 + URLs in meta content attribute actions are not escaped in html/template + More info: https://pkg.go.dev/vuln/GO-2026-4603 + Standard library + Found in: html/template@go1.26 + Fixed in: html/template@go1.26.1 + Example traces found: + #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute + #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate + +Vulnerability #41: GO-2026-4602 + FileInfo can escape from a Root in os + More info: https://pkg.go.dev/vuln/GO-2026-4602 + Standard library + Found in: os@go1.26 + Fixed in: os@go1.26.1 + Example traces found: + #1: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile, which eventually calls os.File.ReadDir + #2: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile, which eventually calls os.File.Readdir + #3: internal/dbsnap/dbsnap.go:112:26: dbsnap.List calls os.ReadDir + +Vulnerability #42: GO-2026-4601 + Incorrect parsing of IPv6 host literals in net/url + More info: https://pkg.go.dev/vuln/GO-2026-4601 + Standard library + Found in: net/url@go1.26 + Fixed in: net/url@go1.26.1 + Example traces found: + #1: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect, which calls url.Parse + #2: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls url.ParseRequestURI + #3: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls url.URL.Parse + +Vulnerability #43: GO-2026-4600 + Panic in name constraint checking for malformed certificates in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4600 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #44: GO-2026-4599 + Incorrect enforcement of email constraints in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-4599 + Standard library + Found in: crypto/x509@go1.26 + Fixed in: crypto/x509@go1.26.1 + Example traces found: + #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify + +Vulnerability #45: GO-2025-3487 + Potential denial of service in golang.org/x/crypto + More info: https://pkg.go.dev/vuln/GO-2025-3487 + Module: golang.org/x/crypto + Found in: golang.org/x/crypto@v0.31.0 + Fixed in: golang.org/x/crypto@v0.35.0 + Example traces found: + #1: internal/poke/client.go:118:35: poke.Client.Poke calls ssh.Client.NewSession + #2: internal/poke/client.go:111:25: poke.Client.Poke calls ssh.NewClient + #3: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn + #4: internal/poke/client.go:122:2: poke.Client.Poke calls ssh.Session.Close + #5: internal/poke/client.go:129:23: poke.Client.Poke calls ssh.Session.Run + #6: internal/store/store.go:1549:19: store.Store.Close calls sql.DB.Close, which eventually calls ssh.channel.CloseWrite + #7: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls ssh.channel.Read + #8: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls ssh.channel.Write + #9: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls ssh.extChannel.Read + +Your code is affected by 45 vulnerabilities from 1 module and the Go standard library. +This scan also found 12 vulnerabilities in packages you import and 11 +vulnerabilities in modules you require, but your code doesn't appear to call +these vulnerabilities. +Use '-show verbose' for more details. diff --git a/documentation/audits/security-review-2026-10-12/scanners/trivy-cloudflare_cloudflared_2026.9.3.json.gz b/documentation/audits/security-review-2026-10-12/scanners/trivy-cloudflare_cloudflared_2026.9.3.json.gz new file mode 100644 index 0000000000000000000000000000000000000000..88eb399174e13345ac34cc1a78b6e77fa918ecbe GIT binary patch literal 47877 zcmV)FK)=5qiwFqL+01GH19Wm}c6lvhY;SdBW^7?{WnW`#Z*^p5Y+-U`WM48cGBz$b zE;BA_b8l_{>|Fa#8%du3{r(Eer<3k9v0aa@7gBUX49TzyAp$b1*~!SNC-jZ6QM;WP zGRpscpK_aE12Gsp*<>|{5Zhh#eZRZffBZ+Q)jsxT@!b9xt4TQ?wYOUAS^o5-D&Jq? z-5+>^x7U~3q^pW9Y2)*cvz15jVqDdGJF{!lQcgJQ_(V-d(ZY9JioW9sWjwk<6*9JG zyZTkMbqw2e-o^-%9ZEWsozP-Sm@T2Zk}9I5F3fj?Z4uJ!+OFy{SwF`%IkQa2En>X% zoFtPZ_*ER?tyeNn=)`z6Hj@H`{3*w6Cq+AC5+MdS@+z-dokcPI3 zz3Z1@E0fwaUB0~O*YtbuljuC$}}v#Tpt6jI(*?b(MP=MeTX(k0nwl}I#-Gvl}k)L2$1mZ&h6 z8i*oFDp(>GL0l=gNefc*0n8FLJ#(2_}-xA7#ox6+Wp zaj6(UD~La3Oo9hah>(PG9i*|*xWY5SL%il|4p1`cxrj= z7lcJCy$4irk~pO|z;X{{X0iv`UUBT;fkeW7)sJ#p5= zD2m7h4cL1NU?MQGl)wO|%qkaTWKNK(;7=_8c{o~)v$;M*oe0Wt<| zsPooExLizHv#6-HT6qxc{cSBL>Vt>-SxyU?i1*HDDHx?fI_$RvgG!x44B*_zq!J7w z2_+mPrBiVWpbH$%Z6gglL6Y1uXeUUbjfCxMrx`B{%)qmhlCjED7DNF=9@4~u+cNYa zN=KZNNe~O;5hBK<90O@IYerI^U~*0);4x^!dSj(95#(Z%yDh^2dm>8052dq0X-cG} zN*S$SI6SaOn5R-|4|8_P2*(l#U8EAxq*aAdGSxCVh+=6lAvq!@{ z5Q||#vCst4Ray~Yg_V?>+lGx@@UB7^4w$J<1iFBNiEzfiA1D;U6qVko%)3IR%@hnOLq0Hv1jRjzFg_!JffPK#HKIi5iYhQmgN727HkQDdR4N#`1rTmg5R?5FVFt1{uos1( zA|#yHFy}ZA1-AvrMzAV$WGc|Yse*BB6ce`q#sc9(%7DO&_y@(3HlT@m;X78S@|w*U%6Z0r>* zP|loX+!52Hh+pP`JZI|@d%6_K?@M*J0PK{faZ*13#`jk#S}{++07D!?2%!OWKsGP9 z1LF`tf}jN_1(GvW9+3vNuLvxM5jZRJH%UmbiX;EvJbjfK`{Pk6PZzVSt^8S8M_*5? z88mwy7R}f6DCE;(jgST zCxmRxey<@dE*`j9CE)CbIBdCTISj4u>#F>{jJ=+-lh{e+Fiv_i>bG*OF__f0o=!sh z6R?lZz6?2|SZ9j93R>z98UI&AN@o~Pt-t&#C_0a!w4EB2>%Y`+dObfrKOc{_s`0o^ zlP{0=!cHc?{R{X#8>5W>;#g0s@$}-$qpi=sB+_idrQaGsv1RSgzC63*$)JkEh&VWC zx;M(dJP{~JV^vQ+Q81W!`JlGdmk&0>(s}t+ggsC)nGAU?i?4;850g63uY#BlpoX44 zm6QioN_P;oee|leeboQq`EnW7tb|d=(QI5aqx#pf?uN1dHCDOy>Aok+%j5Y)eK{D~ z%UEGcT}|VcVPSv!#qNGA?>&F(AYm+#s;Gd5bgqf_LrR;SemtJ6_gU%qR9e1_{kUO7!(%uH8w`MY+$uzgW3 zU87x5G*=GF(e|6Y8y5@GTs)jKpA5^<^!GWW%AYkK&Q#cZ2s$ptBM5!A{^uo{8)BPv zpQUdnA{`GWbA~@p?VZ?PWG$bRR|p%G;Fq6JohvR%y5#ETyIBR+?A!hQB35O#6+3LU zCOe$WNqtq;S-NFC2dafD6rEoiFOhdTrd=kxb87w`t5F;-Es$NRA=A!v#O}<-V5&8N&il*euU{PY3x&R6zT>L0#-`TXCBp~3672QPMyzGa^F4z^$I4o-f0v-|wI z@cYyFnZNqw)194hzTwqmv+LVE^QraL0@Lk!ei~#3cagw$C{r4gVe!t{?DI{ZrC0>I zvGWv*KsR=#ViD-Z&Q&Y|-PqZRMW7oyU$F>uV`nUuw7;oy7K=bPcGhA^rkgr%u_V(? zow-;9y0LQ?OUA#cvloj%H+KGFS*9C0gRuy7W9Kjyfo|+9#v;(ooX5yNzsz5KN}ahS zT0WqF&-&-#X1bUUtrj3H~)GuK&E}#_tXO?z#7SS8v^ZJDK&W z?YnO>w*N7%el16*JLPOqFCQ}M%@fk%vhC`0vODqiV%C{2G`>ySd-XuUe$&BTr~QSx zWd0BXJVh|F0J=FG+P;1UfqAdcUZF=x99^J9pM!n|X$^ImM?ii zX-a5ulu356TbMtGumJqYE%VJ9><$izkt-SWs2k7*>Vk&cy=tEd)a4N^fkrdnK^_{q z6cNR!F;bw`M7_)lC49j&`tX$uKDm9rpF#A3ir%9`3a)g4o;Da^A#zTmLn)39O6Esw zU;-$n(V9pI%R5CZYTtz34Xu)i#I9uV$-{&Pu*lI`kd-VZNu)8{z&14u1-(*WB6<;n zkl+>_zd~(qS?;~j@i4)XPRw8tb-52;$>Nho8xLSHcdaWq4CpJJHqoPX_Q<1Xa0z-! z1xG{^9MH`0!V+|f;Mu@S(ZMiC16&I(6I;#UljkfC;1Fc2G*YFBfvJe#5*k>zH{n)j z9)l9R5E;8r3@WuSB8TgeCW1Z=ot%LtR~zY*M?UxSm-FK){_-3}8{yz9&Rg`F-bNw` z3WWgo5b&1dISY~`n@2aG(sNC
    yQmPT2(`Fry8>FNA&MgclORi1b+okJfEOEKCO z6tOKPFX0iyz>cFMfoms1gavcL(Rwe_kqIxQVmj(%%`yvEF@3GG(j|U&1KT_yb{5j1{7BQho%7_3et#)uc^yxyuJ*ddx z9ASkQELnvVi2j}llPC$w-V03+`a*TB z^Ay@f!~_=&0zL8>42VG?1_8z(XQ9MdZKzKkZ$E%VMeZrpTmUC1G7a>ty&x!-Vt{`d zRK%WSui?nL2HuJi$0L|Vq?JHm+=l1QU?qo7p0z)~P*ry4m9A(#%c0b8?}&ml3zTkx zID%M%_-VC9cBUwxoHr6p9Wb!6R{n;9|GB>m1f(z*Ec^m=sCzWV-zn_qSC#`<3^ zgxdb>)0B-!uAhPY9ys-PfJ6CIEzf4IzBl1|@r?;jh@*UeVK!e`M3M=4d$gbTg6u5- z?=^(>Zs7ed_F|6tfAfQ-&0`GjrUY_n21d`DeVy4?H#}QL@wQ~jnxbo`Feus5QXIyoLwuWe* zedhXTczN^M`&cw5=?6?k9Hi9`C+y1fR!< zv(IlFmBH=5LTIE>-t z%vx^gySe*Ux*mLd{s`PnYMVQPXE}N-Ji8pmbr)~XD*y2H7u7hwS$jkGJc!BkeDbi3 z(63#>vc9&H9};$O8cMNvL>b%$2)7S-tW-0;P?BT7eB2jvSv^5h&{*Kk3xlQ z>tZ8o%Hh?^oh&-K{uZ|W7QW6FSoB&{g%#KduaD2KJWqy2d zS(T?}^@=USGS@Yu-WUZ@RfafO0Py+RXnSObmmgwy(R_&*D%bm;fozJ18%J%vM_n&S zL2n$4`Se9;%d4MUQ-2Qoyrdou*DR=&iUPH7fo3-`q0EB{>bqI~R7?+-Gw5O|y;2;@ z_4M6H{+wF+$~hlcO8;#-EaRxvuOMYRo!8R;=bN`*S24Z8ncf`1pETFI&EkWK>3mqO z*Bs32tTL_}p>}yC%F++zaA`~2{W|0e~vlv+TozT_j0f;ndJH2*(342_#5bcH5@y@o3rs)((eHESi5{- zhjn>AM(pcfx>z;Nmtj5@-t;nmJ=Wm=sk^o%H<2d&D!$u`3EG?w7k`9xYPH-t{X%Vf z{u`ozk{Szv21MKKi+zWEgnfX0fxVsB_u4Gb8A(kg>J4wi*fS&evZ}H&zsxMCA`jb+ zT$A;Vr71O~fzsMR8q5nZ6RgTw_sqDzIFr$6iWM;$jM}5U)#U+##S5^=^=mz$%VD#|M3ubQiEPzkDW%Nk!Q+KcBW2( zj}>iUI(f3EPII!)(pW?nZzoS?^03L)RvzQ}TlVij-c9;f2-}3njZo3LxlrhK9l60g zU=Hsz(iBQ9-|4k$di+I+U95dymWZCBt;FMO?UvH&kM>Af?U6nN^XEc=B=YEivDX#M z@_oj-V-^;R&T6-i3B1T&*uR;`!*JHcR%mQbCdj#q=)M+aZyTPhRG_uGk-wRnn`U)Y zL^}dZB{sfQYyj;T_r1xWF`kU>J8Yw5qn{U?kn9T$=WC~l6xwZrl-xENPtylyqSdJ% zy8ThJ(JzR)MnLLL?V1_$UIJFxdkI+P*-OAWTS0&}4doGZD{MEG3m7$yD+&+G4V@e2NJi% zLtTk93~2-x@x(x*J5^qJ;Guo)&M=S}=a>9e6?) zt*AJfFW`?ej??|JC)P`Q_M}?~`G)P#fe5UDvPZk8PcUk)&+mn9id{&M)^So_?k^gx zDBEm{6fg+9Bu=U4P{IBMJQN@J54wsfgvPV=fs3Ez5wKySb{l)AzjYhK#+T0IxG1`5 z4mzake(Wur1{5K$&OZw3?#7}259j`W{$ov|zyCY^`@hyNfB$EMZDQ23ryb{O&!&&` z^|*#=;$y@WsV%(Je`fI);s@!$ItIGXE6KvrL0QlZJ9Rrj_)gh&pYg}O1inzJ;Gc0; zZ6SAL>^yB7dFL^_HGrDp&!k0l6>=soLW}%Y1FFuvB&_i;kA=Qq9`7SzzD98FJp_DW zUA+x_%3Z8+92ON)4V9dV!q#+WL}Am!LewS~LR)sR610gC^~5kA+nn&UnZkYcjm@Ag z2rh)8=W|VxSwKU-emS-m^*;63UjFW3$vZXlBS_QSE?I`NDLk;kroxnl6y|PYSO?Dm z-a#Zbv`(Lzy=mjoc_hosu?G%22<|anFio?Y7bFcp33irbOLPS={R*0F{n_m79w*fi zbdv`FxukbUm)ZO*AfoMD_9$A`SYbRXco#EkJo^H{0kPwVCcDS&&I@{`nXtVWw4LXx zyD5k|o@{&ud08Shh~*N0ke7YjxUC_biq9X|$eR9t(oX)q#BJNjqUpi22CUycu{VZ( zu4&{`-}yqqz~9Hh8X`Ai@5;3V*`3M$m4@4@Z!i1yFAsg2kmYKh{nSwb`_b-ohui$S zwwSG#VwvR3k`a2Th3;1*Z>oQ~Jo9*?g=M<4($KuQk#^88Y-lJ+La*q)Fh@8XU@bY- zWU#G6r*bwsmD~SM~6{qWD`7WZ9?DWuu zTS+cX9R0|SgTD2I7Jv8I-!-VKQX>@@VF`nUKjwu^Qguf#Aw>> z;-bxtOD=a|+?td^Hp3`_7m_Tc!lmv!MS&OlRA}GZ0wmgcS;*M~9qcR`Cvj=aqe({? zG^P(%yV9h|0*tVv=A)aw_S$C$Bnz$lhO6LFLcB5wwmYrTWHbk*pX}0IpraR|6$eW< zA*a_?`J({AkC!AkYgEbwqv~I?xV@iUy0{a2k*bfkD0hcXANs%-AND_|n~lmF=F92i zQwVIB-u+fvmT!1O-==|gI;O8Y#LDOY{4{k(SB3mj0m3}WKF%Tkd->QH+CAr+awkdR zU0QOtH_?-U-RkuO6N9w}BS%#&1hm=fYDn0_qusJG*vUNt)f!8pC>l7VBx42%Kv~1g zWe$|EKp6{Eus{_HL~B*Y0+9wFYZ$+3jSU6Ypkd(b#xQVZV;DHAF$|p17zWN}3{`>F3#b9FG3PxS;61y>=zCK z-6qBgk*LmS((N^dLZj7acLsmf5i!OXLw96P9mz6uQ$VE<-ASkOD70F=DaP${v>}Z8 zZ8R7Gd>9Kk7L$Skb}||?hIO!*x)89_hei+C?DT2!*s~un=w5RmqLS_$h-?u`ON=oV zNPL^7qskbv$V3*bL9aCU_<`zcaDvor%rvOl)#zVpASd#~J`OCj{WI@db-T+W?ZWOw^G3q2p$ zRYMEAXlN?8FqIH55AEFpnJ%B-BBF9t$WF+2iY=QBUF-x;GIdTme~tWn8Uek96G9v^_FS z&BFP`7KzsBpOjqnLIJt}|0er_Ql;)Ky1Yb(B>{S4cn1u_(gdV396d zU@`Bt0oaj5MK^@z=o=O+-;dEp_V6Z(*i^Im$7TOKed)7JD?%ZQkG@jy~g-;$O z5mn=`sT9827*etydiPVO#w)Y-XOsm_?@()=)7F=vW=Jy1VW&`(>8M9FQ?_RffqQzu zRDVyyUTcKf-0(EL$K{v|h+4H^KukpY(nG2=|65qb{>5V#s)Fx4_L2K~BK+h37wFG* zLhj(F8LwQp)EZ(u2`+UpxdB{)jHEY_Pz&>L3Fr6)5X&}j>Cxu%snFm24_p!QrxzE# zPJbR9xXmP9&?rAEgEI8_ubp2)lPKf|c??q8_kJDXEJ+x~p5s$Dn=}0R@3>#W`ysz( zmi*mZ(q)#CIpv!|z`an9Uyo6WP=1uAPH~71zeX6=k5U{k{~SCH`pmwJ>hoh)9{a3n z5OUAQYWcP7wKbav{Ox%&O9MLF;!Xe3{{d$ z(=!!Mrn*m=a8Xnhs%swAWksQeFB8c(RnIp}i-^RxjF~En?{Ve{jpi_msi1r$GZN0Z z!sH$s#>A(IL)Kt)ND(XILw2{|jniK8x?0C9l9kS!xr$4R%;`Mnh|D+S#T^5;I8?|f zgSk-H;IrlY_lZEi(zP#rk{A*G;m^{!AYBYT`K`AIJqK;F^XT$c@o~qaL{lt7wmd~N z6w9gH^I)510wWGEE1zkP;ZP1%m4KI`N-~+_E z1p%&@e^~FM3;WMMScpkh%TMbBZlTF2) z^*rKvlIF>fLAtVG=)NI)l251tNvkNDqDFm-%rw=V$umQus;?>fOg7)79@)@{BKp4R zQA;yj8DtU*a#dXh`f@$dnpvhI>Xgbe6-W-UTMKvztV%OnNtNW9)Khr0o6QgH{^Kfv z`EkF$!2yQ|4(d39y(fD>LF7Vk{-ob&=V@beLv6}9Xb8&{RCd*wPl*8mN7bw=5#_*{ zO9QJy6lVv0OcEuzml@(HVX4X!priPM|8Ko@5^UIE>3_;2-(B!K)Ucjp$TL|oRmq>t zRL}Hgs^&r5*EQ4fB&cpB-J>&VP!q~pU85GOKo!-{JXJOcDXkWioL-0eRne%SNd*3} zhy`f}HATXbl^Hc%DicdlMVS)a^L$7|;E$=vP{{)Gc>a}0!r}DH7dOVh~Sac^xWK5lY%?6!pUXdg&g(o9qH6j_zjD`%}99(>JOzgXa0 zP(&54Kc}RVGq=l49~U?mTEEN<$0rO|B!~aU$Nd6hcr#NKebKixV(PLYQ5Px(#g}#B znM9LCqRN)#>7u23t|1c9lV`3>OvAINSURD(L>q>#5MTgRo5_Z2>fTI-s>d)*!-Yaf z_D#i*MXD>V-Yx`q)Xg5f!{bF58%68X8bt@N{wg=HhJy4 zL?u|pMMIBdx#H9CBmBCKGoFcm4CW-{nfAvZf(t26xB6rr^RQ{3z4^dP68(6|b$do4 zpKB1A3nWC+XC7tsvlJYd12BLIcX@bgKvvnB50KJ?hvo+?dUE;GAfB_&&_8pv5=Tk= z67cA1$SB_BnT{c(8%r8-H4*@Vhp~r1iwo~LUSCU|PC=uLfXd=*9`opI9D}zD!}x_~ z{%sOFQ$AmrCc!G^B8h1h1w0=AHHiG@m@XdNe1`~@`yALy0v)dmkF3})mfALNC%5t=OH6v`tm7V1TQ01a*b%_>W- zaJI!iMlsj;wzvUYjrbzf7CNSDnp9u)J3&ur7&@(B&E*4I@E7{R=R7-L5P2;8qjU^) zIh2JSA2fRjxE!|k7YQ>y3jYkf;$-m8z{M3GZ)^~cP_ty-;`L)chGMDudgLj50Ffi` zD5sl1X*(ud8BRY~a%rT`mJHaFK|b3U0R0DCLm7Z6aW053NXFT%1S(A4RBgc4J>rC~ zvKo+IWF7M5#{(L%w1e{X4*ta#$p#cUwqU*EL;VcAn46mhOxv8LA2@@@nMX1Ip-ED4 z74{JH68MzQQUR4hTZD^^hNSY7(=CGjaQ=+>@|t1QMcdu|NgO?M*#SV-&rX{xpwRx< zq*+Lw(eM_H&g=-Q3}+gGOqg#4W0+-JDjj`?_%`QK(U`D^$cISS(rQrgvCbCt9MdS^ zN^scY0D)w}IAI~57wN<^$6lTJ2>M&V*!e=kXTHH@l;NNl=Y&O2!Z%oc&&Agh5-ozr z=|v&s^6Lrpf*F@0Cv?uai2uLro$GJgIJ(BapTEL5!1*-mn=Ie5D0Z5(({$2wvT>SX z1`A{;iMCbCqN__>7uf&(yp%0Rr0n#0J>A7(F*`ulvH7DUino`dp66D-;+q|5uEH$iGVgMqx3Emi-CQkst%9I!Y`|(0lXW=F9xiekk9pvooY7^?M6_aE+TA?o zO}p>HPdPJ=z0)Hl_z?XG$rNvrb*~$2&RpL5I1e*9R|#(&o5Hp@TuD}x`m0#v8949J z9f_Z97m8DGUiQSi5|3cSUtw~+{`Traf`?&GFhwk%a~gs99K7yXf&A+{39!oaMBRvJ z3D%4!=vHNO3GRw}q9z-)<}!DQim(-{C+1$InZl-HX{aCPORT7i#L-fKu}YDAi9XFJ zQpY0LVE3X({y76D|GU)6!zyBtJe|*k2R6$B$TkV%bk4o%=_|d3 zo8pZn-983HCB>+#SNU3i%lkSx&DIzL*tOm`$r#+Pscxq!xTk&##34A*FOuh}&ls-X zhrUX|V6RB89@QfM8cR-l)=(OHA*W{ivg9OA1l~Ar=CN8n+(<_Mc%zDUjllh$1+k&t zbR!tG^zYQx@LKVAy_+NkpU4%!=IbU>3AmcCiQ8}^0=$eSVlfvHV`?_htC9-=E}ImD zRE$n|qF+0kGY0+%bt+<|z&9}pB9TEX7b@CtYU`b#*cd;pJE5n6;9^Gscr-am83&Lw zr^fHw-8@{bz`gZFdbQZ#^Ts>HDasF#psAW*HJuMhzWj`r&WAK>zDJ{64cv#a=q>PS zbRUTzeB_0z#c~Owq<*Ewz?en;Di>N%FO1>M23snTk6=~O4=^cCZ@>Ji&|TvtaxRl) z4)$avb3wf&_~zRavXT$?G6A<#me@}sQ9R;W1QZ$auIE;67M}#V)1jm$D$nK*Z=_0Q z;Gn-JvxiF=q3^CdQ6i4O1v-kLXc*tF#6%(lOMOqBCt(V|Csd)dUi8Cd2re(}!B-+# zgM;0kd7b;_F+F@<{2@KQ3_Tw+hIcfh%f zW{JS20DB|>qt6mZ@-&qZ>$GxTf1g4F@}3E39?3#3<`llg*dkPkXkqHPm|@SbcF-%W z48#H6gkGXw8iazalF4NfgAZwU2u(EU`WH})wnN^gk<>egu37c+tzJX{7j}2Z&obd% z%#~gg31eNIIaHXaM^5@p$VvW==E_(!SOTA@u6zRbHI$5^&V_Z5{EJ-b*(4Nk?jQ=D zl8{rh*XV1nW%@A2;_NcLiUqbaY7eBoS~GxOQf!aXF8Pf}u>B5Ydi^pur|Z29vBwH! za&RN*E_ty|$jN^~$v;U)O>6i_^>WnerEN6>+8j zcOs%5iqlT-!UPPocff~eBVzT)YDV`W$f4H{%JiX(S>4lp7{wv>fVw19G*iru{G&)x z!D-yTiCH3R3ggcKc@p|iEd7)43l%;f>GlPjVmnQ&SI$DLIqk5EIjXp`2dIn6zzu{Y zqkP^mlz!2I0bI$1`oRdBQtg;)am1zWSn?_Z?^tr!?z{fu&bFT842xE8?Udd5~%;s2N^n`$$`AgunNWm8l_QX_R zH>CuA5(}ZGP#xYQ;U{Pwy-%OVVhReemCPFvi51%7pP;1|^2$rUCMzPJ`Xgx2tzfJ> zf2m>>p>D=Y!7J)3l_r8!XRg-blZYf1=ata4_>^OPmqq2_4idwZ$@$^{0&DqeTSGyPS#JiPT-HrsQ3C}>}p#KZ5lV8 zPXClq-~aEwR7QO|=nTgCUJtvYL8t5WMuF3peqRRtL9Z)=jysfYARJft(s!iOcc!DM zGp0mcPZDESq?(NSv=elsHg<5d3CDe7eR0Eon_Q_P39Ce^%6Z*A-&FXK|n8k-vbs2Pmn-2IaCPUqjuV=UN=CF0J{NlWY`Vx5*A}OFs>xK34;ow2E>qOH@P`3(r$vV zRJ(=Yg6#$f%eI>oOT67g!3R?&1Pi%a7)Q?CLQzq71H+}=EesWSw=h)Z-NbOQca!5t zzFQ<5@jI|o zdj_TBEs7%`Z=<-3yiLMl@)pREl(*4Sh2@Xs!;+Ujnh7p4e=G}FYW`RT9Krcxc`#(> zk7dCXpFfrlEJ1%f16+vyxjaxg`eS)8MCp%Z!H}l6v*1l1ON=2?Z;=eKdXt1D>knWo z;d-0Lp(qo}yO&4Cj4CdL-Jui-4Ydz(f@?`;m2zPCYG z0KW#F)TuDU@M|D0iEp7?VSEc`$>ZBBLnPlqajAR@gaz|$4wlU~L9TedO`}p$hd5kF z-=bkTeVcpprEtDn2Z?mu< zzXh^n`D-jL&R;`uiGCYJh5Aj7A=ht%sA#{%v84M=_EZ7?!?~a`{)cIXnE&Anc#{5y z^I!@4AI<`n_dkMjME(zF!I1j5Ge8CZEe@CcH$jH@zXie;048^$5x|j5cy<70Cb%hp z#evoU7R56NFk###z~*4HfI5in%C;r5RHxaN%j+KCoqJ{!C$FUW#S(dqg z1v4xLED|>wsDZfMzyTCC9jLRo^?=FZ1_TzzupzKW-s6Ei1zQr-z*CF~p2-BaCwL|k zmPvt?5BPS2NihryOc1v%usM!-fyLq$1{TORGN|(`JA*pTFg37Xp0$Au^9&A5nrm}l z(XiQp&7qbDHisJ@SR~8-z+^cl2z3&*La380Lj)UV*dkac(;UH~QHul%V;CjWNZ2l+ zM#82EH4?W@sG$r41&ig{D400YOu>RtO9czVjTI~qw^yivsL6r}vaA+NlxMhLu?*V< zlVq4L?7$N&7-}SJ#84;Mb_}&FSf&gIXy$tQNd^ry7Po1rp$xNz8Vg%C)JWL4p+@5N z4Lg)$;!s6kD~BqC8ah-N*wq2>-I16n*(A%@XI6@%>_DiFi;!JuI42ZO>4APfYy zfiNi845CWGmJn44H-@NEusuWtf=wc-3~m)sp*V&SRSdO_s4}2=L={0TBn&2njU*}< z%TA)gp{5cQ1hBgJjrD7#wCcQ9&4%6BUYKJYi6{{X`Yxm{3$W*owkn7={!E z2isB@6vLdN$}ub|su*rmQKfix6;+aHT4A8Db%jBp1{M_vwy`i6*v!J9a7zmVLyaw} z5NvNzffyziRf=hKVWAAeiwcR_UQ`j#{Gx*JEHJ7d#|Wd!aqKWE9BhhFWf;~NRg7bh zQQ>f#j0(gt%P=s8Wk!`ljWenY!#<;maZEI-9M?*t!s3P+287#cR59FKqe{UR8&wE5 z+Ne^f-G;&N3!Q1bQ6*smjw-~k;izCNGma|9v*f6d3}X(1LhU)K5Z9!`U}39{9mO~7 zut0`whehJ%9W{_+;bFnBk%z@G>^v-zW$IzEY-dz78e=xjUE$Aei}xh48BxXhdQ${5k`g zl2{DC)?fxDCUU}=op56O>Wmqemv&>3q(y%OpIZDVuBn46pO@dPz;b`hGK#&OB4gejZqAYWshQ#43iWC_o!f?Bm8VH)Um>kQx#YABP7ZXEm zTuh2%=3|kW$$8;u*r)_!B#I81{=PZ9LM&>AaU~-1H&y~Obj-H*vFo-cp)F#HFmY`XTfw3%O3=%btu^`+&#sV28G8PG2$rv2NP-e?< zZDlNqVJ>5mT#Ff#W*E)bAnS!JzUhp`q1H1d#xS6zIh-0F-Esn|I<~TNoTI5(9$0)}{QM(+Q zDok@K*!OaJ`5J{@clKlVtlR3ff@wPYA(3>jjsCOS?Ec^#v3uEa=5HtXyp)IE9sK{C zbK~&zw^y3IEQ5i2%Y8_}^oG%wWC9g;7+o~AA6chnTE*0VJbZS?y<>jUXLPg&+pZY!55u?#)(C>P#=lSEoVB8t` zqv5zW9gW7mGalE4^J?xe()9$9!EoB?JHucqJ5%55_s7ze-BI8MR2h9&4m>I3*l~y5 zvD5F%P9OtH=W>y|J@ z)%~`=%Q2h}!o=P~=Csc8e=OpE@AHVNw9xw{v(PGNqd%=C+-xhs#r^B1ws2~8N4=rd z(r*^CZ6fWQH2BeJxzyh|J3FU(+Ok(DQrC0h_q@ho_s&`_(Agg8Uwgjj^c=4j1jDZ5 z`iQYn)#>WF>z`yI%ZsKjrc>!>(hP{<=I)ILQ%McCKOGmYO&xFAb*E#`6@#JIpSp55 z4BX*J4!WIDcQBBh{-7@ce=MiLK)Ry#T)o!ZN22HTy8XcIcSarQd%cnDjRP8RoDq#a z-5&LWgQ4&E)X|I_&kv|y>3MzEaXr}`ce=gfWp_tO`@H_{CaxnCOcOGZOBWz$g8;`ic^ zBAHQ;6K9Pu-a^Ic{N9-6v9FI=ey`o#F0{W}LKUp>xNVaSYLNYgN*Yom5%nvLrPwqm zBFLj6Khc;UDv0%5#!n}(JLfQ7=PX|x;Mb>yKverN1?SFT3N|2{wCL1eCCzFDR zRn|zQEKXglR#E5+omr~?rux66eCcZRPQm<3qv*LpFW;sRabP0ZTx5+^qI{X^Bhj5p zbNxHrw?`3C)J(T8Y5YzFP31gSc@z|fU(sFCSF)sk5|z*9jdhsO&zYvepvb&sbzhRo zN9%U!dC}`vZ$Dg{zhA87+gAsM@QaVHo5RuY_(*oICGe9<_EwV?(NfU2j@3L98PK&K z`a$`N&4KT8FORca|8TTPUffS6^%K}1$^2fQdhcH9b^GlwIhmZ%T%`T-{_I`*<;B@$ z`{wrSefz^(`e$4-Ga{{)TGxB^h3*^g?|f!7bg_Q;Vf9iQ_q53TnDq@72km@{&;cf|Bki_ zpMq9BzHK}0w3rn{yTG&UZQ5?D(>}^R%GNT>5?N4myrvh%`rDXhDaG;ihZk7OU}rX_ z>Du?oY|tAVtu5@lhU24s2sf|cu-mOo^H0re)Nw~gEA+N6Z0Uij2vCbW$L*Kzc70>B z=o?$}Y*~94VP#Q_T~B%3zJq#KnlQIw>eyQ|_1J!-2#&&|OoS2GucpOZdM$Q^Q8tWP zYv{RsIFnhJwg0wyQOq}6^v7St3olaMU#Blb@EE2lp(wQd=H1)#i)L9!oldv58<&^+ z!zvPCeCjduSgEUpJ^&TmEj8;T(ARC1;?arBjozu4&SmgQKhN74A2&OrrZc>AI%nPC zS*O?P_j|wDabKEUt3U_77CCNqdUxHyncF+-_FK-F$Zsx)J{!P~-LYAT{|w;&4B-FO z0erpE{Z|L@V&I73pfl`Hu{o610{HW7tolnCt5V2F4P&Zf#$v&+`6*9z6Wqp!6z2uOw<7k7VuRXjpO20) zcb^}kZ-v*rk&cO}*|-g#ZpoTTPRF`wR!|h#mBGBPn_4A0rC3u3)VtWb2)Tt0q06i( zmQBq|B4`~3*}S}{BFcXKWfiF~+g@!VKj+$=PA@)GqGZZ8C<5^LHeA-HlI|~;!sDl_ z)lu;CN2LOx3l@!l+H@Fi^WR-WkvYZpkw|9x+Kaeahu`}8OPt^|r)Y@s^@;@r`kST= z(LQ0QwTNR8HI|ZQm5bta%+m>e7U`ES-6w{OF*>0`o^vFh_)@nzcgaih-J1`$)Y(GezC?= zDdTXt5`J;{i&(9{=i))vasGXa2mkIxf_Hk6;GJG1xUDP_T()1HT|T!+Flddw(;@*H z-4BM}A-b;(1>c%PcRSTtv_6MtXVJh!__V1C|Jl15-L{b={VK%X0ZFiu-25lK7~s4~W|F(C z6U5HV9bmv{vYQrnBvMOKu{{{vv+T3%lU-GHlcK2q$WAgI?ktkn68opRNq*l~)m6@= z86Zq{+>w6}Og4l1N`GXz{?RbG%Z_`P+{5HYhsi6O?n%RBDTByzTq&H;jQ|SAcI-%- z!M{u^GVV(@5e4Yt_gz$Q~*Z351 zkB}4DiMrhcjP-X7#KwT5C~gDp;K@CJKsht2Ldsn**=$hqv>8R70TRmz?yVqZ1hA7y z9`m943vMDkgIsk~BG?-MZcgJdwHX(@9MeZFR5nshDA`N_P})SIJ57PMUts)%mgOB@ zlUAx-f_@yckpt)x+J{ugh+{=mut?o6fV~?Ej^QOhLn#m|k5d4ca7_#|A>(21V4;y= zT;AsGR*VSq_K%_Y*&K$BQwE5P;{xyteS-mOrxbiE{-tg$=72O|=M9LdbQp(T=Gud& zrUT=YcYsb|#gaLJX@K}QQu!j$MYkXhG-1Hfgz#sGvy$X!Sd&1P3>szb9- zc7dz415<##$SUjnpN4S`7wV_~GEHb)oXd{QF>IlTe4_QsQ9LMxF#n+b#}#U^hyT%9 z`tWh`PQHQhO`*X-AvoSx3@f^m;^nKrTJQGF& z6lRp%%5*A=|7h*AFK9o@;N=v{6Q6soD_nPI`Cc+~%tQ_&*JZ;*Mz)M1KwzQS?&|X7 z-&PJu*WK0g$M*$&dF9!%)s!oj>u22SW;tBI*`a@=+k4wi-JgRpd!xSffE@J8S)^y0 zn>pxi7D+}rltem13%H8$?2pc%$ zSvzi#e7bpI%(FC0s}$bYzXBVZ%4uHUIYussUc%QBB#E!iFOZVW0QPKmY(Fl!WXjv! zI)Z68BvYR*R4nu3tFy~9avP$jnPa9e?Zs7}D7vW*YPRQA)5@Ai8)x3Yc=`I{<-mCN z{^h{9{IA#li&ks%&9PFENi8L`vR09fu^on|#Ebj4Q7-qn1uLbMp`mZ^5Z zm$GGNcukT|z18{sSBRnqhhdh{1m!5YoA8d zSHhB(slc!X!1ZLlTQGZ4{Z~LlX*2Snh`#vXkc1i zFB)tT4bBe{4ZM;22NVsqQLJ7x=tYBGG}zEaFBv>5nv)i z%q4QuG$XcM%LPEEZsFl2?`C@iz3cC)=;fb3zIuIq_Tj_p^H)3Bf0z6J>!0WYP=)at+^R(%Ne3LUyxqP>B&7aYaOJAj4)E;2EnaiFYmk&leO$^}g> z(_f{^orFhnRbSZcEiV^iZhXJmRjzX_E$0DNnTzYA)ab_5G1_#hx*Sk4;5udV9r@HL zW%DG5-!*fQqnnX|O_Ut3MJM!_qeF^@r0M-{%CQxr(<2k zd#V9nIllb+Py@EGp)qq|N=+%HV7w@44Y%%O1YQVmYd>LQg_~81^$u}DJIPx9% z{x>7vt2au|zI*ol$n1N~rhC%#+mE<#1MY!Exd$6DN<2>h_fBkX1`hLiARVCDQhH$a z*tVI+qBwAUCZ!YDY)3%&d7cetMSfGDXZKZpfo{=@H*bHuy#CL(7yrX7(>8|cj=8C} zyL2h5E(PM&q2ir(8cy};<;Bo3x|wKiQ=rlf-7^4}=YrCJA?1~K9Eq_a>nUdN9qddR zyp#=Xaf+CZ9;?AptsYAGmE}flg+)AeeMq^Rg%;YyVrvw1eSsvtGg0L=Mye_#1yLi9 zyv=onU`%_3G0krkjb2Vsj2WtmJfG5}DMXtp0i^{n+&t4F#A5Vig{4Oom4~h}u{=St z1U!@~l~hal!As+{_1CvQ4Jb2kS{WGl{omFkI7`UFW2!MNNfzzrM8!~xU z>D<92Uo3`Jq3ohkzcts9t9+&LCjS~B;rSFlOH@?3+A&S?vTn*Tm=1!0?tCYCKBHuE zl0wu;RH2 zXTK~=QA$c~T)z%lDey2(Ua4ldEX{;As{#eD7w%X!=jBcCn zg$E3b-)QIWTYgbCK2(1Rho*aJny9~+)`)rEE{FW;7Vq_!UVnLH{bkLjd(!$#7`ZYD z9ZQN>gb7$RDuOMh8nZ=}B1 zQi~>CUVo@0v()s{6=asC*~>A#9J5u9SyoFPRE+5=JqJiJ1WtM>rrT35#cY&fwlbbx zis_}8UW$2;#(F8{k0r%y9sU7Q%-+Xpj*w!kjkoOgEyXAsA1B3_;Ww0GJbzVP>6MsX ziFr&VW@XPkX(1*`q=5CbV^=aeumeljzUhYvm#*mxS44gyTv(luJFpxf=27IX6AB(k zGjhVtO|>@30j0Mqt9jJqxZ89xh0ZPLa%Uo+!gE`kWd$%#A9$0Ry!dYn{2kPNqPKcBcCG8f{1EI;GCnkB2R&mK-H# z#58+~L{sX7aw&I0T}7~&e^tygb@oLGDvKFVYQ{L9-D~xOO2{c?=1z(soocy;c3@8? zf)17_bzq=m5H%>Rt|+-;c8`plQVN!oD3a6#YH~iAEU)WATTx$*@6{m}lmxJ#p;*c? zd0WsEN?}M+Ew(_zg+Aj`+e9cspi!lkN@`1E zy2R|hHfycTkWHaoFvg;gA06t^i@Bt9q**+flP-k&djZh1{Uibl=;pHvXQM<2fIV=O@Yh zSA01P>BTg}+m!BtBWTQ)Zue#}CbaYwSj-Wp1@I{X{}}(^G7kWN&jK$>qA-@WfCroz zn}EhVZpM*oTRh^7A3<8sqF=yS{7WP(-l=PkEbALmmVosY!RiZo&hnKw%gUyE(xfG} zIr9@=SfY z4@$X?v_?U@cH(ty7umvaBcqcU;NRbWeESpdC>Y$U%j=IH&Mx1O-?x<2JQc7Lsv7|B z&(AKeFJ8a=^zroz<)P-&a-i8`op`>~$K~%*^u^u-nlGk0U%RF;lw-Y36ZC2HCLaKL zQqdz!gayHgYO~MWZx&5PJ^%qRG9ndj zFqI;u)j_i$jmoozgmD<@G|DHqPhb#q-d;7XVLa^}z~`6^eyuI<7ZC(0fpelQ8^#Uy zEmF8#A$c6TPJ!ROnHq*DC-O5J(_N3Dz4RSZ{U_EdNpc-*%p7|dV+Q4x?8`7|x{MPMj(StKd=lg~)_hLN=jUg@G%+Bl1l z%2q+$)MhqFdF6Y%I;gspf&+aquKCf(?zpu zE{VvcM4aR_M}CyU(rAPZEzoFV9@7dJ#eAm7b+Y8{xXPwH<48(iH0Z5ZB#EO)SPJZ= z+egSUMeaktu5ZDy zRtQtKwa$Tu&yK51sqPe#j=r-dPP=i_wQmQ}_=@$qK4=Bgr+}Ot+tck4n103O3WeZ$W zMlrKw5Wzw_Zs19!^ zBrmC0X`LKd3#j_^Qw^U+TiMpxwoAXhZ>A}4TVq4)K&LwL~YnMxU`uV4Kc;T~?XKhzQ1c;YP@s^lOSPd88SEKnOM%6|o zu^hIfT>WajeszXtu{e0CE*|M9GqMQ=e5u}bf??P;6P*E>*B>cEK3~~LFK8T-bebyB zzu83#zE{@~emJ;#RLbIBB;N=oS0Bm;fyu3xe{UlB#-muf;hvi3mx<&)rPj1Y?4a`m zcx8ABuMsmGG5;vQXR@K=yK7KdkN0}Kw!SeIabUo$;4mZstumZt_CA`FT&3G3m%%g72hXo{T3MCjX zKYUXDZ3TR5S_-~b2GNXB5TOPbIHp8cP?|(iZz#u$A z>eKhysbO~RAGnLx2!IV@G7p4Ws<~C1Wi4=4eF`5i*8KFM72Ew`4XUylt#27sZ5r?X zJ)iH}^Fx)9#3QnIX*9}Yby8M<=1*|v4VmEgqj(*r!N-|?P64qf^Nb$5JRYa8%y?T~ z*B|os|n@HugCej#bn)AIIINg}sKd0}JoCx}G|& zA)n3EdMK!Re*%xm8Ny7*g!euGRc38GslEfL)}uHCsG8=G*+XVsTI`g;|IHDz_s;?E z46X2znWv_GYS|;^9EDQ@_`~m>tm}bl4^+QBP+hwt2 zO!&f#6Vq}n&b%myEf>Zjy*S|#p2YAI^SJHqkT2(1D@eA$p_UpcHs#MK1pHc*)ir5N z<#o&_@%1b(uT65a=4E9=FB|DrSNMY;eXO55NgmHj zdW=S?I5C-TZWj6epS^2sZrjMRe+9KuTVrpD6wqj(8`?_kDv4*}TG{bR&gP41GYxb@ zMu`MD1Sv&d=C{wiw;K;Wz=tS19$8bVu_O}xyxlnGKKH|lo9^IFBOrbN>Z;*Qxu_G# zApC=~Gnvf^>%ni|g*@QBXpt=UO#}Fb2ey2Qxni)T0ek@0#3>9V8Ti5JxVrHHa>=d9 zWOm`k9h2GzIKmqd-lf}tBUV<#Wym9HBCDn_Jz&-&bNWBPHF+E*{(mjzBQa_{Z2GFp^$SdWfvH~sOzjcQXAM-7C<(O4GnplR1e+fxiiZLu*UwcF2p*~o zkf}*zkjFaKoCj$T=Y9}j^mZEWa89-c(wl{vVMG>14%sXWSow7;=tQ)6f#?#ZNBX`_ zP7HYd%zI~}i`wRfb+LJ#zr zb0K!Ets3o@HIvq1*f=+1JBk(EL@hrmy@z_pd;^Q97l-`!xV~!UwtZ290Z?FL&|%_`RUN@2S9oso&?=) zGgPw^mLPKjT{e` z$BIe)*5KsZ(z~Bvez;6kolN-%F3p`9EmkvHtV2rZaise&WrJ2LgT`;x41^Z#t^lAq zws}OVTly2McD>TYd`Lgm*%5GwzcK)MBo6FVe||$|NB-5zB?t5uAcVsz{{?=TaCIXMVIJ6WsaL#bvG1v$+CnTsQ@#v~l=^s4%4a zk5Git821_6CLn7A2)-_WxlKa}uemSp!}%o)^BGlhRH!~C|9 zetE+@;L_t_(tGaTN8r-_kn+QE>CwrF5tsI>aJS%6KlXX-C;jDi_jvZpVcOnx+85Iv zma}*r({izYT+}kAWk<$E)iZcWTUw7a`@XNEC^MOfWfFqLRWt0MUN# zsHA6)XfHNrUD^xLvd>%wbsIE&Y$Dj*4Lkyx9-USep=rO~_1Qqv-gVj+njV(db{(2V z2Sh?GLsL@J9tBO4;3cnZ^S}!({fcnux@10UP|9@}@-U3U%!EAFu?khnVW(3S2*whT z_!;9|2ob@ag-On&mRt&{RHRs_#CA~n5(tHXP)jjTum7WodRh*cFRBW&6LbRQT`WNt z-_|A2JgfwVl?ee(!;Lgu%uQ3H&uVm6fNkT)L0Ll0Cv{iAa!fKDxn~Q>*+j5)5`n3j zV~V9G!oy!-VAhvF%g;J6tMyB`==vq>6_~~T5I5SjyZs=jyzS||u`OqDe|hY$CydF> z_E3OHQA~k!QA{B}7+>-bQ$of3=p3K|^MbqpO#8qK!2B{fK-Y!tS!2f}6MoG7Ov=op zk%Av(pmX7;EYp6J3Kmhoyb&hhv5e5BA7n=AJk_Bu`F=S-HPs)(xZ7>b9s9wo=rI)Ro5M|E?0W zt;g&N#$hX;)O2df`r)R>IaU=Q@6>tU5+Jy2Gp@EE*VU+=PDkiFP#4XEW*+L4QX`v! z{vNttOzS?3zHz<_rkDY!yfIDrtkM)WpI`^6(gA$}(=Y|4$hVoQU=CE_Yjx636&S^~ z#OdyxcJojid3f5*_uGsAZUtKK`gkIsbzm}hCQpxZ2;F$0?hn{@J$^tkc)70^=rQ>_ zA8V;@=6MKKb6Geg6}b{;fgDErN1P{^6^R9BA;v2VBYt#|D?k7%Di?eBHXhs`Va?(w z1njb9#vQ0vRikho^ZyQq(NGM6e^|V;u6*p^J@?2HfxeyrJRbMuCeJi#Xm}=s$i-o} zZ|gezrTBfzm%~1gnB!xQLx_>g{0zvA&P13qA3%hZd8C3Qkx9%WWfW(rNy2~ċv z^Ee3tmPlqouGW<3YX}iu8IrRg6Fdk2sK_v5Ce{WU_kA9kILb`S!q5oKRG=l#w2+DN zl}<#?ng65+af7HoYlIj8L(!qh@;LOd=AnWL$(TL+$M7OV=tG&$EzT>jc5DSR z(WHi(%?AjnoXT=YrH{BjX}S7`?KTNBpOQm>&2f5NIv6=MIP}V+H!0PW zYL}48BVkH>mpRoTXbi=2?BTlX(1!*S(=x&TQ86Z}73L79%da{!H<)_>=K^T)%(IX& zI`e*BA|IE~41T90EN81i=4M*eJ5(2X!Xj7ztjAa(YKo$f&(sY$>7KX=Sh>K*-12+l zLJ#Vddu0o=A%On%{Qbw@e!YDA@y+Y&vasp(VSHvbda$m&uxEcX=5M8-Eq4qaPKbEv67Y`T(e3QOjqV(s*%+vvL-Ub1* z$Hqz%&Qrmf8Z{fi>lPMcguC@HfLo}X+>ek|=z&7mSB?7IB>!Ypc< z)YIq8EGlC;NrlDFR*DPIplg2;kVw1=seo^_biU~9Vp+Co4nWd*RJ)BnsY{+wjVv># zdSE2iwVO(+Tt#qO-V650l}KogFSdt|cTUjIJGTYTsH)b6HO1l7KI1d$6xRsLtO3-= znsyt`HHa-xU6bPo@)P8tdXd?J#n9|Xr3Mkjb=llpRB$<+=m+W!pPW#+ya&8XXiu;g zDt&fhOVrKkSz$>$Tr4yQjerf#y@4$nSI*n@ENP@;qe?1Bonm!5_)*!fV6`>aFneAs zjke|PF#d8=&55>%gsUBavTSbzyYWu0OUmxt*3HK5 zDVi3uMY|$taHe3Gwg}w%nSxtt`3@#wbTziq$>jFdn5h*UHQ#(A+w+D7o%ULGwcBax z9rkXO8TKpG9iH}OL3o9)O9j28m4RafYkqZg@f*t1tJf#=Gkp(!fdz!$>@|X)!EKCx zfUPWHd0xHtu(mt=9hN39D0eg|G&*xa^#T=0#6>~lS_N>pscYUn2y}&{aFbPa*>Eb# zQIz;%1w^yBxxoh0MKRLNxd((w_lkRHc~k%F4oPzuH=M&(-cys~J!x+#=*dc6bz4lU zRbfH8Ff(XdgB>6#hB>xxg;oUU5OgkAja;1cB5o)pzVb4wVo~-Mp?xdnRFx6kdHoDFu7BsZPvZD4<^~|!-l^%HT}X~X#1JfI6rN%>~*YnE1ABZ*j@(G2JijT z%b%P^;!FU`>aBgU&+{Ve&-=G`F~Bvt)M;c>@@q^h>dW4&GW+Dq-q8g4q!xDugQ?(> zBJKotD$ov7ou&_`eCYS4DMT#}yttjR2>KhOMTvjKEd10z{_x#?)3+-=#8WaV%Ej;0 zX5gQmU(`w^+QO~r8(kZ8HrhrmFZSBR8@QMkDXpQSUCqC^IK})l@#8G_O&(-2$`tp3 zXeU7&n#7lwt1Lv*5KDNkc5ROy@;D7SXH4a&9?&X_gOD*3hVWycOd^w9#jID5clV$| z32o(Ci-PC19k<$e^% zAYmJG;oG#HcH{6`w07gQBeYcr)}D7~`AsWGCjt zow5(2GMxWDKe&yq8w_e*|FqwjHhFLYbc3T_o&Iw5ejwrLL2qRLUQa(Z^HekRN2q+0 zTII`zdux0Hf8a~ZG0Ob2C?5L$vDSGGXXZuY`=asv1~k4KMEzN7e7VVe5$R0Fk%Fa9 zln8|M10DN*lK6%TUj&JWSRj%(fR}43GM<=FflT;@rD~VPxA|eSUqDfsJTI~WndATd z^7aSM#lB;Wm&%OO(Zit{-p#FeYIHM!b^0`3sfiAxx|pCQp}H=~gl~&d;S*Tb5|$Jw zDB0L&n2QPvzb}Ym!VO>7vFxO=`lKqPwIE#@8Z9!XPxu}89hygl9t<4=@*PiHj8pVc z$m=2JGpz9B-J*UEDY7jRPin2&ePL!Y14GpHBcuV`q`^I}OIOjFkV=+#ywhPs!0W^g(|%3n~idbMGPDIdahN&OY54!Zhy`R4px zJxO4~HLV5IU|?w~>voLO^X?0H!`xd!cq|t_SnU06`jj4Hd0kW$*=Mn=c=l z0b)~BKFrxOiZQwulCI1ZfTe!xxWK<*lYgUy{2pCH%3``0sYc;xHAxxygiP`rH8LmU zSkf)>3q#19%>j1a%*YJj&YAb~tMdQZ>(10qTqQK@Vz~+&>Y{5gzb>uRT6Iyswxp{N zsbd6d1&Y)7QbVg%;99jxz52Bn9H?SBw0JB?=~EPs?bC~VA@`O)yuiaDdWrRy`az5@ zWZE}csvJ0^#6*v9KL{29--`hjsZa}F3g!2@uI%n10|W$=l8I2|T$?BjbDskf4wRq6 zi5Jv!;Q$(Mod>!>uh<5+x?a?8Qc>G7c5|FN6(cI%YgiR0P{B zgdfIy*y|&|-@w59Noe4GwIBRi;LOshwv>ZFD6+0|2Dg<(nViJ|og|^^UGHPy-{IV{$h_*ftE(uGMDF z*Ma8fdyVvA3^W+WilZi6Um*KJw{z%uR-)s_rmkUTgLb0bfzwKkDl}Zm-h0b;Kg=dDwy_)P2_>_(7H}sKwGnsPipw(BW4;8bN|A5S zG(TGL`LTfgH&Y<@>oo6(-QQzZiPX%2%zzUXGjzhT?jfxf1Fh~PYs8eTcEk`H!v^Wg)tnffTT$zbasy&LwHg&5 zwh#*C{sjCHl3^@ys}xr~`HD29|dpolVf0(LpPFC|%rd)p2%u z|Mu!*y)YjJa4ny}KQK2Mz=uJ^0_vzo@BzOq)H8pXP=>UX8fSklCW;xFTaRd<$b76uIQEmne=0J#9nkHD# zfr}tbG00KHGD{!dgU~Wefe*wyL4RtU1S$N1=YXZ6lt*FWlX+Y}z6XrVluRg0`k;dt zc(+hW0+faY<1FHSm>Ix&y*zd|5#PFvUxtYPk;Ys*{bOjn90HR$oX00;J|D*MvF2PH zfB3@VUwHht!Q;QFf<$QyBpz+LG6>=F_e1S-8Rr>SVH6}0yknxA3z@SdOtr`&KM*Q_ zuPb54;N}Y7AwThj$(Z>IJ-}^8^KHJHO`Z zk|Ip3{m+Jq*L<;S%594`&D!Nyrr$#NXWqH(gQAggSUMYBTY10Q*a`1~vNNG``NvPQ z$$UN{Yw#*7pLiA0glsZ>XbEr2RF`GQn$6MieA&R?7|9!ZpIu(yvUjz2erqi!e!1TG zy(;F;hdZSK6-Hb0tNVf@Hk$Un*-vLLCZljmKZjj!1RM%%0F2gmX0WLPequc`8AXUYkrx2mmAWq7RkpT<|H|gB9OfK*wW+`l% zDUqR8OEz9y11C?&`6qDFs9`5_bgtkSEl7Htc7SqeHKTX_3?2Ukk_ERXoxlzdhq28} zYZ>*@nLAnC-g0t}UiKMUtZ8L2-fB`7K$fa{bjbM8d`{=ZSfvJaYj+uj zjLec(2Ciq*nJcG-s)JPM+Dc-AWF(zaGoq4_1TD#2GC0|m5PrgC zkiuR^xlH3UTa~FT>W7}{8K{F;x2BTqZli@4{yV>X7h4P4<=d+t2LE@6a^ieLXKlK< z6{Lth-ZTgo0lzwyqG}AzG~$lwyX$4p9rAT)$K0AD5B3RIwkZQ=qhN6Og0=V>3u&pO z-9Op8*5>DeJBgi{q-wO~0!UEmb&J$CyX|N{%x|Cj z07$SOlI5OE#dZXA2-S28$jh!xg9^*_NM=thY$_ZgsO8Cm~yUUjD!f9xZPtd4u zSd+r>e6Y=&C^2OG?7p4Gf`{}k^xH9-!}on$cJ%a?lZG#&HqYQy2i_Ug>b z*0)znT~kYfXJ*MPtTTJ?9e4&l`Qbb21Kv@ya`I040q>-)3yzSmm`%X_`A6P|4xU=8#L7EU=@F5tLKz&OuI0M~2j!sWu%6%&^ zwbDk*PlkqoZR5#_9ttad;xr7Pz?jnK`J*`v>Ay@n^Rb}7-rO)B!Z;Apm?|!s+=?QW z5)S)S4rkFiO~7wgB5levR(rKMAFd(I$|kXC49Bu2)xs$7r}Hwiv8b}FD&tBfg-+}N zA@OBirbsDBayZT>Wt^+ZM!;%Y!{`}db@gq|2_Zt*P~-R z33KrnHarGa^X2lGQpmkPj!G1Wh(;3yQusNaO^|I(mu-Pmy%WyU?RZGl%O$+xBqrgw zynsOBU*`(&Vai#LlVylf^d zu)rE=q-_tFbB#s@@cjYq#Mi)qF?K*Wyu2te*r!H-dThF8VmGEC=uixGzO2?a2;@}6 zY^UAq)N$&!E$GDg(Mag0`9~F0cm3`nD;#%V%P2RP6h*$NQ2Gmt18$%gXWm-fy86%)TvoNslC zdIVt|tGio^60hr?vL;}a;~nu}LeT2d*B5^|d;S;Xp)g%wMXP{p2R$-PDY81c)+T)d zI4RK`c)!DtG2twt5JW==n*(z-uW|Eh7W#^ju(N3f1Wxim3m^&w4!-L5FFl&$arK!y zGFieqHm&vq7Ee#|3OB^ypt03%gFvY;jEz|=D5@XKj^iD0YrqF48^OEz64?|mwWulZ zZAXz&9XwF;s#w})Y5QwWr@)eG9yVBN_pV;(D$Nr*(Z7K`T(*ccjoEh{I0UB<9B5jp zyiVP8LABlD9Vr=7Ov>B^>g?KA=Htxrw!+ZM&A5R;o36lBUYwA6?1<`gG!O%YWT0cY z+G%06t`FOrABPU0vCJ^ih$v}ZzZFWtA=tgG*_MPQ*_<2r9Fr(2EFTO&nP`)aR0s-2 z3E?OVj7z>8F9mYrP;26(&_AG_czyL6_ti2n?jRZQn<#K(y zqWuOx01lQIR5nAAO@@%r6z|{AT{Kr!t&xM(4$Kv%^YLDC!t9!naOUc>^pzM_DQ>Nj&@)G{d*AtH!G6BxnRhrUeq+2@k4u(gpg144s~>4V+YRu+ zb3+tW@3d?q=UomJpKw|kSJtA_I0gaDh+4^GG3@Hyz*1ZKdF3|Z(tb}n?+SCk41z1s zDgK5~PcrJ?G-9U=ir2Q$s8l=*=$-TH5LYp=jF_8hR0hZC4Asltp*wrVja8EzbN&q`uFUhsXa`=ne$<9b*75{CY^ zWBO+B6&WJ!U~PfjIh!6}ZmY7kiGYM7Jb*b^B?jNDXnB%hY1|%Yd0+j%{&<5 zlMqkF)nssvk=)q#Oh9^$3OK#P?sn6dUUu6-T)VMl&uH2wHT&-+G8LbLAj?bzE9e$4zNUQ>iAGQfej2_<%^S6#T+QsiZ3F#OPFu zvaz{}8&xMlH?hv(C$WhS5JV{}mDVv{L1#^7q^@(Q0%gvs6fwnEh(@PPwil550Lhgi zw{@JExGZ#@)`dYm7nRtu%1u>EUFiyZVYxSv(8HMJz0>$9V3yp0Lomy7R*H`zGNp2+ zvO^V7a#e`*3AB6yEx!QJa@*8DYtYhERjh@qlALyOs(@oNSF?rG@GoidlXT2gO=;owj`_Pi1-2S)1ZW(3*UJRTR)IBDo0?igP3m^tyzFpOXCpAIJLObw6$yy20VOBWT) z%9@luNN>_~=&W&vI8lqwi4#Tv4LYX3`0N|2UEOn2g9u6(GeWYN1Oaj=(3o^32*ufy zPUUD5DEF@ShPm4sFB+felt%=S4GL_5vW{F~yk5FxI8^krWAdh*m}?mPf^jq}e?AJG}mHQh0cC>e89{Zhk*q~;UciqNB+Z^m^?b<|p;;Jb-A;bwhHeOIg+jnnBG?!s%6J=awQlUXZa;KEYTP4OMoPwS zzuB>UU_!D{S9bTTgmH<(MosDHZf&>>pQ66__x~|q$tM-{wSDq^6buks@Cwo_%S_Uk z+z8b)s!;_TA}d{$aiL_EWGX!X%19L+It#6`BCAT3*g7#;n&wHNtJKusn-l{4&I9OI zSz0Gj#Enr#rHPcb#Pe?xXGRMlv$D=*Y4dciw(AF|$Cg&xs!^t{v#gA3Ex=!@GG#=P z#EAHm*c-7oZ0iHSlKZCdlK@Mo0|$U5Qp}1X|ClTyLe66KFThHk!oHrck}m`+`I5rE zl+tNa|F;Ia?)TN=LTilf=X@sD(U0Gszy6aH z(fR9Fboj6BsQsa%mw$c!JfdrHm$nuIa^@}RY?u}UqZTe3C8;WUCd1g}9bKG7`?5Jt zY6}~3P3b8pwoEf!fp3lx1Jax_dRLm}a2|YelJQ27$1PMunI`MVv#+T|r#o7-gZvcC z1$O$a8;4*b@Y)mub1Y@u90&^3l?~!j$7NV{h-h9qy!S;(pEb1jj!O?GFTj2HMmH#r zMLE#*M}&ji`*K@VsL4i*yx97PQ6<11&@QFU`0omMw6n@jj_zl`upkyH()bjCl~ zue@d9VF`=GNIbmjzifXX_R)(U-(XPKn^&*i^tL}b9z`%FoUk?ddo?ba;LY=&e?=aX zd~+)W^c3leBljsf`|*OQR5S`fmUQrioTq+ohrQDsGz2f{Ind2b=uj#lh)8uo;((h! zoSp8L{ZCj7RLhPTa5GATK8ChcZ+17?at2Ridy|rBsC-B-*c`dI1MD@HQkIgUc$Z zQ0-p|Sxc!!EJS8xDYFC8%I1|8Rb`aSW3BSsmZr$#EU)w2AmhTSw2)fa1NbPVHL)%< z6r9N3S3sXFVPdv!wKsGjsQ+$g=bB@?} z6co`$V6WQkpj?VX1&O}zz)^77N?2DTI(v5ZZB)%~(NpQy6iS4F18}|_&;@tIbyAV* zRLtLWly z?Bk39dOC&0#Z%OqzPfC^K;(mpHP8qOd?4RYkB#FKJ-8ll%yl}gP?G&^-qU^T&N0Gr zR+u}JUJid#ckkOFz5oN_h?#(w#;A&d6mvZA58nGu41_LK1C32gcS6G!R75wOOLy7m z#WH){SXeVm9cb7~(fEmS9>Nqkk#UiJjRGl4lm&|Z#+(P|7`;Z%5kHpEPiqauU>R+6 z(cZ3CTcFBC8x4ch23Ex)scfa*nQ|sGu`cky(7XmYQ>T~gXP(I)V-yd+M3Ek36zzsx zfd8bgFoP=i=U#dSJ#UJz@y!_{o}vZr?HHDW{$KcW+g>61(K(U>uY?Wvh`m|%eEIs` z(M4P#?>%?PwhV=I%y{vb$EJz%gkNziz|h)_H3C%(x~L3c>}=c8{x6R>fh#xY`Ofj? zn>#iF8sRuVUtP=|If{B3IoH5Z(z)km+i0#V)fII${`Aa18>N&rX}g~MRV{3yZbb$DCX?HPVTpJ>h%D*pz6#( zOWI+k9(CGjRQk$2cG)_E#s1L}9N}OWu>w=U9~V@j>9+>SEpUvFS+H`Bi>nG7wVx=l zFH&SvOX>Fj6>!7*3{Ztnj`VPV&o9zEE_4hh*dm6*Z6TAqDT-PPnN_B=wM|4G%lv>W zH$n-6LNhg-*>q-YEy0CRd6vd?Dz(yiuC*x-O8cu*Rg|@mN|z!n>ohl6*2p5O8YOg* zOPRn4Q6A6-rJEuKKg#GPHVPJ4+*HEC=|68I8hu)dxDoqn_%Kvq?=*fYsKPyv;s>D$ zU}ztMDkRA)RR_!3 z>q!NZ6vN)P3_5}S1-sILP%yFP;lxj`Y&3J4m$tVXRzke)2h3!m7X&T#Z|oh9$#p6I zeX$tzhWkhB%08tT{gl&;Zhwg$bu5=v3j1>*3Z26zI*IEToPY#e0QkC!y2Pte*xIWD z(u~I7yNE0<>ZCMrT~%q8=dw&qofTDHiA=yJq&z6iXe!G_;iW6MK(fY2rKC)1Q>i$u z^U|h8UgdCBIDprl8SskW5ToD^@cjdKuab>5@J%eVY08|WOVd;w;Jn;7jeorJ@_VNl zLsc9{C-?fOXgbih!@C43L#xKLGD${c)~ zTox643mReaq$pFJBv~%&CMmL9WLlcUngV9);0skknRmp-&xfTPq0HW*yLuesdw+y^ zv*@~dBO)0?moW~J*tRd9{qpAghnFv(o&S9C!^<}p-*R+uPxof;x_QkfUXHw^d#4ER zyhioLu@|sGhLNK|#3No{f@ikVmD(8$-qT53N3Wj!eDUfTHE?Je=Q`xuzCEpHVl4+; zbCBk=pdh~>>~ptzg)C5-BO)le(9iGanV;4c2K(szyPu9{(M1#V5KijWOUdC_UUv&< z^x66MoScKCE3xNeJm@5JHVgy(M@n&^N9==8N|F{!0;go5?|!#H{8!(dN2L$~T^)8> z)R61}{}e}mm;Zx#IpGz>~E@6!!BDJ_X%mel~wM?4|wCHds5nHz9jsX(LaY=7HP2195Oa zkvA^e-BUU2LZJ!ccrgKGqdQC*(V;CfCCH80`wf1n zb`^-$ftTAGvlPt5>iXXPQSiZ#-1QuF9jk$^&@40(P~aFaulVzVN7~*+Y0>#0x>|Pc zR~#aNd$d1EA~m2ryq{!rs-Ag3`$k?AMR zf&U}~>yx^E-*zY-hyG-EB$ufXbt;9CB1xN67?tK#sSNyMbDb38fO!2UG2qgv zN~TtsA~#K$RH7D5ZE}%-2XF|5pf)Yp_P1twbAx=ymh#2Pl~qREw!SqAnlWtC=S zB}8RKmey%0jY;62qAE>YE8VEnJgCq3faU;8mVX4#>4f{~b6MuR|$MC5>LD+B?qC7%u1IU3_=>+4@Z9hIv zV(~Ptx8REOp1V9yp|>Xm2Hk1EQ-Cq1b)lGI=dJb~GizPgbg20LdtpLnn<2!Ai%?pP zuy#kH#^NYWB#>uoI!YnH@`aOk@ECdPv+FqG1H5{Ka+N4adF-=gpep6O4UCgyDZC)x zHPnbc*NZtRr@`~&^ZTK9{D9>!uPhDkawlP?WfZ6&*71-aWfqM&aEu+<^G-e@h+L=6 zxv=kf=L36r624OQ$YT-?V;?4<7b3-%B1hd4MJfn_dFmlKZ zW~Am=S|l(mmSCKM@<`z$I=9+TTWD%EVFG@-D8qF#a_#d4^Afo3CgHbVa)jL>t`|E`VDJVS-F(4!8s!bqtt;aW1voPzE^g+rK8 z4NF>%r8We9PYdmRAuuK!6Pav;g4E9WGmMAFZLRNlbv169hQotLFHe2lbOG9ePk%Mi z>O4OvI>u=FQU}m#v%Q6UU8T2e{S8I1@Qm4q}RzU6VUB~kJ%kI#=%&V>N&COHe0NuRa8wX90EeUN-!M$svF`i7zpQL_(LLj_lG}}e{QOA7JrX|o%?U?mD(Tdy@Yn#-~IQo@p|@b zQ>}lgI>($14UJQIo$5gzNjZk0uT4IvPtC^N35~now!QPgkMZzF!UxPRYsB^)^R_Kr zADTgLwt>H-cO;06k4Emh+S>$*Ia@o9*X}C5Q_NW&*AM5JAeyuVuNi3CJ!D>N68{Fi zt0p8H`OEGSI;R{2uWk26xDR)Jq;Bh5@AZv~CS&3&Gdo0WD?J)d9gl^}!}Zibn_alo z(dhv&_k2t-W10^&7n7U8^X0w-bdOONj;K<0V$4@V4WeE7+otv7Q^zEyc{dB%Q z=VUkzJ_f&Nc9+gGCHOtJjgOhoZZ6zgu%Fw+5Uuk;bx^e{!P7~e=1zY&Q*Y;|( z+;SRk-dm=bRO@@&JAZb4dTG;wr(C#Efj=}GG-2)TFPNu(1Jahid>4%Ri# zZDuG(pfugGpJ6NoYutgd?=%yR5@&?b$lx6D%->npmScNEG(C_27w`t5GFa0P#ROY_ zFkz^Vj7$VW3R8nF9=s>*1zc|Azy4l8k~Lop*|sUxJT1ms^Y~+yFL80}kunAdQQve9 z4}F7nN9#}MqfaGlT($n)-ugM&{|E;C?^M5FYv$BNr!dLeN;FmYXZ*vfO2E$wB^c-R zpWDY09_;mYW2swPFu^DR8`dam%s5LuxtUIec)MV{%@)^EV`;%;BU)t~EMi(GN|n+@o);Nd)4U)~h(hC{P`yFhv&Ah{5=t8GGKRVF{xMoHR#vfSpK^<*Oj$M(+nw?pbL!% z^n#!JVWkmZsXLPuj1vNVM|2^vGD2V^iI)Dp98BT-g1PQT+{e56*SJZ(0ZV4*LuGBt z^07W2{yo87gI61$YW}dRPq_x|bN_)hZj~P@I2;mv0j=pz|JCHC3ePq%@ioCeHy_Ap z6AQZYXFsp)4*tB&QvDV0Ks9>|hKwoi_QA{qecL@9Go#76_CX`9BU>K>$~7+Mb@Hpf znaDr#L4FHOcdo_BZ-<~Jo&UL3+XajvXq|oJZ+|&#H!|YL=tpAzPap5gr||LfznEUP zY%7+mTK;(Shy3vkL5|sL)iT-|e-l+1uXA6i%@v({N=H#H+sQ6W+iF{`gZ8${a9H6N zrw11D00ZxmLN@wEtHd`ofyP##az4R2yQqI&gm?bu@6i%1AI-&6wN#U$ze2^;aZqkI zRq1a-tp5E!{`~#oUNEtEaQI;%esL-1lMm8t?LM@~D#UTCRz*_QuWrG;-CAg*Y6S-V z>N(8OZ&&mOMK3GR3d2en+BN>P|G>i9>5C(YCZi3CV@{* zl^!?RSC;>TvX40bNcobmTaWhy%g)a{W`kfh2;SKsc*`Z_KB#}!+CC))@vNYl8J$T5 zWM)JtoE4lGmfMV4MlvHPg03NsE3O#;;m<{>ri2e^`*+VZwN+5W>j0;9%A8s;ZzILZ z+O<+00MmUqj0-7IVZOgxE|=G}{hL2?nzh>9=k>RrpQZN~`|ZCT?T-44ptD!+PY6I$ zs6*qfzkPvj@XvQ*2ZeoiKZI@YmJ3m4o9{R2XR77h_s#KFRR>-Mqhj4SI3DY$Uf}Px z+xk192c7@W9)5a0{@C0Jy9@OQU)_EP&a6$uYY?N!VDn%f9^l;76MO>Q+-A%O2C$C6r@#y*HZt}kEFPmq9fs|N^g2QEAEFw;N)Cm4BAjL!WPX4 z3qRw9A6JW-lSRwy0_^L>`rD!&MsL{3%*aoOe9ZEXI9oEFuDL+T;-?Uu#qWV4{Aw$+ z`Q88irb9~$)^|UJP~`qihibnHw_jIkvs>wHc`$A(_nj5=yWekR6&Ba6+^rX&Oq{kQ zzWeFrF;r+>LU9-~r@#3VjC8p^1M-y;RWB$VB2HiLR^-#Omv&h!&)jj^HRtLJUKdMM znAW8icXhpb(b}C!4*<-{;|dDZG@K5>a_-+q{F?>CSBseM^Kov#@o(%K() z{b`^h$Pb78?&;45c+KjmeAs@1frpp90p2N~Y`NcYu(&eK61(zB%xc4VQa7tPd}O_>vC>KY-R=H)A$f%t>ukS$VjmJ5p52yfKQFHLwah6`S5IbN*QaOX zzj|7Ik=4qtLq6=kZyj`{aYBK|vfTQIuSpvo{*u%%<$CMerFKT}1>m2-&aF!v4jbd2 z&aYH^zu9i(>WfuX*?xfaXUT4n{i9yMI$jTz`o}dacwgj8Lq9GCzq#>uJM4D1`3!@9 zbDVgZDFkH%hP}_vg%&EeJ`g!|mh^&YcV75Q<*)8Pc_p{puRP14k%s#B^A^-lUyoHt zX$bmrC?p0e{ve;8c7f}1TkgFZQq2V#YOZ6UO$EPusmD4V{LIFOP`f@Hc3``F zgPP03Q@OM2P8Eufq(=~n@&!!dTBsapfrnlPEBq?tmZhQGLHj^-@I756tg`s5k&FbmB|GYpjo_j$AVx@M6 z2UtbxHi*@(T$W*{+B;LiO10dSD^J#{GM_I^o{=Kn;@*P+rp zVwp3+MQvR>X6dyx;@=CRlW{`#?CRYdHo-F;cU?ET1irBR9gtr^fmw;L7auzV@b|Mr_d z?YH0TuF=v~T0Yi2QP1Om`R{@k{v(*0pom=F&Pd%|1HRNTH7c=XW(-GQnBrd)W$nD+WUwWA zJhen|!-#NC~jUn8m<}l${El5uR`Dk&N{_1Cm-q6(NcHTQNar zdPdN5&DAi9O}Efwz$7?5w)2cuJSR>dmNQl4EDe>2Y%?k2Nx9%ZSSnVOQzzOL;d zi}YT1h}cZ9Or&lSMdX?p8O2C~bMXaK&Pq;5Oq#=UySpe%o@E3h#}E-b@ens6qK7nzuofs0K?{~>EEGBOhiGb3awBeQCIJ0tO%WCMhJnb7nZzRT9op|H~#&jc5R z%W*!?HnZU~AsyE*55^&RRc<;|lI}7##1QK+bRJf$$c;dWXHGE*XJkerbLsZz04=`A z#H0+|VQm#zO>#yufuMmb*U9!yPp+AfF^nW!8jh24R&Y9A(ylQ#)R=-u&bh(}D+*1V zN=;A3nVJ#QjK4P?WoYmfPu!a;u=M-x}61Rs(x6jODI*&o+O~2?=IcIj>z|KIJqCs%#a+6at95tyu99Kv?pT5T^l8aRL zlj8hfGCQ^1XcGBZ#wfy89vXawy{6Fm!Fn>5;nvF%@4| zqjt8pn~kzcV2zl}B=k}$JUyvqKt=#ECQNFSmkTeLjGmEkTw4c|TsTa$BO=SJQ|X@d zbC|11X}TCWH;tuG{QXcGitF1hX)qO00gAZ<4XVhJ{n&c)&K$jsqsxJmuOSplz6U&m zv7OsZ1YP9XNGdXHk6OjErC;J(7Numw55X;29O? zzdhC0k~3&Q>MSpaPQ3XOk$2`OoukCW3NeQIMW@0iJ=;TjzunS87{_vFbtYWmDM?Ju znVocYQuAxX;E9x-ik=Z^KiVZsIqq;KbEj->@?^WJFX@cW8}J!Qv@*y}Q*d%{u4H~` zt#OuF_+ODJn00Kb;uDi`rsf(oBXjMXs2M1D8#d#!|Fm1nN@Y~BjDc|_g&1+cc{ZtT zrzSPs(jY;RmrM@Rh`dm(cN*qS362Yr8I-w1uwt^$WW9l`i}|SrQSzlGXJ;r?R_ov) zu_iec7*R~QN(>$rlWvCPjj)VM+jf!*BZaVG; zvix1AtS<^-m_o$l zMV4nK`PTjn&UE11vcA3JVwSRUQOSf;(69w1DAS3t>Suf=!skjl*Fk(vWhckydY0MN zIuqJRB&eZSAkcl19r@?oqBr1^oY%L@O|;Oh#Ei)>-0H{-G3AV=lDnK1bL5bBBqc4S zbBB^%fg1ry&MAF#$)Fe-Njpwd?rgGKb6=*Jjxlsx%HkbIV|Qx+nZyL*ZHxt{q?IHm z2nlRia%PIYG&2-qpcqKm9_OMiFdZ7hIpf>oO|B920x4L*2^n#`IWH(T(NVqZ^tHo< zv&W|+_D2HCo_jmU6lvKn&-Pt7(NaRM*%vxte zYO08sG&2-qpm?(ThbHN43KjnG>9Dx?@eUWde+ z<5O~R;o~PREJMmkXccJ;DRg3Zub4bD7gxFPp+}dU9$MR7y#ZDKm3-V(EBK|8DLBu# z521z#$rhP(63d(kF61SY62EXGV(%o!iAqBOM^m^whq;QTuVSNGZ3cD{VE2#uoq>ff z{0hLnL5>r!pmM1kW2I~%bCHh>xG@9!Zor0KMN2_0-WiRSnVPpt)i@EPq(+z%L@AYp zafu1JW0K97jK(BP2I}B^ACY{CF1n*$DmXDO!}aNC^@b8gM24_XMXr;trblF)skurG zblGyVTkYhNb(@{OUu_Q$%I<%W`t$Ny2JS0`Z{%lu%{mhgbAV1^3nLAaBGHv_&cJ;G zK`-)Q+w{xji|A($PeaJSmpj@ww0DssL$z{TChj*!M45pY2L$=_Okh}DTzpnh5?LoDWwBVa>5=UA2$Hk~W@j;=M9S8TEO~Xrae@8c_dQbbE!mFK zY10uf)4DQ`$HRO-K0ZE0fzDlKc+9aa*V+3v%tnLynXzMLe9p!}EIy00el5u$WD~WC zRrj(zP5*yT{n>cJ%6KEnax-5#N;zuY>>=I%na^A0TOwLUU8-9w2r2U%V^8EBJRA3jz|DsmRYNnFOFfNcNTJ_DB%&Qx>GKfaWPi&KX}5B;znHD8W62W)*`@D+pR}w**jRXFh zl9g2<*JVuor~3_DL$LD;c!6_Enq?MLx;n zbb0s~rB;BxB7tvFD(uh}3>s=#PRJsYySC-A(Dfpr8_e}R&w|IH8Q30-0dx5pSKh{D z()P0&6vgO_w0`kIq%liK7Lgl~-^HOIcQGSj&Z1IqG8RR_VCJoLy(q#wo|N?*zskj3 zoK;0KJ0X}YCs4qMrKw2Bh!rFdA|)_;S&+oVNN`9+#w>|L%tR&vGK5)`a8kgMv{5xF zN30}MnScw%6W|?qCI~JLxqz%tQHZi=1jQ zOtJu)o{RrfAYDON-sI#&+)q%zGMQ-v=1F=&%3OdPSY!sZ=L`9ug^Wlo8fFQRfiDS^ zLQ27MDd<8%!n0{gVpvR|A=u|Z1-~em8bg^Qz_!6Zw6*m@+(DXBYK*rpUtE58yZZh4 zRBT@5lhAlo?2@^1vX}%<;ZV*@wv)z8k%d*vz&#AIL+=@ zvL#n8IE?U?Y&rA>N@cbFw$4A^+-!P2$l*7s^MpRpWbpYreips zad?)^mp1IqvayZXnZ@!B&$992(XK4TD4YHYUufYl{(H>-hA+#~E&He<98kpe#!16r zMI1aRTZ=eskhT|b(4cKC;;=#7Uc_;O>Hsb|t$h)q28i#33I|z8WeQ3{q=hI3!E9h_ z`k*!MozTWH=n$C;>N^GU$EPX4h^!w!{H^|dI;RGDl0Hsh^we-%ueD7Gx1w&Za`_?3a!FwPt>KK;OcqMoZ(Ogyz&62QEq$CwnU9 z^C=$U1o!RFXAt)F+B*Sd@wu1D8?5PKRo?B2LRdgI1dH*Rd1 zzfaq^K`jcS;!s@|77u)C7`o^AHuHVcwjIwAlu{$qg-v~v*(SB&PfKTx$#ust%r9=- zs4W5Y#-Bt<2J6)N8w|RP97{zEVKs+c9fw`L-0Y95`@aX9;^!G-3HCq_C&WPd3n!88YA`+Z2p)=Gk`W*`Xa+R%DsJ z?@~@-1UTicV|cDDJlpeK(-)5EM7Gz$PuQewsD!$BGMq?F&4vQuq)NvOWP<KXUm7B-~w)?Q?AR*SP#VXTkEOO+et#zL?#I-CxN?VNN z2@-x40EiVpUB9Hiq?ZwyWtBYoK^%;cP3!n}}f(^cq>_Ogxd{?ipNHGK68yB+7 zR6uIBR8=GW31UeRb0D6j(8pJJMwGrqC4le4UTybu6a!7g#cFv`mjA8}z*r2Gf@B~( zlYDgwz?q9l!a^~IH42kLN+_U~p#z6Ly!+?7_n+SVaIn%|(WAC)nyq@YO@GNHd|3e< zz4Ko+Z0@!5hYiW0JO9?m6m9xsBRIv8%H%QQQ?zN4jmB+m`00j2alhez(1w3)+CFWC zC4|R)-C&*}D0f0rw~WZMTpmRfMl956kHd}zW$8AV_C&m~_n287ao-ov_vbtQ3_ArfR#!}jf9Mw6&`)*m*0gX7uER#!*mnnx8U0(x1)Ff&*Sv@Bz*oe#9ztAQ zW`~}*<_UY^`eMXoeNV&%E3sq3FfgizZXf`yOc5~4u)UDOf({VIbQ*Fq3?j!1y~wdl z76cxrR$%((x-acx5?Awmlw?y0A9N^C+)S z*#2WhtA|6iaM)sWQO%%N<)$Ak1FCoHLy;&RR#-%Lhp2J+@h!UtRV9E^pUbMRM1DTc z_mf6$Gg!S=#X?g>QN~GK20R6Ft?LGA$x+I>=Ts%q2qPbC5#$liZm9bh;MpI=YzNO) zXRS5xYBhdmp+iQNJ;Mv-s4)AQH@BP5jItn~3joN#k{j8CvZ5|1pzN@bv z{_F>yZV#S4cz!kT+%j#SHh6lTt}|}A%-7w(GP#8zkle@!T&nxF?SvlnXrP;>&Mk|< z?6f$I{0Laocg*zzgFn>Nw*)2^SI^G>NkA=TctkUn>sKh@$%V=m)Er! z5idDSSYBeEBDofmEG>j&U(7Uz=GrjXT#;IqwXWkY@Gt4uRK%ZaKuz&vrf!=pFnl_S6Xj$zY`myOK;+mf3wfcf za-f$+71iH(l*%0V1qHPG&qer@^e_I6F*_9mx+S&=b z2~<^i41rS3G^_&&l%81*{HOWHTRxqKoHgrR(A@**JYf%@U&`{iK5d^ifHK{TC^yW| zvwap=)bTLRd(V1hfgC72^%I4#pOBF4F3CiOy{`5v`=gSRqEMbrOK4deA~o{7#?JMewRh6wga{Un(8)ZXp)+~~(vQVBgMVdE5Q?Lb zS6RMlrY%INdICP@}z&oIK{ z0^j?r%(e2-7&NRz+`2Ie36)({GN=N+x9t8x%JLCA{9I;2@Lm7<`K$y9rS-F@!Mz@I`BIul4@h8t(1uBknm*2>04~t&=|X zG5MK?TKpc7x7O~=?rHGrxVq8v)*@lgTVL#?S^u7R%k;vKdj?~c7c$55ZOgPxZZQmA z;hTXTSi&^0ckM9ny~qfe?zoX284fiCz*q}!UBK=%%R%`ic%x3n?70&vR8Y>O^(bNY zgav540%!pBI7WZyoZ-c{(_AR!w3D_Tr9KG&Vz|L4_?z z4fU9EAg?pkMQh|Do1*?aQPeYLzk})pGMHq*8VwM%R)#1838pOPb8Fm+tDn4^*NBbW zlQwiwbC)`V1|&d=D5M<>p+jIKqx+dgE~7bmE;6yC$bd&gQTx%$&MfeK;%MX)pt6Re zx8RdV49C@Qm~_WDI-Di!j+@*EvV`Rr_C72DYw=FzXjsB%57F{yEYV@I z=~9UMAb|5wcQey|jH~_b10X=}aF zZV*L&%KC>Ejv_Hdc;qk9=udnXtT2 zo8#q-%i3{^XT9{D&oMo0ykEh-Uu}+me0B5FiP|WiLw;$JneX*6875E;|I)c%5NXe7 zy#5y^h4ZTqkLFu{)b;e*g(ac=DC)7a|9&1vtu5=YAGEe|KaZm> z@0)$t!}A`<9`rHn4`1wVVUHd?dOQYtd{-wsX2hB82P}*{$F)t5Iu3IUGc;YQGZ;DB z3<3jMP60szKeT-o>NNCpZgJ-Ofw2=k`dftkEyA93`dftkEyAySix545j0dolzK=6^ z&sIHK9m`f*Cg{^zo?h6{}rZ55~T*f^wirmO_0JmVjs&g6!cEAnW z*C`dc>9(15>L4~{QY;{9`Pp_{YFrq|%kvA8RrtmTabJoQCo^8;Ym{6UHND-h4C&2) zhZPf%kK+z&1Abc-`@7exe$z(OMW9^o*cp(KNQ;{U6jYX=CXDHoJRH`zMheP>B z26nYAeegoXVG79N}y*Qylb_2B@ zsF;(gVm6*6b4PY^Cqbn-+rfjFp31&?D%)IlT4}5OF4%_s>C2x!?dNaY+OiJ&(~o9C#Q<$i;)zIPz(+M6nlY~-TMu)6 zLK4C58qa2wdL_!k`jnBNxa10*0wtq+Z_>C@=R*3C$MPbdj9{Tgrk;;Y7p1?+NV1Jw zFjVP^%Mf1k`!P<#q>`pYoNrYbC)%}2bA?_-KdBlU$EA%vE__wYJ?JdYSpqSLwPTf5D-3A=9qcHaQ(zUzWr`c+_eQ-QRb7I&pvm=@b3O8jxK z+u5=X*gftgE|eYxyM{*1ujuRj#iEM!tlP8hW1O{qSMkGG3`S8>=sLd$a0wd21-N2NvYcPSUvAL6V`}kpf{IEWL*p}a8A3tnsA$|O?K7QC2 zjUQ&))`Q&n_6gt6BW917M;|$FPS7WgnD}BE=)-`4O69t)2bO1BmSy|gUngjUWi9xjRH{LyC(h(mvX7(fq2J1jcwgkuP*vM4JM@+OU4sH|ciU zQ)|=dTIhtvu1e4(xokpfx3nVGG}g(+P&$f#V~cnBEt~$9ER9Wrl9_~{IIUwpNQjiM zgy|N>H5DCf^^JMtCPr}GM_$N<;mkHns4(Uj|EsLLFv8`Os$%;mB+0v}> zF_bl9yaa)5WMQdL7%xf2g}ieZXEGMWI4jWL-0-7}dx1AJ(BoiZ5@0k1yoz!emXEk|F{~1n zFBjMJob=HIRbAoR7Gfx>Vk)^frrlb=ON?k@Q}Sv{8Y=|eS$l8 zLp0mT=?~?h_LjBs5Gwa$cnGRIhKC&OYXv?1qEYvI80ul@Xc+q5;_C}Hq>lz_t(4Ai3Q5!m3=>Kc)YMR=Hf#{uIksIv{1JGI^wjdJNk%Yfov7)M#_q6u=OU!0}{p_!w z{q?iIe)iYT{`&jTyNIo<-bN5EQAl3ytIs=p%B*t10}4 zKP)HT;nf>*Y#mn_<%yT`Zo`wvaDvVPT}}dl`qnh<>6cqOU7#b%)3@{4ELzz2qy1>6 z^EPE4u_7)=U4lV;pKZnYv?!CjOOv(38lnlzt40WKtSf*!Qm=#DGVR|=PhcM zF<%(f7I=)2nl^KwPQe#GrgQu8mnngX>(Ahw41BS@0S0#mR1w+NpJ(<7e?4oPvu?@B z!~jhVbAwt{e`f*5H=8U)LO2+;JmKjaU?bOQb-M?O53`ETUB{) zh_Qsay7a6rELBBehZ3H-zfkTk^!!be`wQj%LhFmYw}Ja&te`8yeTMtB7j?^G@56$7 zS}9A3Bd%t&)u**;3)w897 zNfo*dxzN#*C~SQ<77w8Qe$ZB^81d(wEFr zSqsUGU{pC)0TvE`+WDki+%JQ+xl;@2`}U@ZHj^PZdNMB$j+||f8U56=>9cJ%f!dCS z3FQgN@f_#zlY!CkBTkJUPj21gLj&RDL$3-q?wOLPQ~9jZB*lTc9fSk~P8X+50>q*Z z=!+F_kj?6$wUGE$WGfVXZM0U={aewDAlv(*H37)Bi>cZ4>H4Vqc762g=r_6mt4N&~ F1po-pKYIWG literal 0 HcmV?d00001 diff --git a/documentation/audits/security-review-2026-10-12/scanners/trivy-gitea.dooplex.hu_admin_felhom-controller_0.307.0.json.gz b/documentation/audits/security-review-2026-10-12/scanners/trivy-gitea.dooplex.hu_admin_felhom-controller_0.307.0.json.gz new file mode 100644 index 0000000000000000000000000000000000000000..b4a7f6b927c6dfc922fdb000beef403b07f0b584 GIT binary patch literal 384651 zcmZ5{Q;=psvu)e9jjwHc+O}F8YQhww8AKW~Me4_O^7!_IA!r z_BJ-APWp`WEQ}oVjPzE&?d^arb$xzsurK`l@Pm)OY#v@KDS^G#q|X?Sy5i1qMNqod zy2)pb`vU>$OGF4Hxg6Iw&HXUE6C}=ui7uNK)7kO0QC=VoFgv4$jfj6fDP?&&N`Chc z{TzBAmrfRzhxVf6ZXe!l@pXM*Z})9XACNBI+6?jr&I+g}+k5;uJ{s11fm_{4dW0l)vEVe2*qxf`oQW60>Z!52}`Jg!@DS@Bl-V7f&LC(?=R6ny zM|vr4hUFB9&4fRCKx|A8Eny&9b@qHp8(R?72%`0!k1xI$WV%r!UXH{;kw8dv8W%JK zii(N>o{z5?D;yY)l8I{6nQ-w6M@)zujm5DRTHn&o=tSb5G}de&XB!I`h_yFla4ws+ zIqsx|nZ~p3|j1A$Pa0thGx|-XvVss$IiVG5kbOf0|%>V{%c9dB}Ot=b7^9m3p zk>VNv-nWA)Yyk-aYR48)Y}z70OUaMp%UJOOf09M89t6OL~YE@-YQuW;fQW%Hg36u=v?SDr~!TG7~y2DE=K|DOdUPW51=8 z`s$M#tLHVxR3ptoZFj7AP{;7sXUsS(X!{Coe>)`FUZKV>hZBL z)}WMor=)GVo7Mh&FcExwk$Yi&*8q@Aw0P%(GDtt4_ToEXQ?DxHE)Xfzp#^6ODan{s z^HAzeqf=k2@)=cikE$&IzZMWFYak0fH?^JQxsLeCEGEPVL@k6*|ve& z$s*;@+iCLV!JUhSLKd~rY{skL&^gCS0ET7G7wP!%>E|=Ww6$O!uCI9e3E6Kk(!J$S z2Jxnse{;6;kG-aA(_cHbxnssX0Rq**rZ)CH@@k4U33aZc5MqjT16%X`Ep~NK;q?!l zfwXhqzO-Ponw?_UI;@gSJ;OaiY>bxjzj37_bbuw_db46PQ9#mwd z?~G4)H8Lo=x-ebw0U-GuoiAK0w1d^-LiPf(VzP3RI@#NeyEgmftx?ifc?7GKCs;O~ zr04OQz|_bdNS3s#>2~`Cs9>he!1~pIiN*T>YwV#$8Wtg+d8?{0xI`Zme1F2Qxg}Ntv@}U zzwh3~KK4cn!{A;<3wM|*^KJvhb#Flvx->}Q5Izp3r4Mpw6B)*R9?rKsG2{}o_GX5yeuLbp)n|=%WPbg}-1{%{ z+pbW)@ve61LLStZr(jUGTH=y!Rl!uN@GQ&qettf6dE(be*7h?5@qKEY4E#vG zs+taic6UCMoLH@qcs9iL6P7h5?ddl2%FmNT1{)$EYYQwp1u1+k$1LMW!MSM?ogh01 z?xvAd4?*-UuXda6=HY0oF26DR9Nhz!z5F`SDRP`1O){deVrq z`D%cQ|EDYICdpeZ3p3dy<>KabVz&G6)b#3+9nWQ{O>*2*&wv~FI{d3_M#+V_BF8+l zMU?7^%9H}Mvq_?_{R|vyEiIV9FaVq%87}~p5#kvmBq2^ST*r*0^x`D5%Bu8E{9`SD z-tHm1-jXLa=1N#5aSq;g!`yWY6f&e{I_(CG*ePpFH0R`_<$^N+x6c1{lPqlzGz>i7 zo;%IIl56VF`0IO6=6&~?Z?r$meF(#G07}eS=mR*4HdQ%ILdF}z5HCI2DH~|Sb$gj=ok}S8UTVjI3Y*|r-Pp|0Q@fm z3cC+wqycmh(e+pZA0thuq+ov@o&ZP!;o;pp?BgJBBx}Gy1|+`R;aoUaUdSA>Q=d^h zZh#mwR5D@89x4&Gm#B#(cl+y&OJs=1rv zp^Pg7Pe%U)&~_5eHkCTSOaAPE2Pp`|?o+$pw9veNUtbji4M>zS*07JRUYz??J`zbL za*q!0gP7d8$d<31_y&a^cY5{(fcv6!SxG1y8l1Zf{+aD2c8zs+b8rLsQr{$({ONa* zLv%uzMQruPR_>vFbtnXu@9FMXsy95htf8z!pA4g|$z@3T_}W{gLE#9iGXgSi9?4n~ zUY>cymtTN`&?x1#q^o6?d#e(`Wq8>5vFy+$cHxABnFsD5()$YDRTEs?mu zr8y%QV}4(~$l5u3u-27abV4`|(&fa|?(XCByP@096H4v30LHSnLHJc6b<27vFU;rb zbtOjhQ)4{ZZ{g3eGiCP7qw+C4KGUROI{E0PEKr{=6C*`>OnIUyUr2vy8pke3bd1h@ zhQHsKiE|x6cMofvIbkYQ=jrl*be)_YKNnvgpZlw~Cr_Oy6%Z|eaJpx0G>vfkyZ@UM zHqOz+oMr)Bb|oSweM-JS`Rs*l1)Of^xq=I{d7OWRG$+kYuX|#av@Oljy(e7Y!o0X$+dxc|R zn-wu>o05@aL~i}miaMPgtvZ_>nmV0G zVrBG61WUPFSQ5pwLk2y@*}@pc$IAt!bmFGp{-vnyUiQ`uLCvj&l9HxJH2jL7*Mj0& zUXutp`m*bMQNGCZ$*M^5RVIn~tY)7ML2#@Ji4~;&g@{V6UW@0FtSEf@b!on9(}##< zS$`wuig`zIE(O?$W^Q?&t97#Y*cODEC}9N^NK1d&rttqNBq?ALXx0$0 zPUlrKfy_rMbqkJ4IK%j?(_PUo9977`OoI9HkVL|L-J#z=NRxTHq zJih%_w*njXQM?BS{e!fp#t>gZHk+n_0j#UYq*(?@C3 z?n&i<&EQ&uiYS!wzOg9(dx9U^v%jAu8-;r(8(venj#n42WR?C3D>3{aTX?n~9nZUm z=vuVKwbCJ%u5bmyRpoxQQ7e?M=FnGqB@ro=OV4l5OEQ=fZM%J0i z!=!|NYn%qgF62@l+Y-|$j~(teW*ik;hLHlZE<9Ld&Gh=TK;_lfXp!-F;k2>}3^wOO z)+fP+#U)Tld1W89igVoO!eZ}1yS6TSja<>VTX_5_&Yd~%Sd~Bw?!O#Wvpu5#c|@{G zUcNbrBW%+H-SDayH>P{`ZK3h_(Ia==bAyoz5m@|66vy&B6u$T>sYk&D>UmMg3K2|_ zN)+AbE-7aP=EFKJ{Av{ZDUB41d}Gyukryzi&!c!Q@=1&^px^tZ+QAwbq^E80qpP(uBPTD2l0yN^EMR z7g<>9K+?3nFgk><2}-19QCTUHF*RdJNuN$OYpKaoaiRQ}SGqRg(Amy5f$5AzFw5c@ zUuvaE-*+t@iE*P$pJ1m{UOP6C+Q_o`WG{tHaHdQjm;orSW19|UD~7$7OGOAPIq0HM zq8Ge7=(?{moaw4#*q43GqQgW(;{Sm6T6Fq~4A&bkj=jiQdHp$1N|jc{Biz-lxp&W1 zc?TbZ?7&tG?@|YUUmjc$L35o_y2^F@mC>*lNPDxpbyusz{3$+dX**pYK|}YLMVV!@ z666NwTPWh>CJp(Bxbu4po)Ke;N-auwSQOu&D_SXNILvO^tqjw$y;I5|%4z8|MGQe1 zUG$w+UOk;4fDJg|dydahYin;VX@r}SGF{^_m@gLi$dtCn*#qow_-PI5d{J4EQou}N z$M?4@bbNK
    OwEU31cYLI8hQ*n6c)6wV?CmTpMgAc8K;drJXPx4^aiYWD`NCzO| zNMN1}h9^Ea?Z*)ghT0=0QW%C#K*amx70mFA)kpDu{xPgZ)t7n|w~0I|v`eSA2oM+z zLFrg)M8qHwRN0~14?wSdohD?D1E^f5d)={_T06u5l3N$u+1z)!G#6#?r8M>w(O+}fGGD}pj@z^oW|rrR2Xm-@MdA)70QlN z7HYK^To~|X#c(@Gd-GsCibPWun;SN^-q|&qYoxpL_=Nch;^`%0H7LB=S^!|CizAMc zsJ?W$8C0#_j*PT0)CO6A{rQ}W?5)(#J9XuwAgCi~i?qFpz^pKzZANtDTG1Oa`Z^(` znjP9I(JiXr=-HT7{KAyImO%Kei4i90#@7`bE3jX!Ti2#w$ALNVbR!oQH=KQMm^Jhu zs)Kfip9-I-m(Y+kS~T~aPy}v&lU~|-W=}vONe*a!u4#WgkO0TZF3k*m*m=fyB2=6U z07!rdYCmtjpFJD4t^4hy1}dK15cAV54C*(vq!YgeQ%V}veeu2g`FJ~gJQ}~SpRFwh zLCN!dI6prWOMKmbn%>|@Y+8mF<65ZXSi$^BEb{r-KYTAnGwkL{?G|1ej<1_Dr-5=8 zGZ484HmWqzk#`!(Bx>9%(Q;DhH#SUsyhpzBMqy}FO;-*&^myM>@a|y&;WGih`Wi2D zo6dWelMMMtT4?K+mGIEX4>gYbg12LnI)HdVJ#w5pV3b|;Q?o4J>?7?fCy{ehYuo39 z#H2ZLY{#)HDdS@irAwoU{q2ydjDyJ{nzjG=RRoyT7X6Yz8|7*Pdl(WNK&e^ z>{`$l9=mNrS*Zz`C~Cjy(e6suCNv7jA{o?O4xh8Z08=CpqG;S+#e3s45|D zUz=1nesA1#u!>Xrs0!?A!X#^-WXRG-i6GR|X@3G2^sRqpX9lP=^}m2b&R@!!UM0-5 zV}-rq(!fa8OcQGHC!epg)%aFe&(8HswIcE-(_awge+hW0Hym=tn)s1lv#D4hie@xx z0??$zOl`=i8Y{dISR;eUO4`sdMFEIkh!4;Yz`wHxS2rh)dm)J0!pQ`U@*5`B7pnfq z^nU?6b8gmmtX#4(*|02&a(C(R%F%pi%M$*{X)z zXo@!;)$@BHf$&53ttI8ij-4&w(R(-k*F*6z8&mDQ5$sjp-=x>RMpjSSE)Fd~!=-Zq zPG{xuM@G7JPfvO~6M+T`i>gx<5Sx>2s71VI*FloIWI}csH4S9kYBu)5p+B?nfaf58 ze}$nA@AsLx!}wESrJngxx=M{gM?3>m6%D7*`QwMC;66s|me!PDhKfT0ZIP;_ zlRkgN;z_|gwPMc3HOFE@)5Dp~vnjvNt9WhUhs$-qOf8A))AgHW`INalU4L2B##?Gw zX6oA&$oJj%!>1{6LBCGbtpD0~)wH*?fUi>s6 z9!6osv^n@Cjk&(?`uDAzI{yg`%L9Xz^2t%~q3hOIK7EWO}T!$G%8jey#IvqdbaX)_28I;Ck_g?^h`hF?=>&* z!~JO+18eeH;|AEYz}2)f&HJmD3IU~Rg}ytGa_yIgzZAU7ilbc@pw)9~TcgT;TfqeQt`8f&IBnt_*7I~?>gI286Azqm66wRf zbPh^dmj2SHfc9PBsGd33$WsM(EiUsjt`c-N*yNkaEvbD-?c5k1oP2m>(sLLX?_pN; z>+Z$?>+THz)Z57jFbGsUBuu^Uecv5)dDHTL(W)Kf|dTxRV&LF4tCRuMIZ`v@_miX;RrrtddcMxxD87|E)N{vlF z7rXY(nJq9?lAbwLlD4mHA|8IWFNA@tfx*3|TH0YISX)w=0jf(51;kCEGJh9}Eq3SV z@r>*k!#D3ZsB8?|oL-wt5Gyv&U6-e0-Wc>#QEL}(?-d!l5H|ct5cEm0o<|C$2rgPW zd4vjg_VtFxs(Cp8t#tZ+-?rm_0Q{&TiL^Vud#+V?^x<*xs;doP<$~}IHz2OQQ?A?w#Z~4vSn_Y565U(w_VYrRfBbnT z&``O z5};+H;w88rqeV-Q@HLj&ms}kAicM(^eRoaw@>L2Fft2fXz!!TUDk}er%oH%sh7T;|oDrU%*dAYJ zc95MnBtF)k#}rConvmpb$p3+nEu`qrROa9pn$gQ1U^>Py>QuH^HR|+vS$8Oc-kmOl zbU~i6M+S?iSXbNthT-p%3ivzE)dx)^s(W$&@HFW3F8NiomeAp@lrO0!(9T05sTMe8IspO9#^<0mvv&=(}j64CzY^k{54z;j>;yRH)cadf z3n)C(Hn>9iuS_SS#2x9q0XZnqAievXl8L4jxuEOyoWD-BW^;0R%+~9xAI?m<4$`~N}|e9Afgmv#kB)@G}AP;o`4Yo9oNpN znjkZ%6zeq(EzRn=BLMZn!uq%elTQY0*VdIn)1b|TFA1q^j%>mE1IlE|-YJ^p%~)(f z7b#}C65*k@5sJU&N1*!e?bGnno zRVXNt>v8NPR>%$&p1CRAUKzr2M)7EiF2>dQ7o3kqncv;kD+TIWNi`to_Iq_jm;-C= zk_*dnaHb%t&aQIhu9D78B>A+^m1g#+HOdS_dI;J>EEO+Nv~*YnGpM zJ`x{_xa!`Z(Eips%vYgcE8bJvSs*_XVp;!+6l6+cHH`Lb#^76h_uoG2XD^6icc6+IZmauS zFaWHrZc%k!QT>*oP*};IWw85HTvOJL3-zu?^Z0$nIOfoMUswRp+%kcH~4ly4nyTUgGK;1FnK&x zj#M5;qO3MPHo%kMp4omPF?DgY9aJMIIAxXdw7n%}QU~veRzNOSz_Hop&1o>+oVfG^ zv07~Z$k1rjN`y+`_aC_|l^IWX^O`h)~Mme|4-%!1#Uj#pJ!yiSftE+=xhT1xKP&?g6(< zVa#me%pe<+ZIxDb;CA0if#71_v}$zg6{fQd{uuAPT-beiv!eV2P6>t8Ec_7Je8Rya z1R9*%?8kZAuLO|IS2%b}*SO-+uDo9n>}_iiTs@52Lh3 z+#Ba7d%HMbVnZ^Ka<{7y*?c^>7s0U94iShIx5^1Z8vcW17e-1N)kn4xfbbKEC25M3M5VAMW*?MDyak zZYBf`LSA+R&5*A}%zxp#TCJRnX%4V)h?VBx4c!rA@OX^b>9%nn_tn$FvJq${Z50Ol zZ!s4>Xt^4B`%cQm(L2;DH*TOg|3rmx@^hP+?i z^3no5#k`|Q8Q9SyurH~V>SdwAM5_5adY0_V?Zq;9g+1}+uY^DqieY8Gs|!is2`g!Y zecM>n%$rd;=R(Kr=o31*?gpM52GaXPEvX1=SyWb7^-5r16+q-qvFJ8?-P*^9&*Fhr z7vT5%=P_9EPy50sAmCD?UFNCG2^z zE6e%gyHxIF1yV#)CG`^NUe3t6C&=<;!HRxBJ^wjVJEac8GT)PEmXa#9XsJj=<7x7H zRZZE9-HMsuvDDkBRb_rUg#Ijs_H?*6UH#&iYY@lkpkGV*$kV|}Sm8_vh*v-w#x%c~IIU{x=9M%_&w4?_4+uN>61GllY#R#VDiDBHxNJ{pWUC zNWe}+@+#I@NW(6>1jhq+c#UHOSQZp$&cN{8gY7Xt#Nt?I`Y+u9NdtzCAOgIM!8?b# z3^;l*8NJX)AKG^Ph#fs=3bIpAzj^sD@IuYr{us_qV6U=vy__vR%WR{(KpNOc##4(w zXQ3N}lH0v*iEfD{NE7JOu;{aH9Q-We=6%yv5cfuyIE^y3Sp?6Ffvk0ze|GY*)h14~A93 zd1UE1O60$H3~eUYz13q>M=Nzji<^3)X12!cZDO-De$AYWqEh5Q5~PQ7;@MEB5)*E$ z4!38LNAo>vGcDHx`l3cCIB*FnH*JRNCub2xnHf+Y`0a<$cIouhk{R?)*W1z5`}~VVY@^o3{>|Rj+0C-lz!N$OHfZA54#5 zRV=bQPS7ML!9lX&$lpkgQp`uJU&V++8L%D)k7!1=Vv8umVokdAL$5F&DjPtnHcYOI zsMfb6!RQYT+gd<1*=-|U10WwFK?Ikd>n?Oa_$8bJ)i<3wPSke-qG}cpo353?_m`nM z%nbFt1K|Cc7r4wwnmlVpefo) zt(rDbg~ZR5fc?_RR01-zl>!oJKHGM*C4L)?X4VP^4o*R8ls+edKvor+qALu54h#k{ z0(1P5ehpbhe2B8jHF@FdMChPDw|1~?z&sxy35@1WjSqh62wtoR4rc2HBQ3l)1wd~x z2t^4O+ycx}q!04>i z5Vig(KhVs;C&ft4x|EPvPk$oQK*GqN8{$BGV+G_=ahBHWSm{mesUa$2xBb2dF&=NP z2$3Kq3NNp;f!C>LGSuwb!b(=(;UBfTHFsj*PiBP8cjisYG5Giu6gUo`^?)lA zb?aVGH4hhajvm0{AZT|)J=4r4Q8Tc>;D@9U)nw!*bV@ftKN+Qu0=({-7o=xj_0mUf zV$wmTM2R>uNfOgQy^UX9S?Ra~aT3`L2@A*n^%YS#?@Y zLkH-=%wrE6jQYVX&Wc|vem3pjw|u`X6LkIS(GRCv!<~tfk*!C&JkKC--|ams{pouM z$T45k2p!7>G@IwS`gKzc*Y1x05H$*!JpHnq2umIMz9HOTUHYwF-LrmsaOd1Hm5 z^s?n88LZ5Sq!b+t++ds^Go*+k$RuU|k~lwf1UulBWOZUq&y0(?GtC5EaN8)3HEyp7 zOQ-ZuZ`fRtPKUu6A9Sxm*YQ5P-7}Oz%LxHD-9W=2H# z83SRRJmd~WQTc6Ahr`TIUE|F$$%Jg@dXLoeeHwgOfeB}RG`G{(V47@r9Rpq84J6s;h&rW07Tek$c$hbm(gOzJF#X}rP(az zp+Q}_k9LuTYpd{lc2hQZ$zkZtN2{(YZSvF>Bx#f7q-CQJUm<4>=~a)5v;l&(y$yo( zk4l&}eGBGMlj;e<<6--GCXU78AYR67rl^jBckLCR7FS>pyx8AHDX0Yg`uJW&3>$B0 zif>D!l`mj5+8^Ax!@_s7?6jHd%h1H+p;^ojd|!=vjJ?E`=cC@&mzs{|r z%pf#Js)r`eV~N7#qEr)F9Cp>jq5^Kpz8W0+fGK$r2Gh=#9LqErK~cq%MFl-Bh%x2yUt8O$6IA7#@ghm*Awd=6@?OdT5~zaUk;UZkQpZeM}rxj(i1`hMB&V zcDVP)&|JQ4$)pFd-3BPbCw8!A4;nq+wRkFevkQAFYu+u>tyr(z52JG(3~;YW^|%$R zculDN>kIo0SDQ>TDm28>SVTdj&~3!D3T^z74Fy)ph{dMvCx!~Bwh0IU@z8tXK2R*p zwUtQa{I@gOAheXj9Ejs4EoRQrJlL^!{@D%rqUWYO8>qouQi1*;ZVD8_^t};1QIgbl z6Cw%0hnRaX0OQ4@A#2mETc9`<<^e4xLDjIs&VXFDEZU8`>@UgB`zVrk>2ip&!l9uH z4*6E!=^Vu+R%H+YP-agRnOaZs4f|*C{^u@aN#ggi9>#S*emUGFQ)7Gtl;tD zpytZ|YuEKmVMZ_I+WqvjW&5>P+dwOyz7?1gurMkA9$uGm|3g?ho6C8w(X-jbm>79! zl)|;9iRD^X2LsVbZR%B%1)b8o@!QFU>NOoQse`>)SqizDa;4>WzH zkl%eF5pj5uG<;5063+*}UO(RfJFV$gP`kRVF(7sJAfBK}D$0C>T1E}jy?^61^8G;g zb7ensy)P~{u|@cE0cl9Ejr-ictlm}u?4V}ymBM`adD|mPc{0{rBf~*tVIB}#)d!C9 z0zaMHO0jk^LgqDFCOj@{r-fTNI(3S@r74!n$%=pgoSXE}K>3l5=K|~XxYtBs7F)HL z#?`>jn_mkph~=UFh3LQsCHr9_B1;=grR~7cHqynvZH=5lF5D56ZykSXI;WGZffP8(AU_HW z_3L#sH?Obemwr&A?~lCxePc}}d|fLWBK=Xl8M^piL`uyAviS~%zc0)Yc(17~e!wyiEE1D}Dgs-8@jg?_n1>znxp)-Z>mXZQA;J%+5}X{!5W1|W zC2OclD!AKaf;2Yq!Gp4s&T9Oj#q+xn(2^UNId?j)=?z{dHoFNXqX!2^&~N9$v^;s< z(Rxs91^Sjr1Yt)i=fl2DDQEECW`|gx-hX6-B@}c{nf$v*=~zokn7Y1GGR!5lL4|`{ z&7pQl?E8-O9Xn5Hy2SR15!}cc&}2kaE?l7LXsaP`aXp+x9aT=w_n(VW$4F*>f8D}x zG!%BW)EUFJme>#3gCh79qwD(R#i&`Ixfl`T|1`Q)^Eqv3JlC?q!95G-ol{px zDS>0zY{9PVMRLN8I<_kNo`afUD%RSFD5A*pn;Xp_w+%9sY@9z_N zQ{}_Jtw*4q2H=S^J+K&msj;W?m+ zGPU;WLD1dMo<7NON1URZ(%o=I1+x+Q3w!*U*=%2{o*XsnA%#j{vn_1`UCU{98$zD~ z=a9bk-J^tIS~o{Lg@bg;7A$t*nB!Qi%mWyEp5!gN^qlr?Cy~fEf@f&ja<}ovt4nY zPL}m=eh-lvr`o;`%*(3-hb|`Q>rECMpLU;0slC@#yag>s29mC~lfn7Yn+$>4II< zVv4&4L_*Pue93B0J1H;^n-g`^s3TH3M@$co(`e#CVBRV)?En20yth!tO-cB`9tjbZ zY&dV)^Y~K;ei09)E8X}A?W_JU~8#R~!q#Stc?7w|!sxIcgcW+ce< zq=4@MtABCdg2)R30>xn$dHb^c4oHq<$2`8yQ8pFF53r#C-xkO#>>yW3LBF#cQpJ&g zFOiqi2xj_W2XBiI2d-1|twp8@&bn>LnW3^@ouh{Ta;;OnkY0lKD)7TWE9<eszijj1P@WVq9ShlC zk)+P|oev=k6kT2`BV()FhL(3BTsp?kEfsh>=4Nj0a5TEt z?G-$!@a-j+rOSoRii@`XCWP9pPXtiJHrw}|x=)5?G^=H@Th4`3_RC`1k6KpU4A@3D zV73~hk+!M;KAd2S4`%4{8pK-_Gvu~FtY4qV<-`dduOVtqb}elV55zeSkGWKmxD+P3 z7VH&lqn(1R`s*N;mGU?9v;f%dbai4u9YbehLGaX&8Z&oBMs-5j*KA@q zDsM$M$N%^;|M6x1EZV zp?eKAHg!!$Udfp8?nI@$t;NH00$?Z*RQEIcu-1}25^RS};iTQzTgTkK$I8o+EIwH3 z$g6Ts3CD1EPQ_B;O{L=!=ALxzo7H$?H^{c>r;pwWbI6xmV`Em!JAJBhpIdppS$k@2 zF1i1#aKXFE2zKgk^L1T)pRFIayxj0>_3~<5irRc%`hL2-lgD~~cwe{YU^08(o;xI5 zj&6%K6kZi}-(4NVni{IrW&UJrdDH%o^AHTa>!hsd4s@zw{Oz6Zr@3Z(jA&lpx5)S1 zIb?5BjX~y*U-{0Sd2RtcPACl-2yGpb^=D^|%$ISRVeEFR_4zwlkI*-sq{sSrK)V{} zeaz?3y%p_Km8A3NF{nSBY9R1TCw1z2XtGAUl0-<@DG#p$wPd-fUy`_!_~q^jt0tyD zBB1WV{i+y!bHA{SUtMvh>*>h#uBoyab;8RnO%uEDE~*3NLI7ZZ{lr2e?W9I`fttlN z1BAiQVEyaanb@Z!Yfj*%lz*w36%}iwEf0jMmWzsO3_Q@ zk9t8Ml%mc{%KN?>hOHXt>HTJJH{@q#W?18_yJs~!n44fpl{IHXRS%_-({q}VZdSpt z%V?1U*>1m47Vuef4m-aOBT&M2unXcwGSqT$Tzj$_8(ms)|B6Z=8y9WUyh!fAE@eGB zx~+^wJ_zh^U!1ob3-erdy@W^shD21y6mToRk#EI^5HcMy)cG_!N#Ni`+l*4q+~2)9 zcK|XuTuMx4i&fm9%BjI;;~Hp!(OG#>fAFtje*jnH8CW_rV3okH578>3zHYZo8&E0Z zP7ZP{<4%mQ|BZ8go>HtFXB!^x#)WckrKj*YBr&K+loZ{+o+?_k_>gbQcWt+QUSAzoR`OK#>Nu9 zc%rZ)9yi*UP!}Hwum;@Vm|No&ByH@7tAt z)JN<35co1JLb77xA?`>c!^!~la#<&;Pj~_dSQ@hwX0Cm>sy>T*dLfaXVW<~8Jz}BG zgW8r$`+?u>(6%KhjVtwx!a~sK(_!Y5T(j}WyRj%U1SKM2Jk}{q?rphkGTdc-$&_eo z{A7g!YjRB6a7FCwPJ9hwo3zuN{Oakhzd2sb`LntyVRVbWbR3-xIIcpLnXaZ*QlA$; zb&jv|eRl(0$vH($cCC}xDS*t0gB9MsaleG=MTNX8VuJPvI*G=E@WA+nV4DDy=TCj= zHrlX_z<#L1;hqfkt(d6QD>pn>K9&7;M3U~UL7GpqkHaCwhCCDAlLMhN7! z92AwcZhFs^1S9Jj&uBGUe=#s8t0WgIlg0_4nSzrAI1{Vt zcY_w?R8b$iI9)3@t?cv{y;Pg*tBWLbiSi2nJd1q?vIWJ_pl8CtIUB$|RvezjH0z z9WKx6aDnP+X@ru0w?mBm?Vo*j*`cby6NHAges!USH1uyw&y}%1e7v z%=Xa+ISdvKPdmxtb*OB(P_r;{W3!uK4x59SN|u%kg(lu?-f|^^HXe1=pM?+NLC)tK zxa+EPWfT}##98?bNH}iqzbfo(w1Un);(rEgyb^k_?B6V6ZJoXraJA|qC~w8MlnVy` zSRuyg7CfE+Yn>`9{LsCxmvv}+%bPuGby0J6s~T;z=OLZzczBL3J+?^d=nZXW>hL?) z;Tm}bGiA=C_E^_OoaaF2WY5#P4gp5Br!ggZH`q+~~EXO~MaZ&e|BxW_ZQ;?G)rU#Lr(@@a$AMjY7nN z;gL%bXwBb!z5Ei2zXSH7O{s|&9h_@$-!KXBzBm0$SizWxlfnR$Fgiv!>Hkqrb8i{R z=s0Z)TNl|c%Rj=@n5J)iO`yp9@5L(? z5xq=JT9u$`UoG3sn7eIU(>cvhm#lkr+a;i+oS`~F0elESJ@>wW#!~S0zj#dEFJFK|ss(v- z1|&W$R(RknV#E3YcL!jJgaMO4=!?MnV&9ZM@9|c(*(?M&D%dBK?-9f!Ua?AF!Fqa2 z3+V=4D{f=4ihWVo*<}kG%OpVD3|snRjlmEr&+9tjlq(1_dSibyb>Z;H2;$A}Ao&|o zTmQYKoW^K87abPC$Lcp=htM{vLx=dym=@I!GzU`I46bGkTlE)1qnfTxOWU9sVl5$$ zaqJU}MWBC5p7BALypf4#-NGs!-*zgN-Ao+!w=wR8_how6zhsokOLDa}Y1SkKQ-=Bp zJ)@NFA!=M|>{a1Fe2`NuhqXK{ZNp}W;v<7&H^v8^v^V^zPXsHJu}`3}{?+=RdSgiA zQG}6L{Ahe0EFM>+j0*$Sm41twpm`n0!ghsDSH}G_gQ3O#@X{b;c}UV61@V*r0Wq%) z4yXFZ(t{FMAW6*;#AfoCru$D5gXYO03#AdnQt_e(I8Wy~e@WE%10%=yS2JM&fqeMZ zRf6(><<00s)3;;kIx%$|8aa;-pC(4llVfJepfUD+fWzJTV(vN9kDTd5FScWq{$`Rp z2_y&Ao(8dDhppS9?F(%L(w+hN&9Ky~04dA|=fY&+sq^nB(xSf4vjAKTR>7atQR7O8 zICjXe8S)5)6~+Q}jx0|!uWWW$3PRL}9^c(g3QAOr9s|2w!{pG21(Y6xw!?x9B0vxX_IbqM1hj>1j?_^4R}nObheq}P z5~2DB9G0K|Ef0PM=L3Ug6}&bj6aN`Ze1`{*)p>3HduR#uSpCabru|f>F+FI+h8VS+ zm$NfiK#3TY!%ORVUv~R@y2JD~)Y@r5h!ZpqX zX@R*=8f--JL`gyDu#qkL!^6QLheFeM48Mc9(2fVk?qZtYNlmAB>ga{QhrALcc%7Z&Bp;R#Vk4U2_=>tWi0*ZQoU>Fo7e1Jz+$zbYv z`##A3qu;q;Rrv>py< zjM`NHaX{1l$1!Cofo9}Egpmpu3Ke9fR}6;_aMvkd#0A-gO)w3o5mv!AngENWf<{wD z0hEv_$Vld;B?>Z;2N+3#3@870K!c@!9r~|A-Jk#A{qN}{>>#2xV3Dg(X!XbdBT@x4 z(L6w;pdwm80RTi)5ln-74*+;3QMeS%Ta6N|#|$9B1rcQj+rR%W=>psTf1<#F_;kp zD5RF5IRhJ-Gq9ocS{qugwW0M|8=BRyp;-+ZTCcUC^;#QRueG7|S{qugwSmKC90kn` z+0e|84XyIp&?>JDt@7H?Dz6RAc-hd5mkrH$+1QL1w90EktGp2Tg1FZbnq6B0*I!5! zP+Jf=gt#F@4IyR-5krUT z=^#euAdL`Wfe;CVI3Pp;AqEH$K#2cAL=NI{5RHRa97N(E4hP&XK#-Gm1UYF(kdt-< zIcZ0blXgVoq#f`&a|@*=o~2b0`G;q8Gyr}b#bNomtXNXszI{*k>|VYmu2{AqEkCi8 z6|~BVa+W9NN^bu{%~wROSe(VOE&!Yo`QmHlN*)yk_PcPElSPw zgDePmrsJ6D``QJT76tu0lYhVz1X+?qm5B!SYfa#<$xvOPIB1p9}6(kSWG=$)cS;TCI4ixhO+X1d8nk1T4!-@XZsYDK`x*t}|JKX- z-0EaZt9ua7a_2EC^{um^Wo1Q4&N;AjoaRSevy5obDnnOCzML7AruiQ?Yr(^etcX}? zQmTWtiWXl(&6gONP!;fjI(rW6?K|&7H9F!reejh#p?}?+;K}@ zdOk2%yQ<0|8s5{PU8_9}K^*a4X4}j}Ng~EyGZlG}y?i#*QD(uOX_lp6NmemSxHea( zZ_p0DX|(cB{+FqD>ecn^beLd+DM>>k^?HqhiGNmAh}zUbmK8n4c1gn7u$V~G#&a)< z#q66_vudC@4favG$uzOGUlokqzWea-@%8;ZfCSp`5vuKJN1*Iho1e|lnsq#&K(8x3 zYJiB_8C{P8?7jfqZFvaQB5?@bG@?Ec}RKhP^VFl zg+Nw1_~zHg!>@W-c`7fmFiS#xXp}~p6z4fB_MBcycTCx{b@*LLL;krCG=D<2>B4Im265rVu`tC z>se%p6IBCc(nA{CnrIO|ax#*kqQe@WnUaJR+pnZ5uS?S+70jolseupe*h~v=KS#3| zx}h+O2vLF^3-(!UVr2vW6C{eqH$hy7SCG%lKm2bNY^T;C4zhx%Ma?YlhCcC8CY|N! z6t(T+;%uAgf@J>6skMqh$fqd;AF->5rnh22qKJ5BC{R=KSwLfU>u+!G-#)(o@!{e1 zPd`2g%q*FrAqQAMAs8Q35g3axSP8*41q6#i42ETra|Q&q&mdTiRX|=n{`?U_7BvJb zpCDL;)%a5c!M^Ms-+n-mAOBMiDTvtW_NVB|Ed5FB_T9q!pe!pkg1nO;BD+UbC#5 z24;!-wpYyumSOO}RW`yEfg}bRDd`&2n{VyT7+G{}(Yo#u+*XHJNFb?awS` zoJEPxBc}OLWQ2cTw5z0$e|*IY(iVRxf(v8zzFo-F0Zk%;r{>#=Su6&BG6tZM}_YUG~_{U*pK{{_Va|wy=1xAox-*+&m>V^8Nk0k3*2f z1mty5aYu;)tLG4>FFeKWw|5V3yMIcebo(r(va2ZRmG;ep%tiOlVVuZ~FTJF5vEyne z;rnYQxSy(!vw_9O(O!XfHfhEGlg;wgpR$xzJDT2nh*-#q8_|mF;8T&xU+=aeP8ZAd z^6#wM2=c>5qkaSDeo+dCdX;T9Q4rC1ys6#O&qH0r57CyDl~BREKC*JYr@rGamtMH^ z*?P6`o#p?rcWvE~+RFN`_~ks!qQf0}KiOk@Cf@PbKDM)S@-z#O=w_P+!lga-Lw@^_ z1byM!D$$)x64pwx;-)@H2&ukOsZ>J9Hs-Ek7`~}kmTl{%Va&}rnmaa@9Tk%Y2AaFJ zY^aW5>&^b6o5Q7As4CE0-|)4$?D(eUYL<=_Pf-n9Q!Ur9k?Benf^mb4ZYzQyA<^zIMCwG|5(X(2H25zCHm!(I2y2_? zD0>=R%Y)=seA?AiuMw@3a5F$^%|n4hlu-r+`94#burJAAa7Dsk;9<>TgQ0*t zj$xmPMHS(1V4B*CMuOom-7BG++;A8S!2(=Fc-vp))g}RTgM*M{rGUxoq+}%uOkyaK zP-3|Q3j=0^R7KPo1p)z^T`3Wzu<&5wm_^rZ$RvOn#nfN}0cdnc)r&A34uKWLF|5~V z9FgQww^Rh{0|tc8HwI%HVh~h7j6o@bHnBWP238_;YhFSw7y|^5#UVy@ zQ(__G6gDO4$`T}>36LKFl_6PB6qxzwB7ucKK|xs(0>2gw_selaI0D#2#t&@k77hci z)k+xL@F;P_<`=CJ{^=+Tj-Y0XL{IRDL1Czu+<{FOf&lkJ5#|BYP$Hjg4HA!>6%7FZ zf@o|d2*F-P#9&}RvWO@m^%- z)_F?(l<<{DiX8;k6;dD29C70=DR3M{a-!qVk|Koq%3N90d#qr*{T}dI%^824JIA%!y4_FhDDgAb=D_ zgVYKbuV;B0B;>t-8jK9^Rg4Ot0lbOI2Vq_V=(0I`Te)!c^h%Cf+lzC3bJ%ltC(5EFU zE@^|dg>DZAZb6rd20yCuNmo1BaG~#DUg{}0j?F1JEDIJ9p}-W>Lo6yD z0;qQC0f@~OJp{t&71XXIjq})x>27A?uxwy~XaVe;rVy0+tc8HkPre1NRS0aCJ4y#k%Xj%j(1Oc~u${7f@&ZJd9<~KdA1p!iz25l?^ zLzixE$a#ZceCIca_#%w6%t=92P;Vczfk8c2Ka&kZt^-QtAkfz22B9`1Nm4~n5DcY$ zKO~k$3EIOPEoM6^lEpc_c}$ljWu{a?z-q05yNGQnU4JAJuidC~8?UV%j@NE>Tot12 zd8VZ(y6+;(FbvP-4AG`7sK3r$Ky+_!aD`*jcT`)C57b_d$nI^xaOkx*5DHAsuLfC0 z)(y=k2Lr7;0;z|Bxo;0Oc^EpM&V_>GH?x_WA0|OSvm-dRtpxi1Xk> zX#8^-SbO$4Djq(c?H*-SAT$~85*q;JzTJ7qG7~#t5a-KTIhtp2x;SBU^cAK_9JBkV zJw#BDuA)VHXwIKiV^|6mIpP*B@*vE3q=~GvAew_y_Vp!`%DgE6K)Jx?1Mo>@D?Yh( zmss!EnnKz4`Hw}H)4}w^)#d#FPwvTGKVRJ3J`L0APW;ow|8mLwcyamD&E03-Vt=~+ z_38TYKi7|3(s$RtJn_fp?;xDA_hkA%e16~+ukuKg?SUXT%YXjy;_fHz#y{U*@qPH` z$BVnC+l%LeNjR9az`2M9ju*gjCSoVOO=fpN48#>Z5j{&%9|q-1MN-H7=SjNrui$kN zbyh6kFrpRNDv$n044JYe1q_?KCM@AcG~>yGR>x)@lE~sJg2GsidL$8>C>8oJwE`-( zo>49f+IEsiNi1d8h=R7vK(q3+$a1zTJe&!N zWtAvxGS5k?-GUr@%#k;o&|wc+E{-LdbzvRgS8m{p{;zbv-P;sbLE^lNXa+dx>Y2+z zt}me(jwbYlwWoM z=!a#&FB>3$ETA9$3m6ZP%P*S%`XK?dH_5+#eB>8T0YfbXe2(k|AiL(5%>hG=TaaZ? z0*OEWazMNzeOk8}+JJSZLu1w$Um~?k6p4iEY-VBOM>Z3&0g%zT8;9t(BF;w?F$x|F zBZa>a7H+K{2qRNb~c?v=GtR&2>VVE9=_Cc z$FCyJ#u6y%ZET`pFi>v9atQLDz}OB+2xL1%As}G73O0nf#j7FBEnf|BZuvt)p1Yvk z6ySu|wHYz9c|olSQbJE*IzvK#j}iDg9QG?@BHOOw=q55v&-G;+PbTtYB6l`rGLhLF zrjb+}F|2=aWBQ=6OfTX7jj$TlB>7w;ok1#9`#NK?tk1?+)`u)6a5St~EGICMlQWKU z-|Q*vg46IcU$p!_TbGDqaCWQiqcFGYBg;XuZpyN)>b^ZO_r%{N`6=X$AUy%-niIlnBU2S&QNQCqv zaTZ@d<;tw~RTMpke8Q4r5kQtD%hc)dm^Cpm4NaD4j>KN^Dv0_A8bnR=K?P|Xt!RWd zc@a#O_;H&3FqaR%+I~5(SoQ(*!LaoK?12dNe&k><`VfpO?tCK-HqI&-=uFWTC1lvO zun-XMVVx~P@Nh{R&l}6%5xp}w$~!!Z<%b8j@app(gluVmliJ1nCqrw-@eXzr3%Rou zM=_HXYpz(jXLxhjM4oR=X7XevcQ$1*lR;odtlA9Oh29y}{K{HA7&BIJpJDm+GNq0hF+#Spcn89K`}KWl!@BbuL>z z)^vA@0-G#=?xsu@z=?Q$V(mYlwKsmN9<|+1e5J4$UsqUhzHSu&MnYqVcGy#rE{`*M zpKV)NKLlyEQSVXsb?*DVtlPTpYuMJjiC-sv?QY7%uiwuqw=L6-`ItDBlT(RSjp+VM zze{-=1bsMpQz-@JTLuy$+6Iyz!teQK^3YUPrH_H~P!=p+@Y`%S7N+if-~S@8nBd4i zCGj85fVfZl+3FaiU#s&dl#evWR9sEfuiF8fzNno zsQ6C$%vNA?fIx(dff|k%09<2dt5Y&;XYSxWf?XejU)M+XSnH~7`le?g*_*3)I+QWd zYj;y7di|acQk?4CgJtQmu6dqkdmfUJY-^e`$5^)Js-mloYdL7HA%AWu*q9@v>bCFt zwu)TEM6zPE##);hb=|Z)Z?4T1)$#4Qf_#i^hj69pkaAt!*9^m%yPl(C$I*$ZGHj$M zw&JJ?!ZJDzGp-Ml&l=2&YcX0}16gqmCdKvXI5EY^xke{O4-Jy%<7seP$r#>qk?dNw z>3Iq=vF&s59;vjK^b8@YYxPH+=vo!lSulM_1c zPFm@4hdn+2vo$syyfomP{BwkL!rxgNQcZ|k<8kxE?|stwV53^o-luyijEMYj@$>VK z_m59JqA)eQMevF8C4r}s-1j6f;rpw5PEi5QsKYqrIXI(C<4vSFvUpbsr5wMWO^Skf z5>dHW5VsJ+HS;8L<1#T^Ge;sfPOx8^`4PEsu^>*cUz&Ldxp9RUu9?k{8<&dV7J}cs znE{a(w-g*NOTqVR=3C^&HM1>p;{?Y`Gt(k3?nM+QIFDZ5#BiZtzclkma^nQYXCm02 z&8(H&IKh5l$&kgM&19F{IKipZOmxYO6YSDVP*pV3YVzW8!6B0`1#yD!*G%Ebi(3m) zQb*!X0JNF*^B{ERK%k;0b0EA233Z664HwtWgV4y~PH zTrLD!Yro@M$cNDCk-86|U1P&lel#b-r>k4KANN6uVkwB$PD*;PwZ8cD^hqM)C~+3; z3&Mt+&8+l+HGJJU@g)eI=hehs zq=;xDz7%KeOosIFyXUmm!{vijcY*Kp8u0EX{mzv4es9XVAEzCs#Mz^MP}uuIt2pf` zEyAyd`~;*Id3`5Tl>44ZD$H|nB$X3zhty%5^4#tan)s3XQZuC-r2J7~khGF)?D0#p zk;N~*qj?@_Is*Bn>8RwFCL{G^_Qo>Ka(Y+gxkj|{hiFywm>nCr(WXbO!v9e}(ke&T zAdV;7rsC;3QNgzEshrywo$tzLZglrVbK9b`f??A_1@1q53CJYJ;n^3Qz2MFE@rwQN z$8h{a(Iu61j)=CN-H1VS^9}>q;@qH4rZs?xo3>h{12uMwA0!r|ymr zN!oBo<@FF757W!uOS9oEtNpW>p?I z@0aDs`|!c!YF}j;l1XHc_nu42@BQT#2(J|$!EfJ|PPUZKNk6j$&~1r#(nk8KSy{CDh7ep!tzARb%5*iH<`cH(O6Kx%}&3KTF_p+sYcaukg$AQ{_& zWb9{b2id~QNXL%mbnIwu#NP@OF!n<(XH6-06i-dP$`Otl)xfguW7{IDG28YBR!TL83aPf&A1-v7cl%Pq zj+|D#f`@t!rk(hF@$mbnr%#;@@1a26!K4qY(hp~^LB2dAFHG+NI>X;QoaFQc0gfin zndJ7HK{xG3C##VDddVvIyjD|!Ir>+$0;%cd@4!1_B0|j>rT3`@r>qa>d zqvUz2oGbsL`c9Gbenz2kN8uAzVO1Ruo0Jd8JS37WXXNJ2YD2L-GKS`JPjOX^pIZ92 zS{q$)P3tGWD(4xS^|b!akQpNxYEcj z{b7pJ|0A_%T{G>?KS6!iT>>1+AKGth!7QOSv2IQm7f5SScopMu4A`>Dx-uMX!J59K zI*uW`uA-=>%6BQ{G1cL)1v@FkKVBgoxHICgVF2(hcupcki!$azlavqcbmnkr*7<&UAB8#QlFSB;6}#=eSu zP4$uOE1v1{h8WTo^t-OR`-D#)7kLnt18>-`&~8D)iQV0Z)A$h%W^OLrFz_T4Q!j1v zA&qy`2jU$&#QVY{KR(@FjPP+B^u`M~%5R0qt-cAs$!@#hbCx*Xi?i7I%6E^>t4H5O z^ylP`Ii5R)X~>N~hJ&L@jVi`bEi42i>W`_&EqoIVP>L?|Ygp&sABKWo+{K%ay^^M!P5YsH}XmAsXwbx6WeRcLx9hB*H~215E9>po z%Yq>?-4o>PUWwFt<@&IT5i9AA_v1TPb=Jf~(g`mmj0jq0Pyv8k422MwYz<$-Vp- zxYwoC6P(MB_aGU(#H^!Q!9Y;1Tt5L!CFLxYu5cGLo)uLv

    3 zc)q#6P;mznP1=qE~@?@Pb9KHB`e)la;n~?@y9fN!O<<_8Ma2|MmkXl z1F%gxlVAMniu6V7eI+BKVCkFM5f^<}6vBF81#8+0uZqlB&<^9rtgB5qK|UR(aM%(P&5B^S#7okc)(7eHBwwc3L9nrt;w%o=u-2tH>`RsH z`ifi_jBbi`BYJlW7StsC;o|P;=Ij4yGewcR`tK0>@ypZY&5dM>V4uF+f7SK50QBR{ zXG0M7<4;eQPa@dIPXegR2St`;OAM)~A}>jRsv+_%8Bh@gs-i$m6sU^=g?rT$1qu!T z)exCimk*XER-t8yjT_4n8#b0DHfk(OY|s$oUiJRfppSw3leEKAPJ?2U^D$mVZJR8dsoGl>T22gX`--AA*0xEA$o!{CzO|Q`I#H8B+MYaszs2iUk6%K=TpuWHRPRc$@B%sYA$yqCs2Q90}QdQKSh+0zavydQc?Z^+S<590`%G zITAVpH660RDH0^=awK?!4Dbj+X+hIW@Ozq&{dkT9kB|u-Arm}@OemXZU{27$oS>Od z&ecFhQi=qb*K#EItAGq_ITHL;Kqj^v3H~ZJczxR7^=X6GrwyJ7Hh3o3;O}Wezo+hi z1*idjQ3GTErAQY#{R|H}{R|IEC$F@fbZz3U?6a1c~CO+HY1b#?Q1%60R zg)T}@11>C2hki+@mD2-%52)49gBlGz1NtGM>Y!%;dCr5H{X7$94m;~V-Rq75nmxCJ zAt+Lj0vq_h2_6C)4ju-IVZdy%!#hP+bzSM-DrbK}+>RSHG(rDQsbKoNs37H8L2x;-UHyYgL zAxogizkvs!Z+d;De|9^1=v|*ZKHS|y7C)&2q$m>Luy+HA{3cLPJSheaZbx^+O9*xV zY4Nr<8Y-tfP@FZz4$saZLv%la`NAKrG!?YRA)iwDV+bLo;pO0b^wc0^cKADJ29CNQ zo9C$i`POnY9kgIacvEJBTs0$dW(|OQyoBuj9&ZQzJJ8{V$I&@V$0R_I)q(&a67BN< zIHdGnWtv1wa;&)txEuQ63p>G!bQRI|&kB0WQlFnjLQpS$)W3zSB>dk@a_?6|O{z0@a{|M$ON{50yEcRM}&rn4gL z$%{{Z+Z}g(^2_7-c${@-$sy6)ht71eS_fU4{g`!67!Mbv$^6Nm1~Fz9KDtV;Ij1zq z1zWuG1UPZChDo@G(S*l?k9Fs@IS6X5X(Vlg_OybE~B0j~yLZkso^G z%9l_wNtMk{QpF#jCihD+2eq8Os@$v69qH_=%m5cnO6O_bB~K)&zyFfruZzEH=gMDX zvvpGZ@b&eOzWJx(d_vikc`U-r7jIk)i!b$t6wkl|kn)gyGkcJvSfQl4v`X&k5^#E6 zv=v(4ZnbH$eBDxY*K|k8-(KP!X&s+We4`Il?H<$1=YnS3p-Y#&p0T4W}q36t`wfPrhF_D!kDR6%Kq z73Qw#@bOn9})Wm}eK`mUx$fomFuf#i5KZ(KyIp!>FvK3>ez{k@j;C?fMbYx7 zk}tochMr8HFva8=H#!^p`JMEKn>`FX~X|_~lj?&4o(N)PG123;t z-ebNbsN&m^3c`N9r}{1g#bi=jOdw=Anh~0&Zdsu&XF^%^Kp-fXBes?nrP~C{O8Cyv z+?E{d?v!K)yGMK((n~X9wg_2-PdHZ-vpd(?F0jUHyKa`RVQ|k^S?3-PUFRZAmh*zr z@f@S$sZ8H4IM z=o<5>xM|XcRp5@+u=#Xfte<|HXWFs$$?Te4!w}r0o0n{b(epM}Ew*I|cZ_j>bfgBl zYx=$>=LgL@!6)%n4d8F|%|$fM>W**&z%_nvQ{fFB$|g3t0)f0*#?}GtTZdhy6N3y&Hd!1yUDxeuil(k6m&NC{4O}Y> z$LzLhD0Ttz5@JmLwB?;oaAy7dM+fR^H}( zc>Z{OUAfciPpu*?LHE#NI$HR%C`~#SFDSwa(dt%j{8REH7~q36$tJNzuP^q9$+F^2 zV~d+=p?uXED&Au{w5q&p<@#z;6c5TgR$kM=GttoE1HSBXVDvsm`?P( z^n5X~j@7P?-$Y?`EzPEL4fo3YO~;Z_({-c!9A{(SwM{#suO6^Eu~@v|`fvv{6?ed3 z?n3jD-xpa#3R<`c^45CwwTW3!d&UZ@Ml3i+mkv$~w=wKO2!gHrK>DHS!f2@|eHm;n93+`BCz3aqYijQ@6Zx0rW) z=NT>BhTz|9l}P=(-6rM++xCsnQ2oFOL)VqN1b6eT`Jx{p@EHTOE%EtH0}q)DCkV~I zg?>fB6v@n+p>ls+Hy}dfZexg35c3zSa%+3K82;6I}uL0%th&h7Dh6ewi9$()#^3->5k#*^r25kJrTY?-2` zJc=TF6Ybu%DgX(I0t($J=A5%9DS@b$F`SU|KIBNC?x=hzu~oPgalvT5fv_;gA+q%d zPrkqpLrb7uY{e5--dS?*Fj)m+xYFIx&p;&^Q;kQMGrkxS;r`uPe z2T79sI5(mn2((24-CTb)j{9w|+nV}s8N6>r7=4-g^EpcK4jFUDvHmIlk825{4N9PP zxNf^2@4cuSfl%4EuFm2`k)~RXZ(6pcn~q!{*{U0LV-R!zV@|$IcbvdejjkpW!uglr87{^;5&tv_O=Gv}2=d z63Y?GX0^l%2Cr5N*XFGaEc(GH0twJqb59lj$Ft{6ZYB}D6U@yDA?bf0ba#hGU=fk6l%{nZI74UT6pMXq zV}3rIB?Rl&WS-}TJ=Crvp;yy|e>A!~y(>sj76KyEGPDK;YRjln6Veo`c=Q|yUS*D|dm@>zF5HS>U^ERrcVdRBV}(d_bPNCE z>XOzH+H7r!AUO-_h0!)pAT&H%a>Vg3Ylkx;KO?_yQ{Z~C0%@0puM3nQ;3^8e z`O`Um%hi9n^GYCz9Dau0G9{iVlO&lRosk0F`BXt){7K7I(%(+}0PUsXWQqTdmC(<^ zmp#-N4oj&D3oRxuHIm%*AC1(hYD%L^9_9c}20k zuhMqOOU`b-m6R^m{^I*2>6|2s?@2mEvu|9K%8YaRj*g7DnhpUiJdlHu8m>jn@Nz@EqLgGTL$j6PwnjG82 zDw!8VY7pv{Y1^{t&CHUL)cEK|{zl@cgG!^oLmLb^BRY_{OAhchKGfkwJj4lq)UA$?wZ}2xY%Bx2BJcf*LNRdw8Ji;az2k_Zq&VZL z?@HQUlx>AhOU*XT+U}Z;7Z?b6VTkazmrKNxH!dVrAl1Q473h&c~XGvcTM{cWGV$lXx8_z+BId)daahrDr7}Ud0T^|FP2^-irbQEVMdp|+pC)GfRs`O zx*kl*cDzv@^UX|I&XwhC>d*XV6yeVqq<$KseWeC`j)JKYCeyi}k!)MKq3}Jfn`K)O zLe;jLm_hI^%QFq+YPx4ymYm0xw8|GfAoUl&lvvi3TP#VMI)2q%&O@O9IzJ^=V?&uG zN<905Cz(IX79d|FM3&vgVS>d<=O#)0b!MIbudyYj?jJPZk|C?`*S1&d=3uRWiYYvb zPdO3f+1jLXPi)c$kl)!g)Q9fdXt6oVMC@$0May<`J`NpIGjuX>T@={1+%*^nK0fgA zAprhwAzZ?=wmj3?aEi47+-mQiRHt)IJ=Qkn$0y21>4}~f z!Q?0LBAM;Tl`V7g9Ji14tx3Z$Mzatx(!DM6Cm+qBd9W5irNWfPvTL%YBEn-U1CDH# ziW~$JB_(JL%)Uj5%vCL0vZMgCB2G$;uPymb1La+Fbt{ZQ6B$@r8IR?J2@?!)`>MhSsAU8q^3PuF6nQ%% z3wKojNyGGuct0f6(!AtL^86K{$QE3?By%yt?#r9znx?$Qd0JkRQzr8lGflCN@pF#` z4GAKGW`u^~*)utpNz$kt1U6J)udhoo)UIJN&Y)EVVj(T+`FBffm&vbTV>5QSbb zjq1Vb_=Z*(m^M;H*MrIUhLX^qprdecblrctIU5dp7iYtxRTbT-DBXF1jSw7*k_OlY zeICaRuqhlHXK?JR564a$jMZ!c$IhEzv!{~>I6Q4IwH6IN@!|^{yL^RXzciTA-(Q~k zw_Nz1b~Ke34DMEDU9y$UOu5}A4q?YP>?ktEmSy{vFYACXOHPy)jvKAtO6-Uzw+uXU zv{N}3opgQHRFXPs8ZQ>{7iL}rxqZPd16FOF|Nern^5fzCFdF|s*@eV#t`<;!HGyGB z*{9ZAQY*^n9R<@1S@^oZecP+#FZkP{`b}6XY|re++JM#Mj?l;%k1fseRoiw+HZ)o9 zvnUjmGeUA=fV|`mKlF|mR8I4f8G9rNcj!+$mwuW}{ndS0FZoYDY7(@neIZPyWFhgB zP36U2EgE*07&13p(kUuka&)WjAw`fy@ zAlq#=O@&}uerO@rQ$yR<%}CB|P21+%eBhZ7$h(Q;2%}-3$w$gA(?rfZ&f+kM`1YV( zL8#pR)VBp)(}C?|@8L=>Xfjvw@jk{2`^RVcg9mh@sYV1&mRMmE>bkqBG-n(6bj(G0 zY42rGzMk*005!^9In0TeuE7g|D6zJ}VaRxma>1*MXM2 z$#tM#;LE-0OWr{5XICLvJK?yL~u zIi{IzV7Oi=9ZX{jEGr=E{OX;=Ojl{P>76G~^Sk_|DU$Tre@V%8m6$xQ{6&U;S&(S> z`uc>_9SnhwqyVC0yxSlt|0B!iU=}x1t6HzV4|ia@@$* z#*TE#vx6G=@zub+#F+>+1sV0TTArP$_dv@KHI}>;hu5Gi9#2XKlApQc@sCz$8e4h1!G*p5LF)ky|rm(X&FeC4efuXhjSe zMqmXY*3E5Qw>=dd#L)YLpGpiJXd7x>cwc+D!%)V+u(4j@r1)OLzBTJb;Jdp`45U;m zY_{24lUxJ%vqyoYs-b1;hAo%?`!y{Tuk`m>7I={p=fm^IYmT*G<5Z6%#r-13=G#vi z{L3;WUIfJ@KT=1^DG$iUROH2_Ln`v(xehB^8b;M6XbsGsd3_T3bG-B|8YgFUHG>9+ zDtx{59nc2PSDG)fmMKjXRz37|b8P9}*zz0|SyH6G@%CKm2WhJb<{$E!BJSrlUb-Ju zRs!7NHm^^6_jqV4kxN(tD9hO-p2iu9cs6C(5bU}k+nbkPU&ld~BolGQGNV@ECQ*nt zG5(t6v8qh5-}@KkUy-Z9|E$~xb&HZ=GR_1CUWJ#!B9wl`WKjOS#HF+$tx)M>Av;de zS?sghEs7PnK+9#$-sXO$Fs`}EA3WaPFh)Vx5WhdtiRtPoC95^SQA<|KQi;$PH2I*4 ziA-*=!cgZgCc2{IO7ZU4%}HKU4~h&_k(mT2C4#Hi?{NY|x#&XdiP2l?z`LZZYpUBo zf|M5~zAg}Ix!X`T_M`xPH|c$ep76R`TB;R=XS2B`cfhNW<*K&tI-cer!K8g6KNNecXq0n*__3I88c(um04}7Ry3*#Kn(4s}1j0jrPYAId_PcCoG%V z$T9}fX%5}@zV7?fw~j56ZB@~V>A|<#(bDbE+eWi%??V#{-q`f8YN4sN>bgkx#=*lXTST?%1$6n0za61Q>u?7BZ~xgcdz#>%6Ks@ zKkXIUJOOH!;LS^l_Z78HZq1Teh1y9&@v~CdnF-Gx3sVKn{-3>T+in!sw!f119vI_G z?Chr`PP&q=+;*Jm>eDX_8DyJnZVkdN*Z=G{%Fb+49GY5ULyn0Ho#9)vgSNf)X= zb4SZ)8AGjovKnTNQlSyIE!f<@Sv}0%x(r7{DzD4X?HV1cJGCw@Z1BhHc>`I4O7&z( zN99Ej3<>R-^+u)3P}r<}{aMnooeB;6jjOq^-%yX9491m3_iCM@SLW+Eu#9D9@fy>t!_2_Z*abJJe zRJmE$?{Pi;_d`j{&s)cTxj*tsWO2IP!FAajg9>6^;GdR!*-J5Ia4DP*(ru;T!H?*m ztTUOt0+EB)C@`37i!2XNw}>@&{Fw=lYleKNt%AsInhtnG>NwF}On3^UODUFmpXF5hs((Rcg8xAQ$Xp4StyT*oGgm$Y}k&MHyQDVSsZ-q%B>`$iW z?RL9A84laSPTf5|?TUD%Y$A?lAAMVWPsuc#%Jse7rLij#aV2}Bed5xMkJBc`!0vb2 z6J`AG!%GSl@oKFuYMy;0e-AG>dfWRK@VQZ;ME2G9r^MmX);s$R!vC4ho~56Cgj#<* z2f0#C+v&PjyLB{v3Ph?cxoou$tc`eY!5t(%Ghi&i@oN2SG?iCgO|MrX$M^5NaY8Y5 zSPiQ)>>Gn=mz)o}_N1OvPg_tb)=T=No_L4QY&zJgWPDKz4l-?u8zH}&vsRLWte@E{ z(GI0K8D+}k;i|E_c+!`xU*quPKGr5-Ua4ciw!`Nv#c7Lb$1Xmeh5J*d`#^)Qn6uy^o&stt8@t z_Wbgk55!)nddx3Vp&<8fiO`CJ!Jso}+r5jn(dih&Y0WCR<(^JYMipj{Q>6!w?zyi7 z557D&EFdDz>}>4u`H>$J5W^q;P-FdA)G^1O2Ko3xOSzvp(p4tmvJsY^a9f--Q3mCH zt|x=@sGrE-LgG_52fnMsTGbR;E0r>9g%?^z&mb3;-RliVw?8!M6}9*fS|37d?*>1N z&|1k#Eh!*~Eh(UoTdQ{#TopxH_XJmZof5INe@jd)9@3edx4D^rL9Jf*yxviHAC(HMu~bkZh?|;HyK)ki|J(0nNBDDsdZ6v5wm}o22+%bEEVp~9<+Kr^Z53~ z$;h>1-31DO&&wL6J?o19Q+qv{hIQY#9*Mu7T_@I@Ml6%`OnmsW%K4w!w6B!&>5LF@ z*IuhrD+_lkF6yV^?qIU*cu~yiiQz3$PWbQO-&>N0Y!1mE=Z9w`?n-XBMv2hg-V7t6 zyToV@2%T8N3o>XA>K^z~Dxc-#GJlq8p?~Pv{r}?-E`AS)7xu(9 z{f{t+q|DDIXMp{BHtK=kq0lFEiMsmU-hJGVn$h$@l7glT-EpRql*@y3?Mu?|* zft~QXLd2of(aulqx!%Dj(J9AGP_qBpu(~~Z-ZSiee>mw3YR5bdOp0CgQqngy)eP}Y zggXxJysu$OZZ4;3lw|#teV3hlbq!mv%Fn%m<}oWYR}l%h;yc>bjEnVGryk~MaXRH)S3s9NPj5_{6;M~ zA?)C%GV{%~Oqe>3Xa5d-Sglj`Ncr*`U*#Q~_0ShFhkNAT!CfV#PHC+~r>F}7c zzmk9vN%Wk$u4I36D_vR{#|hWu)Ha=|9G*FzYkY9_(P{!ViT6jgbw4 z5Ie9<93lb7?BV(A?Q84kIF3`BEXtw;`%vyf!B1b$jCT?8=vP1J2D7m#8=+FOt`Q`& zj2dCKI=T@ox9%H(HcFxqN{Gn@h{2|Dg9g{<+OHmFxa-Lc8$ePAt{H;+ZA}2eU26mY zXR8Td>ti)ViD}RXlzLQ+Al#8^a(z0{njliQsR<(YmYQI4C#ex8l>p5knM>3NwDE+R zp)v=k2}t-ojQ|^Wrx6OgoF;&+;B17-e3~YhOlUTOY&@7IsLXL`1WEmsCXlV0(hMch z4I96r5h!&h8bMMoq7h{4JT!p`W!Myux(ba@8xNrgDs>DRA;2GK1W4V0rVwHMHvtKw zzY###`b`k2iGKnC=4pCFYpibs+xsuFX%oknS!e^C;>EVzrYKo(yBHW3q&G0Sgq~Zy zDfw7%+xhNe!R<#{aH~%H5CYt|H2wt#8eV8eiMn+&LqrK=;OVt`t!{B$V?K!6vr36^ z_Hq8j(fd2Onix;u=)PR;o7^%9kH>p@)t*gSePwPOR$c|F*|g@1aCLNG+Rg<@X!9vp zsK6k|6|ZAPJv;k-xF|rQB^Oe~+7IrKdyM5*>{&RxwY2Qwk{A*w7fjSl;IWaj0}?5; z>=`3fy1OJEL;a-_1wNcBTQedv)EoQ$hhtvOHIo4!45#|ogIQG@xHHk3VbZymV&2ap zj1nKZq>(k4VN_Xy2TeG#0$sPM4cHrSUC^U#C}PNEciocP7#q-aKP| zBSp&N01DA(s*|byFft!+$K$I{w`2W5tfanNJ+{26Wz!t&VZadv9Am)W5#R~MfM*!6 zj{=+bPZ&I=!!3dVqwc&$fNe~(ZOk~asX4ks;HirN2N*EsZBd2+CkXHq^Qxx~28

    `yRYjNJDzugb@~ssQt< zLW~#-G0z-grew&>>sJIm!bq|RqiAD{eGp@WNsM`0@n0A)W`xGkrAwHDnISPofHTYt zVHlCZFzz^;W5AdfmS6^Hg1Pe&Gq=_lk??(Pjxg~Hj=%ei!@qsS;H5;`ZmM{*^lhMS zkcPb*fo+!fD+01jGO%FTt@=_uEefd-%Yy0+jV^9^c0W$Ms(lE%poAS2?JmEv8FyaM zui4ej?h(^CE?E1iyjb%C-|-oZh{XzyL2QDRYU~D7x;%niZatAibFk3bo+(;l-QHG7 zirs+F{yFJ&?EVEMgw#7U`Xj~e;QNmS)*pObt0E1YQZqMFL<426zoy%^kUvUI%c9j}kzjH%`hVS%xy)JE&3B5SC`2??7 z7NUPBqjAT;rcYC)+K+B2c@V73sn{=~bvp+Jp1o17&9XxS#h2-Uf$3?2m+66lT6%h5 zrrdnW{wC$-@$qj3Hcd0N3sjfl%7`{ydcqnpT5Ue?E<689|1sIV#RwB2k4Dsb9Sz2T02NLvSP1d!KM?MYN+0wf3dK`>wO8#bA_+^Bkc> zpda3Tjh@lLFZ>GYhB(;gp{)0+9Q(120_U(zo%1wA}vr3-g_@8Tj1MqP=&S3!P6 zya_i5W;AoJ?w_t+|L5%C{`!^w)*kLZ-=4i(jXpzstlH};a|-`3jznx#k%oO2tEN7B zB#h1J>Wp`rALQPYmwx!SJ5wLNklJ%-Q?Za8KVIwn@r@*D>;Y_ma^k%J-VpcRBA!NW zpO4H-_#Za{2Pezz zy5P_IBi=vx*k~GCe0{yrKHuKHXm5A-W9{kr?S6C=7uZvLqR}hrM7HK9-h@VuKRX1B zMs2O20{7ePA8*>*)%8)a7q~$$zrhO}+jR5%sj?NHZl7*n?~hKAuTrSvo9jpI<;(TM z{Yblce!RMWIuhm2PjA}j?&|5&E$@z7jrU#Y0DyT_5(70#gRw?MptdY_x*c+d-`tJw zZ|}4l-VeWDz1{zQ^xD$zd6(2R2cDcoaQ3$Loy-#O8UOb`!48;w??B&O8W3FLzTM}fpf6neWedjji#UPu@eJ?nI}B2O2tIxqPe1l(q?-)bQdgV09I!t4b)~ z^c19Dw?a=6sgDBRa$<^L7|(;1OTQr)-niDrwBV13PNm_a=hs`EtDf7}r&jR-c|D5z zCp5($<1g1J03Yha#9c%v`2k2aX3f$haqLuW<~> z1}x2K;#*h_k600IR5(8W5;rKg)f5=lX#7r`3t&+q$?bWYnUM4%~Zg1 zd4yu~2psZZTFk}KP(~D}2@eZ5ZNdnaBO)s-#Zu@A9Lw5f5uCY$A@PHlVP!m0bqApt z(V3ZMYrk8Xv(?t~d&2&0V^ru9ig*)Ue@bz!$?3aDi_r zP-BA1CH~CurwW*2C!7uz{7Pb=b+!v6h7BExMztc!MAS5L{I*hd(k-c7vmg^c&Wma zX7h+5wI3WdbKX-xVJa|M6BQi3V=D0ul5{Z&o-1a=M@D{N^9(j{lCbFzOOOU%kSq>P zUnPm{5u7wxq8kBcTs!^@_g24?a30uLiNvKdoS?41l9hh_-3dGL;on^qL@>%T+5TJZ0SC@xi(>)Mjp={aQ!Cn;5bcb4sav%mzS3yVptMN z7xENh6;6M=>0>FzcUSThYo9!De-qK6x4!V4ad7?0bx4dQxn47LLq@-S9&Pj+mg@=6 zpx^z8Cc#OrjOF%vbaOvKvxr~V(U$(=$_mT#Y5dskc86%11nPYtNq&35Gw636^l;%U zzuk`qSennTcm}=G?sQB%)8qZ)t$s%p$hloA{eJvxiWcHuouGx>H!RV3?M(s~%kuUW z%aCQRDWcK8y#0z8kx}Fa(&%3;pUHP97(Dt-5Pxz5dD~Nv;2FjtweSr3mFLXJ^H>4X zXgymwz5=4#Fi`Pizb3u~d6@FDe9QGnRJ7=MEbselS-wDBB|OdVk1AgJSI6(79*S|% z`-OYE`iQvl6Z6x}^&`$5x#KRbXb7HxKNfXu_*0te-WWdV5BZ9MG|Mvr$~_W!{mS8} zx54pu#J6z_FHVTV2Z#~L@nh~%iq%~dhf6Ja-xe4GYe5w-==V>zZwhF>Jl+2xPxCU; zA7gn>0q|q$L0l_Bycb}B?JD*o^>8ff_;+c72PbAYk+osa|BzP(!rHwiF$CIC9RE%N zM(vl#@#Tl>BVlv>+L_(^O#hX{jB6En&HaSdD)IvO8Gr8(WwXCLj}a3!L(2w8U--Yd z$e`HBK*r-iKpx2vTf`;u8Zl#8Iz*acj2;qW@eDYbfz&5s7DOneI8G+W2Uy4YT@W)L zWBJN6@PF%d-A_JBu!5Qh|^ z>7IhfBd+sZp2?hd!nqlO%^4RZQ^4m0kd~>8DON%So5{YJ zP@Go{U!2JuMO03prdiy7_27MKS>B>bPGw}shgCIT@dH)C097?GcX>>RfheK^D_RlN zH)ON$Q%=QHQ!*WtOoPPd{*tYL0y|zZ7UWRLSWu&cvB;Su3}M5Nga!Jwe%*?TPaLjC zaGYh5<(jBtg@ltd>jcNSvPIqniX=w(GHmMaNy+Q@o z`0h&NS)jOfvJ}!(1r=Qba9cB`B`F#i;G76pr&5R;O?jS^PW=qNAv`ad3QZ?S#Ygs5p+VAfmkuZKJ3+ z@$H>RH;Ql*wB89{;|N6zI}c@}s6<3Mi%a8(_G8oAAhilsh*YQHY87m0%sLNUt6*F@ zM8vRBT$@1lPDmR^m@X}5p=lgd7N6b*s&RBX!RBq$8BLjnp7RJaif$W*&Vtc+HW87| z;?gL#!+3BWUsgi8i3;z;hf%~^XL#2yMp1f^_`#7xl>djLNVj6e=^>4F_Dcms9i_B&m&(etk z-=jVv9w(TlZa|oi4V&*!;W%cL1tH^u2eHPpOC;j3I3^M6)^LI9EfJCfV*i>QBx30n zLzD)nc^4sRQn?{|M}wnM)zRUY;w)ne&mkX{O-Y;?5ecwp8ZO2d{f2!eXGWJ?Y-nP~ zDYlax;e#r8@i|l4D&>S|E}yujioW*~PtC&tQMR^-=874y77ADv@pm*!w%Z&>!yOP} z+eq6ZU3Sy9JF^wAso=oMBS9jTCXqz3Id#bl+b@he?M&l8SOLkR#A2q$t$n1z&zPc> z8=$Af8k~Olwf3BZyO)}4Pt*{Fgkj}RmU4yRNGH0M`YoM8)zzrnXpY% zQ3<*31WSsvnfCYsHRi@1XOzTbra}tkgleq3JxU=fL#15_lzilflB~)Co zAk{(wc9Q0ZA}4H(Qd49Kuv_2c|`_n&9C1o8ei zHOpf1Cp-G`^lcA{AMbxzUJA}1I{qK@Q_Svtkvn$@jycY4C zz^AQgi@=AM;dIJce(+P(BmUV-?-h#wY=Wl6h}*Sl5yO10(vAgJ%jtm>T1T3TedfAF z^oNo8csm|Lv2R^GmsgyYwvUVDaJJQvb%HigT9L}*N zagy)BVRE?tNcQJK7AHAA-K8APpGe{)$4e-SlYD<6Gp}FeppoROh$N>(EGa7Dg(Ob$ zRm74*jm;%-lA^`&tNnC)ek%{-x39Cb`zmjmC24=dXSL zL)P`#-V%JD^rjf+=l|HdvL&}|HT^28R87rHxhQcbfH8(x^-xJL6mCHy`f)<)4pr$OJunprTw(XwU+ROiQ9F&={)bdh5m5UeD|8_4OoGv6zrrRT?YZF zzG_upMvt#B$tQ;vogAL0rTdpb5WPBd_X6Kocn6c|3%HV=>9+Y*nu2X0-6f78srV9j zd8$ZiiRer>1PDE_Ma^$WGI~22y;>13A&I7Gs4XbRa)>ErJgQSjmRBUp<_a=lQ;@?5v!?k6GW5GfBbWOh)ZWdG);C8|FT#` zkH{c-*@j5qZPeVR(59NCymAzROui7B1e+DMRAfmVZ3$spA`J^;LYsEJfuQ2iq!%-SY2tNx)F9Aa*qF$s8kIQrlBZzLPO(QYsHWSpKKFrTxe(Zf&%~g1AAPo4 zfsH_`Z|bAaPO&ZiY?n-DQ0yIQ11ozP#e3vh6>L9y_ZGXQnzV_fU~>1iy#Mr4Be8#8@-2KK?KKA_<`l)b05a`m&+5In#y*k0xV2&p3yoD;|3>2^Ty z5ky6(?MWLGun_AQPKG13rMAz}^0YcA2qBb7-1d$EQvJe@Q6p3dfqO2Cm zYX#R!o0f@fqbe12n(*wzI}S(BAsas-&VBg+`=Z zCR)l=#Zro&LbWtY-sfA&$EXt7apurcR5T4#*I-MytbIA%50gbyhx?T5QYrt=e(gc2 zK+7YOSrrCeSkoyBfu9hwE|;B^Mf4K{9qrP$qS#oyqj`J+9$~%m(wEEjBCzx z$SpwcZ~oDKj(2Ump3UlF6R`0nKfU=Nfm8}o@|Tw{{Q2VJRVPT;koe`|ZKp{;{B$GX z*8Z;`?`T3lT)(~erTzQ6<-0G}*Plr*yZrEl^z+r@HcmRWZ{9t~QFDnMRJOn;8~JONB7|c=g+o zN4ZuwPDi(b2`ThFn8EifcTpG>Zfcxw&&1GZ?$_%F-02j2r!FVa^rm9_zO2i-t|)M> z!%@?Znm&I%YWh*rQ#8Hj7*lP5*VoE9sE(eupnA`luHtyl;n(s9tstoGYcDuLf!E)1 zZbuusZX9jZJVj5Jl)=2-3UCrt+$#Je8NRj+T?<;8uR__?T)?PbCFrw(2>G>B)-GNh|JBq^_Hm>&~^gq5|KZE1nOb4G?Ln z0KM1Iea$ey+;M>p0nkm~G;B{%Yz3%_2W9VE9#AnF3wCUeIx;Jj^Hh-2x@bPw*(oq@ z9%Z5B1n8JO+*e4RhWqNJ;?*ki7}7%nPW3HQ_iaT7ZqLxEaZWp`6n| zo*WtPuQn{f&I>YSp}fYMH0Kg2Vaa*M`M3C(DtT&426?}_R8SvP-)R%C=&u-~91{t03vDj(YzFy!FJP%x5wt+tP=lUEm z3)|L^KA!JgyG1i1!uo!6_E&T-20HAtVsc=9GrpW`Hg zo2Ov%A3t6$|Ffj%mHW3%-1wKwZ97ch;-G1J+IPr)#f#OH=gvak1I37(02jrrvnb>R zpWBB?@v$vQ&WLFXFU8L7v96xVtbgO>ZjWz zUZs6hO)C3*JC^Aw;WR(t0vW(-NIGWnr)4L3d`J)Abm}il2@*4^--BmDZH&x^T;LfXK}n#$KGj$?wz2P5SR~m2CZ#rST#PvMKa-FG;fy z)*IqTLN;D=x{f}9NEj+D)2SJVI6W@xPl7W8&rbboRZ{R>EHWBS+HksbE`J&=&?xyN zxzZ+3Oc@x^0-EhwfK?md8c?+XrA^q^0nm5$D}-+GO@%rgulSrbYx%0bp6zIJlkK>?q6%~cMQIy0 z4YhJzRO4Pxf>3-*K~ZWz)CE6YUeZsjL$!G!N7WVWB01<22L>UBAAw(*Dunlqu@+G$ zA)ob_W=&*AX?wCBvgE{i3sKDk;_LQwqfGx7UVn!(7E7pj4#&3teD_pB0>h?5XJt@L9qU{EYH znPdY36Kam?vgI}9xCDNBSji5yl0;`2mK302=k zv>FSSbMK_<>;L}9s`lyFmn56c&;+^ANfbe?xMPmvHh`|n5KRsXDlTLTRhd0|-gFVZ-?+O3^KlQ^ zcgk!sz0S(;$d#D=x6&~$2|tM}gkL5gSWT7@n&c%#yD9$13ta;rxmY0iC!cu*50j4z zqXXSOSd+E#=`F~UZ7dJy%q+R{;Jv~g4$8$(L6_umk0DN1w^ZGgWnFP?)nv=`9|J+v z&to9y`wIk(+CtEB$K+GwI9XGM<9Bne;trk^C?SPWLeEY8?Q3YMq`wzD3G=s#J%aNs z*$19w&Y_}0PX}y?M{V-^fu60;930tyQ}2rIiFOJwZPV=|*>?$q%h=Bz(2%2sO!{vG zRr?DsbNln2Ebj&7(jnKqksFq~QRxvMl}ms8{Kx+#tI0dux2g2*kAEg<)>u1VeD(b) zM2aIEHN)RQGgK3~*iXQ;qu@Yjf^1L1^8(MUD|Ug$aVADCeiCKTDEA~MVIasHc#f$9 z#rJ)S?KI-?Bn(bHF`k4mo`f+ftUp0vA%ZMi8I4I-VLla9Q!OY5=FH0J@o^2(wY-q? z`(x?LzNOqL^ir$HV|*B3D5~wv=d$IR&|wSs=f%>)Rw7!c_@X`yL?~47Ak(4Sv3O6L z_&H8@aPle1;Huj0_7(p$M*06WB%3-D%}C6(hVZm)~AY=&t+Qr>VZQs;&=kh%f+RZcLy{f!S1p9vK(TBS8jdPE zK4d%T^UxG@tCHMASGY3hxgtQgsN=o(p^tBA^&($C*X3k#?Zo+58HziLghND3-eul& zmB&vwe>q>*%!S5#O8!D3c7k%=6PXV`^+6CK3F>py-dW%C4SZN7TQafc&trP|HRi=K zoNJspL_jgLaI65avoi<2J&aut!kLrKt}kytTrHOuKVB_o#l)FLeVc$wqziC#WhMQ2*)U?ARJwSEHS<= zsQ~O$$7k_y7tB?XGBODYIQmsAjrE?Mt5yQBiJcS(WZ`VeHw^3@7iuwnrA z&!`Y=Bdd_+8d(*DZ)6oHu8~zicseBG9$8-jXP12C)*%IgtC1@RUn747+>Km8I2su_ z8GJ1!AkE&m9D|*=69jsIxA}S7o_BO3cZah*D+F7U7Sdd;T0pp3se*7cRKlw;5^jZ2 zA=p}~x~-X`r78&D5KMO5?VIqcz6!!I7LkX?*}@fqt%VC|t`;sJTy0fBINGX$aI{s% zYl0$&R1Co08x?}BHwtO4-l!ma`*^z%tiR2NCzO%Qj<^1C3h?(ep3z&&yHkR?mswS1*p&z zXCVCuBmwXo$qfU<-}tf-d8#N=#g^p$!{(a6qjf>M9{XDG9XrR8Muvu{?U=3%9o2L_ zhfPbA^`YtsN^2dHLsm9PuL2=ftEoaLH4{i78`?D|oF>+%g9dlB^=-N6)qJ~67$BmD zp5!MGqN=%c_`p6wtcoNjNaKyPS46Mc!pq;%*zZjGz8f^KPLzOqw}~GR`K@5oo@tZg z&JOwTwEXp&a&k!Ylzt0e;#q%1`FI0hx-h1eBu@?64NAd1u4vVkj4BJ+NazR9LK{{gFaMzdJT8Sl)>1`==cL_us zlaDk&Ixd8O$q*GqL7Fm2uNfLY4Z(0%X3yBClCoGrI$%)x0R-7LARpnG%b}O3xjLbX zJoQZ~)CNi1(Y^b}r~^XalI{NDc^ZfJ@D??^dv{A6%LhZfNvwRS!!0b&{m*3R;Mu4x z7{6aaeL+cf{BID-XYO$*h`y0hkumd9T%7~CLB%v@hwTSFI|NJLmIQs96ZCCC(44Qp z1bd4KmK*nYd!SoRaKV!is2h8jh3VhftP&Ei}BZYoKS4^>zNoEU5(@IeZD zfe(XekspEeJs+yn(R`pnVe?_IHsnMg)yRS1VV**RF^iWPjYGbz;Rc~_vuiW%*`rI0 zE(#^Yl%r1^XDVxS#$XeWeZ{xt0H||U)qTdRp2uj@7;PG(O)nwZ#2P|^UXZB^4YiCa ztEwVv?PEu|<3;6!)R!{3}hQuzR)oXdu;}jRw+aAT{1nRIDTkV`{%b6JRQj zDtky}6O>=xhR0~n@&)HSVJHF*cME(Zr#?l7t}H96ENSh-6AzU6aCZVdL@e>BbCOL* zF@ft@K!b*?Gv*1_Yd}>yowi{0zS}L;&J?7V-qbIh3WzBX!Yx&om(rWx@gcsfwDu-` z+96u|9gXLb$($$j_wnq??=Qjb;6yx-eTO<5J>1PMF5iFr^xO5-+aEt%ee4{2O+pmQ zT`ZC!1lfQw$}{*MdtvwpqAhB=nVa2)aI->+nX#qzNDsQ90BD)QfJAaxqcvt>rO+;n|ZsaYb`fq*0c34>2APi$b_?Qtf(UtA>-0rv&cwJ z91fIN3c7Jf*cC&PTy1u&ax8D%&bIDw$0oDn@xH4G2{M>#gU)I{QF6Bl+?b%?dSoRu zZ5TcZ`K@jO;lQA&q&Q!?7ndBuMkO+YU9#(5lI6O)!-#UzNBk4}7w!hyESqJ~(EKQ5 z7|Xn$-Dis2y%Ulk)XBl@3aKi?n~Z@MJz=<%luQObdoO3Q$uaavCHjbSh3xKon-+83rklOH_?1We=F{6x|Igl;_co4eefq03 zE-;usE*!;n)(gCt_LkTcZ*4hC*UZ46CE8X+meg7jyI#ECeMri(k|f>kfi z>^ndhV>q7F5Ch?3Sw~T7ES}Noj19n9bD@{BDY46c+YsaIirKG0#;-vJ@DyALX&46CQE!nT_IW-_?~NBl zCLMZHgrM-TZvl>I@=72d*s!gtg1z4)ibl&=XzAB z>A+KO{Y6hLxq(!&i|w&Y@_)1cdnXQ^O&`0oe-~3I7f$?d(7XQsv*xj>4502LL;lV^ z=6=BH8{Z<3-AQl#+_Yj{-QUUi z@FF>dUVKqj=^PN>fF;K?+lP7DBR^RoGlz$}|53blkNi31 zqfbNsle%uPaBCHiI6ZqrY<`D}6FJ_z#1g|yoptKMr@gaMlJ;}6w!C@$6RXRc>c@&| zv#|Vsd%HccZSEZK!_n1~x9=gIubw%!Un!M;FJF`^=^fT5Z|#dB5;&#zaC%*;u&|ZO zi=BBn>ZJLRXev6WGE2Z!sr=9B(S(!i@#=tO=%+37h3?;eorV_wD2^W^t9W!6&Ehi; zqvK_o+%wj+i*Gs;&*w$AS8YRt^N-V0URem+?T3e54|l*0URtA z>q3)|F31@l{Z!-G^Bp7CSUQnqG-?-tM6fuT)3_+)q5t3-?ZNAKU|4+g&ngmY5fMLS zA?tr+Jnt*MIGvG)6kN~^w6x`c)RQZ<`j4G{O9hqNMsdI>MB@jsvvhtI-?4p6s=Ask z+{bjKw~1%rXAX-Y6!%+wRV#{o(sR{!>ja4waZzTWCB3H16qCp+2PBNB3TzQ2$_W;% zJ5)lKwjvj(VQR63N=3o23ildsRbYD_#Y)_Ql|ET2p^;MYGfX*3YN=7`5qfGddUNIx zDUo5woL?1k<^<8^Hf|+cTvuN5#f@7^)qc)>E2S#I$bj{mifE`7X}UoI&b`|+6^y&N zD%_GN)j*F8NZ2?kaLHPyOxbwjFBQ(WA|;EsZOWrl}J8nuc(qrmYaij zYM@$^;heHT5D`R zFSr)i$O!D=L5)+fh5}UR+XSaDaub|d*EFj2o2AB>jYUTFMNN_7$2QiEQ zm5@!N3BTnpf0wp_Z|mZ1pSVndrE%vV&^NWM6#MvBEV zHB>A|0nnv055)xgWS%%SsCc$pL;R3lfCe9Va>5saNo*}NB=~xAq{dV4Lj{|=eiV@q zR7%^$kVQy|4Qg*2bRrJJvw9W!Fr2eu{ieh(k5)q=RBol5dX{fH-W-I7?1jS^l)H@i zU==tlk!Zb~!0pABhxUdn+?uW|P#e#)%lT3* zkAPNu%lXqE6xI`OQK${yg8Uo^i4$O3-O{|3tL77sS*=TZdzk?=4+#h^)?u^ox!_pG zRRR*m)c(DCaa}6-LQWcD|Cz!Gm3%}Rr&4CtP34Ynx3AvbU*6u!eHE2Ox}X01hvD|0 z$Q?yFl_!TMQLc|37stAP&|@gnb7$E1&U%Q4=@see0r&qm4|}BVQ8`ib(&yaCaM}Ca z{eE{*DU~lyh1vVec46cAbxvgS*_9KucJCQ8Y*W}J=>>{McI<8wQu?gkHaUOWIX(F+ z2XdB>BM6pI#LVO6*QTT~Z!b`(VBMc`XR(S?zPB!~Z|?8t4Uw{xyUZvwm<5@nbB78m zeB1v#XHJXKb#S=vbkY>AQ8{_XVI;MCkU#Io?yUb`Uv*=Pc*;47lpW8eEY8zAw{2l419pNu+_%;57}8iLRB z`oZT{Dd5qc&1@dvY+myKXY=vHDJpK^Z1J;{X^nxMl-)3p!>b!a{?hOb06%|v1WFT< zr%yM*cVEj*Td%Md^uh|yo~=FQK^HgKtxIf0{D0+*Ns_sdBO~V7aUEIY+L)(SSLPCr z4B12iAfR#FZLO2c5MqyEZ3xV;W(8xI!GZw1Wy*xNNm`7&7n3Q&G(4ybQv{Y*86*7~ zGk* zk*&XZhI=b;NX|g)7)b+>0hxaSVYtTv49`3i2(j^5pa`&3Hhv8Rku^j!2WD4x;pObg zECd?59Uz&YP%T07hAtxjhAu;(1jx{3h`gc82zVS(GMziHIFe}sA%Mno2f-PLG2LS% zo9!MWYfSecxyHU@B#mhXK#Xa|$QsjJcu8ZL5ddSFM}VaQFs2zIYfKjj%ob(g0hT30 zpajHBI5zAx((s`2b7Ek(umj|}g>|A(BlbsRZCJ!>%c?6ihvL^e-c0NJU z5d8p7KrHik*tY76ef7~7|FW0VlqyTzJX0o)Lhyo=1Qg3~1{=fRk?TKCJ2P!pk+?G(4n@q=ft%z)ThBWkGKW zv`|p<1hh?14+&UEKr6O{jhC0O!7|+K0-Mwn2&8Ky%=m&WFWfH!8)}%92AgP*eFhq5 zsAYzlWvERCnX|wJTC^P?XQ#68@}?>!U{!jLk<8aUMz&(_LvjVOVSY$=Gn&q4B5e+vPt&H*Ny;Rl#xria`4DarP>1LT~D5I6yrg_m!iA$-a# z1W%cT3D~Cy!Lw``0gVIL{qG<+1F6Y-jAS+5V`PosJ_M=w03(WPAEtc*)K_ zBLMw<9s!mLz?x@>tTm55fQD!X$QhO_yu4w_2ze`!5+Ey)A@WutC16c)kC80&Jw~=E z?n81_WyeT1#SD;bR#|vJjn5F->Kj8BwPWC-b_`xWj=_t;F?caJR#-oc71mEqI^`&N1C@gmVgj0}Jx&RO7^_1}vSl1%vL@?@lWSFb zn55y#F%a98!(`3ZJ|bzsauC3X9Z>Mn0+_NK1+Zr0SFmN;A<~v9MSyKMg}}`!!+_0d z50fvbJxso&G7MIi@)SIYdvz%Xp&fmvq5J#wMfK+5vUIyS*IIP>2MfCYMCHJHKECZi zcb!{6?#Vr^-p(rJYy0-TdTB|WZBJ9M|2Db9;{`b(c_GMAKJA}hKNa`>+4X|xi;t*( z^@-VYpQr70#)rQewH_OT-th3(*_rfDCtj4MPUL$fy0WPFn#n(pO2>2fjZBBXu7B?w z>3(;eX;EB7Z!{X!N>8oUurzLW%u;_a?lg|R^`0Kwx5UByG|`{b3GI@XET=SdyrXl( zjm9O<#=~EaTW{mixK=k$MR1ixFdV$LM$N(F*;G8X`mIr?aXQTDD+bJFy;mAO*SnoY zsX6G?I{m{C%|U<6zgy9NY_aTUl~~>tRsi0v4j*>Y%q|z+V({e+2PdBGs@&m|w%KX5 zOHGy!FST*!<*3-w=PXNP?>*={@BVM&wdZWEIq+ik_uu~wt~214fVcMZ2KKkqWQg0^ zO2|-~G7Ih& z+`1rKVR6Ks)fL$F0vu4dD_|d!3@>p{z=>o2hyLO503aQzZA_H>9!6%eh+jbt5oGI!#O;B@ZF2`thVP?Pwy6;t0_dqk_;T4CtYn{)dFz7O+4FGErmxK`$24U zeNWX4v`Mruo?}O~E_DXVpm=?CS}WriKXd{O+NAWIOm*TnnOknf8obX&-`c#<>9@xE zB13J7=YHo+Rb<#O1_AXdntWA}?=pW>rwt7Urt-U+7I8_a6MI?@P4c1Kp=s4bbG@AU zs%an7Rm^&kFru%1Xh%9KV=~p^UqhnW4UC=C4lCksrj{o};y84s3ICLiq5$)uxhp5! zxyVifswa zX-*)B`cQ;LT+qnL=hM%u{z3!}>&@V1y}t{^#c%~e2#H#VLku-(U{vK(azaRL*9R0B z8kUPdkUqf{i24arT+#(9oDv<1{}kMT3#~okXL2z8i5Uitg;Vsj-;PRV6iNMi%mo3~ z7AGI@f&Y#r{5(O{jBuG8F^iZEF*WvA^_|ElIGBgnyoiqx2Gnfqr7x*+Us9()a<3bI`$A>TQb=Wme2Z%D=oNK+L#L?Z z42xdYoYObx*_HkG)@4*`DK|@r7YZr6I>Nypkdh9Q#SRHB9~|5*IF2MiDY=2cISay) zvXGQq#$Si8&a!xM3IG-P;_Que6(T1Za=_%g%%pg6NME*2i~cSVusM(PWWY(SG3NjV z$`yqq&cwjQPFfuRN<)+ZvFhf{CN7H3V-lb79Guqct#U}AUF0=5Gtl%P^fNRFnMad_ z7|aI4sRm}MQ=ao1KpJ$f?}AF6f|81UGnv=OYic2n7_+~%Afgar?VfUQ1jU+8I$?{K zADvAL*aqXh=0c+o?kwcIY*V=K9LYX~NhMt4T!@v6+u#)NK_&z{|Ki`cJ5~rY;*}uB zdJ=VJWD+-KWPq`=(6Ee_CRNjZK?ZV~o6ZLmu)#zVfb?{PHopGo#QQ; zBO^?iFnn281S_X}iZ#Oxvol~6uP}*B9uO+f;1aAKecZkp?nno7F zndZjhUUt)QW+?RJ7+OpnN|-VgK@}j4v~blb3ro(Rq#HOvBkFHjFOx0vo&E$ZjL;4 zxP%=_m}@f4j4qE5JShff3RqtA39;GqC(EF^5qmvxq^&QFsxM3xs{zg_27+^R(MNPI zALT!fa<(Ci&Sg%!ITVC80f)!=`Nypn`F@3?piy?RE|zd-hAReTss+1N9d!NFrY209G+<^Pc1Td(vv_{mo%knzz-$mb{P#$8>u^rlE=hpB|W-qA8xgY*6|T{-{dj>~MfTe!Qm)NiHi}8a#KaM4HWV z#|@Hz^c0+?^v7M}DL7Saa$z97<|gXE7eh%#8`4Os`^P|^29pUh+C-NwCVow`>#DhNkUF* z3O6WdT%KPyNhpg2VaJ;%{!d3?%W&tqllZ~o^??M#URKN6H2up!iJ`*L3@-{ZsSw>Q zQoP}1CcSmbD0*b3d#{LLit!AXC0=kUe~h0~ZE3={A| zgaMk6R#`^(V9Aml<=w zqqo3i$~J`N1*PD}>EKI?zWN4bz$?DfF*>I*rkRJYQIXH6_?sdYWJXxD_bD{QXh|^8 zCzwjOo}Bqz+Z8N9DA*?)OI*U|hL}spzW&+swJ9PIl$<5JW8~7QIYKI~@xH4!`%@ag zytFBXJMzd-C`2pZsY&_jr|1Ma5@k>}H#9~-5~>8Y1UVujD0vd$r6!sYQ@Th-Cm-mT zMHmlv#)cIyI;}{+wuPB0dqzYpHpBF@D$+9G!W-cXr7RN;gNDgi$fQc-ET(rz9G`J( z^7-i1F`9D8SeYzZqn9Pt-D)$^H4ieteMkv%FEw; zCo0}(5I7s#)Y5+uK}1dE&QdUDQghjxYW$=5Nq0mFYbF0(ekf zVEySa@cwr`Yq>RLe{D;&URjV|0)w(JkK_@@t~LsrFo#=Vveh+jIRY)%B=Jg%b5)Z8 zJ*DIOvrw`O?vC!5A5|UV5d0#3=bTOuqxr>7bu-k3pTEVppH9IKQuFcy9N+oBr<=xjy=cXwxJM|)3CZ+q*_7;ZNS>NuYE#>+zI#06A)PbXKU;Iwt>`n)X2(%Ge_ zYIiS5Q`Y%kPcP94)pkc8wVF-2x*F<_@t)3xvX@r3w8P1NG z2kRq&$bpx?s!*EIq!~&hHBK1TU+jSJ)?$0DUj`3vniaEIWn2$hxdXs}ojD7Er@#bU zLe_=!mk&~hUe6LfuzZ~$_)@2WFj{8K2+F|37FOu&`xK)X2Z!zo;o$psdL_>faRxJ6 z?r2QXV-F*um9aC)kDFCr&<8H71F71+GOnq#(z;#2D=D<%LNI(QU?!V-J@{}Ck>s-M zsVI1=#S%$Y?cC?`Wxx}R94c@1# z1+C7{;*>92Ghn$6H97g&_Xr;E`A$;H9JG7}YqHutY!L)=K^gLN|0tpxAoAj3&LhrJ zJ+&vgQS?cztRL)!iqG=t`1^Bz3S>}16+Efs+oZ}`GZY6z;*;%TPuA1jCQD!n7Y7n5 z4k5HFBAw0I*D9wE#D_l8mvbVXhJUAU5FRn-Np)e$mv5nNLR;0aMf7b2`Ttbk4WVM3 z-1b0xMjDcU2fy-F7bNFuyWHZ|`lP?<~{!L=qbhEEP4c?(!z&1Gb~uuoFS8<=|M*1yNKwn#He0# zgu%%(zYQRnu~0g1QQ72qPn zt2h&SSb{Y#DyY(Aj0bI0-~*srtrEhoQowq4_(#d1v9%gd=ZTZ>PW}U!356RC0az_% z+m)PA&XC_Zyecgo{&Y}BZotVjpEDZw+#Sv@Kd|SI4}a`_JU}VDlk;EQdp!A}Aq-b) zm%{rFVZ&}}*Hz&jT9L7mwZz-?2EkUo6h%`TRwVjsF1#f~3m=4(j>NrBa&p(?LyLu8KY3cDvAuS#zo)=!jvdG zK4fCjI008~i0C?6gi)-AP$+=dY5_cRYrxWF#o>TxP0;((cO}&lAPGO3e}oYQW7rF% z`PWdvH*|r7hI!~P0dgsJ%a}4@cCbPExjJF)Z*eToLFsRpc>fmG1WaMdAq|PAR|8;L zxQ@7cIHz3%v(Q18NVmOZBIC?`0x)HmZ~#{Sn{=Zf1fzzB?HcpMC!ztk@4eVih}7y6En$ zBKz+2U4KL3i3EFq5&DuYur%H_=4oIzpl{t>pR5rxS{@mb0pKAcjx@{mpP=Hq=z&f4^;7G zpNbN2%vZdOVDakgB$b?m!9hQ<{Pyl;((KSZ?DSMM(x8vS#-3Rc0kbJ5;Hc#b*g@8! z4G<^7yj^z;U_nM2yrVh@fVSYi%z_@$CfiLPgW;Yy<7qTn*lPN}B1UVuU?&)$5!7Jc z%b<$zP<#S&38BX5=;1(3|ARTh2+5<>_4pqj{r*&Cj=>k)fqra!IL2>@&-C>ydJO4@ zo*Yw%LFyBE>P86w4ZDL`;e8Fp%S(`v^*f|lY?I(qZUc3ArqTodavYtJphfc7hCCa5 z{aDBNbS%sd%S+-Ia6uec0#=%^xG&8ekVoi`YDM0Sz1#k^!mrspz?SIiflG1~XB6s@ zaXV!dGeRX8@M=vJ(?jgP2}0lx9%3DT)&<43NSD2E9k&_4sa3XNp}VdL|By}OqxDTV z!TSYe|4hzZHGrv;=YyUDcSxUrI4%jp{iKR8wvE}U+m6Xv_Fa#S-c1UszqV+0gcb0I zO{Jgg4Z4Wx6{`xmx&MZGzPVMrzH*{5lNg2(_Eqpj#WjpreC79L#_ghJU93&uT?flc8IduNm6TTo?w*&6PVTDa|*QbL_b`wE24#gzRAO>ur7$jnn z{53xoTL`%1WUQF*#7y!QxMbxIhSA|?T$!kVx1ShpCbU0GL5BBjBXNM?+isfyqFyAt z6y+Pt;E9N$1X?Mn9pf^LN4D3LQvzd~@tHgyuKUHQPXjj7af}zw)?WzB@*fyZKN-Nm z7x43I46_3~HMob%r!s=r!*mW32k?a(wS}&YCL3^7v&Rw5>J^}ce@QR@NWv^kOh1a` zcW*+*fE)JNI*(i2&SY?UQz|sz3D`aI2xVlrX!Fk{?s7j0*seDW&W22mX736!=>d@` z$D!&^#EpD5yL+og0SJmq?uPIL%tT#CpVs!uU`&EJo=#~$kc_JK*9wqlGB^k_$M5a}r3VZ7# zC(#uKclHT?9YoFh4t=l4wh|bop#<#FP}S!#dexwT0BbDxY$3emrSPyk(WAQezNr<} zjweq(DOg#&>iYygN-kq?&u=2%+wff=^j|X$7|3yyd-5KwB?=HYc?2y^uFx<|1aPf7 zfpkv>=*-O)NrF8($-nBLgymnSZX+oSg;y`!L(o5{ftbFzP!)*gdKljkRHEfpox~D4 zE^sYxGaCSY`r%AXA?%I8yi7uu#GqX*4K^e^UQs|Pa0POhhBBG#MM9#@zam*;G6Gt2 zN(hwVq$FSzP$b?PW+fh?waAAR@N#ygY{UA_|Ll)TUgHC=M<;}T@hLx=7!A;L(bvWK zi@lLpzh@cCvO`Et^*m~f74%gFb1X;g?Vf?`4yg5=>_sY9t(lNgy&TJ8skAycjM!@& z3wMaJ)F3n%3dtq8>!SgY>B6sU-p2=OKS-_qi8EE#xH1^SXb<5{0kmQ17Tna3Yq`^a zD9?&U$+wSRHA^YD3mBHHhNE#L0L;dKUN2-~G&84N_XIBS_3E+Nn{u>20)h=i zrGOja5z6}H5-6SNwZ8p<&YiCvmg49;YS{VU5i$NhQ}Td_jCwWxzk*NU^u5TVOL0IR zpgIREy7i1Chb|)Srz#)V}sH2O|BaG-U8oG4rg7r!uKjsCCNtyyqi@1*5GnF0i`GX&O-!B2S$^@_rgtIlb``i zBV*HJk)`ut$kM}mcaZ5{1^kDSXPJ75Ngu~a>OgD6yR%vwsP>D$n*fuNxXPOLm%T!!LGHn5d>Fy|N2rz^}@vitELQ5{?jErT+>jZ-)v zkj0j42g2++uwPtE(Bu$kHnn!KXzvy3@qc_^zY=v$R~kcn^ST8nkiPH&^KMsCW?K#U zA1{_aI(veBgZx%r^tPXDhCA!>Ft0m(<95$aLZjj%;cX&He0}Mjs84Cq7r-i5`YntI*?2d>hmZdspF|v$K!*-ta!v%7_0l zd?R^xc~s)ZwDO6_d#61*F=Rr0xP9kx@_7lX0EzY8Fkw=_Ial*2eNZxEkkWq1sV$0f zN2R8s*q@0Z)Bn!R^G+Xl9)uu!1!1%!dknrGH0<5iTL++_Ng{c+0j~#X1cX_*2e#xP zBLS&q%<~V}&|n5#4GoVjyv->PFGs8?N(Wm0VG0QW?nvVuAexPplp~GrMyt0oWZa0*kA=O z0_6XFYI&YloJK+~?M55oVmh$ORQ<0cXoVN-V5g|K81!?=;k~>!x{%DN0uwa1eU+@R zcNV3JtCkBpEN_qNL=6mXl>!mCPztG!`@|9gLb!bC>GTn{5wNXsOA&K0C0g*W7~!4EGVC?(7~JZ-!4- z7T415e++Ievlhf!SiV&hE7p4zyLwk;mTH=5j3?7uCHmzWJ4GQ8@*CnYBsn-*uYI3+ zX@eU`?N3h_Uapr*Et!}bp1eAi%09CB6stPb4`=_``+_z_(lwnzMb$c*s}5;A)!I+0 z0G6`RGgS3eW?QaskglkcI$>2$SGeXVT|vu@rQx&%^j}*Vp!OKvJ{1%6j0(=-MFTOK zitmS1f<;@pS6~$>Ba1myJx9|`KHr(n8{7lh=$oCF-;NTtK@VIT6@}O%&MrU(V zdh}Zt(uI=Q@_NiV4WbRR!%6{gY`RGCRgPfs0Zq5d!xUOyxuAp`4Q~efv=}qpvb;plgZnC>82|;{ej8 zI3uzB^}AAgKO)`cu2BaaIn@26AztW~Q(Yj}3aT@*q}Q1;MvK_Oy_)*+@0W zLR-5U+Eo)c_b@^A8r0Kf3;-xz)`X;aS$RxP&h=R!L2fcqZ8!Xrs0#$2^K=G=X zF^dO0Brb=qy)AGG@JS(>pYKKZ$n0AO#-}@HVu+jh0(R<^S&P~yy>OsIIEyN&g+bRY z$-oiZ!l2!_stH8@9_zB=R=v@4u-VFSh9l;sC_Y(iaEqvUQvtxINRH&~Kqw(raOw-H zl?u*m0XA)Jb=zJl(07sn1e#|Ah2rf?DSz8u@>`MeTcHH?H=u}kdaKY5&M0+`RxH|= zaetHEmbj~AHipkIdFWmrZ0Zyn2C2?I#GwgQPFh9%N_!9H8_EcQN#fJCDmt~&F|&P~ z2?=jxme=aP{j-O?m^&2Yq8rumq8DCeK)2S(#WZN(hb?$6i?}g|D58$~IAUf*=VG${ z+dUrdmv#=Oder?{U-MJj;lK&eo)0FcJr6}%@p?oCyHEc+*WZ>SgV)87di znBSQ#i1qc_iW-sQR27QRuDUvcS0K%75UCWo0Giq`cP(5mQPo&t(94u6cd!CIjC2t+ zy{tPGK+Wxv)YjX+q))eS3uH&WClz4FpeqrgPtC(CVmp|5&?q8c2vbih!hee%j7eMr zFZHzxjFd0RqUSgbbRF5AArC?Ud34}s$3UnCi=f|cz8>HhSYU$MS}LiDvpYmuR~F4hG3 z`byvC95L$KMGoLfAIopET+%q8FFP2+nf~e1dBMa-*O?B#tkv1{cn&h#R1Q4|VAciX z2jBHY1Ib!Odg&^?+8=nsKFRInTs?{|g&bA!LRJKuXs*G7JM1gz6UM{v)nk@uvE0mng=G+Qp zt=OnHb-`Z#Ydes+Vxx}S32SBAY9M>Xmfil_*iO8T$84L$%ueDtR{1tBjOcY3qFt=H6&UO@ZR_gZG^r_ zzsuJ4xHDJu^|=LK`p-zAp&;YHt4wk3lBriS*ZnC8H5f_F&I${k&q$W^-;G!VR;PXmnlde4Z_)1+tBg3Pt>*`LFVC;fyH!rHQ!x?0aDJ-tKUqMs!Z* z5xCR&-rnx9KKYwLpty&f(&sh-Kb#3_9Lmp~8vVxCtmf?Hs-Jc`w23FmW`W%w8|fn{ zX9e1==z*&%nMmd;)3~akD90Mb7PGpnOMJUZuRIvUzSDYs1oSdv`q)H7V^xmR`{R0=VPrPx!P>{<4=MU%|*5On1_3>86UZy zYw3#QZv}B}Jr8j^zW@ZDb?VO41JOtFYef94h9|ziT~GN>20vA|LG=zMLOR6kFUwUP zwv@hZM~PDdT}NDevZt-7Gar3CJ*#rqR!3oShu|}7xn&)y6q=Vs{8^mHBaU$|;icV$ z7UHWfjj%Gg*~ZJMYF$((R&Sbg3qPlkk~zK_6(?AE4+bJ@1Da6tSNigtC& zP8q{xR$W*2ue!aJCspmjR0#)DpIdctEq)`Od@LAQ)0=R_b7Y6EAVmd;FkxNNnx(Q4j{J=fa)TBgho z8EfLDl_pJ`xA|_G+R#VStTdOg$9kC?4{p0$8f#B+>$;!+nO8$kF7Vh`ft9Q*DIcv;yi#iSY{xDV2hz#h595d zVXK<;yId&T=DxZ`I@Eq~5BG8rzf*m<8R{q^&7mwG8_Mr%IUhcm4iG?DTfSfTKCUhN zm&r5#d7+0J#KcRXR;fTfo`%)FFTL>{3CbSME^ld1(W?IS)^o6`i@LhJSYq1V)iIei=9vP#5?r9wUP!{AS4#c;(Y74N zkQs@!biedxL4$+dEUB!Te{GtgHdYop9MYnTqwt`Hcm%dCQaNFMh}v}bYElTVM{>|G3c&E8^fKnk2Os-gcLsBs5gg}h9`f1P_a8!X6kno)#hox9 zFGKD>&u-F<4Ewp}md7%Of|0s{WHjCIylVl>Ua766BG&u~;T}s@C(70epLMxts%?|DFomTMktcM4XsQEcQv-gw( z>;?J7QBos>Fn%a{f0K~95brh_T5Uk(2?}*}?1l0ajqbkpkA4Pc{ydxAP!1n(zd^?k z0^<5wx<*=mni}!nP^IsOt*~?)2lPId0t3Z$V+9;7+2nI|*4jpis~+|%kH1dW+Hy>! zSY@^NxE>XxljkTseSfKWl}V6&SzeUJxiz@m+m4UKm*w6}_9>0U&cI z?TPrN=9htZL;1TJAfa)cmseqi&d*1G@dWIC&WpP<0{frYBXLwwh`ib8`XF&NFQEQ0 zHER3kYZ_`b+U%Q}X7NSy<=FyMC9%#hCA~W9n!z>+HM+r2MQAoaLvJ)d6SK-tL}W3* z^7|eQ{7d~W22fA90B!0)iEU~=8Y-igc}!}}0iFK8ePu8J%8bH^*aUA3diWur8svq{ z_bpQv<5!kC4&DtV7SgeO<*@r9hwc>)D;ce#9}xQ9a#*!&=m}e-~PYZH4@IV z8i)qaABYYuhGp(bhGk|k9{3ws4ePTSN^PoHA1Su-{zgiIO`y)~WvD99LvG4?xK21R z@i<5m^Eem{wSa)c%jo_87@FABG3m%8lU`VQ`}I9x4Y&#Dp7(cFR)RHjOCg(B=7E{1 zWP~Li|B;8Sc=MwXH;-I`fwNA_!(s~Kp$J%eNJz|QgOkWLoNlC1(osMKrG;9B=S~*Ut_*=DhT#0JjRLr|QR}}TVkG+Kf1tXZ zAj+a$Q^T`qpo9dyS~x&^=%7a(b-!{X(O2o2e2SX1I#!gW!-@(YIkAQNakg5U!BaK!-lGhkJ$y{bnH0Gr`>+e?71^a)x8BC*u^zc? zQYZ^vRBAXEJzDT#>MF>*SE^q!gcHG%)~*>@Lnoy$&TE!c+>zE#3YL{Jo@O7tN}E_@ zm?{lgRCLSOLsvp8Tfr~k482)pY9=QyVb;6Rq{ES!yrfPp z*#8pNHly*pDW}MRi`ub1+0NR%%vyx4pA9UyH#3vO1#9YFxpiXc+7)i_r0@5N32R#Q zQvolwmUoB&`xTd0nqm~ynr=VuX_6>Tk}xMIpaR=2iUeeo^^7tgFNuU@R9q`_w3`$< z#2z}54^7e`XE2whQHoCU7?BT2Ga#eNg=R?DD^7|8W*CuCos7dGbDBD)D;k)DS(7iNMP?#)F+FL zKqAg(W0l%{r?TBF6`MnjWs@jlX2ZXb=ZGW4Np5A#L8wNN82UgYye;$ieQ~i z*&Q^Td_0Z;qi*-88kDkWQH1AxO;DlvHy+&rHQ8lO-9H^^h$$wQe4E{Bss+hY5$T~S z)vU5hsvH4EoU=}4pHxu;#h()CvKpI_BW9yAo&9YrvNrZdEFtCHcriU6AFO;jNsb|=8=_IvC9?y$w6gky= zD;5J(-dJX>#b#_BX4@Gy`ZC6U63osu!t5n6Fh{xvU3aBg^Y+g@eqowvrjU&#)#b>Gi^~T*FU+1#}&Rs@>4`_ z8kkP#-{VlKS)LejEK<(VnH*l)w{QrBlJ%PS>hnKKfxgt@NeHZyX)x|~{5=1t!o#l)77PS6CT7A0~9d@y)Qq8hIV!=_9h{B3mheum>~heL{zC65snz10gN@Tg`>l7C;ObOhO+@xRMP#K{XzZS~t(iRDzZmNK<|!^Btw$ zQH?1yw|MVtYK-rf7M)vV=FZPbqwf(J2z&o7Vkx%@#e6}DByGGr^;_lcydHEQ1N=$J z?q270A`p-edais}I=c>*VJr4>eGVnw0HR(+qSYuK8~T2xUBdtZE0c1*;WnGr?mBZz z^dz~cQYK9yNnlDR(!YdTi^A;RUC?mqIPj@-OFTW4EY{ZCL5U3w2r)D^Jw4tx_$OYw z<4LxxL&8Q=tG-cZJ%Sx!!H4`g#NM3rvA>L7f<% zU&@o@znw=8h~>?p5&?121KEuJshcv-N2Rn@Rk5*Es7y1Vj&Y+=e?V08#dlgPVeDW- z$ckE24d>+3z_?;{%Do03*&tlvBD-Oi zT5rTFjCL92sZ48V*+RF=Vz|!^_)J~fCV4=z;|u;SaL@~O&&S~|8(R6i z&$BduuU+5lWaJ5}N-eg`!`iR-X;uUR7K(3v_rVj${flzMf_XrocrDMIvV;}Sn#F$H z^hoVCY{OQhfy|>UnsAzo4R-CI$R+|Qkr7=~g5+UWeyebLc;#+J*sQFY)xE0ZR#d*y2uxoqoEwDn22-2dd9e_(f8G3gGB{yeV&UpE}M&hkbIxq7m3 zL19?JbNu*c((cx<25f@YE-$>Z-KKW2y9TtH#X%SoS#R+%WZ}Rdl`x&=ANkULUhCn# zB|$LAB(`j%+O%McXVvuh%(PG?ce!F;!CxI~Ab)S&zff|p(7t+MD`IBcsbU%>5}#Jp zn3gS=|J<~2oCsZy#HDAnJryin_L18qxwC2<_8hmZO*LJxP;I@T4z3@-U;S7M|Cr;m zqU$v`asI5ue76dhHwrVeWBw@`>J16Bz^d&#s16pZZmFv(a=x0m`Dq5sIpC$<8pGYz z`(gZdLs}Ql(jUpMo2U0whwhON5hr^cIB>0gGJo`*(C%XK9IO<}=Ea!X%l!K3a2d7*JV4DMchptOWZVlzyUatlwuE!*e5341&T%C$AM);)+ZrHc`qn zAsqxx6TKdqQ8qhA{;G(Qqf$8>EooqgH#fS8^n*HFwl^1M`(SP1e$CNg!p65ca;a^q z!kKtv;)vJmS++&IjFp2Mv$_Uh;wbcdgO%MGYqf-xo${{1&QASi%g!cw(&}Aw{L`re zEBy!?x|8^M(sy)Rr=4%?hDfpY+Ho}Frs8FTb)LBpbz%BglH~+9O`Mu~GAZ#C*m+E|Yssz7b|6dSvWc~Y~`B-goN&_@|H9a}iJW|4)TC#q1kfel)uOAfV8 zu2AK(xn7-L3AuWen;p8hHmA`!AlBXF%Cg@z@{i(@L4y4>Ha0eHO#`8k&aB#tiHq}E z^vbnvit8%8wUAdvz%1S-*1wVy5GicP;#ZU7e*a=>*C%OI@;DVss*zzHA@EP$^o?CY z#Qas83lw=Q%X{|ayna+RY^(+9Yu*OLsIT#pUQ*b55Chq0uX}%D%<^`fGtKdlv?&uk z9fp?y;ln^QI@;S2nge|_xo`UYz-MLf2P=E4?yAJA!8$bd2kXmf-IigmF49K|?XwjC z;+uhQ_u*O{AX#qu&cB2J{Nokr(%f`CV40@9p(6B(FDj)E7is3ZflsQ1SJ?I#wc`f$ zF=E&>B8>S%SRp{DcV=Lh_6{$SciT|gJc{g2e@PHycx>H3{S`6LVZ+qm_i%g{jL2h zdM-I4Z8dW6;$6x^c9tkj^1VPS)N4^a0d3?v+gzN9(Up;st*9n;jhJE^`VIy&$0ygtkRkgAh8J8|sUMO9? z`)oHXErSL_EUDbS{>cfSlIse&jZ9h0yj_ATOTZ5f6(DmI8>miV?jS4r zKNBVCohWCyLlNHzcdj{Nuk_LBbs%i`1*%U>>!dZ!^gKDdRJ$#5L&gmdKxr%rPQlP! zQpL44rP!;yOi9 zQ5SdJWUh^Q#k&U=yFs6>oXxdov_FtVE%gktCuF(awcv+d)J;%#y;F{}G5wTJg`}G+o2TXy<*}6F(6|YsmOMu>Wn-wrgx9&HM zK9&WSwh&`HZaquJHG6$h{L6feYP@NAa9e`3b*x-mEv@Kf{h5l&ar5r4>)d@iZ3T9V zn(PZ>E{_ZaV^ zS?ls8p+Qg9cF?tuvG>^bxoRvzPc3({yMECQ#5y?mw^EnsY4CHs1`8>Yv{`S#qIbLN zKL-D^sl+V)$A0SDk?B{Z@o||!6=4C0BQeRNj$`}%IY~pOPRLmp%1uh?VckQK9&u^| zJnpS}kk|z-Iak`&PMq$Pn}z9UqbP^hZ!Q8 zZ=Zrf;rY!Tpga3%HbIuXC-0rqhL+eas<8*7@DpO%f0EqrB9GcypHPUQnaRQ+kyh?_ z_5LEHM)CzNUg@a)#nF!j=rkrt9cR^0qYbDmyKBojG4g=HjFXD~!DH6CUZA3&bC*vk zQy|gkP$qdcSn7(PdQ1hBPhMj%(D?#{l*qP{xZjGBY;!57lUVzavaYl`SMe*twxQS2 zfK^^Ljs3h)0&CIpeYMFU+7SQ#2Z}&-zjZP^XTnm(`$x@rrd}w>4GWZ3lG49E!Pq5r z<1Y$Ss^kXxWZnI=70i;<&@D@+v>LvJ-)72E8va&{Swd;{TOr{OhVof=Y^*5S^v(rP zQkBG=N=f3D$%s@48-NmGCZ<%@oi#9k2|ynjJfP^UKAYN%1{kg>YQFDgPtthmt1*Ll zHzwtxq*gOQsjGXZ;sZ)^+=IE1a!JZW0722%_n;OhVXU$`<7pH6-7=^$WygwAXAcTS zd*fcsDD6LBYWPGOD^FUuH$fUPC0{~dbtOn8 zyks&lwloC3%YxHKgvQR@m(D=qQh}W-bnV?-H7Q(z<(|655Kmm`NFgV;3j77kJKPAX zpm%KeDAcoO#(j5H?5igX`3`TK%5@t}#WMZNwv{GHLm{yV;7=mLKam`4zf5CJB^8=0H3CCH2 zD?q%Gw4?I?!^Qv{Ct7V^C^q~i46XNHsIj6FVoStX4RFcQK#OS1p^-=$3BW0+1MQlY z#>o)r5G@JKLR#m!WOFW&2HXlE4)MzvevWa5$O-{v5YuMLOJO4xIpwE$?N#6vP(go# z*@8C3U8;G^#CJ=pz5H%YTJ>3hU87nOt|O2t{EA7K<0tUf8R_G$*o&bRryzz<5j30b zipyE;WuaS$Oe=x2wM#^$LK6GIb(AVeY}0Guo;8?~y3Tdt)^28?>q)in5j=t6Jx_?u z?SnhA81u#l`EZ63e5_dv+v+j z(4aY^`39d@B1Y^74Vh6h;W||Y+#`|}`Ya;>8I}J!&yqBqmHe$#r1F(qAO0$7GgXN` zAK>!mmee;(eGoM97K51YFw(MzV13L`tfWJGW%u zb_QvEqYvs|kc!fWu0&iAafl^;mIe=#YO3|!x`)y<&#KQ}S(ec3<35+p?BKMogMVl< zS)ap)P2AVfs2?I!WZl$vwM}&WU@(M4JIak8t~GKM_AN9M5vTQ3pbX?y8xCHf?iqUL zv?Tb;@J~gvYwod&wo7@fWK8M@fMoITicP@LKD^*IVRe`B*W;I5*5CVIkGmQIOPIET zac?cDN`HTb`E5+9q6g+?L>i&p(yBmi>y%WixD+G<$885Rm~A|0H|0~wp&AVb(=AuM zya%e`H=e|_!ddP(aK?$41Q-6?+4m%U{mA4*$l+(1aMHMbaCt&VV=X+=G- zBt`a&74)dGm?NX&R@7jwUZ~8IRtav!YQ=n0CQ~?b%m}xg&v8|q3nwW<`YO42irvk~ zr6r5zxVFf}zh_9}e<7^`Tu02sO+01+a#-d-HrIsDxnScsVz`;JkdHOiMl9qfl#h|) z38BkeFfAD}#x%WGz&nlnvk>01}V4gN+7%}0Qs zrU-rY*1j<0^1c%XYmG30^of_{8Z`B@`myk}0#L7UDQp_l#_+j&XI zHfa}4B9S|CIWT{nCrTq%^BwUh<}AY3(SS{2mJm#{fm@ZFFyyjHPH;s~!UK2gEGA6+ z15he#TK}f)2BCQ*`9vjiN^gB);2YyV>xnrt5V_cq0|6LEhL8aVn;PG4Pq9d+$k_T^ zUQOnByYWd;s`6{Xz*J+Tq4QPS^gF(GzM8CYkM(jL@J;YsTj0CVw}eGvMsrv5$)%36#~;dVkYt`)9aT~I4cOS|%rM4dEAxb8iLig4xL@;c$V8(u5I zClujRig1r2d`1wizLs7qOz9pCQuk<(x<{i;Y4S$(QItAq(ua_~gY+4cuGgS+y#}T0 zH7H%Lf$n-=pDt0NR;wvLJWmZ+pAqf~fs&Dt(l{%sB;3>jUMp&*ESW6kxJ~#4aKV$Y zW;knRiD;xFT>{z~!)u@Bt030Bbm4Bnp)e7c#3bZ022WJt*3(J^e#n@OaoceV=*r!B zL;-F@pxyaLl;2n~mTQUJZ(bl^Geh|&D0g##d^QPp!BBltzx?dhgOF>~3*-yew8GrF z^&KHyccxH6s~JUpE-2!6VD{r2+Y)$&zVeI=(I^=O%7v7P{lQab7^9r$1q6Pe7L=;( zV^8pw@NJ?>JOzc8D zU-G1+KLGJ(j=Nvs4U&-t+(4uw4*yS4l*eGArq86Zs}XL=p_I>5IEht4F#(=f0vd`k zPM?HEt{E(VugRQAH6sn9Z!EH?lN6=A;F6@CzKKK%++KT0sAQ~&iu@0z4WkV1|6yaz z0}5cZ2vN%dA6b~+FNhHRgmcP^BS(1vk#uW?0ypXw*kz2pV`vG0Cd-f^lO>}9ZI$ewN~id)|jqj6Q>IksOAZE27UO)p6@ols zQ3BV@Adi78i4ntfoD%rRCQOY`<7|nDXOv5@l(&+Nkk{jt%neJ}6swh1P#OqYeYwNS zED1qpqU?t^7^&qyDX9{hpghTvxn(J zCAig%B_Ohp2~BGF2Ng?X$iNEG*|1-nO`&j)Oe+{OI4`J#2JHXX`_?A6ackS}_gAo- zO2w`;CB7eBHI?yW61&oVl)F8XlSj>fB&g9v5ovD3eS76uR{Kj_(_8Jx0D0R;dpG8DQ0D}&I|&mEYG0CWe6m4TLEcroY>3@ZuU zfnkNAWf)!_TE?k}M0b#Qsb~qPAQ&y<6l9}iAX+?HhABx%OHf52X$h+)CoMr$M5QI5 zg0!@Z!wO7GC>5FM8rbN=BE_aVC>6=+E)*|3-9@71r#nCu5$Z1VP$}xMe3S&KM>E08 zQjcYU7N;J|Kt-Z@EDr^t>ai?T<*LW>L5o(8XMmTkp2`C&U_F+Hf{gW877Ak4-7M7T zV*^tVw(cMmFo|0Ex_Hyp=G!`Km{>w8L1-4-9ah{b9azx z^4v05QKY*MMoV?eP$j|c4pc?9y8~4c@9tvJ65bu4l8|=~i?6nh5xC9!gT+!&#sO!AIaKvf#s6D2Ri1 zGr&rOcW`*2a2co|7v2G)MZ;y>fzsh4nWzbf%bDP1#5*{on0N=JCMhn1@xtO=99mwy z55##jc5y0F<6W$R;CL5`mmTjQRm8`;P^<)b7pEdb-o+}(k$1ofqU0SUUYfiI#0!)U zK+!VgeJozAT*l%h%R4v);qner?Ra2^LW`L9fQLw#Ph^4@G@r;sN!GlR57P5iMkz>~ z%Rs!)c^9W5cizF`MbA4xW$E)iUP%DG4_A;u?|{|B(7RwYNpu;lDvaJiqvg@NIIKu| z7l)Th?;w=~(`BrRYuLBFG0~__Yw*#dEWw|h3_Q{ zTK--_;YIKz7*-0u4MGdzw?GQA_-&M;IDQAJAd%lfVukYC5Tsmw3!)~P-v+8k=eKbx z0{Sf+T1LN(Q4rH_!&D^oTR6P1ehZ``uP?zAME2V_tkixRqae87hN;Nzw{fcC`zoJU|z#5+tCHRSFf*h2sMTbdl(=0bL+Ict97a5<;MdRS6`} z1uKOU=z`Hf1-d|dXaRvl1{kOlofs!Fw@Zu-JWvDh;RhrDE(k#fg3_Ar zU=AqhM=_MB?vBi4T?_ z<5WT>$VhbH1PP`RKA{7|22qe<3ZWEaph`f64iX<$K?14-SCD~9Ar>SkKG1>$Qwp~r zBNc)!NI;d)3ldN<07D0h55ph<@xd4*m|{o<8H)|fAfu4s86*%sNP`Sh3DqDY(E%G| zm{QmV35pNi(19uGS*QkbkWuJx4jmXasDlKQwjwkL(u^tWEeIqgp5)N4j~~GLPW?obf5?crW7thLZX94$S8E^ zhz<-LKtjf;gprVt_+Sze3?EWLhM@yX2$({62?0O`nGlH&3^gHv@c}0~Fom!aG7=kn zqJvr?Lr_RCr9c!C5*v=91HuQT=l~T$Q*@B%02LBWAxwq9A%j)aiB*QNLf{GkPzYa9 z0~CW;bWjSREM%l=KnoeI5Z0m#RJvlP9^#^d!v?yLVG7|cIzVL5iw;U5^o5L63V_jt zqQhWxfNH@odf)>_jY?n)8Ho>%(ZMMN$>?Cwp)xu+m4F#C6dyLDi&F@m(Sf2vXvjEp zAdL5ogG0T}A^$o2$LQ-=*?%HMeEkh{)IYa|VR;D{ zDMkK`0O_VRGkYgPAH>VhAc}p@@q8yR6FW}Y4fb!Tw%^mDWXu^rWAFSFD#4zUj*G{m z%OY;I2d{lE0V4m4ET-!c?2L2mAM)G$<=usD%?v#+^d%W!bGzs3<=yz0cnzerg8z7j zz`u$(*OEWHs)|fw?P|xX%CAUYCKfAnm+WqZf-;31=%;^MEueWlQ?RH=E*h5=!O1~dI+J?j*$pXeqJ+-$!q54rd6JN+IFBYG1wtqo4be)uM*Zo0v zUniY@stVGdSVrIbVGVgSkFxbVS<$k87|EWb**aMb+(ux}mSr?x*s&+8p^Fyc!FFA3 z@@yo>vQO99&$mfj^>;d!Su`*2%8IU%`hVvsOxf9LR?^}o8&F6ZM^xF6enH6!hcR9a zT*T+k;Qe8lh)L1k{%f8OoYppv7zH1Dn8zOz+CN(3Pvh%&z^)OGs$xl&RYLpCRW{w3 z_N^50tc?4;xqC8;3$mJm&X~k;U)8F9o)(l2D9_hVSsx5P%SxC%#(=AjV-;dgX3^x+ zsrTUtCf;ZDvAiXl;b)udCa-=h^1MI9`SW7ChE-=|u$5aNYy;a*;vtl|B+*#kmbY0I zUr&^Ln{DXW8~+NeG4zo!qR793B-xC)d5bZb=fm5I;^_nw2J2+jDNJ8^JhqF>Q?Sov z^eKG5`DQ$OV8IEj9^-hROGA^%?(rsGO@KFXG2Sllba=~vPp@ReTT9HnLvz6WQ^F8e0*F#-xMQWQT6k3#5JgX42?71 zYZWO!mLmdr>^Zw0vf50hSaXYV{CTz7B->Sg+H4ZsUekh(?4hxxdj*U1yrG@*5hG`3 z-HLf&5ALi9c81GfYN_)*y%+WfgdKG zc<_)Bf<%w90|a)66XT&{BvT=WVHS$bV1#yK;e)&!2cBSE`@xf(Y(IR0u_3^td=7;j zSz=MxLkG&3k%U8!@=OGDask~BAKXB|Vh^AG$LTQ!J5HW)=uv8ofgiqZjneY{&?(Z6 zKp(#93>x@&=->{30{p1idtwg(o5A2F0}?zfbutYd-J`>0Fm9$HuoFhye)PDBhro{S z+aNQTupsxN_gWf=9475gOa_N?@#8F@Da#jy9<_^6=rOAq1s=7j5$Hpgukn3A9Dd5w z-;bW&2teQ`wh0jEsZE6a@ZpmLBz9tZ0)Zahe8qvMc4u41_`4mExnbxe%D0sczn8P> z(^O}5pie(sy?p!r65%y)k9qg>HB^0_W{Yh>Se4a^eE;3k7q7pYz2FClco^ThP%9}W zOGUuWi$c^+saaH9Fj}ZwwT?T74KyU7n}RZPUa|e?C&ET$W8UfYzh`Xl9-m7UtK=fU zYV{YGAMZOx34NX4R=FN+vt^=}cZ%PY0JE<;TORO@H1IXprVxHbdKq8SWV=)xNHw~g-&ix#)@vuF zH#v-pLuw)NaZZ$vd!l^26XoNdD4*a&`Glv*$1+Zok9neetP|yPqVa54A;#-f~t+UuKC)a<;9EPmljT>aAaN z`rT$P9wD}O@#*UgT{NKHhDD}#=Op==d3XOP_9tg962^KUTa%?8=gYh(X9*G+G!9*} z0GnRy5MYzvdwi)tGNsh~A}Kz-@Z&-QxaXEaYBuMhQ}0}?(2&}x3Y}iKGASirtrfCo zUO!5S#WA%Sh968TK!hWa0)Stuz$UL9SkUPkzY{!wd73Ds<~|+@>DTzg+%G^Waij`R z91!=O3JMT*2#HS4&*kx{cPH^^NbB@m0n?n9<00al8=byB*~X_A*FW&-o0DJ##O{&^ z8p97w@u~SiCpvk3w7D;R%XEb%imz$>ah@&Kj07kAz85XpW@sy))8AYkyJjdA)W3@> zU~;OXZZUW2agw{tG`6gicn*o3z_ya$;V$#TUFN|A4|kd6+MVVu^D>LbHpwdUTk{-V zbr$x64?vRG`tlXayM)Dd$;RzGaP{V_n*TJhmhQP~G5TKn(NnFq zA3feILtEHl^*hQzr9TCRXhSy zW}VS*zkro{U|D`xXeSn0wuXHQydOQMo>CX_RUGfDGgJK>$^!sp+Ar(1?;>bC87zVmk<7a|SWR4^*Nu5kp< zn|XkAuIX{C`gFQ0=m_i62@KPZ6PkpHN5jZP3@*tC?7ik?MXD|TxJjDQxax`v{vY@Z zFX;^}V8~qN+al&2p7i~!AH6Fwuov#?uD!0RO?f__lbd8le%ZoIAJ2fP&DS@{Jiei0 zgYE^X$gY@9lZv+;D7v+@9Wv7xQS(c<_xy{QOuU7)ESCp)J zzmB)qpEH;gicP_8K;8F{3q3^5nD}n&1P-)2jEU4Rsp&^Fv~0&9h8sYygs~Mt$3W-U zP82y#V%ULgSaLM9M^{<3;y{wk=4Tb zp0bz^?A@MzfBt6v^!fSg`O_`@^&I|tb^dPt^!!a{yfd7Ak7EU%+cR_CWbktS?mhhV z;T8O!%kvL)P8TCNS(n_tJJ+0l@F3`L{RaHu-F5&h8q- zWX;@X$dXs*f40$fU2S!#TC7TQX^ov-SF7GFoZUP`<7LLY)LHG)?Q+SEX_tAqE$XZ; z>1J+OJ(Hn@mnNw8%ho^5$5;GzM(ewevn-$A0ArY6zWJ}e>KCuxeE6IG^c@Q_>A7Yv z&R~NStsr-hT;%8n_Kt07me(|S!9*h1YHXMx6sKF>m0_Hl?zw5s4Eyih^|!2E=LusP zEuiIapm}AO=eBWf!NP9-eZM6+z>u!Kd;Lx~V7d-mPk&|x&z}BygeS3$iErH*_vW_# z7uHocrK_0Oo)gpSHMQfGK+wE05{2ji4+=h{9=S?t+6xFe<^SgJf$RV?sn1U@& zcWrNAVyY*wGGV)u<+tYf^vPs4?B;d)u~N!`Skqv_uW;T z*O2??jITv6U;X8!+F~S3FJ{c!4ly=YsjFTq-U3D)Y% z&KEA(qragwI}xyzFzH(8k%87=33d3pI%4;DYWx^ES>?pQ%j z8L7!1X4%;qmdV*7zY&&PLMxIjk<}Zr&WHNdA;1-*gIZTZ2at8{Y$?{ejp#5SuTC*bI!wubS9Um=OHb2ofVUNlX(GSO#>j z=@>RmOy9Stod%}mg`sEIHZ`eb#J2BJ*4MW0xr)Rlg{cgdMf$0t#hPsn^9A&pE`c6s zB_v#G#dck4t@ZqGdd+|GveK{fyd%QbfC`J&CLQYU5=;=AbiEqm0XB79w^pP-w7i?p8QPzI+4 zC1Y)yg6dFU$vFXYXBKe^O5iwrvz+C_ND2M4S>{l$x>06XvSPHa*!{q0M3)_KBt+bSzXJCc-b_>-oESmUvGkFPU& zBaxYw?X5&-CinS6=mespmlKbi&q0fy9{Bo!Fa z!OSXJ<`KKM%syP^FTe-GiPDKgB9>#1$;SHKz~Gj)mDH< zQ=3?pK@Hmj!f&}jL|8w&#C2?TcAQv70EFL2tjISa!!%>Z2^^oTRM7aLq7_if257qe zbDpjBcmec$!~92pw6ZNQt^Q?|Ed)o_$hNx9IklVO{#Vy@ByX`_$w>EF+MyJWXPY9A zOHPwDQdfZ)2~eXOzN1Mh@i3{&1Fp=n0_t1jWvTJoFdCC8C^uk4acm4Ms`h{p?uI4* zxkfO9;D$baGSi;Xm|fxFm4cpI)1@#*nq0e0QG!*`Y@*(m0hKTE75@>MX~Ax=^BSHp zSDbp|7_1lW^|P)WaA5FoUBR49Deaxl+B)Fv@CT^2n6#NWvC3~K7#Ahqjb>btGTW%S zrO+0lqRe8ct%RPjBX*C=PS=nH$zWm=tt@JB#wyw0)Ma%O?I4=CzN-)a+O7-Ankx}~ zx2xRAj1S*;k2gNP92?_3*ci`ik0FGO5uV7#s2LC&n76Qy@p+f~&dlMPxOc)~Q}Emf z=Y~5UWm0`pg%&U{$oxIyf-Hw~&o(^;{D`U3TM1g3MBBx$*>XvwY_9X$ADP%Db4vnZ z2;3Leb^r8y*LBlRdg?3|dYoSWd<5T}dP4-?h zpVEu$?+>Zj3i~6=_3;z2;rsOJ$IJhEeevqeUw?e__RnuGF5dny)2=wLU6O^C^#r}fa>+zmmmx&E*B zd;d-I2?vF^VX)V1D>`pljff+8R{3=T*p~R&saT*J9!>&(YqIx69=Lx#jusxv(LCcb zaI_$`HoD_~vUSH^^ZU_*kIJ6Y+bMAWpg`iQ~O1hytP}0@6sXooNq7jpbR^wJ@!pZQMRXy z4&An{%t1-_^_pq#hwD|5kF-@I!AJOpoN%m+wv}9W;3{>}+OvRxTdYXD#uQ_^&N&Y% z=w``w92vgFo9fJSwhhO;APMt*-}ycYVC}|u36spd8z*o_{$gY;+~hgE+EL4y_DVQQ zw*5t60OlH#I+dIMZ1+#z4`*#B1=c5LVymuVZm7)$DF>F<*`{_zpxmLAwN_JInh3Xq z(|HwmN8BF#@;3IqDCdFC#`et7TYhM^7mQw`JDlwm*S@cNf%i$bQmYppPKoV}zafh4 znG>!uD7F^{N^H-$GDD8^XRdcF+k+J)bRXE>1KazpuJy57+s6{ZfkFFK6T-wXT{}p; zFpXUrJ6=erpG1a5N$N#OY{yRMK)?B{>uuXhTqE)9ASHGZCALpg3E?#*8^(Ne?t-W@ zSz^Y`mRZC_uC+A`Ps(=3iYgN~{)!xk%tD#%F?O@d75?BCI`ULvfiJd9@L;seGoHz_ z%NJ+bYo@Myrd{SsQe>s}De%ttF5UqrZ6uFr_>GS4@9v+)R%??(ZC!ixdgzF6=ppYRr< z+hLv0ftYhX&EJZ|;;Igehusi>)YhQO%X9tFyHQvJqra4^8W^zlbp&1)tOhcM@eqz{hNIkGQ zsOOS|`L0G5F&y7EJrjD;@Z;2h7Ee7t3}YC&CLstLWa=XRE$7v=;&--~|0?j$nzo{^ zsAVOm`arT)Knme2i3OicYYzaHlnX@8G#C&$HwEfzZQ?eY!#q6eT0S1VI{!qwY0qTZ zHDP|6Q2nf#TXx0|-wy^ehS@zkRhabH`e~W6s?G zI2~`@if3dWXz|C#PqaU>oVQuR|75laLp^?S#`o9n4ICin1=V*#U)is<>#cD9%_>n& z?I^k{=P`wxzcHTd>;gu4(>vj6Tl*I9TC%odJNdl*>izd*=LH+(%zzdi*vvF!W(WI~-z?;=#cYecf;VMWA_coAzoSWQJ@E66l3P5(rvqH3 z;QnBs-O$3-V&~Pt?YYKsTT9XfJUO>LxFM4WqnG7Zu#ANU!x^_6n+NT&Q+uKCmKS3L zTE4cDX4-e+9;2{zScvef;JwtBqu33KGd`At2TjS$$FlAa{tiOmp(WM8!m6-__W9DmxQKdyR3E&IN~kf|KDUqwQY>>`U~dED+}Gu zs{KTKGZ}PxT(OUTyKbG@FeAAoSHb%NCYwr}dvI48UfZ^T3}02Yj+a|*en;@0@X>Lz zmx(zt8~7$)ZddGI-1{85nD;Al{3h92C~gQT$+oKwA7;=%TY5iLKwC3sB{omUGtdcb zQMc#hz<#y7!JkiZbknss;roSUpnwLZLk8)XUAwzS`oG7teOX&@gSwOVYLOj>pwrls zr>f1t_9T!LW}SeURZvM*5`N_&Cz&b7{`h8s?;l`WPG-_F4BNv{&rA8=tTptHU?K9W zsxS}GWxi>jMw!mcof-3I@4+tqc@clQjXza(`6-!I`M8cH)+}`?uv=igk>wFPPHo`l zvEfjY7>NVaIc4f?RvI6EzP5`|T#*I8hzoPf=@09E`NjF9-=x1ddUzckA;&V=qo3P` z7KN+Y&<=CYvMg>xyEFW?PoH1=1e|eh7&Fs3(tx(jU`)OI!G69^f1Le%n=O|=!jSth z%|88~v!OrFQD1-De$`gC;iX~VI?xTiOU&2_p(ldCGu$*y2t1^I;78PoqtrLNI1NL~ z@L=zDR;S+CHR3d>k%r+XT+todrnt!x!SKrsjfM1FbI8^dB@5Gu z)@B&?T#w)bNVIp$?P9?_$ewPQyB0eE<81+}1PeK(J%;K%X$+U9<9IZx#(4{}hV)Dv z`%Z(;YAJRcL>xSEZ+7rtOtOw@igh|;!wQaY=WpzXVcmFj^Prp0!RCSDVbh!8QCi2SOlX_&?&@r{u9spY||n+}bkLsE;F z@MlWBC^hWRGfW!Lz)WrE7MH}9>3S(K>|ji`9?!R zf6Prmd{gaJ>WD?d(hb*pQ1X9RGrqu(B@-*l(6Ifg7Z%@j4Lb?qkVKYkS)T3F*m8r| zk5ki(LJR(7#*BN%iESmZ!9)p6AG!zrpATaLvFE|3b+VKkJ=2zmyg2U5*yX5HoTA3p z<+a#kV5i1hN0;w1FfU~=m?2*}x$um+JGa~s& zse`rl&quG`y!&wV{`o&2X>@&)75RF_+;!GF*ReNIdT*OH$Zt#G2(1iagXJ&BiP|vdV3E&-I+VN%YutJcp=3cd^c6_$zEX> zbI_cHN4(%kFGZ?1_rdH}`HXpBnN{9Wn$9C)F^^$=$(DJ_M8A19fU@U?H8;IEQv=u8 z)^@B%+eIx#+bk~gBhRfTqiD7dL>NnWo_x z;cQiAx675|`s+oW#oq0=x8-b2tJ!tFqVucy@3x2Tmrb{B^M11h%=vlFE4cu^!m8&O zramsSwnIWK$!6151_o;ee&U52whfs8%O35CedbJEf2BP)z*sCOBinOxnNYAD;+?KN z-Sn>v=iD;RU2|r*$L+bfI&`t|aA^EsKmG5rp9aV6S8YH=j_Xp}jzWjHmTkl=61GL7 zfVhDjd#3LsaT0-b6}f?z`Xq2u+w#NIv!lqi4zdmP;9V0FrGOMdO zeZGIMpR{zlZtgAe&z5DzeO4b|f<5(t*(a}FJkj`pwazD~wqXaIT-zkV!MQANVaedO z5Ig-nm33iS$LQxSS3_)n%!TtnqaufqzNC77Lzagb5#0wsdhQM|E>1>wkyrFg>EUNT zH8s6Z!HcpF58Pukfz5C{b{gh>p%aX5L}TDe^u7=G?NN<73_LIt&Z~QH+cA#mI45+D zdH3TF+lLn6wrMnQ+HN^!X!o7Z)eh(3#djqc{o%orv6 zYR2WB*B1>wV^ghI(O910{OLvA0Xq9~X4loY|8SiHpZ4yvcz=QU^qTZ+2IkG!@3+aa zd-!_%e21_8KGSbc`|Y#58n}|_1t5#dUHi;e*MRBXR1(T=+#O60i2qTtJSOus4mwi1 zJIjl$CBpOx!My0FYAEY2-6_niPN5hRYs9JoGMX|a6Fc(2Jh44Bvufa#AKY(6Gkg|n zYH%oi)y7mnVd@AIVE0jCxuI)BUK*LEXNI2X`82Qt_+K!a0ylPP;>B+2I@AtKCpJRQ zF~)*V?>?Y&?M=ScTZbAY<#*%S64*Nffs4>I3Hb38JN1~fokS9r_%ClhXuD!-kJ)Y6 z94YBK510r>&sk$U)i)e>aTKR2!vkaQ99*wny?uUp^-9a~xLRr=%Jl7Z7GGbT=LIf_LwM%<*0;a6pC|NY#wM0l=D)YUJCKO(d5b+f zv_Y%TP}6580ET~My60}lu724HTHxXYz&Ljt=C5mdN3l>}2Q$zdixv1lLmxKue;W!q zI1ayR4w|y?--ZI9Z6BUUDm*in`jKbvSqZ0$J$mV_9flzyQTUryXHVDz-3G*Y~ZH z0d}A2V(MhTnOSmej^T@fTrJjHK1H!LG6P=5snu=@n2U+kny<=*VHl1(xnGB)d_xnp z0@vCD-$%9@xDwk6bml7JaIXo@w#-nGY?&qS1fr`Jc9VTSfROUs+x7Gei@3hOt8R4L7_EN^eSDfcw-=6;i6Pa4TWUyrF zZjDQW*7B(kF5*y=GVrpRdw%SFgyBEl=v&k5v0Jj-i#)r*C>)=IiA zGj{ODJuOb>WiesdAL?Z>=Gr~BCHdPsSag2hU0gFqKfKd>UcBk@t2g`kmGfKg$5}3q zsq7!QA6I7+&Ifm))U!Fpp~Hd|Y;-dWou(tpE_Ej@zN%45*4#r6V!yxJ(g zmgy`Y6&O|UUrBDrdQGl(wjXF*1^@cS z58UyXr-S}LrqOZ;;xp$_9zm0H_q0n8d;23jg7}xaCy&uh3wArEy>S6mg0)O+T-e^{ z$kj29bYGepFkO?SZRFHH;WFBL8{Z54!*AnHm#xf!RJLV!SLl|1Wtr?63_HpSReZ5n z)B=-vaXEl=j+UPBzG+fYrBc3&h^fa>DJ@&LMD_U~T zod`xqSPCL-5}*lE%YB+(m|vVPnarvJ2m%C%g<7m(bcEX`PGdqSUPmx7|RTQQn+`y1s8Qdzb1_Pg0FF^OK zp#kHT@G z^E)i+ChMF{;2neOLCaeJ8l^9YAYn|zG589OuwXGR3NB(jHgt>&r<`Jv!{4~m6&os} zNMu&ewnbis-|+T@aE9Y0-DYg&&*tk=0_#lsxWP!5-N!t0{T4#27+aL`S%r-sj-pY- zvnecA5l?}z<L06h@_Idw%qj!&7p}b4Ck@2dovOAR*>W=FO=0R4Fc@qch^TV zD(CSeJIC(kTzL6}(mmSDJ}-_%#y<(bpupFK8N{_+(^r{E;f)M$V#9z}p=}0^W-+)- z4NH5@K}>tfaZt~#b*Iqwml?rS3ly5U;qZ2HaeSKbXeV#~#^3%%7VYm7_}e+!SI@bz zb-RVtRM)gx!Od;!{_Tt5YZqJ9$DX_Y*>vU`n^Gf|ZTC)?U)C^oaT`RXv`dqIbV&PA zw|7y^Eii!Y^XXd_y~QFi93IlQs?~6-9*>&XHIWXTRT5;oSqd(My;zD`F>XjT^=w|3 zd7~}E*7T!UGh~|VqnO6Sy1V&4m^pXW;OF(-&o0D{l%2lJ&dxL6ofo%Oh98#Y*fDrR znuEU^bkdgQNXtCP5{qQ0wkolx(+kZwCi*c^hqRZk@772Ez;YZ|j;CQc3Uc_eSq{Ss zHQn-!z;JEiYK{TYV1%w|n+|n!U)N2~Q}H9gLfeKM^tce45r&-~_-DOQTCFBaiU$hGgyX?NHGY=zFG2p8x6$qJ@05Y%^(k_f@;{dgB|Gy ztjy<+C-9<3J&9yJzy+3I=k7QRKCOIVNGS<=V(Q+xRDK~1%f8_(Xjj!LNe+_;XHLR360w@@c`zaF>H z=^NLKTe#NEa4^%ycY}F&eOJ}NZf-$;Cfq`$*fnDZ`l5QxZ0x+CsRLE#sNOmz#!%II zqIykNX;lhOcq>l-%^KR6rBYL6n#wIjb~1Di_wNPRZ;YGe?bJvQh|he}(1@XFCg@@S zqS`_HU7N7R`=D%I2KW_RbjAFxM?KTD1Jh#;(L8DfflVAwBP67n1p;qULIC*%j%zd3 z)frqMf#caK(OpumA63TuUPwYf_%0@RG%S;8zNQn~&@GSnW?%+34LrxPRhRl0_u#^| zS$?2zJZUm!l#XdWJ!V@3RVe*Tdc48$b$S%^qlx=|*1K}ePOV>V+`jLU$% zNCeDnHmL zdJjW4mibP*90qi|jt&_`FyjtQC7x68ZMOk8^ z#_QnYr+?oBWA%B1oRXKW__>caLRHnLG^(fgdkU6|zi)#1;?)ey7cXRRva;$_+u)tn zH5qCuUslC&XZY0Gd&z>m&SuYOc{^Gye@F933}223d;8h?_^&_zIZ49*C^Q_-Dp5e% zHi-SC*s4zPu50%_iA!Ja2B_ov%rOT}XpIL3otM7nX$NEeU52+g??ZUmCvOeQv4~zt z3e-cD-K*UVRR}RjKd12>hrH7aN-%?Ecc3E%Zx3`-<3i;bGj(&Qx5}8Qk+dZR#l9!d zp}Iv6I49SjAI|A#*ZhSs&cjr(FH7f(MnOz72>iv;T+0SrV=~`XRnu@iViVsX)Y5cH z^?)*Js;cfFj&$UP`3X;n5vGQrVPqwrp`f>bY!bAW#M@0)Jwa!d6mYB$2 zCChlGd_)a%%v`kP)xx81!qh0HA@gdwX)jmU&GD7&2u+~jWRYOr%q7OJqr&>};^GWu z^K%6cjQ}_<0u6L9mcL@NwS^EcKmgynTwr{HW$WKCH@O$C-t3Lyp;|2UV_^x~Iv<$E zk?3M`z*`qXsmcIA=XKfFa=8I;pDvewijoNGCl@;ipQWM|l)w)X)Z)rk%$f9TPgVJ89+4(C8gIY3ueuEkBqap33}C z7QYv*cRL|dL6f$a#%zLq=Yi_Ni_f&Z(ARuwU^*)=@C+OF-lvuw7%T{VM|a?G!yv5m zCCphLJ_$m2gJI6tXP&ZC>faZi&o?P!j2Q%l(jV6<*C&Nsr0fnqeyC(G(2Xo&x0n_x zO3)E-37<7l^Z5MYoMVn^zA*NATbE&BgT6$CG`q*AA%A{ts9$49=>@;8B#Gw{xISMqXDGJ=Ej8*Hk zZSA7nTFYIuUi;QAs`sLo_gRh217)eT$%8j)4{3O_I!M#jO-^%YWs0q~eHoTrz4<>T`r`2Z8ZM6>E#Gm`@*V$poV@o9vF9qKcLriT-8C9feI8cr}AX$4OBa2 zvw?leGHJa#-fk3JCjvWBuxa-~!F=qtD0tI4Ws>H>bvYbtXhW*?s^^B&H%Vo3=K~Ht z;NXYG!6or~(KwhortTT8$xPTyYQs^urlk?)=suyQWx)3bPTHr`pelR|i00~!u6w@e zda6OZ0%cHTfBF`=E5L~h9{805kOE?+;cUDXH2RZqKc!mio4SDsq>2@_;~7BH$--aF z;AufcU3QMR^cKD`d25z5L?u6XOxp+mqH@Zv;S~%owgJu*-w-0K3_ecDkpQ}BI-q;u zti`w&7N7ql z-lSD1!Pq*q5fw3cZdJI4H}NFk(ST^h%0;-b)FCl@ z94fyT4n}wfF4hrb0YewX)H24Wj@h+&*ja$tj9{kjd>uu|lTVK#ejdVQZ`Xn{8y@a! zN@TzoqiFM-#PYI}P|{=A8_8hWHT4quk_=6ASXU+AX-G0uhOYfGBts*=vmRCR9)t3D zXp(_Cm=LNl$*{G3@0hXDXS5N0(5j@hfXwYligpQxMU%??tZq^X+bWw>CpT%%AoPo% z<6S&VQSdqv0%WB<34x6|kPz5xpCm+`pttVJ(R(C5=Ffeu9q-=&pV{=Yz`PW) z57)J+rWn9B3G;z;*(5iiY@)c=E~fWYuJ~9dR}$NbN0o0Jg6MHb*ObcUv`5>0O(ex*!)mh| ztS&a|4y*TxV0MwzhS( z7b?Y>_d%s(sOjBcDSTTQvG>Z74={0+t1M~C z#a|yzzFhwP;q1fd@8?%a43M(o;^l{{qs@59G;7TjPV5o`B`;wHZ29Un-05OmVmOI- zhEiDF4E~x{v60A|$A#t^BUFx7b7+qCWj+SUUn6aIxn#5XQe;RK z6_PQOa)xjF`!vz*0;?OthOB%vr6bIh_GWjAwPygKE-)`_kdDd}zLIsVni|yl<-_lv zzI|z74%TXXtQu!I=?hRRbB{iGkYtJ|YaoPSV_4WMZpyC8bw= zLv+I%wog~WTXjfR!rOHWNWA_2(;nQJKW76vo3-`^B^oVf8fuX$q;7*BJXHuEypJMm z3`sZp464vZZ$((M$w3i5D8f&s2$$vWMJvLp<@k(Zl0(xWP6*1b;rNb&x~|K7BXG>n zvowu)ZU}QReKn+>6FQU`o@Nots!)VC!xAg&Gp_6Z<%|tEGl#ScaG$+eh4?(5m2Z_# z0)h%&fG&mW&_w)~%(Ul=j34mnxSoJU{OStxWSm^R7Fy<;H)2|E-V`V1ii(2~)>4eF zQ|(W5!v`2eYu7+b5F&bh2R-vlBWaG0bW%r|r78126zcAgGIM`m=D_Nb!1Xwynnvi)akT6ttexF#%er)j0+Ke=Z`xUa`z zg(6-0R5Y=T99$0j+I8CP;C9nc|LDto7^qt9`1USZoxs*Es!!yh%w+t*X%8fMs}4Yt zx7%wNXx)SV#AdhZM5OKe+TR+TYD0GG_*BqXpW0=$^0}>{BpiS7bMSL)-wf#8Y}S^N zfDNpEXYI(Ky7RedW?QV^wg$9F-BYu>kR&Nq`fEpv@WK1hB97IS7O{J?BE`V-11WOI zp!!IJNJ;cwG#|n|FH|kxFsSPJs;Lv5FjEa|Uv*6<@O;}19oM%g^WhA1%XNuI4c)_P zKRR42MDlLsLrylS1X&$Ix~;Amky6wurzEnl(E=k;%Z{YnfzRz)eL`22AjY()mC>t` zP2vAPPyJGV!MIdRB!z*gB6(^tJQY@x4;=m#!c#$)4}`CBGE}}|##$_lIlafbK+R83 z5Sieg+~p`*ix~JdOg`j$1e4+m|(#oZc0dPSK9> znS-$d?P|^C1u?gT$MBEE+J?&mwu{>i+Zf9|UeC^3Epub&*% zxBh@}FY=P8k0WpR^z{_(c{K^w=K-@oFAH9nS2;QR^m>n6v7tUd3cW`T zVt>w*@UsbGFZ)I`^8Kepg8HE;;k{(at4k1e$duQui~kRq@(PS4NKqG}6Pq2<-MyT2 zcRP5!T~hK$g^_B6WGAbq+GdZC0o8GOae_GWwv?bT(6kFpJJ!fCafX`Jt*DYUBzoWU z?V95lo2x&Nf(K8j$0PdLE8@u&($5um}mHbt9iC(JFa0d(^Uf%{^9$U?rTBd z>ze8KA@wa!WALM^TY+1swA-?9(x$W29;v|-C7imq`A`AwZ-hX7gKo%*Bjv^hV7;14 zf2M1UdLKpTQ-mMb5;w9rrK2pjT^5|4E3bqVl}3^10iE>kH`%KT^zKKTjx!aNaNlu^ zE;_hooVt)~1;2dqTe7BIrW?5cHqry`(_Oz$_O=GzNG*}%-a@6ZoVB^Ed;QUTF5QW*zJ5&@#H2L9L($toz+34%%YQkgpaFBe-dOiwL z{G%u{#H}LuP%ZA~n>vFMF5=nRESI~0=FOq_|EPashvWa&`9g%y?bMz>}4zT&9Ln?lO)=9)&$w#!TY6#3~st0E9LG z%=N=u>3co{MK1tJ27PP2ynXWgT8ZB1UqPoO&)=TOf8=P!a%ICtZqsDwJQ!o&-iezG zjXf!S$F1uuR#JFPb;r`{eWwbDEjnn9yjjPnMiO4%4i-1W9LyKr?^KmdO_d>G%(y|G+sj=KhCJFNwQXI z?%pd>pl@2qneWy4>x^0B`9?qwttnk0h`mwd#mljhj-BbIzn~-F%PCNi=TNI0?u5G| zhdzy*?vQsLMO|F#O3MIIg!zslPA5mDe67N*i@VtINY)w;J0)d$H%g2)^02#ROYW8z zatAwHg(ShHoF!X<9{0J+oaL|#YMsLz`p0d0%)x%nCU+=wd?SAou4R0M@b`Kjx=~c^ zM5k2y(CyceYYV`mT8+lGZ-6Ii+wT$fJ&vQ+_Ja1k9ks-6Jd3I9t?)@V54J}!JCyXN zofr^XbbyY$Sx4wdudV9=q2X*0+Ov6E=xFMMRIYJ1bgbKR zCpG$dh)|sz%q0ih`4r}ovgo~NP-&TPl&)?#u#s*MIzi}%n#%~ab!MwNbBPfm>{MUkq-qdfJyY>TTqK9b6_%`y+6$} zlUGB9%ZC69qMm^S1*lB(0EoML8Kxm!HO2rnaup48VG!74vW|0DE>`Rqn`%S8a2dd{ znx_FBS>m2GvXQIf(^~%ulAt91n9VRGMIVY`b5o8O3pTXtQDhABpg`Ql74#_HywMyg z0&c9;?tIs;#LtO)uUtt&`|9;kww^4QPVB-cg40+Zpx8^Cy#%NdJ&Cm_ud-ef*{x7i zGQ{Wd{=^!N*86cJ=C(h@pXmB8VZwPTUA|EY$b$(dHQ{KLYFbl8y!6f4sZnE#4vIK$ z*1`FQQimEn5=+)C@S#mGeC&RjFzMzi?F?0`w$WAUYYN-5y~jGIXwt^>IIbLt zaje(qj?Jb=njSOwJ!MLGOXT+tehw+>NXQZ9t;uHH9#|caCw+c$i!JbMej!|sv!KK- z@C=LX$dmfRTh-y8@8V964Yw5z4~1AEPPhTSTQNfqj_hq zW^xppak1udG;-I;Y9|%=0MCeuyV+=3s^ba}Qr`2|sZ=qv)#*Cge2_JyaB2FM4j%Qg zQg>juaA)aafbOpcMT{#_jP{iQZ_|94|NXO(0e@;goTqhI{pC5G-#?5D_$txeqYC&@ z1^lQ2-fET`>|&N1>}Hl593{Yy65vlO0p1&gs#7Z7>o9-NI)XL{a0a`b)>hZL3$K1^ z9!CLu)xEi&yYNQ-z$?sYHqieLx?(qigZW*)_W{btoi}K^SQxbwrerVHm}fhY2@Y5n+_!v7ZRlLU1g)15buuC&SDq z3Jr!OCQW#Qt&`v|!W;Adtth=Ad4x92iM9ZcUHI1g(_2q;*aB8()PiikQ zjsKaY6fjArXItyZTTH?zdRdZT8Qc23+@Bj`hSh9u?BUmJ-cOd_&&;tYLU=kh!Q=VzC#6pzDY-3fq5uR;(z0#T-z$!HXX%NS^Ks+M6B)&R9<*SR$2dR*L#~I>jba4 zabK1bDd1^0oR~7)pSPHab7Q_fcM0Bgc5Q7u&HV2-)1ZOL^S63(G%t;A!ZN zR&8san#ba4+V6q&Ms0%Zk*|lP_iMW~LV6R9h^=p9$M4LA$^7@Hw`a5DgyS0;{>bV<-xdAz;^KTGny9+ThK?nf ztrPEqv{B%2Nq?^0DK9e@ggi;+s}-J;an>I-se5&YtR~{9=F6T*S(n|sMrlprFQE#5R7n~Ay z>WkA>#I_kXv*gXNW~b;%Y`wv(i|rU2epd#nbA5L$Izz!)H*d?g1%5z@5UqvQVe-{8 z)XXVnr^w-Ow(|gx;a9c_0sx>x2x$f9TUOIbCRF1g4!Vo#Qf?M*lG8UIeE@9BZ}xSC z+6UfVs9j`z-9Dh6>#gj;vk7pYa<8^I#c0d!R8#uVB)^P-rB-JBp|pV*Xs ze|Gj7{`dOb+4~>gzWdLs`XKb=GJo~Th4` z++D;xBz`ONy>550db&5-7I4A<$ilW@zfH=tn%3RLI{01>W-Is(W&94|A1Oij?)%+1 z+7iA;-}&M@;&;WKEItQJ8i(N#z|Ryo0{G_z;FsK?FB-u|Lh&$?A|{*~9!tWwVMIw1 zQ!3FCk`b1u$nZ#n(r89#pjD_t&11@Zp04Ea&z$OBWl`?MzW^v(ZI63o_6(c<#!GMv zxn2q3v1(L~2J~%d`+>~mwQT?@n2oZu9KCH7Mat24aYoUuZt*f778v-bo2Kn|F^9I6 z$j08oUl;p5Fc=-0RfB3O28c1Au>Mpoan*)U!pjKz1Fio2_T$eJIPU~i1^}!M1;^Q5 zigoKE8|Qz2ACB+M=5HX4@_0CXfmmOwITAb!&3`E8q(?#Olp<2!lPq7h{?4LYQ;s@_ z3MGKu3{Af(Th*{E^jMAX<5NV*r&T38K4(F^3u?Aq*ty)U_D9!g+UfD&y2GNfbrx5_ z?SxQjSgO*5!1}C+FQWGF#FqFT#<|~4W3PwWE3e*qaO;Y1iEb$cP+XJKEbanw*-5E| zbs60o-Uftb#ruyuima&;}X$Xtb@-x#u*gXjp~okQ*wV1bBA_ zFwTMCI1j~(hU0S|Jf2eFdAkJk1{y4ngwr<)#|gU8qvQ1OlmJc_%Ng~paQecFWIaB{ zBD>&fTW&{O{YNk8b$oRlcA_Y5)jZq)*{&Mz+SqLp`g_EUW9il{!3L<>c6}>U4cHh^ zbyRc40q=(4uBck@{p10l|9n2x;)tq`sQOu<>cuiIO5^31ONA z0MW`tisnI&50H}pZq!CQQoe&Y9hHYUV4o|;Xpjs!ux@>6Pt)Vg$>Le1G+$lbG zWU$FB47@n|fT0&i7oXIghc<2A$y3|-?cb3EuB<%vyx_I7DICC~E^kbZz!zSl!>KVM z*5ib&tIPZqEbd4ZSFq~5YRoljG>a=6ia$sPBisvk!nw=WBX0xBLCfNe+Wd7y0asaB?)SocM^yw3R;G7@00C z#_JI#7TE=v+HyN0Q}H<-cGQ=s?36wK^Oi(yAOxkYQ?&t{T{TJ19M0OV?*nH=m+k~+ zgKiM+O%ZedsOEhHv(FmLF5ICn8q9La6iWnGJdu$fQlb)*z>e9ch+Cb?}Sf91Y`@rCQ5zo;MiXj_P3WGkOyEIsf|!{G9*b z`NGe4n^2ML;8NM=dlfW+t(Ql0jc*I<;tmNv(&#%1_$=;5yU~ham+g5*4&6VR1Ri1C zQ^LBxn@eCCB^+Q|AXubgK>^c=&?H(>nkFV-zJ{wwW0tCz3aL@DC5^&JDnFzFi}gxa zH<3U1RGE%U0r_;&(x73WRU0_W?#Ao!cPHRkz}wAKdpDsdwwu!qxAkKf=Mg2f|tXc9euLsTBEF0FbQ^MK2K8; z1c6F)nzArTwB#DzUajY_EkG%zA=$@DdF7lvI8fTjY-k23`J~JFZf?q=OTxX)hKSF| z5h=|SI3lG-bsJi||6Vjw(n*^7N-~&LoeH5il?f4vAEg1IOeHYoL27)hRg%Uj;HEf8 z6P<*{@F-1MC8A~tun*Jo%wgsZAZrq=CYr|i?6KwMFv%XdPK2C3ynXlX^^YGu{c!&F z?5EeiT_NIW+;NbW>KFNSm1#3crm?h8oqckN4_U5dsVyyZKfv*uNgEdz=fA_U`}SYI zeR%!)7w?}QxpHR5OTO{u{l!Q7jc=#nh$*}%tYMJJ(*kZNZ@4%&XyY>r&fsa3^`bpJ zl5PSNjcz=lXVP)H-Vb(uC-IR@)lR3^$>zcbm1%~rJNE`WmC~&*5oYbQUL%Vsk?+F} z*68zV zy=cT32mpXG4tyfD3PUAg0Slmzv0^NR^^aGqV$KK|O>P0v z3e1Mo*S)4M^CfLNC{$Bp?ojjU!i+j+MRAjvE3b!H;U#{nbX8vcSPW#AU)dwhGE2rI z8A(`UC*kzXWy9ab@!yH{GY1mj&H6k z6PSGUuG~MrwVBvg4ReQzdVm*CnD? z{HT_W%KBO%tk$*zUZvpD0iy0UO?zi}Mr%zq`(ICLPfJ@qtML3;4)JQ28N5TF)ht*2 zv33bIQ#Veu#I&;ySQCDM$u&jUNWbc=1WZ*~9#fV{2Dd$2BTRtD5ke)dXVnxJ!&nC9 z{zQ6i9s%e#$JLVo917JEdH~k*F92SD*$%uOD%E8x@Vc<1uLq%6WEb#i%k9j1azzc= z0BdE!AS7X;1!t*-HF{eJD|{C195T3O${rlT+Q#>Tuu-rZghjpmeM!%l2S;6^!y(vX z(#c_yPL|!EFB;+kz~wQCm{c6D4l^X=No-R1p(Q|GPM9D`2&;~S<<>|QrJ9A2fdWSI zn1w4LuKPI?;5KjpZgpTAB3#VRu;>nXLC2M@hqAJPVs-8b8k01HUadA?%_O8?J69KH zA7ECm5G`F{HVXd3sRfNkuu%P3yO+Gf~_`t0K`%T$L1);AtJG(^ah+&VmI97=e(~WT^HT%ltW_vS`*pZlxJn0~- zY?C!!tta6!pQw&bcMWc@0uwU3eSl$EJZ+PDEXCT?Jmpm{^I2ZCCVuZ^nL8ITz`9v= z<2Dw}%Y<@WJyiZeK1mx`9>toFzcpu%D(k2S)M> z#_gO3tQC=Nx)WG<@y*n++_^jmgZ3!P)*^g+DaxNaq%pC8ft2#_Oc9LxnQkG75suq71v*`!%iwbZyW3+I2E)t-)^;K_}Y7Oy=6FznXf+cTTeZ# zx@>EihaeLBFb}rvZHb5bw%u{O6Ys#gjP4tiPW)g#f@4BFXj%3CgLHY9&gWy!(hc~n zL(mQPTHAwS2xS_<{uyrR#Dt2|?I?!j!#xzSAVfd{rj&}5(nQ1llF8T@B4VEgzD$JF zG1F-*(CI;IKZw#KjeMQZP!qcN)?6eO;O#1uidjs3n1`6^)R;)Jn7~Fgjguf{oXa>- zGB8pGVH)yCQyNj}Q*DTT0%Bp=E%>6T1rZv?qX_;4B;ni-k@ZO=4`rg5W^tT^e!_{S zF%v3`IZ?3*Lz+gZ2%|JiTBrqle!lbE&x$mp>cr1RG#X+p}WEE>x-OeeZ-W(AOIe)(RWLKJ3eU zWcTyp@jbg6{3jx($l)&m^7j@$AcCOW?AHvhq= z-RnPb`(BL)cyMQr{ceqS_TkgPEd3bUBeSq|H@&lo$3Fgc=gR`%->lj|@-BbS4P;9I z{Ne(&?QR2L9U*%ht*q|C1|i|D{PxEqerz=n0B?{ki?)dgXXK+#u_Ot)zSui^4hPVd zK6k_^%{PxY<$-a^-zkGmr*QE@o}?yG9Nos!go_}-)8>FN_-jf+ZhXn`^uvTvk}?+Q zIAwuMv{7^eobtxVAx3U=inL>2^Obi8UAF0E@E*PW9YBX1x|kmun^9S5)lYe5&Bf|Z z@r0nfwZ|MgVwR7XEQiBS9ddyWT&2c-wFDqCg1;utJOO)#q1KjoZ~Ah1IYwM@dHJdC z)(KQKaz_OgJzy2ysJH=ig!m#iR!R2O2^M5uToWw_27{AO=*wb`ycsu&g+ce5ohGcm?M!e-y~n^)A)40ww9OGsYZd>`-nH(yZ7k_m5wbsy2N+6y<4r)Y$+5GJ zaqM^zPjYqv13|Odlo(5*LP~S_cV1!NAkUIV*(cem?j}WDsLN=^HfASq?2(4-ZZ^s8 zud2TK>PSS>dH#`z<~~_&ZA25Er1Au30-|B@kc9o<>?}7Qw!W?`H|RgZ=xg;Ig-0y% zwt-IrYU(2&1lcs*nof_wHue{KUcixCJ~Rh(A^D!Pc%S*(aexr7kbn>uCh`9GYt(*<$P{( zx#UDGC-QKX9FB$m_2;4}T+P$hKmF2c2Kd*XEhfgqj7ENzF(bPI7WUF8IKeF(PxT^K zruvpU8c*((wkQ{(696C3r$vWlxtt@R8)!58LLs&skT9}}PwgrQo1Q>Gu^&GID&4)Bspl8>4S6=&8 z61B=_HD>V$X0S|n;DIH2&eySZ`ZnaZnXlHj(PTV@NlA;o`z2V!@Lwl@$n62KIg7$<0%U*{8e{~k<)gT{Mu z!p?`~UyzQzf!BZDs0p@Lgk!4?#AiY5+naJb$PLD5e?A%L*!yBNh+2PGQrGe5JxjXIT=9RAz)lDwbK02<29jW zefvH3h29fKKdQ_78#jBW`(Qjei1&!+9=42Z=cgJ*p~u)26^02<`{Z~}FPs=&QHB9& z;rE$;X7vRQe|4$frg=G?jmqy>pY;XtXrDSB_#UUPJ>_Anqs`tMO8i-F-~?+yM=~NI zON7r)vyKi;#WN#*hoJ;7@R?T9&gb+=TS8(P!*#8VSH*|g!dSzc%LEDCj;jqnA~xP@_Pm+( zUeA{Q`MUPovcBK_LhG8zz464nXWhF-%-O!`T2ExraCUz8PPdF+(jL6K%ow2Qquq~P% zfRBy+R*%UFw&5WNlVMoUs{ABjFdx6!oYVftZ@PiuyB}V?`Q_aSE?a+(@9k&-j!g(y z7tcMm))>CX_bD{?8B5@v9^~Gtt+4Z=zlx!pQ*@$1-Y<`pzhhrO#bnn)-)bb)*L|~u znU(h{^jRkjasANpHEd#Gq!hqpMxr1PA=4R+1jp4h6oUJ()A_W!Yf~hn)#5y#>vD=P z)O_cmrMQGCKx4rFgANEGBBp2YEDub^Az&K{dPY?UbN0O{5cSYcg2lc^I9S0~%v6P7 zq))}susHB&ctzqNiLfX{cwSKm-wWVr*+#j~u=p7ke_gP6$8-9$VR6WXBs77CNJ&3S z1y@1=CMHS5!!$~C7%Q5FaVkinGI&P(G))9yS|#wW=qeuJV6j23!`_D)0@k8==&3cH zW5ZokV+n&_Aa`xi6>Cx=C2}j# zJ$<_{zIrTW){`kbS(Q;iu?}f?=a;5P!_+O6O{)eWLlX*BP13ZcB$)P$*sx9LbVGp! zw#?<^(()k8xeYpAHzAzMd#gW}OIh_^$O%$YM}|)E@tfS%fau9`T9hBZX^zh;ORm76 zfc3?#tU1>Gofu6#!0qV9h5pTCRmOrT(Ls-74Lw6QH_XOtHBKze2JNoT;~p38 zsYspg%T73m)Eyw-gxL24L!e0kN+WjFOJ04F3~gqs2TIK2e^#lD%y46RHwP@E2UsB8C(x|thl!*JY09YqV(W} zZa&U&6^5l@;iyOl}`F&X-%Fgsn?;n5vy2-f~Om%YuP6Ueg!Dih#NC%2=Y{dT`2Al0>4H6J^p)>-X0&hkU;Q}l^bo?Ltor#ZD+d2Q`LPd-iESwgBg5n}Q@CYn@on(YV zD9(-IBoN0v0w9h%zb9Z09v{yKurN*_j3Zz~3BP_)iC6%kAIz<6KCaxX%&hv30m3;-G%?=s*ym)ovy7sk>z8f?9lvYk810yrenmS(#L)Q2H?@8yLPQpOfw zF~IXz#~^Q4<}-%|OYJqsxGA`Fmu&{06=w9-1?r{DfxCx7vcVbZ%J)X54-z78CzBljr@?23gF6?- z-M%__f^BrVrgMgp1u@ICuYFje{}`Mb3AQ-oiCx8c~10GSo2{Z>HOmkQ|=n5&w$Dt^lroe3cG7Gq|F`kdPq{`o1_9 z$@w7(o`Kx<1U>_~&kW>tJcv&k#{~@MR0LV-2Qcd#R@^MkBA*FL0~S(|$tYBWL_wUu z{42$REYl(9J`cH!ySSS!I=#x_Qsv!zfr&%&aju#e>Rgu9A*SZbcOQB$Uap<~&Yk|@ z4uH|^Mcs_Uf7Nt_?N-rizt0E?^STPQ2C!h$wvLF&3;X_u58msS?*I_mgd3?V@6F3! zCxGj)JT4XiahWxV?on1J{x26j;eN&x9V2Y4(|*sS3pJ@gttjwH=}^#!Jy=Q(i@pT! za`XE}M)&mOo=2C<-4W?LIv1a9MmirO?t1^xd=@aby*Rd=dy`_+S8|eP{k#~=2jk)f z!=Lv3@}#Ho`B;}oW4K4;b{gC=PmIT7F9_n_&&a;ncLfKtZ^HBHQ0(m-PhWvTblXn~ z*%^A?ee~eu)Sdu+d06BkLd}CXJjIvCeB%WS(3dC949Rkjlc2M*Z#o6*6f;1-<9)Gl z2i9O;ecXcpzx7VfzfEl9_rXK!J z17FB24WtZxDpHk%JV}!z^aC!m3RT3lqMRue&_uvp)JY<`6({SrXV^=Z(>Y2jBlKyz zo~)J;x`_7TzgKljwWE&r{kk-;ceriG!$Xc@lZOphOkYdb6Kkk<*=q$~FI#!$Mb=yO zZ)$HW)51{yCU9P!VEY#5eQau=K5-y6R_Ol1DYV`AaqW}&zT zjLbj4XdW27Zxp-WL!Shlxb-;jziVUc?T_p;8U=vX&m#luZQ`s_3@54oAGrJj^8eh! z8*qmD|Nc9;CR#8nX6w2I^)|36l@KV&BgA6@wsx8sa3+Ng!AQwMlBB5&nGUjjzWaOh znno&1R79eTN1={F5>v%|9inD~VoAb9lq8IFvO3mmL^&;WUg;9MGdur1EX%lLbMJOK z^*w(+A9XdbuhM~gHqI(_08a?>*?}f7p3$0U7eO1~NvjF>Qru7nma4%A(`rQEKYmtR z!2v`s6$SkAv=L)s@` z1V;Woond?M!z|_NjNAJu?~X_ONE|fu6EDEv(@^D0>s--=+m}Z zDXjh+_Nf#;@>EjExz>Ub*ir&6C5b5PVhPFOC<+CO1PueYi6PY)7b;a9R_i2B(&?}_ zxt=mpY#cwlYDmK$9BJ4p4m&lq$y)URt4*BcBNLO*`-v#KG>1*6E2ZB?!%Z3M$?#9s zlrP>EBTOsl{aQ@0u)sSxlPI|M;_a{RE_zc~#SK-(j%it1JIatyQms)oc&2UTMU#ey zG-78j+x{k4-VpQFIHF~#~KU>rvMY-fE)t0h-iCAsZe_Tp9X;lddC_1e?3yp#u1L<8LPs6xeEM%Ncp zMEfeLGHjLg3wa!!UDj`VH9ggC@u>({Cx|_QN3w4ONAN++>8Az*B9DqI5*Rv&=nHxZ z8>AKp!&(sZY&HlFXjkE>3{cId?^vH>wP)YaAGQy!cQJGLL*T9Tej5%5KO-*St1wIw zpMU|B5z5G^9FToe@C>%@r*FLV;5}&=r3nx5;Y&0NvnWeM$at91L}Vfo5*Z)x8y;se zj5VyCek_Ct5-w962%2PZ2aH0UM9-MK!(RL6tM@Oj-v3g=hACj4MWZ^4pbA~`73@GQ z-e+}#RUqI5S&sAqeca={n9A0=cJAN|-kPKbuX>5vs|`YN1(R1AThJr^TlI>$t+{N5 z_9D8lx?OVN_#&-A)WHa+)7yX*b4>s(u;}w;+gE*+Pc>@bz8q`y$*Vv8QUNxx({cfW z0+evmD)TUF+~BFJ`GCWAF%GkrId}e!iECsIa6oS0rd$M0s4b7(91D%Wq?nKGlWfxs z1-mSYg;(65+(Ip!e7PpoTf6E}vY=6%HI2iWdvMl|Z(gs1h~p`@ou!vQ6D-*PzaS-MB^lr0bx;; zF#tFKT4YKCiceFV5hgPccBPAV;TKc|v6(SebKmZhV?CLp(k2`@>6Ob_)oX3r|K&ND zQ&bCYToj-7XOFLXLp33jEz?$DqDXz1rT8Q3Gcz9J7C}t0J{o zvYsKFJiK-_&h_;gW@&K_PC_kvrIyYS%U8}I9{AOPP^>1%Qcue^7>~5m?-m_3gbZH99Z5U`7 zVvJG8nV&F;0z|!2bZAWzEgIXlZ5unbo$T1QZQFLTW81cE+jesE{db&mUTV#H=pLg- zcdcHlx@%5cCSu7F$YMssq;bcO_(ip#QS}cX$L<7mV}DhWNIm-*AXKuyQdR7m?=Pq1 z4?@MHMGBcK{CUD}BnAPc z8c;1P;UtDZUIBOGH}bYNM|wD8ZW5p+BMl*9*Q3~v`<#y4i&5XvJB4c zuU_)3QtIS^G7ZR0Xk-JMU28M9f;TYs&+_jKzj{cA=duTh!>1v^CnKEr!SSWB*G8v1 zuh`vySsPQRiBaPr_|8J6#e}JWXStjN;abmGU4f8~RA3_8oA$na*P^klYSAMX#+TOL zVY+*I*4#pSv z6hIkCxZsd9N+5+Yh65^}hq&fg(j*C>APfs(&$#a;hp~|a%7swSD3I7JUfT&~wCpi$ zlAiCp+$#@-%3<)Ril0}Nw!+G=&k2C!Z8;QDdR+P^2V7}~CHL_)4#CCF~}bQ#F(cc9+gnRbOtY)FgP({H9`r$v(eRyM&Iu?EUezWQ+g(v9-a@ z|8>xkyZtlr(PF#vgG}iSp-b-2I38JnHsp0u+>Fu#P~|=Ev7JNRYwjGdCcPtlU8##B z^~2_K7)a=nG$(lNw<0OAk;XScCC@64TWHw!&vdHzcyHH~av7tSS*C9j9N6<4Z*TZu z;3OA(!8=*uek9P~q?iW~1$vbDPaTD!qg+tSCbE}@Hy+AGXa7OoYIsJWmORb=$Vq@Y zyFN>i)hW2Q03JZZ99?#RDaA9)5FT=bHJ_UtRzz`l6f3cWpD$^Ul#Fp)FNmpsZb(uw zOBf0wVJYOC21-D1Di~A5o)%(+bQZ)AfB?<-rV$v)+obgxY93;s$Z<@Aneo0B;zQHu zQ!hs(m{JtaN)VS9@iSqAwgf?i{gWsE4c>~N&wLf4#;X3NWy)h%xw5697^}SJzd~U3 zD?hN$)rnQ`sNrCL?qW8PbSsH@R33+D!;oNoigA#yBv$&loKuPre7$H51sVleXnN^s zt0Bd}0?mkDo$mO$siPq9+EW#*5`F7;`pnp4zQ4`spl)(>znA7MtsORo>wQIz-sZK< z%K;I*o|Mbye{=JemoXF8qN5zgBg7UUcHD&IP)zo;b8w6D_2GAb|+% zroFQ)VQrOQ5UVD$7i&*V510aa(j@<1#$@$aeT*~GTrKjhItxdJ)YqtKxWtUSP@CAfBt zdV)B^!{P~Su`9AU9<6_N+v}R?JqG%jvnx>9D^+)jXA(&Ks?A)6Mq%QYjDSj?QjW36 zX%}nk4)ZWouat;e>}XviMI~E<5erz*Lo}>0BYof(~HP?gwy??H`lBW5nj)9BOIQ=74*Z zawkybIuNAibAe|55G|i`lHn8|tb(A+v8-EkEVUi&pC~qA=DO)u$g=Pw!%`;V{bnod z+<9w&>=zH^Xq23OSrtDoA{pYYl$8w zw$!e-YO6t4;UHE~|G2Q)i~6fI@zd5U>B&A&*A5yUWgBr2hy2PlVr+LKV%@&MPJ=z~ z6=mQORq!k^9!Ox?{vdK7G9Dx&6GDS zAh}aX^Cb+;D0(L0vMtj{0};S}r+`xVKr?!Jw9{cHl^b}zlEEb%xatU;gx^dJlVnK} zQQb72?(-Q%KJ5f8fe!7AV9F*-s)~*{_16Yd7I_FK4F(P|?Gev?V|-hO+_o2tb+FUR zF=K0jTt4Owbj2YI%y`}}LG9RYCt+uRUp`!%SD$`rImVD*;V2+l*;zU9O`rZFF!Hja zfL6J&2nnV?S|LO0y_;4RH%egk%P*Xac1QSY=CD7AYb7siFwOJlLpuAb`Pw28%IuM2B+S<>Y8B;sMP^4Q;a z(TWKYs5O`E_L z_tz9lc$K+ccB4tP$lS)ts=~SWk7bEwhmJ?t-DdR}dj)G>H)hUBRDEet7 z2$Aip(nzPXRCL`&sT&(JP2BXG4r;LBS%-#JIQ!&~63f^0+6mG@e>%p<7Bq&MCfL*9 z7HLX$Q}!3TnK7l?$uLhjmy8bkVf7(0pjWL*mLmo3=odH0;6qxdu+RFU)Lmd^An9@I zv|a=LUBgmFqCRulN0{rJSj^8^a-!=#EUWVN?T*y*Ii z@n#U4#H;szK#u^Nw`QnxHbi$Xmu3BM!Zasv>1h2Ec0n(2ixI+(UCQh-KbVHd4LQfFpf;nv*NRPPiejM(02KLz|QOOeSX}k>dtH*(w@&g zzM`t%sF#}o*iQCAfYxo}at6$`1nX6+6AmGgP;y!;_VBgE9RHwB^2;g5JL>PpbM#u- zIGMShZu?ET-h7H5lJN_PL;_Ay;{%MTkIx+FkLADSd=9U36j0zb$KoKK6&KfCrMa{1) zLG{;KcvrOAsGIHYxjISRJ2 zf}Z2~ZdxTeHob2AUTk1zYP9U@*+@dT8cK`9*P@^ke)ji>rf*CFgcK+8p>D&STO499 zK2U~lt2O4h%H2_H4ZW_n+rx$JiY>nZiQ3x*DD0kOQ1GY9owr8(5YU@}RpXLF#b1-9 zs^jGCOEW|4&+Ty3K0WEcF4w1bBao)x{+=_kA!(s`$k_j$jCQh$dU=+}3sNrgYFoG`Y=W(92V< zcFn8GwQ}{nJ8dyF@FZEM*kQotWRhcjOS7fsTHiC8wKaQ^VDv^8LuN_s6@PkI#j|Zs z{Y56>$*cCh=dsM?Y~tGDleOB$Ks~CGI9{++RxF-&$L^erJ6%c#X$njTvM-X`fx(5G zn~GUy?Hz_RhpUh3Fks``nO;*$J#xQFyw07FI`M(57J}IyAI1!{e6b`J^P6e}W*$N8!ZY4;t;)W9p}N`@{VpwTM4poFQ%sJ(f0+a%C!in zD6X5_&Q_1F>#NMtn_Q>KQ?krM;&NTjLNZJZD8J6ayu|t#^;b1aQW-T$YRWaFCKOAa zmntj;7wlz>dQ~JAowz;#t*rcxG?O$Bph_6zPCqOCMcV;SiQ-@j?Q+o}J*?(&rEbZy z@T@~B4JUW>hmr(QfCowcwc{x>VCoDdrAUC-ie1=M*uW;bg{_E<>WQIkEb7Zs;OrWQ zj#q0-+M+EY-xj-n*Jg}sGq&qGL@t3-M)`L0QX*^#v# zX1&pz!$n@YFeK?PoFAn>+xoWCwi7d7JwN1g`g(r1taUHfJQZs3>b8J;`s65)d-|!> zdM4PHYPVF{Kz1n~*efZZi$i+}vzt~!qXYJCaUo}_ORfE6)0oYQas(uTP6_#IyPmvP z+zZx1$GWchKdJG8m!$D}cwocgna{TfC92ZR++>i8dZ0V86xNwOQ3 zC#ALLMKpiq+pVS+EZb6d*poC4GKfSx#^&wnF<92+2{h(DJ7fq3X=jc=!rSSWh-fzu zhm#ag0oj<9BJa*!zt=fr=NaAUDA+c`72MEW>X`cCtT>IBdJ}R`X^Xx%#cB!2ZN$lw(NnIQO!$%*Y&4LkjpEdTRK?1xv0VFYC z_zQZz(NFzy2-keyp1AX`&*!iH9ds|-i>F;!Vg5R8!{KYZ{8dV|?6nxTFb5qwe3ww8 zll!8MfK?_6KW1}Aa*KI4a)ho8UTal>?FI|{8l3EL@i9h{;~&RgZqS@BJNUP9q2KBq z)z;DA!}tyyjP6V|?<-QPrx9#vGkgOo@SM>==}g4olHr$=`Uy?OFB=?(frAaen|)PF zIhIZnC!e?aECBGGEF0f-ybUcK|K_exsZRH{sS33(JXbxe;Ujk~&zs`sqxU!Ck84{4 zH|$|se~BBNKx*T_>Q zx9tRz+hR77nq&5jG&`mdmgkJNMVRMRvv=7LG?Rl_{$k@Z90L4AK8Gm0Lr}7^j zuf0@!zKW$k)m2y!#&UEO2T7D3gWh^ll#`(}+G!P2Fu$6SrNvs{B1w$>O;P9~l154= z<(4Zv5CcL>n^$9u0S#~NCML;Fa*Q&M@cda*Z;^N;rt*KmViI%mJLSrO#TAMSrD?D9 zSOt)*`|e5Df@>E`(o@stETrjZXd10Z^{mhgRe6eRr&V~1YS4xiPl&0L8uFYPco4~F z?k^VVC7(ad`Y@ijlioEvvbltqC&zr*(kF+p$1$$4V6pK8pP!$*aA<`ejWLPdX(8pn zuQLiPHyTrQxFNPQGmYE_wlHA_(3Y#;>w?Wj*XgYCKlC?lg8Hp^TjMS_dky=qpQ(bf z@_h&$>+-Q(yzL3VB6)IKP~Y5w^d27q2`~t1;32!~61}5$d}$$?4S0Q4AfgOs<&5^l zGg$7Cj{8r^ne^)Jy^+mh50rPkz~dFxpQJNh{lSq*w5OG4Q+kDa%ZEuoXg!Ln()xJ; z>%4H%H)5T?>azWnz3qW0q}cz!Bv@i(k~Ta7K&J}?-c63<$F24eTtsIq&F0yvOwKBu z`a+hfVhx=%I8d08^`WCKI7mt>8ZZd*OfjTOf*L@!#{uaAU+ZBu-}{IOvwp_iPmajV z@l$QC2`0T!1LM&@t`a^A@+0)Ym8>uMnYw#!px(IIAl$n!vQ>3-%|)?Q+J^)XLb%+* zGznsWCdWBePq|ry)TL*ESKA5s#Nk>FC|QTdH^1RQNa|7QQ2RAUMlm->(rxbcKXv%? zOh%C6AkwVo<0CFIA};FZ1ON1$o<)kN*QnR+unr^Xr-2~O3SU1E#M@w*lj$MDvPKpv z4^{tG@+3b8Z6~{T3~eb1|U#5c3CQ>eJOddJdwmIdOgZ?N zHai7C;!c^^hF^B0ZjSlTeyne4-(e4XXeMKQSUzgfQhe}IzFhjNe5rCK;oBwm`&9Y& ztbHI^(VOBHN8q5gd15I%WV5wGkAT`CMR9STvl>uN71taz$pP%O77>tD^mz)8P;HL+K~$u=l-`yAc#)HuWWo3@Mk84q4RC}Wg6rd28cZ|3(P zz3@tOd(HqG*nR&@Y{2MV^%Acu^nR0Wnmt_4-*pg4;KpuOxe0lPX$Du1gyC5R5Sc^lTN02DqjjYq-nlKe96|)GIz>nQBBWq!P(dIa!KqsTs%1!lOsF_Z6%szTxn(*yZa4Zn)FA8RkZd>a<1k zTBl#RgX_Vr7J45s#I>5qX?`-comL_UkUoZa5<*+UT)N*cObtxbTacuT+(Z(e%tUWiIf4Ur z+r%$A7X@(aMJ~s5As2j@kyXm7U+ru^bXp}L1B$?n zk12X|uv~J;$vv(ko7!&yy_vbmi+>YBuZC3=9&p6O&@cVEh(<}=fiO%E@Bzt#9A| z8_gpAzEIF%!528j;%aQ*poXaf)FtX^#<?W~VlD$~*;pjgS$O7MIjb~fA&#+P9Y(^KgHm`a7vO_XJ}=mrWl+GzgiWmVPb zB(MofvL5_dVG9;B#fVf|z7oP`uOh(WM6%0L0Bk)+GUS9lG>a%pr@Ak6}7 zpmI1mRr|{MmrC?ZU_+0sd=b&~U|YCP9mSg{_?&E}76#<8anvTt*!lGXkaoShtu%8j zS(}%m%lv|h=(6OwFEt71)bIuX*e4T0yrNexM1-;)_0U2rp;-srsNqvgYj?gHE+`aS zvxF~!)()T3)Ud}3+E)eS^#0TJ^U^iy{rd~)+c7$yZ)Gq_b>TN{Y-}2;66Lm#XM#;U zKQMH^Jwg~U0T*87@lYJTFX+|biYV@)$G1Zzyx2M_$qR$tYwM;i{P`~B#mgH78`~oQ zKj3Hw1UEaN&L2oE?o%OZaC?%we)ja4f6!j=6mfyVHlEKRu0P-?IL1EcSXGOAt2XBw z{e5*?HeTc4;9d`ZUr$Mi+X z4>Wg6@-xD?bmPY-@@2f0N!8Uh4waZs42TAK3epf#R0_$ z|0*V7cQ>05@h6Y8N9$VFSx~4Mh-I{vYXSkis|%t_lMs=TmAf!dgXSyW$7~3t@1V zqjzjEYx~9Jj6MP}>#5>{e^nLro1S5V3R)dVO+z4KAaC^$4&VnZaqk!xjO#@tDk@ZS z9EBi~w1sHP;EjS2mky{BDNrdPDX2mU>e=)e2Q3^vkq0ek-Ih2#Pj1FXue32c`>$0R zI`CmT1^}i2zWM;&p7DQG!?U8*MBU;j%M{Bg1;RFCR{IPTQB_rlQB(4==!P+HEh$O4 zg!T1s{TxZq#T@MauhH%az!@8g|NB3~-moiP-GV$OLaOkXtA*3>k_aFsOuEx@rHdG1 zKvFWG-FADwhVn-s#h*YI0w_!E`{ zk8QW7$-DauuqTC4JTU;ePqlq!{vRJ0JRA6}=r1uZuS#|W6R7;6>|c@a#d>Cg;uRX) z+ZOu8@4VQCjO*l|mjk&#FP(RVgQZm~2RvVT^wiAvg_^6wf@H%l{8%u4oa~GkQ|NiD!RM7%M|K{ondaomI|Xjcyy(9(8@-*lA-C@Ldlr*!v#ABN2Qq56 z|Ae<#+c4yH#I~T8gQ`Vx;Hu~*oTSZVJ5n17@lh@3=^sI{4tF|B3NxYO;W^!V&qr3n zU+!NwGh=^Td>Fc|yWXIR}<8BQ4^9cH|}Yv2R< zrjt#KD^t7*K-2%DAn zz}Yxwqbm&T)Y?aaPbua zE*stW@_k7MViAT)r2^h0d7Q~MU(9e_MRrrdSLEL=urfjt`(xkN?vRs^#WjEXb6EXr zqPeF%U^uv)=-ty=Kgk@{Hw8H~06tEDEs^g-hLFOA3@Ib0&kIW;L|_%V(=oX+h>S#~ z!}!-UzQnPqaPhsnK>7~5FQWB%p5ng_HJFz&U-i+5@nJKSZ`jKzw`cR$3spUYm>u-s z0@L~R{i5bk7{5WpXoaY(fA^4}QKir}sOO;YKA(G=nY}pQk>IrES~_gup;^-rbjP(dcV{)e>0RAbY&z8u*{+rk=7XE9kxtMHsB}bc z&)-`^8BWBh3og4eMNMwDc8G<}l9J*9QuV^xbC@x6uoqgm&Km)Rvy7H$1- zhhNB}}oRbEC)VS!Ph!8tRXl`B1ybyF15*Rj9^eV37~`Rp^ByCSJFZ{VTH zBh6h|npHLD%&nO-4C~xbE9{(@c&9+m>4d=X-5>#JFfZoxl^&WZ1P1+%r2VIf5vaPNGZ`%_nS zi*Os;=rZqPFAU!CQwO#Fl)-E0QGX)d}Pb@(*T1DLoquRnEUU)l;o zXw7}_Evr=MyW&CEYdPjs@$7RJMc_Pcz6kXE{Qb4taWH0trn9nR3g1&0GvZdrE8ZSi zeukE%+oRQbu&K?U?woG2_b!%ndT4~FPyZZqnx7I3L~6f!42h?Qw{*5N9nxx^IbgQh1UF|*iCah{>?x?w?^Y6?J z+Wm$q@na4Duszm~Zg;jb@ducdn4|yZg4)wA8_u)-!(uf2c2n`o-pGqLjGGy!yy@(` zZkI`W(?k-G+=Sh8#u@1=!`G_z-i5u|yU)0zM|gYO589ZzW>nvjDbxbIyU+5ZpAS$I z&LiM!D*n;yX*oqUEyL+T40&MS-JaX|nhSE58l`4fzb?7!89Y7JFa_{B0&+B<5bEO11;VB(TE`TA zJ*|tSIxa&y+{v={rbL7G#^o+6k+Wb8+@|)3Z9~ge*zUWboU`j?*%rD_(NXr*RLcA( z(Ij7QHxqF*JSm5DA44x=FE4iQ);z!tOHc5=3hQd~R3TbfQuUIEb`@(twR`h$Ao8}M zDiK8Vn!41OB0^kXNGlDSV>{H>0gW4DwoXIBsWND&vd>X#*JB!=P zo#uUR$r!&j0)n@vZ~9cy2U)0^v}==Ol^9Zn{Yx;$sU8;NTK#oZr%g{%&)31iZD=e% zB1Flos*zASjPK`b5BQ+tK^Z1T)2;y~ghZ>ODCW>Z1E8$0tqa8#f*gdQXkhNoN2>4T z%rk1b)>ZbC3si8Tmg7c|XH4sOX6y_bq6VM7>p{4N*-^>nqhIlM@LI!OqZldc%(o>;OZwTzAp}TD4s)>blT_ z4BXvBD!q{5r|oazIXPEP8za8~DFvLcy0jtLb~{10PcO5?_WIqVX4`Hj#s*Bbe0nY4 zm*L(ev5mW|LxX?e`1;mgs>U_WB?KHOhHbcqZfP0g)&#Q|AYhPF64hzQZBIYc z^cvE|ZFNsW6U)Wz_`xvLl<#Spn@4&?dW1eS##QDFaq2_gHt@;-QEcDL5$R(qa@YK8yJ4+t`+|<04kG1m+ae&mk9o3Hv9LyXI zd(3X#;YS!yc}08fu#2XV2K9A_Suy3oI7$1!U`|b{foL?X0BoSBRV2q`izWl1u=s3V ztGD|9f#Wvt2b__}`dj8H-!Wy=jVK7#B}$BRfM~g#^8q4`;5HKcB=cptJ}A_%kg(lG zRWgi=;OX#Sd^8{RSN*-v|G+iTC&LWmOx@3e8HXCHda+V-n+b|SI+b;Trc#9>nfYUo zbq*DbKPvu}#*$(CEde`xhb|Hm}@$I*w4FU?9eK)e1b ze|Jiergm4Kt(6jXc@d(#Fr`sfK9Meuab}PqNtGwMtW`Gv0Me|N4-Mc{sR?8lVmjiR zG2wl6`X45gssv^V0(GrE<$Pr{E_Ga$ra8)dBo%HbVt_<*u^$BHk*t7xm*@(_bQuCR z|KpyDmwXpC|5XqJWHUlwHh-6G5Cabr4-;IoWrrLwa45XwGL2lB3J{|#yaFdSp;r@ zOOXEoAzUHcNC7#g+QKO?9@X^VN6z#=g*!n4$pFJ2MfvZQTFg&qR%Mc4`X~WVbaS!0 zf&S_+?cW@c0yBykgpb59NquhQU2}9NdP2|2<{BV-LUDt50OL@&u*zK^P#ORRfM(Z_ zXnyJdnwnT>e!npRXvX&>3;idmKdPVRod*{x^&hmhy-bsN5Od16U~<6NpWVnIjq+z8 z(zLkpdPOC8IY`J91tap*so46{fr1&@-;kK)jO3$vuRZ+@iAcT$+0|l_kSd_>o5S4Iz+;@{oP%B{7D7MNC9uDpXCF=(Y8;1A_3-yflxs|AB!G zliOj&9GYwC2VEdjh4M<}Cdm+Gn56&!{X9+{*&>`Q_$n7+wlyX0s>gFIMrvRkzxBar|0Ku>zQ-$sktA@T>q}=bC_`W2-tO6BFP0<@Gc2g#ThW6 z87L1?GQ@cYAVjbtNm5FJzKZ}c8c5b>BvBt`+*@#%gol#myxp98yJeH&rMRi@YmEAl z=4_?7rDdjPYFwOYO*3aN6h>O-7l6u_oBb&^3qoi{L+3R@r!^uiCX0aEEr-xiYOpaK zAqO0J5Sua8O|9>$I6#N2L1aFKJj1%=Q_rYHx7h?s`D!_9q zWV82Vx^9-oid)M3{Ju5@Cgn*573F1)$>@{bVgq}~sk--p^O^avPHef_Uj$#lU-@0B z>f8OzhglMM$E$Zsb<`YoyIgMt3LX5^Z!kX=I98^q)98)b7t>(^R7Pc$kLckCGiJ~% zOHHfQ%ViWj1`RrfQs_WA#sSNCsE(Wh!3lIcNQRL4Cv~O)@{!2^aqYi%2%i+2zfKk8 zVC7`xr-6q1${;}`ns)g-!7zsWTb@-iV>nVV?N!o5LIpC*vy1W-k$HiIR(6C4O1^xR ziSd7-n(SzWCM2Di?MZb0DpO z?a^;8ztSwgG`46&DAC?YVO*~4yJT5ZUZ*IOuW7%mE>AnTgBdG%LKUeiVOt4X$2Pc* zU@7!J;MC%#l778P8^S*EF(5=smJ?dF1u)OY( zZmA(+wmG6HJcpliiRVW&2p&mJp&3!sWphLF38Bd5MT#ij$RPGd7BFF%8<&UB5;cdJ z%ruBRG6A8l5gA1OPD68;PLs%BrB||_#v5qeeYJ)#QgW)9RLE{L48c04;B=-Rfx{x# zF~&bKCz=$UQ{>TdZCIj$q`4zw=1MEXIuWM{*C)Q$X*5JFVJk#hqu&2O)SM$EM&TOK zxz==ppHrhUAf^p<2NG?E}hHg8D4EB!z-EAUc7HHP0y} z4NjOYfUeoGY}u@mb=Y!gR*u84%%)*UYB%P;rYW*dzgzbI>CLQIL>Ty>oe;j6L<^`7 z`=%Qe=&?!lPiRy5zViOk#tI@xn`OUz`Easun!2+%i{=;;HbZfHWun5iM|NS5nRj!s z0TP0WIK;5KM4%Oe6hM41AzH|Bj-Gy4aDH*IzP=eB|F5rf)5V-p=Tdtu23suU3l-?W09b_SS>zA!aw|5m{-RAj z?aLz!3`SkKS>32bf{Nms{;uxnhA0ATK+K z*kAJ!;No~um>KB$kP#R4zl{PS*o|CjasuZf*vkKNk_G0#yw}$A0@9!j=$P_iQ9P*> zjjM_x3}G%P72!&I6(`Lq8|xA{kx2synFTZo>JAf-ro#>VF+p~0pEfF2r4qawKU9gxto4JCsr|&9MDl@Q)!SFUt*KFixcTb#+EMV zds(s@;`w0_!iqAVP;&c)|mUfX=TK z!XpO-0eD^o5Slho6kLiPI1o`3O@lH~sUWx}*fdS*SRN(AqXfYi3j7>r$P>UG@exH} z=KL=&Xd$|Q-2WU^Fp=2@B33sR<>h4^TK}Y?t z5|F!XGXt0x1{f4BE^!gkD6u$1K9CVu02ZL0Fai=PgI%)H!~>!&rw|IF9HMZxl`LNEm8|+#=l%@rT?mVuC#%(1bl7Qo#IuVMq!bXYmUp zL2`~CD&vPTyID%p?uYROi>C;2iy+Jfl`J|+_)UZUmN$^VhX|;5Xwb0?I|Y|50{Di4 zT%~2hgTlpiv4j-B3~?BvEA`@>?CV?uKm>57jMY5DP}l+9f4a?F@i?D3^b??^;-$VL zplEC=G5zc_7B?6^!4zcG8zUTOFxhZC4>YiwkX%L|7VmM zxj|vkSw0!(Zd1uN2?Ip+3*(mc1~DM<02opfr~wV9{v9c3(1hDlq~$Tj=r9IUGE#Yj zzvS%^ZBq7UFSU6<{h{yA{-09?6Jd8Ufp(3O_t)>f>`&W27g?ehQbL6fCt+^*Me|@1 zRWivK;A92iKvaFda8`i?c}iGf=>rG=ZcU*jyl78_E0m?_-@t2X5LZ&>7HLZS4ZQN~ zfSsJpod?&by$B;yem>}&@w|n2K*VM9V~N^j>Jiovpp8Em>^KM+VK}$x^230F2hw&W z5G|6oY+kA)+#>Z#|IgfN_1Vh#?R2wr#fXesq63Zi6HWnCxMQ}-&zXs!mgsQMPzo{{ zSQQ}!ahM49>fDP5+{4~hojOP8l*U(Yw8}qniPR`Pa_Khfh&f>{w5slW4|f=g;qhEv6n%H^@Fc9R1ULqh2>V4>>S@ zZoy8Q-q>5sAOt9dfVU^hHy|npXzY5gLC3{E&P+CEYqY8Kc@d(snvNuGX$$F8)3!vz z%Bz~^x`hIEOP|vvYXGw|_kzZh5xmL;$Awt1(UGn{0M6@M`#?}+HuPDUW^<_GGRWZU z8ANqKQpY75h7Mt5Em_fEIU;*|sA?IKCOghAxI==eqSD(m;>li~io1vM`5sXzd1=-H zMQ~%oDE`uG<@vYTAb}AD)&SU9?JFTur4?u14%fJ*;yL6jCbO3wGV^jU{!{yMaH@;1 zIx*^X_{hdFYWrGCAeJwQTBXhyuabJ*eJA34U~zMJefr+$>43*OwU%V##T^pt zgwbw@F^Fr9COTzOFIoszGTRY~%gLJ^a@nyJ14M5j=C6GWDuk_3ho^bR>Gln#NcZre zHGXOPw(yYT&7|Eu1A4`%V-$Ns<#|>-Yh#Xk)@?7yU%C8fAKlGq|8ve@njnSv(gX@v z(>&*??#M(i&f@O7v_goy?_KmB^z53!J7O|GpBR0~uBot*Lep#X$Kk7ojGF1_R$5O0 z>x&Ogx(DFFIA){dol_2^%mTR{$dYq>0L!gR8>pI zTmT<~d!Z||GLp3KD?jUt2@BK8nD8_Om-bkSc013Gnj|dOqqln>5xn;q8(Mm^E%*y$ z%w`eqqVlTUZoe5;iTB5>oTZE5`p0abhjf2ugf=%uv8|Zj?L9#$yf24ctL$jyU3yK4 z27T8-XyDvdXcl=$%S?sGw(~=$aoVuTO$Zp0PvM_ zR(6adw4iC4qE*(&j(e~(FZQR@TSBL66ZblfjK~d%_A2AHcIx&Tz9vI$w9{^>7aFEA zO4>hqf%$c)(JZmi4;wW<%vYU0-^W8L+73bCd{YW8iuus#_CxyCDBhMPD|VI!{Urzb zie`&mN>g#pI^T5NI|_tkR65Pw zCSMjz%3M%cZU7Er$B|4biBL>%K2sEhjf`QW`*M>2jnJ{@D;h|a?{UJPY?vy|)qGm| z-~Y^4Xrz6O#p{rdmTF1Vpoc$tbmdvnIo{?>(RTDbU^g@G$8*6J`eh|*_8(jqJxXIIFYZX{AAW}XtOmsSm)%u9e5D8@O7?(TK3Sgz zQDVF$7b@=?m#-~`yB1dFS;o@FUsoDOzAOok&aKW;!8XvwZc0op9+52*^!eKidD4{6 z`A72mWBw@B*Y&)=Q~mI6y>fe{`EOx;-cQ8OpnGA2XoxS=bT^vx)-2#~<~VFo>aWQy z42nw&LVc)~QQ@OGPwmkT7aqDNJ11jDiPb!K#Xo&qNWb@buuN*uD5=_?9dpuo=he^5 z7oc??%-1W~Glsj5orj$4beHpl4JT@%q<0QWFWHBiXc$s3?J%pc0J*iD10Xe|J9c2F zcdW5`eMrUpWyjjwhD~MMp{h62`RWwO@oYWs(Uw~r;&FA8QuYIGi;&q#4?fhp5WJdO zxGrpPckYRuUJlNv&WnZ~5;@A)AQaZYF^HSM)9H9U6=g6^V(+g3o@XX9H-w1+USP*k z2`ws(ViASrB=P2oJT*Kh&kN3#GE|Oq^ulGbTrsbcY(F%MRU1VY=ud3$UaDN>L}K=80B+ zH_14Ld@EQUxd@sxItbdBK|gx>rs@9o6ult(au~yrcs)j+#XOd?45$(0yRO5l2$0a7 znX%eK{`GO2zb~?4-MT%qaF-(C5@c0XWkKm~A-~%~^1uA<*XK#T{ zlWSw_@06M{WBv&v^$C;8TLMRJ=7ipGDN(5Ss8BfrXIRTh3MHh3ks+pM#+F+@laUYj z*IbyOkHW;a9s74mOy2O1rCd6*tY1_5M)zq^<NgNvUm6g3_EMdj4m=UD#bm>>>V>=1)QMfZEV zgTk7;`jmT#%@JzCxH_SL!=-m(v0{TT4Cf#J!t;Tt)tR?KR-dwxm=qi(;@E}?O3P2_ zXXrJ7+{=9PZPVOTi^&?Ug||?9t~Y8}$9o#gt=OF_z3^i^!7)r@mA2)oNc`j7x`qqb z(6q#~tU_G5!M7OlSn1iclpC!`TaZ!S=)jjg}x zH{*fTj7AUdQvAIP*uMYnKmWb^>g9Jo{Js19^_wong5#r(-(4^A82p4a6xSu<4XTcX zz&&(eY&n(_;x`CCqX-~WPv8rX@lCSUgkfg03H}B@%W>bk+em8_Kc!nQ1)XxSb)kpg zrs@Jb?r`VUgH(g42m|bdV_G|G32lJ}J2kJn`=Ai?)li;B(0@sqRu;5HMrdJz_E3&aLlmXFIVD z4M`gZv%&1HR^BcSuvh_*&1CorGoK5aEDOE>Cx1bz{Q_>2hsHZ=7jr(HX7e*=+9^}& zEblmh={XWZu4yyAJ;XZ=5pvE>fxuFoC6T0^| zHc4AolpT|kjQs6~@Uu4Zsbb7iY#bv|7>>CnA~=GyG#X^9Q$WNAWH@}abbyh#uj(N3JeKUsjJXvyYC*~$w`6fa7*@~hLY|HoNHiv4e z0uLpduGQ?%v5la=`(ft#5oV3;z;vJF$WmY%#=+aWNgcjv5m+i2o#{82lR2NOs%l@U zuNT`TYtfIYSW*?W0Jd?837^f}MVqD%X`LQkRnejeQp}i|iN6H*h9wlEq_;|)mXR}Yo)NPH0^Mso+Eic%W zOjaUsEGO*h$3>o-fjZRNpLti33GFhX-kt#~+p4!eOa*EQk#PX@%Z0Ckr?aq(6oNG! zfK#wc!7@*RWp+G-pEZ^dQ4@uk4<@3ZydlO3p#-ItTBJjCTyhIIMiUnp#WYeRBoY?x zW`g;qAe>EDCc^4fov0ipqvRHm-a`O7N}Z2dpcL8zByIss@le= z;umb7k7_R?A9NE|o3*k(FdnU+WxYHrdb+wR;qsZ-x5F{itL~KEz~3aKH(7jN5{r$8n*$!2|++67|$a07cu2HY%um1-hLt&i4dYeM{bD` zMhaMuoq?BV5_4f}&Mn7a?hu%!fwOd0xYaI#&5EK@DyCDIEe$4wjrIJ5aw3;57)${s zXoui+?j7QU6Um5>CNLMh0HD*zr=Jd~ZwUX;rPn`e_#_(h-w&xtok##MCcR{m{4d^LVfsGqxQM zjge09!ih%y;j;U&?fO{y(v4m?Y!pUE8ZpDjccL@!-?4;e;Qw^MfBO)A(ZHX_Zk&aV z%cH~%Q`hC8&!z9DsT(9rx$xLdSOza7pE<4@a#si@xUaGpW1A8#2Lk`1f?E$Tqiz4a z%nLgm10tVctP9{&G;~?!lW9KIu-Gy>V0&cuu{z=IzO_{nadxq0htz)_VJu8#@?y;p zNJ&hJn>sd${+OBTl@!ub)O9B@GHGt1r?i@3mNK?Y0XUg(@AO&}V^eU_v_KAULrJ{f znDXj4DA>6|PK@Ne>2-4{DodA5B(e798Zh{IIi(L_nZ`NNDIDPi#r$aVFc20Bao-*4 z)3R?GLO|>A&oJyd$GQYga3g_FREtItu4)pZ^+1uN7-F!+Z?uiL+SnQ~#z?Y-US&NB zs&2V$y2Y{Sb6{tG??V+mU;mNA24{`#> zmkvL!w4KMg3ydGkZnoY8LjzT~>-uqLe(l2{F6ZjbR{nTwr|SBMBJjO4JOJWS^9P_! z_lgBrtI737!60oKhm*UVT88eiPIDZ8k9zPKZ=Uhy)8NfNlDKdjFrT}UyS^Ve4Az?k zsq#FBrxHGb#TQAU(f~f>fh&{DvzVVvO)B)VK z8haA@!=Gk?aF(vl)41Pt_bcx+zEt01ug{)qv+m2Q_wWAwhu5#({O$dlw|{y2`t{pi zurL!s*@+liSt)g)sA^Hpc22bw(qCduqnx$Z3NTxqY1mrG+sVDQm!n2* z_yW5n^SiNpI`SZ`K`VyyYy3&&oV2eU2ah_-dI(g|>9bJ!eQJF7S$fhR50)J#djha5 za2^4cMarGoet75EzBj!&4wm)m4DN?zJxBK-SO)LhA+XH5!azp%1rJ8Pa{^e#dL#qS zuOmgmT@nM6vuMgEW%8OOo>1#C-HoNIu2gsIliM32V)r(hnqYRDv^>U zQK%%#x`Z9NU>Tr^#atI_O!C6KzN=brVP;|+D_ZTASAEU9eMv^7%PD%N>j1obBLIFA zrM*N1blXyafGe%WHL`x%J+6iLC|e`a5QNNbI!H2EF4o5m@Wg!8gbe5cl?@Qm)93?9 zn0iRrg_!23+qa;S>AXZ^TT`gAiDO(#OMC~Wk{u3%XYm&#GXA5Ir8 zaFoX1XJ@|qtfB%Q4dAgs>Ulc>Ueu`!@o<1QzYaq?h=M!YRqpgCfY&|4g8&}uiGeu? z;Kk7(fajx%7q$#X{OIcH%;PaX1H2tecm{Z%Qz7;p=k$xlfS92fhAho8IN^>9+a5C5 zW;nZE0I1M)MI0m^L*K6>JRt>(0@!%QT_&7(vqain40tWY48e{~;e@tAvluG>nmf=c z;CPY{!F-{0pJ($Du*-Nbz%xa?bg%FOxaC^?=Gx& zSj}v34_}1k;EmDN|#8 z@-+doU3-Ofz5v3me98@IodLYZQ3)%ZV*>!waLJEWCU0^;t#BibrS(ivv3D_@;nmRS z`t!SQ(6%V&+F_5_c2brzyEZSv4ji_mwMx0G^35l*|V* zk$Op%MN#aDP{y&4N-0;R(hGc^xXcqM?WiIaCW>Xz0koqpb)FQ|D!HJPD~v@2$Z3%3 z!5Lo)hfYSu(IxaeJzi;c8?V~VCAS+a|hf1eO| zD~}!VJs{za&z@WVf;}(ujDAEqf~~O74O-DxoMwU=e|Do#oBw9QXmucOZY2Ip&}Va< zXA*k;%6Z;U0Ytg#UWd(^paB{st{vLzY5k0qJ!>LblM*8{n$*0J^+x7oFMr!aR9ryw zxk-*gML=YO$TaX%N(`hhVPy&hAu*Idb;^608Ny&B4@IXBfP@8B=KuCWujCCWT!ScF zP1cGvu>txz(GB7*MgkH0qpC_;HQ|EDV*Q8q*)icIwDS6lz{(q9G_w9pry**3GlzZ4 z=d?@P0us%kxS+G7Lt{u`u`(M%bI_6uEpY`niN<@UoCNz@dac6j5oFEM*{10WaJArw^O-D=@RmhR{-jtK&6n~>g@Oo<52ejM#$CBC(Pln6JZm$gtW9X=yl|Wm^N-}r9*cU4@|-F2Ln-rZKAF6S zQ}$lvcYiqA{5TH1?W6id6Kj$B+>e1!^HixMjKk24V3+;C3nM3yaTrHHwj)=GNJc#L z9GSRjlCUJmWTfKk0Ak(#`Q>_9(c~VZ*MV?IM8SZS=g6lh;7F^eub7=UI&SOL-tKE+ z{9#g#^WqtM{=u;Fn(o#vp+?;9gMIy>(X^ukL?erWTx>a;O>zSJQ$Y5s%bIYnnmd2^ z@#PQifBOFIyQ>cv?Pb2*P#Ntrs>NK$kCoh`W#T5!j2!$-rdl7acBR#qT33(LtBq~& z?{)$=KxX|oS&qjP8uoIDaaic*qP2h*!xCx8GZ^0U&3dqN`jd&ug0A8FSjgqxg4=4M zjSN{i1=^w0UU#~`)(DY7Rj1<@Zgh;AyrB%cYa9({1e^Ulm=O$gDZSb4#OW)0^oTB{ z2NYp?vNB6sE~StSQI6kD0k+;HgB?n~%e%`y?nkVB19)t}O4oi6UNvE4-pC6NPyEzw z9v543u0z+3f~+W5cn&~o{yDpOelNA;KT>pA=p~^mgACT+hh=uWMER-fM1Jh~F;8Rw zC(CmgtbUw{AP&7S6JLcb>TSeV}JAcIhfEe*ow>;4G@&ah%StiO;4C@y?U_MZZf}%%y^Z%_14#F%3izNmmHP0GSFeaH34{ zB#W6;B1z%EFwYf|Gf!na3DhBKwe%zxleM5twN<|@$J{2R-J|Jsb*)Va=nf`*Te2l! z#4*rf=vVf>Yq~<0TX6>K*IJd(+i}&O%q7WGfrVkoW!ZdMhe2y`g2MXsPp{tm`193I z-~Re1OBOfzyey^|!h0j;Iav^Z)T2n0E`x`^nW$>&MY~XGO-yX^+FwOMnQ>xn;*rUy zL52iuae*#n+F=?Aur*8$0}_T&!YvOcmcUtQUFmCGHKD(?H+`3S6gkpGw&@nH)=em_ zfaje8w(X121FULqO(QZqs{=gXX&CmpRR;B*~mNqLxWb$628UT-EJ@m^cXVO6kSuT{bRvG2ksn?h3sn~mZlCV0}E#^KBT zV8A=rdA#E_JJ@j4-$ybj$0K;Z>iwG+?K8vK$+c*!tzt zS?TRShjfpm?v4M+zWwB3S+;KZY8mETULJ`am= znWw?+*SFQEkc-iEIhB`Jm;bbUs8y_gb(`{PV|eD5B@J>6cm;>&JIwCZLTg&WD8+2n zR_p}=10T`F9nXVK0C0Ei#6AXN#y`li25np{6ONWOjsm`3e0TtLV6*Vb@n5*k3(iIk zKhCnoZP;Sx> zO;Q!70qncyt3-ydLqcW|S6wB^yS%~QW5!^zgkw9WI@1KebBZdS-NIWHwaSnv7{OKq z-Y`l#xnJnAV&q#q$|p>4eLY~h3Aw%AHM;%dxu~g&&KE?YRlAi}^ZH<^Wl^Uc(rt^K zQT*w%cR-<)#h@r$%cmLVCAa1g|`IJA9U-Uicm237+u?8CAlBS zBl;_O4-eLCN_-FG6DLEs2WHr@6CvCK-JvXqk12%BB7TfkFN?b?mmQKG=tsv?(RK$R z`t9bS*C`}-Nb|@!ri8iYJI8FCAN$A5{dh0>u9t9|4ehKS&SGynkbIcuy|;^}tEs(b z`a5fC$E}juc;_5dQM>Qf>no^j27Y8g?Y+a_$M*KD-#)TcHy^~dppi>5)FH;*I`Ft> zg9NPWI0hB~@IO{a$9G-crEF=J4DC7_Lh^ z?}!IQPew0KqF!o83VBFMrT*`~{yVvce_>fb?Qt3LLe}_nTGXg(AX+C!U~sGn zH8mxk^>vpEyd+&58C#vlM>&7vNtwV3Xi|283X#hR5g{1ZR8C8BGtK8qEvijvaCqtJ z+IqGnrSg3AYw>H*N`E7gnBVEVH@zT~2=~AL$Nmv3jnpxq`$bM3mGbNk;oN?ZwV|AxFGjP;r7SKn zo3}EhN%%(dPAHfcNqINYIlH&QAVNBMHl=z|e-6i@t0<>Ba$_$HBAX#k{`mFBNjaTS zlZOY0_D*ltz&fwB@nyiV3)8|RlOd{l(2dl($llnXAmYcw2I=J(1oi;3aodfk<_MzY zQ4|letTX3@AHv&PmpM5K>#@iSdo1fIG7U6r2X<_1$!z=UEx1PwP6YPa7jJCp%s&F} zDR>ElzQ{bZNV04o-s@e473hN(!ut%LC-XD#J4g?4`v`u~z%PLF6ZuKPWSA)@bOQ$K ztGHy`6)^)Y7)sYyS;iU08D%2&MeNB?iXh4SRCehhj`5CpVVVDI+Q})%l(628N^Od? z7)Ur7m(pQT6)99qoATt1bcxnk=`WuB zwCHoU*?+&my$h5+ktKdRG3m8QOnTi1O8wub{9SbEhL^_}cH#9Cbt0vMCG)nP_WMk; zoOyxM9oy2`WKfYkm%EAB#lc95gcXfAm)?q5-gO_7>7su8h9J*XPyBM~7JGwZ2 zIq`p;cg53L?f2XngFB0Pcb)K|odsUdd0Gbd6~>*^~-4F}bvk+Z3oDVH>6}<4h7mTB^=2$u( z`*Bb0(KDSt)A>iI^V>)8i>LE(#$d}7dT*j6R-ROTka}sv;)E;M7Kh8g7ZLZ8LPZpj?v#dXJBLza^*W&l$ukb6YNiWhc{N)t_Stt;)cYsxNVuo5G(7fiCPAG8 z+n->Gd6+w~Y$W44z%HxPeySyKBUAw;^8)-nMFGhAi&Rgb5EJx9P0Jg-ayqRFMl-30 z1K-w?|777vR%$PHUZ}|uNn)mp8)%1AwX9MJd!9^MmWiUZHME>B^}a3gDdnNf@cpJ2 z5fw+RLN0F0`A1uclq^22HD0Myek{t{Q<@T(>pq<+;i*jq+kULqhm_oUa(VnP2v5NE zw_XMNAT@K^m>S1$R4C7$Aq;@U-G#MI2wWfT#0tHz+lh5h>rS$G0BEK)9txUcoB2j$ z-{+%n5NKvm-7*}x{AeH87FRxlX6p=^pB6N49luTFV81Z+#ri-qYcTV)83jg2)g`hv@iW3%s-|UcROr%m zP0?cotBwMLd3sHK>WHO{ASn~AB%3MZSQHCgZ5qOTgz@X#_&aQaBIejH0YP0s3{~j0 ze`zigF%d;dMa%Sc0s4*S0R2$6y#RcR$oU%O!=X(IGpTjoafL>fb#+^|d$C}Viu4+~ zpDkhNVpU=cpzuoE9UWFF7A&ZHO9kLgl2=6DvcW&hHrL)gJslXQyaTKXJBEUT0IhX_ zFWn>jbwwj+!hoy^@6Ql*tER2*SkGV~;6Jm;62CjeK(g6{fV1m7Zga^MsM?*{M zFHi=c!hWZKFmUl{X)mm*q^Z{)#_1C4=FamQtm~$EMX{VF=(|*_B4*l4NSkV0gxbTm zL4$~&5U*NP5?>fv&0Ze{+!0tJT)+h^7r7F3!HN1*8sbB<(CboUwR2M|>7$hW4&SI{ zy(z6a^mUyyH15xJr{|7}6DK7U><{Xj+#(tW_$J-8KYngRnQ? z7+&<`jRc0NCf8bqQ_A;0MhI%ZRK)+YcQv|gBT4#Ih`l?+#z``p|MX&j^TwV@?y^Y` zJ2!WL0Z)@`+MJO|tw_c8VsOv0&$3T;Rn<+3q$EnR6g%T^GKgb|>~3~9$@;#k`s!N- zfi30yPurD--dBL?rjh}M~N=(rF}j2oh&C?AjV1X)TcQwPtbxzNW-^k^$;Xo$enhFlBj&oUZ8;1^0$^qo z--+Z_O#h>{&mPf!n!?K|6h|(1Y&){;q2W65&|RQ-fX#4Jt?(nXix;Yxv&DCOv`$MCT$CD0YJITG{By9^PEz0OLkC}gLfMKs7U9j|I^5~DD%G21 zv+4q5$m9GnnQBZoELAS9p8tt{c2ZkhmI%7%sKvqJ$4?JREB!+2 z4}?}%xGc*$Z_lXlv8aw`>i#amgr;d2J6DQcc+PHwRd@4Gb~o|I#&4@f90=;Fy51Sl4xP=!lRFtsruS@Zu3eUzi@e^}&4M=Du)@t?!IuOt-s@O<>IG1>5ZG zf0=T4p$`pac#iL{bXRVQi8dP9{;-k0l1BOZ*ys^zH-L@w3xlEBjk%Spt%;3nV^?g{ z=2m)ar1jY7$*|GF?t9VLh#5ZjEYt8<3?PWRj=;){PHaUU_gxcapTn9*o*#HD@@$xL zPcV$}H96N!J=h2vy-g)zNMuN1RZ?rJEr|D#2W|!KNp1z;>7q!#4KYz!9dC4j$$Q? zTtoliSOFZwdK8l?)#aC5#$c_Kj#-n^8ML)@C{7h+eyYk>*il{uMsI0%4WJh<`BF!dX$sTGUr%+n8!Uu;q30NDR%h+)2 zbt$|~(FCAMM=$oVouAVHo4jb$S0hAn2jx+H7^SgJl zJ9VkEG=e9Htcx~}t5&j}uwUT{<&8&u%LK>?1$no(D-I!_g(``&pyN4ikoJvGzX_)3 zE6>XX&gVD9(r*(LBwcpd(g)2a@C3|exnwnDO?uJ#l%}$rtx1;WlyR9<0qAMOr;+wK zO(-d~ac}R_`OS=H;~CmTWB-6W!)9Lbr{x*G4WD?2H?sGM_dfC7C%&SM$N9w9kS{O| z--HvnV>vc z8uJRK&Wup5#kWd(-Q_veUGb5{gc4FQhnZhveTt&?jSOFwWJ~?p7Ap0fI0NnV*{6$v_U^;$fp+mQFX6osE0Vd+gi*yk>}TR|9_ULo@@$Opc$)U(Y>HT%N^&5j@I}bf z-P*##r6J!o7mc!{$kbe&IH2l>)CEr;Fao_HdJNs1)HRURnXsgJ5+R=hHZe`#9ZY*! zyFFK0N->A^Q)8epD#4_wKzSu1+2UD&R8v`8eXls&>4VT$1)*W++Fab2i!g2 z?g96THu@m+wfq6D#J9j7bnS>Og3wpj+T0_5uyW^oZT^5J=@I;acftH)lTwpy<8l0f zKiW0WVnLdqrw_E<=!0HRZA%JaVF$iw3Ly?X3oNWCbWGQBJlE%rXNA5IGs_W-nI48) z=nfZ=&Edro2%SZt>v{}M!Pm@26v9VUgoX!TA!*T!Dl8@`VegVW0C0t6<;DGEqnHVG ztc;5I`P1py)ycO&sB913CdUnfP3kZp;D-TxWZ9b!x0X-~7M?s??f(th<)W zA~0tik2%7QVpw3;4nznS8T-bcZ-O7*oSmFL8Y(`kdKRtrwm{PxG97^?bB|4Zn=%J?8L(M0JnhQJdMMF*9b3DUyxfeu%?*ewT0?u70?Wj4T3i-*1! zgpO}IwjTQ2HEgbXR?|RQfSNzaAE#CH{&_8WU+OuF`x}n6TF|#SlPb>1nEaL#PSs^Q zk>}6o#uz=Hs>W&{u9LJ(M3zk+{NJG#XXw^dzDg>lfRvc2#+)PthyF4x*loRM9%SCbWm4069bK8%H-r0 zH{>Tr^)k6RWO4*udOqQyz{u@ct|f6>BOAv-QT@dfP7~2!X@TTMY2cExDA#$=aQPz* zQAmMtt=zHU7?TwC>16)C1g%%NkvHT9o>m+M4drcfU39y9sm?2f?3O|0t#&Ge_4)Pr(9+tqQCB4969~i# zO$d`EbWgCR?Ak=f{BmMThOKKdMx zl)}fb&9XFVULef`JeZVnfb@~)+L`f}w?7T2R&7#fDZ)s=uYyk%OEOWFz2=L7>j{eh zR*=k_E=uYl759azW=mwod}sxdFtYqubso9V7aFf>fPq~+yT$Kf8GkN!OjSUuUG@qt z2TgE~2k0JDr*D8EgGDgnvwrq?)WcCGP z$i^^Zq;HYIzwfeQi(9;BW3--)c}g~B$rgOkYz#Bv*z!YPk37SG+2kI4U|4!=2e68$ z3Ge7u#C*%LV5PyHaSaZZRlvi*^#k5YSlEP(X<#`e z%*F{gI}kI*3Nx+mw7r~W?=`uXj;b6!+^Vn;JU+H zEi4zjiV;Z%ZY>5|%IYECumkHI76P9?4Hf*nt)&W1;FN zy!-I_q$bIQyrH?Egb?S~UrcAI z%#xAx%KQpQ;4#c54~h$ceUd4j=3YcY%73|nc3@A&5v8D%bu5S!k%P*sf&|nQ;&T!v z%t>yNxCUx+HXb+Eb%;Cdu8YFd?dQ`#vwB;+`vL@FoVz%OHgr4or+ zf-a{IazIfgB;ODxih6;Drz#t$oRdgS1Wu|@#7Q~RD7u(Fl+#)=H8iKtE=&e~HkE7% zrvIqLZ15gQ8jfeg65&1{LZ>NZS;;m<)#^Co(c=EBQ&UnBRMJ-om4|>^8`-z>`n@A1 zFDruO4jvOQvACxeH$UDLR80h?L?oyLiQ-<`>6_Odal6X9M*HuN@2O%8F1n(xO4dmY z57VN?Fv#LAoBmdcOX594Y@tg1p%ki;AA<+d7npAtf7ymo{mdU=AKVU5Y2;U=f#yo4 zxbsz>RoPQxFTvR2f~>&((LPR>ziS=sGv{}{I$d+J6J2BOiLOz$YBmw+9nz@ymc@H3 zKg#laSXsXK!adUcBjz4$AuhRswQ0Y%Yi<0RO8R7wiCP zI=bB$(=dH?iNif&njP{A@F@cSxcR}>9l>o^_naUO{7{$?Jm6RehM?teuoP?)EJCjH z9Uu(O=pzt}dx7x9IkwG_VLT&%@pQXKFxnmwOs@{V4SHGFelHrn2-EOUam0@V^FlX@ zV%-g4b%Q8&L(_DH6~M|1Bk)Xvxt5_@u83nE=uyORKWqSBP}@zJC>p>GK33`GV0ZFq zkQ8L-)x^Q^O9V3)A6{R4_^eG)XAPa034H?=eDnYYV-jj;=e6ds4QNiZBDodAEFMZ@ z7>y|P0p_J2$UY92bb`iFvm@!8? zUC3R{i>O(1Bdw(-@UI^}z5NLg6%6k5;_B1KlZ!Xx56(p~OCs0_#Wk4m2PYR-=Vz}! ze>yuXi?rnfg(FKL`&^~i-zOo}&P%b(q11m@fQB^N>wrOJuvZ!a=wU@qF+mqJQ)HV{ zemBr&>9E!!Hib@3Wsl~y;%x7bBh})31OqMT5p@M1FB&K5Z#f-P}?s~Oq#toup~fi~iuM4r=1(+|vnkg5(+7{aZH5?URc76epT zTEQ_6BfSl>G42x>1m)<<#+5-&dj~9aRF_{mmk;yEf`rU;0x&Da4fidAxlG#hICdqe z-@chDtSH9f3xTsbQiw~GixWjC_w0T$&Jv{sF|V$dQXN4q`=*_y$vuag4PJ-XpG5Q3 zrleAah8&ApO|=_C ztlX#NcYHFD6%kr1Nc9Yw3pmpL%72BAX>$$(j+F#HoNM$>Pl8!lGaymAk}GzvNNLMr z@2Uc%tQH8*m+P{W#Fx4mv`46AI)4nP)vA|QLajFdwcf0QTJBf%i?2dRZQEc=q|s=_% z2SOIN;EM(!J`enm+oAAbQOzI@EzfmfhGWY%JwxbTtTQ+CeZz4LVZqYF2a&I{*tI+h zj_n2^X&y#OD+xK-80#pF1&?y6mIVe-G_OOIjc04UB*?SNMwRPjsUHIFjgh5gDLjs& zoS0l$cS%WGbL}#14T>BHsGS9-2-N^4?+ekzRgh+pfq97hE?TQ)X{pOp+A(-MQQNIj z!z(UQ34949iLbcKqmxZeaa^SEwmuXd2OI{JY)@1}J)hW9#FrX7f z%d)$a1kmQ{8kF2uxGPE@53R{%s>UfjJ9Yn5a~~n(EwEM`RVu%}RtSu+#w7+)r&xNu z8j5s7)~d_nA9yn2A%pUZYH-aUb=ZwD;w7vvNj9DW*U_g|MRQl~yZY@A zRX$|3u6x8FZdVk|<{0Gp!gf3SK!970-*tf#Yh*OOd^$f6JKDKO*rM^V9m?rCeRGuK z7++U{`6+S}SN5?1hN4+~gcFBd=muga(;ivQHclL-oH)8p;A{V!`~t zWUL!LsUPo}#QVG;&Vm&|2p~zxOp!v$Ngj@~oQk5BLd%L+RoPOdAvNm6T_;_qKE2PT zDx+IkiP(XXPNvyd=awPckDNSBzs0M3&ZR^1`0vl}={Hi5mZ3it!A`TCH+c51d#!bUozag3AOL^=biT{K62WxeA48Lm6YANS<>O0#nDp}dt@ z*?Ic6MxL)s-CA$>$?JR^dG3--r!msE%0Iv}{bNip_eZ+Blj+Cwq2;zRt$NE(>n*=W zS$^eXwzAun*=SqahfDY9i#89r5D|Ax$8(qthN5dSBXYQ<^S}q|&yTV?R^rAQc)b`1=#gR zxbud3#2-fCGV2B(XX-fx5F^i0dhGJ>CV^$f+w!XXnvb#2{qjWC<*f+ikD?QOW3_p; zkuAFH1yE~alZj>Yi!nX6x*1rj16^js2dlCeyqd)Y^0l;E6ZC$!@tnkF*A=1bEI24S*#xX<@&wJ z+M2!IWc`**)}@>DMcb_Ke2x4daIoxKgtn-|;8|scPOQUL2s}4*EH?~n*W|+IOpllm z3&%ABW^sLO$?;iQ3#gsqP;+H7R^`L7^i!0)v@~e=K!>dV_UompSW_fadG!@tA zcyGNC7n5o?HAUylqu~#>90CPme6C;Er}Dy-U2Feo6ls zw&@=J`z!3{dMYOSG7CF1lh&DqVK5%TeUqg06fs--bdAy2KK#*4-L^*KI@4{D-qVlf z4Q!K!I5z^jsK0hK^UaOZ$BnepQNH(t$?~}qXW=ZT$7qm5M@)CwYT|D*t8v*gxYh`4 zKQQm|(RDg2#c0qFgnK8O7G(9oZ$Fq8vsT)TU?~1j zXaCRMwJo=eY}a2wW$M(}DUkxY(YW}OEAfmyGtSZRxNJ|Iq$*W%1KlkmCIJosT2>zN zE%}ywS@!M*Nbmv>5Gh%fQGSpm5{(!mT0vaaWA+E6Hb60qidan=plDmXSC{JVkMwe252=LGj^PTH5@sx=-c7h17NiV z!1|B?Yr{5u)R5H<{4j!}C18R^eh>?fM0Ny+KOA^qnJ6ivICeJpE(innH?*K zO8ACz0J0kQ>D7`iFpo>;8yOV`tTEdPKM{9cAkKv0X&YcoQvuvnJi z$fg%t_RMTg@5a`f-#@&1X8kdTBL@~*n@XW?Xgd|!&TIYWKj}8HSse+A-^1DA==e{w zbQNf)qoA=LDFznn1UCHYso=5W+@00bZQRbM!?|w(^SwO@&TVsJlNy$7!It4TI1#q& z4ifjDdp!Wz!3MTZsrtEA{;7Lg9o^=H1iLS(TQ%}S+^cwI*MS@Yed`AL!ag5`{V=(V zJ#*-oI^C_52KSL?cKFPt7njpyQG4z^j4@ z-xkc1K}^?{1sIB0>2!8TMp+9-O_zpphD?Wut40i$T>c#YE9 z{qSxhs_Tk(8ymO<-feEH2UKmAdTX&|0)L}~*r&2(c7VjUjWn$_a3mxSZwHCpu^pZS z5f5tDTk|&{;)jTczb8p-%BdekzK|i2(xZ_b%24nK*UaJ4_1s9hZX9_c^a=b3NJyn* zQgJRkSWUMb5x;nU@vbuS8Jz)>Q?Aok);atdTVXo**D#LiK6dHcK1gd)4jvZNY_nRz z3-A78J@3P9|F(2tzd72RdC}5RC%65Mqx`Pi_H8}Af44m#)Z_Bm8_wTbAk^k`^!^C- zXu)GdsLf{G7KCbhw(Hqpb9vtm*WMqxZJejB=(e8@@-Dh{{qC7mo9LDtnMqZRV30!I zn!f?wK16u?JxL}zf#01Z^*fftw$7D%Uz{;i4Y3&?%LR ze3fw9owL0cXl}c@Gs<;|*IbnQ;UqqlqwNbdb>5Q`lzC6o?Ts{Dio#N!d$gvgkD4L_ z)EuDZ*U=Q+-F}Z6MS4D$UgRqkQ7GzWMEPfm(aqVcTVqyIsxv#-9phNTTf8i;FD zCOJyWXVA<{S1qebBfQP7W&50E6`D_Mbi`@ z%v>wDuHkN36?;CPVq`&8oDZ70sf4MfM%?}yZoiyY_mJYMjBJp}0^sG9T$SlcWpXuv z71T8p^d~S3nP~BSqjv>k(3Qlt2YsqkD$&ieMb$31qN`Wo?X~9}MlxF&T&qe_Wo=>90BDAA z{i_HaQOT4~XS~hLzVksAf4bT8_j@cl)Z)1AP;}^2j_Y1%FgPdvd82~RE*gXv7#zdr z?|v)s(KC4cG;3*gMU%UyeXWswf}8~2*Ph)7{+a+%K&`(oX%wN~e+i+)ZN#aKm-HPA zysQ1j4E-*8q_>!k{Y~_mp4}#TPuJci`c2=SCXSy@{MYzY=zu7AznMcj*QfxFW_XJM zdx&n%-Lc)MrG<21mJ}r`f%~ED5&w#!(fa=QpXc44jNXlf%x$!o_ifChUgK`*-IgCV zo*{kP@_ol?q_=$=3v744)G;<@&cZRisHXVR)@_F8FD@$XsL#e$g}1T^{q9<~@$RD2 z>3W!Ex9*`UT<5%EzW8H=(}qa4?n#oH9=Kl)zS zn1sjrUYyWv^}P%%eqix;#Nu~%-lJymfl@YL4~H^GhQfniVj6fbv9{oXz@pdz=QKva z5r+q^4<`$ywqP*texS%!G|e`P|H%;6-)kk);OS6E92d#eq!|6zGRNnzbOOw|5Qk{{ z&+s51&8^x&qFMg`a(akk(*TLFuCsXLw$b+ds-S4}T5 z0)1mhaM5)lib*x7@lK)Zh5U1w0LR~Ug{({Yno7>lm3%eaY*8Dnj<;#OYpr&1k)&mm zy%~gVJlU#WU3sCZ%i-dD36w~ezbkYx@O*~Ond*zHT5K~3(DJjHITLXYy_r_s$#ee?$bN>T;vAGo1*&TzQu3;Z`<=COn|$70tjgG5?e8a)u*IHbb z%}z5bmBn?o_%u>H)`p(i9IvtqtWRlneM$?0(FV1m^{wW(zr)LM%L2wO8~eSmvJ+HS`eSmOPTyXNJYeMkE8h=R-r0GN8Y?UAM8uW8 zjH18^X<#$KVQpQ({4j`B=qNX^V>k<7r5!I0Rp5yLP8T-{Yyumj9V`EmeA$Xb;_!~S zDM2cNA0ej_PLeL@xcn~a%5eZw3Ltg@kMZ;dkf5BSa)&&Gm7Nt-o~?R;@kjGaW4_%w zy{TnN^wui%nh|7a86gC-z8jr{AJw2)8H6NPL)fab_X+y1Au|@~f>Bjc&WQiGj)G4C zKO1k-LPmVbQ$&B&eF5=ZEdcRhn0*Sc76J1lnPOFGK%A)oy?A$+p|NFsxX$XWSTIRx zJi#i(OAM?^G5=HtN&y0fdzVUt=$_IU0aa@;2e=74?`&P@cs+mRGFQGlGaQUw`T`IY zR!l85q6VA~d(yO+Nbyk0LVweq$Q^#s!4pX~K745W z;*MO9ZN8Dg2RHcO1|QrvNp{1R8rrA^|fuq zB$H0S@go_Awsay`YmW(GZ!T_AgzfJeCI>@JF~Ii2``5o>zI|rOEg>X5QKRM?rrpwV$;9`XUX&i9gS757A9uS8Q8nXVR+KasVc-aXk$4Y0WKdzHp_bh!;kb&9RAV#X7gKp4+)n_1Kr> zdE(H-v)w=6KNp=(vO+JY`wfxQ1_$Mv(m~lyQty|dQffErjCH!6kRBP9O%%1chHo=P zJ}+nQ(dFg?;6;wXC5x+OZ$m&kFHZQFF@$=Dg;8)p=SLXJX7196 zsI+P5MX~LAR0N?^Bou+PVNvYJQ<2;e`Dvg;uN%s$EG)4SAf@jt|EAT9Y52~h2z8uUHhLWabRPSav;th56oO!W8cAOVlanj^N z!Zk}i)tw)e+eJ@v6?R)|2ETKObF;5qlNq=%MRkcu47KGrmg@=dAZu^ms%YLMO>p(J zc&4dt2{_YqNQ+Xw`Qzfk+^!tzG8J%w=x*17r}YyCL(3Bwp?UE1z1KpQyW17JkT2s& zC6|uhN2$x52ciBDEYLHaR|}l4ABw%7CS@dab<4BOJ(|zq1jI`B+L%#Qs^9#psc~P< z);!B|olTjnqRdml7sC1@O?1NP#-S$VR*n>e2;?% zeDHt|9`J@XZs!3%U~_?Kcn~h*mgVT|GNxhJwUJ|7#*H?ZJGYPEBpqiT3BB(5&YK1j zFFevfvh$P-29m)*a@Piu-A(tX4J2{oFwdhgQ7*MT5fQ>&n={TB2|d>qgvKFkYdesh z?}aK1X#{H@`gXv$Px%2+pz_Cyy5x-}g4sfI?=`KP$yv52OCO+(q$(`+^38jsLvuh1 z?di~W8}*s56MD*D=b z;hkAOzk2uK%)0pf=QHcW-(LL(&RRW4xt?H+Mvv=_R9)zqp2V#iooO3_7Rj*+^u-sO zIl0+-h4f;JD0V2MplfO*!9+6`!27p@MgMb*qXZ=R$uB5nLK7qO|fX&vMhy$ zAC^7OrWkZ*S-&h7NWsrc{fG(wEKOQ&ZQ)^PXl7gMK$#jGHJ#x|V$!j`1y64<%zQ(> z7;f{Tu4Y_b2}_zM0?jx8h4u7d!3wp=P_7tfLR&`^hxIG_P}aE68b}L?ib=xMveSh= z${wDUejibn;;~1XZx`x4pknkr^6WNNGVttyXAeBPp^YKZ{GizYSK=X<4cc}@k4W>D zvW%xQ8#L~myEYr>NxFsEAou{xpX#(@Ms8;|2*<~URqV(P3|50dBkf)+2Rj?@QCkjt zKa71v1%XwSc1&zHQo;=!68qHgXh6AVQxb+g3%$q@k@6zSlp})JR*DB(+1(A6gSTZB z86E*JvILgA&VWQ|%3awEfKy$=2`0a^7jLX0B+Boa7>Iwod->|}#oM>9-n=|$0@yYH z{NMj#lJUAu_KE7K6YzyNuPz4(lOj*!k89uMv2%P5zBF41;i#DJkG{Hj8c zE6wxuL=?ueu3`P@_+x0docfPdhia{J+ogDREf@Ko8RCP`p=y)#8Dyvi8LCq?HpozY zXEIc6i`0Xbg-1raA0T9RTWH4p>*Tp3LvGtNRJQN>jsQ681&$|~P_V#0i)0LgR3Z86 zBzpeas~0bC%@Dt;AeLV3zWg#6IX3c3$A3ocvG07nk~KT0z`!sEhIuaxb7$i{YKF-? zm)W=xx%52FBqI^*Nz~tVY{Ej=IKV9xtat3hPUs1rNXHd!=Au=Azx;wzT;wMFzq}B+BfMwjVwR+G^~sO9 zHOb&ZqmYcwTqCr+6_j2D(dQL)HC14eeBJy?W4SK+Z5iLP`F)X!<(va=jThP2`bn<2 za-RIRGy&%*>1^($1G0I(?(@nETsqCm0QJp^vLH#uhe_bG#Pa(W}IWGfOLvnaM3C+AEHNWM*@i3!2`0j%;Q1F3*-vCIxdnBl+3vY8&Vj@T}Aan}XV+$=3E5$oRPK%h!m4BISA#pVF@Ou)fZssb2~ zcy7HSKfV6-OxKuA3M)nS2((r5MQI$Fm!-M>pS`PLZX4IGe}%JcCrN9`0Ql{ho!0Bk zKIg4B_QX!No$-txNP;#KiPVTv9PjLp>2K*T>%A8sMSW3{r8urveVuF~i697o&YoKKhp06)4WdQ>qEx%xUXF0{m9Ou9Bg?nV2D)yGlNe6I1@#0%i?xR2kZdXu?c zF|`BMtZx-u4kCit>+KcAfE>vb?O4C6OUubQtKo**Fr?D9SJU2T`uFC7tZY<^&P~sl zcIY*ZzUbf!4H&1~*(pD-=5uDfOe;Mg9b>A68a`^cZC-~A&<1XvHv>LYJ=%1SZ;-fN z-)}#jG@7sH1lrLLp#;t}kf>RJH36kH4Ow@{UIcA|seAU~JF^$NU>{l|riHu7H>VpO zK`%UlPIv@;uoJpq&%W&0mp%LP4A_^jNxtB-@q3altz)r)E!gsVVTb$VA1^=nT{##% z#+#BbVTZd{oFfUtMVD<*oxf{eu=ypvCt>y^%u|ps3s&BXCSd|5aFzgPiO_Y!0Oyf$ zC-nlJh}aHd82HqWIZTU}xFS(@1arkwAD+K%5U<#3zlemH3gL`0n_*67gZoW+nW?5< zE-N#2nR`xV&&jlMGSigFP8pe5x@QAEh7ii0kC{Ewo{w3|$Fzn$dp>5*$L#r-oiw)R zWByuvOl$Wy;A7UVve|-<5s#NU{H}bA9^>u!7#@B{KE|8XtKZWxdphPR=$N^M_oCUD zIPjHlZSF*=6G`}kF-JxYb7K*Dfl{gK`kr*SA2S|?G6WFAW8p<^=%=Wg*v`h#e@OSP z9F3z|{BBvH3Y9UG3hyW@Df;kmCT0C1PqW+ckiynhg63T%?pHxILk;7=nPu>q{rC^tk+DI}j zhIj}6=qdC%Bt{8NIegF^N(!ZEhBPyb3p6}5B|p`eBzholP?h0Js*y$=#r&Zf){3B^ zF@<(vFz~aXCP}cy$4urF-I3*SZ%pJ6uJaC@G^bK3-KMHr?G-YaU!P4zN~?To)+!^T z2e`G7bh~WcJ6grE=2h#}}6J-NW;s_z=>KQG>s z_X|$CVXZ2%$#f5EpL)>A(S0%eTwI&T=6EZX#@-Q2V<2iV zQ29Nwr}&n|d#gMw%Cb`fUVPymvha}mha2ccE+K1X-`kBgJ{9HNSa$Emhw1nad^vRJ z#ni#ulhfxq1S=rT`97vB6{lty8!>;xWgJO&`> zc#_AFYXc&bOl}dm;D|mVaPhA&YC+@Rt`OfbZV8yX4_vAP_B!uR6tv8(x)&X_L@_MB z82(gTMRp`T5%^LDGU1ZDi3aPY zO349k%3+j^2;VhizVS9B1R0V{4T4 zRi{Wh8UrJCG9O^g`D=ZSHw#XJm}vS$*6Uup&*vZB{S5*s=-kg&Hy7cKY zjAjRi1>>k9ucI&tJ?%$D57!BFg6i*e;|9mm+5v!$I`Ip~@?o-%AR}~6am$i^!+nb} zT%n;n_T7l%&)!URh^Tt%3&mv303oe{TO23~Zr^?#^oq>rJWTBIaxwyx`rNeAEWPG% zu|-*q=hH!ay(r0xuv)E6^@{5sy4~v^Fuja-3CttKY4utu&4eu)pgQlav4Y-MVdmYa zXXw6|*)*#$M(aJRyqAN4_BNQAL2@RTp1`j4oBRYH)8gzz5nCe$?+LuS#Wo2Oy3Wnx4k54>7$OMfbvKZSh6C*@=3w06`dw~s9e0E* z6#KZNI$)nLdAitRe&xOB*h8V`HnXEJO1bO0%u!L|Nf|}1Z%aGjEV5NByf96JAYh)5 zO4$q+gRgv+c(&ahd*o%D82KY)U{f?g>M5C&S^x`hPcku*DthCUIT2*lb)zQHvM}oa z_eR&TiX5K8NlCn|Hcm1k)zZ4oXF5gc0+ho71VY}ulxrb!xZa65DgYHCn~NZ|@`k$3 zHGIL}6Olb*5xnFgjb@iJfSkbJ9006DxX`ycS1KW+WcvNY^_vEx0y>CpG={y-Wj@if zYF-VVnDQNy&Kyi|Dx$Js(a%bA5Db()EK;-&R1S##hMqP2u#D%G8Jx-P%7!)g{D|x1 z4|U%NchL{J|NB4I&sxw8qAtKkweHygqRYezp(&Ii8|M`fZ}KGi?6v=v4vZw`vdANf zvI-58Cm053NCyw_N+X0a(j%iU8GG^$R@cJ-BeV*EYv-v0-Eo+k>%8{G(pLm;bG^-z zjK;o>aMvd4kQMhiX_`&+&;Y=yUhkka%%lZ`cs=15kCsjU2{rZ%yDu zA;vZCmd?>Kz3z%mIyPM4@qh4S#Gf2gU(}tO-iZ#YF~u+m4aD?qT|1TMa4yZg)9!T4 zpw(Np>ttQ?c1Y@sv67)G3k1~>o_c0D`RsuO|wrNZRWrO0skx~bfP7Zvoh`#C7GF4lF5cfHI+~me(JV{ zTgPpOK7EF!w!f{wA)dg9Ak%29O2QE2qm<5cmf}@8Va}m>{QJlE^e@tb*86*EI-N$l zoMP4Ae>}qjUmd<`CLAJwykyl|qQtQ7F5s`4`A3jy29+ptSdwb~r`7yby3fg^2vZ;2 zHJi<7OmN?qKD&_}hGo+;y2!HnN)P1gxrOwG`q9h!nWp~hRWu3sDxcxq;nl5#jQ3Re zQZzaLP~HelwjTc6sPd&{S*!7$zRt%{#|Wbv8%2kznp6krXR_=Z?Z zH#ZNo!~|$nCHVld#z&WpJ>C}!V3nxZzG+ystiS7@`Te?Q-j&59*2{j)qHeB6hvf+1 z{2{Kq4ol=iH(ms4@Ns6IQxI8{MNW@h8Q*0v&3IehRA0*;`qD41Or_#yUmf=&-iDHg}yC*6PX%FudaE>e6uzke&O6NRFmWZ=5rhBdU1qN@4exYBc*Xb;w~vI~WzJSWHGn_-aF0~$ z1NKPu*&x-0Yx6}z)s%ZMogs(OhJ~OctaR57oWz$QAkiR!iDDs3oLC4EGcWStFRlu0 zrkvE9l`xrus^h$|S$2qBEe%wxZP92e_)SudZisCvZ(`YtZw5tq!ztHVl-bwAp}NKF z`pk=PzD{;s1UlgvMR>4b7ihP|$L587s4i?FfPD4(`dSG8&o}Vj>uXMb{5j%(Ueo^x z*Y@B1+bcZJ?NAMNg$7%TjaH$-IO=uazR7ZWir6#jbOlzN{rRJLxlOU+D#SKV=CQ*` z1DjM9POx7a(Kl;8zCI>>Tu)oG;XAK^te!h*5syoHj7C{<$eGWV(|qfJ#YNBHMkBEN z0M(V<+k9Nf${_xOd#4zV2<*YXezYC#EQO1dyssO;S3HEvho~HbEp^}vcuX8ZSHceC zhyC)F0pfdO_^~cmTM`&~-`-6Y6f5Pvv#$w$6@dMnLj|8dJ6>o%6VZa4M#h5=AA*R6{cWsdB zVXY*9R2M*M*md3Q=+v;oVbW)}Uhi@09;ZGBoVsLnzG$Qx`)R^eB$Wsw1t^q9F`!Zo z$kleeM8r-QJ2DjtuxsjIa@}{lD2SOIMl4F46&sXwj`Vgchgh0LB}7_}0WD!$Q76L9 zGlZ9LdBpfN)G^@rBkMO^W;AK8TbcPvRR1iGtm7)RP0AAVnss&6uihS69|!Qrfr%z!6#9lt zX+o^7b^QaiiOte3Py8K@j>PPKUgY&AI@;lk{m60CFx8~tPj`iiIsbMXsk3xB?+)Hx z0MxtK3A}B~Rf`6MZGn_wH`o!RTpt@Qe(r66!&Wvh`;=-v*UU%jx3y+&T!>))CH1IA z{wdzb>vG)-S%vi`4Qz_`d{pMcdNKEi+g+Ql&q->yCyrQnAOlqb`<*}iGwt7Y$aXp_#%oDFHE8+NZo|_o*Ov{ z%KWv%y-KC5mn5jqH7WOcd-ltuFl|N$17Ig5rHizw)P`VeJX)>dw-P6QP@TRhjjw(} zyY!M;ca1h5PWKh{{pRrGyWF}jP%18#WkWe1(WUw#d*fMci+M~5XY3`*KxGYAONIGw zQFnv}?MntowXYRL%Fpx>jCM8B*{Dl@t#lG_h@TmP+!6>bB|yJnvi!H*A;b@xAVjYl zv>?P_79nm;fu3#N*9IZGE4;db0u8yhR1$kLn7b6rtqXIPHt-0TyS%Lp5bAQRwif0R z!Zuq7wkzgx4J7>7U8Ic$wnW0=5OkeW+eFQLFURb_4Fx^_H7=h_>61N4IGLJbP3zwVlu5s+s zf!d|xv@WRKOuu*@)H?q9#Zl9sR%}@uRb9be!ni(Qk7}PCs{JcT9s5C)dSMWG!V@s# zK^$?IV-*IeD?ON-#IYkU@_k=9%u9qDIowYrVBi>LDDqT0s$Eh754aIwq9v1LsJ$t$ zoLNK3o7ez8{m&=Gxwm8OzM*msVz_a%~mV z%}SH(?*M7Pb!pOzhqPyl#h2ECwBj2Zqqbqw$BM$PZr~BvbZd!O#HP!c*B66LmyXlA z*mN_E+j(s2Zcq+2jZKNF-3ptAe6MjkIbaV=pAj&fUz#r(l_p{8N45jA5;Nx8NyzNj zc17q!k&42IC5|5p&lfz1VDX2x>xeY)80Vh!T^_J@RJyN*!fL3gLZ~wW_nkciBoi_iWz?E4LlJHn??! zx7;!N`P4F*tKAe~QYjM;OevG?Yz#0R8RuF{m-VJvK>JQ2BR;Dk}A!Zd(cPQzHiUt>)Bwt`3VpT!Q- z#dw4+YEd!94Vjb~2UG=jPL4Z3<9>VE{))uZ>)%e$=n_u_;b?V8iAwMVG}9+LDsnV|8X@X>D2$C%mIGqbn`sGh9vI{2iC@FSMT|7owZ#;+ zl2wZ8GC>yrV+^hBnT>rMwsI#21C>_?*Jm7|y#Vb{9W5IIM3)og)d|Wqmeqqn54R6g z7JAUkL!~U$(^~ZRaQg9}I)_Sb&GrSA4FOf&s@hB|SJ~|y%ph4F&^K@yDkH6YEm#HD zKz?7d7rm?MDA7`_ySDu1ra*FY`OWw3UcjwL%kJ(qOL%xl|y zIUe?G)F>GB%Kz}YLD1zL&MM$CpWtpHx5lBn!f*?FGXZq&7JyDLfJz>`N@G9u-Gpxj z=vEEQE}gMt((>;z#TU7P!HA|jr|ffIQ< z#dQl7=!?d6BJiU)uoEv*0f05Yae(WbD6|DkF2H60){H08iCktUe!}cfz;cRG-wU|I zJ#PuF!&~Rb(tloFo?3TBIYK#fxCi5A>R6)|z5TI_?^Iv)Fk1{`VbsVkf4RCiyga#R z#dyDKUn?>m%JMJ8XI0X=r~>rnPbZJq@KF(U6K9Orr;XED(Bp}p+0y3SAF z6z3OLH}I32)AP%#n~RS>oxMA``StC8-&~#^!$KgW*8JJ8@6UgKkH5X_S|>%0QuYen zgP;@Fxw$~BeL|CC)S1V(d^$!CqPrq5;L57Tet!GQ@y9bb<%jdD^ON&4?Ia7&H2tP3 zuXAn5MWb6eGFQ`%ENeMXF}<3))=v#)voWsa=ZxSZ^{pNPXfn-i$3x?*1z*CEix*=x zS_p{CtOqZP-otfX^wFy+nRw>XHB;%FUJ6Zwlg zMfMhaJGg_JZqaFK*gX41ZO^nR5U)D884h2}&7Q8>Ah1*Zb@#pb_WbL@_h_RLdN`Kq z@XSB`m z)A>L4u58Ioq|Lqx(Kl^7N-8oTS?aF3+Y|PTw{exD=Ry%(2_zCO31lr*uK#LYV_t8b zWWFyG5L!S2BwMcG#*3s(as$pe-{yw)sApKyt@nA>!AQQB;b|`WP^rA;mxk@yjF#ri z8e>W5zPf#sLcF!Om9yPy4-XxHF_*93Wi*5_lj&{Je(l@jU5*jJ>?1fomtSr^^c+T6 zuQX(CKNC_Hugiq&o^IUgK!Y#{yH9K6WN@WRg=%R5uy4tPENWM!iS3Axc3dLVPTc;5 zNzk_Y1e!P7@}%wK`>bh_;5wE&V2l|e5W==};n~7s#CKp1d`l3(SX zj_w;ar)Z2QOW2?YQhJABYJ;7gy;(tnB)N|SCUCe{v}q<%Sej$!lr;Iv`68KUZxDix z1lB^T&hqs|c9Ra{A}bS|_Hu{aT-~J|$&yeJreBzgg;d31&)(eLeuB|_Tf$AF7!XG$ zf)aT8DK?ugy*d65!L=5kR<4FGCRC$5E_6|1!zL^{i z%NynvAdnxo$?TOu_Dx^nGRVH$m0~|s-*m}13#eY^MsYAyFY^TX2}3!WE#V+1=bvOt zFfXZlN!nFp*!6bWO9Ze*1O6bJHKY&pt8ev2zG3u64`yi%vJ(1W*`!t7v#J%^i`*%- z+aPy&?Yh7nxPoy@j4MonYxSK*u-)w&t=&x=>U6lhGhm#p0b~1oK5t+yLT;P3!)@1~ zrb`{iBHX1mX4L_du475E(55~GJT5rpArpEK7`D$HVsW>u#6!`3@m5L7YZ`T~Ut^+$ z44~h>yIB{VwMjIW4ilB=`+CEDSA55}BcgD0&(LD=sKMgIbIfilokNyr47jeiFG(8sQ#U(_@$vm7XvHYrcPySs^N*{tSOpovuq+7BsU)?jWs zyQnwU?JjE1ePOG6bn(xg~ERnlzi7J4Uw$dmtmKCaMkUr>ISXbm&?pj z7diEK>EjzLv)c?W-OKBut;TRGcPi~dzEoCye13P(1FM3g8ua_9XM8vOo;9>aWgV26 zxPYR%r8`?~;@W#Q53q3ArbSy?xT=o8UYcw=t!T2mc3qmhZr?Ilor>K#Q8q~5B5hs$ z9CPDI+7acBD4!Ei-a4Ppnkf6kaY9G;LfB9XwlyR{XavF)t`#5~W`xqvwOwX~wn+`w zG7aH|x(9n~htw)7+r44I`VwQsYj}ZR%tV1$c3u27ZaIP)}9R2Jht zk_m9vXyz{`aJL|mPdk_K2r_ed;kwF{HNQvauw(!XQu`o=@Qj8hUvIrOH@v;(7m5jI zkrYqLA52I`FFF1!f_D%PeoHHM&j-KBz>I95ApksJmKc>gMGv(k#As+#35sUAd7`NN z$|jZ>uI51W$XPM~>^O&O-WM*5FLx1FR704_@pEu$~d=v);vD^>k6}WFgxfKxC zHB&m^8iRPVhB~%g#ZqV6a5NRdbez+v5Sv!Geb%|n&ks}~N)reDGAhJDu5H!{9qo>w ziJV%6uv}7}Tjs#_rRerx6=U-?dXT5Hcxz~ z26Sq`IjI3#=kr;s0fBD&y62ik5QIKufsaWuEWth9H;CzZCbLaPX8tlA-_`}yVQUQA z7p@&p*WXyG4K<+JjddBrBN~Xcto-^NnB$7xVFNhyi;V=hyQ2M8JU1iW%5PLUaHfZ>09xYLS(h3HAFq6+Um;n%(ERJ)N=DY*Q`3!uH&-8>l!Xozc^jp>Ni z{}y?}j?KHxX1sf|S##c9w`j$&yk-w#y6&m1|HaYlbyYoefZI;%e~nrbC*s`|6r!A~ z*5cjIh5jJLwOrCsH0^i9#3(fNCK#Pw{6>y88ZteI=*Fo*ff zrI>ns;}K!P(G&(3HZy&T=+vf8$j#6Pj!S{PT9g8*4e3T`(Tcg|7VMQNdoFsI zA9>abXF_cFXk!&^8M~NlCoSCL?7gh&H}(CF;+%OZ3-+3Ib>*9l98rZ|UQ$g}|LX-} zifk?RpRmlIN}+g{XLh;${QCO+KYzXc^!meJH+NbBoU`Q1e_r2RtjBC-sdesfVEj3No!JSE@M**jgd>o%PBNR3-nCIg39>P7){XW z*V=RhCx1o7F`9mL|}G z?5aYOGtrW%P}IMI*1muJ*V`}eYZ#PCi`0WhW3a1oh-YBx-AOqsqa)p8mfI%lC1AD; z&wFDv&7(y}*2<}}^{79P{>X;)bE?Qz4RWf;b`66fAHRNcdf&}&lb$u1)OI*!#40Ze zb3i_mss%oIJ`;KIHb~j%vt||^#Mnk_q)Z&vA>|G!pD$A0KA_JUDLXb}c3}FR&H)|^ z$73$H0|UM@nQg!)u*_j-GD3CNv_jK^^U4{w9V@i3gh-{0r_$1ckTcJ9STt7@3?->; zLAnK2BIcW7Zoy?SQwbu#0KFDh;gR^iG+&^v(vrZtWf%cuesPD%Jg)CvDj53el^WKo zSDOP%Q&wZS8XgZbc&NIO7Z}7V??cRDqI&)VdY0)>vP2}=pe}M-Rqo=b@bHB;;rE#T zFo*i+EeVs%GLuNlOo>ef9(d!Rkh3J6-3371L`w&BL=5|^jWb)`lIL!m`N2rJA~bWa zac0X!^T2+(7gxN5EV?k;NWz|JnpcjQ!t zHhJUJXPUBA1Ewk49W@lS>c;=chP(1~s`dLi-W=U>Q+VwdS=}zZ|9_NMZ0UVlp;@^8 z>|5{K$a&~l-zSs0ngym>FMVe1$pgFhzB$Y~S-orr=q6Qn&0gKaVx*OBA}`)fH*xKz zx{1?THrWh*?^Kg65A3-pCR=CoSqmn5V7uJqu*?>xlyG5iFC?4`-!gq8G_BAMeb);p zF}WKMDyU&m*xexXeG|6q0Kw#XU28~-V5FY0E6HRla#m^}H58%%&K;{40dW0@x3fJM_G-eZ;)G zaUf>nC;S!gfH@vSp#&L z1=K_xjtEO8&!b_i&eLNuyO+Cjy}mMXUhsrZ9_OWJK9%~^LcEYI;9yOYIDqAN0oa)tLCTst6lE3q#~q%A#>73p#-unZdCTy|K-Bwgdx=)C2ka1EMYgWhQ` z9!JqQP0lu*iH9gz&Wk&XsgW1J=b&R?WG}Ve&UD79HYm?XR_O!>RXob@dl;54Fh84| z)m*G0&6WQySN%alApNZp&Ui=JuXC~veK!=k}FU= zb?P}1$t=)V5S;sqbjmAXbk*zTaYlJlZd|{gmOxZN`EbW>oC!Fsqa>JT;rh6+BHNbC z$pH`I^_SZ>ck1M=j-7nCpo%S{0n$g-@7d!K9}k6RlsY%CkHBxDAucI;F5vzq(0X!# z_q&=KD#WTLB1{C&bWy<0>dxR{9%I2txK)Z7{8U96RF&Z`RTdGq|7tazfBXFU=FLBU ze*Ey^^`EyW|K{Jkzy7cE;~RC(y?N#|FU#jH!`*Q|^G59$0iBuzL) zO_We<*5%}TJ~{dJ2!H!d$q%akRB=f5%6__Iwunm5UAL8Jh$FA785%u8ZV9;}?25U4 zVmGTDW%n6vn}nXYuCYG*PBrX&tztPezr$Y z89Up2ARU0Ip-Cewj_sHGk zD!i&)Z?aSbJQQ4RJ>K_XL~PLjTFPb(BP&@reC*90nAw}ozJ9L>O)W|sR*Eh6L({4i zI(4~8dF{HewpebG^&PhvtabW^)z(1}h1w3+cDVKzEfl|fe4jP+wTbI{7HoLvQSQ^w za(z8;2z3bTKCxkcOjr1@)uEw>%yb+$BP<96(V6FXK~M>Ob0P3RH$th&tz@=ZIQZy= zH_-iU%U|%t&C6VylSxqks8&?yP}1Na_L9X&%dVY+*I&@r@cGo?D5|h!K7GogQgWk% z{Q6M29>h(&_O_-0M-j$5h@~JMZ)KfTo@3IBPe#*LIPqzjR=ief^&ls{p;$=Izfk({ z;Ve=aJw0dholH==_2vF}SPr(zCl6il)}8WTJtxt3Jalp)e^=gXa)$8lYB#+>T<)i* zmAmO3*H>%@1GGp5q&qeP#Mj_adEt-o1>5F@?~dUMrdH!DhH|v}F3p_eeu&{>3qS28 ziP)k6x0KBqa!YGy4|~iCC%w>_OzUz>lQLF1$Nk*0YK7Wy%TuTPkt1)zOszg~8xm8? zXzPT63T{VCJ7Ri{2AA!#`K(!|DMC&S%chnCyXgC{>}XXn+#t|hVi8Bj+K(g@o^A$u zNQCRa7MQ-rsLKq8RI*O>=Oj=De23Jr$Hpk zX%YfwLv2tH2Me`xkK z#Ya}Syx8>%_3@lPX?Lk4e)sYspHCjpr&eJQ!)~lLP^~47K4q{ey;5`0UgW*b({2@# z$tfY1{i!)ztk&Z~jqP~MfKmEO7=eBk*gq(dWoHD+j6kFm#~q5)x86B>Avd;YfYfEP z2L45sJhc%=Ub`JsX3hMy-M((OhRP;&JE+`2<+Fs!TW9lGLuEsF2I5{$ z0v@`dX%QCcw(aX~Kz+;gd;?aUa{|9`I5k~31%dDl1_;|V1J66mK=bDcCu5bZ6d_C5 zH?K36$*5@(a%rr|QFJ9#{(CJgLv9S=+Fd^uiR)oz`HqTI>ydLV#=>=B_ z)}_rr4O`0HsR*vg(PN)0xG7zRl-iEcI`%7qo(%a%p&!!>Xug=iYb0Jb9UU_@rLK24 za8Jl>edKjSrS<%hMwZ~W%?IIrAO@uBq zna+Q1rt{In@_RF%jd}*1l+K_m)42g`r}V0O%P?2pH9scNdDYo$SBCkZLdq32cn(N& zZuaeF3W!1bthEVj>-OmskWK+PD+Ofpd_HRhgc%`sbjM?ySk$sC5(Xg+c|bf^dz}el z2%GtgG3vP%H++Ya&@kW(7=a_0Sr(_XT}C;dej1Ro8LTv!&M(N0nObP94D=}mh@h|lcHOD9{Bo&@$6Ta|AS?CCQ zs`a%u$s@`W7iy9)#{ody1qSevg`y| z!RfUAw7jO$fabD{UFwCFjs`kUG{NW5_^GeGjZv0@_uz8OXL-is)i6}fXgHq_7!7nU zp3Xhf@V>HjWkSy8=LZTon_v8TLe4?biG9LYk0Xrc7ZGyGDM}~gbV5!imEn)_- zb-QbqI$<9oA{iA?69h0WU%pNuD&X2nDqy8DWaCT@t^<}1AC-_;* zOrg$vkLX6oecPh}?61cR$_dv)-=ra7Ky5;c6Ja`p>C`b8@vSfnbVqkXwt;Il9c}*e z%iBMT>V*;{GJ#2^y?#u_;mysvgLI_%eKb`vO0iEo2Vs^bL#l^G4L|2RpfF8j z?JcA6A`2f(2P88)E|PJOea^9)`#5=wFFhV;el(RSO=jpG^B^wduv9LXDTjH%vPJk* z;+WE9HSo2;a+!H#v7E(o?ErK@i@)Q4T&Q|g(J)SCDy;8mZJuf6swy{{cOU<*;X`wZ z9F6InaHWwFjiuBr`$uaZpEpuszuUMUwRN|V(|KRN+swMLH$gY+n@7?<@Hr!V8Fwe2 zF_?j96*i2~cjo24FUOZ;C+9f0^-ctSXzSexw-1jWG%t1IlG>N0knS+?X2+Xh50z9c zYBSKZSwr{p$C>H(hL1zLH?@sYcDI{1P?PAkUD{|LXs=$OY)vr$hEJ!(!2^PZk7O4* z0DzvZ>!s+uW;dm3!+bf#N%t`YmRf~-@AAzpB_`Q@*!MLmpLltr@?7%!h(fy7wTOa= z1#+l;t26@ZO|?MU+^F8ZM+b}!jCFBgN(q;x+td9m_p-ZHo@F@38ts_wc)>_sTQDSJ)Hp% zKxCeTGI!tto)(AXprC?GlU{QCXAZqOYNNWR3YmyAcEue9KNw{w*Bf{=cu=X!i{ati-B zJwN&Q_Wk+4uZmFW(I9#CN>>o5Wx#W{Z}x389l*Sh*{fGaiWG7~UVdDxI4!s3r)G;( z(mCbgW(xv4Mr~qw^}Y-Rd`)#X6xwFh2mY`JKgKvwkEYdc8|{nAVC-YXR=2V*oW0u@ zXVtOQ^QPJC(Yn|YqqEnh_1a{wH#$z+cEdMA{r25dBH`^Uh7B)?2I#L_w6++EW*set z+uI*Ez2L|ATaU47@{xrOa01Y&BUOPO(Dy`7BY=8pNVl?!qDTB(+D$Ea$anq{w zoi~{u_1nFb-M~y6kS^E_yIC>wZYs@>CVXEkrWL-2HdfDMpNWb1-m?0h+Y;ZqZ!G7H zY4x2Q;{XgWsmJ*N;U5tG?~Cv^9N}jT@$HZYrVx>oOcL&h$f1ER14;$l7|-TWAf*?| zh}zT%nFHrR1|EE1Spl~_r(PlRL~{q`3I<>P2}oKIkSw{w7vcf$3?J8!gtZtSyGDX+ zfal8bKN5+!Rs%o>i;0}d%dbX7E_M{CT;Sy^MjRyL6mu)Xa%goe*6|ih;5d8ubA8?; zi3zB2KFa5mhL~0gkD^=`&#Ej3@(cl)O2?;;GA*`$ZCQ2-i_QT!}d zU5&FeoCXv8`ZdDn*Lf~_7PG0>1y-vmbZ*yG2I@MBdN+(-_iQ(-+{HRP?wf>2I|?G- z74eVgozf2m2F z1O7eW-`^Pjt{>rNjek8S;?fL>4bavKT;|(eNQ7lamLxQyK5@MOF0`VEh8_=Xk69t5 z#33d#9p={yL#>orEtgnb4^v+Zm6&Hy+N3L*R0Yy#I-JD4$xS8&dZEwW9$#DU9V-Dgqb6({gEgLki{iP5Xj zWk-6AD5O(p17#8*yEMjtA7UR>-G_N<=wGp+`K$rK!}wW2Iio4Q%NZ-A{Wi`8ya$jY zygnajMhQNXXDwuxrb(=v{BWsC)CpCOT1BWVhr=%Pg!ED|mSFsp0D|^}*BN)7HC|u& z;^Fuf&#IZOw;+mnARxb0#t-eg4-Vw{YZHLHv)L!#3dpa$NSXmOHt7PqRlAPB``Zn@ z=~=-w@42p5$=tXF^sQTOWB$0wtsQdLv2~@*um$W^Q*Q;k0Xzfjb_=gFWqr=O!fuD{ z#$f>SXRGBN2iSdp-M<&?UO&Rm8g}~;w}@nLN2MJJZp+A&j0;=(+%ma{g2;*}Bk+$Y zgs>gQi9Et7r$NL`%dKa6e7EMTogwe6bQHJ7($J{q3-krg0kn1}%UI#W%aaSt?m&n0 zQ6UbgYWp<{x5^>^if-gwv4F4gdTTw$5&YD}cbOnEhWG4vt{{p1X#Vbeki3GYKRTOp zcmTaBRY(iCi)7%)G9D`)f;-I|AVS3d0_*#O^g40ZbkYR7RQ zvtCNH=ihZl3mTPr%t0cIVHzlBZ8lAk62z-j?G2y0kAhEEKcC^#)i0hdK0V*YnQ8Bx z5&UciVIA6c9u1#XdI`73r>l?8EpVpQf#0}n*AbuI1VPsO!K|!Df4Y@f1y%UeHNEP@ z-fi${%_co{d}?*zlwHQBmf6i8OZ(j0ky4h}+;k5B^}s3nARx5^r|gCU`mEunWpf56 z(3Ff&H*&cjhLpIb@41rOp=smSjtRh%Qn(SJNtpB^7DQ3t`@T)8%J>#@9FCVjUWq>A z#P|sBMU`f7d3k^8tQAanggfy$^914yEw|(_~*3d9t-&buPDq-p|sT zx;6|3^3?>Eap+8iCm8^o#45m{1h{zv02FrZJ94%n)oY+qHGGMlSxg#$y_FN~N)<*v zRWIylIvgZHb~m1+*O?gK0PbCMKKG5|d7Ymjf5FXE?%e9tmvTKyBE8V&Q4G2xotuDM zv^VgUgpOvViHqVu60@U=1&yW52Fa}$#-X0gp3t&q)#(0qE)Q&GSFHrUZSxBD8p?0P zoA%!DW*g$s^#@%8;47MR;7`=;wgif6xvNq*B(UKn#4!v6&m$rQynwi9o51Q?0G&D~ zur};iBkpsp8V0&%7C1e4TioaMO#Yd;ZwLT5ukUtqO!B_HV;CN$e^66A;Jzn~`~J`5 z6fHsmNdUo7xQE1q2cu^@`0nsbO1N)@mawJgMuL&Rv|K7ek4oQ;C<_^*l-1(C8HvM} zT=ql+(5M$>5|tGdXToa>HbvlvPKaD8);Beo<$5ukqt5x%S3^IDz=oLViiG&nwUsJXI`}@Bj*+QN zy_NR_u;31L2UyK=gHI1fZADV>NI0sNGkG%}>L@5i8WqLraFmCXEKy{FAs6^z6xrPM zL%~9LdsT*dE0B~&xVeicb?u(rJCf?8%Cvx_EVIv8H(hF{Z}Od0nM}(z4^Zj=rJgF3 z+HgRhHI(ur8}1=DLwufE+>YRudNkzH3#kmLCAcJTf8kD>((yw0+w_qNi~3>U+n&FL z3+-YaG9AY{##y-03Rl%MS&WQskE2vncg9zB@&5e$^zFr$KhEBt{O9zqD}+R)j1W4u zhG}x0$Dy26{3yp#Q6e+IA6XKLEL4uA*M(`$4%1SbcQaDh?czthB?`RRd!LLyiPxX1!yG)XlVX3aYP&3pw z{!sfn%h4>m)_ld9J{Z2pWx4#Yx3u6nrEqbJu(YW19x2d?9z&d90Z;Er;VNGmnf#{G zOr8eQ@4-X&Ajoq4IogO2Rg*3XC#qdnWXUYA{q?*b{UKD?_tX*8I9+ukj05aw@L=AlUD04bj?q+CCs&l*xjrq2jGNF54> zx+@~2T>`sR@_-R3eHxj8M}_nQ%MBb6`WUw5g!nXsb}|&(dFS3Ef*NVOGUr)W!Pl9_ zXMsE~rxBc4;|zXDhM!Im=G|#5)C@0Sym3A>3f61Hlrm9>sRq=c^K5D8L9$_Njg<=L znvR=ZUCK%CBu&4^^2)fu+V%{u%5;}kZ_|;8lPeWP&0>E#k%s&=hGAkXDKB+7;asFy zd>tp6+ex8Zn07qL7qe-B&$MD|EZ|NN+}|*rW@(RqZk$?Pl2dNNv({mD6jCQ@ zi*X&xb~~pnHf-6wV_Y@(ZW!04-7qc+6YT0X^%y9_&xHdnsPt+vu>N-;$!?^R?26<% zguqxtqTnBT7PYsv8S9D?s}%(@DDhId1PfaJe4%Ov$GN&Zxqw~0LO6AWB{TRxniOd| zfhXDDg;4y0fArng|D68y=a=)7&+k8;Ul~~Zf)u4kh$Tk?f!9!TBo&3?n8*lkhisb9 zy`6nS(URUSJ~E9ofVmg!sG@X>7JgF9YAp9-kWB8zMP6Z;!UVDCywH)Kmz!&+th!PR zktpd-)tG09Eiv^{HODRygX%Rd6qsM>3UgxtGix_!Nz*!tb2VfEXp2o4Bs2Eaxmlr& z8Q73T`vR7w0Jo|4Zv`mf7h1BI90q+Vu-A>8;{k~ zsFoj&HmM?XFH&0VN$bG&(pxd?zel>=SSOoDu)q=R2Bu+tFt$r&1Q9WSTn1S z8aDeT>TX-3Yl6DYF0KhRc3aQHvO>D&b#hFwzD;(`jJHhQkQq-qcqBG-+1V9A_w9q= zzD;~49I)+aK&W{LvptP4+lI6FtX&MI75JfPo31Hshq%6F`-B9(G;NQ_$aDNKv;$__ zkt2j7ETo+CTwe+*JRZ58+``2$^CE2GoKtqTX3ofi8#$6gz{3XYMUilh-hkJaCl}lJ z9j0Kd8*y@*ewT&D$g~KFEq9IOfA9t_%-KP5)$4(EJV|@-LlM*AQL=-c^qcxX~X!t93+c=6U-?4 zsuSGMhw}CE-7y>lWyvqOSI$5F_Z+XiRIxL-ceyMgXNnY0?QaHewRj{KN z%F52(p8k3Kbo}jOA`&%|q!q8YC%zwh6{)aZr`{hHIXr7+3eZjQBf1J_8#5RI#mr@o2R-}hk6p#t}8e8$fG?ka&CGyAFsX7n+zV$ zVOFJ;RB!M!ul8Xqp4yw-X!0=Ra@nDXMGd}-%|rWEM>QM{z>Y?S)9QcaU3o}5!uu? zgUEtbHm{ewX-YgS#BYk!w4oG5f?p;J1iD&~8%*;_I?|lpI@hm0MEgZ`Q>xgMVa}qL zE9~aYENL)ChU+X>#E4onCMmPsRQj7Xb}&ear5@#{s)%@&Gl%*y%hHl6>+O{k`CU;* z{L1hVBA1~>Wesec4@^S`I#&kNY>8+W;8R0lD0RNMI7MY?s)`ic*4!9LkxYvCt1Q;2 z@OsG=uKFJ&#Q=Td3~vNV_UsL|+jQ;SuRbO<2}X^uy+Yll3Z3J_VXq}DkBQ1L$M4-P zs9f*HlbFiyTH4c!?2*2kM#jS?n^K+l@@j5Xcp{x%>y$+3 zR`s)CB`|WHV(Mg3Zw;@2Jvyj&@kBSI>OD0F^%Kd|+m|fOz8%-C)F$^QlJk(6dUc6F zhfKY0UHrdh>fu>x9STv6x>Sg{_2$hXQ}5Yi>e<$>o1Xp44to5WSBkn;1+Ksv^(yad zec-C`Y;F;^awxZUj9b+mf&0$XQ)9Qah?k>Qv>WxBP5PYd%#%S`gLuKgCO+824`UOr z9mQvD6T@!0GL%6O1`!y(()Xpb9VTTUY@e9ivl)ENOw%_*W<`$c5ib;uO^EM@Zi7uc zr>j*AUGT2>dx@T_FgFX680Ds}RnD2pWvaD<%TzIKwIZKFIs!8_&VuO(+0x*-T6B&! zs*=1~99IXZ3hk@`7>mYvpRQ zpCUKnJfFhe`FA+e#Y#;jyE{nK{m^NBO$(aE_KKRxa*V+W=bK*M>`oZvZP=T`fx0y; z@%yd~Y>K(9e!iu{p;CSKw{bXZm7B)zF;ng_Re85`IB<_tYj|zhen&aq4X@FyTnUwC zN3|=Vy~Cn9xvaWL<$hK-X<1nbO`J*tV0&*utF>+JqMAJBz8n&8R@yrxuu%tx1UB2J zL!$1Wx9-cc+8O@DT(JDr?|vuCzxJ13WBI#o0Kgr#)$*@71NUzEkQ+=F}L`*Qh-wQBg+=b=s$ly5=e z^Kq8`S{19tbj!&~1>mO2ytzqR+SrBM3}#>!)-#gE%t?X5EJi!tzXLlqxsBmfgc14P ztpLN=wzi~eWn6zpPMBZjeh-NPSO#$pj5rUDlvNEi5Z z@3?T&sHH6A>?RYiaIw2Q9U_$_?r}M%J;wBFDlZ<|#9kHg+0w+W)c$F0Vz=eC+*jJ` zRz|IN-!c7G!s7Q`jJ7eRUr8(RU?z5rwNP!AwlcAwk&OwP)!xR$MjdQSZ1y~DOm*-d z#m4-W(Wplmr@f!{sC8K+r7-c1HfGZycpw|I=DzJ_W8OQ#EzW!w3zhYW)y+hOcMIFq zL?tG(4+-1zYYsN*Bl5_spT%cwq}rw(cu{Buj9M-OTNEAyeh|P7WRY)1#382ZFw=7) zxSwG_NJJ>}B>;?2z=z8`;&UT)7MHHlQ(aE7MlDiRXP6pqWrF5f8Yu--ctkd2YftO? zEt0qATB}7|dMRc)Pp;Pb355Ww7G3Rya*T#q65N61C$+@HoX__2r_}BlF|egCzn)$lE!S6;j5k*}v9DNI`4#DECof*Yl}cAEiW9VD4Ora>{+twCGKCec z>PQzF7mBUW9OKHFuG>_#pa}++XM(ObaPsF?x0p=iXsiSf42_Fb>E#HY{3^PPmT3k( z;D$^C46&ohTg0JDa$MZ|&6+^9@7)V{K_PEA^{c!sB{g)3d!o<5M$nMQpota;& z4IaIyva~L1D;d4MyJze2Y*xv*7EW%gtE7)3f4lam-_p`i4ck+ls8$`QPE@;&1&lwx z{cwA~=#Np4k4CLCMj7GjEJZD7M(Q^B-f2eE;JbigyU)7CZ4gfHENn)I%MPG;e$4?C zKO!hzKa0;A6i1X(!3D99IK+Y*X3LPt(6fAp`7WFs8U?}s*t@djwvjCRD~Nt6TOm@J z05XB}o61!^#qCN<=XY-GIiNaOSyg2%i(dSP3ZJ3}Y-$V3w&377rl`#~oHP)41_D@%T$)j~`ju|e|cGiq#HetvBb=h>O**4f#1#}GH-2NotV zxXqAYnvM(`7$j@=K@=A;HUA7XYn75rA0+G4d42+w`zRXddu~mFJ5(UdQ9Zgl!XPuj z5PjZKa?%1%x^YyH5=lpQuJa|N9XcUgebGlQJMNCp{mA8!L2*SGW$ls6j*sPuLGiI( zjU}LZ=T*_<%%pQmJodcjuo>KcWORJA<|z)Y4w~`(RUEVed#fm4k%u}y(>KoHMx`#* z!l=~cP8v2^b>lzraa_5e>EU&qZj7S*fcxNhR^pZ3|BvO?T6*7B&=W$=zx2Kg{jWX# zZ8ABOo`4A~e`eJvvDV%<&CVRFr>y}+QgzqVQY4(wqbL&H_;D18@Y+%&{?QD{cA$Dk zkgN-IO017Yj_hp17tM_@>M9;fAti$y$ffjL68lO~;&ILdjU7g%69|-GjWE@v@VqE; zT$=_#_jC~lJN*qpLZP->S{%pM?5Kw zc1@WT{r7d|yZQshv7!hS2C^Cv*6nas7)>$I_(uq51zaB)f96Hs`iRQ6nD2f39j^k& zzrc;C3>OtF2g!Py;by^P8VhUFvG}a8TxXga!%U-R*(#l#W5;#2dCfe56=F8W2)4Rf zjBXRNpYEsgJH0xWn=_-wrBi<{O80!q>Y0gnrAxrZnoW}krsFyG>*;){0SsdZ_2p-~I>38-+F=@}=^U?n7p|6tHtf6&`?K}xemEMZnrXAS z`Z}7f7R8lCapEPIZcs58U$3p+UP0lM2Gn~bODlq%DsE-C9=atJ%BJa2EtEc24~&HI zy0=OCn`s{QPkPop32+yq=$e9wOi#N_2d4RsD{ji+DA9>lM@B5pOqQO3;;u8#k&)J6 zhWjNB;1OqryyifQ*r4a6!UayYr`yte>*SBR(Dq&nUBRU>(7f8QtQPqCWzz?-WW;&hdUX zV?#1{YW(%%X_n45dmv^>UT`yy;n{NzPq<=vI8UDh1%q;(#^>F_F`>)r({p;<= z4}T#|4u)?Hv3$E^FIB`5f!-IB)p$9wE?anJE-h!v6rxm z+K`@Dtdq)nIZ}Bw9ADiod8A}Z6`Q1%;Um6#L|6e4;wXL)dwwWA==3PPq4W)9ZHz~(Y`@F zo>@@_*lCvTiT} z0Bv^csmZkav$oew1-DAm7%6k1zrOrwv8G_g8`=RI(t@XS=|4vKt$~-)fmY?oLaQ;2 z&(%}=`IH%A+Yh7$@EMACjL9(;bgK4f5IDhA$fUM2>VA_X&YDBz7FaLNJ#&fmA$* z;RC^7zGbMG7u&vyV!%O^#txTC_=E>eCGcq?{j&x>X#$)L@KXbCDpTKV)b(XG(y@Nn zNZw?Ie~|hgB>4f|DuI{Q{QGPZKUnd6I$0mr6~4e@&%X68HqnO~@eGpOQyuUOp1>dq z(?UV8Zr_&HD+GP--d}z?x31scz@GrLK7IV;yxvmp$x~o1vjbG^R*p#|%{g-#V~OK3 zqf|Pn5S|U7PLK*x|MUrfz6f?QV6XM?PRak%9opmgtUL$u|A#aDj~xBDn>n$OYc=bO z2V?RNcl2g`=R^ST&B1vbOR2r4ICAIlUJD1YL<bC%&M;srLVpK|rkRr+-B;uKrQPs!Agz`QWEp1Tl9P35GZPp#5tgq>8(5E>@+1-XO+Q6j5bp;QUWSo&mc*2WGq)6<< z)KP92I+xSr2FPF*2G*LPLyGDUqNqDBflpG+=-92jnUkiZusv@cDh#Fkxv!u;@F zsI)B$hGj7$K&DYsgrvqT#25}HM?z{KAh6Z}6W_k4VI8SE#}LepLdL{G*aQ|Ct>Yq= z^ObsoMQL9TJPr6*&9VTHT=Zvc<)ow2-CBPNJHcAWp_*U_i`_TP7P_1$6>T8xLE`j_ z27B`V!g_1U8L0-(2`q!fv(St;e0(G=caF`GXj`x{}4wzPlf9nNlA7`JK50=Ero1N zLHW)*rxsmfi58$-7i-}l#JS+k5dxJ}1AOSC8Qu1AsF=0$trmUa9gT`zTXd*6|LIWi z6QSarZTO;5vEYny%6(5M727^#)Q>qQo~=UoU%)KmvQi;qDisd{;RP6(6??IaeLIlN zj$PiaAu(pJO2M!ubMyRN89ACNe(NKc957d+;(uesTFuMuuGi_QVwo4LtvzfRU^H1v>Z0|fB*Bpi?kTPvbj+sNB@sZ#Hg%U zKx7NG93+FkZ8SajoAC)qy@C+e=?AH_u2(VKSJoBW?Uo!Wd6!1PsRTu9jBk3dT$**# z8cb8XfeS+AW;U{xQr`oFmmB$e7IHe%)kUdy`ec-m#d9^*H1TpcnnyhtF6^vmI>Ah{ zCq<7H;Yr6ziKEYDT{Z?;-!gs-8PAN z-FAt2-A-1#lNEnjS@Ge7%idhFVb8HAr6VYl6?eeeDQ&ejlX3N3^Ej&FReSTeOva6J z5mzLQw@*iQtP6Bx$K#S6+gtHPlO3VwgfftJ;BX>j%p6Yz zHn(F!NXP^WZO2hUF%KV5E{kEm!Ysi*Sfn_mA}k?0b~6#@!%u@}wgZbMvpEJ?Sd)VT z=<{@B`V=aSL9q&2IvV0_M!|!Dp1N`A(4(x;cyv3+X#}HyYYl_Q3RRY0P16e))HBqr z4TG;3v@soy!V#9yt#8B%-6=I&6nmo&#fou4qhvFZM~4*Qso9$MSO?;3s>6(N6c-eH zC)Olb%3&7ffv#qK>$mAWG7;xykTAvppxPw{=3snPN|sD5IUeaK8#TvgqtVg6NA-cR zikH?D<5n`!fGlTon!;JPY3QDXP7jy5k)^$X%BPkJ7Nha^zV$9a1`1wzt8p;T<%QSX zFapi6Kfhw+&Yk-H++}_1(!rH+Hrt;!co=*1b2w)Mh1zg7P^{x@I?m=vIh%?1ZPFXYO!V&g{LdDg4Q-hUuJ*2ZEY7BU z57Z}u^T-kLeOUUqwoARJoA5<^=+=W&4mae#XZ;$l1R^`e#D3?r67(_uEQm# zwj@xh(tYN?{&@GcNK_c^A>)#?#`OJk9A95wHKL3bccYnMOp0~lK8Q2*4ihA3+Ff%r zTaL>Wftm}c1UY0E~n!t`#ivE?vm+!auEiRB}X%@G%`o0m#^wvcgsk$ z%mNq}7=I&t90jPfvhMgsX9Fz=vRuuRh4t|t=Oz!-=r)M-V3&ymfo*!-8|OMy&%qo?Ol|jw`M%eo;O2{ z)o4l_Y;2~*TKbRQ&t2KOy}$K(GtVhCrKguFtV4T>y_`b6UOo7fKcup3>u{FuO^h(P#K@<=JT$g{)Prd|}*o-zNtLU9P| zBdk`8af*dZG3ZzS7yQF|mn_w7;i5|OKu1evRTPyjW>9!KpP)M36t&=`b^F(7W<|(E z&*t#XM-V=ZwR+zY9uz%5O4BGyKy9)BqY#HSR1m%ADN!%qzWo*c`t`%xkH5V8@E@Pk z1Jd(Ba&~4y0Q4~65!)wy2dxCKB-H%u>|Dz-?s2Rir6ZnZ({gY08g)vVY;gI2z+};r zm|cA;n*iTP?QMcX-Qs09?!nDCO7x>?``cPmqV$OMsZLBAnG)W~O^K`W6VnfMy*Z&F z(GZTa3u0docCnWZJ+vCWAJrdTO)2PYW*qE!Nz|ZxQ{rIbAT8F?IQaVY%djWE%>L{# zR;~$Br~tc={xO|QM#~G2$G#JjD6}1b0?KA?BwV6oX=NprhG3l7rHpu;rBOZIjZ6ea z900XoA{=M1tg9)tH0q#yI+%l?Je09}gxyerP~Nut!aoqo`)_RT4YB*)k?cMLOe#3< zz=`k-iclhTjOR0S$at*?{X&ATSg*I*$gD`mygR z>e4v$V^)Ud)4*7x-nY<*_xkSunzb&-2FYDu`G2!Q977US!g;J3)u;i9YdU`tB*Cq2 z04gYYVruSQw~E5&nB%dajF+}JNM=)Xj*POV^|csto62ru@8Q?oeoqv7kd79U#adJl z{X*dxv@n6L+RYMPOxPc2_5Hh>_c^pTVk{E?S*L>L&QZ#Db>5HLpKn6*qgnn2vMP^< z*>?!{TD=nYVd(!;WoCL5)J`d)_9IF3eb3(_;#Koy4-sMjz;}d6#TL4%*?bzUQmT^dU#Ni3<`QcT@Sk}SFaxEn&Jl{T}lBUr=+zb`hZ+osk}IShaL@eT|&JM>gGQk)P2@a zcXzkGXs9a!6$Ka$MQyGkSO^}&j*ui0DuxH2ub3nrr?$(9j8qVakhsisqS*FaJM{cY zsJj&wwHXd|JD!HYSm(n`!;nn$k&YIctj5bxZ#kT+0J-I>UoJmgTX}#`J+mE65nWc- zV!gr-OcogE#cPAQ(?`PjAkp2)QjuoCJkU49%%;vX9&41qiwj<}M!m(1!h{H!F=B$6 zH0RD-0XkRK44}do13#ndu)v1P=g0jxv&^Hd4O=xJv?)}Z>A(IS9HJ_>SIJM`rG z+j)l5G@a2Z8ENVsF4dkkk*?8X=gC6XunN;5GgLewus1h8gH$yH{tdXe&$%Z)I4Z_uyxlDLfC+l0b%K{nD_{y{UBnYqz){7D5yt0U${OjhV60Tc%gKH z(1}DWBabLmmvQE|9SSxF+4GG4Js37ap<0l{E9l{ z-bh|+fA4=GIlR!4+uI`ACMDtoZuQ_!B?yAyl{#A|VZ?fjSoUI&oWX-0DdYt_dCsy# zo++|Lh!E-r7~AYDJ|apjr4<{a)SZWMJ=(+~ZBVK%*Ak_AU&O2@ zzxngtd}x0;kid04kJ8eqY5;AkCh3_&Tix|zpsm-Zt$?lDclpuOF|#{`@DAAiFu-p8yb#hzz#Mq=tI$(ZEa<+kqNaqW+UW(e2N3D7yW{^M#@xnoyL^$>q1Nj!0PJ z_Pr;AqNUtlb11s~_-p_v?G|FfS-F-_bSUM#_l4Q>o_p_?x&@R$QJ;u%C)_4bv|^H; zI~28B2)J%SQJb`5S=~MtN9wmyhZDcUqWMoJ;QDj|u6y?4i$*l?B;IMSVF@FZS$U=woY z*=>>mAV&<&8!JGTL%^CaYj-G+in^*&`&xtw`Bpsjhq+ZtLy!j6Vx`~B@oGFsHBL<5} zcNBUurvsWPH6J8jgYhUby*Uvu7IsCJ+}2Th^-`v#IQLM;fRmoZ*FsC@WYF>umCxM= zT@AKNi?k3cH02s%!W}f3;lT05K8%vdeN^X&?` zw|dDn)A*qfPxJ`Cq5c~RSWWc(c61}}J4c?QL-)IcgdN0tE)ehEEF&Rz160IiDu}4- z!5Y9`<{?ac=*6~-!`) zgj%)W!iGuFDFHvN7DM9(3f-D-ir6>Aa%o#XEi@FCSA1abX{gf2O$_>OrtIMz2&9nqTdVR7=3Y_sMF8vS|7Rd?GC6(ux3u zIxJP6vG4gorbaRWPXw7NwTSmapO!hfXl+uiD##>=W3xCWuItJ$iercSVHB_k-d?3= zwI!fQP)?3X;aoXq4-T4IB{nL6CY$sbYnR2@>l1!-Vk2TZq(e>l&;PS`_0MhM>iS<{ z?)jyiTO1?-g524e(z* zNkAY8A)e>`diJR4J1QHkuEj@~FRo_xMS^iwMFpt-7_4X^W5s#zkAHWw9{E5G4OHk4v4wYlhSK;)CzJwARsy@W0J z^~=v6PEO9PpDgFfh%8r}@#_7@3w_4ZdH7-i9}O)|q=rcb3(6X;&J9WiEdn)o8%42! z&)wE#K%y9U|;vjl*i8pqh@bb{4VGj#ewm*R=Or=4N?O{~W;pQc=V zGa8$SWbsf@jwrNP%(H*{tkBZb?b956)MA8Bdz`}e z1n!y+mFXDpRj%!uVjQKg?BN+wPPk7Z_@jy=A`*B$Dv*id48W~RRLld#m`53n zfjKp@8In}S3|sx}54!iQiy&F41Eo~6ruep}oftt^JV7ga|^Y3wYlpBRBy&c|=V z$?d3!0hAeZ5YxU3f%SR9w=uQqGesY(65Z-7?=iwi43pH&@sbEP%@`L_ysu1-x3vI| zjd8Oqe>zBWeaiy77L)MXa8}iH&L9kLfeBfp5-=={t#v|>HocZtp4(f08!p;g3xn_< zVmvhJWq^Cr{Hq}uqf8fR5`C=ZTDh!#jC}Q$+VQO=3c8BNuN?R>#N(?AnQkE0z9c_T zH|+1zn;oP274dk_b6G7q-INuqeE1fwQLUct`fhzxW^EI%y?A`RCUw0Md~L0&&2-3H zkFD|&?Z#RyF5j^ijdO8dg6g=IS_`V{M(ru4ZnjfF_0X>u;AnX*#)JCFZ>w8QgPm!h zH@)nYy5-@5Y`NZUI?0wdZdeUzhBsL8;`-*=w-f%KwgFMxBb?Oc>NU%juU(t#Wy@jA zUb8Q7y&0nEv8}a2xB>5Ch0ynIYlOHf9Ug{T*&w_gBVD7|L%*rsvQ*y&KqAzb^c-OI z|D=cJhrnA(?p(4%EVbK_MPj)(^S*3ikuV2f(ZiW5tGzH!5Gje{ap8KtM_nGbGf&jd z&fYL_e};*QCH$x@6EsNTAXFj<1*Hj*0a08C&kcM(fW;6;QQ}C)Bk);_eHJM0JFvgU z5u<^i#9xYdTT~B}gF~zTZ9ug@4u3gTLu8b|eK8gtc1&$Dm<|_I^~N|FE%Rq|zmxPD zL(}u6*{TVF*HR(cgJXi><)CLhH+3%NNra{lTs#&DMnmDpH%_x@Zk=Y=DW3RC)}Ia( zno|Vo`#m}R<=s2##+UZIOs6 z2TS+RW#-HrJhRlz7ctFeR)bs{c#yis!qgH$5pw7;<}eP7T)B`l8$&q==m(5H|59l- zfu2wM6PoZJCuvT%T@TKy6JAHi(ed&D-L!z$Wg6eytzz0-jShBQXIO*YkRgO$sjxYeI6S#f|{n z-P_MRO00uJDGnl^GU8I-Q$b9VmWZusB3`C94JW&G2rt2AdwBO>@TPafc9n0#qsDez z35OC-(wN2YkfqN z)H;FJ7Djyne;Mk9-GtK0R~BU*vg!2~i}w5;nHQ6&ykhCaD&xb)Iyo`Tv%ZcdpXLhD ziMpAn@eq)T0ZO^`MBCip1caDy-OH2W40HVt`m`f`PE+vBtJgojYJ*%l--@2_O0`d)Rq9Q^^SZ$p^6$o=#7vVUq)h;bM-@XrAsy9 z9rR{vh}zoJTD7;&ueD)0IrqR}2gEz5wcf2o%>dlI`gr`!Ky$-TYF#nZhc<1S1iW4v zZjEu;wQ-z{R@Mdc^5TwUXZfAq=Toq3gdYDsqBeEC(DrFO+Tb?j=Vkswn&(rvT(FT5 ze6{&#+V39(?pC(!;wg4AW^XXddLj1`1z#318fO?$pdS??;Pe}e9ZxtI!3R`aD_abQ z*%aQof7Ue{!1{y}4_GMbalE3-&`TJkqzj}H0{?or)c6?mxt-7cF zoW6a-fAL=Wr*Do<{`KbH$1i^U`GWE{{OtJ$cEZm1L-*&GxAZ-8e}3h%vx`?R{`bWh z|JnQOe}4Ps?T1fC7cWj~`?HR(u6g-4k~nuAKyoN?PHMZc&WYjsp}V~kqZ~vl*6i92 z1O9vAcvx@I@q6Cpk(5RuogY$yayZ2ASo+%w8D9zo+>_=#Y5w6!^A>f(E0+4BX2hYJ zuqYt#v_u#sGImt#xe9r&AA~%1Sxh8JBvuM1R3uIU4BGXah%h1|L6#QWj1ea(iYwk6 z0zuXJA5l7%hgQLpXS6pRYFay)G2WT>_$0F?A zU07iq6<_AFOH_QhS+g+Y4-=C3mnP#oXTXhRmsZq)9*zN5?d7c*uy^2u2gI*djc-+# z-NVxCweekRiL`e}DXAXKhVCm8I(}_krA_O?*G_3It!4lk>Wg4j$5A>#5Y~e2>Lw&` zR-s076Gm7)->+@LTi(TW{kCIq1LC)hZw*M$_Aa6C)|vsTn|R!<&qk|j60%x*K~0mu zY1gq87isgF!}2aR#^#BBFHaSGgL8cu;I(oZPw?;onivj%+S*P)JBJceO><+PsLf5Rs|(lnxP@Yj(8_O=dQJZ0xV;{d--`c6Lgg&PAMQ8D)e&S)ZHbT5gJGbaKXD|kAF$fZe)V?n3ErP^hwSzG?=-~%3ng02wzD#jb zmxY9}u-;7DWKJxWZpYYI<~q$5$@L;2jc?F;84ub;1cZkj@_W~G9h(m_v)3-t&&Ahj zkmN$oBc%ubxR1-aE0=9$Li5UaUZy2WoL)#3sy7NB=O4ZC>vrLt(8oNvFTu$UOda;h3~5x57ME@;w?Imr+@07 zKkEN0jO|tP*q32N=S{I7orf&0tH!Z2!x~`Vdl2=jv!HEfBCC#8`H|yMPMbxb*ON*77O$^_v?Yn4XukZLHR)# zQyGR13qs`!*xZ%tdXy_AL=dqsA%3DTW2BbgtPj?1oV$Bw7udSibhANg)+OuD47?TE z*8+viDYEy7*Vy(ye~b z7cNrm)rC)DyU2mnl0uD_*tu8t!Mw0*rgOa)R=-l6>f$uM6dRCYTE8VU*SFCl@94zS zo$pxSrtt~Pg3MQ6545Nr#JNZgzR`nk>c(u7cY$wXk*NFi@s$H>%cDIVc&>T0gGFIm z37YvAgkiq67xY5EtJ}=?0TJ(s^qxrn#fbD4EV*K-KWdiD1bl;Ic*2SF6=R_YLx=l3 z;?i~eP{lx;T~9<*Du?)Cghh8?DG-Md&v7NID*;?kJmHf2qadMi5Hn|I$U73 zbA^dU5`D6iz8&-!R;!t4<%3EBe5bUGc4SG^jF|UG^sh6R)-QvV-kAb7fd8LQCi#=6 zb1xbkyBYL#rgtxXR)}9LXk?s~HG8pUaXG|7w|1Bf?IAi0`Vrun-o)6oq5`yVCT@EICtb79Y4Q#j-`2EN5J|+ zV>QTNikEfJ<^_qwP)mnkiDL@~&{x(Us^7QKv02y&X3_I#kFXN;hc!^wBD%$Kp|ZyC zZgFN4OmEH0B;z%(>W}s$svA91-=M1>KH>Arr-PBH9BhjJXwi;g#p5iC2BSbmI@a}u z=3~+qm?h#XlgAGi%=%MvEF0_TFD9-?)h|W${@O;6c4m!-vtImFS^B0mil|>-b#;^W zuG5B{R~T^(yK_ zNE_Gj285K=+lZP8sh-A;gmnGz*Avpl$GKkkg>-VhHr^bYW0$qDf4N$&eg?MrPTE;w z7vD)6K$oqd3w-2rdj@vwIl$Sbq*!o4Jmjb?9KB)D3X`MVUT4Kb&gpUv)27p(a2cxs3cE;xu$$NAx{!TNkRh${u*E+ zGp~!JELdZ63?)*>FG`HcctVUew6UNlk^`)%rK@PY&<7i7#jr;2Fv#lL z-DQz?=wENSBNlAW0)eIGkNT|gf`I)E2{g>3;BkXXbNB>~{`XH-Uk$CIl&Y3tf%7yu zLox}+t|wn+8O#{S2>?HphRe>+gSHlX zG!n%nvGc&h@JBsK^UzKm>$)IgSh7Eyx*SCfv7Ht+1Uh=IMEu1RgoP2nGx<`GITVGw zJ6*^t3#FS#mBKmyV`UhK`bP@qEe~O=CetxIMqO_0{QUj-<=Oko7oT3fJUK@mTwE4! zYp!LXAAGDO$t|4;ykkmyA=;zY&76rp z(;7iYHsSBO$tcse$&KXY+@>-AyRPP&Nj3YE5s!>hoji|*h6GlS_59=Mxjr|VrhN$) z8tZ97tg^Xjd zoeG|i*rNbelu|4rz959bXF7rJg$kAE;`m}=ElXLC@f!!Y9;L5sUW?MpLD={P+U9My zXKy#ETb17vJJ!%0ezo=Q=G?Ye9jo|qjn(;~$J$7oLre5TX@8Ov^xU8;U|(gndwS|ye{4n~NEi__@Gk)|V8Z8?cXY zc8z}ptY6$lM@k}iOfrnOG;SneVe-@L^abU^!E!eZI*yIM1n{g;lT;Fr>8!TVf+wbE z1uZgJ_)iL&f>-ZnL$%b^+>F3@Q%p9O=_#JC@!WKnPM*z#8VXlhh6o>3!$$%Dth{r* zY!OQ48t6?7fk90B>Fo8<`{NUh0a4enl*t5!(FcrLOj!Iy!1B^C66R84cY_#r2nlyk z_4uLuD&Nz6vVoxC-_d>2Xnc?Q*>w+=@Z^td{8ewJBa~Au46oDcaX65|0R%i_rG~B{7!d7^ZAQK(0LlDE4%c0MxJzAVJfm z=Act^DL6iZ1g(8Wp-sXI$_h0Z>a>Y#q`?I?(+t+>=s5CVt6;&Z#NVDsc5@s7H@rl1 z;CTEuq=@&CyH~kTA2o~Qim=4vL`WL?Lb@W6lKH}gXPjV0cfu9*;bFiDu0s<^Vpn-I zVLXnaAc~V37FkuPgwtqyvQrQXF1ER z6**@02l>{DhHIv0eHlE{ycLx6Y(fwaVv3A+=<(j>0@Gz(Ir!ALUXQw61*YL2wh9dQ zKynWxAJW%QwG1CMO!WMi1aSnj&Uxain0YD|l1DyEsEjyOJdrdI01x50lPHM--;EVj zRD@FSuueDOZWvN^@=8^qHr?Q|sBgAe=+QUxQsjlM!D0@JSDN+_DX!dZCHUyh%@^}h z;6Fy~D4kfNzL+4p&y8%MsV<>oL*`LC2t)Hl?}PC?6wZr6l)A{#iK54qL=!0%CQtYRm+ zPqXE$9&>Q%9n6j$%;WL?aY`I#yHNJRBubqyaERndBoc>JrS%>?j~#%j zA07g8{jgEFYd6eo?TY)B@o|msi&q0H#)Fc!&lv0T&TtiwBC{es(K8nJ!(*UTaYCyn zw0c6T+uw#qjaEY#1%e3DCT9TAyE!2wBU zJCW&OC+H_+`qfQ2Ix=lNT4!Ggmo|s|J|r%!Pq2O72=5L*LpqL+=iHPP$Cscew#V1s}{cU*EsF=Y_7CcrFPtrg} zsUHd|C=3M&Ig>CYB!FWrSpxW2`&#)rQ9*)=CovcPTF&}iP;sNP)oD=VvnlE~%}>V1 zX|}Wa+g;tem9*tNY@pOrTPW^kiV*~bo`MCHGRC;4WiiaGfo7Y5e;N1h31lzd>F)!w z?;K3wePGBP2XM&!;FRpN*@1V#s;3xL z*A4fALbpuRM~y-OWttQQIW~rpATmA-d>BS4r(s}VY9*A$q2k&XG3OCyLJ-9F2)}X);i|~XveMjZQ=Qn`D@&l9wkqbE+-wU)+Mk|nou`kQo^g}vfch%-8Bh@-gNPfENE31`ND@mTusD{Gk}57J z4JgLWgfJ!2R3z~8c6wHzb++meCe>9@)cD=l7IR)n^XumKU*r(N3sO7&SDX3XHS_(v znao)6K8%yeQ1&m?CL7yoP&P{tV`+A%OuT;ku{%d<4WsPr)bC1$l6(q%j@!20Mq^Ym z^hQVu?TWDeZ8dREM+K{Q`uiLe9Lt(Jv#7nH@U|s-Z$`A^ChB_GB3ppft{L|DuRMnr zyz42$^4sa<<;uSomMx_l{)oiyO2yQ>R!n&O&(Y1DKzEhcNemI8R*_aos99hllPVed z5jBxgk_i%|k}z^N4Rj0aTcUHUWJ%v>Sn%Ye$WhVOb|``>6v($fIG@12B?sD*<8eNN ziSl1fmyKXx;fLqHym|NPr|-neUw?h~{ME-F-u?J14gSeL{QlbyFMfOfKQCW261aP^ z=i{3XFW&$7`w!p${`SRB|M=nJ`AbIMKYzoXUwov$e*g2YjrQzf96M&|yk_tiu9{4i z6IX$Hz(;rwMgk%{LP*$X#xCwro3R)7U>*U&#VQ8Dc;Bac>X-0mj6MtEK93JP8bXD~ zRg`{;f;vS({S`URG0va1ybX_<;4nrsbhDolk_s7e77|4W^8>+&rg1|20H}^{QWzBx zCTWzyyhya+NkXXbyGKFw#;_gkov*s}h)ML>nXBkirJ_1YV=L+u-=Par_tIRuYDg-d z+ybfjGS08ZPCMNezOlzeMQ?`XUJ=0@i`^U+veXcnw8~PN$jJKV4t}qHIwvFRUwkXN zdp|W|?j7=S$0sBAWXfMvcW<8~mCbc@nLs?Gz+Dx26dVv_-}*2+J==uRX3ut~tMBer zM|gUGSKU4MUdR>zs*k>L5@B6X;`iB}%6vX~hWgN?&-sDKmiZ(in?UjeO;1ks2NLDm zG6NqqnhZh{Gir#EM2Ad>Gypsl1W^JrGVpauBN#=Wn}CIaCOU*sNR8kLh2L_YG!+0^ zpvjJ*^_Q}|?3rQiz@8N^sWq4ZH|`liAN2|1M66b`RQ3@5D*#%$;)t;QlxvNm;$5zw zJFP)-xqSeqYBp-mN8Jl_2Eid=N3~0R9rx{ulW#y0Cg~&+o9>#YE94= zM}l+RWt90jVdwDw2N%}aTo0FSvb(Sj*Y3|65raNJHcT{TSDUR zJD|SR^u6chz7Un!zUA`$?xGeV1fVQO1foN(%$qV6{*;iJZ>TKJ(a0~q0er&I|aI@HiG zO%f8O#*bAHYXRdEYF|k0CxKC#!%P5ho2W3=4LEf+&4!*0w|mxG{`=zXcNcFz)LE9J ze1@_oMLsCx$e}~rq^EgZQ5@4L%WFBo+{>vf26}3%qPN1fFFvlURg$ ziy<8+0qX3~^V?A~Z>K|g|$s)VThI#-N zTSKkc*99uPIH+M2sK?tnt}00H45|#bMKrNPZ9UAzZ{a4;DfXYs7r9%{6DEp0pL+Q< zhQ!oK2WP!Wj)F27mS*p1d}{Z+bHlBLc;#L-ExT7MKNgZc#25K`TX=bEV8pSY>t4a# z8*AHkfVOyHm;Y=GLWl-`gr1;9;4vBv?hfHv&D#yaNQ-Z=L)5Hod>K3)gk=QhtR>6v zgk?@x=KitFmPz=iu?!#+#*@gTen?ajNAUQJ3m9MupK%_f#K4G0G>PIQ2t>pbjngzS zJQ5+NqRHphgk`WyHtd9R6=1h#Ug{wrf?f$f9QKMCmV{Vr;lFtm?zl*AvVfWu@!KO2nh?AzSkt zo?TsL`f3Hg%t1}7pvQhyxr0MWZZrk>?)Ey~e}(OaSkZ2fs2_a=P_(&7?g5JK45n+v1Rp^yNbk%T`ZQJ=AW%AwfcQySqBJ!VN;e_U!Cy6Jg;XT76aIm;1XVc5P*p<6> zaj6^b?YxqRv&SobNcVLgt00%Irn0O|KwbbAU0J`SoVqX5sy%?mc&l3d1D0ZF5p!qC ziA2>sxK;sha&A4~6LO4hJp8!20y)5ye)6>6dr|3=piwY#V?A{IqrU5USCl{`YFFu^ z4KTjQNA^SLra^{u3N6Hv(Y1RR2usgZ0hASu@DRilIW8#6{>_RI*naqTFuN)a2n=GB zUuobI<+QFFt&t8*uQiqdw1y%{sffV_zi~d|a&2hjKxVM4xn6cwU?jvA*Dc!S`oVSa z6xqla|1}#I8oMiXV>dVMXnaG6Lo~W8zVYqQ3atJ7T@@zKfmS?xwPk)z;&T$7@1e)B zspk>2NGW$_Hyb;_a+pCEnT(K97I!(;-xK1(27BWfHW+xyT>fzY#BF=R4iMK~eh0Kk zFMO+(Km(`0+!=0?(CXmXD+N9D&>ZcLPk3`n7oPCugW}Ej?}Rr^L}64Jo{q;sObyIO zUkW8;6vs?*Lt+vE1eGd`QyB+T1->DnHbVHqmrYW2O?b2RhnBM>%`jsK;14WGV7=D8 zLYMi_3D{YuDp2dmqBe6e(rJbeqr4r#-FEn!5rD2WRv}LdeB@fwMwZo4IQ-(ZbyIVA zZ5{TMP9r&mA6T4a0pH^I-Q9k1`iz_EC%o&Er_QbW{NmI5fByXX)tmqR^ycjkZ(qND z`?24B>e>oVo@GtK? zhKKI9@daK5@Bg*%@YmhvA`eszS})PzoY%c3-B~*tKThFVd!@|_I~wo{<0F)Iejt4J zO`fFRA1pge01aRnC-(r$fD%tUCT;?c1*5COU|Hi6c7tUtQ@0Z=v!#u@!?NJQkDmGT zS;+g0908WCXM~<$S$)9?mOU6OTc3oF8kYG<5-Fh)llVL)O2j;+B1lrLIK?p+(AUyv zmWq^0K@63N4r732G5jnbbWd0YXkuDqI2n6MHm6NMos&1a6vkfB}WrF_8I*!p@ScN3Mhc#vq zk_m9pK9~esFKvWCxfILT@4a$?kIS*2FadL{2pRg0a^IKwIIsv>m+6&;Z3qQ73ihjrs1$ce{JI4v&ZRx@j!26a| ze74NfM~wkP8Jk3fBovD3CWV7cW{m#A+p!#F%I1btg(^@^6-!t2dp1$0oF%3HbGCX1nYsdM z*lK;a?CM=0^wW!~7dpjH#JKpL(;fZm2$+7xta=(e$fJEZ_&7iY?I&^iHl zk5(=6)e~s)OE1+nw;o=^f$lv4T-?()ax}r#(CPZ&{R{Lh>cSn^Beum#%wFwY#C6$S z{M0rBNPRHCuEeKs!wy?}4p`hmX!}%Bxl9|F5A!LIVG{mT{sp^pHqA$JT6J@B+na%n z=QC`noW}!zG1h*svi~xldXwR7(1TS6*a5m$ZGO~jXyXP_?6P4t${d)*1Sc2C0C!cx zyu=zJm~1rH94MXUz%fhS`A5)?I;F@WwarJ-BHVioZtZhU4E*jTCIOaYWiq#(Z1f(k7KXU4F` z@Y~(oqV-AdI}^+`zArQ39*r+ZjA`^V>IbAdGl{&wx2|XL%n$k`I<&wY6)bEipm1U) zCuVa0uIDY2@KMu_G>X#HD275#aS%m8loA88G9Zc4T2e~VRKV;M(9taN84L-KkVL6C zG%y~f1MO%_owv2#N!0hMdO ziZCH^i~g&uG?$FVFj}*+@=0T|`_t884yY9cs2$AD>g8n4cdXYJmf)c%Qd z1h0DX^vrtE7o28@75Y5D`S}>(dG@a=jMfG6W>eQr74$i8=ZS_p|0j7mrviv_&8-WY zt%3%umDqRauebeIdD+u>L~D{`WX3!-uity4GwUyZJCCS1gUgF5ISwmaAR9!cfuGvM zKpQ5Ej`S%!DH1~sR42dHX+;?31+|;b0IaaU!u`M8(JqE!9qSAFm734M`=?)Vm>L( z>|Ao8F(op_vKkQk3{H|^NnGLD7Gbm`wq}_)a!$ozk&{>psKE%Y&363t(nC#g^7WqJ zC#g1aHk{5QYur=VVwS~pR`c%a4YnIH8@~L}gG8l9&W$&SsDoF9}T8v4F*9 z>P|OojEuE*nG?fXm5tSKW*Ik@sf3r#GF|w>(%!3lI2+-=Y$Q1hu^m?o;+EOiX=K>f zawP`GPBSYnwOA^kuQ3V<*NN2?=!o=lv$`{WN;fOU9qoW-&w?#YRQ8*%v9dkR2T9wT zHqyq{<=&1%A&+IvohjrUYW!`Yt2@xi)|+&!OyXg0cwc}N+Dube2lOzXET1{~47F6x zU%Ue<{Kr7uT&tUDP~N2dY2Ha{u9b;~8t^XTBB5Lc$^?MV6#?KYNy;Lc8iPl9fXeRN zP9?Heo=@e#=F!3$bNnN@KmTMm-j(^2dGTd@fPhNth~77Cc8%{#n;FJkQEF*(*zcaT zDQwmzTt}V}()ZbcoH_8<2-b-*&o4NHGGAxI;U}17pG27@_G#9t~>|K7I zYueca#7Y(gx!7zn8Dbgk|6g?P~Nup%WyUr*wC=&GmOK+b1vH# zurbV#hCBiDp4MEY9=O7ORYhgNt>O1(hHb!WHFQpfG#>%&aA~hwkH1z3QH83G$1iAf zKxlrGAoX3VE*?#ede0-JH`@YdgcPmH?bk&^J6MT5IifQ`Lm z?*k=9L(yo)Zp7MVzUFh0DkQD_BPXTE2|DBF` zzLr|@-zmC`66Gg;5CtfQOq4Q|b7gc$Xe1+w!=RKBcqE>L)K7!}*y{U)iXdiwxOODI zK%@WrYCP2#1@sm+d^60i(b@g6kP}(dK(P+|vEp6xNU8EX&C9;}zgFCN7*?$#Q^2gd05pub z8b*H1q))0?tK8AG~^H_hVtx(cP{ z@Z6Zdw%(XI!1DUiERzgRD+doa4TDazYOm^Cv@522Z`{z+PP$$)cJtfv0BNu7wV$W( z9!A%mnv}zAtIa`nJFS`CfhA+uvhHUwG?f!N}R0iHCbvHx@* z40wARj~lMp-io7c9;SF1+%M@UOE4L?VFOgmaj8Rm2eWirsK8cMv>292VynxgwVK(U z2I-EJy0`o<>+UbEEbr5})yO)61+t4ghGsfzVgnA`rG$e#=exol=jq*O%)MYT%u?mw z{cxAt6Fs-Dv$1wAoo^S1YQ?%|w;G>4gflm8?A^DJ0m z_rV&x{O3Vr`n!ruja&7rmYK8&!ywSUW}3)|5-EgAJeDv?LzPHhcp)CnQU*e~fiDz` zi1vN%B_J{R3Ex9zs{i~7BL<@dY}?r&gC#ToJT+d$(>u6TF;^K13T47p1m4g~E4rT- zWyOqb@hF?Hf$QrI(@U4z>!#lA?$47-bSdHmQP8T)%BykxF-R7ZD(uj_w#dx*pFX+( z5$Yp~B(I-89vDlsg)ZEVe<>XIrj(16DLEsdq&ui6CvC^&7s5>Jv<_}$wTj$T)jlJS1#Kp zJdlU2>gIjOdm;L5@_@A_lG}$obbA=0x5ycHk6Ab__%UNY-iqFI3D>2e1~WS4M6hi~ z@_v^0P8LPg$y*GDA7khT-pHd==?VI>M)wZ4-S)cCz2wOq!!IV>#-p~l(U7Nbp1vs; zz`{4Dv+Q)q!5n)l79Za1^XgU4;|Xl0aeLi5+uout_s@&{yT41?+cAH;gsqCam$U^$ z)TE&{Ri9lr?t4^y7M5H2F%Tbs|IvwbT<>UvDUa0NDXiFhuTbioLTLsOD z$cQ|HTskiOb{xQP>?v$I+P%XQ3-reF7-Sq zA|<(&lKYA8g)t!^k(9*RjZf;&(6kx9YJmzwS&*bX6}q7tc^agoL?+6QJrH-f4t*Mg zTt^_@`c#J;ge}U0C{T%tF~_xPb7;VKW}amu5GX9-S@7%Gp!(nH3%~sE`7(>hMUh3s zL|SfV)hWaIjNAjqNv^NbjlkJGq^p}kvKK6UQiL0p zIc?U{(JyRb*Tkb=G!0xRmyg+|{EGE8XipUIH8m;=#eNXSCl zr$^#1;rXPafXD;bi>YZJiye^#1RHUk!Wlt43d*CL&ZZ2>@_O7Sc$fZ6Ogn zf;o4?B=iIK?1WMK}hX^M$O5a{3qS|rTKO=&vo zLQm&<9O;=8Fv>!5l>TbRsCL7rg8TsVM6uj&ku)I0OCZ8o);t(OpqpsSIA1PAqm{d&qb(o;EjV@(RO8`18!{MoY zKj^Sf?CtlvX<2VIx$j8k+ZyalTDMofVCQwO*mrAQvF}Rj`TIk>V&7H8Z$H*JH32QU zN>jud+W8V*v3vLRGkC@Jab?{;6I&2f1<=!6px3kfGak9^{h815%H#A3L*1Pk`UejUvS%D9S^^x>)sBeT=@ z0Zj;tB_^=sSUKs)W)dZQ0IHr0IE{sdi;~A8pq|n~QIK3CK_VZ7wxf_Nwca9zaXdjO z-(|?n=eeC|IA|nDqkqEQHN25Ny#;pofHQ@&QVz9+p&kp^T|cyum4O}3D^B^pe|!0B z@XOD?UC?*uPv0}|m-qg^`FsBKSN~rxTW##SeSkZ+WsybkPL?+M)}2X1(XJWY?Z;d6 zp%*l#mdh;a8))vGxq&VE=rt>asOQ`6aV7XjX!#-S)N9V}r*rE5Ky2dL#A5qF^MdGP z;C!PGCqd_lWZb8*_K6?F5$lW2JE!9ToPQ>8-nd`CYHS`P0r99%B1tIx%el*Z5pc}n z=Si;okZGoTq8Wje(t+oxfJY*PB_)2MleX~3~MJbM28)ngD{mV(Wy z(QFiBp61mQ{v&VM45t!s7(F8Y>kc`lwQk?3ax*oED{l@9;&VH4I_(w2=XL6gPbjQ( z_4LhtA$%Lzr#`>1(sW1EG4m=y?oOvSdNKr{JaLNG30^I0c{Ez(L327z&Ru$wc7tz# z^V8uLpf^lR+E~X7@JAiZ7I1MoF5m;v4eED*=pECw1ODzoUGocFUWRf6M_KNu>Ecg0 z0bJ`ABj|&np=B3fbZ|-885L(Pv4bAfM2cWIdIo=pumkTn1vj@SWgW#t9#HfHivAm+ z=*Io}RikJxB$OpoaTUfMmjIACyz_}Cq>80hn(9z99l5cB(==g}c%B=@F;*$@CH%A- zMOXIrB7MeNIlBe)_S9SjJKP55=@|N4rt!?vSX)>^d7?+n4h2i7_Tl2`CQPeW0T{~? zbz`}bja;M#xC3ZKk4iasHqt5HToINooLTw&epEeM;a~JrsJsV?dJ3i&W#JR-$qJr! zW&iAl7Q@dFwbqs$)<<*1>a&dE%SJ`qFnuC zjZ;jl}VofC6;0Zc+&?s=DFcJ|KWp0i3s$sC=C8_?h93yiBzzW?~>fJ8Fox|DfB3zL7 z!V^n>g21>42X@da!iu;i!YaU2WJgC>VfVuaIPm}{{swR&{4atNGSou*Fu{SZBbaJe zCNiNhV24QZNHZPiDD-F;(g+>M5=oUuNf1jas7U;_WMP|d;(V6nxm8vZs$H{#nZ|Of zs*VHjPDalH6pi7D-)zqnRVm_KP6Dqt={Ect_P`irb)->QmT3{eNt;fvujjRXKP{>r z%}wFlvg4{g$oD_Lt`DxL1Y0O)*J>u!CZkJtx(zxWutV*;L$E`u+N&Kqkc0xdR#6zc z5hGI4Ao8QwWgcg6CIzjon)}`UtsUC$_U|O0CCbuq3X5mBz_0ipyx8uyc~QjN;x=4V zc6XHb9&CIY>wg{wM1;vtO8Xdd3rb4P7(3(C=JZ&_h9CH%D_ZFRi98^YFM&iF_Tkr! zM4~Vxj721l!`RopPko>J#8*C?wHW)Y<2VYbCOo3P7jY(u^mUy0A*_`M#hyr{L$P6Q zei^4lLHeKd{otc1O@KG|i%)a7Z{faPeXQ{#QwpG4>oF;>eE-y^xR(N2?-&L<(L}COB20O9Ia$ zQn7@x4s6w`MKRUUix&fLIp-7XW5*~8?``$%8$yV%2nkwQ?*>_&W8Dq13i3md4GGUU zv1!-`*oZ2LAhDTuRHz5B7~4D}A7IS`tob{7s5NfZuNwO#5%mOspP;CV7)r@xqGB4x z%qJr9WDtZ}xUL8yNjV`J7EC0*a$%8FEMyDzd3AaD{^D!^2dlcV?$TTj)O7~1!dk{S zl(=IchY~Zm3@$F-IH(NgkPhXn^e|iqEV~UkVW={rhGvmoJ_%WU7B>VJa@G{GW zBRx33o@H1c`xi`#^ThDU=GOqCpiA*WVFX7R`;iyX7ZKLMLgaM*>>R6n>!O5~x`wWr zexqC5vXJ<#!2p|KAY(Xj(4XU4TjMm2N4haEWHrOM2$&BMQ|^@ZCbJ;*^@z~L4>KW_ z%kk*h`Lm~wO-99uVQ>LxFwaeTo?=q}tg>tUk<0lg zMGKsHO5Wg@e*ea7ncu%D$8fr+kq$43y~E=9#%ta)EPmY$aFf~YL_=R9Xuc~7r5@_O z4no_8@+I0n1^@#hn5QbvhBnqrn9dOE7B!Rzb==UQ!ih9MD=V9V7?qDKI2{i_@P|KZ_1{9TzwB-@%4D3|##=7UZwlA2MYLKO zIB^g#_?GLor)WZ_zMBl|Jl-1)X0WDo+$6JR>3{x{+0*N38>P9c?Nq8+N$hfmH0PIU ze%yCj{1s6gG8dUL_gJ;UwppxcHm^1`afs^_&sdmc4Nju+*{&g{xw3OP$!#4koH)gJ zA-Ju-gWLT(oQm(*cQ6c}HHN+~J@PQcTjA5U%mQ$++y-R^fTD}eFKQ0kc<8!2mf{%3 z^dQE06JzT9sH2LndrH1PEk?&pL<`@y^8T~%z0lK&Z@ZIbZ@#R)ZhP=G=QKbT^VU?q zSj}CwTvBr8;&XBK_L$>-oV{u`PTFVc)@Gw~AA=00Y*ZyW{~UcEEruYg{8fn4=maT z4}ITvDfQU#tb`W?@GGG^S>4+v|K}Py8P2lB)LihZTRe17JShMWUgii>j1szqahBi4 zk=bhjZwcsxr)Jla_BaZ&!`-lJ19sChi*V2DqQ?Z$xQzrhdZQk( zgCqn&y)TI`+Lp4FL~N_Fc9Jxkemh76={tN6Ugw@;0g`Ry)NYclrEDzfiT^Vj5WVB6 z{i$>RbaLRX5AtRghqA=>>Jq$(oL84zh_-j8g~Ee7ye9=|j&bUspkd!OyuQ8i8}yGQ zMI~%3MVNJ&YFSma6e3!<+)l2IZlwVfyQPTNb!4DYUryCn$K__rYkj+r7VtQl<>KK&n~HxoE1?92RI$5C z#~`iFud?I{&hjfGro@X~V@;#68Kw!B!Mg(a=gyzW9w{W5Z%nac&F=1Utpf8xv`FL&N$oI>ALB+oX8ExMJ&R? zPT6cfJ`{^#?;LA2nj}+;LRlBVyUhg)yWYh%s-W2ryg^mkV+(;Q*qttIz0?`978m?<0O}hQa1Bc? zC)G#V*xe6|NF`2SiLjFob=v#7^QV*kbvpepngrZ<9rObVW9ZK7{$w<8H~$U4zK#Et zF2}v0>juINU?0^O1@j?|FVo8I#+;SylyZt@bz?~F#==tY#+E^x)+>Mc3s|x|-oEFs;yeV|LSxjw1IyHO4#zVn%bWya*$*Ir}N6IRj zr`Wsg zFJ4B;DJ39ujL6b+BSjNG;kv++yP9E1{=a&;5;Aht@fe-^?~QutFwImSM^QA(ipC@% ztby4E*+ETWL~BAx5|n`~NYv~ZW4T*4-9syy)dccI(G*4VB^1r-I(*WKhDNDOvL+g? zWs*`kmYs4bWR3~CVWJ(+mVnJ;Bo#0x0Bsq7-9$3U!8LJ5JwgKrx3SS#epwgI0whuW z^oOa22WwPL&gWaoaXyH>@Q`zV$%=s+) z!_yV{;h@5lb`~?dJ4_DGtamv^2e$w&6M!$) zNtv1wAmP_?)~SEqw=ytD>(UJ{=03&F&o5u0YWY?C#(o}O{fVi4YC_#sW%c9RcUApM ziHR6HVRI!j0rTdk-_FlFqbm#(8+RfI{h8oj$=*Io^8Ul?SN}QbyieD?kqbQ>r_jUL zuiiMh!R6O4>X@%_x}J`q_Q|w5r^U#%K|-tQV`WuAJ)w@=sw(J@;Ki$MfL2_*F*?gk zPC75~Qa|*srW1?=Lt>@z)ny+8{A#A7s^!i#W?4mYfY+}orua!3MhsiKH(+(BnyUsh zxbgU=W>{LZJL_6S5Q$8WV>kIw4dO)%Rd62&$eRvwC!wGWo01dlNc=k6*2Dpo0<1r>Ztf59<;10x--$)T@syL5Z&F0n6eQHo-Rnrhrv)llT_m-31eSwmjuU7 z7aUq}=yBrE)us8QaVScAmj!{P=t2HRngnP9X&lIXL9HfQI7_sZDO#pYq`@oYsUR|g zrf?6(p>t|#fJlG1ajdXcsy6_hq*2wgHXJo3rKw|r~g6uOP zQ)IZBKX`ikE&a#2*4=YT+gQjOL8LH%O|A3Zzz;^X@}3dJKsD${DDf6#RSvrW@p;{f zQ41K=Gi9j++ZxnamdJyeq7GSQW&>x2xd#E%MpwY?0BZ9DZU<1?%kKv(R z-FsqFwG%X*Q;89KBIur3ljZiBxy4f1}2HY ziuHtw$OI;kfmza#8$GXa3@``_v7RjYh&BCZQHiBv9Ymj+qSi_ZQC2` z&2#Uq_n)rMIj3uCs;6dZ>YVOxQ%PYaxUw}HsV6zjnw>x&QyKS23jCQ<7sS#1$Z^Md zqMMhkE!YY4LZ{Pv5{&ZNjOUDAn3$8a2&r$qCQXAz0ch73XBgZ3+9N_*q8cx*7>|c{ zsEZ|dF2sJWWXbORE-p{~&*U=WsSf3?Krxh`zkSiva`UXD!_)s!&3W&iqLDwQfogmJ ze!C`1{PHrv6t1Z%_cycS4#MQDJz+8aT>nmJ+!zP`q(l1I99{r8dG{x}wMN_-G$x=i zW3hymX3_ycKxk+^LRk%}6#iX&5NtFW&?|gG3rDXm?WJYf=$-+g>MQ~sME*uibJAh0+%QeDzKxUCdT-N7a7OaDHQT2U=pigcBs0sFIe*f1AvB3$8$ zv*Y93Y>$OewA}_~3-7GzI6>#stUrmmnay(*g|Z=Y(Q2CW)biU|+KeGssc`O|?Q@Ef zVo6aI5=n(f+Tp=ydq@i?H-D9S&+8GH`|354&QRBE2g#Fc2$PlE^Wq<2D`2Ob59M&^ z@+_v|+L@Y6kue-ES+c3aH@8W0C|H%|57Ufuv}%QA+?1i-2bOH^~RCj!h!1me`N6lB!l`s;-)B=KFHCFF#|T+bk9U1wuAo2^#-Ay+Hp3kUOIKCTv%P zRJPYW;u7603aSCY{w%(3c3M#plCOwbn#wM#5LnX8I_us(^eE}4s@(g>>ol$>;>Q(c z7n}g=1AUZt*>80eG3+j8(&y3ki zumhdY6^uEqHt655b`igQr5SVvPfId-B+a=7N-EyCzDkTXvGsL@$R$(N(7Ak}_iaAl zc=!d$4kHpkuGwkA5_dvZLp1OIa@mqPY3RW5l}O?mb@IhLe>_g)a`Sh6X^$SDgKkwF zgkJRNX#Cpw1PF)Y^DgsVzn?wQ7$4i5Qtz|_k&(a}ee+hednDZ%oqa08IpX$3O|8WI zc4R}2WH=n`NV;;)SThM>Uth?K#lS`p_MJ{TvRA`xX44+YU7%Almyuew_-%_j=O}M| zW%UU#@!TOdYpI6JWN3^Rp1xHUb0xR);tgBi5h}B%esN zDb<;)<{8Wg{iK1`l@p$}Or8+S>??2%EEY-n&E}QQl$_QQJzSJ5 z+u(!W5?7AOlq?qx$8){fCsd+j1e!|aHCZ1JB2ye!&cnr&Yy_bS9)am%Vm8}Iq@cJ? zij8c6Ug|WzsfC#~B@|+k4h$oqZO00kDM3a~e5WE_f-5=3Wuz{b3KKAX|0tB_^eo1h zfR`Vy0;LiW|4$^UNGMMUN(B!$K#DP;0%TZ%3y=8hHNHeaiZ(IOpB5E4k&)S~Ee0Nz zq_`R?OPi7RSuMB)9$%jHR7GDMu|D)6_daN*2` zve5mS(qQHgC87hKztkK-306;O>+JWWD0L`fS-6@VicxEl29ob>+LfRWY2q3cig2); z#4sGrRFxJT5uDhqZo=J=(BNR%W^}Mh1mxb!KsB24kU1a^Qu>w0PL}eiP$@%*jx2*_ zh2oVcl-O2uDU|HKc}XLZKm=jHcp+N-Pe!BmRfrU^e+s!h4Gqae`eZ?kf>H#<@p&fo z_Srni0FGRo#nB|3lGh@3GrXEi5O6n(vkr6KqetkK&rpl7y?GXOF0E}(X#$UXcYrwaM7s_7q1Vs zpcJ7ArAmk1aNVl(2}LODeWjCmk2QLQ!jzyC@$dU|>~oqzf%H0}!$5{;ASASb+^ zh9yByX5rW*L}(DTkK^GzVCK|sdx@iz(s=B#d{An1W;*W)Qu0tlVh^)<2Dd2w3|i(; z>Z73%r1k_oym=^w*{E9P6j#M&V!whRGZL4=(+`b>dc8_fXNU^XD<&4Dl7G?o^cxaV z5p$rgTO}kVqS5_);D!8@PUWFLCG+_y|B;7$nLxVhoXWE;LzapGuE+F*(h#A3t(9&@225FvDMXee4#%3QEuGSPH6 zI)%bS7fq$|#wAW<*(%jQ68M8jjC`THB;6v83pq$bUdK(_MpA7GC1}y{#DL-uqGE+2 zo0?9AqRlTaBUDQ8BsyqR1y7b~u$fqv;rFWGg?Ta}cmLir^y!UBN(44ULlq@9$I2*^ zIm{!V9j!F{c-~Wm1$Z48ODRIx_J?M^UH`8Cc>^936(y9REytDe3yEYYUtAUQb~g(9 zTW8|LNEPIj?$fXoMEeD}xD3yN{l(*W&SeJqij*u=u?b?utHO~W!+2awUZ%PYQ%;Ki{ovBU;?{W|c72h~|GH zRmDP8N@1#ar1etuDQMsk%`QC4^ACkujB;m1#Kc;T)mc)@#i&`Ra!_$MlT_zv(Q6T4 z&LuyR>674;vJ$sLY~}JWOH%n-lq%FAR>ca{s1?aV%})4?&Op~raJIWR422PALd?4N zv>!bAAGM6~+iu$R_XU#yarfPF1X48}^^g)~{Y>$sjhaM0nVWDVt*~N(f2|RjJnya{ zV}Du~lSjuCl23|S78;E>{(^djAj9~sg_GXYc;O8#;%FV=vQ1%Rr;|3`|(v znag0~)MXz*{Q{!9M!wv7K1DCx&AGFQ?b-UHrjq{HVs@n(>%=hF8tEt$R5|97<=~f` z`!(a@K(#zyVx#MM1@Y8UYz2GSng%z!tUNBX1ygkI{V(PQ>8Kn&DN5_@?`L7 z2u~_??SZ_YHGIMyZi(O7Y))==b_qsqU)z}2vS!b{SN7h00z5jhZO;_BE^c3W042w= zrz;d@lQp*n@dQ|8^h$*BdppK0+zdM&(S~M?ao5fl)AN@d$t_T0$M(aPrmn!VEY9VD2LTeEWAGg3 zd_9dr`7fyY)EzhdAfA(NtTB0g>`ggQoGN%G37SJ*Lh2y+CD1(rNYq3|tgcSnFoB@A zD5v(e9n26hG@vLS9ZF8!-4)Jb(n(`_B<+?*z_0yXl%KEf?HKk?xT^|VM+hcAC1GmSMhSzyPsIEz4%Ow8sl{c4pdOieCXnt>mEvB4D6DSho6bo~f zk;|K}!uAd}{kEPShsZHwefHpq|64*OAn761sBKZn@i&z z#;j^MNL$xwHGxS)VP6LZqJ9?x*)nMT zsX^2p&Iy=ooLls5Kzcy);gm|5rM|esdxrC0blRLzaDwW#JvK0L1x_NtPkHp{rNLC2#FehrP2NMN zTObFXoSiHNBb!4N095wQ9+bBar(!WI_UVW?Ph4P#Q_6}+L%Um7bE`tJYp9F>WzaZo za~6U+6REt;iqd??k|)a?O#yrA^SM@EpU42mzEX3M_B`D#ZtZ>Uk(qm7 z2zTH3OX72qpU2jNOg#KT0@!)I%72Oe8i(eHGmbh0i53-6-i3?8?pCCSv&TSxVoHcj zJK*YU1E&RBWBki*)|Q#YCfaW0sREo>U&TJpq(Yki%z+1sh_h+y^<857v^U)f`E_U? z>vZ8!T8d{5gKidt-u_$xrmL&^wRLbJsh#CRLL@x3yUgdWM@T9q?}K}6h!;3K!@d%K zo;dzF68$%jd%JJT*P^?on9jS-NQ5OV1w>}3N)gQ-63nmNgCu4=NvshbqFWYD-zj5B ztWw~;{6p=#d+O-@(-H}!5=gUf8id!0u)wcEV``*dEvUs^f`l3259jkC{aavO6VGV< z)q#-`iH7OXC~hR943o@#+<^h{r;M!Ux5u5Pp_?J_>3#n+*|rMu8@iEN=%H=kPCw66 z)j^IMl))=F?a3wJB4`9p-_GX)02wovstqrvqO5L_WD%Ah+^~I-Uts1D50`JlM-NOo zc+F>xwPHTsL+)CS>YNylk7Jt%R=eEG*k@IqcdyJqCJq#y7kORFm z>w~gf2$1&KPi_W~=QY4*_RIS<)K`z|20`sX@w7gxYy{m9WxeJ8Z=tw_I2~I9JQ)VD z8ynjC7QOvnIRe@7oLNus(2MA_?{g!@A8>nD^s*EJF2~^pGq+D2TXUKbp{r;+(?h;< zsQ#sr&ex}IrBEAUCfW)Pk;gk>M7xVZpcr`KMg<)HYH)2||lkxeP| z^%tYu0F;wPx9oE^PBf52Z%qUKiYan)4|!Bc z;yD+YH?i9+c8xh;N#aTm=nPWy$L)8u4AKI0JSZzSMO;mNC+FTVwJZ0p8p9%LW)Qr!>y9cy%b-<6(^Ya3a|#?5NA_Gv1rMG)j?3hWe!Ut@PeKmyz(9NA=i5NHc_!WBDBv1m817&MC*PO0H5s zM{qB}m*=zlryu%JtJgGrnNz6c053FyUBcrPJuITdYl7%4%9W!*^l@lisGk9E?MXI9 zn|L=~Rjk^n{j1uS7Dw%lJ~xWC_@g6>w4e50IF?pR2#99@_E!K`*P4mZcs+=g3!D~9 z1HBmw5C8fYD_mc%bJkn$7M=PQR#6m(3?czO{CEC{$hehB?|5p{ z#yl}Zd0|Ah#2Y_#@AVJ^!Av+P9?n`da(1lm@aFL5kNH(===%=KyVYDtj1N|L<7pnP zo!FVOec&#i2$QXc2<-Y>EZyOoJEI70vVZ($MjF(g`fZx-++P$<7u;%RzR#S9y0i>) zQVJrmcLLEm!draA|H|J19THpNL(804;}0=e|2@Nu^aSRH+TT$qdkTA5fqV{o>E+-5 zW=<|lW>Bt&q9yM6_tS4!fy^+;38^l)k>S?RIXXB7MAQchnnsY?LIxnMq+eN9{xQ$B zZ!ZJ7`0B%kcMPgh+%sxV{4wbib>3G?qD&mF$VoTKzr+?u?ZPu9 z4;eeG%g^aUG2(gnBU_>RX=#}7tCTtWT*oiFYMbA{tx(K%^8%t7d+b7gTQ6&7;io^& zpXBI8x?_xv7fdd{g-bIl;!bL(0Ci@YfuSgRml}`{vg-MJq)Zjd&F7aiE6$O7<16`o zy2&oXvqE7!WV!A|@}AO=f09B*v82G{Z+~H9Ci8xd^X+buz5GhAH+R2kkaF#fA#7H%=Bw=m zrOjsRjV@q!u?<~7X2>mkFcemt?5+CP!Yc5~``>o)%KP0)Au5&sm6kwckN_Tq#w-K( zPbCF}(g)-&B9rDA0!qgzl2LQaNp>vvNxl*uZgA3hHtq9QZesZ|M)9@5Q`SN2ddMeE?e;}DH`-(#XB+(2&7&l zAU3)WC7B@xe|7Z}dcGX)+?ttM8S?R+@7Jdf_LJ6D{2h+(Hc!XbIgjtXgN^6ZiP>$A zhlO*DzC$FMkpU7m1CggISy%%YVF)Lq7!ax&rERp`k4drF3&59c;DNQ(wMxoSV3v=m z)fGm52E2i{nCtOAt$Z%aY_ovw!^zRFPjNyN+*nNbUozXtGIh8HW|Cw=lpK+&65-^g z1tOCY7$p8xMytJL_^*M`V=Bf#FYz)sW5Hg7*J&4`ISxx@uXP46>AM%ZW!UK!zA)?Y zfMrEfuMp(E#c~SEm>=KrwKBE1wKSPCF@J7=aA`mO(Lq`5y4LG}ekV_aG#?o3K8eN%I zur2Y>bCs01Z-a3W+>e|=@3ft|fv>B1Pm4H=L$R}+_Yfx%J!S-+)2f*4Ia83g&cMb@ zalFR6jhKX9yws%{GK#JxEU_T0$Jk4bg5};820oZM!MY=F*$h-{e|ECP+tr&z(C7SK zKWJWGbg7hE7D+JDkn=IzRpw%>ynDF`-QB+4u1eju1`eM`zjn%rPKLF@6n|~`)&t(( z{Wb-KjExS}F6D`0#gNG3!-Q*+Bj!~?xSqUM!9iq+Xk91_c)5(eiJ$C;z7Wo~qOt!N z?}%*m+6tA7<|cPH+*>UxT?<7OM#8 zqeF`=Zh9OglQI1}h4px2cMZj&c#6@NRj*1`eV#Sejtzh5&`#F?`yQHbHNa2e6yMdz zsL-mj2%8R@HXzW++ zQsBPB4Q8j(dY_5E*>Hi{)dYTRmCt-U!Oy;rRo_srv2ow!g1%4WfggAZ0p;Q+SCBa2a}1%$_UXt~M+j9UUsl{NlA1!S>T42D zxXRWpWUmMtXR?1dK^o~ln#&@$-0&2pcf??`2@o(UZC+s-C`j2Rvi1nofXbY3eSsPf zP$)e1uSqY8d~S-7V&khP)KY!DU1a*%u=c%_e|J?mL2fJ5Cu2E(8xWpo399 zbHp0Ug2l$7?n@A2QG#Iy_e}H**!&yf*h&_<^`R6wplvQfw3*rUYtSaDw{1fY+0BZ8 z``r)&Yvf~t&_`hK{+YF_#K+eV#zs?Mmh!bo5=fSDk3o8iavh2ktBeeYmp~p-Vn`k_ z+(&{o5wfC5Jqo2%T}Mc&RVF|!pbe)0_BKWXQsV}5dhSF~U4D>NpRn5G9=k~sV z<@H33vCrR9gBn`*5)E=t8v5na9_!;*G*F>m#@xm`e;$9@|FUlL{60I_m;eVaAkB(N z9yE&HeBQVi@5yBJab@3++sc9yv!a8 zPHYP;z=#JCzk{JUKQHq4bA;pZi404;usd9gX?9!0xWU#7C3>;48BqW25HS*JmBq2v zJpu3gcKOOlx=|zXZ5DTq|VXKbTdoZbp z9zi-j?17CK{*m8uszdb2)`Dv3L@+www$2~F|ANR4XfEUUbn!X+(?h<=J1uZE%>71R z*9Ks=gUT}N_IIU?B$~$HFI1Gj#D4k<>a-}xjTgXYdNTY5`&pii9v`^(C>ck_a7hSb zj47^yh=-CaHh!XbP7M*8`brWq99cqyBtwN!2_-L}E@eKQjh;5*e5`Y(h#zTBP@8j1 z_6o6rapLP3?U2*`c02a^d)@68z_WAuM?*`ef`aeDx{a>z_R_vqs(5eCJxwNA@zm4) zDdYaZywP}|vEfL`KKB{tWPSN+8_RD`2>V_e2LR9YBTi7@9t%riCY(gzZj|wQ+gudR-u)1~1^u z>mh(3dqyKT`qyAR*QAgSPaecjeb85NnLKz0(%q)r(0z&mQ<;*7&#Qc(BHwga>btIP zM+4n~)!S|X$GQB7CHS zdFDi~^iK^@y{o?lH~n4H@~jELSp37~Ft5#RBPT0{BrBx@NE$>+T5dnd79F0eX7Z?) zuRtw4xd}q8oF9QT50(73voiy4>jc{`7(+B~ef4m93Fkj*l~0Py`Bqm}nj7aWbxy0G z?uah;(*}ufPP);u?&PsSmizV>qqJ8t3R3W|ViIF;Z=R83SdVaZVsNkab6{9+Ke#cv{$;dIq2C!^B`g(l zuS3U;#&xn{!6&&fx-?)!F`(hnm;}S()|dj2B5x`j}7uy!L{Zm`fm?^K>@iK5bIgLVzmB^_KDcQC{FWzCdj}=ms{dOTS(vuAi#-ojVk>!aCs4NMa9#p_9-C zYA~>S`CHmsqt%`K?ha9O;S9qMNK=s2iJ-x#@kYiNrl&~y7w_NHAwdU3{rP0h?Vj6z zSM!Y+=T2JLV`G;OHeq8f%YAm`A4iWS1*25GuSbJ^dY7<0Lwo>wK>fS@zFr6D3y9lD zDj|35sR!b}JZ(IQo~m&O@g9!*Bg%MsYtPe2GJTUQhjcKV{TSTzbAkh4!wBpY2uCyq zLzd!l|7o02q$bw6NfAeAReH|7XEFov9v-~cz*w;zG%ewbW5K^IMj+R5|(>V||?W{Z;hQ9*(CU=NKQy%L!n~|Id;CyPP_R;(Yl( z?9?>$fBrbs^(PZOs{x;YI{IvsN#jQP>~wzXCsG+NSU^hlYU)dtQNt@-QYVp~RB%5~^KFX*ig93I#HS zBuk=e)nsA)9G*8OnzvbuDNU5u)g*?eR0UxS_7~5*iR*J4_=a~Xn@JV#IdCzI?NEz7 ziKY*gDA}5GfyyJKG@s2}{U7GkGWtLNnB-Mw z2)#UQe!y<=!K0`5ZZYwLIb4^*Hq4q_zh1%wL4%>uyq=4DRq8u&;(wRFZ}Lw~#(OIW zNL7KhO=BXGl}!s_B+dWZgeGGe?3_5n$QV_rp-5?jJSG#yz&v{i8JFQ zfc*b?|9_W{ZijGY{)cgB8UN3JRO*uRfo9et2W)13E*wAC{Os??k1&hky!2TNPh^PZ zbYUC%a40D4vp5Q56Gz^WB`_^D?>|vcT1?jT;{il5P$D5qmy+E~jOzK-KEHS*DtHZw zVzl4}7ULxIdgwi6ku*nv33U*yFR}`6cW!abOJF{0$CNi20-VQP$sEUz6mq8)q?>r3 zX|@JOQM$N6_ls$^`y4Q=2ZcnJLPnFb{pY|DmsMZ*Xh(}EVPhPugISEw5e}A-d`3u; zz5mbuw+t^ona}tiPtGAb|F6Gu)ld#I7UVR_I;Iy|`kgOHFY8LCtKo?k!t3jRm=<>L z02ec#KnKoZ{c=+TSq%GGM#!ONuVJEdNjplUlk#AHhSmYM)c|Y(AeAg&U{kqGtFRHz zEAFI<0dE{)guzHwB2%gm00$HkEpde@BQp^-Xp|*UC646BC>29V%a|b-G{jXBM5!eW zQcVtE#1_j~Vj&y$(W#1Eh|IDOfXq*&o{(2L?+)o|iF9WXQb~ z7^aXY%iODg1(*qvDGiEPh+qluFE26-HZ2p#1kp$dBLPIq0V=3S85JsxCMc6kna9FA z)8HrD`zI4_{JK5wwlTS@>d^J!zLa7q#R7pv8ED0&_w#gyJDy9;Y3>+VB1t}Qy=V)9 ze@|54*oZgYU-^B^dvi7pt*O1%#xjy1UC+e(QUL$euLOtxMjI zcLs)Q0I)Z~e7h8&=ocXF!X&491g_|Klz(eWy6eh!uSWu}1iPijHtA!0mjlo7pM+UN#lb|@&PN++ zf2Sn@NjCb{=_;4&m=xIV^EylxWqgdhU_^zOP+wUrN?X=|8en}{e0*pDZzUb#<~E4U z-TCn0oE{096@%gTzW7V{q>vq%jj-gQlV-#_S;y5v`;(p)!#Z)f_k=x(yrS%_3gwNSYI9e973=dyRY4$6+VSf3olyLp>tSYapW78y;AZ^B)*6E?UlY?v|oHDv$Z$ zY^xjl#=qi1RY8A2H%pfL{H<$X>g$sifR%kL1JPW_Yf4@sd{{uwlsY@I3YMz1=@lqe zTrO^yVWk=IWbD_1Jvsok0;3RPok)h%DjpCKvuNC&{w>c(my~Q(*i~_%hyl|#Z4E_@ zkgE&tJ?dTqhVsM{usF-_t#vNa;8rteIV|>-WU8(pH8D|?$LeHCc))Ki(`;<-P;qb z0?~}WMilm#c&R*`iKs2Cogn~~A^eYJ-+%&6Ml2LDCK!XGI1Mtr5T<15ztA}&nY<_REJIu$;EgO3?7d1WnD1~_^u`YQ0Lx@MEe3X=^C{`F%?K; zVJ3^R#AOW|PPP?L7H3gODIK1HP-)`aairkPO|b;zdyDV!*X%BVPMyBzMtWaP@KM}{ zvoC_UP;qs19cL)H6esUi}(A2+{9T!ql!}Kbk1X%}H zD4^cDY;QzYO~n6eECao0r>T+*Da?2nR++RUB4K-zOps;Oinoel^q5{3mind2S(R2q~E0c1LKxfnYBq z7YR1=fH;ye8b=<@8#{JT-|}FuN+e@}_;50WS3v`xc~U6WRQ_4>pN=w^2r(&RjH*@k z=GeB56_x^eCyeEDtr}^^h!CCMTSjZ=o@JHp5z9X+(;3myyiJPjwj0eM+!@_SqjP&t zBMXew+d-Ol$|!{%FpWgK37U-hX(2Hla0_X;Zi10AmCWwsA8M0(h~8*L=7KIQiafUU ze$fjK%p+aRzZ;oQXh<4xizK0>*_rU(r8g;<*n12=d+4WjAApftF95A^ZBI|Ui)8Jv zoHanEOxEtdn7GU8ca!%Gyp zkyMyr<{t7b$0hqv6`_0B1Z9v<4|S;WcN1VyP_D|@PrhcYQp&sjIe>vh7w7%cG8XYS z;%K~|bjQtPB~y;n$_fS!wcXAj>rSo3_jG&c#qSqA zwbeH{hf;3`V-28g%t!<5q2e3{j5~4RGyB-*%v>E@GAXv+16L-R;wxKHDWu#u7V4b{ zi4SpE;$5SG#D5#SI={1MtnD2dE-S|x-m`B_Czxh60Ap#$BEeb^2?`*;@qW_Z1x<{E zphs-VnhOHLLgLGZhKVu7xyAy+t|%r1WMw8cA?nBP9hrU9^JJ>%(pjR6O|88QRedaf zzfW?-Pm8s2@j~9-MxQEK)+z$)daV@P!xj}?mRs1idv3o!9%V$(d*+KYgVo!$VkJzP zEgUrj@mTt<6M(uu1R_@87fO@BMUYu6nS}X@cKHcXv4*3c+6WiS{W<(O5PBPdko*8L zp2ST6IQ_^^`!~ST5Gv5tMe*Lq!tv2H|3cmK#UH8yMH8Xy2(dCyR!tionHGPx@WR0Uen)>3*x-< z?6LDPnz+REZF~f41G?&h0@kE&r?Ka^=T`I$n9Q{-yRdY zQ_uMNr{0DNv+id2z7?<$+(R&(;)}z zXf#X+E??}l>I*8(anrSfYH8@RNf zi~S}^Gc6i50qrl$H~MNR6We9I|> zhDu^utlX}9kfye(15%e21ouasx{9>QGUe&6G;f^MLi7|dMD=^Brpc2TOIWLs@@Q;i z>bmwi+lm44uYu6r!>hymI`{GgObSc}mw96a&tMH&^>_PF9;0d~M z(#dNsoS1e{*K5;sX#n4bw;W5+hkbwLGO9qbwVkz1O8|roW&QQ6zWqh*T|;Gx#S}CN z^Ln)h?@je|b?=9+v`W^%m1!ds0(7FKd>&@@TU%Jewv^9pZZSD1JdeCeJes)uE)}3YR)5HIyWZGgf9IT>;Uqgm_ z7IsNnjxYE?Sa&eQcyH{d0ti}KQ)lfwEVV6J{Y5q?x*@p!uP7jN1Zqt(cBHo<& z3lTSh#9r2GV;cmVcm4)Hqn7}~9u%*vpOxniF_)SLNj9|Iw~egh>Oq{WR=O>L7M z;t?LIEiK_4o0t>9wCozO|BJMGwXcHvhQSDNEv1YC_0*6-Tgehyj`Zwbi@oVb{n|`r zU%5Avs>EK(M9Un^wY3fx!&;;*+m3P&EY8oHG4+4{1|1gQ!VZ%55WDV;P&>~@!?1U! zdUM66jba?tPk28-a6QmZ=TFOpp9cjgb7?s>&Yb#v+?g>2+fEJ32WjTKxZ%5EX5(f% z;M4!J5hmoCHzjj3TKSvI*=vxH?BO>bj&HEu)7&BZPWIXd2aIQ>?xQI7GSxwO5t8z( z+$xvmxKcrX@G_Y}0%SUrOaajg?EIv~z^+qC|7A?V-!vIJLk)UgUtQ^KGvoZ!EuwCC zh)}U#SqI_1i4YtEm}}Z~mqY!V%bAdgx!5DQe?G%n+mOeUIP0v{iJs8kC zW0JQD%=f9(o6A~D)wQ%udXm^?tT;V&bT`})^q!gBfs>vu9F}jiSuP)8IcaoG8h!(# z48l&up-^mBwpTORx6SKWmC;CG`P!SML3XJPu8-wKAf@3xwyZQy=u1N=7FNWV>&G1e zvH00BZSosCd@?N$qV<2eJhec%>L_`3`XWI-|JM8IUlrS1^sl8E(v=?WbA6O}#IOOW zcYPU5BVF26Pr-;Jf*tL^aClwSe-y2X?WX&mRZ#pKUUciuizfX8Vi$9SmCF^uSOhQ( zuK)7aL5fF@YSZCOI2|$1`23Ir9jLH!`X8R@0U2aWN=exi3!w%U**s-(8vh)uNDPDy zm|u#3rkN6`pzjAWo+Sz3?jXPpY^1e|>$hG+IK_#OBmCFut}ZR5YIb?S`Plc>Vz#*4 zC*j;fo-1ZJ|H_~84IvjBX1D8`P|Ujf^&5S~YyDWVohbgYo$}%EGk=f37r`N2g-^Jx zFxj6gpU#=HQW8!jpI@G5adw24yp(zEqcwCooU8XE{^`y_Y(yB?XS0uqxame*Pzl-bq~!b z@vvLHaHdu~FottRiKH@g>%H1P6)ok9(q%1jSZp3=6)!(J*-c}%*c)HJRF4KpR7-+= z&MFp%4qi-^4me`A$O4}gU7ijG6bIj2v2+u*lH*5QM@wQJkgNi=5KMg#d4E->p%{8G$ zvP%ubgW(Y|4H%&mI}#20T*Gw{A_?k`j+N5q9z_H@$cnBZpS+x&xt#&u9ObB*qYQ$d zJTZni)41!1b~wOXgBXCK_r#-9J03$FxzNUV6t|r%+IQvN^POojUkBb7t51bWjnC7R z=N0?`Za=ojY#b0hz!vCuy2_}~MpCd|#;Z5G5j`Tt3k4hAJsKI|yZn(13u9Wrx4GtW z9xTA}Z=h*(C{T||?zI3dGEFT~ClSRVp>S8WX*4;*aG7!t`#0D4&+d?ncQjs*lyveDo<~aF6$5#j7UDzDwaR{Kc@OzH4m->N5;U}Bx#8-{Mj_HN$g&f_m0 z%5rI6JqE;TCAIDCmG8%f$0i7kUv22J>V!SME-*yXx)6d~xE3mOP1Tkj%aq_N(7SMZbN3a@#Nl zc<+L7dk_bB72$^qxP)&ghxe-IOWJCtbzH~q1k|zWPPCF!gbME!DMRR`N3vsl`Tn}mG;=_)N(5lKdA6Kw zoEQbsZA97j*Z$D0@MyNMkSTKxun$vuUdo>#Z+M{00uilijd3MXrOILE9!11tl|NS7fM!EN}dCZ65ffpRvGAP ziWLUuGrgf3xJ;^?tjg`zsl_ft55o#u?i)XKdTH zZQHhO+qP}nwr$&cs`l=~)_v)8Qq_4$=12f(?@kUvrz zJkB#~zNJCEg!^df<#>qQG=i=&<)}(Izw*`mgYi{Js9^b;uP! zi5C!gNku!UMFa`AP+be0a-nm)vM?{f~x#12KhkCTG85GbI{*G*F(m~G3 z8hC9{LsgDFS=5s34^NSlvEXwQb&R9r$V!`(-s!)FyR~pXJU=aGwsI7XTfFb6z#s)0 zP<{0gl1aW^uhzxyXGtIE3CNT||5l7*O)pYP zpER1^xozDJq@SYVT}7zY#xsMgS8)Zo(G**{Lfk*k)b}De)kuCOYd5i?naGct&DF0? zaPzfjQGcd~J{$Q3bp?9H$bNzOgg}8gy7f%Yk@k6d_VQ_eqZ|L z{C=YSTxOc~_PBi?_WHj4q~`Aah}2?y?stIcg+zodKHJbbNFaC3OL$@0Lf7{ju|v9JJnr{D)Bp-rG4 z!zUyF1r;X1i$ELFp_EG#pP;H9JBG44HPFgD?SKsWmdhoP5@C6@P!OouaJBiky}Ky> z{>xozmb3kp5c7F6#um^XdL%T#2)v5*hCcAwI;~`@M1YG%j!~!QGu%ISMq1G2V1yg> zoCqZDR%SvRLZW1cz3L>8DM^nxx%?6mQ_?Yr>cs>lqD>L~I+O06g;IMngT)EM;C}>& zJCyz2*?hOFXAe>cIo)jc#UYGF9krLrpfQN*mrm;SxgAB1u|u$qaW|NPk0M;r5R#|b z!Pe~ar1xd;V(QYJGopAclMF4`H6!?Rdwbw}SNNx#xBEDNU^6zWtVo|JBw<-X_YK6g^u(&UjbDoC$X~m@Dm;85%p4PR1}>UwaCL`G5_|Cpcv+Ba2@!Vcgw$XeK zGU+@`7ql?klw~)*r}bOY=O~1r8o$p&YRXWg_dCK@`%$KCG_1JY`H$c%=8ASA=6WrT z_)n`vV=RR^fkJ{K{^6+6_wT@T(q-BOg)C1X9M%w%%q^)IN9<3jXQ_lKlqE3I2XryO z0j`*x)5o|3*K^e7+}&{0^Rh!#PxqJI-JEfC{-3-0z3^`?YR?(rX;s8QS}Q51tS6LKfKC{cp1;wdR3cK0T_e9HXDlYs%=8K~lAXBv@;NhJ>G*Jw z)%7oYX8e+fv=(;P`K{*hu>v#laBW&_qOD;l9NsI&R0pbxC?P^GmjOI6uU<(8(Le2B zfN^F)ij80TWT42|M<+X1_4IT(Dw&hFHn9HstBZrTc4oHn@$urTi)R0n7!lU5a|VJ3 zx)mxZ#v83;T@;ds*zTcatr&e#pO*%aZyi8lIX#(Zl4>@KCzf{^ZahW8xG1~4#uwhA=Xz%xA&s^rMFh!8Aj)mIPbCewmZElbkKh4{m)eC7u&n>^=i+n1z4y1 zls_WXx`~14;ImbClroGR9-7wxFn-wb%BVDr$3v^}d}*w|hBvgkHCp5IT}$Yvz$*e> z^KiC$5q+_QvY>m4T3Vj^Y`SnC7WbkjOJ+zB#W)l%PK}LV*)g)4LK`)wq#(z7T8wdb z)YnP(>*G+A{^a#Kovr`NbcrI~`Q`(pRvN%>xD=$C^txBs)%r<8L3kV(sa*#H!i^5E zpQl=$V`5xrt5t=VLuXbr?^_o8z;D$k{m+9-+N2hfaM>w?CoQy|3C|QNH!n2S!X^cUs*}9pLQW?OVd29qU~dq{sWjp6$2P-ahoRig8YT9$cE#?K^sO?O-0HMWg*BX6 z>;2FGA4zzJIss10n=2oP(}Oo7222>$wGq9V6d0Y97lM5OoY;cqWuu60;kfpT$oF`V z)>S}ISUGc7A5*l_zg|cm1Y-Vgm9YiHWYRSD;1ov`s1z_2RIIl$l(UZUFjvbnMWDn6 z!b!;U(pXyhN%cd-3Nvm*C{3s4?anQ2`S&>-Zz2#OQRcUAAOa$QTPCrB4(fswQ4JsC zVVKE`%R3^Z{3=<3w#3Il)X^qEK3Pzw$y-DiPoZ_9ts%v`4nw?l3+E`CJFiCmtz2#$ zkIYzqF(-Cw*P8(JYu+_#l}fsjv5x*kHYD~vmx|}t3GKMaZ=@m+x8F3bx|1$brZo37 z*?mlK*M^J*A>F+|Mbvv#BUAB~Vhrf;hiIL1v3Bd{Yq78 zd;q9HN6tpx%{vo>;-%IS(9F}va${dQDq*M2dm1Qm$5tLLuE`5|2F*g6Kr%5UXPHOg z54B)^=J3`w^6C!s_l1e$_v)^Yh>GVlOr6H#Iat~xhZbCx8xXW>gHCl|Tq^P_)||n|^0}2MyaI2myPke4j~D|}@F=3l)p~Ev&ezMwd1dD1DQ~yO{nN*L;@kXY zswbYv36!qa@7Hr|FVC)5Jx(z3-DVu{a+QDO0Owq~ocFkTWK=+!ZwOQI>+KT$!G zZE0a_w-f4}q%DRca0qryw{hMSiL5{JBVK#(xQcy;qa|Mz7pMr_F3M~3L*hGnN8MsS zsoXlp&ZmPf$}#jhm96A}?u*4a8lS?XedKDi$|PMK|9932TF~`Rz>@mdXyJ@6YQ&bv zp{Kjlp{3m@;cL&=)li&-O7`1v(nCZ8OM6TjYJqf5o?H)u_%ZoVih??1pe(_NQu8^l zsX`OMi9{vKcWTgugo~HKJIi{Bz&p#OEF#HflrGtB%`csQ^@QWnMx8_0aRv-!)Z>It zu9;eS=N%&l^uM`iWkE$|%H#5PGm!zf8BLtHs zp#^FFJSKjUm0|Q4maiWu-zZT(U0_-5JiB>ip3z)K{t@VrO%+pjZ@4p<-weQAI}AW* zkfHw6$yq^onZp|hyvKrE@LgR0+^+!P~w$>Y>MCZP7vN%HgcJ^1TrAloZ2S;-AexqZ@Z3@6_U$CW?OE+9vga^uvrEPYlmaUXw`LNfz-OBH#+fH*Z{ z7j^XS;eg)FeA#Z^NnSmF-;mcGiMqj`+UvLg=y#G+57|IVvN)ekUhzDbF{mf^pX6K^ zG>^igwe62!Y%G1bQiDgI{;_qFK=mEfs}2E9YKA>AVj`u+8=ooCjm4R6k1!(k2Rb+7 zJEuJ{$Ugm1@|i}Fi@wKWT5#bmyl+eCVEb`CrDb+Jb$xj~AE)I{ZQk@)f`5_-B-7#p zo9+2;VjfN|bPB_O+AnhL z>7{TfH2nEe^nxy6L#C&R(x(=l*JuM9^>c{|?CvT<12+v)1%g6x*4emQ z_(SW68EMgF+}VZ*XI(w2a1*G-x&le}z*e?k@`hoFSp0_yBOfBc!bOU3IScC02FR?+ zO%^D#)hDZsR7|)2@awZMW*bPh9Y@Fwm-kI6cG8wv^B1IRJwKS9R=g7Y>{y-tW6uaf zn7LXGT#|QOZud`C1Fmn60>A#l_|J&Lc4p$D^I1m*u0WgTx7- z29O*CI2b_l6ICe`k1}kfLvT5sfAN~N$;aN~M}Jec;|_uf_zM_&!NeRnx8c=&;oYs( z9}HlggF4!3LSrT%>W4d}x36P{X7Z=a0@fQhINGDty6x_Hw)RgpIY4t*Iq#cY2~|N! zn6IN#Mq#zxrr*cTEi@BTua+Pb$&)$QodaVWaIZt1WCk*T)xIR89qI^!2dxcgabC4H zyw$miUZsFpc|@Na=*$HnW7CqU*>Rw|{M*ZH;r_7>%lm14kCzlih_=4a@!<5H9Bv}& zkN1_t<%J??Y5uICr*I-lhQS&WW%Vv8;EJRYKl=Q#=@#yE+%{dnscMO^u~$c-ihVbI zgy4Byo(B3bR*F-$bSHYK3d^;kO0po&}8RS*}3mHnLtbo`dR!4gGT_unBzhVN?^pqCYyeLvo|_|3rNH z-VzF?*|XRZi~o2dL~@B0Tf+Cx=|U_I7FGe}FNYR^A%^gv0I9hTWcr0+&Vp9;!MVWj zzsS~OCJv1{AHo)%?~SUH$~r?Qeo0qZWeMI2A!L!@6(%ffRL4$db>p?b6eMEain#0? zXMMXV-R|y`<0mQtRp5Sglkjf?RW^jj}VhTQ$`&MeyJU%{U@NLIJrFO8cHR_}1!xG~Roc zYW#72Q>R-Rzc2NR!Cbf+10nhJd&%hb^q8Cvoi7e2y_jImu|JaW8)nP8^*i4#K#7xW zXkkvn2C7=0wh+PqOwC3eF;{dOEduQ-6NT#U9hI>VhS8jZk5Tx&Yi1Ix=a@+ZhDAXYgjye>^Z{z!XuUJj#>V8X!X!R%|cm7q~xEuqN#f+Ub7MB95*26WbJmcPYNBV7tX@=s%Hr6M3rZJFrWC?ws-z?wbHkJ=(|G=0=4$P_7dacyUgdTIn$c(XC_k|X}kY8)9Rv*EAt?- z{GyH~c&6D?>ZFbnZDw@sAS|`wgpi-|2}+^%C5Q;2kdf5#<|T?iu|xvoIL$%^+8VcU@C*J2L zn{d|sBlCEX+bLWiJJ!O4oo7o) z5EUSjH$WuL|D75@8z3qt3LwXCbpW(|%wa;psKZVc*2f&#QjkuMyXza5hXgV^Vl;ZY#y;?Jp&3G-+Qp0r+Ktd(25JnfztCt6(ViDg51fxVO zX%packN3c=kWQLNlfzPPrVZc!?Z|RD$F9HE02;*KDIJuWuGnMn!xKz3vkBu!`?V}) zfh(hP`#$*y<*!qFmDicF@w6M8t}rq1x6+b%ET*_EbW8g}rhO6x(#E>{C8Ta%;C_n;>GGS-^( z#C|!iq18!!q{H2tAyCTE&%#+Br?W_Nn!X^OB3viU)-|$Tj|*zOcpv+vI5}utaMKv| z8OLb1TH?D9s#g@;jIm|KWwH`PA|sA$L2@WH$|Rr*3@ZtbfkH`bP|SdIo@OsChUrN0 zmLoXVtrnQ~b8o^KU!Q2pTAn89$%t2u_z0ca;^5hNE%f!?*~(k@w^?0&17O#0D1C}; zpUEqMGu?%d;3hw>lj@Fma~_t<9LQP{IT-xc+Zm_p?VTdcQ0FW%7~7+P5}|Qcw|asp zG@SMpC<&$+!c$l0yDew3Re1?(@@>ChCwS`VKAJ;^wgIgcQd3u32S!Jy2ffPzsb%E* zOg^~UvjNSvcehhm(I)m=3-wliFVzN%)>7$2PzS}>rg9Qb9#xa1_15!N{k?wF7wT1F zc||M)iS#4Wh^f-Ug2BJLxY`h%3?EyS739YfjTSeKqTRU-+=%n#I2Hw-Smu>F>qhg* z7#Wx1Z$Xi$TQxJBu&$6cs1TFUl^XQmSwH$n3gJ9lq3wMx&-w5(_ts4Rg+OTlU8c7h zUm8u)lm_wM6sfp{I!Nk`J$#8b2Mhhw$l@0Q-xOZj7&G`ckpCB`&S$UF2>a&kaAF91 z!n#_?7JR<{5rTmG6w>+6n84tmkf?+@Zb%9p<^Yhmxk63@)0BbD(vI8r-2+TO?sl&# z5*v?X8;whUl)3sIXz+$U2oK>B$*o(B#VGfj%w2ykn{uG9P;O$+S@(C04v4yX)IIP9 zDWz_sPuq`k+Y9s7G03Os$p)A*Pk^9VkP8@fAx33-PjfQ3c386rqozz(N%vTQ{eD&I zK9pOf074rYt6w2_=_>1)sE)h`84(2?`n>m*TCa}GGV-Yf=m52U=y|^ zs!{EOE5Zx*yUC?Bf5JK%5?1QJADykLtE#)*Zq96RC6Mn{EJ$uta6mpu#KTW5Y3;6_ zjcccj^>^Do07t&vf8KRh<9>~?j$}Waa2{^4p6t8VTVBi{#44LZ&qzrL{xT=gl(;+~ zFO znH4oh%$hSTaD07M^K2nHHGY_Ff>bi0+AK(lBGB0DJggJ*3niA2dq|5j*-5DxStDWs z^0pBvFqXH+d@6F?#aa^7RnapWe44pf!yu%hW&eBjdkKf8LM{H`oLE9q>~%EHG%^Qfi05_Q{jX9HwzTP*8^}M=JlW)3LaUCb$-G~ z#Yjc6!hl3z?KG)WVl&8+qD*0eXr+XsUy8=*Y?bex)fh@YcMQPCF^H=! z*Y3t-Ql$Hj(LQn4Qlp#U`=4hLWt%QiM{UgV+HuLylUwY1oS5ZWm#~?Ec1)Q1-CZu% zk=K<*^D?To=7}{#F(#HMIcN;?Z8$efP9SSgz6J;2zwm4%@Jh~sKQLlTl?FjO<7dHp zWoEs2N-rkRrN+&6Q(y|KmLhC4d5e91&$T;*`zAFKiqu5-Ha4oGihQd33(zSxAkMoN z>1B{!%(9f9o7gz$agPUtds)XQ`oaD~pO}s+SyHt#g^TDjtgxXU4hJ zuP6P;AAC2Mh~zPMQ9J5Bw8%VlUkF?7rtjS#FLF2C-p@Oe-NZ2Gs9@|1`i0dIv*X>G zp}xGYE|PQMo~?tQetO`VkP8Q6wV@<>aXY2}$PF(Q=R| z4cS4hisr1cIOR{@iO$&ZB>IT<@mJeWmcx>q4FEi}zdp|&qpY_ymPHG|c?*Ji4&}Be zf153IwOINfP z(etkMuL?#BEC;YnNxePTjAK2cbQKx=ej$;iIuu+mModS1Os-5vdh~a?pEbD52WX6} ziX=dohJ>)i2?vKlqM+0u_{B;Vh0OTPfL^JirBWbB(q^Qrgd~hw>iu0UzI1OGo?JNW zYu8?S_BA z0J~6rinN~`<>k3yZ4>EdNZ;LfUO0UIJ*Yea;6 zB9Z74{P8ZU>WkP$9#EonGnogpuhA+X8C0(~(I-dfRD!t60SFSbm!3yOls2iA*mQ`0 zlgD6g!Hsvc^?ZZc!wa;HyxIM~Fl-Jk_nfyP=r00DB z{UG^E$D`_*BE^ZUr_@BA1(|9W-_1a{azi~0qqb#3H^5%jqK2El=|=XWg8hpX?7I@^ zFyz+Z4r^3Ka_F+jN7Eg$$VW>O=zfswW2A=l!6Xyx%o)W8#~6gemgB<>h;Y>f1Tw;; zO2U)sPW_W0AUBEj^QH7Ro5&$mhjg10?5-2hE;D-TIbSdKR4XwB{U$~%Z=>LJlqJbj zpVUiN&}cG+fVXij1~h12%O(bHG6o|1B-`z0Pz@i>Hq+r%EA7+kP3Ho=6wo`XzaMdp zs4sYXy*8C;q9aO$nJ=rQ5_^If(8@5s*zRSg5puxE?O;Y5L!Jkxi@Xn$GUoK?F}A5q z^zt`{xfijx;g*~@CS0XyF2rbo%%)SEYxCIIibfS%XDCyaZ4fiATNaF&DM+lp_StgV zwd>z0|(&7r>wy=IDlE4L+sAm;p zDCQSOZGxyU$*ZU#Xd>FvD3t}7Nc5*lP{!X=NiafPT0)Drn-jvR+IsAw7?OTej}LB; zNc^!Z@xG%YZ>dp9|WE2yaZF*6cuoNi%9%`9EV2N_P0Ei=es-t#E?eJ>&Ul zfCu8`_vZp60QuT!Z&F|BoM)55C@QPGM1LY%^5M!=l!G_xMC??az@F8h*f?RJcb29V zcJA0d4tzFa+>)MQ@1x4c=f@*5R!v>)2JA;?>*rFMK@%c?AA22ORpCIZ65Ycf)b&XO zxUSmn{}HhjY=hVnK(B7zW@_1xo^BWJ^ZVR*#B35JR&~vc#uM`(6O{v zK3Nk&RuvU$Z^cBk@>xN-4BqSnfwc0)X*h1q_y^Er@5Bk6cb(&GyYy=ki_C|*BrJRX zOdZnaXwEHv{@?=2j& zpmq5{V@7@p%PT{NYclr% zLIQKt60U-xL>LMg1y`&kPm>F=dI&govSE9J_*~zQT-VCPHOIYY5QX>_?WKN@i{%H|%pYbP>VKASOc!L#hDFWjbn>QVZFw zGGi7ssZJ0pT(*)#TRoD3%xJO!MfA~QuK?b;$hxO>ncgbMb0bsPT^R2OBF>;i!y41H z)8(c4pq2m&4oyL{{BGRBRs9Zoj_@HB>j^&k$|vi%*{iqOJgHZIrju#RDW3ulS#FDHH8kL7ZIUFSNy zWbYoDb9XA{JO1zv7Nvz;(TgJ>R%h6(CU5^66YI^B!mObH%|b&HDKk(lf%-V5pbWJX z1d(7VI+a%Muy-@V{ET5#c-agM0y=%_R(&urV4iS93(!*ne@mG#MT>H8E1VVl7MaT= zp5rwRpS@9sDq*W^HvmcuoSZImeP&8<{BzMS5M)X&#VW?(k3oeh@Q2bn*`Zu92?KND zE$JvDhK3~L-0~#33PYqt5ZD%~C5794*;@cPy{{$yy02?b z&T)EeD=@`<#ZH3Y3j9YJA0Rg@_*~56-b&ADolFy#v@VB^CH+-g=TA)MIj{99R$^-^ z$K7www}%XiJc-=utgAx};ynbMB{e6q}=u`E% z6!{o>4#Nz?&GQoj(n$X<=M7}#JN#LfZm~1E(+=lODQxy&%p7~l=ulfD?#5T_>1nD41;NgKU@uo~V6Yw|*|uO*El|AzQAnL6Qt(0U~h$)1UbP zMh2D;=5aY&J~iynj0`bhE~XU8jFF5X&qWKIJ;)X;a8@^~^T9*@L^P*CD4iX4Ko7K2 z+75&1b07tl1ijC5mFY_A$OUD*I%7Dm4-iv_wzEpsL!l$iAh=$4oj^U(Z&%{^ExGOJ zKgxz1rmcQ3qAj7Pl4kekwmIB_#qYv*Q|&_BuH=Jxo3j>hH`nO`E*nTvGxD_ABRP1lB^YzcsR zxEZeT_;cVeIXwD64M&gbN;fHmzSOA6rH{=VxE!vi4Znc?T~G^i!)=MA0nYTWLl2_p zq&Fmpn*RhvIG=({H`XtA@X?-?Z&@w&)`h*hOf%Gaq>F7U#9UMQw3139WTps^#m0V% zAbu<)$nzvoYDsru#X>u&B>CGMu%+dN_E}ix<-kl1?m)Tx9zd6EE#6OS(DTjSRQy`b z=tZMKMB$!PTK4Eh*=P854pN&QE7e}g|6t3S?n>JeGt$3B>?UJDCGpD?Q%)vq^+c%U z`gXSZ8bB$=!sENS|%JsvYRG3=zRwTpE&19aTS zYEruIq^vt@a||;II%s^-k8*1s=|jc=d{)p+K*hR6xTA9CD=RVk{dY7Yn-4^;*$))< z1Ds*NYU|$g{7@}wN|Nn}&OX9sd}kh@l4+$?=@))2vLkP*GUk%qrosF!Oj^PZ}(s`(0?nrON>+ydR-U58S5B)6JLwziJc`*rVGvUjOACaG}`!W(j3aIV4y zgjK7&XRml^)@(3+0XA&9g#G9y-qzv{t3o!TT&5Xj!nj6%IR~$K5w>>P&vTi!Qt-u{ z3m9-1bRQX~}m=|n* z)SRK;ea_JhPH6JBv0}e}ZnjBxfOM=_^&FCK`WB5geavfZLj-cIKeo8L}*oB}U z&+W7}c0-aiJps~Zk_$AR1pwH>WiWoi`I1>3p(|FM1~E{WbB~iPr`!$R_E2aL(7G&_ zRk&=bCl-XS`-U{3hNqFEL$WHv70byCCz3Dr$@=R-d}-&*AbJ{SYzyW*c)FpK`np?6 zXAZ8n__f;lk|#vcwxyU0{p-uewHJw*Tr^%hF#-#H*lM%6oam=BtB&8Cw=H;RF3p`_ z+?RASS=$TCPnQLTpJ3euw9TD0lNw2G*k9vkvkyi6-#2$Pqo~>tVL%F_JYhDxB0R~f zB&|ZQM^Qfi)piHBS{q9Kq7+cqLDmpY2g=g^(OQ+xJSY*5Ytz(|@56NnVQEb&i%`I( zrFm(+Wj75;s!A1>6xUD{ix5F%cRb;ran;#X&%@@mCF5DCaZfBXASOs%^=LOcqVxXn zRSJP>NMl@(36)01cMvNGY!&CN`-LkLuo6S{U%dxp1AcG#v=l@gH$B4QP5V7tmJ!GF zekXQ{w*xS1gW?EobT89<>R}rXUfwF@yfPgm%~<;yIr9~pVB;Mj~|*o@%|6|aR1VMHO0SV08ynFl7l z_8Eb-xcY?v;&}RW6Zxx1rAew43Yoz;N(8W;lXOT$^A4bNckls(TU3_{^xsE^F zlg)+z=ctrh)0&MlSTUV>x8UBXtUdgbbzdGee_{%wbqELHV`aal=>chwH_A=fT;k;N zA+hb+q(wtT&PrC^V06=BZRpbYdK@;Tl`SN~?zEDzjqXL*xMw#-w!;tR{?+o7iqp5a zgZK7)oi9h`b|cgqaSDTN+O;1!E53(fS~7vBdhaK!k?-rXNWp-*>q|QCdcsIRwd`7` zrM*c%hm;USBwr44r52FmIPq!+4Y7f?(HzK0%m7ycH6hM(;gjkOM#UtZ`5lR(o;>QA zw-IR%hMPG7vsca5TJYi0)!VH1}Zv%Zke{6hArL}N={fJi8Y>rvM#3C=Tl%QTOZ&x)p zr;n>o=f7yPs{*N9T>J4V90_?iZ49rl&H9i)jyM|zOruYazC9Pq)d3vnN@3O&-MpJN zG*0ZBP=&4R}d`NKXStpL3ZDZ;>7d^bjW+ z-Q*NwAHtcz<_|RhKxYpj!e-L zUI1l}UeICf0TIAf)Fu%5aa|n9PPFq@YZOuG{kLUUNqnijbfCf{jmV~aMYA}M>D@^U zut3CloTLrwPu2jS{LZUTbXEgjS3F-b$pT>@BrKUefdi_DNu>^>T40S7_ClqnDokUb2py$0j z%xE$Du&?Kit!}or>(6)OZqGx{H?J+59~|!&R`1*E`yQ`7rSEoy*r^z-?lF56K%ZNN zd4*b+)#zUcTiuT0$Zrt61BJv zl-~L9t?2Kd9Ckjoa-k|SC)&;^H6W^YV?aY=gKM%vSrov(%K4eR5<&b~M4xdU*4gE}?K46JuB+*BntzFG0NGBzVW&n3diDU#G{mU;UW|Fb zyfCp9MPoP?cO^_U8qaf^W{iqpoh~BNCecwT{}@j#5}CB?hu`T-J3yXFA=3HViy{@#l!dz{8?|P7%4M3x*Pe-&)BLMe;I4ZMiL$R!`*La zgwNM?hf%m47KV0L^LXfW`1h8PAeW*>vo+RHWGz>gD<*?LHmCIl5Q~`w7+OXr(6)g@ z4d&KLgSw=d+!3hKj^CRx-=i8t-2Lpk@-0RqSg{Q9f}yOFt-uWY)EY+RVNCDDMzD8| zF0|Pvx`hH&np|o&kR1Q+erV9N?{mfH(wk8@BK+J@RyJ(Z@*0~k9dP0hV*F$aN?P?y z-JhM^9>MYmt5T%ze4ORY zC)bNG>POuG#c4ToaL^?RHWoRO7x0RYyZ!yk(^CQZcD0^%h;0-5$})<&4tXeG^ziAe z&bMD4s^;Ct_q9(LurnjQ@08wbq5pbYA8JIJJtQp6c6tKX32yLunfcUmdRe&vxdAWR zo(+ZN<%ZY)Ij$cTCYO)PT4aK#ci??suGK~J!#qiI$b z#x^cGy#vo)r-q&pEQ+{NnWVXKw_1n+lp{j zNV*c3cbo_3lP1)PPEL0Br~Qs$EN;uraA)p}PIFi_=fytuASKX0mq$By zzAaDm#(;*ywVBXutgSHGGywv_L^0Lc{?cR!0M?OfFxQ6E!vKmbI3xEnq-*G?2Je%h z(xVnuWyzP^qj2k~u7Q3({sFkZKJzG`@{AKODWGq7=Svl&a8RY7g1@)NjRa6=T65J0 z@9}=*Ca^@qf7n!g71@G)Yax>a+AFtLK(H8TaJBIgVZD6aRLya4)QX2oP8?x)PESdv52zO-NxwRJ@oihxijW!(N5H15GUGn6wF@E5$VlkjRX-|?5!QPP!9P`S36&1LH zA%ANOWE(zs*v9OqFQ}C%LFF^rgc>A@C@;;!u3;&;2hDcdj~7Az5C#|YlbLIJ_f_78pv!k+Uvxu+=ybm~ z10!w(ChuCODH|Y4+Vy@}U-Fz_skUP2_M~xUW9dH51~#srd!8EjbdujWlA1m{SnPD9 z2pv|PeCtJ0YSKKWSY@PdkG_5Q)6bPO7*sTN~$D>r9C5gQCqszG18h!mdm&wGp7kApc0CW zult{voVVUx5pNG7kE8a^FS?0hypZ!@W;dss2T(~=WJ-mGG$y$g^LY4qN<_T_o4ToZ zdB-l~W$-@9&nWoih@iLdUTwwBk%!bjY9YqQ$FN88<8y;9Q3X83W_>y&DfsY3W>U!3(UijL0dyiWK5@Ns3O-p>CyR zqdUDBdq+F-9NDKs$y_35VAF2)Y}q+#M9D)7Co z$~+YutNQMd+@2a`*-wNs7o$k_LoRJI8hBS_W1My!Bg(qon%79$hcAl876I2*{+y!+prr-4QytBPRrV|& zpA_`$PoAO!k8%fkl%;cc>z+$HNK$MazwU~&ySQi^c08#Q2Sp@NIjM32zl>5S^PqUCDzNU%viQS$)L-Pv9+~9D$Q;Jzc6ytaXbz~#=jKP9Y1>tactflJKWD&=gQDvF8x>)==ONC=O zL5+&DPd%b({f>IBNI_<2aZ7Z>{K_ejvNZznT}03?h#cqx%er~%J>@S2=NekzveSA#Ps z;g={Bg`L(4Vpxnro{t=;AN~%Q4wC?(gugGp8REu=sq_i$s7Ji!W=e2mqmf)8?R2GHmbBLuPgRYh~j!RnZXTJ&DQ*tvAXuE;0+ zk57XGU$cj~r~MqSDMm)92I(gcZ5SOndRq(7JNL$upE|6T)=#L;Z>g)l9^WUcpCnJ! z6!uiDWkcXFUjW}E7*_^uU}>!AsvSys8_nWI2vBUmU8$kr;=sD)a)Xte%V0arJRKtm zOcMe>d_%(ODj(z%wfWkiOZ6EN@@ci-xo>i6oXG6Mkj$j{B$*e4WYe_%3Q zHH=DkGP!Px^LAp#>SKAkb7vmDtQ@p$hv`klZk#W-DcJ7l!J68!t|#7LLkVj_Lzy)^ z$}LIDyNP|;nMbe2WNJ?75F|elmC~mEcibvQajSCgX z!xm9;gyi`xHUPF7D>Wxg9t}DWqJF(f1;?G?b(sJqkjSo`R;P#>$v`7akg; zE6bxD!0e~O_M#e`=}*b!=K_z>Ml*O`%|@Xned`D~;}fSv&}{&(IX(y#M5GmP z#^id?67LHM319Z{bRZr2qP|o&sk#sJxYRk-83z~tN~!3!WJ5Nn==j2|VP0llyde7I zQ9K3zr~t%79F0KN;)Ip9h}QwXBW>@XJjX$0t1k_HIJk1kZn<3(N}U^gF2j(Xe=BEB zBRn~QaQkXH&X7LT*KViDVxrpTyO*hBg6iX9(CmMY$Gy>tH3dZDCs4&2)_55+O%n3P zAYvHzOerG^mxr;YfUJW=?il8?P&5OCx(8a%jF(39E2AxYGEj5nvf`)|} z3o#hZicV5$esvsCpUNwb zDA(Xqk5OqtXLiObiC~yN70BHZG$6Aw95dhHwnl+O|EE#_4`OB&;9j(beBDT~^YtNf z8a_^u+7=Bh$JJjg4c7hlZOZIz)@As0EeheR8es zF`+~e8~Vq+^!SwkwfAabq297z6lsGcwEGzF-#81vy)>-FZIPXC~t?~CP){*hS6_#;$RbRtMxRfrwcGhfLk+=fZD%Q zK_e{tg*3;nJ9LAtD@+bWH?nR2_pf8`FX~hs_gs{b8Y9&KP+h=SK#ZBmrVuu@cq|a3 zWy@Zo2qOiOpE}ba!b~m1f?7}=q2Wxk6k^ITl|e=+MJfTb(+~si5FK!QIh9;UDb}2n z3v2o^x0jwwcdD6hol2y;usoaZ>8jq+)NxbCl#N|zVA^aB>j+NN?R12N3hNO|WGEK` zr|KY3U*9Y5_uIj@@a^d>FfAn%bc0vlOpr>vPDPxrk$Q_V(h_^bMK`bK??eigHleL$ zi@lo#f1W-2U>kap3yU)iIl-xm+2AuT5J+%wu%6z8WhO3w2?p>TeT?9oFb_4;?`Ty+ zT!{_3x=h~qIae|IfQj5q|Xpr71qPHvM3Ni*B`tK^%)v<_OVaDoM6NrA$$z|fpPwbCC^ zfh6`_atL`*?thq%tP;~Z=6kUX)vZSpL453NnTShEfy}?$)V%wGXC_8eD7*QSC)~!L8Hmq;!-A0$V zMr^S&sq38L$J(hx$!C#CZ~M@JZ9^g;ZH$Q8+#wwT@@}%9nV{={5jH6L;8Yg3w-6!- z3L9>wH z0QA`Y7YJoODtQ#ix02OrWrcj^`2Pc3K%>7C86>$cWva4-OYSq~o5&AR4(QeAMnr(6 zbQJoTg2h(L86roZdIYLRpn3$VN1%EHs(*E$8px1u3An2PT1>O5tU2I88TWZF*d?=a ze%qnY>8czD$*v3{;TtA|&$Yq-cSWY#rsPoAG>Wj?QkG?Lmg)az?`oUd#;x^V(X=0G z&ow0y1W3R$ooP0kb~AO7y|J@CIB=x$p({Usb z06`FVp7Zh?KlOPSN&%yd1qmpTNi0(lrkRKX%|x0K$}#_$q$r8a6k_PYylSHSHCR|d&d}&I>2PuuIV42d12msN>;if>l*)$(|CdL1>*Zlk9 z-OG!2A1e4ZGF1VqxO=RxC-I1YQ>tern=x*zyai-yT((9`8xhA=)M=6mVZH}?ssv z`VCJ|7hSrf&5L}b5re%%&2X>!*9U-LM|N6{VNiezZX15*F+8uEe5fyB#MTLo!?y6v z)#;wvqTQ<#=TMFvkQ+GSFf*YBq|Sc}jm%Zc=NH+g>m-IrQ2>g(9qZJLZ#57PA@0!L zZ#{4`LcDSdxcce!KNf+;?g(jF6X$Ce3|x(q+YLG$2spI?Jga+Kqmf32=KO_i{#m!_ zG%|8s4*r2oY<~G0^I|dyJxciH{$Ob9@E$H&?UOEo&$ja>km`hM;wYkPT({4-<{8&~ z8(gzyK|X0*!xW_f^>suvBQX8G)-p_qq$*2!7==QHERnt+!NcT%uZR#j3p16Zm~+l} zOI(8?Tc#R>%O$kuCkAd|xw9$OrkKpeWv_9Z|BvV3Pf<=ita`THm^SZit|U<Q z`pn1-z@MZ~>JTzhpJZ_~`YxZMydS(o6@-DIjm?>jLvcUG0i9R_A%3-jM9OBKW8*ti zfR;Ag4bwm;+Jg?QC@H7Wf(9U^C9^S?LCcSFedG(I!&39DqCYPQ)NbRQY+5LE*w3hH92v7a!)aQNLN<)RBU6k-s zKj_E2Ynew*ef~@Wo=L!WLjqP8&bWjPJQFgCSj1J7W;D>I6icj_ z_JzR8Ud(41`r;EQW2QHip582!IZ$RjbQWQTFC3yz@Sq z>T*@7L>wWi&QxY&ATP$ZyWVr%uzNakVCLa3Fl?8J4Qygm+&ER1x%Nt;r?(pB!VVM( ziz5juT*umu%cVynFJ(Ti3UAv{pb*>|lP-?U&V!v|mxMG$$NxkRP5E#0?CQZCjC;g! z7sYhPJ-#1`fzIofF3)ENit*KJ%~+j0pLI~pj!vU6h&rbWt)2vJUEd52cCkw(@s@Cx zvFy&v=;fuSva8=Zz};P1v)tla{k2%_lwF4FPYZFnW!;x@9r6qPfP{ih+pQ_}h*6-AJc7!i}n2--BRu zsWXQ{4G5A;U1zd%?sE9WnK55S@Y-4&YLFoQWx^O;E$+FC-Znq?P~!pn5nDYvw&va! z7a!06_2%sL+kbw1`|j`W&d%QbiV>3tYlrf39-CQCi|e(w+JlFS)^voG6TqqZx;a;X z-%yOl75^UITRS>NkJfhQ2VM0r-6jUXb5Q^Hx#ho_J{z5&Dgb*`sT-PElhz-PgCAqy zs=4wSaArGq`eRj9{MuOWyY#j{9z^Sy(M?F?KLSMK8M*dod>48&9Nlz-XdN=f?d9Dd z8gHRBXw8cJG$5xe>eJ4#k1+lEr_24Tx78yZ%WJA1knIlOeeXKW=Zm~JIYHyDYka9 zi;1+#^bODZf(LwHj7x(Nda$d2J$xg!A+~k8g!6Ird+*neYbrnM#)vE&G3GcMRB5wc z8e_+-7yDBeR$!!g=Ag*l#x}s@1a>C+dWiN$qh>RQO|Eg1xq}gqR(-jOd$bq25XN)Z zW9A{8r~rsJCSj~sCW@eJ#6I?WuWg`YGgcH9V9_fzOvA$TpVa>}&*7vQp@7fi#2V^M zYEESyH5Zmw`L&BgFa;IOY*oWG2{!P>;X(?c4*JgDpIPs_iX3<}u(w%zXJ@dtSqO1| zus6AiV=v;-okub<>IC*S-{DSRFW3?%vlG}8EeePUSJWA=jQcF=oRJ+e!Jfh1GuV3+ zu(zr^jTK(I;=wg*_DSPGpJ>dtRzc#2zSbg3Rp`f@ryL$Op^`@eLx70pDkjQjN=OU= z3IfTslBBK4&S)D0@bOIep_ie#41g58g~{-9o|@VfsACLoWNvF}Op0V55o%jV%e7j` zBo^5M2>fw|3eFq*wAHwNIREja_a-0bcPG8`Vkjqh*}LPBEpYV#KK@l=Ld?R&Ho{XO zl>mZMymypl>x8ZaCjzxS?k7*+$*UuKIfU;!`d zP@X%W%|%uSx}i*+p4e36YD88gy2RMnAs{&v&Nd$D!evq~KPzY{HFZsD1@8*LUIWxO znZa?KBh>0N)12J*W-!LV40|f;m;o4! z8NcVoe^pF9Ot;4pX}}cfS}7>qUCE6P^HFYrt(D@$JAzi#uqd%~I3_AB3s@d7`I-jN z;bUrln+@}ICBkhn?d4DBDcnn6?46)g_21QEdgfFxx58-F4;Q{%F5BI*g7{+&r3=4! z+j=z7*X9=_V)4ebsGW1&SB~?|_dd0UnenKH)$MNA3rhyH%$Z$eujxf4qvF=cD&5kIq( zXO{A9Owwx>N_*D*k3R*3t^qf~ zf+!3Va2ahjk&R+>ryJ$b#-#b?RMosOQ99aI$qyPL|{WoQc{5)f#)bi2*QZypa!&SRYXF=cD7^e__kBJT-qJHNmS; z#0jnIbADrlj6A^n#TcP_{<{miwSm9+)b`_oMC*QzG_?Fz|G1_Fhek+DKL7YPV4LU-s;@g(cjfk7bkG}#3k0D3>Gp&WF7daNh&m9#b{uk zqUzYh6l@+A_d0dtp(=;8(KlcO3g&Ks=0w{#i#nvk(7B4ZjTb}<%+C$=Fgzx;oEO`h zV8d2@;bftlP;>3L5ENUW+pH0oc}J4^y;sdTMiY2$`NTY>RUwLcQJk2yWW#4lC&y(T zh`9$V?a&ZufR*UHDmCN8Cuh|l=J||Oy=i#DORF7!-MFbKF23Foev;};V#%e&GE?y1 zO+J~^R^V4Vr&*MmCOk1@1F4)n~YDm&Oi12en30&=P+1u!9LUH)!FPwpKtTw z@FT3ak6C{AhojJsP@#f?EpWdBce8Pw@_v@P0SYJ{l3S<0R$-S$NYXSahh1{yEMMXM0+old2@=z;= z{PS>jd1=DOUd%97Yg$!ddt>$Idq*(5hfw~CJ}eiWUGLs{m>n#)vo||v>1ukr-noN0p=S@F@x!~C zmgJRNjV3%8H`uij9c+1B>A=ca(%R8P35z>uDsLOWV}n=I_g>i5g_?!^aCbFk=l&t4 zh8?rvZJppNiXc7*sXe=Yz8m+?ng#i!k*TkUjwRDnWHIBJuQI74m7rFk;Jy%P64H>- zl&VMw8K;!8AY+P3E?Mfwnv|KQA~QjPUN+mRG_g64l;sZbu?8uNQ<(s z{%wDLwF<}&wsda1CpH^YhR^(vZ`}dz-zy0~c z#rv24{!>qnZ}Leo9%0Dujhy7hvH)Zsg{P!-=)%8T6t-!_x>?PfxLD?eZ{^rz)yavA zUpB@LV_?85PSEXap0F7SusBRC19FB@#SJfL3M+c9pJn^Hs6&M-kNY}BD&uUI>9Xs* zTr{mT0;JapW z3#7V*pf5Vy;6d{t+fVo2;J3AddCf7~+Mu+(jbvC{_ThZVhed{B-=-P3DjfJ^5JUr1 z0r$|bt-NG*=|pI&!)4IXX}v|V_lAD)Zog3FvAfYmN9+(DP~U1Jn(1s%2)uD0&{+`p zkuUnAGQS;;D2vCJMXsXTzulJov7Yv?ijf{%4E{XZ*IKrHcB}jAU&5YW6lRc@fLCyM z)DOJP`fBx+FiLrS-BbhyG6Nr(&iyciMgVYcd=d|_88`k`7B{$tcqA|uH--Yiq1Zj( zI`V?}!l$RiKV?DRXWcAr%!5blKYNUy>C=A{eOkM0pEQ38d60!P2qQmCMUtdU1*uXb zk}89pFb%Ru2EeZ1(P@=2?sFCJl&Xv>4ojT36%t-9=4-%sZlaK{Z{dVR{WDYj)e6EQ z2!~O6$^F!pGc*3jPJUwp-4_F_>k!?mb)$QDJSP>6vAKpwx+>T6{JuWbC4NsFX~4!z zyz0?8(5VkdPhS6c+%w*44~JYfc^y1tM@ejOb6MWPiD9S^x_%EuE&|d;H+MK%2lh9G zZ|=z{3Rvkw?G-n2xF3gD{sJ)1{T|%nU}$&8?7ZMWXm>}KX%LAP5tOT!bJj%*I1rmF zrtOkiNcl!H^e&gTLieke$KghCx?L{kehX*y%H<*TyF555XqS8M?rC3l2sfG08dp2O zED^2-p11SPZ*9U>yS%|f`Vppz;E6oUl^$d4YjQuJeSag?Z^tbkxP3d}ecWp8iH2>8 z!HYBZ06cti`d8DT=tDR?VbPk879r;E^?u8kqg^7 z(|G0gmCMP!sQ=XWug6*O_en8&b$2~EgEz9~Gx$^2Ywh|7`=RKQx{PCpc_Bf=Gcy;K zsbX&%MN6vMi*pwnG;az!YV<_eGKoe4N3LqEm@G)^sl%Y$ahc<>y`a`&JV%bv^+tMx z8HlDtcO7wi{_5=2%ZquJRVL;TtDW@5vr&Rmm0=w3M7vUpZo=NZ|MAuP-VguksUZ$= z3om>5{`JM{moLs*kh3lY6=5z>b_l+pt$3LAS}b3)w?}3^jIMF7KkY)B#4>H#(I@i_ zhH`N4$=SBiJT{+PkL*|W`c}Yh+tqfXGW#~X>9djje@xLH1d-AtNn#m=LKBhf&;&+v z;g&H7h)g*lc>aUoK;d z-ik9FN^}`hVV{M75nWtQjl^K%oXl+9m8O|K*EPgi-#b<)9~-3ulgMPSW{oo&n6UzW za4)dmmM2xe`tAz8w+4DtDBLs;$-T`5ySM3D)s$3*cncLra)@}dnyPCIV8UN4R|l_z z4&l#YHbnuL1f3RTuX2oJ(~_NOnVoBmswxJiuCE7Z6gSM(Ry|_Hn_*zRmDF$zzr31_ zKfgvT#VJ;vsnGiTrm*>ZJhQOb+(e}yBIlF=dbEw7RC#SCOw9OA;Adt6-n_VY`BU%9 zOrr*7St0ziQA<$coaHJnX5}tUjdrr(!J-3pFR#XO(DlY>>`gM`bL6}H&7wzR`P&^T zo^SAI>=7s49<)<`37n!SbPi5mTmTlW@bb@tUl5-Df@CBy$`@9LHtx0Up(uqqdsY*{iv z0Q~V@O(v5)uANNgWPB=HTds0}1Yk2GQI05i;#};r?6d5XZFd8tD2e*BoS9^zN>xU- zMG$B-fc_fYUr%n&`Hkc^+k4-K48xdNlNVO7LLKs)P*Q2hVxzK+*DO0TWkebt#pbz9 zN?S|byAchX2{&-2(_mq;4a#bOmc^j8#-6|#8fI9ko&nxKP<9C82`92q$9Tey%^6)^ zkSEByBFhux{p67M?-ZP7b0xTB5r~}I5O&)rE>g(~E@W&Y5o;Uexh|}fVN&EgEEqE! zK(I)S;w;~k+_N|2b!FiJCKB#KJmqONR#8>yV9pWXcWd*@;c5q?;JOb6D?c)#>R-KY zAvx>|bUkQW$BJV(n<-Vtg~$1J>faI1B9GzR1oasA4kY>qB@|oG@fz6NfMJ*Lsr4o1 z&DbXnQQTfZjFFxqa}Av?BK`UbC9KX2CW7@~aT+z&dO*$?$G}prWMzRmTwcAtdHwd~ zw{KqGU^h-^H#ni)6WaZAq1_`HUruQE3q`xfhPmPE(`UfC8)bOHy8B4!0IcimGdlkV z&G|n7yU^iX{9l2lNa;+GBVq6U_q@-GdgUNVRw`GYK<|nuj|9Dc+vvfkga)oD;}?y0 z3mu24N<|nO8OLd)wTiUOc$VdY!}MC4OOZ-Y0GUUHkwqBGB+;?XSQ2IFib}P3w=cZU z{07USy-{^As4tWTwlz8}0uu~}D+pzeD8hqZ^MC)_BG_SYISVEQh}6?sP&{J!yQANz zeC<2_dJ|MwSF?Rrvss>Ewl`FIdUqL*_qX8BQ@Lfi(&Q1Y8&-pQW z3|3Jc;Zp2PZs;-K?y&U+2VLz-dioTcZR3+;AN+ixe6+mTtUMyy$gr^4p6_J^oQ2M@pgdOx^( z;2YE0cUdY)BH7a|6~EgZWH(649!Rg4#0W9W8BPxm5Q7K9q2R~X0hVFPP7z`!cln>i zdg#^2FWP)a<46=y5;DPHPU9$!Wua^lX58wS%UHxZ;*rkqHz~{!m>5H!Jt3;p)3s~-rqs4{gKp!;n+J{+rHFML?+5%PYv+YH!l}Uu#C6lg4Y}2C zW{>yi4EI?JB-5oYG!lN!!nDaTg=sf=m!H2P&$C6@zum9G>vM4w9pboL-}sgcCG;sR ztfgP(RXHbX>pah;j4kIplSv^XI020|oC%$WaIR(h)JSz|*8JnE(BxQOT*rAB16YZ8 zku#ohDKZ-=mMX<1beN}7Z)$(HD{SkC`#e*ttNzK}DH+S7I7_MHhdPTAGWt^QEIOnp zOqd}(kbp4&^igZkSdF^g6T|h#W%T(R&Bn^{$lrN_^q2_3kzjzFkcdRLU($O$SPVG zao$S%egch;7RDMJBuX-6Qlaf?Y0cJJ!)lf}hE;6H|HNLCExD!V#RR=Y=k6D`)5-jP z<6w^R@I*&gO@CtJ=o1q-9%>wIJnpv`M>bVO9>=+|ur)G{_1&3bMOq|9W`*6S>RqpK zRLCqbI>|K4b;zwuSe9yr)LVixg)ZQX7dA4-8AqF`5POWH?kfA7hS7oihiitBj6aiQ z#0Elgv8~?x$ubH~_h`?>!tpHJhrK%cMcYnDbEq?zc$OsvZ01qSq=k9mg6kL*BsD^^ zSY_xg(>#<4v|1SnY6<^=-L=DZYRM%2`NqcI{Er-II;3}%VST1y*tqgs?>aT;a1j55L7*?{#aL-)`x)(73Bj8B zu89l%z8slvh|0aJu||4bde(R^gkVa$y(@A(!d@@R!Bd20jXpD3+$*9^b7? zO*QV(qX#dbfZltU<>#V=6d`*K){(vW9s9ZA7uEL;v}unb9O>n0+)?&=d!fDkNZ@@B zUd}JxKaB+b2}5W};KdQcdtx2I=MwfOKoEWBLQlk>*^?sl#l-1lG; zd8$#rqZ9kGl!qKy%Gt&c(JiDZp^UYZNfFt!5Hd1)Bj4thMkLn;3%BHoF_GJi=z9_!X%3=Q8OP(X+psuyE^$x7fuZwLF$unPQKJm(qJgcEh%&_v{Q}l~KCcZ@=^DILVF) zf!!*wO=kSTF|%U8!Yd|-RWTW|_)tqd!=PEP@nw8;woRBOrvQqRrT$m4)O&RHi?-AY z9%&vGDk)?hr6LI)4H(H~Ou|S*r_wpWn(wB}TVTsJU^XCqqM2F>@4<+;021ZRsB~mo> z5KVaBI}s;zXtw)EC2(X^$Mu;^?nrE@;IPx=KA6&Aqs6_O&ES)|vwKOaw|ZEUPsKy9 zm%o>P27hnghPTCTEh@BIe<|sjM8H% z!C?1Kx8*q1BMvrFIE?r0Wt0f3jgcG>l8VAZt+Q=H zI9X>;32p6BzAxMEN;1Ibp;flvERUqHR%SxlEGv?T8^u@@F_VHhX5$oQA?7gSu%{<^ z9&s7T4R#l1o5EtbAU-BF8?-;SAGQR$es}feeQ*bc5A^W^h9SV%s(M`3J5!r3$@r@0 zW1Myub3lzPH$l}Oi$G6|_i8#%b!mo#}_(P9jP+~1e7(rqlS@a;{pc; zAJt>S>^!`#uI@U$o}ua0G=fgq+%ypf4JWhzqvySXH(yt?yVZeHzBhHErl%;ks8S7pqFh(9*Rp|mvh-uB)=_L32$rNOOx0My+?DW6`Z~GnZ8>$}Gpha& z^eCWPHcp!iF`!>p9-4qKMmSrK1K5SC$wxS-ZjBx&jOwjstsYTPpmJ7s)a<(Yb#CT{ zCh=<1JEvxjlzpV*u&XX~f3ajR2&%-X1&ze5kf2Y!w7zKVV$IrmR*v9VgWvHJeMWhF zFx%G^j&9aQTs6%GIW*c-hJ__Joi)Ki?efL;@bS(H8U`YQa5QH`uJ3oeGuYJ; zKBJsU>L$J(GfClu8X216k9RJBj3m*sreK#^-h)XQVFQ_BUni3fAB?$gqt<$NWVhbx zU{Wo%Wn9dDEZti=^Q(~ED;=rer}egFZ&Pi`B* zzrk*dzksQ%Ks?0hI2yTtLR(@7X$ajh;e8}(gPOV9yQ&5=w=LV%T?n*=tiSb#KexXkYOUEl=v#ev!0`v1c7F^xfa4x?PGmCMhQHLwR4X zDhq;uslj^EFaxB;Fvi8HuuuV71f9**rHgfnMOS#_p%A^!H}gi9q#!8ehWh>GyZ1p! z2k!+KA8zc8f$k_l;dQVN)uncaIz2IlB|b8a`~=SGXJoNFz7q9e)RRwVnB*Hx+vm!& zdAoiMx_9BRWGMbnugQ81;5cI&Z*lf{KH-Pdp6<`{S%*uVMtX|~OP++Aix=<3*0{Zi zPs!G}b@;mp7HJBPB3Rryi5-WThh6Qz{&F@8{92$(z8+?pth zwv?*g;|(^>xe!sLY+`b$RS`2DMTT?u$dt*_%&Iur=X!a=8x&8WEvt1R1-v1TqTC9J z6xA%ZHq&7eC5hTh5W4#fI+M(VkZ?BX1|VBpo`E z=#tdnNTSQFy6hz~7?nA4SCbZ2=3|Z9g3=Gj9u-wQy*o;aM##E*{8tz?|frXfo7qW{eypZuQ43G7}N@T=6`Cv~z z*v~>Qu&#Vxv=25Bg5_ZX@{F0{Or}i3B#X=zQpm*cFv?|=8svvbV>sgI^b9i_X2Qg) zj4nMs*dO5ofW3L zlv?x9RZqybd#4^;0IV*_rEp!92=~#0=TWv%AL^yce1NWVkKPR!lQU=sxv`qUeNI-r z4%C+&HY?@x@y14xV;g%-aIr*Gh*7Zc=4pjKxV~4z$Oemnc01DKs}0_|lG^X46X@I6chwbOaLx#?5e=TcU#QEnk2MNY(5f6` ziD{TuPJJ+-VruSHRXnb_TaTFiJ!X|ck7ufy4N$zn$`s!#-S|(O9Q_+fXF#Td<)^>B z{ExT)`k|v-XF=^SKK*&7KA39Rkpq8nj9=b?wfq_lgMPrlG>*1qb*4#e-5`{zS=Iqf z1QqW1_h3Sj_KvHm`E_1SiL7j;P&zt5NY}_c?Rd}(9Xr?{eHjbNqaWT$)cFM+?*^DJ z&=4q0GbGJ3x0a`aU&8(j-t$J#s!YhUut{JZr^V&H|ng*6077qIdJ-) z8&|vGAAzgGbQni_M>n;|nq?QE7{*5iqsN0p0w_Bn>l3p69LTyy`MzjmE#d@JkXxoi z7&94VMU=2YMk3Cv&=QU_&Qp`ca4x`HvO>Uj;D@|OnMkaRb|LHbLqA<}6L|gVhj*0I z2`dtfF|gqud_E*zQr=_QDL4iRQnhkI9ASG9ISyQNu3f}$atM^~A zFnIO;CqkoL8fdl55KWaG%yf)A3-HIhLcBWim!@QK`eJ^aSo5AC4uefWM;rO5?=ak_ zB9Nur4Y0$$*A;@++NGkdM-z4D0rAdk>5kROt#i}93~ogdUr>(*Jv~~(wM%n>gZ|*< z(3yxkMLnGvx*Rr?gG+qZFcbhfoo^Bfhc=AEJv1*9M4u~VBD<64ZhA{QTkU zOh^rAG0}~g9YUjqwrJQC;(;28Q7%4y!N0V5Q4`tb$GM1L^F>B+xG+k;(&RX<&P^{%LJpinmJ!r@u@tI z&)_lG#&Ub|7@Rx?f2hac??hLdX_c}#QcBp6$089SOH^jGwXtPzTEvM}LWEhKh&WAb z5ea2P9^S4Tvi*h?vV}F+jmc#V% zp03&dpS^4UapOkP|B4XcfGpP1@J;p{0>ts%CcZd{FZL!`z<`%cvS*alsAu(#1w_1k34UCl}Pv3HGz6t%)L>NirFcP!PQAyU_9cW(QAOID_FQU#;rHaQIwzz zc9Je`zvIjMah)yF!(^A3_JM(TQEE{a)XaZ`*}_61lp_Nq#o@FDKGXbY!gsA@Qi62`p|p6!@xQfCp>uZQs!`XkC@ zJyv(Ziow#>GFwXSs2YhmH6^?e#>qKRq8YjHLac7_wBRuOzeS_6YGvgffiCK8UpW;v zj%^ZtO*07uIm@_3O^RRH*#S9xF)8|`2VFT%sN`OMoe znc&bzutdmTS@@qK^}0%&s=Bo3y{mGsu$UnyP`ywXkgvYd)}4n;G|$ z^>s1W8|%`i2fbIr=;eev7SG$beIhfU9&$=$doykhLF^vKSEb7!t)RAh;hoyljkhHF zMx&HoJeHFI9v2mpU+SmRqDly~x|9NQmu}H8-LOsDWvtgWmA$Gy_GVmdSp0tR7F;-J zD<%spMS8g0#w4B9NvdvexMyLxVrC%be%gs|59;G&vm7q_AZ$0mq)kOfPGX2voDaGCL-4CT52%ikiV$}`l)BbrftL`nsSPon}GpqlVeh zgUZ295znrtMD~U)`lwA7t1Qc%4lFm`I0f5{5*31AG~-I=j+$Js zOiNASU^kh72N6@+1$dMY%3PPpQWLOnBa?<<$p?JEYLNM|ybqI?&w6-|4Kc)%3SGC8 z>Ux90V5{kJnr5@KW zmLg3wek@r}QF3#NVVO~HhHUay0Mf4IhQ|f#b0w;z@DwIZ1gKH@27FbrthaSFfbEe6Tnb1W^kqI@JBUt*!sa@ zDMt?zS+mopWih*l52vi%#<04=h#Usc%d}!uBs&JP!G?y7Udz6=JFR2W*NGt%RA%A8s)Y?r*rzKLkzT_gb9 zZBXRHXZf=qU-aVLG|cCzVg@E^w0HxDWv8_h6k@(l^w?sa$d6$ZYxBJ>q08qfYXN?H zGhXj~S`$C;Nj@o&seqX_m`;V&r>`dEJ+vH)z}Am-7Yjwd8UHenBwL88OgH+j!DbJ` zyXB;{_Q0#Wl|^<)EO3noY!u5$SI8=UJXSc4^Lh&~Yg*H18aB>Gok&+DfMC{16i>%Q zlL~rF%S7&|a%o!Qnl5{#wI(p*i^YU4ehkxi7fpLVS2*AWlFhIq02h;THXB6;^I9U? zN?r-FRbp+`cJCFB2b+sj#fTjunJv|7sWIBpHL2=sy8=p_%g_Ih64Lv2_*K%XtZF0= z$F0p7a}}qE4Pg4Np+_vV``z%Xh~mRE(%}ez__aXjnA$z>)F;C&MJJQbP`!Ht~fiOwGtn09dACEp^fKmLld7 z{Rag^ZUO2~TQ^?~95>&k)7D0hC3csWt5vwBDVSU}jrn%bR*7j+5!0r0CG2R?eXM7X zX#K7n`f0B&2i*QXO9G!o+&hsFx9Ap`c`HM+lX|hbGLKG8COQbT!ku*j&;P1a(Wm$P z??oiy1N{j+|LdUOFu#1Bai@9CoF?AG(^OF>gUAbOt;)ToTxTI)M@k3Kd<@tKR5?dw zFwjpS@o7ycB|-+RB|Nz`^~Zb%fOes9&{CG`qA*M-FG!F^23~l;4uwW>G~Sucv%3eU znGMu1cvwSJ{BK>x$M5-1U;hZtKhcBz)t4H_Km15B zkowqcBT5*d8$>M|yKv^+U;nDU1bd4ONS}(o?qeIKi%w-8LTmrQzJj0DFdDVYV+=*% zC1&L1(wm%TiXUbu?wFE=rFcIajo!kZdkc^JhgpkS3nI94&N%0ZCx&yIg+O%1r~u;u zOpT2DBGWX;%zGwGk;8G~bE=S~xE9x2w-$v^+PREpl-a^$)E6Nb3-%+k&~7dYE~U+K zXGO49s6t8ODK*qG>I3m7wH7z+$wzH2f(;&&;V8Uh3Thmj`~-jyAq6~U3hfLW+yy+; z1SL)>kqHr$Ah=_5&!n~;=Hiue{aIO#0ND4b?8Bdzz50KPH&pdvM~2cg^wClOTpyu%yZJih%XDq5V`@FD2@a;9Dzm2?m58rsM*&AFAREo6?6q z|F81ZUlQeMWwxT-0to!JoTb#D8ls~R$~-Q?3F$HB82N|=J?2wk;acB*yRgFtMZ)W{ z3|xs$^s&$NLaI*mwJ#FiaNxFD*-NBBXv4G4yz$*Aa{CZ=!?5c52jDPM$zTdIFbCl< z_L^|KkYk0pBVkx372W2YKcleTu_z3{*V`oH^H87tp9_U;*piPLgfUG;k$YYcMp;G* z=?m(D1BAtyv|KtZY;HZg>Nzoz5u&~1g$+S^LUPp&!Y&uEB%%w{TSFRhF)Hs7wEPn+ z;(u1ap`09yrJBYgMp^3sVMysg+i zzn>KGe6w51>LX(wX(Z_kz3*|o(oAeuQ>Pc+T>}QGDH8QnZ(~N?R!H{1{;=Ws&F$t6V`)Wr z34fo|Re8oYeE?&p3V14gMCAl~V}Fa^el_5^pzp1`0egM}LOOlmH1)HNo7e(3)o|&% zi>Gt=Z4o1Vxd|n0##=9z%QpPDM|nn8<1I1Z8~RyfVaa7Q)-`2&W5WlGwRg0$Xp`lya;g6STIVluu*I~ zrUTqTbNGRaTR1E2Rp{IC80=jazU;cJqW52XBbfNdFJJ$xfB5#7SM2*|PhWER!%OuK z@lrhfS^e~Nrx@%maJ^$&CKgsCb#L97%w*ku(p?C>9>YNho%IRtGZhiK#Bg(VShP90 zN2AW<(a~nublY?$BM;q^FPUTmo;4iY^-J0ay}IaB5WQ;*M}YI3YJjjr2DrzOuyPnU z-#!^<2WMK)2ZWi|H{+v5-VUB*#KR6`UKH9EmY~BkQzBD}!d!b7a;Ci|FzJCBcn|Qm z@sdy_;jz)>;H++#%PNb+_pi$v6ft{IVrmKI1`S8yD)d6s$BTFuBbhhD-F6cfz@pT+ewa7*uoJ}+1UA^{zL=7<24oNPh?;>>%D7qk*rVXYZS#6mlCct zN8=SqznaWZ|=H7RI ze1B3|y(_7;x{}rDPS@TaZT(PZ`MlK@f^33nuo`8^lqHBF+`exxOrxy@NkPHKAFlF+ zsV-tJ=0ncCJbbnHhnB*@^VK|NU=NXb@tq}5j}*TYm^=!%%I%~sO~|E}0mQlV9UXu% zpEW#YnbQ%(dtnKeJ6|8J$VNWhlKn#1J!>iNxVb?{+{ zb-X&4f>gD>ZqM(by)SxpG{1yE3&;sc#) zPWZj!iMTx6<$)QHbtH0ukj*P-WaYFE?K^G?l;*(xb(NsE?U=BmKNS$KX%O`Ive-P4 zuVaeCBC-ASTm`w6wY+JFy}EG^!wPW^q<+b%xTFMYM2Jqs1)tyjqYE!zdU;6@S_{uS zH#H$&UhE?)i7$5-!Vcgg5E^^+4(oY{k_C;n}lk&_u(pnZz!#~^!X z%IiUig5gmo!pI`f1A;9I=a&ApIVwow@d~jWZ2vN4&!?8QmIJ|uES`5TCgk$`=v1WZ z0m5C9g}9~J@CM}|14XW=s;2KrTI9F&I!xNY`OzeeVnw?}Z>Y~e*izY?5$cJ+RW<~Y z$#v0}goa$u^<|3DQ9e(-6|#LEFe_BI3V7u(dTop9>sDoz8;USu46%rP#!}wr6jJ(j zr%e9{T4>?*>urcAaUl|MX+50`Uo&o%Dt(#11$=|buG4D(Wd8UU8d-^bl&v~xd&I|% zf9{U}-M=?`l>0`q=gk9kK7Ay$s5vW050Llev-3lHMzJen41_Z#l~1niCg}$w=g+3NmFoxV zRhq?WXf2+EfR6&E#UTequNm>iIIk1Iz3S;1wr7&I%_)hDG+6tw+`@iJ5f5VK^Gh-@ z6$uZuHJKHQ$}g1dy@KoxKB6rN5Vw^l3rzzQc^ts-`@8@gy6|FY(;H6m4v^wQberAF zJq|2E_D!UtI)c&p65QUK?oZj_GD?IQastTsFTu&6sKIOmYca~3>1QRUr!dPMSMROA zQcpmQMX{*Q{sE&)h9*W+r5VLvS5$Cjl5BQ?Mgh#tw|Zk&aaj+ss`_!(DW{?HRGY3V zdGZH01v^#?XP1&ttCP0MVZw<3`~y?B31g~^B#+x1pjw~h5_P{zr)%YoVhcuiwRV%b zP~6)o&NnSp^Wk7{{eG{LPOP_jgWm64V&Dw|@&{fyunaMaWVAv6VqkUc$0@`PA8TNb z!wbh}qfHf`#b*$=qD={4sSBNBs%o4u-Z2npxPn0NFy>?c4bGXA92IPt_mzk(IMFGY zXnV@DCRXu~m$(Acv+9F6_xGW(#cbzhVRKIkV`qT02*^-k1ITO{XgjfPOW{$!U^Za& zJ%tdQ zYnijEaqM+uzBGbr^>hqO>mWe#d>vD6!@!g!CB({RE#le#s6-V3#GWk@<&j* zl9*lEo`N`QF#ucISisC4!)pC^z+8PqU|59xxRo~~$}&jha?(-z}v<<19ZbSSdJBa5}DCYn!IVQt@u>i2JD4RG!Ps{lIa#c!ZSWcD8W~ zcSN(3QWtJ&E8k`sny_4XWxXskVDxH^V%>oZEDA$;68)b zWkoec>O>+Uy9%g#U_{AvoF?@=7rg}#=t9<3tFwDAkAKaU-+^zm;Uv+DwKjBO z5@4R}ykGT2S^rx!laFVmIzPA?vcwU|GjQ->>rZ(5a%a82| z;z7V5Gf9ivTb@RMk9KbvNkJL=4o#E!{vfg&?G6eLh?V2DX5?pPdx`azivFUvApOhk zs=Wlp&yA32VJ*|8b7Q(>%qFqL^+ghDf7pa5yn=jf`um*+oPbn)xstThe4vFXnRGuG z;4k+~KgUVBH24z^FRso$W4rMF*>*u4mIZ~bLQ8!{OX+J4WHOHy6Bm+cb&@UGP3uFv zWU;}Te7cdV)OHQObTag}n|O)b`&@z)S4Yh7&LByL_#`$Mo33uka{>kB+g^V@Ghqel ztMtbuf1nMR6PTYd-$cwIDWj@YWCXI+dr!j8pAYUm_!^C4qP-49`S@bdSOWa=*(_vm zer*nmP5*T3l}(3H_M9QPP8UR<5f0tYIq|3Ohu# zKFVZKw2FWB41G753Tp)en;ZNx z_`|c$A-)23aV;C$qT*jiFYtoHbGlND4MYdE)VDD{J&EGmBdq1EzQPIU(Eo4+b7VMQ zT|L;IX|orFH{8-f6HaOyVe6Fq$=I2b>`5C`Tu}K<;ZCc@nDzNg+kSjg!=@}3lZOJ; z_{W&XuezGgVL>Ei&&0Abi0A4QidE)l9V;UsmZGsf|7w#l>LGs9;e^pYd*;zzxA*g5 zx3Z)clG`8g1-`dHB7%9wIHf^~9I3bG%Yt}kqm)-hNrFjm;ZgVrk`TqttnZQQVne#P zmG&l^BNjv)Klh=``cqB=TKd>_R$4p+CF*St+$M+{xoBpsKHeeVHrZ(Kb~N6>pgoJA>E#kFP8yTF?aQh1w{tF2&G)-!W$EP!t9M*O7hn7F5-!FN*( zK(%M}W}ty=LG0cBpYOq5pVtrF-me$F;hEarx3}Tgou3a|-?x*>Tp#fryYE&u%{)?- zO-euJ?l2>WS;cvxh10W1y3i+7|0_H6O)shJH+eB^u8{6*il7Y-Zk=OXfXQ8|sz79k z2axv!Yn&SGHkom&3B)m4t(EN|fi^gP+`u288fZa+bZ+JlgqG`1Oz>sOm_cVhNs680 zzf1ic!^XH(o{Q!~fuPUoLaYgx7*ARh71Gy^;EJaD&k>8OnF>};Ck7(|P^TE5pX;x#?T z`4vV4({eCRJ7OsC^VzLzhWlUvr_-A)hVInM4FR+-s90*w%@dVBXx>w>d2~S5V72JF zfbnp_hT0P&V#L7IXpt*yqF?gc1hLve4V|w_HE}5;nJ#b5 z1`;_6g(JroJyrh-O2eo|VGFXeU?%RH8#r*)=gZ(QEcfQ{a!|5VX;@Oj{E_lQW<0>O z@2CsF)C>!_pr#@j!;rn(4O%3=r&xfdZF%l}KVnBkG4YotA3XS2f%d?Uk@EC&>B0)(9^IU;}*@6LTn;bWs+ zJRU0)qi9f;Q?$Z&Y}6E@B2PmY0IFBhBBK-#RiM0teHPY2iOwjk!oW> z%frngLT9unNN!LOPgiSVcG5w^zzEHW=!emSAs~x--X5mSH8Fj%AHtBoqVPvUKA}Fd z?ibq>Akr39y==zfgN>{w#G*QY}Jh8k{y!wHID(z^Gh%lTL* zS|M_)Cp+(p>e`BM+p5WC7pqX^Qf}c60NS2E@XXSlMhPeo>065yr84JWKwMcm@!Vyx z2qBV~rDhgF%|Ni;otsazrx_QXXD9(&y!sNzF;|NJ(=`@lnjKMr6J(#;tF^jykQ#6G zC>Fa~b!~|&o}5)2dAcE*!ofwTta@vM7#)#|42Oob2PP{9h*4s^y4;DAU;!|_6qNC| z(@$WHyz(8=>I6%3+-x~0s#Mu4g-^^iP|D?C9!5{d9L;I7$J?D_BnFD-4&?{}_ebks zJ37mS0wo*ubvgn2{B>Z_;XD%8%C2dyc7Af1-AXG;$DEbBcksTO&8nv+!x4-WrfO>Z z%?(TH>`K7!)pLWthsx*x&|f?cuE!}%V1h%-hN)+p;Fs8z zbB;EEOgO_$?ZW0qkW(kWa)p%C>ZF$Z%rg{+FwAbQM*^YVmtZ7%n}mYg6W`Dwn8@l? z_jf?)U}vCY5E%kF=?>U|jJ#67}F=ORjpZJ&JlRUt$fsz9Xh5I5DvC<=uT zPOz`JtZ(Fh!#(jaocp!`@mVg)lH_Y)W|%~YXBZFA-z44EkTa%9$@9jLtkN&-4tn5kF4xbRwNy$);@r3|>3t>nBF_(IKG_obN$%T3@EWpeW$EYX{pr8aH^mYT37 ziFOlUcCOOkEh)?bDxPR49uQV8c8GtqFwIH(AA37rlqG{^L}XTm7b_m}2)7!2QSZBgU0+1k36% zMp`CIjybfcDN!^s#c@Cq)M>eEK-ZFE{<<{{!3%Z$32}H`-?D9xZdbTL!ODJWy+J*h zXgD9YpqQSJ#Qa9m{YWy)6&FdSf|=wItW`|8SRM0q!!j{;z)&g!A_mAWOLaq!>33g(@psugKE>0xxA0hsg0GN_r2j4x}WdoqsrbMkGuUPx-zq1c9*QuLv|p)f7$`aD%v;Pzhig zKc@N{wxM*KIB970I)&x!7Glz}CxEp5f0&bSfa|y~gFed{%e<}ZUc~Y8_;ATKFhm;Y z$Py1B>D7i3wl#Z>YA_Xi=HLJ%)0C$< zr&p(*)o+Lm8BTLyT&n)OY}hf z$No8_9Rf38@`s-l!33m;a9BKFW9f+lkRFWG*25KcJEi&D$bB%T#nOhlk#BKsT`4TO z$K0N~r%$7T`LzgN&vZ-2dn4cUyAW59aZn!P*(X$stk3zF?JuB>*hw#f8HrJ9^u0TtwlL z3!AXaAbjZqQrze%w6{Y@r|dZ9?%3>>$=E>moc4%p>^0en1Sw;pE98Tf8%oE9SEy$` zSI6*^F`ZMYDR@5DcgS&m(K)nx)2$q(!(4vn(%r@ERw>GKr%AleGJstC=Dt>El-&$T z6-&mkh`{^+bfyOB{UmaHy`Wk@HATcCdifqXieC9v8ix%sK$nY0)Zaglv_auwffxjT z+yEl`KjxoB>$q_>ddU{Z;r$%$X72*$a0}Ait8WQG^pw8w&Oe}|aPlUkt#yJVdVIc8 zBe&s?%DOsFyKBHa6qdU?rF1~3wq$Rg=+a`IefCa^%@I1E$YvY$vIpFZ7g+-&8M4O< zgpqXu`v;x}|H4n?(c;h6LYih`J!|%v5i*wMpfbR?w}+@~A!=IBBnjnJu+C{~utZmGq$O8Rlw=UruEupb{e{aaX@BSfx?yN&JM5E+Ur zcpYP+snu>Zu=-O@u-}n?6T7hB**Tac=y!tclurrqkdQeUFGwXAttiD&P4bds>(ss_ z6mGSV&Fg%sYV|v(CklKNiD7u4z9=>F)kq+vfE6`;iYoC=z|Axaqo6eslT;b4EhNRC zI_)w6^;yme)JQoG7>u&7*xS*%O>(1pAey=tq}ZDuz{2nrkz-Bf8Uc~-W0#^_*t|rx zY@w0kB{?qNVjfb<|Do8O0xP-3RZv+5Tn8@00)hxK9TNUL&qVg_LLq1e&Vzt1fST=v z6pEZP#o=Mj)XA}ivF7W|<*s+Fp1VQn&~33z(5?o#ZyPl${}+~Ke@~6C@20rS8RP{Za3?qWBL@Ia_yfQVki75s!{=^Z5`G5!ifl-FRyd$+COrv4!-a$2hclF6BVN7!3I8-yi=$B>>% zRfP>1$)=E0UtN*}po)Q`4P$8WiYP$=!J)+?dicBTbA_P%bvrx(f+h|si}c8q~&)UDdKV>jdk z^>J}_FQs19+#AFW^2-kYpTit@XS=|L2CZMUpcoSs%;T7@>P)vw?(2tGA>&?4jE!Y2 zgRb8FT}P~Mw~F5-Ha@&8PZ!({50KPNjj*Y=9h4<;_(j_}PYFJREWMuws&_qraUQjO^2v;TK2|!NI*ig4^?(fg4 zDK<}zB~?N@v~7k`zNn8YHlNhZ*B!S6-4n4Q$u-VG*{O8HgHQ*Pm}`|N&}r)Tk5Kap zgc8W3e@ue!kL>Bf{)tpo zC17B7|pjO07sAs<-4Xq8}_#0%V&jK%{@En-V+hNxJs%=r%^dS>vH!g7cHRz58N)j zWGlVX3oF&+EQ^hIZgOBnd?0GQW-WL37U2)IKW^WH8~DARPw!K;r-w^g-Lt+Br6Shn zDRu$MUi^(i(&oek@DaQIVNIcC)`~C4!^3kUjIW*weZYF2KNyoWH34F)511Xg(wUnN zJgcZC{{*J36;SGB(T8BuR&r3y!+g|D{!<_Gt&Y&yU3Mo^2MGi(wv{*ap4-6gamJs~u>BJYA) z4?1aUjK1UIa_cFhyuYC+t0K`z8bJ#dltP#lOG!J1p-|S-Hb{glcgvx8fmdu3Cul+- z^(PVlDpc47BY%HMm0N_ey1#Cs`zZ9Jcl_a&H)JW7H^99)aPBw;R9G@*sNg*Ibq$zC zZv95sH`mTT2MFHgxlp?{_ixuv{AltN6Y=1~@NKROyp^HJl@P;0A`#KbN`7dqE`Gqg zbBhqR(Ja|{5+IV4X$G3&FG8e)mT1fpFLRRKEU;TBaxAKMmfWd^%fd`Q5*cYH6h$Jo z!p;oY8Bz8nm2+%QleODp$;4 z?g!bpey81@$EFZXG{04v=BpOU4Mgdue;dWu>GApa}$c@;7Ub?qKAWB04u;$k^- z-|#Pd$OA79h-F3Ntk8taQRE|Iz;i#+WO*#Nvp_P8>*g5DMA(ghz9sp#sba$b^oJ zw_=ZL!q3^oLwEsQxqHJnb znw>ed3FzXLNBa59f*ku~CrYdXsAp9V z76}i0WB1x}XXuBc{6k6{0R(mBGZ|gZ#ZQ6*Yt;kHmnC%cTiU{(8(iOa2(QDV$kK3E z{?geai}Zi(;xRZRAmpk`-CRW6FMzh!<*OiMqo*s+;2X2viV(;CBnF2n9y=w4TuXdW z%vHX7{L?4E|AxkPttXN=yY7!{uR({2c8H-I9`2*?3&$cKj@ON>?*Y}9&CF~Z-*oJJ z9vsB6Sq|2gt z6SZy~bO%*j+=5c$-114Vf{!IdRx$9P)(z+0ppDDmeS(L?HQf*jp-l`P375%(xqycktJ*wz;Ev4)%4K|ns0K2aqfy%+O0w4U zOoK{Q-WuRwWYW(I51ye}lKPrp43hYXM11(e)eSf?uwGxUYKfWJQw+Q@-@TszG1Ri& zd~$R=;(|fHUI!g!YD~YW<1LG$!;XVEQzt}*0|GZ$K<*GXKAYrcn;y4|dM4lF9q zM9PSL3PXO(J@bF}kd$*!=e8oyY*GBZrX`U^eG^jYhHb!4$&?$E{EpkR9)d@F5c^}BL|IhSu?pm{)7c2@YhWc$p! zihln_e3dv@ay=<5%N2rbM_0g=FkTM_{0U>9lr04}xtv)4-x^TDm^Y&mVaw4?d|kwh;#vsH zLf5vdV}BwogUJn))wSh;2tN=@wAfYS<``tRq$N%n!-yD0Exx)WJVvdR)EnbA6TLRF z0cfgwDiSW?CN`~53_{&0@IsjwxG2PTyRQY!6^t=P(FJs0_vZlS4~3(VrPLF1F;*S0X&c*@?VpEY7%`hN;YQ18N-zTS6|?1M zFPk-otn97X2Alor5&KkKm}hFWK}(jh^)uBkCfliRCZV#;Ywf8U)qsIjWCJK3JKfj$ z`kYHLrA@O@#-IzVCu-2g1V}S1$6Y9D66B)iF~0HW?c>x6LmhN(@fR@m1+OM}-^Vhg zk~$sU(#Zi92=v2X$T{*vENoSJB4kk66EGC|n+7u|rD_=gW?E@c=Jvl;`PPz8o!hmW z@s;FL&N84>?G&ifmWV9B^MmNoIMyzmK0TE>7@~xGn|pmd#i}rBz`WqU5I>O21D3w2ejfzH$P} ztpLCX@%x$xVceAAg1<@Y^#3-yi~qk$lL?7S8iUAaI)JgwXeYY#$6JH)2Uy7 zgJQ*{z5D)hsrxyZg@O%>$1PvS$pINY$$u-6(rtIi3SQNpoz%x>frLvSG~q~l-7);6 z`RMV_v0^ZHq1&8asFM`t!wRGhs`uhI^E7{P1C>jbiR{&c+h^(#t1D&xEwq4T-w`!d zUo$5ct-l>yD%W$S)zpSFwB`(urelZm9*#ICOWM+A)Du~lJKwA^vl7fuyIF{6F>&7g zn_G38J{cpo@)-a+t%I-F^=#BG;JJjny7{-&apUz`C#1E0S$9$Cki%X~YQ%j{PU$R0 zT#->m{ThQ~!CePUA}P9^Vv0>|Z|ccjx3*`21-$ZIsX7>a->JI2^;{|XP4(gT;OhA^ zg2mLd>iwdqk+Q}8kARdwI{IjQ# zr-hz`F@R7|K#mI^M_-wN8p5ECwdW%(Jk25`Iww_|E!G+Lvq94Vi1%chtaJ+N8~sFB zfZIrf-I2=o-M@Phx2F#B_4bo`t-vt-@d)>TX9k_C6wz2RoEOQcgHK;M*G zaxnw1k?y>&NF4|hbNc&1-JzpkCg+dy8rOqT0Im3HGv$ph4z@Yf2zA4+bFKyZ*`JSs zTdkw2`!>m#R#L5H=&bRB7&j6CE^F&M^ag)0x^XJ$L31b-O18g z-qmS6bOz4=GS99?gDH5xX*P!7GE{PD1kpo_1JpmaybrNa!<|7CS5i06B*Ly3G%A9) zoOjcNe@D0XAv?_X=j!NbW^9Iz?=$UlrPH*Q zkHmJ{$L;O-iE>Ccsjwzfw>%#e+O*QgEzF;5+%LQ;MJzHF)EPFf>(R|X=*}8L7oSG6 zwW^{>C-7;#o`G}|DcWp%|X~#^&koXj4 zIwt)GAVVStMTH3_W2Wp(LAzPtJSB}?SAS1-9+Ve5egmJqfxpsWzXJ094#S! z*q~)MId85;ozyjeh^rY^qEdW@_BNJYKRo_R7m%m*!k76@oJZ4@&R0KZ;a+0`P90e6 z9xWt{*J1}lMmgM_K02SEfiFL5sRRqK2GDwUgxrVTvMq21wyD7nj1~~>7P+d9r~yZc zFuWkYB82g#3|#aRy0|#qWWbq$J~)C#Yi3A5ah9*L(U(Z%KyPSgTvAroI*3OG9KA}L zjY@4CKVP0v!OZu@4Gw^DifP9XhkPcJt#b7gvc?PtSE#>{4pdfTQtQz?-S9 zTg($=+@PBdWrllcSZ19&0Vy%T-4oX}?cj0jv$X)|cr$>9>A*vpxg34OCjj@ZLx32p zM1wGv;nj9peiFoaTG9eRndnp?G;NwiX-pIn5#hfY%4~SbGyk41hy$bE1))od@B#m17o?6J7;)Yi~zX<-nEdxOtmO+ExG3Xw23@ zcRiHhYrtPk|NdbAW$3Lj4Av0xczz=A&XjrsYvdgz1>Z3Od=AngC#0UA$HjKnQE(+d znsAGOYwO3H|FI$PPKmWu=$A@&v5n@ym}i?dl>EEX_E%Hz9T!rznt+E8T+pNK*6eR@ z&AWTZ<8P3^gkSFpUp0h04aHoNG&I4~o0lA2Hj;7I&J*)kBJoFM)af+j=!|q`Drgzu z^AZWr;#)t>A&*=OVHc;U5Vhq(5*wPEDa_?D##mCAsTLvY-!b2PU1xXdu78yc z1lXqD`ptoC?r<^Z9EAa2-M;K+`M4G{aG#@ zeL5>rMgrMuH)_!e&H?g(|5?6{wvoHZ1%XK%PU{CRC1v{r?s#;Xrg@oTl)v)@8wb{| zUIE8D?Xtw_BdlbQFaCJYfSym9{Hmb?;s8J!r6l;bGL9N*oL?eGT}8qeaoL#Gc#Pc2 z6D_>Cq0W@jz65DPDFB8sCqdSRMS+0=z8Gn$V}Yhz_<*>%2or=aV6y z%fa-jKPT^R zV&K=Q=VMjyAPBTa=_4XRKgqDGzK&&H+59tDo2p|U_&c9kjiIi#yuV|Ihj_giXzfnf zxHFc-j95!Uz=kTG-J81%Q4$Q@DGTqPCDeJ^fUriROQ&#Fxk*m(DL>8W}9S1JVNA}wY}xIz>t3mcX0rvsEh3{heXLSj%$mq zqE2(|uiE`3n^R}A_PJ=3d_=@%U{yVLwH~Sioq-+;LbUPxM-6CO_AkFjLj5>NE{0?b zl`yFy0I`rfHIMahnRVJ~?h-MWIk)mK8}}vO4gB_EZT8PepHAW?%?;|wXKrby~RAPw00HU!a%hWKEmJI%xlt zqoM6-!JxCDnCb|3Enc#P8T}m@n#F4OjyhfzCsYWReF&F(^xJKZj>~@zIo$3pCvfj? z8CX%t>4I~+cKtt%u02!M8>@KVlv!)&)~3{;ApCx}-pSGnWL)O+(wkS_D}VyCCX|v9 z-$P^5n>Rl2{1PoB0Z76f@mfYD=2noQAP_(&;N0w`NT;c@;xFLXo|+dAs(g=a9YTob zS<|kb#z%*$b{>&GEj}byl4Sd}+Kl2D4!OIWWnFgAm4T^RE+rj2=Qw}D9Il%s3?rI? zUL4T!b*SK5{_ZE2t)lJeOo)_(^=+#nE?Po@M36wZR}(0UWNFN(gM6s)g)81v>K$r( zU&;s_Q18oBUs4ZrT?l?&2<{U{xUG;1e2WCFyysC2l-)$a93;I&->r5&II@}}m6FzCV&3gV1 z6evx`T{8^OHsHv;pz(SW0d^>2hJ*55n0WJ-GR=^DZeH??+)(l77Ol4Cf2aE@YJSO?-nwV!+%Mm?>WT-%-e zwlrE6b$6eRsO4%8cISIV)o-st(vx`@{`v1&NZ7^>_lR1oc3>QDrMQRJTq3XTADItN zV1vUF?%!z78nFz^x+`IZt&%#4^d^$~ctPQFjVG4(gS3&Y3HTpo8OycLik|{kE1EM7MW&H&Of1?yS}{@S%V@Wa_pv7n<#;DY zsk*$MAJJ?8gW&8v1FJcsdqR7Fef;7+s0$N8T13o2Hf!;IYtGm}fXEPOiX?hi9_NW< zdI*xzS#)@Yw1zOWP8r9bqe&EzqwfC7DthB05oVN30}9Ch z&~oa{je@rhLg)ztv80?-9|Me0ih=mEJU^`isyg4~q^NB*z* zKS*(B{r?=gF`;)Q|AWk@);ogf=4s}Fyw2Zy@bJFQJKQyb=|W(SEKqb zUf1ikh?V^3+9T%v)cj2%)_Y42WApIZY%!c}Z4z|CgnEyo{jW46((I3KO0Nu?mC}U%~nzTQw;?Wb} zM9!tVCZI538H?E5O*~aW<(TZ={CRZy6%c6 zKmYRWk_oe~*po(>V-+`?_>9Aj7+XHczms&wM10>&8Jes_lqd1bt0PwqR_k0Vxld+{OYTY-yN1#VN;`O>d{bnt zh+Q&P7-IB$NrmU&SvtZ`l4QHO_5Jc;U*Iq`x4zsYLa%GL6bzUJggtd6(1}3)#qAeLM`Zi7PjYO6u9$+S z@+G}8Bgcd7fYJq4kTFmZFykZe?SLSJ& z#wu6%Y{5RwhNap6@t!bu!n3IxVh_DdKjng+M!TXB@Jg}rUS__S9n)Ze&4a7dObkyk zHV$97zNkO3@-o$0x4Wevl7WO!kVz+Gowo6FDuPNwpr#G_kqXC4s<1n^d;l@=%+FVG z(;hx~%)$raI#Duh z@)M&bQ6`U!6dY+MAUcXdg*gL3HBT_TWq$0J*j+(Q!1YI`6LY8rdVF={$c(bxtB&N& zw8d_1!to8_wd_d{dKy_-wx&yF1$h#jMl&UbQBj;c|DNJeve;d-f-H>TV2R`F%$#|2 zqF;8U|5P$_)wVV?sOqI|xq#>G7U^Lcbl0@q-oN7O_IbF+^J!%RHt2UkI2KTr3#WnyP@2%;RfoPe!2sXz!S(7)fH$;VBWls((`xldOa0sf|!lR|V=( zR=qeR720s}vWVErLGXo-*c;A|AjF-wEyjqsO}8A*6Q8DsQRSv_pfsy;5`YrgHX}n$ zDva9AQY;EIfQaZX$FQ;Gt?WOMJzwzi{XTr$c%cBhw5kF|4Q#~6DZ`j2MisIk8Ygz+ z{oD<^mnP+s455)D`y2A~6llb5KUTNpoZDm+M=3_#50V62=7%v{^beI=KFCNXj(ZAW z+_4%ti-cMQa)6VDUoB3l7$=eFniey~@Zpz}IdFoTa&);hNcK^iIl1voMJT(0TWu?{ z`z3e#M`6b|DOIi&vhAy3_IUB4O~asfikbPUV?Dkj{uV}nZWSy}1yaqXpZ1OFcC-JZ zW&Hnf_0G|i1nv5EY}?kvwr$(CZQHhOXM%|)wrxz3iLqmTne%?(Gr2Dw$853q=d`l~ScgRSg@ikY{aoPgu5OUJZ>X{(2XG%fZ( zwv35Hc|bA4DD@7Hw;t}effJc=iYY2BMFWO}G&1%#+h-`GC=$D(%G2=xL6Xq6?v)YA z;0FdC1#_VfHP&$f~yH!gnMrdz2GC1Jnw&HB9eDQ`g7cJf&7!1gkF_tOn7jxkox zDl-RR`V;)~=vFuajy7n(8b)=!#n2#aHpBAt#ykG=%Oh^hWf=E!oZFMl)c6*&XHU7B zscXrRtD*3_Dv(MTzn*Pn@av0O@t+b^^OJq`UHLud6fJPZx<6ypeqYW-dpU40Be?{u zzYVankL6S>vpMXtiC)}s5oc6@eb|6e$S{IQemAFDmx(G>s#=f*X$9Jlu`d1~bz1X; z%I>d&zKT{@4PnhA2R&@Z`*qu&SMdvB%hOT+J4-y|iqj!*6X_Ga?C-1Wy++xeLa1PJ zj?US84rv?dze8l4XF5m1f+@b&FalC7s3^5z!(HhYRm;Zk7G|Qzq?JXPgDkZxr|{cd zBv9YK_ZwBjX$OeFZ)0&O#tTd;LFZd=u`hl0@pt>!=!#8_z27?73uXh9L3um~q#Q#X z-1M3FkL>W@Te={9(v5nP!6_&z?c&Y`BkYvHi+u^!Gb>gY3TEzAXV~fZmN0A5^)Poi zy&Ju#hrlLs4R}@Y5luJ4ZUINtPIZHXy6>aX9j`m1!xg(T!yfc)R|by?2PD5!OYlBZ zf~7`SCpcwsh0(}NU~ICXJQ64O4j?fD5~EM21C`X^>IHtdwZ>fg#zS^J*D-w}I^OCa z$m0JwF!3#oae#4mzr8g|dJc*CZbQZ8w*A*tiu)~eS!@dL3>k6sP-LJ@0=O}4N-Pmf zpE$GyuLiUc_zZFq(`1LR?%zx@osd8CqsbbrF~6PEp(eCEA8OvHMge9@sS~mIdjUGv z8}->b1W;QiXS$5bw*j3>ay z=q|0%Kl`|KdGVzlkchSY{L%*cab_m7+_?Hy^1qDL^+ld6?>^#U4DeMtDrd=d8%}h- z0zy!mXWO_7d@-bn_&9#-DF8J|Ac*b?196q~UZjDL#r)n>P|g~smGaEB5`#s8#1pU4 zy(Np`l5$xuxh5#>Pe}oZ)(^l&^7i3F8lNA9D+IWa1#*YVS5JDRfSfkfd{`0IeCXU7 zgrI2}2uKEfuPb|YAOmNlrdo|guNrHc;7q4p<~5ruVI-Gj64}Zw{1hYp4ZsZjLpJP{ zF2VzymgJ{gNYJW-fXy3lTR!6ZxirFr|9j5d`vv<)(DgB*wNmHG>IPgw4E4e67Sa<< zu)kw~{d4bzW68X&a=|0p&GcV$W&>5qc=!f`3b0>ku#1c<{>5gHE?WI%y!t9t`H=_B_o62KWvCS6eP8`MtQv-95eO> zt#0ewvA2|to}^(%+C+J0p~Y?@thF7hlycEQM%bmPrkUfgrh{9d76yLM-PmQr-C+KW z3!RQODFeTxrps01R@B~$kAR(Xg3PQ5&MO5kV?q_u%8hIew0cR{g1c=gq(@M~gztHh zih<3OPL>*$s)pW=&L*m4O{a}Z!@#!4G%+{EQ=)LBFtH>h!8#z5Z~C*Y?vB*nQHk$! z@&gnJ$i*>8_H%XI*=PnJTtPSb$VunfAfuO;(PJ!ZltB$LMaW0hC|v*ZdJ?lQsHHFI#=V6&7AQsCOLxiHu%3pl zaZ?pp)y!56%ooki^Wo|#E!*?!s=a2_flyR*<7U_451u_vw7ktj^ZuxV>Wz`#tLqAn z*U_E&=PLi%WooNdCy<>wPJrKe3TVoKJ?5{cuXcgIJU^~J>Ym*03)yJs@sq#b&1ThZ z9b7p0&NK4xeuXM}P`!&h%wGMu?H?10Dz%&tTc8Ue2*c(&O>daa{+q5k`M<$%>RTC3 zWg2ehq~wXaGyW~?DLb~hyp+IlA>82{(R6sxh;913OE2T2xMv>mmI)LAH=kkO%!n*= zyXO@jI%Ft-C=f_8PP}7~|FKPd5Y>N0t9sdKWIKA5i3_0(rd!I6TZ79n42a5ZSdoA@ z90%Djx-39A8)4pAZJ7Y)@wY2}$lK1bry#DC>B>4g$Unz{qK~?~3q3U#At3B-G?Kof zp$b1WqYba6;qT1pXQZ{QZ6N$9tKg+%(tg5!Di+84Jtyaxw5ZA@tx?!1Hbr=}N)Z~4 z7>5+Rpd37{X@zTXU_e$(opC0Tr6Pul!WFw`bumeb!1(^r*%t9Bvx)Nc-SHx_H{kZ% zVZJZDWQ;e6P&1MUb9Zfx6-QjtOC2i zT}+&_`}UsEy3xJzj0`NLyhKVfH+wekUee2^+ zx>1UDxM!v>wkOSiVcqr_JQvc@Rfs8C^Vh{@5@ieTYBN8CDdyZq?D%`(oNg|Gtp;%} z`(>yrC@_zEg_d77M=X&R$bMh%EVA$C{BAsH)=V7u{TP*CZ{)5EAHSz|R=hu!5&7yL z6+^jeA7ky!2Bjy*8~)y77}$SEZe%D98T<-025=GdhAt@flII-$mSMEhD$iNsmWSg$ zY_tByA`xBwu}I`^7P;gxLvn>TTTcSwV<4v3K#rV3giqXnURE8c5$&xrlo!6OR!aWV zS_37%vpjmm$~i+4<ZGeqRpgPdY7|PRK(HhG8v8ooTw2O&7^5Yu!u*u`( z#6G-VjjU{ESz-G;=(~~D)q0WvpVm;4?eyOt5f9%yanSdhCmQwrgNAe8SW?^a8#~Ie zenUfc9NA}i(rJqBomz3!JfDi|*2QnAh-3W^TmHk6<^R~D&Oi3p^p8Diw?xg@?Q>oJ zD}wmP8)NY#k3hY2Em4A^RVeyk!3dpW!)jxg+8fs6*H_)0}l>bM;A-DH=#WoTAf*|%&Pq}|Cru6HT&wYG?7#frF z`)=*BjliU~uO4~SKBJq$WGa1#4-2)#Vs@1*QV+v{TQj_Bwc*2LE^7%>1E8I=4^U7i8mDQXF|-Aszya?TD$V(#}LIF!qXyg27lz=~Yr zTCSE$m26Bk4cVUFi`vtlidAgk`Div zN|R76Hld$6($Txx_GY8j-%#U%ejz)rC)rl^RyrTj57uPLRZa; z*j9~VJr3^t%j?x6e?T`n)08*uB?BLb4Gk?e(XIKYp7-VN4M9Y%3?zz_C^vB#jjy!F zdd$Dgvg-;vkVnR=MjK;%cHBrYRTSR+wVxxy zUHr$I@TF?BT+N;Gx+ z0X2Zf2IbOl!f%B{VYXyWAp=Dml}=xxeVbXPO~$T3r}@2Uy13?Xp%JGASq!-h6$h`V zN;3~BqEKcDq*43`hpfVk7%#}l!k!)&SBArAC+`y3Wp2!x_j8XUJ)JtSGyPa6(MfPF z?EeZGMCAW=0*wCSOd1X(x(LmHb7d5T<}sgudv5Y$(shunR&1a&6xrG!Sv#BTsv34hxp%Q&SW#{AZ-N`kgrqLjHRx%bxoaorEHb` zNTRCZx%Vm=wfuRqia9Lk`#n1|2%(HoP(A%@F{YPhab01eLhY&V9GrhF1gOTL-+Z`| zv80S;5u=jO-V?hYeMfL(lhE+NnE{F^t)wij=lf5=Q>|;EkyAv>A!BePEdM9IJL$ii z?@s!U^W90N5J}jg=Knfr46gM_iHL>nS>EIZpu{mW@%{RHzN0>2@P5bc7^hIt~O-~XGyr#L@84`^{8ic z=H2uFSj8i->9GcnN6SlEmN|h?N2|s$*jUzE7QbHLvFQ7dEhw{#&7E8R-Vud%?LwFy ze_*%j4;TZ?PK_LEWGwFVr`!owM?Ao5en#>ty7O&$T<~{3-KP&^tk+8^QPn%bq5JbjK$al1{(d z4{&@GgP4@3kEVhrvofNR#nwm<4_^YHKJ%LR4tKG_Ia@IzTQRObZXHHGZfQlr3Vwe0wJwmO)OL@kJrH-9idZ#{Fmd=Q7Ov)n zfQ&meKR8-;mk=~mW=UR4c2cEh)Uc8@j9j%iv+@H5e`@l}WX)v{pp+z&S)_NYm1iA7 zA7)EWsMP7%huW~#(Hs=v8i#dc8X1}X6WlqB;zNJKjJx>pxB)MRE-=Dl6o22Xs#B^e7ctOG1aTjdUUbGl|zTEAS zYJzH&V81uAE%L(lc#zC^F|YWPT<3)5=Bn_eyCMx66de%i$3}lO z(R`lqD8IW@+fCJ#Z3%8$R3&qHIKjYQDC5hVdyd%Jd!<{Mv^I+e>Lph2Ch^W^CHl~O z_SFZSL#4X2FyWT%$_to`UQ7pd=?$E+-(~&F>>PoD=xM-d2MQ6_w=@?t&>fz zuZpD4u2NUkv|XEmJ{Fd*@mf|31H4-u?RJkLym{th3o$_V^??8viur~EWj)oG7UUQh zt&0tne$?pcOp`X*c}&(4&o#TOX_U;Fpd#)vZW03lf&&!?F|d48VS9gS^5{e+;AgA4 zNXU$2X<~M1Ma23T!UqrLRv1*+E%1W1A#ru7&`WRT0BZypA_NOe7fRZOVvA6^I}|49KVjEc|!i@W7MNh^(EmBWP%-(ZkO}Cp;3Mk{=R1E_{FZN ziD+L0H`0=kNLOIQ=u6@aN<9t73o569j0jhKd78CNG2UbheaMB#q{HH?cDY0>lc1 zj2f-tQxU@py;;Vm$K>5XO;4IF#(Y@m1F&qGpyxPn z5UfMo)g&ZPjkgJQH(-+CpDg_Is?9WC#M%Dm@T1A z61`okJZ~~pP79)KiPnjCX-~Tuo|7lfGDBw*8@DrQ!yzI;LXHEe@n>Id+dJE_Y zcpI?^2ljk9oDHimmX~?y%K(ghCt@}Opsf9jG;`BIab+1jf(=R>JjJOSrJ^7MQ% zX)g;`&v&Xhgza_2eM_ap!ELrLLVVYG-HIVDe*u)uyP&aMT!GNFI045`4!=bF>w&50 zdfciPU9o{##%(H1O3oZDrYc07k=jN4Xafd)l2bm^RI9kGq>5afCPO+6HUGM9zI}&C zzl0{gP76RrSv1rDP?E)@IfeOL)2C&?EW^soezyh1`ZIvvUyb;UO2wrOHl|N2Ko?NvBS6N+h{PlY%mNm|=YajV}Yc7;d@&uAn%kVaR!2E{6H&n+A+AVov)B4AnNnipk7> z(m2xO`^^)bE{B20wJSGCo5}2ZkUxB%;EWVx4s`N}S$}y1%q1f&WNRLC9WuS|r}J3Z z$|_fsx#l|Mm$PH=iphY`MTyG<>sOhI3WzwE8ebu_k$D=(6gNrwXrr{A3F-6%a@|A^~i?4K^tH;P@IfPzT z{V@ve)+8S~QIw`tj5lqBJ_9}(6-LlhL8o+j8^-}AxN8tNa(Gxjqb?KhfWd9Y1kYh0 zq@}lhXMKLD{()b?^V{#lB!{3~+Ez2d&t3W4mvQwDvsBs0Bfqk#)>W%dd>~_jXUNbx z6(R8d2b}hO=$7ukNVf{UEgt-fG&sz0AyM5j^BQzYY zo~bvKR~e>3nBk=wXiUsx>~^X5w(sDoa-Nh2rqf;&EYG$T8?BnaRBCU|US?AGLgue1 zeyKfq5W?ZdKC+*S=;2z%iBFE&p6`FLp}%kbF*kHM(zn$a@oa&8^_$Lniy6fy_5pW1 zkUlFl_`{7ra}EpBWgBCYt|9v~To z4D;O%gvVf(L%@|Dg~4NZhTBl%oL>|HQPs7a5VP}qygS{WlDd$R3vg)9)UopbHf&TT z9y4i+OrB!LLD)d3m2+aG~jyVE1d7d;94Dier_v3D-Tqs0ucUILCpS0;Nwf0?d~wyrA` zyb(hxV~5p6Qn(@1a*?dKh=Lx67%2N0=gkvnao6pNU^lfdrO8Pdh8PF zF2)}wePs+;BoW9w|M?>S>d9mKn&$LnA#m~fnMQAmx+TXG|NX*>EID{SUQ6Y`Y`0qc zBQog}*`$no!Gv3^h|2!z&xY@E!W?S}rmNi@dPHZmo z5UveVjK^y5QZ07MQKxzFharTCu^rYk$Dw_BY19?C?MQ$>VOitdrzVmv!`yrShYUwM zp$54=cl+v!sz(P%BKC%(amLDM&C9+!po+L=r#HU8H~w>f);^>S?q_rS=jS_WEg*;A z&CRa)Xuu;dv9NV^wkU=F!u&$cEdT3$FffOQH{QqgO155hdSqhWVGr*6fozfNl855; z{3c{CO zH_(+4mIRvYN-wj3H`vA`FrUlaxUtcdu$`-n)CP_bRew11IC%Ct1iVq#cnO?swaLX=8B`$M&kW6 zQ$H!67a2dPSQlwOsr)af{tN2=Jk5VfyC-tTZQg0U27TTRyB2lcNvrl-W&Km@{}guJ zKdnYR5w`EXphWQ6u$i5=K?oPwGyE8dZf`&|&k)6`zz1J9&U zItbxIv-uAF35|3+F#fz?i>>yt0)q9PcBPb^DEhn9CWup|ax~sZEJ;pVuq;+SoeKUH z_cK*9*2{cc_A(QK5KG2k38!#{ym|;9pVAW}*0#2ZjHX}LRkvg*_*AJ)|Eo@?Rrw&Oc*KtCGz|5h*!U<#h-(#Vs zj(;Z+G1AE`#P{>oCxje|8ftU6{1?^u1|Hs#g8wi1_;y}lMgHSJpoahB9FhHS ziC3WWgg+|SF?Dh3P|a0Jm@Q+5s7y2m$QPG7RLiTRm5r;WT*ghsTer0qlLEQ?LCl$d z1&&l6D59xwM35UIu>Hw{-qqdk@^Mpdy6S}?X<-dm&+_2$g<2!wUAr@8cN5cxI0JpL zn6Eiq&<_>*OVh#gbk{}DyatwxmF!c*=*C|EG}d#mNoKb-Y4ZI!PyMQF*k9}lyc6?} zexi@i|B6#$kpFfV;Qr%a%VIe*jP(#bF{d`F9P1bA5Q0A~Fn1Fa_*i+pNVzb`#zJ5J zc@^`EOxa@8m4s3BQG{7&YY+c^V1m@m7i^bR6n!(?)vjv(|KM zm1ORGt`W|XDP@^bNtL1^O2&|_$tWiViNlvN$`ujmC&{9w(=_Caj|>ty#@FL$6G>U8^TKPVY;($E1P0)-Bnx>2lrN3`& z+0hYYTpO8nt(HVBIV0Uk6dq->z-lv34$*3`?xd14-4pj&%CR=5i59|nx;b{zk5%nt zUNHIz>}mW~pz$a*S?YXPAwz$T5$X&n_(wm8ZJ^HdhM~4@))?bEGr88#O8z!g8EmRC z1s}y^)W>6IGT?-vOahb}Do<>$OQ%>4tQ#tB7~$h03M)#}zbk{+VTo2uz)6Wh!Vu8d zWTuJ#E566)e>vad^FPk__zZ~%_|$;9$i+%)lS zbqfy+E5+Y=kS1txKR(XPdQ)f_0p6L)PU~x694G2*aWrh}#g0`nrE3@{N(<7%u&3ZM zKTIAaVO?5ML;jSjYj$std3Sn!_+a`eATJ zf#?Ra$FBP9!LoOHlBsK5u~}TC*a+<-X?bxbR0No*0P^H91!r0yIaH+xAF(J^sB0;z zH$g(Gb8uuw>J8@}^PMRQc>Nve4`}!lPUxsuJqr9)17X-n5DaN8BGEr$^!w0`N?BCs z&J4~_5#A=*p1rdrnvT_+6|_eFRC*k)Tux=qf26=^X&`o5Fd99RC5m855*b~i$f(ig zT!Nd(9I;^wMSMr9;Ls|PL?@_tj~0mJc`16v4CY>2LDEmjrfvDY40N_<+ZzIU{XXiG za{qF`l%a$qC$##5sF5z0Qqg6lbK8Dcsy+GI8tJ3xBcSO{Qx3)*q(6zIiSVf#$cYLB zwNw1uQ;UdRm_Vu2#gdgFj|&Ek%T)LDm9P40s1;syF_ZlT#Zbqi=}W%qCAW7FkE~vc zk}4V-w*#)-4v<|oA>VWBX^uSs@jqO#<5qT0S`$D_d$#2W=&4C{Gs-?fiJdTW+HKL- z)B--Lv)Vx}uoP)qf0{e2rnw!{V9QmHXN6b}FR>TpsKnTvst=PcRJt$N7A`+yhL8lk zPEx}d9-_Z;VT8D3p<|<`5Qhm4#__cVbbsd)5vJ`F+PgiU?3=AvTccjG1V=RBv5MqZ zKQX^HaqF!OG;Rwt^0GfyWeyBti*q|&hu!>GTNyvn(?&OgK{~sxY=nX=@Z}*Yvrs`n zK!9|{o!$fd-JGh84K*?+}d{99|RXc7J%yDzBWEKQg z2gfv5=bEmmH@_!zhj)p#Hb#s&aA`yCow{04n@AsaWo(s9=;AXt*V-pNMYc;&&m<|& zY!~M%4HUVTSrSBNq+7LN$yPRqh0w$9q4{hL<)n5|EuOht@v8;7Dnb?v+q2cB#?_wra--V6?lzJ>O1a2tK zCRYajTsj~vJ|;(qTbptmwsd2gs$P!oRUB3?2Wxb=-x6a~eRa$z18W-X%dpfel>r0z zjoh^)P$BNsd9%>AuqcMbIw+w48e)$SD%5jB15|V*<%~$=$`}~kLUOg6h1p(E)+4Hm62?d}v5FZ|(K2H;h*0*GgP19L!8ny=8K3Q1p51 z8K4qe)gg%823Xb#&^bdsC_&yPL9ew!{K|quDNq)bQ4zUW5Tx*s(G|Bqs(In=dk3-i=)d3K~%F zfrUldqKFLOQMEZ^-;o$vdCBdYf8WB*2&-hp`RQo~;tbsQSAO~J^gf}vmr&5S76!>) zOEnFAkzos&G;ui-wrmmxNM^(j5-<4VZ~b7yIZEW)_0q7}?5kAP)`TV6y>318AXm0F zW==84-CT#L#S_rsq;Y9qs5wrlWYL^3(0&~*mL$w;#Qd$M3MB6LT&um%g$I)rGQsx2 zKDBMuxsn5U;E2jr2W;XZVHnmm}5XpxIi`}YO^4)cB^=wzBc%)G8hg>7=BIG+jY0sVVgWaHMk@BMC*@ZN4 zQ$Cs__ua71Cdv={d5tyd@KvkeYA;gIPk4kK zo`5&UyX4nl;o1h}7JRfFRu_*@lVif+S!@ntxBGb8toITZFq+QVv`4tH1=S;~qOH^S zU6qOg$OQWLwq~**^sa>zEope%ITThdFnn@`7aRG;-;~V6Zg_)EpwyDuhrPUO!@N1c94?F2HKOrjgFA-nWJl9vEgEQp4PcV zUr3W4drEpRA;T)b@cOSwdCOrM)6rvw7?{1kcWoniV|Nn@$5|&J*>hb_35Y( zhDK^I*+%s*4I2V(0=jN#;A@l`Be&radu>=%$xiCqh=Y3!p;SR2s1Z zFd%Ews%YbQYj5D%2!cmlKKiH9{@!ns zX%9Nt6^I%un?2ON7gDx`(dbdU&CiO)@%sEcZrmK4V zAX4*0hMedEqP4ApjE?{|usS*W)hd2-o=I z_J?fyptC;E=SriN06M05J6vppJ5>L&mA{7X$Z@WGG;+bxG@gLAN@J72FprvDEn)2Z z<7V5(ps{g6%V~eG792I}_w;{i;hm|8)@9 zl7$63GmWD;sluVLKGRJ;+wxv7D4+`0i}(hz9)i(6ej-uFvHwZ6kGh-{PWKElHy@93>7LIk1fs6e?yj>ZghS}&yYsa;dQb4 z!UP2mu(u(weZ@yM#Oh!*v-^$@7b`!1+=I%PlfM1>E zm{<*x!Z(fm$klC|@pY|&*WTywdD>h>+qofJ`UKG(v& zi&uvp?&HTi@-3S{qjb0dN=i5-#cpUy^6wY?w&eB)$|d zHzjoV1&WhrYprV5K_;%}0Hikq?G#f5V$a7dq+jE8vOpz1d~S)qr%FxSb3lQ%tIGNn&Ur`as)i($5Jf%!TlmKI_1{XT<4TA%Em zy_YAy1M{Vrel0J0cq|hp75ovhn{MW*o~m6Z?_J)S3qFUdp<=(`qb1f{XfvmwYO~&$ z>k|ML)a86SNc}z1+LZ_!Cdnb1@+!`T3AuhiJ!1N{giVW~U41ukKS7I05&-*jXEHs6 z8@(Cozai>Mc)35y{*}8Us#(Dz^vQ;w(4q?Zj$HV%ZfEmDV=zPD^Yfq`(ZS#ExV|D{;%QIv{ID*2V<;eLH?1JaOfE-IZ~! zxdBsUNz;f|rX8FXLZy@d({RUZP$4^>=0TzD0H!+pJmtp@sD8~9Cx$5#NVU<=`g%B* z>7+s&sl0fV#2ct8KM_=nSs-2f`i&V7jB~C`@C$5i?>27D5FZwYpG8-T5%KzMc!mKs z-4*=3jDgtKnrnTn=@tJm`0GIuGoqoGjJO$S`97AfjPo$oXdM>V^< z+r2L@1_GMYeKM0Ighgae@flT*Xh2@0q4HZ`#`_K00FoVNg5pCrC6OJL6iFB$T?!_4>;`g)+X`QQfG)HzMM>WiRr$k&CF~rx_ zJ8BEaj197kn>|_i{nhrXtx|!bah{;&gN7z!_s0)!e7?9jkH*)r=#Q~M(VQ(t)WN_i z_0Mhjg6VqrZ$AP&penCUnYd`}ySz)bRwT=I0UWQgE1eEwQ>i1tyRQu8j)Mga0lTh; zDSRMS1ivrEBzX6vp2)9uw;)5ddO!zh(${}Mo!BWg}O6Kqn9`F}D zv)&1gt#;C>p&Xmb3vc!EskwI3t`LUnqk6 zIzrB6opVn`d6!W4%!)4|-U%haxPKk`El)0&a?pxb2W)*dNPwB!NmSbZE~Us2xd%YcNRK;lJ!!H$|`2^s| z$Vn36{wg9-@TUcP0lQS5b0JXXf(c!S5hJ3ks)PsQxn9r zp3AdNyLl#1SDvB?|5GSm8EuGL+j=+}#kC_d3ZD@DWF5)R5NJ={I;gf{*M3r6L}NZn zm|R0)%KM!RRh@Y{r!M5RZFr(J|Nek(uG~XXME}#->XfP_jzUB46CzJn1(B4$zS>6< zoAu~-;$@X&s7(AgPfnbA(5u_s1ZZanm+&I}m8UzFhUPnPf+}C2NG{y+Rfo(BA9D3J z)6!}4L&f2hGOum`)d&4>$pdBNW%F=Cy#Rt&#(_`K^U(og5P=G>>mw911Nu{?i|pup zBmv-JRANknZa@#Bl|)p&64z^T;O3+F47Y}{LSSb<{1Msys2`n6CTv0}2S?!1YE~=e z^yx5BhalicYeDIR%F5Rzo?FU$v8Mf$=ycY?+e>|KnB+F! z^K5;y_1-_!s*k`{lxqf%=aQZ`8@MMr28iSw|Y@BTp7qjEba`OvkFMWpLK1&tJMm^$xtfbFfBh z84g_PDC01vmPdncE^ZYbfWJ3LYm#Cc$5H)wt><%UCi62~Jow9KK$_Vmy4A+;dpv}uA$w35VOF@q#PNtG^KNR9<<&>& z=ki#9SI=7XyVajs3mu*_D-JbcRjwu`{+Sm2v}$BQe?9mqb!Tdd?_@-`)_v6-a=r=T zpW^SYsj|i7;^@~L)pG~U9i;2$xkM*sic6ghg==(hk&`9fB86Y?;UZ-ZkQj}Ts z(%<<91j9+Hno%8+F0_wV`((!5b$^mONS9S>@1kUMW|j`QT=6~apcgFCu*835KA3;- zAr43{x=Ez2z1%(^ zrahMUy_!fW*CLg-7JYJ_D5HR9`dbA2`eA)}yHn-!Cz7DSM;Fc?={I;bjK~@6RE(g~ z7I8!uQVi!jOFVaM?y+zwlSD1^ppA^9PVg_kvR?4t+uj%jtiR0$d`@$n!>fjrHC-lD zti7U9$QqN?UEr2hpmAX6Wn`ex^_jC#ipk7vWZI-0T>`LG!^|3uvb4y_K3+JR2^&~g zUNrv%c|CTg|LXNa=Z>i#a6w{+W~zmWFjTaLfH{LT=EX#SDDU!{YsOk|WF`R5JA6e$ zh?VBm4%E0N-%O%zVII0sl=sk%+;^Z6^7HZR%2rQd^My{;>{=?4hRcb38n z$&>EK5QQm%bxw4voHp48y8~Ucc6(!gONtQe!TQX=_+t-WK%}{3=<_p1nHWN&o!_Ju zI4rXtuKjPlYI$MBo$qDxa{kXIQT1Zdw1jNW zGe4RpIXN6Xos)R|<%JpL%s{sS&4_yAowkHnFXngc_pRk+BZGxtNpMi0E?cC}t#UvRSF+oj zb(IhCi;n?fBTGNT9{0@#qSxonV~K9~%=8++(xFo{{sE5&JcFp}36J$6s*<_2ehK7h3Gc3Va}pO6~2Ah|4Z> zY~k~lpBJ}jS4Aidg04fnY9xdB@(87pzd_=I4BY0d#!;SBJs%|Am`gvs*M_XXte9?~ z=UMX0b8UnZC4LYoZZVfeSbdL0=x*fVxj7o>W zHp*IBsj6 zIa|G8*8N;c=o03l(g}b5fTfvYkDCMlpf4}X_qP+(dG@f?@dwV6Q;V(A9NX)KLlD-` z=g1@66epS)9o+7)2=39x!&pAsF+>T3H#?z65yW8SVD!XKJ{RymB!7hU^W>6PxYo8? zY7}dJVqtZ_G&UWj9;>jP1I|TfVVF7c<@OnWyV`X)8m*Y|t+!Qqtnh-@&>k;4G%)D* zd3#~1ttexM+niNg|G?7GFjL$3z{IoY`5kOnYcnPd`|(=g(Pn(^N9Q%~-9qlZi40a`$%zrAK7@4HYglaim5g&5i& zkVAQUrQOZTXQh+vVlzR=rlE6J6Ur+=YgH4bt4q9WZK9>7l?z(ggq>Jv_~7N(*2RI# zv#pB*mus_&gO_h>7uCyof1*DTb1r!0avalH^{+ajvr7Nk!JTPcoq_()&T3x;yM>a) z>*yqawzfIt}3b$DgPH+`R&KM0N{qI2-kEV&|{ED(w`d zR12XgMS8b#Z+A8G+MV64w4)~|?RE?vn$Opv=pyq24=f4B_jzeL3ov?8JA7z=4UD$< z3598@JI?cX`D4N?x=41B=pN`37BP}BQWwE!AO&`@7MD_TeesW`c;Iy~xk z4Tr78qqTTEPK(Euv;3qj9>y9g6YG?sPHN`_wTK|+Fm(x+&JZnFLK*eQYGw>gz4RJR zH`YWVlCCXyrNtwH|G2ZSYmnTA8c30w6+Y4a2wu$@(59$oMxoZ>WpL}J~c{|C$xGIC9`Sd`YwXIp|Pkq%2e~#j2({IV*=bNjTV&wZjZ)j@pjJ5 zYu&K&$nvn?VJas}Gf$h%w>DY`jjR2a`?aSh7C+i{f9yl_$w3ivC7C_UG{P~Xn{l?g zn;bT=qDf_y)xC-OVWV#6`Ufq~Mi+-K*Y++>`yutqd9OwbIMt1s2C7SS9oU(K6{;3_ z9MM_j!8xY0N<+_XqebyLJIQEK`$DTTTG%0pZ$xhxe__3&iiyql_(Y?H&_sxbXtbz3 zz^554cD7dN1o`=nsXsE42f_!NJU9srNfR26suVu0#iO-&JSL0Bmb3h%Egs%l*ia<7 zz==~ba@&(N;BkMx*!z?3*C-->}HjbT9miK4lIC(0K2{ZPZ z4e#i0YU8LDMjV6drT8?ADZk9(-nAV*Fic(hqaHS^6nw>;H4 zg*`-wqN>u#o2WWZr;~+-cn)-1z z7%(lowL|3U#Ak!s0x834^-EdvVt|0E*9Ol^MfJbS{!3Z)S$ATly{Pl={|TX=v*2&M zhMPMwqvg+u=f5SO=d#g(Nlog|GNJeGUED7@%AVfE%A6`y=`$aUcX2hp$(vouU;a%c z(Tz@}(Znx@&!%DI{cydDm2Q~UyV!acTkm4)U3}o)MKZ~Hu@d$=PKVVB@!j6V`tbQj z?p>^W8XmSKq;~3$$`YbFR3B&vk!P5lG1=j~0XxXu2cxxvw04lkYX@07%TL-4f~`(C z=QcG=apnX{7aCJp);N8vD8qUGEStiDaY^+E4@X=!HJYkQN+AZa?L+gXU#bO`Qm+)Z;uYYQ{U8N zm$Smo5wd&-(?&Wl^~uYFB_bP{LA+3R)QP7<4(`iQ|G$2ov#v}np5@a>Z=Xm0BD(JN zZLdhDm-whZEOG$D1p8@Zq5-^Fvx;AEJ)R9*nS!t92a_`592RDll}W#sCY0s6l+u%F zP*;~$mSWlLcr@~MhnD(KYY8Us_#SUBX~h0V{Or$V0uv-S~{@j#f>` zsZ|TSTj2dffVcV+0dFpl3I%Pcr>W7BTdxJ|uyLuORwfDwq8s7L<0bnoYbXGI((9>ufU6}!JiGEos zXr9+Pl;5eIdxKD#%M(10PZlx1Jp>r;DmvLr0AeFkX)MXoakIHM#9S#HtwGH66S<7- zm*JP#e!8yIXnse;T=}COK4Pw%`XfWk>QKN8mnA<#2%vTYNj<7cTef()#mnCYFCUq) zEcFIS4Es#5(~Jp$T*8?msZS9~HjX&n4z-KK8F`c%8(tPBV9;f{(tMVteOtyL-c5?({JW)DfYai9t;Xp&A3RjcmeJ~c_TKYzErrr5%h^fk4cSf{U<471o;na1o&URQOn zyZQn?QD0Nc{~_vYYIpWwbDr9%KPt`xF!|6>BLJlG3~;<;r`B%Rj7e-sPfL0pAnDn1 zP@gpE(TG_|eBv3bIc#vy-dL-hrp^l_6lUH@yH>-ZhV;CK zTPGXN=|n%bgK?oi2_+XCEN~P`GtA0-fFXb3TCK=ZPZMo>(6?4(*v@?Ti_I#OAz>hZ zoWWph=M#awDx!u;X-%l89g?q1Og{^9m@;}OUa1-p#4=?VQDm|rvmrDN(Mk;xrf*Vo z@+89aWa5N2bMozF5^uin{f^n}2o<{L;G74Mr=&L1L7S(f%~R6mDQWYRJn%dvpRO&9 z#h0sL%rbFgo|0lEzj>aL-8{c`M|U!HN$~gM`L$Eui|6l5NV1#dt1c#8d@##bF~%1J zonaLeeQN*Asyaq2uzW<%km|@LNdDbtuqF8|$$y|Ef9;??X_8MVwhDRV4MSRcYhfb@ z!d}JmQfNY^2V^MT*W3HjT z;&q|qYm&N)27H}W)V->X!20KVQup;{516{Yxtqyi-Md&z-N`rfb-p>+knrbBFQ1{ABIE}jRN4_fue^lgK zi^It`KEtd-&`InY$(RtFr?bX|*BE;@mDVVat8l;b@qN<-)PV$pRVZ=BAXDs0f7hz{*s=TL^3#K*m zf>Df_@QM(sFe1cL&WIHr`2g97_Vp-i4u@t%F0ps-U;h+6dpGj&MStj{_a@JSAEQVV z@DuFj?X(A9dtOKr-@p7dfQ>y-*ong&1;7>p$vZ&oRDe}LNdSj-JWBhQaHkeNoKXCE z48La@e$Qn2d!D_!c>lZ(l9iOAF-V3Qr~tk0QL)J&h9?wOINS2q?+4_5JqXCL4s8y~ zg&U}U<#Rv`g4v3hD$&mlv)Q(nLp2v=Oww>fBjd;9pRw~LIg`rbIS)N?>&!l|78~Ly%&JH!oV;{QYL^6?W5otdr`BW4rE5Uou_>2D^3aeo@S(hWKPZ{8J1*X-vu(4azO zCsx5s!ti$k4OkR*(l#D6YEi=@M-AJL@{@)QNHOlIHi#K%HG}PD0(MP1kt(IM_e==E zg+wfI1Re{Y5+*HdV9FUzEUkbIOEGEj-m*d58TD6UMhD(}-pdg+?PcTHWiL`4`Ty)) zTXWk+vi>V5@2QGiB|+oq^n>}%Ay-q4pPEMU-m1{7Vp|BzWE&y6q9`?7N?iuhR ziU2`@k!^)}h$WG8zjS{+-Cws^G|)OxSW0x^RLg3SNo=CN5%pHYC#-bRB#2u*G@&py zD#c=}la+Iu7k9Z)3SiMtw=mR?R*b^|LZb|bb7a`bs;%~neWOGsNY}Z>kJicRq(D;# zbY=B?hTpBwc4Fw_n-q7@+wDF|L-d{~q@m1GW7ZMQte9f#EGR8V-0pn%>H6##UiQvjSFz?cTk8)dTSGEam&vRE z<$`FfWgN>`D^4VhX&^)G6CNd~0Z5TZqP;Y|L@>feaM{2`$!kmR5AEgu7|P8403@^kTU`wrU@g0#4)BksmPC9a_3_S>4pCwAww~ znV0s0A7R%po}kr1w2zUGQA((fM!ul6o@FhiyM!}Rn!m z2$z3AZ{C&)=@j1Yio_k<(BX7P6&CwX$=9qu1+Z;vjHyRkXxnN8p*Q33WNI0Sq zA`#yklfWh6Ah$UhLpM0(XC!h)BHua^*}IirG!lt}h{zb$IVRjo14>kqdI}a_Fh6F( z(^7LChAfE~$XYL8kxqTdSP~GHN^y|8=GR?C82!iQVuqkZ0S3TM*XB8Ohc2^38z0=4 zop|LJ14=-fFA~HHCM>Ptnn&&#Tj^+8Rm_#!hRzkfiQIUj@-HiEM{Ik$mGxtEs=;fvd-0pHsS*uF3^6_S-!&Ue2lWYCA|YHMo+RD$1J zbvK3GK0}I}3b2Mj8h6O5kI)F?G5`+A8_UXL(be{RzXp^sX@b`#uioqdBJOuz!=vtz z*kTh__XpcdkB1OsD1-=}3qU-zr|rENVkd^H%sL3-ZP#c?Rzdo=cS+;pz49mtXxJJP z(GRZdlL$ws%m<41dftvHLv0UK%~s9#kfyro#xWWu6e976#n&VrGxP^^8R<{>ZdFW* zDkkM_5D!x^`6#4&G{v)qdDbw$F%5IyPJYn}rt$zNs|a?0jsulMNeD|EOHR^2`y$bi z_WhKlF(YA|q&{PwU^?)m4@#((yRQO|6-=8%NT5z;co40#oJqR5eqF9=(5=dqB^&Lo z)uJf0As*CDB^M1TqEjsE#quCG;z})xTz;`4nir-U=Dm8;3-jx4FKio*E{pkAjw5uv z!|+TAnrpSndxW~%KjBu$^3nB;8vQd%)7eHbePd`A=OWJ*OH5vBYI`t{3o};rS&)QaR2c>LCQG5_G|h0FV&>?~Jj5##0#b^+vdk!_dPR@D_}Ns& z9;}LgoDTVJTZjDl31;YbkMeV(Y4_bhGjxa67M_xJkvy@d?Y(&hBlMnIc&iS4yt2mB znOkLQ4mXXdsd=Ztk1rRgzN{)S@+k`==EAS7wSB7YRAMZFNtN20wv?C4s&p}?8x6Qn z@w9|)&y}&C4yXz4vi9TElX9LC(}Tci1MR%dY6jduJ)-1>9V0Ni2yUhY9i0Bo!%5smFLocKBEJ(Uolsu4vCJ)dE!Td-O0#S5d?HBi|D= zhN6-xW>dJj>zlcgt7%bZ<{O<__w`1#tx!|lvgHPDwB@g|&Pck|!S7Gg!N$R)K@oGS zm&3P5^M`u5(We`WaF&Do5vXV9xv~syO>A}LyuP~ubp~^u-V~K#VryJN)_G5HD2Y-z zDEjhd7c~o8@$YJOjKZ&8L#Hk3^pXTtfcdDMpzvj3h^!Bgm9^kj?U(=t3had$HK^C6gcJCc_ zIyBn0M`ZOQr`soRw=2nue45qnJj>IvsIA4n;U|K>U!uzj{DWFJ=FJGSCYVr=M6r@y z>d7$hWGYmuv=D)oUdYn6ruvYd(HLro2JxrS*!R3>5D^@W1IF7)wE9&M#+WgPuI?)PKRXK}_?sx}>{iV#btPGRc0$=hnAmw>3I>i0~|YGroNNaWKJ@=l}^vjH9K7 z24hNH?jLQa3H&jQ++o?UVPXN&oe5K%vzg`vm}wqwxq%g*p{p5{62q9;2FzgJv3h+iVOLsHGT2ko;ebC1Q)`B!S-7 znY_hl85l{8R*c3LlESWCg~y0;x||=%9*1r2@wJOxZ$aBT)3jzDFdV>P)(KB9bMx^9 z`mLo3)hw9l+S)>n?DU?<9cwjF>FnOvS}L16eC2pY+%qjplR|7 zpv+v%@X>bF&icKyn!H-aAvKXk=xR85W!?OQGd13O80Km{3KRJK7MH{L8R8FjMR}`n z#@xxP6IpDc0WYt;3^u!j_6MG8cfa0km^r!q<*6o*wixObGs4@4?Do4ar0=>+9-$j| z7#X5n?)$+ekCwi!JOVqD==m;v*qbMtJoXzKPz!|ZQC$Ws_DMS%_dzR%KlW&QuBhHt zjz{w90K^1@PW*VFsiCuqXGNu5!{19g9`*;){R^DFHlje$IEEA19u3 ziyfC+Y~N0O(J)X*EoG7j?I%GR#Q~r~5h+Sx0ezG_Dr7_mo~Dscqd@pFPQy5%K8v&; zM9I#^J3fOr24($lb@le=A9usB?0YhX9yO6qhn!>EQ;&rgO&dG><$GI{=5@ZIb^z>^ zY&rqRNtQ)b?G{`;te@&>I}AGlCJrH`CsQ08udeT;@!D0_52W#84?cVb=ga-)`v~>p zQ2E2TQVy3tm@K6umHhrBClu|)*Nl#7gb^`}_D(U1B{?brP?AvhBzi!6rkixm_Tq2d zUc7%Vzi3S%B_i@c=0`yohAQAZjzY{vN*U+^Tt*=*U7{t8Qbc(=)Nv3TI7OB1wgjhTi3Y9*)-5>B3`8H~eTWKDcC@>p-^o(k=JFYagA z^rm*M#3wYN&fzWw2oIooiXMFEa)-)AVtA{}H$lCaW9t>}QspRfN-?n8MtCEQRYPa> z7C>kzLE~^{h1EJvrfpC@z>#iaVjU#EpGEQo>=?lpU1ORclJcVM82SkQEqOtFDt-=LFn%Cf4CwMlcON?mL|dDQ)m*=S(7+x5?>fb zqxZr|l#S?5q-;=MC{Q5$hgRf49*tEeZ69^TMml|B?B$SjUVhbNdXWvuMT z6oxzyhEr^%OcXTkfmL-;)#^+gL+851o%$~-}o zOl24Wa*wr^oGLF!qYy-{3El%#?|UjuWfCy$MTF_p(}cGfrXM4CJXHc+i*_;-sLwEh zm0vEJXJ-ylW?Cz4AFH&jbgxhiE^L(brb1&wHn|3x_VJAxMI>5~w`HXLj!8LSIyJk$ zKtuLyX(0Mmg;tKHSm+kU?102Zi#DSFCh{C}9f%c6={&29uojI8L)CW}DQ*V=E#0oT zsBApBiHAaOzVxqKu1zp$&{LDv;A?m^Z`_M_J%U&H9@_%GcmMv-gLt>Lb!hi)v5mc9 z_k+f@c(#twz*eBYC{bhP{Vr$8cmv1-@Ic2T|4 z);tylTb1nd`DH$jI6KNs*c9=Pia=%o^*wf6$4rsqI%bLtisgO6bnLC-xaoOR#qra% zzlvc4>7LH#bN>!U0q4BcjpiwpwI0-CE9*RPPpPbR<2gM8o340vQvEcJoyVa58x+Z^yS zoT2LS*Q*bsIAV0vTKcf*ytDCM`2C>k+5wJ`5L1p&c5KR#5DB5FNtaCHvCrL*_jYFI zBjTeSfcRsdxNKO+bK}8xPJZZ|?Eqi99bn&1ebI&ht(jC2Wy}{sCNv>Yz$ul!mdXR+ z6{RsHB8qhoL`nuq38EP1j4Kj)aV*;ipAn?%deLh17Aw*;1m<;_O`&Ve%Y9MaV@&QR zbmr<~TOZzxm^rTzsv`!sOv?7f{thO#Rwm8iGGAK>*1lwKoD`A!yX$A_POdx*Zex!XF->R;T}Y+rd}m($+-r}mYXdFGXuyFNXIknzq!<}75s z2_fVCiG+;rajiTLme+$tR;eOf%aD0t5^5cah^L{{uv@w0sZRhg@E{=2E5%|SL_&24 znXZ>r0N3Vp!XO_-C^g|pj?jZ2aQih=gXGZwYw*<-(;f7Ru4;m$PANt@O}<}=9N{hr zkCY>gw-B^^62Id!SaHsBr zM;goK)2=9)qvcIN{bBM(l%KOtW>blzy4(!oi+Zzq$BL(*0Z1e`g?Ku{9Oo>az6tU4 zXM#B%V3*KmB4QB{e#AtoiRS}?NtKe4=!mNb{uA5}wFna7g@VS)^EH#9N=VWvo;qw? z|ApQslgWlyZ_C{UgHtSjUr+foxSc#5&9Ypr^V?o*XK`3F2%b{J@UIrpn7r+9@iXE^ z{;}~7{@90-)TJjuG-oOy=PWY536b$x=J-EA3_ zCc`{PjC@+(U@H`4aol0fX7>ubzv31S9&N=E^)ERc5CXCy(3iBSqQ-2ay@*Z3GCVDdTR<%gd*6pG(7<9N&({C(x88@@=VMoImq5CRes8(vefi;0t7NK zVE#Lk)^C~5#bROlg>Az}Q^bBa7LcrC$5838VC?*~ge|8>NwI`3IKMzO_?@lIGTz-} z%}A@&3ay+qilvDPS>=|U%YI5#po{Tup&qpRzcIeS&DNjTs% zn;niEtW%*M9$%~vi*KDE*LhnRhn@;H(7rjv?wD}sIxog8n$f; zI<3YY=nKbYrna6#Q0+`43KfM(zP`C`@Yp6rdT*M;l6aRm$vxgB>s<5&s?QhB43k%u zt5LxYGm`~pKwD<5k$D&}sSZ~2nVX(sKycmoI+;}$_A8ToQNV)P^Ky5S!G^WGUga|1 zT!OfvnhC|wuI9@|X)!EKCxXi}5De&b+t8vGrm2A^%3h_vl7p-B#R0}31TNysfJY;6wCgM(nMki=vp zH7BSnFi-{xpVNS!CbX zw#RU3tCIckU|vMxL3u6@RPmfKP@Tg+9M5Bxa8Nu?=ORAJ&^TNF+vHf~B$S#cO=TQN z;S;H#N1>-U0n8ny0P+}T+;0u|>Cu7?6VLY<6FO2!kO~=6@Bi7m+UB;ABmGxUl@GD& zOlk%gU;y2h^LjTI*VNGA!y&Sq>{QnN_;Q z_YX=Tm1u-(LD_4HD`Frj)8%i=gWDKqq{E1_KRj$q_l9c0)B8iU9`y9yzV8q8@YZqBP9xZh zYlLsVI<%b`1hY3}aa~q(gffUZCRmXWbBO}py97+sRwi<@8Jf*Z1oOOh56-NzZH&F$ z;KVoB0d7)lZ)EH7FPVG*$(`3fy!!sbO9F8p-o`M>%i5K>xqsB@*>z!$b>Uj_04)gy7Sto`bFfe0y7v3 znp01rKUW}Bb@XmE*YM0)+rZf7VW^%@W%Sc}W1jWuRDNR`H5IGW~1FFxN_ zu>WqMYICz?Zarf6AF!)vlES*0%Ly)TbZd(j%J%jXzmB0tk{MXj$>!7Fz5dU4KffIb z7v}$=O`)%s>Q`598ghn|d%=LU*^PxsU*lwYL))e})20q)5EMtW0MJHsfE;H39yPSm z!En{Ozpbhk?cv^17u9}On-UEmBx_`zrgZmxI(ul4e%vj|RUTH<+XXK{tQQfeFVM)W zLK#9q1j#a2RqZB}l(@G$z)Fz4xr;P1gBMLRJ4aRUQxeMFVjFm9o9hbqlFrD(PKY0EI9p*kVc9mUQVX@by2I@B_J{9Z|NQoV z@Kbg~CEC4pUg9Q_DDp+Eih3R}g zPQP;-9|NcVbK`11{UdNS%cog<5V?tvH7`z?@U*C-khM$!lszHqCuIFq@{(=~-#3k{ zP3|0Az>cxhWlCm=QY=f0SP7QLM!`)VW113Sjo>zug({d;dCu}g=+YH;m)0D!nLLXn z8j)BKgP9fswQcn3?b*1l73lESA?pV^DHouC-BVd}6G^}H4HB!}tH1~fK(4!ey#$b= zRabRHwNcU8kFP%bfwSn;{qK$h|zV2^#zYXq&tY}&;p8t((*o#lp))vw#g z)4mCAh0IQAM3WsO+QPLPdx4YwHLSyEBd!#Ubm_=B?D`}!G!+0kqhAsVhc=wYJ+veV@&Iy3GkaeDF^F|! z=8I@z=CGSB{Moe;z5x=0Np0wF?vK4>g;1RcLv@f`a9;m}^a5C$3rx*>@&5fq=elRl z*JOe5FllP==EXxZdh*rBzrs^XezD*TW(rRaHW+B&<=JbGI%yR~WWJiJwGl<`t_k;G zeKZijiUH||4INq~z7u>gpTdrZ{lneyY4qtZP%k@nAnYi?G*5l<$Kl10pm#XQuJ(M% zHkdokYd`c$g_{flgWN+J%yJt2*;lwDrcLcC!qAv5Vl?NP694;ILt8X$qIg{S!a!Gn zzYsd@JL;KjVV-LS8+^2Iro!pMEW=5so`~7kZOo?e2bQcJJ1!JDwIkNo)^$N4$jI*Z zb|AE{RBJ{eTslkFXFo=|ho?+#F)2KI(2@y9jm&fN6)Y%~0YvYtshU+sVoSvTW?psS z+V*Qed>Q;{J*nymbTpY)*3PIV)S~ISb^O5C%+#B(b_{wNy`p6bCXCAKYd5zAlGv5n z4I%{Bz~srA=8T0BK}dA-J*T2!4gqC5vI$N@&StCY>=dj*CRZ0#>a|HDd)YSo!(( zhC8?M>)RV1kaCqKaEvFOPuXGNP`xic7E>;cu6hFFzq@ehlf~f4V(%?M%}rhuMVu?MuRPecFMhYhfZ{R<<621K4<@b@P7Kk0X6%o`!{L6s% zgVKpl%rIVMlu|AP$6mH-9(;+QIkYzmak4e7$r1s^8WVp4hhcD(atgP|Gg98>-w ziXtPSxSh!m5RJMFVH4Jo%n=s$!BAm1K8%3=I>WmiV@>)fqW*Iq7`|*gdJHGw7GMeC z1cXI5f;&PZ6jRf{7q0fki3VZh+6r-7#QlcD@c%@hGPH8*j6fH?*axG+&at)bfBlM+ zxnqu4v_c=ZpV->OFkS}?kaEgDgyKoNF+^1LNhR^gRuK+X@FBcxhu>Vdw#A{(V2hBy zvbH}F^*RJjg)S9Z??UVqw(V}8aeu1U@-@WOga(3X;jTe!*}!1QgCHt<;oG^GE8~AX zjXqRl<%AQ9_brJJF$4M``%t#?dbk9!dmLW~mqA*=kS0wHP?wG*+D5T;Lc{@p)23qZ zOaFEX-&Qp1jS!e?e?(okLri-+&`zOJm*HpUbr4vbA05H9fi^H%U@QE~WkEqYw-+fK za5%GA{}CetG4@lnc08zmOf<`(Fdr|xZvf}N*^Bev+>P@evzp`~IR6L~&V&TbDb7J% zjuV&VJdq_Jf5muabm6Q^n2fnR!Y9vCrem2Jn@O%R=PU0K6`X%?+LK#2KRztse2?>!WGd35nE^5@o^bvX&i^_%e_QyzX`C;0 zERs^?u$NpYnG3E{$xWe{E3C>>Q?k;Kl3I80 z?hnEGn{0UEzYgT-ZU?hj!HQjBwQoZt-{7Vq>T>r2Jymn><=Zi=gZb`b&hGD&^S*a` z(8;(OatI8+@Eme7&YaiRuvysA9!`4ic;5(7=+WM25~%TeaJwe2hZA3#rtGJG92gPBXE_}OpC(6wk#quh zIhRjhy&@1p?1j+ zznoq8v-bghjug|ug;I}xHqx(gMD91-QIBDM3|jm%(#W5$gFe@QWg5MMCte^M+pD`o z%|>2l_4gr!G_;BQN)Le0iGn`Ko~zln+2bpGuw2b%6Yo8yr-*jE?sy27v_7&FX`=Kq zkDf5K7kWgEnng=wlaCybYAZIJHf)k)A_RqdHz~UDx{dV-6G1iq8Jv@5l)hO-efB|f z6KS{nn9HS9pVA+i?9a$l0r%&pJ8g8V+ulMFT)( z?Sw`aZ?o(d%EQccKV1N!Ap+MssTNl^9j#b*(=7pDdcGzoLmtfFPWA4OFmw=or!bYH zg@x?d>0MJUKf#ZE)b0SRF3}^04)n(FSny<%GaE282znJx#kkYnH+|(9!o-WEqk{kH zv$3_Sx{s$FJZ`rpa|e!k^V44*4x*C$h$Lg-!oCYDJp_H+p%RlXt~-fEobDy!&Ha@# zHL!Z!w5+D{Rb5TZ-w)I9(g_1qE&CY9r#w9sV#*$_;o+0=BP&i>f_3Tgqs`4p%Jbq$ z!+X;3zJ|GZhwy#Vx|=Jc(uS2v6tOH&aZO{+L~1jZ*i^VONqFjHYVk9v3awHlI2tZu z_(<+6S^CgGG%S12Q92iH~1Luin3j=rmP&q zaU$>CjB@jRY@o~6K57B}c3yAy-u1)}e3Q2gG8Hh=2E(Z^`}Aeoe1euK32gsbHKkm67+yK zNH)WcK)Gm}<#I*_=B+@sTX7}GR-xRg7G+v+>g;$27dw|?oHJ{xequlO}c zR$o-zM=eGhX}_nDR~peZq1~Fm6=DiU;Y>8S5DQe5Lq2e%{J_o7(k>0;plZr3Pr&5$rTG>!3ggjFa^ ziga2Zu7n+}yQh5isI6Z&mF=QF9q@QQqaEw01?35G>u!;mcWY>>?Kf**lR;oZi-y z4xstufDw3R47{sz=%-9mDJ0|gCU;V%@S>L79y13}?ObV~r9#WH%wv&R!CacBE-67* z5Lm%U$YgIg&;30Z87s#z`rUA;^4JOJ#AMD`;R++1NzxqtwRaBpTmJ9d#&6&9@27u+ z<)6uEa=76i{!7I)mB&UK>Uds`~HWL$nj%U zM25ZBoEL_r@M3eBI7nPKPiNqLq^BT)6%acSEm^G}3xrmjP$`*+&3&~wt zSR0GH)Bwz^<{8F&Y%!#^FDfB2X-tt6JXU31a9cW;E4aF_qI;o5nWU*Iv{Aw-C9*P0 zbIUoX12MOb*?%;%VyFCm)3+JyzLGZMOftbi5Cm7&nu5V=NePw!08g|?O_oW}=`cA6 zi$Se}txDnAFO}JIo1yyT?;kYGMeUhdUPW)PmPf=RDs)xVG<0GOQV>+f-YriBpS|b0FKfADus%I;$i)SNCHpcC11rH{DMla3I_r?w>_77@lf@Yx zpn_vN!%v5yA$6p6^JeJ=QhWDU#>6-~A}Vq10l#%x;LO6O@qv~^|J1e_F#A!oZu}&c@wP4;9zoMge-)IC zS#|zlBoke`6MiD{n8(ElXN>+&JPhl0M$A2|wLF#7(r31%D|-@WOzf;o6rQ?XEnMwu z{?wOfH`-VXxT{YRA@^D|J+oojQtoc*vV{}vPTrrrnehCs(r-JgRPbKlY!c@mDTnSU zV-IF7h)JA$Wb8CaPlcSq+wdq8m4MfiNVYNBlYX_mq)+k`?hD)d^a+&8Nv~SzSKgPG3a$8N4&#e?wb5OVcDB z6tc2vJ7Q_J=s0gy_42v*x_c+Nngxy~7Kerv09-sO!MZ{hZBqty4F*)zo?}W{96X}z zyh8VlLuYU8mYX&3g~nf@SDy5$+I@n4=K$Tw z_eO1J2gK_|4^94g_3F)UT?}j$oONIR z^86*Ox0Rhh)(K>NeI@oLdMV=__o%;fS3hcerkSTCO_^o^WfFEqssq9kJaK%2z%8Va zpT-G3jhTpf91ygahA|IhgA>AdYP>f`(ves?)0f}nBJ%$C07>^@;Xf_ZM{rm&N=a2O zDn;&>7tgz>IqZ^#6TLVX^?dX%zsG`}*A3k(-{4IE-#*H5SZ=jA2HUt5L~werFr~y- zVZ^-Tu#>NO0{%Vx)bwp$cS5FE?uTo(T{_~zV1MEj!USa=k1X zOr0jsc7LmmXO4u~F)!zRys;4;lUx}HLrI6YOR%jt%>P?KGcGZW^>?FW#SD zoxga#9=On~DvMgga5zobCU;Y=DcgK*&8oanf3{g>b~{~|cYCu~Ept?^SgU1}I+iu~ zaCX|)yRy(kJ+k)U|J4op0U<71I={b`nU3tb&vynQe1 z6V|WQm+e#)27@33v884CT3)7oBXzdrhh3^h9z`Lo)i3R(YHY6J%c&Z748KyfL<6lOrhNF13r{4N-69ElGd%DQ zYa%C7U`$l{H0)9Vx`}P20>s&+q1d4Uw4Unu-tLX{LMAgOfufKsClk2j6Wt$YH+@b( za3>zG-9EcRq8c~M&VZyK^jm~8Vd>g%rro6lZ^OxK2Y!$$H0YwI2}3s%5)8QLMf+!K z_9BdiLVAsGz(ULB+)7u#;ndlX{!h9B*TP9x@I&YdDqev{tt+4mmNtcTWuah+kV<*5 zV6h4aiGoBhSiiuh6v?3}lZg^>%oL??C3{dPsmmFSFJ9NV4|W%FKIm*eF|NDNZ3Ovp zw3b3TyC1{V_g9vC<;pogQ;eWBF1rqAHL4Gu+m;4{D?sy`Y6RBvgz?@mN`{=!tZ39g z(}L<5liSRv_#(T+Me9-dCC0D9>%(B!>#_VxU%M2t*Vyl;&umhjEYE_39eYqZQZ(ehaSW47Pc2M$JWKHmpMZlugAf`VYe>d)=Vo2MsC1#N9Cz(w9ceH<} zKUpQ-x@g?{kWIHF-M#TO4_f6sY8=>p#lwT)xo#0kyeDbG zgig6{C<)?tJtarA9shL|1%a`2TXQu+&I-#t##k_F?8WhNI8tB9luukBL#L8SVUJ;0 zq>rgVZHm}613Ry$D%bQ(F(|vjO>-%?qlo$|ywxe8W0FvqKK1cU6ndfhvgSz+}DuQax$ctUQ@sGwCd5}Tf@58?bXbP&4_SQYRuRYb*n1D6X zF^yyNcLu@46QM^^O5-&20--}nQ<6Nyo;q8OMgZv>Vi9&DpQeF*Zg67Sei*p$5L^Ht zCH~>2zi2>2kA-dd@hvtwp^Fo`_+imS#Vhcr;f0J-fr0Ey3(rf1Pl<{Nlc9koyU?h6)mZmAWg)(Po@cTHi-&z{>^cY};fmGM-%lV`|HKs}v z+>c@XZUzdAE$*4_=vhZ%F4n5aMa$<|2U^3Ze$y*V(z}r3S-~3bT%*k-AFPoqvOXIvD&44ZZ>C6QF|WTD1zh)H{n0W^$hCcjhV9fFl1~&N4?0 zg}U)>wlp&BTH)M6fn3qkC5G1hy`0(@G-YG@OwgKRYch?@O~OwGz}4Z2{!l72mx`85EL&gIp6xNR{q5YBv)qN?0>-dMSp$!MA*9c90Sqni~X_^mG6 zJ#4P6>Bwm4VHL2^rLoG$%q)aOCdC4nwW(;;EmekU{(K%wsX%|S30q+XZjL9;M_UKI zdD?;o^;jN;--<6`Ysvc{TS0g<$@@_4eAusbCfmc0jz&bZ@#CWrC0q0+2bCAW0e*ZH z<)eCHroH?KH?yW3UcQ|lBdI3b-QN$A*P1WBkRNDmFxsBw4`61iDj&4je?I(k!2YiR zz+3WJsggQB(y)Ht@9Rg}P{kMZBW)V~UVfxOb2#BXex&STNS)RnM z5nhj=0BPDqEqqALytncpZ5g9!2lfEnN_gdQ)U7bmWBX^U^8^&WB5Xk6FYWQ5rEvJ?6eiHz@yf`gs`(zL}(bn%tw?*nnppQB#Q$-4rLleflgHjPf4VO z=CF3D9|_zPe(2ME+(6GuSxw+YL*R}{Nl=vmeF3Dro}g+5;pQf z?CIt87_Lbe%Qc)H%Ve=e_dP+qL3f&VO*ZAsIt!YFe{PJ{GHJ$Xln-0ANd?8UOl~{F zg&zNuS$9ukTkK%gaO+s=IFt-y(|kFZ*!JP%DM*ltE*sa;vrabcta!6ZRT!csJMDAV zu@2^Q8A+#Hahe><>+QTbU0XTfk&O)f*IDOJtA_dHXq3<_J5^R+GqIte_~UTi8AJC9 zUs+eTb0$SUN;w~9Mp*>ibjIx>`L_GoFe{peM%A617~j&BKd8;_jf=N5S=jB0I9qfv zLItPEU7lGT=3~Ch7RF?Y${$AMUSs5bv~DI_jN=5pOpjX*HADSKBd-tM%x!?H9*_; z|KwiibFGq)D#f%Z1*y~#k+9mFrvy#f zDo`{GL|6lrEcmD;_FrMi~(gwkJJ_Hf;`gS_~>)Pt7 z9b-$;h>NyDxZ^O15yo*xtW{_vZ4|7b>>YY@VhET^+*H7s*=UKOgc^;?_6bbqIiuHa zp8r{bGk~%zJ~0TYAZ|tbaPF>}j|x+ZSP-JDbT2<5RLV!T3Jo(>V>eMhm%0eO*TXw! zwJw@+B)FKDbGU*+AW#gGGk_=aF{bIt5zWRz9}ia?13=V{8+Nu_L zbJ1%RZ)4>ntGgZCgfBhAjPme- z`xSNHYkF(ThhS?aAWb7R!$$AcqL&II!P2;w8qIho*SA;6z^<6m2`qsX`p3)BV%WVI z-pEyRCL_J|tTckPrF1ZO0_1jR-Viomycm4@XhLi#qA%wZS*;!aR$L;F7Z-K7l-yc% z{vFEfhC88+cP5W~+Qz#N%OBufSdAIBuDenl^(2Yy(w;U~@g<$xnnu6dx6LeIE8n)p zCEPE#E{$aB5l#b-2~9yx^Fe5%zVs5s0vbd-kZ^79%1O}d-iFiE(!0%!^w<=MTpS_3 zj~v0ht!W>9ZZK%tJ`@Xx4S0KyB>n8I}>;LJ-y9R@o*3Q*4G)0xB^ zZXL``x4gMs0IW>3snps~FoF(&)T$R2lx_Fb!bvsFuBN|FhM%s6V`Q&@nan+_I*77H zU8J?>x~fKSc6Zk(P|T<;99)@Eu&%-20*em@=wfDSDzSuMm?8%18P_c|spMTnTK#gJ zMR&?RaC5v-J0QRq&pH8s3mJoeHtfH!1}4w=cx*rQdEaLjkHK<6fj9;Bs~pMca(Ze zaH&-)JouIRgf?a2?p{uzM++xZ=f9MLI9{%TIMmWm%DuB<-Y+)P;XR0k%^pam(hAYp z+jc;zjiWFE;yEmksjT-YJ2Sxx*TdQMc&`7x&dl0_JZZunvU0=#NRAjlVZYIl^P45o z+U4CaUP1Y@VP+aLQ4^L^!X&tYcP-l@zfRAVLKqgyjsl$5N>hm~9Mj z;INj77g4w^44U9ktU`|pPe?+%NXamX;agHRaqs1^-;Er5>w>)#y6m0kGT&_GWC5Xe zxJ8uQ7!01X%=ta;_gpx44WO_LcP_h(<7lqv!x(Q${LFFjl@i!wOB_4&P@-ZRL~a`; z4waZfg-RP9=ud7i7}vd3>~=a*CU~Lavd4Sj{M^wv`?%=PyCJHn%?EC zgceSiV2Z3m_!-9I-&r5E#mA{_$jq;eQgWcMQ~=Vv6A7UB88Einzal@WlzL> z22I05M;5R>jm5{ea;8mKdoq{VtwXAY#1L&WAW_Vhvo$#M`LPbhpj12#n?#w1+EKn> z6#Ea6J4p1ss81>d-UrlkfFoQDV%oaO_eD%TPg15hPvTfBMM4#VR1!%RMwCPW(;`*A z@^&Gn<|YE6gH%x_042n6q@yU6Eah;qN=5|Obf+qSm;SB$nmlZ&xU zQj|nZ(I2MMn*}#F2_{n%cqrhZC~~4!UTWEy%)`a|+uu1PCGU&I&NkOTmqeDhiITqW zEZ@mkqV^ zi>Lz0Up}chTQyb3E}Vk8T}@m?iEN=-S1-#xs@-ULC0FHAi@#?1s6RB6{5 zJ^`K9OCT-sFKt~&el^|t;k;+pT1S{$goTOKBI}Mu!3dOg!z+r^N{D#|?nd02D;0%H zqP-B;KR?R;sL<#5=T_^F?=F71{PmxIeAoK<|62Vn{N>qy@W6jAyFcMp{=Q~Im#D-( zGzRVfAa=W!_R6h|JbC^U+W8*yp8RgWLn{Z+AG%pL5 zW5KKWT?O0FJqr26rBP}BoThNo@r2Tb#cg|Pp#dP6b2Jp6Dcf=C8#^Ksi{c}s{eJ^7 zYV*#bSG$}=UnoXRVA_8Jf$a^xQ3;PMKnxQJo-mP04gX3>!ypaMN&5cIeIN5vKe{Hsv3_^Spt~Fca4_1X6_= z|Kw1aVZf*1Db3?Vj~**MTC=|&H9ev-h(*kZ38^xXPPq}V-~kU63t5<{BsJ6ssfnR* zJc+mp;0B~rE1CpmIU}Y~n#bka-HR($J;~G_D=F( zE2;qx8H>ffbAQKhHLH3H(AIlre(>n_iIsoKZ)<0ccQLr1&sr2oAx)mvMt>LfH3hhB zeE~nHD%uRMtXj<{r7n!crEo&|er!vgTJ%Yy*1z&!Y^(6WsiLwp(iE@C?2)@GV`}{@ zm{41(B2?O4wYQ?KHf5I-mS<=B2K@D`h0j3iXLq#q!vvKdCQn=0*eYqQU1QW3!0~uV zu$d%6)fM_nU`@_^$eHzc4F~Q2$wv`y@z!&gwvwYG;%rV1@nJNr%k(t>@D1{}dnJi{ zxfGFO)Q35!K1n1p_)?NMGF(w9BFT)=VIY%GXsIFv0Nun)v!hl=wOJlb1GYY0ZII0i z_!;VVga>7L1hhkvFP7yIlciY06Rxg$IN|DVA6Kt#??(-*6^$rBX00M-1c2sG$s+zQ39uNqZ7F)d-}!o_1p9F>wIv(0&5Aryk@XA8(Mp+ z%{M?3@a5I3XNX_1g;uAt-Met4ZpQlWDeQSP8*3k#VnbehGJ?-SwgLV#Kf!cRHRkI# zl(y(6!aVqvy&pOY_HS1&D?zOJUe4?hxaF<)LyMv%W`@9K^btlkFW~U`jqlo7`EjUS z+M)I6P_xSqac*oEb71)H{jfUQ1z$NhUur+%GZ*3I%;ErZr{z3?#^KGBXl3h8r>Luo z3xq!zJ+TsFnXP|$z$l#FDF5TCz+P)qR3qV5op#2=+P#3pH8y|%_EI$rZ9EDU1CY6RB zl0a~l8F*PUkwz+zItG%QZAW=)aoLNDi>v3e9^3X|YhPczym(cEv*rMYQjCwl5DDIi z_t%GUapClwP>c&tl0yS4;0thyt2hCiM+|WOo5Ct!sbMt@Q`&@-$RN&=$Ox^YAksWg z2^E|tJX3HQk0ni%fGt4adC+kbhnzhO;LM4$7-w{ADWLWE?9P1?Cx-%@J-Y!AFvjoA zaGc-TnD;EVF&56ud1|+cDPJa)m&ekE$#o%=hi8En!{>vE}Z{msP`dKr5;{2N$=OTa<7zHyU# zJ05<#Z!exR!#xfYj@?az>6Y46Qo94phtQ)!fOEq|11DfJY42LAgt_$rG1~KN2+DZk zL{ufllQ?jg4^%O=3BWh@0lUF2>>qCc``!(1$I|KdNYn-zp`H$O*|&A#3Wj~fGMPadas{N=eK*q{(ettTu?%yBZwWMF;;h?y$ z@F3iTHbT*SV1}(HQz@}A2!I<{ z(qYLVOoGxjr!-nc@Fyy8N-%wR!GSeUyfF({yEPv*3y>`3#-y=Oj7I_Gk%?24!6%Fn z0XN795k^81mS~0LA+ea2A(4&^RWVS3O)S6#S3k=OeSY4$)_wH6+o5V(@^xsFQc)hT zWi|IKFE4wgG`g}Fx`u7L{b4r6$lRGd(+BmUUZKW_W~b`kD)0Lk{kj~MJ&$`{ zz4^TX=s7^`-fx&yX%HtIzkIaz|I&?jx0wz-n|X~ZXYs$g7t`~1-beg)Q;_Cf-sa_u zxpghE%G*pk;TB(Xu&f-iX=V1GbN(@2}pc0g?^U3gAuC*XSmwa_NvaYT58V=~=gK#c`3 z3@%Pct-9cZ)V>;|wtjCuYN(cmBF@4nQlS=^h~dtgK%{`jQefYqV40?|PBKAYA7(lZ zG(b8N@-U6EB+;qa0M&37?Fq137vXt6Lu%Kr-nEn-Pg!Tq-mK>rI=L#P!#|mzYI#g-V?ql&M z``%dobqBEAUN7kZDh)@%qubJmR+SiD0D60|D~eHc=)#Xjs*7~2(R>D5XJCP3vR-(* zQ8Qte1l_e3)8@^r)y8hxOrucIrD9FNd9>`kY6^_kethN{NsHla=e>Q&=X%l^3@vJD z*KgW(^(t#min8rrXKjZN$~J=8wtG{S8_kt#>p?Llg3TFTYl|o)bq%GUjq9?tEYKX{ zN9$*)0gi>UX*q)}4L91>XG`K+%7Y5vubF0DenRmnZ&p;$NRQ5@yY=d(_N|M=H>n zg4acA3^$A^EVM3zm;k*JER7@)k`PV|O|>9erBRsbFw%?w2P2Ccd&aEZ4l^`Te_YjC zk2)Bxx+a4S$$LYq28usPH=aOMeLpD?{#KhGZ`q@gW58%nLiU}?S%!c*K z@vUQ7He_TvL3M_^JexSt#ebquqPtjTS!uPzQSi@&d(0ZZ>bg0cdN-D%Cr?oi!{)Y? zGdYI&rtw;gU9q7#BZ*S-HH*Y4W8g-o<)e2{@WP%mM%6|b_W$bf(8U^K)N#8U!OPc9 z3wnk5O`J|ifQew-@CZJOHuhw0l|~o? z42Muq6PD!O#%b7fdN#NIvsmR>w9UdT8R)rSq}h1<3f+z|@MsDz_oCKQFROd4vn|Z` zx7YuA{pR;Y!}wPAD}pWT_o$H@KxLBdKIUjZbluS~Dm&!@HIfrr>QItBCFhnOGYpaCLPt>#zL*A3M@@>i004v*d#cD4te<6aT&6u?<$Cxjb9Ii7RFt)f3M-3=$r?7O*0Fu4r zSSV?+|D!-9o+Xi>JfZ@=K3sq6@x^hB*^f#op;SgP0NMdyK}}HYku#abGE0KYBr(-t zl4XnwlN!OYltvk$;fh}ADyrfam`J?=cN^UdxHqr^(SC{mx5_jY9 zRhavkb%Mp8gN2{57;>%tRsxzBOsqQFE*Uso3BWCiXbnxP@5<}I55QG|(AALffW|9i zxl%Ehr*DPSY-F*t>TGC5$BFjJ$uzs~S!IJ+cyu`h*j6`zk-gAHnhzG+aCj@z#YDnH zCwJNhR-1fWPW7%*TmvSl%*bH$xsZ*wXx8E?C#`vV1XMfx-C}eRHD~wJNr9Vq7oZG z=USku>1%39Y8y6K$H~1#@awav^OcX?-Xfm5_@ z19cla8#nX^@BIND#XJz(KmOt8{ieUx{Xt3X|A^Z57HqZr`!?*;K5OLa)n1!mtNb4c zOw7|X%>o$#qb6CxBCP@ahVVZwh)_%@uHr-F|AIhl3}o8oR`CmakXr>;m&Kw@cC^wc zq(2sf5`KsX;kFI)s7qAYi8r+z#8$#EwhHf}ld%2$BJ&#Wafi|PP!U6T>nz3ooJ0r$h@u*D)CSysGiP#8gs0;&5SYix|j7WLFHI0Zgq2@s*11(aLC~Zg>2TTXC zXji!1-E`3Re}lY_fyHaa*kk z7p|xC^J^gY%T|S;L&VIVqn-BOtW#HabxnC9pU;fmfilmW7K^{y3ZdKVQ>-$Cl(yHG zf9YO10y-#*9*+CTQkc;|p_yVw)eC&l_kX-^bt?MDB<*=Ae zv`t&JB(&3MmHO8D`CWA=A0AW9u#Z)reDPoO<=jr?I4f%#h+W(H`P9Ph*6C!;32tnD zB|LRUUk~QnqMYN%8Y7%o`rPus;@RmrC3qOBuTW;oOVull?y-TL&QW>tsuY_IH#{KO z)|2NIDZ{23hx@SVjZuRuKX~%IeEbWO=NJ3X)#H=rHPVfj`-d5_#nC*NJnzX`10uqW zFm%uBA0Eo*u5ZAa*IvJoy6&wyx$^1V$+`s%HV0Jg$GW#R@i|%d*6HtN-S!q7#Jaa` zf;me3XP$QFKIH9zzN^*uVF!OpfeRd@Y`Se?`(55V*&o9Uu8A!u%}Iwg)kP&<7u8mxK8UP~ zAU<*R6IVZR^*X+C<$-wAR6Qm-6+FvKEMpdO9)~N`F?hk<)2jWM9b9?<-?VSMc`% z({RKeei~`(vR-iQFVE4E-(_FEFZqq#xWgUg2)Fj`cr0SzYaaYLw4Qw%Dd~a-+=!ux zx*i#jbLr*Auyz(!FX*(M0e_Y)cq-g`wjO8Qke`Q(!|3OOyg%(bzrJ%y+e!nzGD9C@ zA<*Ohk5=J}%hgNv?i~!b2NyXvypO1ys}=t4!}F^*zt0tj{;4WxR~ZDW6V0UwZo5UdWgg!F8W#@ z_8=#Hb2t1~Vlmj^ZWo`zV(@JhtPZ>I-v)+*^~8JSJG!s8HADd$n&_0JDdK=sCq%@A z8pcu+lSt^8F+QWMb>b^<2}+_F$7p^lW6B27{nhbkmm>yW6B zMIndH5TzuHwv~%+&zZcuV{qZf#iF;bZ{K(hUoLnF0VHS6W0y@W?)6s5IUm-seT1_v zF&uY|i_rVxKB}9)ohsQRga&=_S;;3 z?)I%VISU~k4a-S;Zkg13xaJJqfp-IU))awxD+QKe8CK7qTrJuY>&UD`eybIz{kgbj z+Qm~Z1-xc)(Jy+|g5Ii97}y=Wr2C_~goKZywu?}0x49u(sg*6v;l<16FZO2*>m8PH zaEQlpmuqr8m-zHW*^V2byVc1UFPB9A6i&wZ2;HreAzCId52g%FooxG50Qn3~p5_jg z_$zX-Y+S@|!i~Z9rxwnQK`S@L!6AntiP(u*oS4No$SfXKMtOO=KWf@QgMh1)%SK-1n^KV}of4C&Fd#wzk)T=1Oq|AwsQ|tqB2|%$rHWIrjW+BkqdcPx3PGCw2vey! z!#WdkmE>Ox)2%!KEBsd7?5d)SMao>ydM;|w4hVp&6I^}{9sV0d4aRP0>kZsG!Ppn;FH-d$h8#}~5-3tMQpSm?XzY<`rg7*@n5 zb0^{KMl~Y0b)ajnh@~p7FpSNU#7?KyXCq5{BOFnwZ-BiwYkKv!szfJ1wT`%0KBE=5 z0c`LOumZQoL-)zbi{2jPUp^f1YY99&7>GCWB*aGp;>}AnH&B*d3A$qm6^8`!VTh}Rz$^hj4RTeF}^zR|hynSw?)CbI2${l+5K`&}O$ zvj0N(&oN4!Z*F8$&}qDR-|riAx}}NF8g#mC`g;YPM%z;n_X#>Zq}03tV!${mU670` z6>H66N>UvNp74kWYJwD~6FDg26c_36h|?V_^^kJ+;a5}ce)BFmAmG%l`#}Mx2j+LW zi9Nv75?>Q;m7!=S2=)&d6>#x24bB<-!#X@V(AE;hJUH1}PPUeB(bn>5ytr$gh(~RX zF{w^tX3YPycP+ea8`=7=5ZwUV0G2!t4mtFqz;zyNf=!bkac_%@0`hQXXmcZpswlx8(SjhP0shtIp;gFFd~k1q7+Xh{GD=`l_E_QKv2rl#4w!+ z_%}`kO=6OejPW8XZmE~9P=@k?m)^ixBag@I0(i24X+JOKUG1E1qyBI_9pYaYE$A~2 zd}W8x;nJ4A?+swrgue9P?J?Dp2sTj@^nx(O>vYnoijGT^T6@nzjBafD=Y-BeQ4Mt?1sXg#M-@)r z7-t0CO8txkOLf~rV^L_;_{9L@F?I@`L1z?C?cC(KX$(rAt-ETd20QG9Lh-yT*o8MH zf!*zFh_a=JL;EQ`tqnfC{pl9jD!!8G_thTWqOu#`JmdLXreAE$>y6?}U*o*VNi*#& zjkLIdF6V2D&Z03%G4-KNnK9f7%1tUH63$S71T4r!V8>N#u=^_;asdY{#Ee8+cXSFL(Ziph7Abax+FdBRCI zi4Q=o_yf6mAXk4ua&<@M#J?ftWMiJGg6de&ELE`)OjA-Am1cPY!&|7t5*{Zy$rM*6 zwuG3Xh#6z4v8g7j{9oS#lt69NlW6wSGdnB+WCL`4k6C-PCr<$^FJmTvv;pg>e)(^; z(aE)`W{HDqJeSlUM9!_M)PeF@wcc^G@xy)pTkpl2H~$21jIVeHya6YVOF*Q(%c}a& z^C#Is{H3iVL~0@X2^7U)b6gQO3Ut65aW>rh5nVqqe9SS55GaPXj`~v!L$qje_MgCT zzT~X;^XYGM>;{ttIJ)8pRVxXL*5k&vwdqxk_F>0Kj0gMb3Yk;WvsqY~vnhvx`o~-o zq4l=S?a)>gku*p*Wm=i0zFlFd)piKNz4U67BjWk@%S6Wv!BOU zu((w3HR9zOoGepF>Ft9NQ4KtIbgozaA3l>W%MWTo*;3Ar@m4e(5 z@wFTQH%M$2tK;F4Kir1LdwlH<&G!lNqU3gBuf>F3^Zujrv0k$l_@oHV!LV(sciKeE z+k+3ke;nYiJMnjSqI03T?pG?H*+-Xv3j4N$?-y?I>hB*tLKFE>^vH!iJw6JVnIDBn zsQTuqwwG4$B~t*`sPb^DbvGiPS`)(5`J%dW^QbwEUj~W8ZN}=p@&R|zVA`LQos059 z&8pKdaMrtFI-Kp*AsoE`7!TDu?FWoCgR2jQX;YbfIS-}a&I5&ZNIl`@- z!tDa{icA#*pjtw>v@A23NTp;#5p8(Fk}OVCPUNQK2kU*|aG3UVg>yYUwD@8y4-gwj z58w;8ZXJDYZs_XXl^V_m2GU(LN74@CbAf?uFJcIM9LUj4PtXT@%7Z=SufaceCYMW> z`@LqDmWz}W3DX7YikLJ(=QEy2K@u&Qjwz8@%qYg3))#t7fh69Br|!o?V)%KC6BimY>eb0SaLNGi%(iA|ze?4k~1H zLQ#Eqm3MBaskmNyb~rP#U|A<8ukiMh6ZA)OCCv$rV2C3I`8hu?G`KWPb?L3=%50l6 z?=UyU4K@NiH@Q55i?5H+ssiPX8{RlyCERIB-`O)KEz%5EJC=3h_O*0M0+|Mo^!+0o zipPOLd$%o22kleFZI=1dQGMG9Li)Y!(1wrcSKxjYoY?e3-;Ld%J?$?noGYx4*~(PY8|a%FUN=ob*QQy!XDS=v;xYtt z=xS6p`N#3=P-{6DhhcOTdAuK-ncSk51&>2lv4GKOlKn5fmbcIDj4?y>0SZ5iRlsRm2ZwGkUdEFh-Yu4Hl9d z0}kFre`7_e>V@5HIXhVN`!W``1CkSEXhuk3VZTqb&@?6_H?pAA>IDAH59;?t7>Nbl zkwZNH-_zIckNwNM<934mkLlNr+kN&Q^Bv!nyuf|J#ZDyf$LBKIlDxp3smp>CW6EMK z_w^s6LhyKzD?HGT=uY%wMko~QpSb@%aEdKB#o{8o*PH?do)v`Zgrt;m7-~XeBhrH9 zNoEtGXlg}XFfJ6AqKFGqw8Q8{5Mv^t0q6s5ktKN4L=LZbtx5$uj=XNd_z_{gt zBJM-&h1bptS#5$C^pZ9VaO1@9g38}q;+%SleTNn*JoW|z?gP%D z5O-61;0+(xPoXmyBEE3jWz{z>@F5CWZ%~^Xf%Ggg8(EX{Ivc4m>?7sK#~1wi;^nL7 zKSx8SeH|zamJy=G>n4+rE3DxRA<80zsk^|2=^(exr3*`{yU}Z)D_DNZtuVCPVg}7#%08nQ#;ha+8!GGH#H%_Sc*XW(2&^ciEp$GU>-0H4tU88sC z*@X+ls3RI5VQBwH@6a~6s(eLme0{)sn4!RkN|?q^^FDX5B>KKRvq8rN;4h`GNuQ z-$c$Lc}%inx)lH3p`0DO=2j4>g{^#B0wrQya1+Nm&#f^uHGqL^rZ_^LEa4V4R}9%i zpw?HBNShRfaS5a$&oi54h2lk=>RfS}0B_3}&+GqHn)P1oLWZW6y9HgCV(-e6fBP8jHNlvQ(=VIf;YV!A_7A^w~m1z zd_(yvJVn16SBP|VgW!s?4}cG^GFF$44DG_3g1T1LjpxL*Xg3R>ADPXj7Qz?xv_A>j zPYTt?`?iI@MPFSYQueU@^s?$atpJIZ`U4tJYNxoa#{Fwgp$dTKz5H7DRb96dZRfNg0NLdja*94)kp?8B~C!ktq2PcI(`v zutP4gd#r|mCOACr>Vxl)Q$SyR6{z7gadgg26trjlK2uq5HPLcjS!ZPy2oEk>D;+|w9W(wRqe(a_JMBn5;% zclzY%v**8m7yakS?FclQ88E+2lmmjQWQ8=)8Sr8m6G11ois)A+cABA$_L$GXk zPIH)ayr6bIbnBj4C;<5894p0V%2k|)!VXBxlJo!y0)GLAws}+1t4*e)ujJ4sQ9)n_ zCGQnPXkl;OmZcz6Q1HmA0?>nm{Y&P`!hcFp!Bfrw+W>>HcOpW;iH$Lttt1J%*`OEz zoGjZ%uxsr|{mI#qYx?eN3DpA6wlC#v@lcvXR=nu8Oao(Jl8Ufd2UkplfVp#VjWxB z6e9BU?Ju_@{^26;>g0rB`&BhUf>FS`?#F6;rN-<1*tQN3VG9BTcWH}*!gIf)Z<~|X z1*98nH;)3?{oV;nl^3n4Cm107*GCaWj!3h|tx3T9h)n@~J4?YM-MFUVolU9bq_+LS z!Bn`Qz8t&Es}79PB>HFh#FYyBPvgR6k+lT*=K$n=HdSYZ!PwkJV4+b3Yi${AmMb@; zFgzPWKj7D+2%mxI2mfjGXo4aVlgE)6JB_ZTV~lbI*q$IZHd9w*d3F7EF8P$gZeYz@fA9|TLqYWz3`GlZ!$ zida*4kt$XcR={p4q*Xf6fY*zZS$5DQtu8`jSMRRRmy=}m0DghIA!4rx5l*`#`)Uy) zDY@mC_yDsXVD`O**^8_FUZZT42qL8_ILkGagj!x?oQYf*or)|LoTZE#l1r9kROXq= zv{FiESs`d)m|B6dU!0x2Jvlimht~@zm*Bf>hH_2iPFr290v-@QefR1|gtJ&e)a|af zJshZ-vHfETYaS1kZE$08{xKntAp|tL;DDJGVLEII3wa}ImwOaZA8c)xl|SG9<=x9h zYHPlhBlihRd30GhP^~bk1Qug(M>>B2AD^6us=W;Wn|e&Uv~3-#frTc{we55c8(&>k z&DGvh%cJ|+h87=rcQAiw4ybop&jV^~-c0gVMOQXQ0bd*-{Hm}MCthY;#*HI)wp}@^l2RR#?puRR3{p{*0YHhUgk~%&igfYFv9@tVroG z-S*VAb5>P-07m7o^An(>V_Y5`d=y%j{*>!95!6biw1pZnE@Ng2A@EE#(OlV7b7|It zzNIkj#p&t0pJp|7+{4y6d-wA6Rg2Yj$2*jwGX?rn#NBjzYOfbgnry7?R&R^b?&LP7ef_W72Ym;}& zZ^u$cEMxZP3oWgdIS=r9uP z$)5im#tar|H+t%t(P?qf`RNpD83!5ua~OoD0EcD z*48I4qui1zJuPm4Xtu`857ur{#nz^-|yc=DvWV8>|ZzV5GJ96$g~_5RrCaXeL8CD zVwO=f2+M{GoB9G^g--QL4Ugw_lwWU`n{8KYDcG8HMVqkY7H6gh&MV+j3mght$~cp; zEqKO>F(y{|fLGa0$`RXP1ZG6#+D`XXj+|X%MaMk!!XH(!s z_l$fgKUq6n7|M6rEQG9Fz-gEkynKj*8o)+RJ=ORF0a}8Kp?Hii%2y9;E<3GXu6pyW>QE_IG7)?dSh2w+0VwBJVT=y}a|?#Dcbv z+}N4<&6Am)hCOjVGg`Wk_|l*E>5?3HqEd3U(eFATVGwPe;WCUh$kJOa-e6(Wa&vG2 z>z!q(?$UTY1Fw3Akc5}$*1qQTV&D?DuWR6~`^>tDx4g%+-Y?o@uU$-~+1MY}osVmH z$`^Qm12aD=TY^41GmiDT*}R}C`X|{asfrrd<7SQo4M}7H{t%xYvod&+t*@ozh^wD< zo}g*4JaQbFEXl>ai^K+*Hiu56Pt+i4VgtUF0d6Yn2-wc@#~r}NS7Eost9;w?P-H>q zklTbCJT3(*!7Q6eItnoah>Q)CjX1hd={RYif!rxyeG=J1Pv4AEl_T7MjuUyeXPfKM z2yAm&r#rR@SC-Han&nEig{LMvdtSl^g#v!TF4nqEQ+r?;Go1ElYf@CiJ1DhxVhIX< zb+)XhaR;uj)K*p(A27!eJk`2Wz|rfYLSJ4-s+-L?Y+&G_krPYmZqkm~9-(1?>9C>A zlciw2laW^4yGO)<;!;4*A-Y+JFoR`@&`T~i0q0mF^vUx z7XbZ>K_Yn3-? z{3kKuU5-x01Z!@)z`c+2T(=Y5+q_K2;J9Gwv-F0!j&Zhl?{(0M`Y2IQN8oD9!A{cC zua#Y~c{xU+mvi0fyq1i5=6JZPoz}7mSq2e+8>@z9pOL{bjc=CZ@Oa|OT3k@V`1$IS z3o9de^kaRKDiv1`t+--ZN_PYEos7hSn>AvlmK|GF%rmzqgln`&4dS>L^@W9(H+N8M z9gH3#^#wx1F}LRexjQxe~OO?L<2(tLB!hB-_S7R_#6cL z-)!sz8k}~X+4|!UaL#ArO_LPr0Z-|swm8BGhZJK9|0zC&K_N=$>V+VLiCwxJiShYFqa)}5j zA#eyK^V|5trCjg*;vMjNV|E%aycv`2AeDE)WZKiczbcxo(8~GGzn&}Wn=SEHKTwr5 zl?FRV6q9;>{p8M-H7jEyHO`maDUOM@75$TZCIhMv^DXxmt(~R-0fete-&CMj{X@w1WCm~gweHp!iuV*19{%Tn3RsVs9OHrmO+R)IEhXt)=5RjJHTByxbIG-yXrk|7Gv>ktlcW_D@Bg_1{Tr{ey?;O9G#S&hNQ zbDHITudV)|&bSLtsdFWSThgbhJV0_e@rb6(Bjx-`(MG$grq|bS`Cd!eemowYPn=ud zWazVox%zI!&GG!K7T*Y_E$DBjO%=K30nX2v88Atxfh23ik|&V!oh=ke9WR0m3HL`T zv@(*e_Eei3ptid`d$4MM5N$h8H!H6PE$$uL1ZVERa3@E8o-&}R1>1jZflmQ0r?rfh zOe2WlcKg9=j|NHLlyV*Kxh18#6}FzL4X0OL_L__i0m|Ra2yx6ASu%4boh-6vLLgbN zaIN_$)FIkJ5{VV$lOB56h1E~YX@yLLuaySwmDHeXPqIkF0okf18RJRAC6bjn9pjJT zdc=0GrwW2Dh&TMOGh0-2h(XmZieA`=(}-4ceij>8dER;ioY6V!_oi5Qd5h)w3z za+oX`<4Z@|dgcI^mvAiGW$~IgQrOX;iQMFi%m)}T?Q0n0QD{>V&V#!X`6Ot?zEvESiHH|lK5I6uldCC4s}J`J_~(6J0!-7sP+FYuFBL9jL;lVWxJv z8w0g*VaQ62ob^(!2UnlEC95cc4IFXS+iXZ0YN9ZPAvqP8$n(w)e8W^x3%3Vn;nY2ZYF=${3ZG|HRw`W*Y050Un@huhjm}J};hwRb9@g`GQg-qO z&dc-^Wsd@%`GWL`C?{s-{l5DfO4G|CGEl%NmhgNA;SvHafbY~=%jy2|o)@WCx~YeP zuJF6tG0X;JXM$#67ch#nc@6bb|`Bd`_ARZGE2YOiJyBiE7lMZ+1*p+fYl@2PMrfK^=m2-0< z=jKGQsid*lCWBwk_uIoM-g9#@pjJT{LLi4rfSD$-AvC|-)l z97umUxua^}~z*+dt{-578i@dTWmf@=sZvULx~$ zc}oU=(DCp5@UW-fXR9~t-Jfxldi)a-aMi%~^*S1sM1cZk5v1|_rwqD$ma%$84XPAg zfjm!^<=*y62e3c#u{Czvvbk^6%CR;1jd5L2d05~g3owWlX` ziaIi)6TyXEY5^sI{IyOiLWs8{l|YRp8haR$^1(pE7%%NQ=j}9>GZ0tSjy%m>+@NLu z#&%E8TnGU?qM-E&=_5%3HvR!{{0z`dp{!h^ZXdsA}m@5{w%6@w*0IKc-3!^ie0qVKcq7XLzat*8ymmmy_f&=rGZS{+_xn66JKiL*LBf{|%9oM4r^eM)O4 z{jrFsakEoJ#3E~$93h08YV#ATYU|_X>5fO8%!@(k%`7GJ$D`vyq9V1)U9+HOvz@}( z{yRR`*D1HV)OL#*?^8pDje0APzfH`TjDJZRnyc#VjuJ>r+znrT&Jq!JwcephKF+Y% zVlDfR7utj<$WPcVKH?`{$nl8veI6h;`nmyuT&9Mp5zMLfx|#`T3gd6YXrz|J$ew~& ze2FGX{1l_IS!sF%l=aHj##NMGs@fu(E*hwcTg^C&;^ZcH&jz$^;jNkS2!}45=rdJ3 zkN~3Xl_m0yKIS$qfbJAdaO;X0K;GRtB>qZR%wmth_B4-l>bTsS*!v3OYN(pl6PinJ&0 zG3FS0X+r5yYW?my|H!AZ4!iV@Y2($$D-HyPG#}2N2Me{KJ8eM(4R>Jug^CPG`|Egk z!^&vYSi`tX_1poTAo%eJ{tjSzKW%bhm<_+0}7ll|B+CryRfg@sH*CPmNeH^}d7}-h9@Y_1q2&42nweWVBrW(P5 z!(wY|-<|;UM7ZvN`dh<#MFGk~ zRlH{be!fbl!}K-Rm?yf~(2gO<)(mhc|zquDwi1UvG|FF;UH6tl+ffPo~rJ zzIU{zR>0FnaX>pa<*h&I5@i45d>}J%w}ly()EddYBg)q>cDDsdJik$QJk7Vi>bFUt zEZ)P%clxRq^@$8>*kZGNcxK zc;ZgF_lAoaZ;)O$iIz}a^iNI0j(rgVZiv%xHw%@@Dx;9uH!CfSDQ6^n6_oUO(O1VG zGO#4`14gnuUMRD(Jplzn`XT!iP!d^n@RI5$>S*!vUroPf5u`uI#c-~#AE2)gWN>?~ zMkiAj0~b7@iHA-{>m$XpUz=Wy=~M<4m2j}g0p&7-ki;(1!k3S(jJHnKlY2;#82Vwk zc^pRsI_+j_cco=(A4e+vDv%+~!_g2t1`-N(&N~zaJ0C^&#LLZYa@1M`Q3V2z26iV_ z6^A5KhKk+4cl^C`ljdw0(5edvC_oI|#*lkD`&p73AZvaHB9e z*qJa1e;XH;x65=Scn}a)@l!v;Nu?gw&VnSFCpQ$%icAvDX0L1$-{PqBbU7De3l9^{ zA{lKL|Nc7o(Pm|>}>0DS%5-UVo8ET8eQm^wD><>-+Z-{|A?nHSFLw2n3Va zXJ#K7?&kzJ-sQ26SYap@FHIDFa`3KiQ+BBJh}V5q21^y9+L#cDrht0^iA23nfQb|) zQQ{;;l$C+9nO2z+lq!`AvwqSZn6y{o39xEG6`8K%EHIy>z?0g|?;Ea4(PNAFBHpFw z?aGUz-&Y^4fG*%RnW8jtIbBC5dQTh5vOS=5be`Jd)}om|8^Us)7X8b7u5`Sn_=MD8 z*{E3r|Deb@A=IFdZ5~mWVrJWJZ)7JaM_WQ(A_4u0d->0|kb>gFkel($k5;!9qhAi$az?7MMWj zXM^HXVQ7ZKZe`2Z2aNu~#wp`PX;lkTg^Md$c=Eivfp`QZQ-YEybTh7qjiSs5h;6}Xtg-57?EwR-#3+*ba2z_q=>(~Kq4rMbttNve zw0ZyG#1pt+2W3hvEx%&G+@gqfp)er^3{DPXlnu+LTR06KuGU8a%cs|1{K$5TYP|5J z07ZB13D(ZALVijafcAaSe@_tYcrb?@L^%;ZB5o3p<$G0bw8bv*^4t*ym097*0g9&X zS?sh40l)CJspnuAV!xc>oh!)Yfogu-%&Kq?eReZfqNCoM;`}4Yo?gd5!EA#|f z_fYG4`+*h<_wYUFq+75`f(faxj?e@|wp;kelyqS)%1cobU+z;YQ*C#?p`}c`ZWB4+ zmLI$zT+Ww5&mLQ;Zl2&2n4bO+0K+iI1JD}PAE4GR6Qm!Qc?)jDis216F%Mu80K#TY zi%3e@I$`Ae%4}SEBHor_XMD}|@Tg7s{)FhM&`3tcA4lM7R#T3uF%qC&5cquuxm9Sa zQEEr;&*&HSSW6+A+?-b+Kgsd$qxZB9qUr!u8k$W53{H*?hL=8j^3ZVrP+ zS5FsNF7{CMj`U79x^l5M&aHOv>q0!j-Lp%avHjP-P2wIU+zK6UjrPZqQ7)6is1ozl z0ai%9>g3!!*9=m(|JUyZv@opzcoFF={N03ksei=#9?)ty{^H<)#O3wk*Y8Fz?yKr0 zNTDJpJ9uDTRv<*V{TlE^0ItUrjFinnVl!h)Lqr+ZMhz)5+3T`<+;PW*Jk(@4J^ne| ztNYHO3FEmobj5=u%RkyN=b!j;>q^0&S-=q<7+DGAv_Y_5-t=NBrl%wJw9usb@5)Hg z?Wv^e%b*`2Qn$ZSf1wHka*0;hw(8DTA0~n>m}ki#;nT>6OJ@mRZzyeLD~b>38J*p?kT1zj#LWZ zwJe4aPoBGNL4z)nkhX3`J%Fok*H^|f7P;5YqjqS0Gcr}-Ny{t58nl0fm)c`TBt_%-bTKU-fN3oul6W9inC#G?WNio1o zD=8KeZbkE6oH0|lI(l6__l;|Mu?OPsWa)!|y=SYMHE<9&H3{~vz7QKJSgUrY8VloC z@+1J%_d9vKgS76e_buhT27{KHsx>1SqeA1`dI((gluATw0A9rI_`aN%;=_kl>3#o( z_gN{uaB-AYGKF}$!h}fnVud7X2Y;;R>|CjQE(c*uFbz_VzQj3F8dix}8zta8arNb_ zw9}+5c`|dkz@nU27HigzXfvv}4AuoQsjJN|J#RODyjXgv2JZB~*EC22@R{7Jg*)O+ z+D><<@SMm$m(jhN`TRsr-7IJB@@MW$7L_k-LcnrinNrdLB2(LQ`QKrv~6Omx1-ni!0^Rt_O`68CqtZlisM%J#Z}KOfi( zAUm%c=!#}~l~%Xo8VUFOo{rOCxf4thWo=l~H6xBMAIjpU@FHZz21!%YVDxkh<%2&3 zr6((rC|8vw{KQ4)jr!t&@}!~YgLwjacD2da?>izhCq+O3!M*2w(=g&9NfiPF=+;+V zb3EJqB(n~}S%{}~l@bW5O?8giUNPmxs=RfY z99DThDp}qBOl2i{aCsF#hRY^=cFAG|T>J#Z8Avuja>vN#iT|?+9c?kn_u}_{NE}Yp z!B0A52h5s4yOGiFprNVF| z4gNVIGma7FMuOx*Quq4#nc30G`3QB--3Hmxe&>3*B4C>R9Ec5Oo~6ytf~liZ(Dgjy z69c9pQMN`>bK{uqV4Urfh#n?2a04NE5#(RERT*x*Cz@vmFt^glfX6aFG*`Ftwrn5hNfVz8C1_=?p+$N+wp`?&GfSm zgBoD7QUf^Q+Ln*n%@o-^KPw4Fh#AEFNK-a=@e)kQ&0o@C3}@(-z3<9zUMGKAsbk){^oC|X2+S&s9#4G`A< zZ8;PieyDU~#;Ghb@He6bcANIUb`WpcR#cmEU`r1CW9w=#Wc+$A; z)Ws(@ymPA_Z~Oz(bOWjrrYCy^9W zyf0N;KLM4wYKC96&Lfo3-o$r;#~046DpM{n8r;_q%plp1rNpgb6FaaDh+)1$dO1wN zD8r>kY}JiQgzM*Ec0O8=RfS*vLQS-ef^RfxS~U^Lj!nOec|d-L(fXDsSTx!;wg6s3cP%cjA;iS1(4TKlb*bea_=g&K zheB-?B+IM6jW`E|F64gb$OF0SU*&}b-y>KAX!#_V7qc3`hlh(YS-LhYlO0=^hDbQH zR{-X+q`(7mM|j_q*%paKAlzL0qkm)Jgx%WwSP5b6e+3Xv6Y)M(&{vY~Vq#ay#Gg^% zi4KY+QGk=*a1?(@tfO_=_^AGFidih87=!=p>0X_;c=(6=T&<9a z?nPrZAZ_CK$ekEuevwtXWz{Tsae!b?!sN0PoHgh86XnMm!`I94`QU9L_xp9^b?+zY z4&nRtP1kK#_hj&ANcC;QWWp)N;88eZ02x4yZbU(=eeT~&t&U%|Ed#n_H>}$xhH07j zpB7WK4yYYW@$BQZT&?SBJH0z*5|0#p{kmsO(AxY@l!kPvtNnAX=-vDS$mFnrjmM<` zz}4WE=ZaV9aBR`>Rm4_H`dXgIxHi_SM;Gj?$8>>xphc?Fe1`3M9*+jrn+{ikNm3YI zbw7-9boP8)p{POMD8wlKJO*kj=3P(gSS5@sYjFLO<$QcyV^14|kkGIYYn*aAFL;uS zZD06c4bYrfNbQS9**8uYh_&k znS_1?fd*E(2nri6g)~54+Hp@6o0y;tj=LcrLf1N3O%Ohtujn~@fmig~+I{yPMTA#R z0-NM$EDf=E)cX_Uz}@NiAUdpfK9Te(z(i=3z0Ni`n?Wke%C)L}cgjAhEV-?e0-q|s zvLUAL_%HIRfeIyXfBVe|a(xTX8)Ip;{#89vJDL+YszjD9QN?6Q7z&t~VuYR~4zrpRtl0L-rA> zQ1R-dI*zj-bcKUWE@H!pLl(Xv8EIb3u)F}>m@FFI#~0if75dex4k zV4FVm%ikDB#hv44dC94W$;6&Jef-)Gi5CE$08X-N{&cb=n5x@G8KnCr&7GVULQ;WT1|Q|V43a_L|Y|?_{X=? zg}@n=d>DxOg-FCo?@eNyYK(9X;?`12?PWs0O4xw9-7U0v^zV(MOpWVG?^I-a5WIGK zO^C87dQDIr5!6|y2Q0YU?J`Zt9)L_vV&M5EIMgvEWKC->OM>H%jRIcH5fAZ6UHhed zWK20y+)KaU6J=}@!-o`uuF19&L<#5vfIV4?Tu8uXAteY7M4wYDLbU*m`_!Wf@Cu1* zH(soxDKRA$mmFDri{REZzl|O1s+T#g<1nk)t4&Nc*TO9#A~AswBUSincV!fgzG5qb z9-v9)p_RcQ*?e)-Tk}g#+CBd%12|U*^WDA`=)`7RAss2q7eg%K%=}%A+voSo%loDK zn3C7k$;t^fQ(J716?{;{fISS1_&u1?oWy?lF|I-pZ}xafc!E+`Kf zc^v+KRY3~qBin>ImK;OT0BHT!>56PcAdwyIIWt7(uMF@=8;(}+cnp%(qeSwluTyAl z^9ecP#UImQlC-=B%L5!-D4YXY`4y`!5|HXt`y2^e%Kg6jsTLFz46(dZJA-|z&DfQ5^5n#}*+kKHQbcp7aVF`bGe*Fwf24B>3 zp!x9Zmni)U>S1!v@nz3XUPjr#6b-ec?uB8o_6X9#R2#)LF#Z}e#f=>k3StFE&a!5y z?a214ohs!F-@4OAnbm6sxA%lCG_#>-uZOU^-qzx^!v&BB+fff;ve!u;)`iJai6ey; z+n?W)=fwjzQd!YjPu!bhEa>P1ZQNuiaGCJ`vj$3It;g9g5x)%PALmX%$c>K!I+c#~ zRJ~?`MsP}4N4fRGE^-0Mj#2}H;Bq2&7Qj}yK2`J1o__EW?9^3K0Y`^!hb5n z;H-cINGxmJYgqXQxW{+e!Ny82GtDsy9WsOFNm4=cStAG`d+4>-5m$R~lD&>Ct zg&Y>T^ZvuyQ$#tBL4wsGsv%_wKFWe&By4j@?v9n+`lvK{Zhm2UH4z!FyT-NOpR%e{qEj$ykg+x+m{QI!L5EgpF&cf0%tMmGpi{yEH6ne ziBrDlYY_H`(7)57gQ@DEon67Rfue3l!9(XwfZeHS$kAnUNx*M_cp|O0?`ZU@tzGD8 zjZ%?mNntpAFG+EL&MrcZHUIFO5WqCxOaOnkKvqywc0jNv%vm2VL5>%?yR}#|?d4bW z0`wY`a6kiBeRqPR_X=FZ_DBzD10}r8pMQ*dq=8~J!cWw5PUeyvcI-KCah?aV`gzqw zvU6znHkUSZqtjBEi1sKlPa3tgJ0)Xn_+(*7`>|`fSPCi`)#PAZ`A+{NxvTvO(!)5L zZvCZ^QlP=y46<~yy14+8$g;AeJCz)bJ|e_3qK_FR6py^}YpWSY93SaqOo7zUPHm^> zgHL0XXih`}BVF9W5&acXc%m(zB@p@ZD@I$L&1jQ`7TO6OG`PC zYXSGWx6#xwVg423$0`|}t5v^&=qOUonzZTUb){mun$7KL>{$9TS+Wd$WSpV)bSS(< zOEd`43`=ck4Mh!sz}{q=E9N&gV0Y&SuQK4b4*YvN}HAlK_rKVwSsYF$ILVj zH(PP#ZIzo_QYi#W^HW;vw^>!yFRr8I;WzL5O>P>u7G0#aW$U~j#gR*@GoW;9$H0s; zZ5e;|G#+G1NSBW~$W>EVybrmuW~`#EcOG4tdF>##S#Y98>y2rvpdJ~p`wN-@Kcl&r zX)J^7ys+9nq?kOW3yan1N3J*mt(t*v9}_3qI#Tdr@f-B{06wP$O{yipmZEl!NZvZP zgC)h*5wzD-d}>hNRs0!qZfaA(U#{E1iymNwPI;u77~si3C5$*j-!p74t?{*J7cC3L z0l3wKykE>@?iT+*0jjjqc)@wl1nUNSjhZ z!U>Th7N#cBFq$jD4+8lD>4EtbtvapI#7`kDjhQ|=CsWuq%UTFLN*f~4O5F# z=C{XWgfey*nFCy4n%bRvkCp87@-@T9C#lj5ldk{T-@qgz#`7tLBz#P%Aa_RD69Nl@ zLg#0NvX=_&NtiwV+&9GC&0s)Ut0<=B3%Bmp%=V@yK~*br3%zf-LEX?uS=cQrMo;*pJykun6mmp%GFGMJ>!!-|3FX(gk|r@gzXn z4)fA%6pENB8DuTs9KUtVW!IjYP9?%_9PDg=9c+E<;CHUF*~9~P=tp`j@*%F?1PyBA zYyfuN$o`fh4S4z_2defNNYM9L(b6Mre9V{>JXE>A|y2 z)_cXz40BZ6YOx!|KDQ|U{w0oEFogd^!d?2?A~m=C4Q6~gC!FR5n{{{E0NZeb+K57) zIg7N>D-IzECS`aSOcJTW?^t68z}mb7wps3S)@5lEr?D6X8QFF=hoCc@M8e{pz&P?|VER7)dRzL~ zi9%Y@RwFcKjfq>)dFZb3!?F(`7(w zsrNYPeAZed78>J9#!+=ayn|#i$$>^-tOkuskHQ|AmB~^th_^)@EZ~lR6RcS9B0L;M zA~FvtY@yO$D*&Yf8CTeY1*(H6KGclg)|IjgH$D4(eb)~_clnb+HvyS1hFw+N?7*0Y zjbRGKD27{S{H++1?5P)SN;HXK>5RIxE(e0chh7P@Fx0?t>=nR|T>{a`&M=vZq?Kl( z6D3qUE5aZRyCnrBZ`fBWM~{w3Sg>!BOu~o`3x<@kyH*&FcpGC&>GJSCRk_l65LXJh z0+fxTprH7ElM8|NsLbeg8FBO2_V*3Ya`50TC+Agg=-+mYqpvLr5m(NKCmA}O)$*tE z*U$F~KK1>l6XM!&pL4im_jFj$wB+Zv>)lJ6WT_he2?@XHSN^pmC%^3rNjB~9ZzY-T zqC05|QpyOI@6Zv8Js*e!M z=u~@imt4a#cT=ftTd-27Yr7AD%i+cTA&qh&{g}bNoO#L;U&UtsihRa4SH(7Wk*Q|8 ze;c}PYoKAfzgvIGVPDN=e{1)gwYr>f3YWOKHMEC&mcwNT@Tz72u5Dhn5#71O9r;$Y zzeKMAlg;lsW_!p0_?en874(rV&)Q#@#zlS|`}3;LX4V{AKTYS0Z9a_d z8%7h#zmB>AQs;42#napobH2Mk6t^|sIZTbQUz_)5mT6$)-IC>7fU<7&8rOkME!bt+z1n@ZndoW%J&Qv zMNMhc%5O&$!GQx*$S7j+;dmrX@@NVI<1{^}zNX3Yq1LR36ju+zgCI-IM(q(Ok#j~% z39yMQ3dms5nGn`VP?v)sKVOlgI%USlf}TprrB(^~S#s463RKrgU6c;;(aqDOXn`@x zD)sz&XiwmOCmXp^94QFdYtPmGB>AT2MQdI9Nv{Q$Bf-}ae-wwovRFN}J6l>N$eMrj zB`Z9KN^^=n4*_JMLVn%2e+(mjW)f1wh-G>2p{zYyCC`jzI~&R03}wH~q;OrxUYK1= zIhuCU&TXb2Ps7pYw=+#;oBxM0xVSPH{mRN8vOd+Tsxlp zksZypo=n)8&bIFIf_4p=mTa_#fsT>lAX9c}4WAwjgkbXI8^8;$o)ICc)t61^yA zx|A_3d2KcMeYg^_A#swZR{S!N!bY4%o=&1Lr%7YYCdVvU(lDV-ofXMLG0Htw=cm2} ztfr6EB3)5GR^*C7Yfs>$aWyAS3M<|XBw_aM!`{6wlnITaQ?KWWHp67e|}pTaay|3$~iIRWxYY! zYS%zjb#a=0R%69Lg1{_QepeLe9$6!rKDaOBJhXF(J-%h%@NAko8dX80_}r;T3E}~z z3Mf`Rf?NDl)E#%Ov7*_pU&&rGa+i)ak#{ku^o9~mP~viQDyB=BC=b<1JvY$_5gMHw zxr54(Fr1<5#5JRt`;a`mR(J^ZVuC?#{~Mb50^eq(ZHOUgSp zmL|Fyb_Ja;b%#xJ)jVx++Iyl~rR!Si&_=1y!bS=CyfHr54NXU zL%-gJZlU*(xm0VmUWcMnZTFBft3c)HN2_>l0wk?Ax9{2Z-2Vp27X{)48Bp!Tn?;&<& z#SaT!5BZ>UmLD)=x>*VTt}8Xoc18IO#jh|=>Ouu*Pp3f8V=|aNi;v5vBZIKf|2baG zV6qmeR$Y^PQ;9Zon74G7!Z3V5O;pO;j@{-Hu!^*QFqv46RmQ#;{@ic*NWmD6t<1w*V^&ds<>huYq?C}w#Iz($%w$7~Io~&*Bh~>KG(R?94H3u${^iE&}XGAGeHdtdLpBMkBcF zt*Hqt9*+8-oHP+iMl;5fZEapZJ3q{{=ZDoRStL|~O*t-##7eFsc$;A);^9$JOPh5} z+OjGHgW&{d4lxxDn?z8w8d8{Qo{st=w{RrRG#p*#>W543M%-(?q#Rc&kFroYjKJ%> z0gjY+2}@Jf5Be{y!Mj7dc*w-VMmp*}WsUvn98lv zlM6VvEJkC66V~bmd>nWu*J9x{yDukB23wN69CIk}mvgt~ywZ*bJ+uqn=%+$)^#mUD zGvF8gL(KRt%!dD4$Cya{$35Y^R;#}Vn75i>COu6i0n88-*SjHxcgwRPU-2S=nOmR8=qZ#rOrcG5Tfzdkhpn;jEiO^@{ zWWO^?>&3a_jN}IkB9G=A;*6}tTIm;aw}6@7$MhMHGcoy)qt)4n7dO7^D3Tf(?#T48 z^w>IvVBV-hUhzjf3`+f`qWLP(w#f@DhbmlJ+Pp2Z6I5asb6=vnMjxjXxjKohw zusKj$UNr56%5pwQD&gg2X$&rx)t{MxJCO-^6?Zlcd~gRc1DVAG%!4)AiUc#$$FZk^ z363n^3GfTuv`@$NB#<3oMwva!KjC1o!p3|-{u?sGLs6wvQXe;oC3YJ#@mZ1%iNu7A z#h`28LuW)$0vY*6hK%fp89ZQM3gQ%mXZoVTl>=m>$X!CWUCi-P;(FoONkcNDfVzTM zDO*7}dK(n6iMzBJeg~gC2Gfd}dC?t@z7U12z9jIste40#`4Z}d4{mcs$#UT?zgHD( zF@Zd0nPtR);dC@P*)E8U564-v#Ma1OevyJ zSD0J2QcxH=Vl9&t!X4qh@KEG`O(Z7K|1DRBqY!`T6IR#?w~ltEKlXM;rJlRU=FnHu z`CZt`DWwUuwmxMF|tBFnOclA%*CJn+b-~!NN?CM-WP1^wr>jRoC zD5G;J-KxiCgY8#NIckH)KM2vw?#)9Y=H{7JJhtWa1`rK2Au2?{Irm;#l_ z&nQc1<`_5dX^5+iGdP;#ZRJxU189f4D5EshmN09ZOf0G2^Uot}DT#u~6cr_=a+R*@ zmixyM=(&>aqYhGcXqGf10h~D-rXOe+QZ3%Jl_%abR-BFLc_$8`s?XuHo)0Kj4mAEi zC{d|Ufp?~lH5}*|2ioerGp{;SDb=)Wi!Hrql3b7~-u))u252fZ z>(HpbO59=o`mK1mC?F1)2F*a^BJy(0fb22-|7Hc_|1~^7yqP2ArXjh3eNkU#ixY#d zm+nI{n~lr3p)=Fr*=>PiA$-+;e?6dc+mR|vZFmDA@DcevHv_Ko zG+qk>Gv_$O4%a*i;+N>^IgX?qaBxfLVF*LvvkS1RAh3t~O}h@TAIqGt$qxjwr)(5* zC0I>nuOeG=9j&@@wlBhSvhSD-)Z_pCwD}}ePT~h)_-o1P1fsCe9Cb126m8AkSBM;K zy~mQ1+?8HS@3vP}c0TS$ayU(%iB@L}Jx4weVokncZT6-j+gL|!gF~N~iXu2e973U_ zXJ+t;3`}^=I~KXG*f=DlcRSK2a1&Bd(Xp=NrkvYQoZ?juy{pciNYdg2IIOUIC;=6^ zDV2$sVA|HRi7bgop_UJ!qiv#?CN*B)4^0IM>ADbGjU408 zQU;h>C6iZDhackBmA5{*wdQuPfoKJek6YkQ2UZ{t)u70*zHQqPGzU?LC_)tFk^?zl z_Wv3YjA(i+edhlGU*ZfJ2tzSvLZ8cB>OMYtd?L-%+`v&SuI`*sb8u*Xiv$!!nYAO* zra+7gmg6K6deh74B~liaH4_~@^G-MuU&xJPhl({G@2BmW#BN(R*t zyU-@qAOzIQwQVN*=uNQO>){xU6JmoA)w>N0UP+IpVO@!~|5LL;p>Pst53rSi%KXBY zGLuRthrtLo4!?V+r&yK(eN1d+T2_Ke#r@UjgfnIM!w|@8dM_#e#jCC_G($Z`r$W4H zs==tHg zBnH#t?4yVomXa63A+dVtRX^wp@O7S z{f~te8l`VB%1A*v*{scJ)zj-HO4@t_ZpOG=VGx`n0a9G9|@6~_o&wF_iR{MW>cRL{R3ZnEu%48@7{2~BQ0V#o$ zPSXGIIm`1o1JZ@rBOVZr2uEFb84k6{u({OF5$lQcT@LhFHL=LTPL5wJHNUyPyIb5Z zU7a!=($jOX1*V@9FLVGfauJ2D_3wknrIR!N`B2Ez?I4=^7DJOy=PhSui^-btH@O>% zk(D(z;j-0o-3Lp}GwCFbD#Mg-td*Vu!+k3#$Ar#al}#hMBo{BXwHJMrxn!7-Y`-A> zjUG&_zvvfZjG1TJ2&j)K3d6;_0T@BFc#brZJh+jzMk{~gnNJ^oErm)7yNybv7OqF6 zDxJbv(ypUk63u6{G>9!|00ko%dPmaEg_~@Xo@j{qroTh9sQtcIC9+2ATE4YOEZSSh zG!<5~?qgQlnlOPx54Rjiri9g810n>muq%#vb+d)m^v2|z?VagYeZ^kBPATdqqdE$P z%PUjTnU8CYT6x1|&pgqv0SnBfXkHEdyWP!Xp+4ORS{XV2&uPLkTpqPp{zw=W?K&cO z_Iag5`EUP}!xD?sn~&@UZD?0P93km7Mi&UQr)yZSF!ITr`f4MBXEvN(STUj`S2;vI zvw^v3+Mg5=>S#4Ae|jK&bS9BMQG6Kwb-#DJi}2++OIY{7X-1~LS2v?7zx#uo3o18q z{mQAgCr_NNtl}KH z#bfzS*H#UVyr<7+Nzb6mJR1;?M(flLs!bRCSg6#n_4+qP}n$;P&A zdt=+i9ox1xww;Y_CvSfL=e+04hpOuNGE>tvS65fpm6Us+(PAE@@={O-Is=7EfnEUS zJm(5J3Zs#%K@Zd7{%kCG-d)0rM`h`puqBb*5Ta z5%dwBLNxg{p}$e3ndz`3*KRSaM2W9mrYEykSjCKuHvBuH>5fM>cbM@zHNN$x6p%;iQWi}}=e8UaZ+P;vE8EcjNCDpKxe4Yx~6Zo(Z8Gz8j zkqd)u0^7xc3@F>i)|x3lmbo+d^?{O`=No&~VZno(_cQB>ZI$h@xG(Q`)-IK(;|$2J z+}J;mzmOq$%OL{=K>~l=izrDLFG%>G@}GPE6Z?ML`(wRf3+Ov!&CYDiI|g`m%9u;cwF#CO~)Shf92|z$r#7tkPjdc|0A*qE(-4CjWh-N2G_H?WoYX)B;3k(Gz)DsmLF6neOt#IXp6R)igN_J8d%1#YT>rpJS|G$C_ z%=+Jg?f(o<6krw{SGHDqJOE>P_3g_bV68g+fkz77szb=xe9c(u}@rf(LZLxtHXSy>ab2k%~folg@?k+0j3;HhJ0d7ij!U+*wi1kN7xlux{P(D zBukuhx+?FDA?XQ_YYme2%EMTo%12X{tkoPvwh2?e)*N8lRVa}JjY@6hmR9Zll2xmJ zCe&IE^<&psHB^|aR&({#WgeR7l~r=x>{WG1n|q~FiZd=%6I!X7if3c-y5wv=K&o7o zX6n>L+8DnRp>CP77@R%Kd=?AH57pM&gjocXOPw~xr9Qi--Cr15P*R2JuRvI_j zJujyOvh2M0*5$$yGCyVG*H3VH;ma@S{NxjxAEnC5XYvRl7jVyGOyz9eJ+hZ2G@5oa zwud6<1sA|0F$yh37w`j1{#%%rSZ2$dN*{qS#6}MP-m*WdUyO4p1Nv*0tWqZc}p`MggQ~S1ZRVb6;CX34C z3vX%55sleWcP`mkdAw4qybrY1DG**xeJNzVfgxPbsi5coD`u|Mm`he=>>B1>R|hO( z;~Nr)_BtuKM>Q|uv}n1S?Bao!S0CdPelhow*P9~N$m)P@`_Ch*g2VB+9!U+E+Dxa# zbMmG)%c*S&S+*H?$9Ch_G-avwWY|gcDaLxNS5F_E3xJZ6W;oN7?kXBt5%Vz#&Mc0XihI)%8=CX$XNn z0ADlTMIO*dLuQsc=vo^Vs^r?&_g%$I?O{Rhz_~7NRM;gRvUE{01mM*D6$RtiQP2{6@xLpm-*A}^7B^%DzE!x#RGg?NtK`!4?}|HZ=piT}kyJjafezSGoG zSCi1&vqn#zpDx>q1T&{k?sEr@9dnk>xTPCE;G%Sc+nfDytv<%C+f+l|?ZJp-MYiUY6n@_7o{-&o8=vn zcO|kVJ15&h8@kmS)wO88rJ$rbrNdTglsYic+;9D0gbJoq85` zwKLkVktN*(JfZ5%%Tj2(OL?*BIjoJv>1C@w$C(ZNUQxkOwZ?b|lQ~QoPZo#g6gu*O zZcR?5mZ8>&fRJi>eU*sgy$!I~5jZcg>ZEuJHS^q(^O70Yg!3=M8_vJi+|TaaYM73S zE~aoTq7m95REy}UEb2zwj6-TSxTaF{?(a3Kg4F%`99oz;N&|kNSGo@ILBnFYy7KGj zS~GYVd^F50MF#HRM|1}3E{bVH*R8G$89o087l!vmweV$h86Mjps}^BC8KqHj9T=KF zSdknleU3PFLK)cypt3Q=>{H3w=t5kxV{J*PNgL`}Cy-E6xH$_FGfpl3oG+R=Ysw#L z*{R_jnSZ}NQ?hiH_V7V1x5R70SRiho(s*_PvC9R#SC^ne))b#8`sYw(Yw(Ja03#+wfn~Ax@$^tDYe=o`=F(p2YQD8L{q|@I(r+@n575piFsH_Li$wmOiXjGnnr`)%1=EvVLMS@>gTZyN zQW4pI8H^(wgW8v#`1s82SJl2A-M8gAX$~undWN@wS@WFIDK>jh*vgm35#`1c<*k7? zPpCaG2zmunIQ@0V+uXY)<)3n5W50vT-s z#o1~cPa7m06w2>A1NK6L6?65re%0~0=DmDvZXf+|lM+#dGnaH|&u=Vau>6{FCn_ia z`f9KTas*^oTH7lSMYG1iWOpR+n!s!{X!~)4Ot0=kDp#SLvZ7Faz=e;4IKN5YjS>Mv zZpA8iOr?yPLRz_$9!554I0@ORr8%0-4^&E5mc#Q;dExp5t|ZL8%&;qlw`)ptHM6RL znIdXhf3`w}aHJCN0A&lzq)n|@k38&&4O6JUpoD*8RQ%YU@!@aKm81%?tl{$vHTdH<8G1A5_hZ5EvmlPLNS&F6>^^NbkdeG| z5hU(M>XT-fvkjx&79B(y+lJ%G`QE0hYPiaRX$||mwoPbRY2LJl06COj``*g^ z%l=xKheK8=Rk6;don{ToaPxAP*q*ryywVNu(by)t@3S%4u`89?c>$%UB(?}Bk7Wxg z!(_`=h$S|GJXv|&s<5OFtcsCBtA2rQ?`?ppnUx=P7=Oa*z@$-3@my!NlfJ%OzAIgZBVclV3b+c3^<7tL+U z-2G0jyPJ2nAWa{1WH5da*yE2XOGc-lzs;FF5F!PQ@-8@!fMmx~<3|T>^;wR1+O967 zibn7dG7O_fh3j*FKYe>zuoo1ompjLbCyiA0 z9l-fWO)z`Dg~YbeFvrBpv4{@&l=d(-)+*(!nCZ&&*=5wt<#2$E=C%=%k=7TJ{)87x z3uu=?4{0RrN?KC2lF2$s$(JGMPyBdFjys2>PpD>6jY#01Gz|8qpT4HZ?4Zz;K;5(A(5@ zzuY>tv}S*O-PtZRELgJ#(rcHlS>hq$cA4O&#e#A7vS_dR`_IiXN!@HBG{qAxPyWzz zw?^O8Sh*PGVeFt`T*Q=4Y(1A7X`4fPo#?KVl?<^weBbMa8_+ZcoN8VIMQv14H9{|X z`f|u`XEAaEwTdSW2r>;RLTHU|WsPLC8_mGXqk-xgcSjdhkIZF37(<&lQO(rJ(t0J1 znjxo9XX`c-Fu;0?9_Ny@W9-rLBMDPaA^8U0kO%3 zC(_ft3Ld$1B4olhQV;2)|k7th+ZsBm}1pB#MZW6e9P*K zsv3k~EaHe2DX+0YdHg~q$%)0dL3rUO?;KfmN~tB_Q{D5S8L1$r0qR5}sRRs%Ov|J< zpz>tU#1C^_+fIS4EwzFN`Ic|;Vk14cfWMpLAhEVTrC4ENrqtl zgml6&0|3H6=Xn+?lftI;As(xqT+w6C9&eaxiisr7xU;~hQ9LK~E?s}AV@Ve=0`_0) z9)yY#@Cr&AW40)BedPq-Vf${cn1ihT+GkF7TTy`%^h`O`oajy}gQcxhV)T;An$nJO zYikRFC7TB65xBG94092==G$al#gwQZ8Q%aC%*rhg>y?zg%yA!sikHu;;U zbRJb2tPMBB?>qHQK@3)4Y`TsQH5*#7W7tPAZ2qblC)ipFx1Kbx2M2=uOh}LKi6X^+ z3Z{}fd_s9hV0PJ4IqjRYqh`GASq}w$ph*|PffAW{3W0LwW&+^6Fu=C{E=V9v5FoVJ zu)kg`ep&Pqg1~~RkHwD%FinFnJkf19TlNWa)bR!I?L?Ac3?v5kfivcd83^Yg%0~>6 zoZ^x99dONLm0!&1($mxqquyB0C1#iPYv`HI_it`TJ?fM}cY0#!$r-(mbL9}@PIdd2 z10Wz4Mc{Ptz+tZC!ICR79j0cK71&fg1Dw!~^ho0~ZFS=GLz5&# z1?V<;a=fFhv=eb83SQ`OT&^TA#=$;T8|;mwMFlQA1s2ZKMedDExK?W>@I&s^4`$CV z`}}#rOi-pvraEqG(FG`}@;xOWdAdNP?RrD&``RM3e<7-ObtV~Y zv?;nxXoyy*jZGWIlp!pm+NEiJ4QU!&v{Y+hI=DN*Hb%(7c8?<7u(BAp85>@qv}7E4 zW;%ec3o%bsZkExCsm(cNy#!R(7>1~CA$Nu>8nrKZ~cnx!&huV_F6%;Hs5 zGh2MOb%|*}zW7vSO=+Sm;uUpo^&Y3ZPnv)-OnoZIpl^QW8})A?)Tt4(d*F)ulxQ-z zA`Q(DaH~dMtoAh9nW>BOX{0q*cYQ`QpU#wt`HSzpus{#zDPn#_3*VTd`Uw=xzGH=K z%~1aH6W@Dcfo{%IO#h4)zVJ+9sd2h{P^gOZD~9$uo_{Lk1H|ZNKP|GmJI*h2xH|?$ zJm^m^z(*d@%X4#Pc5-Cm>r~&!El^BncO_!29w4OjZdeYwIxx zM0Q=@xcvT=J-xp2{xCfdrCL5ZO|J&P=jr@s*FwNs>W;2a?KH%dqid5%siR|K0zsDI z%-y+q5S-JT>wWC9>;;m$ph?4%Gne6BZ;ry#x!M?!qkFe(G4q@Svq!SnG+7e$*nPIp zQnS5fQNF37^lFhfWiIjdTPvX=X@(=`0Yt%;9s25YJlnq$VX`lyNn8_sL6|SGW2k3( zZx{Kpd1XBA`H=ZtkmkXFU{p>WLLvE}q_Su#F1^MITdQ$?Hk0@7Ie3xu!emNAx2$?U zC1f7GS>@4F@esHriSGb-pe&Y^RO?qkiop!rRK-E4nvr;)N>ZAbD)}8jRB+R zqpCduTVjT^Vpd;nHiyriNqbk-r;V?1$cjTA4qkUCT}=FJAU!ObnJyzzmP`c2-MAyC z?82_JQX6N%u%Ww!U6SO#d-&KF(jXkMbTwqaF=7ETl)qrpEbr*Da(#1V!Jmkr9mOa$ z4@*@>9aGwMyHr&tHF6{)`&jA}Ty{B!LWjIn9+&6}9>c6V$K~~#B-UJ`|K$%kGf3hB z3r7MUhRkXhpNz)n%M^jO-OH=ifIP=MY-(LUvYS#;KQg<Otp#U&G9 zCP!qcrlrZE)M09hEVGbNuG&Y9+?b|Ii>pat!uN^fR!?+pxn@uo#h0mjL1xP5DrO@y z3YCuYlFUQwrn@gnv`60zh)=AWt?ynv`UA7$+C6r>=?DtF<5Je-4vpOu;&N!XdkbwG z&zK3b9iDEVkH4E7*5uCYtw~bJ*WPEumvtC;Yh>zBPyKK`<*3Uo$d@Z?zDYU1zH+I> z!=&qJ1k4tvln;S<)_=%+Ym-pA}e>k_epZla@NHj zrgF?T4DXI^R~lCF;?s^E@=3*Eht@1|Kf)Q#f%(~-OJ$9_4vYafrPC}Ytx=Yh0JBNR>Y}&!sruL@3w{39PO04ykj+ENq2G$J_UrA1nY!jb zMcVdvNZe|xQy5UpaTCdr>Tv4j*H(3+LWzT95zv0GH*gTIQQYv8*-Sv={M2-in8ea> zFzA;s=-=wRDmCj5@3Vszh)<>PjYE<$MB_a}z7pMp;5V5p6*2+K#aNxc-)$Y+n}_!8 zhb-M3S=+8VBukDHM4}#B0$lMS{0hXD>PNjdb-} z_1pE&fn(y}8N85hgpe%;G_0zBD7&N`EoI!Wg|t0Rr1|@NzMP(4j_Pmwzg;e;4^E`? zCxvnS9GYEZOhYy^7IqH4JyWQcMjS^ss)9wWoye5iuv4T~Bhd85R!DMP_rhY!pw?Dn zI)u}fTY53na;IrgY5#5wE3A13|7>GlkE`4c^s>fsN|{X1M8jKYTvB+I1x(DFYuaWk zO3Nb)-Vp~b()Qo|hM^~QDof|PZ3q#^vj0b;^AE#~PKyA~Ee^BahO^ z379#QHR^7z`f2+ueJm;Gzw%4T(CiJbhXI$6e+7Gud@jFP0We&t$I%roralev?cP1k?Ri zVS^VA2^C&O*PsmeF}=KYsndxsF7ZUz%{PepCVUxE@;$|Wd?;;S6{xQh|)yAz#Q z3~Ia^rWh1jN3|I(gsn>GRN`7`Pev%TS#`}6J~S9P*JiI7u5Pr*Ij%lT9pJ$33de`T z&#CwGjk83tvofqBK&@#k^7F}6o`NRBYUzx>_xIY%`8W10Y?w#DT8)5z*Qdwl)e)-| z56+AM9fl2m2*PI0F=4D3Id9WK2zRd=6&%6sC%bv0Hd}O$^ZV?>z9cXELvd>zV`1*JAz&2tN1Z<3JzzCPtu%A>vy-SQzHB z%_znqMI!V|MSP8m=vcZK?aZ^q7}ud1#qTN%=}4w2Pk4PXKru-8m*0B`cKSFnRXwYK2UUo(8*b_h!`aFQ#sTilfTP_3YD@qXsH%KOwL2?BG+r zM^~ERb(~=FnosvVKS)*5p+5)gD+$x`RX|E>Vr7n%EW1^FqwV#F!t3bf!56 z_eO;s2j_piZbwIDRbc|ApQF5uo)?BY%H+AxRp}R{#Wjq_)h<5dkN_1b749envKLms zexB~$pZzaA=_VuHS7IAsuPc%^lA| zNQNEv&#p~+Cg(899oCn#l;ChGtZ!H7yNy8q{PjL#dEa+A4YV=Vn*++{y z)P&0VYqlT%bZuhdd&h5oj>5+Qge0{b8@0VlmuNaG(Y?NNw9ku`c_VRNigVU^-1mN3 zilhcjILe#z;Z`qw&P~j{?czDDhG^1>>SLH?wH3F*-1pO!OS!C5GRuspPphB#@bSKp zE6(28P!(!)xJ}Ai9y5<~HuLqbgIe4LdA$qikYa6)oG#hx`>}y?)J@`palqHi3&}|F zldwo|vPe)g3bQ+RFecDWCXUFnr{qt8!r`-z;ZP>KqB{z4y4h9VR9D;3wrs7Cn12W2 znrsS<__|;{lK~hTeCf;1!D11K3Su!r3m5=+zmH@_?>-T~Y{cgGj)B)EdRp?kX;PD}ER=ZA^9 zTeCRCj=WFMWl@pJ)|yB!l00E0z?%>KN%rOAv@_n?2<-v+rmZ* zn=+1^6q4LwvyIOl4IqtK*O8>SIl*&%GQQu{sTyLV<1!M4>WVGx=vC-L7X(6(8wE4} zq@4s+5amu5p%w=-FLH>{7)_epa;LrADIK4SRrv+g<^vrg8YEU>GN-1|7J4y7hEy}I zaxjRulZ{Xbp-P}YnbL>!7doPkCg7Me;CeW={9C5xazzY|HSF|LH7bnZ(I9)=HOe;i zN+~Ya>}kEl>S++(4XG4Y;sxMr^fZ9x_rUi<9gt$ph(59!C7SxsG=)*xNaChvUGJnF znH)sV{3KILpI$8r6*`jy1J59VqFDj_~0z*5-dC3mv!|b^v`qrBZo4#}#_bul$O| z*imO^v3d#|IXO3FZR&U+GOxEn)=oNWze|w|l&ho*E}*rkp1SK)ywdNonb-K%E3DFL=#cIsh2@InoKSUPedX_~vinK}(KN zER6J7+uXX8hvJi zC=a-EF@;C=P7exiFF8^YR9rJYLnX9_qvi?fVj1(6jvxIF5!93R0Kfj7l#L8Ou`1sZHB4^?pce&6sIal8d*v-uRW~iEXjO> z`7b;pu4O$G1U9p%1v=FiL8bR(W)3SGS54`>+2Iv7!}YBQHhu{<7x)AlK%~9!mM?eV z3KWOql^ZjQ?}Fs-$b&C;tqtLv3>St6oWyU;sxk^^CyVlMI{W+lwFemPaNW!@v6wxq zI>9NyQh{#DrGz;ts_Svt0tb7%7}%{Ox~QClH|?iaFr_0aMz+>5Eer2Nh5$TVbF2p* zww0f09x~J|NkY6VKN4!8E>XKiiYAXp!Tr+e&tonFrGEC$uZz8j1(6LZS1Xgvasab$ z4KWjQ-a}1gPdJ&Irb@0ZDd#a7cK@D4>XM!a!N5wJps@#|ogyXpa#DSTm_{7mym!>H zlc3a&Hu8@Z3RBiBob)%&~BK!t2TRtnfsuwyBBimsea{*;UWRX#RRec()=~3{=l#=L=L97IEP<+j zuoRVHUT2=ToE|FS$VxM3W!V-I1e~sSjyt}@!Ze+luH4-u=8B649LNx-0VWOZ{mpMS zoS3rVw>?Jpp#3L1WMht7Kc-2k`+`;8mP=@iri3{&4wpHqXZ-Cu@cXTw_8m`kTS#8e zw(+JaTDG`pcpVR6l-YCCr{dbZcX5O;4FN{AZbJ1&nmittCu*GoN4go$yN3^VwX-)0 zS=jt*h^sb`60p~pz}+aaPbj}bU622H`S|nrih5q3LR^cp&38obtiWA)*G1q)?zg%W zUb)*t0x~eofKfX?Pw<-I){(Vp;Eh>h|e+bbL3?J2p4Edn&@Nl znzCX@xJBF|<-tl{$LAiXp#KBydtNds@f-@OrRMc$=5v&ALVWRy?EEYW zyc5VO?eC!T3$p#J{|53Np)B|qaIE&s&E%D;ZgH@(1swN!(en6{IM zmL^+B%fd?#9fQZp2Q)-Cu%)DGo-T*dIU47D1j>5w()+zTlAdfuN71uMtN3v|97xkT6)V)ZmXQVt92 zcXq*Rrr4Y5PucC=B!wuKxl?I568B+-i-RbsmJ&6lD(RzxNBpMAGENTmICB;=r$p)? ziu--$i`$&_zN)F&ckPM**!%0#YDP0WCQB>Suf1NhXA4(9JOC`ZXfuw#T^T>?VvDE3 z{FzbThGVZFQ3#t8Vu~x@7!K>dniVO5-LblEWkVbCAtX$1`@KN5@NQk_T`9O_>)|4f z_1{a%kbBB3-g`IYT8$c?JL?BD0u43*N7tP87v|Epz7==Tus_(=HHGQQx{T_(7A0fyI9>$4a@ybd0RYyQ>e(ZL|DjrUa^pP}>zGS@U?nppyOE?fJ6PcgJV!baINXOEsE z(rb|nTra(}-3(r^ltiWG*LO8B3lVaPY3QJ#owF?^_^1VpMhq|^WBFKn@^Wzo+O}50 zzlgAP4qm2itfDFa@XgQ7e(`F zb8AiCZTadt2z8)i=X<@+K)f3c6SyI)r5BLG&>N-bGVKsY-djVly(N6~U%PjAEi&G0 zXhqfUc*&f@j*yuaGR?>P(X(OgQGf2S5}ZMw_o^_WG_PLI&l|5VQ=%>DgqC3=|%q!8Mn72Dwju zFnHBjUT(UuywEef(B-t}{+~KV(^IBc0|eV2(Vrg`o2}k7U!O#=Op$XET?Fmn=;Aj8w2k`3$4XaUWd!M z`&Z1kaX^3KqbBX6Pmv~ZLp}%3)$%GzL{Zc0|Lx9tigNAMSCQO&4Xs5N=3Sf8-|7Xu z`m9MsDgSEQLXh==#ThC0ayG&li8Lx;H8qu$-U)n$neoC#AtWAWabDLT^Tf#}jZ`Bk!TZpxqrmyU{6TRJC0Fj?OJvEVV zpq@%>6LPg)-{Yi~x?S&T(OCTdj8m96x;ODi zNknda;qp6VUf5KLe#bmFtx=S-7_UU@8X0;uU7vIudbB`fUjpY1;MX<4_gZ)Zl{yG= z=P+M^930adv)|8CU9wPxD>Nk}LT3HWqVidm@gPsrg!W&w6`yM7%iq9*^L1zLxPD?< zhLXI*^n9#+Sb3Or8%ogA_S8}*2PKcg)_yP^7Iz45V0mc^PK@cpxkJq)c zgE(>Z6RIx)FNGMTQ@8Ui6Qv z>LCym)9n&!NJui`z%hA0ylCjW^0@Jab8%T7Zh*FgaZC9*=S50ndodD4`SmML4Es$# zf^93#7xHW{bz)SA8zg)IiUi>=oUktqpEuG7Y9r>p%z(hOE#z#5=Afz(=!Q_?rhV*l zu#JY@EFEt=tUrD6bFurOdLG_PFkS|3QI-Eu2E|?m&dWfCd9LSChPmBd1|vcq*v#e) zzuR7h#s_0=2H}iJ$LM1LuX4Jv=g~Mc_rj#|>}2D_)a2pM?sBYYL1pE`1bM-F#-iDu z-)08RyWnbcz!#F$1)*=*o*I9-kK3gUG(Dyw)X4YRWmIdj*ZrtIjrVpNqqFNV3(@~N z@xMfJ)4h&g3X+0G_(VW$h$oF~8FzhDbvYN7jPC2YXhmd;?z5yJWNgW^Gq-P5U;6Eu zrORDA+6r@gAhi^pF|+%2wUTke1E-v`znCx$$-3{221?|#7vk=2okLEHTz~}jFD?ED-I{}&92sB}=v&OwmRy5OMavF_26dRoV0^e(YQDZF%lKFeY&^8dKO*vAdj*8BgS4C$2!!(d>g*;89H=^O z?_1O@1GUoUYw~;M;~OP-vndN`nSPOB{g+?{@jM_~X{KD+GS@uXTZ(FhJdlGyqa;Vx z0Ig(MQ6^)oO5ul}YEsu|LsSv;JxYcr>PpzT zzlI-j)D~|9gIfYT3yJ&=wLlFe+D|k9|Cdt`e=`3MJCf05^_=WN(Dem#_%AGO`)rDR z@tb%q(i|3&FMPPgGvPnDiRY*hsYFT*^zEZR$5ao#<)D?twH@YnjAb`H0(z{2gf8RV%y-^*_f^pyC|&-Xry{^~e()Yd^>%x$ zq1`0VI-XZRSl1$9i>PQ}lDW$U@G5)4N5vr7?@CCy z)HpG)Qe-S}b;V`_{bFMdT39RPw@1l~ArL8zN=VC*V!G)yG^0XsZ#s2ig*K?p2#-J(^v>vGwY8Nl+Pdy$Vi`Km5O08 znz=MOFv%8L5aK7UJim$BmMNZ3WxNEms8NfRrQq(uC4u+FBhB}nn-2_Dwyv9K0W8nD z97&m=pAugooYySBcvqMNC#DQo@xY^|FIVCJ9E6Lh@mq?{3%HF#c<*4rRayjG zLP3a}08c)L^31@G&5lAw}1UvyrEL ze7aeUz_873zXF$~UPN_N#LPN-7Ll6KADuc-3hLViJyLb1P~^9GDUVklVyKq8_gpz3 z6;<$Wa7I6^3OpGH=Cq&B=V07>;6{e2<(l}@;?{g zc9jg`I-BPZ7A_kD#hTH$FbBO+x0rif+oC~+uN=h3bVPejD$ymlh;hr`=12*brF%A`wUU>)qR5^Qb& zFHD{XqpR!=5WxYJfQAtr3Kt2$K+<2Fwi`ARavthFg@;e_?1*34wR zJ#fgUkw$&ORm@Sn5XZ-aM0VLv42(F6n31e$p1vnl zrg~oXUdaqFUU75c#Oeaz8vOYSiF-^>k|+gU%&E8>Me8n=SW=zQgdnj5N-p5?y2S%3 zKvw-|FR_G!@xxr*)y&C`9h+sQCyYDn6TjuP=4#Gk<=#`|7WnLbAcW2FX}1~o>=w#G zgd3}$_%HD!cXa|wUWdi$?*mx@pKCG;t~{1t4EtOP%aefdH^t!Bf75Z~3o75Yme!Qs z{3iu7&)gjozC-G`meF9W%O@{S<$@&v^0)_E;HT$i;4 zLfMNzRX1U9b*9pbh1!aQ2_1z)AYe&)s;4jtkBa8(7d?DPJ< z@T|R$iGu>JSH3w4?IEC&)IGmbNrroz_QaWey|qB}gIaLWCM+7j?}5~!nv;ah2CE*8 z$!|Av(Hk7sbo|4JpfA)~3Dlpj_qGiRprmLPt&$LD^}L~+L*|a;1?+>P5{(d zW5Ck+dj&P~d*jD+GSu3Cz2*7;&^{a~aM*AAeLtO@ zT{4vQ1X#4#+aCuK9h$iGx|QL1v|I2dx~;4?mNUyN4StqnY23!^F+t%uU$r3=*p2 z4pFhY?;jY3Z|HQuq}vZis0n()n!1o#=l#uwxS1BsV9F7%9NG%IG5=tLbVdOD^ezQZ zAL2y(;Sf`aGYKYa$1ZGNW^)_et11rj{XYBsfWnBLnrsE0kK*~rpg`f)?Qti&oJAjvY!%*n`)QzNgtzfvkl+^6@h9W z2%kN0bZUYFMEQntf^o$&qL33BQ~2Xz)YbK z3$x1;yVP|W>$ezNrA#_gtK|8(#|L;plg z7^$`6tnQYbc~{!iOv#J}-M_+RlL|cigTKv9_U88A3jwW^|+UzLMa%M z6UN2L3%*^?t3w$Xgvd7JHtbTt3%S)mqzp}Lm>Dj|L{QFc0ecsZ#$eh;kq+!Iukc%7 zoF%gRfNiES47T2fWlDD-<5ZugF8bMDip(aS;uK5${fBa|2UUE&C1kw0zfY#p9RHfM zznRhT%K`Rgp=_*SjzDZXtM8%di`1rvcHnfuh9B&OnHT%OQ?{`N?F(`bOSv`VlNvDI z;;k1f-Q)i~D0Y2pq_nB?u&p5BrAO<f#cx@bT7|^Pzf;R~fHd^xTk;&^%JjBKXpynzh-2wRsn(XIBdi zRC7ZNZ+nd;c#zvYcaYJWCE)dW`T6`6JU30lHBIQjokR9WL_*u@pB$1GwgIF;03Y-K z!7IjfVcjnC!p*CiVf-|J^SYv(e=}aGu3Q@dUFOBTJW-L=xUmhr&Z+UrL$@3YJexlI zRc!Tr=#nuhUTKJ+hDQkL-7GFK+(vm@73W@2EF2YrC5I6}9rRJ25-Qd;);ar(Bw3wNQ>mlMoZ{d znnba+Z329IV+w%`jRtgEC!1MCWmJ`r22@za#2qXWMYbK7fJB`qST3zaFyBWvH2iilWwDmQpe8g$@Y&?an9)L{2w6;>b*_4Sue1>kh;fG9?yl0YC8AuCfG z?EBm-Rhqo!&|ZO^Ifu5zZ32``{l)XYnRmfI@Pr}v5>_qhwa?s`o`5%7kK=SE%r!3= zj2`~!@34HnzbhdguG!$J2jc?-;&!;rGa^CX4Z%$A^Oq(d8`j@Td|!so+Yf1ao}WHwg{)@zpPy=E};0lij{+Rc;*SACma6T5GNR1 zhW&B+5}wp^LknzYdTaBFGX&elBJiC3mVl6IU}FSmc66nSSo>`R7FYAN$yWM-Qm1lW z)2~YE(APKj6_&8PZ{p9OC zD@8G#UX7M(7n|}af-cK^xvHsm^#+Fxwa9`e%;I_Z&J-}{X6ax4)udse@zl7Haw3cc zEH=y1#!)Ji_|`UQF}zj9#Ee#fbZ79K@X`gc3l{?Oy_$|zWB)05l}{@DQSZ>Li%FR^ zBfOSd&NyM3g|wBMr2_ieyCeB^VtWNTuhiwm-EWE5`}JAOG`l<#-e1@TeDZg@kA}9f z*>zOtUx(2CRPnZZBr|the$K-p&()d-v&aYN4%|go4`7rBD{0Wd<}^&Ei|x<8Ha8|FTLW;e-|`^=K`GCd)s%E1wR zZ020v{8;A9yaSe3CIIHl``v>$WeDPgaz6QQkU}_#HdCzH6b&P5K8-bB7o*Wfm}nne zar3uh&W~f(yE|LIZEj6-u8dYH=T2sr8k=SU*fz@%HtKl&Ch`n5S zhb(XH3Vi{4!^$&}XVARoHC?F(ZXPaG?paVZ{Js==gx6|Ro-^dru~&NtQLuZBU|XE1 z0#@gv7(|`mreCv${aO;olY-rP{w#6DxBE>wKFssY{o;z}HY~l}7Nj_;HS}zhpsS7^ zRwv8o-PucyHY+j0Wot9;2d#%1@Yt9&-1|Y0welyUeJZ=hftJReAj8FZ>BDvsYV}zR zqbFK4_Izz)&z^bsO#@P=fa<1FSSc`7fJQTA^PC&R1VwpHoy%xWu+M~*(JXgbr&1Z3 zBV#2M+_nJH|9w4KTJH|@3+(yM%T-P1y?@X3OwVhqSbG44j9zP(sl_0lF8b#G4nof} z*M1-Fxfi~S^_RW5>pI|$F5BnBPh&3G{5lz4QITAaXJ5?`p?s&Bd(#P91xXMWG2edN zDV~f-(SiMB-(>x!w-b(KnyDgOrBz^WMa^ z&6|~CRL!ATCm){Go*u9o%7gaRJAzdQPd*Msd3S~mM;c5`HcDVAf(bL|WZfTgcduEK_xZsSm2T3ap#?wJ(xSf}y7Ac_VIxx7PfvKjvxYbx-`x+! zyhmG+_iVFAA0HjABO6VJeb`@$(bV}Q-Ju#NMF)rsuo(F4-HAWOHc7S`R>@=Q&1G<+ zW%@v>-7EGvx&F*d!f(c{*47aWP`^xW7`n5;9Q=bLKxY^ufztkXQCyG4jLXSzS{QNt zuj@sBVwe5P>DUfF48B`E^la>K@7B-PAHteHorXpZ0k8PxF@%%$1ZnG%&`Lduc%@L(g2>|Zak+_eOkm$R&bFtdtU(q*iDQzqHsQ z?4*;KL)3MkP0hc5@&Sa|3a0J6H-#Y#7`zA`#YW7lw4|=Xu+m|=b^{MAplR649ytclw;EVd~J+P?X zJS%zq!}DG+NhiL^izc0eL9Uoc>A1XDT*F4OmYO^lr@-Wte7B?VK8)Yyn)yH~F@>2v zvdQ#Hj~+%Hb}s-_@DbIeoIep(I+$2PM?CFHzl-_kJKh6Yy zu!>TX^2*1?k9`=3-;qa!u@mptn%xdqAGJdK<0$1lk6(6p-!HZ0j^^u32QS}L1CaPP zr+>L@_Y1CS2+Q84ig$0iyn6NT{R$kq@$R@Cy!V~*)%^Lfd-LxjeE0OFB>sZs;f-9i^kAbaa%Cege|b zkqvALL^cq`q#q@sD<>qkd8#bal)9AV7@%*SBjyNC33CRpzF zsZEbn_KRZDQA|3DNk=j1C?*}nr2iUX(h-Di3PcbZ<)t6xNSbR*u-C4!xl)p2mElY~ zp5?j28c`)xE>nb%V^k@_4Du-l00Ct=hmGf0hvq0R9p$B?y!38OQC>RAOaH~?r6X3` z6o^)nj*u0KN~r;7 zbCO2E=_oiI1*e-={)$coQE+-+{ZVlG9@N)Oa5|#CO@WB|o=mR#zncWL&`M~BQKlr( zB!y8z&Jji!b53Am9fmbOV>xw%rp%?zIE|UL9H~?a%8vwwQGz;3P)7;sC_#O9d5RL$ zQGz;3Q181>l%ReB64a5dYzjoW5=E&WgNqPY2}#cLoNFtwUn_M+m~<&soKiwC=G4HX zPLa|)%e<$7aT04GjKDaT9k@sorH-Q1QItB0Qb$qhC`#Qsz;B}{^;c=lgL!2Xr9O1` zC`uhgsh@}_b>z{T0#T;=NtyosW-`?pQy5j5X+@N!QmRa2je$^WN(9Fg8KQ_x1?&kh zB2;q;L|f9#D3;-r(++Gq%2Y?0>L^pabs@@BN15s8fB#sX<(7*D057&9w51>~9=7!E{SY8|#2j7x6X(ws!$>RvY_5{0Yl zKhG;%9run+fw*@(9Z|Nwos>1<6s4RP7;6|I;V{QeGj5F$LTQ2w*U$!*Dr1Sz+-m3L z+brXnP=|PzJX%r8I!akbDeEX@9i^hC9R zt$f~L!JM=?lGZpbQtPX>zvvD`DvDc2aqB2< z9mTDqxOEh_j^fr)+&YR|Kc=`fO&C|ZPJU|&_GMILc=#{;0{4Nu(0=X~!yO}BlXsOr zKL^{YZ`{0X7kX7*u(K)r@{X~v;#!7k4)n$3R4Fa9Be~YWzKDLiWj8#6-|pUt`b~2! z z%V*YspM}!UfVBi9?$Z#e7UWIN-XvD4bOTAMWE@MES-&g8k`!_shQl1VW=DCy_x6_$ zKfdU#+gb*U>e?h$B@e2Vs>5>t)5}+8Sr?t%j-fC#X8nK&Rtpj0g?;|Tnn{klk8qj9 zr&z-CO!6{FuvZ_^l(knzqB023-prnjZmpSy4BzEly?~^*@6EkS@5^6b zAK-hh-o5_t`qj%fN07dglpotnOKnLSw`m{SxjMXD=sjQ87M_3!PJH!|H#=hD(iPogpB@q0c?Q%+90^RB_vz2EbjL#?^vh5cZr-d)Cr4lsiM z5BBnx?$xjX!a$}5?O8CpQMi43dy^2^`7-efupadng@vWNG;~#KufII-6kxDe=!B*K zl+Zy+a8!LvB7i~Xt4|8RSMqRuu!xU~)fgztbO`%G05~Oms;&fw!ha5OiBgxrrjG>R z1I462hb1!CDYuRp&XmHGwud=(zmX*XF@=$sGnbCroMDU`+< zwz_!$_+=cdHp*dQQki4z@-)*xm}BCO5YXRFa@pxTc`8pRgl z;u7}p!5TL_q)ge5V_=L`3z9%l@Vdw9-@(6r>%)XsyoqWnUNu@S67P_+f`zAAJMdt< z7<$8{IEi}S^V-jDXGLfTyhp#ovfFsz?=B0UA^Wzi=zW%3e46E!VoZ^@+_s+o99d24 zS8rg?a3h&GJlfNz#-t23LipQsW($*_~65^1nZtdy=+>_2SlP{kSfsZ@XoceVB{sS7^%Ftm1WR z4svaJHm>bgM5)&>FZfE1ro&1jmy|Gk^MgdM;KgeLT1QvZiWhfknp;mx7lWDC-d-$| z@^cdEeD@0XaetP(wz|6KM%vw>_VboIabdt&ld&V?ME&lLWpE+M*$h8J7wtaFmQ=KlpWcneNdqX(*z~G=jKCcLj9aaA${T9OtJFLqTa>{ z&`})eW{S}Z?_VJMl%Fb9qBu$;(!bk*5$XR~A>Dgs;5QB9bxtWo8Ig_>$1>#d+|Z0^ z#8Yp-gignKY8h9;Xv4V4g+e-q4@xnLtvLYWH=$F0^@f?+G$!^*9Rjw;K{FT&VIlAJ z`~CZ2{K>az_>5K#p2II6ue8_ac=mivDDHTSPNtJ2qzd&PhF?PFQ~3QRIc*uR7o?Uj_UhYf**^1?`4%6nD$Dj&Q>C@S8*U=_> zYzUt-K5emA!?WWt)cq{T)0IEZ?CmtghEJ|Le8s4=MtO0bzG}+p3PQ1I?3d6x8}^dc(&0 z4Wqw}v9kEnJQ>$>b_^Tm@$B&cZUX5=mTqz+UZc_@ks+XnA-pIyjF?5CGz{A` zm=k#c7rt-CevH;HJFqR+-Pu6wpos6p03Nmx*jx%%`T_GJ*Mygb!SyUBFr@37B8CkY zH+(Lg0Pw{0Z2`p@v=sLb(=%96*Pmtde7!MAcBf`DZMvMC49%Y5jL(j<6^CD~tb14G z-`=WPjx(6%x+e0W3ELs@eRK96B>rWl?LM5|dn3Olcbm+OW&8_(3&Y*ol6H_g##;aH zCizK;pLZtcVcv#)KFs-ON1)a-4kIG`mX9`GjL|RJrRD&4!<3uM@(HFOBUQq^PXn6L zVV>lc%|qX}Ob4E#=^K`9`JrP*(lv$jBhPR`JF;!l_E}^`!Z1V_2w(J`2FxU$O{kVn zN9uiO|GQsHUdNw&d3E(}^d8dzBmPD(j|YL8Vmx3#2NlnY2QR`gEEP_2={r7Q+HWzDnyZDOAKAG4>7op>hR4 z1DEgqc(f$NuKR$4abGbR@j%eXg9=^u(fsM}mrQv3b?$PmdaXh{bm5x)MtNP1REJZK zdv@SHm~t=Uw)7wu7qaQcT4U#-@^{Nr=>>U0(2;GJzR8XJQ2WLQ^C-V>cU z8#C|9P}X;I;(5oCGgkDqtApiF9RGp3JnX%H0($Tv1?Cw&&gijsP)|e;|L=qzP8@on zCz#EB$8sfVVkHh|5QP@At;lm^Y{9S!CpJw79-@d$!C~UU!?QilKZqXnr)jMtqQ8u7 zCZQ$mZd#W%+KPR&(h7X!m8miM@Z##~)tlcwjN;-5*KqWi3zK|R*4391c?F?@4D#*e zx6S)n-xsC{2F1z?$^(n)t~F&>>S3L#kYZ8l%tn-uE29Wg3(WtcNNDQ@y6{y0^yjNL zudZG_d;RCfS8slK`|-~Yum1G{a|NyBQ1tElkq$ifGwC#S9-DLy5sV@o?)7J+*(9QV z&e@)g?s z(7u?JD%)ct<|?`WC)IhXlL^P@pIg6yv;DV3rd+!?`K~m3LM(EEda@!u_a|p9CscOK9)bGnM`2 zscd)M>7^~+&rsX?r{0(|Us3-wcxMCpr(T`aVMtOTuj^U(Bs-|{_X`koY)$z20V zaWA%o^i0OM?Q`Z@9%B|4jum=+jMQ)Xx-8JsnL>esgkI(urmW5}+c$y%l2Rngb%su| z8Ra%3YuM%6H*a2CUZF}RlSlZ9kWCCbFu5v3R^rKQ0vn10K?*0{ToY4m!;0N?4%+UdFu1=#kk$(W9+B+^LHNiWJ2uA9@Qy~*fR z+yy3uKdO;|9vXLdqiZRbW09hctRBjXQG36ItX4%lw;cx1c>ey?j*14yxDMO&x$-$lhCDUmKHYgLQ= zhZ?^g><-@90POaH`Vo1DsL6-GE}uBYH)35>XPPIlF6@EMtV;#Ytoy}nt@n-z_g7|J zVa5W+(Bh8eMP?Ydo-JZ#2Ci@e5d=WLhQVSPi8$~r3bpM8K@gj<<=TM|)94#;c6z3vmZI zPDg)JwSQ8l&cqBoL3BF}JPVBKRuH>sAg8nJQib8hOwg@?xmIt|DYZ@_XaFibx|%lQ zWVR~gp#f3P<;UN}9f%|e^!=QgekY5|rruAJ(N$hGt|Piz7^VL72)4t8{Vji| zCg=WuM*Sw|UY+rACg*#mfY~|C=UDgErq(uR%Xp~C*|N-&j`I!O^BFPEh`D!APcb>~ zPSEcgF{K-t0F92zJkMbkhk*-1+w++1`$Ae_90Fm6juXM%n}I1!PhwC$&xmb5_W9xC zd^IVy-;jQ^=Av@3n$6N$lbS4+1-iB>T*7Ywuy(YcN{@7eK2@tuYl5s9OzTxgsFLie z(E2s4D)_L{PS%RjdGbjpx7=;jUq{ne-%v_vE~_M4$+A)55iDW3R=L(>sBEt{8GT3) zT#xB5)Ph#49Th4(b0|KlR`5-_(ZO;~)^XIDBDPiAHAPu>TxXD}J)N;-l@=84QG_}W zGVtOeDFZndH<-v0|IABNIM@7$`7!IXnY)wV0eyiWRdX9 z&Df zLJKa1%fTMQI|&!L6)J~BgM_4g9IXK8Mi`T=P@W)}yzN}FIc6v`$|Fz4*}7ljx?gR1 zyb{LJfKC+J*sq$YJ5?uTFGppL0V%sC?n2I1sVKUat4EH`Xo9F-70@nSG|XqM^%_&1 zFJ*L3koxQL5Jv64Jf4TXY<|679{{&pXTv5enK?{{~ zOBkf24XbRay(`cKW3|M9AmyBlrz_G>C7Fm&AqC9=GEfubPJtPzHk)tzm9BN7<+)fc z0eYH<*WCkrYE@N=pv?;@4ccuEBLo5qcu}@0yY|c--R9F#o>3}hb)EVO&~Nn-SnTDC zXTQ97uN`br8CK`~60IfcG@fG1t#_|i zuj<#ISI?fmexZDNi3^)9kczX{s9eaU1bGyt>)LsyIj}iTpjRPuW>#x9bzqiGf9YHw zJm}67`OdlTczd9~%g}+i zWBgqV{;g2cc0Bu}P;Wy?anGoEM$Ns0dYZq>_5}UDQPYcs69@NasJwe{cI|Q9nt3n{$0X`x#eoWvE zzb!|f>LA56s|<4D+pMm5p$LckEGYab0@V9FuO`1=M@fMZQQE(rr70yyZCj%##@hOb zC*sJ}CCwG8Dur7U4q3%xK|?0eTh!c;Hf%Q6)cpVe$?DEw5%n!JPnVYw`YfZpPl0X4H~>&||}U#C?*t-rY#1%RofBg9|o zucxYGKMhdU>$e||w^4G_8#sl2G@RWx?a8C2_c*AOd))LM_i&f6kBv>&@A123q#Q7N zepPpg{yQ6Rm*_RH9_21!KP)yKpIF|v@(p%9$3EpS8#^Cn(*@70^rihJwkPQK%}TM1 zV8t+f--`lEI+h&>Cy*Y@OerLEz%kv>Hn?wETv{yfJjY{>A6qPx%noDG!%Acq{P&Y9 z^bwWCzn|2euw)V=?N6|7R4)ohy2s9H72e@Y6OYxagv?Tw1~rcPfiS7g$}Uu%b9 z-Qs8=mLv2pPzSX-3O9Xpu64cLu1R16)h|X;gmW@NqK_?z$g+-nf>HaiJCo6`Kzy5O z#0#o@$p0Z&H&O7!o^etT7s)V%@hbPk)Pn^tjmnD+S6h9971=_G`Uo6LG}0<35BjPJ z5v*@UDaw>L25IJ$8tiv*_mcYZzc}ERRH=zX-1+%Ac^K27xKcA^eW!^s5))m9q;!kx z;o|LZLHjVw+TXccEy;npj#6{CKcrxD$`GFf={~P6-))>+#ID}Xb9lb{JB;%%6lq8^ zD1u=kUlG#T_M_<^Z~pn_?Z-FApu#%9joO#Qi2VT*+U%# zjBiL*4m*LY_&`MNGg+Ob1uzbgo%(Xo?^c>;af#Lh1 z15eZo7>_L(7_Ma)%onER%g`|lw}-4=Qs(vqBVDXPrb!jKBanbWg&^x$D(*%iK;vB- zR!xT}85dHCp@UrYIL*{BmSiJ%jy1p}n2m7(FTGYr3F0oyrIn#*CMH9PrDCDzO8U~1 z(aZc6C8ds>u@KiP$j34Vs;EVOZ(|58b(oIEE23*IELXq?b+IjK_V%fPXbtNz4tt*>?%B|RuCus5i~GHUdg5X4 zzm>T6!w8<56GW!zIWhN{jT6#$99PDUX;@aog>A-PEoU+ghu-(aqxd+(Ud{&=1{?o(g>xbVOR z_F)Hht%=W1@^rV^#AlBYUHv4XcHYD4f@h)j#SiWNt%MqjO)oSUci>_9u4!7H;h2$Y z+l(7hGUkUyY=@FXERJ~KSOGjq7;hKz+;}23dxYAvQB|x;@@=lYg~Y0w=PJx3ZI0UD zOeSNH0P;?TI-4;JcQRh4t67qj`l~S=g6X{EUpUcmC*O75C)I)Jjs5eDJ+UWS zr||0~YN+C7jeE+;`}U|6p0HYR&to7%%or9hzklWH%FI3YxSb~%k2GzsI!in{{x;iv zqdNV6mdfy1aw9$`hz&ni*D3EK|WXCkrDILn}TEISI8o<=d<5)jVHrZK0HY$~{H;~i2 zySXUm&FJk!%Ia20ljTwtb6DZ!bS3T#Usp4RtEovg#%vbNAG2K7<@SNfq)e1WgdfX1 zm1;b8meJli^+&Nxuqx-fv;1J)dUOV#!e&hjSW>NV8XSFtvM3@Mm$)ory#o(pr=A*^ zBkQC&wZV@qkHQuCdd~HnNG{RfW`8hl&p z(y(_d)ZEkL4_ni*g#L@C;~nnS-m3rnpbH)fE4) z*6~ACkOFB^ES85SgDzgqQ+d~sQ9g%f%Net5Z!BHd;kj`T+PiTRcdxWsB@qtb@Y^|o?0ZUOA5#JPeScj5qp2!kANV>e_v)p(|E$(v90%{ps zJ~s{1j{-l82d?)i&jQ$T!2=C(uEGxK`tU+=9f&lA^#Qv98-g_b&kB%b1AQ#RgIzph z?%21PX$a52c{Oy+RIExsgo;oBgFw&&^9SG01q^zo7REF$@XV4DZo4OH_Ekzs__S8t zHiquEsZp#ld7DJlTvr-e{+dcOLb&zRGIY3evsLwZxfqd9VhYOw#B&sfa3u#VM87GAdcXK8LUkJ3PD$Q9ZaxQH1m4Mk;<892TsQQbT$; z4i%<YTs5$W?5a~s5>gxi!{lu4|8Z!19NPs+c>HLEUxHfc!i`2Y9EBp zaBvmKi{u&@XDZZ;9exU!`M6-FLHdrkZtc|Wl?J6@^DJfRVQf35s zDFCaY@RlDz2*W3VwbBG>sOgwCo#N{0 zcDrvJyE|nPUnYUr&-u(F2@Ea}L)47wd@A!}h4NuQaKGH}_6!0~%v%taawWJ`ai#4m zZ_=LCjrzI?BA|GZpzvmHeV0*<&7WUh%Bmr}+90!Q@7Nu8E&`~o=QU-Ot(~N*&HKFc z_TbLjcU$whH3s|NRzRc)S6>$1$g39{AMREMlY8C?y-^#|3vY8RpPMzdAKoKtHS~&) zxF7XDb@(vb6#wymN#AiSc}k(R%))-D-OcO4cU>*tnt$pCO5OSK`LOFiLMxMd3T|tB zf5FGrJ^Ylaz8A$Nt?lH3+7_EE=0BG^L?_GKq}!C|o5{Or#={n5NNQKuP4iK|9ySZY zg}i;hGTSUEpu-d6Tu(7wOy!`LBkz!d2{eKIAzz2$AmfJl8Z=ou?l<$MpD?HwLi%^e?W zklf>M_Bd!guImkvdA-59U9?XH?D#V$jvmRCdfv|UO1tB{(%9a$p;T)7)cQCdzTujP zj_~=};|8x1MGhlXy%bUBN=M1VmFo6YrpQV22^a73QP>);B1DvHpfVJu^E~*op8643l#q zn2wt`AI0N((O_2?;hUEeqht|p$%9PI&D6v?g$Bt92`8gxg1hR0Aft_617gCVb_F`W zvOGpmPuEP)1cIjd2M0MCEFu|9lbx84y9PF^1BkB)&I&3tEih&7urW zLU4v|DaOH5OFs^vksFl9RheX(AmE&&nE1wz9ewgvQ5uK_uAg3k$4fl`n&GRkABSP0 zb~@%p6GDOFv9R>C%dp%8%k{g*SGf5o-~seRU5q}4QP7AhY%FBhSz)J4T>+glO*hdr zcpd!;M2*}702;d*Ijyw(vXqb_?4Vlq+1lPFv5Pk$a*CHhxS6f0U zrLpyktpXQJ=cBQ&Ku~;WieT)YpmZ_^wkcsVJ~n-zEih8PGo4f@suJu-_auHj0t0aUX!$yomL

    `vrMUIAEP{e-9b%Mw9FtjJ;`L;#76KuPJEbBKYSF9 z8bfsvy~UluxdWVQAyY%hbY)V(5)r!fIAcjosdiKtVwgjb_H;nAjLCFNhGON8VN%Pa z#$+UB?-3JRCyOFNQ{jk}@sT4gHOrVx!X!FK@&GbH`GojP3F3S}Nn3{<)0z?pT_GdS z>;oESl%}9G9yL3R&xcGpVy*`7KAx`@+INw&iclsB9cjLVG|QMw!6YJFdYF|9!F0sL z1#mw)1VMtaHJlPaxD}C}WdR*CHB+d$5-~qaOh+gkE!SiBA2*T>(hy7KdrA_-qtD*+ zM)Lin+>|U~1fr(A#0=e<(BT-Y0~u#IWyltaS`vNIHK|21dXv!`%C0d&S1pnlu8|xc z#|0M!rr?SQ43R@B`fg!%4Z4Ss=}A?B+>92J45gbgz#Q!)3N)8OStFHg#ohIw_^cg zPuH`v^t~M2o1-y|*JY{c&`OX~@;K)e76I$1aa7Bqh;#&+*g6@;co-uSe1?b%h^9g= zKJDmnqtZbGDKtP*z!8YPi=U5U?_eiQp4Sjs;gVC)l`KE)aT^L*OMTBUXBcv^*4V^W z%3w|aGcH+hki4E~GU}o;7$5J|5=wpN815H|g(i_>T1d~#PCPr2Iio}D^hHy#6Q9WX zI3!u$lE`_0uoFf{X0Hk9nc2C4osrbxqu{i1$*CF7WPZFjTL{eR3>{h+Xrzpv#V$3> z$lQR;c<%U7YCc4hgL5^Z{l`I^l-x2y1mJ+gI@X5t%9Lon({K zbER4*d>rsSX^ql|6-5D}x5E3HW_%{#^SrBmSzIK9;-J31M=8h5FGdis0(sMu6xV_J zC@mRBH`lK-FcGAMq`ni0q?}K6V2W#v4BZ6i*2Vjx*p*B3xolGP;+VKuXHv=dx>}W4 z$Ins=Vm(Pt5odJt{!(AN49i4V4naD~SM}WH*=X_;N4N}xrIXSVRkzOWH&sFvh9IIG zr11^|*{}Ovh`cqTHu|O9+cp4jgmrx`mK2-u+H^)8f&@kqz(V;}gVDjzd-`QwCi1du zKJ0_p8pld2l9ZF-TFg3EUx8!>F)RRfEH;E=K(EZmL`Ir_4*6AR%z@dNR8mkztJ2xx z!H5~Do@7RjDjm7>#0=Nx#0)l=YtFa^L}|dI54U<6 zW@IKJ^H#fqZC0IM-{{v0tpDl3@fjP|U>UIWHAL?2@IbjzgNNJ<;eJLZ%e1T&VVpIBqZIB$JMj@p^Oy z5z9Rs%3CM6(40hCv^hw^U6`!j?CK+pTXW^kG|d#7j(JEv6+Tny*FgzT3mf-PVO&If#BkZkuu4?(?#>QZPHF430$fI)Sxs!HOlLfuTeYfQ*4vk- z%6{H$%EjNd>(y4j*jKgKvv2k+%FAoCkW@5Iu4!ivn);@9b&?guKx`V;fa)2n31C^h z+jy&`iC(yUTB@SC_|p9L@XKXcM8}AUD=rypw^x4Fx%`ft5)yL<2xcsL8#~94xr@7( zve>gD8m9>G{&G#OBFwK~CLYNu5Ll!eYH6dPYSpl4=h0z2hq_qMgGCa=z} zjY0q-HY_jXl0g$uosMyDoZ?tYVhER-MibN5Fe5Vona`Wr-_NY8X4T$_E_Mja1OS8# zP)ad*vVQqR5SCmrb{(o<$;sGCQtyt51ucR^0bCT!N*o<9ZBi>`FeiZd<{)0^b+J+L zo8l6KrL!psG z5(kY1V9KqYY#H5*NmVYZCu8>uw_UA$7r(bz2SvLr<5dR;`oSB5Ctn}wKV+gXr&mep z6`P8u1oiFM;(#~;lmtQv>oJH$Zesgn9w+d)UX|ObET2o?!#m&G9m|D*dViZBgyECG zT4{nb)b#rF*DEv`jrZ2}#G>#m4yaV#MB-HQsbNCn+9s2D6Nz;cvh9Aamb-2oSmK+U zK#T!kPXGgh3&apL*QeQV$q!)ij(X2JH<}bO2v{Se0}@P4jULxZ8O)o&+^x!Ldlto$ zLs*9lM&OA_3M}PHaI2;u*_8PJ7;mcU2}2H0!2zSbj|IcAyC4%=CS!OLhWiQva5lnF z|IG^`pm>s?@bxrI73z9KrOPrOfZ~}a7ns5tzmOmh6rzYc)(q&IIl9KtdR}jmR(5G$ zZMAuym+OVvRqMspd~VZ`44sjW2;Rre#2R(B*$^(2pinZZ8RyY1hdmuLH8)UGd-ZL~ zVo|Q@gzB&UukE+q=8c@Uy*poTo|}Asi?tW7e`v1Q4UbdlUX&cllnQsOJPUkBDqINe zdlg3CzjPR1d(&6r_$HM*bGTpkVosnehylK5 zGsyo~ARqhk0puQw{`#nnD%IKc_Wk5L#uRnvYRckoZf7=Auvzy~b80c1%6dR5IZ=aE z>B3TPxNr<@;WVbvDLMMuWms;6WnsU(tv6MDV`N<|-htArtTY%AGhR09i^P6O=M&Wb`G|%;`fpJ=pZA zxO~i7WqRd1+zE+%Z%HW-bWlVd<7Mu?26v~Q($3<6!oMz)5sGy-Ffr210wx3zOh&so zXF$IuplPS?K;eHcKqIDZ3xQS)a8t*3B{&oMcObO2vu-4?6@Cn1BNgkM9#hU3!rBzl zFh#TR_je%ZaFBKbK94xt8?90Y9PXHKf-(YpcbZ7IgA7h$aPAv^P6a#+qqt$nFj)H- zKxD0Naua#VmT5{!(>)8$2d*w-mXglTUXCk{h#`cqyp;U9_%!i48pE}@cs1$p>Li;S zpDWcm;R6w}em0|~9)l!|c2vpN=WoGhSJ+MChVi=ApW6^G!@Qh5d@mta-+V#>S-Jg9wvAFbQ>ZvXj0(nTu&$G*`gLaB`fBr&Cf9e)S0o-|QN2>7igi3K$JV zUz-fY6ex}X+{ti8(aXovVKMmf?tX`m+;ahdA1OGF&Pm+YCv!24i!aUmPDZvkE*?+G z#lXuulZY_B{i*TmRzH=9=s19VeKHr5xF}y6_j?#QUiiloaxwJs&Pv2voE94h3tI>R zqUVvmKADTFT=Z@m*;Ts}+5SnrmD@H=bT?Fn|6mam06iJSu~$SnsE2~u#J=H9#2%za zXS8AkmD*A5q$Ju#ua76SS_U==u!oCs4+QppSFi`^aRQe3K5+<0;Cycp9=&$Yz&;q* zgDaoFgOLY=GO2kRsz%3f$Mp#}#J)j&$H%5c2x*ovnT*LPtpJ>3Hiyxyq{((Lu|6kg ztZ^0@?hSf?nWmA}TTsVL%~fiAm(>SB<*JWHwVwom1%vKx2sU>n>uj4b0WeD0{{2`kA!-Oq&i#S7Is`tEh!UkqS%`01}lsbBrL zTly|hMY$}i(r&%j|AooxKKS0M^XbRmH*3r%iix}!XnwRSv)+97yYmv8KmGAfKYaW2 z_DuN```gdYPd~BqB%^;lE9d*q&%J18A0(OXk8MCPJiqYE@dX4To(&bzlf6Ca*_2v# zj^C`b6cmLenETb*NMC=q+E!}0wB|hiS+4>9P<}ak2G#Q~{>=={(OlO5!E;vsrr>nRSS-}u%+*gj zwY9oIVYT-R?Cs#k@;gcE#+6I)9U|?(AE$FSqN>`|OYF z9%SeB?9i%OAwLBC*H1gUdH>Jq{muRwf4lKxwf)(ef46$w=7#dWd|nT?+8@f*v)#OH z{OI28C0hv01m)Nn3sm9h239jG827&e6iMVfBaT`KERxpYf*6jJBg%Ty@?zWMf68jv zsDApeX61IKR5X!gHM9Tz^xdpn8T)1Syisp2Gwt8&*7X~GsqeFw z^7&=<>HEJdUhQk$*}JWJwlm`qSUu0a-z}Hl)p=EC|5{it)UBl-H8$11{l=HK+t$x6 z*Z!YR$3K7CSXI@(ZU&cHS>r2J&6aBOTnm@K*zIp-tF^I_s;mzreZ={`~vjefO6?pa1>S&o(&2eEQ$tKM~L~DC%Ex9{jbyWOxp0 z=dw;^EZ(}1OF<*{c|l~uSvbj4;~y6H%)w( zIEL*sKvAHeNXn~PE9s<_?LFZ6?#~P@Nv4I+7HJAo~Ii&LBXjPby= zq-jgjr^FE~3^*pUrzQi1w|6^*OeE-%5_$UUQ9oEms!TtfN2?4T@uSscEr&txUDqPp z>{3@*>(!QuJX?jZ9rc6mA7I|)!F~34_6QJtCL~myoGs9EHvv~+5|=|MfD)9_Qx}oo z)O79$J*V!u?GH@T`*jh}%JHX6Ai6GJ>EBW3oOg650+Y1{O5(A`4|{Ko^rZl6=AwX$-UMp#(9M(NLv)s4R@r zB!0vT8GpD3VW8W57$*X207wK?Z4{^$)7tb%1;Zgu^J=Wd2*k%<^Ej8~z_>$uVevcF zX(J!P18Bexuu%*c99AV`1Mfvvmlm;rug1_wmg^qkh!qkZfO4#Ef_xquPf!62Fb9qR z`=`vHKn{ix^k6m?>0`!K?on0LV4PQ@DuF`!PC(h|xGOsfMh05Y=9=z9AxjVsy9~eS zIV7KlV3%R7s!}x4q>}LS=TF8%4DWn3oiJcGPO+`ov^l})`-rt+`K8HdR4ID|@W9z) z;719zipJmo9+EuCCYVgMRD+`}!&%jTFV#GVM>+0wty8Y5K26K$3!yD_3#T)ff$fQ3 zun6V{j30I!W|6Y?a5^b1gVS=}R9^F>9N9+P+v*FmF}#opywl_DjlV()crw0)@%M4w z`1`oR`1`P%@#oJQe_cIW7SURe&>GN|gfro8&%d0ZK=?aIw?Z7Nk;WM~M>0i0C4!nB zfF)N*6(hm#>3yv+XKr>A3bh zJI%`Zzi~89AHWEOS563)#iLBJyltrf;S-n-Z*PFRhgDGx$HhZ2&f>v18zuYNM2A|; zrpb9^ThtablEk;{$Onr#0;AmWgahhdMuG1WerP)mnB5lh9N+BFWn=3oUWf%_`XDbvr+80KPXl~O;_DHvxBc7eCO4VyNC@8Ml| z!M)%s-3hC@IP(rPJojJcAlSle&+q{gONXa5lLN{BeP+zfMgyx2;bpPGc*p3h`)q(` z|Ei~WSCiZfiDQSpWDbEhd_<@STsyMh1Mb6rW@OoxaD5i|j%f$d0tHGvJG8iuw)x^o zs#B93yR>40o}qP|-{(dSW*@Fbq5YVS;FYFcYhbZdX~`mq_N0(ye4lF0NAv9=&7M-D zdF^R~p6M?Lj0MZzEI$Qv4D8*6ab@gbQ78!&)H1BG zz`k7l>+18@c|&5m#UMSY)li?=wrO@c{}&&DxmS2w0UhMl_I%f!U&~nQ)~;o6T}rp{ zXK$4{qD!AFWsf*enH)2LM3*L6>fEAdnhadht!@50ebIaPnO98P*R8OG%O#htXZymF za65v~rBVhY@_7V?7A27gLX(7M6nVrlEysiV27)=B4E?|r9SW;CE$G~so*Ojvi{fAA zd96y$jm2lB`F>W#Y8SJ7Mn6FOD2)$ych_g8ar^G>?(*vWtq~P4u(K>n} z+vOUq@!|6Qyt8M6*KUoWvB_&U^-@_o`rmeUZ(U8@TUR@~x4fgdw{~$!Ex$dMH8fAo zeA}ab_u_oJoJG3L=eEZ8F|}D|Nr1Av9Mrp+Q2a)Now78|D(L(fKl@@vch%&lfBq-E zJglN$ub(a^H(#pvZ_BQVHk;FHhq4P{6h7>2g6k%CG{Gr3CH|dhp$Sgx0ioMk;CNwh zhcN{1xg89AXHN@!PW&B$h-X7)_Qcf_*LNkZ-NSkR#Kgt8a9j~M)C+|rsKo+5l8(bT z{3A@tL+M+A$xV+_*K)ZKZfJ)ljVvi7+(PHJ#bQwSB7LcRx8dZy;E+~8&R^!tug>u5c(>oCG0M}F_>gpf0 z6N262>UZ5vvzk4GZ*ajFuP)U!VHF`R2-VQQXk%tA9QIf~=Sc>ms*Ha04Cv9VmzAUV zzQQWj4~V`mKYU`(psFNr>RZ+HwJa{C*Znv!?lO3L&5MPuigFw$bsaj~pl%zer9dg` zk<*PRCye@Fg&;>jaP6%FSQp6CHV*{P038SWfT!1kXAhp=4Lny&+t&@A zw(A9fYct!Am}!xSaV7}izAr86xMm<6Ct%Dbjxb%{;V#@Y*P@b!mKXT}=?WM92Clvq zn0&Z?bMY?&)MAE9G$Zx?(ouqI$#af6(X)mtO7IdgsvI|jl|u!GmDDRpOhBnIG?z?t z6BGP82Bw^EekNBksRQqZEYD?H8ljwp7S^n*g_WA~<|~SdYy^m#wIdpF?Fxe`F4=yJ%tf(=Z09I0$p!L}w0x$Z=F=@iZ?*C-RcMgnoNzLQj1x^?fP)Q| zHL#j&OjB^Ih9)z7t2srl;3A{sS+4iE;I}s#a0YdYz(p8kRhBx^sfCucBXVH8t+8|Q z$~rnJKQScZLm;|wF#&-6kE)>8(&zjDeb@_BWLK#jAdx)X}>?=G%eUSRErei~+Qe^(2P^N_QIs~Ln_v6RUYmOi#|`E9>t{rJ4)l0A5fuGuZt^VY0j&s#6H z(oFtJyk$~qMj<1Puq_y0$7DRPsAqcIH9bKHwQM4MliD;Sl6ssm$FYcS+mV3#NZbzI z`T*8xR)F#Yk^xPJyMZ4;*Ghn+f+_D&!k!HlqVo!%0o3CN^mw;*lY4a z?Z^_AL%Y+&w9C2HM&@W(g3|7i$6|>!E}L}#}#RRP(DkvZ&@&nc&2Lf4#+& zzP-BNOWk{aC3WwazGu6(j5sre83oKVZJ&CPq}1~R7MRo{%r&JI@PPQtb3`ayLU7M9 zT+i$dbw692n_tH3T&%0}D=OE=4HRs=9P1)TryKzAB$lD9q_M$`=z1$8BNsx%%yN~{pDz}^_U*9^Yzxp z*0;XfC&X#X&?T}d27l&B=w6CCmiFH+;;6G{Yy1bDz1%M1XkGNpHtga1d$Nan4FAK6 z?JexlqeqWppvPZoWyc9&l%$2b0~v9HF!UoBLBd%O!RU(6wHP3W2k#^&umiZ!f)nb3 zy%t%L*mN^`^t%ZAU4%X9^t%ZAU4-9x7a>Lh(LLCTY!l4gvsKSlhqBd*3HrL(%JrEa z3fu$8nHBKJcUNo>YRIfJP7 zXRC3k31KkaU3|dAuz)4C<*~OjDcYn2U9cE~P3(Z_v%p7e?UQ z!T%UJCQ=6Y!Udvf6tRx&u0w>MWRjdV9w|((BgZ-nMVA^E@jV{9QAdrmlEc<`Rzq2x zMOQ_*z9(I0>tSVyTsuxBe&DywT%gsT3!VK&N>X&}4ts6eGz z+rfpHp3468RJQ!y>7=bS=@S?IPcOgvv|YS$XV2F7pAL*SUgwP2Cf=A>-z)ybae?vn zVWe%&Y3muOXQV?JX~hJ6-Hha0GNK-*f{QR@9;2QorF0@5`i^D$@Y80N=URRsBf_kR z5+`KTH3_$b9W3-|o29RdA}h<&s#Kf*>i~&7i_1*;SyY+?Ior6^tcG2DzPfsMao39J z++s}(1;9Aov{XT)YLiqeD5R-#x)};1Rv0iydMZab+=3<)_-!TtlVT_V%Bv1P4&gIH z#D!E*AazXfOuFeFv^w;~K#nTr68hImd()_s8kjWx=tkB^Xg)t14^rl*4396E4&{k4 z>u({)Rgsp9lGU=tBEf;rl3D2ULUUykg{vZ7W}C)BH5~2jd2FHse}F0#xB(r49>i{| zVG4DKt;#D=g(X&#>Jt+ZmGDvDj{%*wkfjSk&mSOwQqN_1Se!Bn6kDOtDIT1F;ZRK| zbs<$8d8{__sSFnS&eZd<8KU$Ll}Wad3vN|97czv~{Ca<}i1V!)$I0MEm$}BM zq91jOP2kef7>_~f>K<<^Jdv1aVtNBxK}CrY5%=M(d3cU_{J^^4qCeYizGc|`2(bI{ zZ1u4L*6h@P?*Y5Z3Z&b$xT)OCwb-3e;@iRQ+Mca}-9u7)t0oVDT{>{h?-=X-Vp+v{ z*6msM7;CM6sr+G)$2`u6=lL+Wwi7Uya*w!?O#@4C5^;F8Y-$Hl7%*yv%nEV+)r!oJ z2+FM&Oykh!59{-X_4&hEP4@Z2I?MI>!&Y71=MP)8mzX9&tgy(s7D5UE~u9Oxgua&~b+i6NSa0ALH47I~xrZPc1M+A$ZjceSg zvrm+NwBe%ZRx<^R@hDdZy3Ddo0bnh8KkJ=zoBgS^>vSP?LgQC8&?VV+p>=y&5o;Rn zWaB6u#(yyW&^jY@>iTPW8k-I!69qwWTIYUH5UF4Z%gvl?Iy=~0eFNh*MsVFmUbqU= znJu|c;htmuuW<#RBy$3`PTWCk8!ukT%0_V2)2xXxR4v!X$BuHw#~OuklVn_~J%@N& zFaDX8=x}cMQRThB9U2&MurvuUn*#2|WcAs)BPn7``k=NuPLJ!+-BWzJ_PFRL2+?{zHU(Drt~>srWtbEBRmMC<1sfR z9-+RB%s>j$5!B=`#ME;fVp|d1S>j7d9S`n(2Ph85qvUKXM>*zjSYCYB>xU(vgHhvM zO^T?dKMttxCZ6$5?%O|WDeW?XlDLqBC#`zO-_<8cLd zT-1aJ&mh4)55212DgomKXLwLv; ze6OUZFPe3~hoK&Z4u+w>T7Lb=k0g@;Co-Tc^dyaF6h_3OFw$ngL(k+r*bhHwY?h|Kskh9~@~H2#2BuUcbkSY<6IeomVUPc-4EeHNJIL;=)I zmW>CW9z{nF8){WP7F@{G$>W<2 z)eD=`I{%-&YyENC*7D!?uQ2kZEjIS>DUtyexY;y)phX+xvHRsN3W}m;+;}Y4vS%{+ z>-Uh7J${I?Y>Tj4^m)Ly^hfR zvif{c4eYxXF6-Cd|F^r15>wgYh2EJt!$DF$7jyROS}FJIE^~HJDMz2geQy8$2{K*b zK!RN(WsBMKQNty|GiwQ#2pU*Bg-h@_Y&tw*@(Ho=A1)VB&nxx3QY^3Z)ny&BB4LSC zOj!ZDr>&A$YiVUpElCZ@xlHmDNEE@+<{BqCRjEZhg{_l_85!V}`m95J)}cP@P@i?E z&pPx^$U4+>Ry}8R2F~j1$}fb77D`H!X_;!BP-(L~1My5ICgap{l1W2SmS-a4)=+FE zcDWsa<S={6c+xq0O77&o9*H7ixC)KIOSbZ4O=ibKgJrjf;Asv-el^+^f`R zWD_fNrcFwbP=YCq2&E`fR8h=TE~U;GM$#ILs4@iT70M(!-;0o3Klg9eIe#ii)%nu6 z$JW0SHL^i1Uss}W9eC$s-wdw z(GM0i8pPU3$oK8+N!EilK=TZt3SaD;Z(nP!p`#^c8piY73!i#;ci|QRHqK#}jTAm9 z(w(D`LgzqNKj~5HW!So4|EN8<)9zRGsA-xgn`gO6)5OqRa@ap?7@@|pBtsd}B7rr} zv&;%hsYxss26iKdXHBIF2OhPTgT;JV`q<`Gw2)pdu8Im~(hEoT;N>2XbK%2`ZuDfl zQRmR3cBXE;dqRzP?)3OIfYCR1PBs3`;G?~}EkK;ST}Oqdb|aE#73I?ulT>xIYQP&H zoVvKK;-6TD1G-nhb#gd*sPRcW_GLqgbd}a5d3Y$AmX|F~TI2AtokKNS|Mh?Wv2ny! z$Nt%S?~~%%S(ft)XF8c&q~qyDZYNj8^{~c#nrz^FJ$p3)*2~rKiv`oa*IGY&e>bah zxI-gwRo(ycMw^fNa%YdX-r4%@8856JWkumEAfv10h0d;<#^bWM1BDfXTt=w1>&48qM%exmZd9p`^2KsF&fI8|*22K_-xbTOxSoL+a0w)T zndgg*AyWj8Gu$+S$su7G)9|QgdMD;%yUFt7ct+fK|C+n-fQ`lwO0d9+W5kA;#%baZ zL}jw~RBnZXRJlDond643Y!g-%Ux?&y~TLq%8K?TE2+&D#0|@_ zS+e}gMZ3C^jPIA+;B(oi4RNX~KPhvLC@_r~uptD);+r&)Rx1iDGH`lG@;pzZHo*4f z6vQ%xGoqDC4a4Ces68fYkDp9Y2LEMBWVy!J3PA}K!10g_3z<_XQ^~Xvxnal{j--?B z1!m0TJTqt;NNoE$c{$aSyU#ZJ@4Kx#`=CU$C!Y9~Y`lk?gp<=Hlf8cKFVQ@c448J5 z!PIHaTV}l@k?fCs_ZF=jP*0OK{;||?^lP&DbcbukzSl>;a5Z@)NHL8WNNI>0PFp13 zZSvZiWluQW2`84NXdKZA?5U4WEmq&Lun7l!t)?(u@+FDWxzKN4|I6)~Kh-?o=76 z$Y`R+ohHvkiSa6zmGr29_<(8RBFzjz-BfVLu1imYhiI^){_CE?_AA7ZR(A#5inmgE zf)l1GGe#KFV!YcXoc%fV)Nu@ToS^b-rW$DId?a(4B6jr-A|`k)C36UktfPkE$R+5B z>=+^oDaD&92}+-jl3MifHMyjzgm;D~nr8}S+rc)iH_zT|dZIW;6o)M!8#J+9IFcqh z*Z#)x>IfUNn~B4h zKObqd+R|&v5Q)ulD+O@`LUl)xxM@Z`X&gZsE#3=_q*0YW8)>vVPpn8o)6_7YtHfd< zI#b5}gnG)jch6hZ+VVFaw>iv(9n<-c5V@Py>7ZjeA5tc}phkzTYs#%g zL=a|$H8hb~nkOVPDbIzL0@GBPP%u`*8Mr9Rt0v&++F$$^dpCIf$%6xX$MHZ5t#0h^ z-u<+Oj;=6F)-lb4+(D`==6YJ@cJ4xu7lkS6%o8{D%1^4yXM=1#$g&=!UM#fvSm8fc zk;ihx{&Z(i5K4PWUFiRx?p*>A|+51*G6dfv`=lTLMCE83D0Z|DMt>}?&=Qu>$DH)K}V`hQ*|oM74k6QNVND$1sHRIBN`i=`UN9vQYS zKZ4S!!fhYHpxJiVVbiH=SpafGAp=-o#ZTqD0-ZbbD=NcD7^?tFsq-P zuu_8_&Gd9^R%vaPQ~PNK?4-?Hkw0Gk`1-f^f4uwf>eXvtN)JgtE7@djjUC^3?8x0V zDujuuj|#|Qapz)a*8oblz%tcCa&fg4B&XFbr=ZK4Jf2qgP<3$cY6`$sI3Dj@a!G6c zuvoc-^m56UB9|mD5EFY($}!b>7;LMnT(W;59+FEKW{MqEWlt_?Z{jiKlGf=r$|b-& zt^^a{uV4ov1e10O*bq!=R(1>v@T1#)p4`eIllg3zTwmUt(7=_sq{F`iXG1d=EvPkJ zBpiVdQ5__lPUUI|hXZeLnuOzbG)lsOZ56z|iNg|3D`ABs9M2~|kz`U0_(;hF#3@YQ z6Y>J{7aWg>JW?=GFNl*(MwG|G0#PN&@rlhj!d((9^@7QL!F|DmlU^{1Mh$A9-!EG* zNpi_G)gXQ_YJmI<=OoGUG$-%~V38*7Il$Z+lPW4L5kk>KQVJhfj(77b9Jam$fA}!1 z@P2&CZO2piwA-J25^~`6U81IJTpB&kDzRiRbCN)nmb_IcsnVWL2lu8Kk1XVlv{@xp znoLq>T$$U&az2Ij-{|>btS9f5o;`a#pBM8A;MPI>OvjVKoBPfk7OaDm-x$x})*<4S z<4KhmbUp6pgIVD$En}a=Ae$GnnYX{#`Jzfr>Z~sn)U0pD1KjG;q5By-TrG;u7j6zP z8B@SNbL|*xSJqfKh1qEE)=$H=+%Vi~9!(Q;h({Hgtp@?t8_@X!>q?wWv})il{AY{OrPpwhfk{Ui+I)vbOwyL`9$JjkGSsxMRw{kZyZ>n~B%`~^uO>x-!MgZjaw ztsUz}j$cOYpCEDjFKF0+)S*5@7{|i&cJVY6w+`Z4qe^?B6(VU$GmPjJ-x%Shb)%P8Ve^g|OBRX>s8qywGmD|EUW3DgG( zGpc`yqux&tp(EU2s`@eaA15sdpgPr8I7VI08IL;uTwoPjKj!}9ibe6C2^_ze^-B^& zV$NUUTwLPp6-|1Qqm2&|C1E~bLtQO#5+3iix?1t@%iaz4RwGINoPHkudJ~aqwsmnr zsJUJT8mO~&tJ&Y4%x$hIb$)R}E^h3n3)k3=K5O)636k@PD(Tg9j#5cGlgyBi_lP;b zc|t~5byi8MA;#~qM*?=b?Bom@>EqMb!ftfQzS3)??+f-C=?BwDe^v1Suo)tk%1A9# zO45v}45-jrgL9S>N>V0pN+}{-=Rz}0|lHC+RUB)H5<&_ zwPw7(z1OJPPwwg+JDhqwhhjct56h12VT8SK1LXTz^`_SdS()WtuHFJaSR zjOpEAIo;62JGFo9J5;y0F^g@D{m3tzAOE-p*}tvUrONCpu_A*MR_Xcu>aN$RinnlR z{=Ux{O!$YN-@F@OnGDIo@d>3iB_(J?N;cP0s!J#)e^ah9C;LsZ!dV|A5861RS zQS={auwXJ#QS(=dMJe244JJ=+@L(viK8>OOCpVY~n#9mQ7ZOE{Khj{s73VSM59&vq zp9Ha}`y1->nEiwL;n;-7FnD1aHjQ+t&oPNwKdzFf{$mYxg7G8PFKnpp7_<(Q&W0N2oYiN;nmyDMK_t2Yhu`KHl!?ia=2^Y{-tCy1^g`v#tUrV6%`wpD{LGJKN^wgm! z+W8bprOQ0G^XG$f0&IYDZSc4y>+rg7$_jOHQWP`iFk!2Lu9pJd;l+4r>tQ%=5RcIa zQ!Ohe3KzZTntU}WO8f11&+8aI_sK``ZLiME&uG>0Xz-zFN~@`?Tr1WAjAwI?!225e z3Ja2a`Q8yb-+NS*-ff|GTlfmy7NXq-zI?NP6#eyX1HIco?=}!qzc>3orP=?9;{!&xnKC#*KxH!jHv+I6+rNWB(Bh0q+1RLzvY_>hB*S#h zM4bT^ct;lNXz_1za_BAoy~Y0#E&e<7`(<1Fg~l>ZGp3Eem>ZnXOp)BmT*@R@Hpfac z*gpj;tp&RYMtost~E`kV7v{NL5LrAGls?`FCzS7}N-qV4o@uq=H#MO!+X1n~U3X@Ahu}~w7lYZ=T{$*-0&{n`z#e1RJ(IJALl%bPU)=iTfEE^Tc|uJG;85fP zJ-E{I?ABTHH>Wllye~Z7a51lPN6uUp0q6UW+A9rz&7aqZ$k4*SpG}LQ?|A539>(x6 z|NGg%euAFdUE*8~Hb90)uU9{ml|P1mfXpxU?p2Mod^S%4$L9v$fX<-7ovr*&V$E+v z4gRgonlDFq>&J6j^TXPxlbQZB!6pYuPfL|aVsw_sOmmBgPEu<$!8pk!;~km)7ND

    FICJ_Qs$uj3p%JF%;8#g^e%0xG zbAD@vh8kG6LQP)|p#SK`_lZ#R<=n zoRVCT)Fe!%iWs8dPq)#65SBhv3ceLTw$0j(uV?eZxoTeNY398x|)=z8}cUW>VgWx8kN?vqZex*BHiN1bwSc!SU;Ut2Muj;{q~ zcC05pc}Ja2z4nY94Zgpxzn$Je|ops&L)EzfTe9d|B56EnSn%YcLwTgq3rHbcs5i`!>hZVU-Wvb>!j6*4aYRyTNbv z_Lu52$P`r~jX!~@EB)Xr47TO8T+U|2+yk98uKXB2IyYdK^?kJ}AP^Mu+GF_oY)msp zd+bqs0**7KJp3BmZ#~2Q78v$d-5GZApbY!p(0#Ude|=K-*QZCligaI%bHAj5MY$h+ z1@4=1?w7s$a@soe*oVg9*@q5o+2xyN;13oHDBMD)*eKRW|zNEj*M5j~Y2 z5C7qDP!?KV`$L*(OEXM3%dr(UL8;bACYTY!5-eDnCz;GpZo{W(Lo+R8H+K|Qt_#|O zE7w)i&B9yoh;Az+8tnmg@(gY(!Bq=u+ryrFac(Q*0o_)*>Ec^VXq|NNNzz>xuZEbv z$He)LFf;jtNhE}a9&%PQwJY)&zUPd^pq;{MY*X@*b5;WJyz z^b{IS?_74~N~c{pzAP#||HeEYH zhdA~$4*&un&WE#o&)-dOsq%1fQ#@Zc#ks3IoSB^AG1#Or>;Da~QKRtJx!I)gp-x|%bY2eOJ!qra*+#X3Mr^{ zIjkmi$|_s3ki*&qT@Wptr@@yUso}r-IG)^&V-msqq?2jq*`NHUNkvq?PV0#NCeUWd z8B=bve1GtFjqaxRtAyN`gAj8!K24(di~I5~vfK|RO)8oJOce{x$p!?1Ibv2wv^$C43=g%Lc z_V+&zyh5##4|HEVu~&%WteR0CbE`hPR|=hc@dx+noV|88)+_V}uO0mjSmlvkiHlYL zSzGlrM}5ENuH8&oJuBq1u*xHAKcCqufBxFb&&sO)Ws+AKc_hzmm4AS{p!2(Qq;-7& zjq3^8)(aPJ_a-h}ycaHBbYtHN7q7kV{W?hld)oWeM8$g|Ni1lpJ+sOh2OFu7!Z2=q zDODb1Sz1X|se<;kleObrWA&fcfp@LG#i#MEr7iFkQ1~`(#d_~rJq~%ecdeR|ueBEO zY0q9YmGwTX)1E!qv6}EEBTV+S#%6>GCGA5p!Wh5!?XrvC?)-kc!~Ofb{dP`yz`i6D zA=lIkAz7}8mz+4KY>@|8tb&Hp*^(*AjVLK8L5V8QO5r4XU`E)HA6B_l|JiZQt!l2# zKUU?(Dz@C7E6bUWt~-DmWqQ7~t8R4=iJp+0>n!d2n04ij^&Wj`qrp5Sc)=J~>1DA( zSQuO{XX)AbU$Q}f7Vfgi;s$<q^WafUA`yBNOcHl!Vp$RilOcF)3=rI0R$ zuOx6We4XF$wYPttx8ciErJX9I2*zn)i(KY3s3I6{%hGzMiJ>|OP6Q|_p_QgVGEhOb z42944=zB4SujUd+um1jX@B7zpv#BdS`bAd4!C3lOA85Kcip)>jIP>Yy6|uZM zoOl)QQ+~Jb^TcQ{UQ{LgSK;H8nX5M+lzvszXhj=PGnOcG>xaYMdd$_}9?eLliFgES zRNET&TPxMm7^A+@YC-j2vKGe}45Q%6s3el)OA?IUSiWJMD zGo(?C#^np7X$NWK1=64)&5`~4ydjM-v~VnF5;Uw5fqQl^uzpP2LQ!uD#h78N5T3zR zT=GDuDhdPG#xTLHSC0m1qAxFgX2mgQ-g4~602zuye_m?_rC$!cW$^PNF>p@OQ)|d_ zkN9$j6lmr0yEn*fHApwlCSyQMn_)(PlN#G+%1jA)iLVq6+rwX{ZgDfes%V7D6;V)h zIi?18FSh;Kk*1De`ffpetXsaypqqT+X62jl0=8KZgZj2VzMH&G1t{Y(Z2ua^`u)#8 zzk2`X*TLfE?VH!HlOMDHDnh>>C)b1Vy{eKM@~D*;GI~j`U93u(22>Ted@=dz#bH2-~^%u|_6H=RPqsoG}q;@;J*?xT86@u2kF z;IrNn+L)B6`sNJa^YFYr4n8eh7}|kPLs&h4JB=9|2ULd{6aINHW~{pGiWyChnS}hz zORD>d=niHuk}xCJFD2_!9AuO|p)KtI8KWgUsL!(Z+l`v_ZfBvUvI8_s8|z(MP-Pob zDK4lIiz<(9@#l>yN$DNYh0i538bD+zo%Vn$BfNx5B$JfWqU1)<7(_-0EF!F$x7tvj z3)2x*ZrC?}{%7_oQDLr%dLJ{Ct=ZZ162{h1*9uJz%%E=DasiLt4|4D&d z>n5w}+tb-3DysqivP&LB)%?YCFQ4 z?K`Yq3J_|nNe&~(C(Cge5sqsL{CfNM|9SJ_ZF>Mi8K$N~omFjvL!Oe-@u>BzF_cU8 z`Oc3|0bq_D4aWftqqc1cFU9L4yxLjMZhMpe`P{%Bq$ps6q1JSP&FqC7ZX z8gD#W(oHkZDj+1 zj$*0ta+Ld7g{F!dKtS`+JeyB_kF^-A4|7gY1ZpdV@(hkX>7C?d$+Zh`01HZ(hF^k|Jhw&r_OB-u{F*2H zRiBo+i|9^q25u1@vM6f{MAx~Y|DFy9|5f`2rvYN)3N`@5T2Of^+${Q)A5Oiu9xx7G zn)cylYji2ZOG5jSJp%LIeuzrDaI*%MrweqvgquAf^WOgcecsSf1_8Q;hLQ{JIF*Fu zfD$QFENB%4d2@Y>i% zzbXifuTRFD-NS`z2EU38Zvi@f)Bf--HMnhmP1=_nkDJa{{?B#dWyQ63002Ro-7apf zGJs>C6X3JGi{W$go3+bzCBCxVB}b?W0eVOnb2y9$a$I!?9n9wa?5DlAU(xJMZet@; zKO5d9&*!J;9FDPc$tPMh0yFVq9%JhKYz*@Y$4K;#j^m6Dy_>Jx$=7a{N6TL^fkUQv zWatWajV~B5_f?que(W4Dr_K^EcX*B+2Z)C9mH~5I(uNkFE?}Xf->W!WWiEcSf!{abEe^B^9<&{glDOUh3>s$*0XN7ZSDO$*0)c$sg;{-N}eFc`kHUpJ08;E=d9$%-q4HkHJAB zq_*v}g+KT!V{ij8v^(#@2MoFy$`s=O& zSG_I<39~)`h1N*e#B5lW%D^$%XYvt%aQDm+NmzqR=7MrBDEBE*?l%?VM>#8V6`U*y zkB;r!ieQUCoPag*@ZYR(E(l3W3O{jJ1gf?3g4$9RWPj6q5$og%<3_{Ub@U|z^a(>i zYk=gEk#S|FyoIyYH=^BNBbtkkMUWedCS*f5yIxmj6W{+WHtDkH>mK^-*VtY{lo{IMFP|-3*gk<4JWRw0t%s_VmVyrBqVcYd^n9d8%`$ERPJs%i0zg>494*H zShsGz${_IoeeYHYxbqE09=VV4#}sB5flI>EReyk$-E1(2?jp2>4wG$Ci4==COBT~? zF#}cX9@z*LdmPLlat2IAg5}UTH-+jlS?Dlaks#?1WEn?j;J)XxB{a z9+kZ|R(XktaNFzcVCJimFIU;nyK+NHS|y}ZCeHbzS}-ZI-?|(6c?3`%I|1r|7;jG= zUte4EiR-pJfLfy7SlF&^3yy*T(Eb_WOw1wf&cUF#y!e=t00z#e3!HhBx-H)n2Seag zXcuBII_KJv+?0jLbEAr&%2F5bABq;Ca8ffCVAgf+VJ!-qdn=f*-QdiFOVPDTuHE59 z2eBDIjJ0j<20%*g0cgPPb*n=%BAQ4WRYaj|>Jz_0astDVbkKF>)2+P3C7_t$r1+Q& zXz_5E-H*Xr5vbpK=yhBUeTwt@=^w8%0sD9}qIJ7}$*zZ!9A15s#uDASm1LRu&(k=- z#qcg!*2Y)aB0{ayWJT(*86Ui%i*~rhq?im>?&BEzxA1PZ7bTdLliO(Ko5OEq%JW?Y z(D+r}3!u38Ztx#pO-joHY25d5T1y)D19-QlasNZ3yMq$ZnlyNRyA)RGMrtXkG_<=& zH@eA6q#F-r6ye?2Hj_wgdFyr+vI!&g=D=1>fCAU`KKFJ_bY7IBO&~czyD!?&Cb})+ z@g{JKDw!em^dnD4r5V$TczqS|u1t

    iS~toe3+ssb`qz%rObaQ0=wsA&ouSoW;f- z^EK=5*bix}_S87Z%bBzXikGud|7;BlhN%WBo!y#TlvAXKhu-m!v+a zgXGOTJ-6)&jCH0DNEh`78#k&hyBarakFZ}DiSa>P^?8RFdyo{Vz?gUmmt(^?(zv0G z+WR0{8aFOAGm^l?xN%OAi|Ye3Pn8h=YuhZ=e*>`s=_GPnY<_pB};3V zlSWHbC_#;rR+6G59RujQ8#h*#fYrr63&Y7II!D?YIqo%a4W~KW>NXWEM$6AH=IQqz z;g_n4=^|UsT|SI;EEa=dHb{TIXAtRUul5Zh(YcdE(%>pHLe*!=G=x0_1O91KfoyFU zS*JfX*hXAgv0pBriQ@h!s=URkRIfGphPJPnN6hQztJmmfAJTiwm&FY{v>1#)sxq9s zU(p22CewM$&77?Rm+muR#sS7m(483n?*gd7<;-7gBAnLNkYpNJ|1la>QV>@(r0g13 zz8b4ZSM$iljn!bNI6NF{(I#n+Hj!?u7HIP{(rbLP2BcT}mZyZ3kh;LMS_oF9y#E1F*z?9ud8w^0gbXrx=|iCUln*f9BIi`Vlt?E7&qED-{4C<6qkUhk5!e0k$I;Gjk_RdN zl=~{|<=^9fkKcssZnE5D^bKZJsreMi9jiXXN)9RO@Lw>#_us$I=68ViMpZ?Lv5z(K z?{&2v{Z&dA97Lw1dm**&qmO9(HY$PZNpJ7Ht5O()`EGk*GW%FLz}#Szn44hmF5#=* zAXZ>Y6i=fV(OoeXBy`x73e5kd0v^ESQ9^v;D5bEY1 zs{=eJsi^bKAC^5Gm&OO>*#ZM~Y;M%Z2|@ zDjj`OxkQCy)DxK8ToB`&ae?R(mW)~pIKPk~FGOj4X(Z2K<^xlnz+!l+D6=_rH45v^ z_|qia0FNcyyz{s3e)%vSL_)fs7qjZIZ2z12?sfp@!ELinI?_}*@s%E_$Vd`LUiHh+ zkFP-=tcTLieq9v_|1>Clby1C}MAgIT=w3fMuM7n4^I%L}Wl$YKmkq()_2KUBPH>mt z?ydoXLkRBf?(Xiv-QC@JxIS$8cDJ_n&zY&I>Z!g{-M4R_>3eP?zFl}!hi%W5P+MfV zzM$p?U4B|0_op|e9dw57gDaY1d%MQVtG(B_eo4LCA~>?b^=YoKN*@bJvDrpm-3ok$ z=j&tC%T3Ex#h|N2)M6zA9_i;^63v!Rd4%FP-Moq9NAGc&odqThhE;iBt9sm>I1m1T z-@DkW-2IcK+NI6V8Be94?U`K#l&BSiMPQ<%_Z=}n;j+N``lRCGT*O`KaZ(NHvj%jZ zj~oZO9wGGE0xA7GcY&#eG_ntvkkuU6z@RW>+bg=({Z;%u?ki+c)5bY1+7GrqN1%Ij z+m;}Te&6djw0&mvYM}JkRJDY{yg7QOO4^h=ia^lE)c3$a99)$tR{re0dViWxnlQ{_ z62-v?C|?^-hNZWzUU_t@TiPbqYcN(TLXv)aj;qlc0E?C&$q5JcBTYE=L!N# zwR61bJUm-BJ4TnO_!|?h(9GObyE)yOvb=rXrB}{KlJ&zm8v( z<31O}!@Clh)7`e?sU4L;PUW%$;YV1y&@+|wJI-$D%U8P>$lKDZ6b^Fy=6DOJMWGNK zfC8bLuM>^ZF_lB9Sd z8u2p&S;yzucu*=x{T74g6Cv8LqIiT(QQMqK4-3b(#AO;~n>vQ4C!gQ^liA&8 z;=>4|!F-drCF~tb3MR+rN$bRS=COjK?R1b_1J-S(P2zhvyfMpb4t#WY z&rW$BrMRpIg72YB-aWDgUQkaP2S$MqWZr|BvG%A=;s=`JXWv9mE>;i`WC8UX>LJTH z6N1PolTp<_@6Y)BX5?JO#1|3P==Sb_PVp$B1D0{<9ax$ghSZ*<#+*E~DrDp32_^!I_7<%>;(SM<#ppg-f z2yp_!yTP0mn(L_Hzl9b+#dL&fW$xn-uxJmVEkN7A%1HZjUv4s7ZYnbpp$vOFCFi4= z3*$GPJGMwgfSVIXUl2Ge1#nxRLBOqlnYallBd+cL%ULJrR%IRPdpzf!gd57I-(z)C zn;qHs2WDcAZ9Sdx`vBQCf3(G3`oPW5tvP2>IR>G8gh{v|%v{X-gBKIE4EbQNFrg+p zf$F3jC58g{i9P$Dh`SZLYtQXBld8C^Q-)yAjZecF#;&5euwi(R`_6p|L3h#-@t}4l zxX`kw6_R{Q1xE{I1>T8nhP`~;gV1xMvyG>|?)&5MMNh)>SyoNn5pziU&t7KeOC09$ zJSSTp-=9qn@z4$Jf1#e3s{h6a*39h=db!?g`E>3KHPiow`m7!cs{w{=2BefU1lyYh z6-|q~mtp7_!Lo!d5FYiib|P|$4Axpe7^za4_J8DFSv z>08@|JO3aTu%n~LEs3M=%R`bcy;myImc?%8cPXP)O)gYuUkIhAuU}{n<-|6U;5uF~ z@9#4gv>5?BZN#XPuhVSy4sHLI6mE^_^qphKjsl#2cHGZ^J`T@!9_CXrbC>}FJEm`w zez$~B(;JaBx{pS0zlAl1ET2z9>WwQX?7cDZP!Ap+Fm+4r-mD*<)^h0(hs=1Yxp1ay;dwX203G>;6nOPgK|OnG>{#2;ZDo`nQRj7PQBPm)wM?c!fA_uYHC%eufQJgh{zV z!cWdEgC@uP!#$L_g5jP<7l6oeiGz$9Y=;2b?bPQCv#6X}ivSc-$W;kdVE&FI;2zUf>6sZGG2+{ z_9W1&D3`U-Xpk^a5y9ns?iF|8GcQ>1gP9P`dnSX8{quB?Xx$G2)eC|8nKgGO;%4TB zDs`7?m!zMq&tzEK}xKI-DE}DTQgPS?|NRHKIU|P84o4E1`-W z3L&0fpUJyL-Z7VKM+k-v6xk;_AzCFmp{JiQKf5m!x~+~0Nxwv&Xz+Ysh$deq7J{Bo z?Ov2VF{(Ft-Z7EpFA4V(P{a?p+Z4^vs$qA_HyGqBq21oQkgXmVWT%=RB)R7))q*D< zUnxz@f39P9A^zKLsZL7fLFRpun~VVjlOJJav_BYfk7Jkz5ET10MKQRCu2?<=OpCp8 z9G3A`<;}yz8;R1wh>Lr5>cKyLc2MHQ>_y}$0XH@0VFV|J%PVkDNGj@(dWJ^AT~D}D zH%v__@;*lk3CL_dre&t9?|KeD-)7R4T|fK2;c7hqkYq-!@$~&5a(n8*mFmwJ!DzG| zPAl_tlCJ<$SDv;0b20ohVR0RfIpwvVP)8V& z8?=;Lm^FzeUK-OtL5CphfxK~_KnWiPT^*Q2|4Zegr5CTXD(-#_0yi;-i7BJ3 zOSK#ly_2Lnc?XY{p2s`)3s^0qRdSW?3K8%_C2aSVgQ%;9L4NcLob+QqiZ;WB*@C-x zsfiiodr9SIK0=Br>)+~85IREg`t&!sg;4cVs~a%3hmFbltTXulrFIJzBlpTuhyJ-y znjqMXAz*_Ug7{G$^D_pQoWGd&b9@-%u^JG2E(%e;MRxIux=*qk0`uxC=6>>uykGax z|Mvq1xy$b#ONJ9f*^r!Z9*At0&HG3uH`#-yEOpGgRDO`M|*Qlh=I4y-WuzFjG^1I4A8lj4v zPNWcwWU_Xp?_bGm0_Z4T*0pl(>qP zqbqoz{!H%X;u|YICru!E309$pW}ru2uvMwJeU=*UluA|ogcb=ao@Pm+?A;FxP9iLG zOS?q4^|7%1DW3v)#yQKq;C^Mne4Ae(sKfGmQHXG3p)`@M?~ zQ{B|+V26$O1QqnUS=o|lONrpm3=7y(lMeaa zA6;BeGLDFQW{4{Om=x+K9X``jTT}qc6&FAc66ZhH3fW|lli1xQ1+t5vYY;a9KDNgM zJ`^-!<5M6~q{HTlC%$wdBtE?MReQoHH+;T&ED@ooOD(*|Wr;4PSs%N`nyAO7*>29Y zWr^1{O9KGVrXWTSfa!bo*|k>cH$GeuCDX`>Cynl=0(f|o5Vc$2qXeF%pj8@JueW>S zX3=@k47%MDkwBp-*dOUa$z@mJ&ZHl?I0@dZZ3{z@H=7a zemtiiH6d-aDfSwVk?i(zblI0U5QVz@OzrE2G0juZS>~U|ViiTK9YVPJbT`2Tz60`omr(l`1Q{-%_Q=U#~C>%A^Peqk{ z>M&H7RG=M9s6AA+jsJ1jr|49k?>sF~c=wvC)nJQBYqt=a50YV;qt08@qy7i9dwWq z88Vb}o%&8|{YgjiI?H$w!1AhrIQqm}%M^UU?m~FszB7*4+j*KT!!!g;u)9jJFlJeb8`wW{kIM`jv#wg?96KXODptId6W#i}h7TFmkduc}LHX5&zyt~(OMSAG_ zqSl16gxd~vfrxl;6f$dK7_>xxc%&C=*Y9Z7DB48*xV#JDaDepC(oh%qeuEV2<@El1 zvgwz!9j3xarP4hS*<2r1-DH((T(qj{Olq-HA_Xf^@D%f_;;?u+vYGPC0by~5j}zT! zYU@idR=|fqYVk|QebrqU%h2J0-Sx%cd`@Qaxx!)r0dzQ&`E z797bEac{`%n>9_2yAITLkGCEj$q+lols$vt?~9Z})VtLa23MSMG8t{X%@@Zb>!jg^ zoi)9bKshSNcaEH*MKz1^P=eFaw}ypcBZ><%)b-(aaZ6NBt${Pk&i$1*`X4l~KI+8$ zs_Mr4_gWfs%$Vvyn&sHPKO%<(Wo5v9)ECh5F)i)#rpMMSOX;h7Rkc1UVF`p@lYcyu z`+tqMl^d!V3l9R?(4}P&S^)X^8Sx@w{)0;_9Q3Tp&h%|y2#AQD?p!Pgr%G6S<{{(H z9akNy%X>j140n>Ean3_b_8C>KDxgoav9N|j4MpH1L4l%hoyh&;LlFvitwfusoLU+6 z6=lfQekN_709h=x;AF+w%6sig5%oD3fxz9Z~%NZ6pQ+yQn;v~w_7Tt0_>epNu1Ef|(WLGJ2VYww2Nfkm1$ z=o5Xfaa*W*>eHc5njN`rZIpprjDflO)Z9dixg;tGqNQGp{fdB~=d}@kzvD(!Z4Vij zH9{pEq7h~akw`=cc+%DdXZOV9SVzvDy{ekBW8!xDiS69=*ZoW?K=Jgey9dGO^@Ig= z=j@b?eJ}5sKXcR7?o^FskfG*qdEaUD=3c~=GlQ~v*?IMYSn zb#oJ+7~|UdABx;tQTS+w)r1LF6)Mu5&dY!rU{ z+QR@Y{8g%4en->#{GS?X=_gbMqR6H8?nW=H@tGOP+GvT&^X5+A}~dOEXn2 zT#ve9DKfQ}L!}}vO0f-5Q0l*lJ63fs*GBD6y7z<*^?%Qg+jnk)UQD@k?w%XXxU^Uo z`sGgY6f$Q?8AuDF@-I1fl_kV*5gSGeam~~6RtgZ(JAHjUUiJ=!^gnOr=l$Mq zo(!@-?%!gTnS8wn5iB+eG71_*Gueu~SQ&OIXS6PFntRRQ7qyskiW01~r;d7|J-1=- zbHrm6{?3|mr$-(!;-nlVB42|~ve=)jPBWDSaVatxyuIBPCmFIMNH|9;INf(ELzX?Y z+Sn*2h{yew+~vu6!im7)RY|cwxl&JPd1EL=J0$e?_=#grGBeghpQ! z!S7GVW%`CoK`byxRiS55%!GDrzy;2I>qjBx(;SeUl&U0)RvRy*ZeZ1?r2%Bv3B>$caJdGsni}Ij) zB8l=Sc>#-hxhj;TdULP&ljWV@zIl*DH<3DO^E2uhXzANDl3W>ksBzhH7_X|LH`7tK zjdp0~A?SQ1dD)LxS6D6-$Y@2fG32KwM$!O4?z@v5X!oB{Jl3HaW52Sr>j+ubLA6d- zc)x++fFfU5Fxdvn8tOO!owEBH6HAn^M7g9NQgu#-3`+BqWazlw96gNRtynr;X3-%R zkiq6*1}^!!@ZrUQS&7|4WFz{YU;+}#$-wz;yR9VgI-E$=2DoX8>S zA0^$%i>c@ZDvNa zP?nz+0A~k^yM-Id7i}6wUrMG9$GuoTG*YW0S2#)u|K#CMKbr2QWt{_qNTTl=9 zp8jL`6u#1liGRo%TYIp*#8?f{CgQ3N|L;GV7vG##z>I6b2MmxyyVlf3Ezz!)PrLqJ z8A5LFV-f({64xAtyj0`Xu^CoC#_Z}3n~=1g99ssLGC%HRGM|Ie0Tg+fI6`WbdeYP^ z^T&s_tnX%Td)M(w2+4tG*{8YW2U+gj@k;NENJ&iTK0Z=?G@ z41g>cbz!N&tHADQzj^i!(zYj>`Kj(ZSQM&pTKP*c!dRk4#RBm8NLB^3aCK37r(^Q| z@*^||bG8?)OLb!e?Q~WAUJvG7N4+a*-)G%*k7z#E^vuZGiTs~V){2-U3S8FAV)ert zdDEx$;!caCx-d>hz{E5^_rW*~zsW-=_s)L9CaZm!2E&g9YsXOfhCuj_gazD>`_DJ{ z>t1jO2=hNNGB-+J1WL;71JrXanBe2vtSn88ouPf+t0Xqmp5~{Pz z!4Sp|{vy9h!F)>JF_Jl-M~v^dWOAR7zd}337ADJ2!*9$&AHZ2ZLJ9qZUsZITn;+V< z;GJu@bJxOiY`22QWHpLBCqI!s+VMvP4|6MqK#2kS5!tVa0rO@%OAZM!@xKfc3Y)0c zK|M->$8$;8K4ny}Y>=rUn%owN3l&cR7rkfCpmrB7c3$cpB@$CqH8wIY0J?OgYV#4a$7-$M1$@P~d%K(yy9%<~Y!>u6zgRLhRG zskWVbB9OPl%xv=}?9`SMJT%+=>y+Mhqb=9FbZtB5*H*(cUQ(0O<*v;3i)oxIL3wi` z*4~YS;>n(9UlFY4e7++qYx&k%gWgRW(peiA(6@*E~^Xh^ya^sj4q>On?m$4Q)X;PK%od$i>P#z<&}jG%t!u*p zlm6;}qbMU?Ycg8zeH+(Jr<~j4EfBWh!HW&>YBcw-bk)*}@>*Yqe1QM?FLR$rBXi#Z z`)wQ^bTxmaZ(o(y%X`dCSQ;hd>pOK5$J0UEh++|YGr|SV@FUV$);+KxSG+&MNtS=W z15@*a*Ev~)|9&$4hS-Ad`wfbPluZTm6yMOx-+j8s=9vdc_fWRzUrUHXZF9}NV09FP zXF`2s+m*P;*+K&^UrVT;UA*uz5q1rVH#Nx=>n_Pu5)#08blr-P_|>V; zAqpeb{4a;%$iuw9Ib3>AU`V!KO!aC!?9!)=KEblmcP-LrtHhCj{qA&mPw}lx|agt$+20E47mBu%+90vKopCVo0;bzL_s^d z>$riXZR)?-2Dr$ZehT`|5!U94x(zZh+p$N|f77|j@}31NYC#E$c=H!?yI*tntKYE5 zR!5D4>^4x5$Uu&H$t5|HCng)=$@1ParoiDPWL-8SflnQDk!@sK>bh5C0YL(dJG@XEI7o?FG6`}+xTH0iG6zJc|YCC_Dz&QWReD_C(Pz| z-c=2OrG4G=)~Cglb;i0_{iVU_SjvRzDyxeq_|_USo3wd6!LgZ1Nj+Oqxhij;RDVU8rL3yE2iUUpR@$WwuN*QG;DvkRHdP#-Mm zQE+rEfs-?%wTwYh1r?nHQ9~s^Wl02VXKr^KIUuHiE-_Jm3y0;Xr;S!B^GIf@h1iUd z(Maz~ivNvp9=>E-x{g|ghXzTCGvQ~YUMx9*tZIGuX*o7|*2FJv5+bJLck0~SFV4oT zn(aE)Rv*iXo}~eWR#43-DHrFHNxH;X&OE=9xK_-372^(OMG!4*H-xs--dl7j$vhp&y-6~gj%f4Ew2BWaNR{?@5dvbQq=`j=t>;Y_1Ju>R&M zd)|Oh%|9h;XIkF17GUHsN$cPaNTXG^djF?V2WpY3^{!XQb*@hnwxBTIj1wO2ahl=J zQmpBkRnS+Q(>~%epM%=ILR+gS3FezC^LIEGU0Y*uic;I4yP9Wz+w_ukg^hYlj>2{_ zalm!=9j7nWPuMHkOuqIJe0i#<@tfM1m(rNMWH7qR_IgTIqVe-wL9u44*%CSZ{j1$x zhiJ{?e4jx31Gkv@A=+qtq}|>pH#f+Oa{Scj{O5c};|7S`?kTuxI(A5vugWcXsIfab z=P{VtiQqKE=m)y2qb###o%DAA;c5Tk@9%`S9Y%Cid4+3(|sSif(m&X2d6k)xOW^ygj`gtWJd z5l$sT?hCRW0X~I9K$Nkf&6<;kR!=66{&yK6WsEPK{h*JZj<2)`0V=g{4Je_KXv%-p zQm2Ci$*jH}?rYb=*>R6_T^7GatDOKl`1m>Rjoe>Vm)1*ew+g5|;hFx8HAZ;lj5UsX z$Bf-G`9mXP&2E9|ypa0^D5yASlJS<^5Oj!8c`(`l%26~yg$7R+qm$`XV{Y@(*5(tZ zvHi5%; z3=#KM&f@yidn0$GIXu2N9$`e+Vq?TEc2LVB0XHh})mgG8bUR?^j#gv}Ja-gP?z;04 zn>*prl-I(Yr;&Q^^;xuiOk=Cue2Qe;ls9sud)y&eg!p4_YX*KR^wpNxf5le4@e`yb z;HCA=OA0&xxXtkRUS(t5g}ph(^}jKu<(I>narzY4t=RTCtEWj?9PB$V!E_>8`F)He z&kN}kK1hC$^w1*HPj1nFX%9*S!)k7g)V4tMzuH#u>pqAPhS+f9@}|M6Ou`2a5#5#>_MgRQlKl`nAm)D$h(^k4@CV zjsdEKockHb`X#^m&q?E8zhahH3yatic{IJ?I0hg2=%Be}`LX+8 zx8TdwUukz3Rh?ro`<1h_UVslUQE8Us$=6UVQEC*($D4%>`pwq#msD`kUuI*Q{>3_q3`GZO(OhN152LXb}g{`;mU;U)D)z>~4y(JEr6@}xKY z3|rz8#%zT>T7T%)rgH~he#?!yUFgZ;)b>ZT(PAPyPcSeVt2($rx!t+3mhD#-

    9 zg!xH_nHL#+f8;XcQv_DE5O7TlzT>%9Pw0q58>b)$Xx8Xx=NV$TE07=Lz%W-rz;Hp; zSBG!4>Tk1dWXmTwQP`Npd=t+s#g8|X$lI6Xs0_x^4<8p&H;yLB`*(3P`rL9?nl~@I6!I~Z*?IyzvCUnN_5s~+##O=Ivk0Hx4H1-xtQZ4_mb=I zyt#6vWO8}6o5*oIc>}gf)A16z4#+B!Fan2TtENe;MYFm3x1K3u%K#*k(YqcaBIBDVJMp!lVcoK7izHnPtUksbwg)XC}T&xVk+ZW6V3hP+fG@+8{mN9K9V_1 z1b!c>Tb*NVXoo!LUmtL?Z<8qKh;WT_9{OE~TKS<=Iz_TSAvHvrquYS<&a$=ogXC8L z)lHsaum`*Lfu-${^uienQo`RfmIG-#jk;(m<&2LmkNEP@YW^@k%LXA#{8Su~!9D@A1M>@hS=uUc&{UAYr03PJ904eY{}jB88Pi{^gu%B zOhd0`%wdtf{#YuL*GT+Y9JYr# zMo5Vj&8U^Qo1t}YJ6(P~hi##x;K6NuxCQTuiVHB5dkQX0J>-rC1Dg#u;aGAy41*^b zy<#C)IvHI#nH2Op^j{$&MnM`f>56nNsZ4%d`zM&~jVs6#%and_ zjQ>Wcq~!eufQWIkISY7@Doef}sHr;0Ex~WT! zsHx-f?c(wScowX4dggLLd7AtmfS)36e|K3=-g3Nmi1sSvN*Cq6jM- zO=mCQDqR#rI6yjyy7VAuJw%qNI%k9S+|NFZBBC7?MH7!huOGP4#naY>64YhR;i+cI zl3Giq(_?}~$Lcqe(v`MLCTB@d_)!$uT2jE3hyaJj4-&+6s0Z*aF8OU`$GR7Fk2x6x zjN|&ICt-_qS!*W%WCkbLd@)BY$ZXZf3=7)Hy;qR~b$hh`N@g9c76 z?fim_>0Eap7F(($LNwxr^78&2&Zu8hDwy{gh9`oAydYwUcE>zZ99cmvDsLU!g2fT5 zqe)HoYI)N>XX~XMv2j?`xex3Oajh^EnSw?fv0GdH#n`@j@wd zNggGC-6%_4bDOA7g><5eAO5_FBc8RcJ0b}?luALlG+T7oEOcS2HJ1imc-R{Fpv%{4 z&a%lgsA^EBm|?uff{mq%MpM>^|IdZ>&pCGOHzu@W!6;pG$h=tffmDJQYHaMd(86PF zdmPR~)U0E`g~|hy)~9cVl}bEe>Jv`(gq4`#nT5#Rs;tc=|YrP@LL zUeyqsVtIMEd_->ANL*z2ye=vf{O$bR?8(b?VeIjU3Z^OL9r-vFE2Vgv2`sg@)}|vQ z>U?V89Ypi%%mC&^wwXx1RgpZc49`!W)EG5W6odoMKW1Ofx?mujaqbSDH4gm(a_CO% zM_4+mC1O>S#DU&#SEU?;coFEqdc8adl?p-z*hVY*9-=+tzt!O6t&9b7oZK}YN2VaO(KDdu5 zmkkqGlDR7>C|>*A{a}>*;r=2-60w+UI*|WK))I+WWQ$Au4TEHk_0`7-fxSR93hBG{ z>>Qt}AD}7U&AtElSp7bFe(<8r&GY!^eMW_Nk^R7b3-=_8ugL8`Gku<~?*T2x!%2*R zguc_7MYd8{>I@G0gMau-TfC3u6n@;i`nvTXZ`usyS;dCDfM2`5;Fs=3z26ppqd+Fi zX()MCzU3Km+cSH_F0L45?GtM4BVJn8vN2x&ziz!8U*T{M7ZEWhy+tt8HgaQc3as!W znmNtji@&MdSfZMXkw2d`NG_;S5$(^e^&^ zFp;EP7=XZ-{G4hk=T02s>;->G(Ru_H#d8zIIMdSuYW`Sy@KM(PgL-l;{C2h_bMg9C zRle0HsrnhoAN7_@4gm_X9o=hj^b4`3PMaa5TKqY8Uv&x9$>HTzh3hM)H-6M#E7u;V zTL=CVu5c+YLaxE4gSYd2giiO<1-5+trFO*|tN3V6CAeR1q_(CG(yL@`(v@ z9Cr&ea_5&XymvZ2*$;^il2m!FW589!*U?NqhE~0WXklpvghURqA{G46t~-Q^p8kP* zM=e!2X?!WIZQ|UV7qjR`P((eD9bN|#(hi|GD|>vmbmbJ-8lk8qsMYPcOEG^dshOJE z>U@1qBw9(>E(G zznP@;i0JrX_I}$2>N74a-1pNJ7F|wBl~i9Uv>%k&*k0LGKU$#(jLm;TkIO0XvIAsq z&jxMcCugxGeVGnbd9DwZui7Yg?wj=pXzih#2_{VirDe&JkA5Bm3VuBPh3H0q15co= zDpE5hIL?oBM*;LYX#C>WKQ_$?JISbjM6GBT;}-~_F`x;oe)m*|u?rhF_Xw`B7_bOZu(wYf~8c2D7#{f%`nwrW0gCZBGM-&x2;7blvBz(q7i9THfijlQQw#x z^=*$N2IXJ>Iw!QeaIBzt9r%_|%6FUMH1zl_0l{c4nFG{lq;hc`OL6T8d4bMq#KsjH zw$Dr#Zf6}a5dKDOl-f84XSCIZP8HelS6N2uLYe?xZM^nd))29VyF-d`Qu((Az=0Kv zaB!%Z{TQZ;)}im1;c3hH&ooMb@3hWeW$z^5~?!H+3S3 z1G!alk8AY!f(T-NmZ`3vhnk@dvkEHR{Q)wBFi#JwK_e&c4C?N0lVZ~us-BP39{c_*j-y)R2 zkG{FM)A6v?NcQJd`KM^(Srp$d!f%ROzQPWJ3E8q$%~mU2|2QzFyTX}1Kn@>Q|9YOA zg|cn&(~uNtT^hNvE7LDRsTh7+I${1CjA8IH^#XR)%=QB(nxkoierKX`9d7PW9A1G@ z`)nmX`g}|LMjb$ri|^i2#ni!p?+w-B3Y>Er&eTc1K_AX!tvB0~%s%*SD~{w=me_nO zhJ=2dfZ|W4o2_Yo;=y0fAF~!mMlTEc^8}9$H03cX{PRJ>m3!|ES9A9x33PaIewyQ;_~mT&&pV!a zx`cQhvZ)tP?#pD?9#M!o%pa9%o93{HV@xU|5V6K@t#frKYGIi~M?)SJAHetX>sO#yS~^3^U$kCkzB zhpx6AuJwfC8tnle=UbVTo_G0n4xMp+CApu;3bA|Z${~*HiEaVHuN)n~;{C_3s28nk zN(o>&qmVg-|II5{&As`f!@GkPKZVB}#97(LkqJ+A-2qGMpt0K?Z9$EFv72v<={dS2 zAal?PoXy^7%wydyUUOYiy$q_oGwZ^(CTQs5Ga`s*! z0faw&?O~EFe=M0gdbgu}IM5uPwC5I3KlQlqC2B(^U+v_f)E!-|aZqB<}|$1E5*! zz%QZZ79st^_}jnX{8kP3p65B`@fFY|Qg-^er)zD}r*3q;Kghdat<@Rl{kL3_D227> zP-7IvgCt2=aDsV-ZVP3fL9_^iB9ZB?my5Gols`0F6k(HBBL`Itt^G`v0gc2U+iXAe z?c;L(tTQat$0PVi3VjwMYVl<}H?Aoz`VHkXqe9*`EAd1o+@(a|h(x#Q<=xwefAvGY zrpVc)p=?&LbC|%js3j(=Vk?vVVF|NRqEag8>g`&6#b}@q|xHd`xc8&RT_WckGcaJXNX|FVeSpmu|iHvHgs^3(FM}GVF zda6qYSTg)>L^^*N8N{}Df=Fj7@%r8`^7vcamtmyrrUo^V*HL3OgQxf$ z42JsMUT!PC4q%G_DRObjE^nGia>PHws+%mH{8H;f|CjKG@|R|0UW|(_ZfQPlid>)6 z(D@J->FI=N*Kx0x7uih*^oASmTnpI_VLm)E^oGD(D6HetxVpbHDkyF1$l&hN#mC7Fk#B^K^r`zMK*Q(Pn96Hg$>D2pJoJ5=TVIZV{dc3Kkar$| ze1G>HuvO7yxIzlWh5yKleTi_P-NvNZswG6{YAbdAvT_3_Gwm**wSqN^}S8KGZpg%m6ip)dis2wCwaL=*T2y^#&Lq-8Tg}(ILS=EoTJ%k zZH0eO(jNYL$V7LsX9b$Y%MP~Owi*vo-`1`$pHW1>b4r_!3eh&HtuivtV=&U2Tk0?l ztu|@eNV)zzy)bgaA5=c_;068Zc@Ni!On%)@iw(#z5*Y(EO41@Xjh#>Kh%dsl>Yl&X zweyu-sKO4veanhjWyq4J!WQcEB298IY>Da3MWg`GAhz1(R2oTh#i}LLV!*W?7@GGDwOAD~B zC5t8^_?0B|*$~LaM>DW4lfWVdW1ar`ElVjEw#Bvf0G9i)>328xi&q?-crX7Qt*#AFZhMD5{UMbZ_e}^`R7W;Jt8@2%2 za1D%ansO0BE2FC{M-DT+k|l*a%F8o-_E`}~oVdv%NvsrfW{WVT#Tr#^l6{!x$14;^ zDo*6&uS3pIsW;RHpGq?c0<*~U5Wxu!rZ6Ne_{aHu^A=x^Tfy{<#Uz_>up4)%*^ZSY zU(Ik;?;l3+3jdoqDdc*r{;o7?krvDJmpG#rN8TO8@|5Y~%rdEbg96?uM}{NLtcCKB zyt3)?QE=jgc<6V$S`@Q{LGBmHU>@l;sKZlA5CyuNpeMH+>R^TYGjzI&_?uC!!Bm zf$r^0Yz-fK8)FmC?aPcS-Fn~BCoThB=g$9E+<$|qMcWFH#IdMZ&wREF^`fN zS?FuQoUpvWC{DAKj(mCKBKF#;t|tUy&dU9+U2{k4*1(^3^b4-;N8i`3fJj`fHZzLV z(;Em}h>%=BFe5@RBhPKLJ`75^Li=+{^o{{N zT#TYC_RO0eExt)sX?fFLp#nX%(RMsok(4u#Q|?$-iGg;Ni;lUuv%EpPs$2@>^vi?e zr<##+s0XL0T8FNuURmUOE1_;#HW-o2xal)LCF+bF7y?{?V#By>?-eCXR}<928Z_Vj zh*{6x?yr#|gPZfbX}5QN4+9vVON&Xp0!6kH!x2w?zgh#Q_o7aMuC*ikKW>}O&V`hh zL3hwe!O=&IC!GWWGW|Pbt~ha94@w*@nAuxiI!3F&z16N}%!V9zIwDD?{2YfzvNMB`711hz`KvxC-%&gGmlP%w?SD^uGfC4gm4yPO{wQg%Ol8f#!ib z8^`tC-NP|mw{tr;>}+5|6Da;m@&6S=|Z&bX!>4jM4J$k_zCfqh8)=^_vCppdm zWn)ZdEc1Xx)!h{prYS1nKt<8#0{26*lMV~b+gt6k5Ytn@2iKyS$`h>~Z&?U<#WH1U z!c(01EFEbtgjCO7>8{XtMj6Xj>{>K3okNsT(4`D9&0#Gh;clF!aDlVN zsPOPSEU+2a-c6IKfOFIxerk-2st1+dT^mixh1aB9cqOeyM?^iQl}84p*>Ona1rwB3 z$70Q8Dt0cY>T;rT*BMuLMm>+^6w%hSPIQM`h1+Jz1gErU^pHH38)59K)EF2wv&Emt z9?J~uwK<-F)$>a#mn=On)eXcsR$1sNnTW2ZjxWyoW(qd#7-B!!!D@;cno0!tyO) z#a3u>$HQ0=*Nm9$y3DuzD2m~L9!8GmnV5-W$A%lnEc7CsnVz#vfv6!kM1W|*Qu@tY z#liGayM0=o-S|94j$G;1D7hOcJ0!7jHb?E4T*RmwohU48DkRnkiE-MO&L(7`TB@=$ZB&)(=@VhLv$4fJ?-Tpxz9C)mVEhd!RfkOew-v zFuw@U`0O;C&ratP0$_-E8c9m>>L(|J<=7=7A#duZ!q4zYNCpdn2V1pq?gnX{oL8IJ%$k(g%;9c|nn<3x& zOSBF08Gb8cxC{;3(`?qD;ei^NJ)mK~hW_|)bGG>S+x%ZIiv2NW=Tx?1%=VnF?HE&b zc?ia|My}nPR8=6;qqyc^WFJbZ2DWYOUg{90tZU2z${bK;+pO+^GB-S<4;y7VhU>+# z6B@C@biqR3bYfu!v1b9`gs0Q8^uS^wb{y_Hkq8760oP-bc`kFf6K+MBtMZo5BuiRC zqhdV2yiC{1tq@{TCI8kqP{}6sU{w`?T7t+DhADPcLt?T?q_y*{h-^xZvZPC|lD||H z#Z>~Z!8bOF^&t*QCRhfrB=QI^;dwR1R!JGw?Txha1hH!$d*LeRb+$&NO2tTRHiskW zl7Yn)g~*VECAz0quVh7OxGKh?lK-h^DsPBmWRZ%cp#Yj96j$sz!CHmzYgQobTtY~y z@Tg=;*B^otM9w)?J*Q2{SnveX|EE%pG^2Vmxf~ur)HV85)l8HlRs3pWxOEefPz~iq zW8fnn03W&j?rjI1{Un(Xbhak7enCF6b7UP@u@zr#$BMGcL$IPf^4xu(qN9&I{m{^2 zFn>i%s~1*uf+4iHK6Ai|ca0TSpV5bn6+`Zrp|5k-6QQAd+zvzL3b;F-7kGATMtaC~ z%MC5Vix@*EyeBNUy>LTa+mG6?Vv8J7`G2%Y2MNI&wyJqJ~ z8EL2D))F>$U0(vAqOJdv5|L1q?5fl@d?``KXtiiIagf>^Fr6k4@kmkbiMVMrInsVd zQF1smp)@%1(w26emUh+WV@pb_y;Mt*-IPXMvpiv83TG4e*2 z?y#6~9-#jfX3z9o)8&2?g;Ai}s0A5X@I`Z(8Cvk__dMNjtxy*hZ^1)H@X*#xyc82; zTC!L>7x^{%Miq1_J$SD_JU{yx5JQx4jE|#tRm8UDWi7d93zgyzZybO!fY?}ZwWLPRRXeN)bnvW|~9$4jFE}5qc z{#mhA_3;RPLl~wNfT5(%xZ*vTcK+((;?28%mAy7ZH_K1{ly?1j@%+WxSAU+r`Qw#J zKPycjqO;YzoQtV|C5flx;cga)kp)&FFy^x4H)RND(_V`4gB#trBM%(4~YzV3F_ z244gEt-Vd#UA286BC=-NT)!1WblaW3571THIh7ssTk9nBz?#(MAz0HLna0;bo2F;% z;ivfgK0J6(RsR;6Ooc#;Mjrulyi9UT zp|5_26IB8PdSeA|*iH~MFPB(oG)5Eyhz~t}Ww2g39;sS|N3a3nApPNW2Ro?Rzg#>u6~_o+$D!(^7jL-=7!0HDTt}|M{ zJ4cfccv~UDw>wKlnXCTMwsCwNYrY6RU4Q>>#GRfU*nPE6yM&ed!Nphn>W{zkUjzT@ z^ZszLb7ZZ$qX>TXhKsVx9pR#Go$Bs|X`<6rH%5B@Z0S;W)O1k@>R{PX$Mv1vb)Z~V z?}(%r;Nn0|9uqEZct#&KT=YC1usE_T1Ln$Mp6x~4H?5F6%=dja6k!lMg8P;&EM_~N z9_xYQIl9eEW|(GM`bbu+duU%);0<67(t#``mhtxlzT`KB_E%ZSxn#Gtfk$cnksD=$Fr2;==m3=V^-gjMcqOvt%+;QEOG5ni7IZFD*J@r6MXKU(#n0OK4OD z#8qu7I{*buO5^Ypc@*IxHjk=Ls|Zb!nb{y}6M7(abF%bxyK)y@t9I?B4$@JV_2sWj}#vGAc``3F?I*&Ds>376ik!KGe` zOV(G(yjXw#w9<6#X{f8gZ5;sYizeH)kE|ovwly%XSF)|Mv%1VmvaRj!nh0^kY}?iB zy?$_M$b+cQ9N^MjXWOnmqYoP{>6Y+B=otYwgDCX5>4nS=J=<3=rTiQ>sVeSd)>BO?FweJQ0vp;Y8DBo%b&m6MpHnXyp%eN$~T z8g-(kV|BEsJ)z3wcg<3jv@p%4a|(qcB25X6s2;U3o0c{BlqSh?)xEQ5y7oRRh;fWBql^9fzOEqgYUPEP4sU7sh3o2(S}gc`1j!np!PtfHR7rBj6|H>M^)arU=uaF)XJ9UDaTucU9){k~>%W zPJdyyugR8w8TE8Y>Qf2k6!R%5 z@Qml_ESaX_R?g7s@T&wByc6Uwzc~A_l=On8-dtsHe>WS9&tb&Uh@K!0(?prZmom}6C2%F2h?`O97+$2?zVGnRVUA$}%JP}z>WsrJ@+}TKR^N?W z%tkeIKlWqO4Hz?5ADRkWy@q{fmM5r|wt!_#NcFc+pkg?qsH>FSYAi&z8XyGpM8e9W zWbRILAy=ZU(CRqdlz1$eXmB4(43msu%^kznUXfCapw|NN%Y+=20LyUEl6rdTBGvRr zd!60jVyV>E##D|6V8Ap3U{S9At(_rmDW%@3oZ4oXSuqEgP@27zZmK|*R5^)=V5~h8ORKa~#e7!3dU|8{o6~Ap( z_e>T1rdE8PaXau`BXYUR4bDR^4g$mRY++j#=4Z3evElXSau)cZh&kL1nC>6|K){2j z&HMC$<%Qg!%Ka*aVdHvBONCO$QoC%qK~~BQB(_im;%r^F2@?K-=51YBKEo^I{6t_?fc`pjWnyYrNV{hFmo?^_E@W?SaBO9GE@*XMVPtJ-ZeM0)Y-n$7 zEogOOUob8)G&U|UE^2dcZUF3E-E!NwlDB z`70F&fHupNs3NIMoKy1<`w060d%G8VJGJk%4N|fwnUZCQnwi>@R5`H-@Bmz6F7}3)9{b{$ z20h;s0pT9!e?{IgLe*U-SrJE4%}2{`rRTF_8e&CB5GmvNFc3xz%Lrrchr~yiMFx44 zDkD8Xh4drMmB2V4L{o%dkZ=|HtsEN*eiIi)_H>#~6Z5HeJL^k5jwk)dB)93fdpiq{ zQ4dqrTbtSNep=qH(n%rXiOELsSl*bb(;HJrEep9^*FpT*cBh2;3?cMYb@giS&;vfb zlH)kBx;T=_6d;ejTC^WVBH?iP#~YID)TghDTZDbv7&q2@urf{0Td z7{q1B1QYr(AW;D$J_pnEd>L`(X`=`%Cc~TrFlRsrL2=wiMEL>sLZgu2pdjH%CPifh zKhJe#opUH}R+P27Wj}&Ci*HO`JP+-~Trfp&6lon$=5vLa#6c(+_$Stafk>gG0SyA; zDXAnyo-!I!;w$Mf6@^~tug@kjnVBdDUtKuIX*!AGo4TjTOx*&MDrQ-UE61AArG`|+ zSu2c%h8XOg9TVDP$fsaG*sn2GdEafE7io51TeZ%^n2o?lbTJ=#=$Hh@p4X!y04rn2 z`{4nze%mN4$>HSetWyz07lel$FlJcShtgE^+SrjLx_i=6$HKI9;FsEI1><18Yr1X_<@){G&RmX8S9Rp{t|PVXbi0$Z3$}i1 zI!bnxvGF5Ta9`djKHDJid+KP-l7Ys-13|*4r8~WP_kE}4X`TKo&-zKKWKs%UYx(2k zf$&P0&jfk4w#Iil&N|&`r(de1ZwmG25NQ+HY*LZTb5rE~N2Irk0A-1D_p{9R0+3lm6;q~|L zt}fpWOZwi#1%CoU-@~7(*wj^J{_xXL2LxT^g+BcB?&UZ+q@45Lett+ZQk$0@CGlkT zX_fosKlk5c01wGodrr1qm&*Au+*dfWMZ9kjI^zYf}3p1(5FwsQRy&{p#O z(h~l%<^e})J;Svd@3CIj?%a}Br?<(ZYva`n=X_FR_tP{kO?w4=BL{2(`nZnp?qvAQ z*EN_NaE@1DtB=cu@|Wr({Ix1rL*!_j$#-dX7f)`^V(WTG{kof+f10Mb(eKi%SamIE zTadWD{_E0PYj>YyH~D$4U}(MS)W5E5;9pnXxm=8z66a+D7>fuN)Uc}!T5Z#h86m_N zq!5Y}^9=$c^CSf?6&w+%35V@H_w2??a1I_E!Td!)wZUOve0j72Za4mQ@O}AU-C`e$ zh<)Z^>}?a#2VX?65b#l2!ntt(3k*H(Y_yWObCP75M=CB!Vnk)V2tD-B?&y~N0@5N1!obZ zTV>pvET5JUhC$opV+1h+hDuSuy@&)67>-aZY?)ltcrF`(Yz+*&&T6-{{G#>CihiPFYga*F=qUT&`tHp>i z0xIxHfVRunQW&W?$cB1`qKI5sy@-FiW2{_%u-Gh*o9cE zH1AIDZk9R8(W0KZUiy3|)t!U|-dt3vmSSFEc6MCZ(FM=thNm@wd0yV&nHKE9V;`*&3a-9 zEf?=zcfB6!rjz8pF3Qg<_rH+i8M*)G@Z(hT{@yB3Vwf4O|{H{dueu4 zHmzldXJ%?9I=`Acp35UayLQ*#Y%v|1!RPm3`l$;kMt=JO_Xr0$GE6s%@p_)guUXC^ zqxO7&14VB8XVvIdWWmQqLCiJ8_knsN9tFTo8t6BG5C-I3?bfHM!#LH`EDcRhgKx&5>%3es|-|V?&>EPpJDIDidAP%Wt=LygolUdvm_Mk4lp?8^LGTS^{7XC`X2{((8AX z`E?xj^ZQ&C3EYTKxAKq18Gn>zI)2x5J)2FMF6YxUP5NUQC!1TXG9NU$*{@C}GP(b3 z^vmio+4Sz|a@26CBz_bHm{OmI7_sn6w0K^$_{U>x*f9th z5I3n|T^i*IybV(VTQQG!-dOapP2SlYImaXl}ceI{l@& z#UvZ>Dhe+JI2eWAnfv^O*Ymp>+RB=?Ut3gJ8`F&)O~4H#A%qeQ6lr$LrJIC&9ydN- zgH={+8euahzPTKJp~8bup}+{!Fw&t!HhT@Jk9_P4*i;)4VG(f55R<-mJ{4M9wpOsP zWNkj03D4?j9<+3-OHL}!m@L=7DiD=j!9>dD0*64WskL}hO}<4nCXz9mVJw{ zP#}KupPW5Nz=*AGc@{qYaGYZ zd`Dw^ei)ff6{CqcP(XbKx&x_Zajrh@xa`jlh0j5MK5^wlpic)%ICjQ%2syCZJy5E= zBeFxfyd$zh3R3O;54RvYf;*(;yMsT<_YPK1%1mNpZeGj}us=~%n)hz2u=Hqf$MO1@5wxN%1Rc(tlfMBKwZqdM|1Cmd5m za3~|@DbH7kP-+asC5H#CTU=~WanJKvV?&y6yDc{=ia(jWd=R^Gykp*J@eHyCa{#`X z-gS#KO{`I2+GE{}Y@nJ&$NgF6@sMr=6Y>x;JR!JXp%RMiSif!*b60|CUWN4ncH_JB#x`@(vw6?#A>exPwkX(Tzv21z7|^gXTv>9K$yLrnP0hn4o^uyxW+ zd;~wx+RM{kY3N%t;>=3(vqkk&MUA91@3%K4Js!`Ik+i@O4zUoR6cz3EL~WChJ5o~P z8mto1rV-j@q``0hota5zXvR~ZrHYaA)V`#J%9>UmAy1vv;F@Yt5Ci7ZmFtf}Q#eGxb;&|Xx7PmIX z*@Ba#H(6Rhw6Up>n#PUC3BX!@Nwd3t9Cc??=m^Wz)NQ73)pYSs>u;HW zV?jqUsWIbrhYj289rs(C#NN^Ux30?CzH8G^TM9cB53CFPC#d)A6f}0*eYKr7wfM@} ze1HSJc4q%;on*ZTEmQ(dJ|_Uf&Cd}4n7dT3vbGP9|@-2YWb-EH2tl1r`6WSoAE zlSKAUPES8vpIrWcdn$V*!Y;Ru?A@bRZ{G~N*QamVK^YCsuRmO#U0t6K;Ma@y*H;5a z;J2?vgE9+-f3lAz8(pVqF*-eQgi~NwaXvbk6}Oh|p%tiYPt39Wyu=u}>R}bdYXyb0 zfcf|32eK*F;)k8diJYe)G`Us)skFuK0F8ag6ey}3HODh>I;L`ovDyaMJ^-0y{J zt+-uWxCr@Fa$hanxuc1#!CdbF6W>hap0)rNXJgPomjrZQlsT7--c~h`_TgL!eGPE0 z6+7z=uip=bqnFpqU}c#SwFc)|ILDx~fU}O-;_Pa0ZOpF1nseD46N$DlVbXiR#y7Dw zo6$+0L*ArEmuJ-w7mhZ#8PIhx7l8F}wfF2+!1kS)O(HD4zq900LHaE~0<%*jSX+p7 zR=99X(=N`yzL?{Quj>h?%0rwv)e)sKV&2BGT zS1Fy`+`-T2U79cVl8zpAIk>*4F#hH^of?9pVcJ@DN$I0g`-Om+ikF*0*8;^7^W7{= zK(Pa(V5_`0>}NBX+V6ZAyWRgLR#}=GH8S17XCREU<~6PvRE3#FMa``nsRK-x?>ofO z(OVwk?a7Dp>(z=tn|n&w+q_QI-RLBfll#%vRsMRBCi?5qtN;CvLQa1BpZvG~Dn9=9 zpA*Lst}X||^OdrnRfnsSKSr}FzaQFnmjm;yxnE5^UpjBlwt${GgZ}$0{UCLm*LGE| z+3_PNuRSQ@3^h1Ey?WCWgdG#MCEi*LcEuaKw)D2#i8gzoo&8}4D8+G%D2p);E5TFK z-w(aPMD|>b1|xAr{Nd!)<#oCBaxdK4h#cRf%K%++UDLA;=gfTfA)Ise>TyqfOM+cJ z?=g~Nrdc9cBeeO{Y_bq^nKC9o zck_ojbuR;8$0Z+jhbA$w@bds$tG+qTbPJ+mNE^O?c{x1!cJ!?r&qjkcBjB6Sx9Oc- zaohP$<}ob5V3y6s&dcx}tmNtUFV7#Uw|n5MK6cszsQon6s^$);`oYsyqJVpSxe@mv z7PuFh0XLQ~!4-@DxEI*E|LlpjKyme!vecLZ(yG-s=YN|49mB>Fa4lnK1Fn`XIKs{5 z+wi?m-rGl@p9(Y4Mvp$oB-YEwf|rk&rnc8+iFGqnxVaXVVeWhjjod5Un4=wP=mD*bY__RIJ6)ef^#9Wo-YFPXFl zZIKKNV%jH&DW3L1=i0?0=D>2$NE3>PRWYC`oTd)z`{5 zACGV7X1}w26RGs)cDfC&)};}u_L_6$t@cf4vZ(>;}(#yfRP zQczwtl0^}#oo<*)ZNG+oOWzbk@6Nvnx}TUEsqSs>gAnZISN`klYJ0Uott+EBzP=qs z%3y{FBgh1pf8o`=c=Zo>HR=Bk^(rqSSVfd`qKz;SWZy8R5Jczz1}1@Tm={LT^QgB* zZk7W}W^3Q~w|t$)gXh~md%OMWKyFS?r5AYN|FL&<&28hz_Wk|})jZu>cNJT*zMMB( zc5KI%P-wj{NJlL6MX!$)0Y{OzqygdDv_wI*0gbG`br=1G_e8 z?R%bR67MwcY#edcZ?}E(KJ(76|LgNp{pU@?CI~-lG!8s(zrEiH58DBVAUtezgumZv zLEr=0;NWepV1FpljBs}l{P0gLq2Q)|DHKpx0#Gn%FJCN|C0H;S?K#_ zaR*1I-DwFCwwoa|8~;~l@kZ;8hbQ%By&r?!P9j$2FfjEPoo(~4Uhdyc;*|P;pAPdp zPWhWRzt;Ln$#hX{4_b$T-wqDa#zF8msHrV6+Nq)n)SuQ*o29)^H?>8hu^+U% z`+hSB#2dHMU#2v9|07g0__<3#ZzWCn_kMipSH$K$s-)X(9=Zomn;rc&Uqkk@zz)UjvOKDU}W4{~rdfgVZnpo?G7q<3$2M6tj-}9RX9sE?U z(H4iDO%Wn1jn#bp>-9$VoIexk_9uf^H-nd;Kdmh`%6jLMlrA6Ne$#g;I|HPUcY3#* zN7NF#TED%!yZ!msRmAdmZT&Uh>lNEPb6{^^$2xeGNMb^0eHr1iE`+YZ<%so2vY5!F5= zRqk|xYX}7=&CYz>8?aB{E}3oRzubX5J0^kZ#DdQTl-45Zf42@`?8eoJI1^W(G%PWus=!Gw0P&*%V-b5PMdYO3_EH$XL2*A&P>d>di{%4qxioSe;M~Lz7 z1niac7L>9Fq&l6x49kyCJpXMiYhW zMw`q|fFd`yUnq6F{c=e_4W*jEOp|oT$eO93=&rjyrEBg+lxEy1IY+~T)G-hB;T;7= zlIU+Xwgi|=^+BW4`LN?Xe^qdf9}WE7O7c!G90rGH97ngFX-X(BlIV^r-^ zioU7vYGNe||7a;wqQuKI1&TPAc+^_if}|BnhJoj2n9F$k1@AXV_R%Ju<@9VHq+xVy zA5!qJF{EX-W;f#;CpJfLKkEpT5-Exy#at{|G^eFNUqUitb?qho zYo;w@xGyCd4~)USbZLTda?lx9FwqPZi}s}vOnq>r6As#G%N-v&Ya+1DM&2g-?ZHDDr_@NIBDIpeHVoLBuITE2HO<(M#7(iF=G;xJH{J5sFiU zL;^!8U!(Gy`jO5kCRxGxVgWl#+lglMmNWEq{aVi%qdo*Z989CD& z4KlJyGW5ZNR6(T0&R2pq8E9-RZ9!nc6^@^Q38|YZ4%%HYO*L1POinC|ft9i#Y2sUP zh$~EqPpxukeL0j&PW6;#%U2YdGA!W75Yg1aI)04CZGhG`NwzAY@o*-xC?ejzNb)vb zK66CN+0cG{h~_72RE{-_@6j`4^_!k(CP8kW4|)r4h0^GjNkj5NOIjZi&&XgRa7;CFVHM4*w;95#<#Sn>WZ|8K>pZ%lk+VOPK1m# zulrUKV;U8~2`6VvPe7q;PVv_{r)DScl(L$#B#f~SSj+i|P;Z zywN`m60LYcc`A)nV#bjd^p(+ppW_3~y}qR~t9aSF;OG%v^3BIb=~&U%0aOG`Nt z#NwG#y|Wm6?rLzRgDj%OC@Y3e*`>JEX6$0zEE0Eo&MX8X)|MqbNXkS)j3BHy3;2P? zEsL`NmX&%Au?%7Bk-j$>b7m33BsxVKoudgaR3Nb!=g@Fg_X}m`k~97nKOnX&4MpGd zs~Gmtas>G^>LyyOw;)_9{d0VA&0*krF0hLqIem2n;~U_Z4OcSZ^wX6yP}M}xHcD13 zD^qfqsvEU!*RqW8dKWVp)m45ooIoV8)OXajhL zEM^(P0~AZmT9J_9j0VAKjBs!2un5?WscQ_2^i%qJ+?U%AroP2;1H*GU2U__&3kVsR zFoqUjTj$JWAXpOsNk))%f7dA~Rt`8aeGSwNvXUU4#$PqdSh$umoN1hHz9z=}D!9=q z;)vL_wVW1wd6cM+I0f9GI$~*YButbvnI#?GS+R_B%Ox%JUXmg$l;jvME_Pc7TVHB^ zCULC8@o)yD!#V3bJwEbj8(J?&_acs1y&N#M%XbA=T(>%(xqA`BBQIMY7(&e2kXvUex5L8Pm3=|J zvaFcbiafHu{Z# zZ48tfB|F)D;Q}1*WxL=2Y5@02HJvQMEtI{GWE6NFKbke}CQLNkWI=M6C!C7$! z;Qz4bg0N}S9mX||Kd`vw@JKfhC$wQ(ac(u*-n1jgE7DL~9PS&8u6{4_!W$s5fH*}~8(e+-i-pnv=rB0~&KE#Xr}P262Pk~A*iMgi?^ zLk<_xSaPQyOYC*pp@kgo_W4OiA|1L9v2Qb)*_Y$d-(i5Y^dL^@GXoiF@U_^tP@(u)xl4|r#Uc7a001M+sVrD5%HXM4wkfot~u6vzyRaFD!S76gsq%d;$c5W zI0KqT`kO}GQJUX1%Bgva!|B8898C${0g88@$Wbd$)fPPJL{`x zA(0%vcwWTX(9Uf*!Y$TZ)0f0sxqyJ&nM0tS1z4idSBUA0`Orm+r?kuiOM=k!1!af| zb`sI8B2JQlCBcY5iK&hk4B;PvoY9T-5janPwr!N-J+v89`sYPN%NA0g*<2LHjFf5gzg@#dzIeZ+NA4*yBN?^1CC}uiW(n7MmuYrGmK4s zkO%iJ&Fa_0kdedRyIf|Hcnvcr#1P0iIf&yZ`KA_qD84$~MwZX7V(JnGOGOQPFG)ts zX>-6G@^f*hqi0RrAuAcj!X%ca(o0Go7Y*8V{S{*-#`nU|E+dt!PauqDGMI$VDCYwp z2JK4H00JRt!dp^q#bWvh#G}zAX&E9t6WUB@MpZ@3#^)j?-u7LQK*hA^Ir`gZC%K3k zDNoHBJ`gcTniN!|VHuTE@_e9ir06+2SXd&70DW6M8Be(fO(=>BNgS; z`ZUA6Vw`Ia-g;(m2j%Mgf`^wX5X5NniiAew_*_5nx@;g~cm0hi2-m|09^P$3u^2ak z%lO?2p;BUAs}(KR2Rz0Ctw7$CMzaowlcsMf(!F$9`Iw{!LCW5=B7AjcXmHk$^qNbj zBjY{d$fjmoiuqbSU2FiHx228A*5(y`H^@cX`_Pm)lNxPTtAYraG8oSsj!b}U7T~4J$yl( z?x&eg%r#jcN%{g2Ax3H`av%cJ9fH~NmkH)=%Z85NI2DZb%b{W{M^u}*s59wG^ z8qyNW800!feCizWsdL1q-eAZ?y}=NQI;R$#N^t7H5X?G5FzXD#tTP0&&Jawp_%L$c zIy^16W{xD~*UXWO9GebLOpSSJjh>0Uqr|Ns0V#J~Nl}5Oc`+ry8Clbav~-q~EE1%{ z^9BA`#39XCS`j7&NZw+_FtiwNi8qi*T$$&Lo;o%*O-0OUxb@w?vzl%Lm@yftR1;Dl zqhO$Uf)vumRLO9UXGXv(<-}#KXW-AIXWY?WO60MmShQei2mcDjIgX!HQ%bzDV4(db z-2JlwXNE8~$qUA3)FPaQT)I6C9Ct%Hs8o`qpajY*w9y>+f)s@>&{s0`NcMM$e?)P5 zq+RbQDH?SlrwIE~BrecEiPILG0R%=eMqofZ++M+r6cHqhRt%&f#j;DdRzSK)SK(81 z#p!tZ&Tv8al9CQC7w8-8AcjJ|(ZNI;S`vwp;xf=NR-#);IzCaNY1fnsbiOyq`1&vp zavP}_Jvzh^9tA1I;u<64Xo{gsLVe(Zwt8~bbx?!gMX{2L@r8R;WRWM^_ zj-;Ulv)Aw`tCQ~H1t>k|%>TRR2xo+5sIYqoEF~971$XDF8QtWz{5WdXQXTL z1>sg$MN4YBOqQ~D43FUUKqzIbQHG>*c?IE2C_#%-7g6B7qZvt!S8(f3sn3QKlw)lt zAQkmWPf5dxkwqlWe8r%p3@P!;_%VkN0%`Oryt`!WS<;Sv$@v6R&>`tPn35qMDehJU zw+cd9^8J!>1~JTtYHGzvJjv=^mwpanT*_GTi!6?eoNJ|HT8yZqpel|Go=B%9OTslOc+MDJOOlIG z!L%+V#++9radNN;dHjc;g4NmiVg6jZA4GV?)__8=HfGKDE z9-LpsncZJuMnK;U_l{z>(@ez*>kcjw(MIBb5PN6MBI?DRbUK4}FaW{lC@qpA zV2CYhQ6FYtNF$1z0lGMHLhVMz5d}ok4;mnNIrG+#f6=45&$0CKH}9LTKB?;_Cy;sNZFMLDy zjn}n*J&nD)Esc+&6&^t2pwVeGx{WSCM}*yO^8hP)aL|UX*9g6Ezui38m z|DHdj`oqri1}^|ksNOfz|7(Nr+r5pQ!|N_UWOAc+FO_D&8_Pagr4Yg7Y^_mLU-Re*B z=PuMnFXBR!SvM%Zg%1DQf7<-JG3e5nMKQinmd(I3)n6{qmN3qV)~bdx!;f`pji}8f)J{fM!sWg#kx*5a6wI%h9oMnY*U!G z&ajTg2tSJ#d7-iRu3)YBM5HN9MC}Q^eo@OJ$Z9ghGE%pyiJ&$Elhx59#-EI~ljy^D z<;ty!%rXR(AMrueJoh6wVwxdoRf1>3P?#E){9R?yX2WZGE=*pDG-pYdSqSxS4fQ}? zF|k&u9QR!*Ap%5e{1kSIShW-@`CVP$(D>QQ?s~o2#UP0qc8-7<{+4L7z?$m3?3r*? zPiwQ-Sq|c7w$_CK&Wf5g_!*n?eFJIa+KGQZ5lTY*UFi^|-ptWlsXawP)s`KA-GqPm z5w;ntU{wOMSza$!HvTlhj>+57e>nYE!$0bcX8U99i$#$O>z+Gso7QgeGY+#REFU+8 ztY~Rkj*#oX46C6n4!5c$HqPYCiAHE(lHdZ7{-bEXQZ5{==>A$FgL>I>|BW4LjXRuB zdpNotjUR3=MyLPtUCA(SVV>GCUbvt0exISgUCTs*{|`o@MB;ayh=T8nSysbVFMIPt z?ZF+Z{jO5$M^z=(qm!f`NfX6{~0wrbrD*S*-xOfBU@ms(9(JbX+P*Dtc1=SnLA%z?8XOumw6TNBfu72A?7r9@K0fdu(>Mjo zCHKplT{6YtkeO4H*eS~Bwg4ZfBslyozXr1vMlMqvK{_!ORVkJU%@<6s&hd_3kpFGb zMXnjTEic8Iy2B?imKc1Ev4nJjz0mzt6C-EU9omO_7%Ys01wN4G+1;!$rVvFy{6*8t zv!IdACBrvMbRW_>Q(w6)79}W5`O9hsAQoC!=HS`Oq7Q;-P+Fj{ttk_R@kgnbY~w~Q z@MvA;>xlu~6~ibok|;Pqt21b!i+B@=>UjGm$|<8^V)yU|SEyW)idX1UFieuf4xfT3 zHIBh#jD(M2tYvwBFXciR4r_KtWaV$QQ5JnzMrYP@f$)}RiCPtNtd-PXq3+Pz$A)l( z%O!(ecrC$=K;}0$7oX9dj^0e@HGL2M0Rn`7sW5_{K{UoUK$QiE=jaUtnmmX1K{RQG z1EeVo=L8nO&>C>D$pHKnHSA}xOLUx(BTxw85XqE~@Zw|m1RlbLRY<0=B%L$v@WbBTxlA!mswf3LDa)(xvqimWEV$FJz^2HW$ckZ({i@KL z06D=RxC#k|S&^>QPzqe~P>9;*TfJqtet@8un(7bdS2spR3-1YRKGfV9Sb5TrwF>GE z;!vFlwW!k*b8zt-eHa!DSgXyAy*rK^Z-ay_(EIZr-;X~%TgmfxJHVh`E%&3lpYi6? zYS8$`hL+`X2JgBX`&3xEl3Y&92bS;n6kG-5v+IL0xnJ*if613cv&0YfZf(zgzPZ^R zUf0w3eVmy4v&2#@g)DDwPF&MIKK=RR!}00a$@}B0Yk2kP9R722^641g!PloJ?>Bbj z)Dm3?4h@B-H~R2@_Kx-%O-IsCzHI5F!yO5_jH#wT$b)`~f*oJKzd0rJaS{fxy#*tm z^L*&WTgmYIp9i>s=k#lYKgW;2@j)Zt=)d8Qq7IvJd^ZHl_nb%SS-JWQADGEq_TQQK z>k~~R5Gk7MLBgYR2vUTKa?OGr^YyW3TE}~zeUK(B+?AxKpuZ{43VgSKKu`VSi@zQ= zeI;=dy`;xywsm}Zp;a&?6`HeVzQtc}v_ZbnH*$S(kP`18FfTdDP{Xe7FA67Xj$E}w6o^2$sdQo|_O|Lap3y@ZaM$x3hozz9zF)(u>}KK^v`VH&~H+qGKHdU|i)tJTWHV1aXh(OyHesRRb6jiK*dTd%Mn zpq@$b4%1X%9ioS02hgCuf27nU5$-B?<7(5yef3&3+H2FUjT5!$^(dMrV_x+YS!$?)fK41^Wa z1P~6)1|i)YCLv~tA@dxWvBZE-_#ly{tq6tI8-jn5Z{2Kgsv4{T8nLS7(OQU0tPX&+ z+v5APcQ>bm({3&u80B37eo_qwqHrd)rqQV=iN2k&2P72%mSw~m+!h%kdL-#Ike2Ko z;b%`c13F!5fG%Ob*g!k5A8#34Evuaz=_x$iG%UGCsK^150sNawM%*=ynh;@zz;Djh z*mG4N&9?>%!}S!#x$y9MPOCDmem7I^P@7KcNyqkE?AMQw;0tIX#W7M zBI|^OWX%-CYiy`^!9+`uC^_mL$!0*N)A7@9&wu>z>2hFP6Qfozo<42>`xj%b20j8j z3&yTFs&O|0CjEeuX}PqqIg?U5rUT6pK|U#>25^x7mr;_WH8)kse=YGRUP!^!oiqxi z)iOnngKUi$Xp=-Pi9Emt>C1J4B5nOdQGa(})(Zo6D9}irp$(xSf@R^=pmMr`PdaJ= zBtevNZE(EFdr_A8l^c1LP2)f9`Kj8VT1!3E*7nPmvwYh=O;S*dT5BC(b#vKjeKPWT zYNNnYga&;^+XNmPGz0S*YagjSJUY_*8ReAC3?!0aeCh=M;r!-fE10V(gyjkRfw|ED zuBN_YQ%8GDZZoXZisyokiJ;dMPEYcjZ;(6#9;e=V?4)J?suJyJI8ySGtmwEPblMVs z|FTj(a+rsx(Q4n);smjch^GZ>W{)sSm*2lT|8#jcw*(>N_j5}fdE@M(gX}+>4%+;s z;}IR?oALiC9kiQ{+1@HW3+UR+=Tb%@@k7tGn8RfdC&C6J3BgVP`Z}qX+Tqsq1&8^2_;MtB(EYA#rKLR}aui*I=JbxwN+5g7DbL_`5fiMet5sAkG+n0V2 z31-=z?FCLEZRSD52VkAVQ5-pL6vNUYJt-NiXrcEMcccj6lO|LOH* zp!Sv5=Qn55pPz%GPj_@yE)bLchC9JA@BuiY2BA;cH^-9I9n7K;4*=f~TMvhPTc|Pj zoA75N;W3gj_?ix!;R_1qNR{7|U}6ufV_-~bgM&LzOzgl}jQ{~6EDBy)ysYSU&M-2G`=%k5EjS=B221}C8qFergim^wuQQr&4h8~RlM4vaz2!8fM7 z;IBQagebuDINIAHFUxylxlp(w!AA-dDJ-mm6Kal$H@o1g#*trOE!PP&s5)xC)6#~5 z5YDMnb_J4KjGULn-4wntZw>9XKubFkOFAn@dGwlmLq@U1geWd%_(=EJZ9xc-MDu2X zMm<+~FPh!LG1GWQJlAeah7D&b0gx$h#&Wz5qnXXSx%X~I-yW+*KaBZ*l)kocSWmrb zUe54LYht)&fdBESdDrxe$51P|B$ft@opRKwi>=xw{EwQnP0Mt)pe1hWDM^R7Mph(n&H) z$GBu`0~bS-#3`R;1$!_~?^v~BXd34#hiRM&H*6p<{|y$J_l!80H+ftf_;z`Ikuf9 zA_?O#6`l+Gci-~T7`CWe7aShmgBQf9D?KN0;uQ8~+z(tkj05RdNf0El1H0Xbx$*_a z?r|7<2&7%W@~|y-LOLI2W5?m%gZ;yh{9ZNw`AGgSEdEG}*g;r4c76{Ohj{}Adm$7D92bYLQ2Z5&e+5u{ zhb?|{P#i=RFfMF>+m3I;V&XU=fM_fj^Q9ZPF1IX8*lx@dTPBVb$4Mem7THN)NrPgIv&l5JS)R7aW^463iUCZV( z{yqEn>(LwBeyZj%Q&^`@>x^V(KuDu4fXc&$2M8S)gX$n-R9Xb@s|^7j>`_Szm+Ml4 z51kRuihgIvstO*_wIi@c%~?W#q?6!v=Z3FssJ1f}P z!YnbPQlD;`#^?x8ol~pKX-ar zS-QjL*7lSgYvpB)I%CAF`(}!{_`^P$^+ICp))J{8)g@sPti9?@2u3}LL2QNkE>n~r_Kuejfa(3F*pCfE20;?^&(S=F!vS4o0#iw=qI_|xXugPSIWZ1OY2{=!U!^a$AER90hG94f=2N=^Z@|
    5>5$U5XvhmnO3r%X^%!TpyOB&8@Sq|-V0MD zJt1=a0`_oQAi>j>Na!PD*q%{^1bM3RQ>`xOw#*->M1j&DGMy8$E3Ra{W>r{Ge8;>G zATXvoz^D0y%EEdor6fUU7DBr>5_P(Fa;!qnVLSM#Q))C86O&pnRCa|~&=QJZcUY4J zRg5TePGO0qYA0|X%yk$Q9d%}|@*aj95a!`XO=r@BRD=Su_)S*j1R7J7Ksv&-2_h)t zOleP2)61|sVXtjy5QUp!2D%)W}JYOo! zYw{A;nAWU&msROD#Fe)F!`iT80BxRDm#|aoA~i!px~^lG&7iHkWGDkJo0ZgsUpPu7 zi!Q2zUAB+3dR1dY*IrTNg(qPLAs#Svf{3U12~mw?)L$49mWqiMGG$nT*a@_Iszz>8 z7aaB+X7{~TlW5PN_q<%sRYj-lN+dgWnt~8n(XwdQ?n2%H9BnIC34w|RDtgZEZD#W2Zjv}RxxOAhZn8L2&Wj9l}EF|WDz@E|%< z=IG7_-M}s%PlQLk(Y73XRkC?)8rMDHrHCfFRE5wr-OK@7>6#KM^cD{KE7(jv9QyznAu8J;UV^FW8kI-T^7x*>1ov{4>311Q^5e6UW#+1L5)lgLQ z-W!6jg+elenUILoom88&H9|@@9*eB1vg%lYLE6m@zt-+t58Q03hR2tU;_b#g>Q7r; zmLrEEoQ89#f((uZR$W>?nB(MV|+0#Pk;S<^YQxo)5{z9*U?_j zeA7nSER6w*}8cRw;{Ms_UfC3xARc)gcellE%`$+lK(U7)7R-4=4_hWl@> z8S)8jGF?aU)cvZkojTWEaf3x||4D`-wEiD36c>9Lii^h?3U~D3e~6*j+RZ)-dpk11 z8z_T-yD1O3<)^8i`VnIRpzhd-e82{Q@4bLO@O;D;5%Ys6NMeBX!sUVIg>J+W51@nt zSR(M<7bF@5o^Wl;Nx9E`&$VqCJH8#JPQaOE*+DEqJC>oh1yc_1A&n)IN$PVUf*^JT zvwVjGQsS2DI!Lp`I2&v4O)dv86pyL#n_wtt0xw`FY|D(I@b}!wVcDkR{{aNWYgN%J zLGiT^6yJJPkrznU^_&1S;#r=bs*<}bEooZVd0j$7b)soD>~ryo9DTo`l!tZ!b$dXKEYW*INA?k3k4DpIL> zduHEHdB+q@W8a0uquz!Cnc-Eys&t8|gL!pEio^?3w;u1hX?UoIRM(&MXJ<-ogG7@t z^WcTS35{sFV?;aBd1L}gjn|>>Eg)lD4wRWk)l(oHl#u!q?Zy;IQbeR z1|wdp)`!X)kS*%$a?ld8e-$FdTZ!pMAiirY3wJ2kBo=z%srGI06Xn@lUVX-zqtDmZpKDnkz3DF! z9c4c)31kU$n!%H2AAiM+9sBdbwqT~1nAd0d7^hd~Dro>*K%>8iq%gSXn|{-x2j%-F z+#=n`P7n*p%EStfc3xy+T*3cGBd!n<pJ8Eye*7NLdw}!VCGRbhdm@%k4oqD3P^LjL!QaP;7s@e)DXWxvh- z&EB;&w{a}zzp_>5AyO3q&Fs$Z>?oB7hL&TV$g)i-wyVOFYOW+A5MZz%W#u8iJ>5OC zi^T$<2*JA0hgGsg5!ku*%=Xupuf2VjG8@Tm)$z~5rL#TEQbji95^)xq zz#%pPK4#VaQ42YHo{KRTe@4_o^=K4$GzxqpMuF;q8wI2>JQupMs;We=q6|v;AT1Bl z%K(C?^T4>S4Rdv&RRzmxYgt?2nS{+SA2SMkG-?5ZeTi@&Rc^r>YcKpi%RmNoy0&5~ z99aRHW)9kU;$4hf3EA>fO3Gx9^<&%GC5Q{;S#gh7pq(WgoApC=}zb-1r2+do&Fku#j1Hqs?ry+=Eh}P zKjAJG5*S3R!$ZYsR)cG6HUU1wK~u)T`ON<@X~^@qb&aqcfX*oxxc`Zpzn^vC>zHpv zK6rGGBGUy%Fr${;LFTQ72XY_Ap-}KQ5;xMa^*SP--Xgix+KNYw4u1I|ImttW1{&WB zNi84NLaN1cB)wQ5)l2qk^zJ7#@*3e9zM-;TZZtH5ZOpRM*)`U{8CWt-XIZyMvz}CW z;;@WT+9H@FGHcR>l}lokq{U(qQ-S(BAHy70Nh0wfN+ckmm<{9tK#RUeRa06z5rn(3 z7E&6{DxoHu;(d)-A8iq#_V<2vfhLD}a_7gBFu)|Knh3$owc0MJk@szsj-N&Q!#u`z zw1$SEh{p}Th@s})Xa{Emx@g5d*$uXiZQ=hrt~gmVt`Kfc(8n7mwz4Ah*8%Gz#gs5Y zXL>y`D}a7?lgdCXG(lYrzl3*d_no&CNs;NPN8*#diHRyNBwv2&QpXG&ni00`hi5#V z>Xm$T(f+A{WIecR5F2JLSn?!@+P#hKyuH#ketVp~rnCY)v3TE-_>gD39dfK>bw2AZ zLF|4#W3LPHk9i%0X6ZAfyMdJ5nS0|Q$hr6MSQtjQ;nYCBBcY4=@-+;hLX~D`h)s1#ccLP@_6C>1)%(c zbMGGjv>7VEItrP}NFL%U$#vzuOA;hbjVE!2P_Yk zdG2Z%I10T`3>DLzJ=_n<@7%_R0_E?pvC%wkDnZgo-Epy0~p@F6qo-cWvL z$qnQT+){R9A2`2W3}Z!p82KbOc|tYi)Oxs8iQ_*xn~VyF!`VSqpDt$(4Y&ZEdAx6$`pl z2URH$T!j+di-0@0!$g=u70y_A{X40=sHK&;uMP;Ct_(mCQR)(YP_RlhyzJlws99NS z6O<$lNFjEX(Yyy@xN94~K4SRXRSM$t55pTmeUj@?@Nsc4-oOHdj|tC@c;j2Z8(U=Y z!QqWu=0;;BT5fY;xG73!vh<|gFZg__gGqhH~?|xs~o?zbjW^c-~S29?Rydx z|5RZOS^^|6)gL}va`oBwCz)c5A-;%6q3o#Y@uxidPySyp27JWCDO`C(8I$Jfd}cl* zM5x!q4yTN7@e~iav9}np3Qb(3a9e17i7uRo$$G++J<;QLV?EAJPQQCPT)v2|(UG?v ze7S0%a{+cE8)q*tBNv(@uTb*iqE9y^BR3d_j~H$hQ|*Vp#7Dc_ZmMKC+aiTjaAGBL z8;1*%)BEE-L79w;IcXBhSQ`}FjkC>}?oDz|@x7BpivAp?n6}4g*D--%O#O0WZP8_p z&M?ph+trFg+87HuiIb1Mmy3$)c0SwHY3pIeUQ-W86k0u4>CQKb{B=0T5!~nV#RwV8 zdiyi{th-B_ZftON;@yOC0t=tDQMqy9w%Y`a-iq}Jm!QYZrkFosZ za@5PnuZgbV!TkCcaNpmWt~{4$pmX~+Vk7C;+ zQv>YF2@>Sl&M_aR8bd8W4Vc*YdOuC-sh(9c_;vY?2PEX2h*MMB`?dmD1ug1ZM-i5!U&j!#R&Vl z)TUG_?98_RxY_8=ZT$LXqmLVY;sg#c{N&@B?{D{kKl!*6huVFLlGp0d?(=B(`3CGh zTV(OU*?lC-VW+&}vWAa`rN#V>2;S+%M)?_SEM6Y(f3}LIP=Ira_JG%uk`yTmNPb zU7p6IL-+|G_(tzd8`O#Bk;NP#0Vc{~HZ*b%MddRRoweE=74-x4@%M4b6wG-EYl0?) ztwx_S(tX!+&ieyTX{Rf@R%cm2r!m=1$ghoGC#q{&*K5%Kn>IAIi?rR`6j=1cU`?b0Vt_@dj_ zNNk-dzhH4zBpslj)~>w6I9pZlFn$%BohSi%*~m1xl*&5^Z9Psh_ap$=1B*=;SkS=I zO!Wf5;S|I7JA%X26q~isUJ#k(H2~A5k6BZm`Sw%V^aMQ{RP1QF+yQj@M^eC5wScY| z0U<#mr;pjj*wL!{aVnfhrr0KX=lwMfsz0CJjx~vUjDp=)-D1@JU}$It=>gC$5Gefe zr{BIbcH`fi%l}^3t@tYC3^!l&`#IzdfGAm*+)C!06}IBG^ngmV)|GLR7gBk12s$j_ z?OgK8T3-4Z`UzzTdKTjx)FUq?phPdZJ7f;EXFgbHNf{YJ4XT$D%$IfPi{L6I0%&yt zbhA(I!OC2FUgs9$+H{?J0iA%JVV&^G3U7dW0M1kL}>AvVVh+ahEp4kWDp<nA zf_|;8VdAuj1sdD*+vcXB0^5!%vyFO{*~YDNvFH2j8cALsA`I#ZceNjy8!CuI1=5$7 z!--QgaVpY98Io<5BisY2Akk`2?_;UHnfH-A3_;74U(Ix9e8KKvr%gg8Awsq-L`bT8 zbns)@Jw1tKvsOz;mB28~H6r0MIf;Vk7e2-OR3#C(X6${K8*su$u9_ z9M&y7BOpA$kpm%1Gi}-(!UY7lf@(ZMy%tBUa>1LHJSxfsrE16J&#oqJ)UMo<6{*y3 z$FJVJ{q5}Z&5Ngiq$5@$a2mXCR{g}E>3i^x zbF@6Zjn@c%2DdT(BH4nTJf-TPPbo4XOlB?_(E4*igBQgT;G!TYKm+c)X=3Q=ACn-c7EX zp|GHuzwn9SlcZSptE#R4=SR`7(7@zY;th1bCzTLM;m(l-aj7LA5{@V}t zw;sXU^3$zHdU~bN2s6-A;niiQel)+;(=DHN2BM7*=Jwr(Ex+$fQN>Qx_6ud7+(|tr z$Ktb^qCnc>dnUfydH?-As| zDjS#&+}5Slf>{qEstT_dpuox%!RIPh;sDw{6)IB*k>@%{Z%U_a#fv=mMFBr@?NzOU zuJQxQ5$K}EKy~M2DWC_F=O&2K7t(VRf^tmeQtI-69-Jzu@LHsPHjmJqLa_0CI?FFsf`nplXB+nmW!Wjqe}*}9XB)RYGv5Rb z>EG@*rf=K48i#&ZU`_cc`BY^!X6(?ono`vA(YpF*UHyvI)h#0U;H;}5aKlw#pk`}h zIdei-1M4Ym&SWK66-+Rd@>OX#>`}oh9ddXj!=+kosCS=4+ps0+9g!Smvrla1r&BbD zS&R<9^}U4sea)=H21l{M1`v^6wC1xG*|vP)=d%|l-@QI2c($Hx-(wCScuB1#Q0nGn zwY}80XiEe%7Wo@D__wECzeCiyjk{ruhoB?dr?uLfI^rLkHsXNYzsIg->y#jaExy*S zwT#4dOg)m!Y!ZrW&{8B0xjx&(x{2nprMYOU1+I1DVA8k!c%gN1rcLb(94L;6?P((# ztSj=**_>87nWR!|OG6usK`UMP1~hGutdZe4rg(U=8DN9-WvZ{aXwONs_+5ZlUuU40 zP^C($3^=1uF?$KO+UPyf@wFC(qeM8_WT2c)X4mui^yi`$3%*H_5gAwGR9o4fx2DQ} zZJ(x9h=#OQIzZ|$CozukXzkReJid-ZBg({0Du&rMu)h0f(Oaxl10+*SOVZyh{HxQ~ zZ`y_Vc?8$;5&Q*nqXGOpDsxU9?GU-)wbDfM*3OCor@NCunvKVvw?@Ck9ObA#QaUAx zbraj5@-w#++)Fwm_d6kRwCQZ6<%DHhvo~Gq<>ey>$wTHK*;JMG!na(P#{1gYQi_7< z-1tgif_Lx|HclIn4l?;nxG)pI7sRrP0J<~wQ{K4RwXn~#|JGh*h4UdqrHd7<*6 za6$20+rk%UZZ*=m3T{{onyppMYbRWxJyXt_qAV5cmjn?lOaC#<-2E`w9f7n79Y|5# z3TKdh;_SyNs*`7@uTMt5?w5wL*%=mFyQ0Dg1H6M-1~iD|Qy-3H(yVH6;fQ-UZ$QS^ z4f%W)$DFMb*zE&=2XuYr1G$&s3lZL=ie;4bGQzrfS=4J#@x(9=$~WobfJMiHAD0&? z^OMH9;@N9cTo$vtA%0x1gHi5Jo4edPw&#n;VnUOMz&EnI&sG}=0ClVI4E8tTwyttK z2DmI>I5GSQiP6oJ$PMQ2vYYD&CoDcP!zG3HY0n>RD3xXlYEAI*4|s*AaGA-~iiAg z&+4Pkz<0*w+B4-no<^_Kdj4Gh$pPRNt*zjGw}=xyZ$tXFuu>8NLj0C63MIWTtPk z;|slbuTeBkW5m*W;9I|eD*O8lTv2Tc-+K_W-)SY=C>4C(0fL>*uj6{3f*@u8fwUL% zTN>YJ1oyx)dxAInbyQo4(*yK<3WX#Fk~V}5ru{SRXJ$8wJ!VtPIe`gK>S<)ga@@4YaAE}(-L*bLSb{^ z0NmO`0tK7{{acl#D+A0$l}uJ#*&sX%9R989+UH!!oo@X50r&@9K`>6>FbJ;lPeI@? zZ@^%ORvpM|B_9#^BLe@5#RfJ-@WCPQ5a6YLIxzGx&o+^hc*@QfI zrGy(>2+vu?c`aFOz1z9fzC|k=Pg5O6y0Nr?$ zw_^N^LS0G;>0CoAT-Cvw#G;otAOD}d zD{F4!#@6rmS9DDtVpoYY(B0_8PvcRXxvH_V*q%wMMpG_y1E6_Lu{CT;w)}8^`#lTL z3l}YB97l6iNhK1+#(IE0>-SLu8~Bf)&?3t@^Qd7ga~h2TejJtN^k~X(-d-?ohV-GO z-A;rp&{ZTR_r_2t4x-TLSO_qiS{sfSA_PT)rA+fxeQ}0PlbRXT@P?ZBVC}X99eJBI zpd(NX)3irb2%+*F1cw_)7Dc{UU-S#7_HO}Ij9Jz^*H|0%fUpA~i+0hhThCZe)gOe3 zip=o5FGt?F(uJCX?6DmC&6}?|qKK*W>&XVnLbSd*N5F=~1=HAJmkiB_Sf8B;!Kf#% zPyYJs#a}Tyes$&Z*@Nt$^`k%Fem4%+4||7YfL#X5x!obiu#jZ&FHk&&!y$S&B#?6p zJ!7vEdYJ|l5V$e^0F1yqzisy)J=){`^i@|RvgBLXl-eW4ZRA8@tbbxC6&8>s;pgJB zRQNMr`an8f4fuu8MQ}M^tuGMz1KOKL-!+tS)4&%DpNf@rE9-$eSPUrm3d;sZ?b_1| zQ>A@EgY_fG!|4+JI$a%v4-kV^Mr9CmQu&n0YL1{WF8A>_Oh^a8 zHJX+m{n`PvW}-vm?5CD|Q0Xy+I_UrzJ@PHSqqx$}3j<>kX&NP8>DNydo4jc0EzzG+CfH269FO&fCJd`(K-%7C ziSL*o*8P#?2M1yI z%?AhJmvRtpi{QO;5N3I)k`k7#EQJ!O6gJLkxbESGk2AQE^IBP#RtA4cR3-|dy+Lf1Ycn!1#i)FOXD60zjRM}&NakF_9H0tbI)CZ zGeg|d!Cdyuf>M0Yhtd%ijQBJnghhQx5T^kO$O9eVM|oBtWGeFXuuU@R<-;7b#1G^$ z`eKYdZ+3B&3=ASP#&#?(S*Hw9(=FrE{oBDwC}RO+XIb}^K)y2Al?y7@KsXXm(9tmB z2{EKeK#!qG`Hl(m2dDT;z^Pd8nqE(J(v287Gziv%+--WzWF7&Y#KYjO-}M-$qbIT5 zt2PMcZfQJmfq;is1ic6!kp&XkdgL49^U@5NO8B$KOaR3O%qFP}<4tXPtC`woG#0yB zHLK1UFi5i5ajyMwZU@I~!o#aB*6gku_vrr`_OclrC^FA*4l6sbk-ZP1LQItP)6-=H zR{MHG2c_TZl&4bqLo@7|60Aht{NV4)K!l7Gjhh zO0c`?QpNglMA0MSq(QVDp6p;@2MbCL8BAcjpsXwuRXo&xx!UbNXwmO=={**kcU5=a zjQGDg@~=4h7`=S<>)Y3FUOj*I@-_VSXz$5<9B$g~f|`z=^%oOeb8wS&97^F_qaT`) ziSdY@E~~kjuUH~9S2tZOM<4m6JHko$k}l9F$VJ?t6OMGR&#C!9K>qvU3?SIxIyOk@L{WeUx2K(`+D)^8I^A5tpDohr@tM){zi)E`1LDN zv<*f_Sq(te)4#uX!89EnOcjed=EP#7D<&lI7>QJd9wPMply^*V8tuav9`!aH$U8*$ z<@zMeVR(*+qQ6Bmknt|?;Nd<5LdiZ-#_KjnD;YZ+(mZ=gBbw|O(T=2^!Cv5`-}`kK zYy^e_vADw$7GxKAr>SftTPS=M~{1K&{3|_1=&_aBRzQX_|31FpCjL%O93;* zG`v2iCwlhN38x6rDh#l@!S3)@@wF2U2JT=W7<}epDZimztK_Z26b=lC`~Ab+Y0lZ! zTQE)3t{w0@N{MRhM&jep+n3!*wo8UbUwI6a(p4yr^8@*$FPWH_Nu>v~ zY52hU9ICAgg--1NLgl85b?=;If0HQXLDni=oZPctOsOwBkY;3@^X97)9Bc< zXfb~Lh={uvAM!m`wi6*Fmfxhig3tV(Z;SX!qgarCZ^;i2Z;t(#C7+j+a1^`%xNtbv zrfwEnC`=n@w!f1r0B-gF09U~M%2C)-An#=4!sCUha%Y`PV^P*gt&yWuNF${dpaN%= zEM;~8*lAvCQP&k1=do6KZp*63<17d5u)<6NtI|ShWe>=+C~Xz%LPNuuOft}DlhR}+ zH%eq_O2&ICYf~Qpr>ZL_Vi>kgt6b(;ZtFUa<1$I(6jsftN{CXHVlVH~?OXx(x`v4- zaEL2FPDOV29EDgsjnk=2e~TQ2?7CDv8*>yeqnE%0JO>M2RChA_ml4RI_O}(c zBC+DXZ5vR^J(MEjAVkleKl?7K=jUh@v=>y4;)!fJOWv!K_{0KVHAZrgIhf%xP zN}qWM3eX7)341yVTh-RiATwq@Uvk(VOWd)~8`*GeMXh#redR;qjx7R>uLG}* zZ?YN{=~D!>SRsr{^bd~Zdn4pET50%VihjP(&~lc7IGH< z_>A+(yU}i(5$Ga_y>}Pv9NWtN53e{mGR`_mW}aB@JQ%J6G97W<7a3)GTz%z0tqTm# zD@_)zh7aN0+I{CO;tZNqi^{9)`@ERHw`C62$JuWqDmDKNoM1 z5lcrBy`I=QC*ZSbO`D1=HbHasf1T5;M_e{ty3GzT4IZAILZxT^Yo|*uusA|lh00>T@M1{a0Cd;MHtTobPsmil7HYu3yI?pxebB92o zCK}Z45>!N`OOci)&8sYPvdC(ugf4O^lQaR<@$-97+7+?0uF@_BJ=E5*tA&-O$el!? zPfHOyvA>7gS@3(e@xEB_*SPO)Wx<1>eU1g6B-2zK3`3G<<%0$PV8MS)3w~P!@0|so zT6Cs@>8=!9#c5H-Qku9d3j>SmVkr_Si#kn2kvOZIlBPt4_$tK=fIPmv1;3X(17QGn z5NO=RiXYQj^mv905xEWhsi|Jp!evTm{XVorMd$4f2*fSm!@J;i4na5npORPX-5v}K zUUW2{-8Z=UpWH5|%S+fS>}U_ULe1n*b@LgcU;fcNLF$x3X?~6r`#oFE(bMt|3;6C#WY`l+GRns0!of0&t(mY)?UOyx8=*vvqN!G~hz2Q%X2IjyD+G)1zEZ%KN>($Y#=WkA4 zJ*NS7LnEcvN3r&do|7}VK$eT@#tl)Z^Nbwba8aG>HD(eri6SPs`BJ^_={rAPSXk^w z$KU__cp9C!!3;qwwgF}f*YaJnfI&Yy{u`475Ud~0yszIIl{yZ~_Wn1ey1hrN?|X_g zXbB8}g}(Y?h10LTKaNTv1ez6WAgB&>9)F6Xf69Ns81Rvbr*LM`xR|$Rr_1Wf8-jWy zb~t5xdHbZtt-ZyxRA^%6b84aWH3n?h6dMRr^hi(NPxUl9KKbtP=JK&ojbXcShGpMC z7x3#wHjSQRwJkJ9F(4nc#R#r1G;T539!v!4+eAgV+#!WT9np*2*5Sg! z^WnIUQ6_mY=dA}03z@&&I72=3V3G|b@y=I1#dEWKG#sOS#{`D4u_|f*@pr{n`9m zcbB%^*x>B&-Go^ID;tH>TVA-`HxL(NQ&Pg|a`#qtx6n|8alJUPVq-cWDJ`sa>p@yK zhRvhEhbyGBw`~|+gt^!&UWVZw_4WUJQ8-@;uwUxf8?eCZ!6(}9D4EBEeF`w@HA7}% zAb4Yb!wYyAUG>);UKFc&&57~s+z3@9go?p|Rcv?vST`$|X?2Ff4eu~87FL1TVLe}Y zvD(}a4Z_vnozM>74D5;75>s+-aR#`^ zS9f7}x6qha0cya!=GP0VsjaW{A^iXuKR>KF%^vUQpeSMf3|vp>1f0(8+L4}Qn)(Sc z#y?qssSVftH<;N!!FV?GI2phn%n^Y1p+@|V=Nzd-n8vofY+5)Nu`P;ak|Wk%7VEf;uL04V;X&-bfwDD z?X9H0*;{n&Hhz6?(aruIp1>jgo_JcwySsbf-*~FhL)|@zl12I8?s;(cd_8y14iUV6 z?w-mh4Oe@dSdh`YR-pT+!bDZ8DpA6m*RUq&N!aP@ zc||JkxSo7Ca9>i|yR$ln0)~jmWkOMG{5pYF)4HC6+TVu!*DjrQdsAT1Jr*?;gd)8J z)qr}-ux&Uy)0eppk*B|u|K-_c$tU_C2;P6#yHCW$=BU1a8?o)u2wGU0grdfBC&l zHu;AO@ZZX0OTG#p;r5IEZsGR|Ua*L=Qs=^$I;}HVD+|Vm);g<9E|a{p)geY<0y>bA zSzSv7ukE;YN`amwqy+WI<~bOLHkam*ITTh{S3^r>l{;5}>Sa=4RiSL+OeRtXT3rgd z+2{9A=drf3h~Z@khF}rfG{*cj&~j2+)~T%%Rlsk1=Ww&hcI`HPeUt4=2l#pV2N--J zpC)&Y@58?;ovQrMLf`^)r)^7)zw`-q?axSn5>HlQueFEY`YlYoQE#7T=b1v=Sd=bT zaS<0;b~ih3_e?kKJpV2EVCNkg*58)AduQjR(i$Nwh@3NVZSpd$6H}yxDGI4zZB?Oj zWnFCZ+8I%TF{p*jiaf4WkxRQTtdB<_x@4JaiGqkr-598dB(TFI(rh4A7sTg-Nvs6= z3RiVBoldW{63C9e}{i_BRo9o$=3f^-Y5=1iM~T|L=)$K3esCm>tZ zlS>lfCtkd!^*1k)axXB-Eu6bsSJuYkcpOMhXgHwY%-aSd&NQTnKVcJp!Y2GG!E-fX zIhh2Rom|fKWcF#o$LKS(3z58$$y1R%jRhzPw^lFk$?^^54x(Nnnv|Mai_8c0hJ ztUtY>qI7KOqFp_qc=3~JzI@{B;$3q#fi3FB@TcR2Zs}#Y(978b^nkYi+ncL%8qchO zr{T!-fB6Xxx}I&w<4DorcLWH8)l<_nV6cCjzPo^ZI2#S*&zE8<(`>r&rVnqC8=oIP zc3V|v*5GWP+&sEngX?vi`v2Iw)*iQQHT_qF^QA2|_K0^eiv^m^$!Usq+oDPL(*X`B zikk6>$8s%urW0WQ`@W>)yC}=1V`mbfKst~`ikDZ^dwrfHW`gA`Q%c8j8;|z?b`F7+ z($YBJ$~y-q?cHc>mLeZ(X*q5$c=U0!DwYCZmt$dwB2Qk-Ib4 zXmeW>w_|g&Sd21zbHj8uZl0O@r(%&6_fzZ%myGEEYpLH`B4o@UG{PK0oU zQxcmDDVe4s#uQ}c6ct5-1?PH0Pnc3ZsmX4wl)cfmRE5pI&0jV9+3mBXq)EhBaxBuOMe6y>C|i0nZS6KRCd(f*V4A%AWXozn-5EW zv{FVU31>`^1nJI#vp=U^I*yT!6AZRysez8pCo-p*k+mo#L}Eonk}$1>&hjJApl)l> zOW83}=CkRWMG5XcpD4As6P8C0PeGlgTE-|*JZV{xoug-OHoZ_B6pF(RoDG@SzBy1P zI=PN&kx(W_I#$MJ9;Sw&ZX(ezmtGr2e2;` zF)~Xq?R;qL&!`uTb0{)t&{K3X4?xqjIJ$qt)mgK=_{0PMcn5CE@~)|HtWMth$vj1G{;FY8;Ac+{ zt%-&2-o0HFIMvW1%hLSF5m70sF9c`M%5x`%Z0pB!*T$IH3{IGv-`~D_<&L(O zBq81u#SYB{MP3YnZk0Jrr|U*1>Eia|XgpS%-C)oR2=|iOH8m;kipPJ!4?}%BvPqT) zy3md+I;&DU;duj_m@+Y@n)yq z7K5327@5am6>qPKMqNjGd944(4QCh;Kfhx2ebeJ^_qk!Uk7_x6d$3ev*%QOorQB;@ zzYcF!yCG;oTe~<^;B-J7cE9^us*vFE@Fz%AdZn=t`C+r zF(gmNvRF>sukSY`AG1M>2bjN)lb48EszNC{QzXQEfP`(y;+HfYA`}K@!3I>w-Q2Sd zMh+}{8(?d1;cgO%T4CLRDdPHoJtQfHI>)cF8WnS#Otowsr}B8B^h{*y_@pQLn<-)h^jT5D(cU z6j4c!YO-gSw0ChyyQFpcjdlqrk4wV@^efnb0K=qR0yYejjk32N?DjMMm<(u=PY3+| z_ThvM?({7g{0X1nfu0FJb9yHWN5nCf9W0zq_th2-eE;_<(z{tWZbySG9N1RD+PgSx z;j{{t&%$wf@|7%;YQRTYCSXn>@*d-th`nTJh?64?6ZsNb+hj;sDCh!_3Eq~N!-feT zuo$%=3-*Rd7sG_%-Y^M==-Zdy=WUoMf)tn`6e}UM5Oxny2D_DWDU+NM8LLEM2{wq~ zIAJE?8A~kfiFelGaP-Cd!yk?@9lm`Z9R}9Dr9KB60nSjT>sxTYnq9XtODtOT zJ$#02IbEw!;>fQp$=510vrC?CF%r@W-+R88O`!kZ)XdU_zgsx@?+b3p(DGr zM{&^kM=kSkVEYjHgZ3o{v$`_m|?Z^OusC1<4QLGN?UIlA!hHGCnLAF8Zl`;haGNgAYoa(Mkh z){pZThrEB>rnrQ~E1LWyM+YC0nEUmB4R>{dxPQFc?rO>WU-sKsv6z;%2fa!&sy%rF zHJKC(u&ZwLjfxZe@5#r(&ksMI>U2J^IL%Jy+6U@svr4Pk-yX|Nb)!p_-#p-(2lJQ1 z9p3S04gXz&<$R(`dO4k=T+%iqGr;(LOkW~y`CE`Y0;mrm3-O19^JVihc%+Z52XMR5 zHs#(U-Fu`j=#l=S>H%WdG_7)Oc$z8B;KW6iDuxM;GEHJ0YeaaSYS=24W(FsiXv2l( zJi|(`owW$?NH;UgEGbl`_E^&{-`;st*UU3hW!VNTNN=lO+A-w5d*w1*{to}&=n#4+ zZ3RI#%3R{UnN)PPj&x*PlblSJx7H6ET4oc^;2dXYJ-#(Xhvk!4IJy+~{AEv(E*9fu z*3FWW&HgB%uwh16X* zhr0}Oc=rzXuiD|xlOTf^+9yHsE8;+hJHlbl?*k5fz@ZN~oZP+-IP?LBuQ}i#Bn^`P zz<>o!xSv|2OM5Bzoi3LQm|Q*JLF2&oBt-tN9xxGvhsZw@NgOo(z<>>tjD@^^&_3w> z;V}(5zo9(~**|FSuT8i_zzY$7XrxPfhH%jOG0B6T9~!U|lpV2t{(#+azy~fs=Y6if ziT73YH}S5nzlrxi=^lJMYHrP495vVGF3vEK;6SYKe;+${!2{PqS~roei_6ub@d0Kn z`+9U|0{Lx+V>@eohfnCtuT`AVnOBgH?TljP_ctBe857uV{2i_=biU7^(!y5n(RP{x zJ(T89-{*hT_R=Bzb$;hchiEGUtVK4k4A8A$P#xfbSEnT+WdRD{ zsKzi^L5sAfWW0*(hhC40MOl{^uCgIYIDoc#y&V@R3}t5iT!5^vA7Jwja*JQ0CTmLM zisbf1w4!}>xFxIdx^Kz~b#Yu2Q=2ehsvGT73iuAsEwy(w44Vz&FdAX1WtBv+WO#l( zE=u$5cQ5K1K6}Yk@olfp)Xix5;9>Mf)0CD|S*BL33K-9p9)b2f_7xT+e*W1JJJ)+u zl|F5uPh0o`(-wl$2A+S|KS=)iw1GZtpidhJY2SzauNn5ga-CowHV+M(hu0Z~g}tvE zw!VJY^~zz>;@7rSv=Mj|kh66JoGma@h8$r|xyZ;slexE)avGJ-7@1%h|n) zu&}M|!e2_>y^Evr3L3khp=*&Ke~HBn%__(6j;~P=u{^eLo(+% z)d;18=SpURqg*G_Z@uh<&Hd25+hKF>vA-8K_uqN3usMkX!{%;>!o%kN_q-)+ewZNS zl(0E0Nn6(ttN$aM<%lNK5Pg+O}0txf@dN>2*-lOdO9fCb*M z#X3g(+mammh<_jPzhK0FM}D7o#2?36ODf=0N>G|Boao#zhA4%d%B3(2Gz3_20y~=| zd6r5eGfZ%%Y*a;{^F{pM)u*LH0Z5;wsw|f@B@WScavLp5N2h2?86kv6x5GyQgxb)fnb(ae*Diu>DL<=N4HQUjO3JEeG^4hr<(ES^$S4k5qK0X4#{S z=5J1I7`-nX-f%IixFe^QMZo4hq~=b+U$YlAA~N*w&%aHIfqU@4raX+`!~D;`MdmMf zl08dos=)@x@bJy@hqB7Ya33K3lX-ewV=bR8lfde^-fuu>(BRHd{;Ndu8&QLQX^ZA3 zL$vkdxuf}hZ`8?3f69^0Ez4_S$+NY}c#10N>2Cr0+EwQLJzf+N z%)fFiinQ1IynwPBsIInPeRon<86%zbRnW}IduWE@mvKBq&EZ(?$WKdH0~+*T!UVvy}n9|zbKV9x4@`8R!mczh};mPb&}(lXqg!qGnBxGhDxI; zNd@7CC0T|A%czZM08!AYSvCf@NAOa%<9w<)a1}{83Zx4IbinQ?IR*P^;I1GCNXZ zN8VA>sn?mY!|3np_S^Ip+bkLOhpD9jbnJkjkb}bNh7W@;xAfa(CuvJ?2RD9_6K@Og5#TJr2MZcKGpQ_7X zQ&dD6{|2S5bc3%j*cOv=F`X7O2XxlB@*}ut(||4O`*KylASh;a#_;{wlx7z1sYl@i z9A~0D{1Vb{ox=V*DD1DhE9~NvD(s(O`fQ*6de!vT>!V%;rmu#jUlKus(vQA?^v$sJ z%RYVb>rS5xO+UPL`d~23KNBJHADljS+4MEP!_O;3UuXK+8Bjy~NC_9rRJt7g!(~tw zTE6y&Jky3`2s4@^BMgsIrQ(DmiZ$g(&@|^+lEu04zfBvSX_0hGN3r*HL3^|BARE~?53@D&K)_K$io6XY%nmldezq)(q;5`H_~^`0sR_UzqWZD zmX^7U)FyGoid%Y_#Zj8M!)ExgvwRS>@2n6T-`&q5IYa7Jhj1%Y~g-XxPcx0cQw1dAGNv$iv$vEbPR>LB>g24CQd(hz^ga z;gAEAxSHeSCBj2N1H(r9ECL5hIGDcub3kUd$>5&rhuwu+Zy0VXZRsOReProEk);L^ zf8LQLO(-*|ks<~OW(QTej0!^WH7YvzJ6*}BU2C-c-AZu+e*$h9>Hwszy8u+6{O zZ2wJ^nsG6?btM9}!sGR;=uwqbt#L7%8EvZwmQS{2&a>6%hS4v@(XWFv zu!o~xZB)Dmio|k(gu#-_M1de_MiWe=$rw*_mSvJ5p7C55?_zC5*RcQf+KaCFd%R3^ z&56KgK;hdeivH-DUk^Dwx>ha8=ZZyqII>qQr9XysII_o%L=#?Bgt4Izp%r12GkHoy z7`*)cIrnk9K5loZxZS?|KJU1lOfipRjyc6z!zqUu9Y7u__2yDcc8LtW^CvV)Q!yD-#JuQA4GIO z86hHaa&N1yRMXRKEbV?&x&kj4V_jZm5yJA(?PBKcE&nqb<3%tT;c&{CbynZP0 zx}mhdP*`Xv>e>Y+p){P~1rmNju;&oU`5X!y_AQo^oa5g2_>l7r^z1w(xiC~QWiZLP z%uqsv26GK%gylI)1=o9aPIGE|XGA3?{BF9-aR;<6ev9MF`_=|HzU)x0?f44dC8(A% z%<;w8F^(^^PH6{Cna-Jv2})I#$t>fr zxEUb|)MjcJN`=By!AFb3_lp`%bSeynP1LE)u{oRLs~rOA)th&NA71}YG*$Y8nMWBM zjG3|cK-0y%oo3*bWqw-cnNP<`TX=go@haY@^l5HN$7nE_R}lVn`grB$8kD2V)SyN+ zZGdMiw#}m%j|a;!SA#p7lS;(&4Bn`&824*0)n%MfpD9|9Uzzl3^xK-+5n)n4n&xFS zHSf$?3IGE&8WE(?@L?QZk7>zLEYqV^8s6$$?p2y@Dh=yZnqZZtL4KdNO2af9g-j(> zA)Oe4lbmo$GM)+e)lmBX>|JS-+eVW8D~S1Gd!w5|-BsGy*p=-WkHVHlYe}Jv34bX7 zg>K5cOpxmC`SqJwAlbYC0-deP!;ct`LV~mgU^eYfpZ#vwWcgvi7$7O0wiFRrVLI*m}VN)&`ojyj@Ls3x2GdGUO*fMu4WQQ!T?m(w3&07{&O`@dpae|r7;*{kR8hKuVL&wuzK zzGDuaA@%!ZdNrJEMU~tnk6OJ#;w$Nu$EcLCL3M!3Z>mkws(KbKU{(^}GOZY5v+mS% zCx|7E`EFjNP^{8J#iXpmDu&7Qvl&zzqiwcN?p@RDKI+RUos@oV^4a_n+Uk_32lg|N z&%^WjIQevNVdzFaZOWSo+-c6(+Mp)R82QhGIb&UAU(RSRxsA-vK4oU0Q`18YmPXDf z%u~e&j7AyNr8JK9pp2*qFZHdue1EOympAjWA+iG$%v$4JoLOZTRw>V{lFBNNF7dCM zRTg<}vP=ukYzRde0>%mt-U`FKv@lh!1OihU!E?iy;6=fhgL%tbCSbZlKUTTPzWMs^ z$+MUWa~0J4n4)Z*ZQhT7QH??Pk3o?# zA(@+mn`9XG{o-z&Q4<(Y9eaH2@9NOttL*L5tGOTFM+qO+c`;XIBfYur!>UujP%$Ps zv>=-ZamLh6#SOXl8i z_LQloDjg`+oeAknX5OUkDYuA}j!K1;WqbZnC#leTbz?98kbmTt^ILw~LWSDK!w1b2p;5tF)5HD=6PAnn1He@l=M9H znNEv-RH*lx;c^nGLgYa)9X95&UXC{kv0D4Hry4m)mDVI_=I4?394%!-fR1vh$#R^9 zdCjKsYhXatxJs&7$m2P?mz8`gpEzpi77HKKqyQzV2~}G!ACVuyB!5(XwD;k&Kjb7UB=4NYl zDdp3Y4HSQb%zOMn=4LHfp3c;iGY8WP%v7o)PCP-F*c+8CrCCeD+ z+Ly+0A(>VoZ~+r(rGR-=4tOJ=+^5RCHxIKAU;F0aJ&*@97z4gG3HYuGfXUTKo3kxm zxX$2LXTw{7jNg<$x{C$gm%mQh7atxsm9O4E*N&HUuDt^S2-56kaea{h9RryF+x8C4 z=c?=Vlj{n;(%r>}P+!9E*O~c7BV>@1x@_Qh>n7-ex9M`FQ398lRq+bb^K!*%zY6m zzh8PA%<0c!Fn4&49VdvEiH-(yLa~+-Kb^r`YtLE?<{BNcIz_eTG=n)-EABdyvd1=< z!|*<$J1L7QzuD~ea(;W|F5i#m4JyBw|N8v;83AYB_St#c{u2MXd7DW?4s(_FiZYWSQyfM!FEy^uTq&iQRGPD%Hg)UQ&r^@1D_PTQSr_vgqkY$W zd|Jzg<2#&OuGkbn=SYmUEvjCIo1g1HfBW6Np%x0k*`ltkidmE+5&EI7_xk{C32&>& zjH<=lqn|;xTqG0Z9{1LD!$ocBg-xylT~x!X$tEc?8gp&;1R2STnPA{pA~1oebVA>{kv0Y$o22KI@-!+7yVDmMw@4%nT@86571wB6u7#(6ei3E#&mZb zvFHuUV;DHD23$P?5$^9fqEg=SBy(oDXO{aZS?-_8#;+_)sLDH`mx*xX(v}47Zqz)_?8URryK!W111-hj4L(e z4V<;1mF>PmHith$l8ZqTl98WZts}F^pT5T;eS&Y@qmaDA@*<;5fMEKa%Fw6cXoD7! zP_HzAGk-Ul`l2={go5(rXzh~_)tUI?*y?07oz7yoyV(%SEkZe*z~3=$UA6Kc2|#`C zRt~t;h9i&t@AxsA86t6se7dd=xU!!QE2s{sEmRnFlUhbw#Cg=1CW|?UV*kiWNajAq z`}vp5U%yK2Wb+H_$#?ZsaciImqnRplr^}#?hKsWE+83G8f-xaw*-87UPd=mHy9<9I z+Rx^ZYYFVq$kIP2-~8C2Tk650uvIzW;`8Zk(L=9CKGMx>w^H;oT|Lv)PZ+!9PnB%6 z@KS|P0$0s}n`)8CGItF4YUc8w%bc@9PuF`4yEHoBvfJ*k{M z{;+=U-w~suv@+DcP3K7-<{)t<$!<&)%r*K=D7aG04PYgFfO9XV07boK%Z-(4{`q-3|gr38*>Cu=!`zonMaA+^5@FIz#T73QTja1 zVX9<~Psf>rQ^p&XhSV8eq(E%)oEJV*IgD{xW~Jxeab~6KM`s=!imsD$?M_~FfX#to ztaWqOKvJ>*L<3f@UmcRjXfSP5j-X@~Vt$4A2nzzIzUeq6~+^DPUtK4vxDSyLLv=0(`AbQx?15(BSWAZ6njx85N<%Y3(Z$orc zZk%IgM8H|O@p+XSN7nDxt=y1#&|YFDG0tI%eCZSuvSi){4s*tg&jT+q&EY?3sX`&M zpbJ+x#xh>yj~A4-LAkNg1gtLpNjaKM@o}WPl4GlgD>%*JR=0_0F<#z&Q^oJUz?V9T z=^|NHJ{w^ii^Xu14C9}-6e5G<*}g&qA9o@oHm+79)OAKrLs&!5;9oZp$kvLHwfkd> zZp0UL_R9qnk#D!6_FKG&@mk~C(0w;E}nPz^(r*!axz9&H~23;*DNQMFVU0)cm_J^ z)q&;lY3KI|%Hj3Nozx+cT6t8jM(kIMRZf=UFh`zrwC;;FJ`Dn?FQ6DgpL-acQ2ej|iPp^{d4*1@m;;ys!e@_gZclt@Q^DqkX> zT9!FhrpmH{rK!a<;-$$ArgJVru7KWTD!^QMX_+mY;o6Cm`P3^{2GJm}o=-kZ;|=hb z!_CWZ^YYEx$q*CLyRWg!-b2u0-{Zn$RsPTL|Ou0>?EC`QBVe?G7QmxH~uD%+B= z{vA~ww$*ko26L-RV@s}>PSaBOo?`H5SN7!~{74P#MFRh;2ka~liSqEs8vVNEVabBE zsmZkAzR1%e1m)4dPX%L~%WWYGk>|=Q&V|nm;w62+bfOp1=B_lj~`Yb_3@IzN`COjS^FH=mI$UF%f@a0?;x%x zemp$#rQP~%c8!<9HnX^c4-YhpyKmv=$yVFczduFp+yg5;V8OcaO}-PJ9WM8N_-2QP zZumY{hDY&@zN_8v&Gt9l@Ve3FsTO0{%asGL;C0i%FNon(ESmWzPC%ogN z`D47bOKdJwKC+%ORZR4e>Bc8PXn31&cH? z-|Vc{1rPrujUW7zG=Dr5r11wl>HGpbY5(#Thr>>IZb|hEm6GNUgAUX1l5~EGmUwg> z@ucw=+K|?dFph?|wEZJnB9C;!GurtljUn+LX=&%Tw1zZ(Dy7Yz1_nmLYufp(Ep7Y( zPujn28JWA`Y5du6OX44<#mT%2-la7D>EHrD#FN$!;EC<0$zMm5zb>WmN0&C+)OW%& z;`lQf|8k5tenkC&Yf1Il4d0wSsw19segK}0Y`Gt7O`r*)h%KG7qCjU9pB>97QV*Mok zi+GCsHGscY5fD9G=Eys)~{By z`PYiZKeQt0e*jP7?_BHVEEiqyCN(6yO=pX&Wfb`-Q`Q_NrW4+g~xC3`s+g9!fjf@-vd8eNv7@z5q_F zog(@bapyZrvfR*VN|GE}kj5V1l-_GWS~viwOdY^UL#H&U?`<*sy5O}W*&J$`%3fO% zH-&}rwuDenhAi@YA3yG0GzVw ztR!t%fRp+zNjA||lGZ%HX^kh{2mwyoGLocDwU%U!2XIp3E$Kc3aEgcoIBCaO(nFNp z&(_cvPCIF7_h?IdgtRTOY`eip$3;uf1f0Z;KbS~2Q|P+ zLnlex2H>Q5mn0GCBmM&M_2Lnhp%_5j>dLH%!E^!|5Q^*eVp(UQokxD6IaWunrgL*BuHA&9HTz3y~?Qa*@F-YHriab6<*#8R1G+ zgxvE06YWKr7iHm!0N*TT72C^Uz6pi3ik^F`Qn#O_JK6bmJOxC!#q$$HJO*xz|F@2z z_2bLe$?In?F@M5*cp{SVxBr1P41Nf6+_@Ns@w)-+jA42A_i2Tpmay=3(ugFF`zsmy zMSi{h9s_jwWHg=5Vvxv~T{1RdnZ3v8Ue890FrP#&lHg<}-$LWQTel7~Qw}RA8KW7m zLO@o7*E5*jZ!uQaMe^HU2EYB~I}95fZb5V`Fv#&NW(2Fdp!_A-ehUJvpnI9atpVXDz`ib>Cx!%?x$ zg^}M+5GJ%3VlGb{HyrWnn1?e5sXE7`pTN>$s86VKzN|2s*%tWm0-5RbBL*z%nmqj+ zuxwS*Ibd152ynq^4m*G+IUG4ha~J_U$zWC}(o?vQf@E=rc#^@evLuIZy1}z1=~2*N znN+`ZBvpuTGy@#rl%XhsgrjNvG1NB6;Fu8&h8a!iFF8%`j(E!YK|E>vc}wcpj(C#6 zH&1EnhquJz?ue(HKaw+&F7mS*+;dJ+Lre77BjKGS?O(X0?AQkusI zW2AsvigPa43l4kr5c#^|9;7Ru<#FOSv z(j2xGs)Fk;u_jrQ~Bn596iT{vY&Hzu^e@4?>{+uFN>mi;re}E_T zAMnKflkQ)DC)r- z^)9S!22a~#MJ)!&Agfgmzh#kSg>DWoxoeT-bTc#QW|6h{xf1hn{(b)QO=pX$!;L|- z$ci@{s!3Mc^fspeY}V`$OtRvT5KXdTcec=-OtN%L=q_S*LN(}-oN&t|ONs%vf@qS3 z#vyyj&blNgbnPRnQ3q(V=Ui02^%c3R{ydXRrl6eKTVHXW9&>cc82rjxMF7N7q=d)M0BHjZWg3M*fx zyVeg7FOvC|N~gD7l}<8=vpqePsxFFxY;9ywBT8|+zkctfWLu&In$lscD9x($Ba$u% z0w6$KoX5gWadZ=mhV-_;KECYgdy9a&hcA`J@K>%sEUUKy4k|6=CuzZ;C#t~$qx80{ zUU71^5>*^6z238Q9E=!$G|So2{jOz-MawMFUFl#z6)S>XKD!M1!_xF|PCqI5rz>q< znlM(sp!RPKw8YtM@1)zd%ii6QL)DX>#-ipOkjgn>|J9FN&FS!n;l z@tDn&g=9DOZ}Wudx#2cZpv_VkZ6g8kFrFF!vq=gun+qu+)Ck2xB2yfXU0-42AGgVZ z)-Sf%!p4t=P`i?SmZ10uZ2t&CjY^3L`?X-x1wKCsgu0@5@c9F6W+)zGO=33D91o2j zC87NXY?G!G*8UokQumav_z*H8;CRU9j^g)i zGYHxQLadKNw;7~(jCKCEw<+vYHz3uA2xPrS*!dC1L#huEc78BK<3FO-{-#2s6y~DRr5hgUTAHmSL2(UTJA}~rn7vZ1Eniqi$EiS?j zNO($BfZADQm%_Z$^wx!`*l)JHOJUw#-@34*W+3lUSZlYbrS_{cZC_Z;qPJ~fyo2yA z3cD26T5ob;t+g2y<_FsBQkZw~SiED@ifnMw0utG%eQjH{J&Kk8fmj#Wh^2oc)J$YU z%>V3t>Am~+`#(PV3aS^`D5pG7WTR}Ee^=a4=~ru|Pv|GDNqWenMmy^1Bt3X;XkX}~>UZ>m zxDYKG>$|ART~lvYo8NY;4K23owej|2OVT3f(dd?`VSjGayNT{{qg`&a%Z+xq(JnXI zQXqOv(>fEUCL;oM-M*Y8hy4+}p=0>AX$F1Z>y{%D`8};@{v;1WU<}a0LoW6{X zr8y79bNVC1NeDZ)bM-6PxF-3_xK6RM%U^c+%RS^TE1h!K`Ah9&Dk9w*xIrjYm~OFwZJoWK4+ z<5~ru-Ayo`ut|7uMceK4;t@;tvq8Y3z{RldxNOeBaZy=59=ohe{}nXv6!#a}Z~;y+ z&W&xPoh91rzB z#bffTsQhmT$&a=nAB@SrDu}+sC+Lj|0*&0Qf&S_ zeEC*v{*^MpJ1H+J%i(ERrU$Oj_xCobRj zcbDJWuYBG9<=-rnf9T}T4qX21;N{Cu`7u;JY~S)<8e0Eg`7aYg^2Np^Q2%i})P58X z$yZT4Bp-#!hr#k)G1h(*kF*~wUuCfK6Lz0O`p+8d{MuRp&Hoe+ou9$-Q`SKFpMA?$ zMG~5Rqn6aKwxnxmqqZXl?Mw>WiZjy+gKO)1`({)$j4xE*7Eej`k%l%oZ58$%Gl%M) zqs5b3$D1fK0T6GZb}zreo3JXf-gmAFZ$kM`_nwe9p+Me5xl3q)HQ{YtFKZ(9XJ;`* z8P$TKi~<=MCf-RDv)Wh`38asB)wEaZs0aeO~%=Vm!mFf8;WyWr{#>Jq& z2a`1WoL)E|8Do@>FM^kEUi|)w*$NYS%PF}Kuk-x#d{Ta1Y4>$1#viQvvLHgNgap^a z+2w*haghhVy!lWvAx1Pbj_xF2He8qK5wq#=f*OqJ5joAS?szbDCClSwaOJLYicH6S z`Zk-U#bs-(hz;(j{Bfvs%}m(QBC7TNF1QFCE#kH|-hOO}79nK_9V<{glvd(+=vY@t z&=po%%+(9Ke~!nFB|{AzE2;8&QEYxWdY^i zY4+PMEIyQwEQ$>k^!(tkeAv|)bY%u%`QZNFg0fay!sy)n zV15vtTS@0u;wz$aE9u-yI=7O}t)zv*I=7ONF;m03DS-x0;#NYdod2#Xted!o$J2;) z^PlYH*{gpQxsHDK74!(}h9{Qq!^ydBiu1db_~%%FcT+YB$h#?TXC=B3@5UU9=v)fs z-Dr6d?PTO^q7xIgK)b0x^c&G`XkGE&a!0%AXgA(w{dTmQ$~Zo3+Ko)2REDX{5@l7I zir5&Dg`9h|{F}U| z;w=7K&Uar=OOg(?z;Ea0?@p!HBqbdU^68c92OnOYpP#+??+<_d{^DPM{rdjJ@2~#) zaQ5$4!C=ZQy52h*$T<^QlW78HhR))OcLgp=D2{^JG#wX{d^!uRX}=LTzKb9o2gC7T zI3CViFv{}@SMZv~7#H;N?HelLW+ztay-=jk%q+N z4Q=^jJgmO zLaoB64XGj2m6ezo4aY;{UkPmdDvUM8@lgLMjP*tF(E7*mVEaL=Sqqv$a6B}BC`?SB zH2FNU+rd2fLVS)6iT}o@O1WXuXYhL=06% z>|rB@`jH!?jvgs$&VC}o%;?aiiSFwxN#r1Lc3@EMI9w*bNV7a4%NAooP`LJlUQ$&z7Xm>WPs&!BTquu zeCR<&zoGe14O+j;UUV#|Cuc!D9LI;9)95*C`;kquFj10vFilin4%lNkNnF@VrHTeg zCNddk3H{V%x|hV%;c_5j>buI*w8nzEqA9cLK(zdDb0#C3rh}R52abOf49AoCtfprLEM_+TUK&+Dk)XK|uA6Ii89DD0PG#ceu%AdBE*@zxm;5|8a>AT@59d;U|qaxkb=38fEIx12} zMcT6g5!U{=femOt6G2dL)WAgxZ2YqU2PA+V3djHkH{b{{0e{$l05kBx4Fm)xfR9q~ zPyzl!r}A|I_@Dqj_WsdPDfca4ZlLv}4FPei{S4UusDOBkUB3kZa7@4(7vRRItgrwz zbRyk`fHg*?-7}RnO8hX-MpRf-Ks&|^IB+U1EWnLjf6oHiQu@#Tno&6gLVBOBCn3Q))u^Od#>mXTJ0QC^Fq=g z^1clsuX8!*Tn_%e7|G7%psm6>mxKM2o;#O=!$shhyU8bUIWS4mn3Qe&CzMY`%I3!x zcR5H5?s8B!k<_>xcv}#lWtWWtx*U|Zvl6{EJz1TE@eVcz@pBQKBvBg(-}R}u5kHy! z)ggTEe%bMppOT;aaKs)qmRI!$ItkUlCVktZZq%8`GG&FLHO48al0Nm5>p5*QBXuUN z3p3?tnM&fUmn4-Db%*7x8Wx-m`{VQ;*n4Yu@X*;{`9tcOFT;_$aDgkbbW~zxOT6!J zOtawBWwYSje0-DTeHV<|`#g0pQwd*e~S_Cti?SsB63z+5Xc~BO8oR2BC{LM-5YtE?P^lCD4NB7tJ z>C>~XFw`> z>&szw8BE-iohFKv;=XLz4?rbV=noo<~a$@ z28$-YtwAyG74AQCnyRV2vV8o-O=rcXi_+aM8~%uGCQ6@*;W+Jcz#@8a-6B}5~<*Q&oYM#t_@0v3JBA|Hhc(*SDDCm#6&68U6F( z`J2id8mwZD;}f~|<+sNi?-{czt${Fu9FLqCC}A`GV~$v@+21NAVD59L20_40EMSjRIoBc&Pm-9yzn- zc<}xq%n!#y@O%D z;~ZHGbBfvrsYpYZ9gc_kFHRuLi%JCc{IM4>6dy;({Ha9GnS#bI#Y6AEd*^J03D*8nK%5nh$L!BA`wWhU#;?TeH#i;|zqI^=_m9nAQuqM` z4dbEtONI)JhxR`>=Mm%lay&MEB*a=d}<3}b~zsEKU<^I)+9a(vH3TO zp!Zjfht{8i=iH*4*#qaS((5{9ii_NREL|0y2g%qfF$ z)--4z+Ht1$%$dg4FQY-us>bp!6pzgxIAupZ3f7)>!+)oNI%P zpM7(l6YTt$2lw9;kBy%Q!++Qad;hZ$ruhVOmbc^l`Z>E>S;+1{D_n$Z zM_T0&yM4v{3u;?5U!AC$v{}b<-KB_*=i2dHJDzLDbM1JpZ5Gz?T=|8mmgmZEz)!++ zrFTvL15x3*M*j9`&1t4tLBq4-t3N-SiP79UmL4a}*4xcAAk1tyIbhr)EH#!ex$@DcR^c=Rp z^j)8EntAy|b@b+r>B~%Cxn%m9RiYsgC-ION|OMqg*_2 zy=X89lYZI@L#w3AdRb5RL}aZ=(lkq?>T4UvMnu_qTU407rB_d0oV?HT+4JDT%@r+B zpMya@8s*naDgCl`$LxP|T?GB%w50Rh1hZ-Sg~s(G#=~#fUU>L5C~k_GyDE-?eB#Dj zdKwIdBgahEbbMQjV0bl|(hsJin`J!;3M}hYk~{Alc!GRBD~5f?&O*%iEQ3pfV*cA; zI8H~wB%NIbG(;x(nEi~Gzf2dO4-5J~D!P}`UMeVWoSDV^i}HJ#=a^F*oK|?W|CrL1 zPTtZz{PgMBvTCQFp8fof1v`~*F1Y*R)3boRlou6S{dB|CCpq;zw@c;D%Ij4ohMhU9 zwq`X#8LP7T#gei5w=h_KeP^KadeuPZmdyHyflj>kC2r@_YHhrY*Alf>#TuhF(E7Fo zG|`_L-ZGt<#GxP3)+`fOTf~#*ed=!i@x5i)h0xxzwi8$OmPr&hbTN(U7%$DXgm0%; z|9th=pA+*T^A+^?mau-${rHx!Wd5|UA@p{yUqR`iIo)Y)rk)`ps-itK;~vH$*P6ndzyX%ZyD^7pu%F zoeh$VdNR@dfr?}liLBqtY~~W}1a+^nk+hLYjLOz~c+JMN>R@^+q~kL&ee>~k(7TzH zJD6Yid)`01&hyXn$-8_yV;!A8hBRed*IS!%V{Qt+S2miYW7;I#7q{3>&_3zQkVTEI zhqPTu#|v9jmeZlRf4RZpD*hyXZf*OZqxOACpW1%3x=rcqM?3q`t@ayj*pF@jAjKu`)7fk7a?6GRCYfwzU>VuPeF8S-lj47?2!-q8-)HY0eV8gMeZW#8DH>}dT|3G;y z!_X&hnAIB=J+NVswqcLf^^fKC=FibQ|E|{kN8hlA>8&4EFW~^j@#&3UFJXw|`t|#q zEz4{5U)%7=)-s&M@>-*LwdufMJrR z;Stp{T%mUTeo@QvT81fnX&9uL@CaQ?^xAi|@ULq(SQNA~ywWpl zg7RAHPv3A$%kUA)>y2OAuuJRxSKF`)Q!ne3*Ej6aO4x*kTUzs{YdFPxt@k%9uQmVh z_||H_n_=JQ8MKSx>vol6qb6m$$`QSyI!V#?P&J|x3hicU1w}kse?qqx>Flz! zhpW;aE=qg2Chg&pw8IstHy_)lir##zHy`WG#~xnL+nbN|=41aP^D%`6@5OwKnGL*A z#eB@KXDIJU(W@>JO-1kSx!tYkZM;|;6uq_cx4&apJ|#_#VY}7B`EXWBcUBAA1IO+X zeC}PC7W!_PY+#_wcu{aawQ%)r*G4Vu;D&qsn0vJ_s)fx$EnJ!2UM;+bT6klTK5exy z6%oADM-iN$fWy2B%khM33+e=+2&G{f4uuKzs251dxgiYGXTAsw%W#?LS1y%>T6h$X z(9%WLfl&>p=-@v_4=#N%ryA&4A96;d4Ez)dwJAs?5LVj^$xRt_%%~dYt7LyWvcI^L8M^}OsYxIZQexMP;{>0HPMniMTZofRZw*9 zsx^Ke-LK2nZCSBTo3C?BGq7FT7na8((+hkzG@^)ykz;Tl=2!|FPN5eF?uDN3nlkVs zp9vO(f;w=HYxp{h<;N~o?I4Q}zl`NLOy*Oh)81WNe0o8V9~;ZUtFg4qA4-g=-yrxJ z$-A!@tj|dbhsp#k;-TUwzMKJk$I8;#bc)81vyC1ckvJoO)CIcANAgD5Ql=zICL_RS?Q&!OiB_fgZX*M1S+@ra!A7%E%T>|gb9@c@);_Br+CAQcqAvY47&#%xt&6l zQVi#0JjqBP74EpjwA^CW8ZXv?HvW;A({##LO$lc<;ey?K(n$*w$! zcWhc0l&U-$G*=|GS)TNx(3YVaP;UEy9Wmdf9&_M)``m-?3_(q69bPSY61{Ka!3d4lD5nc6U#B!p)f55FHH{gF)YLL?|nMRp_}{~x@n5}v@zbpq>0 zQ6zA)fQBddGlqKRWGH!Qp7{Iu`QiAD28#IZ=#8pUswKU#kxk?A(Hoy%oWDGIfuEdW zV!W3hng|7VVBRgg@wt+Vudz2?wKxA5dZXKGbWd;e^hQr_^z=qgZ}jvA(i@(^%zF33 z3cX?1KRND^-e{I^+#kJByYTAi4PPU#L*Aqwy+MukGLSo8wtlr)Dp(Cme*Rw}W3;md(Mh9>jYQht%9Fx^Hcc^DH1tr}d$MhJSh8h=M zgM>yS)F^LKk7Kgv15!+ti>npIM9rRJS{~U`O!rGMRaflOrkJ>hJjdXsZAHQjg!FA! zcyOu=;nDzRGYkdXV#3gJrRPX0Z5{|}GsdVdsac`N*CUN)$qKua|0IjgH<>0C(gX7@ z;LaR}1g3sEl(#q)@mPsskSLlAXNp#8%QvYa*Ew%BRCrQVm9AO@O?iT3l!y~W7|h8} z&j*9&Ka*5mB1@H$sZ63tGLnL%S%M{?@O6H{rG$?K31$(z?n4td@b)ZIG8yNwNogjh zst>cFQU<|5mIKVIe=OA$6ygO8*=Q(YyT!FlXTZlj*p}A|a}OBkAe5o{sA!M309{>m@{w zo-6u+=$+OQBFk;*B;y%&eX70tqjy~6aY%^j*GetDL+dZ2R`ibBu>IVM-m$xwJs+Ij zS-&1y21qpxxulbm-LSEXqmjohUtd=^XgaIS(vvJb$x@IkHr=VUDM=QG)=u_4k}UL*kSw*Q zw;@iec73%YS*Rw-;y4dQvM|qeD?S!&NEVo~o@7}ZxrJnL2Y$h=R0x5dR_RQuY+0jE zn^s{KV{Q-`oQJmWct#X4#ymR;nZbAjrz)Zz6`?JebWNC0<_qe;x0V!9VDhLzHG^HO z%4X`Alrr}fI@^-ZaG)$QU^UYy%8Yl)lQhq!wOVjh7sJVrC-BX9HVWVyXgh_+>X0OO ze0oHFiHGuBQ5HY_a{lv?>X|$#-DFT6qCUaH@PM^^Tkz{LUye5~=j{l{W>)>{?K%Q78{lR;1oVYQ7qj`B|NK3!ML@gJN8`w9(T7_< z%H8NAZ?Yr$Fbx18Dp>$~X;=f#Yl}Xxpnn0SFcGLfaQy?Ik3E9K;ilN5kHwKa`nYrS z@k51$Q|UxT;QOKQ1)LBXh`@F{>2YDfXBM*}2hNv7py7txG+?qh%ruJtweTSFccPE- zw-+%6VvqSy{fky%iMp%Zz9^5TFIRF2YzHjMXMSPEfByF3;`GC>=OjvCVw+*h>y<5* zqWDy*IPtNH6|ZFREU<wmDfe1}Ic}!Z!JRCTe3VOkGsH~gMvh7A}vT%%Q=~E)bK09kWdq zCk2Y?q0TxeVs+{pKLsy;Sqt?)sJuu8Y z(Us@uk~=;#EOQTd)g+Sd;Z+Z>4hgTetkI_puMBC0A%lscHkFJ;LFh!3M_w2Sfp>4m zi&zjw7Ilr#@SP}fnUK_!fU zi=6CJ9)4HWKD<0COX5qI@-jkb>DN;tv;vn+lLL0bsl;K?4S`peLy(R8Q+msH!=3aenLQqa=_vquliHt##NfXl3h zQB@X7(=YKLEL7vj8d#`W=4v-i%A3@|N$$X~T6+~1K*@b+Iq+wo%R*6R+TDf5wrezH zpXgx{bp~FcGd6peqzRL@tkI_plbGJhwAmrYgYf21y(MkRiOtO<6*hGA{y@SgWX+ zSSl*Hxr)OpC<+)PD;v%xIdQbnGT^j#7w^yVj%ECEqYndep==8II8V)hi4=;wl#4>} zO*&B;V~!oprpNNHS$w_H%uSqKsUnInBH!TA9sxwT`u1!}^e zsO^PfnF}Gsk(vi=uNcBC8Ri{4D#nW)3?!MQc`8m3rz*v#Itc44&pYPcnxZZPTzb-_Z=7dn>N~_$&FZ?_GW0A5S)ptPW2qbhI~~%$w|pCk^Y^ zaFwPCUc$|R$=Z8gqleptX}qNFOWPi}y1bi3skaB9^xUSj?>(RdK;lM&?}bps0L(Qt%qgg%@UkK3UK zXI?m=O9RiZ%Zpypaf|KFbPkwgID9c1$G0!Z=gA}+oLr42LV=|M+@$l-FdlzTkx@f5 zh@dEeBO9US$1yoW9qmzx1T)-oROMG%0oa&Gz^x&s8b<)g%hnKI4fANRP#wAm1;avU zl$1;^0UxGEWZB`u9|-M%)|*s>TVC-IffYE;6PvFbG>oMhAO_JbMu^B(=Hnod>ITn9 zF=Zr${wX)0_;L)7^Hi03eevh{|K6XSe)#Rr4QdX9-8gB|aRiosBCQ!U>48wCrynqe+s#7T}id7~RDIV=A8}B9mm2R3<)7S0;C; zSjOsbk4T!o1jM5$RE$N?Bq_`Ba>%j6FmH*h)LVB71DV~(Vw%+mR6iFd@_;b7$r`X_ z7+)39?tzZ+PIh<)rHwD{FSze);h^+xl`AdNo;7l%ZWY^ZovcUEmF}Q_*_*SnHz#d- z!v@}+g8q#-L5feuI)vM%yyN?|yV-4DIyRrsE0xs88P*C7+6AXswrzE4bxRe@tlyV! zSB33ZwqAT2R^e#Qh3$LY0xCDFa2%Uyh6^6xq+%8IAzSwtBIlZn9>`4_D)UTQyUx1C zjsb*Z2XlsoS6r*!y}WBAVAFkIpUMsv320djx~9&R!PQn<+3w&yb<5QX-fO(+uaG>h z#aagMF^~GSliiNwF=qb@u7gj1eE#~SuA=7PJ+*o?gZFHY`OPj%yNRa8Ra{FnA#1WX z(UdpYm1weY29CTn23?TID^ix7z>_+uCY^B_!9_ayQ#XMOnI^2nZPdJIg{50zQo z3Jlu}BVpRo4SdHAOiryZiVT|yIDxjyxh;inb1$-FzycvHX}QvL+{h6@b*Fd1H1Q<7 z0vPrpDgS4gE4C6pBT;2Rs?5j=-Omo=+4eoXmd?@5rbhel9(UB0 zgKc(}y*X>@jXki|dvjpkqn>wYi-UJXHIz8ms<&-A7!GcSK|3e?Ge5jHe zkk>-Q*j2bQ%$H4-0y*67s~I#AvDh*og@9KkZ>_Ui`WQ$Bv8U5voa+oR=0QD%%e2UO zJZzgDK?{LgHUeG3J<`#lgN2%LtxKq6yk5B?;>JkUM=svm8;RdN;J!;qUq`^*s|)o3 zcZ)D$1-RQqtH9H@A^zol0e9!9UIiYt0C)GShwFgbYoGP-;CS2jsMQ^B`;A0*kGIhm z-zWfgZ-uXorZ*Sq(?-*_XS$LZoXf}w3?UuMvkVk61hy|c&g~#DWoR-Pz9zsC?4`9 zpe1oug|v?a!akZLg%2pP>)~cwxVfoIqh@`)bG!2OiksGOcjM`?Qc0~DKGhVZb@tQW zT7{{p<-#g7rEyq=rYH@o&{Wsq8PT7M1Dw=uOKE!*2bc>@fgV;-FBrQwfnIJqe=toQ zR#vOu>0FubnTONVL1hP1`{51kU>^33cgKAyJ6uKrzhRm0QCYpHwQFTIwd>{9-79nI zH!HX55WQ6yB0gdDWQa}A*i|;j_v=?(g$?rSpBU}fpufVC)3?8;6PvxSt7wM|5tp^5 z3{lODt_-p1@~UN|{CeqP3r0#c*_DxUjtzD}4P_T+4XEEa+|{NpEpK2m>i~>YCD&Uk zMvA#TBegiPXQb|)k*X}xr_D%FKcIo>xd9Cw+oG;Rxfz-?j6xZ}lhgMdmzic5nSp5s zc4%4#ELjU)!Q8-gMKw|7hL5lMYnH{sB`dY%tItS8r1DcTxt-(g=?zarO0Hr7mmT?Q zCX+d)3V_+l;IJbyogniPtDVnaKIN%OB2c~rDyk=$?AYC1Ych|hRn4mA;&l_{QzoIBsZQbRH5 zijz%l4Y=OFJcp$^fqXFuYf{ikPjW-Rc;k%XAgX6i+qY-je07Ty zAcY%V`P*PHC_XX`_^_>ht8dR%4$I@L;RD6RW+X}`qx^UrGfe$P zN4v3yJqx%x8Qn|?&k9}T4&JSzt2{Id_@N66=-zi0%}2umc29}fvw%Gd*t38=3)r)O zJqy^gfWsGz8P3j(qYD<$*36@I5EjsRBrIU<6;aOuvf8!Ujs=3fF z^})B4r8Pv<^(0_V0v?7YURhdaFL3h(&`q$_3KPioDpV}!*f8?cHc)w#KBDXvZk4m^8i+ zt9b|ND;bGq!qYnKd#^ESY+fu%DUnvCM=a(yc~J#{DeH-eE>q{%@ntLaqp1aLz#Vxq zU(UpnrUo+_^EN(Jw!i5{e3=dpyN9i+wE5|fvTA@TV62%5p+m*6+82kX!9sJV435*r zsx4!WGg$3U7)fT^9WIu^h}4{nA(X5-=X*0E?X~9~j7WnKX)q!UMx?=rG#HTvBT{8V zvhA>UC|O5=gD+=9qTh%Ssr9+*2qkNs>3&9}uCS^;MkMc0BU0oX8%l=15BrCb`Jq3A zlGR6Uw<0;(isb9srR2Ow25FI_O-fsy*vD;BiUll|DR%@$jX5j~6Sybv_D@qcpW+L zaOnfw#(#4u%%~Py$dJY`}fm@%&(i+RR28vu5vAV@nRHM*EP;YP)C$#%Gq@x_; zsqH@d%h!F2@)+N4c+mc%d1%Xy8+h$J-Pba+`QqGZnF&eIF4(?X09p>a6X}}7>qoRF z@kSlG#r=r)T`~E`#qa-``5%+RX|r=e+h|jw)4{Ze6`pE6LX=~i{2Esf6VFuq5VWv@%#9=Hrb6Cs?;T+~W zNGbIa=GcknC-7Es)0hSUVFBZA;HNOZF^dA?6V^tUn4W;TZ?gjEq6wM!x3%`|FXPha zH>ko+6IiquJZDN&V>(;R;s00^9-rzi(EOwnjTJnYbtL^{e0?+5Rbf$xc|J!~yFz(gWf}WPeQ`!T1HM!vQ{nTNL?CYq zFeqGnmS0~B{xCu4tu>%FzSx^1SN)2|%OM-T;@6|kxBWbMUx+>r8_h%0Cu};~Eo42< zKiaRj`BL6Zub#6X@NRl;PSnIV;rv0Rp_91_I&Vjh(lGc)9cM`IdZ?P)ih%UqR=8ff zcy_OC#r)^eEhfo}xG|%)OTyS8Uf?-AU~WW`i27^AphM6TSZ_l zN}&Hjlrvbe0qgT|nNN*8AQ$Cwn%ord30kx-udd!(FWe zbg4p23s?)Ka5qjg*R%{ z=!mGVY3-3gX?DCMbHWs*)v;K!NyRRNthzkbx$BJUJENaRGevT1S|_^0t-@`y%mkNd z(dZ%hQEh~=E2A+mYG#Z7q^hfy!CWw~VKfvIjF&auuy&*Tu%_0;jpb3$i~ z2k+(9HFeh}`e2X9_m!c%eG|61fNX{C&_qO z-p(s)171mQ2LrF_a!=s33EJ`zc!Oue9?{;i*mz=eg_!KapHXxq?glXS{Y9}UwFgn` z`p5xy9~5`DJfn{rcj3KCDGfPrEcH`>-oSBV>bgOScP#Z7yiC&|O5&79u}ug}b7F^K z8t{-ue%w}JrpDb$a7Y5tlx6ZKXPtxPOYQ!tIlA$EiZ*hsTchP}l#7l zr{ZV$CX*n2gsA)S z<1g$URwV%d{z7*BUKB5@^L`pxS5ly8Wmu>JR01RFHdMrp?i+Zaz)|X%Q=Q=Ts}Hse zah&nM)WC+(v;g&hEcs@9)KE2%-FawLqIsuUxw`2s%4Rt8w!$PgJRVTtbP^)p#%2Cj>-=;VLdvn+3j*T@nbOCtkl z%2?d6+cDNEgdg(~&CUiPWrasAQ@Z&OoFO?Evg*0qluQI4WBUJ0$&u!=-b|q`Pa^7u z`Bm3UR9C9)tBuR8n@|STSZy>0d*maqM{d4*+o7|cBojhsYf|eMv`2PcSqCe&^5t$; zR9zm!iry%ohoGWQMgciCv>1lJCZ^Sk75!)kEv}CoSn;7*as3&6+^oo{&se}y3X>(` zgr`0YnJvQ54vIm1%I&OKZk;ZpKv~k1c7fcB7W0x-o;gWyP4q85~jO z80y^gbr<4#k+GuLTvd-6w>kjmMghp62ZggNlgz(Z}b zdI%3~KBJGDho~C}Cw7u3jVSdwVbl}09l(>B#IeJXl^D!#oF+g{Bw(Qv2tuQTh|q&$ z>=qt6frqwk;+2@9r6o_TkD|Cm->60>O8Q@yKF2^Is9*Jth$dU@DpN~RRTjPpK)dPWY))vtE<;<|7Ln^h;Ev1eploA z{p$IPHy6KueEr*nPCqk4kcQ4y?{Xn#0+uA6Ne_3kK#VG|lE7fDjeS#vfHub~WBlMo zH}1$IN59KfSM6oDt2X)?=(q7UZFkl7K}58g?Q;EAh)CO=zmL#W+c}jT=C{^K=)sz@ z%VSuRjvV`I(WV2KvcIR+qhyE&tdHE9*dOY=etV$JBWZKXGy1q`Gf9bO$8bwx5_@5q z!ge(hK}>v_1U45TjRKK4aVUfr#g4;COiALT!iRTFlsIj)nU~M3zru2l@=z-1ObKgC zf@0Q(JjYahO`2AY4n4leL?;}+n_9n4$M+T*s8DpOJX3T7@3eWtVTwRlDvaW~>fh2* zsSr4#(Fb6TSK|Ux=&PUMK%D@A-dMpKW0we8m?ah(O_5@N_|W5Lg7wVxDAg+b1RIcc zxg0oC@U1>gJtyO`>BlUz2*3oE6D2`j4_vuM2;_530T={pVw*q z>)%w;0_$H?TxYlb?wm|Q;7vt@Z}ygqa@PH$ZP)R2M)O7Zbo2eYl{*73^7?9@b_px@ z!^I1J^V@%me?;NU=fiQa^U7LvM=3cXvQKrnCoU5AoX{)BL8mLRN2GtYw9y@PC<;Lx zEj#Md(BEGNic-=MNipE!V4OT9E^c{7A2%+BkswZ*CNA6@9{6dJxNv72Cn6Dri*q?Pg07=Fp`O6w0($=O)9 zcEO`QQB$ML(q+Z9kUWL}H~Qr>S6o>C^gPRu&sg2tEFVwjI%=(|Q)3WJd1=uJs}xa@ ze5F2%SfNoJ5LdOS#{m>HHG{)L)TfAt*gUE}trMCuX6Dlj+MLa@u?hpM`Y(0h8y=s* zd)bKjODf=lRn=s@mBxprfi=4d0lLpQ?fVbSgfy-SCKtHwV+( zfw=T$1DAR!F1cSN^J4S;(`u$`PeWY~ZtDQBFPd!Ieq|lWwylAAy^?MHz13ybl5M?k z-$aNLX50FQ-Iwq1WlA2%)q!UJG}`Hh8}1h#EQEQnGbr->aAm|v1c zJP2T>W6o0^CCnzVNYJ;7vYKm^S!!I8@nrx0%N2@@h~nRWF;XfrluEh`r3$+8$|)vk zW-J)LZ)S}~qfTl%RY%L(6RKT)w=C013$uK-kfCtWkfw!3bdT1A%}fnGtx2+)bx~`# zte+{_22MY-1WRsY@EVG=z$#f<6EQ&y%b_70&dB;JK;NqG`AnX@D|#T^;9SPgN$^v0^%&fzQiSD46If0qy6THj z-c^;$E8V%uclryvzm#M7Crt7>9XtT zQl?KWm{TrhQh{f($mZi&ChpY?tzUkXpn`WoI?S(LzF$dt!J*#W8P+5u4DR%|jwV1d8 z%rvKd5;~DbT<$~!=AHSjF9fGiTOH*~*mvf|7}e62u&fEC{uT>V3}-UxDr5H+i_xtH zgn*t%Sb4O}-FYF@O0*NLPScIyvGLS``)C+uJb^WL0>Ad!D8(dtEs^4029oxSJF*2WGR)C zMB3P-WL{HnZds`XuAaoQG6(n&3RPsLsFY9{tE$dZRG4eX$-&5gOmNofNIR1)dQx!c zO55BM99+Lcd%1ZWb$0@W0SCLi%InF%p(E6(YxV21-uw1}suJ+(I6<)v@$0TWyfFa)T6Gr~+|zuK1_vW{k22IW&XP zu}XrWvH)neRv{*OvDFG%bFC;=#h1&z(Xk|?@E0`i5u#*jPr3XBLB|_@?|rk|E+@Z{ zfB*2wW*ytueVAX3`*PdJRVo}PtQj>1Z z7W12236{$((hN3NXyJxM1%pB7GEe=MW#h&u`Ntjl_r z!>01CQWlCuBNg4GiEm44R~?xKq$dLH#`+Yw%A%tD#sS#L?)3AmtKz?^_E@W?SaBO9GE@*XMVPtJ-ZeM0)Y-n$7 zEpuUQVqsq~E-@}JE^2dcZUF3E{c;;OlK+37f~EWCZW9ji4UDQ%C$F9Cy2?&cwvwy8 zB;~@VG$oS5ni(oqw(?s00{3Fqm?0&8%#28ijFVm2Wmz0F8fc*VhwcV2{KuaLgR}Sc z+E4WNz9_SNdUie_pU0<{MRt1!pZ)Ee&>1}cwWfUMXL(V*epQ!YjVYpJ zXt3f#i6|RtMZ}O}#T=6kc_Pp1S}zN)EAL)Zu^K@@gV7L^OU%xBdd_iz7)MwrK|Vv| z9HFMxi=xVcwu{!vYfZQ~H_ls219elXKk|}3AIGY-+sASq>7Q984K#Ai)Von4N z1|gRcv(EZ!J@JwGRaSYOxICYY{m0~bKGJTIO-I3xuk*>U)Dxr6aRU8ZuYP$qtE=05 zTIp=+ix1gEU-^dUt*^Axm3|o4_t`Iz93w`hP_!OK-#dlLBcm7ZkdI2mVpJOiF* zpD#<6ouvuEi9D+x|GMDuI<~tuP|6dG1=UzEK{@tBJ8HE>+$%|mrN%p9sAeeG;6-W) z5ePFuFyf5DTrAo>dzFRo`c(;>e^_>8(Sn2q94G+{d(gzE-bf6MFq(4fD5fs(U^&*p zh}5LS5f`AC!1PJUQ)?b1TQDR7h^67sV~vcI5^B((Fp?S*ni`S{6>KUTvMi;9D~S*V z!31UmduO*8TH>&@4l_hK#Uv=EfTz>YJ@2UuASuUI2x5h{P+~E*iaLP|M??{_#gJJ+ zQqU*t8RlF%NpT!Q2{ICeG!s}U44S4m@C;UP3th)FU>gj#!Z(xl(_(0&F-wD#bI8kPAP+N z4S1_R!54mN53sJKHowfLA-h^N4PDr4U}dX$QS;RkC)mRr*#>3qF$T#YL6?}GQ;<$1 zC>4UIT%;=)Q`fuB$|^7JR>o~`-)1{wHpJqR&~r}DF;6677;GA||GnqATJ3|Wt@*{P zSA)i)hah}bUZ_4gO0s5lo<3s)ZH*das`{m$=dUVE_X(a!>>CPSkz5M3ezYn0Z z#oa8=rd0weG+O`osph2{?jAP*dp*hB;Iof^NLjx8`tsf1zy0R**OxUwl~Jr{wLhK> zemolv>;Kl}Iwg87e*5Wut;yr^d^XOe^N$Y;P_q`StaR|KTDX=q-*TnJGY1aYhs>30 z>(vRovQ?%>^UPM69?d&jWqKSBt)8?$ZRl)t^VdBRc=qMJDs9fkgYK<&bU0l9ysnKa z?SH=7%IzlmZ(m&g?TgX81SHL^9@nj%uYA7$_)t*)(tLy;?Ja$ukLMG=u8gshYmgmF ze{D1Bv;WD9n{0aZDvP#oHd?mv>sqk#rqSsKfmX(I5hE!~AhJX&oEz_UHNZ(>cHtiZ zz>c0Og|HKmz?=wFIu4VJF~`z#C``d0Fob|c1Qc|NoK^U2jd=`mR+vB8iZ+#JTf{Uv zDbV>o87bnJr&z-W1YQ}l%uwbXP6N|HdFws4R)SJf1wsl9eWqYfQV^ah<591SPd4hu zW#qVj4z1@>(*QvP77(aP;|Z}&gLxxCsDoh@TqrNS5jy2gDGRo51=y*V2J5s}z9-|$ z)8z{$W!`&Bg2%+bL;)6IWv%v%niOf|5Cq_qYC@!^$U~^kIMrIF3IcIvd*wS8)HTNW z(@Kt~oR3%H$ou%~QWsag+AE?P{AUyM44OdazaAF7mt$Sli(y_4XE#?5OWfHqtFoE@ z_*UB+hzr*jzBQC;hDY1+1xcX6VS(47c9}r|iuHom4nQ~yS-pg>vW(4s_wG%s1f4vO z&V19Y(P}II9V62(njo%m+8xA{MgGMiRrC2e$M2ecdIj33Km$4Rm8ZY-A0xKxW&Bjq;iYFbu$JofG@@SIyTXyKKN?DeKW$&LXj>+KzeD@=M~xgkWDCh#NZ>D_h@1i_ zn!K*jrH6PupH~+&5sB(Xj7|EdLq}&14#N<_9K=_O8L23^m1rjnX%~7|4Cx<}bwp`z zsT)!50b@G8`_y2uCFn5j61Hp1Af}+oJClDL!ctdW1ISPbauk?79c7LfKrb3NQ4k&f z^r8$PqT!x$&b+Jp`q-G2;&KT@-7vhX6u?yYJq`PgPsgs&+L{ObK@-YY1OZe`~ z7q8xa*-vBhabA3Y&y!h9Y9#%my+G-3H5gIo3(c0rW36gX+x*0BA?IN3a<0Annu0q zC@b3vvT0UzGz8E)kKJo4>Zmd;%b&B#UU%cP28z~|XaTw%MO6+^+}f4pCUR@pwRZW> z?InKP!LNbvT7Z*5=#9UN(J_Qss24RO-Lar@rOiY0eA0sx0#@VzBK>Z@beoX-VdM4~ zY)0kVEp%hz+t-)RPWXXD~EA?Y;F$b3f5?j&b5Eu59F$FnmTKb&D9#iq&PNL&jOb2$Xw%@U(JuK zSpsQGP}*r#2XcMHRuATS0*eK%I+cVSpR2Ki9-phF=EznMxw_zwY_XB6r$^UUES#a} z$hIYf(F6s*57+2f3U(^&+MW9$<6KOx!>Lw?U3nj3cg5sZp03}!@jk#>#(6%y+G9rd z*TzXUD|b}J{g;v1%nCO4Ct6VV;C=w87FlU;cO3Tpm%@Fx?+;uhP0_~_IUGClK48g# zX!k^}@{XJjaF=)Fe1Hqm#QvunkR6#H;Fj;se9PZESw5-oW3NkpvABlwNLFbvK7Equ@!i?gL}O=<{{3=Qp-xL-Ds7R@U#*|FsaaY3x+R&Vxa#h_Xw#>Mf<-D~ZFZ-&M-iGX>FYAriwF9LKqU9ds z3Y!z)&Fp4a<@q=&6=sPT7PJFumV{47ne8SIJPVQ%Ev*kosCYtX*YjkpV(tns?W3@n zz;12gceJn9gELkSt&i8pGpj3K4$XY(#{MGSenJe>P0$>~OGCyMce5&|uwu|{Ty03o za@<|MaZYWc^cSce517QWde5l0nxU77QLY>|j0FwY=aEL5YEGn6ng~TfI&b#etgNpG zMF{D@qj+*{b`wvo)r#ITBZs3>yiR(7>do=A1CJuf)3Io^p#xFKF=V{M+;|VmPP!8c zwTiYY25n2ejz6u;_c_)2sa>5YU~}NOO%$N$JbSi57wC0zjNKhAWdPz{Fl!{3t;?qBDauH}|G?t?KXNO0sB z)iU)c1P{Csh@(S&hv@*nuD-F}s9H0@oo5`@NT+2abBVT9G`CLj&I1}7SLMr4&4y)p zy}U8MOOgK;D=`h|k2LHGz4) zS>b1SnZ>tc41w?HMco=oL=vk4$$m9o!Vo-GyICDq)aEgwg~IeCB39IEA$j7qPj^04 zs8J1%0E&GPbkqpI*d!F*J73;Z`7EiWNnSWt__BQG%Y1z6i{#^^^{&c(Okd>_SOES~ zXo8roQ^b zH$ne(l4x22kO7Vn;kBh!C>)4KG*FuAKrsP9e7qgH9|FYypiR97_sRcx;j8Mdt#Fy$ znCa>|ZV&YE8Ru6;UcovU9V0u-T2JDGw)~tIH=`^J!NqnXr(4P9?%K|l|Fs6g4^G*F z*7>04W57yVWV7mYXx5+T*~GMl`dG-e)%Icd7DC`m!7|Kgw1=J*@)_R_z_*rV?-}Fn zG0vw(SZy%@9Yl&Nu02yKNNF`Z=T2xHUBf+JlF_`G?*vxA=N{C({kPY9G7vo8odfUR zK&WPP5De5xAjNjuzw8=>9Wh};nBINNuBLhpN;KfGDe&_pol{vh3!D@1n3)vF6N?0= z6k%Z~Le>OHg*OnOu|3~oQM)MRcoa1ynfXbp3$rLMH|-;_MeEITr~o1KV?386r?~HI z=d*J8A{z+hx3+s8fMiMdbnMt}^3bcy5bb-bQo%gtYB&F(L(E;F0{Y&6&Y_iiH#)qS z#WxSv0P%^lI*)HLUQOrKxV)f=YTwlRO^+=6>*RYZgIYvk1Gs2~#YV?(0#E?J!Ye>S zZ?JP}Ur%Hu&k~ikKAX^!i-|P#7a}x-#|N62H0;V3-h)gedNRIjv~(D@aLwaaGVs8> z2#oD^grQ5k9l>Q=`pv+koqZ3wd{t+TH)Z_2y_4(6XBVDN790jd5)dfW;B;xJq6_9@ zW8nCC?GQ>8BHE<^{PX=Cr{#u~FQYDZo+?=1*Xl~Q#2Bllv}3QQ^VzVBFZ|vV#^zgHJ4|o6O{Ynk+mi0Kl>fiocp$Bv-@^a>F zRX1^(Wow~4fR*#9y&his@yr)Ht!1q>kFvl$)~CZ(y?BBs^}OG}O+8}tK&$x0zTzQ6sc3JQ_4onhjm_?W}!?5C-#qSX?JWU-0+!FeWkU9Jf zw~bfw*tv%ls)Ul09C^5MW)gLPb>{OT#gh?YwV4B7fGq@3H1Jdk1$e#N>j+x~+YuJF z<=%va7T*0^fArb-{{Y61gpxwD;FZ(dYV3JRk<%I}twRdVL24;Sa?ksaD`p)vD;l-v zG5vd*z7yXIx(_y=fa@2@xBS8$(wg%L5M?sE5J^<^f^;CtWcGAGS!v}kK#|02r#NTI z3SoErrjB;Oc14s;xz_=uo%bWhJ=Y-R+28nsLXPI1ScfS_4ijx;Ngo8f(b$0pD_N=$w<#yVSS5FT4MVGd zyMjcE{F`rJXyyM0Iv3u#L^O$v%uPxCbtxU!p(|ZZ@db+$huSIT(>S@=^eV#5-W!lp zUsdDy3J)-aw%Rj{hc{UjkF1MUg6AE~R$1^l$CfHEB;twW0#Rgw4^(LHj8^cIvOv;! z_2OWhtF5Pwn0ldZg)Cvcd+GsLXF%b1xmsAHQAjAv;p6@Iodz8v~qwO44(pI zhQ%_b##h{EjYU*_MO(&Lo7hFRNxu+xnuUx7WVFEM5{zX)^tQWsgOk?;yd*dtr754cT62 zUsS#hf$9-(u)JB;q%Md62V-(&Ia{bze1Y-Wx0j4HzpLu^6VRJ?6N_G)gkGsTXKyPP zIMP)o6fEuXHr&B>LXk=>R{2QgI^y(g;Dh5#GwU^@DCTV~4+V4o8KbPh7ymo;&hO2CH|sq&r}M@1Y7cB>bg`R6%Xks%K3uDzcELxtdB zhGOZrX1D7KYqu`=Jxjb0nqlE2aa5)_^^AdI1hpVT4R+2X@LxLFMS{LCmhpK92?lnV z&flA^eZTVu&^dblzOacG1n^Wdoqz`v7Fk6axy0I`Ui=gjT0OkT+EM%P?6PkL`90lT zawUdtUGV!vP!{G*9y^U(%7~W=VQCW>_&G{sl3Jn6R1aWdaHCl_wh*wr0o1B`9II#t z2^C$2V1`x^4oGGLJPXep$(+VDRy%CH3F-RUzr zVDr#J`mkF&9ja~*(pl9$mo>e0@a&^o-ht&+GkT-E%I^l2>R*vSky#WlFO+rVt*YzH zL={*m3-jxT0c-)P&t7&6+?_H{7n{Bf+^DlpuN`?zCbH|Hz=^Xs3a)^cUSgei@8b?z zb*dQe$927d!)W|U8X>4kzy=^GAk zZ>~K85*s>au!p+Pp{jiN2CaQYXmIBsgd>5|7y+kN(G*5bqzJYwHh88}$#_oacn7VR zxzi3;9n9~(F(1Tj;+=AvDeAx zG`1PWm$5s?4uL=|LleFRd>bw(i>~?*9aX=3tVInzQ zcAfokn>J%;`Ti9&$K+Bh;C%+8cQU-V2B32=z`m@Bi)v{?!LF=LH4}=(T}{-jUc8sr z(*Af&t*iR$!H6HS=VOOGvc#qy=5#3aiLexOu}EucbqJi{+!1=>V%lD(24f0cdT8B! z2Z4Tni5y))LQyWhen{u+c0~|LFhc39r2XALz|TSeopPrp+(|9WyqzXUvc$zE+!<0i zk`k6?T~@>Qbqvet=Z1gGhPvY)HtpMLIAS7gA~|}xt!4(U$|76(Vy0E)+I3#(=Y@U* zG*S}>uC4b%nlna(JGku|{>49U}!d^jhb{PWdKg7JxJAgU|>l_H1 zm@d#z7yw*C6fp@^kqL^s6^zZ?bFBPP)KGWj5toGxMNUpxj{aC?$}Szy&@#(+SBk04 zKYp;TbUxfCW}Lk`DraO0-P|uMmEx3pMvW)J3(YJ8Plco~G)k&idTd{(yVfujj9hzo!-jsR{>Q5ir)}s*vA}m0KYe2Q ztt&~qkc4tnrwOKsvQV0GEJ!M?G6a5V!*HT#k}x-Y9V3|M*sj$JW`3db-Gf(tACL*a z&O#;!;wDaC1TmJTj#!Z}$w?HO^r#r?QMkHxkAsVuJpwMUiG5w${8oF})MEj@0rQ*+ zgoQ*D(Uc}ELB?YP)<}^tm`~>f=pAEA950y5aYAm@3P${NJ{X%EQ0Jh818GxJlJmsT zH1%9^O5;u@bnACQykJ}ZWB;N{KtCV+?eotce+5Dq2nYSHHm?=XMA&L0pk&Knue;lm zk2!JTkWm`a+Txby_GxZc;v7`hD}5sEVSywtAE8bdd|k%9&>qiqY4+`x zxPSnbaw(DGES1taDTz`NTll+HR>FLWP4}C2{c3D=_5gRO1=^JY%R7N!Hu!VUOOND< z_qq#XLN+rlIGA8$9=$8OY^%C%5`C9Uq`4$QbB1jq2zXWw%W$uQ35$|iSckQO29Oh- ztNl}5O&1*Fp*_^4SZKgK-zT2{I|ua~ikrAfj3l@+mZ#V-A_b2QMD9>A_Hy{AGF<)I zdI{}NNy67DD56y~n&3V+L3w{sH!Hy%CC*wp=;!_887$q&mgd_<<-suFB>B**FI`P<6 z>+A+bQ?`dp^(58c0V(ES_WSqK1X`Zw|y`2VeO zj#^5_iE)M)iBcOE<8+O4d~=-RU`XtB?mEC0R8j1iMO>u76-ZM8|6)?hQ>t8wxC|>} z68q_F(R9miykH8BPToF zL2G){CE=Q|TOuC} zj@{>k7vMQ~;aKWKZ$rSRM+Wq310eXJkF)K=%(9QhlY3Ze8$uE@66s z1Qha#!-+Sk2@?*lJvT&gj+8*gA0%^5q3~K3qK97Yk>z^7h{4tM=z?K%vbqDvkj|W1uT7R=4Kf z^+<(D`XfAkSbc37_CcKNVr*#MLFR%DW`qk3TV$1qsP7dw7i6r`mQYi)+2 zb!KDn3;3YX*c}H(7bxoJhP)09u?31o*I4)}oc@UZs;`4eWP!3M>LR*ZG=Fh*9bJ9p z>fhHzt)lTT_~g-63A2|In6z30@j82(`PdT8xO)P&85Uy;tQV?^e(_;IjmAQ^tDjcU zE&r;@Xlwj>?*?!5J^()k|MxV;y;-lo;6MNEzd!x`60`7y)i9}&b2^Z~A24s9d>;s! z7#xsj!nlEXT1c%M8F|>FTnV_x(N=28bKhHp%N?fhHZ+Xt4vshZ-oO~qjNrUlz5`;YpSOHa zh2KA{7W0KWbI|cvF#DB41}Fq-OT#4*gkWq4Rf%-iTE}FH9S0ey){0Xx{m@fmlbev^ z)@SK~4V@z0L8Iz>t?dH5)W2=?%1P@p9QZ#JG|_QUL=X)mWD}&di_7BJqg*T(wRCR< zFLu@b?eC-b6P{#J&UlQe)`+1LMk{b0td}@-2DnXGqrk;b`owslrX$)}u!GsgRytjY zZGScM7Vt8CwmC#w#q`__@+|%LSm?x@9q@HvL~zbC0u~Xs2Js#C;v?-YF(vs%C%H|? zHRAz5L#*ZXxa5A!GMFt*q&3V+3f)4djXn?Of}U>T%Bd#%wcgYni|r?Re~+$h6p|{d_kR9>8!EG zL2Q0Aj#=HT)?@E?i-~Jsc~d@q>5K+Cg2Yu<-BhM@t}`I31&Xe+o}uM)2G81K_wK*ke5r9e@pA{Jbt!LV@%RccL@Nce1uPRB=eG6e7wfNesDGS_r?dWV za47ayRhLiZpX%M;i)!c8ZC?L}Rb86pI?qpE3BOyc!08UnDO(-yy2RbB3pk9a$27$p zg@o9GqC`+55zM8f$4VLmlMg45o1QlEzPS79oE&Buk0p~p; za}mT(TJ5%*Y! zV>RHyEmo?&1O*nWIz$c0-VA90@pkIl6Eksd0L)QvDv{AfP#x!vbt)Fic`dzLkxA{k zzy0psHO^=PPkE(NF12T=#UMd5XeyzcVrP)#9NKJ{=Wcqwkzh=tyt2cDD~m4C)t^k5 z5|KIX4@U;f+xz-~oQZQU!&1tGPmK>dL~)@-eagjl_^0~5Skj?B-zTBJ+yDC8zyD#0 zQ2&Je)`BL`_^>wam`)UyLZzCgiO^Wv#Bz)!QAhs88+uS2a-o&E_NEKoZUIEDpUH=?+A3ycYr33AU5Dr%!P^V@nL6)T9-pv8UkQ}Q-7xho z;ts~)FxIyFarCrw%I0Ar2Re5c1t6;5^Q?B8ICs!pbOu5`K5qaF-d$HE&+xPfUm(}y z@P|~2C>KOiP6f;ngga4B~aLaoE(i-5uRP0YfxS>S@+ncI^sOmFec z)4}3_iH4sJ)ZRSqsXkkpd~MwxDtJFltj4^RiecZ?d%codb zmPIsNWskSjdbKLbIsu)93;lUXR9SMKm-omUofh3beNH&eB~m)ee`!%nU6(+lX_RG zFIoK*S)jaIsWR5SRTZgP=rU;%iM2Wsm{mX&k=SPv2QvGh_v__DBy?dTfrX9LACTt%*t@zW*KOqbS6qIdx%!sIRa;pn_NH95yK$|vc}Y?# zh=e3qB!~sc(P*~zzXuIa5+!l2yBnB1?Sp;i-oZH}fkvYn=x!iqFtn`aH-)jS zOXG&jnJ(D&pcuTIV@IyijeKj|zmnR&x<_CE2025arIkoU>%9|X)A|+H5EN=wh}yX% zXaHf2A}vt4v#`;F;+$(_!zybeR<%jpmbjLnR1_wlyXSyNR7l6ohdbFVUIx*=bECz}c@(XK62NJBS<8H;RORLK5ti?7+EdvEuy zkm9iyHJ)}ah4~w@X(^DVg`1>!u~6l1pCfgxGYJiPUB{ZI%7{Go1z%9j5ApB@0 zqa%Y$vXITegv7ReF9oh8)HK>uZ}`TUK#E%FR5z4_L3UkP+d=Zz$rL{;icQ@(uphR<4I}ZLQFGg%ltwjYZ3ZEuh!jG{Gub+iI+rQM=^~ zx%@dN+)AuW)DkxLDy-&&l5VfaF>wZwM6Q4J9a_d%$7TNSvHe!Pw_4DQ{uDN5@LTjXIYJ|nFSB)&3d5NBBjVuj?{H-}! ztR3C#vHK5~?Pg?iXP_&jh&0tfB2PPfQ}vGR3kzjT@l7`(LvCC8=B2+V90|bM9nR)& z&|{7FfLv4b*tN*{*Ft$)R7fG@$4X9sSo486Z_hIt>6h;eS0CXdwFQDS|Zvx)up5mAlU?WD!}eOH*X zR!Zs{GW7wd0$&E7fulma6-EU)Tg+(?D#{97!!kw2feS~&`0F(|LUmL+cT0K{))$t- zL3?pP#1*oSM8{OP1tV*%b)QCl+6CBY*8~Lk5TgM!X<`lFgW#j#&du`ye@_q5HDCTD z4iem{XrfGKGh$FK%%Ki zCk}Ozkqix=D4PtK_u!~=vjYi*+*v#Wq|TKrE#aV@ z`0^b_YB)2_*ARw)oZ%gE?-p-q*RP^zyNz_@CQOI-5Qvtbp`2`IC%oMfV2}W%8fUCI z!{gc3nCTRNA)vHGN0kLswuf)S26hDqMDppT6k6-TjSYtd(80kM@brw_7^ zyTXSV1W*txI>O2wq_rWHN{2YjFK-Vzp=5_=%ngPGBENe4l4 zCkHj*pvDt&{{w0^VxT5-9%{@&Au~hnP*WBPnFDi&;`IDv&Kc#&oFj*m`HGI3EE!!m zn=pEC#+h965km%-6Ap;;ddnq4C{~<#wc<>W6-Q=Q9FbjdBzDCS*wup5dkcnAS}izT zzF^F!6*epH7Q`9c1!r&z+WI84f-EM>2vb#d|@{MOm?#6fjnTi zf)15ht;zG)qsV&0qmZW>J=FVnG$Z$7AsVIWdZrZFT3E4Blz#9)C0CWEdW&&X~?>@(kMedgu3D=xePs=n-d{Cjf~v5d05CC z633q=^XJj?_{p56PrB0bN$At_agT}V+czaOzQaSHcx+Cso3k|u0ppHq?*96epL9`)+=*?-pLxzggQw|G zG(4`D@C|QQIx{(KAr5kqp7uRGr?+qGb*4Xyd4KpU=I%t`v*>>{pT&HzpT*o9KY{sL z!ZSIyFUy&nwSG;{88S>hhj#6&Y$oUSIR>9ZyAH_?smU)TQj-&J%JiIFh1S%(vXG^7 zKN~C4_rtkfW^!I%S~E2(m<-8DiyA7urKg1wm8nU~e4d^Y;;}cUMux4ePoeKpZ=w84 zYW}W>WNO;3Dr0h5s8?9;OPOB%1nO)3fYkh<3}9;3t_omkTDa}yGf2~0myUFro-|au zOHS)AC;Eift<$fXy<&CgseSFa)U;srZQAWtrgsN`Iuk~H4zXiU=@$;54x1%m3HbzV z>>r`S?((N~Pk8%1WOaQ8JuIq){2czbH{UxZ+rz$2k$xtQV= z8GRwTZJKiJuTjDt?e&3#dJSjTR=r6} zsP%S>!$(J)anL6;gj<@R+&d9;+F5K3+$+X!`;stLZhievdgoC?3U0CP|7$3hfjovE z0N1rd*Lr+}gTPQq&JQpI@0*Fv6}BM#BQ_Mh<)g7NiNjcYY4;(#Y9JJci+9gPU(_*x zc29PS6&rjpMBr;IG0{8OWXBwtP4WmQRTX=LD`$IS3(O9n2?fAELPtKlMg}ww;PF=g z4uN4MW}|B#TdT2U{RbFm0Z(5ch#dy})x?ijbUl{=sO+xFj3C%odDO($?BUbspuGWX zrQfAR7KIvsw`Ji=fbnIAc9Gg6-Uy4mDPsVPzkcfxY=z=jglF(EPH9+~xBMw@CHO;p zv=${cG<*nd*u!1RX5EP#o5Cr}T-e+f@ne&mYA}+x@MdqTBOBbB!k3IhmvbNBz*nSw z1b6!tY`857Y;D*_^s)9KzQ`!&NBo-=8e3y-2;FVju{#fackIRI+DScOdO`u4RT_C| z^ery83Z2k#i`;d45)3GBK?zvGePnmQ9d!{2IKn+m13>hxO+~faIX{vr1RaV}e*28s z3&^{|nlpDnHN^M4N4xjcAsvH_$0st}gSVAEP!gH$@epaoLw2=mnO$zsk?W60BlUWV zu5|q|KBnISOKrqahtQ#TnxoR#6x9bB%H0h2V9Mn)_gHV%@kRf9@B?8ymOB&|61dXs zz-94okUQ6?tg!iO!xS0iR_l8P5CkUlq%&uw;g$3~0e<869+|ggd5Tn`frF|_{WZL6 zMq*wc81C}TYRq*7JzP^6^i`ggT0$8BnW*I!t5`fBT%n4+w$~#__n85Nk}wPx*FG6H zDcwR*pRb0%o%?jLa>Q=Cq9_M7XH>osMj;*u% zkJ4XrnLB++{iHsSGEO}p1YGA5E>R{!v%SDpTj`?;^p#kBR8>^AgmX1A)EOv{#zKa< zHLwvy);iOM{*}&C%%v{HiSfdvlYvqcYiEjA$U;Uvw8N4yMxeLD`Y4INQnruMw!%7V zeOw{5Y}U>_S(g=dS?l59p$+!>?;Bj}9+~6!*?ZW!vW;7l-AlUxWjq^y=Gq5^TXVDR zj)*%}Zl%<(_;T|-@JZ>DKwqlsbR0xO64hM~Mp1TG82Z-B3&iL5di#M0WI$kJ7OO2T zAbiNc6@u2k7l>1!&dQ{MT6_-n1q2HbdJpJ|Y87^NT`+hnJ#1T2g*AW(d(9n!u$9#z ztaOeic7?lOYU4~+;)AM9)lkf*SE*l#{nkM!6Wl}U%qr8=UqTg#FW)=g=hds+dd#E{ z9R(HcH!&_~=MG^m=KC7MR-q`4^-fv2CHD6jMcengpePk5&Y)0bVoljJIztIo^%;Vn z=V!#LC{&JKuHVQNrT~#w<(EHKx%>km>g0^$J2MBSrdwRmGZ%%iB+yq|&o4K3lywKK5Ov^0?Wj}X9mM!7$UZ)i=I=tf z!2h(P(PWXsWr@}Arq7e{^YXsm{u;hvHWAruvzV>&@#JOxlJ~pmA2%=hUryUO70SuwfXP6zWU`4Pm|}-$HV+5*g6tWs}LUW zXVC~PWbw_vRYrUR{WZ;W=6?Qt=wzR7@m$%R|JAK&{p}CZNS)XJp&wu4E3)v-jTDG% zFX7KozxjtR|3}!LdlZl#)Xw=+@I8=eKVN(|9nHt{m$7hv8I4D?nH$^bOy=X4?M!S} zGLv$gWy{%OJY8)^FAFiwN7M0av|LQ)FRP7wc;O$^b{hnxd%$Ed7K`O(zL+hnNH@bC3N3JEXK3RSmxQs@^$kq;Lm$o$r%zJOBB?x8o~O>?oGE@l3b z<(u(n@v`~KF#L0xU#Pw^&E1Mq*TvM0%k+8q&zXBObF=BoTujER(K5@WoaNK`YVPK1 z?&NMdn&dB2_qVBB+;#R(q5QJUoufH4@B{1odTsWyD5~`uehkya|J)fSy)?S#`*oMZ zSQ}CD*m^G&@+P>i)g$WOFqTI^jA(0oN<$=7uR5)-c^pj#?)X4KAugGPh=bcgSRATS z*h6bJcXcB;OjVt%@69Pimz&d2;W#GKV^udE(QUa>9*57@h-8772H1gVl&+(>8f#K? zbA75q&?E$=tk-@WTR-LsM?R(5gI5j*gGH6a59v{ggO%G_#!7v>#0#~Jrf`QdHLI^Jp3$3J6!2#1g@}(w&}0Q$d`2p`yiZ zxP~%|$;7H_pnwyqNS6E3%^Z%~Ld^^YFduwksf_K|LoIrUZ@kpyD!Nmu?7lQL zgGK5#*8hZcEGuJG6|jVy&`2KbtE0rSK;WZ44~yh!OuVdIFIS1<*-0&}%FJCwGZs@* zMQa#GVniMPQH{@cie!O9sz?ee%zgQ84h^J8#!(E^5$CYnR}JTIlp@v@avD3q6jJ4G zpU0XU&PO-#&O`LpgEAt|t&E;I2YEVHHr8H-bYTB;ED!7gM3dard1p|RLKU0pEdfg= zVkdIxY@Ua^EjTX)6 z*82ntNXU1JCTXHOq)cI#);f=OH6QPcVUu(b#*tK3Cequ1>0Brvo-2ioT1Ove!{VBN z;_;3g7LirakqLpsxaA<8sEyt;8NNx2MWjU=%W*0jv5B7u=P-*%9``O29IF;fn~@9;WLu=+e+ZMBG}wN}e73A!7&zPf8hO zetpQ=i29I&;{LySSvq=E<)v(j;K7PKLz zQoZpaw};5w9P@X@q*V%zwW%`Rfx{4ASKu=ZS*VYbitW6;mbL@yy6}CNiU4&$iodQA zyPdSG9m!!n=UJ4=J~p+g2Q9yI%G9JJOvdHCvSe(|H*>2-GCC`C9c~m!MF=~BiO56bq2!w~ zRoCBBpdHn5jBwfJ|zCgYg=|X*nusfHD*nT)&EXW`MeWmMCv13m>CJFtlUAF8_s(0Na^oyVn+BpvX#zmb<&oEE8&2KNuPu& zM7|}P@LV@9Fu`l2T_zqF;ZA0iiH27*}q2MI-?1TWL~13sp`Kg<^FinY(oPe-bD^Q2_^L(Pi* z`hf9$lK6wcoGMw-G#~Jp(R7)RZ9Ez+lG06*(v2tS#0BVPqm*=$d1AV8S~^b2m9NlE z)6#J&+kAyCsh~{eNyT_FPdaBO^HoB+$ui}@&L%0xb(U1w%||Kc>vEEmE$Npomno;i zDyg1ZCDlu-q!WLYbl$I$PWx5TS-)B&9n(e1rE9fFDj|!M`fbIk$o4T?Qt4eJmEOfm zO15RveoLy~UZyGK?PZp--(LQYy))gF+r|>`s~Gt^sIsVC0UG0U;?5ZDP69jW`7tvn zP+Y2%t1Y5*7dQH~<^|@(=1{7;RZ&ZwVmZ#tMG(NZbohyqsI!nqhZc3O=-B4hOl@4p zvG*|c&|AkP_TIA|YApLj1g0w2ab24O`4PFXXK=XLV|b6XsCoby z$3bHE=?_GE`s@LDfnHjD=mXN~;2eAjqHQTC+t7xl znLYPWBUw{HM^P!36VSUR%X7;;m9$azmgF>X+X!LLz1PHyiJX?09J+C4KalL%7me(L z2Kz+Y!>H|=t4v|4V2vPBkVC~LGwb0Md;)+jKa$Q~&^-bFt z@gn1>Yo*QLW58`v+a27XN1{sS43%1U#6l+l@7mVd6Fp+> z_szCJs;a9@{EFHUX#|G5?*}M!5x$`wivH2k%^v~cK0Y0RrB&6c7FTy`4yos~MT4ss zX=dBJbp2hO-XIo}9B(ELd)H$Ip_!*LU6|Dx4*5yvBdicD)jI{*AKzv&{8YE+-cU38 z$%ow+pr5k~%p6;PwQ?!8{`CS_WH$UGwh^l88fNdK)mgNap*O;2RZ*ZmDVZhP85<+; zTx==oOQJdQxk}wkwV{m7WVBlTRaK>}5q!jg5TL?+Ylrjc_9e~E!0E?m%|?$y;g^m6I1^)xW~d6HKU6`ZX|8@%(6zp2 z(4CZLDGD=|XQ)cx)6k(9;svm%>92VxvaIzSIBRu)U>yv-#ckp-gN44*wne#8b7Wnp z$vSo`T6V)Rxen7@d@Y)3ZpO0;RTOXri!IN)1beCOD$MG~3>djn?HpB4ZP~}FerCHw z6-988h6j z$opzA7kD|&*y3>-T+;@%GsFxPxeMMjwV~NrvEmr@=0e)N5xl#A3T{MRp^C=MVM|(| z7Qg1Wwf$kMM7!C)Z1&k;IXP{3Uth~U{Z8o!#yYp%HPwxMYFFodIXYay=@~e(pyxDo zpGah%+vGW_0_QaLM)gzqm=%+0@NGj&RN16Cte`wcZj>;M{*;~LO4VCYKHpu$!nDyb zlvU-mRUmINT&BP{Qcn&RsFa9trUlpL7>eD?Z-Tfz%bhs}VzuaD%B$@*E4S80 zxdDgXqRs@{fhEmx>t{nfwV{%?#Y>*T!ljqPa=v{qa`k$ODy!xSon|xz-U(DpJB8dA zQMEk~YTRnxG_n@uM&gQMF9ToXp$&Ld)0=YB?`D2M{!Lb*5{xJL=%W2oRP^38Q_w!H zyMUUwPZZdw9Yp1}2gn0m?|OJ;9pCqvZwgUVsARZ#Hp9jXlW0AlZ8Psm2GJPO#!r!v zYukrN-WA2&r7Y?({4Bd#-|>oVY$gnj5ZkK8ZN=PJDL+9g|a6F}ThB2B(Scgg_X{$odVc5EBMjZN)8fmD7T_Xu= zJcfOFIhZwTw{47w9&aPW^sa>;Rkp?G-4Q0+QPgL%W4Ii*LD?9t%B!Z(X<+u4;IRvZ ziQUF{;C{6t2UM5^W3{0E7Mdm<` z(QYd6-pXrah5QlfT~^*vR1QN2#;OH1X3K_+@X!{_%)@QlYh?9XMfMK0Euu}9UeHD9 zZ6ghtwrpnM?6Z*tb`)YoYqSpeO@NW6y(HY~h8fpoDCJ~?A*23b!P43re@w$JkQ-3g zg&+f}5x;dfhs_96HN?BNx>luCiw=;kMR{%OX&P8)-F>6BStF#au9FZyYQn*9=Ui-4GmDS+kcKXzV_>13mrq%(zi+d3nPwc?HGROr zsNGrb;}LY5SC|CRPgNKlmH?>-6s z=ew`Ie)SctuO3DJ`6&30r%m2{r$z4*Sl`5JcTK!i<2>v2S3l4~Je7NX^c~mbxnw39 zkom{+tNrPh5ASu$`fB?%bm%qBYiR%a_=NvT8@Bt?Z5(bw|35p&aYL?mB(DDCtzEK? z4)5YGL&u4qgaH+jM2;Uy`SjNO^I0GN4mJvuzHT#ejo-le_2Hol&yRg<*z_#`f%!AM z&zOL~S%JuZJinUne|o?2*3PPGRyo8H&G;k!o1WUIy1bG;(GRqxB^CLrZ>yTV(znfH zC4+yz8SXQ5w7Xqb&9*;u(C6<&ElRF_ERXvG0^dcNQ!kv^5N zU_ubaB0nTvES)5zggYMbohWpJBu<5M*uU>GDTl$bKY<$(8b)al`XP1FD2iMzJsA@x zqQv!*)J?)zvLxgV^Apbv;z-{+mxjc5iQsH}kUhH=@^zXd!gr%E4nbLDhH>+sgyVlQ{qTQqbL>u6N_}p$mK26DTb?mu24qsCn%JIYkmKv zX`KERtOoyWWUxF+^=5n3e;GR`J9u$Vq+ayXgMOkeC?O#|#|a`o4nmPcAt!{zg1B&z zDJM}72WkA3MMW_Eh@b0&y{sLzaCBmvb_gRGQ0~NmOPNC*??pR&4(+flyB6Mc4@}gt zU#0yOp1yI{$=Wp?%ToQMvun|}H#W~wSvAGHuXBoD1hO@SOI{?YigZr*9r#%XN9(F? z;V4N~jemG-#=AezzAN3GWh!`1Y6(ftP0R>tcc^0UfPMXdj}MD$edC-p3D-nl+>45T zQ1PxWC3QWY2#1h3NF4BKQsJhqFMKZz+|Ubzm&(I{ZpH=G{$rYzuURG)=O*t`ALZ$d zu2rke^r%Qz)P-WS9TOsZCE{im;s;jOZ6R6%Rh_(yr<~);QLXFtM z(W%3_l-Xz>;kep~eDo&3aXr^Ndbnl=JNQIkc#nW0cs4GizZX!#7&7$7K><;gtEuDD zy#RsVx~ip9h^?4v-x`1<>d?#c)a7DtUFH---Z~7znOPx*mnS>P$`XPP(@ zV9NA7)6rF%rQpA#C-__+>mkZPNztrOE3h8d@Xih66#(;1VRV+lHw>K(?@o0S4g;OWhJr$jWXp(e%Y?ZGe8*75H2mJcr1s-ZW>%`fJ5Ooeub9!D>0%h@juf7sM8HqIn57INXy%G2^dnBwFy)99 zoV?mL5G=J~&0imnpS{pS)UnnjNG|-w@2AR7i8qegS=9vQ4&k(dOTvIMH-M2C2#2OG zTH$kqAC&DKc6aR=9dde2ciAA~tYZ*J4kbQM1fzX8z=XOFUvm5c4q6W&AV5r){1V}e zT?;64KP6m;GlB-v7u0j1r>+3B6Nxb55cN3F6LOj|KZ;%M)fTH7u`Jp-YB3f044y2l zGcCDLN)u<@%@03)yZZR{!{6V2SiS%8$Da`KgH-od0#O;x(ay^4s>rsDZi#W2`AY8y zfNH9Bz)s}#$xeRF;eJD7_-m1@p6R4Y-S9=y@XqhS7dHP>%jssr-?y-9@(((JObP>K z<#NZDt`{bfyo3N>#9ZUAv{VY>J9kZd!y=_6V-3e|{)kJd3%u_aXX6j#Z1BVlBEn_L zU0^#hfzx;%BUJc=5Vn^KV&wR+t~tJr1~y}A9k6aH*|SHE??+g*T@4?0OfC0S zC8*-51-Ze@jS1+Fdf_C+g1JR;i<|IUU5UGvrk`)}Y*1e-Y>{4!d*a6B5ZlfS1O{T+?e!EwFOJGAzOoA_eE9<$foKsrIfL>R|ZL@9Sd zUwRI8i5r1!6HeqNH1ea@(SUwiY{j2Mr=q69xJ;8ywa~^p;B32AP?IFgI9qmcEk4!V^4^UBup1 zs@)g$p1IdX`I-AYw9&o~PnYqZ$gbUZuE8SeJ#MC}y%#5Ec~8XViQ2AcQFo!3erOY- zg97hu#aurRMHgideEVrt=42I0dxXgThNuz9 z@=mpwJc|2-8AQX1T~S24;d$V0&yf3!Xg7E{^;L^K@qR^Nuq&sw?)4|)smh#gR|TzW zJ%4|C?vM`W7@{3!rhlsxtusWf5^L`27L(*8vI4g#p<9-1ULacD22OH%vp&;FQijPM z!)a{Y3OQDDo?=_>)xDw!qkpgJMVnXKs>BhrzCS(hO~BBF5N*Y`h#~RN8fTOXwcT-q z+Ab8RBg9SWgB;xBeQ4?<+SYW{DqYS6af=(hixFb&alc|P7)I6AdaG9~X2{<}yuU+p z(8FDmwU}(hp*`4Ifw3U{KRo2%?BgA@0|nRIK%WtVbiZbk@fAnB&->O*g~_+o8l-J# zsgQ$3FO{oZh8X3;jNGab_h&9!L|W|;<;3Q2!*L!~+rWE<)q;JiMj(8gzNHdvhRBTQ z+qRe?c9WHc^Nmh&p1JsO^sW8G^2Z=+X#wQ$#JDAp#PK~Rk&a9fHT96A1k^F|AYZv{Uyh00d+l!(zi1lbHafwcLWh@3!D_(X@mw>YMPF0?KQ%RkWu>B|c&Ya!KUm;zWPo;7+Cl|{0;+^gPbM)8HWTHLmLv-}xKdL=fX z7K&wboy?Uj8%MI~miD2`^Aozf9i}eep36=xd!*ZX;oXCGrT3Z^3HLte=2k!a?ZTT< z2%gc+jyB-B+%0NRNx3hWH!oW^Lhli~NLK3ux?8Fgv~*SG%eveMcE|E%T?Pk$S2r8* z?3b~h$h!+02pC2U# zuHP`0FI2kMS<@*w)c9W_f0JavV%wJcwJG!7!X2S)a}kK5=8_1yuTuGvV{UOk#Y#JkE@D!_$q- z;p%i;|5DZDjQVGxbXc0kQIxpUktB#?=|M!xNf3E1_k5plR~(j}U7p1F`1&qO^*Sv# z37l%3+=g0GZ>VYRcdlVpU9Zv(F`?gxI;RY?k}-sPBJB{<>ce`|D%E?YqH+)5L8m#$ z<5p4b)T%L*=9pcB0KZ_BQk5B!9xhGX;+N?`@)NmuZiah)3|h8@V2nj_^qAJFfJ3 zD7}aWBy|W0NF)L{n1C8iU6%xbbRzRV7%Ov3QA=fNiEWkTdK zpLO(tmwK(kB}~2Uqo){u{N}m%3Cl^u3=_3?uw; zwE!-rQsAF1)eYYYXwZtiQeavCXZEIUs5TUL~I?e!%HXxm2dV*2H?y_dJvN_h43JHzCJLW z6rGuVv{KK{>tgUj&hXHnD;AnZMc zO2BXbGTiAm!(Xemmso>=Iep`&AOJ&rRmPMid3CjkZx1QbbiYoeBVbaBT4&Y$hu{@7Mg>YG|> z_r;#sne|)}TO#Ymsv=pe5(~wrfV9Y>@86$S5|8=S7a-Q9%%#3EI5-O#nx+>}LolTP zu?lPpm~!2tR}z(y^&hCNU2BCZ_Z0qMcYfWsNlf5Ft7~u&OCvkIqyRTb##giyb$xr|D-`QAYwO^3>;eUmSgS`4uJueL&$>x2JJBIXx zi{II@L(la*YNFK#fZY<@uwjM*Dh{)GohYZ3=<#j0ET)TcEKoxjQ`*a{b`xGTJ=u_3 zu^u_?2g0zqXTzW|TUdKf`>m|*Y0#Sd2Q0c3{-5fMu_5oylj&#sUmZG7n;AZ5+@qYE zu3)%L;MB2{V<_KLPT-5+l*}}(dG%zzW71!5hKl$Ej$@unS>5l@u{oGGZxKDlQLJG( z@@T;c>_GXhtt@F6?tWJkwz0LRYuM(x=^3^`KgvY^ffw1m_?457X}(zh*XIYbA`?j& z$NlM{GktwXf*)wiCtZh2&~A2LOwt6856s0Ew4c4g(kpN!IneIdQgMLEEfdgEcxVMo zgn>($0SLqqcT`l@oXV%jp#T1(^7KyI_1a4#uUnmL=S^(K89Svgf{qpVCbL7^H}*32 zb_Vw}_wPS;8GAeEJ&q4MQsj-FhOe5>K9oTmiQcPp3a+5}@@)mt{J$DacyVo@*$>79I_4$6~J5{ zg89hRN1#j@GSBxgd`x#_G%N>vBbB+0>(|luwpNX8=dk*U4@Oq8{onq-P17H;Xv(wu zdVKLR^Za};;CHgme=B*e1m;!^k~=vNcdAntUxB+Ere!A7wzMinDvfC}x=_mt{gw=s zXc#!E$R=qyw&^##@SvN)*HJQ7nf}D%x0eI#Y^733(6i zhr_qz!@n+v-q$;oMdAI6m(AHD7g;nbYPG%2^HPz#oZ>K@lM9m1l!(9t?up1aK$jZY z-#wCMWH`9FzPTcKG)~}o{kdEs(lVAKOqCnsp%^DHQTDhdEJVVj{yND540Z;a$Q04^ zMfmxgH0h6$QF1+GEqx_NGyMd>oXFCq?mwG>Bp#{qeN=Uy@XOQHgzmd;KHA(k#wqaV`B?s5wftIeaKkU~Dx= zNd-lJ$qs-4j$#5Frb3iiPUa{`Y_JYquZ=X~e3SqwUlH(&mn2P=#DT=dQKCl)ulfKs zi*$>J7;SUjF`cuE^^`IP_AE_v(44{(+(&wnlBs0~n>aS^LtddFjU zYcfV|W^fJvU!1>b43UO3#G9f4kl*(=UjDm_ z?Zc>fgVek`f*Ny^noiMuR3VnBh_+qFav3GiEc+D;dLgB<3?`z%$2Y?Zy_h<;9E)zP ziVy6+b>aLW{awr33XvYvpKf1xe@K63vQzk{wrOmokss3E@!eDCr!FkzPwamZ|I9E> zqMsS&N%CWCd;fAkf7^yF|0(@FkDelb?0<^<9p7>3N&QcgpTm55N`KdNtgZ9y?*5Cr z6>v8=*b$vr0}_$IBgE{6-5Z7mNU?s9~XJ3Uximwb}Wzru^Y7)SpZ$$uVU46Psz zGmdr;2Mv8Yh=Ww29mGN7+z#R(<7x+SkRG&xIL!FkL7YA!hZ$!(h=Yu^9mMH_dYCb{ zgLs5N?KF0gDcG&wsVel6>%e4OA6pHA`vGjZ2c3QIRDT*3nbN%gA10yUQ~iZ$#E(Dx zb2;V0y0_cjj{(-HXU72R)VO1Sb?V-sz--HNJGJl_V4eDS46shkJO)^|jvfK5b80#Q znD=N(i;K=qFMkZM#~aOE%i%+TdGzrNfEivVlhw|kkHN3iv5IL7F5cE#g`N&o^e4qM zegK9JNUeZ;e7je$VjLBdGSGgP%eyE~vk2Vg&$v?wUEl7BnfR^utK)W#`5J)w9A^1< z^Qb-mY%~q>UlOokF~vzL~|j8Hg+=LjwW!Gh2bj5DfKsHD^B=N`tuQ5wn* zLgm|xQ_X>+e9t#L(-B5!`@XW7dxDgJY6ryNFv%V1ge@UN9Tm+6Me|5kKuJE1O8*Trgx72u|6z4 zeraZRndlPD6^%**gbk z@3iRRpDuex+AcLDX98TN#{v+Q%LCsHndQ5l6M8~%n7>TvacKmh=edIUJO~4rkbSI! ze<*tggf`7h*BX34 zh7TUrYharoNSux%L1e0OeKx;JK|!Rk8YO%U{UY^e4!&4bISNq@IC9L-P?F4eR`li^ zkM*;(98daHlE4yWQLN_=@dPsy@VXw%{V4SD{^Dg&hN04l9iya}G#Mx9oys&3RmOn6 zoju_(!Q1nyJb@Kay4@&Al#)4SmtfY%RINB|%|Y5tc0EX#qJzmtb+!mlnrhrLg{0?X z7Gw6W`d+Mw5a(3Po=;bAtH_rsbTI_a&%Y*wZ-@Ir#`+u+5sXoHvzhnO0Jd5DKsWGSX7# z%1q0+h-Ro7VaCT(m>}}Ant@6$uv;yDGL2+!A-NYI&@xLfpXAHMyW6i{K3?Bmy&NTV zMitPfviM#nq%5v)CiuBVSYl-nCZ_R3r;oroWmXX2x{_v}e3?W@PF{-1l8AM^Jk#*o zv>&e<$QJ2WQl}Z=RXq13i~zc3D*r}W6tFUzN}G^R4l-3di(#e&VZ=CE_dPDYCFvaI zrLmGdp7(Sr*g_g%mQG1jNF|TaqyHY-CvmunWcGDA+F3$P>rprlrIFgX~fI^S$* zzDj3nZCFsBT!7{-lCD~0isWcD*B}uo%4n2;4P=;B(`MJ8wvxmuL<+()%$Sm;s51Eg zY|I0N>w;0T^js4(+aQ(q8XfjTUqXU=^d)*s5Q|O%J0mgI-}|ULgNA8gfenOlG@cZs zM|A#IQmo{eXiBGwXm z$gI-gwrvW$)TR&C$_Nf5Lt4}H+c%|VmE!QC-6L1_mg{uDg zu+9@^45BvRWP@p&Ne=5-M2Uv8VF=oV1mMXkAuTfcq68;aeY49L0S09huafFu)v5hT z-Dz`B|4|#s(imIpaHa2o3eitiUJ5W(nwNizW_eRtaHXGtPHAn@S`0j{W`&gsXd_s2 zt`c*WbY5yrN`g}!3bEGt#kfT{e}JHP#i~x>i}b{M4vUY9_npaqPnz^+K0$WhW>VfC zmwWf9>2B{HN_X@6_QuO6Pj~ZNW}cGn<9W3E6mZ{kmF+FiLx=nh^^6mb*LQ>XJ&z7| zvj6ZgfF8n=jsbQK;vNxj!^LfSXbRsE+%|*)id?Fg;k(k6G*lL|nB945vImCH4XABf z77slYIFbw3q?V;9g&$3>n9oA)S|>#DIrRZnD5dAvfFZD~AhaDtJ!J-A$fV&}p2wXN zFi7T@%CMAFe&}*H41Lov9NU$FjWvRy;h4V3tj@UZ?x3sIp%a6yS`AJNy6)8Fy@IZw zD!YQNoiOe;%lZa?-;bsTL#5FBgg`6yJ|WOrk$z~PmGvxkYq~nnYW1Cc!>p#!GyGe_ zJhzN<$L$-&sbSXb%!B7J>vNIh9}{M6(ZxSqnAI>m$qd8v7-z1fOku)5!Zu*OlD=a} zN|iK~?h6oOO7XN{`(?J%pZWGaivRdT0dc&dx^$cI%i(+$5T7gZ4H zH822sjhi~+wMRg8xQGy5YU>+kd$l*jABGWe{di_gZ5n3 z`?5QpMQNF@%G2~_KTBcvr}Fg>=#s&UqTu2iz#&tvLrAN-LinLEQRzA}E+!G|kVeTj zb>D+ccmxa~cVU?b};y#z~ngdN-6{gb|R~4*UR610(Ey(3wz8-|Ss8C5=%?TUUq<3+3 z@v45^C#(89Sd#!PAZ^%8>p)9g9+<0GiK;?X#{~+EZWdZ8q|)A8Kd-q}8$0=`L=c(m z%{UOYiOxvA4)h;b2&*r1C7>B~0HI9gU^`WW zW2}-AozUggzedT6s?Jo$)q1cuM7iL|L)VvQBq-O2iV~1Dd4K&1$Xi6IfgNNUJWcQY z>z@GJ`?5gedaabyaZ6Y=RO(SC9OQ!5P(|1PL3Qaph8Wb#Dn^H>Fu1#rcTZphF(KEV z_4{h@F~;B5X9l$tL8;Kjq8~6OYt&RR?rK~CQH%_q)geQSBI#mWWbEeRva<3@Q$T6I z)*ABSC8@&b7>lcRrds{Ot(aMbtD+kNK(jQd4nTCnrTSD1-UG=p(q*;am?l+huttCZ zGW1?}CRK+eYhrZRD1^Z;bhNArH|Eiz)>ZSl!~~ejMb&Us4_z(e@kJV-A!_Z|={Gb) z5E{`j@cIdbt)bOe(B?-;?Gx6$(GFK!M}j%Q znE+!~Xex1%?IDtSqz`MOB=;68T1$J6ZRWwdd4SZB-K&S(z6NRnl?SU%@G% z%2&>wo~qAPfJgyL?lUR{5>**_RZ9sBn$wY3}17Zt0`=X;jgHoGl@aLpbM zhWo4o!+j@|+O`(AzS|Y;W6k2$F18=5)OIH|zkBTQcP_PUk3H_pj(;wddoGoGE|q&O zm3uCgI|{^esoZm^+;geiqX2s@m3uCgdoGnb`i%S!ER|z-R?nWZS|I-P+eXs;D|lPEic~PT4d6T}j+1CVTh{uL&4a2`bCtQKKz<-8 z+4=R`-7^3IUL?|_V|#q42g-8VhQyCG7Oe?S?=cZ69)$jpk@C{H&R7h<#{9VWsVKVqsJeFtiuA~%f zN}nJK(y!Ize*PYl;}I_V*Sqs)!R6W8->#qicJ|`M^NU}f2fq=gtXeVbgS@rZPA``z zRS4sokM9NISS{XF4bb5muOQT~5Kcvk)tJCQ`6;mD$wYg$0|A~>gxTh^RtCUISBczo z+s%w<2~^_|T~R(o)#@KYh@RJl@T)fuLip58&*kv!3Z#C(&oD&;VK_wpWQjDuaWFU4 z?WpvLAU>hLjqE~aJf%lCGy9RknEmM6e6nCkCv!;zojz}~Y1?XOT=lAblA_NOh2Z*131+x=(^mOvO(nm}X91sF@Td;(iP zmO?Vp9~*p??An@w7Ci!by+IoJs@#Dlu`f2u;;*5Dyb79rDIMhR2AsXvjf#^LgR?z2+k>+`ID0@7JviHgvqx*J2WNY5wg+eb0&q6H`#7}O zf2PB{_|E|h=v2mGW~>Zl%sFaA>M##unFy;2_`j-PmhN~DfKGLo6=`au35~M3fOjN{ znIZ~Vo?=zbgd1BN25g!FhG3E+3`NZ2DB{{k7H1~UvNQ=<5+>Fj@&+q~$m2XMRLF$R z5}OoU@{|iBGy$#k3JLYpySb}V)Ye=&c)-nX8eudnp-!y zua9f)hD^o>A(K0^zmJYeu75{+RI*1Uzg~&l6<_@BP{|?_VPY7!VE>dW1Ll)aE^{4g zqXp~}oX3{Ms))hvg|f<~CMr^!hw$03;Yx+zbyO1Bmam@ug#66&n{rYS1Qa~~{qp)5 zQT9%r1eap|ejf;u6v+^uYe8_jLNE&dw0@zl1X@d9I@E58Tbt^>eo~qtgwAuP+y@^( zGg#$r4rdGe7sL*0Ch5$*_m1x5gOl^$pO6;UXzcU~QIS$q+E?aW1uUNvs8-XSJ*O5d z)6h|!dK=O&7qdoS4gbgx5(Q&LzOzCA?FL>mCRV7!$-vNcZ`-A2O*L@BU*ow~Ogn+* z2dkk@oDn<@6MeNQ0?NYlF8L>;6?;vOhn~M_cQq9B|fy*1?fM`)k2ss4S zj%}WCx`L<}=jflFuB|%+)f&BH)Wv*qZ$W^EPN@d8UjJL%X>>k7SgRLixtSFhL0Tk1A|@4y!Oqf>>fS8n|tJtCih zZn+iaH18&>>zxSX>-&VMyf`21A`PV-S{VLmstGQ}A&d{^9mOE+%*<=WL6WeBD|y&FE+yFGER6>^qzsPB+z( zb~{M@zSc)-<38e9?q`?hyKf__C8C4i71+6xx#If*yM)A32fn>o7H-VVI%p4WxglYR zYI;*GKQcCZBwFm6XF-*yTT^p{`qO*!-~X3OO@B8j7PZ>tBaHLED8=IQ*!X{o6pIIM zyZaQ2KEvFKAQ`V@;k#p1vw`V@;k#iCEK=u<5E6pO!Cip3pF&hX>Cy&Zn!x77{} zY%3KT#Ws`~a-ri;BuXZ6oar=Fd9EZ6Z7ftIl631CX&PArJ6giVzhJ|7#OofbD zTx2R#nyWaIu{|V-L#Tu^Fl1s3k91)XtVyCwL@LbFG?A&~oQVS%_IUzL$|6ysP?6E_ z(UUR`S;VDGY^=Gkq0T~nKoUoh#~OPI;bpE_#uA<;xzS9-98N2m@hFs1$bFJ&)=I@5 zf2!A#IF3KpYp*!|WUs#B3(WQ!#s0wQe!Ns{`VHiXJor8O9`Z!o01n6#VfkrM#9u8} z1e}WZl>&~DE7BKaJv3KjgD-w}xgtDeVal+`w}@EGm@%2)S*Y_QQ>g@-h9-%^P$&_? zm!gPl9>q+7EhUR(%Ee>3A|A_m8eF#2$q~dRFc<5|%}0cWA^I~^??nltL1^j5z#cGC zffxrWA8h>25mW05xi@1_CDpeG#~dCFrzMKffwhu*$I!9}q`dmZlXFD}WLPYE)(B zJ|(2V63JGZ3G*#!YsBmjQ@%BVs@!6)39}vD`Z59t50{w9u<6w>vf*-|?T!pQJ(~dH zTLeR!-_5Q{CCWkIN(7FfFIZdkhv2u7hW#|SSlmi@=CYbV-)?-x9O$ z7F>N^9bhOOhu_at<_#VVD@*IRZ^9oi*i0h^RB|tQ=#izA7@AZ zM)Db~Z_s`Er}JMg-o0!&S0nRJe?1o;OxdmKh=TZHyl7cHhNjTpUXi_5KUD>IjFw3;i>l!H89DF^wW z`ux*6Z?2l4AGLc*tHdjjU>mq-UBZxCBfG5-*IU1~yg9*aof4IplXgVlAGVOs2mZGr z>#1BXWD?lk|<5WSQ!n&`TX$r!D&23 z(Y|lH$etVizQJ>=$X=MAX3@^Ub5mxI6(}5+Wrvp8!~XX~i#~Y%R)Xj6ooGS&t1O9F zmPYVZQaXcgMq#yx3d_R~z8|4wN@cRh1rtRP!4&3-vmB>%HF01=@Z9{LcASPZgz<#p zI*hf}V+cC2Zj5W-zh|#sX6{`1`uxqa;qUuI(PtZ8Hko2f`X`%Z`4%F$I1qsyPJIwh7RDkk_HYbTYVo@^%tD6t&WlJcI9ZcTsj)jj>gB z3jd)d*=cwhJyzIkrB~>f)vV?zET%V=(A1OGZ{S_oGtW1!p&+x)$j|6=b* zJ~`!IDU#ocfbJ4!hY(JyD2I4E%;7+4l~!=-wK|C*eoe!~77(i*kUNoNg^f)TWpD_C z5Ll*J%y^NRC{$Udib%0I7qQuzJhek+11}N`q+^KX^SFq3irEHCCV3j#SVf73C>MtK z`ESr#3tgnCPA!b3NJE~nLfHh*lko3Fo|}jj+wuC{BKgCB>@OP0?-q;i4`g>^@gn-1 zP#ngc=ZA*kSseB_c5sYPyw^N9G!)<9i{D)+9to^Y0>6uhO4wq?YMH@H4XINug@-r zmuElw9}?g-!gO{*Zv!mw?E)+$5SI|(-C`((wUi0)Djn)Yuk=Sz2q;mH-4{yEsYE&S zYcU^A?2xd#nKK@>{b<0BrPe)z9AQRP35(~di2?NmVVT^V-1F6h&d5rX!>Xe+oJZ47DOW1zv4Q_$H!< zJrO3p)4zXX*EYh|IR7+JSb&{sf6twK1G1}|a_N&2He}pG>uC3WRN-6EYD>p-stU6} zPEg@N4~3asTwGA|!>Q0Ts_q|q#xP#9oUN4c#`_b5fejpHV8fX=mB5|%fUDfJig9D_ zX&Czm-hCAjY)({tOrQ{CWzraMe(h(<*?NPGmNzq_*3AqogIT9L!I&g! z+T`_3q;-^J@ep|%XJ5Mrfz#m;VQ$!HzJ3XTE{}cnsc(SC{y(nHpK+FMr9!z23uhe~Fy`*V zuJu>aZdsC~N8<@%V@Kl&qJ+TFSf6-faVGOT zal*1(8yn?CoQph`HkUaZ$GL(pRhVcNM?AHefiFIMB;$C+iPrIwQAroIPLtFS z5vjh=aInc`T}Ks@80%~PX*HP}x<@=4ers;CGH z5D|#(H`|@SEGn2I90DfOVE)p@yB9ASDdW+6c2%Cexj1Er2q4E&hJ)M;?m47r7BKyO^FT=@C&wJ3NTz!po^oBOvo8s3O*Bg?jNHNB0feVqx|Qe@W^ zYaIlOw&pB0(!T45uFl@CsB>SH?FzZA=_G&%FNP3Qfk6+wIhRA7QO>1%$W_(7f>Dn@ zG}pn)DzA0&5w=DsQ2m<0X4Hk4Xd6+NglA9P%w2kq{CR1#HRy%p$jMt8WUcn9q4TPj zXV2Q6MUw>GLmnIra?rS>KafC&Jr!`p!IsH=EmwnozbgMo!{Ykv#jmekU*DK{=+vQc z-YYX-RHa99T<7X1(LLPdJ(!@C^_#b^&o6#;*adp9 z^CzNYnU7O9jcrd3(1|Oj_Df62nX48fM(O0`qM;5TJksf`8;rXJUmLMoba+cmm;%hW zXR=XV-Ft*O!45tnbIVF^)+F*(ao$F=TGd=5y%OsT2ThscrZ(|UF9X;sQEl1hq>g4a zaH4CiY6Mu2y6Tf)3G1NIcG9EjiL_zl}k6&GtufT(@!LP30 zy#D>#C-GimFW~!&s0%KnvLpTN<(=mOfyKqNcFVeGH7!i4#l2-|ie=8MFL_PfBlL$_ zf`vClc*h}eK9#wacJ8iS%qc`U`IDFDZ(ly~!}VTJ!N-emr7l)P%-R|anz@zyqs!`b zu2dJ#UZ%khXaZXxsQ(3lI|IK{J6(Iyv)8SZ;#1mF@U>tfhlEj9tu-#?*X?HAx&*ga z$GauT4&i;Rk-UZ&HF(kGXW>OPEz|Kxzc5||TjbZ*L+V%rJ0(B#A_Bv&eESlT;Q(s^A|7AR&w^mFtW} zMp>KbA`yk;O5`$)@>t_7p@mIj?HX>MH(2-@DJA15SFx~CCsJg29$S1-&SDiNakTwo zv%?#>ut_G0NQcU>LKLCNvclLj(^1MZ5%MBRqUZorO=$tvv1!WVyb#ig!Xz0>h15oa z;fg$gy;Wyh*(HzTMcFrl7i~3Dj~6|T7d;RU?t~Ym$?igt4PeBdvgkC)4#bOiv?>GN z<3+vH#n-`$Hu&QAhZo6Qu}HutNptw*g_2v#bfQgSH8-KQxz0_fM3E%MFs5Mhh~P_^ zYWQ%OFzj~nA*qYCTyO%2x_l0ow(W0yshXQF_&2*B&DCCoN6+Z_Hg$yPlc( zHQm3y{o~{b-W|H;@vabFSo*7Gf-IK!jDLXG_gGu9(QXt}(h$t~!H@)_y9`0VfNm?L z`84s20g^4Sc!llj~wr>@tTk{C2oCvMJL9#6fkI@hK9^z z+O-mc)~N0U3OafS055+}gO0?W10wv*JXXqEH<;)9FU8y*#GrzyAx%lNL?hdQ%p#(Z zpcrA-35c4YJyD?yW)m!6I;zy-7Vo~5S@I{mJmR_s4g5uSb32YC1-zdAFMHS88@G+M z|B8V9uqj|qDT%uEo8zRd(Iics?6$z07Xe98jyB_wF&Z~@KkRScb0H;aF1}>i#x4vL zsXZR?dPtq;T%OYoB$@TD1clE_={fS!>X&&*FWx=^aLas}#x7UvH2@)>68$K&bKTt$>fJl3W501i)2Un}e$J0C9)7}FV6s5~II^XSd&Xd#Az#dN&Uo9udbUPqq8=HFhBjz>c^5Tl-?);ecH{!>ky9D`2p%4CQ;DA(fkOH`5h9oe&TZqGx+)Pa5I*X3G z+LBwh-z_gg`BW6?vjt}Cq4W&3v&prM?Gs)yBfX&fD)h zKEPOxp{;qRa1FFweX=eO6-UWyG2H4Pm;MpIuRKOP+Mnp=g(pFSsDH()6PEaJD8@=c z{hLBUprK~4x}2}Z1s$I1kvoXqE6czYIegFWB+4`F`@FlNjXt+_NQRv{zDbHM7yjM7 zux9{Al`kFceV3ugVj^UaLCXGSl+wOs)@xS^7!izhuapm5xSM)kvM-tv34^!DK$;9^ z3*;_LY$P_~_9JFSu5jHWhRpRW`nGfWAM8T!Ga$8P4TRd-Xb8nTSmJ|_BneLw*H!Le zrF)K}c!AlOz4M`NcNo9wHu-qB6DGO9jA%-gJC@Sr%9 zhEjJERo=-6C`2xEn~5@0qK*LpSAgP@2GFoJSyRMutTMpfdxX}@IL(?YOHEa$T1h3U z#ui!9WOXW3lc*d%Np!M@F}5<9tP@emGH-GX0Kb4PlDMdhM53HTh(^g~x6ke79&B0I zI>~iXm8y_+sZ|c^lG@4?+SIW!$^bHsclrx%Hd0=@jSqo{hbM4XLt#k7Q_U*zS){l! zo@M#Ik>y2J3i)U$e6$qa2TS3mEIv3(p|B0y#x@s4lUJ3A(>#$PgNrj)(kf+&R5iJY zMVi?}=T;}OpfL2(G*t|ne3PYcs3^1DQh2$r$gzr%&_Dg_ErvM=FaP-m7 z4p_dRg+LJX_QSGUt*kF+I06XtwYp#z5=?G%C7S zUhCtRNy?CSrt>CedbXZCiS1tXUNE;y<4F_QmQpKtMbMn^o3R#Q@DtY~h&H2dh9pYrExKyW`vk$Lx@Yhb&rTx109p{_6L# zn;a;@X*h?a4ZyN9MrdR=T7C0w5dnN(tqB3$b`e2E*hF{c_^WKP;+3O@a2Gajhr=zm z5RG!^5Uv|PkVQw9t;4Qqdb?t(rk0u*N&hJZ3rEvYUs9Zmn;#A3kzK?CLg(_JHSb}v><>d zWUK8!>*8y`^}2TJy8Dn~{r$$nG0NiPnXc1%5dmarG z_r*Z*(5v=nnV2RqnaI=FnmmR@gRM#n*s2tMOA?a`z$dA)xzbfrrSKj|;H@Jvqf=Ae zXrQoP9>C-;1mlR?m-o<8>USM4tq^12ti0xwZ*^g7+GR0Z6&0>KX=A^f9AU^At zN`;bRo_(Zfc%c;Qj=Q9s^?FEnl6Mzkf&C)f*|^hdW2!A78i z5bLVg`8;&R(^S?%bUJRs<+9Sgbm-yKS4@?B#jS^%7Z_XEcNw$?z}(Io%B^2HU*a;t z&=zVQ#(|5)u5cF&h4S%FC)SZUzlaXaIqc>V{@*Vnyz1fVYv-1Jvi}_Nhe1QZCb5tb zdbNXeW=z0+e|q}9w>>6#w=R!;68*$1&@~>K;K}2+zhJ~p{Qe>qFjEZ78>4)pqt_=K zG(@W~Sm`{k!T`#5P1qydU?Av@?!tWNp;a>5VNeIU$ldGvF$RF~^1H&#*P-db7=a!?bkRc zXeB|!58K5dbaZ&$*7cnDO)ffe`#U4$DyaWF6g}G<^ej5&2nfEvTUN@h)&-J`klGF+ z1lPdyYUwcM$?y55h%Xh21sVDl{BU@4?5-R9d0`3%-W)*GEHKy3bn}f$=x-HqDln~=W&{YMw?c3UISJTxs-(BWo&A* z6S3bSg-l~r3z&cetWe~IHKs_CDwUXUCz?zPQN@*L_Ol5*=<-24fqiTO@l51*k6K8? zH;J6Z@{fpGc;v%-Gz#1oqrijb!-Fd`6Qz+F-zjO5W|c}rT8da?b*>9hq^UA_m0FA8 z3u$FCSo^BdvJh!qls6d#Zj4&MU|*shdWLb#oDgs){J)4m29>+ExRn^IZuWf#+Bs=i zLz$kV=SR<6aTjQTGF31x9hAxe(mTD<6>wSSheJQ!*;1XmGO(Z=;IYRz?q;dZC{Vbi z0-4Jd=T$NGLO7^anC|5HlcJM=hMLu|Rk7DT=j9^ABdw|Sa4G-i# zS*{EbJ-Ji_b+Kv=yjzFwyr)QtNX;!4 z77k5Jp6oK{QgH?j&BztsneHW@>QTOiXn)s$vmRVGhz&E>z)`4G{hr%-f36IF+ZBzX zfCjv8NqopN?uR@_4WRskbMNl~w1q5^QYB@j$|SXU8K*@9;9iM1H@ZRx zi~udSsQ2h06B>*2);XdGYwNhqWme=esU=`|RTN6;YBvqhEf{T-%*qNB@eCAqS=F-8 zdEUfjZkkLe053796laljy9$S^`D@HY$rIMxmD#;0m$3hucB<{a8}& z0hGTxQ^^#{gP?s5luy%{%=Rq>Toifr2<0E4{Jntko3i-epgb(QuG1<_q}8#kR9-iE zQz}))TIM1zWehJGRSTJ#8n;r2rp{HW;f-LWDVkeD`PZ(RD8fHfjtCPWnt$^W)Y+B- zUQq!$#B!)Gqr1R)Y+}qjKC=s7u#}YIMYq7JugG+^)svjnnSQDsezdssO{R@SPET9ev-{aGyo5*q!xy*}?eE-Ea>E){bFEJUF-*w`+=) z6H&shYV_*SRNwL%Jp<(zRAtcWuQqV;&h2r;;x2%E_y#iskp1P|g38@ON4#@SPriHg zua{#<+TOd*!&MppT`&peE+V%v$i0)wQs+-Yf?gC!#9Y@gaZaf z?4Q`V9uvnP{yv|>PQYH`ll=%LP69B2jro{j1`b2g_#X%vVAuZ!h+)(D_q{_5ukNAq zZ{zK9CtWx;QrWr`r7DzFDZUCtoPyqM5-aKoor1Y+%pTl}2>=F>CndZ-bW$55^P-3= zsq4Hng%LTt)w8NJdoWbWxN0(VF9Pm}YfOZJH&v}omPk-DtSk#tBz8AJ?=3=(H9!%W zsSJLoV3kT`;>KzvvQlZ#!}3hXM#`Pcxwk+J*KOmMM+~=mdMD_+1>T_P?}s;J^;xb% z8PC$a@dix4d`x(L#2fbkZ)}mp2ZuM{wG+$4l(nu*sjH&E+K$pD(lj-o3zZk8X(X&| zmWnuuwW=~(;My0k+D%p68gJ}!9g;nDOTKeEoWcnC%I4jjN@`t~HQda*u3pPB#dK86 zEu&!0SI>WbfBfUCSI>{%p8WXg{mC=V812bJ^lR7FtY&gH9eG$H^zMu_c;hTUfeW(% zgDf_5)d3vZieI)S`1Yj!s_69j+mqAhG{9kKr2RU-){fD0+$JZ{a^l^zA##46lj$2S zstdKELO!@h6#wSZ`M#y^{B&tyv7a1&`_osm=%fi|2*@{`}oSUpYjmCSr$E#<#eOhuqj(j97&x&Rn=Hw7x372^&V#I)%9>dq19_E zJ@`hEzYgbk2={rnJVeH_V1L&CHr%ECFg7?ld^cg7z|uxODwh{-`whei+Z3koZn1qU zhg&EVVO%c`wOE@DNJ2(YP#u-BQP9 zfjM3eE(U)~T0O?{lgm-9m|qiJ!)x;kFW}JM>aIJyD3-0^n0dBx_yiMT&R|z7w!3?* z>)Fk;I^l5rI}A|6l0BfjUcKXan{J2#;p*^C=)*Syn`Ab`lYFF%smN!7<;=6^2@X8qgYky`Y-fyCfje52CYW_i4ou_;^Qq zMF}Hn;Ce!9;H9WvG zl^Ritrq+c>i*zq%d977yWLf7~YS6|7!xn{5aiN5@iB4_Oq^gN`Ms(kT>8`RF0Ld~< z0ZHbiwl)LAEnyZ0Bkape>8z@no!Ry`n~kpB#xHL+y4mo<6WGV_lg!Fnmrx(=KJZ_{ zwKVp!`=nW1R*!a{N4w8Gu={M0#Rq5iiL?Ps%u);3()_2 z9~wJE+HP(NEV^T`rle6UNeF@lN$guS~MU2Klh z5CWd7rXvD$=7F0$!-b?>Z4l?;hew|v?;mpeedW3Sk>0Oe1j0#F1D@IJ1N4YM=VeP2 zRPcQQ+J5PsCww{VD-&D0$}cKn(g6x;9m+e*qOpR9wqtO%qXY=Dk!f-+mA7pGea%%QN48O8Y?2qqT}1 z{g69=PJbo^9IFKk#R!68D@j4@LwipS+Q@juuO{lF~azdKz{Kf^4k;nZIQ(Xhx`(l zLn+cy=SpX?)LNw~k+5uOuB6HfrE^&|Rbs8sRyMM1j4BGaL_}k&x)C=aztDQ|7u_o2wQ^kBVZ{Qo83JIcmCr~#K_Y7$1!Z$u-^il_otA?|LL0LUJL$}0k ziY}+19}|X=vzXVe@dNV2T&qciDNQ^~ z2n077l3L8S?Pt+5UMkYz{o?CkXUEkGU26aqU%pv)i3ID`bCM#@#%C-y?Xq8u*{q<# zlOq@jp)r#cQ7%$Q`I38KZndN0>V2YZAQD?PXABE|x43>v6KUGA!yL@bd{pQ;-oDe5 zm}J7T4(Qw<%>zW7P#vu~rTU?=Ryxb^pA7$z>_tvzVuLTqvmc>jHl#ng7W90k@9IwA zXD_lNEGv%~V(oTS=jwO5TQ>gi`z3*nbwAgCF6XV<@;Mg+Kl~qi*S6cnwPb&#aeyEa zAWD7PeGzaT6va6{s;b!Ov=S$Dc=yPZX{ zP9}DDkS}ajvdnqs6+qitUZM*e6ckLI*7i{s8+{vnk;o;9Je zN3&)cJ>CMy{j_tC_Q~K7A6{oK`vU*yLUXO+Brz1G7<3%cRz zx?hz@Q9t?zKB=&5c-{N(0seRS;qv<7*pJT=PY5+$zh)0nJ^To)LV=}A=xKNvNQ@s7U|g6 zxr$g~bP~u&MVxbys8DZ`OKA3B`edeFY~l%Qz1YMP7<;jaC$RQn6Wf}*-b(Pb7d5o} z^5M>HX{o$>3-Y4b+L#}u`JHv#5BuJEAy^CcP5kX(-#Cc3fPJy_7O<}!{-&@mBEM(I z_9fUiUt3tpPkUi>=4Z!&f9(5*LG&1~?}9Mx4))!_zRw2xF8JaX2m1<@a0dH+Zo&wO zNs7llmz?VQ}_D!YGw8Ddq!AR=~b*kbu~m11i052D&e= zbRm!jJNAC04WIbEZ{A-xC~a?_&?wB}kQZT#p;x1Uqec3-Yfs--Z{f;^an(!7(%}$UB%$;H;aDm8m@=i2s|i9oWbCAsbLZI%L=SVJbQGfu^knK)f4Ln;{%9j(sFYO3!fH) z{_lElYpr7Ap=~;^sw^Dq0&c&Q$xLYQ4vl1Z?qZ2wmp3-<0QzeeN@)r3u5-5A)qy>- z&}-X{2%DNmyBdxe&DAIIkpsJ*_Y0eg>&4G+FW!Ft;@8&EeA6Ec>T`rRI}`A9D zjr7HA!YFt|AyKH;A5TnAn(<|CT=CxJw69QQoOWYOzD`jr^=3TQ1DFXH(OtKMG6!{2 z$n&WM#I3qF`rM57a%b=O0FJlHC4M9M^8rW3)<-8Gcwo&~-42HuBlYPxv;3|)3 zwTcB>h|fQiTD3@dsu@a)pRY-+T4GRran!2U>j+;iMZs)Mt$MwhT7@#4FYoJ3@|UGn zZNx6wQLA>;svWgzN3GgXt9I0?9kpslt=dtmcGRjJwQ5JL>Y`Q+Gt(Pp|8d=m#-nZ0 zXor%gB2;OlePd*xF~~kLI?+KI2Z~Erg;K;@1nvtV0v7Nr^5Y=&naY*#2U>+DmqCbp zm`DeL#arYLQ!2@#Bo6$PGq@=Q(&r(IlPm~Xkcot;h=&muTeM*OSVU-kwp>+y>2 zNItU$uP8eV!?pD!o`P7EF4Ki}#G)Os=vjzGi@x~95sQo;Byi%SzRwbt<$0WPpGiN- zM6BRHljK1vqe#Fn!bqS*D{SP*YfXZX`wNc(D~LtkeRtaX_NDh$&*uXF39-Txhv@d+ z+aQ1Ceb|IKL@-zj^&GVJ{tdVFz3y`a(;&NP0M<`V$U`<{1N2`!1x`$DK&H>x0WD0JY$E`lCyVz$X(u968?5 zHb(R2Y=-&Wmu%q@di?tDAG|;R>;JsK+Z&e38(HFo6^DSTDH&d4_pht-qP!_!Mw^K~ zASak*5r8&f!1Ml(xl`YoxC$Dy=1^2PjLZ+wh&T22W)CDuOV@HEnTFu_;{_xL#{m*NS=^t$?wcnx8JZiO|5Q?L4 z?6!&H zT%odSongMJc@a)rrX?^!bOo?;{}T0TmN_nK%9%uzm!&Og(jjQ_SeSVfvK?mrSH;Xf z=hT&-EoR>RE_8>P?=bTnX1>GBcbNGOGvBg`9cI46%y*di4m00j=6@~BJdz)WC=q(o zySy59?k#Ibc__{}>glU6i5QPU-($-N^MdZ3*Y!#wV;GZxnRCfd8CX)NJ0CV z4wIZGY2q`kwOD?0zkUnM#4Hqohcd~6IE++gq%kT8eIDc@WvSM2s3ZCC7E&XO(y$?= zTEV3fZgiP2K1`J#$UI6V_hX?H-(r>|55bjSmXd%aaUhZ;gl%5*o#d(fwdQ#*w)w?2L-;~~|GQGqtOfkD=LG(j z&hQ=ZzXSfC3HV?3#V-!{*DA?U1v99OmL@bhh%rx89ptoT6WNCokUj{&D)I_x{z- z1O?&0@$X@&bhQa9pbjRUr6(YuwXSdP-FK%R3-ffpX~s2sUeI?LoXPv%5cWd&eqaMR zF>W5WhFMm;lap_~y%VMSltpmhoy>lLG1TY{`?HMlG}?BgF$#Xz7+gYM$G1)3c`ewn znpDt==SP5^3cKp(l|E*25ztf0E;tANw!_;SFubaxp`8ZCy))*uCd@|97EZXkFlLwm%-0QARpLb2VOa<=Mv{u+&1X}2@#y1Uqs0f5^s_#I7qsQ z3wQsdU}vbOHTR>z6yuMBq=!ww)bPtg@5d&9`M~=P*$FPK2`n8xxX>T>_J5-g@={LG zt!z}X4M(qaLmYzbgfpO4EPx;)9*yoth%Q@f^i`8)^6N$sV!W7E!{XO7vskK%{y4JW zsBHsT9>WnzK2Q&=f;U;UOBiN50~*Q@dld1LBIul zS#?fPqw0bU$@U=H7MP9{$y-=POe=K0$tYOo@jEYC#at*o4C4Z*rqBMy;EL>T3!Hkg7c4{Y4b1=+x?_V7K^QTv* z`{cpp7_}4nly0WojdEPi<)L@Bq#tsyI9HW7oL1=9byx5Q{jrC%p}M1F_j)>Efmk*L zQa)e?232V-jP-cc@BNWuXe}-aCt5YHGqmyy86$P7+K6efVd5ARCaLoiRZSsk2<8Sh zEw|2A<(N4yKD83Uv#>gLNoH2CI$qz$qlgc)Ps8f?VV&MQb#~Ivl+|(9JMkT>W5?>) zu{w6FjvcFG$LiR!iXE$C$LiRzI(Dp%9joK7#p*~$SEl!2G-SOG$u>#|Arnz36+#m# z6w(hc^RBe`$lOvgOQc?kCho`hi%3XZ)`LZ0z7 zVco~z{VixMna+jrRhFbt6p1X(nT}avz(HX4LYC$k@7~1LU=lomsh9W=k8kT`%EhA_ zdpQHlqg#8iiEYh&532*W?$3eMan}*@MX)+(09&v+g4}X5o{80wM1H!0h_PdJ>{uP2 zoYk?y7r#7KM;^h(pP)!loEV>*2sUl4-~bA1?jdU;iJDWKfn0l;qPBn zUlr$nLrDM_b9G*P^XkWo>#Cr|YcPeoCf|1b`0QCyIudJrQSICnY z*N`5L_6F`}*!;MhUS7eDGS&mjH>!wK;nE%0(snV^WYXBIz6F%%Q!*7yFrq(9sb)%e z0Jo4n%us1?dclRHK4=qO+}36nE+x0&>+LLu1pkj+3J9;|J3~Dz$G3J+2Q%JEk1I7s z!V-9eI>4%%PNUNhS(4He}%#jaPDL8m@!~z;X&6{Yk zD(bXCpFE2KY=FA5R^gb|?1uTj;%V_|2cE&bC^07#=87@slHp8W<$Y!`S71<1ArXrgm`BY>xTpEjP zrkk+@U2SgK6;*6%>XlV&X8P4tY=??&?i#DB*bdU%+;vu0u^lRUw`+Y$NHd6I_GlOk zR`zHZ4AL_m4N+rpmOdH^iCg@mfvtC*7Z0iIQHS|xSRYol1q?<<`&Ka6ornAV=!q|7 z=!+-}lPJ%Fobx!0bnd5lu5!*&8Hre=iR2G&A>lsUF~GA#tfG{slFJ}uArEsINF5m8 zmrToW9Vo90#nK|wk(Rj%RBR$9Gd~QClqwc}6y=#f*h7b%+x!};=c#5q(VAyQMN&$9 z?`MSIeiU$KgvofMa+s=zfey4(wger>4SIJ6q}~rZ+_`Aif*rDuZ3R0dX|@gQUkQ-+7uaa>Hm|wo1H>pcarTZ71*w}CWCo+|`hVCLZ1^^}uB$!XCiZVN za?uWNs;ihQj=AMmMIK=?X#29bZWW7D{%BHP#!tvl*ndnP>*76~((qh}YlA^VEcW)G zk2Y;=ODeoH-m7AwFYyoqvtR>1WAxrK3URhLeoVw@Ph(eeVR29qCB)?z%;h3GtNFoNJ#32XYL#p(cj&z=ZzxvLxBxVCCTwTf z-CR#G>o~=WjkKC?%l5#<^4X}d6~;n|UI&t4-gm2U?7V^|%t8T9j2bJ@YW2BWaf*~hdotg*M~ib~+q|pZ^rdv? z+vU&WE%LJmcddSlyL_f^^c)nx6Qal&V@f7rm@*+$8koeyIfJt`;BjoUfJexOw-6;^ zKoqV-hj5XKePQy1!?h}f8&wX^V2tP5XIm&)B{JnaF_}r?I2WnWeh{TvXF?}%xl&=2 z!=O~M#S^bkTKG~SYcIzar6JsRO#t^ooiZP$2=0Or+!#Bb7T0LOz$J#6G!2ng5t=L& zAzV5+{3S)eRG!6I!bImY_5DwRcRI@RKMAf?y0icHmWIjO<|))p-ZoF6`QiVwcdfl` zBTM$L5PLsN0$2*k=Bxc_eG|_eWAeh-v)KiVHJa>hn-iJRkW!rNuivWb=0i_Qrt-QV z2ACw0*w5->RrRS;;S-!t1kQ~UzpoRzhU^}E(7^}&K0fHWDE@RVsAgQlyGBIt#!Ptv zFG?ANEQ@r^xNwyRFFIJ%IDtQ;O1PAs;NX@9QLG}7h~P07)WQ%>omVxG113i}4o8CH z2+q%)5;H_DjHY@-00jfFFi5ydvcexgg^f~y)_Ch59O9M|&}wIEhLneabU81a_aFYa zAa;>O@lc8xmOU~=OlYmwaHGck#C8$-bh3;_LU37um>VVTM@Zx2{C@s>?dg)2J1_Iw zTPg&!V+}s4k2hu*H!z}S&$qzosD*R^CV1&!A(Ih3k6vWki^1L)0MZ1$uE@7p-xvZQ z6-%TimY*jtX5fa~ZVa!>oLDyyG6SoG)EhO(q~W;G)0(%5zDE+4;vT7MB)L)z1}85J zPKkVY(3RO_S}hP1W88~&R)*xLb}dS<+Qr0h3w0q-4aG;hkuxIFsy#JZ*a#gka=?k% z$bqKk*kz4$ z_@#C5JBtD-kI7oQw0u+dr#ay&7bP{_Wq3ysYV7#Jt;QicteI;Cf^qtP9>C*UX@h zc4+DF*cPy{+l45RjcGE$20{IiTO9Ky}<$9fX0Svikv+_wsIPg@w?} zXSlN9=EKT@({EL*lYs<}>@&`2_E6@{L(X_Srg&6~KZXwAaDld>^Yh8tSrcVWPmMSm zJ4hu|w}P}vaKOyjwc9ICjr6tiHFK>%t(VKITvsxKC8knHNZqs=vZDZrk}WS!+is5G zCU7gv2^Wr5548p;WL@M7(Ry=5JOK}jL9l;Sp<)Qi(<7dUN3KN|e4QIU3zm6>Aq zP)|X#_0yny@i<%#!fc!NzbCNphv56!l}9|#{S0(J1KrO+_cPG_JgJF+?q{I; z8R&kF(%3-vGtm7EbU$0#`jP2={^rSNScr^`!ua;D9zf|Zb)$$yQ4;u?Ggk{K@jjXd zQuD-RuFwJV(jFJnOeQi+GYj64E~?$AXZ5TwqANjd7?E!p^yb!crwl+ zney0GQR0PC=#;zM3$+_FH`aZ~c;XnV_y|PYMOud{^rDc30rR!X{6tCUGIKM3t0e73 z_me8dTpq)MNY`gVC@&Mf(hV|S)e3~65kDZA{Yw~14?Y3@hVUPe-*6#>L@@7=7wI# zJpuo4JvYE=K@4W(aUBSqs7!$#$>JdLSfX9Tm`Rs;0mz~c^G(&7>Rkg$_>m`~I1Qs9 z5^fsDu`fXvC7v4#4^d=3j}o2nNV-|TnI9&x>oVnw$P0W=$?UisLF-cZ(;+3ec0(3r zEYLauh3_Uh^jPGkZknZ-WyL&|c{1Wk3F!qfhfNaP_5IirEY#65{a%ZdptEr5oSQ$^ zFXKPu!hvO#2!+m&=wdcepAplY)17IVr;E9AW=)}}ov;Y%rD5to@n(*_8C@dVaH_iZ zu4-{IL8L|Lm(GY9ud*lJDFRkQ^z4K74`ZHsMSq5y7yqdwD0eS)FB|C1)Tl;QkV-)y7FAQh&_R}4Udt7AI^~jrJG#77cUp#i-=pT6B_{1x|V_i6Y?JK_62T!KQ6<-{tzGakm=b|4R{b79jg~a3GACjV8;h&vy z-0>r8+qeD8Y%!U<@YweB??;leaT$C1h>uTykJRj4+xa-4-DADds&{pckK>RD$F&-R zqdgdz_atI3?R#XBT?MpY1 z;1_zr3$xe_;J+T;Ao>EUX1etldN_Z@Cj9xb`)86_5zO7f;K_ZdA?B7k5i1xk45}Vn z#g1c#BR47M8-|ZAf2Q_NGy8t8mcNcGwN8u7354wBeT&cfT_?Xlu* zX?P(bTzx)u8V40oq2S`p1kza+m(jj6>_n_qXpgX1ntaQ)BdG3YrBC5>qjq%(<*YT-{TYWLvW+;IeJow%ujh zwv8^^wr#7+wr$(CyKe3MpL6a#_a$;g%rWw1<;WasX3Y4&&?6LY{s_=Vlpr_odrR&y zrj*IR6(~6b9OJABH7ZVF^JQuU^X!wBP3q0^kz%3luh%4E_JLHOX`W!#mu&1TmvauQ z6IUcEBSL>F-Y=A_`G>Ep>tWN0InHH!$T<73d_>&wC6Q{SN!)T=)wRR1)<`@3;+kY{ zd{9MQ%l9Alk$c&@TxEUqwr249lqgA%Qee-GCB6ZW8k31@>X(uAcEh>*8_(V?G|!zT z8Cd=pm?3#5XG>L266URD*=M+81Q>})<6Tl5qkpE6@k%5S91}?3Vua_AOrl-NG|CaF zG$XSFSTdj46u082Ujmo9WFo8@5vc!YHdVK3@rxBqc}3rm%)HtUR!N*nK9KWgtR2I5 zYmi+A5yx6VhTKhj^-LP)>i`P=P~JSyB(A?oqUhiV`+Tt?h;5qbEfp5G-HuLn?lR_> zZ1TYx;=OlA_lO+VcZkseWNFHO~v8pPicy6$!db@#bd=h;Ko$RrVDvzf@(cf;kt57Su6DKQ=#FiJAWh% zU)U6u4ATn=YA3twJ6P?qlST?nLq*2r2vG<>PXcfA;>p4!W61ywV4!qR`bd8-_UnL; z{@*%SqSu8rO}e!5`rL-mmp}n2G_rDh3wkL73nkokZ3hW9+X~+5{$BXrSSb-GGsqOE-_e|Z4gR`LuD!G_RlquHM1stpE{Dv&! zbb6g_zn$Pzr)}mO=>zYY)5MLpswtaPt4JrjjWYW}_oNACWJ8^QL;J5tN{w!s5UFx# zd4^h^THGEZu9d_smNj!hW^ra3zK%_rds1={X`gG4M~s+yD>nM-%#TpykIn>>zf_sL zgX*voa^+ycU=P@pa1|P;@^yG|KW9xmR3@4p=m&_uL@F_$l3A?xBT>hez;gun>ULh# zSai%ee|3n=aRDNtM(pgO(~@51}hB^-j#B!AVAAReaW7*Te7WYY>vu?6r7cGVS`1 zM_KyY0*@hRqg8mzsa|O0Px_y;@WC~Lcd2CD%o~gN7^U$$d$n`ppL6az>2&A%uWa12 zi5G(CF0J&bI9sV3NccNWEZg_yF_#nGcI{aahoo7To9j)Zz!HbT``_Dek^P6}~c z-s#FL%9AG0oe?o4KDT@|c5U5dF9vUUbT_7F$x7O0WanauuDjo~*7Xk6)w3zGd!s8; z+V9U5yZ}dw(gl8?Lyhk8orgM@RAJ{RRlc6ry`I<4?e9v){jJLvW}-0(O1NR|opf*$x4fgIFv zR}E@G&#HP*I8(W#u^y?NWh|dPu^kIs-nhzB}(gDFfT8U&+Ka&pE@Yl z(e`=2fij+tPYag=Rgg$vnKdZiM3&#DGZ@}1T!fFC4vM9s(&-LTph*6_^d`+0YN6#kiA%U8lfgJ*dipF+W4E+?^Har5 zB40fhLvsDYe);dYd+wJuoF(d)Nn>)NsKbG^jmk`TUv2Gd{vJA-IH=*$@iFxN{N47M z64KG1|84n2(&fqsaPvibdD5q{JqO~nyYmBSr@Y9-X8Ag`BG<3}@y92`k15D9zFm-3)O z-#X93)?DshglLrm%hy)T%EN3EjB!{@s6Vda9ZVOf*z1bO7W#xN&$rJmiTFiX*-?Qh zvHPtbC8ol{OrWV*b5~~b+BLu%iO<`D?VVSLBYKh{O=OMAU&BRMB>Q%9qQ9^$i z%E~CJNLKWUE2p_+4<|dp8d7J6&vO8I2MAEMjl%fBXJm&d=j+((uw+0($8nu0W4R)D zA-PDjSdu0$316;+Gb0uo*yo1|_M6woEgL87Y)@q?WN)q4m)cOCT|AVt03SRSSdc;#m}CYSYfA-o5{(Y-8pl+jkOw#-ojuF z*dfe<jn zsiHnRNnb8Zdb_>o9ew}>3baI?0 zXV-7Ja`E#eqqLsdh^G%MR)QWhqx1Z@j>3Y?=TQmxl>sB*-Y_dKutG@G8!4fNuM zYam|N7W{_QEBDIoj&M77qgJPP&)MjGwC6(Xt)_5KknSyrE$1r}iL~(EDU>J*!-x(E z5I(|%@e@AyXF`^(<-iz4G>~q3=c;-62%3Ht&LND?CFBTl?a0v^#7=Y?|K>kQ4j2OP zVGF!1x?t##s6>KhLK0cdb3FSsmQV zl1z)Kt*AqJW>qewG&iVLpbBfKR$J?$>~dH)rGM*p((q<1VfOLvRJ_{7yp~|TW?!lB z-#*79DZ0;N2fPa_b0RV0YuqFy;*D0Wuyu66abV__2ubfVMb+5DcID7@V4V?K0V5Nm z%+imET$-Rg1S$9f?F?}pKtCwGjwuoQE~p}bkKZf`c#hpYK!v*q+a=wlBHy;$?<8b) zl_bZUwp+@j>;}Bvl_-V3LFIO;G8d)JDN{ru=6|hiRVSCv4Gv;-`z>}WBanTe}b)r~q_e)sA zgs5YpkFlMOuY#VqDjyKJe{HE)2E@U~yui6@ic#0!Q-vyxv>HhI0hH{{yKj&`!fb1w z`n3I&M*79#Vq>FJZA0^X;}z zAHjvF?XPz^^Xo0cn9vKgVv-;FNu6Q8Ub6v=%WtI^=> z=}zylYt0MhD)y|Rw}uD;HK+dbTVIZ=kTKt;v37P2gxt%JI9R#N)R36hZdx}($(95( z=y_OjwDBZm1OAu&Fd^yPid8<-LMkayP*;u&w9}2jT2}RI8l<5FQMwWmEky}8GSVMh zeeJ3eyXHA@Zj1;ti`7p~&@t(x`tgfN)eN%*A_)O%7!h5woG=t|wYS2z`=ZX_7Q^I4+SEd;VVjR|) zKfAz03XR>yw+1gV!R$?veArzw{*s0wPO;G^;X-RT*owBs5=%ZD>XgH7X-b41(gN> z8r3$j+yePY*5NFePRULZ5<1&NMYC)i0umKVV@>isYr}@ciG3KHgS2v9by|o&YDTd} z`OM3fNeQL-u?9)?oL3ZbSS+<)eZ*;|Qn_8Roa%(hgwnb~v`D{HvFg0#Mqv0INU2Nv zA8`Todh0;$8S3Tw&djqd!n^e2uRbi7ofr6EtLF@FtYFkf_n1}wM+cai^Qcu+ZW1@i zPI4fP@5p#5rRVsnM7!Jb)>7gzVdp-A?%mP=b&B;#D0HoS-H?;YF$Z>Y(q=o+OL8cE z%~8fl-JFwY@XPk$Ej5EA7(K_UzG+(Lkd0)}a)??dzEUr%hz!EsX^V#=`?p{IZCJwB zPdByM*xOmh4t?&I&-)L!pw`1H=K~+k?rKop1zFH4oG0|S?faRB*nM7Cg{2K=)rn!` zi0~T?QiZr5V5(H4y8&!8hp3$`*TwI+m+T4Ci! z$KF(8CUzorq>MWSjE$zKz77)LM@HHwbJEj;AF<(U@yl@q&@q=Lxjki=tS_BCS^c2% ztV+zK8-#mY@3fHaC=3aVl)=}DDsNvSD&Cq084)A~$=Vi2qX!8>Ms&4i?|MCc+jv;1 z-5!2{s1c^QS#YdpuxV=X`7MQfUo#S*p*D*;O-m)&Vaycs8H~~C$J>Je&bJ*9#aeh@ znvJNZWt-OAu?HavG$(g}92$?tpx$nTtp08^MnJq)AFN`b&8;*`_)DO2WkKp;nmSS{K+M-C9EDtrQ@!d{&PQDTei4wy zMXsReyqnypSd<5EDObaknkYb#bvmPN!p}KFb?$Q-N}D#xF`0KyJnl~wLdh!5x~o_( z4H-ArIX20sk!nKj+?T}C5U;KzV#RA$|6Teyj(Y<~v4x%%rb0OSl&z8!qtq98oPP zcd4D@885&Uyc@|+BNwcQ+pU=+Ndi4kgVoV5C|q<-$WqA;i91HW%L;AmeTph@W>;8h z9M~j1WA=90oMr3qaAZ)8m%v{S1m;{C@Jk{(MDy)HI2HbT5wPf)_2+RilQBw)cY%12 zy4I^V*TtrHVKxoD*_%8JynsfVz*E$*`C?81d)8J{&ei}&AL*KGEc-9Y=&rdf1*D`2 zA8gb{c$Z+fOl(D%xFXrIhn4c!T>tsDTsZGvr4fX0e@qwpuMu)Yq7c3}4~F{|JQdNx zaJ(0q7Y<1hHq=o6;lrk1+*wL+COk2F0(wzT$)bYn1!i5_k_FwtI?&+OZOLMC z0e>zml^Cb!0dre7_ZgPHS+ySdpca-TSlj#l%n0JUZnXT}l( z{lzK5&rIG}JP0vno~^3u52)KRcJD&g@p8$%by408)F~pZ`vn=;nwQ!Z(ydw^4Y&BPgEhqcA_j2s$^^Tc5F0aHt+p0>|5OMT5jB^feIn zf=2u+I6ruJTUvqBak)&3jKmhx6m5F6J?1@_-6*214!`pYy1DX}CW;YC&u6x!Off98 z7BsR06LFHi&F1y~3MtyOe$^(fB0B3ng+7M3Ui}|sK}jgbVRN*wjp(MU(H^+k!===E zB0%*=Sup&Z`cW2qgk;tTBTVU*$L*JYJ)!GW9;3@cbuNucZNi-J4T1y>=!!*R!d9D^ zlyQgKgeDG*we!pwfLokjcoi*Q6UQ(3c=$Abu{C7<<&@AJ;CKO2HPq5iW%zyGyS`z9 z_`X>aXnTT&jZ~6bl7UqpAHPG`ZMbm@HO{n^o*_0$+r_-`wZj?x2#>5WC$7oYOaCny zkD5Eu^&J~l)%ud~fuP|KR>dK#ibF&V7mpe`8o?X+|7O38hkR9yhiIjzcMo)2cwZ@M zFKD4wlfc*}s7*nba-B-rSb1iGsnckstVk*yZJ4JbqqX+X;!%qi`&C3!%i}{RGd)zz z6HD8WQZ&eI=%jV8kUR2eQz>CcUUW@mRoYZIXM(0_s3QY1`^D4Gd0!t%Ly4mIRjD)G z!SQ*G98*l^F?5e)&m%bd4)N--D<*N9Q8p*$i;0dJc8lH0r%AI^wW*j*qu4qIXRC_* zy+6x!!?%8aw&|Ad|3F1;5%dfj)IsmOr5}4Nbwh3lc#bzOr(zKBkhrVFJS4PoN#i{l zVGtO}JVn49BwAk~ghW<9-%Zend&5#!(1d#*<|=(fRIHcl=~U2(o~oMhDtI{Mk{6N_ z(wr&i5!|L(vuzakFo@v@(+h{4#DX!atOl)V)V6#i2rz=V{$F_`v)IB(H9Rz5`7)p8 zL48DQ{=B!#Mh(kcy;>c@$(_(tCtX0``Mv2(M2ELu<36!zYXK7TJ)T1r7oyS&o{ zscVNlWED4UegVaZ7PG$Y1R>D(D>HUwK_i`@ACQJQ9zN+on!Id?SaR&E*Y!Lv;w}#T0u77aIrpjkQ%h3E%<44LAm%C zQ)Ye*A*qE`ye`kY33&VD3VM4{;%&}Vy|1`t{Lq@Dk{FqJ`pwt7rz4tQy3R_-XMkfA zZOoiDnD_lmZ`RZ0@!epgU7f=J41B8)Bc3uK}JUtbM-v(HYm_k{y8+{6qLry}Iw%$SL5MoPC-P%j_a zYe#-Oc6Mp_Ia5C5F!k65D>zSLM;%;!tI5vvtF`64Jc==dYRX|sI1?h_9s1#XhVOjh z<@O=(dxr{|1^D~?@~XpBf0|LNkMR@GyAUi3K7yt=f-PW}4HAISkB-F|K#!v0s3+sazOc8#qzA8Qr-$+bkh973ISu#*s>KA1S-&@0uoxD>{%wR4mzaZ0bFlVw8C) zWy@XgPD2w-4Bf*B1xcZoH`b(b1QW6*8rGb>R#U|bMGko2;l_Z*O%L#`H?P{4Z40lc zAg>)apsv|39q(gVAYRp+Fl(#aHktfXD&bKAahYdk}W0_TD@ zIi2fOb-=mGYFx~AcNW;`ML1-;IXyqDZ%62+AI>ty$&{Q$zK4PJcXj~jNmzhn15tuI z7gIvy{b~T3TQk$E4iw!oy%^zabhEnLT>U=alnwb5n%$wA$*!6aI&J%|Zg1a!jG#`i zcz#cN%XFQ;0lKh*u8<(8?uRD}6_=++&ujB`?+n2oG_|CDc(|lw&b~vM5)We4Blq2r zo7@xN*IhX{eq6O2VL+k{`%?G#o@=wARjSbWRbZlMms7Scz&*FS?(}Yw@1#v^J3y{ z&*;TG9&p)s8EPmjT>rZenNWJ`eN8{ETh5u1 zk<-hsZ0yl5+Yp+NLfZrd+nB>z6_k0VQjObG^Z?@(+2IlazT&E?J@9)1d6aMq zNcet-y-tLc^m8CE|4V{6d;(0C=&}2O5gm`u2`nV3Gj}TVV2rlOj=|4cKL=-Tnh$nF z_0NhG#|<%PXtS9i`yN!NEx!a9aN2zdD%i`0&qVA-h@Z`YMHt?>s+aw)7WiM0i{75q zHUAUxdu+~I?7L~3O)D_nKU0$SjT(^P^W$95rQ73oIGf7>car{*?P5hB=oRCj49x_roiysn8&TZ$w)v5{ zdVx-|+$tzFWqI^r!(qy65uU2Ww{9vacyQ^Nb8lBTuV4BX^yj^HCjmEbS}!{G$=)&G za9?y2-n{nljlh=P2yCw@c&}KDHxM%@55eWTFDfQdC8ViD z6WJ)Y!FLQllUVpBYZFmDM}f&@Y@L9~moxkdEm_)rl>svYB0JP_Dvt+`oq`x^EYFI|@7VMB`!IF(w)^?G z@=DOB^(#t)yo#+aYpbtTDCHL8v)$@3kAat|PwT+XK_U4L1j>iRvU+55gwzB#)OBkT zJke4>e2WGKFZnAkH)d^tSO!N>MC$@7Hnof9ZZ*o|w@a`suTZXFDXwdAel)B&+fq*) zL2P*6LD|3=mNrR%z9(dQzEfg*clvZDU`fH~+dB&`5&Wyte4>W=;`Z3i`FK}LOeYPg zv{$Y7_h3miXt~2*ivosHuHuIr@My3i`4-Gsa--Ea2Y8#T%?^X;ru{Nn7-n(uNhD@L zOmOyDpXc)>YAPRwr5KN;Z-*k#gRAi~MN`{OHo;l9_>Jy#yaqgm< z7YGG?$I7OGLC}_Vyz@JpUy!08Tsv$7TPTuwms|Ftv(K~HBzB?p5wNK&b4fqV<&7#{ z9aBQvV;(!()TClFxnJ+x-H{oPP2?w-*?&{%!M-0pNi#xorsF>FKHX_o4wvzt2F7 zX?M`GQJ&tAJz2|odBLR4vW%0EAY5`yD`Q-+8vSXF!*r!H*2kRmn351J`n6zER%=vJ zcr6Js*irUA{soQ$g^#!x5`DZ;3Vxcnl)Cc{H+uekJpLh6G9)^^;Cd4oeZAML23iR| zDNAUj(IldI=tZtd+es8@$S%p*P2@@}zChi9Sag=G(*a+5IqX`Z=31EaZ|N?13Zbj({JM8PU?Im-0<#4$q3q4j8Y_K0M z8YYYjFjn+xFtSmsaA3P*$XC`NR@CEXr71I3lxwK}dDm#Z)SI5~xC{R!l)jWXn_GtR zN>WukQNLqP$eer>J z9|CnAIC8vLQ|qeQ1p{HkX%KFSkLA_3~$(iKU z!Ow}|L+0lk(dyL511Dser(}j?DzrHzt}p}}QW6FZyZW_~u_dZMi86`k3i!*6LGx_s z1D#$oeSgo(m66Z;E>yT9ecno8&$`yG$o?|fB7_w2ZE5-OZ{AfQ z=f);|=+u3Sw6+KH_#Qei8&C(ra)*W#Ghqz18Y#v(~rkr1S zeepLf#`=-+-7)2TJM_c8Xwo`4-LF?qnG@9fW`b{+Ctc4EnI1TRS+lLjGAyz7X7B@Y zs{&EYPmHciyP(lW>g{(W)+73ZXGa@uKYPnxXavxIcJ<{3JMQsI4X`>=vhomD1jkZS z6ftT<%`r^k(IZ2!{K~{@>+_lS?mde~4CeNZSOg&%4&rM>6`b)A_JSP3?ozQ;JvzwZ zlOi72vREUI;5d`gxHv4B;ako^eBIM~b;Bjc8G&3ltZtE3PUVSf0zMZp?j;expYV3B zuh=#2-t&~=M%!?0E0n8N{Osp7=2*ToFQFZ-kzuMQyGn4khB1I^gy)i38Ot5 zwiVjlYY^o+)7ebd4)aTbCC-}IX=J*>;-WRG%H2WU23!wneNBO1ohOmq6+UPUwZzVmo6|V(e+dapx3mBo9cKX?< zUl8JnIa;8HK^8!JzhQ-ouU`Nx?fmV%3P{G)D-51y-a`b(F!$eyH>MsG*|>>@sis+u zN$@Qt2Ea)=9d*3QJf<#2F%-1#C7@r?{Q7)2%R_TTkdihvaW$Pxd~(}>RzDP5bh1^e zj%C@dm2vf0k*$jmUJ*LE*;DGu&wi%EW>-|jj zp@r*5oa3wM3QK5$8M1uc6Vzbb2*QwONsI5kXSS1{h8>J9dK7zk1_6uUG(3-FQnG)h z3v)D>A?6zE=3f&r|tO62&vY4%tuq}pdk4dO!^BiB$YSCsKxy%;_dCx zgj)}{`BWR`U0_BEUuSYowr7`aEZuK9R3S)zG1N}Bo8RM(7vjXyU4*wT70CqLoB161 z+HGa`T|uHx>K@}Wl~Q;a1QRXcmHC(gZ_j=-S%8zl$z>RaPRvTw&E*Ilz%&q6>P@BR z<8%%$wp7l^K;H0NJ#`(JgNIi|n1{R;PA$R(9i)IkIx=&ni3wlfGA#wE7VNY4km$8q zr-sg87(cH|(@bN4^fCi}}T?a?2L=RcoVHb)DL!SEqo!w3)i|yL?7^6dL$ua5uhd@;bpXT3-oUGs z=+D!vC*c=ZK7bhcKnhNm7H#(v2F$VW&mi2W6`j)<=asaHNa~CZC%yHZaFEbzq(iJ= zzSlzk9fc`DsNDoi#qL{MLLb?CI!1{L8m?>Dxuc zgoxj>_TLP)h#F+s^cmzCMXm816mQEB*>REm4%9jI?k;Su@|V}bhRsg{m-0ejBHXjs zR~+N5a-P{kre{EJbgNmo^4VA0B3rq3RV6`>MU=6yA31N$g8D#D9@(O9yp_`5SQAY3 zq~5vwnmw{D80TL58#KDGX<9IuR7Og$J08Jh3jk}C$QqoaXyVuP0#PJqlEA8wl2#%6 zM>4q#OUu|HaVcD0rpobErs{y#x-NNao(oMy^H`<^a2I`6geG#lXfy;Fdamrx+LdKT z8@Lu)bBq(NS~1mp`yy4Si-ffal#OM16jK}Bkt}=PRP&fs%N=3e)h)=iB|glWYlQ|W zU*s)YawE+Sdrar3WIP`h1U_ugi#fq2N*}lx!Q=vw95d!c1%rbr6Rew8az%-`rHbDo znz|*ce<@gvDIl(?M!7(e3E4Rj{qlH?jv9$+hySgkK|DX|L5}a=lQ9Q#BSJ$wbktYQ z{KG}vSc6&Oc86@xEkDOt>xjf{aqJsLpXbh8kdxUObdZ_N1-s`=wc<<7T=O;?h{tU_)GrfCEb*e(7P4y1?%VY!D z4i3zT^>FaK1)u@dFKob1*ft40OsfLnTASj<@B#=!3^&uz=POzBst?<_*?}W(OM}Km zn+%9?fOs}grz(GfK)Q2eWp=ne3QIMe?v0?zjJrg!0c%pgD7JJvj}1R=F6TA%$6^fB zz|W?f61i2!s*+Lua!jAr$~fzII?PR`!XiMOGQ4^RWChUmezLj2-$h`w__ zOW9MLyGc_q>jNN5gQP_qeqV>RVkMGb#f{XV>p0SffuOKz$+B|G`q)jwy}ym4ikx&= zz}wRM(sfM)7P*Bvsrv&c>dFQYjUrlUw?j)La8=1ln72Vk6a0EgS}asb|NI-2LQ$|_^0HaW70yfsIJWuv;sQE&>06C6qE+^{!*ll-a0WwWBiNJy0Nno7d!j4U9cBcQZFpsK;ou_ck}d ze!GyEP5xlzy8ws2Xnn8a#yH0c&b}tTb~xQ+MEGk#Ff<&qy?TRGDrjF*Fg0?lc5@zg zmqZ&0ArFaZ&Na{Fj&;{Vr^98-TRi^D=U@+`5BcNnEal=?pU#Bc{I!lCcBWqQUI7_i z2{bm|z*R|jiNtRodoyQuPsK#lUf#Olzlt>v{hV|zxy5o!jAYM;jlK( zvT@waCW*!FG0Beg5p<%Kta&sQIK8f@sp*r6JW?+V*hLx%>RJ^v^iE2E8MVmSr55o? z<3;VZh6)ipQqKfuQ%b!EernDojV$r=su;!VgKerpqn#Dd8f!#b!~;F$RShL$&N?TY zyU3&s>X|r;*CgR{?TUNWgVXw>S{P(C8^hoRX?c*B25E6WqC&k(g)B zz>QJd%=)%*YAd0=MN#FCsBi@UyFQ?iE9Tx(SIlU!-ce0~{*S02b@Y#@@U8MAD#Y%5 z{)#w#ouZ^%H?Zv9$Fa!ml=5JRKR0ZYq_0zkRh;%A%5!D(I31z1OW&tiH!Twwa-7%V zK*(K}65$_%oxxN1(;|=OGNPks=+Q;1YNii>%WKkUE2usegL5}POT3P>h4nF&Z9!!P$cfvshoowu$MtA-PF*6{y}vv#1#L}pSq`%f%wu~3OFCPd zbz+ZcKmg4Of6zN*IMM>`E%f#}9`0g1O<(ZK39h3p==&xWQTNIIsmV#|yFm|DqCYQ9 zKT#bU(tA~Kn#pvno1fQvX9JJ9O)IsEFWkj2GX*OR6rz?Reed>#+ZI$&F1HWcyb9c1lgU*?VA)AJAn=dE7PkKpQbN15Lfms?3 z7AkeEo3(DEqgaL=1JPz=AZxf4#uQB9KY3!V+q@0!5cYtAk_WVCY6*~bTAGu0gOkZ^ z`NEn5sU`_~HR#|7ih-NiXwN|o9}^Li^)buT22IWi>7WMi)s^q}ZvjI1hMH_*-tsCeap#`$ z`i_(a^ek@jWi0UvMJ=q$7ube8>|gmuRIo9|iX0~qEfZ zlCg0GdeS-!KNB5fuucY2rMU0M`ca9Ji_%p76&1!LSw7N%@SH^ma(ekn063A~wv12= z?`*QBjo-xvDR>;Wc-Mih*U)Zf+phIQ95a(7tX-5gjiFl^MFELD!c|W(!Kj@Uzq9qfiGVPbubcN(NtS0WKj4xa z6>CDqxy5E;bJ{#;XMu_f^=~;(6Mz%k&WkF?8m7NObUPZ0x!gc?1j&2n@i3~kXqGTV zfLoN$9ozN~DMPfwfR><~GI-b(o$u*~k&PabIE$yZX&Eg40_O#3Edlo5A;T#h?5cZ$ zvG)AJqnD)?NMNe^8+c^jQjNG&SwEh*29V8f#xiX*Xcr4smto>a-_WvOAHh|%|LcIWNp8C{uA6G}`N)k<+!$G}M;F?C>$7JnSJP*MaAaVZDhNNauIG+i^g( zk=FY6ZA2pB0gi%cWjPL#tThW>&;@{#i@P4k_#(^4xC&Z<9o^4SZ<-)ryNlcO7Zi5H z^0pzQzI>B0WDPJKD%r+-%r+0Mg|0&--tiTL`5P>I(ZCC^dV?*jSMa8a9VhOandCjW z4la3=Zoe1WaQL^ruecNQ#8!_M3_8I}pNtfC;d`fhFn@Kf1oJ0j53bG>OwEN7LqX!& zw)UQ8mW#el|Ki9H`%GHHb6Os)V9D&Z*e)#)ln`eSv4zSB55MZ&kzmVu8=3^}-83V{ zllDG3cJiMe2LL~vH85_<%fA8uvFO`70Db%%W`FTsHH$>FD_X0RG0EBJO%z%D&XVKW z=8~&v8@@*iwhKe0&1o97PV#V0mX{l*7pg`VFp{{F%M0Ws)jB9cZ2MFT=c}p&5W#Ka zi&V1FxMr|5j!VXZsGunYN!1)K?zc~O`%8XUg}mQCtOC_Ptb#|9^WG1u@LoM?_%EyAkM&?et6ieJz0#IK zan@NHwd3?W`46j5wr+Ou!z!SR|F8;kKdb^-6sf{kBG{z#%pgnu+w1?Z3bPAtm(>4Z z6)^r~722zA%fq_Eeax*|CkxarJ3YEC^}SAPTfu>eN9u_2khP;WSV70?DGbzD-*3$; z?A)Vs{HLL@m?$39u+kuCp=zIs#@y4#5$X3?3P&BzvOsbGqC4EJK zO80BGG5lc_bo|`c(|Au&jCvu7e%k%ZowczOk3|S8l~>#?pokrR|H~@G$(A$#d5iyS zY=l%XZjhEIXlByL3QpBoXrvJ}cW}DdA*xjY`WK~-@8Y9YDV9fBSE&+FC)-vK%?Pg- zoyjt7Y5@daG~fO8@2~FeLcZ7nGM#;V3Bgq^$IVB85%;pbGB3p9}wmDm?y+Du7*$;Xi8qpb9#U zB{*+NM2|;NldeCgf*myTR{#vF^CTeDI+Rv3+0Ap&)Bi#h9=YiMK^5%D$VVL&|3MX8 zauW0ZgDNEO{GbYl$BIwgg)^UC|3MXA9#;N?DrnX}v1t7dsxXqntn)9b;A@v~j!|;; zMPJ<6MP7AtkTBpOBn1F)e10w`mBsgU%~27A06~pGV9d;!2%>YV=kVxzzrz6b8F5UR zr3Hd+MU0Q&q)7z6Mv4XR93|R+!SyRuS##pV=D_X$ zMHTkl|AQ)=Vk3vXjqd!Q3i$t^3WA;L4O9@V{~xLV&e`5A0Qq02LVHlQ7~d%K5tRH7 zs_@tNUsU04;RjXtEfk;dKd1uI|Bost|AQ(#ru>U4jIE+1{V!CZ>VHs$gynxxg$XPx z&DCxA85R9P6Nne{$?ucM0*7*dj^dbVK&MVT?Yys)BzKrqa_~Y;MiVlwfR$r(-QIk+ zB^|fl3N%^+{&&`!w;Cja5q&W#)^0EAE6k}DF8zD&>@dCk318Vis6wIb|3wv2{b?Do z4JD6hV*u=Ki`SP4B*D3CR$M7pBbP$0PQ(B&C;I_D9HX+_Ozj8Qor3*Q^T7Uuh3kuxFc+(m5#|ykvQy3`Gk{_5_(-99+%>``s8UDOoS( z<5G+?r#@#+3Mf3bXxdKWtVAlhSWxalm_W2P!K!POoc5>cfrin1J-{GRh(d$Hz@`cr zn;nuMHrrsMg`l?58cd);8c86*y}Wt~z@d}@I?&+Jq{LZOWolabJ+oS5#rEJ!E7G?4 zE6RzazLRjnDy^3DaXd;49wVrLdJ zSTIm$#Kf_n&ec~3qUsWtE`X+==Wzx*4$dV~PO#~v z-!vZ+a~|X5>jYuj{Fhsx`-VqSx}NRGK%`!tHB{#pF4OH zFj_?i5c^E1?814tA!mUP;qgb+vk)H%WOitV$Cvo#TV9o*j7|18A~#k?ZX498vHw+J z?6U4|UjG{i_cAvZV}v<=$I$G1Q-1yvac{P-Aj@rJuFqQ~Vdm#P&Sy)2bza*huCLgvieGlb&n-f5u~AHvO4I-#{+Cr?q7;Z<14kh_VRL(8)cN4eDp z+?_>h*fxVJMr~%CRVi+Htz^5>o(DCuI*F%$SGSnU3YoUD@YcTjz ze}i~^2JzAozU>3-rn0*)L2BqnFNiWyQnjyLG*JSok$T{<5VlUPVdaS_p+L4ky|mQr z+lnta)7*Qa^}A^rK^t^`pvh|l0)1~f_oSh6c~xc{n#6tuDdh|(+lHKg)#d>fZ@-O( zUu$3VFU;M8(VtbAnVyBL&vcnMI~o}bzZhvApoX{HnRXS8sj)z1pWki6TBsLYQc& z$hhUf8P81D>=^ub<(^c@Q!So|bbfitTMz;y+g8G5tD{0)+p0Dj{lTQD!oyK)6}>2% zP!g4{B@asFc(QUt2HT~&0H&b2O*qmaWpn4^@s5zSvwWyOqrRH71c2PO#X0bIl$yFz zk9&V+Wv0QeE_2WTs)|MRYY70~*W1uiMx&QO-9!N@&}e{=YHBQAkCipV^7ZrS##A4~ zqQKC~f$?j}(nt7Bt>x}lBY(GO73GWE$g#9$ubRZ)@XRh|HgB%3nN#)YOY~f|hG`z% z#d_R&bK^0-SWU$>1~;>rYTS>9%hc|(KbyhzIp{jBrb`6oR76QqCAB=>W=d5g1YqPu5iG&_Eye_q_i z?Oo8lTjn%GL45D;4V_sGneR z@=VpNsr^q1{?F>`&*~1*2JQ4e<*F-{OS{D@G$&6~a0bg0!;z|n1MYHWP4wS7s&X6W z1yqqr&-N8~(Q@1q+hd7mzjH3oEi1YRu}g0$^MY6TK8v3nr<~eXKIoEN-q(JD$L2p* z+s(;+Mv|rI*FV|<|3AU(C$z*~%WIs>{rP3G*O#^Yz+3B-x>MXRprNGV%3u|8y@w`X z9hx1u$R3E?+DWJP%=vuwM(w16v9EFf!ci%==#M^bLTaaH}>4Wz_8eVOS!L zWU@GDEbjj>b&f%r1Y3Y@V;W!E#og)?V6}Qoz#Jhgyz^jiUFqLbOfPrhJ@C>&}c%f%_nZWXRp?l ztcV6h)H?pFsVki~t3oZy9YU*)^&WOa*X97Tx_e`&=Y+Nu$^AM6uBO-9-C0YM%5Eo6 zTU9H|uG8Sl99OQWJB}B@I`{?R#n-&<)ZHt;Tiz4Uqz3TQYC;FvrP_NT+Q7D>#xe;L zI?!F8&oIhce~CE61G&~AM1L{2i+l04ZgLw2?`3aF3mpnGhilFuS|4-Ejt9@(I5bX_ zXM-k2iVWX$*b9#z1qQaLh=1sNNkq(7-Q&7p#WX6vi%PK+NKK+L&hul#h=i*7j|I1F@!GXt?uqQEd>1J4dvy)zp*+I?Bw!L3@OJ4uODY`G;(# z1s4w$rM65pb0d8KcgLBd+s*0megANTo)%DJT+&(SU5u;^ =BZS0CAHjR3>X1I<1 z@U70{x9y_C;!)wzM)__2W?LP~_uWwr=!RDc4qF@?wHQ8Ew>X z;kwziHE#f4e(fO3yNS|gRDtX6Cm(WzvsV-pFr$l_>z3_KhEYMO+j>6CzpB~k;i-{3 zGt8QbGq4yeVx`ccVWn7r<_RFOPa5P(jcLrD`j`qVr&>Y{djH3%uwpr-$g=&)!4e~Y zmKWjT@a_|{-o*@&eW-nDis@2AT|*RCr4$+-5`_ln6p#?-BZvul3 zymF!3<6?td`GfO@)cou?ZboCdu?$qlrrDDbnb62BIxS$D5GG3ew-hY>&H8L_TZuOh z=C^0UxOO2D`=OC1$iIYZ0HQed`P1s$(q%{k_xJ3JO|^_?pl8aOw7AAd?x-z2g-5-m zL*^F4U^MnUCod+?dtaQB#Gb_F)flKjq5@lX(t;nAb)xL}Ie4ZO6RoDqyvatD8O&FN zOOSorWf=m~*09Grg|qPy9mg6mNeHuAfA&7O18?*jlc+zt>C1pWV3XG1OfET)lIayE z6vH4wuj7^siZk3h+*DInC|p$vP--AZ>N(CX@W~9?%xwIReBo3a=&V$D^*IB zB&0RJy@f=Vu^cXj@Q7ekgl%Jz3a}}1E zDm_J2X3H-yRd|Xj|NmeIhRPy2rfiYl4&1hPi=3eKfW=ril#cw(K0;STOPVmm0yK}9 ze61>>*$$q;M>NBzoB7d3F7ifCc!&*`Vm!$SJTO)?74C_bS1}keQTSG$(^dS(g~a$i zD`^k9F#LT^ICzgeg#*QAQOM9sI(DdZ2N4lH1NX1sBzNivZo(2=vf8`$P5|aPChVV$ zAtrUh7z$^1rE1ncbu_uZiAD0DF)JR2KAwz=r_Y4rNK)7RWl?ev8vb|=Io(AJxD?9I zl3lzD<0r{AT?Fdk z4^BDbS`(hNAp)`a(6@sq)7<5J=_BFIy=%*wh0->~%~yv`6DWOV{sWuD>is?Jem?d4 z&O25YTa;F3nr@v_M5wf!vQu0CzC7TZzENT+S{4S(L8oGZC}&w7-Lfo8r2P?Q4H-I@ zIs~#0e{-q~(BuEIil|@pvqRVut>iXELM)V!PrmaxPYO*kz`(uyNwL|}Vac8E!-C@< zH8k>TkaW{@z!yhpJK;+o=m8SVVvQIVFLcG7`(c9qwy!0?Cph{5UQ^1@oYDxCV}B` zr4Kh<#OcP8`_D_GD=~gvp;hq%H+(FJ5oRnG<7C8vhB%}Fzz7SATB3ebiH}vFhBkgP zn_rL|XGZSnbpHWI!kcXjP+~6l4Ia=|;2GVel!f7Icw%Lc*vq)vzld;~2~3 z72udjj3HaerDC+GUAA%EY{bt49^P!PgImkG)TQ7A{!n95`&L*igh7#!nGMx|lAJS2 zEMKNk)?!Vrdtf+|(h)2X<~?4J@0j++qx_>5GQoFhot#Ibyz~95DQv>4yzBpU-m{dR z{}X=Ifv0qS4WfVv+=dlxTAc1Q1lWh=^McQN3xKSa(FQ29=^ky?>IYAf9N{%0d)1+V z84;TFObcH{27?w8T#F|XlnP+1@uno!^tSJIf%Dya4`7gThvUSx5lOlyLWQj@MQEIb zDS8Tbc)y|z1d|F@!cim(@+eo5b%c|)WKwSK|G{>&^pb|^7^QZQOs1;P_=UrFhl2(t zZ1Xq;KS)Bb6)Su;Id-!{$(nG@-c_-h#oku)pM1^eKl$2| zNQH~NTo54E?d|Z{ObmJ<8 zFM37M+gfHNjl2)vyg?QMDd2N}@o@Y7y>(^29l>Y{f&I@+TCab&#a-y3NuoQB4Non` z5s&i_OhscxFRKQB(;sBm0%#T%XJ^B2^$;pR^{#)izGGT> zi4Ymv!{GeA9R_{wJ$PG6tiVeDX^CVwaBYlqXeH_|AXg}|!goaf2`nTZjgt7Ujs?Fl zH77IkHBSq)Y54?vQ!M0V8=!V0PS60ztAG`l^5LR1O%6>`ei+dFsB#N@%hiDD^GY>3 zI7#?0sh+7?;1l{WyGT8>93^FoHh!Tl-tZ1^G^PMUv`i=^nB=+!@KlbE+C@zUWcIqy z`>?4-0iR4IAd3Q&9DWRTN$PSubf<9b-s#^UNW19iAP!I=Ffx?t5AqkXHeePIaL>3? zY(z>5%xWwAbUmJYaHNHn&>iZI1eu%RE8f60Fu1ODKM0s@&n_QcncDzr^>kzoYTL$k z=zF?V<7KfmX@!fzVwYq^9w&mvVkBaTj%S-2Xr$Cp#@yq6r&%1GpnHzG1WDzdT&llV0!Wd=4zB;bpzVtIR z`YnV6@V6nru&M=nnDWjs@{CKnTD#DO$IqrcEEgFst7#IZTt5D|0C=G@ie^a`1y9_cQG5otB6#654#Q+TAGb2Z z_>>q&jp_!x7{%mH&c<A z2&Id&IjEpcmEgS=#w*I%_q(HP_@;viB$oei;rnZycp9R_bx(9YPf#k%!#C$2?@#}$ z8vqq!j`8--sIW*QKJJ6rIE1Ev&`~={ME6p13K`*uz~VIoI1G2SGsH%K%I#mWVh$hN z^vtnvus5nJ^WbP}R?Avj-I9yv(7*h_8N-RgCDa4U0EMiF%ovPdAw5J+-~d^L*HXv$ z@8rFy8O5Uh?Kj5oCt~q9G94GpcP8asaiR+3I2l99BY0$ZaTT|u0k}vm=40&9AO}(M ziR@^#=DOdSV>p(`ljz_eu1E@#c7Ah}M@>NH4w8f+qOlf4im>`KgajJf1 zLOUQdKF*(O36(JFRe5}SEM=}av*jOZ>@rP=+|wo?V9>WfxuyXQBy8i#%+qu;!-$Kl zo+?T7a7?WUCdDsq$oNj$7+(N1gZwuT*aHm&9Yge9Pdqd@=0}R912y_zUk_7Y!;`jL zmnWqF4tQF=azr5hANsDb>AQJ>!Pb-}%Ui@VgmnbxQ!7g0o&a*b`jMMa(zDoWTOSF!2t+0Na^YMB(XY!7 zJ9NIU@2Z2Urw=;)U@K~x z{d-jTqerBPkVV~UaVB%#xiq4!mSW?_!i&+rjug|gAv&6Lr`R*tS!+xSB%>LOeiY;eW)Y|rsFF=U8b}G0eLmr0-II#3N4!7!)ZEaQHSFN zhR-jSS{g$!xyg^qr4+F7&&y?;D~6~}ttA4lP6h&j~yY}?4MUR=3@WnQ3#_kO1K8{ zrf$H+ffH#_8dn#pZeg>LLfy>lXpX#=-qjuU)jxZwo&Wa~KY6KL{BL|%`^=CaJ^J_+ zBtR#>-k*=IZ-N6W{@6{4+gWv;bJJkb1<H-Wj;#g8X`*`+S*@` zu+I8SOp-z9qP>%3B+?l-+J~ZZ@WERTCdr10Td&0ygPnty;B0+|E1niQU*wm>A{{u+ z9`x!BX0Yspe@0FfUPAqoS-D*gp-t&!2zLfCI65eoCyI@y(}Z0Bhxm`Gh8;-10ckS_ zx`t*G9y-+PxWz=qOWYrEXcNmiBsAJiG?Rgx?eQbA*WpzNSAf6HvoTi$mxo|u?$A#M zZxbJ2#8m*P<%i=L!8wdGelOkl6=Cvt1hA0uO9$ess^Rq5>07mCM{zo@f*AUHRWn63I zlNBWOMZdHOYRo}ATMx|)6cW#++mK0>JdTr4(Ga6|U})fvkfl2Ew#88}HgFBd~soj>>vj72>0Z;kOZwo^NN;#a%88XD>uSTJx+YenQ28iu+<6=3LT$zgX&GeDErkyBnF|EuJzU+k>>Z$uEL!c z9p_W2e^Q0xdosYWrJqNqZ>gQjx5LtK{P2Z03O51C6DD#&5?BQKCy8k+CnNIsQbLCp zj4eM7i8Xj)IV8obsRWMvvpQ-eS*5y8w>Os5=B`jJRWOD^$z#N(Sn^$PoJ0fQ*PsaKR<<83v(YbgqbZvPBUScsIR;1ix@T zjN=@}DpmwnbbJk%ioDevqJZJL`7Hmr^BsjdWf98&`T1(*!X{i_49xK?8<3l2x9g9V zR?uB618>!TIvX`SeJ{gw?bUiCo7ocf8>_{~ji;~5($j}uUpLfpz<=3uLnd;=#{$DK zs%64gIr|Z5;AWYfFesJ8!dW)N-D4O0$#YO-Z5p|=@`Lg?-8Spt+S-wt=Ogs#0;eB& z+nu77*fCF%kYeRQDJ{1)9}B(x0+TL>xReLXO#69P%%Q6`*0fA^_Uk)1TRG+Q{(5SX z3)4d6iQeEyVX3r`DlcsA6;>=qd>iI3P7kjU!;)g_2g^9(%f(lfJx+G(X@a(5v?eLs zZg(mknFYb}76a@qnRf=FZNJ)nyVpML(eXdxxzvk~OIXB>99k!1Stt$0eB3>@r87?g zN`tZC(9&hFkaBnSaH?-j(2tXADePdXQjU|l}!e}^@-f=TjA@CFOext!y zVmT~gFO?S?b_{A@ehl7&hxRE~8M>;ajF&f)i{@8%`jR4K0^Bnn+^6u4JPal+;hIX# z5jS*(Z)l%HaL+sgg<2A1V^G1-C}`sions=eoSEW&kCbx*6&F~x>)%PX{ppwsUCyRR z;(vrVU7EX1et9!8TAhUkC)vb);??!GuB&sazzhAF)13pem$7T9ZOPc?CWasQ z8LiNRW61`E_;AV1-k}kRF@5DpIRzY^_q4IGJlM6O>0&E}nO^tOdKRTF4$GX3K0%=^ zLANq_ZL9ArvNv;59HD8hamxVK);nR?1Sd*-@wtKz>(;U`q}Y#TD`tVO7aLTiq)E(U zgV5|PRzS7oC)wfZ%f{{3lFb84lD(#<%A`O`ojnws?PZn%Wu(09LT*iZhhmRZRg;t1lV_{GHKf&uIBhWDP*UEfQlrv!?+38kUniH z+Batzp3}5GmZV~y=L=doeR!o|n>oI9BYAG$y3!(h=HQ~XmvcKNdTF?6`Rf;o=!;y; zo0S++$Kg}^KMnrkAan8b|29d^&XcG1|2B=q)z+!=M>?w?xIm~c;S0B3d_*)F9)(CM z6R^qDq$@*VwkA{tEg^OX4f~6@JF!Re!lwYF3hv2B5i_UA2#2>tvx20A{L6PANdV0s z2npKiA_Yj)?qw1RArt3yEyIc_VW+}JhG;HLqY%7Pidjmt3=)+@seX;$*%>GXWBedm zor$goPxlc{hAdDdNFzB?%9{joOO`D zjLkQjqsEt?Y#(rz^aV`&wLk3)Z{R*3cSc*2RN-5Bz%faBg8stNVaSKNnswRbRs_}X zcTQl|{t~@U{A?C~a@8oEj5Q0zGA_9PG9=FQVMhi1vMES2xA?R7?_$MFqsM*U5f5Y3 zlwqEfAwLs@=K+~|am5UcYbkuU<{MOT2oPk43t7&H(KbBHv_5Wr-+WB;5FQ)Xcd0u} z!{ZYSJ;(ttMYmM54ROUT-9e{fZ&6$BzLJN&#rL7*ZOtmTVe%x72Xr(&D&23GWRBU0 zhPm{;E;Ol-DL9u#P>5u@+SA_~#=dwa^UHe>?pJmYA$P^c{qM@{E}o!kho=NUU6X!B zT>_7l31lEB1#r3(VPyccZz=5UWb5;km|e-wXYaHgwt$ee&5M$)JU!!apLI`)S7*@~ z)3z%hl%qsQ1j3FCzK0i>H)bc$9zp!Qs)ut{Pw;t(w=a~x>bQ8cV^d=9BERBL;?6N; zZ&pXd{&`4e%%qw+ZXSl$y)E!dP^@`~nx(vq*72^@KFQPc8nkq{QZtF)=~>%pODvM~ajVEK@MEM8W>Au;Lvf<8!_oF~8GvRalFHF&AsE^c}iU1cCSE@pv5a!w^j~ST=}~pq_bYE229A`k)HD6ZzT@sIpK71TtCOC#AzE7b03#R`m9AcVDe1pmGy46x2< zjQBJq4@^-=$r58a{o;hOdD6Ud{RSfaF!zpU*8!WAV`g$ zrXLeqy>z=wp1iSrs%CKJ&6S?rMrH$A{w>>)jDQ8SM__O&#;nM&wGzXtoo#d=y1QI_H{DzsOp?ZFRuJT`kXZ~Y6K zR$RXNOTIFydyrWjZ;kN3V)!7C zfM0q@ii(MmBg;~Xa5w9ciMT?usPpgx)ug#kHcM)A%J7dL*LRmJrwC+H+cEk=K z^8rzGG5A|*f)9>4xUsKkle2l{VA(E1GYN>-5`J(0{@?`uO2Sr zez1bQ2n9M)Gij=uYQmX0V+mJ*@S(!wXcByOQp8y76zj+p%tMyyWvMJPXbpD`S+WrJ z8@nR)+*i1>)?)qHp2mX9qGZ6C`MGqc)ZMkoG zsY#CZ8K_aGNpLL>>;SR7;yg_RYr1~Fh~B>g21QB~FTDlf!wr&D;{vdpo?~aEdU$5; zr-4!q@TFu~vVTg*WiR3qcnEXYz+j7ZxQb=2qDQ}PvgHLBen20~`SOIy?7hZV)fzLb zRu3gX=R&DqPw>Y)Xr!6MSz?Qp2h#?@e1Qes$24DVu5HY86g(>aK(TEWj>A1q}OQg`Ya|55gk0e@&XwpKd}2yNAzB zEsB_*5DGE@5HmS8Av6EzwA@{yORd;~60#l;mP(cts^?J*5}h)Ie)lkzV~P zENqg7EBeqJs;<=chU70G6JP^!(oI$Nf1|&U^T`v_40Zc5}bHU*8wY zX5SgoXG#wpA(cy+chOV+kYzV95H?h;*OtSQk`;#rpXH^WZ5#?@OpboCkUPOmc#FuJ zTD<$X2pSt%`6H%hrhqbF@uZH^p zNvWqcGm?35JE}c2Cff7LuN99NR!1)nq(H@5mvnMkhNVO7G95XcDSJ!Zm`!f(H=_0; z+2ggE!vS&O?%p*2X zj8<+#Z}Xs8IA11Nbx0%alI|dO$#A*I68?uKb$2Q0b=igj8tuZ5Potj_H|TuI2;H>0 z^C1JQ*}7vz2%NeaU^S=;!i39H#~_nm>W>|p9sv*3xMf*6nJO#Ec^I&eWFoN7e_&-Z z7pSd{IJCQ&>kT|*E1>r8Z~Z@>5Nx?t#9=8vw6`Fie+YT_GImQsM5 z5MR5RI&;!a369la=GgMHsfKE0QXIUSCLhkFhn1>)!d~HJXF|anl)2CQmqY4Y9JCBJ zmz9Q)=ITSG8rHr(dZ2l{ub#KfQ@$weBLpkmp9{C>@Ilqm98I3lgW&5Z+b=c);Ahba z2Fs%6_78pXg|=1n&^fmfg-Cz6&+OyWOYKlOw}7~Hgu+(m_R~V)D;hXCY?bGPgYJV= z?5lyhbsQ>FUU>;dT667fFM$@waYc}5E5suVwHa?49tJGQ^nb?1Z3Nkga$r+aLL>rH z%J)PQ7lJiM8pS1yrA-{5g`09CY%YOBH43ehsYwzW9@S$*v41%>QVXBrlu<7d5A;_n z^1{&nM5qNU^7HgN`fvmtQE;Q&1S^USXAK|uwB%By1eT14nj0JpIY~&=k3-dk>&X?h zx&R@x?CnT|3iD0XPeGN;CloWPM)ccEQxO_plu;_v0Mo>vszk3qNacY``3ToSnuoLG0iRCW~<1))Q@jW*Vt zIEsiH5r(@RGEVAIPPdGtk3tif62QHE@Km2`MEghg3010o` zhMn=+7wQEGO?o|?DO(DLLA56u&SDX&L2=i}g$=Yv)vh`AGzB?#wH;j>l$-m9F`JpK z2f0nAaP!0OtqEbW{aQOWB20}`TfRLpxzN0GVBhVs@p920S{R`nrs@%PR?1p;ZQmN| zNX*sy?PpVAf2ML;r=w%L29Ge1HVMa-l{dXkODcVw0*u840*x{iWt2EjUUC_M-K%asMdzy3G_7;Z3$E_WaF?aK zAd6Vk#kxeg<~qu zD$ReXgi=V`8+tIb^sbC<8Bws8g1@5(>Z>lL7OJRb@~2Z&_~o5_60coP`R8Hd9O12( z;95sfwYX6-$h6Ha+sJ~AG^zl`X5Lfmv;6`AK z&bMxUbi@1h;XgjRw;82TmrplaV`M3#8&>63CWBUTtenkdug9PI=SI8_= zdDaq$_Xw)c@U-6sdZsr4>WlGGmj)9()fE9!7X}hM)D>Z*&;JI0NS8pHDTl8Rmj}m& znq!F)sks3P^3%fk8K2}^18n}(i43`z86}btio?odjL_5Cp`Gan&hjj>s`*ddi41}T zm}c_^0TwGWVbNIFZICHRtWns{ZPp~rfF?#PAn@Ns(~=?ihQ=dO6on;3Wy3bMNDdB;f9N-icwK z)Js7%zD1=(fQ1pP%P>I!`O9>RYIu#)?+};C;NmowHJa zM;gnp*Y2W#+ym|+An{~i3Utw>S$3o}{=ZZ2$y^$Dzx8tM3Opb&OHFy?c0vvcN&%8~ z-WoGz4$&0Ns98Yq&zsgjq%Dkyh}NOJ^_UlMVo|mD#^bSj`4h{^+$Q%n7+22DkYKxJrIVIf5@Y-GSqCY#`bP*7 z)Cbml(@V7po$jaXX{Osw3jMbXS*b2XAJCwE=XP*Uf+$sp2)S8tSrPq+TH{+q27&6&^|aGZ z0xL&n928~s3Zn8`gY-Z->Gh4V?qNl;y4m&sSyL(qRdF3Fb~eK|4&$%5;?*Y84@(CB z^#!%tkeTEiRlCmVRNWOzKhAya7whxW0)IRSKH$CS#9S(^s;{j%&GV2%mqj(AGt9-+ z1c3rc70A=+L|rM>%kTM0&%f5JzZz{nHc-rKK7>9rXYF`@y(BzUr$)m!H|)Hbl+?2L z3VdiD@)g%<_$f91w8(yAnlyjlbAMX~8mB%*tKLq|Ch8_yx@2f9P-%8cuu1)+S9Cu$ zWC~^vFT^3}nEeDjHDAP?U+(nE{ykk#t`eM%-@#BV`xJcO>|SML72Bse(EAbw)T&!;x%BJfRp7Q2>WBv?P&}Bqwpr>ax;?Gcl05oOu~0tkulWnYA***cj=P zHVsb#qxkXQ!IX(HY-o;tc4!G?nl>hO&|KtbxrXzcbnIO=x|(tj2o-Vlodh!eJ_UVZ z%(OhApu!Oqcx{nW6q^FX6p{X(O9Y05Hhm^TOlks&7E$xu#;=m9(JD-LJ|T1o-o0iS%7UU?l%M>vg zoXKDz%V?RXGqWDFPnw#q5mj#q-vrbuWS8J0-?#1QqT5-KGcv|(Ini2S@*KVT`xC{X+W^{SNyi#7nd}8L6jQw4KBN`rt zw5Fh`xm9i#4DFn8N>l%7U)ejpG%09jw`f&TXZK{HbI>YDQ|EV z9N$*N0bjKy%)cU2UF&D;?k6NoqC$JDujMe8-pl5Wkik;9m`mNu!_fnEmCG3rpfW;f zjrhpH0~8OT#Z(aM@&|~d=F2`6H4|X%QzMF2R_BAOWW~?#Diryt?u1`Tfpgc%4;Ir4 zLWD8q_d=0^?0C0fVSh9MInWauPq)jhXJ95SpK$1&cluaqY}c17Dqc+*b7l>3rpa?t zZ}Ov>$XQnAY5uMdfJHX!vhRYS@3JM)-Dy~>hy|6$4wz$EI^ZmwU8&_h3Y=*i-hwvY zbqQX-&%wAsc*YNnc_vX_>W-r}tD;dH?7opBb<^Vd=A3ik%};Q=<3xJB6Y>xoH* zR{=IGR&BE#Uwn^RuYa_43oc1eJ{F2^oGXFhU&mBUzuUV=TGNhPbDpFey(DZ`#e4q~zBK-B z&12*Eju}7p<7%hMDF0pbgL-sB!fH!lTaUu_Mmq$Ty7bcM(6qTo@B5P_B6tVF+HRl}Zg@HpuD!^3)=d$pt7Cmi(nS=aT zQPm#uCXrd=j(We*nj^Q11=tqn;6T+VAgtPAFJ4P_pkuFDRn~zj9G0ZuqOzf2qs9Is zLQ6F8mnsErwM;*Uol0S>M=fe*F{XeMylJ#j#y13fW?qq46e3|30#p%$(x^lOiQ<9u z@5B=D12$fzPkIqr+3Uv(@O@)Te7&9xG0*+)_XW#BGPAn%_6?4Nu&~?Vc{=RVsw}Nf zt3`;c&nZ!V9h(krwI0OdOGhV_lUFvE()6sUG$jhRa+TF>a_1zlq)z{gzd%Jlq zn}v9}PNl1iU^A3iB*9<`;JxWC+{;7D=n6ZExX_g#z)@@$Ed=jVn{8rR; z?kS`m>s3uNJt)v$KLSW8z2oF1`=wAN*UpKhT|AyDd6C&z<7Ggm((lWZo(a$<3vdOc zm(23+lfe>X)hB9Yq5&*U6rE;yWctOdpvmajl!}Tamdw(hn@jOZ6Nl%W?r1}-nN$!< z9o0dgP)X+lAnTxGet?;6;?>lI9Nu``$C>VEl9<2&BM|D z2`nM0T+Pve8%Zuap`)qeW{?qqX=sU7nY)02jNxeZZGyvcK;uRf4>L^R{aHj)uyZqX zxgYRSRdPZ2(a^BA>%rRcE}&rOL`awY3r#|sv#X6#44`%RZ!CdqX$(^OI(Qqn*Zzw1 zY*JrqfpJd^TInK9p;rAk!9zodO6BmH}k*#yrtew+M zL4nAGlUAQ2>8+htog(&3h3p+8_AW+E`4+x&ae0yFvLz?^b)?7DEsQ5**=v!eOjoEz z%8_^_(s@NzfW>a10BKT|!Nv~;gjIJMha1n1RXGs-OLbUTL45QFZu+iU?^o6INCiB> z!h;5GM6R0`%qtLVA-OYA-bt6u`zAjXPM!EDQLn-HLS; zz^kaNvlyJ89L%T!3+4%UA0pn4-B9V3k5sxBSl^pcyEd(Y_X>>;+QIMe$hsYyqW0kg zx7!$rs4-4j5G-XoCRI>0H^j7FbJnXhlfmw*ERiqQJKC>W3~&d|pFlUE47c5eCO)6Y zCqU|Tn{;$o%pUlUZJ{E@8E_-<0HPJh58?w&*GYZkCT@2HyohPU~=1zp@kn@ zV~%pfSxZrw6syCE?J##sWn+uT{U^2vv*vnXEraH7q!FFcVE~^=Nw9>S~-78U8Lj zP6BLN{?!qJb3h{`bZ2zH`kT>l1eN#WUMm+X#p)t)(;ymE`e(em6tH=CenQRt~cDn ze_YLBRO9P=hLaafOGhGQZj0Bp!LdpSD*s+mC}ZLd5;qSQ^-3*y0mieMGRDHfMw}a7 z_Otb&&Zt%U2NSQ$%Eb;phBtA#HL5=tJCb6a4T7n){rzYjqO?1`Z7>#v{(9?nZ|Dz! zc>M+6O$ZmsL=8lg@FQ}H*U;hiXw^p=v#X6=TJ$hvW#6p}13-OQc$NWFLJ+_@!1T4^ z)6#nK8A8)?b}x-`6V!p6Zk^xmNF1YiY&!!HruhBMwEYAR#o4OjHuD6o|HboH(V+nm zBFnX6HfkA&T}780nCjZ5+Aim2IyTi36G)cJR~@cMw3kAnn8B=vP9R~rT<`M)Ui+F3 zqIM{GFwp72G%sQKhFpmSRb!m&bUL?*8RoFd<8FNofp@ketqtl<$Rs6MBA0ZU*bMqa z2!hH3WO7G3JZ0J8eDNMXs$YzTC~O$CU?O8r27wb=eHPn@2_3UX2gi$E946fC0Zi!sX4O|G7-7|#5^NV!v@eVK(1%+8(bkI z4z`u;imyb3mkBnz)Sx_0#bJv zI25JGVT=Onk+~9zz+!QRi%RaXQh4Pk@h`13wQky9Mb=&0*4~0{4#6ljvY-yVj13~mdJ$&06hogF{Sr12Ci z7qr1(?qnESg+t3G&uaJ#x0VbDenEup&WJNL1oZek)OQzo1VSyd1>heZ9&uBN6> z2mZTCnmj;WGv(v27j?`XEnY9qvP3t-7ZIO4%ehCXIhfoZedy0^z9(!VI=_~nQH$0p zvXn7IU{f!fWS##+#5q$0FOJJjfmypF1ZOmAjPeD;DvGf{><^acGeJovmxL@^cp?^S z0c>gL4qB)0IHo#;iB?1_^_!m9-2ABn|HCnlIUvsVO> zpUPl8Bl%`}FWyCsyr^k%CLPKprJg?(GSwCO93UI-1uv?6={wuEBd_J-@5cF4zuW-w zd_Q{e8FZMFlXO^=^GZgxS=MRx^?kpRiDq{CSycrIS!cBu7eV*x45av54=R9O7p!aj z_x``)_W{MNB@u$6l_4ph1~39WfPeIJk69R>Hh}_(d1bQxPvXD7?j?V;Ijgf16g5*| zCGD9i6{56|a4nSQgopvuQ^9r&g59*W` z)Tk~!Fd{kcpIdD>Gh06P+)?eHNA74&uk&J!>2tvpZ z7o=*-c(P7b?td(C`%7BZlq{lT)Ujm&SqT&u@l8^!3b+_@KA zu^@8D>ln&IfV|Ph8Ej%q0zE2IpA>8l0%ItijB0_hs=egEBJS8v|=SUOydZ*wHi zuBHhMGPki|aQEw}Z^78~bgS=haChza_Pjp2^EUE2+#aX1(&8HR3WMas&sm*E%VLi4 zwg9d_*m<;#j7m#}osCO63H;Ej9=EyXabOx?rehmU8y)RED1B3Z^>Xbzz&aT)H=M&U zbs=hm6U9znGzgsK?k73%Xu#Pkg8l7C;qK8vvr(*k=fLVwrxsK5PkT9$x!IO-qnFXT zrZ^NK5FSOL9^|IAx)?S+z_WXXr4joltuZ}F8ZKrWYz9z=?^ zAGJ5&m?`HvC)ayJ1MD&x2ccqlLmLR+2)SNK?WRb` zr*uNa=I_2&xwY~&-Cw9j0E|*bmh$7jBLa0T$lG`mV&MPb>Yjo{3AS`mPusR_TWi|3 zZLMkBwr$(CZQHhSR`0$Y_w;$H%zDd+ipq+S_5EWYx9J%Lm-Mw5}eGGj5WHkSQEM57<%^8Lm4lhB? z`^j*3;(7N&;_=7cB{@;?_MRUFvbYzp8w?bx1gg4)6jW9GvL3 zsx!wAcXsq;kOZ-aoAvz`hqXx6RY6VUIOT=98AIga;mDx_V`(lspA^19CB3AT%^Uhp zgYn5A6+cgOnJ$|i?3k3i@|@~vDT?mYoCmFY)oedjRzbS_cKT&}v!frjx-%o`+iWf@ z0PuBoiPtWYHu4?ty5A&9ZNMeTh~}z80F%3;Wu;X*GpE4L0uwy zSbLxnp-+K2N0hN;JMLs218R^EI|+2$8tNCNydhIp2dOF1bGEV~9%U%5rs!BZu_+Lo z+q3AfIWzlINz3H)g#pT1qddeK?m5XvqDu9h5RSu5C|~XR#D#Zc1HD6^9ODaB*+~^8 zXP8CTAkov|zkwI3jucCVvL#p^`U)8q{6s3-fiK52;7{n7i+shiiQ^e^yp3^|l`zw$ zn6PU4;2H&yF)9&oy%u@_!JfJ3%Jy}|sBw_DJgpp*7t~7x_{lFNO$At?4sw|OadPV)P>H%T-NEKA z-fKTm(G>yiz}vLd@X21qU;tOY5oy?>2h_fQ=lI-#5j3!o)Zgiw;zKBm{7#`&V}}SYeoSnVD8ajz@14?zbh#1 zZw3t*t$dYG4}BcL4wivd@CT6Ild~^90Y`APy!ITzC_RvAo$PfdBY?we6E>Te6E*~p zD*;Dpvl%iM4jDy|QwU26gA1gF*>{j%_l!o-?m>)X*Kb&F4$QfxS3*!|Gf;SC2g&BV zenoSxlPRRx`rcaYbr?6~^P%MYaYX}SWiciJ1_6Y$Ign6Z?6~hjWKy;P0x^MTF87eR zQ3>hcfX2CxBz>6X+gLH+d@2TjVqItfKF*OT!IiAYGiDq_Ds_^WOa5`ddd@;wsHq1(njit?uSi5m6dD!%$FL*eyqD#2@?2fqW+Yw`Gu z9Q1m8-VU1Grtx|`evKityKG<8f$35XzV`|!_>5Q$TgbJS2KNiPakyH7BemMzp7#ze z9zOT?45PyTnkhXbrB&gYZCE7WU?4Lw!jED|n@<3`*aLyXPpkIjk4Fa`qQDWh<7sQ} z`=uqCsgW~-qd8y0oqEW~)Y$^7EzIAKzXw=&!U!15jC2oObqh~;6Gwb?;qxyC=inG1 zBc%Wvw+EDWJ%Q(qs&uzaLB`lp2{@mRwf?XOxPyY?lZ8$lrTWIwvLAU2yR!1FYY^nm zo1^C~?bChXOI@v$`k;5l2+&T~t1C1Byxli5gPDA`E`fJ;w;CKIuV0!M4L zWY=yU;k@I!2I$H`Isj(EulP-;;>NbZW~E|6!uM#gQzUk7BXL_1pC%u=A}8v_-#|R> zll|UaO-r@7-hE96w)+13Jn`+W`Zk2#?sR#4M&0szJe-^(B>r}c>JA>!4|}G4x!e#c z68q(0gQPJ%CZJ~KPQ;@D%lPy!tLnQ*b=-X`n%2_I;lm-T?>i^VfT|BK^t*^6iHR0b zv_ozbH0ev1O%oypzg}&1}U9vaT4h2mT%DZ5G{T6wMxiHf)`djjHG#9{{Ps z%B;E%ZR)K-e~=n(;mgjNl9d{wD2Oo}Z6=J}XMOLymtbrtg999$KxN ztMR(JEuan@Z(@IV_kyPDOs@7$q_!VOZb^C{;=IZl8SF3DU<+E0i-VbAuu;bmC?rFc zuxC)~CDA zLoO=fTXQoe&jU2q@kk_UpkLHAkR?#(%M;J&mK%O63#u!ooHCjwVV}e>*xxiUZgJKr z#U@;sG)1PkKDgT|ZNly+xtTFjH@07Pah&;Tx7O(0^7?ab^?Vsf9*g($aq!-AAcucB z`s(Y+7&LLy;rcle#ZNmF7uCD)QW7S;eRxEgJPcVV=0q&)68|tNW>{xPV{N4+-r_vq zMLoQ>eEd2HNEg-an%uujZJ22t%xO`oy(q^)HNiT;-kv)nK!EL{&8T*H{DIzFmXclb&AaIU=~s6?_1vg7kd2j5$JlKTM)`zXBlpD{Jydtt!h?TrB zMf%IQ9GzKzIQoYKuUx_jw=^6qm7h!70~Ehs-!L3EN7^Ol;JZ3PCDGvu$>%n%bq{W< zd_GJ>OnOTzzk&X|^e8Fz;=P?Y*!9dT_lPL=%0k=Q$gC&xdLv_}lga^2rcDb+&t)jp z;_T6;dQHTO1BY-rcJwC4u1m*2TV+j7%*9a*0+7L%Qp3|okkF`b!4SZz0dYYsi)5BX z1MCL{+6pa?m{m)VMTi3=eJhm#E!Pc_Ni{Gs9x4bSO;U7O#kGV0NA0P;_yUpBG^bdR zBgsr~!H_Vg@4*C9$tdbQ=;>Z3}>viFd(oIgaZO7}x^^65|}drghEkbg%T{-ht2R{ycml z$gE$w#ImxONZrfqr-_)Xh4_hV#IKW()BqY`p_&-9VoCQ6w3=H-j`ZLHPEP#Wt>)6$ zsr^(gI>mc}r~8=Is}ai0N?E^Nr$yv`; zV#1T=_YsbK^EnIy9DF12cG~X>=w?*zEzmnQsEqP3Dw%vMYg6HqDfKlH`EMn_7P%b{Ky=7=)@)Lu_fgsY)5F~d7Tj8IKwMTj zJg;DSca_#&Pcx#U ztcmd!DN(Nj^<%~_6O>E>XJYFZh0i&`1YXK3O65gJT=IoQuoD(WLSf&vv(c)e8TyS0 z^IY)B;Mv&+Y|JKt3!)X~R{*4h|y-y+^8+$SWl6Af!5@!cnN1->Uu0QLmb zliQORM_D!#fu#iGr)x)i-X@`Jgf5QA9CQnLb)5f|DtWABDP1m~NqB8M*T^udcixi%k*7V zphNfl#=g3FV)4dv_jyZZ+m%#rT!;1S+y7y3%LcoBvW8;ztnS76wR<(=I5Y~s(0cAI z@O*cgtXtGw1Pm6xi&w}4UffvzvT9SMUiTgrrKg69?`pl%?(YgE-BaGo<&9JYYlKw; zB;}sv-xcq_-LijYLax#?;5C~x!w8Atf%%Q+u>hV1BjDF<^WWkYH;@>I)a$A;-;KHt zghcTo;4i&g_ujdN+i@Ny)cMR?{SSmvqLa6CuAL()Z6!jQBO3oyTQM1T)@fSHcLmN| zV1;hb4rg1Rjr@A-++ODXn6~0>U<7u#tl}oKmlo*@^v=mb7%Cf>H>DMliJ&ZK8aAOz zCj!#Z_cK2CYb7Tu5l+SxKFzy}cKN>_YO0q{`H}Z!<(kv@+k%x>y#zVrqK*ouUAZd~ zHk5(4;TEInausbgpzReA(y6ByMlhH%n&fgiP7VEF5`#@ZrvdhJnBX}t3D2!y5hwbC z0{~b^kX8BmwAJ%@CK^ZZobBbY7JW@Dg&ze>K}ma&Ctc2xnkF~Y&}4y>$PuWLSYZ+q zQQ>#bk1-J&vLk2}`s0uwiXvK|@C2!G2KYm91JKaRB`i~lR(_O%wo~ZqaHUPq6cFYN zU14xFz!KMG@f5OA9(*iffZS#mEICL~!k{SQ?m0hdcv9~*BMT1t1>0U8pMU`wXbWy{ z^+`=BL7enn>73hQk2d(A67`8>0cYNLbE2Py(ypgiOSBM;O9>F1EgMQFc99%|w!u5* z9P_MKXAqJ`poC6}>pFxJgb6lydRTgNboNwy@WEmyF8wh{YelmK#{^`fkA-H?FrWBC zDUl3acUY37Q5O?b#KNlTLHKa6kcBGPyJf4G$p-f=co=-E?|g=iewUH2w#td#<_l;Bu18y< z^Y!F%u+gZtP1ACXs#5m=DcXEbXKl2}?{U5it8`x)sf~T9IJL)iWNhGiy2T0Q$-qNX z9k4IVdF^~O5kLxTXl7ql7%_NDO6U#-o)xP-yQ)8pu%<%^I6Ze*Y+(Nl89os0z?__a zHSg@;aQ3ugN4kmg!hUjl1B=x=0Pky~6SL1`uLB2GY}mtALv(g{4M{l(4#}4*pUkeg z-EZPoO>pq3?!|*c2(L33z1Ntgh+iWgw;esBgUQl+mB))!B5V6|x(kca(Qb=};nlzL z3Yk@`SkjCzgsTV4Wf$v%D?5T#d-kZQgF+5u6%87+QP%8v-7p7p0*J)}tGTT>SC%Mh z#Mbxc0%garG7r})S9Ed6*H>rgb?#Ih1>%PaZ>@`N=J+sUOUv^sY@QDG=@$rUBSlcb z=rP8_2r-*d2~D%V*zy_(GUpT4UW6CzHeY-;P}j#^h6{=uHwPmmT2Q!RPYWl;#66y6 z&N&jPE7qF>gc8R=%{r?H!L0oXPd%6|IEkGddg-A)zeC9*m28ydZ& zGw*?;0tI$xVyfJO=bU!tP@3~ zaf#*yLrrL&s`D*{Li6~VK6E}pOdeXSG7DsK-J&6W>QUM$%DyO10%0a85oOCE)f+5T zqfS0>JpRup8f9TpDcAd+69Xj_@Hf(F_#UMthllNqNI46$bV<+y|76NUu+)gZ7jNmO$o;!$yE!gnNZos^f@l2t6j=_jz}9LOi3b|3p#t|R-=Nsj0yzi*@uMC zj-=%k#AJEOc8>>4l^rURT=sHVU6t5wI?u)PNCe8+3lAB;cP|bCD~kx}FiOwj7x|p$ z>Y*?VoYfJj^k93noe|F)kHSKsySU%*z10Q=WenR-pI2@TPUma<$RYQ-seHX}f>`y_ zcwyL9Vn^N=T=L+=qObh!41Yc@gKLbn8+3TnN3Am&NVOBy3GW@Re4Tk*CAKCh^sXh- zEiSM-)t!Ew*`>(%isiiSaFJw~LazQ^k2mzI{r>B8PNQVoT7@%FO$AlUpAr4XubJtG zl?r}o{A6EslS@5-z%;vP5mbF(>!uk;ilKr|OVR{=7e%V91C*|eT;iD*##>`!k)}wev<+fM>4Rm-{!`2p{QCpoojjzk`nD&blhmwZEgr@q< zDN(dt83~6RX!=bjwF&H-*z8ZFxCYB-``+o@kb&ALb1XO_?DPwyX#CYsN@<3X^6o?4 zv4$^okfjjzWOi9o?vx?N;didu~1g4$A;nK)EW6veYukSaYn?UDihV4esR>b57TIfLoiEqbjfDRSZsN*@#3!G1 zglnN$JVnk>)lFoNQG`}4dWEW%fE-M%=XAhgMF>gNqi#_$ZoE7u-<3OS!v_jpO5!CG zXP2&I#{*n}$8WNX&{q50$&dE#^U3z&r@8;dKvRSsf(4@xWrva=9g`5=hDXr*4*$bI z_oHYqQ+$O>LGyuP%rq&(!_ir(B2Z>$l==%%`%O|=SQ9X05mn-%ATF}~9zRY1kT8ab zP7P%zz&MV;?NIu8bW$2mDDwrP?^v7C{+ob`4@WDmbBiGZYjL&}p)++vjrU>e5n#zU zM+6P{#vw*h6(W5l!p;u$Yj7~rA#d_vl7jjNTbvbu;Af+9O$f6f(~y>9Xls^C4S~VG zOO}ML!%n!5yunR{1;6bed4aD+WW2%kUaiCNZ>@fQO-CNK z((iVAb$LEqEJM}?-YV0kQWLOdYO;Iem^E)1?7E)a#f^CdoeLo_6n-Q6OWYdqs`o)^^>Kb^Q2#xZLj8 zC67%zPZ?II5Vsh;s#U?h=SIE|$hcprp}PjYf@T2yc$a@4Djk-A$ChQA^~ITT$n6iR zNL7_!lqfXTdn))r)+}dl8SKLDp^Fs5wqWkANW~t-yw;yy#5aX(` zH1NUx9;jCjk6tkuG3Gm;ko^>*H9&#mMe`^CgLn6)M<_9dlA#mMC`)3)zWFR zy$`$3ckYd;&oU5%nlrGtMx9b9`YGZNUYLC<))U|z#+8L{;OznfHAq*<=Xgvzy$=;j(s-?sJwE=sr+b9h9+cogCw`r(-c+1_b+Y5=kssD6Z#@wX_ zkWhW2s5E$V;e=)6D5urA&T$!-Y$V~x1$LH~xeu`k4?V}YtDiek?2gq<*TuBI)jy%Z z^G->%!gJ=Gb3fmVFRI(8V@;`nk1DX<^-c?_9sp= zHek>=U{NJSDQ#ho*5DJ{%CqnG647F=YUJ<695JfvxxoGz!Uo2EXq`oZJ81^);wKwq}Pw zB=~Wdziu52m4(EMnF)=awa5}x20*3Up|4!K180W;18fi9@ccDoF^MxhREViQ+ysTV!)aCTL*a_F8y(@e9X3Ha^oa=B=*G z^$CO6HeEm^$D){>!n?Fqn+N(7u8$pf_II_x3m8Jecs5< z9ZJ93!@0TZ`SEquyf=%->r-RZ_og!G%!~BhNry@=+G7jg&!2aZgat!@u-Rm+1m!bv zK{YXJYqJS4z!q>#6&<5C|aYuDkqs;LB6lTgN|Gq2?c(gMm!msOgv7de}N?7L;r*a;}qx zS2tz%_2^2aTuFCe%x~JQ_eWB@{}P^@L|WAyzVM(^aZjlxs*06!~OhHnKvULGH3r^&@?Sg_WcT2c7bsW}t)iz?85x8M;&$_7AM48m+M z46#GjLJ0r&@R!^G!crw-y>J1qN?QApf@pl;5dm~r8YH7VcEH99@QeuaFg;$wFo#eD zhO{(sZpx%B0`gBNRQ)sR1!|fClPCs@5CIUlbfXKO@zK5j3>CQz8~Xd-b#VrGbCdBym}6C}=XjzeXq6!FSz6Mb(%!-sGP%mVZXOzF8T0v%rmK)Hnb zaBkR_S5Yy`Xd{1annnW3zQ;XjJEA5h)R4N!-Lhi?2rIOiJyNRvy1p+E0|@sr*PQI` zeLMW$AKBa6$Zhn1Ubl+anArF8O8%u=XX60slr?;A7=@@VQH+3ulMw}olFNtuDI3B~ zh9NeXdz~}+6SD(3bfYmz@Ds zA(-3mkSdhq{Lp`&mq#2nPY=F7-q#r1YEcX)a{!yN5*sZ(@3o47t%DO+P%4%Vin>)cti~<7`88=r7F40lR&4aR zaWpS~^1Z81TXi{JLSCxSmj8=Oe*EK-%|3rVH81&_YTbWJPQEv}US}yPS%3G=>ETkU z7INl?F}|s;Nj0Vf8YMkN(1Belo7kn7tmx50k=5dXNrYF|fAhSnKSy7jYxT^294*k8 z#j5B2c}cSm!AGvfRi>7aJ@lgiWe`7G%4UB^k*EqxyPo8-*IiQMZ`Wu*v`LL=4E9{Iby{4KD-JL(s)kN z?D&<-VXX~^eE^RC0+TfVKbV~QA24~MFg1oj!`;sTD+W*3&cp_mj~c7cc-Hq{V3OTT zClK&|fk}IzARzGWUMc6XG8C8;Aw^lU_5UWGt z@h{BW+_2aJDWiZ}ywwOmB6~r>ugL;uMZ6#E`BzjZ-b-5%fa#CHuI0m>HAM* zBDr%Ad1Xq&_*}-L7I8&BKa5Z+zKpttb2bFe*@xo7N>51n9^+ z#vlhixs3ln61FhJ@Nd0qb*IhI*oO+%<0*+i)twKdy$=VvT-GK>3-dS#7+V+Fz*qv| zIP>AKdzyEOcZ1Tf?RbOnc*@3ll`ATUERA!bb%M;wXvIel++jy?sJ(&Gng>KH-T?jq zp>|gI>x@uYIT2us`_X-qAi-w&3gh2vl&HifZA~c=C{<#fI}#-@ZyQ#a93n3Zw1sNi zz(9lL>(lFDHaqPxiW;X$wofx4O>P zIu58=F!`|CWW#yP*W%Y#rB(OG_v@QS3(~;-RIz3BU)L4)kMwEpsGcc${gYg0pAdY{ zZQTz==FH9umTb5^jrf5o1L@hbo=jtLZ+ER8`lNHc5|R%!{OZVBjte#yv1Nv90Xbn3 zwZL6bKftXzZits|p-x(RcPANbMy=vuQ7(st}OVlryGN3JDI`MBPgdf%M$t;{}sW6x1m^0jW zm>@4kaaHJG4D>4&A9vb3S2AzWmdbGQ<4B#D;VuO23|(c8Q00I2F21ub2F(S-e`%lP z8<_)j6sR3yz~^q7fH`b<9Myt1IV1SJgqVIj6106j_x6ngrhHXRN47#uCce5?pVfNR z=jMhow3p?4b$2C9jPDU6Pbf;(rFpic=tmbaEm+Rme!lGaD#Sj$j(So&vFLoKIs!Y% zjbK`KblmfYiQ1@U&WDBa4zf+Dm2-ZcZ_b~C1aHedKhPEmtlCSjyQJP~aF<^HXe#rR zd@gl{BGiQCxjozl>b7B-BQhN zr9A0NdED9k@u+it{AF)@za?63jn33FpO980(n4+v1OnW2INW1@viUqpJEV-CepF9R z)Y#N7c;RD4DL=qN6O)pdn=u#4ZVI@ZK4+1ElWb2yUFy?GAcM{!^-7@~jnYQWJ3wGh zC4=TMmH`f3a6noCt!;LQ(E4Lc0GY0l3_EE8XE!rsLQZCEBX{Q=R(jGZ#-MyYh(+q3=z`g(%a# zC!82G5=FjMhhRS{6~(=#1}U||eO~j#ipH=BS*c-EK(r5IUpF1hBL-Zy)oMsZ9`EIUYKb?5299q5zU84GN|=3$wDLu&I2i#g&}-cUiYlUa}Uv?=)28FTTxBdVlzk4A^D)VLfS2n@*)-5ME-}s^t@5-4HEc`tm-JGWLhY@ zeQC>4PU&u5a{%&cdWpgU=^4|-8`cxtnlzL6d`|~z-L!(p`dI&eAtmGq6jkQ&x(h&~awzwUJY7h%xWQCk8k&8Z$P#?r`s-qtyjK6pW{HTa=hh#~z ziBJGER%eiQ#4s*!JXliEW*M9S>lik+Zl)fOVO|WCJfL+nG)^4`5++j4AcIm0608K4 z>HR5*Hbty7`PlM?tOBb@EhxsVV(H+wK8d|u-XC9kw42;tckge9J3IZ<&!)d;hnIS& zi?v#LQ!2MF)A}`A-E?V*+(~TuvUSdeEehEgtopKHaCVin25VoCXK2&au_s4p)6KE# zJ*HGU+*K#~`ZVxK#Nt$$3hLU1y4@D{dZ6Kc8)peSz zE`wXw#bje263we$0r7p&@(#a>;RbXLoFI?JhVCn1P;D!;B> zODcttO8jTeLhoftxXE|BYv|8aLWeHu8JN~^y*v3zK{rLx;Ych|tJjHC1!bU~irMAO-f4(o?5 z(1PX0xXx(fkIraGebM?{unkYYabVo-IuEDE`?_USv2CIZ0 zg`99{O>?DUpKP=-9=EJ5I~X0*83y9;YIP0hsmM#+n+>lcRKuOWo;_?tTI~QH{JIy= z__+MjT=3w^CzHnWZqd?{n2Ti`Hg+nP23u}1Qv?_$DN6p0nZ&B}j=>=L9D3QmqHHz{ z#*X8{cyFIJaw_D;0$?0w05HMJ!HLN?gqHObY7t~2paJ?Q{q9k^)KOgZ$d_0A@w&S> zT(&n}Qp1J*3_^f*0a}vq4G}3*d-6Cu3Sh3H*9FAh?S1d{JGi+?T&jBD&t6PH7pnZY zyEIb_s?vMA&(%q~dp$`x=h2Eehr~{TQgbfXDXd|4!mG|+K;wS;)5L8vJ(6aJTh&q* zRBHr`j1Cx4R+Ye1r%3i+{_;f#OqCZ9nFHDI_+jliv!38T{xUTJxgra42P8icU~>l} zvmGF@AefFbuoF-h>9$e873r!9z^ma&kYZZBL8AYmmj~v@l*YVBA^>#U#)+bYE>EB| z;TZsw^>IYgfMh$1USe?y$w0P&qA72q90ygMWX?b^*gR{Ij-&G(nIp-YkkcWCh?R{n zBfy496D&^^Ti~ewpYpFI@aP*-1h>f-t11~%FartSaKJTYP#$2$?DdDXz34k|c`qM{ z7LSl@M~Q6`Q=Iidz11z-?ludp-8qxH^>u%j=uH?Eo7MAqd%GOX)x&KTP^{d!&h%Gq z_te2Dc2UQTF3W}30Nk|5HWzk`x{Kr`1R&X{NRYQYMVV+3u!Ju12?M^&D0jQnM~ag3 z^DR7{fDl6YI!2OPu6mA706>E*&PgAGfQ5+y?8kj#ww{e4OSK#2YTElJ-7o4qJ=kyv z;wK{YUMlR$6l3lRHf#5`CG>ZQY%zzL@Z>EkdWOVdALXv^IHkS|fPm0-t3hgf{eFLL z$K?ipx!=$Cs~)Ws6|Y7HMipB-Toqb54Ic4TN^f2dW-4Bz%g;X7zH=hL%VRI22HysE z0KiY+7~!<0%IF8qk33?~yNR;$SxGv&%f@=y^6W{cC;sJcs6tVBgqEEhd)$z_9B*>N zUvq1d&&huyP&Bm3))pkr1+W;!lXs}bM=je zig5sd$N5Z>6GK@wIl^%WIZI%*(GsD$4*ZR&4dM7WvkRHW-G}3TfJ1^J%UE<|NgN!j z{v$90Be14w1Ea;b0)=4nXpPLXlkcWa<~=mXN}4Aa(qUXv>I5*?)TgZK;GF^%92pEb z&E9CcxR&VT-nua(*N$00uItBcN&^d5Yhz>K^nAJae4h8G#eUAsf78+M`Fl6Fc{$uR zfFi5B+U>xIpRcj=5l5utv#t?(FhQx(4oYaT(o;Eh0^(^g-Wm0c4aj!5X$m+GMNjtR z8PbV)+m6EI+6vgn&U6MEPZ-J0gHe|-3#jBd z&^9^)0aJc2C9v#n0X1Y6+$T2h=*+yagbPi!s%Gu3K7BBVjS%g@F|m9Fd&62g9L|Eh{gUM?!-Xj649f7 zoFAjoO#jbuLCMlUn}h#88qf}?fi#j=qR^W~Q>5W!`-YwLYDi`(U2vuQxILoHv=rFw ztm_G>(PuB-Rgc^6{a|J3Y|O5&&;7-4?PxFWrmy$Y%Xj~5Xzu1+LiL7d54*d1x#u>p zL%q;A$!?Yt+Yy`*uB}#XY$j*zh`cA!@?0F{`s8*#V8o zod3A7O~bIV6LG=x3fO)SVvgIHPn53=6!Y3i!*yy-+^t?MFxsqC$e&htD-<$ewY#Wg z3NNYBaxRewYV*elB?pwUfxtUpcC2s6%dO4YL8>PlDC6bxh0{SiNhZQmH0fosnG=O$ z2H_I8t@9YM<+H8S&IR+Hrda#&$E0m{JFm1p0-ATQRc+u!Glnf*d|yu%*aJ#`&b5&A z(100yWjc_xza!0gYe$Tg^KO1zdH|$GxMR!}TWXZKlRo`@&ZXerFA zwPcBfOB!2X_TzbINdr>%2IR|3gad&0rni&{DtnXmpn{fqa{EX=;wFV$w!!t>%hyUpUn zNNDUY3sdE_P7ny-#y)gPzs4>DMV$#rvu>yo${6jR!C)16?&vM$?<@=oCl%?l{@7Zx z5qY|5sG97jq|)*opn#jPyq!Ew)2;SO>lskgL)pxzW9Vuyei)>=%@$MslQ{);#7JRj z8F{E=n-ep4ZTX;{6UfOSkeKhmFwgq0?t)%-;UIpuN*;poP$C+S!>%*rcxz6&pY4xZQ>wzVJW z;G;TQcymrU1v+(=~kn%m01 z92%pOz}l(422k1^{CcC-=;6GoU&1C9oQrsXuVUUZq_4R9=0u+UTm8x=_gg#fYqd=f)0(NOid zlEOs+?U%{K(<#Y`I1!tS<{7|5eNZH9`w|#on-eE&JLJ)v90AU6wx@Ew!tI8bl56$FpK8pVy|>#9rhter5V?W&%+ut{$6lfaLGD}oV7 zw*K&QA~U9;B=_pn;hNqET>DAPl(h4IE*=JQaEJi-<>Z7bvTa=9t<3L=E%R07swni1 zTxFQbwB5VqAKkO4=$?E5jNSgux>1et4w}b>0yM(C=BQ|kD?}r5#a1N#EW!!hJvR+j zmNa)ql7sFOjHsdU>t93uZPAMA;X(oaL0Hs|_wOfj^0x?^ zCw{>7?sl+s8;p%Now)7ibvbr0wjG_9#g8#t*!X_ZFal*+h{rs1b;?eIG5Fl)#bOub{t-$+axsB8u5W(N)sC&9`f5FqUxHGBn@>`e(@;VLp(w_B ze*p#OirTy(ak_E1%x{)YjhV#kW)IOGaXgEEfg&8m_=F8bH|OX7igk86J+sU~e`F2Y zQ)JiwQB1hz+ZdVuP|PyC83izK>nR%J>Gm+bLB#w3k%jgfcuoRYv!!t9uI02{q`uNCArRvs>fZz!j2b)p=4M zULG&c0rj3Bc?L5V-ob=lQ0=dp!tUNUucpB#ID{xjxxilS{`Xx`;QC`Sh3ZFWqj#tT zT~F()f7t}QKoN6ELSarLcSot!hP+5iSh+my{UbsKas5=tx$k_f>zTP86#_!aEL{cbnBQDE46`vY?7LzxUQ2E;h-E86xa z{{p&B#t!OO>@rXe_D3?|r+!`FkF3G;*gH4`E8*6$w%}#=pv-jZ9IdNKol}#1z2m;qiU~2Nsy6c{5VipX~1)yWP2fYlat?| z&>tZ;RhTvi9~*>34g%~_e8uVk8u`)@)4OgOS{#5@*xP(}*(Meq{kq#bu?CNk2JP4Z z=A#2Aw89qDHelZPw(cvCxn`JnY8IXq|HGJ%dhsVTPd_KW|N0rHUElovyo}@5=Ja|E z;a{p*-)?WN`rr?Y)ow1wr$(CZF6GV zoY;0UNhY>!+kUh6KIfkM-dne-|5&J6RclpOS9h=9=lQnW{fWl}!rs7#OinjaJ@=yw z)4XT?0#(xjT%(Z~h!yDS>Qwh*_l{#mqM;uOq7pPj4v?n#EmWzwj7rA9H z8|+%xRJbRk2_I$I4cZ%}{qneeO)zRFba?~f>N}r1ZiGr1uWGy*E}#yk6trTAn?@{u z!&|(l5f;ZCkET@i;&D+*GxJu#axYCw$E1_k!31Z(K98Xr?-MY|RdGmoU2A}rC^a<8 zjh!kvBB?+|5U)EqWtON-1v@GYVe*pwqjN;uexm|)d8ZI8L|YK=7D2s3a^R|JTM$92 z@^ruT^ka2BQ)_k%$v)FHuML)Ajg%8=byZMX>`&KqU-q<&H?-Bo(Ap<$=xk<^SE2ee zUtds5W0T!3CYiQ{RJvRi6>U^lkWzy+L<0dqe3rp#?Q&3{3~9o)aS<(ze_s`CYQi~7h>gQDo~I#MJhZ00p2MYv=o%EmN7Ix@(FSFeDT(De$BAv^K~2T z`MSTovN>0{g-7*y8{&I&yi~}`>|Wu!W<>?k^uvb|WUPrz#O#!SY*;yEI|_F;dV0m= zCq7=pW<+CcmCeoyEBhS|h?%W=1RwTuLW~%+8N`Er8$J7NCzHZp5(u`mDEOe$j~Vp~ z_J_VcCuIec6WBvo8x6u%?{Ih`C7p~cF@F`neS~IIxBL{lhe=gl5A(jEDXkrf6THk39fmk(z zs#vU2AMa((O;Wfasf`|xSOl$>nUaCe4-l~Tj3h}Sa?T+@DGmHA*_mTfC=hxxz?qDzA{_=q6;8nrVhEsLwZ>S6#_Q_*od4>2OIxAj+@#fLoe3lStS5nD}&#Vdk?rYNMFpyzK% zja6$Eg&C!ae8~;6+J2w+h?Tm~A1fk^3}kY>UFn@)c7`SM#MolychIB5p#k*D#8qyY z(C?iTd>F&Tm53&)AVXVaS5K#LS3c;=N%BnfKyQFP0!-i$R>P#FgYla&e!K#3h?^4m z-MZLQNO55<8{73?;j?Xh?P}H6%T<1yEZnd^V|x zoA|K*=1g(!cSNPDPtX?)sKbycNdh&fM*)gl=?D}0g(eLG1RhMptUysWD|~{U=1_a3 zu61=g90{1ao(~aL10k26ugoKA~hYW#_5#g zu*XSSSh(#E-nhSUVTx5YyU0jKvuNVqSCiC2VQHMRuc1lW5YrxJFzNkBAbLu!f~pUN z&GQ@FkcM0Tq|SX|pk%d+m`v~pNc!v8>4!O;m-`{NX?c(v?p!*DivLLauoikLv+Ow_dPAf<%|)&_n`*s&pK*2ut>>NVt^axR!1G zOqHit|Dc29=K%v?(`>ZKS!wMUQb~d!rg2cX6oFet3cRWSzwN9LoGA$+4Aq5RgP7ml zfh_t#^zdukyp?+Aa=gC6XU_^Kd4NP7eBU1P4B&Bu-aX4gRriD)cuqc3Br8TzG z!ygIi%V^M;J~IhGexyqXf*}L>>-J0k6b_Q8sWm&_TcM1(R7NehzFX!VuRfGHx_PG^WR zT}%V4qe^>U(gDC*1dgRM60e1S@Tz9Tmq+nz4q}^c#k5`utKMf+KYwYN{rjPLe$AEM zCq&}A3M;Q?7e(J_>uEurJ^wRxOxWBGahJx=Utp3`B8(4mStYfDF^@2;&zj z2eG|*!uC%E4cp(gI(WMWy0LLo{dE77c9P8LOWpr)zBNfH8H9BEDlM>LlG75vh->1# zJfL-j&t16hJVxf?5h^I@7sA?rfpoLv%qKii`YlC&QY<@=%heR$-;DXbJ-ST=?<_vo zF9D*4JD-{Z3l4rVrc$tG@!DVyrqlCiFJIQAj7Z@g!Yt~N-7unmI8?|qUO;imnI;mn zkq08L^9oCsdil`2zHWV@7IBrqb??K55=_^P_dX)@9MI2{ws~!#g41=pWqU%W=NLKF zwH!%fyP?-@pz!3&RD5|jd0Ud%4SRx0t-P$qg6U($A&%94iLqkQSiRc1327l)ZM%@e znkv&`-2*6aBXf}%BC*zlh9%FnvE04%&}OkHYBQ%BZ|dhb_87h0sPlHnT&;Rx(E#77 zb6mD!cN;CJ*5%7L-K}?QQ#ic>dx3G`=Cg4QY_-xo_0BNrIl-6qIZ-)Jvr08<^}4+@ zXLj!|?5UH@5=OJivc=DG{=M4hvTLPquB2_c3#=v+N0lbyn`7p0J31|%|F)gWYT)%M zIqX8MLM@mYANc*G(Fg|M({t$4tYyA=)YvS1&wxs8WeR1n)HyXSbmtpnCo66@mo>)A zhcV`L!8+YJRbN-nF}hLGW|`t@zL53M-cIV%3|%n@Hi30qqYAQQO95^&5ck;<8C=u- z_CUbh$lxh*t%{R;CZ$3@qi0SA!XVkcUr;=bKv594h*;RApK%Z22N^?xuvuQ21*H*+ zT^u{fvUJ8R05CpNRX=Kc34-9}$GZO6beQ$Wt%q~GX z9vlZ-8w*OmBYU| z=KBBSnC+?1e{)RtBn@F9?w>0RFqT-N`WzmjHvQ-4mkOHS98>*Vf`a#|fCvFh`Ic6OObjXtdUrW*x2`%$Y6|x>o&PhSGlbzZ*(N zrxDpmdioX}%f(ZAdS=^q*lIZ7J+MtCn5fd@QQB8D>Wl6~@E&X&$jRI<(gmsyNnWnm z*jC?%`;SaEIz7CH{8lZ8z=<$cZC0>2DOa*_?ai0Wi}&nL6%Lu2kd9ElNz`EWZUgI% zbyXw$0*2;^!*dUq%HWtf8{VW6Ix*lTLs+qafw>xkpl4R!4^*RdXtgWUBh+!won(LD zqyP-u7Kh8LPU5prla~RJx@59d$!rZm0;L@W0x8SPUal!E24CJpFdx6}whXlG9g)b*1r^BvKZjAVn0hO^&?(!yP1`) z6>saCgzp*l=pr%t&6WfO2&YfF9n{Q0F8)Y4C3r*0^s^G26)V7{Cq?+f@F6AFMw}gz z$j?U}?+`wVyMou{+_fe?*^$F6JuM0!;SRcB;h?|~`>KIT5BE7TmJB&mN*ecJR3z(Q z6uIEQ{>8YFukz5y~@ zxqXZ3#nl~8=Sy9%ilDZ+oc06C0aA?7gL0Z+pMygIUqjI+w8y+~su7461RKMfp6&2F z%uBpoOriZ6N?5db^;SHVDH*2s%aeu8^^tZb3R)g- zXF8S#2=}*TRoWnD7}oz{l%y6JAUo0=5`YCA=S;n3eS+|ZVqiF0GTy2=r~5&3eMRIj z_flD8fu+Ct?$0N6{#KL`n8IY`9Lt9}!dRdIUqys79!MQ}{8mt4eo^!k^c+cIa@uhT z^kbDXsEN>JPdtBQ8exTB$b%eLZv4ABCF;j8D;?xOrPFrCBQJ4@a>?aH`-o~+(M#*Y zh2^oFL^1ZZbrM8Jrn?vkzKfiUVC>+{rLo8Cw@LN;%<3_x;$R4&ex|W6>fC7JRIJ>*ZU6*18lG1Ju{~# zZ(Y2|3>B`esP#6*FD2Em4{-UL;aXKTx^tiHk6pIEAw z@JF9Nl0YrfTu8@Yz|{&Qkr1fUNXId3vi_v^%?ZEq5V+ef4saMnIWK}7YLVUGb>qG# z3=z2n=G~IZe1SP3BpyG-=$#j~W1c1&tbQ_QtEzu=iX#!Zi)8q)eVn}`|D=#xZ|q%p z;P~)2DTQ>2+sRO?am0gBbrjoonAvU){P^&=VFS-!OtHHZ&xi(ybAHG72(bQK{>+D(e zM1{VPs$lYsDCcWxPal`wP)3Q457gA#AQsXID8ZW&8 zGa8dAl}a(v3>G=?i0c9pt?Oe0xcJ98LciZz{R81+(FaQ)sUR({KV*5IrVf0lZJZK% zXx)xl`}MWlF}ukcL-VGF2?#djQG2qQ%I1z|JrZd>CPh6A4f4B5GpdXfPh!x4p3l^G z?7hCNC1YMN0(mgSkct3^7;2=vx?4wQjKgJWhZ{PV<)GFar4>2EhR-@hIE4X0{d!b_p>>I1Dz%$@QfBUx)oim zcBOwPxOWzF(f_X)=kNcDaZ(R1LCi2z_ofn8X@^ts@32fcBrSE2RO9QL`E0cI3y~1} zJwBeC4a>DWZt{9JKkQD(+3E3m)jqvXOlmy}G$-chaQEx9Xc;)&j1?fh!qp)u3ueG6 zrQRfvsmIYX&uu5QfRe~-cmqpfqb;Kwd*gxA9(Ei|2x0%IYWhPjLB&XT%{T-w$2Trg zTS-5Qj-V6~&t9O<^Fy0hKGXpze1|DC@WZ;v1BUGo03lnd<0~-pt_UYUO z#ZyN)1-7~xZsW*#9fn(qfs-E&m##xkP5@NRAjoLou5iYChzY@LEllG**OFTwFi3x8 zCaP4XYUtww)Ao|3k`1Z4J5$asnF;8_K3E)L{&UcWMi8(Jyn}&zIX;vf03{QaJA0l@7(uv@q1>uXxC&}UVk9Q2g*}7T%KYp53{;; zBUDDYShVByy}OXlYXHnBU{ZUIITtc$u)q|7BJ*ZV5B4@>XyR3-ro-6dmf6`SqcgCz zk(>Gscb28~=da(zS^g_EH~0`qBKdmY4#HH!aP2YYOC1{yPfCDxpDMP^SwQLMIFTL1 z+J|Q+tf^Env*(GU9|XLb_nzYx>pa}e9@d(x919|%cQ$Q|(&6P5!@;D}Q|Ex;NJZZw z^8kP9$;p2AMk6-~XoZ`%*|jrCF5;q=X-l`wu>USS2uaET@y-Sr>0C$la+Y;OT{F=` zC0;6}N0@g3D9_k-whMwhUQphZBgB}xf6ag@wdb@=h1zy77ix+c`t^V+(b0gme^6cS zB&4b~r}*P~_c!$paV!Bwxrj4$*nVV36at*8WIDYVWPo0!51=;g-H+lJ?8QF`1`*=U znm;JD?Y~VXIHRU94ninM{v8#y!Tm2l%oge0mSq7V-w)MK{33AR`f}O7N}e19t_l%AoUVZ_UZ01{!8f$07QG(t zmyDJ^&lK2HsyvqBXOkIBudu`u48)ZgYZ_>!nYxR}+j4Oc3^s^K;xXL=^ zklr#C%G+ZUmQ8-NeR^QeionznOt3Ssf)KOxLx?em9Hq&G75#VVm~(D*rz~tIsF2!7@da z^PyL~G``#1!b|$>)vjFabyz+WW6;OfXuCMMg*#sE0^1xwQO+IwkSQ_}hCRcip=`^y zUjWdyJvo~@y|6oIBv{~M(za(IVhn%Q)bDOnoW+(;XJ+)L&se`R#x96eb2A@|GLIN8 zUh<7kO_)BHaA3pw;u5d{D5QcSGKTUsY19uDeYIbZm>e0zK-r@4lU?(^A9CO*T+80? zNMm~}vHD-h5!EIVQkvN1erjF=h0K73k7v0$SL8hCaBo7tz#`#w(2$Z1k;KCdkC)os zPJVF&Gqt5=lUgT+q6v(XDp_=M;S_@{SOA@zQsTf3{m5kK#Lj)RYPI$F{XBhIgQRVi zB+uwPFYFa!pF|`;5hG8`{J~3JE7vwK7kwTx*(;b9p^{bM%f*8+37|$|VExE8$aUtd z$BX&}CU|xG<-R)wi(1Bh&wje>kv^w**SW*8el7zI4pViD!oVC?%BK{>qDS|~ z)aQ%c;l;;lboXNZ+7)y7HXYeBuD8}I%S-pt6+9<>9qe#Vlvkk^Xx4fS9SnFQi(ya*XJ@_g?^UFImsZ!#icKEZ-orx9^We&O61)BKJAoWT&e7 z<2z}A7smZgg0pM8-&QClTn7&uH=QqR-cJEb`|}2eTpX}!S{JKyQFkfvoAQLlZai^^ zA(27YohFXFVPKzd3!VZavu1Jovhg_G@ z1K0*Kgq?Bg_Tv_%^8>fPe@GF@u@62&w3v$^XHbp%kpgzRkdGYMxGK;|N^q&}u5ci5 zr0*N<;NlLN(t}^XWQ4PUFNa%6PLo3-#^ z7jIqwA>@$P=P62+XIycD_DHn8eC7J>A&{qe{-EWjKKzC2JaD87OdJC*x{%7up{vXv ziEPJ~Zu=bMgc-EGKF{K7&&-PwC+k8tMEePP(6d>6DFnYxDRcSG`C9D99GbiJT6fxZ z?NKm2=k3Z_VhbhtD2JAt(#09Kt4)RJiBp zjdSd?tM+n!B=98brtKrc{`4Xx(j(h&lf)E1z^)^;u;n)4G^f0-tjb@6K0+G9)O~9G zB+x2LWC#egHVG`ZKv+-3EEjbWPWznx5`1}ZnnZyfacU&LhO~5IE(w1`LO|KB$ItMv zSaUZQE?0!0v>#L^{TZUq$Pj>p1=FHUyjN+vr+}w}n8PXB@Dt;ZJ|WMxP5sKKW1Sb@(N)g5DOnpV zR)Yc3br4pA?!8TRRzT9RV?%y6&#S_OYqrrBsl@2R`5kXca;D=f5{P(r(_RG}_TRjx z%ubF6*sOq@y3g7V1g~vNUy8zqKQ#PW-YPj3Bg&t;YE)o(Xa+64>^dZttA`g1_)0b% zHFs!o&YfHywx0s9xy!+TkO*-94Nh!pl_8W3JSx{U*^qohI&)QlaW6z~vC9??q#ZrKjU-&a10| zs5uwv^FH7A^Au&v>qX#We#q8+TbjyNtdZystzr^!l0>xd| z?a&RZ284Pf$f3Ogp|hGPB$M-)A>U3} z!(>-}*aGhFHmHyA<~I686m>inC3~R3EPvaNGhwABEj7J_r-4tj#vXz9>&4h#+I2~x z%NH?NGV|rRUsrxp)D}kx$fTTDKh~5MTi^KJ)%FfLzJy*LuhmT+um=pr^Z7Nv$u(s# zHQ6IY-CV!I+8%|9?ZFc>;MVOdJhuu*q6;7Bpc?gG3OP#*i1q;noNAT=y5mjlpfab& zmDR*-#%mmJlp2JIKh`oI-$^b!aP_ zS5z;KLYpb+lB~6ScP2dtZ*BIKeA+XSiT3|Rt@=)Z{2>%jJ>tkT;?h)mVfol=}Bi*Dt?np_YcYg z5{*j521ySQv>>;NBsS?rDmpZ!$O?5x#ATsos;$${I`6f!mXj~-jKNbyswB41rju^@ zPMNEwD4l{E=*dB9f}rZ-G+?9%^o0bkZbY#68bQ4;m6u+|tfqb7RBCeClCvl@T1TOz zN8Wxt!a;1p9a=*;S<(osY}A@GI@3AfeR&c$$`BY9LuG(HU=&`9T_SE!(fT?J+i-bgXsLj+hpUCVE;9IL z-5!tE-Oop?PusJR$+0E))ihOFtkDvgvvIlT<04B}Ev?3eSI>AmCEeYBBwDjk#5vTp75hP<6!-AH!5y zCO>uzgogg2lpixQ^eC^_$Cat3XukeddwoAd_1<3$_;4R+qOFn?z2;+&unx_K!q9J(Z!(!Ui5mYqG`cL?25a*=WCR~hMP)M zW7?KEN`WWt4@zkkt=%6FM@kE+Oc-7H$`4S@MX3el7t}o73&syJwInER6g^T}36of} zUP7KN6g>o8Y(;L7w|_s~GM{}jO`wSONW8EWc&{@wYxDaDt0BZz2zr0$ z?H8B)r&>JFdgv`$24iB?B7Ds#YL3i41D@lxvM=pJK>Ne@kz&@DSdk11ln^P#M0@VA?v&QRcj?XUtRb-3h-Dur&D2O>;}S|?L`Iz`vpZ8veBC?=r5Qx< zpZrR!Jq^{M`z~2VmP`s4JHvl|hQCuF7Kw4V388762Fn@;)sQ?i$8+)67Y1>)EnT5S zKK9k}**d0`rdSRR!u(vl!;G}P4Nj*+QJIV2e0v-C_-KFm{_w6ITr(mx!*;HW{JF3b zKCul0OqFgv-d_W&M@3T;v0qC_c>bf(r6&OtA-YVq%fZ5cUbx&>M&XR2q5h zIQ2h`9UdJ01V5^USb>vR`M}Oy*kLnxy)duPTISU`j@9nRNtRRF9k-M#VSe0 zw`q8js=rrBfVe5@zRYoLPR){Y@|`)d zcFPn`;q|2|`~VWyfBgVG@rKY?21)plz^{&c@=LF;zm8~4gLT%4;Yf2bnMZ}kXqepr z+p8Z)Okg$SH`4~s#>L62i^>;tr6evr)W-Gr{cHTIzN!b*_P=N*4CFsFbGm6W?YQv=yWl#QMcgC%-GX7t^PgtGABxgT9Vfv0*yB%N|9pwXoruEvgc|7W~P~ z?zOSLZ<$HCJVN#@Gs%`I>(GLhOod*6?f8*=3 zG+4RAAo&v)-fE*1s+#Jgm|^~rF$rbIqFZ9?u<-dj6hXb>3zW`f;dpl*-g86VccBbU zO8t6&NXbnBG|ZSoiD6xp^QZtWP7E%P4pvGs;X7AEM5YAQQWUKGReLlME=NS&* zy^P_0*x+urdlU%(Fr4Uvh)im1Z4?7~stW_U)247MTUG!4(w_mhkf7P-yuM^5eQmJu zO@a-YRLj-Of^px-XEmnW@irE-3-2+FJ3|>MM4hj=XEo@O?{hy+ynzL_N6KcJe_-bI zkTEA!GPy()xFthac3`nAf)@|$<}EQj`miGUfroRj)FF-OUZH-5RyL@~Dp&2y653@l z+~y6?xz8bCSU-;KeA_W1bQXjdO;ChVWKes~03)0#pT2tI5F$kIZ@WlYofJbMtsDEjpJmcPrGCCo5l&|7x?e4Ks$jQA2)d1{I&+{A$Qpv~y- zjGiVE>Ue!cC6PuuDFo=7o%UcYVzp>=dN^NoH#ZBR%2+k^icZGktkz+`G`I+NpPlYtagC?0DD&bUb=!ahuR;m@B|4+XV>~v z{Xx0eRDtxATFBfVMUc_ozL%Xe%ZVz|s42cn5(~0e3P8nWvMD^|zo(BMytEmXMm^zF z|3eDYGakzEN$CQ^OVuVNcQULRVK4j7?PR?Mhvy4O;$t7E*%8~@hGb~(-AVpv;+E+d z*GpBta8X_jJ(l8JmIQE|{9iP4H>1oOrc?3bz_V6*fy^uj3$DYR-Qgda>Cd!}(c2zI zMm8X}9GLh?A6*MWUU5C8yyZqYs5Q!Y1W&x=Qol&{8tp)Pn2$ zlOzmI?Y=<=acQ#C%!m&m@NgJ3dKUnagYqW%%qUtLUIom>g@b=Y4Lol`&?(zW$K zASNdv@)>o;iM#qUEq@s7{-rY0l63e3{_0{vvrtnlLJ^(3zDj18ra(9$qSDg*a-|dl zMTK-ulPADDYJ{Gw{sMth8j8c_7zSZuCC~sA6dMDuZvy1}tBdIiIs=R+h0_>y{X&*cM=L#T%M~yy;i3BlWQdko|$OyA-HEYNCQ~l4`Qt~b=SyOGmv{p(hAJ=_nT6EO zd2-N&n7oF0It=0MemkmwGrZlcFU}X6XFswYo(z`=8OewZ^?R*T)hF6hRx<0)z0-Lg z3fpQ=*mTlZybiiD_mtP?Y6tYfWvuPqb%Lwf3bJb{AXmpO(x`5N{d^YO4PJr~J}hVV zLh7+emU`-txW~A-W>qJtIy>I3yX&4Hl|Y0A_`ZaSs}U7y$sB{|@W46ia7FZsrliiC%tJ3{PGZ_eXMwf0`-^Zs}}zTSQaD=bvIa*cTj8@Q06iQ&7n zu|B`zv+E;a^KDBFlJI%cH12nY%xb{tUrLk%Ra$Q(NqkWrdD3@;C*{MHt{xxNi;)s1 z9+83^*weSR4j$|SErqR23Wiuu9Is7UOy^*%~p7zeZ7 zT1D*4UMJoQ<3FooX-#m29k-Y{6nnZON8eki{H=!1q)zgVh6kK3jo|@@M^kw6-z1aO ztOh|;)8#LcS^gKvRQ)EI5<3=ySG`~L;z=O4%-%Z%^^V^pbCW^6>6>I4E)1&tLo#Re zI@@Y3HP~o|EB-|?;)-p=h&#^p6WJ{MnU|B%c8ivJ>+TuC8jWrHUW>oN3{T;OM^kr|56 zd!wMC1`yA*5Jm~xXV!n@3iXk-D(|}Q-PzVVuT|U|N-(;GwX8Dwo{qSzGU_g#-mvI4 zaeKTTyzh=LhS6$tJNaInoZcRGF4sQz;CP#7m^&;mUN-xUiZ4~z#s-ljNss0v%w#qg z7I&H-blcMJ__yp*w(#V>AX&$1z7Hz4E!tqG>aIgW*zA?Bp&kb8B}fzc0K_T8qQ5*r zi6nw&S4C=B1dG;p09`rI6dUYYyx(5E4R1QL1dktgd_ur~QMnIUBJ-BcDQ6dOqc*+_ z;W$Y~_JTl$3^)?)Cs^oxzy_l4ZjOfMwsR0`gKW|~$dBIz4g~!d%(Tf! zGr3J!FyZO-(Dh9!fxShO-}dSCln=^FKCU^C7t2`9==$%XMF=JyDn|CnT~N`0v>AUP zDeaKRaFEpe%Vffo_vw*GsM@vgR{v!(J(mp~sqxBbz&B>5et_$}<%ZIdB5PIXAleUV zz-MT`QQ#grB5!8r7{nHu{a(n$=EZ=|Ns=-h3xWs#ATxst-M6Nv9I3%&0T=lX%48~r zz2P4%fV02_=Q5f{UO4lW(ECQ2VRDj$jVDeVsL8$zQl2J>OqIS><~$F%#!7XJT$=}{U`xe_kq6x2Ho!#K>Gz5t zO(w8spbFYB5I=9zaDv!T4NUi-Bm&x4m>`E4<=0kO47PXZ4nW%gz*AO2_u|!iH#g>L zzDRqAkGN>otu3@-j^$lV+5Gz}t|Z{#5xs=C2Kv)q!3s`g={|`Dx!LFJ!(zpeR@uFF-KGP~bD6Of=^l|PMo4!6 zE}(UvBS}?K+3EUj$4+}{H*MyewOG=vj|Fgi_uexu5)-r{IFG8Xp=DP)P;2d~vj%oA z@i};e*=9M4cg`VE;*r`4ccPP&>=hsn67=x3b{G#a#(Pe(Q5bSY)50Ex8lz`w`oxHB zbNXBP=Q{goN?C{$Bu5xTx51I)VGqE||GjOANbUUHw!Hs`Woqz&O#NRh)3?DFRN6>X zLjd-PQ*-D4XPFOfI{#srx|PAE#p0o1K>uc$+wl}g(LmvUv&`k9k)L@uk)aIqw}s-4 zuqx3O5IM@O(ZKdH5V-4qoquk{Z`%NcmH3HjdedaCSQG(R2Jpr!*> z%ZQ1R>B;-p`;a7{Hs@5`_gMOVaT8Lb$V#PU1QY?BfgW(wRwi~XGy~;a2CN3iO_m%5 zHJ55ZI@m|h`{U+GJlZsF@pLNnM3vjPr>c?^vgY(!Y{E;mV2*0!mW+-$2>`r*fbUsE zTw#C)bA#-2y0>XK5QwmdM&YWEeH`J0;y-r&BQwoH9_6X9_1|@Rv>faAz9e_;gl`O% za^;ACp&4@S9lQV*!!>niWfB7SSOt`TIx#tmBor^_%%0TH5Ps!bDi3m<oM(J7~O)U|;O8vC|l2%IVra2H2e{=l={f zlyhIYp=!LDk9`~#cj)tdbfR?CTQt0szuMBgwo4!C%`hz9_!T~xHw1yLH!BnmAFMWkt+YbS_Kj%@L@jqKI_k06yW)Zrg;Ux`)j8I~^dqpe^9#lw5)}EzV^0 z44b|4w|MiULNlZ&;~P%#oL=YJD(9*)-R4=?O4teugJR3DI2WF!Yi#@z`pX`}?P=rt0X?HSw2ov_sYGu%5rd8~ zKGfzKB~_oJ^t7EmND;q*fj=9kc1_5DxyH@`O`@*OLRwn5huU5~u$0%nXJV(K%d}lI z!^yq1H-pOOB@n;#e4km;keP6Q>g++wg*!c^<4L#@c^(|OQ?#R}1w8(UOI6wuxmXM8 zv@YjE^cU=L&9nm@hq7dD53W_U$VWs?1(z>3Ns;Uk1-|MP#e1|HH%|6j>9R9OE3-jk zf&+9dqj#AF${1eBOx_dPyT9+|Fp9kz>`wIFRpt>nH=9SV;Hy(yOVNftR}Z7yUP46q^DG4SCr&=e|E(m9?7pGaPaD)vxD}~zAt?|@3QPpTddEf z_T2CuUk)EPZ!%fQ?dOcPfIvqttn&P`-IJ8Tr=3IiRZL^l4FD;*G#iBh`xblx*T=9f zMR0skAg}(qj5Y#IP4MUV*%2#v=3j^T8#*VuIR@NP@=;`r{8Fcn378RpDeZT7Jj0(C z{!Nied*!v`sdBee&4niXbv1XYC|Z}GI(k2|xCe-A$G^3_MdQJIU>+Dl}LXKUm4u4W)%xbQCk>Jh5PEU8-TI!jM zW!V?gnD9DOx6s(xR99^;LpTB;uTj%V8{Jsh0s$9T&X+Bg-VPI>YO2*Z6L54C8_?< zlrY<;RGoWEVLa3&5{vdNDJB1#r1X%Dig;)mAiATL%5y&wiR$N<^9V76>-)R`Q5Cyl zqAot;(p8k?9+D0$490*fQIVBpQZ}zAz$`WfGg7SH!OKdXwj#K&ndrYBeQb1be!oe( zu&a-bwcD&nrF(2{(Z$8Jru;NjyW;)YtBnrcl-ar{CWC7FVIzy2(ym6r@(`RzL>W0J z>UJzy)pD)bA=dQ0mt?c@h0GmhSiFn{q%qVgB1GI)&_bO;m^$eT_SPbk?|!Xx)E}_Mki1d3H!u?jHqqsf(WFR37KkfF7V8HWsv@F-+E3@1 zY}BONrPF1OTlz!y4$aDpDuP^q&jDDToL-iXC#D~X%M_Dx52U9bEi){_tzyeQwWf#d z_Y`@^N8BlO3on z6m9}|lc(`7+|eRety00IXAVKq5@F3H7H?5iZ|6-4bsRqE5YP0b?m0a#pe;}Mg`NZ} z7jP{-7@vLOC9})ENZd?FiWf*GrsukFLS0%K>Q?2y0eND<&YchVtKFDm_EFTu7BtSk z?UrwDyN8EFvR@=bJ|9c|C{oKFPs%Bm3u3Cw#@g2n^uV8o&(;M=d(>}S1O33G@%3ye zXx;igX10>bbt^IUq596fTX)Nl_Y$V-7n-y-lV0}cbpN~O`gL|j{ zCz1)q<<#Ew5WArGx5%tz3lqj574%@&@z9r$q)D622maZHNUv~AtGRCkx+Ke<#_DY2 zz4*7t6l?JLshWrBx@;`LN@{wwT`5alXkRPPjtzGS+EV|4!fsI3q|Fs?uDEC*m{A9^ zV2Kd`D%m#z5h~_|7HevM(VGd3MRc^?*T@RF7!_~a+oas*A6aDRb(n2loFD-u=OnLi zgYQ#MD`r8?K7^|6otQlj4c5O3Y-~^P^C`fK7GvFBJ*yW8T~6B_wmbbVlG(n$Xt5Y7 z;aBo=ECb`Sy~ADc`)^EBx702*xko*p_iR3cTZ*@9*{}97zZJi`_ZHfW*0H}bnGWA3 zbAvf@w3+25veBnO!cym=$U^yd$VNHS4Rp`bY&CQ1(`+|1-9_l|ZP?wcc7kqyK5Al| z09CTO@TYj7y1Ufpj-aZ)f5LXTbtQNXkX>8$j3s0RyL)n`WRaS zn|Tzdq^h#bbBnUC7rFe=UfjGF)Ymk?hNa#UjOZR-!OsNCZMmLDS`$0)fs>Z)yzJIH zOA&snr-wIK%207MoRVY#s?}%X4I9$A#Itnij?7j%YhB%DrC%m4X@A?yTeQDyreeU( zf7wjvowYEDzip;z>EAY!QRKhdOdbh*Eqtu)kM+X`4#>s~{wZr%+U0tZOq8e; z>b>F70ey%9cI6J8BqS&;ZJdH#@~>2;;1Z&7zByj`Xf63R{@G2_h34xUC&ePD~jf0v+PlpMhfUg2~cJqJo!G0%sG7H%%FGxqZB>4L%xJ zyWrdW`~>&-u?x#U5Rd*tQjVK=_w{rueF|7?D$M?wOz+aXJ%AuZj(mVFJbn)tz? z7ChjgCT9?!`m(9eI@S5MgcCAY`n?Mw)guX#SpZi`Sv-W!(zC3u>5s{oFcd|vC@WU2*tFPq^Gm+83fmFzG25Pk8eYT6|1~QV)vQgg ztZUwcda*R7_kfH4h5HN>B35rI@Jp10UitQJIvYI->hhgz7L40n{f=VM8>DMY;+~;) z-tEYNKJ&CS1I(>9u+STBh`XL9$A3ptl4183X&F{j>YzO9EkzQeTj?7!9)(3j6}6gM zdz_CAOy~F;a|`X;JcpNcp*HL16|(U4urRMJh@2m?M6pRb^izW5|JW`#J5rU~|K2jr z&fZd$`vn1#qhmK$j$2I`8SQnW|J}=+6^Il6zj~P$1}=rkfJf`5B!w=xoba4ngEpq4 z!9~%^Gs|!hVzP>IT}9M{u{F2aN&y4(d+LrqJqi-{Z5*G>YTHR^+keT}Q;-aMG*e57 zC|;*H$p#h9ADJ2%vYgV$)Q8gB`9LuW=YkUcJD2GWqj*PE7h05%RfD$=5M#h(>Y42Ic2t?zL${3?Wq)KWCi8lN zmBwKWRVj70&#WZvl7_Wx>RmZN0|m`+sfSb8zF| z-}wDvYi(_NYunx0wr$(C?QX5D&D6H-Zf)!Cey%UB>o@mICYdvnKa$LQCTC9acs++Z zkEfNpn^U{ANXKzYx}mqG?`vN>HGqp#v;l~--%&lu3Um%a0-;QnPzLbEe*-6tOs7hZ7nX$->N-kEI)$?^9nT_X|8j+ zbm=2L*)XwO9`?A;{oD${fkk6Fqs{#4WUd#&>3fObv1w?W_FM%qlj~LgWtr;LD?XsV z_A*!5U~+#i=~(f@I2*po>^aU=cDBiQ{>-R7U|D11EI)0umATZY;ISSIT!Il|F{Id{ zh*~&)_kY;vwZjgcu`!!6Yrb}7!fP^lr9B;@IBodQdts~Bte(+{ml=bwl}%jrY#8D zD!Hk>QbQO0gtn^OQ_s;dTsf*}5VfPg#xl}>E?RCHALP3?kFb%KSAV%o+Ulr-Y!_^^ z&4b!6m$}<1Mg6WCdm@kQ4`DRtP`kp0UdhlToy7ny^Dvl{qBNpP zb*UB8NgSqH@8EF%2apRty(~t2P_#NT%jo!#9xy-9znM($?AHHeGWD1XQO5q8$+VnO z{+r3<*yW5WE2rr;`JziTZcu=#I0ok9~MB;M~N2!{B%nu#we`;?b$mJuj3pr zQ+{P6LI>kcg|{(AoB1wl-~tP}9)jrhKb_3gIl_N;GO7Q<%>Q;W1A1p$A zZMI1dDZdr$=p}HL!cJ8Mj|rIgKO8s# z_*tlruZuYuY_PXczSj;?V))zi2GLXND9rhOv>e2pT zgY0aXwdV{qNE(B!?z$Pjx#8y{Sln>rL_t0!Sz+CD8`=+sAEj^2(Lr3(` zv2R|@u09)^1d-bh=@4w=L@oPUX`dz&SwOY+GW>gkPUx_No|26*P4R?Ao-9IP7nzn@ zo0x!|2hMMyFN+edi$SAbFw>akw1F+f*+fK(+ekIQ`U_?bIq=k2o1r6<3b#AIV5Zw*KrnoNJS=BZhFgQ8(+xo1-yH?~ z1&k^fGUpfgTs_Zy(d;;Vx& zG4V9xMYD>c1U+}>ZJ`;~?*|32qsBv^y>1CcsVr)HInZkKed*}u0Fr-TCQZ$1o<9W< z;{0HiJSB%)YN0%11D&22qbR;~(xm#Jx3JWR;%LI$mG6&ytw2_53vSv*;6khGq^X9l zhmMv5IVtx}E(3;Hq&l3bWB9={UR4M#u24@1I(XiW&1d7!=1$$si?i;z(6?+AI$j%B z{bco~zN&n1)ePGRk5Zb!EjjH{V=?@!Je5+2^NPupccq)ws0z>Jz1`feyP@&7?w$OP zow)en4na8cDzh7zzUSC)YY~hHCFuqzd~h@JYLCL=K}-@@WDP)jJ&Zpxhw0E2J|DLp za!Pi3vVV2Erw#fBl7^Q(uG#9G{|dn_&(p8_WY1o(d2>e;66r>RdfRxKd&ZpA%4xH| zc2ZRZ@yq0rDeZtY)WJOf&LMn%@qKw3@Oi%7flUBp`J`RU(5F2A3e}cAf*I=n^Y&!) zE{=B1A+?DgOvy%`#hrSW9yYa}(Y_J=dXsWPJ44$Zyt?mrNoyfkB~2E^Syc1#UJMzLuO$OD?dC; z$&$q|p!9bZwPgEKaa>>Bm@XVglIAp&gWAjY$`G9Y7iZ>2#VP&8nSqv<(O-qjZ-zbQ z;3jF#lMv!o+a#H1hTHI2$2dZsgTU5CL0t{oA>WHAidpClSpp~*{W!h~m-!qJws69J zx71#XNr5vzrcshf0`W=fqQd=fEtBEOywQ^W7pQ#E`7fwkD8}*&Ai4_Y zjY;=`qBTu?zc?lFK0(iMm*wzIFjB&0m#=%v`^{I`p3Wt=)93Z|^?gHk^Q?2jeTsL~ zM!0E$YhBxtXfespISdodpr(6P#IM}bd`krUB(c|>oeL%uuTN8j$U)UUK(2mDikvs5RIhl3Meiq* zIy^u3arE5L3<(cN=vKC@%vBLQ7^z#m=Q2zQXkitc&GPFRZ&9SV9=M2eK)ff;gBg1t zwiW_8&gmJDQrlFTxV^WJ7>pfve*^3?eq=pUx^yEOCNA90E<6B5+AM7;mzN?PtiUdY z0P60qs2m49M!{i`f)F=c50A)!ICPqKu(>BC&F2!aH%L^syw2C5e+dE zn9p^tykP!0`YV7Y`d5r?SB^l5oqOqtS|a|uwkiwFH8rJy+kHq@azpZtodlXZ1?r>> zZh%-~!A>gjxM#~-*9B^4>u1;IV`?o|9|!y(5BIOR?I_Qc4lyc4o2iY;0HrWA3_@lw z?!_Vf<}>2~#2o7$rXUK>T4$u@h?I>M1dX1hB4L0f8p=pEP=Bj*W%koy!!ie{{14=o0R0c)>^K3KIir7Z${H2; zkS|VYSF8k4Nrxp3zyz&8Khvq$-e>&*=w7*!%3`DaYFt|8t|kQZSg0h(J{c8pN{Z`o@wo~g2^93`|O!RLR(m)s3g>i1$w}Lr^Rg=*|ajNTPRzoCl4dR z(}~na3q!?>Mmx?6MzT--Y@9L0Y?A^!zBhlM>({>)u^OKY+9GLmJfr+tp#Pf72aCQd?7NB{S696;p51QUPcw?bquia)Z#}g+9zJ6y02(! z`>ok5?ub5-*XrBOoUtVJPU&pnmZy&nJ%lTBmiA6Mb|0ODJ3>>s&Z1>(e`0LS(E$^t z68q`N+u50u+|nkjXKIDBvvc=&d1yI+l9}gywSpJ!Be#=E+lEMev3iyPk&V_7MEHD6 zI17JpP_M^?$&%fm6xAt?6kj~#y5Bp^J;l8)Q=JA=vktA|9C&J&uP3FgyrR6K;$)1D zsk@*+kxM+B#lMeSBmP9JKnBtEL|OEGQ`Br<4@KQ+vBznr3cl^rL9P~5>xPax_K_Rh zEJXr-0_lj^v-Csz{4sWJSjKtU`SWXx3;T@ z_exo)_54+WS3SIUMvlx-8SB$L=y97eCpT8_GVIR5liPIgYl>(TLX{^Y<1;K$F*)vh zL1(`mis&yCh_pE7cNZmU!J<%8>=nGMdJKIlRr&E32bbKe8uMhxh7rpMlckkbFE5l+ zOUq{3hTgAUW>yk>3R#Q((|q}ZJ-6h*v5RtO`vM&fbERhqtkAn!o9ie6u9In$>E$ll z?SsG)oJ?E(hULOwuWonx$M)Ln@0rJJoy$@%Y)#*%(;B80<+BusjbI_T#EQ8xkv?yi z2F-;EVvGZ|5%0uW_c4SBYerpq-i70@3;1s^Gcho^p8J`}+`zHhmHk>ne+{!jg>^Q&SY!C>TZ=3$s46-PD;=A=kma88Pw#j3#X+d& zBh#a*XwTGI){~SM%c^LYfcE~!dRA5mo<~D9?4#xK#l^wK#_P7KXeIS*9JU{3zkvS% znn3?bW@dnymVj$#CI1U(Lb{>G`@5>U>o+1#e;5_A5;BK52AUh^$NM3nI{i19iGiJ} z7iL1GMl(5DNWFbVp)N*Ze5B6mj}5(Nq8>KMk%US{VO;Gd5V-2Kt|j_v{`xK1RhA!;+i0CL4QWiBxvqLQkDf8 zK8}nGm!AD#hiO@0V`819?iSzpmuKo(uX}#(0{cEX8M=P%EFNB*PGnCsBW#wrJ~roe z8df*wFxRn8s_&%KvKm~QEQ%Pa)Ul4D)xuRpD<+s*8txrWaSorGfVWCd9b=ou1a)R( zo+25;#~>&`o8k}-nukcRa+;xSOZlfm!ktM=VX*h9$)ZN)m?4_9CTE+xuRN#78KbNR zU*RFI>B+5e2obx$4z@hDW}}JL=)0sKMZ2iD+&qXC6{{p+9u#x9jsf(4V?}3-(aXB+SJ5nI`NXOL2K!EwJ~l=JH-LL}bJVa^iQ- zIi29?TJjjonz3P4@Np5QV8tp{!)l|u1)dYv7I@P9GmA#5K4E>%aS?WIH2G9<(RpL* zfERMJaTVE`R39eM@KZZEUk8FC*zY*KN@=O!e0ltx6(w%A)bC7W(w31_LQi2dxJtA? zjWD6`+>Ke|NUah0g8sa5v#d1!dDC$6q2cUC%hrvYtp0hVT4D9?mF)ceUgV@>WF*mT z(5V&fV^G{#*pnwXfgeXG7J-_;1eG2M#e29=So0;z11{C5|Fao4@1!=uvZ4n{*4_ zPQ16MX}ACJaT++qwR@e}v;^Q=t$P+?tGyo4EKN88 z{pRBB{4$!{pkGFlmt~mg`&ylmGAi&W780DI=30gs`@1?a99yDUTFx9>jM=aZyEU$1 zxFfOHsD@-RP>%wgp;Lebo?Q5_duHW6p&TvA*Rix7Iy^G@4NMq#n%j=!Lg36)_U2N; zG<@`ht!wW5WKEh^x1)lyesPhS^||c=;`WBV^KxVvQ?9*R;D_ID&5h6VVYs1@8;M4Y zqc_BYB8IWgcNy{W=48R6{L?{rEv4VMMJb^GNr(-5C3hBXj^4BT)(sk$4|}3_&fAaY z!yL;WUhV2|HSG`^a~}^NR^I}t>W`^-Od*~sDj$8Fdpj(fPp2F`-r%8*ZG3Dx%vHyV zG>A1HBFsW0TQzRll~_ijABAdAZ>1nCn+zsYDpw*{G;2+$7Oe&{s?_RHEt_`ndsXBr z6vlHXO7x9)HAE4`(Q-l|hjYUDnI7d^l5K&MNesD}7$uXDiX!q`T#zzaVZZY7f9OS3 ze8T@gm?T9ZVok93Rer3`Rc0e#Ci>>VeZ@0XmM9%o#4zwMjOY2Fr9?85p#=v1O*Jbj z-beygqyC3#0{$Q)CCUm9fA5qV@98-}&H5Z-yCT8NZJDG0*!&|_WlwDvDu7LrpG#rt zfm&5+YZaXRE<$5MRhiBai2jGL55y648M?KC4Zp*qZ)?-@TITXBtZFELZ*$ReD);u? z^l~AREMVC2E1sEIML}cRqart}kzT3SW{#9nMq@OglJ)WRiQv;ijNJuw+ADpV;Xo#e zV%=0vhl8T-K}muK^J31AGM~b<3@X0`QynB*~_k) zk1oHAo&qqq9wMP`X*M7cXn)O>|5$Wse#z*#eC+xKjgWz6`yN$Bf5?c^ey*SG+jw%o z_sQlnXJUJZD^K|Gh zhbIaAz*iyXA~vi!`?kl7^Oal~UB(Df;TD|}FKIO?bVjk<#tkvJSigsE7bA<;;(@E@*uc5eYyK0U1*5nC!KWQs42 zE*E@7#8wDB7UDLcv{P`TS^a?5*+tHpb9v6!*8P05uvhZfq;uVz8S9eM*|8}jmLd+`2=QXQcf`oLJT>%A)Y@@l=M`8*q64F_hdw)K51(S+5xsa`1uRa2oM?_}0#4UgS)*|KXYfx(v3f6q%kPDYiJa_xjCV zy0fjm?9x}hU6$5f1M(hqJf$zk@KM73Q8rggKzRYD&7MEMrYc)3+xot#1vIagIDoe} z>W}ma#r)-(`BhAP`Y#;ITiWQqIm@xP+wf1h?F@h+kd%VB9S5R@ccrn%EV08zaqc;40DH?EsWQhqCowOPM&RDe5`+X=E@= zyh;@d!uwcKeE7{nZV$e;s{nTG&ysn8l^NKfSPdno<-jkn33L=M5_6N&8Lsuy8M|FqKi<$48S~u8Rh{RSA|cAS)z1v#r3dn|83=iA9V)$< zqX$8kvc0mJPfNVH?eHbj<0pXzuLO>-nL>znl;al+umVxxJy%tf#H?6FOHZmzYw1dy zJ%rTHNayA01`O8351-22&oc93eq1Q{q_XZ8EO|X;AlNGSOoUcHUx6R|v+SPndYU+_ z?`Fb(mpuxc$!{BZYkl^*;s&wJ7Szuc+zA!SuXzA}B6kDT`nhd~Yzvf6$s`_b1qV%x z48EL#4dF`&c9CcpQzEPq8=)*?VjUR1`Z_MhAL*%vLqjUSRRHHa3;kPlYRB9`ZnUU! z8-AVCylz{)*L1}p>XHT6250xA&fGt=(tKM^Q>M3VyHQ2Po+=EMM4wa5xX%h|aKOGZ z>KkgM0;gJLfa7MlFz&4u6^a*Az#+~!N=e-t91bjBDik=rdct?e0tUq)@j4QPT`97J zB2+EjE_cu#wAMB@pj>Z)tV=jQI^De<{V%e~HF5lr>3P=a(LtBX=S!v2(f;XU=xJ(e zYJ0k~IhV?{*5S|A({W(xZ0pDPdut9m&&jeF;FZJ1kE=Xx9=Wp68}V~&IAjtiLpmYS z($o)T(D5ABF3=%Q=4&r}M7Nz}-|I%W(-W7C1QEET#lYp=OE#&t@VM`zb6K z4Nt;#V#R$a$3CXJZ6mJmBH5VSX1ydZaGzTC35GVvx!w}{&4k)rekfh+$OFjh>HIru zZo;+Gw1k?obX)2aGLE96WzvHazR#!M{11ncA&zDtY^bxKa#K-qQoZKM+?NqJ-i?uL zoob2!{Cm$n&Kq~?EftixxW3NPS~2EWu~!9omfxk$cGG<9e-=M&`UZU*u==#vPapIG z%r8qm@tR-F<(@aM6qSWHuSR9oQf+pl)y5hi+tl--yu0sSqs(~b)s!}WN6j8&u@ab@ z7O8exVJ(m%6-{P6o_3U^T8>5}ou4g^!||lh_;j%_GFMJ zFcY=LNu7eZwTQW`pfbY;G6QE!Jumm?Has<_ zTvi?;RWBd6tZex_3vimm-9u*)50TFp@wO>yCPdO? z!_aKYJ@uCh^PS*cWPE>P-HovPvAh8G0Yr7W$HmCG;c%Mufy$?g9y{EC@MBxy*2tFa z>q{n>Ifr~EONI2+D>5sNkVYO^r_>W@vpBu4UlhiVJ3p>YMrwmt8tj5CFt`s+|+aH+DJPkqw`FccWBoW*24$M{Zb$>XSisVRw zB+yIPc1R!azgn0J$J2RA<3#4AiXvprF})a5#sM$Zez*x1fL2Xy6~=Gnumto-D7^j{ z#8Sm))+QX7&|8#nu?4_}INPG+Zh5f$#jf-}C?)X{fb_sk8J_6>ic8#VacNV}X&OOO zHMc`po0!Q9TRx9ly{`xhTp24~cgJHur+drm)$?n~%RnUgWp1b2GEnw}HV;}~ecO}q z^;f)QfVZ(*?md!(W-R4!A1D{NuHqUqk!B7h7qMWmEyz;l;tkG*ot%xQ#1_Xdl0#iU zjf}T%uq0W@3_rMvK}`bSsbZzBnb z|KA=aq+Zm7meG@ob4za?bDrF;H=39XU=sR?LXs|MHi|S8CA9D3geOiUgG7&Qhm|ua z8eJ}5am0f^D#P8diaz0Y&e%US%o_Bc`Ctn&2c>#b0l>&Vg!i&s04ocg+j6ZTZ(qTo z)j5&6hR@MIUMt$+?B3nNocNHLK_o%nY5j%cV_q`UU|8$)>v1~yKB`VIu>%>FnT%3# z^v&7AdFD10H|CUORTmV$qMFVwR)W)De>gS3msPQWF216gYp&mU_)W_Kn+OmqDDCGl zfk&7B9o5|G&1Z8CwQqmA+LP(|S)>K2*#`PMI@aJdSi`rq_SHlZ-`lO*y>M&zy>p8V z0iF-9%cFh?*ly#&W-Ge+%WwA5+y^ZX#=WHH@sOzy2{XQi%`P*6@c**ZN0m5lB(jWk zvwU&y*F>1cb?J+EKb}qk4~NPv1as>zBBb`GWzmDNgIlG9sNxu2DaaD&QX(VQcTVU5 z-I>(zfymIPel8@!sxmqemeiXHj zSvWD)*!&oOkB{K9@XL(p%NyDwlo{s{BxKD!*Oll`%zQSzqhUbFj-R`6mjBqK7}TWH zYqH7nque&f2Fx8=Oj5fXEP2L~uWOUG$-fha8T;gF4J_|tItim>nFuBIUe$h8HM`Ni zmH;+!mi|C48@ zz{vb06snLmLhfLD%6rpN9I!hx3oGucCtYcQy#k&^NQo z`w+Cy+~%bvSC<@DKkDYLbyvfbmj{)+;A^CCQ_rAgL;Eko=>$fz6v@G7kaB#4SkEmy z&e*Ky%Q=i>9tJRj&KQa-RocDcBj&L=Bo)yN2eOQ>KXcH_`G%{Vgz*Ev{=liVu+ntl z@Z&?~9?oS-5RUWo&&slQ+dYy1D8`4cwvy=)s9V{{Uc3D^4oW}A_MP#}jywBdm6 ze0IoQLa4LiDaOQuHRS8{dp=l?-TB043U}hztD?uH&s0KUFp0nM_3| z@m9LBL&Vm~ppnHBly9!w@+pK&MSG5owRRQjQ$SdestfdUOiLMwzibC4d2}>dyy=Nv ze_^ojAaVp>)mke4)dB_q7%i8pa&^)A#BHGoqyCXO@dQdWvO=dyN`DY-j)GUAVgtQ# zm8NND1Hi%f6F0$SgsdENFUIfVzhzAuMPW;%)n7n_$h+ZUf+Rx?EGbZjWh%VxiBQUT zpt_v>liT(ddAuSS+#P2lZi2W_0p`Yfce4=~?yqvbnPJ5M4-=4ubeL?o`*jRa$XFuM zsd$p#LT>RTgqm^xlr?v#|HC-{DQgmL1jP9vs!jTTILIqn=>gP1JImwG{Uq^jLS{6=7S-nu|U9GdE@U z<1LU|G*`2hZ$p4{M`16%_5KIN5iFDvM^02SywPzmn*~eycFF~LIhu52 zC&W_k8CLZ4$aHJ5m{5Rp9Ab$6R*v9J|3DCEz)2-l<}cyo#WwiK#Gh3Q4}+z8QPCHn z@|D%R?z@~;t6oj(gmk2Yk|VWYpAHWMW!W}1gZyUa2_amfjnZ`#Z+9gxp|E$# zXn9HPBsc9NKS)@4*dE&19w`f?6=BLS(Idv$;%c|mE_uPb?V?C!BcxlAK5pzD(=WpqRNF|R9&->y6Pky zhpD5k2CkQkpDSAV$f^!ETq}1nI5G8Ca0-px@7MA`SlWf9{JcLc4A5kPXz^E0RSfw2 zD>%E8_i>g5Mp05lLq=N6IJGMxSEE0K8G2~w1>Qp6=QpO$`N z!pF1}+fdx_@T&-_y%lBQcTpUb+;g7fX7zXgVedWtQhKpW1416PfECr zviIu!c_{Q+!$#GbL}_n|6wQ4_5yh-GV{wtCH|as|nof8Q`iK)AbbUs=_tlDmCaaGM zp(=<*&G4%fbh?s$g~w<(ZOIGq#I3TEvb(Grkry|_Ty{!;L0-ilW4|E~b}kG4x9xHtLNc!3wa=0Jokv+B95h z3G%po7);gjst@M->2egjK6i6|xpw+;K;HS0acNcSDtfsbzwW(xUbCB$>Y08E-r>Cf z8p>%3DOvu-H;2@yE_gN*H|nGBoJ)51!u#%S-FC0O%iLF3gpXnn-5zzC{ zmiH$T<@|U`S@A;=R)GOd990~qHNvVI!)OzwQD(^ z%S?$IQ`{MP{t#<_kJYqNo&-9Slw)$*a*Ohd1c60chYV}L2j|U!wMv$^uPIK{Z_q{8 zM(Hc8nN8S>r>YA+a`=xQRJs{MT0EVO_jPi}O>U9(Ut%Uo^m;3d;*_`8MM9enHh-s28Fd+4` zd}psBFipQFE#46jIma$(hKzUX<>hs4OdpwdUDJ~cxEECfo`7@#DFW?Cl?8%D3wkxC zN7W?!73#tdPpF-E^}Ztru$^i8gaNWU1qWJYl)DK9>d936eF2-;(VbMW0K5&YjQ&-! z;>fO#IF?C70dNEam(!O(k34z>d~#2y8_JJhB)gv1`WJ%F`28Qh`R59l^!kWxqev=glH_aSuG{;#?ayA?ZTVNQ`uUICBP{RSqvEONQvE&=$d>2m;Tu^xr z(2xfW5cPljW*(7J&2Z+DPXcJKyGZtMzh?A|Ai(Xo6e3d0Z3;D7#0e2`5MB)=MO#J7 zZ=i%!oDrm$6w%zPpnx@htAnR^UxiDbg_ck#3yJ_`0I|H~C1cwkn&^z(CH8c^a&L#}?XZ4S1JO@eTO*W` z=bkGcvXTrcYbTcSMvYhZv9gN7eeWR)?2XG8%y%7Avgi1T5*o8iE4{5ri4OiM`&0m4 zxBNj79XjOO%Qwx{p#n@&aqYfG+i`;fb|Q^e<7Z`+AB7Qeg^FT$9_+ zs!LnNEB1WCC3gX;fa|OeRxEtF?1nWl>5AbhjbH$}2@=NwY06axL2rzFt@K}{L?c8U z=K)^hx_s2Z&yT!^HRKo^aNMZaL@4j$Wq$PT07w2RVT#1{?HRg8;Qkey3DmqkadsT4 zJ#^5)2VnfyiHtWl4U*K-XL&9kthdg&ZVzZchzrD@|I7LmkW+dOZ(Y9FWx_Z9=4 zn;4&+>~RZ<01sI&+F+yG@QS_0Tv8*wnRa~D{$ZTN%n3n zUrGWI2f3T$8RlXYSI%I?E+m@7#LB`1!)X>4;igP~It-ga>b*#0WH4+zP*#249 zw$Zq55j!>42}?FR1Re`7dKN4yjhL#Q+8Gr?b6BbaIDGh7(UX!CR3Kl&2U%*<^;DF< zN|?A_f;^kw1ls`AD^Kox0klzOFgZl{9^tpRsiCFbiuX+Kujs=3-BPd@?!fCMt!5Vm zkXJkj0h}R0T5f*-xMa$!WZB?&jm`Vks*`#5oAzv zotYQt$G}A96_>6NGvbL00^$sGe$dfpfTkzIF8ymVFOIzcsi8|nfzxgD;l5nZWL@(v z(f>U!PZ!`ofY{~{N-BcZ<$5p2va#fL{n!X$H3}4m=cGGkhy@Z8M z@ho*HP24Vtz7NnaI%1B|E~zK-1vpvbN6~Z!)XBQx_xBd5qn6I#`yUYa@awYSnm(T2 zMelD09!@7xJ=?J(x_wKwczhd|f=4c!Twf>8e$oi1o(+6$UItSn>}N zV=2uXoLRKFkGcZNcj==UitW67JUDT(lPd--mGQSxVfD1!(IwzEF)I(TE_;jk3gtOF z%k%nuaF<=czRMKcY!A(FXx-zozL?Ty#YM>evB+L;dvDx*r%XjzR>8sCb7J+^8|vFO zA$~tu?V-zW+#!(ef_*}5-5zYjToPybV5L-K`6%#> zaQArEBE^8nE2sWsQYZ#A;@1=()6_yMq z2pMA;7{jU*xXFLfbu^R~;E~a|^O8INVjLL`-d@00_LzHVYh5eU*mZkxORH;o!|{42 z-@Up^=knm|J6E)LY27}A)aWyI{Nc;ugK1Yb{lNTy+{Oc5 zZ-mEV^lSfnsR2!De#bGUG&e?N+yEr1%ejJd)h?<7OZ1ob-9@96OzmmW`mO7DtGU(WY;S_ zT&2l|VZzes%MP?Z=Qp`Z9^$UXBtoxFDwZ~>_{rL%=ZF%vv54A2)ER{&XwXN+>Z}PpNP{Cq#h=_GnfYtJS zU28TDvn!WsrJ*>vRO2-f71Scya^Z}Tg!*?fO+tG7?oP*G4}dU%UOcBDaxzlAUQ&!d zCd4aV@Whhi#i}E!odw)-ey?FR31~J4NTyRr71>{NdG(LE{P;4La9mPS0iUA^adWXexN+g3ZgO-Or@mB^z zrEK=+b&US@Zj%cd1S1Ig+rw1xOmoCzS^#k6Vnk>C@UuDZWQ$V7VzfGzSCH%PHjaD97G zf^akOuqG3P(g7AkFPmnS#h-NtshQDtqtT0Sq%F{obA3x3lIDXa^o&OklBQe3hZ{tX z>MVu}NFo3CaphvFNN`HYM*k1b#~eor^}-PD{b?E4X+PiuPEQ-t-<}gXR6l?n z8~u<&wk67yI0S=GA@ANwKKfSP-f-Avwp{EG&WfgHTVe1;=(9s+T*EfKwx|{_qE^#8 zX|^X$pWpb>rf*SagCJ$e3EOeBoyvR_6D}u_V%yn3@l(^bR&Y@Ba|lEn$MW4P1T>kg zFLSVXL_+x4Wl)O8Vxsgp=?e$jGD!D2?Wh^kI~^jJODQR_4I4J=zX!#Rdi>atgC#ez zNNNz^u(pD{wu^0_85KjOMq<}EBD~J4S6nwKmJ(YPLyfkMvvf%CI3YDgOblCPjj|6&`SI8YS(7qH1vS)#?`5Ph_dCPPuaP?eell9ZbM!q=V zu?x?dmuwexkF+;Ss)1W6S-egq_F=HW=f-U7gUh|4dv^OSn)iKyqfjfSkg&-f5R6RL#;}R+_rf^ff_i1Frg3GfFR0nC)!HqvD!?p=cMy%nA&<#A_!P5%&>EZ{voFuF5rdrq2ljo(CBEqHa8 z70LFJF2M}sD3naXZp(;Gxo~g^c6EqY|Gqf_Fp@(qLy!!O#dhXNVau|PQg~bN53(=ikAl#(T0vZ|%GQ$N!_Ub(K?{wQ-6j>RNG$Y3HLtjCFw?Y0aozKAqlS9H}%ygEz%1;NzNY(aFyAUSX}}k!rAvrqZpJvy9qmG!OLE za*o!3?HDIzW7+-BG2p{B%WmxBJ{}R|>1OM)b=;=_eNaIz!Z7(+Qgj;Q7%{})h7^o* zu(?8DQe+%Z>i|1P?*Gw8_APiE7?QVjHVKy<9}}WDM?UuIEmq# z(BP26*#qiO6oXhJDPPCa4axBEQVn`^da%DoDIOa3T%lW6F)(750^$5kY2xCw*i=q! zlB5$MaIz1>9gqD_N;80_3wacGGV(9kbjtdsnd_&Y^dGX>0gHGFQ45T@PY_NYAy$xw zq;mj?t&|3w=jonMDZ`-Q>~<9&3Gz}DsG9zhxj!)tSLkew9%N&L$s&>H!p8;*J;lCh#i9k;JHy(DM%she3P;+bZe$31KF!tZ9>n_kJ}cOL z#QI9y3wFoxbkRAns$&xhSea?*51YWc1l@Jez2D;dX3D2E=S<)3Yf&{317d8rUKH{v#e~OL=`au3 zt5+tMeo8@U#aUX&33v!mBTF)cEl3h~N$IaS23z&3V<{LWg*XlH4<=vPXK{}2D3uH|{j9DH^#lMFUyVSlx~tn{HmY?c&T^6~|H-{=q@&%{WK~Ck@r7&WNSx zr*g+EL1e#XX0Ts#6A2mVn1Z!vs1Z5Yn@`_%@v`m^#1kX43~BP``So_`fU8}3%D!M} zq!au3k)ve53|{5gz=tUS(~TU^XJ6Nvsi87`|2(u+jhn#YRqoqPTkFZujq?h_ZnK?w z8yhV4J%_HmA2&@~?ZGY$jkc?SA2pBn^B0_!-MJ}`>$ikAfs4o$j*eo5h&9F+gkZwz zv62oz6ei8~+Wom|&>gzmm_kg#>40vef?Ym_aL5DE+I%f=S8zi+WZi{*F7LSQg70g> zB<)sbw?^_(p98kO7fyT{LQ{Ka-xg@zj(!$g%jTAKdLD2JJ)9QcPuOjyIZ@3yGs;62 zttT$Kw8%k{*<^nYz+;%~tf~*P<9HCO{`Q#ij)t$3Hrs90wOagX46|BN8h+bvHLY%O z+@3wjM3l$Kl`+{?G|N_}8%K8jzfUp6{7Gt!Vc##Taz(O8S*q2oBzm2VSEcGJIYkhIni)`{ zz50_^$OGgp@&b9GJVH)m01}r02!LQD?}}xc#7xiEeY(&2&ZT?c-~Nzg2k+c@xHNwb zRb7;WgQJXmm#&^x#nm-@`VBt7$J^TnD3>fp2XOuKxaHe0EUV`E@%SD#m?BDg-eKL7 zR)n7Af%T}j!J??JbLL?D)RQWhCiurqdW;|I^6MXzp*?T7h?POpdKhg>;mOfd-6hvL$lO&Yxn zjq#>2x3l@K_%$`hT4GHkV&AowU%$I)0-v6m%c7r_;K1~UfO+uU^v-mMG$$;_2jk11 zCm7FDzjM>0MIa*h5Tc_(BjL0sL`o_`q?ExLacOig$TCZ!mpod=oD#%3#l4r)eh-d| z7@r^4fc(pJAd?;_Q;HdDgC&RK^e#|%5H z5Rc1qNUej8O(3A~26M}TA%eO9bMC2N4s*{XvCuXRn=oo|1cifHbukcwmjDqDiVMa( zW*%17DMzsk+&B)Z%9R0a30k>G5l`I+76m+D;SLc5)_w_)DdssW8)!3($yx=HCq@$5 zSP0LR5ysGB=59!;skaW9QiF~S02q8XUDLZJ8& zcof(zxfrU0@GjuUoY3HcK+}*jQo=2@*nJFD7`TmH%#_lfl!I8D&H4vZx$~k4t{GKh zG;`?%yPba5I@lZcigXXLQ-Y5uJ>n`SLSnEK{qMI=oELRdR@XDrlHK&y4GB(LoQ~b~ z5z)B@NP#sXx0th!eXwI^_W1ZXYaLqevKSOqSvIlmwXUr9Nr?}F<&CNGvtP5r?4L3_ zD*FDSXci#L%gZnr#}3m5xi8&CsM2KSSLooT_2=&%P?#q#kF#I?dT?lq!C`&=*Ms-l z4s)(~xEwauANuAxRPabsjl%X)+^jPEqjE$va21fqdMRGN`Ac>f`hj z)zx9Ybf!NR@BeizW~5*c3Syu`A*o&~#mTEbXHTEMIQil2>!079y#4U>>B~1KKYn=g z`1INL3$lDotF*Ix$B$1R|M2+T$@honij{jp#9dd8~F64dk`qk6tKdzG2 zjrlRZHkbY1t+b1(T7#}0&8u$v@%F~}kM`sEKZ}#|yPS)+KfTH(l$!NiW`-A8uQw=r z&OoY~8SgV^dM>2gt8nmKon4xu@60f3eoe}dxlz^6!lxoOW!e8?#6@z#3Bybiv6Z;q zk6`7p-f`Be+Z$=>v)(AfkeXyOtNYc9_7fOx_O+@b2q6@NY7nul72@aDZ~t`s{B3q` zNU{5bf2F1AeCb7+RcSsAkY3wicdBHBh-^1c$y&_77D z=n=l8gdAZ^BwEjSTTA#QB@#qKBFFA6Q5F2igfF`!7Zi}o98!J; z%tr8i1@w?m9fB<9O*8%Q<)qS-O0MV~sX+2Yv+Quy)_uR&xFLl>R1zfwyL;Si0@M2n z#tbvf1$dVY#@r@bU%{Z4D*`LVd=pruL4WN7KKZvduiu?yzbJIrxZzinpKmV0vy;a! zPM9(zZjOF=^76R%?%BzU7j3B9i&^5Bqr)~)I4_|M2z(w)zd6tT_P4ZT zO@`lR&j(GYu1x=kqB=V*E<-tLj%b~|YfRO=2~|;g;IGN&o5pbAZD^_@)JOF5?{NlC zUY)-E%bVBFU!A6EO+Fj{JY>yg^4I&D3R{_KjtBi>F#2>`c55qOGnGBK)=c)3#<=xN zj|aYp@k8NfiM_r%q-~Mwq#~O_qHuF3%a+G_$=t&wrA#6e_vZPv!Hw1 zrkMrZ+g8mi=-#$#Wu>YV7{OHbwl(AZgEcou00$3EO#E<#oP_Jm0aHf z?PcQB0${^{O#n3&)v{jLpILkV zsUC-vD+DWtDkR2@rT*p)00In+F10K zMP^uga-c~;ECEh+rt5aAedaV0=LTGEa1K<6fU*P*QE8;an-~J*%#y?u0D-fy#t{+0 z?Gj8VquN9w3_F+uPbZRQ!0#RXF1n~?5rw1}LVSm;UMu6hgYgYygb-Wm^)hOuErA8$Qah<&=u+y4 z)1MIbK}1BkL?}XJ?>P*?I4^`U+B%SyNn_nw8SkAN+$|$UgrRi;3V}=r##8LMfFQ>} z%fV|ZPrW6O{Jd8?82-Z^s&Vv9&qADne%kf(I_7yd*k&i*FuaH5m0$bYXS;{${U>`5;j!sWL=Y5Sv&X9nlUVl=UQY@4R*c9YuPrGh_h< zX;@6I3Q}O?jZGJP#71FYc*rdUPl5ztF*sL9S3~d&GF&5J2w|;!_fE0zmJd>BP32k< zgNRPMNv`;)$@$C+?h z_l6f|x5f2?=}R1ouUot^?gG-c`I7rw64g%1FtXI0RkME;l*JKb+~#2|C&wBsx~xd+=UV6E#sRUGeVYWu)AeX!3> z8W&WFmF=L>c-PV&5;U&3hP*ys-|+3p)W`pUsfOB^X0Gsz#Oj7OU^_SPk4ME$L~T7} zw-Ry^23b6|2n3Qsc;YArXzmn8YI`b$N^tl^5I*Y*)RWy=GOat189lM0wjvJTfV4fAb zdRWbgFQ1=&qrwNFLa)5A3I$Fb;@U_Vn8w^2sjSf=)&62IgrV)JFzIsAf~h9^a25KG zQruYQ3ro>UTeV0rlvlOMhoerG+6Ipkfn9KRUw8rw4hySS;f>EBoSQ1_RqEYPIbk$J zwo>+;Q9Y4%@2Kn7X-8Crwf4^K8`W9Mq}VrVU=iYwJ);Jpo#A`dEP;T`klwQuJdAAt zst|$3y`vf}!Q1W~)jC4=kLsx1vlS#%AH$w4HlYT(cYVdeTZ;B9krpQgO zhvKfy(RZ2W>he53l!w?9dl$Q_F0bUnje9ff9jv8amV>h`R&;x9yex+GhRV3T8yOCr zVEynw4s{Fk9Z0n*YIn8av~TYUw?W^YxN54=rw0l+Hpbq;gR~->rO;PK0<7sR%ei z&Tlp>Zg&d2eRX?%UAwcBFJHvDds}n1khgL~|9G_^o4y{5K%dS#DWMaXTOK?|I=EmA z1C`Yb7;T4I&}tK#Rn(pz`=mE#($ z9j&VmPuty}WR`l|u{tb}md;@+BlSV8(Um#N?-FuTcIlpjMQ-Wp;VarRTf;F6U;fjx zqk->-N9lbVB=8bpX6cPv3$xO#JMC>(T@Ra*LKB|LjwY9*y8j60V@e~7H-80ybS5M1 zLVn}B8NNe|!VgzkYGu;-!V-`kS+_>#<|g9mz1W?4TLELo8Vq^i{WaYM%H7IIV0>Y9T^((3MEzY)^A|M~AK z46@U3IfO8&rLnq9Ul9DqcA6ixpL)%>MLr14mnF2npU}i|hIp_Jktn@a&>^>i2<|wu zgi+6-FL0!BJ3>p5NtbrrCR3v-G|hF_&FK-}p=r)jy0r$UU!DP{K=7NgGB+$bPY!{y zd@QSr!y@)ZLulwtXS0z%cf;wg&I3xf#i&VJAEFuco4kEN{o%-L`Ly#oN^4v1i`bU> z-th!|aLRx-fwc%q^kzpVztP*K^w#0^zH!_Q$8l#phOp9!h!tXv!+?d85VsM>G>Hf! zi=va;a~#;&{;l5ifMZeyL|Lv@mU!A$_crsz&UQ0z1{2HEi?9YMPQ2LEyt@S4(7LvlnLIFGCZmiBY@$^uj$$JKyrJPFe7gV8{>^qaZB3bca0?ELy{9 zdeszLCphqjG+UbTOp@Y~R;2`Gsk+tKD91XN55WQRwY`-^y<0k%f8hSSuzCPH7J!u? zhG8smdiThzS@PM#yQ{?BlqA;8%ECF}Rb8#&i#8Tm6!Qcxu6 z%WQ0b6e|5c)dGaI|Ht07W;cpt>8;cTY#ss$>YP5OB>AOE%XSIbSyg{H0R%FW5~z7N z)47XT!Yp7mFn{aJzUBrX2}uOz269(*jk_z;X(_%h2)OaZy*D1n1pe>&zB6#VzT(B?~q-^aKkrey%nH=wrD^EU?Tsx+` z@AI5=!F1Nt`S!x8!z)=u--G3nNW<~?X*QhvuAIB^Q4`w0ZHBh5?xypz*?4*y7Tda< zJxwm|XO|ZI^ZIdiZwV6LUD;M12*Z!~g~s+Qic)(#6r^*(u7boKX6Z9id-xWVtt01( zeBW`{qR(NUMLh{i?<6dmAWIr0_B_rK=yy4lDl4Kl=a6c1X_w=%J-@YpT0J%O%o=v3 z&eA9jJmT3Nwa1$hE;G2RAYKu+TZ^)hl`QS?lzGE8DGR=jSNcYPXKIPuA;31}(e@l3-D=%mmvvzG6oBWY6yJ=YkCP)BB72 z+>o~>l4}x^C@`P&wG%J1;?wfNhv1nlUyB=eDQIE`G_wvg!6GCbZ2>;aR`3kYdWP1O zrPLDpuE?mKo=$XZI3VnF$1cw1vqx)gk7m1Zk13^mGCGyf365VII@U2ycy$%JQ(Rra zRccwuDVwL}gp2M#8!Q55Huf+{zy1s{KfutFw!ziP?)ry;x4PDC^lCW`C};(4XRvh%6v&ZC0%ib~JT za5fnaw_33sXM}@~3L*0WPe4eQOBx2QJ#>jjSMU!Kf?m*svP`GVQZ_-FF&8u0HX*N2 z5j0Lrh21L)9zIPfc6%*)m!fd-1^(C%QL>9A1$)%Qnq3zhzY1PXg+b6TSynukbbHL+ zbrZY6E+`bub?i7FGG_@7)}k(i%AIMy({RlWi&}}{r-2(s33Y9HW_<_2h$_8C)PpKG zBR{Ql>ssjm(;alJV%O16T*ck+>2kK85jbT`39-#>(bs*~b0i#~HIR;l zNq@enl{}sbLcI zovgv?*b!c9YWE~%hQb9f6*Q7cGE><4t|H4WS1LB)>VDi3&jr+U5yNm4w!a?+&Q z%Yaz$me0@TbV=dHmjhTOyCry~4UB?A#{6+KnGZkNpU5h+t*H%qV}FXiushBQe<4W# zH^9o`Y$bdfKEs_H|2DeZW=A{l>`&`-AUeGp$R5oXkm_wu+ZzSM^S8CU+p$1Akqf-R zcILr;5jDv?UzPyV{-Y6gV)%rD+Pot?7?w{#R~eH9>9R7G?8NfO=JCFzl)YTsej>}j z+sV5)WBCBC)h;~N<*aDn$>#`n)F+=NWFK0S>${!t33iW~SX?xU-BKNlP=fu8?lMNF zymNF_li(eTUSl1ZsIZh|m8%jQ(2j^iL+2M}z1RbEJc}rGH+`)3W z&MQ}IE=Ozut19<;16QR)H5}@z#>WEIk3(?L=YgAgPa|?~pvyo(XirmoMK=4Utn_75 z_FYBs*`n2hPS9e_Xp$`Rk?DL*SBLGbexDq#E1a-$_-?!XyPU?g)rO z`QbWPE@()S&EW$i|M;ikhrq&hwjiDV*njxf9zgQpOgsXN;R;fID;`R;48Q3;C!{TBG_bf2G;-np)G^U7XJ@{X{jdHb3Y^f4!8ZXcC_b#8+-;9GzbG3ExHDd@PNs6$$7WT&r#v!!|- zp#nSYm@I5f@$|~jbja0K7m7liRpFp6F-^R=lwIxPXtd6qyv4pYcFI(; z{5a|C#9Qq_DGXmX6d*NBf1tsCJx`Yv*H9e4uPXyZ*Lwrx3y&&WZ^3lg##?5b?{Rz( zJErKn3XfK1JIDK6@qj|75RYnIf;;aG3jSNq)MSmSp5AuneO>d~9;@*^SgVaLL@hgC zI2hrX%AADr{+}%zAG=*^+oJp^8#+4yUUvt?HwUh&YXi-phNEimmuC2~qV%2qKp=wH zoDTL~ee(dZvIw)U_v!nMgGROgmjzFu0f%)8IuR~aUC-(HvIEbe<%x&&&1|Uy5p*IL zL7QEOI{t=WVolsW|D)m0EFcKl&a>ANOG2gFcZP@IA4uydRb z?{w=7W@;~^gV~RbCELD$TTsu2Q6ysvMDir z*Dw~y=c;n9pT$SrzEd0-E}qkLt!{2h->l7f??;=5UnZ%y!RJ@-;kH(WtAU~PWx3Dh zWK?w^69=fNp+i(kJjc{ra9TZAGaTG-RUHtZYq8(8@RAs;;t9r_j~C z+5~0Q_ceInrrvWjMRwX92wC62ma1CY{=;|0*73JUd2Mpr2W`D&1$uv>iD}7RWrAmC8v|2SHBVMNU)EixwLLc%WEFVPI70>f@ukSiNQ|VC!D%J*$too`#sN6RkotiQcmJhHV1JowIVRXkX!Q>e#YZDQ&HMxf{_@!7%WTHE*5e`L-&Ouc<1*J|6M{HSWOYpA;F zDK1eo-5B&-cq*njF#G+!X;4R(*_@g#tPn}j{d@1z_1_p9s{Mak^b{g+T(4-V2ZUes z2YyfUV5DjL4vxB}ws#{qcj9nLt*(;4QDE}nG}N|5`O$|i?;7CQ$^+RqC}I5{=-|_y zYZ!*_DRip;lHBw=fRZ@CWp1=-Qp@1P>=eN`@5g9i%Ev&L1BvRG&FII2$cbz{^t z2A=83RP`La*D{$=+r*a2QF{jtvl+D&@KvMOPJLwi5!4m_r8WfoeY$s_Du(CxRo#@S z!(Iw#nhNa^)ptFr>!zlgj?;(6;iuE;3}o|Fu%hSb>zcmDs(pUGd)Irj6QmCI>JfY? zjc zyNO9~C`ixM46om#uI?EFS5ti;>uIFtd!C}Grs26reaTfH>7vKYM zUT;@^4IP^IZ2-_0-j~b$4J{{9s1}ptTal`k?JQIE6$`%p#&ao{sN)R=2GR6(??2}> zwxv{+m*1>bwH2Ji;kb%P=+eZEKy%nit&QyXZt?3!#^9Z1DSP0n7;axv`~fj#Q*o*4 zYdsHYBc^HSimUmWqZ}>-XrD1C?J9RjnwCB6l{;6>bL}0(fo!x|1~K9hy7o&;jeiXfx8dmEw|%i7jSJ`lpjf- z7^HhrDaZ(Og2eV-*{apZ4T3b@bI{c@a2-;{vfPs!?gaFlV`C}MsOBsYqw&HgEk z&eun$D)7pVbB7KMuoppkzOKD#4WMUAUS2Vb9~k0^{PyGFM3;oh43iYRYgjHWj0${0)pmY-q(X%rI&RR>AaIB+s{B1wA? zWp=@)B-%sZGeqfCjIp9TfkQWa_KVtpa4H8T(BguM>zAouE6lMBJR8xQ;W0gw4K!(*)1l@npc;}SRjjK@5N0oJ+L*rasxyU0D1 zZd5Vc&l77P@&Kg#uws!1F`Y~=r5h^bt`%Swh<2)1nppS6Y0DzkS3X_oaejrlb<9DM zE~11TbBcwDV5~KDMKIEE6)ecTC4?QnF1`k#5cF~#iCyni7P|S1ZG_NMB3A3Yg&F#H zIItd!E3^YXO~oF`=OFAMFExcO@|XtTu|SlLfZmYgIR}bhpkli8*sqwNNipuETf+9H z`WUx*au03}Mt=Z+jBo&PL)dOY9OfZdV-XSRApydo^b0bU%27+|VnQ~C!G?KTj5N8s zoC^UT?@-a}c&@xN;mjTi2V?6&ClJJRu;r0eJApp18$Gzhaao zA6G{tp?wXD`X!4}>OI6kh%u2VNuQ-ru$Y9YbVZUBL<%F}5AYWli$I)TB3JO_@u-)8 zV6q)9S&|t01WVNRL1IQkD|67*y(ZF4l%yffA7e21vy3qJejco-bQ8=_xttvI5KtF$ zc{#|UZWN+&BO9-93~EeJ(d-6!7sV^G48DtC%UY$|2uuK#Bg@iA8c8EW4kU*hCql|} zNEaTK6DblSSeCC|o-;WH6Fs73Y7ju$aPsSWr19yPcaAgy(PY z@yZ_vl6^cUj3{0YbO;@WuWu{^;Nal88y9czVb*#X@Dd00s1fMn^NPe@P^j_4kT+Mz z0g#xNA*csj@K)~disv^vMc%U_UO+O1+ml%S!OuYWw=-d-0Uw8^MWh?Z5_qf z`*sCkA}=q(K|n7Uv*Q!cD1p0u6@=c1JLyu7nbK9n&otCy?k<1jC1mRXg;RinSj5L& zRFRan$P4nB0?rqZoyJ+@ddM8x=NN!DVZ%Y>vWs8saMr*u8F%4OJ;oteK(O$a5y3rF0P(ZjTu7Ml<_Wlv7<*y-bx0gQ1|ttr zZk$*CBD{Kpn9aE5av&7QqwAQu{G2TZ6_7<3v1RMHOZ4)wG3G3Wt;f)B@B^Il5IYX} zl%yGVj*5d}i3nVqd>FV=tjqGOKXil)R4qcne=DGC|k zywGS(k^C?wvcsK)K>V4pdfXa5ME1Mhgl_9NB=7f2Vj%9Ya6cD(s)g97so&k zG4um5lw_sYq2vH7&1jM>afVS(f%iSx7O((V<^&mz?{LysWDu?r;ByF@+)laT25G`0 z>4JiOA>F`{bicOOaqxnD+$^0S74N;q<3<@eKFo1>G&)@f)W~LN+3=1>UQj2)jUpw? zr*TZZF@Fhd6FNUq3XB0ON;`A}{-BRDp$ZsmKg|TtS99K4)Fx06Cn?L@;-N)XX;eWE7dx%VE|t<*ra{fWc7kJ;1qbIqq?WOKRkxCjmDm2VQ=2>6(cRjJa+G zBrmksgiJ$Mz+8894tvQ8_3SKO=5M9xK=n#iOBSQp!Di!aXSQ`5xe#61l=TxKv6DiY z#=M1lO}aG)?06Yq!;K0U1{bzjpKuq*y)8tNR~ach?*t^T^;?k}SZ+T*NRJ7PhYO*5 z!IY6XYv93SGvYh^l|Y7JhrWUKN3o!)!(Z`2wC0DH#`K>e0?*Jh`p+zgDa*)+QZ#JO zcnkUj#^aGxq~GQE--c5Gg*DGif`-6@Ue2lj8?x^K?h+jedcJ}fR?6i=JB$iImW!j!x3vo;nH}N1xxHa&JG=|RuDXh zf(5bzTlD41K{_v6XnE*JC$MPUw}FH9;kMxE@NRN-Y0b~APm>1`{8X^ssXgTGq-lW- z1&tH1Bg)->_%^t458~VKiw;#^khn|LQ{r~0{O&Vvm;c*X{%*!L*q$j1qkp**H?hah z6Wqd_JurVG=G$QYX3Q4Y4$ru0GiNKbDQY9X3F62X%KiurHB%A>J~oNHLkD5NJ`qHJ zaiSf&_v((0!Z-w#7f(sw3oV{tiprFXBVa1IvbUcLBZup1-cy=19Rtvw38! zue}2oRSO`$C7H7p0d8EWd=+{(Zww+MlKN4+YT6`@<`R~wV=B-OFZwF@V2|m@=^6>{ zXdDHiF6j}S+rfo6X7f6D1vPBcwW9>Lc%p$WN(9Ffu6anKG4H4wVan^%Q%tr+^(A1ixaTjfC7Lk<^ zha<4`)&WI%k zpXr+i$Rt$0nYQ@|hXx?qd^;z|MQVFU>4K*GLw4E_++u^i$^CYg1B*jXid5>tJ3o8i zhNCy%Mqf}L|9~s_YwWs&DtJb|cCG*S4%H7mvStF%?GA2Oy0&D)Q=FckB0KAWHRX;u z(&0LMtbz{L!P7Yf3)`Q0A{uZNV%#FA$}wEHRcQcx4BhSH4PPgrkcIpoYiG9HHj=F2 zSLx_`8xpCtBPOP~X|X7Z7AVQ>b51CVWRXM@1ZXTW<%xOsQ&|8dkfQ9){Oe*oZA;&e z+Lx@XtWA;EzX3Xu0jG-Rk)+F16wa*zAb^*p8GLY&J1`qBLl9h|=V)i7JD~A z%*|3q%4^k{HJyez`t1@B+*;h05iFS3 z5k}6~w*@P)NkrVOpqH_s$%!9l__xoi}S!PUC~+J0F)-cO?c{Tl8v*RNGpp6pv$ zri&}v;y?>)zOz~e%uV|m?Li;@)iV*lpnv}U!#l9`#x^ZG(d>Ou$#%In=qeo3U8E$* z(Qd4mUh7*q71(nt>85q(I3Q_8jD78#Or5$m8eDPwdjQ_E=W6h(bb(k{c+>7?cl_j-9T!?=SoP5d-m&K#_veP z4r~wjFeXh}n9G)b`ysHYZr&6E@)P za0t4im*GT(|Fa;?zbq4L0~x#*DF4^^xz28uS$e|@>Qhx1#EqWM8@)DhX;*nw5Vgh^ zx|hTgp7X^fZ~g|*w;A&7flhewWVUfZORwPKu592hf?=oV&|WiCqj{5gzp}zhTU?3r zZ$Ve#e6eh#qJrO0_`4@1HE=}v`CG#s*$2WO)b|Dr>RFtxBtL+jn<0a1~xJ$%eC}#Yi zipm#c#5DuGDM;VG94uPOlJ^7iX6XxhLoRPw63k_*XnOT?F=Dzw6+Opmb3-W&8h!qW zAVC)@iMYctaW})ixt<+_35IUM&M0JZmP!25H*tP**yf`&W^SuC71$=@P24w?#htx( zX2IGt!cd3q6mg{@YPwLSY|88?y07ihYfR1JWXisbUQswt)MCLjyHxN?QwqrE*Zi3p zu|pA5WUlit3+VVv&{skVDT@IoupYb1#hm&A)o zzX)^!>ji&>#X!B=LgArS5LGm*r_B4x&E$JUo&r; zzN>VrzMG#(wWt*Z>C7}Lw&TkVm4_tYMhK#%yho;9!TOQV7IPa=K$1{}mZWl`>oI(C zz;DtonAhS4M%!ZjOfiqwDgyM_6n}H@%2RnY&7>wyfWK5DNwX?w_BjYm6rLpTi3LU5 zKKr;|%=EUgl;AMRa`cBJd+TeGFFOmlgdhas29IW85Rc<_pm;X-9Vw7(eP649Mlg0{ zv>p6y&Yy!TDs3Io_DqnBJk{I~<@V(YuhHk7@0C>g9F6>Z$c`gl;DWfg1t_`1R*>vn zb3w8FODde%-o5*p_RnB>udaC)Idds#smng^a&oRwhAo(BmN1W+x&G7g@A z^z%T_8*6q{6Jasa53t}wvun+}=LG^Ppoch_Pr~@SY^?F@8ieak@rv7{3+Cy^D{TXV zMO>3d1vj0N0;@`lKQAhhW#Bt05RXs0w4}q;E-l$Gv`fkVmYbEYXe_KwQqZ8fAtcON zRl?R9#lct1Q^a?*+FGbp%)~|DORfj>hJt9}{6Y&C&@T%DiTQAYZwgkRRhqpq+rVSN zD`l^ED^IhSX{_83XluQ^)jVINZH18O{kh3Y$FU8b?SZEuQXi>w)IxU+r|Tr9AT{4Z8GLo$D^ zBb@|1ckU|Ri$(jb0=|(fs|&QR1lGbAn0>fbf&Dr2diDk^Ho+A9J@e_(3i_ae3~8uz zav?f|+cL0tjUoGx^^L?LGXEr5KUPK3R5Sg^-e}PFHW4ibD1OUpMxmwn+-|!EWpO z_FyWA_>M?xW2x6p0`42u+ps+om&`eZ+0|=M`WKQhs}wL}%_vV2_RB}xBIN^aqN$)% zp}$}PW(N%kl%**=4%rfs8!5MhtOtLG84+){l5m5)C3C@zUAj{RIc|6nkp-6A)$C|! zNaAtMzc;c|?b<%;?V>-}*(Y+MBs`GV>|W&qhB9l_wiIBG-ID4#8a;psW=n|vQR=&} zQ_M;B%BP&@XPs5xAe$9I^VfFF_Q?5(rupmIK?v#LZ&mGGCW&OJLAHULNVrKZHQIqj zC8!4doP4n*v-kQ{uUqcRKpQv(mjFugZg9qX`l+DH)7ebRV-`kL#jxq;tm6@o=_t3yo}^5Luu zW{Fl~NyoAN0jTp$A<|T-$V^wz_K7}>4n}fko>B(n?bFp_8nD!s0>UMENdtD?wE{g& zC$GhG9kHWeZ}5qd7?}!K=t5M$veTItc0}R%#RBZ7L^oit*AG-O6`k#rxE48kzTn&d z-&OcQCA1Zix<}cmHHlOxv@2Q-Yf4LNf*1!C5o-6cgVF-eWhYw}7J8At@Ry6?IZG)o z>v7OKwVRDM+s?kj&ac(QDG9 z?84^$Dnk2sL_p{hUQrmR6e=m8Fhvcxyt$;)2U zsz9&9&$2l)Es4G-akL>U8w*Q?T${2)lvaYgo?7U!=&p;IQHm(rd~CYNxKT(g7t-fs zXvUj5@1lSL!FYGAwumd=pz%}~&h>NpF53v(^B#}gC34=Z)%STWBD-Wh zUHV`4YI{6m-!7pm^Hb(|{4SZk*@rMMlI)W4vm|B)&)FsOb(W*4DZ}3@v$zg%mBfik z>O|#-3zeaEq7u1K87U_!PD*!_J5hOdp)z(-E@S(M}Sh zV<#$3nxIY}vxH*yJCMp;s7#!+!%5&q#a#=W&|#wk87FOLl03Q@2d7R(u$hyz%+z-$ zGES;{=A;46oGb-qZYs&iG($#22P#g+zQ3I`yZPLSij&b{?qrEHcQVGzVc+YT=}GBPT1p$Vq#NQYT%BE|)q`aZ*W3CxhnFNwZ6w zly2%IN2!x#L+WJNkOq%q8{yZ1l#@{=byD5wHzz7ix3{RgP6YXY6pE+s8nUhwW zIobbbPKMyjP3bymH2L&#^qe^93%QeinLEkWlaoQ~$w@_hS58{+cPEK?cB1mbNpJcw zdmP#$2`5rhCyOj2v<#f|a-)=HiIYBIq<(OB%oP4}%D(JqvE_Fzrt&Nv2ZE4}Yfy_^ z7uWPG;J&cFCR6TB>ow?);-wZiUhUxd!JpognwLJOndTjE>e5-&j86hDy772i`e8f%7RG^@uP&!cx|kv#GeIK8btaCvg>b#a*{6&S&qe^;ulL zy|Xp~U$t6i2#tN)hdz#ETHm_c+BjH+h&hvp{kI5^LMl45)VASc-Zm9y}}=@ zr078W(K|7DFP;S-#D)7v_1eX7zx74R&pQ__C2q|`$BB4lXYjU`&n*T&yH`BJ-4>ol z$k#8<0r>K)aRcC=e4X-4P@DW+6kLh$Fc{Km-s?3W{C=01GQ#o*$SEHRtG4x)+GWzw9YUbsqogr75MosL=PbP4xv@5#|S?% zGZIG2$486H2PumWKmqwMVQK8+ZS3nk`DWJQSmJN)A^aZrdc0V6RzRz7BST%AZchWa zULtgWEMD984QT}L2yI6te#Z2%*~a5YX0|K&%P7EjrW5rReyw@8+qUo?^E&P}E;}Jw z({a>Nkd8_HQ)gUrQ1#JAz%) zP)h>_Mgz-NfkZIlY#&+yYE6RNX%B z0>w5Bji)|TfF+`orRXK z`AVIE9?i_Z!i9VnQF;Jt8r@z%x_RX7?>)-BD2U$&`5Mg2y;z8^gWo>@`9qk;@_&SV zAFMvG_Q1-kqhFUha2XtIIR{wc!FC5WyF;w#z(#w7CH@Fad>z4$vAmyP_$h>wH93yb zI8wlzM=Hg$SeQmPh~`>;6lFDf++d8G3jLPXjI#_ljIC%ikTNwYT|EJo=WB&VG?pLf zTNPmcXZahtteYirgQiuv4W=`&I0mu&sBtY|in9r9E?!l-$e8u20=D)-AQZ*YdooGqL`sR->5W$XpA&9BhgY(7K9;~kaA!}s`*s~nW0`)4xFg)Ld3kM za^yti*on%C6O~gZD#)Z^RL-@1Hy!EFM&&Yk3esRGKhv-(y?o9LI<`Y%F@)9xM&l-% zp%VQ((N{qTmWTgr1{M3@6rwUPOPp)P3}y62&F31=97&U|2F3%^j%*Dq8Q zOoCha^3Z5pVL9k3`PRkYz4%j1p_niYz<_G_&sYiEVlBvLK6S8-YrvXq_yN`eAD9vD zw{WQQBDZr4EI*Vmu-wJS!1C>}f#pY=29}>Lb%$Olf|r-nX<@(mnz5-s;ABN}R{J&cCNmK&(P`|_)j zM9arxLw|llX(R54pkgf za6n)$OQSfpJj4l@mwucE zt9~v&$SqWo00@g@CH$ot=|14RWK{-12KXFV3A{|dl!c0^*bwuLi1*O=Zk5(dzNM_H z$lae_RnB6$amjBZon)Ys1;UTKMxx|#^(?=TFJKJc)RFAHtdegnfxvvkbKgPU;@kR3J~b1c zGoPT};yc+)exhmka~;dqeZ+?fs=xCXtAE4GHzvd>C`az6(8svVRc(F)s{%r6P=v#t`3C%-7|&`CtJJ-`yaB`0MZ)>VDT?_rK0VX!yT= zUO?^dCV7VH-wz`B-h=q(L>_6&@B_7grk?@W{|7pRhOa>|gzA5gXHfdTg7x?H`B`pd z@JB1JF%FRqXauG+WCU2DE65ePgfs$A!pCvf0^lOl2+Zd4*lkuIUds2{B+ycGtR1ve zf-EGBzznz)R0sejNGlKv-=TgHz%~;rbT_d=w-YORA^=&BuFwt13f+;cymKUunH9kH zG%IvdvqE<@D|A~!0vR$ft(P8EF6c9hc3e2&-1e!gJKsuHC3XniwCs;G+ z&%iZae->gB+ig6?ZcV<5AU`uhKlpk| zPRob};Is7wdoJb+_DIXTbJ2^hgCvQOfzGPj#+k~vPu5VF)89?+}~6XlA7-3nqb1%&-4vGr#@2+pZOvPyaBf z^i;SEq9XI}rQ+Wz8O{E+IyrhgI{4pwZ?ASVHsz7T|Ehni9emv1F44OpU#Fwv`qBQl zzCS)0pPU{YSBvhy8_B&ds)(T78E=^H(@%>eZ2rtoM*p~6%G1cmu5OjZ=$yertwS3} z2Wm7vIyzCO!_j0kJUCXv(RO*YgUO_5E9D1{kJSF;=w!4vR7PbuJ~=v6Hrf`VWSpU-0pmBXCLm!Yp2b$sneS6|Aps!^o$-;EY1QK?;{= zXP`pAg9`L1QVS&EqnTJP$(RI5kL4p5g@A}%>*nRX@+56v<77_@s zR|gXQ1Q^Ik0<^u!qs%xNlZl;r#?bJ=_6zJ6TX~X6XrVn4%I;q5UYs6U-d8iWWm%GK z%{Sq!IMI`VSgB6D&XNI4uC1MhFVIV5wN7q(LJ43((Oj{Jme0$Nmxu-RLLphPl>1&= zDrH`Hr*4f<>swHM5>O-pVYw<~LfW0yZ6p+N*%1o35l-NC_lr<~)R?yKg?w<&+O#nK z5z2YI_c95mUxaI0_(3M&tTPZg31`<*KjrMYBUA~LAhf|}`iFEOILjbUw;-acDe?QC zq*x=gRA;uZ;Zw0%x-OmhM~yDMa8WuJPLp$~ew}xuj?=l&@Sk^u)AU@~0mh+XA(@Sr zdXYe}B}vj(D#DQgkqlej%$A9;6RCH8QE%=EB?z_jVi2;=A_>JTYx|kdly+LJAr8q{ zOS=?3E}?*SLnxp-5H63MzO)VEH<-<>6D}zo(^jF>j8w{4_h2Cta@joAB0GSw!O z)4#nDO1Kw}?d4oemPINhQm()xAT*&@HVKy`L?RY8Ru07RtJopEzPS<#P#|2Zul2-= zy@u;WAzc}xx-`OwIzs;s1>6~32y@9OMw)kuI{g!&1Zn&p-3l`ZQCDbjBC+|6y3%pz zN!#!sZNe966Cl2o&MTNIcVi31-K2RV2aQBN1)&rjqZB(9E~$|=HY>#MQVJ2TBN4{Y z&St{5xzST;lvIjX%>wFRh^<)& zO=K@r=@tplu@!Dm_FhSkdJ*Hgk`lATzir5!ISGlhzGhvWe ziV(X4eQSit^&p|FMJ*CiXrWyn+?)#S&j2PJGq&QGa7)L`P)s=gEzMyL)DNKxFi4ek zLS-FT=alr2!oY#fq!H$wnHu{n%&y$GzzJ>hJ!Cq8Lb%%9TQ|}|Tl643;`uNT9?*J# zr!K_8t)K^|3$;1TC^7P-sPMNfh*@q2i^Y^#3AvOIlFOxRf*iT5S872BNebmc>K|l$=}3=YevuxBLIIQyD*Raj##%lWD$2KxuqEF*{oe6|Ooo22 zPH65{2b9aQpVF*FCF=yTVq3CW3#YSeThiLM{jCeUhC-X&?TVA;Oe=ZkPN^*^NT^+> zq{sVLvMxJYYG2t|TNEX{?^DT&Al~MDLUFBB8_gbncm#o4 zovJ8si_-z6ZF5GTxK6CHvJlvo+5!dc6{}rFt`YjBZml{%iMBi z{an6fU1Mg2`uUe1s4Mg9(>_>BrqOI1?KSrgV7FOsjz_dwGVeB!T1y6g)O?|{{0-tC zpYZz%GNC|BJrsyB+2Vh@ILyrF8IDT*Q?usk^4c)_`!I%G70316q&^z$tNoq5{c)q7 zz*wpMX8oW(9w&!Khs~W4#5jb_xKZD&H})DwFs?UY@7IBUQyZqScX+r5qmeqQA2u7~ zSRFMQDmjQ7NAZrrXEhtUFy2wgVKdo}oN1h)VX_^dnz_dB zCifaDpWp92^<$H~jsu*G4|hNv9vvJUD(WPEx2eQwKJxiuWPkj_B!Bk_+nwh9|NIZ9 z%)brPY>sn%In8sc@ZbKm?CHOjf2$QG;*(JYbHZnO6uZT|u#LYOpY}f;{95^H3BmFF z{qO(ZX1v>$-G7hk^_}q^?C;k1p|RV5@c};Q=rB>^qrKe*wry7(C3`!`2W`e?x^CZW z6fX&`Fn`r?lE%NSIJX3ejm0m|`k0y6ugA^N{*D@toAsmdQ9?2k?>CQVB;ITN&o<(H z@xQkaT|dfnTx;7I8i4;1PvHMvjko6R_+Wo;PsPb$k~A9%O-N&`8mhU6O{k9(II64h zPW@M{Cf9g-u|{b#wx3(4gWtRR8&rSLY_&;9KLP^ml=RrsJ`uHlN_x4|2`(WNoOX%; zJA=5eZb3kvpO8Q`;)Bm4N^24IuQ#jU`?wkrM}j$}%(F)0^v~D}(g0srGnwLl1n4SH zPeD2`6j<)iY7u~!faWl!=zf{|C*ZE0;SnD^M^v3Gk#K=rkmz}%8-NXTp} zitV~r0i7wB*Ya=*Jjp+0 z==~8mbDQfQ&WGjspTXe=;=6<&c8?Bri16dFLu2*%c%+j@k};|XaqK8|rh+Hv6c3L_ zKynHyQZ_-qoYFrPA)f*3t@4@T;7`!BPbv0hjW-joS@=g!nGzLV=Q&W+xx%B>Di$QG zP%#|5yug!2Uy?!ckA61toStogc8rc~K@KBq3~8CIILa3sxHT{(`E)Bn8>Zkma5q%> zun!r)9}?|vXpeeieZf$ww)OZ7I{q{p9)tD_TX2SsUSXdZjB^-ShyO-rT;Rm!DDI_A z!5EdJ8dBWFibV@rR_H63%~@R=zG+!l&lv72jm`sOu&=biU*wE;x`v5mm{{~LonqR9 zYdhnheW*6X!H>||K%O$X>DuQwTj}@+hk3-XPZ7+0!NTXtF${SW7E;diiR=V$1x`87 zu*TUZ&FH0@V8lm^VYoq`W2Ow}5gG{$qkMzLZyKkzptxi!&aDUREbAwh(ObdMx3wGl z#2EEH*x`URHwGHl)oHZ#2UmJZO`oR!u1kbhehhAh6&D$Irop)JAib5+|3uYsylZnDHCE4N)Z*GU-8}|w4EnC>(G!c8(TKtT_v1 zXlw9>F=NfkR*HX4NGr;Qk$Om3cC4j+0?F{w<8NO$JhaN$5FK+2NJxRthL>2D6>M3Y zIKv(-tGXdAQqbQ$YlLtj6s&pO@|u{_SQCPBa>ld`26c0azkTAoSsR{nR#TRQVJjTJ z=g^dSQk?N`tHN1La>y!%ooT}x{nKP-4R0tJIr@UJG6wKZxJGe0;MC;k^wMIS z73B=w%i)d6cq3Y}9$>+;Qh@}Sdf~j@c?L0eH8{6Pk9=P1N6%5@OSDb2TxF3B6x4Ny18DuQ|* zezh!T;YQDKrg6IYhM4nP!<{uLN5yWu=d|GVQKLQLJRnr4WLa?}OpJDgCmr6|uv`es zH7)gCky5LS<~T1QcUuErTUvf5acIZG{v1e$b6)f8@HnPzX#GUGS6RyH4X*+XV`m=A zV8DGG++dDn?_oDA@L9Zgum@(U&9GxK#hKeZ73(pl1AA)1OV;*OZZlu7o}umV1Vav1 zZ})7DO3q>QA&gHahY{&W+D|mc%8v$$=H;LQ#SY7uoyoK4N_tjA&<`Iv&qs^gla6Dp zX{nw&8*_|gU-OdW{Q@IZSEL~y%~?;8cWG0@nRZCI(nZ0fT>F@n#Yf5@wKJAMK+b)z zsfIJL`_Fn@3|qb|BFEqj)C8L}fo#rc)*$t)AOZ1VAA^~O80bgO3y=q4)u-(tZy1GT zxuW;MP=mK?DN#{mXTvO30FqU zhqq5Q0zR_s@QQ6`Ho?Uf5+H8VzaxU1ir;X#35*T%I^^>0jt}7582}u~w2buUuCR%korQw617(-rREfQ)&pjDL%C*oLVs!hXHafO4bcU3N=_1jk3&Avu5+faX63PdhGxj27gy zjLL@6MvG1w*jE%EHoV$*jyyOUZUpgnk0A(~M%`h2#fc-2YYvYTzRW=zwhgCe!v|_e zrfWm$TaUxtwcHNuFYGh(Q3Gc)QtY;&+}pgcq?n~7;9ND6g#tHPDAFk9IvmboV6z#} zY+i|;5m%uSY#>>XM!ZCSFKAi571)kQ<6ENhbOIxqTe-qdQzVe0(UMRs9R1}_V3Hd4jFxf@@HWJ>0A>lEK_1g~vPyhPJf~fP zHSM5liS;93fbm}q-DsR)D<__K*e?*yffmsO>;)Qh`jigkFKKIZiMB&j-(jQ;$;Dby z%w%{)yOg^kJdy2J$6-vLlP7iuyWEWER^~EX*`bfpB`jc0yw+6WmGe2(UkrpRV7&Yl z%;FS?Ny#O_K}@?Pv4n@EkGuw7L6PDDpO6<2B=GP!1(OABo2tayZ2D`#i$B2~ zE=#n}W4cFnqhp)Xau_AtKG~^%F^XY#0w>oa&Cs3O83XHRJLLh}O^uxmyNYhWyCEhA zL%Wkv5*8t@0J;+Yjnj~<3V(;QzJ`_(De;S!MP?oC+(sbu@XalKN$lwbB;?NQ1NAJx z5{l9?+v$S5HViCdgzg?Oz!-MJtxdX3 zxXS=tHQ-nVq?q9e6tuI}CBymIckL{8!aO1Y^; zABwNRwvqMot3n4!Ic=zE?iESHcgQNniE=YfGwBtjg^LF5y8ebS zSHpYdXqS;H))^>gnG7c367@U+V$!Z6MUW^>Q{IZwQ;X>%5RXPzq-BcqTv<1vIaO<7 zF}zS2@wV@V1SX?p&oSOcKPhC?NOfvn;S-gCrfI>NbmDYQy@LIUWN~pCUT9k8cg<^s z{Oy%8IkB$QhF01G9%F%CAa6>eTUUOWgGIX6p(-Df z^q@%9n>K{6;S3GV8j@WL<#crRnRxPZg>EbQ3E&mw6iBUDp^0q{D{KO5+e~MKT~}HN zyCQ_wSB^4$SA@v=vcxEzaigBcNJ@zMzG8JD)?-f7`;eoL6{qT%WQ|s=uYOAM;##TB zRH#%`XoG!B>*A8L?BNb|x}O#?vDV}YNvbzlVc*oq{S%fYm?gQ+0CTVn2KG%g=s#fh z8Q3NRd%(aRGO$Ng=GwKjiWv_j{4L%>Qmcg=tOOop%gXFTX0^2^9~HftT7a` z#!$=}LosU%#U!f_qxNmU(`sv$NK$>x63M8s8Suo?n5W*^x%zxO3oA%Ms$Ex6!q;L* zQA|Y$PS!LfEu9smNEPYu{0e`fvN6qB+7KoVNYUb&;b=MD3h$uMxH3O6dg{daJXaZ~ z;XV%k&T6_(V9sRZ+Du4^j1>dj6QqzfrYZ*hfzC1ODeX|Xo`FBtBNvYTQZkPf#iIvH zJNUO^T;TX=Go|D!R}A#uRJeZ@ab^f(lYGUvL@UB+$W_?Wz;Sn^gGv=iD@vk#jdqp; zUy!o!EA+L_Mfs&_PaUw{ZW{f~YJlwv9JFQZf zF9u&2@&Af6*Q$?Qx>)$U6WrCddeGGQPX9yl+P#d2w@L|@{CuMKIvTEitu0TUFmP* zxRU?Ae}yn#HUVN=_u<9EZeG$yFiAQuPIu1^3o9M`C!D?d8AFYabtZpC)PCEk{&$ktZ2+JA)js~YOBF$af@)9>Lc5IzR@M}lX z-JyPHjEjg~Rg>PmN4Jdu(D*%gOVq`|pl!uPZ&Z-1lSQG=6@21EldfvqV~YZ`?!M6g z8mpPtX!(sU)%_Ajp}g|m+<~$0laro6Mz#+x6D%EuwY2 zPPZ+2>%#3V#CKn&`!mwpX~S=Lhwd|%YaedL-YSbRWXz@(Gjx+s!i7mZgBW(;1dhQR zN05;EuCKcrsD7tgc){xU-C*Ztj@vb-S;h@~shH zH}6Bs@(h>zAvH}?7^366-zH?&c@LaFKkv5@-#zdDIXdrIy)#&ywhzd9cXQb@`+6_U zdNJ;QRZ>N?!Q)yWX*PUPMmYQQriWL`_Y50C@w(_Y4-?f0_@>#@yhyG8 zvDD1bTP^FUw`$uawtooPGV<$U5Ln)%EVP6k3f-{7-Cnaacq3kHm-=n=TdS4dY6Yv+ zqC}(oAh7)p|KHxyH(4|z*;8fTX;IAc;b1@>S)cq`lAO~%O=pATkqzi0-|36z5G_Y( znNi->mJ&pH%%-5VTb|0N+K7V_v|MDJwH({@H-hkBw}5YP_e?g=Ahd^`H`G2)d7_b|9=J(HJGz7^h^cuEpQPb0oEFC#p5DrH zc%hDyM-oR&b-73&N&&-jLLYdMYa-2n+lM4wBpL&+j}n3$Xf#a{AcH?%oaZN6RE!e} z3auGJvqH!u=Ouz^PA z^EjePFhVJxL-&<{ARUfGae1NWRYt32Wm=JHd68!FF)*0*Dly@&s0(qadRm-(ZJAm(=06tm{k*`(r~yTJmQ)t6J>F!eLPD7-nn2}>C1}YTKT2) ztFxsJdlyU-Svpe+l8v+}Ck(BSY9fOEpkn@8gdR3&D1V$BNy3#vkNet%(2{gpQ!PSw zEhQ<|7-*anPjik>FRm}{E>15`dzgENwAM7r&YIE)K~YKt$QS7ugoN{$<$ zw*k4RfFD6NQq6+Jl!JfZG{NI2auhq{mA8Qhg-?h8JB?!UfZax1da<(t(Y82-79MFF~Z07mSm) z7dInR21Lst7)*&S|2PA|W4^Sb5Wq8VM)H*|*OiD(!6)*FaR?P4_H<>3CPisfh|2wq zwG;=t;1QnidU}8H?*01HvjvAYMSF=}#i`w^?N4}IZPp;ZvA`hljKE*5jdcT=kuUO9 zx%nW?2#t9!1$AzDI-g>mf6If6GYEUz9;Ec)Y0KZsuuO^)9+*29Cug5VqqacHk=Fl? zs<1wBtjJT}2BXo?>KlX8Ps8iM>DlmdaB~YkeY}8wM#GPTGx$ILd^&u;v8Ixg0+iy~q^~p~3CVj)$l&(<=u|F4hpuNhU)kSnm09fWzhocQ!GmYM%Nj(& za`FYQ&~1`2VYvyb`8~UMj?=2Jc(IGysy(VkUNBxSj1v570w30L zeEi`b-NMyth_&j;UQNvRf}K-mUt*5!dpjLxUt+GMdpjNZHN;vqgI`1Jn~J$}ro4vO zPCrv`;yy0hRtX$KADmuRujZb7wfCpRtc8Ma(2z^76_MM^PA~TfeEO83oU2vBX8C`d zgi!&j6YjyZr&gfrAr;K?h-d2D3q6~g9&@?PnQoAsf%@eUY~8mF$K<-LTV_CsZUi>9 zDMSiA3_{ywx=x(XZDqr{k04B8*sdc?W^#wR2Bx*B%}iY|J+QpMW4>t^)=n8}wc=t~ zj?-TFJZqv>|7r#HrfFu^>FLi>Ngi20fi+}*l0FU|%QzV@UXUp6xCE2 zw?e|XaCB}$*n|&pp9By%1mo0WPT*Qp7^bau^|(?k>S z0#MLIw3hVW3LKm_MvOUOGW9y;WUj%OSt%Jm0f{3-3!df?m6`aA=Vgp(+(aAWg(tHb z_(;W?OqG&OBOQ0arj^?=awt9N69^O|EkB*O(d1an9PkU5G zQt2Yf7l8Q-m7`u~VaXckwv<^LQKA85-h9>lWG%T`0|PZ{(u!QUM(u4!jihyrnbjVs za>Xm^h;#@o037Q^PF$aUf6brK|K+*?3z?+o`5gu%d_e(jOZzy(7 zP%?p35E{7uwT$R}Od~eC=Sh~v_bG#4)(s}34p)3m3C21F1jjs?6w_CM3nzaJx^VU8 z{Nm$PcYFb2-S>kpmQSbq~5fe)in;Zj08Mt3^U3%~%**S`iZ@Lc5R z1`L?ap9%~}0rm$5Oy|z9hK4t^gT8NAosof{XIgiLJJh|Q{wgWjOd*{U=%I31r*B5R&$p*Hy_?hXs-XsI zgx4M{q*aB&0^)SFi9Y587Sq}cckauiTU`=B3N@sbam>HT3IMg?9ussuYzusqMK2Y- zY6G=Yo}|6Kd?C?Df$4FOYcWmX0qy~o*>0L)-i}EH&3K-Z372`x8kiv}XNM33?s=yb z1KO_fSKFl@BU(hWTI;#meU2$m80x4k^>HeQksr;Z>fra%FUQ zgo$_t?%b%T$T&!WcWM16ZljMLkyn`3naaB!y*WF7kA24p9$Y6gvRLkMb=mvz%@w)_ znS*)N_H>o>$Fw(mV+Xi@o=%?4q`h9dewy%jd`uGIq7AqzE!$@nZ8$k z8lm^gH&_p6v38^!8(2_(l>6Paqc1#5kCju_QE8k+vl(X*$O%pYyeL(ZWu?oBtTO-) z!SuA2&p|&}4Ur}ynv_}9L^?x0PGqH!0@;=&D!8_y>+@uZDk$^^kv3WWK)IwsHbKQE zBuI9Ef>n)z91}emp*`@PWo+CU7i(Z-k!CqoL4n8QI0R}LyrSw;TT1DAi;lJ@_+c94 zYwTz-o_@E?+!q@FK%K2WK}F+(aiX4paS;lts}5v61Xvtahu<)<4}s>7OYD;`rOaq= zCg=|d|3kw6`E1Z3;eSZ@9}@mwN8*t1KP3DQ3I9XFe>;ueE8%YvixCP=M19@ys3CO2 zcYQkug~1s&2=_ua^mb3Bmq+kD&$kJ4F}-iOq3`P+HFet#t-#iG-4&ElgWEeDuLGpu zSUPb8GYFo&MJc14*|z6%Vp_INYNp+?D51LN3*9oA=TauX9D;kc#Y4;Asio&Z3pum@5}?JiG3L() zEjsny$^VPJebC@n047R#uLewlq3QN@V-LK!WscPIQY=lhJ_NzGYEeAmsiMUQ+Lu zou`=T%rGrmCo~jna#L3c;F(W#ntz_9h1vvs8ov@qxse;n7g#bOF_H#N4U=7>KEfqU zaEr6d+~x=iV1`-cH=9i0j&raPihzfx;C|lgkC&G+KZ?IZMLteWN7sD=5dlP7xR8e( z$?p}!1gax*ZvJ_7Qe)w=9vh+N*lXtFBJZnw}+%1nlAYS5nAT^+&ZJ!85m5zQw^vjQ4UC(^=Ei z;P-LzlcNXsr|WI%C?rQQSND|1ImzTbs9%BvxJ_QUfJ~|@;Gp&# zDpTJn8W)_{xF6l!UR=LZ*hN)Wp*F3L6aL#=nX&1~^|tyXu0Rl_E^vW*;zz4VBN;$= zWQ|!RjLL$yBvz9Sv(yq(0E;irFap9;ggQYF437+>?(* zM@g#TDQ@smMW{(tEP#}nJPVs)kp(b`-74UO{g-SarJiT91S6_;@gpP!(qr$nXcJY3 zuE|;>?L$&kZ^$WAVF%EpZdKt|Vgvqq-q{bCCA50 z7{S}hdF__fP-!L?ljx761QTzL@J_Rghu}3b;7J>EH%)r7_TuR3 z;_m9W61Vb#3|?LmS6au4FxD;6pj^#lsqL()r>M{Mf>jlb)4a_1i8NpX1g%;~aOb3o z)T#&sOPJOQ#QHL(;IN<~g@i?4Q2XHfWmc7+tw%m>R)VBheg=Z79n!;nD?Sw(#Q25{1ly7*H`ph*|4|TjuVUO@|RYB5aogCeta_wFEkM-GB?n zWv1g{o-QzL)BFlljWPn-5su?oen3J&0&cs8Lqf(GC@%1Ah^@@sSw{0RUi8;E{p#8I za=?pT#*1Ea@>UZsa_oHyY%0LW8yaTccE9%It=4PwfEOL`qCf9akPTn_?(ibZBVd=n z;RYcbUJiy}0W*D5H^4Oh|FL(qy=~)K`mYEB3~mA>UQ+KWupcs+&fZ`;oo=UdXFnL| zrTCKg)|S1J-8A#-_qtv>E*h0lo`e|mF*hvx~m*oCAaYZwX~)a$&Kz7j|?rx;}u z)L^ndw*LW51`AQJp+QB0%A*qNgqAtHB%o>I@4BIQ-wj3c9xWb!7rcA*TVOveVf@h86@69Zyk1g()W96-g@J=U2^d%a zgV2R}>9~Dc=V8DQW~eAagIMigMj0cM3dx!lQ%^wVvlh%;uhtYl&FT`D!4@LG)E@E@ zbo~u?bUw1V-=__uNiqUj1#^cJbEq zz-d)NS)IHG@>^NVj3ck_QB^?)!Ma*u!=Q>y#BihE$5p@M5!VE()^(29(-zbD&5R6Y z42>L-EojH{Un{~{`rY2HD!m%UU?I=7)#9>N#(I!%wJ@~mKnGgPjbTU|N7_#3*ZZliyOUQ)tEA(&LgW+SrMaF@x8z7Bn-ItoiLPG#`o}W`Hx30c5-xfEWXaF@P8Yh_SnjF9l*qo9n2^O_^q~h)Y$P$R^4aMNyV1YCyXz z6ncLX@2?@rrBX^bp`yfuGKPAba8^3RFszQHlc5al-bMKS8jMgb6mgcPd9G5WLYEXK zm0GFD<)MtyQs&ZR2QYORWpXG+WYVZK$%;e@U8H#`G3ljLBGO7HMYI>{xnE!-dlnGG zoeSO9hZr6vuyF@Xz=L?SlIRIx{`f_djPmSI9!yoTp`NYhn^84$WclWFy4hSC6tu+HYDc-VCl7;zl^CFFh&E}4g2HMxUm+Wj z3o5(3p4T6OWv!f>Xsn;ay)n_FwTaqjD?>N|o~q|W5?E!R6&U7(ZemWLsj88jsVkjL zKS4zi%r3y_C(`rmC$K(1lCi^)$Lw$huEd24_s5&*F z8-!qU3{EiWX}wg+ns*A5c&^k(1dA}k;s!?JqbI^*4S>piTKaK5!m+oXC{TX_6_Iz4 zt}>JQ$Uh;o*j4X{{Bf7!(@7Y2y?&*jm{vUAtTh~9+^S~6$p~wl zrL?S@K1cT;IT4B@R~*P*Rq(--qRGGi_=bzXVH|Z{$Sz3Q9#?@?HF1&g)M@6OhQSR} zyOlOr8#ZTYl`Z=c1M{A0rsA4Z zoo}I_10AqOotgQRyNLX;S@uAo-gG@uHOXYlbX)cf<3qdh)0!dn; zx+Tw#)uJ~S1D=Yb;P(ZoR!bqc>)KA^u)l8rW{z>zNvA4uwnnB}XY^POqi8U1F==K- zsS7lN!A~wJ+Rhc|shZ3>J#2zUdQLj7*h?wpiW~!e**&}Au6Ba^-Wg@!pqGj}0AVvf zsRLu11(IAfUZ0yFr*?&LgeP(S5~n(Jivpo*$SKxpti6&;nr{l4WLSQm8w z0THOQ zf52yQ1pjD3mLo9=$)b;bU%((8+Jw(-FzR-Z_*AV)N@fL1P7e|5T{8+t>wCb0d+&j3 zM)Afy$ph|zSM7~^;s@LlkFt$>?r%?o?Fp$H-hg9HRk1Wn$7;W@(&A7nve5d1i#th0diaN*TE_+&hvFPy>=u=rVL! zl8e-c(&eJC@OL4yLYO#%pQ5z!-c{qv)80KGQA!I99W4r(X_Hv1g^*=fWKoisuvA$X zB_fex?;3G`4K4|t(^8huEm5X)UWhy@M3Kte=+H_RhZ>$#PfW$4W#U=jq<1b@UmquZ z-lSlGc!$?u-!OhT5B~Y`?c4XYnl$!31_O_d|G5XBy_1rz2cLChd7JEZ2(8!(s>fJA zT-3F~+YW^izN{#lgg&Qyw0_RW_0^nOyJ9W)68BSH3B@bW-!66&sg+S29R1F4f^ZaeixccGZ z*Y_WriYBi+I%ZzRouW;fZrNt@bQx2mj$|epNx--v4RWZV8WeJxO*oR@5yy3zfCw@( zM#ZT^8=luq8*se^19#g#x5+aJMuDBTl!Ev;1xih|?%sD1Ut~L1`SimYQd_f3a%b$C zrKnz3!HBoKd^>vMga?B7+wc{D;KA=H%Q5(VGg}mlWzC=ERXtx_Ucrh|+o|FXL1V}i z%D^IMk|y(-3y&!jA3$BlgnRG?c+$_z^h+C0Tw>I_hwQRlSs3={DDd`k-PI**VqwiX zRmRZ46+{_NI5pB6jZQ=Ocb6==L5TPHQox9d)u(`=C{;fPEcgm3V6XswGoVWRt$`|k ze;TNgjEcV?sB&kJYyedTP-OsB4l7~+RR&OH096K1Wp^203RDqVhoX$aFpY{r7D~lo zWD)NuOrerYM`c`QsXjpICshL8F~GCR*hHDiw9+z6LKPNTYAc-(IrDf_$%n6e!aiz-@f>GsO z7rmc-E_xP_$DNb*>q8z7V}OeeWPp=#_7vD5PDW{TXlmH@LN~w;1MKkiV25u#H7u1x z_ExweOI;q7nKd$wB>X62W!^C+POJ1|&PJ}m(+r@Vx9+;Lp_ zxGi4ort`Vk6!f8Zw3i%d0#kEN9o5N$vlBA;oeqSrmas7Y$zZ{4ji9z=0TQWA?d|q? z9rx+P+2v$rSz*WD?-QAr{;s4C*G+6gqTX{RKAj4g!Zrm;e6wr2AfX##LBp(yuB~2; z3C&+s6Znw(c7w{RX=CL5thrx*{Uzu`VVX@CCdCpU(g1gK< z*SnVD*8Pip<_k(r^;K;skp2m7Si^~ZIE$j~;OqosQ2Gj(+j6wA{t+ceO$lJq%TF-U zXc4t(2Wucf36wC%^Wlp^-jOaMoMdrkL^qD;K9StTQ2;&nTcV{n!=;wOhmePt`Ym)#!~CTG9^Is_Cpi zyDTa}WAI z``G@FF!9LP{*W*+#P)~S{t(+AV*5jEe~9h>d&KsoP13B$a+M^mR5F)wsKQ7@xzLde zi&VsgQ}%#VfKaN$6ls!|LZ_)wO50ReDJ)dxTokG}&W$Y&AZ5#9FwmvO#hFU7G}BT@ zQRcahvqWUZ>7I$ud zQ?gVxDdW%;Hp@}Q8Y)R$DGD7&doh;#(SzraFmdNh{`%;_VF?ot!yXPxc}PcL{-l(L zBp=D}bEG_Mt~LYqFklZ~4|}-fi{BjfP>3=rOd(@K_;dn~uPBXl5yK9vENq;IIzphq zS{KS#rB1`MS!RVuVT5CMZ_2}e|9){EoSpy7iX00J8xn^aPBAY!!<0;0TtbflBj^Nu zi$=6;Tn$&=QoH$M!Nhdt?QP6&Xh0g^zk~4c$p#z2^7Si)b|P1+zP~!!fU!eX7sLME0&t`(gq9PGhBY zncj$bPuLo-69SsLlj5FskZ`V&*|n&UPMV`-iR00^o*?aD=RVe_uH5#CqshpQJOP*I zH}rnD_RHf@@b~#OhE`AdZP+>pP9gHfN3^}GsnW~2V9iKUhUevLd#P$O#ULCwS;Z<# zuB{*K{2O%W2L|6JZUgF}#=$c{@oPgvsyOZVov<9z5_=orEpJVa+l$f*cJ&0uuPLv` ztbvg=Inu4Rk{Q%_Cpa1{C0n(c*&5A!bMgAWd~=UIff!kZzKLvk6qN^OY*r=b9Z;Wp zqRfp&0lV=8rYcfduDKHZ$Bmkp+ns|`lG+hWDz!ky$Qt#jHs{;8nr}KJ-g*)&=Cn@I zG{Sl4ft7vSku8A}3l_lwydsPQdiNSu1FeaH0H8o$zphk_;fp0Fn$K$-#vUAjy{i zNwP@fMVuyCTFTI-ahaDkiAwE+lA(x_xD3lUEcdb*J)j0%h?$X%c5QH`=_WJw%5JvKBAdJ1v^z|W(hk+1x@bEqegox!6K#1&xNJgN-u5<0; zxDWy!9$FSsI;(^bxAH%>L5S{`vzKQ-vUUW8u{vE0ic#CyVtEs2QYqnsyjAe>A8+2X zZpqQ{V*rWsD+T{Uar$OHy@4lDLea9bm%p9bEy=tLhH) zVXe8)bVY33j$#becCS)QnAvhVL2s1IKrwFQG~!4k4iwst5CjH47Ry%iqdjcC2@b$J zP;dk`*4WPAA8U@QxeG3;rM<+57z_(m0N<|cHVxCe+wDJlbHS!z%#R${*vZcV{~HHEX&X zsWO5AJ`(X74$6u{*&U>Tlu17D-m~p<#j0VV91yF1Y*2b{boqJE=)C%mvlp-LiXum& z?2AT`cSmuzpXra<2T56|vPhByc2i-PC1nYFAD6ngNW!9&Dvq5k;br9MHAE@AF~O!S zPi>glB!(BoB2`i*utN+BmD&V0U?SP8Li&J&e4QzkI^4L$MVUD(WRzJ8``$Eh+JsR7 zje>pN0sB#7OQB6s#HPSNX^3atU|VW!1}}`U6Glg=i}nUI9@2O6woG%K2qmN`L?H|4+R&v2zKO!JaN)fN;QZl*7dujGKTgzL z+0}d~iBeu4eHN}KaM&v*IC=$B(87`u;5VH2d%Qj{H|A7%zU2b84rp+DAP3*ZR~4RM zLgr7TlI6Wa?>G;`f^ zHgc0u$?()S6Hk{dNx6-91GWsyhDOuk1> z_VXQ{d)M0ow!5&(@aBnp*&l@SoxdW#I$xhRyyzY1Y7Z7!WjL?fO-S1@u%DQ$xYzmP z>WEMGaEBg`Fi*dl@4A#i9ArwHf6o=cKJjKjXNN9cU%b0Gd&MW{)~!M4v*}xg+`{Cx zeYw&Ll#cWx-hJjUfolp2u)>eN*S_>w@co+G!&Y7pl42q~ zL;jDwYwc|t$+CZiXrM7RV5y65GK>9?cGA;9$BEZYZ}$fSnqpPa=0p-Tq-4ka>-Rp2 z6!r2;iIema0|e8yRL@&Q`ks5vIqa%tz%izxP&^2vAJGhhV`IhGljR`V+BIhEqx^DZ zNdKcILF29uWSh?F-fFAGfViwRv-?-8;!xUGFGwidT8HA5HnX*Y-Lg}P@kaZbKZ^dk z6hNf|PmOKgat?4im)ZySZYXZuN)`>bM3GhUiuiaZMTd(H!x&v-25Yo{DJ`Sm{`AJ3 zMRU7lgi+FB4=Lea-~98}ho>i=wUln(lDUmv+*dN^Jx{XZtC!5#zrXM$=mzti_~wXD zu=*#6)H&O-K6S)?tAE&WSJlFMi&f)I5IJ!x`iMqHu z@3e=ZA+G;5>*9C)x}pR+$5PU=>4 z89HMOYUk|FLz||&n9@L++$FytqcjO&$=GY9&t7Bi+Q zGvj@JJ1Z0=;44!v#&fC&xt%Zq6)E6QA77uv98 z8*#fu5#wsKLZyoL8 z`~n?r>fpj;E1Q^as;br&{Ae46-X<ze|d0t$lJ@x#pQqs z%QS@u#{!bmIW@gHgm!3kr@XAu9aw(-XeFoG-~r9hXcrBKMiXrZom_PTl{FE_DdJ`8 zWaG)=%B!QYxzx6X&Y?AccV<1Z{Tv*U{b8|mo}9^Q-ez6l9R()COQTm|hmoFe4&rqgehf4Jtqw6+6T)BG zNOeaFyUBB`v(0W<+yIRd;ll^W%0K(%*nxL{!MYlSoI(_=-iEXjU64u1ipq;$9lv?y z9PGqO50@s8^%ZpA;E)N7V{XMnricn|PVe7~$!u+5$+D6QNXaMkKZ`<*#;VYhk(pNI zcvNcmkJSyc3KcX?ETyzk>2Q@zFRlFeV=;xJ=K&Q?UcY+t`^m#$1-R?JA6Q|dh_Z(j zzC%3Vt~6GU2lRMAj|c46M2`pbctDQ_^mxGbHoh1WUnrC5IM9BWdU@!@UK)gKvb(J0H!hvzXpg zat3p_d`#lMH3x)NI&9{;_{-9sq3HoPjai`?Rv_~jGD*o)`0#%grfPZab{Iy}ps*d5 zBxPFj`QVSUm#2f%m#^#x9au(q+QIuX^AT>U!jci-u_LD_IgEAslxu4U0CLV}+uO+s9k;ZbtFj^MlTd1f={ijd)Oe2JKpQ+pa;grI z2dr>cb^y+<{+Gqk*M*uFlV;Uxt~JNZCv-KkKgG0jgMZisrlzQ3ehme|50Dol0~@de zyI2NE3>&{PzCUniTS)}C|Flu>-@Kw6d58Yctl0of)vA)904tGtQ&iY1uG%s%iGgub zJ6Va`89k7ue)sMjH9we1<^in!xZ#vz5q4*fXagj%`aANj&Gu0AaE12LUJ*u5`+@}d z+Ke%W&Dmfwn7fu0CXKC%G(=u&K-V-{qOR~w0Rc(b*P(NcW$&CGwV{jwkLZx8$h5EJ zPgDkGfo6;Uz@qu$8ppa6dN_D}{OVWy?!{DIR))oj%gQ-Kfm?hWApiN(R}}kyM3PjZ;ibcaBqCOx2!hN{10h6|E2Uhsk4jS-`a*`ecBNF(D5aIrK@cZKdVU~e zkci0jeSeQtN{vD_3{M&_Q&Oieg*-OKPr@Wf!Z4G$3DP*-L#0Uyl^7LM@{AA}U-LL8EeG^#4op;RF$13)-CH&G#PP}+e#z{y|Sh!E|H1va^ zmwXOS!(Pd$he^INO!D0;Il(r;G+Z~00@$!T@ZK|O0+VG~5{evU zh68wf#nMwzvL*|^1tw{#V`n8MI4jJ?HhBz2OHLb3017)b*?lyG=91khV@gOcfY@VOKDLOBAwS4)0gM( zhAsjD2(p-*6piT56odk-F3#!CC#OwQL+52XtdMp=H$&$o0xz2X7c&$}~f=LhT za(2Xsk1(&!UsB_O%nad5``BiIm!@#US%J}8ahPQ{N87;`s+8UewghqXf_LuJM&zsI zqHXs)TosOPqH4fVb@KAK8(FkTFgz5wqDd~f9`-#1g|&3OCBRzY+is{8Xmj^xDALi( zxBq;9Ho7!(fglv`yJZ|OfWw1pzDb%*l(UEBCu{(V;yDB;m(F-W6FG`9-X&Q$p1*TP z=O50{{f{6E%c9^C^+tsne$b8NridP$>gXu(azO|*2ftVz8X5qiA}fRC$#C*}W5#^w zNX8kV1laLbs0bRqLWC36K`$!uAl-h_+cSy!VYqKZ{F%%aRDq8aqiN~1W|NJ*AI#E$ zyAr8EaN|~n_(B#h(f`FN;pER(5#ge+HT%}962HB2+Z0w=jhIEw`>Ew>(2=o_0oqvF zPg&UNV)`CMj3BN?=V$*rvh1mm)q+B>1rHL;s;fUm{lhx~;)#n{6PC6sKA5;zyN)Iq zTJrGtaPsg7^r4m-1J^ETM_$6MRnOPYZaEzg)8gRd&4-giJ6#(E6+FBMPFjVC@UCk? zpqfuIt#)fBYQ?+YtxAncbZtDM4eVf__7jBZ9NC+iDIZ8!TA_mt=}y6JVTl+3Bc=Bo zV!t(nT)p|6$pU7IWHYq6Bn_{YF17&_wJ_1?lVGAoY8!6bFAo#J75V%yQBMcyVWO=t zQ7;eG!$dty)WbwQOw_|fJxuhsfQkG#Njxb%BfKy&E(AajcrwW&FOPK=gjt$~D%i&e zL%Ok2iH=;)D6IHR1DR&Al1UbNiLZ4Y<~dv%8)>-5^pL~TNU6;C66MQ0(?KSqB=K|X zC~*S(C=8xtJL!7EAo>i3 zAFGei9wzExqGvb!SPQ}L4<-s@X+$0;LPTjAMM|XF^W#`$NUd?b#AuOZxi2+5Xv5sN zagwVzRXUMIrukYBZNfxnr@t+;pqEolx-B!}%n)d#X}TDabS4F>Z7EaDInQd=7W+=b z=nbLpXRWCyUZ@h zoq&H<)a(erYEE+LA-d`BLO2qGI)vh^C0%7!R&&aWYB)ok?61>R`hpR_CbZdIDz0z( z+z$^zK8hp|h@A{3#1AQ^sK_)MTa_`(QP8DYEOmV9#U);Y4Kjd49*PnS{grTIE&y_# zP~S*1$0UQV4rUdCZLmli-?^9;ByA+eH}bY#1`;x+%8FC&ACccOzJiOX$yPM@{5hU9I(h#CX!(Vb+G2 zLpTo#Xlch{2DjGP(pqs)Yw%R!6G$h3PcvZyHVE-R^x#r766Hu;1FG{}TuBpY|yjLVx{9G7>iAjEd63i*(< zLRJWPBC1rXa=c+RQmi5$PgJvdl!527VjBBm7wfj4_hJ{%WCz+~7mvU$?#$oy*hPTvV%G|`&@g8zqTIvLv5wWXf6vk=j3YA7l_Mg5O}N@urvW@Igp{#~5?>qFlR7dgU7!ADdf$8^PmJraz zS)he%m@%!!ZWe4%A)S0d5P+GL>gqA+e7NIGL25y=+w7KBt+o~XgIOMquJYc4_yGn%jLoz`Zx0C_jG$9Z__U zRWgxwj!By8n1rp)XGT%>_!pE9yXq9gAGU;^)|I$j^(zU@G=A`U>CXWBHmwV$9xUON z%&--DiQz$3A(TFza{d}^?W-{*k$-=6%1z)l4%;Z?5G3D@E62!+1jqR3)Me{WaLf8_ znQ@i_E7>+>WBdw}^9ET0w97xY=TbJO2i`m?Hmc?b<0LOW9VV==gL8`%nF$dU z=mbNYTvC#qJ5Xa;Oj?U;LPa`3dNJiFC4vIT4oQm zqfI?SC9B$6ZWGef+%P%8NX%AZVncf=5U7U2VU3Rp-9Qu;UBNfvVbF0P!UqC8d=bj- zk%wy%bIC-CvIF*nKu8l6;UqFB#`9ukky1m5f+JN00f9KegcvOrDrH=(@$0e3%*7O+ zFh{uSjJg!OSA+uE5t&a{u&OkiO|Y>l>W{cxa5LdbTa3tx$yvQQYK7N*BRa4zS^&Z; zjJ9*bfwKepI(lhutJzqhrMl(UOc#@k34YMBJ!;U<%FGe0wc>z;)|PWT!JlT#eCa?i zS!o%`qG<9s|?hEoX4VlinUP6bDxoZ#2-CU~)Imsj|{ zmg!S}72U7lcHI9p_|#uj%hTi7K`I|hh4K^IO`H?BgYjh=qwFQYYR(@fYmO)kx%zb5W~MBGr`VVS$P-PO?(W%N*nns?7Dzzq&A`juQm?g2B$S}U1qmHlbO##HvL-CwVKx zo}5?j$d?^cylCl7B2tyrS3~`xExJ#S0cg7lecL3Ytm!*~qD!f<=7XqTMT5kn3S(L@ zNQZA}@S_Soj4+3_RbLtWymbEc`s{2}$)YwR%mE%8{%Z#;d#CPP2Q_OI@m3}55K%Gc zYL6*?_)t3wJ9cQ4U}Z_%5&Ai?&$l;3F zPH``Bm(-O+6pVq?>KaQEn6!fM<*KNk!s+c4U3dXtS0>o7mXd~5xdpAUElg(M>qK74twv>|O#n^UA z(V1)tJKl)zZCQ;Y-Ut$D!{!aoXxZE>jCQm-ce@4csto>ig*$5? zwWfL%1Q(B(2x$k6K|`>2OO0Gnz59HGFA`j}gfBFl>N38ZuR!>M3-G(aQiAUdOZoL_ zSV}ld{~uy0cjm@=ETzX%dMstXCVDKT$5MJMrN>gXxACR06rq$SGT-weKTX|K%E0pt z!W^ki<^QpFZB1_5$ol>K3RU(YcGZXiz$^0P+1b>_wa&)tOtR;}r&0g`XlP5MR+Q%A zU%%Y|NKrRR8jTbCWU6eBJR`;R z7|&_0sUakfb7ZhT*Qb1gn?CRL@@ll53Lv`;5e57gX6(AhTK;_UR4 z{9>djZpmnX>{M+VhziV{X3VYHl*0OGUfey2&27$8v+LbrRt;+@@A9NN| zFsTY-1D(4G9cDgc;;D1iz*_XV5BhV~oMh{V*X>KU^?&gu{pawA6HWTh;StX!{b!T@ zvq}Hir2lNve>Um=|1jxO9VaPI?F~vPXhtI@SV+Q*{ zk|-f^oe)ilhQ^EunTVoHX?_OtS{gwIO`=Scia1TuoDxc8mgP|zlT?{JmLbcdGx+J! zI82BzFbbj~P4bLMK}byUIOiPmMyFiIkvL-vCJ7V6b3u%tQs`Jl%y6A%sUZv+NsJ^s zkHWpKmBUVhFC#pn_f7ueod)NHM;zyJI4{5<30U^10EajWD0_+khxOg&+2!!;a`@d{ z4jUr))wvuZB^V)*P$tow(l88jkU*|tK^V+)BA85BEK`*+mBoe=9x@%LnapAe$HPWu zoo$!HzkYdrHMqR`hs(AxLu;WWO2hZdCzNr#OIw6Nr}!Z3efh=-(NJ#HuJMMy&0hkx zbY|W>-WV6%4efdWy&GzqwZ$efx1Fs$Qytpw;1@nYIey=cs=agVb86UT{S{|XHmp&b zld#5yvT2C7^>lc!c85xI)6Li++38&6%dj0;al7S6UFT+dRrRpWEsx8(O@G_szGVP2@9Ti3p=WxV!=Y%gj;`cy60GBT0j?fAJKi@BPh?G1#ibQzRP(?0g|TbR&~ z&gWK`H4l#+9Gn5dX$!T@c+;%kg-dm`z}ZHxmhVl6z{>^`?3xK@wzg3`YUK}EF(7S> z)po;9-UY5k!@E{4r+SXveEa&JfA_TuTVCT63-grK^W_$bWsL&&OICE+NOZh zcmb~}@>Q+~5&f@gQK-$y!B^6bV^EZ0hP04#%ssXKzP&H2b%Dg97lT=4_euL2;d|)) zDfwWB-M%1F^N;o453KCbcSyv=Y;9l&_pGIYZ?;G6BXtn zQJG01g-gJ6$oIcag~I-$=K*aVvqh87qq$nX?h^pjXYd00 zILC1geq9k+Rc7$IT<9^LU9c?J0DQaD+gwZ6o8!NH``UF4O{KO+ZWu^?k6CYOYyKSw z7%7rO-Bd_8)vhcqcxR!pqG0fP;c`gW6)e0RydA7C3zya7ec375u3T&H_Z@P=gzapL zo9`*6KpNB^i`mR)#A(}dJ@6hBDON0}NDSh&h|APyLc>&RfV)X-a>YUpg93PW z1`JhNk{ncyNO81}GQ8OaXjJPI6voI9m4}H5_u4Uz0lGXku}M<~8e+msmP!`qM!=_B z(pd2<%92>_h0=!sV6UM3@c{6s(tG>=xtV?4FZZCNO(Z{5NP-Dr+}fmn|~Y_%~h@ew!zz;W+IAvz|$@;x@YX0Xp{yi+40zu zz)_xY$pBZvcA2MHM$GQnkTav7y!+myEjM^o5& zO_JpRXQ38MejN+Ns4*tg8SKkCB|1#u$&9B6vs9ji0H3JhArX}Dr%l7UEtOv#95ph8 zGaxl_9;Q5jqaju%h3NwzpXGTDf~Ww8W;}#R=A5QH)=8!l5g7&Zy^#`p1xNi`0h(v? z;fL$%w}W>s272_ap{o3Ox*U%u?k0*FG`}AHYpDTYzO9P7vT@S4g&2sbEXGT`VuDqT zFo)PLKL1w}THT9UeNVoveV^{}+S2_)%hc&!A5_He#N6G6+Sia*@e$nQn0wMH^jD79 zbNEJ=W5BsLS|I%?4og<*0dSM0#9Y>vB=e)zv!TH7)`7%}A;<-~x&n3q4-qJ&DSOev)))Q?%I5D|6v0kJ5l#Qj0TEXtypysYL_}nxDs-5xs=B;} zPpkTV#maug+J3#n>Jgy)jQ{=l07Qv{Xjj|K*GUkrBba@2{yC?j+u6^Gr?xKB#8DFO z^>80oe*bNOqw~0J9g2r8eMCIu`!5k4<=pSD;`em!_YVKC)738FSx(p9MeN`>Kt-_a z;@LI&J4(R)e4Y+7_F+D}jkEhBDv-s;qAW)Gem1F!g_sx1=?LaYkC3*bRg3*uJM^hK z-IhOeTR!|a#(C?jYJWC7Z<1w{#CaqL<*5=ZGMO}aL?f9~n!qxESZKPXY8~hJwCi}L z<1>az`aS4J1!N|W0$QVdsCz~mmmKfdL3cdp8u_mFa!m!6_MsK z^Z*P!UHWihwV9Iw~WN*i%5(_2wSwHx)WfWtN0trZOePX;5{~ST~_+^Vr6`{n?>vqq(*~^BdSl zHU#5zG`mAUzdAIl;zaP6#8F0!VJV@4M>+%<6*&)0o&vrlc-bd}gMuVHm0Be#VLBq3 zNhq@i&EgC59VYUCe_xldO=21l3?W%ggymwxR0uXC!$n~=kkt`BZ9mr!RI#0bPYHtV zH=FbxZ*TOVuR)NXy z*XTu?&c!W&%~#{oq=QQE(st98E%jKemo+dcKFr2-f2)p{!Cc#q3?_OWOzPfyKJld!H{7{r*(LQdq+xav4vHsz-8=u_> z;JW=3K`1{Q3PRxlUHkGWQTUr~Z{GOc96;eul>x--yy$AW!wU|0f+Cq;Jwn@7tAOKS zIwI+ahNBZATXsg)oLheHwbEn3{I*VT7|ipO?Y)qGB$)53;&;8N-#7f@Zcr!Z-k{zu z1RaQsC#hBIbdg)vc_C0g?kG$gGtDR0iQJj&Bxh8zBAO;~Qpdc;7l z+8Zs+o_(#DrP+aN#rE|K8rcpo_%fe~(k(wIzM?GQkk9pKT8~E&O*2ACv{!r% zqxD{aIl@ESgVv8K{rJqWNfw=BDR2Wn6`iM04ly<|vS$Hjr(A9(*)?P6U=GuO(Q}Da zvY7CF=={^9kgsSE_JebL>M6kaT5FHP<^U@J0tv=5rjnc{r@E1Mjda_K9DXij{^z>W zyhHN7I@le{JToF@B$o+MNgO6gMqo~n#Y`K(-?1hf<}-|7hm9fSO2j^Y~MnH53rr_|xqwiKxAmD|`}5yE$A~t{Uga9W0%> z*HNcTp>8MxsL?$x^+V;su##p zys!-{;O$V=-AEJ3ql~7U2_s>bp*l-oC!@xYEQuOR=+o1TEM!-xI$mUXOK0J}8wZ`jbkVMBM6;CnT6ax!dW*1848pN8%=I$6B{ zB_YJ?Yb5!OkswY_QZM*5BWV05X+YQSulY~^_dgwJX$0$=Yc%=Uz44}+>X9iXTF$Gx z8rGxpx$Va{R})d&19KwE@ep)@m2L2w>xY@`)3^ed0Lo44??V_d+ROs*+A?wsfd z#duLKv@xPA#K*O6`AZ?MKuF>s8CqJK^`oUdSWc*Jy@F%)pmBxMFnXG9uN0zK8j?o| zF_Pp^m)w88bu^rw`FMvZeQ|TXDQ5WSys8$PN6ZWca6^AF44v`8dt+|F`3r& z?A0xSH)HG7>Xi7$!$kj8lpkw=9<#*_j-K@v5VbJ&jsOI71IszT*WE60|pA7F*2YIMukEBG6vz2($RbqB&UT8J^u7T#op zR~A$X3OX<7y~!|CX`CT-2$;loFan zoUx%KOob80dvxl!`fN%Q0A;s02~CxZ5)#ssWl=H|p{8jXfjSj!U83$*iDYCY)_Aj= z!dvsnu3!JK%)OXe?O~M5YVNzhgRK*y`&tSK8~OxxW^^TtrUgK2*sZWFz$IHIi*89> zGC3EnkEU3BvND_nThO&zrW%U6q(cc^Y(BUbzi)+cWznu)kK7MeqHiLg#D}WZ?a$lj z)h!Gs=p7Hpf)cZl{l^Ir6xjkH>m|^JC}zdzLtT|#i95VZ8|B)hWrUM47-VfT|c7iq_Wgsk0?2-sz# zQI{SeFW^Mma&(75U~jo)Ss>yOlcA+VgX654+e)$%D)G^0xMffRLPdg*1P3Jlwg6-U z8tM#Ydzmlr{B!$F+`H{V$vZ7E=(8L(AAEn0Eq0I3hX)?d^9L-13u4bbe&D^bTHA-a z#R&hp?IJ#@Nc`$HMt%5T5!g7Z&S{g7jAoR@VVn&moIQflh-ceiVy&KPJh7YGVm8I9 z_<`-yKE7NQR>?~GXRfQJK?^o**kR3KvlyPLZY%6B_p!Py)VO*O6DyKpjz%oEV!czj zUar2Gx~=fYri!U>XFd(!yy`n1CmLXds_el&FWte@*U0RqnA}tbLBgGKN?q^c|5+ls z9#xCk;kxH~`cN%ZHJ#mP5F=TPjahUgDI}mP5zf*m8?s167>TBY-n!t@t@17x^GU7o z3`gZ@RU73bA{0~>P=$tEXG-f_Dkb~0Alw4Sl~wNR!$*^U+FmHLpPjsfy&I1&gg>m1 zB*B(ztc%}^@&U2)v>wl#==arqA4S;+(5hI_1ScZf@pKjFMXrLP8cA7A7W)>h3UK2I zKsUmltxCGBe%KwsBJ}%_jh(hzL%i!9?LLYEtntZcXX~9Or0|1T;`Oyc4K5# zTOQp`cOw8!kP~^@?nf2}vgY53hS$RFl-cj_ev(h=O@p1SwOzNcGnXx~)l=iT1|YOD z0Vb3gtPG145x%j$dP~&UEel!v9Gm`Aq>3+)}4+#FdYSFy&_=b`n2`-CV*t{Pf6A>)pWgXge`n7wRc0rMFiD|`KzB`+w@ zm;@?Tf<(fQj`i%ld1&J0a9$i7$4$KKWgBgRadKmqyl`Y_98w&LAmWHS^3u@0i5GWX zoYoDRh^b{9iy7CIjFKA66}IclP&mUAp>oENjIjZh$s zp*y)mJ~7e}o2Eui+#JG9-|AsEJ6pNO=f`1Tvt%f+=RO$(;)Ws0aL3lKZHSs$J3-_Q z(Gg3@O;l|?ZY-9LTkJ033Vj<(U@}$ z$*Tk#3`uN=)*&M@LdMk-G1=B5z;TL!Y~rStaV%_HqcST+24f=vgN2R=HPq1&(a^?; z8h2`jguymO(KqKG3!#Bgy47-vL_SkkQ|1d2=-74sskeASX#h%2anX$s?dKc~AJd_fL=zfC*f7UHfNAO(jhD`y z)P2-cnV$lkzAfGl{vAeQ%`gQE76t;j0o2siiJ-#?>fTiEg3-eho{FX3egD;(g~pK# z0~p&_QD1c&tTqAlbU<~TwBUkMng6L^>NyCa@*PS{0!k=MOL2&}^PZv!r7=-zKYGIj zq&)XiVbpmlNVW1M2ql3JT3R9roj*bJH6ZFchs6b@t!F$HP!7k%R4-~I63WL0`@W8` z?-jc!eKy{zmD959`T41W@9uXw>Q^qQYqL4&5P+D^V9Jz1nueEl9 z=un89&vol3s_9WrgV&J5=&EHDg#s)?p$+CCA=;U>T0cyz9m<-+@qhi4?L6dZ@Nzq* zu-XN#F;|f<0t8gWuCdomO`pIT1eWu`kS$C#<{uHLAqQ7h_izXlg+}OrQlq$V-PT)g z@r2SKl-y1VZQ-bvc|?Ysk1(y?^L%EwhYCJTykDR-wK&I{Z z+G=rEM0QtWz=eqXAaWK&wYE*93?ZfOyx?Y3wsMV!io?;x6)OzIQZpaS65-T21gYM* ziIpL&IGh#TjLTle@sM#ly}G1EhLQ$8gFm=ISUHATH?(o0=5T5nj|+F9hCCHDZ3mb? zyr@SqjxnQ1VS=Qi25xBMM9olY4mmNt9VPp;aTz-BMEh!&w8DNsgwclh+-J_(cu;Rl z&<%mE=X!x=wze{jhgbha2USpiY>e_H^l9i56gw|`)Y>+YGMJRMnAjq;$~+o31Fkx$Ubq4bVyzGJZL1kq6txnDHY1W|MDu^<|B2~xEr zfptV;h6M|t7wG_qrq{8NAZodFs-GXo_%!IW--A^xiVDUU5AHBVhnq6%6M)lm8(JlvMF@tDaSEm@a6b~J-pmOdcXax%pKGFKH`iFiI9-MJZ~zRv zXa$lW5-BQT$3?7$)=jXu!_s^AU=u4lnZ`oJfq)EiNFMKVf9ok_SI`+(jp*x0s zHyt-&ww-4z#2jv1esDTQGBOk(5OHLf<1uN|nIU6f(s#vm2QAxKM~24X;_d2fPKgM5 zJPfo{wsT$CskL)rXD~ahH=TDtWB(W#maYreE3IUBKw?gD5TgkGb@oWtS~g+gj!EAY z_f42==NXHWzIr@zf;jO56oo`YMnu$^lUmCrOx!WK!#FyL=c!mDYISJjfXQ~Au`ubY z$ChA;s0sr_S*RmlItHmWG;E@zkCJp|)=JNk^hC;ZzV7x2?Ik{r3x|@oR0tP34l$A( zM-;`*3U=}W9YBQLd@xHE`MCoRcgVFJ3tdZoEENu=KXO4sLYOo#STHCmbX*BSU-5)HQsJipGid7uoz;`tx^)^j(457oW zDH}UBxWkm}ryq}v_Tslzp8U|LAVgst8-k4UMTGShO=t{3<0jSl$h61J?4=$Li?*U4 zp^%yfEQ~S3z7z^M?s92r%>=~|C>ADPr6KKmyZ2I$2Sr=ak5HJ%_>rK7V~L@2oR590 zw`PK32o$N^FdgLErQIY(kzqVEIx4UwF|5EK0;@>tAmEPvjHWhCbPS;*yI-jMG_>|G zm;L19k^nVTue2 zo#P4WjhUDj!o=F#? zMq)qpQAjuy{m4YXd?^Iw5(Oqw*!k43dTS;q20(Em*4Op~_k48Pri!Kvqp{IdgDrO! z4MRU5hQWxifI6<2HMD7>V+bAQCSBd<5q5zS9C`Zj&}c7y%Xbm6Q23frcpu@B?@UI$ zMH3nW(8zwDC+qxNlJ?b+div4O=qP?mc~V6wfu1Lkj-bn&V{@hzk_I%&pMI@!efM!Q zUznAU2@FMIGRXG7&Gc+1yf2#b{g3%6Y0n7{_ufS=K7Se**8w@4LjjW&Z0bAg)Bk;< zJI)u`+McSR`@%df*J8b~J^Y=BW24sQueVF)l~{|*bhA>X-p&e`F94dZRkDKP>e_hU zr``^Yo_(wonW>Fs0fOC*ke!~K*w>p+=}en1C$^B2_Imy!S$s09)k>-j^I8UQ`9xAZJO zExn~spT#HRC7HKb+z6->{Actt_**7otZn=JXXc;<u+nDU8kG5&OegI+hj)1 zep&poIFG&ibmNJY@mA*dO|mlDTc=)rc{)^SCDz8fP1e`mk5Iph?=QUUK3kicEPv+0 zKx(m7R8{+Do=O*40v5>I3LL&zrR#L@RwVgBCwuL_y-w7%t^CgO;&k=dTVIQ{ClV+W zY6g`To`$+TPZm(+WgW`_S-gCOlgS)_7%|QBP2QWw&VzDMI*&IGZckb zYUA^mYhrLDVk|;1R-9o)q~Bt&fcboj->FyqbdpcZAU^ZI1*fGcIra9xE7j+Zk9cJk ziI{t7>|L7GmqZ!wOCmgT2NPbFd@5#ZfpG(_C8{$$Ku}0pf>aU2G~NaF|nztkA6FUcYbyL;)maU zI)C@-$De+?JpcK%_eIRXes)-mH|O8K+5PnF)-+DEXFt7uj(1Py`n6$_-g@{R@nD6) z=E3j7RuIoVUS4)&-2J^RGW-ZqI9(O?KL6j}CS#gqWaj;}{KD$^f(hW5JM4fyH;;YU5 ztN;09aemx`e!jRpyMO;-^Zm=L?Ljc-&K60whDVk2nl@{zzTCR9O~T~zp(W4l?d=Q( zE1!p;l=lWm(f^(3|Jp0EU43liJjt$&hM7B`1M^JCf9^+DL3oPTsgGwq`gz~XX6v`9 zw$h@WkzYYBL{BlFMTGs_@4x9&T;U;#E0`45q`1DS;tKyviVMM*QG<~$bQHxDMw1DO zHT1WlOcDXTi(%MegE`U!QAIdLp-?gkS%|fHI>l9e9?#R;Tzst3xi?R45_s{xUy3Zt zb(cY@Ylnx$1(%&*f(Qe6xUb+FPcp zT;PFR%L~bK|GjWRh)>=OZXWmr`v)695 ztg9khC-d?d@LN!>W!a!wR<@R9&lQE_PMG``4HfB-oo`>iI{)z2U3gM9hVTr&w($I+ zOL&r5xbxw^PI%UiR&5cUwUzs3;fZRdwN-ewm;8+i&(;QY2+vma?It|Kql9NTqnI72 zJaKTO@Z`+jU;J?so@^4Hlkog%!m|O}Z(Dd065|MQ6B;Qoq5&a9a^DY_q=xATG-)h@ zm}#Y0$gw7z3&dFH8^mcSW%zW$v(MGHB~0F2yg2)(2WHU*33xa8{G~)LFuRoJj_S0Y zHM^n&laRMrdTJ%I>s%aeOtFF_G^AQXar674hzP~{NZ)sxh&Slsw!BQXx1v4S7vFzOzC+p z-1U|Wzr9YNRthR(Pm<58d<}}+_R3>@p{@BqZ;i-6>H6=cK;InZ`Xn>{6%=TFHf>j+ zeJ;&Pf%YldN`XeSUDJMp3beB;I}~VZC-f`OqR3+uD4hi;9H>C)X-MGT89(0hNe)?S z_Pa#)BtRb$P6G6)JfHj6e%k_+GtLc)wc1x+an?1{O_jxkq{lluZXy~Ux z?P;Ut&|g`@8aYgPa}8zLCR9SMY@k)D^LeUl&j?Q^*>aVZ?%MoUH(+6NiCZ?Nkc5R_ zHP@hp;Cn0X-sE-pXgmBY&t!$~{>Lxx*HFXU`bVi0!SsSMSf-#gDnZa%n3Xb+;8v{kgEwv`)GynBa;U0pbbA-IlGn98~_4Ln8=cfr0nFd|9!f_56O~9DUuw=UfgVoB0-QM z9(2F`LXp_TiIcfj5{7lyo~Ma1M5x5X8T2ec>#tP8o_q6qchh)-$+}YKIP&_?#}(|@ zMLEV5`98R^&}G$3j@Q4qK05AD)_d)IiTlIE`!&q_o5}I>*B@S7G!x}Z_`VOx^mBdO z4R>e+|6bhhA|KD_RR61x!sYw_o=sbyBqOi%psio~>==pDfzlL-fbxzoPjPSPT%Sb~AjKv5>DD zh)!$Qm+0HElPKT@P!GYUPat!yIYCyt(#6? zb`dGG*Ku_tLuvM^%K{gm?o=c0+h?G*bv$dKY*Ef}Z1xJ5h09t&c;6YTMo*%T*yvl> z^aXGOk5PFE_9{b#>;}WS@yBmZtgjc-UdSHZcu?tbJD7+GRQAhL+4g&9khX?v!M5U0 z_n&<_Om94RWh3#Y6ZOVp!I(qz#)LhT{zXV&yki(?;Z#UD?c`{EwV-Fyb7e%6t7y>*Pyl1mk2qkabV~z z5Sr9puR3XgsllJ-BqJ@1zkQ3oI=6VKrx+vay7D4gU2o~?WjU)hTh_L^nJ%9{{ z7WeJ93M~#hO8h+79lf#<*c}A*{jl4d@)X#m6B$3C*8ARE#RBUF);&kA^-1}Mxin5W zNtt1>HUPd#GC@pC5^04InPyC~ge%32a2Y3ALQEIt0{KJBO*ssWY!9Ohc zhXwzz9Vutd*->)7L+l#@Vg|%KIpw_lfIe=-lo_+iB?S5}=ZaE}=3uGjJm$(sLf}uK zgd_%DPyW$Fc#Mfzo5&?Z3+NuEBe`1((R9@ zwxQDv>x3?@8evFsJ%lzKX+^B*qLW>q^mFk=XJ5OB-FoP6Ez;Os(Db{9pkmf~KX{1r zu!Q@qf@_UC*q!4|q7Mav>mluhZ=s#pRtOdDIr@LqOV~2K)4;VAcM#j^&2Q?eYq-DC zd8aY-XGXsShu5gHxP7Xu=Nn2n*!Ei>RA(? zy>_-h(+6Mf*e}=9T%PCCt-x!$`c8ADZDe)ra#x3FLaC;iWrRrNBZx$9zk7#?b6C+44`=5 zpt$*fK5kIdgcz!|P$uJs!_AY7$Cf3`D6O<5gi!;(FKR?W1rxCoX_D&95RyB#`9fZS z;^+E$`l@!<3-oZwWPfv-u2DC-EYQrViYo84wVvWG-KXVL zm+Ob?dd_P!VW?i>YK#7$+5FQgdksCQ7tTI%pVbu)T>%eW9?nDbVR(oi;-AXY{tRv} zLyU*X>8JA0@Rben5DxCA@DNW=;vq44DAUt>b=?mz6kzCN7f#aGgPya%vK4 zfp@GRR4HzqR?-3RF!s!Cyc4>)%hk zi#W>aZ6qijP&1(B?oK_f-evOvecY&-6Ul8X4VNZYCg+mTIJ1PZ+|pQaNgZV_F_gqw zIF&o=5)muKn9aG1r5HfXd9}mj%~ywDk!oFPggd}TWX6vL{K9Xm=nK4heU7bTl~GQ7 zH|xH5(GZTWvp|;<4^UV0c|G~_t1U`&L|Og!`*hk^*!O2!%!^swW*<=z=Sy9@L42QW z#dum%Q0x6zFp=4q$9EUhCN}$Hw(S4_nRSiBU7D?M`o@3WV$Cw<3!7>SY-59_^BJI% z_l0lLx&8U8Hi3!zPvM;myjXt*g1ZJ(MEbgWWzX@`SM~f=x8))-fT=!4h@W(uUo{PT zF+y2y-hDhgM@d;aqC!6y&gkHyd@eY9(+B0=Y{J>zpd5P;`P}yVXAruE3kf!plp|@+ zpIR<4d}Sl$5`ziWgUThuY2I{n!qW%z#=pO{hyp7GRyviHp4_TK94;%-c}@voI*k>R zoC~VB%Z#E{JCYgbTj*lw`-EF%lav#dWWoszH$@JxQdo5;tU44{9SW-sg;j_CA66X- zWEIHj3}p4R))!JNXG*0xwTYteJCd3RAS+3E$~8ABvot0)b=2lo@g$QZOOn{BoDm0~ z52?Sx`a)rSq4hUSSYIftFSJ|ieavuA#spnqxDUhq&Q3j2?ER#Md#&J=K*`S?Y zH&f%b@XpuD!Q|5vb*am}!~J5nqZet6g{faU66?)=Wtg) zYETPv*mlP-sNK70_el+EI!_a=gfK}W4AB{9jGBZScs=4;H7XH~!1zTn?NVzpVdFT< zY?`Z#iafSM&Y{0Yb-Ap3ZF5&Gq?h&Qd1Eu_Cr2yua_`7l`!b^&JuTM0vu{v4(`mds zp>;gRIDTtj^xJm~jsF&Xb>DC2FrB>ZtHO<2t0d~Ge0J3&H7Dv0;1duSE^fc#hgkFh z-P!?9vcGz0=aBfLBO6iip|iC#zJDv4k&*4R*_wcn?Hr-m_OHL5b^rbK?0?Vx1`FHJ I-5rPq03|6GQ2+n{ literal 0 HcmV?d00001 diff --git a/documentation/audits/security-review-2026-10-12/scanners/trivy-summary.txt b/documentation/audits/security-review-2026-10-12/scanners/trivy-summary.txt new file mode 100644 index 00000000..5a264338 --- /dev/null +++ b/documentation/audits/security-review-2026-10-12/scanners/trivy-summary.txt @@ -0,0 +1,82 @@ +=== cloudflare/cloudflared:2026.9.3 13.7 debian + cloudflare/cloudflared:2026.9.3 (debian 13.7) debian all={'MEDIUM': 25, 'LOW': 10, 'HIGH': 1} fixable={'HIGH': 1, 'MEDIUM': 10, 'LOW': 2} + usr/local/bin/cloudflared gobinary all={'MEDIUM': 9, 'UNKNOWN': 7, 'HIGH': 4, 'LOW': 1} fixable={'MEDIUM': 9, 'HIGH': 4, 'UNKNOWN': 6, 'LOW': 1} + go pkgs w/ vulns: [('golang.org/x/crypto', 'v0.55.0'), ('golang.org/x/net', 'v0.58.0'), ('stdlib', 'v1.26.8')] + HIGH CVE-2026-78669 golang.org/x/net v0.58.0 -> 0.60.0 | net/http: net/http/internal/http2: golang: golang.org/x/net/ + HIGH CVE-2026-78667 stdlib v1.26.8 -> 1.26.9, 1.27.2 | net/http: golang: golang: Denial of Service via crafted HTTP + HIGH CVE-2026-78669 stdlib v1.26.8 -> 1.26.9, 1.27.2 | net/http: net/http/internal/http2: golang: golang.org/x/net/ + HIGH CVE-2026-97031 stdlib v1.26.8 -> 1.26.9, 1.27.2 | crypto/tls: golang: crypto/tls: Denial of Service via multip +=== gitea.dooplex.hu/admin/felhom-controller:0.307.0 12.15 debian + gitea.dooplex.hu/admin/felhom-controller:0.307.0 (debian 12. debian all={'LOW': 215, 'HIGH': 144, 'MEDIUM': 275, 'UNKNOWN': 17, 'CRITICAL': 16} fixable={'HIGH': 23, 'MEDIUM': 27, 'LOW': 1, 'CRITICAL': 12, 'UNKNOWN': 1} + CRIT-fixable CVE-2026-13221 libperl5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-42496 libperl5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-8376 libperl5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-13221 perl 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-42496 perl 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-8376 perl 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-13221 perl-base 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-42496 perl-base 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-8376 perl-base 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-13221 perl-modules-5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-42496 perl-modules-5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + CRIT-fixable CVE-2026-8376 perl-modules-5.36 5.36.0-7+deb12u3 -> 5.36.0-7+deb12u4 + usr/bin/docker gobinary all={'HIGH': 3, 'MEDIUM': 5, 'LOW': 1, 'UNKNOWN': 4} fixable={'HIGH': 3, 'MEDIUM': 5, 'LOW': 1, 'UNKNOWN': 4} + go pkgs w/ vulns: [('stdlib', 'v1.26.8')] + usr/libexec/docker/cli-plugins/docker-compose gobinary all={'MEDIUM': 9, 'UNKNOWN': 7, 'HIGH': 4, 'LOW': 1} fixable={'MEDIUM': 9, 'HIGH': 4, 'UNKNOWN': 6, 'LOW': 1} + go pkgs w/ vulns: [('github.com/containerd/containerd/v2', 'v2.3.4'), ('golang.org/x/crypto', 'v0.56.0'), ('golang.org/x/net', 'v0.58.0'), ('stdlib', 'v1.26.6')] + HIGH CVE-2026-78667 stdlib v1.26.6 -> 1.26.9, 1.27.2 | net/http: golang: golang: Denial of Service via crafted HTTP + HIGH CVE-2026-78669 stdlib v1.26.6 -> 1.26.9, 1.27.2 | net/http: net/http/internal/http2: golang: golang.org/x/net/ + HIGH CVE-2026-97031 stdlib v1.26.6 -> 1.26.9, 1.27.2 | crypto/tls: golang: crypto/tls: Denial of Service via multip + usr/local/bin/felhom-controller gobinary all={'HIGH': 34, 'MEDIUM': 22, 'UNKNOWN': 6, 'LOW': 2} fixable={'HIGH': 34, 'MEDIUM': 22, 'UNKNOWN': 5, 'LOW': 2} + go pkgs w/ vulns: [('golang.org/x/crypto', 'v0.31.0'), ('golang.org/x/sys', 'v0.37.0'), ('stdlib', 'v1.24.13')] + HIGH CVE-2025-22869 golang.org/x/crypto v0.31.0 -> 0.35.0 | golang.org/x/crypto/ssh: Denial of Service in the Key Exchan + HIGH CVE-2025-47913 golang.org/x/crypto v0.31.0 -> 0.43.0 | golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent + HIGH CVE-2026-39828 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthoriz + HIGH CVE-2026-39829 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of + HIGH CVE-2026-39830 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of + HIGH CVE-2026-39831 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security k + HIGH CVE-2026-39832 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent + HIGH CVE-2026-39835 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: De + HIGH CVE-2026-42508 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/cry + HIGH CVE-2026-46595 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorizat + HIGH CVE-2026-46597 golang.org/x/crypto v0.31.0 -> 0.52.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of + HIGH CVE-2026-56854 golang.org/x/crypto v0.31.0 -> 0.55.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentica + HIGH CVE-2026-25679 stdlib v1.24.13 -> 1.25.8, 1.26.1 | net/url: Incorrect parsing of IPv6 host literals in net/url + HIGH CVE-2026-27145 stdlib v1.24.13 -> 1.25.11, 1.26.4 | crypto/x509: golang: golang crypto/x509: Denial of Service v + HIGH CVE-2026-32280 stdlib v1.24.13 -> 1.25.9, 1.26.2 | crypto/x509: crypto/tls: golang: Go: Denial of Service vulne + HIGH CVE-2026-32281 stdlib v1.24.13 -> 1.25.9, 1.26.2 | crypto/x509: golang: Go crypto/x509: Denial of Service via i + HIGH CVE-2026-32283 stdlib v1.24.13 -> 1.25.9, 1.26.2 | crypto/tls: golang: Go crypto/tls: Denial of Service via mul + HIGH CVE-2026-33811 stdlib v1.24.13 -> 1.25.10, 1.26.3 | net: golang: Go net package: Denial of Service via long CNAM + HIGH CVE-2026-33814 stdlib v1.24.13 -> 1.25.10, 1.26.3 | net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2 + HIGH CVE-2026-33818 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | encoding/asn1: golang: Go encoding/asn1: Denial of Service v + HIGH CVE-2026-39820 stdlib v1.24.13 -> 1.25.10, 1.26.3 | net/mail: golang: Go net/mail: Denial of Service via crafted + HIGH CVE-2026-39821 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | golang.org/x/net/idna: golang: net/http: golang.org/x/net/id + HIGH CVE-2026-39822 stdlib v1.24.13 -> 1.25.12, 1.26.5, 1.27.0-rc.2 | golang: Go os.Root: Symlink following vulnerability allows d + HIGH CVE-2026-39836 stdlib v1.24.13 -> 1.25.10, 1.26.3 | net: golang: Go net package: Denial of Service via NUL byte + HIGH CVE-2026-42499 stdlib v1.24.13 -> 1.25.10, 1.26.3 | net/mail: golang: net/mail: Denial of Service via pathologic + HIGH CVE-2026-42504 stdlib v1.24.13 -> 1.25.11, 1.26.4 | mime: golang: Golang MIME: Denial of Service via maliciously + HIGH CVE-2026-56853 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | net/http: golang: Go net/http: Unencrypted HTTP/2 connection + HIGH CVE-2026-56858 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | html/template: golang: Go html/template: Cross-Site Scriptin + HIGH CVE-2026-56859 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | encoding/xml: golang: Go: Denial of Service via XML decoding + HIGH CVE-2026-56860 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | net/url: golang: golang net/url: Denial of Service from quad + HIGH CVE-2026-56862 stdlib v1.24.13 -> 1.25.13, 1.26.6, 1.27.0-rc.3 | crypto/tls: golang: Golang crypto/tls: Denial of Service via + HIGH CVE-2026-78667 stdlib v1.24.13 -> 1.26.9, 1.27.2 | net/http: golang: golang: Denial of Service via crafted HTTP + HIGH CVE-2026-78669 stdlib v1.24.13 -> 1.26.9, 1.27.2 | net/http: net/http/internal/http2: golang: golang.org/x/net/ + HIGH CVE-2026-97031 stdlib v1.24.13 -> 1.26.9, 1.27.2 | crypto/tls: golang: crypto/tls: Denial of Service via multip +=== gitea.dooplex.hu/admin/felhom-hub:0.146.0 3.21.8 alpine + gitea.dooplex.hu/admin/felhom-hub:0.146.0 (alpine 3.21.8) alpine all={'HIGH': 2, 'MEDIUM': 17, 'LOW': 2} fixable={'HIGH': 2, 'MEDIUM': 17, 'LOW': 2} + usr/local/bin/felhom-hub gobinary all={'HIGH': 34, 'MEDIUM': 22, 'UNKNOWN': 6, 'LOW': 2} fixable={'HIGH': 34, 'MEDIUM': 22, 'UNKNOWN': 5, 'LOW': 2} +=== gitea.dooplex.hu/admin/felhom-samba:1.1.0 3.21.7 alpine + gitea.dooplex.hu/admin/felhom-samba:1.1.0 (alpine 3.21.7) alpine all={'HIGH': 48, 'MEDIUM': 59, 'LOW': 28} fixable={'HIGH': 48, 'MEDIUM': 59, 'LOW': 28} +=== gtstef/filebrowser:1.5.6-stable 3.24.1 alpine + gtstef/filebrowser:1.5.6-stable (alpine 3.24.1) alpine all={'HIGH': 2, 'MEDIUM': 8, 'LOW': 12, 'CRITICAL': 1} fixable={'HIGH': 2, 'MEDIUM': 8, 'LOW': 12, 'CRITICAL': 1} + CRIT-fixable CVE-2026-13221 perl 5.42.2-r0 -> 5.42.2-r1 + home/filebrowser/filebrowser gobinary all={'UNKNOWN': 7, 'HIGH': 4, 'MEDIUM': 7, 'LOW': 1} fixable={'HIGH': 4, 'MEDIUM': 7, 'UNKNOWN': 6, 'LOW': 1} + go pkgs w/ vulns: [('golang.org/x/crypto', 'v0.56.0'), ('golang.org/x/net', 'v0.58.0'), ('stdlib', 'v1.27.1')] + HIGH CVE-2026-78667 stdlib v1.27.1 -> 1.26.9, 1.27.2 | net/http: golang: golang: Denial of Service via crafted HTTP + HIGH CVE-2026-78669 stdlib v1.27.1 -> 1.26.9, 1.27.2 | net/http: net/http/internal/http2: golang: golang.org/x/net/ + HIGH CVE-2026-97031 stdlib v1.27.1 -> 1.26.9, 1.27.2 | crypto/tls: golang: crypto/tls: Denial of Service via multip +=== traefik:v3.7.13 3.24.2 alpine + traefik:v3.7.13 (alpine 3.24.2) alpine all={'MEDIUM': 1} fixable={'MEDIUM': 1} + usr/local/bin/traefik gobinary all={'MEDIUM': 9, 'LOW': 5, 'UNKNOWN': 7, 'HIGH': 4} fixable={'MEDIUM': 9, 'LOW': 5, 'HIGH': 4, 'UNKNOWN': 6} + go pkgs w/ vulns: [('go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc', 'v0.20.0'), ('go.opentelemetry.io/otel/exporters/otlp/otlptrace', 'v1.44.0'), ('go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc', 'v1.44.0'), ('go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp', 'v1.44.0'), ('go.opentelemetry.io/otel/sdk', 'v1.44.0'), ('go.opentelemetry.io/otel/sdk/log', 'v0.20.0'), ('golang.org/x/crypto', 'v0.56.0'), ('golang.org/x/net', 'v0.58.0')] diff --git a/documentation/audits/security-review-2026-10-12/scanners/trivy-traefik_v3.7.13.json.gz b/documentation/audits/security-review-2026-10-12/scanners/trivy-traefik_v3.7.13.json.gz new file mode 100644 index 0000000000000000000000000000000000000000..1283fabcc07690aec0d04eed51e5636303bd4aec GIT binary patch literal 39071 zcmV(wK|Nb*+eVhY z&r`6pQ#F%KNcJE8lya?UN!Dm%TV9fOCW%w5{)2=PNN@pAwmg-G*hkn0*xS9>+tj|- zo(4b?q(F)U!AiEqs6FwyZS81oyQS9+~eu6W9qvo{Dno9fuJERQ&deVgCD z9xSTB)k{7OLNnzjJe&gN$+z>8`H*ObunsxNZvR?fT$z4Xro;Cr@+k8ZkuZUdz?MSH zA+Aqd*Cm1z?QshU$9HUpcoxH$z|?7NBV|D|RP=jt9{B#%c>>5k&j(WU;4tMmk`Y&0 zn7e@NA^5}L3~`J4KK7;OX^Z*Nr~;Lm+K!DJghkdX#!JZxKnr;qMkpNVX|0uzm^gwl z7%X+Ev;{>3V_^yEGvqObEF=kxUTIq@A+UG^NT|hamzu?PHAp30f+&oJVk)#mwpkj(U~iP8>53|1f1fGXE< z6!8cZFbgh1Fr|VcPzudG>@YA?L6D{(7h3Pr*Rh_+jn**NzO!iJ2RCI^=CQmDQZ3V2 zoVDg-WwYg+%G~xBmXEwPc7_C>QhJJ6hk3AA$ab8cmQ8MhB#q*SlJKoXciS-0DRoW> z>bR~)2zDKBiCJzo5}D!k&d*!9@wLanB#5IZ^^rU_Se}LcS{CyhpwfK=OLW?5>rdacKBORH4-Dwphm$}3C6{*^ z2a~jItm^9zC#H(ziEcr8QT4+~E11A-Xd91j{jXc5>a#z?#l8LK)_316#$fI^rog?W}ilXGUF_I$QKg+ZhiWE?^lkYeb(yElDHd2l7~iDT15rZG9I_umCZ8! zxE)8T_06ZX_Vb#*r*S+c_bTqXe*0q!1`eylTwc-3U+LxK$W)$+5M)sZDr8L zwr*w6#ZDQM9c($+>VoZNvIcD@t9^pd z$~c=jZAZwA;0)q$uVz5Smw~~A?KP6{&@!IB^LTo?vrJfBi#c>*IxbH+T|b}ivc<$2h(EtkPk*;Lsu`<}*_ z`qajt#oV?Xjr=F%YsT5-25KDMJlUVj!cr1)k@6ez7UyaUEs4RBV-CZB{NhbLff4pCAxOP`yukaoNl!^{)w zkLs^hyHenD0zb&YxN>)9NbmZu3fq(KKqEBszkCNNxxI-O~Bc^z>7_W*Az?$Y9 z({U9Y9Laf^pH-z>kp-Xn$cJ%B;xomO<#OL<4i%DFl4&k%;$fQ*;HNb+n?tRFM8*%FSgf_Q5eM|xQ4AJ0Cs>&xPU2KZxf_^j27{AuX) z?&$>H2HxLd%A3hQYt+04SRG3}H{eT2Av{2s5CwsN^TiG9=LY`qs94&*CzMv$Q7&V` z_6>xv9NShzQcEIbN!LQ|{#5Kk6;Z`bH*qwZRu$YvNjfolwV^DjDhMV)x}hWB-kBL* zRndkflO*{Vr1Ew%PeV-lvC_p9q`RRgjev?Phmz>{9xR}`?3SzOV|9rRH{j(Io(XU? z3cb@0$#c@N+cDb8nxzm*Hu4^}6n9(@&1ODyra56~e=0P(Y_wpm$x7er@VSW_ zlg`>wv>CTKavAEx3GYm2l`ORno<(ddwG>U^+1R$Uw!BSvS;F|1$GTCe>!DhNQSGyh zve!mc#1W07ZeORGs4n(AC1um7QV8bQO`~e&LmbjDs+vxf%ngDZ_jI2 zcJlitah`sxSx)3_9ML~sF39#37MdBKPpG9mX%im{hx#yZOZYyAK?{3r#JlB!Hk;Ty zqn#wP%7Q4_)-2J|4?gK6dxE)gE~2P3f5umWIRf8I@7ie;g$YbRSkW?t`bl6ll) zJ$ezurkJ>nZCS3%72lCws)XE?U8?6`om;AU_yavN+rlwxuU@sqY@$N_+#GL59`e?u zYMJxR0%oOJck*HxKTOkzLKUmB%6OK9&v7TCv`0(*834?gjGU~$@ZEy%9M{Gaan~n` za%p>jh;58r$8vvK0=U|m(Hucaf&kTP1?^sV-Lp`1X+2lNvMCL8xZ}Mq=o?o@o ztVU;|(>)ny)%w2}_`<-2#gL_iM8tQLa)tIRVG|I-Vgj~(${Z=?!u9tvaAV(9+O-Tx zX0cAwhpNK)LAfbUZ%xp$1t*Md;wS|dVqzOP4Jx0%gR*>#;=69(w`WtRsCZ?ynYxwJ z`A6kr{^gdgsH?QkXJOjOUsO0AnLR!;xQ){C+D#GLqrPjNLp7!W+N6lEDe-nYfb@ml zcBQupulI%H793|up)li8+CFv>la_!`Mmmm?L^6-~2qS@f>Fm#O<+rLDv--8@cw<<+ zF#NR!2b=zu0o1d8&Rox?+UD4?G-vj12W&Qpy`%YWot3qdHk-QIlBvmgU|rxpKmunc zr%`9mbTFed`1(=N!I54;GC$iH#h2VszNdk{IAI=A+7%dCzN;AXDC~@=uZga4P<>5n zH=Z{%=4y@)YH42bp2te-txbBls`XmE?rf^^D9YTu<&RI87cY5s)%Qvrw?f%*8W>7|hi~jqo^XvY_ z0RFsu*S{Xr1b*{!G{}Nr_=xXyJnBbLIy&psgp;6GK{D#i(p$s!GJDbWK+G}!yu=vQ zU58Z^(g+G|1clW^Nuy*mjAsehT?RGByEr==4POmL;7saH)+Xrwpm!+rEREs-wmu`J zM`!aI(rC%cARcpbNLd?q$ivau)yq*2_JEWj+pX8#i+_btUxtwYxI&1U1Ft};sYEYk z59W~eD0_WyL=Ll#RWN!O7)W>?B*9IN(yuAs*-N8@???UX>tRiV>(|%k*O?+OR3sx3 z!z-XZ>BB*|MvI%pg_{sgg%A0}UDQ;uHJJVZFu~1)AE*m(b2f%GXj7LRic)aN=uMsi zX&$aFp|1fRG-K!OVgKD=IC{}vIxEAJs4+NV;A%RZIh--f21i$dYhrXcR>5TjCi0rb zgh3ww8{7m&ZAQH$fw)PHuFmr=E^F%GX280WIR`AetAj_k0(R)gOb}t{{jDLF9MWn4 z5||w}RCZH{WmdSX8KzyHgUV${y?4XEj{4RCe(`cRILtLH0ctMb5}@vMWLh);|CFu& zoIBb_0Ia$ECBPC`-TA5nvzr0CU=0EFYXe22bFNeouq7xT%(=vf}WUPhsMHhTHL|B>>^ zZ~v40_Fw7!Z~r-|*~9hKV0f{T_A|>-*T^5EnVCNf?T4#@{$4+b<<`XIroOiCg25gPUmSpfj$kde%`pGT*(6 z+A(|nxTm}&!F4U~F;dM)Gea^;XyU2aWG?73WUlE(HsI!%b+sVnu^;GAZ3`>vZ+e#S zgW`Kvj?~Y`AW8DID<0~Utqg!`PWiAs)S-rnFC1(s`&M(LTM%oywBfrKSHs@-qwo26 zHX6Jh0pEYc1*j_vu#l^&+r7PkCyvi8gO+wJ|1 zpN9!`q}HzEc&_Vulv9fd%eSQ`8S|;7m{!7DGlCrsvnENHxsc9OkJsfbmnV;py*}oZ zq5m*UfDCd@mKZHEC zDo&X|ii%B;$awk}|Ht0dbv2GN>HGZ^Iq%i(*$t2{lDu~iXrLiqv`r>hW%G-_Q2fx2yZzghlQBF_qi94y`Oqvg4W8KTcNj5 zLPaQeX}xs_AtVuE{}}1RLXv>)Ia*<+kY&;*5f%`*Cm-IyYHWJFNVFmG;4>8Jhhg@H&03*Yg@Ud;K!2f3_Zp(p33|;& zztakuqUklz&1yCS2)akm@;XQDhS+}NgzjEB6PO#epRf9FJJgllJIJ3_`d8(AFc(7D z^SyT46QSrFwSqP=7s9@#5jB3d<=bfx_I>2Rp#OMqleTlSxX@+BNW}=+dZ@0ud!~1vE;H|cuj?e1N`XB+jn@6yUzLx^`~vqc4;3oOt@NZ_1njt zE;Npt$Kg8(EnX)<+S5RyVOqeCeb#v=&C;F{{%-_(f2|hwwgp|4Mhm~)3XaexY4ne~ zEfAg;1V`<#+xEPUz*U5I)Cif+B9%H_>eXMM*J(2K6Nwu7hZ)s2&_A!=`%3+ok_YXk zXf?t{2im@9cWDuWU%Ax&WxG4SY(`}>{ATkgY(uBf>_Ds0g0S0a33NC_*l#ylP0wqH ze$YM&K4>#G>iYA|M)sV)!|Dz+1aF2G*PuUbEVjz}U`E+vztIW0;ZZLPgWfT1<9C1a zh(=;x>vxZX?0)`j3$Z?rUq91xGys3Aki-99S{Q8Sw@@VdR@ zcJH_ep4S6(EcrUQJ_Yuym5?gbhlBH-HRnFmcyc^ABO$E^1lT#L*z++F)j20s?mWUN zgo2Z1Z$kbp*e7teQg`y@?m=Fhl0bE0!52eHYZ3L|J0iUwS0~~~Fe8L|lK%d5bg!|O zqyaAPOcS72zDPjreKCC-X<+B+^L?YT`UxH(!9NqQH_}^C z${v#RZb%vyM0JNGy}SLL1gZ}%Pe`AGB|Prk*xUk+?gkXpc+wk@+A-2Z;Tma^*$60d zbN7W($Gb1r1k_ln2o{=TLnhYD1jTmU4=7!8KcO_^Udbgo9;A->S|8t2U?hqD-6oa* zlc{bsj*k!aJUG4wod{UeQ{ih|wCv65xrejRsr+H~y>z|@?EXNki~B>P-#sG2PeOyn z>hQ#q!6V5Sl?2~66gyMG19$KG!~>F3P?C}e{c=kGl!SB+tXidW!NH%RX`fN-O@&vH zl`QanmsT8=gU+~tNHa_<`jwtn9)r)HbrfvYEj zVPP{CJ{5*x$cJts<*3h4M=tY8%qc@FqnDD=OSjI5dyHYYMW16X6sHJ@1cp(*MdLT~ zW1Uf4vV!x)0(O?Rk!JLkbM$rnRxcT&J_bFVuykW0abBHejCxIsTxgC3nOG$m_TZ~j zL9E4$!a!$h?F#}6u5kPeM5J!2IOumJG}ByBG8tJG11n`g(!{so5NDVYpIYVefO9CB zoaq_Om#-)^V_3jXA*Pvym-s0J5c80c`s5mR3Xmjv}F=y%JAjbbkq#0$yh%Lk{J2sHkJw5Q*;;+vf z9$MvOijFxhNJtBx4KL6vD>%@oIMX{?RCPmI#UQ`$KFa$Z2NfY>>Gi-$VoakVIN{`s z=@}@L%^Ci>Ep*)`Thc0c$!x6KW|q<9{YHqb129D;at&6>s#h2=-je6D`0u4mypO1 zb{_S7m$76PA{&N=;b;~Z2K3ED=38Ba^!f3Ld;uhI)>%d$w*v1@E94+vOI@r=p1KlSWC1aJVTbS9N{5~rDn}Y z$Z$@BU^Pa#N4Qu7Y{$$shDG`zeLWq>-3ON6W4VFhEjfo;`8*E@8JRGK7GQhHS;|1L z6aYy^kamAxQc|oOaAf)xs2gM@K|D>rX_m8aD;KC~oNm4)#{4R{(JJPM*sZmk7JPY> zXpcArjL;mhtT+-PB~4~Yhj%tCEZ%zX4%AGl>6Jn*ZhWp%@JL6}UeOFIKI$lv7lU#X zJ7{ST2nAIYx3Uc|r1VhAUN*#V#JrnNN}TS;vZ_ zc1XFFS;nN?Sf3TeN6IADbCy9s&V#e5`>zhZMS7B9HXT@WL|D9uh_Fc!BnwWnCb4BL z5)kk9F_>Y9iF~xY1@gqr`m{ad4I|SmSMMjW`I1kIZILHvNVp67lKUW*teK?Z z<@2gyS)P)M))noJ&j}5pKv;ja`dDDCV!K7W^aU^Ki|gMko}R%>XKugVCP2ASvX?y& zF2M0owhIoR1)%xQ&eQhY>oo4LDlMY2p`4*bCk^Ziigg=aXZMCYI2-N|{O=Z*AZ!|S zhw%l+A6lGqc%%^|bK0(@c}r zEI9#nRYfZS##;%}D5cUJ&SGGbInZogj-C@|p&YCrSdm6NM}N;~QN9AKJ<|B*=roSN zqq&s@eikEvv>MF`*~-u>e+p3?&_8|(u_1=0*6Y8A2q&Nhf=s7Lq z>fmSK(-tsm@ElT~wv(0PW8yjO94u)EU30AUfC0vTRdl2A30oOi;$c5WxB%LU#$hkf zpwm_QQh0_oN9SlgMe&^ur6RdlYl@1d*R)Hy1z}0HUsnd#^eI`fudvINN4GMc-IX2s zD1C+%EQr^da=b7$rTUAGa1D&gU&Gvwff$rr6AbvYTM}!yoBGIe@HJ#HPVfPF0zm=~ zk180fXxmgdUMI8dgct9@4Wvr1z|h6*+Fh)|h539zJO8-m;1JN2<=Q?0?I4On52+^$ zOE9_fhwe%QeUciYVx=ivc!r=PEpnNoZR*oKvRmovlorFt;d-fO_E`yr-Eo{$dXgbK zU*-&~q3x7A>?l@xJ{<|V0Uxk6O?@o%VxWKsCdo%L0;kVuYSJ+BgN zXy-N@;SOuA=~LpJTtPtY%rQ{U0<6)vR!HcR`PfB^XSB=%Yl6`931y51Hj3$95huyO znqWkr#7rkEhVV~7F6hqs1l&r1wr!N-J@gq<`sYPV%NA0glj+G)?#+z37azOpT^#g+ zcA+na>)DDtH%v5Rgzg`4fiWGqTbp#7aGwCWYQV7!NKw;M$Y^J+bB3|=@8rR~PqX?h zF=XWM4=$IPBwoYJ2?+#pNe<#TO1`N@ABu0zwvpxYo0z$D!BSDf-fNN(OPUV2Lw+s} zb@Hrt}z)6F4U4O$^i0Okcw97~(>k|m0nG7c3Gs^i8h(WuOG=xA% zn(&sCJF%KQ0`X{cNm_?UFN8J`&8e!0+4NE*#M{0b5~ze0J;(Jn`bjRLM#@w30w0J3 zBuxq`(y5Ut^$PY2lE%qtdMRm<--Bg3I{L3ZYVB zUaJi)w+B4N3cWy{N~2qc!%4F@73o2`tb9z;S3%0&v>|+RXJ}AsNOsMo(~-#`@#JTL zJ`?m4zy;+TNUbQ)#5TJbHh{`D(;05pm9~T}2(J3VP}H{|47JTujM5pm;wjYbnO~Z` z7pxKZ?h#ZvVGJqySbi*?NYbq`-r)%`s4iMb{V zBq`ryiQReXljwr0RVK%)#z`Deetyn}OZQ9Q_XVn1SswussI0Psftdkd|1+ zAlEtKQ|E|Jog+T=216$54TezEIkn(af>Q^EVAdIeS!W1logtWYhG3G#hmrf%;c2-w zb0jIhW{za!*mQVeYRq$M^gVtJsYo~tx4!##R?}?&3nn9#Dk23k3I@6- zNFi-Zl??Y{W(=%S&Rpht2L3{N#vT2oL>^0uMGuyC@ULK8;`m85qr@u<2KsNp-9H<0 zG=#B9UNAnR72!1G+U;rJxEsmyQW;A^Sw#N*T;E~+epRe z(J_|rC`c(5UobL`r5MY3DDY33VIRjcy?Eqwl@2*lH_o&_i*>^Av?h?C31(>KL>gK! z`vpE_b<%yZ0;QK6{l9;XQ6n_NggroDDY-~0xI0(P=q9)2$1(E{GEtIr+OZ_)B+|Tz z^DCf_&#-#GLu3Rc?NWtb;2=E5D~5RdZVheiv%Zm%A97c215c8ayI>7sV(#J!j|MrT z-C!*#+GmxZT{09p{#qC`;0eifEhs~XDFacVlK@wNj3x{L$1bA@ZADq>jC4)DAlwP7 zXh}`i$x;qa;St;(2&Ie{lriaCUO~7JO3a!sQ4% zgkwu?wVex&AswMUO-Hn(BpXgb3My52nfV||dyo|cg`IX(al=qR${4vJm~1*+r#xZM z?!ahND$?SwPBRrNtUI_!L>q~JC4QQ|)sJB3MAVBr>2wC|U;u(IQCcKLzz|#1 zqCU>RkVX_aLtNs>h}w;eBMOM7A2dMlTJv5Yf6}A6&x!Q%C-0kYKB?;w4vGWHG^ZnaZG)6dr#Ad&*|>AeCNUKJs*GjG2P$Y_ud@CpZJFEJCAGs zdKr6fTN?iig0|lZuu|ZI2%FGtK%?F7^gE59(+R=zd&j+_qN(kr|;>h8bigH#{v zJ#O#{;AHA!ivAy4gnvBP#I1MT{fA6$)$WxocnMssyMOR-UU!d0*L$6#{?>!?qgnKa z)&ntbtC9P_-`s{&1N(>i{z?AWhuZ2hoOLqmhTtEe!~f&oP1{BW*KcN3jBK1`i}as| zhp-F|;JbxX_y@k8AF5?==r6^al6QtyajdQJ#cpq{8?u&_?S_`3c#{8G8w)?!36E}7 zEp?cKEn|E5b^|}TU2wB7XvAN1Xc&M9I>(I;4uankjb;n_(CI8)b4Frn~BVlN~LPcwale8Cvj-fYgufxjpF?8&6=7)j= zSiqv@*)SBQrjZpU`l+_GN$ud^V0+?7eIplHA<93en2l+vAufwWEqb0V(adJzKmV&1 zTIIX)YEQ9HHJ7qcr0zsPO=(s4679RZ2FQ3aGRNzMaEB*cg`Q*<*PNP)n)unHH-b0KA;w0RoXa&}tOHaL?an;lU4 z>387gN=;ePI=8?GxO>w-{r%d?&g2cC&JTnA1n$&{<|ZpgDTp~Ys+MoxXYcLo9bi;n z#O|a$jHs`q<)aZB5?RFzi4%we-)*YtjD57psxAyb^()P zaj;=LHfV#a$ZdYDX;m;A#PZi(v$7faA#a+z6mr0MW7Bas+6{gZ%4s{iogMH{7WJLq zp-OOXY4okZ!xxBMVOL^+rUr_*$zdUBW()FLPOHEDQJk;#d*9Su%Lqsf{|)|NuNo0Q zNATh)ep)?0Sy|Ir&;xjcf5c0Tfd=+_Au#sRC?t~&SEPfzd5zAbkR%oI>WDhgOS`PX z_g;XA<#lhrD#sU#OAkciz$Vi0wT519FV(Y`68>-`lVS zx~6Y3ym}ssR4$F4ydZy)F}SLLtqyx;9Ews-uxn(oIZ`hwP*hrW`McZdVL@|^MGgyrH^cg$ z;#~0GVY>JNJ-m$$dud)8dcxQE*uRxufBwsV{kJ7}4hvgwOUvT33+=mG-KMaFG^J9+ zARj&c2B!R=SF3LeqbF1K8KA>2F9fWr0ZDQtP@gv(X!V(=^qx=|8umOUsGCQk(8Zw%}^GKj~7yZ zj?-054g6t&wC@Vm<6@ZQB>m{|Pf7^DI}@$ZqJ`-c5M^ICmSTaQ2|A$A5}CW&7qboS{h9qC1PE|{DbHLuSu%$cdFi|JUzabwqYBG>m_FSK~_x*8`(W&MXPBwa@QT>3dVHBVG(f^x0aF9vtapABDUf~nfOFb zf*U)r=eUXMdNIsx79}CgJdZ8X)pK$}v=wc^kp~fi`yv-o&YLY3EDek_aQlp)g z*TLlt0w0!_`7RaAcTy5%CSsTaD$)_1EO6s=fD&n%-6ilKi>fWf?E$UXbMkghHk=;b zU~Cz-5C|EPz>u z&jMy+sXZ*$yjk%IsP=e~Q4g!d8xFJpf;llwiMTX9qcE5F3J&?8n>+Z6lfW~y3});I ztXwvowsTFLQ_!&3BOA1DY6KT$amj@(L$P(!v`X%nR6+)DLy=u?53&`rn9nZw&IQR3 zY13&@YG(hOrd=UQ>r8vRw4s7MFkD-q{2`-#lOG%2_x6>lcz{`o!s1g_2^68g;<&p4 z*j+EBp3G?mdAmc+N#r3ym6W^b}NC)AhFc+O`D%0V{-ja1IqL{q zHo1zUZgd9VvPy!(my##j7#P6MJH@3&Ce_gWz`JdK9iXR}2TC2C#M9y3jZV!GA0$6< zjdtY>wf~^G%_^<~UVv(r#S7G?KEHsL6|z|Gr6zH-HLb*psIN9#HdMK}Ph(cJ&db+O zYcagqU$hG9{8ele$gkp}czzLgC&uSzW8(*?5D@M%zP!u50Nl2u*Sy2jv&zSbUio}m zdu@g{PB&0kLr3v$v7wP0)-^kwk3@9OQDwRghzT%w&0dbSWv;gRREpM(wuH;M0QV7C zuvLZw#?}<7*@Obj&!#znd5gK@lM?af?lE>nv`IOGHDm5t1_~roj_?loj?m*+a9m_i zqOSvQu%QbvpJ(TF(+>r+ zDsVK^?lOl`CN!|Ot5$)VCwT%_{|MdyaAx9c+F29YKS$ABmE74*xM;MVP#r*Vjd6Dk zu2^6z6{LVcsDO!r>a^{OURVsAE-XK$gRo%kFIVMelAV-tdXX-Y%1mq-bL~-d(j=Qd z?}%s4F>gXtd)A%{2CNgqXJW;U7e#{6fCnZQ1JB-XqW1hhIZPA=PVya()REQdmx@Y|Wr2gFVc-4&aih8Zmj7rw=9ngKVW_8N9i z&$RK)TIc~qSMjNM%-;2r!o2LpXSxSVr+pwWNMKTzSB0&j)lEgYeGAs=El$91OM=8F zR_F_lGn$adUle++66{5n=~TUOEinZ6LHpU0bp*|#<*->v97lY+iG5LGUMJNy5I#hq z1lsKR7T@=j>?cOYzoCD>sToX6F2ly;#1Rd%?N{2AT`m@u%>*V>XC>L5YLH4{5TR3N#fWusYg6C zla|c|jp^GDONt}x@?~s8fj=_pF>A5=+D689uOgt)shQ)xTx(zm^g{r4iEpZYz zAf6Ywp%uB5xgm)OUtX^`BY1L7Sd%J4HFZCe5^n4SZsdUec8TSsSt3A#d*&TRa(VF_==DP~imq-olB z&IQXvc|~grLziH@9iiFn7H`;jbKH)~m7?JVZ=`nZY8BWr_N}O482U@cG|l`|7XJjb z4c)&#Su$_1rDfI-b&JMbThSa;VNDAxo5QksJOrd_&6anhKHwE)4qHu{MA9X5Hr$tr z4nwU{8D-O_Fb(@79WWUt>6-t1Ve6T(hz39&8*?Hl7nYE(v|#N-5(Bi$n$ze-}kPMMR76o7)N2 zjfdLM@&Xz$65~M#QyixnYtY4?z%q0kz?I8q9ZZy4?D?QtX~c2;U=fLFF))72!4Z)j zvJUf@m#^+P%WXP>w?ubU_$ma@-}Utt;Mj)8)UedGuGt?`&{-!$buHTMG6V$=v&Sk` zJG>>|CWNB?kjecG(@}w=7%gg=HkZ9U!iDIIve{1RYIsmt=+f<*&4x{dJ!th{VdU9$ z!r)DQ!jR1SVnG8-u%9Q;f^`dQu)Plz_*vvsuh7N>e)9KJS9(&F5ZMxl=pEb&Qe^c6 zm**{?#(WfDW>#&^QqsfMwkO_FELuHPO0!asv(jzZAMb5JFbj-oAOWl!-&IN63NYJI zrl;UvqJeYT-rsEjMzmC67)q30+>U*M2S(Da`RM0mAH)X%Car4Eu>#7RG^D=kyCyA! zgr@ZCmV$39@ku+b);r7aOtB7EsJa)IkkEAk-zQeUeJ}Qf@Uzq;4Ob~^$9 za|0}T6l1Sd(*G(8MV|#RwzEK$v2Rr~vKLYAe2Een)1osRJd>FzDQUK$!8m28=lOkq{?vTr0@Hw&z*I(#WJf`liMtX4(mgB~5BYH%8iKu4hxcURSPzSr#g2MwQMr zZ!rbiW+k0YwQNJnbg%43Z05rj6oF7>kn(9yOtc>aE%Bf(CX(zA+D|gYTrm9=?Q;s^ zZbYBJV-w(Nb#{}!UzCApa({2&16VXu@!AISjA_#s1BO5bfrTtviAAt~N>$)D^q9q% zNA4ZGD~0$0@huY5#7)D5I>!3HdF9r_4=ofP0VdhBU7$6Hp`)-H9l|;<>c@)a5QIrWu%elH!gC_bk~*gDj5>q+Ro@X{NMq(=EC=ae z-X3lz6L1BIJaZ2cEpk22b3Dt-JmNExz8GuJPNm>r4dCUY+kuK30(hdgFpDYoaHi#z zmefwKgHUJo+osu3pgG~;n@UtB5d&Oil%l?tTn1FF=~>&qrVQk{DPbSwc%u$J>h+jx zP?!#54*fjh9i-d_Gk?mXm^-QATQu3Q+Td;Tr0yA48wRDmRiUY8*2)*(kFkD+4sNJq zut~jMp+n+gO%(}NF6z6>;+n<&S6p<3^_iaD)(Zej@J#baLQiFA_6V=dD2>1N#QONb zWs1OQ3B768}zu{V}_6xMOlF-?D8p((Nl00vC zD(}^h&lc~BvsT^F%64lG=ztZ z)%I= z^gS!`LlJ}-O9WY-yqlA#@T`r4C!)ft1FFW4d}u- zlI((>4BmM~?_=p*h$k-zxKkvsL=(AFv>UJH~jpdTvT!Sq}~0b3UL)bgm~L7&Q6wX-xcok@m3-ccL=QGOSMnSKc4_xObNqC5V{I>2WW+`!*hgZxdal|tx^l3ze%Tkwx zF?Co*iAbD`I-I#K_cESlUK*sXFCvyMk_C(VgNYZ=F!rbe>?H!vXEAXwG)G;MMucTv z%o1pbq$2b@<~fveFf5YT&3GhyF229J@bTj7+x3sXS%F@;^zq9?K2V-+cT_Ns|M%oI zj)rFb<#u0VnmUf>XWa7>U|l!acVFXL&%fT+$cs*}FE=*+${HK2vFqN-8?YsL3H-nC(2o0YH9KWV2<}=E3y&sA7Vmpe%G#KJ<)#<7iS4*x*vL&^ z3H;*Rw5Nx6Zi?J6V=T#FV7->cwn5OE> zy%%Cn_D&eb1eT4^kYn#B@XP= zduOuUIIg7OSGk*B^^t{n*yZUr!DuTji@KETOxM#lD9R>Nq@XJVtBDx zSv7uU%B!z6yb(fBj{uN%}yi83oHwMqGGIEjBFBX^z?`zMRavr&kj5B171D?y4HOwrmfVl_9 zXc{ri1<@NgBjVQ#9mvYwzzmKa&r&>w6{xgq8v*TK)_!STQ%p&) z{Iww^o#BEo!;xf4LpNN@*f$Tl87Zwtu>+Qujl6j&xzFqo;xG@=2;@A|;OlOK3Mu40 zP98J`I)u8hvX&xlLhAN2Z6O4nW@$7k5oi;p6@=SJO%&W_;Pw@c{PMLUh_A+YF`%v~ z>&?%aXSoD>ADCj8fj6lJz7~QWC+HZ?iR|yM5=TszqUVaLj-9BY5128;qjKJZ*%|m* z*qO!7>d#am`Vok}%UF=6n>stJI3iXErin625Cg<&#PfpHB&tLUU=EjT(@oURQ%DVhCH@1m4sN ze8YL@WdUafIOkvtryIPGhiumhSPY|E0(-}GSOluIBHofn3H*+6dA639rf!ycnrVQx zgl?6xAXj&!c5rz~4GoOppuNx$d_QjJeSvEZTrrqa()r*>lf`vB>m-b@%c7RU3?#a@ zr{s~8M5O-Aabhj>q4!8V6xQaj_VtwTJp8n;0nRCk9|3N>yydWi>+f$oVXUZ)NEvG= z1#cUa8QC)Eg`MA5>8GzPLp6`QesO;RynE_9?wpnkS!cCUhDr;3uP{;{g}W@=eK3=u zqf4dy1+)y@vi5zH;#O zJ@6Rk!v45wQrY@VoBRoRD$D44Qry{mIJrCdOs%7=cFNXU^|zzJZiTj_s&c`SJJV- z6!kg~;G4#=S}3690IeC2HoG?a@*K?Ca+as;y58PlSLD_yB_s331@Ob`LfA5dwKtwpWl3Xzkz%)>GPS^GX{eHsIHgBmNh@^6+)KN=hHw>+O~DH}D#l+R>Go zmn+WFn$%hu1^g07+3Q^ju4?1kyqWVR{pXVY3S?I$_qRP*L<|YbqlqklugMN;p@5bJ zwBu4;Vu3A`4!g+dfNVNl@p%Z zQaV^%nn*?AIA?;&K;T!?%GvoGSpG>hc?|BQ{m$$+&2RZB-E->U86?i+)grP{G)-e~ z^VDf9k&V${6diC&f7I=Q6dWmQHvZkF0U~{zhmAI|5Rv!KF-MGZVFcFI0fe2lN?AiW z3Wy?b0<95W3qcbI3OoC=df6SSU6Z%Uy|z)g0rXrNW@87UsMqmC$~a5ygss7zflqA) zJ{D@GP*c@Ax!#BR^#G0G(6`CQ%55FJ?nM|vjIks-AvBo~QLD^&9>=8e>8JJc;qaZ^ z`+h8$Ka8@0a!*Nbx6xZ7y^|OlY&qkp84I$xO*L6&)jy2O119 zL<=2-m@w#+-ed+N)ti0ahB{3zYghRI9(gVe^YH>u)KSyi$J5Ogb5Ozy1HP75#-JJ0 zxUhRQ+v6rRk$bITTz{}19}JXkXT&rYIY3qa=>_LN4k;8lbul6Wd}TA@XJKa!JN(B7 zPrr}%PgO@umt$vCRgWFYq*I!ls#Xc$qxlg(3p-QTIqXdx*1vzhn8VBYH507YxiHMf z4M0(knqawB9tlcRsz>0K-iVKdnhDfwt=a81so~y!|2#L5gg|p)myH>Kp5C-rONl6< zNTzl%7C0>)@vtB>0hwxdG@D(h{W{dO5Agtvd_J_yh7Cy5fBNBolp;!7uUWtv{34*l zJI@NvI<;oAIRYA{My;0v=$f_;A{uz$5;ggtDWeK}22}>E`4Cm_hbH8p3+>(-S~Yo+ zF-8(IhN)P2MT7O}x7%3{MeDoF%uqe7wKve&s5r4GQq6gEz}48qnkg7QgyD0wdO05V zr&NgNAapDAL=X{a{mhVNijbAnl6z;2a!gI(v0wNCSkBYl@yXL@Dv))-I3rRcO$e_y zrLGF04-xwI{=4gX2uGYyOb};c#jq8@Q4>7B|0ML!5*MKH0i7L!Mg)#x5|KdOCDrC56AH4 z*B_+W0s!twj9D*0&mCzULl$W(Xhf-3h~N-;^AX(h%c-gM;a8i%lbog* zSRq9b))-TjCc;r_VPewh?y_}JXfCQ|Ywax&Xk^hvDY<4$M(~B~iFH#*oIqj-`!};+ zSIxE7=D7AboSrp8f&MET~|yF`6Nhs*?h*#Ef`bAesQt?yz~=Z^QRD zO{Sp_{o_M}GQM9i&xR3PU2i}P#t2DpYTn?j1qL7(@wad^fuqX3hI;Lq{4hkPRTBB% z%`W|qy*X~|Hrxm4+ddmR14aKs{_m=$-hOF_1oN~wG{OaBp)13CJ{OoK!<1HDuG;N_ zYeta+cwied&J5LkWxd5;TK3U^g^_|u483txhP6xtz3(>1Qw#A)?3~Q&%a`9^M@N~S-Wam)#q$M_s6iFO)g&U$>?n^dZD;LF|}Rfo`U024m~TFOvU7I ztlwQ5R0xAPIUD6A<%W{p{8-RHh*a7W=81u$Qb?IWO4x3GKZkX5Bki!Os(pKh`~C~= zfnhdcAc}g^VI1Y@7Ey?VMsTjs@{oHDG^t%u<9>dBbNa=GywV+5W}^lqsfUfVlt_eh zP(n_~3Oe+%fHMJ{-{#GSL|~kG(}!VQmV`7iHtH3k=hO(D71t-o`cd$ zA-T2wY>0cwK;+4pcap=G8-*HefX65aNn`Zk8bO zI+6t9sa^$=6gN{M;AvJlhRB1`Pw%$XyZ;WmiJt_UK+>P)xj_Pm>v6=q_M&;iW-X!- z94~3;Z{cV^<2l+sK^=ylZ*{|YbDc{w(>J$J{` z?{}Jb>??ncp-18H49m#P5maRd6|p?che$Mr;?#`b$e|;i7pxw}D)?s~s$Dp@mV^&z z7X>T?)NOseE=p^zg20q;Dy;%%${O*x&@_prP}fy`ShruGp(8KtGSYKbPX`TW3<*i1 zkcbJ%z;DUQhV(pSepZL@{k4tIhymwcL(7cV05o;rIAN`}mRX^NqZGI&J>q2nXA(HC zo8vltoRVe$m+@zljHKKW(ILW|^TJ>+36I)J;Az*GUxks$jBKk@Oe+E#iOv?85xJtF zHvtZm^3+0J85S%D6Eg6s05S=X)G+bw)IRA;dw(2+$scwZVY#cPLq<6-H8q;h)MNsI zpY@fLinEcan+B@e6Gp)KXU`@tD%W-N7DJX3r-k9sX~UrLLPtC+m`umyaP+64P<{8<6 zit7zZ93y415;XEaG&pGE(BHz*!yNq)7l2?uqOofQEX2}nfgMeenKUoPmLiRhG9W7b%mW<|hx zbs;D(L2}hN(5$hSDYdD?l}~*j=LLVV=GUSPG|`0(<+; zX`X}_6Id9lLIfU_7n<_ZG_QO5E@4TYAl(y>8hNfsnlVw#5%66_0V*$0+sgRO?%}1| zm;F*O-ICYaOVZ6gl8l&1>Kr^ta6u_2N^hwxw{uwfDqty?ZVK#mOhgf>EEgVmEM4iC z{uP>b;W%%g`zl~5nr;g0E$g%~kti)uWI=G?%dkRIUYeR%xVz_hK=sO4im7`tJFH|3 zRw+p(3d{xsj%ir1%86C;e0UyI-z6-C)NP3!P?{pqBvRAbdqd$Ff(lSMfofhF&jaea zgr$JGEwQ&@fF&i=G((@G5q_1i05un=fBvb~&8O8z^Xk}~BEXMlw7&+_cnLX)f@|!E ziX>u7ITM6f$2f2cYQ*aT)FhzxTl4u`SMNKY*5ggk!PBok2EIcaT4&@4D6O|u;0z^3 zSSqZ;0-lR;=xu@MQHb7mn~zkvX1hApW_Q?{V|BVMgwSm^F(R=RTWu`ifzPHE6u*S>=P}o|N7=#WCgHG3rtu z!vt`dHs)P{WeO~@KCEL}Nxx2bEd6bh50u+7`dtcdhM!caPDl^W>{Omh&&TBbedC+` zI`)L7C7SEZ^8(Wo1j{oggk+o%&Jm}?BjAI_dma~(rjYbpt@m|xtn7PigY`fLr=C$h zgzhNmbvlTfXpun5TBIjLpeiHN3{aW|TmAfXTsI%>NdX7Ja$%Sc7=WVQUSO~|&3q*e zCK3+4R5apaq2_UFP5}#H?`1Cxm!f7=QSZcyYvCi7UUMBh0WPsed@R&VrRI;pfP>;p z{b81un44;PydbL)3*Hk$BQxMId*GV zaU1Yw3PC;N{0QAq)*&P%N=qq&t)YfE22Ra0@U;*$nV^AeaNoGo}spy?K1%frv1ZmH_R^Y``xvxB% z5wqVM)=k{@dS7o2VdX;IG`2Ixuu3c6-=EEIH+>>dfbN!;7p}+T_m=I!@+g=VE-FQ# zQ=zdMDd;_f-n03=YBHLfZoCj!f}WxA0#Mx+))B-!3YZ{im0~zb;Om_+UkgD~2-?4d z`jow-|NZH11MGJEsC_<;;PQGXk<1 zUMWPSY%XtlE++An`AyhNwHaUBrrD^2sp`lIf^dy!NHywHt%I`$l_31H*x9>PaMj`S za17@kpVO-Bm-%`tK{RBtf3ui;NKF>o;blUqaKzFlt2kD`j%&>S!WW#c7jt;oxT@Ya z0X`4!+jUyBowlqY$*0GRbFl;#))C|_^UMV8y$^v>a4x)|uZ5t82&$`H_`N@6U%-Hy zZ9~fi;JKlxH?$FMz4J~mC8C4hIvIFbzzEgrz-qHCiE4^+mFwvTq-2veDJdzzJr`VTIl7Yl2k;Y-STggLwh=^DQ4yF(t1fT6 z1ZP((*J^V?^y2!Gb=@)8?J&ft<&VH~QPTj9WKMdakTTK-B*De5Cao;s+zC##-5y(G zH(}KnU;RFpYF>uWw`cqaOaPq&R@$(bTp;ZoQ!0if<;e?HS+Lq3H*M9IaXz^p3yB)c ze*~uM>IRN5@}3J%G3G=^c&zlKy@jJYIch@Nymw#w4<|%EsbwgAdBTs-bW`I1l%*US zjFoeq3W>ofvL~%BK-~*eUANuEkaKnUh2Hk3_0NEGP1^vGAi8t588yTT9l=i1q_qX2 zJ0beG#RkdwF){oRbS^0xZ4Wt2IhCDjL^(WOwxs>Y1l zAeF`*bDH{AMesIJIoHU9Pam+lX^!_yTOYPRfzLHv13q1O(j=7us3~x`&`$y*2)Hd^x)G zMKHxWITK_hSfD<26p_p>VC(a-`3bvQ@%U`SFk-zoJV>rQxY*jF{wX}(!{Z?|v5z%E zi?)_Jv;3%C6f;`*BW46)!bVMLpx`w8)Aki!7Vy%x`_(UV7=2p3)Q9#Qs0NAezVe7{ zAT3il+UEAkaHRt#%4(0mmv&3=_ajUl&CVa!zfX~|htqXK07qZVvaxep&A^NC(nJ|N zM^Lo)xp26y45#5h0G>b0m9JrM`fhy9?b)3QV>t2cGL)A zoCR)C&h|rL4bED%^`@!n^)@u8xr098+wm!1ta2fATgpI-SE+x6#6||=kp-^t=2}-^ zSpdr}ZjQgbY0bw+yKw!X6?F zpNDL;C`U*Ui8YfLtt=553u*~7x3>|lJpKonySD|S&Cs+8bPPG8sP-6M*>+KX6;AKs zbW`p6WC3mM>dluSrbH4#IMOS^lnjz+mBw!gq+g!>1B5=LedN12#;8U<+C)HrUV2&B zQw7gOc-D4P|L*EPe*UrQZ|8O|qK|SjkknDPAC-~Idqj`kl87}|`E+{+8#r>pDy5@N4z^Y3# z?JXSL$I)wJ`T9-$^`@Q}Am#jw=}+);Mb*e_b|h-5v1F<5(kB=@Gwm$w+`~?@cb}fc z?em=PcKNBftY_ruL?SJrR(j#F!r+`0ABSRsxjLWETi$Ch2n!s2Mmq!0clSZRl-;bjEGp+FNMJc3~tQv zu&)p8I{me8!r^c(PkP&ppPFXF4JK-|eeMYgigM>7<{<)0x6HM(u(N=jdQ-1|Z#T)| z8J&Ejd4gb^W(kH@hFK8}_8y7bM~kD!WdrGcg#%pHYfsbE=N!RE3*f%y!u}}SE#U60 zt?SLZ>n(mHs3yTn;7OM=BlEB8m_xs7?K8$5Y>1=j9)oxdzhL(b^RK`J~T_6 zmrujo)Ld0GP}6N8k!};oNM-{C=29sx%wyENZ^9;QlZUx}u6?k_XK2F9sbw~9K$=FA z6rn_0geegsc{ac^l9KZBA#gUv+CzhWuhSF!*6db(cUb)j_9cDUp>LjR&&UPSQk?@< zf{}id;o#f4ICM57~(>Z zV5JbU6qf)0;^_R12i!xOxBf|r=CzGZ890?`LB<5KEJOvawlryNfd~%K);w3P-kGXd z@0)tx6~PVtwyk=?x8Fsx*0~shOB)z+3Nx*gwyC?3SKyPXX=@8aOCYK?&&S=m&y;PC zeR?BEfZ2DueB|8L^Pf@h2KH8JPQ6#rA#nPM5<2z}GHu&m%X0OmZn}Kfrz|1(_RKXk z&BqN$)PRnSf??z-M#{;c!8zZi?JVrv!A^BZpWaUwWXJ+=PIlR;xguvkCOEA$4UDl! z4TqLcnrmS}W&tu)czy2T`A(bt^7ciFPm64rT$M0#gVR_k-`(1BJpF>#@}9J+0I~#- z?Xd~%M~>pE`g`T~z2gAc%$c{&M-EimK#>lHIHHJ9fw~~TDJ09z&O;Ej?j>wCFKbut z-w$nbbZr{B(=8Z)J3Mcm4(6Vw}Mp^J(h} zEcd`Nq!EVPMf`4;pP0*fM(-DmL?CI{I8ROx1|O`J`-l%A<3qFSlAODG=Z;PDCHpj1 zh$4Y75sa;@ab7zaBK97D)bzReuzFncXwQi{M73mINP^Y1PQQ?<1JXkU$$OAI`?usA zL3~>3a6}0qw9C-5N{x|@C`WM!3y}PHZhj!|S3Ce21Ys_4B?1mE{ag?cy`+ZLDnT&zL#j9zV2J8y}_hO&SW@Up^83kxy} zkZHVoUYlc6H|Bhw1aiFm%`6)*x7Cc61ToMw5+SCpO~V6TMwa8`hk3DS5_vyYiG&;^ zf3?a>%QY=yzbR54iSWp2mi%$}?aBhngRuB;2z}-;i~+k-Bb&UOT$V9V!b$RwEtQH$ zo1AR$h01Bm3MNZ2iA@OG_iBGC*#~{6d|2gW<(ig(7EH7zskf}Nk`e{p9GJAOz_JvU zw0d#Lx9nU5Sa`@cv%I)mRWtA+T#VKufic&qQ^9jkaac0&Qtf{I?%)1PXz7e{qjFKm z=*5DBQ(9mz2-2E?%WIbkRF9L=#e1bE*!uUfiDGgi(B8L+Wl8fX-KSu|(Bq;^$Tv-03yyY%nddbfT{UIG8B|CuIw$jSZHC*`GS zsoc>a0>@aVLFa}^ZX+~A?LsdU&>jFSEnsp`_W76}L+rNDfiGo6)EX12jO1xh3t#^( zU;DawwZ|Rww$T@(yZ~KMGT>scKq_^WkS1E@fI&v(o>2x;-ompv@1ek#U1y`bq+C%l zTBIv)T!_pO&vhW+sMxaLdW4ie{%_j_e{Dl+y0s28uxMhKjTnfcff|n(MG?zL3C27u zxNKjjxtp4<6uhf1%id zk3EfFd4iSHpq}hlL~N@SvmQ9gr>JXk~#hA21i3)MV}Vgc)6-!DZ`!7EuiH}|G2>oBS5P;-!T-BTU-51F&($Pj*$gw&$K+z? zqQL(m|8r5|fD}cFC~0_%+#n>u1%R*jKp|`aVPUfgZPl0gUbXdhb1vFU09jw>Y_ov{ z)HU*kA`==pMLp&|LQ93sw6x%}1fMoEUAVCg&2yJ1{1tkEbZVIo9f+m@9IKQOlBqO4 zDtXl97U{piP1S^cowIN1-|y*1TZ8Xr%-Ci_2PkXg6j>sK(%M?W1C8(tg9V>Q@Ogb+ z+ot|?=qh!6)|h1oqrT28MJsL`vZ4zy#8BJC^Eu$3+fkk^eKx_KkY&d05JV3{Ea-k&Esnc~-alw}4q8=(pE?7E7PL&Y6q#!w+7F;0UCDmT*}VWg?Ip?wL*!#Nkn|DHy$ zUpP@f0O_R%WW#5PzyYR&kft(3B$FQ`BDjdzw9SR4M`-F&AZ$8!Mcl+P;dDY>|B;KU=xr@uOFY*VvZUg!B<44 ztt{Z&1y1_t;wdT%QlE8V`2*lwku=^`!ZP{7l4)vWTKt0}#Y(N#2f+E~Sh+4w&p&(P zUQZLkZD;w5Q7&F?Dj85w&P73}SDYf3UN!K!sW{A!lXCjqj}T<<`kP<&~C&IWx>K z6SOo~Nv#lgTXEXLf(#s)Citp9TR44q(|^6`CjyB9npoz-1}15=rI@@J9;D|gb+)m< z9E@|VEZ{5w=Q&n~myh2ozdM+Hb^e+|UOE>akdLDU3P&@SG1zeKnL#Ar2zPP{O%Kr2 zEnS*Evl660^!cA>Bjxh{ec&REgk~gI$|w(Bfb%+)0??0f@h3F(rtbIDC?r&8Fv*C= zH4y_M+DpSNbI1m6tpVRgoVKel0%zo4+@?PIkKbJ=-hv!p^VYf0fomI`R$&#L;8;qj zMVf+2c=Nvk(R1}`{+MQKn%DIqeb-lqmud^AXx2O*MqqUVN1O`lyV;llIGKHgu zINI9Kth-DX_=!UT20tzG!E#N)Xx-$Eu-Zf$Lc&A=*G+S+Du65or2h^NyY-+I_tZ2q zGPgtx>{yQt!#)iZ#>~PK(3drLE_Tiy>G=Y>2Ap8dTmJ+?*R_rOWowBQX_!KH8_YAX)&CGn??synlZ9bV~ae%#{tTd7|<*P8Xh&4X8VG4roz{y+;9Cfl2D&B>~Oz zJx~x^fLQ1XN`%eY*IQHV4(Cw=&2dxHY(T+OjTkacDaVlvK?WPZ4pN!pa?~h-M0S>7Do0bE3P@?MT^dS7p?Rfd+Fh7hz|>23-;O~2W|obZ z+iC_}BK6!`g;EDfOySjeC+#b|Ea0V%?WXIm;nUg4Ab@LL^VZqu0c#r|lAHx)u?QAZ zi8Sz{;7n@^ME5}Sd%J1&ZWO48x_VZGAdc{g$Ig$4snzm!s)g^*%n#LlS_jmybHbDt85oYvNmxUP{+HdJoN7$|WxIY?R{nuY~?0xl3fZCSx&DJIUGa>+q% z{0tU(8M&lkG&2dJoflobT;nXpu9tLC|H|F^q_zOj(x5>-MWf>z^Sy)Pmv>aJO zC>WAy!wMx!DS4~*T{?^OPF9dpu)!uTC6{H4c9he*#BeXE;m%tO-o=@=tYESPlO#Iy zTeYW8C)W`+?MzJbQ3Fynz#|AVLJ}Lf^;l})nfpvT3p)$gX@l9cFHP-UL%aTE4j&iD z6@;ES<81sum5p2(F4Eu_5dxx2WAGw-($+%I{RI69&G`l>Bva3<^-m#mS=zvmA&Oy% zy%G*ZhJl{WTx$zNOCV}O>t335ZU6p#DxyUJ?2L@^F>^!7fC?iqxx^Gx!G&N5=pQ0Yqx&h9=4~efwz75!6F+d zS2c{zKZte=bu|jRYAo<`)JdxfAPWF#Oo-L%`nlP=)vsXtts98n{@pMeEf7H?*PS~V zTpFgB-YE{a)SGK!fo3^0dy_i#ln0&w&dt7=Osk+ld1kJ1=1aNX}o^9nA@ zad|i4xjKKJ0Ta>KDmN>arHtkyP7v2rDNi)92ppg~ZC!z75iGkyweR+A&Y#}?kG=E% zZQRBZ_`f17a6esb^Sj6a7Tdve+8vyDgaqL?=wJhRLfaKmf*EIPZrB8Z>RHjsW!l zXr0JR$s#Qu(}hWkbm_V*o2S`BW7UQNh5!(V5;oD;Vh~%*Vh}JYb(TIDXM@SV2N7BB z2vjCkiA!e!kBs$ftr602NY~p%m-Wk#J_t=AJipG_mVGGxdWhCo*0cf|t6;3DO=zfd z->&b-Q4fw5ZZa}i`TSwxHv^fk+oc%fA6^D1h#~fZPjG?}(dQ55cNIGrW7mt_bOA+z z8FZb+r2-^ya0_prk;fi9W<|bOSTieZX1047L4arYBHLh?otLIDgbAF)6iDJmFh%-Y zIzGCF*Yi?Zy)NvwheS9p+iZjL(k;!N7mIbAD1nI762?jJtB@o8Mqa{s*|>7#LeA7< zWz{-KY_ZDo#V(%9S!~*K4@FP7Yz>H9ZwV0--?Pw?!0nVR+Kv$QhbWO{byscg?TSO< z?7hr5G&v^)+C#%FL(nP#0AqxPdUI_$j@0y^Ce0of-ez^C>eJ`lMV0(KIW3t7qbF3b zhRLirarjV!u%K~ZRH8OjM}T?&lrOaP3puv_xO1(aE_-ukBt7r=cb733O+BUDL!}d& zKtwGkR#6=O{EPp!qv>-UHC5rvi|x-1 z{(gg}I3$eT%Zvj;b6%i^!OUEPX(O0c7~()ry-mdtns8_y2;sA2k;@9Q?U};!Vb7X* zhGONM9D7W#rGQiIdckO_LsxWKG#fDq$K=rs{`O(Aed**pn7PeXMP6;s5W!0I#dtsAGra`bQv+iF5-6le z6ec9}Oj?_cBQ@u#$ycsh?ZPf?RXqA9T&}Bpw%beE9kk{|#%rfJvW~xYyYo}T6{`z!B2AIO`H)Ora8l0@2VmFLvz+5A{zULANM1mKM zj$2~H?F!t|tgMRl(*0Fdu90V%t!91$SlyA^onT;=-3Nce3;H&wbqL&W4VYF8O9CXO?!WNxN#lv&*P=|}VIWgiFHu}0 zZexMnIS&jN#9j@t-=&>zR}HSmY+KehLG6Ut4X+g^m>_D9k@W>QBW`~< zZh18fYWbDnGp`f3IcXwJ6i-|aW7oC8>uDomgCOR;wmNWI_swk`xdz9lQN7Q{{^YVgU1-VNV+EeK) zerjNhxP{F50KvN+j@xLY@^z?uT9+D}%2!!xyGEgg?M5Xhnh4jO2~@%H%|<9+6-u8V z)s2ta@#T^UIJo$4257i)drUPpP(X|clR!ZcZ2yf@`nTou>E!w=ar#XM(s1P(OUNck zn8D1VSOI@=^vLP|2TrR(YC9a4b#dQ}!*1dC+!+iLrh!t}^{b)5F+@i0UZ1=Dr(tLD zmcqX+lL3nD2~~`7f`IELAvjmTq5nrhza^o=&fhJC|51bn%-u9mnmX59avCG7$1(H| zAk;an7kc0>=j*W5B~rsVVJHzXXArs;MKU;)&geuB2hP?)zi{Z58Ga$kIDZWa(N%NUzJS+5DQGU^P#Z>!W>f5P%?2g2dxG!MDYyj%ri8&GiYlUh~;L@8I~H5vwu!BqWxSBZRSJ2nPCM zZJLhwoX2OaY*8PLlvTdm&J3_S^5jwaYcUC_evbxGfWlZA;^XAdU{m>6p^=OpWGvT< z%5`ZG&c;)Y!RRon5QhYtI&Y6LT6fIt9zTtYmF3A5C7hp;FKpvDz695NS3 zwMU6zgODZ$3uIz}1H*XsY=e=qK9ntU?L5=;_HfDS*-cC6D#M;|)M$4u|8;tpZMCm)WC&dM9Bs3=Cr_-hFP zcU=&^8E(92T#LsHRRbz>&MKuKs7fz-w*Je=3DHX{^$pr~xIthQXXK(E7Z0`ZM^3zudy#xdE;=f2ER!LTAOtuk ziAGukE}ypPGjh?3i*#x0sG))5g-bpl7hRP%mNkUok~0dq)G+3O$AH`P8M!#i#WFYR zg)OHKkN=weUgp_KR{C!D=Hmn(UD>V#rH?d?CDjB$W@M5Gs<9z~@AO;r8+kd)OFm!N zY2%5OtF-nN#0gkh@?6PDuoQbpAQ1*iK`~Se0vR3z<5;s1lirv-U8T3{JJ(<3Q>Q(z zM#qpMj0mC=8&l)P{zQP-ghJI(!@!^oq(@_gMUX@ZLxD9w#wPggz+SC30y_w>yYNrX zP0yi#lyHhCfGc1LLX7dQTf0JQ_y)jUphx2+f`S$kz^OHs8y4)%^=h>d*#5xoPUmwx zMZpNZ0&iVnG-hHc5@8_)L=)Fe!I4CdH5)PMjY&NisC80@;$%}8%*s>7fq6MCPh;4D zR1yO?Rs~YFBJh`(o1#`F=xA-ji}F@0IZM7HiKB zM>5frTH(3~NE*1P(5C5#PbfZVmP|Lmn;N2f$M-?nVfg5-xAC%q#6nn|h}ap>ATWAt ziy|Wp;WVVv4fNwYi>LT34nFZvICNIr;2{x8Vd+d0Y&i>$3v;Z?NJJyN2&q3)*4Wr@IP+Gu7=0unI#$d6LKk8ydd1|5$?&fnWseLuE7HnB~MTl-r`d z13CSy zWA}-%!^A@nakAcq5sHE90bn@?u@N{hmQJfKBN2f_td*VkxL7aulu!U60~pbXK(SOX ziGeokG%$^_2BGE(+4fLr6D!wYniIeUQvJ6NgtWwnTNrNZDqWNZeTkuf0w7E#h+`oP zXBMcAC=1O(h5+m$X&PiHLo5dgAcRX42OBlLbRWq&M^+}QbYrK+Zv5fX`@Hy?X7fg` zQixy-5P&G2K*$A<)JSDz2V5;nL?l=XecIPhyWJ+TXGjuE>a*tx!b(VGlX z93wt)LObI`#T=L}1N^X@!9cq}rpAjU=A3zn40SUnN^s!*_MR;;B6bF`<;KWts`cz) zT`bCTMe@XfSZanW34OEBqS1)P88pgtUQTzW?Oay&UOrB0*9lHL*MB|& zmq^uk6TysYY)cJ59J(2)ukjMp1|wxXC@W-Ul60}~BS7b>V_Sy7h&m;~o}2_*rL+ND zCXjL&d`ZB#`gjc;WmT+owJxlgENwBj6XUd)ZP@o4*1dTqq=3Qb=_6rdHCtPZ4L1s6 zE)vPYXll`Uq^So@ez(ik(g+~OCmxKFu9}-m(HcO6k%SPim;}yDExL?EoFgJns(V@3 zX<06o&IFz6d^sx%J)7r~)mL4@Iu2RquJH5OucPK7>Gm9P87l-dMMPs5i{P+|PdMc93&-S(%}ic=_~Ed` z`cFUo_2%v59+Q7g^pYnNq3J_YqkkNf^XcpSIYxExy|w-Y?C$4$cN+Kjo;6qUCHL{Z zDEp|)SGBjMy8Zbk(zfsqy>|0kq#jqYEF7q;)zk^2=JIw2Z1d8~IPmmH$4g>QbUSITUdkIok3fs`6;FeR8AiWBXlQ zz`1$tz=iffw{`~2;pFjR|^V_@kpKm|>_~G5# z+xOqKB|7-K*SxR`*IFjpZlF47L7Q#TBG0^1(MA@jR153%E%NpJu9o9{w(-sGnlq1d zGM`q9@?A3jE>i0%%Iy75pFh3(A(e}dbpw`>$zA>|uOhixEgl;=qWe3WMY^!A@v?a| zcln~q`Ol?q75{xbn#)Bwjc)G_1e@fUE6EG7lGUA)#8ECyv@Tsu&3u2e_de0RduXEV zqYxE&UX^tlWKQ}#OVYV_w^~}_yB$nkHjhqbTr&5RYbM}+)W(1a^E>cGWW?>R4XfY>Q0+K%wFEZ5ef zUQZ=Xgck@;|I|A4`UmEh_dk62^_RoHzq_}s2Fbg>J3B@kZG7-w3xvCEldX-@sP)Al zTo1o*BJ`qM*Wh>34|Aw0>S}oG@&KhU4)h0-t35W?~w+Oz0 z@f(Du7~%hZX)c%5FS+sF#8FNRZe2DE-w-mTvCDaOvEZBs2l{z%{C=5C*oLqPohS2w zJ-8E>?_TJ)wOq;jy53sIMZE^YglV7@cAkr&Cw4cr`e<#<^U_CyErEVVAMMqAH1O}| zqcNhGl2T)ir0Zx(Fg8#ahB?(*5~yPXZ5%@eRm`+f#C0RFjuuFjW?ep7@Z8Yml6}aM zyjX6nUXzx3k(bWGjy9=$c6go*?`*RC3e2Hm*mdDmK6T03ksi-BV3Ob+0W zeLl|M$)Z&7l~G#lOM6R< zR)AqHHQZB;ErrR~K}~7p8aC$j`T2(>DFQRstboEQt8vY_<`npfVn?-;Wa6UfM}b2D zlH~Vv_5~D1R|>pRMiR~7uHii`Tm5F`jp0S?N^J%gT3eZ>0wR@p*Ojikx|kJk){U*! z2q0N}wYRdBV2(NOi-ytD(-=(|M)ovqgBGE{Ea6c1e8Uyyy>_Y^Ud@X}sVbd_c~-9t zaAwDUA&2qVvSt8$OzeQvsJx7(U7Uv6%nTxKYJx3o1mz_tI2fEGBRaq68wc(CAlI`a zD-!Yf5jVzeuvO97d1^q>oxT5j2RY|%Ou2ZN`QF}gj`WEh^3ZbbY*o&kt;)G~cb0SB z%5VFNxwD0sJ6jiX@3x6Ke_dJu1Q`40elsz50C{paF$Zu%iKjdOLP<3REtkYvNKY&3 z5dw6@C;?jB$R2u+8fWt?JBjE)%IXn@f1A(N$=6#L^Z@nXqT`$gby_qIf(XzYWEAI7 z6c5CMjaqcnqTi(!jkzQqPZ->hAW}NyRQb%8N>JZTeBw&Ui6mTx)b|oUgkQA|+{iUC zv`WfRi;h}!)S{yn9kuA99itWXPC3XEslQ@y#C=o}AI7-A(B90Pq(T-6fjuLT{h@(XO;UuDWH;H)pS3-}I*=2d` zT?TAViFg8&*!^?pGzC1QRP1eFCl^JSgd$`_0b#?(U?4H?m<{J?$VKm;CKrP+i8xGU zQcxDiNG4(I$_Sq5#Pu`=Z!_-mSi-+)2sbZ`T;i&Tq2tjH64omhx4c-liNv3E4ycM+ z?UOFQrqb%eHfPAODnSkzVThPqRgae4W?SE!m!if!-7Y?~TFs~nyrKl%Sf>}4wR8I6 zH|R<+v$fXX4|exF{@UuG=eIJlTF#Ln#0dJ!AX8L}j)sC@m`#KXW}fFK>R<=1+5C zyi(HSRc?NI)pWrs$#go^pp2KK2|3|$TzlfxVIn- zyay3#W;?-$&!n>^8TJxuy?1Cgu{L07+9{I`4Z=H%HR?b2;9JAO`-!z*-`nN`gL#`$ zr;%7FWK7quPh@#BtIeLFY$M_EimKYUW`7~ITQiollL%O%JryJ}mfF30Ceh6Hn%ANMJXF;qQlp}X)#Co+@Wj>$k62br0 zx{vTe^bIVxA6r`ikY>vK6l?TWsL3DsANiZaxhdw3Fdm%$pQo5AvQ5YcO)4>;qLBfp zj6VGOq4Bje874KHEtaZkTYrT9r^@)lmSzvo8g-Gs#Si*LalF=V5H9i(8^2Osg6SfS zze=Q28YCqv#NFy&{)T5D7On~a}yuNUJc;rv8iO-$(uank&ZT{swZ)TF` z&ibp;{@xXFyH!nJqnb;CZRs-kiUAarWouH}8Ia|M|~PZ+?H}d=(i? zp97P|>o>o?zKfk?z%jDTAhNIz_`MI}?Us*&8x~%#y*Vp}h44{wo`dA{54Yh9l3BZ524^qmPzHml$>Qe0$q8 zH~SUz`-iL3n~%TEe|=f?6|`MV4-RD?!5DhDw*t3S-cf-Q_t=fjJs%ag3p$$YD!}nV zjslzn&ncfo_Z8qP&G+vETtile5xCkDN8oxe;PQVY;L@(=hH)YZcilLla4d=dsgjVv zh)2L+BErRw09nGxf`S!7O@Vmx27bq8XXD&`nv zS?Xk-8-GoMPZol<+7DLFZbBAKN!>OHO~mO+GwLhEKC6?pQ^9?76x^@p&U=_s8V6)c zWTmdO32(K`VA0XpJw`RAR1fyoBNcK&-6?tqt%_ zI+yTErc1M7gY~*uA0dc;tOx@=JIZW>ThWbrJ0#o&P0`||9q zxQ3ZZ1EyL>=LcP$F0T7&;+z-o^;&Hf8Y-$f&6+acD1d8IH$Y2?t!zflR$@#r=D;lt zIiPHSna~p4`bpcir`~8+V2ycaGfoSloHbQ~R{Jlj=m!fJPF7;*{@_fVd)1H1R?e z@F)rWKu3WLgb%-K=7ovou}TukXq<4#9*#S=8TyvEKLA2^+=A}qAJaLJ_ZP=g*aKrkr$#xOZ za(i(*JiO6McjS)b`n>_@>-!l#*@Qm=fNp+G`vG*DL9+$WZ9v-sXcY7#?Gpsh!J!-g z(B47V4xqNmeE>9=cx2~wA`O5B&wU2}pYZ+dp6ou3W_O6WNB(S29QpI1?4IjS?bGH@ zqCyeLL5Sy?dgE{fdf-!9PyIHo~P+7~WnKPM81{v~D72S07)?kWt-y)*SirE}D z|24mUw0tvZY6L982&<~HQBF%_*_a`_l>+NmHjzoQBS#B)iK{rw!gySs?@aX+m-FDF zacs`S`K2gVjkMK~xq6!&Grn24w8bssWMNNfnZbBfw>Ze*i=3%k&AT+=}W)hsK_ z2Dt*0FU-oKG1i(xQR{K@j(TXFr`wB`SBz)#IZ$i3@7zr3lTg~s;T zu2N`wns&P-gYH1OOxoch-Ei4>FjbgyabICvn=zedbvn!R_3iNi4b4{OP8i5PKmD*| z1GZ*pn{?s!2IF%mMJDHV`)HV04Zoo{xnnrly@Lbp5Qo;%UT;A48tu_tX^%Z2+Uv)) zLHO9k;OE`d-giLU3ht1%sRPuZmB=G*wI`0a^Ab#~IB${#d3G0xtSY+9JFzx{iK%@gnm9Gg zSQnQ~hpefs!Zbf7M!mHcPUjaFXzDvCO3;CYmv=-7pAotXO8B_@?v5xyNdK9KLWu!` z&7CuItPudaZ>X6^_f5=!U(@g&4B!rh*R>2#)hbJ4%!23zlc;y*x2Nqp-w#yQ&GK>V zx;{;mPr0i?a`%*rn;qFqxd`X*BM1H)PP}otKfrV!{z%ikr#;R>ABNFWei%oT__$

    c^XS40L zm6<3jtBsd0T%H|oiK;ho^Cg}Sy89Q9{Z<=4`{mP5M^-1F!u5+pbmj=2h9}rye-qe` z86K7*{yU4p>4)DA7FQn*C0iQf>X&}IPkhskaZB#D`1{U~(C>&k)a<`oxKVG<2FwS& zz1%I_Xejh%7xsvvd$LDx2=l{(Eh`++V?>WbpvMp8*kK7gcRrC3ixm-!3!j93M0lY5 zI1ov~BbNpNd{E;EZh~e>#0ZPIP@X4a8M#~0V_ZQvt{@yqXIw!zt{{Bm6@(ZEMDD>> z?k0$pQYKzN5)Su@0Bpsa(@1IVyF@4v z`bq5j_$$#-Uux4Pe@&fL9Yif3yB(L>2nOfX>1(H$W0p;QUF+OrYb?7-Zit%R?pB5g zWUrrq!QU1Tq470}qe4&F#bX!MYWOoxFe5JGOxV1=OW*uEO z`$w3w>Lw#+6ExE1we0Y$fwCrFr3rAEY1xE>F9xG)^u+m$jlP0Ie*tb_8I=jZ?mSdx zn}&HAoAR5A#dMY}!q}a!c4LRew}XzDk;=Y%D%I*+nHW;DL~1E0q%Cu?6w2%(g$crs^>hZepp686 zSt!7y6wZLjtBF32;h3Y+Qky7{CZxD)-C_k=6Z+yHN7?iXi~I-HwYP{mX@JS%kF8{& zh2HhG^F`~~vB=Oy)(+*7)AhI1^}Nih^_DelO;v^iUu0e6^ICOP8-!~jUb-b?u^Eo# z#d)IHDGaF6?p{@6{4#di3{z|)Y)w*$d0b&JK%294rZbc4(cX^FE4-1IWnysymx78i(?nc_ zH}LWtGTHl3aMAa+mTwbwaf7R~Z5vz#j{>`!6G*>laoc&FX|X?@#J7Xp!JZAkZZD{B zhh1CcKCnwBf%k}^-Vc^hY-HV$br0cd{h^YF5jTmHB7x+I;8X{0#9*T1f+oIVk*`Cg zVSt68uFE3a^G`;cX*UWI?nbWQTUmEZ9yTTq86<)Xz>GXsq2bY}K)>2gg0U~O1Go0W9i?Wv9FbS-m2 zYgcv9B)M!t>$kKb*0k2i)=+wx{w3_LjO(VqB}-%5q3p&$P?|TX9}GkqSi_m{8%KWA?9l4o9+;1}<&3gVvC^ zJ+^y>Pd5y&&Bi;nr;TNGsk>bf)|47sl`&c(pMWKD^V{1`oZH;<9dY(&n)rrp_o1E* zfMPFP?%;MeRqg|dbP@*l;Y8+6LU-RKr_g*F-5nGeAD5gqCyt=_(4e^ffIe+dWN^=z zhQacKFd}iFT`jrC6IV)}aP1LSM>Li(*DB$P`>xAfp9fO-JdSuA_kiMMJ#kC`6Vl-i@o|ksN zb11vG=)Bi3l47RS6VI~R@z6)$q0`-Yh&&Dt(Ot5q`h2?wcM*o@^^?;#<)Qwb_3{u- z?)&f%RJjiivB_hlJbloV`y&jEFtj%e{bpT6wXjL#jAa zk}@r17;B}7aAO`MFx)g$j3lHl-PV|0f6T5wX4iiN?i;h~@5+Z`cKv^Jc6}DCXWZR! zy~}`6d_>I=HE$o(`>l6be?Xr$YDS81B8d`kn-WHukV?4(v#=;B6{VboAt!+(o(j3t z9-%zqL7;q|kjU*#^;T53BzZHdLvWF5T?&Ldz(-`p&ndj&SC#V@e0q(Kt!0%#PJExY z7am!{G3zWa%ZUM~k3~^W-hNSOi5XG4f4#^uo56lj+pI|Qy74|@M4VabV)DZ;yscez^ zJ%5xgG5pU)=n{hk)-TZ|#C6(qbP4JgrSWg)L{wv?8Y^8JE6vVy$XVgNR9r=Hv;koa z!zH4T`5?X0hAJsJ_YgS+8w4<>g>GU1iQ80jq<2+KhpOpNH65y^L)CPsKeU>w=}?WV zYGgG*WHm2;A>pHSo*RR!=an@L1)(7*OQ{UXDd5a`8-Q_5fjDmfucQ@>I2oHbr21R^ zg{r^M;Z9Tig{r?$f3x=`a8Je>x+>gPxbL0R3!A-X1^3kQWMnC#XVF+DR8%5L=5cZZ z=f1JvoMw@lKq$j?h{iEvf+V1Ew&Rcx?Ze*lr^{4RFHHj5j1xuKpybzGYFvnSnJb6M zr(LxhvpEa*(+smpthF`1CTV_k47z>pU#eM~@LZ6#s2{XN4PxIUl*dl>q>x1$@by4Q zr!O`o_KkWCeLG|3!+M@4^r_po3y&nQ*EQ_IQqzl=?t&~enL=ItB2cS2Y`L+5+RdAG zX9a4yky0>2acQ*o!Q)0}rNFI|+F%p|7Pumb{7!I{J^rF-@JkVcAUOGSNKNU_UAx)- z&)nu6TgYtNr*$VYnUkYW@$#(5*=Cy2i}|-Yc;+0aO*BkyPbiA#=^VcZ7~Q|6qw)K@ zzv1n5jp^j;o)vDx0h4IQ^6BFwbp!2QkP8s$xVSu$AvWoNp4^ZIInN&Ig~ab78`12m n*_vXvm!cU#w(GJrfyg$+(QNtjxY%7iF5VX(y00)bP?`k*QJmuj literal 0 HcmV?d00001