From 64d6d95e08a5966c8fe19eb7aad2b84cd75d34b6 Mon Sep 17 00:00:00 2001
From: "deepin-community-bot[bot]"
 <156989552+deepin-community-bot[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 09:23:02 +0000
Subject: [PATCH] feat: update sudo to 1.9.16p2-3+deb13u2

---
 debian/changelog                              |  21 +++--
 ...roup-as-well-as-uid-when-running-th.patch} |  63 ++++++-------
 ...not-perform-path-expansion-on-files-.patch |  34 +++++++
 debian/patches/amd64-ibt.diff                 |  28 ++++++
 debian/patches/developer-mode-verify.patch    |  87 ------------------
 debian/patches/series                         |   5 +-
 debian/tests/01-getroot                       |   4 +-
 debian/tests/02-1003969-audit-no-resolve      |  26 ++++--
 debian/tests/03-1126085-sudoersd              |  32 +++++++
 .../03/10_dsa::util::sudo[dfsg-team-role]     |   1 +
 debian/tests/03/root                          |   1 +
 .../10_dsa::util::sudo[dfsg-team-role]        |   1 +
 debian/tests/03/sudoersd/root                 |   1 +
 debian/tests/04-getroot-sssd                  |  51 ++++++++--
 debian/tests/04/ldif/ldap.conf                |   2 +-
 debian/tests/04/ldif/slapd.conf               |  22 +++++
 debian/tests/04/ldif/sss-ous.ldif             |   7 ++
 debian/tests/04/ldif/sssd.conf                |   2 +-
 debian/tests/04/ldif/tls.ldif                 |  26 +++++-
 debian/tests/control                          |   9 +-
 plugins/sudoers/po/zh_CN.mo                   | Bin 65160 -> 64973 bytes
 21 files changed, 263 insertions(+), 160 deletions(-)
 rename debian/patches/{cve_2026_35535.patch => 0006-exec_mailer-Set-group-as-well-as-uid-when-running-th.patch} (67%)
 create mode 100644 debian/patches/0008-open_sudoers-Do-not-perform-path-expansion-on-files-.patch
 create mode 100644 debian/patches/amd64-ibt.diff
 delete mode 100644 debian/patches/developer-mode-verify.patch
 create mode 100755 debian/tests/03-1126085-sudoersd
 create mode 100644 debian/tests/03/10_dsa::util::sudo[dfsg-team-role]
 create mode 100644 debian/tests/03/root
 create mode 100644 debian/tests/03/sudoersd/10_dsa::util::sudo[dfsg-team-role]
 create mode 100644 debian/tests/03/sudoersd/root
 create mode 100644 debian/tests/04/ldif/slapd.conf

diff --git a/debian/changelog b/debian/changelog
index 43c8bc9..c92976b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,16 +1,21 @@
-sudo (1.9.16p2-3deepin2) unstable; urgency=medium
+sudo (1.9.16p2-3+deb13u2) trixie; urgency=medium
 
-  * Fix CVE-2026-35535: exec_mailer: Set group as well as uid when
-    running the mailer.
+  * cherry-pick upstream exec_mailer-Set-group-as-well-as-uid.
+    This is upstream and fixes CVE-2026-35535:
+    https://github.com/sudo-project/sudo/commit/3e474c2 (Closes: #1130593)
 
- -- deepin-ci-robot <packages@deepin.org>  Mon, 13 Apr 2026 21:24:10 +0800
+ -- Marc Haber <mh+debian-packages@zugschlus.de>  Sat, 11 Apr 2026 14:21:02 +0200
 
-sudo (1.9.16p2-3deepin1) unstable; urgency=medium
+sudo (1.9.16p2-3+deb13u1) trixie; urgency=medium
 
-  [ zhouzilong ]
-  * add develper mode verify message.
+  [ Marc Haber ]
+  * add upstream patch: Do not perform path expansion
+    Thanks to Adam D. Barratt" <adam@adam-barratt.org.uk> (Closes: #1126085)
+  * Enable Intel CET on amd64 only.
+    Thanks to Marcos Del Sol Vives (Closes: #1124339)
+  * Pull more robust test suite from unstable
 
- -- Tianyu Chen <sweetyfish@deepin.org>  Mon, 30 Jun 2025 23:01:07 +0800
+ -- Marc Haber <mh+debian-packages@zugschlus.de>  Wed, 11 Feb 2026 20:22:01 +0100
 
 sudo (1.9.16p2-3) unstable; urgency=high
 
diff --git a/debian/patches/cve_2026_35535.patch b/debian/patches/0006-exec_mailer-Set-group-as-well-as-uid-when-running-th.patch
similarity index 67%
rename from debian/patches/cve_2026_35535.patch
rename to debian/patches/0006-exec_mailer-Set-group-as-well-as-uid-when-running-th.patch
index 565d20b..7022a44 100644
--- a/debian/patches/cve_2026_35535.patch
+++ b/debian/patches/0006-exec_mailer-Set-group-as-well-as-uid-when-running-th.patch
@@ -1,10 +1,10 @@
-Description: exec_mailer: Set group as well as uid when running the mailer.
- Also make a setuid(), setgid() or setgroups() failure fatal.
-Author: Todd C. Miller <Todd.Miller@sudo.ws>
-Origin: upstream
-Bug: https://security-tracker.debian.org/tracker/CVE-2026-35535
-Forwarded: not-needed
-Last-Update: 2026-04-13
+From: "Todd C. Miller" <Todd.Miller@sudo.ws>
+Date: Sat, 8 Nov 2025 15:34:02 -0700
+Subject: exec_mailer: Set group as well as uid when running the mailer
+
+Also make a setuid(), setgid() or setgroups() failure fatal.
+
+Found by the ZeroPath AI Security Engineer <https://zeropath.com>
 ---
  include/sudo_eventlog.h      |  3 ++-
  lib/eventlog/eventlog.c      | 21 +++++++++++++++++----
@@ -12,10 +12,11 @@ Last-Update: 2026-04-13
  plugins/sudoers/logging.c    |  2 +-
  plugins/sudoers/policy.c     |  2 +-
  5 files changed, 24 insertions(+), 8 deletions(-)
-Index: github-sudo-CVE-2026-35535/include/sudo_eventlog.h
-===================================================================
---- github-sudo-CVE-2026-35535.orig/include/sudo_eventlog.h
-+++ github-sudo-CVE-2026-35535/include/sudo_eventlog.h
+
+diff --git a/include/sudo_eventlog.h b/include/sudo_eventlog.h
+index eb9f4f4..485d259 100644
+--- a/include/sudo_eventlog.h
++++ b/include/sudo_eventlog.h
 @@ -80,6 +80,7 @@ struct eventlog_config {
      int syslog_rejectpri;
      int syslog_alertpri;
@@ -24,7 +25,7 @@ Index: github-sudo-CVE-2026-35535/include/sudo_eventlog.h
      bool omit_hostname;
      const char *logpath;
      const char *time_fmt;
-@@ -151,7 +152,7 @@ void eventlog_set_syslog_rejectpri(int p
+@@ -151,7 +152,7 @@ void eventlog_set_syslog_rejectpri(int pri);
  void eventlog_set_syslog_alertpri(int pri);
  void eventlog_set_syslog_maxlen(size_t len);
  void eventlog_set_file_maxlen(size_t len);
@@ -33,10 +34,10 @@ Index: github-sudo-CVE-2026-35535/include/sudo_eventlog.h
  void eventlog_set_omit_hostname(bool omit_hostname);
  void eventlog_set_logpath(const char *path);
  void eventlog_set_time_fmt(const char *fmt);
-Index: github-sudo-CVE-2026-35535/lib/eventlog/eventlog.c
-===================================================================
---- github-sudo-CVE-2026-35535.orig/lib/eventlog/eventlog.c
-+++ github-sudo-CVE-2026-35535/lib/eventlog/eventlog.c
+diff --git a/lib/eventlog/eventlog.c b/lib/eventlog/eventlog.c
+index 5a32824..d56c4e4 100644
+--- a/lib/eventlog/eventlog.c
++++ b/lib/eventlog/eventlog.c
 @@ -304,15 +304,13 @@ exec_mailer(int pipein)
  	syslog(LOG_ERR, _("unable to dup stdin: %m")); // -V618
  	sudo_debug_printf(SUDO_DEBUG_ERROR,
@@ -89,11 +90,11 @@ Index: github-sudo-CVE-2026-35535/lib/eventlog/eventlog.c
  }
  
  /* Send a message to the mailto user */
-Index: github-sudo-CVE-2026-35535/lib/eventlog/eventlog_conf.c
-===================================================================
---- github-sudo-CVE-2026-35535.orig/lib/eventlog/eventlog_conf.c
-+++ github-sudo-CVE-2026-35535/lib/eventlog/eventlog_conf.c
-@@ -70,6 +70,7 @@ static struct eventlog_config evl_conf =
+diff --git a/lib/eventlog/eventlog_conf.c b/lib/eventlog/eventlog_conf.c
+index 0663a38..ec3b569 100644
+--- a/lib/eventlog/eventlog_conf.c
++++ b/lib/eventlog/eventlog_conf.c
+@@ -70,6 +70,7 @@ static struct eventlog_config evl_conf = {
      MAXSYSLOGLEN,		/* syslog_maxlen */
      0,				/* file_maxlen */
      ROOT_UID,			/* mailuid */
@@ -113,11 +114,11 @@ Index: github-sudo-CVE-2026-35535/lib/eventlog/eventlog_conf.c
  }
  
  void
-Index: github-sudo-CVE-2026-35535/plugins/sudoers/logging.c
-===================================================================
---- github-sudo-CVE-2026-35535.orig/plugins/sudoers/logging.c
-+++ github-sudo-CVE-2026-35535/plugins/sudoers/logging.c
-@@ -1155,7 +1155,7 @@ init_eventlog_config(void)
+diff --git a/plugins/sudoers/logging.c b/plugins/sudoers/logging.c
+index bd4de92..9535289 100644
+--- a/plugins/sudoers/logging.c
++++ b/plugins/sudoers/logging.c
+@@ -1157,7 +1157,7 @@ init_eventlog_config(void)
      eventlog_set_syslog_alertpri(def_syslog_badpri);
      eventlog_set_syslog_maxlen(def_syslog_maxlen);
      eventlog_set_file_maxlen(def_loglinelen);
@@ -126,11 +127,11 @@ Index: github-sudo-CVE-2026-35535/plugins/sudoers/logging.c
      eventlog_set_omit_hostname(!def_log_host);
      eventlog_set_logpath(def_logfile);
      eventlog_set_time_fmt(def_log_year ? "%h %e %T %Y" : "%h %e %T");
-Index: github-sudo-CVE-2026-35535/plugins/sudoers/policy.c
-===================================================================
---- github-sudo-CVE-2026-35535.orig/plugins/sudoers/policy.c
-+++ github-sudo-CVE-2026-35535/plugins/sudoers/policy.c
-@@ -639,7 +639,7 @@ sudoers_policy_deserialize_info(struct s
+diff --git a/plugins/sudoers/policy.c b/plugins/sudoers/policy.c
+index f3adfb0..27f6e58 100644
+--- a/plugins/sudoers/policy.c
++++ b/plugins/sudoers/policy.c
+@@ -639,7 +639,7 @@ sudoers_policy_deserialize_info(struct sudoers_context *ctx, void *v,
      }
  
  #ifdef NO_ROOT_MAILER
diff --git a/debian/patches/0008-open_sudoers-Do-not-perform-path-expansion-on-files-.patch b/debian/patches/0008-open_sudoers-Do-not-perform-path-expansion-on-files-.patch
new file mode 100644
index 0000000..0afe744
--- /dev/null
+++ b/debian/patches/0008-open_sudoers-Do-not-perform-path-expansion-on-files-.patch
@@ -0,0 +1,34 @@
+From: "Todd C. Miller" <Todd.Miller@sudo.ws>
+Date: Sat, 24 Jan 2026 11:30:06 -0700
+Subject: open_sudoers: Do not perform path expansion on files in an
+ includedir
+
+A file in an includedir containing one or more colons (':') in the
+name we was being expanded as a colon-separated path instead of
+being opened as-is.  This fixes a regression introduced in
+sudo 1.9.14.  Bug #1085
+---
+ plugins/sudoers/sudoers.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/plugins/sudoers/sudoers.c b/plugins/sudoers/sudoers.c
+index 0f75c96..fecd279 100644
+--- a/plugins/sudoers/sudoers.c
++++ b/plugins/sudoers/sudoers.c
+@@ -1286,7 +1286,15 @@ open_sudoers(const char *path, char **outfile, bool doedit, bool *keepopen)
+     int error, fd;
+     debug_decl(open_sudoers, SUDOERS_DEBUG_PLUGIN);
+ 
+-    fd = sudo_open_conf_path(path, fname, sizeof(fname), open_file);
++    if (outfile == NULL) {
++	/* Single file, do not treat as a path. */
++	fd = open_file(path, O_RDONLY|O_NONBLOCK);
++        if (fd != -1)
++            (void)fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);
++    } else {
++	/* Could be a colon-separated path of file names. */
++	fd = sudo_open_conf_path(path, fname, sizeof(fname), open_file);
++    }
+     if (sudoers_ctx.parser_conf.ignore_perms) {
+ 	/* Skip sudoers security checks when ignore_perms is set. */
+ 	if (fd == -1 || fstat(fd, &sb) == -1)
diff --git a/debian/patches/amd64-ibt.diff b/debian/patches/amd64-ibt.diff
new file mode 100644
index 0000000..0ad20fd
--- /dev/null
+++ b/debian/patches/amd64-ibt.diff
@@ -0,0 +1,28 @@
+From: Marcos Del Sol Vives <marcos@orca.pet>
+Date: Tue, 2 Sep 2025 00:00:35 +0200
+Subject: Enable Intel CET on amd64 only
+
+---
+ m4/hardening.m4 | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/m4/hardening.m4 b/m4/hardening.m4
+index f7d2a8c..cc7ee01 100644
+--- a/m4/hardening.m4
++++ b/m4/hardening.m4
+@@ -105,6 +105,7 @@ AC_DEFUN([SUDO_CHECK_HARDENING], [
+ 		])
+ 	    fi
+ 
++	    if test "$host_cpu" = "x86_64"; then
+ 	    # Check for control-flow transfer instrumentation (Intel CET).
+ 	    AX_CHECK_COMPILE_FLAG([-fcf-protection], [
+ 		AX_CHECK_LINK_FLAG([-fcf-protection], [
+@@ -112,6 +113,7 @@ AC_DEFUN([SUDO_CHECK_HARDENING], [
+ 		    AX_APPEND_FLAG([-Wc,-fcf-protection], [HARDENING_LDFLAGS])
+ 		])
+ 	    ])
++	    fi
+ 	fi
+ 
+ 	# Linker-specific hardening flags.
diff --git a/debian/patches/developer-mode-verify.patch b/debian/patches/developer-mode-verify.patch
deleted file mode 100644
index 8499d78..0000000
--- a/debian/patches/developer-mode-verify.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 69ef2673766f4ea918a5b8290eb30db5db409a3a Mon Sep 17 00:00:00 2001
-From: zhouzilong <zhouzilong@uniontech.com>
-Date: Wed, 23 Apr 2025 15:45:55 +0800
-Subject: [PATCH] developer mode verify
-
----
- plugins/sudoers/auth/pam.c  |  7 +++++++
- plugins/sudoers/po/zh_CN.po | 11 ++++++-----
- 2 files changed, 13 insertions(+), 5 deletions(-)
-
-diff --git a/plugins/sudoers/auth/pam.c b/plugins/sudoers/auth/pam.c
-index 973d67b..d0cabc8 100644
---- a/plugins/sudoers/auth/pam.c
-+++ b/plugins/sudoers/auth/pam.c
-@@ -298,6 +298,7 @@ sudo_pam_verify(const struct sudoers_context *ctx, struct passwd *pw,
-     const char *prompt, sudo_auth *auth, struct sudo_conv_callback *callback)
- {
-     const char *envccname, *pam_user;
-+    const char *pam_item;
-     int rc, *pam_status = (int *)auth->data;
-     debug_decl(sudo_pam_verify, SUDOERS_DEBUG_AUTH);
- 
-@@ -355,6 +356,12 @@ sudo_pam_verify(const struct sudoers_context *ctx, struct passwd *pw,
- 	sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
- 	    "pam_authenticate: %d", *pam_status);
- 	debug_return_int(AUTH_FAILURE);
-+	case PAM_ABORT:
-+	    rc = pam_get_item(pamh, PAM_SERVICE, &pam_item);
-+	    if((rc == PAM_SUCCESS)&&(!strcmp(pam_item, "security-verify"))){
-+		log_warningx(ctx, 0, N_("No root privileges. Please request root access in developer mode in Control Center."));
-+		debug_return_int(AUTH_ERROR);
-+	    }
-     default:
- 	log_warningx(ctx, 0, N_("PAM authentication error: %s"),
- 	    sudo_pam_strerror(pamh, *pam_status));
-diff --git a/plugins/sudoers/po/zh_CN.po b/plugins/sudoers/po/zh_CN.po
-index 00b5214..1194283 100644
---- a/plugins/sudoers/po/zh_CN.po
-+++ b/plugins/sudoers/po/zh_CN.po
-@@ -8,7 +8,7 @@ msgstr ""
- "Project-Id-Version: sudoers 1.9.16b1\n"
- "Report-Msgid-Bugs-To: https://bugzilla.sudo.ws\n"
- "POT-Creation-Date: 2024-06-08 09:06-0600\n"
--"PO-Revision-Date: 2024-06-17 14:52-0400\n"
-+"PO-Revision-Date: 2025-04-23 15:36+0800\n"
- "Last-Translator: Boyuan Yang <073plan@gmail.com>\n"
- "Language-Team: Chinese (simplified) <i18n-zh@googlegroups.com>\n"
- "Language: zh_CN\n"
-@@ -17,7 +17,7 @@ msgstr ""
- "Content-Transfer-Encoding: 8bit\n"
- "Plural-Forms: nplurals=1; plural=0;\n"
- "X-Bugs: Report translation errors to the Language-Team address.\n"
--"X-Generator: Poedit 3.4.4\n"
-+"X-Generator: Poedit 2.2.1\n"
- 
- #: confstr.sh:1 gram.y:1240 plugins/sudoers/logging.c:919
- msgid "syntax error"
-@@ -1530,6 +1530,10 @@ msgstr "无法初始化 PAM：%s"
- msgid "PAM authentication error: %s"
- msgstr "PAM 认证出错：%s"
- 
-+#: plugins/sudoers/auth/pam.c:362
-+msgid "No root privileges. Please request root access in developer mode in Control Center."
-+msgstr "无root权限，如想获得root权限可以在控制中心选择进入开发者模式"
-+
- #: plugins/sudoers/auth/pam.c:369
- msgid "account validation failure, is your account locked?"
- msgstr "账户验证失败，您的账户是不是上锁了？"
-@@ -3891,15 +3895,12 @@ msgstr "将忽略包含“.”字符的文件名"
- msgid "too many levels of includes"
- msgstr "include 嵌套层数过多"
- 
--#, c-format
- #~ msgid "%s must be owned by uid %d"
- #~ msgstr "%s 必须属于用户 ID %d"
- 
--#, c-format
- #~ msgid "%s must only be writable by owner"
- #~ msgstr "%s 必须只对所有者可写"
- 
--#, c-format
- #~ msgid "timestamp owner (%s): No such user"
- #~ msgstr "时间戳所有者(%s)：无此用户"
- 
--- 
-2.20.1
-
diff --git a/debian/patches/series b/debian/patches/series
index f9a9455..21e0e90 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -5,5 +5,6 @@ sudo-ldap-docs.patch
 X11R6.patch
 0007-upstream-patch-for-CVE-2025-32463.patch
 0008-upstream-patch-for-CVE-2025-32462.patch
-developer-mode-verify.patch
-cve_2026_35535.patch
+0008-open_sudoers-Do-not-perform-path-expansion-on-files-.patch
+amd64-ibt.diff
+0006-exec_mailer-Set-group-as-well-as-uid-when-running-th.patch
diff --git a/debian/tests/01-getroot b/debian/tests/01-getroot
index 4edef3e..bae4096 100755
--- a/debian/tests/01-getroot
+++ b/debian/tests/01-getroot
@@ -9,7 +9,7 @@ passwd1=$(echo "$passwd" |cut -c1)
 # Note: we do need the 'xfoo' syntax here, since POSIX special-cases
 # the $passwd value '!' as negation.
 if [ "x$passwd" = "x*" ] || [ "x$passwd1" = "x!" ]; then
-  echo "root:rootpassword"  | chpasswd
+  echo "root:riegh@oh4ahR"  | chpasswd
 fi
 
 TESTNR="01"
@@ -19,7 +19,7 @@ DIR="${BASEDIR}/${TESTNR}"
 PATH="/bin:/usr/bin:/sbin:/usr/sbin"
 ACCTA="test${TESTNR}a"
 ACCTB="test${TESTNR}b"
-PASSWD="test${TESTNR}23456"
+PASSWD="test${TESTNR}Terah9ien7e"
 HOMEDIRA="/home/${ACCTA}"
 HOMEDIRB="/home/${ACCTB}"
 LDIFDIR="${DIR}/ldif"
diff --git a/debian/tests/02-1003969-audit-no-resolve b/debian/tests/02-1003969-audit-no-resolve
index 3fc32aa..11d2aaf 100755
--- a/debian/tests/02-1003969-audit-no-resolve
+++ b/debian/tests/02-1003969-audit-no-resolve
@@ -7,21 +7,29 @@ BASEDIR="$(pwd)/debian/tests"
 COMMONDIR="${BASEDIR}/common"
 DIR="${BASEDIR}/${TESTNR}"
 PATH="/bin:/usr/bin:/sbin:/usr/sbin"
-ACCTA="test${TESTNR}a"
-ACCTB="test${TESTNR}b"
-PASSWD="test${TESTNR}23456"
 HOMEDIRA="/root"
-LDIFDIR="${DIR}/ldif"
 
 trap '
   printf "\ntrap handler\n"
-  mv /etc/resolv.conf.disabled /etc/resolv.conf || true
-  mv /etc/hosts.disabled /etc/hosts || true
+  if [ -e /etc/resolv.conf.disabled ]; then
+    cp /etc/resolv.conf.disabled /etc/resolv.conf || true
+    rm -f /etc/resolv.conf.disabled || true
+  fi
+  if [ -e /etc/hosts.disabled ]; then
+    cp /etc/hosts.disabled /etc/hosts || true
+    rm -f /etc/hosts.disabled || true
+  fi
 ' 0 INT QUIT ABRT PIPE TERM
 
 printf "========= test %s\.1: sudo to nobody\n" "${TESTNR}"
-mv /etc/resolv.conf /etc/resolv.conf.disabled
-mv /etc/hosts /etc/hosts.disabled
+if [ -e /etc/resolv.conf ]; then
+  cp /etc/resolv.conf /etc/resolv.conf.disabled
+  : >/etc/resolv.conf
+fi
+if [ -e /etc/hosts ]; then
+  cp /etc/hosts /etc/hosts.disabled
+  : >/etc/hosts
+fi
 RET=0
 printf "trying sudo to nobody\n"
 cd "${HOMEDIRA}"
@@ -35,7 +43,7 @@ if [ "${STDERRLENGTH}" != "0" ]; then
   printf >&2 "stderr:\n"
   cat >&2 ${HOMEDIRA}/stderr
   printf >&2 "exit code %s\n" "${RET}"
-  printf >&2 "exit 1\n" "${RET}"
+  printf >&2 "exit 1\n"
   exit 1
 fi
 
diff --git a/debian/tests/03-1126085-sudoersd b/debian/tests/03-1126085-sudoersd
new file mode 100755
index 0000000..119157a
--- /dev/null
+++ b/debian/tests/03-1126085-sudoersd
@@ -0,0 +1,32 @@
+#!/bin/sh
+
+set -e
+
+TESTNR="03"
+BASEDIR="$(pwd)/debian/tests"
+COMMONDIR="${BASEDIR}/common"
+DIR="${BASEDIR}/${TESTNR}"
+PATH="/bin:/usr/bin:/sbin:/usr/sbin"
+FILES="$(find $DIR/sudoersd/ -type f)"
+echo $FILES
+DSTFILES="$(echo $FILES | sed "s|${DIR}/sudoersd|/etc/sudoers.d|g")"
+echo $DSTFILES
+
+trap '
+  true
+' 0 INT QUIT ABRT PIPE TERM
+
+printf "copy files to sudoers ... "
+cp $FILES /etc/sudoers.d/
+printf "collect sudo -l output ... "
+OUTPUT="$(sudo -l | grep -- ----marker----)"
+EXPECTED="    (ALL : ALL) /usr/bin/----marker----/this-is-the-sudoersd-10_dsa\:\:util\:\:sudo[dfsg-team-role]-file
+    (ALL : ALL) /usr/bin/----marker----/this-is-the-sudoersd-root-file"
+if [ "$OUTPUT" != "$EXPECTED" ]; then
+    printf "sudo -l output not as expected, Test failed\n"
+    exit 1
+fi
+
+printf "test series sucessful, exit 0\n"
+exit 0
+
diff --git a/debian/tests/03/10_dsa::util::sudo[dfsg-team-role] b/debian/tests/03/10_dsa::util::sudo[dfsg-team-role]
new file mode 100644
index 0000000..0a77cf3
--- /dev/null
+++ b/debian/tests/03/10_dsa::util::sudo[dfsg-team-role]
@@ -0,0 +1 @@
+root    ALL=(ALL:ALL) /usr/bin/----marker----/this-is-the-sudoersd-10_dsa\:\:util\:\:sudo[dfsg-team-role]-file
diff --git a/debian/tests/03/root b/debian/tests/03/root
new file mode 100644
index 0000000..12a03fd
--- /dev/null
+++ b/debian/tests/03/root
@@ -0,0 +1 @@
+root    ALL=(ALL:ALL) /usr/bin/----marker----/this-is-the-sudoersd-root-file
diff --git a/debian/tests/03/sudoersd/10_dsa::util::sudo[dfsg-team-role] b/debian/tests/03/sudoersd/10_dsa::util::sudo[dfsg-team-role]
new file mode 100644
index 0000000..0a77cf3
--- /dev/null
+++ b/debian/tests/03/sudoersd/10_dsa::util::sudo[dfsg-team-role]
@@ -0,0 +1 @@
+root    ALL=(ALL:ALL) /usr/bin/----marker----/this-is-the-sudoersd-10_dsa\:\:util\:\:sudo[dfsg-team-role]-file
diff --git a/debian/tests/03/sudoersd/root b/debian/tests/03/sudoersd/root
new file mode 100644
index 0000000..12a03fd
--- /dev/null
+++ b/debian/tests/03/sudoersd/root
@@ -0,0 +1 @@
+root    ALL=(ALL:ALL) /usr/bin/----marker----/this-is-the-sudoersd-root-file
diff --git a/debian/tests/04-getroot-sssd b/debian/tests/04-getroot-sssd
index bcafaf8..5b08018 100755
--- a/debian/tests/04-getroot-sssd
+++ b/debian/tests/04-getroot-sssd
@@ -17,58 +17,89 @@ HOMEDIRA="/home/${ACCTA}"
 HOMEDIRB="/home/${ACCTB}"
 LDIFDIR="${DIR}/ldif"
 SSSDCONF="/etc/sssd/sssd.conf"
+RUNDIR="/run/slapd"
+VARRUNDIR="/var/run/slapd"
 
 trap '
   kill $(pidof slapd) 2>/dev/null || true
   kill $(pidof sssd) 2>/dev/null || true
+  kill $(pidof socat) 2>/dev/null || true
+  rm -f /dev/log || true
 ' 0 INT QUIT ABRT PIPE TERM
 
 # openssl req -x509 -days 365 -nodes -newkey rsa:4096 -keyout server_key.pem -out server_cert.pem --subj "/C=DE/CN=emptysid86.zugschlus.de"
 
+printf "make and chown dirs ... "
+mkdir -p "${RUNDIR}" "${VARRUNDIR}"
+chown openldap "${VARRUNDIR}"
 < ${LDIFDIR}/debconf debconf-set-selections
+
 printf "clean up ldap database ... "
 rm -rf /var/lib/ldap/*.mdb
+
 printf "move configuration in place ... "
 mkdir -p /etc/ldap /etc/sssd
 cp ${LDIFDIR}/server_*.pem /etc/ldap/
 cp ${LDIFDIR}/ldap.conf /etc/ldap/
 chown openldap:openldap /etc/ldap/server_*.pem
 chmod 600 /etc/ldap/server_key.pem
+# slapd.conf is only needed for OpenLDAP 2.4 on bullseye
+# but since it's already there now, use it for OpenLDAP 2.5+ as well
+# this is a testsuite. If you want /etc/ldap/slapd.d to be used (again),
+# please submit a patch that will also work on bullseye.
+cp ${LDIFDIR}/slapd.conf /etc/ldap/
 cp ${LDIFDIR}/sssd.conf /etc/sssd
 chown root:root /etc/sssd/sssd.conf
 chmod 600 /etc/sssd/sssd.conf
 cp ${LDIFDIR}/slapd-default /etc/default/slapd
 echo "slapd: [::1]" >> /etc/hosts.allow
+
 printf "reconfigure slapd ... "
 DEBIAN_FRONTEND=noninteractive dpkg-reconfigure -pcritical slapd 2>/dev/null
 kill $(pidof slapd) 2>/dev/null || true
 sleep 1
+
+if ! [ -S /dev/log ]; then
+  echo "starting fake syslog socket on /dev/log"
+
+  # remove stale file if present
+  [ -e /dev/log ] && rm -f /dev/log
+
+  socat -u UNIX-RECV:/dev/log,mode=666 STDOUT >/dev/null 2>/dev/null &
+fi
+
 printf "start slapd ... "
-slapd -h "ldaps:/// ldapi:///" -g openldap -u openldap -F /etc/ldap/slapd.d
+slapd -f /etc/ldap/slapd.conf -h "ldaps://:1636/ ldapi:///" -g openldap -u openldap
+
+printf "check slapd running .... "
+pgrep -a slapd
 # ldapsearch -x -LLL -s base -b "" namingContexts should work here
-printf "set LDAP passwords"
-ldapmodify -Y external -H ldapi:/// -f ${LDIFDIR}/tls.ldif 2>/dev/null
-ldapmodify -Y external -H ldapi:/// -f ${LDIFDIR}/adminpw.ldif 2>/dev/null
-ldapmodify -Y external -H ldapi:/// -f ${LDIFDIR}/adminpw-example-com.ldif 2>/dev/null
-printf "add users and groups OUs ..."
-ldapadd -x -D "cn=admin,dc=example,dc=com" -w ldappw -f ${LDIFDIR}/sss-ous.ldif 2>/dev/null
-printf "add users ..."
+
+printf "add users and groups OUs ...\n"
+ldapadd -x -c -D "cn=admin,dc=example,dc=com" -w ldappw -f ${LDIFDIR}/sss-ous.ldif 2>/dev/null || true
 
 printf "sssd.conf ...\n"
 cp ${LDIFDIR}/sssd.conf "${SSSDCONF}"
 
-printf "sudoers file ...\n"A
+printf "sudoers file ...\n"
 mkdir -p /etc/sudoers.d/
-mv ${LDIFDIR}/ldapsudoers /etc/sudoers.d/
+cp ${LDIFDIR}/ldapsudoers /etc/sudoers.d/
 chown root:root "${SSSDCONF}" /etc/sudoers.d/ /etc/sudoers.d/*
 chmod 755 /etc/sudoers.d/
 chmod 600 "${SSSDCONF}" /etc/sudoers.d/*
+
+printf "start sssd ..."
 kill $(pidof sssd) 2>/dev/null || true
 sleep 1
 sssd --logger=files -D
 
+printf "check sssd running .... "
+pgrep -a sssd
+
+printf "add users ..."
 for user in testuser1 testuser2; do
   ldapadd -x -D "cn=admin,dc=example,dc=com" -w ldappw -f ${LDIFDIR}/${user}.ldif 2>/dev/null
+  getent passwd ${user}
   mkdir -p /home/${user}
   chown ${user}:nogroup /home/${user}
 done
diff --git a/debian/tests/04/ldif/ldap.conf b/debian/tests/04/ldif/ldap.conf
index 3f3000a..b3b3022 100644
--- a/debian/tests/04/ldif/ldap.conf
+++ b/debian/tests/04/ldif/ldap.conf
@@ -1,5 +1,5 @@
 BASE    dc=example,dc=com
-URI     ldaps://[::1]:636/
+URI     ldaps://[::1]:1636/
 TLS_CACERT     /etc/ldap/server_cert.pem
 TLS_REQCERT allow
 SASL_NOCANON    on
diff --git a/debian/tests/04/ldif/slapd.conf b/debian/tests/04/ldif/slapd.conf
new file mode 100644
index 0000000..9fe0727
--- /dev/null
+++ b/debian/tests/04/ldif/slapd.conf
@@ -0,0 +1,22 @@
+# OpenLDAP 2.4 (bullseye) only
+modulepath /usr/lib/ldap
+moduleload back_mdb
+include /etc/ldap/schema/core.schema
+include /etc/ldap/schema/cosine.schema
+include /etc/ldap/schema/nis.schema
+include /etc/ldap/schema/inetorgperson.schema
+
+database mdb
+maxsize 1073741824
+directory /var/lib/ldap
+
+# Suffix and root DN must come in this order
+suffix "dc=example,dc=com"
+rootdn "cn=admin,dc=example,dc=com"
+rootpw ldappw
+
+# TLS optional
+TLSCertificateFile /etc/ldap/server_cert.pem
+TLSCertificateKeyFile /etc/ldap/server_key.pem
+TLSCACertificateFile /etc/ldap/server_cert.pem
+
diff --git a/debian/tests/04/ldif/sss-ous.ldif b/debian/tests/04/ldif/sss-ous.ldif
index 5ba018c..144b2fa 100644
--- a/debian/tests/04/ldif/sss-ous.ldif
+++ b/debian/tests/04/ldif/sss-ous.ldif
@@ -1,3 +1,10 @@
+dn: dc=example,dc=com
+objectClass: top
+objectClass: dcObject
+objectClass: organization
+o: Example Organization
+dc: example
+
 dn: ou=users,dc=example,dc=com
 objectClass: top
 objectClass: organizationalUnit
diff --git a/debian/tests/04/ldif/sssd.conf b/debian/tests/04/ldif/sssd.conf
index ee06ef5..b0b4796 100755
--- a/debian/tests/04/ldif/sssd.conf
+++ b/debian/tests/04/ldif/sssd.conf
@@ -7,7 +7,7 @@ debug_level = 0x01ff
 id_provider = ldap
 auth_provider = ldap
 
-ldap_uri = ldaps://[::1]:636/
+ldap_uri = ldaps://[::1]:1636/
 ldap_search_base = dc=example,dc=com
 
 ldap_tls_cacert = /etc/ldap/server_cert.pem
diff --git a/debian/tests/04/ldif/tls.ldif b/debian/tests/04/ldif/tls.ldif
index 012adf2..a84b4c1 100644
--- a/debian/tests/04/ldif/tls.ldif
+++ b/debian/tests/04/ldif/tls.ldif
@@ -1,10 +1,32 @@
+dn: cn=config
+changetype: modify
+delete: olcTLSCACertificateFile
+-
+
+dn: cn=config
+changetype: modify
+delete: olcTLSCertificateFile
+-
+
+dn: cn=config
+changetype: modify
+delete: olcTLSCertificateKeyFile
+-
+
 dn: cn=config
 changetype: modify
 add: olcTLSCACertificateFile
 olcTLSCACertificateFile: /etc/ldap/server_cert.pem
 -
+
+dn: cn=config
+changetype: modify
+add: olcTLSCertificateFile
+olcTLSCertificateFile: /etc/ldap/server_cert.pem
+-
+
+dn: cn=config
+changetype: modify
 add: olcTLSCertificateKeyFile
 olcTLSCertificateKeyFile: /etc/ldap/server_key.pem
 -
-add: olcTLSCertificateFile
-olcTLSCertificateFile: /etc/ldap/server_cert.pem
diff --git a/debian/tests/control b/debian/tests/control
index abea94c..dcb8429 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -1,16 +1,11 @@
 Tests: 01-getroot
-Depends: sudo, adduser
+Depends: adduser, sudo, cracklib-runtime
 Restrictions: needs-root
 
 Tests: 02-1003969-audit-no-resolve
 Depends: sudo
 Restrictions: needs-root
 
-Tests: 03-getroot-ldap
-Depends: sudo-ldap, adduser, slapd, ldap-utils, cron
-Restrictions: needs-root
-
 Tests: 04-getroot-sssd
-Depends: sudo, adduser, slapd, ldap-utils, sssd-common, sssd-ldap, cron
+Depends: adduser, cron, ldap-utils, procps, slapd, sssd-common, sssd-ldap, sudo, socat, libnss-sss, libpam-sss
 Restrictions: needs-root
-
diff --git a/plugins/sudoers/po/zh_CN.mo b/plugins/sudoers/po/zh_CN.mo
index de42b0f6e9fa9a9d12867b0412a0108b18161123..ee28ea377eb7f4e95f891ab5ba196275bd17d381 100644
GIT binary patch
delta 14032
zcmZwMcYKdm|Httw391N@K_roUBe4=ehJ+ZAs$HAfDt2otZOw}sHETp$Rf<w-uTooW
zs;yn6c2T2hx1|mD>z#A_9{uBYJszje^Eu~S*E!ecoa@W&9-rm&!#_Um1^*l$Ib74d
z9VZMI1v*Y|AIB+ETCI+ADcN!S@G=&_2k4L9DUK6?L714saVp?UFUNVavg1tVS<k9C
zPCoi4rJ3=wtjjTr_8pktaa?Cxb;t3g;V>4&GpGq~V<G$(127=nad@Uv5_4l0)Pj4X
z7B&%!;cSe>?HGYKF$!OP#c?WO90p@|EW!NFNGh6WiS5{d#feX&9*~84K+zh;bR<bm
zS1gP}P;WW|c_U{Y2H`4v8TVpY{1GED3-!VguR2aH=6B+#yo5=p3{*iqs3Gc2+G8o4
zfO_ycB+Jf0EQ2{}Iu5(y#A6KhK)pbwjW?qfd=<;%6AZ_gTI637)up06ZH4jJ6P4Pz
zs0VJr;&=@;K5uQu@n8rlLzPhrYir~FSd4f&CgInp7rANsgX)+}RH#G#qv>c#LmUo6
zO}q>>@d4D04^XKNuWL+3rLv)o`(Y8{@u*aPfgyMdwZPvo6!X<H3onJ5w{AW1uLt*`
zL3=n3wKtilH(r36=zxuHqB2mRzT@P?aMYoU#wg6dE;ts`@fPaPm3fWxgWXUI8G~Bj
ze3yy_Zbi<8lZBi&C%u8=RKqcthI^1N%<*aHI0;x8HDMpr0%u@$s!`)^qV9`q<Tw>E
z!#W#vc21zS$Su&=WFP^{(ohe{mNOW&6?;$<T|!Nqqlx2`#uU_>WT5(oV>~WEW#j~w
zM8BryY*j>!ua6|r>5goT>#U;^L&I^@in7pyo@S1dis`7m8iv(z0hYrn7>oYRO)9IQ
zGS(XPHOxX~@(60d{w+)<s-PA)2y5y4Uq>a8h9?++aj%=bPe)DM9hH&Es0{st`h0S>
z<W~=)QCrvs`{Nu8#Qd$yS&2d|AOZD4?NAH*1f!YXIZH*UdXBujQ?j+=RK+1!1~;Mh
z@|v}H8<UByND7_B7>D~&&v}I9F|4gQ3k^^U7>mmEYAl6k(bWw;?aTvXQ60Tdd-@To
ze={cFWz<3f+dIw_Y>v6{3Tgqj(St=gn6s0LdV!W0iepfjo{##vPIe&wd8j<4K@;bE
z!=$z>DuoR&7(1c*hhiEo!b*4*wI$&lO@9OHJE%9FhnnaRYK!ioG7z6(&Oo~i*X-e^
zH0XvSSR0>UIHq?psqBa;#M3bZ525z{Dr#XNoz0uoz;xnwu^?_nW$-X66Aw`t@bDuc
zo4ZuPsEkKF@JrMUzu4HPtGTffmY}^Grs5P-N)KWLUPWahM>lhJ5>X52k9yu{)SEBI
zV)zr5K=%oi>=ku4-)VF7(9s<uaXjkHmth)SLA_zI9_A;v3+jO*P#Ifb{T8E%FJctt
zc+)JX6zaLD$cN-Q?WknZupX1K_FLvV9)bG4w_{1XiMp|1PjlE3QKviumD(9L-ifaf
z-@_QJ+RJ372bL!O1WVyA%>MpwQPBkPz0EIJYwIM`gxgVXei8FvL?4rp7}O!`ggT^i
zuqbZ8LU;m|;#;T;7wl^?Ruc;lzk!7~e@<U2+QV_ER4+!Q^aAR^Uj592Lr^QPh&nSF
z7=R<t4`*NzTxjF%SdREd)K)x0Eij5-DaGmNYNBpbJU9XM;AJ*GfO&~;U_N|=n!sy-
zdBafD*N}i(NCO*ZpvDbDy}-w|eKjg0-=Plg{Q>O19^m`7X()xd;Z;<7d(?{GLuKe=
zOu&t(!*&z3;M@bvf{I(KpojKmsQ!W0>8Lkfh05fKf#hE+`j-Y}B5IHsPz!Zxdtx9?
z#YVUYwem-(v*GuS8J~a}-x4)`C<fs))cD0%9CxGUxncYBy6>7BB2lL^8I^&Ks0R$j
zLO2xza52W?7Su$)qaS*`XENrGx-SlOUk%iKZBQBOgIdrORA$_zRJ2$7t(VZB_$d}Z
z-@)eVD2ke}ChEa$urT&Vz4-*xR;{%0VH@AYVA_3$m@O=Unz$D79M|bgMJpa+JEox?
zxDs{aG1P-^q4qBKQ1eD{sQc2f47Nn==@`sj2!;?JMrGhS>UmF53kVpdGs6Ctr=mA&
zg4tgK79pNs+ZWpQO_+=JUr-ZW!BEUQ++?gIsy!8Te`nP5hNI5Pd{oAEqZWP^^D@74
zkBT1jFKWfXBg~s7qE_AtwZLAOgriUy+K9e*7B%4w)LHQ6p_(WF^J6TAVJhkuu_cD%
z`{-(A3#e$Ndr&F5j=JGF7R9iU=BG9llZks`UHk&|_56-nP{1huc7rLXGcptP%eox(
zA}3I1>NnJu{WXgGD`nB|n}!Cc?|TU92WKVfjkjP8yldmc(dH}Yfh}mCjrw}-p$9|8
zm<(1%y=g}*hAt|@U!XF+eGG4?RGpzgZ+;(@$~<GufN0d$P#vSO8G7(NRE9o9jo*lo
zcoa3!18dMYlZlF`Of^Ey^A768r@B;h<0jO1eHN9vd>@z_qEHL0he~B9ERGXV6RklH
zo<J?=5o*f{jyIOW2;v4d?u|MFlWe=Yk&06ClWn+<deedvjLE14wnZ&$IC^j<DzzI>
z6P`qE)dSRmOHMS0HVyU0%~9ifqxvVKN8kS<Dls(dL!H)psFXiPEzEzC+1ohOjV)0N
z>5C<C94aHLP#HLBy^q?O{FBYNQmBPCMvd!(+28*pDrIO`fi>_<b_au}m@TM=ny4$r
z;uO^PyBYPsBUl#i*f{J%vPYbXI%Kb*GT6h$6K%X0{W*WmK`Of87u0ut2X&+ORAV?Q
z6RD^Sv_S1?Z`(fwwUDLO1E@E=hT2N+Y38dciQ1wzsQIR%tG!u3MXB0?n&>2|{Vr<d
zxu=^4#GuBtM@{&yjXy$VWHl;7`_O~;(GUG+nBR{m)WVvhw!Hrg_Fp&5p+O$BK0^Iq
zcrwl3ij&Yo{1$5BN!F!UkoW+W$1~PEGtESmQHQRTjo(FOb|z}UYi5%FC@TADkhf4N
z&i|2Fc?t9<PC=!-9u~m2P!kWqK%9)q+ydLa4fR4lVhMbTK^Xb5SwIRZGtFEoI?Y{B
zDIaR%nWzUYx9-RM#FtSExQBWZ=M!TXYJ!TW7ifrDa5w8XROS|=wsbG*e)l>R?TPm+
zb3+7{BThr5v@dGld<?*Cs7xJ2?cpQT_=r!<SJVhg6Awd8v>5ey9<=^}3B-Z3v;Qn{
zo!V3qX&8ZdaUJTxJ5U2}TEjjw6E{Mo^lc2r*%*iG@uU|SLSN#IbB%jZsXmS#{1u=1
z@IOdC=Ky=L|2|*vw;FF!ztG&U>r3MiR7%g|ZG4E@f{Tky{~xFa|BK3u?-H}1NYs6)
zSP2_rZk&ikF%z|gYcY!Xon2J)TYe3-XSu&JDJzBP#0^nzIt@Lz6gA;@sEID1?tg^E
zvG7uJ>Z@WTaXZww5vYl0Vm@4iu2Qwu4%mr#h)-c@yoCCE@+>oNUK(E_u86s@I_fK^
zYi)}u#Jy3c|4Y=@aSSWqb=1~{EjRxNRbx5dzkYgM8uUxG0=1XNFa)2Y4p+zu^XBzX
zpJPwd#3NAs(@=-_TP%a;Q4{4^X%-%j>aUK<aC<C-!&j1jb<DH_)?#(yA5jk|u*&RN
zGHP6NjKlt@RL?_YXdh||u3{;CX|;KQ^49vO{%$s&fJKNGxm1#<?63_FQHR8LjY(lF
zDsE{VgrUTlm=9N@FK$B*euv8BZPY^i)|w1d!kol)P-m$j7Dl%_m5!>QKEq3xhJowM
z8#K4}wNAu}^nZyu-50FE>rLDgm7&SjEm)HH2I?^SeQg$)fMuE1X-TCr9pkV*?#A+%
ze}mbAG>jqchFbA-EPzW<KSZ0cI-W;mDtx1P!zx&gxCLq}$D;0Efgaq8am?>rqoN4{
zzR^Dj@Q)7|h+|QQa5gr;4XC~L*<{|J7-}nOTRWp(#6=Ho#bi8(%1FRw^Y?^wEKJ-F
zlbPQcPvsTdi51X$i#c2sQSBYDCN4lN@Hb4rvRlmpGf<frhI-TaSQQW0IOjGqVHr%P
z{Z&lFap*RovV}@P%(vYbj#_bf)K+vror$Ta367vXvp=yqM(r>Q?1I|sWvGQ8w+8Jr
zaVu2+XPAO}c9Q>aD*w=+QycQFnJ^8Li2I?o=1WxnQR`z&BM#YRPI()QARdh#T!{Js
z+l$KBA2<gq>^A?G%yIM(pWE%4J<OsZh=wA2%$t?NV#MuG3vkhc%kX79jLO6*R3`pK
z?P=+~#&pzut+6tWK^?|#QNJ7aQ1=&d_nAsnEJ{Nc8^4cy9?nwK7W|Br@a6p`u7Uc#
z2cizyT#Uk#s5k!`wS~nFm<2UPjq8EII1i)I-9)7tmGf8#!w#B`MAQVWP=|7q^&8aJ
zaR+sXybqZLC1Vxh?lxY8n&1@H!>1U6HNP`<MEYH4D3$7T%tx*4GHSx7sMMA}Y%<dx
zixUq;?fnAOLN24u(4W?z@68J(q0Z3TsKfRZYKt$SGW93=>H81)!TfO=i|R;2Wui0s
z;t<r<jK_w!7zg8H)EVjfqxq?xfx3SODl=Cw3=17G{fQV){03^l(=mzpoi$YSM%S=3
z7C&lI+6d!_M`9^lg|T=VOQO#)lj2y6A#RN7ABwNw67<JgsOMy1IgCASUa&1@|NVae
zm3(we!V)+Oby#+y-uzG7A9%uyi^Ndc%c9=29(r&DD#i0q{Tr|h9z$*IGxW#8C(UzW
zPLh8eiWD03`7}kH^0&}~i%<{RXT6L{ah8oEPni@~MQueJ%!R{IFEj@A0@G2?Uv1+9
z7({&S6#3T#|Ii={|71+GHbP~jr;TTz7QD*FhcNp=s5krvHDTasv!DdjR<%Iw`Eb;k
zn1h9Ivr9z}IEs;Y9krLae>Ntf+B={YI1=?0%t5{JZq$RXp+2`9XUy|TV>jY7RR3bs
z8QN$41NA(&@L98>MAXU~V=(qXJ@5n6L@Tf`9zm`AH`MrN7=mHHnEn*h{f$sB)&mo8
zgpJpt&cFfWKG!)*MGt<Ay3zNXxv_+`inS?*(cc3#@mT9Z)cw1#Af7>G@HT2;h0dD=
z$D_v8L1m;P7S;FfQc+6h+KxS_8?RslX4$yt1(ULhs5fYiMX@`2a4d%7V$}WnP+NBi
zl`-#&<^_wOGMgY>DlKipFw_GVpeERfO5t%-W^P!$E}6dpg<u%%F*dGkZHe0J?)WlJ
zLw*0VQ42eWdhV~7{qKKIsOYl_y=(@ip$7Iw4IFR%9Q9d!ZTokj7J3dN@ve;vUNP;_
zsP+_VYt-|GqF!kF74okKE~6nFzd^-6p&tAzDph~l{?K2|=a`E6rOQA)a0+U{3o#UT
zpzb@1dhT;f!0@ZaCKy3H=Bmq|a8wr2pgqdMVi<VMq&NiwiEE=$+79(bW35YU`ytfA
zAD|ZY94le$brW|*J$E|R!LLzUm*v_@$Zs}PsE*b)eh2l2vrs8pg$3|{Z9i?>@1Qb}
z>xNlKBt{XJMNQlkm5D*9%+5s3<1V36oXTF*=Wz=)q4!O*pkUMusi+4uKrN&fM&no;
zFSGF;)crS5nR<pE^xQHFO2;C^U6HMF9hZt$@)>GRHlZf^88y*gHuk%1+RLFPXo%YD
zF1CFn>i&7CiFcwFe%ZD^Ld_HSyLoOrR?+ugkBT1n0V=g~QG31;b;EAke-ZV@kFhL<
z+%Z2mbx~)hEo#97Fa{^t{*9>29z?y^CDdVjj$zF2B>Z7k-UzkgzNo!?AC;=Ps0V*z
z+mB*A@ojt+i{3TA8=X*lJ`zjdB2*?0qh9C^W^e61^H;TCbk)#;N&)PNnrJ9$r87}0
zUyn-dVbu8BsPSI+&4LS}?u)ioMQzRNsQU+?GB*+RLaR|3J9MA?E5(;+@L(2d;_wIN
zZz@$WiMTgv!Y@z{T!&i7cc_Ukp+7#c=6h)V0uzCH{_Cg(y^XqmDrx~s9+H1exPt~g
z@H}dwhgcPT9+?T!F_yRumc?<_4Oo)+Dry1w9-FO+Kuz2PwFP}p3z&xaaRusmTU{z~
zRDMIHIOtC^VFhbL)Q#Oy3mc94o-<LO?MBpDIfq)nUl@dW{xUD-!GgqTsQxCX{w}Eb
z+#$AMHtNmRU^%>qN^OC^&EYDA`G{+w+MA&!?q%Z-Y&;+JhuBusL}yS7zl)mixi#WR
zcE9VSQ3<A_1?rIWv1X!Dw+VHs&!RH%%o_64#L1XIdsD28V^Po9g?jFF8$Y*3|6{hS
zE{5v+?@vV&O+lq}H7doYP!IYWD`L@q&1dsERwB;Cm+=QIf~QfR-F<6tmRUd=YJsg#
z8JUFI`vvILm`b1*f8V22q39Y%sZBi;CwQB;YNrl+Riy1D`cqI>4E0pX_mt?&DWyZb
z9%U{q9qRU`Ka;juW|-q4-cMYMcp#;MZP#`Wv(I`)zph?3?wB3%1=+ZVHPyO`@%n&{
zU=nSI?fpI3NT(vfH<ZB)*hi^DSx2d12OYqVh;{u+y&0Coe%QuN(8{VYedy~($w%8}
z;%3;H5=xnzxi+SxyOiD+mxp?)4PqGKN8MxNgZ~-VfW9AyFHt_EJ^)WpGAKTbZ-Tnm
zR%e8*e}dB}1u0Fq$6l_JXoCPc_=22fsB4UMEuJ(@P8G(+62EEh>5c=5b=a2MF+!)9
zKb4&c^qr^Z(ic&W`g~l2Ex5O){xv%vL1Th6I&=-8UW^iELZ>Zt4s`bQCS#varc!j0
z-=X-?uOAFu)hIjY`~R+~jC)GoUzGKf?v&Qd@BBjfn9`g9pVHWn`Z}zRBXI%cDD{6Z
zo}%juTuk|rIzM2}Uh0d~VXsoe+o-=wiRZb06F;Qrx{LbZnnb(icj{AVP2*+iQ`Eq9
z*$!5{3;h)+EfsK8qi-0cGxgW)xEXkha-BB*0^<y&)TZd#PWyAL#4~h#N9jo0Zq5Hb
zjY-+fq?E?|#Oe40ZKbFeq3HUFw%HV2?XeZ59DR8;o;Gjd4U`;|w~4={bfD;Zk2YQP
zv7UY2f$SFEKhAa*rDL<L51?}h^=a9I_=AAHs`f@TwX@@1wrvU43-pbmejN4N|2;*2
zSn2BcpZmY&{%*AOcd5*${GC07f9jyFzY6W79I<UPaS!eMweJ6}GCZs}<rFQ$DEu|R
z3AYpUv@WBqHTAdf5alhNk%+pc(SDuSZNq<FrNq;y|4&C(Av}hsDb?vKrZx&czs>`S
zuAG!z^nF0dO}#Ga8jF{*Yy8F1T8_5ilvTtd?HuZg;McZMxt#i^LMIRH_3#`ejr!Y+
zPobWO!4zG6DXS?HDWfTmDZ0{Ze*@}evRlkQUaI;EeZ?rHY`dt=^YhY{Oeycp8LUcW
zIYrl(*ogsQ*qAsEr3H0g+drMY7gq>vR|tN$eIuy1r&OW*LfdWZMJY`ESN!kwEp6}d
ztStQo4W?3)-dZ%4pm-AxCtgGOfchxfbp4Dc@O|8l4=^Vsf)YghgraLa@oU`Io>JH}
zIRmJ_xaw1B%b4+MV18#1<qZa`rg12~N}PeOP-bc%=Au-h?%)cnjEyMQsOO@5q&}`e
zxCH%iH>D|K8ejy@p#7c(aZM!F+!d0k_*0qApqrFAlmf(MX@7D3OPelV+UioGGRMY8
zxF^+08AMAEw!@I@appfAh<~KL3nh+v37SjeRpM*ZcVZ-^s@ky|eWNM5mQq?$?@Jj>
z-^UbPy)h4^j!sS{4TTxtQtnW%fj8*<jQSmW!)w$7XxDX^Qoy#4R0G$Cl(*>*qJ-1;
zBXPqQ_u?et9Q2K$d`NtrcpFa9$tg=EiJ~i=0l6s&#D0`e+di2#T@xs6DNSv=+F~im
zlu5R2mm2ML#<~}0Q|>cnA*Bz`yMoR2<FJXM>red5)_0gDr;Lq<5Fevn!Y)MJohTDC
zGZLeG3;d@wFmrlhXyi}y^{4ekM{nW|++U4`(Re)bhs21ScWIrHc|S40jeRkYmRyt(
z#6Fa<lug8qxaSmQBc(s_i|Y?67in`Tb1CO2?@$)fzSa&ZPP~N@#<RAfuKWh)tcl(1
z|HEN}ZS2RuI(A?~>MLzMlDe*b#P@8QX)*sTNdG~qh3G3nSwX!KWh<ou@jgmk>Ny!V
zi~4@*hcHFQAb{Y-)r-a#*F0PQiiTR;c$7F8FA`6GF$h1Q+@^1oZF`q7J*a<R<F54e
zrRYkayhVQvtW4WteZ)m5y3SID(m0M%H@n6Br?I_RQ4i`*F`9=&;!27aZ42;simpcn
zXD%+GZxKb;REm$SEAC9)9nOPZAt*{IP5J6S174+XAmt(LUGZmp2cO}a6kU%QUmU-~
zarEi(!k)w-_&I(`+f~ZD)Spv|Qgkiz;%DFwf|B;e)3!sMUG*QX-zfQQdla6bT(EI%
z?psg4uLg4cM*HWc>b!?9(O=$<?Sw5=&r_ps@7@`Gx_B~r_3FF+S@QSA*N3;Cmgbif
yS3Wr|KE)HClv*Jnu6$DFjyd1>v}j%{^S!yB<xDJ_R5odS@aK1<)_2$)Q{{iCOa|=$

delta 14218
zcmZwOcYKf6|NrsJNK1&3AtWSk2_Z6&NNlldtJ-_U43XF^-m%ptR7<E)wW<}`id{;n
zYSk)5sgV?|O{+RS-^VlOxc&Oa@4DTN`&rjH=X#xUUCAf6e!l%H-|T<#xvzTXU*>Qv
z$?G_!@grZy8J^E^>V&J-aURAyPBDChMKN!6$MHsQ494;po8NJo;L<#fGoiNQ%wwz~
zbseWL?JE;Z|4r7t_z(5pVG+l1J16Tqju#b|u{hpAP52j<z`_k2#|J~P4pzqkI2yI!
zNvMUbz!2Pm5%?_z<DVFcr5ZX;O{|M0aU6y*zq5#pCfa2izQgjAe?bl4)yNDGWo?H9
z$r*$GI0yBl>yRgMK0!Y`fCcd!M&ng1i(ZY*16RgZnBS>O=2dKria;yWK)p~;G8`-7
zd#HgABT;rPVkG)DaU6EXX@He*Jn8|~+w#|_1wX|qSg@(%1Ys?7Yoe}Xw5NlyD!zpZ
z?KaeaCr|@EL-h}Q&2d~<2^FE1sD%x)<tZ3Kc`a7MBd7=Y)3%pyW+Ks~8SyVi!yqc6
za2{&nJ*bH<pl;0D+=M#X+7uPaUbdWur6|9P3iS>Q!0V_5{*8fHx`kPI4b;3{TM&Qk
z;bbbbhwq>c<9gH+XQC#$V9S4^A`sltaXc^@bttQ0D5l^5T!szs1?te%Y2`R&a4c#e
zOHm8l?k1y--yrA1@oMcjoI9r-*2ATkfM=06%<*aCI5F4~HQ{8`0@q<~s8Rj?MBP`l
zt>e_d6zdk$*|~|@B6slXCISsHnu=~nw4Aq5TX7aO(L>b4zU>?*9A85{NeZfcK32s{
zR77rK1$4b(&Q>#2|L#Z-opH$4xShjfDp7F*wIZ+fW{;|1Ez0dsdo>U1V<uL{#~6Vj
z9ZV?OpdvN|^)_rmMe-VI!66+@BwC>sI0KvN{Xa}5mWqO%%!j5fYVX^jCLV{1NCqlG
zIjGmiue0OCVKvki4#gDw2z@cAi#aQ?s0B1cJx~&AVH>d=^E-FRC{#teIu1c_sv}=d
zXAVZ<anxQuv&MBZkr;!7(D@vr@CVd5`MaC<JQAx@?ulB!GE}4wVnw`*Zr$M1!wgs(
z)i4pYryGzcJ71&vmFa2DKoiu0#^Zd<!UEW|msv<#bWxs!rExXtLH1%G-bO_{e{bTi
zP}k_~IG)%GwSXZQgiBDN%*2xTm2JO<36u-;F|SuM)YeQz-JfZ_gnIIPea)6eVFSwT
zQIS~I*KH2N7gT63|3Tdl+m92DJy8qUfK~7aDx}Xa0HgYw`<kI9o{W03ji`w(V{t6Q
zM?n#+jEY2ORKMwNo5@0j>NnIv3MQHx5>Vwqs2f*d7@ojd_y`r!$bsf8G($yVFxJK8
zs0ExyE#Mc_lNTLi-~U=<!l>wpxhq0%%30{bZ?G)>hI;ZMgH7n0qMmRjmcrv0f;UhR
z^B7_*hvg_Y!cZKHTF^XXT(`5D3~!Y41*W6_Q1kw7#d?%)px*Pc!^{)3MlEOz>eMes
zZOu_sgnqZ>&?J76Qtp6y;<c#AoWyYa3oGjVFF#x#0>^2C6>u3=#r@U?s0quCFi+kH
zJt<E^MPvci#II0?)JZnq`chbeVs%u6+n^#m1{JZ*Sd{slFUhFmSq#RzsDV94nvga`
z4V;K&a57fJ4Ahx9iavM)i{bC630_Sx<+50ratvxK`k}^|g>F@BAfvrIfiAp<8n{TR
zDMw%-%B`?4c0o;$h+4QC^)|eNT1ciXA4T>18T9}!Y`xDY6Orgq#9ybkBNZAT1y!Dh
zx?z*8KZIKG6;y;?U<?L~HixV=YQagU1-)%ugD%RuZ2Lv)Gt`57k0JgFW%V&;MSW0_
zn1$-F1$Amqp)Wqcwpd`SS!fs3*%*!L{|>7EUR3{U=!Z{H59T?}e2BtO^R#l4QHNyI
z4Kq-ua|J2_M{N5~Sc38s^g++@=8y)V?t2}z_lc-Tjzx{T7<J!9)O`m~ujd)mg4~bD
zD0E&E%wAQpHb!sidtp&bLA@PQP!n!O4SWFo@jU9u@1eG;_?xC&8C7nNB{2oHg>#U3
z-Od&=8t52m#aB&(^At5;@wd#4aj1dXphBI5dZNXs`!--C?nQ0sZOmQBL=%z9sQxWb
z3+aWW_5P0|<Dz0I>d8LC+_wQsQNCyEU!7#?OXDllC!i*3ih-Dnir8FRzZ!M_G1Pe1
zQD-IpWD~J4^kaUf9vQt}9Z&=H!2q0ydeY^nmG46>@O!L=*{BEwFo+k{LrvHUbruGq
zwq_g_!G%~FSEIg&d(j<4CWnkx=8<MrS^*WJ7N{HgV;M}tD!3Zs@f0@4SEiV^=XKPA
z#$gX!iQ3xdsIyaas(Fy=s58}aD)HBzb*Dn1oQ*1HqTcVTs1Hu@Y37N8uo30<w!9px
zQa*_t@n6*2(_y;V(#fa@zK?p)BN&1=Q4xM+22ZY#mz`lkRTuT-9Z{hifoh+P+S?CM
z1MWf>UO`3ZA5{N<nI@9eP!n~sPC!K>1H*79YMx7OGJ5hSSQbmqGEY<wb;C&14YN>t
z`7u_&udqDcM@{5A+bpO$YC&C4TQ<g;j=_{OZTU3n47eZIhJd$CNNS-vc0@ht80!ku
z0uQ1Vb{$>#92MG9bIgP_P=~V<YQb|+hju;ciL+4sPn&kP^N@^-iUM=Zio#K+wF4^T
z{ZV^07Q=BdYT&)7g`7o2<Sr^A-t$ZZYFIm>wk8$TZyqW#pXRo+|7Xa!sCa;pSZuyI
zWOY&XQ&3y54mH5n7=e#aAD%J`%z&{NO}U*dr(to*t5IiYJC?<hwtQb@=65_7nkS7!
z-H?C^Sv%B?1Fch0kywq2z;4u5own_dP*3Ky$QXe-3(ZkmIS}<$%|&g|0d#A^CuFoY
z9*a$=f>0CHK-ITLtvm@ezyefA51}T!Y|DS5BI2{eL?|3xlsjTE9E(+O7HVNxOL+e)
zkvUI=LaJW?Wu&zW>dQAB<M3T{;diKsA6UJXn#e_<Ca7y2ftu)j)S=sF%a>7+eZG|V
zYsJ3H%$KW@wGAr7si>9DL2q1%3i-!a6u-mbcolu|Au4hn@0fZQ>VaZVXQ&tY;SAIQ
zR=UY(f?ZewkE23<&6b~|1}wVVSP6?zZh~4s2h>0VtZAqTGSDA)pcZ_>dKVQr&v(t1
zx+{{=04-3V8i=}K8dk>jsF0pT^~?XB*%B9qQm%&D!Y-)((@<~GPSorAGwSSkt}w4>
zr1cGq(a-<!Wa8<t6=U%R7QzxM&A=f@N2j$l4K?vjR7fviN&FY1&_9Dex#b~3=tVhT
zwXq^9((&lR*YMwb?Ehdg<G5kaI&R8K=+~PY%718#MTN8h{)(MZThM5uX@3JXa3A!+
z6x4!dpzd3ZHStp{fcH^b@CWAp{_nTRJW+Ynx4b!O3zAS@w0YP7cc2D-iZ1lpY$l9G
zP1F!|e;3q!Z($Iw#j^MXs^1ON*?Erc!ek0;F;C)$>JW;aSQEpsF>0U@s3)I~uVMxk
zzz<Mw!8YqbtWNnf>hu@fYTk}GjHBEF!!T_t`(K;PMk;h@Zlb<a#Xd578HWLs`=bum
zWOU)jsMqlnYT_HV{VD1Ym)mB>Yk-<)1Zv^SQ0*U}B7A5Y`(J|0b=&aV>i4nvi%1M=
zfKjMDTY(xN3#0HnD%ANtF%b$!Z9y}vh{I41u+;jAZ9iel_uOPk(V@V0^Gyyxl{=#*
zOu-0TXv=%8KVl&De_&zs$uwK&LKo#|R3zJ?7BU)(;41XMk5FgHy@QNDnQyQU-bB5I
zjdz&;wL2d51X<Rz*85n4`hq*n>27G9X#E@&p@-I>Pt8xyR;a@`8d;#*d526i6?;)<
z;V!nsu+PkgCl$2?>#-7^KrQ$g7Dcbm&D&E3>r-xkiriGx6RyF^xEnRj9n}5Bb}3Tq
ze?>A{X>-&B<FF~NLtnguion0v8cSuFy&i-L@l4cKY_%RkJ;+UTVeoGAfvb<2XB_H*
zH=sZBJLhbN->@O&&^_ig8HhSu8L0Zh*aSWHngzDR7|Kg90FR=+j6b8EH2*&HH=qbq
zc?kOBB5Z)0&>c(WE}3>1wBNi=Bdt?WD_)9K@GvIe6V!mQ2h3~M4eL{$g<9Zotbj!h
znuW((Cs_BP+W&Wu_*W-W;R_Se-l&jHMoqXLtKm7+))YKs+N)W+VgmJ(QK$R>2IDW-
z312;IwxAd4L*_<p?Pkothlkw^N@o6-rsHx9q@0C*cn%}+E{3505wnn5=%Sp6x_>4r
zB8yP{ccDUk%lbF!0ep{|vyp&0lyAAolqa(lHNa`>b1XwS_$yOi7j<X`pdyowHSvfo
z|BH%1<zwcsb-_@|3sFzL6Sb8;p%zx?xasE(B~y}$ZdeXSVLf~oOW*}te;+GS_W9Zz
z&N|jq)LXI%b(Z#{7WfG3V8{tm?u{CM5w^h3kV8xSzcHsb5Y-_b>tlD+!ZI)pKSPD~
zS5#z5o-~n*N1cHlsD)%;5N2AxM?KI3)LDxD*8FhlkA9keB^iY(6N}+_^uZik{{j_>
zpzq8lHV(CbM%V`X;so4|IwO@%nNN0W)VLE+ky(YM@w9Efk5!r93HaWuxD{%J!%$DO
z2E*}Ztb(4W%^uc9ZN(6bz$I7#51=BLgO#w*8Pgt*4Jr3SZ`^=Un1$}jWOB&p2}_(c
zA&<hsl$&B0w#RsU6ZPbow*8d#3hJ%7gR$sw&b%EpQEyQ<RQpJb#CfQ#-F=SuYei?M
z(1h8jFWF<%DfK#UPI-BBQSOZzD9xII3UQV#UqOZVIch8XelUNkseu|l0rdc_P~#8%
zf%vOpDiwaX1~tLw)-%@oR?iD2B4Mb0tx*deV$0JpcO29cevTUd6ly{DP+L{(qS^8q
zZZcYNXDorEQ3K4yvbYwtmtR`%+xk*Jng!HGeLp&*CYXde{cBKX;UH?fTR0G3*!I4c
z%o%d0+016t6P-aV=ss%Yg)W;X2}cds5H-;t^v5}<g|9>P-;Duy!L~ofl9WBKn1zI5
z4CR`p>~@mK=nPCn-M9=j@OIRV$5Bsk-TH^s>nF3&P}Icrt-Vn9PsHN56cxb_QRAOR
zE%-O|*ZZIEstH*jmZ6~*Dx_U({bbaQt1uX|Z22MvQhtJZfTGvT{UPY0Tpxq5FY5j@
z)RwM9Enq*EbdxzpMxniD_5RtEtD_dw12w^$s7TC5MP|Kq9~Py29!q1kE$6*%>b+6l
zix4b`Em7}(M|5jt)5vJx)mRokMZH!(pgO)l^{aTp^lN18ih8Y*QSB2^3tf&HXNxVL
zv|h9IkFCBpiN7X}ziFPR6>7jlROnJ|c`<6>)u>2i+V&q%AE;-jFJb9hW`WI63+jd1
zq6t_Im!ZbpgE9EyE#j|C;cT<F3D|{lZ`2-TVF;c=h4?Z0V%{7RQh(Hw*0=Vv_0v%g
zvJJJcJy;WSY}xgT8Ml?2OfwpiQG1tVJ&zjru`T=FHsz|Qh_y$Zfgz}cO||t)Z2cxw
z1P-AVas@;24(frt?wClptB_G>+oBfG56hz)^%`wJO}HPmptGp{&rqQ(aMvuP0xHDy
zZ8_1FC!_9PkGg+1y6`fxAh+{3nNn1^el>el3$>6=7>uJ(6Q!e`c!w>2W4()-px|%j
z{$N!9+Nk@xp(cJ4weSpE{|V;){r?mh4g4F{L63W8z=o*Mc0uj=VAR4U+4dEvC*F?H
zcpmk^$$#IRof4>Vqp%V-MYX4(B0CL(IDgJcGCG8NP!rrkt=#j0S#c%QUe-lLstao1
zR9in6t5W_D8{<XPccaWhv*)!jjB;;OBxa%>XcM|~_m+&F{4A<m?2&o$Fw{ixsF1cr
zt$YM(fiqG4Kg6QA4;A8*sQa#2pQB#G;*ZV!QK-l@dCdOniH1_4*KIl~0xQvlS*VGB
z#LD;_t6{|_X2PDR1r0|nWCm*DmFSJ1T908o<x8mXi$66BihfG`H9!k0w19r72`8Wi
zd>8d(A7foSfSTZMj6lC<X73wVM`8u)-$yOr7*@qgsEG^zZnhvC6_J*1GDXM?LJc?;
zqi`K6#NVSPd}uBBhq*BXwXk}q_qh$~wM{{tmF1`f>_9&}ih8iiSR7y2c6Z_Drb94l
z!Z=&*h|!dXp+dg`OX3OC;kt>1G0&f-z6fgK3bx$Pmb;_+k3}tHDQe+ckonxs9+Pn{
z*$yvI6BT=54oSGR4eIocLVd}Wp+dOZdfxg7W2pD~%luER`l!P;5jE~wTi%l^`+tp$
z_ALM3X23|)M9okk9f}I^BGf=Tu?AkmI#~Q4^KEZ~1u4(QQn&>5+I?g_i(0@7)B=6}
zB_e&uG$o_G?}2&HkADi1>Z-sslhllSAkN8ao~nl$>{XMx0<_maT@mDKlfEUDPoESX
znCDsgd*OlZ5wz<+(R|l*bH2c1l$+vcQXEN_wtJEt>wmQC8g9#da!dTaY0E>bwXL7f
zU+3(5jHB+Py?+>A4W}lBEYbuzd_`(T+Cge;I~~Vmly%)A-ySRCNbGJW=xSA;WZDLi
zyr|nvxdRR$l_t$kUt6hydkd{Eud?K8*+K+8ijjBO^4I_A*M_$5C|@TnBtHuE2jzaG
zeDr?<b+L_(+veZJ#UyXi8{A_rw^Pj)d}(-2Z3omf!@2{{n<}R+eIqFkwf79hF_d-K
zw%R^IhlroP&K%mVl62{fXi0tzW@0DqZJLME?M0y-g#;ROy+uBhRN54s9^^U5xz|wo
zz920k=_HRO6{lSv3|;j|2Wk8NU5n`V7j4f;pOOZXx-!3Wh4c=oBOO*y*@pa1tdCQ0
z9qBarzcGfSYdvlxZ6MEw$~j8@12xzyobo>M<47@#`zPh6BwY_tA1?hz$eQ12MW!2-
zH^|Rd1=kJRS@}fT<4K)W;7Xuv5~)A=&bD7V{z~GvF^At*oVQ4?k#rqUA5tyG(De<e
zFXb;a|1>JA<yQ0aoXVn<8{&7=g_94kH(j7^B}rE=>`JOaTVYZI>he+koa8|oMfs5W
zk#tR<PFE{zX~#RBTf_55+r}Uo_Sk$Xjc<`(l-r3f5pDJCjjHNt`+3^BSnD;~rjkF4
z`u2ZI(hn<LegAX+XWT!Kx>UU$Ye{_4bFV(+^{dc9()XsyS&B!f|J9a76oZA4ejq=Q
z^q3TECrGkxp{^VGp?HEcj4@(S*JA2_q3rI?KTSyb8Qj#~=#OV8UnDi4Ed)!D`1(3e
zNV+^ohiRKlDnPyk>Y9nyP1bqeT7|mFq>m|2v2&;?nBQ3wDtow(kS|1i3;c;xpZsY0
zS0`T$OObRXlRhEMAx$IwPSRE1wzno9nOkH2c&Th7+CoVcZM|r~_=TyfPO6%hGgyzz
zM<iVzVt+c6!PhB!k~)zuV%zn919*7_Qg@TWJ=->!d{0sx(iQ6Xec4GOl_Y-)|9c&x
zZUSTdt8dVoWSY?W8kH4D`6y4Kyqz?g{8Z|6{fOsq8t%s@_zKBI((exZWY4|crretQ
zdXfBX-6--eua;zb&}X(PnBN&g>O+U^R8GXkl>1>L(lYAa##c$T$mhXrSO;Gx<&b}s
z^bSeaSloy{_$8@5ecGT4mr(ymow(*w*4%N`$#|1lLZ`c=RV4ieRGIph*FV(hDneZg
zQn~aoRfFB<sm((gOHB#vi2<f#?!Ub$pQ1jI6iq&i+De#BIfwig7(%M6dK^UCbds*k
zq%Pz~lHR0kIZ4+DEJSLqlao$GNjjvF?vrnfcW7Km{=U7T6?tFkb)6&?v-N4J;95W$
zO?wGaFm0zOx3zs*<6O!fw9Ozbq<od~eq5lFQ<+R0NmoNU6ePt`E>0?K>*rIa>upkZ
zQhQskx(HG{X`Zb+tV(-bvL3}1q{sC6fRxO5H?d=V{@G2^^#^9y`~g$tMA`D2l+Tc_
zU>Bn1ex$kS?P5c{iv6e7FMUdEVA%__rBeH{VL0X9+@C<jbUd5BKQ`FoA+-zAugChh
zBVTr;<`t5ga(>cGQWoXcx#tJcE>a5Rm)8R_KU0@RT21<iG>){M`b^s?jPhPm8OGX&
zx{4T_%cktk{p0gzwlal|&27iF<Uh9g5c0ZGC_l1wrpEm1P5akm{b>szeMG)3X)h_B
z@>irn<X@rRd*qLiKY=xL416fOyoOWx@>*l_o2Yn=8&6X%g+EhX{IU}+C;dj-6k9i*
zK7+~6vgLuajU?%cAq}Iw5!RvZL%qcMeO}jP(nKm}k(%e$n19;Yn^hV@{x2-gAZ2kI
zDKB+v@g7OnGlR1VH_^6%q-!B5Kl!rUt7`yx_hbqUDU>0FlQ!GVWOM(6g)y{0B|i{<
z#BumP9759dJN?V!H#mznU3oEyav;8s?@^ac8c$vaGe~l6&BJHl0fmb8#*4N=jfwh)
z>o%#VtuKd{NY`w+8Taj^-Af(0Zd1S7WS#L?fcC1kZ-4Bfyl122;lulm7~txgl$5;l
ze*DSuZzQ`?laoigMy3uKJ0vM_P~xa)*Xv1%eMcp_QWI0gB#s(w+WYqJpEzoiYsd)K
zfW)zhNy#G<Q(eQ82PCSdQSyk<smV#MMu{UvC#FX4%<8cup;%m0m1<Ejv979dwPNEV
zs?<pDma!|}n9&2%eOImYh>4DguDbKnRS!Zt<t$&L1>~%ncIUlC5BAN={%~r}w4JvX
z?8-i{{Qos%FZ|@z-VNCqn{pOx%%1)Et*mX?2dCXhdpl?D=GzBXX3yA=y)P|$;o{qA
SGjcYq&EB_g=ek1?b^Z@BYFnZJ