From 928352ff6d92ac975e11bd6ca80ee4544d3d580c Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Fri, 2 Oct 2026 22:52:44 +0200 Subject: [PATCH 1/3] tools: switch to PGP and SHA256 in ICU updater Signed-off-by: Antoine du Hamel --- .../maintaining/maintaining-icu.md | 16 +++++-- tools/dep_updaters/icu.kbx | Bin 0 -> 31790 bytes tools/dep_updaters/update-icu.sh | 44 +++++++++++++----- tools/icu/current_ver.dep | 2 +- 4 files changed, 46 insertions(+), 16 deletions(-) create mode 100644 tools/dep_updaters/icu.kbx diff --git a/doc/contributing/maintaining/maintaining-icu.md b/doc/contributing/maintaining/maintaining-icu.md index e83aa8a5b0c4..93dbda2c7d95 100644 --- a/doc/contributing/maintaining/maintaining-icu.md +++ b/doc/contributing/maintaining/maintaining-icu.md @@ -177,9 +177,19 @@ make clean tools/license-builder.sh ``` -* Update the URL and hash for the full ICU file in `tools/icu/current_ver.dep`. - It should match the ICU URL used in the first step. When this is done, the - following should build with small ICU. +* Verify the PGP signature of the full ICU file: + +```bash +gpgv --keyring tools/dep_updaters/icu.kbx \ + icu4c-*-sources.tgz.asc icu4c-*-sources.tgz +``` + +* If the release was signed with a key not present in that keyring, update it + from the [ICU `KEYS` file](https://github.com/unicode-org/icu/blob/HEAD/KEYS) + after confirming the new key out-of-band. +* Update the URL and SHA-256 hash for the full ICU file in + `tools/icu/current_ver.dep`. It should match the ICU URL used in the first + step. When this is done, the following should build with small ICU. ```bash # clean up diff --git a/tools/dep_updaters/icu.kbx b/tools/dep_updaters/icu.kbx new file mode 100644 index 0000000000000000000000000000000000000000..6abb79eaaf374f7445926b97f61f16b100b8f01b GIT binary patch literal 31790 zcmb@u1zc54*EqUQ(cR6VySuwnx}>|i1pz@oLJ$y15dmqXlvYAO5CkNpQ9wZHl(-w8 z$LD?j-}m0{e)sYesa(zoybo04^|4N8F zDC9R30RRXL018kI@;&?zEU!>teBi^aI2^VgZTajYNP)bex}2a+5$qVuhx&ZxSi<)s zqDFbu38E!$%D@Bxu)wSUgsgsFLjm~j@Bfnh;ou1b8?O0Dwikj12QX>+NFT-8m~sP&)Ez4d3V*hS`LOUoW)FxqW1@VQ^1lAS}jSPM+-Sb zxkH<{{X_68SJ@-(1wmWZT$0pvN0}3y>Rep*rY_Nf?n&uycFRsm9k;CYq2!}%kC&Kh zj70^NIV2-B%--XS(9ZR=-L0ZLx_kT6olp-+6W;Th4Nd57@3I%!U~@TzlTp0x73z5O zxOR2ta=kU?XKH*)jF55l=(Kp!2cbe8uM^n(2YSMJR5?)~c&Z<5cUAjObXcjdBf0pK zNpoMR90t!6lZ)FMoLLo}PPiziIB^(=VXikOI(zqCEp~L1L#Y9L2mpBr_MVfs(_iBO zG+3!A7$S9jy<8pa{E@P1@>)n%HBWyBUr!r<7cWm6ccg-shqsrfgQveA($UKoY3S)< z=VkAJRCEY*aQE`|01J>d{z$MQ8&cB6F2Kdp-(5DqkK4u8gWJx_L;COALH`<^1c)e{ z5CR405zw14fl|UyFwxOaVNeueG$=X-CY%HcgFtB@P|~{q20Gp!&6vB7dP((b?RxFw z*|#@mGB3FW2)23Yxwlm9;q${wckLPSMqOzu{aIx*Uk)OLH$&4O4G5SZi^p@r1Q@Yi z$Mm&fHk21`hBMgo3fC=7u9Su{G`i=o*7T*x1s*o!zKnkI98xkl#B}Wd(fNR=XYwsj zR8ifB@00K)z0)jwe*Z0*4AqFr6(k-S|0?OoaCSv##A0QxxF=F;d0~9~=ZPi0$>)bi zbF{P3x{tGclwZuK3e?AHjuM%*@mxs|h!V69ZSJA{Ij19uY5S>ncDQ+y&g~J(c;k zZ8hqfYwCQ%MCj-o=Zvp{+eNSyxT%WYn4*_OLOUR8aYuyZa*jS$bEfGpQ2-b?Zb0+D z^m#UD%^its%#uw$C$+CLG3X^7`dKQunfWf*m|8RCW2IaaN2giU_~(J}otmCQ+4gE$ zb~Y(V(s3s@ zR`(@4E74NHW#g@C?17iy54CtHbxq6HUb1FlZm+HC*>bT|>%XuTRK!j+TTF<`r~3N+ zrOycvS~wY~Qs{qF3hUoBCl85wg%mHk?KC8QXx+29_E?NiX2t1vC*Er@m-+Om zSR5)HDo^>{@Th|GI__V>Y$GgU9z7=ID?33CzkZHfFxOdrRc3Ttp=SzL?zQWA`5^~N zRv9|a(sb+oEGy@`f-&n!OyRNC0}L0EidgDBuYB`HiL7f)8d0kNoP|Me$7WZOW=jBo zzXYu-m1brhu0hz?^y?UN(u(q$JY4LrcfiLN`L}`nZGWMlB?rWQV<7+C{{CZoq1bQ( z^7&Z^9#Ec#ebGn=6Y@2%c%K`_vnN#@P1efMAn%| zRGsrbX5wN!8h_qhuj(kqQmyRSQm`2Jv)b0~bm%q%v**Vy;-6T;u@1^1fto(1W_;<@ z`X*`LKZH@NvZQq%4>aZ73MmQ3lBM7m)wWI;`9hnm8A`pga#qw!a7K0(f0%guwT<1H zIm=$6MU#gai{I|R5s!C!hrsNX{*~cwiG|ARH$)5Fn-kqqooM`!FB94a1ismjks1iM zmO_c^CD+Gi>-S`5q-!ziR+HirF%{xhwDVdQKc^W;jvDk*HZf_o+DYvA(ZwAeOL!5% zy$&$n)d(*+q-h2O+u;^bUB#RQ^Jj48FILfZL4pr95W$kO$1q$;QIr?C4eR5pcyjG{ zZy+R!6GeAbLHPnS0- zTw(s?wO#S~DAmyRCXZvKtFB;A`1@cF=%XbS4L76?5p-wd-ctUYn-d1^1ACNgLn&OI zs>1&?_lW8HgR_VyQjZ&{>E-3&;)i5a&{0%E>Z_?}t7)qsHIz)jNyX3CT^5{JxV-zZ1^SWAm6 zQsfXL5laLm=3;u_A#sCep7>5@wvJWO3I3a&=-Kzh^FI>ccyipKdE8EZFG z@*xxj5q4Xii5c-)8E-(UtIP1rtz5nHlgcuIjz8K0z?h8I`qLr7zIPWPiG@z|78QLX zd*f;_%cF|Q7p=Ljqu+eR5qXp_5(r2HX6Xxlw_u59Y{K}+*cT)FxSb*B*Cguc<+)C3 zDTxxymgo(wV1@sDmGV`--lyX`1iTiA+!1pEFSOX82CmNQ6iZW&hm|g8htqEJ>Ln5j z;wj;BV?Xg1vZ>Wohw1Pq;)ux%B6S{@d^~dAVqr@$Y8{c?`7*=9 z(%rGe=PM?ur;SY^XPGFAottimGro#ZinBHYxbCOy;G_d=ZYNeT^>!*`-<6QEe}*mn zfX3)^G@7bM1bB`|O_VL`5A7MF?M|*{2(|9OWz@$h4BsT4d_RT0uub~vl%~by-LS>k zrCN$PF5~&M{i2!XMMq9e?LShd5Uj zLrukEW67dVr0fH}=R5|J&Al;@@fA}nyry%Jne*G?P> zLSKem0N@Gx+d@VI0Qa{W@AWYsiTm`5cudFo`|+xhFUyyym3yEqMBdm#ED;|zd0h

3BA=aZE(B1#WYm$s8_Y2+Y*JLN`k7@NQKTW3Hs~HCB#I|~OU8y$ zd!V`tVru_@`MZtp36E(4?0(y)Sta9Gl%E%c-6=R!#wnY&EEOtzM$qSd7(s7I<{tSd z4$zV7$d2o5;ZdaoMj&V#J5zh`kLnAVI5BfqlIthQ`?C)s5!6hM*~zJeUPCjkPXa$nkp2w2DaZsmW>E@X5B*zyBvIBKY5}$iMlt z|2qQ$`P+c}PYx*pYC7R3hd{>~xl+GzG5!oZYZU6WaxBFy?Iy%Wsv?x_+m6O$b|Q2R z_R`wdU&5cJh_~N;YIwm}_|%=s%ED)=V*@aF4rEUqG)w z)B5t!Uc61|EcOtm)h9zc)D2zKMwUygwbmHN=WCqn++l?jp0-n?%zIhKis*Fd=ZK_{Kf6h12lRK0Ic~pSvEN5gNwp{OV`ua zO8}m_vYIkj00C6NKj330oEEE{iccPJhJczF8z>Z!;hO-#*@ zsPh0OfBS8~7^- zv)cY!J5K)w+t}Ft)25A$(?9TEvVb+g8!Ni_dAr+${J!}AGxKl{0Q>8Aq62d*XJ1u4 z@S6ziw>&p5jT`u8$^O#QR$B*z2|&2b1(fJ-c-T2W)ewYl=$GvL6u`a&NI>||-bPUa zgsA`kiV@&uDEBwaY~u?;zv-d!F8*o;f5S$;UV4AG4|Vl)*S^sYupMZ)vxC|nINiZd zNgu?6JV0F?U6j>87#u6;i%@3+V-N=UguV%MG13NM91!mDbJM@!;ijFjP-lf3{BIiH z0KFTY8A1Gpqp$Lfj35mR%fk=ibPyn5Mmhq7n#$_l21_ zcpCoA56s!yU;d_@8~RXh_uu*r@(D|Ka96p((}VDHzd-#zb>I8@8r(K^nh*>dF5ubpQfE{N+E`zv^-Uj=xI-f7fsW*1$V>z$xI;a0$33 zn9G76ez+)H>`y%;?jJr;lu#5=R8f>s*#2MuJCJL4@Z$@({0E!{Smppq=L_bZe`NSq zdx$l}C}IUMfmlM!07k&q->v*Dsg+B#?;j5SX;}+c0$cm5R~*0|^8~*Cp@B1lTnoYF z;Zh*~An$MzI0e837X&4dgUf)j34z!@y?4WPz(2hGt1tib`yaX+u95#H2s6*!WAdg8yf@~;vXz#gR1_^*_(cvwBG5B3f=0BeK229U5$*c;doto;W5n`hCeQ76p#gvcz2CMPLNf9%oNFlPF;#$e5b-aZvo`=#oB{yt z>wn=Gw!y~*T)0;I*ai3o{?#7*<_iH}fO7>AKn~CV3;-)A6F(pfNC2{c5}*#~00w|5 zUNkbTHG6b8kD5<#h<%upVvC{zxr0X2Z$hB`rgprO!v&=hDk z^cl1Y+5~+E9fVFmm!MnFBNza~gpt7LU|cX!m;y`(W(ISF`NAS#iLfl#Ggu9*1sv;f z*b;0Tb_Pd*6T*>jE>J&J;f8QKxDPx6o&?WMZ-j+MdL?PMl(b6M2kktLaRXQKpR6_NBf12 zht7m9j;@1lj~;@aivAqE1$_kl8~QH{d<+&0DGUP)SBxl(Y>XO=UW_@6158XzdQ36Q zTbM4GcQLauUt;!SE@Pfy5n!=nDPUP(1z@FMm0`Wbn!!52#>QsGmc=&1_Qy`aF30Z1 zUcf%ZA;jUvQNyvviNwjpX~G%9`H72;%Y-Y3Yl$0*n}u7CJA%87hmOaLr+{aJ7lD_H z*NiuXcZ5%f&xfyr?}49$Ux7b>zd?XXz)YY-U{7$5pqQYWV3iO?$Uvw-Xh#@B_?)np z@EZ{d5etzTkt@*yqH3aHqFrJFVnJdf;$Y%j;&$RC5*P_Hi5iJJNh(Pl$t1}+DK)7a zsRL;OX$|QZ=?NJnnJk$DSt402*#y}+Ig(t7+>Jbq{5APJ1)PGN;ub{^MFB-G#Wp1o zr39rNWg=xA5j}s_8@oZsOVJb0_ck9hUtFMv(OvTN7L8R&of{!h%z`bWH59w z>@w0aYB7d0Rx-{qp)-jxIWs+G>SH=#W??pFzR&!cd4q+FMU5qtrIKZi6`NIt)ra*N z>t{9;Hc>V=wtTiv>`-r2JZ3y;JbgS@yh6P0yw7>R@DcE-^F{Nu@a^-n^V{*~@_!b<7El(5 z6nG=BC&(e_AXp$cEkr1!C3Ih?OXyNqMA%ojM)6M+7 zE0uRugjB**-l`&0HB{47r_`v`?9|HDcGX4H@2K}^U}@-U>n!-Ll;Z*UHAK-Wp+TY+Ye}VWVU7%;v~e%{I?=*G|FivE7!vtbK<4cLynl zbcc0EDaUlj4JRq5M^4|JWt_8|w_Oxma$NRYRb2~RPuz6e%G|EqjooWK&^)X?nmq|T z-8_4|XuN{GM!h+_G+ zeK3BoXYf!6dq_gadZ=<}Nfu z%hTy1m7=C+%+IolQHleL*Pa_a?<)~4DKDiceNcK?=2^D%LhnUSxk!0=1yx0ACA2c2 z@_Us<)u(F3>Nho9HAS@~wGUnbF9Tj~zOsHbS*KCgRWDj!)46_7J_2#Y?iI&Dz?$)w4y0+YQ;`Y=IjE;L9*PWrAM{m8~ZohMSx7uaZ^`+aS z`*Y8&p5b1N-v0N>@4Nft`a1ii`r8J?2bw>Ket117JlHfOG}QP}=wsus@NmUaR=2+TeZBa0Zw-4bYn^tze1m_Z?Yr{#Pn+hO z-?qHBer?D7!2gl=ll5oAj_l6RuF3AVJ>R|S{iFl(gR(=x!>%LUqlIIS<6kFm3`A8%i4K8M~T9nr4|*n|E8x-2Q0=wI;D)vz4^dwzqNccZ_nn>m2P8<9g36 z&ON~+(KE>_#XHUCk#DBoWB=TM%s}5D-C(W|%#h8{{;<;UxI0b}s*&t>vG49hO-8rI z6yA%C^@+2)Zx!#95SCcaA%+tq|*|JX@b5e4f^S&2Q73w`r zF8c87^f^umbE!<3>5HK9?25L^Z`A}f3bny6U%lF@r)|(}jA*KSJ@MwUg|St=&8t1L zqrLOnJKQee?pr-Jy>{=7`Xu@Z`sW66KNt>T5B3g4e^egEA6^`({uDl{K1M#aK3@Mh zazbsAU~+cq$@Hxml$o|!|1aEMHs(s^Z5QYkmKF<_td?n)7gzFDjlSZ1?f&MshFlw5 z_uU`^HOhVyce86NV4HP&{zv*x)t}cpZ+89mc=opU-yM`6rXK|!o1Mss#0p&>ed=Q znlV}#+66l0x^=f&_1^1$GMF)3G1@dfF!^N$GsmxAKqZ~2bs?@HEtL~^de#!aDzAm?Zq7k=A<8{KD zz7|NUc$;^7amQ%q**i*5A2fR`dR^Z8_IdQ14Jdrz7$hA0HMH`vf4FAk(Wl^1%Q1y< z#?O$?^ApXJ8B<=<>N89;*RwNU>gJN>9T#L5DHl(cJ}9D0 z;d0}N;HwZA6M7QG5toqkk?xU`Q>apgP*qc}(o!N7>0IfP8D27uGwrfqveK~$vCDF( za;kHwaLe%s^Rn|%@uTp67Z?z%5K0#I644bE5F-*h5}%TIBbg%=E^R3zD@!kjkozt_ ztWd9*trVebr=qILsfMR^q&}n3rdgyFr|qJns>=fU3g7g4^q(0-8Cn`i7?T?xn~a;* znkAdNSjgX|ynSFfWcA!S%tp_a)%MD6+`il)!cpIe)#==M&?V2+!%fN^+kMWX(lf+M z$(z7?!Kd6ez)!;O+W%cZOrSy#G^jH;EQBANmvh6^!%oAi?)XHQMXKBtjG~Xmi@uKe zac?%ZFRuQ6etdj_ccSY9mn7$8=M zOTov&`KMb&C&j>X)DoIf{j$^-Llu~nT2*P)v$d=*LtYKnvoyps&b?-QHhZayR@#t?&_X5y069_s zVCnz>w^RTi`5pi;O#%QZ1_0<{1Au`T08Nwvph`3VBx&fM`2!P-&qx7g;94>hs0T)Y zT?ih87jg^Y3(0`gLIxolP!uR5Q~_!Sje! z7r@`ccMxOJb| zV%*1=!eqmY!d$?Tz{EZNm86p^En4nC3 z%*iaKtSW3G>>M0)oD^In+(bNtyu^HD{L}&rf}BF)!YU%SM2*Ds#FZp?BylCzq?)Af z$|%dC$@a?KmA|DRuPC6zqD-wqsEVluQ~RZUpz&REQR}mIzfP-e&82!;WW9mVSLD#&YHoWrI2l&b0@E~V5i8kc&JqL z#j{F`YTw$qI<^j~${eIqZVFG#`-+$W=Y=8xf*Ej+9!N|b}U>kx9#siGO)qf$R12PY} zg3^L3dwXa+xRM`*9>b`>Rl6%J9US>pI2K$OZUe5!-@v~i2oSOePec*oGYUG2G)e$U z4azzy1FAJ@A?hL;1DZ41OSE%z74$6h4RC$@2xA*l1+x+h7b_5J0b2#T9tVk&igS(Y zi@SzrjyI04iQh+{NYF*7OgKbjK(t8gMtnw+KuSgWicFPknLM0=f})wyjPjDIl-hs> zPV<`99m$AXpv$Ed*#p^~<;s*0kjoSL+{q=vYrsFtv{ zppJkp-z^?JF@0476GK;{aN|^yV$&wG0rNSFpO%0Xfi;7Tkgc+vslBJeJ;ws4X6GrF zV>dE)2@h+}IIk-2ai4QPdVlo*|G?s)i4crXg|Mjb-U$3i`@8R=nPW0yG2;^AaT4ku z_$CXcoImVNPtS13lFTN1a*{if-&xpF)LPtG(qA@FzFv7*L-ta*&a@$->G_+XmZNsM z&Rg$dx?6e=`vpG)4Rwz&k3JYbm^7Py_l0Rbe)0Q?`qzqejPE>K+&@TuuJ2atI~{Ty z!%yMo3Ky%t$DaV4JXi_B7UMV;s6o~k}gsYFqSYx9!Vigu|ruw zL%%t>f0OC89|K= zOkS8?o10rSTT)xaTJPD~+O;^~IXXMNbD?q#bDQ^2^sMzp`aJd{^v?)54>Ag_3&jib z3jY)#6qz4|5gi_L80#B%6d#c={(u^sJ?c}gAF8E2N}tPM$aKl7dc5<5C&w$dCU3id zyD<9cmuKR|MJ0Hp@h>pTpH%WyeXhCtlK<6aeQBffYwkBEEpOW%bQr#+eYeqF+w0#a z(tq}$Whi8rd*thA?zq7O_GJHb%&hd6v-yTa&tZ0ivl!<(dArrT*hT7FLK ztnaSwecA6kczWo4BzJUu+AM ze=~ak5G;8x{J3y^eZUMlmFeJi#su$ zi<__iBV8{8ca?%&!1ark7QhY`p#ca80r<)oyvt3@6hZ;UId5P9P=`?d1M5Lp|E2-g zHTPY9zhJ(hxp}X0lWyKa++6?l4Jzh86cSJWdL4aJdh=ESxc&mhb)gW*%|8_U2NMhd zyGbZ;I1GV`0tWuT$RH{jCORq_1{w+qIyShA4-*Ru3l$w32OA3q1Tk+Kxv2~LT^E6g zhJpsh^8R0@>$dMbVfQ9MpfETBv z{rH5$^hX()S&y@yG`A3h~(3XUcEzS5YXEtw)GvwAYl|-X4<Y97Qg~m z+faNMJ|F{JTmyUIC)gey3D1EKk?{w8lP#C*!z&It3;n)gXUVp~wW|DPv)+-Dv|l+! zg#wyRLzcplolKJ&jMAcCMZ+}LA-YaU>57Xl;4*i>BXV8&}R|bFp{>ES$-l1{Bmj!St#>a z>70dIXoHM_jc0j(^H@f`>yy_XEN1tGjCk}^IElIA9jgaEz;>DdIXlt3Xh(*F8;Kv;=_Nho!a#7Q(IU^1U$Gg`a( zb(x9N-mF|F%Prtab3dfFM>}YM?m~-Y$2==XHgZ8|GWb!qjvE6(yZFj0>GvC|>^QhS z#&JErl>BY<9&;yS);KfHe*cPNW^^Urf;(H-rMLJ!f?#wIt=iMlyfs?o!!ogpN(m;zhA0#f@6nBB(JE1quX3ZQUY?5E2)Dn_N{Ny zCshr~`M3994eyGrMoWpEwBxGYS0DF((%~wc2hgI(MoHAA5B=l<%2H>Ia|MtgH3D-}2bGwE7y{*TaK#r_g8Sq)x6k zWUfU5-2#x_`(b&uN2!hTlNZp|b{p6c%o5S_z))Vbf~2qHm2Z9&z_^u^(5CNE$3?^~ z?P3y9ew+3O+wL=L{&Bs%*hCA=U-<&RI0BFMZ#krM^|^ebPQ=X)prVOx-XXH&7UY%B z8;U$+thGDcb1mRF#jP}DL+5-&ryVN2_xh+em~6<<0zn0PQ1>Y3@u|hcNbPcH)BDLp zwFBSUcIQidws7S==mpIwLv`@uTlJ6iQk7nYb+S{zBr1|vrRv}KeS+ki?({@9IQ4iX z(XeV9fm=-Kcx>WLdVO3tRgdk0C7%6~=Pw65xEj7X?e1L3T+O%_*4tl^w?~_6`EEI6 z6~QZ`i;UM9UKx>XZJAirll~|w9$cRKbj2|vNcb-6b!!|Q_mrphH<|p1!Y)x48~$F6 znT7q6+Imal(GrKR<5E;Ryk&_WiN&WMqrK=b4>|}dYdP~5PbG_(B)kyZqnx?W8sBjo z_xLfYxbmKsT}=*a**-aeE{cKWu5vK7^sCdLs_CsOcvHvjz8ZDr80T(PLc_fPtY(_B zbK{=K#=;+{OSSP=B;(;M%Xb7fDQX%+5RLOE(^=EzUE}Q3iDHZ~p8|F!J64<1rC8)r z7H0W8;rR55qIl1cN>()}I?dJLN||Wiyt`Sdo;Mq31f6klUySY(`RJD?RuXeNS9^KZ zmK~L(u=IV5K9zjEu)fe%vCkM*jv1BTCq^zbf7+^hfO#-=;THYo;n_|%PAHVm3ir_` zgYxO+zRzoEA5Qy>p|_C|HsM`pGqs|H}THnG-xQ6A|0umk64*XtOyp%UVX)=!IFkb=+)% zk-L=A>%f)J`E4&uj>+z2BYL$rBEhvHcP<(>!aGP)ieqc_N@>2g3bA-h&bmefTum?5 zai*UZtZMIl%iSnotN^t;3`eJs?mv@Wx_a6vZ#fsN7R`xW_W;JAW z&g58hwmhLv9<1-zK^rDR$U}he9+J0vox~+4_Z!(b!_X7bmh&;he_6ZXG7~6KcNtJyG=JUHkuO0m&HP#9(QD!l zT0tE~$h1esNAs$7l7yd)#kdYak{cchjI~t}w=M_n{iiwlIo!EqQ1r=f+o*9lVYCZvah+@ za8q&$C$s8nW?@0TOrs=9nOL(9|-?eQ2L>z+nx zCO3XY92F{qZ&Z45$LZr`=Qh8h+(=T>(qhlzubHAbgejE;2A8{$ePy`@9jep4hs~PsbBPo?Ov6L*MzvXShcH^qWEG$#pM#iHsN6>#bZa*9U!TdPYwZkLm8c@i{YQ*?Y7c7yC>0 z)RUTF6%oB<7SP@`uL4hRlXK9OZ?bb>f#fEw=CGEqr{{co)WS~NlAb5%Rx#IgD)LJp znBh2LYHdOqcjM!;g*kIdvD-W~Os4caoi1vO4l*LhRR$K+N0#xk)!ogGPX=saHdMwE z+2pk|Laevjk~t;{*gZ>J#MF*FcXn(pD}BD*J20t80zyhDznko@C9+?(>#RkF@qJCT zyPo;42a^7`J3kfw`_9kX#AraZrs1e?g6V{KhabKuKW^ti0)@le3`E<>z_8V^E_`^MH|Cjj=5}b zX}MeJl?Hu&t7CxD9?3Lm2W>gSn5l7LH*>pGXKymMe@);mXU3jf$F#oHwKL?Im8oUh zy#Dgtj_@``^g_7uJ>A3=IPN4|mrjVV7VC4A@B536Y>P__t!^|@jn&*Eq>%2&3VwI| zk!0R(UMeR|_zNp~mnY`?iJ_#46%S2%@f$q*_!XD-7I8BjN;30YHni>N$FE|lu|4~N zhs#=}vf&-XU3+w+(U>pz|Lpv{IhOSICgt;N#wlSKFlKWFbz1;L;3)&FKkY(3|ML`W0|W8Pd}Hh-B%}bm+n3 zoYO{)cSva`{S0N(a>>ch6R2bylwDst;5uo1nKF)woX=OfY%68j&NojTlN6Nhn6AQF$d zZ=W}_TNz<&9iQ`;a?^_rN=h+193Yrnes5AvfH3_&mV^tX#QME+SQmkg@$xyv*seN=GrUB!9~FJ-ksja7;}N_wS~Q4XH$Dk1HSV44 ziL5NdPFPw#Q7y?Ovq+uD_>O;1^Y~CyKbc5=`Y~xXHp^R^UZU zZ~y3z?3lH1Gz3_2gA3V%tq?&*MZfx!{+5fO*&p%?#=;AxQJD;w8MNiZ|#y4iP@sPA*? zqWoYgk|3-(y5s+zb?TZUD-6`*v^Id z87z+KB4~>pKM@2h_l6-0Gkd9Z*95p&Dn19;?HYXsG&SpZ1=@qK9TYWJonyFPvrYC1 zIbGo*<$aISoN_fB0%{J?p&4H-7B@`}%?YhBw(my|kGYVRtKahVht1x>`4pB2{c*vO zR<$XpaxDlUarH|^UEjvm<}nE;JfUjUkSXnYvinYzLAQT=T#qaNTBQ^&@Au76(-Tf8 ze>f%ZtOHe;)c}o3b1wX^+!rN{)LeB{R_eEY2)GW-%c)x zgD023tp_(}mVTdvMG#}4qhTU$&cOnI9fU;9;M5R}m|oRe*lFM;SBo-{_wuy%CH`S!9_74@36;tTZ$W67cmS;7+GNeNXID=8c^ zm|rfLhOohx$fBRbBCjmF*o5}(H-w&9Hhz9E^o6RaFe4dxc_w6%9g)sAV(0n&5bK1x z;^Ecs6f?7POrdQXPr8L-7@P4{y29k)Gru8RN{MU~p`O#U+qT&zD&OSFtjeY!O@WU> z?0%r?uvn9QCa!KQ?%aG@lU+aWQkRk1CP2m1jv_Qg7HD*kVpwamBA1bze;+aXXq?zJ z%T33`A8FKiaoDOD6h{1X_QkMtrfD+P08m+s&gc8X@X4c~>X=yMIpfiH`67{D&y|jt zhuyX-a;>M0GTHd6a|&965Qxo{CiS^~X4Dn_v!N`k`id4s?@qn=$a*FG-hGcn!tV*} zcYE)-?sih%>vFnFOWP^!Vt#!!+E;IFv&5>;nCn*2)pAdT|0;IJDH*c><8%M5alhD? zJ#n{39t1+8;#PV4rby!>#avOsr{jVO8z2`rROLC&&G>@+wYw^_eo`bb?H?f>Ix#p#pEHtP=l?1dJL&@ zB2^lAx}VdntB{KIfs#`dRoJ{gn_WC-A!g=uTzuH;Fs^!dHR&@=-q~>#p1JPRYr9w4 zcdohcj2nFyIFAY~t5Adk;yc4hxcoUJR&OgpTt z-4BR)du~Ok_NBFJ%TCX>_*RL-9dr{5<8NlIvn=6{QqidBT7R{umLSa@DO6AJPOE2G zSM8bSWQ09E7`#6+F?U{zPQFJ2o$eQWeCa#z7L#m5>Kjdefr+I>f%ffKVC(#b z$ZDpRTBf$tzEW0oLL)RiMEne@eyyM%9wEZvtVNcIA*~a&u56!DYGvb2Yc3xZR1J`C zp=lqSYQ$V(L6W7CihR$HyXqsC_{va~gDx!tE8Vz9KHoF(R)CYf)wcfhX*k=d_od>a zlFj23R^u$HxRh6nv{5hr$2UoB`hydYgKB7 zXUD>BmIh4!T#$-F*?<*PeoKaC;#<2J4 ztAvM1vA7nqVH|btjW56QFj3bHJmV#N=;)(Z^T-;O*JOIsr**r+q1oV zfm4zbu7ry_*XV{d#N2Hq6V(WN?i1H}QW3lOD8nX%rp@WhM?A9!?}Pc@(^Gm;Vs4Gz zO3vpodbWjX7J2!Af%$`|jV2b3?N;;1%bM5Jj~X~nO0x&~JrzvuY!Hk((WANAUOZ6q zEQ;q%jUq56Z5h9P+l*TnAZK9}mS<2G7U5j`=x&;lxyt82P^ENb)!oA(Kk~UdpWfRg zQ&o6kA=40J|8%{-B!@s4Z4PfiOFQAh8@oi^--2xWZhY&Y$R`um#3N0p=ncUt@(HavOlUb62osmr}P`WANIrNGYN!>RturQu3e z1)Jw&ZL14A$E`Zf(G60`J>lH_T7zQmCSvW=KO`4>lR$bd zZ4|CpKz*zmygjAF#g!_FJ4B^5uJ?ds?>(^~`Q#|HFeE~ErL`g+T`!BZ3m?=t*Z&yTSue>uF+n{)VRH|Oxd`RWPi_Wrx& zs5r+1(moT)V(U3Q->`EH=}by+JEF1KV;Q{<$Mah6nxv=yJcC^z@2q+OHP9b?QF1o! z>e+tVj#}A~@SSX(OSqK|N7!4&#OFF>W@3Xgd>llRF-iusle?h zxa)(WsWYS6lH8pyHQ%UzF_=V*E#wDT328PAetlp~l89BE*m-7INuxUG)KXM#;-@J< ziTQ))s`t}b=_?BZy~H|x^Flm@#td z8~-8i7TR(7ZFu(+>ho({GZjOG##EIow#sALA0eFMvptFoc=SlQIILRy9E-&IJ3@=2 zoOXs(HMol_+p%0X&3^v?43rbF^1aAl_V= z51;c8e=x16qn5h=>5cQ0SgiI-0$>ztTrI9xZSA#!9BK*L%A+wzQ86jGYN8b4Bf_FD@=o|vE0~unY`1pn|yI#spgXll5KJ2%v-vMG+Zm2<5|K{Kp z{cjLJo%sib|KFd!y`lZ*1TJXn%!TBlL0ebXcbJz0r4W~(m4ZiTAKB`}j$XU= z`~a4`6Ng=p-cQ9K-MII|^Q+ttp{DD8#^V53Nm*aaE`)0i!*WMe(?t9oWlsr}Bi+Qi zRXn(W3i1BAr<1$otL|}jqe^6{hm#)p9O<2S2de<4f?2pWaCue_8~bysx&s zv{xKPneelBb>$}E(Se;SG|Mnv|By{lq^b{bVw>OA?+t)wOMYlTcwX9z~U4Y@5 zYczxACtcXFxr1o=P%~5o@7b*vP1=O0bm{2>HtruS(y2LiKe1le8**cNHqw|p+FT>J znjbm|D4ICzTHVaI(`ZmKUW~ORdmr0eCN5T{g}Kpm^0aUIJ7z66=BJ<+sbh#C1tyLw zyv8*BSeDOIQ~y_OUlmo?wrsl=Zowf)&;)lD?hqV;ySuwf@F2n6-Q9u)hv4pR2@ry_ zfFMC0WN+>{_uPHrI#xQw@kp31ag7mHdKr-TP0pwrO2AIQROd>L ziou@YbP@+>>0%cN5H(0F%5`uqzJw}Xqt;kG(zZ|8_ESzA&jhZ}D>?Z8Mgi-D*;9u%1+sYnZdx)jh) zH28xFJubR?h@#4gGe(bP7Io;)Qih-6?fObn=Y%dSILYg@v8KrQ7A56Fl6!EO$&d;( z^T`?G*sX5k56pWkc>x`U-X{TvTm%KzL9R-{tRVRgFhiqhaQT2Pg{`A`EfH^W15*$L6zttt0(!c(i!Lqv>yK3Yc2!n_K;VfFkM>)jvaVHV74v8J^Q;OqWqV z-K<8r5oPzr!Ntj~kB)8*G?qi=LAm08cQaX-;0O~ei^qubeDSUM*g!zoWN;f`XW?4)g%3R6;N)eJvOjro~|WonYg zT<&UjR%Wax0tE}pKZDg>4P}=&vhrwok@s)q^e+20esy4LH7$2Vd%*7PM(tiVvc_ea z+Vk;6#%V5AQCzSEl8zsN%;@u=No&hIGz7dNJh~4na1qH5cU}u}ZDEn5f4ahC5FRmV zZ22G#+Q{q2g5=TotZ>Xn^eTIL^nI{k$5;%HmZ2k{-G!}&7N4dye06vRQ^bwR zlKObZhrg>c79(-Zk4mj zh~B9Fj0<~^&iTM0Ki|_^@a^KbblcoJiwT_Qqpj+FTO~3VnP_^$CNH6b_8socTOBE8 zkIRcRyznn4?&$BbIiQL9wyQz99r9^Hx*r*gPt#Ki#ZbIRB5#vGb16WtA^<;a00nf zzjUG5S?m1CpJ3!hh zuVpMfo#6aQ9QZ7II3l^=`fq%l93zSDF)l6nM&@3+R{O=^`Rq|^BwXJMy$|$lqnYNF zJ;JQU8pNjVJC@Z8!NP&(M!*1cyX<fg8^h-z_Yz^57S!J1^y6;Y=i z)a|ijDfh0pRSaM-?2d87FXtNcL}1ZSUSuVnvas=9Lr%lgU=!|aFdo^gtgLOfgUxim%HK*29t6Md7Z}?>D-3R&5-wk2@u_hPn-!+m ztk<$P)EtFvLouq1&tu>{ognYoD4rBfC|0P=g*lUme3z6*(3+1TawI=T4~+ARv8*Et zH&=_aPxUiCAuDi!77Nj^pSMD;v-{fqD#_8<3nf-6V0cL&ok)#o3tnGTI=g{X*Py1S z)k83@^sEYul*>9M2ZMFWBqv5`HGWdkU)uTECzaEQj3GFnX;~!;jWFBeg)n?)y(B*W zK$YE6@{IPPdSUYIU_>KIZwP0y+wJi9(tB)FG3ryc$uJLv`j=O-x;*F6FVeN^dBC*W zF$&W;jIk)8P-vksDw!zS$1}S32rsuU(fQaqJPI|aC2955B{XHdLFij7hlzIrJ2{#R zLCy%rwLGwR*%b+J;N5#yQ{-zSB8GEgoXn*g3fdwH46xH0+DU0d=|m4mZ411+tLXj6 z`O2@#gnCZ8F3RgrZjcgV2$4v}3kXzOaX9eB*VDyKJ8O?M75OQMxyZ;Zrg=bF18g^? zd`65(&T=j{2Pi#QtJ4pPt{LzY2}s2jSRPj2T33U?27cVMlm|C-MH{D*?CUz9KjT%l z-|;H(ztvbzX!$dYedaa-YLo|+Dvj?%`Y9kt{~`cY!prO)FelGU=!dtM@)-Vd$x6~FCLTORb7tdjP zkCh+}0yFGa+rm1rp$hn}dg(J1F$fX6~gxufg9gTAzX zGXt(iC7pN#2AY&A5f3C*x3xEcu?>sKImEEE;7L%B$L)cZlTFRCS1Yf*VzsL+uCzb)!ZzquDgZ5dYfZP=H4hA}L)4_@Fcty(o^}z4 zjUhmv)Y_RP#AP!TYgPFZJ-TJMrGow{8V8)Iw~!$_{br8Ps75&Bw7AYq2%d%}EA=i;Cv#$10WKKPpxTT~A@GhFLKX_NlMOAJ_lOij|HM|IlOD+GS2?JHQ1Bi(RhoF7hzBHKeCHLO}>iMqa53T^P}U zT_M`XQ4-3!vf3dom?(r|xwS!qV&xfqiH@~~%&Uo7PrsGmA)!UnbgvZa+r3hr7T~iV zg?TzL`C=XMR|a|FK6955V&(J0xRM0+=?BQA6{Wf^#}o2JGWs_C9CmY# zPD}f0Gm#J`Y%d$iu9AC^&Suv39TY={-v}qL zJMHjS0FIdcuhTk&qF_etCf70P5y>Ts9cF-Ll8UMrw46-Y(hG7aF>9?CV$I7^e2oGq z8w^}Y)AGG7({cnPo`V>WTp`@PpT5+4xR|UsifxM5yo^v3VH}k_294|_x}0c3q9CE> zechER8d-Bp`Gz(dpK#A~kkb&4X&T){5Z?hCrTbygw zOr};1>RmQBBiqN)-JcChzw)x!(s9Qrssz1coV1AcK-Snu;~K@WO2H2ogP2}NjX>tO zUiqd=^5P-^&1=V{csSd?3R~I#XXC7=)~=4`rZ#l;whq?jfAr4!-I?!iTDn3g{SIUK z9{uQFK^+=GM@jJQQ;Z7_+ywdlu5$fFr28b>o~?tz3>8q6>oON&k>Q7ioEdy%Y1d4q zTx8-K8U>X)eYlNs;RxK=&zRl<;W}54L7kNlaY(OaU{C5r72!AIZLzeijWCyzC6NRt zcMx&t(L$aJWAIe35;I3J_glB^HJRTjE`2z@Dhp#|lK}c^6@qEH-{m%&QNrx3@C!jG!)EHuWr?b`UlmkH-8 zqZ6H~ak9wJT6}WF5qy7i@6P>V-Lg%uqyuuY4yOdJFJMQBi5DCc+5Osib#+%;NwVDBvJfL|BZfvVzw}v$0fx_b#?LdUjs1iCrDo)?$lfNIV7??zU)g%Z|PR>t>v>O zaaCPEID1(Lj@xbtPkYFL_#>*<<=nK;P}q>{eBVWN(6PT}&m@L%Q_&na7{}(lA8VO% z=r*%}L5zhDEYOhK;20?(_P)dPgk^KYFVZWaq^S*Q5$ z?B62_edkSl%G>Lap0Lg~*EX*Wxj@}$`=fqGI(F7ZsA^V;mVcGGVaL@S!W%2?VDlr3 zoJZm&V0Hmn+evK3xkdE_8s-a3Izz99PYZ|Ur&;PHi{DSoo`cN`ctMg=@*(fj6i9YfdZHh1v3ArA)S~v}s2mG95JTq;nH}ES~ zZeL2L6A2Ht!^dic8BsIG<3zHmybCY#qcRqzjVHwSgu;oaFPEJyJqZWmjbzM^?lg}# zYJ+SSx4cxgXXv3&&E^?y=ylJ0>G2D&=b_hO7&C zkSJHtOv>B`?6yNbXYwY^%m*7Z5XUr9)B$d+E&FyQD_o!lGTPtTe>)G4qt=4p`0f&) zaM-#A33l2S4>b@P$MNspxq$o(8os!tr$?^g6Kc<+)boX2;;1!)w*as+tV8`Qtqm+f zOIY(#$Gk#Q+Vf$z9($=`v70jH6XX07>?#B4yqn9L%TQESS9YnxLSAS&Q&8L{I6uXE ziF`p^EBs#nw#0Db8KqCFpMEnf9H79K-x-82=U+@Q2lC@1yhHR<80v?63p>w^H$Z{I zci#DDJqMjCpuF%@vgBo24#Ut~_BK%mY=$0Y-gQMP;yVO>!vW1gL!PDi z;OEQz#Nm+UQKQa6eN5AD{4xnDuQOS^=OsRTqD04vGN+Qo-h`eAtqYiM}C<`SQi{Ln4vaWCA+3YsAl2S+^nxt-bry@s?TJO#R6FD z6hLcM`iWtjjMIb^zc*fg#_G%{#>%VMBoE>+IFEI(>0U=l)F?U#o%JVU&IT|quN9Xj zMoR~F#@iW%w?g|83Ehye*Y~&o+WYR|FtU9|beGJc<)=W>yh~?Lg)ecBYhJDa))W64 zs+@ExsLXxSB{4>sm8`&TEIdt_Mh4N^)Z}~JZOc)L!*pyjWw<6^x$P4aEsm`~n9SE0+&Q|5ID;)NQ7OKM1LG0I7jPjN+;)^%C^G1AFy*8Za9r23>vgEo!>-u+o zH;G;Q7}UczwSH&WwN8uaFVcQ8Ect)8pM~Sr$5xyeO|B&i!+8m>WbhrjsSIgL(2dNP zhVbOmAjEyZ3L6q->G(@0$58^wdq(5*T=FaIsL&wF1)KmDt@)MNix?ipLL{$373dZp ze8HI{C9AlZIR@Ji$cUCg$)VaN*Qya|Q=5U~Peva~mGWCWp3O=+JICz;jY8rRWh3zz zb`PvEbkfhqO?4H2O6ra``th6_w_&h`L9Y4Fak<97@rS_ z1gM)b-sZW&-iqZ#ecXt^9jkk5J_0BGU}&q$&LL^h;trM`NBqGj*3~sXY;m*ZT6$W_ zs;iY~!_!U!jL4$I2`|%o0gcbJw+c*BTQ;ucXEeDug(ce(=Fd`K(HOMx?=zS1Ua92u zz5dj+fT_ZTuq(JECDW)FF&}%}j%2ofctkg~K-;0uAHPpSGcM@aWop3DOH^kM8bfn6u^qWv*rKnvnQ50r4!Q}28JF6zPBqP9@Y7Or} zp}#j+>*xD=ZR4`^(f+vC@N5i>_^=%hqxSk+4E};*l@o)#O5m+ZN=+*bq`fR9Q5cpH z%`J(>N>vpczp8*7=C$)jH=foyX+@CpPXR=#`8zB;TQ?(NX9=w66P+} zjx;EqU}R>agk7wI{R)LpL1dK57O-!{_JzW}ysl>`~q#05~2!*zU zq=-d)FdqCNzbY|J+sN@Fo%ov|8~q1$Mzqt|_@PZ!Hr<8~tR;a*ik(9wlu&t!1^)Y? z`&v4D-gZfyy0Qi9FO9oR5|k_mvU06WE~4R<;OTB(QOx}iq=I#2MGz3ko1y_FP#glG z_JD{85W~A-RYQcrG1>k6d8cJH^Fml0o?k@;48{o*850{i@OJZx{LnCO)2<0MI0V0Dr;X{}gBjUn(M8!XTE#T6FbeDoeW6%04@!e23 zUc{Sp6o$3)fC4ExkNuc^Hl;!!am)|R3Jj)hmN+-{fjj685bv62ZX&((D#a8M@Qm;* z!|<$mj|7qNMG2D!jFM26VuhnSG%ZKP;Gxn>zjdm??!QR#^-!i)FhILk1fT10xZvCQ7di*hr@R=aQG5| zui*2KIbhr-F3&bXcBE6F>sFZwDx%stvoW~wXJn#V@DI5s#@J7#$#4>G_c<00XjOl` zG#JXggQ#s5NU=3{stP8sutV6O4N1KA+WU0DZ+Mf$5umUHqa+a&4&xl$>{&tL6irW^ zyQcGb$tkL}xJ83Y%%6e#o%SdE4X-cSjgT0)8Vf#Czr;PjBp$x++uxCshti(7*UXhr z#MWe8pY*0)yBc$87|SIqdtpBmiH4Ef%i> z;fSL1{SKs7+$-8bn6qnhsifddiJSTHA_c_%x4`@m;gh2h2F%6c zA~a6gngfUFGR7rBvRaLP^&;lK6_@8G` z`4T6TjpU}6S&~$x?~S*e2Bv#9#e>UXKfI)9R-P#3zb84YOZuSNSYWT9sos?jpYC1c zbB{4YNSml=_Jj6T*zJ48cx>cXG_+#83=H)NG!HYln^IYM8Fg|fGhY|WLxjzk(lVGO z2ILCv^DhY9I8v;un%7V=AH8Dv^;gC}S5!{K@w#*&?cEJC;28V7l1UzyF&g8;!MK0Z z=_*Sh30^yXUtbr^Vmo9k-K;S&Zzp!ZtEizhas+aA=7Jj}8wfYjVor^FFxb=Mf%UEx za)uG5WHjD6Q_+RA;-DYLp0cZVGzMo5w!hmhROT$7iH%`;A4sCth~MN8>#hXDlksd& zED1ND!Mt>Z;LO!mC|K0*H){`A9{JSnA7l+&dm?MKF{LJGt!=)L2XErGHM%I9y$2)(l;QkL}oeY99lr=QLhNpo6 zLIIb=P#!yW3gCDv%m=3CIBBgpI^y%kyFOrgGzu}fRdcmH#L2=M830DwAj z1${GTD`Gi)8zbY#;=bMQ{|@?Qe_O-~NrA$^MgRytLiw*o3k~t~TEBx$$ettrKT;wP zr2mo?f&KFkoab*;nF0i4mlCmA)HMniy;0fKV5isIBF7ViwrN8XMu;P6ybTcnmB%c8+3%<-zG`ZyzvyRmg*TZG`}zYFdW@i?n=-d+k~mEbBw+ie`N;meAx>GtnOxge8)gQo$+8R z)|G|-o@*#Q(-*SFUSH9$U+_ya%zusGC2U#=txHE&(^V#{@=a7c81*qb3Y+l{yul(q z;f*&>5m?m2Nah)=>@1-6(+Os;u3 zH;5;3_{TD$|A4oYM@liIryqC}hue4>iAns$gGY_D3L&{&>B#Yx=}z%59n$Q+IYnxM zKGk;XLOX^ruf3SDX83UEd3OYBDow3@uKeZ2TWH&d@2V;r3BwxD0!H}VO6XI?zFPAQ z<_xBX-$fq2%U1hP#eM*F)1P50*`dSP=4p%4swx|Vlv+DictL{oMq~>XLIQ|Q=Mh`! z60Vwu%t-tdTTF5`+xn&n;got(Jl8@j#N+FW!aJ4)h0WKnJBIo_e#hf3=il(idrwl* ze+o=xauSl^!j{_(DBGu>ZxeZD6Z_VKozh+VIjR%EtRE^sncMy);#3orH*3t~?I=50{FGCM4H{e8dl)i|(Y|I0 zf;y&)Su0;>>LU+b!~trZJTl1zGQ3i9?Ei6^H*z z0XXwp06yh6{|ZWv#{4+te;9MODd6w&o6qPw%R>T0?nL$QeN)?X1+i1cVG>;a+ zZEsU^S*7bv`5aE=yBIXu5VYx`+JL-ESi-Xq@U!#W0I3m5gPK5FnmV+u_}wYs+GY&6w5pAWDi8N_6p*x!a-E7?sxsn z^q$0SEt8NstqSwx#o^Tlg$o5iOZpLSy1Er-O4ym+t7Y>uZih_I!+0s&IS1nF4G4Mz zxlJw+MDnYaIcX5?%3Jpsxzkz>Yaau{L(iGN-wV$jo9` zflmG_O{jujF^Yyt3MbMHroy}eK3>uOFC2{vh)v9IPU@yJjtylwOzO-8-*VT#EqOs2 z+VJc}o@C&kHe2mJX8qQT!iYNh9^`g_t*Cgfnwk>IEPPWyEjB64Na3g$)7E&SiQ3EE zhZO$~xoRSzanV~i#ZU{)z$u(8Pa{I<{=No|z2O@4>*})R?iD^638Jy3eU(^0a5ARl z0!sGweA}%kQSn#xe0Xe*@5h(gq?t{lQ>r=SUV;IA674iu4X6iQ<%<$N-$Rgp@mjY{ ztO)4J^w!!&-%)Y9mwfLN@OEOc1ayf_suscSH|)|Ol+N9stWBxA(#1fw4^*fO7G|}n ztj7uj8vMd}C)bM4Ee%zJ(&rZ;vWVe=InwHnBX)yNNO<dv&`4ax+R`QrL=qEsmqNHf%$b1rGhK<+Mp)7LM~|FKWfO`8=-A0>~U(^)Q!}eQgpU zjCAEgQMp=$;0VGXZ~WfUCW4=b!brb5HN(_4Qr1>Hw5<_Q;2uL2X}pb_)~C+njSKrQ zEZTcnmUQ;!6O-%u=a0u7ik08_H82ld`%x?aNEvrBz%m@s{|Y}gi%{MMJqW>dj^y|4M!YY`^O~|Y@n+&tO`iYAluqd)IaMT zfXd_e)+vXi$Y?}RHcGFi@Gd!+@wu`1)!mcB zFnJDl=ibi5bRY)S*OO)u_GIoJGJXB9FGiRA8glmpDt^aCz+6a8q~4P~SX_%VqC9k3+#&jv$~>w=$CL^JrXH@sOfOCU*Em* z*Pi|2ux>4;${paG;@)JMIMZtWoQFJIG44?zl$Uzk`wKu#bSo%cM9QxI)c@km4`n_I zHxIr|oWT^LD1W;{A)^eP7Ccg@cQkPe`W4yV;5#7E$epDF{4>$VywPLh5xo>7MxvI2 zQDQ$86+l8r?_|=Jf(CAU%LQBKbAK%e5WGd+e7#dH64^u6uRK(ga+1~2f{w*~JAZQ| zKQV@7rM=O=fvPJTCs^&59IfKjrELb{=RK(t3zfXGODMbdH&FV z@b;X^o)i!!LQMS64Rwj20rYYPJc7v6;bfl+ZC_2VeDT+Ou;Kz_IU#1QKD8x29T%~^ z6>ikzzJzf5rtY)Z@fpPL6b0)ETP5{Q&D0J+tjRI5{xhDN=t$&i_w3`y+7j zckPk;(OLWzlAs};X8gaBGyhg%KO=9Q2nq0!fbZx$X#@;9$Z-MCE7R*9LsQ=}@1IO^ z^`VfC!VHIDqa}o+BAquFO7nAZX=R(+eI#?98-c=sPg^eOVecs@DH3EhB!Oo=D(ppk z8;M`Kj9@=W;s^=s_nK?datz><9C&^4uHIMrh|wrZ!M z6%$?z#(L-PT3GkeaW?2@XItH`)vRYf!oe=n3(#`Le@kq-%$LT3e%Foqi?2%qvph4^ z5-&epJujSpv~Z(`l>Fml+s<+&6)r43XH2J(Qerq2ans62gD=h;iWM?IBxb~TqQyFY z<|+76X5=Osw3g~6!CqbGJYx?PityXXGJRyIOzr-mJ5-uhB7TbNk~b|iBgZ49A;$Ba z+>0@hN=p+dj+aAKC&`&BP6aHq1~1o+N9ATI9E0JXf7Mxzwxbl!s+CNVXoak> zU)gq}(K1%^;A*)AxlEt4M%)u2+R9d4m~>`TjWGtGOrw(R&7OWwJFAGq6mr;PgvYB%T5b%R=r1oWSxUi*ntWSqWRLXRToic}YN*Itd z=sM{=jS`bcj|PS@V&khoGtwtFDb=e^?-j7z(N)a+SNzVuq-QYn=84MF{qtCn1_*(LAw z29u_Ytj4~@`PL}1Yo~_py!@UTM*?1(4%oOz%NBbzpy1olW5jZHy{eXa$f6Rq>d4X- z_9k?%fR!n$HJ_zoGNZPhB+9w0OGSll{ZC?k%Fn?4&d>avt^Ll=JR20X2jV@sR}NsU zL4y9{Zmcw2hSn&!_rvgg7*33WoUX4&4pg#s*cn`%Y$>`eKj*2s2{V*3w)=?;<`$G! zq`pNA{Lhqz$qORnoh5IUi=l6Bt4gD5e!Z@HU*J!+j^GOv;5f`mqA(GC=gM(H$9n=y zot2|4AJWAaJ{8a%)4ZC3DK4*MHky+rOy(5t^S^bmz#B)l=bfrr=)9n>&E<1XQ>Zqf zZx}Fo%unbg~9-({}RN=XXnR7nV48J zSwy*#j1qZcH#XNRC|2>GSEcFNcQBCraKvcDj2;(Z*f-}V3)N!1sJ zyH{wKS1D0T+HE%I>4idHdn<0V{#1+*Wl}&gZM00pUPrRbj?;*n?H%Mz98dT3ZcPT(4@!2#J3(1xbOS3C`1k|9>V9*zB?12{CI8OPJngLi zkHwV7{ESIYlh=RG&p2Y|4&`W?36x0j?F99n<))9G)7o{6VkhWF_>S)7@BT}EhUzJ& zukc4s|8eWJf$ihQ>!;Hq9iA=)oc}nj_%F_k{HGMnUkw-<;_1zPM|IG7sei6o`M3P> z{FxvVfq;X3TMWIZz#O)Zb3A*9j%f_#gkKlSG+Toi6avN4ErS6MCe(-#O9S#S`VOpK z<;$KaK_++H#z9_Owgg /dev/null || mktemp -d -t 'tmp') +NEW_VERSION_TGZ_PATH="$WORKSPACE/$NEW_VERSION_TGZ" -CHECKSUM=$(curl -sL "$NEW_VERSION_MD5" | grep "$NEW_VERSION_TGZ" | grep -v "\.asc$" | awk '{print $1}') +cleanup () { + EXIT_CODE=$? + [ -d "$WORKSPACE" ] && rm -rf "$WORKSPACE" + exit $EXIT_CODE +} -GENERATED_CHECKSUM=$( curl -sL "$NEW_VERSION_TGZ_URL" | md5sum | cut -d ' ' -f1) +trap cleanup INT TERM EXIT -echo "Comparing checksums: deposited '$CHECKSUM' with '$GENERATED_CHECKSUM'" +echo "Fetching ICU source archive" +curl -sfL -o "$NEW_VERSION_TGZ_PATH" "$NEW_VERSION_TGZ_URL" -if [ "$CHECKSUM" != "$GENERATED_CHECKSUM" ]; then - echo "Skipped because checksums do not match." - exit 0 +KEYRING="$BASE_DIR/tools/dep_updaters/icu.kbx" +if [ "$1" = "--update-keys" ]; then + KEYS_FILE="$(mktemp)" + echo "Fetching the upstream KEYS file" + curl -sSLfo "$KEYS_FILE" https://github.com/unicode-org/icu/raw/refs/tags/release-${NEW_VERSION}/KEYS + rm -f "$KEYRING" + gpg --no-default-keyring --keyring "$KEYRING" --batch --import --import-options import-minimal < "$KEYS_FILE" fi -./configure --with-intl=full-icu --with-icu-source="$NEW_VERSION_TGZ_URL" +echo "Verifying PGP signature" +curl -sfL -o "$NEW_VERSION_TGZ_PATH.asc" "$NEW_VERSION_TGZ_URL.asc" +gpgv --keyring "$KEYRING" "$NEW_VERSION_TGZ_PATH.asc" "$NEW_VERSION_TGZ_PATH" + +CHECKSUM=$(shasum -a 256 "$NEW_VERSION_TGZ_PATH" | cut -d ' ' -f1) +echo "sha256: $CHECKSUM" + +./configure --with-intl=full-icu --with-icu-source="$NEW_VERSION_TGZ_PATH" "$TOOLS_DIR/icu/shrink-icu-src.py" rm -rf "$DEPS_DIR/icu" -perl -i -pe "s|\"url\": .*|\"url\": \"$NEW_VERSION_TGZ_URL\",|" "$TOOLS_DIR/icu/current_ver.dep" - -perl -i -pe "s|\"md5\": .*|\"md5\": \"$CHECKSUM\"|" "$TOOLS_DIR/icu/current_ver.dep" +URL="$NEW_VERSION_TGZ_URL" SHA256="$CHECKSUM" "$NODE" -e ' + const { URL: url, SHA256: sha256 } = process.env; + console.log(JSON.stringify([{ url, sha256 }], null, 2)); +' > "$TOOLS_DIR/icu/current_ver.dep" rm -rf out "$DEPS_DIR/icu" "$DEPS_DIR/icu4c*" diff --git a/tools/icu/current_ver.dep b/tools/icu/current_ver.dep index 3d923fec865a..577b585578ee 100644 --- a/tools/icu/current_ver.dep +++ b/tools/icu/current_ver.dep @@ -1,6 +1,6 @@ [ { "url": "https://github.com/unicode-org/icu/releases/download/release-78.3/icu4c-78.3-sources.tgz", - "md5": "a7b736b570ef0e180c96a31715a00c78" + "sha256": "3a2e7a47604ba702f345878308e6fefeca612ee895cf4a5f222e7955fabfe0c0" } ] From ec420a48d83fcd3c2af25e52061ad42d1fa1110b Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Fri, 2 Oct 2026 22:58:16 +0200 Subject: [PATCH 2/3] fixup! tools: switch to PGP and SHA256 in ICU updater --- tools/dep_updaters/update-icu.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/dep_updaters/update-icu.sh b/tools/dep_updaters/update-icu.sh index 8badb9c0129f..a6eaa4919541 100755 --- a/tools/dep_updaters/update-icu.sh +++ b/tools/dep_updaters/update-icu.sh @@ -54,7 +54,7 @@ curl -sfL -o "$NEW_VERSION_TGZ_PATH" "$NEW_VERSION_TGZ_URL" KEYRING="$BASE_DIR/tools/dep_updaters/icu.kbx" if [ "$1" = "--update-keys" ]; then - KEYS_FILE="$(mktemp)" + KEYS_FILE="$WORKSPACE/KEYS" echo "Fetching the upstream KEYS file" curl -sSLfo "$KEYS_FILE" https://github.com/unicode-org/icu/raw/refs/tags/release-${NEW_VERSION}/KEYS rm -f "$KEYRING" From c818aa94a31f3401cb71ed7658acb5fc9137ec0e Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Fri, 2 Oct 2026 23:08:11 +0200 Subject: [PATCH 3/3] fixup! tools: switch to PGP and SHA256 in ICU updater --- tools/dep_updaters/update-icu.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tools/dep_updaters/update-icu.sh b/tools/dep_updaters/update-icu.sh index a6eaa4919541..4bbac86f0f28 100755 --- a/tools/dep_updaters/update-icu.sh +++ b/tools/dep_updaters/update-icu.sh @@ -55,10 +55,12 @@ curl -sfL -o "$NEW_VERSION_TGZ_PATH" "$NEW_VERSION_TGZ_URL" KEYRING="$BASE_DIR/tools/dep_updaters/icu.kbx" if [ "$1" = "--update-keys" ]; then KEYS_FILE="$WORKSPACE/KEYS" + GNUPGHOME="$WORKSPACE/gnupg" + mkdir -m 700 "$GNUPGHOME" echo "Fetching the upstream KEYS file" - curl -sSLfo "$KEYS_FILE" https://github.com/unicode-org/icu/raw/refs/tags/release-${NEW_VERSION}/KEYS - rm -f "$KEYRING" - gpg --no-default-keyring --keyring "$KEYRING" --batch --import --import-options import-minimal < "$KEYS_FILE" + curl -sSLfo "$KEYS_FILE" "https://github.com/unicode-org/icu/raw/refs/tags/release-${NEW_VERSION}/KEYS" + GNUPGHOME="$GNUPGHOME" gpg --no-default-keyring --keyring "$WORKSPACE/icu.kbx" --batch --import --import-options import-minimal < "$KEYS_FILE" + mv "$WORKSPACE/icu.kbx" "$KEYRING" fi echo "Verifying PGP signature"