From 8b24908a76ac20bb12503c7a32ee4d3cea245a74 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 9 Feb 2024 22:52:40 +0100 Subject: [PATCH 1/5] glibc: 2.38-44 -> 2.39-5 Announcement: https://lists.gnu.org/archive/html/info-gnu/2024-01/msg00017.html This release seems relatively harmless in terms of potential fallout. Most notably is the removal of `crypt(3)` in favor of libxcrypt which we've done already and compatibility from ISO C2X. Also decided to drop the old *.gz approach in favor of inlining the patch with the changes from the release branch directly: it's relatively small in contrast to certain lockfiles in this repo and having a textual version makes reviews & diffs easier. See also https://github.com/NixOS/nixpkgs/pull/258972#discussion_r1454962456 for more context. --- ...l-usage-of-BASH-or-BASH-in-installed.patch | 36 +- .../libraries/glibc/2.38-master.patch.gz | Bin 55343 -> 0 bytes .../libraries/glibc/2.39-master.patch | 566 ++++++++++++++++++ pkgs/development/libraries/glibc/common.nix | 25 +- pkgs/development/libraries/glibc/default.nix | 3 +- .../glibc/local-qsort-memory-corruption.patch | 14 - 6 files changed, 594 insertions(+), 50 deletions(-) delete mode 100644 pkgs/development/libraries/glibc/2.38-master.patch.gz create mode 100644 pkgs/development/libraries/glibc/2.39-master.patch delete mode 100644 pkgs/development/libraries/glibc/local-qsort-memory-corruption.patch diff --git a/pkgs/development/libraries/glibc/0001-Revert-Remove-all-usage-of-BASH-or-BASH-in-installed.patch b/pkgs/development/libraries/glibc/0001-Revert-Remove-all-usage-of-BASH-or-BASH-in-installed.patch index b7658b59fb1e..100bf31c3b00 100644 --- a/pkgs/development/libraries/glibc/0001-Revert-Remove-all-usage-of-BASH-or-BASH-in-installed.patch +++ b/pkgs/development/libraries/glibc/0001-Revert-Remove-all-usage-of-BASH-or-BASH-in-installed.patch @@ -1,4 +1,4 @@ -From cdd0c4b168fe228de97778556cea5c0f936e0e79 Mon Sep 17 00:00:00 2001 +From e207c3dbcff1d3d09c60eec99b6fec2a698b01bd Mon Sep 17 00:00:00 2001 From: Bernardo Meurer Date: Fri, 22 Jul 2022 22:11:07 -0700 Subject: [PATCH] Revert "Remove all usage of @BASH@ or ${BASH} in installed @@ -22,10 +22,10 @@ Co-authored-by: Maximilian Bosch 8 files changed, 15 insertions(+), 10 deletions(-) diff --git a/debug/Makefile b/debug/Makefile -index 52f9a7852c..22e4ae5461 100644 +index 3903cc97a3..b041acca71 100644 --- a/debug/Makefile +++ b/debug/Makefile -@@ -265,8 +265,9 @@ $(objpfx)pcprofiledump: $(objpfx)pcprofiledump.o +@@ -343,8 +343,9 @@ $(objpfx)pcprofiledump: $(objpfx)pcprofiledump.o $(objpfx)xtrace: xtrace.sh rm -f $@.new @@ -38,20 +38,20 @@ index 52f9a7852c..22e4ae5461 100644 && rm -f $@ && mv $@.new $@ && chmod +x $@ diff --git a/debug/xtrace.sh b/debug/xtrace.sh -index 3d1f2af43a..eb2ba7ad4a 100755 +index 77ec1d84df..5614404a71 100755 --- a/debug/xtrace.sh +++ b/debug/xtrace.sh @@ -1,4 +1,4 @@ -#!/bin/bash +#! @BASH@ - # Copyright (C) 1999-2023 Free Software Foundation, Inc. + # Copyright (C) 1999-2024 Free Software Foundation, Inc. # This file is part of the GNU C Library. diff --git a/elf/Makefile b/elf/Makefile -index 0d19964d42..ee8ee1cd41 100644 +index 5d78b659ce..a2145d7b64 100644 --- a/elf/Makefile +++ b/elf/Makefile -@@ -250,7 +250,8 @@ $(objpfx)sotruss-lib.so: $(common-objpfx)libc.so $(objpfx)ld.so \ +@@ -249,7 +249,8 @@ $(objpfx)sotruss-lib.so: $(common-objpfx)libc.so $(objpfx)ld.so \ $(common-objpfx)libc_nonshared.a $(objpfx)sotruss: sotruss.sh $(common-objpfx)config.make @@ -61,7 +61,7 @@ index 0d19964d42..ee8ee1cd41 100644 -e 's%@TEXTDOMAINDIR@%$(localedir)%g' \ -e 's%@PREFIX@%$(prefix)%g' \ -e 's|@PKGVERSION@|$(PKGVERSION)|g' \ -@@ -1396,6 +1397,7 @@ ldd-rewrite = -e 's%@RTLD@%$(rtlddir)/$(rtld-installed-name)%g' \ +@@ -1392,6 +1393,7 @@ ldd-rewrite = -e 's%@RTLD@%$(rtlddir)/$(rtld-installed-name)%g' \ -e 's%@VERSION@%$(version)%g' \ -e 's|@PKGVERSION@|$(PKGVERSION)|g' \ -e 's|@REPORT_BUGS_TO@|$(REPORT_BUGS_TO)|g' \ @@ -70,30 +70,30 @@ index 0d19964d42..ee8ee1cd41 100644 ifeq ($(ldd-rewrite-script),no) diff --git a/elf/ldd.bash.in b/elf/ldd.bash.in -index e45dec5894..e09428506e 100644 +index d6b640df66..46111670cd 100644 --- a/elf/ldd.bash.in +++ b/elf/ldd.bash.in @@ -1,4 +1,4 @@ -#!/bin/bash +#! @BASH@ - # Copyright (C) 1996-2023 Free Software Foundation, Inc. + # Copyright (C) 1996-2024 Free Software Foundation, Inc. # This file is part of the GNU C Library. diff --git a/elf/sotruss.sh b/elf/sotruss.sh -index 874a6bed3f..7cc154561e 100755 +index ac1a83984e..2bf17c518e 100755 --- a/elf/sotruss.sh +++ b/elf/sotruss.sh @@ -1,4 +1,4 @@ -#!/bin/bash +#! @BASH@ - # Copyright (C) 2011-2023 Free Software Foundation, Inc. + # Copyright (C) 2011-2024 Free Software Foundation, Inc. # This file is part of the GNU C Library. diff --git a/malloc/Makefile b/malloc/Makefile -index dfb51d344c..574b5e9579 100644 +index c83ade5f10..8dd9174b79 100644 --- a/malloc/Makefile +++ b/malloc/Makefile -@@ -306,8 +306,9 @@ $(objpfx)mtrace: mtrace.pl +@@ -312,8 +312,9 @@ $(objpfx)mtrace: mtrace.pl $(objpfx)memusage: memusage.sh rm -f $@.new @@ -106,17 +106,17 @@ index dfb51d344c..574b5e9579 100644 && rm -f $@ && mv $@.new $@ && chmod +x $@ diff --git a/malloc/memusage.sh b/malloc/memusage.sh -index b1f5848b74..329e36ef8a 100755 +index d2d9d17ea8..2e7efc9049 100755 --- a/malloc/memusage.sh +++ b/malloc/memusage.sh @@ -1,4 +1,4 @@ -#!/bin/bash +#! @BASH@ - # Copyright (C) 1999-2023 Free Software Foundation, Inc. + # Copyright (C) 1999-2024 Free Software Foundation, Inc. # This file is part of the GNU C Library. diff --git a/timezone/Makefile b/timezone/Makefile -index 0306c0bca9..de9bbcc815 100644 +index d7acb387ba..c8e203ea3a 100644 --- a/timezone/Makefile +++ b/timezone/Makefile @@ -132,7 +132,8 @@ $(testdata)/XT5: testdata/gen-XT5.sh @@ -130,5 +130,5 @@ index 0306c0bca9..de9bbcc815 100644 -e '/PKGVERSION=/s|=.*|="$(PKGVERSION)"|' \ -e '/REPORT_BUGS_TO=/s|=.*|="$(REPORT_BUGS_TO)"|' \ -- -2.38.4 +2.42.0 diff --git a/pkgs/development/libraries/glibc/2.38-master.patch.gz b/pkgs/development/libraries/glibc/2.38-master.patch.gz deleted file mode 100644 index a07e4f8e1d507dbc33fa97d05ba0ea343fc03d4d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 55343 zcmb2|=3oE;CgwSjk;S(ygzB!Zf3bG$Estp$A1}O3elvA$PxhRi?746Jp0=_!E$HBM zT~%@8+LBNAmoo+^xlY`)NiUlH!rd32U#s~nzS_0?!8x@lLe0G~`B^jgF5kS6%C>pg zuQMM?E*J8cC6=6sGLL-a{!!*0d*B&Qj{nIuN0WAZhwcc+lFHR2waq>&fZ&oqueIXgFLjzcKO4gMS~{G*<0ax*xD( z|Kk+BH+_owDq^!$L`8xoOs-SnU?(R=nUoj&so&%Q`! zy*_%;%ff{vH|2$#X=!;<;u;?-Szq7NbI+zF_X}7__8m_)TdX#_BuaOBwOqz6p`9lj zEUN>)70z!8-hc1W!qagFH=hxl+k2wm#{1~UHzx#^d)e@;u#@A9p0&*MWNzv1yKXnH zUtciu@I8rLKdc&GXJ>w5UasRKF+st}{bWV=gxVipSjBd{Jfd=M4)b>xo2m&0qN};> zeXpOaF{r4le5rqUjr`Hmjtg8=n^)T%xVeCJ?K}HQkLEL}1%d@%k}iE;9~GdpXpxOo zjPq0NZfzkJLDB9*T@(9$mAkv0H@Lu4(YJ$JZ?ejTY4^`vleLjs;s3~3Blp3p@6*_3 zv}cO7E8SCR+k8$-eP-FY)^qbtcU{RUl|H#$Wl}dQr?r#ymGop+@ua#f585y2dv2Ve zp;mG$>uIIi%V;?S+-MSLzp$wKvMV19au~t2j7`|2aGB=y{vYM=Uj;)?7H~miO+~2fzBck3Mc& zC%yf>NPwYBJIB6F7OxaDr!6R+tmEP8`B~uKq0(nrfzzI?N<69MJKuA{#+b$DnK(DF ztmwb<;-y8AahHZtUmufr+zB^@lM6dpN~a0g9Aeg0l)JS4Dc`Fni!B?k$Y;0j4N@zg zB+IZ+>pj!AGffM1Rc|w0yQg_{g7&nIWi2-(=9MjfvhV+f^mB0+jM9zUkIz^ezz}qd z#V*Nc;@4RRj_%rWC;sVa*9A)-@+1avS}tu2NywhOBWEs;0WVwL0#E6R7l|9WYBKMf zVeHxE9KPL+E%EO@OIcsFX?bT?F~rud2R)bKb*NeCM_vP zQ;se+-(>Lcw7_8{Gl@!D`mDb4ynE{Rk|Z3XmaX<=*#$C=RoaGt3JhZ zuF0!TteaqwRlqi1X+k9HVVlI;($mU{cCa#D&P_ClY5coogZ#UH)!!3tcF#V#zWm$a zzsq+o|GmCkcBV}9j7gie8a;oixH{=FOLSt7s;=mY@bfux$!7Nx%--BqzH=(D?A?xS zhj>3;*8X!-_~V<-fUhnQEMK_P3Zou=)>ia2l-@48QGf3r)~lzM-WH7!+B(14SB`P| z(hmO4uEr@JV)x4WHtU|`tUIr%z3+Uu|JV9nfzK?8Q!TD|T=YJcQ@gC}c58NZ*Ftr! z^@;}3=^eLzv2*Fke%t$_!*>~~pUyPi4L;GDlvZuFz&k>x^LGyk(}ESe+?+96vevK}&JLlw4~`@yY#jTP-dp zKQAx%lM#Nie#-u5uQF4=KVz{Exu|%}_KEPFgFlp?*;(#bo7^Wa`2F8p)<)@vS6YQH zcCpW{(+l&9_~G58a>#vcQcRSg;ld9os;#O?S~~s>j}mpn9W|cnaR6dYo}72}gCFm!m(@M&VQ-d17_D#;a!RRexEaj3d;Z>(m3z0}c=u+m zqCupu@S{Z@cYd|pJate}?bC(1-hQ4Nid*-{`PCGf{!IvN*!}Tj;Cwk|HJg9T-Va-M zuhj3`Q@JPpz~8ry;VY`=%{BAaJ?bxbY_DJF+*S1<%-bHXc6)W9;rHBIJ7s@mPR*y=mJx>u}%gx%S7Tm*0r>+O`pqiYqmROj!WXD5-nJ?>^vb&R zPybd)J~?x>MEs}PS@p2MIMJT<9q*Tz3)A_ zvE^psm3h1+)#+j3vaYUqe;0NI{P=e8)Y=D%I%4%E>H&A(^g9%J>0N!8Y{$c|G z+wJ?Ck{7q-acFY->Q4>RUc2Sh(rWi(W-CJv2+Div|Gr;t!mIo zuI%@HF~XCH7m}y|IF#|-}j(DUgGHs^Qut(W7}pb<{jUC=E&~a z`ZH!*rOs>2OW*xT^!9G4cA#NtH1p^o%d(+_wGY7aVmN}kG@3J-PU>SKcQ<*eb%Ht zt6SOq6$dYUKB#J)zca4(wtB`C`LAMEb?<)S`WE)AOnm*y*4n0>rTr3{^l$0;rAk}rK4aYQdCIbLGqbnFWL*1oe%Ei&1rw^T9-Yl~^{-3z ztJm@`9B*~{|CJ8(lutNuT(Lz)@|TP0wBUxR`!8?NJIZ-BNU7=Cx1vjXqPuJTc3%}2 zpKcHaLHAJq9*t3|9~fsfB$R^^!yaY5f6{FxH*N;F3H>Y2u@*#==RWcm}?>bJ(W zc6V1iT(8xhpdz!?W^(0Yt>>ZBLRa?3hlJYh-(xW|rIc&`+zP?TUMb#F~uRnwC?#es{R`-Em(jQMy%N4)bz>n}$zkCTUEN5&U6iv#Lk`(V>uk zGiJM}J}#f7e6Z8V@6)o27v8LlYPDRXxo+#)UPYt!J)W=Tl-;ssx+=X%HK5Yi)Gc<| zO~X@{IkpMC3YjD;&3IdTdHzMior}HC$WJ+@ne=SI^l2w23tbIe^<(0T-SQ#NESE=J zbmC3znl?q_DG3Yy{G4S@7mdQSm2Pc zp!i8H?%#e%mZ{6$n9t?&{MkL_>$i8+oy}8z3hms+(>LX5%RX6#J#2pNrN1;jDc|3& zb9|$7wQ=EvC;McN33|F6>oku}RlC0|`+LrA`I~ji?`~t?q^x}Z-kI$;*R8&sv+cCy z?q#=SI+*|LPPu@@T#mocVfZ*gY1V@Zxg;H(PJX#a1ph-st|BCp7n0$hMzT{=A;EUp*>k zrpcZ#=QmvYR5yPX&o3$cmsxRUch{^W_M@*Q9ey5@S^1}6@4gwcw+b2C=N;eHbnrmg zo3h>Fx9%#JKZuC_9K1gAjNjfV&z7Z|=DN!~xU}%($2}UMTs&`2?l=urBO8x`a*P3?XJb7E@Jug@sdUllx`-|w4kE9Mq?5>$q&UGs`v0`ib zVIB9VyZ;nku?e>9eExlxt@ldDxshM1W`%w=5=)wH!~XBM^4@$=v*%~mN5zMj%#E;V zvAV>PyQgBt>6z1CMRVyrG>d(4J>GM{$D}#aOdgkArg{0I zs%iIvC)S=F=z(*~ zoqG!w$7CniDmr~VC2F~9|AQ-;+mG+OyyJ$B|B_uv5w9$wDg_%IytW9aRsT5rL0A)4Bf97g_Wg$y^i9=~>MtXMhA%PZ|}b?DlQOAau&T5HW_w-3Bp zb74hy@46c85PeTx&DEtjGgi1TuvnbethZ2M{icw-dF2LOeSz0o=X`Kh4r#gRbnqAZ zDF;!fg{|oBf2}JZek%1f8%< zn|V)?-dD&!xb$nMoDr+%^=(fl)Kf?;ZK&$9zjYn2wZRiALsI9r-hqpZE( z_t!3;0>8vXyEHw%Zvr zm&7esyDRmrdY@46n*J>-e&4xpU3p1>ow=Q-*t0pFJ`o}(`0E%9inq)$E3Kct^M}o@ ze+6~Lx^3z4N1i`?`t-w_U#D*$k`^quR1*D!MPS{L2|Kz?Y+Ca z`}Oz}wwAK7^XDEoZfUz;#JSLL&mKA1`!zCgUEQ-!cYj_j-0^1WBVN9|hpcSwHl8o7 zE?(*R%l*uB_J;Js`>Izlv2w6-@GRaIQCt6N$JARJ`%R6r)$QuuY+-M1f3%0~HlOEn zQ?1sUTGlGIM~?1syVlevd2-&DxfOLub05n4Z(SVZbLQsNkMC``9y2dco2$v$yyn%$h^A%R|#12?XX)yPcHZdh)?`Dx{Y|5=7NpQ!A3th4%5?bMc28LNBs zuZqv;`W`UwXfFoyRs=#L8_-xpeK4h-n7bU#+%3Y0oyx zApDsbvs~Jizb|b$S2lMya?P0jAaAziljW5w9=+teyIA1pz6ac`J~mc=AMx7P+1Sff z9XG%JeEIU<(y}HGBG=@vW?8bDtLv1lhljAMi=)ux*VnXODs8L_70ACVb?Fi7XGS9@ ztIivYKm9a*iK>0x@3c-OJ#0eTiKk!AIizGP^6`CtebM6mYI*At9!4^)c8Z&LzbxRy z&#BYSD@hz!JH_VI~oCS_jgycCh< znP*P8FB0lIS|QT?G4p%EZR@H}DkqBM>@OYut7!eVbo=w)F04Dg>+XO5-D+>$?zUFTH&QguW4 z+OGYYth~_YQm&ru_m#1xthtIeo@OonTzPxxYgx@ng%(b?YZp{rTK*;Lc7yAltD&Dx za50^JX}P!H!S}l-%KCL~zx~p0mAL=<+tcqR%Jbeax>q&rMCT9XnQf8lHoW;~rk8h{ z|LxEG$C5o?kFDH&GKf9)VJFW$i@)Z6;q0-|({`7>;j2>cOms+yXKFGqc>dw7#goe2 zqK*4R|5yD#AKP`b>~8(_q>cI4{I_r4&Z`*5)wExDTE$ndD@8$O&96g$9gcUM*%b7b z>A&pck97;2ORnC@<1#bK>whlkb@R#Rd5ry+SiBbYg|fA-IXqd0V~z@c&QH#~Wv}e~ zrb$NKHeTMBY9e9r%Hvn!SDDzSPvS-FwS-Gq?P7I4E0yt_sE{|7nHre4;Jt3?i?APC zcGSNq*l_i|Tix+*%<2V-Ny%M1PQTgPwUoO)~7E0#?>Mw8xu zzj?pD<&>4;lC86S!fw6#zjl-MX_nPF$>pW5Uj8ZjaC5^lfo%$64`S^f=gr%*b@BsN zsrtEgS00;mMI>ZD=QY^f8De(R@i9HU!|BC?rHTB{x!KG$KO1E@pi}6hW)0;+jcK` zBF*-EX6P(W?a5Z>mrHh}EiFm)TDooNsxGJ3Hl}75Z})zavf94;SHSl78!RJdF1z=h z_l<1L>>mrZNv_dfW_zjd_lCAe*Un?|vL5=&BK>`?yZTjm{piwQZLd{&=KrVR=#dv~ z-Faf#Q_g4Ja*p)BVOe5npQ64*`bp}6$>vwKC@TD70fpw3n8^Iw76NtO{&6X~GDvR? z4P2(dS)I_Fvw^S5M&<2cJ5Cc%Rj0X8*~bf-kN*2U_u<0B({jphGvvz2M9WNkbf#dR zrN*O^TnYEDZHsz%&Y|K{n81#Nzc-JRzH*%6pZq8OmHvt7+sXxH+wL?yNt`HhOk`2y zm92`mcXN8#C(6l4Wb83#?rlAp@#@xvZ*uE)c}-r~{_w~hX2*z@&6`@)BxLUI+ULHT zx9UfL&JQl7*I(UCbsnnz3b!p?uxiOtcE{}H3ZJUBZ2WWU!Ng=azjAje;j^!WuAB|* zl~(z7X^GB;H4OEWJ1hTn&OLV|B)#shx{UvS+1reK6R!MuA#>z@?c`sNCby_={ucN9 zUJi2w&+AX(kvgA372jWZUv6;u=_Wny+StICKPHMK$+apj+&Q6e#)S|AsWYB4+#P3W zSw2)j!-hHggB8OPm%ecChZ^@yLeftDXJ7RNb$u`26qJ zqi03mCiDHsc@vhq!fDe&S-vy%`kiu|okoTKKWZr2obW73b$zk-gVeiUZ{Iw6_KM#{ zU79JuT$x8D?19FPo43`as`JhSR`(?cNxSqt>9}xk)z=d-+ao3(SMp7@OD*D4VrSP| zqP4R4NUf5&?HA8GTV7R#bTGC17yt4SeLcVN;mS39Or7=hZJ+E^B3^u5A#v@+s!Yv{ zyEhZ7KF3v`zgGH&!S)%Gx2B<}PQpu@ghU-z4Pmd~c`b8VRs28MB%Eh@aZzr8_?cGs z_J?~4ML0i1y!@@@anEv6#_mU|6|Q$1a<=D0gl>M(!?4pt@}cQ6cEjgAd3mRq4dR+Q zC%k^kFE`uKUyrMcPkm!QuTW)Lp22Ik3g{Uy$8K3}A+_U6Ts+{0EJ zC8{RJHtqU%CGCt_^!=E<(s%B~>|2tN$M$dWuRj@=Y|s6AtnIRU+5V|#UpBX|E`Oi@ z@04Ep`trmR(gzO3@OW6*gugB_`F2k9KTkNT&e4NA>)tmTTrOjpe7ZSCZ*~q}B;P)P zz>QyOol><_y*ca~&pr*bn|@z#@#*x3TQ*->pB1=m(uw09v1`MYm`qYqwcM3%^N>p{ zswjl*ZtOR%CA04=vb>tHZu`<~6Wt3B(jqdCo{>!p-~1}vxiI^@+y6r)#cyv-*fvS| z?fmOE-!1KnD}6F6wbaV~bDOhI-p$Q_+S1b|Y`&OrWzpdxMWOB2uARSnZpEvd&Ej#P zb0%c%+nK%b$@Wz_|5YEA&wH-`%AIf{V{Rr7kS^ zKVR!X)ds78zi+~t)V5x3dbV}ly#2j$A$#Yp;P?+7e{pKzsnlH9&@u_y^NhKlf7?u; z?%qGHQvTMWn02*#&b8|%iRSjr@lV&XsNsMv3~#WcN$({bI!#55>i%j zop}6mVEOmj^kvHwI2WhR5`SscYRNa9+lb|0>aqhd8Qf>OdmAmcu|2CSPVl?I{JF)^ z;Qm#m8Qi{2l?#10#GSV6dax_X_Cu(Q?jaSg6G|#|b6zQ(6Tj(NWx!K8O^WC4|K(yg z7}p4W`9JqsW8nQbR=4SXJ-=#27RbLj^S4|{a@+oL^~);!mki>6xytBoN)=nJpfM># zcdOSQoo}^s)9a*I^`DviFt00me7xU+mnmz{N4rh09nQt)cNWd+mtJL zyESExD{{CuKHMM6mi6wb*PV4&x8+ElQ}AQ>|Jv=ORUddzY~520qzy``*jD2Ui=NyySey=A&WCfAdO)1A)c)cQ?lSoKx7D z`TAI{uI`@<{T1rQQFS7D^9w9qcuJ?3TPa`sH0|KpvgI>GLnl7xeVQm9bN&980J$ko z56c;!+<9wylM~YuzZq;cMssSW-dB`hyFWq7IM9BtTuo@i$*Dr2r(l%{~7jPOYh3(b1sX8@`l`9`0CcqtFA^RU-nH3 z-=F+rhO13Q{8poF&pm!^H|0HJx;JB%_1z2etfXu&)rCJ;wyoE7Mq*}lsKEGTP>yIb!nf&`bL){IigbHGbb$X>v7Zv>WbgYKuBEV@eX-!7%@f34?n^pb`S|YV^_j1~FP?OmLvruO zH>(fcP5+*;$edIE(W=(1@?S;w<>fz)i8nVhwq$rCd;jsT^%0j-o$jriUH|{f)5p*K z_y0TDa`Ni*iw={gU7S(5Hq=^H(o+FvP zA(+iQvW7$G;`(LcdzD2*|5X@&efze(`qzPq9aZ;@jlBO}I3@Q_X;it`yY{}fDQ_{Yk?@c%#4HK`v=41&QM zczYLYe0k@HQh*}wDh5usNlF=x0tOG6M6(b4UFMlq(#YGqLwusm!ri5UicK4iN#(~J zFo6_rXJj+;rH_Bz-14uZx6xvWr`GP%(LJ#zHceVFRnu|O)jvkC&%BPXQ=_ z_2bukvdQ9KFCp!y9_ebl=h-8dYqc5|U;VQ4>U9usI%YO&<*|v2zbx&Q$vuBLYtO%5 zVqMzahs6X>^n1tGEajfPa$)R*wEU-bzIuU6gnEspHU#Tl>}>PU|NoJ7f8m+yjpiPV zX*%Id`)a&wvdumx9QGFQG}tky8+cLD;M(V% zu79cH%Ym~ewyiSSZF(^;Wa67+Z7jPtn(oZ2u}->sV@k+kmmuF2A5SKq{PK8zY|yJ? z!Y@i5Ukusxkwwb)Md*?1>x14LGhckYsVUcWi?qMe&5)fxE~eZFin$>Y9cbvf)be=x z+0RUKCb>4~a_tv=uvBr+_SQqQ4|mNh-Vr!sXTY@`6|-JXpPYE|hx6m5QY++iR%r&W z4om(TvM=Czap>Z8#}=`QN?g(BvfO2UB;}`H{*9w9&2Nup=(w~;F0_0WZNA9(>dTB* zzvnJ1=W+2Vh*VpBB4N^k1ML!S9#Y*LCDXo5U^Id=Ge@t`*>}a%=GTo5B%LFqGvCLFfN~Zrm)_jpJU;Q=)>xchbG*Fq^9t{0ZUy$@{=aKu_o;f{?MklUGhHALH54v_tBqhk8zTZ1| z1&80ey2(b5!#Y(X`r7^46MOR9|D%<=d0On*c7X1ZE{^GU$bD1Yni86$;Acyg6{KJ6n-w06z!d9*We#y zI_>Gt@6-R(FrDXpwLz@*q}{A#m)D<7SUdBO(YDM*`!XbvMTh0mvN`$ms!jT zhPCAk_1hO4Sl5Z1Jt@`scD9nyDpn!Ron2>Q43^mLl#Ps=&mgd1O}Xv)6<*wr9ow3^ zwUWf{C-hnMWbf@N-K(;9d5cVT7~E_Ykvg_5?q`eq2dBA*M6VTvDS9oqp;V^y zq$PcppiV(xgq)h#u}S;xW`Da7ap^tJyfmGSF0OL>LM$qH7qYjyGng&^)KKJ@$Mx%J zm1khY49$jhl6&sv+{!&w?pu>w?!4t~B1zED(2p@HNKm#>Somb^bG(?wvjPtWR|1#mJVN<9V+_uC2CI^SPKe zZO%KbSg%)Bmko>hUOPQI*rey#*m1Gsl&$rKylr93NA#YG%usc3Y3(w<)Vj#`hDUn7qG|Wq`TTl% z@$&uZ?aLo`U!MHfoPGN7<&RH3UH{x&eE+<8djeG-8vSIgewFs(mq^d_-Z_6l3raio zWK8(7f0NS5jGBepj_z)2EQwBveQc=leS>4-T;4ez51ps6tM&OqG@Xd zZXAe7T~xvIZ<;{(nNJd5Og~-=*|6l=PtzEkjsUl|k0xKw@FXtTbmXXjUQe}Jzp35q z%F1=u7JcW;H9CKBrj_DqkJ!!AUOhixY4s3UC-%Hl#`h;S;oIvL<_5jEvFyC+tV*0(G-f_|wgpAEDI<+nLd2nLt-zCY} z1x=|}kICQLc4H&M4KeBC;_~;bBERcwtUPd0R{!*(r>okMqt@HVIe&8&$t*WH@^SyH zX@zA`PxdY^tyEfFrMA`3t#Q>!fk{cbrX@BRsvN(Tw(XOc??Tl%>NieBM>$N#s?0 z+`i4cpp^Z&`(tLEL%9*90n=g@ueqxe;Je}tchM~dhriUKotrfh=cFgz8QLUS^ z9&kS}{qX5?-nyGj98y88Yi{yce|O(?WwYU$J&A|RBNWWzl9q%9=bLqB&*Yl)^=M7? z>fON`ckSap`d2jI&W$C>e0#!WwrnVOh%DSQ>EB}CyB1-o-wo&2Z{Nu3_UYmISEYK) zE$fW6)_NO8i7as4bJBa6QjqtzuI1N07H>&DIoC`xLVw++xmmvzHp*0aSNxs!$)mtv9=FF?b6A^A6Mgw3 zP~!WXJewY?yB4qbcb`+ZrRQTB&${gH?f2iVwXK}z9um#)cDJOKnaIPA#%%uM%jcbQ z<+Kl2wc(s$*Jq9Dx=m3r4<0|ATN3%d%xsH+w$au@8XkcMR+)#!Wah={aemM|B(Q6W z$Z7^@>&TE_yWFyb6&L^BYtps88GoV5}O|J*8YD~#VKWy?+~%~Zo>6?~AM?tD;DDBmKoUxWirs9l7LnWx<5le{b^T`!m}e z?fK>?Y-^v}clYz0Zwjwk`s9xs&f6|q+8!uzq&YF7=eUggU*^l-KlJ*NV>0Kk?n`^kW0Qin%1&H;Hc!;`$wP-5CJb4gR!5uMb~P*#Sf;7? zt$*9yw`KRc=iIIR!#%&}Ud|5nRR@GO$R}n>?YFj^`2K7Adr`>~+EXidlu9PBxY*Qh z+RqitZ>l4F`AgNi>cA8K#dXel^9i|#DR6JHmRJ?JVXfsoxiTX~qeJ@hcTB%6-%|bl zqSVwoSvw0Qbtimk-%z{9Uh?{{iR)J6T>o`?-PhSVUw2-A$NcrKRz(>5nRjnnx4r*e zxcmK$+id5{teP1^&oBG`A~*Ax`posGc9|N@ibyaK*ywFme!eA;b9s&6Z{^h&*nPM4 z9Nm3Dx%K%fr*pD1^@~Ef`cxB_9eck{xXfL&IwvxwFv4oS8|y>Cw)NAlU%Bh-oz|&g z6ufuNr<2{^QxlaV4`tuoR;;(UtM<$!9fnP9vV0HB7M_+_pZYPjjU|8g&GYCrzgt6a9`$<7adZUs4= zof%a$FT;jOf1)M-|9#7%%omyIWGCL-dS7UgWF(W%_D$xCodOG%ozG*)UYzc7;$`WQ zDB}j*4YxmL-;8?J%HieS8pOuC#LXazc=^bDPLY*%UwTa7L;sIxbs%k z?BuG0uNcmqT$Sf@+o*op{Z&&|%7>M_YT$FyKg4MmtQPq zNwpt&QZLW$_xvC@Idh$n*Y1t;6mP`^r*@`G$?SqrCHq7PA7I(%T!!`Q03KRWZC;d z`?Rz}aQjt*>F3wyM42Dq)J_ zw@3fyr=Nc6y|X*G=cr5FgGp~My}QBId;eO@vXzr2y>n-6o1*J6#mDg<>s`6IFJ>ff zo1vz?%U#FziBA%1YI%reen^*kCEHI;&ajg{GlU*4iQiNtv+#Yp!#ksmkIzebewOc3 zQBkR|+{VmwRY38YY(o5w{DgO*|F%k;PObiI{Vv?eVoutcYbLGv4BCNQw@$Ji-gsj7 z4E4u4HvQ4Aj3sw(+sa;1;+}AN)rSnp#`n7&1OHd~wO)B>w7FNY|2U6DgSgilsqgh} z`pZ5^H)Z`utZG*+Sr@SMPe-HOlPJ}%-cltYmsdmzwRMRpwui+uJDuP7?84U|X1{6g z73aO`bkNZWx$GbK! zIwGNdI;VB&*_|uTulUn5<>D*G;PoHYWh%AJ?@W61S#=qM(x-{D*KJUXihAnsZ(-Uk zjgz*aUxVtBKP_FKcd#mP=a$|-@3hMule?`o_lDo=sPShF4|Uk|$o0Xr$&;Hu$CosF z3g7D4!E{aa^9BW_6;&T{tej3LnXH`oKDi>~<&%pqrb&MZ{@LQ4EXCXMG`%WlU(}(L zm>FBSWHxzQ&+5c zcihkQ#;p~nzWiHoZBwwI=Jy|wS8Qa`+Y=ZkxnJ`YuJ}4pDxzcKWc%g~&9xC9S9Yv$ zwy04{$Y8ICWN8#-!=WUv4zHr0G|Eg1`qc?`n1l`Ft_lsYxDp7g2gu6QtelD zZ(p>tesc7KPt>os7tI}XCQ3GJ_bbSHI$!f*{1M)>XUhD%Le3{ku+6QO*C@N` zy-Xtd=%p)%uOHv>eh0tsQj<(`7oJj$r!^dM+KtQo5A0aUIxX?sZ0oJnX}RCM>UKvg zRDN{$?!F1uj$HmbZ}WK0yLYPO&_WNj9EDF2tgA&1ZGN*&@@%Mr{Bq;Kt2_ZeJk*XV zdNZh&E;}ONAlP(bQKnj13ztx;S&ND9gtQE^Wf|oY3YLn_h*qi!Hgw+e#ZE%kJ9#3z z)B2;CUX^UK{%?%mr0`>^!VKYmVqN>RelEK;Z&LRm4OXTpb1q%!5dUqyf=#xyL{{;d0DySbKpRFLiJsmj`EUw3`o zoA}?c;&$m#<0W78A8)b`k9zg_p4sK3_!_0x>bu`vklo^JfA4m8(+2VCymX1ssCVAR zPjr4PUB04%uj-E2yw8erdaM2Ml$-J=f7>QB zUr}EAsxg{F$~{)_`E=2bno`apZy94Q?OkCm;bCsQt9P2C((bsE>xB=hol^AV(!Iv) zROO-?*pczV$x3V1yd$4mB(_aun0-hrwS01>$$y6O1#Iyl@{MzHRgW6TUMdvelD+m^ zc6o0>=^Vc4OZAwi#i}Z;vSUxolWGvU@8S4%$%A&22O)JX69nH@yYA*|;oGGdZB@i; z{pe&xq+{1q|E@XtF{jP<9WxW$xyo57v`TW~`9u4KC$ISaux3$aPaD%5_S@D)t

6 zgsy}hu#*&T&{pPbVpQ07y?D2uM463skMi#OojL2%t@~bEFkX19@vgi?6@B2YJFS#cme0bW4kwJE%}r1JIm>yg2(hpGtM!raX7iCDmcVS zZ12qNUwGmLOtY32o|#&Cz4?iD-IEjFe)mbYIkT?_xc;^}?#jzsdlho{cklIkP_k#o z+u!eQ3GF$$FDQih9K*}zwd+qcr{45p4>srK ze5;)};i;a!Kl@)Y-P%B|Bbu3iu9vn-_MA37d+e(f8r$QhLjFIz9>t9ti&=|_XjeE!Gn z<^LO1R{vs4Ec^7Vh)J2B-_Oq_PT{7@&C&waO{pfL>jdtJU2@xOZmm{)=cJpai|WN! zl4nnHpNKO0scc)sUYl~r>*KtLk~k^5jVl`X5-|H03>59_CI_`?nw*Ss>CvC-NgiJMB zdChcp#(xf-N&loH-w8c@n|fkTLZ#V-}9XLQ~*1l*E{ zsQ9KPDQ-EjaBHVe-=lVZrJrRQR!^Tu2+W&0kyl1xON55p$5iA0ukxzslMpSyDRkf+ zQ^cFP`}M1%j$IC2J^N;HLsq4yTCx3h=9X>cw&%a3Jlm;vB4&a|c-pd_Nmo3Zrxmkq zv-IfVGiqmhvNT|R{i1rA>Y!7;t5dIsdPb$S@2F?cEiOwe5*OXPW{v8)Pn}PvlrMhj zmcXI+>fEYblV69v+WjW2GdV?d*N#0_{rBTy&YaJ$*?yY!r0!{F0o5O^YrGt1CCa~Y zk3I6=YX8n(l`Q|y{FIO3TEYMRV`oV4=PS?EU0!u8KYYgjTHEKMkk+mrOFcLyaaVm_ z^(Opq#d?|3jt2X7pOwhu$~xk9_LziA_zmx;;L9};#GpSwF~3R@&>sa~5@qO?U}j%)7`nVbgLt_K7Df~x76i% z&gFS~6lZEHE;8wSZcxC@;(BpilWA~YlUU9c;k3YsJXqP8$HlKa{U*f)XTE;HnrTWQ^r`AS3FN>Ti zw>0#YvA%4YhTP0WF~@yB9T1y1+tdEcSrgt*D&;}qU2_e#DxLOXGWM0@KbOb6NpS7m z&xP7kpSH84Tg%LOyW#!&mj`eDS9iR2Y;yA&OB?AY&kiTEO<5~^d$#Sj+1KlTPyKN* z;GL`KUa|QHO%5*8e_0pA{C0U})~O5qIuaQVmn>ACld_@i#l54C@9Hj0?6**}4~pYH z_0%A3eUJS{=E9>BmdiU{Js?!#b;{T9hs83@hyFQ*`*UKRls=D|Gpo8Z_tic2(w`gD z%U&;Wy&k^L(n&_`)sEDwLT3xN&pdlRWm5AY#nM%o!S%kzKU1Ufx);4&y?1N!{+Y_c zRk5ya?VJf!z=Op^0eBz2jy$utmU#Ny-m7)h4|jeSODa|9xA?0jrRMxS@y|5p+ztBkAHL$Oo7GZxltcdb z`}_ZXwI!TNNIyPzPjuJuz4tTAmhJUk`D~@v`T3Q5jV^sk|Ce|3cecKFFA z9I5!EctMc;)@8pn8jiDbr+0qJ4Zm?U;NkMOMWTx@d;Z+?;u>e-jq5fa^EE>+ao#=8 z>0ds%bZR5x1?^+2%MHA|SuVYIzOef3BId*Vn-}G`3W;r9wN>kKSM%+oYoA*&{CYm5lwsy^$IfTPj9bswoSt?u<n7&|0hg`0B-%j$hyGo_t;bJtNr)XDl%nS=55l6&(n6!x5oOIX)kH~H9V zy9)NNQ!dY4&XfH=YOU`czS!1D0+$*0^u=Ag$+_x1r`X;F7wY7WJ@dG<@es$gfQDUW^lCSyK;Lj)LL}jI>pO>j-o3!V8pT-__E0L2a+D%)!kA0o@ zW+n$yUbfI}=l4rqug?!u{oQkFN7X5=N9;`1z0q$L`ue(?!o z8^iQT3$+(syShPXvPa((^}a{qhTGjtVlK}Wle{VBJbQ-4t^=6~tK7FA{OT=da;No*5!@Q-#2>B5&ZBmH&AtvLEr4kbe{d1k6yL>6irwl z{ZZ2N?v=nx68h4C_oNO6H)JY!7^!AyB-uvmOzEEXKFouA)v0r@W1A9048J<{oRH;M z==?F!!c1xfqbkcb)fwWm>+-yKz8t>gBeTa+zcBydp$m^vAceMr?})izXi&^)(0;dt$HJHSM_dT`i0`U z$rtZk%qhAlcyi*3dmFA@^LxRY8hN)@w1a=OPxj+Yjj|7SZn(FWZR*TkRnLD*&TDok zt*Y*L?s)F4R)BkQRgv!08y93gPL!RpW>QK+#9yzNnQP@{Z5B|ybm#b@8iiLjqNf&~ z)oeU8S-_ykY7ft)g9oD@{S;GQX886n=e4a(ucvk?D9E~-9zHy6#<$qJTVs2lmsCag zfB5^_ui9;f%o$#*Yl}SI9^#npbGwo4P6{vggtJmx{vLeLd-Y_&lJ9&5cbXonB-C!* z8C+9*qCZ^wdtv&^OD}o0eYkaJrApEar+mltUEBPx9=YhWWJ~w0e=p3Y{dc_EtS+YY zO{%vvTd6Wds`m&(K+f#2BlQfRHsztv*$#QLTjCZmtu1F*6YHIQ+d;tY`WJVO_^8F# zw&|Rn_F1FFr2UeJ)8uHwSI4vk1C^yut1Y?k|6b)==S^PSFI5dM-P%1%_HCW<=Fhy} zpKNpa*qoCwt5o^k!?kZeY|uEtq>}kb?BxGLj>Q!Vi_6MB&-U5%$2_9!{^+S$Vtf7-YPTa{sqah;9eJr>OV(0C0|ZiyIxa8JAG53yjC3h zs-o_n=QXUwuJaxD&z_O9SKpxisn@IQp!o)S=FZtw`p8LN^QJ{Zm)4>ip;EG5XF^qO zJ^FU)!8fhlyXsEZ-Me$o=FWzBIp0zPcYWT&f9RaQ`pym~G09{fiGsC8t=7iV@>8!0 z99tp3$4L37?dPVqxzQP?L={&ysk14BcvcH7-D#FXEGze$d=8xbMPLf%d4gzb4;XJcHw#g4v3XG4+oXD?CG< z#Ta<4vdXcwTQ06|JN=tV#0%diJJdBNh`ALC9qqf%YjBRw=Aqf#?VPK7WUrLTNOhZC zI%;#tkm1J?hTF!PTyq;(t6ddRswLFetV>!t`M9Ty@AFE#{^gq^Cmoa0DUCg_{OA*Ti`h9E1r|C=qQ2dk zi@x4J+!S0S>&fQyYGk5%vyl2$2xo^Q;{|3`67NJKM{*^2Jtw^4B!*0(}sVzI@MN;=& zI~@08mw461EhQ2USFRRrnz1l3-D~nwPceyEKhIu>yT$jmGrIZX{^!OMxs6g^YzaEC zVhUgT&RM=+Eavwv_FLZhGwE=4l3r1Xd98Tz5w8EirI**Rc3Ru09ZB{UwR+Jiv7yvg zoZ(qYb;NHy#;NPF*BKnBbFH@M$mq|Qc${V1s=EJ*t6%x73%KPQ-u~4*b7RR(zIgu7 zgx6;|PF;GTxZn-bl&Q@EdB$q>5_vw4-Z}hu;^kbwbJuQjM(*i0g+cyi(Jb>N6iuF% z&uVE)wx6QTE9kbt>}0}^KpBsY6Spf>OAa3jz3l&(PwCrZYa5*(uZvCvTq{WI{Co3Q zqDQXJq`uFGFYw3A;`|yEXeYe$0bj3LwZ#j|fv#%uSP%i$3n!=bu#O z96zs`)#1dCM@5e;1^JjxMNH>)Ir&`k>B%<**42ySKbIUYe8csBhDPJnc7u*{XAPc6 zSuaxzXC7w0EfdXXx#k!-U;8|N zqS>ZNM@llEYyA&$WsKFm5TTs9Q%2j-bLs1Mx#3-z@oFdB4o_b@<%VEe>&6YIf(>`h zHI5a!xS_<*;8_Njlv$y|-0yx9cIpeVF5$5~)ukOZ<;+yB;{Kqw4qR*Wdp0-kTIRc~ z^wzxfQM*>>O*->(dDZdajSn0)AAMW=NX5?PPV@a;F{g^W=QG{mnbQ~f^qKh0M``Y# zugb~=msr(4{=YQk``ozmdsPMA-~IboSFrZyb0(9&Wrmk*w^zOXVWlr7sN!~k&3);M z)wi!K>iJdSdF-)kQplu_4%0H~+YF|b&X&twzB~5cr<*mKHw-GgI9o%V zZ+Qki-|o90`rf_n>(3v(Ed0TA>CxBiiIwKFRBF6V@vE1tj}bQFIv;*`Gq2jdHD`P> zej02DZSX!>J+UhHu@d)$@A_N5EQc>12v70Yot>n+=h(KUyK{;>Zi&5KDD%Scl1&TaPxEPS$}R8L z&(vLUi@myQ>+_;DckiwBIV-j4`{yN36sixm&e*wclYPgY{Yn2BK*_5n*75Wq10LJo z`d^kA{AIky@-so4|B?ZL6a;hpRsb zSihz=tKnqn24=}?zr<#XUDfpXekR^)LdQzGt&aw-H z?48$b>TpbxeR1seL$kS^KI}Wsp5bxZY0Cfi(l)+l%DsmrMC;w01^G7cPjr!)IKM1- ze|Bfl)rqfFB^dW4ojWt}WA;={UJu6U+*A6W+&6vx^JISMv?UH6>-O2+T3&5*bK!Pr z<@HN!wH}JgsVz_O{I*8n-rm^cJq{~ltXIan&WZmlJS(SYZ}7+DDVrxHmdKf`xHUcJ zS7=;-bkD0ha@TghT7PHC)vVpIZ~G6*U6$h6`Of_@x8QW=c-~J{LnCqA(K->#Nz9_U1@FMAM4uEweK(5`S^pNE&mdw@N1e*rxFy^ z_T8!b=DgMZN^G>hbhtp>xBVZYH;5^F9GJ4~$wJ6M6R#b=m zeB=8u=Tgtlx*Z%Zl=FU`?ev>F>x>uAoj4)Dz5d&&iH|rfgKTu&x19VXzUtI_7t_|1 zJEh6{rX)A7d>sGivdG^LbL)chW^yb!a-d}Sk@L23VHr#b?>OYoT)reKb+%}JWmrh- z+L^0YaHg#a4^lEr_SN{R^xMvZVP^XShgq(2*S*yRnIHbLdt|Zq#6<6&s|Su=JbUv@ zVbQ}>&IaZpmoS#4L67q1g_UabW;(nU`CGn;U-@Z*|E>M|Zr#xC>S+3~?qkY+t48+& zk(+{D>o&wkIw@wX*Ey1KE&I@=nnb(8Dua9yUJ^yZU?Svz}TTb2jU%vb*&+WVO87^;ozAfu{ z?!L&+T?`x=x5CbaEJ)fR$~VE~*CHc_o&@){j-NYo|0G^m5x3T|@?kO8m(`NTx=XL5 zzid{#>$WOvy6xVe#hX5To6PLwCjQ%+J?7{0tzXs$FI)bna+Bg5>1gvy<|=>fD%?Ai ze%rKtEXvf-b5jx8E1;IOE#Bq8&K+!-vWXGR_Sw%nKmE$u^t-nFe^vJCs{MP7{~FAE z^K`LPQM|~N3GWZ=ds(XZ=I6U-Ps9@(C0Vi#mabj*Wku*@sZ*hU{iI%R*z@qwgQ$nw z+2<*h*5pS{7k||?!^3++P|PD;rcQHixsJ)YE<0_kekv{AQhs%7>xz@>pUtx_zm>Pz zb7kY>m#d=IamaDKz89%E<(8ryV^ZnU{a2Wb8g}pGl*tc`o_(^Y!qlkgyEaFSS3sCS zVV351m#ENV!q1}B;!R{!-F071yC{EUqUZ&qPuf4;ZPZodmv56gCU!dV*hYs^CRUf! z$Sus9^4RVyo3zpTqUVVKA%m2=Ph&5Jx;Nk z9aPTAWo(qc`gIwLy?pIYPQKY6Z`5928}Z}%qR2yyzRue-PAp`IP?{Ci-FW%_#QhIH z6>Z!zx5zl)&*l|(dUY3?nO6t}e7Ue$?Tf>gBetpc-oBW>>+iOyZVsuNmiJn2n)^0q z>P^P)^Y81*ANqVmane!N((s-)LB2cAKTrQy6cBaqwfgP3!jcCbz44p;UU6qav-Qd~ z>d()gy6c}6v?KS9^VgNV-CpJPZF$=!d|1IFw97KmSd@`By+OB6S9ISgbq3?USF1x? z+pd;#Yw|>R{oPqqXd2BlO~FGifyHb4S|gr~PqSRVriw@zckNVY{FudTuzI5Fijb`b zc1%{EBhGklTH$fI2PXsSdyJwV@GO;V>~Usd<1Sq#9k?OnAG@0V9i0OC@4vbhs#X8` z6uz+HWA=jcLgq8`Sgkj7e&@PUSk)h!m;Y}1<+RZ6(I>Y&mVEuC;Kt*3G4e;x_KUd{ zpH0mA`27l_V3lzF{`vP)1{Pa@{dCtY+o?3CtVCKg zc4daro;?zB8qG(}8^85?#aq7hP(h8ZAy@zUy^V+U)_+}R%qkOi=;v<7z2-_1%I&dh zW;4HXpJem1iY=_yF@RI<<$kWI zx#y(fCKpc-Zd*CYnYlsd^#wcAmGf5Vi?4Y3;&|j+-Ve(!IN0>x`1NPT{?F6)Zc0%=7Y(U%Q)@x`XYkO2!rb`wyr7E-~UePCCLP|i2ZA4+^IZf-H zqEpAj_Q~+GrFF6`kXX4@&&=>~^_}Me94-2DO7*7io3ymh=bLH_um9VJ8OhyC+}hh2 zI{Cd0*~>XkoOGK1dhETQHqY`-X=Yyi@cNUVs(!<(AD7jRxj{VovUnTEAEG9c|-4%(9qQzIega_w&cy8S=e$X!?=E2SdcK*RzMb1uD89+sbs_2hV>}ba~-F z3u{|@yZshcdpE3m`uF=k@HWdmv9I%QMTq_1^H=*$h;PC{oi+wVzX`XN83(VlHqP2@ zEuSIslhu(`_~r$Zt{?Zm?|FBa-^#>#)~Z8mYu|tUYWux#-u}b2D<1A&G4J8ZB?|U8 zB>6gHSG~Do`sQIc$I2%m!gC}Ko|AjL>%J|2xeu@PFQ1oOn~wNiT6FV{OP7YOMtzIR zf?JJ~R08t?SkJHtukLMlRJDDBs>Z6TI`Yp~zRB%0@sHrVGk;fVg2$%KLe?)_zJ}(C z+~VXhuc?VSo-qBYx0v?ZOxI&Iy-|)L8{bY5GBy7B@^S?G_VC~ZtKyD(?wEU6Zd!e& z)$wyzt7n{E|Nrynv&a3{+c_G)zgLsf<@(f3Jne<>^1?5cXD=jHsjAlrzI z=U-kN50vM*(rPmo;CWt5zFJYxGo*6D8*UN$)AfRf-X9tRgC*ZG>Z&EJGw9R^4iU=QGh>kvgKdzBb<%XDt!4&~<0s$glg;baTi24M z&?}(d`LKAlZsb(wYbUaqy$%Y;hPqb^dOSDx3dSeg`4C{d&~i(5+wG%5&rb0^d)FhfgQG~}^1IU8 zmYjYkcK&-({M}`z<$=ZzvU?`Z(lv}1PH6MC=vsIE;A6Erzdg)OT`n+t$5&POqSVS+ zzmIMC=FJK#Z)&`rwc*>DUB_GG{iXf6^;l*(KinD-k-2y8yPcnR6stE{bKdoQ@;qB+ z%CX1mDkW_XJ3QR2D|6zZ$_$%#dQIIE`ht$g?~8VNKRKWAU-Qnc>q0x9@A<%1dp>)! zkb`PNienCQNp#8#Ey*Rf#KWFsI>(rv%KB!n!REpEC}+|OGtqj!2{&){oa(UT+}2*W z>bB^^Q!GDJPbl0?t+?PM8{ubAE1umoBb4uQY71l9x(%r&B^*|AvRvWw^Xh7Ue|z;- z^z99WWzW`{6JDuRtL!ydUfs3cv*^Qt1t$;bJlShhwKy%jTtA%s=qJaWcRuMX_{i2M zcKD~|yG}oLFQa(|E(hnsI*98wV|}V@QT_fl?^|l8t;4kxppT1?BB3A`+I7||DCHXf3~~x zJ)8A?A1(WRb9@dzxYe(x-Y6gEC$#5KecJTN0`lkd)h`-P*Sx6Ux3T$EvtQvo)0bN> zR|xqQq{ch5FXN0$yDS;^?6PItqnD;7%LUCQxn0OGoBhE!-{r^qnL9h{7aR|`GWYR$ zo_e7_oXa*Ox`=-~`X{MOFiz$Azjyw-ul>Hgt8H%6-ySQE*zA>O-@UJ{UsTobetGZI zpt&2@8_(Uha*}fKru_;@lO6dIR`k05D&70%)Eb$cwgNba`IPYLmc%<6AgKyjbcK z_-#{&(|z8*VNdq=WF)f4{r&c5!ShFx8kRo#DR}p|=_A=a5>0Yb(z@C&UtoU4Jok|1 z1@$iv;!JuU9P?J#$iC$3M;)Fjhh5C~E>ypguG&)ffVXw!&&6k5ZiMnjt=^;~cCBsN z6Rz)5OvL*hJv4Z=*u?zBxAw<{SLE43)s{wFFHk@F`^2=K^8s3mJRGgn<0Ah!zD%#u zHR8V?rBtt!cq&?>e*4K2KSYnuyc7D(U`NNY^HUCcw73TCTpJpCiDl=5jkg-#y(wUQ zdO7q1?^HfZsW7>@nb%*ISoQ6CSyi)JxzO%WAzx|vm9{5Lej9bF_ZL(h5Ns^aRzK+6 z=9DU$b|mQFjgZ3oLMDH6=jBY}h`wX-tSI;Sj(~-|&r5@?BfC~TnZJQ)@ok;EdV=?x zUeB%Zn`o`}EJFJ9)>jP7qUYw;NNc5Tn6+B}^ZA#7(N#A^%Hmf3@F+RmDSzd?<)#G@ z=jJMZ%1xPnTI+Adi>l_b{GJ1BcgylCZafHVxo^1rQcA!3sf;hrw%7mv_v&!;a>l8YN9$rfDmofUahBUWq+`tmeeB;cCns^7_Hn!ER@9!t(LR9+%^ zaLYxz1gQzWQHkX-Vma3(3l`)s2hNzkX|bN_`9@nOvG>%$GxtBoyxDK?%)E#@ zb>5}5&*#K;{tl4Q4&4%$`ZVi#=o7V#GLj2-JXyV3o2!;>X7Q{?`bT$g#2#7xHE?y^ zd^h&48&|eibZ~^E>MMQ=XwZ`NYn_(5t%6JSL9V@1+cdsl)8@Nb55tyTn^YB77r*n! zxj13g+MSzEOs%V&zkb@n-LuX~Oze$XkPzCTnZ4nd<0e6dr2g#%-1yXxSiZ{J0xzDz%BWw|bdGyBGubJ=^!);6E{H1GKa<$0MU zau325na!?$6S;Inx0IR~@})+U4D|d7|WU#+RD&->6sKoD}o)mX`a1ZI89)J+GXn zqWO5&%f7Jhw|<4?YZbfh)(DZl`Z)Xjiu>Bz?U%XbM9uJf%KfxP^WFtZS-0iJXLu#c ztqvQenfN5-hj_7ttkJN{>oV{Bqde*KheHY$s?t;4F4gJFIeKlJAhwwC!~xfix{OH* z_ZhWYHgM%FaGHLpRbtH(Ro3^)r}JGmimP7kG!)F7A6LroU#Vsx*Pml0`DfO>VZ0Pl zw4h1_c4p#S!zr73W?3Mwa;{0xX(}FedV;1<}xWu*S!=zV=KKR zrR|s5sac5*5l1E(x94x(u;{(vG?#!_-*vpf-UhcX9N2tO@xW8Y?Tg-K{aQA;m}i%9 zzRe5X=9DL_jwRQ=F1o1k;=J3*oD1@E=k@LmESKr~7w_};U*-1ld$QM(UwMC1Xq**y zZvpce-iMJ&eJb76rN3pFJByDoupeZJ;X1SZpcVVx1+NcI;!N7{d1o&-jCvS*pu7$90@G` z^Z9rA`ulhO{Cjw}KAy4t|EsUo$y%#be(N}_-^XcWkv{jn-@0ov&RpEt@#5HbBMaH6 zr}b-M@8{okOtlrF6GH4_SQuN=chcPSuqM zDPj8;$rR-U#ZBMi<$OnA%Oal}ceQ(N>4rCM58>loHD{MkIo~3o4V+qv7eYT>GB+{) zrM1D~hVtZ;35}93j$BbP=;S@_@bR0f{^8eW!x}5^ORDRz+P5bbu28?S^QZp$l|MM_ z-ItV0Slylf-~9Ebh1|@)`b8IRnB`x}p#JiKo^O0bu4Z<$)eXLxAqJs}@&}6#PcBzF z|0+7OVCM(%Z>Q!n+{o((xZIi#4*y7_Zm`ql8W>`eSsPqEh3D!ffAWR5>n zIjJ{&Icw%!We=lG%RgvaJa>L_PJAh=4lmnQ=3ARwE*rmnY6- zO_*W6$jmT#s-?qp|4C6NncJhxaEVRg`XXX)H-wvrpS=)%C{TmlRgSgLW$r7} znu5abGi&o2ZnottdJ`YDagG@O`Pe5@V_*gwu$@oNv??aPjp3U+qBJJ-A4OVWs_*X|Zbe1Wv+t2TNjb|xt ztB<|8_NZObzU^0~4j0>>JR3ZBVu8Z@72A(qpXPqx{wICAZJKA(?|mscaYN9*V10G} z^@lS;nQXJ?KJPhn`LFYf?RvG1ZL36=Zk)90Tj@{3&Q|%8{oH#0*HxAtF0QWMZ+lxz zd*@m6f15rlm&MLZ{Qul8EBo!=nt+&Vj}P(H#w)BpwN}JF%;5G}p=kY%_ZE9PZQGd_ z)N;1{**s}a7sI+Yo6@&h-xZwJ>&?kfBD1*Pjo%>Q%if&wGP8Gan`WL=kF1iM9w^I_ zDyF}9#|#l$J~POq(3M!wl3{^)x8o1C38-%3ERz+84qw(6D$2^CE5s$5Iq}!~>gU&Q zs<3D#y%g!RIJWV9(fjv{+&$;H*uP#A|8ENKu_kFR1DA&F)*K9_LGSmUY!vUApJH+; zj6<{f^aNe;z?A1&`;-2jR#aoRRtm#dR?>hXhye0_zKo9*7c-;RAh#%LRD zVc_NCz zcIzLu5Z#Pzk}Z#yuM~JK7_+d!Yf?_i#^jkdR_!||Ix*{v=Z+KWZk$?e$0lyuc(l1U zQAYVza+1;YT2~JtOPxI*mlw-L$S4XMTdY{V~@m4AL! zkyl#Z^tL%ea@j#?w}q=d#Xyo6EfJ@=g=qY~5R`GxqL!JHJ^obBEX7y^Ky2 z#nz|oIzOl0W{iBcN*c_CRx^L5d z?Eej;HK`9WWOgW@-|ns~@5{H0_szBMyRO~nW?PWRcXr>+?qhc!ygzjyuKbd$Pt~_Z z9v6w7oeayCFdFMgHy#LlwQ_ypwYP<@9PUMYs}Q*1SpKKydSZ^ORQM#NE=PB=eAWZs=*)tn;6YY9_zrI`jyRKOmKAYn| zUHpIML3!?f%riayo|pc3GIpty*yO@j<^@eRe=&C_%6Yz!*l&@(xqIcVF9mh;bj9`A z#V#%7i8{Wc@WrHiZvq*NMQqy2zWm+B`#8P$1WSFeSp6oUw2Vcot4n2%|NIcT`{9qd zOb+unGX5Q8{KldBbe7U4L$gm>DI4OvzAyT+B;=50XsNNpjQ2;PejRj~!(487K#NVQ z{@8+~`(G`0YTU}XHf4t9?U@T%UUZ%LcjBk{yqteM?a$U*R6EZI&}Fr`ylwYl1qnXg z{0q`OQHhxjjRI60VpU-(e>>-LocMu#_@ zeaI3Tea6U3NL;M8n(~wV`ud0t4>{EI5aQ51XAKnROZ*?r}4qWqgBKzJ& zk3VS7nB{-#g46U{r&5)62dVvk>f5ya)|DAbX5U^uNqKehL-Hy`_xhRo0iDxw4)JqH z9*y+&Om0#>f7eY-ZeEqs>6?NdpUCyh6|gj&w5==b>wW3pf9LGq&8IH9#o{vmo&t%; zzm4`=+?lnvu!mjW>hjofa~Ypv==pY~xL29)+;!rY9Qdp(rLvo)N5}a4E%uyea%=n} z7C+n||Lv`v&b)o%-)e4uabIW2w@bPB#@9qu_V{+IyZNGT%LG~%TFUH9{{Q;+F#*}g z+0IiJKfImbe%fhr*^FmQ#m0(X*6v#xc9DfEcFPfdW7G8SMh{aiZirg^!z`4`qwc42 zhSpPO4&nWWQ}Q2Q)@Af&`I=}Y@P6*~(uU6`XBOMW$N2ew6;)o!)}m|@mp<`ei`arR z>unK%hg_ZoCV3T|KA`Q963pbR7F%)N^5}YpHJxwSK2JR+vP$+yP-UCYe_`)+lI&u; zA2u+i%)R5Paqrz^(UbQNGVbd=^S>;dyh``tpC{XCETisb#~0ul2(14HT{JA37o1IkYKs2^m+LAT90Km>thz_o8+E;?W%WTO4;p}T=g%%7B@zw94YdCcCtuw zcByZfyvfZqr#C8|o&M-8KbPU0XvvRK9+K>B{^9$c-YT7uaN}I!&o+)v)2=1$yz%2n zxJiTKFT*v9o3-u~eGo|q_;A8;>#f#%pJry=S>F8N#-qf)9e#Ijzc?KjTEF7=js=HP z_!A{~x*2yK{2sDZ@51B8ZA`0fSO@Gq9^h!^e)X?W<}0f;Z&yd&7oYHR_wLm{O>E8m zFW+}BIX}_=^7XvQ6W)E9TN_%q;1a*phxv_MOpz!f0{zfQ$vYvqC;MlR#qzCEwT-Q32r>tMKkT+ZDkp+=Y1T->()zq)vpqn zd)oX#mfGqF!~L^Xy{w1zDSpl^L=++%iT$1-7@a7_V_HCzT?9ol!-8y%wjj#M=HO`qGY8w>JB|4>? z?Y`30=)R+W)s`xAZm89ny3zduZ>0OrZsyv@9G{OB*~yB^?EJ0pS%1Gn&7HXx?*FTA zOw|j{7yW(ZkJ2~iE3adIB)v7Hh5~!?~)h;_Oa8fr~A>ew0>~{^Ghd=a0?q8M^re3hA4l z*6fPt*nBeJVxuE?ar0l{-Jqg}uDJX&!=P{WI1kIecd z%MSCN*;!Qd#3w%LZkeU;x9`5%nrmm)hcxaxKBt!VNh8nA+pq7Jdv2OK+3)%1=jY$v zF1>Z{O`f&(JFl|3QwNxfUVaH^NRZnbBl#k*F|E>~vP zb|y!;RflDlE}OT%@zK?+c>(*gv-U68Xx_N@JF~6Bp=VJ=Z$A8HUh}(jRgVEv-zTp7 z;wz^=6<|?w2n;--yH?INZ13Zr`O_a=WpG`xI(owW={wXulzANvQnQRae4A+*|M{a6 zro^8T=-_-K=yzyYOPbyGL}TlBrd)OlyP9@|<*$3h`fkThidmqY6*D37$ji(Z0etNj#Zom>8g!i0y`IW-HtcbD zklZ_8s6P6b_?n*?-&7ye$9LJ^>Rg}n`QMpMu~TLj%$RunQJDMI^9Q$B89be&eEVUg zX_ak;T=qIkxu*W&fax>03$P|Ga`Z83kd6unc(sc4>M7Uxi+-J0;jXD4clGaEzH`k# zZpbW=S(Iii@`(33)516Zw6r;vQn&8Y<%fHp z7XR(Mzm2Qn-Tu^j^0v=Idqu;8tuK6C@_60X#WL1wEq3kMa{BLr`|}pJcpNp?krgn~ zHT=O1T0ONyHaq{e+neG)+AWIQPi_UNM3${7;Y?eT8K`r&Y1dtYoCd|yK{{7@_h@;} zUi#F2mNjuJp-BkCpU^#ov>_>IP zCrt-ocYB8eVKVJpIz_i%h2448fh#6m$?3b2V^&gH)4h6?)~N$8XH~t5y7uymk4-I_!Mip>xYqq@y*FwN}}#I3fSM6|1_>Q-83<}So${a z8@tC3b{|XM@U{HGwzjwLDt_FT{oWv-X_-7*??H;rzQ6AGSFU~|d)>Tr+5UfDjNi>q zpB%pX-fs3pztig$$ktygRnRv2otAo1dNbaDH=zMc3yg9gCDWCOy#bU~`>uZt}r| zoIgF6i#A3)`+8~Tigym~73@l1oY$`V8_}FJ`DumP(a$H-7Uf$U@wuN^A+zd&wtmOf z!+|;{l1oY_W>24dxFaivzg@Y!)YU90kwKn)ah~>WF~4Ukbk>HOPgniT`_g4*@iT5M zKi|V)Cchn~I%+Zn_8I?Hc&&drR(Wx=Lek2b>m{F#-l#q@-SMT@?f2Ie!cOe}B>&^C z`9mddu9RnSh07vD^IFRfeN$vQRm8=yI4|c3^NM=~ug@NI0-ev_(SZ&_`;XqlCHw%rTA zxN~aHpPx%_Vz964j`!8mJ2&sE?hfys?%;VFUiYg$69}B``>v@f`@ur#Hfh6|5tch- zSKpqYvE{x%*O^MYLHqp1Hi0vXeA@dyV=6Z>)2-vnbw;tIwt9GJa?2k+N{!f``y>oyQcNo{S20_a(CU< z@YYVFrhX3J;fyKiuG)<2K1xZ~N>A75o^hu-`Q_cuA*YoV{M-29^TE|2k7^Wbvu8*M zZ_{_VHosjzcG=SHdwOklfBxS(Ghyw<9KpD|2PP#2gg>p>nB<>gv*gQ$iX){540bPZ zQ$O)!=J*t`mj}9==YN^ndNiVvt4CKHrQ|=HS$Tl^}BuE zZNmMg)kn79-rvk_#bv*5-}dX)hMymL%esHHS@^5mMUwxt?Zw3%5^Z7ike}l4wzD^t`&+ zzW&>vnomhxdhzeShu;4jBG%A8@0YOclKO5LmT4ia=>_byJ_hpR&Gcq(lw|c|_gKe}#VU4v zL2896*D9-m;*f*2uA;mJGZ(L9NL9#U_w{Anu-x)wNBW&#JsdADKUFdBI`B`;Uwenc za<>#luwidvZ|B`|5U710zQZL`F@}pR*hycg$U{_9F<0nH*s2uCWM-ioQ@kg&*VL4! zl}-Q3`)1Fy=>j?Lk0$S_E<1NqQsz_Pv}9u`W4(a5z*grFy@Oe0cPghg?tXf??3mb& zyCsDzPdkjXe82U*aAS=Zw2KWn+~Igm_DRFKU+;oT_iR+pDe=>~a4P!1iD-v&x|vH) zbuOKxHhYUyQbXSP;1Uay+vT2NxAq?uSb90rN^{HqgJ~kq?q_g6lArcy19zA1^91&H zk9%GeoXCF=>?UZjrBByw@t*w(i{zUU-uWml)Y_?f&3)Sc6QBN1*QsY(KF{OQW3|2y z2buPqUb%YBtt|&u<_UkApV@s=iZ9qhRWfVB_ZKNUH>q<+|4y6rMm*X74}+0F)|U7s z0e?FW#{KaWWfEc4IGsGTS^3eT{5a;n<;B&8d)`G)Kiv4UpwxQD^{$i5KAgXfC`<18 zSJtS}|9ZWSW%tq8YQ?is$81(lVCq@qUc_!bg>mDbnH`3b`#74V0uO94{^z*wu804< zDQmwdesZ{9W_UBle~Vnvq0@GgCacu&UR~(*MC106J6{irCp~XH!n42N;LLm5UL^Z)<+*I@tC>?o9{X)=C_0@O-I1`cP+Cpm7*}-L zBA*XACH8H9ci(Tm=Ntc3A~X8~AD6!pzq&e`k5uHJ@6uFdeedYJ}@s7D&ao@HsYM5STyd;W+#ra;zwtq7w zU6GHSmd$$HqfL=1<-!}+BHd|yGoE#1_RUa}U*>s9H|?0^Op&hhYj#C`;A$u_DzoKK z|M7QSzti%<1l@4G>cG1lCH|I&lRv#zinQ-K$@-0Rqb7UiT>V>{+aI=cv)-|4b9bEk zA!I?IWaQVm9uq|`SZ>Xecr(Aqa@EEOZ>++OW_{XIwfJ^wed&+OZ|3Fg{xzTXoD0`> zUzXj6g4|a#TJ5{|?#ipJm)|aYG$V2LAIaQgpB`^L7NdB)7vfSxH@ zfu&tc3>n6UtaF-c+gRBcq!#?R9eeK6>3dhVUj1MC^+JMMkT&awhkdE*^f%17^MH5i z6qlu)TDDo+e@&e_$!y)50~0h>pOWlabxm=5j3WE28FF);FOR(FviRxCZ##`wmB%%z zE#sQyprPo-m8te?>#Fr$isyURH6?szOj=@9eEnOt_V@P(?T&V*n6}=wli&U8XU3A} z?~;DK+`4&|uKCTX+7;8*m|w~%iJBXD`da*FpUq!g94A`Y{jB%WgOomNVsGc&wh*ZG z+tH@_&CvMm{$bJMN59n5-^vDU)Y~$} z)mBCW!jPA9_&3jDaq)KEj%E>OajhbxRsQ4kY+Og{aj~^GacTC3% z_Pnm29Gs7jZs0g2$<4R$rcM3t#VIziJRPPPzt|GgmG|F0T=sC1yx&<*#`EkeEPdzv zJa*W@>+ady>hd!euTS8xdn0uu#lS*&-ume?Ha(9u*;d{Xv#$7Y-}Udxf(s_R;i&yJ zU*`YAv};vY0#lA=L~u7`w#y!O+Fh2W>@>?RZOSSeDNb#!l>GK4NvrocR#wh88=qCg zU7b30r|Rwwr;~3O@9qC}fcv8REA{Bc%^&`6K4R2&_{QBBY`uf zFY9D;Yjpi1V%oGIft%fits&Xy_ng;z8aJpudL-b@Vtwm%zL+z6iSd?oPv;h0Ua8v-XWK7bBQh8{9voyhswo&P2YX^eXQm%-&aqbkpDW`FP`6;bl&Kx zX;zL%GdDn$440(Gf%pDJ=)LG7xnkX`8%i5 zb4^wchnx|Ym zRw|%YcK4fT%8_@0(i+@%PZ-Aed%1j0tNignv7hq9Rk-?*4n%nTwy_By(54HL7k-Fx|lQvj1*_LoCaRADy)qZ=HM*vEYW!|EU}Q zy^#o9c;z(rX6xNMPQ=ZxU!ujQ`07ZRhVwx5l35trDwHF4wNmpv9o&fGP%`zkfNaem$@)urJxR+#f_U=&(D zt8%U7yF*I#w*1UHt0r;Ocp5!?DnH@Sqky8%kDC{n?!DKtW&ece8-I@6U6CrzXMUYo zsk7WE@%%i_{X(DhW}L5A_e;7Mm(FDI?Tg$$nd2(wqeM)$-|F8VI^)mu)dyyFCSMoj zU!$UUR@TvkYl1++Op$5QQD$jRf4x4ic~zF`CCooBoOAbS>&+>TzsGBzxV|Qf|MmYJE05lM=H;T~)#rY3qnDLQ z60eWMag8agiJq70nWw4p$mczqpj~Qe&b(9T>zaNE_=muQSByU$HR&= z)fBO4&XA)SOuK!K?svOnsw-kOl&)<)&J9Tfbs&Cb5@dH2R27i2Y_UUrtn1-K4%lF-RTE8YXI{UVP zNZq@-)gyh_Y%j@invF;IvE{12 zzrw3muz0lW&B;tHRWaMJ(`ZT19yN{8wq8g|7YDdH%ZlFTWQHm46yOTi4TW-CABS zamvhomfRnWYv=16yUw$)Cw={gSuGB}xt|v?T%K~Y{ZGY>)n$!sfBQa&9tvT8!|J^0 z)`M$Yk9B)hKb8G@TNT(L++Ex=E$YjEzO2&>yVqUoJ9%eX#P7SQJx|@18g9M0llA_| z@Li{0eP=z)eXJr{fJwsZw`0$@iS-xt_8A=)>L1 zQWu3DoXX=YslMP<&*9W>wyx~9Ys+6On7SsPX-ZrCsR^~ud-L_yFE_tFd3Sq_)ydBv z!%J-MKNB`+d19G1X-4;!ZU&yFV-nX=*!P*g{L=R9v+uL>A9A0a|8V8cLW8H9=AB=? zv~$v~**jShm{ZyQ~C2B(sCHc!&%E`HXaX9vu^;78Ct_$o;5f8#u zo+$4%e)al?h5y{S-{NIie`c0zvHq94_Q1Z~^hKIx*y1jd?R(cJq-za92?J@0Xg zTdw~@>8-l6KbN=oYzSeSF24TWn-{&Y8*0oP^`$&t9`><4Hp8RysMw4z+a4;n$uP%6 zoDQsHFNk_HsWp6c3ryATRs$X--vQ08c zP+$sQmoZVQqH@}_nc|`fL6s8I?}*nN{ju-YGNF~L!$XyH<~Ipn%5U;5eR4MW$fWp; zDf_d^U<#4}8>jr&n{HO`0Q<-Tbf;sUIHB)W;uk*<9hai_~k z@A=)0cNwQN>ao4Hc#g?AATosW44r z=kbNg>pmr%OI+hv+LU!cJb!Oo`ci?Cd2!`Ccq%2f7O`rVpWXNIx(`$B+(+MToo?K& zxc@`&u8dPM4P`Ta?|c1x@C(}WqTzV2|D~d(2dg?OZwoK>I#a!)W<#p1UgELR=ktV2 zQrgab+?Vu#IpVl$&qv=W{)^jSVV82M{PpkmH(zzUV9X5JQTmzhX81S$Z+AZ~tn*Deku`&5 z3)^>&hns_+)*kU&-zI)N|Ni`#y^b|4Q^G~p@0@vWZqn-Op7$Oq>KwFU5!gH>$X4G& zao576EylX6x`(|sa4o;Rwafm9`m4e@Nvi4Dr#3u3;wtv5^5wFlyXO22^Sr&e+tyEe zzOYfYmhZGjCw6J{y^-sBy!NTtru+|bH@8>xzhT_t&L!bv%V~4e_Qt#yC!}=jw;lQv z+`g)6mUfd>wan}Ow;S>||C=|(EjTz`rk$DPV~x4aANA!IKbS0H(f<*xSYxFmpX{J$ zBKiI7&FNzEdQ)b06<@NNlNl7UK}}S3W%}ENeM`50iTWbeenWTfv#D%5mo|GhmmJ;u z&2mkr<-&bSerU!N! zG7U^^ty;X*IIUj{W(b#~YXvxmp54p@BQ z>`Sv7mzOM0h+eil;q4o_53RqW+a@Tv6@`neWOtvSwDP*B%PE)eOJYZ@8bXRiK1eh? zvK5r%t3Ik`Jl8kr*p-J8S=%?SiJHLQvg%Z%XHHY_&h(r#_fiv2dzOTHbU8y4!_hI=&ADg2QnQ=Gx@0gzaQfD@^OWMXcWTx`^b@%7} zsj%DOV#wV5MLOq@3PFLi%73#az`)kxh ztF?s(*t|ILe%^e)4-)NvCtPj~Gh0`!vW@$I$yB9Y#}mIYUv{eSJT@qLtkPF0@>|KP z$z)p1TLt&U>_L^Q|2!?SnQmEg%F^)h{=(}wWOwkFrmdX)kkNn6lZD!o7Dyj1nR@A% zL9D+()sht95{(4khi`tpefr?)*P{s>R?p6>i%-|`JGsuP&~@%Z@$&CCH@8Wz-eS8p#L?7zO=IxqSs zqq1a+(y_PZLN>g?acQ2BZjp0XY&v2ms3pF!TlmN0SKY1e*OPT;J>`BhFT-|69OGNh zscJiK@F@%=K7uq4-uvG`mp9#s3NU zxqIC{HOy#w#usB_F!7;Oz;&Fc7Vavb+bY>9Tpg!J@nk+EZ>tn{>eGvuIIao zj2iT(v1l61vFO=vwl zu_tveMOSKb>vJd6>tE*B^+L7v!zl%SuZ`PX9|bqJ%BnNZ5OCQf60KtQHN@}fgND!5 zg&!9Sirr>QT&s{2@oCC?zZ_9iLuL4IwN+cZPKWcTv6ij zsn9`udLU2m1<|*bJN~VkHR1L3+yeVP86DqSE`h4;VHp|TO=9lHE-=pz?0jc?_+*gG z1(}vS;5foAU6C;^~!d zmDZd;eemknn=ie8eEs$2ipPeXMtl>b_G~LLf3vMjGJntd=_N5!W@^VC_}v%0EArJ- zhF_1rs_xx6r>Zi)u5E_ZlR516!f#(B&b+bZ^yTk!>l-dA@3}3teC3>jN+Yagt?coKlT%JgZmHWtUZM9GMWRuZnb2Qoi z%gNH#?EM;EM$2tYIQc7*9;xs%&S%J3$Sfq_b4z zpe+bDvPybmrli4NP*9Og3v+5NM%kqk-25DNo_-dv`_C|x!E}!tKYKORNB7Cs|sKLUVp{8GYh;`ubFR7 zEidbTHCcJG%+q@p|LHS;X0N9}=Lwd@C%QT@6$)n8sGfCRtP&JANrT08RY+vFeuIm` zA>WLpbv4hobsP5G+QahZ!B$)A-PYE|>3&yl)n4B%x>lwt?$E|c!DzXMOPIAL3c8*a zE`Gu0k$*Q>>&@;Iz8fndZAIr5J=}e~^20K@mdlGQirp{vvb8ZW`zJPXaC5AZVhr{? zutGub!nR{)Y?mMD36mB}%RN_ra8~!Hr9xi|s@B&pp3wU4!3nDe(baj^^?vnnL>WXi zEB_KxYm*Flv+m{Ud-)aYRVl1y6MF@W3>dYO8QZFsZ<<%iE4S%r`;+LIpyaS=684VvPD_H4$2P?KX;X1v-#4h{>C=79T{GG z84s~r`t3BlZvNoFxm!0EKJr@adHRTyp8bpnzxh$6uI)EM>|O-=f8e+MSUR__PkNQ{ zp)={F_un4L+#e!0EFM^yaEwd@ZnoX=|haCY9tqMuU@o}M?@IIAq^Z`Xkj zOKN6!Z=AM3T2<39eF{ri-l`e91&@ZL{0O*3yrgTX%Ae;HTm@j*pekx_@TSxg+=|(CWh-lb(<@i)^m%d+q)~GBq=% zC+W5F-pKsKNp}y_rM6bAUVn7nKAE2lJ=tF*@BOp;`!Ydlu6g0zPWkyuEbX7Q{IzG+ zoq6Ek>2I=%kB=PR?#Gep&QrI#Mz>GJQ}4j9E1VJR>8AIkH=a>m+WD1HT$0^Tg`2M>4h^KJRanQ)|hv_Q3iVornEr zEfveZy8+L6DP$r@xigmfsK7npm(rcz_x z7uDu#=HFIpax+fC<-JDR)m4sQ&!Wz`t7| zY_Um)UD%S;W~IUt8d94@ZKrYG;<2e?zIk$X+!cesv%WfyAlZ0NY_`A5aiPCHbw^z$ z>KxmB`flvERznXJhbAW`BbRfbEpCVN`faBtrfuE)pg{Kd_WSFCul83m^a;n-A27JQ ze&wrm>(;HaS{m*;*Jz5uiH5>SZv%|@1P`Bl#dzu0<`vz${Z*JJiI(5Go!+OY^gl{7 zX0MdC;(YJeXxmbC z+aX_XO=+H2{mJHcZ?$7X>_2toa)r5dI2L|(^v^2hyWf|sEwXhF|HfhnPS-X5 zCp;}a^ya49f?|n6H@EN6pTZX0Dc9zfb&1of+Pr){cdP_k^Rj0=o0b2ud3yP+KCLrv z^`(S*spAWZBrmHjzHal(`8`gq zYBBv2c*L(s%J_q>Z=zRc@tbL9>N_N4`F~wLnlNd_+qG*e(igOS%rKEPIl3aG$S6ea z!MR$l?Zv;&pNrUFo3!Zwr|`!sVscBOl#<@Co~z*OpX3|cP_-aZIPc|s(Ht@Tto*Xu z-nT2=D+D8W*k_3+O6=)STB^>zzh;q08!)`5d|A zcGtPSe*Hc@$)2XW7VO4+SESw;I2%M5ozqk9`rf!Dql^Eu)|L}#TLO(s8vdC$3N#g^ zbWN%#`SOTm^*`%=qgv%0F>K1rV6GKY+0cy1i}F`aX%sIMT+x_cr9BJR#F^k(&* zojyE7440p@n zDv3!oPue6PWHI%LR?1d(_sm<-Pwm5HszgrwnOC#keDg2MNT%$6t}Vwet+6vWC%yS( z&W5=>>C9^%eQob9Gzz(H`n)&F)$#mFyB79?5{3`H+&^Ql&Ha4s!zWBR4qoEAh294) zc4V9Ta=$)u^m*^vu8)W0{!PdXZaDPdtfNst{tKV5^JecQKAc$S9ML0P`C8_YrhMH$ zW-Im(TRyF`vwv=UJ+ssA>vLsIjpT}1CJi1*-kr=L1tnEy(v6kGZ!%rje(m+!<6_!t z-@ovy7tql#S*FR-EK}2-VRhk~=tf^gfl3>%*BoAgI+K4?%}}W|jqG7xyu;pWoqMq9 zwWxpR0(^gK&D8qpFJXCnz1!sFy>r+N_zk{@E}ZdUdH9J(lUY~{Uc_9!X;E|R(Mw6C z_Rd+p$0pw_F!TJvBd`83VNdPaUyFaH+^fI!sB%*AvTI+g&g#@iFljv0d@|?JskQ00 zU+0v|xo+TDw)v$;ZoM1JX|n|e+gUk3bGq;Szj=2=fA+a!;qgbjUshg|k7Yf6@w@x< z<@RM?^~L{ipJe;_IQPIkpFa!dFfYAuiu*uc&ZLhE$|VA&m@VJC+@BW{_r}+4+4PGa zx|W>#4vXS#U9A>TJ)L7HK%|>9`>I$Qn7hkVk|Ma!W zZ1yYRFFDupI!#2imw9{^(E9Lg&2HcFO<(Ho%Pb32`W3JyFQawKn{B7pB?ODF-YIm% z$fn~ndr$Fnys*!hR==d80^yS8oJ^X9F4rQ}Ir`)bFfhd-HX7OHOF7sa!0=V?o8 zGoDVB{Rw9n-Z?QuZ8SI7e=gtS%CxX^b(zdEWsJMqeXB~c-x@dC>BWCAU3=G{pndm` zyK-KVSGFbkeqNz?gk#NV#=ly>80R*=`nCP4X~F)@>H16en0G6MpEbA9`FmMQb-~s; zhkL0rb?>}f(6jr2+VcpneJyO?c$}S&&yk-R#ny6}xxT=A&+eMJX-hs$yuQ`_vgq2w zyJHqCsEYSk5+KoiPH#?5(K{D1S!dRr{LR-s!SXCq%=g33p3eDb^1P!!@cQk` z+-xmL{D;o^9k2d*OK4%)$MwgXi?wf?N^+lQ(XizDpr**OIpl-TGD{^6sSR^^ckk-fAWhqT~nRZ z`0yS7P2TGCV_biy3kJ=P?XA4UdVEQCS5%-SZx4G6%loc|N1;o-_7!CKyyuwdk@IGw z!o*;9d5(mh1fP{{ryj~Kk=~=&>2!7+=_Q~BbV%pI)-S4XWQ&_9Hr`@kB`p4TVS9Q?g`y(;6bFZaEKZfe(Csw_jvM=$o zA&>gqlQS;JmhD=6@%{s$H{Sn0_JrF=UVQF;x%98CznG%R)&#CC0frnpS2ilEPW{gl z#dgef_ul1USw(ZXJhMw%7R_HXvAzEHm(cSZncG>;R^K$-Z+tFo{^}2#f_5j}=i8P1 zNbbOj*8N*&%vLFHsxE1+eL4Tf2@SvP3c2czyI-=L)$0BGqe;kg({I~1ucJ%$Fdy-% zoUF$<$33elW!v)^_t}ND(u9IeElW9cD$F(S{Dr0W{7WTQ6f6^T=x3~*_U`bTZEVWy zmj4<|W`Eh7UG`4T@z8SaNlTX7yQ;Te+|DlUo+z&I``FEk23%)^*4Hg~6#YaZCGbnt zkwrUBN47lY_cJ$pf2wk0NQqCE(bP5C@3o^gZ~3UFy{^#uYQC7`hS-#?*@nW`h1P_| za`is*wTg=^&GhM?Quod@a^LS2#}rH>*6#TfV`i#&``V=3cxI5BzJOOb{Ri&8KC@=w)$ejw&p$dAYU3b`B` z?z!F8GJN`{T=eUi%KKebQ(n3=9Zu+3STvpca&Yk{wtdguvh6y>HnmiXO3Ck6kEmeJ_|O`;_J>@VmFCgkMk_)}P9@Z4#3?pq zZgdQIR~z)FtYYQ)SN8K=rkwqBKirLB=DZrcUq{!^aW79ltebo5{_Sbs#2i;1aM+>Y z@!V76w8r-jcIPJD+jHP-`*a)kyL#QBd%PqcF)y?K`a6d4*4@ynRw5e=e0+2mbf5Z& ztbcrF#qO`~%StBRWxH+iP~2_X^n}U5Z$GZqS`oy7Nx+so{+v@$8r zWiRLED|M@2DOnsY^QCQXn*dLbVrWQcmi@A*CzljG1%1`oI;P$Jr+R$Vlh>A!^ZS11 z{ys0veYzqeseWm^yy&*Q=`FeMD-&-|?)^36&WtbnwzkLz-+R31!8&1!G(~MDHCKl% zqUOAkk&|z2WnLF5;CJo7zhX6RZG{OQtx4Z{G$a0>UA*Yb>Z5A|dG}15HA!T?mf8D7 zcb`e?yj#JXnKY4c+yDA2vA+I~9eDm~TbgmjigLVEI>LBFGVCyVqMe%X0qq)Z&e) zv(l!_+`ww{@@j+INw?Um-W$!hABeoD_Ax%OsyWTFb>4>KDi;-mPyBoB`|q`^`JuA4 zD<@7j;N`mRD#=vXtKG6>qL$AJFTrf{pyhlO7Bl$wKfTRtB4BU#^2j;UMGnWfeV0h> zZE5+m)#6d&@nwfN)4wXZ-d`rk#?2C{R%@w#o5n(nZrp4VHf zv$i|pzwjb1Q7Lc#)hnm|`It0I-&20hyF-~$DLWPS1cjgYQN7vCqka2MvEYRlm+mm1 z_vS^h;i8ErqgcwUbw{5HgzSEs`YYM-w|?c(^mSJwvr`|Xf9if$w3#ngyM%qY z;N4w&i-R;5Ea_Ek%DTM6Q+U&3H`BS=dh6C#?U=WFYfQUT=mSSPWZE0s+Zt(W zj@+!|8=|Wl9H-p!@4~O_MP#{m1@2@ z@%6W9ZsA`!dDm(EnelP%q9f-QuwGF3(6qNH?8Nf_PLFJ=`uFhc1CN3&iS^CD>>yzK zJO0gDmrmt#tzoMaJUk{kED~aGX}aB#^l;5;i(Ju<&u>>Y1RuJo*z|N1dQ?A82VW?d8hR2j8zJW>B^(ao=+ z`#KT~4&QTVTmI~=Sm;Wp8?Usu7E0tEKD}z~K{kDXx^{<+6*H5s_-@cL@on1Z!G7Ym zuQXGa>16}ed-KoQcZg&bD@?7c`7N^U^zE4i1#OG(ui56WoteLiUu%K<&it$SSu&4z z9%R&Hop@>a>X%EtTl_ImQeGCLhD^;KRY|Qa2l1v0?F5Y3z`> zv%^$phyS(I4T~SmvVN_n!RGR0hGb$=U6R*|B_f%-zuriir;?^SpHuMYR-^g?n=-fO zxjRBun_Rnf(~R@ju@K`##w_8X5w_jEgJZ zwf?HVd-a|>*OV0>!)Hvh^)m1#@g z|KhEVPsx6INBHg9hh6L$GDY|AzL@=fpa1U`zT0;*DtD%Ozn78beG?jeKfnBCO_C6& zs}qO5NA%JSB0F`eRjX=xF2%h+>%k~c@ZapGOn`c5g~3Iu;=*-@ev0g$n^STu^MK<* zr@DC6Y_81rO*w*XlPp)rl^YaIZ z=-Cq)Pq%pP-!Q@a;l2+MqCz&t?H-wroy-pLD^8g19RK28k=Zv9e(`YI2Y34>mlPOP zo?t#2qVS2s^6tv=A4iMZ-`Dbc@98)(J(S^uP0(I(2j2ISPNq#ck#hK_k5#CAp2g}a zAG=Uh8K2c+?Vnct*=TMQ>9=*mtKv1wrPt2aS+l$4<(%YFrZ=zdb~-O?>~uclCL6zM zo(z-2G?sAA?G{Pr-CP3}&i=Nrm`A#6bE6IG&9HCp<+KIPSbx5D!TS0%$xG3nTB5Vg z7kuxYX>^GrZ|APN4E2|HO}eqL<;;QUVXg{inatJ-TyI*xXcoT=7m+`L+<=t zdCisrE1zuiSu@q4iznIP{JdA%U##qSqfe{+_WiE0BWeG?6N%rVbIlZ$`%^V{8Wz@U z@JiijelP4|IkUsm&TQNDkKA`^EVi4hU9;Rk_O@%s?~uIPpV(qq15!iH;`wj>+21r( z{K3WC9ODZD>4%~ex;ETeCh@2(>%|6(O;XlN9+!PEFq7IT&gy0p&M<^_I0QFX za*3rz1kE>lG%G#*#j^qiu*{0^Q)@rNsp>Ly zp+d}2FWvd^(oMs@Fk4@_J}Q$GAHXpj5T$(|9s)k*Sr!v9nMb0XibnO$$Z=eMkq zvZHzZ-|NSxMTER7N#x!0rE;%x``f89N34%MI`O^RV*jr_b+M~o9rxX^;??v0qB}~a zS^UkgC}O*tC-O~5-}_PE{;;e1=ck7JE%Fr#;MHWjx?oa6*32gb4r!IDfg)EDHp`~$ zT@cOtJEea8^{-LANntD40+mEpw;x&2dh=5KlGp61tf~fk=D9rl^VMtZCadEu@*(|d zsqfQrU+BLq@?IqJ`|>S=hf59#_RSJr`KR#2_p+HkgVM?tuJ*8O&zNhSxx+=gag+L& zgYnw48>Agx{Au@0FF=GM!VEzLz(>GuoKzwbeaJ)9-6z*&Nno z(<5uV%TsID-V>5ocYlhKsKAF4{42Q}ltiQ5&!|d7g(r9{5lZ@aiM=9{ZC-yw_0p-m zs_G?QExHP|zg%~$sl6)s?D*1!i@E}4N59JYE3|6f3-=8BtJBsqOD`5N&NeyKI>&Bj z(I*EU0k6vS5vFJR4ln*OEy=bj#AbI(QFzsco2A~DBc^^iKRbL)mA{CP`rAp7((x|6 zjR#hUx4r3}sFiT%!v>Q;%PrYKa_5i!>T_fjF=xy~i1&xT>$d)kX}G!4jcdk< zbGsVW)g&)YIC9b{cYF77-;!_BxE7U8-f{o5TjH&^-xlS(`Lb7K)j`jdYZq-uzjjxR zpV?`C*7rUKXAENkOMFr2OXh zO)e0+7|3;pMQz$IE)~f~{LjMvRnDkqe#NoYJn#PTEss=Y-&VS{v4$n7YR`?M?WsGm zZ{+JFGv;=!cDpLnWfyUgjgi6J>GkQKY3yIueBv|Sm~S%k;k5%?F^*jq-0pVC#fhtE z`|MN}?XSORePzWd>9^j${@Zsc+~T&mWY_!t`lJ4$h}UN>{80W0omaMp2v*^lu`MeiL7%#@wq#8teN_Cx3 zJAGiDT1;$roN#~JS)uH3!DklI*VoPDnS9y#so{YxYaxeL)BAt^Tuf882#HvAY;{O; zgxBxtBk`{OBC@BM)gLypxw!s0W4>dqQ|_eYtnpE=eZ-{nT8{dKIbM$a>oq4b_HfUK zr016Z7xBbo*qC_x$(EdUf4bq!>V{*|Pf}VAK48$dx?5nma?7IIhx54I6Yk{-@Veda z@M!pPEAfI~bD7wd=Z@B#_tYAB|37b>%UULNk%!n5dgX4m}> z?q#;UAD;cGk}}V6-4^g&XXdeBmHW{dsnZ^Xo1OlUZ8!UIxY6!bv)O^hxou~|R#ez`l0DcVo1=*9`2$L?B7=QKo2<3Dq1 zVyA!yPu8Q&n+{KvoOZ;(fwS|>8~gs2)x2M#zX&>t+@Oex`CP&FuJjbkH~Xh+e;LLtn-#L>;thGOl`f64tZywUq=ge(^lGad zU)=N%a?r{XxLmqKaJvuBLiXtuQHvv=91=O4;$l3b?L=$#N1ZnA{6x9f8T%h_OcwTY zDi^8}U;lFYHioa&H+rf+UaBeNmYc}9C1CdJ#u?7%^`DksxGpkd_GA8Ik8jAgD4caY zoMO=N*D7<}pB&5n=AC^xoUN?ejxRp<`Nso|zi0AXpFQ;Ue&VmP>=nb)?Z0IsPxH*` zGFotO`i}cEieBv6@8PeP{danZqh7_D)eE%Umn^8+#N_K1gqvrof{_JpYewCiyES9P#Z(QcgWUPAeDRKk%wHEoA zoEdLbFDJa_2sOU()+{fyYuc5+S=CpC+(mB&2OWs+j(NEzd`7jvQO7GP&)8;1+>7Wh zb)O;eB+}!-Dv#8(t*4I6&;Bsy{kq7Mt}=s9(FHHN1mk^AK01-fm>8+>WMxp;#9~RA zV=qpv?k(eay!n2sXuDRFu*Nctv-K?wYaf=af6OmxbIWp)K(*V&If2%ap|7uIdd|wY zowmy;tl`rt%?WYGFG(l;PFZ`WD?FI>$=f^8BG=}rC9mGbd?#)Bt@_*xE31ufhX%@X zDX!jP0k|*r(;K7h};rtK<9h*-5UIVg|GCoU|*x6*9B>;qQ{wcds1` z_S^rsD(rUg9r2zv%U_oE=O-Qfxbkf)k3e(ug=gCz{m7}U-kRXTcu-hly=rKebw0!U zH|brcK54H39go?0Xv537*DH32@@;BbuGud8(QEN%g=-%+eJbG&|LoS!TJFDd+hpYpDKh6Sm((6V=(ejrOGL!~%c^A;RxWp_U0tr8?O82W zvpjX~=M84dmd%=cD`HQUP}uC*N?Q{3^6E|a{uXYZ-M47reR=nD<)4zowO0Cf$7&py z@#)_L#^Mj`Z&?d0mRSc)-DJ&~~>J`@g6YchOg5@Pz~?gAf{^9)V% zHqX)gAhZ%5&DFv}`}|&OKw|O2%j%D|Y=d*Hm^-*A*R!sT&0L>^bcE z?D#CZo4rC&9E!6RKU~G&sMuF*xo7rAX?DQ^<;ay>&(<9ZW@>Gn^?PsM+ckU@iao2A z<#S11@|_zew7f9?joV3$*S(ACOx_$_IX|hb;QIGphXXBMe68n@{B-$m<3z>d(~S2O zwTJ(EQJHe$zCp&`V}DrQNc`#*>ap87UD70sNi{|Aq4kalo${^CH@?=|7tK9*qVw{< z8-<4&&5Py=K1@*C`yafv-D{J9;Xw=WOJ0f$CUxN+^7d!^?lBrUpsLTa7<_PFcc zc0OPEk9lWisr{F1`QHwP0=AOu3qJS=m|Rt}{x~u7fY~lTH{;kx&U$(hdJ>#*QtO{b zyG5H?7RoL5WV3bu-Lv?-jd*9#c^fZ@e<#zMFYP!KFr`S^V4hL`y0)IT-wrI`e)Qy0 ziIY)Z{kO!Y@--1ZxAJRSGcV3R-(x#x;R@eh^+_A&^`&zvWG()5`|nym`^lVZCf6MK z8p(1Z%vP%ZaN3QM$J?G?OJ4tU-qlCDq}wm8b?wWsPF!**Z867$??%4;;UET=l<&Z)%*{#l5rFwkXT2e{5o{<&m^x%{3_*%}mYrEBYsCHtn)n zG}~jV2H)RzE9$>CR2>MAICKADaoFjJI@`V{JEU{4YWA^V->DO}iKkiFf zs(3P{{hmQFFQeST0yeQvQ=I4Z@lN165kK?tqEw@-f+>mJuZk}?d2NyW6ECx=@Rn7M znbY(Ini_BIOW9R^Wo~4#j;~BhIj>@;t{)n^I|RNw6pyqh1iXo|C6Muv3Y`ug2z zfqS>L{af+fLTGl9hS?RPEiL`*&H^HvEc6W~e`ES+RmtaRyrXTUR^Oe+PC9MX%+L9v z7`&VhHEdqYAlVeb`qkfG+V2fdhpU&&#`dp?28MML8bVgYO)Rl=H{t%#$HCZ{zh1$Y z_n47j*u1s1N7iOqMrOqsMdlvOE}8o5lHh@7oDLmY8Y?aao!jbnc4~$C#}6*IxlW}q z==OTX|NirX6|_?8N^EAaw0rSCov^wiZrkoNc`)4hy&z|*Lf4d;4l3OXR8DW>+N$1p zT|w*^lhR9zpKo6#r{yzEn9E-ox=lf+>iLV8FJI1lSr_%>(#)ejExxg^=q&rB$uh;y zL}Gu3RJTxDVT!~?4ke-w^1?v3VmlbGfpP zR^0Q-#N9TkjjJEMo0S$~_e)jm^2y6Qq8b~Ue2#6I(b6H+Z1iyPVxBkd*=>AQy_+{A zwCKMwJLK&q^J1P;`R(9O5f66qu*K&QIm+Z&B#jMGc_`an1%CA1AWgFvdC4Cqs zvu*j^>+pSNypoMseD3U?~1F$sotINsB^izUDC@J1>U!N?|i?pJk$Ff z_Xf2#+?>L32`;aZf9oE*d5h3lkdEq}T6k%rH* z`D&i_6@PAp3UXWc{ob?0Nptbq#c((cv`s>pq8Yc5ydV1Dd^Rq;Co}`<|Z%+YL4ugDE z#|4M=oXT~h`;{&??CqR4qp@px*89ynB7_PKXb40uVSKId+w}CsukVV(Zpz+B)lYnu zv}g4dr$hfdY)*UnsC&t1e-N_&@L+f9s#$E-+bp`8FZexjFrND^Oyn0+Wu3u>KNm{w zDtv638}K66X<_;Q`h^$dIYg@77vGFxJnOkiD5Z6su|c_2rE5x}&G8ir*QBX$vIk?UL!@p{$b)PmIe%^26!(e83pJUR;letl_ld$)e>zTAEB#iQh#F0UV@F};r0{9PSTr)R6nnW$;UE51(d7nguS?}7JzH!K@D zikcf`S$AZdd;4!u+q)wV6Kn2GUK8FD<6kg+&a())=L-Hg-DTgm=|0%LZ{0$k-IK0d z3)ndO$das|WeyCAAHF_c^{9OJS&#M7FHG}WCi(tt-jo^=w`I?l=lrg=|COIVo-aQ6 z;m41=yUo>OX9}rrkN(`VlXKo=f0pfwUJA`L5fB%v{ONk*JKHBW_y227MsIIhJJT7ukIG_4U@z zmzw(O*fKM-^I1MocXcOO*;g;=N=YfPF7-AIEqm7L@xIx}e)ac>KeX4({ygQ<{P}-M z%-B+O&EGjD{oJ>*Qt{8>ElRdMA^KdQ=R0-Jh9+umPd4^iqx9UjyK}=?3k~^_eVxun z15J9*S?cbrHh=PN?m6>|6=~TM-{o2eF@IkCsHuPFG1=>%zHF#rIO)}xvqJI43cFn? z+V3yz{2%>`^;Y@u|5c`E#k}pMb*}4gmlTt?QNN_x2=`>P@hmaE%)`Vm#)+D zjxBq)a@NIM&qu!AFLh@6HY;UjyqsuavgQD9Y=q{Wg9prnb(=Q*ofdL$YPdJ2%jy1~ zlbSAdJYx5ipZP&-bK1pSu`^wMq+B}ljQ8lrE4P-fWHk~=dh+h+*C%iO{Ce{0Q^yjo z9}*o;rg?wK)luht6Yx;va(l!9b|Y~qwP0p%@o&0Lc|WhEY>d*HJ5A{*&&2ZbrQ7z{ z*4yvg({!?+^zX|Ra{@l@`E~oruggzQx*S~@_at3;bLaU=pBu9eo>QOCvyAiG;>Wk! za(^i>v_0KvAnjvb@`j=3mcpgCHwqU$64Cy$e8ckU814I~>-WxDs<1;c>h9-fg8TEd z6~0^jS$N4$*Q;oHhHR4P&(3nxUn{kyhQ_;OKG$*d^Pe8NwPD^e<;3)Ir~XaSmsl?uG+$-f*64lX?)k?Rk(~xdQy&zS=w4oQNloPK zxtagjmD7Y+w%c@Q1{y68oBKF%$KL&W9xBUi-G8Y&X0rrSb7Y$P;g9|@D;?Rczr6b4 z?#YyzZ=X9ay)3t?^}iW@%szhZp3q-i-v8}%>wj|YOYnJI@FmaU-}$`hN*ranD?b`Z zG;GdP;_BE@S--qg{-57#JDZEU>ZhNb?epp5yp+sMO;e4&hO7QA+kVaL)rq7&Ka*;U zn?IQ4=FEwYuMM)Qc%-M~q@MJ@^|ZQ(iKPAKx$`FJR(0+6|2m~9yL(~Xw-2h(w$%}< zd|nx9X4urcobrF=yU#B~uH0hFTI;wrf5A2BE63Qf7CYwVEijY5a*Zu(wPSAnf^E`Q z&aq{=2g%!<%-`yGDPhw!h0KDm{0SyEGEF?BY)qt8c#lQ$PGZ~shRw6t)iQqGtk>s1 z9Mz9r`kA?(ML1vh9M?y)n`;E}h0k(*G&>1moZa1@D{Gr)gh(Oi&}m1UXON!?zFc~^_~4=?Huc+o46K*Jrfjcje4=< z(a&UcQTtn=N6#->ANbK_@8&M`S93#c0^hHB)LE4->VL(0b;Y84kw=BUp3~Yl_kLD$ z%I2>8=WFgM++6eMc4dZ{huP{MWqCJwC+%PK=;6`3p*Di=S3T;i2p9D~vU^p9(!J25 z!XMXZ&Fd%+{phl1byxoL%~8v5taxebpe*Sl=)qyJt<`^y49 zF7DNe%e#2kfa|QmhtT6?XH~B8obTLv#LMLHm(crHW$i!S3DDj4!v5Hk37`86Os2el zzo7HqAJKZAO_TCZezj7&FLXEb#O5a+rBCGUX3O{|wte4iGV9S_jeE?KA8W8j7wil5 z@@@!^*tJ|LZu^b3!XNl11{`zNT5?%5|KibSIjzQ6Er)lhq49`Ky$QO%Ev zGcIr3cAOBspY*d*>#Y8iQ0?_K{wmWK9iGQ1|1nu_-J;TpUGpC(GAd2DLtFbLwvsH{8?s++8aN}_*?&ET5Hv5^)KHpd+oY_=+(zt8(s=% zIUF(gp|eKGiRXA16IY=G>%K?RSL#316-lTONmu;X|6oGFp}lFxb-rn7b6jFAnDghT z!SY}=MfHu`2Dgj!Ez*>(T%Wu(gv%*hZcfyT?PnYPTRuKZ-?>5L;?qqZIK{h?4yCS@ ztYF#bmryg!e8#zncNAY%?Q(zgdqvMZAHDT{ZsLc{Ya@5Oc@igSyrfb!VUoE-JoZ5?4YKXilke~kH{--sw`z?AaHBV%G)K+#2 zcr@Q;_HE;dB{OVtFScH-XV5GA$9VgY>;I*5l=pvd-E!&pm9p;h%w5|OrtI4vc7Qi2 zXQj;CDaYlXdWIA?yY(jdmwvSTBZ7aQe~nJdzoYNlAlU8mJ8+T zuD)q9n(#_LzwYo2=Nm%b7OV-$alHI6c4fWl?G)Xm-=nMgJy^^aDePX&6FL9!g~fi$ zw{ExLo1&<&*L@GOU*pX0jsJwENoTyNSXk1ae0gU}k<))$CVR2$(-UL!`7y4b^61HB%wyZiZtgs}3^$eA3*)EnqxD=8>HhxIF5wXEYae-*s_S?29Jz?8dnMX`{{9DO$-VBu;f(pzH(aph)mtqPp z*dDvLv3{LF5ZB|D+ddL!%EFiEBu2coWmGyjd3%ca(ju+r8#wRCXC>rCD^G|>ou!x{ z)VA;7H=*x0wslq%zi$6`w&w4Y+KZ1?Y@96poGtrsap>hBVc+es+;4c?zboDL5OVLg zJ^bA!`f`s#;M}m~93}e|&07|H3XPCnxawGygxW&ZYi;YJ_PzbR@ctIFPuID!mFr!^ zYsK8w$vU!T18 zpM$>rj`nw7Uot!j&zk>Q>W1BQ)0fYp&aJX*{bzP-<)QO`8I~-*RaJ58Qp|>m*ST+* zm)`mokX^kZoJ%z1Dtp%BPBp8v6|1f@uRauD+LY9izS#W9$}8$RZuh*td^|K)s=-sb zF5s7Z`rd!?wl%k2f4>+k9Kpz~ck9~yq&MG{Dqq-r{dX}_ zvbtftLclP3W9OTrH=bAC6L*ll8&-64S##8Euf?5fZ@MhVReo^IZ}N}wrJp6z_vTyg zuzh!*(bc}GluO6>ik8*A5Ax#75qVA>O;MGP*=rtiR=w4J`E~irn@hKf-d}xd--5qC z<)Yk{w49KP$Pj;cc+!7H-W0361#BDTC%v-ld8FU|*)&aPbwX|E>0^-#z8QGzao@L- zT}0Y$;;-6iihDSAhpkk4@MHgxmwli3e@T90jsCUF_M&<2_kFChX0@~}ezp6X@9m}e zxAX%ZJ{PZC^8B=}b-~jB!GFe0s!?-QBVO>yT%7-)4=}`}XJWrzWQ!i3(QRuzTHq zhk%U{-fCHu3vHHVZ}M{d?q@7`eSLw!2gPL#4;RnQY?4foI27)nqWgYR(bL5emmg~6 zXI2{o>s>#XBX#Mu@{LDljII1*9$bDit$)#nv&(n=aq3*2Ar!>Oq{Wohq?Rp`dg);> zyUrnZuP>V(JXu+B>L7dPqqDt#Gh@Z_{*Hg?Y+|4gxc9q3pg@$=)GU&p(@ zUqAKX&*V>q6{V&&`~Q7uGMlu)$}mpdH7wahx^4A?vgCb-YDGjpzI*cOhkHf(k6$?@ zWq&!Xi>k_M>x|^Imy3s=3fL(V7du~ezdY~yDc(1tV|x7AWWrP}&h5#4Ty?Hc#F|UA z>(NyExlcQJ?GMi24iRG$f4*j_AnSTvx&1{EniJey9$)$KyQ%+PxNTR-k?s4A7i?I3 z`0(%FzZs>TCiuyp+p*-$htzpo8yG&E54&jM`sClG%^A~LKHoAH)1C= ze|6&4via4gu6})SHpS%6PhobwCjxygnh&J7t5klycRM=gz^=&8%{IdC3#4~+?XjK1 zyDmmE_Uy(#{1cdxtn)!ptJQ`ILp8eTAH&h%I2t9426Dh&48Emk2a9dc@a@_DMy|oCkAQmrA%! zZCz`$<|@0Dy~f$(tsh-Z95R$so$8Ni`fKR!4?89P9Cwgh zn;7`#dCmr}%aPw+J>wI5_3SE38}rLmi*8n!CO*rMs|+~Ooc%rbvqt~&{;>E1K0S$z z%WbY$gv;^7I+SM2%AU5sO7GbZX^ELLGFOz?n%hXrYKBVh`0+LRsT$Xi+v$oW>b%%G(i$9i7)pBWZ@|TZ6 z7fWxqCjOWc@7sO*LT5fc?`-+%ez z{qlsULrj0~236RVG$_WV7XDaJ!@b{NvX9H@8jm>~!Idkf#EhQ!Ofr%RNU+umBec1qTqaB0?d<5wIPPs$(4U$9bl z-e1$y4>{?gA9&QiZvM6AefRNP;lB*^+5e6hZ_qF}#1y;I^~cH$Pt*>t-Y$D(|B|-F zEC1|VH0$Z3H#hTM>~u?!a?Hr=TwK{HXuWS%OC#InOWXDy@S1bsk97Cu@|0KZv-Xu1 z#r{x9#JxX-%#;;ehN z;opv%Z9G5i_LaCREcd@3=dZYTwB%;W?YOBomWys!UHZN&z1Q-@wZaLP!=5f$H21=! zustWTEkt^m^up!_h+Iz9EG?YbJh8SVL~7ak43W2C1rwzCKFu%qF#pBWxCPUfOIIJ= zemK$ky2Z=Ak~@yhU+w$k{7#8T508_tmYq2r_TNfedvoB5pK}5(`Z4{`pMFM9GJ1~d zshz9e3YE-G$uZsjBe=+J=E98|r?|W-*D3GH4tpql&{g~7o1@z`Z=Ri3F#B)_+t+6s zda5QwxIB4$+4jU2w!L~4MwSi{)%IH)vX4Lg+PwL!dRsdR5mP-)%u!VjdGNsT8mE@I2@I@Ao&xh9_q{ij?w$J~kgyacr>o<*@koYvV7X z&M&1c;%o#Ts(dkDqA&FSh-IRS<0ekS&rWRa*B1Ug(7jpUpPJl1d%=Irf0jSCe7sT1 zNp!mAiqG-~>uVm_?_-H|#t1;#3iwFas=U-wk7wz1!QPafg{_AZ{=0+m3u2*Co*w-T-Y{PwU&BZ5r zt~2@b1gixWdh@)S#vZ>X!^^cG`i*J5?cA9%6QxRp+}st54sKbtT-UzzwVvR%m3}{- z^A)p&?XH@-bKNYn7Z=|MEfU|wY0G4G=BLYs#BWx*+R3(W$|TPxfAxZz961)(PN_fG{N(b)GZj6We$4AVn!hNYP*01{ z|G_D@b>iQY(`SE9o<2M7o}$O!&60EF9_#oBZrH3Mk$yo(U~BVp7Q2`JF$?OWr5V>n z&f#o%IP;X`C%x$w%e>Q{#;7iI5_cpy#hiA?DTz};XPcXyVon0;SD-NwcwBS?r z!c_)50v+rXEj&wBaV!4W)Vw@OqldZh+^N&ikrwQ{f9tL~+&{kR)}8yu`uH!I&gDqF z^QiW)Xw_reLIIs^j)~7?_FCIoS~*^_sw$mxxZdCJoXm7>9yggc>k?g`TfLd{af02J z7i~G;wV$Z3{_ObZrIj4Bz@GCft}od3ePaEtZ4W;?9TwsHCTy3tS}1f=fU8b2=NpsL zQ#ht{ZL*l=DD=zWU0|Ep-WB)uGV6AnsM>FCZzdcK>X}Joxsv9FRqy$v(@{u@@<;;l*$vc zY&AG~nEhjOwj33>6nD~4{)&=o@sfw^O>g$O{yxlfSheKIjowa;$NJZoP3POx<$vaD z;hK~3D~0O?TRsX;_TtcY5Gj{Ed?2hz@A-AJLzjKN1V*S73VO~IbNYGe{2q&SP79~J ze^c|Zjq&RGbq3RQzp(DVWTLg5PyN#h))&|BXms5bbIUwe{779e@n@aP@>QpdGzCj^ zS2r7U9$q7&@b>klFRye$5+hey32S|mGh0qdo)dSMio>f>LDYjsq@bAS9cH(X^C zbVvFy_mz*#$ELnm`TDZd8I7mC7L{}N+g44VzvtIP#xGy&&iEOv`>{WyR$>iDlG5+( zD<12H%e>!FcRI=bcpG8d*Z@ZWm4th_we$S^o6eBVdAYdfEQEv*US zdiy4E^QPDLgd!Ms9@-)i-nY|7%vQ{gbG^>}#L67=Nsdq2Ro}=?zOtHGRq)J~HO&rc zkpU{LDt?bNFTU&vw~yDKV;pe1zR}TULdDL|q`3`T4ML~;1&$f=Y(0L+A*Hd;C_3&# z*~?9nw4EJlFP-}=tvBtqkEg8ZF{Pg06@s%tC-JN!y7kj;&wmzWVUI+JC(&BZt%&;Y;W0-|7qHy=u5NYH?8y9 z_U6NpbD7{NwEg$9RB|pA22@4QE{B?KSPItRwt)EtH zU~1$DGSslW->-Gy-DZ^&OXS;?j^5p}{K>AGIsUUZ$@iGUElrbQ`XLiICC|Vo}eDnZ*RA)yfER=di%QvufCZUH96bDRolRP z(^faDrZ*2C&b$-c*8YC;a_b$drg4W)Prh|?{$aH(Yu;7IPOo@r^Y<02pZJxKhtEW~ zF2uZ9^!D4jizWT{{z`vSxxdG@?r-V8f4|Gu$L+VZvc9wA-eHF0e~l+U+Q5FYpd+#V)jnq}Qo(Rru#QldF~Gq2vI zO&%==431ynpDM8M%WB=0)cdamr|or5S5s2iP_l6PL9>ZXRw5^w7YY~J=DTm`zj{+5 zT)FpZzu%7V{ZavZnR|jww@>RSJbXiT@11_Nhbki3b)OuC<_X)`Zf7xH>%HZ*L@QhO zBE6F@r?sbkl)Ni5?P})P4c4EZB}HD>Ka->U` zGfib;PO0Tf?=_x3ap}TH3HCgh1rslBcyTC&Nw!AwP`2~pDeL!4Ee^2!fAVaW+mtl#ni~7~^XbF8qxjS++d9p@`;^;0e;{DT5UgCjOL^PQc_s^I&;R85 zUhZh+n*+W#G}iAr!^$CW_tUqYZ(_=_YkfI?aGY#Evn@5Xw$-4lgKfd{^mFUjj+tHH z4|Y1~_>B2a$fbITJC5Ise^_RSUO#>3=4E3)<~ZF4+XAPo+`ho){F=3C{^!qKaJsU5 z{kqxq5tmy&b3ZZ*s9)jA`}#=M47HNkpE#`zZb!!Q`cLJLJTTxw9OW>}Yc1`)IW0qMGpD|MIiMb8hi( zH+B_@y(f@(Z%yE{{|un^I8)@3P6N4}8rNI79Z%OJOy-Z-ktr;_>=uht2&3lv=3fgI zTxi}YWA(37{XxS@#w-0Now?Mn2sFIg%@9AgSCGx2ch;qHi`hx~7S4SaZ9(vUuW=9hMzWs}8zdFW<_<^49FC;y3;kPttlGSKL~s z=ChY?eZcaPk1N)xN!jS>>~5NLIsb2--&f&(5w-GB(#Pkt9+WPYinh+3cHBVrx}NYk zF{xuKo?X|v_Lbw!@+*s4mMxm8W$Ev-Flc4QA&I4z{>;ss)VpKZ8(-a2d-DkiEw0Dkb-2yEope{eCU} z*|o`!EnYowaQ`a~N`q@+4+b?G2-qH9zv5g)0T-WQ?#9Pg{6DbE@bemcX}GpB>Ui`2 zyt2)loB=J>S5hF;t&RwSIhI5(i) z>+t3Uyr!SF9BdEYtafLip~*wP8&h)1q~0xf#mfI^Y0%yXRwc=mRjat!_1vy=ho4@i zbN19BBj?1`nHzHQ^m3VR!u-;j0TZpFFIs}iDB z0qP+M8`L#L&Mue{Dl_SbUh|@q^nEW4t?zhCv$k$f`|8B}A@^4Bk&V8>Z_Z0(Y>li~ zvM_P7%G&r;h4a<177yN9-)*!_scuQPd=|ei_+S4+w%A3d&411NyJC9Xu8%?r@p+rW zmz?hY^O`xYW8dl%F>k*2=oZ*T=D%2dVWLxDeCNFl`*w!ftFxaMzPZY4TK_xts;!6l zy^k(rebFrRd&0BpdmXKWJ*7@t+|pZ6@Y5@$M%H_wf`tE3rKpwvH<_OQl+k5TcT@8C z;Zyo;M?dffmhpCkzAak4Yo4v=tXOu7WmhO~nVZOpO?rNQdgpvP*-CFu zl`)xOnt01X_lu8+$(*3>O~J)M+NPpCUwL)E==x4s<0xLN*qi=hy3@IHPU2?|iyV>p zb>buoTcTlv>U5^066b^J_O?qlF-);<{yTT? +Date: Wed Jan 31 02:12:43 2024 +0100 + + Replace advisories directory + + Signed-off-by: Andreas K. Hüttel + +diff --git a/ADVISORIES b/ADVISORIES +new file mode 100644 +index 0000000000..d4e33f2df3 +--- /dev/null ++++ b/ADVISORIES +@@ -0,0 +1,2 @@ ++For the GNU C Library Security Advisories, see the git master branch: ++https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD +diff --git a/advisories/GLIBC-SA-2023-0001 b/advisories/GLIBC-SA-2023-0001 +deleted file mode 100644 +index 3d19c91b6a..0000000000 +--- a/advisories/GLIBC-SA-2023-0001 ++++ /dev/null +@@ -1,14 +0,0 @@ +-printf: incorrect output for integers with thousands separator and width field +- +-When the printf family of functions is called with a format specifier +-that uses an (enable grouping) and a minimum width +-specifier, the resulting output could be larger than reasonably expected +-by a caller that computed a tight bound on the buffer size. The +-resulting larger than expected output could result in a buffer overflow +-in the printf family of functions. +- +-CVE-Id: CVE-2023-25139 +-Public-Date: 2023-02-02 +-Vulnerable-Commit: e88b9f0e5cc50cab57a299dc7efe1a4eb385161d (2.37) +-Fix-Commit: c980549cc6a1c03c23cc2fe3e7b0fe626a0364b0 (2.38) +-Fix-Commit: 07b9521fc6369d000216b96562ff7c0ed32a16c4 (2.37-4) +diff --git a/advisories/GLIBC-SA-2023-0002 b/advisories/GLIBC-SA-2023-0002 +deleted file mode 100644 +index 5122669a64..0000000000 +--- a/advisories/GLIBC-SA-2023-0002 ++++ /dev/null +@@ -1,15 +0,0 @@ +-getaddrinfo: Stack read overflow in no-aaaa mode +- +-If the system is configured in no-aaaa mode via /etc/resolv.conf, +-getaddrinfo is called for the AF_UNSPEC address family, and a DNS +-response is received over TCP that is larger than 2048 bytes, +-getaddrinfo may potentially disclose stack contents via the returned +-address data, or crash. +- +-CVE-Id: CVE-2023-4527 +-Public-Date: 2023-09-12 +-Vulnerable-Commit: f282cdbe7f436c75864e5640a409a10485e9abb2 (2.36) +-Fix-Commit: bd77dd7e73e3530203be1c52c8a29d08270cb25d (2.39) +-Fix-Commit: 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (2.36-113) +-Fix-Commit: b7529346025a130fee483d42178b5c118da971bb (2.37-38) +-Fix-Commit: b25508dd774b617f99419bdc3cf2ace4560cd2d6 (2.38-19) +diff --git a/advisories/GLIBC-SA-2023-0003 b/advisories/GLIBC-SA-2023-0003 +deleted file mode 100644 +index d3aef80348..0000000000 +--- a/advisories/GLIBC-SA-2023-0003 ++++ /dev/null +@@ -1,15 +0,0 @@ +-getaddrinfo: Potential use-after-free +- +-When an NSS plugin only implements the _gethostbyname2_r and +-_getcanonname_r callbacks, getaddrinfo could use memory that was freed +-during buffer resizing, potentially causing a crash or read or write to +-arbitrary memory. +- +-CVE-Id: CVE-2023-4806 +-Public-Date: 2023-09-12 +-Fix-Commit: 973fe93a5675c42798b2161c6f29c01b0e243994 (2.39) +-Fix-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420) +-Fix-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270) +-Fix-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115) +-Fix-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39) +-Fix-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20) +diff --git a/advisories/GLIBC-SA-2023-0004 b/advisories/GLIBC-SA-2023-0004 +deleted file mode 100644 +index 5286a7aa54..0000000000 +--- a/advisories/GLIBC-SA-2023-0004 ++++ /dev/null +@@ -1,16 +0,0 @@ +-tunables: local privilege escalation through buffer overflow +- +-If a tunable of the form NAME=NAME=VAL is passed in the environment of a +-setuid program and NAME is valid, it may result in a buffer overflow, +-which could be exploited to achieve escalated privileges. This flaw was +-introduced in glibc 2.34. +- +-CVE-Id: CVE-2023-4911 +-Public-Date: 2023-10-03 +-Vulnerable-Commit: 2ed18c5b534d9e92fc006202a5af0df6b72e7aca (2.34) +-Fix-Commit: 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa (2.39) +-Fix-Commit: dcc367f148bc92e7f3778a125f7a416b093964d9 (2.34-423) +-Fix-Commit: c84018a05aec80f5ee6f682db0da1130b0196aef (2.35-274) +-Fix-Commit: 22955ad85186ee05834e47e665056148ca07699c (2.36-118) +-Fix-Commit: b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3 (2.37-45) +-Fix-Commit: 750a45a783906a19591fb8ff6b7841470f1f5701 (2.38-27) +diff --git a/advisories/GLIBC-SA-2023-0005 b/advisories/GLIBC-SA-2023-0005 +deleted file mode 100644 +index cc4eb90b82..0000000000 +--- a/advisories/GLIBC-SA-2023-0005 ++++ /dev/null +@@ -1,18 +0,0 @@ +-getaddrinfo: DoS due to memory leak +- +-The fix for CVE-2023-4806 introduced a memory leak when an application +-calls getaddrinfo for AF_INET6 with AI_CANONNAME, AI_ALL and AI_V4MAPPED +-flags set. +- +-CVE-Id: CVE-2023-5156 +-Public-Date: 2023-09-25 +-Vulnerable-Commit: e09ee267c03e3150c2c9ba28625ab130705a485e (2.34-420) +-Vulnerable-Commit: e3ccb230a961b4797510e6a1f5f21fd9021853e7 (2.35-270) +-Vulnerable-Commit: a9728f798ec7f05454c95637ee6581afaa9b487d (2.36-115) +-Vulnerable-Commit: 6529a7466c935f36e9006b854d6f4e1d4876f942 (2.37-39) +-Vulnerable-Commit: 00ae4f10b504bc4564e9f22f00907093f1ab9338 (2.38-20) +-Fix-Commit: 8006457ab7e1cd556b919f477348a96fe88f2e49 (2.34-421) +-Fix-Commit: 17092c0311f954e6f3c010f73ce3a78c24ac279a (2.35-272) +-Fix-Commit: 856bac55f98dc840e7c27cfa82262b933385de90 (2.36-116) +-Fix-Commit: 4473d1b87d04b25cdd0e0354814eeaa421328268 (2.37-42) +-Fix-Commit: 5ee59ca371b99984232d7584fe2b1a758b4421d3 (2.38-24) +diff --git a/advisories/GLIBC-SA-2024-0001 b/advisories/GLIBC-SA-2024-0001 +deleted file mode 100644 +index 28931c75ae..0000000000 +--- a/advisories/GLIBC-SA-2024-0001 ++++ /dev/null +@@ -1,15 +0,0 @@ +-syslog: Heap buffer overflow in __vsyslog_internal +- +-__vsyslog_internal did not handle a case where printing a SYSLOG_HEADER +-containing a long program name failed to update the required buffer +-size, leading to the allocation and overflow of a too-small buffer on +-the heap. +- +-CVE-Id: CVE-2023-6246 +-Public-Date: 2024-01-30 +-Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37) +-Fix-Commit: 6bd0e4efcc78f3c0115e5ea9739a1642807450da (2.39) +-Fix-Commit: 23514c72b780f3da097ecf33a793b7ba9c2070d2 (2.38-42) +-Fix-Commit: 97a4292aa4a2642e251472b878d0ec4c46a0e59a (2.37-57) +-Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16) +-Fix-Commit: d1a83b6767f68b3cb5b4b4ea2617254acd040c82 (2.36-126) +diff --git a/advisories/GLIBC-SA-2024-0002 b/advisories/GLIBC-SA-2024-0002 +deleted file mode 100644 +index 940bfcf2fc..0000000000 +--- a/advisories/GLIBC-SA-2024-0002 ++++ /dev/null +@@ -1,15 +0,0 @@ +-syslog: Heap buffer overflow in __vsyslog_internal +- +-__vsyslog_internal used the return value of snprintf/vsnprintf to +-calculate buffer sizes for memory allocation. If these functions (for +-any reason) failed and returned -1, the resulting buffer would be too +-small to hold output. +- +-CVE-Id: CVE-2023-6779 +-Public-Date: 2024-01-30 +-Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37) +-Fix-Commit: 7e5a0c286da33159d47d0122007aac016f3e02cd (2.39) +-Fix-Commit: d0338312aace5bbfef85e03055e1212dd0e49578 (2.38-43) +-Fix-Commit: 67062eccd9a65d7fda9976a56aeaaf6c25a80214 (2.37-58) +-Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16) +-Fix-Commit: 2bc9d7c002bdac38b5c2a3f11b78e309d7765b83 (2.36-127) +diff --git a/advisories/GLIBC-SA-2024-0003 b/advisories/GLIBC-SA-2024-0003 +deleted file mode 100644 +index b43a5150ab..0000000000 +--- a/advisories/GLIBC-SA-2024-0003 ++++ /dev/null +@@ -1,13 +0,0 @@ +-syslog: Integer overflow in __vsyslog_internal +- +-__vsyslog_internal calculated a buffer size by adding two integers, but +-did not first check if the addition would overflow. +- +-CVE-Id: CVE-2023-6780 +-Public-Date: 2024-01-30 +-Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37) +-Fix-Commit: ddf542da94caf97ff43cc2875c88749880b7259b (2.39) +-Fix-Commit: d37c2b20a4787463d192b32041c3406c2bd91de0 (2.38-44) +-Fix-Commit: 2b58cba076e912961ceaa5fa58588e4b10f791c0 (2.37-59) +-Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16) +-Fix-Commit: b9b7d6a27aa0632f334352fa400771115b3c69b7 (2.36-128) +diff --git a/advisories/README b/advisories/README +deleted file mode 100644 +index 94e68b1350..0000000000 +--- a/advisories/README ++++ /dev/null +@@ -1,73 +0,0 @@ +-GNU C Library Security Advisory Format +-====================================== +- +-Security advisories in this directory follow a simple git commit log +-format, with a heading and free-format description augmented with tags +-to allow parsing key information. References to code changes are +-specific to the glibc repository and follow a specific format: +- +- Tag-name: (release-version) +- +-The indicates a specific commit in the repository. The +-release-version indicates the publicly consumable release in which this +-commit is known to exist. The release-version is derived from the +-git-describe format, (i.e. stripped out from glibc-2.34.NNN-gxxxx) and +-is of the form 2.34-NNN. If the -NNN suffix is absent, it means that +-the change is in that release tarball, otherwise the change is on the +-release/2.YY/master branch and not in any released tarball. +- +-The following tags are currently being used: +- +-CVE-Id: +-This is the CVE-Id assigned under the CVE Program +-(https://www.cve.org/). +- +-Public-Date: +-The date this issue became publicly known. +- +-Vulnerable-Commit: +-The commit that introduced this vulnerability. There could be multiple +-entries, one for each release branch in the glibc repository; the +-release-version portion of this tag should tell you which branch this is +-on. +- +-Fix-Commit: +-The commit that fixed this vulnerability. There could be multiple +-entries for each release branch in the glibc repository, indicating that +-all of those commits contributed to fixing that issue in each of those +-branches. +- +-Adding an Advisory +------------------- +- +-An advisory for a CVE needs to be added on the master branch in two steps: +- +-1. Add the text of the advisory without any Fix-Commit tags along with +- the fix for the CVE. Add the Vulnerable-Commit tag, if applicable. +- The advisories directory does not exist in release branches, so keep +- the advisory text commit distinct from the code changes, to ease +- backports. Ask for the GLIBC-SA advisory number from the security +- team. +- +-2. Finish all backports on release branches and then back on the msater +- branch, add all commit refs to the advisory using the Fix-Commit +- tags. Don't bother adding the release-version subscript since the +- next step will overwrite it. +- +-3. Run the process-advisories.sh script in the scripts directory on the +- advisory: +- +- scripts/process-advisories.sh update GLIBC-SA-YYYY-NNNN +- +- (replace YYYY-NNNN with the actual advisory number). +- +-4. Verify the updated advisory and push the result. +- +-Getting a NEWS snippet from advisories +--------------------------------------- +- +-Run: +- +- scripts/process-advisories.sh news +- +-and copy the content into the NEWS file. + +commit 63295e4fda1f6dab4bf7442706fe303bf283036c +Author: Adhemerval Zanella +Date: Mon Feb 5 16:10:24 2024 +0000 + + arm: Remove wrong ldr from _dl_start_user (BZ 31339) + + The commit 49d877a80b29d3002887b084eec6676d9f5fec18 (arm: Remove + _dl_skip_args usage) removed the _SKIP_ARGS literal, which was + previously loader to r4 on loader _start. However, the cleanup did not + remove the following 'ldr r4, [sl, r4]' on _dl_start_user, used to check + to skip the arguments after ld self-relocations. + + In my testing, the kernel initially set r4 to 0, which makes the + ldr instruction just read the _GLOBAL_OFFSET_TABLE_. However, since r4 + is a callee-saved register; a different runtime might not zero + initialize it and thus trigger an invalid memory access. + + Checked on arm-linux-gnu. + + Reported-by: Adrian Ratiu + Reviewed-by: Szabolcs Nagy + (cherry picked from commit 1e25112dc0cb2515d27d8d178b1ecce778a9d37a) + +diff --git a/sysdeps/arm/dl-machine.h b/sysdeps/arm/dl-machine.h +index b857bbc868..dd1a0f6b6e 100644 +--- a/sysdeps/arm/dl-machine.h ++++ b/sysdeps/arm/dl-machine.h +@@ -139,7 +139,6 @@ _start:\n\ + _dl_start_user:\n\ + adr r6, .L_GET_GOT\n\ + add sl, sl, r6\n\ +- ldr r4, [sl, r4]\n\ + @ save the entry point in another register\n\ + mov r6, r0\n\ + @ get the original arg count\n\ + +commit 312e159626b67fe11f39e83e222cf4348a3962f3 +Author: Adhemerval Zanella +Date: Thu Feb 1 14:29:53 2024 -0300 + + mips: FIx clone3 implementation (BZ 31325) + + For o32 we need to setup a minimal stack frame to allow cprestore + on __thread_start_clone3 (which instruct the linker to save the + gp for PIC). Also, there is no guarantee by kABI that $8 will be + preserved after syscall execution, so we need to save it on the + provided stack. + + Checked on mipsel-linux-gnu. + + Reported-by: Khem Raj + Tested-by: Khem Raj + (cherry picked from commit bbd248ac0d75efdef8fe61ea69b1fb25fb95b6e7) + +diff --git a/sysdeps/unix/sysv/linux/mips/clone3.S b/sysdeps/unix/sysv/linux/mips/clone3.S +index e9fec2fa47..481b8ae963 100644 +--- a/sysdeps/unix/sysv/linux/mips/clone3.S ++++ b/sysdeps/unix/sysv/linux/mips/clone3.S +@@ -37,11 +37,6 @@ + + .text + .set nomips16 +-#if _MIPS_SIM == _ABIO32 +-# define EXTRA_LOCALS 1 +-#else +-# define EXTRA_LOCALS 0 +-#endif + #define FRAMESZ ((NARGSAVE*SZREG)+ALSZ)&ALMASK + GPOFF= FRAMESZ-(1*SZREG) + NESTED(__clone3, SZREG, sp) +@@ -68,8 +63,31 @@ NESTED(__clone3, SZREG, sp) + beqz a0, L(error) /* No NULL cl_args pointer. */ + beqz a2, L(error) /* No NULL function pointer. */ + ++#if _MIPS_SIM == _ABIO32 ++ /* Both stack and stack_size on clone_args are defined as uint64_t, and ++ there is no need to handle values larger than to 32 bits for o32. */ ++# if __BYTE_ORDER == __BIG_ENDIAN ++# define CL_STACKPOINTER_OFFSET 44 ++# define CL_STACKSIZE_OFFSET 52 ++# else ++# define CL_STACKPOINTER_OFFSET 40 ++# define CL_STACKSIZE_OFFSET 48 ++# endif ++ ++ /* For o32 we need to setup a minimal stack frame to allow cprestore ++ on __thread_start_clone3. Also there is no guarantee by kABI that ++ $8 will be preserved after syscall execution (so we need to save it ++ on the provided stack). */ ++ lw t0, CL_STACKPOINTER_OFFSET(a0) /* Load the stack pointer. */ ++ lw t1, CL_STACKSIZE_OFFSET(a0) /* Load the stack_size. */ ++ addiu t1, -32 /* Update the stack size. */ ++ addu t2, t1, t0 /* Calculate the thread stack. */ ++ sw a3, 0(t2) /* Save argument pointer. */ ++ sw t1, CL_STACKSIZE_OFFSET(a0) /* Save the new stack size. */ ++#else + move $8, a3 /* a3 is set to 0/1 for syscall success/error + while a4/$8 is returned unmodified. */ ++#endif + + /* Do the system call, the kernel expects: + v0: system call number +@@ -125,7 +143,11 @@ L(thread_start_clone3): + + /* Restore the arg for user's function. */ + move t9, a2 /* Function pointer. */ ++#if _MIPS_SIM == _ABIO32 ++ PTR_L a0, 0(sp) ++#else + move a0, $8 /* Argument pointer. */ ++#endif + + /* Call the user's function. */ + jal t9 + +commit d0724994de40934c552f1f68de89053848a44927 +Author: Xi Ruoyao +Date: Thu Feb 22 21:26:55 2024 +0100 + + math: Update mips64 ulps + + Signed-off-by: Andreas K. Hüttel + (cherry picked from commit e2a65ecc4b30a797df7dc6529f09b712aa256029) + +diff --git a/sysdeps/mips/mips64/libm-test-ulps b/sysdeps/mips/mips64/libm-test-ulps +index 78969745b2..933aba4735 100644 +--- a/sysdeps/mips/mips64/libm-test-ulps ++++ b/sysdeps/mips/mips64/libm-test-ulps +@@ -1066,17 +1066,17 @@ double: 1 + ldouble: 1 + + Function: "j0": +-double: 2 ++double: 3 + float: 9 + ldouble: 2 + + Function: "j0_downward": +-double: 5 ++double: 6 + float: 9 + ldouble: 9 + + Function: "j0_towardzero": +-double: 6 ++double: 7 + float: 9 + ldouble: 9 + +@@ -1146,6 +1146,7 @@ float: 6 + ldouble: 8 + + Function: "log": ++double: 1 + float: 1 + ldouble: 1 + + +commit e0910f1d3278f05439fb434ee528fc9be1b6bd5e +Author: Stefan Liebler +Date: Thu Feb 22 15:03:27 2024 +0100 + + S390: Do not clobber r7 in clone [BZ #31402] + + Starting with commit e57d8fc97b90127de4ed3e3a9cdf663667580935 + "S390: Always use svc 0" + clone clobbers the call-saved register r7 in error case: + function or stack is NULL. + + This patch restores the saved registers also in the error case. + Furthermore the existing test misc/tst-clone is extended to check + all error cases and that clone does not clobber registers in this + error case. + + (cherry picked from commit 02782fd12849b6673cb5c2728cb750e8ec295aa3) + +diff --git a/sysdeps/unix/sysv/linux/s390/s390-32/clone.S b/sysdeps/unix/sysv/linux/s390/s390-32/clone.S +index 4c882ef2ee..a7a863242c 100644 +--- a/sysdeps/unix/sysv/linux/s390/s390-32/clone.S ++++ b/sysdeps/unix/sysv/linux/s390/s390-32/clone.S +@@ -53,6 +53,7 @@ ENTRY(__clone) + br %r14 + error: + lhi %r2,-EINVAL ++ lm %r6,%r7,24(%r15) /* Load registers. */ + j SYSCALL_ERROR_LABEL + PSEUDO_END (__clone) + +diff --git a/sysdeps/unix/sysv/linux/s390/s390-64/clone.S b/sysdeps/unix/sysv/linux/s390/s390-64/clone.S +index 4eb104be71..c552a6b8de 100644 +--- a/sysdeps/unix/sysv/linux/s390/s390-64/clone.S ++++ b/sysdeps/unix/sysv/linux/s390/s390-64/clone.S +@@ -54,6 +54,7 @@ ENTRY(__clone) + br %r14 + error: + lghi %r2,-EINVAL ++ lmg %r6,%r7,48(%r15) /* Restore registers. */ + jg SYSCALL_ERROR_LABEL + PSEUDO_END (__clone) + +diff --git a/sysdeps/unix/sysv/linux/tst-clone.c b/sysdeps/unix/sysv/linux/tst-clone.c +index 470676ab2b..2bc7124983 100644 +--- a/sysdeps/unix/sysv/linux/tst-clone.c ++++ b/sysdeps/unix/sysv/linux/tst-clone.c +@@ -16,12 +16,16 @@ + License along with the GNU C Library; if not, see + . */ + +-/* BZ #2386 */ ++/* BZ #2386, BZ #31402 */ + #include + #include + #include + #include + #include ++#include /* For _STACK_GROWS_{UP,DOWN}. */ ++#include ++ ++volatile unsigned v = 0xdeadbeef; + + int child_fn(void *arg) + { +@@ -30,22 +34,67 @@ int child_fn(void *arg) + } + + static int +-do_test (void) ++__attribute__((noinline)) ++do_clone (int (*fn)(void *), void *stack) + { + int result; ++ unsigned int a = v; ++ unsigned int b = v; ++ unsigned int c = v; ++ unsigned int d = v; ++ unsigned int e = v; ++ unsigned int f = v; ++ unsigned int g = v; ++ unsigned int h = v; ++ unsigned int i = v; ++ unsigned int j = v; ++ unsigned int k = v; ++ unsigned int l = v; ++ unsigned int m = v; ++ unsigned int n = v; ++ unsigned int o = v; ++ ++ result = clone (fn, stack, 0, NULL); ++ ++ /* Check that clone does not clobber call-saved registers. */ ++ TEST_VERIFY (a == v && b == v && c == v && d == v && e == v && f == v ++ && g == v && h == v && i == v && j == v && k == v && l == v ++ && m == v && n == v && o == v); ++ ++ return result; ++} ++ ++static void ++__attribute__((noinline)) ++do_test_single (int (*fn)(void *), void *stack) ++{ ++ printf ("%s (fn=%p, stack=%p)\n", __FUNCTION__, fn, stack); ++ errno = 0; ++ ++ int result = do_clone (fn, stack); ++ ++ TEST_COMPARE (errno, EINVAL); ++ TEST_COMPARE (result, -1); ++} + +- result = clone (child_fn, NULL, 0, NULL); ++static int ++do_test (void) ++{ ++ char st[128 * 1024] __attribute__ ((aligned)); ++ void *stack = NULL; ++#if _STACK_GROWS_DOWN ++ stack = st + sizeof (st); ++#elif _STACK_GROWS_UP ++ stack = st; ++#else ++# error "Define either _STACK_GROWS_DOWN or _STACK_GROWS_UP" ++#endif + +- if (errno != EINVAL || result != -1) +- { +- printf ("FAIL: clone()=%d (wanted -1) errno=%d (wanted %d)\n", +- result, errno, EINVAL); +- return 1; +- } ++ do_test_single (child_fn, NULL); ++ do_test_single (NULL, stack); ++ do_test_single (NULL, NULL); + +- puts ("All OK"); + return 0; + } + +-#define TEST_FUNCTION do_test () +-#include "../test-skeleton.c" ++#include diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix index 826d1e9c8389..4d6fb5a54b39 100644 --- a/pkgs/development/libraries/glibc/common.nix +++ b/pkgs/development/libraries/glibc/common.nix @@ -36,16 +36,15 @@ , withLinuxHeaders ? false , profilingLibraries ? false , withGd ? false -, withLibcrypt ? false , extraBuildInputs ? [] , extraNativeBuildInputs ? [] , ... } @ args: let - version = "2.38"; - patchSuffix = "-44"; - sha256 = "sha256-+4KZiZiyspllRnvBtp0VLpwwfSzzAcnq+0VVt3DvP9I="; + version = "2.39"; + patchSuffix = "-5"; + sha256 = "sha256-93vUfPgXDFc2Wue/hmlsEYrbOxINMlnGTFAtPcHi2SY="; in assert withLinuxHeaders -> linuxHeaders != null; @@ -59,14 +58,14 @@ stdenv.mkDerivation ({ patches = [ /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping. - $ git fetch --all -p && git checkout origin/release/2.38/master && git describe - glibc-2.38-44-gd37c2b20a4 - $ git show --minimal --reverse glibc-2.38.. | gzip -9n --rsyncable - > 2.38-master.patch.gz + $ git fetch --all -p && git checkout origin/release/2.39/master && git describe + glibc-2.39-5-ge0910f1d32 + $ git show --minimal --reverse glibc-2.39.. > 2.39-master.patch To compare the archive contents zdiff can be used. - $ zdiff -u 2.38-master.patch.gz ../nixpkgs/pkgs/development/libraries/glibc/2.38-master.patch.gz + $ diff -u 2.39-master.patch ../nixpkgs/pkgs/development/libraries/glibc/2.39-master.patch */ - ./2.38-master.patch.gz + ./2.39-master.patch /* Allow NixOS and Nix to handle the locale-archive. */ ./nix-locale-archive.patch @@ -96,11 +95,6 @@ stdenv.mkDerivation ({ & https://github.com/NixOS/nixpkgs/pull/188492#issuecomment-1233802991 */ ./reenable_DT_HASH.patch - - /* Retrieved from https://salsa.debian.org/glibc-team/glibc/-/commit/662dbc4f9287139a0d9c91df328a5ba6cc6abee1#0f3c6d67cb8cf5bb35c421c20f828fea97b68edf - Qualys advisory: https://www.qualys.com/2024/01/30/qsort.txt - */ - ./local-qsort-memory-corruption.patch ] /* NVCC does not support ARM intrinsics. Since is pulled in by almost every HPC piece of software, without this patch CUDA compilation on ARM @@ -177,8 +171,7 @@ stdenv.mkDerivation ({ # so the glibc does not depend on its compiler store path "libc_cv_as_needed=no" ] - ++ lib.optional withGd "--with-gd" - ++ lib.optional withLibcrypt "--enable-crypt"; + ++ lib.optional withGd "--with-gd"; makeFlags = (args.makeFlags or []) ++ [ "OBJCOPY=${stdenv.cc.targetPrefix}objcopy" diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix index be3bee081e73..3f7331461fea 100644 --- a/pkgs/development/libraries/glibc/default.nix +++ b/pkgs/development/libraries/glibc/default.nix @@ -2,7 +2,6 @@ , withLinuxHeaders ? true , profilingLibraries ? false , withGd ? false -, withLibcrypt? false , pkgsBuildBuild , libgcc }: @@ -16,7 +15,7 @@ let in (callPackage ./common.nix { inherit stdenv; } { - inherit withLinuxHeaders withGd profilingLibraries withLibcrypt; + inherit withLinuxHeaders withGd profilingLibraries; pname = "glibc" + lib.optionalString withGd "-gd" + lib.optionalString (stdenv.cc.isGNU && libgcc==null) "-nolibgcc"; }).overrideAttrs(previousAttrs: { diff --git a/pkgs/development/libraries/glibc/local-qsort-memory-corruption.patch b/pkgs/development/libraries/glibc/local-qsort-memory-corruption.patch deleted file mode 100644 index f7e25c72a61c..000000000000 --- a/pkgs/development/libraries/glibc/local-qsort-memory-corruption.patch +++ /dev/null @@ -1,14 +0,0 @@ -diff -rup a/stdlib/qsort.c b/stdlib/qsort.c ---- a/stdlib/qsort.c 2023-07-31 10:54:16.000000000 -0700 -+++ b/stdlib/qsort.c 2024-01-15 09:08:25.596167959 -0800 -@@ -224,7 +224,8 @@ _quicksort (void *const pbase, size_t to - while ((run_ptr += size) <= end_ptr) - { - tmp_ptr = run_ptr - size; -- while ((*cmp) ((void *) run_ptr, (void *) tmp_ptr, arg) < 0) -+ while (tmp_ptr != base_ptr -+ && (*cmp) ((void *) run_ptr, (void *) tmp_ptr, arg) < 0) - tmp_ptr -= size; - - tmp_ptr += size; - From 1c003da73c7ca9e997a85781261ecd379eb4dd9a Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Tue, 27 Feb 2024 23:44:38 +0100 Subject: [PATCH 2/5] _389ds-base: mark as broken Doesn't build with glibc 2.39. There's a potential fix documented in https://github.com/389ds/389-ds-base/issues/5332, but the package is too old for the patch to apply, so I'll mark it as broken for now and leave it to the maintainer to update & fix. --- pkgs/servers/ldap/389/default.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/servers/ldap/389/default.nix b/pkgs/servers/ldap/389/default.nix index 18aeea04cb62..ce61f9676e18 100644 --- a/pkgs/servers/ldap/389/default.nix +++ b/pkgs/servers/ldap/389/default.nix @@ -141,5 +141,9 @@ stdenv.mkDerivation rec { license = licenses.gpl3Plus; platforms = platforms.linux; maintainers = [ maintainers.ners ]; + # https://hydra.nixos.org/build/249763145, doesn't build since glibc 2.39. + # Potential fix is documented in https://github.com/389ds/389-ds-base/issues/5332, + # but it doesn't apply here. + broken = true; }; } From 2dcdf602729e7923ec59b2e1ce67a0cb3f0d5c7a Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sat, 2 Mar 2024 18:47:01 +0100 Subject: [PATCH 3/5] swift: fix build w/ glibc-2.39 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Failing Hydra build: https://hydra.nixos.org/build/249763077/nixlog/12 The problem is that glibc commit 64b1a44183a3094672ed304532bedb9acc707554 marked the `FILE*` argument of a few functions including `fread` & `ferror` as non-null. The applied patch ("Android: add better nullability checks for nullability annotations added in NDK 26") is targeted for the Android platform, but fixes said issue as well: the handle returned from `fopen` is of type `Optional` and the `guard` expression unwraps that now (and throws an exception if `nil` is returned). The previous `nil`-check didn't modify the type of `fp`, but only raised the exception and moved on with `Optional`. It's a little sad that the patch needs to be applied at so many places, but I guess that's what you get with language-level package managers 🤷 Also, seems good-enough to me given that it's actually temporary, the patch is already upstream and will probably be obsolete at one of the next Swift updates. --- .../compilers/swift/sourcekit-lsp/default.nix | 7 +++- .../compilers/swift/swift-driver/default.nix | 6 +++- .../patches/force-unwrap-file-handles.patch | 33 ------------------- .../compilers/swift/swift-format/default.nix | 7 +++- .../patches/force-unwrap-file-handles.patch | 33 ------------------- .../compilers/swift/swiftpm/default.nix | 15 +++++++-- .../patches/force-unwrap-file-handles.patch | 33 ------------------- 7 files changed, 30 insertions(+), 104 deletions(-) delete mode 100644 pkgs/development/compilers/swift/swift-driver/patches/force-unwrap-file-handles.patch delete mode 100644 pkgs/development/compilers/swift/swift-format/patches/force-unwrap-file-handles.patch delete mode 100644 pkgs/development/compilers/swift/swiftpm/patches/force-unwrap-file-handles.patch diff --git a/pkgs/development/compilers/swift/sourcekit-lsp/default.nix b/pkgs/development/compilers/swift/sourcekit-lsp/default.nix index caba3e3441f3..74e687594c16 100644 --- a/pkgs/development/compilers/swift/sourcekit-lsp/default.nix +++ b/pkgs/development/compilers/swift/sourcekit-lsp/default.nix @@ -1,6 +1,7 @@ { lib , stdenv , callPackage +, fetchpatch , pkg-config , swift , swiftpm @@ -41,7 +42,11 @@ stdenv.mkDerivation { patch -p1 -d .build/checkouts/indexstore-db -i ${./patches/indexstore-db-macos-target.patch} swiftpmMakeMutable swift-tools-support-core - patch -p1 -d .build/checkouts/swift-tools-support-core -i ${./patches/force-unwrap-file-handles.patch} + patch -p1 -d .build/checkouts/swift-tools-support-core -i ${fetchpatch { + url = "https://github.com/apple/swift-tools-support-core/commit/990afca47e75cce136d2f59e464577e68a164035.patch"; + hash = "sha256-PLzWsp+syiUBHhEFS8+WyUcSae5p0Lhk7SSRdNvfouE="; + includes = [ "Sources/TSCBasic/FileSystem.swift" ]; + }} # This toggles a section specific to Xcode XCTest, which doesn't work on # Darwin, where we also use swift-corelibs-xctest. diff --git a/pkgs/development/compilers/swift/swift-driver/default.nix b/pkgs/development/compilers/swift/swift-driver/default.nix index d69a4da0eb3e..3245fa1d8787 100644 --- a/pkgs/development/compilers/swift/swift-driver/default.nix +++ b/pkgs/development/compilers/swift/swift-driver/default.nix @@ -54,7 +54,11 @@ stdenv.mkDerivation { configurePhase = generated.configure + '' swiftpmMakeMutable swift-tools-support-core - patch -p1 -d .build/checkouts/swift-tools-support-core -i ${./patches/force-unwrap-file-handles.patch} + patch -p1 -d .build/checkouts/swift-tools-support-core -i ${fetchpatch { + url = "https://github.com/apple/swift-tools-support-core/commit/990afca47e75cce136d2f59e464577e68a164035.patch"; + hash = "sha256-PLzWsp+syiUBHhEFS8+WyUcSae5p0Lhk7SSRdNvfouE="; + includes = [ "Sources/TSCBasic/FileSystem.swift" ]; + }} ''; # TODO: Tests depend on indexstore-db being provided by an existing Swift diff --git a/pkgs/development/compilers/swift/swift-driver/patches/force-unwrap-file-handles.patch b/pkgs/development/compilers/swift/swift-driver/patches/force-unwrap-file-handles.patch deleted file mode 100644 index a2f2d38c37c8..000000000000 --- a/pkgs/development/compilers/swift/swift-driver/patches/force-unwrap-file-handles.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 8d9ab4b6ed24a97e8af0cc338a52aacdcf438b8c Mon Sep 17 00:00:00 2001 -From: Pavel Sobolev -Date: Tue, 21 Nov 2023 20:53:33 +0300 -Subject: [PATCH] Force-unwrap file handles. - ---- - Sources/TSCBasic/FileSystem.swift | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/Sources/TSCBasic/FileSystem.swift b/Sources/TSCBasic/FileSystem.swift -index 3a63bdf..a1f3d9d 100644 ---- a/Sources/TSCBasic/FileSystem.swift -+++ b/Sources/TSCBasic/FileSystem.swift -@@ -425,7 +425,7 @@ private class LocalFileSystem: FileSystem { - if fp == nil { - throw FileSystemError(errno: errno, path) - } -- defer { fclose(fp) } -+ defer { fclose(fp!) } - - // Read the data one block at a time. - let data = BufferedOutputByteStream() -@@ -455,7 +455,7 @@ private class LocalFileSystem: FileSystem { - if fp == nil { - throw FileSystemError(errno: errno, path) - } -- defer { fclose(fp) } -+ defer { fclose(fp!) } - - // Write the data in one chunk. - var contents = bytes.contents --- -2.42.0 diff --git a/pkgs/development/compilers/swift/swift-format/default.nix b/pkgs/development/compilers/swift/swift-format/default.nix index 2f7e630e6804..a3d939b85cbd 100644 --- a/pkgs/development/compilers/swift/swift-format/default.nix +++ b/pkgs/development/compilers/swift/swift-format/default.nix @@ -1,5 +1,6 @@ { lib , stdenv +, fetchpatch , callPackage , swift , swiftpm @@ -21,7 +22,11 @@ stdenv.mkDerivation { configurePhase = generated.configure + '' swiftpmMakeMutable swift-tools-support-core - patch -p1 -d .build/checkouts/swift-tools-support-core -i ${./patches/force-unwrap-file-handles.patch} + patch -p1 -d .build/checkouts/swift-tools-support-core -i ${fetchpatch { + url = "https://github.com/apple/swift-tools-support-core/commit/990afca47e75cce136d2f59e464577e68a164035.patch"; + hash = "sha256-PLzWsp+syiUBHhEFS8+WyUcSae5p0Lhk7SSRdNvfouE="; + includes = [ "Sources/TSCBasic/FileSystem.swift" ]; + }} ''; # We only install the swift-format binary, so don't need the other products. diff --git a/pkgs/development/compilers/swift/swift-format/patches/force-unwrap-file-handles.patch b/pkgs/development/compilers/swift/swift-format/patches/force-unwrap-file-handles.patch deleted file mode 100644 index a2f2d38c37c8..000000000000 --- a/pkgs/development/compilers/swift/swift-format/patches/force-unwrap-file-handles.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 8d9ab4b6ed24a97e8af0cc338a52aacdcf438b8c Mon Sep 17 00:00:00 2001 -From: Pavel Sobolev -Date: Tue, 21 Nov 2023 20:53:33 +0300 -Subject: [PATCH] Force-unwrap file handles. - ---- - Sources/TSCBasic/FileSystem.swift | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/Sources/TSCBasic/FileSystem.swift b/Sources/TSCBasic/FileSystem.swift -index 3a63bdf..a1f3d9d 100644 ---- a/Sources/TSCBasic/FileSystem.swift -+++ b/Sources/TSCBasic/FileSystem.swift -@@ -425,7 +425,7 @@ private class LocalFileSystem: FileSystem { - if fp == nil { - throw FileSystemError(errno: errno, path) - } -- defer { fclose(fp) } -+ defer { fclose(fp!) } - - // Read the data one block at a time. - let data = BufferedOutputByteStream() -@@ -455,7 +455,7 @@ private class LocalFileSystem: FileSystem { - if fp == nil { - throw FileSystemError(errno: errno, path) - } -- defer { fclose(fp) } -+ defer { fclose(fp!) } - - // Write the data in one chunk. - var contents = bytes.contents --- -2.42.0 diff --git a/pkgs/development/compilers/swift/swiftpm/default.nix b/pkgs/development/compilers/swift/swiftpm/default.nix index 4a7a4ab63cce..2f3cb9530cfe 100644 --- a/pkgs/development/compilers/swift/swiftpm/default.nix +++ b/pkgs/development/compilers/swift/swiftpm/default.nix @@ -1,6 +1,7 @@ { lib , stdenv , callPackage +, fetchpatch , cmake , ninja , git @@ -195,12 +196,22 @@ let ''; }; + # Part of this patch fixes for glibc 2.39: glibc patch 64b1a44183a3094672ed304532bedb9acc707554 + # marks the `FILE*` argument to a few functions including `ferror` & `fread` as non-null. However + # the code passes an `Optional` to these functions. + # This patch uses a `guard` which effectively unwraps the type (or throws an exception). + swift-tools-support-core-glibc-fix = fetchpatch { + url = "https://github.com/apple/swift-tools-support-core/commit/990afca47e75cce136d2f59e464577e68a164035.patch"; + hash = "sha256-PLzWsp+syiUBHhEFS8+WyUcSae5p0Lhk7SSRdNvfouE="; + includes = [ "Sources/TSCBasic/FileSystem.swift" ]; + }; + swift-tools-support-core = mkBootstrapDerivation { name = "swift-tools-support-core"; src = generated.sources.swift-tools-support-core; patches = [ - ./patches/force-unwrap-file-handles.patch + swift-tools-support-core-glibc-fix ]; buildInputs = [ @@ -389,7 +400,7 @@ in stdenv.mkDerivation (commonAttrs // { swiftpmMakeMutable swift-tools-support-core substituteInPlace .build/checkouts/swift-tools-support-core/Sources/TSCTestSupport/XCTestCasePerf.swift \ --replace 'canImport(Darwin)' 'false' - patch -p1 -d .build/checkouts/swift-tools-support-core -i ${./patches/force-unwrap-file-handles.patch} + patch -p1 -d .build/checkouts/swift-tools-support-core -i ${swift-tools-support-core-glibc-fix} # Prevent a warning about SDK directories we don't have. swiftpmMakeMutable swift-driver diff --git a/pkgs/development/compilers/swift/swiftpm/patches/force-unwrap-file-handles.patch b/pkgs/development/compilers/swift/swiftpm/patches/force-unwrap-file-handles.patch deleted file mode 100644 index a2f2d38c37c8..000000000000 --- a/pkgs/development/compilers/swift/swiftpm/patches/force-unwrap-file-handles.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 8d9ab4b6ed24a97e8af0cc338a52aacdcf438b8c Mon Sep 17 00:00:00 2001 -From: Pavel Sobolev -Date: Tue, 21 Nov 2023 20:53:33 +0300 -Subject: [PATCH] Force-unwrap file handles. - ---- - Sources/TSCBasic/FileSystem.swift | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/Sources/TSCBasic/FileSystem.swift b/Sources/TSCBasic/FileSystem.swift -index 3a63bdf..a1f3d9d 100644 ---- a/Sources/TSCBasic/FileSystem.swift -+++ b/Sources/TSCBasic/FileSystem.swift -@@ -425,7 +425,7 @@ private class LocalFileSystem: FileSystem { - if fp == nil { - throw FileSystemError(errno: errno, path) - } -- defer { fclose(fp) } -+ defer { fclose(fp!) } - - // Read the data one block at a time. - let data = BufferedOutputByteStream() -@@ -455,7 +455,7 @@ private class LocalFileSystem: FileSystem { - if fp == nil { - throw FileSystemError(errno: errno, path) - } -- defer { fclose(fp) } -+ defer { fclose(fp!) } - - // Write the data in one chunk. - var contents = bytes.contents --- -2.42.0 From 02e833b2dcd328713572aeb24a5054711e566190 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 22 Mar 2024 22:24:45 +0100 Subject: [PATCH 4/5] dolphin-emu: fix build w/ glibc-2.39 Failing Hydra build: https://hydra.nixos.org/build/252105318 --- pkgs/applications/emulators/dolphin-emu/default.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkgs/applications/emulators/dolphin-emu/default.nix b/pkgs/applications/emulators/dolphin-emu/default.nix index f81fce6a5aa8..b2a9bbb7bbc4 100644 --- a/pkgs/applications/emulators/dolphin-emu/default.nix +++ b/pkgs/applications/emulators/dolphin-emu/default.nix @@ -1,6 +1,7 @@ { lib , stdenv , fetchFromGitHub +, fetchpatch , cmake , pkg-config , wrapQtAppsHook @@ -71,6 +72,12 @@ stdenv.mkDerivation rec { patches = [ # Remove when merged https://github.com/dolphin-emu/dolphin/pull/12070 ./find-minizip-ng.patch + + # fix buidl w/ glibc-2.39 + (fetchpatch { + url = "https://github.com/dolphin-emu/dolphin/commit/3da2e15e6b95f02f66df461e87c8b896e450fdab.patch"; + hash = "sha256-+8yGF412wQUYbyEuYWd41pgOgEbhCaezexxcI5CNehc="; + }) ]; strictDeps = true; From 91d85fb0e654a1d187e39fd2460df78fb09628ce Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 22 Mar 2024 22:55:27 +0100 Subject: [PATCH 5/5] cataclysm-dda: fix build w/ glibc-2.39 Failing Hydra build: https://hydra.nixos.org/build/252068803 --- pkgs/games/cataclysm-dda/glibc-2.39.diff | 28 ++++++++++++++++++++++++ pkgs/games/cataclysm-dda/stable.nix | 3 +++ 2 files changed, 31 insertions(+) create mode 100644 pkgs/games/cataclysm-dda/glibc-2.39.diff diff --git a/pkgs/games/cataclysm-dda/glibc-2.39.diff b/pkgs/games/cataclysm-dda/glibc-2.39.diff new file mode 100644 index 000000000000..edc79ce76d79 --- /dev/null +++ b/pkgs/games/cataclysm-dda/glibc-2.39.diff @@ -0,0 +1,28 @@ +diff --git a/src/debug.cpp b/src/debug.cpp +index fa63a3b..1e8f554 100644 +--- a/src/debug.cpp ++++ b/src/debug.cpp +@@ -1494,6 +1494,14 @@ std::string game_info::operating_system() + } + + #if !defined(__CYGWIN__) && !defined (__ANDROID__) && ( defined (__linux__) || defined(unix) || defined(__unix__) || defined(__unix) || ( defined(__APPLE__) && defined(__MACH__) ) || defined(BSD) ) // linux; unix; MacOs; BSD ++ // ++class FILEDeleter ++{ ++ public: ++ void operator()( FILE *f ) const noexcept { ++ pclose( f ); ++ } ++}; + /** Execute a command with the shell by using `popen()`. + * @param command The full command to execute. + * @note The output buffer is limited to 512 characters. +@@ -1504,7 +1512,7 @@ static std::string shell_exec( const std::string &command ) + std::vector buffer( 512 ); + std::string output; + try { +- std::unique_ptr pipe( popen( command.c_str(), "r" ), pclose ); ++ std::unique_ptr pipe( popen( command.c_str(), "r" ) ); + if( pipe ) { + while( fgets( buffer.data(), buffer.size(), pipe.get() ) != nullptr ) { + output += buffer.data(); diff --git a/pkgs/games/cataclysm-dda/stable.nix b/pkgs/games/cataclysm-dda/stable.nix index 90eab89a8349..5c3ccb4bf287 100644 --- a/pkgs/games/cataclysm-dda/stable.nix +++ b/pkgs/games/cataclysm-dda/stable.nix @@ -43,6 +43,9 @@ let url = "https://sources.debian.org/data/main/c/cataclysm-dda/0.G-4/debian/patches/gcc13-keyword-requires.patch"; hash = "sha256-8yvHh0YKC7AC/qzia7AZAfMewMC0RiSepMXpOkMXRd8="; }) + # Fix build w/ glibc-2.39 + # From https://github.com/BrettDong/Cataclysm-DDA/commit/9b206e2dc969ad79345596e03c3980bd155d2f48 + ./glibc-2.39.diff ]; makeFlags = common.makeFlags ++ [