From fe8a635141a0aa97e7f0903597d03a36f7df26d2 Mon Sep 17 00:00:00 2001 From: Jevgeni Krutov Date: Fri, 18 Oct 2024 11:45:41 +0300 Subject: [PATCH] SIVA-744 retain validation report TimestampCreationTime field in case of 'T' profile signature --- ...emarkContainerValidationReportBuilder.java | 2 +- .../service/timemark/BDOCTestUtils.java | 2 ++ ...ainerValidationServiceIntegrationTest.java | 22 ++++++++++++++++++ .../TS-05_23634_TS_unknown_TSA.bdoc | Bin 0 -> 9058 bytes .../test-files/valid-asice-lta.asice | Bin 0 -> 11311 bytes 5 files changed, 25 insertions(+), 1 deletion(-) create mode 100644 validation-services-parent/timemark-container-validation-service/src/test/resources/test-files/TS-05_23634_TS_unknown_TSA.bdoc create mode 100644 validation-services-parent/timemark-container-validation-service/src/test/resources/test-files/valid-asice-lta.asice diff --git a/validation-services-parent/timemark-container-validation-service/src/main/java/ee/openeid/validation/service/timemark/report/TimemarkContainerValidationReportBuilder.java b/validation-services-parent/timemark-container-validation-service/src/main/java/ee/openeid/validation/service/timemark/report/TimemarkContainerValidationReportBuilder.java index df3c5ae76..22f1e8066 100644 --- a/validation-services-parent/timemark-container-validation-service/src/main/java/ee/openeid/validation/service/timemark/report/TimemarkContainerValidationReportBuilder.java +++ b/validation-services-parent/timemark-container-validation-service/src/main/java/ee/openeid/validation/service/timemark/report/TimemarkContainerValidationReportBuilder.java @@ -224,7 +224,7 @@ eu.europa.esig.dss.simplereport.SimpleReport getDssSimpleReport(AsicESignature b private Info getInfo(Signature signature) { Info info = new Info(); info.setBestSignatureTime(getBestSignatureTime(signature)); - if (signature.getProfile() == SignatureProfile.LT) { + if (List.of(SignatureProfile.T, SignatureProfile.LT, SignatureProfile.LTA).contains(signature.getProfile())) { info.setTimestampCreationTime(getTimestampTime(signature)); } info.setOcspResponseCreationTime(getOcspTime(signature)); diff --git a/validation-services-parent/timemark-container-validation-service/src/test/java/ee/openeid/validation/service/timemark/BDOCTestUtils.java b/validation-services-parent/timemark-container-validation-service/src/test/java/ee/openeid/validation/service/timemark/BDOCTestUtils.java index 9b7c2c17d..42244f826 100644 --- a/validation-services-parent/timemark-container-validation-service/src/test/java/ee/openeid/validation/service/timemark/BDOCTestUtils.java +++ b/validation-services-parent/timemark-container-validation-service/src/test/java/ee/openeid/validation/service/timemark/BDOCTestUtils.java @@ -33,6 +33,8 @@ final class BDOCTestUtils { static final String BDOC_TEST_OF_KLASS3_CHAIN = "etoken_CPP.bdoc"; static final String BDOC_TEST_FILE_UNSIGNED = "3f_2s_1f_unsigned.bdoc"; static final String BDOC_TEST_FILE_ALL_SIGNED = "2f_all_signed.bdoc"; + static final String BDOC_TEST_FILE_T_LEVEL_SIGNATURE = "TS-05_23634_TS_unknown_TSA.bdoc"; + static final String ASICE_TEST_FILE_LTA_LEVEL_SIGNATURE = "valid-asice-lta.asice"; static ValidationDocument buildValidationDocument(String testFile) { return DummyValidationDocumentBuilder diff --git a/validation-services-parent/timemark-container-validation-service/src/test/java/ee/openeid/validation/service/timemark/TimemarkContainerValidationServiceIntegrationTest.java b/validation-services-parent/timemark-container-validation-service/src/test/java/ee/openeid/validation/service/timemark/TimemarkContainerValidationServiceIntegrationTest.java index 8c3306dfa..e76e4abd3 100644 --- a/validation-services-parent/timemark-container-validation-service/src/test/java/ee/openeid/validation/service/timemark/TimemarkContainerValidationServiceIntegrationTest.java +++ b/validation-services-parent/timemark-container-validation-service/src/test/java/ee/openeid/validation/service/timemark/TimemarkContainerValidationServiceIntegrationTest.java @@ -65,6 +65,8 @@ import static ee.openeid.validation.service.timemark.BDOCTestUtils.ASICE_CRL_ONLY; import static ee.openeid.validation.service.timemark.BDOCTestUtils.BDOC_TEST_FILE_ALL_SIGNED; +import static ee.openeid.validation.service.timemark.BDOCTestUtils.ASICE_TEST_FILE_LTA_LEVEL_SIGNATURE; +import static ee.openeid.validation.service.timemark.BDOCTestUtils.BDOC_TEST_FILE_T_LEVEL_SIGNATURE; import static ee.openeid.validation.service.timemark.BDOCTestUtils.BDOC_TEST_FILE_UNSIGNED; import static ee.openeid.validation.service.timemark.BDOCTestUtils.BDOC_TEST_OF_KLASS3_CHAIN; import static ee.openeid.validation.service.timemark.BDOCTestUtils.VALID_ASICE; @@ -72,6 +74,7 @@ import static ee.openeid.validation.service.timemark.BDOCTestUtils.VALID_BDOC_TM_2_SIGNATURES; import static ee.openeid.validation.service.timemark.BDOCTestUtils.VALID_ID_CARD_MOB_ID; import static ee.openeid.validation.service.timemark.BDOCTestUtils.buildValidationDocument; +import static org.hamcrest.CoreMatchers.equalTo; import static org.hamcrest.CoreMatchers.is; import static org.hamcrest.MatcherAssert.assertThat; import static org.hamcrest.Matchers.containsInAnyOrder; @@ -79,6 +82,7 @@ import static org.hamcrest.Matchers.emptyOrNullString; import static org.hamcrest.Matchers.greaterThan; import static org.hamcrest.Matchers.hasSize; +import static org.hamcrest.Matchers.notNullValue; import static org.hamcrest.beans.HasPropertyWithValue.hasProperty; import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertNotNull; @@ -471,6 +475,24 @@ void certificatePresentLT() throws Exception { assertEquals("SK TIMESTAMPING AUTHORITY", timestampCertificate.getCommonName()); } + @Test + void validateDocument_ProfileLevelIsT_TimestampCreationTimeIsPresent() { + SimpleReport validationResult = timemarkContainerValidationService.validateDocument(buildValidationDocument(BDOC_TEST_FILE_T_LEVEL_SIGNATURE)).getSimpleReport(); + + String tsCreationTime = validationResult.getValidationConclusion().getSignatures().get(0).getInfo().getTimestampCreationTime(); + assertThat(tsCreationTime, notNullValue()); + assertThat(tsCreationTime, equalTo("2014-05-19T10:45:19Z")); + } + + @Test + void validateDocument_ProfileLevelIsLTA_TimestampCreationTimeIsPresent() { + SimpleReport validationResult = timemarkContainerValidationService.validateDocument(buildValidationDocument(ASICE_TEST_FILE_LTA_LEVEL_SIGNATURE)).getSimpleReport(); + + String tsCreationTime = validationResult.getValidationConclusion().getSignatures().get(0).getInfo().getTimestampCreationTime(); + assertThat(tsCreationTime, notNullValue()); + assertThat(tsCreationTime, equalTo("2018-11-23T12:24:04Z")); + } + private void assertSubjectDNPresent(SignatureValidationData signature, String serialNumber, String commonName, String givenName, String surname) { SubjectDistinguishedName subjectDistinguishedName = signature.getSubjectDistinguishedName(); diff --git a/validation-services-parent/timemark-container-validation-service/src/test/resources/test-files/TS-05_23634_TS_unknown_TSA.bdoc b/validation-services-parent/timemark-container-validation-service/src/test/resources/test-files/TS-05_23634_TS_unknown_TSA.bdoc new file mode 100644 index 0000000000000000000000000000000000000000..fa71a22ca3ab934c1f2e430e386101de7d9e87cf GIT binary patch literal 9058 zcma)?bBt!sx~SXMv~AnAZA{zN*WF*+)=b;BZTIxFZQHgvXMQ*L?0s{yPjV`GQ>m4z zr`G$ftooz!D9eFEpo4(GfPj>1G>S)&yh;#(fPnlHe;|$-oU{2>{4N(5S5Saf1vFGDo8Th*x2nqs%@wZoyP#0m4QIuq| zH+HbLFn0kmdf3|~$B8HoFe6Aj3rHMXQZqD)sm!lV!tQ`*?gdImqAgxoh0UYI<%!xE zS^E2aK3~29=~nfulhs%IoqRyV@NMKj_I6)S?TGp!NTnu{N5Qq2OU={Zojc;n-f`uT zOQA_(4CGl-n;OaYa{hk92!urw#-V#_>9rUj)mRqvy#e5%``xvpJ zV5_%uYa^-;(UspN=9BlOX{|3Lf{OcfZJ0li3w?0k_WbvAcl{-;Wt-cqUSBMDc8y`oa?qo-kHR&N_up0LPqATW-c*T24nP#MGA zpF`7E6seB7PN#E4w^9d={g5w;j<_C&`FIx^Zg>I2W^z_n3JDeTk`W0FXndElPX2hE zWnbBLBNA%LHk9yF(Ynngs(jlI|MLO=*1BD?ON11Gt*?|gcKt@_AVlx0aY+8LsC&QH^v~N17KHE1&2`!5{{4#}%xo@^t6BN$&90mVKI~$add`$IJFsncA$sI7Bh7FwCyHPJ2g4!VEy7xfeNl_N<6}=HtxU8DOD)=@~Mm=!}e`Kl(;O zW>q?-&55D{s&=Sn@r1p5KFN#kFb{+`n*?NS0}0)&f-`f=&v_zgk0qn zXakTPTZMHgev%JzNo*6npEt3g8Mla)-qb5#Amyg)pP%}qACcs2RW^$ed#_!8)VlAh z$O^Q4c3Jsg{h@#bOPoZ9yx|5777h|u77&X$KjA$#;-^@?FJjeVXAO|2e7#I4-S88Z z&dZ>OuxdzNaLZFqZBb7)g^FK9piHLz1-f8XW_F`4Co4aZL0UuYE0rm*p5cSnElRS4 zF;0X#HK9!!p9*D!Z5LgS5KVe*AlpD$QQuMSMma~R3MDyeq!$U~iI{WDVuawXW+k1` zV>#%k92=jkZ-R@|<7?`ZN3BMR0$qwNRbPl@)hj5*NkA};`-!hn^}Ldz#pyMdx@n!}GlokU0gg`zQ)w18S`G}S23@vhAnoD~)jle&xN{B^4W z9k0$1KaC`r0`=AyXsz5B!bBjzR}`v(+SUkxay5w?Kht0cQpJNagPvXi&8kw~RN3Ny zqgO&_OFODyxgLdnU5BtXPYHy%2Jp!zvfUva)a>=_%4(AM-0||_XD0&P@2;i@1@R#_ zP0uwt`ebrhs>4j0_BB)6qCE!ZeJO;a%oMVFwdxjID98I!A9>JX!O@zhM+@Vnxg#0g`AASMla z-JHch921CvMFx%F)4yj5DQc3_pC{v?r<;#|KtBVp^%5Yuej}s8A~-YE!%C?zJaaD} z5G%(GAk^p3v+5xQg@}W41;7MA+|b^rJNxnbCSMRf?h0cD*rrmQfI@wa_~a6>pglm-<)t>M&eg*($!1=k@B*FCi>h5}8!vQ{Tk8_dc{*bv*qr zP)YjPU$>XLHX^96Zr`vo^d92Jel;90f$BEp`&`RSElDGVUIqN#Yi`Q72)^;n^y z?vU0`xWjpz5;~2muN9ay>V&~MtEB~P_Oz%P)1iaA z|Fm~mKBH9Dd@!GAlJjZ~1H;J!oHuZk&%W_$oQkck-44-->~ADJO~`}$xb47OI-G|$ z+8X~fAUl|Br+Yr~7$zpfc}SK@uHLM&Jjp$w%%0%a+)G9+xUvdd681>LHgI1Ea(M@K_?LZxiBHc54fld1A%|^~J3R*(Yy~A-Mn40N z8WaDpOn5FoHEMm5erP_?othg->J0fC!*qNhlK6=|Lq&bmQ+^4zZuRau9{SBqyDwd3 z?}+XBE@~w!c|25){NYY`HyBnzK#dF~3_J&N<1lV;My~wiI*Z_t#{t?aO=ys=tk(-5 zQymPaT`4@@)LK4UgNC$R?n}mIE-?AA&kghVjE#OZ;5nU^LPivXb~pPQ+&}zjdcAh~ zAWHfu?K>F?fBP`@WCr`p^n0nhV16SS%N72UC&X1@yML&ESkUE^`F!cG?9V!J-2Zh% zA%rvLQs-<4<#dk~RSOGjrC1t4+9tz8UpMOHXpmYO0Ndq)5WR56j`@~rc&o8b#JDl7 zd3d?k!{rfdSiaJa$^ZC?#rq@?SDiU`Ey(}p9_Lz!W`b(&8N4|jbI|*y zu=nG<*+bsMxEVm;=Jc$)&QWjJGqvBi*+w_@mo-WKILMSgmpLUdbh|^xrjYVIlxX=V>xHI~ zk&Mw~Iyr`u@DUut5zb*YWQ|Gjxs_#8ajFLpT;ekHDj0M@aqc0%U`Gr0 zbYDY;Nsu|LmNf{Q1dkd794&W^ehg%$#8h9nCdHMaX$O#i`@@gitZz7ysIeawz8_jky#(8y96be-LHP zFKa3>zm_KPR?|`Y6K4CHj~@+&_@a% zvsKslJsef#`NNS3fq$Kfyr2uF-YT$FqPq` zU4;UwEn?I(xY zMNNF!2NpFe^sn47+Rm=A1D9QpKiz-)szeO<;*;E2gcANkKz7pviVdkkd)U8jq9D^> zHAn2NP5sl@1NSA;4d=JB|Ggc~t0MHX`P43*@j`A${Ojm?+%AOPECxSlTOY0}S{O-r zwr>-Y^g!^W(;Bj1%JZ(NguUn8g?UVj7QNmL;mJEmLuhAo^yP0nrkU|rDwz#m-vsg_ z?v70?C|S-P#fh3rjH^-!efr4N&XpcrS{1HMrhfdZ@hHKZ&qC8kztx@yqJ=@2jNm3v zQ-$ibVd;E--UTkQ?eWDfx zt$zIWW3|LwrW04>@zSiq^Vu4GnVuJoU-J5jZ}-yR9=e42Y?PNT^CM}57nRYP`sJ$3 z;8DDXx6TVyV?6RALxyXMUM}Ws<$aBXN56|r99qeWzLkze1=|!`ob?dnz5LL}rN^CZ zOO!zxax1a$Ow2Ayt8MzeH3wKJ4`CX)%?Xfg-Ktw-*=$x*=nHosxYDw7S#v6B;X|zk z7+fbeGF|N*Dbo<9cwtSQnh~*0a0I|{u_Em7P_XH^q$e~vtUCTnHnY+|GG*|W$Hn~-TkZ)iB2*O#l^p;yP8TwV<_^CUv&=!jYn78=(4!qF00==Zb zf)i|l+QoU2&|HMXd9?;Fn}cuD2BS&7iD!x@)u+~3FhQ0RV7ZIT9w0{BCjf>9`55X3 zK0(?gSn3}ocfNCpWBb+U#`qR2pMY}HX5kA?MKnZ&5Lw&Po4`RV;{uJze{Gfy%0c)>%WTLlH`n(|s8&CA z0{asc(HNfAClqs&Yen2JOIaIOLxwtYmoivvrBzGc5bg?7=UTvvx##je>dr1YS1j^k zgUd5&(6s9W5AC}Qf=z4zZKiA$AgwJZ6UI9NJYX`vZOLri$TiL2OQ8Xbn^=gjot$3PxG8OL-k$ z_k)a|s5&ogq`A^k{~hph_DFs}ujvuAwQ094|q z64J1kS`uoDWYR;PyHu%d6JN~s1#{a@%N)*EQQ@wzs3GBwh#*D`G3#!MTqW0_|bE0F|YHjlv_X%G2D1yNR`NN&*wTTQ}dtIt{)2+4d zy8LmwbJ*Vrs30~qPMi|^E3=P9#_Xwf)?p7Hhq$$h&x=h;X=Ah>ZL3OLWy5u$d9aQN z;*0!T>3?17tS>M909Og0anqkW9YURE-i2FQW37d2eXKEaMv!!XcAWFHMZ@mB=F)&- zn_Fx+W2bX%>w|!Sjikp?7dslZkY0?gRJ9v}VN}Ygz-v8hNrm?$!U-upX!IKUJgA9X zp<+i6*a5u27$o%z3#r7{XECQi9668Spyr4?AedC)aH>omGzc5uE+7>W5+hzeFiwpZ zC05w;A;>(?)Ulk9nI3t)WJ1zY0wLB?Lkq$~?-9XdEOtKNOxi=k$=6!5MI7xOsf>5Se><8r zLobB%7%3c4pg;<9mpR5=g4vlTq}ZME84WZHBiYtpnu#5w%Q9X7`Z!f`a@@AipF>p1^n~waI&)3pSj^OiXOr9hv@gTY`vtej zWGmbo^!|q{u3Z3+eDd;)476$7W`5&DZ%Xs?%AsmXEg#A}$yB*2bt5U9#4soO-a&v| z%2a*)483ebX6-y8)ta`2*Xi}^cM3RJ<^1NxFqXi^28T45ADpIW2U5Yi_10FDbBx$Z z+8d8lq5|>7{<#yScHub#1qpshei(;~rm6AxfO3T$1BuXnqVo@lWJ4%tO~3*1P}{`o z8t2AmNLlQ$#S;z5!Z+28(&U-LhPmKA2E|}w`h&bh zyK04H-Orlpm%xyvj`Okm;x6}9Sb5`?9#5yhxm|nIpAKlA3AKA)Dc070WcFIGUu6*= zK05s+OT;rOjx`-e_x#R8QGiBCg80_Wizc1uqDA+^zUZtOGovoOm2}rCa2q2Z&N{CBDcCM- zpRg|JBnug`OwfDle%s)$rGy_dd#-y*t8h@!A7BHxSHwaDAd~WCpxwjEU~+&r}1GfymmcWi>%|1D@varryzgW|ucD3@2 zWI3d~eDpLJSJsSDUO^9To7iT$Y~^R!(HNO<^1=hDWDvEPs#3|;xSdEDV3-vI2=*~L z!EeT^7uK!I3**WnEzAg$=vQPA-`KTPHZ^8yZG6oKl9Fjd3B0yx%$9GbLmzT(O*!x#%Lq~#yi(`!xcIY+v3FCp`zAndw>Dr~s3 zPRhyD3QO06I%`@on_J)#lz8mP6D`5s8+zL4IRdCw&n43Ww;`LOu`hULu}KJk;rGXr$m+U zsU;dl>HA0b+or`CxT@+2oMl68Ck=TVn(>BWIB8ld1$se<*XveEn7D7Q(slJ@9sVN4 z4(t<24?FLcjPqH~wJtt#hjuo`e6F6bhYBaMpsqMwQDtu4dS<~md_O3mFj`aIhl5oN zkBE7NC7L^l3ANq|ObvLPCdCs%2=yi4es%CUR4BWkC|dpcnKsrr@_M`>C@Dn4I%)MM z)r5V2U(Q)GLm;6MDL1jv$C%4uWDI#zI_4lBPzlF)d`)F}`G+c@5h_xrm(o(hF|o1f zIzgm8AV@Y7^G7N43ZXWfw2T}SrziAo!X8?jO)d{DlM|#xK#`PDUmPWk+H9(k*i*t_ za}w-y!yrE8J)etJMqymw!90gGgA=7Ke{GPVJRz!y=B;p64;k0i9Tv~raaV;DE7s_R z^@w;M^;F)=KnO+8%y%@6L=cxmDX@(C?XD%^cOLhOGSBvE-zWC6IX4NXP7ulRMf`Y_JcQavyrF{kFQBt z%cI1F?is5g6?T}=;*pvboy@zyYX-)e>M5%OoXV8@bJO2R zW*V|8fv!r7rA<3~P-O6EQ;xEV8zA|vd#@(KBh84jKz{Mk2QR88F;@ePkBAz~0M~}f zk@_xE1*&r-BDYWg7WNB31z2vB!AB$91%kBXwl^Eis>tFl&)BLhD-xOs@2{MoGy7cP zCPlqMOx<;$#kld_UKE?YF+GDTpy8yW>hdchr>yt~6YT1h8<;N&)G)zvI}GFMq4rf4 zBEKHz=TO|#lcK*e%Lz{Uj#k1iN22v7V(2}S$X$_Sa^>F9fP?|1$jEQmWys5Q;YLAc z&AgVVjNPY=>)u)LXGJSGY!XX5kWo|z{kE`K%^#;`szL?02r$c*Cn9$#qHn$ptJ|X- z!G1}0Pwvi>c}$}gyIP|b7sc-)H8|e7{J?MA2L;m$SD8(#%N)vg^~r1@E1PDBDPpwXQ`WK1`FpM>lMA!jW;g zrrnrm;x?VB-CkQrKm9Se=7wiTabzTLl{Nlkq5L{@QM-jXwuhl=d+aC4$SkO&lN7o} zGacpChpzSg$W3Q8M5A%Nrnb|{KL)B|Hl+I17wb6~z1sgOgZgG2D|bN%HH>S_GPfu; zL)dXu=jL#bN`IscIoAE{4__|(2o7Hv<0xr;_iDCX>NqlZ_7pgw zUtu{R*yf4p6I(;91u}8kgpyjpu4sExj~x~nhV4cb7Kt@8Z=-ux%Da$&hE8u^x3wl5 zNpzc>U{5Ay{+4lSz;*u_h?teQQxOqrLU0}MlTx2?bwi(^r262pF~CmquB}J0u9+a; z*>M(6K5~}ydim`QvzneuJ@R4$a#F{b?XDx0&IB6mQlB8x)NOcll2hV&wk0`#e2HH} zwZd*B4S`cFAa`aD^Y$@a1ioa3Z`Z8YgvFBTu%YLv@KTE3w^c6@6%FsVPvlDS5RWO7 zfl+qRmYPR{1vR>ZlWcG7y1ow+%pe|h3D~C`^qq+(Udl*2P6QJ&hhzcrQ?-gnZx@G{gt*S{o+`ud zqIQN?slTmb=~2EpVUC=b+#Q%q+)G~gh6MRYQe*xkEet&|eKGbP$20F7hXE#WC53H< z%_1NJ(n5x2d&pb?L9$Mn)?X31_y=PKK8dT$Sa~EW1-0)#_c>N+>NAiS!|}XUG4^1S zzgNYA`lkUQ=GyJf8;ALeG>@E4W_{R-UFYjbMO)9ihXXZqT;Tfz%PS!sqaO3-f6E)W zhKKN*m1w&TJ-_*^v#xX{pERa+j>bHj^r$R(XBj6(qiOQ?Vzl0S;Zag$HEOT&Z>Yfk z7A0>*V&}-0 zZW(4nOX0(ZS8U|c#mB2I4Eq7&B|4$I?Rc}XW%E$2jYwM=8*ZTl{~_dVXJpJ)2*O@DHPH7wKr3U$v{%cRb{9w>lm8DDu@Et+;5#~qKrb&t+nnBpG#;q!* z(7^>3nNu72Rl$1=yXdx0ZUKDo&1p*xCH!2L^#0o|rE zGF$pr%2W5w#}dQMmR|%983E53{;kxE3g2|j!Ssd8h5@1Lhb140cP%Ip&<18h~N!Cg_C%Yji~D-gd5HVf#q?Qb7P>J2l;cAndu{A>zsOEN>U zWrmmOt>F3@W63ENL8>-++#LWB?75wuvRIb3os+S#LU{$7IVSjEZ+-pSrqK18wlKs^A!?u1y zd*7Piv<>f1cTaoU9ZR(3BXWBf99b&_^#QM=x#Mj}{Ri?BOIZ#S3 zPTlW!dR5onYwy*)s^8kZKdgGx6k*|zp`Z|Lj z&OlRVXL}oSQ;?05Bb$e#1uGEbX2WXgW@F9*Wb(FgR{NU-2MQ4p@!yjCjr*73{=HL{ z)|6n8SCL_JFm<%C1iFD(Jss?0)FhC5*gv*CN7m@b=kXyGuK5Ou0`kjPsWT_+3!c2U zC88oW9IVo^2`yVQ&8#cxH_4&!}Y++j+t7BphL!?KJt&hl4`Rdrw z?GuET+PV_Hacx0AHOspl+! zaHV4F<+s}*%`h{EWwd#vLU{9z`Pqdj@kI_ROKN{30#f*77k37&rig&Z+Ken!^|v4e zXeg-vx#WLz1N~Da$P>h*qO3JIu0b!)!YZ#gG6MZK3;|IbJ}3k8?;?!9{y(Q7`1|%> z%DLHCIhumpU4d>K|A=?$Ym=BKmvConQ}#Bf?WS1l&@$hIfz%hXLCm)$18{kH;!Dy^ z&eqiunXVOj&WKseCuG2c!z4?6zHX8|aC&d&zEzF8;WcW#Yg9d88!UoM@t!5vWxn72 zsSX{VDT4Gf*e6zDYE zfi8e5r_nV;?3J3X)31dVQbK^@Vi8Bm87;MKNTSZ)k%verc*12Nd-h&Tt-Ql~Y~;9D zb-H9nGB?kXC0;fQVr6V9RsFF`p6U$Z;nm5y`cT2(04>yVCL!EvZQ!Y?FbuzJY-`1RKqP4|97AreUQxGwctvj`B#?YR2_AxwV z*NAEj&MVE3gp|aKv&GJnbpS1en>7Fs7qw|EQ*Az-tAGrDCS7Ayb`x!zahn79wQOPc z=@jAoY@#Z24wp4`unJ>h46D)b{5!#nN=bBm&y-~^RYSg?%#fvjUW7XFTS1F4_c9dP|-w>lzY|fU`V!> zsWHDGn1x*DFS)b{b>mw|Z5R#vddO!XoWOk_q}*~y+%dvjNxz}d6$6=Cg$k)2VxhMe z)_2k57iG`Z`%0Z|ZXrE@N2AyMeTYlM!uEi5v4>B*uJ~92&YL(Lt5xH_e?ar_7Ic=? zFs~@26#QW?vP#c&TXf!&r8!FlY>%RR&8GM7Jmrs_OKT&FJYpoX49SgA&k@)wB-$P! z65S^X8yt@`S$fd|+We3q1&{7`InS(=H#DW;u+&Bl1M?PcP zm7b0h4LFsKRx;9IuW|j_f!LJkO&u(H$W>aTf8SPRG;E(4#bHD_GHg0s9J4aa9@4Bh zy{a&C^)2Rnw9DLEMD1&VcVM7QS^UJ-{EUwsLu>`jDb_LMrP=w-8e%iL zBfNODnE3~wscgP?ow^Sr7AH=-z36DbaMrA?m@E4tIp?ku6ZZ|vxz9gm4rmP@ndIGET&SCi6`yh(6E_6hw)S#VpE zP*U8+eMIXN{l_klH_d3ey}fd%$KdOQtHiHIP6Kc4*ux~SN|H2ohSz=93nt#AChh9v z)99}XPO8MO*1ProUJ*Tu%fX#OJ?CC+;mN@L^ZfD@T}dZITc*Y&T{?JMk2q3DR^Hu8 z(GZBd7wXEb3CebY+l_{&s6lflU6`jxUx1rlnzJWq{96e9OmatVlF6#1tH>dLP+T9? zm*NK5`ds-WeHP_>10#0yaMULf24!fW37*5cK33ZTGCF=%c~2Vj)^Mc5(A__4yuv1) zmozY>J4ZdqBs*0%Bhw(y53kJQUNY?!q}bJjdSIJaQLzCdPWrGhdUiy{Va*#~u<_Ln zs?~_e+n5RIT3XirVcMX$S8dxQeB%B%cMykJ3a=kuk`i^w%&LvZ1`^r2xqTY~`1-=d zQiE_uAQhXHPni8-p+oO=Yb|l_vTlJfgH5#0nYf&S#?McORdPJ6h_ioWs$+2CWD)LK zs=)2XAGDTo->}Vt6KQ|NUFq06*M3b)!_D!v-wq#h9!@F8?-Rb(RG1lajwl)>ZjI9@ z7aOG6$$GOW6e?1?i5i#4!cdFVFP+Xb-6BoT$$cj8mX?I6tWasv9cW7TYe#skvBuNw zAALD}5p5rH%2}o!XpXGTGA1yXOAwij=wWo4$o_Vc=sy=P8^OKz3a%_3Rg^n|57riD zw|@7uNBRwJaZ?SMLMt8sc7D(8@1FFc#llk_+u=1rPFk-Z$_`zsdK9!IfWy|2jF04j zp?R)tJ)&mb?Osg97~Fu6X&vf1*dnDunR6?YoV60kXEhMS1f8l35HTP@e>#unuMO{5 zAz}szt&_O$&Rs>KPjWeu#v!~;IXN333TIegWa{0pce*>)yV#3^glfZ!YsU`!35caB z6@?tp+(cp%w!`!g$3Mf?Ash!5P~uXw&W@MH3JA2a4=bxj`e@*yCfW=VG0z|XA0UJ%V_5fxO9h} z^`j&4XR?~G;yh6E^an42nOs^$`XBqF(vG6}{eMKhL9N}oPJgud9hBU~j_JzQJC?&Oa8J(bD z(F+JHTrwLg)swX|6Kl^OFBjO88*yb}*0oD}>E5G~x@5(qSGi7(7cB1sp_8=ocpSe& z$aNq2XH%m(5J=BhuWKkN@{Tcdj;5_LEK|*~43$UI7iq!eL`PXwR|b^J)J?6FD6N+D-*d@Nj zQqbQLN{g8{#h7)P^;IHbzM#E{t`F#lfzFN-t)`yOE7>345$l+C4Yp~L7~WDMyFMAd zmKY<1w8vsLY&?Oq zoX}l#53g7qKVTn7Ty<6%4;n`pqd%|v%a~Eqd`AI1Yfy&Re1FAbOUzRQWbS`ytjijf~l#|x{W!2$|?pjIZDG7qM38Vqx zupR5?U885>xo|3BcVvoEUuTs&8Yy!#Gr2ACBV{BfIYuc$tEd%0ACqGrqT z_ip#v)-*x#+uSlc>Wu)fJrK9j{10$e* zx>;*wNqhMD$Zpzz&*4Jud1-T?70g^AMZ1zH6Nn}Zs$uH;(#c#wxmO#_;?pt}j=Cpf zQiHDQ+tTLKjFi3a>hHCg`ILauo^K(^P0VaTBVK z4b=-w3>}||4=#QWYOfaZS-8V2(;$-&RQh;UC@%q7Cw}p%8t}7)2jH&phQIf=ts{2f`t60>-m0-&@v7YU9^ENpKZ31kw%4K$8)Bw zbhDt{ynq~IC@9y24OCSoCL0i^ooXoD+&4le=hGFK?*R;a}8kxSId?{-M#je`cm)t6p%l}9dTdP%5p z8nDlZNL~2JUFlK5AwJqP2!E&==*vkf*{`&(fo;bhJy1V>H$JoT5k-iJ&>w{^s#%U7s6X%7u$ZP+7}11x;PqgriX&fFGo zF9fzX62YTm7SY$EPPf`<<);%aKd;u63N0C58MFu1k6fx|+reTvy)PepPTBuT6*5Z0 zyfV&u>UHne_BDQ9U}rc;$p;;Q7JYz#xr*ak5$CFpPYDz;(#`Ti;rf?EfA0@l_kwXe zS)ux1K_O#J{k5)oTap;4*Ybc7D`pwTsV{Rwe29#&L3=a~or%of@e~^gf!?N0lBO#J z$!oDSWjI*#no&VeZzw{KlFEv%(5Tx}Wjc@y zELrrX9RUo6oUAxSG}4G=!!PK;07Es$1*xyOHIHzh2n5!`)MA0!&U;!ILrB0aZDgzo ztdH8juSEpqn7%aq0cDX;{8PL@rsm?Pp~?G7GAVe!{Xsg}Dv;zbF09$o-8gNESM1_bb~4=7i)oJ3ZKB>0nW_ zfgJx9Aod|>fqcqY2%&&Xtm0~R?IzYNZ8=gBhqlsJIAzJ@g7WJy>NrWNX5SM_XRc3k zn`vs4sbzi&=|J`=6yEDwAt^A;uJn%NT+6qX5Z5%n5^{X4&4tQv>_0Tx4&z>(xRI`Z$K zf#4j+?BQNjHo(Jky}S|O=L zg71-+JpX%t8MKRBN;7^{Rz{kWoZ+I~|Hi0KX~XldCTr9ln${ZH)LLRGjKcP6hDV|d zHiW*32@RAcrCO2+etJBKI=)?WJojrQty*9iNF%WrF*Zn7o$!C<(rJG=DjkPZc(ePL zW>58O*Kvc0z_Ql_mTKxc`#r%6A)RwEROIcLL|?{9bJDjMvcpa*a)SH5kN2rJfdcIh z4HB~#5jRs6SHSLfVKxp}qP!o(a5UPVWCKdZw48rGPs>P4pex3K54Dfz_XiK?)Hjbh zl1?k0Pb!iO2(UB5L}S0(860H40<2I}Fc3+~dxEIR?b@i9Y+Cx|8+mqyTuW2pe7#l) ziDDeDaKpchIO(0$oUFJroH1K&!PZ#M3NuKx#1s=oM9ph86gtU78{1WHBrlP&9Oa&~ z|8&lO1QVY63VHiQOOnjYm-@;mWQ9i-0z8^YXtM;0z9G@+!&P%qrRS;v=)erv{CjYD zmKG63WPVzxCG+QwA}u2h-C%Y&Ef=y~b@wp28_p!3^Q^~+_T>G3HSHk{kiSP&7$7z( zT+ab=6|KLE>2eu56MxVWdp~5fNk-iRs#z;?Awy?5U~n^r{W%;%CpA0qy)6A_e`@=$ zuEp{OuHdVOy$^ffs_Yy9?pD`SwezrMk3EQh!E7uKU^XYrGZ5{YRh2s#EMo?IC|BAk zRf$N9FJo1!YiwE#SsqTuRJ<+yJUT{PrcMx3K-d0V1_~30ttRW&chV)+77e$9h37K> zN$L>=yYk*$Yv|dmTJdFHII-(jQF<&fM3G*kiEJ*5dYmL_iW{3sTHGM}#qSfp9!>g4 zEw@1xoZRfICTq6h7}e#k4uf5vc)aDjqd5N_zBDa^$whRqtk8monz zp!Q0E-8QViis612zZp&T=l+plrq-RvqA8SI3(@%%kuYR�Z!zwzgS)+gu~wqQfDaPKJ?D~A%nP3&H*#m#-t>83%M_OP7_$*KUYBtDHc(hn z2_I_CS4rP5Iv_>FA0>rPm|^L}IStcSB0pddQI#LJ`AxH5Y!? z=pS*^X&77t?I(LVk6n@JVWcZF&;$=aH7WX-xh3nD4w9~|vGg#(?HOfj;JDW}oW9os z$6{uKeu?$6{8U9;Gc?gB0*cP2b3WBZZsT}9<<^L7F5tk=;{38hBz#Ym24XOpjrGPO z;xUu#)|(-8zfqHxMg@KLRz24FFua)T<}FnA^mYtCX0jm*#;bKDa1j#gatH+q?NjWq zI$O>XZSepWPLoBMbd!Efz5GcJOT0y9`i@BNhfn&bII%DGR`veS`?iho94B`2&m`cj zYW*$rD03Zr^o+4b)Vs@Vpk=h7?CwgQ$D{CkDU`hRqF>_lm|Os}hj`?}IsaLjTL{ru zQsk(7>FTFL7yB}HTduzU z81)+?Ly0>9?h+3trKBTp<)bK9WI4xR-p3DaOc+sLw{M*}6azed>=OLEad+|AB*~=# zHMc5*Ps_}j7nr80lgz+--eLvzzjN{C1uqzRYCCmSgFhlE!Td<2;wVUX-Y|62oKQ)- z_H>D=_c2f|i?I+97Gp%TNu|g6kzct9|$SlOJ5wAU!~m86|dbY5>Q-9x|k zkA`8|Zio^1Og%!wNO)t>OD z5A7AzVau?i8;Kid_h5g?w_2uQ4Z1*184Ctbj-gUSs(9qskYwtim&{IWm?*zLK5>Qy z`42Z30rMd8its?dboHpWOCY<=PLi56T#m~*bLkbam%X~s%EJH$=dgl3%XU|w{FkUh zG;>>oiZC~6bZ#3J1?>envHk;h0oteffcWs{(Hw0(wZSmXRlCF};w(W{I$GaC+eeD) zi)wy-+tGEhXy!jRldF|jdReJFxT;-TFpf|n>=S^UD- zFGmnFlJzQ>%^2JX^)F{k&mN67hD0Zh${5{!)VbeKB)mk{+$QQR1xmT*A=45Y9~xS- zu_DYZ%!U$$60qGdhdd7&2Kp=*#nDP^4;Z%2NbVvTJU>8AsY?%%CE+2w8J0|>5Pn2m z;$nF@5<7!p9zL86XbrJR756W`v#aE{o+#WP8#{Y+exM~~UL1?gr{)@TvIpuc>OJb` zhI-;L*&e-ehOtpo45^65k!7AmV6E=7hRfvyuYorW8i}|sm}(+{h;MrMcy!!j`B8!z zs1+vEbM2HX;fPtSmTD%pU|;Wc=2yk0fp|D_(m??q?NpYYR9&J2T-9x#?9Gr%A7ycL zngJh_?8MV>`Ec#FU(bJme!-wLw0t_)N_{mapB^tSc=u8|IXzV5M$Hfk6RqhYA#elB z8uKlPRS&-0cz&zfO2-Hg5QoNXJ|Azcd^@L-`M_Cwt@ws5o7oa%8)o~v*38#EJAUjs zemL`ZN2_~ZWp@cZfIqX%uAR(x6aO-_uoENun#{-4F}JtP+iX-v#bxh-4g!@LU7ST+ zN-1KjAmc?u*-tdy#UF06b=~6?WvMUHRXq3RDecR2FePNkE6A6BpCN_qU9upJA!>G{f7(J-3aBKQq?mTIdl4wG zdWu*n7{IJyn(Azd(8I^hFS&8-{fwV$r8(&_P2G}`zyGB0!_A0SBk;1($KzZ#is*6M zUoNJ%`6AXmlkc06DqoTMt$Fe16K8Tp+)j}ibkQtI^^zv9#!kUXVbqaIzJ zu<1gBN(DDkmCs?01&kV<1*fpI(gK#3Y}%*AOOU9C(m)-;c1ZT&M0)5|b>$g?NC#h2 z<5phUelt)+!VpQElQR|2h{0h5>V1d;gX!;GyY+0TAd*Ksy@Cn+4q>F)?${eEn_Uy%7}a21o=hxp+uvU z|KX0H@pp23uS=raZlJTWME*rw`a3Ndvl7{JQ18Qz1+S;ebcSFJs)g}iW&i3_X?X@_By$n0gQJk z`xN>k-LY8aWF`&GFDW^?Xiqr5Q%Z!TaPv!{zoYDMXN<4tAH?kdekpCvQcd^qoLv+| zMN~`QZvyF-AN4?B6Lc?Vzwv#ja_FkBKK@`=s6Edkqz@8rN9mop(vh*(=i(Gl0UUme zhj*F1c9T(2sn4uidLc1^aAblAYcFc)I_sgr#3rX2T8!6YUdfz4IRx$GW~&IXsvkYCq- zQh&;eGIe~NtrGmAKY*Af_$O&QK3laOTw&s;9Sw(DMWUw*Wk0MmE%J4N_#*!EORVwM?SeLdBWE9 z(7gz)eS+W_CBT#+&;9-rwn zn*1U>LJDg2*g;(2DtW~5@$@|++FPp$I?aUfp}v6u`8tGe@N>eaPqy!bzrSB_RioTP z7;GD#eIwA-BjO2hH)o3O_rc<(?;8i$mv_Y2@9S~&F9maLCUY0TRFsxN@p~d)-DgeE z2#rZ$$zuseyq5d|lq6CX+at6EOUD5h92Fya4p!&v}jO4=pvO=dEI#$ zyFRDXvdLr&rbev_(PrZ#mf$D;?5b~U+Zf;H9apZ8*#!<4IfNadSbn^=V8_%-NKI5; zU$Yl*LT-?3=VvwOm;>L9LG`b?%E|A+&+nqFme>yXAkhtF+PrV~?rg~*7+1s7V=atk zAlzMJ%AZAT(-{%=KaO#1L$~F5v*~+7RLb9;_WC~GM|Te?Co9qOcxFMQ7QGmaZ+NO2 zcXbgOhz_Ro>Ww@MeXCdh$S%KPVZrn7ytk1WlW5X(vD3tL^y69Y%u4))NaERSGIco1 zY$>i?-YB{3I>KCxceU*Iz4(nLNIFC_b6DqjfW%rjI>li00xjt^QcHXm69^v1GJJw^sAmr;I1E=m0Zab3XqWfs$H=Owo!bP zDEa=U&wxd{wMjVrHhBU2XiN|s##N6@}(lmoV8eqoG(=`ZNk zDZQmPm_f3njE0gEAyr$5Oz!i&pAc5Js~a)aMBwIZhZ4CJag-g3h3n8itA>j^wZ=7& zpnBzwLm3^7F{o?CtfFx>_iC_`%x=b~t0-C>kbMKv>rLnL@J#lyOhU9Lr|BO(EzYpj z-6*@1RLQ8#RYj1yrb!lj(LH;0imrFFrym98Nf9>x9-_a`ABVCYIN(@65@ith>-rco zO?+Q6Wfbuj9>RlJ-5VPJMSPyULb5@*zKE8bE_OlFzvpf$(=mT;|3(4nzx*+zsp@$B z#t%JBNIswqEQ#B7dr3C6xvfs@sz~EnSdaBG)jGS?!88HnlTxIf21Xvj zt#RM3ug@y2b~?dP?-%+48+WpuQg_equ>UY&!9lcVV>D1ub4vd(VbCzhQ2#TOxA~V0 z`%n81L{CZn6F|zw%0|k`oZFU7N?IFW>E!BQ3K9hTKj1yUzu+=8S0_swd!QiTi-d)= zhVdr}4QVBL6=`E7O@M-_hp8ZdgO#6^-I#-ylTFpt)Z88jkaTi&c5?kUE)bxqAqY@5 zHUE1Bd|~tC=QZZ#X5(OI<=|%J04QiH3;tUUfSeOZ!`TT$uc^!c;N@odWCH?d09`$R zt^jT2|4UXjP9E03`>~jDaQ-6;4%B~QhX0ku`v)`pPg$h@&i;kY{a5Jlf1O7E6*c^a zOZ-ob`2RAD|3NAKuao7!cH2LkCE8#AcMJF{%fCLIe>KLxQ