diff --git a/.gitignore b/.gitignore index cfbe234..9d3425e 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -SOURCES/apache-poweredby.png -SOURCES/httpd-2.4.37.tar.bz2 +apache-poweredby.png +httpd-2.4.63.tar.bz2 diff --git a/.httpd.metadata b/.httpd.metadata deleted file mode 100644 index 06980e0..0000000 --- a/.httpd.metadata +++ /dev/null @@ -1,2 +0,0 @@ -3a7449d6cff00e5ccb3ed8571f34c0528555d38f SOURCES/apache-poweredby.png -4a38471de821288b0300148016f2b03dfee8adf2 SOURCES/httpd-2.4.37.tar.bz2 diff --git a/SOURCES/00-base.conf b/00-base.conf similarity index 96% rename from SOURCES/00-base.conf rename to 00-base.conf index 28dacb3..bae2bf6 100644 --- a/SOURCES/00-base.conf +++ b/00-base.conf @@ -15,6 +15,7 @@ LoadModule authn_dbd_module modules/mod_authn_dbd.so LoadModule authn_dbm_module modules/mod_authn_dbm.so LoadModule authn_file_module modules/mod_authn_file.so LoadModule authn_socache_module modules/mod_authn_socache.so +LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so LoadModule authz_core_module modules/mod_authz_core.so LoadModule authz_dbd_module modules/mod_authz_dbd.so LoadModule authz_dbm_module modules/mod_authz_dbm.so @@ -23,7 +24,6 @@ LoadModule authz_host_module modules/mod_authz_host.so LoadModule authz_owner_module modules/mod_authz_owner.so LoadModule authz_user_module modules/mod_authz_user.so LoadModule autoindex_module modules/mod_autoindex.so -LoadModule brotli_module modules/mod_brotli.so LoadModule cache_module modules/mod_cache.so LoadModule cache_disk_module modules/mod_cache_disk.so LoadModule cache_socache_module modules/mod_cache_socache.so @@ -55,6 +55,7 @@ LoadModule slotmem_plain_module modules/mod_slotmem_plain.so LoadModule slotmem_shm_module modules/mod_slotmem_shm.so LoadModule socache_dbm_module modules/mod_socache_dbm.so LoadModule socache_memcache_module modules/mod_socache_memcache.so +LoadModule socache_redis_module modules/mod_socache_redis.so LoadModule socache_shmcb_module modules/mod_socache_shmcb.so LoadModule status_module modules/mod_status.so LoadModule substitute_module modules/mod_substitute.so diff --git a/00-brotli.conf b/00-brotli.conf new file mode 100644 index 0000000..c2e0e9e --- /dev/null +++ b/00-brotli.conf @@ -0,0 +1 @@ +LoadModule brotli_module modules/mod_brotli.so diff --git a/SOURCES/00-dav.conf b/00-dav.conf similarity index 100% rename from SOURCES/00-dav.conf rename to 00-dav.conf diff --git a/SOURCES/00-lua.conf b/00-lua.conf similarity index 100% rename from SOURCES/00-lua.conf rename to 00-lua.conf diff --git a/SOURCES/00-mpm.conf b/00-mpm.conf similarity index 100% rename from SOURCES/00-mpm.conf rename to 00-mpm.conf diff --git a/SOURCES/00-optional.conf b/00-optional.conf similarity index 100% rename from SOURCES/00-optional.conf rename to 00-optional.conf diff --git a/SOURCES/00-proxy.conf b/00-proxy.conf similarity index 100% rename from SOURCES/00-proxy.conf rename to 00-proxy.conf diff --git a/SOURCES/00-proxyhtml.conf b/00-proxyhtml.conf similarity index 100% rename from SOURCES/00-proxyhtml.conf rename to 00-proxyhtml.conf diff --git a/SOURCES/00-ssl.conf b/00-ssl.conf similarity index 100% rename from SOURCES/00-ssl.conf rename to 00-ssl.conf diff --git a/SOURCES/00-systemd.conf b/00-systemd.conf similarity index 100% rename from SOURCES/00-systemd.conf rename to 00-systemd.conf diff --git a/SOURCES/01-cgi.conf b/01-cgi.conf similarity index 74% rename from SOURCES/01-cgi.conf rename to 01-cgi.conf index 5b8b936..4b680cf 100644 --- a/SOURCES/01-cgi.conf +++ b/01-cgi.conf @@ -2,10 +2,7 @@ # which has been configured in 00-mpm.conf. mod_cgid should be used # with a threaded MPM; mod_cgi with the prefork MPM. - - LoadModule cgid_module modules/mod_cgid.so - - + LoadModule cgid_module modules/mod_cgid.so diff --git a/SOURCES/01-ldap.conf b/01-ldap.conf similarity index 100% rename from SOURCES/01-ldap.conf rename to 01-ldap.conf diff --git a/SOURCES/01-session.conf b/01-session.conf similarity index 100% rename from SOURCES/01-session.conf rename to 01-session.conf diff --git a/SOURCES/10-listen443.conf b/10-listen443.conf similarity index 100% rename from SOURCES/10-listen443.conf rename to 10-listen443.conf diff --git a/KEYS b/KEYS new file mode 100644 index 0000000..27c70fd --- /dev/null +++ b/KEYS @@ -0,0 +1,8818 @@ +This file contains the PGP keys of various developers that work on +the Apache HTTP Server and its subprojects. + +Please don't use these keys for email unless you have asked the owner +because some keys are only used for code signing. + +Please realize that this file itself or the public key servers may be +compromised. You are encouraged to validate the authenticity of these keys in +an out-of-band manner. For information about our validation and signing +policies, please read http://httpd.apache.org/dev/verification.html. + +Apache users: pgp < KEYS +Apache developers: + (pgpk -ll && pgpk -xa ) >> this file. + or + (gpg --fingerprint --list-sigs + && gpg --armor --export ) >> this file. + +Apache developers: please ensure that your key is also available via the +PGP keyservers (such as pgpkeys.mit.edu). + +Type Bits/KeyID Date User ID +pub 1024/2719AF35 1995/05/13 Ben Laurie + Ben Laurie + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 2.6.3ia + +mQCNAi+0jQEAAAEEAK7oX0FeNncaHfa1v+V7SMUviAm8qB8orWG0zvja4ZtSrHVg +/PMwppUh44t5ERA9lltRBdHu30+YSh8a1dYt1XOD83nknzj9rhtpFAPqyywlLVhN +VY3PVLyMbULw27aEAGc+StFqrDoUQ0+j9QU/YH/IyVN9rBaJyhsIDEUnGa81AAUR +tB5CZW4gTGF1cmllIDxiZW5AYWxncm91cC5jby51az6JARUDBRAyb2Doc3AsNzyk +Yh0BARa6CACUBnsP9Vb+T/PvNYKVQBIODz+90tz5GozWwCVfPVSaRd8Dz+oF1sFs +YCz/KuxqBhL5PkiCuSMfOVlPA5nirjoktMF/af5saZqhPr5rvr67Z1OzZnVDvWe4 +DhFrn8EoLrY5YNJhUwfINnZqyKaQu8TW6p4caLkTCW0KM+4ztTe74xRG9NeE+K0+ +0RMpAF3jEY36LGRjq6miazt2bVZQDTl6CuWE+gAaFlX2ojV7e1xdxVvpBIEc34MP +g9ORJ0evx1QilMt1VyGcS/pe4IQgjdJqjU/4fzqFZkT2nntQMbV9kQyNe2+qfqP7 +giTryIanmBAfd3oOCTsRz2VKPfdhCqCRiQB1AwUQMRdzEEyr2GZv4ALJAQEuhAL6 +A8I84BR+87uNAHD0ZJkTM73WdyMEGvAKBvrZK/g0VLYj0NtgkSuRJfrXnGkuh27I +ZrjfL952Q/mXgMtHhJHJ9YfenGFWSEDHnolNzKOzTQJpE01IZ3nWv7ezA9N1LZVC +iQCVAgUQMROrdRsIDEUnGa81AQEUNgQAlvyjt534RDQd2AYGoZriaFzjaL7dTCRH +4b1zxuWBNWf3pI4W0iwU02Q5rEWEmY5DLl6/ie+vcQKOWSqXVgnM/s6EARdKEN56 +d6PzkwszgfEybDYrcAxReJcTCcV8ItJer/iqpBLgtaxyUpI77NvKcDGHp6BgYpnv +1lNkH0FISK+JAJUDBRAwtzlWdGx7qH+PTVkBARFWA/99NTCMihlOZS7LmHDVic/q +H1K1DVdMcv0iL39+7Pq4+AA/ET8dWIgcjaIreSqAZTpjwU1pMPaWgecDD1rEMCYX +R+JoofLJ24BLcSlpXJ/gWMifYNxqdDeMRkw/aW/kaXQJWIz+oDYNuOyi5VvB6faF +6Lm7P5cw1mX0I5rYc3woh7QoQmVuIExhdXJpZSA8YmVuQGdvbnpvLmJlbi5hbGdy +b3VwLmNvLnVrPokAlQIFEDEXgCUbCAxFJxmvNQEBiL8D/3MLjfHGvuByqP1VFQrF +QeMNd2aIQuC7ys3lkDvrLkkPJQANua0/MdDaZk6F5pCGcTmmmaJOjcOcCheD7FU5 +w9zxkQGR3Swr3opFHSr/CkEl83jRy3oq1MFydWoGajQjIr/c23X8zr+XntPyO6VX +q5He4RrTiXeAEFBzz+J+R+EQ +=zh1u +-----END PGP PUBLIC KEY BLOCK----- + + +Type Bits KeyID Created Expires Algorithm Use +sec+ 1024 0xA99F75DD 1997-01-24 ---------- RSA Sign & Encrypt +f16 Fingerprint16 = F7 E5 6D 20 58 AA B0 65 ED 0D B1 66 03 BA 9C C6 +uid Rodent of Unusual Size +uid Rodent of Unusual Size +uid Rodent of Unusual Size +uid Rodent of Unusual Size +uid Rodent of Unusual Size +uid Ken A L Coar +uid Rodent of Unusual Size +uid Rodent of Unusual Size +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: PGPfreeware 5.0i for non-commercial use + +mQCNAzLpIyUAAAEEAN9KC8CxTeozPYJjsnhFpJ14d4Hhf2M6OTgqPQFRHOswM/3j +B7IW0s+HwVyQ5/SjIlo+8ur9X7yaj1FS2GQmKD1x9LKeHRAoosBIs33okRtoeDRy +ufTaTyQTwLklxClWm3JEef4xZioun1mtWbpz0yVEOCSZcRvtnJrNPMCpn3XdAAUR +tCtSb2RlbnQgb2YgVW51c3VhbCBTaXplIDxLZW4uQ29hckBHb2x1eC5Db20+iQCV +AwUQNiiZ2JrNPMCpn3XdAQGlgwP+JLlZvNV/fJ2azKIwjibDa4n2LUDxa7ofKboU +QL+D7FD24zQcmzmkBQm/BL/FSUtxZasJkvdVbU98N3G4h3C4AyErfQOFcrepyGAB +M88onQ1DbQ6tiUA3gw9gIB+2l1C5R8wBOtlwoRJM4GFvjjtRp+KaQqvN3f+lLMMt +hKYB70mJAJUDBRAz3QWlms08wKmfdd0BAQMfBAC1c+9gr7ELthxwzYGTB7LiBk+p +UABsPG/hT9z/cTGN8YQbK6VXV74sPAaeyD/t56xFUI9CRktZCinXp2cxvbNTe3Q0 +MLtD/PlCSRsgwsEIoM+1An1S3qOXWiGBXoXl/DgRzz9GVnB04m5/SP9XLE4Tmz+1 +X/Gu4TJnRjZZxN4xoYkAPwMFEDb44af9b4jGIdCnGxECiFUAnR3RORpXVyclwFEl +euOwoynPQbY6AJ9H5rwHnz4gkE+AVp95++HmyeDkYIkAlQMFEDb45Ogxpj2W7BQL +gQEBaS4D/R+EzfuRPiX5LgV7C70xtplIgS1iK+h0ddkPAr3P3zPxY0AEOjM81hiz +Ol2Kf0TUMhhcLqO0UjNK9EyIHpO+Bf7pQoV050XYvcIwzNyVez5VCbDM7JA+vVeG +/Pb+O/tPyEs7peSpdJAP4Kbg4Eu4b6+1QTLKrBCTWkEuNHABOuzDiQCVAwUQNzs2 +CairDeBjG1dJAQGb7AQAzHChrwaosl01sLcmlItrsqmzSFL5hbLor9Wh8UjVeYxX +FMVgTQGs/AwN1B0W8PApOsz8mg0pSJm8VPHv+pc4Z9eNhUokfUsRJ4LHjREpr3Gh ++5LoZ53nk1f62VQSOCxOOJ50cAH2rqv/ym9EVCaZ7evfHIR7/KH5+sVpcs14c/2J +AEYEEBECAAYFAjhv6QUACgkQF1lVzkO+5qgYaACfaA4rC0EaP5yxR0wEYiGmgy6O +ZhMAoNt4cGFIMI3x2VI9hyi/ZoUiu0zOiQA/AwUQOtYm5d26ZLosMS0vEQK8VgCf +Tw+RZ/xUlB/5YfyrK9fb/VKGm0wAoK3bRHDa/MMxxFtO2c0SqOKxbTKGiQBGBBAR +AgAGBQI7FOmzAAoJEJcWsik7qjrgJlwAnjRjnKXy4jj1pAFnFFUebJ/+Ur8kAJ4+ +DTV/SegKBL3jSua5ISqm+LBOjokARgQQEQIABgUCO4p7LQAKCRC/S9DmBJ24edNS +AKD4ddoiLbPhQkQtGHjy9BlwUSdg3ACg+1fpy3UjWHzCWqWYSh33aneZuXa0KFJv +ZGVudCBvZiBVbnVzdWFsIFNpemUgPGNvYXJAQXBhY2hlLk9yZz6JAJUDBRA2KJmI +ms08wKmfdd0BAT3yBADEDHAn++77n7bLA/u9QYM2LBQHnXdw5Is8YGHpHcNZVDA8 +CtRTOdub8rhe9qgsid/jEry0hT9Sygfx/ry5ntjmF12ltnxBDPdZuU2DaHaIh/zB +UAv0hyaQeAXEYiV9J75GrDkTj5Jrrnd623uyIRoMZPKYb+oqsZ4HjIe/w+CDfokA +PwMFEDb44bT9b4jGIdCnGxECzDAAoNR8md7KvzarecOh/6NpTb5r8JXJAJ0aJtTz +soNXpLaVwSMiGdm5ts2qOYkAlQMFEDb45PYxpj2W7BQLgQEBxKID/11Dft+UeLdd +kIDFjaJGrIOfQ11y+QlJWaQ2Him/qNzNP8w8ZJ/meAb4PMSeQOI3PVKulf8vMp3Z +0Jh2irfn1ycqsui4kDe6azvd5PultRKTRljtwVIDuqsrVMVq/zNAC2bN6CUnkkdZ +2O7a5qIkDDYnyRzAEwKhJxleWrXYHiIhiQCVAwUQNzs2GqirDeBjG1dJAQHcYgP/ +eRCEQW5DJ6JQol5HQ26UnjBfQGdXsRvpT6gFNCDy/Nv+b886WC9j99T3IU+AztXf +OPfPh7oU/2yC0VOmSaZS9SQ/PuuFdNhMggR8Q7goWothdBsMOUyO3iYrQCRnV3mL +NsOT+/gpSt9diLujs7SpiQeHZmQaNMQUrJPBp7tTbsaJAD8DBRA61ibv3bpkuiwx +LS8RAvHXAJ95ifArYzouYPB3clib/568TqHeVQCgxgEb1xJ4AgjZibMl34g+19wb +G3CJAEYEEBECAAYFAjsU6ocACgkQlxayKTuqOuCaDwCfTHOoCNtoYenYgqa2LgUC +62mEqFUAn25xLhvjjODMpWry5uAA2NR1k00KtC1Sb2RlbnQgb2YgVW51c3VhbCBT +aXplIDxDb2FyQFJhbGVpZ2guSUJNLkNvbT6JAJUDBRA2KKJpms08wKmfdd0BAWcz +A/9xfbUofCDogPs2gbMQrGx9kT90SBEYcWnlPq/Ocj1871ZlnYeYhJaMSOuLnMAC +Ze9AbadYRgVVwXWhamH+d0uAvCw98ixmI9emPUsPuiifk8Re8mWQV+kcOqIbjE45 +FtsZYFy/WyqTHp2OSl/JcugwPfrlhrMW4q6selY/ABBEkokAPwMFEDb44b/9b4jG +IdCnGxECNOMAn3K6caoKqMtKGrqRwoFaCPjBgOi5AKCc1dP5HAtyFloQGxS2fAwJ +p9Dp8okAlQMFEDb45QAxpj2W7BQLgQEBX1gD/1O/9VxXp2a8yrlV2qJ6xJ9U3fCL +/OVUTrgDgzw/219jeXgiG0CAM0ApZ7NSqk95aRSKZqWoJvTY5K+P4RuGoMJ1JYjQ +i2fXiCSHo4fDF2RPTXxqCorQq6M8csJqpQykiUQRd6HfKSURk1WRfvGqi2iwiCQG +ipqd0kmzyQ2WSEjviQA/AwUQOtYm9926ZLosMS0vEQKW5wCgiIdzdam+8MnCpvrp +5ooDS+XqJi0AoL6kVPnu/uDN4WVIIaO3rOYeW+SViQBGBBARAgAGBQI7FOqHAAoJ +EJcWsik7qjrg+S4An1wT/kE/gbX3qmG3oEGY78r56mM0AJwOEJ5QA1bl/wDeHeyH +tHd2qw/lVbQtUm9kZW50IG9mIFVudXN1YWwgU2l6ZSA8S2VuLkNvYXJATWVlcFpv +ci5Db20+iQCVAwUQN7GHT5rNPMCpn3XdAQHIuQP9G3RaObWL3iI2xoIWs3s6L0LF +noFv/RrK0NHEDy0YEm9LqeVp86F9QvOA+kh3ySfVPtxbwsMAswAkqbvWNi7U2Xz0 +V9KJmnEnJFLmjHoTBNpahTGFTnOxcH4X+57mAAzbCWyXFvGsT2b8orset0QVqDhV +hwOLGKLlXWzDiQdrY1+JAD8DBRA61icB3bpkuiwxLS8RAkGnAJ9m1mvfaHA5Z3FU +JyzUpuS7xd4NcQCg5XMoJgXHC1Gngqn6jAh+Dn3TDVqJAEYEEBECAAYFAjsU6ocA +CgkQlxayKTuqOuCHpACfU7nZUI2Pj5dS46VZpVygxMl6dAEAnA751ZlwgIYWnZyh +uqKcJzbwdV2fiQA/AwUQOt88Av1viMYh0KcbEQKqwgCgyDsKH89EE1W7/b8cfns3 +OrI+3DUAoNBYnQdsW6Uk45iQWyODnV3jUIgQtCVSb2RlbnQgb2YgVW51c3VhbCBT +aXplIDxLZW5AQ29hci5Pcmc+iQCVAwUQN7Gd35rNPMCpn3XdAQHcoQQArrWwFNeS +A5Yu1nEXevfStfkSUQqzA6qsREPgrczIOgsCfDR/RA/1P7GcxiOvY5mtckuvgkP0 +A9atWkCFX4A0UzerKAKaSirUd/V6Dm8w3hOR/e66I/rbQifZoV/KqvofRsxESV4U ++uXoBsleePwhpmDarpx1BlMJrjwhDDmGaVaJAD8DBRA61icL3bpkuiwxLS8RAn9y +AJ0YXmF4g4/6GVCilTjxhZWL6acAvgCgwfYFTgB7gdCg9+3LL2jsc6bC4OCJAEYE +EBECAAYFAjsU6ocACgkQlxayKTuqOuDA9gCeLlDfQW6ryZS8S00/LKsdvdVF0R4A +nipUMGGyTIHYvgX+SI8vfZu3lUwwiQA/AwUQOt88D/1viMYh0KcbEQI9bgCg7T2u +7Hzf/HG7s+m5So67+ixdngYAnjTlgTJNKSRLspsZVVumNM9YgxdjtB1LZW4gQSBM +IENvYXIgPENvYXJAREVDVVMuT3JnPokAlQMFEDNNn5SazTzAqZ913QEByxcD/RkT +z31D9IdedFAd8dseUv7TZkSSnZNctg5fZSlxL8kOWQKzclLFmEmnxRkTsIm/jtLF +g2B8rEtKCfvbnOIvUFVIJLYtLPgBEWPFRrDpBx0eaLdWmogD534En/gsc5Yh1XTB +G4Vveq39iZPcuP1Zc/fhmsNTvdgsdpbLyDquYH+riQA/AwUQNNhoI1F+HqlP3KvB +EQJbxQCgxoQqL3hPPRxUhG3jFPIfiMGokUgAoPXYHWM63hFwomWAkaN6qSAHPKe/ +iQA/AwUQM9vDdGfM5V5WR8xwEQL2iQCdFQX3I1x2K94zlI740/VKtpv+2g8An3Wk +FnyJR/3SJA88j/cujVv7kLX0iQBGBBARAgAGBQI2treyAAoJEBPfD2hdwuxYIq4A +oKI1iXIAvt6KWLnde4nH4fJYvT58AJ99QNGbxthzYLnyFL3M/6jmQIk4b4kARgQQ +EQIABgUCNu/SaQAKCRBrQHp6H3FQjZO3AKDQQnUS2qMjw3D/Oy6UlMVxZEYPUgCe +LsZj8ZIUcKkfuhtKycVaIK2wC9mJAEYEEBECAAYFAjhJyKwACgkQURMkRYnG89BU +PgCfa7gmUGgguVXend9EzB1h1TqQErYAoJai8ymv6wYxUXR8/OjoY9eB3CIJiQA/ +AwUQNvjhlv1viMYh0KcbEQKGGgCdFsmDuwfAnU9UFyxhSoyvdkcOcwYAoLp5e1SL +6ZmIvITFg++VkDvR/j4UiQCVAwUQNvjkzzGmPZbsFAuBAQFdWgP/bv9a9t3J/xZY +44wb0holsJFuZWOVYKeF9RFIWd0sJXut7yUeWZ5g760eFSEX0QDHfiq3KOT3XO9l +hcNnDRBInMbBnawbBneLpzM58ZaRnw10HwsOl49Ekc9nHZBBM47mqy1BlGXMi+Yk +Kh3W2MsuitHkAYwZuNalrqYhqghwooeJAD4DBRA61icU3bpkuiwxLS8RAuD2AKDr +q4JAQFljMpudc569P131/RjPrwCYqxVlo0cbfFBihV06y5LHjQEd44kARgQQEQIA +BgUCOxTqhwAKCRCXFrIpO6o64HEaAJ4wLnOLuRX5U21MFOUzIZOumrItcACdH9DA +YvOpnnkjPNSNGjaI1oh2w9+0J1JvZGVudCBvZiBVbnVzdWFsIFNpemUgPENvYXJA +REVDVVMuT3JnPokAPwMFEDb44dT9b4jGIdCnGxECfaUAoLEJ3t6nXT15EskyH+83 +pKZe4zkIAKClLlJ7vTuZ5fcjOsqVURNrs4o/cIkAlQMFEDb45Qoxpj2W7BQLgQEB +QjQD/3DOozCF5e6JkMXJ5HGVrAxbDpRs4SJCrLFX3GuTeGsVCniOf0WTy6+cXuod +zu1ZbRVlji9YKO2ufoWvH6AEPEVnHYp25T0dtMya/mwEI010dCrj4oXTaYikz2lu +WTDPgKcHk+mYNDHREOOcN0/CO6RWTZIhok3Su4zBYL0YTg/RiQA/AwUQOtYnG926 +ZLosMS0vEQJe2gCg+51l8oZ1DQAL5hzKeW3pY5Vg2gkAoMlzmol5cvtxt9wFyrjw +L39LL0fstCVSb2RlbnQgb2YgVW51c3VhbCBTaXplIDxjb2FyQEFDTS5Pcmc+iQCV +AwUQOsoapprNPMCpn3XdAQHxkAP7BJ4KshrO4m+T2/l5OepLDQAGWxIg5XK05upw +mgNPO6enptNjT+Quu78GYOKgVQww3eQoIlxFiEQ7Kccc0gFBhZVoqhrZ7mALrY5l +HPN5Gy68PlpZ7LJoeYm694LlbwcWa2IAs2K7pfWft/36t3LRBt3NKOyOFVSCGPoi +U+LiZuuJAD8DBRA61icj3bpkuiwxLS8RAhflAKCyngJ8wc9VaBIA+qaMFxCdGbIw +egCfbseHoGcorOi0OS6B2ev8hZbJt1aJAEYEEBECAAYFAjsU6ocACgkQlxayKTuq +OuDvlgCfcKf4eO+Y/ojSavGhITOWjBxgPG8Anja9yfJLediLcTlQwsycsWVMx3wh +iQA/AwUQOt88GP1viMYh0KcbEQIyoQCeIFtr399fYt4MqRBfvGo59oE3A5sAn0yV +t89HbY/x/sBXuksvBGxFGhgs +=GI5x +-----END PGP PUBLIC KEY BLOCK----- + +Type Bits KeyID Created Expires Algorithm Use +sec 1024 0x302DA568 2001-02-13 ---------- DSS Sign & Encrypt +f20 Fingerprint20 = DE29 FB39 71E7 1543 FD2D C049 508E AEC5 302D A568 +sub 1024 0x04E15F28 2001-02-13 ---------- Diffie-Hellman +f20 Fingerprint20 = C41F 1F5C 6485 0100 B21B EB14 A14E 77B6 04E1 5F28 +uid Rodent of Unusual Size (DSA) +uid Rodent of Unusual Size (DSA) +uid Rodent of Unusual Size (DSA) +uid Rodent of Unusual Size (DSA) +uid Rodent of Unusual Size (DSA) +uid Rodent of Unusual Size (DSA) +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: PGPfreeware 5.0i for non-commercial use + +mQGiBDqJD0sRBADmh5EfoFA8VC/c7+BlG5l4+RBIcYlkvYFZcLbS2fPgkHDndrrp +5xIeYCFvnnRSVGkQbAfl4Gj62fGcyaI9QIbLAByGeqSoM+DbiEzIyR+QQNpBq+bo +V1JWaXiuI8d4sdf5ZyTH2nT1EUWVPiBgeXHYtdnjoh7IpG5ETH2miBs7swCgvcJr +y3Lwa8FfgVtCXFeI5E8wAm0EALOtxh6HwJbTWGAFJFA9RWw2oShLmovYGtdnxcY+ +wHX12oCkanKd26Nr09O+onh/xiQ0mSql3v6SUPnCfyC/qCLeuO2w4vspDlFMbBP0 +I+XFUt16Owldxvmy5fHvhChs7YSZqkVCMx5i+NTvyd51P9aELFG6A/7x3z/tpmyn +Be8wBAC8l29qjxJSNDsIMMf0cw8STUtNKN9SknKVpQektHb+x+3wreUESPByrgfl +cTm7y1ulg8rVazynsSVjMCRtmZIfboV2mhsgOu08aZ3bXPpWiHSJ5NR97jdH8s3I +xuiyQ84PHHVjyLAIh28nAkIvbPRtgt7M581dPpKknHvqz1sW6LQxUm9kZW50IG9m +IFVudXN1YWwgU2l6ZSAoRFNBKSA8S2VuLkNvYXJAR29sdXguQ29tPokAVgQTEQIA +FgUCOokPSwQLCgQDAxUDAgMWAgECF4AACgkQUI6uxTAtpWj/KACfccB9nTN1VpGP +zL2c11ya9ApunAsAn0zhuYOoDZsUCbKooUIg4zH3+nFziQBWBBMRAgAWBQI6iQ9L +BAsKBAMDFQMCAxYCAQIXgAAKCRBQjq7FMC2laP8oAJ9LlFZKQo9K+VFVsIu44z+H +GniLfwCffPkZqEjG6nSJYV50x0bjnVb8GDuJAEYEEBECAAYFAjsU6ugACgkQlxay +KTuqOuDQRwCfbpsHlgt++QSd1BRy8yHqrUupApMAnjcY03RsdplzcGr+xuiiRjo1 +quipiQCVAwUQO+FSL5rNPMCpn3XdAQGqgAP/VUU1o7ZxsEZJYUq8R4wErYxlMr1U +IGpVkPhMmlSnJyTN2KbZGcGkbiQ7+prdjj/tk5MVssVTP8JHEjS2pXc5/Gpf01oM +opK2h7K1fEX2NH3F3Ow7yEt1/kGtNhgaEBYUVO8TqZaba6ikqXn/vYFQpprSUThg +pOk4kk/7eggUxRaJAD8DBRA74VKU3bpkuiwxLS8RAu8aAKCLrqGScZZ3pWXcvnsF +7Zu3Cq/X8wCgssm+gUsZtncub+LPqEWcrS7MVqW0LlJvZGVudCBvZiBVbnVzdWFs +IFNpemUgKERTQSkgPGNvYXJAQXBhY2hlLk9yZz6JAFYEExECABYFAjrKH6IECwoE +AwMVAwIDFgIBAheAAAoJEFCOrsUwLaVoixAAnjACHycu39VEG/T/HnNY8iJt3TFH +AJ97peKuDSVTTLWtfwBHv/y05+ieNokARgQQEQIABgUCOxTq6gAKCRCXFrIpO6o6 +4FBhAJ4orS3X+GJ64mXjzqU9YFd9XYKBTQCfapw8Ss2Fy/HZgPd1CeUuBuM+9/WJ +AJUDBRA74VI5ms08wKmfdd0BAaVhBADN5lhtY+wUn21GCQHP8aRfL+efIVhDlOE+ +uKY+SAK+FgMM97r3eVEVC6r/eWeXOV6hCUNcpnawy2mwck1XwJ/uAkmvXPZevP1Y +P+8We9NL16ECH5Ow/oSz1i+ASKsDH06HpALC5VhPfZ1qIc2M+n7xhhPUFS8g42w5 +yfrHDS97OYkAPwMFEDvhUqfdumS6LDEtLxEC+xUAnAuKRZ5OyM3wZWZhUOFu2+1m +RYuVAKCjjuLsMfV8KDlFyEc3QXvdyhyJYbQzUm9kZW50IG9mIFVudXN1YWwgU2l6 +ZSAoRFNBKSA8Q29hckBSYWxlaWdoLklCTS5Db20+iQBWBBMRAgAWBQI6yh/NBAsK +BAMDFQMCAxYCAQIXgAAKCRBQjq7FMC2laAFLAJ9B4SLn9nVY1NWW7yZLiJl5CIoE +fACfVJFGZ+CgvozX8nt7kRXcsu+FZiaJAEYEEBECAAYFAjsU6uoACgkQlxayKTuq +OuC92QCfTrmLK2FBGB6auc0Llz91JtM8vPQAnRI4xh+uenrt0Mijf00tKBDL8O+A +tDNSb2RlbnQgb2YgVW51c3VhbCBTaXplIChEU0EpIDxLZW4uQ29hckBNZWVwWm9y +LkNvbT6JAFYEExECABYFAjrKH+cECwoEAwMVAwIDFgIBAheAAAoJEFCOrsUwLaVo +6WoAoLPiSCJ+ZpzTBxGbUMkmm8jidlpZAKCTFBQddW1FkHuKFMUae9S3gOQVsYkA +RgQQEQIABgUCOxTq6wAKCRCXFrIpO6o64ErDAJ4pyRV1ShT0E4TegsZQ0IQ6wM/g +oACeJQNXftu7U/bVZuNkLfXnD7SKwNOJAJUDBRA74VJKms08wKmfdd0BAcANA/9M +g1QCcgmg6t4HTaZ3caeI8nNZ/LjWs8MNWi0Z8OGytEwOgwIrG/DzoCPRQY/IlMya +gEspYEDO1kjrk37HcUeO8aOWkEjXt+0uFDLfQGKJnusyb+ekjw+JxOUzM8gMH/mR +ePJM+zx+ZU9dJU1rvbwXrtPwJpYX8xSf1L0J1p0ih4kAPwMFEDvhUrHdumS6LDEt +LxECD5UAn3gLjfBN18lmbw73leBq3+XKjI5gAKDBXQHmIc0zRT9VgszOGZG+XfRk +nLQrUm9kZW50IG9mIFVudXN1YWwgU2l6ZSAoRFNBKSA8S2VuQENvYXIuT3JnPokA +VgQTEQIAFgUCOsof+wQLCgQDAxUDAgMWAgECF4AACgkQUI6uxTAtpWi5swCeJrPK +y5D9fDm/H9nbsXLQTuo5QdUAn21AiEiqhurk46M747SqLpNJmgqFiQBGBBARAgAG +BQI7FOrrAAoJEJcWsik7qjrghWsAmgOEE0Fh3Xcml6sk5boGNVRgg5+YAJ9lKBe/ +9SY/DssCK8LV4gSCdhRCnIkAlQMFEDvhUlaazTzAqZ913QEBzWED/0gy/fbatnok +wtHz2P8xEAZ47ObQ52IhjxaG5GCkfdSEF5x+EUQaNeO+u3O2k3LakNO1/YN2BC36 +MuZeO/rU6bJro1r3ct5G5TODdb5MNSnf6rUath4T1BvHi3P5sdhB4e04WlenUscB +AbEpo2zfEMn6QDvmrc6Mr+WpnVCb2gJiiQA/AwUQO+FSvd26ZLosMS0vEQIRiQCf +cdu11Fj7Uotcb4R9mrM7MGYVptEAoMDImlcyl2w/jf3vjPnoNmrzD6YqtCtSb2Rl +bnQgb2YgVW51c3VhbCBTaXplIChEU0EpIDxjb2FyQEFDTS5Pcmc+iQBWBBMRAgAW +BQI6yiAkBAsKBAMDFQMCAxYCAQIXgAAKCRBQjq7FMC2laIlXAKCWqXUTcphAK7wQ +lpLXYTIpq45cKgCfV7S+4kkw8A/Sg3/v9rzbTIFTKfWJAEYEEBECAAYFAjsU6usA +CgkQlxayKTuqOuChhQCfXC1x2yzBiRp61UJM4ILFM79TtU0AoIUYBWyxpU6eS2kU +mHnBZlHzkZJiiQCVAwUQO+FSYJrNPMCpn3XdAQGqygP/XT9IZzBm42ZeG7hIh8Nq +UwPinkv1AP0lqUX8ME9hIcBOtmpSwvqHV4aa8RBzStth7ob2XXvJyjl/oBgxjTkQ +mdPwqsYGT6CQWm8q3roJe2oASahYgGinkgivKi5KNCLwdpst+0nEcTb2L8GDOJ0d +cWmBRVoKlQPNKI44uL68XCWJAD8DBRA74VLL3bpkuiwxLS8RAsATAKClx09xbGW7 +VDKSZi+HXLpy83R1fwCgo5dkvND4CEAJD4XyNol2Ygj/j2+5AQ0EOokPURAEAPb9 +XCxUtIXh12LmwYNk0PA9TWNJM1Mgo20rwUsZUdLHOZNuXCUfYIjHjw951K1KqpXG +Cv4On/0SVXagXZs9yI+y4Emkz6qPhr9nAzHexH+ykn+ROaP0zNKtPPgp5CQcHz9F +Xyz90XZuU48Tly20a9qo0v21dhVh0D4tulkS3pAHAAMFBADUgNY87Tsz3ndoonHo +JUFfzwlm5gOknvxE0Sk8dgYzYPrcLX9ZETpSoTWepbjfSe2F1voTscMkV2WhKMSr +dtzFrd8PjvOo8tXLkPL72vyUgw7BDFnfLvIaLtHAQu0BqfHaORhH5ufFZLXrOXvH +GaYfx/kSbFOpjK/KCrYgLzF3r4kARgQYEQIABgUCOokPUQAKCRBQjq7FMC2laDSz +AKCv+P8evU1SsJcZdjTcfyQzcN7FowCfRZE55mNxbmQZH8RiK/ssP3gcEwiJAEYE +GBECAAYFAjqJD1EACgkQUI6uxTAtpWg0swCeIya+hFw4LjTi4KyK8puAMTMNsNkA +oLSGqJ147DJuA6/pNp9OXD1q98vj +=DZH6 +-----END PGP PUBLIC KEY BLOCK----- + +Type Bits KeyID Created Expires Algorithm Use +sec+ 1024 0x2C312D2F 1998-10-17 ---------- DSS Sign & Encrypt +f20 Fingerprint20 = 1315 5B0E 9E63 4F42 BF6C 163F DDBA 64BA 2C31 2D2F +sub 2048 0xC9D00816 1998-10-17 ---------- Diffie-Hellman +f20 Fingerprint20 = F05E 8A42 A306 92F1 7B32 E3DE 2B88 4A28 C9D0 0816 +uid Rodent of Unusual Size (DSS) +uid Rodent of Unusual Size (DSS) +uid Rodent of Unusual Size (DSS) +uid Rodent of Unusual Size (DSS) +uid Rodent of Unusual Size (DSS) +uid Rodent of Unusual Size (DSS) +uid Rodent of Unusual Size +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: PGPfreeware 5.0i for non-commercial use + +mQGiBDYpIJsRBADkH4H8YqFaBHE7lTb+DkZ12CLXq7Hk41DA/HU+KM2CrGOExK4r +DO9zVa7zjMbjhskYMK9AVTPC+f+LrDk4PtTJrRrh6DKZf8loEhgChrUpSDBvlByw +sWiAxWqIWAdNy0POXuZNyW+XPc6u/bKgn61pe9UARKI+qqxIouRxfPJuOQCg/7q0 +syYsnWFiUTOMF7/ku6PHdhEEAJVpl3PaqW5BExYKrdDLKfQ0H7jLXXOABul4bDzm +pjUx5Wmkq2zhh75v4bGQRBdCCTAd3EAowVsk2VbhUY/oQ/bfv7lK32PNTrhtA9Af +adueeU6hDQcH2YV0U7AnaYHlRbiYxc6ASGZdSNiPL8CYLuP3KQ7eSWjRqG+iEa1T +5nHkBADWMdJJ10rUeLSoqUKGnDhVDt7T7H7EuEcgPrERksztzBc/bkOFZg+aRlFo +Z8on8LURDDjtQkHgy1X3ZZMNi7RlKOfEVVBQAwaxqUzxv8gGKBhu41TZfksJ6e6j +q4ew51wBKl0dLfnsWGdxrzbFvQr42KIia51VW81fuEWWbePGgLQxUm9kZW50IG9m +IFVudXN1YWwgU2l6ZSAoRFNTKSA8S2VuLkNvYXJAR29sdXguQ29tPokASwQQEQIA +CwUCNikgmwQLAwECAAoJEN26ZLosMS0v09sAoK4Pkxh5nK6rASGHMm6yJ1vAcj59 +AJ9Bc1TmkW2hfjy+h/qupI3GSGKAPIkARgQQEQIABgUCNu/URQAKCRBrQHp6H3FQ +jQTMAKCeQ/gtRkp14n4IPb5XUFgaiuxVAgCgooJ/PF27EtttYAcQQrCj1boFxgWJ +AD8DBRA2+OJt/W+IxiHQpxsRAvTAAKDOlNLFMosEetY77WXXcecvjt6SKACg28M5 +aGHwbNgMCYAMc5N6CyJ6P1iJAJUDBRA2+OSuMaY9luwUC4EBAa6hBACSL40yvCXR +8KqrNh8YbXYQsWsauIWiHfjXrMjlYpGPjU8aYsn0dhGYNsiYZwVKkTJMogRtiNeF +RpaTJcjTQA0D7G2d+eq2YULmuPeLoHXCp2+xjh77SD9Ybb8cOl7iNNNEGXrza4aE +X0Y6/bAH+IizlIXapirzyV40bilv1sh5v4kAlQMFEDc7NZaoqw3gYxtXSQEBc0oE +AJrDIhOcHRPtJTYGig3+dBuKOpVh6KXg6t0oWbr5+xopEBlAjFJdJouk/lkzlXGo +XmJIqodvlwcSBrANO9ntJNTZGZ0fIbrk/a+j6NE46xb5UqDlkKN9n8Giw+kWvCbi +eRneb+JKLDtr4241tMEG9DnizsoHEeX75iIdWRTkjSK0iQBGBBARAgAGBQI4EBU+ +AAoJEPq7n7kJORDtSGYAoJ1UO1rpepVGPj3fK79ZkdNuz6MXAKC0cVfKK6V0HlH8 +lnJkNe+4zOqwiIkARgQQEQIABgUCOCrN7AAKCRDdIMImBDBlVl24AJ9oDUfkD5Wz +Y6xwHuiVRSqApSeKRQCgzR7imurkIfa62k7ozQA7cBSGY7WJAEYEEBECAAYFAjqJ +ELYACgkQUI6uxTAtpWgUvQCgmUw/9s6iwO9yC2e8KustCEZTtBAAn13ziXenfoWz +yc0uIhuNQSo9/9obiQCVAwUQO+FRk5rNPMCpn3XdAQFQeQP/diFqVU8L0XIRUHqv +TklJ5NVCFxb1DgkRjPQgQc6URSr+u9d7+sUe+XIj3UD/V0ib+lmTribpe/OUSlTg +TAJGH3WmXxxJaPigbQL4cSmuvdQ/aU/pxZzcUW4OpVjbOlBzo9zchP1wWFmQYYai +hi+vjB63HgrUotJfI/JoZ8eook+0LlJvZGVudCBvZiBVbnVzdWFsIFNpemUgKERT +UykgPGNvYXJAQXBhY2hlLk9yZz6JAEsEEBECAAsFAjYpIigECwMBAgAKCRDdumS6 +LDEtLzFfAJ9ptM0H+S2O1EuUoRWwh4frOdkH/ACgwtUhdrNQctOzp1jzuXefRLek +zZuJAD8DBRA2+OJ//W+IxiHQpxsRAmm5AJ0QTZhmPKYuRZ1wLeEISwSVoTxPDwCe +Kn/V8i9uXG5SrjJIqzM52C9nNu+JAJUDBRA2+OTHMaY9luwUC4EBAa7LA/9i3oYk +i2PT43SKo/WXMEfEUp0SZrBqaYhJn0LWOuGeBB3ta+ijQzVF6KV8dlwX115Y/rd8 +xHV4QEQqGD1ofC0QWXGc1TJl7l/yv25nHE+9/+JnPp3xAwYfW+IJca7pVcNxceNO +v3xKH/yDc36qtAVkB9IZZ6kXAktQbzUbTi+lQIkAlQMFEDc7NbCoqw3gYxtXSQEB +5bED/iThb1hGo0sSEiF5LReuq5GIIliy9Ju0lYGG7sjF+HuGa+l3VCp7uh+axFSR +KKeAYZfN+arHujpqcYHKeMdJreRsIEm3bBLgcMboiVjqqJQ2Kz8rw0Ax1dcS43tU +2E7XfbDhVRHee8H2BNAEoCE2qMBZ2qEargC69lPVunSs1LWLiQBGBBARAgAGBQI6 +iRC9AAoJEFCOrsUwLaVoijsAoJ4P63/fTU1SS0CsJcrGLav5q3vaAKCHK1eUxe+d +PtPYaeZuLmvmcTdcOIkAlQMFEDvhUaeazTzAqZ913QEB7vID/3ny3JaTnCgeFt4p +LZ0nuv7UaywuvXj/6RgH/4MLEWHVXagvgfgEML/jmFw3j7VzxE78pEWt41R+Kfpj +ZK4YQS9LgZLCM6UENe/ejijeljOTAGYRlei46O3nMyZXCkLsq+YFoVd7Gn+yplaw +Quiy7snl9ChUsGMLCjAa3jZt4QRTtDNSb2RlbnQgb2YgVW51c3VhbCBTaXplIChE +U1MpIDxLZW4uQ29hckBNZWVwWm9yLkNvbT6JAEsEEBECAAsFAjexiO8ECwMBAgAK +CRDdumS6LDEtL+PCAKCK+FbSDw/QtyB6U03NXEviaQmUNACg6d9pt5X9/E/utW0p +KeX4Yws0BieJAEYEEBECAAYFAjqJEL0ACgkQUI6uxTAtpWgkhQCbBvzYd4A/V7uB +LHmEqz52teOoVt4AoLgZMi2vfQwqv13ED/y3zspL625ciQCVAwUQO+FRwprNPMCp +n3XdAQHc4wP/V9gdW71Ygc1Jr8hxmMODtq4auSsqg4mfOHpP7Z6vbAhLFn1RTAYY +pIhTYX/Y5514f8yWmDyL8/ePGrvZlHqpu8MNDlju37kdSS78+KlUf3XCA6s0RlXA +VDovcmbAGVQmNQKf2tlJEPmipTZmExF5tMGM7H2Ob7w7nvSgwiXZm4q0M1JvZGVu +dCBvZiBVbnVzdWFsIFNpemUgKERTUykgPENvYXJAUmFsZWlnaC5JQk0uQ29tPokA +SwQQEQIACwUCN7GJGAQLAwECAAoJEN26ZLosMS0vkGUAoPbhp3yi/BeC6zR2mv16 +XARtVlAwAKCE8kHKDREPKA/E7KpH6dHEx8BBzokARgQQEQIABgUCOokQvQAKCRBQ +jq7FMC2laJlUAKCG8lAf70mA++RFLykYKh6uouPYXwCdEvy1e48Py7VD/M+q8c0V +Zw3a92e0K1JvZGVudCBvZiBVbnVzdWFsIFNpemUgKERTUykgPEtlbkBDb2FyLk9y +Zz6JAEsEEBECAAsFAjexna0ECwMBAgAKCRDdumS6LDEtLyKeAJ9N38ClCaouEyFL +uCqlojSCcInEMgCg6fgtZXAoi9KyGP1JPhwFstk3hSyJAEYEEBECAAYFAjqJEL0A +CgkQUI6uxTAtpWjwFACfbO9rVnMASuQuBNr5S0v6QvEJHUwAnR9Q4cYjXPQ8Q+B5 +ozX3QKSo4fLMiQCVAwUQO+FR2prNPMCpn3XdAQFhywP/VwKYdMizq+z/3wqqMoG/ +e7XIkTEllE8O8fPa/mg9S1Gdf3ysErKmPoxwzhA2NiI+1ItxaFhmSnb3FolzGB1r +XOdPUn74T8PJAdycmmwLqY9jq6qzx3qva+O/KBkp4RH5Y4Jrd8R1w2IfNGllvI83 +/QixXihNUYZChg+0wbAx7Wu0LVJvZGVudCBvZiBVbnVzdWFsIFNpemUgKERTUykg +PGNvYXJAREVDVVMuT3JnPokASwQQEQIACwUCNikhawQLAwECAAoJEN26ZLosMS0v +urAAoLIKrWymZ44LD56dmUSbp0Im3HX9AKCPXngeaVD2FV9yb4xyEr3aAPb8p4kA +PwMFEDb44nj9b4jGIdCnGxECo8wAoOw5N9z4B7faBmnTBDetulfBfhGqAJ9gGzaA +V6Hp0D8dNO9V+MxZETY9d4kAlQMFEDb45Lkxpj2W7BQLgQEBKYwD/0ng4LDO9Dpm +6m0AxD2EzOsdN0eGB0VdfEJfeWxM/TAnHlecPL1Aq8XXex8LSvDemfATtQIXeOld +Ye2np5szUpY2MBTCLr53kNuPmDLOYhNCzQnB9w6QtaXHlDINGyTjTQ9S2r+YhCtc +Qb5LPS4uY79qE4GVMmkvI+60/n02YlJRtCVSb2RlbnQgb2YgVW51c3VhbCBTaXpl +IDxjb2FyQEFDTS5Pcmc+iQBLBBARAgALBQI6yhqCBAsDAQIACgkQ3bpkuiwxLS/t +3ACcCjcL+TpZYClEaxwdFM4SFgha8TAAn2qAC65Jedqiwrhy3MTDaUII0pdKiQCV +AwUQO+FR6ZrNPMCpn3XdAQHnUwQAkYJGSM95uGyAu2M4ndw4oIm61olaZE4LlGnJ +Pl3rmf51A9VxLGSCGWDuZ8BBvPiwu2A+sf9j+FY4f3r9/lNf+wGb1dnnv0uo2D59 +CbUGkPsGmV0YRet9AAwy0RXXWL1QZ7f3AH6R6JVymMNupE0z+qupNjlBP+k93Xx5 +M+krQM+5Ag0ENikgnBAIAPZCV7cIfwgXcqK61qlC8wXo+VMROU+28W65Szgg2gGn +VqMU6Y9AVfPQB8bLQ6mUrfdMZIZJ+AyDvWXpF9Sh01D49Vlf3HZSTz09jdvOmeFX +klnN/biudE/F/Ha8g8VHMGHOfMlm/xX5u/2RXscBqtNbno2gpXI61Brwv0YAWCvl +9Ij9WE5J280gtJ3kkQc2azNsOA1FHQ98iLMcfFstjvbzySPAQ/ClWxiNjrtVjLhd +ONM0/XwXV0OjHRhs3jMhLLUq/zzhsSlAGBGNfISnCnLWhsQDGcgHKXrKlQzZlp+r +0ApQmwJG0wg9ZqRdQZ+cfL2JSyIZJrqrol7DVekyCzsAAgIH/As5pFqpFu0udUuY +2p4I+ck+xrOOv949yjVrx5PiCIHhPyyUNJO2P4DJULgIzAFnpKZnuXY35UXmsHN9 +85MnHzvk9nk0b0HylxomBFrrw7xUHwZgD0qXCbDp6gDyDa+SY2zmBho8V/dTK7nq +tuUEfqzUY7rCb+26p2pRvdetHmCXR5/yQ5cWvNw8AyGCbx+7C8ta2y6arWz24ZP3 +2MvenLXrpGeAiuZRKqWnCALksSxNUT0NMqmTghkL29Qcw2F5br/MTz4KnE0znvt9 +q3zLK+upIxoqTsKaqK2yiSuI/lMbl1NPH+/Bw2Er1VBcCNB14/2cqit421pMiCm2 +0dChqOKJAD8DBRg2KSCc3bpkuiwxLS8RAt8CAKDSmRCvou1moFG3fWUxweRlndgL +XgCg6ajZ164aAHwQStdF9x+Jn96GQTg= +=e95K +-----END PGP PUBLIC KEY BLOCK----- + +pub 1024D/08C975E5 1999-04-14 Jim Jagielski +sig 08C975E5 1999-04-14 Jim Jagielski +uid Jim Jagielski +sig 08C975E5 2001-04-03 Jim Jagielski +uid Jim Jagielski +sig 3 08C975E5 2002-11-11 Jim Jagielski +sub 2048g/4CCDB430 1999-04-14 +sig 08C975E5 1999-04-14 Jim Jagielski + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.2.1 (Darwin) + +mQGiBDcUl9QRBADl5tF8kOD0uddlnl9qsaG70/hwujGTsSXATnqoLseTsWORoVXf +oBklokEAGmT2+Cl8XIXZ31Wh+GaJ3CTbEv8Ok1vapOt+ltPgOKzZEB4uP25EbhC2 +LWf+lUoafcd2Xi0KBV4fqXqEEuDGP1TAdZ6k7NVqgpjvbJ5TdqL0LrWOOwCg/0b4 ++/p/avQr+uZRU2rdmYu/b/0D/2LnjcEqUjsslh2e9m0OgAu+gnYAmQH6Dbnp+iKl +jffWPChwIMFZd/7FnGOzYDzoqnzTFyA4VE5PHWL61V2lpHJWB21K9D6rbEcx0iYB +AHHxZQEmxSBU6PmGnbF+2P7vC0Jz9gZ5dCbjtGboYxd00/XQlZwCs8jHueTpSfx9 +n7dYBACFpW+v2pSlG0ReiS6Ult3gaGWiw81D0nFVvCp5BlxgQDymyF1MS6FbCj/g +FGILosMhlsIHTFaC0DD0LSXyN1rm0ykPvi+vULIlKNJwW7fCi+33j1Azx+zfMNeO +T5vqAfF6cvsZ6qPb9CcYvU4jEKvkovA1U3jMFehqcGkTV5sfvbQeSmltIEphZ2ll +bHNraSA8amltQGFwYWNoZS5vcmc+iE4EEBECAA4ECwMCAQIZAQUCNxSX1QAKCRCL +OmAfCMl15UklAKDq2PsXa7PbJPtGlXblJjD1OZgjTwCgkCz0EAdWS4Fuhi0mmSm7 +h1gtH/W0H0ppbSBKYWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT6ISwQQEQIACwUC +OsodagQLAwIBAAoJEIs6YB8IyXXlajkAoL2wNKsEorxLhZQAPRNa8kcv5uaCAKCc +KvWB5TIgPvXc9KIyu7YwfYiLg7QeSmltIEphZ2llbHNraSA8amltQGppbWphZy5j +b20+iFwEExECABwFAj3P+LMCGwMECwcDAgMVAgMDFgIBAh4BAheAAAoJEIs6YB8I +yXXlb3AAoOOU1s/F8PJAxYQwAQmlKxYUnZHdAJ9uIWY2w2UUMpTw45tkJ3xplawX +Y7kCDQQ3FJfVEAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bxbrlLOCDaAadWoxTp +j0BV89AHxstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJPPT2N286Z4VeSWc39 +uK50T8X8dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrUGvC/RgBYK+X0iP1Y +TknbzSC0neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVbGI2Ou1WMuF040zT9 +fBdXQ6MdGGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcpesqVDNmWn6vQClCb +AkbTCD1mpF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAggAhIc3ERhHN8t/+GDWhvPR +ZrSEaRVOc6GmccQ65lIktR3YahcpL/KM2k8o3yJgroavIugxteaBrncT5muxMrAn +AP6pkBAVa1xStg2ExVt1Jz8qohPNtqZaNHeObtXLCsz7xqR2FRguBzhCgoIUcv+e +Jx9H7Cld1UpSFwIURtyyLLcwLbJa0mBC1tS6L+dxivmGaUQyU2ywMYyGAfJBGIYk +GMx5v3GwXkaYxvQaaAUIeeHTTo9tglPBwuCr2Upw3CwM5g8q0BVxX337ybUO/hx9 +oiFijBTo6UR4dmSuroSW9N2KP7/mnZirNR0hBXVeVSVApKspoSk9Dolp15jR6kFH +5YhGBBgRAgAGBQI3FJfVAAoJEIs6YB8IyXXlME4AniogMeV3YLNf6C1Y2+k8F3rt +0S/OAKDHF+wfxLDzCxsoQbwesIUAKgb7Hg== +=5VyJ +-----END PGP PUBLIC KEY BLOCK----- + +Type Bits/KeyID Date User ID +pub 2048/DD919C31 1996/12/24 sameer@c2.net + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 2.6.3ia + +mQENAzK/QZIAAAEIALrsEjuGlt6wkHy8fx2wPSkH7paAqJHDCbO1W/GMVs41BsH1 +xpyBi9lOtUXHsDC8Obx/TES4/xVPSsFKPQLa9Q/OsxjXmEPBvQ5PZdOXJ5zmRMI1 +1cfUp2s8w6i+IS68IWRKdPMshGWFGar1YUPM1UpVME7U+uGD3wgdC4DrVJHzS5Eh +gEDyQ9FPb+8CpsRO3AvUPzsZGG8Iy/9GiLzmaJG34zZ5fv5X7sr89xiWJ21ehk+X +ePO9kvq+nzfOCCK6a3GZD4g3KJX/Pm3oKeaXeL8WSCCPzpNbtRJk3ofeN7Zm1K0L +yChPiyui+OO063/WASv52bxUIlmzbX82a92RnDEABRG0DXNhbWVlckBjMi5uZXSJ +ARUDBRAyv0GTbX82a92RnDEBAfqVB/9GSzADIVqY0faFOLN6+E3qqg3hPRLBvjgC +5cvTlwT7W64zI+aiSZuN+xAXq+3lnKtmzn45F3hD7gBxRPJbSKsObn2zU4UcqW/o +qoiYEnO9EhoBomwPUbVy8C00CWvDLfeF4L5r+2oXgilTsCojSaWJX0QoPCwRQao1 +YwZ6CqAA78vdbBNkmA0WrPsVqwd3ijgFapcX671AqiT+pDbvK646I6uGPXJzN3ZU +vFuDim9D2uNk9CfvPhKGscr4qqP40TnNn5fjSsmrFyFxYsdwo7I4TFpnsEPOw226 +GU+TR7zdwnByP72AxPEBJ/F22LwNyreuph+fRpWCnCf+9gVW9Heh +=jS5Z +-----END PGP PUBLIC KEY BLOCK----- + + =========================== +Rob Hartill + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 2.6.2 + +mQCNAzG6VfMAAAEEAOvtvphFG/D02vGLENBl5OVPgEJgP9E1xhUgKTZnJstv30kD +h1IqeIBkEAy5bpKapCbvvxukyQErhB0efTi2v5yTAlz5pVjgWM5Sa8CyTXJmXPHH +EuOfy1DqaiQSmZ6KWX0ygw3gKDZMiNMf06UURLLYtRlGKSYY3WVj2u2UCmS9AAUR +tB5Sb2JlcnQgSGFydGlsbCA8cm9iaEBpbWRiLmNvbT6JAJUDBRAx5eIAZWPa7ZQK +ZL0BAU2XBACXfopMzC8kW3KEqq+N9W9fkGNgy//8XqQ77FmfPQPbO4X7Zn3cyO46 +MxvPP+92zSyN3dyj/xWZYoRLwll+ync9d4KUFwKw45DALAvz1CKHMOpQPD7dIWdE +9poJQrcbKeOqLcGZTu/hY90gWBUZ++9umR8X8lyh/WEgcUolfgYHew== +=upYh +-----END PGP PUBLIC KEY BLOCK----- + +Type Bits/KeyID Date User ID +pub 1024/631B5749 1996/06/21 Randy Terbush + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 2.6.3 + +mQCNAzHLBS8AAAEEANGFXb9o0NPVfVjSLvQh1j3fN6cMeVNA5BGUJ6HZGP/NDxTE +i8hwejJqakkU4ux/g6Kqckrx3h8WR7OXZZ+R8CsA0bg9Sr42ndEQCUISgArg+lXZ +gRUniARPPA7tamTSq8v1mnxqy9s26Ht2rAG2D6IiK/7v0JlezKirDeBjG1dJAAUR +tCFSYW5keSBUZXJidXNoIDxyYW5keUB6eXp6eXZhLmNvbT6JAJUDBRAxywUwqKsN +4GMbV0kBAegnA/sH63WyfwMFmn3nWe8T/5IXO/QkMYoMGLS1i7IxMY9O8BVvKQM+ +oxEcJdFAG7zPZkpgKzTBxmExz5hMZ9hwJ42XhrslWoP7JVvADJcdthrUAYW9W+jx +GcDYAW3qW5DpKsQchfvXq9QOBDxP+Kbbe2B8xGEyGUhLkacISFTrIhhQSg== +=8P8s +-----END PGP PUBLIC KEY BLOCK----- + +Type bits keyID Date User ID +RSA 1024 0x49A563D9 1997/02/24 Mark Cox + Mark Cox + Mark Cox + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: PGP 6.5.8 + +mQCNAzMRY/IAAAEEAOloTOU0f4w7FDRMM6kA/6XazXxJ/HH8dsmb6E7RuYfVlXsd +kCwxUBOkyW+AYhkHbYUwnB5qBoFUyLrbLGuwKHW1KnAwgbeZLTH5nqQLpA0RLGVZ +v3tzImKUdyyxBphZWC4IeEgUbl9cc+piOsEJ8QzF7gnqwWo/Ku6tTP1JpWPZAAUR +tBdNYXJrIENveCA8bWFya0Bhd2UuY29tPokAlQMFEDQvYTHurUz9SaVj2QEB/hMD +/ix6pAa+4ZgFQNRAc7fC+I4uGWvXoI8N8wtgiJi//8Kc1vjtvTylLPKVBDsy1ihs +bVOjD3NUEkH95TNI3QhVeCwJPl2e3GgFl253hj8Jai9snHj75pXjQXq0NxQ/JRSr +EAqrFM7+yRLPs7zDwsMoc2Ox5emq4joVa3syZUEwW7LxiQEVAwUQNLELtdZUWxzP +wQD1AQFWIQf/RtyM8Rw01RdQXH5fA2jLaQlwD/VG1dlxqAcLKVQIKR77iBPdfcrW +LyexGgQmltuVTGs5U1XPf7dff21NP79aglvD9hll82L5wZQybNpy2o6/66EPp4OW +F1/WG7JhuCRfy53H983ERZnqGD4YeBafLHI9oGAixZ9G/+cFsxPde3Lv7Ij/1Hwp +eNAHJQibBkpdq29Kye/+PHgE0HTMSapYXN/YVTCpEFzE46YnD/BjzZ/E1UClvcsW +ZVoqPR46HARVQNu+MfoR/WSBAOj65Dt5oBZTcLoQ7TyDcd4gvLhdzLUo+kboGTjt +HLvesaAWKLSWtKY6G8Iy7R5+Ms0helLFaIkARgQQEQIABgUCOG/pBQAKCRAXWVXO +Q77mqABMAKCgO+LVARom7t/XmRw4w4TO9IkM9gCgh2URPU7tqECsr+WuVfC/v/7e +vVWJAD8DBRA02GubUX4eqU/cq8ERAgUbAKCO913wXBCqiBfQBT5F6koRZRRvbQCf +fJ+Y14jFEx+cfCdDIUjjD0l4/diJAEYEEBECAAYFAjvQk5wACgkQVZbdDOm/ZT0n +TQCfdqn38SRRYeIG3+LIPqBdODr39JwAmgOH2/N2hjA2Z/4QMOjrQ4gIgpAPiQBG +BBARAgAGBQI7zAqEAAoJEKFQ/C2FqPeL7C8AnRr7d0vN+E1W218XjItFonLw42qT +AJ4xUrPsSduizUQnOuzdR8x2x4yEyIkARgQQEQIABgUCOjcVtAAKCRDe3YS5RDds +3Dz/AJ9UaB2vKuteTC+gm80f028DPbmCegCg3ZM1Rt2WMDS/wHW7nQJ/xnyg8PuJ +AD8DBRA6ynJX/W+IxiHQpxsRAjd/AKCSXqSmTnrzlnpgYwMESQiKQxfOywCeNuUy +0q65a+C/ayC7t6F6ih9+bcW0GU1hcmsgQ294IDxtamNAYXBhY2hlLm9yZz6JAJUD +BRA54aHP7q1M/UmlY9kBASf1BACwKxBv5osTZpJIiKsdim/P2LHOtU91Ne8kxTdr +78Q86cHSz8V0ExA/FWKkOPgEHAIncXItNH0t3pGtUbAcYuT830Y7OJgLZdEWszQc +bsp72nlK0ceZ6SFRE/ouDlcnyaiou28l4JGlttqi08yO6LcX3sQD8wDaQhoUoCe9 +wg/eaokAlQMFEDrLUyUbCAxFJxmvNQEB3XgD/2M9X5cgqjItm4vH9CjkAEOvfYh0 +KjDTy9/WA0mVDcXvV9RZGMMnWmSKg1yDZp4A8lWEQkk6VxZEMwW1PTtsFlOAyEQT +2QiRQtS6tFTj8X9aZ6a0PeYF5PyS20hvJzYXpbogkemBFtUDmsfXToSoO6Uz1E3q +eTYYIMB01pImXvdpiQBGBBARAgAGBQI70JOfAAoJEFWW3Qzpv2U9XQYAmwfOqWaT +wJFN0bz/9PLlxJRO0J+ZAKCHUML3L2N1yqR0CXTO2C40fDjsMokAPwMFEDrKcnL9 +b4jGIdCnGxECMsMAoPGRixfMANAdwK0OwFjayMH0GV0PAJ4kP7UxlR3DkU/5wTOZ +dGL/zRRHJrQZTWFyayBDb3ggPG1qY0ByZWRoYXQuY29tPokAlQMFEDnhofnurUz9 +SaVj2QEBJxcD/017e1bFJGNcISL2dIvINhnXnzHxL6B66exG+8+1pFkR8e/EvgEv +XHMs2+AqDfUxkb1PNSoq/u/m/VpJGEWoObuSkiwiqUYrmXcJGElUQyHMLDKSLQQh +G4PkeSp0T2yX+Fk+5F3vIOdK53jsD21zXqB5QD7TjCLSGkU+BiLuLGX6iQBGBBAR +AgAGBQI70JOfAAoJEFWW3Qzpv2U9p6kAn3lo65wMqy/XbG+RgeJlrQQk0v5tAJ9e +zLVU5oVtfnH6JvAZFvi8sudRhokARgQQEQIABgUCO8wKigAKCRChUPwthaj3i4gq +AKC67ZkCrpAZWQKPJdwTw6zn6GsyVwCfQyoy5lGIuGBu0je6You3NEakk36JAD8D +BRA6ynJ4/W+IxiHQpxsRAsw3AKCqcCFo5uzU7XEom82HnvX7kSPDtACeIqOnzHMb +ArpmDAcknLxcmsjp2J4= +=WGLR +-----END PGP PUBLIC KEY BLOCK----- + +Type Bits/KeyID Date User ID +pub 1024/2F90A69D 1997/02/24 Paul Sutton + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 2.6.3ia + +mQCNAzMRsB0AAAEEAKj2XYYEGcZhT69x4gskQ3xz+KMTLn7gKSqqcyyeinJ0ZjLl +6AJjb1/68nGsF+IIY+IJS+5smq8do1qpC3UZcmw423Sg8F71GeqDO4HZXOAOieVy +rpVs6S5TaXlJOcrC7zZCx+iql97+xJFjUGkkS7j/jIkx1AajzMNkSr0vkKadAAUR +tBxQYXVsIFN1dHRvbiA8cGF1bEB1a3dlYi5jb20+iQCVAwUQMxGwHcNkSr0vkKad +AQGrigP9F43zbiOigYel+JCMiB0HK/UdqSrf3xWxHIKWKNhQNjhnyeF+jKQwFld6 +7KQYsqZIpHsWLWmSk0AmKQOUIw+DxclDxBL2dT4p+CjgTgIAcbvPpahWkBAw/E+c +EGTiYbe+Y3sHJhhP+d0TOLmsETG9tpi7gFZ6FfNcWPxFMdxGrf4= +=0jQW +-----END PGP PUBLIC KEY BLOCK----- + +Type bits/keyID Date User ID +pub 1024/BA20321D 1997/06/05 Chuck Murcko + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 2.6.2 + +mQCNAzOW7moAAAEEAMYZlNOxWCjLR/PosadbG+xsrB2unid2LiYoakTFiDIBaZjx +bu6hNmVZPYfKOXQcqrCu0EY3uVLP/L89bST5pfIZOzz8GTm33zrETgfzpXYyFdbX +eZ5vc6aa3+7zmI7h/aU567P9ruB2C/RBLl1A59wmPRRVvjEIAkI4bAO6IDIdAAUR +tCBDaHVjayBNdXJja28gPGNodWNrQHRvcHNhaWwub3JnPg== +=vUdL +-----END PGP PUBLIC KEY BLOCK----- + +Type Bits/KeyID Date User ID +pub 1024/26BB437D 1997/04/28 Ralf S. Engelschall + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 2.6.3ia + +mQCNAzNko/QAAAEEANZ2kpN/oMkz4tqzxvKPZws/XwsD0Y+E5/y7P2DIw4uHS/4N +syQbgkdrZhPBlXDv68DQioHXWsb904qyr7iZB1LC5ItK9MgqlK+Z2mvPqsGbHM8J ++oYib8kf2zJ6HvrYrP7NYB0tN9YYum2ICtx+hIi6aKGXdB1ATA5erwYmu0N9AAUR +tClSYWxmIFMuIEVuZ2Vsc2NoYWxsIDxyc2VAZW5nZWxzY2hhbGwuY29tPokAlQMF +EDNko/QOXq8GJrtDfQEBKVoD/2K/+4pcwhxok+FkuLwC5Pnuh/1oeOYHiKYwx0Z3 +p09RLvDtNldr6VD+aL9JltxdPTARzZ8M50UqoF9jMr25GifheFYhilww41OVZA3e +cLXlLgda1+t0vWs3Eg/i2b0arQQDaIq7PeRdjdEDgwnG4xBaqaAqfgxwOXJ+LPWF +hiXZ +=K7lL +-----END PGP PUBLIC KEY BLOCK----- + +Type bits/keyID Date User ID +pub 1024/45B91DF1 1996/03/02 Doug MacEachern + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 2.6.2 + +mQCNAzE4lesAAAEEAKJYS1vL2iB3owwiZdCxp3JyvSNaC7h1p2jQXcJvY10gqyZm +VffDwFoSvJM1JdCx3o1mb3JpZ2OTV4SrDDkzcSpTXelgyh7k9O3HB7oG6pHTML9g +Dq9ZKydShMIvIJos7KuLWoM/eeeejtkv7r/gWsGHAyKbT8fs3r7nlmxFuR3xAAUX +tB9Eb3VnIE1hY0VhY2hlcm4gPGRvdWdtQG9zZi5vcmc+ +=yaR9 +-----END PGP PUBLIC KEY BLOCK----- + +Type Bits/KeyID Date User ID +pub 1023/163751F5 1997/08/18 Dean Gaudet + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 2.6.3a + +mQCNAzP30QgAAAED/1k8hPKsJj8Il/TfhP1JIRGwnXuzfQ/etv+MZJMzeNeKa8OX +Kw0d4e1S/KdJ+AZwWQp3ZMDoX2ghZ79X4DDDLEAc/Fmy0Gg8t89CP+xJk7b4EHjk +F7HX69BRJp3On4aRTXRND3WviqEmn5ppzbBkTenF9WWudLRbqrc4NnoWN1H1AAUR +tCBEZWFuIEdhdWRldCA8ZGdhdWRldEBhcmN0aWMub3JnPokAlQMFEDP30Qm3ODZ6 +FjdR9QEB9VQD/0+zumFj1zzYZ1+bS9Az36gijDUb8rlEVf/lBShx4VEvha8fsRRy +vkwnmJyupYvGtrSIYAwB0VK+GZPZa7XfZvUCM83AZY9vGpE0LwW2Vcz9kWZdJ0t+ +B7zJElmBUrmj9aW6ICmSNbOBwVo1Y7hg6lPSFFMOOECFpT1WuTXXYpNA +=KWcF +-----END PGP PUBLIC KEY BLOCK----- + + +pub 1024R/EE65E321 1998-10-22 Martin Kraemer +sig BB1D9F6D 1998-11-09 ct magazine CERTIFICATE +sig E2449019 1998-10-22 Martin Kraemer +sig EE65E321 1998-10-22 Martin Kraemer +sig 43BEE6A8 2000-01-03 Michael Cook +sig 49A563D9 2001-04-04 Mark Cox +sig F88341D9 2001-11-18 Lars Eilebrecht +sig 4F09F055 2003-04-21 Daniel Schemmel +sig 3 CC78C893 2003-11-18 Rich Bowen +sig D20BA2ED 2001-06-03 ruf at tik +sig 2 F43C2F92 2002-11-25 Bruno Lustosa +rev 30B94B5C 2002-12-28 imacat (¨Ìº¿¿ß) +sig 3 3BAA3AE0 2003-11-18 Rasmus Lerdorf +sig 2 4C9165B6 2003-11-18 Aaron Mulder +sig 3 88C3A5A5 2003-11-18 Philippe M. Chiasson (http://perl.apache.org/) +sig 84F9264F 2003-04-21 Harno +sig 3 30B94B5C 2002-10-09 imacat (¨Ìº¿¿ß) +sig 3 A54DA2DF 2003-11-18 Erin Mulder +sig 2 A1D69759 2003-11-24 Michael Kellen +sig 152924AF 2003-11-22 Sander Temme +sig 964F31D9 2003-11-22 [User-ID nicht gefunden] +sig 3 76D83CC6 2003-11-22 Manoj Kasichainula +sig 3 CE19D5C6 2003-11-18 Jamie Wallingford (legobuff) +sig 3 F5FC4B42 2003-11-21 Theodore W. Leung +sig FD093C41 2003-11-23 James M. Turner +sig 3 A11D56FB 2003-11-25 Geoffrey Young (http://www.modperlcookbook.org/~geoff/) +sig 2 65FDCDEE 2003-11-23 James Howison +sig 40581837 2003-11-27 Nick Kew +sig 3 D147B776 2003-11-28 Mitch Comstock (RAID) +sig 3 142B509B 2003-11-28 Glenn L. Nielsen +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.2.3 (FreeBSD) + +mQCNAzYvawcAAAEEAO/lLOQVYsUS+l7yan+Rzr0ehfWRqlgeNsV4DQ0xTuQewD9K +5lm7ujRwutxlNaf5dXjE24mlsiRN8KDp+fKwm7Wtqv490xmhzS/6y8ekwB02P4fi +/JJNX1PbLS0cL6+bz2dFqLDhh03Ovz3G16Y9he5mrJ2PNOWa9Dfj9F/uZeMhAAUR +tCJNYXJ0aW4gS3JhZW1lciA8bWFydGluQGFwYWNoZS5vcmc+iQCVAwUQNkcAbUS4 +3da7HZ9tAQFUnAP+PrKa3YFKp9XTrANmORex4kOyNpM1adS8zM6bTcHyIkH4WitB +b2nRbqOdOuSwbh655aSStluIxY66CValeL+6E7MCEqQ/UlzzMVmdbMyWSYwDlkV3 +gQkg3vE6bgFlWlLLr2HnkllY3ISEChDWh8x7fRKLy+8ZBGW89ZXOGkhIb9mJAJUD +BRA2L2ueKwLDReJEkBkBAbeGBACKM1FCmQC583/IHyw7rDlvnsZKeKvdbbLGSnmJ +NWOyf4VgkC8OCKmwPnWLOOIK44/JsT2Yonih2r+04FBqYo6SsMgBqOBJqKktHvtx +bD3VfUUkkV8kZ4ituecWTx0zj1Oa0QiCiv8HHvdsmQB0mj07mWQz1CamXPSwHYn+ +t+fJOIkAlQMFEDYva2c34/Rf7mXjIQEBcNQEAOrt4+o2LwcCiJp3bOF9WZMirpMQ +QJISqXBnom3r2eB+k1a/Jig1sePSzPxneW9EgWIrWg0EfK+u2kMgvTJynDUux9zL +4qnECmZT+ESEm+P8rPKeecOfUHgDjQlTUCneOX5p0TbdvJm+TcJVjXjoVrYv6hZg +InYw+jlvF5e/sdI8iEYEEBECAAYFAjhv6QUACgkQF1lVzkO+5qgJ7wCglwijjcMK +mq7F50Yc1+rpktcbYqgAnivId+oJ9iwi/18y6Y6t5zxk53i8iQCVAwUQOsp2y+6t +TP1JpWPZAQH6sAQA1jbAPT5GEWyV7gKNeAmWOBo5JA8+ETmtvDAIGg37wsNhNBQG +kCP+pN9CuzREKCSOLgZ5KXYpLWsYLJz1X7ZztR2kFmBGPHspYBdJsrzmvydyODHC +ZgN9Bh0/vmWWKPY3047pkZOIiQ5ldSqaXtmYMzzSVe2vC6VqKQUkZUCNQJ2JAJID +BRA79yw8Po+38viDQdkBAVwVA+IDjCUtGZoWG2GUN7OoaABSZWqtQfetBL58G71h +Umv6IhTq1IBm3FDTosZeh6IN+vcSlVvq67F+y9gRDWdsu5Sl2J9n9ZUDUymysQFQ +++B65oZaJpS8pD09aWAt7CkvthkYD7UXpzQau7fq59XRxZiN+bDAHtSBf4TMi+On +B4hGBBARAgAGBQI+pFcNAAoJEDGGzQRPCfBVmHMAoO48YN2ZQBVtGaKnYQZpqeka +zsHvAKCumrigMBBhhUiZq5XLLohV9GU2bIhGBBMRAgAGBQI/uphrAAoJEFz9N/rM +eMiTc/0AoIN7/2mNfxYll+7LYDVlWG/zWENzAJ9O5SzBY/v7nHJ6tuD+VETweIir +BokAlQMFEDsaVtNoOT9M0gui7QEBGvAD/jHgMCvKihnRNm3k2+nDUTHFn6blxG6k +jRtL1DJGQD5cATbhxMx9ioQtD1q87KCj54pcGQ8HbTL8frQbyPX6yFjpSPILIPCX +WF6NVHZ9GCi3SOo39HNFxCQZUpVof49gmGOgL/qwfu7mi/sBEJP7c3FeyFnvewYE +2a9SBhZUWdb2iEYEEhECAAYFAj3iUNoACgkQiNfNvfQ8L5L+qwCfdgPwwfKJxDGH +7S+8llIfUtQAsRMAoI4J55ch47lhayilgtr/MzqoS8k/iEkEMBECAAkFAj4NNagC +HQAACgkQi9gubzC5S1yB4QCggBPo0gnQXYxXXovq++XB06XkyE8AnAr8Z8v89p/x +Z5f8Jhv3+arjeJQtiEYEExECAAYFAj+6g54ACgkQlxayKTuqOuDBXgCdE6UopS7i +xaU0PlutyqcEE6HLlaMAn3tjDl+8GTNjFa3i/yI9VGssa2L+iEYEEhECAAYFAj+5 +3/cACgkQuSRSrEyRZbaJrwCeOVTRdXKeHI8NZGbEKIpBSD2942IAn2jD5cP1e6iZ +QBp/KcxFSs1BPGzLiEYEExECAAYFAj+5wvYACgkQyzKhB4jDpaX2cQCfSx4yFkoJ +vJEmA6faBkggxB8cRLkAn0t1PJ2ujChDobTDZyQTGbHaH6RRiQIVAwUQPqRYgc1j +0d2E+SZPAQJy5BAAiC9vzladIopS40igR8djtOq7qc0h9JqTXN1NXl6sbLPyh8VG +Ty6CLRTcqw3dvKoj7WSW1ICGOAw1N6UE8g6ErpEcJ7UhZ6JWYcHDAcS7rWNYnPqE +g4Vz2yprdzJYo38ACD3o81O7ko+KvwFsT+PYquZsc2OsjWH9GNwBGiSugyEJA3nk +N9S7YMmJ5LriOofMze1fl8wnaoCx55RliOIYe7T5l65hokvQ7u2AT/z/Wca/qSuI +iz7bNznLyyUT15OILl/WgXtDyhh1dL0C3K0dDxkbCmUB1DoT5Qp03w7fleT8diOh +Squk9181iUKI85teeGkIMzPff8Th7liyxFFiFse8Q+xbtvN+3/jtnK59ArCpc6uS +xWBdwoE66Unf63mmiGvEbkgoZ+aAsxm5LkP3v7VHHUJOtESfijLq3QSv2vrobxDH +ejLgtMU9MQbPLV8s2mcRWeLrMJuFNRRNSEfJLEhG7FtvX8RzEz5kkgaHgSdyJ6Ht +DHo5MNIl9WkY/oFrh+jo+8j8eh1i81pZyAxPd+FRsDiyGTBtNJLQoARJV+YAY3D0 +Xa5Gmd4p2X2M47koDgHeA5HOpmfB0wuQOYDNnILdhIuHVB1GRcicJGMVx7DOXVJa +5hoTbHoIz0XlpLsafMIQym/K3x6sP3MybzefD83MaJ+Ilat+T3FxctedvHmIRgQT +EQIABgUCPaREVQAKCRCL2C5vMLlLXNEgAJ4iYCTPB23/Flm7qNroUl6GVX28CQCf +RrordYeSP+K7QSxk4IL8PAEbSJOIRgQTEQIABgUCP7mlEwAKCRAQ+kyIpU2i37G6 +AJ4n3x4exHlJaJ0b0aplo7IhezqhzACgmZyzlypniz1CgWFKayMzNdYv5uGIRgQS +EQIABgUCP8FT2wAKCRDMITAgodaXWVUxAJ91OzkZlLqXZRx40R7Gw5AxUq0fAACf +ZUrGzdZMoFh4VLmXs9UwjPIkqQ+IRgQQEQIABgUCP7+tkwAKCRCyvrxAFSkkr6ju +AKDwXK9W+Khm1OACepHiwBjqhs0g0gCfVZCH8N3c9BWUNzvdWl1SY/5v7iuIRgQQ +EQIABgUCP7+twQAKCRDBHntHlk8x2Z+aAJ9+DwDEdvuehFeJsocl75danlHX9wCf +SmZLWzDCnXESPG+Nt0zKlOB8VQeJARwEEwECAAYFAj+/yA8ACgkQBurPqnbYPMbk +bgf/bwdAlRX30Ys7o8Yw0KjnyurkboF5jgGveYQ6ycT7cqOnrT6/68QvNtx9v1Vl +AqXGbo+vW3N0vPKmyoOk+vVDTjnzOcF56i9fzkRg4kUT0NuDdYS12Ducg7V2bHoB +oDYErKCPhAMpHlIXH82Y2KjtlJ42QXbjM2PHhp4jRVrVaGEDzpKMJ4J8vy9RsQP6 +VhIBlIkJfEQyAcRzrQPMXTL43q2nSej40OPfwPttPViF4AZcI0WjXSrSUl1TDei1 +2vxatJVQU+5pAnXqNptS5z0CRzew9FbmUtRASf4I6KbUFAEHoactAmSqO+nVQwya +t8B4F5cVdI61GbAIltn3dJeSY4hGBBMRAgAGBQI/uavWAAoJEKge5knOGdXGNJ0A +n1fgKsQjBZ9IInHEgxfXuBFBmWYuAKCwL4eokLlqwfoKISp9nb+Q0cVaWIhGBBMR +AgAGBQI/vdF+AAoJEL66K4f1/EtCFcIAoLso4QP/YJF3MvQb0UD0KgixM5IWAJ91 +gPVA+HGquzcbvBRsuWSbXW/6xIhGBBARAgAGBQI/wSPnAAoJEBoJ0YP9CTxBwBoA +oLQl8sQPadNHQxlEOE9VDvTHKd0OAKClJufnKrR+QqWdyLj3oWdaPNxlH4hGBBMR +AgAGBQI/wq8yAAoJEAlaRdyhHVb78VwAn3T3DlfLsALf1p2Fmb8M4AjSm4qrAKDI +/71tcIrH9SOXnaEUYdn/drhRcohGBBIRAgAGBQI/v/ykAAoJEOyZPWNl/c3u+yYA +n2DGGUr3635ok+rBGpKTNQShReckAJ9MZN+4nDJUbXdM+mF+yMEIxtKkEohGBBAR +AgAGBQI/xiDTAAoJEG0LxzpAWBg3tp8An1L06fIxRRms2VFp+jJmEcBz8xGaAKCK +ff6vbVmqxbVQGcAhd3kQGMOTjYhGBBMRAgAGBQI/x9hmAAoJEKR0DznRR7d26TAA +nRdPRJLDgffciI89IDzxI/OSOFJxAKCG3SDpdF3M2VpRJUdb088MsOk0BYhGBBMR +AgAGBQI/x2/kAAoJEPo8jSYUK1Cbb6AAnROPVUmurToM36vGQ6UBUzFtb00+AJwI +EGe6WyTrfx947xo6gB8GL5A0fpkAbQM0SmQyAAABAwDjeySbW44+mRRLLW0Eteh3 +fwT5cHW3MzBmkNDIt14374uQ6uPi3/G7YW/GFrvKcSG/upLZn81poLIVsMTTWM2m +P4qoB+9s5YGEhuHWKKMwuMo+Zzr9QXOcUOvXcv3lNNEABRG0Ik1hcnRpbiBLcmFl +bWVyIDxtYXJ0aW5AYXBhY2hlLm9yZz6JAHUDBRA2L2c/UOvXcv3lNNEBAYdFAwCS ++ei8zQhw/82vG2n7cpU3PoIMNW1Pg1ipJ3Y74hwmj8AWzK5X7BJ3VRS5Y4TOZeG4 +AVIaUwUBvrTz4fRqNbgC9oo6nF7wLKYnGNmUpAGZQscXRT9hkmFSqk6F5pUbI/aJ +AHUDBRA2L2b/NirXWI85Tj0BAYF6Av4zz/Q5QPvtiEzAJuPKObKSJp0EdA4Ga0JO +cr751xRNKlAqNwnGxY3MUTupLW3IDQ3CJk1bpxWJr7q9ufv5g/yZJqCTSvRNw3+J +ePJaWw9N/OGT1SmKvXBx9aApv0/ZXAuJAJUDBRA6n1qpKwLDReJEkBkBAc3wA/9Z +/ZnF0QkP71AeqPes3FXvYsUH3d8uIBSz+KJoQa/SvB573sW1C50i+JEWnVe8fAQs +wQQ+F8q/kJal+eqJvap6+ro3KRG1CGa28acuRzHchSmG6GJpUqOXrFfo4sbFCEXI +s2Wmwho7d7AtnrN8lsfqYmaz1Uc/yl+wHJUJUIubCw== +=Pz1L +-----END PGP PUBLIC KEY BLOCK----- +Type bits keyID Date User ID +RSA 768 0xFDE534D1 1997/10/19 Martin Kraemer +sig 0xFDE534D1 Martin Kraemer +sig 0xE2449019 Martin Kraemer +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 2.6.3ia + +mQBtAzRKZDIAAAEDAON7JJtbjj6ZFEstbQS16Hd/BPlwdbczMGaQ0Mi3Xjfvi5Dq +4+Lf8bthb8YWu8pxIb+6ktmfzWmgshWwxNNYzaY/iqgH72zlgYSG4dYoozC4yj5n +Ov1Bc5xQ69dy/eU00QAFEbQiTWFydGluIEtyYWVtZXIgPG1hcnRpbkBhcGFjaGUu +b3JnPokAlQMFEDqfWqkrAsNF4kSQGQEBzfAD/1n9mcXRCQ/vUB6o96zcVe9ixQfd +3y4gFLP4omhBr9K8HnvexbULnSL4kRadV7x8BCzBBD4Xyr+QlqX56om9qnr6ujcp +EbUIZrbxpy5HMdyFKYboYmlSo5esV+jixsUIRcizZabCGjt3sC2es3yWx+piZrPV +Rz/KX7AclQlQi5sLiQB1AwUQNi9nP1Dr13L95TTRAQGHRQMAkvnovM0IcP/Nrxtp ++3KVNz6CDDVtT4NYqSd2O+IcJo/AFsyuV+wSd1UUuWOEzmXhuAFSGlMFAb608+H0 +ajW4AvaKOpxe8CymJxjZlKQBmULHF0U/YZJhUqpOheaVGyP2iQB1AwUQNi9m/zYq +11iPOU49AQGBegL+M8/0OUD77YhMwCbjyjmykiadBHQOBmtCTnK++dcUTSpQKjcJ +xsWNzFE7qS1tyA0NwiZNW6cVia+6vbn7+YP8mSagk0r0TcN/iXjyWlsPTfzhk9Up +ir1wcfWgKb9P2VwL +=ZxgG +-----END PGP PUBLIC KEY BLOCK----- + + +Type Bits/KeyID Date User ID +pub 1024/EC140B81 1997/04/10 Dirk-Willem van Gulik + Dirk-Willem van Gulik + Dirk-Willem van Gulik + Dirk-Willem van Gulik + Dirk-Willem van Gulik + Dirk-Willem van Gulik + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 2.6.3i + +mQCNAzNNOsMAAAEEAJmwazRhNJB4mQkvp0rrxLkeOAxR9fGBXgJNa6HHdLv7YHwx +mwMorHYDCAMypO1yuznNTaMVT1z3cS+yqhOkTVxwNI1mxW6Zts1kOJB9pWuU33sk +sUuCkLHXMgyvP9cms6gcYgB5g3UP6M/aQ4T017+Gk/7crlH87DGmPZbsFAuBAAUR +tCxEaXJrLVdpbGxlbSB2YW4gR3VsaWsgPGRpcmt4QHdlYndlYXZpbmcub3JnPokA +lQMFEDRZ5+0xpj2W7BQLgQEB/KAD/1xniFNLHp+jxIVrEL6HcI06QZUYPvRuarWq +3aI2gdeXej59Ry96MOo2MU3MsuQ+wW+6gEJAuyCp2jyYfzF/8winNcFWc738s/hX +fRYCJe4bvtMcnhBV7GAlTgyw00fcrnaJaQ811+QwKnZvXXWb+QuoXC4ddTon25w4 +XHLjtDZHtCxEaXJrLVdpbGxlbSB2YW4gR3VsaWsgPERpcmsudmFuR3VsaWtAanJj +Lml0PokAlQMFEDNNOsMxpj2W7BQLgQEBzW8EAItAEaeuIzPIVlKOk1LnHlYc4FyW +aiNJC2+rRmftYu2bIp/JFuXu3xC0U0byyHu0p+Y1pcAnt2YrqmYUfM0d2cx1b4+L +8RQR4SGKhq9jWKS3icfKoyMnGiD2CeI8/Xx8V6b8Xg0QqsdlS0kz//qGCDWMz0vi +oxzasVEvFjqAse03tCtEaXJrLVdpbGxlbSB2YW4gR3VsaWsgPGRpcmt4QHdlYndl +YXZpbmcubmw+iQCVAwUQNFnn1DGmPZbsFAuBAQE0vAP/aOb/rXsE256tpi0+CRp6 +cd9b1oBmw894UK+Cf4DeNHWehPWJog4y0eNFUcAMdLIdubDzc6Kfxw5QyJt2EAXr +05XuJ2DJdG24S/aPzGq+6VzL7Nq7pylXuhrACTgeesaceEpUd/NeOCOyzNR7i8qM +zbGFtU7fH1ipfJjN6fXLo5K0JERpcmstV2lsbGVtIHZhbiBHdWxpayA8ZGlya3hA +ZGRzLm5sPokAlQMFEDRZ58Expj2W7BQLgQEBGRwD/jdUjCJXFcAbjx3Y2pWUkR7C +hwJTohM2TvhFp80Ffbhh1xT961XGuHL5l41fRAIg9FEHjQKNVfXeisLH68Qh73cF +5xuNE6c1x1VSqfDLl9fXZ6TA35qt0G599T67jmVai4F/LjHWDI1O6UvPRuZE3O7m +eRaCfbPLAJ1ztFujtS3btClEaXJrLVdpbGxlbSB2YW4gR3VsaWsgPGRpcmt4QGJp +Z2Zvb3QuY29tPokAlQMFEDRZ56Qxpj2W7BQLgQEBvOED/1LhhPP5OkeCCEMVnmyZ +jZexzv6XOH2I5qH0iuozsI987sSK+zfv8O0wEBwjUOQqBuzlvjKImYQ/oqR89egQ +AinPc4z1b3kgeGyqrmtea6ScmpKufcWUBbhH0qsXF41eU3ArKY4kB9znV+/PacCe +VrOD8roFaxIDZ2nW9FS0mriOtC5EaXJrLVdpbGxlbSB2YW4gR3VsaWsgPGRpcmt4 +QHRlY2hub2xvZ2lzdC5jb20+iQCVAwUQNFnnjTGmPZbsFAuBAQEaHwP/Q2Rs6MIu +z8all/xildFOPfRAX73InwBeInr1O4UU4l6yWRvuLkg+m6O8eJSHo21SNZBCu9gM +FoQsd0jVOitUr8+w2WkypBlJo5wl1nCw/1sLU4AxtBb0jyADvJzxFCeje/FkxEvs +6Y3eLxpJRBylbg6KFOsmSY46DyGc49B6cZo= +=xUw/ +-----END PGP PUBLIC KEY BLOCK----- + +Type Bits KeyID Created Expires Algorithm Use +sec+ 1024 0xF08E012A 1998-02-19 ---------- DSS Sign & Encrypt +sub 2048 0xD8F8125A 1998-02-19 ---------- Diffie-Hellman +uid Dean Gaudet +uid Dean Gaudet +uid Dean Gaudet + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: PGPfreeware 5.0i for non-commercial use + +mQGiBDTsCJkRBADJmDUiJL0xUaxg0yw7+VqqFUL6sjWxZeZ7kQZs4dyN3R1ilBUG +KmOXE6qSfb6Pi0qEmgCz1K7g1KaglMRrpANY4h1CjziEVmTH5s3ocxe77w2uaou1 +gHJERIqQuC4/z0DwFqq61ZVf5dUQTD8OmfOwG4pFs51Si9WS03ueVEFQFwCg/9Z2 +j6UzCLyUABpWeV1v4m0w82kEAK96GyKDcT20TymKJnMKuwya+ZwqrULH3Sdi2Mwi +1GOH7aomG2fK4D2yxWx5xTiYhmYNnRoopgu/Kv5a4x43tOKS3zeADMnHIw9dMSn9 +4Kba8vfKbZnlOgt9veV+iWZv7N2aS2z7w/i53Y6LAlV1hAIMvGJ3zLfmShZs0LDI +Ya18A/wNcdJazUk9mLGIoycCYOk5YhWL9sCaCBdmdfDPu++rLnqROSWkmfYkOTt+ +pG9SPnvv3XrX/SEwM8gYfpbZwrFDJFI9W63lc9hdSosFD+8xiRl6h2gKRwWvc1Ry +xIt3+gUrZxovNxBOv98BoSf/j3lkldU+ZjDGlCplRHSndxlN/bQgRGVhbiBHYXVk +ZXQgPGRnYXVkZXRAYXJjdGljLm9yZz6JAEsEEBECAAsFAjTsCJkECwMBAgAKCRB9 +bb/R8I4BKqqzAKDc/4H9iOXJxVE0yCEHeTQ2gAHfhgCg7VSq7eNhiJhBgblQav/R +XOhaHj20JkRlYW4gR2F1ZGV0IDxkZ2F1ZGV0LWRqZzIwQGFyY3RpYy5vcmc+iQBL +BBARAgALBQI07AjSBAsDAQIACgkQfW2/0fCOASoWOACfb+8OVvy6FCqN2MxdCqp6 +gffNbYgAoOxlTa4NjCUUO9dfLFFYpDfGrRy7tCBEZWFuIEdhdWRldCA8ZGdhdWRl +dEBhcGFjaGUub3JnPokASwQQEQIACwUCNOwI/gQLAwECAAoJEH1tv9HwjgEqiC8A +oJDu1HTuGOfChFSJJ31XvV8tnlo5AKCFceck4veIMP8pDC0f5UBGGC3mZLkCDQQ0 +7AiZEAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bxbrlLOCDaAadWoxTpj0BV89AH +xstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJPPT2N286Z4VeSWc39uK50T8X8 +dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrUGvC/RgBYK+X0iP1YTknbzSC0 +neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVbGI2Ou1WMuF040zT9fBdXQ6Md +GGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcpesqVDNmWn6vQClCbAkbTCD1m +pF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAggAhb3cBmR67H4+9Rj4FeTwJ8kflX6I +pp2AeXXZiffiPVBv5cGzGn2RkGPAZqbp2AkrCb4TrJH//1GPdR8VmPeEGsm6u0uT +0M404l/4IW1FFQ4JBpTENPn4NYBHkKBNkPcls/ip0lSjlmLGVQVOtDOaFD7n44xV +hT4WpptCripg/5kymDmK9c8hv6rPUvNoVrDdWR4//MCvNAZvGq2bZGdFTyd5Tn6D +AmwbvL/UwgiDnm95qBBfCZtmGkkFaoOePtBevWFaviFZM2pErPRcjY8A/1cZsycj +JPMFYqBKGDIk76ulDSjU0Q8dqhCEDf0o2oQEg6msjDtetVFEDw9yJe0AGIkAPwMF +GDTsCJl9bb/R8I4BKhECBKgAoNRtRaRMdYNwajSO7056eKazCGSDAKDShamaRjAe +ThQ1KefmJKyzfcosZQ== +=25Cv +-----END PGP PUBLIC KEY BLOCK----- + + +Type Bits/KeyID Date User ID +pub 999R/F88341D9 1994-11-08 Lars Eilebrecht +uid Lars Eilebrecht +uid Lars Eilebrecht +uid Lars Eilebrecht +uid Lars Eilebrecht +uid Lars Eilebrecht +uid Lars Eilebrecht + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.2.1 (GNU/Linux) + +mQCKAi6+wOsAAAED53PJgrIYS7iHbZn0ycrnzS03fwvwsDpoAVouoqqBSVNoVXH+ +lL+8HzX/fADvNyk1lYi5kTiYR2meKB1p0qpvj4bQ8ZEmcBemhV0FbESJ4CxIgy6V +euxOD3v9gauyf1u4lkfyLIsCepuJqpkH+aOviE9VhTcE/D6Pt/L4g0HZAAURtCRM +YXJzIEVpbGVicmVjaHQgPGxhcnNAaHlwZXJyZWFsLm9yZz6JAJUDBRA3pN73pBlG +R0SoBbUBAahrA/9/Pyd+R/2vz0is/Tuu6aniMYb5O09OWypVtJ+1QB0Hr2pTB7MR +Spb8ljpMTT+Mv+hE9RZm0lxwW6OgYbosrDCwpw39Tfs89UjFJMmCj+UyThmpt52k +g3MkcRD7C7J0w+RVV+EPs67vLya3wKRRXKa5i3I1RlznleiJwxxGAgaxOokAlAMF +EzeoM6P9LZCSqJB7JQEB9XYD9R+ZzFmtJuclCbKR7zZcB/5lqpbmuDRMStAaBIq7 +KZ019tbuyj8RGdc04UFBAVL31pwHl2hrBTsCw0ZsVudvRg1ufn9KwNQnmO4j9fbE +fYJ1gNDgTaf0zMZ5KdKAhNtw0Wx8tAntvqjcxM//h4lSMn8HWiYlRqNFSxRT0nGT +CxqJAJMDBRA3peHbT37mpPWwmrUBAXpIA+kBT2YJm3tep61cxMn64OlY+i/OOt05 +Of+fcJwPwD4q0hxXCeWMYSueDvavvJG4+42T1O8xLPCeR6cqe8PBtXlRbyY4b6cI +mFRuOsFlqEtpXNmJ9AY2KIU8bhZBuzckS6oXGxbM40PiXsIwREib3J5OY6G4YG23 +8LpTheINpKmJAJUDBRA3nOBupMNFzIvCD00BAXGEA/98Rkn6Ncn9BgFUJlLskcsw +Bn45IJhIJtLYIqyjSWZY9iGPU41txPPcqi2k2atn03ThUufQc4V1R6pnLZwijeoA +pd3AuXv7o0wRj/zi9lrhpQpE5L/9YzJ+uGkHTMjMBSks74IR87QVebdMxSvFYBPK +QbwAVohgOBdZyNYyiCn3SokBFQMFEDecWF2urbkCPI45bQEBc40IAJ7NUAL5a5Bh +qUDf60pLZlYonowEbAnnkT+0pnp70JD1w4+bi1dSa/iboU4Kedf9tqGnPlC6LhN+ +uPWSyJcZ4AxkyhBPoezUdpKDYxezLbSlnsWPpjSHo2iYani7uSDFjppTq5vmmkPW +lW2NuI9DvXtDS6UnHJa31CqvVl60vmuyQyceI75UK/Qe4kZRgfFQsLrCWpiw6fLu +KB9NWm5wVt09ZN4U3Zo7eSNVZfSSqzkPKgXR21yD79Qs66PxjM+SH6PrbD6UEtkW +llB42nzdiQ/8MGNCFLgnaYqUkLe58Y2oicWy7OxC+wWPxuvCW64TF8uGkDlF8ors +J5DTX6c57HqJAJUDBRA3ovk3JBRJVbhWhOUBAWmRA/92NqJsbkEExxDNrAeQB5Y0 +draruR6h4BTWreJtFH4WitgnqOvU8ylveGLMLiv/cZKRmZuDaBncoQ+mdCMOeZNB +qW0xGKS4nm+rTw7LlG0DjyO/fDTe8LXdQBxR5hDcm+ynfH/Q16x2Nov7DO9NBvkq +vvp/nj2KzGH8wrgsHFzOkIkBFQIFEzeOINlR6m16P5LTsQEBE2cH/00BLuWwe/bX +DqL9+qxsx+Ko53cuJj6ZLwc7UU/YKEW4/9q7EVG3slfbl4aPWWURH5XCpn0iDpKc +fEvgsbGe6yEoxpDQkj2fTnU9z1B7aitb2u/a1NMhdgNBOHvU0p9dVlaanqsGG0zV +KE2yxZOa5R7H27PESjK2vT0NxljuUV0zV65oQgb3zT8a1DNnpvbVcPskTSrPiecm +p8B3sH0OdG9mCAEfO2QDLcg9+XDOH7M1BvH/x6eo3ccj4TUAIx0GCz3LsEenAxkw +18Bgdu25jhBcjdgNj1yvEbD/+vc6iL3HkuPbDt2jtc25QVRNPYtMDPVOXCzRovAJ +WOEMaLb74hiJAJUCBRA3jiC/xEaR6Lw5pc0BAZshBACeTZNGRkwDJC4BKFan90qG +RCAxkzFCVxyFjetBqwkeFsWM4E1dKxPoObjR0lrsXt+IbxZ0xUQB6yquCyIWZvyl +v4y77ZxBfklHQwOZimA1rinxgOsZozdAJY5OztaScc5fKEDmMGlbc8Kn0UL7k3+p +FOF+XuMktL3ZUt9nyEbU0YkBFQMFEDeOS7Cec+sKTVjuUQEB4I0H/Aw3vqOo4y12 +XODHVnRiRcZ4fRunqF5KsqHdBuf3Bh8fH99iwlIV6rj7Rdod9OjE10ARCvoxiaYj +Ev+DF88+xam77IkDks0IGU3ou+c2RjPI9h189FWG8q5m04ZcHtvo3GnGvmgaD5wd +setAM/xg4279gktoUi/o/Xi6DpJ0mx0VBOuTVwnVEKoCUWJtWrOjVEF4teSrI8n4 +Mb+Y/Cche/iu8l3t9fnny90RfOg1r6jSJi7wy9XSgVangSCjWlrn/gbYmsH7wb2B +9BUfsiEu2HAZVAIGuOZeU0nqDl4Z91aMK8scVBKBHmeST7dYB6KqXyQaGmDDsxU2 +5ks5GBPChuOJARUDBRA3jOyQaxYS8X0sCakBAd2hCAChV00lh5v4uicK+hHrL6uz +FI0KgtehTYBLC21EW++q3g4UtVw5bg4ksGgM0cN3T2O3VJ+OIeYp2aW0DUTGVymF +SZ7Ezt+J+YTq1PeDVpqWI16z/qvyGCJwNLWU39QnX9gYPTfoB0bYTCqnp1CZ6l/n +E4skqiryJCyoy/icDBsErz8WkPS7R5mJlNtmO9T0WSh6w6AXQrsKKorl1p/dcyYM +Fr+ggJ7fq1xzufnUdRi+S8rWQbIqcgIKIrGrSaHqKkf4zIHn1QBJO5HomHmLT5pp +d6SUbXCnTFDk05uSmZHT4g4/wyqhxkWlGtyTMjDluboRUIFXR3Q1cvBMiZII0r4S +iQCVAwUQN4uW+cmGeh06atyFAQFuigP6AltjOGhRcEg5rc3wrSZqk6fpVucw9qhh +QKPv5aBTWtIJdIQy1mls00V4QjPW2PFGWpQJSl0ZXTLIgrr/rlBQRziJ8WFMmLhE +c/TH1ZUSfC3P2YMd9rWxIA6Nk4c7qDmR7bYE6cvndRCEws5NCmvpigY+30tVXBU5 +bK1zgVmR/E+JARUDBRM3ieTK4clqXikoFOUBAUjKB/9FstalvSqDeMHbcYdRiC5x +AyDA5fU6ZY1keaTSQY9qPCVfHji87wbJge2kmIxA+ldpQQQB7t3z7ktPV25o29dk +aZpRHllDfzGd7heJPBC0DXEIXu3XZRUG19Baxt2VZ8JA/v/bzL1o/i/sLTEvDk4q +OeB6LZrvRcK7COFYlSByZXmWcbZGV39qzykG+NxrfXqOwz4NZqebewj3e0cQ/cGv +csRnh2IsMMfWXDOfioUgLsYQzuVP9imGhRtYzkIf0vf5A+YRBBXLvrAmp3qpJqLm +D0pSYYGXxwbGEfLqXa2lbjDToRfDvyGfFtgen1AfgaUIKiqRVTRCvxf9ZuvQXiac +iQCSAwUQN4UudD6Pt/L4g0HZAQGagQPjBZRiXtA4UeXk+J1zYjYKf6dq//K9Fi7z +9U4obGoY0e0k1OcOGWEa5DWhl3vftOaiWejmU4gXveYcdVCly6fNoX1T8EAmu2Dt +/qFxyZ8RSWb+ncTqYGM1PFVWmvJBmDfz4zg88gNLnIfxzYravVCvBpaSRjhouBPY +BegjWUuIRgQQEQIABgUCOG/pBQAKCRAXWVXOQ77mqCkzAKCT40AAdAWiS+62IuYS +YdYpBzKs1wCgzFg2kH7H0vpchKnpk5W/0R2qcUGJAJUDBRA61hGfms08wKmfdd0B +AfifBADG9LL4HjrFMfyx2b5g/TqWOpB5eJa5WVvwTgPuYYgEFeD+xQ0AnsU+dpd5 ++jyPEdoV3+soL/sg4jbCo3YcHvWZmdo7h76Y6xQLMTFedDGR8IFfeT/X9Be07mb0 +xbVM+Wdy3N71Ua0Tg4nQWbTh5LokCO0lKwCNdu/rB6V9/qKJt4g/AwUQOtYol926 +ZLosMS0vEQIv1wCdGHwC5HayJ+XUosOG9t+qnkBFefcAoL6YCaOqC/YSrDW5jkbB +ZBB+oKxkiQCVAwUQPL2DzQ9HL1s0103BAQH6igQAiB9kefGNX8/a53jdLcgD9qUs +VFC1B8zQXPVPwqTv20LVx5TktTfISnupUGMrrh+xNHNN1ay3GkZ0EfbUBAthn0Cy +gWq06QXyCRyacl4sne+Y+1D51HvvVHCzanXzuaLj0MdCx6Vc2wdCaONFhzqRtUF4 +YZlGAZLEuLqmNqwVPQKIRgQQEQIABgUCPQM/OQAKCRCXFrIpO6o64MRiAJ41B8/Q +fCbyEIaIssIpaVEmI6If4ACdHBRZcOMhdBVPzBHUG+xOQTO1U/WIPwMFED0ZvGvb +0kX8s7KhLBEC/NUAnjRj0EuDSbYocYlv2DjVLIibIa8JAKC+N4o91dBh/9CuMPfa +z9vPKCDsyIhGBBMRAgAGBQI9Z7LJAAoJECxw4sZEMXOc0TAAmwUfeGq6mFWbi6fZ +OtmmEzQg1mcmAJ4sEqOsUBJg45taUqfsbfCSvaZPKYhGBBMRAgAGBQI9pETZAAoJ +EIvYLm8wuUtcjmoAnjW65Rh4NdDrhpwYrQ7MqTQBY5IAAJkBG8gWL9hJCyPGM8Wf +dBwTP4UrWYkAlQMFEz2a8A2z4b7txQbzsQEBV28D/32OJ7GOos9ei5fNp1Njmxrk +bozjcZK1pSrpTzQQ1BMNLHr+4YPMaTbXX+CqBBOEZKZaeDeAVT1v+EMEHm4o3Ubp +Bebeyzdwnu29fh5Iz0iOIn2J6YInAt1RxjYosiY9n9tR5l9jkB1QSk5fXWEth25z +PyYceq7GyiZXslcNiyvgiEYEEBECAAYFAj3YIQYACgkQXUFK4eAFycuG6ACfe0Jj +SFuU7UQYRzM7bMlcP1SBYtMAn2oFVZTyasM1HST2S8UpxP3n1StLiEYEExECAAYF +Aj3YF1AACgkQatVs/hkxGwC/jQCcDgaoS8X7hJH8hvwnwVEnPypGOW0AoNAkWdA6 +8HkLjfMjqJE6I10zx8qyiEYEExECAAYFAj3YEhQACgkQyXxQllwcOtd4NwCg0G3A +M7MqkjQNyI4d1VSQI4N0fu8AoLQA9Wwoz5uc1Gxpaf3w/gjuQQe6iEYEExECAAYF +Aj3YIHoACgkQ/A+FifiUvhJmigCfVHlN3xXMFNDb3Ff62nYfT8dPBlIAn1TFMV5+ +OM/WS/pS0EfBbfCLp62FiEYEEhECAAYFAj3YJrkACgkQNhUi14Kre9Ga+QCgzbbI +qTwpnIaFGJefGdtCtmYOaqgAn0jbjCRVi2hoed0UG2D+wiEafE6BiEYEExECAAYF +Aj3YIx8ACgkQZjW2wN6IXdPO2QCgrCq8WNdXJQBHKNy0xLmOfOIIRhAAn01YjYrh +v5UF8/HbW80LQJjFISvliQIVAwUQPdgj3CQOZvzFnDJwAQLxuQ/+MbaPOSJZ/cLX +V1m1opESzQ16OXeYdMrpTRpNaXVyOfhu/gwuhSp3M0l3K5RAb7jVhei9Yed+P7/U +8O14JC912YSfJxod6O0cg++GExyJliJMYXdnVfU/HJeBuXI9lgAhMx9xHopEmNxG +4d1ZJUQA3GP9n29go8RwQc30t3z2QTX6tQEk41MIZmWFMAWmLN3o9s7QmwnKMHFH +EVgD/QpC9W8t1aHtMFxsweJ+FdsAuyCejCcu0xxW04yN2VSQMM8nFYZpkV6bwl9j +9R3Uni4mDtML31xxJ+ciZPXb8ue2EnLnx1tSeORGyj/2qTyB2zInNxI0idyhX5cZ +ZYjbn/D35fuKVJO2PUzn0LKMExABkJ30M5pN1Q0iTVkYXLB2QqM/8MX3582bHg5I ++kj5rYlFixYlqI+V7PBv5Y+fkiiKWfPhqOniwtX1y5MTuOxYvdx1AtVZnE3BQYrL +7Sr5CMf9M0vvaAh3zjx9OYpUq/NklJhYLs/D0XJ45HEEfv4ZaVjVZHxsstgurows +H6My6cFTDf5gtBgRut/dXLjM7Ax1QRoqFuk9pW5+MrcZtgi/RdEl//MWF0b5vdo8 +38PbMO4EfRlZucmVE6u4tx3B4VSQl+Cf6ye5C2rey1zr548wGZYBWO5m7be8nwHw +ahzy8pFWR5o9REnzD/7La+qUuVM0jJSJAJUDBRA92CROMaY9luwUC4EBAWmfBACO +SpwHkNx3uKZeiQeIHur9MVfh+hUuS/Sr1MxjmnHbATqQ6svHkXZ3fm+RhJNChv9I +apMRsMfDXgW+11P0kwLWuGsaWSDdO8L7AlQjG4vAVZGa3RfbYFL/dWzzJMZhMMRZ +K4GABGFJt2b8go/RycyDW5TkPTDs/7oeulDfqvPCSohGBBARAgAGBQI92BsvAAoJ +ELK+vEAVKSSvj7wAoOTZLlnlRLmbiqy9O4oGdI4e7K4VAJsEXFoMtImL9VCPJ5xY +3Fr/O/FLVohGBBARAgAGBQI93I4EAAoJEFWR4sBmZMB42ZYAni7JWxTE+uRlHTaN +1Mt9humWf7JXAJwIOaNK+whZiPpuVSy7uSUaozPqIIhGBBMRAgAGBQI93T35AAoJ +EDRKhE11HX8nMdgAn0gIl6XfePxdBe0u/VncEC9ttk/zAJ9wX4dZlgIKfyVKTVUM +sQRPm3Ep3YhGBBMRAgAGBQI93Ws2AAoJEEzETQAR34fpj8IAnjzJaWos8DsyMxAL +YAGKji13z1QRAJ48+B0pijAIS6QsK0rZI9mJd/6KwIkAlQMFEz3dIQtksM0FGHvW +jQEBMgED/2nl2SchT5r3rITPNvKJSXqEi3ZJk9KC9tEX6NsgHBDufnHMlFmPzWF8 +CIY1Esfk91i6IScbtdIJDCXxTbeI6VQY2EZGAbCaz+VyJRD/daEM/aRjopjxLLlr +49QEW+YFib2a0QzViWYfdYzB2VFBEOaoGvabHrAsfaRUAZtHDGkNiQCVAwUTPd+M +ze6tTP1JpWPZAQHPPQP+O0DPnE+N1kUDH0r+96E1CGfeLYAPGUJM1BZVj11DplKP +lrB3oK2fjxd3zvBbPdJqKrq4/mtxeGXlgOS1n5Wjmtb9Z+k8/aCG2Hw8qg7lzWQQ +wJxMqDxogERkmshVXT9svhLGwurYY00tNEU1IDV0zTEtCz+CxXpv5sTnyJjJFCiI +RgQTEQIABgUCPeHubQAKCRAxNjTku5KeVPzIAKCfuxJYXBWle20SqWNlbPpWN+rO +wgCdHMJI9FmbIkU9wvapRCNQ12Ze18uIRgQTEQIABgUCPeQBxAAKCRDtomXYNFh4 +DngVAJwPbACWWWL3lnUZZisChi50pO7cdACgsjxddmEKCXt11Uds3iBzZOq8pRKI +RgQTEQIABgUCPhWzowAKCRBadar9ZAHxYQ3yAKDErPthqfaOcfpBRfChi3YfuW9B +yACfbksBj0KxStjXNIlC2L5SBLpVHtOISQQwEQIACQUCPg01+gIdAAAKCRCL2C5v +MLlLXDpLAJ0edFHjJfn3buJwBEUXFOOg2yZ5uQCggJcEFvWyrhLkCwXuluFcnS6Z +uge0IUxhcnMgRWlsZWJyZWNodCA8c2Z4QHVuaXgtYWcub3JnPokAlQMFEzeoM+39 +LZCSqJB7JQEBpE8D/AunAbzd6eYOmNwVXWh6krunrxduJrLPMwBye0H2g1nHVvho +o9q17Drfl72Lo/Ku2Gs19TVp+KLNk6vcol8ULAdQYftPhIUF8Hf2D2dARMlvjLr+ +fQoYYRS1GX9OoEN4G8PntE0P2aGplVuf45mUpEFaPYwW22FjFykBw7SFp/7iiD8D +BRA3il+CVuaW53sMD6YRAjTGAJ908hV1PrzsbnTbVr/dbQZYkXrklACdFtqhkXLa +focMmhudI7IQcccjkTiJARUDBRA3lMiLrq25AjyOOW0BAQudB/45xavMfDwL5K2A +K1CZEmkwUQLqJJ+e4FMCnT0sUhZ1fO4Yj/HHJ8MYBZ1QHAfyYyE7vConUzGy6m2l +4amT5uJ/XcibobrUMlTSC1nKl97+vpy8bUOiMTV6xT7iw/vxkPX5tYGORJs0T9hP +qCqJ+2iT9Owq+bxHL1bBEe9FkExDdjQRO0PMBACiNjvgK3pN0bPaunYINePrNjR2 +3k2cd90+M0XAKCIgaC9LDPB/JeA4HZ9qntofCp0QplzBKOOk2iVKYf+XGVEisRGP +EaoRYaoMQO0/errELoyY2r3jTTb+FtR8saeZmDsNPiHrZlbXrZcBWXz6pZVyY1OV +HKDg1HP1iQEVAgUTN4n7alHqbXo/ktOxAQGeVQf9E4rasb5UWITWjmiKloegcwkA ++YYJ+cGUQEw/EttFrbQERZVtC7q3yhPGGlURcvukJyxkghnTWj62IBtEA+OQ6RNd +OqLmqQc4CqqCWd4GvoGdtmc2IJHEp2G0k+pknoFs9jzGETDRW+8B++mNPeZJuyRp +FWHKLWrsECfbgmCIYqr/i7HDvBncTDWLWdPlKUT4p8S4+T6cnPx7WdNOYUumCT/1 +Tbze5eb7w4fXheWzP7/EV+jyHxO7yOw286HID5JyB9U/wcAR2duoNKpF47I9yAkv +7XR/uLAbaNmNgscc5lmZKWuTnOBkrldFKIFCWJ/uRA7eCTq4aZVGHQBm8cud8okA +lQIFEDeJ+pzERpHovDmlzQEBnkkD/2gHyW4NojEQMZ7eepxwy1JKADIJ4TBi6R43 +RxlT9H2TeWxX9CnOxUngtJMW9vuAf/M11gY6r3c0xgPkAVUCvaZcL/OfBa0cP6TF +RcQySxJZTyFqyeb3RDgwg+aWnaRNG4XuCDx77A8YH/CQZZ1z13hHptE+u26ZMe8o +6wC+qJ4oiQCVAwUQNikcGZrNPMCpn3XdAQEqEgP/WcMgFopVyTTFrFdCn8lHh2ew +rBQPfykIsS7aUh/Io+K2i2rK+q7q3EnJK3fjokCj0BtP00l0gBD+7LmrVel00yxB +RyW5qnIU2VzEmqcMRVhi8XRvm7gojrlcW6aKeGaCs9sW/hrXXsng6/v/4BS/sGxK +pWTF378IMwQsXDjP7WWJAJIDBRAzzQ7YPo+38viDQdkBAcaXA+du8KHJjdox8QpJ +iJiA/mDFRfINUYo9whMvqCwGYojVkkcY9pVkx4bFWV7cxed/gA+/ayaqxYWVAsfl +urxuOrizLrt/1aZxH6tkLA9HesyFL0gxSMbMv7OJJ8r4HzHl3Mx5m+74xmxrMj/Z +qowMjezFHKoAQQDR+B1/QkkTfIkAlQMFEDYbWZExpj2W7BQLgQEBurUD/2sDxRYC +nrqc/Qb0NS0GZ57+pqg6HlkgxOgPwpDYu4kk/4gX6kA7Qgmx28k9oPHihHT+huq5 +al+5ezaC0ZrEUwvrcgbNfxAacTMPOqxjuJD5GEOU7+W8357yJP7nfzSe/IM3D/ZU +MuFAxH0mYP3gDDD7T0CqBEWbJm9kzxaZ+R8OiD8DBRA61ihT3bpkuiwxLS8RAh8k +AJ4rm5LDty/7QrAM92rq7JEUuQ7INgCeO7LTLOw9jOqZDwdp8JrC9s2nhyGJAJUD +BRA8vYPND0cvWzTXTcEBAcXgBACfG2fGomWNVzTCwRzuwZxFfPkRSOAxu2Dt3JlI +JuCl9Ku+3f8tTaGgOUDvym0suzhz5/PeMvilsrdPI/dsx2FeNZXE1c1Y+kBNmYEX +MmdGHJGatkdlHEeiFKOwhc17E8CPrk8XzkcwW8N8L7G480hOb9t9jjvN+og1I7Dj +uUUC/4hGBBARAgAGBQI9Az9AAAoJEJcWsik7qjrgVSEAnRcnEEMrkgFw161OtpTS +a6giTqsUAJsEDO9X6vwPmGgO/nkeDWce/VATPIg/AwUQPRm8jNvSRfyzsqEsEQKE +WQCgj+POQEwEMtvcVKA6Z3/ZjoFT+TMAn1ZK+xwgUQnp8eTClAACRIvkuv00iEUE +ExECAAYFAj1nss4ACgkQLHDixkQxc5xFpQCWMKBv2yd23G73gc0JAGYW8rmGSQCf +UyGiZ6zDQ+HwKwvlFkWvd+Mn33OJAJUDBRA2VRZbYlyoKdWSjeUBASW/BACnKm/2 +FjN86jOtAH1ir8XdiWzTBCynV9F8A7dxOuEKCaf+6ILgfM3pmRl78GggE9ZesrKT +hxB6+azt5ln3vOnXBKYwwyiyn6dAjBjYKQCjXUnPr6lYWpn2nDfi5jGg8Wd3GLvC +BegSMeN54TrvvQqgjb6rnDrO3PfStT7HfKnk7ohGBBMRAgAGBQI9pETXAAoJEIvY +Lm8wuUtcAlwAoIgGWg4/teriietB5v7akloDwBDGAKCp6ijRdWQaMJ8mOkGRWZpY +Kjl4X4kAlQMFEz2a8Aiz4b7txQbzsQEBNcIEAJ1Zcp1UYCY15Pua1qLME6Shrh/x +U+KQIUkbU9aoHRLtMJ9ZyK3nIpN2Z8wuz6YJZ58+gFLuwx8kuw+E9j8yRBwmrw/J +SViBPa8AZvdWx7qE5wb4wKL3JzDmhbLyD6tdq8k/K8PIKILn0og1lSanOAzWWB6J +y8UcJf4qstXNxR8CiEYEEBECAAYFAj3YIQgACgkQXUFK4eAFycvpowCePnhazYAL +xZ+J1VJ14CJsqbhVeKQAnRa7TCTSMLRZ9tKG2IP5h9d4UU3jiEYEExECAAYFAj3Y +F2oACgkQatVs/hkxGwABbwCePGUylMh9ebstpcYvmVp1Ge0/a2sAoMhsIjfO3mZo +I9TRG11eH0T0bWPuiEYEExECAAYFAj3YEgwACgkQyXxQllwcOtdbbwCgq1bWegCT +2Om9MBEOatVMxMGIBb8AoMkDiPAaflgi/sNQqj/fJz5W48K1iEYEExECAAYFAj3Y +IIkACgkQ/A+FifiUvhLdvACeKIGPl8brem8WCV2DyODB4WEof/8Anin3nbi9soQ5 +tB7Wufk9ubya+yOciEYEEhECAAYFAj3YJrYACgkQNhUi14Kre9HgPACfc1+WD8bA +p/MCHOUXl75Pq/ynhkkAnAhPJxhwbwmJQAPe93FJK0CWT7xFiEYEExECAAYFAj3Y +IxYACgkQZjW2wN6IXdN+8gCfckABgKVKMH7z9zOOuZQXZnEYUk4An3uK8GiwIoyP +PoZlxyYSG3pFZPFAiQIVAwUQPdgVECQOZvzFnDJwAQIueRAAg0qcWjnN86oZUuqZ +cT3df8pdRukrtrameId7JOT92eIcfSZ0e3TOuZvf9j4CapGoDP7fTtBjvN8sW7QY +B4jMida0/Jp2iubPAxO/BCOoMthDZLaERp5K+YcrIWskofCOfZys9e0PKwL0pOsH +XIOCuHai/s6rWPAuSNxo+M7lJ2gkvcFTopAbnC1T2r4Tl6xhd3EqRiI/meHAHSVP +vhmqGWYCSJjM0I2JReTAlyzXu3t0lPSjsedlHnY1mjSN4dxcuuUglc3WCln6JntM +RYUMZ1UlsrBMbfGYyxzcxSO8nkV6n5+95BrAkV2ncmSFbt3dX36Np1gPJW4leobC +FXrP6SEF0pUAXQSXdunXR2/fnxlq2kSHGvNMDKSLJMx7POhaD/A7X5uTCID/t3ND +ep1AUSBfk7NkNRsA1VzRP+2BUxOFPscNB7mDoQQIXX3ccUWFwiJuQ05CrCsCUerv +BQlBXEwXIyBl+ZvJTpY9jpp1NI31GBTcHA1kyS/DCCzTDhkg9gAuYDEUuxtN/YcV +BbbKl2mT7VF4s7k5DYJwBRDX2pJrdzGebiPRs0IVDI/dHocTTDlxf++r3mB4J506 +82i+kVmwJ7HrLkgXlitZxeesTCFY+Et7qEZLENaJV3jScYPEkJ8zGSRnNsa7ySj/ +5Ky50SjTHjyu94ODQRJ61j/OweOIRgQQEQIABgUCPdga0QAKCRCyvrxAFSkkr1iZ +AJ9P1L/Kcnu5YO3Ffjt3BCt8iBN1AwCg5yilElAdPPY4T0+C2169KeO1seuIRgQQ +EQIABgUCPdwsCwAKCRBVkeLAZmTAeMjDAJ9rjShqH9hddmcjx8OtjAI+9qY1bwCg +hlWGanggTHNIXXRJeJm/nHja+4uIRgQTEQIABgUCPd099gAKCRA0SoRNdR1/JzsQ +AKCgxC8Ud97WqPsvn+Leszd/82wtQQCfWHEzkf6CXB0AjItFv2lavhQPZsCIRQQT +EQIABgUCPd1rMAAKCRBMxE0AEd+H6UQ9AJ4n96TMb6dFairFj6i5PneMP5VNtACX +eFF09NN7EhhdOydNuSD2o2WFCYkAlQMFEz3dIQFksM0FGHvWjQEB9FAD/0jbvqVv +oFwjXFu2GBlUu2oRCFpwbo5xAydPpL6H1/PHtkzNMkzuLdY7rintSRZebUGDbnlk +4MMOmqqg59YHNv7X9Gf9hwMGiMjZ0VVyQs5+cC927n9WGbPMybbimCbPcnFZ34ug +h3tqb7+UyvPdlMJBvywqipu3vYKj6htITnIEiQCVAwUTPd+M0u6tTP1JpWPZAQFE +zwQAsO6P8DH2bTvJJsEl7GCaet0XkSO8WEXgU7GDsA7BAdKA4WGxf4Hp7FvT2znp +A76paD8com79YcmsULidmh3WVrCGG6tb4ydt91CU8V4Bugr/0/auhfpNnOY6H+eJ +d4OgF8NcNmjM3Jt7l1ZNRvDFqyyS4fXeJGHyBwMhrHO1EfyIRgQTEQIABgUCPeHu +YAAKCRAxNjTku5KeVGP8AJ4q2zuDiIgArirtTfI+s+hjThAX1ACfbamjwnJY0wKj +ouenyM0kX20/aeuIRgQTEQIABgUCPeQBvwAKCRDtomXYNFh4DgHWAJ9s68ZI0exd +RgoL/QycXDNUxFSqgACfdtMFKtINALcJ07vOOu6K1BSRU9GIRgQTEQIABgUCPhWz +oAAKCRBadar9ZAHxYUfwAJ4lfEdpwATb3PXKccqsZ3frQ1Z9cwCgiRq8qM3CCqow +5rqV0fLr5kwWN6mISQQwEQIACQUCPg01+gIdAAAKCRCL2C5vMLlLXIfZAJ0T9uMZ +PqUMpcfRweoqtr0lbKu+nwCfdtyKm1Er1qQdEMBgN2B8EtrMotO0IUxhcnMgRWls +ZWJyZWNodCA8bGFyc0BhcGFjaGUub3JnPokAlQMFEzeoNAP9LZCSqJB7JQEBoyYD ++wXn4TqjNwDe+7JGRng/4TXtjYnzCrdeoEmc3b5LCtv4MadCSOfeBvDA7ZwXcEoo +KXvd/M4B4o6QA4SqUcJU5pDqdgP7nFD3IRzx/8XRy+OODciAPHrmZUelNIQ2S3vM +kjpjjUf0/lQ1jVWiGllmlxCNe7+O+q+iCJOVsN64Er72iQCSAwUQN4UuKD6Pt/L4 +g0HZAQFWvQPmPTlwE9IfrBcb6afTEb6hWewTcwLZckphgwNjcuDBccv193gl8MOh +PG+wFv2c+jKwndV19NvHeB0r1HE0+lYqLxQI0DTGZTVGDfyQBJMKBOMLOdB5Qk12 +gNOXC7F8Ulhx9w/LlBs31MRsl3e6TY5JyzclPP8qNSI1DhBBBzSJAJUDBRA61hFP +ms08wKmfdd0BAT6mA/oDuaRfJMUpypSCFrVgprN5fCNDz4hosv+rmkt0A5Ks+Xf5 +Z+BzjCnJxSjUwxNI1z+F2NDDgLXZG9xl0oC2ib4snH7lfWee//zJNr1OqDAOp+D6 +BWfDr41Eu+AYsZdikbZ9sRkilGbGRkx6EjOO+AB5sLwwvZtN2Y9vNBxkR3byKYg/ +AwUQOtYorN26ZLosMS0vEQI2lgCgvvVmipxqIKxd70Gw/P7GZSOM57gAnjMD/8OI +u7bFfryVUKVIJiVmyPa6iQCVAwUQPL2DzA9HL1s0103BAQGAuAQArIZWUAWR1Dm8 +ahwIXAlGKMGtqJVkbVu4c+Ziwax7qGvIf7sTD7WQFAbytyEK0guirnqSodXOGLLW +SVrvzB/8d9C7PDK8zDpzatmoA5CXxPWYKGtdB7OjrA32eTuSrwf6S9+OdJXi4960 +CYTUq2D7FyLR3SU/MyvljRLhLIZoq06IRgQQEQIABgUCPQM/QAAKCRCXFrIpO6o6 +4Nd6AJ9U7VCOElgSVuZoFcZa+aIoj21C9wCfe4SCgoM/khv9TNLCLn1OpwzFGeCI +PwMFED0ZvH3b0kX8s7KhLBECGjwAn2N/LvnT38Ip4KXU5sg4ZFVhYASKAJ9DjJK1 +rgsWcKjjSgWM2ESgYiA+sohGBBMRAgAGBQI9Z7LOAAoJECxw4sZEMXOcf1EAnR5P +O0gfDHPjKml0u5NpVDXCIYFPAJ9lnk0E5tDzrMtzIBAyvb5UyJPxUIhGBBMRAgAG +BQI9pETZAAoJEIvYLm8wuUtc7GcAn1ryTaOMH725FdVBWv4vVOBp+Q34AKCNS4HN +i50ZMJkfAXR99aGlCoz9PokAlQMFEz2a8A2z4b7txQbzsQEBl30D/0/Lo7Cz1mVP +GlqS6DNbAoeJdmEIvuM6iITmp/Iw2BanBiyI7XsDEw50lhq4PqR3k+Un2vRKnFP3 +FvhD1b1iuyzAiTR2q9OZzDRURRlGnVcZ2qNoduzWQqrmXCDEeWWTEEe9GYO/j2R/ +PYiJrlWmBHC/44EUjcZZ2fkQh4xZJ0A9iQCVAwUQPdgVPBsIDEUnGa81AQGXWwP8 +CXqiBsIZej3+4R05GTZsmWofAMiCrK6BW3dqGj3BQsVjuwAC2Jy1FIXRdnLkyyW6 +qZGzed67nr4cs83WcnITk2p8cei6pmu8tQRwQFlayrIMbn/RzAqguocbNprdnYT1 +aAlJOYPcPfr8/CCHVyuMn1kdkcRGh0O5enLsG/IZ5++IRgQQEQIABgUCPdghCAAK +CRBdQUrh4AXJy1MoAKCOBamdjWJX7lm8IQh4+Yxl0LS8RgCfUWMqettiFD0g+CeM +X3yWxDwXvs6IRgQTEQIABgUCPdgXagAKCRBq1Wz+GTEbACrmAJwPGPKlh/TVffbX +Znc9W4YKmv0CtACeICRk74geAZX+FTMVf2vojnn5aXeIRgQTEQIABgUCPdgSFAAK +CRDJfFCWXBw612SjAJ9Tw8gPCHWJAXgoJJqFjIkVCB8uGwCg5hbOzUzwDBXkqcX7 +4XBeXF0YnoqIRgQTEQIABgUCPdggiQAKCRD8D4WJ+JS+EhhMAJ9fCvK4SG7U2Ain +BgARpPzFW/xS5QCffbmKs4pbgGY+bMX7toNRDPPVO3WIRgQSEQIABgUCPdgmuQAK +CRA2FSLXgqt70WtSAKCZNK3C7QttpKa83LUu9PxKDhTzMACfR77FFd4vrY7uuDiQ +wSvWAMqPnO+IRgQTEQIABgUCPdgjHwAKCRBmNbbA3ohd0w0fAJ4qt8RjiNFJmoGk +4ZiREGmJGK7CNACeIK4AmENr/kjihSVzN3oS4CybhA+JAhUDBRA92CPbJA5m/MWc +MnABAuj2EACQ2kVZwBBIoz0NKZIvyla7/Xi0+xvaY3qeAAoM1LpYvlNDUkFZOwwV +nSNNXbFmdVjqJs6TOoeMRDOZNeTwJwzCV6RM/OI+Wwv6Ji3ZhF61IHlR7wSS6KVX +aeuHPvLIW1LTWF5yDEu+QckAoG18Q9rPAXMVKGdcKiMvc7jz8qUt6rT0myEJP51j +4DNXAFlxKVDgSiXjE71a0DkHgsYZU1JLbO467iRkbA6L+c9aKTu4EuCjUVr5E3rl +Z7EB6uki2b77MbBVCFYblaIPPz0guf2CZPgLeFiSViqVUypuIGjKOsrGlkb3aya0 +AMtc46vGYZ4kO7ulfUHSscJ/SmSNkONbzjTmpGbEdc4OqI+1UJovEWM8CFopXypE +UOvKeARzO73JF3JE2er/zRngOOhliWn8Jy1NeAt9bKQ7Fg6VD/p6CNcjkfEy2mri +UtR1o6oezQCRSPBbURceZIaX2FWHAi+L9ohLTfzk0Ff4s9i48U2eoIIVcVfDWIFJ +zQa9dB7EEmaEsseMHnqRxtz0oQCR0ihKSeHKt3vSnVzEEvNcwoKstH/cbi12T1Vp +PBRmMSs1oNbpDZAeuNvvVM9b+XAkV42dTSs80ukjnlRSP8bRhf2qvaYDKv7GT+st +EkOGNQmzH7H+4fIH6JfnH6K7QoPARfyFZEjhHtEZnOMILxaxvbhn7IkAlQMFED3Y +JE0xpj2W7BQLgQEBPnUD/3B7Q3rFd+Rc6QESia5oZAiv7DlU0YpKbnqf36nShgpA +BZn3gIVXIzlijVZoQNZe5Y9vVv0LBBCAX3+hTu+q8y8lUYcDvrKyQHoIKzg2cfAl +sKDqAfCRd1wo/ePZgrpFQXjWgpmfJnFxKvU00XPiLcViHIX9ut2+mik3L+RVCP0G +iEYEEBECAAYFAj3YGy8ACgkQsr68QBUpJK82zACcClM78giKcJReGZ5v3g2MNhwP +SlkAoPPnlCWqDcOSnv7zWilUdiC08+D0iEYEEBECAAYFAj3cjhAACgkQVZHiwGZk +wHiTFQCg7ScJ5CKs0d95DwfYfFQeYRXnagEAoNVnZ1LyCt9gm4C+k7lcxuPS2xae +iEYEExECAAYFAj3dPfkACgkQNEqETXUdfydraACggSLLr4mP8iCTyqtmihdk1Ldy +N70An0sGk21GGI8QOF0fHHtwFfoT5za8iEYEExECAAYFAj3dazYACgkQTMRNABHf +h+nd4QCcD2eLYdwrQNPJxjsJx+5AIhdIS/UAnihAavuB4SaijBBmH92tGzw3iGuI +iEYEExECAAYFAj3dIgYACgkQXP03+sx4yJMYbgCgpPZG7Xg2AKb8sI4aD9PuU+Qs +5YwAoLlQjy7gvlv6OPNn8ygxp3JrBkEHiQCVAwUTPd0hC2SwzQUYe9aNAQFo4QP/ +VjYmvIsDDOg4kRD9zDgyNMrqpJNIGTDN4gOAt6H4vmUN7qY9laYLarMLrJQg/9+m +7NYuC6IzDlY1Bu1YnOR0OnVtL+WV2EPQuee2YzqAH0qmY2ZQxKc6QfqfqwvAwK4y +NU7xXvTOAeSNZ7pOqpj62l1puOYbMFqWM5BKykSQr26JAJUDBRM934zS7q1M/Uml +Y9kBAXX0BACUFIWyTCWZMRZL8Eex1LzvIFpzojkm26V3mIbZp3E6RV13zjqatIJX +EPFe3qiWGgGHKIaLOt0N2R/A9LLWuYhE016uu3xQQmWgh8XbeKU9VtD9j7eqNiq2 +iVRnQlkR8Z1Jrv8Y0LsvBU2LC83nf8Z0UEYCOxS6ghKc8EFnK0UyRIhGBBMRAgAG +BQI94e5tAAoJEDE2NOS7kp5UTroAnR15zCxKXR2bok0hFXYW7Qpzk51mAKCf04rW +temf5aASKwJ9iGwmYhaVg4hGBBMRAgAGBQI95AHEAAoJEO2iZdg0WHgOET4AoJNA +zn8VI0d03B5PmlecuJiVhivsAKCRlpbeLXdAwwVJPDtC0UcTa/A1mIhGBBMRAgAG +BQI+FbOjAAoJEFp1qv1kAfFh8rcAoO3xdFE+dO+R4GMptC+cEmYu38JJAKCPcw/Z +HK33u5NTITecwuqtHNuwbohJBDARAgAJBQI+DTX6Ah0AAAoJEIvYLm8wuUtcvosA +njKNyxNGBDXk0S/UDxrOEc52JAS/AJ9Pl8MKXgL3kakVr9HgxauwuTpfr7QtTGFy +cyBFaWxlYnJlY2h0IDxMYXJzLkVpbGVicmVjaHRAdW5peC1hZy5vcmc+iQCVAwUT +N6g0Fv0tkJKokHslAQFZqAP9EWFA4Cr0GU4MzDAdpaEl8DuVztob+QtWFSgzAtZ8 +/pYnboE/gDWev/ODGzxh89Wg7qOBA1bu6ZatUtUR9KOEU0W9DzeprtSPQ9nmq7DY +jBo+EvxrRZUXrxM2niJ1kpu13zM0n2tgEmn76RdRQ2wAAfmnzqF7e1PpIR57tg20 +1hOIPwMFEDeKX5FW5pbnewwPphECcNwAmgL5p1ev2W9XyQEy6ylAtga2XBGgAKD9 +nQvjRYGBhAjC6QJ2VWlOtWc+hokBFQMFEDeUyIuurbkCPI45bQEBbXwH/18e2qOB +Y1iNFYbNqxfAdKItzH6KvA1dsZ0of/JGgXXK6iTcdpPq2vl/RYTpmwLVErhhBRik +n4XxtNUxigMS0U6IUKesyggHLrXPY3hwGKAvV+QmB/YosTqtWJi885oEIv5uMlJ2 +mO39jjqYAnR2CqoKH1B0b4wRFdpcP5IPYiL9Z4F0zniFxFQ46Vd/pet4K49KVP5b +nI3yw0x9/t+nbJjee8XDP0Vxcg6A7QoaJU1RKpGWrKsYfBlOGPh/gixcCQbrpsNs +sPiSplWdxT+xctQpIviPn8UsAgF1WV0jLZyQmtoZ+JvYVR0nrBUNJVQGrsSPbI9f +0dJXaiM3ddE7dbuJARUCBRM3ift7Ueptej+S07EBAUktB/0Q+oYJVnLw+j6eDPv7 +wzXtFRHcNnv2Wn1eGH/NL3fe6/wglaiZ8tw7kcY9TQWdqCidjSkJSmKCW3O3uNtD +dRF1kVoEzjMQJLOKY+wHDT5TKemKoNATJPTNp/HJiV2XCVnCR/vvqIrG6n9ct1gZ +AlTVdqtwHeZ5x3qLQapo26RzYM3Liblhn1vGg0VuO9tgbscZDWDkrRVV2Hr6FIOz +1PF8INOv9Gm6IJkIQ+fToOz84TNk5ubQUeHbLAjH8fKaaIOYhebrSQVNEAgLQys0 +rhB+B1TVLIiXE76pXk596vwVGii1Cejm0HyX7EhQKMF+IX3kiwnHbdW+6Sx6LkKD +FzvDiQCVAgUQN4n6usRGkei8OaXNAQGTKAP9GLjMHw1oZ+lTu5B+UVJf7HTQZecE +jGw33t5w1vvyleNcjl/iEsyNb/g6LMuahmldh1J7SZt615Jw6p6AzXZxk2ispmum +e+37O0VKPNGZ2IUs0mFhAJ8yzTAZXcMh2SPzUW5gL7HznskNOpxTctope9PlqRGQ +T+Qmmsc+y6VzfMyJAJIDBRAzzQwFPo+38viDQdkBAa31A+dPvsRw1zWvyMDp2aQw +qIawIi2wiFl56lYfpkwWWjsdftuK0HHe+gek0aJ1vLwJFlrivroEukF1JaK3kS/o +b2u/TNIZ4MKWjfhbkJW40Y7gCKCUJPzh6hDw1nYfc4N9XKnwubiRVdW2ig1HVoKZ +UN9Ad034m30jMHEzqXbO4IkAlQMFEDrWEWuazTzAqZ913QEBaOkD/1ga4Z9KUKzs +LMcCrqX/4H9p8iJ/wRecXL6CcnyEK/xcm/flhsRZLnNiNMOusW2RIeZSzntjYmK7 +7CUH5UEFb+ryf4LXKoFXV1FOLqnwcJ3JGIX4pf7HnPtcVblX0zrwAwjoCikLsM/c +s7xVcC7cMUdUb5tgh9RvYcbOtDB54wGxiD8DBRA61ihe3bpkuiwxLS8RAkebAKDL +Ofbxii5qPiMxr5keCdzwprztxACbBrZie4yvYdXwpylwrJ88o2+n6eiJAJUDBRA8 +vYPND0cvWzTXTcEBAZrkBACLGS/AiGBBDtOK1CzMUneK0DdYkVBk+qXxvFllOfZj +varNz8wOyACkSB37ZzsxAmq5Dvu2td0HDUkLsvhrmJHIddd2YVIlg6ScWMkKDVmo +N2t0rPIffFxr4lkeIFXr6LeJXEz2zPmldT+VNVlzIiPHiZuBXqNXAL0ILrt5aHTo +O4hGBBARAgAGBQI9Az9AAAoJEJcWsik7qjrgpBMAnjVge968Imw+z1aOVDFh5glu +LuR4AJ4qjQ0A6dN6h6F+xsHUUrMbgVP5a4g/AwUQPRm8w9vSRfyzsqEsEQIFBwCe +P2q55CzSI50XAhoP1Ps90lttg48An3sPoV5oZr8vNI9dOhrlOEUPJkZsiEYEExEC +AAYFAj1nss4ACgkQLHDixkQxc5yjyACggstQvc5IdrafzY+XFrlNo9NoWccAn3+w +jcgbUdR50oVbIsjTbO9p28+oiEYEExECAAYFAj2kRNkACgkQi9gubzC5S1yTgACg +rO4DT0Pk1EJVg7kUpLL9gJjZQBAAn29oAuoqSk+TbmFLR1Mip/xyJCpxiQCVAwUT +PZrwDbPhvu3FBvOxAQFAfgQAhcL/YD94uQgNYnlNA8WyQt0iCp6k534X2B4P+mR2 +fAnsvb47pK+POPPXku+MDQLGt1L7fWXn2HV0/IXMrA8vjDBXQdHi56ACB77LKlb/ +RkgjBsJ5sxSaqKm3kknCPU303ypSu/bx0/v2NAsA5dsa3MMOZbw551cpwSAUxDqt +Q16IRgQQEQIABgUCPdghCAAKCRBdQUrh4AXJy2m5AJ9MdOQSizBm2+c0oe+r+m+v +AW0y7wCggAwJCQPzsAohf5ZLwrokLrsNEGuIRgQTEQIABgUCPdgXawAKCRBq1Wz+ +GTEbAOS3AKC854HXJSr3q15MXWJ2aRpsgrODXwCfatZhrw0eCToappL6QVO+emvf +v7OIRgQTEQIABgUCPdgSFAAKCRDJfFCWXBw616euAKD4bhe/A/1YlMCW8VEeMz1q +8q3jsACggYVijk5n/GXTAYagYLuHt2sS3TeIRgQTEQIABgUCPdggiQAKCRD8D4WJ ++JS+EmSAAJ9VUKqSxwDnt5DOBDOIDrkBeFSLuACfYozztzIvA7dcpRJfbQqhSwfY +aoOIRgQSEQIABgUCPdgmuQAKCRA2FSLXgqt70aUyAJ9ZnFBaA2KO+QjMMoJrY/JR +w0d22ACg8D/KhGNnqu04hx5uIHRB/U6WQIqIRgQTEQIABgUCPdgjHwAKCRBmNbbA +3ohd0/Z5AJ0d9ItcBgBA2jYFZPYM2ndkpiMnsACdFNRsQDPvu+0IKuUhUG8QDOqC +RiOJAhUDBRA92CPeJA5m/MWcMnABAi0jEACTNnLtJQyLh985/pcpL20ehr7OLhW5 +aAdzodMCoqXrPGlkJPe6/OAP2RtG/g2E8yL4VVVcShcV0WlvHnNIX5KE14LSKjY3 +5iVdSGDzItTuZuXPgzLjzo8pwFW9OCdG48TdGgxrGLAJRcWzWqNat+ZY6C4mQu3E +/pqv8Twif9J0QeXb1TBiAjg1mDCKpFSb2Eh3KWxNxRqZRrx54BTh5CqeISl/ISDQ ++hQLvD3LrISGfgGDGmlTs6Bltd7PM4wO1MeonSprzgwGqWPVIrWTsD9YQJRGZ9r7 +tPztqeqPk0TIgKQvhS8W0Vf22ZWSNLS62CZtX8EYdD6snN7tfBbG39UszgyQ4EPw +ds8My80NZ87oP+xIiycllMXGcdN7KjwE2Ai4HNzk5H+6cpUwHNhmV3eVkKyVlEdU +vXJUywrb94ivGn/loBUwDw7ghCKnDEFxNBiL6vYgkezG92ajaYhjyRynBqALL//V +07W1+5CdMkr1/MoDOQjGYgkf5+vT3At90gYXvrD2hZ5XwW95Zw+2A6gPOZBDa3iG +r72smcD3ny/v1NjXC/aKpN4Od6nSI2wNeqm2b2AFHkpSySdWLG1TAc0rVaOw5y13 +vbWNiwP4i4RRIb9mkHpUU5yGLEZJ9CjT+K7OkxAg7A8i079b+xjEBJ6nXMLrxSaZ +XXYc5h5TDGbLxokAlQMFED3YJE8xpj2W7BQLgQEB8HcEAJSAz9moNPBm4kNtG7yu +z5gkIlFa6cOmaJB5dnAW3OphxoyC5bac1SBADT6XVTgVNtBwvbk7MwDDp85idhOA +GDahLBmrFVV+O6o7OjexJhlcTab+eC/pOQrxfG0pYpqk6IsIVNRjHM9LOjngYV2d +2OZjJ93wPxmYdlkFDjEaL+2kiEYEEBECAAYFAj3YGy0ACgkQsr68QBUpJK9B4wCe +JPHrZa7bBzVcqPOqdbUyJ8Tn5OkAnR8dm0MWvYtqRYdK4/COcxbkBzlkiEYEEBEC +AAYFAj3cjeMACgkQVZHiwGZkwHizXgCfZNz44hhBeJvbPj5xN41qnzxpX9cAn0Ug +9dhPASUF16va6ZW++e8+WGaKiEYEExECAAYFAj3dPfkACgkQNEqETXUdfyeB8ACg +2hn69wNnJQ3SaUZMoM49SGKxw5cAn2259C7IAho7Wnypa/76Vfv2qD8UiEYEExEC +AAYFAj3dazYACgkQTMRNABHfh+n8MQCcDfaZ/LmpH2g2izNcTNpic2Isu+8AnRXI +dHIrQKbKDOnCcTRuqeJBe+1ziQCVAwUTPd0hC2SwzQUYe9aNAQE/OwP7B0Qt69z6 +BP555Yo+PtaDPFJMOtWFsYnlx5/P1b3Y7y8HLnmWAa0bY83SPAKjvLHeQh904vEN +mopBk5plRPpz/e+T8EJZL10BaZys3KeVncMMiVdfxCMiusu+U3uiWeXbjpauyQjZ +N2YfdhvZ30yVYRT7KBt+XuRKRHVW+fl4IgSJAJUDBRM934zS7q1M/UmlY9kBAV+W +BACm/UKONS/oG8Jecyc6HZkaHJnWADYT2EypyaE3OvXNEimaU6S/xLrm2EywbOHQ +L6IHr8GLZjpln5SXWO/ve+H+kZOERO+jIFUysFDoG7d+S4Zex/dFCULsZCVbaMLj +G2IPmTsbbJptllGcENNdzl+QlEdWMNiWszv6SCBRnsDNFYhGBBMRAgAGBQI94e5t +AAoJEDE2NOS7kp5UnP4AnRfUpx/baaGqTO69gRbzLK1exu1WAKCBjqiAjNETihto +PJ5cku6Hu++Rw4hGBBMRAgAGBQI95AHEAAoJEO2iZdg0WHgO42AAnjIcf+CQlXYR +eKV47t+DHDvXshn6AKCxSaDbodEOC1Z92ltAsImD+MG7wYhGBBMRAgAGBQI+FbOj +AAoJEFp1qv1kAfFh1jMAnAmgt9XJeko49kxYxctaaIBj1QoSAKDv2fMPZruYf48g +C/UmCIkLrbl+pYhJBDARAgAJBQI+DTX6Ah0AAAoJEIvYLm8wuUtcxFkAn0+f5UD6 +GBmz671Jv+/zIG8Qs9z2AJ9ctlW2IAlEXD3QSEoLK4mNnICiWLQxTGFycyBgU0ZY +JyBFaWxlYnJlY2h0IDxTRlhAdW5peC1hZy51bmktc2llZ2VuLmRlPokAVQMFEDD5 +fUoJNGLsuYI5PQEBF9gCAJQqYY+CSP8r6HWCJaQtjDzrPoX072jD1YUgmWdBFX2Y +E2aS0F0A4lKJWAb0xyZ4wWcl2aM5Z/3X+DAR0IClsJiIRgQQEQIABgUCNra3sgAK +CRAT3w9oXcLsWDX0AKDf7NZOZSFYpvRorhOUgBFSoGQ8UwCgxreAMZgT6o+/Ew0S +6kw3yXpJyWeJAJUCBRAw+O6OHdm2eHD917EBAfj1A/4/cYEEa7jN8+ptmxZKsfZ0 +xOP2dxsPnicDT4VR16MHN6rkVrto782XSiRx3ZUsd9RjUmfHZA3mHoJIGo6JRFVO +eyjg3LEASSSfZr4YFkhutnf0lDlJOeEKhqvIw/dSO7MDwdLxhOqAFv9UzAlpOm4G +Lx9p1N61xDl1dIYEnY9cOIkAlQMFEDD5QYseKXCPGoSZUQEByFYD/jqPx2u8D1aQ +zKHvZqS9PUYSsPMTgn10FR/tp2c9Ch60f+BQ96fOUCzmRt94Iq1iMZsJ0oTyLLf6 +wf/Mdb1LhvsGf7rXFATh25OUpPx1qPUWstSToHSn0+Zf8e1B0p6PJ96duI6rimoc +8NKppOwSmRvqAD3ATCKpMiOSwWe9+mBZiQBVAgUQMPlE+T40zOw5+FkbAQHkSgIA +g0xBZlmf7XavacVJwJJx/lNoqmb5jox8Sy9WDS2u94QnviJtsUOjwAFnaDoWDN8P +EAxvE2xRBoyuGHRNpIL0TIkAdQMFEDMR9XVLXCU0Hmjw3QEBftADALeK5boLfjNz +xZ7g1VPHw6k6QwSUESwiPJCmGTIT5f941YhHqohgwN5kGR9XDxWCCJAqQfFvbxhi +Zv0zu4HvQ7FYLVLO2zwZrVvOfR259jvGDFpPqRBq1ccxTNXuvf2a44kAlQIFEDD5 +QnyFat0badac6QEBCCMEAKV60AedWZyXWokcwWIbW/PLgNTCh8JL1vijXGnBvT2P +uA0L7/rCXPhbb20Arrq+P6xbGFxi42iWieeU2T5zN5IlPObT6cPeRWJkxPnaSf8Z +D33Y1almcuhhYMUc7lkL7yqSo1J8TRVCSxjQ4W0+QDUFIEvrigb5Scd7zYHGOqoS +iQDuAwUQMOFRHordZNYSzXUpAQFOeQbBASAkyTxIdH7aIGY4lDbH6S/gtWY+nyF1 +ooIF1+8kOatKm4SCsFYUj08OlLAXs1Ys+oRI+dajl13xh7KfNjPdoKIhcA5QHSsb +y26MXV1Kf+QVQIyqCq9s85TexK/q1WUQIgCHrsZM0efrUgiEszQobi/16WjQuT9K +lbBFE8llb+W1AECmO1H6O4U6Krrzr54T2QoEIiYIi2EF4T9x/ol/C5Lj7W6L4yaS +Squc7z7Ttt2NuRZNLNMveXXa/+0zanwXCqmzjXL7ecgQ7Orsix/jMGN/DZkp5dsR +eokAVQIFEDD4zdqb2lGD8IQbEQEBjYUB/2eiJQSOIXRm/LXnpTIGNpH9yKtPDQcs +soCQCOPB6k3tHCiFugT3AZCajKKCbUSU1+kZLfH0SnvyDxnhxqslt3iJAJUCBRAw ++R5/voJFl2Zsya0BAVlWA/0eFxcSJrCcc6WspLfB5eJKUDVmFh3eWnvNUBZWv73y +KZQanlVq9vfaVGztcQbeBBT4uWsmvAhsF7PLkbByp97u9dY3064tZiqYjAVrdePQ +bFJOZRQpxPYFaOVMWHKTNr29SOQynqP/Pw7mM9RUIV8DsRqgaiK/oIENXze0NL+a +s4kBFQMFEDEsVXTwiYRjAFcYEQEBWnwH/jmcYmaqYHgN4jGc2zq9e7+GIy/yeDd6 +Ya3MvLLIdK5kwWzR1jn0UdMsxpQF3rKQki8wZ0kDKYdjF3NwJedSyuM+PO4gEMab +uZP2Sq4OWoWSO1+aJL4k3EY5l5KW216frDLOid2Tjo8TtbVsrUl1uf95SsG482lE +ZW1GwQPUEEhgGD57MGfgjykTblLJNhCN8uA1lY7mmznAnjcuEy3wfVCGPNaF31zs +k/othcGdH9W3n3mbrjyAhkCMZRBYtx3d4QxAIDSfB7vQulwAp2Ink+3VWLZWB9eF +E5OvwiypG1jYXfyOUkDD24oyits1OVN7z3KJQNVGpUgXJH7Q0Nok5pmJAJUDBRM3 +qDQn/S2QkqiQeyUBASpPA/0Z0rLxeX8MgmxAwon/DVmw7K6pkvp8fd7FkLfVjxfo +OTxc3ZHDQqQ7Y+Mw2leyN3R+nn1f2zBMP+F/WBEivtS+H+nadd/IFIOvj9VQekru +3HsgHdmiUhlW+2brv4fy98cqT1cQWAUXXj5pW8oeiNdne2xG3pabvyecnjeB1XIe +vokAkgMFEDzHIq0+j7fy+INB2QEBcVsD52j29s0zprKtUQc3w/46DAmFDKzcDMin +N4levHlq3BrUGtmCD08CoJoG0RjC5nykWUOyMTYMF2V5UNm69vFZTqj2D0+p5gFu +Mu1Yi58Pt936dQ2vw9x9yScnvSsGD4KrdBvAGD3OMCFuLDSXj42CrNKVEQJTD3yR +nNK/h1tbiEYEEBECAAYFAj0DP0AACgkQlxayKTuqOuCeSwCggVvzIE9C73tVUvil +R7R5usmUsBoAn2InryHTX7AsmLBzBjaI79xbPPdJiD8DBRA9GbzS29JF/LOyoSwR +Ari5AJ9k8ZhNyiR6grJAwa4Iigq/oGVpkACfT3vl1YHpwt+yUMvOov/yhzKhZauI +RgQTEQIABgUCPWeyzgAKCRAscOLGRDFznNZOAJ0bH1y2CWmpHxtcykhGSi89wQmM +mwCgii8iieGXBawlNPJeAER2FJXymoKIRgQTEQIABgUCPaRE2QAKCRCL2C5vMLlL +XAGuAJ9Y8YH+Gs1xngyJesAkLHnqyhyMWgCfRTMZ7apjOcrXs+0j53vcYeSIIruJ +AJUDBRM9mvANs+G+7cUG87EBAYlvBACUWlrJjgP01FqtwFCaUleVttYBWmjYCXub +Hj+ZU42BCfsRgiB6YdChS2wv8uA9GPn0o+OKIoTv3mPKphHHJKZn3+lhLBDsjghc +B2nwv6Qxv0mMdS/1LjVYxCrXilMPTKWZYfbHHDIeOI/56lwceVFLeHsfFOkuZUsX +RIVoo/KmbohGBBARAgAGBQI92CEIAAoJEF1BSuHgBcnLdowAoIkKRS3UN5p1Jds9 +69DxGb47DutDAJ4/+UpAcRAeU4FUlfOg553W8SZnSohGBBMRAgAGBQI92BdrAAoJ +EGrVbP4ZMRsAhd0An3M4p6RM8Wg3FS5N0SXYdN6fEixLAJkBm1N9j7rVPFrPysB0 +Qb47cFYqpIhGBBMRAgAGBQI92BIUAAoJEMl8UJZcHDrXT4MAn2TD0Ep1qO/PKx6r +7oWdOT0m0793AJ0fZsoJew+uvBEU7ZRia1vGXErQCYhGBBMRAgAGBQI92CCJAAoJ +EPwPhYn4lL4S7PYAmweDkE1fdzHdraYzjkylmrvtKAImAJ4gH2LkSlXMXH8c6IBF +YY58GyMAsYhGBBIRAgAGBQI92Ca5AAoJEDYVIteCq3vRIIoAoPzstX0RqEi9O6Kt +/V3coeAYt+06AJoCRNIdj7Gf9jfQesdixpx27EVvH4hGBBMRAgAGBQI92CMfAAoJ +EGY1tsDeiF3T5lkAnit9whQcSy6TVvtl7XUhHJGT4bMEAJwNAwvXBvNbycwJstzK +P0LFL5SwqokCFQMFED3YI98kDmb8xZwycAECXdcP/A/As+JysKxhur5LcAsZ+QCa +J272Kg9dBvsPr2d7IdvLyJzs7E4C8IXabvjaYAiZrA4cHBS0tEfK2+3WCUo5P5uh +l3zKxhddzNul+2ilqu0yJu/+Ag078qRL2QVfHrrdRb7HWeHhMTjlIXMVHU0lUKmj +dzySe40DNmOgQcRjfd+4vSWW3rUAiV5IbeRE5ZR37ZGDIyS0Zx443VukLwL/oO1C +CA2eiNDhluJs1yeBjs8MzWMsX5P5KV53QCJjOT9IE+xUEoGskUD1DtJCJGbEXiql +hpfw4wyNaxLBeh+mxSVLazg88JfcoNcHEQ11lJ7hKiZewJhl2oTxmPIxPcCshr4K +SETyHsKw2FxQ3zJW/GONM7QLP7wf57wIJy3bKMPkWHgRUeQFjG9/CDdQRz0iwLwz +OWaoLr7JS6oRepB8reukM4J5yb1+a92TW7YPe9r2xznSKWYlWrIZx01hTyRWkQIP +aOIYBrf2gThaZXX/uluJNi97H/wDh+Qk+oY7DVK52i7KA5F4N/yRHIzeh9meLJpM +8oo0y4mMTgSD6r+Sbk4YDYI8QYapkOnppeUW7PPD1JSjKPkEQOaZ/HGc6JZf4Xb8 +D5mtULc4MJ5x4kVsL6cmMyl6u+CFlGPpMSD1J33XH91muHgOPukP/pBzSLzznsz4 +2D6DD113mrGgdhYQIeIsiQCVAwUQPdgkUDGmPZbsFAuBAQGS9gP+OOi6LUmn10LC +AWfoi6QXGBdS5bEMbXrKv925dH8SLa44LKcwG/U6WeZMZKznUPMkCglUCG+LoQoK +WL+MGyHUbUwVDzWKzwsGdOR3T/dROMiUgw4GyciGGFnBfMoIB4L0mdWk7rzN8Io3 +aS4r6Fu3ADiHP8NCLwJvJngS+8in3MCIRgQQEQIABgUCPdgbLgAKCRCyvrxAFSkk +rwfZAJ9DsO1nxRuw/yB9OCmoDwqjQXZkEwCeMczpSwyDe96Ocat18hg/nJUPsTSI +RgQQEQIABgUCPdyN2QAKCRBVkeLAZmTAeM9wAKCh46jDqmzsLMkYaG7cJxk2blX/ +EgCgiEmEEAAa4dvte2GQddnyV6ZGZoGIRgQTEQIABgUCPd09+QAKCRA0SoRNdR1/ +JwoHAKDJK83QGRvh8bdVUhJZzsbJRNjglgCgmF9Xa1NIrqMDgp+it9BlETtYRf2I +RgQTEQIABgUCPd1rNgAKCRBMxE0AEd+H6QwjAJ91JzeXNaCoxAYaLxFXVbjUB0GU +7QCfc3Q69ITy1wYaU04JZaPjIrxgYIyJAJUDBRM93SELZLDNBRh71o0BAV6OA/9u +YIcNjG3B41EwpdeiR2+xLjsbBAIek3d+Ojuf+oOmk3tdxRJ5Irt0x5twaJ8qLAMh +f6oxu0C3rg6r9pAJM3aUEhu+KondpcnMgtrHew1qDxaegMqeogwb0gcBdJxYlwY6 +EuBU9PROHwhbNw/Ger3d9f1L/JgK85Kdsgu+6VC9O4kAlQMFEz3fjNLurUz9SaVj +2QEBTC8D/RZ8sYP3QQvx9EZxfsM3gPlkXDGzfV3WuC/40pZn/p6BxXzeJommIkOl +/7voAT+a4fHlWkkPe2gOJbPwJqYnNg/owAMhQFGbBCGPnWtRK6t9RwLRAleOJzkW +GNH0oj/XniTl+Dl7xN6ZZQ0RHIzwJrzxPQI1S8tzeDx2w05l6mOsiEYEExECAAYF +Aj3h7m0ACgkQMTY05LuSnlT/5gCgthoEVzwmErtYzsQ21Njy3hoDH1cAnjyCEFAX +C216923CIpTeQowdhHfEiEYEExECAAYFAj3kAcQACgkQ7aJl2DRYeA7ayQCZAYHb +SiLL9Zctr4y6UCqU3AhPbqcAoMJ5tDR63Cl1jbSxRcvhdsPaxVFKiEYEExECAAYF +Aj4Vs6MACgkQWnWq/WQB8WGyLACfT83t7Y+df2bdiyVs9SKOipgMg88AoL4i1IEp +1aMwRStOCSkGrqfGcbNbiEkEMBECAAkFAj4NNfoCHQAACgkQi9gubzC5S1xnSQCg +nq30ULvQwLVltJ9Nq15HMhcV8a4An0QxsO2gBI+LlgZZg3knkpHHAU8ztDNMYXJz +IGBTRlgnIEVpbGVicmVjaHQgPFNGWEBhcHBsMS5ocnoudW5pLXNpZWdlbi5kZT6J +AJIDBTA8xyNNPo+38viDQdkBAd07A+dAkaK08KXYxLiO0AuO8uZLsD+n5dxSMtpw +zwk+fRboA7qWAzmDp4+0w09lSrxP77M8M/NMKVRedFPKEM1xQftkdhSqhq+5ZguI +8FdDmrjBsRV3lR8MTfBEuNE8d2SZB079qnZd8pOhIxdwA2AODmswzpwZ3oOEcbag +KViC+4kAVQMFEDD5fY4JNGLsuYI5PQEBW0kB/0s9AqawHqJ/0rO9jsMhk3vuHNgw +VF4DoKTL5EDIORETccAf4UZVJo+JzmjYxc1f2RkwkMkk/N9afKZmcNSYzteJAJQC +BRAux7auD0cvWzTXTcEBATNVA/jU+bTUqnlZdrf6KgCv+hDOs6VO538cExQNsBl7 +x82Djbp8Q5t21YEV8LiFN1imuLYqHXqDEHt7qtroNaBYXgnR24QjI3urel+kYMib +ZWxGrq382C2apReaEDmQ1qtEzP+kXexaawAzKMo8VKWMnXjQYBLZohuUqfciE9A7 +OQF1iQBVAgUQL9JDvxEZCRz6lM9/AQG2xwH+IQAJZEvldNHzeikez18Txy12EnJ9 +k+za2rjPVnlX7+teIY3VNO1homUgwqjoOHpZkdGgdOdmufOglT3Rqrk5FYkAlQIF +EDD47t0d2bZ4cP3XsQEBdGsD/3F8CAWhAI+A/0oczJ2tzUPxDOGk54gB3VSB+Hel +IdkcAwqGLeh8BD9dcXwcCOmw1pUIXVIA8xjl5jsSsb/17YuL4hzsDtSqo0bRzsg3 ++ISP6LtqdG57VzGeclb9FmpMlu5GHeysU22HfwkynvBwfvMJI/IdaW99SSaF81rI +JsF4iQCVAgUQLs1+vx4pcI8ahJlRAQHwXAP8CKLDWFLJ7Fc3JZ0MnuPxW79M9nRQ +wL2TI/Vd4lCUSiDOUdEvjU45MLmLgU+4OZNPeXaBSLkN4z8PUkxGEEvSeCFE7u04 +VNq1GJ2aC+fHVFzuWbp0LsezqDSnm6xvBxz40yEaZnkXu3+66kXZV/E4BNIkCaB5 +V2qXxrBIg0D10iCJAFUCBRAw+UUZPjTM7Dn4WRsBAah7AgCIWR/HNt+V20bDueCO +9mhwGirq5E7TJU+C9xT+3BeZXmyy/AR7tWJdKnC6laGDLnMko3CWr/XRKD+rC050 +nNsriQBVAwUQL9M7ykMGd0cf7QM7AQFbNAH/dXBIx96GTyGsnUmcT1IxdUhN6fdz +Z2OgN5imUdb5HsBurEalWuDDuJcPMPAFO4Htq78LqRd8HhdWfQxtm2rhpokAlQIF +EC/TPkdGsYn74N6qbQEBe7QD+we/Mvd4GqIwzAvDcH4jSoe5eXAYdDjQPltYNzu2 +CxOVu2f3zoOB96Tro56lOx9zbAoZg8bQSkCCImV6ZzYODbdxe+ubfBD6zJo40CeG +uvvAh35l5nzUlqjzHY4CVuMpDJ1GrBoYBdWfH5TTZHx+YH1vRq/FHApYCqmucb5I +QuXMiQCVAgUQLxgZ6khfqy8j2SvjAQGc7QP/VHgeVQzjcJSPF2KfNyKM4nFE17uJ +5emnvE2f1K4mi0NV4IsNEVKmYXYQVvQoPKhfZtjXzE9P2xa0gxi/heKBIHB+5H5K +n4nUIt0/7POYhltkFz7cbnEzqeKm9oqXUOSFKUup51bh2aDWsqAI5dgod3MdRxqd +40TiuShaVXAbmuGJAJUCBRAv0bftSUmmLBOdkOEBAc1GBADKJ3N1BTYxqJ/Bf6Jn +NDzwN63x9iEuht9RTen0Wq1tT8JOwlpcd8IB5uoDvcX1eZQ4wSfpVZm5i8/9TGYY +OuOnhUW7oLQWGzl8BOs5jaygYXIVbnlTjc8FjyAPAWbUdi8OgopADoSoJeJ3YPDz +vFFIPIIdFVChkzwytDCke2QqRokAVQIFEC/SFz55jBgMe7ddiQEBqSAB/2a5delC +8N/4Je09dRG52wPU9y417g+ExtyBnhFd89cG0adtu8jddmtz22rxCiY9Zn1q2Wk/ +PV7dbJmAWiMF+GqJAJUCBRAw+ULYhWrdG2nWnOkBAQUwA/9AUqFQsXW9kMi5RooI +TiQbRynunPh2aqadVnuLZoAhxp16c+EQYpc4Qi6jLPBVemHdS4PW8vJegF1pJtDZ +4VfLNwwkIxj7Y0hU8A4BcHUIfFdOER7SwbW/i7QTU8u3vNHfmgIodv19D7rFxEzq +qPxMHRpIs8/IOG9L3zc3kV8rnYkARQIFEC6+xa2V04tRZnGpVQEBTi0Bf1grk33L +BHO89ViuQTEJbQoJzb7s9IYpjT9hcT5eIOa6t7vItN3aj27lcH68Us8vpokAVQIF +EC/S7ZyZNU6jaP3/TQEB25sCAJyZCXeC915C4DbNKaoc2sIRd2aMgiW05ZzxYUI8 +mMO3pzZwF2a7Cg5iSdZYYMwpe9OWHqU+AhXHd+GWGhvHEUqJAFUCBRAw+M4sm9pR +g/CEGxEBAYOpAgDY/Zq9tIHGEWeHg357k0pEr7Y7yqMdBLTPlJwAIIocVKubzQmQ +xHqIWUmQUf6dqZLXErvnHZOWwRR7c5GjU7fNiQCVAgUQMPke2r6CRZdmbMmtAQGO +zAP/U3CbvKhXqyPupOIppb1LcNAPcspe3B6IN1gXSWn3rUhaS7IG6vhpgE1E5Arz +bMVCoo0p+yb4Ve743oBhDbMRQkRSRP1FCCayt9TWrTrtmij51yTlPbO4f7+SqYX2 +3bwa/iOPFVOK3oL3Y0SFyK6007jyQrfYFPaaBfbDu12zobiJAJUCBRAv0zhK5cuG +DKtEoMkBAf+9BACMYzfvQzBwh+a1D17/SPSfO1DBDXx1cwD50zI0eIatz4kLvW7n +OPHCY7tHVW/tlIBp/0+yUX/XXzBLp8WD0E/4s7lPgPjjAwlN+Iwy/fRDhJ/Gf0Nf +03eJjMvU9MeaUI58JBCq8LjnVdtxcQKqapYcSogjz//jD+H3KuX/kX+5eYkBFQMF +EDEsVbzwiYRjAFcYEQEBVCoH/2OA43qNfPmQH69ASpdeD9vXSit6fDi3J6l4eo7g +X00YlpxSba0Hxh/cN6UL6YtkUbg2U00M4TuHjqtoOYMvTMrVNYbS0VaVcAZ5poy0 +Vs9Fhqq+MuGVC24N4WuTbHwaaXYBypOWPgabbyC/9+2QZM7ZIgV37NGW3N32UeG0 +lNcQzhPh0tAaHzsbm6n2awmbwIzAguTSeEddx/MZ2IOjSkAgKjn3gjlVpBp3PwSu +1QKzF4wvKP/Z0A82Nn0TyDT5wm+H/+D7p8DqxM2usy8V34Da2kCdfW6D2/6PQwZb +zTlpKvYEplZ0xJKqxDLYl3d9SgFPy1QkR/+9Jse12ZBefzeJAJUDBRM3qDRS/S2Q +kqiQeyUBAfIXA/44omiNe1tswtoLSbqmatLQQDliRtXu0OzXGnXxkKRI+InHk+aU +ziuuJr8l1oTFFKvbxKvEjzaMJNbOvN9LkMgEH7XKOcWfkbk+WWKj8d32pLuUNeh0 +WgXiUBH8crNeEhDD+yvH4rj+Ihy5ly8E4TxNBLFANFU2labWkMMLaOa7iIkAVQIF +EC/SVx/9mEr5stbwpQEBz+sB/2uYnno7jRBUPzTf5tTXNKJITXH4VRG35x4CyjOq +j21oWhEgZdNrwymzBK3IAuckqnIOQYSdN9F0BFVC1wTNgmeJAJIDBRA8xyMUPo+3 +8viDQdkBAQiAA+YlSJjf9yMCd2qZ8AYhGVF3PvN0KIaxSFVDVLoCbKSJXTv/0biX +1MPVHIgVjQOSWe9uVfWgIzhogTBmQbymuGGZOzCejzoiVXaFwcM2Gi3+bau3+Zcg +3qMp4E3oUSpMPjRu+JPXS78sF0SkRbkJocS5znUVnthUSC14Dprzf7QzTGFycyBg +U0ZYJyBFaWxlYnJlY2h0IDxTRlhAYXBwbDIuaHJ6LnVuaS1zaWVnZW4uZGU+iQCS +AwUwPMci2z6Pt/L4g0HZAQHWaAPjBALNx2Em/tfMwY2tsJAmcvTlZ9IPXRp1z3Ll +03pL8cu6WZwhMN4ej/BO/noZYTCCk0M/3UyYupSrhuVR8R+N1ds3FBZbX29bP/B7 +9WuOEUmaesMhLli5mzNs54dTGAExbjqC1ZnescaiFcIEZy/Ns7kUA6rWbhDywfKG +aZGJAJUCBRAw+UKqhWrdG2nWnOkBAeh7A/0aKD0eqRZ0orAnq05T4UrwyNoJdh1D +BcNAmSeSSlZY+RhQ2aeY5dMoYAhQsHhbhO0VIDDpLxnhKBD2XsoqWnLK1SHDtumg +kMnqy00HeiU4DrghHhL5IwcIqjq1TUhDzOU1j80HO0OyA7Sk7Ak/sTRrTuj4tvgK +2WqHWU7aeLV5AokA7gMFEDDhUjOK3WTWEs11KQEBgTUGwQGH8Ic7zNaUlRmYm5J8 +R375iP8CrJ/xILbET69VsR2aDG2MA2z8NBBkV1ARrAC2YWa9sO91yCyf3NAI6I1o +qtbv/09Im/s0bTu66dWrqRAiuTB3Ou+gHJ0fc85gTWcBd9/xS/mNlZb1/ZXjkBaY +dl0Bzm72c3+HqZjHzT3nlxVY5HCi15J4iDgCuCPzeo1r8QgGmsbP7fD+0Hka7tlX +b87WxPZt+nkjGS9xmLrNHw5/vJpcN4+fzevzhTQD8IcsUr0QcZUH9jZpm6xWpibP +F5z7FzXTorguf+WJAFUCBRAw+M4Lm9pRg/CEGxEBAd1UAf94iAKTp+jf8y/G7sgR +J0Msz+jOHXjK9nPoW8L9Uq1KnnWCiqxXmMj3AoA0iOict47sYm5uM76Woe+wRWwZ +D7CkiQCVAgUQMPke/r6CRZdmbMmtAQEP1AP+Igi85SrIpEFaMeAkPvOiyTENAf9h +WEm7n3OgIQ4kbBcU8uVPdx6Z4wJpUtrle+gOcthZn9t8jmcV328X0bDBuY/z/Hf1 +nc3bEp8mkPx4fmKe7kDC0iyR9eOZxmFJ8OC/ZekBoWKDPfAgG35duQ9HEknF+oPm +gnXKzSo17RTqOPKJARUDBRAxLFWu8ImEYwBXGBEBActWB/9xboWXOY54i8n/fIHu ++FI6WmK+djTSIqfPMKlYs5qxoLg09rOGo0h7AFrTUpK5qYiJxiTNeTwx5pOrkRpB +8nID4211ZKb/f+K8pag7gpqoltU+fFoOcHYoEf7aarQEnitLiLaNVm6ilu0wAdX6 +VBQdpUfzbphoU9r7jbkD8f45qqfYR2QvzR+kgmwAKy51g8MYIpLfNwyOylUrVxeo +1EPMg5nwj9e3I0QmnDXJEZ+3iOufiWP2NTjLS/qwU63qOm68CbJE3+l5vCNgnDVh +7r3swySfScRp8fnkS35d90E5g2bdJv8naDyPYlVWE3okq4VjIzWS8rXdGTLdKIs9 +TMP3iQCVAwUTN6g0Of0tkJKokHslAQHbHQP9Fq5S9UeaqdsUY0cEkKZzkQpud3CB +FRL5uNy/TLEikV2yXGJlqKyiKo1CpGs8sIjprs/ASVN9DTNvc+86C4szLjNgFRq2 +m52ivF4OyxAgTLQCQ3KEi05SnM1SgC/OKX6rPR1Ss0w8C9UQP+jeKYL21UJjxUtE +08npogtN5IgjNrSJAJIDBRA8xyFgPo+38viDQdkBAQ4wA+da39v4prHsJRFyCimD +qqOaMBA31weXM9+VwXtiJK+xYdY2W1WHuk/LgSEiCG3XRI7SkdhLSA+8e9zX/8bX +Z1GfFoN2iBxa8Zx+s4e15e3fwFPqnpOOGf1g5pOtPgrrT9NYgOF9w7GuSfVUk4Ks +SVuP33rURLGnfY4xupUk5LQlTGFycyBFaWxlYnJlY2h0IDxsYXJzQGVpbGVicmVj +aHQubmV0PokAkgMFEzzHJII+j7fy+INB2QEBI8ID51RHz7Ph6vGOZL++1VlLq8UH +ynvnTuhlFwsGSrsdD1lZs/NGUIOrAt6XiDREmdl6EXXzynzVvgt1a2uuvWXd8LLC +0iO0IvVgf9VhejQu2Hy7dkePWSWXr6WDk0Np3su214B9Wg2pOuNnZI4Da6ZQhSdi +PiGYwHpsMBwQMXj8iEYEEBECAAYFAj0DP0AACgkQlxayKTuqOuDjkACfWbR5le9Z +2r7pQYjgZoxnwdmHQcEAoIKxUG3XN+giUetPdAzKUcqI1Fk6iD8DBRA9Gbyf29JF +/LOyoSwRAndOAJ4xoxylpNNYHf6uCYArmxQTxvwP8wCfXiwiBYiLgJreewbY4N58 +Z2qDy9eIRQQTEQIABgUCPWeyzgAKCRAscOLGRDFznK7lAJUeHMiB7cf3RR7FrvgS +V5CnCu5qAJ430yl+G052F3d5eMpNx8yKYJob0YhGBBMRAgAGBQI9pETZAAoJEIvY +Lm8wuUtcz6YAn0N+Tu+fDOpTCRlJ8XDM7utgansJAKCcaWk9WmhU60dp8MLfmrdT +k7tTrIkAlQMFEz2a8A2z4b7txQbzsQEB2g0EANQfBdutEsim81MQeLu+7IslJJq1 +fY2oiPxBifuE8qHG8KjwTrrVSgHiPbCAr8YmAYtJLXRmVCO3p726sIEJk5+fhq+l +pLgq4/aay9DwtV6N8Un8tkMU62mV4MVoBfkxchCAvYJFV0JFPBW1Y3YJs7TU3EjA +2lR4pBwhK1s2VO+5iEYEEBECAAYFAj3YIQgACgkQXUFK4eAFycse7ACghPizmKwu +kMGfHkycZ7BMbXZOd5gAoIUTQE9SNhpI61W9PuWttMKJGthhiEYEExECAAYFAj3Y +F2sACgkQatVs/hkxGwC1BQCdEocdvgS3BSSM33sEVtMahZ5N0y4AnRjCy7YlOUaj +rhSlDUUJKcH/9+nSiEYEExECAAYFAj3YEhQACgkQyXxQllwcOtetsgCg5JGjx3qz +e3iguiCz1YeGWvhZUREAoN4wPchwgEIPZQTQccm39Ssr14vOiEYEExECAAYFAj3Y +IIkACgkQ/A+FifiUvhLfCACeNrIoRYmww8AlGuzC2icyAIO4HqoAnR0WxMvgNJ8L +p9vWaHcjSs6au/MiiEYEEhECAAYFAj3YJrkACgkQNhUi14Kre9Go1ACePRg49ZH2 +KmW+vaDHRrbwXdSNGwAAoLejkLTJq6rpFCOwMtiQ4O4+xiCriEYEExECAAYFAj3Y +Ix8ACgkQZjW2wN6IXdPC4gCfYnFZ5ZDlATc/oDFQ7ZhaNKyWBVEAoJhPQc4xbV09 +eH+xDkKKutvPh6LiiQIVAwUQPdgj3SQOZvzFnDJwAQLlUg//Tog10d4EAAmXKRhV +cF8osK1dEZ4i0O+0zd7W84uzngRVPSP9fVjIcKEAq44MZplPQ8dLijlBbMrb+7C6 +uUSphkk88DyGjPUbH5HBUmXIyLPK4A+I5WDTRspYh5zj82PQ8EEgnPeY5SDFoAOm +vemG5Msr8BT1FwdrOPbZnaZyoLDPpg/XdTDFljOnrdQ0LR7qL7yG7UJrP1z2kCzv +S4CJRdcxdaGiPOnl4Yqp7vWe1whcpjBVsmFA/rzrhK/zLHaGn/yHQhi9g3ExK0Jh +kJIP8g26UpCLKSJ57/3ClK9l7vHVDX7g6r4+lKzmH9P8RuOlOjabp6KCwSsMEIpV +FS/F76+V+i4IYCe+lgXqlLbrFodN6FogwhzfceBx4H+XPEf+/Bm/QD3ArbNNbBQN +Dcf45feOJFopmIueWuGVVUiJ4lin1WfRCRZOA/LF9wYXBkEKV+Xje/mkY18r1YFE +5I/ZtaviwIQs6kaD7DerTWpbVbxRv5RaVDIo3NozxkvBZZV+8EXm5k5TXfxy6nbv +dsQm/UV8Ac8MYjVVTlLYI3jS8wMtZMKZV/XRuw82syYQL09a1hTQYyjbeuXEGYhN +6frqSoHl+1rNFZ/Y74Oah4oPb50lH3kW3OUWvH7xORcCmz89wwNC5FFX6xxKpT9d +MlyoPcuhd6+F67meaZjqwZ8KwdOJAJUDBRA92CROMaY9luwUC4EBAUqkA/4poVCt +2CWOvGyCVg9CedyT+F552IzQuWM2BsuMdwgfmEbzz63G6ohDXzN9LxF1E9hqe8RC +hVCR4EYkVV3SHwK6ZKKU2TTUcf9PR6mZKXSKmb2eEY1PrmgmfQLtONWXU28v5PZl +WseLXKnJsPtRhDq3ybWRUETNrYkzggb8xpWeFYhGBBARAgAGBQI93I35AAoJEFWR +4sBmZMB4+6IAnjFQD73eU0GAv1G9FcrxZkLLK5+uAJ9QRU9eaKbh9ppE9XB45Yp0 +l6uLLIhGBBMRAgAGBQI93T35AAoJEDRKhE11HX8nensAoJR8foKDOiBir79UIAQI +aqKZj2q+AJ9byxSuWrEYIjLgNX1n/6gKkfz/3YhGBBMRAgAGBQI93Ws2AAoJEEzE +TQAR34fpPQIAnRw1AOmI/Zu2jIF7gs9lYDT674zCAJ9Trf3hkd6fJ6Ht0TDB5Afu +4h3r34hGBBMRAgAGBQI93SIKAAoJEFz9N/rMeMiTfIkAn0f2xve55OEI2swMZtY6 +khgTslz4AKCtFr6G5Ao1BdOFkbLfZ7e/EqieEIkAlQMFEz3dIQtksM0FGHvWjQEB +y0IEAJyShUw6Ce3rhVoWxsu1Y8trO54vonyZ/Fvi1iVfWThK7HOtY3n7FbePg7V6 +riUV4oNWVakIgABi7uO/g9r3pcmBmifUMPKz0Qjo6+evA5d3ZalcVRFamSFlBRCr +VRzVgL9JRkWvlb+nh1gZc4zaLpynsG23v6ou5rXa2c0/cyQwiQCVAwUTPd+M0u6t +TP1JpWPZAQGwuQQAo1u0FeIUyYCczjgqvnmVGSWdy5eEV5nW9OxhsOJd7wjEVDEZ +8iHprLLcvOfYdNxx5yLkh48bPFzuey56HEz0QVWK0Ezr32k9WygrpbsDLdApGiqG +umQbvfLdmmk3F9Llyb58qLuVHyJGa1l4YYXCQOoLVMNekIhPVULh/XVxtn6IRgQT +EQIABgUCPeHubQAKCRAxNjTku5KeVN52AJoCU3QuScdnWAKYXH+KFNni07/CswCf +XZXXuOybaZLZgjCXrK3ATbZshe6IRgQTEQIABgUCPeQBxAAKCRDtomXYNFh4DuPA +AKCcdiby1x35ME9t6YNfyTgTT50USQCfaKoyi7KNaTE63XH+14o92ikJ+PSIRgQT +EQIABgUCPhWzowAKCRBadar9ZAHxYRwYAJwJ8wzH6IwMH7lo3gYRqduVfH/evACc +CpFNrs6EaZEzGacXtVgnjnwXTPuISQQwEQIACQUCPg01+gIdAAAKCRCL2C5vMLlL +XHbbAKCsKVO8v606BEYa2TwRlFqgXq21igCgnqU4zpGi7HKxMhEqhe/NaIL2dkq0 +JUxhcnMgRWlsZWJyZWNodCA8bGFyc0BlaWxlYnJlY2h0Lm9yZz6JAJIDBRM8xyTM +Po+38viDQdkBAZUGA+dj7+znMU4Q8yWMiPRL6RSLKCWZf3IPHwPgRoiIAKy6FMOU +vWC4TbduBqcApI7+Xuzy2V6HLSlf9XGILj/aFI1zw905705ON2fRKeueBrVZ0576 +izfTmNxSZit8MTt9rQWInnVhU6omrTCqzdVJTu2lTcAeeAa00kPm1fvBMIhGBBAR +AgAGBQI9Az9AAAoJEJcWsik7qjrghSEAnAu8h2Wz42zg0w8qQBWCKK8U0RGKAJ4y +PTXtnRyKse96SwajcZGeUQwdTYg/AwUQPRm8sNvSRfyzsqEsEQJZHQCfSsP5J6Aw ++fgdHGx1KiYf973EYYIAoNxaj5ZrXhKG/+9fEWEDNNkqND5MiEYEExECAAYFAj1n +ss4ACgkQLHDixkQxc5xvcgCfb5ua8g8L87M9risSGJX8TrWTHc8An12HAxgXcMdd +uIEag3T5FH7lU4cUiEYEExECAAYFAj2kRNkACgkQi9gubzC5S1zOwgCeJRqvA8Kt +dTW5ytZe2Pk3Sj1JhFoAnR/XXJxDswWiIfsmyYamwlRfZ0joiQCVAwUTPZrwDbPh +vu3FBvOxAQGQjgQAhBKgFpJtp2AoEXPh+5Qw3VA9ooXGUmdI6XvIWRGPL+cduO6Y +Fz3JyvD60P/kBVCqq7GaTPCKFeaedpZbEOa2FdtuCi04sCgLX1DO97JhdeW/+7Oe +bnIt2yGd7sZH3GDOy61VI2iTxrvVWzAFf+JLwCByvOprFLly860Gy7jjbvaIRgQQ +EQIABgUCPdghCAAKCRBdQUrh4AXJy/NlAJ0fFmMipOTp6vslz2O9spLapldGxwCc +CJ6lzCXC32O5QCSOEkr0ab7ZXeKIRgQTEQIABgUCPdgXawAKCRBq1Wz+GTEbAOLM +AKCBYhZPY2It9Gs4OB9InCJo4FLtbwCeMKiPDrlf51uUKOLsWh9ClNrY5baIRgQT +EQIABgUCPdgSFAAKCRDJfFCWXBw614gTAKCUmNiiyFPS49Ba7cs3HRvpQZW0ZACg +wV7OY3Em3StOxlyrC6dsbjdVvgmIRgQTEQIABgUCPdggiQAKCRD8D4WJ+JS+Esrp +AJ0SLYNh5KZE5+CICruBXMxkCuA4JQCfa6K1vj53RYafQNH0xKwFZEGh0JeIRgQS +EQIABgUCPdgmuQAKCRA2FSLXgqt70SbiAKCmuozsDmD/08yLEvdd0V+s7X0yJQCe +K0NausfA2RcjMUTVul9YzjcMF3aIRgQTEQIABgUCPdgjHwAKCRBmNbbA3ohd08DG +AJ912o5jWryb486jhE6VtCET38+AlwCfe4eA6J0qr/NrZLQUPOcuCWfwPACJAhUD +BRA92CPeJA5m/MWcMnABAk9iD/99S+k6PW8u+F/wF5ZmBQAtchOewRw/q+wOC66O +BZbxIGn4C8R6I6vjHUP+e6zdjABWqfFAqwlYEkjm60MPBm77Of1Bd9NAEPpzg6zI +6WOQdg7jCUMbZOrQ5HCSCvo5qEXaCN4qvVLPjL5MamTiQio0fdGZqUL+Xtz5Ypy5 +/K5aW6XKfLuFpIAvc56mSFHNKjFYi+94+avI417s6P+MPgijz5zbQkZqbrLaCGLX +njZVxMX/Dz+mKk82U0oVsQL2ht6TXQWy2co+KAMlDCKZIOJVfCJBRjeo5/vfjMad +GuDPnlKTJAZe5gtATr6jukvllg94UxwUyv8bFsV+khBKdd5gvGwoPgq2DTSOVbk5 +FeZRY7SSMHMPsqjl2ARHArNeYR3S3maTExwTkWKAHifNY9SUuscoyVnlNFPhqRDz +oLbH/TnCNBxDzf8ZqdEjNpO0nhPm/ej4edGj495Pgt+6m63B2dtEkUYfpnf6oS9h +ubCfTdVbuJBihySKtL2LDTCuWnySsj7QarNFXYWHQT/Lj4AeEXxGeec/z0m1N7De +5wmdO8qjZsi4810xTj01FhmUm/Cf4ejnP+pnF1fU4biOHTML0lSaBvk9qjU+uhoN +r28wXYKVq3vvQn1kXUWWubBI5k1TnpNPxIT2cZuVySxalmtIAHtI8519oOr8rJKG +PhDgzokAlQMFED3YJE8xpj2W7BQLgQEBgtMD/0kxmNPp2SM3hzv6ELGLPrhluGA1 +f40+tvea157/xcGYDTr7370KUoKOAG9eGsjtp9aCCOUr/zBdrdMdkdEP4VsdPNUF +MqvS+DU8DcqaD13Tjkzz7+TqTO8Q/iYvPjd9khXNlk8zPh+a4sdaoaYz3vAzovfj +A9QlcWXgy0ISToYhiEYEEBECAAYFAj3cje4ACgkQVZHiwGZkwHiu1gCcDf/xdDgy +zOh2gxa4vdxe267zd9YAoNurihcjNyCAF/iK41q2Kq2rJQUCiEYEExECAAYFAj3d +PfkACgkQNEqETXUdfyfW8wCgpF9UPAyc7cl6fJkiHBvonLpW+JYAoKCH86A7kK0b +nfeQLq74LgIk0xG+iEYEExECAAYFAj3dazYACgkQTMRNABHfh+kk3ACfZo/G108n +HpPjrQxOLRVsGw9d1OcAn3ZxDF5jXOdx3/WmQgW55+qQcKfniEYEExECAAYFAj3d +IgoACgkQXP03+sx4yJMoQQCfVxNJAYt9MBJhFmR6JPAC9l+1ckIAnjyfT5fwq/dZ +2ZFX7DbaihqDu9mgiQCVAwUTPd0hC2SwzQUYe9aNAQElxwP/VDAgsM5UfwB5UX/s +TR01+8Qo9C0rlEES/P6BXOIZGfBKQ5b48c6FnbSQaPV9ofWjim2Ypu5htAXj+0KK +Ujsfpx2AUia1aBo/c8p5mGe/Ts8vkIGMLkzUC4LmtXPRPc+ytyJQuiT+NXE9ufY0 +Mn6i6mgku9brMAi9NIqZnNdPQH2JAJUDBRM934zS7q1M/UmlY9kBASVaA/9XCoos +OyUY+I3ERk+oosbc49AS0K837NkqvZGabAGx/Mwf2kL1naqerdMCS1wpcccYkZvi +W4copWlDb9AfRr1C99CuoPX5LGvc5gKrNVvsOUrGrBBfhu8vjzOwD0k+eAqvegLt +MxfkCjM1Ap3pZu6e4sClFIuKEOmUSQcRdtYMN4hGBBMRAgAGBQI94e5tAAoJEDE2 +NOS7kp5USlMAn0XYhqQFMLM/tpswZqkIudQDFeZNAJ9SuhSeAjnPyM0Qb9xWik6/ +CLsn3YhGBBMRAgAGBQI95AHEAAoJEO2iZdg0WHgOP2cAnRcINt425OHmBhMm8uJF +Q/PDOYYNAJ9Nw9juAd6Zqu1N1vx9HVgWluNSEIhGBBMRAgAGBQI+FbOjAAoJEFp1 +qv1kAfFh+KoAoKy03qRC6JP9ehyNTJm8TGQ5uBDUAKCUvfLtj/ofHRhqDE60RjWV +MLLBPohJBDARAgAJBQI+DTX6Ah0AAAoJEIvYLm8wuUtc4IEAn2T1HffAKkajXTJp +Hn+RctMlc3txAJ49LFjccadq2/QGIPU4aVmPOLGk1g== +=yvlm +-----END PGP PUBLIC KEY BLOCK----- + + + +Type Bits/KeyID Date User ID +pub 1024/28AA55C5 2000/03/02 Daniel Lopez Ridruejo + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 2.6.2 + +mQCNAzi+5mgAAAEEAKRyfbHaGoNuWwHVSa/5mRbWdhDTkR26z3Uwq4KdCZ2Wp+b0 +VF4Tfh6d4IoK2jXKBUlUfq+v7FYzSzYdPCmwB9L9cHlaU/ItfcWD2G7rIHyO/lGn +VXK/BGUPoOhT2yeO8tf6oe81hmN5VzqqhG/SWEkwlJASRX3ApyanqCooqlXFAAUR +tCtEYW5pZWwgTG9wZXogUmlkcnVlam8gPHJpZHJ1ZWpvQGFwYWNoZS5vcmc+iQCV +AwUQOMAjHyanqCooqlXFAQF9swQAnVrUersSbO/SrT+nnwgRPL/xRMjGCQe93gUe +JPcOOYU2be1tFGynJl842SIDPTHcJVg1hHReO93K4jvQKsbmT5zrzIlQ7hVB2u48 +WNcgsIKWIxcGaMp4+qsDOhN7Fh7vIEZdRRYhL7YcGKZ2WnXOZnGsKSD8VZenycwQ +cAA4xkA= +=3hIM +-----END PGP PUBLIC KEY BLOCK----- + +Type Bits KeyID Created Expires Algorithm Use +sec+ 2048 0xC808A7BF 2000-03-09 ---------- RSA Sign & Encrypt +uid rbb@apache.org + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: PGPfreeware 5.0i for non-commercial use + +mQENAzjHNiMAAAEIAK+iTnKRHymuUYmRRe6JlH3oN4GfpakM6CITpS0aM/piJBX8 +MNgcCUK2tz8MSCqAlfF+2r0hGRMSQ+UpXqLXcJaCkGIvXtlKmxCcCX6R+LDCnzoa +QvOar3+rKFFJyiauyV7VPucZZhFKesReG6o53uoOAd0jyzcV9TdpAIn4Xl8W617T +L98GdODY9jK0zfgGo2bSgPpo2YswlDCGbYzRX6bfEGmAbP4t4UnP1ikVCE3NTIyz +gT4kywMb5AT1Tm3FbwTx7rXc/nL20t22VTJMjyCxqPrOTs91PxdXyTAQUKY82x+U +ZgW39f6aKrJHDEJtxOyym+B5NpYgeP5QQsgIp78ABRG0DnJiYkBhcGFjaGUub3Jn +iQEVAwUQOMc2I3j+UELICKe/AQE4yAgAkNXkalNn8Xi+v3BFCmHLlB7PKlItzlS2 +PnMcTJPgzO8w+PyXc5lzS3dnqLEBoCwRazEZh8ncVbeBJz1LjQU67gvCBqyFl+3n +r+Z8k6cJYw1AzSK9FLAgOEtG8IdE+jsPq39xORpu6Dhsuln++G1xaK6fePeAEgR3 +qH7gog/SFCa9QXQd85wsGRlQlmMwe/HDyoRd/iHg3X7mr4yB+zYkxYKDD+TKlSqq +V23n0H4n3oTI10PfaB8LDYVuPiQvIRn08XKUv0Att1KPH6iJTIJ/KRbZyGb2J+1r +RO1nBGw+qaOAw4wUQXOpJyXVUeanIt1tSe8Gczlf/uxJZdCNSpgeqIkAPwMFEDjH +OY/9b4jGIdCnGxECdl8AnAvSwMQ2v2ryh2NLL4FgfVLCjb40AJoDu0jaEqUinZnp +oMBmjFgtsDYp+w== +=5ByY +-----END PGP PUBLIC KEY BLOCK----- +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 2.6.2 + +mQCNAzjJAagAAAEEAKkko/H+E4+c7OXgiNfBCwlU/PrxPovDS3/JCKuILnflbNtC +Lxbqvf7LccZ4LoiHOKd3+G4V8BgaTndqADx4crEsS0BpNrJdshPmXajzkdQeo6jN +nts6QJ8/mlL4Q+s2/8dnleCrgDkzP4DpAIRGK9OARE/TKmUFUonO2YYGoUwFAAUR +tA5yYmJAYXBhY2hlLm9yZw== +=dGNO +-----END PGP PUBLIC KEY BLOCK----- + + +Type Bits KeyID Created Expires Algorithm Use +sec+ 1024 0x00ADEBF5 2000-01-25 ---------- RSA Sign & Encrypt +uid Marc Slemko + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: PGPfreeware 5.0i for non-commercial use + +mQCNAziM6n8AAAEEAODTLW2h2homp9NCjlsNdQQQACaUgrEm0sO0Lr1BVSp35fFQ +a6XtrIxQXwcvBqM0py1ea2zcmYqnv6vY+7i6sBnxiNNugH3ShBnOYeCaO6AzQNaN +2OvLkB7+1AoDmbU4a/+APtLrhzYzUj4DmwSmr7wTwdO06PsdM1Qv/g4Arev1AAUR +tBxNYXJjIFNsZW1rbyA8bWFyY3NAem5lcC5jb20+iQCVAwUQOIzqf1Qv/g4Arev1 +AQFTZgP/Q+/pcNsCncKr4x39f/N5zXine0zQaKY46ek+PCUrhDm5N8cFTyijE7V0 +huRDVENAFkwtznz/H7BN0vtMRlvUQJOPFa2UaN8zIbcMIzSbiNEx5nvfFeT/Gr52 +GtnrQ+BvczfaauJ0Zw4p5uq6na/+0iyEf17d4qrhIBftlO3Ti+M= +=+laC +-----END PGP PUBLIC KEY BLOCK----- + + +Type bits keyID Date User ID +RSA 1024 0x62C48B29 1996/01/22 *** DEFAULT SIGNING KEY *** + Ask Bjoern Hansen + Ask Bjoern Hansen + Ask Bjoern Hansen + Ask Bjoern Hansen + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: PGP 6.5.1 + +mQCNAjEC6XcAAAEEALdrW5rH+2XOKX2zAPQmgomvHGADJedG4Dxf3Ci3HpGmKazV +Uoo/f7Vf21ldvBBYC2CMpJU5uiMstNdrJ8Rx0KDBH2pLXsfE4XvVm8cGLbHcJycj +cZsYl4yppOufL/76kmpP7q0Jni/pXrkYg2mLG3lCN3JoZqX9tvkoKP1ixIspAAUR +tCRBc2sgQmpvZXJuIEhhbnNlbiA8YXNrQG5ldGNldGVyYS5kaz6JAJUDBRA1eczx ++Sgo/WLEiykBAZIjA/4+uCJi5WD0p3EFzOnmkZRxf8egjQlFdBDVR7sixVToZCze +oZZ9EVianFbwv8XU0McA7FLSUala0FIxRtmOs8/yN96rhBqJnYfLxu3b/ZRpBf4Z +UExXQbussUX7AsPUmFim9Xp8mTy7xDEpcfiBnGY9Dtx+nmSvyLO38W5VvKP1qYkA +PwMFEDV7CdYJPTjw/8ByixECHSsAoKUySg0ht56Rjsct6ViXjWfVEF1xAKCldK5x +LXMjefgsiuW3n5seRVogQokARgQQEQIABgUCNgEYdgAKCRBoqAGJariS5S72AJ9N +JsXpts88tCq7uZiirWlL54vTUwCg4A2urEUCEPuSz5deMyMX4lpjN5GJAJUDBRA5 +Ix6ndTAZgHu8twkBAZDHA/0fiaJSxGAxIdgYQY1KqYJGWg/E7Gwn87kZyiRHKUaJ +gP4IA4PVnh0rMtTTo+CWyzcqMPjRAZNDW4ECWymrqqNrYgqy/NrcN4h7LZC5wmnW +hXF3HdgAgxIn7m2YQOLluNqIrhVKga5G9/xytZLsF15qZbvjyX4mqToOsRqAtUBI +ALQgQXNrIEJqb2VybiBIYW5zZW4gPGFza0BwbHlzLm5ldD6JAJUDBRAz6gMS+Sgo +/WLEiykBAd9fA/9YdBn26x/7DE0by/Zzelfxu8o4AgZOV0AuWqZJebXKjeFmkJ0B +lZRaC+NUcvpXOcANP6berJknvAMjNfTD1wi89XUVlbisDSW3UMR7Op8EpYjqLTo5 +u+KmyS+ehhQjA3somcJc8fBdnGJZ17cKWEbzJK+oJBvnzpjtgtvw6/oH/okAlQMF +EDV5zQX5KCj9YsSLKQEBbk0EAJ+CwSbR4QQ2pgyXV7U4P4+1xSXa8U6IuI7AX9Fm +LNlDu7a8DnJt8trZxjBcEMZcfoSNmbjIzMotzl0vvtDpqYgKfJ5Dd3eUTRCDYYS7 +8DoYcuB0cunBoGijkHS/2IkucAZGgcnNjPdhm7EnDJ/4F5VR9ZByqXiAIhZ746bs +Z+nrtCBBc2sgQmpvZXJuIEhhbnNlbiA8YXNrQHBlcmwub3JnPokAlQMFEDkjD+v5 +KCj9YsSLKQEBEK0EAJBYAopnB9/dun1G0t+TKWVwGQUi56sWd5bwLypHklf/fy2V +QPjCz9QoI0L/jAguBrqCfwtlIHRHMwzvvNWLRtuA8oiTDl4w2gO2vjy7V3Y4qneA +3U5CYRT/ekvK42d+aHA6yMeHSPlNEQg09Idmee5Lub7kV8ejjtRZ8s3jcZ0utCJB +c2sgQmpvZXJuIEhhbnNlbiA8YXNrQGFwYWNoZS5vcmc+iQCVAwUQOSMQB/koKP1i +xIspAQGtCwP9FFWCZN2540lomDAY6tXt7Q3AhP/CkAec5i/lsv21sUl09jlZQnr/ +Kc8hL1lPOuAlLFGqso3zL7KMVlrOIng+R/E5fcYpE60QhhIoHdvlxFKTJ5GZq7DG +stCrR34q2A4OWtoC7tF0Uu+Ew2ontVgvqsrgq4qt0h3yh/kABp/8mRw= +=GGxP +-----END PGP PUBLIC KEY BLOCK----- + + +Type bits/keyID Date User ID +pub 2048/10FDE075 2000/10/09 William A. Rowe, Jr. + Key fingerprint = 33 16 9B 46 FC 12 D4 01 CA 6D DB D7 DE EA 4F D7 + wrowe@lnd.com + wrowe@apache.org + wrowe@covalent.net + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 5.0 +Comment: PGP Key Server 0.9.4+patch2 + +mQENAznhOVsAAAEIAKuVs0grRRD6sNsgkr78WHvgpxf7ExaKI/bWEtS7eiFwJ+JE +qP/ceM/zpot1wzUyNAVC+wiOJaj8CXyFrrmsjRM6zO5hRE/Hkf4me4ZviDP2lJTH +suoTIcmSRdY6q3dIFQJVWPeDU2JhjAE313R/U6G/uJ9yVK86YPEC/b5Wr1XIDwDR +GE9X58tZgMTDftYM/1wxeQNNF9kyFQky/45H/iXOirj52RI+gchkZfgRbfTSbF8r +zSvs+JTHJBiSv4SpcPMq/ZTsxju6BIxb+PVaRVthIGcgRrgSgjPyTQYuPzcw0Zi3 +W3zfhlXCYngtumV9AM1uv5teiKlP9xOoeRD94HUABRG0KldpbGxpYW0gQS4gUm93 +ZSwgSnIuIDx3cm93ZUByb3dlLWNsYW4ubmV0PokAlQMFEDrRq1BTB0fmI+nqtQEB +XhkEAKv4yJlR5l9hxDkK1L4/tW77LPAd+8dlJW+KaciyrfbBw9mphtzCrcSYsMbB +4i6UEIezgp7MGftxSYAB78B/Cz2f0MOntgddqlsVHhNe4b+sgjrgXu/Dgu6S0b0M +09oTvsc6RBjnUmfMlpXcWmK2a0MFpY+ppsYXPo8hM5Bulg6UiQBGBBARAgAGBQI7 +UhsoAAoJEFWR4sBmZMB4zVYAoNJR6RMw3ayHjelXGtInTeTDfAseAKD6npDv9S6B +o84AO4er+DrQFY3X9IhGBBARAgAGBQI6yntXAAoJEJcWsik7qjrgOx0An28zO34Q +FSSM2TkmqCWUdIplhp+XAJ9t2KpAJxanRh978KeU7C8SPHV7rYhGBBARAgAGBQI7 +pXfnAAoJELymmQeGwEBXsHYAnRwiIsFfDoqXdCdQyucm/5a3a/DJAKCtgvY6AXZX +oBcAA895Q3fsjrMFr4kBFQMFEDnhOVv3E6h5EP3gdQEBjLMH+QF/daZ3aqh2/EtF +uIOMNUQw+sF4mxgp7HQvhvwgfbOzT3uczqgtLlVd/a4rcPd6LxD4j7HdNXCJaOn3 +ANgaZkqUyNOMyS5Z3Fiyjq8o1t4lFcFo6Vk5Y24G78OnZ19Dvw/KayiYFcVVoEJX +9WssFmq6VwKJyx68pg2tMfDKiCOG2tZ+LWZnsQd60ceBp3MyKKAHMQQu3B2mo0xm +603JeobTxBydxrJ7b9LXYAcqcm7CdJ3ELutUQr7oQu/bcDhnphdlEjqZqWDQ6I06 +lxU9MSxdO1hpM0bShzmXZwKXClDP3w0+2DG/Udy2Qj/6F7RUNmUkBfiC5HQEb8se +FF18pjaJAD8DBRA6ynRH/W+IxiHQpxsRAnNrAKCS2i4ohDFHz4x4r3zGkE8YhzYw +QQCeJwSRE+py6XqEg+G3yc4uHGVWxwK0DXdyb3dlQGxuZC5jb22IRgQQEQIABgUC +Osp7WgAKCRCXFrIpO6o64Bb7AJ9inF86z/jFF6YZApvfn6qr7sLnZgCZAfEGCtLX +dNrH8cKmm3Tf2wge1CWIRgQQEQIABgUCO6V36AAKCRC8ppkHhsBAV1NrAJ0SlSBe +ofgRiXMWo57hWKiB9Oo5kwCbBCSGL2v1Uw0fH1MbGm94/4h+g5qJARUDBRA54TxE +9xOoeRD94HUBAeOuB/921e4vBxTPe6cFR5EnBJxfTerVSktVGVqn/00PVYjlZ21E +IF2AG/8o0znIPXBxUcGC/rRi/rF+bnsnf4P1rPD8wMEpd6W1MOBQzVzQ33DY5a4D +BaktKwK06vEZuJbTCTLH71TXVgr4SwrjTFLGUnMHB1xnM663LbL/fnLLpOY1Rs79 +dTUsuSbkCgYnA4dXwHlzThWGSpwc0dEwwbdNOzegs/vSV0e2fk6HJB2tnfOYsmyv +PHTlLocaicq//I4Wl3Cx2ouruF241N/nNTXMU12em9G1cTu241tipdlXXzSlhQho +qKyY72qRpYg1HeA18GmIjE2beKWE4Gv7IqlNU1loiQA/AwUQOsp0Yv1viMYh0Kcb +EQLDlQCfYh70u5epjTvR4fSQcY9NpL2LzUUAnRZ4gidgRImYkhGsbqmmcvxwMFyo +tBB3cm93ZUBhcGFjaGUub3JniQCVAwUQOtGriFMHR+Yj6eq1AQGzEwQAgKsP0KRO +htk3QFUvb8P+RWUeiuVv4VzHcwfCFSsfdxWqK+OgxYqWidhJTtBTmcbnfFVljsq4 +HM4zaL4n1HR4ew4CDQ9CFWJYx2h0vL7ncJK+gvZgkHsDOdDtMLPtSOrq0/hylxq2 +fviZQQ+qxKYp4U5rPI3f+RL2k3KHQqGwCyOJAEYEEBECAAYFAjtSG1gACgkQVZHi +wGZkwHgf5ACfVErPDVqxQ9vRdrkZRUc0cLUuqfIAn2dNPjPLSg+jdsz6DRsKmZBJ +bNYGiEYEEBECAAYFAjrKe1kACgkQlxayKTuqOuD3LgCeK/rmg0vWNyP7BYDZEdUa +hNdi+oMAnAhax0Y/HeJ7FiTK0J8wVrS1HhWviEYEEBECAAYFAjuld+gACgkQvKaZ +B4bAQFfnRwCfXw1NgX1fJXT5aXKxIHrTms3+dgwAnjSlu4dds1jxMreB0iTFuz9z +sVR6iQEVAwUQOeE8IfcTqHkQ/eB1AQEevAgAi9jAfi75hpYxTkniV6fo5x7Ftde2 +zkZZ4nMo24vMkiEQOcSGv8/IrAYFWOrUPRBwPTPH9AzcSIlrW9lAYEqKOns/1Qva +6adU3EJ//QY11zzaT3AEp/rgudIIsIUeGisJgGObSz1lOtOf6AHdNdhfR6GV1SKL +h5hrsU2Gi/xVvOULn9vhXGe42V+8OedCP9N9UgxAIgvjxiIFC/j8eZJB5dghlckt +Ms/ZvosU6yF44yzcvk5tf25MSJGlnkITuOBn3f9RToWkXDjRjsTXZfhFjYN/2ZGn +CSs1iJHuE7UWvqL4qcjI3kzaLcT4yVWuwvC14J5Lag4fKWwiaQQ7O8VGcYkAPwMF +EDrKdFr9b4jGIdCnGxECoSoAniXuoavR+ikLMFjPzq4x0bpD3N1DAJwJK0b5uXnZ +Jp644mvIFlzFmY4cYLQSd3Jvd2VAY292YWxlbnQubmV0iQCVAwUQOtMhGlMHR+Yj +6eq1AQHtZgP/eRSF36yvWktiUoGnPgCr9mcC5k3IfsyNYZU09iMM6KyEA+YNNQS5 +PyW2rodOeSpI+kze9CcVovBVnN7mydrzi2tGDu5mS20gwD6L66aZb7UyRB1H2kmI +olkmRIN/VR1PJ794qllgU0KdWnjdCxsn/rCwhRGu021INtgMBFdAgZaJAEYEEBEC +AAYFAjtSG4AACgkQVZHiwGZkwHjIaACggQI9vwb+WHSy6pZ+9Bj0yW9g068An2ha +jJliSh4II5EI0MUAo7yhiuzPiEYEEBECAAYFAjrKe1oACgkQlxayKTuqOuCtxgCf +RlLBfmRwczoFl1pAD//oAbC7jToAn2EAejckcE/hIPHuRq5UpKlhumY3iEYEEBEC +AAYFAjuld+gACgkQvKaZB4bAQFesPwCgpSH1pRHHk20vi0M8cjOAivZQckwAn3WW +s2Q8i3BNxDwYPhYzqyBRyZIkiQEVAwUQOeE+rPcTqHkQ/eB1AQFpfgf/T23qlkH/ +/oxtKHZPeZyobAy4jury203tMp+2uvcUJ3WrAOZ4ci17nIB0WwQSNpHd0YMEx37j +rpqrx1cgfUQW5bf9zPY2go9mCvqBEXkxeaG/uLBoifxdAlxT5jBI7CycI5rGmu3n +q9ZfdtmxM9XzJzOJX8Y0b+nM4BMtG1B5P0fAHryS4wSEHZNbEX/twp8aE4bK9+9s +WQxJESfcgAVQmYNNTI9ibexdCcWLlu0kCjmOs1CG/jAjxPMgkYQ3IXhVuwKE+agR +QOv2LCUgC+tBdH7qif8zXKR4td/wEgwcxzCJCril5zmVZhhsRMPC2Hf3f9bAMGTU +M568+aKglxGgRYkAPwMFEDrKdGf9b4jGIdCnGxECE1sAoOwHZW+fIvuZ9m74Liko +Svnm3b8WAJ9sKeuYzFUrRi7+TMHG+5qjYCkaug== +=e23Z +-----END PGP PUBLIC KEY BLOCK----- + +pub 4096R/B55D9977 2008-04-09 [expires: 2018-07-07] + Key fingerprint = B1B9 6F45 DFBD CCF9 7401 9235 193F 180A B55D 9977 +uid William A. Rowe, Jr. +uid William A. Rowe, Jr. +uid William A. Rowe, Jr. +sub 4096R/CB9B9EC5 2008-04-09 [expired: 2009-07-03] +sub 4096g/FF1392F5 2008-04-09 [expired: 2009-07-03] +sub 4096R/C10FE28B 2008-04-09 [expired: 2009-07-03] +sub 4096R/7F7214A7 2009-07-09 [expired: 2011-07-09] +sub 4096R/7715D89C 2009-07-09 [expired: 2011-07-09] +sub 4096g/FCDC8C20 2009-07-09 [expired: 2011-07-09] +sub 4096R/60C5442D 2011-08-31 [expires: 2013-08-30] +sub 4096R/17886D66 2011-08-31 [expires: 2013-08-30] +sub 4096g/E25AC108 2011-08-31 [expires: 2013-08-30] +sub 4096R/9088F565 2013-06-28 [expires: 2018-06-27] +sub 4096R/DE8FC860 2013-06-28 [expires: 2018-06-27] +sub 4096g/E1758474 2013-06-28 [expires: 2018-06-27] + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.9 (GNU/Linux) + +mQINBEf810gBEADSwwRqdmepv91pr6k18+X7Xmgr+TM7DXUSxjGEZ6zkJkK9VEBn +WKIV37768nvZXFl6kxTvMfRNlwotlDHz2WA94fDOA5cTsH6AcRVx+5SNKbGBhDSz +HJ58K43f1EpiVMZnrwcZPMZrB3tfJt6E3fzwTtmXJCrqPil5WmBA1LDX1C2dmqlN +qdLMWTo/ZBFGz5SzP7L9cKmcedGIn4QWNQHsraDTwkFPTRmj+KkweElR02ZJpHIW +qPhKaGnGYzdjFgrCzUt9V68LUIt8CY4zHnpmqbVqHPMTtmQ/iyZFrTqeVk+NAu/M +lEG9scechJ3DHYw81zZSZ4l7HH9IVcAscY8l2oTHPQHAc4+MDzjtz6w+/aOIlQy4 +16LGWl1ykAe1K7cYRvkwCpaA4+pT1YddWWHASGcgxyjzv1INlJWAsaNIaP0XycaO +InZSwl5v7q/dmDNc7LaISodASvgPkcY8mivZBtkmdNZkVjAtz4ZD8Zu5d+UNEcaR +X1i6tBDnNC2PepZ1AVpsoQKlMLi0szc9k37Azg0vikihmkGF34NyYjHoDEh2Dv3h +A83VxxcGcZ1cx+lCkt37Pfiz+OQoYGTyFVOWxzxW54HYCSYEd+czIumIlzrqVXLZ +Z9gRsEL8vmiaCR6/RJ4fZnCJjZytSvZSdeBnVZwUdX8Jy2S4mLFvj5wKzwARAQAB +tCpXaWxsaWFtIEEuIFJvd2UsIEpyLiA8d3Jvd2VAcm93ZS1jbGFuLm5ldD6JARwE +EAECAAYFAkf84YsACgkQ9xOoeRD94HUvUwf/dZgDnw/2QH04f3y/QjNimz+HOj4G +Im0WSWk/qrv+xy5wyeou5D8LOBymGsDkP89Jg8AyWrC43L3AYhunvIqnFrB30v2l +Wo97v6ye5y/9JzODSHvtDDMttmtHymZZHIAAJWgwBYp88b1jL7H8Al1nLT1gbL13 +3UTNi9SfKXCZubD+DFNPanIVkvmU+igufEuxzWouS1F7C4LqfgKZXG710Z71pKQK +6nIVabXXErEvSHW8clXU2WaeJeG5z9QbMXx65zQ/54XtuVilfJ3daDWPCbg/uF4y +JMh8vcGtueXfN1RrZyJZ2jyBWW4HjUdkfG8mUyCIPAk4WVz3hy+ZXDYb7YhGBBAR +AgAGBQJH/UZRAAoJEJA4TZo1x+lCOmQAn2pNvQmEH1H09C5kJ0T8avI42SpOAJ97 +JIqllYY3+Nk1siYgUxLDBbnjMohGBBARAgAGBQJH/cajAAoJEBg4H9dLG+aYpesA +oLAAEhc4iJZWSX87F2c5oyGeffCNAKCNka1vAfc/0wpbvZLc66DmYbCyf4hGBBAR +AgAGBQJH/dw5AAoJEHPdjBYBUwI1u/wAn3hhiKsgmnEMrbXtxgK3d7pxM7+fAJwN ++CB5kLynlnmdOZ4vWc+Gi6hM/YhGBBARAgAGBQJH/k+ZAAoJEP1viMYh0KcbPGsA +njM51ugZdOXyGqttC28NlcOk+Cl1AKD6VkMlsVjGeaTAKWPVECMdu2A3WohGBBAR +AgAGBQJH/1OAAAoJEDyaQgQMCIW06PoAoJ/3i4XmPjfmG0WzNepS2QNiO4jNAJ9a +17edZ5coTQq54NG6XJ8+/l0ZlohGBBARAgAGBQJIAhtsAAoJEPXCYBZM7tdfrYEA +oIEifF+e56erz+GWTgITWdJzKa/XAJ4yPbLnufvrPriGgvD3tK6Zwr6ZfYhGBBAR +AgAGBQJIBT81AAoJEI6jsGhMdlfxg8IAoJGBeaZhyCMYmsZEx23KVvtC50BmAKDB +V8pZ3ru0QWhn/o3Q6MY5ln1exYhGBBARAgAGBQJID05EAAoJEBhhwyLFYBSyECYA +n0FWhEjTF3qUvdV+ZAOHbZOM2ZeqAKDJO9t5ehmazXq32sFXwXWnRKGcQYhGBBAR +AgAGBQJIIhYHAAoJEA9FCiZiEL/AheEAoJGzINXsl4qKWLHxLw8KGgjPdKKNAJ9l +UieGObbQG15y7Tbpf2Ze8zH5AIhGBBMRAgAGBQJH/6qVAAoJEEwEKBgxGj3l2/QA +oIcqKyuWn1MC60v31tVtH+7J5sxFAJ4+ns7bDTln/x1j8Z7ztgP3qfNjHYhGBBMR +AgAGBQJICfc8AAoJEN6A5lYZ+SkYbhUAn28xqwl2wzKdGibIe0Zg5G5IiVkkAKCt +MwuhpeikPAHakSEBhWhQitHu+ohrBBMRAgArBQJH/StHJBpodHRwczovL3d3dy5j +YWNlcnQub3JnL2Nwcy5waHAjcDUuMgAKCRB/WE+eTdnRxK7mAKDC2wOJgFNkW/4/ +GniKayVsRdfKwACffQrONiUpNQCr16wnLNZTkFEhJDGInAQQAQIABgUCR/5N9gAK +CRAxpj2W7BQLgYhPA/9LAqibEUsg4ZVV9ntrH5NmOoIQuNOJTj4FVj9AEWj2hNyh +XzGs+vCfTdwJZQ7R3EpqoQ6J2B3ivXcLvDQwtpw3cVsNwgHp/FMIQPq+PIYqc01T +HGHqfQkd9NclsbFrM3920TE7Wp7PW2od3IjG81lInJOPmPVghZ2YZvkOOUzUo4hG +BBARAgAGBQJIQgvkAAoJELK+vEAVKSSvzNwAnik5Qboq2TA0N9ujcf1qTdY/1ylH +AJ474I3CsKrb+DnwOYQhySdWoOnp7YhGBBARAgAGBQJIWURXAAoJENUzTnWxMT3i +ITUAnArmUDweW+BemwfyDl0pSg1eZ5nYAKC2lWPEHhMOWbHMeZrofXqP3O6+mIhG +BBARAgAGBQJJGjROAAoJEFuWgBDgT5qJtf4AnjT05yrvzenyJl/afFsTtcoGC+8a +AKCR9C284hNXrNMBGG+/TDC7cpm59IkCVAQTAQIAPgIbAwYLCQgHAwIEFQIIAwQW +AgMBAh4BAheAAhkBBQkTQze1BQJM0s6dFBhodHRwOi8vcGdwLm1pdC5lZHUvAAoJ +EBk/GAq1XZl3fDIP/R6JuS/WSlcX2zbcCw0j8aejHf60AgJXCkUxL6bqj2R1sfFh +7T1Ov4iuqnPSkGXz4IAAh65uDoCzGPebwkzqP3BurNrUthjQgEp9SdKSyPCUQaWi +n/0M+ct/nCmzVfc5H2jF1TRICgjJsBH8GZ5yD7JAlSdgRVzMAaL/dZJac5zho27T +sLMKvbjbj09sNnUM9+d1dLlT/vq9gSQZWFfVrqe7ReXgHp3U4da04k6wiKIgbxkg +UiPuUjUmmNZ0hUeOTAMnWqqSJZXMQZWvD4kuiS8roFtiasyGaN9AlUppFmj2CvJb +Oque2M9q0Q1lfxphezpsTK/0ZudbdGHJQbd9fiQp2BALnH5RPAzzl/N4nK9tkbUP +gQt6sx/wfaXUPnXqirb7Gr5WBesuCAKb8hqlWH3xt3LKhxYiaSDelMJJA69OkOG9 +aTSAZOfLijp9zia3dDhZkmuXOYYh+E7TXTPmf0nCxJy1GNRrb+/e3/X+IN6imN8a +6VV/7BNnRL4aacdywmTxu/pbz9tpvcenyRs4gQuBVkG8/MtzD2+y4p+8U5iiKYzN ++HS1/zS5tQ7YErRtWzzF2u7WzVN8y7w6HMhgdO7HtQxff0pm3OXa4OQS7QzKh5YH +8elPgKindPy6y3DyX/2DbOaRY4oxYsqpBWyJeEocFyR3TeXNDTzDeQMscHs6tCdX +aWxsaWFtIEEuIFJvd2UsIEpyLiA8d3Jvd2VAYXBhY2hlLm9yZz6JARwEEAECAAYF +Akf84YsACgkQ9xOoeRD94HVekAf/Q9xaanBwcGPPtaqHy9534g2rQhIyO4aSUXX6 +hSztKBu0sSTVofsHW0H9tOMcC0cHfoakIPBXYFmFbo2ofc4CJLoOVF110ac3XmTt +bFMoO4ZBmd80tlLpgeE2R2e+XwOJcGwP+NHmBHJ+jQvJqyIdNv95cyzpaEWYO5i5 +81g/jqEqVhb9QLBaQBI9hE2hTpSTQlS8AlBUiBn4efQZj4RmZ++lRxSIY0GncjRk +thmentxIWZ+u3oR7Mzz9D0d82rBIy6mnws469t5yKdcDtsLsd75sqGUnJ7/27Q4N +DsqqMXO6ZtPtDvnEk5R0LRqRm3PPVKKRsFSmw80CbpyC6wCVv4hGBBARAgAGBQJH +/UZRAAoJEJA4TZo1x+lCRpYAn2OH8WaHucmGOuXuocAzerQq+gYPAKDboz+zevbn +QaGf2mRewuqPajGVD4hGBBARAgAGBQJH/canAAoJEBg4H9dLG+aY6C0AoMhRRXj8 +9ESEt+NIFYcez54oKGwrAJ9dPV4tZlhXANlbjYDk8gWX1eBp7IhGBBARAgAGBQJH +/dxCAAoJEHPdjBYBUwI1eMUAn0+N5yTMT3C52umNxAhV8yWrqDCoAJ40+S+Wlr4J +XgucB98S0pGR2DFkXYhGBBARAgAGBQJH/k+ZAAoJEP1viMYh0KcbrS0AoPTWYltK +wRLFc4eMVnqt8jva518SAJ9Kaah/amDGEK1Bfy05fjeXZYcWQ4hGBBARAgAGBQJH +/1OAAAoJEDyaQgQMCIW00YQAnRdVVcsHKnYlddfNrNdqbDwQtJX4AJ4ngGYjjSQu +X4xqr79EgpqEAzWDSYhGBBARAgAGBQJIAhtsAAoJEPXCYBZM7tdfJFQAnRTKR6bC +gaTMEIeH5bMIUYdkzfzeAJ41/R0maanZeFx88D4hjZ/2wuXcKIhGBBARAgAGBQJI +BT81AAoJEI6jsGhMdlfxc70An0T+27SsGmdOxgDAo7ulDfnwqZlqAJ428eaU3mCx +Vse174q8RBPsY793mIhGBBARAgAGBQJID05MAAoJEBhhwyLFYBSyKFQAn1v7gFZY +VyktjaoVINe3oiCq6NrnAJ4kQQzmqvKj0Yg/+1NGoyoqV1Xx8IhGBBARAgAGBQJI +IhYHAAoJEA9FCiZiEL/AIxkAoKnH4okkKrPXnX33l/WnCfVYoch7AJ42bTa+0arq +9YsCG5X3BeReXftHK4hGBBMRAgAGBQJH/6qVAAoJEEwEKBgxGj3leagAnj+0nNT7 +ynpN6DIuxfIJmXhjmB3xAKCxoFsmpw5yzuvwIo/foM5Da6+yEYhGBBMRAgAGBQJI +Cfc+AAoJEN6A5lYZ+SkYbFcAn1ONz6o2scpC+URV4TBbUXmw9iIAAJ9vz9bm0Akm +JWfg/AMFfFb6jyHnBYhrBBMRAgArBQJH/StKJBpodHRwczovL3d3dy5jYWNlcnQu +b3JnL2Nwcy5waHAjcDUuMgAKCRB/WE+eTdnRxKn/AKDX8Pd//IP1xFq8gf0QpJ0w +y3VcvACfZ4g0hx0gQOwhNB1/9Gkc175ahI6InAQQAQIABgUCR/5N9gAKCRAxpj2W +7BQLgf47A/4sPG9KJkB7xJOYDqpFK/n29JOSGJGQGAHs+2PAxwQbXZZ1ON7ogzAk +Op7ka+ORzYOTHiDj4MyYdZzmqUER3biC6aIISN7VcMAj908y3bteIPE2dhikKgfw +P2XU5WWskpZwaQM3bffF9RZbFYCy67BGQ88/kRO4W1+0EOMv7+Idn4hFBBARAgAG +BQJIQgvkAAoJELK+vEAVKSSvi3UAmPZ2cfNJjXhGHshKIJUwR3/hWNYAnR+R+a9I +2v8dhBOQSr3d7MfZSICBiEYEEBECAAYFAkhZRFsACgkQ1TNOdbExPeJ+ZQCgrle8 +p4Gh2/9F9bfQ3Y0h7QsqPeIAniUqC11Q2Ttd5KdFI8s/SmGEp2b1iEYEEBECAAYF +AkkaNFQACgkQW5aAEOBPmonfsQCdGBYTaE7e/94gJZANZhUDGWK5jFsAnROzFVjG +u7Ld7VDyWaWrSjTIvdaPiQJRBBMBAgA7AhsDBgsJCAcDAgQVAggDBBYCAwECHgEC +F4AFCRNDN7UFAkzSzqEUGGh0dHA6Ly9wZ3AubWl0LmVkdS8ACgkQGT8YCrVdmXcG +3Q//dKZmBj5+Gyn3Nm3H3mt3Q/ZUr3x7rPA0ERRHunGyx0tUyaFWyPyQngTDfAA5 +oXdHFmKUmooKTTLS1kCp2GapQGro/0tG52agg7fPmYLjCaTHmGp9nRDA5OVqfOH+ +stJQjDcnABWx1Qpa0kjLer5Ul9lyHtF7fu+heiZmnnXvbpPi05/s7zGmOtgmsiKi +TV+csYLorOaLnKfh582cjE0JNtYvj30v57WM83Ia90cDeW6lT7/z+9FA7XZj3HWV +fFGV1BB0AYs91/dxZQpb+gE+2S1RcoXnkab5LeFHDyR4LXLHXK++Cc9JlCMMnDtM +IJV40OnCZe+KbM5rVuTwAOhMt5dziT5/u+GXibKu5KCG7Qiu1QKj4n8pZpNEEJ8T +bzy9qPVNY4/HrU//tqihiMCKfZv1B96GuOX1KS7GRiaIQJphyeqg0wYX4TbpDs+F +cynajWCjw/cJRvr+UgFjS8t7s7wLHiZfrJEmF1qSZi+R2igVHRPydcrsLCmMWYvk +UTflCNMvEWF9Uk4VOb1KYG4fkHsSF8cC7/2zCbF+m/ZEKcHxnN+KxFMAUqg3qUh7 +ina5lyeeOl4pIi6xSZ/7U1WdRjQoh/vQRAhtwO/6S9jULaV0tIth/OuE0C7Vrtdi +EzFq5RHT/Nw0ziEG9UfRj5mvRQZpaV9Gwo88WvvnxS+tYYi0J1dpbGxpYW0gQS4g +Um93ZSwgSnIuIDx3cm93ZUB2bXdhcmUuY29tPokCPAQTAQIAJgUCTNLPXgIbAwUJ +E0M3tQYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEBk/GAq1XZl31qkQALtXQmmX +N5gww4xJpTOjjs6Fq+jqqArWO/nrAkdg4f0syovOb6h59o9hzQH1kWHTlzXCF3up +eY1kw/RJ3q+8TPfVzfGNagxM2pxVMVsyDk+TC5n5z7+B9cphx/VzuWvZjUfS73Zg ++RFgNsLhE5ykmYDsxnBc9/YxL4UWWKXO2vq/i65uzyFLrWeyJlVyocbGZkxWt3/a +5m/J2J/V9tkrK+h9mFKdijCixanVvefjhAXPBXVFDonJE2zdx+3Mt1szjwQOBEFo +ZywvWUQ1pn90qPjj/LR0fHbEpiP1i2mkrlwRAkiKF/OhdS1tMb3gH/Ile/Qs2Zs/ +l01+h4joQzYGHGzzoBSAphKaWAASWDzWFxvnxvizAn+M+eBFIBdMFPqKC5iFnpwm +471wmI2BVcVZ4bfjZTEgE5Kt9kPEMZ0JpsmgXt4cnbQZwadZ7YSsaJjpZdozNCp9 +MmxawnNvyKi/DVOVUZY+S6eyQSiPq3p4IIsbT+87C3n6HfRICcPl8NUxRYMjY7Wq +WTQrFZeDTqlu+YtoPVMAcPAmH5rS1VHJMIXELjFc6wCEvJF7xRiAAQhIXwuQETwM +qqG29kViHqv3/A6XGK0tmmoMCcNSASYT1tbqmcb3+mrUzQmyUXTb2xJ1zTxLxZS9 +elE4eb1hxPLbQo4qd3E8fMDQi39pYkl+up50uQINBEf83woBEADgCTSoU3Euh4hD +c3+yB62683MtDiG4DGCQaL9QmK4HyLV1u0bLO7S5eWIsWpdRGWnKSIObAocmsYQt +Fd13imrdZBGuHcvRAyBrG4/SzsRImo2iQUE6yi9q+BI4Nif5kJDm8rT5RCyTER4l +gTx/ZAsa1LvAwPN6a1PXQeNICeJqNWBzbZWbGx2br4gqjtpG0vHq1zoM9LrhZCEW +sFXICBT7sN71W6e6brJ//VLPeMX3nCvotP6V192sxiaT3AMhkfhtY7oxv0rNmaVV +9rL4Fd9drxmTfykQ90IGHRxBrWc4GzU5dshoAT1MSiZbMTOAVwnZcvpq6PFXg6kb +ZA+cpb8J+jyBXFNfdPEkrX36JJZGkdyJrqqqg9xwY7SFq4ipFZ81a+a9KCXlmV6y +6bmUm7cMrhOKEjE8/3AfqgIlafs0lhIwI1SQmU1dCGDL9dpWeQ79nZWEu18GjtPe +UNtCL8ACgEPhrxUAJM6Or/bGFrJy+/ZvUV84TB6PYFO6id/SVN+/yvPAEdTbwI3Z +tdtwNJx9MLSVwOOuc40KRlXB6dTpjDUJ1mvQuwQXST6bYStIRY8uF0wzf8raO4Lu +/6EUCBW05fYC8HAkZGBsivm/YCymjB57mpz53ovuLcwAp3pNmnRWDpKiGVwJdN0B +uNCxuUUgioEoF4p56IS5YQQSVP0VWwARAQABiQREBBgBAgAPBQJH/N8KAhsCBQkC +UUMAAikJEBk/GAq1XZl3wV0gBBkBAgAGBQJH/N8KAAoJEIFUZ7bLm57F2doP/2w/ +H6COAjjzcLUosembG9DnC9e5I30OQxZKGUQ4mNJD5nQT0euuNoH284KXeoBTaFRz +kdXU68BK4SDEXotH4vwXStzK8gMp/dmpr3lGwS0BHHElDxFNwk4b5y7lYCJt93N1 +IQbAEtZCqv/Dfn8y+7hOmMociDxgZgai1cYym9YCVkOPOl2ikBK7V3XRPXKKcYx9 +IslI6TH2HnTRN1xzjggq04IwT0o7u1wMB72xU8kaUgrUHYio0Smh0memClUhwCEQ +d1ic9nrg3TOvlAw4V18NHglQemwVtpRgAGOZNwXaLIEUBfvTKhva3ZVA3yeoaYuP +CVFE9X91z+sGdRydFJde4m1b8W4gf2Mv2RnrW5EgfdisLgXRw3C2xo8qrh3R8Gx0 +pLv2VJJT8n/o0Ij+w4BsXYWTD0jAuC6bEfHNraqqihsWf0C7N1T2QVCcwbzxANUO +oYegFfCrz5RqjemsmDTZkCJXxRR6RcvW2wHtXI/K4HULUBTvPl4FWFEtmO5LxcRR +BfeeXHrrOFmQ+zFwb8O6MoQIvmOSylB1BDi5nZ1v8ojvhHkqufMpqtK8RN7DO4MW +BSavjOApAgX9HpChQeFEbvpWy8zKsljfhnvhgBL88kMQ3Oq/1KQlthmVVqYmPvd5 +oIcYWo+oAcnY/RAGVYLmLAo7a6Z+ms17VeSP35aDH3YP/0sX0ipnzstwA19ULQAK +UhjMKGGv0dt0gkT1/ZXO5GZVWx63VcJbWWMzRsTzGYLZzl1//RCMSRdDbqzWBKYT +4w1dU9chORG4Bgnj28cPS2CNHrLzgkPtcJWcpyXo6cuaRKXrZ8W2Jyz9jKltTPSX +bxOnGvQ1YkRhhzSDyhU/KBguo1IiAXgTBMgO/LL0R12PMETIepBMrPz5YZhIZpKm +rqTayjpLu2n7xBHu12XOnwm/kRqmBHFxyAFQ3VxWeXVzhVvk4JKWajyzRZQrRSv7 +8rULuAw22llzi/EGY6oTzEQvEJipA9OtcJx0+NKcLfBgYO0dh4bPvA1iW1BFfE9x +t1eCjDl1WHPAZXLWTJO/OpkDzsgcWlggC0gpgE64lsriKpUtCTbnGei3VdlBNNar +A/JsudJUehMEh7t1W5bJPrCaoeyZOMqlDxcshUFfa0CFiytOn1ILcc6okhytwo+v +NjndBupTdfE0IVwBxNE/SqBbn3cwQ2B6z8sZnrHKIe+dOI5yK7CndAr1GkAdhSvC +TS/ctOnWpsX/rWEk5bIsmeXVYjJTVVbaPer8VC2Bvxdhdob5LpMfMhRsJnoC7Fjd +7X/CHQlkQVwiMixanJqTzA/DCr0M5ahZHAKBw7rdhTOdK5UyM6yzszxFvpwT6btY +yRM8MRdtqZPgn/7CUVl+sViiuQQNBEf8328QEADucL8UtxhlP8R0C9vmyextchzk +AjvhoYZP5XGk15gx5yM7W525vTI+G2v7jWgfv4G2WsACQ4CJTEAy5bYzQ8jjGUdh +phhug5G2CQgaY0F+sQWeoBNeZZ7ngRepppL4QcfsJmk7sQNu5u0F/ryK3kRleyv1 +WspmQ78Id+/fh6VNSR22ILNi+AuhK412bUc0tJRhC/JOIMr5Gt1HGUnlu15cgAKf +L03MHnfpiB5qCdUkdvdGjT3UkHfBVrpIlTWBhZUsJmbpBTOwpseXyLjr8/dXXc8h +o5XnzeSYZF0rZNSMc5PkpCiBdVNiyYSfIFzSCedwCC/8MYWCfxTvfjEiTP9/m+pA +6Q1POAGYvFqTSNLiDie8qhOHHVUlJ0J8WyUmi8k6yOktGQj/EbHvMRduMUTwqUzv +RzdsURvZ0KY6207dsTRhJEplS2n6WFAnYdovWBtoNSKhsqLg1GpXufJdZTWCsDIz +3y09IcNLdMa6ybJqV6pK8dGMATBlIbXuPjlwlcfOLeJlx7mxH4R6SwTaPV8koOX2 +3aX2SNDnvrTMLR/u8s4aFGn/hqJ4Gs0J3SBhRLWyPNNXPXYXd8VZosnfoQ/ZAYkK +KYQMLxisP7I9SRavSKJ2Db3n3rKQbaFNULxrmqgZiiSO9NEYKAaQfU+wwcPURmhc +9UItS5ZFGmqzUnJ1EwADBhAAvrDHdNE7TtA171w737weox1PJmHdCeOIWUttom29 +cBkSa6J8EfAebYOxcn2sjOfWDdrJb6n6z2SHRHG15rTJ/eDFH8f3ol2L7VNzq52o +HPnkUwnrJJv6TD/f7B+48qhrgF5c6ujOUC4QwpdeZ5jz3qzXl9onXt8SedT9yVt5 +KAquEDVaeBZdUiE728zBD951JvUzrRmJ1hYODBxbhxmLPihoZyNYaAPWkoSXnLFM +Yc1PIrRygvwDJfviEtd021nYt0NDjves9v8KdFT2SX5NtsIg5GnpraURtCr1PMbZ +mTKiBHTO3tnin1Okg65ZzoUsVA0hOCIYXNxDS3MPAkJOWTqBphT7bbAC0vdSuMr5 +lMZmuNjR/MmG2xvVHxQZvlUJi/F4ZltV1oo5ugz+XzEGgO5L/lX3LpKIcS76dUXZ +aQ9nSoc5jtKZOYBQD71CGXYvtb0dpKPYuAMuwODaf0dz3DUD7e0AJDgOD4neXcpR +Ml4s2QZzFhTyu04pEROLGomBcfT7PkaRPyPeumrEuNHuC52Sv7zO4ZOiwaOLzsUF +yzf/y4sho1NvwunOJ3QSrXdAnOo2VxE+amQwkfetfknL2P/PFdshtSiq+L6RcDW3 +b09R4H4yO2yUJ5cQRrU8aicGFjf/QzFdFUz6jhm0Nynvw5uIRp5VDNmaZWul1o/p +nimJAiUEGAECAA8FAkf8328CGwwFCQJRQwAACgkQGT8YCrVdmXe4fA/9HKVc+cjk +OQdhkWFqkRv0gQl4fC9yQnakRJgJ8G3hG6j1ai0FZYiRRFJYSJf3MNMIbilLWDTm +UEp/EVz/c6lkuT4Et1ZktVwnZF/QObOfWVvxStvM/RvL9cu4KmLeVqCW4p0LzCYM +EbMj5VeeBiLtxrmGHbhiqRPhprczn17or15S1lBewzDMKbKC0if7TeO8FMTHwHGF +P/bCdn6ZWcAFnNlHYF8Ywbwxr7UybztGx/QKb7XOZh8b/y5+lq8m1EWZJ8SW35R/ +uuWU2XS3vtYVo/Oe48NFf5qSmddqZCQhMO+ajGC6gBa/MvA0dIO7E5YIa+M50Ttp +Qt+GzlUlc4RThTIYEjB/+LmG7PltSg9WmkMsaOdWOJtToKVGsM9ENDML62qAJI1U +dc+69tn0/VGxcT8gIJFnnQ9CmN2lhgurOztnmKBf6Ms0MWnFJKp+lFN054RyNnBJ +1qO/+w081u8/zKv6+Ypp8AixBjlABori2yVv9gpD0xa5yYEu3hZuuZ5TKcZZXraW +BVPWmsh9w0ECIV4ZAZ+08M7sUstU3jSIYl/28QYe5bxEP/XqTiLyygw9AXGOSFAZ +s2nK47+dOOJ6MEcfFHvPt1JoYx9dKSAhk9nYjSO6foHPBggM5M0ZgFaik2r4iQqM +MNw8ogqFfMwOBLbzvyviBi2v2M9VWNzE2M65Ag0ER/zicQEQAL/crQrnyzcQtKya +51YvMr+hCl0LU6wcIKvvbdI71ydqaQY0TvO/AAOWWcz5AI8W/bgqV898Wk1g26Nd +NQKxzEzikeSvx9qsZhNeqqx0B44chCI9TTGuLs0i4YoohQuFXBtz3tC1CdytFtJ4 +UODseqH+s1vALjrxJGgLdEPU7CEmDGQTYheK11+Mz1h91OS835d/qct00Cqzxn6M +m+ehXqsy7lGsSL/mWKQLf9yDg1DduAXqlmsmjiM8kaRkpfx4ghh7E4O2LPT3kdme +4CQTt+BQGdkV3JEkWc92WWufGSEqtVUcHN2pvVXcWM90cbpAbKh7pPn4Nx7hV9th +NZfjNBSIFXYTdmFmu0i+w9dHxtSelRwnzNM/CLL13x8s4rXAiG/v8eAr7FCVFRHZ +52absma6zTqBMoxn80jCoC7Bk5EEvn8dV0tEkrgvjRHZ/mc7A6OpZX3dj6B9lf0j +WXlkRiYTor6SHW5IsdQuv5KwoE3kkUfCD8w2QAhGcXT1sylBpoLNXgMFX46OS+g1 ++CE0G3l8vxfrFSE0l1GqzpRl5ZiZ5ECKdk0wkRe6HPXNE4WnBNupC5fiSuZ3H4Ki +j8RK6HpbVhZa1Rpb0yf0fpkoPhBNw1kXjOBziQ2LspHDAhY22VJWxbINnqBvsf5j +dAVw9uHuswFBwGmV5nhNHurZLwujABEBAAGJAiUEGAECAA8FAkf84nECGwwFCQJR +QwAACgkQGT8YCrVdmXcOXg/+IoNiOxeMxeQYe/XBcJAcBBZPDLVQhJQ5KqgWYnbF +w6lrK1nKzbuCGQNGp3RubWwsax2yQxTcN0vzhe/WvShEnXwfTxF+9XrTxYqx9ZJo +2Phs+f08Xe70RDP9Kc+BNzIHI9uXA53VeGWOAenkxFBu2Qd4vKJzmRR66TbNDiHs +Yh9k5+FAW+0wUf8YSca5RYEuXksf3XMA66edUcWpPvd6eWf6YDnK1pq+Kd9oB506 +1iDzUmkjV+0Lr8z46d8mo9BDfx7gX7hwF3T5/eodB/gKuBrPup8151j1fGI7QKUI +swIfq/82qC6iP/jKEPFa0g+V4naSWp1TrBh8wyJU3Bi0tHbUfSj1zrMnPq4lJDtp +mfQb5lmJbuE4VKBRPTtkETF4DjYsQOE8iQiwo8uyMP0H1xX9PKPQOD/YakQ2Wlkq +cggfo2QO7bCKIeF5UmwB5x5ZPEZ7XnHJ7T7iavS8f4qAEn/Xnx+pzMzWteaHahkY +B7M1XcU8QmrUC4fpbVwVOet7zfFKdH277LzKmDEbxpuFkj0fHHF2GmVZacEiCyOB +vOZlrUiDY/IFlYr+3wc3mJWHKkfYVTB3x8Tks3aaq758t6lOic32ZiDWWWBcHQCl +bgWAMFKEh21yRQ7DkmPwv/p2SRJvRaDQUKOoESzJKPkDaPN6GvqZhJZLXJo+VENO +ENy5Ag0ESlU/sgEQAKynd0bz8BthKrW/ksESoqLhcOKuDVyR54Znirswjo3rhYp8 +5eQWd12H4c+ffdaxtTLL+TXRKGylDQTapfMUx5W6f/R2ei0ihr9RyOVKPODCVLfu +NZIomf2qUMUbAoGyIUfxbg1fFsymaCJtGD6Raer2GCEPP6EFsq5IBii+As5FiP7K +Iv0JHsKK5tKHLsg+hp4wvQi4TLaBuZ2TWnCM5JrBFZFzsVSTeFgMOG+H2nz7WWbg +o4/+75Sj6venFu1+cxGZPZ+2MQyONTVnSkc6jGqiaEXqapfSJXMwhd0JiWwR7Pu6 +lmnVDL4C7E7O+Z0pB9tkCAizwVK/dOg4eukPYAdNTSO/D5yXcQ4g9lPNTnmAAYKa +REfuQTZduP4f898ZqjHr45wqgX9LdBZ7noRNQAZJ+Nq+uQomRNBfBMhTrJq9UUhc +vKsIMZ/FkF7Ft8LhSVvSY6/P+IbwXxEkQtSiuP4GWfHCBz89vgPZ8BkBA/Y1FzPK +xkIXRtEAlo9YeEAH94/Ehc67YlynLVoVMpMTngdA12+2QwzpCxvPDmZiaXRTBEDm +5aitEGxC52z0RPOS/Wov5gnwdBB3fzpwMvPab8eWIQ2E4tB2deEU4EkjZkOdOtPh +fHd1C3dz/X2EkKG/NVdM5U/+GItR8OvapnXxZWPPPyNNFQAb8beKw7v7gnchABEB +AAGJBEQEGAECAA8FAkpVP7ICGwIFCQPCZwACKQkQGT8YCrVdmXfBXSAEGQECAAYF +AkpVP7IACgkQo0i5hH9yFKdrow/+PMOFDxC4Jl9hdtn6Ab2Fq6RtOdWpxQ8/heWN +pVB+15Zh0pxMJ+oBuaLnrs0iZuQXJnUW3UpkoxS6TyRhJTi7cNE+5b3k4jn1oC8Q +M8xKU39+iKx3i6Yranc2+ov6/OvcHXqT+d/oM7PwQ1asYnQqU7GrLxrMAsk4zF16 +7FTYTxrA2gPVZXQSnoh4pH6PLx1K3vsVGDqd2ePB9pJ97I8e7AFvQbOGq+KdM4Xc +TaV0JbF1GbUgAEukXAsHnSlnCj6lbzTTbF1VdnsgzStS0PI+9lEZjeWQ9qvy/G9L +fjeJKdaJWW4wbuSTwZdgmY+NOAC2ZRkGzIKB5zPbvkzc6vJQjFeiq5VyryRUplVb +pm3pIyRL/xeat8Z491bTnPVuyAlhndHG8yGw1zE8nGoo50UbwvhUCpY29RE/exjf +kaR6LCRRIduL8evca0EHGBVhB7fXFW4YFhxCWDe0dgC5NSurgZs6OXaIF4EvLkhS +7pgKqN9EagMo6IvGyuf8FpLKdmTwL3X30Y2lvhi2D9hd38+VNV1mumA8ul76pcqa +Tnu48l26qJ8HvhWrUC0/prylYO/aGrUjeyOt82/sQZ/7hfGR+yJTpKv9bEaJkPIB +Y7zXfPOObLfii8BfMDCXBH+kN9gvqjw5rxGxWj5gYGnzwreQMXZune1f+m5bD9F4 +O0mxcBMJLw/+P8R6kbImzrYoBR+ktbs++q7bq/FJe5Wye1Oa70AuJy5zs26Xxc7a +zw7rMv6QiOY66PJS2Pcl9H+kH4stL5CvqiGcsSNo/7KEyrfEY1s14jAg/5iHHkxI +f4UYG1Bnef9mUHf8TdDDpgPQPUsC8gAPDG4sT79iSfX9F3SVquDaE6Wm/KPRpOxm +MuM12qwNpD5jlIHM8MjDolKTHasVCRxtyTop644FGlo5bkndTJqfY3YMZYLFO2yf +LaL8hGPelwKO4RI4de7jtMEI+r0VJwUNfEtQR8EgradjKrG2BdXZi0Jok20aIA6a +RKe1bh3C6yOe/RkHsbMLF7iJP+YYjqx7d/uk7wDRu8p/iIp6O6JGKC81Dn+dUjCd +Sg0uaENW9Kl9dGRahB5VWwRewlS4SiORhV/t7PcCoMEkVCkgx+bJSf6W/+HObAb7 +ZL4rmGm9uLzIrmWfk77FWmkKUv2hyNdg4ByUpt6w8J2n5rexBqcgWAoLhPWzylSj +XKPQEE/3gfWsMyIFBoxSyQiFpdK/JEZTU7IDmCQJIrhxOjBuaTqo/s7ArYBSJkkw +aXQwkamOTF289QgF/lpyUBg5vFS9EBThLDcgMtTspU+F185TnJ13pDXOVd7DyFl2 +3W1dDhToo5hj2JqYnwZIpIWM4CHQsV2E+hXpWJNd2AIo84IA/oOOOZS5Ag0ESlVA +/wEQALW6VJKYN/3q7MPYiqXB9I7W8I3jctnoZFYHC65U5FGARcEuiNyDmR5C4K20 +Cutc1hCXwPC/vt4k7JtF/d20XNeBY4RNS1E294c5MEFWhpnrq1zZoDWDllQaqOYv +6UbyXdt/WOAEci7BBNoXCnk7t3aqtNSVe9ZsUiTKNt0hD5Lz8fzw6cBRoUOdOKmv +QR/wNLxqF9V4xZiJJmIqeXggyHcaTB25j01xdx684GpFIWWBgUGyY0KWd2M0vxgO +8G9Ih1nPdRo4gNofslMHwLN2eElZk2mbsXVbTSL/mCpmrn1iIcztpkVW7X2VZiFt +7h+JJk9kfGFIYix6/xJ9oEnU9youerAcjC1To+6kss1XrBC6UOf2m+asUUo+EwDh +gdQ01f3ihKfIoNctKXXNYYbpIzIFudrVRf8n8RlxgfSgJlvqZ6E4pQEhKe1I+T7O +Zy76YSv+f2jgFFqt1p3As+fOVFIu7ePQd8vLx9Ft4/H6oYw2fCfI77aOGr5so2nK +/yCpHsBDfWrv7Bll5tVJfqnd5wPCgDY875LcOa5jI9Y6yr0tWD9BpR5H8TfH7s+E +qEog+a01a2G+k1Kw6WOVrqRztkCyTcbRb19bS4Q6nDZPyvo6435lEtKjOlvd5FVj +p5KFg1osdklRTNVX4kk0++J8ul1ld8jq8Za/MW3vse0SRYoZABEBAAGJAiUEGAEC +AA8FAkpVQP8CGwwFCQPCZwAACgkQGT8YCrVdmXdPBBAAx9KH3COxe4WLBtwtYZqX +Vm/pe0BzEBxOZf5h3IyZFhHkxWeBje3g6tr1rsER84ed039TAQV2vbQCYd0lyLbV +O3ZmHRDvLTG02dzTU0pSN2yJr1aQeGLrxlRdT92jaTYRLfocP8pkTJ22UJvoSsm5 +vEyFe3HMFJUHqQMG59oe3/YkZkBDr9CDFytWmp85C9+Iql4/hxKVZNabpIRC67w0 +SCxoeEU3c41RIcGj7ZHfNcco6LiUhhXG66dp5Vmc6P8QDIypdpywK5FzpsMuxlj4 +0gBmNR6tBqq/eCtRpM3HTh4XzwHgLoa9NgbUwQFjYC3nRgYciymmoWBcVl39AQ2R +VdE3ZoRS7ZS+v4E3D6DJfpZO8yuumT7Jk6RBUzBKWSktwH03brJmoZUWq/sX56ff +H1UkmZY7e45Z9iaQp6152UX3T8E3eQtbKKgzQN9rw2hjOszswZmeMX58IcflHgQs +KTnpHgcwHeLZ9nEUCU7l/tZ9bOfcmPFGSkzOE8o7EWfOcDABKph5ruY4l0vA0ALD +wcFm0xbXw7UYiiMiS1FiIgX3YyA72MhiOWOS7uUDmUU1dB0ikPoegZLrLIwRQ3+r +1ZGcveIEAniailyvzjZ2MJCtffRiD69TDwII4w3ksW1bE76kIqgdRf35/j8mtdAX +cFpjhKP1yEE0pvDC4IvHiaO5BA0ESlVAPxAQAM+PIW4juuY/121KxUNWHYGrUz6f +Oyh7g4U8AqfTbugJfL8zbwNO6PWh31iYZ5sN0maraW8HsC/Qy/1tE2+xb0khni5T +fhb947oYGUbMga+SVXXq4kz24Bgo1nMnj0QXP4wnhyJIfgcQqmaMYDVxwRZLvqZt +s0Fs7N6azsuOH+XBN642RjE7EBrpMn73AoYIsik8j8a2S81g0bcjfYXFSfn6tKLv +BjiCemRnPmnDHPd2iiVb5AYpIrqInCyVp1c26Eq3Bs5nQH9riKIwgF1sCxVxVWU8 +p+E3iQP9N6IkVKfe5srDJ2WTsnbxZ+tjpgdmmGkYBoEgYdBheAfJzet9PPEc5WU5 +5dHOp7kA9bfx8+YAPLyEjf3t2LesVyTHmGG1lmDz5h9VY7GnTno3CyTJZxj2DiyE +0oKzBKIzJ5lL6taHMSLL8rPskdm/Luefiwb84qihcDvS3jpFNG6BrlZx+GNtkBPu +ZioPZyaLxmf3xlqXbGZc6bOg4302EnuzQhnj+2QEWJo1KMIdaHLnQRjFfQIuceow +EPGbq2qTSbnwz5y/pXVyDpVgfDF6jsiwec7ngMsLntYJJEpwLCy8U0c0VL+vg3ES +GNnNqrFD1GOVNo6ckIX859ZJFBdAhocok7cG3ZFpaIUwQ9AapgtY6zPBeqragjQm +dpevdslK03nzxR8zAAMGD/4nIUkehuylxTm//WZLO6Q7LEH0s5shWj/GwaqzW/eC +IMcgxOtVZUXgwSKWly0zLh0Xm2vGg22AE88zgZOz0mJUdYch24vykr9giCoCF5fU +Ji6quVJPC7JXCt6K/tcJSzf81j89HkOfRHFf57YKFpiKLbOBpMroHpUiL225HEwT +nk7UGTjH8fcHAp0Zt0u0QQtPvX7Uwt2A28F1HJCLt3P6cdTbcupVdUy5MTxghjfc +tubpBbo/Gxt5kJ6c1U0U4SaOjaxdVznotJpNvcpUAw4cu29XpkZgN+NhEHFHm/o8 +I102J/r9CCFBax9sWMBI3kD2J2jgo15YcQLHvNQMT0HXopM9f968NGy2gFkXyCjS +ZWlKIB6hsJQWfnIeiGOsqhyGowbESYN7UsCgM06A/2L+3yU7NjQ+LZ4PgPKqk4wI +LmV6NEnTX/9bkarcLqWCt1KX6g+6IgGbvJ96eiI8ZwPxI3C3MuSHNiY1NSP8EiKE +V3ds+OOIdV+yl3gQ4lW/2z6gBicpoElkN39Yq7tcO7rWgrj9oQyPslo35Jx3d53h +T+6ytK8g9d3PRrvF9ckr9eZ5JfWuy20jIs0WZrDeHTm5Sn4eWiwFo/Mk1vrFLvOr +KwLWN++k/ltz2nsqT1073O9yn5tPJvuCG4hJyNiYWkXKQnLXD2IuD4a8hreDIGn+ +JYkCJQQYAQIADwUCSlVAPwIbDAUJA8JnAAAKCRAZPxgKtV2ZdyjJEADDKmjRcK6u +c9icCLbeFsAH29z7hrjpVMRMVn895p2bFHqaX5iP59GanVczflkDM1HTqiSd9x6s +acIBlJyiPsvPzV6EnLqKOZU7vMZVOOmJ35QNEXY3fnLQeicrc0M+W1vOSWb0uEEI +EUA/azzyKT3OBmB2OeztDbS3DkQFY/Vc/f9bgJYV2yJOv5LlL9EGw7T421ewKyqa +ECpg87OW5J6f5Ia3Wos3nKfqIlqWsMVIRE1tuHqoLu3Wioy6fADYOaiSMO/Reez5 +cTQWzkJvbW8kGRYaFIolEnYMtBiDz7IODE9QvWD0RCt49MAXAVUcdrHqdSSrtNaH +KeOTFwexXc89v8ESGhDNfG5B+gg7Pz1008EGXP7oWpkT6oPv5nz+bPmM99brR4kJ +6D0EcD0RM21VLxZX+VCBTPKxlltU1w8uRS7Ra+Myze784PBpYLj7p0KIV2t84pM3 +zUv6VSGsPrg5YCIA1ARJgEg6fmZoto4OqQbvXHEeSpb8Utbow6cBrj7RmT6fcimo +YnbDIae5sRfcLXcNqPxX4XFd1ZWza7lw8SCVyUE4yPAseTMPk/qlVJX5HuohIZ7H +bwDdatc5zSO8EIlPi0WsaV9OoZ68rSOoOVzbE8gVoZOCpwzUYHYc8/xuUIS9WZWp +f6p1tsImabq7D4ZXvixijfDd/1jHxA04LLkCDQROXbvMARAA1y0p3gdbrfj6XSeg +vNGfN2bTjtdLEjIyX9y9DBAeSxTAPUdaN+kS7DxfsiCR068QNw56RPoXJeE61OPh +XkOGwalSP0M1yE9fS7Ym/9onQdUhrUetzftueqcW/oLAOXwcxwbZ9iWIbr+vSx2k +bIMe+0m9T7IUXna9IO3XiE4c3SQxWuxhKyTm6sOcC7pqUY6PvhN/zRQvnNEmr4VX +xoqkNsw7tpWYXKRHhz1GFMAeVXsuqYOVohbkxOSp2NyUsoffCpmfShT1VGJwDckY +ywQ8VkAyQpr1zpOX4ZgaMlpsipPHZ9Ab9UbLqB8+4SaFEo2wqOvJ71JdIrHwa+/U +BGwh4X5AGH5uyEfbSH3SyzG9TLZQUF310khDivVdkINYfifGuLJMrQaIe7aRtK5y +9p2zP9VBFel6OJgK3m9A7f+GNvVzq4C/YK4o8pqOmPI0Rc2ZGihvq50A4I8st3aN +jm8QXAWIgVu+7ZPZqp0qD2xFQ+Qa7o3BcTWzPM4vT6Kb2Kmju+HhddXGK+bAeW1Y +BzUOhy4kWBTE1+YwheJYG5na+bNSeOmpdOCDOfT6uWTaVfKnqDaIe5Qq54QRNiGw +I4cKv9Ccb1vt8k4VmhQ9NEVGqiEH5Vq7WfrDIWWIFNuq7I1F5WoqQrYrnVrX1w36 +2kk0Za22tSBKDjWD+Yd36CKyofMAEQEAAYkERAQYAQIADwUCTl27zAIbAgUJA8Jn +AAIpCRAZPxgKtV2Zd8FdIAQZAQIABgUCTl27zAAKCRBVk7ypYMVELcQ4D/9yesl4 +2hO75XeLIgjBDbMYZSMIRlrj6CQa58LQvlKw5+9QuYXGCh0YHyuQ3o4A7CPplNYl +dY9V++griWfGofs8xoX2t4La8kjTIHSmNcvUVuYm5cmlJlkUUqadPXtAzB8Kz/0E +vvNq6j2D98TlViUj55JfXy+GDv47A4jQ+71uFiRv3JwI52s7DYuZY1P1FHzGRW31 +v41UJEr8LivleiIOstJQZ7rsIi4mL3dFu+vV17dhSHA/lNLKk0dADwI46EYLLiL0 +nQgA9oKBNX06ZszE7tVPat+vos+sEkbHBlwnX4FidnOkmXs2Ek8xtKn6pwYj7flI +733dY8HlgcTKMYr4vKoxKKKfLElRm9baY8wb9reYUAMEFL0VOgYY8EL3csoGdhfd +MGXk77WgwPt5KOFNuoPn9VZdNMcIpIyEvVkTdqo/QAqR4bo1zliVOPGKGnhyEZps +CwhcPLSIxMjIyj5Cyiyj+2alGf4UEbdjdAOYqQ63yIi3oY+YBWVxIN3SQlM94XsV +mh4bxaF6pVRoEBWYr21QVFY6jA7RCWzDkIf0eCFkvbP1JQe9iQ6cB4TsAYqPyyut +E0rGOefeA8db+cg5TFqAg4IAr+x1XtMM8waGYMpaouCpdM9aritMzcbKXJKzvfYa +JHyY65UdTFlYgPrmmTXgLVSYPytXBJsrFBFGC9BhEAC/iPjm2pYfxOCUBiOZIFHm +KZE1BXcMR91kZUdIjlSKsIrKDWi3ZsxgCx+jAGr3BraOVX6PkRsKJmDSraU0zE8E +FEDMh0MgVobFm88lodJcgn8SHGogS8iyfRuiO9WLrNaktbaZUy8eSVHYY8A2fLrB +w7iIJPM8WSf1N+vwZqmEq5kdw45po8OkzoHcVzWnQddBnBY4rlhcApzSjyRSygXw +lcgmnpXYcNf20MsB951QyroSkOLVqLTeI8VPWK/djq7s0Q/nqEC5RAZ9x9mTn+xt +PLJNLsJ4VKAnoWbVs5wzSxr7ZxO5eZvjsPQC7cJB9HNkNaFNYURS5paIj8RMFzZK +oicU9r0nAXMYzFJOt7bfVcBe3qoPYkBYnZC+yswCnwacmZQWrzMbm8FZITdXgtaF +DS7u4P6t9jxW2QwfKVtTGJHqM+VsjpgTMa6GHUfqLBoMz7sbbXHAHnUd9P2IRS1E +hYsjvD88rrUHOM78sEfLS4kHbKhv7TPRFRqGVJ1Ul0umKEvNMezvv0OQgOLdnhEU +TmHNTFE5GGFuQ/dijb1bju2I3FyIiRtviv1fqRxTHWRA7kHUtL+95dFq1EcmoBiP +ZDWW6tkKxqP8ZBEnBMdC46IwUEWXy1lMaBHodJEEtGUFrw2KS8VWDhgAK+BLKWqD +36HsZhw3C0wnx2+IlMt9rLkCDQROXbwJARAA5HFImRF3mJI3fv3bEndHfK0tkzVN +KD838cq6gfwxuJYy9sutatfLRlE/WVjS07t/7vaL/9BKiwwWmdqhPyXoANPadM3v +6KWbV7h/MM9zTV4ViI8z8u6TXgBkQzqe+YRS1s1LLqNGeh32VTCjkzpIgf/IcOnu +oYqhx+5cqNCl/26YGMp4tzxcAGCWwzqhhOD4UkHD0ksTy5RB0NCqb4gIPP5eh11l ++PRm6n9kgc4T9zSgCzb01Pu0bO8jWTM0+q/JxxanweM47Kjg6cxq9djQNLFlaqGq +Ft4SUGqsVgfJusHBs+0gfM7C24BQ3Z9n4lupv+tcI6GlPaR4lqQ2zHjLclDzPwOP +Qa0IlkohQ3E5gGUPij2jrF4a1zXOPsd19XCu/yrkDsr5NPagZDvDxCTwOvvc0yCk ++N+xt061WWIINYnSN1cvEpvfCy5MfQy/ZSSNy35QwI13IWimRyFIwUBJOBItNPfa +Ye4C/QkvLJGsmVq2KZR+uSzjEeTWCRlXPiwqqYefWxA63vhCg1TRN7Cof5ktD1TX +XAhwMAO0BjXgou3/ajF1CCXmvSJvIyW8gPeKd8fPv0qhVpvCdQOcQINsKjQKz6Rj +r2wxGZhFwfMU83S8BWe+IPex5KxI8I6kGgoQbXjlwHY5pv0wSaBhr7bJtID8K/O4 +ZjHhv+IxW2FUfjcAEQEAAYkCJQQYAQIADwUCTl28CQIbDAUJA8JnAAAKCRAZPxgK +tV2Zd7nlEACray+U3dgfA7t2HkuOybWjy1a89YLaGovc6rItTQ9HTEr5cHmcOC/p +4cCtRLB+25PCl4PfRC5aVyMGzFmQ8HxZdhn923dYvdhuVY7Mnm7IKZrmkf+NnsyR +8NJSdKoCbV/Yjcq8YHguswlzQXOfMbz2dAD39TG5JipjWCoRyKC7QI+BwPBBcpKu +p7ALK7IkzYnjwGThM4ocbNsjPIIva4Du1DdPvB+bhrHOdUJ1FCqID23yWrAUXvM7 +TKhkl0vvIhe5wJ8jEMFVCJU1i2Xw3D01FOykQ4GHui/kL7Ddm91Vlls9v4dJQjWs +jSo136cPld1O4Z4bNd3PBZpfJuJfs0NepX4+XGcmgk3HdeGgImmfc3LqVGcaz14O +cnDy4IPxRHY6W2/+S8+UFxz1vHDAAX96wYIdadkkk1WjOLpyKhy/hCnlbyL0mx0v +yQZYCPTCY1E/Olt/uNuoRU0e//ynKZJeqvF1qqH+gNI1UQYtvlqRAVdugxXPC9af +uMGyaazcT1IFUPLmpuaxmUSIsSBOctVbKtF3rjluo1VTwr+6j2Bm1CDCXwcLWvm4 +pALWtGnNPEgnDm3IhR9H3ORWR8ibPv2a5SdJ/wQwawjWtz45s9xITpXlemNxOUke +CET1h6v4C4t0bqzinFzi8CwrR/uI7ACdzkhOHU465ffR3IfRiNHi3rkEDQROXbwv +EBAAsYX0xg2Ca/OjLFNiaxyZRjcNIyQGon1Jgh7ybfSAXbXnoVaG8yWf0O0si3jM +JsNkBtGhRRM+TmJxRVqRj8vgrYBOq6FvSsbfKKnsbdL8Uxvna+t1SwdQ72CXWctb +F10LNfNo6LGwdWpyoXQAop9Ny14TLEgj8lT2WwVd+Q+tWtlZKsFYVyLXwW1ZEF5+ +hpesFdMtNL48JHcdOSHN0L28DU4b2V1m9D2eZkMcbZEd9ePYKclwfU75fYxaSpWD +nAXKfAPR10vpL+H7CjFxiYSDnsSQPO83fQvVrTDyPacR0HDbO0VeZ9N6JAs9p6QM +QJwywUhvW/IMvbN5xvLK7Vqy4ODoej9vSGj5QqT826Yhpy5pP28MmSlAqseDiSNn +qLvrAqmIhu+KAQo/Kesbbxh69SI0zeGu1+Dj7bnoSgvFvNiyNOY+YsIpx0GnSXS5 +mQPdxvwHuWcVaIZk+ZDQq9cLQq1PXQHyiKbLSnhrnUbKJGs42ecyKZ0ZXxndbEUi +5MRoqw6OIvzpPYWAwShenMZTpMAT3zS78+m1BYZMbVVUHlwlhOSw3uzzm8klmF52 +jJLFVtDBfW9uJtk28ZYHwUwXhUi28BVAgnzq6IbN78cv/GRJYxSRiXwKhAS2+/Gl +ul4gC60a8qNL3GJTqZ1Rul1XT576acS7QBzWthxI1lNSOH8AAwUP/1NTZ/iaW1/2 +wH8+4taP2ksHKbESzZ3g7qhZ+wB+iWQbC/jb25ECr9uJ9KEEhIsXonKr/SzIPjHO +0rQZjl2I78dNIvUjwsG/hkKHv3m9qZU4Jv4hvAh3K3e8vct9YSpzpRtGRQ2fqEdF +32Xkhyns8T8AdU0rpysDYxYd2Y0u0lkZqZSXPfvwuvWehkL5n3iHM2wDBxPnlRTw +FC0L802HjIu0b3OSr08PdLQwFVrICFMS7oTNSxqd3SVsCe7Z5yCpuAi2tdKwxPNt +s52wwRHZmyC8HiAMnOkuwNcnH2TeU+DDkHCiKDFV9DJFw5xNJHaEVAJJlsV4a2p/ +0GZDrtzND/YVoFSQxgBlfCLFL2kko8AyW1BjGomTpgJ1mWXMi8sPGzpY/MjHDGMv +vzVhL0YfDKTddmClqxFoeNYFf0C82yb1JejvjAo5AFKrjWzEtwBo320jSHte6v4B +RvzEsA8136wfnkID0SHPk/KxE9K5djqROQ5hn/+WZzE2trqqQLlWIoe9MCfF+B6h +fKHw9CoyXRRfWlu7K8F+411dYoo5oFgbJ3FDGsVtZNhCRES/xn5klz538AIUWiv2 +qy7LJvvejPAKpnTziUEqkGfNmv5Q9Q/pN6xJsreJb03p3JLGTddeicNacr2ElEDq +pOWEbpxL2IBOdNYuYKYQdaxCUxmPwEBjiQIlBBgBAgAPBQJOXbwvAhsMBQkDwmcA +AAoJEBk/GAq1XZl3mwIQAI5IMKuMerWu++Yyt7JgoqP9B6pAE3bh3OaKTWaWVzaf +0HSezNU6gV/yc5UVezARSS5R+/lmp1RprfKxt1ZtuU5cKHYdSbr781vULvnFIffF +Jlqw2VV3TOlNxGammzyFvxE+CLUC0yQ0tlNrc7wVjZDjN2mz28TqOeZsBfHknBQK +WgtmUbWRCqm6ZeZHFHja2Yt5u5exhChbg4hX23ao/w9raTlly6iaahqNYgJhcnlN +REY9ecV723E7IaF43/bXfLnDJiA5nCqSCP6PM7yEWnxQVo1uyijfzIqzRBNrh99X +G//ucPt+h9JveabuZE63NQTvSWdPQY+fUYze1YlPfdRgsTcm5hJ5e91tAubH2Fv5 +LkIIUzIwdD3Cv6c9inQzHw0DUzbL2YxiWDQU0LMNU5OtlHxjx3Rv0ScoyLN4cyJY +glZCMHsYRzsFqwAdCJVNoEQTxZrTCTWtST0f9CECbzcZlIVtzi3/IkoEExWxy3Mf +uekIcECixRXyxfvdFEIGwnAI/rlzTl5H2HxKjdo3MFWAJtCpk9DMx8gc7VLVpVnt +WhZwzVxsGytW3CU5cz9/uuYlWKHlf7b7MOaDw2cQhhID9FZV3owuhPFRWvhr3LrS +R0YkaPdUIXEHu3dXm62u1t8ADQLnrqI1d5P2u9Hhy5BohUd+QYaLwq9IXZ65cNN3 +uQINBFHNxxoBEAC7nB1AFiIke6oUVZh1zKL8+Si7dlQ0J4Gcwi8jhxSVnfgfrCYg +tLCo4zdKnQSdh8jrTDW7oxiuSIbkzRReg7sTGA8b0TUyTemndGXNb/ULzQj4KbZW +o9lRtBMbpuGM0R6SNX0bc8hTJ54hH4FLL+l0hYSrRZcZ9WNdcOleOQNX+fU67x+l +70lLIECoje2+C4Cq1bhcVXF1Qy6DS+4DLvZgMoySguUyAyp4ivVcGdMxkzS/iKvZ +drLiONn2hlt+m6j3h7dLdAQKBLRD9+njE248t/+aij966chB3BywmF3F0Val72rs +J2bxqRVS6xxeoUZZout/qIpX2Y/pF5slpzvADWdm3XG4a0tANsgixpZ7qQwHFXn0 +1Pz2NGrur37pvbAk964XZJ11oCROBkQArCMGRrjHwyyUbcoaGdxBdDiAoaBhyl5J +vU9QCs/r+0D4w6wqknfAl7S0jX7+6Nr1JaRJAmzivKeA8xGu7iJlM0dLa+bvauCz +G56HCVxJdSuDb+A6ILa/Rv3KktwWDn3lVI7KEl5lBnfotTSgl30QetaI03zw2mMI +sSrifRm7yGwnLctJXc7ZmqZQdGWEO3ydh5ae8yTc+smgnl4fA557To0Tv+vdY6XA +2ulV3TdvmlCL7lnhV0lYq/xMJ6KknH4T4ZbB7lMG+1jJXrxSFL8kZxcqZwARAQAB +iQREBBgBAgAPBQJRzccaAhsCBQkJZgGAAikJEBk/GAq1XZl3wV0gBBkBAgAGBQJR +zccaAAoJEI77GWKQiPVldFIP/j5m0erquVWssZyomy/2jCDK/fDPz0ppUWpg4grp +UAWUHRfNvE07HopTnY0U7XQMSC4bCiljsKtec8M7T08RqGOiIRaGr2FzaLXEBDEQ +0K5P85hjMKAZWoGCvE7yspeVEKuid0VBXtDLl9X0b6Kz1z/JhfKsv+OusJOAAzVz +TA5gvjhRcV6Opy4Q4k99JFIep4ZRHompWVjcTH5VPf0JsRv5CRZ4CZd2/2htCw0U +lF0MSdqDErEQGD98LdMf/2kYUA2RYxhaG/h87Rk1ArXrD1Xp1b5qe0Rp5JZsaCes +6/FHE/jHINigsGUHEZ5Nf4vWgKfrB2ih3WUkGHGpYFlTp26Vz+HEUAlkqktYDS8Y +dUeP0A9oG6yxh02QNdk50Wm945xIbuQLPiUOjc6AL+mKQMGGgNlhpY28FvnHZlot +lseXj59a77ebk3ISSy0Bp540wxiNQypTltjsIhvVvEywpBYrWFRyOxe6vSj2LinE +U8YmQbRo8eC75gRWrdMgWZF51Z0qF91S6RW0n881HEtXG8eH3ACjkbq5f4LP7rPX +KMT2sJCOW2aZRephlznfpZ6pMo0HgdbYRUkZjchABgKt8+Y26H2kBGnvsFW98gdm +RBULGBtoifNRz3D8L51ivfeVTSyH+lDPLmNurFVGH2d/Mu45vRxAQHLzIY7XIHbp +fgLsevwP/AqjbDpvLF9N5oInovr1fJAOnRvdaxrrngGft+FC63Er5soDaZPktK5j +nINrSCkZiCTCG/xtPBLynj4yRvmgwcjtw6aEGtnAoz41JkPmddhj9pThAkuObZ6E +HQZPV3NQBCYvw9qDod1ZJ517QB+AMYmQxIRkjf7g68J6J4+9VVZDP53WXolF/CaF +g5S+UqD3Vw2bCKRTq2JkXw0Cfe3zbq/xz/jGU613/PU9pgi8hKioozQATxvCfgZP +pm+FYTgbtsYXYTjXciRTxpoXggW9bGl2ICYrIfRtDNQFBcgTSylPIDqqrBawYkA3 +jZm4vnw1SavMzWh1gh0QCJPtn8LxtjVL0Ck1qgwlVlWSI+GpPyOaU+KgefVvn7qK +eum2OagJjIPwnDf+N02DFx+JGRcVAU+4wblDHi0chP5fH65YrXmd7d5QfpEuTKdI +5J0EuEm4PFz8gXptzOwllwKV7wDBGzdEIZlt4hXjixEw2o8gKu58s7qZcPApb7c6 +ec15km0oZJpd41+ZxuUUdWmnsQvyJHe61O5g5CXqiGz6lSlZp92Ai4RJwVuivn2P +ropwMXvZ+D7BWI8ETXzWtYknZWG1F7Dbhe5WIuAGt5NGug4BXOXeuSvfazFo0MKR +CqG4TNe+Iwee+yub6bGVcPu5R2EMjHa+koR0YdTu3sRbJPZzQ72CuQINBFHNx18B +EAC8lhILAFOFiS/PFhYxGKfN+Tv8g1HaSIGCFKPXUUT0YwYhJCgwHklbV7cFagmx +HGHELRFW9Jzw2SV6r0206CsBrlAxWXX1QjI60eBdiIZjhSTycG0VcnUCDnI27uJO +tNy/UBZtmClsuuCx2GGCsgYSNucek44mFvmvsaK8ytENZS6lRriW6l9th8hE/Lj+ +Ss7LRmSVPRf7aN2X8o5Z5OMXf7kS2R8ScFAGG9lkyr0YETg1NPVE1HUBV+jof1vk +LVprA2bURqld1nKKOr6HKLuxM5eZ7jNraCoSAhPPrfOSl0YAt+hZ8ZepwfvFgaek +3V85VjVT79cOzkdHMbDzCsaNhS0tM5qZL/UZTcgRtHgH/2mHHLFJ+k3fd4rY0QUq +5ngBHo2PwWx26Lc7izfvwPzY0A1zuLU4YqozppoWhVMoIoZ5dPrU76Bd9IfrbZ0u +M6KJ9nItWQEOA/PrfydSur6578gHbkA1umGCkLQuizAqmXQ5yU3Nf3RI4j6zbRN0 +3DIw7vVN1BD2eL2x1w9vKjjcsdKuRUS0aehfa9WE9WKEUyY8dzouzl8RAgLaRcot +y/N6jVMi55gxLX2j4PtdVChXC0CkuG3iH6Mlbuc9XmqOBag8u+TRXvNN45UN6nbr +SlHz0QAQ7SbMH5JEK//3EaSvrzWFni6fOpOCoxjIIPNJJwARAQABiQIlBBgBAgAP +BQJRzcdfAhsMBQkJZgGAAAoJEBk/GAq1XZl3cA4QAIJAIc0DDP8JrkDjKO3Cf4wx +mBSzR4PUWrgRbG+A+XMNzYNQGASbst014ckSNKRAmsrzSvBINBOAVliGZIbI6d7u +jbvQWHrSyQxdyiDrPrz2P0qwMu927SGDeZB5513rSDaH6D2U4QI53V3yOxiWcAIp +LUrg/j2LQsMUSkUe9vO78nKw9oFdPHhzTgVgICmvTilKYzIkVjInz8ke4I+EA439 +2FLq58A3lw9MgWi0XEVnR9c+ddorR1I5Ku28NnVkjeXA+2uQFYRtcnSxx9PXttwt +pSossDyJD2K5H1pjpF0GyzCVTvBJgHLTZ/bOHfQNDLv29yRVczCjiyujNEM1Sm/k +4V0IFBB5nUDX0xDhNRL51tXJQ0HhpeJI1oDzCvKWtLhF2qxH7bx/uYJBF3GhFQ0f +Or6zqDf1lnJnJTElY/pbt1teZsrbATPqCQnDkNhG9z8JMceGYl0nz31CaWI3sBGg +TCY9JdRLLIWQygaN7jOlyRWnTpnKRgJQ/dOotrf9DWvgrUYIiPA7pubQdwww3GAG +5Ieb9jnJtc8YCnM+AgWAqQoDxM49zKjkOy287UqGLO0+pL+wjEk+dDsMuqwba71a +OhQo6gZzfG/eHmKCCPITbSqaAD/DD9QRhULz99GGybdnLPoAiurrANxL4e0UkpDF +L/nyyG8tKpwEuF8T7f7kuQQNBFHNx6MQEACbR1gnAryeceHHc3ljQxERLFBCBZ4V +cQkDYxxpQRMsk5ZvxH3u2I9w9oKgJNou9ZI8XLluqg25CM1DGUKKoV7CDsdaP7GC +gE6OMj+VhPr9mjKsTzYyHLMaLPSOX7t/mfT7SbbZovknXIz7U4UeLT9djTlP4pen +FFv0csVRAuETPrlCHFut59evYoGlVax10I9+T+aC3v2OY0yB9vukxalccvFL2RdT +lV//ElMNrPe7BoSVrBlSycDZqYsU53QxCdDCWJ7+43iQave09edVmVscxZpiVoHd +vcz5j3u/krMY57QEem1ZFhygsYaG0A1n1XJ3cn5nf6oIJvG6kHZ8mgoi+89rfbg8 +w/N3lUH1ZABLgzN+hJ+byexHc6epQbH+ZVmJEnMPtmND9Wcpg14gaXH+1ygvTnW1 +FusFDatdmM43UJ4M+mP4scA2s0Iix9xXHmbbEQLWp3C/n3R3n6ImTtoekAfH3IOt +4eoMU0qgIn6VhL91/aGBxQVhSPWR2XxkS7gClCxWAatRMWWf6Vg2uuJeVra1x6Yq +iVrsEx7446G4fkv/z3jqUl7gdt/KBlCg0BYE1meBqJSnCvvgDXmJ8lEU32L0IE/A +9WkKCMMx74+GdBKATCuBGskJrOwb8dCVXBN0fq4fg/SBKjWY3JoQAX9JcXmcg4oB +jGWpLUX5zU3CNwADBQ//X6WxF5cmQo0gu7mMjGkWo+Xdl26afEDhTppucb/rxZka +Emucxt0R7kzqyxjqrp3SNJhmhmtSm9UkhSyvKHH1R2jSF3VrWRZYRrUgf0PJLelI +WGRPWcnlw6WcmB3imgMEtLKcwRvhqUhgC/wc8kyPD24sDb33dOdnqRsyfX1PRPbB +csQzSbQfnoZZDDnJbxuNOnJYHquRo2OIWCKPjchfSoe1U3JioZwD9yYQj/6Y5RU1 +5Fk8OutmJr49FT9I62qQOwGJ4BKI9FRTX+y8rCF3dNOpgxTABmXjqAl9SfghIIjk +SXgPNhKioxQ/mciuji+2Hdoim3IxCg0GJZxFxpyNTQWR27kn/p4NhwpLnRnF/qD6 +b1N54pL3o9VRLgVR700+/vSu81ipl9aurYUrVsDtupcEzzKpyb+Z+A6nwrAQb/Cb +SBnCoV4w5wU2MPeLHNE+gp8VLbS+CYgUpchFu/XKkgTIqgGIvQ8FBvJh3leU89XS +qvRb92qkZ+LQbpDbpaJGM6G9huijVsAChmYEKy9lFa9/fH1I81E7M6q+AawWyiEI +KBBVLToH4GS0TWkADrEZ6LI5+P0IkplDm5ttOsepfX//fqkAJLhfy0Slu0KE7hvr +S2RDjnjrUFAJhv/7fKKzZ7j8BkUINXWK4gcytkzkBUPF2mfpUH9CCetirVwVvHKJ +AiUEGAECAA8FAlHNx6MCGwwFCQlmAYAACgkQGT8YCrVdmXeEAxAAnH4mQOYOh/49 +0YmWPrt5mKG0rv3kNTOOx+TlBpcXOI+RFv4JliFFfmclqhdHyaveRZ4Ho1hPGaoJ +RM+rlB0nJoWFo44hN3dQ0Qdv3WsD9ewzi/D1ODKsvYZmxd7S5gH0K/wr+g/ZUHMI +FeARHbviBkQM/bq9PDdYK8vDbTzix9Xk2nH/zIWSjnY3Bj16Gyn0Tkxc3gsUal1P +ypTuMbaznHB9SljvkbM9p+iG7Q5bG6tfUv6eJR3Ex0J4OcnVEEJrpq3rDzrH10XL +rvYXSofAYjz2sQ/NpKdfL4dOxLiD/67hEXKjZEH8Pp53ZxMNCC7sdaTWkaLgcCE9 +fzQX8g3vmZAXMPU2ET1CNjkl9QvCx9yRGnY6VN6pvRmQjo/L2UhCqN9xWcUEmyhB +lLkSzcaIyhpaQ9lLTXu6uA8Bh9XyksLo+4uqbfuc3hK9vkKqoJNP+hR/sdHqgEjX +Ks093B643nXVe40az5flt7xKlR7PI/FVm9ALoL25seBQbSNRemZixLiFAQev5hYc +/75PaDozWbhVWsK/IN4dSdHOk5fjaJyIANPRPm0jvYhh9+snJ8A7+Q1Bwfw6nbbd +cQnZiHSbaFn3zkK4fkxzqnPGov3PlB4WZjmQLwzbUmZ3pReGA7z5R9MjT6ZhTpzg +CAf4F0UC9mAucwHZOkjI0HulK1HliZc= +=prMe +-----END PGP PUBLIC KEY BLOCK----- + +Type bits keyID Date User ID +RSA 2048 0xB96CD0C7 2001/01/04 *** DEFAULT SIGNING KEY *** + Bill Stoddard + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: PGP 6.5.8 + +mQENAzpT47cAAAEIALLL4JXm/9vHTouYSWrdDvAvNNxa6UwOZ1Sp6urCgGtuRLz3 +ysFFY4hlfIhSUvMdBuLMY5X73Tzg0+LpzCBuvRHasSUWO/5UMlTdS4LnI6oIS+7T +Nc//iwPQaH+P3CU2QScftyI0kS6kxr49Ejf4UZrJwMXsgvk+oDzRIdx1X8F4A5oW +oAUl2njrqVodbO9nPifBPlooHg84Cm3r1xgMK8OPPSEiVnmypmwTXE0fMsxAmW/6 +AqPf6x54tKmAyFY6UWM1bX/XhjVlwUu0Ax7ndBTKgw2ZCZA3TY3GQTPNbiK7eOpr +PUYN69EIKwtyFZHDSalkVpaZB44/nZygsbls0McABRG0IkJpbGwgU3RvZGRhcmQg +PGJpbGxAd3N0b2RkYXJkLmNvbT6JARUDBRA6U+O3nZygsbls0McBAazZCACW0+ss +3zAcpJNVI8rBZGwRSCEHW+NVRCQvrT4WiXQmb0fcTMJD8WD7kkMrYxaDuRzx4Iqr +nwdTqzc0MieM8j0lqa7zaoncxYFh/iLeeZKvK1988UIrVmFDslRQpnzeSXLjUWnF +1JYsS9+sYt8NBJGSIGXALji8QwcjpjRagzNjyO9YEs3TkGqdNslTQo1LJ2ZNIH6T +aIWoTdnoU9WUUldsSQEbYB6JNNP67eiFTRZZnKradoQ0PVBXtYZAw1zOp5y/xPH+ +72vhKLk7+Tt3zaV/SmoB52ssE7AXazdQtHfH3N5XXtZJvjIIf/Y/Svw+OaJ2nD3n +Jn3b7QtvWvkY2geD +=0D9G +-----END PGP PUBLIC KEY BLOCK----- + + +Type bits keyID Date User ID +RSA 2048 0x423FF2F1 2001/03/16 *** DEFAULT SIGNING KEY *** + Paul J. Reder + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: PGP 6.5.8 + +mQENAzqyerAAAAEIAMPeottLIzgSNklzro66gEnshbRLeb8MRwlivgOMxl5MgDpx +sH44MPaYKaB1owFQdVSSA+k8ARrxSbki46mQvK53+t1yUeVtaPu85GBta4Q2paXJ ++2/JVB83Qt8ZdkR7bA3Rxet+Poye4wqZcNQW271FS+sUkTvhAF6nb+5nWFNyKkTe +ApG9eudukksFd4Uh6ekMjpOX0HPUXoyzf7CmwSERZIny+qwK0dkKkr6qKvZZOEXu +wjnFgQoqcj242usLpGUfrGZCDQsOheGmaWH+RxrmccOqqqfmjo/EoHNjmEvfRSDP +Mviq9p574VRsKdt3smkyo63DcaguX/FV7EI/8vEABRG0J1BhdWwgSi4gUmVkZXIg +PHJlZGVycGpAcmFsZWlnaC5pYm0uY29tPokBFQMFEDqyerBf8VXsQj/y8QEBX5AH +/iGMf93L2+1NP2MHZzuggQrcRcf7fkOdVRfx0GcMUFuet4G/0Qg/NKy24J2xMVLI +E03//bn99c47BmGWlSrsuKM3nHXDtLHfmX9ajWB2x5TGLsQqCubfvGyxviFKyUKr +tVLrvOmfiOGZkbRjD1r1mjNKWONKgUcjgFmSqsZPnZsclNjOMnqENVwOtSS14r0K +YMquMP/sk7xDNZlRVUPEVn2TlLSBJp0NiAzwzbafbszX6xHLRJzE23hCGjl0ZnX+ +zkBusLpUGkuRkK6phJO6pg0E41D5QRnts3pHaDQ4EI6jEnWwlIsavrHh0mAw6ocf +oO+6PlKrPkqjgRSHYewLqnU= +=WB/Q +-----END PGP PUBLIC KEY BLOCK----- + + +Type bits keyID Date User ID +RSA 2048 0x6BBA9D5D 2002/04/08 *** DEFAULT SIGNING KEY *** + Cliff Woolley +sig 0x6BBA9D5D Cliff Woolley +sig 0xCC8B0F7E Aaron Bannert +DSS 1024 0xB0D5F771 2001/07/24 Cliff Woolley +sig 0xB0D5F771 Cliff Woolley +sig 0x6BBA9D5D Cliff Woolley +sig 0xCC8B0F7E Aaron Bannert + +Key 0x6BBA9D5D fingerprint = B777 8235 B7D0 36BC + A8E7 C012 842F 3E99 +Key 0xB0D5F771 fingerprint = 3DE0 24AF DA7A 4B15 + CB6C 1441 0F81 AA8A + B0D5 F771 + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: PGP 6.5.8 + +mQGiBDyyDL0RBAD7CpRGu7Gvtrp/J/wDKgOxLpX8xLTFTXFnncHctLYKMta6nQ1y +pQpx5WhrVyE3wkVPTHbDfd+mtviD8muBLAVdtiVbpN8YxRPxg4KAY+yzpBtIEsUW +xXc2C6JHgwlxmW+WNEUvBTllsG2m5FDuLiMw9UA7mGYsLChbt8S7T92YEQCg/1NP +toNBVqZ6X9n97L9SaZuykh8EALlUMsXlSauI/CjHbOB8/kXcBah2p33/eD35vEt8 +GVMwASc6N7u5fwnlCeEKRkLVZD0nmZ/8/50eQyQdL6MCPDyFERBMKlAs8VbpfwQH +Z3odHJcSbLEddmm3Y7ToCTpid03FO/UgonPbu/N//BNuu/WLimO6I3ZC9EYAMwWW +zzhEBACv3IIwjrkJHLxJZh6NJjoXJL5/w0FgRA+C08/nZBxcBWElavk1ukpxyB2v +23P531IljA8MT8VyQktNSzfAccQuvY3gIweDEgPXxpc5c1MqNihixDtZvAtoBqyr +nmKWgl1WeW26oe1eg/0XmpCSg5klaeF7EV0EV5DYUczNP5Ecv7QjQ2xpZmYgV29v +bGxleSA8andvb2xsZXlAYXBhY2hlLm9yZz6JAE4EEBECAA4FAjyyDL0ECwMBAgIZ +AQAKCRA2FSLXgqt70TzVAKCr/RJ3yVYBNdkZTW5e2PFFhHfZhgCfYBAPdm+WomzF +qHvigpnQ7KjXNuCJARwEEAEBAAYFAjyyDVAACgkQ1zqQuGu6nV2XRggAuGaGWQRp +apcTcrsPALlzUuzFOTApMePxmtaB66fKm6zdV6FpC4iSW5zaMZOZTNDOWD5541qe +Rl3JtP+lo/ZrY91gO9mmjkB5cnXQrzLP84rfL1LELgTgSJ3lcCFqgp6dJr3NI0UF +eMYcAu/OjjUQ9JNoNsxVjTvuxnslSOekQWU28CjD11/pm4n0VPlbPJosHv4wbncF +DplifohuXoQnJX7a2JbCTn0+YDvUe9+aMj6A1/qftgv4msvxqL7f8d8cZ5vwK+CC +VfcVNsFYf/EblFH9X05e4nBt/P58SnLLWxsCg6foNKpuK83SjPpTAYA2s8+AJ9CA +054a+swKXbFWDbkCDQQ8sg01EAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bxbrlL +OCDaAadWoxTpj0BV89AHxstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJPPT2N +286Z4VeSWc39uK50T8X8dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrUGvC/ +RgBYK+X0iP1YTknbzSC0neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVbGI2O +u1WMuF040zT9fBdXQ6MdGGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcpesqV +DNmWn6vQClCbAkbTCD1mpF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAgf/bu2YeGmA +ks94lBudJLT6kil4hSw1J8JuKPAEJNiXLupxmrMDOegB306y/GGIQg92kbgbMANl +wrsg3NXrnMe65PluraGnIovnh9KO9i4XSkIWdB3zQgTlkxhtfZ8NJHB/ihSnxtTa +u8zmJ1514QJzHH6lDlCzYNhS4tPvR6deIoUwzSupi8L8DKNhS/dwlvKmKQXMpII4 +PULCDT7/nFbB35GmA0E6vM4ZnmHaZNDv448OxoePR8bKy0RpdNIznKHV8MbhI5il +2IfzbiqJ0HIGtZJCaJSfIv2+qWsQf2JbY+uln+KiWwSkUI1MvqUHKKmC4/eMPVSK +xsm2vrikocYSgokARgQYEQIABgUCPLINNQAKCRA2FSLXgqt70d0RAJ4gArDns42K +44A6p/EkdHPvPRt2UACg1PdswGHhdskOJmGc6rftbDon2jyZAQ0DPLIMKAAAAQgA +zLpNBiA2pEnKa2OocaCvTSiYn1mSnXPbtqsBQdodIeq0zm8x1YizTWzhyocjIwM0 +N1i2QdFY8RQfmiqjoEOthzPCpP/3/K+BUYOpaq1Oro67DvmDnS8tOFvhQG2cDLcq +LXW1v9cDTSiRLP6cNZVyYYtlQAPoIkOVbnzBE2nHSeS5nv67XmDIvTNZJFlFHnUr +cbZ1Lcbg5blL94teRFNaVRaCVpBKGiIE3XycgWV5+MBVKRH0XOnmcyaOS0VaFIr7 +o/g0WjZ2Cn8lipjEx3KSi0cERIqZQFMfqTGC7oVuuyOrtvp6S3/9ltmtndkzJ7so +RMRnjS9eZW3XOpC4a7qdXQAFEbQjQ2xpZmYgV29vbGxleSA8andvb2xsZXlAYXBh +Y2hlLm9yZz6JARUDBRA8sgwo1zqQuGu6nV0BAaZLB/9tR1ZYc2tB4uFGqa1YJbIq +7qRYESrESkeePJvt5A1WF2n39zY7RwRECBuUhZe3GJVohac+kZ85pS6WbtihrO8I +HSuSm0HPvfkoedk21Md/zUzaaq+gKE/0eaPO1UycwZk8F8jv4uC2tKBwfbZyay5L +fQ8YcYM6XFzV0uY4oJF7x7jTaNT6iyQtsPPo6UAxNwcaZFdQ1Yz/ZFvl0vK3ssYz +h00QsYxy1TJGaqHXO26FlIBzP24xl//jbMVS88DKmltO07O1ZzZ0H8gvX5u9AYeO +S4jt7wJlJql5jQGQ781ZybGAzBma11ixK5XItq2mVaAQdJdOqMiTmJvWgE5/ymoQ +iQBGBBARAgAGBQI8shKPAAoJECFFSvDMiw9+E3cAoJCOGqlkIY3JXY7rYHqICrz8 +D7eRAKDOQjhlMF3OOD6KlGtnuBpdhpK6rw== +=gjEJ +-----END PGP PUBLIC KEY BLOCK----- +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: PGP 6.5.8 + +mQGiBDteBSwRBADAFBGWcqz40R9Ne7jX6zyk1XMqVsab4LNZMzd67n9J/Qni34Wq +5ZMHKUUqMYgIgKjUB4J7J56XVoPEujGBxG7kb5HOi4Vt8C8jg3FF551yM2WgamVT +cvEKwHeltYeIyYdq4DLCBt5GENA+/amakMS8LiHWPSz9+/RLzOUJABLuuQCg/y5p +WzAw0lIO0OoFz2U1RLQ+RZkEAL33hMq4C9yfGsEKkSp7od8koJ7Uw6SvZEbRLaiv +pxjDCeqM0Kd4CNyVgprdnnYmMxtsQQ8B1Hu9NE4///h1Gk1LWZnXw1/aTbZZKL21 +JPqkxdjRnqAztOuFo5pO0+EGG6Tg9euTjr4rZ9VhAYaO53Yhv+uDDaVB14HXtMMl +bw+1BACNRHYjHxJPrRTF4u8lwgEsUC15hPUQZyqCOtYrWcu/FcfEluduA9E/7OTj ++DblPWViPLb3+9ojjwA9A3MRFA80nJTMbloSdNsTvMq+UFmk2MkKS7qsAMjLRC9P +nbHA5tzzHuVscDZDLp7otIKaAGAqrxLXPc0DMM0JB6WG0A5N2bQlQ2xpZmYgV29v +bGxleSA8andvb2xsZXlAdmlyZ2luaWEuZWR1PokATgQQEQIADgUCO14FLAQLAwEC +AhkBAAoJEA+Bqoqw1fdxNb4AoNLFL4QgmbCEZhyVk1PwtC4oqmujAKCjymGdDhbi +SruZ7t/Qo0bvGpDa3IkBHAQQAQEABgUCPLIM3wAKCRDXOpC4a7qdXdBbCACjf9kq +TL7qzPfsiy+yaC7f2TVv9pzNMv6Qv+ep/zkNGYxHHokM6OQtGf4B4v7BLZ/23BS6 +Vikn77Q1OTtqtM5YTXwLOGIqjqgp1fwxIPAN0yekfAuGQi/gOpGVlRrOT0V/g/Yh +aoHdvhHo65pObnm2sCOt6hPJwbns2lgoVoWdlNkbsuU8oU8oFGY18Gxm1gNpMJsQ +48RHsFeVErIh3DA1tkCLOMQ0HpqVH7185JlKq9qaU5yAmUNSFfuHN/RHYWAKAN8R +mN4EhVLigxEk9/qU2lJ0RdSonGjCQU8WXGM00V4z6Oael9d6q1bsYKidYq6lvN1Q +jKAZTCVLNP+J81p8iQBGBBARAgAGBQI8sfqxAAoJECFFSvDMiw9+8FwAoIHAupTX +tAqACQ4JWN4THVPZgQHLAJ9n7mpZ3H0Jk9JsT7gkfB6lYxR0EJkBDQM7ZJxaAAAB +CACrn+bx3ALwnnFGAODsQJXtYmjarJ3IgknCW5G7NQgpv1rrN0DqqU6d1Xy+82aC +q9ixXXgoq3Tf4yPD2QqLCd26ZORYWxP5wmcdzE1HRgBXbFZ0DdHdUa5180mRRukg +X3JmU53s89tiEh8RH0ijqd7C88yGaHQFfgWmcbmAsBfyJ+pGyoyag630j/U1d9Pb +/7LMILYtyeFMY39T5xPIcEBA8zBCWp2kqp5aO+lSSB5ZnjOZpnwYc+EMoGL4+oTT +gPGHh/8P8OD35sik545t55XUX+KTPaP+T32s/FRyMf25GQg5bHOvczGarr99ZxOJ +yck94fk2UeEufMeL87Y3EUs5AAURtCVDbGlmZiBXb29sbGV5IDxqd29vbGxleUB2 +aXJnaW5pYS5lZHU+iQEVAwUQO2ScWseL87Y3EUs5AQFQKwgAn0iyFJcsYTov0q8J +Q1sfPZLYxo6Um4G2Sc2FmctlE+sc3GUc5IwpWQAfD7kQKJih1skL6HE2/yqPU2UJ +Ah9e8JeVqo34mBBJtUk9f+OTWauEIexCtaGpnRDT0JFOgBpBugzOnE7Z22SlaTAe +wi3OT9Mwv6UoTs/kt3oO8jZLemypUvgnWLtEpNAwFxgZXPtdC7EKs4eJhyjRdT+h +CIVKvwKlzRVSHtgPhYpGT0l/BCOF9qNGQ8QJcu1U0YyDXhPzU9Ymqzs4GJYFmNI4 +iQWIJhaegDYdFCIRzYv6/giTdccm4EfvjX/CgONsJHAAE1ldd0iElLX/A2se5oS8 +1VCpI4kBFQMFEDyyDNnXOpC4a7qdXQEBn4IH/1/cvLPV1AB5u4SlKIknGlwkKBN2 +UqLRxkEi9AeMAiAatgnbT7WD4mIbGpn6ITOzYZUA9wmxHvWCMIZGh0y83Z93E31+ +7zr/8W8qEdYR9416LXBEosWoh43vPXpmysFdXSwO8S5BYy+sIC2XRamvVYae1LxF +XNFY257pBSfbABtVtMdwo7LNNxNO1xpS4HFwoIHAmgH25dlD2AgrTjacNg1I2sPN +h/KWU8eOFbMdKpDYkhQiKhvObO4uND3JALTsjUqk9XYgxk1fTejS/o+c3BfQ79Bk +xo0Va2Sg8JA3lk5MaQPf4BRqGeZqqjNbogHhO2VzTwXgH5tY6kP+AR0vqlM= +=8dFY +-----END PGP PUBLIC KEY BLOCK----- + + +pub 1024D/751D7F27 1999-08-19 Graham Leggett + Key fingerprint = EB13 8C6A F0FC 6910 01B1 6D93 344A 844D 751D 7F27 +uid Graham Leggett + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.0.7 (GNU/Linux) + +mQGiBDe8doYRBADX8dv5WHSCk8CDrqMFs7eB3MHEIeWanX+7e43s2NTuDhxWUOOg +vWFYFM0aQrGGvJ3xT/8DrI3V6KdtBK1W/h2PjWNXoD1RsmBQZUzFx3PR+I+dwv+T +iMWgrIpD9x93AUvvTUYDDVq7NcYMDyL1/Le3Bm1u9MhwucTBD+jhgtKULwCg//5c +4yS482vmqWdR1nGLcqPGvo0EAK/2NvcgF28KhUPMMAkjl0YrGTmwbTLGJPbSK4nl +BbGlzn5QpNTf5llSVUwmWVZmoidmBf6ghuu3XNr/uwM16BagVa4wIPHolFlQsDUy +HMkVgtMrTHYHFdXZSPbQhU5UGzgF6QCgGHtzSISyHtiqXG+50xVPV8ku/bIJdws7 +ntrxA/95BJqZ71mVjBm+GHF4NBsSAkB5zeFcKBZaetLU6YAA3I2P8OMG5abCcr7H +p/g5pDHMvYW9vA5OvmBW69TAem2K02ifohjXA3RSfdqeZ/VOvySTHKaHM158a8Ad +BIMWFy8jgrT9rmwntPvofFD9xKh50XiJ1waJBj7rjvr8QyoQ9bQhR3JhaGFtIExl +Z2dldHQgPG1pbmZyaW5Ac2hhcnAuZm0+iEsEEBECAAsFAje8doYECwMBAgAKCRA0 +SoRNdR1/J8r3AKCdGB5mx8Vm6KAA2Fs/HtNzWTw+mACgzdv86/7AmHCTy5uH6mbj +ZeK/feaIRgQTEQIABgUCPdw82gAKCRBq1Wz+GTEbAAN5AJ9lGlLwQVv8nyYdKYBy +AP0M+17DIwCfZTyc/PJQHxCGH2ESqD+T5ElQMX+IRgQTEQIABgUCPaRGlQAKCRCL +2C5vMLlLXF6YAJ0WgqBLoX4b8bujrYe6PiRWZPm7aACglDrNXoM8TU93F/n3OgYx +btxDuxSIRgQQEQIABgUCPdxChAAKCRBVkeLAZmTAeCkCAJ454pYX8Lc+cPkqE0Ph +f8HeTEg18wCeMwbCbcyQ0ZhEnnUtWwuawxgAeNOJAJUDBRA93EdVms08wKmfdd0B +AbwiA/sFXOdYaAD5FoUrBPhxxMIWMru2h2LZd3A1/jLhcptO2GQGCMafFje9b1YC +APGsUgAtm128PzvvoOzge1tSUwGEWlQlEacDJo7REb++hOtycjccBUVMxaojlkwz +Gfff6u9Z68EbRM+UpZMRWV39j6s/Yl0yFwU6emQjPKpWQH5OcYg/AwUQPdxHdt26 +ZLosMS0vEQIkegCfZyX6DAKQXY5eYzuGuZZRl+0Ug/YAn0w5TNjR1Og+eYT6tal5 +XcyBYY+GiQEcBBABAQAGBQI93Q0DAAoJEPcTqHkQ/eB1qRsH/RpjHaZOHbpsNFeQ +KuPwxObBw6Rd72ut0N+N4ESVJSorytzCH//5rPmurmyMjtQ+b7qzohxDWMU8/ZJx +RJ6GpI+m55S+lyz6X1t8bDt9P1T5nAbsALOvsFQEv70pVYNtSg4sK5AAqLCJOdh9 +5+FQJJK7sMVLShB9Jo2okVVripGxZOKqTi4lhCdmVmWgAMKhODoXg8IOPjxO/hZq +oGP3cT5OW9hFYTmyECpMItTLYzcB2d3cTyYMaCg0kebMbuq+gAilho2NKRnZ0rJY +9I5ObSL0F/q1Ji7gCoTi/FkqWa/dz7kTzJdyov8Th0Fkt22uvlKbInfuFgjnFsoA +PFj6TpSIRgQTEQIABgUCPd0jKwAKCRCLOmAfCMl15aqFAJ9JlvmUZ+lIPP0OjQO/ +HM45FRalpQCgn6Kq7NSq3bPmc6bpkmBtEbdMOhuInAQQAQIABgUCPd0w0wAKCRAx +pj2W7BQLgR9oBACIOv5kNRdT2EEHeb66cjooslW8omWRiuLD3a/i0wZBCI0lFoie +HvH/ppJ1ELGMGCB7aBsahyBbDkxUMpPKOHwd5bu1p3qqUcqXbZw/GFjLyee8VwKD +iyYMm22O6J9Sduw4ypdS41mGmlPvdkV/Jrp57/3fYyxnu8tX790aohTPgIiZBBMB +AQAGBQI93TyXAAoJED6Pt/L4g0HZ4r4D5RnD0dfRtzX1iXFofoQ1TA1Hv1uIrdKG +WqBFR28exzkyY1rUgD1ob6kA2phT91YYuAKq0D0DIdL4plIK3XJqmirN0KkWyQXh +avEIOSVb24EMP8T1IWzQMVLsfJEJGZA9UrlVvSnjFvi6zDbk/AjpCG/oJOWhrNCC +yReDWRKGiEYEEBECAAYFAj3cRhYACgkQvrorh/X8S0Iv4gCg4PgxsbODf5rnxHwY +HzixdRl4hLMAn0f9VJRwdgH7s4eEHyjcFPpjsPe/tCNHcmFoYW0gTGVnZ2V0dCA8 +bWluZnJpbkBhcGFjaGUub3JnPohXBBMRAgAXBQI8su+QBQsHCgMEAxUDAgMWAgEC +F4AACgkQNEqETXUdfyeoZQCg7MBpKayIclyy0m8J8ftN2hTjGSwAoPcPHDXDSXvp +xRGpXBl9tlTOJVt/iEYEExECAAYFAj3cPPIACgkQatVs/hkxGwAgRACfTr4PRP6s +6BtADfk1nSlxH+PjDUsAoL7GXrtCAeg9RUtRhk2K83VuHkrmiEYEExECAAYFAj2k +RpcACgkQi9gubzC5S1wxsQCeKI3eJH2RLpP60M1uhMjNNOE2wqgAnA9GAOgdm1uR +wnJyy9oO/k+m8u3riQCVAwUQPdxHXZrNPMCpn3XdAQFpIgQAzv8Sg+KAfH3mfPp3 +qyfUgcP2gQ8fpkEvGKCQl5xIWuWu+x4xK5CDLI/cl9xS3aJxG/0CrjtxdDE/nriQ +Kpqyy3CXgX2QMca4Ud1SQm/Ij5mJqzpxungBVnvgXPH+HGyO8WVTb+ehEalKOz9b +dtXNrxzBdjzAYTD5ce41Bwl+XmOIPwMFED3cR4HdumS6LDEtLxEC1EQAn3bSMKFo +Uy0Qbn1AMQETscj/d+c1AKCloVdOiAlxq5UolYRgq9zX0w8mjYhGBBARAgAGBQI9 +3EoeAAoJEFWR4sBmZMB4+ycAn22HECjtgHXC7u9Ky74S1eqAkm/dAKDCQ0A++NEq +D2UBVDX49rj8YtcZh4kBHAQQAQEABgUCPd0NIQAKCRD3E6h5EP3gdXIPCACak1UE +LD9x7+rIZ1EhTRrgZBy4o7yj7xMMUzGd8jSmjjLyz2pcUA7WL4+qMlgtq27ZNb7V +dSeJpumvlnYDU/vPwJwgAlochQnl5CfYMVlnjrHnmKaZD9N4m+53UgabFm+N7yip +bL8MBs/m3K/EaRosNwRZyOfjbC688jV9mjj0//fHlBzj9DAjqMDoNpIMOnZNkwPd +2lsW7UHNWoYq14j0BEWNjtduvgqb7vHavOfUr9CDa/kEeFRkxWkz0uFMAFdP/nw+ +5yMtMwqVaE2bhIBRr4/vqkejKt4ZHIhhPI8Om65ERrdp6Dd/LM2+nmqBz8YHqRuj +LsjM+YoxkqlMJoriiEYEExECAAYFAj3dIzQACgkQizpgHwjJdeX1hACeIcBnwo0C +ZpwKg8iHUuh+E/bfqdgAoLPwaGaaRwPMNvluSV+PNdLZ14PsiJwEEAECAAYFAj3d +MNQACgkQMaY9luwUC4GJ0AP/dFH5CtCF/FZrHNzX2sSQRtO0szMd7GFc5DCbD8yw +ugDJBiS3a2YU8LcT79JW8kA6UL20EokQVqCmkVdNaUVaFRxGITwcGJ3Kvek6DK0c +UoWI/1R3B5INg5LAW1yfO74nyiZg6JqdZl3INbxDL73FwlZj79j7gSo5eZcolmuu +cheImQQTAQEABgUCPd08mgAKCRA+j7fy+INB2e+cA+dwXZgI8S+Z0P5X7eqg1bWo +lrq1DUTwWLCYq9OctBwrVDQkj0G30hBvUAiv2aXnTbtn/itcEA+eQg0cA9/zY+RA +a9mVVXdewFqI5GOkoVkivGzGpTdhNWrDvMLkK40XyIgoaT2mhxe4GerdVNA86Oyn +QNB5QTY5HEetIhK797kCDQQ3vHaGEAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bx +brlLOCDaAadWoxTpj0BV89AHxstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJP +PT2N286Z4VeSWc39uK50T8X8dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrU +GvC/RgBYK+X0iP1YTknbzSC0neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVb +GI2Ou1WMuF040zT9fBdXQ6MdGGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcp +esqVDNmWn6vQClCbAkbTCD1mpF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAggAosBU +cLsuvpn43c3M9txCs8fPDzeQL/0HGpcjNg2EaETggZJf8zlPvYOWMZgT8y64C86m +PUIILYh2wcZX+SXaETfKcxN3iVvMCjr/BOzUQcIOvUWyR6vpAj49MGvG7PLodbai +iIWmY6OCeMhQlnpMOiEGjyB0wnH/ImgxC/2Bppap4/Wl/kevVojKgS1V9zCHplI3 +3wmFaqPPYKV7jtlCyKYZY2jTiNjKourukAV/wXR7QgujP4NrqoSGQWXgXBWlEn+S +Dh80jZoXuz1t6n5Pv7iY8UaFUzdFUQX8PipHWRBmX3W0WTZBbfONKI9qoswDp4zz +7JV6y5fVnvNKUMnAp4g/AwUYN7x2hjRKhE11HX8nEQJ97QCgtVUJ4AhFQT4j6Da0 ++DR0+1BGPD0AoPiJO6zeeh5I/4g6m5QHXjeL2raZ +=qXzK +-----END PGP PUBLIC KEY BLOCK----- + + +pub 1024D/6D791A41 2001-10-26 Greg Ames + Key fingerprint = FA51 765D 3CE4 EB83 BFE1 BDB7 605E 165A 6D79 1A41 + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.0.4 (GNU/Linux) +Comment: For info see http://www.gnupg.org + +mQGiBDvZp3cRBACm75cSDrKQCCGZIv8QL/AvcNMidSpnuZn1Huvxq28bgl1eh3br +2JHBb8CYh1ijUNk9EQeB/fl6go8NiuWeLLVZkJGnqQRZSVGe+ukpZFLPFGb3mgGS +lBmO/88gQ3gld5Cfumy7VRmMA3EtLCQlI25h74RcPIw5Gzil7pSj9N4JywCgsLDR +olk/+Y4kTdHW1PTt0YbBETED+waq/aICopOLAtEC8W/G2uexi/m+FPXWwM80Mkxh +K+2tjZX9oxzQQ+/GDeFId3q5NbSndscAFMq57ZI9/daenkdGLQqG8gaO0Hto24dG +YNft/w92i5beYG0CPJoIFspCY46GeYaV0HoKaRkLVfcxXqN9UKvKmH18HhO6GO27 +idRMA/4l24wu/Qbp20PvEKTEAsPWQSfUjtbMECUdpmzC3/ZG6SWO1cICV/b+QlSC +p5agjTesvno7GJC5IVs09RAkW6NmX4wVLY1LROPIzCriJKoKfgEeJcEqXPZu8q2R +S3U2UPe0PEzzHjdWZlwps+iSr1qafaxRfZsnUXMU8X5KsV6GFbQfR3JlZyBBbWVz +IDxncmVnYW1lc0BhcGFjaGUub3JnPohdBBMRAgAdBQI72ad3BQkSzAMABQsHCgME +AxUDAgMWAgECF4AACgkQYF4WWm15GkGFuwCfaWyKPP8/CtIqgZkIBxUB4QqYwiMA +niSB7MFpia1iTSSLg7e9dum5wrasuQENBDvZp4UQBACBHtkysTqPXCHqzsr75CSL +7SbdmLQQamlMxw0crksTfDZyPIr6AVfZcojd+EHO/6bHU270FxuIwfR5n2NejIIx +oZzjkTJ/TAa2r5qFy1XoUMnodF4qSNPq/JTajIaHXTSgNtPfuw098h3ommZ8XGSh +OMEovonFFjNNXYCHeY5EBwAECwP+OJdDyBkt9r4Zr/5mbhsQJ78TlKhDpDy094zW +/pHgULSEsVKbGbRGcDLYnTZ8Hjs7pCuyGy7uaCuWArRrnAzP40LNHEao7svl1VmR +wZFsisZ10D5kRB8MRVh7ckdOqxq/lSC8AfMBaTmN81Z2ljMWQ7SEvdCGq5OU2wn7 +O59wAOmITAQYEQIADAUCO9mnhQUJEswDAAAKCRBgXhZabXkaQSHkAKCUveQ2Ews0 +yTd8V9Co3kVUq0E02QCfccreS0fXB9D57p8qPvXRWvJGiRs= +=SVx5 +-----END PGP PUBLIC KEY BLOCK----- + +pub 1024D/E04F9A89 2001-04-03 Roy T. Fielding + Key fingerprint = CBA5 A7C2 1EC1 4331 4C41 393E 5B96 8010 E04F 9A89 +uid Roy T. Fielding +uid Roy T. Fielding +uid Roy T. Fielding + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.1 (Darwin) + +mQGiBDrKHnYRBADjqUE4qp5WS3rI51oKVZOMLPyYI8lNwf8NwJ6LwfquU/DfiCf3 +K4CWKej721VMgT3zkd+PK/hGl8XpKGZIZIsPyZnvUOfPW9k+bxn3WtUiprwwVvBi +3YLOpKcubthMg9+Eh2IweR6iY/Jeoj8hk9+B1Yd7vq/Y1Dd6Hrn+NsqCDwCglzPc +5hfMjdVqU5l6O32udxhSRR0D/AgTSYi3PXJvJHzesRPQ7BMkwwxpl0C/D0WxRvIR +LlI6zAEgk5Du/JrmHqC5GCE7TF9gqM9BNCbJTnMupIMxM8hi+JwyhUqrpTEgri8f +OcNf/6KoaU+SeHMhxTR8Ji+n7Nb5ohYn+qRUnyLZ4i27AQU3IXOgmRgBhrlOdQyD +8zOsA/9/5YCQKeOUZscFSxk5V+lHAaRTUpUuxQ7CglWw/6sFZ8OqSWkYKB/+5C2f +uBAXsZpBsN9fjlIxwJJJJLT0nowlRrANg/h+QComqo6ddRbJWImrUah9wo+arBZG +nmFAFRD9FUjRJfllnQ627YivQvBda2/RSRUEyr+nPkUfxE4q3bQmUm95IFQuIEZp +ZWxkaW5nIDxyb3kuZmllbGRpbmdAZGF5LmNvbT6IXwQTEQIAHwUCQY74bgIbAwcL +CQgHAwIBAxUCAwMWAgECHgECF4AACgkQW5aAEOBPmokqrgCcC0KoXTZwGMuUEv9b +c2ddPD2Ggd8Anj0JI6lG+iLuXusECs0Ipr1XQLxLiEYEExECAAYFAkGiWWkACgkQ +BJfVkRK/55pyngCePS7ilC3pXrOMzwUCI/DQeCMoga4An3cgD0t6j2/T8nuB5h67 +Ze/LyaC1iEYEExECAAYFAkGaiCkACgkQMJF5cimLx9CgmwCgk3QCimNqLIcic0CR ++wNgBgp+gFgAnRixBUNQ9GLqJJWKbeMZ7b4i6TwfiEYEExECAAYFAkGalNAACgkQ +yX6cq3d1tHkmjwCgrSID1cu/xLIAA2ehOm8NMYWkG5oAoJzSZh1lT/kRwzHLwd+/ +IO316iobiEYEEhECAAYFAkGjAgMACgkQB2FzsZKExFKnPwCdEQRk8+Z8n8IFnhQn +1T6jXM7GLLoAoIP0sSWpQIs4z7zhRPjCqcAoKFnjiEYEExECAAYFAkGalnIACgkQ +XP03+sx4yJOmCQCfTixepfWLoiTqs1GTz6u737iP80MAoM0TnDk54Q8CbWYJ/9zY +6PCBwr6tiEYEExECAAYFAkGajQ4ACgkQF2rZyNGqiWJE7ACdHH2D5KlwbLgUFKzp +zng9JRU6hKsAnitj4Shya0KoWQPiNkFHgB0CX8ZHiEYEExECAAYFAkGbzpMACgkQ +XUFK4eAFyct6RQCfWQcbqL74JP946GValnxfJhhsQmEAnjm4jWAWWL3KtfXeOCgV +MbBhL/a/iJwEEwECAAYFAkGZgZgACgkQMaY9luwUC4FfOQP+K20bh55JEs49DkMM +gScH6P9DsCvZee+MNhjzLijzyWrdnMCRMEb4ye+cdPQxD+M+Wl0iaO61AMMqUCno +D6DDo20hhzU8kn5LneOJ93pcz1hjkpzof02FG+2sf6B5x/BdQshgL1ySiXrPb74q +s7gKuybtDtkobLRnKPuSESE/Lk+IRQQTEQIABgUCQZqKSwAKCRD8D4WJ+JS+Enqi +AJ0XZi3M3rfMuqe7tIagqiIeIlrm/wCXcrzjI78YE4XEeThe9a2kIIdIOohGBBMR +AgAGBQJBsRgPAAoJEN6ihzgyivIERxcAoIuSWSOTjocSQyedzgDeTDEs9r4AAKCo +F4H183O7HWf0pomjCRQh/4f3RYhGBBMRAgAGBQJBq3mCAAoJEM4BpH4cQ9hQk9UA +oJmXaSH3C0f9RfNUWtbM8TPBLoB+AJ4qqFgkYYfkDg9Cij28yyMa82tQE4hGBBIR +AgAGBQJBujwZAAoJEAEFZrzkE2OSx9UAni1LSdTKkDgpDcGEiAlZ1WpKQmAaAJ9W +Um5hl+2qSn/AVaMvGsp0XtgYVYhGBBARAgAGBQJBsBhLAAoJELK+vEAVKSSvVOsA +nAgKhSKJKOI3uBTfP1/blI/04BwzAJwPuS+s8QgwTUkxQWicyrq9pg2XjYhGBBIR +AgAGBQJB4viIAAoJEEzETQAR34fpsTMAn3DvE1Esp8Wc5JH8uaVjndouHtSeAJ9N +c+wBHb+a5/RIZAJy1Jt2Nfl0tYhGBBMRAgAGBQJBzkgcAAoJEME58VMjy3oqokQA +n0doBXF9FSeMRZV7u/ERU0n3qrVWAJ9ddFnxQU6Kra2eQpuBx57oPqoHAYhGBBMR +AgAGBQJCLiKFAAoJEALjkFHlgLNjWywAn08xy+7kZwLdHaFi16sdKm5oxsKuAKCm +r+MA/c7dvOb7f4Fh2vu/l1ITdIhGBBARAgAGBQJC3OR1AAoJEOyrDnuD5q4NFxIA +ni0tkRV7SDBFmZ7BhbqSsdpmLxo4AKCu3nRFWT+6MAY4v4JeTm8MrV7moIhGBBAR +AgAGBQJC4NkeAAoJEIzjdrgc1IYfkMQAn0t4Kh6txi12LJSkr4mc0P+AhQ75AJ9k +OjklBQCS7C1hlluI+oGhlLwKTYhGBBMRAgAGBQJC3rBQAAoJEP1viMYh0KcbHu0A +njNACpi5qo516Ohk4EiYmKFsNO+OAKDsu7NVsPst/s25q4qGT1H2p49kGYhGBBMR +AgAGBQJC3rqPAAoJEDLJ5M42QstLJsAAoLbRG9j6wci/e/oLkYTbJpaRWlVjAKCl +cvH1xY7KUnFRU063pqmJufzpsohGBBMRAgAGBQJC32zmAAoJEFCOrsUwLaVoI3IA +oL13PvN9g6/ApleNvcrGWJXlWqn3AJ0RbsVM6fCpYgsdsjE8kyjU/S2JsIhGBBMR +AgAGBQJC32zpAAoJEN26ZLosMS0vRMwAoIV8hheV4kG8fp2jVYr47RzWFvxbAKCv +8O9RmTGmEd1BJ4NPJZfcU195WIicBBMBAgAGBQJC3seiAAoJEDfj9F/uZeMhyKYE +AMoJv8QYRTXgpoUnT/IG34i4/sxCvL6yUmaMJPUN4zE/VvVpSb4gMHwVCKg5+fcg +7OdyA2OG405nmkvCCZSZFdWslifh+smzbYLSTKWMaEIupFFntKH9ynOLXjewoSux +lY4EreMrxqRhTdXXaIpzLw86hcz3rLptfvhyezFtIOPGiJwEEwECAAYFAkLfbOMA +CgkQms08wKmfdd3jiAP/RHxhO/f4LLOaSPnVENjNK7st8D0MXHDXbDQYerEmJwuz +7DT+uup9Sn/3NRA27vtDXJ9UgwVUYuuO2MJ4Ij6U+RbTcGwh9WElnACOaXKhv4Xs +pdt8/7TA5BNcHL72RYzY58oj4hHN5WfyIO6kKa1TE+Ta+T/QHZOV1Hk5jQfIXTKI +RgQTEQIABgUCQuDsuAAKCRDJtabs4td03wPaAJ95/ud8yHueG8HminBF4JB8BdYb +lgCeNp3z89IspuW5AXQ85pIMeJF3U2y0JVJveSBULiBGaWVsZGluZyA8ZmllbGRp +bmdAYXBhY2hlLm9yZz6IVwQTEQIAFwULBwoDBAMVAwIDFgIBAheABQJBjvlFAAoJ +EFuWgBDgT5qJ0sAAnRsrrqrOFCISuF4mRulEeGXclRjWAJ9IxE/dEuR54aRjmELH +2TxUFg/T3YkAlQMFEDrKbLcbCAxFJxmvNQEBvdAD/0pvyvL/ZC0GFpqdtApJX9eL +yaR6bDkfNh/OrnFYu0s7Efb2j6KMFef9fx90gJ3gRSJj6ngX5eY4uejUGLoVx7aQ +qJZePZedwy77uxEyI+SBlVJU8ArsL8ZjR2M/4TqSbw6+fJ/Y2KZECmoVpz7tTgFv +eWNZxXKDbNkAVLwRQT+OiQEcBBABAQAGBQI6ynZpAAoJEPcTqHkQ/eB1+gIH/055 +hND4xOZqJo/+5AgkLx5f+M164bX7/WZVaSIDZbYF3AwCejYvdxh6e9wJ8ZP3ZyID +jNtAEwZDCtDWNPUod5cgO2bVtQmxbIRXi7B1Wo/IaJVSbdmbWfE4exXiOumMS4n6 +oDYGOxVqUD4NkPbc2RxL9dKpF22o8+VUMwFOrClsb9X0KOa6FpHetCCyQnxsySbk +wsT3ATCa1lpkaoWOCaAIAi5lH1eaxWvf4PbChH/E5NknS7y2a+duAZtZSKKzj6MI +MpdiAk8tAF8wlvdZ8aN7BGFmX90evFcw+U/oHODlFog6yGNZIUx70TPVR1zdhgxw +aCUmp4RS7vZA0tI8aBSIPwMFEEBfU1zMsutG52z20BECzRgAniaAcrtVanVO2Qrl +0s59C1Fx+um1AJ9aB64YaNz6AYZgKfF+hsIldgp6Z4kCHAQQAQIABgUCPdlGwAAK +CRAkDmb8xZwycPc5EACzRyV4vUKrRtXKx5mdnQ0IHx8d3x/qcIBQ1Y/2QM3LU4DR +zeYV7fV8TIv3iBfxd1625BOx2LAbQ8ElDl7PLD4E/29dB7MwhtYJjqurR5yOh+6n +nWcvJoz8owR6hS2DJ/i03+A9dzn9YpQRvmMOnACVrpL7IZZ2V+Kqk4TN3G4LGSfd +LM/vpYsb2Ghqr5MQ3/F89LxuJZn74m1dCvCwBAoJf2RQlNesIb/irMsfU7Y5Fs0h +5HHONNdiwTGIO7VEHyWvJlQ4rMSOp/rAw8k5uAdgHK6SMn10ogEj+qKUOcnHSeqg +hXnFBorhHdb3Qmqc2s30b/YtItk5EIyXsARV6mdr55wtn0hp3wX8d3ct0zcMsYsl +IlNuAXqQUCH2NO7Yjz2LF3K0A3cBz+PcXGjkXD/bUPsZG1DhbDwoxh8YeKGXZ0k4 +MKeb775EF5jgMT+cArHqi/OLqs1OcJNjYy35+plQSMSM0BPCdk7P+bcf4YOGRDei +AukLnA+Dkl1CAzBDhFS9y231tLfob7w9CMoAXXF+E8mAG0QuLpVMta/JgMiOx3O7 +xs5t5JWOMIdv3FA8tSNdiviA3DIr1nhphoLu0mzGlD4W1dyczh5MBx8kCYgS+nS3 +ASd8NR9OSYuelOsRn0ykyThbVaewnY8VrwUsmp5JOCXAPWj2SOT7KQNmRa+GPYkC +HAQQAQIABgUCPqRYcgAKCRDNY9HdhPkmT/o2D/42zg5Qwy77OvS37qEO371dsJsV +IUSSi1lb9s8+GlwzyufGdlFkhgQ67q4vI0esl32DrdXwA4aVfuwp+HXj1nTuW0l+ +otOnvtt2UWtZgHHlVl6LLfGxMM+Ez1AaXym934adTRwoJ77jqeNO/G1t/Fvh8Cws +8bM5nIOvcFYVFEF+67DFsNgiEjKztICy/0nNSWOE07vWWOXXsQacLemPRsG/zRVd +45BNib5rBCLQFLqA5D6FXO4PLXCNb1ltsJENs/mN+MseihtQ82h2ENALOEiDCuOi +f3D8bX8ZY+BwLbQn9iROzalaj7OJIJitAGfOFrdvD2Y6cZ8puakTYOzmBALPmSzS +kViEMrjnUQoTxSK9fu9DCQ/UfUpDLuec9rCPrsJl2cQxW+rZ9UncxaEq6soa9ccZ +niO2y+0R5b4hIOIxO9quZnYwHwdE9bIeEfjAzAN3vCwQh2VEkaL45qpGJdenwcc0 +yiayliiYVvt0PA63F1Hg7fpirLceJNtWW3u8Thiz5RcsDx0PxTREiixjhTPtCc1X +Trv3QPR9QgGBp5W4Zd3xYDLrAS8+2ddlLIobWK7YEsr8s7aNce26FXwJRnnPeZL5 +LUkCXXiIJ+LZAvyWnVEOS1qNtE95HSTVZkhkUYxDf8BHchuRIFvlIVajKz1CuP9x +mvu7WjsV9D4weEcJZohGBBARAgAGBQI9e3QXAAoJEAkiEpbxiQSLJXwAoJ0zFfYi +1mAUhrWxvZW+doXeuDvxAJsHdbykofeTkQtvD9CyjO0XdF2wqYhGBBARAgAGBQI+ +pFcNAAoJEDGGzQRPCfBVWkMAnioUdcTH1PuioPpVojukOAeUH+AvAJ9EXXfWIgsa +tgzCTDaPFs1lzFqe+ohGBBARAgAGBQI/whdoAAoJEInYTK9GsmLGTyAAoIVutvAn +c0nj27Rqp+EYbx6YsbsaAJ4p7w/+fZjEa0wsf5Hy1r82UxHWg4hGBBARAgAGBQJA +I7WkAAoJENtdJwgR1Yk9XmQAn0rLEaoX4IpXbDbVM1Yxf71vvgVZAJ9XMdPdVtk1 +LpDO4qv83rzLwWwo/YiZBBIBAgAGBQI/ym+aAAoJED6Pt/L4g0HZQp4D50gsuxjD +1o0ZlS8sNxNhZHgaxohzBTgavEIY2ltnNUxshRdMtoBMx9tVvmZQFI4Dil57m4WB +9fE0eMI5yQSUcVZd/Wj56uyrb4xwcZfWxU3k9uChf/eyqpEtH/V50DLdK1WUgGVU +ndcWSNAPxKgCd3RbUxAEZx7B9zNf0I5GiEYEEhECAAYFAj3iURUACgkQiNfNvfQ8 +L5IdLQCghH3YKiAJRmA5vSVPqcDrGY2/jmgAnjBuzJlZtfpu7Q8twmFpXf2Fcbv2 +iJwEEwECAAYFAj/CgYoACgkQN+P0X+5l4yHW2AP+NpYD54gNj9Ll96pKXeEH7+Dl +XNmeZwQSyY5F9V4luQaO2Qt15O+YK9eHOMnb32U2bwOo/LrDuraC0L63EOFalkNU +TkRHXLrt5uZc6+Jz9KhoxNcv5rtoIKsi0p9a06d6yx3ppkfZHwqIxdAC8YRAvyhe +WeZIZi3phb1let7y3F6IRgQTEQIABgUCPaRG0QAKCRCL2C5vMLlLXJtyAJ9N/nWN +2dCv+92Z697B/SSJyvoLvQCfaI7sopLLYw+aVPdj4vykTZIdwJKIRgQTEQIABgUC +PdiF5gAKCRBmNbbA3ohd0+P7AJ97IR6ryjBehFyut0EboKhdVN4mtgCgrwnqzg/M +f/+142L7aT3TeKYKfKCIRgQTEQIABgUCP7ppgwAKCRDLMqEHiMOlpTTXAJ9GxCno +937c9EpYtek6c+RkrheWNwCeKWKyFYAjFklOk7J23KII18XNq16IRgQTEQIABgUC +P7qSXgAKCRBc/Tf6zHjIk9T+AJwIbe3CG+SZEyz6IliuRTAs3R3V1ACgspn53noF +uYBKawQvI5718Di+BpWIRgQTEQIABgUCP8HFwQAKCRA2FSLXgqt70U9LAKCoGLVF +3oBqemNHB/VMvL08pmRT4wCeKr1wCr+vM3wjDriHf5Xx6FEoJKuIRgQTEQIABgUC +P8IaZAAKCRCJ2EyvRrJixkInAKCF5uuqPNCP1F+m7z9fR/nIJb3qeACfRcJhJmXY +lNNLonnExeQT0hjOYYaIRgQTEQIABgUCQBXUSgAKCRAVP6DNdaZ2kndiAJ9eTafo +NOGtPDsjQQB/LEpX8Nqg+ACeKEqMt8CgNKCBqQE2DuxjUOY/cjyIRgQTEQIABgUC +QWVtyQAKCRA7KW1RzBhaO3XNAKCyI2RhtJ1IFIjJd8STppArFxLjSACgkL809tt4 +gdjw0ocpzW/9OzY+QQqIRgQTEQIABgUCQWVudgAKCRA2Or8wn8PVfj9EAJ4ltkHf +zOrj1LD83ArlaUPP6Sy9eQCgqIY4Nsnrfb8h3J1tgQUPDxiQH6+IRgQTEQIABgUC +QXA6EAAKCRAPkZbeblLCnjRnAKDlCfbsdTR+la6YbpNf0Aq0+DH3xQCfVuKzP9Ws +0sSX3UklvGJAYMmYbN2ISQQwEQIACQUCPg03yQIdAAAKCRCL2C5vMLlLXPO9AJoC +/yIz2xDEryTy37M27KTIAheuwACdEskgLXTBtz28QrFmPFx2OVg/lT+IRgQTEQIA +BgUCQZomGgAKCRCLOmAfCMl15W/YAKCtdn5CG/LaBJ7DjRV8N5XjK8JxggCgnq7S +lDL+JQGB6LRBL5TdcXas/teIRgQTEQIABgUCQaJZaQAKCRAEl9WREr/nmpBNAKCl +/IZ+aETlq3NzYHkF0KSdmIrvKgCfSjDLzQWgoUDTLX0gxfXh1+0X3PaIRgQTEQIA +BgUCQZqIKQAKCRAwkXlyKYvH0LwOAKC2lY8Ulzv7vv91eORNdJr4GRNAkgCfZJgR +MWXhcilBCSKpKbQhNWbNBdWIRgQQEQIABgUCQZlVcQAKCRDJfFCWXBw61y6gAKD2 +jC8aqDOejUjA3krguJUQcdTvawCfT20bNihqtriktT6pjZcSLRJAW+OJARwEEwEC +AAYFAj+/wGsACgkQBurPqnbYPMYnvQf+Mgvva9ljDjZXI+kLdEnPA86EHnANzh1P +4VnC0a0Eq4o218U6C+9oUekhwz4wD2jAZUdoC4qwDtrFtHh76hDycfxciw7QgTbi +LNKBD82a0P+ZuMFL6omfBzoeBlvswvvg/G+1LBSSPJTHV9nOpgoSDFZcKfrcX819 +KrKxeKGJXUIbYsOhX+PVNSGzPkNGjk+8jxWM6SiueIpQUJTQqa+9eKcR8/YuLmyG +RhJMQrmJO8/wRFqblkOwASta18bdgYNHDpQuvRWgLhqHLM1P99AKaP+qGmyXP2qq +DMh5Zy9TjRo06O0CiGPcioQ5PDDxrqnhqxEYQuwrvXJDFSvuj7BCqYhGBBMRAgAG +BQJBmpTQAAoJEMl+nKt3dbR5MbgAn0YbFWKhffr32B6yuApTBZdXEkHRAJ4qqFjW +qgYqBJx8XS5AdAY9dY65n4hGBBIRAgAGBQJBowIDAAoJEAdhc7GShMRSdakAn1TS +35CiLVymIbX8h9mP0a/6nog8AJ0eibyHC9WX/n0FRiGrjvlvL0eHP4hGBBIRAgAG +BQJAMBtjAAoJEC6L0IDMac7t4y4AoJhqI3bieTdIsLXoAkHPNQRljxaUAKCEgjL7 +xBbbcAXM8x4RiRmWZY2uy4hGBBMRAgAGBQJBmo0OAAoJEBdq2cjRqolikOwAoJbo +SnWnLET+R/tlHslqWcek7VMIAJ4rrxd46qybfMYQHrrV6OtCS1v4w4hGBBMRAgAG +BQJBm86KAAoJEF1BSuHgBcnLJdAAnjCisIbl9GuHD9qyQC5L9w1575xLAJ44OKIf +WenBu2WzkBW32n5EnJ6pgohXBBMRAgAXBQI6yh52BQsHCgMEAxUDAgMWAgECF4AA +CgkQW5aAEOBPmomWqACeNI36SXKcu0TyZGCk2E9qSU6Op1kAni0/pV25oQZXiEzk +pFjt0Zvk6AXiiJwEEwECAAYFAkGZgZgACgkQMaY9luwUC4GhxgP/czUSd2of63/G +3ldibnJrhUDxV3tHkkGkmi0CfwNf2LxE2VNwmw+ZZpptz0G2j87f/jBv+EBaPSRV +yIbXe0kBwRwQ+kiTiIWyATPNN7yppPWSkyyQA9UrnzMzGa4fKMVYN8iNi0xG1fRP +2WdVgGsz+rcOmpNo8hW6jo/ryNSXTD6IRgQTEQIABgUCP73P3wAKCRC+uiuH9fxL +Qh6hAJkB/2nKwGgFeFEtt1cLtGBb1bsEAgCcCtguj2Eeqt0zMkT/ZBFXrwZryx2I +RgQTEQIABgUCQZqKSwAKCRD8D4WJ+JS+EmvcAJ9N3mAC14G6QJaPYb70PnxkHjoc +dgCfWC3ka9sEtarAymMa7MVdUocN0gyIRgQTEQIABgUCQaF9VAAKCRDLuVBj4NR3 +ba8IAJ9ixzfPZAwD5mSqmXtlW6tmYWEpGACglCCsKNik7J+wNiD1kxsRsgqQmaWI +RgQTEQIABgUCQaVY/QAKCRCXZ4pyLS2qUrsmAKCwtWTP7YGz/T0P2IsUNByypl6Q +2gCg+heYYJOVlGCLVfd/hXOncYKduNKIRgQTEQIABgUCQbEYDwAKCRDeooc4Mory +BKMZAJ9q2Qrztrh7kZm1g2YhZVSHnVRALwCg3e4qeKmDQDPC6A+MEjyRzP7Sp0eI +RgQTEQIABgUCQat5ggAKCRDOAaR+HEPYUGjcAJ9l7+VtHy+N1GPZXlcycSecdVCD +YwCfUUytcVT9mzlkKW5SYDFh4rG23bOIRgQSEQIABgUCQbo8GQAKCRABBWa85BNj +kuruAJwO+zspSq1zjUsQR2raH4pZ756xSQCeKX/+pYQYxPjDmxcWHcNbUb36PHyI +RgQQEQIABgUCP7+tlQAKCRCyvrxAFSkkr9upAJ9NykpPMb6dRQ9FqwvweU/JXWDl +GACg5zIfIAa9xAbqnCGziPwyKHF80PiIRgQQEQIABgUCP7+txAAKCRDBHntHlk8x +2YmVAJwPRpDo/Nd3G3x/H+PjEOpq1QTFbgCfZ3O8gup1FVTtBlVEm+A1bQ1UqQqI +RgQSEQIABgUCQeL4iwAKCRBMxE0AEd+H6YdpAJ0fVSCcrYcHXNGL65AsRr+6q197 +/gCfcKJFL6ZjOQ9jTju4XZ8HBoOQdDuIRgQTEQIABgUCQc5IFwAKCRDBOfFTI8t6 +Kuk0AJ0W/8WdV3g5G04/q6KODnQeuRBjiQCdHIGVdz3D096jg4ecVFkbiyVbS02I +RgQTEQIABgUCQi4igwAKCRAC45BR5YCzY+t+AKDq8sy+taTxZ/Xlixt2U1A9jJF0 +lgCgnKQ4szOAerQOkkUH9KtVH0IBWDuIRgQQEQIABgUCQtzkdQAKCRDsqw57g+au +DRMTAKDMYhafsynKXcWd/TMpNLLFTYSoywCgva6DByBZUrSmHQ0RQsrREUXhrAeI +RgQQEQIABgUCQuDZHgAKCRCM43a4HNSGH6IVAKCqzk+V4RY4iKcXd+q4gDEU77F7 +7QCgpsK7JxEBCcZLAwSu78+v1Sd1LnGIRgQTEQIABgUCQt6wTwAKCRD9b4jGIdCn +G9d2AKCOg8hb2mcwgTrwmdw3r/AlCD4kDgCcC/tJ/L3m8qxXeWPnqSOfYV2wuR6I +RgQTEQIABgUCQt66jwAKCRAyyeTONkLLS3tNAKC3fajKlLewGgI19nqLS2gCpUZ1 +KwCfQBZ6gQ2fBSyH0GM6FUwQMpC1+wCIRgQTEQIABgUCQt9s5gAKCRBQjq7FMC2l +aF77AKCugNqDPjHcOQMT+SXb0mOgUIVinACgg3m8nB/umwcl0rCjj4dTJldECuSI +RgQTEQIABgUCQt9s6QAKCRDdumS6LDEtL16AAJwOEHZyEsnlLhZ8EPaDR2l+DrTD +WQCeOUP6WWydX0oScKgxvrxQelD7mXaInAQTAQIABgUCQt9s4wAKCRCazTzAqZ91 +3YNEBACGZdqQctLIW89il1EOTdaETEFiBOZIgrTuMtbaLKCWjVLEZhRXwP7YOmG1 +VQ0/oareK36O0J+0dXQ/datCWbq7nKg8ah6v7OgsoSaL4SDbkXJRomJouE5+Le9p +weASnNSnzXDI3iT4/VLNziNS+Px7MvprZfWqW7EtrWcZFNH8u4kBIgQQAQIADAUC +QtEVQAUDABJ1AAAKCRCXELibyletfP5lB/9hCdsNGnB1hEFuC2MKOAxXyii4WUSh +SZnAGU1KFmgPR1VT7ansRcfr1M7kAWadgbvZMKpiMfw/YUoDk70S+HV33klqYaBo +G/ys8tlpB06wXLBgOG/ZXsgXVcfV+gKhBUHJ22yFyUGpwUE6841Z30P6QPEnGlnl +OaYkj2Bzsu8oJ+v1zPjQMQzbWXflg/9qVm6GSmvkHi71uExVd9mmyXriK7AzgEkg +fRjIsHgaHRANQgEHXpQIYb74jigpaZ58/iPsBuaJvtkU3D7K/pJh8ykVl4iogY2Q +v1L4iFpwzJ8moXFZNl6/8WQKyclu4hvetUjqVhdv+TDnloY9IfBYzYSviQEiBBAB +AgAMBQJC0br5BQMAEnUAAAoJEJcQuJvKV618RZsH/04shIbSOSb/oGQBKp5o/jZf ++y22LiOcvYuTFNmW7sC881yyWOAOXzvNSiqpLVBv+nPbNX2Zhu4JFKAcx+iD0E27 +8LuQwHt+mzYHg9jIacDF3gMPVMNUcWkdDcjilU8F01VuLe+EbtzPAv3wzH71njl3 +vp8hRhtJQ2Ljxd8rwtVmY+wj82+itO62bBI0R4jbPREA9FQUzqqlU9e37F5xyHeE +GGFQGUaNNnU29bvZNhooF3Bp5n7nRbub9NH4NgoDSf4LIUhcJv5iExG2FgnnY1Ge +1zEs2hjLlF2XEDaRZzuABDZkL4Cb8GB62YQIp+1sr0j1V+0phAKhuU//CfBZKp2I +RgQTEQIABgUCQuDsuAAKCRDJtabs4td032/bAKC4/52AK7s02dRiB9TEyU1BTtIy +jACgj0K7oUN3EdbRpvq4JztHnOGYNKyIRgQTEQIABgUCQuDtLQAKCRA39o/1AVr8 +ihrzAKDtlkrBk5yLVlFmB8cR9kXRdjw4CACeKxN8s4YBIhSi+dogdt4aBUz8j2q0 +IlJveSBULiBGaWVsZGluZyA8ZmllbGRpbmdAY294Lm5ldD6IXwQTEQIAHwUCQY74 +FwIbAwcLCQgHAwIBAxUCAwMWAgECHgECF4AACgkQW5aAEOBPmonYRwCglIthafvY +gHvdYcvlQ42kkh16xq8An2KEveQwXY/rxzIfVdQOnXaPEMbLiEYEExECAAYFAkGa +JhoACgkQizpgHwjJdeXLRACglVV7g4bLAU4cGCtVk4tAmZXpJo0AoJB13hnyxZ8L +YaDz34DLslck+NjuiEYEExECAAYFAkGiWWkACgkQBJfVkRK/55rWlgCgop+hFNtg +2mgo4QwbNpekeoF9+W8An1NNDP5O4HefD+V29AI1bPBkFo/AiEYEExECAAYFAkGa +iCkACgkQMJF5cimLx9AyBACeLg3ys33NRvTcf5syppUh+9QDM6kAn18oB7U//NvK +C0UzaU41suy0Gp7oiEYEEBECAAYFAkGZVXEACgkQyXxQllwcOtfSwQCcDlcuiPiR +wtT7AQhYbMqqQt7cP9IAoKvtg9RBPm2C9ONLi1ZE5mPU2Wr6iQEcBBMBAgAGBQJB +mUkOAAoJEAbqz6p22DzGAIkH/RANUKVj/mKV5ymNYV+2TLQdgRLLwf2Ilhh4x42+ +S9ugvOt9r010E7othLiRK266VfwhL4Mf1xT9tJolQtnP2VlGc+38URqYzr5aiwEO +i5DKVPwZLf45Ih/+QYYaqetVCqR9QgxA00bNcVX520l2dp5nPmidMlb7SiQfLcsK +/wUf9HV904GYzLPdNLMAo4AlPcC0ercNNAmJ7u5eR04RvZH3vonsvbLYAdv6HMew +Gu87apHbMysxYNEFmpOTLqlo5L13DUrrcqUxA5kcu5h6j8GLRd1ClrB9JiJy+i/+ +UMGHIpPML/F8Crn/q4uN0hO4ZctuXKbMcRRqbQuPbYdiupWIRgQTEQIABgUCQZqU +0AAKCRDJfpyrd3W0eQJEAJ4nI4H5yMJfhWdyRRY3Mk52n78ItgCfRNwz3MAo300v +Y+akLcBAfwZVAdGIRgQSEQIABgUCQaMCAwAKCRAHYXOxkoTEUsX5AKCJwjAIDWv7 +x9NihTSYNb3ADNoPAQCeKHIXbSwKUmElwqVOJjybOSkc2GyIRgQTEQIABgUCQZqW +cgAKCRBc/Tf6zHjIk8EJAJ4y9C4RTKgDIEfQEOLy8o8t1YL8WgCfRRLfkgc80b5C +6bQwqgsPqVv0Q9eIRgQTEQIABgUCQZqNDwAKCRAXatnI0aqJYgsEAJ96xxxx1KYZ +wWqu2ipWRgWGfFBnXwCeLHiXZwaFmQxyPjF0Y6/tMghg2kKIRgQTEQIABgUCQZvO +kwAKCRBdQUrh4AXJy2jEAKCRhGu5f92Ih9S5+dwJ8LXiVc2IXACeP4/RMeJOqVP4 +2X8tru8WO/zYVdmInAQTAQIABgUCQZmBmAAKCRAxpj2W7BQLgcpiA/wMi9uNybWt +sUkqMP51apjy7TAzY1DeR79xYyGy6E9+SWUJrUdpNQEvnCe65nMTFMZZkcuAkgGf +aUpdxXsElt9N/cJmPyrstjRPsCINx3smRXLZfSAJdBxqfYjjxBO9VP4fc0CVsDXK +oT9IYhO/0SmnP9g7P8SbEDIrtngZW7x/MohGBBMRAgAGBQJBmopLAAoJEPwPhYn4 +lL4S+IUAn3+70bfqGU/TxmjBV6y+UHaDr/htAJ9kS3gum+7tNmdJAqe1Ciavd6tj +y4hGBBMRAgAGBQJBpVj4AAoJEJdninItLapSQyYAnRpjXaBU/YFfE/wzp6vo1A70 +zc4RAJ9KTuhI7QrSpjw1JCHeTxlR7lWxrYhGBBIRAgAGBQJBqolAAAoJEL66K4f1 +/EtC8QoAn3BJOW5EsHdCiTn471tOOK14QAsjAKDvJapbKzFtqjqGnYw2PWFEgBM/ +cYhGBBMRAgAGBQJBsRgPAAoJEN6ihzgyivIElLsAoJBsB4geBs+0jWI68y7B++HO +4191AKD/MBrOIS3Is3BQieJvW4VsmPnaGohGBBMRAgAGBQJBq3mCAAoJEM4BpH4c +Q9hQLtAAn3QUB+AdMyrhrH9Q0oxH4SXMN0VFAKCJHawjZ8I/DEOBjFPk6/VvCCjY +OIhGBBIRAgAGBQJBujwZAAoJEAEFZrzkE2OS0AUAniHEQ3sRR6jR/7pXvLA9+sEb +sEEfAJ4mckbMJYjC25GEYY/mshzavDq4NYhGBBARAgAGBQJBsBhUAAoJELK+vEAV +KSSvDRQAn0Il+opfKW9MXiBtmmkGw1AooD+YAJ9JA6Y1a10IpgDiaf8PT8eNeJkr +vYhGBBIRAgAGBQJB4viLAAoJEEzETQAR34fpN/gAniYfvgliN9PVsZHLE6lrxhMR +IFQuAJ0QGzJtLUn2Wc4BiXb3kIFqGBQ374hGBBMRAgAGBQJBzkgcAAoJEME58VMj +y3oqex0AnjOW+na6KMKM1oi/K9HSXCwyeTHfAJ4hSZuvs97N+Y5m7iPkr5fbXWyv +2ohGBBARAgAGBQJC3OR1AAoJEOyrDnuD5q4N8wkAn2aRsbRUXZE4YxcWU1ShUJ6J +/8pWAJ9oQvyzkiqk93vNJMw1hXOC3oX1b4hGBBARAgAGBQJC4NkeAAoJEIzjdrgc +1IYfzPcAmwdnttRdoFx7LLzvKsx8gEdKKoeJAKCNiWCu71cp5Q5MGONEAmHiw91+ +FYhGBBMRAgAGBQJC3rBQAAoJEP1viMYh0KcbvPwAn082hYWUPqOUZVSVZDcWbvzj +szKWAKCqVYxFZlWxP3ocJS1FTg8nwkAVs4hGBBMRAgAGBQJC3rqPAAoJEDLJ5M42 +QstLgrIAoIHjFAfBlsvQZCiBzEetlYL5iBOHAJ9iQfuFs/AIsuRAka4YjVgCb7ox +DohGBBMRAgAGBQJC32zmAAoJEFCOrsUwLaVoATsAn3L1nGKnz1jIiUfZZDSQfGRJ +sjL2AJsH7D/rc/ovbhHGoDFdHfP9WllqA4hGBBMRAgAGBQJC32zpAAoJEN26ZLos +MS0v6cIAoP5oa2V+9TXOB+qXe4eTAiMUk3+gAKDgXYJs8iV6udwIYaq2d5KUY18Q +bYicBBMBAgAGBQJC3seiAAoJEDfj9F/uZeMhmxcEAJCbwGZVbVmw8D7+nbiYAWdL +4QUTm2y25Mest45jxpHj4XvNv80oLhh8UrQGMZFy4ydmi3lfQVerHl7QZ7In2hGh +9ZDF6jAMDfR7pC54J55USf3s+PiMadqzTiIThdLD/yTeRVUn6KUv3RlCGqpfLh9X +k/paB1V26Wpny6/A3MxbiJwEEwECAAYFAkLfbOMACgkQms08wKmfdd2KogP/aKPu +QivvCNOg0smXso+p7RyP4imM2fnYfZKyIdztxfBCYPP02qClRBspmHmhLvNgZ+Ih +PUm5lGodC9wYbcSurkpfRXDX8ImDBCZRJJxOmsD3qV5xQcmIJt35QiylBRrf/hBU +yh+yeFGhebmplE9bAfo1S+B7azzdVtTCZlITCOuIRgQTEQIABgUCQuDsuAAKCRDJ +tabs4td030I8AJ4tY6o5CNXMg85r9sn/T1XgxCf+JACgm3VUQb3crIBldo4E7ELs +OlWKTCO0I1JveSBULiBGaWVsZGluZyA8ZmllbGRpbmdAZ2Jpdi5jb20+iGIEExEC +ACICGwMHCwkIBwMCAQMVAgMDFgIBAh4BAheABQJBjv4aAhkBAAoJEFuWgBDgT5qJ +GNYAnjO6NCBUeUnbCfpLr/TT+V05Ai3NAJ9w9U+xwdJqrNblobxTZofw/Zb394hG +BBMRAgAGBQJBmiYYAAoJEIs6YB8IyXXlQO4An2CCetfVTn21dtjauCtRmqbMATLP +AKDZtmMzLFJGQtbGUuhU1bcb+GY1IIhGBBMRAgAGBQJBollmAAoJEASX1ZESv+ea ++KIAoKGdYYE6onP/naeAMIc9Ik9FlW3MAKDDJB5Yv9rdMUGhVbqtYf4zQuBvRIhG +BBMRAgAGBQJBmogoAAoJEDCReXIpi8fQa+4AoKaD1nsE4UgDubabko3KGfJFoedY +AKCEF53SoAmE6PbASnDJ9Ik+fT8t5IhGBBARAgAGBQJBmVVrAAoJEMl8UJZcHDrX +mOEAoMS0ZWF6F70fDvqFOieN6OPLnxTOAJ9aHvFmaoVTreA5jh6uh6zi8lljvIkB +HAQTAQIABgUCQZlJCQAKCRAG6s+qdtg8xoZGB/9TcMq82G3eLnFDST6aPeoTCI/P +DXnjg0INoWDyDXWrogLTGH4Euy/A6Az2qjWNBIE4iDT+OgeWFgGm5WHMxsAYAjzQ +Oo0myVPJqxTGpRO319NI0Z4yyNDuIpsIz0wGWrN5OnOykZvOBRyMTR13bS8Bbsez +gUdloa0MrFknJ/4oFquLFmoAHPeR7uulzaU2zyXvZ+k30DlA+6XfvOw7zOQaiAog +RXfTrqEORmMpJqm6CHYtE2agnVHWnjnbCnOk4k46JTakGxag+yRwrpvsvdb/W4v6 +U55Q3fUdANOjHBmav3i8Wtf4K46sbYmEmqjexMYMsmhlONt8xxRPGsTbnFNkiEYE +ExECAAYFAkGalM4ACgkQyX6cq3d1tHn40gCfadmQp3jfm8qAHtMF95jAGL69z9wA +mwd65tfWocFWyOsx5WmfWDwRkKY5iEYEEBECAAYFAkGeEXoACgkQJ0aiJIc88a0m +zACg6RISZOTkaIKTsTXGdO9Ief+1ixEAoKQ/B2tXzDwr03+cZ4mUHM8ZgoEriEYE +EhECAAYFAkGjAgMACgkQB2FzsZKExFKhwACfVcYhM+6DVpb9ezMdt/D7suT+ui8A +njQLpOz/O8xZJ+YfrXiigwkhJHp4iEYEExECAAYFAkGalm8ACgkQXP03+sx4yJNy +YwCeOrQVc1LgdZsBzwBf+e7x/0/atbsAnjPuftS2naF3js1ZJa2Zg4mH3xM3iEYE +ExECAAYFAkGajQkACgkQF2rZyNGqiWKSyACgun9gfZ2906QTXzwVKCyc7gCe8LYA +nA1OD8ycF/voOHhnIUTUeD9gDOE3iEYEExECAAYFAkGbzpMACgkQXUFK4eAFycsY +8wCfbkSGlU/uTfFCixTZw5T8/qHz2bQAoIFN04VyQbl3eTwZrndB6RGIpwhRiJwE +EwECAAYFAkGZgZYACgkQMaY9luwUC4Gk1gP9E0ctfYyBxSYLf4BCzZHrf3LTfErN +57cT4xJlZgoPhu+QiypAGvBd+HzJIypfk2xtMBmh4eVC4h6xEfayKZYiUQcXM5um +qWPoejwypfiEirKMzyyBhhiRrhX101ZsKU3H1WT/hoDW1Fj5QyQHdU2Cy3H/N9kJ +ffPvDYtwbBgc+2eIRgQTEQIABgUCQZqKPQAKCRD8D4WJ+JS+EsitAJ9WzgasMNX+ +VbNkCFzu0PKB3kRGvQCfTvBTqsCiJ7nSMjyQ9PS6LQO5MIOIRgQTEQIABgUCQaVY +8gAKCRCXZ4pyLS2qUlpMAJ916tBgim3Jn+/NwDv3xp+MyEJe4wCgwawHk24C8hMG +lid7m6TeifMHe2CIRgQSEQIABgUCQaqJPQAKCRC+uiuH9fxLQtFRAKCTwt7TpFr2 +QzGZ7zd65bMxqU+GPQCfXtbuVrNOb0pOW2FHfCsZnQ5Mj8KIRgQTEQIABgUCQbEY +DAAKCRDeooc4MoryBBQ8AKD8Vak3rfHFjimL5Q9pR2lLGY6cAwCg2n4JgEHjlfOF +r3hUjkpETcG4xdyIRgQTEQIABgUCQat5eQAKCRDOAaR+HEPYUKVsAKDCmpZ8fmUN +EuXCyoL4Jprk1k2rpwCgkh5iH7bQc+nrct6qg9rTRZXJRI+IRgQSEQIABgUCQbo8 +GAAKCRABBWa85BNjklhbAJ9k0oKaUQPE/2wpEw4filsdii+qxACfVHxThFduOA0h +sytzvRmUPOeNrJCIRgQQEQIABgUCQbAYXgAKCRCyvrxAFSkkryVJAKD7GQrehzhO +noT8K/ifs0dSiBU1QACfTufX2kmNV6g9+2fBny01e75IFHaIRgQTEQIABgUCQb40 +2gAKCRDoMBhIFqjTqysKAJ96Ou8DkmXiL2ouHaawKxsXTeH3zwCfZBKeJm4oIEF5 +3QuB+WPr/tEnaeWIRgQSEQIABgUCQeL4iwAKCRBMxE0AEd+H6VTIAJ9DqsVxJS4m +kADD5Uml2cjK2lk+QACfU7Ggp2szss9E8mY/uIH9NEvifDaIRgQTEQIABgUCQc5I +HAAKCRDBOfFTI8t6Kh0kAJ0Uky1vHTiKQehy0Q0VYDtE7DQ+rwCcCLaE4hsCzmk0 +P7Xes3JpFuMnDx6JAhwEEwECAAYFAkGa7kEACgkQJPjfwmx8T11ZCw/+MqiwBNEF +tGJOeXbMN88hfLeomTcRmnewd2QFtPDvE3zUyCOr+O3qVweOHH5uSsc7L/Xv/in5 +kPOU8QgGh5m7ChfKyB8t0MTmYZtQ69Dd68FWZOW8lMmrwu+NUyQ/FAcM7CHidkaf +sVHx2EE6in9W8tzlZWQBPQFTQfKGth9s/x+UHZntwsKXfQE9KZQUu1XW+LeKmCP8 +wfCKSCoSe2wVTecLSBNSUfgLm3lU7W8JuY42PsjOnDWrhH6nA1HJKVWL3EnE48LY +nU5fwyfUvOjvK0B3ieq1U0wzQJfp3Qs/5YwOyZj5OCn4+mzuDELH9ewvngIm4JkC +Pg/rPp59v4Ew4wQRQPdy0COEJhUoXhobNDcqsBBh5MO4IDNK1Wr6UMG5LiRZy+hd +bmVhzudlgSFMozp46Ah0B0jF4SpQAbaQCkVGiR22SGhl9pIRPeiv4rX1mZHx8x0x +yNweDl/xTgj52jalscmkvg9DjHY4KTebFP0fnJQ3mm5kBo0HVb724+dR1I8hcigu +42SiLDvXY6dhO05N98jceSHEvqDdXjVcAXMjqA8LCYqaWbd75xc060Con0qK0ynP +q5hqSWk6IRIAVZF1ODWqxWt+SihMT3s61sGfQopxcSjAV34gnECrX5FWD7l09Q/v +nIULGIi2+e+kS/CuU1putPH2D5/kE8774/mIRgQQEQIABgUCQtzkcQAKCRDsqw57 +g+auDYfFAJ9hZL3fmrXrLx5NpEn8bBgW1JQ1LgCgu2Mspu0TEQEx/Ni/1P1uDGsp +rHqIRgQQEQIABgUCQuDZGwAKCRCM43a4HNSGH3onAJ0fP3lBAFOp84iaeXIsTOnF +NKH9UQCeM91DA4FnM23QPM+EDOC7aScpOyCIRgQTEQIABgUCQt6wTAAKCRD9b4jG +IdCnG0kvAKC3AAF56eR0KVFsfup1sw5WR/T8lgCg3+I89dms6CEBF0Dhkt8AeN7w +VCmIRgQTEQIABgUCQt66hQAKCRAyyeTONkLLS70vAKC3ZI1p4QABXJpmj6mpX69W +2qjGagCfe+x+Gz86TWXrA4Tx4O9oh/6vqFmIRgQTEQIABgUCQt9s5AAKCRBQjq7F +MC2laKc2AJ9OgaYLbOtoPPbCFLW0SV4U703ApACgqqiljnK1G4dStQ0Vk7hfRZw0 +rQaIRgQTEQIABgUCQt9s5wAKCRDdumS6LDEtL/bgAJ4jgI9x/ZPMhfH/EFL36fVg +e3RvxgCfdXMaJx1Z6H1tu1YPDpFk0Op8OseInAQTAQIABgUCQt7HmgAKCRA34/Rf +7mXjIfGOBADRGrzCutbk7Ls/BeqmEq2y7VnGaOHiukp4p7Giaj9tNnTZspkU3+kX +vNkA8jjzoTYpU6Mv41KQuW7/7DfPhRRSgupJgQVlxqAM7b/aSzXBu6our6kdksH0 +m8ZIq7efF4cHsRb/12sAn5NRi3VDXGnnYFudNdYQ59XVeZFgNHAkwoicBBMBAgAG +BQJC32zhAAoJEJrNPMCpn3XdS7QD/22wUAgq5s8YyWq3yjJC2fFQTPoc8mrf7puL +8KK9W259YBUY5NtuAjkfQ9L9hNx90HIMsa5Tsp/StbKbaU+v80NQ5pXgd2z209Tr +mPwgt5CHOnEEo7hp6hmhFeQMgwCLsMYmaWp7YYE/W0MGO+HjijHc5ynffubt4Vrw +YOFwxaDqiEYEExECAAYFAkLg7LcACgkQybWm7OLXdN/sxACfaPr1gyfLBqufCBnN +EiktSb7quooAnip19UPZQ/DF9PerM7WW0YE2X8xCiEYEExECAAYFAkLg7SsACgkQ +N/aP9QFa/IpZbQCg2Uf6sa8Ls4uMwhd/gDJDefB/i4QAn1XFkAGlZKp6NT0cXwHl +5g0gg3fVuQENBDrKHoIQBAD0LtmKeekw1walkGK8OAvKJpBT4Wm4AhPmnHNh3MFR +jCAit8ULZEW0XDHs/5IHOFRpxyKKpSynzRNGGM2Yi9DvW5acn5H4Us1Vc8CBx1TH +K+zC7AU7yS9TCR51VDPEONIp2mcd0eayB2R9iGiu9KV/Rj8+H//YGF2sCvAqXwOK +HwAECwQAs+bNP78S1L78v4mj57xptLLWlsTxXkZd1JCiosXitNmGLYsLtBldAtlu +XFllS2IjDZPV9Kp74ofgaO4wh01Qprk4Gn5SrSI7Oj6YH8DA/gggw7v//hEBLimN +75okfqfzBhNTXNIxH6zhuo80RcfX0J/rZQ4Adu/aXeYpR7E36CqIRgQYEQIABgUC +OsoeggAKCRBbloAQ4E+aicVhAJ4oVY04egiOWbZj8DoBLuPjiwiGpACfZTuOsSKB +xkA8JT6eXcJrBJhGbcY= +=KQRI +-----END PGP PUBLIC KEY BLOCK----- + +pub 1024/E2226795 1999/09/19 Justin R. Erenkrantz + Key fingerprint = 3C 01 6F 2B 76 46 21 BB 54 9C 66 B5 16 A9 64 95 E2 22 67 95 + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 5.0 +Comment: PGP Key Server 0.9.4+patch2 + +mQGiBDflD4IRBADqhgm28jVQWqu8ogG/NvYOSySYc4MhrXFqOQrRxJOcAxdc03fR +Mu7RtAa4hXpNfjOLIfxY0cc6aqKJLlOuZAUxNNFWIcuO3xSWsPrwflaBsATt+0jw +qc8zOqjQ+Eiejk+IWc+43+7ZggQ83ROhsX3njjdgZnCT6eSHbQwlBIAAWQCg/49v +YeqveSr+JkWhCi45/NPHtfEEALPZcuaaTHyN5HBn9YjSIE+0S9R6fsdfIbD5OZok +I4U8+SWPVHX7oDrW+vNhqQUE2u+kPTobjERqzSxT94sTx+93jUaI+H9CKb4x0i0j +/4K0oPcBhlCsrIJR83IOqsw0+583OR9sIdKQ4H2aoPA5fWbE8swGpct9v/habHH1 +zty3BADfT4fbzDoryBzZGFIuaBaDjV36rWMf479Z8UfuWTcmODDilnitD1/JZekd +uZ26A2pIDymYCl/YA1Ajel37ltL2uBBrj0RbqXJaco4qi/13d2P8wFcbj1qdvw8Q +8b+BFeY6Wipa4YQQWWBl2DXpkQPbn6lp4fgH7re52Ifp+S67R7QsSnVzdGluIFIu +IEVyZW5rcmFudHogPGp1c3RpbkBlcmVua3JhbnR6LmNvbT6IRgQQEQIABgUCO7q1 +XgAKCRAhRUrwzIsPfu3uAKC0/0sWPB/kb0R4IQLZ0puhGf0UkACglccPWwJoxlRP +X7OXoyOAmh8ncyiIRgQQEQIABgUCOY+ykAAKCRBQENNBPZ/lLfXNAJ0TjsYqhnzD +NTbjVRGhnBPtW7vkoQCePatWc3674bPrLqWjyxxsnQrC4IiJAEYEEBECAAYFAjiP +jpMACgkQt5EJtVU3GBmGqwCg59ldjSguiatxd4GG8Zf8qYzYju8AoJlTLIxcu358 +M4o+x1SSCh6duWlbiQBGBBARAgAGBQI4uHwLAAoJEPkzzAXOnKkZXasAoLWUMtVp +WejgEsi1a+83sxkI6OteAJ4zq9rOxZAnRf3EViBrYQYt8eSYRLQnSnVzdGluIFIu +IEVyZW5rcmFudHogPGplcmVua3JhQHVjaS5lZHU+iEYEEBECAAYFAju6tWIACgkQ +IUVK8MyLD343IACeJgsqw2TLSfqPg7vZXNr+YlE+ydYAoIgBr19QKzLvoOjiEYIh +ybmYNKaUiEYEEBECAAYFAjmPspIACgkQUBDTQT2f5S3FPQCdFEcc43lyLLz3pHLi +7fb438rJmo0An0CObwroeyH+JCYNTNWAAYJ7Q5B6iQBGBBARAgAGBQI4j46jAAoJ +ELeRCbVVNxgZqSgAn1ggB/CwEj83gXMvC9jJ6M6dCB7dAKDsO36uuJEnET4AsBOK +70w1dYtu5YkARgQQEQIABgUCOLh8LwAKCRD5M8wFzpypGSgEAKD840jlZGA4WdvW +kwXTlqcb5GKhqQCfWQ0R+87LPP/mpFK9i7U71OlrtJi0Kkp1c3RpbiBSLiBFcmVu +a3JhbnR6IDxqZXJlbmtyYW50ekBhY20ub3JnPohGBBARAgAGBQI7urViAAoJECFF +SvDMiw9+9QgAnipmohCeCe6plQqqsNGFsJ74WVruAJ9Xtx5In/LzmIwHtoCGrcFy +yA7y/4hGBBARAgAGBQI5j7KSAAoJEFAQ00E9n+UtbdIAn0pyUurPEG1GGSpt4pNQ +6gXXv8idAJ9Bt1Wu4GZSLRjhFFR0BMU9Ce+VALQrSnVzdGluIFIuIEVyZW5rcmFu +dHogPGplcmVua3JhQGljcy51Y2kuZWR1PohGBBARAgAGBQI7urViAAoJECFFSvDM +iw9+o04AoMeojDRRWw0K3JN9D+IC0PJM8MCAAJ0VawIzQDYB/zot51ZbEgiNcZS1 +74hGBBARAgAGBQI5j7KSAAoJEFAQ00E9n+UtiI4Ani+W1CfvgzAJNeoTsazs6f8H +m5sUAJ9l3DJCeC/HfoVBoyhgZea0xWADa4kARgQQEQIABgUCOI+OqwAKCRC3kQm1 +VTcYGS22AKDgckbOfjX0fJ91PFaZiosj1/Wm2QCgtfPhTwnIYWXisDJKxGKcPlOn +2WSJAEYEEBECAAYFAji4fFUACgkQ+TPMBc6cqRkSNACgwk46PQfEpIvZMP4cQp+3 +ChdFFUsAnjYoMe2KLySYfmN7c/5dUMMs1/oBtC1KdXN0aW4gUi4gRXJlbmtyYW50 +eiA8amVyZW5rQHVjZi5pY3MudWNpLmVkdT6IRgQQEQIABgUCO7q1YgAKCRAhRUrw +zIsPfqCbAJ4jIArOZ3d5SjYXfl+inSl05Y+VEgCfbg72HIziChfV/rnoqDsWgbM2 ++M6IRgQQEQIABgUCOY+ykgAKCRBQENNBPZ/lLZ5DAJ4+Qv/6TF8iXRKdruxagqRL +8v02bACffoxhfnEGNeWpk9kwbPV1+dKnfee0LUp1c3RpbiBSLiBFcmVua3JhbnR6 +IDxqZXJlbmtyYW50ekBhcGFjaGUub3JnPohXBBMRAgAXBQI7urQPBQsHCgMEAxUD +AgMWAgECF4AACgkQFqlkleIiZ5XccQCeP3nBu8yevFJjVlEanG30vNOk6bUAoKUM +BJh/uKGoQhoKjtRmAbva9LhYiEYEEBECAAYFAju6tWIACgkQIUVK8MyLD34d4ACe +OZSsg4uMubn8phNFpoYKsYIIbM0An3f5XVvuNFqRhZq65So4Ibda+GsvtC1KdXN0 +aW4gUi4gRXJlbmtyYW50eiA8amVyZW5rcmFudHpAZWJ1aWx0LmNvbT6IVgQTEQIA +FgUCObPdKAQLCgQDAxUDAgMWAgECF4AACgkQFqlkleIiZ5Uk8ACg+2tSClNalnwI +CghNlALE48ypaZUAoM3FyTiZHgop2uSDjBWkS5qnrf/tiEYEEBECAAYFAju6tWIA +CgkQIUVK8MyLD35NmwCfbIdBIg9SCiCckGyiWYLpst3fmjYAoLXxrih1AHEjXN36 +bvX8VjuK3ZsHuQINBDflD4MQCAD2Qle3CH8IF3KiutapQvMF6PlTETlPtvFuuUs4 +INoBp1ajFOmPQFXz0AfGy0OplK33TGSGSfgMg71l6RfUodNQ+PVZX9x2Uk89PY3b +zpnhV5JZzf24rnRPxfx2vIPFRzBhznzJZv8V+bv9kV7HAarTW56NoKVyOtQa8L9G +AFgr5fSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY7288kjwEPwpVsYjY67 +VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy1obEAxnIByl6ypUM +2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XpMgs7AAICB/4uMRus4MO2 +fRm+/sz3o/6Vu1TQk1ZAb6qDhwrkArfnj7UjNCWqn0B9eaubF96vTokb6hBtv3FS +BZ5TDvngAbFvZEjNpXGfoW4GkoRdDKNpYoI8RLTKjlRKiaEl+f1e9WxQp7iyP4o0 +VAxAW0f/sQwzLGIpMS1PajO2mBBtSW32e7Zgy4C/AA914Fb4AR8wkoDPvr8q3P0D +vwtnmd0pSPeAfGqY8QtTKjjPdAyETp1JIqH+uVlrij5CwtAd3wJBN4GMfXotztEI +TA8um8xS/4EnWSOROTf3NNhv9MrTvMYpPsodCD/d0IJ7lce4hV5vzZ6hYX07gvcJ +4LQrqG9b3yLNiEYEGBECAAYFAjflD4MACgkQFqlkleIiZ5WSSACfQA6CboJi79Li +SbEJZT7+4wK4UJwAoLCn2Gpg718hDIGZUzC2avajRNUT +=6s4E +-----END PGP PUBLIC KEY BLOCK----- + +pub 1024D/2CF86427 2002-02-01 Ian Holsman + Key fingerprint = 67D4 D4C4 79ED D9EC 88E1 734C AB7A 60BC 2CF8 6427 + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.0.6 (GNU/Linux) +Comment: For info see http://www.gnupg.org + +mQGiBDxa7bMRBAC0kClufzb9tqQfQa+qs2E7sQYd5ag53w0nHKAW+9Q/5C1y0Gaq +enp+p6FafJZdP4vIgmLw/4TWinNkLqJRSA2om2TLy29AznCGWbIvCuSX74WUa2Ec +PIh2Lc/NpDQ743mocBc+XoLYBNESpGHPnpT5niYTvRLHjzxp0XLNk7Gc8wCgjR6/ +aKd+8vTZcDjh/3xZhsQos9MEAIQI/z97PtRnohkj5HVRXi2a7oQ8G4tPegfntz4Z +n3jfq0WXNoMEWo7jrYUpJiy6L0y/tiuPfctb7RUJ5wfkdZmGjQ3x9NuGRq5jQstA +neCxsIyl2f1qtwaV4IgfhVrfUvJhI1BQq7d5sqePjXmPNKfouYcNKeGOvZXbbswF +oso6A/9MFgWcBOBx9h3wsoVQcYUo5nsUzq8a0AeTYKz6kUMPtVgFLmOxuJrKB2dX +g+A/o+r1n4D/SYcCoiHBArUGuCjOU5ni6gC5mPKtlo8VpYpNV6tj8yx0ntyr4hu6 +KMcTdJwHs8KpfkWp/H1SXpy38ypUEQx7yZztpZnNiRMizDhDDbQdSWFuIEhvbHNt +YW4gPGlhbmhAYXBhY2hlLm9yZz6IXQQTEQIAHQUCPFrtswUJBaOagAULBwoDBAMV +AwIDFgIBAheAAAoJEKt6YLws+GQnhzwAmwfeZnT1FY3DfzE9IFkKKiJ1LhPRAJ48 +mi4txMWmwcQUv5N9PSgS6m5Ml7kBDQQ8Wu22EAQAyHiY98UhNYD1rJLJw81S/1Fc +N/P657bqIbhPWifOHDaUpJEKY8YARxB5TucTCr2bF11fs0tlc8i+xqQjjIxlspFf +d0b9mjzd0h8DfnN+Vbh8J/HrCN2l7EM9gbp9vh4sAfwFh4ObC0Z/ULnIpPw2s8U3 +v19WDLUz+OOaYvl8lU8AAwUEALd/VRU9DzAHefcJLrQkVbyaafq43FyQ0pp5HNO2 +FUYx3HohVKFHjPckCM6iOdFPixqNCTCutTT0ED8gTQ1f9zzNBqHx7RBlHcXQjPRV +0Tzl+HWcTED7BL1i3rCRpWWguhZ7KYArjcPlngrDocshbWVYmUcE2KqIIRTkwbHW +urXCiEsEGBECAAwFAjxa7bYFCQWjmoAACgkQq3pgvCz4ZCfAhwCXU8ZfULcXJERI +YZ/OXV64q33OPgCeOftkLN7nxOPBn0so9h/rwSYo3qSZAaIEPFrtsxEEALSQKW5/ +Nv22pB9Br6qzYTuxBh3lqDnfDSccoBb71D/kLXLQZqp6en6noVp8ll0/i8iCYvD/ +hNaKc2QuolFIDaibZMvLb0DOcIZZsi8K5JfvhZRrYRw8iHYtz82kNDvjeahwFz5e +gtgE0RKkYc+elPmeJhO9EsePPGnRcs2TsZzzAKCNHr9op37y9NlwOOH/fFmGxCiz +0wQAhAj/P3s+1GeiGSPkdVFeLZruhDwbi096B+e3PhmfeN+rRZc2gwRajuOthSkm +LLovTL+2K499y1vtFQnnB+R1mYaNDfH024ZGrmNCy0Cd4LGwjKXZ/Wq3BpXgiB+F +Wt9S8mEjUFCrt3myp4+NeY80p+i5hw0p4Y69ldtuzAWiyjoD/0wWBZwE4HH2HfCy +hVBxhSjmexTOrxrQB5NgrPqRQw+1WAUuY7G4msoHZ1eD4D+j6vWfgP9JhwKiIcEC +tQa4KM5TmeLqALmY8q2WjxWlik1Xq2PzLHSe3KviG7ooxxN0nAezwql+Ran8fVJe +nLfzKlQRDHvJnO2lmc2JEyLMOEMNtB1JYW4gSG9sc21hbiA8aWFuaEBhcGFjaGUu +b3JnPohdBBMRAgAdBQI8Wu2zBQkFo5qABQsHCgMEAxUDAgMWAgECF4AACgkQq3pg +vCz4ZCeHPACbB95mdPUVjcN/MT0gWQoqInUuE9EAnjyaLi3ExabBxBS/k309KBLq +bkyXuQENBDxa7bYQBADIeJj3xSE1gPWsksnDzVL/UVw38/rntuohuE9aJ84cNpSk +kQpjxgBHEHlO5xMKvZsXXV+zS2VzyL7GpCOMjGWykV93Rv2aPN3SHwN+c35VuHwn +8esI3aXsQz2Bun2+HiwB/AWHg5sLRn9Qucik/DazxTe/X1YMtTP445pi+XyVTwAD +BQQAt39VFT0PMAd59wkutCRVvJpp+rjcXJDSmnkc07YVRjHceiFUoUeM9yQIzqI5 +0U+LGo0JMK61NPQQPyBNDV/3PM0GofHtEGUdxdCM9FXRPOX4dZxMQPsEvWLesJGl +ZaC6FnspgCuNw+WeCsOhyyFtZViZRwTYqoghFOTBsda6tcKISwQYEQIADAUCPFrt +tgUJBaOagAAKCRCremC8LPhkJ8CHAJdTxl9QtxckREhhn85dXrirfc4+AJ45+2Qs +3ufE48GfSyj2H+vBJijepA== +=XyM+ +-----END PGP PUBLIC KEY BLOCK----- + +pub 1024D/CC8B0F7E 2001-10-02 Aaron Bannert + Key fingerprint = 937F B399 4A24 2BA9 BF49 E930 2145 4AF0 CC8B 0F7E +uid Aaron Bannert +uid Aaron Bannert +uid Aaron Bannert + +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQGiBDu5G8kRBACUCvGTlqgxnukt9kkjFPIpr/xsyGJjq9XJ7SEMx8caA6uMAxtU +mBcbBFqiyYz2zp019B/RYdXkpyoKVYyxoTdpkkCp5leZwoPJob+kcTkAApfTf5Rq +xs3AbY8e/R3XAaqdhwMsBJ4Vsu96qE0/JRajf+0sw+kGN1HNCI0z1cKWKwCg30x1 +zjFAQBf5QZP29z4pijNAPT0D/3L75dA2cBhG+hXkvbaAPf6ophD/owMku7vHqYLj +SUHw8Cc1C+uXGbRvK4cYVFS7wfo/FiNCHxawdPWeak910/d3UsoUsrNcSSz95Vnl +RxSlYG71KKUi7us3dOEGzOnv62+zRUwA/Y32aLPkTwV+U4qC+zqYGGz/DUPsbeN5 +AY75A/9jACi6Tjd5kgi584FHYIlJKsoej5YRr5mz5tvVQnwCHsySzvKZhFNA+Naw +kImlDBtN5r6SzWaONCa2sW2cSbECfpmvmGl3uJe9uVvbs6lEhZPNggKQgYNzdJQU +HlvKHK1e09IPLFOE2xd/De11d9rFDnv/AUtIJrl439en7EziL7QfQWFyb24gQmFu +bmVydCA8YWFyb25AY2xvdmUub3JnPohXBBMRAgAXBQI7uRvJBQsHCgMEAxUDAgMW +AgECF4AACgkQIUVK8MyLD36GmQCgt177yUba4wl27GeLLngmvioBc+cAnApbnspx +CWUm61QppZdYAz44QwPSiEYEEBECAAYFAju6stAACgkQFqlkleIiZ5XUngCglWG4 +DejI6MJ496Vu1Tysc6J+ozsAoIe9QsA50cxCZalaxUrBT/XtT7HfiQEcBBABAQAG +BQI8RgEgAAoJEPcTqHkQ/eB1H9IH/0aV16LSzf1pimZLuARbymfdJK4/+wQ29H9D +XWf4wDLdBJvUMkHcN9YxsslTmhqlvudpqCbbrBXu0Q0en3Qa3gxlG8c2pxCFpNrE +vi7bCiCcpmS+OUPT4PAMz3P2Mmzx+i9/Y7yCSdb2eZOjakTz4EvYcn7naTz6TOQ6 +WvjkOA2kgz2fER+ciXF40A+465KxwyNJJlMVffRPm6PMgifTIGDqcewYo69uvltE +XweTzh2mX0FBOuBgi6NiI3Yu18LhWtpBXrLmz52eQBrrnUXDvuNYoWbHsxM/56Vf +BFxzUUd38ChFziaCsGvz5HbreDA523qe4k+r3YG0E5zU70kTAW2IRgQQEQIABgUC +PFrxagAKCRCremC8LPhkJ54XAJ9cZpEYbISKfHfd2aXI3orydfv8VQCeLXVQbC4I +U5vLvPQLx2uEMNr9csOIPwMFEDyuIwT9b4jGIdCnGxECG8wAnigF7KzIbslopWCe +fPGBgVv0bcHmAKDmVyKvqAj90Ejni/LngyPrkSWbuIkBHAQQAQEABgUCPLINwQAK +CRDXOpC4a7qdXVYFCACHrv4T0OjkSWpTVLHYm85Rtk6oS2PvbLKxmVYbBMG3B2bO +quVLhjFBbaQyUkr3ks1ebWcjgnJCf72DrUwbBIjtbm+BjpRTvqmQai/lkf4oyFb9 +nVcX0iUR0t4uf/ecsz2rjBLlVYmAxUi4GXPnAAmFJtego1qJbEuHUuh5ZNGJuaxZ +Pk1Qnu+5VMN9VBbXOFT5Nvnt2WQBrxYM+5SbxszF4BmpztIFoa64QrheRLIQ3jd0 +S2+xyQsNCFVfwYIvMQqVmCNC623sBhGrFiJffTdJv5Y8JcQwBSfU8KnBB+XNirDq +LiUUI4m2xBE0Vhg8dFLnSi8yshKjTOBNQegmcC2MiEYEEBECAAYFAjyznowACgkQ +W5aAEOBPmol1jQCfYu3bWUJ27UUERTXpWuCx0wGgi6MAoJbXTrlFWVN/ihAOeyoM ++K8J1lA4iEYEEBECAAYFAjy01ucACgkQZjW2wN6IXdO/bgCglVvYECJYH9LS56Ug +dx00l8NenM8AoIoyiqIRs27asHxwz4CRUAzM5SxStCJBYXJvbiBCYW5uZXJ0IDxh +YXJvbkBjb3ZhbGVudC5uZXQ+iFcEExECABcFAju5HOoFCwcKAwQDFQMCAxYCAQIX +gAAKCRAhRUrwzIsPfp/ZAKCcug8zNT2WbAXMt4PPJUzhPKch7gCglldxj1byfdKv +9NJnrQLTQ6mXsmaIRgQQEQIABgUCO7qy0wAKCRAWqWSV4iJnlZVJAJ9/sAIUBPzG +HfjRVuvkEPehgv5qpwCgm6FdzGwUXScv3jkqHGf8K5B3RNaJARwEEAEBAAYFAjxG +AVgACgkQ9xOoeRD94HUX/QgAp4deUjwvISoeBoB7KmD67ccpcvSscBtFzpWVbJIm +QSJEWkMwqU7ga616NgEV8e3BbOlpUrRCJg3l1lWGMVHFMlG7YRIDrCT91+M2IA0H +0G0VCilPg4nUhx4vEww9H5gQkNAI2l4ep9B7LJD/EYMvIOfJ2W6SX/cip36/eHAy +YjZbKw3+Af785A7H7lWWI+Umphq/rd103FcwCx4m7KGuZKZJlQse6l9PQqWcyjbP +RrwD/WNUEhP8eXgy8/+XrHpqo9g4XMi4YVTqxc5nJ3iNYei6+iy2mK6Um4GNJANR +70TNQBe3UlMFfvEZFQ8SrSxBBXk7Z7tdgi0/tb1saT7D4ohGBBARAgAGBQI8WvFv +AAoJEKt6YLws+GQnsEkAnRlkBVgiZ9pkgU4k+Ab16M2bTYhzAJ4wWf4JZASGJM5z +CVFQVpLsTcZAE4g/AwUQPK4jMf1viMYh0KcbEQKWqACg6oVtZOFNBi2KUiaiekea ++YROANQAnRaTUuA6FZT+8+8BGy75en8FJTWiiEYEEBECAAYFAjyznpIACgkQW5aA +EOBPmok1nwCdEaXD1JKXsqNwir4cDfH4JOHvH8UAn3CbHK98MQOAv30O1E86F0HB +CfUSiEYEEBECAAYFAjy01uwACgkQZjW2wN6IXdNaUgCcDgHxmicULGB2TbKrslpg +COhS2UkAnjgsAMSQLAPkvC4r+1gXa4c/e1v6tCBBYXJvbiBCYW5uZXJ0IDxhYXJv +bkBhcGFjaGUub3JnPohXBBMRAgAXBQI7uR0qBQsHCgMEAxUDAgMWAgECF4AACgkQ +IUVK8MyLD36V4QCfdB9Kqiag3T98Y6tQ5YSb259XJnYAoM9fQ30sbQxfmNKuOHbk +IuPuU24wiEYEEBECAAYFAju6stMACgkQFqlkleIiZ5V/dwCcDxamuhlGgk3a+T0V +bIRp6Qy8bB0AoK6jwOfUwTn5YJTsVH8k2D/lwWBNiQEcBBABAQAGBQI8RgFCAAoJ +EPcTqHkQ/eB1q90H/j1MMsFAQ6XpIpTSWNAt/wR9qp7ZIAv6KdrbYX3akO3bPy3b +KL+7gDjEAqVGHzEBjTnqU7erDaI2Ms2RVBFhx/jI5RwT02KHSw3OJkSKN002yVxQ +igBSmIm7aKig8Uk632x2ncQz/pLHk61jJ2h/62enIhROGCQvrbArZAdAzqxTrSkp +YZ0IJqfHgttzxXgllHgAqTia7dbMMymYDUH1xdSyD7SfyA0dsJ4M9HhSgXFzmOIH +/dXR6jMrj39jSHsVMHyaMn2WWEj/AHSqvQ5J+Hi1EmLpA4NC6sVOhttG/c9B6SZ4 +xVDrH+qciaL7fFBB7EsCXMYpYsfbybZ+rGuMGtGIRgQQEQIABgUCPFrxbwAKCRCr +emC8LPhkJ6s9AJ9Elq2KHVPSqEbv0KEX+qd1izAW6QCffYVRnR0OVdB624DHWIbq +BAKSsoSIPwMFEDyuIxL9b4jGIdCnGxECd5oAnjKUT4SFF4VIDS3HEc8BHGM4zqIx +AKDzxSD8YeZ0xw4cWb7JQYzpWmzmkIhGBBARAgAGBQI8s56SAAoJEFuWgBDgT5qJ +8D8AoIyG5L6TBB4IJWQ+hwfNrD9IwVXBAJoDckFzbkgxnvhIczlY33Q+EqoMgYhG +BBARAgAGBQI8tNbsAAoJEGY1tsDeiF3TlFsAn374e8DpYNe6vJM9istjZ1EWnFpq +AJwKMiSR90qBquj46vhZ7BYszuYKnbQhQWFyb24gQmFubmVydCA8YWJhbm5lcnRA +a3VjaS5vcmc+iFcEExECABcFAju5Sa8FCwcKAwQDFQMCAxYCAQIXgAAKCRAhRUrw +zIsPfnzfAJ9rFBBJky98n6vzgvqtl+3HNU6q0ACgxaSLwy0Ki6Ii/eTzqNm8fL34 +IX2IRgQQEQIABgUCO7qy0wAKCRAWqWSV4iJnlZksAJwO02q9t/zo5HypYme1NNZE +XkJf2wCdEmnVSdzJypGpZSod+8z+yWeH0P+JARwEEAEBAAYFAjxGAUwACgkQ9xOo +eRD94HXDwwf/ZrEtrxyCqkBk6epTjn+JIXhx4hyk2/7fWXIFduJee2Mkfum+ERP7 +fn5mAYblwCaVMG93av2zb2gkZySCGsdmF8W9/ntPKf3HZ9ZBbRXNamtYyIPHGmb+ +wJPENiGZcKkCgACw8SJ7/nbGu0ctJpgyWEg0vDc/A30zR1/GxGddTpJ5wIRdhss3 +JBZQnFXolu802XmOfnj0IZ+ddw8AlWKS2kQj5de1lc1/iMTObBaF2dxbIjFpKRN+ +ZuTsWTbS+ESNNKKoFHjoRwu+kScKh4EG4YXsH9lvEePHRNFVWJ4H4Iu3OZQ028Ll +dqnCs19XhV5jTR1iRESKsEvFzqsbDH2/DYhGBBARAgAGBQI8WvFvAAoJEKt6YLws ++GQn+h8AnjSdURKLWjGTe2tyZ6uFgZfHNFHtAJ0dqyM2kQE0hqvbna1ekOKhhJxJ +PIg/AwUQPK4jJv1viMYh0KcbEQJd5gCeNxmgjYHc8Rbskd/Rx6G4GLD8bf8AoKMb +KOkABzz/lMkWnFoSQTORgoByiEYEEBECAAYFAjyznpIACgkQW5aAEOBPmomJlQCf +YbwuwJSHLxlZ5X2e3S7NY1do6TUAnRi2BeKlVOINxZAgFsdzWtbyta8GiEYEEBEC +AAYFAjy01uwACgkQZjW2wN6IXdPTvACeKekzrpxWT0kznQkzCsrWT95xQL4Ani5w +hJTuQ4e2PItb0kLCyoRgMMmYuQINBDu5HBQQCACKePczRQE1gIWH6LZaCDY8pINs +W6SHl4MXDnBPgnuZ9H/6kFr++2OXatVKlAoQ3mK0sN/py/HeGkMwKBI9lWVldPik +4pgDhdmZU3B3spA+TTCBWNpKyXGY2c7P+ougUvwQAysifhxOGAvr1R6TpBqeSdZ7 +4ZzMPhHLSJGwOSq3BJ/uaViRzZORbVmUFV8s1Og3UlHdvoK+blnbj6eMVyrQ/n+U +LviDnPDxasWhP4an+v8c4Gk2qsAz1XmXccn7S4pa9x/yxiXLNHHrr90Dd0h5Lvvv +hgcQTUFbEwwcdfzKKaiOtuq6qA0Rki/wBBabEtLPzCgBIpUj2lUZZrySVR/7AAMF +B/0a9jaU9Gc25ZygMtftWMVIXEGG7aTqm95Q3ZebYRlpxnJJUkNyLuj09IwBuV7a +XkpEBdACHNTyPwl3khmswjxQO5tWj6JEvdijxMEHu8JtfTq43zRAc62bMq6uJshW +Nd1oVu7pS4JQGmJvUyZjJ+Q9iiyY92XtdSyN0QnB0BeXHyHJB7ZeHbzALkOBDKUJ +yK50/ACJz5JFXabvc0c0zwveU46rFFa2Vdqv2Tf3exL4Gix/Pd8cKfknrssXoIwm +UvpESL92XUUSm7Ozy43+UWq2J55NSLNuqNtZyoMJWiLv3RpBn1DdGbXpuIeyDHCD +MM59GnqTdrJWcVQ9WJ/9txxziEYEGBECAAYFAju5HBQACgkQIUVK8MyLD35AfACZ +AcAS375Fg+hea6FxD9qnqpaZpjMAoLY7tAaEc1bKdJ/8Za3ZPT/GON9J +=SyIW +-----END PGP PUBLIC KEY BLOCK----- + +pub 1024/3A4E7AC9 2000/10/11 Brad Nicholes + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: PGPfreeware 6.5.8 for non-commercial use + +mQGiBDnkyK0RBADedOdiCuVtn2awUpoc02Gq+BCHRjy/lnZ9p4wdgJPJIdImcEZo +agfLwU8iDY4L+w71FMiZjR6Lp0dRK5TupeUD/NWEsDM7we4KjafK1tGN9QlkXAtZ +WulDyUoR6c1cTNeMPowL8/MMs4IP1VGL+9SUjSsoJOm8VBu66NLne/WnfQCg/4bs +0pNeQCtdzCzeNnTFbDSFd7cD/2FWSh+CMrhhC9tqDjfkvLrjcTj1bEpOI/qYb8Ir +eivywJQ5u/tvIkW856SubuBDFRy9kMlJEJL7y8pxD+6xm4ZYexznLS2AjaiseqLE +tgR+AXtgjebiM7gQ/hOtDJjpTPeA5hLYIsDYYrXds7FTeYhsJVeXZpZt6T0Uqqjk +aIe7BADXsfg4lz9/ecmHjo4VAOII6A+Ax2P0FTkxSXqPfIK1AGebIpAGE9nrc9t3 +hKkaqFztHM/OS5/QFs0G+RBnSyMUd/HXUFSl71Bf8F9dq/CdhNK0KXnOuZqpXZaT +WuD3Fl96HsCXYF2Dvzwf7Yoyai/3wX+f04VZbBKuLM+AsZmG67QkQnJhZCBOaWNo +b2xlcyA8Ym5pY2hvbGVzQG5vdmVsbC5jb20+iQBOBBARAgAOBQI55MitBAsDAgEC +GQEACgkQ9V3wKTpOesnSzwCfQ73nPsRRK31if54rQKcVaa1A+68Aniks/MIcwGUC +xSxJZpCGICkXhueyuQENBDnkyLMQBADZi2ehJNymtM1VOMCzWkamCuIWaDZzUOmK +Hz7pFnceoFC2xynrUI+AJIzFqqiWqovQqv4V3GloRdWcw9Ye2IIi7H25r6v00Ng7 +kL1TzFpjC6yoHGXgEzYFfxa63plWCRGdfWU+3yzg7lQAF9a/ATUxXUXl+uIebQbo +ZI1Wt4l1kwACAgQA0bT3PCO4TT0yhTuS+Rgk3ROqZTNhmMAnrTpHW70E4N4hgBe1 +1ZEralIhzT/1/dpsPbouDMMUer6voDcAyq7kCZobu/84LKhvCgFLQAF7PAz6g5Rc +sPsoVv09UYYVgVi96EeGciA6ozVSGsVfNwEzZX7QOBoyrFozlNlX2Y+oF8iJAEYE +GBECAAYFAjnkyLMACgkQ9V3wKTpOesksrwCgwQImPBW83G11skRygzwEOm9DWHoA +oPpwZLqqLg4/dGQ0ZK0Qm3HXok7W +=YgRS +-----END PGP PUBLIC KEY BLOCK----- + +pub 1024D/DE885DD3 2002-04-10 Sander Striker + Key fingerprint = 4C1E ADAD B4EF 5007 579C 919C 6635 B6C0 DE88 5DD3 +sig DE885DD3 2002-04-10 Sander Striker +uid Sander Striker +sig DE885DD3 2002-04-10 Sander Striker +sub 2048g/532D14CA 2002-04-10 +sig DE885DD3 2002-04-10 Sander Striker + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.0.6 (GNU/Linux) +Comment: For info see http://www.gnupg.org + +mQGiBDy0wXgRBAD1J8+8rBKAXD3Z9n7LhdQ+gDcYIDw/sN0cZGz5kpc/1YWWaMQg +ArmoNW7y+BBwNu6Cn42Nid16avSC86H1zBzOdQscDc9/WLwBCiFDCSHB98+UId25 +JGS2cRSE6vt2oDOy99Ent8Eh3f165e0rWVdc7NMOcFGhCTquAFbqMfxYzwCgvGIC +KcMeykaY5QSHrX+ckJmc2QEEANDc4ZRPVF7cQ2wR2OIYzh5oXInhFFnyW2vYbTsx +NwREbizoKXqG7rmTmOQPz6DsifJEo97QrFrSOcD9FI6aUpDmu1Ns06QSjmzCSS6i +R1xPXBp5//2jcWjLs8td30N+AfwFnnB45sy8ILWel1CkGhdPoiHdI8Q0nJWahVwU +PKz1A/9xPsk9k0quKrhEKI7sYZFJn/vy77gh4/k26/jk7JERonO8ECDDlo+r/hfF +op8A/ljW2BDm6VxHSBUkIJvULUbN8rxvQGnpKplv9jgiwBHoPhKZ/TX7KvXAvdPg +bx8Z4EfSVJRQs7j/v/IhM8xn8tu0EEW+Fg1SHCFWV5iqe6aTZrQjU2FuZGVyIFN0 +cmlrZXIgPHN0cmlrZXJAc3RyaWtlci5ubD6IVwQTEQIAFwUCPLTBeAULBwoDBAMV +AwIDFgIBAheAAAoJEGY1tsDeiF3T18kAn2kAzhMXT0tOg5GvGVNi+rc+dpZcAJ4z +rKA/8TnQ88Lqq/OOwkuC/TXrHohGBBARAgAGBQI8z5oyAAoJEBapZJXiImeVyywA +n1wPiGQVC6Kwdz1XlXrFL6/yC98mAJ9MZZgOr/Kyh2mDgwqWi+Fa/bgqarQjU2Fu +ZGVyIFN0cmlrZXIgPHN0cmlrZXJAYXBhY2hlLm9yZz6IVwQTEQIAFwUCPLTB5gUL +BwoDBAMVAwIDFgIBAheAAAoJEGY1tsDeiF3TQNMAn0ear3DqKydi9oTzfBYFCidn +YhqJAJ9fvKcU27+jJCRHIPp3lQPX0C+UQIhGBBARAgAGBQI8z5o1AAoJEBapZJXi +ImeVXd0AoP+AlwMBWr5fJ9pERjvKmnnNJE5oAKCJTRBYnB/aYkt8/aqPMVtl3k1L +NrkCDQQ8tMGJEAgA2F8v1AMPGI7cv7cWuySfnd2CV7SXOZQpc3Pfv2UHgYP+1lTL +NJoRtfwXMiNjrEwgLrpLy7F0nHnVqb6MBYv/Dhx6eO7MoejJUc2pADijCS3Qcg5n +7hCZ+pWvCjdZAfZhHB1cpSm0FVuc07jrJYTbI/qsdbUHQ4r1jcIZR/ZU4mTnFgnE +bAw4NxSGJ8ikFNNfviDdb3O/XAYS27dgJcGHOHaQi54dWkJpYt5vayUHYt85pOMH +MR1AwkvM3AiqPO3688VbV6mIlGS9XvBr11kbZ5EHUCDPFJl5AMjX2fg4lMQu/ONj +rbxCqbJppPLLXu/MwfrV9Y4pb7L+riWqdQwEOwADBggAgOqiXCSsRXmbxC0hYNj3 +UCY9KKy6CmCwExigG8Irs3aqC3cPGi9/9lpuniMN5F9ieN/BJysJHAFWN8f3z4UC +fQH6os3ewQDZqoFrgkHqlrAjej8qD0X5Ue0dozXLuMFe05X1XCkTff9wXI88uRxq ++5s7cedGqZQUixpN15oK9FZSORPPxjGsUe8NVMsplYvH/2xt7tXzDfE09zwT2qnM +voQte/WBoVYdVCigUIeArRqNyCsk1yGUfiBcmJFHCyhKNtYNAUwWGPv8AmTAb5yf +FFVprAMbDlv2yhiTnEj7AvEC+OP1RH0Z4j0TDlpeKHoZtu3uP/gp7Mshs7ssE2mV +qohGBBgRAgAGBQI8tMGJAAoJEGY1tsDeiF3TPewAnj9AmBMuS8QvsuS5hUhSWNZ/ +uLN6AJ9FK1Wz3vBRoTloK5D3D3UaJ4x7Hg== +=AHY5 +-----END PGP PUBLIC KEY BLOCK----- + +pub 1024D/E005C9CB 2002-08-15 Greg Stein + Key fingerprint = 01E4 7536 0FCC F1D0 F24B 9D14 5D41 4AE1 E005 C9CB +sig E005C9CB 2002-08-15 Greg Stein +uid Greg Stein +sig E005C9CB 2002-08-15 Greg Stein +uid Greg Stein +sig E005C9CB 2002-08-15 Greg Stein + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.0.6 (GNU/Linux) +Comment: For info see http://www.gnupg.org + +mQGiBD1bRO4RBACFxCQEk8j9a9SSzVIFUg6EKAXabSii1f2vyhdsj7yLd4E2nybA +6907ohpFkIHdOGWAasKKDRG3rpL1X37c5dxUYgGFGyfbe7FapUPP0azq/Wsfn8Ax +6D0jcIHJKZg+L0zHqxSwItiyiSqt2YGRUO42Bo/8SF7PHnv5TNKQZOjBIwCgmyiQ +lVmqE7NiM2oR3P0kYUDDcWMD/j0v3uyNKPTTOgapzRM7ThACv/6KmF600HH4ZbHg +3B2JTaoHiCDoYs1kp/8F65N6KG8S8wzJb1ErpbZSCqy7ZjjFm+NDRsTkFHPZngUS +l4ctAthOwgg93STorWE+XRF9ZjzL/XcQog2XV3ZMZAGq0prgX0LjZ8lHWPkvYv63 +EEJIA/430y8P+3refqpeO2UtsrUeDaYEkNJg379USVdI1VDJXdS1G5lCRkNiRcyU +im6ZcgOlgf+7KNuBv9urIwk7GkcPl4QHHFk2Fex2+k2JDxn+8gafjG1O2bkDKEyi +csHOWFouQvxLhglC8WJCmPQtMwMWzVpNlOnKyN6MPyvFz0CKc7QeR3JlZyBTdGVp +biA8Z3N0ZWluQGFwYWNoZS5vcmc+iFcEExECABcFAj1b0FwFCwcKAwQDFQMCAxYC +AQIXgAAKCRBdQUrh4AXJyzFQAJ973oVmfVyH0w4cs8SljCxwPnhUCACfebmWhkt1 +aYuu0vSX34Req3TPZ9e0HkdyZWcgU3RlaW4gPGdzdGVpbkBjb2xsYWIubmV0PohX +BBMRAgAXBQI9W9BsBQsHCgMEAxUDAgMWAgECF4AACgkQXUFK4eAFycvhKQCdEvec +2nvVEx6OC95oTwYZSM2B0NoAn0Ju156UP6IwGwczI0UGYuezk/4xtBxHcmVnIFN0 +ZWluIDxnc3RlaW5AbHlyYS5vcmc+iFcEExECABcFAj1b1JEFCwcKAwQDFQMCAxYC +AQIXgAAKCRBdQUrh4AXJy2W3AJ9Q/SnukhlOxz2vHahHiQ7ZgDE5qwCfeCn6PL3H +VMW9xLKJtU0O+Fep6a4= +=2Mbf +-----END PGP PUBLIC KEY BLOCK----- + +pub 1024D/8103A37E 2002-07-18 Andre Malo + Key fingerprint = 92CC EF0A A7DD 46AC 3A0F 498B CA69 3974 8103 A37E +sig 3 8103A37E 2003-01-01 Andre Malo +sig 3 F88341D9 2003-03-17 Lars Eilebrecht +sig 3 5F6B8B72 2003-03-17 Stefan Bodewig +sig 3 2261D073 2003-01-02 Astrid Kessler (Kess) +sig 21D0A71B 2003-03-17 Dirk-Willem van Gulik +sig 75A67692 2003-03-18 Erik Abele +sig B3B2A12C 2003-05-13 ct magazine CERTIFICATE +sig 3 F43C2F92 2003-10-03 Bruno Lustosa +uid Andr\xe9\x20Malo +sig 3 8103A37E 2002-07-18 Andre Malo +sig 3 F88341D9 2003-03-17 Lars Eilebrecht +sig 3 5F6B8B72 2003-03-17 Stefan Bodewig +sig 3 2261D073 2003-01-02 Astrid Kessler (Kess) +sig 21D0A71B 2003-03-17 Dirk-Willem van Gulik +sig 75A67692 2003-03-18 Erik Abele +sig B3B2A12C 2003-05-13 ct magazine CERTIFICATE +sig 3 F43C2F92 2003-10-03 Bruno Lustosa +uid Andre Malo +sig 3 8103A37E 2002-07-18 Andre Malo +sig 3 F88341D9 2003-03-17 Lars Eilebrecht +sig 3 5F6B8B72 2003-03-17 Stefan Bodewig +sig 3 2261D073 2003-01-02 Astrid Kessler (Kess) +sig 21D0A71B 2003-03-17 Dirk-Willem van Gulik +sig 75A67692 2003-03-18 Erik Abele +sig B3B2A12C 2003-05-13 ct magazine CERTIFICATE +sig 3 F43C2F92 2003-10-03 Bruno Lustosa +sub 2048g/E71FD3A6 2002-07-18 +sig 8103A37E 2002-07-18 Andre Malo +sub 2048G/3EC3A5BB 2002-07-18 +rev 8103A37E 2003-11-28 Andre Malo +sig 8103A37E 2002-07-18 Andre Malo + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.2.3 (GNU/Linux) + +mQGiBD020E8RBACVdPw0jDJ4jXKx8hBllu73Vmoxz8amOq6J92XH0Ch3obgHKTa/ +JndsxvYFDy4onZItPXbb4TC8uJGwi717eU+w8dHvB/R972JveKgb0HMeHcrGFOvS ++AlggjSCSxGht0UzwvwQgTZAdWfM+14g0K7yPtpMr4eh3QjYI3Q65lZ21wCgwNS/ +9Jl0adHrs3VzLFpT669fcMMEAIaesoMbtU0YaSyKN6ohU612G3pNXG23FeqbOXTY +twhKxtefcG0xmssI4ylq4jxxn4iLQHJUn9wI/oS/rksJjdBWICq3vah6FV3NUev7 +LZcJ1X/TntztE0SKSdwjngW4jhzxnZlteCVRmeejIgotj0xOwBzRfNGpW8E9JJdA +uWeTA/4/b2+jlkcWnIYrfy0HwTeeN2Dzd0p1S+egfkFZOfD15G1iRCSVsDVaHyeL +2n9NMfjVlHV/OzuW1/786IpvwFXwy/4HUm7b3DwG6p1GIUFFgyk4CjezzUqBAaJK +vfiaGWAmPR/gVdPSI94RduQNBhvxFupdH6QsyXw8Rxp+dYM7WbQaQW5kcmUgTWFs +byA8bmRAYXBhY2hlLm9yZz6IXwQTEQIAFwUCPhN4hgULBwoDBAMVAwIDFgIBAheA +ABIJEMppOXSBA6N+B2VHUEcAAQFcggCdHaBDTO7VXi01WGveomeSLIvx//cAn3ov +xRtZ5FkPALFK8Gu3aqJOf3osiJkEEwECAAYFAj514TUACgkQPo+38viDQdneGgPn +RL56FbdifkKziqJVkXLNdPeHAH924v/k0SAoX4Z7UlLuzKGF9pyjeOl4XOWuD5yv +FyjPMByZmeVOzPdsjPRAo+6y72POePrXvxZn6wdy/gEgceWxCC23DOdq0iIN581E +Hc8mcKTrLj2ND1WPCNjz6iO74qoUKGxM3WbJpfeIRgQTEQIABgUCPnXlXQAKCRCi +EVrhX2uLcmOPAJ9Lyg2fvTxGVamEwgvP1cf7/VU35ACgsFKVNlQ3qlSmPgeKDYr3 +cE3QfcWIRgQTEQIABgUCPhOHsQAKCRDu0eo5ImHQcwvLAJ4tsiuDE2UY17kdNlbW +JUbGQim5bACeP/31gQEQBPKbbhSungcj/uiZHcOIPwMFED5119b9b4jGIdCnGxEC +KCsAoNiERBYp3lGM/e041l/Dp4NalwfoAJ4vPM9qLN+CwKKqkPcFWT361dd9mohG +BBARAgAGBQI+d6vlAAoJEBU/oM11pnaSFgYAnRXQPTwosdoB2tkdAixHt6r0SX5d +AKCF3u+4wK/1/3NJLbe0rsthERhpE4g/AwUQPsEPa9vSRfyzsqEsEQL7MgCggSp9 +AlkHuIEjWqWe+cf71MI0/m4AoNqapfJAGP3nrFopelr8X3SmXOLCiEYEExECAAYF +Aj99kD4ACgkQiNfNvfQ8L5JSDgCgtO3NvDQuGjMttuzQQ2q72/TKg0AAni7N9ZNz +IYiK2tDIGHuZpvJKey7NtBlBbmRy6SBNYWxvIDxuZEBwZXJsaWcuZGU+iF8EExEC +ABcFAj020E8FCwcKAwQDFQMCAxYCAQIXgAASCRDKaTl0gQOjfgdlR1BHAAEBkhUA +oJeJ/RvFnduhbVt7aBX525PsY2PEAJwIsvADai6FHkyc0awF8XwLjF3MoYiZBBMB +AgAGBQI+deEvAAoJED6Pt/L4g0HZAiQD50pdd3/xn1Ue76fQ9zShqBpP0YliD9Iu +Co0Gh3PfATMYDbXqNThtC6jEDOyyeR8ZiJsJGwTh2eSRRVK6YURYy8ef7FWXiT8P +MeMThCqui3mL3oovpZXTX7S7dkwY84OaWIyTc42Y0Yf+sI0WW0LTwnKId/NtxF5r +nfmrcgkgiEYEExECAAYFAj515VQACgkQohFa4V9ri3J1UQCeJ6XBQjbUpYRgsndw +2MD4p2WS8vUAn1Pe+uc60dzzIyzbJMLLI2CVro5+iEYEExECAAYFAj4Th6kACgkQ +7tHqOSJh0HOCRwCeJkoqsG6ofuGk1lZS/6EBwupfppQAn1cs8TPKywSVEF5/kXpz +MbFKMoAHiD8DBRA+ddfM/W+IxiHQpxsRAkHHAKD0TvgAFQkaIm3ihevb0A9bZdo6 +jQCdEG+yxufIV7YrMdR+ACF2YBRmQi6IRgQQEQIABgUCPner4gAKCRAVP6DNdaZ2 +kprhAJ0RKBvHof+L2PUAACwcNYxPmcdZzACfQn45gJqhY3iTuaSrxbtt9Uj+GAWI +PwMFED7BD2Lb0kX8s7KhLBECfpEAn2SgNqS1FFCAa0qswKr+0VXRCLlBAKDvAj4o +Fj0vMELaxdqLRpofJo6aDYhGBBMRAgAGBQI/fZA/AAoJEIjXzb30PC+SKbkAoIZv +HORjyXUWiVtvZp5IbOg7PpmAAJ91B+sAXSC0KZAYdKiREaU1LuRIz7QdQW5kcmUg +TWFsbyA8bmRwYXJrZXJAZ214Lm5ldD6IXwQTEQIAFwUCPTbeIQULBwoDBAMVAwID +FgIBAheAABIJEMppOXSBA6N+B2VHUEcAAQGl9ACeLEMFRQIDIyptxewoPoarWpv+ +PJsAoKSt98+huyZ8ZnJbi3rDyUs99FWViJkEEwECAAYFAj514TUACgkQPo+38viD +QdkofgPncrDfQy1Eqthl6zSIuqcy40VnIhZl6oG1QKQkpJFlWnfwBXGnxs3S91ZT +xePXizV8ZEsTMxo9WpYOVkWF3f6OUFs0wEvRWNbH1OFZ+J7m/04xk0aeWSaTBc0B +qDRDexm/kh7baUm7AHPVv5t6d4F9q2Udip1XSaEEXjGFW6+IRgQTEQIABgUCPnXl +XQAKCRCiEVrhX2uLcnROAJ4qfuGagTHfXOQZxgtbv/xNBuDTmgCbBxmInYjKqVi5 +PGc6WqRjXlGEtWGIRgQTEQIABgUCPhOHsQAKCRDu0eo5ImHQc/y0AJ9Ygmr9qBZp +gKtGY92gycOjY/nI+gCeOOMDnT20bRwsUY0KsPzfc3/n/lCIPwMFED511939b4jG +IdCnGxECtWQAnjSqf+kk+QE0ySD/dmGKtV6m7rZmAKDHJOzT1DbySPVPYsRI71Zy +LXRMyohGBBARAgAGBQI+d6vlAAoJEBU/oM11pnaSMpgAnjQjqqitLpaXEVX4xMyh +c+SWwwqfAJ99J4WGSjx2TP6jH5F+g3eIBvTgUYg/AwUQPsEPdNvSRfyzsqEsEQKo +KQCeMNi3xC7+A0W360cw2sVo3LFmEIMAoPiQkWR9p2nw2ZBw6fwFSC6ZjfG/iEYE +ExECAAYFAj99kD8ACgkQiNfNvfQ8L5ILRwCfR8G61cs1o2rtGRuLRVxkHFdLauEA +nR7PIdcv7egOVuEq7nI1/mVGyJ7UuQINBD020FwQCACzjBVkgyKm/qUtaK2pLCcA +TUKioRrdEROiw85ojD83rtV5mW1XrvFfwekCbWMyBvDAlF+jF0IjjKaH7o8Q3I9q +S4md8cetsH0PMpDqgxzX2sGXUO5oBckJ8InJM6QVj/FyUHmCaqcttaIJWSZBpv97 +NWKDrgscC5rCbmsZL0Hi1kLfxfllQvq0snP/88wWInRFyHrqHu3XVmyeA+08LJae +GX9T1zPvKL+nXO+7TBswxGszE1lJmkafKnGzg2NLpZKKZTUNaFJhQnPqMsGNu9x7 +fwqE9avYnNLyIrYPy+fSZPsMtn2VS1TkbhVPQOMhq8J6k2WiHSd+/rNx41X+6N/3 +AAMFB/0UOqYx/526cVcqufmTUjsZ/ZHa52VYL64czno5u8D0Y7yw96rKFscnNbRu +l6kY4RBZ3VRqWBPE8OLlNPU4NkpV3FsFnj3e1e+nmv4dRTHGENy4ufESDcu50JxT +4obM5FjbdfAH81MPGZee97O2CYP+usTS8I/6fd4D4wsU24WAfpKIuHChjgpUAFOG +9386j7TpRCMZfLQk7bIzZsa6fnNWxfdJGAfPrsKMAIc5JY4HHIfTjr8fZpe3Dxy8 +cxc+ZWdi6TUU2L9BAhsAh4OhuqnAN1/AChB1sCbe0zr8eLSwMkzvjBhYXBCpRDqR +1BafVsRm09g03ZOeUVX8aFVN3Dm1iE4EGBECAAYFAj020FwAEgkQymk5dIEDo34H +ZUdQRwABARO0AJ9KSq4YtCH0mEvc7bmtEYMg61OlzgCcDbnaS4zc3461d1GAxef2 +vZwJNc+5Ag0EPTbc1xQIALLx5n1nvDmOVjAGvYwXphGXDTdK2yoy5qhElUs3LtgV +2pCsLmh0USK1IXc2pJN/XWq3FKkQd3W85LisWcCF5GvYlKlYS2Y1NG5k5TOcdAx8 +4ZtIxu6a79we6dJCQ4QPQMHDCxejw1Zflgg8Ml8Jex9CgVsTH9dR2OunrnPFdWB1 +M7zanFa0oMOpSMtn8s2YyMES2SeiBlX/ZDDlPvwBAW0nfwJ6X6ybPq0WD134W73t +UqwU0lkXTtIVejix+3sUE7tHo/Q8u4Yr57uZlhgCCG5vYuMTmyRW7qSb2QkrNULf +6aR5BLN/3ghrmX3VkcZzsuuvi4eWNjFFBsB9sxNRo48ABAsIAK0QfXGaO9utxSWy +eOITFbv6p8rbsyv175hBeozB1mpEK8F01NJV5BkHGd03uOAjWo1e0IbJFdESG0tf +wy7GbvbA+b6NP6fg7BvX/i3ca8XrdwAoasaMck1+RyUO8CCRqc2RY3V1ngL7z824 +Vn113QO7bngykdbO8Ub4A+LYoFv7QMgtjlbKCS4PTx8dHKfQWVz1a8F1qUIb6Abe +UNt8GiehiUfZ2YaUE3CiMR0CYQYZJ61R8CmAw/ZwiKjbbde10n8uMhWOMmgCG5J4 +QCB1TAsBrH2fU+aMiobSp9Hz7UDdjDN1728LVdoEeaA5oArDhcEoIzwZ/Rgb4VxQ +ZB7NGE6IYAQoEQIAIAUCP8am1RkdAmdudXBnIHZ1bG5lcmFiaWxpdHkgOi0oAAoJ +EMppOXSBA6N+zfQAn3hYxwNd6/Zh9/9vSrBjnil4d1AMAJoD9Vi2J6DhxHDrUiw2 +i+8RU+4msYhOBBgRAgAGBQI9NtzXABIJEMppOXSBA6N+B2VHUEcAAQGSjACeKvXX +kfcE8otR7xgRu/nO0LOLjSIAoK4gCL2NJ80W8HgC8JIAkHU25Lv+ +=93VU +-----END PGP PUBLIC KEY BLOCK----- + +pub 1024D/75A67692 2002-09-28 Erik Abele + Key fingerprint = D395 C757 3A68 B979 6D38 C258 153F A0CD 75A6 7692 +sig 75A67692 2002-11-23 Erik Abele +sig 21D0A71B 2003-03-17 Dirk-Willem van Gulik +sig 3 F88341D9 2003-03-17 Lars Eilebrecht +sig 3 2261D073 2003-03-17 Astrid Kessler (Kess) +sig 3 5F6B8B72 2003-03-17 Stefan Bodewig +sig B3B2A12C 2003-05-13 ct magazine CERTIFICATE +sig 3 8103A37E 2003-04-04 Andre Malo +uid Erik Abele +sig 3 75A67692 2002-11-23 Erik Abele +sig 21D0A71B 2003-03-17 Dirk-Willem van Gulik +sig 3 F88341D9 2003-03-17 Lars Eilebrecht +sig 3 2261D073 2003-03-17 Astrid Kessler (Kess) +sig 3 5F6B8B72 2003-03-17 Stefan Bodewig +sig B3B2A12C 2003-05-13 ct magazine CERTIFICATE +sig 3 8103A37E 2003-04-04 Andre Malo +sub 2048g/A680673F 2002-09-28 + Key fingerprint = F2A1 2400 3799 B66C 7530 19E8 D8D1 82E4 A680 673F +sig 75A67692 2002-09-28 Erik Abele + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.2.1 (GNU/Linux) + +mQGiBD2WL90RBACfr70TIDSk7pcnS895qhkiBp1A3wunMVIshhmxNpjxxJAWnZ+5 +wS8rvtwksMmjW7LCK8UA6Jt0avsc12qyufiR+pfhMXVtJmGQc6VPHd/mQcQS6SM0 +/G7xpt7V4mRB2gIZULFlaSb2eJNFNo9faAJOv3pjnG30ON9MBHy7kJwo0wCgreok +3H1+Jbv2X9NPSfh76QoiPQ0D/j1GsAIiZ18TFPD6UA5Xwh0f4jBNLNK50/xgJxvC +adVAP0RPd6xgqYQLThMEQHyX79rVnlmW4HdtjvcxzqY5yQ4fTGTrEvMn2kj+UPA9 +xQfc2Lb0dHdkxguSicMpkVXKTP01avEpdIRO2zHVYKNeX75pKYQujD8Qq0QS+SsI +4WvVBACFhAgGxxnoFzxprEmg9wkGaeiF6RlTLtTyHHqRdubdUkaa+rH2AWtSQ0h/ +acyePAvl2ScpGbt325TPfAQcW9ewCno02a80/7TfzOrktSZrM3yxVQz7cZYoZRup +GUaN42eWUFRaOusRTBJyC1VBXeAkKJy2ZkgqVsbG0jx5kMFOPbQfRXJpayBBYmVs +ZSA8ZXJpa0Bjb2RlZmFrdG9yLmRlPohGBBARAgAGBQI94AzpAAoJEBU/oM11pnaS +KigAnj3zryS/aoPAoaxMhJAh8MPDtN2GAJ9R6/wC2EYBpAK2WiJzCUFfC1Ho0Ig/ +AwUQPnXZXv1viMYh0KcbEQLpLACfd1VwFJi67I9ZgGfGg+wgBny3kU4AoLszthWa +cm3dHZl9ZzEdhNVWbEgDiJkEEwECAAYFAj5137IACgkQPo+38viDQdlNEgPkDd2a +99kBVGY+PguJVGSIgtBYdmpu5DpmUfWaibtJUnIAxOk7AT9Ke7kaHAkp+JevV/d5 +4Hpy1pD2bYUitk4LfiprBtd5FtuT1/Qmk3d244mP1O857tVpUdOwKTN31hAr9E/u +T1eMf7Yx0iVOuopiFAzYVFqZ0DgdIjPS0NWIRgQTEQIABgUCPnXaWwAKCRDu0eo5 +ImHQc9X5AJ0Z5IxYs2/x7XkMtOpdkOrvfkX+FwCfcjIzrpa/vOdIAXL3safBoMlu +PgeIRgQTEQIABgUCPnXf+gAKCRCiEVrhX2uLcnA+AJ9czJ5JfRoGLaDeBwGk/Ydn +XPeIrQCguUK5wJHnLE1TJUb1lrt/n45dCY2IPwMFED7BB1Xb0kX8s7KhLBECS3YA +oI6mca0xDsxDc2jVfPMWBHy+M73tAJ96CL0jNtDe29PvmQiqWL+XBH1e8YhGBBMR +AgAGBQI+jc/QAAoJEMppOXSBA6N+7QYAnj2Ci1JyfoDLYozP0+P8rcF9fUHPAKCz +eEHJcMEBY4/Iie+inr7aD17+ibQhRXJpayBBYmVsZSA8ZXJpa2FiZWxlQGFwYWNo +ZS5vcmc+iFcEExECABcFAj3gA1cFCwcKAwQDFQMCAxYCAQIXgAAKCRAVP6DNdaZ2 +kqTcAJ9b6SqN/SWtyDhAjwwVxhDAgpqYFQCgpOFZZ07RA3tLNBmPPsPVyOjhWC6I +PwMFED512Wb9b4jGIdCnGxECzzQAoLVx22FhrxOpd2K5sa4/UE5t7croAJ9kHMrl +tZt832fOmscRoAG2OHjDT4iZBBMBAgAGBQI+dd+8AAoJED6Pt/L4g0HZ/ycD5Aov +I0RWvFNQsKh5/5vp6PRmsGPHGsptgZcYbkBh78ivkysASoyPAXyRGakeszeMoXgG +qNb0WMInaIp/EKxiYH8xYq8FcGlX7vkRhM1zJkJsbWvsSNhR8+MgQ2D5KmVEeo/+ +OG8c0XLo6wQUa3Y5SwGCQtBFbbZwZHzRLgphiEUEExECAAYFAj512mAACgkQ7tHq +OSJh0HOZuwCeIGKuddy18n7LrQ9onHIBN1u0iHYAmOKdJHhl9EV7d3VgTgdVtNDV +Iu6IRgQTEQIABgUCPnXgCAAKCRCiEVrhX2uLcopTAJ9Lbh6cy8flzIn33YWb5Ao1 +S2bw+QCgp5Wxf86vhw9zy3zZa7WRN6sf3J+IPwMFED7BB2Db0kX8s7KhLBEChYsA +nRosJaTfQroNwWkNesdYJd8kX2QzAKC13PFvlD5QiuP3cGJdpjF0uGVTC4hGBBMR +AgAGBQI+jc/XAAoJEMppOXSBA6N+2qEAnjWL4KKHF7uiniUJ7J+8ickC/zubAJ9L +Opt07eUYMEoLmDgcgWt8AEQaL7kCDQQ9li/uEAgAjhxXvtN1+g5/Aa40FFAJiRKh +G6Yoa4oCA99HJEubjH6FKGfWE3j07WFpQ99jPcTdeEAEla+8I1VMLkF2kR4V+0oK +0ilxRs2t/6V+h7KsqLtivGOCEIO8/uRLG8RUJos6LSHeda8KYEJm2K92gPX/PQC6 +mqZlToSyj4pun+mUMqM6Hbe05Updygij3ly7h1YQRLb1dUOIb/Ju9R4c3TnFQgFr +j64c2hldJY4SPcM9rL5ffOj3TUnMLsaMdoLrML04H5wiIK11wpsx3bFeGcafoXHb +wh21RxDK/KOVc9RUbw35H1Gahnr6ERnAOBz1SJHp30y2zDsVg27I0BCj81eANwAD +BQf/RrdNtskNbuNSxsL/ULN94lSwowDlpcIgIRbFEfqyvCvjGDuNVz6AlHsierCW +tIn7sD5bEKIGgJKFaNbAuIuBJ+PGhzlL7SCGWW9S9B19JbXBF/oBzvmdbs3HPm3T +X3qAuvhVZ1b9F+mJTB6+Ub9/c/Ya1FugXzHfPyaJBpestQXSQGmgaAQd3+Y9YLHI +tQJumfW/AWTCq5gFnTa87QpN+GsLIx3v49wtu9S+aRgEpl4Dbbf5LwCYtI51xomu +Efdb4M2v+frqgvP7Wq9L0c5DPmqFrslVzE+i13eoPJxYv/uMdmEtdZG9JZgZSimb +0LeNsqGJ8KZuFXrUIOCSUCIu9IhGBBgRAgAGBQI9li/uAAoJEBU/oM11pnaSshMA +njooG5OC36mXXMf7EpADoF6hdVpOAJ9dg1mmlKY4jAKuyCAnJT4U5yjE7A== +=Yf4N +-----END PGP PUBLIC KEY BLOCK----- +pub 1024D/2261D073 2003-01-01 Astrid Kessler (Kess) + Key fingerprint = FA39 B617 B614 93FD 2835 03E7 EED1 EA39 2261 D073 +sig 3 2261D073 2003-04-04 Astrid Kessler (Kess) +uid Astrid Keáler (Kess) +sig 3 2261D073 2003-01-01 Astrid Kessler (Kess) +sig 8103A37E 2003-01-01 Andre Malo +sig 3 F88341D9 2003-03-17 Lars Eilebrecht +sig 21D0A71B 2003-03-17 Dirk-Willem van Gulik +sig 75A67692 2003-03-18 Erik Abele +sig 3 5F6B8B72 2003-03-17 Stefan Bodewig +sig B3B2A12C 2003-05-20 ct magazine CERTIFICATE +uid Astrid Keáler (Kess) +sig 3 2261D073 2003-01-01 Astrid Kessler (Kess) +sig 8103A37E 2003-01-01 Andre Malo +sig 3 F88341D9 2003-03-17 Lars Eilebrecht +sig 21D0A71B 2003-03-17 Dirk-Willem van Gulik +sig 75A67692 2003-03-18 Erik Abele +sig 3 5F6B8B72 2003-03-17 Stefan Bodewig +sig B3B2A12C 2003-05-20 ct magazine CERTIFICATE +uid Astrid Keáler (Kess) +sig 3 2261D073 2003-01-01 Astrid Kessler (Kess) +sig 8103A37E 2003-01-01 Andre Malo +sig 3 F88341D9 2003-03-17 Lars Eilebrecht +sig 21D0A71B 2003-03-17 Dirk-Willem van Gulik +sig 75A67692 2003-03-18 Erik Abele +sig 3 5F6B8B72 2003-03-17 Stefan Bodewig +sig B3B2A12C 2003-05-20 ct magazine CERTIFICATE +uid Astrid Keáler (Kess) +sig 3 2261D073 2003-01-01 Astrid Kessler (Kess) +sig 8103A37E 2003-01-01 Andre Malo +sig 3 F88341D9 2003-03-17 Lars Eilebrecht +sig 21D0A71B 2003-03-17 Dirk-Willem van Gulik +sig 75A67692 2003-03-18 Erik Abele +sig 3 5F6B8B72 2003-03-17 Stefan Bodewig +sig B3B2A12C 2003-05-20 ct magazine CERTIFICATE +sub 2048g/A676B84D 2003-01-01 +sig 2261D073 2003-01-01 Astrid Kessler (Kess) + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.2.1 (MingW32) + +mQGiBD4TcBQRBADAwVM+jE6VQUNhOHL/0L+VsWC/n5tMEbINSYUj+7KFrWqlTLgc +nVA9vOGlScm+STor7YaE5Uhni6WK9TfmMBrLL/qPBVVH+jh3J4AYv9IzNuqmIyV6 +eLhQ90jcL59orD2EnbVf9S+Xa1+5zatxPFH97aqd+wTbhiGhNGXyyrwk1wCgkgBy +hImcmBHd11v8e8ECbn+h8o0D/RJAfUKKfQtJjJk8+gng0adRgqYL/XT1F8PTcFir +MIvLrXXDv8X0JZ9PZ/AomV+9S0spqT9jStRIohALb7LiiWfwdOeE96tUNe8bgqUx +SIJRku3NXJlQgxwI1eQr3kVT+vYwqhc+Pd4mngrmcDqRDgYqBRdvVU8xqVM/dU5O +VzPzA/4jrpenZJl5SWDPFn4Al7enlvnYOd0ptvGO/tL58MHvJiAlFlB2xewiX/S5 +GYsidApV1+U3dCUyQadOxb9ZijGC/x6ck9Td+i0BMEC508tUCmWC64JYCEnbOi8x +OzpQMUIM6KvfuY+4HqWe6efhnDFfrFQUl4Net7gVVvaKzwzSwrQoQXN0cmlkIEtl +w6FsZXIgKEtlc3MpIDxrZXNzQGtlc3MtbmV0LmRlPohZBBMRAgAZBAsHAwIDFQID +AxYCAQIeAQIXgAUCPhNwFgAKCRDu0eo5ImHQc106AJ4sQFbRVLQIFoi73RTzRI3J +yL3wrwCcCxDCMy8ry7JvHUnsdryCMC80s3CIRgQQEQIABgUCPhN6UgAKCRDKaTl0 +gQOjfkrRAJ4z+GgWkgcNOAVuJ3AxJRSPlGS/qQCfWmfU1ioB/a8SZoegKDYMfKpl +4zmImQQTAQIABgUCPnXgiwAKCRA+j7fy+INB2S6VA+dVyKV0awmH56wznCWWNGMC +F2qzYAV/KfTETppEofVUFO7wHy/jle352Ucdu19aA5e/H3+2hiutS+8ORO8QMv/1 +mziMskrKTbT7xc9C7PQNOIdyM/EqanD4LF4aFIFKpvxRWumaxU9h1jImfabJHZg/ +jE6jWm0Fwj2qlD2tVYg/AwUQPnXYBP1viMYh0KcbEQLugACeKn1RUCsBWc/x7eEo +yE/RAHVaw38AoPdmhDP9iH+SvDV/5UlJG2C4Qe5oiEYEEBECAAYFAj53pNwACgkQ +FT+gzXWmdpKRyQCeNqFBkH4iNDL/rNPwgydSXykRSmoAnA36OwlYpSflMRCQjxc0 +KeAth72xiEYEExECAAYFAj515YIACgkQohFa4V9ri3JibgCfaqVNUK/VvMEzuI96 +dH4kGhmMJx0AoMNkxWQXpFugNbFqrGRgurHS3YO7iEYEEBECAAYFAj7KI1MACgkQ +29JF/LOyoSzx1gCferfhaazwRtniE6H9Px/JuxF4X64AnjWMiRahZyqUOyLjn9NB +Xe/VMfmptClBc3RyaWQgS2XDoWxlciAoS2VzcykgPGtlc3NAYXJzbm9jdHJlLmRl +PohcBBMRAgAcBQI+E3h8AhsDBAsHAwIDFQIDAxYCAQIeAQIXgAAKCRDu0eo5ImHQ +c9UpAKCOMBmZlo9iUnkIZpmojoxWMTWx2ACcC1TkKFzgp9YmuD4VkMR5kx6KKAaI +RgQQEQIABgUCPhN6UgAKCRDKaTl0gQOjfqs9AJ91seXqRoGQegd5Sg5b1aawf5O2 +bACcCENC93l4uzFkZHLnikMdsPLXe72ImQQTAQIABgUCPnXgjQAKCRA+j7fy+INB +2UwHA+deIxwJw9zoaRBIovlFpvFs82DdI736enhui0dZihSRbrCaT5TocOICf2S9 +gxBqksIaVX66OgQRmZzURAlTNE/9AgVMwuKPMxQNTIfqhsYYlSI+6F0kDlZPfRaR +fZR20FV8ZEjITSlVxrcSXtAgJjErxdpM9TO7aBwc8Aen5Yg/AwUQPnXYGv1viMYh +0KcbEQIwaQCgniOy83lysIlHKCGOC6HjRmnXhgQAn3SkuVSh6ELutSyPw6t+9vs1 +173ciEYEEBECAAYFAj53pOAACgkQFT+gzXWmdpKQlACdH8uC2kyy138l+dAgAz8q +ht7aP1UAnRkHNPAzmsIZpxrQfI2XrO6R+ORFiEYEExECAAYFAj515YkACgkQohFa +4V9ri3IklACgqtZocUtEssgWVHHtXvoRHKohHLQAoLfhSrQWl0U5xUFyMwdw7ICV +LwELiEYEEBECAAYFAj7KI4EACgkQ29JF/LOyoSz4QgCgiT4OGQjPTFCIfqfiKaFx +whYXxwcAnj4pmD1Zb5kv9bKQvLh+2f6elgXQtCdBc3RyaWQgS2XDoWxlciAoS2Vz +cykgPGtlc3NAYXBhY2hlLm9yZz6IXAQTEQIAHAUCPhN41gIbAwQLBwMCAxUCAwMW +AgECHgECF4AACgkQ7tHqOSJh0HOaagCeNgrOmUUahKTedv0Fjuumt+l26kwAnR20 +ZDRi63Yi1rEzpL7eNJ9lBUMHiEYEEBECAAYFAj4TelIACgkQymk5dIEDo371lACf +aHoV/aWNsQiCTN/E7XkisU9rdWsAnA8EwJWG59zff1/r5FC+JY6IXNeaiJkEEwEC +AAYFAj514I0ACgkQPo+38viDQdlj9QPmOhr2tdOghp2QBupznGUik/ogva/ZvDWU +KbGrMP0dDoX2PvIahrRruonKBbrElWkPqmKFW1MkXS+lU6gFeYDzrze2iE4AT3dQ +Muw6iY3yUr9jVJHEwMNZKk0FXx5l9FKYEhlFgoWxfOWhM4/CkxRTcyxGpNycG/kl +Yasn9SuIPwMFED512Ar9b4jGIdCnGxECcUQAn1bhun0zd9C2I/of4vonPwLUKkKE +AJ0ZQ82v+t313pFt2EiO1AqjX5pRLYhFBBARAgAGBQI+d6TgAAoJEBU/oM11pnaS +pfsAmOd4LVw+9C+Q5BAVU64nXaSRTLUAniB4Lr1H/H2EUgU7QtImvAF4dSddiEYE +ExECAAYFAj515YgACgkQohFa4V9ri3JOuACgmo/f2GmjPHO2W+W6O+I4cGFCT0oA +niL5Y4zh9JjaJpIcJXiS4g+HyAMNiEYEEBECAAYFAj7KI28ACgkQ29JF/LOyoSz3 +rACg+9HCA3XInNfIM8bpqF4fC8LypjEAoOwrJcD/NFoETB5Gl2KlvFnWTQdGtDtB +c3RyaWQgS2XDoWxlciAoS2VzcykgPGFzdHJpZC5rZXNzbGVyQGJheWVyY3JvcHNj +aWVuY2UuY29tPohcBBMRAgAcBQI+E3kIAhsDBAsHAwIDFQIDAxYCAQIeAQIXgAAK +CRDu0eo5ImHQc1amAJ0V0IX6W57sUsgP3jaHy9sdL/BHGgCcC1aGh5+WhdCYSQNf +DMtsRmVrbeuIRgQQEQIABgUCPhN6UgAKCRDKaTl0gQOjflloAJsGWsl/jfrxjyTk +Fx9kHHmtkZHY4wCcDj503AAQHNAUO9qswSSHvayTry6ImQQTAQIABgUCPnXgjQAK +CRA+j7fy+INB2cyhA+Y+5CHNOHYOpw/gcYUIfc1OeX4IKWgZJImlySe8Pydzx5oJ +275HAdcRvJEehXIaeCCPNHve20gGZWrBQowpMrO3AZXaHm3LKgW2jVwWNNgbo0jy +7kvnijeujQlZC/wNRbetIoBdQIrPraywZgNYeaEAmSaW4TigavZTg1nr9Ig/AwUQ +PnXYIv1viMYh0KcbEQIL8QCgq989k6yY2OkOIDF8QUxsG6bVegoAoKDNrIPhwPD6 +gj4rwK1TtFpE/s9AiEYEEBECAAYFAj53pOAACgkQFT+gzXWmdpKXEQCfbcQs7zcD +Qb1OEwR7FwpSn7CxLn0AnjuK8206aC6qwVliEoIgmakZoVumiEYEExECAAYFAj51 +5YkACgkQohFa4V9ri3JouQCg4Y6nfjgAmkSA8STWFvCx+EMO3kwAoIMylSE2Kr5p +VKnVqHSihrmFa9N5iEYEEBECAAYFAj7KI44ACgkQ29JF/LOyoSxk6ACgltr57L02 +sWUhaPWojTRQTG+FgsUAoIRw+CjYOaoHJgbjJhLhH7GefSHBtChBc3RyaWQgS2Vz +c2xlciAoS2VzcykgPGtlc3NAa2Vzcy1uZXQuZGU+iF8EExECAB8CGwMECwcDAgMV +AgMDFgIBAh4BAheAAhkBBQI+jgk/AAoJEO7R6jkiYdBzkEYAmwauRVlLQWfQQWYL +2oETUR5r2LWMAJ4li2XuW3+Q9ieAcYVgLW5JVrIDkbkCDQQ+E3BzEAgAoNcpH15I +EiWXX5dHI2H94Qnrff0Xl4j1Wdh+P/JJNDA8FrOWCMcGSR+RCDPYiZ+R1bNskmiU +2fBnb/KrdVPVtGYc+Fm/51PeA7oxV/hyI7JudyouEm5JW4x9JzNcDXjnVWxt5Ovd +dJX5CDU6NmELPycKArRAxuS970htnGXf9MzhBsqjCWyiq226r1d7irnXXqL7+nC0 +DPOcyV1FNoralULY3qpf7k6oxadjJ24x4Eo3GbZrse7IJzdO6ojfros9Mo0VVnnC +0lRh4BHpOGNav8DENySNcWKUqCFSG6Pp8fvz5Py5pHP81sLDewaBp3wMrtKWt613 +N15Kuoy8FbeTdwADBQgAnNdV0mjGHWoOe+D4s61mm8OsawGSk5VvmxgClcO1uYO2 +hlCpRgpSSVwoy7Gk1BAH8iPRR0/zTk6tR/Yqgc57BIDSD/FSfDOEMj0FkOt07DEq +dAqyqF1QQlmznMV8qWXCaVXZf4e3a1zTS233RU6ue7uF5iAvqSN1AOoh3dEk8WVl +Na+Pdtao346XOK+bVDruJt9yRtW4AlR95Oy+FqPSSF0DzaH5MDFPCBJjZFuWAtOT +pyKV7bqrREbzDiNNWHY9D24wk4jTvXakNPNWU2LSIt2MFvX7JUZHr39AOIuzOq7Y +Hg6fISaeVG9bFLioCzvLHHwO98U3dkvXZWBMDRv1F4hGBBgRAgAGBQI+E3BzAAoJ +EO7R6jkiYdBzo9MAniGRGjIDno4FmOE32kgt2U5LEvIrAJ46RiKuEJ7Yf6tf9CPQ +d6rncSGIlA== +=SNQD +-----END PGP PUBLIC KEY BLOCK----- + +pub 1024D/208F5064 2003-06-13 + Key fingerprint = 984F B335 0C1D 5C7A 3282 255B B31B 213D 208F 5064 +uid Joe Schaefer +sig 3 208F5064 2003-06-13 Joe Schaefer +uid Joe Schaefer +sig 3 208F5064 2003-06-13 Joe Schaefer +sub 1024g/ED4260B6 2003-06-13 +sig 208F5064 2003-06-13 Joe Schaefer +sub 1024D/F8B0462F 2003-06-13 [expires: 2007-07-19] +sig 208F5064 2005-07-19 Joe Schaefer + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.1 (GNU/Linux) + +mQGiBD7qX7gRBACxF9D8+GYaiLC/c7eyNwuxQJtbkm6myjuhUoZsG6o0Z4SPNqP7 +dlQn3uYIQeRrT3pZjXCpcxYAq10c2QpDNR/Ip3w20FXF/QDGZZ/B+DRAY0Te7jv5 +Jri2qRcJXOaoUuLV+BhG0w05dzcNrgONMJKMR+TXjod4M8HQdXDb9PDXkwCgjPAt +zuoroLjvjz6GeWYiYmwWhzUEAKM3cqxbWUdsjho6RD29KBAAcc30W/qPzVZ/+ofJ +SoIgnf/ZnF3ZszVQM8qZYzvE7bgMrZJPDcb6SNGM4sX3D3yBAL+KldKlC2pZriL+ +Uv68e4zVpf+7mMEtk0GoQLoG4QQ7XgHA6O+mIoL+zu0I+VwReEjrdOlRBjXrMfr+ +L+GEA/4q0Zk8TP8iIh+su09UHlIU2c8LloRGmxiPXw6GJHgLbY6Aa/DotLBHFLNJ +LGD0zHhKqUl2n20FSB0fLikNppETF+gpp+6jzbfMGd8HAcfOgyh2VB8ShNuz68PT +mZEQuUAPOS3iyo7BUnpFiPnv3NqVqPq9LyR6batV3StDVeyhC7QhSm9lIFNjaGFl +ZmVyIDxqb2VAc3Vuc3RhcnN5cy5jb20+iFwEExECABwECwcDAgMVAgMDFgIBAh4B +AheAAhkBBQI+6l+5AAoJELMbIT0gj1BkUf4Aniwfn4mUmtfAw3S4HRg1mbKjk20O +AJ9HkxMkzG70xfROQXVClz5FAUp3RLQeSm9lIFNjaGFlZmVyIDxqb2VzQGFwYWNo +ZS5vcmc+iFwEExECABwFAj7qYDMCGwMECwcDAgMVAgMDFgIBAh4BAheAAAoJELMb +IT0gj1BkSUgAn22n8mLipL2NJM6jrD0alAeoDwiAAJ44564cvmM02Y0d705OFHgr +eftiwLkBDQQ+6l/DEAQAkXQA7401V378j6PeasecoTwIxp4fQen+AICPeoYeuZKK +qZeRh9Y0U8uAfNVdqNPSt+lgzQnoEpLdUSf5TWUPukter9mxxf8jATQ1W2Urrt+W +xHw6cjJs1qdHXVJ8eWl4lJZon/JhcP6UnmKFCSse2SM/moywzMNKb4Ti6tHrsIMA +AwYD/R6O4woc04s5fZn2XJjbZIcbLWemNpCMaRQa4ikHSwmh7HFZHwcU90W628Ms +mK5nK7W9bZwydwfO82fPX95/RWVZitT22pLdKVxwjxxlE37cHcA8PMCMzLZ6BEly +Hx8+3NNrtOT45C/gDlcutrdUBX6teLQECUe1o/a+7eh1qoIUiEYEGBECAAYFAj7q +X8MACgkQsxshPSCPUGRaBQCgiVKCXgOCVhyy4TzQDrKio4aaG80AnjjgOcR1sjdE +tCiRm4U1mjhlfYkGuQGiBD7qYc8RBADDggTr2/IrPdiP0L7iVRu1xXf/5+UU1/Bp +ff8Em1afNH13ptnBrhI5ifMUFGwJoANUtfGEXCAynB6pCamEq3pAscNdNGst0/ul +y4kLp1NJXdjvgw1wozRjnkJmIVTLa8Yg+aoYPC+tj5+74zmO5QvY9ZHXvdtYnrAM +tViV0gouAwCgnhjt06CpXVYOJURDvlw7nvDkssUD/0idmaMKUCp2KzNL4v3uUN8L +KF8pdUAOF0zPUl0w30KrWw9bO3sGmFfB7BQ9RYqzifcg1Ks/m1qVG56q3gf2ux60 +Uz7nB9VX1Q0GXj3vpq2jz5QEEu/PJ5ZWN21ZoD6PhHTtYAwEukq5XeNxjPa4Hf/9 +16TqlebaFcc9U6ObObw/A/4go6icBzpStu6wZzS/A7RzBfaRhn5wUjaVRkI4NyMJ +TWBrCkVTwtnNxGawMZyxdwwCHido2SuGgp3vze/Nw0PX0V/QdJPvOA230dNstAeo +KfMTki2MmCnFOZGSvznjb5XIOeVoUWYW5KeZd1JvFZbxbAdyqfKZV4M1LPZG/aI/ +U4hMBBgRAgAMBQJC3OzXBQkHtPIIAAoJELMbIT0gj1Bkma8AnjfgRtuon/0wgMZn +GA2FZPS3vn7uAJ4xC/LsaX+zc3ON5nLs7sNBpV07tw== +=8SJS +-----END PGP PUBLIC KEY BLOCK----- + +Type Bits/KeyID Date User ID +pub 1024/0300A2E9 1997/10/12 Jeff Trawick + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: 2.6.2 + +mQCNAzRAzqIAAAEEAMJUorgTyMEZPP+vXvmW/W+kdoCqAx7PFNpepvxTsTc5CQLt +Up9PvWrCGT/lAWO6qQkOsyNju/g5c/+cbJv3G0h4bOZPBEbRH3pkmAOAFUVUdmIu +FM+piYLdoAeEcE5+bmvWpzddkuiRRNIsMjmNjuNkqgOtYEZnGaCc8zADAKLpAAUR +tB5KZWZmIFRyYXdpY2sgPHRyYXdpY2tAaWJtLm5ldD4= +=E80M +-----END PGP PUBLIC KEY BLOCK----- +pub 1024D/A879FCF5 2001-11-06 Gregory Trubetskoy (Grisha) + Key fingerprint = F8C2 405F 8893 395E 4DA8 68BA A01D BC9E A879 FCF5 +sig 3 A879FCF5 2001-11-06 Gregory Trubetskoy (Grisha) +sub 2048g/0596F229 2001-11-06 [expires: 2006-11-05] +sig A879FCF5 2001-11-06 Gregory Trubetskoy (Grisha) + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.2.2 (FreeBSD) + +mQGiBDvoUEkRBAC2ZKj/jb6WQEPH3pU3dfC654tnYU80UlbBo6HUUgj9CB6QtECr +GsV771OqbBm4YAxpIo1QCpCSqnQyE38TEayuEs+BVWgh3WvZb3mNHz/5NFc2kEpt +i9YxGUkQ9/2sSEvGSVbEYitbghjLAFzQxuPfxUhxW8GnDBSOdLhF7Qy7PwCgiJwq +406ZJz5UGvzuFgpMZsyRm6sD/AyAM3eeTMARQbYa2cKBFDwgy6wLZl+llDGYmT9G +D+N1uyyLtiqNwR2ANBJC7gJVfNtVFIMLnQ3ms/nVFzTugQKyunlg2Koq+3ORDw2w +Hc/IJZiDlW+oyYeKZNpze7FKFalC2BzKA2QJDG7sHOHuqN6GA3FpFpw+LnxPTjgX +OOPaBAC16on5pd6AXuC1BoJ/TAJgXlirlRysJQbcRVMBgb3sUouXcg2NvHGheVzd +BEwRRZWH5oSxQW+C/dcJJIzF5je49TgBUzKuKSIdZ7x7fM9mm83lVa9mFVE3DLZ9 +sL7f4QRcefAUdCvwl/9bQq5fx3ZiT2v12FNPkZKfoDpFvKbPrrQuR3JlZ29yeSBU +cnViZXRza295IChHcmlzaGEpIDxncmlzaGFAaXNwb2wuY29tPohdBBMRAgAdBQI7 +6FBJBQkJZgGABQsHCgMEAxUDAgMWAgECF4AACgkQoB28nqh5/PVGIwCfXKn6dGHw +ypchTj31SPs0mG8mmdMAnjmIG097j3WbwlA0cnLkd9cuyYq0uQINBDvoUG4QCADO +YvhOJQ5hYohZJrSrsMZMe49HBdiPnguxa6tVBbXwnJwPgk6ceYliKMhXe76r1cQz +pgqyVSXVqeM+dxlIb8+Oxjm78OcGXlGhRoN/0MdU5yvj05UnPhKX9PE0nfTHhP7P +ROEs1EBfSkKjBFri+pvPw6QS/3wAundM0sO3OcZgrZJhbpaKCwocI+QnVaXjOzPk +vhguMT1jboQH3H4qKHgu13neQ0T6g+29UkN6cr3lj8izTb78htybgKY+btRuF9IT +19yCa598prBka8F3weCTgrYm0D7gNA5Mh93TMvmuQT1xwL7KWrTpDF39mUJjdrs9 +LufCe6dVlCw/fs6Ler+LAAMGB/4ktRdYZB7IGXKzAm3Ga1mhM0uUsMEFnE04npKj +hA9VL2LbyGspHf+LH11SdN1SO3fOBN/6t82zI6/52oX5k5on/Ssa1Gjh86camewk +0DWHmnDSySsRU67ClBlRl0ZFTqVYld8NxzXihXN7OzJSIJQ2clz68iegVOg1zbWD +DhB/Hlysx72UOXLHi/KaXHMlW5A6lAmY61Qf9C0TR9Hcc5BJGimwF+hPNw0kIGw3 +oPYo6VGeFdm6P0LDVElw/gbQxjKW+qy3GYsINGZz2lYlz4H4DJkpW9gGFsM7l10M +/baQqcg9BpBrOE7QTzfFK3GLzrNV+zf8dseRLvLnZ92HYqoKiEwEGBECAAwFAjvo +UG4FCQlmAYAACgkQoB28nqh5/PVs8wCcCsMhi1SacFM1kpsM+JPdT/KN0qwAnA48 +NdqzrIzzrrlvI8FkkZZzKggV +=kwZz +-----END PGP PUBLIC KEY BLOCK----- + + + + +pub 1024D/E76CF6D0 2001-04-09 Stas Bekman +sub 2048g/01611FBE 2001-04-09 + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.0.4 (FreeBSD) +Comment: For info see http://www.gnupg.org + +mQGiBDrSKd8RBADpBhHzpCEB/tWZTNZ0B4oMSMsWBnukkYADPy7ydBUOZHw17ddL +oKj8IOveqkX9Fdl7e32At1cd25kitU2nNXeQWt27C47LfDVR0iPfnVg+YE4jfDDb +rnDAcMKROqjvTTwAuGw8S+m+yqmS2xXsKIBN8A7druhT8R3xg1uBBsueHQCg/ytA +mFM+SjmUXumdid73ZmyK8Y0EANA2uWUEUVQ7PFipydmy2AWY/ZwYrrh79wLy6hch +zF294PU8Ubx/lqENzZBLNfMTeA9l8mbc1jF+up1IBpG/0DRGiCDtWLBDjTGorIFo +ow2zkUKK603x+qpdXV0ghxBkb8KalUQrFAh4fr4gSdnvLhLP70C6hS6g3MbJYNHf +v78kA/9u9y05+tZyNTzeeEcFWXTJX4t2GT4G3J+85fjpxiO21bjNg/I3kUxEyIDc +sjsr0G0yfbSIdAKK88BC/YlRR9WfYKwd8vvH9VUyroYgo8ufFYvhhBZZwP+FWw60 +mvY5EWLPk5g7rwT8Fqrg5y8rVSXTsZs/baesQPqkhFLXT+g5TrQdU3RhcyBCZWtt +YW4gPHN0YXNAc3Rhc29uLm9yZz6ISwQQEQIACwUCOtIp3wQLAwECAAoJEMyy60bn +bPbQnXQAnj8fmeXLyodcHPASyt376IUzsar4AKC98XkNtS8gl4AfCCfOUkGNrh59 +B4icBBABAQAGBQI60Z9MAAoJEFMHR+Yj6eq1eLsD/inQzkDNOsCDEbOF9calmv/C +QkRZps0kLKEnxk9bS3SnwYZN3PbtZDNh4ImrrZ/xqBdkOds95jZm5Mo4mJUTzpX0 +gK2gEhajjeWUdQ4k0QZ7pb722DQ69PMJReNZQQkcV+rY3SaRLugeDUIzpexvcO1w +i4lKffrvJNVN0I/Yim4UiEYEEBECAAYFAjtSGwoACgkQVZHiwGZkwHhcpgCeNoZu +zqc9rVB62+Igb4pu6l65Bu8AniM2tGWqq6tFGLqvYtA7DC0mlFfhiEYEEBECAAYF +AjtXsjcACgkQyzKhB4jDpaXnwwCfSUCu5OKxMNtHZWQwv2HMt/DlgFYAnjoAbCqy +96V/aY/0rHMhPWlhd4SJuQINBDrSKd8QCAD2Qle3CH8IF3KiutapQvMF6PlTETlP +tvFuuUs4INoBp1ajFOmPQFXz0AfGy0OplK33TGSGSfgMg71l6RfUodNQ+PVZX9x2 +Uk89PY3bzpnhV5JZzf24rnRPxfx2vIPFRzBhznzJZv8V+bv9kV7HAarTW56NoKVy +OtQa8L9GAFgr5fSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY7288kjwEPw +pVsYjY67VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy1obEAxnI +Byl6ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XpMgs7AAICB/47 +TeZ/O+z41M9MMI2/4aKBqbfIWNzcWl+71KZwPymTQO5F+WR9fSlS+qTNz+h3gi+l +bAEQ4dI2d+tUZX6q5cszNn/60ffxUbEqa3uBIkOaE+ZuoFSM4I/3IWlZqH7q2x3N +Q/oQgthLOU7c8HnCv3hHL4a1nsvVZze7zT4Rasb07+kGydlYpkoVhFEp012s0PJT +vDHG062vs0sx9HmknX6Nu1y91UQCFE7GVfkixk991s/7qHbKNW3u7FC1F0WrwMDa +Sgp27uJmn8E+tFrb8mpLqvJko2852EL9xKWGDDUqI/sRtZtuxdTcqsLBRyGJqxFy +0yA+GHeueqiS5YeEX1Z1iD8DBRg60infzLLrRuds9tARAvtZAJ9YzzyCiEYU/s9p +NVbVevC9/OkwYQCg5fViSXktQM035ki0W14ocNEpXdI= +=oamg +-----END PGP PUBLIC KEY BLOCK----- + + + +pub 1024D/42721F00 2004-01-17 Paul Querna + Key fingerprint = 39F6 691A 0ECF 0C50 E8BB 849C F788 75F6 4272 1F00 + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.2.4 (Darwin) + +mQGiBEAJtaERBACrYSun+13XY5xobkfAojSZXeYiLCGrqpRQJiRbSQCQEFIhCqTp +5Q3q5wcHFqx9da3EpF9Dl9yw7BP/R1nvWw68/eGKMusjyvjF9vVKFFCnaB0YwWuh +tViq/+OVnVrkPKNtpkBcg4Rl14tEKqOVRAMX+GaPLZTb0J4/rSfqWMitVwCg0ZfQ +pHJRuYqQDMUlWlg5kdMAxl0EAIGHa1q5fx81qd4jOd39C9ujkSak0GTlTWQptvMM +LrUbbC0YCYKydKK00QG5sW/oSZd0emdn/0ITaM3v7Pe/JqinaUitIBeyIrLIYKFC +TIArG7mqCJWHmGXhG0wkI53T/yE0ErkgDMN4U3jTD2ZcbV+UXqygHAtR3qM+uIsJ +H/hYA/wMj3cOKwMBWfac3i/mrnJVdOXMaXzLrB6EjISWRhQrrlKVBsgqkPEdKwYb +S1hieaoeZ0UIt2T72Un/KUZinBYYGZAzXSFQNNqiyvy1v5WeVMjaEHOHHWLbqzX5 +3ycf4o9B802MIBS6F0UGpCAEnakZzT+2GG0B/z8RTF6eHpRBv7QbUGF1bCBRdWVy +bmEgPGNoaXBAY3lhbi5jb20+iF4EExECAB4FAkDwYsgCGwMGCwkIBwMCAxUCAwMW +AgECHgECF4AACgkQ94h19kJyHwA1pwCfYThV8T/7hCKtGOBUgVABymqtER8An1Dq +UrHIVDhb8JkD/pXxjf1g5pVWiEYEEhECAAYFAkGjAIEACgkQB2FzsZKExFLdCwCf +bxMTetsoC3REjFbIGddDZQOICUkAoIY9m2AOUZmx21CniAK4ihNq1As8iEYEEhEC +AAYFAkG6O+IACgkQAQVmvOQTY5JrygCgiW8vzmmKQ3lbIRUpHyQ1D9vubdYAniuO +5P3M5v2glVmplF2kma3lu9SriEYEExECAAYFAkGaiAcACgkQMJF5cimLx9ADZwCf +WWqyc5FAe+exeZeuOzL+F2Zj4bMAoLVY32mEOzifj3gRU84v7Wm2HxAMiEYEExEC +AAYFAkGaug8ACgkQW5aAEOBPmomgLwCghP2fgryoG0IqPtp9NHWIuecwhqYAn1M+ +VmigV5yC/PXqZXhxCUX8YTZUiEYEExECAAYFAkGiWNwACgkQBJfVkRK/55qYPACf +SReNPV+c0HhjCPgRT9/oZLw/E0UAn3uz9WHSWqxBrmvpoAXUFlBGqYZeiEYEExEC +AAYFAkGjS4kACgkQ3bpkuiwxLS+jzwCfeziDXPZWK2KIhNEYW9XnBxfRzPsAoNXw +LWYxPgO35kBQ8KTvoJbta0HTiEYEExECAAYFAkGjS5IACgkQUI6uxTAtpWj2PgCf +buJ0M+q0RjVJFZ9FsttqXzCYr8EAn0/J280RJzAAvGARJkRztdZmkC+XiEYEExEC +AAYFAkGkL9MACgkQF2rZyNGqiWKJtgCgkf0628uDGiANtRsnVqTC2T0ZXbkAoIVp +cBe1RZIrVZ3I/d1ZM07u8Rm1iEYEExECAAYFAkGrePsACgkQzgGkfhxD2FBqPgCg +mtjV6A54A0n+cWj5QNXhNoUKLGwAn3FXjBUNPsEDliW9cWBYS6ceRF1FiJwEEwEB +AAYFAkGjTT0ACgkQms08wKmfdd2zFgQAwloFiGEZ4n+WrOMzzT9eued90SSVW42c +6JyJA+nChSaGtT50XBxXDHxWtr3rtleQn/MqnFpFdi+LMCREJzc3Og3V86M+ndj/ +6xftMyig0VW0lC8FvDu9WSso4ny3MZt2vUmOqUBH7ConCFIhjEdjS4dCuq1+RhmH +o+R7TDImU9eInAQTAQIABgUCQZmBbgAKCRAxpj2W7BQLgafeBACXLa0nkaexTqjG +EhG/kksIC3TXR6IiH4i+VcTzuMEuv+T7uDrdhZjc7jroeLWWl5XyLCASyhI6LP/3 +lrK+UdO3AnNA+PDuzVYqaC4dDMj9kdDbEzKYcrVPbKymuTVzR4l+XSgWz5kOyoDW +Nsqk6VxuK+/KdnuXdZ8K938HVBuIZYhGBBIRAgAGBQJB4sieAAoJEEzETQAR34fp +yXIAnj1YBCHiGmdN6GjkM4oTyvVRWhluAJ9yWdPGw5wrlsRtAl9WHVqnZ3iPMIhG +BBMRAgAGBQJBzqlGAAoJEME58VMjy3oqkFIAnRXkYqT6dfMckUaBZNCi+V9zi4kr +AJ9qKT38Kfs36TFRt/WxmFZLysz7D7QiUGF1bCBRdWVybmEgPGNoaXBAZm9yY2Ut +ZWxpdGUuY29tPohgBBMRAgAhAhsDBgsJCAcDAgMVAgMDFgIBAh4BAheABQJA8Gcf +AhkBAAoJEPeIdfZCch8Au7UAlRmVWI3GpMbVSxFf1w/jj5I3S6MAnRfzZ8URA5C6 +pzb5X+WecPVrON+TiEYEEBECAAYFAkGeEXoACgkQJ0aiJIc88a3YbACgmixFO0rw +BdROgUtYIUlYBLxucQUAoOb2Ki8PKEQlMl+gpaP4qwy+3E5kiEYEEhECAAYFAkGj +AIEACgkQB2FzsZKExFI/XQCfViYZu5AcqGa3aZynBgUAd9A8ekUAn2skGwDzd3Jl +y14qCWF+qCNyyej/iEYEEhECAAYFAkG6O+EACgkQAQVmvOQTY5KaCwCfUwLt98Pq +aVgks/658RVhhlUNqLoAn2RyNQ9njp0HEc0cjeowpU5s4BumiEYEExECAAYFAkGa +iAYACgkQMJF5cimLx9AjeQCfSWiedjEzebbt7il5PXHgvJx40pwAn1bbP6iVk7yv +3nM3xKTtD1mHWzr+iEYEExECAAYFAkGaugsACgkQW5aAEOBPmomvzACfY2Jx3c5a +GKEdKJBazjboun4g97cAn3RbDFtb8MDJe5bQVQ3X/vysdAQ8iEYEExECAAYFAkGi +WNkACgkQBJfVkRK/55qh1gCfYVBinwZQBDLLWdOhFf9wYWcqEU0An0k9HWExIUFF +3uItQ+K9Z7C3NGuqiEYEExECAAYFAkGjS48ACgkQ3bpkuiwxLS9JqACgrZy8c176 +z1zxMnKVgiLZ1xjjaI4AoLeLarplmadavnMPcGhF+TXH4Q2GiEYEExECAAYFAkGj +S5gACgkQUI6uxTAtpWhjFQCeMEJH780DFHpbXWSyOvs29cYuPFgAoLmUNcUQbx0c +iinkYFD8VdeReHodiEYEExECAAYFAkGkL9IACgkQF2rZyNGqiWJ1UQCgs3YJAx0P +6pinCMhzunuIJTVBbRsAoLfF0lN2LW6Cy6mHBMIG0YB9Y0zSiEYEExECAAYFAkGr +ePUACgkQzgGkfhxD2FBueACfdLtQ1wegmW1s934n4tDQH0dfpnAAoJbdfKwLrDNC +agh6BwGF+Kd5hJKDiEYEExECAAYFAkG+MhkACgkQ6DAYSBao06uOFQCeNpMgvhNE +MqsT3UWkDBjau2vTYcgAnRp3f65Wls0+Af794qZa9TtJFnqliF4EExECAB4FAkAJ +taECGwMGCwkIBwMCAxUCAwMWAgECHgECF4AACgkQ94h19kJyHwD4kQCeO13BXjGC +MLvj7PxuXmav149yFccAoMb8DRP1u4pTz2aE38nKCHtO4kwGiJwEEwEBAAYFAkGj +TUIACgkQms08wKmfdd2aBgP7Bs3M4QnfAXFNf3pnWEIPhlS9JVsShwZEBe7U3saH +6vLdGUTOqxU7fT7nohhGV+XDCAHpWLBI/odavlQguZiTYQf/RHaSxdtoXUuwSpvt +NlFgYdp6ex/B2llg5Qof18LMHy1R5A9lm7M2Av+DDhi1ErYV59S59SryCU0PeREN +KoKInAQTAQIABgUCQZmBbAAKCRAxpj2W7BQLgS6bA/9Ds417wgIpgS6frkCtyKAu +otIL7JQ1Lqsbv4+CZeqi52ERxzGqryxBWx9YY58bwv+px9dOOnm33zesf4hx/IVr +nD82bnrmdA1qWqXPPfLAwYdKh98gWPnYkhH9RCrYnudCTFjNezS5+xRENQyYX1qT +UlAE+x2nffKxnLJ2845gTYhGBBIRAgAGBQJB4sihAAoJEEzETQAR34fp/cYAniEX +EYhEkx0osaS407/sVzK1CAd/AJwJW0ZL0nAyjjsqpgOM0ba3IpKxg4hGBBMRAgAG +BQJBzqlKAAoJEME58VMjy3oqDZkAn0Dulg3UtHdiI5EaABr9C5rN9lsnAJwIkeGz +T+S6kfIkuSH9/Nafyd6r97QgUGF1bCBRdWVybmEgPHBxdWVybmFAYXBhY2hlLm9y +Zz6IXgQTEQIAHgUCQPBidAIbAwYLCQgHAwIDFQIDAxYCAQIeAQIXgAAKCRD3iHX2 +QnIfAFiFAKCVt9mEsKqCe4o1K1HmOAT4OmdiOgCgnCr58C1CTeBYMjzgiLteqSl4 +Bx+IRgQSEQIABgUCQaMAgQAKCRAHYXOxkoTEUit6AJ9sVkHFsNXow160c1h70DYF +nMduxQCcDdNa8lNoauvnKBq6Jv7B9JBaKEWIRgQSEQIABgUCQbo74gAKCRABBWa8 +5BNjkiZQAJ45YgPe6LiBIyGPI3LFsLPPaHp62QCfc6UHkdWCgsvHg8GhjSD5wwHX +UHuIRgQTEQIABgUCQZqIBwAKCRAwkXlyKYvH0NHwAJ946lD+sO4+bWSWVG7fGtgN +f3B32wCfRTezxng6aLluB/QWspObQEpvfXiIRgQTEQIABgUCQZq6DwAKCRBbloAQ +4E+aiVMeAJ9o25E+6sOTxI4KxYfPLfHgip/QEwCeMTzPbYVlryWT2px1syjvjXkd +tEWIRgQTEQIABgUCQaJY3AAKCRAEl9WREr/nmrG8AKDGq14Su7iLDYm5Z7/4LJSU +8/MF1gCePdaPGg0vmnWonKZJApyEEuwvDJOIRgQTEQIABgUCQaNLjwAKCRDdumS6 +LDEtLzrTAJ9aq2KOnzSclCF1BBuF9tE6Ykwi7wCfWOrw/mBKr0tolIcQ5esUinIB +RkSIRgQTEQIABgUCQaNLmAAKCRBQjq7FMC2laG3NAKCkzGOfXP+ONhWD0oAvIhjN +AccyVwCeKlQjucbMdl7uEkWrf1Gya8pThu6IRgQTEQIABgUCQaQv0wAKCRAXatnI +0aqJYpemAJ9GdLeZi96/h6Jg68z2ZDeSc53g3wCeJo7A6QuCXXM/rcmfJqCEbB5A +0G2IRgQTEQIABgUCQat4+wAKCRDOAaR+HEPYUPLQAKDAMgt9qlL55JIRygMXhdiw +kJD0TQCfQlGUyCYz4I3IYVbgpWtf4uq4KDyInAQTAQEABgUCQaNNQgAKCRCazTzA +qZ913fUWA/49r5W+Y5V4RRWGWgaXd8JLAQ2yu88qZsIam35F997tRS1uqZOoEWds +6r6F9XVXwOUt2xsZSe34+jRfKWAXZdcmTyMIMTInhCcmukPCzEcRRLd3PBgIBPDM +vMgGGLKjDjjh5QZ/IpYdiVKaiY1IN92OLm6sKXh3SeXAjWlt1fK1d4icBBMBAgAG +BQJBmYFuAAoJEDGmPZbsFAuBxiQD/R9audVADYECPnTSp+YZJeB+LSDh84FGrWRm +61yKp2qGIorhhzf1zZ77QMS45Zy3hEct4Bx6/YSpieL2PPzMKhag+6LNY2W46QYN +k+d9v+ru3MMSHYoNfIqo70GOV6zad4fUMYywtYhDEalyMyPB3pP8jrmHt8m5ahws +sfJKn3fQiEYEEhECAAYFAkHiyKIACgkQTMRNABHfh+k6TQCeJk1afbGzsIN/doC0 +0HvYiHCmk7oAnRd4SefB12lqKxB7+rOETvWu5pqRiEYEExECAAYFAkHOqUoACgkQ +wTnxUyPLeirbGQCbBQL/YdNEhAR+QojUCsGLg46B89QAmQF109O9TS5Eqrn9+C5f +3bck6qbEtCBQYXVsIFF1ZXJuYSA8Y2hpcEBjb3JlbGFuZHMuY29tPoheBBMRAgAe +BQJA8GKZAhsDBgsJCAcDAgMVAgMDFgIBAh4BAheAAAoJEPeIdfZCch8Ak0UAnjpl +plE4Mw3PM3j9nSHOoXrzzglPAJ42khRlgk6TMfnUTU41h1FXA51bCohGBBIRAgAG +BQJBowCBAAoJEAdhc7GShMRSXd4Anivb6tq25jFqiaoFJmqkNoi3/vdCAJ40ZK68 +cP0Q6ib2yiOWdjlmftGXXYhGBBIRAgAGBQJBujviAAoJEAEFZrzkE2OSFoAAn3Wb +daZJ0raIS5NIOQcrca8sELZdAJ9y3+9st6AXjDXSRsghu59Zg3zfQYhGBBMRAgAG +BQJBmogHAAoJEDCReXIpi8fQl3IAn24VtuU4CYAkDfSJhPRPbdwXC9oYAJ9KSvz3 +7QG2mZnimcoopCQy2g1z9YhGBBMRAgAGBQJBmroPAAoJEFuWgBDgT5qJhogAnRL0 +IF9/2Exe712BeoVWPK5eBSi2AJoDzWCbp7wr1nALbPllkqApkll2S4hGBBMRAgAG +BQJBoljcAAoJEASX1ZESv+eashwAoIwuyzeeGal/ZWkKIxBbordqIl6bAKCj4iFg +Kya4SFt/bd5ZKBzWWv16AohGBBMRAgAGBQJBo0uPAAoJEN26ZLosMS0vJroAnjeL +RzjPkxFDmABQPshdkftFzAoXAKD7qaB4eHmYqZyDZ4n4dLpukmer44hGBBMRAgAG +BQJBo0uYAAoJEFCOrsUwLaVoLuIAn2deIMzEBk9KTdIITM5cBUiPccGBAJ9PguKy +15iLmZE1EduTLoY750KnTYhGBBMRAgAGBQJBpC/TAAoJEBdq2cjRqoliyFIAn0Ar +xe90GYJrXOPsan0RbBWfrIzYAKCku4aJi4Fy9OweqRet0wzeyYzEE4hGBBMRAgAG +BQJBq3j7AAoJEM4BpH4cQ9hQD4wAoLgEBvKXRJbdgpHKAynebPFc7+xTAKDCie3Y +g9nTInyAkBR+woMlo8IP4oicBBMBAQAGBQJBo01CAAoJEJrNPMCpn3XdiXwD/1O4 +ya08P1YxIYn7owU2DFVj65++T97WO+yOvkZnPuT88anrx2lci915sXAQYZh1o4Qx +HIsterJrJB31p3iokJzQxMt6K6HMzITDdNh4mvGoNAaSNurqhIeqmk2UpuLuDe1f +gART4fCmgMxglgIlMBI6UyhP0RhzHx+qePRHxf4hiJwEEwECAAYFAkGZgW4ACgkQ +MaY9luwUC4HNuQP/cQUltjk6iJq10+NLv97/vw7+eij/z8kBwfe7przIchSoApFa +ADyVDuIMmZcSU/PbwlPRebESQrQ84q6jHqpG3ZMhvIT0EEOWmS+8Ga1FhwqXjNrY +AsNlAFa/tfUPAPTj2M7kTt3Dq4UD2xXywY9Rja3Q+khSttGqQGEq+qB6a4eIRgQS +EQIABgUCQeLIogAKCRBMxE0AEd+H6ZS7AJ94jbsCZKDncSb/JktR+O3R6XjmLQCf +W8zLP/1780h7U+SeGZRx1K2uNDqIRgQTEQIABgUCQc6pSgAKCRDBOfFTI8t6KlUH +AJwOQx8xEJeGwce+D3DtawU+uf/JdQCeIIL5AT7+oEK1IzZDN7klXB/4zii5Ag0E +QAm1shAIALfqB4jeQyzKfybVkA8PksS9yD4hmjaYIo6XaQ6GAJsgYOVcWINPzcHt +2rjQNxScSjkNApTxttpgRRVP2s8RCR9Vkn8S2t76SKm85mgmuTT3iVNjyIbtQEqQ +cpN7LDJAq2LbGIDt1fdvmhkI2gNNqnbWMsAxsJkws3r0JHsCxD8jraXKvBQ83tFT +Kqi9ZeQ1nW4dc5s1/p40OLrsq3ww23CfnP9Oxp+8rvggWyE1Rr4xb6hnYN7mSLNe +u6xlycRopG12Rkvh5QLrKNr7D/GV1j6IGTqh4aRm+z9o/1Wwxz0WkaEyN7uFbQg5 +hscBBHJBKT1Q8evrJpTEUyzA8mrBO6sAAwYH/i2ygbxLRdqgRcjgqaWCkIDwUTJ+ +c6kIQmpPH9RMMpwnbU9kcGENCjhmFVIvbcUk9xBqQgUqSq9a8zZUrwuBauNCOmVX +wruGyIXAYjlUXvxMOpTgEku6PlpKiDhmcv1Wb21dTz020ID5gpAa7s0T82VC3ciG +JmYTiQut/Dz6W1X/vKkPtQ8UEQ7LTkNOyg7ys16FpktXYq/MxAhgQ5rRLqEwIPe1 +sjClgK4Lnzh5o6ue6pa6VAd+Bwpfy9i4yh3+CEgjWjq9DyciR6x6j2de+k0hQW6k +V01gLPtduJnaPo+XWlHMonhKSlsPK10RMuVC901oLZYZSKOwMgpG5EGx2OSISQQY +EQIACQUCQAm1sgIbDAAKCRD3iHX2QnIfAJZLAKCuvcDan/KMsSsAjM/rHTf8G0AK +nQCfbbvCK0fwZcra7ofd1z1Up1+ID94= +=xYye +-----END PGP PUBLIC KEY BLOCK----- + + +pub 1024D/F39B3750 2005-07-14 + Key fingerprint = 29A2 BA84 8177 B738 7827 7FA4 75CA A2A3 F39B 3750 +uid Colm MacCarthaigh +uid Colm MacCarthaigh +uid Colm MacCarthaigh +sub 2048g/2C7157D3 2005-07-14 + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.1 (GNU/Linux) + +mQGiBELW4V8RBACRZw1GIal1EKcPqtPyTAEtvtSQqv/ZLj3l9ne9kNHFgp52TyRp +vV1JRwrlptNhClkBFD2/o6OAOvR2YcDvWXkoNGIlbgrsRaU9H9l7ZVFU5titPj+s +69hHn2aGox8mpWay0jfRLpNiA+hxHpo9Txh30Yzsian0+vCm2cr6H/IkswCg68o5 +MB/AahASaRJBBDS0kFOjWssEAIFEq0yBFbRljS4Ia43IKiIYCsMTesNAvpaoHLMI +ARvgEkLxXYQr9ZPjIxTPVXzKIuM7sE7Q0JkOa1ACkI3UM61dRaZ8CTHCt4zIOGMN +WP8FCUgFyu1/DMIcgFo86x1jM5YNdz09wezqvhpYwf0rAdTCyk3Jz57Wx9iJyX8L +JYAeBACRXYr7D6/xwE6nnVHebuUI20uM3UqAVfELKfEju0A5iiqFu42qXTHYpvds +AdA7bC8YEWQLK35q9v5Kyrp6IrMVJJlo3701Kjpoqn+Wqo0dKsG3devB4jIN53lJ +Bglx3Woxo7pPAoeHyPMxxZbPpeox+0cfj4SAh+sECdUgTq0nQ7QjQ29sbSBNYWND +YXJ0aGFpZ2ggPGNvbG1AYXBhY2hlLm9yZz6IXgQTEQIAHgUCQyCIgwIbAwYLCQgH +AwIDFQIDAxYCAQIeAQIXgAAKCRB1yqKj85s3UNOyAKCOR2bfAWqBqP9AlRb3VXvU +9CJcQACg34GFUHLb79GWPAq1eq2Q/rkWWbyIRgQQEQIABgUCQyCPUQAKCRDAyIND +MMiiiOhAAKCXDn/0uoJ8kEbOzf5biPYnU8qKWwCglSSuY/6TfRfuVpBK+v5U+/F/ +pOqIRgQTEQIABgUCQyCXyAAKCRBc/Tf6zHjIk37oAKDs8rL+BAWNpg1AH8H7QCPE +Z71AvgCfUZFeA6Lny8eSTLHp8xfCeKR+lz+IRgQTEQIABgUCQyTKEwAKCRCKB01M +P37h8sjtAJ9oNlVkhM8eC1iZ63mOWk88RWp0fgCfVZJxv4U951SfwAN5JNUEJndZ +wUWIRgQTEQIABgUCQyTeJAAKCRDYa/eUZKL/ajBFAJ0W2Lwg8NrYpeaatsOlPM+k +P47JpwCgoDoETU6/KOltBn1aEkN0B5jMzdmIRgQTEQIABgUCQyVXBQAKCRA9ckWS +wp73hyhwAKDYGgg4PwdoozFscPHWpL0Bqd5K8gCeK0+3GoMoyLmdVX/JVRpFLZSP +dW60I0NvbG0gTWFjQ2FydGhhaWdoIDxjb2xtQHN0ZGxpYi5uZXQ+iF4EExECAB4F +AkLW4V8CGwMGCwkIBwMCAxUCAwMWAgECHgECF4AACgkQdcqio/ObN1BDlACdHWGv +tR1w9KrHSUpmQNVx9REVHNUAnA31s2SibQsdJ216/538PMYZgPLuiEYEEBECAAYF +AkLe3ewACgkQymk5dIEDo34hrgCfXMyiE43e4tc7cH16VbWwzdniE/8AoIPKexDT +a4m8vyiDa1GceK4GUyAjiEYEEBECAAYFAkLfTJQACgkQQeoJoFeTSY+H4wCfa7rE +7djok2b+s95HBeF/NwZNPt0AmwZCMbG29o/bofeRUDs2CGGPvbh3iEYEEBECAAYF +AkLfkvAACgkQAQVmvOQTY5I2rACfTY/W7cCeTUU281TxYgQQeNWrYRUAoI8NOyQx +KEQ7kijRdscRjhSR4ui+iEYEEBECAAYFAkLkdwwACgkQjON2uBzUhh+VugCeL6uG +G78nPzFwsP5WhksIYtv/RZwAnjmoEOofv0VZeXlQoSoFUuc/TgVViEYEEBECAAYF +AkLkkh8ACgkQBJE0Quobo42bRgCggRA4xgADvjofITsuFd58PoORq0MAn3CGP0Tf +6tgw4aYDwcc01Ha1JSQDiEYEEBECAAYFAkLlyfMACgkQYRlqLjM+ToS0AwCglahs +pxQ6jze8IEAsweOfPLy28jgAn0vbj101OnrjEsIsuryv440kWY7eiEYEEBECAAYF +AkLqZfMACgkQsr68QBUpJK/9nwCfYeo2Hyjboyba2vC93cAi0VKePnsAnREn2lG1 +4sz6s+O+q3Uwy7is8V7ZiEYEEBECAAYFAkMgj1MACgkQwMiDQzDIoogUXACgkCQV +93N8bGlp/8Pctql/loQU0LEAoJ2sAiDDyPTfmcSYp0eI6tGl03XViEYEEhECAAYF +AkLetSkACgkQi5YpQ/wkPzzHzQCeNsAOFJDT/bJpCEkL91yOyynw4JkAn0ctxG0M +oevrTNSIgAIy0fmWmErKiEYEEhECAAYFAkLhNrAACgkQohFa4V9ri3IFfQCcCr4X +XeFigTwF2F2WhBNIslhVY4EAnRF6/HIFGofC/wvrl72tQnwUIo7PiJwEEwECAAYF +AkLerMUACgkQMaY9luwUC4EqDgP+MSHyBB9UmfjFQtrveCJJg8fxhUiiuX6f3/jP +/TeeI9RHRVFLTR2j2ZK/OOjtUAZo9WC0XYNd/Uh/aVhqrxfFI/J9M90Iarsi1zAj +Vj4sqjDIPW4ucvP5E21mscTKP+Jdcn3OBU46OXHppbRZhhqgWVN6DcPudgozQ71T +hyZ/noqInAQTAQIABgUCQt7IeQAKCRA34/Rf7mXjIcqqBADerPaJID4FtbTgR3WB +fsGV9TPMCLl3GBI+u+G0dJghrS3HsYzysBI9ZSTfsaxhK/5BtlbiHelv7xReyzZB +R3LppWQuwILQWYI+PHbnVfQu8VbBS5th2V/JTdEwU5Udj4e4yUSEIEJJDyVMWVu4 +TuWCxfdGxyzvyrZC1UaqFhWunIicBBMBAgAGBQJC320vAAoJEJrNPMCpn3XdX8sD +/2eBp9JWolVXYnm55sQXrwkin0jr7mDWa5ms755RGXJHjIaEpBHt9KDKknFpRv4v +5lWQhsJQ3XjVhGGnwI360Zut0W+8Jtx9WS4UOLeWQwSbLa2miyNlbY1Dl0Lc7mri +PTfp/aIk6PQrwlR9KR3X44eRphk2lX0pCalvNefEVXg9iEYEExECAAYFAkLesT0A +CgkQ/W+IxiHQpxsbfQCfSBKiIFQAZ3ms+jdifoew4LjuRE4An3FqSIfHdjT7QS/G +SteEDyEi/+35iEYEExECAAYFAkLeu4IACgkQMsnkzjZCy0vSuwCcDdk8GhXVselq +w1P6KfIGB46paI8AoNODV1J8WOivefexZF132lBYbGc9iEYEExECAAYFAkLe2eIA +CgkQ7tHqOSJh0HOcxACfQIaSKmPV6ul9JL7Tw6bZV6LoZ1IAnR/1dq5qI6L/XY5w +3/hy8rNzLjNGiEYEExECAAYFAkLfbTAACgkQUI6uxTAtpWiQkgCglhRN4h56a2NX +4PubTaTpt4s+cFEAn2zOK6T9rlGYd5QFynZj0k1GuO9aiEYEExECAAYFAkLfbTIA +CgkQ3bpkuiwxLS/10QCg+3rbZys4iQ4vW4qS6R2yJNlrh3IAnj2tyMmRrsEtW+bN +OvUrJY4gL1bRiEYEExECAAYFAkLg7QYACgkQybWm7OLXdN+EdACgrgKHTCgj307w +0FOioXe9uPEbU+4AnjM4lBi94Nm84BgE6esZDvXbVOfSiEYEExECAAYFAkLg7aQA +CgkQN/aP9QFa/IpM0QCgowfVv1Z98utS0tXToJL6zS1KYiQAnAqdbSAtRxK8xpnr +vc9LnpsukMF0iEYEExECAAYFAkLg78MACgkQW5aAEOBPmolTvACfWWiuidASBspI +UeoZysIMfcXSDKEAn2gdALzsW+uvVT4LKNeKzsbzIs/TiEYEExECAAYFAkLiYsYA +CgkQbZiNF4cxXDEgIQCghR7mWPIoOJv5sZn2YB+iKKKQUPkAoPLQlPiDgZM0L66w +7KFMcPuSlj2IiEYEExECAAYFAkLjWt4ACgkQEy5J1OQe3H7SgQCgg+1G28fkCt2K +Npsdcv3hKRY9wkkAoKMdsQHQQl9LeSQtxmnVoWgtSWXliEYEExECAAYFAkLjuE4A +CgkQbQvHOkBYGDcQmgCfcaUPfWx3tzbMhgPIaxnC+2+4GGgAn3UmWcL4y6CuafGo +TVEJ3pnbaHCBiEYEExECAAYFAkLj7ckACgkQMoZOQZyFIisAbwCfR8Gv59/k1CNl +ThPvjfqOA9v7zpIAoIlyWt6VamIUF6V1DJkUsLdMUiFliEYEExECAAYFAkLlEN0A +CgkQUnkvr5l4r4aw2ACg4PcNmqWg0tmU78SCYb5sft9arAUAoKlzLyVwbgx8o+sV +xooCVLbq5Pn1iEYEExECAAYFAkLlEcoACgkQa3OhBipiP3LtPACeNNzQK6+M7+iW +GRoa/3x91WTXupMAnjppF3NKvRFM1bPBuPHkMQrlZ3L5iEYEExECAAYFAkLmmagA +CgkQaOuMdvjqKWeCIQCePj1/DGvnWdsE8vVH6LYIIBCmQDIAoI9KyCTP31ETSRBO ++dkitssPvMO1iEYEExECAAYFAkLnYYsACgkQbpR1lMFSQxqbcACfS19GZMulB7qB +5QvGKpFncsHE4i8AnAgs0jgBO4sWj987Wkm9xKb+6lF8iEYEExECAAYFAkMgl8gA +CgkQXP03+sx4yJMg6QCgsjBgLZbMkacGPnXJQmR9OxPtUU4AoNusKhziIkJWlHWa +uz8H9NuNp51riEYEExECAAYFAkMkyhMACgkQigdNTD9+4fIOkQCfSerkxohvKdRG +uBh6/BbhoRyYY8oAoIdSEiSASDsllD6ABxpmFaLD0VjXiEYEExECAAYFAkMk3iQA +CgkQ2Gv3lGSi/2r8rwCePvkHpYFFVmwaoyxDiWyAJIuO/ZkAoIfEGl2o1seOiM8Y +pNIwqANE8Gt6iEYEExECAAYFAkMlVwUACgkQPXJFksKe94fKugCfSGLdAfgTPYNP +JIddiYbExRj4tusAoNsqjlS7j0FiwuLxn2KhU0XdNR9otC9Db2xtIE1hY0NhcnRo +YWlnaCA8Y29sbS5tYWNjYXJ0aGFpZ2hAaGVhbmV0LmllPoheBBMRAgAeBQJDIJFV +AhsDBgsJCAcDAgMVAgMDFgIBAh4BAheAAAoJEHXKoqPzmzdQdvoAnRX9Td7jsxuJ +tPtZTUuSzFP8ayWOAKDPnEXHSMWf83yGbYmYbjd1k6AVGYhGBBMRAgAGBQJDIJfB +AAoJEFz9N/rMeMiTMNQAoO26cgCXNIHA1BXzt1Gc1YMx//urAJ4p9quyQ/0qhf5t +A9FGXGX4nqYbc4hGBBMRAgAGBQJDJMoPAAoJEIoHTUw/fuHySjQAoIby3eTBkcvq +Cvl2NWPrQJxPubd/AJ0QlXBRAJBycD6Hgf2Y1bcneLGKE4hGBBMRAgAGBQJDJN4h +AAoJENhr95Rkov9qAwAAoNVYqqIIF2uvZSD4eKScYFb6u7n1AKDKFRSOjSeRHVXz +GUd3UbUB+xny1IhGBBMRAgAGBQJDJVb6AAoJED1yRZLCnveHWC8AniAJhbJpdSR6 +lIzSkPbvJLRwdH5TAKDQ4aoyMe7914J9MgnkcVBraBhJj7kCDQRC1uF9EAgAgaod +PcwlIct4wWAHDxe413Bgw6/v/kNp4Q0nbnLwQ++gsN3sCkK0O6qASsed+Ffsjhn2 +VEjAF03RT2T8Ir7AuA++EuWuAphBDTZLF/ARszSnYWEz3cELsuuqj1yXl4Gc3mj6 +1vDmST7g3iPxNbWGZNf0jinD1ycRYd+ZSs+5yQzOt6g2VtAE8DneL4M0o+tXZXlv +Rl67PlrYbRIE81VYTm2C+k3eF0PWsdDyL8lPmV6ryIjvDK/EKLGynIQN2yWASzqZ +Ql9mJGdwHKXMNxG5R0AQc0auJjk47sCj8ktP8+k6MPy2y2ZGv0PtSNSogROwMvJp +MpqWoMtZdmrkXuGn9wADBQf/QAbCM0qCv6ogLmfsyyBubl42DkB8vMgRYoY0/kQW +3qKBnIsCHhuQfYRX9oV+LVtq7vNd1NQe0HFMW3ZxOLA7e0lVPf2vJUWGG2wBWHOs +2BxnS/691KUeB7NUA3MeiqaiPW5IM1+pWT5+/Ps9mJXnSHYYqaJdDHSiKeAvEYRz +qGlwn1KpopIhtLZRMwio1ez5aNAQ6otD0vHFit3X+SCkl6+1+tvEfPTupUpbjBsG +3geL3D1csPC45KsMCE7zwqAnXiVTYCGXumFEBS6b4bfh2uM8fZP2Sy0xEP0nxzmD +mK5ERs8R3rshRHFZiil/qtqlMfucZER4XxWZidEoath1xYhJBBgRAgAJBQJC1uF9 +AhsMAAoJEHXKoqPzmzdQTTsAnRwKwOe+n2LgPgqAReIqMvbIHUxEAKDbuZIzxAtk +Wq8UfA31IsLnxfIOGQ== +=95yW +-----END PGP PUBLIC KEY BLOCK----- + + +pub 1024D/311A3DE5 2005-10-02 + Key fingerprint = 120A 8667 241A EDD4 A78B 4610 4C04 2818 311A 3DE5 +uid Ruediger Pluem +sig 3 311A3DE5 2009-08-12 Ruediger Pluem +sig 3 311A3DE5 2005-10-02 Ruediger Pluem +sub 2048g/A21CD598 2005-10-02 +sig 311A3DE5 2005-10-02 Ruediger Pluem +sub 4096R/5185BA1C 2009-08-12 +sig 311A3DE5 2009-08-12 Ruediger Pluem +sub 4096g/3B3BAB8F 2009-08-12 +sig 311A3DE5 2009-08-12 Ruediger Pluem + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.5 (GNU/Linux) + +mQGiBEM/yAsRBACVZVt6oK9fpc9B/7vPny00aHnuhDQ0MsM5rbEGZ57aBnmHYyX0 +gTKLWGBXhlkos0hxBBIc9UUbOmaVBp4VFu0rz8IQ2OUZ93J7lR/khRG3wlmYx25Z +CcN0tOFmiZuyV+J9zNP/dBdBfUqDwcJD8zmA7u8NLeUWljJJdKv8wcZ2/wCgwN+/ +PWz58JCvsvphQT1QjzP8a6UD/3DsCYMq0m2dOi3YXxtHpeF2Kn+k4BXnFt5dkPsd +O2MN5m66Ky3MndeIPj81Bw9ssc9zZGcP2PHej9mZPjKDQaJn0GkHem2sVQ5uDcbG +JCy7UKjgLqBl/AAJs3+0KdArvWVxsxBUl6wViAxUytwdsgK1KUA3Qyfj7oAM3p4S +iAWlBACVIZO0u3LzAN5halnEcsjWrCdNpvOLB7aopNMYQRm0X2OXgFWRuLa6X4/g +yA/aDZg5xbSBVzC9VwMS3Os1hqwuFW0DuP0PAal1KIRL2dzD/1XIuRBz7N1WgeSq +MqNqjFL8RuTh9jHlWOnHKd7GOitJazv2TNgP0KQgRoPKklas97QiUnVlZGlnZXIg +UGx1ZW0gPHJwbHVlbUBhcGFjaGUub3JnPoheBBMRAgAeAh4BAheABQJKgx+aBQsJ +CAcDBRUKCQgLBRYCAwEAAAoJEEwEKBgxGj3lOlgAoLLpqsZ5MXiNaNgPeaqD+NEF +xzVLAJ9PmcaWHklV/BB2D4BloSt6LVtURohGBBARAgAGBQJEouU2AAoJEJA4TZo1 +x+lCEToAn0oaavCybTxvhrlRfAzUM6OXu7WSAKDgZKHzg9LLLITk9KBU1lNbtW1Y +iohGBBARAgAGBQJEovOrAAoJEPdiuCXvtpTqZBMAnid4GvSulpSWKIetS5tXPpTV +BFwRAJwMKS+OoH2ZrvhFP5BteT85qxbei4icBBABAgAGBQJEqThgAAoJEDfj9F/u +ZeMhN30EAI7VnOAkWSv6uLoznFQYQC4/qAWY3pQzJJeEhEFWGdujc52Pqqlxrp7Y +Ny8XkVNcM8JzZhBwx8ABAv6nGQF+Qov1OOzAZ4jAVd05kd51CAEFoWozIDUUeHoR +Kyh4F02dJC0r3tn45zHIS6FzHxfIKoStrOdwfyreDg+gCZXbvRcCiEYEEBECAAYF +AkSpOFIACgkQMsnkzjZCy0vHfwCgwAxPDq+A5glMd3kLkHJCIViJV8wAn1ne2QjM +37U0E9AVUugkamnqcv0+iEYEEBECAAYFAkSqs3EACgkQNYuqM1D5YRYnlgCfdXa1 +F2wMsCEqR3Wgi/koDqAgXQYAnju0aFixh59qW8a5wkXK7T4BEtJtiEYEEBECAAYF +AkSn0RcACgkQ1TNOdbExPeK/xgCgnEkD7fjmoWo1m3Jq2LFFS1II2BcAoKqNxupM +Dwf9abpHvrApLg1147sPiEYEEBECAAYFAkSqyNgACgkQ+zfaQDMuY83TogCglcjo +XiiKKuSth8WSzZvcUX513bcAn3uPk3VS5+jMKPAAcgt2IPI8qUcBiQEiBBABAgAM +BQJECpypBQMAEnUAAAoJEJcQuJvKV6188n8IALHU0NZRB1aLUCJgHYxtvR3DPH7Y +3lbiScdJMeKBI7JvzUL5sfoglgLJ+BIhJonvWVVnDsFURH90OhCVO8QyRH0Io/e2 +pV0Cq6MXQreIrwin1U3sqI5Z17tIilYzVUguq3NhVB6iO79KyHnYE6mR1vOP6PXO +ZFMbpJHoCpa99ZoTEljSnrW5LAtfeDL0Ha/1pS/GC80mqgC1cANA2kh0FTy07exj +u3f7eA4F6BF4n91YW6MZNohIHNb/E+rhZliJZ0dmm74cOwSYRo4QtOuOsRnfPz0r +cDOsCNO5jbw4ZnAXReijao7HqILV2qt31uLIDyAdrYyIJ0D60sQpHc3FezSInAQQ +AQIABgUCRjoHnwAKCRCazTzAqZ913UkpBACfWnkg8FpqkSY4hVUN+S2lxJP1LrcT +kRAbjJ/ECd+7DagMkrp4qq1nRuTIZ1qni/dgLb1bHCbbQl2XII2zdEMwi5bB5PEQ +ggcjGtEiB5tdsUyYZPnZjh3asQJStQ0rjP2pLARa1DPaYq5PiRJQ/lbjZFsMbaQh +q9ysPPUuo5GHcYhGBBARAgAGBQJGOOKlAAoJEBVFs/7iIt5PBegAoJsY6fMRMVkd +l5wbYRQPWcmvnqEwAJ4zaFXcLgOGzwQwVTakYQICj+W8A4hGBBARAgAGBQJGOOeD +AAoJEGPQra6REgPkOE8AnjTb3rP//+I/WJBLeO194cmB5ZnKAJ0Ug2nG0bxINnga +tODVO3CUh2ggjohGBBARAgAGBQJGOgefAAoJEFCOrsUwLaVo3asAnRW3Crwy/oRg +Kuxh/+5OqjB4bo30AKCqgFXmSuCtuVMf+IBQu28JgBGLyIhGBBARAgAGBQJGOgef +AAoJEN26ZLosMS0v3asAn0RbVVSQy/li97fKim2w81ILLctDAJ4v6OaPJmmAyeXq +tSAsQ1Zm4dIN9ohGBBARAgAGBQJGPJHXAAoJEJhw7/PxL2ByD+UAoIxHuxKNL+pj +PicrmIpKNigqe2XXAJoDHBqC7dGawg2eUsXS2g6+VJ/xWIhGBBMRAgAGBQJGPaBW +AAoJEC65RoKIgXQCSpEAniORwuCyXUKIDFnQOEbAo5CfCnueAKCTw/OrIlakDL6H +ktMcUMjHSPTNMohGBBARAgAGBQJGPhfcAAoJEFQiDSzIdBVc3bYAoITYcorsUW1f +OamHAXMcflZDZEvqAJ9LhDRlZWaa2OGfRGmWrwRAwz1GFYhGBBARAgAGBQJGPhV/ +AAoJED4qb8JfKYgk8yoAn3BNCMpwqdV3LauYt0pTH1Qgvct2AJoCK2zdA5NGT74j +NMqJHQXQysXZlohGBBARAgAGBQJGPdZXAAoJEPXCYBZM7tdfElsAnjSx5Am1oSrn +Q7cUsLN1FPnOuTLsAJoD/T6wr2X08EP1DW8ndgBhGgrVVYhGBBARAgAGBQJGPfS8 +AAoJEKBy1NBDWMWE0SQAn0kYZ4EZRAZd6DdUV3DI05g1ZWQZAJ4k2nO3s5wg1RpU +uujnoG4/WJeaq4hGBBARAgAGBQJGPgWDAAoJEAKlpgULfmz6dsEAoLMOj9qxLNdC +3+bMXicJmUW9ePgSAJ4s13w3tDI6kbd9CLreIp31ICRjFIhGBBMRAgAGBQJGPbGb +AAoJEOHh8rCZDtSqYtEAoIhyMN6rv0nT5gwNLV0c/Fa6+q0gAJ4+pr7oAZRLKtkR +s/X6N33r36pJwohGBBARAgAGBQJGOPZiAAoJEHPdjBYBUwI1E7sAoIU1S8Impr3j +MlGYrnwBamrSAwaEAJ9LAER9Xg6pCTM/1O69g+KaB244cohGBBARAgAGBQJGRhFG +AAoJEKIRWuFfa4tyDJsAoKP5GAZyWTJ4SJpqCnizTk+dF150AJ42/QN+tsYbDVwN +gQGSJl8dcJp+0IhxBBARAgAxBQJGSMVhKhxIZW5uaW5nIFNjaG1pZWRlaGF1c2Vu +IDxocHNAaW50ZXJtZXRhLmRlPgAKCRAyhk5BnIUiK+WwAJ971xK0A2wXxrflodgE +RBMq9/2m/wCfTUHo0b5y/aNj86HZOG+AxPLsM9CIRgQQEQIABgUCRkC1hAAKCRBt +C8c6QFgYN2GnAJ0STXI6kDmBOQwJ7bIDZmVWs7mODQCeNwrDrhMAT0NGVWjhTeHX +VWlFQ6mIRgQQEQIABgUCRkxEPQAKCRAfISPDa9hyoA+nAKDjxtQhZzz/0g6DScIn +Qvh/Dgi2nwCgrmlR69W53euVDo08J3YtidwYkauIRgQQEQIABgUCRkx8lgAKCRAP +RQomYhC/wAY1AJwIYQe+QvKCVFEUHR44HJhG9lThIQCgsHTzbz2rUZ2bFbEM3YpY +hvKiqYeIRgQTEQIABgUCRlKlMQAKCRAD9oy93oiEoO3yAKDbaloGpJocFy1lMQX3 +ynEngTUOZwCgxGiYdithfO8Y8x4iaQWmyDqasl+IRgQQEQIABgUCRlJuCwAKCRAy +wdbvDxQ7wV/+AJ0TbDMo7whcttqwtRIF9arL/aXJhgCgpVFxorts5yIisMXi/eVL +5cUBTPaIRgQQEQIABgUCRlJuGAAKCRDLrr45pGxMoe+2AKC0e9ZZH9qep25JXFab +WEG8UKsG6ACfR4VuOIIPKzBvSf9JuvGpjf7PlDuIqQQQEQIAaQUCRlPKpCAcU2Fu +ZGVyIFRlbW1lIDxzYW5kZXJAdGVtbWUubmV0PiIcU2FuZGVyIFRlbW1lIDxzY3Rl +bW1lQGFwYWNoZS5vcmc+HhxTYW5kZXIgVGVtbWUgPHNhbmRlckBtYWMuY29tPgAK +CRCyvrxAFSkkr5V6AJwNVQSjFWYlRNyc5UB/Ylg1gVeRXQCdHuVvpnO/fxbjB+jw +ILowxjbuFA6IRgQQEQIABgUCRl7VYwAKCRCahtfM0arqYOk8AJ9yFSe3EsBciiRX +xTsXWHxH5aLBZwCgnLDW0bWkjd6CKStV62+Hg2FeNQSIRgQQEQIABgUCRqVKXAAK +CRA5vlGhCEyRE7UjAKCU1AiErvVAmkZ+GeXUKHRfEQz6HwCfdQIV8YVaWBbvRgMl +W1zVYGe91GWIRgQQEQIABgUCRq3MAQAKCRAzzWczr17EUhWfAJ9HbK0CO07DTZkV +Nlnm3CmwOc4MvwCgwXLE1EjDufwxipQfwSPu0JRZioCIRgQSEQIABgUCR/0s+AAK +CRCLlilD/CQ/PDErAJ9VEaLs+nFOJdiQzBZcNyUSVRpeFACfbjqUkvIecDdcI3lO +JgVPjN6RhZKIawQTEQIAKwUCR/0m7iQaaHR0cHM6Ly93d3cuY2FjZXJ0Lm9yZy9j +cHMucGhwI3A1LjIACgkQf1hPnk3Z0cSrogCeOYYQ0/P4O5X9/9d4pFPXa5h04nUA +oJgZVFJ6d4wqBzQLW2FRIkkEifeFiEYEEBECAAYFAkf9xPMACgkQGDgf10sb5phu +xwCggcEsz1tnzCqMNgwGTb8TrMHMZYQAn1muuBraWNZ8cPyDvFs+AzBCDksMiEYE +EBECAAYFAkf99pAACgkQveChm7bpBvP2FACgmGDtfKQC0m9Ub3cwlLh1DMo0deYA +n0IwhPcbQ/DewoJ69ijrYH+9d+whiJwEEAECAAYFAkf+TWkACgkQMaY9luwUC4FX +YQP+NGCaVfHgIKVbeJ6TP45W+1p5mCL08V2AH0wYZ2v8UBgZrdMqCTJilA82FEps +aUQWijC72YASpqwhkjpZk5Fn70WjT96x9Ire4jRR/QvBkitTF4RU1vf4nUrWdgHD +9Gk4FYu9gq6qqyiSPWZq/OHkVGeFY6cM1w2TcTsrVNJDI2CIRgQQEQIABgUCR/31 +aQAKCRD3iHX2QnIfAB0gAKC21tFnvtiBIpqpUbqZw49VdvBEpACgiKtx89FFaxm0 +fEEu74aPz3fToTGIRgQQEQIABgUCR/5OywAKCRD9b4jGIdCnG9nvAJ9G8sOnzViU +EdTJGeZzBeqrc5voyQCfa+wT8YN6a+Ep2B3rDtWs9d44EI2IRgQTEQIABgUCR/4L +qwAKCRCBLyCFwtUL+w7SAJ0fMVEcuUltW+XJ0GCo4oWiqBcNDwCcC/pnKkKvrEWE +3v6hUXEwHx0ZYZOIygQQEQIAigUCSAN5GR8cSmltIEphZ2llbHNraSA8amltQGFw +YWNoZS5vcmc+IBxKaW0gSmFnaWVsc2tpIDxqaW1AamFndU5FVC5jb20+HxxKaW0g +SmFnaWVsc2tpIDxqaW1AamltamFnLmNvbT4iHEppbSBKYWdpZWxza2kgPGppbWpA +Y292YWxlbnQubmV0PgAKCRCLOmAfCMl15Ul6AKCiNufW+YV3obsLnrgRPyYd+KO8 +ngCguSjH+XXdANHTFECh1V2D3U5mXWaIRgQQEQIABgUCSAU+6wAKCRCOo7BoTHZX +8XMyAKDJyeqX3oj0wRNGFVSkbjpV54i4xwCfYPtfmHBQL3GcnisIso3ien8aR2WI +RgQTEQIABgUCSAnx0wAKCRDegOZWGfkpGIXXAKCoQHJFIIhXJ1LWWb1kRNpvdOq+ +AwCdHAwDQhohnLXFQC6C3Iu3Lr7+3oSJARwEEAECAAYFAkgInxUACgkQGWWFUMMR +BhEFxAgApqRcZhmICKF0ZMuEBE7M+saRsgBTRoNnmsNKZ0g3kKk0bzKTtztZ4JhS +7Lvck2ljO3DoLbrjRAPzYfaZk3rUWk1RAhrHC223XqBmIGhK05LLjuGrZZaPZBMv +gPte4928Sc8b2U3lTAMwbTdG47gO2t3l5gFR9ZrsyHDw/gJtJ0k1VBWIssRrKnuT +fPfJzO0U5bFuESVPaQ+u5+V+HjyXyrwBtn8daHp+PEz7Z9puXSLHqR2mTeWxGWtH +S17Bb3CMwjKrfxG3lg/FCDryfu78XCpwjYOQouMcST2CKcPNkgKBQ3+GDbYKUOO3 +v8FpTQbK0ACOasTEjOF6KbKjMTtpGohGBBARAgAGBQJH/0xyAAoJEDyaQgQMCIW0 +tEAAniYkVrwPIJE/JQT9Gxk+nlB583MUAJ46HnOLwBuAUB1K/opKGUrrF+RD6ohG +BBARAgAGBQJID00aAAoJEBhhwyLFYBSy2u0An3vnCXWczd0VR+suMEmyrpciAg5Q +AJ9q7EBbQVSKom183DKkHuE8LShoNIhyBBARAgAyBQJIC2TXKxxCZXJuZCBGb25k +ZXJtYW5uIChBU0YpIDxiZXJuZGZAYXBhY2hlLm9yZz4ACgkQs5fdGlNtq+0LSwCf +VB1kPOLsUsJr7dOAPxGIo9bfWzkAn3HeFym3oPtJVbrMT1wIMUgAsZoRiQIcBBAB +AgAGBQJIRASPAAoJEBk/GAq1XZl3bxkQAJ26wvx+BepGzI8u7X4UMKLclnTLBrtk +uXxsPfLBHFAVS+quwkFoglUb9a3mNyRv9DR4F3/yBCZpUlvquPsPSQDW4CDODjKQ +f0hiDMmCMrUWaLRbgWSb5HHk8V+RLtHb3l/37ywu1ezw2OF4Ue+xl5WIYDNiYEOa +GCCbVoVwUtFUSHcIPSd6hr6coeXK/p/vcpc1WUSeYukmFFiyCy2ODRpfpA3Yjclh +vCAklryyK0xOapIjIfUCbDfM56/8AS5Dy9AGnw5v8l80gRCD3FpSnUE8cyHCi9zc +I4dYdSNO+ZuL0TexMno9rlJDBgbGYWYbmgEW8CRSv7jzVHSGaPYmdFA3bu2YdJmr +vsKgONflOwEoP2naJVb6SSRHc+OHh+BAAZIUXPPLr0v68Ps1/fW2UzMmiPhgCJjf +z8uo7dOdMzjVT4GgMhGnQuG64r0aHpX3AT53go4j9uk1rMWSikK5t6VacpqMUsqf +VXo5VpADSRA7g2zBTbFUw11tWFrx7+M2jelvXobiWgBZ6jG+1XM7IvHrnN5j5M4I ++lWfbeIRlMMZJHnQnJDh8/4op2VQGt7VxURjN3cePI4IEJlRZ+Q1NjxDYSXkooXh +Bx4RKYn/6fya4z7KDdBSMQRFLaZ+Hf9tQezj8PYyNO4xR0eJSeBUjXCqPePvJVOt +B4NBC5uayBK+iEYEEBECAAYFAkl4Y98ACgkQi9gubzC5S1ypMgCgoTq8fqFbEpAV +0c5K/Sg2Xc6JyqgAn0vOkLBBNh9WHHX6h9lh4ZGdjy6ZiEYEEBECAAYFAknKiAYA +CgkQyceSTlEEfWYV4QCghWf8038x2jzjS2axOqnpPq2Q8PIAnjXYCVtSVTWlslK7 +xGBRkHueNFPOiEYEEBECAAYFAknP8aEACgkQJMGjeGoBexf9iwCgn6GB5Mo10dSG +CT2+0JFcjv3aBIQAnAiuKtxLXe8ExsR2i3L5ANvFr92QiEYEEBECAAYFAknSWIgA +CgkQrrAaFTt8dbFNYQCgkhqCyFMpSXHYl6OL0P2K2OgSBEEAoJIYWaQJGOy6DG2o +3A44Jzc1GPQ7iEYEEBECAAYFAkpkJYUACgkQPPOSHMbURO3CsQCbB1x0IE2o0atR +R2cjxjHYiE4EIwsAn3puLQANhPOhv9QkIDrZzBfXukwviFkEExECABkFAkM/yAsE +CwcDAgMVAgMDFgIBAh4BAheAAAoJEEwEKBgxGj3lflgAni+OIjcWhfBnBaSXI/gK +eWE4OyENAJ9cOfR5IZcmedhkBhy6dNBZDbgcibkCDQRDP8gYEAgAt1UbMmoZ/uoL +StEC0SfcgbLVG3yTG6xFH5qL5t7w7HEboBvY9OkXYqHIMklC3MHJUv+BlRfhevo9 +R3DdeOY36AuYE5xwp2LXOzmDFtmqZ5aYD7269jXj5v0Vc41PK3XkQgltzKQWTvHe +RD9r9Dm6MXQ/2n+/TfDfnpgVpW+rXvU+SXUru41+3kZREg3NeWMfPcI7earv8Vh9 +mEzHFtF49QauFa4E4cvvQnl5YD//Hpxube7qG3JDp7tQ4HYp+xX5HIuU+c545Up0 +NGWSpm2HnwnMzht6NEsVipWl7ncz2ESUJ3oHt4gDi2g3ODzZPndrQwr7U7qLuLCK +n6wFTGMctwAEDQf+IjolfpRrijLrrMVtta9PO6KWNFZgQolOTN5E+Nbt+evFGCUz +NNcDVlyozm3ls9NaHOUGUKtwUhgN4qGDyuB0DkWtqNMTEF5xzi2FLyzYqSZJjx/i +kFI64D2hj1Tclkgz56cJtnjoS6U3OkQ7oS1mHDjjo0LXLY0X7nbyxwqE4XdLeYOF +ilrvHIqJX0KBTrZTl5HHr9ZhR+Ho6ygcI+ip22gxhvqVXNWTFzJ84J/Zq3YJLqZW +eDui1EzF/xFOIJeclm1HX24FX6VIsZgkhbPx0jG/QvYJDMnTmoZMePzz+EZdOvg6 +ycoCggtiZi8g6JLJjJdAWtcfSVEjIL8WR3G5qohGBBgRAgAGBQJDP8gYAAoJEEwE +KBgxGj3lzTMAoKHiIZqz5SVGSwJftzHnZEeBhIZCAKCIYF7dohQgEGpBGmOUNo80 +QmAF2rkCDQRKgyDdARAAz3bbM3oSSxSUiDKmtpevW675+ygVoRMDJAeIiUZ9UQ8z +cYbsGLqesgwmjtUGCHP+Fn1sV7eJLgyfHvBsRqloGVb1TIGdlElxwIz1UIBBD2pF +4taTTGYugoau5kPN0Ds3PNdjB42Tn/W4mtnuAECKOftoJjWFHTuJuFyPjQ12dfW/ +epoFx+twNwvD6/YMqzDNZmDiaOcqxQyiVhal+re1ATkU/1we9rNcbI5lbahYnvYO +Q4xiz7qavtiC2yY7moZicT+YMb9+AmMu/U/OGLkihVKi87N3cB1aUd2h7AM5CSoo +ASFu5zFYinP6rLCo5H+91rgOMiLvwjI+5H28yhoKKM6udaZ7cwgMp+CaD/db3ruy +HC330uYlG7byyNiucPXxiFTnUZb+9UOPEg99vs0RWDfHuGSf7EXADKR93cUNv30D +Tlab2r+KNVgCn+pJJNLGvbAAfQ8VihpHP2YiX4gnuoAKBhEszwM+/eLjwPbZKylL +ngkmJPvYIDm6FLJ7R7ubkL6SvNjPXWQy2TAm8O+saJLsrFVzpr2t8YkEtbuJmCT2 +8HHmz7H+30NC3SAUmy5biv/iXwnVP0dKSbGEXz63KKGm56ys9xusY+QbZjChAMeL +CmiFhNVVtWsbK9rQeF227bL2YyE8md5sxX/9BYrbrM3zq2ERJ24o46ZmK/vtxC0A +EQEAAYkCaAQYEQIACQUCSoMg3QIbAgIpCRBMBCgYMRo95cFdIAQZAQIABgUCSoMg +3QAKCRDm1b7RUYW6HJMcD/96/KQo7RWGEpzad5TSxWaQYULuzWo9wolPbKFAJvDv +l1EljIYvuvJjaPWX5a7YAivMg7nlEVknI+sGRG3BbYWRGnRaYOVjUT4OyrL//mdd +N6CDMm7HXpPGk62pQORRE8F/+kfzxcx8cHwerdhwm3lGPx8Ibhw+ZjkUwOY3DBNu +RcKDSlFMQN08R58tO0A6rDw5wereC9Ys+/853xWuwKxNmaGfE9AB9oZN2n4Ruxr2 +albiH0qSqTp1Iplv6JtGsqbQ5o7fLA2PeEltyPdj3oAHLIHq8rgD8T15YxpLHNP2 +a2tqZOqu6PMLRY0A3/2SLPq7gg1XuIXwLuCO5Irdlcf8FXxQZwSOg1BxAZXNquka +TLBcZeHJlbiVuSzMG+PA9iYxwT1gCrqW9pkIiqQcpiZvuFHxsQRDhhkScA8ktTsT +HJMiLp77cqhRYZG9BQGR5vMxJ7vFkOiSWkhaYC1VeQjn4FdkLryuXARU+VDzwqTn +3EUABqyFAp8ZbdVLZAcqMAjTQdkQsHFPCz+2XKcAchQIcFILSCKwZLhuZaP23PT/ +qKdXOpWPVVFRBkcuDYC3pw/Tri39VJygF0/tIPHTmI6C6Etzd6okk+k1Itdt47Bv +SDNtfCxBQ28tOYoc1ACKZOyWswE2o/00IzlHMMiBHcLerUM9DSvcjzKwvtS10l6t +860PAJsFaZ70asd3WhQ3GQa+jXYrzeQ64wCfTYyzVKKECOc27nsw/t9mwwPUMYO5 +BA0ESoMhPRAQAIKs8QdUzoQIWxF9oaXQuYsCWBp3waN+G5eObOd51tfsZCVjng+r +79R2w+qmYLg1ooySby36etxLxgKbA45oPBMTulNGKyJB39PcYZuc5OeicmciLIt5 +ziXdWjt5b4+8BiGGa+fsMblmDRDpgxLPgilYIT/8F7q7+ciHUnpOMnSH9UgOZphX +65F4LgvNIrre7eBAXaN2dqIdHNCay3rOqU9Qy8lfHKTVepytDPCdmmTLpM28wZ0X +MktK64pVkr6lTEZUjJzsuumYw7EzA7/U8B9RKmfeU0q9FfWsZASd3ys9Uu/re596 +q3FxwT7RAXwCOn9GszE5ZBFvMngBtsBhSYAhS8N30EDKdsc/0QH9PYtbO4E6Z8nc +RF5TDp+6CY3u24MxNz1TwzOClcz9ZLYgTj6kNl8RNKTvd1JFcgT+18uBCBdQJxi8 +XH7PhsBZgy/UieX9T+NYcvC2xHIeP5O5/z6AgFqE62sYso87EgNxrZH2FI1tg6oG +4JjsLzykORX29cUpKV95j65M6DKeb0eF61u7pk8r4qzdeaNTjnbm2cZf9/9F/rzZ +sdz8Pl1DUwJdgLZCQBlFVrN9IbAzgMAQdHeSK9UDk5pLtwVhKwEL5JqzM90IuBK9 +GYH3Gvg8ZNTndL4n8q6sD56sWsXceUi19yQoLaxAuOORvxXQCy+YDb4nAAMFD/wM +aEBi+TMG/iWTG7oCD5PJjf0T8FUriMTZWnbKCNznFaFlMyiV+ZFb7+dwVIt62n6T +ijq60EwknzRnA2/urUBL39s2qeK9jU3KNeBlHSFRM/5Pjqlpy7ox3fH90fg0H4OG +DlZlg4R2WfdeAgk9TjlMhWO6fjvSHtkoccP4OhGpefzBU1ujlIAYyIDNxSDQDrGE +Dc5urTWcLp86eC6M3UXNopQVskITvjasc+/C9uAsto7xa/dBSwTsY4xHpQF0d3y9 +uu1ygO46Xq0N6nUVGgF7iM/OnL1sVyE82ccn2ikqfgY/l7gQXg/+POxxRlBAcGHX +XtFrMf0eycxz+nB1Hh7dB71PnV7WRB63SvTJNKIBBQkEy194ob6gAKzazq8pXsZg +pmnd6iEW6AP+8PcMsoYQJ6OdIqZneTQVfoiPyNG8XDygjwH/svXA4NUBdEskTHrk +dVrDyWoCTNlY2jUmCC/is6ZfYK/fyR7KuF4D5uXL15NPK4FsLQbq6v428GVL+e+c +HxztgILe+HKWv/h5YGaOOyVq+lUv5LopYt4poxnlC1npI2bNej5K+XyeQMsdCr1n +3GlyqNFugRsIf/F+osARZfgfxNPXOekwlEnI2cQYJggwqLH9+zw5JnAksX3/57aE +WeKvE4cuaQBx+qSS3NEb0Lq9If4CATs17eI/gPNT8ohJBBgRAgAJBQJKgyE9AhsM +AAoJEEwEKBgxGj3lzDEAn1njbzNxuWwU9Qc0mPdkVrUIK0FBAJ906vRPI7J1KIh2 +DBlOT12zgK3B8A== +=E5qG +-----END PGP PUBLIC KEY BLOCK----- + + +pub 1024D/83E6AE0D 2003-05-08 [expires: 2008-08-18] + Key fingerprint = D694 DAB9 8F4E 68A8 4C17 F011 ECAB 0E7B 83E6 AE0D +uid Maxime Petazzoni (Bulix.org) +uid Maxime Petazzoni (Bulix.org) +uid Maxime Petazzoni (Apache Software Foundation) +sub 1024g/EA644EE9 2003-05-08 + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.2 (GNU/Linux) + +mQGiBD66FGARBACW/hHKwrc3NIMstpxwopJI2h7KMr70Ecmn5i6NFOPr8I8smABx +dIBNE0E07oCWKlS5mT47mio6wY46j5Q3EUmxbfZDlox7IO+R+1+s6OpLDz6QyLpW +BtcaGkHNHaZPB4ouyd4T640ni1mp0b1G4awlgLxJRVcP/AtJCWVJTcNc4wCg4I8r +v3+yQ+oW3QDExgGN23AQxIUD/0N4aLkdzJNv7DmDto7cwqQ1+hmPVHsyG+M1oKxl +isx7NpCbicumMyvaIrFekUbpX2jtdP4zK3F/l4BvlR8YfgDrk7QmDT4eCUMNLviu +d23aEehFtfP83O/IjXt1CjVW5n8IWNY0jwEygY/9bOQNI5XX3LcJvyMwqZorUSts +n/EuA/4zRkE3Y+p/gRNv1f8F1exV3Cn2pb5ROi6tmMbpvB8Lmx41hZylsbZQdNty +s5roYdGJGAL100x/KplV72zigDlpSAFZzKP9ArcO8w5SiJiyqYQWuB6UKB3fH9eE +inL+caa8CQY/Tr2NGIR45t03h2i3zD1MrKulZz47kCZYbztSOrQ5TWF4aW1lIFBl +dGF6em9uaSAoQnVsaXgub3JnKSA8bWF4aW1lLnBldGF6em9uaUBidWxpeC5vcmc+ +iGcEExECACcCGwMGCwkIBwMCAxUCAwMWAgECHgECF4ACGQEFAkGOAVMFCQnvQvMA +CgkQ7KsOe4Pmrg03XACePWqWwPgqWx07CfmVr/vHodYJI7YAoLIJanI8VZV4dHIB +VXZf0Kgf3VlgiEYEExECAAYFAkGFmWsACgkQCbw14+5QZGFbKQCfUVJPpvg9taHb +i3fopt+oStAtJ/0AoNrjNX3IQZVGW0A2BrcELzHWA1GSiGEEExECACECGwMGCwkI +BwMCAxUCAwMWAgECHgECF4AFAkCWj6YCGQEACgkQ7KsOe4Pmrg0dwQCZAUZX8G4U +6MBxPaN6SDXmV7AB8lwAnjjlVWgagBa+sGW//R/jNYlozb4FiEwEExECAAwFAkGT +EiQFgwcWRS8ACgkQzTD+AjVP2VIqFgCfSMoeN3UXC6tGlnDJfrJJJJ9hb8EAnRwz +xS785bagDzRQTrD72+kuukB4iEwEEhECAAwFAkG7qckFgwbtrYoACgkQlF9N1bY0 +ib0UuACgsjxfNyZkqZmfyLyLmeLaBIiR35kAn1EP8g8JnpQaatFUiWXzETr1u2EX +iEYEEhECAAYFAkJC8CQACgkQv04Nz8dVki/mbACgx35U9znQ49Mw7gEEb/PkM9SN +OXYAoL/OYqIQUqnnxjNUWdQHHqua+dDgiEwEExECAAwFAkKE3+kFgwYkd2oACgkQ +9lPLMJjT96f6ogCfXfb7Jn7PWfeT5xqOFd5jahaL/aAAoLQdE/nmBOVqvAKXNKn8 +KlwFQeKDiEYEExECAAYFAkLb2vAACgkQW5aAEOBPmoncOACdE4Sqz035hyYWfqqx +JYw+wKrB0MsAniUauUXnaedm5baA3MpLmKE14vmkiEwEEBECAAwFAkLc4GMFgwXM +dvAACgkQ94h19kJyHwBIDQCgnIhgESJ8p6OUuEqLZonnGozpJZAAnjbKeqeHuRaK +Lqtd/PSQKpjcsoLpiEYEExECAAYFAkLdBIEACgkQXP03+sx4yJPdPgCg6uOAE+5N +EK/x+AoyXSi8Y8m/v6EAn3m1F0kFeAQOQOFWz+XCXFmp49GniEwEEBECAAwFAkLj +kskFgwXFxIoACgkQhUnvgY6MdEhTDACgjLv4eCSEm68dlStlK/Ii3jrgKcoAn0lq +qZdlIaK9LA2KRIM7p3JjpdHliEwEEBECAAwFAkLkElYFgwXFRP0ACgkQbQvHOkBY +GDfyZQCeM7mtFt4c3RA2bVPmd9mxnY6k1bMAoIQbVZ1G3d7YP6oLATygKPx+689v +iEwEExECAAwFAkMOxUgFgwWakgsACgkQf7o9T+sfU2R2fACgiz19Npntlekc7KXo +eqIqfQW2EwMAoJVfMZjd5HSu+WX/DJLDGG/P38iTiEwEEBECAAwFAkMOvUcFgwWa +mgwACgkQS3OlVpbZQYk52gCfXD1k4WEozb+oDW4g8w8mPnyD43kAn1es9XXb/sOP +s2QSQpSuPQgKVjduiEYEEBECAAYFAkNM5uwACgkQF4qBnPu4WxVB8gCeMcL7DkgF +9m1IwvS5vlNJ+ZZTtrUAn3BqUvaxgXS6PrbhzqV4ca6h5xRYtCxNYXhpbWUgUGV0 +YXp6b25pIChCdWxpeC5vcmcpIDxzYW1AYnVsaXgub3JnPohkBBMRAgAkAhsDBgsJ +CAcDAgMVAgMDFgIBAh4BAheABQJBjgFXBQkJ70LzAAoJEOyrDnuD5q4NJPcAn3Ii +MneIS7QSFFqbBuWXg1CtKmfbAJwPdXZaz8/XeNwl1IRqHcuF26sVU4hGBBMRAgAG +BQJBhZluAAoJEAm8NePuUGRhVgEAnjECm7Za8pLWh986UN0dALCf6fPcAKC9JwmR +xhk4Z/Jttho6m15LqYotSIhMBBMRAgAMBQJBkxIkBYMHFkUvAAoJEM0w/gI1T9lS +pMoAnjMWb7SCcrNZWJ3eSdlSFk8ZPXcaAJ47na71eks2kL8yXB3fp2HWNOx2Rohe +BBMRAgAeBQJBhZkfAhsDBgsJCAcDAgMVAgMDFgIBAh4BAheAAAoJEOyrDnuD5q4N +PA4An3CRhtEOJ6sJvjTCzSv9vCuSeCCPAJ974rjwU4SCJ/gco7XMM1SZIgvIEYhM +BBIRAgAMBQJBu6nJBYMG7a2KAAoJEJRfTdW2NIm98LcAoINh9Pw9fhCMf4tbGhKs +cS1HVNacAJ4obCxEt7Z88ptYUtrlSru9aZNO/IhGBBIRAgAGBQJCQvApAAoJEL9O +Dc/HVZIvr4oAoJWNbuFkt7K2hxNLSu8b2r80z7jpAJ9+6/MOCJ2Msvdy2y2XF8xE +9L8jZ4hMBBMRAgAMBQJChN/pBYMGJHdqAAoJEPZTyzCY0/enS0UAnREbV//LESUt +zmMSxefuLEHtk+rZAKChzgpgSVLEsKVQQh30GfQgRVWcj4hGBBMRAgAGBQJC29r0 +AAoJEFuWgBDgT5qJZIoAn3Ly8SL/FjA00L0l0gY+sjVR4oLvAKCPEw2fPgMDIRJw +mPeV+Co+W07GnohMBBARAgAMBQJC3OBjBYMFzHbwAAoJEPeIdfZCch8AFNkAn1Vt +31nqcgesRmOtfQnjQBFx5hC4AJ951q/b1oUn47FvyyJtfp+PUWuLX4hGBBMRAgAG +BQJC3QSFAAoJEFz9N/rMeMiTVA8AnAlVBaQjW+twEAbgbWqFaF6dEsGLAKDbwimF +XXTU9ZWQsDzpO8/r1fXW3ohMBBARAgAMBQJC45LJBYMFxcSKAAoJEIVJ74GOjHRI +uHAAn1+BUjTwapsuQ5xy6mOhQVR3uhuzAJ4kz7GyZTQXveowgl3wuLr+zHW3C4hM +BBARAgAMBQJC5BJWBYMFxUT9AAoJEG0LxzpAWBg3+z4AmwbyGsGW5goY5n1Y7n8l +XvRNbek6AJ0eftBgNzQ8Wyliw2zrqrCx79ZS7IhMBBMRAgAMBQJDDsVIBYMFmpIL +AAoJEH+6PU/rH1NkS6IAn30i+PkmC8Y1lrEVxZpSD/iJzcKKAJoCUkHRy6T0KJ1b +TvFORa9yOD1wrYhMBBARAgAMBQJDDr1HBYMFmpoMAAoJEEtzpVaW2UGJUOcAoKyG +1VXvxK830zLq3hnNP4DGCBc7AJ9JDp7sE9EjcgxsBlA7yYxKCHTPdIhGBBARAgAG +BQJDTObxAAoJEBeKgZz7uFsVv2MAn0jeoqWUiSYQ7HULy/30CQNOFwa0AJ0bWNrM +bnyLVOPsg2rDq1bGMGyMsrQ/TWF4aW1lIFBldGF6em9uaSAoTm92YS1tYWcub3Jn +KSA8bWF4aW1lLnBldGF6em9uaUBub3ZhLW1hZy5vcmc+iGQEMBECACQFAkHkYDAd +HSBUaGlzIGVtYWlsIG5vIGxvbmdlciBleGlzdHMACgkQ7KsOe4Pmrg2UrwCgqr4T +NWfG6S1eplFbu9rXumEgezcAnjyz2jhtfVGCCsj2Z3AgAyDl8wCJiEwEEhECAAwF +AkG7qckFgwbtrYoACgkQlF9N1bY0ib1QKQCgotl+L/SfrQrnD76obkGPzNuFqaQA +n1Mj8Wk9FNf/hAsSZzCAbV3tgbI3iF4EExECAB4FAj+NhncCGwMGCwkIBwMCAxUC +AwMWAgECHgECF4AACgkQ7KsOe4Pmrg0zuwCfSIJWxDK4Gkx7BsvaO0AZOCgapFwA +nA+oKOaDt6GlxoqAhxuUiPo0xKZwiEYEExECAAYFAkGFmW4ACgkQCbw14+5QZGER +zgCeIe3ZGHUjzz/UyQW25Yf7s9/8VBcAn2J2p0ZUHEdntWqlOTi6v3jxiVe/iEwE +ExECAAwFAkGTEiQFgwcWRS8ACgkQzTD+AjVP2VKubgCgkVieHF2C0HYExlUCR8e+ +hkJjrQUAniPb3LEwUfj3OofUfREw/I8DGLbCiGQEExECACQCGwMGCwkIBwMCAxUC +AwMWAgECHgECF4AFAkGOAVcFCQnvQvMACgkQ7KsOe4Pmrg2kHACgqrNFxaQR3e2r +jyZ9yt9HThYvbc8An1yP6cOovt1AZ5p6OdU9R8AXBf+PtDJNYXhpbWUgUGV0YXp6 +b25pIChOb3ZhLW1hZy5vcmcpIDxzYW1Abm92YS1tYWcub3JnPohkBDARAgAkBQJB +5GA/HR0gVGhpcyBlbWFpbCBubyBsb25nZXIgZXhpc3RzAAoJEOyrDnuD5q4NGJYA +niQNlo383vzVTSeUdbLew6yRsGzFAJ47Jeh7vghc8e/gdRzqYcAoQuEyaohGBBAR +AgAGBQI/k77UAAoJEO6QdfU5abv28oIAoMexl17WRE9fGmCPjeS5oCEy+gAyAKCH +hRHg53SWgJUPQ6VuDL6cwUNUzYhZBBMRAgAZBQI+uhRgBAsHAwIDFQIDAxYCAQIe +AQIXgAAKCRDsqw57g+auDVyAAJ9V0z5uUuipuRG/5YlUD91mFGonLgCdHKSWkg7d +LmcA0I2fecVd3tyCD6KIRgQTEQIABgUCQFDzaQAKCRAw/hG7Ima1Z1NmAJ9vkgu5 +88uiz+IK/Vrz7bl4/j3T6QCfR+sEvZJIK4+BF3twAOgeqj+torOIRgQTEQIABgUC +P7+2ngAKCRAXioGc+7hbFVSeAJ978TzTftJwzHQik2uipMjBC/BDjgCgh/VdE2kq +A7uycb0AmqOFEG9nzz6IRgQTEQIABgUCP325YQAKCRBfSAZpCvvNYNaTAKCAApn8 +SL3+AeBH8jT/5U1zuhf6ZQCfXAFBAuFRtlf+iml+MOFccjDUlcOIRgQTEQIABgUC +PwSSpAAKCRCrz3ACPcJ28S1jAJ9NMBTPc/16nQWrC9k8+ZL9l23zkgCgxbM23/yQ +xAZwLzxFY4M3F1OKptKITAQSEQIADAUCQbupyQWDBu2tigAKCRCUX03VtjSJvSIn +AJ9zZMfRjjsaG+mrQAT4RAZkOVqICACfc2FH/vtiAsoHPUnQDoq9f3ohgB6IRgQT +EQIABgUCQYWZbgAKCRAJvDXj7lBkYa1nAJ9NgL+MQmis6wQ69+TTXYI0tJaG7gCg +3ghKMJfGtbzNi4RxTZnqviTr49qITAQTEQIADAUCQZMSJAWDBxZFLwAKCRDNMP4C +NU/ZUucTAJ9hGzCVYM3PvY5ci+L9OkJeg3JZ9ACdHk9ajnEBXBXQiHxPrSvEkYpG +dX2IXwQTEQIAHwQLBwMCAxUCAwMWAgECHgECF4AFAkGOAVcFCQnvQvMACgkQ7KsO +e4Pmrg2KmQCfThDO0PQglZ/QyjLq8a+t2nT+p78AoJtiOntKvb3zitjuIf/9l5i/ +to9otEFNYXhpbWUgUGV0YXp6b25pIChBcGFjaGUgU29mdHdhcmUgRm91bmRhdGlv +bikgPG1heGltZUBhcGFjaGUub3JnPohkBBMRAgAkBQJC84EGAhsDBQkJ70LzBgsJ +CAcDAgMVAgMDFgIBAh4BAheAAAoJEOyrDnuD5q4N1ZQAn3JZ4otgS3ogdgCGKFeQ +hhT0PDaPAKDFBgOlH8LdGitENSoZOWVEXSw3ZYhMBBMRAgAMBQJDDsVIBYMFmpIL +AAoJEH+6PU/rH1NkU58An3zcPhOI4SgSr/I7cGuHH4NrqKDnAJ4k2IaWtkxtYV1s +S8VcANTKSEZJDYhMBBARAgAMBQJDDr1HBYMFmpoMAAoJEEtzpVaW2UGJ3usAn2kN +ttPGuLGa65+6LJdavi9inG9LAJ4uTToi+StbM2uYMStiL/iOKyuoA7kBDQQ+uhRh +EAQA0gQ6m2hdo3t55hByLXkQTf2zficxXaW9S8gA9mePQwyqpQcDD5wCXMCmhhnb +XGdFtqs9GlRLK/VcGwkP9L8FedS/u/jtwtbE8aTI9BBE2QVGkRvEb0y38j23pCbQ +EwRdv9RrGNxAFhCDlJiHFxBAE+dabJt9YCLEUXPmqXh6FocAAwUD/1rAGpdLLsez +qBxeXYZPzefwNtxhbpEXs71sBC9+ijZnYoGFa1Acnqh3vJH1DXvLC0RDTnqWma/3 +QsHJJtH9Bfbo0M3zKWs5aaV+yu/2XPDGMiOLm1F47EfGFfb4lCWGasq1onD8zIME +W7kB+6jaDOq+qsu77eWL2kbD/FyC1aNJiEYEGBECAAYFAj66FGEACgkQ7KsOe4Pm +rg1PfwCeKe4JSyAC0hmnPn9sBOQIgsG2s28AoJ7gJ9zLdb4SquLE0vvfZeKQtLYh +=DmIO +-----END PGP PUBLIC KEY BLOCK----- +pub 1024D/40581837 2000-10-23 + Key fingerprint = 4535 10BD A6C5 8556 24E0 0923 6D0B C73A 4058 1837 +uid Nick Kew +sub 1024g/6A4AF32A 2000-10-23 + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.2 (GNU/Linux) + +mQGiBDnzkd4RBADgCTgS7k/tgx1KaZ+yI5PdpA9slDq9FNGOaP9U6GXhQPDz+Vwp ++DRn62/+k5Er8dN05ioycjNe2oaKRCHW29d+yXC5GeeAhovHYr+uwp1C1wkV8M2L +m/3LcKizSja1UYsvqucYzBCKYtcK5ttEQmQAa24p9ZhE59Yl3fqpiilffwCglnu6 +eoXfGPxl9/hEitpc7lObQGcEAJSloC5SClhhqS3F2bw46AhrJ73BZ9kOcDe6dlJo +J29SHt8rE9U2mN5WdLJpSyuwpHOK+xCjnW2JrVxn0xGVAsQ9g5T3FNTDbf1X+a37 +2pO6wAyvtsIH9ZC0JU5lfg/a1+2rGEl37T6tlPW6l3RVUkCPpiyYoaft3SNxslOd +xJDcBADBtiNxviA3H+x6GXc978PvyjypsESU2JNZRaCI86yyT/dj8VRwVwUPzurm +0vDqJNfeXbBEGQwp+Wj0C0ZiG30U0/R3rltEdz4Tn/CKH2WXAUkQAdevgOVB1rkU +eoqjkGnvhwntq6WuHPYaT5pASpiC2wU4HDu7RJcRF1uj0PnVe7QcTmljayBLZXcg +PG5pY2tAd2VidGhpbmcuY29tPohXBBMRAgAXBQI585HeBQsHCgMEAxUDAgMWAgEC +F4AACgkQbQvHOkBYGDdpugCfco5ZqB5qIKHYOgfIA05mgc2WXqgAoI2SRD4E9UHY +Tdx2EaqMfC9teG9TiJwEEwECAAYFAj/CgIoACgkQN+P0X+5l4yGyPgQA3psQD8uA +j2QoX2bhCLG8rLwYyJfN4eqMvHwQK3iTUDKAF6qEcfnVyXQi8Tu5OY37maq/QOpw +rHi+/50eiBVtStsqXbsHLKO2xxQGEaCSSehYMp5mQSiJmfKvyLTjlCb0BnesBWvD +kRMbiEc3F9zzOIcUTt/pPV/YEXmrICM0HPeIRgQTEQIABgUCP7ppdQAKCRDLMqEH +iMOlpYI+AJ9X3J4vcPGJrZqSMToGS5pzNYRPUACdHyrJ+Rt/ShkqVnJtaM+ONsQj +H8GIRgQTEQIABgUCP7qPYQAKCRBc/Tf6zHjIk18PAKD1JRdPczkSbx75iHqEfooy +O7FlBACeKkMmIs03OfCAOB5VW4YsF0x79E6IRgQTEQIABgUCP8exJwAKCRCkdA85 +0Ue3djCnAJ93/9aXFWDyqq4n9SjR2RW/Rcp1jgCff/eiV+vtiZwn1k324Cgqpjjc +ITOIRgQTEQIABgUCP8OH/gAKCRD6PI0mFCtQm5CrAJ4yOwyw0kjJ23CVpL/AQ5so +5f41JQCcDrDu5DPpL6sTJrUlnWB78S+14V2IRgQSEQIABgUCP7xo0QAKCRDsmT1j +Zf3N7klmAJ4t4NE/syVP1xqfN7f9c9yc0IjTagCgmOv08ypx//V3x3/2sH/Qzr4q +m66IRgQQEQIABgUCP8BknQAKCRAaCdGD/Qk8QbpcAKCZjXmmLt+vFPChYsA2VafU +TJFCzQCfYPRG2bFBd3iZntiHAqLKpTRy8DiIRgQQEQIABgUCP7+tkwAKCRCyvrxA +FSkkrwFsAJwKLTY7SnbEi4m0VLR6/JrjzBRZxQCguYUsuBvze88BDVIRX0epyK21 +RhaIRgQQEQIABgUCP7+twgAKCRDBHntHlk8x2fzLAKDgadjCownEBcSPk5zbg/Jh +/HqFPQCgok3nbkTIvD3ottYB3+RjkQaDD1+JARwEEgECAAYFAj+/xR0ACgkQBurP +qnbYPMbsLgf/foiuojq63JT4kDNAGSiBnk7NShOC9MRc4odQifQI6stCp1b0nn4h +d1o/OlBZ1TZfXW/dyW+dMxYlkiaaV/WdbHY4r/ImynGR88aLgG6YVwl1oVUbHY+w +ImAZLH/rJp4uafWtzX7/p21hVCeS9DckmR9Px23l5UPQyYZLHuI+iZdP0hhPkM0m +rwC/km8UTuJ4o7+Y0+Zwl75TcTuBe5WodeRkbnIv46cnd6WyJjlgRfz+R2e6gJlG +ysBkit62Qsl4qIKry+/F/jvy6nOJjJWNjtHTFQs5ijNHGhIagJUvytTFuNcNg3db +MBEA88D2Js2n0qwLLh1a2aq2T++sj3Jae4hGBBMRAgAGBQI/uaNIAAoJEBD6TIil +TaLfK7sAoNPyR6W2qBRLEn1usNwpKJcH9nMrAKCeLD1bpWkVXrbCJNsbRLZQcUVg +MohGBBMRAgAGBQI/uasYAAoJEKge5knOGdXGnXgAoMMltbfOC8a0jhMzzLS0c2s5 +VoGGAKC1UMyYcatFXUT4m+Of45z/+xUL1IhGBBMRAgAGBQI/vc+wAAoJEL66K4f1 +/EtC25QAoNvrYI4Gz40AHHWuSNU3GcuC98GoAJ4w9jfiVYWDftQ020FEKMzDFFdk +VohGBBIRAgAGBQI/udRNAAoJELkkUqxMkWW22kwAn2XBo4h4t1jxReXckDKhy+7r +AgqeAJ9uvifvKci3nnfkcKvy/rsGmJC+44hGBBIRAgAGBQI/wVDVAAoJEMwhMCCh +1pdZMdkAn2kkyMexCUuKCEHPoc2luhU1cuprAJ4peVxHFvyur9mBN0UQ5v2VGVnX +sohGBBMRAgAGBQI/yuaJAAoJEGhad8ruVlUOIaQAoIX9Au+wI+URjTKwADRf2uHv +EtDzAJ43TC/BwVHYDpsBu/+7Fjv4wqOY5YhGBBMRAgAGBQI/zd4FAAoJEBMuSdTk +Htx+ZCoAoKJyCqZuCf0tN/z3NBNWaPgqU4C9AJwPztLCMNJ7J9skWbndk74IdiJX +M4hGBBMRAgAGBQI/y4vVAAoJEAlaRdyhHVb7g7wAoLvvB/TarlHX/a2jm+BXFPdw +V9e7AJ9AcySdlGowiXXtEW1cCPyQ+teqnohGBBMRAgAGBQI/0M5fAAoJEGQHhtmt +v54amD0AoKdcXerf53vHCRVVjeJIdPugbM9OAJ4x8qs74w+PfZ9a+jwK7Mw9EYOt +XIiZBBIBAgAGBQI/ym90AAoJED6Pt/L4g0HZEXAD50Gfce2rIDHB4DSf5BZyL2Qt +NhbM3Qr61TlmlduTsyHWTruY1mB95nX/KPGaTiCWBqo95yrf1pcUn4rVH7Im7gyD +XF82j/QYLSH1rN9CN9ESsFBjaGzi0BoRAAlqgaAELJAoQLsl53vAAaYQiWtaybd9 +u5UNIX7xy/pmYHNpiEYEEBECAAYFAkBVneAACgkQGFXfHI9FVgaXgACgonzAibvO +s/UHFomOC1R94nKM9HcAnjmjgDH4Q/XOtpJX1Av6ZqTsJo7liEYEEhECAAYFAkAw +G0cACgkQLovQgMxpzu1GygCfYyI+cF1P8qZvscDQJwwscBktk40AnRnz6qzzAfOS +LZ9xYJ0s1IQnMGGViEYEExECAAYFAkAV0+kACgkQFT+gzXWmdpJuYwCfYxbaEOfR +JQXdRj2BlYA0rbUaQ0YAn1MIZa+mkXo2LBwJgufuNVHKfFMuiD8DBRBAX1NazLLr +Ruds9tARAn2XAJ9/ozPEegLNIXDRFHil+yEe/wz/2gCfXYXgwLrwoyeID7RIrwdc +hIORke6IRgQTEQIABgUCQY7oHgAKCRBbloAQ4E+aiTqZAJ9SiogzAQfXUoeV12aT +7PmwkqiulgCeJp8F5t6kEaBrA5yurTKX+6e5uV2IRgQQEQIABgUCP8IXWQAKCRCJ +2EyvRrJixs9uAKCHjl+/UO32mu6ikEU6gmYFMLqB3QCdH+3pfTEDcGAvStQpZzE7 +ys/vZmCIRgQQEQIABgUCQt7ToAAKCRDKaTl0gQOjfpfQAKCkkLYJL5/0yrhd045h +bIcgTN+9YQCfS64ZOAN1lh3l/SjlXLHWDzXmjlWIRgQQEQIABgUCQt9FqAAKCRBB +6gmgV5NJj7p8AKCcfGPPWrDaq3SodTopRts4Kmo8EACgjJRLCg2DHKAzise70OVN +THGYLm2IRgQQEQIABgUCQt+G2QAKCRAEYzpXfCAJQexCAJ97xbwzZhMOOXiM4aj5 +Ulzrja9nVwCdFZsZgtozofpvmZaHeEtKucxGG3qIRgQQEQIABgUCQt+SVwAKCRAB +BWa85BNjkr5mAJ9qlkrrGciNUdkcGGjfAb444/G9rgCfTVtutNz831bCqDowpSqZ +M5bAuUOIRgQQEQIABgUCQuAc7gAKCRCM43a4HNSGH39EAJ98iw5WB5CZOXHbhEPw +dUnTSVKwkwCfcWJD5Yr0bSriF9aVLChmAzi9jjCIRgQQEQIABgUCQuOlhgAKCRAE +kTRC6hujjbJoAJ9Mw8UfCDIttO0SGqaodq932IIUngCgj+E2QuHkF0TyMApSaEIO +w8NOPsKIRgQQEQIABgUCQuSFYgAKCRBhGWouMz5OhB7XAKC4J7nTmBWA6cn67C0B +vja2bxzRrwCeMAWS6xn1tBZ1vm6vP2A6WtNRWlmIRgQSEQIABgUCQt6mVwAKCRCL +lilD/CQ/PGZGAJ0RRqxeZpOhWoM2ADUfrkqTkTXk+wCfWiWHJ64H7Ubs7z58fBsi +M69wpeuIRgQTEQIABgUCQoptEwAKCRDI4/o2Nmo3W05JAJ9arsg7sN3ft5siNuGB +pnd3Q01ToQCdHjxosGdQalkXeymtXD8SjACn1x6IRgQTEQIABgUCQt6v4QAKCRD9 +b4jGIdCnG4UIAKCJOOihLbPfW+c2CrkE6nEPxQ29SQCgkBCbx+h8aMEyqJqjPWpd +QvfQofuIRgQTEQIABgUCQt66EwAKCRAyyeTONkLLSyDiAJ94yVjfasZoGZodSR/2 +kYqF4ZQEdQCgvOrzez4RP1JCHWsFTn15tUQgNh2IRgQTEQIABgUCQt7UjgAKCRDu +0eo5ImHQc6jEAJ921c05ZPfI+9uWI97wsopfW+PDFACfQ/PxEyEzeCXbYFoEUe7B +tOgp1AyIRgQTEQIABgUCQt9sXgAKCRBQjq7FMC2laOH/AKCwImpjMHoE9H7sQx7L +I+9m1PmOeQCdH4x9T3vUF4gHL8BypAse/UuLQbmIRgQTEQIABgUCQt9sYAAKCRDd +umS6LDEtLxjpAKDoV9vn0QheFsQLYuUeDF/5m20TkgCgwkSVcCDP/7m6aZ8blA/h +cAeKrJCIRgQTEQIABgUCQuDsmAAKCRDJtabs4td03wkIAKCmhOt1jrHnnknNr623 +OtngC3yhkwCeMH2xnonwIboYmyo3hzC84VHzr1SIRgQTEQIABgUCQuDs5gAKCRA3 +9o/1AVr8ilTiAKCLvPNLPVjXY8epjHhSxkRY6+HU2wCfZnVkzoW+c7NQ0G7Db5/G +rMjEgdyIRgQTEQIABgUCQuJhxQAKCRBtmI0XhzFcMY0AAJwKmpwnqrX8aDV2+t+E +uTrM4i+42wCcDiK/v3y0jmXbylU5eZ93mrealSKIRgQTEQIABgUCQuNVMwAKCRAT +LknU5B7cflj2AJ9ZTTFhGTJALO2/xVX8eVGucVbO5QCfe3mRMPaSx5nKne3TQWIR +2Pck102IRgQTEQIABgUCQuNkkgAKCRB1yqKj85s3UN2KAKCH9B6mMup+BSkf/qog +WTp+wkzt8ACfdLzMTdNnt15YpS0TEmSNrq0waweIRgQTEQIABgUCQuPrZQAKCRDy +AsuClhyUYN+TAKCQGVfmlOhNu/L67ZmneL1KA7iMXACePs6DOTSlIh0LKzGvZh0H +8jAwtR2IRgQTEQIABgUCQuPs9AAKCRAyhk5BnIUiKxpRAKCHGnESODZlUhkrPZ9G +bKZj/WKMgACfY7HDgvOuK7N9evmNB1+8dUTZnuyIRgQTEQIABgUCQuUQeAAKCRBS +eS+vmXivhsKnAJ9a1Pp8ZyZWTtryRgeRyIZ6CaG9DACeJtY83ZL2LatOpgfcLCt5 +U/F2okmIRgQTEQIABgUCQuURcgAKCRBrc6EGKmI/cllgAJ9LOwF1qeUlQplpr+mn +mlLB9JyV+gCg8d75X/XaHWMYCqBs8dh0E/0zf6GIRgQTEQIABgUCQudgyQAKCRBu +lHWUwVJDGoW3AKCvlrR3dxaHHPAa3Gxae3NTu9/j+ACdG66gH2TAfa9qSx/E+9Df +H0pdIseInAQTAQIABgUCQt6sNQAKCRAxpj2W7BQLgUYIBACQv85g415QDF40KBaq +b+3GMOtrHq0gbhG/xq8EfVq2NN+W4jRBgpDIdj17zgTgDy1Xby/04UK+7CMNhAFA +li5QXPQgO+iKgmV3Dvdzml9P+IGGb7CjU7/oANNfJoCwFUeZanizFzZepTkyci9x +H5OHcfe4Lhiq18wCmlb4nkG7wYicBBMBAgAGBQJC32xcAAoJEJrNPMCpn3XdRfoD +/i0tYfOTUwa3OQ8hj9RUx9KTYJe/M0vGuyuNxEWdRB5R6AUolIeboIunb5auAbRb +ubrVbXjRkvJS5wCqOO7WyL49w9G4BVAO0Uw+QptION+UdpV9ZfXHd+nsgDuiRkVM +yhX0336SoD57RyiT5rglKpKOCb7l4e12S0dVr15PXc7IiQEcBBMBAgAGBQJC/ToO +AAoJEFwyh8czExtlBa4H/jj+/4NJgM7ciC0A45ySTdJZY+DYFJyRCu5bCPkcYS6A +3PKInXc8RgFykWfz0X57UtobvH+s0O+Gyg6ArSErEHXsCZGYlHPpcACgFLiLS7yE +gEpzDLClmSIMmb7kRGr9LX5RyQhAPAjszlIk9jPdcn3jkTtvr+oHrVLmTy8tcW3u +d9G8oD7PCZAeD2P8XA2eHiY+9/oPu5y/cJKLYl3J+gL6Ptk7jngft3hwr/6X/dAc +bE9h09ZS9ZRmf28NiCEBJ6meswMA8C2ocJLmW+7X2Cctfo2LIPpvI0uKzvAeh+Hl +/97HmmyArknk8qEFYHNh5sI7yT8okbuZ5daI0Ibp1NKIRgQTEQIABgUCQv04lgAK +CRB+iDZMgoRJhB28AJ4wWlHXGXU73JYV3b/A5l0gdVF+qwCeKkLJspvZ+BF2cV3u +4FKwIeq4FaqIRQQSEQIABgUCQuE1ugAKCRCiEVrhX2uLchEGAJUSSguS2p3XVs6l +3ssMx/Cm11RoAJ4hazOLz9zi9bkkZe4Jsnj8t8dkPIhGBBARAgAGBQJDJH2xAAoJ +EPwPhYn4lL4SDsgAniHK2LhZ+mFApRlM1EHt1XwuZic7AJ9DK42czJ0hWYRJuUge +gH1hRJM3l7kBDQQ585IFEAQAqsJfRx6LMF9sBtHmNf83j1V2SCVv4NK8OoPcKWBg +MKQxnDkpWD7DdV69p6azP6N/ENfmK8qsSiXHUUEwOS2UMct7T3Tqi5f/EAVSgw4T +rTC9dgpafTUpU5A8MW7h+Psm0XDwmwlqREUvyK2gqnpVaMXhZIVU71yTeXxy/3Vs +7ysAAwUD/iJg+Bc0iZ7LNnW1xZuvc4/6LOEGelQpmM5SPr+gG6DHXhR+TrUMDt7R +e+WkPGS8yqqxZ/4JefF5X6KgQwDadfQAYldFwW0XakOBCP17yK3aJsYtdaxTyx5e +R0LuGbxVdMz3u/UtY1Txn72wlEEqnPhNokbvAI50jyc71TTXWKaviEYEGBECAAYF +AjnzkgUACgkQbQvHOkBYGDcHiwCeNV4G2NP0SvG75RaqmYvnvbyC1xUAn1qF30A0 +W/Kdk2iuwPLJw9rN5PFA +=WPl7 +-----END PGP PUBLIC KEY BLOCK----- +pub 4096R/F51BB88A 2009-11-04 [expires: 2016-02-17] + Key fingerprint = FC5A 6FC6 2E25 2DFD 8007 EE23 9BB8 63B0 F51B B88A +uid Sander Temme +sig 152924AF 2009-11-04 Sander Temme +sig D3262722 2010-01-01 Jean-Frederic Clere (Apache signing key) +sig 3C7705CF 2009-12-13 David Fisher +sig D84E41AE 2009-11-30 Nick Burch +sig D1F99590 2010-03-18 Josh Micich (Software engineer) +sig B55D9977 2010-01-26 William A. Rowe, Jr. +sig 3F0A04B6 2010-01-26 Geoff Greer (Work) +sig 5D7BBC5A 2010-01-26 Leif Hedstrom (CODE SIGNING KEY) +sig 1824BDC1 2010-08-26 Brett Porter (Release Signing Key) +sig B1669287 2010-11-10 Kathey Marsden +sig D01E0E18 2010-11-16 Jean-Sebastien Delfino +sig 08C975E5 2010-11-04 Jim Jagielski +sig 6D5954FA 2010-11-04 Eric Covener +sig F2F27A06 2010-12-30 Carsten Ziegeler (CODE SIGNING KEY) +sig 4DCAA88F 2010-11-04 Thomas Dudziak (CODE SIGNING KEY) +sig 82A7FBCD 2010-11-04 Antoine Levy-Lambert (CODE SIGNING KEY) +sig 7C408737 2010-11-04 Joseph Edward Bergmark (CODE SIGNING KEY) +sig 791485A8 2010-11-04 Jim Jagielski (Release Signing Key) +sig 0E371A09 2011-01-05 Sander Temme +sig 2 F2EFD0F0 2010-11-05 Christopher David Schultz (Christopher David Schultz) +sig 3 X 4336B448 2011-06-23 Scott Mustard +sig 4E24517C 2011-11-10 Hyrum K. Wright (Personal) +sig C4FC9A65 2011-11-10 Bernd Bohmann +sig 1F49ECA5 2011-11-10 Ulrich StŠrk +sig F5CBAE6B 2011-11-12 Akitoshi Yoshida (CODE SIGNING KEY) +sig 352ACF76 2011-11-10 Richard Keith Turner (CODE SIGNING KEY) +sig B84508EC 2011-11-11 Bryan W. Call +sig 2A239C2C 2011-11-21 Christian Mueller (CODE SIGNING KEY) +sig 0208FC11 2011-11-14 Carlos Sanchez +sig 97C87790 2011-11-17 Paolo Castagna +sig 088335A9 2011-11-24 Chris Darroch (CODE SIGNING KEY) +sig 2 41CEFDE0 2011-12-13 Stefan Fritsch +sig 3 F51BB88A 2013-02-17 Sander Temme +sig 3 F51BB88A 2009-11-05 Sander Temme +uid Sander Temme +sig 152924AF 2009-11-04 Sander Temme +sig D3262722 2010-01-01 Jean-Frederic Clere (Apache signing key) +sig 3C7705CF 2009-12-13 David Fisher +sig D84E41AE 2009-11-30 Nick Burch +sig D1F99590 2010-03-18 Josh Micich (Software engineer) +sig B55D9977 2010-01-26 William A. Rowe, Jr. +sig 3F0A04B6 2010-01-26 Geoff Greer (Work) +sig 5D7BBC5A 2010-01-26 Leif Hedstrom (CODE SIGNING KEY) +sig 1824BDC1 2010-08-26 Brett Porter (Release Signing Key) +sig B1669287 2010-11-10 Kathey Marsden +sig D01E0E18 2010-11-16 Jean-Sebastien Delfino +sig 08C975E5 2010-11-04 Jim Jagielski +sig 6D5954FA 2010-11-04 Eric Covener +sig F2F27A06 2010-12-30 Carsten Ziegeler (CODE SIGNING KEY) +sig 4DCAA88F 2010-11-04 Thomas Dudziak (CODE SIGNING KEY) +sig 82A7FBCD 2010-11-04 Antoine Levy-Lambert (CODE SIGNING KEY) +sig 7C408737 2010-11-04 Joseph Edward Bergmark (CODE SIGNING KEY) +sig 791485A8 2010-11-04 Jim Jagielski (Release Signing Key) +sig 0E371A09 2011-01-05 Sander Temme +sig 2 F2EFD0F0 2010-11-05 Christopher David Schultz (Christopher David Schultz) +sig 3 X 4336B448 2011-06-23 Scott Mustard +sig 4E24517C 2011-11-10 Hyrum K. Wright (Personal) +sig C4FC9A65 2011-11-10 Bernd Bohmann +sig 1F49ECA5 2011-11-10 Ulrich StŠrk +sig 352ACF76 2011-11-10 Richard Keith Turner (CODE SIGNING KEY) +sig B84508EC 2011-11-11 Bryan W. Call +sig F5CBAE6B 2011-11-12 Akitoshi Yoshida (CODE SIGNING KEY) +sig 2A239C2C 2011-11-21 Christian Mueller (CODE SIGNING KEY) +sig 0208FC11 2011-11-14 Carlos Sanchez +sig 088335A9 2011-11-24 Chris Darroch (CODE SIGNING KEY) +sig 2 41CEFDE0 2011-12-13 Stefan Fritsch +sig 3 F51BB88A 2013-02-17 Sander Temme +sig 3 F51BB88A 2009-11-04 Sander Temme +uid [jpeg image of size 22992] +sig 152924AF 2009-11-04 Sander Temme +sig D3262722 2010-01-01 Jean-Frederic Clere (Apache signing key) +sig 3C7705CF 2009-12-13 David Fisher +sig D84E41AE 2009-11-30 Nick Burch +sig D1F99590 2010-03-18 Josh Micich (Software engineer) +sig B55D9977 2010-01-26 William A. Rowe, Jr. +sig 3F0A04B6 2010-01-26 Geoff Greer (Work) +sig 5D7BBC5A 2010-01-26 Leif Hedstrom (CODE SIGNING KEY) +sig 1824BDC1 2010-08-26 Brett Porter (Release Signing Key) +sig B1669287 2010-11-10 Kathey Marsden +sig 6D5954FA 2010-11-04 Eric Covener +sig F2F27A06 2010-12-30 Carsten Ziegeler (CODE SIGNING KEY) +sig 0E371A09 2011-01-05 Sander Temme +sig 2 F2EFD0F0 2010-11-05 Christopher David Schultz (Christopher David Schultz) +sig 3 X 4336B448 2011-06-23 Scott Mustard +sig 4E24517C 2011-11-10 Hyrum K. Wright (Personal) +sig C4FC9A65 2011-11-10 Bernd Bohmann +sig 1F49ECA5 2011-11-10 Ulrich StŠrk +sig 352ACF76 2011-11-10 Richard Keith Turner (CODE SIGNING KEY) +sig B84508EC 2011-11-11 Bryan W. Call +sig F5CBAE6B 2011-11-12 Akitoshi Yoshida (CODE SIGNING KEY) +sig 34884E85 2011-11-25 Robin Hugh Johnson +sig 2A239C2C 2011-11-21 Christian Mueller (CODE SIGNING KEY) +sig 0208FC11 2011-11-14 Carlos Sanchez +sig 088335A9 2011-11-24 Chris Darroch (CODE SIGNING KEY) +sig 2 41CEFDE0 2011-12-13 Stefan Fritsch +sig 3 F51BB88A 2013-02-17 Sander Temme +sig 3 F51BB88A 2009-11-04 Sander Temme +uid Sander Temme +sig 152924AF 2009-11-04 Sander Temme +sig D3262722 2010-01-01 Jean-Frederic Clere (Apache signing key) +sig 3C7705CF 2009-12-13 David Fisher +sig D84E41AE 2009-11-30 Nick Burch +sig D1F99590 2010-03-18 Josh Micich (Software engineer) +sig B55D9977 2010-01-26 William A. Rowe, Jr. +sig 3F0A04B6 2010-01-26 Geoff Greer (Work) +sig 5D7BBC5A 2010-01-26 Leif Hedstrom (CODE SIGNING KEY) +sig 1824BDC1 2010-08-26 Brett Porter (Release Signing Key) +sig B1669287 2010-11-10 Kathey Marsden +sig D01E0E18 2010-11-16 Jean-Sebastien Delfino +sig 08C975E5 2010-11-04 Jim Jagielski +sig 6D5954FA 2010-11-04 Eric Covener +sig F2F27A06 2010-12-30 Carsten Ziegeler (CODE SIGNING KEY) +sig 4DCAA88F 2010-11-04 Thomas Dudziak (CODE SIGNING KEY) +sig 82A7FBCD 2010-11-04 Antoine Levy-Lambert (CODE SIGNING KEY) +sig 7C408737 2010-11-04 Joseph Edward Bergmark (CODE SIGNING KEY) +sig 791485A8 2010-11-04 Jim Jagielski (Release Signing Key) +sig 0E371A09 2011-01-05 Sander Temme +sig 2 F2EFD0F0 2010-11-05 Christopher David Schultz (Christopher David Schultz) +sig 3 X 4336B448 2011-06-23 Scott Mustard +sig 4E24517C 2011-11-10 Hyrum K. Wright (Personal) +sig C4FC9A65 2011-11-10 Bernd Bohmann +sig 1F49ECA5 2011-11-10 Ulrich StŠrk +sig 352ACF76 2011-11-10 Richard Keith Turner (CODE SIGNING KEY) +sig B84508EC 2011-11-11 Bryan W. Call +sig F5CBAE6B 2011-11-12 Akitoshi Yoshida (CODE SIGNING KEY) +sig 2A239C2C 2011-11-21 Christian Mueller (CODE SIGNING KEY) +sig 0208FC11 2011-11-14 Carlos Sanchez +sig 088335A9 2011-11-24 Chris Darroch (CODE SIGNING KEY) +sig E1303A99 2011-12-02 Marshall I Schor (Code Signing Key 2) +sig 2 41CEFDE0 2011-12-13 Stefan Fritsch +sig 3 F51BB88A 2013-02-17 Sander Temme +sig 3 F51BB88A 2009-11-04 Sander Temme +uid Sander Temme +sig 6D5954FA 2010-11-04 Eric Covener +sig F2F27A06 2010-12-30 Carsten Ziegeler (CODE SIGNING KEY) +sig 4DCAA88F 2010-11-04 Thomas Dudziak (CODE SIGNING KEY) +sig 82A7FBCD 2010-11-04 Antoine Levy-Lambert (CODE SIGNING KEY) +sig 7C408737 2010-11-04 Joseph Edward Bergmark (CODE SIGNING KEY) +sig 791485A8 2010-11-04 Jim Jagielski (Release Signing Key) +sig D84E41AE 2010-11-04 Nick Burch +sig 0E371A09 2011-01-05 Sander Temme +sig 2 F2EFD0F0 2010-11-05 Christopher David Schultz (Christopher David Schultz) +sig 3 X 4336B448 2011-06-23 Scott Mustard +sig 4E24517C 2011-11-10 Hyrum K. Wright (Personal) +sig C4FC9A65 2011-11-10 Bernd Bohmann +sig 1F49ECA5 2011-11-10 Ulrich StŠrk +sig 352ACF76 2011-11-10 Richard Keith Turner (CODE SIGNING KEY) +sig B84508EC 2011-11-11 Bryan W. Call +sig 5D7BBC5A 2011-11-11 Leif Hedstrom (CODE SIGNING KEY) +sig 2A239C2C 2011-11-21 Christian Mueller (CODE SIGNING KEY) +sig D3262722 2012-02-11 Jean-Frederic Clere (Apache signing key) +sig 0208FC11 2011-11-14 Carlos Sanchez +sig 088335A9 2011-11-24 Chris Darroch (CODE SIGNING KEY) +sig 2 41CEFDE0 2011-12-13 Stefan Fritsch +sig 3 F51BB88A 2013-02-17 Sander Temme +sig D01E0E18 2010-11-16 Jean-Sebastien Delfino +sig 08C975E5 2010-11-04 Jim Jagielski +sig 3 F51BB88A 2013-02-05 Sander Temme +sig 3 F51BB88A 2010-10-11 Sander Temme +sub 4096R/48BCACC6 2009-11-04 [expires: 2016-02-17] +sig F51BB88A 2013-02-17 Sander Temme +sub 4096R/632F5ABD 2012-06-18 [expires: 2016-02-17] +sig F51BB88A 2013-02-17 Sander Temme + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG/MacGPG2 v2.0.17 (Darwin) +Comment: GPGTools - http://gpgtools.org + +mQINBErx+bIBEADFBcP1jJ1LFue4GUVlmDbqG6fbdE+jYG3ITo/EXLcGfjfOyR7D +vkdXOXFJ1uzo7NHjleVuu5V+XKrsK1ZIFq07c9eGcqByOC9FOzAZFkC46iuoDM8w +rhm5x4GeKTPqRfoZzSqoHe43Uqurw3KT2ltQraM0XDVdkqGjh9P6VVY2Yxz3afih +syO1f2cmWSDnOGj0LmLUCgMa6YGswJh5eD6VvMNGI1NnluD7PCrsgKOp2CUOE+9R +kzy0IbbY6Xc3hO29EHBYAES0H9e09rCASlQpkqNkZ0eA1YdmFv8oGWpZnPb19X3z +y4hrbz616toOruKINMb8U07Y66d8xnj0wHbmjdLoZREJb3GnLIyKOHvsMwJueCWB ++t6aILtGIFHFvvvP7IooVBI7jfLPhjPSPGHeQQf2K9w2X4xYMs+fhedFZMa1LYjm +mb64TVNvjB5AG02S1yaRWz73kRJ/vhNnKOZbUab+bYlzkb9ae+rCYg8YTif1CKSX +03PuTs/ccJtmZFfj6xNIcooKs1YY4BvWhFMrjtuAOcXlSmgbooV55sJKbWTPmdLX +5jZrhs620II6fZ8wNBmb0+97IxC9SzRh+cfe1JPM6W1extE8j+HXnXovsk5FHKhi +BQwLiLE/BZIDvSOj1cggqVvoWaoKiwbNNbGGm9HO5g/+ysonTg84SDs6lQARAQAB +tB9TYW5kZXIgVGVtbWUgPHNhbmRlckB0ZW1tZS5uZXQ+iEYEEBECAAYFAkrx/JkA +CgkQsr68QBUpJK+7/gCgp9v0Jbz4vP0GKZcNPhqJs7MuP0wAni/6duAbG+RPP/2e +rBXBuDpq1qgiiQIcBBABAgAGBQJLPcnoAAoJEO04c/XTJici+H8QAKt02h69emh6 +ILw95dehF9oCggNwrl2W4JS8vwMNe9v0edroDCknPYtK+5UsikW3d7vGBuHGVFKD +UDyWxvmT1v5CcJQHGoGLNzQzc3nplPHbFbYdzuxkmJ4aVBeX6WqQ9y6c4e6uQB0t +APzNvdGW6Oajg/sunMJKeO+m9IROq0alK3DFw9ilVJVpHXmfK29MIj+j+KTOO/CM +nGrfl50mzRV62qhzV/Kud50qpZSvI3rBP9p1oz9/DAbpsbC2/Zh31+FEXblrE7J5 +TxBedJJqCyDf9pvFi+Xqx2vivxpgx79SjotDx02o+GFka1UWSdKQNg0Vo5vXV486 +o+yTwgZyI89FwvuRaBwEcfA++tTcDbrpaiFd1sABvZuWwDhBt2Oe1uTaUg+0m5He +20+snyk5nrH7+5cF0r3ocHxsALCNLh+51K+0NIyPLF3VcrYMSaPEdHGbYcAEaDiy +J0EUR8jj9h/TEF+Yf2Czo5sOLV8+C/CEaHpuj4JCzOilHGGEjGUmeaiagQs6Oj+1 +KcY4ILYnM0MaGqa2p64pTasUDYnCMySZKihdqTTwYLmmCMlSdTiS9kFx9qhUoscb +Z66FameAzqyfUDezjpExkB4TQLk4eeUPnDnhH9gkXXVBPBJbiBlUW+1ljscCVINS +kx3Ozmtl2uqn65zPCq0BxzA/c9cJcboJiQIcBBABCgAGBQJLJUYvAAoJEDF8bfg8 +dwXPtUQP/2+nqnjP9eQqI90eCUgDF11nSzPhq/3kGBEgdELRNOkhwr8qfnt+dCA8 +2zayHFy2fdwhpCeqO8Xrz6ByBgmolDKuZm6BZvEEBvQjae8nTU6ZWfR19iYUIFA3 +1oXLR+a2soTr0bYF2JSn80gyfALjbqStkR5abHmrbMtAXKdoG6DTBkIVBpjpODN7 +qLVrTi37zxVzqDdBMm2gAZUczsELB+Tf+2dCHIukIFNZrG4B6ttQrv4J3qPfp7A2 +yqYNXMYQwNK4RZ69uzDFKHLzIoJrBDkABU/JibSr6/+1Lp+CzUqYU0EGAiyhdOdO +1LK1WsyI0Q7BOXNFU2XEijtfFjcHeDoiehKB+5U44meWf/ShTz7XnBUTvhfWrDT2 +L8G0F9XOSU6L/Yu0KxNiaUHX8GCTBuHERj/iiGX4REL1QAdzdJVygeBJHHOJubqC +8DwKo9mQFfox9jJPDwlcHUix8qf4PCB+RhbrykGLZR7FWJhDEMFC3MXlkZLOqisj +rfU+tGdDvz6uvHa3zwrYzN7u3q6ontDRkckTNxYCI5TsYazqNwQnsBgd1eZY0Veo +etjfN3cdGR3sGtLICvHWjm2rqV6586Z3LTLOo0+zPKcV0QXMdo1UPgLHuSwycCLr +vH9ogos6w+RZKQ/2Zn+PNadik4AlGsJn5NAzeYbLLAfvSr7YjiwqiQQcBBABCAAG +BQJLFDXNAAoJEIqviNbYTkGuE/0f/0vnfSfYJE5URq0UR7zGmZuY6MQDEe5nHdrT +j+5tWeatSQTOI8lNHlkUPSRuRv4caN6fBZw5mM7xbUhz6u0tqbO26euazAQVp2fC +NQcBPWbEHLoxJF0ZkEDctVtYoshajtr9tdFxv/4p6HIsfIf0l4aoQBsdS8jxxJOS +kN1ZrtYyBMz732OxvScwgd/rKphMLu65iT8YiQyPEVBd9glDVlASa10QOhQyyTcJ +mfdkGzbYxAI8u5qFDhtWVPP1wSbJ53DGPjkmtG4J57bJtaxcz019bVK9LoY8Jemi +J0t5Tu5GJZBLxO/0wfGAdb7c0ggws4yIwqARnKxLKJC4dbUVQlE34W9Ql59s3drJ +uy6inOLr92D4iyKwuMkWvJtmrhwTgUcEam4giXsOGYQIWyHGheTHdwVN7XJfjUgd +dCVvdjc5tJvA6zrXNhVm1SZM63SwvZ27zY8SgJz3nl89hT+iEaLE9Fp7+YqzdOXf +kfm5Vp/y2y1qNNJ8nFn9gSHMBidHDwN/B1lGn5KBc3p34Iw047q+o+qi4YOV4VEq +fHzwOTXD9vADvllRM1y19i22fUj0ke5tT6OX9djHfqzFQvUo0XAHXEL54lvAqoMQ +11JYreYMKULtI4wE+CGqte4G2Bw1yCzyD5m6FIUlBFwcmJhnhkdjDr/dzOBaFtzG +27zsd6GlQoPfDCjuE7/3/5nolpRzxrOWzBP0O4AiGOPnnmcRJtmDdDgx/QOuX5t5 +kazagZPkiUr0BFODjskJdFF5ojTx2n2cw3WsaU/55dQxSYVR3LKHLPI6Cu/CmAIV +7mAJPe2pzJvWsH4xjuaFUTRBsBvBuRxsKeoVCc5RvEizqZS4x2SdziKGZi/SgILH +GuYDwVRbZJRs7cYNkeQFeqZegj9SzkgITJsWa5ZgoCKZasSW6t+Z9i0fFZWPYzsa +NdwcH12wPS5ZN4ToVwcjkfMv24zrE6Y/SPHLYYeDvNzbIjbCSxmarYlbwX36mEpZ +CfwaGWCQ14hDKKgiRuICgsOMWJMeocZHQZnTN6EBv4b8TqHHh4Ux1HOnkC1B5V/5 +MjVsyWvqxRq7i74bk9sm6ZfvqFNHmm0jc/t50x4so5CHqD8KUXmDRf9myFj27tWl +Br59qdnftjk3bXBtplmWagkOrG9SE/eqb40BzqkBxFirCByFnGTkdvhxZTtbJTWd +7KBR/f+SEij1P+CTf8iXzj1aDGzYS1O65D9OJRt3YNLLxZWD4sI+Y4ggF1ZbKQYf +/3NMfWrJvc6Q7HDTPr6D/C5VSb2D0ycZx9ZEbbMiLYYhAbF5di0Mg1d8LY8NlZvo +nkDd0PrwMjJKUGdlG/IXm+yUOs7ugTxssf/Rml7+Jlpa+Rbju2OIRgQQEQIABgUC +S6J7ZwAKCRCGC77m0fmVkKppAJ9ZetTyKSx0sBhWwccZAAmRrS8hSgCgqyFAGP/v +B2RpQA9XtWaYdcc166WJAhwEEAECAAYFAktfZQQACgkQGT8YCrVdmXdQCg//VL7e +PcPmYCOCu+Zka9xeFZzgV/l0/grgC36IuicZVCa93lj3gmtvTnbm3Fh83avsB5tZ +DnWujFu3SfqqqRz1VWSwcGdobpQooL+LH9p6jXNkQLVfWKI4giNLzPCP7imWpjy3 +v3x5cRAKGQ9xuTARqTvG5ZZBaeoBOP4bVsZ3CS2LnvfZLq5z4/D3wSLGKsBvsJcX +b8eoxkqpWVFlIl5LCziA7Eqs7hKNSKhryyvbfjVYROOyNOqhKQJlyg2Z2hfVdn8g +EGJ5e9qL9vSNJA46GIpnx7hf/1WXdVyohkAWbKIJdjUDfy6/c+hAovKwONacY92u +7Ly4TyyZHOj4D4wF2q3LJCGAXhp6DlOW8qDSfOUOszT4MAR2l2HyUniP+p21yc84 +cC2OMyFGtLPeInlO6xt2rXFlsfLqv9sdG2Bx+yS2qVa1+KSCmMvnLGPI3u9jT46/ +UtjrnV+HfdH5BiFzfSMLnILTgUAlsg/XeyaZtQt2BAnAZLASD7G8yawoW7elIOFD +kWoSpA3S8Nu0QZt8VaeXsHW59W+1myojN2FPab2NiGlfCiWtWCtjH/ihYcIrkCLf +14WLOaTCz7rSxKlMMwZXvwHXBHr+tGDHkmqLJwYtsS/IEUYqw4M6lU3dSMXBu02o +Yzfx0bWntoTsjgFlcFU9OPhNFceyhvnGqKl7eEyJAhwEEAECAAYFAktfdS4ACgkQ +VWu/8D8KBLYvihAAru3HWQkjUn0XZzsR9fOFU9Zq3OMdq5NyCnSrtVQPLhhJV9Bl +euoMk8Y1zsyHljQ4OClWUXV6bFso+a13BmeieRvh0GhRBKY8HldaBaFsIuooPyap +NOSwoBVsdXREXpecTIhfVgR42rms+GJNvmCDbQnbFLAH5UvR+jLLMoDzEJkCSf+d +S63FkItHNzbuAsdf76Ggtk9el9N0bFBSt4fKPr8l6sA1PhyPbHiSL30Lie5Lga0P +Si51YBJPZbH/0Br55Z3pzq5vqTam8RtLl/zN02mD9vSu7Vm1Wi7mYwqgFbTlYG/5 +t1YASu7ovHDui4I503f2+yTkGYcps+DXnLUfceBwUy1u7NgPuOoiotYQKwx6zLJO +QuDX5upj/ZdQJ6xim6f5g7wOwikEnGFAh7Z0W/q2/lVxwXqQf7xqQLUkDym3Aje9 +519rEmm3/2vM23E9ZkDwVMZjM4U9619y64YwigjEteQ9cvyXXmkL19x3Alxzurwj +CJnhM3FnFF2ISzsWbVFvbfP7DE8QVzjiflsUD3IqhIyBBtaRQRL5p7fOrRUGnKM0 +/dmUbSPj1Hb95yB1mDBdwP0T/pXaDxD89D1pxSaPpQAHnvpQoCICQT241SCh+60i +g2GFQXcXdKa+Tdd9ggKeh8i0tffTt69FRZQ5eorS4MOVUaEgTWzPhBkvk0CJAhwE +EAEKAAYFAktfZUwACgkQUz3vFV17vFpDtw/+P3CRrcBDZs/VHYPrs70dkUp7KC/C +GKOD0jLOe455FUpk6LQTwH9rwtk+2F8gfY+i5j9+aHqj1U19p5kpU6sOnv0UXUhg +YgX+rbIj8eSPPhTnj9pP43W8tfdt1bhT655t5VXGdzElNuV0SPLSl6WkREH3GsIZ +YQSVSOqfcbj15+eWZWD6VdOkvCxOVvGGCbx3JDx9yVgCWpwp0zcO0EeyJYTCcOJg +7Phpcekt+ek6S65vUYVt78ggdLXmrfiMIOCzc7BtECmHHBpUNlCLMSD9Ms68sbUt +miHysFQbo4YHLHw97B3qvU4xGhn0lFOrBQBOjv3NXcbGGjvjqWHhtWVq8Fzv5RCm +UkGz/qosxAgWD1rVGdOUIFX5m8IFAy77/C+OI2gdUebzsxcvAJpfWrl7fMVu0aim +Q7kT8w2IQsSPw0Y1Uz0vtWQyZQDyEK2YMBqWuuVGA0d+DWa9DRKEDbUTFfnzoejh +ep+5hIj76fIyDfF3h2SRTfFrsu1luZAyIsuxsryuH5xPH7mxlnNbSStHe9JUTFm5 +DG92Ls62jnxcxVwL3gFPr7jjCazz7sI1sd50OY/TydXflwn6qLy+TT3WODTjfzEi +vzyqutiEtJDJtXZd7XHztpK1/2I+mLBaHGB5jHg+SV2zilRix1Ud35RTs+HL6J5r +/0p9bamIRQm5HsuJAhwEEAEKAAYFAkx2khwACgkQ4TYIihgkvcFD1A/9FYpfwTQX +gFjolMgWbfYCUsp//8CRX1P8r4ttw7u8kkEe4IYpObasVoZzaJZD+89n6/1Kx4uB +ozPhwmoEYsBAsLtTKMEt0T0U7/ZDD4c4ZhNYVSTbQawn/pcf4jSy919tzMeqHfrM +0IFwARK24C02BOrRzboiJU+1pXGaL8ivbEv66IC/aNC5B5lqN20bX/imXaj4KKiO +i9Z8NnWHH+5UTGVIX+f8y1ADkGzs8SxkLl4Bc4AJUa0yDKoy2OpYc+0KOYRjTfdy +YhcVfdQbd6xDujArpzBnDP1nzHAXdUae+sMr8X0sUEo+8Izoku4Dj/J2SyqQ1tt2 +I40z6cfgOsn36bQUdouBEPm5PL/92sCI95O4ZB8LUJxKySI+AHgxqm4WMMy6FZ3x +HOyH84+cc340CRNPMUcr85eTrCPnbafId8W4/P7RWHNJRtItmO3tZC82OgujqLd9 +Z5VbsAGgK7E4Q7JaM1bRoCw8C+gSpkSUoVyVWzs1e4FO9UMkJUE4ExOQ3ZEQhybp +X/fSSrjX5Lz54MUCWKS6ADiQ9PgmmARtGWxIcnkHnAEQy0Ref8EfMtvqsgTnu9gI +dOObLMPn0a434kppMPK7JCUG5R6xc95sUexyZGDTDSynJYhGwmWX10iWz7jrdpup +k1LipcVzSi5LmE/efcGJFo4UfeOcfh+wD+2IRgQQEQIABgUCTNsu6wAKCRAbSHfp +sWaSh8siAJ91oX1vi7kLBJ98UWMKbVKSJL5CbgCcD380dJQuYlUYmtBcVAZNKhh/ +1emIdQQQEQIANQUCTOJSoi4cSmVhbi1TZWJhc3RpZW4gRGVsZmlubyA8anNkZWxm +aW5vQGFwYWNoZS5vcmc+AAoJEKR9Hi3QHg4YANYAoJjhPnn2X9aUeepb6HzKkP2R +EJTOAJwMqNSRlUdSQUBfUC93xCAS6sUJFYjKBBARAgCKBQJM0rRDHxxKaW0gSmFn +aWVsc2tpIDxqaW1AYXBhY2hlLm9yZz4gHEppbSBKYWdpZWxza2kgPGppbUBqYWd1 +TkVULmNvbT4fHEppbSBKYWdpZWxza2kgPGppbUBqaW1qYWcuY29tPiIcSmltIEph +Z2llbHNraSA8amltakBjb3ZhbGVudC5uZXQ+AAoJEIs6YB8IyXXlWaQAn1tiQjM4 +MyZA2v4GlT2Te9p05dSTAKCRpuwROcbdZlTLygOhH9j0/1lXXYkCHAQQAQoABgUC +TNK09wAKCRCCeB3kbVlU+gW/D/9Utj7lCI9FR3vViba7MUi3QrP+mIIm9lIS6bR1 +HuhYT8XUDB4QSgPvSsvjz5Z9Iv1w0nAjFJsWUSyLPCuPCpD+v69yUTHhI8r7Td4h +62DcFPW4OcUzhtLjO8lngxRcFOtnJGHsrDwOFCUsPi/S/8yixxBnIyFmCya3O7k+ +GIVk3J1ULeFxl/6LuVOFnFsoqRdIlQF6H/LhZFqTR8ZvdeUISpZ0jVIwqBW8aHaf +VLDtup9UeIK2mHALxGmlT+yt5bH9xHSaLi0hT7HKig1P7AiELZplJy+e5DiosLmc +4ajiIhCs1C+AZPU8LY3trFATpf6vStMnNOOcbRFEaTZpGNWTmHIDtdXOGGPzD/6i +u0klzQk1UCzxQfGpdsMfR0UAkQfaKcQ0pfG8JKs1zpw2PMtx7u4qjzlraiEem0/g +YJ2lbuYZ5gJ1VFN2PnTjQae/vmxDpX1nZDluuvPRFZNt/eGBrOOOSSwTQW8z4Qqb +vtrKyUBK7T9OUkVMxnDi6YQZB0srGIloVYQ75I5dphJOesA4gHRDGyoqFMB9j+4E +1DrdpEwfmj6cgcf1MNU2b5kLPJQXitydBXKO/FIg5gHvayUV06pn4TVcewMSIU/X +c+HOjnhX4vP4BpYOSU4bJz4c9XOssnePF2qCzRGZCUCdPRIMy/+7MpABD44Owg2n +fYifb4kCHAQQAQoABgUCTRxM4AAKCRA/z1Kf8vJ6BhXHD/4zDnnROmQOakmNbUvQ +rcD+ZLiE/4bXrVyiG6d/BrFkng+wpUZaWPDZMEtTY1xpm2XBkqv+LX4QGwJt/m3X +279nRauba3rkcn6qo/2352ESfEpF0QG6NzT6GlhCdUSl5kuw2nIX4QqloeuG20co +R8ffU/nzfnxv5+Edd7NVpuxjJ73kk5r9RWo1yz8l1HTnAruezga8LFwGsJpJB1KJ +Jp224LWcmnP5Fibt9/e124KldY8yNXgVKdNML9ejElEeAJ2PsSn+el5LfXC/k7cs +J19/EcIuw2rfYfYphJnz7pPuDqbw2XxII6KLy+JpXNalc1xsDbcq3aqI6Wbtbz+5 +zjJaZ1sXEj+Uky8bc+HogscJYiOAzjkXKpWab4njRSHxCL7pG10Om2oNZuRDNs4P +StOhbreVHUW6VSlCl95embICTRWfEQ2d3NX73DxhVZVsEiGhwPdb9BA1Sy994QKi +8KB5SB7jgv+M5UY70Phtdoblrnq4iGaEFvVw4p9szfWdkghCw8rI7HHMkKeU3Uzp +QWs3niPk61WGseWFjJGrs184dAOTmzWEthPu0hfyaMYE9Pe4gr58jG7GlH7q41kv +EBczVyS04wPQapFHCVYFhhLfdF4TM0dmW2/PYD4MULse+5ko5ZMjQYWXxEcS6KiV +Vwtv6RywMOKzGQQb+yK6TycILokCUgQQAQIAPAUCTNLNqTUcVGhvbWFzIER1ZHpp +YWsgKENPREUgU0lHTklORyBLRVkpIDx0b21kekBhcGFjaGUub3JnPgAKCRDqTcrc +Tcqoj+ksD/97lFmqIfbJKNxGSACbAoR/CmKLEy8bHLWpPcm0e95PDKC8byDDab6M +cADwsECHZaKgHizynRn1OcmBSHVrcA8eHwwBHqxV71Ocu5M6IhQ2nU1aW7V2+d02 +8XiKich++KUDqtzighIjvOYTBtuFAl33vdggAY1PEl57UsPWy8PxNjJW0i1VMaGb +oOw1lnoCgxN99VkuaKrEefL2p9xUp+yBZItEKJEuSpQkbNp8ANkHAhbjJrmA5shY +IDTlsVqGADMt44cw0ugiQtqDwWjo/bXwZzoFWcC9a8Z55bj4w+atrPzCUsOuKpqH +q0DU5+SnvTHLzXoreKfdRq+uNvfczRjx1AZlft1hmr0m0Y0yw+oktNRLbZzXUAJC +5P+PDkKOmb82r0dFtF9uea2kX1gsCEP55dUnKk1Ego/gm68vlxLP1VnaLPRgLpKP +W/mUsnuTY/7tmGzj2XUhAqwJWVv5rhS5/UaqucgH9nXnaZIrvLS9SWu3LzZ5SLXK +Pw1ir9YZC1pTPrtd6nXPnJEffNbuhKH8/3A3UIt3NVEN9oBxmJiof9jRBWKyf1DS +U13aP/wGmCCOiU7gN1I+BLMM3ZqP0WF0Mb6Y4mR6cAFHY+Ug/UjLX21okPE6djKG +1B7UeGSUwJGcof6PU67dxaJfUmk47+DIQoOb8aP2whFZ197D7CitG4kCWgQQAQIA +RAUCTNK42j0cQW50b2luZSBMZXZ5LUxhbWJlcnQgKENPREUgU0lHTklORyBLRVkp +IDxhbnRvaW5lQGFwYWNoZS5vcmc+AAoJEF762f6Cp/vNNX4QANyh0StE9iY6zxHO +B2/fkK93itUVxQx5VsZ7/FkWs1Um01gRaDJ3so2VYtGJoH6wFGKy29VWj2zNLhDv +7VUUnosBuasnZXgcjXCW6OgEg+t/fnuNXAHXLEIaqZsZwYgx80rJEMIAW2NEhxyd +zAj3m1gOf5urOqPpyDKcyB1VA3AVKa/08K6aS2Aa2xIZqt0ghGj3NVPBgRhkB+MH +XmZypmbhRVZZn6bWXs0lhYdmBruljW2u5fgHJIS7Jdl5yvz3DaF9MizzaHvYBDWC +3w1hbdE95cTWhPp8dRsp0sbJAzPHf3BgkaAP08e/v4txUmqlSw4JfxFecWt0JV64 +qT2tKotVQrqIeMOgimPJ9ovhfqOlAKBvzJCBZ6T8d9bcs/xThqCSMPaQCh+PiN9T +7/h8xxfG7+gfGP5fwOOCEOVkKFi+9xMXye1vx4A2qWh1ScALs92GvhMwy1PYoLfj +fsEgeYvRGtAX2TMKkyOsHQMqDGOdRxb6yFeBMZPQD6SQaNHOt6l2gIqstnTy9Vk+ +I9MUT3ynmSX/rkF7YVdPkDJP6kUAsxI3rACZrZz8gN0SIH8/3+WaT39+OQXVLleP +/BbkKBtxnopi5De72CTG1ocwJZz00ZvZdi1/DvElLs7ia/5IyNEviCw7m2EQdvLS +Szl2/Py3pYz1/rfmQkC39FOQ1neOiQJdBBABAgBHBQJM0tGrQBxKb3NlcGggRWR3 +YXJkIEJlcmdtYXJrIChDT0RFIFNJR05JTkcgS0VZKSA8YmVyZ21hcmtAYXBhY2hl +Lm9yZz4ACgkQsNmRtHxAhzdp/hAAtF/zQVGiDrcSQuuYGU7Ez01J2Xk/9LSZ819Q +3jsWopdQYzxGCmK+V8plEkGLIcM/jsK+NLAhZVzt7qg64vy3MTQ7anvjYx+1+mX1 +Z0p/g/r5IXXQ73Deg0RPPEtScM7ZanFlBUTniMEkZPt8qo5CZw23MeP2E4fl3UzH +y1vt0CyB1dOJjsy9XPXLX258ON9IBnjS5s99fKqnCs2k0VFyNkOlsIdWzsvFCoQl +7URnEEUI4OrrvftxQHouql3x2SxE9K7pIHZewg631W+UXuH72BC02kIXrHixu7yQ +IE84fLzaptZJWZ9Xgoigk12L40ygMQbc4zbRfoVYGymn/jdZ6W/4TG9ksq8FHFi5 +eZNg+hv8YwFabfYH9cshjh1+ldUbHKE1YbY5TpXQ9wNZOu0XHMsvo/pijcptUiC8 +yvmeP1Ky7dyJb7PkoOcQ3cjf31wGiGP0cgDhw1FbS14g2OI+fng7Ns+9LLOZ34/Q +ryK+hBLppEdAnLgAvIZzyuydK6KbdIPEzotffoJJ8PfEPoYa7ZHZZq3fJTno+DO8 +mhEi9V2jHkpDZDTNUkRYEIevSnfD8F/44bjvZHUy63T9Hrr+DTjqG2ucCDZeAkaM +ue/NRXev53RIJ8AHLTUG2dbfb+GHfC/OkkwFe64ZO0is/SucfzHqQArAUB5mo5B+ +RC0o9huJApMEEAECAH0FAkzStCk1HEppbSBKYWdpZWxza2kgKFJlbGVhc2UgU2ln +bmluZyBLZXkpIDxqaW1AYXBhY2hlLm9yZz4gHEppbSBKYWdpZWxza2kgPGppbUBq +YWd1TkVULmNvbT4fHEppbSBKYWdpZWxza2kgPGppbUBqaW1qYWcuY29tPgAKCRA0 +6nbmeRSFqOljEAC+JPGA6EtNP7fhaBEuLL2dhgTs4vPGvWivygw4WKR4ONGVEMBC +QQCxafRxXdUQEjvRTxxdnI/2S7VpGvQlEjSAPkVcwuX+lwxPYb/7L8D78a11AtAx +nxN16QsDBG7s4m+aBBfjn+keQ1lIdScVqU20ZB4y0qrJb5Zv2hfaDUlg+99VS08V +ohymSFPEFzUWDufyCC/nJbPnrKZppbBHZmJT6WZm8y0i+oC65ZbRCxaMV8FVRhcm +iafXeZoC/SURf4YSX5tgI8++/Ydwzxp2wxI1NCxKzsG7sERjLmtoXi9lrDLlWJnh +bO5Yid6/7EXqzHjcWmUqag6jldJVQRjUR8G7Coj5zUjuEUZRlTM8tllrWLLSamuK +hyk1q+UB5gDTIqGDpFxj/SvdKeScL0fzsCmnroaLMXtd+QCBHmEk2umA9hb2N3bc +q2Ht9+zZ5av1RHkNdT0L7l3TiFgyP8cx/qw5of/ZTQzcvD+Nsl3ijShyvihNHstP +YDeANCcHdRlnmH6fusZGGV9t3H8O1kGIGi2R4Pw6pUDPuO1BHfA11Ld2uCuVbJwC ++2aG8tl8v7XzSovCrn6cZW5oPxnT724UMZ1ms2ECMu0Re+4T/q5r1N93vmqHj2AN +Am/Kh0l4xBlO/W4lpVqmZUOsdup5mKQMLQWEgxBYLNgEqimt1u0kP1qmn4hGBBAR +AgAGBQJNJK0WAAoJEH4q/cwONxoJUOEAoI9DIpUl7gHypVqz0P+tyWxVCrioAJ0e +WiOrsUygqDUpDl2Nt050piF1LIhGBBIRAgAGBQJM1CP3AAoJEPQmjufy79DwdTQA +nj0qTVNFNlZowBK9Kd1N00InXD1aAJ9kJylYaybYhPt23ACM6kusl8lSAIkCIgQT +AQIADAUCTgOM3wWDApIJwAAKCRCMleyeQza0SCGLD/46iT/p9bOgVqY0qvmLztka +jJsnQt58C9H1iQsNHR/dO9geiDtwBPYI3CqkuesZBVJkH3m+wK2eXILd47tvnq+V +46utdYMqiZteW1zkKGjKrx6waZvH+WnEKeFMioRBy1FVWRPlVoAPPjyMy+LHP6O3 +hW1As1o98EUO2OeUVm2wB6q0x/CoIBhB3B04Oi3SPB0GHXeS3spWNZ2L2t6wlbVp +W4OmNZ+iO0dgGmbxH7rjAhjBwRfzaem80sPH6hcyZas6S0MDW7TM9gL1Q28NQT/y +TZ/yIGRTbus2pIsd3oFtAZgZSLggkQKHMj8RiCtstEXHJ+zBi5fFaF/fJ7+H9piD +KzeRnPgtzF1uhZBLJk1+LxS1oJpFQziUE1BhjJz+Yo8c1YssrY/6PXXWn2f/FkR6 +4yQ6Idz1bM+oOwQLz236aI4lM5hHTqg4LW1dE7DHO4M6oQC08IArZaOYcJysSWMJ +RiqkGOMU2SGorMP8toOMyFIA/AtJXuL1sPeCJsNQRdYvjqK9E/5hp876Go8TmwRk +q13atCN6Lq5Mztp1X6wEgCTaEKjZWZiMEMjMHsltLTxpFrg1Nud+TqqvP/jLTIIV +MELxQptX1XNx+x4wFB5RfgRI1eSKoFxiqDrdfIoXA33/cAMR92H/TLn+DKrqV+jL +h6LWgGRLIHlu81YVDtdSLIhGBBARAgAGBQJOvCRSAAoJEAsDrm5OJFF8ZbAAnijm +8R9IBFruKm6dgtAtNeb1zl6SAKCmy53zCniulyKX0CB9xdLcxnRBMIhGBBARAgAG +BQJOvCmzAAoJEKvWMuzE/JplVHgAni1gnNV+TXRf1Hgbd5jljJ/pl+sAAJ9jScDd +4xk3PyFh6u3M7yevfL47N4hGBBARAgAGBQJOvE7tAAoJEC8+XTEfSeylrQMAoKwR +cQeCGc89oDGga6l/fMmvHar1AKCNhI3x+P3v9DQsIfV8fiRoVIFPy4kCGwQQAQIA +BgUCTr5o3wAKCRD7Yz3o9cuua4/0D/iTDQFDtOwSW4ICZn3vbmbJVbyvHkqPxany +6XoUpfsMrwoQnwLCwDYpmYDvPCpORPHOEoWh/rkMyFOdTpntxsGxboi8qgK0hSej +pVFFyhtVLagmSImbFiZeK0BghhE5+3/ijmv4NBeoBdL4Mww+6+DVMMjAGHM498ev +m2+nsX0f8YHVxhxFdoLpIa65+KtZ34Is1giL09E9fz085VaJEIjXV9RzgMeAexH4 +VXFkDlJ1tgHZujXbaAiJtV+k/JH3J6l2rGsLQKotb+xxAOdVX6b0xkO6YFsEvAQM +5zwfdL5eZ4Nm7Krog+wIlWVc1Ofv365S9Qkq3pk75xAAB/lTWzVdrxCTLvOxW5eq +VCu9z7I+yzs2ykGWZuTV2QozWRREyQsBR5A8SbNJRs4ShyKtrD7yGkk3cKhtcghM +8Oe4VjhAR7hzrKaTmwASF+Z8w9tQGCqXX7jtDF1rrzxJTR9AkYAorjN0vdmtXo2G +SNCQJs+Q9sai43TqJODXTSFIMQ0ia0D06Bgs0SmIjk5VhmgsAQ3i8KM270tnBcis +YUwbHFDNzc+vAc/pRzkoYyn6T8iCNZq/wEHwukueFawO+/HxgmnWpVKcEKMIkt5S +qlCoOwFsoEo4IZuJeLj0B4rT13CGBylgHj+JwFpEvmNDR4NfJjurRTiM+5Y+sKDg +4t0tOTBYiQIcBBABAgAGBQJOvF9aAAoJEJqs+1Y1Ks92jmcP/2Vt8wxbMi3Ke0yR +3l2UK6ExTiePVmbDfny8nqv7Q1TeFhDyHkyc4RhB2u2tKjqq2ZnEKp7tSXFW7icV +Gjpsz4ZuEzYEAD6tAUP3kQHUmzQ0ZJlqBzsqk3pajTYML+krpv6ghP9arLRGowcm +Wbsi1+Op6BJZIfTXWqTcIRtQ7VBTXRkFH0ori7tfh7KhiQFLRVOXbIg0koxwrFq7 +j15gT86qvIp4tEJ1POZfPY+XVrcQNBj1gtIEt/iBdhw2p+qH2f5pb6S/sSWn1vK2 +k1SUwqS5GnkWh4jPEgTXMxt5gPx5je6DU289oYNzXgN7DMSyFLtkFe1dCsS0WtHy +4I69HS28R5kVYIMOnT1Iq7ef9VcdGgVEyWe+46E2O/iXl3jKJfvOJ3vh+lmYpwrK +eWXeryiirVTPPY9O1vzNfLEfgAklZvTQZ3ypvVulJny/jKkZgJd4uxPj3uNcPwwB +9AwH/HY06Z3BaC77/IuhFqQOvS/a1lwfXi0WpwEO17MzcOV+tZ2AGQ/lTelGBM2b +YCBzFDD2PXhDEYhN537hjM+tVYtfdLcZih0Up4Nq13CsMlQjNDu099zaX5Y5j5os +RPS49TzGHRzbB9e94I1viX65Cm/Wosx9dAcz71T0cFFwNkbH9XSqTPnuD0cZ7EQo +0dD6CGxu0QmhGH8FSmja7KNf/kmliQIcBBABAgAGBQJOvVKJAAoJEE0VQRC4RQjs +WbkQAIWh3uAccrqd3pRySW8JJNRSiXQre/OPvgukM/mc46DB9rgdndILZkeiGDdz +M1Mc7LEB/yCyLFzZstpaVQgq9sLy8bMqkJyIx+a7eOgu8LjV2pRYQtGgAZQqmDgF +Op9ZRsF4fcdUwRLfl8ZSju3w4s/3mkuPQpGPD1ZbL1ixyOhEp3qUvdOUIrHBBtWe +Tedv/XhRTBzdd8KOImcnyqHNMdb7U7JSWSdF+CWq9uvU5LREaJNvV27+dtJzEGXT +d1/SpPDhNR+9AYsy8Y3VhAQLZFB449fnTvmtqANcXM2PBGOm6jN20olDDswthg7n +duK1kfJ7TROmMApAFR7+k/zqOmD2dh0pJGg0wWICW0Q9y4a49ffP9hTiNPCUCEBZ +pDN87GmE3BkmTy3bVKeKNfyT7wLhAneGKFlJwVX4f1eF+V3n5iGow+Vu5XqjxffN +HErbVykamVff80BSez3N91v1woUd3ky6pZP/pSY9FFA3XGgutfXGRNYKcMxq5evY +UhPbaEsz4ozdD1VjITP9XcgZF5+K7rT2M15fMVOlN0dQaBASKSJjpy8gq5lNVyYu +kCd4Q2a64KklGiDKISEKquijVg4mMmx5JMYKLjoQj7g0FkKAC+cwn6LRCdnhqFiB +/f3+fZi7VvZxY/Hia8xzeD3ak5Hs+4Inj3CReZrfCxmKDlSiiQIcBBABAgAGBQJO +yst+AAoJEImh9lEqI5wsaK4QAMBTfRkRKOryFif/5XBkPDYeMW6UHLwratUZDfHp +CZXPGklGJwdz/H44WgNkklmuxmI1DRFkTQf4LzEaxGOnzLtBVDG93WLPOZvQfuVi +7wg4J0HzybQwqwjWWMOSEdN100rdvoC2AFot6VdbxrQT30ZwK0qqd53h5GLDA326 +QTOXGRhi4Si0FgNkQq1++V890Yp03kXPFOiN6HiD/s40NkKUzfYD1OvYYK0/R9qD +55arUx1nuRerEp24zTNOjT+33gDrGrCd6l/ieDMkgRCdh7G0LN+gHcjUN8f56/oW +TfPHzeNI1RA4hqGn1YzSUXgZglO4P5RRMobs/FdbVLFIu8nFMDkDQB9wIHc1xPGr +6cj5K4uSYrgvhXYDDGutA0GSuEvU7M3T7bwMEAIdql+oyYswlbbhyI6RIvIJx2PW +GqboBVagx4wqvWCjJjZBDPmQG+pTpSGtwLz+HvLHZ2JczpKJmuox3qkaJk1gAUDn +yvf7Mkxe2snk8fdnhkgTBb3dG4EbYKK95/rpkiqW/SN71ZbgFkmBkyJzWYhR45z9 +0aSo1oeScah0toTYGb/8BOq9qP9xVK1M/ZxGVQq535NgZSXBBUhP0RAg0Xw34FgG +HVs7n27fClcAh+BUeg9T2BOdONOyFzXAN2rUJsj05Mpl50S4f5IRbfHHTFljq1T9 +PmbHiQIcBBABCgAGBQJOwWQKAAoJEE68DJ8CCPwRGAYQALDQI8RGxyBY90UKBnwe +Q/mVtUjT9BgL+DPJ8Vmgk+AldFyStiZViKi1DGNzkHE1aYj42yZLdp55W/SfLgM/ +moXtz31uCX1t6eCds23JKxp1YT5I9GOsaajYL99vRMXhnhrYpSJ2ax3RYIEINv9o +dAgb/QQLHYWfzf7b9luMx/sYV/ArweW4UMqsb6cfF1GgwvpbMAHBqp4JPr4BvYdA +Jn9U4fOK9RcztS0r/NTBbiWrgU/WKVOkyr9gTfYqktgcpQkI3UzOb+g4kWv9BrDj +C0+VQ+cltXCN2HMurTLQL8M0wKGeqqVxFk095DHlDDuKOV0dLC8eULnx2UdAWvdS +Pkn5ohN1hVdEzLwsp3bpHjqj9yoMiyGIBJcmnEj/4uJyB1Su0MNQBI20A+zLLONu +Ii0zLeLoaWpq2HtEFA8CvXNfMfpMzp864a09PtRWOQhdt5pHMnDgr3oWmJsWsPow +o9ah3WMCc57tjPP+XvGYqbHD0KrKmycOJuNidFI1UVZH23afyPG+IOAdGDevHXiu +Ue2UHGH7UJmsVZO5dHn3yUzoSoMMhRW+S/CpGKVX32VizoHgPzTCqrtaW/lnD6uS +aMNuhlIPRMw3/GOrTXzjb+pqkkRFjHiNL59eJW263L4E8guvCUMmHYy6pltkiX6y +GDfemnN3EKCK5Ut/sq9Sn9j6iQIcBBABCgAGBQJOxZdAAAoJEARUjz2XyHeQojkP +/0nUKMl0mR48juHl5c3vGp9mt+rtfqBABR4+OeuuysKhX+0T0OtW7M40mZEJB0YW +8bxT/2HH5IbitMmgSLAhkQaUr/XMWX2fHFfvzMLwZMmRtaIjB1IKE3eZgraUpmZc +weeDGZxqOL3ROKhZtzLms14IOWkERhRVad4oj5sAKV7hJf/Q8Gep+lDmecVST/Jq +ucmKdbGry/0rLVeRp8snbKygLQXrohRgATyjsbP3ssXU/Tz9ccWvu8Npb/rbK6aV +rbVcF98OcaG55QimUty1eSq3DmVk1adcVe70Sj6OL+UACb9SpLI/AnuOgiwIJIHe +pVs3bM9FH4KzJ87l23JQW6eKb1F9dTOwjTpgeaAHGsR7KVl7wyF45E5kOOt9mT+X +CzRGnXVmnfaBXT9wbDj3kUvSgmRpX/NWCVCTqK9PGUwIkqD4pFYpwjH/BwB2m2Uk +eGeLQWlVFf62+GXxkAbTzuBTgQSAY8kISrUKIiKBbbXPk7+HGuxXbKCa/SD9dOEs +HWVuiiqYx4260PyeXUJRx/uKt8ehCQ5l6AGexIH7VXHNfkZSNQ9blKRHP3w1DxOC +tqnMai4/+3hxEzRURB5fymOultmhEWbc1wkR4TjLq8hlrNUECf8nx50iOHelYPY9 +TDHcZlKhYj4JgVafwpBlWtJGRHcAnnRU+X/7P0D/5k9SiQIcBBABCgAGBQJOzZfR +AAoJEPVP5kgIgzWpUr4P/RF+F0RPzARKJgm9zdY3V0lSQyEKIfHl8G9f95vWcIxz +Vgb2W+eg80d5b07jalpvwFsqtsQqSDZH/REu0bZJkHuHCNWaKy1St7FvN+y+bv2C +4asM35NYvO8H41Jmjex+2pE86mDI7U6NRMiyzq1Vbx+PKhq13idgGhCR5dnaX27R +hHfjvfL7aQWIE1QRYNiHl6TAjmSTVWfRIJBZ6QB0ldw7CVbNnIoNhOd9gU4E48jQ +rvBaUwVcQddesw0CfnxcdywvH0svxDVu0KImilfWWd+q3bSrtXmvIMDgAXoQ9mB2 +Es+IAgypIrD1+O7PDMCSu2o5MLTRph7+0bjFYUH+eh47T5OMrMhGOSArkalROzZ/ +naTBkMXsbh8QJEdrDJiZaomyQqcksF4SXFkEWBOVnKOWxOR/Ki80TCXRQAaZq/o6 +/mo1DMOPXVMTJrE7+EV1VGcUH5Vw20sL7ZA3WSMngtLYG3VA1ntO4oTrrTtR89Aa +XLYwAWWJCOr4969eYy/xIeKk0EsEI/tbzY8n+sGH6EhiGM5fsBqHSPeqR0mpJGfi +IGh5D2EP0fuMBznxYy/9+NVDQ4mad+16UMaV4lUG2TVoVofvVa/JiHc85VIh5B44 +eemGjnQxVfadPkbbiIF4IYA9UC5P2xhnOy++axdxjrAiU+qIsSp7V0C63UUDPwBD +iQIcBBIBCAAGBQJO5uJeAAoJEMaHXzVBzv3gEscP/0aN6q0nv8z7lEJQdqOy72J2 +oYFCbZbNYQEGJdEirX24wa+Gki8ElQGB9XmupcVejq2m+J/ypPBzS9KKUonLxZtF +FBQAJmcw+H5rOgFaSq+gyxGZMLmhBSU7RP4oYa1fE98DYlyf/a6zcnCEwyfU0zhy +Z8cfItStoF0wc0K1+KTa3d4yr+AwYOj/CKS/NyMwPJORjtt4PpE5fo4VC8FQvKZ6 +zwS3tcVXoYciEhD70E8sfBx7rTgNHnm5I8bGIauCcTo2D5WHKq//Qw/3ZdibuX8c +G/lgIu5AYGSNo8DIkqB1ayr4U6QzRJgSEogcBKfpeJid/jGkf/HLfSpQRnY+Lsa6 +CzPBLNerEVMEXIFtbxyX9dy8UAnN8TgjVc7vra1NCaQCQOvAXq0BKlIfHAnwCS61 +naGN7f74e8meQ596GtsnNsjmeviGaVrhCCeeYc1qL15WKjlCeqAH7JDESlH7Ioqx +8sg4dofT4yv9tBFWpmvLRhTYnjJvtEj56YsOaEy6hGGI49hDGGte+UbSbQsJRxOV +P9mM9Rbhjl7RKuREHIFJVhvNMHJ2Ch+2PczYWqG49EPl63I2/SB96+3982JCfK5V +f52sfZG8kDv/6h1a34Z0fRCJkVeLdrQBmfsaLoLDKioL2cKEtxtuJVSnFS90hlvd +MCXcJYJxysDNFjPdPBgFiQJABBMBAgAqAhsDAh4BAheABQsJCAcDBRUKCQgLBRYC +AwEAAhkBBQJRII9HBQkL0jAVAAoJEJu4Y7D1G7iK2McP/jYqrS0KdYp8ljvXV+/o +AHobtCmmclaZKHr8qOLSIxUcUiRTCRXNH4sn3KGYI4lpJc4y/HAoSPbRbrDj6rG2 +CI6P+VzgLcg0YKzu0vELCsmowWbp2E05F4Gqusyfk7wdjofgCInKLG+6xCaf74hU +bdNyb8Sr4uo+qkAwHXqeo8SwE1hG1lDlCqhpaHJF5ms2EEyqIZjcrzfKvvvsJhZj +v8iu1nAO1AlwGxfNVoxzvGTTPYT/PfpG1ZqZVrAchgGwLhbdRx3xgiMznUsza2bs +7rF2UXesRsjGxfI87PrfEvNSszkyx2uzB6PKT1UwUfvZH1+37LH0/IxTYyRBxlVg +PpIqp5UX5o3grpXwRSqFxSLxSyVHnhH0pe+2pLpFgR5a0dTx4CS5RBcgWm4Wkoh9 +W78qyumJFE5aAmeZCfKb3uZu9jzVcVi6+4rjVJg2q9QJzfbyQtzHwbF3I2+FcEv1 +hcXSkLoRAbCIta2eqRH4z0efY0pRXYr1xHM54J5JU12bGj4oDqJlKMy1m2hxlI2S +FW95/SaDLesl65uuz79DRlwy3Q0FqYaUD44XRtQ3AGeGltvM+kPPRO+Sq29fzcQ5 +WzJU3A5yYmUgG/jn3acpjhO1TaHJvQEMXZEPR8b4nRoGzosJgTKH8A9lQhqCgxOV +kItTt220wNwVbiT9z4kX6B8diQJABBMBAgAqAhsDAh4BAheABQsJCAcDBRUKCQgL +BRYCAwEABQkFo5ztBQJK8yZuAhkBAAoJEJu4Y7D1G7iKgK0P/ix3+2ytJxlD55dQ +n2Tf1nQ4BiQNn7hEjL8j8n2OyZEWIMiB8pgeQmFDaiwBQVhuadsIBO+Rwp8bhZ8S +Ah1usxRSEJfNijMeVIrb1KHQ61XxYcRHCYViFfB0v37iTyIyc0y0tMyEvcjav5Qs +cEMH9HGPnKC5P5z0vXwZJjG/ZwiLIw4wNMA/1xMY0ubifQC8RcGMQY/2VAn2Mo8l +5h7081HfrUG7hDGkQiIqLWeZehbxRNBqXevrqzTnVQ87Q2Q8t/xQgjbMvl6T75l9 +rQqM8LYMLJjdlJyRSFmozy0fACrhhlwSrJFXfXN+AnQed57fHqW3FhxolDTDf7OD +jczt17rLoCq7AZ3o8iF+9FRaQES/LgeJmwolpHjPMsrz7HJ1h69zOBbEZJuNDkfm +TN2T0cCZWA1cmRaXRVv2I4zUBmBEn3R5HJjoWmcpVx6vMAG1WMtANWSdaqvZHgB9 +zbqWL76rafMQzstl5q3ZScr7g2E2Sp0F4ua+iH3HW0uuZOZMYjpkjGO3MXD6LcCW +dZ48PjjJZWIKYIEhf4GtTl2fhi/hSYJybGsytWOg2qlATCEZe1N3lBHM/VbUFQYE +0GH1vdhnD6px4zPGFMY0MBBKKdmCSJpmY9jaVnHJEgpUN1BCqtqusFOolqclbe+y +pxTfL1SUjhQSWGfYMAzs3923/3S8tBxTYW5kZXIgVGVtbWUgPHNhbmRlckBtZS5j +b20+iEYEEBECAAYFAkrx/pkACgkQsr68QBUpJK+GJACg91JqNc2mEePLqAJL5nZf +cCIfUfgAoNWyrSnCEhKRTzOhD1BxZ1G8zajDiQIcBBABAgAGBQJLPcnoAAoJEO04 +c/XTJiciCawP/2zNbZ/O2YuVMT8Jyauw4oC3DFi0QN+ilXjCmDXRPWoff1aB7KIt +GTbss/kmRZ4yYUwsN65g9/39R/uR4pV6aDLAGHky+3Rbze9eRJeZZn86TmFWXNjk +5hgPgyu/RRMxVW0ruYWguskapzlZW8GG0jvlMOzRxgN0gR5m5cT3dEUyo/Xkxx+I +1Dsd4FDwy3hT1fEMi5kFO1gcxMyoXYGOliSi5v30tMHdVq+gTpukHZoIrK5h6caR +nMz3cJ4pooh9KCtTDT5MwFB+R8PzVocKbZG/DiJTyFIc+g8Bo/+YJtxx2+4wVpKi +9z9Be6raL5BHRvmuIPb4OerbR2VPk5nrPu2SKCUUiGy3hzTQDupd7XoAlFHA4H8G +Z+WRAASEqHlhmAL0/1j2CWQwd9iViNyJFmol6EDwAYgYsNk1jQf+/p3hphpCk0E5 +MCsF+/pGajM+w6oy+aTbCCxKawWyXJwVBxo+E9eljHISqeySYPBRzOKCkcAnmxzp +xFqmVH4N0BaowYeN+ta39k1ielVzGbUPdx61hxqM9UHbrISnYhxc+3hGoAt5pUvO +Uns1QiKMZux4qpu2hTeCmGaoBmUcbRCIodmpAvVXacfBbTUL11D4slxVxTslruNe +DaVpsmUwrhun7I4tdheoaiau1KxvTTKaCFwA3QGAIa+M6R6GDRUQFrTIiQIcBBAB +CgAGBQJLJUYwAAoJEDF8bfg8dwXPyasQALVodGpN983ope5ZY90q5+pmfbbGQvej +DL1zPMhCkJM9TJjEtWVTUxslli6gEkZkzpQULbr9uMEsCFv3l0BsZhPqAuiFCyMv +6LxJGs+TRS6q11Y/PiySR2vMHk4AYdx9ixQDB26MVlQEUrYe0rQjiCjTEO0D1nJT +VpZlynHFLLNuG1FpVPLfRbNNBQGrMMnNdc9eF62iXm+Emy5odzUfKU0hxRyjyhrf +NQqSuh4FF6fbsNGJpsPX5ca+mmMn16A1DQ3jvLmwHLn/GPhTozwaNKli56OT6Zu8 +AY730hIM1fANFoPGtuEdI/2QDy2obRE5jcWX1/U7t5DFMO/pT3fS7EhqPhWcqPqO +g3sFeXVH29/Q1hjC1UqOI9qD4/snPaFVAei7rP8YKYiAIOIBPiAWW5nfiC4BFhew +kQ4h1upl1ZD2QGKOrHB7PAqL4sYixw+R7SWIkeVDSTEJmq/CxmBM0fvGVlk1TQbR +ZGqnXSojgA9sP+ZQdZy+NtPOxx6YpNzii9Y6qD9Fmu02F3d2GZVAmvaUGkSz2ndY +arCvNhf/Z+uUlkEn20KG6o5n1aqD6t8hjD5izmGFYcPl/wfVugqOATn18NH3hp8t +rBGZAx68ZX4nS00TLnmXji/gvC42hZXbalDm3l6p8w2/8oWmK5Sblcxq/DiCeovd +zVGsIXTDcDDDiQQcBBABCAAGBQJLFDXNAAoJEIqviNbYTkGuR0gf/1EbrQHogVgR +rJT3uWBsCGCarbG0VAgJtjhVAA1jX2TnLT/LefbPlrJjRtrOemuOncyO/qcc/1aC +IVdSnIh9HEKqabIQZT9RjQCKyo7wU7GAEW96SETudwJaRQn9by2dZj8hOoxSX+lx +5IHFsJzGE4dAK+OQDQMt0bvHvsS1EGAibYdcaCW8cNoUtMMmC0j5WqapV2arOATX +Z0p/go83rRCPgBQ8Y8XsPBJrphjpBhzV7YE7P75nzf26HuLHWQmVN0vDEAwU5nDR +PppBARwYXE/zRGQMTN0qHdNNhyP/FRFocTV8Z3hbE/7u9+l9iNkPcQWg3KbHTWn0 +1UioCxFTCU2CdJcK/9ayuSUOCOOsmnNr3mNw8fEP5D16QwQGI7IPoJwRr4sCwa1t +mbx2QxVGaNI6Bo/uLOvRDwxnCkZNNT0tu7eHujFsvivk+dNRygxEHrW9eiKCzzkN +hoQYCc3Wmgw9gTExcIW1JEXWW2ILsHXd1O8JD3aHjtRm9vLefNzIonaZRugJNC3w +NBb3cD5u3fkUuOui9ydjfD/Q82dkfDKIyr30T5bEhrHZjsjH9Bl/LMAwoVKGwXTf +n72v8tfoo5CzuKVlEgnpRVQ+uKSKfN/YL5Cb/3xKXpD/EgGPMO5pnQaSjP6L/eIM +618Y58x/Tn1fz1jc0UR1zCUxLmogkGzaRyBHQzITkoouYJ3iM4VJiiSI4S18eFwR +ZKQSErneYwCKUYNEQRT1I/kkHZV1Unk3m5rcD6JiS5e/Oihs6xvPZveGG4maOQo8 +NIEoPjwS218SJVQFs5TU9aUSF2BO+PNfrTDt7OMDR5ltqRvUd7iWVjg3y0LFluz2 +D0Z4E7movViMdS8UgKC7OSfKuhYubZ2BxDln//djzGQvCrRdAbNOgNa6pbldYmIE +iaxEjamCGkTPuV3EjdQ6we8H2WpMUCzTQ6L5rUyaw1Qq+8UlW4PFLmpcYkj9+g2V +v9zQwH81iqW7w5wOrqiMksYacKIX3NM2F1G4C4Aj/cQsnQ9EuqPufBEaFjhtSUym +aQefv7zSG8u3sL6KVg0+CMnvGrjNEz8vQBWDcOC4Pcf77oA0Ao7l/me7bsxKO9Mo +5k8J6bRPoTjVo1wr8lLe0FViU1LGLKVF0SmhqXh8yT4YkSsLAHiYVcnYFTcpS9TQ +dC/VknQXzOSXA0Z4eNl4uEKnRQ9BsYkfQc4afYFU3hQ9Lq7ul6GyjPMf8QGNF6kJ +ZpJXPgI/c2g18uFmH3zE9jTElS4qt2ioiFBUr+wvu1QFi9nTeYue4to0KcdLXzQA +RCQUJV7VeLUbYRCgRjS1HYZoJVUI2gqmuY9pHBMNJC2uU8jBkg2yKoahc/51LE5l +r9TO2gBiwmaIRgQQEQIABgUCS6J7ZwAKCRCGC77m0fmVkLsMAKCuDuZOSIv74T0Y +TNWdr5+J3ICV9QCfRCZLEvW3RJ4W8gHtKfmiDWIl1mKJAhwEEAECAAYFAktfZQQA +CgkQGT8YCrVdmXfJOQ/8C7/g0FEt8NcQHuFRkbGrM9W/CF8rvocsDdH6e9rwLZAv +shkVy+5OKruN9IYsSJDXNu8XK5S+yAGqp2LH1UjP+G2dDzW5vh3AILfTW5SgJlhQ +ygTIbKPWKMhDwtQuxlj13uj5mPpUIwQMU4WTgKcpIzhihGuqdUvuQsamUpeL3NLE +JcHYCGRo47VAWnEmTiI1PMAB3wTmI4e5x7NfftQXeTPaMon6tA3cNkt/J+xxeVJo +Z4Sv/bSbD2pMa2LU76JJ4C3KQ7QPSTgMMYTBkOEkyZYsoIxYbM14TpJka+9mUDBZ +7i4oDg6rbngzN19FsV9psTsCOE9tFcLa/bzBqqryXZ0QdNK1XNYz6j7jxBmAy4fq +EEPRS1qfFOrc5GT7g082sjEHt0W8iosvNxKPav/29DQnlhyTkPu//lzBOHR3qdIF +7f2b8EkxPj7NkpTcgdFWCvQPFVzTdrByEwvjMARVwdQRkr86DW+d+iPzm5Kr+ZBN +zy4LUic43u5PU9AUvTbMPtJZI8qpY9V4i/F9E8lbcW8THs/6oE1aIh/TEzFFGEdB +TZD1JjYHMjJXCGTxBzY7vqXfdBtc3v4t+hXCK8HOsAJC318E8RrIwuPXV3KENVI/ +ds/Jz3cLbuZS3S6olf+3EEzo/xlc1wuwK1Rg1+/uoCCSzvc0DtC+t5K0xVonNyeJ +AhwEEAECAAYFAktfdTQACgkQVWu/8D8KBLazdA//UkwKVnNaL9QO4h6plQBFsoci +jpQEW3tL4UuPLa9Q0nV6X1NZKdsBK9HFuMdnjkksYByDcknYqFzOcOdnkuYBh5Fs +2LlHx+BkJHxAd23cbC/KJyovx9e0DkxFkAJRfu0db9pCxg9m03v2Jp8FV1GChCUe +xnbMQjT1HTH9AA+OEKVGc8V2AFzzfEqAfM5T8ex4SGBadISLaDjVLnof0F5nw0PW +ZIWhgQnwS7YiHN2UobcesflijE6Vaf0ZMQ/sEEe6wuNxFUlaQlzulXU9YES32GTs +dyC9HM/mtQQDex7O5prTxRFJekDVjE1rZ+467Pa3fB5X6naZcUa79VgKp8VJUXHK +wBKVwer7vnYyPUWbNFkAOiXONRGSASsTpP1cBIbMs5Hp0LPJDVjKaFzDXRb8cmZt +yxlEHWVyFUvk00CD/ykmJZ9mPD5jrsba9ACHTfB4CJkzd5wEffm4pw0GThiuSmkJ +7DMI2K6OAUl9/bbGVWdvwZEPEeffvLbPHfhTGxNjw9QLfGFAwnOdw2fnEhHmuq08 +/Tuh0+nHqFlCr7sSTjbCefOgeKDbMaZR3bXTkGZ1aKZizMx3ZVSuHjD5QKkubNkl +zVhWIxpW5BRroHVQgNhaROR8jAuR13ZVntZde+QgmnpirPQQcYesxc05Dq2Vda0f +23MdVI1XoeOmWSUroK+JAhwEEAEKAAYFAktfZUwACgkQUz3vFV17vFpitRAAldOr +AktkrVYn9HkaokKTjsFCOCNWpiGQelP2XtJrYFJqNs0kzxtefA4FrWN9xXCwJu3+ +G+zuFU8NWKq2UB2N/5BrUVPZFiZ889KjtC1j9x7SJADlayZdNmcPRI1g/nev7jLO +gUec/Dyh4zDxxHd2FWuRNPERfimpiLJ7UMxSsyxgDgUQHyu9g5ULB0t7wSEzEB8J +0jqENr4qbbIrq+padIjMZlKi+dxkvMDaEIcm1juley5ePehFDIUzRYmv8C22wyAX +QUsL6hvR6Js1GOAg9lauW/JMJeqrhkIeD3A7pIT4E49jqc6UeqDk6Ix1Eh/7ZgMe +Br7AyctllxJbH0fDQiTV6vuMXAa33f709leXhn2PGXkXI4OEVyxQIKOsLBOJdvWY +MB5Bt1mN0T+sG1Pktop/ZDXRdMAzbWHJDxxWqIRsPsz1NBebzHw5B97lTp7e3CwE +19HOBug6R+dv3HzLbCiWzxjz7hcIxBwT/KsSvpduUqQolSZhro1UhQt1lWuTPT/C +qXZQaW4SJeiKYpgXHK1w/sQIMWFiWa8BPGFcE4f8qa8W/TuOMhqIODd1e484UpYO +0L34wwiXoiY09/qQ86YzX2NAi1DT8CAGXu+CzllFdN78zig73n9fnhZE4MDFnB/B +kOezUtXWY0jIizn71yMyKyj+JDVtSqNem9W3XQCJAhwEEAEKAAYFAkx2khwACgkQ +4TYIihgkvcEjHg//YlmM3WXZeu87DRwLD61S+rAqK2rHekif6Xb7G7acbeXiWmaD +Kgoyk0o5UZmIrquZvCKFx3tEjvqpVLTV7rLpy/0S9dlNdgAd+QhB+zYXKNJ97JX3 +AwvWSz6SHOXo873z7ReI2Ph3c5nqYs9Am3osWynJwOv3KIxave8W+7z73xbuyUZK +pZL2wS2f4Ng9CNDkLIRW3AoeGV1ZIEdmQ6IqAtqFHTgI+oeaKksLbbGOS9TjG0kj +58V+TcFS6Myf2FT/8Oa5Zd/vrJZBb8TT2YveuYoa1oheoRCW7t0i/olsVMchK/vD +gJNAHr/985AHi+wbIal/vH28SMy3z/eTSCec339E3N7XFHSzipaUD8FNQy7runfo +zLgd/l2/omPBfLEjZhSzGZSpcnL9xlHr2M7iTVLiYBgGV0gXVT2V6f3jYfHUtBbK +neu7T50SBXX5I6r5YlEnjY7KSbOm4ixNkPRj+ExGMyOg+akcZvNBPinuO5I0XbfG +YQx+XqN3oD/3c28dGbL0EXUI/zb8yG6MAfbZL9vmm7bBCB1gExAcLi/FHcEd4gj1 +sInQD12QSZxJHpxv+ctJPDN77RG90fqqfoibsxGHX7tOwQebspaDK5DSU3BrzeDB +0flWBIZCC8aabQbUfykvRg3U9eopt+6Ny14GOrg1++WRttTnHASiCLkPm9iIRgQQ +EQIABgUCTNsu6wAKCRAbSHfpsWaSh/1fAKCFCR55YV97JMNHT4Ezwe15hIq0kQCf +WFcpcUyo4ZpWZ6Kh15b5rnxpmzWIdQQQEQIANQUCTOJSoi4cSmVhbi1TZWJhc3Rp +ZW4gRGVsZmlubyA8anNkZWxmaW5vQGFwYWNoZS5vcmc+AAoJEKR9Hi3QHg4YANYA +oJjhPnn2X9aUeepb6HzKkP2REJTOAJwMqNSRlUdSQUBfUC93xCAS6sUJFYjKBBAR +AgCKBQJM0rRDHxxKaW0gSmFnaWVsc2tpIDxqaW1AYXBhY2hlLm9yZz4gHEppbSBK +YWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT4fHEppbSBKYWdpZWxza2kgPGppbUBq +aW1qYWcuY29tPiIcSmltIEphZ2llbHNraSA8amltakBjb3ZhbGVudC5uZXQ+AAoJ +EIs6YB8IyXXlWaQAn1tiQjM4MyZA2v4GlT2Te9p05dSTAKCRpuwROcbdZlTLygOh +H9j0/1lXXYkCHAQQAQoABgUCTNK09wAKCRCCeB3kbVlU+pNdD/9BM8Oi/xVaeuux +DQ2Mf4Smv55ZTI1D4EC/BA/I5ctWkxm/xwEdJ2Hcd0Q6aPTNQlJuhzbnwRmRU65j +osF+NiK4lI0EfV55KP+HEO85v3IrjiO9H0xoV5/L7NDKHaPMEXP7RKMiiw3Ogful +u3SvzH6ZiOZ4ZvvkkFpMsiKJaeKIey0S8IW+CHDdFbbnmNbhsIyPv9XgHDii94gv +LbgtL/RaKEV4Av3wpYuCd8GlyOmiJlGZ8Z4PNwpRmTB5h5DJGPzDq1jPlBf/9avL +ukhgHWqFmGjpbRRl35mL/d7LbAramuSYoZREiP1CMLPbKMWxaYuT4f1Q6z0ykTNa +8zVQfeP40V/L4QtmNrkfgQxKY6TRByckBupsq9p8AJUZj6tj2csXPCm0REyBzkoG +ZcH/3PV2sCa/PAd/v+uJCT+mYwNdUvHImrG0gcwqgj4laewxB8QUrl6ghFWNsjvL +rcZxAX1qBvPftM4Mg1QihVSPOl9HM3kck632Y5DKAxgS9aqXk6Z/hvQ+i2L4PGKN +U+ubhpClk7J4aaLLr3B3vyTmg7vZb/el/fHyJZ5O5qh5d9XyuTjINSdSisMdTf57 +UldOjJlnCg4ij3Y765P5EoTEIa+5DLh3sHiX6VM3kHQAdJ8Fzg1dslxqhcmPVvLC +p9L8UJcqrYqMgSN6ExYP/rAq7gx8k4kCHAQQAQoABgUCTRxM4AAKCRA/z1Kf8vJ6 +Bu11D/0cu/nu3LDNyiyDSPKd9PTkds6o3Oa26eqHTZ9CEgjdJktqbZ6qIGaovcD7 +oawiHcBWC3GY5ZhV70JCE2gufOgBEz7pQGMqNOM5WiUowznwbJIJnl75KbHC+6S7 +T801HGkOdYY2Zs8zLPGJ/wzK2oYGqWgiQrlKUyMBGkN3bFPPPAJ4fhZhkY3Qwyz8 +j+D+CF0QGWlnHtgMef9mN5TSxtJoVRDZnK9voxvW0fP9Ro2z1fLzBc9zcvjTVYk3 +2c/wKSFto/ANgqmlHo4SSuDNoCqN8VRVuF4QBpdc9Hf/LAJFq5eKMRWWB3ABVEBF +2WygXtDGsFBb1P0raXJAC4RkmlbRqp5KiTnYATlQ6d60ApCIT+Z8LewrREbcmJyM +5MAH3pVPd+OhtTnSXNSHXfGak5E7LSkCnchV+NoaHPXHy0tXC3O3d8bkWk53RsjE +OCtCFWPcRVdWauNQE78SqP0VZqeLl7PDzMe6MFV+kB5ELg+LR7UtLgSbQCmJXpOe +2TDPl6on7Q2kOvT22nUQLfuaoXvwTgW3NgIlizHSkiYc+N/iofTFfJbv+scZj7Km +PnqrBpMx2sdxDrYowTvCd/0gsgofH6wI1Grd8YhBMuzIZ5qDqHNvXS6P8ClhzZQt +TmYBKa5C5/2deSmOwRptlVWL95mhYNvHabGmIpdZkOlbtSRmOokCUgQQAQIAPAUC +TNLNqTUcVGhvbWFzIER1ZHppYWsgKENPREUgU0lHTklORyBLRVkpIDx0b21kekBh +cGFjaGUub3JnPgAKCRDqTcrcTcqoj+ksD/97lFmqIfbJKNxGSACbAoR/CmKLEy8b +HLWpPcm0e95PDKC8byDDab6McADwsECHZaKgHizynRn1OcmBSHVrcA8eHwwBHqxV +71Ocu5M6IhQ2nU1aW7V2+d028XiKich++KUDqtzighIjvOYTBtuFAl33vdggAY1P +El57UsPWy8PxNjJW0i1VMaGboOw1lnoCgxN99VkuaKrEefL2p9xUp+yBZItEKJEu +SpQkbNp8ANkHAhbjJrmA5shYIDTlsVqGADMt44cw0ugiQtqDwWjo/bXwZzoFWcC9 +a8Z55bj4w+atrPzCUsOuKpqHq0DU5+SnvTHLzXoreKfdRq+uNvfczRjx1AZlft1h +mr0m0Y0yw+oktNRLbZzXUAJC5P+PDkKOmb82r0dFtF9uea2kX1gsCEP55dUnKk1E +go/gm68vlxLP1VnaLPRgLpKPW/mUsnuTY/7tmGzj2XUhAqwJWVv5rhS5/UaqucgH +9nXnaZIrvLS9SWu3LzZ5SLXKPw1ir9YZC1pTPrtd6nXPnJEffNbuhKH8/3A3UIt3 +NVEN9oBxmJiof9jRBWKyf1DSU13aP/wGmCCOiU7gN1I+BLMM3ZqP0WF0Mb6Y4mR6 +cAFHY+Ug/UjLX21okPE6djKG1B7UeGSUwJGcof6PU67dxaJfUmk47+DIQoOb8aP2 +whFZ197D7CitG4kCWgQQAQIARAUCTNK42j0cQW50b2luZSBMZXZ5LUxhbWJlcnQg +KENPREUgU0lHTklORyBLRVkpIDxhbnRvaW5lQGFwYWNoZS5vcmc+AAoJEF762f6C +p/vNNX4QANyh0StE9iY6zxHOB2/fkK93itUVxQx5VsZ7/FkWs1Um01gRaDJ3so2V +YtGJoH6wFGKy29VWj2zNLhDv7VUUnosBuasnZXgcjXCW6OgEg+t/fnuNXAHXLEIa +qZsZwYgx80rJEMIAW2NEhxydzAj3m1gOf5urOqPpyDKcyB1VA3AVKa/08K6aS2Aa +2xIZqt0ghGj3NVPBgRhkB+MHXmZypmbhRVZZn6bWXs0lhYdmBruljW2u5fgHJIS7 +Jdl5yvz3DaF9MizzaHvYBDWC3w1hbdE95cTWhPp8dRsp0sbJAzPHf3BgkaAP08e/ +v4txUmqlSw4JfxFecWt0JV64qT2tKotVQrqIeMOgimPJ9ovhfqOlAKBvzJCBZ6T8 +d9bcs/xThqCSMPaQCh+PiN9T7/h8xxfG7+gfGP5fwOOCEOVkKFi+9xMXye1vx4A2 +qWh1ScALs92GvhMwy1PYoLfjfsEgeYvRGtAX2TMKkyOsHQMqDGOdRxb6yFeBMZPQ +D6SQaNHOt6l2gIqstnTy9Vk+I9MUT3ynmSX/rkF7YVdPkDJP6kUAsxI3rACZrZz8 +gN0SIH8/3+WaT39+OQXVLleP/BbkKBtxnopi5De72CTG1ocwJZz00ZvZdi1/DvEl +Ls7ia/5IyNEviCw7m2EQdvLSSzl2/Py3pYz1/rfmQkC39FOQ1neOiQJdBBABAgBH +BQJM0tGrQBxKb3NlcGggRWR3YXJkIEJlcmdtYXJrIChDT0RFIFNJR05JTkcgS0VZ +KSA8YmVyZ21hcmtAYXBhY2hlLm9yZz4ACgkQsNmRtHxAhzdp/hAAtF/zQVGiDrcS +QuuYGU7Ez01J2Xk/9LSZ819Q3jsWopdQYzxGCmK+V8plEkGLIcM/jsK+NLAhZVzt +7qg64vy3MTQ7anvjYx+1+mX1Z0p/g/r5IXXQ73Deg0RPPEtScM7ZanFlBUTniMEk +ZPt8qo5CZw23MeP2E4fl3UzHy1vt0CyB1dOJjsy9XPXLX258ON9IBnjS5s99fKqn +Cs2k0VFyNkOlsIdWzsvFCoQl7URnEEUI4OrrvftxQHouql3x2SxE9K7pIHZewg63 +1W+UXuH72BC02kIXrHixu7yQIE84fLzaptZJWZ9Xgoigk12L40ygMQbc4zbRfoVY +Gymn/jdZ6W/4TG9ksq8FHFi5eZNg+hv8YwFabfYH9cshjh1+ldUbHKE1YbY5TpXQ +9wNZOu0XHMsvo/pijcptUiC8yvmeP1Ky7dyJb7PkoOcQ3cjf31wGiGP0cgDhw1Fb +S14g2OI+fng7Ns+9LLOZ34/QryK+hBLppEdAnLgAvIZzyuydK6KbdIPEzotffoJJ +8PfEPoYa7ZHZZq3fJTno+DO8mhEi9V2jHkpDZDTNUkRYEIevSnfD8F/44bjvZHUy +63T9Hrr+DTjqG2ucCDZeAkaMue/NRXev53RIJ8AHLTUG2dbfb+GHfC/OkkwFe64Z +O0is/SucfzHqQArAUB5mo5B+RC0o9huJApMEEAECAH0FAkzStCk1HEppbSBKYWdp +ZWxza2kgKFJlbGVhc2UgU2lnbmluZyBLZXkpIDxqaW1AYXBhY2hlLm9yZz4gHEpp +bSBKYWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT4fHEppbSBKYWdpZWxza2kgPGpp +bUBqaW1qYWcuY29tPgAKCRA06nbmeRSFqOljEAC+JPGA6EtNP7fhaBEuLL2dhgTs +4vPGvWivygw4WKR4ONGVEMBCQQCxafRxXdUQEjvRTxxdnI/2S7VpGvQlEjSAPkVc +wuX+lwxPYb/7L8D78a11AtAxnxN16QsDBG7s4m+aBBfjn+keQ1lIdScVqU20ZB4y +0qrJb5Zv2hfaDUlg+99VS08VohymSFPEFzUWDufyCC/nJbPnrKZppbBHZmJT6WZm +8y0i+oC65ZbRCxaMV8FVRhcmiafXeZoC/SURf4YSX5tgI8++/Ydwzxp2wxI1NCxK +zsG7sERjLmtoXi9lrDLlWJnhbO5Yid6/7EXqzHjcWmUqag6jldJVQRjUR8G7Coj5 +zUjuEUZRlTM8tllrWLLSamuKhyk1q+UB5gDTIqGDpFxj/SvdKeScL0fzsCmnroaL +MXtd+QCBHmEk2umA9hb2N3bcq2Ht9+zZ5av1RHkNdT0L7l3TiFgyP8cx/qw5of/Z +TQzcvD+Nsl3ijShyvihNHstPYDeANCcHdRlnmH6fusZGGV9t3H8O1kGIGi2R4Pw6 +pUDPuO1BHfA11Ld2uCuVbJwC+2aG8tl8v7XzSovCrn6cZW5oPxnT724UMZ1ms2EC +Mu0Re+4T/q5r1N93vmqHj2ANAm/Kh0l4xBlO/W4lpVqmZUOsdup5mKQMLQWEgxBY +LNgEqimt1u0kP1qmn4hGBBARAgAGBQJNJK0WAAoJEH4q/cwONxoJHQIAn2msette +hgxjatfizrygcPR/2MG1AJ0TfFlSZEdBVOcbyeQp9QHR44imhohGBBIRAgAGBQJM +1CP3AAoJEPQmjufy79DwrF8AoKX1C2MHxi+3OURgekLqqLhhXcmsAJsGXHUPOxWI +AO8gWdOUbSan0395mYkCIgQTAQIADAUCTgOM3wWDApIJwAAKCRCMleyeQza0SER2 +EACxkaUEHDutAFu1isg+H4N1+w1j++I4VbbminesbaWRl3X8or0CFeGJD7aFCZ10 +oj1tYwDQ79+lv7Nza7UgbM369lteJzF/uzHy0now2r1pfqZ/LDTegTbDaLx0l1l6 +T1RPr9Z7udWADOG9o2FfaPZx1sKZvHGdBAIQP0QGIwNaesXTOBALELN5YqFFJGw/ +QvZPjgrhiVekV3CecWtRe5F8oYPV2K4zwV1hOzD8t8nmK8U4C++vK6alVC7iQt7D +1uyMeeX/Sj5wWdXQUo8PKauzDSRO7J786j7nl+c04OI83uij75nckwpKoaSKVuaJ +1CIiAObWnU4X5qiWXhbO/D1iYDu9U/hbKrcBR6AAgF5UTLd8gc4cmMxMh156OMMv +fbovNeLiMvtk+I59RMoFXR+M6vrF0IpPLuTD1v0HLvog2FEuBvDbXDeQp0CpR8xC +VjiLGDNWBjtNnYYWUFBUY8AjmOjmlOKyhVyGzZKY2OFsTRaYHnpoWVWDbxMwdF4x +OU2WiPp57gvxdLDuRugeyZ7at0uJ9qULzPdmY85ZpQ24iC6IvGeKbvbBRy03NO2f +kC5QYiZ5GkjIdjMUJUAkBUnDRVfNWfxCt4WWDOj/b2Dx9j+wLlvoYSp8vJMOgzdY +RCmLP4ILYHestBxjX5XL4/jP/ermAtE3Z1stjHPT0WypDohGBBARAgAGBQJOvCRS +AAoJEAsDrm5OJFF8OV0Ani98tYfmIfP5XZQ5OB7i0utm+mUvAJ9i4Avj7LjRTUS/ +/Y8WEjwECKU/V4hGBBARAgAGBQJOvCmzAAoJEKvWMuzE/Jpl5R8An1XRpZqcpO/O +Xhxah6XLsEpOyZwiAKC19goK1pK3aCPjqUQEZeTwjux3OYhGBBARAgAGBQJOvE7t +AAoJEC8+XTEfSeylBJgAn3BMgHkHaW7aRruEYxqv6DRs2zotAKDSVf9WP7k8QRNM +fX2OGjq0NY6AsokCHAQQAQIABgUCTrxfWgAKCRCarPtWNSrPdsfjD/9qBA81KkYP +OINOIgYogWlJJ1v2glEbcICRvuBIOSpFgQqdT9cLyXrCl38Akhh+kO+A2PEtkBOw +5fDMyENbO3scVOXSIui6SvqDZsTUhcua2jHSWILg1EYr0mWDa7WrbWWcFNna60QP +M+sjYRAkO0oGES7xfg7mb12vHetZVlv6fitIRRBSXDnx09QrvmsVxj528TuR6l0Z +p15MgqAALntYZRkgOwajBIlMcbYkFJg4PsOIzV2ucVYruoPaBpjRnh2AON6qaXF2 +k+0Hbt2DNwB1ZrV/CLlpWmrrgWdyBiO/niqxD5xJaYIr0A9aW01cdgp7kwEGvTXZ +t3qpNr+Dc/Dqgjt94GoEEHJ+ugiifGD+kyox2kXIlNMT38FdorLxmTEPiyAQBDrS +kQGXmZGW2ua05Ns6ElU5WDLpdqZlOg2GjQY7LHzuXNbILiKleoIMdkc1EmSRpLjd +IeyGo94V2ae9G+R345KAsmZfP4Yszkb5W86KBDUErw3MY5wye6DdXPZKpy2w9XWh +lMsz114+xpcJjo1Fv9/GlHSIoeEUBVl+TxoeVa8pjUOjWO7aCuf4ZXk9vfLhIJYw +WfH9zlT7sTH+yQ2S1PqpfAhrYUNjxy05ZmSHKR0/QfLb/WmIVD5D7zoG8F5pV4uC +WtMVuOHEId6U7W4/3BSKv2+qaOWKKy5+aYkCHAQQAQIABgUCTr1SiQAKCRBNFUEQ +uEUI7JBKD/93jZP1q/wInzVCBN0zl5PI3Af9v4q8qoazYHrtaUxm8Zba0EmZlpLF +H0VfgHxTnSQo5gJfSoN2fi/jcaSpr7hZozLw9eMkEL1XLbGb4LiOlwIR7bRhq+xh +OTuSSJRi0VWdjaPZOXTnyefnkSgGe9bnW/imulKrto+c63rSfr2pL/xSPOu9wgbK +fdRuhYQOZcnG39zDhFwYYGbLsriyJFxoc6F9u/5RRURVd67XQ/ZpdgjjkuebpmvG +Hn3OTmsEnMJQrkeib/S7Oylv1Yhb9QlRIDEvsoOZGeEF/hAvlHDDYR8zAKpfOjSy +eApK7sPaZp85+BUQ7ciT9Ty0bhMMNQRP3Bj/M6SpsVzgMUmUN9B4Mip7Kr5XDtY7 +CiGf7u212r1MOTZ/o0Wmh++66QI7rw0b6GmUlnJORJz7D+YiVfY0knRgU1dt0FYq ++qLUjVneqRmp5gfx4+5BWtOESYrITZUvc8VKTOYgRIeD4aJ13+IPhdCfDbWoH7YX +e8z+lt2hLOE2KLiIoa15XQAI5t0hKEQQt1rYe+nEKB1k/azSgUtLh7uVUhYFJnKq +3643pTKFoWJIuEUIaf2m96hZiUXFRxXWV3PIa2/GElJpdVZIPtwoliOcUDWn8Jpp +o3OIM0wwHyuYjFq2rbgiyxygFAIlSZgMJvTnYASL+kUYQYZHWQu9zYkCHAQQAQIA +BgUCTr5o4AAKCRD7Yz3o9cuuaxSaD/4qIpKpgCw4oe4DkpUlTgJM4RRtC5Wyd98/ +zavht3X9I/n+/rfrLVUgOiofHWGgBAD8U8RxUDw8EfW8ohR+U+u9RIBHUR57VFF0 +zU09F+UbI8m99paOb31vI2EratGOd6kmDIcVgaIBhY2JRbNxuet1bC6fphouPga/ +aUQtxISKwG6sUpWugCgD9oVtg2UhUfj6eH8A6Or4ARu9s5m1JbyDl9XEHY2v8LbM +joyxd4kCWsYcuwqluE8BoEJw+R2QDra0y2voNcfgGMvnLbJFn1ivufgqLdtG5r3h +2xnA7idL0jvp9YMXEFbVMzP+BnUxKIOnSo8hTDxfgwkiJbFqlgQIxzmAUjGAg9Ve +rssFWUMsFs0Bm7gkiNhU76OFt+RdX3RmoQIDeUMUlJ56jvWi0wY1orNuTG5anu0o +OiWHZAkVeptiiiAHF6sJlV4YeCzDXID6cz8+iVSK3ARlQnvwgzOfJzs+rs9AbtSU +9BSWQNEaAcG1Cln1pjIeK9GasNBW+xLHxQNYUJWk+jmBMrRz5AXn8jzMv6BvRzVy +weYosn0DhKuK7LAtFX8mmxPX2JGCC69Q/FYXVEvRuh4iI5P6heppDcEtRh/+oviv +ZeIrAWLTij200V0t+XVRhAM03Q/sPKqKWN4W0ye2wpAD5RNwaPotS/dE6HhO+fsi +0HcJmVg9IIkCHAQQAQIABgUCTsrLfgAKCRCJofZRKiOcLJ7ND/9NGFshib9CgkmD +BG0M48kfXydfV6B/DQdtYRsPXQDmS8slTakrQQRBtNHFyX+YCYKRAPVgoTzn46X5 +e2CrF8Bi+qySJP4e7rP9F3DQG1LqPoYJPBdx68v23x1Uv4vJ/q8vTD3kWdktxWM7 +HxJwJnJCkiitg8JeYfdJAe7pjahN/ve/gMlbUUS9lzUqCmBVRIwxiVE2lPml54h6 +dtDtzKu942y9SzxgkQKRPIkKjN3ZUWHTkT+kE7KOh1cc3SyB9P6A2alm8GoYe6ky +tmgvI1u6NtUPNMvPycLyWYIesORNwtD0ALzSRDRbbALEMby46xWBNddDR/3TKpdc +bUFFjoXZTGGnSB/HD6b5fuul0tvzYebnyBzwNppd/WgGr1LeXYDUUohHWs63CKLF +KH9EZmAYyPDKTIyIstmC5rndiBczHMlkKvPQcXId5QTNVIDS7ze/jRgX+yAqEump +0Jt2S0V27km3NQoj0VpahzJYn/3xqchj+gRFoc2IwVxcqKP1ouV0Igmy2ddJRoQl +VbsZ8fDdiIOP0tWDroZhy08lxmeC48YHoY46dqlVV3qOulmj5CwJttsaGV8N6UuW +uplS7pqXioR+XBSsg4uGx2ht5jS5Ka/H3BJk+7QyUSKyfLbboamf5m9aQsDtuErF +KsYMy4Aoh/dg2SgFFUNC4k5/oDz4sYkCHAQQAQoABgUCTsFkCgAKCRBOvAyfAgj8 +Ea1/D/4kr5cLC+J58QXTpFvDtem2Yf8KrQDMKm4pb3Abw3L5VA9w+z+AqzhKMwHY +8WgakY0dA1uxnAl0hSZTg9oAt32vPzRZL1dCthHSSVr9iykWrJ0GPndVcPiJc3z5 +UIoSXZ9kN7HDBk0Fk4o9guWBMPmJ2BFrwsDjD6zW5L3xPzxhYN+D58e6VjRg6YoD +vwUCLXwm1xtHPGBSM4CiLu8GC7VmBVL0k5x7FeczVaeCIF6uwgLHu/cb0dt7kJaD +U6VodDOadM3xd7MRwU5v63gwR4JmqH85lZFYI7phjbVhnWOKMpUYYoNHT2Iuk36p +ojyrwbMM0EqWA5WFvqNvedqwzJJ9GGTRx0zkrgM0i93GpQI8IvIC2QJXZcA5BcpQ +ggQyVitnxb9ZNnp/YDDeIUmvRVCbc4IYtzwpYEGCESCW6gEFjafYdYyajKEGRmb9 +0/+69YbTBweOdihGMWrqhQpCE5caOj2e9LL0ZgGlmioSBALvfcVvGbte3XE9na1P +dBFN2osybG+uZXld0uoa8OmSdjL+1LqBRyLIVHyRUIQZLfr+KtokMWK8GlL5WCPF +i6RZOZcQ/KXWadTb++/Le+6qatmzyQ5B00ZNzBsUvmYBXbX75VeaEOWXelAU1OWG +erO2SDEPifkaC+pHP1Ud+vH3SjeF3KoBENqBpkEKGUi937bpWYkCHAQQAQoABgUC +Ts2X0QAKCRD1T+ZICIM1qafXD/9PLM0s0X635yhWfZRFxd8fM4NWiBMx5dgVMR3E +aq+iXjeNJqqMt8u1MQvYqIXrzm+uOTJ5nBbh0UoWmXO02XBgIWENccgA8wWy17X1 +E/GKWYMFhr8ond32N7+kn/7ftrBQZasbBXSdz0zNFTi7B3ilZnq19whN8A63ctYC +GNMxKfu31F/Mp4Ukz4oiNsXmBq4+2SLfoR6xZ8xomDEcpRDPu0yQM7q5YWEF9KNJ +E9fsZ1ltRxoson6jjpGbwGS4N1MMlJrWndwKhz5ZwPWdMCiiAZW6X7ZvE5So7J1n +CWR+NxnJAFqVwp9PZxjiiKCIHZPz8m20qm5CoCR/j/hk+hLbL5cB+ie8wgushd1O +V6P9GV6ld4umM3Qh57cmZBZwhQoouDpjMHeMEK/P9EEjPKizfhF8T4qVVQEpQlJQ +7U13xR9PuQh8ofDs2qDplKpZR0BVSBxQb7l2JNDJsjwxKiqeGrFhEu4RaeuXl7do +PWHsJqTbxul49M6lh1IMn06XYlMxR/dViMmPCh710T4ShyPQHr3ubz3gQPNyUsJk +FkiBCBTJ4A3yVgdsSLMCv2TCUYlVGgazIyXYj6CGlj5C9X7b2PFGOsmIuuMWJrZu +K64ISrbZUU7weXYn7d9NCCzUFCZHWNxM5MqdKBHy6jVONdksvgXmmGJ32sN4WJDM +5wutm4kCHAQSAQgABgUCTubiXgAKCRDGh181Qc794DR3EACrmqG2CZRKvWPToU9c +YFMbTNQR7tMB3Iuz0Cks/JzgRpRnBIg3tNoWpJfuQeTYV/rWgbov9hF42X1aahKh +yO7iAT5uc4n5C8YoWzvkViGDtkueOGcCgOV/DlMsYtaUlPpgAqqFwCwiboJShsRy +d2Jxg1KxMbJK/b4iFYSqox0tqUT/E4+7fFkayY9hbG6VfX1Dt/rv+kWPcqcvbEFq +U2ZOQ91QGic7ZLZ6TWkkJtmJnOc8q8WLzUz6jKPqJNwa4bcxc1+I5/fOVS2xlaOx +ZXqX4eWSTy7Jx2Ya7ise6H+WDt7r3M+n8NgqpT7KHzd6ZDel/NXHL9HpL1sVvfBd +nkTNnUH2ZAL4QN5u2FdZkR4N8sJ7VFbHFbpQTP7pFAWM5NxPhXcOvZz7CCYrCw0/ +3xSaQk2M7jUp2JbnWq/fxRzwBXG9YUe6ZzFmovgX9MjCf1kPQohKBjSZyfefB/7y +IBO1gN/lq9R4KzeVqbBUHTv1yytEfhmSdiJD6Zn1I0+rBj0lOPFBh7FavZ8Mf3qa +nBQdYwfviMIEsw1rxwi+m9q5RwPzN4c10GLxPyA9HiveA4dj8DI2bD/mHymhjM5E +Di8plId5A2mqfb36CYVgi3zVgF6fdkSclqXJgmaO53Q0UCCl7qnKaBQiUvZ4m50S +vun+iQyHOgf1OJocid27Fe0eaokCPQQTAQIAJwIbAwULCQgHAwUVCgkICwUWAgMB +AAIeAQIXgAUCUSCPTgUJC9IwFQAKCRCbuGOw9Ru4igXDD/4wg4dxsAhXkOWYQb/8 +rN0plsvZHkacnRc3w0h6+5FfvNMbuUQY0YW3kD3APerX9mkYBsQbloY9d7KXMl7M +ATQtdXl07HZZMS1PXEyIWPk5es1tHpfR+6NAU3nJyJdniSO/8GDjhiN4sq++uIF4 +NMvZC6/7XG4uT39BlPFqRHpFxLu9uJuzNkiQnPkHQZ08r9FKq854/KGDtaV1aAzP +s4f1cghvh2JOrioKkNuS3yXWIn6AxhXmvYhufqHXajCBovv/Edwf+ErkZ6uYgJg7 +EjjU0f8sDsyoEThV0ChBcvIaxhYEne5QNRpcaLMU0w+/u03DTbKUmOGeYyOToB4y +5HIhuiNB47DtFY0K9FQbT9gw4MOuQkVLX9WG9Ksnc7cPPHL2B6DtLER2lMczp3eW +rftx4q+CcI/jfWDrpDN1a2MI1fwR0cxCF7tSxGWl3EmFnjC38qMWQvXWMXsFqGUI +sTOGEmd4w1L2xnYVRXDh6Ic9OmYu95iIgUE064E8xeurDAM5ela2C9KVXcpefkU8 +0vuq8FqNofZzvV/LVQczE5W+O8b+pqh+PUa9vLbv3ukdDe+zJm9E4/bGF7NjPgjT +YBkb7L0PQLb1zsAUj0oo9HdyEPwHf971N745js2m3jQrKAgAuUOXBFnpAQ8qhhxk +eacb87oIzHdX8TdtqaSqAg18M4kCPQQTAQIAJwUCSvH9lAIbAwUJBaOc7QULCQgH +AwUVCgkICwUWAgMBAAIeAQIXgAAKCRCbuGOw9Ru4iq3HD/0SKrQhKwuBcYSSbRNn +i5w0l6erZ/ZllogFTHyn2J6sAYtG/GxJ268xBVhXgmSpXWt3G+809rYh8BMKp+UN +4sMuphTs/eT61LTDjoPIACN7R1FxWjlhK1PzsaV6dlfQXaePjr8r1vqV99kl8Khx +iAWpLBJVDjyCXlv5vTGzX/PuZdnE3R1OkVhjHANcWLr9M5j86WgORhhR1KkDpB+B +pwYbCCg46yJqkRVF1FZsns9nYyMnbqCq4mTkRgj2hSoAzBgJ7WFpdJ0qSo++lWxR +r54pXTgZHda+GVO4I1APyyyO0Xl+BBwwNbpxT1PyaBgz7/x4lTf1vng/8dKzJc7k +cHQftTgcRdDMhzjoqBAR7P5hACK84mjcSfB4a4THBAW9hO7rGHFWs/kVoZbRy6+m +n9Gk8bm3xyzR3kGSSSA2S3/LYxmNfBRXNPvG9M1j6/KPa2dLBdBB/09Zk/lgHtoc +lOW25dHcAlieYSbqJH46WJmK+YANzwfJwd1ofSuvM3iXBRdcuGvTZ8LHpq3Aspgv +2MwwDtZUyjOMUoC1JSUIVLRfM3498RGVd1K6kOU2IVM5fFG33fFjzbmDMqZa2dcw +w42/Vk0XIjLOUoA9/BdmZsX1l+YoyiCWm8KPzMWMjpeuxKCgdjTW67wB5ReU8Amp +rzaaAByaElVk1FZiiZH3MJEhRNH/AABZ5v8AAFnhARAAAQEAAAAAAAAAAAAAAAD/ +2P/gABBKRklGAAECAQBIAEgAAP/hC+RFeGlmAABNTQAqAAAACAAHARIAAwAAAAEA +AQAAARoABQAAAAEAAABiARsABQAAAAEAAABqASgAAwAAAAEAAgAAATEAAgAAABQA +AAByATIAAgAAABQAAACGh2kABAAAAAEAAACcAAAAyAAAAEgAAAABAAAASAAAAAFB +ZG9iZSBQaG90b3Nob3AgNy4wADIwMDQ6MDk6MjggMTY6NTk6NTkAAAAAA6ABAAMA +AAAB//8AAKACAAQAAAABAAAASKADAAQAAAABAAAAZQAAAAAAAAAGAQMAAwAAAAEA +BgAAARoABQAAAAEAAAEWARsABQAAAAEAAAEeASgAAwAAAAEAAgAAAgEABAAAAAEA +AAEmAgIABAAAAAEAAAq2AAAAAAAAAEgAAAABAAAASAAAAAH/2P/gABBKRklGAAEC +AQBIAEgAAP/tAAxBZG9iZV9DTQAC/+4ADkFkb2JlAGSAAAAAAf/bAIQADAgICAkI +DAkJDBELCgsRFQ8MDA8VGBMTFRMTGBEMDAwMDAwRDAwMDAwMDAwMDAwMDAwMDAwM +DAwMDAwMDAwMDAENCwsNDg0QDg4QFA4ODhQUDg4ODhQRDAwMDAwREQwMDAwMDBEM +DAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM/8AAEQgAZQBIAwEiAAIRAQMRAf/d +AAQABf/EAT8AAAEFAQEBAQEBAAAAAAAAAAMAAQIEBQYHCAkKCwEAAQUBAQEBAQEA +AAAAAAAAAQACAwQFBgcICQoLEAABBAEDAgQCBQcGCAUDDDMBAAIRAwQhEjEFQVFh +EyJxgTIGFJGhsUIjJBVSwWIzNHKC0UMHJZJT8OHxY3M1FqKygyZEk1RkRcKjdDYX +0lXiZfKzhMPTdePzRieUpIW0lcTU5PSltcXV5fVWZnaGlqa2xtbm9jdHV2d3h5en +t8fX5/cRAAICAQIEBAMEBQYHBwYFNQEAAhEDITESBEFRYXEiEwUygZEUobFCI8FS +0fAzJGLhcoKSQ1MVY3M08SUGFqKygwcmNcLSRJNUoxdkRVU2dGXi8rOEw9N14/NG +lKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vYnN0dXZ3eHl6e3x//aAAwDAQACEQMR +AD8ApEsBc1rCHEA7gD+c5273AfSUX33sDfVY7f8AS0iNA3d7v0n76J+zQ7i2t/h7 +W/8AfNqKzp2U72sLT8N4P/QepuEtbjC5ruvs9oLj4NEk6WNW5i/VPqtmMC51dT3t +BDHaFpjbt/O8FZ6WMXplDXQftbwA8udv2/1JXS4djH0NcHAl+syoTluVD7WxHFUb +Ly3/ADTzmMc0bXOAEEaSfzvcqFnS87pziMmrbW+CLGmROohzl3GRl10yCdVJj6Mm +stIa9p0c0wQkMgurtRx6XVPAbgGvMGWw7wB266LMx2B/qMLA1gBLBzE6ua//AK41 +dd136vvprflYcOr131+7c1pH5kbty5KjfVZL9W6iSTpP/Wm/9UpeK9mIgjddhAF7 +Q8bmtBmDBJH0klBroa4EPcXyNxcwxrOm5zPBJFb1f//Q50fYC0jexrteSf7Lvoha +PT8an1vtAcG00/pD7gZAHsb/AG3LmG5DnEe0ElbGRl47MYYtRO8AG1wES4JTmQKo +arYQBN2dHQb1kPsL7T7nHTlWh9Yb6gPRc8g6OaDB+LHfvLDwaHWuFhEAj2/BbmPh +MIBIUHCNqbgGi7uvdSdWHPe6yDo4gTHbd/KXVfVzrVF+Jv1e5uh2gB4/sH6S592H +Wa4AUMPI/ZwsqsZ6lNnYaOHnW795EitQgx0e2q690/JsOMxxeTLXhzSyP5Lt8LI+ +sPTvsuJ9s6c1rmM0vre7sfova7+sszHsJb64eL9fba4Q8D92wt9y38ap2f0jIIf7 +ntcAABpA8/3koZZiVDVjniiY2Xjj1G4aOxmGOYd4f2Ulm23XV6myQJA0B1/d1CSt +cR21avtDwf/R4MNuxLW+u11dldgLmkQ4fncFEtNgyHVmTY50a+ZVmnqW81ixrXND +jsqs9zABztf/ADlP/W3LRysSrI6o3MY1oaS1zthLmyWz7S5Nn0XYgZXXTV0MGkNa +1vgAFq4+0SHLCyHWUvAG90/RDNB85UGZ+aIfD2tcY2vAJ0TGyOz1EtGnIKhdi13i +J1VB19owftI1IMEKjT9Yb67Gse0e/wCjAJkcfmo3fRJoO3bhPpwrDv2mCRH8VD6u +davxcltQcC55DS08O/1/lI+LmjqGI6sge5pAIWN9VcUOy7Ls6W0YweQ+CZcwGPa2 +Xe1MIoaLJa7tbrdVN+bayktrpfkFrQOGhzi3dCSoW51j9zCxmpP6QAk8/S9xd9JJ +WOPw6U16N34v/9LmL+k42S+cF7aLRuIxrHSx+7tiZT9u7/icnZZ/wli0K6siivHZ +ZW6sta0WscIcHARDwVNvUuj9UxHUjEbjZdQfbWKdK7A0e+m2v83+Q5qDjdSrvqZX +Ltzo2AmSBy1rif5KbLUeTJh9MiL+YOvTXXcPcEPIqrYNBqFGqxzP4IN73WgwSSeC +FGJW2qFOxgYoswX1yCTqB8EGvp9Dn/A6rPxW5TNte97Q2CHDnTsrjbHVXEgyHan4 +o34IoXu7dFOPSz9EyHASYELBzMiujottmO3bbkO9F24AkifWtjT+UtnCyA+t5d+Y +06rG6zlfVqy6vpWUX1iuXmyl383ZZ9L+S/axlbkhr9FsqjGXc6B5mpjwQdpIBE6d +klfxfqjmZedbT9oZXh1PAGbYTD2kb2elU3dvdsPvSTtPmatm6rwf/9Oh076k9c6X +ltzrq6jVW1zrHNfq0fv+9qyQKaswOja5upD9CG/mtH5j+V7LVmUmpxugMiHE6gz7 +dv8AaXC9e6H0a6+12Kx1LGncytrjsDhrNbY9rf5CRjqQBZrzUJAAGRoA7/1nOrLX +gHsQq9eH6FztpNlZMhrnO08YITFzqONWEz8Edj67miDr3UMW6C3K6qngiuQSZaTY +TAj+S1NTgWY7y++917n8l0AD+S0JsWmprp38KzZYCW1s99jiGtaNSSU6WyCfNHlW +irAuYHbX3gVtI0Ik7pEf1VxOf05+LS219hsse73O7a+P8pd1kZeLgVtty8KnqGM0 +kvtbuNlLvovbbX/od3+EZ/bVzp/Vvqhluc1+DQKi0kt2kkQPpAf4St3/AG5WkBIa +9OrFKUZWOvR5LC+sV1eK1rcdpqxwK2tDzMAbnO9wd/WSXaUdM+oua1zqK/QaS0A1 +l0bneTg/+qkhx+IpZ6arXip//9Spf9bs3PfjYe4Nre+uW8DQg7i7+StkPrtsdscH +tgajVeattDbaiSdoc2Y8O66novXun03Oota6mszteSX6/uu/OTxkGOQFaS3PXwV9 +3lmxyMbMoHSPn/zuJO5m7cCC0tJBaeRBVc47Q/c0lh8lo5GTh33ssxrG2C1pnb+8 +zxH9RyY0Bwkcqoe4bkNgJCpDQgtWui4nSw/ctPp+PXTNlj9r3gsbYTqHOG1kEoGO +xzTtLfmq/WnWuycDGpguFvrFh4d6bXOax39b3Ixs+PgiZrrXj2czPuyTUepUuNlQ +ivLe3SeGtyHsH0N/0LVkvcaHC+g7ayZIH5p/eZ/JVrHzxXb6jBu9STbV/g9hGz0t +kbfo/TVS6sYtwrEuxbhupJ7T9Kp39VSYZ6CMjr/LRbzHL5OH3uHhgf8AG/vSi6/S +sq7I9SuvI9C4w8Ena10aOY535u5qSwqnnGvHdrTIB7t/dST/AGxx8X8ra3EeHh6X +b//V4LOGLI+yF514eAB/J2wVev8AsHq/oC8CRpEgn8791zVzKSGff6fRs8h84+bc +fL/3X9V9CrNBOH6Qh25vp7SCOD9o36N/wf8A01uV+lOnzXkKSght1+v7GTJXHOv3 +j/e/wuJ9mHoSsvqPo/tTGgv9aTs2c8O+ivLUk6Xyny/R3Wx+Yftezv8AsPo5H2Ta +GSJ7nnWN35u76K0qHdGb0TIGTVXYzZ9PIseywu/N+y1UU3MbZ/o/0y86SUQ/aP73 +/ozeP81O/cq5b/L8sf579P2nayPo187p9s8x/KSWKkr32uL16b/R/9n/7RCMUGhv +dG9zaG9wIDMuMAA4QklNBCUAAAAAABAAAAAAAAAAAAAAAAAAAAAAOEJJTQPtAAAA +AAAQAEgAAAABAAEASAAAAAEAAThCSU0EJgAAAAAADgAAAAAAAAAAAAA/gAAAOEJJ +TQQNAAAAAAAEAAAAHjhCSU0EGQAAAAAABAAAAB44QklNA/MAAAAAAAkAAAAAAAAA +AAEAOEJJTQQKAAAAAAABAAA4QklNJxAAAAAAAAoAAQAAAAAAAAABOEJJTQP1AAAA +AABIAC9mZgABAGxmZgAGAAAAAAABAC9mZgABAKGZmgAGAAAAAAABADIAAAABAFoA +AAAGAAAAAAABADUAAAABAC0AAAAGAAAAAAABOEJJTQP4AAAAAABwAAD///////// +////////////////////A+gAAAAA/////////////////////////////wPoAAAA +AP////////////////////////////8D6AAAAAD///////////////////////// +////A+gAADhCSU0ECAAAAAAAEAAAAAEAAAJAAAACQAAAAAA4QklNBB4AAAAAAAQA +AAAAOEJJTQQaAAAAAANVAAAABgAAAAAAAAAAAAAAZQAAAEgAAAAQAE4AZQB3AE8A +cgBsAGUAYQBuAHMAUwBxAHUAYQByAGUAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEA +AAAAAAAAAAAAAEgAAABlAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAA +AAAAEAAAAAEAAAAAAABudWxsAAAAAgAAAAZib3VuZHNPYmpjAAAAAQAAAAAAAFJj +dDEAAAAEAAAAAFRvcCBsb25nAAAAAAAAAABMZWZ0bG9uZwAAAAAAAAAAQnRvbWxv +bmcAAABlAAAAAFJnaHRsb25nAAAASAAAAAZzbGljZXNWbExzAAAAAU9iamMAAAAB +AAAAAAAFc2xpY2UAAAASAAAAB3NsaWNlSURsb25nAAAAAAAAAAdncm91cElEbG9u +ZwAAAAAAAAAGb3JpZ2luZW51bQAAAAxFU2xpY2VPcmlnaW4AAAANYXV0b0dlbmVy +YXRlZAAAAABUeXBlZW51bQAAAApFU2xpY2VUeXBlAAAAAEltZyAAAAAGYm91bmRz +T2JqYwAAAAEAAAAAAABSY3QxAAAABAAAAABUb3AgbG9uZwAAAAAAAAAATGVmdGxv +bmcAAAAAAAAAAEJ0b21sb25nAAAAZQAAAABSZ2h0bG9uZwAAAEgAAAADdXJsVEVY +VAAAAAEAAAAAAABudWxsVEVYVAAAAAEAAAAAAABNc2dlVEVYVAAAAAEAAAAAAAZh +bHRUYWdURVhUAAAAAQAAAAAADmNlbGxUZXh0SXNIVE1MYm9vbAEAAAAIY2VsbFRl +eHRURVhUAAAAAQAAAAAACWhvcnpBbGlnbmVudW0AAAAPRVNsaWNlSG9yekFsaWdu +AAAAB2RlZmF1bHQAAAAJdmVydEFsaWduZW51bQAAAA9FU2xpY2VWZXJ0QWxpZ24A +AAAHZGVmYXVsdAAAAAtiZ0NvbG9yVHlwZWVudW0AAAARRVNsaWNlQkdDb2xvclR5 +cGUAAAAATm9uZQAAAAl0b3BPdXRzZXRsb25nAAAAAAAAAApsZWZ0T3V0c2V0bG9u +ZwAAAAAAAAAMYm90dG9tT3V0c2V0bG9uZwAAAAAAAAALcmlnaHRPdXRzZXRsb25n +AAAAAAA4QklNBBEAAAAAAAEBADhCSU0EFAAAAAAABAAAAAE4QklNBAwAAAAACtIA +AAABAAAASAAAAGUAAADYAABVOAAACrYAGAAB/9j/4AAQSkZJRgABAgEASABIAAD/ +7QAMQWRvYmVfQ00AAv/uAA5BZG9iZQBkgAAAAAH/2wCEAAwICAgJCAwJCQwRCwoL +ERUPDAwPFRgTExUTExgRDAwMDAwMEQwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM +DAwBDQsLDQ4NEA4OEBQODg4UFA4ODg4UEQwMDAwMEREMDAwMDAwRDAwMDAwMDAwM +DAwMDAwMDAwMDAwMDAwMDAwMDP/AABEIAGUASAMBIgACEQEDEQH/3QAEAAX/xAE/ +AAABBQEBAQEBAQAAAAAAAAADAAECBAUGBwgJCgsBAAEFAQEBAQEBAAAAAAAAAAEA +AgMEBQYHCAkKCxAAAQQBAwIEAgUHBggFAwwzAQACEQMEIRIxBUFRYRMicYEyBhSR +obFCIyQVUsFiMzRygtFDByWSU/Dh8WNzNRaisoMmRJNUZEXCo3Q2F9JV4mXys4TD +03Xj80YnlKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vY3R1dnd4eXp7fH1+f3EQAC +AgECBAQDBAUGBwcGBTUBAAIRAyExEgRBUWFxIhMFMoGRFKGxQiPBUtHwMyRi4XKC +kkNTFWNzNPElBhaisoMHJjXC0kSTVKMXZEVVNnRl4vKzhMPTdePzRpSkhbSVxNTk +9KW1xdXl9VZmdoaWprbG1ub2JzdHV2d3h5ent8f/2gAMAwEAAhEDEQA/AKRLAXNa +whxAO4A/nOdu9wH0lF997A31WO3/AEtIjQN3e79J++ifs0O4trf4e1v/AHzais6d +lO9rC0/DeD/0HqbhLW4wua7r7PaC4+DRJOljVuYv1T6rZjAudXU97QQx2haY27fz +vBWeljF6ZQ10H7W8APLnb9v9SV0uHYx9DXBwJfrMqE5blQ+1sRxVGy8t/wA085jH +NG1zgBBGkn873KhZ0vO6c4jJq21vgixpkTqIc5dxkZddMgnVSY+jJrLSGvadHNME +JDILq7Ucel1TwG4BrzBlsO8AduuizMdgf6jCwNYASwcxOrmv/wCuNXXdd+r76a35 +WHDq9d9fu3NaR+ZG7cuSo31WS/Vuokk6T/1pv/VKXivZiII3XYQBe0PG5rQZgwSR +9JJQa6GuBD3F8jcXMMazpuczwSRW9X//0OdH2AtI3sa7Xkn+y76IWj0/Gp9b7QHB +tNP6Q+4GQB7G/wBty5huQ5xHtBJWxkZeOzGGLUTvABtcBEuCU5kCqGq2EATdnR0G +9ZD7C+0+5x05VofWG+oD0XPIOjmgwfix37yw8Gh1rhYRAI9vwW5j4TCASFBwjam4 +Bou7r3UnVhz3usg6OIEx23fyl1X1c61Rfib9XubodoAeP7B+kufdh1muAFDDyP2c +LKrGepTZ2Gjh51u/eRIrUIMdHtquvdPybDjMcXky14c0sj+S7fCyPrD077LifbOn +Na5jNL63u7H6L2u/rLMx7CW+uHi/X22uEPA/dsLfct/Gqdn9IyCH+57XAAAaQPP9 +5KGWYlQ1Y54omNl449RuGjsZhjmHeH9lJZtt11epskCQNAdf3dQkrXEdtWr7Q8H/ +0eDDbsS1vrtdXZXYC5pEOH53BRLTYMh1Zk2OdGvmVZp6lvNYsa1zQ47KrPcwAc7X +/wA5T/1ty0crEqyOqNzGNaGktc7YS5sls+0uTZ9F2IGV101dDBpDWtb4ABauPtEh +ywsh1lLwBvdP0QzQfOVBmfmiHw9rXGNrwCdExsjs9RLRpyCoXYtd4idVQdfaMH7S +NSDBCo0/WG+uxrHtHv8AowCZHH5qN30SaDt24T6cKw79pgkR/FQ+rnWr8XJbUHAu +eQ0tPDv9f5SPi5o6hiOrIHuaQCFjfVXFDsuy7OltGMHkPgmXMBj2tl3tTCKGiyWu +7W63VTfm2spLa6X5Ba0Dhoc4t3QkqFudY/cwsZqT+kAJPP0vcXfSSVjj8OlNejd+ +L//S5i/pONkvnBe2i0biMax0sfu7YmU/bu/4nJ2Wf8JYtCurIorx2WVurLWtFrHC +HBwEQ8FTb1Lo/VMR1IxG42XUH21inSuwNHvptr/N/kOag43Uq76mVy7c6NgJkgct +a4n+Smy1HkyYfTIi/mDr0113D3BDyKq2DQahRqscz+CDe91oMEknghRiVtqhTsYG +KLMF9cgk6gfBBr6fQ5/wOqz8VuUzbXve0Nghw507K42x1VxIMh2p+KN+CKF7u3RT +j0s/RMhwEmBCwczIro6LbZjt225DvRduAJIn1rY0/lLZwsgPreXfmNOqxus5X1as +ur6VlF9Yrl5spd/N2WfS/kv2sZW5Ia/RbKoxl3OgeZqY8EHaSAROnZJX8X6o5mXn +W0/aGV4dTwBm2Ew9pG9npVN3b3bD70k7T5mrZuq8H//TodO+pPXOl5bc66uo1Vtc +6xzX6tH7/vaskCmrMDo2ubqQ/Qhv5rR+Y/ley1ZlJqcboDIhxOoM+3b/AGlwvXuh +9GuvtdisdSxp3Mra47A4azW2Pa3+QkY6kAWa81CQABkaAO/9Zzqy14B7EKvXh+hc +7aTZWTIa5ztPGCExc6jjVhM/BHY+u5og691DFugtyuqp4IrkEmWk2EwI/ktTU4Fm +O8vvvde5/JdAA/ktCbFpqa6d/Cs2WAltbPfY4hrWjUklOlsgnzR5VoqwLmB2194F +bSNCJO6RH9VcTn9Ofi0ttfYbLHu9zu2vj/KXdZGXi4FbbcvCp6hjNJL7W7jZS76L +221/6Hd/hGf21c6f1b6oZbnNfg0CotJLdpJED6QH+Erd/wBuVpASGvTqxSlGVjr0 +eSwvrFdXita3HaascCtrQ8zAG5zvcHf1kl2lHTPqLmtc6iv0GktANZdG53k4P/qp +IcfiKWemq14qf//UqX/W7Nz342HuDa3vrlvA0IO4u/krZD67bHbHB7YGo1XmrbQ2 +2oknaHNmPDuup6L17p9NzqLWuprM7Xkl+v7rvzk8ZBjkBWktz18Ffd5ZscjGzKB0 +j5/87iTuZu3AgtLSQWnkQVXOO0P3NJYfJaORk4d97LMaxtgtaZ2/vM8R/UcmNAcJ +HKqHuG5DYCQqQ0ILVrouJ0sP3LT6fj10zZY/a94LG2E6hzhtZBKBjsc07S35qv1p +1rsnAxqYLhb6xYeHem1zmsd/W9yMbPj4Ima6149nMz7sk1HqVLjZUIry3t0nhrch +7B9Df9C1ZL3GhwvoO2smSB+af3mfyVax88V2+owbvUk21f4PYRs9LZG36P01UurG +LcKxLsW4bqSe0/Sqd/VUmGegjI6/y0W8xy+Th97h4YH/ABv70ouv0rKuyPUrryPQ +uMPBJ2tdGjmOd+buaksKp5xrx3a0yAe7f3Uk/wBscfF/K2txHh4el2//1eCzhiyP +shedeHgAfydsFXr/ALB6v6AvAkaRIJ/O/dc1cykhn3+n0bPIfOPm3Hy/91/VfQqz +QTh+kIdub6e0gjg/aN+jf8H/ANNblfpTp815CkoIbdfr+xkyVxzr94/3v8LifZh6 +ErL6j6P7UxoL/Wk7NnPDvory1JOl8p8v0d1sfmH7Xs7/ALD6OR9k2hkie551jd+b +u+itKh3Rm9EyBk1V2M2fTyLHssLvzfstVFNzG2f6P9MvOklEP2j+9/6M3j/NTv3K +uW/y/LH+e/T9p2sj6NfO6fbPMfyklipK99ri9em/0f/ZOEJJTQQhAAAAAABVAAAA +AQEAAAAPAEEAZABvAGIAZQAgAFAAaABvAHQAbwBzAGgAbwBwAAAAEwBBAGQAbwBi +AGUAIABQAGgAbwB0AG8AcwBoAG8AcAAgADcALgAwAAAAAQA4QklNBAYAAAAAAAcA +CAAAAAEBAP/hEkhodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvADw/eHBhY2tl +dCBiZWdpbj0n77u/JyBpZD0nVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkJz8+Cjw/ +YWRvYmUteGFwLWZpbHRlcnMgZXNjPSJDUiI/Pgo8eDp4YXBtZXRhIHhtbG5zOng9 +J2Fkb2JlOm5zOm1ldGEvJyB4OnhhcHRrPSdYTVAgdG9vbGtpdCAyLjguMi0zMywg +ZnJhbWV3b3JrIDEuNSc+CjxyZGY6UkRGIHhtbG5zOnJkZj0naHR0cDovL3d3dy53 +My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIycgeG1sbnM6aVg9J2h0dHA6 +Ly9ucy5hZG9iZS5jb20vaVgvMS4wLyc+CgogPHJkZjpEZXNjcmlwdGlvbiBhYm91 +dD0ndXVpZDpkYWJlYjcxYS0xMWE4LTExZDktYWVmOS04MDNmYjlmNDliNmUnCiAg +eG1sbnM6eGFwTU09J2h0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9tbS8nPgog +IDx4YXBNTTpEb2N1bWVudElEPmFkb2JlOmRvY2lkOnBob3Rvc2hvcDpkYWJlYjcx +Ni0xMWE4LTExZDktYWVmOS04MDNmYjlmNDliNmU8L3hhcE1NOkRvY3VtZW50SUQ+ +CiA8L3JkZjpEZXNjcmlwdGlvbj4KCjwvcmRmOlJERj4KPC94OnhhcG1ldGE+CiAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAK +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +IAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAog +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgIAo8P3hwYWNrZXQgZW5kPSd3Jz8+/+4ADkFkb2JlAGRAAAAA +Af/bAIQAAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB +AQICAgICAgICAgICAwMDAwMDAwMDAwEBAQEBAQEBAQEBAgIBAgIDAwMDAwMDAwMD +AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMD/8AAEQgAZQBI +AwERAAIRAQMRAf/dAAQACf/EAaIAAAAGAgMBAAAAAAAAAAAAAAcIBgUECQMKAgEA +CwEAAAYDAQEBAAAAAAAAAAAABgUEAwcCCAEJAAoLEAACAQMEAQMDAgMDAwIGCXUB +AgMEEQUSBiEHEyIACDEUQTIjFQlRQhZhJDMXUnGBGGKRJUOhsfAmNHIKGcHRNSfh +UzaC8ZKiRFRzRUY3R2MoVVZXGrLC0uLyZIN0k4Rlo7PD0+MpOGbzdSo5OkhJSlhZ +WmdoaWp2d3h5eoWGh4iJipSVlpeYmZqkpaanqKmqtLW2t7i5usTFxsfIycrU1dbX +2Nna5OXm5+jp6vT19vf4+foRAAIBAwIEBAMFBAQEBgYFbQECAxEEIRIFMQYAIhNB +UQcyYRRxCEKBI5EVUqFiFjMJsSTB0UNy8BfhgjQlklMYY0TxorImNRlUNkVkJwpz +g5NGdMLS4vJVZXVWN4SFo7PD0+PzKRqUpLTE1OT0laW1xdXl9ShHV2Y4doaWprbG +1ub2Z3eHl6e3x9fn90hYaHiImKi4yNjo+DlJWWl5iZmpucnZ6fkqOkpaanqKmqq6 +ytrq+v/aAAwDAQACEQMRAD8ALBPU4OCryWJxO1czS5CopsTVx5OjxOalpoP7ybvz +X8b+3zNDi54qjM1k4qp4aWlOm6xCULGEBHyw63QxwsCJV4jjWpYg8ak5PBeFeoku +JGW2ZSyHVC1SDwpTTUY4Co1HPoOm/Lbz3thqTAndW3Nwpn1SqzzpS09FBhaapxmL +wVJk6QZyGh3VVUOOqq7cKqkUFIyRyQTr40jiMi3Zr+eYRukitGQ5IHbU0BWuTmpP +rinXoIrC2tnmXw5EYGMVejEUqG044Upxpw9ehzqNu7x35uBnxWPzOXllqYp0x2Fx +lNkcpVmooN/YeCA1UNIlNFVySTJIrzf5pAEYFXb29fXCwPdTXd2Vi1UpgE9jetPX +jnhTz6Y2y0luYrCKysy9yEJLVJUd6eQ9AOH5+XVpfWH8qD5T7h62oKyvynX+y83m +9rYielwGbp6nG5rZuUgxUOMmxE89PHlsfkqGSPH008E5AlRJpIZkfxxkhCPmRpVv +I441ZJI101AoCFAr6/aPl0OP6owxNYt9QySRSOXoa6gWJx5f8Wel6f5TvduExOVx +cUe18xlYcTh3oslSTTUsuRrIGpjkqRcwtT4FnrWrKgfcuI5otBIjKsAtF3qSNET6 +Q+LQAlSKGgOTX1rT+delT8trI71vlMJJpqU1AJBpjyx/k6KpuT4xd5fGOuqaftPY +VRjNs7khoqij3ViMicpj582IsvQPQZnMUiQUVFVyUjUiIjmORzp1WDaFEmz7hb3Q +eAUWTBFcMaca+XDAz8+gxvO0z7WDeBfEgOpWoaqqk9tPOg4nA6Dz76lo6HdFc1Nm +YqzHNjtyaVpRQ0Vf/d+eato46CqNZaOdqeVojKNaeNnLppXR7PAro5laOiLkHzPy +HzJ/l0QmWJUEAYNIwoKZUUNammaKP29Eg6+wcWc/vbganblNjMJT0mTye3Me7NkZ +sZNXyffZTFbihMstDPUQbxxbSSU4qXEixRF0gEt5ELTVZUaiowrSnA1AINPnn/N0 +oEazvJcFGZgwBzTyPcPlpr+3p5ws0UEXa2Mh3TStX4bC0Ne1SMJXpSZGsrqO0eTq +xSxpCK9BVQwqkbPIscNvKwmKJdXEi3YMzajHUEqcilOP+D06TH9C4sVkgqNRGmvC +h+H+R6//0C/H45RZIgw772DnWRR4pZtpbR1htWrVHNtefEFdTc+m3+x9zH+67ctV +LxCD5UT/AIvrG1d9uKESQSV4Zr/Ov8+l3i/jp2bkFlxuAyO26xxDUVGjFR9h46v8 +CCGWqmhqMBveCuHhSnDftsXSMMBZS4LM22/TRhzeII8CpqAD5cDQDyr6npVa7r9V +M0KWpeQLWmgE0HGmMkf4Orxfi9TdWfFPYuKyskOQm7r3Hh6Ki3Pkc7uAbxXai3lU +rtmrr4JqykWuWZ5nDNNPGkwSZiRxjNzzzhd315d2NjcaoIiRrWtDk10hiTUcK8PT +rKXkflW2trK0uLq1Ec8iqxQ4PDANAMH0/b1dz03uDDZjZGDyVNmKXITZuN8iZzWi +ead5rFmZpZ5pCx0882uDYce98l7jt67TDFJfJ9Y7MWBYaq1pmprX7ePl0p5ltLpN +xm/xVhAgABAxSnyFOs+/e2tu7ISeKtmjNREousj6EEjNEsURK3a8/lGmwufxf8Kd +75ug2yVraGPXKBWv4fL09a8fl03tHL0+5qJddIq0xx8/y6n4XMbJ7U2/X46tptu7 +jxtWjUuUw9SKHLUsy6SrtJSzLKraWLBXtrRhe6sODfZN6g3aIyRyr468QDn/ACHo +u3HbZ9ulCyxtoPAkfP8AZ1St85P5fmc2Pgd09sdKpQ5rakMWTm3JsuVdz/3i23gq +rEVkMs235KCfMNmsXBVeP7mJo0lWA69MvjA9j2y3+dPAt7kBkHaCak54fIcePQD3 +Tlq2m+qurSiTMdTKAADTJocH504HPWvDsQZfaO4Hq8zHJX0EseUppKiszmShmoIM +g9HURQ0VN/opxNTDRUdRSGVI/vWeeWR5ZW1ufZ8yEoFeEsePFh5gjOk4xWg8+PQL +W6ignPhXChQMnTXyKnFacCR9nTXj62Skos7TVWO3ZlqzOLW0q5So3X1pkJqOnlyl +DkIJaKDOZvAtTwQjHx+Old/H5T5GXWPa208KG2MZVjJQ4JNRXHmvDh0kvpWuLw3O +uMLUHANOHl9vn1//0aaaQ9DSUNRTnc2zcdlDTZqLTV5DcVMs0r1NWMJkn+025jYI +6v7GSLzxRSQxJUJdPQWJE4u9oljKm8QSUNcsK5NG4caUHyOeoyew3hJVYWDMgIzp +U0GNS5PCvA5x0cb4+da7Rk3fH2NR5yjxmxuulG/6vTvChyEmRxtFjpJtuYdaeOsg +kes3FlYokDRx5CHWXBZBGZFD/N292Vpss6wXJa4lJREVjUVxU8KaeJzToScobDeX +G92813YqkMNGLMigauIA9ajhTh060fzLizm4q7LbtqWkzGZrqiahETZSonjhEzSP +9v8Aa1lK0NKpPDA6W5tq59wdbWSxQOzgVIHz/b69ZIJBI8saRmpGT5YrTHy8h0Oc +X8wveuzoKL+5OV3dWUlSXxuZwtFmUoMk8Eg/Zr9t5KZ5zQ5uiezRCo1B+UdtJ9Bf +By7aTTmR9NWP8+NccAOje4a/MaoIjQV8uIHUjJ/PT5KZbA0WSz26dw7okp6yqp4c +nk8DRU2TnwZliloZ8tFFUvSyZyFI2sCw0sWGtkKhT6TYLIRjw2Ooj14emT0WJFeq +WYxBKGtOH5YHV/H8uf5nbJ7A6pOdK12cyWGkjo6mLbuLoqLe1G4gRSq7Wra5kyyS +hLQww1WqcowgRmBj9o7B4to3Apca9B+GRaa1b5V+IfL86dFW9W099bgQhRSoKPXS +wHDPkeOafKvR6ds/Oz4/dqbhquq8RlcnuWurKevwu46LObZyuympGm81JW4nK0uf +Sgngq1hDCRU4BPDXuAe3PPi7dcW8MkTyxsQCzARkE8K8Rj16IIuSr26trm6qkaKC +dNfEqPOlOP8AxfVd/wDMI+Oo6k6mbuv4xYnA5nA7amFD2ps/eO5JzLFiq2eFMVuD +CZKKbwzquSlSnnp5g7+uOSI+lx7lfYOfkvV0qY5JS9B5kNSvFa0FBT06iLmH27ij +DvGHtjo1NSulkrk6W/EK1+z7OqPZPkJu+OSSnyfSuz8gYHnjqRR7pZFBpI/JUhZa +rB1UTyQpclCyuQrEAhWsPhv9xXQ9ihkPofTJ/wBR6jGTlkAak3J1QUAqDnVhR/q/ +w9f/0tWGh7ArcjJAHw2OrqyeTwRrGtSJ2eSRUhhaKEhZpXLWFkNz9AfdzYwICVnK +imcj/D5fZ0TLfXJm0eCC58qGv7OrHd/dtbAwPW1N1JtKtr489SU1DVdhZ2mo48Mu +Tz9BSLJUmpSeD7iSpoQDSwvyywq3qHkk1RvPrub0yTD9IEhRWp40qPt8/wDY6kmx +iSO3XS1GABJp/Ppl6M2NXbwyFHuipp5Yaato6afGxToWkWjEgjuf7OqY3Y/kg3/P +stvoJIGNvTurmn8q+v8Aq9epU2Ea7f6pqnUAP9XpnPVqXX3SeJqIYKipo6d5LqGV +o1upvqJ/SACQf6fT25YWhcgMTq8/zr/q/l0IZ5kVa18ujFV3T+3qnBPTRU8Klaco +qiNVRmY6nuLWNmPHHs4NupShB4f6v9jpHHIAwqgKmv5V6THTvYcfxoi3ltPc21m3 +RsLdkZhkpcZUQYjc+JaoZ0OS2jmnp5loc7jahlqKaKZJKSqdfDMl3EiEFzEiSCSW +MNpPA8DXGfMH59FO97a0qRyWThWNa+n2Eeny9c1x0ZDYW4J6jHydgxbnpeySa2F8 +VvrN4f8Ahu+qOhSoQUeJ3VX4yrjyVXkKWkCwN941YmlAIXXSUAN312um8FYwY6im +O5T51pxH24p6dObVbCxiVmDRkfEtaoR6qPL8qZ49W79cbVrfkV8Re4potzTR5Dcm +2dz0NLjcXjcdFPjXose0ypNNXUzVE9Vk56UsHm1xheUOsagf8ibRLKxniuHhuoJQ +wUYrw4nj3ZHnw6B/OW5QpdR2slsr200RUs1TTiMDh24+Y+fWm3uTd279uLJXTbqj +mpMfNkKWleLHbfrY4q2GKZ3xoqq3DQwpOYItMg1u4S11KsL5D3kG8bbA89zejxEY +ALpzpbt1DFdJOKmgOcmnUHJYbPcyPGlmTE/GhNNQFQCQRkUrQfLHX//T1MaXG7v6 +g3Ph133htwbS3JtPf2DrMli8pjHos7RR06wZWkqVx9fCoqaaVFWWHgxVCAaGsQwc +lVvpnQpxJHp5cP59ILcQvuhdHqPDDfzAp8ulduafOw9gZjblWaybcmX3TJiZUqIJ +6epkqctWeWoqpKOoL1NOxikHpf1oCRx7A9vAy/qA0Ra/yx+2v+fqSrTS4W3YDU5U +Hz45/kKdX89JbShxWMwmNRFJoMXQY+SVuCXhijWVyT/q5Be3tHJE11Lqpknj59SX +YhY/BiDgRqv/ABX+Do/fX/8ADKFZ6TI3jkacCOXR4wsiqBo+hB1/Ukk/4W59mFvH +HEQGGkHzz0a+F46HRIC44ivEdDH91QQSR0oeGWKaNm8g0h0VjcFtX+pAJ/wt9Pah +glKVBHTa2zolWXSScD/J0kt29XYHfdM1MldC9WpDxAqksbXC3Vx/aUcXsRz7Kry1 +WYEKakdWEb2qBpVIU+v+Dpu3N0vmNjdMbrmXPzYupixVfk6WSnijWBo1iI8tdUMn +3M8aKvAd7Aj/AFrECbHA14WlbiDwwOH+Dovv7uRoGS3TuQU/4rpNfy6vmfvXqnsr +C7VpMnTZDK5/KUO3qzGZAzS4zcJqJYoFg/yeopkGRnSQtTLWJMjav2XVi0T1vJ5N +n/x7bzpuFOCK5FKaT6/6jjoFzWiboBFeVZD5+an1/l5fn1Vv82tubT3/AN173wOy +6rC7P2LnfkVlMLiKCmqIYcXt/G53fGUxdHkosc1U9QKWmiSa0knjUoFQWFlGRE8k +jcsiO+Ym8eOByxqdPwagW+WoEL9pPUV7pJafWwGyQaYVkVhRV1kA0YBclqqwLniK +U6//1NcrafyTXLT7UotzYjbWaw9Pm647Z6/7DppdybGxdHh5Jvvp8Pumomot39aR +pApMhxFbRxPJM8hgbkAyeWG5ijWVCGKsTXOQTkHjQD8ugrD4kMvixkUVlJ/P/D0c +zs7qna/ZPyexHdWFxO36DFZCs21nMrHtHMZncO1pK+v2jQ18UOByWXpaKvyGOgqt +CwyVESTmOwlu4JMXeK0M97aJr+k8QgEkEj1JI+fl1k/tXL0U3LfLm9tpF3IniMQC +AQWKoKVxQAmvQz9hZLO7Ly1JFSx7yyEk8cr4yg2zVU2LoqaaKI1CvXVlYhgeqqSo +SJWDkvYAAG/uoFy0pjVwiHgfWn+Xo1e2tUhllMLSygVopyaCuBiny9T0k8N3t3LC +mOziU+98LjMlkKijOC3RSUFZkjLTRwSyVEv2lPDNFSVLylI6hlRGdXC30n365W/j +j1eNUfMcOvbI9vc67s2lzbspAo54jORnqwWs3ruil6STtalElVPTVVPj6ikKu0ka +v+wsIQam1x1Eh1G1j9Px7aEF2bRLnxBWuR8vt6EtxdxxSsrCqMgOP8PRYto/zBN7 +7azmCwmaxVLbcZZsI9PgMpXDJ0oqqmhWSJcXBVzRuKqlcMrGMgKX/SVPtTCb8xqU +RTXh60GOH+z0Dt13G0ivore53J1kehUaGIzwGrhX5/t6tx6z7npvkl1Hmts1dLjZ +Xym1srj6GrxZqJKWqgqaWakmjlFSDNDWQVFQheO/05UD2mWZ3mcMoBFftp6H/D1o +RSQPpMusNQ1/wfl/Pqsr+Vd1hBle2d37375irMP1309iOxMnT7nmw2Wzi1ef2PiM +rNRRy4bCU+QzWSpMLX0iVMjRwHylFiRi7WBPeqkm8WVowJgZwWX1IBNB+wV8uiq6 +gurTa7y9WPS4oobFACRnP9GtBx6rh3T3jnc8c9gq3a2xdc2RrJ13ZR0OXr6+Xx5W +aobK0UWUy+WxxGTCl2EkLWErcBufcgm8vxDJD9c7QtxUkUNKUrgEUpx9BTqK49vg ++q8WhZoziuAAcmlMZJPX/9WirfHxL617NzEM/Qm5ML1tvOE7xqaXpXfW7XyOxt7T +54VVJHQ/Hzv3cSYmhzFdU1AWaj2xvQYzNmGQQxZHJVKPGFnguBGsYP8AZv2HLgMD +keTAE/I08ugeG8MSLk1p54weFTw+w4+fRwMDtrsTYeC6gwW5Nq57Z02D25t6k3tt +vO0VXj87h9wUeMo6CiodwY+tpqauonnSMMokQFLAH8Fo4v0AluJX1KFYmhx3E0pn +z8+sw+Wdziu/b/ZoWp4iwquM00sQf9Xqej6bS25gd6UtstSQySRxxGOQszeSRALX +KaHUg8AqQbfn3qGaKZdDqAB/kp09b2UgK3MZJUfl+fSQ7A2ztvA08SUmPpoqqB/Q +yK5kTUjErqZ5Xk4UkXNhbm/19q2AWMRRkaWyQPT/AC06XPZrGTPJVy37Py/M9HC6 +H6xo9w9H5/bprKOeeb/clBSsy6nipZkrGp4ICxMkjnkm13PtQIy1qVDAj/UOkswZ +WVpk7ANPDGf9X5dBXt74+7Fr84ojv/k1YTUCnNLKEmRwkrItZDVCLV/tPjYDg+0u +SAVkZTmtD08bQi3E2gaTw1Cp/I+nViuy9pbA2Ziok2vtxKTJ0lDPUVSUNBHQpVS0 +9MZVneOJTHUSER3JFi+oc+y24ZImCjDU4/PojewlE6AyDwS3n8z/AC6qd7k7CwXX +3ws35uXrbCx4zePamZqeo8ouZoMXk8hWY+XMxdib4moY5sfPTzV4x2VhppJKRaer +o440kilVgQzW2Qi53GK6SI/pI4NRWrvTz+wH59G3udZrsPLFhtEtyPqJLwSgAgdn +hlMg5oGFR5H8uqPNr4nKUlXj6v8AhGaqaaDIUM9TGmNmEk9NFVQy1MQaaDnzQIR9 +eSfZxuNrd3ltd2kSlJZYnQNQnSWUgH8iaj7OoBaS2aKZBcIpZSoz5lSAcdf/1iG4 +35JfED5a9SZjZdP8edv9P95bKot89obSo+qnkwXW/b2LwGCqqncXWW+9q1NJNFga +7G0Ua1OLr6JQ0cRnjkdvLJN7DVyb3l6WG5ineTbJJNDh3JKBsBhU40kDIPDiDx6O +DaWXMNtNGEEe5RxFkCqArmOuCR5kE+X59B/1t8jcB2DtXbO33q802QykOPTb9DlK +ufL5HH4SGClrsHicrkqyomrp6ahw4RKWolURNHF4VdnhY+682wpbSLLEC0cqKfzH +ma+vQ59sd6gn2G62O5NLyKXUh8mViNSn0K04/Po4O1twVuGZoyLELrhYOFCegsde +kEqLck24A9xsby5S40Mua46niymtFslUU0Uz59BzvbNZDdVLW/Zz5WprqyoaOGtx +aTL4EdTBIqMoKpCFkKhzZtR1Aj2JbaEzwO8kxBPpXHy/z9JH3FBKiw2hbSeB+H9n +r09dX0PaGIGJ2w+5N94SDF1GOq4ctRGKevqY6KoM8tDWVElIyzrUqul/QjsPo31v +aG2naRlaVljOcYpT/L03dbg0cIc2YcKxqpzxwPtH59GPxu4cjtPd9fWUVZNLQ5Nj +WVkMzOJaWslkLTSlfSPHUuSxFvQ9/wAe2b55bOd3VyY2P7CfM/4erWV9b3VqbaRK +OvCv+D8v8HVhPS3YdPntubjqssyqMJtvITGeVtKrDFJCqnyE6VNn0i9ubD2lE/1D +RVrQt9lf29E11A097bxQVLu60p/q4dVr/MjtT+W1uHduy/iF2vV782pSbOXK7nyW +7uotxtBF1X2Z2jNDSZWrqY5xWYfcsWK25t3D1xp6qOSrp/vJIDNGGkHsRvZbvHaJ +ebPKEBqzKQCHPADhWhHmPn0AOfN027dd7m27fZjNLAiorhiGWoBNc6QyGoIyMA04 +jqurrD+Uh273D3hv/ZJ7f2ZtHonY+66PF03yX35kNwjD7/2llMTQZ/AVPX2xcI2V +r905ePb2RpajIIs0FDQVEq00tWsnp9mO1blNuNpHLBFpn+GTUaCNhxFPM18vShJF +eoW3LZpLDdLuzWTXEKMj+TIwqCAPMg5+YNOv/9cpfx0/ko/OH4kdq4nvze20usch +s3Z23N1ZfeGSwnYdJFWbLpFSCrXc1PS5/CQkDH0tI0c4hWRXppZQwKkxuk5p2i7/ +AHPLQKzArQBga0IweGCel3LG620W5ozhkiKMCSOFfMD1pj8+q/YqfZu0e4qLIpBL +hMvh1nrqqg3LU0+CrcZg6lZaXGYnHVdPKm1txU1VHkKYS+JIKj7hIRSoVkYe1O7p +b/uh4dxTRfNbAKKZLgA0A8+HlwyT0xywbqPmBL3aonl2+K41uRkJEW0lnP4RVhxx +UgDqzPbs2OzENBVqw+1rKN4mYMNSSPH4/Vyb6Rcc29w2/hSTxlVqafsHWTkT6UY1 +7CB/sfz6Bvb3UcfX+7cn/D6rMbq2tkapqynxe4t2blQYepnl8lemPyFBVvU01FMz +kxRyx1EVOzcLp49jCCK0ngirIUlApUcDw40/w06U2sNwXdLa+aGQmvdpYV+WrgK+ +QPDh0dvBbV21moqyh27HmKOsrKuSoxNTkO0Nw1iYKgNBBDBTRRYzC0dRXVEeQDuZ +XmiDRto08X9mMVhAwJO4qFpjJJ/ZTP2n16rdjf444vqd0iKqKNoiSrGvnUkUpThX +5dQdo9B7h60ys+X3z2duLtHK55JWr6zNJR0mPxuklqTE4THUsN6ahpIZNOqWSaom +b1SOTawf3iOPxY2iJMWmh4ZNePRfBcskckRYmQsTqNK/yoKfLy6Vnae5odo9DdkY +OizE+FzPZNJj9i4itoaqpo66hetro8xVVlBV0MtPWU01PjsRJeaJkeMstjci5UZR +biKUAMUbgcg+VP2V49NxR3F3L4SXTRsVJ1KaMuKVU8QQSOHWsF3r8dcp1Js7Dbsz +m7Mjurc+4N0TwZXNU7VVVjooKmmrqqqNfW1Sy1s2UqqkROZpWuxL3FwPY42nfX3C +5kt3jSK1CUUYrWuAKeXHHl1E3MXKf7p22K+M8k+4vMdbZppoSSa1Na+ZOerJ+l/5 +iO89vdWYahoupMBXbR6loMT19isZT9h52DI1WPwlFJk8vkqSLKYjKpU09Tka+prZ +tbPKxqDcsFX3q4v9v268ttrkLCVxrLAdpZmPxN/Ex+3AHRftvLm47rtV9vkRT6eG +TRoLHWQqhiVFOAB4VqfLr//Q2/8AavbuzKvamVrN8x4ul2+KF6XJ1WVpRXYnIwZO +WPGfwapiq4JKSuXKtUiBaYq4qDJo0nVb2c8zwWu0xT3txdqLREq4Jyopk0FSf2dM +bBBd7vdWu2W0Oq7mcIle0EnyJNAB8zinWqX87fg98N97713vlep9q5/YWGxFbJn9 +vbT21umvn2Bh914wyVzZHaeEloIqbFYOvr6aOcY8M8KFmWMIulEKoeW+bN+26K/f +l+L6JImeJprllkCkYMUSISQVoQZGGDSgHV/9cnb+Sdx3rlTZd9CW13IkN4VtUYy6 +SpaIyuzaVjkqv6WCw1kmopV9VVuU2HZ4knq8FV1D1b6VaR8aZnL1Kqqkk0pYlhpF +15H0+kOSRhLlXFMVFOsmbUtJaCLirAGvH7K9C7g8xgN64+h+2rkE0iutQqTLFIqr +qXWWYgBgAGFufZ/ZRxFKk9p9OlUU8xUgINXDP+r06HnrHZu2cfWCZt0TpLTs8yRS +VbaNaqGPmkBVWR72Ckfi/wDj7MntoGRhHOQwHCv+XpMxufCfXGCK/wCr8+hm3Fno +q2pwe18Ks24NyZisocRhsNiw1Vkcrlq+qWKlgo6dSZZfK8gTU2lF5YkAE+yC+dYw +VaTNftPRd4lJRMRhRX1wBnH+AefXDfnavWPx1wGG3T3R8Yelvlp1NhMpWVe4+wcF +U7lzPYfQm5apaTBbhxHYG0YK6iSv69jylA1OMzi5Hip6lClbDTuYmkFWz7DZSWca +XUKvK9GqcqcYFfKgPHgeoy3/AJj3GbcZpraaSCJOwKpKtQHJI8iTkjy4dGS6A+WH +8ofuTJZjHZv4s9A02zq3B1dfVYWLbG4q/K0FTjscals1jcc8la289nZMKwrUpYv4 +xhyfO9LU0ayzwpNz2G42KOe9g2aK6sirMFQUkRgO0UrRkJGSKEVrnpXBvFhvuzQW +MXMF3b8yQM+sTyD6e4hJr2YBjmQVGltSTDCsrdpFbZfxr/kWd5UOVrtgbQm6vxlV +l9q0UNX1/nt9Lip90bspnBgp6HL47cVDEKSvgmonkSGKmaOLUwCMhIRi3natznC7 +psd3aSMkR1aj266BtRJpRXJCkcQCaDHReN6u9ktLRNu5hhmLmRnj0fBpcqpyKkyJ +R8HAIHX/0S9b5/m49z/IfLdMdH/xmhxW09y716xWpxUDClpFkxeWxdeMpkcxJUpe +LDR0slUNDwxXQ3v7OZ9j2y+WW33VkNtJ/atKaLorqcsaig0g1zkdIrXfd3s7q3ut +mhkbcIyfBSIapGkoQgQUJJLUpg16szgzGB3Znc1JgMrR5zENQUBeoo5qWviaoXUt +SY6r9vxM4Y6uCPzf3NGyb5tHMe33N1sO5217tkZMYkhLaQyAApQVGAR6GhGCOsdO +ZeU+ZuTd2gsOadou9v3pwJWhuFXWUckhwTQgEg+vmOOOqxK7FLlf4tT1GNq8bPjs +xmMVU4yvi0VlBPjsjPTGCoVGZCTHErq6kq6OrqSDzhZzFbNZ7lewaCumVhQ8R3Gg +I/1Dro3yRdx7vy3tN6sgfXboag+emjD7aj7eghl6+x9JlTX4yvrcBX3sz0jaaefn +gVFMytSyH+pAjJ/PsNpuEkeFkIA6GQt9LkoBQ8KdCFtzZG86yoD0m9auISE+QwUd +LHPL6NAEREk6RrpH5Rh7WR7tPJhJs/6qDpmeExReCyfpnP2fn/k6PP0D1/tzZbVe +4Nz7kqMJnM/RZHaeJ3hkK2D+JUe49x4iuxm3oaCvyKS0cFUclLGygp4gsbal0g+z +/ZNsXe72KzvrsQwyKwaQkAIukktU4A8vz9egTv253exWcm4bHtz3e6xPGYYVUu0k +mtaKFXLUyaDyHp1TH35u/sqq2tkPlDsnJZjc+0ccMTsj5AZ/BkUsGeiNNjsJge4t +x7YoNK4Gtz0E1LjtwRskmPrpRS1asJZ6mNNe1vPKy3T8tbjC4WLtjcrVGKEoQj+Y +GmvdRsedQem/enk/bIVg32yuILfmK4AlurRGIKNKA5KLwAVj3Kp4k6RRT1XzmMnJ +sOtpN+7ArpMftaqqKeurKXFTSU52tk5pFaHOYGSJllpsTPO48iIw+1lPptGbJPaq +IhVSDFkkfbw/L/B1jU0jSkxuCswpQ8K8cdWC/FbtLdnZD7r2vtrt3/Rj2BkJsbvK +hrJ8nJt7b27lwqRUecwGSzVGirianK4uQVVFUSaI6Wop6gF1WZPHFXPnLtjHbz7w +kR0BdIVV1sGdsEAkAKta+Wehfybv9vse82FxdbJBeaSxZZxqSiiqYOMtVXUjKkGo +I6//0tTCh3PHQ7q2PWVs9RFj6fObXWtNGxSpjoZqujpq0w8Mschp5nAYA6Sbjkez +vfIxPtV/C8WotEwoTgkjAPyP+Dp7kq6l27mvly6ju/p3ivIyJgNRj1MF1gZB0A1p +6jq+/wCFvzx+P2zN6ZTr/eGIz3Xe2aqPKSYjceUy+d7CFLWRzJNT4vOtV0Mmd1Gn +LKk4jkWyKGA/V7inkrmbeOTL3e4ttFsNi3GNS8EztHGsqgqWjkjUlCyUU1Wh0jIO +espvej7u+8+6lny5c2XMcu/897Wxi1mKOGeSFu+hEjBJNDd6qXqAToJGOje9hdjd +R9h7229uXrLd+3910G+sFkoZ5sMZKeVM/shqKGtSuoKuGlq6XIT4DK0rNHJGrmOl +YkAC5DUc8e4Xm5Wq2xRoCHP+M/VAiQkdrlFIVadqmpFePQL27lvmj23u4uWucLGW +13BlEiJJEsJKEAagEZ1cE1JYUqScdN1RsiLK05npYkaYKWKBbM31U/W/FueeP9f2 +iurUMp0rQj16GUF+FcBx2eR+zp+6+xGRxtUMfVYqNo1lOiqYOJViNvTYgLbVx7Ys +da0QxDjxpx6d3O5ikgQqxqRn+Z6CL5p5Dddf2T8RusdkpSVWUg7Vqu3KvA1kbyYj +cLdabQ3BmsbtjLJHHKkdDm4KespmmeOSOmedZ3VhGfYui2Nd+2vdNoeoS8heM0JD +Baajppmo01p50p1HW4b6+xyQbxBM8dzBKpjdSVIkY6ENRWncwHzrTz6qL2F3pBtn +dD7kw9LPm13Sa6p7C2NJUH/RrJsyux4wNRsmr23VYlsHkaGswtXKuSaoiqKf7upR +KRYvtomUIxtYctWm37Xt5asDnvYBnY6qgGtSc5JrwpXz6yR9t/u/7t7iyXXMnufb +rFc38Qa3ikZgQkdQ7VRgwloKheCgHVSpALrvDblL1Hu+i2/SPVZXp3selqsx1zXZ +IvUQYqOpkl/inXuUqZC6VE+H1eKN3bXU0jRSn1M9pt5J5pTeoGs70Bb1K1A/EpyG +HnTyIHmOscvvE+x0/tPzFBc7W01zyjdoGglZSND8HhdhjUpyhOWQ1yQeg72tm6vq +/feP1xHIY3F19JlsfR1LXTMbbaq/yvC1er9R8KvTPe40lWP19i66to5YLqxmXVE6 +kAnhQ8OGcH/BjrHUl2VJAKNwGc16/9PUl70i6uSrgfp6t3tUxtXSWp93YvCUWOgp +wtGcV/B6yjy9fkKpmrS4f7yCFlgCk3cuqi3mAWItJjt8kxh0dwdVBB8tJVmrmvED +HRNy99QdytvrRGG8aP4SSPiPEMFH20P8ujTb3ToqTdTP17Ub4o6KKrozFTTUdLka +Ktysz1EuTjhrauuxWcxdNj5z4Y3FPWQVkIEwWmJNOMfN6KtZxEqF3Sjawp1IRq7a +EhADSlRQ0NaE8eumHsUefI9xtBuK20vLRlTQZiYrlTitFjE2pTmgLIFFKFurVtuy +bKmqfjo20qOPH16bg28uy48PkqLMY6eRcRkf9Lcm6J4MTgjSNLs41OtDHMyZFYbu ++qPSD+V/6xrf3xsdD2+l/FE1ETTUaaFfEbj8J0/lTqHvdyO2Hu3uh5rvL1t48eXQ +PBCxiCj+H4RM7EoMacAE1qBk9Wk7eG1fuYzA8hF/3leOEU+q5vpdZS45+npt7Hs/ +0viNUmlfQU/w9AYfVeCvHRXHHV/PoYaIbI8o8bR+T03CJAUvbm7eQP8AX68e7H6S +i0/1enTcn1FWqD/OnREvkOuzj8oOkzTz72Xe/wBzlP7vLs2ljkyuj+7eb8/8McVk +cYg+y8n3f3K/Y/Z+b7n9jyeyvmn99fuZP6t6v3l4sXh6eNfFT08vX5V8uhLyWdqF ++/75W0Nr4UlfqiBB8JrrJBOr+DSNerT4fdTqoffDdJPs7uEdPxYGnwH8QxYnaWoq +6zJajuHRXvjky1NQ5P8Aga5tKqSgWRtDRSQRysBGkksbt9d9VaHeAf3vVqhf7IfF +TS3xHspgqPKpyaZZcnn3PX3k5f8A6zq7ctizvPptJCqTo7w+gPGprUOy6mpqIWtV +6OtsXKfDug+FfbtF2ZsfrXdm34toEybm7+7T7P697Hrt2yxQ/wAKXozY/VnTvZ21 +sVu+hrSn8IaXcNZWVZV/uhT07SaTtzP/AFh5WXYFvP3x4y6mU9hH9JAAgjpg1kOM +0rjou99191pNg3WX3Lls4vaEsn6W2rFKq/77Dz3Lw3jzlviP06IHoEUrnrX/AOwA +gx20hrqnyyVtSMQ9VFTx1tTgwtnkzcVPNJBRVr0pgMyQPUQrVAhGZTqGV7+Obe2+ +rCifSdWk1WtM8QMVrSorw65XXIsRdXgsGdrDUdBkCqxXV26wpZQ9KVAJHHPX/9mI +RgQQEQIABgUCSvH+twAKCRCyvrxAFSkkr7RwAJsFbGcXzq7Dlj/5fvyGG20oHQ71 +zQCgskn1egtpBybXwtADPQ1OSan6GXSJAhwEEAECAAYFAks9yegACgkQ7Thz9dMm +JyIL9BAArndUyab5gn298I0S15DSvd3g47AlTFXDhoq3yDAWoWi/58se+dq4Dpjb +entEm8gjsN/La0U7VtyVgQHV2fO3ErSnFAkRAJfLf+6//u0dMi0mKQbPUK8Z/Q1a +Dq97WyP+28CaFFEj7s4gB2MQgH+kmlok5/IE6mojFbHHMtJG3GFost5cfAKUt7G0 +9KJmZOj5Nh46LGVogoHdYhRpfW57avrQh5HfIbegOUnE6oxn0jwWPNrHzMPpFwcC +BU4wmXbCQwENqVjgfiVkkAP5ICzR/sWBKPlc51XYiwPIal4tKg96zZlezeGEc2wK +HI1i+aQmlVuKFzA7vQzjHf/RFinXDauB/xB9anC/z0yF8hCpr80LZ/92mLWuG4Nq +FJGfIA/DDCL6uXhanml8Oz2UbHwphCVmaJgb9fetGfNNYmfDtpxGzh/kOOqA7oj7 +aTqfT96zHD4L/b7n9SXfe9elttgDbjz0WFDyLmY1Bsh1kch+b3kCfHBqJgaiAppM +4TDwiBLXu/+uI9b9G3Lt2yw3canz1Wi5mHOfa3bSf5ctvTRCLkLyy8SdE9mg3FZZ +hizdXqNSVO2Ik2YsfdbI4PIQYGtrFY2U1BlMe1I6z/2mDZ1kLVGEqh9C+NENg/KY +CFDNn2GLkNo4eHcThdEAPUI4NLRVUWH18wl+A1s9ak8032jP236JAhwEEAEKAAYF +AkslRjEACgkQMXxt+Dx3Bc/GwxAAmneII98fueCMyxS8u65PaGmaRh+xZiAN8BAj +s55aKs5K6KHTOUTlTdSzfIYDtywzQp1B1dM5fNlyk9/zAwYSlBa8KGXTKgQjx4U8 +Ge13Md7nCDDgZQHJCXcpPW/w9zWJ/VXGBaxV3AEn19Y2LeSim6B7GXG1eiKiHypn +Su2T/lLlrO3Mn3VYhSP6j2ZFQc9ryD3RhEICgfcsxdo7Y/tWRTWc5HfsvDcw9Vn9 +LHIUURANnMlnMjyy3aQZMH/tA6/Im5arNLU2ApcEkX9kPjBn+eoKEOGYuOhvnV2s +YS6qxME9D2+Xx6ykmk4r/D7iUEnyNdYf7/euQG8e0NXeeygR7kliltzMXF4iAM7c +wwcMRvFiYUb4ML70IZCoZcUvxGbVbnvqoAP3Pk60GNZ4n3XN0Ikj9Ym/c2ghUgky +bY86fKs2tFYrNSjkbRJecmb+COnPEQCbpWgv5oPROg8NuUyEc2jJx+/BnMCONAt2 +h1/7UQ/KA3GlkoTDVIzDMHPSu2bF4TOz/UzjfQetj2RJHc5xi+AuIdGsuoqdnNF5 +C2I20FmH7iVN0GxetnKvyobtDgJG6ohO8RFuOuWY66bVvUhRwf3aHH9CJSxk5YV8 +XzGoij0JoHamw5P7NCPZWvaHSDt+iOkuvgEQqSMsmId9xwoYzk7GrB0vLev62V5p +UvZ+q9qJBBwEEAEIAAYFAksUNc0ACgkQiq+I1thOQa4MoyAAnpy+eTgbQ1xJy62W +Tqy6nFPXcp2mApwCTB+vK6Km7niYBYTw52SYIEC/Sf9FOU5CskFgYMerw5/8oBKu +C1JRGINxjjOI1tOZAiywROVkHrjQ7CxCh6kjoAhQPhMjECVUx7vmwmraI51aOkLh +ZJZ3XkB8PO6pybR5+k4zr4JBA5EL6gEFEpKymazrZBh+6CqgmQfF0m78eSQ2OsVK +sG8yeHxtZJ9Oo7O6yAWpzazOyDxaFKoet9+5cv8KI14187Sk+68tSrFhyNbasmIc +DjYbTieT/o5e6Pxy4wMvEkAkpRLlvEKg3BJOcw16mr6U+gCTQ1UfchBxFdATG0LX +HCTGX82nRZ8AzIhE1+RPwKJz0ixsDGQ6mLW98l/PZn7GPv94XNKSp86i2g689onY +Z2wVA/dfbzxXe7Q4/THenn8sj91xMTs1F/BcUy7jUpE7ErHxngxs1AUN3tAsd73k +l31L84y1O16vaQxLLer6sEmvpRQvzXIW/RVNN4PlylyDgXVI8yUixB+UXuKkLe9r +Cu8Z7Z2kzJem3DY4twliIBqet7+AYlTWgzg5gT8Iq+omb1VGaBtBXrlnSrVoSaH6 +obcUNWlA/Nmkj6qd39iIoywJrI4mjfXtQ300/pIPIGDpZi5xckd55s75PeZ9WyML +jF+ljOlcY1F1qbfl1TTx4L2ofzvvEbh/T+qQa79fKFPsmqoZaSG3Nad2KHpGJR1T +PFjZD/EktKuNg6m3iWd4fDi+oICcmBjG+lQQwZhaeFwtEnU2/JfNOzS8OfPi/73d +vX8nuaYdjCFnWs0NM3kLrebwcmy6gGskFmocn0rC50jJZ8Cs94CEKPHL5aN5jmpX +gRX0SjGURvMZDvICc0UJgqLPbnoWHbaKm5b0/ICobdjCx5cg9GJ8u6OVkst86Nne +WCqDSWWtawnH1WySkGQPBB9Y3nxH5j9aGr+jmCiCOrWbKS9KnbDq+JlDicO0YYww +iZkVSZfLWVOwFMhUfCbLNsMKGo62jEJd4tSCHk2Ic+xcKw71SEeFx6jgaMrV/Ic8 +anr+dQG2F7Oy3VBOe7a1JxPBg1R+r+Trtk6t0NTbGXhzevY0qmInqeCxAAC7+KYT +jgcL/YMt9BfQa9I02jNQ5FhvToCGZ9fHtUjjLnLoinv8JJI33aC+oQCmbldNHSdW +kYBMSNcAzMV8kSGZ8YSN/brYEcD1QuLIq+EOsAZw4AC/iknrxLeUHoyuumS3sRlq +/jfy3WPQ8M9wYP+z2w2+ZVkTb0LoYjbyL0FBOZfArQQ0WgkR/NuSGMV7dKz0i/xd +XYuLFn9p+sYNfSpt/lV61zYWdxsou9dCW7difwnhE2rkjNync6ox8tAkdKFBr3fd +5xnnUohGBBARAgAGBQJLontnAAoJEIYLvubR+ZWQ0IoAn0RtPgyMyGDQu7Pw7rXC +ELQr0KFFAKDPCtIYyMgp06G+UGsCG4d1LnYaJIkCHAQQAQIABgUCS19lBAAKCRAZ +PxgKtV2Zd4+7D/9sLmLfudG2tt7So9qf63bOYFHNvisHGxZjQFivM8V8VRToeSnP +gteVCxsX/tbpwcWs3dLzHDjEEeHIBBVKco9HVuTudiL2rh11+1BJsjFIsoeZwcBs +Q0rCtwKHSDmaSZRmKSgRIwz6V5fOHViPrzQiqH5L69ngmoBTfXI6gtmMo1plexf3 +b3tMHY4J/29Y9EjtfGiToUtcVW+MD1n1U+iI6IdsJETPlE8i2xfmeIADUQFjTbXL +g4mGga6lyxiONE2dyJCGqPL8ctyt+OU55vVn5vqx2oxI4jdTURlHf9mhEMc47tgT +E2HfbZbB8GLxbWnDFgQiZJZECfU3vG4IgUvgxDYNIvl2er1ZQxIgy3+PsbMC1OGC +V1cHl40HJns5AueMQ8cbx1cEvkpvxighlaxq5AKb0EXvs0G/r0HU7yfj4HwDETJV +8mpmCwllHxBh8bnVBBlDlebrintFjSYr6jdhdb95ZJjlgnbkSiknHBvqQ5V8w4eb +8+YOBH7aKwbhmhL+Pwc7ATrHeJFVunzsWFgoUyrr5k0eyz59vTGuis6K5CzzA0Oi +KIPupexetjOF4B+4eSYGLxlmO+1wPhHnisOTTyFN/32UaJ92ozvw8rW2VuywW8Xy +rQ+F8hyj1xy3sopoU61dLOAJXbCPYLcCRvHlsPONqjM9jK7DSggf+XZuEIkCHAQQ +AQIABgUCS191NQAKCRBVa7/wPwoEttuED/oCXyVB884L+Z2/CvELYowDzRmIeuZn +sc4eqlS1Oyio4Dxl6PZM+BkScFNV7LH3904tYqo7YNcoLZ5Vbu1j8OaAJGcvBf5S +MMcZfEULzLmUAKhPZ/J3XkIRMcd9gS0NwCvwxPq4wR9Iigf2UkzcGdVqvJ3U+FNv +Z6DXRt1C3FRbZfGqHtkuNJKp405PiuE+ASyJQe8B16tEGvcohklACTijQzmipp+J +D9O4Frf+iGWimrdObDXZdjg8zfOsruL1y5PqQ2hUPMLIt0Mm75g9QDcW/HhE1sDj +MSQmdx8cQerrBof3KfNiW7EeWAyBJ7+lGPS2UxWIiiLYEvxtv2KgheffdRNouhW7 +ykijxop4YLuf3jPB89hY8xLKFiqM/OWH7z0fP/bJip+w7B5mgmZSRmemJDVl6SMU +7xQ3UjLRASswc1YaiNatcWFXFaNR0+oBbLBoz8tHQ2kKzGWrbO10bcxV/dJsqkDo +gzK7d+l1VCwaI4CALFVVwWgt9szWqWAKamGv/9u8hS1bUi2IshG879Hgmbb4KlEb +/rYcOc2t1gT3h/7OD0tuWbUM+DSlK2Cdgb+V/kYH8pzkuYbOXvt09veA7QwijBrW +7AjOyZXc8NmlDUEayTZIeGxIdEmsgFidV64zBXOZ6w4ySJpau38RYiVu/XRrSXxD +Tw51NtJauVn/qokCHAQQAQoABgUCS19lTAAKCRBTPe8VXXu8WvHkEACF65H8WZTx +06KHKRKNpTMPNc8PNUKoly0mNYCA068r+lFWKBfjrE2F08Xl/W+GaO2q0367yTAq +xR4PTPDttGLxFUBWN/H/LdpcAxeDLHu2W/uK/ZF36rpHLCcVvL0XgyB7+Fj3ThdV +RNlW2denBQmuR7LhNEulqznPNiiKJ3kR2LjdFQVzPv/IKIWPrCQoNyDt7oGzJV8j +IZMHxIdAlxrcy6t1jUN99VhOrDZEVG0htFb4iSbzeUUjZRwYds+6twaVzAkrkqPu +sxRD2KyQiXlk1PM27p54YReVpYKb8qOKfBuuIYxNrZ35qklv+6H0xKwXLibsuI5d +jlVwrA9RXSKcna+VVnBB7m7WKdDqueG5mxXSYOLlrZjq7Aujwv+TWYGG5jVHSux+ +XtxjvhIkv47UjjUqmV6PUnZj6lwFuoHXCCPQ6GMSc+XZlx7tEf7EdTTxzfrn8n/x +T22bYQSHCwisV7TCNEKZp76A9MwA2GT4hTspHN6Ty7aMouCI4I7eofXtRAysXnD/ +4tpgpTldTIFN54jNI3//N5XXOEueRBF/WzR4rzHguyLoyEhbxEnDwbXuWZjfFgvT +NR5F+4l4YLFmkz9ofPG4CWQg2xlU4M9bWeydik2V10yEJXquZVYdmPbcR64ZzeCr +HkMmbsJ2Dtt0etzdl+t0hvzrSardywR68okCHAQQAQoABgUCTHaSHAAKCRDhNgiK +GCS9wcSiEAC89ttxfq/uPRMY6NLAUivhjqvNkM/bPcUjKmj2LcvSBz4lGzAPHWJQ +HakHgrPREhknWck7/d9jYYxDblRJ8Gu89v2KI2NCxc7PX5XeRhDWH11FQ1oorazc +hxW/v47Hv05ffDRlbpTKQalrtOzyLs8yqXgfG/vrYcNEjQimCHhYPenzsndp4rcA +97IAtOdhDEomQSw4c14QAqqZpoDMNQ72CapjAEgp/Xkgw+kQDertNw1gD0r3m4Hr +75CVR4HaX5ii5aUAUUjClb95ktbZ7HjROCVoO6NLnv+9Vogozcfrh8gnU/g3DcOU +TyOyK2Du6mGrcdaUHVcfSMCfmmQaBnGioDWManP6WhkAohSBS0HZVvXhNeb6fMzT +AEoj9G2m/lzsG/Kg9HN4b6Vdot3EjzAKLPyG281aorUvIQFB+B01Ija5h1AjzdGr +EyNguhV1QoGduvNJCHNACWBjZVo/LKV+VAi9W9yr7Dn3z0VP364I2YVpOYHQ3Cg6 +uf35ZsVHrGZdNw7xAo9BqzIGNA/+Xe6EgxlSEmEu7x6+1KkqxHPPk5gtJr2dKzA+ +T4toWbKSq5F5V50hPeqVsPdxqKjzNBKlL6/g1DYfwna8Cp+d6+peMRR6MSYaaXKb +xaCRTQg1k0bQ89oQPSUPtIWA3wjdXAA4P1ARMP2N7R6mnJjbbwdxoIhGBBARAgAG +BQJM2y7rAAoJEBtId+mxZpKHgzYAoIB+nrJL7I5Cr4QvhhlO/El6jlzkAJ4+6Qk9 +14NQmFDVRrmLzA/3Q1NXsokCHAQQAQoABgUCTNK09wAKCRCCeB3kbVlU+n18D/40 +xttbcnGbNQor5wN14MjgHRFYKPKYLfqp5iZw3hKhBW5Eg8tvofO2covZcIs42aef +gL/h84nae40YjW06BE9yNZVYXbZzvXSzoerJbKdYcuYGklKRAqfJ3vKP672uU7Zo +HQBmgGMLhegVsLuaOJJfzMmOKqSueJJrDy6c03wkcYsj+liK2I8cU2eUewlLN0U0 +38xp1CZbru+zV43Rwq/Clpuk5BqeM56d5szzwELHOm4ijLTFLBc8qr5l+KDEHJE9 +30MIu+2PkTzKo5BRm7XNhWq4/1ouKiAfXGDrwqdM3jo34/CyDLwF1mZtw4HNSqZt +tBjS8IJoXa/Hkktqob9+hFAPtayBXxJZhNgnjsu7tTbOIsVHanqFGYShA0DDaycB +s5nkPkCAuDNp9t6+jijWiNtB2UeP/bJHogLrn6Mv/2W600L6lCXA9gqMRY8jXReP +tT7oZriamSYgWbQndXXAFCOVM3wVC0JQ36IVDsjHmd1aZoQ42euq5vu+dK+kSWei +DSPWHJiSiD1LauAyEyGKn4XKOvFLn2e1L/BZAuUTsjyei5iTpSYpouz+S9MsCDGM +PTDJaKYWURp3/qI5y9c4Sd8xO5EhmbUZhsHFWqu2vi9/b4bFKhz1MGPsXDk6kHD1 +KiSaqxR2Q4epslWdyfwesw7d34X5YSV49wvLGVGUfIkCHAQQAQoABgUCTRxM4AAK +CRA/z1Kf8vJ6BkhxEACeYh6BXFa2ZYWYg+aOYoKd4RxXh7XBX7Ah7driPWsNTcyd +hq0VP2CY2trx96qdK/Xf5yHZ83UHuVIwtkr2M4+K3o9iWPXli9LedetXaF4l7PFL +yYZwYu19HifJn6t7DN8bNa7lkFu5TgL8Fm8e3BxTcQIoOomyDxYm4y051QISeWxT +9m4oPSO4JBd/IFB74zxUf997m4Lhm01mLuyEFQSYIi39UHFIwcbRdSNaA5AHwi6M +kL5ip2nRj1QaP6J5JeH5efBta4oLgSPrma1V16Jp10tqtfpot7K0mEIaRQaSpj9n +M/kgvsbU9T6MFZSvvT/sBTAEH2q8pRt4APIV8mU/bM0tuyQ/FVHYvamzSmPgKNLs ++6LnupuGBS+N+RO1xJ50rzCvVMQ4LhBCcdinshhXH492MKt3VlcN6djQs9iZhopl +j3aqT083WG75ylLuoQwaB3jmCV+J9VUTT1U6tTlrJnnx9w8vHbOITIMEs+rmSS/9 +RRZr+7h5bIwKPqTHhA1qVjruJ4L30sGMsc6uaCwF9mHbpjXy54PcoMpcXLgvj+9w +WGz9EB+3k5cbVZLe33qLGnTv4zlENskZNbzqTqPlDhuFYW0pOr8Mf5Vt9xNjTNuF +5xUVYQMED+6xIwwYX05IkRT5fCJ/2rIgnvw+VjMCbLZ70pQetF7dgmrtRUwiY4hG +BBARAgAGBQJNJK0WAAoJEH4q/cwONxoJAksAnjoZfzZrAyGlje7G6GVFV4Vi4O/P +AJ0d7KcNvSGi20pr2h57Krc+XepjQYhGBBIRAgAGBQJM1CP3AAoJEPQmjufy79Dw +RQkAoMDto1YFid3+0mq+lHsczMCKphVNAKCL1z17V2sx8lGyYYMjBk0plCdHxokC +IgQTAQIADAUCTgOM3wWDApIJwAAKCRCMleyeQza0SGUtD/9yG6sly5LmoXvJSJfD +Wv1hHP84El0NOf5JklVQgohzXjyRF3GM3hDzCItzx24718hoZpPoPJaguPLjZaoM +AINeqbC0bUA6VAHR3iLwPmFEPsB2ynKOJza0nd2MJgYyjM6U2G+lGzSMGKaXcAG7 +4nr6tWJqqPrkg4a4wv4UP3H9mt7HydiLN+QqNDr9pJ1fiQik8RIRPLgIyhfh+1nb +DuvupK9H7ZMBTsnz5MwOWHCnj6Dx0M2wCi4WuT9lA3hgOYMrrNO9DCw0+8GKt3YO +24Ivw5VsN613slD8BsOiWkVWuhifCJLFih7ZRqMFC5uvhZAmBSRjXPTtvAGde5hm +nnrE42XiRUnw4ikOObAFJ2KYgcOlhDTTOjzejrEPE+EPcuRB4GtyCMCtEEpzJcY7 +OXKhSpC8JByNzOdyjDfRpzEorU5Tsjaao6ILH1WJgAyYyosKc3aCtjSnkrmMLyc2 +iUd/LHwyHGToqoQCHVmAh9KL8L2x/MgkT6naJwB9a7KzwggMmNQhd2xOB/+6hDOW +FuxBNFl8CBt+TiDs3E8BrS18uKQrvUa117boqOewjqmwJMGKTLsmEHNWVjDFkG2/ +oES3xo2+qpfwWlMhLhMxjwqzYSRrI74aGWZFQEnUGlVObThx3saIXD1uUAeZ9dL1 +6+wjEOQWleL/MwEVADJUePpEb4hGBBARAgAGBQJOvCRSAAoJEAsDrm5OJFF8/NUA +mwfjmRqfaHmFbln2cyO97algu0mTAJ9vf+imI8yoxL9V2l2GiC/kDr4tiohGBBAR +AgAGBQJOvCmzAAoJEKvWMuzE/JplCNAAoL9zXofnh2dSzIkxqBKouJ8NYgTdAKDu +2wNCqRTDeDRiVjKpyWai3hpb5YhGBBARAgAGBQJOvE7tAAoJEC8+XTEfSeylyzMA +nA9C7nFOFX7+22k1zd+NIRScXChuAJ9l4Vt9JMe2J6FcfjIQqqvSeVi83YkCHAQQ +AQIABgUCTrxfWgAKCRCarPtWNSrPduWDD/0UdjOwVrlh22EdHqJJk2O3kLrOG/sx +2Y2QNI1cTD97xfl2MrOMv0h4mrDuinY8y2Fx60gTpa/7ChII/lExXKr7sHshj6og +RegdY2eVp9YmCiLZ9bLQA+vXQ7Efj9PdnunYEvSDL4eQEiw05UHujsH6H2l3un8i +H6O+Jqi1iaS6izKfbgD5R/KWQEiSLfS/zlqRm0+B+fNkuKKgvLwquDuvGGa5SmkJ +lESNdYOmGxgP5jE/EcxhpAAc2B5nKjhPtwFBSrATJ/u8BoyzS/+msl6Ig+jWJ7VY +waax2SJ0b+lLCbJn19AMMF5+zlllk0iFgJ0M47XcFvXdWEoOkxWuI7YH9bQeAUbp +WOSTxM7VnA5UQS/N3bEb6npVHzSCAv2UTB5U3t5zbTFEOoXA+5MzICoex/3O3Idd +brIOZIXf1GSaYIT4TwycB6UXLnUSBcwYV33g0IzILbqjbh27wCLeJF5wmMgU8xLO +0vGr23yXK9bBpBjWQcmME9q1kJXJ439RfjnoUBFeoyE/XpoJ0j5Km085c1ZWDzUY +6BRJjEMrM9kN1U3TfXLEHrmAA1Lw1EgAmxnrgX70WgnG1Y0EfNMbnJG1bHV0+46E +cjn0t0PuWX0KwwMMO2xw1UUqedk+Jq3j3LbRXuFMdD2TcAewj0QFp9gE8lQSt4k6 +MiUXuDTDCXVBt4kCHAQQAQIABgUCTr1SiQAKCRBNFUEQuEUI7HkLEACS/yoMCNKp +PB5/7pgraYwv+ddNTmt0XCDypJKLPk3aU+6Zv47ixzWb0fsDCZrBQsgP8jz8iIeQ +kge2rMlxajaKi92xIYSKYbLIENBYa07OKEJ4uQS78ajrSwtEMX5EczjyNMapFp6e +46FBMILhYGMEAt0MjvYC+7fEWE/i+QW9X4K3N/sjxV8BqTHYTLh5c9tsVhLCZeZe +5V7bct1HvElJ290ABk8XNMDUlrHuDQAmftJ6E0K4MaNFlA7pB3dje+bTX5lWo5RV +bfZ//E45cNOvtNWZx0ArM3OqFhyiusH3Wi/RgKDZtRJCY3tshpV8sLtH/T2eCXKE +8t956zCn5elZi5NxUiADSbzfyC0rUl3pftgsdOFBxRbwWpUkGGBE/ho8leXB4Jfu +FTva6+OnUTD2c1t0qpDvwNwsVkOLQgdVXtfV5/PYTmcdKzqfHeP8en8gFZPPO7kQ +xlDUHDNZGK7Jff+J4spFRDNksfgntIUHZ7qcQgRrIAlGj7zS9Y+bnfgTsqnpbsq4 +tDA+Cd7H3VxK3NF7bdrLhDFSeYdeOnRuZoUygJ0HRZelmYrRpLMtWW0HQaT12IbR +gIh/1UI2aUBoTALm+T4qeRxbTW/r1yDF/gv0f7soyJ/8aiUqt8/TdD0t03ZwTjQq +Q2wtca+4dJOKggHAYh8aL9BsD1WOitiFM4kCHAQQAQIABgUCTr5o4QAKCRD7Yz3o +9cuua7f0D/9g6YtdXYH36VClOJ5zhCH/NIboXJu51NYN9j5Rv1SIywXlEkSfET0g +WOIDpLGuFWFNnKdz9V+7u1pqgNgAyG5CFDiprXB4Yl8popy3sYiHD8Ga2LFbd114 ++xYmHi3o/RmdTf1O8WMZDeusnlkMWfuBXW1PTIBnD5BuMlOu6DzBMLwbsj5cDH+g +H7VPeq6Uop6CiGL8H6atpHfbK2pahfsWr/lLefFXmpmd7DRXXDqg1z1yc10N5J0d +Bzi1Bc5+1MTqASkuz9gl6Anuki0wwpZkiQcsicstxNjr6ZPPCORNBhm+dEM1JOKz +9ifFtRJ47gb4vsQTxmK6G6QZbmYGT/cQxnc12JNWWMz0a9Zl/Qb7k0cyhp60rbHQ +FxlrJAd2CsE5RBu2hCCN/I2rorM4UueRpsIqKCiMKDjgwHjY6m1juI98TqYwYMpb +P/3gXwVSzDw9N+krIUc+y3qwjLxJIRhUIYYiIILkK2Kx+YGZCR9qGOuY/lEFRMee +Q79ZpMtCYX2OHDi6CU6VUGYZ5bds70IMWO5AAteADg15jKwbBdoUlSNONMTx/+hF +R/Dy46+IIwHDgQPGxrcfB/ngvHK7R/52Tx54KOfEk9JYcy1BRyjypEpB0kmoOkNM +wbsll28tKbTsL9fUjBpRG3fzdkl+ew8oORVk+tLS/pcmR+yjYta2y4hGBBARAgAG +BQJO0ATUAAoJELJ7lE40iE6F4QsAnR1R23XrLJXjoXBpMTjB9LlIFV+AAJ45TiGU +FxHKJNPTsEUNvFLpSiO46IkCHAQQAQIABgUCTsrLgAAKCRCJofZRKiOcLPk1EAC4 ++q7bo7QhakHUSRD1CVNo2ZfHsyFmXSyUOCAHkzhtkrPwolrLqYB+NDfESyOn8RvO +nEEUOOLhaaTfXc3BZlP1uiDtpiNHPevgNkiCSsBK2nMuaCBUzKmxzAqdrfrh/Lji +PUhMXOD7mTskzvDGRFHiuUQs2DPhjORNnX0wDpVd0Jzop5FzUiiCovlVVZLfuq43 +O7tcbb5xH2JGQCTvTMYC0W7w7LdXrRF/dR2ny9asadDq4y+EOifX/scpCVcG/rX7 +780aoaSF+OzYwFdpAPabY47uS0sTfmfD7MTDladjDF8oQEZ6BxZ7GQB5Qwt2F/Ae +uODTnS88OeK+K5StHBtLOmgA+tPH7hfhXMddNTnmukI8CgGsppwYtyu5XazSZLQV +ytQ6gCmLdhYBdk/3/7juQ13r0Ew/V/tEem39KCH2/cm54PLcHZxCHgMQ9FBZ79+c +atwFKCFaJeqAXdxsoiN06zxFGnLNy867aiP9d/DkWeoGOnfesK3WkYKl0b3ShQsa +ZCaRgQA3EYbtlM/FNQxdzgNENfhMune9wqrIaMNQyyH4MA5SGWMb2AN8kd1Fzofc +ixvoNIneEDiqkE6dYScwOn7LdJ5VBHQVb/dHsmE/aUAbmFa73VP9FtnDEFjZZ3VG +NWHYF7bDmg/0RNKnFbHtwGkHpQOnu0PzKvNH/j5EYIkCHAQQAQoABgUCTsFkCgAK +CRBOvAyfAgj8ERcfD/wOQE7biSCEjhJE6E0dcItAsCStJx2PVuo3CW5JgHKuEk2u +yasRGL2jxC9dc1hDH586OmCHliaxFI8VnhFGQ5EELvyqWmC2iLMI2Y8uYq9Ph9zE +hJT/g41HUv6Z71ce8oLbGBztoIWK9FMsIPcoLILiFx5phWRtcmK/thKcYVk0c588 +pVRytgtjI53gIPXj3c804jWfgKbCbPBRErTEl5j2GOV7M04WTuBOinQA2f5w4wDp +05Zz7Zub5U/5i3+PaRH1a0ai7VgfgobkPs8OS1EVPdBCORQJbcc7f+sADd9ERn0Q +AZkGxB1a8/cz9J1mpHTgGpctdGYfQqgvPJSVDVEEIBmZ894dObukPxyiSAF2q07r +XF00sEqYSJsJ/1Yti0DsReOdrMmBWDN2CRQImu9oVYk3jUySEpu6b1kslZ/5CDoj +PRrfbdXO5XULEX0FLE/ieQj8+Y98tPRw9boJ04EKmVdEySCIE2Dqvn5xpZStpl63 +jEind33FNOL3Ndt1NXwrNFfwMw6O32xNaUWI7tpdXfkeHgawzoZKWhnqZVOxZUZp +jyVaTxFOGm+qU3IRAsPHpQDvsHOCBxqpYh93hLoYI+uQReLB8nI5K+2/3uFfjQeO +McDpMyVNMtaa32FOjaWEiFlSu4Rp8qRv7G4ujfvy2VELk0STDTUy+4zNBq8U/4kC +HAQQAQoABgUCTs2X0QAKCRD1T+ZICIM1qenOD/9cbWZVYOuUIZ/8ZTi4tBHckLjh +iIFyBlgAwOKwhYIxOaZnQ/jDLIQuUwwpPfCVM2hooR45gz02A+racUwvhL7exoYp +htx0KeMqxzsWIlWKLvPm9oN3HF4DD0iH/l4ctBr/5VM8FhDZeNA+M7PispziM/L1 +SUl6lm7nD2CaCh/R6AGyiDB4AXhnKQCPGJUjY0UlJcCfOvEAnpE+4P3/IDl4T2vm +1pTfGLBxJv94SxjuGR+Lx9kCMeO196ixl4EAwBEibIc4LVGfOjzPtc4rNVPM3S7h +WatdTgMDXThaoFOnDErlFOSdcmw71A/+mEa1luUr27+/KBSlnmdWcGFTjxqDVOD3 +ETmAXAOBGp3VNb71Fd5bCOYguVvAxlJl5lZ5OUqaNM0FjNrz/XWRVj+ROxo6uMD5 +9R10wdvFGjdFLn6Vfwi3mwaepDUZfepA+URQvsKX4puZAX+5U61fIqFFOTgXAnJb +D2p/HsnieNx5bWyWqpM9YI9OVYfDnxdnUXcAPz8S2MxosEOGy/QvljQ84gnlh+/u +ElFCnU4voT4dZNnEC0BaseUs1cXQ2UDUA4f4xXFDkuzevEjFdGSANVT2XkcFv9QY +HFXShTAJILVvDx/9lFfqW7BpsMX6jPlGxsbmgLr9KTbOOtiw3JwnI428F1Mgc1Og +L47C5uP9pbGD0zAg+IkCHAQSAQgABgUCTubiXgAKCRDGh181Qc794LvND/90tpSk +f2l9JI336EfjjtsUShmzqTolRrMGDuH0ibIAMNsYwMrl7cBdQitUoPIQM/BuO0hW +fnbXcH2h4P3IynNeCjO1aHQE9pEb+KbnwWVj+cXnIHNczWDuI6qXQ4ELcIK2gnsc +VZFP3dj8S76D4lgQn3qLkocMdOJOo3U64WJ846b0FdIpUX00231FRS1eA6V+KdWv +VjOHA/fprV4gWPQGuRMF4UQ/Ll66Rbyzl3PlzYFwr2tOyyJF0UUDCpU2AWN/xegM +vXHHc2cJ/C0TP37W8y5lrbS8wDcyKFoPDua9zhPr+wZteF0GVxYXzC3i1DHBAhH5 +tjWHXk+QHEa+jzwoxYmEYmJ2LgxEDT0Fzytn1y52OCu+uhWznVWUiURnGhF6c5l7 +eJXDq/1lHkO0hoAxLAIfbU6gEgfjy2foOGxOTtnJZY45vANa1MAvH2vbemGAWONM +65HeIBgNhgO245FZ7jCJ0ss8ZvM4NhVi0Vvh/z2yjQguvAEEIqBnV3um8Dh0Qxf7 +cbsRfbPyoHHwX+0o7mS1xXspI/Rzhc+lYzqbY2FW5F/qLrJ1KwZH3zR8POReKgLN +Dbg3hstxy584NxbM5D64ux89y9W41oZmEohiLIH2REgnLIkfPJFmn+k+D3Tlk2fX +CTUkkRo/ADpifwKQ23v74CUusv05NqLSmRH8aYkCPQQTAQIAJwIbAwULCQgHAwUV +CgkICwUWAgMBAAIeAQIXgAUCUSCPTgUJC9IwFQAKCRCbuGOw9Ru4irAaD/4/7pgA +xHEyLq1tcTh8u7Vpv/dtumNm6sM8PRRcLNWaHWlHN0qCkGdvaNHCZkBFQiXGi8FM +HZYfhIzuCHsoId5gC2bHmaZfIWveHhMPGXo5KttyWUNZc58Vr6/yssYg+7IUj3TW +VSJHcx4nZDDfdl3p29fiWx8alI5Eme3NFOtTLlKKMz1zRIQdUMMfsBGyFe9bZE6X +kmrDJkj6lLUNp4Xw/34NtlgnrAvNmsdTGR9SWhB4LNJTxZUWq2+2mRLD3OEW61qF +T0zRdSPxvdFloQ/XQKAdSNv2V/7wIcPdB2HFZdyf+SFnBytX3IQ7LnQZoiTZ4Pfo ++MA68fPjrJEAtdmHDoWhk73ToNbd8veyTFWNBCsVee3oLKh2LDnTFnObG8Ba4YSN +ivTRkpkt3rtgUJCF06b9S8GWg1vsIgVQJgv4mTCu5+YjApefGOHA4I2r5NfxqRbL +FM25C86LYS3z70PD5kNAPqcrvtd4bOvo+mICHPYMTWSDvlmYLFAgtSx2EDtyGZ4w +4et2lLhhEPPQEGfOrM5IxhviW3thBPl0QGpSKY3XdviyWTZ8nzjuOoW3bdBhgpAO +jK6nzYGUuaxIRPv+UsRZ0R+j+cjiigyY5RnHqMxMT2VZ+hpej9HfJaTkla9bJlDu +THTpzGHNemLOJdHFv00RFlCNZb2bTY59CeBBOokCPQQTAQIAJwUCSvH9HAIbAwUJ +BaOc7QULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRCbuGOw9Ru4ig2aEACU2sdb +jNYVomdNeLTEkHpF8TWURZ2Gbh5HSqv3kNklpDUONU4f/mhuIyVLQ72LkRIGylwY +VgyfOEYB3kgTEEqtgj1XqEcAvJCafMiE5fGrBr8yGchFtSq05btZtnJW60rKDksU +8VhKsAJ9anj1Lt8hWeG9LhJJ8JX3pZ7gPSmDDe81Pk70SiYOfdB5j91hU2quy6TQ +SxuNRspsElHuoIo/DU5sayTG6JBjtCrbKTscHfW4uT7JQQof34rZ9XLk79YYPoII +DczXcsvg9Wx1kFQ96Y3GKCj+RL+2Vhw6MFWqJ+jlPOUJ8V1LfyC3Yc2+/hQR9KZ/ +g2QnYBHw19huvO55qnGEvCNn4RwueZOBGh0XDBw6ZGxaWlxf54y3i02djDpwkmgq +16CrrkpBz25nYs0INiBxRwjN9xgEbBiRo39lkouvBKc2Si8wyaJhKD09A3w4i1QQ +xlgD19VoUqk/80Yway9DbZMwh+tmpEtVXB+vaNqfIwINMabjsZPPiSj+8wlxLHOd +QHH4gGovxVaeUHQ/BZVKVZAFu/fD5+pasxQ0IpZAcneKoZOxShpeRpzkP00rCvaL +si67YU/ak6LxBHWcTJQxcLytml0TdC0wk0WODCC+rEhQ+jM2uDnlr6N/EDuujqJr +bqGfHNFyl8a6b/9l7S/b6gHRdkx96jfu2097t7QhU2FuZGVyIFRlbW1lIDxzY3Rl +bW1lQGFwYWNoZS5vcmc+iEYEEBECAAYFAkrx/wUACgkQsr68QBUpJK8ikQCgty0w +1I+K7W/Lx8BYFR+m04MfFEwAoK5ldisJ8CmsyWR68OT6RocYZVjxiQIcBBABAgAG +BQJLPcnoAAoJEO04c/XTJici/FkQAIJDo9PW3CY4Qu2pTlwuMVBSB9RHNO1UJLyP +Geo6pBhN3KnpJu9ClqfmGjF/Ln/hXTlX2S9LxLp5/YU2l7JZ7kyfMd3nlW4tZQyP +PUzgYwGNaAsWPdF2baYs8fk420ahff23RT/aIu2kU8kLy3J6B3daJ+bflm09+dfZ +cbQXBFsHYq+3r1R/F3FmUIbFAZ092CeMdiLPRNF07c3uCi6g+NyxEdUVK2GlYUlv +RwFf3PUy4lydUMjaRvuEoHENJOObQFci5D+P/VmROkhd50noDEWUyFAieY3CXz1T +0Vy+8BmXCI1Aa+7/EpFh6V9DZBI7xWi1M8gg/xCD0EmgnUVmZrxUdWMsrVu95dJF +Bpl3rcsRQ28ur9fnFf2b4E9ouN0kJGX7uThUf8aeteB0cjatEThLEUBhXY+hl47r +e6ois/aLN/SzwUYBHpGowCbvGMztj429qhbZYB3lkF/do3U8b9+x5Y4T6cjs8hMN +uEXi7Qah57WGGePJLfeGKSerKdt2yMG3ji9xzIAYUOnUeQEo4FE5TbNlBClcMtMP +2qb0OFmaZTN0dFz6So8eaKfM2yB9q7rhIydMlRmXXSWlaA1UQ29bPsC8Uyqs3EEn +xjDy3TipjJYbSzQjosKGLt4HsbEdWjNng8mMaLVwtxlZGNnEGmPI5vdnSdv3zuMt +M4GU78PViQIcBBABCgAGBQJLJUYyAAoJEDF8bfg8dwXP6gAP/01RptxEUiIP74GR +Nbd97arDQVY97KibVDH+SsgRgmTo46Mwed4FK9eK8v4EvulcnX4H0nCBoa9mI0Cp +ttI89V60HE604KLdejSKQ95ceiI24HXZE/jxZz5nk7sZdkGsLgEOSs61rLI/cX9B +aMAE6fRxks/44D9WyP4aDy4AFzO/rhKQb1+6qnb0icZ71G4nExIOhZkv1d61SxXx ++HzVHeKhayxG21k3IB2sm1LMFzzCqp8Plg6RonSiLNyrDLRdrNFAB5IUa/vcA/uT +6y8+lKSGfYhfxBLoz1SJ6TnXDgMvC5gfdooKZElcribYrXBWe37yRbCQ5JDvyOF2 +Mn5jLl1ffqM9Y0LtFRU3azdtTRwls/p/kcmSGZq31ijR1UQFxcWakPnwDr04+1xI +p4nweqZGMk6vCQr04Sxo6j6gFXQJx88cMgY9r3TW3+Jv8ko/s/CAr/1dqsQPgqEP +Gx9FtsCwBL65MvuJBVCWxHTOTWEwNAMkf3umHttfSOH3t1IiLheTSjEpexTr1lS0 +00IzkNULuOj8Imw1Yx6BYOoW3kPysBts/rnEa2xrQMO/OptXaW+byCaxDoZToa5X +GrCJuIkMHw+ago9mtl59GnWkAZhF4us6J1vplq/ciHbcG8ZA8so4Qpu93kyZziMU +nBdPpYIXeySSgbTlpsrS+39o3PdeiQQcBBABCAAGBQJLFDXNAAoJEIqviNbYTkGu +HSkf/A60mrVc6B10BitxoSUfdPYeQlqgnk1KWtprknb/Xm7PdEl8dw/MRiPtvzYR ++/NSaxEzuFRxoAa31SZxFsjhPWNFwqsZ+n6SZCNHiZow0PwGBbs9Ss5QuitX9MTs +1Zcx1cdJmhhSc18Q94VW461Dkk6BXAKdufXpfDlRur63Ju3GRKxQTpv1eBwf23YN +J1hBwjj6h7Ai9otMDnlcW5KtFvwwIyp8i23YKzUHy6K/Y1SuGvGXQzeIoD7ejSli +ddrAkRuBQBaT3WO2NtIEQIP/cey3ib0CuV5LjnMZx4wNkfJ6KKzYPbmXIu/8pWTR +wTNxOzc4pYIhaMmWg4W/QA0mtCN5nfu3qvKVTQuda+vXGimDFSfkBbeIMUQ5vkEJ +Sf/vlg3Tv/t9P0AsmevgOi8hhN1s+utDefqeET+dj7VFcrKhonOli+Zy9xmzIWDW +sv6gvMxxfnwvWW2McGyh3dE6bbUr4SRHamAn8CKYMmelnzEFIWYZ+iwBkTgoSm9u +RG0aTL3Uek9DGMWJQ0SaQ8GfRDpMAlb2h5V02IMri0kVU02QM+5P8ovzkAVfwxuY +LwBr6vrtki9C4qHq7mMI0KTFcGEqPtpLcj0d7WuvGqbYvJtj5b3SQecd/JwA25kQ +96VjlZZ0A8LTjL5Vbbj7XO0jsW4YhwquTTCKfSLxS+dl4lrKI6uwshKE12AKRPpN +iqU9/N8OY2hqh1sPzVwW/wAObcdxXcxvrQKIAEhl16C5GkUq1fDzNQekNVQ+NteH +Wshj2ECT3x9Q/LZ9qCoM6MGTgcHA4IGlWLQ+lpgsxiaOsb03ffHCB/irKovRkjvj +H9LBiBNlLaO9VDBntWDxFnVPKXK9nytmcmM25mzVzOVmGDw2wzsSf6bHB36GdYjB +2vm2opxlpKj/9Iww/5TCfMIKQqi0ynG02dX5YjxWOtKX4cP46KnkaNRS8cTXaROg +wTIpZc4D34JPwj/Vqa0oFOWXV/6ffMpwFKz6hlIVeUK/arAmhGe5NgVe+yDHCkV8 +/43ZhLRFrhh1WCv1akdrtYy2KR6IBbxrp+gag4Nm7p1S01pT6gjNVW/22CtJ7my+ +iai5mtURJzTb1gR2i2eUG5U8YIwN2cthWLbcdAunQ2LyWMAN5yAHi16VTb+uOC69 +utPyIKm9hxgvLOT82UoBrmYnFRD2NXhL7CmaUqNub1nTJQ6S4Pr1In6I7QrzQw9x +xXqq3wBKbxwKVfAXhfF75QT2AeXG3tZIXSQU1A3juJax7wyF+lA0NTKR05Kd4Qll +QEUaR6PmuD03fhd/tLGNLLGcA19/+7ud+c4Y5JxTVOCQRt5muPWLOtcgx+2r6e/C +W1cdRchhNo27u0gjua/YoVokAOSIRgQQEQIABgUCS6J7ZwAKCRCGC77m0fmVkD48 +AJ4uPH8gQC1E8JYQ4QBx284gmbxyEQCgiUAoLrJ4wIGvk1fAmaZfitrSM+GJAhwE +EAECAAYFAktfZQQACgkQGT8YCrVdmXelJQ/8DHbNvWQRM925jeUlmQYcfQeUcRS8 +2xacCWx9gwa5WzpUsLkxfb3hiPkWaD0g7AJfpXjDZhCYhWpvh1/4JayI31r5n9uL +uhJrs8vF0+l0kMvfqbnOQ7SR4C5U4zmqQx9f0gzOfZhe6U+/2p1QnCWfDXAG1zrP +wX0wPPaiObLJwqI4smVHIGlciFI08ZSuIO3RWCFp5gilDXmIcIxeNlC6+NbBOM+y +XT15gGjFcxk8dTdDlYXBHv0O4sh0Nyw2UgLDRY07K4jYtpmsD28DvATc9xUMlwEA +SCq2L18ZChBqbp7UwO26bptk5xa9PRYovNGJ1rnyW5MCBOooH/Du/8op/xEBf0tA +h1s6AEyryTWMIRehDFoyhkw70RiLaiV7J6trElEzVxmPGMMWrBQ+OnHGoTMWc9/T +lxCd1zGbtLZnMp+Xv1Xj+2aHmK2ojgJBwy++QbhsoH0Z0lokMhD5WlM8Rr7hSyVB +YosqrYsaoR14yjFxm+f5cYJxfVzsPFCcG6JgykkzBZbeRfrh2/0NNKBWygY5r/df +c70TwqxTbgffoJTZnTVlkpxgLy4KG72uqYf53TH05BFT4LXaLnVn8pWxQr3NR2ZN +LM1ZMhP3d041rmBuhvHVg3Rg6H5oQZS8/aJs7McyQa1G0Ge3jOIr5LXG9LHJJY+f +oVtaTAqCTEY3XoWJAhwEEAECAAYFAktfdTQACgkQVWu/8D8KBLa/TRAAnjYP9bVA +bUK+3af1LsoY2SMG5uk8XLFT2KvRkazG3+Fb6K/WBU6fWQwHVYlC+mIJiRtViS+v +xsJgEJNLAVMRm2O2/pKrYGDICxdrUoBvB+4m1d26un23zfsQSk0sepKqO+qwVZ0X +EPGKgv/RqrixfcaIZRZsbIYdQd9rT10/THdCiRwmh3FTohcGKxKWCik/A7AC/9Vj +QdbRQysQicUkZXHBVVgVPXB4oVbVAkT6Ccg/NEG506DTcLmSyiLp9R4fv4NeThy7 +CjeQleiHg4fflRC1fS3kBIpeLq7i6ZxJFMdo93HuT0fcVxOIYByAoTTktcKg/Qb4 +Qyd281rcOFpzQ8MJ2WWAgjmpR7LG+ihWOjutaWLTlmlFjZK7fdNLOq5JSpRpErQM +4cDwzVuj4oibLvOzdiR6Tx2+Ux04tMTkZw6p4cfMpdLjMzAasAu6IcrCEfv4tL05 +Eo/kDHLHTiW14EP9U89GgSFfK7UwjPPKyZdj+v7GwQFANA7Vte9tAYgMgWALARq2 +1tgmfu9OZIVbf5fWfr361+vqp6a8vK54aD6ZZmvKYwVsK4F+7Q/tPxMLAbE0Qs1t +CyYJToaYRkvDKwESEv1ajLc+vsC8Q+5/ckmr8gE3fHlR1mqrfYW4WQl8s0SXF/0i +ggP67OrGDsNX8jknfV9INUw1mxwJme9sTcuJAhwEEAEKAAYFAktfZUwACgkQUz3v +FV17vFqYChAAgG02Y0ck0hvD4wC1N49euSkxPGO0viDSveA5w443i3cIQW+mNhAt +YRR6fm5EYpMX8ArnbSWZKColrx1lnAF+pb7qGm/1iKhWLxjtg/UwylMXum3eIcy2 +RYsCM9bOvaQsUF0T0daSk7Wf3zXKZKZjOR7U1atfAQ/m83VapuZHdQ7RrQdzZGOA +t6J5rDyS4LUY8sB9Ux0hSYoMPXhcIhd7vIOYIuxElJZcR6ufdTQnhNJ2T6x1n9RG +OOsB6DRgaQ/XCbJ2wZquCYWXNmWjGR4GfzrRVwDHYXk0Y2C62QdX9Gf05rFqlNPG +8eitSnjsWDbaz/oDiV1pb9zWxDwA2Wa+7Tme8J95/snVDxTikj8oBdl5mePyKp5K +Cfxu9BARzBu6A5Zryooly9t2N2yWvTCvrDmWQOkP5u7CsJX5BfSaLFzQ7HIQb+nL +0IweTgKqAED+WJx0EZOltWQHLJNaT+5TOMhqHNZ3D+1ZaDJWPXp1ggYqhtCHbCp2 +qzla/6pWrruETjA8sN7R8hKLq2LEHfuC3+hnMkpPuMgHd8noq1FNHPWB7ywAghrK +WPoWhxXabTBi4aLUdNo2toZzmQalG0I0WbjQJa1A/2MI27vqvO+84IrTbkZpcdn2 ++A4/xBH+L3YrzlQ6JVCUkLGsERmev/JNktib17Psp7mGzfOgow5tJnmJAhwEEAEK +AAYFAkx2khwACgkQ4TYIihgkvcHwdBAAvehXDEApOST9KS9Vhke1FE6Dn7xK9ujq +tWqVis097pyLW+LyWaQdYlg9aQkD9kYxd929BaOVLLKdTfP4Ce08hSgkrJ4XJJC5 +z5vAIZar2z4cGdvYM8vbjQg6O8++tud8FKs1T4OOVFXqjjzjdcdrNZ0vuNdCghH6 +u+4Uf+LkelalGsEUi6DCBJiwnwNsYGCuKijc57ZqbTYJ2jcCTVPDjRrVIpRikn/y +OxKlqJHzwrrVNSbiCNWrvgg9iJLXNWJBvg+cXtAVzXTQQEhIrdcUI6s81piz7s3A +4EQQRKN4+ovxvkbnn5YXZKzv0I0b0Juz/6VRxiLnV9mcPjInFeF0jiyM85SC45a7 +TEBaTZQNP6cbROqWCaiVf0mLf1Id49ZpiHR8G8IywOgHb7K12poaETfMpje6KrVj +zHmVOPR7cgGtwgpPR7uDHaHogVzJdPybIx4pBGADa9VOHXwJzMJdGSR9Gg3N/ARY +2m0tHGkSpgpYBKib9D/hpiApTRqZ/0Lz0Tk+f/Mu9Y3VrOm6Yj1ocleX+1OW8png +XLewnFIBgXIyvD0Yn2MM3ZF2PsIxVO+wU60cznwQ3tXOu+lzJLV77oqtSEL86SIi +PDhZRIwr1KX4YJlwqB3DS6wv4ag0sCO4uVZW0vHTYFSoRbqsUVQh8XkhYSO5jgQD +A8KJMLntuoiIRgQQEQIABgUCTNsu6wAKCRAbSHfpsWaSh6g+AJ9IxqG15LJm8Z+W +kVQ+RxxCMp/FgwCgtKTq7T078n0bepdi+3dtrdOexveIdQQQEQIANQUCTOJSoi4c +SmVhbi1TZWJhc3RpZW4gRGVsZmlubyA8anNkZWxmaW5vQGFwYWNoZS5vcmc+AAoJ +EKR9Hi3QHg4YANYAoJjhPnn2X9aUeepb6HzKkP2REJTOAJwMqNSRlUdSQUBfUC93 +xCAS6sUJFYjKBBARAgCKBQJM0rRDHxxKaW0gSmFnaWVsc2tpIDxqaW1AYXBhY2hl +Lm9yZz4gHEppbSBKYWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT4fHEppbSBKYWdp +ZWxza2kgPGppbUBqaW1qYWcuY29tPiIcSmltIEphZ2llbHNraSA8amltakBjb3Zh +bGVudC5uZXQ+AAoJEIs6YB8IyXXlWaQAn1tiQjM4MyZA2v4GlT2Te9p05dSTAKCR +puwROcbdZlTLygOhH9j0/1lXXYkCHAQQAQoABgUCTNK09wAKCRCCeB3kbVlU+sPx +D/4pOEtn3XmEjdtGVMe0ihQw4QCX4SesrmaFbB6hGL+ltf/7FupbqMXJ61jmBDza +EzBpEul91nyQ57fYMCIXiTDwxV+nW4xO19/uPTxxdCNDiCDz8NRN+YnSWebculTD +0sFMZe+Y9LvCRqQE2T8N+P4yCn+RUcj2Ch9qZ9hHQIEzWidMigUJ1nnZno943Obn +ekoJM/7/oUFPxG/AqzV665wh/wUotbaSM16uLVI1ikOhaNSfTF+T2/Do2Zvwiqzv +FUoG4Y/PYJvFEIevRn4XuAaw1mvf3FCF2bnjcuPRChApZKX2YEWlF3+UINDF1l0v +ktao8mMJgUKhiXXtURK+CNYDWyAbQyqmp9QY2En35ktiZDWKoiWjJ3QiDL3RznGW +6g6F9hKhY3wwB2On/lbn8w67skFPyTdKNwONU/Jz5vppIPryGHsrwiX1fP5klO4M +j91tZrofhcaBqZPrpmQHfDHj5Rw0k1ztptPybqaRxhPYyachBnbgRztC8EO/k0RS +fcihdLyMHjLax+r64ONZuFFC8awePmC5QuA+s8VlZctmuLd2A8Gdudt/x7IkNIEQ +H7ZgaOM8j73ng40rcHkZQW33isbaMZJtizyQs7mzzMBeaxyzkv2y62pKnYg7WS32 +HQAiStgZL1hjRMqhaH8/ScZ1jbWQnZDMfVnyZk4DdudwRokCHAQQAQoABgUCTRxM +4AAKCRA/z1Kf8vJ6BqIXD/9rPWy7oBCeNjjUxP0CqxQQH8N4R5iHSdcHm0001DhB +YBYJFG6/kyO5Cg75wyT4Of2utEdLo5Rystr5ZdbQ9fAarf+aLSu2/BKMR2iXdegc +SQtDUzVbMmtSMy00LAXzwQ74pW5w/822B1vodQn1iKJI6zVbkCPx0GOnHEiaPjBV +hLwEeimrlVpfUD/xEQgqGIDj56eOOxgAS+QnNOBT+KcZ/+VND72hsVL+0iiGGF8x +h+l896P/vgJem6XQlpVWfrsxETPSjnDXYpTaW2Qyk+mtgsfhmwigtDS2nFZZM0/V +WW/nxpoTDqIIFK9G8pd6cmRBJxiYeC9SQ/ddhWVVsyxAC1nti95pv8GtZVJh9umO +91mouH7m8Z75vUYjiAOF0eD90oAjAo/lCy0H4MrvkHj29+5MFMUi37SrdVB6aKWz +UnVhoZWDhEtGPro5awcipdjlwoUNurmGF0E5sUMbybxhTPrdr0o050AG9dDa+M+v +yFy3UKHmErJxAxY7A0IsZ3M/ikrZ6RIR9UOhv/5w7Yvpy8PDOJYMGOpKUZSp4Wg5 +Rjb6EqMrp0Xor47Cw5CV1fHnuMYYpTCv8nID0BdCYBXTOLp2zVdj5gHUSbC1VIzq +3e3HuhiupHc2GWahgPKtt2iymDEqzFCduuDho3zu9v7uCCsntURNFKsAXZWrgHK8 +EokCUgQQAQIAPAUCTNLNqTUcVGhvbWFzIER1ZHppYWsgKENPREUgU0lHTklORyBL +RVkpIDx0b21kekBhcGFjaGUub3JnPgAKCRDqTcrcTcqoj+ksD/97lFmqIfbJKNxG +SACbAoR/CmKLEy8bHLWpPcm0e95PDKC8byDDab6McADwsECHZaKgHizynRn1OcmB +SHVrcA8eHwwBHqxV71Ocu5M6IhQ2nU1aW7V2+d028XiKich++KUDqtzighIjvOYT +BtuFAl33vdggAY1PEl57UsPWy8PxNjJW0i1VMaGboOw1lnoCgxN99VkuaKrEefL2 +p9xUp+yBZItEKJEuSpQkbNp8ANkHAhbjJrmA5shYIDTlsVqGADMt44cw0ugiQtqD +wWjo/bXwZzoFWcC9a8Z55bj4w+atrPzCUsOuKpqHq0DU5+SnvTHLzXoreKfdRq+u +NvfczRjx1AZlft1hmr0m0Y0yw+oktNRLbZzXUAJC5P+PDkKOmb82r0dFtF9uea2k +X1gsCEP55dUnKk1Ego/gm68vlxLP1VnaLPRgLpKPW/mUsnuTY/7tmGzj2XUhAqwJ +WVv5rhS5/UaqucgH9nXnaZIrvLS9SWu3LzZ5SLXKPw1ir9YZC1pTPrtd6nXPnJEf +fNbuhKH8/3A3UIt3NVEN9oBxmJiof9jRBWKyf1DSU13aP/wGmCCOiU7gN1I+BLMM +3ZqP0WF0Mb6Y4mR6cAFHY+Ug/UjLX21okPE6djKG1B7UeGSUwJGcof6PU67dxaJf +Umk47+DIQoOb8aP2whFZ197D7CitG4kCWgQQAQIARAUCTNK42j0cQW50b2luZSBM +ZXZ5LUxhbWJlcnQgKENPREUgU0lHTklORyBLRVkpIDxhbnRvaW5lQGFwYWNoZS5v +cmc+AAoJEF762f6Cp/vNNX4QANyh0StE9iY6zxHOB2/fkK93itUVxQx5VsZ7/FkW +s1Um01gRaDJ3so2VYtGJoH6wFGKy29VWj2zNLhDv7VUUnosBuasnZXgcjXCW6OgE +g+t/fnuNXAHXLEIaqZsZwYgx80rJEMIAW2NEhxydzAj3m1gOf5urOqPpyDKcyB1V +A3AVKa/08K6aS2Aa2xIZqt0ghGj3NVPBgRhkB+MHXmZypmbhRVZZn6bWXs0lhYdm +BruljW2u5fgHJIS7Jdl5yvz3DaF9MizzaHvYBDWC3w1hbdE95cTWhPp8dRsp0sbJ +AzPHf3BgkaAP08e/v4txUmqlSw4JfxFecWt0JV64qT2tKotVQrqIeMOgimPJ9ovh +fqOlAKBvzJCBZ6T8d9bcs/xThqCSMPaQCh+PiN9T7/h8xxfG7+gfGP5fwOOCEOVk +KFi+9xMXye1vx4A2qWh1ScALs92GvhMwy1PYoLfjfsEgeYvRGtAX2TMKkyOsHQMq +DGOdRxb6yFeBMZPQD6SQaNHOt6l2gIqstnTy9Vk+I9MUT3ynmSX/rkF7YVdPkDJP +6kUAsxI3rACZrZz8gN0SIH8/3+WaT39+OQXVLleP/BbkKBtxnopi5De72CTG1ocw +JZz00ZvZdi1/DvElLs7ia/5IyNEviCw7m2EQdvLSSzl2/Py3pYz1/rfmQkC39FOQ +1neOiQJdBBABAgBHBQJM0tGrQBxKb3NlcGggRWR3YXJkIEJlcmdtYXJrIChDT0RF +IFNJR05JTkcgS0VZKSA8YmVyZ21hcmtAYXBhY2hlLm9yZz4ACgkQsNmRtHxAhzdp +/hAAtF/zQVGiDrcSQuuYGU7Ez01J2Xk/9LSZ819Q3jsWopdQYzxGCmK+V8plEkGL +IcM/jsK+NLAhZVzt7qg64vy3MTQ7anvjYx+1+mX1Z0p/g/r5IXXQ73Deg0RPPEtS +cM7ZanFlBUTniMEkZPt8qo5CZw23MeP2E4fl3UzHy1vt0CyB1dOJjsy9XPXLX258 +ON9IBnjS5s99fKqnCs2k0VFyNkOlsIdWzsvFCoQl7URnEEUI4OrrvftxQHouql3x +2SxE9K7pIHZewg631W+UXuH72BC02kIXrHixu7yQIE84fLzaptZJWZ9Xgoigk12L +40ygMQbc4zbRfoVYGymn/jdZ6W/4TG9ksq8FHFi5eZNg+hv8YwFabfYH9cshjh1+ +ldUbHKE1YbY5TpXQ9wNZOu0XHMsvo/pijcptUiC8yvmeP1Ky7dyJb7PkoOcQ3cjf +31wGiGP0cgDhw1FbS14g2OI+fng7Ns+9LLOZ34/QryK+hBLppEdAnLgAvIZzyuyd +K6KbdIPEzotffoJJ8PfEPoYa7ZHZZq3fJTno+DO8mhEi9V2jHkpDZDTNUkRYEIev +SnfD8F/44bjvZHUy63T9Hrr+DTjqG2ucCDZeAkaMue/NRXev53RIJ8AHLTUG2dbf +b+GHfC/OkkwFe64ZO0is/SucfzHqQArAUB5mo5B+RC0o9huJApMEEAECAH0FAkzS +tCk1HEppbSBKYWdpZWxza2kgKFJlbGVhc2UgU2lnbmluZyBLZXkpIDxqaW1AYXBh +Y2hlLm9yZz4gHEppbSBKYWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT4fHEppbSBK +YWdpZWxza2kgPGppbUBqaW1qYWcuY29tPgAKCRA06nbmeRSFqOljEAC+JPGA6EtN +P7fhaBEuLL2dhgTs4vPGvWivygw4WKR4ONGVEMBCQQCxafRxXdUQEjvRTxxdnI/2 +S7VpGvQlEjSAPkVcwuX+lwxPYb/7L8D78a11AtAxnxN16QsDBG7s4m+aBBfjn+ke +Q1lIdScVqU20ZB4y0qrJb5Zv2hfaDUlg+99VS08VohymSFPEFzUWDufyCC/nJbPn +rKZppbBHZmJT6WZm8y0i+oC65ZbRCxaMV8FVRhcmiafXeZoC/SURf4YSX5tgI8++ +/Ydwzxp2wxI1NCxKzsG7sERjLmtoXi9lrDLlWJnhbO5Yid6/7EXqzHjcWmUqag6j +ldJVQRjUR8G7Coj5zUjuEUZRlTM8tllrWLLSamuKhyk1q+UB5gDTIqGDpFxj/Svd +KeScL0fzsCmnroaLMXtd+QCBHmEk2umA9hb2N3bcq2Ht9+zZ5av1RHkNdT0L7l3T +iFgyP8cx/qw5of/ZTQzcvD+Nsl3ijShyvihNHstPYDeANCcHdRlnmH6fusZGGV9t +3H8O1kGIGi2R4Pw6pUDPuO1BHfA11Ld2uCuVbJwC+2aG8tl8v7XzSovCrn6cZW5o +PxnT724UMZ1ms2ECMu0Re+4T/q5r1N93vmqHj2ANAm/Kh0l4xBlO/W4lpVqmZUOs +dup5mKQMLQWEgxBYLNgEqimt1u0kP1qmn4hGBBARAgAGBQJNJK0WAAoJEH4q/cwO +NxoJqXUAn04GJX6IamiK46TpBngfZXuSjh31AJwNfYn8nS/y9cFvQQaYA26RhuWc +johGBBIRAgAGBQJM1CP3AAoJEPQmjufy79DwttsAoIpYpCX704vSyDTCWig5IFJm +nBafAJ9nvPSQApkry5XlHAlv2E5LBADCy4kCIgQTAQIADAUCTgOM3wWDApIJwAAK +CRCMleyeQza0SH02D/4qYvbItCLYBo/9/Aq4zvrZXFfveXqbo5oAQ5SXBmaPjOjy +OqGMjtH0suxtYWoWsxqKwMYg6uiA7o1IIYnGNvwxsIy01uchCpjiiF4SUKbYYd88 +ort8wgUF3BQlDfweEAzsu8tKVkyqr9zNK4t9sfvINVCxwrEbCvyim62tLIxaVhYP +uxufJ8Dw/dLULmC6vpVHfMrRAwanGqCB1eAejzPDzXEaIHKMUTFlMKV+FwgTN89D +VzWCACmPglm/8PrPw7O/wpSuojp6nZXJcCycIT0CvgDJvO3ENnxrHYn6J9coznIN +rGdfLdZ6c22xxHlR/HsWXnKILlrMg6EZKVtdr17puqgsjTiKAsHkRvMa5whc+HgV +XPNI7RbFGKFvB+xtrgW4adQzqWVkQaKNSyVqy8+rzsRxrmQDaOn7aHyVMuBl7Z/J +FXjxFzZnERWxwYgQAUoWhsZmx8ccewvb0ddJNCn95bvY3LYJ4M2c8naInEbo/yJG +Qj0/3u6IJZd2UaPElEutdac9acrySukO3OJkyI6yqebNwL/zrj23RX6a/Oarz73M +VkiPvQjPuKCkPJ/6jfI3hCl0wPBbFDsQ9kHoIf/QN0KCtIqU+FZI/jh7UkObROaz +d1xi4P4VZ3hjKmPJW9dfvsqZ/NdJBm7mCBca7kE0yxi98NCIl4GE/goxiN5oQohG +BBARAgAGBQJOvCRSAAoJEAsDrm5OJFF8U1MAn2DXWP/j3r1dYXO0PGegOBYBgLfO +AKCD51Kab80lGi6JoGjeWfPlUJC/9IhGBBARAgAGBQJOvCmzAAoJEKvWMuzE/Jpl +ojsAoOdCrU8aEY4F8P8qZm5v/lKm45l8AKDN3B4NPlrN4UMLSrtu/dJXsfm5EIhG +BBARAgAGBQJOvE7tAAoJEC8+XTEfSeyle9UAn3VdMEXENr1qB2cPydMYbe++KQzF +AJ9iPNmBm5Hu6gWHgxjCatBFYbrgoYkCHAQQAQIABgUCTrxfWgAKCRCarPtWNSrP +dm/QD/91O5fgoLIfpkZHTPkh3dwzorQbOn2k3XXHNzsnzeCG1B83YWPQh7bwEeAt +7JYFiGqjrlYKpfuE2oBUP+86nLGdAWbVX1rXWFXVKRtrVNYMwsPNDzO7aWCgej89 +JFl7vuZe7sls2oS5FIodJ2GE8hu+tID7iy81lgpWIto5u2XBUT+Cdf5jy9AqPG/F +kxqMfxzHFuEQsiW7lB1ZGl7nO5SyZ9EKnQHa+2MXikZcPQfp1LQmu7KtufyFm2lc +q8KVFp0LkBblxOK4+v68Zg9t+6gqVAA47MtbIxSr61mE+uDXfSuEDKPAlbyFLHLV +e8WCW0lDq+O9RIxQn5nejr/xkGqzHOaKZ4uLaZfTTRIpIVdnufcQakUISKXrge21 +vNRWetaMn3H5pNd7nCj8PjVTgIuwHzHrE32NoVjmY+5Br3zQE8mBUf7CRxYIe0co +6pSiGF+sOb90vUIaysfCKh+7ovd1VfBDKnBpaGLE42q4l/9ddkiXvuFrDcLMFSgx +HCjpOeJGLfh5Y6Zk/q9Vv1Qa/T9gGsUDNb0ZfMsIzmMNnts+KJotHxqSkI8M7rLB +LgxutUKaiNj7gocaQJY/dz1tgk/baJGL1crYvq9Ih6kd05SX+7NvN9T+PcCWi4XI +FAVDkthcbm3kH12AS53Gd3bYY/Du7RxS/QT/zJHg46grKR061IkCHAQQAQIABgUC +Tr1SiQAKCRBNFUEQuEUI7JI7D/9qoxkG5/63D8mimhfEQwxSBCITRqQ/HcnGaEp/ +530izpGL614zlGeB+Ss0KEbr/Pnw1AePEwD8IAfxthBq17UmFqSjDOSq6ANQBske +CL3Ilrs6mMdJZRWjY1JiS8Wz06jW8SE/his0FvmIXCIs8exNjS/4ClXF+NTvk8N1 +OXNukTv4G1cRsal8ohy286rHIlkkSW1hY5glYHcMg2BCJ5Z4hZavYhwsKxfBjrb2 +OBB2IeWHicQ37r1V8IcE+1M/qg1L0X0uKF7rw3/09w5WjmoI3CAhK+r3gY6+PMch +TC+j+HLz20RukZHHKaCSoDXbBJj+MDgMnq+FhhDA3ig+zknE0qBKsm3P82CNfyBY +vGaw0pXBvQHiuBEimLajUucg4RDzFNYBwdOGIt8nTq3Ari3pGSC5HYqCP41aLPKz +o1FTz5BFdHkIHXyMq9UPhcQfr0tM8Hoq+lqrwVigds+pV93PJe+M51t7AKTrJ8kP +4hdiZSWE85UiW5giGA8C7N2mOUBiUjl9HKbsZQ6Cn3F7mWN7FZYyWjSZ5lSVJDxK +M6r10BFNZuYbBmh0bl/J4bL/mwSvYP/depiTtafM1nA/+sYL/7W9qwr69HITaDmw +tPiO2vZ0sG68v2nrqcuwxLiAp7su3MyIcmT3VNLedISh7Y09D3MI0WRmCuyQJUWA +Xq6XTIkCHAQQAQIABgUCTr5o4gAKCRD7Yz3o9cuua8DzD/94qJyLF7Re+o+M1GGB +SX2h/o0IwxUUjB950SIiHilplUjnBVDSuzNay9RqrX3L6uIWwvIfgdXn+MHyX/k3 +CtxKN1XrUhGFS197cFx5h9rS2DHx+ntlX5NyhnZtRycSBQMnaxj75GyzD2ZE1dBs +O/ki7Y0Y9BI4bxu9zCLnKvDawc0Y7XkFjxV0KnPYgFTEKcVxtVZHy7cwxWwENjeq ++JFI5PQW1TmFm5EzIfjBtE85jcveMhWu4mLfPmbvByhb9N5O0rsSzTeOtgwypSH9 +JjVbXWAB3bM2vwxzDq5ARlS6hSNrNTCLQY0VVs4adLVVbxF3rOaSl2zXtaXh54LZ +RGkfgaeYpPeCRfjdwQwBj3tHdYOpZR/ZJbgS9OcdTioHj0QSYW//BQViAwwm9lCm +IgQdX+qgdrBYtKFLQ0b6WmhFSRa6zPjdIxgN9mSa/Nx7NZVOerxBWkHGIkadLvnY +AiIaLmWRX58u/2y1FzpXABW9QRAWtbjUQZYZXeqrvXwXAEE8RDPiQz1egrEjm4js +gtOobHBRBVDuqPZdPCt766E+tdBo2bEjcjvfVaADiWWjgHwH4f7Kr1uBe1jeqmFJ +DCpsJF5X7izsdMrDsdC2UaCK5UeWQXhgyDAvjaPioAV8LCwVaom596PgxXTPwnf4 +KXCeZjrsAjL1XfEMH7BlBKvjYYkCHAQQAQIABgUCTsrLfwAKCRCJofZRKiOcLP5M +D/wONbynmOipqbqF/vIkuRcPq8BcYhiA5M3FzPiZXH4rgl7aCN7iV5SU/oilbP3s +cHgv7pN5Y6aLxVipvp5UELrNxT2zUNJUbmyoKOEu0NJ72emXDX/KGjqqLZ1W/jRI +TZR3w+cc3dOzx9MH8XdirfLWi+cpk7k48UC3VeEICB0EVYQ1oA4CG+BOFva0/gw/ +oRmlMIzG5ItH4wyUZCYICNP9njmLyjjsxvXdSNhGil8tQs6ywMuVi4u65L3FDTu5 +cbDUs67DsJZNH11UpPQOBFX21JS+tairMkJW8nF9t+5vrWWFE6KIWShTPx0QfDYu +tve4rvtUkC7K532KNCliVb4G3oJAuwAWdM1OImNRf9VVg36FJFnimVN9IkwIkN8e +EjwyVEbr4aseADECz8SNS1hYeSp5PzY3Tj/L5rXYvzmkq1EjijPT8O3TiVmfe8RU +apDrrTM+by0wyp0915+XRjatErqI1kO/Pxf5nnOCl/DNCml1LqjeZTzUQRKrvNDb +CDMSXzG3cqHR3Cmt0qF3wQ8jUKifFeJ4AlJm/BkkPfyxhD1tnIOAA6Kq/qg3empa +bBrrYUbp77+Fk+5VRivEN/Z9NfrnF77SDsUsRe9sbl8BFPtiKb40wkopkcA36Za1 +OW0JfxJwJj34zovJoL0jrIhqb6GbRqlfy/KqsXcVlKcmeIkCHAQQAQoABgUCTsFk +CwAKCRBOvAyfAgj8EbP/EAClSVH+M+jOf8Zaf/UGOOSHBP8K9ktC064V+gsNBClC +XWhq7y+MC93ER0Ghiv0VRKQBPZS+ZisaoUN3nIvVkQM1ZFnQ8giQqDoXFbZJ8Wf+ +AexJkwSvlE2fmnwWykCtaKA+FHfeJs/YS2BoYbHMBrMLvZmZw41lvFIjv9k+OFNF +pjZuEuCfQnZxb07ecyR3qBZHdRBeOEfrswJzlek6bSkjBVEioh359KkXl5266uHp +bpO5yYAvwRvWbzgZ+aQeeyGzcoBrws9/u1Jcwmc7IWjr/Crk7pYgwiXHT4Z91ZqT +XOeSuu+iMZCnb+R0pNH5Xbn81yQJjyoHa120bZj0OArnmNRTtASq1+yh5xsn9OTy +bznWNpZUnPtOl+XeS4rfGxYpzhXYKHBUN5+4cPH2eYpyoOH7uGdPHaJ6WP42Nf5m +joDBu9MZJPNuTbgNk9Ei1qC+7fNkXUF9VVfzgp7lIL+1gCvW+iPz1OSEjgCctGBN +FyccapuzEMIBVOZ/s0HSc2DRNfPvubUbeRoaVbFlWusOWgoXGsqkyMSFKV+pBeVO +CRK01g2RkfpZ69CdKAWB49ean6OaF6Z93Vtdbt/QRm9XsWI8w6FZzFudaUhyFnY7 +EhkeN5e2DOxjhqciBuOndM272i0m6WcScEudr/65WKQoSWgnBQsGKeeQQFxn1qxH +pIkCHAQQAQoABgUCTs2X0QAKCRD1T+ZICIM1qUhhD/9s3yVu9p0bM01hIdLt5tju +PXlSciGRXn/d3BgI/IRDwfYdgRq2yLym81iFRoEy0s2TF1VtdTJiXcpET/XP2sIC +JwKmAzUAH+BYpfY0G6/uXkXfc5ZtCK/QEQz0G20Etb+vQQN/JYhgQKJKVPEh0Qor +3McQbDpjjktL66npTE/aZ+Pnop3Qqf4Y3fP+j1/It436B+5AEcacahxnpchZMU+e +XBn1WhxZqm2zeZcKyR4Zqg2/oGt2vrm92rqME5LaeebjKHWA0gRXAldK+uAedTaD +P0c+JPem4W1K+CIvyaS7qsxch2LSSqCSyhBOS+yRtd4E7IHX7Kp4P/ZxrPVyUbOk +fw4MNtPizvR2sA6FVElzfUFDD6Axjc7oqxOKaPc2vrG8CFpomvRwDnBcdnIU3NQt +QMs5I7t5VONwGuBd68G81qbLlHWUIqHs6T+n5XIvUuh1WIfloEK+A5cJiiXWIyLz +ucjDg3yAjXuvzrddbngdT+hMBkwwJKFVMkTvFiJ82IXBsR+MBA5WUAp+jr4x51RE +y5IpIvtY7ux1Z9HORrm5jxeDoU0AmDDaTW1MIC1SkX+Pti8tKC6mOZJ8d5/rCQ2Y +GU6PVIhcrsb8fGojASrnLeT4QmFpOssWxPCni9hwPZqUIvgBKgB4TMJtgsz7dls6 +A2rAm90NWb7CjEFVluy3uIkCHAQQAQoABgUCTtkqEgAKCRBzJfkC4TA6mZKQD/9F +79MIbd3EDvrpM/oaLuVzQuNE6Ma6ZauB9LRFE6oRWDMUjC0cQSXGA6JM441J1WMB +ngj3X6Wg922gVBBiptZvQUnMyPOS72UwJ9mCdS40lcJOtZjs31HY+/f3j6LJkZ1A +8FKQn9nE6ceYVk0OXP5Nb01exXwPoAUZqAxqfzEAPyyvKXiP/6A8AxWg3/k+6mhM +LeLB+5pnHeci65u+FU4UKWPLqqyuqv+UxCSrra6vozWmmtU6WlRtvteu4Y5aerqA +vFaJCeO759IonXfPs4TzFjMvrW34jTHmYCV6vVqbOHu5qC2FKgtzGwlKd+MDGOCd +2ekhd4MbbrIxp/GXfIbp3+vrIzkNpD32DgoniYlbrpBToxTJA9iebpcZ/BWtbT/P +Uaa4imoAh4oPrZvj/iVzfatZ70FPC+Mg9I/3PWuV9sxbffFNNcywh/uGjI2WcJGs +FTYTaTU7z4HnewDLJRYDYwO9/MjSb2mCsg8cG2ANiWZfHn2quCyn/gEGe0ffMjPn +e2ZycUCReUo0ZcnEqz9VvakgwVSL9SiQrDsE8VNr76UeY+8m7rwTME5RMrM7nyFz +tR89kPeD0jgnepBUyO+RpBSCexboKJ/GZqCRkiDpeRQUjzbLJX7IyULiqo3ufWvf +KZqEUZ1qVAOCH3MbUFyAsBWALAVAXo8HS7y89nqt6YkCHAQSAQgABgUCTubiXgAK +CRDGh181Qc794IzrD/48aDMZ6/fuonNVJR4PRd4mqU47Wc+S3URCMa3t3GGiXGkE +PPhKfiubw+szqOu6ob9ZrAXXatPGaP/gT+rfP2Qy8I1ed6ors3p9pqa4+4v2fFZ2 +rkIinfw7hJcQuGJw/fBfP2EtpP2EU8KMR/QZvavxtk63BXD9Ed66chTqo0EEQrh6 +EUWEkBGBkrfPKH7FdwdWhhfNsI0EpE1l8vPD+bjobKRO4ByfwKVEOFA+6Cd7uh73 +LTuCnmRH+qRPLnNCZcoiNNR54U3SETod8wBEiCmo4HR3AVGYIEG1faUr7Dz6tXOo +57lp2ced2AJANNw8kZ1R+5OhWY6J5ydTaqSBsk68pQtvHW1FqRBR5K0gq4ns8GJc +g/yj6Tyy9iH2IxF2O7EzDS0Z/ZG4T8L4HMO6HfkUVGK95s1Pka/M3Lz2X8SFH42h +Y396xN63SJOXfhXeOwDvtaFkgOvE26gqMN1JK8oyuzCsN8/8G98k0ObdM19rwkpQ ++zgQ5Z59I6m3v5szC9B55ikeTYB7EDDPxdibfMCya6GUvzkGpfCNb8ba4oA+nwTB +kVk8+ROWqQUuKgSaYdEnEH8yxoTdMC6J6VTO+1f1qNKH2oGmSWqEl1xsVo1ZABnP +iiRjQsLbxJ5WcHKDGVz+74Q2DL3XpoLCsYHzWv4aSdExllc1Fpf9YZDfb86Rk4kC +PQQTAQIAJwIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCUSCPTwUJC9IwFQAK +CRCbuGOw9Ru4ikDJEACVgT5YdZm2QBnh0OKno6u+ZwD2eIBfNJMXZAWdkXzY8JZ3 +QR4wOq9WfUhFB/Zl3qj1KfFc7W5IxsTdHELN0+eOlOg7GwiLbirJFLIUDgJm+sSi +Mr+6To/B9NKhvUDVt/GtxfpFo9CbJ0neS7A9cp8l8lI+GJHsRmW2rrS8a+hyxJV7 +TGnMmjfOtWpjjGPbw0nu+ncLSGJcBSyMDMlsG9HPSg1faggRSQ/irR+OP2gm+/1E +iDz5L13m5iYNj4SDnf7VmLN0AFPlaNL/k82cQgWtcGCE3WPI5tqK9JOqB5zX6Mq2 +qopON8Z+QaWYzaPiHulDkXuXNkQ7jcBb+iO9kYipM2PnRa+LGfgGh1SoMZxX3heE +F1YPktzjBi5lW/0sCJ5BxIhhpQF0XfFKjn6Dbe35/Xyc3dnfHCcUh8ytSUPAiwlT +saYFuiO7dnATLSAP1qQtQmZJvPTyL3W5CDYjUPOZiCp1TVTEfY3u4cjAhgdM8N6G +qzCgoaZfeOH9wW2u9d/pwUlDE0i7KAvMkQbwPlcmQaIKBQxjv+K3f3+gViv8uU7g +mDrk5A7WILZmbxnj2iRPDWxnClR/VoM414HmbqoDD5dX5h7Ldd49Z83fSK9NNhM0 +EpTVfHyXV/CmO2IKxxecPqum1CFxbx46b7qMEpRMHtdMRLuIag7Hh0XTi84JYIkC +PQQTAQIAJwUCSvH9aQIbAwUJBaOc7QULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAK +CRCbuGOw9Ru4ij+JD/0TuZUtNamxHdmvZjXlhREZWIa77qbS6d2hWsKUTBjIYSsU +n4yglHZIsd5/p7IC+/Ri9ar9TFGvWtori7hTtM//vdfUUqYWQQdQMSEHp0UNxtQU +/eKQHaXfxLKHlU9Mxic0h/G2M8KW2hq6986Vyma25LdAJ+ez7GBaYgJa9Z8GAOri +uGVOimDNRN/OS3L9WS5AwYLaNClQTsRLLicqyF6TRY8NFEh6/07iaHGgsEfsJraI +Zl9MpNhdg5TWfPBQ/ZDAYliCLJvNe5TjmRUAyz4Nb57QLrM0hbGdq0VnXvuUbERC +AIn7ZrWZJdo+qUzoQ8VM3PnUt0Ptyd2/+oMfNv5hz3wcqZW/3sgGXziHA+q2VcU1 +thXxutQa9bgz52G5CLgGuXW92QrtPggbhpbaXKUMz9zYBLp9nSehNa48MGPk39JG +7fe9SQmj9xw/xkmyI1RSPJMFMauGKUEMo2FPqlTFj5FP8READcOk3Rq3NpkX7vOr +E/ECcg8A8UvV3N74n9CsWyburuXl/DGbZaXIHe6VaDe+fTpmGTZiow5GR2R1bsUB +rvQXDEo7BeR3xksZ30GlW/KTsoWQ7okGX00XUdUzACESgXJWMD5AD0ZnWw0VDYJF +9IsCf9qKkmX5nLMSqTUIqvrUiZvoF5qn0Cgvr4o1TUsiTrPY/V5FIgIft1XvurQp +U2FuZGVyIFRlbW1lIDxzY3RlbW1lQGtleXNpbnRoZWNsb3VkLmNvbT6JAhwEEAEK +AAYFAkzStPcACgkQgngd5G1ZVPoC4A/+JySuHv8UBK1iqOnltmdRYR6b190wTuo9 +Ir/iBFq7ofqxmEoxWqVct6lfqDNebAbIjgaAwoOoaKHkeyhZlcmCfsVj3QFAiwq9 +hkxP09hkHSVWvFh3CK1X9kYny7ljBMbx423ISyEZj+Lf3AjrjxI9KbRdNY3jMlUr +f55pWTT4w6JR/qsIVx4E5g5wnVNBRI+Oqn0SijElfy0qA7UiMvz+sxAUXQnpC9c8 +1jp4RLgW16FazwwMq0vpb0NqszrTNF1Uwl2k8V6qC3fnrbb9w5b2zDRMeEmHunVs +CEODOREkQHT/OdO982AxOp03uH3MQPYbiUOAgUlUwGJi866jBu01jiROl+CihFIX +PidQeL6+Uz9aurk7H/gXAafwFBxcURn7zsyH/pb19HPfxg2TiOR8ZUgqQ5ytcAe4 +ONI/tVU3yUs/l2QvqqRKI+Cwi0iPeKh70Ny+lb5gjPN0lxAwYjCOZLJtQ1osFABX +S7RcoZvCO7jdf5A+WdMm4fqB3FBTVpuZofU84GB91S8l9/qj02h1ZUDzUUiydsm2 +d+HHaGXYsx1oxgJWHSZ68tTrLSttFXi0R//VizGEfrYejMvU1z3Mrt/nn/Oua0UE +sMK6U9nzSepflXeHa7q/xtdQ/5jNo5bXpI7TQEMe4dFoIC6NyxVvbYrrdPQZcGS9 +6GqyfG6d8qiJAhwEEAEKAAYFAk0cTOAACgkQP89Sn/LyegZ9Ew//YSC4hvz6fcDi +uFTgpVEie1epmUhUTHe2lCSb7BErla9umRu3PAe+YyaHpunnKeA75541vA6navE6 +pp9bLpPllMc2OoDWOOk7REgLgPJkJPFiCWYeTpowHRvkT/qJV6BgJuehr3uODF0f +/fVkaCXCOfZowEzu6NuXGfZ9qxwkM8SgQASRqDgcOkR6V4ricaT/lVx6Y+iz+3ua +16CJDTMi2YHOwSV+MXDDujk66ebD55IYZeA+0B4I1YYKNhX7FJrTWYVGZ2XDaSBR +5sPzohEPfswxQMeTV5ZwJRgax5Mzu6Ln4GiqVrk6uB/JRAabNN3IPq4pkTV1dt+c +CxIEhLV/QjJ+DeiMyqBs60/LdeME89yFRsXsAKkP4bSsUpzVvmOHp1gz5AhqGec9 +Dmp72qLFM+/m9Ng+mxiZgaKyjENcKJhraO5YzdHgskfNu26yoJjqwgpRSoQ9P9GE +zDh3wNd0sVaiVDQKHOPfpVYAFxst4/s4K6ZpMRXofm6wiABKwTRFHbE4Pd7bioBK +A3UPkr3n4AoAo/bmlgQiS0jwMB40q9ynSkUKO99zyDybSFbeVCRmGU62k422AdhL +rcwy26Tj3yHkpqLft8FBDjdOuGQcQVMP7PUD1p75FlrGdZw2Tpxqp4p4cWIydzSn +xftt3ZB8ik4zwj0VU7Nel1uH6hepyvWJAlIEEAECADwFAkzSzak1HFRob21hcyBE +dWR6aWFrIChDT0RFIFNJR05JTkcgS0VZKSA8dG9tZHpAYXBhY2hlLm9yZz4ACgkQ +6k3K3E3KqI/pLA//e5RZqiH2ySjcRkgAmwKEfwpiixMvGxy1qT3JtHveTwygvG8g +w2m+jHAA8LBAh2WioB4s8p0Z9TnJgUh1a3APHh8MAR6sVe9TnLuTOiIUNp1NWlu1 +dvndNvF4ionIfvilA6rc4oISI7zmEwbbhQJd973YIAGNTxJee1LD1svD8TYyVtIt +VTGhm6DsNZZ6AoMTffVZLmiqxHny9qfcVKfsgWSLRCiRLkqUJGzafADZBwIW4ya5 +gObIWCA05bFahgAzLeOHMNLoIkLag8Fo6P218Gc6BVnAvWvGeeW4+MPmraz8wlLD +riqah6tA1Ofkp70xy816K3in3Uavrjb33M0Y8dQGZX7dYZq9JtGNMsPqJLTUS22c +11ACQuT/jw5Cjpm/Nq9HRbRfbnmtpF9YLAhD+eXVJypNRIKP4JuvL5cSz9VZ2iz0 +YC6Sj1v5lLJ7k2P+7Zhs49l1IQKsCVlb+a4Uuf1GqrnIB/Z152mSK7y0vUlrty82 +eUi1yj8NYq/WGQtaUz67Xep1z5yRH3zW7oSh/P9wN1CLdzVRDfaAcZiYqH/Y0QVi +sn9Q0lNd2j/8BpggjolO4DdSPgSzDN2aj9FhdDG+mOJkenABR2PlIP1Iy19taJDx +OnYyhtQe1HhklMCRnKH+j1Ou3cWiX1JpOO/gyEKDm/Gj9sIRWdfew+worRuJAloE +EAECAEQFAkzSuNo9HEFudG9pbmUgTGV2eS1MYW1iZXJ0IChDT0RFIFNJR05JTkcg +S0VZKSA8YW50b2luZUBhcGFjaGUub3JnPgAKCRBe+tn+gqf7zTV+EADcodErRPYm +Os8Rzgdv35Cvd4rVFcUMeVbGe/xZFrNVJtNYEWgyd7KNlWLRiaB+sBRistvVVo9s +zS4Q7+1VFJ6LAbmrJ2V4HI1wlujoBIPrf357jVwB1yxCGqmbGcGIMfNKyRDCAFtj +RIccncwI95tYDn+bqzqj6cgynMgdVQNwFSmv9PCumktgGtsSGardIIRo9zVTwYEY +ZAfjB15mcqZm4UVWWZ+m1l7NJYWHZga7pY1truX4BySEuyXZecr89w2hfTIs82h7 +2AQ1gt8NYW3RPeXE1oT6fHUbKdLGyQMzx39wYJGgD9PHv7+LcVJqpUsOCX8RXnFr +dCVeuKk9rSqLVUK6iHjDoIpjyfaL4X6jpQCgb8yQgWek/HfW3LP8U4agkjD2kAof +j4jfU+/4fMcXxu/oHxj+X8DjghDlZChYvvcTF8ntb8eANqlodUnAC7Pdhr4TMMtT +2KC3437BIHmL0RrQF9kzCpMjrB0DKgxjnUcW+shXgTGT0A+kkGjRzrepdoCKrLZ0 +8vVZPiPTFE98p5kl/65Be2FXT5AyT+pFALMSN6wAma2c/IDdEiB/P9/lmk9/fjkF +1S5Xj/wW5CgbcZ6KYuQ3u9gkxtaHMCWc9NGb2XYtfw7xJS7O4mv+SMjRL4gsO5th +EHby0ks5dvz8t6WM9f635kJAt/RTkNZ3jokCXQQQAQIARwUCTNLRq0AcSm9zZXBo +IEVkd2FyZCBCZXJnbWFyayAoQ09ERSBTSUdOSU5HIEtFWSkgPGJlcmdtYXJrQGFw +YWNoZS5vcmc+AAoJELDZkbR8QIc3af4QALRf80FRog63EkLrmBlOxM9NSdl5P/S0 +mfNfUN47FqKXUGM8RgpivlfKZRJBiyHDP47CvjSwIWVc7e6oOuL8tzE0O2p742Mf +tfpl9WdKf4P6+SF10O9w3oNETzxLUnDO2WpxZQVE54jBJGT7fKqOQmcNtzHj9hOH +5d1Mx8tb7dAsgdXTiY7MvVz1y19ufDjfSAZ40ubPfXyqpwrNpNFRcjZDpbCHVs7L +xQqEJe1EZxBFCODq6737cUB6Lqpd8dksRPSu6SB2XsIOt9VvlF7h+9gQtNpCF6x4 +sbu8kCBPOHy82qbWSVmfV4KIoJNdi+NMoDEG3OM20X6FWBspp/43Welv+ExvZLKv +BRxYuXmTYPob/GMBWm32B/XLIY4dfpXVGxyhNWG2OU6V0PcDWTrtFxzLL6P6Yo3K +bVIgvMr5nj9Ssu3ciW+z5KDnEN3I399cBohj9HIA4cNRW0teINjiPn54OzbPvSyz +md+P0K8ivoQS6aRHQJy4ALyGc8rsnSuim3SDxM6LX36CSfD3xD6GGu2R2Wat3yU5 +6PgzvJoRIvVdox5KQ2Q0zVJEWBCHr0p3w/Bf+OG472R1Mut0/R66/g046htrnAg2 +XgJGjLnvzUV3r+d0SCfABy01BtnW32/hh3wvzpJMBXuuGTtIrP0rnH8x6kAKwFAe +ZqOQfkQtKPYbiQKTBBABAgB9BQJM0rQpNRxKaW0gSmFnaWVsc2tpIChSZWxlYXNl +IFNpZ25pbmcgS2V5KSA8amltQGFwYWNoZS5vcmc+IBxKaW0gSmFnaWVsc2tpIDxq +aW1AamFndU5FVC5jb20+HxxKaW0gSmFnaWVsc2tpIDxqaW1AamltamFnLmNvbT4A +CgkQNOp25nkUhajpYxAAviTxgOhLTT+34WgRLiy9nYYE7OLzxr1or8oMOFikeDjR +lRDAQkEAsWn0cV3VEBI70U8cXZyP9ku1aRr0JRI0gD5FXMLl/pcMT2G/+y/A+/Gt +dQLQMZ8TdekLAwRu7OJvmgQX45/pHkNZSHUnFalNtGQeMtKqyW+Wb9oX2g1JYPvf +VUtPFaIcpkhTxBc1Fg7n8ggv5yWz56ymaaWwR2ZiU+lmZvMtIvqAuuWW0QsWjFfB +VUYXJomn13maAv0lEX+GEl+bYCPPvv2HcM8adsMSNTQsSs7Bu7BEYy5raF4vZawy +5ViZ4WzuWInev+xF6sx43FplKmoOo5XSVUEY1EfBuwqI+c1I7hFGUZUzPLZZa1iy +0mpriocpNavlAeYA0yKhg6RcY/0r3SnknC9H87App66GizF7XfkAgR5hJNrpgPYW +9jd23Kth7ffs2eWr9UR5DXU9C+5d04hYMj/HMf6sOaH/2U0M3Lw/jbJd4o0ocr4o +TR7LT2A3gDQnB3UZZ5h+n7rGRhlfbdx/DtZBiBotkeD8OqVAz7jtQR3wNdS3drgr +lWycAvtmhvLZfL+180qLwq5+nGVuaD8Z0+9uFDGdZrNhAjLtEXvuE/6ua9Tfd75q +h49gDQJvyodJeMQZTv1uJaVapmVDrHbqeZikDC0FhIMQWCzYBKoprdbtJD9app+J +BBwEEAEIAAYFAkzS6h4ACgkQiq+I1thOQa5y3R//az+kyS9sQUUivWaEKjhqoOB7 +IJJE7E3/YkPiaLnehNI2S27K6FY2h+skpjuIa8kAM38GUAA74KjdCiS4S4aPhCvL +C/c2zNMVtGCk6EDGaRuU8Nx0wKyMGHqTfAtSxubmNTbR/+iBNakV2DahcDJhuKbM +1FM/IE2vbObjtG87UZ5RjqjQRKE0ZnE1zyTV/jlQoHMjQFgMZdf3J8vpOt+YX/Fd +jOvX5+YbIgnpoA23j4wIQQdXjnJaax5gdKkeUugOCItwEq5h/tvcR+tUkfcoEUPS +IsAFx5nlxBWAGwdG8ag+D9m/d4I/UtEAdegrG+L9Fv/dE46sBkWrZeF896RpJF1f +7iNOS2wOHXQ16/sMyy0j1zlUGZi156a92lf7sv7S/gy8qZ/uM8MGslEoJKAvNbsT +e0u4D1eV+NHIKy7XgcxdOvd0JFLChUK9vSrNq15c+armNHAo5p+HRNrI+A+hbWAh +kn7Tje7FoVMbq04kngcPXpin+z8G9WURG21a4WQP2s/nJ9yC7cgb+olXi+iNvliZ +qEdF5p4nYRYUG5mPOScNSFmZj3fKN7wTWA8eoY33ag/V0KEiZVc2WJV+A7bUqFNx +FGQdLDtSHgUyZM+g4Tre03F7GbJG7K7i/TxP0vW8wz8JXuJsvY+AoCmagFA0tXNV +MrdzhnnMPN6SobrDcHRWQ9OHjz5CJ292qono6RWXUz0bzh355QW0bFCK24Mpa4oh +hkR+wrJxgCdKsn51vr2I0NxWIn/3rTUn8OpFOI6QUVEJq9GfQYaJLiYBx3/XRNde +zXDNPSbeZV6fHPNwhPS9rKmciTdRc87B8xIeT47J0+MJdYJqlEG4yvLl5hmhJYOZ +C7O/tenlu+MVdB2UkAUQUIBLxoYN4OU2VRk4il/38V4Q8SY9CTU2ET5up/YuA5Fx +b+Mj+jatRkVR9meAeEf6Nc2x8HmkIllVVPpz6qckMYBcVD2fc1dENguRarnQLFAO +Igfu9aZN3AhnZypNcPgDkCS6fsOpoQZP6DRLZBPx9wVWQf5JLsrMBZ73+dDjl3Io +TzXXVQLkrg+tb/849BYRwDkNHqaSFvoBugpSTMyPTiDU5nkp6z4mnyZuSFUfn1+u +JMctBRdzF25/6+I5fP98R5infEz27PniId5FRKjfZYw3fV61NPUOHmeCSXbzqYfk +vAENo9mLBq8jXCmkJ0fYoGHZuHXCnqkKU9cZEQ3fh23G6VCEJb0EvFVTlkRF+LDw +LyyCH2pk1IJ/GPZ17NcOE0kNVVi87VaegcyNnDlnbIJQv063fPoQio8uN1qzqTGL +Ce5GoGo+BJUCdSnywsXCBIoK8zwUwWP7R0mcvuGFyVcTrTbXQEfMa2eHIreaGohG +BBARAgAGBQJNJK0WAAoJEH4q/cwONxoJNHwAn0Rbwtm8qdQ5naHtPtxTbqnvnwtj +AKCTQ3ol1F/J9UgLlL9NlVyloleXc4hGBBIRAgAGBQJM1CP3AAoJEPQmjufy79Dw +ZGYAnjktFpzU/3R+t2gei7E+XRTEJ/LSAJ96mGaEJprAgZ7R+p1Ae9eJBaqORYkC +IgQTAQIADAUCTgOM3wWDApIJwAAKCRCMleyeQza0SNteD/4pjQpHD3OkcJY+yCD3 +zD5U3HKXRLigrR3SfRivz33EqlivC4FGvIUxbfxdiJlMhwW58J5+BrbiXkxgeVsu +DfdKacjv+ro87i3NqJUGvCrmZFKN+p8PuuDZqD8jDHIWVMgUA9qXrrIwDdvdS6jT +EsgmHaa0pVE8xQD8T+6DaVZOjbsZHn0iJLzrRjy5dg0ENOel82uTwFl5gNg/UB40 +66q5gASaTFzRr+qL54OnNmUrX4R459Hot6FogYUTowGzordQhFT88fJArfqdngYp +Pq4sM29erxyTksUCwRv1wcmeUX26GuPzk3bIu+ExdyQJHJ+28p6DNmScvi1dXI7T +/VnklisMprm+DFtMgz3eI/db9It6E+/W9+PSh4Xr5so9gShtO+ucJfeXHqKyrC/w +Nw+eZKt7IKXWqXoXyNTKylOwyzqXUI5GFpgkn1QgZlpQI1dSQnd2ja1VANDMQNX+ +V07ytN28tEW8g4uqkR73hkrva0bUKwN+sEyTdjkAe45hCnZCVeCH06Rc8A0XcuYg +wCTM6sElRlpoc+I0UWepls8DDYkIgOHyWUUMNq25odJ34dyMZuTBnsdQ8IacTxNk +hh+ktkOgyL97F44PdSdt6mv4/heWeb9Bf+WNOtxGRU17lTh5A/Vo1PmTPY373dCL +j91026aATwx7VUXxtJ3Oneeg6IhGBBARAgAGBQJOvCRSAAoJEAsDrm5OJFF8XuEA +n2DV1RIKuYAhGkDeyDgYn6kpN++FAKCdbrXNf8O8oPD4zE71CvAFozTVbohGBBAR +AgAGBQJOvCmzAAoJEKvWMuzE/JplcGAAoLYAV/Yr5kKua2wRMjdiJYIl/forAKDQ +zQ5hksBZkPt7nqs/o5zmnc2VPYhGBBARAgAGBQJOvE7tAAoJEC8+XTEfSeylMMUA +n1oAP8vd9CwWq6EWFfXk6jTzFucCAKCCjAjUess2a+L/Peg98anM93FiaIkCHAQQ +AQIABgUCTrxfWgAKCRCarPtWNSrPdhsnD/9LAOJueJWvuZkxvP6oKYMdcb3AE5DM +tNkSSEylxYK2/mM5pR/B7BEvK9pr0/So6TtGo6UNjSXfXIZeNiTqruSTdkF3Higj +eo4M+xHVvDx2kQCg4mta4rHGOC8TAXQydAfl+i3XCr1F12oAEMB90KxzwbMuyGyD +um6QuRfVAqHUOJdvwuz1WnqlUtMOE8eZweHdUKjgC/h7SRwqukzWnub37HFBDASE +qxZ3m+D0INEpwiD7NkYvgqK2g7aIsRngY+6qwCCORc1rBM4ELzob2nLOymoeytD2 +uokM+1xK8mYhbxpi74xtrmUUaLHmv+WNcqFQNTGtrI4Wj6d0iuaeKxj2sLwVYfAe +oGwwlO4ise0ZhHszXFKwCLyRyFuV4tZabS4d+7wMhztF7zoOMUCXXGUBdgDCHh+Y +XSZxUFFTyL0unvnsS+YBHq5+V8VPJlB6q46IHs4TAcc9iwNDiGsLvuKZm0TRE7xG +lztdRvvSZoc/ZMuPMia3HSO107H23qoiVxQTMkJQoDaFqzKM0M2Jnhy3fkpm+1xy +J04XIFtcHzZ4+Fr+299l8prnHLRQoWqhiG+KK8CJtXXQ8iRsXbaFInmE+WxOc6OG +VFiLad1tq19HW0rDpbLVggB/KPhR1j0UizpW6I0xFVivZXKn+6zO+B41+eTaNQcj +crt3eLG0MXpCFYkCHAQQAQIABgUCTr1SiQAKCRBNFUEQuEUI7BwJEACTAIkrbKWj +zxMS4JGJYeAaAU3uWOdyGHJ3lahQ6WFoe/L0ipY4j82bVmgHRb/pGcV4yM34x6b1 +FYM8kwFNqFUReDb14cB/6e9U4jBrGNIEgkuOOL5h716WJX/7jzh18+Wm2SNt+yug +HTgP9QAPqRM28+ACuOD5H02ay6E2KZ08bmjNZWSmHA234UdaXhHV+lqdTgMc5dLh +rLEX6+eve7vrJV6LCB6aq4SKu4UqTexWg7mtEluqZLZXarNnQssH1qPfkyivV1Xh +1NfUgpOgtWVRydg0eFNE9Ux0CXLNZt3yil/0iaRBVFjr5M+J/lWoXo2M+Jn54pjw +w2/VcQMYjOAt5WjG928gNEFDBZk3b0eM0jKWVY6xiDa/nMOzKqtEzL0Bu9v9brOf +KOsgS/0vwKJg4Ktdt9UBhayDSUGeHWT2JP9pdx7+yYLrnGRT/1KnGeguNf8YHRxt +EaYWcbaxR9GFPi9ZJ6/vzZq0cjFwoeU95hneZixmABCitJxAJ7HNEFzg7EApol4J +rwtNuuMjwu1cCuf61UYtWBdCzNQG8OwivH3mZ9L3COmz6HMjp4uX4HegfYP8FPIx +JQXtj//dZvDE9sGsZkqVvfwRJ8LisHGApPCPPWPK4P3DxyPzhoO7jVN6K/Pbmx4T +/a7MhVCaohMAXOu2SpKQ2QzIdveExio3hokCHAQQAQoABgUCTrxp8AAKCRBTPe8V +XXu8WnO6D/493waxI2i0yS5EO2vexL4t/E/RbGxvXGR4o1ldd9jWoZs259OFxsVt +zgyq+PMTcxD0IrrbU4P1yj0jNfH3AE5SIgyunhWgP1oinKu83S4Qu8n6/1D25ehe +Vozd+dI1fnKIgJM+0fHpKBftsbWXV6IX75doSsFH+afKQpKaQO4W8ybOFf097fMY +M9Bpx8iF2h6kW1AJ4D73wFjcEYylEuuEPoupF+S/h6PYL+MfxvBmZtyUZtnYApCR +0wkEZ2uAIQbeBjqsUmLKpta0dswDAlTSVokb6oNMFVEVn2QgiDKkba+kU3GsNf0H +tdmdVLqGl+GOzG1ZM8V4WEbZtsBBqne9eLIyeUxwkPeyM+1g1+0E8d3ZCCb+e+pj +1dMfu+TtoHblXH9og4hMOqOLR2/U342nHDtlSrETwYrF95FTTImsTIaz/4ZpSGHs +C7otMHxWcDW5ek1QFDcMcruLp/k9uphHsL7x6ezlB9QQRlJURfW3rhkQ9QKv60ou +8RCywl791cmaeKypDWut4dbAcEAU/52j3wCVkjv+PdO5THjBAvlWCe+ETz7zWwRi ++uRbq91Dtg9zZBh/KjuwdNrCPjlhNr/DySKhDOdCTg6ayZgx6chijTjMqhxuorDe +orqWSRoMHcUbGCN1VNBicVcTvwLp0ZNGnIFv2tWa1NBsAHeTvJWIVYkCHAQQAQIA +BgUCTsrLfwAKCRCJofZRKiOcLJttD/oDmttJnZ3a4BPd7AqZEPBjxGY/5MQanMF0 +tAYU6YxHHKXdfE6PRKaZv9sJHtPBWS6tTlYdUgntnxy7qYiuOAW/UUssdThqTb+E +HrfPnZ68AEF9DbjlVp7cTvFS8jYICVQ3lelvwGLXvbQzLj3+4pnNPSGAEAfCPkOl +y5imicTIjxnJ27i3T2BzjyhMRvhyV0OxEk2Y4D2FLLi/oeN4hUyxZrm2hP38kIYB +UREX29W9XAya/BtI38N89StU5eHauLi5ywdIYWQMB0b2YIHqnplqRDN0W2h8kwZQ +0DAVl7bRlTt0opVPDgntNi1ny66GVMA60JIIkQkb9NgQpDC+FLD+7Hn+MstGWhlm +B/gA5tVQ5FU4vu7z+sOAXtrQyHrhqp4+QmMak+5HiKnM9cs65oAq6rj6WmF+g6g0 +4ksUlJakx+Ea0ervIhmwHMbuC6o2x3mTxibcldJ1brGIw3MNvF/vLJ2gkmon1xqw +6xqn3Kii8OsZcigVFVxn3lAwb8XcKDJbM7gDosTZpluAlwlhZvP1zVT+0yjyLjcx +blomgt27j1VWCRr6ue3Enth0vkQzEwjPHWi3Iy2DKBzcHmp5f5SyedFsbxUBVHyv +S65af3/Thknsx005snZWBYj8JV/y81qHeMMRaTSrEoiQ+pzWx8r5btCTm1t/oOs3 +93gK5Ks9zYkCHAQQAQIABgUCTzZvaQAKCRDtOHP10yYnIidIEADM/xEu1TWcOfex +vNUK/o3epLpRCT890C6ZXK+xI2hfIUObjEnUqNVuCQ8bRRWBlIVzeDw94elw08il +uZcHJgr2mrNVXTi9Gg5Trp45DQdnSMwxbZAAwCrW+2JibIDpNAe3cCk4hSyN6yz2 +IXICt4mrO2WH9TsHXXXUQhq3bkQHontc1sRcZtPA9JZP2imhkYoLyjUXQhq2zpDm +KbcukskpImiElzsdWAox27LabZRkKTWEithjtdD2qHg64UgHG4GTPnupEcBZ0y5o +8WtCXXywpk7CUGnvIyzVuzWFusyrFfp6Cjq7H0K2hg9+d5JJBH3408tt84djDNXJ +fcg/EWSNr/vmC8haJh7nHM+aeVCu0ztZrqxS4fgTA/jl5XGdf0Q04Je7Y8FYGQ20 +9PQnyujQyP4Pi9ye93RV3mh/Ki2OBFem0x2siG9ER4o37CpryRZg6AnKJ8RButid +B5Xb8PqCC2Pxw/xl1UYUp8aqO3nOknlbn7D8q5+LGEANLZKz6sVMYRAvgknXi7OE +hZbV38TtNuo1YCEI0WGUkTIUVd1dZ1S4EpqecIbIXH8SvzWrcVbbRS/j5F7gayc8 +1Jxpf98x1bHmd4r81rNXTpUyRPC9eseayK6Xh58ZIL4uzO//I8QFIob7tl27uYOp +w1sO3QLVx8sLBJt6/fWAHFJuqk7954kCHAQQAQoABgUCTsFkCwAKCRBOvAyfAgj8 +EW4dEACv8cNDV2ayt7zYxvCUrBNTKjVhfvn/YF6lRnEKHc+9iBd3M9jLRBK0V3cR +dSsVeXndvmUrmE52H6WLXKjJP44M/VRSvcgbhMoF1FBMkwueebG+xVrQbsoa161i +NPv6zf7S0WLf078CoER3F0yMnTJUgR1ejiMQ5MK+EECcXhDwaPLAw6HlijqQJnul +UkT1+fO5asy7F1QYQLp/5uCmSWfzUTfLNavWH2p1imtOJsl4koQvyZGSx5me1STS +p5M22VhrcmzxawBeNWSc5YZcZNXaszvqCKT4Or6XEWASWfV8i9SN/yK5VZgFO1fO +4WbuwD8820GWTRCSw6YQ80Bc8xpKJ9aPQBEnpQQ1hX/S1RJ1LnxR/iH852aP0tB6 +1HNcvE3PpJnmKfzZBsCER0VVuiBG5wwo7fILfSrjeKs/U1KHS6dmWj8uZB/r1tpV +T0uGW5VG9o/CuIvZrVUsPIVYzH4st/JxOTW8wu1ade+VxC+ZAfDu0kBR3u9q2/3l +fQaOim2+SZ9+PPbRnWClXQXaqQrg+bXSUFWveBqGAm4g8Hm9qRLweoeV611DMIcI +/jSrzWudNSJrSgfdMySwQd7g/G7NHmb3AIUEZFPtG5PPSKnPhV9cR3BM0SooOaLa +zgnCRuH0KZyMNOEXSTFCcE+4X5y2UlkNL9aVF3DTynhZO76r9IkCHAQQAQoABgUC +Ts2X0QAKCRD1T+ZICIM1qZZuD/9vUi+1nCzf8kjkJnXuRhfFgskBDim/SLOhu+S5 +tIM7ui/xqCZWFUGEwRTR5kgNGEsTbPJ/x1glP0apQ7yaD6rWGbwqlbCqd1/KieGx +NBkMdyK9JzfZkf44+Euypbac5shmIC4kLNN4ksgzLkqTnTr1ApPNrlLSOqVgr97C +4WEDuKKPXrIkVvRCfGy5cjjXFBe+sG6b+PqYkyjC5y9m7WECW9wc92t/9pzXvk82 +sfPFzcF/0d+0bUF6GpImTCk78OMjVyjZ+WFq6RJF+yQx+k1ic71Huc6kk4ODPrMk +7QawlWdsMbNPuPELhu4vu8DZj4bfgOy/77jCM2lkE6we+8cQ6FX73PlzlHV8qWQr +e3yzuK+cbBZJ64XCyeiG+qcVLPORw+Saa6AZikp2g3LxmKK1q+MHUtAJbfyJvHrF +V4w96kQsHnCAt6SznocMxn2JniUxtOrq1ykUbdGmR34WBzb/UsnAxgrIau+5y8S9 +pR9aBTmWw+AKOB1GG/zQcGJL/5nHrg/wxfnCIfO/1hOAH01LGLRMF+Ih77A03GtE +sTRrtH0clT7HFb+aWTp4xuaLorPJ3CBoNT9lcI7HkkaAyN75Yd/WKZZbIKqAwX/M +oKhn/DG+6EnS8MwuVCxMKNXftYIyhhZXttH9Erz8SUiQw2cTt6Nq1YjSoXwq/T3c +EdYte4kCHAQSAQgABgUCTubiXgAKCRDGh181Qc794KfdEACInc7tkSJdiBsjlYME +RWmGCMgjyPYbkIn8ZWCnfY0CkH6axy7znZ1XtAYg/ms0SFfkZiC/7Trs9XV//fR/ +BE+Y2Ry8bTuDjIiuAlJikYGc2mc5bm72jFg7ujx4AdlQY++FV6+8YAqtAYqqmNFq +uxM95R9B6AbBEs3xYSEvD/flSOrvE+oC5d4rPnGIfKHKD2DaHbc7MednAz8txBgf +kznk4zy3Ebx9joHmxTVbqsH8ydLTvFR0YUQxjQe8Whzeuu0dv0HZIiflygch1UqA +mxMfM4+Zdw1dn2wyUAhFAmPlrMW0neoYdtXpNGL9fHGubfKHrFcmf56vtfffT2Jg +mP4JlAsIkoYXLDDrtpfQtM1c9pgWs1ZWKakKzLWM+doW0vg1EJBv7ArCht/Ymlpy +OOWpTY2cCWPxx5CWifOd+ZPmEL4vk0hJT7ZSrspR7/IykMe8ZA/CQEspM4yFoIbz +1BCINzKcjZcurygRxlMUL+aZk0Fobgx3eijAOMX8yDbRkiL9Q0DA+zoH953Oqjqd +mmVmP88Lsd1DxXEkt2wpedO1rUsGFjjSpfDP4NB5NRIjnx7Y/PLus3iyY2CSxcDe +oBwB05GTZ3hqqV7tXVsV9xiGpLxD5kZfhBs1D4vf04dzvqp7/u/ORvislSNaSFxW +eL2/4fr7ZxL/+1QvIuOSr7+WPIkCPgQTAQIAKAIbAwYLCQgHAwIGFQgCCQoLBBYC +AwECHgECF4AFAlEgj08FCQvSMBUACgkQm7hjsPUbuIqV6RAAsyR7D1OSKh8WC41h +ayD1W1MvqO6BfxCOgvQpoIp1ctEM43oI+fYjYxXEBeeiDpPv01ozQbwd7HSkCf0/ +1h0IvZNCZiUn004Mz2gmwSKjHl9oq5cOlhgJZB3RUbz4O+vo+vxkL8H/Mgfc3SSA +9TdPWyTMn9m3YM46Ql7an0Q4Km9Gei03wkKoz48GJFw6/pnDgZP1mTq7JEYrQeBQ +nX/5aUtsflXJr+riUIAHO6vjCy0AIN5b5D69/01+I6dk7Iw80kR+TFeT/0nJPiHX +BRz8TDiZg/gJrdY2AykxmdAyZAop9IBJk3zGub7Aswn4V3oW+UIQ1pjIXH/bqciW +RP/VAsz7kyg6cCteWO+Vtew86QOi3+1k82+QYrrDIKQP9rDhgKDr5CLHnr9HEYXr +hV8liag1SNB2KTvDCiPPMscpDq/MWV+kdboq5m4ybOQGEUvpwQrjVGrPwyywkD7k +3PqSpvy63p33zabbJHQjevopsDdDFzxlhH2NKJDH6WI7Sszk9q0VS5WCtneQ+8zb +o4p/1nTVCSE0Leedy1LekUHDPUQ6pziGbjEU0JsvZNRC9RrKFUsnKTndgsQxlMwV +2QiK/BfNwVkFReyEO5HEMvXXBZSR0JG4IJbYO9Tgzaxd/qOn1nD2RuO6h6O8CXX4 +ObQvMD6ANZOrQ6WClXKEKqnhuDWIdQQQEQIANQUCTOJSoi4cSmVhbi1TZWJhc3Rp +ZW4gRGVsZmlubyA8anNkZWxmaW5vQGFwYWNoZS5vcmc+AAoJEKR9Hi3QHg4YANYA +oJjhPnn2X9aUeepb6HzKkP2REJTOAJwMqNSRlUdSQUBfUC93xCAS6sUJFYjKBBAR +AgCKBQJM0rRDHxxKaW0gSmFnaWVsc2tpIDxqaW1AYXBhY2hlLm9yZz4gHEppbSBK +YWdpZWxza2kgPGppbUBqYWd1TkVULmNvbT4fHEppbSBKYWdpZWxza2kgPGppbUBq +aW1qYWcuY29tPiIcSmltIEphZ2llbHNraSA8amltakBjb3ZhbGVudC5uZXQ+AAoJ +EIs6YB8IyXXlWaQAn1tiQjM4MyZA2v4GlT2Te9p05dSTAKCRpuwROcbdZlTLygOh +H9j0/1lXXYkCOAQTAQIAIgUCURGZrQIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgEC +F4AACgkQm7hjsPUbuIoS3RAAwLclnEpqvrPmnsvHXmxJviuBBsWXrBD6ces9BuV5 +LdCZr+Biuud0A/xtkNl9/2RiCx78qhszwNkNTGtyCUNuQXwPfkG0hdRr+qSuKds0 +/zx59DBGN+duxoxJOVSVFvQ/LG4QGi8xXauLzoBcCOJmdEJycdgvFkP7cRE2A6yI +5C9FmHurJ43TZQHCdU5O5+3B7rmrPRaVnVy5/j1sVCgJcpFAWdsLC7JdFo3vyzEO +BP8DIVE8eSVd74+Db0QCvF/LaWkUUM1noG8yXB8cnG7rEHQpg9T3y+pmKVtUIvoP +DbNA3OfsNKCmo5ym1ps4yeX63F5SMZ4JgNXHEB5sSbdL6uFnyrFEeH6zb4u5pjdd +g9cBRFLkAIUVpIISaWcGVNIe52YpJOqM9aQAzx2zVVfrB/0PHEex9zs+hQJLeUPu +LI7QXKyEXD2xW4WtIaZxg9PgenzFWm+zTZkgaMW48EYW783xsq/dgia0i3s1mYSQ +2STwGsM7whqUJdrNd5kybdaa17JRNXLtTEZU2mHtMKqfSFwOQ5KEnePLPTxl9KkR +k8xrQH5F2MKgyQtZRLvWC7jJRceYilJ2K4XkT85xGzqumIa9ABrxeqZMlKSldaAF +GYtSJr3m8TT9RVUTl9i2SJqlOEtuN5XlN+1zzhHAdzP/hxq35qunvgkatAm30DL/ +1HyJAj4EEwECACgFAkyyd3wCGwMFCQWjnO0GCwkIBwMCBhUIAgkKCwQWAgMBAh4B +AheAAAoJEJu4Y7D1G7iKdjoP/jI+g2MfdwcYeulAtehiHpxWXU1HCXHblLdqLTNj +DFHQ9KQaAi2yOhi/z6XRzZRCtBBrTqfOHEHl8h27v6Hlbg/J3XKz/Lgf87NUMoZ2 +YehvFvLGOCbt9AAMURTmTBOd9tmqR7GeG6IkeiIu5u0izyKezy0CX/6oyXkLyr7E +Xd6n7D57T5LscmxlhsFW2bumFE+b3uvhfyeUyVH8yxNJGmAE+FB5PTb6WWT+yihQ +I9Chq5qJVyEud+FM4XkbaqjyJCzzJf5ExU4uwbjWBd/fAVRgs8XGxfXPCJ66GurB +FeMubHTIxKRnXqbcgYMeNNSFW27ZA5QHq0bForY2oWI2vzZtQu8EyJS94yKxRlwr +Uvo+L2pjP2MOQGXcodSkYboEbNJrs0001+FBP+gTngK++pF1ihEcRoXLX4qXMwTn +PdUuZ5T2PERIup6EwA1uFViNCa/RnaFFNSkNBkE9BcoZBUSGcCjZPzAgdTNbdv7O +3QlZW6tBpKD9cXFzLinhElR1H454jEP7FqRYu42/TllgdNJh+GfLLHATRSe4dk9Q +8ujOGXSbAoTwz6DHn6OrfRbXf6VrnjwSBC0wJ4lx7Oh5IspsBZtyK//GeMUa/0J/ +uXYLPNlDbBUckMm9e5lOt5PSa1AkM/bIxBvJc/XIOCcXVK/0iHI1KbaT9S3Am5xO +BJM1uQINBErx+bIBEACvms9F9tvCbiiomUNcohHhHV+poRDb97luSQkXWqYYb4N0 +npxgAe+YzJCI2aKBZvLxIzET5w0foXvCDafrMvZ0nQHO1cqG4fFDqJYtietXW9CB +d4kFn5pQJs1/8ZU/9/skQkw0zOJivfhHOnDza5JY6JmsS7By2fHJWfmkPU+5GSs0 ++MmEJ1yQRTg0L0gYwyap2sYxOWb5h41mf1tPnEnZXT/T90E5YKtmAd6G3khuiuTj +VoMvuqMk6ueVjK+B0mSmcg0rrwPa21rO7ymouL3CIoCniA0SoxeuvVqGv92fjxFh +0a3brpyBIUj0SidVu8DGjlP5lFE7s6dX0hDYr8wWxOLOxHUvk02JQwoTy5UYe3jU +g8cbGdACX99ATPstfdBmzMmhrJsJKGB7NzzZqMk15e7oxBEQhLG6gDCrpE5l+e/K +TQH0x6R58IzyStlZYCcTYOS+80CGu3pQtIL6QXxnTAPx14Kb81a8h0+HRX4dELCM +nNUAWnQvNaihTb7+yfVaJvBe8/YPLBp9ST7vLBC2P394syQac8sWx7oADq/YpIOw +ccQzriEIHb0hsbiPXfaEVxYG7cdsdxTH78w10lgYWdF71VUYNZnUv2wOmKwxoZQs +wXQa+gX96+KJAlcQKQkcrjl0/SY7/vMoPh43yGZyOuKFd9AwqCwagW06moAXrQAR +AQABiQIlBBgBAgAPAhsMBQJRII+sBQkL0jB6AAoJEJu4Y7D1G7iKQjsQAJH0B3OP +vE/8pKf7umGjzHFY7lIwXU2aZ6eNWGycxjhdNJxuBhQ1rcZAu/tT6Uv5AjnfjwaD +2gYuYDRqDGnifAR55YX5/lZzLKGfkQXFSnGyC53hGx0BoU++jmRjCn4JJz2ncYap +2gQ8c5O37olp4zzykVPwbiXeluWfTc5RaR3U2A/YmRRNRgu8dacPSQw1RoJo/A46 +Xlru92cLjBt5I6RatGTkgSMy2u2zc+kQNmRz+kN8zhTbMy0K410VBM0PSIksXK59 +YtQJlgr5zwfDlWk972HLorJu37GamBmv3MV6/nyIr9oofLNkY4wGm2KIqwRAcjEM +K6JWwHUMrz/5EwxLO5tjQnzftbAuTgy4kaRqs1ecF5VVwbL2Ot2DqKnej/umjqMP +xI5azBsh2o/2sIHMyPjiD+cOGGs8I+/rcnWFqm91GNZCnLMBjozbcFhOFhZ6XEsM +8JiT6We8y/GOwm/NyE1t9hS6p52eDxEERqnvfan+tOzUIssw16TBmeFrPfxegKBX +5j8v5jaNi0todmh5XIDUD3XJNphFDlDBK5QakCC/XicmH7qm5Rx3jQy4eLbMAtX9 +URDq829mV/Y6BuUAQQnURFvNoN1GXK2se8amRgb+2ELVyPUU2J+vZcJF424iI8qE +djLV9x5r8l9XFbkJJq9Te9/EI0iuDhH6qbCBuQINBE/exNYBEAD25MRg7Xt8ZOmo +oeWYOg1lcwkUmxD28fF0EaNAvhYd8aGv71uTT4sDdtOyBAQxdHu+3aGJbXFECciS +GZvbZcP3TJDmw/97aIn1z5VHAFQiOFF9RxrlaFxxAbaRw8w9hfgxBLKe1VlVJjUr +txsPQt0W3Cuow7TKr6FGoQzOoxCQnqHWWAXhZ4dJA06g8TH4XdvuRMYaKdl6psgJ +EH3GnKQZ6Xfzv4CC0icavOcfVBi3egtAl6bEko2LM7OQp1IWlW06gIKIOrzDWF3C +3+8bW6dYvXslP/hALbd5g5UiLoprqqXuUUZmWHi5VjSC+6hiS1fKqP0t/AbfbZF5 +/2iFfqcjNAIaeZvcE3kb8chR9k9F+LBfc5Rp4f03l75TmAQ7ZJJPAzM/Sv7XiGwA +ekPosZl0UtWn+eQcTNVlLci0LvQY3NYU46Y/AKw0WKQuDgSEmjNxBB4NA9BP5kHD +DgtNM963OeSGuyRsB82hwGYXShBnBvtg4i/Xu+0x2iw1U0Ad2MNbsz9VdUXVZefh +Ww8fayjAvHPptnHTJ2DXukn7fot33LXx6bwoNfUlA6u4ZvVMpF3naA0RYHY+3rBF +wVm0kd1lJ72uBFzyo7bzUQicPwKIHZfy6ajzo1XNy6M9DX96djpC5iSoFHm/waFt +H/0vCpqntPg/DMp1Wbr3orKNEU7URQARAQABiQREBBgBAgAPAhsCBQJRII/DBQkG +5WVtAinBXSAEGQECAAYFAk/exNYACgkQ4sL0XWMvWr17sw/8Cg0UoN4DMgFgUr44 +fjTFi36UOg2AbPuh8QbqC80Eh7wX+v6Gqc3OZi600YmT/JaPIwdc8YQqZaQKbu8Y +JzadQMLSkeD85Je9g2zKjygc7Lwiv7UTYL9aF5OptUecRyaE0QQeQ4chQq3zhowG +vBsfbIAJXvloP+T//mocO7mNmjfw1iU9nt/RKBFn5l7mHIpfOyQcdunC9sU8pgNA +NGpenHEvjchvAkQUAvEAXAKiF6/+O4SjzLOPZLNh/oJLByhynPicpb8K74pV+ngh +htOWL/3+QnjxeallGFBJPKmHwUD8bZUpCYJS3H/KPmVSa/P+F/zGkANjBvtmdX54 +288CAUgeNRSOKaXTxP3Vnla160WTishV9Dcjodjn7JDnhHOX6b9NpXYskR3k8G9P +Sh6ggTmZJ2fRzkgk9SSUxjJXr+VznEng59emcmeD1T4HyC7nHhef5oLH/pyPt2h5 +fTsORUwcPNYVGWQZiEy2YY45EvMuW/FFGlEdNzByUGyvCKONK7/3ipWdnJv4OaVk +teljbVl9sxRqecIcOAuAx7SbH8J7uxNlw0HiXMTTIiH+NvQwMyHQkSoRUG5IkBeO +P+7B2DdS37Caw/kNWcCXwYe8zFVOch99m0wkI9vWBtpIstUDaeelHSSw8T6UjYF2 +Rgr/I45P4vJdmh0ZywBdjhIWqx8JEJu4Y7D1G7iKZqUQAJ4NZ5/BGEq0HTI8trdS +DSTnphm2Iasi5CpDDLTak59rNkWjulxnZ2c/qflMY7/K1ZGD13kpelK0nWTfKXi5 +kVrq2E/6b/1Lp3GfVaxAgih9rPrcfp7cit8403WUTKYkmb+2a79Y/Nf5T8MV2e18 +MpzZkA+3XffHXQzzscyhBOTzZ4wjvT+uC3coRGwIgJchAd00yKgrPMYox0eEAAhB +OIaYj85EHbdA1B2wdrQBwNPM6pN1kFvZKOAfTAPNSYeFEQVmnGya5jg9+RIeouxE +SFEDsoe0kKwZeQF5ZaAiU7V1EJEefTnHVVhkULo9w19M25jdka9MGFyaiZrL0Epd +N7+tYwQG2qzOY+JScUzIOYcFKPTMF33x2crMssMaX2HEI5JX/Y9lPGZMwEWwEtxa ++V5rJzZOpx0FZlBA8aLgn1hChjmbyTXXP+/cyo48v2Pgkk5WBqBJZzYGGH6FX399 +Hr8S1fzrwqO7+3vMzNuBZBbKH9rEtIAh6UqvhDpqZPj5T1dIWlhb4kfMcBZ3+fE2 +eJj31fIr5/QhPxUQ77Ca9nrMwxoMmPy3TJHjBNLOTAEHgefIBpFUt3ZtBayCWTsu +eC/NmDLUR23oBvfEfm6beglClTGshZel7UdTNRGr5793K62KdM6XCT61VrH9g5T1 +YGX9xIlFt+fyh76GksQSYwhv +=BVQL +-----END PGP PUBLIC KEY BLOCK----- +pub 1024D/EC88A0BF 2006-11-09 +uid Philip M. Gollucci +sub 2048g/315B27A0 2006-11-09 + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.2.2 (FreeBSD) + +mQGiBEVSy4ARBADrOOinwIJ4itmRYZkw8cecNVGDP/VwcD3p8rlYsjZe1MNEZhuR +9nsNb+QOTHdY2iw92zsXYsYuk3kFEppGf+pomFnfUARJiMYkV02USvACRNSN+aRt +d2y8FCmhBZinx1niYhOAD8J+B97/IUKXqEBOygpHXKQz3xN3770CNef1NwCgweIx +0jReKJvR9uUgfqhps+EEdPsEAOmN37+bs+WaG+u/cd3Q/bHqDs7bG/GiM3beLop0 +HQLu68yE8KjZYDuKojFVJcvupAzP1suV7XaaUhBY0xJWLmGI9ZwU71yTTsDqex4b +G3qQ+4gqYEzIVQkWHquHlBeH6Ipjgw+I0XctPklIGnA87pztTfycKy/Xk/6RnlBA +29ujBADHA1PYdImHpsPbko+OkjOjdGjS/29kAUmEsWSVZ/PAVgs92glGHjBTZDWv +QzvsDmceTWS8LCAQivo4FzZvn4hbMA5nhU3Nz5KwvA9fe2LhiSyMoKILk3D3odSr +w/bZF/0SOZgBynz1AcC+jaj+rTGF3pb72RKLYZa8ZRCyzJpUYrQpUGhpbGlwIE0u +IEdvbGx1Y2NpIDxwZ29sbHVjY2lAcDZtN2c4LmNvbT6IYAQTEQIAIAUCRVLLgAIb +AwYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEBMkm0/siKC/X+8AoLnY1ra0mDdJ +8KzdBWBRgm1wG4JGAJ9C4K7yr1bF/LKXKzXWXJ7K+E5YT7kCDQRFUsuMEAgAm0d1 +14gWPOe4RaOYy9S3bsJlKww/eLF7pC4oQKi+aWf914Q0+iJ6XcPW5dJRZkZ8ZQEM +zwhDPn15mxedfuN2CQldgyi6DQKbAsNwnUKd5Ro6S0rcsNF4hJ9G7ZfTiSD58Vox +aGSexJwToB5GrmqshrTBr4zfy0nGOo/GfzqADz/hMIDjLMIDQYah1ihidZ+w3XOx +ei0aUsC45ZnoeAipiL8xlRljDq6h8dmTmXGBlyY8VaXghYkLhoF9bWZ6dUukVUIp +OI2KyQzOIa48X6wLD4FbnIdg9uvcwItmdgelPAZqiJbsbk7MktYNHwbMbOR+W7JK +we5eCKhiddD4v/ysmwADBggAhsI/RXL1qLwssop2cDs5oETekHHjRb/aDg2xLbL7 +KdB3wSnYPYwG5EmAc2jukCZonDEJYTZ1RePaK6QtPyHNZPWwYS4gZsQbTgNUmWvU +r69VwBg8i1USADlKiMCLvoiMOyNEQp56yrwAVldP9UWs3p0laTZTwaNeqDS0m0by +gDNTPuX5xIHwTe66dF2e6YKSXEEIqlluaHydK+K/l/Osxx8I+DcH3rkzi+/9bCk+ +iq3Q+qZh9uT2DadAbbPe/jHtcBzoQ2qFan0rNDOFGDkMGbF0y2cnjc9DXBLymcsd +UTsRkhsB/Mq5+aN4sG7SXT7DwDesMz6jNdkqrYP1fNsMdYhJBBgRAgAJBQJFUsuM +AhsMAAoJEBMkm0/siKC/mrMAn3/s778nZ6gU4+yCIwoVpf94/FYaAJ9XKasQwdyU +QrnWO3UkWeAgmGQ70w== +=wxvV +-----END PGP PUBLIC KEY BLOCK----- + +pub 2048R/4DAA1988 2008-08-20 + Key fingerprint = 7CDB ED10 0806 5521 82F9 8844 E8E7 E00B 4DAA 1988 +uid Bojan Smojver +sig 3 4DAA1988 2008-08-20 Bojan Smojver +sub 2048R/9E49284A 2008-08-20 [expires: 2018-08-18] +sig 4DAA1988 2008-08-20 Bojan Smojver +sub 2048R/CAA19524 2008-08-20 [expires: 2018-08-18] +sig 4DAA1988 2008-08-20 Bojan Smojver + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.9 (GNU/Linux) + +mQENBEisAUUBCACoFc8Bm0Ipb03fNXgilmTiMgjWkVVddy/XliF7mnfiASZ97vwB +tQyyD+3M0Gi0VvL282+EfbOdDkCSuD0b+DNGVIinY6YBCdyvOEWoduPPB3fEg8B7 +NZiDmuv6K3IvZnL74xFnEuq+U2CV2M6OAZW/yRtGvWRG3sa06IiyNPgipIy7zytn +qh9FhMJJQepFAOa6+i+8peMHQtcQtK/sHJLG6GtX0Lo69aYKzmDDgzxZM4wLvBmy +H4LqgYDPXmvf/e2hqBfHJCDyH5pk+nIWngNWjuXg3fo/v47tOWfv65Z3ZETWbE7z +PrUD2P7AKvBfR7cKTl+VameyZsvOZsY/hA+DABEBAAG0I0JvamFuIFNtb2p2ZXIg +PGJvamFuQHJleHVyc2l2ZS5jb20+iQE2BBMBAgAgBQJIrAFFAhsDBgsJCAcDAgQV +AggDBBYCAwECHgECF4AACgkQ6OfgC02qGYjSQQf+M/ESq8WUviexEHItvTWka6yC +gd2sZzhU9z58fhFZaFu+48GXo8dUojlGRPP665bLUu3pKiSG4UQhDjcrxkew+4g4 +g9Jhox3IN4F5istfHEcQD9X9VWDOtz00kESNg3PiwUUk4N4H0fwkohGz4yfEZXIT +ZNsyRPLFljd3jZoQLRPtraPnxxXP99KE+3D4CswNwNDbEvWj6GxTRGCncCFlP5dI +PXgwcQxx75sQoulk49hOpzLq03jhJAUqe0kWmJAXKwqpAXr77FWhOD4rET7v/Mu3 +piT4TN5S7vjjrSTLGb/OlyHDtOhBg+En0WxlkwLbJITEJbPhE01Phiri8IuFu7kB +DQRIrAF0AQgAyJfi/My7CKJEGWTE1x6KwttHR/k2mPzfM5+Icr0Bhko5ODkCewf2 +EmS4bO09ltZHotwCYMefLRQnaPtCYsvdF1qGnCy9a7rgZpCEpG2+YxaaDvVbmMV4 +zNnKO3o3pjAnO9rRAM77SWW4XWK/CF2MRIlg52Z0dPNDv3SOOGwYN7Dv5iKHNxTU +k2DjK0FJId4r/hvZH0pNwl0shvwzfmgZLLubGUp6zGelZ0bYbi6T80uappgFGZY4 +ozldu8/eX49KA6o9AZuGPEQKuyX7V/oHsx6atCDMUso97spVVGKQlDfAKGUsUfdM +YwMO0NhAag9F7JyVpuadmVyV9icBxFBLywARAQABiQJEBBgBAgAPBQJIrAF0AhsC +BQkSzAMAASkJEOjn4AtNqhmIwF0gBBkBAgAGBQJIrAF0AAoJEHGtyF6eSShKTw0I +AK/gyCXyNFjt+FHIaTu3Y2rCdvv0n+UWOrsimnKkARVKq16GYoEN2N14LhqJhWfB +mRMwL6WdXla6ZoppD1uzb9EVzdhkKW3fsBmHBlnGjgdOGvL/W/hEbsEd4qg35vGb +pZo8t842GBnbkbN5ealREvg9Sk74uXjEKeesiw8LCgPrP8MzkaKH9L8/2IvHDy+u +/4FPRdAfi+lr1K+RhJVAu3n36SesLpwSek0kdmoDi+Ie1QDMJ37Wq/RTmzXmmYEG +H88rkTIyAHLwjZr5Pn+g1SPOJeRfTiRbMI0RyR20LVuaig9JXzfBwERIDCABH2ZD +CIQaG2bLMFCvzmKxqIcxC2pcWQf9HSr9nVN0qqS6u40+F2DxHPZ5j0/GJZXRrGOu +t8OOQ7wrBZ51BzmU66noFGz3ftjPROZFxf1XDdJKqOQVbl9mrY23L2g88UKN3TLh +6wUjUAnnvRdar705r10iSdxFTehEXXTimJCMSJwFyj9VQxZSPbW+kvL6aSp4usC+ +3vVYErgt75sMFmo8XtI09kzBtZM4aqknoXmZ1Ck8QPpuLunQ4pT9mkYqCwTZaskD +PD/jX8iP8YX+q0641fYbsz1kCE6ur+6RuxJTnowLBHaIR+Da0+OwpmEVMyM5YJQn +qPsUIbmLK8YuDA0QgUu2jezEa1Y9oRjp/6M8UnEqP1hPZ89ckbkBDQRIrAIkAQgA +wgjaTGzpE0BZPF6iZy222vHrnsQKvVnQ3JysXSXLSK7DNsikHMGhHTUAPxjIJ2Jg +NCWf0QBfmOqLLYyTgnakkMKGs6jsLtPAyx/myKWEyU+YZYIhx4LbP7Vy2fjPdKo3 +VLli+Mjx0Nd0tb69Km1U87CPbO3deWxIarGixKqv7+v6xn68W/qg1y6I6jZbN7uf +pdV9fdpqDI7lnuw67nOq1kzePoqN0XvaXKfc5nMz2CmJdjgLtYfsFbKVe3pqTJ4j +tTIhMtgcoQ5XcVOsCygAhH088geOuKPYG702onXz5lnErG1KINEKWKC6BRdGi0Dy +whewJ0hSRwpDEIvkV4rMBQARAQABiQElBBgBAgAPBQJIrAIkAhsMBQkSzAMAAAoJ +EOjn4AtNqhmIuw8H/jQF8pEz49P0wnzMS3KLOkXcM94rQTTyX0KLwruxMa5Sk2IT +r+CGgSNpEbOmy2NUWu+om/NIA+iOloM0bbWAZBDUObQ0EMbCI8P/60wvULrJOj80 +MwWITqBV4h5HB2q/gS+1cxIw9+oj6CwGLi1GqFeIVKReLE9aSKwLnjViWMkovc+z +x9TN5Zp9Z5K1nGDLDXOccor9YzLgjx6lfYaEXnp0rHjoG49JPDz2iA5l4KX1j4IM +1Euoi8/o+V0G46az5UqFDE7e574kygY/9XqfLBWEJKni+fnnOIrl8AIM27h3k1wU +tFgJorzNs2GGEpj+kU2A27zmLWqL5fqDzY45SbI= +=h/J9 +-----END PGP PUBLIC KEY BLOCK----- +pub 1024D/6F9522D8 2004-02-22 + Key fingerprint = A8BA 9617 EF3B CCAC 3B29 B869 EDB1 0589 6F95 22D8 +uid Issac Goldstand +sig 3 6F9522D8 2004-02-22 Issac Goldstand +sig 63F69B0E 2004-02-26 Gaal Yahas +sig 3 12B9AA69 2004-02-26 Tal Kelrich +sig 3 EBD27418 2004-02-26 Yuval Kogman (primary) +sig 3 9FC881FE 2004-02-28 Zohar Kelrich +sig 015AFC8A 2007-11-18 Bertrand Delacretaz +sig 152924AF 2007-11-21 Sander Temme +sig 1CE17EDC 2007-12-18 Matthias Wessendorf +sig 2046D0F5 2007-11-16 Henry Jen (slowhog) +sig 3AB8598B 2007-11-16 Jay D. McHugh +sig 6210BFC0 2008-04-26 Jean-Frederic Clere +sig 65D5E39A 2007-11-15 Ben Speakmon (ASF Code Signing Key) +sig 69CEEB1B 2007-11-20 Michelle Caisse +sig 3 6F9522D8 2004-02-22 Issac Goldstand +sig 6FD05E49 2007-11-17 David A. Rush (KY7DR) +sig 8780226E 2007-11-16 Nathan Beyer +sig 88C3A5A5 2007-11-16 Philippe M. Chiasson (Home) +sig 9C85222B 2007-11-15 Henning Schmiedehausen +sig 9D3AFD4F 2007-11-20 Theodore W. Leung +sig A79C6E18 2007-11-16 Bjorn-Erik G Townsend (Gmail) +sig B3B4D98B 2007-11-20 Timothy Olsen +sig B8CE306E 2008-04-21 Oystein Grovlen +sig C3110611 2007-11-15 Petar Tahchiev +sig E04F9A89 2007-11-15 Roy T. Fielding +sig E41EDC7E 2007-12-05 Carsten Ziegeler +sig EB51FBBA 2007-11-18 Marshall I Schor (Code Signing Key) +sig F5BB52CD 2007-11-19 Yegor Kozlov +sig F79B7715 2007-11-20 Felix Meschberger +sig FE6A7BC1 2007-11-20 Paritosh Shah +sub 1024g/6741A3F9 2004-02-22 +sig 6F9522D8 2004-02-22 Issac Goldstand + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.1 (GNU/Linux) + +mQGiBEA4Z/MRBADgHIqs9R8lj7gPlUps8D3JgLJEEDnCCVabppX6+pdogmNdTYPz +tjp8KLHjBSfqq+r4aUxp92CtZzTlpSAEEn9uo/dgb+/4233Eg4hpSff2f2fZzvpJ +b6I4BaqF1SWVoGkVxZQGcC3yLFxQAc25UgA6DCJcFCd7InY4q+w4cw8AswCg1Igv +BI6gYpVegrlQqYUVlfxE4p0EAJDbJTtaChXFEc3oR9JeTzN36NUTNpnq0L1/RNfb +U/5hy2bt6YUWn2wtpwClGmA1IOxTO2bep8UvoQ8F8v/wgdQazlcS6wdo3dDm+hB2 +MFDy9qrGtXAsvNii1VK2O7XQHa60K+ZDGKNyGmuzXy8ujAvUE2YXD0LJH1pwBalr +vrLfBACUU8Ch4aRwXHSwFyvNEQb/ICKc2wOk278JB8uRSavdmbaDeAKoWj+7LTx7 +H0xcwUyP960dJea8CYYGSrr5IESOH6sFjwy8Dv7P/xo3COf5kO2KfhoBL+ABEJvG +VmNFsoNCkiNXGjkBLJTwav0/R2pYRxQp04h/ctVrJr+lto6z3bQmSXNzYWMgR29s +ZHN0YW5kIDxtYXJnb2xAYmVhbWFydHlyLm5ldD6IWQQTEQIAGQUCQDhn8wQLBwMC +AxUCAwMWAgECHgECF4AACgkQ7bEFiW+VItgf4wCgpUd2Ln/cCyPgV4V09kqM6+g3 +ObMAoK/qeEztO7STfdgcKJnAR2GQvB9PiEYEEBECAAYFAkA+YAwACgkQN2uCuGP2 +mw7l3ACgmPGmdtk+n1jQkPNlmy1cgIVPcGgAoI6vVfqJ9+AcnwehoagbD3f5LLeI +iEYEExECAAYFAkA+P4kACgkQ/sGarBK5qmnIYACgslT6Mb6VfEvs/qN7GoWN/oZ/ +jgEAoKhcKA6gqbWBsh/ihQijlF6zICssiEYEExECAAYFAkA+ZzYACgkQVCwRwOvS +dBjipwCeNnKqRspkZufe4XjL2GFQdTXaaZQAn1Gm/O5Fah42HxoNt3PrXh3WFnTA +iEYEExECAAYFAkA/5f0ACgkQdW1LhZ/Igf6nAgCeOHExK0HUSqXQq9vKik0ZkzFK ++VAAoIq8NmLML388JYGLMK32/HegJAF8iEYEEBECAAYFAkdAlWYACgkQN/aP9QFa +/Ir4hwCfTY2KuaV1ysNFb32LW6VEYZccmVgAnRACJIthab6J0zQIj5cAlW7vfrHr +iKkEEBECAGkFAkdDlCcgHFNhbmRlciBUZW1tZSA8c2FuZGVyQHRlbW1lLm5ldD4i +HFNhbmRlciBUZW1tZSA8c2N0ZW1tZUBhcGFjaGUub3JnPh4cU2FuZGVyIFRlbW1l +IDxzYW5kZXJAbWFjLmNvbT4ACgkQsr68QBUpJK9cGgCg18E4t5jbxd4N72X2AD3v +cEzTDNkAoLUp1EObt5Yr/mFkTKPSZwRP7EVCiEYEEBECAAYFAkdnnDMACgkQQMKr +HBzhftxAZgCfeHQhdRf04uxEd5rS9mN1gF0ZnloAoIgsXNemGq2wGuJJAmeauDoC +kVBqiEYEEBECAAYFAkc9FkcACgkQLNaoAyBG0PUzcACfchAh4Apr6TdP1ka8FuT1 +vog45ZAAniQVb/yl+MqqkniL0Hfm2FgQ5ozCiEYEEBECAAYFAkc9KaAACgkQEYjo +3Dq4WYtzXACdHRQrXQs+jQgce2HfsWPrTvtWYswAoLCdJK+/Qi97OXN4wl9bK64K +1J47iEYEEBECAAYFAkgToLIACgkQD0UKJmIQv8DIAwCcCqxidJW2K7tISWyNhtXc +tx9CEysAn0nrx8zdzoYWu4PpBTtbtTDGSckNiEYEEBECAAYFAkc81CsACgkQr9Wc +wWXV45oWNACgqhI1zGHGeBVOIWeO4327fyX9ofAAoIeO37Tzg01Pp60XL+O4DVtR +Vy1DiEYEEBECAAYFAkdDITEACgkQ7U7vsGnO6xuXAwCfTi8nBpinhmeqPzRX+VWr +0RI4E0UAnivZbcH4U1voSgMpktFbZU7n+mB8iFkEExECABkFAkA4Z/MECwcDAgMV +AgMDFgIBAh4BAheAAAoJEO2xBYlvlSLYH+MAoK5j0uJMhQf/4xaIheZzvjHfY1iT +AJ4srgH4IvO2TWXSm6AqVfNrewcM8YhGBBARAgAGBQJHP2VsAAoJEDk1+i5v0F5J +MIAAnAqV9gjU5LWnBc1wH5p9neWG1xiaAKCFQ4r58AqzoT+4sg+9AIeojnaYEIhG +BBARAgAGBQJHPQiHAAoJEAC+ZrSHgCJuna4AoJL0tN6xbBO3464JGL+cZ7PLctGd +AJ9SThD+6rkdxkNWx4dE/WgAZBOLh4hGBBARAgAGBQJHPOkuAAoJEMsyoQeIw6Wl +s/YAn1x4nHnsstMIDDwGMhlGPKHW098pAJ4+LobR2VHsotRXr9gP/KzuWRa3DYhx +BBARAgAxBQJHPNClKhxIZW5uaW5nIFNjaG1pZWRlaGF1c2VuIDxocHNAaW50ZXJt +ZXRhLmRlPgAKCRAyhk5BnIUiKwoWAJwJWiTd2ovhOMfYh9jKXPkLMo4tJgCfbC47 +nhNOLMmdgMn7PZFwz/qU58aIRgQQEQIABgUCR0NSdQAKCRBgKNb8nTr9T6QLAJ95 +ktuG881Ko2iQaJ5kJe7hgyuyWACfdFIR3F4Jq94PO6kl9s+DC6jWF/yIRgQQEQIA +BgUCRz0GzgAKCRDBPTDYp5xuGCuvAJ9RRtzJQsXCVwngAC8NVhcONBcWbQCdEDWJ +LvqrDRJKEI7Cbk1Y/O5s1QuIRgQQEQIABgUCR0MGHQAKCRCw4Bj8s7TZi2iwAJ49 +sIqrZNVGTzozxTDu495RuH9+fwCeKtXFaRDaXa0IxK8lkslQ5RJ7rB2IRgQQEQIA +BgUCSAw+3wAKCRChYGPsuM4wbpUNAJ9Nd9CGW1bSJcOKaKAo2K7iEsNVcACdGo4m +SicMkhN2gmFkHQP0wjLyNkSJARwEEAECAAYFAkc8uzIACgkQGWWFUMMRBhH0+gf/ +bPEbwV3zjIaUyYPiXIGa2jmdi1G46ms6yEdKg2T3Lg0+AxR5CkQWlF+b6L1L/bAM +qAH0vd+zHFlmiKSHGIhqDz2mmR2kc1eMxd050l6qXASHIWa0QbaMTImmDEkXaIVD +QI1dttqQKgOJEPgta07kUXSW+zT2SVQ4IurK+4RwrUupoKPm0trC2kM+keCieCpR +f3c2q46Quy7qfMkfby1cwtU9gjz0k+A03TvLXDcpNNJOTPfQByEkOjBxF6UZatay +YFEpLdA83hqIdLGm/ziU85Mk6VR5We2PcD74ZEI9R1BSaqjmuofZOqSW9kYg10Kn +6vFG4hMxgy9B9S02DVmNiIhGBBARAgAGBQJHO8qYAAoJEFuWgBDgT5qJUDgAn3J0 +7BVslyH4YOpXRy5nEX349iPUAJ9YUYUjm6cKg4pWvoxYQqQPcGAGoYhGBBARAgAG +BQJHVqzSAAoJEBMuSdTkHtx+RfEAnRqCsQ+oUS/XUjyHJwTvnJuqgOQZAJ4kpGHe +4oTQ2xSJRr99LTGdXPcGj4hGBBARAgAGBQJHQIXvAAoJENbd8DHrUfu6ef4AoJCh +cQ7PqkcXM/sch93zD7UusXqBAJ44UgUdUzoy5HinUz9Ui2MPigKe9IhGBBARAgAG +BQJHQOv2AAoJEGk0CgL1u1LNttwAni6t9y5HOrn5ORAqeBbxcs3UAKIXAJ4+lLWm +nCbL58/zcSElL6PygS5PaYhvBBARAgAvBQJHQpwHKBxGZWxpeCBNZXNjaGJlcmdl +ciA8Zm1lc2NoYmVAYXBhY2hlLm9yZz4ACgkQXif4bvebdxWczwCglDy01EwcQmqW +OsXoT393qOCdTLMAn0DKeU+zNU+aeISGLxErfSqIlSMuiEYEEBECAAYFAkdDGN8A +CgkQ/4h7uv5qe8EStgCgoO0CH/6VsY8TJYTsmxdSJuHj17gAoIyuvO31979r4bkx +lOlau/qbyxWguQENBEA4Z/QQBAC0cGDsns4j+wtllwA/npIQX/GP7IBp+ySSDHMJ +upoLXSktZwmiQ0y8vNbbJcofqSrb888WxSERxGlhM5fiNg6KVJ84EYR39oK1r/qs +Y2DRnDUJY7SwwzP58/cUOvOp7Z3smXsX8pFN4iCntQhhIcddLdRCm/o2s5QG1B+W +Q/M4AwADBQP/a7/zLwfG+/JJl0LBG8I4BK3tJko1sjOs5VBxO9kw779Rjw6NQqWy +25QS+UXNL0BMwSR0/MRsekNo0mmXLOtpPzWZf04Q2vVkM87Vuciev5xD8GdrIyjg +QEdF/PIOuMSDR58X/5MhcFCPbQEsiR9CDIzpkoyFkfZqBv1HYAkHRWOIRgQYEQIA +BgUCQDhn9AAKCRDtsQWJb5Ui2IccAKCVJoJc4s/AXocLLtjXDdMjU1V3+wCgw3EG +j42b8RDsM44NwP9oQj99Qyo= +=awFp +-----END PGP PUBLIC KEY BLOCK----- +pub 1024D/E55B0D0E 2007-01-01 + Key fingerprint = 3E6A C004 854F 3A7F 0356 6B59 2FF0 6894 E55B 0D0E +uid "Guenter Knauf" ("CODE SIGNING KEY") +sub 4096g/CB11FC40 2007-01-01 [expired: 2011-12-31] +sub 4096R/31D9665F 2012-08-21 + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v2.0.16 (GNU/Linux) + +mQGiBEWZmwYRBAD0q6ODLHHR2D/8L7yANKOviQZwhRDOxfxIL3PoZ/xN/bMPeo8t +wcv6Wh/VnIdz153kl2EkdYhCNbc+d0g/WMfFNe7ch8hqeYJKKQBj2fViS30ZLfju +EwVesWzr7kUah2ETHC2Lo+vd0+x2yLsTriWUhK/ZU+85MTZRs5HX4e03NwCg5SpM +iJp1pLwJGEt1zsAfIqUVfXcD/3uOlJamsYXmNGtEsndP3V67gsQxrleWWrLQzkt5 +WP/Myq5uY3XtIa0j6NE9TZtXwFQzVoeLQhpUg8bMuPRg3VzB5oq3ClkS09w38xyF +eEZlNjeJg9TfvDk4bYpLKHtJeFn3pFR13Ojz+r7AHo/wbcO/Jho6XXLJPCjeMBFg +MVagA/oDalIMI9cUVmM5In2WexaGuYqOaLD/2CEpNpL2zppv/5ES75oU1I6bNVw8 +jVI5pHIVn7wTH4ja3GfK238uncqot4SM6DxdW1F4Gj4cKG1YXyPbD+kqqX4IrzFW +VL92VtA7LJdt2t/z+OFg2StDKiKtpGdSGcWEimDu7RapK251d7Q4Ikd1ZW50ZXIg +S25hdWYiICgiQ09ERSBTSUdOSU5HIEtFWSIpIDxmdWFua2dAYXBhY2hlLm9yZz6I +YAQTEQIAIAIbAwYLCQgHAwIEFQIIAwQWAgMBAh4BAheABQJQM6Z8AAoJEC/waJTl +Ww0OlsYAnR2HF7kXtBC+SzidVezJf56EqiXjAJ9EW1h4g5opnNFAp8sghh48aJii +RLkEDQRFmZtOEBAAwlQPuku80T82g6aS1HpnsXyzxG+k1k0Nj66ZvRM0f8gQKmGa +nVTsbmjXRD1Q0N/WR3F5ynrk+dvgdN0/IqBxR+Ek6L0hYFqa0Mp8Rqw70M7oUI5i +wMa/873koCnBhFet6Eu91mVPOSE9mdVIw/vlq8KT8VuxcqpvUKYgjC9hHK3GQnia +R4JKkCQjk4ZynQiDckKcfaR765GYvw3Fq+v92Ebrdu5qYh4Tq2ncEY6qfCcxTu6T +HXNPVgX+A+5ASlcLAxMAD1W25//abwPdvBIZ/76nXXGnZI4NQDQQf1W3btrcHxQU +XrvHM1DTV70wlifIA3xjuWTIRr31gXv5QVrVQdn58AhWoHB2eSGX/jhHzQfghS/F +kBIt//THDNDYhNtqHLz6SihMHNDIUcBNNZDF1tO2slsrAtKkooX1J91lBtWRWwkU +3VK1HttMhAB5xUswbn3XExKK/J7IiI2M+Qz/QIKVIWcPyYmPBUkwtNtVRiGPcq2O +MF2BEKRVyCZa1rQuPNRLv2iuFD7iaRfMMakWGIY2uIeLAy3KNS6VbH0qa7LUfeUv +0Be2yyEAr5luMwomWzAHpW4xhCLG0kjMiNCceTJwASG6eTg/JpWxcXca8M0ZvcbV +BZ7nzvwDRBCtH0W+9w+gNwgtToE4UnglrO4TsXtWwOyLfv+GaVQIngqH4lsAAwUQ +AL/VaXfDuLOe1j3jn1sKjDIfIHzTS0THdxpP3B0WahZ7xHAtuFdd8jXiCmIGi9hK +O99Mn5xsW3/cEPVfTjkXbfsgUc5xHsC8zJ9BCHctkgPvaHUJ7lAyZbW+y+CrW+dp +CN49Y8H50NhwjiHiwT7GynNKnOxMFg/aZKLBVFFOzjqtDQ8qjiPdgAldO/tV7/WV +4HTZvGUqQloEqqMjWTJO+fw9Mau/ejvBBuz/P78XkCku8cST6hjg89FXgyB0J7TL +3ykvJltIS1gBNK6BF3N2es4qIaT/MUUbB5wdpltYt1HZHBUtvF8ywySuTu3ymyYf +LQdRt+e32tMWgbWL00d2YJDeEOFeylBbOErzHI+tqxAQlwigKzHyUQkNKel2MRmd +saiHMlc8Btj6YsFTf+sXnLo/zkq3BLVJd9qRS+udbbT02TIVhKybbJbxtgg5ajhD +zOuRHb+RhpqjAaM6HGM2Vv1y3OLSzAN981LyEKgqIG2cwmNmubQLgwi1UDhcrTLl +aXpFB+SHpvZPsnBQ329YKurlIV/rL38ZajIIMYPmk6bZIqTW0cwy7aHLXgBEgIpU +jHDBOnq80rcyc4dauctgU1muYFh6y47yqtxmTkHu5nwTbZEn6/l1/FfoGCRMkLtw +RdDm/4BfuuPExBNkplzglJ/cMAvvr0/mwv+tqvQTT0CMiE8EGBECAA8FAkWZm04C +GwwFCQlmAYAACgkQL/BolOVbDQ4R3ACdHuJ0qhGNF2HmkKxkEvyQ8XYBKGYAoI/V +BpQ3XajbV/CPs3YP4qBMddA/uQINBFAzpr4BEACwaErsS6S1riB00wvUfcKpl9UL +JDEXlpL2ut8tc3L6YmxemBl+qHMqNFRkaHkCF1jWKGGdCt4Pjuj9SX80n9R0Hclg +Yp58Q5C2ud3qvorf4Pyd+A5c5cyRXLovcwdybxcHgsBGbPjLijyG60ahhZV6R3XK +oGjs4iFckNBlXXMmQXJvrGqtzF0j9FaRw1vmFbxmkhYz6lFHd+0iZgtYIuhYxaXj +i4sJ750CWnaq8Nhvfgx3KjcoQDGFwH6iBPNw9U72eXVgVZdRBiNOphoXqpiGsehg +gChIFDeZhWfL9MpDMHZDeLyHfBPItbjmJLV18FV5nomRSwk9q0E7BysdF/fNO6bg +6+sJtrpbztgVySRkBO89XS/ZyAxmNaE5Ta4oysZPKQMCtzFK/9fFtIPf/Ue/c+b2 +1yjCGfg1AxFjdfAQ8sLS+tR4kDSNCTGS0W/rms4D0vGYlcCGRHj8DSForckm8hcD +Q2fJzZdocgIWEiPGlOZlYZqO1NTGwvDdhMXOsgQoDxLeKWLz5UdCiskYi0A+leeP +VTzrg+VisMUeKEIkcoZFSb/6Zdwg0yoso6QuuAvzMsUbe2JlUd22JyI2ZPbRqHL6 +KJidYkf0gj+34bVH+Bh/LKseviDhsp1RWPQQA6Y98ZYUIuPl4TXb9bEfzHe08Xc1 +6MkatgyaeD4cmc7+fwARAQABiQJoBBgRAgAJBQJQM6a+AhsCAikJEC/waJTlWw0O +wV0gBBkBAgAGBQJQM6a+AAoJEMv/VdIx2WZf2s8QAJw3S3KEd9OPoh0Vh7pFdPqq +QM3VsRyYB6lyLj1LmFgg9N5nnakPQfW3uI0B5/ChjVbETp97f5T4idLjTZthTEzW +fRZWwqJy90sMpQuxXl+bQueAtzAsPoWrbAEbiJOrj61VPIBXUeFs5ryqehn/TSoI +MbBeqIXODcYefbySoH8QYNl6Rx3CE10L/8Jc9Rf2JDhwrh0B1inUnQPdewMnUU8i +9pcowyazIAHnM7RPyDd5lJCVYol3NFmga/xdR2J4tzTgism9uSAcDzm5haQWI4Gf +JqITzsTGKI412WiCwkQTTVQ21r3Bqtvv8II6FX4rufx4+Yxel98r63JcRHqEXekX +uLw869fO0p/QgI16aQc64355a8uk77Vb+8zHZLGVJYxQrC7ifSxwHao7JOfvZr8n +AvZQzD8ElVJpRMSPib3c/J645zcWO5Jb7tybjS2Jki2SZ+deIr+ZeiN9rOHwUqWY +9J6hdUHAdSq0k3EC0ZNAnZ0Te0h31sBV9PJ+XvGojwWExL3PSfRvptMq/Qp451xP +V78eroPTPuFEhs41kgf+GOryaNyiLf6i+0+oGDBvAu9/nqey+X7jaPYNZGObm89K +oVahczAX7sWtVza3tKA4GpNosKD6kvhAob6bYjzYW3hdiDwfotQinYX1nHjWaVHb +hcDlnYi4YedwLzL1kncZ/JQAoLwCPW4ja02VCN6NaTzPXbXMtNvGAJ9IBx1qXxRY +x8eFsL1d9kVuIT0J+g== +=R3ET +-----END PGP PUBLIC KEY BLOCK----- +pub 4096R/39FF092C 2010-01-19 + Key fingerprint = 5B51 81C2 C0AB 13E5 9DA3 F7A3 EC58 2EB6 39FF 092C +uid Jeff Trawick (CODE SIGNING KEY) +sig 3 39FF092C 2010-01-19 Jeff Trawick (CODE SIGNING KEY) +sub 4096R/E4799D69 2010-01-19 +sig 39FF092C 2010-01-19 Jeff Trawick (CODE SIGNING KEY) + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v2.0.14 (GNU/Linux) + +mQINBEtVvNgBEADNtkCqSEaFoGGAYR36TllgPuwMOfYbu7fubmVR1JDtozJrl4RI +KAjkCTvybouecd+LFS2ta/RLn5tAUYfHrJYC/M9xpcAaBbMQgRkykZtfshcLIrzZ +pnLmpQtuqauvYjAojHiO+2LI087vvF1tJHbL8Ui+pOjybYbMyQdmGOHggi95ct1I +4fATHth2UWVsQZ5Uy2SpwNBgiVFcLKFW6ePeGhkJi962Ehu/7OJWgBlLq6EVn5Bh +ZuOpHM8nlEsHnbmspZDMU5Wn/zHeq33MsWUxk/A0o2J6ifa3bMEpIW/dgNsE3DEJ +szWll3+kmV01XIsyORy8NUTuUdpjmPQxK+JczORYO5JaZAhRMURIrlym8ISrltbc +AbiDQQrKr8DxPpB5A4cQ0RVWxgePPldN/CSfW8HqIUYLShrLXuaq48+cntw+BNET +8tyyeXaDVYvbyJNUJcIJbUjbO0tzB544EbCLZVxur2g4JlDSIP4WeO5NHuGIUnAT +4Oy9EuCHSRfdjWvVtFcja2NTkznqOG9pkRRFU2RW5Q77eVP4qqZj2QKblqdz2aOT +9VQU2Q+Y8V/SjN3XTPxYIrB9kTFOlx3tw6jB4kuNcFCEnw7t1REGWANBoT9g5aOd +f5oCPhfhNN3UmTaRnRErUb1eA7y3D0IxNTzWxpY5thkf0UT5kbAiJC8sHQARAQAB +tDRKZWZmIFRyYXdpY2sgKENPREUgU0lHTklORyBLRVkpIDx0cmF3aWNrQGFwYWNo +ZS5vcmc+iQI3BBMBCgAhBQJLVbzYAhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheA +AAoJEOxYLrY5/wksOZwQAIMiODkpgLXKVFWXyBbNWRA3GOM8HmM6lTOJYMxoPjF9 +urHN6NC71rHAN16YHu+WZyL40BAg0kZBtFYv1TNKNFy4e/GETD/JiHYoVA2hQGqM +wWNDxREXtWySvkqpM+snkcLezeAaL7EPJhdLwkDSftrffOY0D3tR6Qwh66dfELvT +/93wCm8eMPkNdK40p7iNl6YOwEqK1UBOfDyYSqcTn2xjYyXEyVlFIkKWTPIRlPmt +1vQsiLlKMIzkSWa4foc60RC4jULD59DQT+M0Y1hME1a1gbVNBwliQ3uyVKUwtCPQ +Gv5gLSb3Vy+37nLcpg8nL3X3EPXYTQTah6oaUhyFaBgsaGV5FVMV3f+dSQMcb9Tu +PsDO1HJFy7MhKVP040oE27XTvSEjaF1gIP0g9VvimSN52JD98vsd50A62BlgNR88 +IH1U6oi8ndfDb4nVbiANOLwMgqMySvlt0NYMUglucMUBsNk39sJPqA13LQHBjuOS +/vEQ7e02KfnDBbSVIt0RKQMOlA2F5aDxc9zGHDyphNFvY+EMEeXSQ+akg02eW1A8 +qjCcZqOFC+cHdHRaJ1OaNAHlhwXbQmZOnIDtYNAn+Cmu0lUaZ8pzTutCHmUqyIMX +YiLQ7dtnro+IM7d/dumcB1Yf/QiESJwGYV25FXk6KZK4FTU7kE75LVjbeQDKazfR +uQINBEtVvNgBEACz3jqVi+aTqq+DCxTg+uBOj2Da9clD/e6DQ3xiyWczAmc9nbWY +42K/hT/kQ4x+WGR2N70A0eEJxnpf6nT+FaVf4xVj8wtcheVJPHnSKXMst8jmpePv +EyUjQ+7bhxdz5orznunB+VEgVCLMHo2nOHzsxIDA+BKSxm97Yw8DFh7aXyRiZc2G ++5Wu8PcpD4G62SX603hwSi5NZVrMKxqUPtStqoSoqQmei0U331q8kjCZrBLBH4C2 +mvZdLSBHv1vQOwDr+2/4nCd2AR4Ehkvmg21c6WComXBZI0cXTXHH0307RQK9Mb5u +zmm4luY47CoYf2wQtK08fmqvmXZaxYVvw0oFCy1m2AV8Mjrqt+kEjgMG2duqDxD0 +/Mm+fDyTy6BVqxAdXFIYkJh1cIinyBVClPUGJnI9nYNOPm+NvKJZtqiGoPQ+B61r +H3FBGTLlF1QSQFopgKM+sk0qBpJqFZv1vKtuhmE+dREgYKJHAfafGAmdOV/btdgm +sYNcNWiNwVRKU33hEfhxXgrYc65WBip7On91ZvKgeVQAXOD0oWdc/3YqewoeS6Xf +TodA1drvU0nOIy6qhq8UR03ACrnIapFcYP/UfEanl1fAeW/T9oYWDHXzuVEz52fd +xM+8h5SJbEB6PQpqq8wvdzech39R8catBvMTnkndeO6OvRq+Q6g3d5sY1wARAQAB +iQIfBBgBCgAJBQJLVbzYAhsMAAoJEOxYLrY5/wks7AIQAIFIRdVv80ONrKdhC+7q +pl4y/G3MO8COktIWOwZF82ThlYA5v8C7EPFuKvd++TLhoV7iqVRfCh+EdNV4QcKG +QbMVlq5ebuA2yHXZDfYzzOeU2p9sCkfETIXsZj9kwhtnzCYrGNbTcOGNnA6S7xjB +YGcpXI/NOGSp5XgLt7j4uFFT70VAy/kGaqDjTwLI2w8HY+d8J7S46M2Xms2f4XuY +RQqf+rwk3VCRhnkjFJfLUB0aEQtK2dlHO5eA9uN9Q12mNvVICbImOywoGPHD/bk2 +W8waBHTGsjqOBs6V94BUCAbjMCNkx5YHMfq0654BpwmLxn/cXAuzrJaCvNSSXml1 +/2INF9aeGi7cI6ShErY66B+cFr59Jf6HNaduTt+o6CDy9mt8PJhtd5G/mD0UVYWf +p3S0qb69KutBenWC94uSoRi5lduclNQkZttqFSl6qpzm6IWlMT7J38XZXzfYPVdR +tXnIuuJhf5MM6+sasTwnRSXgpdlTnQGlWO+oISJWQiR9ZUUs0gc7thQr7qVs4PIQ +A72U4xqzjlTZWwWyxqhiiFRrFk2ACpg3mvnvqErNxJYUvE7YJQqBL5WKOTBbOyVv +mFpbUjf8M8vIvxfmaXDyDkpOX1dmSGLG9gQTGuq7MBKh+UTSMaS25JDHKHuAhEs2 +hTA/zcAcwy7UE0ycrzubKC3E +=f1ck +-----END PGP PUBLIC KEY BLOCK----- +pub 4096R/791485A8 2010-11-04 + Key fingerprint = A93D 62EC C3C8 EA12 DB22 0EC9 34EA 76E6 7914 85A8 +uid Jim Jagielski (Release Signing Key) +sig 3 791485A8 2010-11-04 Jim Jagielski (Release Signing Key) +sig 08C975E5 2010-11-04 Jim Jagielski +uid Jim Jagielski +sig 3 791485A8 2010-11-04 Jim Jagielski (Release Signing Key) +sig 08C975E5 2010-11-04 Jim Jagielski +uid Jim Jagielski +sig 3 791485A8 2010-11-04 Jim Jagielski (Release Signing Key) +sig 08C975E5 2010-11-04 Jim Jagielski +sub 4096R/9B6D9BF7 2010-11-04 +sig 791485A8 2010-11-04 Jim Jagielski (Release Signing Key) + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v2.0.16 (Darwin) + +mQINBEzSCGYBEADM35SrGvF8jjtPHoVtoU3LKaFqqYInTOKiGeBxkCReGSQrUL+g +nvEqs69xSnHffHY8MwjsJY/k0zaegHgivWW3fjiA53oFnu6yTl30PeNN+l5QS7kR +zWk1mHL+Hl1FV9Rorso1lQrokTYBxkE6g/1F36QNmgn3ckdyXV3t98WI+elj4Uf2 +uQkc9W/sozfI6iEzmZVfViULARS219uMYT3obC7RE6yVDIsYwByO1fXxeLSCnzNs +POBRGuqgkY46o4Lbb2EMCAYC5/pxiAtV6pGqDa5izZ9Wt5rQEsnGdBaa95cZcLAg +MiTXuE9bXjMcHsWR+38rgfGZ/4RVYs3R3NpspnnONRawCZAdwHX5Ns5WdBEZv8/g +Q62LBm4r9x0UkkfA32m5vAt7VhE95RHfJH7suN7eoC6wdXRKzuy+sPt7OHBKWmKJ +k4Ve6oGxosI7zur/LKYafyQtdzp/KNpPTfxcAAs0GZnFmAtk9g6044aNPZ8BpPqN +UY928g+WI4OhEfb42W0DiVfONvZGR06buNhdbNwaqdPeefCjErFSblLitSlUzvYb +n2YjDP2WySP0xFjIfkcaUjkv74kVQVD9haWdQJF0qukuAR3YzDr5djXhkHv1x3WQ +trC95tOaH2ZCB5K6NMZra2t9I3i9bOYYMLhq4cRCIazzI0FNsVaOuPUZ4wARAQAB +tDRKaW0gSmFnaWVsc2tpIChSZWxlYXNlIFNpZ25pbmcgS2V5KSA8amltQGFwYWNo +ZS5vcmc+iQI6BBMBCgAkAhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJM0gpi +AhkBAAoJEDTqduZ5FIWom/AQAKqOyCOLUHQPif9BlYF/TrCutkE1q03xIVsOLv6t +sefueqHIa9pa4Cg+5AWHO9HwmCrOmJijC34Zu1CW8fKy/ClGS2DY6vcsZ22MrSo6 +FkgcDqk+X9aqx38G3MKpOb416JEENwSS7WQK6j+C+BefoS7aqYarsD6TdSReVHO9 +y+ksbKVMRhgxj3yQZ1fPYSZLWGCyl/VQGDG92l0LsaCw+di8DKOM7lOY9vRfuQIV +rqu3dyY8cgvnux156kqKJOfOCHa6GMl9NiUDQpWCWCuYRBm5RsNIRD7S4nRz2K8M +obfgwY75rW4iayAEfbLznbtzarMDS8yl0UIuAVEHJtIZ2oCnpcptv0dHD+zkMHW9 +eNmZBaHz57buHla0VmEFT3DImAq6eRYveI1pDE0YCp6IjgYd0rysz232lkbMCZOP +wnOwp7UbSOqX9Pfiyct7iEZXMH71QBpNr6sKKHcfwUPQ2Qmd+hmmj9aFbYCmbiP1 +DrQU8uqqmQx241tpMgu40c9v+ym55ZS8DEgtFrsvQ2xhud2gYlx29kKhfMWmhf9K +M3U1hibkY9V31IsgpbLkXGg1dny2dzzzUih5gIViScs4kC100SurlLQQCROWQtTl +RmkZAU33IYucwJW75iuv5gxyZkOsD29QXNSHGEUe0BooakzrnKlhriuzvaGXKhRF +JYosiEYEEBEKAAYFAkzSCcAACgkQizpgHwjJdeVlSgCePJsV6CDpUawSxj0/ceuB +Ht1u2vUAoOc7vAkh3ihIjKpbf7XU/XnDf2NYiQIcBBABAgAGBQJM0sMzAAoJEJu4 +Y7D1G7iKnBYP/3aYH+gw1dmAV+/ytfaEFioFpkB5v4nMUDrZnlnM1xSLsxSsqyWx +rxDpvGVf7VN9bMrXm1oKXBwnpnrdXvBeaHmH7cIjpN7sp8L1QQ2g+6B9Vml3DQmS +VWnX8YwiFYPfVEpLvlIGlA9lc+n1JfAPsxH3qb+L+g+4qUW3LAvGNTi63t9rjT8g +RYzWFcYBTruLdT2MdXIYpVGCdYvM2+QwLFcSsgNaK6LHuF5gW9lPz8fAVkgJ6M0g +cFQK/AiKaFIicX8bGIQX3YCdo2gaE76CbJiICN6h32AnlukwISeYkfmEHl7VOx6q +qIY7jjmP9p9Cmv5qQGy7UhwXFko5dBHvaG9Ac6N/FskXxBt87+TEort4ghcHPSa2 +EV355h0kRPeChOfTjTHHZi7RfS+YVOoaQVPyxe79GHX5La4lQn81uylrU99Sow+2 +QNuB61exOPyHgT/QBXDZ/0fucUW36uEKT4YSFAHV9lGpGywwLkKqyHNA3VGGf3Xc ++FpOzlxlfD/TYzPklbPiOddznGFa3gTsoNHvHjaG0XbA6coErCuchF3zDVVtBZ1f +f3HdYH9m7NoRHcoUVqj00lixJ8PqMyS1CzXJ9fFRo5G1LB80CkPryY1rW9+IewoA +2fKAuE0GWtQbVR8+I0KjOv0kOzMzA2exZ+cYME6sK2I9bfEJCXLAQFdTiQIcBBAB +CgAGBQJM1t6BAAoJEJrilv0C6fZbyxIP/jvJ6wNcj1ko/mZpJTsIkXxOJxc9JF5e +5aCl8rpoXubmWB6zDZKoiJ1Jwl0pxVKRfiHwlP5NO5jne6Njj6xia6rBcHkh0o7f +5JMDNSVehej97y9jc2dX1+kNmzf9eJZTeE8CUqBELY673L/dITg1eOgmwbvFZ50t +Tc+PnP5eHTlXRcIdb3mRVHmwjlvFVb4fxy9DEkDOUK3ZsKpWUMl2a5XUURwKOwGW +sQ+9CwHd3reSSI8GEtutQTZTc1XTTbukYRYjyHpY9nRWE7+dd5jgv6Jv184Za5bR +CtILNmYjgJFtb2/5djLNErAIpGIg31+sABq8D1whe/AQhq9duTkc0+sNQdP9Abc9 +FkTeat3vFk7D+L1YFMY6Q1EcM97SbsBTf/I4Grm7ndNGEBHgi2RN9CxToTpPzkzG +Uz2soE8ccB6aInbPldbxmwarZ8WZbMNC0hLa4PKmFfD6ptP4cDkY+F+qQLV1h1bo +4Ccse/dDXfE4h0j23+uowGvT0ZXU9Uq2cpaij+9Y3clMVgly5aHDYv7a7CXznMO8 +fjyh3ZcQOjvNEusRPH2c5akiOYWF+xz7cqvzL+CI4SX43NFK9A/lSnJiFfMzus34 +nqydBsJLYCOx0CZAz+aLwkxFJzcmre3Qv/8Grnw3gQfGBHa/OPiHKQ4zIZncVYqI +y7UHY0KiTZVuiQIcBBABCgAGBQJM1wKOAAoJENIc0iPujg3VOTcP+gKPRPv+Gbs/ +X/8x3G7rwIuo14+1xKBJZco8kmSGWEpos/DKPo9Aw5Gcgz6gOlh2EVWyGjwaoXdE +mhPLOhyTf7EVbUuIpmLZGoA4AAR4OnJRxGjmwTCkPoUZ+U8lzSG6VpSRmmTOylZV +Hs6kmaRzvC0puxAdUEYL21IbQyLODXR0k3DmjY3LLssPMPiXuT428HVvCiJdPu0s +b3jEViA65E7cipu1nF0PJBUBNAqVMHyydXT/yXKxHVLCJOHWeD3ZUzorxRc0e+Vj +PfVtaY/nR1GDLKm3AtUDYZNXIB4YfYpwtulrlfNv+ia60ejAQZDyjx+eG0r+cw7v +L8WwrAZLC5NitH6I8xESKzdJ8sTGnfVdexMsUvwvFPBJ3jNoxZI8my35BK/snap3 +eBDj2sNU8tE0R0L09QpytwMQorqRFha86kcrmsPB6po83za3xoli7GiI6P6pW64W +2X8d1sLLUM7BcPyWYZ/Ps7chnHb4eRUVHuAuDG/v7GNzHzFWEbCV+/lTjCXCVnRL +VOfwkMjWi2HN/GifrDVEiXyqGW2uGpLT05a1ppNu8fMvNwqzIm3If5o9wqdU0Pjf +mFWRKILqoXuE9nWdtfXrAMBK3t1nV/HuMVrwuvMIPo2yPTxb2oHlrsqY9HuWYugm +5TIo/bbUGHduo2VAKOoYmk6Hg8a6h7WCtB9KaW0gSmFnaWVsc2tpIDxqaW1AamFn +dU5FVC5jb20+iQI3BBMBCgAhBQJM0gjBAhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4B +AheAAAoJEDTqduZ5FIWoA80P/18XFs37N7+D8VFB8NsU3kBTvh9UZx2x+ZGcHIH0 +MnEgzACcoOsSSFdcOwgkc2gVGBEgynM1HSmSgtSpxPGrW1UzmKRN5hN9bq/B6hyi +7xAEFyMiOUcTobH85eSAbFuxv1Gb6PbKtnlcZWx5YNlAOi+7OBD2g5lAA7waT5sM +DisxOlgkTYvzn2ouOwnQ2RG8I+qd/htswvgo1wI7GZJcnf9ZFn4ejsJmXoTmC6+Q +J7iI2K/YbSCs/tGy9yowTx0QRO4cOF2Wa2bo33ALCSaNjMOEsu3TTDMCdV/1T6Ys +6ppxfKbT5/bOhWpfGye+mCArMrV1gr9ydo9WcGXkbDWeg+3j+hpsUGmp809fzono +ziZb10TRIa7C9sY+Np+WHPNgZ31RHLY6RWXweqBjkDOPcJyD/tnC6sRugY/CDuRV +eWxfKgUKHaVNLj7XxCTWazxZVT55WFvvNknugSjjp2FKlnHb3lR/KtIUp6YLvSIr +VgdyDAbXW2CV1kamuFrA35bAazXsyvEXye+P8B+lA/pd0achXqxzIlBj0tKNob4u +gCQ3AN/E6Pivjg+o/N+8Uzwiu45yKvuUGmtnKJQTdNF/+5E6QYm95c26VpMYxhq6 +CEISO+GhJnbPB8ND19AUEoNGrvRROE4FsiGNpUWN4/KPW2Pc+mt8Q/yqOnWQM1GQ +xznxiEYEEBEKAAYFAkzSChoACgkQizpgHwjJdeXSpQCgp3af5lJ3s12S9jF9Ipdp +zwVnkPIAoOJEjS3pAs9uuGdImfYzGKc7c8f4iQIcBBABAgAGBQJM0sMzAAoJEJu4 +Y7D1G7iKse4P/ipNLcumGrfCuRk2jpUChmhIc51wdJGeTF3+GPkXYjEckX2nWTqg +KElf0yPfaU8XMqzLnp13tCYg8a8XE/MZR0O6byIbQ3ODr/WASQZ+xhMawSmSiMEu +EWX/VKs2+4hhDaVbC7PluVXoOLz4sgSIU1/QxJoarD8rqIWYZFoS4mp/rlAkiNsw +mM2xeA6sqUTj9hSRQJeqnLI7B5eN2VCB+yooeY8k4AraG8XGJCHwcJprksIPqi4R +EzaE6VNrtA59GKFK37z7kA1//yBm0kCoqkCkC8LFYDEnQhQXdZrZL7zHLQRP9hNG +3CxnKUkD1HzRYNxRemC5Mmvxfj6xCRtBI6bhlNUpKzYWqfslXvVXPy+diJLhbXj9 +u5I2W5AKMlgO00Eg4JRp9WcvOqsVaVD4Tlet8uuIIeLuC28l3w8fjm7TCrHjcjN5 +CH0QWH0nRTNaIR2ogFvIwYAsR9rIN4qJzNy9crYLJEJwcVgTh3tVW4qr8jn7sjVt +MeF3JIZIDGGE/b4ZSeceTdaJ5QsFoXmRT0SEFyRtbT8pE8WhNma7Jl0d2/b/qLV8 +H8n32AKoByuV1Vd3HOaT3XN1yACren64JCqZZCyNNRWa9Wu2fEH428nYjcqMCZQw +PuPyRNQsPnvU1fNHzmPEkA3UtVYwsKtFxnUmCfo30klOhzPTZrl4L1I7iQIcBBAB +CgAGBQJM1t6BAAoJEJrilv0C6fZbNrIQAIX1DqlW7CAI6irpaPq+l5s22nBolPce +MLMhHPgp/vB7JqV6wMDUc33aFDCkDuSFewDQKaf1BSaAQHWCxRfVSkgY/YqBx4vJ +xE24M9ljvH/PEDruCHAem5Aij7TWmPFTKGhV1h4Rt9CWWvSxZQaNFQgUxq+W7HwO +gIxugYiNz7NKt8mdzl/48S4rSf0mvsQ55Z2xM+GMrYMQqAcunIiLNGoaXk6z+B5k +Qmm8T9UnR8cegG6AxIvcFm23KahUWjIYfhLFa/Xeg4ddVwaeN6lhwLOwmzEh9qeg +gOTreZvh/5i7Wwk/LbnRElm/ejkj62p7sxE7RzRNGdWagTRbZO6rfEZQYNoWNnej +jjG0MP2YIXNMEZ8LmLF+r0RWJMzVoLHsTxSD7c4vSNjhERuPgG2XM/OsxX8KN/Zb +Eo/dn2I9vQ7Oa27E7hGvHGzlj+UR3yTdoSoao3gJs9GDqwdyRwFLALMzwRmp1z3r +/4CTowRsebJI9G/G1U+fGJig8RupFnSrh7vMRMsp5JHQ/+aC21UcJ1jk+6P76wJR +BCSYg5gLdMvkK8SxmPGbDD4PrQP2ZkqQjl+ivh9IXKnjle1QgnOWebRMV9LXc8dv +WfEawbavR8bmu9CHZeAqfHFSaflU3A82fX3d+3Pnvq/zQVddJRnUMFju2lxPgsFu +Skzw/eotq+xqiQIcBBABCgAGBQJM1wKOAAoJENIc0iPujg3VGS0QAJRIkubc5Uca +otfdf3fDQwoc8+hN1hMjV5spdQOl8W6dC3fskVoVL/OJ0rCXLFeCCciB2CrXdVMF +xNVDfLisYSY9pvKd+Oku9eMK1ncC/D7Sm3XXMHShAUqnCA/dFhIyY1LEDL03qqTW +PjmCXFO45jA0pGwlbpT92GVxOui8sUL/YFZQ1Z1mQTpiiZj/qsScivI8P++PMOqu +IzuXgK1qGhuHS+DnuxKo5xDvVvOfiPhLW0A0EcjmZ94hedCxCkN8JpzdGOnM/WEI +X1RNvUML4nqz3CK0CGQfzpttb7PmNDYprw8td99Z3rK79CA9CdhRA1sREnNxfeWd +L/+8EyBm6zHHNwA+kwMCFx8iDeDF86bcia0WQiOihFW23yT4J8XtzrNcMMdaduOy +f6MupTn6eNlsQDOCm1kLFffkCnrUStS8NB7yhOQhGfEJbllHeq3esgoA1ivSpp41 +mtDdrlE9m/MFilrrvv8VNAaTZqptqJIASRIE3b03SVskqcgzTId0V6AkpvzKArrS +2ratHqDE4Z3Kv5Mo69nq9iju+WvRF2dY2XY2z4otX82byFIsqP4kaKTuhfBXKwW9 +SCFWANj2wwbFtoOngjbLZPXS3d1tgVokPDpJfgGEEDgMIyyabN/BJ3By/EJn9GiA +m/UKO72aI4Hk/0RfGi+mYyJRO83Zrt/AtB5KaW0gSmFnaWVsc2tpIDxqaW1Aamlt +amFnLmNvbT6JAjcEEwEKACEFAkzSCNsCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgEC +F4AACgkQNOp25nkUhajI9hAAuSZHbMznyoM0ANPP2bTkkFwT9WkdB33Tdbs+5893 +sDnq59xT4Z80JcXzH3WFtQ76J4GYtU87DpGZUsYt8EZOo+rGUySGDOw7BbaNR9vq +pMrH2ZMJFAx1GsL22csHhXOiZNdvoL3Ns7k7ni3/dcJpVp5RUFgWyBUyybymAE0X +kv1ER8sPha/aZvbQg5Xr0pKKA+mU3G/1KEC0prVsb7j6U2BoZGfP/5Svk22ZrCqT +uImBXVNu+Mz+7LjZKnityc6ZTx2pFiJMPBI1XiXO40ix7ctyMM+QtKUPkSnGsJn3 +JPasomIL6SrDjAVHu1HdnqAYUWvjc038rj+/ntuvqoH7NYZDvA7sFcZjZyhSt2ci +46G9aCX7KZh7JH4pMG028E80jDofWSFxHxXVHo7ERBghKRhkjj1lAwdnrT3lTED7 +TX0oJbFwAT6h1+rjWJOOGlQpFPQ5+0LkcyTiq9790agphfm8RF4oVqTaCFdbltr6 +s1a6Va0H2z68Rp7wAs0jmjEZoMC9G06BsWqXb8/RwtsOhDfQqdevnEyk6ejecX+0 +YaA1Y7jVvfiho3nCHVBKO2UVpv3TpEShnVug/hl0oY9UZIsGe41JMp88CL2MJZt0 +HUvbSFOrNNdzSpi1jOaJ/UkWcC4kIUTUqwomD1hz8adqUUhR/dMWUXevHvdoF7lu +95iIRgQQEQoABgUCTNIJ/gAKCRCLOmAfCMl15R6vAJoCZeiA1glNhoaQIcQlzKBt +aSTN8wCgvfk6xZ1+PYU2b0pmBS14mg4DYHWJAhwEEAECAAYFAkzSwzMACgkQm7hj +sPUbuIpeChAAwxvkZYeJME3ox3WKbqYb54PeKKB+J9dSHQs3bvu2yWq0+pMUEmx6 +tdAPjP0VgGvjulfy2VrM4wUgBJ4CzPAM0KRsRiYE7C3cLQ2D3Uj35r4ws+UfkD4Z +DKoCMPKcfSOVFiv706JgJojIgaDJqYMn2b7y3HkA2yGuPQ0kWG9HxuOjdrbLB64y +ipkukAXFWcYskUcEgQfU19mmYHIKErjXPCc3AV2TCYdd6zgj3WpJ6aBd+dxJ456C +OvlIVx+AlCb0LhnQJtfU0B1lhSwU+eqbMN6ttkNgkxAtkBz7hAM7rQQvOAhrOhTn +FQakkqhOj1bEp1ofwi+EfPjv2162a149cavWCbsPnxvjlhbAkHq/upk+a9glSELP +7M9U4W04e/kFGQh3QaMxw829cc9tmysHxmKi79btfLNJMEzwzXhRsY1uoJ+MkCA9 +GIzOzFC+VzGcEPWXwFUszozj7wTTBwdd9FaF75pJ6SZ01cIrCv9agUnYHST62nYF +Kwy7gtBm9eVLSjUA2l/avp99GVexdKy+HfWVgOP/d90UZgX6gsnemB1C2u0LjNQr +cfm7+8EsgekJNZqOdQqqHwJYEV2BHu3YXNAlFYCvROd/+ffqLhbgH2QMD6zOhBZ8 +MCN0KjC+WrGsN1F3jfNN5iETymZu3icu+aSBO55czPQgcFa4JgPoKyqJAhwEEAEK +AAYFAkzW3oEACgkQmuKW/QLp9lvPvg/+J58Vek+EyGg3u7pACHDru4UilxwLcnUU +Ywip+xCWmyHYjVRxyenkUgHAu1O3yDuFNf2tKW4cFCZ8KVhpsOiz6EKQHHitwh5R +2vh7gT+4lcOJSiMOq5yrGvJlVdsqf6HjDielzPBS6ByVblqsl2GoiP6tw41nenYM +5jDWpvRnO53qp/bOmlAGP6ej8WJOtF2dlr1rDmz4+XGh7NqvytWYu2GLPKSx5PCA +7e+vdwEvuE1MdwJQ81izI/0HXL39jqw5fKUyci+cs07dTUrzXftm3qE0j6+H/y/1 +rK2QY7xqBsQUsGRV+tYSPFaahQFF+QxF+SfQRhjo2BXJkiw2Q8hcN9TKEzdY3Ngi +LH06G4nVOC4YmRIeMsdPfQSUQLPgpWfjzB9Twf3gNIyN78vfu4gB3AQlcpuAgGVe +4xAZwjrbUJVSVLa27C5ZS0vlU0Kl79KLRmj30UBt6DjrGrj4IZduzUyvJ2+L+hp/ +LzOEJIjyzdfpLhoLfeb/ceMY6OXt/lqLLSgdeU84uOdpQM82LvVfKUqkcJEribhS +N+CpV/1xsWmoDihCS79w7OsaJxmMu7a9ksxJsuKxmFABMOaZ4lhdU5T8NaYXCpuH +ti0aKFFWqdDu2sYUUAmMpj1pW+K2bFl4qwKUvsi8xbWlzBlR8vOtTJAnYEC1ErR4 +QieuW7Myj+eJAhwEEAEKAAYFAkzXAo4ACgkQ0hzSI+6ODdWmvxAAgrvSD8lIIVyp +NvKNWKXjIMLIlUqcH5I4SmKcixB6UL80j2+z17WT6wcvvgV54uM49yTa8KLpBBwB +d8a1WfsWyVQNZV7RiwSnl/WwNua/rv/krKlVmDvcKIcwgJiBTkc0jYcrMwKg07S3 +zla6mg/nhwlfNhdeKDLHG7CMNhNmLxmwTtoUfFMW8sxVATcX73eHBAhpHMDAbXzA +xVdyTS5i4eO7vXddBq2sKIEecXZ8r1eqNsCR0VhNEbh8o2bKwt3sZYqVdI/eaEiS +25sWzx+lCXKYycxOfBcQJKTle6NShTNa9bPq2cUiYJPZNAgd7lGdOoPYD5DqjIFL +z6TcqW4PWNjnZkiamyue9lbI99whCUkemnRDM+tIS/0N76FN7ROom9Sxm5+vL6Ei +B5TXJe7gK4/CanENhSPO5h2MtD5EiFV+ALv6eQzjG+VuBh7GfZPR1wX2hhOkhbBd +p0aQITE5X8EfkLbYwvDCkKFVXknc+XfbAqczCoLIT+MC+TQPVRwiZoOhjA7Oh0mn +Q9keDiWfkMpMFDeu6+l3Im2xYDNzCTdSPlGLOZt15tUIonw55gOf88ScMPP7ri2A +cGxHP6fpgB8KRqjiMrEkuqDWJ26Q6/4K4CxMt4zC7F0PZNDjsJfMFrgBBOnGeEzZ +3uwBU/OPixA2toAFaryvY84tEFOAqCS5Ag0ETNII5QEQAO1cyflVhAw/kl1NI9ZS +GfcFmulOt9hM6PyKihstoppuLWdMWZ2OY7ZEnS2Ots6kkZ4GY4ak/p19sDHlC6O4 +x/dlYMLcbd8kpIE0naTshCRCuPPVwiiXCtlp6odemYpxgDgGCnEJ7NaW4AeauNUN +R2VrTS76htpuMvgGydqmZ7RHGtwTRp9QYniRkvoO3Yf06E0YSpFv9r729h7gE26y +bjCzlKHqYek5GgWlD2zeW9Dj/6y792sasQ0mYbp1Z4hR7/jFXfXq5LgTJUUDypRY +Emzg34nnRYwRtRsi0+Gahpfxzph3Pw2r/OSrNV6N9/1mtN2pB1UpwxbrFgSw6A/W +6004LXX0OR5ZazKYgwpmiQqF1hYjIijQr6ej4Kzk+lHglz+F78U4Oa1XVlpX52lS +7Cxze2pKhg44TybpzeivmvPPuC5kY6SBk+JFWi+YOR79CaJG2fH74DIJJsqoBeHU +FsS/IyFs7aO348ySyz7AUgn/yUopH/B1re6fMqtfxJez6ZFn0ZUbB5oZg4F4sPBz +YJLPhmqItqTISaaUGVoiD3GLxEVV9DeqWevsWmt+RlnyV+R6OZuZ1YR6usYNLbEU +1PY5VgAjgri+/GS6ujwXDbo78kZU/RVqTA6f2Ns19Zmcyw/P2zdCLy691gm7Fzke ++zGrreMscTP7mcPz7LlhtI0BABEBAAGJAh8EGAEKAAkFAkzSCOUCGwwACgkQNOp2 +5nkUhaj0ARAApkyrWmGDwiUC4Y/0vzjH18pJt/MlPv+4YC9YtW0hgqjWrWzaWh4H +LP1CkQUUAzZHm6x9bM/AKq1y4j7uSoeH5kFrZJxIM3ikzbw5MI+ZjWlGjGjaaVRL +rrD3i06P3FrQvpvNSfs7imggenLVgiVSaumzIHVN2VDLjQycUTXlYInyXJZuTdMl +5SWrHdBxKmaWXp0HTbuKDEDRDj6IQUaf+FaV/y2nSZl+XmjLaq+1SRDATVWlASaJ +/YDSU0JVtp4IMtpzifhiP/AdgCx87/QpwT6zNfX4WHEF01scSjfC2ahl1+sH5S+s +h+fDQd7ApuWCVfkRKJ2/tn05jg5qkSSxp4hRCYDr3eDdhYMzatFzKulfFhusWBPt +SuqYp2B3KM7Gs/cjJ9gE79TDcSIdT2tQxr1iR6aWbFP5tgijUjcOV3i/GQqZGRz3 +FHA26GvRHR9X4WOcxE7XfaCRbDcRBBOqiHWLI7pOzPPreoTeRWzUkZXEjhr0lyVP +TC/AHoAenOjlxy1V+NEahyBQCT+WgLMgA+Kr0dZBLAz1E7U7FAcjOlLeNKSFaUMi +G38f7S/D8UVWuHHd/G5skc1KIMHL/jnTS6q9o97SfmqmVZ24pKHKF0lM6UM2rRz8 +E/274DCVg+wK/pQiWn9O1zQQRh9KIJACgd71jF6z4RMaRUcvpYYaywc= +=qdRu +-----END PGP PUBLIC KEY BLOCK----- +pub 4096R/6D5954FA 2009-11-17 + Key fingerprint = 65B2 D44F E74B D5E3 DE3A C3F0 8278 1DE4 6D59 54FA +uid Eric Covener +sig 3 6D5954FA 2012-03-25 Eric Covener +sig 62B2963F 2010-11-04 Dan Poirier +sig 7C408737 2010-11-04 Joseph Edward Bergmark (CODE SIGNING KEY) +sig 02E9F65B 2010-11-04 Luc Maisonobe +sig D01E0E18 2010-11-16 Jean-Sebastien Delfino +sig 08C975E5 2010-11-04 Jim Jagielski +sig F2F27A06 2010-12-30 Carsten Ziegeler (CODE SIGNING KEY) +sig 4DCAA88F 2010-11-04 Thomas Dudziak (CODE SIGNING KEY) +sig 1824BDC1 2010-11-11 Brett Porter (Release Signing Key) +sig 82A7FBCD 2010-11-04 Antoine Levy-Lambert (CODE SIGNING KEY) +sig 7C408737 2010-11-04 Joseph Edward Bergmark (CODE SIGNING KEY) +sig 791485A8 2010-11-04 Jim Jagielski (Release Signing Key) +sig F51BB88A 2010-11-04 Sander Temme +sig D84E41AE 2010-11-04 Nick Burch +uid Eric Covener +sig 3 6D5954FA 2012-03-25 Eric Covener +sub 4096R/2B4C4B38 2009-11-17 +sig 6D5954FA 2009-11-17 Eric Covener + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.11 (GNU/Linux) + +mQINBEsCKnYBEACb/ldlhkVPPopZa4HvQhckhpQCQBE105N6Q7IPpzq9djl4K9QH +TVSOvnhTd0s3J+7bB08jsYbaN2xMLLLZxjGW+EsQppXIsrY6K0m/aJfAb7MtdgoM +a/r9G5r04hQtRcc4ivMVHnFemM0A2sls56wUwVI9OHC2BPwBSoacTwSFOwwV4mSB +XivBkRPfIFVk8iaH3G4Zc8/KxgoPXJxX6rQ3AZxx0ad7hh6FKGgNxgOKNTwkQoZn +hj7edM0KlSkzQ8O9asRx27H/8Vv5oRP8tsy0VYSR/FPzny3cJfOhyw3px/mZSOhq +loAOLtTqBkvyTC+888rfMJDlozWEKqNeallzTTBQ38Y6iSskNMihpp6RXAiStrYO +oO/OlqBuSxXvplI3EWilIvEkzpzyWt/uiQnmclGSU6uhLMKby96QpfWOQaa9CIJQ +liMth7eisGKci4z7lom0q//fPQpbKIqk0bhFZeQeld01Ozy+s0rhZA1CD0P/e4yk +0nQVPPMih9wiYKvdr8lO+cLSt7Ugme1JX0l5jP3JyomiLPNEfyeWGpwO8d4YSSoF +UVJctLKBw1UR3rCwladOcf1iriqtwOfpy3wPtrxByxU4jBIR0stcpIhkMs1Qfde0 +RT6POBpPlNrGBoiOXwAAQv8zqy/z7yiTDhYTvWqSx/J5rpkKdxvvg6l/KwARAQAB +tCFFcmljIENvdmVuZXIgPGNvdmVuZXJAYXBhY2hlLm9yZz6JAjoEEwEKACQCGwMF +CwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAk9vLA0CGQEACgkQgngd5G1ZVPoe8A// +bxCqDeTMU5SGPVOGQHW7NHXUyc8CsxNPB8rHlyMiaU5UwvB7+uM7EWprJvpBqRQ/ +9rRIFfhFndKmbAjIjNbGNQjk6oTQo9kE2RE7XiOjWMAN86g1SrhwNrGkrxqH47n/ +NRiMvaN4VMkONJzwCPSAe6ek2p8stl66wquZZf4+H/fkwmH4aDQ0SSCv98HyI1xk +xbjbKDgtBS2XMZzjYFtjP1+2goPCdcaLGo2knU/NI1x/yu7I3WBu1gqvNd20jplS +3z3ROwUxs9T/ejsF5Zh+SkDOd8tyr2RwDUDuqVx1DLhuAXcTHzo2Lk9vnieJjzHx +pnMMvP4g88edXYKa6GSwUbGM/cPJVzoOkFnemb1iEABN2v0fgIUXNnIWCESZiLMA +Dac1wKI3xr7wo0q7G0s+8n0LF5mxDU7/tQXlxj5FvocfHKtygNwlar3c/DAH3q2Q +bDjsmPC0CMnOs7dAaRxYSZUk9EqMmXMQguBDsA8rP82ygxBctDxeY5X9dB1bfZVN +loUcPhOQm8QmQwiNHEJ52bDmM6NGigR8mR9Z8sNK8f263YHFAzfRLNVtuFEDuQNr +B+ThWttBshtLivEGiKUOHTemg34H55O4QE0JPGYKfNjY8CagkefTfdv1rhwT8JF6 +n4KJrcF7DuKn4/5yw0fic6222v3nkhw7XZZg3iD0r96JAn0EEAECAGcFAkzSvhUh +HERhbiBQb2lyaWVyIDxwb2lyaWVyQGFwYWNoZS5vcmc+IBxEYW4gUG9pcmllciA8 +cG9pcmllckBwb2JveC5jb20+HRxEYW4gUG9pcmllciA8ZGFuQHBvaXJpZXIudXM+ +AAoJEJz6KwFispY/oR4P/Rc1LC0eZ5u72JN+ttH49FVZvbmJa53C5377m2BRThdp +K18H/soJdMADXN+pJQrdtOI5Ue0c5OtB9k6sCt6TN+/6mFH2Jepm99GQwBbuhfBw +viOQjCi/tpLeYLPF4tOiSUQycTuDeopnS0zWRmXP0nllZN13UzwVf3/Zdzit9S2y +/NyalyNp2n2Ec57guRxXpwx8JxK0eUveBV+5lGkXIcaLHohujdtnBISiJy1gPfNk +xbVkeeLjw19pxCzjbQEvCWtQ5/+nn01U2CVO6z7sE+cVS4PzgnudADKlR04jgNno +FXtCLaDg4oO3aZdZrHgOA7aGWmDsgzlcI7ZHuf1wQrVCnMyBkyp26U577jsfmeC0 +yPJarc0fABbVv5faMy7BJ77OjpglgjxYm0Arg7rUBDsb8WkjthSSQC/GdqzmE1t6 +eBxeTFoROZbZX2XAZjNSCRQBBD0aHUmw4VA+tUPSGvbh+J1nfg4FhUOhiOCCrDQR +duKDZ2Wr2j+nQ+BK6RfS3rk7rZletqb2GCGnc/FM9PY5lwoFhztOu/RVrzGqpi2C +oIVWxxpxZ7XY3RnLyV9WlTirz7EoI7eO7N057VdAhc+9KSxBy9Nte+CiFhGkRS4q +wcOGrdlqW39+tMAQOdMltU7rPwzVKMaZRRRKOyp/4MORuk4Qo4gyRBadEsnc+uS4 +iQJdBBABAgBHBQJM0terQBxKb3NlcGggRWR3YXJkIEJlcmdtYXJrIChDT0RFIFNJ +R05JTkcgS0VZKSA8YmVyZ21hcmtAYXBhY2hlLm9yZz4ACgkQsNmRtHxAhzeb3g/9 +Eix4HD4Jzb95gAbKLzoYgks/Ql+PJpYFdx+kbJ1gmgU3uuKPpaVZIZUIxw9nfk8M +N4zqZkdjreUlGbfPlxQUN4lxIDoQyv6PMmVc0pxy1KZ899/yrhuzsTXadzIvrbyP +vrWkEUFuawhuaIqU8Fy9Mw6PNlOznkaZsnqYoXD71LVTkv/k1msnGH79YPqfmdTk +D/JgtV+nXCxVChNmBzHTMccV4n/WKPJZNCgDVXHpkuC4IxYDwds6TfMXR3KMACCn +FSFnRGOJJhhwHjbK3ilsX4+raICeJd/gSuBTGkIlJ5jewYvngRwM6jr0zs2Nf7xb +Ypx1pQYh8emkiy13bCgYm+xmIBEg1pnkk0wlqZ2pxH6Qv42PVubsm6CNFVeOGdnS +SuYr5ulhuSTaG5iK2cddDadZscv/M2zySwORVMkJo3QLT8fp+3Vl9qd+MnnmOR+i +UtO+ZDTLx4pLSE4tOk26PIG0SJALAUZHX7OviUykOZvKzMBUwg5TUnoBdyXupd+C +L2GnPjZvmFLaZthKt/2WPK+bAxT5530dAjcGOJYdd881SuCUTy4IF9+qw2WrsKJa +TNRZtPKlhtybaF2ylTpVkH5SJntm43mXuldcHbMyf/ZaAW1e+5pQiHdKyw4ZNkWw +nla4zFjkFOeLRvmX2om7L12oc+OaW16HM9UZxhe1ymaJAhwEEAEKAAYFAkzSngYA +CgkQmuKW/QLp9lt72Q//coD/XlxKxYC4z2/b6iALiAoM1IUHbrIf7D9v5MFfjU/D +iEl7wRtsvCsTPGYELs5sbh2QUcgu/FTD4UhMS2e1oO4NUfB4n7wjz2/g16IRR1dE +6U6M6xpsgMA1y+MtrMOVShjcQPwTleFvlnPq0KRSemtqoZ3f3r+l7Zg+KxCxIUCi +r5TP4HBO1vYIPIkNnnxcumVqU5qs6QUuZbfCsAQjd5b0UksiOrgxNM9TgZVBrd2o +s+hS9osarxtDVpMlcDjtQf5+hyMEm6Ao4pCxyua/sTNFEH+BxmVYHgDaSompVNUE +vAkYDcuJAUPbjU+BHnokhx/h0eQDROjgl96VNA2EyBKPuClrdPslxQeK8IcD4rHO +SWMjtxPTw8dT2JSJGfUPYpQ7d9qYraJaESu+rzpFQhVzTnFSdqsnlqtzjoXRfNe+ +aMEt6fgvm36lzfsgLWfrsGUdQJ6cma2+B5osI3vB3PQUZ/0HGoEW1nQM/3RUsnb2 +95dB3A3bzhJDrtGthhg84ztxBnj9WnVllb8CXPpTLJmS1ZWeqgdpIX4lkSYdS1OL +CvJWIYurZ4TC0EKFQ3nScnU0tXLsS9cnjpqQVH5cZU8kZU8cOIlmG9GhYqQjGGPz +BsBXJ/NcGCJLgYmK6ks6btdvPrOeez6G3HNQPI6e6i0X+n5XGWBUkHdv7FL1mSCI +dQQQEQIANQUCTOJSoi4cSmVhbi1TZWJhc3RpZW4gRGVsZmlubyA8anNkZWxmaW5v +QGFwYWNoZS5vcmc+AAoJEKR9Hi3QHg4YtswAoIj238Jwspzp1VJ6jdF03OTym+uT +AJ4+G5xZO8b00Yjnfx0YSyjFvOiCzIjKBBARAgCKBQJM0rRDHxxKaW0gSmFnaWVs +c2tpIDxqaW1AYXBhY2hlLm9yZz4gHEppbSBKYWdpZWxza2kgPGppbUBqYWd1TkVU +LmNvbT4fHEppbSBKYWdpZWxza2kgPGppbUBqaW1qYWcuY29tPiIcSmltIEphZ2ll +bHNraSA8amltakBjb3ZhbGVudC5uZXQ+AAoJEIs6YB8IyXXlqTcAnRUlfUyIBr5K +sisrAkeThmeA7gCXAKDo/DLtoAHtda8clNwhnsXxfUJ3U4kCHAQQAQoABgUCTRxN +tgAKCRA/z1Kf8vJ6BnX9D/0cenA1sQ8jbmjEWOlp4G6mwuHlorD2UVWf/vpJjdbk +HTQXPwdN7UtQiDlB6BMynKOoJzzbp9W8x3tBHgUL63LoehMtmUDzmy519quSIpzY +S21SHPn1WukZSK3Q26gmNbr5spxeDJJsy9jPMLDiHbM7CVmjEyh+e0ms7L1nqXdo +i7d/wBVakfor3MLnrGrpqWHCMnjRHgEKUSOQ3f/aH0kMIzo4G7+7i9/E/F5n64qL +wGFB7odaOIUIRMiqGGUTQ5FWtNrUP3PZiUyYlyd2wK3uBVJf9eS4/6o6vGQ+VFRu +h8L78OMsqEnDl0Fc+y2Nw0s0P3u2KBwvjnWerG8QDDs1SYsohhG6SDZiwT/4/ubQ +8WaYptTZ77TgDdYKd+0Z5of0l816QIl1LX+nNcq7kVRnRbvz+chUecbe/7/cslka +hx0MlwCRUAaxVEbUTaysRffsF54qneagDGHb4L3VqAN0iTKxbWVnRtemb7/wYNlU +ri1NrYTY304oNHkCYdiByeddOBmGBb/pYRYaoXve8O2upaGCaWWwvBVjLtGgAScf +dhuJxaLZ6zu0AWPKs6alqX7SAmYsY35NjvY4JZINM8JWdeMUyj3A2O0CpQGPIoso +YNJM1I05ivDaakLpTjhX0bhxiYyxlgBQ/kRChKpmX6fPOvXu5LaMBb3EwUxq8Mld +sokCUgQQAQIAPAUCTNLNqDUcVGhvbWFzIER1ZHppYWsgKENPREUgU0lHTklORyBL +RVkpIDx0b21kekBhcGFjaGUub3JnPgAKCRDqTcrcTcqojxaSD/0V9cRKcomCfYr4 +8yPBt4TbOet0w9Rhq4sdwrRyisJEO+nRnTIwXTZ3WIDYhm2aISKODFa4RHedoxj9 +hdRbDAJuRIA+o9/MHlaA1MMVMUSWp4AoPh2ESqvq/krtrrbTXHa9xgQkL9B0uY5A +amYf1Fqe2F00LpqlF4meDPQBSqH9AZtQhf6omRqoWy0jZk0EcgqaxpDBROke+aqi +S1f78N2asNR2wkHsh2NOhEiSd3rsypHvm8DgrVBdUjn8+Tqs6qEKChC8FfRmScek +H9+P1grd6rly9L6zcl1N4PAz2Om7jbwCgUfWoK7gZ9Cj9DJ/+H7NMhlh6ap6BBaW +ZVduCZtGzTYxuJp4hSZOFi/BdzJG5BToIq0EUaRQbySTNGBOsZvP1u2zB4BH6D7T +PxSztSRMkPcA7wyE3cqH8zxWofmxwIDUqgCb9/2fy+JAwUSvEV3fxXum3SB3rY2u +7AY4s9LJkFuBWA/MmZbcfSTwtTpmPXUr54uLyDtRejO/aRCrleKZ0ZcZ7v69HPqh +9RdNHyepaJBjWoo5yRS7qiy9yE3h22TeZcBLMe4Fm2m39LisHYNx5+w9ihgfeYtb +wEePnRM0ZIf95Tn0VZo8XOZ5SHRJMDj5j9oHNxI0Qa+eLhhoXmcVsqNUaUnPYthY +Nw8fd7ke/aoOubOC8ZabJKGdlGE2XIkCUwQQAQIAPQUCTNttQTYcQnJldHQgUG9y +dGVyIChSZWxlYXNlIFNpZ25pbmcgS2V5KSA8YnJldHRAYXBhY2hlLm9yZz4ACgkQ +4TYIihgkvcE+DBAAjiH/wW/C6Fj0fTUqKJGTCqdShYWudeJ84NCvnCwKGsBqk0Kn +xzd4I5yhdf0YKTIuGk43KL+MsW+EkGQisQ5/zkufuhJAT20kOQ0cwEH9Z1GCmkfx +Jtb2gH2dK3FAWbYLUCHxvko7XOerEaaJQu2P5xqct7Y21kpPGvNYlqnQh66iAp1E +HmtkMHs6nfbCR562aDB8KhvPlC0DWjoKN0ll2+xCSfORY1aavWpiAmRFk+0Arrsn +BgrZz0xpfVOZe/aq+dPFoJbyZya0XJ8SyRQl1yx3L9IkwO1LiTEVLLIlANSQZp9t +e+PC3eE2Iim4gg9fi6vfSjYf1NMOrM8p/S5wSwmrSxV7iMG20L7iEMvyEkknaxfJ +K7cRRb2sB9/ddRc1sPtJ1c5V1FVvbwcYB8xN7jeJOr5oR1DMoM08OQZEnwQLGdQG +sJoJFny2nAUUjziNDDgREmm+nHscd65eABtxMABUxpOA++uSl4pzvQnCKc5r9/+/ +vReW442HBAucVUC7Lu9CgWz4g0qrB8A0nl9ZPcznNJ/gED2GHgSq7w+U4Z2OVOn6 +ah4p7FPrragEy2DHHQPGJb9KbuQP6RiEJCslIgnQV9BxxeuBSdvKpBPuAEhZl17k +7Jak1NUgxIXPWYsC4CcsL1q7f9FUnq284L2ZyUFLGo8a8FyfMpJbxO5wUkSJAloE +EAECAEQFAkzSuNg9HEFudG9pbmUgTGV2eS1MYW1iZXJ0IChDT0RFIFNJR05JTkcg +S0VZKSA8YW50b2luZUBhcGFjaGUub3JnPgAKCRBe+tn+gqf7zYl7EACWU2qLqTP8 +dCreA2aJHlWjFIaIuNwlOZ+fytsAlKjSdTFoul+PxIBk28+flEZPFooYmpzyEJxL +s605m5gX2N5QQMjEGGHs5dNQ5EzT7mn+y+lLvQCAWvuP9F6OkxvsK+VOEK7B1eDl +I4+xw8NvTJonOidAVtrw3398RDb1e4WiU8WiReRGzsyUDU8MzvODslTnqY1dgwaA +xaGvbNcGSSpcDOD3BdY9iEXm4x0p8y4SamP9aBSQfo2szO+gRO4T7RRmjlC6urqP +XVQWl0tdqG7zd19i+Mvjo9gqxCZVaqzl/sO4jRP7ZbgBIk4eIkm+fZ8qwVYXpYjA +AKToQZvPnft7hHf5q90oC5CJh+1U7y4V9BJuMebrkHeo4I1cIoCTbz49vH0r4rmj +v8oNVlINlqgWcqzjUp5nQf9n2kyDBCRuj0oiKOuqPyriTf5MyrdXSs1V8Ib8v/Ko +GwHtc2/PiSjZ3h6r9TNIgxCTTYzTEUk55l8ap1+1WekEwUa+zdKe2ShZcRXFgJ+v +3m8PNeECSOwI4SmjPJWB63CJuej9QT6cQ1gIN/T7PD3WOc4btSipaiT4dYgIhFbQ +FlTwRgQ2+XBlpzRczvNczvQMvySFPYwDzQqvHKcXilBf2YKbF5hGWSgDXQLdGyKT +LukuB0YfzxrXYkIoIyuZIQ84Z58qXaEAYokCXQQQAQIARwUCTNLRrUAcSm9zZXBo +IEVkd2FyZCBCZXJnbWFyayAoQ09ERSBTSUdOSU5HIEtFWSkgPGJlcmdtYXJrQGFw +YWNoZS5vcmc+AAoJELDZkbR8QIc3nMAP/jav4fF573xHr4c2jT/Iujt82+s/lefd +Pw1GOwHaDrEB4bL0AlC+MnHCR8T6HkoXJRFIzUzfyrA/hyjzlfXLn/RvfSMFkvoF +tpPzjT5QC2DcagF9Yz7YfaPK78VcKIpmqCP1j4FT4kJMsOMKOpi0Bw0zJEDIxJPL +ByIf6V9bWelkk/IepTxM1dfwSzzM9F9nq8hsmp5daUDsnehTscoomrv4CU8tJ8+V +uDRoWMZi4FECMoxWrZpwhj4dD2Ocgep7fPN9Q1pHf0Wn1Sdbzywin9rBL98UEH2V +BDv6fli2QlyU9zbww62LcTdR8SjlE5fVTt4CUBDnBm3PEIPVkbBeDXriQunVwVNm +afZPbvfLZ3IEUoVfk7Pho6ivwRelb1u70eyP0zudWb8q8G5Qquhb1rq6Ib5SM0XS +D5knEIJQLAEBbbul+SqBW/lcaLLp29mquK1Ci5xC+bBWaY4Yn8x/8Zc0RiJPX16M +uYAaHj/sgJW4nI/BrqftKcFsB7tYFvRE1NBMGIFepq5NcZfWhWbYYglRJOc7TSx2 +jZksSMdfcMEy3nUEn8jnjge+tmKi4gE7KqLMhoD0y1u2dJ9dHshMi5IcM8SsNJNN +fqxBzOI61aS3wxNTOtDA33/6c0Mz8D6CkftRDPlEqa0JyHJdVXIJHk1tCcshEMBX +jEhmJrv0Ty5aiQKTBBABAgB9BQJM0rQoNRxKaW0gSmFnaWVsc2tpIChSZWxlYXNl +IFNpZ25pbmcgS2V5KSA8amltQGFwYWNoZS5vcmc+IBxKaW0gSmFnaWVsc2tpIDxq +aW1AamFndU5FVC5jb20+HxxKaW0gSmFnaWVsc2tpIDxqaW1AamltamFnLmNvbT4A +CgkQNOp25nkUhag2xQ/8D8Rt8++/KUdrXTeM5ID0HZ0FAUe9DNarE6XAT/EWt3Ch +4leZCX3gAbH/Fw1/G/txURqmcwH8/U54QHvJJA0GDHigeealRawZbTYXMzwmscBq +x1on5ztGD+IHWlNaY+oBlvLX6QEIMWBXaywrSNM8fru6Rc5yOs7K3yHgRRWn4t4X +iuMR0eEJRkDD/rJ07yvg0KamtApvK49k+qiPjKU3optLNIlGV5pP+vSSqxWD0Dsp +XEUAlpgTlhHyajHflFCubdaW+IXJuw2ux9JO6dCNJh0Uoylm6/udrUm97196Tq6a +AjZi61ClCGpTg0yGNokvCgRDbrFt4W1TtGwH/iJ0tJq2PDNUm4ATaORlE29q8XmI +g/wi/77pf96XMgQ4F+HOIilS0FGxszBXHoxzYDUmkUB1vVNJvIL29/HjPSFbCZWP +GFlBulwSw1YNRIxa/msV95WdvygbauaR40Rpy3VeOZKUm7JR+wPbbq5XHK1SK0rQ +mCllPwM7FqSgk3Lqs5/DrNFlXtUuk/3ZP3fTJ4MRGgRWktjmwb342imeqi740bA4 +i8oBuQcTpHWmHfEBnQvvYVTqHNbXLL5lmA2TbR7aSQWCiXmw8wk79MNWmwbTU/8R +TzaRdDFwDkAhhbk3ETqe2mh9oZgaZk+ZdmpakJ4jCN71NcKKrar3G8tyI5/aRRmJ +AqkEEAECAJMFAkzS47EgHFNhbmRlciBUZW1tZSA8c2FuZGVyQHRlbW1lLm5ldD4i +HFNhbmRlciBUZW1tZSA8c2N0ZW1tZUBhcGFjaGUub3JnPh0cU2FuZGVyIFRlbW1l +IDxzYW5kZXJAbWUuY29tPiocU2FuZGVyIFRlbW1lIDxzY3RlbW1lQGtleXNpbnRo +ZWNsb3VkLmNvbT4ACgkQm7hjsPUbuIobZA//c9PVF5LXRY1WtK7R9lM3e2nSdr7z +/A5Cj4REWOTjPRMXo515XNmb0od3reGRv2yDtXfyvyjoYA6FU7y64INBWyLWPZMW +5glKEwn9ILVxdD4z3XIJFy+XNPVIRZ1QJRrcMh7B7P4eTPQDPRKdh6xyitYsfYhq +UKX/YQ2lrxqmwEPd1KMGW77rjctHJxF93YNiqvr0O9fYF1jeKHa4w+wjcNbCuiej +AQoV6LbeggUtyk3xZWobPLQt1Lr3JG58le5TUjAXyWPdakTGwRRx8NXUmJ7ciwLA +XUaq3jNMkunQ49JHgY89d3if4yhUyko4Im8I0FE1eV6YFK1aaPv+e4OUCgyGeexw +MTyNl/b6fnllbtupBM8sTE/a/6LbOrcnieSD+qe2WLptU+E+HO8S4NUUahChtvtG +bgQOv8Z9xqCQUvFTxUl6P7i2u+goXSnmhT8AjoaqcysTPGFPHY14C6hJFIGZ3Pt7 +hOpcX6/weF1bF79GLbn48SVpEzafMnxIjwNfxbJ/MWKZtsubwfEORycasiqx6PfT +R46ILZlQVWK16w3rzkz+wZAsIof48vdT4/6dYHh+fPxlb3hKQoXQv4x/QPPIaH6v +2N6HH2GYnt5j6lg/+Sm/DaGZ1YQAmo8UVDwrkSWDK7OfLd4A5IE7dMsk9CvXD3NZ +qHk1jGlPs7/Oi6iJBBwEEAEIAAYFAkzS9KQACgkQiq+I1thOQa6thx//W1V4IxcK +WJSWGsaxHSCCYCxkye2uUvPYfZq/i+sHVVdMJQDTE1sC2dnblXlXRlSnHma/0v8+ +EQ9CgnG0PHFFqVJIYsK8JFer+lyNTFtGvSnjnKd8VXkbShoLTrmUeCyuWI1egdI9 +xsj1pK0hOnG8QvjkPrDsI0faW9N5sobRCmPfgcibFEqAvJDkAnM6p61ZbDtIby6O +m/5J7gGMD0bTY0S2qChaUDXslcZtX+1gnz8HQr+buciH9nmJcyB+rzo0RdVO6WRx +jdZDOpQ/70fTCL6b2G1ge0qMbrxoryqyxBOEDx3a1S0BWjp/6LxKtuwGLEQk6pBQ +jjmxihyk7Djk2uwq6q+gsgwoaReHAvxg27lNYoIKtJfrysNxBjCqGpP76e4Azltz +YUkabobTXart5pLUS742ow8e4z0P2hOjaylWnd/8fJbpzQ5/y5tPUEkgFqywwnap +sbvNiUKUP2D05hFIbgo+16KUSqA0pPElvsY/yng0hRRm/tirT7qFd2gWCLKUpZVZ +WZ27QTjdykS/0yeGM9tSLMca6YSdmA5J3ja8vimEKyjgyFYKVklSdZT1rmctKaBJ +3+QKHz1Af8pfwMVxROfyxDTZIhyAi4JU9gQvBzkV9ZDLATydBopl1jM0zaclKrpe +l+iicq6jnpmQ8A6Vc2uf0qTJnASY/wrM0YasfB0DA+VSHH6Dz4mHUoTowlkEiRh5 +rCOz7DnginbiKtrfFbBim8XaLhmW03TMgIy/bHbMDdM07JAK948/l3m0O4x3Wudf +V86Nv6yhCq8VgMSR367KYIdoSrUMmuY8+FZuWBcF/6UvNRMXR6XDNMG0LqJgXMLL +cCwcEIHMDJe1iZnG0WmYAUBcIZpIUOrRpc7OyRbX0+QzpFPsvWoXJJVSShHbKs5p +0xxigsJFgphBktkXHu8KfOfj1Xv/6zXFxA3MJY7qFsVFostJfV3uF41CeRvUkycU +smTFT7/1TK4jk8JAeAQHcEtcAQsCNYCVuL6nByp/XiBX80lvGSLwxGbtiJmJpxgv +IpQoEj7txxxculijvk1eBwUQOBAoZOH3h0Mm1e/qf11bxa6Kpwky7PNFl5pmdwrV +TbGj2Zdz41T7D9w6gaRk3llvyI9TfPRVF7ZPKdW+tBYHISXzBGG6P9Vc4WTrM+s6 +ZFlomdmunNJ+67T0tBDNdOI8ezBoCnHxzDHvrQyxxCcyE8BIQ6yJP4DdcL+NuQgB +oml3bu+esIx2iuMgAxNzJsuNWdyTO6lk7Yq2EGsaDHxpn+zOeV1wPy70C9LZLZnS +OpNdD2+NmULShTVEEox2wsAjWew+JHOt/5+fi+kvLQyhVOGKLz25+ZUo0IaDV6zf +hNboMC8xAWlIirQiRXJpYyBDb3ZlbmVyIDxlY292ZW5lckB1cy5pYm0uY29tPokC +NwQTAQoAIQUCT28rmAIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRCCeB3k +bVlU+v0rEACK5ekMAENEslmKQIpY45mE9j6MQ7Ppx760fiCamutk3+HnaEap1i3H +5K6zwsnEtJzp187N3mfHrJsT85bpATHh0ODj+mR9OhmaI4fdHeUpSXXPLBrxTo2l +C5ucvJ1v8QWyyuYPruSoGJdjecOHjEovPKM1b7gXVqkgUMhY3PTgM5MdfMbhSVfN +4Y50dOALkMaHloseOLHG+xN88i/G2CoKfp0lFCo2Y6RLSp6y7nRAt9wcCvS8raDc +pdEMogRRm02krAjJKqxUvL20VqtDDeJ/v2wHcDAvOd8wREM0laNhq8BT7Gh8poEG +dZDERFR6DIdvEfd/++vt4xujI9WTjIPOjyGIPS5QxGKSrf+6AWy7zAJOgEHgfY0E +pWgL+4FXmjYASe3esdt+QUiPHXIk3TBEzcGZdkbI+K1A8zLiGNkhtsw9s3JdZJEz +N6ZOMQQ3Ph2DoVtsdhVZPkg3muVHO1XbwmT//bJvCaD5rWQ7lqDwikBHhL8DmTwj +dvIbgqsy4VGq49ZHd4QcDCKE+Cjopo7bcayyTPLnf4Qg3IUg5hTy2LQJ4Ynf9Vu5 +CHNF21zhduwzOXOi9Or73tlD9EbvvwijFE2fRRG8Qqw6At6IpAuP2LXfRGPWnA9q +emZKR6HPPX4hXHQC8jgz6HnAambfkyq5jmLdz42KDgIO8vQtqqQqdLkCDQRLAip2 +ARAA4qluKGH1/ETwJSLmGjH6+sGx43kwSlK/EczWFNpLdfsjbTtIFlQbaRtm2A7L +IJOr/Sircp0+Av9gZuT7HPp2NcvgS1FKWhqAFoi/2Ijis4j/NjcYZHtF/A7Dgm9C +UB+kVMq1ekICClaBcs7LrY73XQLdCrF5y7A4RPmUj9s0Ma89TPw1lzYN+9nhKkhe +IJogkDj/qLAwO0qwWHLJ/blIYTLMUHc/wE0w7Vx2elNoY/9m3rKtpGKl0y/cVTUi +ZEdk3uiXRDCcksoFV8CYw4JvfY1HkYBf3S0M5WCUJPme+zjOo1eQxiCRMcBwNP34 +ZhE01/8+iBGNNOW3fjQA7DQsAgiOeTkpSg4ntv2W7VQQIUz23M/pmZcsd6+N2+89 +lzooSwPC2wTn39nkKmzMQ8NunpKg+5fA1TLpndghBaJH75XT/KZSlGvThwXYVwni +wdFIZORzgM4ZNh7vsEGH96KSZ+xaA0uF9VWxYCAGCZPkxrevhxF1lUyAmr5ByOCK +D5FDUuLoUO8102Ka7/fsRSnZbwwzIEqPdJgnnKIwSTcFQm6KnMovvK/51k1HJpoE +Gj3TJqIJrGrxlTEk0czQG6dn717cNiRjXaNWfJRvEEEALpXaPQ1PJlXnbISACEf6 +ugJ40xxGJg64X6zl/SuqrjDfnv53iQxxv2vY5Xk8sPg3LyMAEQEAAYkCHwQYAQoA +CQUCSwIqdgIbDAAKCRCCeB3kbVlU+n9LD/0byiox8rw+vXwUd4IjWh/i5WRms08Y +eaoHXz2VAIjnwj+tYx97ANRdmmHzYMXilnmO2SgEg/Gz+xNvwRUcyG1jMagTNarg +j1CeNjBZpHrxV1XWlfH+82TbwJAay+vEQlNvyESGT3GF+8FtdNUz3fK3okWqUyC4 +aDDSUAwXvdF8L/HduaO7IO/yyPE/mo7cK/ziIiVLM/ypMTLmkKmVxzHEN973xp1h +vsKgdjcY7NKegHiLrdAGonV+re+Oed5y2GKp0pvX8K+p2ClGieYL1dOzH0bS72jW +5QVfLO7tvMuutff4dXY9x7vaFyXxJTkQeO89wOU6zIydnaTo/MbLKaoJXZzJXrJj +JlXcECrN9LBLOFADMsi46TraoC4uTJ0hqg5hQu2gaZTRP2/bnUiV7CEqwJ7VRdQk +YsscNurLharQ86+xhB6UkH6zqFk4ElFElgR3W+X778VOipYXj2F2d2s2OxQ32z2K +Hi7W34/qmi56p5gOao/XjkdekzYamUmh1tonixj+ZpzDXJnslr1z99LZTI/FVFkW +wLONiEssCb1BC7GH17Q24hogaRZ3j8mAt2YEQFhFu2Yf7P1Gks8iPXTsUB8ylljE +LgUETGmAQpBLAuK3Y8xNsK5kWXU+GkgIrKd/hWk897R1WwGXxqlWuvNdPjMVTG17 ++d0Rh8SR8ykGuA== +=+Q9G +-----END PGP PUBLIC KEY BLOCK----- + +pub 4096R/7EB5F61A 2015-10-01 + Key fingerprint = 8935 9267 45E1 CE7E 3ED7 48F6 EC99 EE26 7EB5 F61A + uid Yann Ylavic + uid Yann Ylavic + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v2 + +mQINBFYNNTIBEAD77QsLP77W0f4zwQu1YRSVvnOSbSWmaYA2G3rnIJ6TTubVj4QA +juPGJphGcH4BN8ypOY5aeC5q0F5u2LWMP7Kq4Hz/YMqHlfIzEOWbkE+Q1CbIda1C +6SsL2FLHDBONZrVkOJWkcZ8MP3av3IYwMu0EgAo01OvxPeHKNzhc23z9uTSEEAKL +9nOy8CYGd2ng8J8Z94vVwpoR65ggKwZOAXat2uVnnGgdZBDoce/74pP+uMDg/vg4 +hnLq64+1ZndvbPchqVJZvwROXaFpB74QbulO/juezs5megMeH55ZaYIjcRxGr26z +X7o4N2R5ydSlwSW3jZx/WL15yOLfOiMdSdRME6mtuvEBb8M53L/taGmWzaZV7JDt +6WIHLwUvJsm4z7YGF5n7F4dIsuDFQUx/+3lIGLsYOZU7Ha491Gqxs+aU0TNuFT7B +d1iM2M4DU7RMMRS5j+v7TRiw5W0yoO8OQ4ESxYFN8FXPdRRseqfw1k1jumFY0cdJ +plxNXz3f45aNui3XpLZX4yHzNfnMc+rqw9STvy/rJSEvtsaT2PwlO0nEVdFuP+vV +OAnc6GffrsvHKo9cQn8x+8ibcLQXUaIolm6TB76RUDaljF5bmMHI/VzwN7+fQhng +jYuuAyukq0/nXSSY2O1KCXC6QRCqZdWP7AAXhVqwfuv/H1wanL3IladjRQARAQAB +tB9ZYW5uIFlsYXZpYyA8eWxhdmljQGFwYWNoZS5vcmc+iQI3BBMBCAAhBQJWDTUy +AhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEOyZ7iZ+tfYavX8QAOIjsT51 +DE5Fu7k/Bau7DbmQmQbUOMqBpOxS6BrmSDWy3wLuI1uJQb5NpyfmnYtPQhQp84vF +JYOsW6IG8kZLLHImniBDeurzu55o+8eZzBwHQMn5zdhIQXpDld1EVdSrECCeYVkQ +gN4Zf18X0hrznZhZQX13oKsfJCuzNM7cPdhEZd+1Xm8sFazh5GDkYKdhpYvhexce +/Y+IJeqz4VxPd59LHfua1YQYqAymcmPU8Tz4i/WjvwHUGXJArWu0Uv9q7ZIfvi+t +Si/FYOUoCLWvcvXDxvKA46Fyyx1Ph1FQK/jzLwdkLnTUoFpB8NiJAC6t3u+UQy/F +rm6BR4x8Tanncg+bF5szxEWl7N76b8nXlp8OL6G+1Skaod+OLjtPZRO3NX86Vt1/ +UsA8wyPi8o32w0y0G0JFTN6EMQ0b7UZd0gtBKnUQCLs4P/vxjvABKfKBmApGa08y +sdvIe5GQ3PXJ9WbKiNDtFP5ceyYhi0kcm+Zx4PnF+INOHZUaEkacDt1LuSuB3Prs +U37F1Svk1eJaCCeo6KflErdHUriabZe81ywiNvoCuCoRwOtVqXvC2eLYD+egBdrJ +GFqcTbTu1h6HXnuILLiiPUHt2JPAXeMS9Ks5stbrZrScp/oWYGKJxuBKykQ899vk ++g+9IAERUtybCGQw8z1SROgr12E7INj9KxCiiEYEExEKAAYFAlYePJIACgkQLrlG +goiBdAILZACfVEboy31a75Uf/4E6AejriBb7ewYAmgJPY2XYrN37sNKon3RRQCqZ +HMnhiQIcBBABAgAGBQJWDnfsAAoJEBk/GAq1XZl3gO4P/39cOhS07pUoN+pYl8IK +XpIURnSmgd2UbKEG8c2osh7FecQd4iGaVzkfFLdB6VBs5tCgVup2ov/4+brSIQJH +V9YNUGUrzJJfY2IKCjxXfyaKFW368UKl1eyQzdUYdG0S1ThIm3Vs4YQkWJcpRRdf +kvMekM2/QU0vWDCPPWEIscc6BHxkuVKwzzMyWeoY9CQYayL+elxYVaHG+9M4OdU5 +sAERQJFuvrRW6NAqfRd8yK1msUnDRcwocmlckJ6vqj1/JuMjJFXER1H8968ummec +n18YEWwL9Aos2jKZwrzqwiBJHgQq5ciPpb63Ev/HiJ2Qv5PN+zSQjNePcpR1LXPr +msTwJVf6B3MUWbFkX1ppFvJ3VME9L0kAoVVgCBAi0uDd2FfXH2+iq80WUWBpis0J +Y+xS919Jr5rCaSPRVVw3RhB7lFOdeKiVOKivCtL16pHlxPrFfbMBVNmHeUfem0u7 +UxVSP/Arc4f4P12Cp+iQgApanqJoGwWVqaMoJm6BptXiRF2Bmr4JyIzi9mORR0p0 +zSP5EQtDs1GVHaRrg+nl4xAn7os0k1lCcCTHfKUH5ECOW83pAnYmfgUMa0cbV9p5 +Ed3PhSuaA8l76ypCWtJNQrDdkRoWzuRzixst7PyDaPgakck/fxythCUe7NNcFRkv +cbqy57gLN+bWGtBJRmEug6jLiQIcBBABAgAGBQJWFOC9AAoJEO04c/XTJicipjAP +/iLKF6MBqq1eIZBjlirCHdkkHEwPoDNANW/c2NG0XZ2SHyOtpp67YIK3kFj52MaB +CQV7Tov/PbIESyNU8+HsHWV7GKPzpLSseZqz0F/TzM7JhF/cA7BAyxFyScI2U6Hv +jL9ODaZmiTpkG5VLFhB7fTzUQk5LnDyNL7D9A7htZz5alemQ14RncEEg92EJ1g/V +b8Oww/6XuRvcjm+4llrp0ybrbmi5lv/IgI7s6/NjR2XERHb10hxaENhsdNJ+Z9cc +yB3ivD4qjJ0+HsDewxXClvoHmbPwIoFGfYGly/I1JbH7MASRzsn+1WJrQSU4D/dw +v1ESwF8f241jiqpF6gze6CZj+4cvHqMBqQFsUIGpoTwLxCiOMgamcgz5+NfeVE6N +FOaVuVNtiwa8PukFvJ21PWSB9fs2qCjpU7CxUa3W/Vq7iHyTe3F7qu4e0yUT0u+E +gsrTDL6eEmh17hW8icePwJk7WyivwaggvwPPXK0gMV94po0dvb2ekbBaqN9vxrts +rgCjeACecS0RPQmkUlArmsfpYnmvky2Pl+Q6HedAKwje+BKcGchvHe17FO9G4YdL +Pa1mpzdiDcYWErp66tl0Ikz8OC6JzMlafLmYBO6H2AGOdF4qov7ixIQEIBHTB6iq +K1MYpOJItjj5jEbJIUi7X03ugYvKR+Y3LwCwRCmn+BofiQIcBBABCgAGBQJWFX/A +AAoJEGgijAHsH2WFL78P/jeb96X0jNctPdRS2pU5xYDt1wy9ak8/RTLadACJdAhl +5TeEDSfpHqO/j/asUh5wvozmQp6cj9mkjGlbgOnOF3cgcInOE9/PLe4uCrkEyq/f +u2E+etkQdK2vW4CQ2BoPK5ayesu9IeKhzIOKcgBoiP6nPyjHxvH3QwPGPpH0UEj7 +C6Y56Ub4jQgfCnL3ivQtyMXxbpPaxbtmeFGSdjsQ8C8yYnilZrj2CuOtqIQuddrj +B5gd+MdkjMmNhkhYDPtw08BzWyBkaSyVpoAmK3Jd7gl7TyVbrYdNy8zxCLh3akil +p8jgd58YPPoxTAQg96Mp5Opzc47ZWgmjAeyxhuFWmqomugTx9G5xarRODhJ0MJ5j +REnWB2OgDJqP1BplgHSDCBY6epl6rp+hoORczVY6C0zNMHIQiob8AWsaTro/ychK +NrzJhyT9x8gsAErqRQbF+zELdHEpKgTV6Pf7HGrfWxsEIoVPEyWZRn2msaV/u+7w +Bk8cnEaYFvy0vODhAWGRTXsrdpIv7mbHNZq4f8XoIr+ZFJaoJVizVtma/GrTkr65 +MTr5tKoBl7vZqX6IDYzFpkZZE+JAG7l06iceIEaaa6MqnGiGu67QC5T0oY6Qhf1z +/Z8mXfvWWtvikv2crScAMPv7mHjWudTCSovvmG4fKuQURTKd58GUWgcMWz7UAgUK +iQI6BBMBCAAkAhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheABQJWH49qAhkBAAoJ +EOyZ7iZ+tfYaR9kQAKz/GbiAvJdyWnHe7r7a1EXmecp9YgfJVRQnqZUZj43qwlzQ +xz1aWyWPYurjzkoHIkp9y3JOJYtd8DETOwDRhVkAeIirrENnpRdHNgpTXqNQQbXD +uxlRHQXghDhucvLbYcYw02L8sB4+4AudJZ0RVfjVhA9zyXqXT+7Cq2010swsI/HB +ySRp9m3O4hhxFDJVriNGr5ONB/xzMWkH0UC8sxJ8zhwoBVhj7IEjOKDPKRARvBCi +S+r7tnJ1guU+Idx1ug2SwhylY52dVQn7vC7asMPGK5uObNEMuxHqAqB0PconrR8Z +L5cw8ZryEtEMoIjNeKdguRC0mTOXJNqj8uvzfKMTt2B0YEmfscsspkS0JsDm0abl +ZI+DVW/OBBevYp1oTQGZWUGTiefXUXcCsPXTutNQzDv9M7maY9P0Pes0U3GtP7XX +tBQTW2OJVQQMwIaGYsLqsUPwBGoWC9pE5kRZoeIbwn3HSxDoTjObkGw3HHPLQt14 +5NEmDbmBn478ixVsZqHYTFHEfJ53fg3Xj42kwvDNkQQVjRY2/vanMT+sKCdhiuKW +4BhXeY5gAfKEs9RyNxWiiOY4a9YkWgSSiPbvqr34ZKEn5RrUjE9bfyyzCRtILo5f +sIAkcGFnDYH+DCoCJqqiTYmyC3PzJSuR0/vlS8rkjtUZuJv8aJZSU1+OWFYutCJZ +YW5uIFlsYXZpYyA8eWxhdmljLmRldkBnbWFpbC5jb20+iQI3BBMBCAAhBQJWH49j +AhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEOyZ7iZ+tfYamioQALz1Pc84 +Qih1B6dNB23dlrgCb0AlBISO291FOQrcCjTyaVsauRRJ2rTHkxokKj8QoJFLiKjY +sxlc96fo7hgKuQFgKHjg/rn4hhlT4VjZUL2+vkHPvG8wcn1bSxFxqmminuGK2O96 +mIJbUbv0koSBxFsBnOSdB9kQh6oOsMaBExTwfVzlEc/f/83uYBVr6yxenDSJsh/a +nDwV1SkemMCklvnFSiUX3IfXcXA0rkT8fqQ8n07BwZiTLPGLLSbLsfme3wotVfwQ +c4QR0/MKUmI8Ebh9KI1CE540oGnzEbUHxUS05ux1hn6/QemmONMyfbNrYXUIBV6N +MZr2r7FxAYCnN4JiyjSmGp5TSiRsSoGYGANXsIgQfwsKDxZ4iJfQQ/0FCZquFTaL +uPlFq3H414PJhcARQJJFFvioTorju29VoI5VcykSrjbHW9nA65KbKm/9sM2Tk2S5 +a5veUhNR0Haudj+EVrhmruNSlGMVO5s2l8s5wJ2U8oVZYhISfsU5rD/GVE+Rs/2S +dPk+5LhFQwy6qqWNd+RqrXS/KB1HVmsR2HzCc3QuEdaODRVijSJHc6z+nzp/2DIw +ynVg8j51qWbQ74l+gRSa2gb/Da8SkraFAgDynT163UBUqInEVaeKHt4YxG2KWERx +480bebA+8ZBJX5zcKyw9RWtp/Wd3zyWBEevLuQINBFYNNTIBEAC9L/sTGgqzpzlf +ZKCAVsqCC4+a3gYi+WUqG3K21C0bC1UoBrTmt//pg7BIjM5+ThM2IUOEcx5ORidw +oMOPNyC8UHC1AaaoWpD5Xo1hYrTQkKwHaJMZGOuidqR5VahPn1MH7DwatE9LacW1 +zB8e67idzloZZm3YhXteDg0oX5nGWYm8vIzBfbORrTrX5GIP+m0mDP29kBcSLWB9 +XuLYJVABmNoGYi9liTAFjP6tbJexTwNc5R0jAX+b5oeMQyfKT37mylz1jTj7LyeK +Yl1OIz+NmmmvRNpT24BOGET5c3Wm5hH7cLSk1vo/ragDRTySVJSsHUI1wnonY6IH +/obUXIylgwFz04/8pQG7UGVQqxv4b1dPWAPn+uH0YMgvlDBvjbyBc4U3mw33ST5l +zf0iCv1Kqqc35aGJ/eKUQj+0fpA0dRze7q3YKf59GlrMiAWqj2jBMLqm5zZuWhYD +yh3FX2zawJ73vbVyCod7XfImGwPRwtj+BCsYGAbtLoS6UNo4irPgcNeYenLba/WQ +Um3rClDNVjrj/bRgBhplKgyNcOLwPsrdzgANgTAUJffVDYB1Fnx6nsbcvaSSddZh +N33lkTSsuVCC3pJczf8T8t6c1DK+knXeQl7WDZJ3OPoVHT7CtBqcYrGvtCVK2AkI +ariyM1Wzzf+Rs9ved8Wohb7n0BrJewARAQABiQIfBBgBCAAJBQJWDTUyAhsMAAoJ +EOyZ7iZ+tfYaiusQAKwQ/0q+KTmNg5W1PDCoC7t5KAYFZzJ8HRXIl7sgC4Ji8aPC +v77LcPrrnRu1X86c095C//SLziRQlYjPUCP0Uc7fILWj799wtwv+hk8qWlT4n/zY +QJ5xULlRGaDGRRYbWs/Y+EdEjgXvtm0t0ZrEt3C4z3J9FKwTtwmC/WGQumhyZcNN +RLckCWEJCIpaZO7Dgnjwwrfg2a7t/WrqV/PX/CVNPM3b89K/KMe9NTZqhWThp602 +41d511+LEaxVFIHerEE/PpBL3ve95iyZFKyaR40uREeGEMU4AziODv4GY05NSFTe +MapgoNwSwot/hteq6O6qGR0xx75Our3Ioeo2jbgfD8Dbv0QnkP2+Q5rIsOJOTH3Y +Cxgc3zL+v1c6GjYplmQMNzulxsz9Bshd/yJzHrXRKJf7hUPIRt7K88Ynm+ta2dZn +OwxHMtlkzbgOWegmPL+I+dqAJnNCcR3u203ee9JnmbDgft/BYNagagmGPZLVjLxa +E5vzRXsJWbDLzQm7S0iX3rITbN8+9S09Ay3+Dh+VDSxea6sds+fFDXLjA84S2Oia +vCr+rwKKFmELVryPtyTMwKN7TIcBLYvEavmuDXEgiFVrTo9zuD9abzFVsukYUmrr +RhplyEYU+XWCp51Nbk3gFX2eZwIU5OQBLUNHE5pVzNVvxuIpAnzMMmLxhfTj +=+Xpk +-----END PGP PUBLIC KEY BLOCK----- + +pub rsa2048/1AD84DFF 2011-06-16 + Key fingerprint = B9E8 213A EFB8 61AF 35A4 1F2C 995E 3522 1AD8 4DFF + uid Daniel Ruggeri (http://home.apache.org/~druggeri/) + uid Daniel Ruggeri + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1 + +mQENBE36jjEBCADLvVAeRbmk/cChq8p9TvCPI+Q5FGOUlrD2YQ3c2kZLY8ktzH3L +c4PsOxVv/xIm4TymaMt4A0uujSV9EOp7go2NYLWZQ3eSUVKS0U+4QwQRG6QKDlnG +M+VH4Ayz38FCzi/jiXrHuWgiU7kkoYQzbC48XmhRh+e+80aOYpeHa/rNMR0vp7+K +iDwUJCq/e+3NQVSkkbYliBE3SjuSoIMUtaGeORB73zn7DqmH5ZLPbWKcbcsjzW0N +1ih8g5wqVzvlE52V1/UhT3DEY/7ZXuDX+Ox/Sg4DhtJLPnDfV1Oq4iIPB4Rlso6O +XufC636gdFhUXAAJ0xGctuC0xcZ2ddQJLrrrABEBAAG0JURhbmllbCBSdWdnZXJp +IDxEUnVnZ2VyaUBwcmltYXJ5Lm5ldD6JATwEEwECACYCGyMGCwkIBwMCBBUCCAME +FgIDAQIeAQIXgAUCVtsDSgUJEkZ2mQAKCRCZXjUiGthN/wo1B/9n+yDlliJTYPI1 +EV+WHnS6BEnOc4iYbqU9D7VFbrNc879LUODcpNHd80R0Bmlq9v3jYNCkWMbf3gFW +4KHQNtD2Ha0EAT9O3hCgUglXrGaVLNWsHsVCfe4WalFAs3HQR1uPda2k7WCRneq6 +LWia9lAO0qU6RMEG7IqSXeNVKUGxA04dZUs7VqNgcJilRu5kHJrvE7E/XWBuOpwU +74CCt72m00we0nnLjsI2YPvNCQxh30S9hVwyfp+b5n+PeT4kvfffSJLty0SO2k1S +aC/IeEucCLYuJix9VDNa0VjD9aEtaeTRqDyytuYiv4rmepMJlNvNqm+rBPU5AIpy +iAPmu3FXiQE8BBMBAgAmBQJN+o4xAhsjBQkJZgGABgsJCAcDAgQVAggDBBYCAwEC +HgECF4AACgkQmV41IhrYTf9qVwf/Z5t/AiOJS+M7w02RXYLvkX200Bn+03cUD2Q+ +YSld9ygrvTsf4AW5Raemzs/2meAMuB4BsQVt2Fq4XBojYQ/feV93zHk3Zg+50E3d +sOhyw0NaMNuiWLCD5rLEFor7dqjahZkE+QgPLePPCA52bAbHaSujIInRDbjg9Fkx +I7kuyXycvPWgV4KWwQwrb2ub1p2xfIIZ75b9HxM31Le+LAX64tIPd5SbXG6KQlDn +cvhwsA0TJLzEeFBEgovYVdfvIPzJqCvQ/fxmc7qNbO4//63UIfpnDQqMNYyD3tLY +8FtIIb8zEUC7D04lTF9ikzXW0zeV7VUI2SDPpfV10NkEGnjmookCHAQQAQIABgUC +VzV50AAKCRBdR2xh/7CPzUKjD/9OD5Psbdz6ZXfXcnxp8luX7I4XNoiH7EELNzy6 +2FHVmfseQ+y2UqfZFQ8XZhu7cd6BJ3zoGndymzMLxmXWYTWYz4hQc403xt/7osKx +kJYTXfTqXXbyoRB0hhLH1pMgfwEo1WhYaf35jykL3+5i0C8WBqmh/Z8868gx1UZO +FJuNwjL9O4X9ZXF3EsR4Fiyh2uaY4cidvRspFdA451CjwW09fS1tc/x4IOXMiCEn +xt4ZA6LEBk4WZkOTL0Dts3m22e2uebE4TC/56E2ldeHxoePDNwHGVQNPU9GyNSbM +gdzdNVJAnrhDQMRA8aETRdcKXPaUKZA7fmyF6R3tB2XuKyhr6f6Knrcv3Myl6V1C +5A3oUYP2KKkZXKp06v3H4ymYk9FKrHupA8aY/YvNmjyrP2aV02psPUEncxTIxXqi +eekfLDHyfP7/Zbndcu2ozWpatBp8moKqwH4qawMQBu20leTmUe/3R+QCwnAiK693 +sOpC4O+NK+YJrdqY3D9mhX57N0DDNeTCYnKbSxONQWUl/dBOXkn3hMpT8PWuLiO3 +fbA6+gAT3Zr2boXQD5PibsbclP40T9Us3ftvBLSbTySiRmLsx/m3T3sYB8p+8HGd +QITFy/Bnd5tsIwjaBrCPPgDA0rdfb/Qe9JN3IHOb46yHOi2BkBUgFX6ellVl/dUW +eTkz24kCHAQTAQgABgUCVzV3RAAKCRD/H0B8DTwkMNvVD/wMQIqGlXSCC+XjK22W +SXXNNU3fgrIlL/OvmRjSjzJtQN07FfPowbVEA66Xl/xR0yaW6TdxSOfz8qgYJizi +JgAQMIQRF3AjrjWgSqnjG8v15KGe2zrAgkjhhfXR6cmte4YDyJqhNjWEuFSsJ942 +51ltC/EwMZ3yEoL53m+cCWfJgL5Jhm3xHBxZjbuDzM2Haw4LidO8a149exCVYQUm +AB0WBBELUAzHkedNW4Yv7bfIvPDUCJupnXHc4qZgB0gF3HZi3H9V3jzMl96VajWX +WQ7jNupsER8Ot5gFAndz1JSR8NOJFhY3lqfnJPnALpRVwWA7O1kSAPhk8zAsFfzX +y2zOV/IRao4LLG0r30ypYNPo3Q6Zu/j9Rnd3HB7kQphoxlBV05ZvotQFQhopXpc5 +lpGS8Hm1YcwnvV8qqPQ0Ki4SfHe4eEckb0W8FHuFktsAw9y/+U6moRtIJDru9t2N +zC2RqToom2/7/UhNUE2dy7RuUDgvlDRBQ2HUxMXYIJw6mBPiyb2pRtRj+A9TNAHh +qJjcAxz+JSTWIvGtW/CC+JRBGSq5XhCFZh5g55RwBeWwJi7E8y2nH1MM6e8zBY7T +3L+HOAE/rzTlYmYQ2BANt3tvJm5hQOEDhr1gx74TPORsjox+/AlRaF7mo3Gc17wC +5bejV99CgsXfS9H6Q5C2QzQkZYkCHAQQAQIABgUCVziWfQAKCRDtOHP10yYnIuOS +EACfImSRxVG4QX9qzQ67hQ48orCs3FJHhaoTm9/wpkZkw3UwNGIC9uJsAW8HIVHq +WILG3dFZgs+AK3kqGxJLE1gy7Vf08BnSqTlV1mXfdnqntfOQGRwz9SbXrWy71NLy +Qa5+/vIZEa+IIMuRcDoxT46TJCG1OUF/cwU+9/qlV9FYcFptCpc+govLlDcbLzK8 +PGohUrTtGW37H6pOkfok3uoOt9YSyautOLZB9SSN1O1PpBXKYlNJc5lE/V/F83B7 +1r938FMskv0R4DdjKcItm+oZaVZJvigWtcQvQc15LP00dEDmUF69LQq6proJ3uTB +PfLkGxVvmbOgsZRfS+Ck6YMfeak3QrPIrK9TumMMpL+Xb+gL3ptfUussGg14vwOi +nTiCQarxAe8Gt2+8sFMZ3R6HCUcUZDjleOpT5OR1bQzsKJp4HyajHwIxwvaAXgP3 +C/frK7QOSx98QEeDlYaVbVLuxzLomNupxf47fh5mEG+jTyTeeDa7NRXmJNktPvD5 +Wnf97czFO6giesIIbMbCSt7vBG3UY4UpbBZMZbOBZIbG5N+RUPfZuC54SDR5KBWd +X9sdUklIFacmuBvkXzxOhfhRssNCZA9FeB5k9t/NnfUD8TfTbQ8+Di7f0+ISWzfm +glFVT7EhzacyoJ+lUAdU02lNu/FsvGeFBJ+gQdsnmy6OEIkBIgQQAQIADAUCV7kO +xgUDABJ1AAAKCRCXELibyletfDaqCAC8nznqKPG2Gstyt4rgaTJNp1uCtRqapqTk +ZHwos534/N4HGndX0Q/FwnKQUxlKevobUNUvjcUKVhgVFdMtYra6rHbbMFVQCS0T +05lXpwZEXIXWUD4A4q0+8rjGi1lMAzPfl9A02MrltTlZj+d6N1aPL/7MOYkf7ToS +vx03FxPXT+n//GW7pKrNL2eRi0Ohp/l67Z1OxSP6GnJUUYtj/iWZk4D9hgpuz9EE +rn+OBA58bJqaxxiVMUl8hIM4soLP3Sn3/IdWx0709l8mGmQoAQf9admARvrvXyRk +PCzgiU7rGaBeBG6W57moK34aw95KBxXxm7HHmCdBOjZzsKY0u8HtiQEiBBABAgAM +BQJXuQ7jBQMAEnUAAAoJEJcQuJvKV618FzoIAJgZgVs2hyUsp1JnwXDA1FQf2gAz +Mudj76m0zvTWop7asGfDH6JXFdejvU9T4gqKM51x51gWMC5wu9hv84HVTS5Xpbg1 +NbyUdZw99rcAJW4yR4Rs6uBNgg5V5IajS5Ej8advG6EKjXQMxsDWiorHinJMlO0F +CwerN8+gAUBcPpOvkP+C37jyIN6NW6bwNatshENgsYPnMz1H3A3Wa0YUuraWejmC +B+FmXOUYbzHJ1gGSzYkPrnsJUuIG4g8/fuapeAVrlg15iR+3ZR4EVdsvjBoryaxY +Xb+HhNFPSpMo7DkAw2f/QmivlMf9FH0yd3XaLcimz5gyjqROd13SAADiURCJASIE +EAECAAwFAlfb32UFAwASdQAACgkQlxC4m8pXrXwwzggAy1oiSzfhakoz7HNhrOSK +stREvzBnWPryJFbjTUDguG8en/KPrJS+eutpDxbkJ2uCNvRMr8mt0VGVjGjOEB56 +4cyzDTfxjWxuTUzGiffh6Sr7pHNUp/GMGX9TZWucyWgTKHys5UxcHpLang5ua1IC +Bm4VZiZi+CUNgBqt8n7rZiNE1nEwB9tXOGU/YBiicqjvrR6XN+mhiqjE/6h5VGVf +lY2uIxt2XS3/v2Paegmlq45XNbCN1gWp9URQ62X7wS22sG1aiekI5H1CAoegR6LZ +Cpgs3DZUzJVUVAiQMuhJ6Ok/G5WUkOOLL9sD/wKqNX2qV8qgdLPlBNYiA7FDgQfu +QYkBIgQQAQIADAUCV+0C/wUDABJ1AAAKCRCXELibyletfA+nCACR+OywI/TYh7RR +Zh5yV9V0784KAlyv+ybQ3EUnXu15d3hYB9X47UI6c/f5sLGO254fzFvVrfkFNZ5R +PxbGL7mC6N0IozmnEJoQEyV0XWz3dnbVghqo+lbIBzvRH5jeSjR7uME8cBZAbBb7 +uQOCTmPvLV0rsEoeZPtNBfs4744WwonM0304ox2DH/72Kxwff0nsCl7fgTN3f8YT +Hz7hkqnGPDNnmf9cELAFz1TWzH6j4S1gsFSYCxxSNtDLRUkNUhVUhClWM5mV5NUz +DPkhEUh28RJmFChQp/s62jF6zfU50AqwAAiLemdyA9jXlSrGsuGCzZLiNJSqJ3ms +WP6KglueiQEiBBABAgAMBQJX/iaRBQMAEnUAAAoJEJcQuJvKV618XpUIAK9PahDY +xZt0pG6Zby+KA1aRfkW3baa/0NWal8W41s3CsJ1B9znayheB+6PEoVOr/pADbQxX +IRGUbdaAZ2qTGDBcJ40fItfuSfwEvkKkqhsDabE/ZBzxhDiO7r6T5raI0P8gnmox +QYjHOaqmzFN4nMbBZpi2y3K6QqfC5ufHZ35E6JmVkzrcBMVd42IUTEZ2a29B75am +WNUZQtxrtLhV0GAE28bCQzhvJQiQO9Cpcc30o2zoBfWeJYErKp3BSMojzPaEbHts +vGqiiNvn9ogoR1IXDv2KzwTJeipeKExzTGI/PB/0FUyjrpolBro3kzlIR7Ol8OCl +t2VuBqdOTm26iEWJASIEEAECAAwFAlgP8rYFAwASdQAACgkQlxC4m8pXrXwhjQf9 +FTCiokUb1XT7wmMIl3dPU7KAVW5UgQKzNH5K5ST2if6Q9YDgDvioS7RM8vcyzGuC +t/GU3F4RcQkbBm8jkFnJC9spgSI+Ft7EkIgTdryeWpivZpIrx+FSyLcFnNzbIV0S +3Z5O8su7PeAlZ+6UCGIM7LFCvj9f9d2C5+8rIp8/0j8eCG9EQCLluZ0xdJNjm96c +IXKzzkNUUuoXH8shbakvFqO3iX48DbhKNdv+dskhfK4rQjb3rDZn1lVS5uVt4l2L +woS259xUTQr27Ym652kdq/+CZrw9inPMmjzJbmBMS6zL9NevdvfEG77XOxp/rdYe +gh+yMnGPj4kQW7KKpoyEhIkBIgQQAQIADAUCWCG+/gUDABJ1AAAKCRCXELibylet +fK+8B/94+FXcO/DONjHrGnZ409sjIPAiRUsOCnrcmqDeB8Lio8kx6VHXk5rwN3xb +UoBYx+p2AOQBP67wLQbwCUcy5fguY+JuuJGdvFlUGO8B8B9z4jLO+NRBf8OkY8Ky +sR2akBsRGT6aw3VVHCmVyknfotzdDpMzg6TIIqDhuE0TPAqz0KOGJ64dbrc4FMFy +6UAdHTv+I8BE590WuHOGZi3FAyUwV0mRfi3aC+gTlDNhwG7qEhIdgNrYnDWsQic/ +DSQWM56Toyx0Pv1N0/pa/oEbC/Q2BvcMFjMqGwm6UUkWsh8KxLqyGUsvkjgfvPC1 ++Zpc5CkL/EGFiP6mzTydeGWLJhnRiQEiBBABAgAMBQJYMuNeBQMAEnUAAAoJEJcQ +uJvKV6186HwH/3u7DVkXEf6IZY4d+MzUaDSQpHxq2HCotSwrqJ1QnLLXxPpyPl0D +5VlwY2P3/+HxP7xrG2QQpL88K1bQSCvc6gwS9U/VBbVtsAgVY9nUCsqcl7KOa1hu +TrUDJHIepYUd48SCcgnYu9Wbiz7ZXdTcbJMJ3uaVi3Hux3v/YGTDyNjnseQoM+Uv +lT3yoQ4niGPSnfMclykpdr5X1vnQ8EgW9BlBhoZSki9sxRCzGlIS4+UdT/resy4S +eFvOiRGJJIdciRfECqiB2ha2xwxN85l2aM/ejzmq67LqDKQHR6SOq5C/Dopkcoim +CJgdEp52wCQ4r6SjJsTB1cdCzNt5nfe20EOJASIEEAECAAwFAlhVK5MFAwASdQAA +CgkQlxC4m8pXrXwsPggAwxMlujaxb8dzKOQF7qIO+LH4hIwH0f3hcxiBAdhKy+1t +w4a/iFeBzrvFYQmakiW/0/5rMXurwzzrlhYCimznNZUN8Iae6XLaZ5s2sU2Bi/Z6 +jzZjza3EcT1XZYnLz3piuREZ4jPR1ZrHQpFkeSxx4gf9sUHYre1N4fyA4tPZeDyt +Ohd0/paAmak1a6LiBZElFs3ZE7lWH/W0utviT/iO6BPMwrar/iFt97KM5YPxVhpR +33ugRxeato2zddLFURnf2rdZZHp+C2A5oJUAKSFqKmh8EPDCh2bQhnDlhdMcktRg +1vkBoB6FJmUQxvk6Q51nEFTIrX6us8yuKzls1gm72YkBIgQQAQIADAUCWGb1oQUD +ABJ1AAAKCRCXELibyletfJDLCACZX0uwMOKAIvBvTF/yhsvVFhDQjPHtNLTk+/5R +SdaeOKYweh6Hy1JN/RpjJ6+2N+sjj+1+0rkWVHnZ8ApeOelGFgj/C+Xw9D7yhuYb +KHZlKgEcLofaQKJ+hwon0TuJEYY4EcXgCLESPGpHRa35z8eFlkvfh+msTTgAs6H5 +AbTIU6cxNJOZDH34R2NYuAHfjiMeBVH7iP76QqLjJPWclq7O7dkz5s4bjd2o7Pjf +GsOx3Ea6jKqf9Z4TqgTgEjIs/bLipMmiDUXJ8N0Dz7UUjTASsWReCpp3ldDjy3Pu +5dk+7B8CDtPd1iSK+FoKVSxqbItgTkrbXW3ScXTdOHBPxQVniQEiBBABAgAMBQJY +eMHsBQMAEnUAAAoJEJcQuJvKV618PJYH/RWpJgwmAZROizAqyqaEXjQqeBUYhdAi +UQ6nN7xDcR1CMyZmfRbZwQ7FZmfHhVdu7ywTRHmIRboN1qiYHIV/tphPr+WMdIhc +xYZaAgJQVKM9LuwK459jHlDMZmGzMHSdngqM3ivuQKdN7+kghUqzZ2KwrAT+qTyS +ixBAxWicqJIeRrA8wVlzSFoK7py3Pxe6MsEWSRxg0tSOgfQl17zXnVNmldsg3Ym1 +CHe4rtOz01b0sYT5qtiq6ybgp5D592H80ObDplAYhJwEM5E8X+EYQnfUFE1XkGZh +c0knY6tizJQwvo26/KQsj3uw4Njd8uzShSERhcDKqfrg+0FA8JtqAYCJASIEEAEC +AAwFAliJ5XMFAwASdQAACgkQlxC4m8pXrXwJYgf+Jh8nVamv2rDhPl7MHfqZHkus +I2WHqRL6XY/3VFPL0mzmQm/0dBo8zuq4dYOnHe329BZpQ3oN9krZlWE+37AkHcxg +alzeyavvDnR1hlgYhoKWAdTNdIvJ+L12LeCKOBHnlfxPe2Zug8wy8VOKUNk4qLNK +Pd+BhhRvBrE9Djk8hI5zmQl2Lf3Ibvu0A/voF0un5esSd/h3eVJJTLaOuUh3q3FA +M2jCx8pfa/l7nT4OBmArAQBZg5FSbk12rYXpcSVRGP2sQeKao8AqF10Hvk5Muhfe +EfPBCJN0yCdNyN5/GgqHnZkhueVS+t07c32/DUdldCoHjtsCrkXdlScsDRH1SIkC +HAQQAQIABgUCWHRekwAKCRA/kCwnbtm+IaUIEACDez9J+cHghzfWjHsFOMsBgzto +ZQEjoRhZhQ428yHj2Q83qVmwifF2K8gdb6cjNrgnisJiSgvE6l5swUFWXhszieJp +RhoE5nHDUVqh0jh7qwvbvM3SLaB8LLFhEq1CufD1u1YoB36dT90b6rXVXzM2i8Kw +gd9cFDMJX4FEXlYzjMG9hUYv+OwCaL5cfJqS9qEh549igCmAXyJeqTORmCDqq5LQ +6d6oUb7Cw7guCd3V3cXMxlnfcGDbTJQaMsfhCOHW/tIx46yvBSbJR1IixmnpMnx9 +WxhKUFj7KvYf0UVh0YrGndq0jLIeMZ9ZDIivPEfdAqjHra+uoyl2f39hev4sV2H0 +GbxtjfXfxvkchJhGj8PhjgmS5F8JqSRK515ewKK8Xv2H4W4yKguQkifrf3FgH9ct +pjU0dLgZSxUITj1OhLP7Grf8E9lRzP0F83Es47n7WZovrb85/xOrUMlHkyOCmeBa +koXhtXU3gk95h2ESZZH4j52N//o2VxVTQGlrchLu2lUz6IplC9zqHi0I1y+XHIM+ +jPySVmwL202fK8WxKWO3s1DSf4gEStXd3OumjSsg0kUjtFGS3fXzHmD9fkO58Nmn +9L9tgIv4vysNmZ5JdSWEyxgkU8hZju5qYovnRcX5D1gR5735jblUIpcczG8ZSMBA +LM23bxCFXoMPPCAGRIkCHAQQAQgABgUCV0NoqAAKCRCU0zajbRWTCq5oEACByjSD +nsrJRnPjncDNefv7XWINDI+9FgU1DYjFK8J8VZifgXNMlxir/1MhkWanRa1RFXyo +SMqr2M/H+M5HPw7GHxwrlWkG62ReO3WuRSHS5shYpzQWbwIGx/rvWKJ014Q2qaPC +B+TQ28iLfEJASguNmcAOUe0adOiG7AX3GSqh68TWYK70Fr9ddV0uyYI2uzCn5mMe +IoTRxu7wGufN01jzzqPd6MDtdxCxStOq4rMqZLfkAdphWiiF2nqxiMIY7Hte9YeQ +t+Amx1zRHuPwS988v9JcpNj4e5ZKzpXQoCNW4ujJpx87H/g7BsM6XKBE1LdLJhv8 +evOMmxjhOYuBd1P2Zrl9REn78iPKKvy9H7brFCI40tQ+B9XbXub7OuvqNoGSQjeQ +J/xqVZW7xnAsmoEL4JCY8u1eD6Tn0dJP3OaQ1lAYt85nbOKtkFREA9UfI68Ac4Qw +MGjG1bA6d/NawTTT09LLPU40PTTBfeDQCGKS+xxyh4LrVAFuP2x2Mx21tb3TtJzf +R2KRuLN+iDD8eL3BRKxq75cjm/Tz2hdaNBSrDDu4EXViify2DQoQVd1WexJpQkuN +aTLzXqEXXwE39szkYurvcWVUXdaQKRkSK8+fe3BiH/PmJShH5QpDexBbyNJdAEMQ +tMYNSfU/7hvrvW8AzA6Tn16WO7D9nRWwmhRBF4kCHAQQAQoABgUCV0OuvAAKCRBi +1I+tFqDeAYzVEACv9yu2yGzMsrIYcCgzhCi2alYMgPqvsLYlId4DFHhemkiZhBkg +RMrQ336kyuDvSi8bEoJlXwfaLDcpSUxPOD0m/LveIvOF1z5clCMx+uR4MPzf8+5p +d2EYeH8RG/x20ELvoH/1gYtAo+iUqJPW2owibBbyVgXlLS1L5zT9NFgPj5qi1D8U +6v9NPjdv3NGd5hJvFXv0lBeiuO+4UA18csLwhTr9eJqbe3NJqAkKeMIB8vnUXG9U +h6UmaX+dzniLhI4OYnIenzyps69VLGUF0VvCMJC7cSr514pyKkhskpSNtYiA5Opg +pXWwtZp1URm1RcDK1spgVrF7V9DgcpsoHRWByp2S5vRWkspmn0nZ+3+XQ+r9SbYF +Ljz1dT/3TmnIz35a3bf/yegzwXNZOJlSuSjGidZVzAQ7jT+HRGpoYkURyN3mvDwW +B5qOi9TcVIUtuOhuywLuIY+9Oh3VwoLE56p6MtNanJRQ6Zrf3vXz7h5AwN4epRb9 +SOTNPsS3GtbX4bbI9Z3gMD0QuwdP0PnlkQkdQFNLNJ949nJcQWX4/GJqs7b3Zy1W +UZd4bFyqGTv0ejcMYUhXjIFjOPb2tmnNk2XtLZbIdo6Y0965HadcZUin+AwzolkH +zlUBxTa+RkDS/l0pbrBMmIoyrcixF+nAmk1SOCPACHV1IP8Hn9NhavlZXIkBIgQQ +AQIADAUCWJqFqAUDABJ1AAAKCRCXELibyletfK3UB/9/Ao8Bv1srj96NF6YoPhcq +TzQ//XZyBhhCo9CgqQeTtHH/FfGs3eZMkVDLKeX+mSBa+wNN6vb/6FVpQPvLa4RX +fxynTbyx6F5CUousMBqx1vXSR/wxn1AKAO4Zwr/QjpZDUgQQHcotzo2q94aG0i/C +IqfDzm15tCO1PKewGtVBagHI0kjvO0722b7iJ61MtwnN0Ig3nd1YFRuPQiyAzhTM +2miEpOUV/IP3i07yjHrPOjrvoZqMPU3/3+qCRztY9o9TYSu30DY2/06pd84QIAfx +44yrAz4lXJAHYF89Cf22gf5s1Pu6ucyLptwP+1XVraGXABXi9JEaBgrW3nqz+YTX +iQEiBBABAgAMBQJYrCxBBQMAEnUAAAoJEJcQuJvKV618OcIIAKdIKjMWCjQ9cG99 +HnQ204RTCLugt3WRXB29dfYaQYAZn0X3ZWOyWnLfe0VhSBhG94Ww5I1FyE5aBWUn +F1+osKkNqTOTUpiRA85KX8OOalgLHByhGm12Dz2aMHZnAJJnaaJji6O3KE+TwQRT +FLSn0NJBUyQuNlH2//s/UCXwciOnj723icoEZnlalNuWh+4Bm69euHZnKRNWd2pP +9WOail89C89IWiTLGt3KNJy3bDnlwnaQr6mi0Tfv06F1HqKw5eo1UPpwAL1h6+cq +R15EIzfdT5iFcS1NWWBqErirTjm7LTMZaQXB3uwr019RjA7MW0VolOBo1oAJgh8A +8pWPrL6JASEEEAECAAwFAljPG7QFAwASdQAACgkQlxC4m8pXrXxOPgf4ldwkCFIh +OPqt5kR+WQ/waVv8h17W/r9zsB4qUaNQYtP8BuG2HV4zxMqGlfOj74QHhfWRz3Vn +MpMKhRCbaMp5w7ajbhMC6NmK+47eWO7ize9kwasqTlnB2jfefzEdNETC5EZ4Yfnv +T1mfdz+9o/BsnTmSo+mi8BhmgOc71+e4DxuDxZJOx4hUBFbR49A89wK24y9LGuwX +dS6/eITIjIuIoo3z58jzLIYaJpnl6JHsUKWuw/NqSbFZEgevUddP3u+yoXyJ21N/ +m6YdO5CdJNNnY4bNgokE3QTLGesK/S+b3mkcAwQJgmAK6QnbsNnWA3xR26YWsMye +qhdRpdIYVmBUiQIcBBABAgAGBQJZHXjvAAoJEAqdr2cTuGNJMUsQAK4yxvZPh0fp +URgdTYH6z9/INZNP0A0ZtV29pDnCFU4p2W7qW+OqjfzpX+umT1OiundHdfSxp0hn +pSezrX8mezN5dC6Pshu1HLE2K4RBOuIacL/VFCASseuT5Wwc9JljDw+P6qnozR7T +rbrpDcPkLjGk7EJ8KK8yUXcya6pwk2dVvCB245RSF+U7LJDRQeadnI8qkwW7O2Xf +cR7BLpz6Zto05KCA13tERVkeCher5Jpx/PSPUh0Nxxj5mDcv1HwOQ+fNkJXkalUi +JW9rugjdAAlXYWfvT65J74gAxhA21Www99Vy50ixPNAgYPrVnbhvTkDO2xSbAWwf +vDK73VnFqAXip0mkiF7xX/GOErNb2MzZKK77vi+J+JZgdPcsJUeVvqKnCQT9xhTL +LMMqa2kkK+Ha8HqAuvuA3uGP4jLdjisOBoyeBy/VSPMNjcOyxeraJOYebLwZLgtg +z2YQHI7gX+8fdphl+vhI2j7dQwJbHtQOYbe9VoKFq3Cq2NPTIrRxTQW8I5f34zvD +12EsfATnoThTeg2vdsrBX5CcPXgg0bAJSBod5tJco8riVWCQpJlvrF67oxH1ZOJA +LEffg9eEdvnJXcpEib86vpwNkvzwLdgCAxXDhcbExKxAD9TrwOa004IgldNV99q5 +7Tte0yaqwZkAkV43KLevNxxqiN/KeDa6iQIcBBABCAAGBQJZG5lsAAoJEOQDLcTv +DPOK+9cQAIBrQecI5SWNnu/TzMuGXMoO1twetkHB0sjtDiz0vx+oco8Lvykfucrb ++nkIU7kjLwnMlTblCLbHd8qqVaY6ogoBjzMddVDG5gNYzK5Prbf2fZve6vRUL08+ +w9BcRSVI7Eroq7GHekaegQrRZk9HfNMxhCZ9hCV/N7ZgiT6wQ0yaF+uWrcxxg8X3 +gm22zxjVF6ZcKydAA/a571MB6BG0hSynW7bUQfRlFSdlComOcDNZDfHZBFW0p+ZS +qlPT1r0WFpKn/uTltOvUftZ+XZ/6nmOtkXfu6wpkXgAvqsOdVlxoMz5iYlnU5z/W +jYTPo3eK5iyQ5upvYi6wx7nWNzXaw9KJ80MlbomAGGwuaXox6ZZuwnDikUnCeXP4 +03ANHArUGeZsD5+kN2n892qyzTojkXklns1REpSA85+ffYgPZCih1599LdtKBgqK +WvBu/r3l0pUUWOyrkpkWFZhgi1+Xqd4VLydr+JniNsuLj2Iyl78K6R1B9Kjdzmvq +DyJWetzwjv+cpRjYpae0WxnjW+sTiXqB7xANR+QSqd1T9cxG5C0ws0cb1nRK82rW +3rbRZdCB7piHPmcvX3iiUnlW0fyOAkdaqymFpfVkkoBO6Af7snmFMx78NECN+pIN +wmVKucGeLVeB0UkBHuCAieCepr310cpsLpWSuyppE8SpZlNB1chNiQIcBBABCAAG +BQJZHJMXAAoJED+q0s1ey7MUsEQP/inrCUSi3Bg4ZwGq9nndSrHCDoRBqGKBejN4 +sFWRRMK1neL+zILcbjZPLDhkPy2o/cd0cvJcUIssuCPfnJWXjeOb7wuGeXiXJhqQ +R5BxOzJ7/Zxa9/XZK2LwEFzxknGav8xRCG0FIEKCA9oFTnyFes6me7bVHq0DBYP6 +7DjF6N0qQaZT2YwILZFCB43M14ZxOEyVzG0P3pv49Lw7OIQJggmnpOkN2RG2upzD +wvHbQDXb8HD5JyOTkw4VCSFu1MBNtkYjwy+XM5MGfOpecqV/xZbY4sB40qc5DHbT +FmMniTTH9N/EcSf4RdZOklShqIdZmC9g43Yoz5/Du3uFOlmQE/af6vitbKMcLkop +jtnDwubKKYJR7HeWnFmiHoV/aD81u5h4H3KQwhr4kWsywwI1+yC2OokYWYIJdjp7 +P+qtv9IA5y8HDbhpHEUMrZIv6edVPoK+iEbkC7FpkYTBM4J+ERgHdGxtFBppPbaK +ISbsoJz2Z0rsAE7OpaTcOdLZ0em8MTAsxlefZcyOWXhptqbUC+/p92yzMrAdFp4K +x+rzZm3E7netwZe61o8yw+HUEu96oFxWR001eGwVBt5MjAbw564mjzsv8+7fXASA +iPuLoHVZA7RoOnhp9XG4fM4K8aFpdKzNfFsH9G/ygbF/IQUulf1RYAHpraRRtz4p +NeqP96htiQIcBBABCgAGBQJZG6jVAAoJEG8M2ucAtomd+r8P/2VpqAh1ajLRP2fv +mQnLb7keFv8io5KDlx/HOrqmiQ3ZYKOCjJvFYv0G1VwdassGEWEGqjt5W13YfHhS +YpSQp6Z9GN98ohOBES6NSfVkAjmoplOb6unPlMYcceAvDyei3f1Es7njiUjj/f3I +5R6Tq2j+wuySva3t7MrDqMWQi+LUvDWACj1n9yJtMHz3vceC7xo/7S7/ca+ubsHE +ueBr/MKvVH28H26Hej9/wzGYyocuq7OVtTMzfwAre2DK6UJq08WWJoqZjikpYfqF +dW5ZkFrXznyGJQ6Nmh+A3uvlTFXOI9QAlLZfsaYnIOHb+H8rmUuM1rsFMv9OJzwL +13cjwdpc0g2OcBFV3/omuVHol/UaF9cApfQJewV3MazKokb6y/doq02h+mc/W95N +i9RMVTSvSpOKmkdzunTWfh8lhkG0oZt5xobCGDxd2QrdO5/zmVYCQyXo0VGCOQjO +h+nzuyFBvyl6eXtWM/LIeMw/nzMXkxENdgpCbJgR5V/IqmXr0pneOB8MH5yI86za +t9arS4+t72Z3XEyEIglGZgms/PvRBrMR/3HCsUy8aSN2qNkIPzpT+5lPqJJ+ba+V +i5g47r6bH6IMDsOs9jKCQuMOCGWNZHKJIwdUnulJP9tGxAfnQse63kK/cHiXep5X +T0tQISnVYTsR3XHKcqLWAESiMPsDiQIcBBABCgAGBQJZHipqAAoJEKKrCB8mUY/u +RGEP/3KC5ZV9b3t3e1xQLH9Sh/RXosBHHeoAI3Q9Se290xpcpK5WaeZbd0sx8MXe +PpL7Y5luoc5rv/F5C07r2XIq8JLIQCDVdjjvrf+lJh4gqCid0oWbnVTzNFj5ocZ3 +mPCE0q2/3UchohlIx6/sGpKffpYt3Oc5NR6LWllukrbazBi64s/x8OliC833IhrN +xsreuUn/vl5SiALtO/tkb2dKMiJBc7WOJOay+XMviWNgUyoL0vSEeXMKgGqjYjpC +OhurriVHDDniJ8cGnhGATIoGqhYtUlI2ZTSosrYs2YV12b2Dpt2SJnVoy2fHhZTk +yoICJmBrVggTpffsD8H/qT6k6Qm15T7oxpKrpuxTugP0VIHALNNCYazbDaNyxXG+ +/sBbhX1JPrgCAy09eG+cimJANrZXJpLa6ToWuGShopM55g6RTTFKV74p2m1SRCEH +3Pny935AmhQyJLHhjGm+PIlyR8k4GvstzXDi2NIanmDRVw6tgndIHcP4UUYP+4cb ++7tJYBYcnJCvnrM48BK3+aTQD2MjPCUAAa8J6X+D9a/d0HAjhIkZL+Hage08845O +Tw2c5NdSpLPZiaV+5FEw4nn7s5U3k/bWGC2PFf6OIly5X7gW0rFBnBy6tArMz//u +txHOXkmVIEbOqxLrXz6LT384/ltMqFqChU+K6LoenFJc5VtgiQIiBBMBCgAMBQJZ +G5DRBYMHhh+AAAoJEMHtu5ykAP1QZYQP/i+FmF1LIkNY/KQ2njbYcwKcqF5KsHc7 +6IIgw7XGAs08mBZQniQRmfPyG/uRrgWc0vNdKopUZ0bRQmcLAC0fivqE1E5PEsJQ +wHBLmzVQeqzJ2Muhl3izmT1TSIOCdsPZRHnq3Kq7Zho6uzjsQAek57t604y7eZuh +5QR5OAMggWWqEFE1YZP7cEdBw3pyfMdG6Y+rhivON1dK+DVxVQ229NFMOSIEKRl4 +fR5TosbaoXHZqs6TQC7d7jOoT4DxVtzC4sZqc6hcDJuR6pyekLG1W3Z1xViJw4WI +1xRo2NpPnVGd1ZIQVvqYCj3wj/fnADGyuSJvv5eYRpQqX6nsHc2fosdZsYFBF01V +/eHjJ936HM3I1sEqGbNIk7DwtA0/GPTG82PKRj07kTytrOKfqMbuuXTuglPcg6Rr +pMCboQ3VcJEEP28w9f2KmPNy20CWU78DkPH3RjJMyTz6/3lN+RMyRM7PpqoCPH7P +IKTJmGq4jk10j54opV9bwnQEWThQv+Xp7eUQRAxOdF7tkOtMKSqPL3U+d0jCSKou +aithN+REwBA8Z5i9jJkbsmKZ9YMRFPRRxnfp9c3fvE+OUEFxUBIpRuDW3jizzFqt +eN+wrCw5dDjx5uaROSNOl8fSRcu/KaqvT0izzTekHeHt5IyOK0ewyz0gwWpm0bbO +qN6H7HdMsX2JiQEcBBABCAAGBQJZKDh7AAoJEAPClpScF1DFnh8H/2Nd7MCANmdY +ME1r7xBxIPaTFeKag74TzYjYmSLjmsOuhjyqgbEGC7yoGgdb/zjoZhxAaNAGqYRY +xQQ1r+Em1iu7RBHRa+9CjQmcJdE94mJf06G2s/M1/wFg3AnXzSedtkf+fkgCkCtD +p/4hAfI6brrVcsi7ExAaTG3UVGyqGmRfD3GqZx+ljLFcQWGxmJ5rFtHfIkbyyxvH +CJ7zxfhbETBX1SBpLS5eqffxpikmhbt1jtmFujjlrv68gIWJ4M52fsM2qb8SwLTW +dPDulCS5c3f7Lvj/gYgBFHW96r05HQVyZTWaxBTWQuOP+1ZcXD7uwqs7tnkdOwmh +ptKAtFTRTWqJAhwEEAEKAAYFAlkojKwACgkQnEn0IUcIVRjqMxAAnQk5LSR4/HlE +wir0QjRIL4mtfL8m43gbuLRgZ6zvpi53t+VhmaDyzweAPeRBSVQ4KHHvXEQyjgjm +lOrGg90NSAde3h5TSx19+pcApNGzQcTKbB6opK1NvCWf7DHeCcix9zgesSpEAwST +rTn9SG92Om9fZojNKhXJA4VD/hb2fyXZhs4LgNs0Rg3WkksYKrWdIlynx/MzoFDC +oukpXKMsnwZclwhAbyhQ63tG6l2cgmMUo+leyORsX6yUiCrtz7eR2lTo4U2ELE1Q +F+0pTKH+bEQv62T6FsbuRqzZEjjtrR8ECaTVRqJPFT72OBW6dhWgJ5djC2JKR26O +z1SmWgEWSald7jQZ+JTvS06zJ0KicPBPJjd+iIpgjhnZgSZaj7iB7wR9/Xftye32 +dHgyHmdFpxuqjJqSC7zsIPieBrzkaoQaH95z6E6pApfo6Iecw0SltDKe2BkK37/Q +jYfH43j5IUuo7YaUkrkLx5wfRSmnqd25tP914jxI76HvlJr4fqkMkhQguwSsImS0 +1ZTpvA7zAzgkIJFTinTyTOx797fjuA94PYLQcGSY8RkMG4E1ZXUQ/wyKzNntey7X +4xf6v1FWqwFm4FZ+yYw7GY5m04HXDBvDwRmUOGGO/MjLjKhWu4z8KRCUE/0oJ5rx +bN287GzZAZK9gDaPVFKqWHiOrcc5TSaJAiIEEwEKAAwFAlkk9CMFgweGH4AACgkQ +A+K/Hg+1K8buiw/9F7/xI70mxSBN9SzOCB5Twz0rikBWxzZnDOvUW8SUh/VrRVas +C1nJ8Mv74eVu7df0qNi4SuVtuftzIfcdmn0VYdkWKhZJ9wDkUeE7/2rTu0sJtMyM +MKw7/AyMprDFKJxVHfuVckv4u1Lt5v2JuFpvLsQ3qLFshefYbuZ49vtKjgJeYclF +a5BUFY3J2nUrXoyzAxkEpu+05TRJ18tqWW+SYL6UntJLJxQL1pPDnz8/BW5AJVoW +aGGVKS908IGYwFvtDZIkR/OO/4cqenANos2oRMvo7IveaS4gBwEuU73vJySBzHW5 +UAbJX41KGqp6uVjOCL6DcsDxHVgXhago+9jgc3OUo+1oT5eUviX7k4ru3St0HGhX +a9c+Xp6D5g6Z1OLqQmRpGqQO1oR4Af04wh6dKiNhbFnd9oP3kmQqzGZOVp2YJsvT +EbCZmLa3bX/Il8wy0hgMD53jhO38ZXJuH6vJYVLT7/0u1YoGRcAw1DhwslTzPjMo +EK2X4+rzytN5KOivDznP9qy1vGJbpNc8DLcO6zMbAlSdmXvamqjbO6u8RWOeyViu +KTU7ek9pzlrMqwYm4/Z3X/NfcbzWJmJmgLpeASNcKUuks3cIOx2uWrVBTFiI+JYL +Q4FiFPKyBeAignGpHLateWULJSq8PztTNhQnndD9Qxb9cLUVuhdjMAPltZrR/wAA +SCD/AABIGwEQAAEBAAAAAAAAAAAAAAAA/9j/4AAQSkZJRgABAgEBLAEsAAD/4Q10 +RXhpZgAATU0AKgAAAAgACgEPAAIAAAASAAAAhgEQAAIAAAAMAAAAmAESAAMAAAAB +AAEAAAEaAAUAAAABAAAApAEbAAUAAAABAAAArAEoAAMAAAABAAIAAAExAAIAAAAU +AAAAtAEyAAIAAAAUAAAAyAITAAMAAAABAAIAAIdpAAQAAAABAAAA3AAAAxROSUtP +TiBDT1JQT1JBVElPTgBOSUtPTiBEMzAwUwAAAAEsAAAAAQAAASwAAAABQWRvYmUg +UGhvdG9zaG9wIDcuMAAyMDE2OjAzOjA1IDEwOjM2OjE4AAAmgpoABQAAAAEAAAKq +gp0ABQAAAAEAAAKyiCIAAwAAAAEAAQAAiCcAAwAAAAEAyAAAkAAABwAAAAQwMjIx +kAMAAgAAABQAAAK6kAQAAgAAABQAAALOkQEABwAAAAQBAgMAkQIABQAAAAEAAALi +kgQACgAAAAEAAALqkgUABQAAAAEAAALykgcAAwAAAAEAAgAAkggAAwAAAAEAAAAA +kgkAAwAAAAEADQAAkgoABQAAAAEAAAL6kpAAAgAAAAM3NQAAkpEAAgAAAAM3NQAA +kpIAAgAAAAM3NQAAoAAABwAAAAQwMTAwoAEAAwAAAAEAAQAAoAIABAAAAAEAAABW +oAMABAAAAAEAAACAohcAAwAAAAEAAgAAowAABwAAAAEDAAAAowEABwAAAAEBAAAA +owIABwAAAAgAAAMCpAEAAwAAAAEAAAAApAIAAwAAAAEAAQAApAMAAwAAAAEAAAAA +pAQABQAAAAEAAAMKpAUAAwAAAAEAaQAApAYAAwAAAAEAAAAApAcAAwAAAAEAAAAA +pAgAAwAAAAEAAAAApAkAAwAAAAEAAAAApAoAAwAAAAEAAAAApAwAAwAAAAEAAAAA +6h0ACQAAAAEAAAAAAAAAAAAAAAoAAAnEAAAAOAAAAAoyMDEyOjAzOjI0IDA5OjE0 +OjQ5ADIwMTI6MDM6MjQgMDk6MTQ6NDkAAAAAAQAAAAEAAAAAAAAABgAAAB4AAAAK +AAACvAAAAAoAAgACAAEBAgAAAAEAAAABAAAABgEDAAMAAAABAAYAAAEaAAUAAAAB +AAADYgEbAAUAAAABAAADagEoAAMAAAABAAIAAAIBAAQAAAABAAADcgICAAQAAAAB +AAAJ+gAAAAAAAABIAAAAAQAAAEgAAAAB/9j/4AAQSkZJRgABAgEASABIAAD/7QAM +QWRvYmVfQ00AAf/uAA5BZG9iZQBkgAAAAAH/2wCEAAwICAgJCAwJCQwRCwoLERUP +DAwPFRgTExUTExgRDAwMDAwMEQwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwB +DQsLDQ4NEA4OEBQODg4UFA4ODg4UEQwMDAwMEREMDAwMDAwRDAwMDAwMDAwMDAwM +DAwMDAwMDAwMDAwMDAwMDP/AABEIAIAAVgMBIgACEQEDEQH/3QAEAAb/xAE/AAAB +BQEBAQEBAQAAAAAAAAADAAECBAUGBwgJCgsBAAEFAQEBAQEBAAAAAAAAAAEAAgME +BQYHCAkKCxAAAQQBAwIEAgUHBggFAwwzAQACEQMEIRIxBUFRYRMicYEyBhSRobFC +IyQVUsFiMzRygtFDByWSU/Dh8WNzNRaisoMmRJNUZEXCo3Q2F9JV4mXys4TD03Xj +80YnlKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vY3R1dnd4eXp7fH1+f3EQACAgEC +BAQDBAUGBwcGBTUBAAIRAyExEgRBUWFxIhMFMoGRFKGxQiPBUtHwMyRi4XKCkkNT +FWNzNPElBhaisoMHJjXC0kSTVKMXZEVVNnRl4vKzhMPTdePzRpSkhbSVxNTk9KW1 +xdXl9VZmdoaWprbG1ub2JzdHV2d3h5ent8f/2gAMAwEAAhEDEQA/AOtlPKilKjXs +pUS5NKzerdf6b0pv6zZNpEtpZq8/+Q/tJKdFz4Ud64PO+vmfaSMStmOzsT73f9L2 +qh/zo64XT9rfqdOB/BLVNPpm9LeuBwvrp1Spw+0BuTX3Dhtd/nsXT9K+sXT+pxWx +xqyCP5l+hP8AUd9F6Sqdfem3qMpShamW8pKBOoSSU//Q6uUlGU6jXuL9aevjo2EB +VBy75bSD2H51v9leZ3W5GTY621xe5+rnuOpP9Zb314yDk/WA0gy2hrKwPAn3v/6p +aGL9WsQ0M9SZIBJ+KbKYjv1ZIQMnj2sdOvEaBGbU8gDw4Xb0/VLpz2aOcJ81Zq+p +uFuHvO0c6IDKCu9kjq8AK7QRDTr28kSux9LwdQRqDwRHgvTG/VHp2hbOniqXWPqd +hPxn2VSx7QSI8UePwR7fij+rHWrM+g0ZJnIpAh3dzfF38tbi88+rt9mH12mt7oaX +bD20d7dV6EixkKJ1CSY/SCSCqf/R6hOoylOmqjXvm/1laXfWm8Dk2MGn9Vq6ug/o +2jwAWRm4Ys+td2SSLKX1iyst1iA2v3f1XIWf1XLqs21Wsx6xo0OAcXR+cocgMiAG +xi9INvX4Za5u2dVdr9phcH0z6xZbsgMsfXY0mAWDaumOdbXV9oa5r2kQGyJlNojQ +sgIkLBejqnbqqnVX+nh2u8Gklc7ifW7qN73VVY9ToMSbFs15Ts3HczKqNTi2Hxq2 +D+cHKTos6vntNM9cxXs5NrTHkTK9CJ1XEYOI+r6zjFMkU3O1Pg0bmrtZTmE7qJ9w +SUSfcEkkP//S6aVDIYbKLa2mC9jmg+ZCknlRsgNG3lsBhFewumwAbieRMqvl9L3W +m0MBdwDPbwWjkUNoyro+k4yR5fm/9UpCwFsKqbBb1CRvvq4VfSSLRuaGiDx2B5hd +aem05HTsfZLRUNuyfadNvvWFdlU0PFlphvA0mSuhweq4LsRkP+lDQAJ1PwTgSTqq +UQBoHFp+q9H2hrn0vD2SGuZrAOnYrbxemnHoNLPVfOm6wwBP0p1Vuq9rrHVuG1ze +QrTyAyB4J248mMiuwvs47ekYOJbk9RxqW2ZcucdzjoDH6NrW/R9oRidUYVek+7IA +htrWyPFw03KvKdG2PLwgADfe1fnJJvzkk5if/9PpAU6hKeVGvavUqK3477do9Rg0 +fGsA6iVz2RlGmh1gBMcBdW4BzS12oIgjyK5XPrOJe+q36HIJ4LezlFkjsWxgnQIt +yXWZWdDXEMb2LiFsdPx8vHktvr9OQateTEO7fSVB9eLTY3Krx2vg6vboQtTA69jZ +JbS3Ge/WA0agGUBVaaBlNdTq26s6/Ju3MLXWVNJZZWdzSW/Tqe5vs9y3w47Qe5Eq +s19DNuOxrWOa3dsboAERj/UcGD4u+CIWk9GFt73tFZ0a0n5oUoRzcSzMuxWWt+0V +Oh9R0cPzvon6SnKfWzXkbJX/ADklGfckgh//1OhlPKiCko7XspWB9bcSy/GD6jD4 +LQfMe9q3pXOda67Q/qbejVQ9zWufe/8AdcB7Km/yv9IgdQa6arobgd9PteX6f1R9 +Vn2bK0aNHNd4rbxeq4GIwurLWOBJBaOZ4lU7ekjNsnYCR+cQr2J9WMBsG2ve7wJM +fcmHhOuzOOMaaHxK/R8zN6j1P7TSCag0tseZieB/aXZ4lQrr/lH6RKz8HGqpaK6m +BjW8BogKp1/rgprPT8N/6d4i6wf4Np5b/wAa9GEZZJCMBqUEiETKRcPrdVOX9YH9 +Rx3loraGktP0nM9rXLpMPIGTi13AyXN939YaP/6S5eoAMgCPJaHRs+qh78W9wYHu +3Vk8SfpNWjn5XgwREfVKG5/evdoxzcWQk6CTuTqkoyks1sv/1d6VS6l1vp3S9v2y +3a5+rWNG50fvR+6iZ2djYGM/KyXba2feT2Y3+U5eX9Tz7up592ZcTDyS1vO1g+gz ++y1NhDi32XSlT0HVvrrlZYdX04HGxhp6p/nH/D/RNXNYWYaep1ZDySC+Hk8nf7XH +/pIdVptYQ/2smGR2QbGGTPbupTEcNAaFaJG76h9B6df6VrmkgsPE9itUX1DUu0C5 +nBsNuLTfqC9gn4jQp+oZzqmejSf0juT+6FTjjlOQjEWW6ZxjHiOzf6v9ZLgTiYB2 +k6WW9x5N/lLLxhA11MySeST3Kq49Ue48+PmtCpsLa5bBHFGh8x+aTm5sxyHXboEo +gR5rOtudfmH0xLK/a09ifznK3lWllW1ph7/a0+H7zv7Kz7ngbaKPpN0kefKmmWKI +dFnVrhgWYpduYYa0zq33D2/1UlmM2+hY0HuJd2mQkofbhvwjfj/w/lZOI9/6v0f/ +1uY+tXWv2jlmml04tB21/wAp359n/kFi7QGR3dyokkannspMPt1UwAAoLSeqNzYa +GjQBScJGvPdSjci4+BmZz7G4VRtdQwvsIjQfP6TkTQFlTbq6z9l6bTSwS4AgvHIM +n2tWcOpZAuFgjaNNh1kfynfvIJa52pM/FSbT4psYmPy6dSepXSlxfNrWgehwcinJ +qD6jxo5p5B81er5XLY9tuLYLK+e47Efulbf7QYcN+RWdY2hvcOOkK9iy2PVpIBry +hrp1XyLhY6ws12exg8/zv+kqhPpQyv3XP5PhKGx5poB/Odwog202tA/nHQT5T2QM +rr+W6QG96DPspo/P5B80k3rEmRyOT5pJ9R/Dh+iNf2v/2f/tD9JQaG90b3Nob3Ag +My4wADhCSU0EJQAAAAAAEAAAAAAAAAAAAAAAAAAAAAA4QklNA+0AAAAAABABLAAA +AAEAAQEsAAAAAQABOEJJTQQmAAAAAAAOAAAAAAAAAAAAAD+AAAA4QklNBA0AAAAA +AAQAAAAeOEJJTQQZAAAAAAAEAAAAHjhCSU0D8wAAAAAACQAAAAAAAAAAAQA4QklN +BAoAAAAAAAEAADhCSU0nEAAAAAAACgABAAAAAAAAAAE4QklNA/UAAAAAAEgAL2Zm +AAEAbGZmAAYAAAAAAAEAL2ZmAAEAoZmaAAYAAAAAAAEAMgAAAAEAWgAAAAYAAAAA +AAEANQAAAAEALQAAAAYAAAAAAAE4QklNA/gAAAAAAHAAAP////////////////// +//////////8D6AAAAAD/////////////////////////////A+gAAAAA//////// +/////////////////////wPoAAAAAP////////////////////////////8D6AAA +OEJJTQQIAAAAAAAQAAAAAQAAAkAAAAJAAAAAADhCSU0EHgAAAAAABAAAAAA4QklN +BBoAAAAAA2UAAAAGAAAAAAAAAAAAAACAAAAAVgAAABgAUAByAG8AZgBpAGwAZQAg +ACgAcgBlAHMAaQB6AGUAZAApACAALQAgAHQAaQBuAHkAAAABAAAAAAAAAAAAAAAA +AAAAAAAAAAEAAAAAAAAAAAAAAFYAAACAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAA +AAAAAAAAAAAAAAAAEAAAAAEAAAAAAABudWxsAAAAAgAAAAZib3VuZHNPYmpjAAAA +AQAAAAAAAFJjdDEAAAAEAAAAAFRvcCBsb25nAAAAAAAAAABMZWZ0bG9uZwAAAAAA +AAAAQnRvbWxvbmcAAACAAAAAAFJnaHRsb25nAAAAVgAAAAZzbGljZXNWbExzAAAA +AU9iamMAAAABAAAAAAAFc2xpY2UAAAASAAAAB3NsaWNlSURsb25nAAAAAAAAAAdn +cm91cElEbG9uZwAAAAAAAAAGb3JpZ2luZW51bQAAAAxFU2xpY2VPcmlnaW4AAAAN +YXV0b0dlbmVyYXRlZAAAAABUeXBlZW51bQAAAApFU2xpY2VUeXBlAAAAAEltZyAA +AAAGYm91bmRzT2JqYwAAAAEAAAAAAABSY3QxAAAABAAAAABUb3AgbG9uZwAAAAAA +AAAATGVmdGxvbmcAAAAAAAAAAEJ0b21sb25nAAAAgAAAAABSZ2h0bG9uZwAAAFYA +AAADdXJsVEVYVAAAAAEAAAAAAABudWxsVEVYVAAAAAEAAAAAAABNc2dlVEVYVAAA +AAEAAAAAAAZhbHRUYWdURVhUAAAAAQAAAAAADmNlbGxUZXh0SXNIVE1MYm9vbAEA +AAAIY2VsbFRleHRURVhUAAAAAQAAAAAACWhvcnpBbGlnbmVudW0AAAAPRVNsaWNl +SG9yekFsaWduAAAAB2RlZmF1bHQAAAAJdmVydEFsaWduZW51bQAAAA9FU2xpY2VW +ZXJ0QWxpZ24AAAAHZGVmYXVsdAAAAAtiZ0NvbG9yVHlwZWVudW0AAAARRVNsaWNl +QkdDb2xvclR5cGUAAAAATm9uZQAAAAl0b3BPdXRzZXRsb25nAAAAAAAAAApsZWZ0 +T3V0c2V0bG9uZwAAAAAAAAAMYm90dG9tT3V0c2V0bG9uZwAAAAAAAAALcmlnaHRP +dXRzZXRsb25nAAAAAAA4QklNBBQAAAAAAAQAAAABOEJJTQQMAAAAAAoWAAAAAQAA +AFYAAACAAAABBAAAggAAAAn6ABgAAf/Y/+AAEEpGSUYAAQIBAEgASAAA/+0ADEFk +b2JlX0NNAAH/7gAOQWRvYmUAZIAAAAAB/9sAhAAMCAgICQgMCQkMEQsKCxEVDwwM +DxUYExMVExMYEQwMDAwMDBEMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMAQ0L +Cw0ODRAODhAUDg4OFBQODg4OFBEMDAwMDBERDAwMDAwMEQwMDAwMDAwMDAwMDAwM +DAwMDAwMDAwMDAwMDAz/wAARCACAAFYDASIAAhEBAxEB/90ABAAG/8QBPwAAAQUB +AQEBAQEAAAAAAAAAAwABAgQFBgcICQoLAQABBQEBAQEBAQAAAAAAAAABAAIDBAUG +BwgJCgsQAAEEAQMCBAIFBwYIBQMMMwEAAhEDBCESMQVBUWETInGBMgYUkaGxQiMk +FVLBYjM0coLRQwclklPw4fFjczUWorKDJkSTVGRFwqN0NhfSVeJl8rOEw9N14/NG +J5SkhbSVxNTk9KW1xdXl9VZmdoaWprbG1ub2N0dXZ3eHl6e3x9fn9xEAAgIBAgQE +AwQFBgcHBgU1AQACEQMhMRIEQVFhcSITBTKBkRShsUIjwVLR8DMkYuFygpJDUxVj +czTxJQYWorKDByY1wtJEk1SjF2RFVTZ0ZeLys4TD03Xj80aUpIW0lcTU5PSltcXV +5fVWZnaGlqa2xtbm9ic3R1dnd4eXp7fH/9oADAMBAAIRAxEAPwDrZTyopSo17KVE +uTSs3q3X+m9Kb+s2TaRLaWavP/kP7SSnRc+FHeuDzvr5n2kjErZjs7E+93/S9qof +86OuF0/a36nTgfwS1TT6ZvS3rgcL66dUqcPtAbk19w4bXf57F0/SvrF0/qcVscas +gj+ZfoT/AFHfRekqnX3pt6jKUoWplvKSgTqEklP/0OrlJRlOo17i/Wnr46NhAVQc +u+W0g9h+db/ZXmd1uRk2OttcXufq57jqT/WW99eMg5P1gNIMtoaysDwJ97/+qWhi +/VrENDPUmSASfimymI79WSEDJ49rHTrxGgRm1PIA8OF29P1S6c9mjnCfNWavqbhb +h7ztHOiAygrvZI6vACu0EQ069vJErsfS8HUEag8ER4L0xv1R6doWzp4ql1j6nYT8 +Z9lUse0EiPFHj8Ee34o/qx1qzPoNGSZyKQId3c3xd/LW4vPPq7fZh9dpre6Gl2w9 +tHe3VehIsZCidQkmP0gkgqn/0eoTqMpTpqo175v9ZWl31pvA5NjBp/VauroP6No8 +AFkZuGLPrXdkkiyl9YsrLdYgNr939VyFn9Vy6rNtVrMesaNDgHF0fnKHIDIgBsYv +SDb1+GWubtnVXa/aYXB9M+sWW7IDLH12NJgFg2rpjnW11faGua9pEBsiZTaI0LIC +JCwXo6p26qp1V/p4drvBpJXO4n1u6je91VWPU6DEmxbNeU7Nx3MyqjU4th8atg/n +Byk6LOr57TTPXMV7OTa0x5EyvQidVxGDiPq+s4xTJFNztT4NG5q7WU5hO6ifcElE +n3BJJD//0umlQyGGyi2tpgvY5oPmQpJ5UbIDRt5bAYRXsLpsAG4nkTKr5fS91ptD +AXcAz28Fo5FDaMq6PpOMkeX5v/VKQsBbCqmwW9Qkb76uFX0ki0bmhog8dgeYXWnp +tOR07H2S0VDbsn2nTb71hXZVNDxZaYbwNJkrocHquC7EZD/pQ0ACdT8E4Ek6qlEA +aBxafqvR9oa59Lw9khrmawDp2K28Xppx6DSz1XzpusMAT9KdVbqva6x1bhtc3kK0 +8gMgeCduPJjIrsL7OO3pGDiW5PUcaltmXLnHc46Ax+ja1v0faEYnVGFXpPuyAIba +1sjxcNNyrynRtjy8IAA33tX5ySb85JOYn//T6QFOoSnlRr2r1Kit+O+3aPUYNHxr +AOolc9kZRpodYATHAXVuAc0tdqCII8iuVz6ziXvqt+hyCeC3s5RZI7FsYJ0CLcl1 +mVnQ1xDG9i4hbHT8fLx5Lb6/TkGrXkxDu30lQfXi02Nyq8dr4Or26ELUwOvY2SW0 +txnv1gNGoBlAVWmgZTXU6turOvybtzC11lTSWWVnc0lv06nub7Pct8OO0HuRKrNf +Qzbjsa1jmt3bG6ABEY/1HBg+LvgiFpPRhbe97RWdGtJ+aFKEc3EszLsVlrftFTof +UdHD876J+kpyn1s15GyV/wA5JRn3JIIf/9ToZTyogpKO17KVgfW3Esvxg+ow+C0H +zHvat6VznWuu0P6m3o1UPc1rn3v/AHXAeypv8r/SIHUGumq6G4HfT7Xl+n9UfVZ9 +mytGjRzXeK28XquBiMLqy1jgSQWjmeJVO3pIzbJ2AkfnEK9ifVjAbBtr3u8CTH3J +h4TrszjjGmh8Sv0fMzeo9T+00gmoNLbHmYngf2l2eJUK6/5R+kSs/BxqqWiupgY1 +vAaICqdf64Kaz0/Df+neIusH+DaeW/8AGvRhGWSQjAalBIhEykXD63VTl/WB/Ucd +5aK2hpLT9JzPa1y6TDyBk4tdwMlzfd/WGj/+kuXqADIAjyWh0bPqoe/FvcGB7t1Z +PEn6TVo5+V4MERH1Shuf3r3aMc3FkJOgk7k6pKMpLNbL/9XelUupdb6d0vb9st2u +fq1jRudH70fuomdnY2BjPysl22tn3k9mN/lOXl/U8+7qefdmXEw8ktbztYPoM/st +TYQ4t9l0pU9B1b665WWHV9OBxsYaeqf5x/w/0TVzWFmGnqdWQ8kgvh5PJ3+1x/6S +HVabWEP9rJhkdkGxhkz27qUxHDQGhWiRu+ofQenX+la5pILDxPYrVF9Q1LtAuZwb +Dbi036gvYJ+I0KfqGc6pno0n9I7k/uhU445TkIxFlumcYx4js3+r/WS4E4mAdpOl +lvceTf5Sy8YQNdTMknkk9yquPVHuPPj5rQqbC2uWwRxRofMfmk5ubMch126BKIEe +azrbnX5h9MSyv2tPYn85yt5VpZVtaYe/2tPh+87+ys+54G2ij6TdJHnyppliiHRZ +1a4YFmKXbmGGtM6t9w9v9VJZjNvoWNB7iXdpkJKH24b8I34/8P5WTiPf+r9H/9bm +PrV1r9o5ZppdOLQdtf8AKd+fZ/5BYu0Bkd3cqJJGp57KTD7dVMAAKC0nqjc2Gho0 +AUnCRrz3Uo3IuPgZmc+xuFUbXUML7CI0Hz+k5E0BZU26us/Zem00sEuAILxyDJ9r +VnDqWQLhYI2jTYdZH8p37yCWudqTPxUm0+KbGJj8unUnqV0pcXza1oHocHIpyag+ +o8aOaeQfNXq+Vy2Pbbi2CyvnuOxH7pW3+0GHDfkVnWNob3DjpCvYstj1aSAa8oa6 +dV8i4WOsLNdnsYPP87/pKoT6UMr91z+T4ShseaaAfzncKINtNrQP5x0E+U9kDK6/ +lukBvegz7KaPz+QfNJN6xJkcjk+aSfUfw4fojX9r/9k4QklNBCEAAAAAAFUAAAAB +AQAAAA8AQQBkAG8AYgBlACAAUABoAG8AdABvAHMAaABvAHAAAAATAEEAZABvAGIA +ZQAgAFAAaABvAHQAbwBzAGgAbwBwACAANwAuADAAAAABADhCSU0EBgAAAAAABwAD +AAAAAQEA/+ESSGh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8APD94cGFja2V0 +IGJlZ2luPSfvu78nIGlkPSdXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQnPz4KPD9h +ZG9iZS14YXAtZmlsdGVycyBlc2M9IkNSIj8+Cjx4OnhhcG1ldGEgeG1sbnM6eD0n +YWRvYmU6bnM6bWV0YS8nIHg6eGFwdGs9J1hNUCB0b29sa2l0IDIuOC4yLTMzLCBm +cmFtZXdvcmsgMS41Jz4KPHJkZjpSREYgeG1sbnM6cmRmPSdodHRwOi8vd3d3Lncz +Lm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjJyB4bWxuczppWD0naHR0cDov +L25zLmFkb2JlLmNvbS9pWC8xLjAvJz4KCiA8cmRmOkRlc2NyaXB0aW9uIGFib3V0 +PSd1dWlkOmUxZjZmZGE5LWUyZWYtMTFlNS1hYzQ3LWRkYTJjNDYwZjdlYScKICB4 +bWxuczp4YXBNTT0naHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyc+CiAg +PHhhcE1NOkRvY3VtZW50SUQ+YWRvYmU6ZG9jaWQ6cGhvdG9zaG9wOmUxZjZmZGEy +LWUyZWYtMTFlNS1hYzQ3LWRkYTJjNDYwZjdlYTwveGFwTU06RG9jdW1lbnRJRD4K +IDwvcmRmOkRlc2NyaXB0aW9uPgoKPC9yZGY6UkRGPgo8L3g6eGFwbWV0YT4KICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +IAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAog +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAK +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgCjw/eHBhY2tldCBlbmQ9J3cnPz7/4gxYSUNDX1BST0ZJTEUA +AQEAAAxITGlubwIQAABtbnRyUkdCIFhZWiAHzgACAAkABgAxAABhY3NwTVNGVAAA +AABJRUMgc1JHQgAAAAAAAAAAAAAAAAAA9tYAAQAAAADTLUhQICAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFjcHJ0AAABUAAA +ADNkZXNjAAABhAAAAGx3dHB0AAAB8AAAABRia3B0AAACBAAAABRyWFlaAAACGAAA +ABRnWFlaAAACLAAAABRiWFlaAAACQAAAABRkbW5kAAACVAAAAHBkbWRkAAACxAAA +AIh2dWVkAAADTAAAAIZ2aWV3AAAD1AAAACRsdW1pAAAD+AAAABRtZWFzAAAEDAAA +ACR0ZWNoAAAEMAAAAAxyVFJDAAAEPAAACAxnVFJDAAAEPAAACAxiVFJDAAAEPAAA +CAx0ZXh0AAAAAENvcHlyaWdodCAoYykgMTk5OCBIZXdsZXR0LVBhY2thcmQgQ29t +cGFueQAAZGVzYwAAAAAAAAASc1JHQiBJRUM2MTk2Ni0yLjEAAAAAAAAAAAAAABJz +UkdCIElFQzYxOTY2LTIuMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAWFlaIAAAAAAAAPNRAAEAAAABFsxYWVogAAAAAAAA +AAAAAAAAAAAAAFhZWiAAAAAAAABvogAAOPUAAAOQWFlaIAAAAAAAAGKZAAC3hQAA +GNpYWVogAAAAAAAAJKAAAA+EAAC2z2Rlc2MAAAAAAAAAFklFQyBodHRwOi8vd3d3 +LmllYy5jaAAAAAAAAAAAAAAAFklFQyBodHRwOi8vd3d3LmllYy5jaAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABkZXNjAAAAAAAA +AC5JRUMgNjE5NjYtMi4xIERlZmF1bHQgUkdCIGNvbG91ciBzcGFjZSAtIHNSR0IA +AAAAAAAAAAAAAC5JRUMgNjE5NjYtMi4xIERlZmF1bHQgUkdCIGNvbG91ciBzcGFj +ZSAtIHNSR0IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZGVzYwAAAAAAAAAsUmVmZXJl +bmNlIFZpZXdpbmcgQ29uZGl0aW9uIGluIElFQzYxOTY2LTIuMQAAAAAAAAAAAAAA +LFJlZmVyZW5jZSBWaWV3aW5nIENvbmRpdGlvbiBpbiBJRUM2MTk2Ni0yLjEAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAHZpZXcAAAAAABOk/gAUXy4AEM8UAAPtzAAE +EwsAA1yeAAAAAVhZWiAAAAAAAEwJVgBQAAAAVx/nbWVhcwAAAAAAAAABAAAAAAAA +AAAAAAAAAAAAAAAAAo8AAAACc2lnIAAAAABDUlQgY3VydgAAAAAAAAQAAAAABQAK +AA8AFAAZAB4AIwAoAC0AMgA3ADsAQABFAEoATwBUAFkAXgBjAGgAbQByAHcAfACB +AIYAiwCQAJUAmgCfAKQAqQCuALIAtwC8AMEAxgDLANAA1QDbAOAA5QDrAPAA9gD7 +AQEBBwENARMBGQEfASUBKwEyATgBPgFFAUwBUgFZAWABZwFuAXUBfAGDAYsBkgGa +AaEBqQGxAbkBwQHJAdEB2QHhAekB8gH6AgMCDAIUAh0CJgIvAjgCQQJLAlQCXQJn +AnECegKEAo4CmAKiAqwCtgLBAssC1QLgAusC9QMAAwsDFgMhAy0DOANDA08DWgNm +A3IDfgOKA5YDogOuA7oDxwPTA+AD7AP5BAYEEwQgBC0EOwRIBFUEYwRxBH4EjASa +BKgEtgTEBNME4QTwBP4FDQUcBSsFOgVJBVgFZwV3BYYFlgWmBbUFxQXVBeUF9gYG +BhYGJwY3BkgGWQZqBnsGjAadBq8GwAbRBuMG9QcHBxkHKwc9B08HYQd0B4YHmQes +B78H0gflB/gICwgfCDIIRghaCG4IggiWCKoIvgjSCOcI+wkQCSUJOglPCWQJeQmP +CaQJugnPCeUJ+woRCicKPQpUCmoKgQqYCq4KxQrcCvMLCwsiCzkLUQtpC4ALmAuw +C8gL4Qv5DBIMKgxDDFwMdQyODKcMwAzZDPMNDQ0mDUANWg10DY4NqQ3DDd4N+A4T +Di4OSQ5kDn8Omw62DtIO7g8JDyUPQQ9eD3oPlg+zD88P7BAJECYQQxBhEH4QmxC5 +ENcQ9RETETERTxFtEYwRqhHJEegSBxImEkUSZBKEEqMSwxLjEwMTIxNDE2MTgxOk +E8UT5RQGFCcUSRRqFIsUrRTOFPAVEhU0FVYVeBWbFb0V4BYDFiYWSRZsFo8WshbW +FvoXHRdBF2UXiReuF9IX9xgbGEAYZRiKGK8Y1Rj6GSAZRRlrGZEZtxndGgQaKhpR +GncanhrFGuwbFBs7G2MbihuyG9ocAhwqHFIcexyjHMwc9R0eHUcdcB2ZHcMd7B4W +HkAeah6UHr4e6R8THz4faR+UH78f6iAVIEEgbCCYIMQg8CEcIUghdSGhIc4h+yIn +IlUigiKvIt0jCiM4I2YjlCPCI/AkHyRNJHwkqyTaJQklOCVoJZclxyX3JicmVyaH +Jrcm6CcYJ0kneierJ9woDSg/KHEooijUKQYpOClrKZ0p0CoCKjUqaCqbKs8rAis2 +K2krnSvRLAUsOSxuLKIs1y0MLUEtdi2rLeEuFi5MLoIuty7uLyQvWi+RL8cv/jA1 +MGwwpDDbMRIxSjGCMbox8jIqMmMymzLUMw0zRjN/M7gz8TQrNGU0njTYNRM1TTWH +NcI1/TY3NnI2rjbpNyQ3YDecN9c4FDhQOIw4yDkFOUI5fzm8Ofk6Njp0OrI67zst +O2s7qjvoPCc8ZTykPOM9Ij1hPaE94D4gPmA+oD7gPyE/YT+iP+JAI0BkQKZA50Ep +QWpBrEHuQjBCckK1QvdDOkN9Q8BEA0RHRIpEzkUSRVVFmkXeRiJGZ0arRvBHNUd7 +R8BIBUhLSJFI10kdSWNJqUnwSjdKfUrESwxLU0uaS+JMKkxyTLpNAk1KTZNN3E4l +Tm5Ot08AT0lPk0/dUCdQcVC7UQZRUFGbUeZSMVJ8UsdTE1NfU6pT9lRCVI9U21Uo +VXVVwlYPVlxWqVb3V0RXklfgWC9YfVjLWRpZaVm4WgdaVlqmWvVbRVuVW+VcNVyG +XNZdJ114XcleGl5sXr1fD19hX7NgBWBXYKpg/GFPYaJh9WJJYpxi8GNDY5dj62RA +ZJRk6WU9ZZJl52Y9ZpJm6Gc9Z5Nn6Wg/aJZo7GlDaZpp8WpIap9q92tPa6dr/2xX +bK9tCG1gbbluEm5rbsRvHm94b9FwK3CGcOBxOnGVcfByS3KmcwFzXXO4dBR0cHTM +dSh1hXXhdj52m3b4d1Z3s3gReG54zHkqeYl553pGeqV7BHtje8J8IXyBfOF9QX2h +fgF+Yn7CfyN/hH/lgEeAqIEKgWuBzYIwgpKC9INXg7qEHYSAhOOFR4Wrhg6GcobX +hzuHn4gEiGmIzokziZmJ/opkisqLMIuWi/yMY4zKjTGNmI3/jmaOzo82j56QBpBu +kNaRP5GokhGSepLjk02TtpQglIqU9JVflcmWNJaflwqXdZfgmEyYuJkkmZCZ/Jpo +mtWbQpuvnByciZz3nWSd0p5Anq6fHZ+Ln/qgaaDYoUehtqImopajBqN2o+akVqTH +pTilqaYapoum/adup+CoUqjEqTepqaocqo+rAqt1q+msXKzQrUStuK4trqGvFq+L +sACwdbDqsWCx1rJLssKzOLOutCW0nLUTtYq2AbZ5tvC3aLfguFm40blKucK6O7q1 +uy67p7whvJu9Fb2Pvgq+hL7/v3q/9cBwwOzBZ8Hjwl/C28NYw9TEUcTOxUvFyMZG +xsPHQce/yD3IvMk6ybnKOMq3yzbLtsw1zLXNNc21zjbOts83z7jQOdC60TzRvtI/ +0sHTRNPG1EnUy9VO1dHWVdbY11zX4Nhk2OjZbNnx2nba+9uA3AXcit0Q3ZbeHN6i +3ynfr+A24L3hROHM4lPi2+Nj4+vkc+T85YTmDeaW5x/nqegy6LzpRunQ6lvq5etw +6/vshu0R7ZzuKO6070DvzPBY8OXxcvH/8ozzGfOn9DT0wvVQ9d72bfb794r4Gfio ++Tj5x/pX+uf7d/wH/Jj9Kf26/kv+3P9t////7gAOQWRvYmUAZAAAAAAB/9sAhAAK +BwcHCAcKCAgKDwoICg8SDQoKDRIUEBASEBAUEQwMDAwMDBEMDAwMDAwMDAwMDAwM +DAwMDAwMDAwMDAwMDAwMAQsMDBUTFSIYGCIUDg4OFBQODg4OFBEMDAwMDBERDAwM +DAwMEQwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAz/wAARCACAAFYDAREAAhEB +AxEB/90ABAAL/8QBogAAAAcBAQEBAQAAAAAAAAAABAUDAgYBAAcICQoLAQACAgMB +AQEBAQAAAAAAAAABAAIDBAUGBwgJCgsQAAIBAwMCBAIGBwMEAgYCcwECAxEEAAUh +EjFBUQYTYSJxgRQykaEHFbFCI8FS0eEzFmLwJHKC8SVDNFOSorJjc8I1RCeTo7M2 +F1RkdMPS4ggmgwkKGBmElEVGpLRW01UoGvLj88TU5PRldYWVpbXF1eX1ZnaGlqa2 +xtbm9jdHV2d3h5ent8fX5/c4SFhoeIiYqLjI2Oj4KTlJWWl5iZmpucnZ6fkqOkpa +anqKmqq6ytrq+hEAAgIBAgMFBQQFBgQIAwNtAQACEQMEIRIxQQVRE2EiBnGBkTKh +sfAUwdHhI0IVUmJy8TMkNEOCFpJTJaJjssIHc9I14kSDF1STCAkKGBkmNkUaJ2R0 +VTfyo7PDKCnT4/OElKS0xNTk9GV1hZWltcXV5fVGVmZ2hpamtsbW5vZHV2d3h5en +t8fX5/c4SFhoeIiYqLjI2Oj4OUlZaXmJmam5ydnp+So6SlpqeoqaqrrK2ur6/9oA +DAMBAAIRAxEAPwCb1ytsdXFXVxVaWxVYz4Fa5nArueKu54q3zxVrnirXM1xV/9Ca +1ytsdXFWicVSrWfMel6Ov+lS1nIqtum7n5/yf7LAtMI1D8xNSmJFnEltH2J+NyP9 +l8P/AAuNJS3/ABb5gLVN7Judug/CmNJTGw896vCyi54XMXcMOLf8GmCkMv0fzPpu +q0jjYxXRG8EmxP8AqN9l8VTeuKHVxVoncYEv/9GZ1ytsdirH/N/mQaHYARUN7cVW +AH9kD7Uv+xwK8knmubqV5pXLvIas7Ekk/wCthTVrVR679KbDDa0rJC5AA3odsFpp +eI5lIoh37eI7Y2ilSKSSBwwqpFCD0II/lxS9H8pa7LqNu1vdGtzCAQ3d18W/yxkU +FkNcCGidxil//9KZVytsdXAryn8wLk3XmQwBqrbokQHgSOb/APEsUhM7TypZG3j9 +SvIqCT7kZinIXMEAmEPkvTHTZnFffCJlTAIuHyLYc1+M8R12yQkWJiE1XyXpnwle +W3WtN8khLtb8j2D2sksNUkRSQR4jEFBFsL8sXEll5hgikaiFjGewo3w75YeTQe56 +hgQ0T8QxV//TmGVtjq4FeT+a0L+b7kAbmRBt/qrgPJlHmzS3P7pR4AZhOcm1kVZe +NaHJRUphH8Jp1OTYo+KvHfLA1lB6xJ6VjM/gpJ+7Eq8lghr5gs3TqZlNPYkHJjk0 +y5vTid8WC0n4hir/AP/Ul9cqbHVHfFWA31kJfOM90SJYHjEsbLuAQFj+L/VbK5EE +bN0IkHcKOo6xewycYpkt4hUKGAYtT9rIRgGyUi7SfM9610qSyRyKTQFBxxlCkwnf +NlzahLFCLlWWRSKBaitciLbSQgrPzrqc8jQxWsLcTSpk6D5ZZbSQn0V21/bOl5CY +mKkSBfiWhH2g2KvPdPs3i82i0apEM7bmnRBVcn0aJc3oFcWK0n4hir//1ZbXKmxZ +coZbaWNTRnRlBHiRgPJlE0QWI6chEXBmrKFHItuRWv8ATMW3Y5NyhrzSOUxmCAvS +gap6eGETa+BBRaMRMvJQi0NKbUB60yRmoxhmx0qC50y24VVYQF9Ovwt8PH48A5KQ +k0HlK3+sq0kDh0BCum5AO3UH/hsmJFhKMbut2QWelm2tzCnrSBtuUpoBX7Vd/wDj +XIgKTamui6fZS3ep2sCyX1WYl2Owan7tVX7PwjJEmkwgCd/4kQT/ALWTDiyFEhZX +4xixf//WlmVNjdcVYzc26W95cFftMakdqdV/4lmLIbkOwjK4grhKClMg2BAT3cFv +IJJiVQbA0rU4gWyLKNP1jT3s0Ak3YhFAFfiPyy2PJqINo6G4VpWiYcXU7jCCxI2t +GSMoSg8MkWtACH0pJ7gCiTKtR/Mw25fdgA3ZmdR/qoeuWOEtr8eBL//XlYOVNjq4 +qgtUt43tpJeAMqAUenxUB3FchMWGzHKixe5u2gt3kUEkdBmNVlzuKhaTtLd6hxVi +qJXYswH8csAphZknmm215bcitzF6VVMNDsSBRu32sNoopnDqFxdT8o2VpYlJSWM8 +1JX7cTsvwfFgKQf9KyUMeCnuRXJtZKHluHdRGRRVJ6d8IaZy6KNck1rK/HgS/wD/ +0JTXKmxuuKuZVdSrCqsKEexxSwzUYzZ3EkM3931DHoVPRsx5R3cyE7CBkjtIJEu4 +7VXod3TYimAE8mzYb1xJvpvmK1uysC2jyb0CjcA165MmmIkDyDJ1e3TjaxqqMq8v +TXYAY82slVR/UcRj5t8sVQB1CzkvZ7RJl+swtSSEmjCo5fZP2tj+zlgiatxpHdVr +ihZX4sCX/9GT1ypsbrirdcUsa86WUlxaK8RpJQqD7g81yB2NtkNwQwjTNXkhk+q3 +Zoo2ZG61xlDqGWPJWxZDZ6xp1mjPGyo4JIKjrXpXIcJLaZhU0O+v9T1b63CCYQpW +VzXjXoB/rZMig1RPEfJntnCscf8AlH7ROVtjz3XoYLzzLJqdtIUEahCVP2nT4VbN +nocJkLP0f7twdVMA0PqZXY3QurSKcGpZfi9mGz/8NmLlhwyIZRNi1WvxZSzf/9KT +A5S2N4q6uKWK695ht31VdDhAdlRpLiT+VwvwRL/lU/vMZx9NssZ9VJFLoy38lfTB +I/bIyuMqb5RBTGz8paclDLHzbwJNPuriZlRjDKtPtYoEWOFAiLsFUUGQZoLzH5gE +EbabZPW5cUnkX/daHqo/4tbMzTaY5DZ/u3Hz5hAf02MwqAgAFNumb4CuTqSbTPQ9 +Rht3ktJ3CB25RE9OR2Zc12twkniDkYZgbFP6981TmP8A/9OSVylsS/Vdf0vSeH12 +bgziqxqOTUH7VB+zk4wJQZAML1nz7eXgePTAbW0G3rH+9c+3++ly6GMDcsDJiVhe +mDVobmQkgvSRj1If4WJ/4LIZBYZYzRD0LTLj0pmUkGM9K9QcwnYJyLiEblhQYFCS +615pmBNlpx4MdpZh9oDwX/KzN02m49z9DjZ83DsPqSe1Wg3qSTUk9ST3ObyMQBQd +XI2jhQU98mwSqaZri9PpiqR1VT2J6M2Uk2WwCgj49ZnGnS2jNyQ0VWr8SnkPhr/K +32coOCPGJdWzjNU//9Q5v9RtdOtXu7p+MSfeT2RR/M2VxiSabCaeP6tqM+q6jPez +E0kYlUrXig+wg/1VzJAoU1EoWGUzIQ/wR14x07ZKJtBUJIzU17d8hIJZzYSma0gn +3BkQFvmNjmBIbuwibFt6lqDwx+hA375huf5R4/62ZGn05mbP0NWbNwih9SW20VPi +PXx983cI0HVyNplCtMtDB13MUh4oaSSfCh8P5m/2OCR2UBLJ3A4W9v8AaXao9/tV +yqR6BsA6lYnH6tIoPccm7VqMA5J6v//ViPnDXv0nemGBq2duSsdP2m/bk/41TLYR +oIkbY/xAQju3XJ0xUnWihRsB0GCkrmAK79e+EhU2h1z6ppUECCrgMC46g8j8K+/+ +VmPHELMpN5zERACVDVbkTCQU4jbgd6j/ACm/mzIGaQOzj8LJNPuYLqESRHpsyHqD +75sMcxIbNEhSYxdctDBL7mcStK0Zr6fwIPf9r/hsgZMgEEW9GkcfxXD/AGj4Vyq6 +2H1M+aK+rp9TNv8A7srUH365Pg9NMb3f/9bl5JA5Hr2+eZDBch+GpwhXU5GuNWhW +ttOvtQeRbGEzNboXlIpRV+n7Tf5ORnIBkAgSjvuxr7nBSrlg8cIitoi2lltJRLF1 +6MvZh/KcnEmJsMTuyAakhsXuYmo1OIXuHO1PozO8QGNhp4d6S5HMEAP7bdMqB4Qz +5laDLBMgH961Ca70r2wbg/0l5ph6xJqD8Q6t75fbCn//2YkBPwQTAQgAKQUCVtsP +xQIbIwUJEkZ2mQcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJleNSIa2E3/ +qzcH/0xVu6Mdd8hfK9D8eet5VweB64YheqrZbjZxGkqDYFxdgDw/zjtBJJZtm2Qg +bWsKuc4KxiFuQxdh66PMVqs5w9DkruPd013KUQKO/LEN0d7dK2vvyLMJYCqT4Hlt +tzFKCjQdh2cWB7axYmbqzGfVs/amaKPQUi8xdrQx5NUmJwNyqOTxiqf2vN4hzGg7 +4iV2/hjRHZL7uUjLxXYx6+1udPbNtKkue2ul9IDR+880iA9U9+nhV258Y6VfJmdC +SoELQaQ8DNJoZVOicqnC8Qb1u6Rue/2bx2uCOhnnpaFP4rmdFYUkauI5/htwO5B2 +9EfJlzXsEYuvRE270JVSAo1oRByJAT8EEwEIACkFAlbbCyUCGyMFCRJGdpkHCwkI +BwMCAQYVCAIJCgsEFgIDAQIeAQIXgAAKCRCZXjUiGthN/8K0B/9nam8iQ1ZmSlag +cNgAKpf3Bk5O20nV3XbZ28fYnBp1sh2Gv0dz3IsqRgiPMha+6YqvVYZfA5g8Sp0A +JAPpSIIWG3R0oz+3NFLjfuiiGJYxjgJA+QONCQhQfX6Esq9igcTjAgNSknXf8opi +pIniufjnx1mxHGRUXrr+YtbzEUKji0RbKO4xXeCH9GSeT4otqkkKkhx79t4AifOf +sMNLPCdQACK9ulOecIPeKcwGfN5xLj7qWCwM8Vn6XwysoFZv7G2feiB3JZLmbgmO +MFlR3Q90d3j2vFW2wEHT23j7xYkNYjwL6bLqjyhPWmqA4FhDdbO2TDnZiaqQF/sR +lAR02PAEiQIiBBMBCAAMBQJXNXaKBYMHhh+AAAoJEP8fQHwNPCQweyQP/ixm6TzT +BaBb1/Oy8L9KyTZ5JFq6ZVKcMkOFgzsk5yeA+v/UH2maJ4aB1fR58ijuSGsELTji +jEVchUta4jyETfR4KtnQXbxnKQqoRMbz7wLENiei0ZO1MIXrmofsiUZQZcefnb4T +TZqpaRqtYgOuS7MDmufIdVg476TnhecqKre35JKCEtrWWgBqOdCLvNLVjbVrR5sQ +oVHEkReDDGif9G8Rz5+ciSqlNMn3UjcPDWbmj5CvrzYLkt3bsUwovHQ6I9w1BwjP +YwRLiR6oqtkHda0M+yCEmwAbcat5s43YAdF9BPOjDNcx0Fb0sOrZPsySQ2IgjNnp +kc/1SaE9eTWrTOLkHy9tlYznuLjDKLPk0GjNWDV+042uc7iui5aX/6wH3A3yxyB/ +X3n5fxAc3Xr03k8pk7D7bWOFbgRMi1dw2la5gmq87THQ1ZrXGA05d/k8cOM28SQT +ahe/zmjT4SAvW+W6zNQW2hX98ngmx9ReiW/zzmQBdnISziWc0vvJo3vuaops9DXH +jvQfrpnwXSOjM1fliPftobeeMr07a6ellDY0sVNlu/thx9xTcyOE/AgWngiTnpOY +wZ4h9iVhXMI9l8pXFF+/uy5sknJTXEr1m6iFHfmpGi3ADi2ZpOZO1JS+awmmwgAI +TjawPAwE/BgrRxWMz9gS05Hj/yKo8VY8VWV9iQIcBBABAgAGBQJXOJZ9AAoJEO04 +c/XTJiciR0MQAI+vqI4X8wyVzn4pbYAUyz043Yy/iK+jaky7egLTDR4DUCrzHRuR +C0Im4daqVJe9Bi1Do3rb8zqddC39Jgeqiu35HnqOln8eXEn/BKgCz3NLDDjcYPHp +6mQiaFY3BLh1PebKU7dxSsCeXXs1s198i1yz55O+nq1ah1Xia2GA8N45UYiCivSp +9lu0ZiOUaTG3d4ub6KMizor9DxKfM4NCHYofX3v6ryiuLWhq5a2XnhMmPhfemjcf +Hey4rtQEleonr7ohCxKu8Z+GpV3M/wdFhClkq9pXvAageUM2xa/d2Cb9NlwLDnh5 +RWi48pQzjFfvG76fjm6vRs0wG4iPSeKjNo34WPF175n4feO9snnfMFAdomWBmUP7 +cNmozymWeG4etOeumeT78x0X2ie3aZ5nkr9rRnXz4jiiX7jQ91+xNjHtebkXtyEz +9LapwUjeGzgefxhnxYutG1HV2uYULd8Wy8F0p20uEfRtPAuqdtMhQhQB/MqtUlKv +N5TKRQx4v9FtUNqz8tfCYM8jjytyG9F+G6t6pR/v35V36mtrm8vbCqwBKLgnY89t +eXN6bBNpJiQiPI0q3zosbUwJ7cAOMEf5NdqpU+LJ2vqTzqLvSyserHpBU9GNVER3 +Y2mtsU9NiQoxQVSgAaz9ORuyD0I3Do6l4YFht/WeZItV0kdooULUvFRQiQIcBBAB +AgAGBQJYdF6TAAoJED+QLCdu2b4hkpMP/ihBdj2CR95ZU3PuV1DcRtXnNpt/YVZt +2OB8Kl76dQp+2+9Ci1Di+nVH/Hb2PEi7TDNGgnycWiOcbJfy8N1nwcvbO5jRYRWf +x+AxbzgLKLB3kVoJG5ostAJ1gLtOXzN+43odS0zCf/7QVx0V91y1DSvQrw3QqY/y +TujzuYItoodurZGxiy137KF+sZpmnW7kY2fYEqy9Cb3K9BBoltfVjMt0WQl6UoHK +oB3zHpDE0zYAGWsZDU+1LV+P3+jNYiLisjLPDwp+sExLROqf4iRxehDLszYx1Ztd +ghNmQtDH06xZuLeewhhW1so4eZoyJaJ+nxjsFoQsm6HO8adqcCDnm0GXpWPgX81r +12TN0TV0B90V9AU8IGW+WDSWV0nKvU1YTd/1vCpHGtnT8L9fmiLjLi7HkBSydjuv +mMK7zAg5784EEE6Od37pSkyAbJSoTNYtvA6zQQIS2QAfHmCxO+8H8JdAzR8FBSRe +i+TWt0n+LPrJEmsDUs3jiEVIbn9jzSSgxa4P176F2t+1C2a91Kaam0AIj/KhHhuo +dCsZKTeT8S8x91FNLk8tvfdsYrzWT+l0W49wRgdk8VWLskxng30piERZNCsimkax +uwPRchNRNzomaOB4xNvdc4AW/0SBUYA7E4RruD/AI+vAjVuACs1oJ1NhECasI/xA +gAv4tvkHpt7diQIcBBABCAAGBQJXQ2ioAAoJEJTTNqNtFZMKLf8P/2yWBCq2CgIE +5vRZAcRkV8UJM6F7rcSphEH3rgfsU1jobxVPQst4/pacx+5q7LR/heBwhUzC6jT9 +Rwv15FljRFpG0dudXTGervEa/3ZWD7Z4qtJIolPFSOV0ozbu1IZ7POmnQkisNxru +1uUYjXpUVuiPa0MFVWiy2oVHquY8Y0Gb/CUHPMX/gAETgp+mPsOFjcN1nu30kxHO +yNw7TRWKigI/iZWDOlZffnZyIGIrvGXor2yTdZntEb2FjiY4K5140cXO2g7WNEu6 +ZkTczUU+eQ0SvOySc3oSOOZbtx4dngsQ41w0oLd6MI7H8zjTk7EM/XqzXdL7vwSw +tamgVTadw2FSjGdcMyUY8o8zmG3O3wI7SCdEGpBD/E3fg/OHgbXUYDvpejq4bJSO +b+mjrMoLYd4hD67mpl08bpSG7eUDXRebp7hOQr8lgL8i2peuyVSO8S5ZH+5R0yoC +iwG3BhHCJ9fC50iKSPv5JNlRfxM2BBzpidA+dQ92KBxREP82AmhEZgJ5OC/rBBJM +OJGkwr4acf1eiV2Ot4EV3yek3ttVR20C+4PwzqjjvWiIavdRguQAahX2Tq0DTWxd +E2XroNyoqDazPBmwH5P9gDwn8Nm8FZJRHyuSkUPL4cB9RG3aSWOgCRoaYW+TEW71 +w56J871ENbdxicikBmnOC6Wxrfz0FnO3iQIcBBABCgAGBQJXQ668AAoJEGLUj60W +oN4BDRwQAIEzBuFGQQxl3OSca76ImRHJc5e2ocIeho9txBjFPHjZuwoAfnaesnNk +1Rl+Nh0I3LM6QnJUKLCUrnPRxoRFCabU9xtOv4Qsexxj92H21PwiPBWI5ky+uCwc +LRl69Ranl6ePNmVSz6cSm1S4is5l9Enw2ZIwdJulOrhxAfqD71D861co2Xyp9uvK +lb/HZ2uQXPtIyBBo/3+DCQxnym76ZJlPF1O4E6++Eqr8X1WMSp/xFKEAxGX6bsDV +doKuDer9wgwtliKPP/RDXDv/TgsCBcrSKF9ee0EW+AgnEE4cb1qJmfXpHJm7s2PM +PtMTycGOBZXQohPDNPuyFHku6SRMdu91FsWn3zZzx94Zyss1sj/DqCUG+XzzTzxT +ULfVsusOIu0JGSy2d+VAnirlm6eJ31/47qlVZBpk0gXcD4Udiilx++OjpNLWZ2ut +sb+RIQMh1yEFukpCkS7H5yvHs4Oxwnv7I4EOrAo3LJSdCP5vU7M4bzaym43QWdZ3 +53SvNnosgqRdEVGFWGcA1/+3L/QvqHYFTagPcgxmp8pZnvUSDl1xEL/wGNrG7bi7 +NmQKMpAzBkQ4YSu1N5XM3+aBikQGtz/F8j4nZxymO94enQRtYNkX7m3Kayzu88Ku +ZyrxgqO7U9EUS+Z6hu0ggLPChtxaZbefVfabQw7+XywPNLaZbiQ+iQIcBBABAgAG +BQJZHXjvAAoJEAqdr2cTuGNJF4gP/2vjd6oJnKpznGiMLZ5vTW+ogc/cVVD2dtvI +8AtjomA0ix3qhBqOLRaHS66J+PvOH/58SXQPpCHZNQXBv3vD5zKx4J/oHeakTfss +IjzE7s+BpQpxz5ZtLHKw6Vc3DE1OgszpE7pgmrHUPZnzmXprCQPOgipw3l4igcsc +MSeAJnXE7tQYD+Pl5op5LqbRbuKe3lYJ3uxZDCiq7SiVf28Z6/WypT9nfkfYd/Hm +CfzLy5xTPSDsuNVNui5Cgmew0Cf/C8tEUmSLN526Cuy4PFWSHmj9qF2dwRn4kfp2 +54hLRGzZiX0cV/bB4csD99poGkk3Np2d7mOLtgiIJVWSa31hbGXRmF2aVIUr1fuo +Te5Io3IuDJTYTb2DbOiuOZdvcU7HOfZeI0QhfxYHDMEK9n57rp3CvCmRohovz+hT +tNSGYXFYzKln6xnZ2FS/o6i/gzAzT9CImJxH/9smAMMtEaeHVAkwBTRxSG+ozRw1 +niWnfgS9hP+ChtilqtjSnFz23Gf0jZxJxaGMPh3v/+D1YefCj7z0bhmRfe2zn+L5 +dUW9yv+jknMlTS+uJsbDdAj5cvkh2P72M0fWqz4iLVEGog5jYfhmIIleX/N3TcBH +J45znBoTom+j1z5UJ6s4GqVfk4RD9WoeYI6nvHHtNHW9wea4OfDy5uFDOgNUkdE7 +xOffwNBDiQIcBBABCAAGBQJZG5lsAAoJEOQDLcTvDPOKe5sP/2qo26tzH/1JVXwV +ooIqUWnlv/TXvYm+ZdvP+inIqbh5Wd+UL1q2l0gLKk44AWAVRNWij47tMqjXXq6i +cD2KH1xvT5z4OworFt/36q0pE7uipTJE6rACTwrhTA/Oc9rmgKw1bE025U4cnAuU +IgM5QvSQwCzHF5G3N7yEweclY5FFDizx0AYC6OupBywFs0QhMaw0Fb+zZ/2IYW/0 +QxxEEEy19yDZVwq/90bu1YqYYGXNJQrds7j/9X+B1U+Fc0IwugHCRZi4oFR3YEKK +FL3m8CvEaUJGhIcmJpvxYvLxTxjRXFihTH4i9SEyT+pKs5zclF/yEe5cyk3xhhj6 +Y7AUD7BB04M51QloX5jKZ0R7+qtwV0pvrSmDQf+QCcmbBhdJoUpRcKn7OH8ZxQFt +T+54dc7M8PdubXr5O31unvXmcZRGex/yBW176h6seEzy+u2G1YHUe99Y56dfcsbV +qy73gEmTetgYVLArp2js3SbbqZdtcWabtAz4HzEQ+M0zzzgDXpZECh16IpyklYKH +fGaG7mj82FghcmnOR1GOXIdxs7nldjkgeaT99cw16ODj1QKKwqWX6GJPPRxcsiYT +HCPtWIief03HAQu4WTRK771725mlp6HWTKvUm8BLIuATrWVdqMIoalHwQys3efJf +OGJGVHz6zylCjFOq4TsQa8Gju4WMiQIcBBABCAAGBQJZHJMXAAoJED+q0s1ey7MU +U0MP/2isC7IgIm4si7UpeQcJ1x3iJhGl5XWvk1HtvkO1SjurrFyU9XNSVmFZRRFk +wZtfiyoEJs6tD7COKOHwwj+CYFtricsc6DSEbqCtk5/Zk6f0yuVCuYBkeE0auZM2 +clwtiJV7Xtqk3VW+hyjaIjro0LmAof+ttJtPlsboV16VIwieVMFv+4T2PTGEkPkg +VGHV2kuMDjt0x9Jo1RQUb3fMs03na9X0nGtqDt0Grr0lVAx0Igkf95aQ4ii9JnCz +GkeyxwengUJj7fcLfBwoRTrNnlaWk/GfphgT2IRjMy1hqyi4vopdMn+CyXqggWld +HZj5RdlVNSM4mmanWowa2uY9fspVDKNpaE4PmN55hdQnKAuDe/HVE4c9KxmKnNVW +JGvT2cDL+/mS4wNIdV9nQjbJ583XXsijhjFS/0EfA6xkBAdd8/y4Vk4f3bpAAWIy +VzvhRh3m4BpXzhNvDlfgv1t1s2Meo8izurha6zCqZHsRcQpP/+AjKBjx/v/H/qnx +8IbQNy8IYmDcqhP+DPQGC+Xdf/TSPm8ODR0ReeXxm5/3UV8Ls6bp0r97jVtWtDUI +BkqTaDU5xCGGMvxqHWLv5FJnH/cvkVuEiT7jA14YROXhBZubF77Wbfdm/2NTabre +ug7DST0CrsgHwogx9Td207I9UYSPHp1z0aLIs9jZyVh+/suuiQIcBBABCgAGBQJZ +G6jVAAoJEG8M2ucAtomd6OMP+waj7f6VlYxOrgFhRTqiG6Va76BQ1fOFD+yU9QOV +am/KcHhxubarMeNzRQl3Is7XK1a/OTIINOq+cpHfkZK0LvEXxhYkfL3oh5ZVzKHM +AmdYFoxfehUcAtGzoQVIvg5YLkqeHpxlhoiP8UMDBk4bHXl7NFR3w1cxbrl4Gd8m +zaIv1Oba+ZnkXjm5K6HL6MLVzthj0N4kvpP/leiDxgjyE4qB71V6dKAVhTnNwep3 +zY0C7Z2h0kB7+indNmukWC+le6zKjmvg3fkM7YDqSlS02Hx/bM3r/81s1jT9aOAH +j+DVwu7XBQIXISKT9tYwySslc4bCbcAO9Nnn4HhWZ8Y+vEgq+LBGHMLW2hJZqp2c +d6GrWFlmqb/iQs+h72Tf0Qk03c369vFyIVGG++3wCDr5Nsp5o77lvsgt5/yByAV/ +EB/uhYATX3e/X5IREUhaLBMkGkDY3l4LNYyZ8N2dd7HOG9kdpZuB25YeZ9itboCa +Id5KCnAINwrA/LcqVjve3sv0l8zzIvhs85YgjTyR7Jc1/9JH7uLWtw4bmH30neX3 +O41/jWxonQhgd5yRQDh/cnqOBvQxXUQTv9y15mySCBZ0brcWwMwTx4AQtTq6k8co +jOvCGbK2t1Siltcc7nyYOSW0Pbhkxsr91TlBF2UtLpw6qGqD9mxUDCFvYWrj1D2t +LOYyiQIcBBABCgAGBQJZHipqAAoJEKKrCB8mUY/ulb0QAIq3fUQ5F1sQFEKrz/tC +vsOb6BeqpOBbZqiCPX5wL/QpFEMJnVmk7Pm51opgHrNm4FE2dPlsotv3WEsSLAmO +ImTCa0MS1NQvZ9KM3q3xQTKyM7M8gMw7sr8XMc8L9uXGjFWcbUXrD7AFMvZ+bwCL +Voc/GH63StQJkwVUW3Hv46Jzhi31dBhNhm0hWkcmGYCPsZBX81a/5m6VYD/D+4hf +gxnPLM9rAjWt1MUvvRyHRTTg7L8gtZKmVcygeTd09l2oh2WM5s43EonfRzx1wOwC +X5GCkVZyL8z5QheO+O+GzL5OzggVTLbgycNK3iiot+rfiUu7BbV9UbUMDXMlFoLB +7g40SJh72Wucc8EeqIs8b7P/FYHT5B3uIUpqjlUv4O3q5cXvA3hUi9fzgCo/86Mh +v1TfJ4lYY+UFwI5SHUbyNt0wbA+wlXj5lA1M70q+U8wlj6bJHd6BmgURkaSQdc1D +nm3bm3gE9L0BFfVWXrcyyz40pNPYrW9+bxWqU7er9lsn9ZgtyLnwvRmMVhLzL7Mz +uMA0Tn4AT7+kAZNr+2NgeO297frNY369ZYc+XrD593lg2OqXWDzFcDEOd+1u4t6d +slXqyzwlq50hKfS3ogzjJoL/8Pihe/6JClgYOb3bPw240Qm5OBKek+XFokK//mTJ +L7EEqN8pT+ArWRdw/mxbpRaIiQIiBBMBCgAMBQJZG5DRBYMHhh+AAAoJEMHtu5yk +AP1Qs58P/iVRPCtcnA57rB5E60ZCHg8ZAj16/7I5+NTq67LdaGWpX8KyoL4kiXVH +VdPdAk45OHpcDGdmBb+UgfgNeCPugBWfL2ZRmw0K6BJtUcz+kDKKqxUtDWiTOgMS +vDLmW5BtBrebx9dpemZaZGUnu+j+s5aEiMO8ofmQQqXQyteh+QlGk83FLNY04B3Q +yvxM7poNgU6sEDG857ygOIRbbDh5PMHSstweU1ArMkfs3/cnOWOdHnn0b1Q1SRkA +w9K1s0cY2HVJjxM/HdcUqFaGRh78PykN5IFXh0A22xha4oJKVNJIhDmPDw0nJwKw +OjO2ZbxkJN5CsQASym/afsfJ6Ws8ehXP4eV69fixb7suhFdAYLXTL/PJzXJmYBOY +0Qvem/C4cHpAwrR9iLID7pO/zM4dS9VvAR4hixS6q0+O0wEvnQs3ixvIkykf2KBL +4C25f19SViRw8/Ys+dhgCTMv3836bIp3MPHqz3ZCe+mVnrY67v6Z0ObvXQ0krCju +zIpGUT5tKaMsbNqqSWltr8XlMoiWG2RPIB2cX5QZ6R7WTIKcF5hanspvOjf0EtlR +xWD0iD3k9pOAOTLUA9kb9L5h01s1zFDQ4d3hdOhR4+/7/K+eFS7JF+kX6VoqVGFz +Sr8Z9WHgFPizbg7mrAdWyGEW2f33pRLJ/E87+XYCC8xWu/5pbHWHiQEcBBABCAAG +BQJZKDh7AAoJEAPClpScF1DFTyoH/0y1LVfmNqr/Ep2HpHogmCOj4YAAHDC4clnO +gD+ZcRz2hfKUUkq6Ra364jWhagYG5UQChVjrBMzZcOL8iykvE315CbsYU0Uaanal +WLub06YisX6ph5CQkkApGXzVtbdX5lJFCSwk4eYha8RLyas709D1Gtx01PQ4aQsC +2m1dBJEP97ie8P0lWe/aTMsR/Z6aVkBcMRu3wuoq6OhdL7bEiZIjU4EV04j7UhoO +YVEr/a+054CMPHNJ9KN3u8+jSyywndVUogYnxSFHhginoikCtHy6+4//XA9OBUmV +dI3yRxs34vDV2nGru3GI6wSZy6q+iGCFGQeutN9CL7m+kyBlE2aJAhwEEAEKAAYF +AlkojKwACgkQnEn0IUcIVRhRIw/9FcP0kGv1S+IKN9GbcWvP5ENdl5BySMKrnLQl +cB6+w4DhGhsSX4Z3k2Do34u8nsE0wWq+SYLI0pBmByvdwuVvXu/Cfhr0g3uF0sHj +MR5sGtmKHqXx9dP6Tf58H8TZJ703l/6ODhoLIFKaa/UxkopPBOXJKD1nxWe4dbVk +NeW7Ws6uUFc0ruCEomCuVDRkSqrX/HiznlIk+ZhlTpIHxkB0naeaS3KCXHZioB6Z +zR5CgxwJmGyaztgZV6JYSJKG8nV0qPaKy5XCbsG5XSXrRNkJar2AnwXj8zrcoKBl +AdMHWUDJQgTtBAuHlLbK43iBux5InbwPynPHmzi/CZLX9f6j9mLLXglgaWwifvo+ +WkjmTVbxPInHhYts43AdX4rlcQZWhU4hsV1vtCz0bwd/nPNYYg6Def9Ouy55a7t4 +8xhdGEn/6HpY0c+ZrIoTWlrSpHU9x9Vn0WW1aTxl/fRaqSjWIf4ZxAMBMHd+B85h +FiL//SX9FxC3aoGykh4PxeAEAg4bHmtkBz0j7sf61QK8PGIIDJHj6cKrRpLHaOAN +ysYpRCGs3YuxX4ebqyVoec996Ue1H94eRvRNhFW4AMlhBBVRA4tGs9Dt+wNSvsxk +fnaIWB48IIqdroVhgY0XqZkLGoUz/w0zlKvHnsdeu5+lgzhXZfFXEbE63pbmYNx6 +rp6YebWJAiIEEwEKAAwFAlkk9CMFgweGH4AACgkQA+K/Hg+1K8bnPg/6A8uDMlmN +3ldvwbPIgiH4MMHqtqF7j/SnD/HtwQXegP97PqEvyWEqIkfYQa2C+jw3tDAbHZuB ++cXZcKLBx828zdNXW2ayxdFGDkDT3kMHA73NdNL1Vtc2nwIJOCB5J29nLLj7thrV +oeezdtJnbk5bepYMxMLQ9wPUVs6L7LBKzRB3E0pfveFd67ou5FCkWADjob1CMgjt +RPucwU+9vNxlbtpvLVMBEmcykRvQR8GcevP7cxnwQUU9HUO9WayXpJfUpFp/vMZ/ +hARlINUlunvbv/4U/G6QeJTptaFuEdApI3vsCL9OiQRE87E6VFJDiP8Yb1o2AyKA +QboNjqIoUfLFgHQ4PZ8GEyQ9+QHl6r7lE/YPZnxXtDCc0hPrpSNjAND9fJfYp0Og +weqIEodq9TAFElN7euynO+f3dGUzOl192zb+qYc6CSUgnwaLL8lRPD5TabnQYXV8 +f18wYS0nfz3ELp0nwj1FE1TptUw9WbRFeuuqlMUJYm6a2oGkkg0k1d5YLeMu9Nle +0cMF2S97sIbsKNdJorsk8o4BMQ1Nl2aDzyu7Bp0mjG5beRGY8nqA7mamh2lxGFbF +6hiOnyF9v9Pk0bGsmt7MIyq0R/Db0eiA2zXUwWgLu1DkyL8r3F0xPYD0Kq5FrGGk +Ts78wMpz/g7BcQ5sZsDJ6pjR5XQRBOSj6/K0SERhbmllbCBSdWdnZXJpIChodHRw +Oi8vaG9tZS5hcGFjaGUub3JnL35kcnVnZ2VyaS8pIDxkcnVnZ2VyaUBhcGFjaGUu +b3JnPokBPAQTAQIAJgUCVzibRgIbIwUJEkZ2mQYLCQgHAwIEFQIIAwQWAgMBAh4B +AheAAAoJEJleNSIa2E3/6voIAJJozyy7ECSeN+e4hLdgeBXxe5lNQmrpUYLLkFlT +c9zvFJOXY9B2oiTkoXzasLbY/2NDJXN+PAVu8C9LCduRPxmd547LCX1AE8dxlKe1 +D/gvwgnpIcqJGg1lW8f9zurtjuJIGRElwJN37WO87lLqK/QedQLsGhS6K67sRd2l +oOkQ07jnMo4K9QBYmqFc/lsRR82wWFNjGq4jA53t6AmeHqpY2MjPRLhiIIIUPYPq +QwGePR6KF33W3F+CAOygUK7harbg3TYKSEC6CfU7KHmbjmwWR4C3TyTXEReqQcI/ +kMrvH7XbiOMryJlsUOEhLRE9ghsvyWpZBp1uyLPjY2LtEkiJAhwEEAECAAYFAlh0 +XpMACgkQP5AsJ27ZviEYnQ//bXkE4o06RCIq0SYWrCpYzfI2i42tHpALrsSdZNhb +rv8pVJKqprOPr6bbKMiv57bmKjUcfpNse9m4Rl8IJ6mpm9VRAlj1uRTt1PsVUa0A +ZiPD5oFdODeG8Y+1UTUrCJOmvdq0q1yuvDYEPpKtae5gQah+y7YzpMJKqwNu+hFy +3q7BG1sXNTCbDM7po1wYT9yuQdROmAbz1ETq2WKRiA2v88YQvv5wQ2RRlEPKXQGA +vQIKoaAq5ZSDyBttkjQLyn6ITD66+kUSgN5jGeecLqKqd81uOfItrF7ilVq5yxw5 +aW+f1auJtoMVnpCbnbVPBSGns1dlsTjw/y4NFTrnIO7kIDLYcvrz4l+7gc1m4iPX +lgaBx916oWuf4eaD/1k+KLVF7UzcXy25eqGtVEjh9K56f/C/8GjkqM2VCuScW7Jv +8jCR0/y2qivkwvyZDqtkC2dfir1K3mMN6OhdzfFsdEUN4n1J0KfaqrUNgoWYjdqA +KqT2c9896v71FDcWFLHcCOdNma387dtD/ekuuk70xosVSBZ1rVg3FF9mpSDCJqu8 +SanNRxuPGcbdNbXpmsEH5Syb5sTJnejV5LfZsCr7ITGukEtbHH5C9w3Z0L3Y8aGE +iA13lwkr871Rt2XZ3uz5O4MHp6iiBcfZQXizjPUFpApeJf2wSzp4gWZ0J3tC4cqZ +XNCJAhwEEAEIAAYFAldDaKgACgkQlNM2o20Vkwpkng/9FiXf3F3EcDkwE7Ur6OfL +3H3KOo/2s4WK+Tla2TliLJd+UGiU+1N+kwItPsV8uNEjS388zDqyRTO8TeX39Vpz +bI+ehNxd37Xnqnh2PiBcnAqdzvciQxJFkZzZuQGuYnlCp6pSFd4jCUhDBbeFEIIP +5eXpJOUqphcDl9wKCBJf2Zgx2izax64jzdMtnvEJogE4FTdqRUBwyclHgWj+d347 +HlIJ3vVnSiWlQAK3gFjNnBLqtkOwazigHqzkWZnQXu3HtZTELbUjji+d38ULKZJ/ +nzBykiqKCnl2y3J2Hx58eRmKcM5U7lYZwKW9BHINGDu8JM1Wyuua9Omb9nFL/ROo +CUP1BwlgYeH5kDqdbRb2YL3xoyZs+juBes8Os00Xi5QfwgOlfb8McmhogZy3ztFz +0EZGqPmmG8YhX0gkAR1/YvSOwmS3br8c3ymk/zDZPJRDRPu6ASB9wxkXXkAQpj5P +srO5jGV/kl0XsDlKndnxyjOqE+5QkkeFEM8b9OpF7ZmTdGxbf5ssfy1NXC62iZ4j +7BZORjYWN194Y9jEl6YZ35q0bGfvRUp5HdCpMKB0X5Iz2/ZlkPCcfILUTspfLm9M +VXCnl17KCIKXIFsWmS2VeqFgLWHPPgtp8BM8KDKVWYoGqXzJLWnv4m3wmPMKQXIV +LBqNKjOuR9Wrq2jFoRrUgHWJAhwEEAEKAAYFAldDrrsACgkQYtSPrRag3gEjXA/9 +FSwSeHUccComnRLTTRY8GIAZGjEckRKKDS0bWNAqa6fbCAO0wQUi6vKWYZX8671N +q7xP7atjd1ELGJQ0T4ZJL/3uGmLqjpI/ptknqHq1sikJGjODac+8ZiSh7YOOvjP3 +mBL+2me/I15bVx+k5sOiRdtpMTXOMC/NS++TmT9XIPFNqSyr0i8OVyKXtsiXcJm5 +q0gYxjwvq/CiL2hco5Nh8rosyqZDOLREzw9eGshgFu++y4831Tnmd6PkfweM2DT3 +HA3YH3NVbtiZknkgXw0F0xBjRWL9C1DEMnaF/zPdO0XTV0CJT/nA3T3XZdCNK81E +yJL+DVdEEkg94tRKAChM3TuBt1ks05K//U/ddPAsM2RtbLTF3VwYZeuTwh+nBqEZ +lRC3CFxibl7ujSvMM1e8L/5P4ZB6Q0VgwRB3pZUd5YetfMTb/aTGSFiK9yThvpBl +wnXizin9fiFg1nrElbtPTQnJ4KZgODLu31qRwod+EZHOOcJNtFfSPwBaNSe9jsPK +fxrwamh2YAXPlTkwqU+Jc3O7XdLy865AMxm0AOFmyuJUsw9DVwP3XhvUe4iSjfOX +FL/8KFcbnj7mJENdqLBjjRntOrBufdlsfdkhBPEiRY2DRIEK3s/RjPu3rKKo3ioE +xHjCr4GShu+9EY/j+VbI3nvFbsKeEqFdFDegk5bipMmJAhwEEAECAAYFAlkdeO8A +CgkQCp2vZxO4Y0nekA//UW4puqD6hWIiSruKOynZ15HuOwgIwS3zibKrw5gMF3S1 +Q6eKAcB2FjEJGMSLXygFQc86HQwlEXhzFMq4+3KTZmdb1q4S0CZ5v67v6vFgvTtG +4NcFZHD6vcLGUAFUhNxvNvvloaWPAG/Q85klLa4brHyu6SKryaZX0Jc7wEAz78hg +jHw0xbuW+6WLdpYj1358meFhXXRyotWGKyX8C7mgtgayT0mIeZY2P8DS79CHcyDD +M5u+o5dppBuqeBjzVDuR29zdPq5EM77Zupc1mc2tnclDa2ZfxCe3W1vrXajWXSKQ +e7Axlw+LiJoHr/mpoHJ+JCzLNgaQa/696FDg36D/l6rMu5h1SoYhUU1fvmO9MmUI +cGJ+pPGvcC/SuOkCrHw2UbKbuxA7j3zjqvO6UU1IOikYul92mNwkYJ7IxDgcBpT7 +6Xb5chnaYyiAAzVvIjoKjWnJXOdNW3qAIP/BTMbDB14L80KDWb7qStidhnDztSxi +gE9PxlxHlWbbtYKC8dQGJLCQEwrARCXBKChXchFMiVeYoey9viwTa0tpxnVjrAsP +pHDWQjlfQT+/kpJTZlkyKMH1ANY/XJ4ZspGwg4BL+8/fzgJV8xOiibVKzeGxymfN +GYrEptUFiGEWr/pzsrcR1K5y/EdIy+N4pagaPYSzUf+BboOwlSX2vgXO3KVjt1eJ +AhwEEAEIAAYFAlkbmWwACgkQ5AMtxO8M84rAgxAAjeJzP9NLVHI+h7bQcGGBNPBq +aQEhcH0xgUefu0BfOPerXLcrB/jubAKj0yhcsx4psYLyU9mVoDz6skD23VHzuyTm +Hu59L7l470CExDylLdmnomfcQH+hrwzWfNkK1kagevn/g0APZt+pFRmirMZHrq2c +ODdOV0wPYoCeuQ1mAcd6HXiis/LbEGGKn+vFlapjSS1YqQH8q7guSJNWrx+FechC +1kK1SPeskpzsZ/sBEWhQtTudyrvZH88Ib7T/K/TMJ5dWi3eQgZsTl0VB4JvWQsJV +Dw9Kzg+kKWAYfElW9o4lavolm+K/bZZP5Ych8rfiiVBRJmAK9W1KpjKzIMJzWq/h +c2C4SZ4zE9lSuJRWrF22Sebh1lkboF/gDro7Wu/LJF+TKnH5kTjAM9TV2T1Y267q +Wo03DhQ65NhtO0qFm663DUtKxScl3pD1IhP+5H03qXrlp7Jzu4FB8BakUWYiAFzQ +h1FWFDusYg731QIRLCpCWYgMf5FRuZXqm+FZ+0Fyi+a0CMWzbVTw2S592HEYvjNh ++dz+2DN96za5jUvsUlTRpGfP+vULEgXcCkyUk5D1DmN3DofLJPIcUXfw3yLuiZO7 +9JXvGcqPew5VG38LmIHNPZBlM2w+Jy2La0R3zdGsohS1v5rnx0aQ4q6FYeUvyFta +IPydQmCHJO3w6ZKBOj2JAhwEEAEIAAYFAlkckxcACgkQP6rSzV7LsxQ+Pg//cU75 +FwlbfMZhG57+K25fGSlSDURID2t84Vu8E7fiFVQLEDInmcLEnBv9ePoKT28HT4Zw +SmOs0ETSfbeQeSHivceo1EpFHwZBBp1mY9QpjWzb/ZdcJvJXitp11IC2cGh9+rSa +4oNDBx7te4aiyli+SRQB/IKJrIHumxhlThAF+5eOeaTZCkPY5RnaV1EV7+vNb08W +K4f6aJH8OKT04WXtYvs/G7TAEqSLJpDujVblGVcQ+Jgi7jSAMqZTlUvOERRH7qcN +0zf0ZNkO7EQnpPgo1sDQBLFkd4hvq7R6o6stnil9iEmqtyn/IjfQ1vEyuCwqSnIg +b2UUNNfxtmLTjKR2iQ9zFCXV+yL4GCiUfjgMhBjj2Avfx0TcoFrGEywDg6zJG6hp +umkAQLTnW1Tp7/GfexIe3ZpibkZMysZ7i//+HbYrm3tXLCkbc4JKM44pfSVp6+c/ +M+mrgTJ1BYBgm5vtJtdy15ZGtDAUedXdX+ikjLOe6dltYqcv3xbYGMxcqK30rgEr +0qJIW00lra0K/DsHB+qWnxtyrse+RCsb8PXgTKgSAQgA3S/tzZeV0fmyHT027giL +5FejZUwLE6Qe1NX3UJVEarHoJTg3PZZvAw90VVnheCOgvynwed/ur/iYy5HGoG7X +u5lTIX3XchTr5LnsEJGDvvKWTQbrLYD7lIyqtEqJAhwEEAEKAAYFAlkbqNUACgkQ +bwza5wC2iZ2aXg/8D3qNdolGQP5x5yPp/WcEm4pA2U1fPpoC9WB/6JZ08Mtolhue +QDwy9swTeCjeS/bVWEkTUCIvgYsCT79iYwCMaUURd1gcGDHw7PRFzc1vI+s9peV0 +ghUS45kkO7yVdM5Lj0cnqaEfdsRH9PEPOJePUfWx1FC1MGpTDQWW+xjcII+JGlVY +5uyNdr1XyiVsSZr/+KgGfmbKGP3+OqOJlGziyRSJNufUzpJ+6ARw0rVHN59nujWS +3DPFcGvjS+xMicmDPeW0KH7r2HhmNJXZYP/0RcrSuHb2Hbofn4bg0s21K7m66I/9 +ckTR3L2tN7xfDDNCS0Pa27J24HpukfiM+mB6CmUUAZhimH5DjCpCAX2IQSWhItBn +8SMqYwkvXSXKYnG1Sga15+mi3OyZwGwci0LG59Q1A9TnQP+sbqB/94ezO0rE2O+d +ho/qfpyVJITUGTVZeiPK7bCQzezJMlqc4RjlBhqERGah4qZBSCMsbB3uU38f9FT2 +Y8lky+O9IFgH2UhpyeqjF+/Zn27dxUsDUo/e0/hlJxFGXCX/QOxf8OwSWDuX/5ej +6Wj9cTpT2pUGA6XVRdzLnUHLSR5Hfv80jXDV4OObs/CAX7WHf5Jm+JWeL8kylvBl +YE1Cs8nb28pGeA72MXANrVN0h4IXROTLwPQiRc+wFSywE0xWumCpChsHZiSJAhwE +EAEKAAYFAlkeKmcACgkQoqsIHyZRj+4sCQ//Roje6BPFmLmBHl9ox1QGB5cpO0fY +SkWeiPrs46rb0J0ywxKX+8KIMJZ+hOLxPnNdC7936PCE2o631Qq23yX8Ltb/8+px +QFthNy/2JAVIJ8TyN8twvV7GpWxQXzg+g/kXwGwroJXarXr/GrBlOZQLRYWEsgEM +1fp1bLVWUr+i4FEDzTcISz2sOEAfMeUxZp76yt+B0dE6n6HskBzHKUp5OQDmzd/d +N+7G07QHq+vS+eLyWGDKMKUKqQukcgzSa4DGF0n7fTjQFcbGhyHGGEn4bMHpsFyE +coIQF3NTuYkNEFoW+sPpcMz1Ax5tTDBpj1P+MZRPOn7Vvk1UqWJzUFkA6gFPM/Rd +XtNI1cgxL7Jrwv+KNi42EVnO2Bx6WCK9wbNIvRKkxO3dDT9PtqWr/N2FaGd7fbqh +jHNoH4O7vyOCDZzK/FaqC4umHFDRILeuzYSpptQBWI8a/qXnyalbOFH/4u6nZpGB +8ddu8hnqpbUXszaLhELAzg+o0ne1mdKhk6MVR4Xl9n4MpRnEjh223TJyK/ybX5MH +nXklDZwIYRPloya+76CmTLQ9sTQnCk/Mk5UMgzc940mqZjaYwVvbDkp32H/rcEt+ +Upmoz7Uyu/0PVitjUPKObSd/wEgBejNwB48wiBP2dhVrUgpICTYgfI2vEfuXbabn +lg38G/rB/6LxP6iJAiIEEwEKAAwFAlkbkNEFgweGH4AACgkQwe27nKQA/VALtBAA +ndpygMjAtdVMAkbqVOfYePc3zPEKmMABPdtxvicRS2B9XG1VWvnJY4lnE/dHbmpN +J966p9QBaqKGSOm4MncIMRvLP2lGUC/dYN+ZhFUYD2wVMY/dwjS05iZn64FiM1hu +697vReIs0ou1VQnD/efOjlRHeAKOWY8FmownJFAZlh3Z3ZlPJvL5RqPck0Sk/cVW +oHiBjmgaefWdY92XO+NC1iORUOs2tPFSifCX6L4by4h+mX1uZI71FswZF5L2xaRr +0F2zSBsY9Tdf7FgnM+kB5A8IUyZDzljW5PeNTIPZfGzFF1SpaZsPDUGTbRgPA7AK +XWh1nUpPkkjA37h+Cr0xOP4tJ9IuLHP9UxuowWW1eVgc4CU6xSExcCxtustkhc2X +wEaEYLVOtXL7AWJM0kGuNWp222fO9ZY04Z6eKU3Vg2INYan2TSWuAaP2Fzz/se1K +MGd42cYT5n+KK84lvIDg1Tr/a+e7jOL/Tlviq3FSX/gUckcTGuyEFyoe9ecwS8Ye +1bsSzA9pY2zkA4TeSV5Ggvyj0te/HlhHDGRd6m6ak60LT1Z+JK1Oc3u9QgOCB/6g +K+JD24BbCyCXYLsSmMM8vXQiLi2BAaJejeyI/faGLkriFYaSmcZe/xHuIMX6uUgm +24WFybzfpJ+SNMNe+YWKXZXKUeGdGoTbjKSq3ZDPMRqJARwEEAEIAAYFAlkoOHsA +CgkQA8KWlJwXUMUQCggAp07Pi+4BfAr4BDVelp+QtMPwaNOkAWoeNtD77W38Bklk +4VtsqOnQY47bUoauKznR8sDp4JrA7565/Ntm3zIqSIUs4RQfGNqtkf3/frj/7C3W +l7pVn3lJTPexImFjk9p99oraH3/KPInlcwIErk/QqjeUQwBxrt614/b5RGhl42LC +SpMfxXyiU7F0udEZFxUazD/2WkgHdCd4NvrW8UTJaD/iLOtmsVGOP9mZVnzNGPe2 +hYspk2Nt73iUNq9VA0ZM4NlvBrwmHsBXL7XJobM6PGfwgV92rvYF3vu9pzKwdXRC +xsy5+WghHOymW42s3XmqquNX+WDJuKZuuhpncMaySIkCHAQQAQoABgUCWSiMpwAK +CRCcSfQhRwhVGDPFD/4rL3ss/juwKEmnSAQLpNOau/Dg+IomJWXwKsdrPgqMAPBz +pkIpQIPKWexUP+gDSsyEP9vHuiy63GICh1WdYBhxhhFeLubHoezn6zhv06Ki+Ppn +OW0IImPS6L4DSALWLCiCrfZ/zAGch139gG5gbvZG9JzO1RU+JYfMbmE9E1z4aZNL +f0Rqg+23pxVes1JIFGwND1t0sQaFOvVJNERnPGnWsK0MQT8xvCZk0QABJxLSdxmo +z6PUCaIa+iGU1wNYjMUYb3mS2nPcrfCvyUgP7gTNXolLbVAGPAMkLo+r01dVL/pU +wuGuw0Bq4mTVeHZ3QabmJvXhef19CVFk7aaPH/kNnGOrYE6aL7llcUyRZPW/9sva +no5qtg40vsQLCTVIpRC0J0fKUEZrjb4Qjt3TwUczpaqVeA1TjVx49pePhZGdcMYM +aysIi+gyK/HU9MdTj55KceaDRJVOp4GTRxKNZsm29FKZENKT3bWnZwCARbTsOoQI +C/pRirK/gqJwgxLj4YLqqX5Ura2UpiQDSfQ+5LRZlakIilDggXkDhiCjM2zV/YXT +5bCpehsTYbV0VS2pLy/8H3mClHwa+ouYXVDWMguzLeziAlZcvfmi8pLWOtVK2AjR +y4dwD0fgOonknQ3AIXVC8Kjd+Kfh1ZZpZuXV95AxUHzNILIF5zUHYjuT1QPfK4kC +IgQTAQoADAUCWST0IwWDB4YfgAAKCRAD4r8eD7Urxvl3EACpR8VFIze3/24Ixwc1 +/luHayr7eSNIFB1NbDlt74Ly6hq9stqY8Z9o6WL/zlwSXIT5wZH8fMt7O8tvNw1a +qmPaclaIUjxcvcoPJUlZghgd2x6Osp11D019K3NyJxS2mPEruT1bQ3olnfokFKCz +CAY64rq8BOf9RLZC09RW8Ey8mbL+oNUbAhO3lC3DALNgx6+lDvoAoRoMJiRzGNB7 +iteRz//nLEP/7rRuFjtyXnsMVFMi36u9KjeL2PTpAiEAPJM/pEekBU7Ap/9gm5Ap +uCmvnhZPPIuCr/AsRKPhu3Chmy3lnkGqFmy6juoF1bbwNG6x8fVwHg/uz7d2elI1 +i1MWd7hbgwG0j2xqCwlcQWXDLdAmEgEs7G6whjb8lNaLTJ9N5+D29wqC5iNjg5ry +i4q18X9RnHbzNNTaTPbg/N9Zd/7kj8Zez5UwkZZR5FbOevP0KklWuKHRQekVE4AG +Wzv3tVFc3ZPyURqLp9g06k41/w/aGwYd/mASLvT5gjFWRQybWNLjrngqxjrUp2ez +wO8hQSz7Ode9YN55eUWyffOB7SRC7QJ26JpiJhM41lyMH7PT9f34NciDaiFqkdm2 +WkeXuTYuUuqWS31vqZy3/Zv4prhDLrxisW9myX8tOLeKYAWOnyRvlreVPwmUWtO+ +h1z06/lzTE9CkPHe6GNaf9SK+rkBDQRN+o4xAQgA69rko9rydX8LLuI8RaXcgF9e +jwT2m/unETjfHsZfMJB0S9XfEh5v1VHBhk1SX61kVWP3WndGVUMW+WmSxGXpMwp7 +aVqnwkakz1NaAjOTh1nJZERVGw0dpFnCY69zqwtJjIMTXdEGhCoTLq7vbWEgPf5O +r5q1L31dblXqfedkXIDNWP7eA983eSSdZiQ2yOkVXf/Q5QBBhcya1xvX7zv79BBB +rU9wsENOwr6YFq2nsqQZN3/Xi854TKljHUPxlUgMScCZ04vRPdfif0AnevvTd1Fx +g/WEJ0e//F6x+iiyNwtVGDbTfSoMDm+PTXibVhZSDiSRBjY9205nX1Cm/vr30wAR +AQABiQEkBBgBAgAPAhsMBQJW2wNKBQkSRnaZAAoJEJleNSIa2E3/EcIH91Yd4yuR +7VDjD/65RoMVUbxs7lvQiJyRyiGn3TW+2WvIFACvZkgTeG/M1fBr523+h2Bd6VAf +NuKkNYK01EuUw2bmwr3jXEntwN+J30AuZcwvt32yBEir8yke5xct7FVSkVzT5ZXe +lZ0aYQg0im2HreU9uqvLIizaoq0xY0u1EmhvXrSuN95fegVY8Stk6lUOolDQzvdj +e9yNN/lLgoGEVaoozX8gUdPn9JG4Mk45DV9Q08u8gXRRofDJ/sILJ/foP3TJgfC7 +vcFMsZn+pEDvx5H6D0rB62lclDYtT48ZzLcBJTX3wu1Gc1t9vZVsCOGfrMizIZ5f +1hWw8puPN82Rdg== +=5heD +-----END PGP PUBLIC KEY BLOCK----- + +pub 4096R/DC55C003 2019-05-11 +uid Daniel Ruggeri (http://home.apache.org/~druggeri/) +uid Daniel Ruggeri +uid [jpeg image of size 13027] +sub 4096R/14FF4720 2019-05-11 +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBFzW1OEBEACnouF1HJ/EYUIoa1XjLqXIONwrclBAbUmmHDTLAIs/6ocOpfNv +gUS0MU8ukgmwWFOUcLNZ0c1qYA10rYWvEmvMSXUUlSlwfad8UcV/rL5KvIk+c6Be +X/Fe84IEGgWksO5kKLS4br1HX9xZpmZPelgdhhPqAZu149xBqf8y2lgq0BqHzT6b +8MvSILCddaMjR+mf+GD5jqw/srJZTnJQNAtFiUOvUCn/z3A8OikgGEOetMaSkYRl +eNTGeq6X4R1i1iyCfj/h0YksC+Tgy1A7JYOBL2wdOGYO8YS+TpUhWmVNWHrA2oJ6 +GamEZhZ/+McmfkKxsAmeVD7prBs+2oW2HyDAcnVIRX+y/4n4EwmSjfcMeIDwmvOz +jy0M2uOZsgSzfIEbnmGrPRM5AavW3z1tx6cYeaYPLKUEpooVJUN4vQih4Inj3m5D +N4gqCLEHNUNMLCZNoZSrrjLesgb2tbJoFghs1rJfiEQJAtY8Q1dXCkcEJVYPybhS +m1w7Ph+5KGOhRqzQAduoLb2YKRsReN+K2PCHpebcprnVkLSYYLKSCPtY5CAk4QXj +EkeAM/+WSBE0c4dA5GYRYKc+J3OdN/DjvouOGrgkcFZyfCq0fJjbXgJjOX1qXMRl +vOWUuIupdnpi+ud+tLf8JyxTECBOR+NxngxTn3Z1hjSCUD82szxmVsfYHQARAQAB +tEhEYW5pZWwgUnVnZ2VyaSAoaHR0cDovL2hvbWUuYXBhY2hlLm9yZy9+ZHJ1Z2dl +cmkvKSA8ZHJ1Z2dlcmlAYXBhY2hlLm9yZz6JAjgEEwEIACIFAlzW1QoCGwMGCwkI +BwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJECqxKnrcVcADuq4QAKDUeH+7FE5qIIY7 +bFxwPT0LsF+SKTT6arXbtMtI5aSf3vlkiWhHXQ3KNs2UGtDOMQxApGtn1NRy/k76 +RJIW/0hAZhDQL44yho0dePbxyN3hes5nKIcoOr4cuHEEO5EnuQxSlefB4bropcRr +7J0M+tSXjwCafwibW8zKsvMNDS2viRnSwj0Ve5uZ5hLs+aEZlExIMiN92dTcIhft +BDj+AJGRIuRMh/u1QQeE6XpDO8vOKqmLgqMfs1VUuO7vD+80HsZg00qfSYlt/KNs +ibhkGULsKJZFE2PPOXEdGzjjsXswpcufYRLqmkKFJMzFGqR8gRTj+RHK0yIjOmgR +/eDMK4iElwTUovxBe9jCI0OT/xPEjHL9GuxIQQs8A8pU4hI/8mvcySjHPpz9vy8e +U4lZxnif5CuNhsWWxQx4rGuucBs7shyULyKeUw/g8HQONc8/GBuvscNBw0tVJO+Q +iYSDm2k4mYwqd9gjjAE+Mz+KNNd8lEQ+ULTKNkMDlYRpdq7Ujs1NwGw1g22XPGGF +ihseLhSOeo3zYReoCE3swPyxdM0ONaIdZ602aapVyWzNZhspcSi9ZtMCq39xrEL3 +3THZvWJ9Kh/jTdKyg5KkDAdMIdKWJD5zNjYW1fuvvdNktPaQmlEgdJsp4fYrGjDU +ANxSvYoGOSQcT0DbQK7ZlcRHUwjZiQEcBBABCAAGBQJc1tbWAAoJEJleNSIa2E3/ +duUH/3QnffSZ85W6XzqoBqH5PbsiYomTzfWvuQG05RcId+vm8lUQZ61G9gk27cGv +4neZnq2SweBztQdYNrzPhm2aMyMmxhuPdwOdgYkFgy63KyGYpl4qVIkAaevAs0NN +lUpDmUSXRpA6zOxrMvZWkAHnAsbNdYg5qYQA5hSV3nTMNmO62IY6q4eG2G4PYEaH +tF8fdHl1qSYxKiFgSYKQXs5QCNG/YBqlUd3NSS2FSAzJu8DM/LXnaztvHy8P/xva +p8hsfmAtbjgNg+AbLUXVxtBi8nO6WrPH4rRw3CaayVFQrSrb+gDaEgfmkwz1BVQt +9IPW8JF9eV0FQZqr2UiMIsEEfsa0JURhbmllbCBSdWdnZXJpIDxkcnVnZ2VyaUBw +cmltYXJ5Lm5ldD6JAjgEEwEIACIFAlzW1OECGwMGCwkIBwMCBhUIAgkKCwQWAgMB +Ah4BAheAAAoJECqxKnrcVcAD0pIP/2DpmVIrfuciY0lMiYI//wovUHPkPXFhRFDC +yWuxURr13ZID45chXDd4GF5DvtsIbzXHNJhYSNoThUQGxm9+Jdlv/KQH30/2mfY+ +CMn3jhO6gCgREU9cElxUp+d8r0bgId6bUfWuwDHfjmZ1Jt9Hs+zijiM+Bz/ak+Ys +jIGIN3eCcsDoS4oFQSPb6gDcZSySC4WMp34NJSz7oSctXpvfEMkvmKAm2eDyWuw7 +cinsz9aQDc/t+YpsFFhjDAxL8AoTQehH1F0fiKOAF54GDNJkpxIJBMCkF7kXpcTz +k2xZI+kpCNj4Sd7t/tdD1vQkaLICkfZf3kpWjHFSsP3Y4gn8/LbUn/ubB122gLUr +JAIJ0YgU/x+JE1RX/GZZZc1kB1rJtHh6qiniQVYDgZh66NbR54BJimY83/0FTRtq +I+QSgc3tacm8hV9pyc2hf26zKGD9ncfAFwACmRKolY2TKb4MyL5ABCr2h/2qlHwR +pq3G9xdOGdzo52Xk7u2vwRrP/Q8dSLHoMEx/zazSfO+Surgz6Ls3f1SEYnzvNqJy +fZyka7obfJz92NmiUVR5NKN5pPbDStWr7D5rKKzaRt4wTTyb0YFX/eDat7a/yVth +zhB14uIGSl9aV4vi5kf1ZwNP996o4abLdEe/f32ht/0TLhHrU7fq2fWi+7ua6WaA +E6LjSxa6iQEcBBABCAAGBQJc1tbWAAoJEJleNSIa2E3/OkQIAJFu3LCmheInFj5S +Z29bx5hSVwQR/SGb8YQhGOKCPwHe+F0OyuIbjrMDCFYlFvsPADpuL880vx7HN0ki +swDeUqscb+9gBhsIwqh7RXLbRUHlldufjjtmWe3cKzafVLD9RsruMVo3hgZmedWp +YaQaWI9EbUwGpgSLHBaE3X3rYnBblp14ThoupymA0u55z0u4EBIg8e/ab8/TYk5A +sZf3MamMY/DctPeGgkJNRDtR4IwtNfnUTW/GNRn0AEns/NFcNHUE9BePJ0n05J1E +RAiX6aV7D18+OpTFOSw97w54Rp1VLRDYfxVkMjEPxRueaJWylCz0cf3m9ScARUeg +kN6mJmfR/wAAMvn/AAAy9AEQAAEBAAAAAAAAAAAAAAAA/9j/4AAQSkZJRgABAQEA +YABgAAD/4Q9uRXhpZgAATU0AKgAAAAgABwESAAMAAAABAAEAAAEaAAUAAAABAAAA +YgEbAAUAAAABAAAAagEoAAMAAAABAAIAAAExAAIAAAAUAAAAcgEyAAIAAAAUAAAA +hodpAAQAAAABAAAAmgAAAMYBLAAAAAEAAAEsAAAAAQAAQWRvYmUgUGhvdG9zaG9w +IDcuMAAyMDE5OjA0OjA4IDA4OjEwOjU4AAADoAEAAwAAAAH//wAAoAIABAAAAAEA +AAWMoAMABAAAAAEAAAWMAAAAAAAAAAYBAwADAAAAAQAGAAABGgAFAAAAAQAAARQB +GwAFAAAAAQAAARwBKAADAAAAAQACAAACAQAEAAAAAQAAASQCAgAEAAAAAQAADkIA +AAAAAAAASAAAAAEAAABIAAAAAf/Y/+AAEEpGSUYAAQIBAEgASAAA/+0ADEFkb2Jl +X0NNAAL/7gAOQWRvYmUAZIAAAAAB/9sAhAAMCAgICQgMCQkMEQsKCxEVDwwMDxUY +ExMVExMYEQwMDAwMDBEMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMAQ0LCw0O +DRAODhAUDg4OFBQODg4OFBEMDAwMDBERDAwMDAwMEQwMDAwMDAwMDAwMDAwMDAwM +DAwMDAwMDAwMDAz/wAARCACAAIADASIAAhEBAxEB/90ABAAI/8QBPwAAAQUBAQEB +AQEAAAAAAAAAAwABAgQFBgcICQoLAQABBQEBAQEBAQAAAAAAAAABAAIDBAUGBwgJ +CgsQAAEEAQMCBAIFBwYIBQMMMwEAAhEDBCESMQVBUWETInGBMgYUkaGxQiMkFVLB +YjM0coLRQwclklPw4fFjczUWorKDJkSTVGRFwqN0NhfSVeJl8rOEw9N14/NGJ5Sk +hbSVxNTk9KW1xdXl9VZmdoaWprbG1ub2N0dXZ3eHl6e3x9fn9xEAAgIBAgQEAwQF +BgcHBgU1AQACEQMhMRIEQVFhcSITBTKBkRShsUIjwVLR8DMkYuFygpJDUxVjczTx +JQYWorKDByY1wtJEk1SjF2RFVTZ0ZeLys4TD03Xj80aUpIW0lcTU5PSltcXV5fVW +ZnaGlqa2xtbm9ic3R1dnd4eXp7fH/9oADAMBAAIRAxEAPwDri4t1CnVlEkt7qBJI +UGQAZCJCrplkO3ArMurMFXbLANO6C+CNUei2Wpcp28FEoJLgi2NZMlDdbjYw33O2 +9wO5/qhBAB6Oxi/RCtArmLPrIWH06WiriHOG4x+9CgPrDnl0GwsMEz7SOUuIL+Av +UvKgx2q5+j60PdZ6VwFnnt2mR29v561MPqeFk7Sx+0u4Dv8AyX0UeII4SHTB0Ra+ +UFqLWdUUN6kwiWOEKvW7RDy7nNYYSU18hzS+U9dzWjlZF2XYbCFOuy140RWv/9Dt +GVAqLsck6KdbuEdoBSJXgW5T8Yh+vCDbWRPktexoWflGutlj3fRYC53wA3JzFIUX +muq9UGCNx1tf9DSQ3+W9cxd1Oy6wlxc93Lxw4T5P/k/RVonL6nkvsgvsJnYNTB+j +OvsYrFX1b6nbJFYYP5R5A7SPoqEz11Z44zWjRqtuO1zpeNdXjXw/zXN+m1TDrRAa +dzdQRMnbru/zFs4/1Wz9o9RzOdWySCt7D+q2BW1u+wvsESYHKHGF/tl41+Nl2Vh7 +i4Hh0e4z9Jvp7fepV321NtfXu3QA2s/Rc6driZ/k/wCv84vTcfo+AKtoaNxEFy5n +629Jx63MLK2l0ECR2/dAA2tRsrSAk+rvXGZBZh2v3PcAGHXR0fzf7vu/NXRs5Xmm +DbdVd6WySwy1w7QZ3B38lel1PFgbY3h4Dh/aG5SwLDMNylqjk1y2EWgaKVzdE5b0 +cC7Hb6h0RseoQiXt96JQ3RFa/wD/0e1qHCO3RBqIgIwISK8Ir3hoMrF6lcTRcxhh +zmODfiQtXLcNpWJkNcXE+B4TujHLdwvqVtd9qc4APhogdhJXVMa57u/wXNfV2luJ +1DqLHPa1jHNbLiBzLlq5HXelY5LBls9QdgQJPxdtVWYN6NzGQIiy67aXtIlv3mP4 +q3TVrMgeS56nrT8pm2hzXu12+4EHv9Jpc1V8r6z2YhltBfBg7nRqNHQP5LkyINsk +iK3e0ZA41KxPrJQ6x1dh/m+Cs7A+tfVch4caam1nXaHsDon82d66Jlv25jq2tbZT +YwOm0kEElzLKv0dbm+2GWNepgwSHWngfRrORv+meBH/kV3uIZoqPixv5AuO+y+n1 +G3CrD3XMc5np7HAyNQ9joDXt/lsXZYlN1ONjttYWO9Nuh8QPcNJUsd2DJs6dA0U7 +RooUHRTtcITuqzo5WQP0iJQNFC9zS9Epc0BOWv8A/9Lr63HRHbuQ6gICstCJK4Bp +ZAJ0Vf7Hv5ErRe0EojKwGz3R6LJDV5W2l9N2U5jq91lNjXPrlryfUHpOf9Jvspf6 +PqfyFy2Xh5jh7BTiVgxW5zQ+xzRp6jt36Tc781dn9ibh9UzQJ9LM23VCTAdqL2N/ +te9Sdh0t9xknzVWUjZsN2OONARNxIBvrq4f1OwMmjqAddYTTscHSILnOI2NeP5Mb +lr/WD6pnJf61RNhBD2scRoPz6/5XuRsayiux7rCG1sIB7QTqtr9p9OfQxv2ittto +Iqa9wBcQPotb9J/9lIGyTtouMSAAASLeU6V9VsGu17rcOHWa2S9zRP8AJDNi6rpm +A3EY1tW4MA0a4yQs7H6uG2eheDXc3XY78rf3ls0Zdd7JaYeOyUTe5ROJiKA08Gv1 +m3Hw2HLcxzTkEUW3VNBeAfobuPaq+HQKc26yh7nYuRVVYA4k/pPc1zhuJ+ltWpkV +Nvx3UuJDHkBxABMT/KVcY7MUMxqzLKmw0+X5sqSMSZg9BqxmYjhlEfNL0104dP8A +nRbdTtELLtLWmEWluijk1y0qfq1HBtyX+oZRK8l5Gie6gb+ESikeCK0P/9PtKfoh +WGhVKnBoEqw25sJFfsp8ApG0BpQ32A8IL3OIOiNhaQSizdljd/euSPmNqyc3qH2e +tz3g6aCPEq8+6xjpHZZWfVXZuY+QyzUEctP/AJi5QZY9ftbHLyr0nps4/Vcym7Gq +DRNjXbiWugz8va5E6Tk9Ubc1jqxFe11VloaA2T7ve/Z70BvRRjs9U5fpVNmd9Yd8 +Pe3bYtHCz+jY7XMdcHBxHqaEkgiNjHPG6ncgNNmXU6k19aYdcvtybaKA0W5Z94qr +dutDAffe51Ptx6W/v2emuk6F67MYsucbLKyQLDALmz7d0fyVCnK6dX02zMxqBU22 +C4nV7y32N9Un3ezajY9foMkGW2+5vwKHXRBO4vd0M8X3YJZjuDbPa4uJIhs7T9AH +d9L6DvYpVnc4nUyeTynxwX4uQ86y2B8vcmohTwrdq5buujoUDRPeNE9MQntjan3q +x1o497feiY7dErx70SgaJy1//9Tp3XEaJxfGhQdJ1Kd3KC9tNslJ1nih1nQJ3pK6 +LHYeQq2XhVZFLm/ReNWO80ZUes9Vq6VhuvfrYf5th7/vPP8AIa1Lh4tO6Yk2KecP +UThdRyMXLadjiHAHUbdsNc3+R9LciVYXSfUZl2OLm7votPtkD85oV7rXScXqBDLA +Q5hPpWtMOaHfuu+i7euat6bmUE0nKJZPdgkf9JQiiLumweIGqsdHos3rGNY1mO0t +FTZc1wJAlv5pd/Kn2LY6S1zcSit7S0VtJh30pcS73rA+r/RqjYLXF172wQ+yIbHd +tf0P6q6iqt1bhu+7xR0qgtAJNl2cYOdU6tkbnsIaTxJB27v7S4/6o/W7M6vbbjZ9 +VVVtTWlr6g5mslj2WV2Of+cPzV2GKdWxyNFx9/S8Xp31qz8jGcdmbFrmGIZYXF1w +ZH5r7H71NgqUhA/pbfYtMbJ06PXV5m3unfmz3WZW/e3zHKmEpcUSQdwx8I7NveHO +kqxTCz2ko9dpA+CAlqk4xVh//9XcNgJBBRpkArOqt3cK6La66S+1wY0fnH+H739l +LquGobNR0hNlZOPi0m/IeKqxpJ7n9xjfpPesPL+sQpdtxwGju97dzv7NYO1v9tYe +d1S7LLTdc64tJI3ANAn91rfapI4SdTp+bIIHro6uX9aL33GjCr9IgSHvALuJ9279 +HW3/ALcXN9Tvsurs9Wx1rtp32OmXEg73/wDmP5iOxp2vvJnf7GjyH0v/ACKrZLIp +eXENDgQC4x925TCIGwpdQGz1XQc5ud0bDtcZtrrbTbPO6r9Ef8700suis2FxHJny +XK/V3PswsnIxH/ze7dtPYuHuldO/J3t4kHsVnzjwyI8WSJBAdvplApY0jUka/ArQ +DQ90+CwOn5j6trew08VpjODA57uE20kOi7NrxqnPcR7RJXIHJfk5Vt7p1O34kavP ++e7ai9V6k80WPmBwwHu4/RVSms0tYyeGiT4nurnJQuRyH9H0x85bo2+rrUX3GpzK +rPTtLSK3kAw78zcHfSYo4HX91rcbPZ6dpaP0zRtbu42OY7+V+exAqdpI0I57qrfb +6d7joQHAxyNrvd/35XMmKE9x9eq3hBesrex7dzHB7eJBlHrEhchTlXY7/UxLoEyW +u10/df8Av/21t4X1hoL21ZLPT3/RsbqP7f8A5h/22qk+VlE3H1D/AJyCNNH/1rDn +jGYbX6N4juSsvK6k+10n4DyCfqOb65G3RjZDB5eJ/lLKse759lZxwERfVsQjwjxS +22F3bTlBcZMAanQfEpNt8UnNDtRwnrmt1Lq7qQMfBAJaNvruE/E1sP8A1b1gWjIu +t9TIc61zuXO1W1ZiguLlE4rSIKZKF7ljlEnctOvPy8Qsfta+oNDJcCYj/p/9Jdp0 +O6rqOJvx3h+2N7O7D+67/vq5X7OQIiR4HgoWKczpmU3O6ZYWPYfc3nT9y1n+Foco +8mHiGm6YkxPcPo1VT2mC2Y+CsXscREwGtLnuJ0aAJc5zvot2rMp+uvQ/2bXmZZdT +lOlr8NrS5+9v0nMP0fs7/wDB2uXO9T+uWV1Kuymmp1OO/iskNYYO5vrOb+mu/qey +tVo4ZyNH0juf2MhnEDe0nXfrPXU8UYVTbWVn3W2yGnx9Njdr938pDxfrviWuaM7H +fSeDZUd7f+23bXt/znrBdji6w23udbY4yY0CmMIHRrAPxV2AlAAQ0iOh1+1iMpk3 +b3PT+pYOYAcHIZeQJ2jR4H8up+2xLNtorv3OGtjQ6PhLf++rimdMdvDgYc3hw0I/ +quC2mszMplYyrjaagWscfpQTu97h9P8AtqcTkRqNV4kezonqWK3RjQT5ItWZ6hg1 +bQfFU2UVVAcAo1dkGADCNldZf//Z/9sAQwAIBgYHBgUIBwcHCQkICgwUDQwLCwwZ +EhMPFB0aHx4dGhwcICQuJyAiLCMcHCg3KSwwMTQ0NB8nOT04MjwuMzQy/9sAQwEJ +CQkMCwwYDQ0YMiEcITIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIy +MjIyMjIyMjIyMjIyMjIy/8AAEQgBAAEAAwEiAAIRAQMRAf/EAB8AAAEFAQEBAQEB +AAAAAAAAAAABAgMEBQYHCAkKC//EALUQAAIBAwMCBAMFBQQEAAABfQECAwAEEQUS +ITFBBhNRYQcicRQygZGhCCNCscEVUtHwJDNicoIJChYXGBkaJSYnKCkqNDU2Nzg5 +OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6g4SFhoeIiYqSk5SVlpeY +mZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2drh4uPk5ebn6Onq +8fLz9PX29/j5+v/EAB8BAAMBAQEBAQEBAQEAAAAAAAABAgMEBQYHCAkKC//EALUR +AAIBAgQEAwQHBQQEAAECdwABAgMRBAUhMQYSQVEHYXETIjKBCBRCkaGxwQkjM1Lw +FWJy0QoWJDThJfEXGBkaJicoKSo1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdo +aWpzdHV2d3h5eoKDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLD +xMXGx8jJytLT1NXW19jZ2uLj5OXm5+jp6vLz9PX29/j5+v/aAAwDAQACEQMRAD8A +9LklcPwR0HYelIty46kfkKbJ978B/KoH602Box3rZ+8P++RUwu2I6j/vkVheaytg +VbjlJHNSVcsy3Dk9R+QrOuZGPp+QqwzZJqrNyatESZnyM27qPyFVZpHA6j8hV6SP +5qpzJwaDIz3mbPX9BTRO3qPyFOkTnmodvNICcTN6j8hVuCV89R+QrPWrtv8AepIa +Zs20jcdPyFaccr46j/vkVlW3atGPpWiKRaEz+o/IU4TP6j/vkVAKcOtAEpmf1H/f +IqJ5n9R+QpT0qFzigQ7znz1H5CpUmf1H5CqgPNSoaBlwTP6j/vkUvmv6j/vkVAtS +UASiV/Uf98ip45Xz1H/fIqqtWIxzTEXopn9R/wB8irSSNjkj8hVGOrSdKljRYLtj +r+lQvK47j8hSluKryuMdaEhsqXUr88j/AL5FUN756j/vkVYuJBmqRkGetWZMtxyv +nqP++RV2Kd968jqP4RWSsw9alS4w6896BlWU/OR7D+VQtipJP9YT7D+VRkZFZmxC +FBepgvFRAENTy3FKwgY8VDIeaR5cVXaXcapITHNzUEqZFS0yQ/L1oaJKEsfNQGH2 +q059aiL81IrEPlc1agjwaiLKi73YKo7ms651+OMMtv8Agx7/AIUm0iowbOnWWOBQ +ZHVR2yaZLr9pAQoBbJxntXC3GpSud7vkE5PPI9arrqXmSBzlllGAV7f/AF6XMzZU +0d2PE24nZEuMcDPNNHipgMtCp5wetcQZCN7+aQpPNPjuSIRvfLdOe/H6UczHyo9A +h8SW8oIkiZD7HNW4762uVzFKDnseK8vm1KVXKAEyHlSehq3Zaw5APG4fdHc9qfMy +XTR6R3qVa43T/EcjAbnLNkghvaugs9atpwN+Yye56CmpIlwaNlTTxUSEEAqQQehF +SCrIJFqwhqqpqdDTEXIzVhWqpGamU8UgJXk4qhcz7QeasydKybwnnNMTKVzeYbrV +P7XnvUF3ncaqoSTTJNVbj3p4mO9ee9UIlY1dihJdevUUDL7p8/4D+VAiz2qcgb/w +H8qeFGKzOhIovHjtUBQ4NaTRgmm+QCOlTcOUxJVOTUSxkmtaa361B5GKtGTViiQR +2qCQkVfljAqpOuFoEZlxJhqqXN9HZwiSQgsfup6+9PvpVgjaaToOgPc9q4HVNVuJ +LmTfnaen+z/9aspStoaU4X1Zo3uty3ExZpPlU8f3R68VmtdO5kIAaTkBT6dfxFZE +t66riWI7Wzz6k98VEvmhVeOUggdGGf8AJqNzY2Y9RleMlhjB+dCP6+tSwvDiQpuM +bsGwpwVP+FZ8KSsd7gAlcEjkH/CrEcTIQRjbk5/wPsaLjsTrO8bSI0nfIOOvP6Gp +EuzOskTAK/JPoCP/ANVQ7Fcdc7TuAz+lEdriUzxAuQcOp64/yadwsWGnmmXI+fBD +Lg9wKoG5m8qNUzHIHKnHp/nNa1tpUgH7skCQ/L7EGpbjT5Yywhi3sww7hc47cUrj +5SpJJJFCJt534LcHrWrDqjxQIZjnfhcg9c9MVjNFOHkAXBUYUnoO34mnX4kuIoot +yr5Y6KfucY/OhCPRtC14FY0dx5RO3BP3feuvGMAg5B6GvFrDVFtY0i8t5OduFHP1 +r0PwnqwuUa1duR80eTnj0rWEuhlOPVHUCpkqEVMgrUyLMYqyo4qCMVaRaQIjkXIr +Nuo61nXiqc6cU0Jo5y5gGTxVQQc9K2bmPmqezmq6EEcUXPStCCP51+oqKJOavQr8 +6fUUhjGb5/wH8qkQ1XZvn/AfyqVKyZ0omAzTgtNWpF6VNyyCRAe1QMgxVtutQPjF +WjKSM+WP5qo3CADritGZsNWPrNyLbTZ5uu1Dim9jK12ef+INYE908aNiNDtU+vrX +NoxkyRuK9ORTpcfaS80mQeiity00O5vVVwQikZHy1ySZ2xWlkc9JEcbSGx6cH/8A +XSqq5KJuVhyCB1H0rsYvBzu/zucDocYrTTwbbeWNwIb1BqedGns2zg4N2dyup4z0 +4/GrqQNO+GBVyODj9K7q38J2cZ3YJOPWr8fh+13D5MAelHtEUqLOMsdBuZ13eSe/ +OK3LbwvKrqShLFeuMc+hrtbaOG2jCIgAFXY3TI4pc9x8ljCsvDQlDEqBv56d60Zv +DqiPAXHPbtW5C69iMVbBDDkVolczk7Hn+p+Ho/sxRYViVur9STXm95pUMMjoQCQf +vbiPzr3XV4ENs5x0HFeS6tbLLNICP3me3emS9Vc5m2kiilKsSqDgbm6j8K6XS5Vi +ljnhYho2BIJrmLyzMUmY8ZHH0rS01HbEhYlAMZznNUiGe0qdyqw6MAanjrP0yUza +ZbSMCCUGcmtCOuhHKy5EOKtoOKqwjiriDihjEYcVVmXg1dYcVVlHBoQmZFytUsfN +WjcjrVLHNWZj415q9Avzr9RVSIc1fhHzp9RSGZzff/AfyqRBTCPn/AfyqaMVkdA9 +alWmCnjpU9TToMbrVeU8danc4rPuJCKuJlMq3D4aue8SXBj0eYhVbIxgmta5l5rA +1j/SLGeLuVOM+tE9iI7o8yj2PeCNVG4v3PA+lev6dbJDYxAAD5RnFePWgWHUv7zb +8k4969lsG3WMX+6K5JndSJycdB+Ap6BiOSKaAe1WYYi3bPvXOzrjsMVe279KnjGO +N4/KphaHb94flSLAqnl/pilqO44IMjgGrcI45AqONEUjlj9TVxGj4+UfnVx3IkSR +r7AVYUkdKiBXtTx61ujnauVNWY/ZWGe1eaXkYlnk4G8HAOOten3UZmiZT6VwuoWx +trp+vsSOtUiGcddwlweFAzgg8H65o061KEFs5Xgen4VauJElkOVOVPTv75p1uCzn +CgqTnB7VdjNnpWlHOl2x/wBitKOsvRjnS4Qe3HStWOt1scz3LsPariCqkI6VdQcU +mCFI4qrKOKtnpVaXpQhsyrodaokc1o3Q61QxzWhkyWIcir8I+dfqKpxdRV6EfOn1 +FIZl/wAX4D+VTR1BuG78B/KpUfiszpTJ+1LTN9G6o6l9Bsp4NZd0cZq/I9Zty2c1 +aZlMybp+ay5vmzkZB4IrUmTLVTlj4oZkeYahbm11krjADcY9O1eq6W3+gQ/7org/ +EcGzW4TjaHC8ge/NdzaXVpbRJE04ZlUfLGC7fpmuWomd9Frc1BnGSM0huzGeelYN +94ysrY+WqMfcjH6Viz+NbWY7Fcp3OE3H+dY+zZ0e0ijvY9UXacnpUcmpRgZzjn1r +h7XXo5nBjmaQ56NHt/qa2IvKvY2zKo7qc52mpcWjSMos6IXzcHICn3qVdWtoD+/n +VMHu1cPfS3WXhSXKxY3bTjGfX8BXM3d1PDPuS6CjkEZxmrjG25E5dj2VvE+nxfda +SQdyqHH5mrVn4giu2C29vuJ6bpVWvFrKBrj5p9QkOf4QDzXT2ENujRiC+ZZV5CsS +ufoDWlzLlbPUnuZImQ3FuYo3IXzBIGVSeme454qrq+nQ3kDx4j84DIGRmsq2vnu9 +HubGUly8TAZ9ccc/XFbsNnZ3EMZeyTeVBOc5BxzzVq1jKSkjyG5tWt55lK5YMc56 +/wCeKnt1HlArwwwc4xx9K1fFsVzp2sERaelxCfmwZCrY9m9frVfRrC41VJPJilSM +52C4j2lD6E9Py61d9LkJNux1+g8aVHznJJ46VtR1W0rSHtNNSFp43kUchRgH6VaT +itYtNaHPOLT1L0HarqHiqEParqHimyUSmq8vSpS1VpX4NCBlC5HWqO3mrVy/vVQO +M1oZliLrV+H76fUVnI4zVyKQb157ikMxS3z9ew/lUivUJ+/+A/lT0BNZm2pYD08G +o1Q1IEpFq5DKaz5utaEqmqbRkmmTIoNGSaia1zzWqIPan/Z+OlBmcTqFvp95eX0E +zqlxa237ouwXLnJ4z14HT3qU3Lf8IhbmL5ZJYVU47etaupCz+0zCaNJcwGJ4pEDK +wznv3HNZbWyR6BbQRqFjVfk29AMnFc1SSex3Uqco6s424hsrWJftjtJJ94oD+tc/ +d6pZwyfuLBlPRSRXVTeHo7y7lubxnCZGxM9cdz/hUMtnaJL8qNNJ0C7NxqE11NHB +v4TnLC+maVi42ho2I5wcYx17V634GkmvtGQt/qxwpUYyMVx0GkNLkPBGrvgYA+6M +85r0jw1Gljaw2qqAir29amdmrF04yi2zJ8QabdRz4aMvHKDGDnhQfun8Gx+BNeeX +Gi3KX+2UYRThwWwxPce1fQNzaR3NkY3UHJyM1zGqeGI7tzPgeZ/FnoarVIFaTPJ/ ++EOlu7pZYmaNQemc4Brr7PwY8kAH29o1AGImwy/XnofpWrD4flgcAIwU+jEit+xs +BEnQkjpupc7D2cY6oytJ0q9sciRt6r0ZWP8AI12dizbQT0qvb2525Y8k1ejj2jj1 +ojcibvuQavpVvqcIE0asQOp61lTj7Jp4trNSTFhVGep9z6V0eeMZrg9cv9R0nXVj +jytv9/dj72f8OlXUlZXDDU3KdluQ67FqVglrepeTqScMgb5c/SustJvtFtDMesiA +n61mXEw1jQckBmWRR+daVtGIYI4h/AuKdBe+2trFY2SdFRktUzQiPFWVPFU4zVlT +xXWeWPd8Cs+5mwDzVqUnFZV4Tg0ITKdxcjPWqouOagut2TVYOaok147j3qxHc/Ov +PcVjozE1aiyXXr1FBSLW0b/wH8qmQCo+r/gP5VMnWsjdIlUVIoGKavSnr0qC0iGQ +ZNVygzVp+tRY+arREkCRA4qVosLTogM1I+AtMxZ5d4vtbqz8SxXUUsixT4IAPAPe +ukaLdAAAoAUYAAxVzxFYLf6c4C5kj+dPrWfa3Hmxbf7pwf5/1rhqR5ZM9anVVWlH +utCo1g7ZyqkH/ZpE00dCu0Z6AAZrZXAXk4qvK3bJ/Cs22jRRKJhihOFUe5rasIcq +GDYJrFlkHnRw55ZgCfSrp1aCxbbuHt7ULVFcrT0OztvmiC5zUV6FjibfwPWsbTPE +McofJHy8nnpT08UaTqgmtobqOV8FSEOcGtk04mLpyUhIrwF8Bs1eilXcDxn+dcXe +G40pvMyTEev+zVyy1uOdRiQN7VjFs3lBW0O6iZGXgilLGM4PesCz1PDhS3Xoa2ln +WVQTW6kmjklBxZYTgVjeIbZ71o4o4DI4U9ByBWwpGOKa7GOVWyu0kAeuaqSurEU5 +cs+ZGDo9i9lZtDKMNvDFe4xzV5OTV29KLGXX7z8VSjrajHljYxxVV1JXZajFW0HF +V4R0q2g4rRnORSLxWbdR5BrXdeKo3CcU0SznrmHnpVXyRWtcpzVPZzVkkMcPIq9D +CN6/UUyJOavwIN6/UUhoqj7/AOA/lVhBUAxv/AfyqdayOolHSnqKRakXGKmw7kLD +5qZxmpZOKrk/NVozkydTjFKzDHWoNxqOSXAoMxZgDXOvb/Z7i4KrhSwI962Xm4PN +Ub3JhyBkZ5OOlYVY3R0YaXLK3crNP8vXtVaa4CpkGobgkMvOK53Wb+RCkKHlzj8K +5Grnpxdlc1k2zbnZgAOhzXH6l9og1B3F3KyDoobj8RVyLVESExPLnaMk96xLovPc +F42xuPYdB2rSEbbmc6jexs6drptiY3jVmkHGTkcV02mapZRTRyrFGJXAAAXGB+Fc +FJotxJFEyod6kAFc5NdRpmmeUkTXd1FEwXBVmq7pEJzk7nVXt6J7aVnyoz8ucHI9 +a8+uH8u+L2dwYmLfKV6Ee4rpLprKytZZbq/fyVy22GMkY7c9MVzlrYXuuXP9oWtn +Jaafu+Qzffkx3x6VNluDcjsPDepvdFoLtNk0Zw2D+oruYmZFGTxjqO9cTp9n5N+J +UwNyKCMdMV2K/wCqTnmlDcc9kasEm5awNf1CS2usRyo+XjCw5+bfkYx9QfyzWtBJ ++7z0qnqWnWk7Wt1NbRPMpJWRl+YYORz7Vskm9TmlJx1JfMeQ/O2cdPSpo6rR9atR +iulKyOSTbd2XYe1XF6VVg7VcTpQxDXHFVJhwavMOKqTDrRETMe5XmqRHNaNyOapY +5qyB0S8ir8C/Ov1FVIhyKvwj50+ooKRlA/P+A/lViM1VPEn4D+VPEmKxOlsvqafn +FUlm460/zvei5OpLIagY80xpSTxTCSaExco4uKglbjrSspzxUUikjGaLi5StJLtJ +5pFuBjrUcymqjK2eM0rj5Ste/LLsA4IJDdq53V7KSZFljI3rn8M10swLxYOSRyKy +Wl2sysODXHNNSPRpS5o6nnwhuYJmVrSabq37thn9as212jjcLeSFjnKtGXYY9hXa +QwR7ydoDdRjim311b2IDNbKzHvj+tO41FIq2VpcPKhE9y0fVgCFzXSQWkchMNrbQ +weZEUeRxvkye4rkj4nhh27bcKx7c81cTxiFYBYghPAK8jPvVK5TdPrc7M+ErO9kt +5NQc3H2dNkavwp5zkr0J96v3MEEUSjAVANoHTFc/4d1O5vpGa53jYR9Cata9qDqu +1c8N90dj2qXroQ2NSMrdtjnnIrbjbEWOflFVbJUntVk+VmA5HoaeGB4OMDpTSsyX +K6NBZGYKBxk4FaGoJizhI/hOP0rOslL3EZI4XvWxqC509vZga2juc9XYy4xVyIVT +jNXIiK3ucti9CKuKOKqQkYq2poYCkcVUmHWrTEYqtKRQmDMu5HWqRHNX7jvVPHNX +czsSRDmr0A+dPqKqRDmr0I+dPqKYznpJP3h+g/lUZk561FM2JD9B/KoN7E9axN0X +VlNSCTNUd5AGKBKwpDuaG6nA1URyakBNIaJy3FRtg0wk0wuaBitGDUTW4p2+jfTF +crm1BPSue1bT5LeTeoJjbof6V1O6orhRJAyMoKkcg1nUimrmlKTUrHnV9fSW17ao +uSDlmGe1bAaK/t2JQbeOpzWD4w06aBoryLc0UeVYDsDWVZay8SbXJMeM+wFY8l1d +G7qcsmmXbzRpJX/cx8luC3AFWtJ8NXTXDyXDBVAzjGTV6x1KCZlXOeAdx7e1TNrJ +tbhmUgBVHJPJFF3sUlHc6W1+zWMPzyfKwCgZxmsTUXNxfb1mwG5I7A496z7nXUnV +kTaFb5kzzz6GsuDUkkgZZgzSM4C4bGcjOPfmrhHqZVJ30Oy8KyvHFcNM7Zc5K54B +/wADW/aqZG3HIWue0e2kjtyZlCTOecHt2FdJB8qgDGAOnah7jimkbFn94cbSKvah +OkGkXU8gYpFE0jBRk4UZ4/KqFsflGQRitERrcwPA/wB2RCh+hGKcXqTNaHDWXjzw +1d42aksZOB+9QrXURTKyqysGUjIIOQRXzDfQGxvrm0ljw1vI0Z4xypI/pXu/hS+3 +6LaoTkeWMe3Fdns7xbRDpqx2cU+Mc1aS5GOtYQmx3qQXPvWPMZchttcDFVpLgVnG +696Z5+T1o5gVMtSvuqIKDUe/NPVhT5w9kWIxyKuwj51+oqklW4GxIv1FUmRKFjjp +SS/4D+VNQHPNPlOGP0H8qYrVBoh7dKbTj92m0Ek8fSph0qCLpU4oKQGomqY9KiYc +0AyM0tBpKBDhUN1cRW0QaVgoZgi+5JxT3dIkLyOEQdWY4ArzXxh4ga4mPksRHByg +9x3qow59C4K7uddfwo6yRyKHByCCOo9K831bwtdWUjyWJMsRP+r6Ff8AGvTXkE9u +k6gMsqK4I9CM1SeAMxGfvcVxRbR1zipI8pTVLiymCywOGUd1qSbWXuGDIkrZGGAB +INdjqNkAxwACay/KKNjaMA/witOZb2M+R9zLs7bUrsoiwsqk4JbjFdzougx20iXE +376fjZleE4xwKp6fHvdV2nkcV2unWiiMsSF4+WhyYKCQkYKtwenTA5q/agEjcB07 +jrR9mUY+UAn1p0WM/Lk+vHFSWlc2Lf7mDwT2rQt8jis6AkEZH41oQdRTREjwz4v+ +F57DxFJq1nbu9peJ5kxRc+XIPvE+gIwfzrpfDZaLTLZeeI1/HgV0njiVZbYxBirK +pII6g1zOkyCOCIE84r0cBPncl2Dlajc62KTegPfvTs1RhmCsP7pq92rOvS5J+TMX +oGaUUlKKxEPU1IHNRDrTxUM1Wxaik7GrUUmHX6is5TirEbHcv1FOLJmlY5yZvnP0 +H8qiR/mpjzfN+A/lTA3zZqzBMvg5WkpIiCtFAMliPNWBVRThqtKeKBoeajen1g65 +4jg0xzbxr511jOwHhPrTjFydkWot7GpLLHAm+V1RB3Y4FYV74qtYAwtkafHVuiiu +M1jVL24Ia4YyBuRsfgfgaqW7SXMTLOdsQI3BT29Pqa6Y0Ety1BLc0LrxBdaihvJp +HVGJEEXQAf3sfyrltTkLQyEnqK0ryUyP8oAA4AHQCsnUj/oz/StbJLQt7HpnhC9G +o+EdPbdl44vKf6rx/KtURrn6etedfDvVfIe6sHbC7hIg+o5/lXo28EEgDn17141S +PLNm0HeJm38CvIehz1GKyjZjzNxXGO9b9z1LDvWeTtYZCn8KVw5SxplruOAu4V1l +muEC9Mdfc1l6eF8lfmA47VqwKM8CqTE1YtOPlyxyTxgdTUcSY/hCZ5pSecHqD+VT +qoIGcYoEieBlIBByD3q35yxx9eQKzTKIxis3VdTENsxB5x60XsiWrs57xNqPnvNh +uWfy1qhCSqKB2FZ80zXWoBf4YRk/7x6/pV6LPpXsZdS5KfM+pcn0Ni1uSAATkVav +dXfTrQXHkGaEff2nBX3+lY8RI56VoRuk0LQSD5JFKkfWuupSjNWZm4l7T9esNQA8 +uQox/hk4rUrzG7hntLby1ifMRK71+bOPXHNbfh/xDOqpbXJLcfKHUg/hXBUwv8hL +guh2o608VTtr+3uW2K4En909auCuGcJRdpIaTW49Rmp0Hzr9RUMfWrUYy6/WlHcm +exw7P8/4D+VODc1n+fmXk9hVpD0Nas5UacDVO3WqUB6Ul7qtvaAIcyzf8806j6nt +SSbdkaWb2LlUrjxHYWmUEnnSDqsfOPxrmdR1ie43JM4CH/llHwv4nvWI+pugxGqq +OwArphQ6yNY0rbnTXHi+5mdljt2iT13cmuWuJ2luHkkOWZiSaik1OVuGqn5pLZNb +pJbGmnQdeTEx7Rzg5FWtpgtxF/F1b61HZos1yHb7sY3nP6VLcEs2e7UwKMnXHXNU +tSTFsVHXHNaQjJl9hWffy2+0xvPErk9GcA0nsS2ZOnXTadrcMoOAx2tXrFjqC3EK +5OfxryPVIWimTIwQwrq9HvmWJQx7cHNediI+8OErOx3pnHrVeUxtnB2mqcMxdMnm +gkN3zXLY2TNTT7gxfK0nFdFaXiYwCSK4+HjHWtS2lZcULQbOladSw571Os6hOO9Y +iyEjP4024vSkX3j9KaZL2Ld5fBCeR+dczqt+WiZycKOme5p80zyvuOc+mawtamMj +pAp+78z/AFPAH9aulD2lRRDZXEsw3keec5diTWnG5Dc8j1FRpEFs0UdMU6I4XB7V +9HFJKxJeTJznmp1YKcHp71TRypFW92UzjIqwKd+VFw65++Ax/wA/hUEDR7xG4yuc +/Q+op+osoaFs5yCM4rPL4kV8H61D0YGg73FvcM0o81DyroOR9R/h+Vamm+JnUKkp +WZTx1+YVjrdpKgVifY0jiN8FlDkdG7j8aicIzVnqM9DtL63nYBZArnnaxwa1Yx86 +/UV5cs7928xcfdY4I/GtjQ/E09tMkNySyZ4STr+B71xTwdtYGc43WhkuuHyParUM +vyjPagwgt+ArL1K8EJMUZ+tc8IOTsc0I8zLd1qm1TGjlR32nk/j2rFluhtKrhVPO +BVGSc4PNVWmJbrXbGKirI6kktixLKDnmqTnc3WnMSefzqIggd6YwO3rURpWJ/wAK +RRvkVSwUMQCewpCNO0Ty7QMR80h3fh2rJ1PxBaaflV/0if8AuoeB9TVbV9XknUxW ++6ODoD0Zx/Qe1cvJGWaok2tjOc30HX2v397uUyeVGf4I+M1QVA4wetWTaHHSkSIq +3IrBxbephZt6l+PUCunqkr+eUPzRTDt2Kt1rc07V7Dy1G4xj0Y5x+Nc8bYSpgiqW +2WylzgEZ6EcGiUf5ldFqTieuadN93DZQjII5BFauzocdfSuC8L+JIQY7W6cKM4jY +/wAPsfb3r023t1lhV0JAP901xVIOLOmDTWhXiGKuwhCRgHNH2Qg8N+YqaKB84Z+v +YCs2zSxYBbZ6VRmYk4/XFaLKFiA5JNVJ0S3gkublhHDGMsT2pJ9EHKUW2woZH6fT +JPsK5S/1nS4L7yru5WO4ZvMZWz8o7A46HFUvE/ia6uB5VrmBMZXH3gOnPvXnszIj +E53sTkmvSoU/YLme7MKlXse22t5a30Cm1uIpl/6ZsDTkXLEYrwlLiWOTfE7RuOhQ +4roNO8ba3ZYElwLhB2mGTj69a7I4pP4kQq66nrSHBKt1qzDJsOG+6f0ridO+IGnX +W1L6J7aTpuHzL/iP1rqrW7tryESW86TJ/eQ5xXRGpGWzNVJPYl1OEvHGc5Ct19iK +pCAcAk1cvHK6ZM3JKAMKwTqLnksMAU5bjujUEEY708BQMbuO2awm1UDoTUJv5XJA +J5NRzIOZHSgxg9R+dKPLY4JBGehFc7H57nljWjalw4BJ61SkNM3765FtwOZGHA9B +jrXI3U252Oc5PerlzeS3Mpkf7zLx/wDW9qy5ckn5T+VckI8qsZwjyqxA0mahZ9rH +60rq2TwePaoW3HIwc/SqKJw+eafnIqmuRxz+VSByOOaAJWFQyL6VOPmHSmtGcdDR +YDEuIWZjVYW2D0rZeL5un6VE0PsfypWM2jPEGRUb2nPArT2Y6rS+WSOhosFjJSLB +PFOkgSRCrjINaBg56VG0BI5BH0FKwrHPXFk9q+SCU/hYV1vhHxvPo8qW17mWzY4P +PK+9UOMeXKmUPtVC40sxNujBaJuntWUqSZKTi7o+hrWS3vbWO4gcSROMqw71N5Kg +cAV474I8VXHh2aW3vUeTTcEkjnY3bHv7Vc1v4p3dzG8Nhb/Z4zwGz8xHuf8ACuGW +FlzWWx0KsranoWp67Y6aSrkzTgcQxckfU9BXA+JPEd1qEam7ljtrWNtywIOCexJ7 +1wsmr6tdSZFw0YPZBimFHlINzLJKR03NnFdVGhCGtrsiVVyVkN1C/m1CZvJDbD1Y +9TVZNNkblzitJML91KkCu4+7W7gm7sy5b7meNPRepFBtUHbNaYtieufyqVLTPY0/ +ZoOVGL9n9B+lWLNrm0mEltLJE4/iQkGtgWQz0/SrCWIB4Xn6VSpjsjV07xRcPbS2 +1/D5oeNlEicHOOMjp17iqCJM4Xc2eO1WLazG4HH1GK1EtgAMJgVtZ9S0myjBZZXk +Vdjt1XjH6VOse0dDSM4HQH8KdjRIVFAIx+tWoiA6jpz1NUP3jHIBqeESBwcNwfSm +hn//2YkCOAQTAQgAIgUCXNbVKQIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AA +CgkQKrEqetxVwAOgWBAAgewnppKesDIFGGNarl/JUkhLUyNxLS1MhtOhES+i6NOK +x1GcM1/E9aw5Jyc8lcJp5jn5mkQ4JX8PXXfXbemAdfMih7y51Cx/RwYwUskqkA25 +Y6pm02vhXxIaWmHTDnNDgsPWGAOpm8guzHFZZmGlmF25TDu0MsiJDy/j09Y3w0he +7TIKWVz04z8Lj+g7YOfAAQQDMVo1ShxtbgOFdnRJeOcYZlENUd99y99+Zsdk3Ubc +keQsEUnW6S8rjuZi3zsjE+yeddY8Mnl/yyzCutv1lvrfk/WZ7ZYuhPBNveDTOEyl +N4/guRkVyyfs9k4Yo2LowW2lDoNoN48UlrxJEHXZ+9qad+7oTjYJ4tUNUCeb38gE +obp4McQqeHYWK4hsVS0nJnJ3toLCYJ8dfMJ/MEFdr3qmOLi7J3y6PFtuJr0bGQ4k +wwObqLqxb94I5AnOM4STWDc3JtsxwnnrLCX+1ehzFaCOHr/aiWDpypL1WsIoV0R8 +wr+e5Ujysbn9VsnNtmKigUvV7pMPEx0SYRf6x9GM9OnNiw9LW6AfEYR6N8sx5iBi ++tHWlbQRYF5j/HCf7INXmX7vA26nKObQU6rhyaSFJzvHvWbJUqT2kxqCoqOjf04p +dSVKgG0bSnKJZLin4yZ+PJ0oQnOClSGxDpI4Yn4Cst6S/MjOMmtmZDFe5sl3zZ+J +ARwEEAEIAAYFAlzW1tYACgkQmV41IhrYTf+BtQf+JEhjggRITJD0hCUPf14WCn1e +Zg+p1CqOcypxB2S66W9tOg9zTGAIcMWh/erhC185oyqXWGNQE5BtvPmMbeQ0vabF +a1C42+vPuPB045qbcOOrGPA/WiiY4iYkvXMy5FlLXEEYA2I27+HaHHO4sxZhclkN +VnMxHCh6MBdXYHbR3AdhPOR8fcg29IsMk8QqIsV8lKrv1NDXgdF6y5Pa764dnqkk +rere7WEv3uOpv0MC80qjZosxQB4Mypd8YmS3aKM/B9R9nBBCDFAeJPlCENMb5ZdD +Nk4uNCYuAaAoLLlC0v823zhiAi/8hkBD+XxSWNPQtoJzx78hXflH0fGOiPzLC7kC +DQRc1tThARAAxNRrcpany4fujNqaDiUTFzlsrtRo1dzkGOishbDEl+1m2HCHbo2Z +lXcXqd+e9YTsidCaPHbYPP1VoE4Be9yaicK5yRXl843W0Y7nIuCJOAFtqIrDBuFX +hZuFUL1rMNdUfuZlYOBnWXxVAvZpacpY03Y2hHkumlWe13wngKJWZt089VWiqDIK +xaXwIG6MirppxarFNUgf6J+z0ZK5Qn1Xl0JRsyZ6BCxNv7vNfH2EgaYS983Cljec +cgVHO0SQ5saJIjyj3sdfo/4FxnrGdgNufIPCknSE+7TsBuowRyVZf6L5IKtFYFhA +Wo4zG9NveJdFcVsuUxKzSZeOBvAuCq5+r89Mw6NrxaaBvINCE1pGJK4Q7EIfgyDu +sr7xnlUhGuwQM1GKSRp95IeOYlmnWoAcPfMIxR3Mu6Hg593xCd8jVB6nbtcUKD5S +DOmvo7NFQxLbX4adLwqf2/VMfks8mBgJUG+Cx0L/aQpPL9NA2FjxTwNjdVpbmt+Q +acABBzoQ7XQzdOG9K+cJVODLZo3RNN4G1FGiTIJuxYWTFXNWVv+RSn1RmdIf5kdF +K1LUfOrPvZM3FX2OkGy++61kHIxOIT/D0ednGz/fgly3ff8EuxSNCikVlhuxYtx8 +QnMvMOFpEb13Jj+F9pQ1O/8V9PsSo7kk5wuHC01CBodHc5Gu0clhBm0AEQEAAYkC +HwQYAQgACQUCXNbU4QIbDAAKCRAqsSp63FXAA728EAChAYvY4KgqJyrUd6OGDq2w +7USK1bwsMXK73nKY5gGwmuyv5U9ZesIY7gNS6SCWuPNH+zRPJ2pzUHTsZz+S5/Cp +OW/LnEa6908J6drNyzkKgH1gciwwnWRjYg/dHOxTh3GBTag+IOubvZSHyLbPcgTx +NQpdftuDSnmBTJKpsRVUQNT8AL2yqz7lDH4Gr2RMtNYVX11P/reQiGvQpjvVNWGO +AmJaC79ZTKvk6MP9yHKskoF0VMsf7LwNzR9YY14ZoaPziObDN2xgcqzhP5QeoQFO +D6jbT1D22797v5j7hGOrdTalJ6hbOvrTDfpIKLouk3QfblIBU7Be93rIrOIdgzPh +RrsxjdGnY5v9AdSMO8nT1xOWhJvyZhsPEcRhdf4EE15wohOQEu9HwS/51qfGjaYG +Fj2vQfXOKs2jA3zIMDmnEk4g5ZC/PsltbB7jyza6jjncIYcv9r/CMkS7s7NUivXD +RtwvDgfBfC20+FDeOIIDUGd7B24Oge0a5tER+9np2n8w5Ayn/saajZO1O0kSQW7b +Iox2IWgDPkDdGC/aRpg1IX6vJrEJgxS0pDQf0FH0Auy3uqgBuFNYa4erzFxSYHGW +NrZCp0H4kt/ZaEnE9n4LKD94yF8bTw6lO5/yidRBoVe28l34aKMvzr62cqezzjIJ +B+RdjYxImSzlmE2uJO6PKA== +=Om41 +-----END PGP PUBLIC KEY BLOCK----- + +pub rsa4096 2020-07-24 [SC] + 9352 5CFC F6FD FFB3 FD97 00DD 5A4B 10AE 43B5 6A27 +uid [ultimate] Joe Orton (Release Signing Key) +sig 3 5A4B10AE43B56A27 2020-07-24 Joe Orton (Release Signing Key) +sub rsa4096 2020-07-24 [E] +sig 5A4B10AE43B56A27 2020-07-24 Joe Orton (Release Signing Key) + +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBF8a/nQBEADDN/l1Riabo1D6TV73R1yWIJiVsEqiToaeOKC3p9H5/nMgJnAi +cETVcxCd3dFyEg1iBaVTxwdyMmm6FHNOkEahhfC+h5TaCJ+1kKGbtRLACJ9z4MJJ +dZnMNPIXaLaLWBmSUzs1ahSaJ4pPdNijoltOvh/+P4c/NSJL+nt+fu1IBwaLIwvg +ZBsImRF4G9hGT5LlDJjf+/ktL9kTIDGGiv8R2WxD6jzqBw4YsWMrdhriBR/nZLO0 +ZcnWKYt7h25x1CW48h989MF6lsOKPyKj24471rI37pDqhjVvkejiy5We2rwsYmJe +bKZ6Lq7swraiuB2cmwK6PbEmvgIFg7cm2uS673/EsQrVauHtitDDL0qMSuwp+qD/ +Ewr1jwMgjA5Ep1XcMOUc2q6MlHSqgnS1xfsWZjs66gfndNmkc63+q1l/Irb9gVdx +2okoy74TLtNwv80P15SaVvF+QeRQ7JiHvniWTYzJ+Hcgh/0DsohXnd0gnRjBN7G/ +3wXOF7EmjV15yYkCF/DVXjpqsLgB/bQ+VOFxML69zBm+S4e4NYDx32RJac5O62di +yR0uTEj3++ilInx3vAO9IPnEtwb/G6jbPaJlBPTcBx/5OZASZD48YNHA3ZhURoBz +XkMKIaE3DkoHTs32Y6jGbt6F7OU/CVC8TQ5rSrcrkigHWo1tPeMQH4SCCwARAQAB +tDNKb2UgT3J0b24gKFJlbGVhc2UgU2lnbmluZyBLZXkpIDxqb3J0b25AYXBhY2hl +Lm9yZz6JAk4EEwEIADgWIQSTUlz89v3/s/2XAN1aSxCuQ7VqJwUCXxr+dAIbAwUL +CQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRBaSxCuQ7VqJ1mdD/9KEWVZ5Lqljf4+ +4InUV7ANqDE2u4yba5buuMMpvN5ZIYlfbRUO49ydwzuEJimF79iTqGqSiImBcjWe +Bn1soxVuIKabJMTPMxnq08Y3m1W6W6dAipgqAwrEPkjKF8hohOdTtP5N4hBZ0U9d +yX+Mu2iwG4ml1He8LD3NIPNJrU8wpnQq1Di4p3LWL+saVhI44NvAFR/q8BdAkXgb +at+wjghqx8Fn50FBs6vDmRDH/+9LKaqwQ6VkoLCp5jnr/voL+f4Pk6flUXxyz09A +LfbNbJpdB+f61DSOTcZF/42iWbDZSBWWVddhMgYVV23JMgVJV9jkPFkat2un1Xcd +kpFvJRZhTiKVPRoZFMBSgZtuRGfgRClAKiuCm9imOfm/MEP1YgWEdEiITQ3aOU4o +9Yek4ZsifqA9eXvNtqAkXkTevaxzMq4SsDdpW/UKbRkllh9axBCgmRzgHE1C6LUV +Oxc8ioUd065D28iIRT072vCIQaAbWdPcR5xj7com4ZVDwkaZyZaYw+OhaSy0BpBM +J4q4KRd0GOpEns7/KeMMrwzT1t23IawVoPYv2HLaQlTrSpcvFc/Hkyr2y6k7EVTm +/JSI5QzVhBnpKP868pZ1znsey0i4AKPcHTPn05+H8Oq34ChN4GE5W1d+djCoY2BJ +m6EB9VMZ64CjxiB7y05Pp5Yws9f3j7kCDQRfGv50ARAAxO/XeC/u5fvTM2aDRHnn +IUWJcCkKeFtiQ2o53yjklF9EUE/TuxYzNIRh9N/MKBVy4u6mrTwlr3adi7Ea12+O +idcgHRo7ImA/KSGxH6/hsZw1NOUKdfC50CmT5kTQ293Qz9xugYqfkaXNTy/oypdd +fgR6fRMW6BzPuKbTrkAsJtCsjnG/xAq0mgWpb/mLjdZqGxMrBgJor2zJHufwOl2C +tf/f1HDSCMXYtIytQoWE5F4PAZKAtpNv0YCPLq29EHzxCJnwxVj4iGLO59Xudizz +HQsDMFTxPqux2GPgR652PP/di7M74wzv8L6LWruj7Xoa5BamqV+9kvy3JzsLle00 +M/BM25YQsBf0qOBVh2QGh7sYpvQ3c6zo5Z7uzR40HdDnrPohq4gDmgH18jVJ4xsE +kqJuDOh/Ruh1NcO6Zv4bLPdW4zj9xX7Prh//4E1rXwdcNwIZvd9hoG5py9cIDHA+ +0X/7MFS5yQI9mGyIiV3lkyE2vArqNZN+n+iifnAeh/V4ljjFp5wvvyo8AoaAIFTD +2Fl3rw+cRs5uf4NKDpSjBSK9f50rc+i+1bMwcgSMB7PuowPLtAFCQ7rZo0adUSp5 +BR2VbpgYH1TgLZLj8v1DIC/fsQ8z831YocnprmznrmkzfsvW36WcTAsgNbM8WbID +yGg50OkyFEf/+g1J8pjc7HUAEQEAAYkCNgQYAQgAIBYhBJNSXPz2/f+z/ZcA3VpL +EK5DtWonBQJfGv50AhsMAAoJEFpLEK5DtWonNGUP/3d/mt3mcEono9dQp4u9tBr3 +IhFoo4zcR5wTVKF7TWdBBh3vsIbouuP8OgfecSUuXb8RdCEHU3uBCG5a1vXZo+f5 +qvwLd1iEHV+C8csxu7a+zrmsrW5ywuuzox+79RWLrxAJcQLyS66FoQO9xJ9ve50p +Bm8OFUEB+4CmlyO99iEfgfwPwh9ymhV+p2Un1kLhHitBb4uJTawbeluWOyms0QTN +ZZC2SIgE9bmf0CRhcD4t+XqnlGFELR5CjEIZQIsxACujb+eBdms0cVYSrAAJEY/d +C3rcJeDUwnKBqweftapzFdpHNEBGvswwfrciZrFtjqOCIDP2cEpn2hiXme8oRNLi ++4n7Lb1gVzy8wLu9zknKEJBy+F3GMeVURBmdFyV6W2M7otwsj8gfGhIX10B5zce/ +CwffU/72nPcLfzK+WbNL21YU0vaaS6ShNBozkXGPzHaPd6Ri02qRe1u8ys4TDCFv +JV0x1M06cd0+M5HU9lTZRDYfTmQdh40Rby294WveUXSb0VU2ExbX4vDn4BGk1Kmn +R9i/x4rPeMllVGUhnWedlmJP50XTUVKG9RIjDjkXY8n6fWvqlItM7+sG53c82Q6z ++KIdt6Sj9UZtDdlxx1wF1utCllxgo8iuzofhyg4ghRbaPMyGXoRkp0DT18OS2vCB +2Zvzzqpnur6uMCSE2aZ8 +=FKwf +-----END PGP PUBLIC KEY BLOCK----- + +pub rsa4096 2021-04-21 [SC] + C55A B7B9 139E B226 3CD1 AABC 19B0 33D1 760C 227B +uid [ ultime ] Christophe JAILLET +sub rsa4096 2021-04-21 [E] + +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGCAei8BEADKUPoj6I2OjdZ44486xLrZoApbXP3hOadau8DgXXPO84b0dnCS +NqvV3aDSXULtSdh+48pVdv0yBtqCeo6pWNBR/aURxxh3vDJNyQVzhDZsdePITwmV +qkpICUXeuTpyow3ir1+05p0DU6F33TynhZsyHltKmu+GqvxYYrzud+bw9zTN0Z45 +Br/cKF/YE2uVEjq/x440qtSQmFhM7eSQvTv9lo9QgMO+eQXK0Dt4bsfyAZ1q2HAt +XGup0iwQpoxS1ofdkSxpvCBWklAiNXH0+qHGdVTJlqCp70xpsC2DXhbckCeLi2w7 +GGa3jCNuf6P5uxW+tPlyFm5aFBSDd/3gAsU8G/a3ng3+78peKjatpmTkBJmXpA1E +cDWFZNKLlS5eE1c2LG+Hgu0yZrvArsJ8dvjbAuYn7uCWLll/Pjy26L9mKwLlJdcl +TX2rgx7a+yi2nfJwtj0rWWqX95HudUcWRxBVtpCjg6NKzv97dm3wOUOm15xcp0r0 +QAzNtjllOjr3RwTgE4B3j4GFXof92HKS8H+B1/z9ZBbz399fs/wS9o/sDyMVevNP +88IGihaxPkfTw0UKZz5cR6X1BWlcH3404bVB/LHcq7+c1NUqvRfIlwwwsKGjMCWf +vv3cDVUvb3mMhvQs0rBEyb71bbKCe3qb10CvOJAmocp1c+YHo5vpQYeMJQARAQAB +tDJDaHJpc3RvcGhlIEpBSUxMRVQgPGNocmlzdG9waGUuamFpbGxldEB3YW5hZG9v +LmZyPokCTgQTAQoAOBYhBMVat7kTnrImPNGqvBmwM9F2DCJ7BQJggHovAhsDBQsJ +CAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEBmwM9F2DCJ7E4MP/iVC7ZglH2sLi5wv +YZaXqMib7dau1NmGUocaz57U6lR2WpfhTIiHELtFnmb8eVuJGzzmYaDwaIN/knOw +vudUGrMI5TjAmgAdj3BswXoJQNGhKhLwtf3yzvabFbp6oPfxq+PgXRMWnDojQ0cC ++VdfavJt4dOq1TrcH20B1GhJUiNxdkwAlVu3hcpdJ4pgIPVxxeozLAU3hLjMXxeo +j9eVmzTaM/fd0ykbIkMUHfPEdqnmbTPwk2lIMFwcoa7iUdcYIDDWbHvnvVZ+4Uae +pX6st8QHDva+etW/illgYRGMVsCL6FEtYRe+nTJLdvT81QoovVeoeyKtZNzCdNJb +WUfqoCoLDQza8ibRpHLleRIQS4zn/TtXpvVwMG5wjZCnEBypmBzriKSt9QrcvVKu +ROjR9Bizzwj1QUL3fMFoVWLLCt5TkGszZWvfmcjsq4gZhcgCrRp59BpuBa8Khvnf +l5OgVqttmM6PQcFwJTHKUc5Ltzh0xTXwYl6uSEGSn1DoDlmUSnK3R+x0u61FfiHh +KvkO/PIdTeA05ihkMRqMtDbPwsghmdXV2wlkcApdr4wXHsuYffvxN1daoUDQXDix +GgPFRG4eYORYY2hlAo7a4ahUzeCJJQGfrF/E3YojXsIgVIbp+UjlH4kkR9J6F/wl +NVgU2JF03YSZ9zyq4lSrP6lji2ehuQINBGCAei8BEACvQQIc89CwDOiKAeJCL9WW +U4O3XX1LwQCzz6W519PrFnQy3194ddT7L0E4gEB9cNBczxSpvMHUiYkynMLZ7i6a +X4BIVDzOyrN/5S6ZkOddpu9/zGJtupzN68SIpJrIry1zeXVm8Ex3VzfikVFDsxQg +OkTu4b0YWts4hJbJMa3cTh+pLQQ+vHqKe4z6L3hVfdL2LZ8W9xmDvCBh3Ysz/mZF +2dI47XdGGgGY/t50MpFJYrPy0JMfyeHdXHwF90pY/MwWr8QeHjlX589P1MMc/5UB +c1ScFfy40gUryUnRQudN12KEQZDMb4G/8Bz6t4mm8nOspDwwbdHjeZhyrWYZpEd/ +ZV6iywoZ7IBzrdaWzgVs5+DhvJZVudpKlqVip37E9pUYKgMJ2A/asD85HV+yODiF +uub9t7quSWgKKkP75BfBzKCp0T0y+wRnKWUdnlEg2wK0QJxOjkhKw3uC84tr2dlx +CHWF0TLKjkUBqnDT3uSY8DMwZxqEyAEQWzBeP7MFsAy2yZChSHrSKN4ZMx57KYxj +1lsxqFYZo9h9bpar5L77JMkgUtqh+reZYAhMSpk33rgRH5dPpfvn3nkCKgngsxtf +gD9fPpVQgANTEj6rdvtOIFn1Z1U4B4GonaFTGPr771+6ZolLmpylbJp5kviiAz3f +CMJ1cVWhIvr/5G88X4jEMQARAQABiQI2BBgBCgAgFiEExVq3uROesiY80aq8GbAz +0XYMInsFAmCAei8CGwwACgkQGbAz0XYMInsbqA/9HFdq+s1Tk6rluxM3hjnx1HQ8 +R9TStbZqBPrKllOPVNnBpjAShoBKCJ9XbSgzaGVlsDMOXe0wZMjW6TF18igVcA+T +wMTMcgy8Sq8vL7tv5JRtnhZzpM27Db3floWJMCmQtK7aGBC7MpyiHImRvieuDO9P +mwhx9mVDx6+VHb8PCnECg9TMQVEtP9Y0E8qgNy1R+axLShwgO1y/g+u3gPJwGr31 +xiR3icaoMuvb+PEFOZk5L1Dh8rIExqbMH5yH9MeJXiGC2w1QX8KH194UbWRtS3zq +6FrZJ0ZVgoYCvn42icBVt51Nrgl1sqHINBH8ysgK6WvZlw9x22g0tErx3AwGNkrl +lPZ4ctQOxMQ541nN3IJoywxGfsOst2M4je+wNj6USNmAkg1WaezjqyQScw/oIKYj +o18dtGUf6Q3MMHe4O550+upz9bJ0eksCYvC0X2jTNuGdfZo9ZDNh3dxBkoNNbHK5 +hc3m7qU68pdYPzqDkmDFIHyXSYXbmB1wTrrZZL1LQ6jE4a3mRT2v61CRglMUuQK7 +yrZTrPOyuBsZSC//PxK93RgH1xfYR8G8dJPlv0pqF6jD1OjBb6nyU8slRsYfataR +ekJ4VhpVUYgDv8+EzGS9SkgY/DpiyLvPtuhqLXos4ABSwQOEYfG3RhGy7h2B404e +Ot6BQHeyFl0mtrYT1mI= +=L7j3 +-----END PGP PUBLIC KEY BLOCK----- + +pub rsa4096 2021-09-01 [SC] + 26F51EF9A82F4ACB43F1903ED377C9E7D1944C66 +uid [ ultimativ ] Stefan Eissing (icing) +sub rsa4096 2021-09-01 [E] + +-----BEGIN PGP PUBLIC KEY BLOCK----- +Comment: GPGTools - https://gpgtools.org + +mQINBGEvgQMBEADHvUv7G4XclbrRea5S/m0xcV/n4eAOE7UjoDhJurR2NYEA7Ori +YML3h+Uo0a8Fr7BWdvi9FucaxUbZ7ohbUULBNfFDRpH52ojNnnKaKgtWNbGjz0BJ +3y9Udlo7jblGXnsO5zDUoQI8t5I3MjrCK3lU5OO0gvMloa8aSl/rQJ4zo5AYx2VN +Tek0JNcccp5LJaQ31BmoC0ucanBZniQG0CrMKUw6utNoY/6HF2jNVxzBs0VBneA2 +LhIJ/2QKYIEfqTTmmDqeor/Uk3xowEpnAiEe1Y+QKlRkvNs0txekB9XKbW+L6yS8 +yW7VPtAMU4IAA6FKvSOAPWSAuqc0beitZarCw4zCLf5EsluI+r0j4nJ/rCNroiUe +CNCDx4i5wwV39m0+Dmei3HuXUBqyH1ydDspZdgSGacLqUOsj7M+v+lpWiWEgbEo8 +w1jeQ9mn+Juj73QLR3bmUxjTe8acTl22/FGKndMcNf+pawLh51NvqmOPGOX+w+Ul +jWIVG6nTCBZB3OACk8to16YMgw8NfK38VHM76YpMOJwgEk+kqljDU0vvI1LIxoT/ +BHyup3Bf2scPPKhe7U47+WBz2f2FC9ZQdlm7VhMYWhGfiilY+SkAHGIto6KEeavv +O5lo2ziOqsotQeYSN/2nyWLcayC5dQxmZJoo1VvjibRm/GkDGLTmc0wEcwARAQAB +tCtTdGVmYW4gRWlzc2luZyAoaWNpbmcpIDxzdGVmYW5AZWlzc2luZy5vcmc+iQJO +BBMBCgA4FiEEJvUe+agvSstD8ZA+03fJ59GUTGYFAmEvgQMCGwMFCwkIBwMFFQoJ +CAsFFgIDAQACHgECF4AACgkQ03fJ59GUTGaH/g//XHeDFajXzOuebcvVf6iQKUMS +WYlV/GO2f27ZutNv1nFmD6zvlOZ6yr+JANoMAK9iXK6K/R8fYlL1LzkJvCS4V0i3 +fnbZto3bd2Eiyitvs0ppj1c6GLOU5EtWLHsa3l1/X7EGjY9yOguqk168wLwMOXpy +YXGOzdqUxrep91kE4Z3y3YflcRm+3Fvi4dARnjAZguiMvbOLaiEHZ4jDDcckxQr3 +9uOWpq7OYY07PvemqCJyczVkzEKxDj7hm62p9HvoJB/KwTFkYW1aLfB8fd834iEc +6DoF17V8DoPMoU1kLRdcVDEsJPpFFEBF3pn2cmi+oOryRrSK1Rbo+HHQyFqo3D01 +9/svYZHRXnXhRbfBd45/qYaJOeq4tqo572Lv2LFDkuZ6S3rJ1qgVPSvSHL7kkOxh ++/x2zRujXzgdVorjXLYw6LfkCHzaevd/DVycHh6d5ctfiTSEsy3JVp+XKK94r8Rb +e9ybf6whA7tEnuwr0sX5219eYGWw5/awMn8UfMSdrRYQbRdW7Wr8vA+7UMdlY+VI +51gFBAod11bSi9uMPToXczwYH3OMRnAn04sIp2BOwCwnIW4h+RD71pnZgDMcxiil +NxhZJYw8w5dvla2v3zxh+oCa+bdP79wHbphNVVWMfhJcnRbQlDiZgoKXdPhU+mcN +BlyebrE81USOWMS6XXi5Ag0EYS+BAwEQAJ1jce2bjEpG6RNaXkN03GuzB8EOOW4K +J7t2ZNhX77okMdcUrXcu8DvvDG7okGDtwB+Ql6yWwbJeCIxhyWeeF+TwcZWvBs00 +3uiiZLfissN4pn9198BtxntUVqoc1NKbAudOyAimlCUlDExEhHQQ6PYP7i6xBf/M +3MZlYyni2ZnMjbsxuNXTN0TR2J53sKCaQvjQjWQwD9N5/0ZivU/uiCuG1Sbn6Wjt +Xp511g74m0Rio68i12/QVEfMZWhorWDhDxQSPhVWqFC1sChLDHZ/7L1IhzMX0q3W +xPCK+rBsMSy/SWw5GotrQATIgJLTGQG7tehDWiVDTxCQSrELQoawJdO99g6C+OEL +m3Z5CnDYVwD4CLPB+DRROaB8UbauvMJZCHMo3OXUALj89ZRpD20h2RQyIkTl37LS +J9IYM9SxA792ujNoUbdWS/FNIUpopP94jemyaj6qqEBwUGMvIPE0RdsIPdOEcuS3 +3kW9W/bHlWCe8m0CIPbwZFohNGk9+KBalz1CTNnZxB7rvRyLLhzJws9BqtU7X3dy +J0ZcYHGQJsvU8ZfAM/EUMLbyvUSbnDdNwDDjduO8ZuOWYjg5f/FwSR25k/yGvfUe +RyiptHnl5c7BMkNaEtfHFVDPOIts6vDVD3K/np9AK7UY58snaMnqFTtxz1munJSX +C0IXelr+V6hRABEBAAGJAjYEGAEKACAWIQQm9R75qC9Ky0PxkD7Td8nn0ZRMZgUC +YS+BAwIbDAAKCRDTd8nn0ZRMZqEoD/49MVe/6bW54eh0CG6B07tY1qlkelSv+xfY +tgZ3V+vZFtLVjo0RYpeP4Yt0ZtpNqZEPnHqwAvD7TZQayNVgo13uK/0aBlAhVtWZ +54nuItHcwT90u+3Tj5hnHwPptIxSsfRWEAg5BkegQN76c+yhNHWJ5U2H2pG2+YkP +dXHS89/nbDEi9kZhgtIer9lhmZSgSO2RYzj/QHgLNEor3IGUGAI3u0M2o+dcoVyH +NJGPRboBzCm8qNDt/3cctQDzFdDA+3X7KbPKekYs3ewuO1l+JtXtnq3S4tkvMDI1 +ZKX0RBydw5w+bksTk6Z7X7nbYmPCeNNBVQUshwQwDXCHPDXd1MxWJHqTz8lOPo70 +fHH0DWTTOw9rNMacUnz7FE0veDcknOZQ4snbHwZkUC4Mg5wM6KOyWgrTW6XK0TSx +Su1Qou7xKD/A1zgx9C0eIqicnifDUEY9SGfXaJrsJDJICEP0BtmcfsP0Z8DcmzOv +atfaF/cmJBtSR6IegJYJCtrlFdpIKQSikZO4QP5B3odc0ipuklkJcPkbQhpx+C5x +O3yU7Izv+cy+yhF+uq8NtWVQx+WCtt4RWqSn6sxtUvTb5qnRbMQtZJ2vbN8+WqTK +ZNlXGF7PBgjSTJnHmCvaT4gfVnJ/NAwn4stq+bdPnrBSKaDnYGwWpV9g8u+XSpOF +ebJKIV3Evw== +=tHCM +-----END PGP PUBLIC KEY BLOCK----- + diff --git a/SOURCES/README.confd b/README.confd similarity index 100% rename from SOURCES/README.confd rename to README.confd diff --git a/SOURCES/README.confmod b/README.confmod similarity index 100% rename from SOURCES/README.confmod rename to README.confmod diff --git a/SOURCES/action-configtest.sh b/SOURCES/action-configtest.sh deleted file mode 100644 index 6685b0a..0000000 --- a/SOURCES/action-configtest.sh +++ /dev/null @@ -1,2 +0,0 @@ -#!/bin/sh -exec /sbin/apachectl configtest "$@" diff --git a/SOURCES/action-graceful.sh b/SOURCES/action-graceful.sh deleted file mode 100644 index dc68b2e..0000000 --- a/SOURCES/action-graceful.sh +++ /dev/null @@ -1,2 +0,0 @@ -#!/bin/sh -exec /sbin/apachectl graceful "$@" diff --git a/SOURCES/httpd-2.4.28-icons.patch b/SOURCES/httpd-2.4.28-icons.patch deleted file mode 100644 index 904d6a4..0000000 --- a/SOURCES/httpd-2.4.28-icons.patch +++ /dev/null @@ -1,29 +0,0 @@ - -- Fix config for /icons/ dir to allow symlink to poweredby.png -- Avoid using coredump GIF for a directory called "core" - -Upstream-Status: vendor specific patch - -diff --git a/docs/conf/extra/httpd-autoindex.conf.in b/docs/conf/extra/httpd-autoindex.conf.in -index 51b02ed..dd6f2c6 100644 ---- a/docs/conf/extra/httpd-autoindex.conf.in -+++ b/docs/conf/extra/httpd-autoindex.conf.in -@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable VersionSort - Alias /icons/ "@exp_iconsdir@/" - - -- Options Indexes MultiViews -+ Options Indexes MultiViews FollowSymlinks - AllowOverride None - Require all granted - -@@ -53,7 +53,8 @@ AddIcon /icons/dvi.gif .dvi - AddIcon /icons/uuencoded.gif .uu - AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl - AddIcon /icons/tex.gif .tex --AddIcon /icons/bomb.gif core -+AddIcon /icons/bomb.gif /core -+AddIcon /icons/bomb.gif */core.* - - AddIcon /icons/back.gif .. - AddIcon /icons/hand.right.gif README diff --git a/SOURCES/httpd-2.4.28-r1811831.patch b/SOURCES/httpd-2.4.28-r1811831.patch deleted file mode 100644 index b8d8215..0000000 --- a/SOURCES/httpd-2.4.28-r1811831.patch +++ /dev/null @@ -1,81 +0,0 @@ -diff --git a/server/util_script.c b/server/util_script.c -index 4121ae0..b7f8674 100644 ---- a/server/util_script.c -+++ b/server/util_script.c -@@ -92,9 +92,21 @@ static void add_unless_null(apr_table_t *table, const char *name, const char *va - } - } - --static void env2env(apr_table_t *table, const char *name) -+/* Sets variable @name in table @dest from r->subprocess_env if -+ * available, else from the environment, else from @fallback if -+ * non-NULL. */ -+static void env2env(apr_table_t *dest, request_rec *r, -+ const char *name, const char *fallback) - { -- add_unless_null(table, name, getenv(name)); -+ const char *val; -+ -+ val = apr_table_get(r->subprocess_env, name); -+ if (!val) -+ val = apr_pstrdup(r->pool, getenv(name)); -+ if (!val) -+ val = apr_pstrdup(r->pool, fallback); -+ if (val) -+ apr_table_addn(dest, name, val); - } - - AP_DECLARE(char **) ap_create_environment(apr_pool_t *p, apr_table_t *t) -@@ -211,37 +223,29 @@ AP_DECLARE(void) ap_add_common_vars(request_rec *r) - add_unless_null(e, http2env(r, hdrs[i].key), hdrs[i].val); - } - -- env_temp = apr_table_get(r->subprocess_env, "PATH"); -- if (env_temp == NULL) { -- env_temp = getenv("PATH"); -- } -- if (env_temp == NULL) { -- env_temp = DEFAULT_PATH; -- } -- apr_table_addn(e, "PATH", apr_pstrdup(r->pool, env_temp)); -- -+ env2env(e, r, "PATH", DEFAULT_PATH); - #if defined(WIN32) -- env2env(e, "SystemRoot"); -- env2env(e, "COMSPEC"); -- env2env(e, "PATHEXT"); -- env2env(e, "WINDIR"); -+ env2env(e, r, "SystemRoot", NULL); -+ env2env(e, r, "COMSPEC", NULL); -+ env2env(e, r, "PATHEXT", NULL); -+ env2env(e, r, "WINDIR", NULL); - #elif defined(OS2) -- env2env(e, "COMSPEC"); -- env2env(e, "ETC"); -- env2env(e, "DPATH"); -- env2env(e, "PERLLIB_PREFIX"); -+ env2env(e, r, "COMSPEC", NULL); -+ env2env(e, r, "ETC", NULL); -+ env2env(e, r, "DPATH", NULL); -+ env2env(e, r, "PERLLIB_PREFIX", NULL); - #elif defined(BEOS) -- env2env(e, "LIBRARY_PATH"); -+ env2env(e, r, "LIBRARY_PATH", NULL); - #elif defined(DARWIN) -- env2env(e, "DYLD_LIBRARY_PATH"); -+ env2env(e, r, "DYLD_LIBRARY_PATH", NULL); - #elif defined(_AIX) -- env2env(e, "LIBPATH"); -+ env2env(e, r, "LIBPATH", NULL); - #elif defined(__HPUX__) - /* HPUX PARISC 2.0W knows both, otherwise redundancy is harmless */ -- env2env(e, "SHLIB_PATH"); -- env2env(e, "LD_LIBRARY_PATH"); -+ env2env(e, r, "SHLIB_PATH", NULL); -+ env2env(e, r, "LD_LIBRARY_PATH", NULL); - #else /* Some Unix */ -- env2env(e, "LD_LIBRARY_PATH"); -+ env2env(e, r, "LD_LIBRARY_PATH", NULL); - #endif - - apr_table_addn(e, "SERVER_SIGNATURE", ap_psignature("", r)); diff --git a/SOURCES/httpd-2.4.28-statements-comment.patch b/SOURCES/httpd-2.4.28-statements-comment.patch deleted file mode 100644 index 65f1bfb..0000000 --- a/SOURCES/httpd-2.4.28-statements-comment.patch +++ /dev/null @@ -1,16 +0,0 @@ -diff --git a/modules/aaa/mod_access_compat.c b/modules/aaa/mod_access_compat.c -index 3023803..2edf440 100644 ---- a/modules/aaa/mod_access_compat.c -+++ b/modules/aaa/mod_access_compat.c -@@ -152,6 +152,11 @@ static const char *allow_cmd(cmd_parms *cmd, void *dv, const char *from, - if (strcasecmp(from, "from")) - return "allow and deny must be followed by 'from'"; - -+ s = ap_strchr(where, '#'); -+ if (s) { -+ *s = '\0'; -+ } -+ - a = (allowdeny *) apr_array_push(cmd->info ? d->allows : d->denys); - a->x.from = where; - a->limited = cmd->limited; diff --git a/SOURCES/httpd-2.4.32-export.patch b/SOURCES/httpd-2.4.32-export.patch deleted file mode 100644 index 18cdafa..0000000 --- a/SOURCES/httpd-2.4.32-export.patch +++ /dev/null @@ -1,22 +0,0 @@ - -There is no need to "suck in" the apr/apr-util symbols when using -a shared libapr{,util}, it just bloats the symbol table; so don't. - -Upstream-HEAD: needed -Upstream-2.0: omit -Upstream-Status: EXPORT_DIRS change is conditional on using shared apr - -diff --git a/server/Makefile.in b/server/Makefile.in -index 1fa3344..f635d76 100644 ---- a/server/Makefile.in -+++ b/server/Makefile.in -@@ -60,9 +60,6 @@ export_files: - ls $$dir/*.h ; \ - done; \ - echo "$(top_srcdir)/server/mpm_fdqueue.h"; \ -- for dir in $(EXPORT_DIRS_APR); do \ -- ls $$dir/ap[ru].h $$dir/ap[ru]_*.h 2>/dev/null; \ -- done; \ - ) | sed -e s,//,/,g | sort -u > $@ - - exports.c: export_files diff --git a/SOURCES/httpd-2.4.34-CVE-2019-9511-and-9516-and-9517.patch b/SOURCES/httpd-2.4.34-CVE-2019-9511-and-9516-and-9517.patch deleted file mode 100644 index 7cee845..0000000 --- a/SOURCES/httpd-2.4.34-CVE-2019-9511-and-9516-and-9517.patch +++ /dev/null @@ -1,19 +0,0 @@ -diff --git a/server/mpm/event/event.c b/server/mpm/event/event.c -index 16e39be..2543693 100644 ---- a/server/mpm/event/event.c -+++ b/server/mpm/event/event.c -@@ -1111,10 +1111,11 @@ read_request: - "network write failure in core output filter"); - cs->pub.state = CONN_STATE_LINGER; - } -- else if (c->data_in_output_filters) { -+ else if (c->data_in_output_filters || -+ cs->pub.sense == CONN_SENSE_WANT_READ) { - /* Still in WRITE_COMPLETION_STATE: -- * Set a write timeout for this connection, and let the -- * event thread poll for writeability. -+ * Set a read/write timeout for this connection, and let the -+ * event thread poll for read/writeability. - */ - cs->queue_timestamp = apr_time_now(); - notify_suspend(cs); diff --git a/SOURCES/httpd-2.4.35-apachectl.patch b/SOURCES/httpd-2.4.35-apachectl.patch deleted file mode 100644 index f24b834..0000000 --- a/SOURCES/httpd-2.4.35-apachectl.patch +++ /dev/null @@ -1,113 +0,0 @@ -diff --git a/docs/man/apachectl.8 b/docs/man/apachectl.8 -index 870a048..32d3ee5 100644 ---- a/docs/man/apachectl.8 -+++ b/docs/man/apachectl.8 -@@ -74,7 +74,7 @@ Restarts the Apache httpd daemon\&. If the daemon is not running, it is started\ - Displays a full status report from mod_status\&. For this to work, you need to have mod_status enabled on your server and a text-based browser such as \fBlynx\fR available on your system\&. The URL used to access the status report can be set by editing the \fBSTATUSURL\fR variable in the script\&. - .TP - \fBstatus\fR --Displays a brief status report\&. Similar to the \fBfullstatus\fR option, except that the list of requests currently being served is omitted\&. -+Displays a brief status report using systemd\&. - .TP - \fBgraceful\fR - Gracefully restarts the Apache httpd daemon\&. If the daemon is not running, it is started\&. This differs from a normal restart in that currently open connections are not aborted\&. A side effect is that old log files will not be closed immediately\&. This means that if used in a log rotation script, a substantial delay may be necessary to ensure that the old log files are closed before processing them\&. This command automatically checks the configuration files as in \fBconfigtest\fR before initiating the restart to make sure Apache doesn't die\&. This is equivalent to \fBapachectl -k graceful\fR\&. -diff --git a/support/apachectl.in b/support/apachectl.in -index 3281c2e..8ce6f2b 100644 ---- a/support/apachectl.in -+++ b/support/apachectl.in -@@ -44,19 +44,20 @@ ARGV="$@" - # the path to your httpd binary, including options if necessary - HTTPD='@exp_sbindir@/@progname@' - # --# pick up any necessary environment variables --if test -f @exp_sbindir@/envvars; then -- . @exp_sbindir@/envvars --fi - # - # a command that outputs a formatted text version of the HTML at the - # url given on the command line. Designed for lynx, however other - # programs may work. --LYNX="@LYNX_PATH@ -dump" -+if [ -x "@LYNX_PATH@" ]; then -+ LYNX="@LYNX_PATH@ -dump" -+else -+ LYNX=none -+fi - # - # the URL to your server's mod_status status page. If you do not - # have one, then status and fullstatus will not work. - STATUSURL="http://localhost:@PORT@/server-status" -+ - # - # Set this variable to a command that increases the maximum - # number of file descriptors allowed per child process. This is -@@ -76,9 +77,46 @@ if [ "x$ARGV" = "x" ] ; then - ARGV="-h" - fi - -+function checklynx() { -+if [ "$LYNX" = "none" ]; then -+ echo "The 'links' package is required for this functionality." -+ exit 8 -+fi -+} -+ -+function testconfig() { -+# httpd is denied terminal access in SELinux, so run in the -+# current context to get stdout from $HTTPD -t. -+if test -x /usr/sbin/selinuxenabled && /usr/sbin/selinuxenabled; then -+ runcon -- `id -Z` /usr/sbin/httpd $OPTIONS -t -+else -+ /usr/sbin/httpd $OPTIONS -t -+fi -+ERROR=$? -+} -+ -+if [ "x$2" != "x" ] ; then -+ echo Passing arguments to httpd using apachectl is no longer supported. -+ echo You can only start/stop/restart httpd using this script. -+ echo If you want to pass extra arguments to httpd, edit the -+ echo /etc/sysconfig/httpd config file. -+fi -+ - case $ACMD in --start|stop|restart|graceful|graceful-stop) -- $HTTPD -k $ARGV -+start|stop|restart|status) -+ /usr/bin/systemctl $ACMD httpd.service -+ ERROR=$? -+ ;; -+graceful) -+ if /usr/bin/systemctl -q is-active httpd.service; then -+ /usr/bin/systemctl reload httpd.service -+ else -+ /usr/bin/systemctl start httpd.service -+ fi -+ ERROR=$? -+ ;; -+graceful-stop) -+ /usr/bin/systemctl stop httpd.service - ERROR=$? - ;; - startssl|sslstart|start-SSL) -@@ -88,17 +126,14 @@ startssl|sslstart|start-SSL) - ERROR=2 - ;; - configtest) -- $HTTPD -t -- ERROR=$? -- ;; --status) -- $LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } ' -+ testconfig - ;; - fullstatus) -+ checklynx - $LYNX $STATUSURL - ;; - *) -- $HTTPD "$@" -+ /usr/sbin/httpd $OPTIONS "$@" - ERROR=$? - esac - diff --git a/SOURCES/httpd-2.4.35-detect-systemd.patch b/SOURCES/httpd-2.4.35-detect-systemd.patch deleted file mode 100644 index 60dffb6..0000000 --- a/SOURCES/httpd-2.4.35-detect-systemd.patch +++ /dev/null @@ -1,77 +0,0 @@ -diff --git a/Makefile.in b/Makefile.in -index ea8366e..06b8c5a 100644 ---- a/Makefile.in -+++ b/Makefile.in -@@ -4,7 +4,7 @@ CLEAN_SUBDIRS = test - - PROGRAM_NAME = $(progname) - PROGRAM_SOURCES = modules.c --PROGRAM_LDADD = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(PCRE_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS) -+PROGRAM_LDADD = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS) - PROGRAM_PRELINK = $(COMPILE) -c $(top_srcdir)/server/buildmark.c - PROGRAM_DEPENDENCIES = \ - server/libmain.la \ -diff --git a/acinclude.m4 b/acinclude.m4 -index ce1d637..0ad0c13 100644 ---- a/acinclude.m4 -+++ b/acinclude.m4 -@@ -606,6 +606,30 @@ AC_DEFUN([APACHE_CHECK_OPENSSL],[ - fi - ]) - -+AC_DEFUN(APACHE_CHECK_SYSTEMD, [ -+dnl Check for systemd support for listen.c's socket activation. -+case $host in -+*-linux-*) -+ if test -n "$PKGCONFIG" && $PKGCONFIG --exists libsystemd; then -+ SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd` -+ elif test -n "$PKGCONFIG" && $PKGCONFIG --exists libsystemd-daemon; then -+ SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd-daemon` -+ else -+ AC_CHECK_LIB(systemd-daemon, sd_notify, SYSTEMD_LIBS="-lsystemd-daemon") -+ fi -+ if test -n "$SYSTEMD_LIBS"; then -+ AC_CHECK_HEADERS(systemd/sd-daemon.h) -+ if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then -+ AC_MSG_WARN([Your system does not support systemd.]) -+ else -+ APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS]) -+ AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported]) -+ fi -+ fi -+ ;; -+esac -+]) -+ - dnl - dnl APACHE_EXPORT_ARGUMENTS - dnl Export (via APACHE_SUBST) the various path-related variables that -diff --git a/configure.in b/configure.in -index 82bfeef..eedba50 100644 ---- a/configure.in -+++ b/configure.in -@@ -234,6 +234,7 @@ if test "$PCRE_CONFIG" != "false"; then - AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG]) - APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`]) - APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs`]) -+ APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)]) - else - AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/]) - fi -@@ -504,6 +505,8 @@ if test "$ac_cv_struct_tm_gmtoff" = "yes"; then - AC_DEFINE(HAVE_GMTOFF, 1, [Define if struct tm has a tm_gmtoff field]) - fi - -+APACHE_CHECK_SYSTEMD -+ - dnl ## Set up any appropriate OS-specific environment variables for apachectl - - case $host in -@@ -677,6 +680,7 @@ APACHE_SUBST(OS_DIR) - APACHE_SUBST(BUILTIN_LIBS) - APACHE_SUBST(SHLIBPATH_VAR) - APACHE_SUBST(OS_SPECIFIC_VARS) -+APACHE_SUBST(HTTPD_LIBS) - - PRE_SHARED_CMDS='echo ""' - POST_SHARED_CMDS='echo ""' diff --git a/SOURCES/httpd-2.4.35-ocsp-wrong-ctx.patch b/SOURCES/httpd-2.4.35-ocsp-wrong-ctx.patch deleted file mode 100644 index 5523ea5..0000000 --- a/SOURCES/httpd-2.4.35-ocsp-wrong-ctx.patch +++ /dev/null @@ -1,15 +0,0 @@ -diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c -index a5e86e4..6611610 100644 ---- a/modules/ssl/ssl_engine_kernel.c -+++ b/modules/ssl/ssl_engine_kernel.c -@@ -1823,8 +1823,8 @@ int ssl_callback_SSLVerify(int ok, X509_STORE_CTX *ctx) - /* - * Perform OCSP-based revocation checks - */ -- if (ok && ((sc->server->ocsp_mask & SSL_OCSPCHECK_CHAIN) || -- (errdepth == 0 && (sc->server->ocsp_mask & SSL_OCSPCHECK_LEAF)))) { -+ if (ok && ((mctx->ocsp_mask & SSL_OCSPCHECK_CHAIN) || -+ (errdepth == 0 && (mctx->ocsp_mask & SSL_OCSPCHECK_LEAF)))) { - /* If there was an optional verification error, it's not - * possible to perform OCSP validation since the issuer may be - * missing/untrusted. Fail in that case. */ diff --git a/SOURCES/httpd-2.4.35-r1633085.patch b/SOURCES/httpd-2.4.35-r1633085.patch deleted file mode 100644 index a14b626..0000000 --- a/SOURCES/httpd-2.4.35-r1633085.patch +++ /dev/null @@ -1,16 +0,0 @@ -diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c -index d52d5e3..8a57659 100644 ---- a/modules/ssl/ssl_engine_io.c -+++ b/modules/ssl/ssl_engine_io.c -@@ -1415,6 +1415,11 @@ static apr_status_t ssl_io_filter_handshake(ssl_filter_ctx_t *filter_ctx) - "\"SSLVerifyClient optional_no_ca\" " - "configuration"); - ssl_log_ssl_error(SSLLOG_MARK, APLOG_INFO, server); -+ -+ /* on session resumption ssl_callback_SSLVerify() -+ * will not be called, therefore we have to set it here -+ */ -+ sslconn->verify_info = "GENEROUS"; - } - else { - const char *error = sslconn->verify_error ? diff --git a/SOURCES/httpd-2.4.35-r1738878.patch b/SOURCES/httpd-2.4.35-r1738878.patch deleted file mode 100644 index 700e80a..0000000 --- a/SOURCES/httpd-2.4.35-r1738878.patch +++ /dev/null @@ -1,140 +0,0 @@ -diff --git a/modules/proxy/ajp.h b/modules/proxy/ajp.h -index c119a7e..267150a 100644 ---- a/modules/proxy/ajp.h -+++ b/modules/proxy/ajp.h -@@ -413,12 +413,14 @@ apr_status_t ajp_ilink_receive(apr_socket_t *sock, ajp_msg_t *msg); - * @param sock backend socket - * @param r current request - * @param buffsize max size of the AJP packet. -+ * @param secret authentication secret - * @param uri requested uri - * @return APR_SUCCESS or error - */ - apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r, - apr_size_t buffsize, -- apr_uri_t *uri); -+ apr_uri_t *uri, -+ const char *secret); - - /** - * Read the ajp message and return the type of the message. -diff --git a/modules/proxy/ajp_header.c b/modules/proxy/ajp_header.c -index 67353a7..680a8f3 100644 ---- a/modules/proxy/ajp_header.c -+++ b/modules/proxy/ajp_header.c -@@ -213,7 +213,8 @@ AJPV13_REQUEST/AJPV14_REQUEST= - - static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg, - request_rec *r, -- apr_uri_t *uri) -+ apr_uri_t *uri, -+ const char *secret) - { - int method; - apr_uint32_t i, num_headers = 0; -@@ -293,17 +294,15 @@ static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg, - i, elts[i].key, elts[i].val); - } - --/* XXXX need to figure out how to do this -- if (s->secret) { -+ if (secret) { - if (ajp_msg_append_uint8(msg, SC_A_SECRET) || -- ajp_msg_append_string(msg, s->secret)) { -+ ajp_msg_append_string(msg, secret)) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(03228) -- "Error ajp_marshal_into_msgb - " -+ "ajp_marshal_into_msgb: " - "Error appending secret"); - return APR_EGENERAL; - } - } -- */ - - if (r->user) { - if (ajp_msg_append_uint8(msg, SC_A_REMOTE_USER) || -@@ -671,7 +670,8 @@ static apr_status_t ajp_unmarshal_response(ajp_msg_t *msg, - apr_status_t ajp_send_header(apr_socket_t *sock, - request_rec *r, - apr_size_t buffsize, -- apr_uri_t *uri) -+ apr_uri_t *uri, -+ const char *secret) - { - ajp_msg_t *msg; - apr_status_t rc; -@@ -683,7 +683,7 @@ apr_status_t ajp_send_header(apr_socket_t *sock, - return rc; - } - -- rc = ajp_marshal_into_msgb(msg, r, uri); -+ rc = ajp_marshal_into_msgb(msg, r, uri, secret); - if (rc != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(00988) - "ajp_send_header: ajp_marshal_into_msgb failed"); -diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c -index 69a35ce..800ede1 100644 ---- a/modules/proxy/mod_proxy.c -+++ b/modules/proxy/mod_proxy.c -@@ -327,6 +327,12 @@ static const char *set_worker_param(apr_pool_t *p, - worker->s->response_field_size = (s ? s : HUGE_STRING_LEN); - worker->s->response_field_size_set = 1; - } -+ else if (!strcasecmp(key, "secret")) { -+ if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) { -+ return apr_psprintf(p, "Secret length must be < %d characters", -+ (int)sizeof(worker->s->secret)); -+ } -+ } - else { - if (set_worker_hc_param_f) { - return set_worker_hc_param_f(p, s, worker, key, val, NULL); -diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h -index aabd09f..3419023 100644 ---- a/modules/proxy/mod_proxy.h -+++ b/modules/proxy/mod_proxy.h -@@ -357,6 +357,7 @@ PROXY_WORKER_HC_FAIL ) - #define PROXY_WORKER_MAX_HOSTNAME_SIZE 64 - #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE - #define PROXY_BALANCER_MAX_STICKY_SIZE 64 -+#define PROXY_WORKER_MAX_SECRET_SIZE 64 - - #define PROXY_RFC1035_HOSTNAME_SIZE 256 - -@@ -450,6 +451,7 @@ typedef struct { - hcmethod_t method; /* method to use for health check */ - apr_interval_time_t interval; - char upgrade[PROXY_WORKER_MAX_SCHEME_SIZE];/* upgrade protocol used by mod_proxy_wstunnel */ -+ char secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */ - char hostname_ex[PROXY_RFC1035_HOSTNAME_SIZE]; /* RFC1035 compliant version of the remote backend address */ - apr_size_t response_field_size; /* Size of proxy response buffer in bytes. */ - unsigned int response_field_size_set:1; -diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c -index 73716af..6faabea 100644 ---- a/modules/proxy/mod_proxy_ajp.c -+++ b/modules/proxy/mod_proxy_ajp.c -@@ -193,6 +193,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r, - apr_off_t content_length = 0; - int original_status = r->status; - const char *original_status_line = r->status_line; -+ const char *secret = NULL; - - if (psf->io_buffer_size_set) - maxsize = psf->io_buffer_size; -@@ -202,12 +203,15 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r, - maxsize = AJP_MSG_BUFFER_SZ; - maxsize = APR_ALIGN(maxsize, 1024); - -+ if (*conn->worker->s->secret) -+ secret = conn->worker->s->secret; -+ - /* - * Send the AJP request to the remote server - */ - - /* send request headers */ -- status = ajp_send_header(conn->sock, r, maxsize, uri); -+ status = ajp_send_header(conn->sock, r, maxsize, uri, secret); - if (status != APR_SUCCESS) { - conn->close = 1; - ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00868) diff --git a/SOURCES/httpd-2.4.35-r1825120.patch b/SOURCES/httpd-2.4.35-r1825120.patch deleted file mode 100644 index 6611872..0000000 --- a/SOURCES/httpd-2.4.35-r1825120.patch +++ /dev/null @@ -1,96 +0,0 @@ -diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c -index 19cb611..79d5219 100644 ---- a/modules/ssl/ssl_engine_init.c -+++ b/modules/ssl/ssl_engine_init.c -@@ -2070,70 +2070,18 @@ int ssl_proxy_section_post_config(apr_pool_t *p, apr_pool_t *plog, - return OK; - } - --static int ssl_init_FindCAList_X509NameCmp(const X509_NAME * const *a, -- const X509_NAME * const *b) --{ -- return(X509_NAME_cmp(*a, *b)); --} -- --static void ssl_init_PushCAList(STACK_OF(X509_NAME) *ca_list, -- server_rec *s, apr_pool_t *ptemp, -- const char *file) --{ -- int n; -- STACK_OF(X509_NAME) *sk; -- -- sk = (STACK_OF(X509_NAME) *) -- SSL_load_client_CA_file(file); -- -- if (!sk) { -- return; -- } -- -- for (n = 0; n < sk_X509_NAME_num(sk); n++) { -- X509_NAME *name = sk_X509_NAME_value(sk, n); -- -- ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02209) -- "CA certificate: %s", -- modssl_X509_NAME_to_string(ptemp, name, 0)); -- -- /* -- * note that SSL_load_client_CA_file() checks for duplicates, -- * but since we call it multiple times when reading a directory -- * we must also check for duplicates ourselves. -- */ -- -- if (sk_X509_NAME_find(ca_list, name) < 0) { -- /* this will be freed when ca_list is */ -- sk_X509_NAME_push(ca_list, name); -- } -- else { -- /* need to free this ourselves, else it will leak */ -- X509_NAME_free(name); -- } -- } -- -- sk_X509_NAME_free(sk); --} -- - STACK_OF(X509_NAME) *ssl_init_FindCAList(server_rec *s, - apr_pool_t *ptemp, - const char *ca_file, - const char *ca_path) - { -- STACK_OF(X509_NAME) *ca_list; -- -- /* -- * Start with a empty stack/list where new -- * entries get added in sorted order. -- */ -- ca_list = sk_X509_NAME_new(ssl_init_FindCAList_X509NameCmp); -+ STACK_OF(X509_NAME) *ca_list = sk_X509_NAME_new_null();; - - /* - * Process CA certificate bundle file - */ - if (ca_file) { -- ssl_init_PushCAList(ca_list, s, ptemp, ca_file); -+ SSL_add_file_cert_subjects_to_stack(ca_list, ca_file); - /* - * If ca_list is still empty after trying to load ca_file - * then the file failed to load, and users should hear about that. -@@ -2168,17 +2116,12 @@ STACK_OF(X509_NAME) *ssl_init_FindCAList(server_rec *s, - continue; /* don't try to load directories */ - } - file = apr_pstrcat(ptemp, ca_path, "/", direntry.name, NULL); -- ssl_init_PushCAList(ca_list, s, ptemp, file); -+ SSL_add_file_cert_subjects_to_stack(ca_list, file); - } - - apr_dir_close(dir); - } - -- /* -- * Cleanup -- */ -- (void) sk_X509_NAME_set_cmp_func(ca_list, NULL); -- - return ca_list; - } - diff --git a/SOURCES/httpd-2.4.35-r1830819+.patch b/SOURCES/httpd-2.4.35-r1830819+.patch deleted file mode 100644 index 18ae1d3..0000000 --- a/SOURCES/httpd-2.4.35-r1830819+.patch +++ /dev/null @@ -1,708 +0,0 @@ -# ./pullrev.sh 1830819 1830836 1830912 1830913 1830927 1831168 1831173 - -http://svn.apache.org/viewvc?view=revision&revision=1830819 -http://svn.apache.org/viewvc?view=revision&revision=1830912 -http://svn.apache.org/viewvc?view=revision&revision=1830913 -http://svn.apache.org/viewvc?view=revision&revision=1830927 -http://svn.apache.org/viewvc?view=revision&revision=1831168 -http://svn.apache.org/viewvc?view=revision&revision=1831173 -http://svn.apache.org/viewvc?view=revision&revision=1835240 -http://svn.apache.org/viewvc?view=revision&revision=1835242 -http://svn.apache.org/viewvc?view=revision&revision=1835615 - -diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c -index 43397f9..ff8f429 100644 ---- httpd-2.4.35/modules/ssl/ssl_engine_config.c.r1830819+ -+++ httpd-2.4.35/modules/ssl/ssl_engine_config.c -@@ -899,7 +899,9 @@ - SSLSrvConfigRec *sc = mySrvConfig(cmd->server); - const char *err; - -- if ((err = ssl_cmd_check_file(cmd, &arg))) { -+ /* Only check for non-ENGINE based certs. */ -+ if (!modssl_is_engine_id(arg) -+ && (err = ssl_cmd_check_file(cmd, &arg))) { - return err; - } - -@@ -915,7 +917,9 @@ - SSLSrvConfigRec *sc = mySrvConfig(cmd->server); - const char *err; - -- if ((err = ssl_cmd_check_file(cmd, &arg))) { -+ /* Check keyfile exists for non-ENGINE keys. */ -+ if (!modssl_is_engine_id(arg) -+ && (err = ssl_cmd_check_file(cmd, &arg))) { - return err; - } - ---- httpd-2.4.35/modules/ssl/ssl_engine_init.c.r1830819+ -+++ httpd-2.4.35/modules/ssl/ssl_engine_init.c -@@ -1186,12 +1186,18 @@ - (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i, - const char *)); - i++) { -+ EVP_PKEY *pkey; -+ const char *engine_certfile = NULL; -+ - key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i); - - ERR_clear_error(); - - /* first the certificate (public key) */ -- if (mctx->cert_chain) { -+ if (modssl_is_engine_id(certfile)) { -+ engine_certfile = certfile; -+ } -+ else if (mctx->cert_chain) { - if ((SSL_CTX_use_certificate_file(mctx->ssl_ctx, certfile, - SSL_FILETYPE_PEM) < 1)) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02561) -@@ -1220,12 +1226,46 @@ - - ERR_clear_error(); - -- if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile, -- SSL_FILETYPE_PEM) < 1) && -- (ERR_GET_FUNC(ERR_peek_last_error()) -- != X509_F_X509_CHECK_PRIVATE_KEY)) { -+ if (modssl_is_engine_id(keyfile)) { -+ apr_status_t rv; -+ -+ cert = NULL; -+ -+ if ((rv = modssl_load_engine_keypair(s, ptemp, vhost_id, -+ engine_certfile, keyfile, -+ &cert, &pkey))) { -+ return rv; -+ } -+ -+ if (cert) { -+ if (SSL_CTX_use_certificate(mctx->ssl_ctx, cert) < 1) { -+ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10137) -+ "Failed to configure engine certificate %s, check %s", -+ key_id, certfile); -+ ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); -+ return APR_EGENERAL; -+ } -+ -+ /* SSL_CTX now owns the cert. */ -+ X509_free(cert); -+ } -+ -+ if (SSL_CTX_use_PrivateKey(mctx->ssl_ctx, pkey) < 1) { -+ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10130) -+ "Failed to configure private key %s from engine", -+ keyfile); -+ ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); -+ return APR_EGENERAL; -+ } -+ -+ /* SSL_CTX now owns the key */ -+ EVP_PKEY_free(pkey); -+ } -+ else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile, -+ SSL_FILETYPE_PEM) < 1) -+ && (ERR_GET_FUNC(ERR_peek_last_error()) -+ != X509_F_X509_CHECK_PRIVATE_KEY)) { - ssl_asn1_t *asn1; -- EVP_PKEY *pkey; - const unsigned char *ptr; - - ERR_clear_error(); -@@ -1312,8 +1352,9 @@ - /* - * Try to read DH parameters from the (first) SSLCertificateFile - */ -- if ((certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *)) && -- (dhparams = ssl_dh_GetParamFromFile(certfile))) { -+ certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); -+ if (certfile && !modssl_is_engine_id(certfile) -+ && (dhparams = ssl_dh_GetParamFromFile(certfile))) { - SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams); - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) - "Custom DH parameters (%d bits) for %s loaded from %s", -@@ -1325,10 +1366,10 @@ - /* - * Similarly, try to read the ECDH curve name from SSLCertificateFile... - */ -- if ((certfile != NULL) && -- (ecparams = ssl_ec_GetParamFromFile(certfile)) && -- (nid = EC_GROUP_get_curve_name(ecparams)) && -- (eckey = EC_KEY_new_by_curve_name(nid))) { -+ if (certfile && !modssl_is_engine_id(certfile) -+ && (ecparams = ssl_ec_GetParamFromFile(certfile)) -+ && (nid = EC_GROUP_get_curve_name(ecparams)) -+ && (eckey = EC_KEY_new_by_curve_name(nid))) { - SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey); - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541) - "ECDH curve %s for %s specified in %s", ---- httpd-2.4.35/modules/ssl/ssl_engine_pphrase.c.r1830819+ -+++ httpd-2.4.35/modules/ssl/ssl_engine_pphrase.c -@@ -143,9 +143,6 @@ - const char *key_id = asn1_table_vhost_key(mc, p, sc->vhost_id, idx); - EVP_PKEY *pPrivateKey = NULL; - ssl_asn1_t *asn1; -- unsigned char *ucp; -- long int length; -- BOOL bReadable; - int nPassPhrase = (*pphrases)->nelts; - int nPassPhraseRetry = 0; - apr_time_t pkey_mtime = 0; -@@ -222,16 +219,12 @@ - * is not empty. */ - ERR_clear_error(); - -- bReadable = ((pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file, -- NULL, ssl_pphrase_Handle_CB, &ppcb_arg)) != NULL ? -- TRUE : FALSE); -- -- /* -- * when the private key file now was readable, -- * it's fine and we go out of the loop -- */ -- if (bReadable) -- break; -+ pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file, -+ ssl_pphrase_Handle_CB, &ppcb_arg); -+ /* If the private key was successfully read, nothing more to -+ do here. */ -+ if (pPrivateKey != NULL) -+ break; - - /* - * when we have more remembered pass phrases -@@ -356,19 +349,12 @@ - nPassPhrase++; - } - -- /* -- * Insert private key into the global module configuration -- * (we convert it to a stand-alone DER byte sequence -- * because the SSL library uses static variables inside a -- * RSA structure which do not survive DSO reloads!) -- */ -- length = i2d_PrivateKey(pPrivateKey, NULL); -- ucp = ssl_asn1_table_set(mc->tPrivateKey, key_id, length); -- (void)i2d_PrivateKey(pPrivateKey, &ucp); /* 2nd arg increments */ -+ /* Cache the private key in the global module configuration so it -+ * can be used after subsequent reloads. */ -+ asn1 = ssl_asn1_table_set(mc->tPrivateKey, key_id, pPrivateKey); - - if (ppcb_arg.nPassPhraseDialogCur != 0) { - /* remember mtime of encrypted keys */ -- asn1 = ssl_asn1_table_get(mc->tPrivateKey, key_id); - asn1->source_mtime = pkey_mtime; - } - -@@ -619,3 +605,303 @@ - */ - return (len); - } -+ -+ -+#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) -+ -+/* OpenSSL UI implementation for passphrase entry; largely duplicated -+ * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be -+ * worth trying to shift pphrase handling over to the UI API -+ * completely. */ -+static int passphrase_ui_open(UI *ui) -+{ -+ pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui); -+ SSLSrvConfigRec *sc = mySrvConfig(ppcb->s); -+ -+ ppcb->nPassPhraseDialog++; -+ ppcb->nPassPhraseDialogCur++; -+ -+ /* -+ * Builtin or Pipe dialog -+ */ -+ if (sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN -+ || sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) { -+ if (sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) { -+ if (!readtty) { -+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, -+ APLOGNO(10143) -+ "Init: Creating pass phrase dialog pipe child " -+ "'%s'", sc->server->pphrase_dialog_path); -+ if (ssl_pipe_child_create(ppcb->p, -+ sc->server->pphrase_dialog_path) -+ != APR_SUCCESS) { -+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, ppcb->s, -+ APLOGNO(10144) -+ "Init: Failed to create pass phrase pipe '%s'", -+ sc->server->pphrase_dialog_path); -+ return 0; -+ } -+ } -+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, APLOGNO(10145) -+ "Init: Requesting pass phrase via piped dialog"); -+ } -+ else { /* sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN */ -+#ifdef WIN32 -+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, ppcb->s, APLOGNO(10146) -+ "Init: Failed to create pass phrase pipe '%s'", -+ sc->server->pphrase_dialog_path); -+ return 0; -+#else -+ /* -+ * stderr has already been redirected to the error_log. -+ * rather than attempting to temporarily rehook it to the terminal, -+ * we print the prompt to stdout before EVP_read_pw_string turns -+ * off tty echo -+ */ -+ apr_file_open_stdout(&writetty, ppcb->p); -+ -+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, APLOGNO(10147) -+ "Init: Requesting pass phrase via builtin terminal " -+ "dialog"); -+#endif -+ } -+ -+ /* -+ * The first time display a header to inform the user about what -+ * program he actually speaks to, which module is responsible for -+ * this terminal dialog and why to the hell he has to enter -+ * something... -+ */ -+ if (ppcb->nPassPhraseDialog == 1) { -+ apr_file_printf(writetty, "%s mod_ssl (Pass Phrase Dialog)\n", -+ AP_SERVER_BASEVERSION); -+ apr_file_printf(writetty, -+ "A pass phrase is required to access the private key.\n"); -+ } -+ if (ppcb->bPassPhraseDialogOnce) { -+ ppcb->bPassPhraseDialogOnce = FALSE; -+ apr_file_printf(writetty, "\n"); -+ apr_file_printf(writetty, "Private key %s (%s)\n", -+ ppcb->key_id, ppcb->pkey_file); -+ } -+ } -+ -+ return 1; -+} -+ -+static int passphrase_ui_read(UI *ui, UI_STRING *uis) -+{ -+ pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui); -+ SSLSrvConfigRec *sc = mySrvConfig(ppcb->s); -+ const char *prompt; -+ int i; -+ int bufsize; -+ int len; -+ char *buf; -+ -+ prompt = UI_get0_output_string(uis); -+ if (prompt == NULL) { -+ prompt = "Enter pass phrase:"; -+ } -+ -+ /* -+ * Get the maximum expected size and allocate the buffer -+ */ -+ bufsize = UI_get_result_maxsize(uis); -+ buf = apr_pcalloc(ppcb->p, bufsize); -+ -+ if (sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN -+ || sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) { -+ /* -+ * Get the pass phrase through a callback. -+ * Empty input is not accepted. -+ */ -+ for (;;) { -+ if (sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) { -+ i = pipe_get_passwd_cb(buf, bufsize, "", FALSE); -+ } -+ else { /* sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN */ -+ i = EVP_read_pw_string(buf, bufsize, "", FALSE); -+ } -+ if (i != 0) { -+ OPENSSL_cleanse(buf, bufsize); -+ return 0; -+ } -+ len = strlen(buf); -+ if (len < 1){ -+ apr_file_printf(writetty, "Apache:mod_ssl:Error: Pass phrase" -+ "empty (needs to be at least 1 character).\n"); -+ apr_file_puts(prompt, writetty); -+ } -+ else { -+ break; -+ } -+ } -+ } -+ /* -+ * Filter program -+ */ -+ else if (sc->server->pphrase_dialog_type == SSL_PPTYPE_FILTER) { -+ const char *cmd = sc->server->pphrase_dialog_path; -+ const char **argv = apr_palloc(ppcb->p, sizeof(char *) * 3); -+ char *result; -+ -+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, APLOGNO(10148) -+ "Init: Requesting pass phrase from dialog filter " -+ "program (%s)", cmd); -+ -+ argv[0] = cmd; -+ argv[1] = ppcb->key_id; -+ argv[2] = NULL; -+ -+ result = ssl_util_readfilter(ppcb->s, ppcb->p, cmd, argv); -+ apr_cpystrn(buf, result, bufsize); -+ len = strlen(buf); -+ } -+ -+ /* -+ * Ok, we now have the pass phrase, so give it back -+ */ -+ ppcb->cpPassPhraseCur = apr_pstrdup(ppcb->p, buf); -+ UI_set_result(ui, uis, buf); -+ -+ /* Clear sensitive data. */ -+ OPENSSL_cleanse(buf, bufsize); -+ return 1; -+} -+ -+static int passphrase_ui_write(UI *ui, UI_STRING *uis) -+{ -+ pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui); -+ SSLSrvConfigRec *sc; -+ const char *prompt; -+ -+ sc = mySrvConfig(ppcb->s); -+ -+ if (sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN -+ || sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) { -+ prompt = UI_get0_output_string(uis); -+ apr_file_puts(prompt, writetty); -+ } -+ -+ return 1; -+} -+ -+static int passphrase_ui_close(UI *ui) -+{ -+ /* -+ * Close the pipes if they were opened -+ */ -+ if (readtty) { -+ apr_file_close(readtty); -+ apr_file_close(writetty); -+ readtty = writetty = NULL; -+ } -+ return 1; -+} -+ -+static apr_status_t pp_ui_method_cleanup(void *uip) -+{ -+ UI_METHOD *uim = uip; -+ -+ UI_destroy_method(uim); -+ -+ return APR_SUCCESS; -+} -+ -+static UI_METHOD *get_passphrase_ui(apr_pool_t *p) -+{ -+ UI_METHOD *ui_method = UI_create_method("Passphrase UI"); -+ -+ UI_method_set_opener(ui_method, passphrase_ui_open); -+ UI_method_set_reader(ui_method, passphrase_ui_read); -+ UI_method_set_writer(ui_method, passphrase_ui_write); -+ UI_method_set_closer(ui_method, passphrase_ui_close); -+ -+ apr_pool_cleanup_register(p, ui_method, pp_ui_method_cleanup, -+ pp_ui_method_cleanup); -+ -+ return ui_method; -+} -+ -+ -+apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p, -+ const char *vhostid, -+ const char *certid, const char *keyid, -+ X509 **pubkey, EVP_PKEY **privkey) -+{ -+ const char *c, *scheme; -+ ENGINE *e; -+ UI_METHOD *ui_method = get_passphrase_ui(p); -+ pphrase_cb_arg_t ppcb; -+ -+ memset(&ppcb, 0, sizeof ppcb); -+ ppcb.s = s; -+ ppcb.p = p; -+ ppcb.bPassPhraseDialogOnce = TRUE; -+ ppcb.key_id = vhostid; -+ ppcb.pkey_file = keyid; -+ -+ c = ap_strchr_c(keyid, ':'); -+ if (!c || c == keyid) { -+ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10131) -+ "Init: Unrecognized private key identifier `%s'", -+ keyid); -+ return ssl_die(s); -+ } -+ -+ scheme = apr_pstrmemdup(p, keyid, c - keyid); -+ if (!(e = ENGINE_by_id(scheme))) { -+ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10132) -+ "Init: Failed to load engine for private key %s", -+ keyid); -+ ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); -+ return ssl_die(s); -+ } -+ -+ if (!ENGINE_init(e)) { -+ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10149) -+ "Init: Failed to initialize engine %s for private key %s", -+ scheme, keyid); -+ ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); -+ return ssl_die(s); -+ } -+ -+ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, -+ "Init: Initialized engine %s for private key %s", -+ scheme, keyid); -+ -+ if (APLOGdebug(s)) { -+ ENGINE_ctrl_cmd_string(e, "VERBOSE", NULL, 0); -+ } -+ -+ if (certid) { -+ struct { -+ const char *cert_id; -+ X509 *cert; -+ } params = { certid, NULL }; -+ -+ if (!ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, ¶ms, NULL, 1)) { -+ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10136) -+ "Init: Unable to get the certificate"); -+ ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); -+ return ssl_die(s); -+ } -+ -+ *pubkey = params.cert; -+ } -+ -+ *privkey = ENGINE_load_private_key(e, keyid, ui_method, &ppcb); -+ if (*privkey == NULL) { -+ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10133) -+ "Init: Unable to get the private key"); -+ ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); -+ return ssl_die(s); -+ } -+ -+ ENGINE_finish(e); -+ ENGINE_free(e); -+ -+ return APR_SUCCESS; -+} -+#endif ---- httpd-2.4.35/modules/ssl/ssl_private.h.r1830819+ -+++ httpd-2.4.35/modules/ssl/ssl_private.h -@@ -986,21 +986,28 @@ - apr_status_t ssl_load_encrypted_pkey(server_rec *, apr_pool_t *, int, - const char *, apr_array_header_t **); - -+/* Load public and/or private key from the configured ENGINE. Private -+ * key returned as *pkey. certid can be NULL, in which case *pubkey -+ * is not altered. Errors logged on failure. */ -+apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p, -+ const char *vhostid, -+ const char *certid, const char *keyid, -+ X509 **pubkey, EVP_PKEY **privkey); -+ - /** Diffie-Hellman Parameter Support */ - DH *ssl_dh_GetParamFromFile(const char *); - #ifdef HAVE_ECC - EC_GROUP *ssl_ec_GetParamFromFile(const char *); - #endif - --unsigned char *ssl_asn1_table_set(apr_hash_t *table, -- const char *key, -- long int length); -- --ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table, -- const char *key); -- --void ssl_asn1_table_unset(apr_hash_t *table, -- const char *key); -+/* Store the EVP_PKEY key (serialized into DER) in the hash table with -+ * key, returning the ssl_asn1_t structure pointer. */ -+ssl_asn1_t *ssl_asn1_table_set(apr_hash_t *table, const char *key, -+ EVP_PKEY *pkey); -+/* Retrieve the ssl_asn1_t structure with given key from the hash. */ -+ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table, const char *key); -+/* Remove and free the ssl_asn1_t structure with given key. */ -+void ssl_asn1_table_unset(apr_hash_t *table, const char *key); - - /** Mutex Support */ - int ssl_mutex_init(server_rec *, apr_pool_t *); -@@ -1088,6 +1095,10 @@ - int ssl_is_challenge(conn_rec *c, const char *servername, - X509 **pcert, EVP_PKEY **pkey); - -+/* Returns non-zero if the cert/key filename should be handled through -+ * the configured ENGINE. */ -+int modssl_is_engine_id(const char *name); -+ - #endif /* SSL_PRIVATE_H */ - /** @} */ - ---- httpd-2.4.35/modules/ssl/ssl_util.c.r1830819+ -+++ httpd-2.4.35/modules/ssl/ssl_util.c -@@ -175,45 +175,37 @@ - return TRUE; - } - --/* -- * certain key data needs to survive restarts, -- * which are stored in the user data table of s->process->pool. -- * to prevent "leaking" of this data, we use malloc/free -- * rather than apr_palloc and these wrappers to help make sure -- * we do not leak the malloc-ed data. -- */ --unsigned char *ssl_asn1_table_set(apr_hash_t *table, -- const char *key, -- long int length) -+/* Decrypted private keys are cached to survive restarts. The cached -+ * data must have lifetime of the process (hence malloc/free rather -+ * than pools), and uses raw DER since the EVP_PKEY structure -+ * internals may not survive across a module reload. */ -+ssl_asn1_t *ssl_asn1_table_set(apr_hash_t *table, const char *key, -+ EVP_PKEY *pkey) - { - apr_ssize_t klen = strlen(key); - ssl_asn1_t *asn1 = apr_hash_get(table, key, klen); -+ apr_size_t length = i2d_PrivateKey(pkey, NULL); -+ unsigned char *p; - -- /* -- * if a value for this key already exists, -- * reuse as much of the already malloc-ed data -- * as possible. -- */ -+ /* Re-use structure if cached previously. */ - if (asn1) { - if (asn1->nData != length) { -- free(asn1->cpData); /* XXX: realloc? */ -- asn1->cpData = NULL; -+ asn1->cpData = ap_realloc(asn1->cpData, length); - } - } - else { - asn1 = ap_malloc(sizeof(*asn1)); - asn1->source_mtime = 0; /* used as a note for encrypted private keys */ -- asn1->cpData = NULL; -- } -- -- asn1->nData = length; -- if (!asn1->cpData) { - asn1->cpData = ap_malloc(length); -+ -+ apr_hash_set(table, key, klen, asn1); - } - -- apr_hash_set(table, key, klen, asn1); -+ asn1->nData = length; -+ p = asn1->cpData; -+ i2d_PrivateKey(pkey, &p); /* increases p by length */ - -- return asn1->cpData; /* caller will assign a value to this */ -+ return asn1; - } - - ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table, -@@ -463,3 +455,13 @@ - } - - #endif /* #if APR_HAS_THREADS && MODSSL_USE_OPENSSL_PRE_1_1_API */ -+ -+int modssl_is_engine_id(const char *name) -+{ -+#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) -+ /* ### Can handle any other special ENGINE key names here? */ -+ return strncmp(name, "pkcs11:", 7) == 0; -+#else -+ return 0; -+#endif -+} ---- httpd-2.4.35/modules/ssl/ssl_util_ssl.c.r1830819+ -+++ httpd-2.4.35/modules/ssl/ssl_util_ssl.c -@@ -74,7 +74,7 @@ - ** _________________________________________________________________ - */ - --EVP_PKEY *modssl_read_privatekey(const char* filename, EVP_PKEY **key, pem_password_cb *cb, void *s) -+EVP_PKEY *modssl_read_privatekey(const char *filename, pem_password_cb *cb, void *s) - { - EVP_PKEY *rc; - BIO *bioS; -@@ -83,7 +83,7 @@ - /* 1. try PEM (= DER+Base64+headers) */ - if ((bioS=BIO_new_file(filename, "r")) == NULL) - return NULL; -- rc = PEM_read_bio_PrivateKey(bioS, key, cb, s); -+ rc = PEM_read_bio_PrivateKey(bioS, NULL, cb, s); - BIO_free(bioS); - - if (rc == NULL) { -@@ -107,41 +107,9 @@ - BIO_free(bioS); - } - } -- if (rc != NULL && key != NULL) { -- if (*key != NULL) -- EVP_PKEY_free(*key); -- *key = rc; -- } - return rc; - } - --typedef struct { -- const char *pass; -- int pass_len; --} pass_ctx; -- --static int provide_pass(char *buf, int size, int rwflag, void *baton) --{ -- pass_ctx *ctx = baton; -- if (ctx->pass_len > 0) { -- if (ctx->pass_len < size) { -- size = (int)ctx->pass_len; -- } -- memcpy(buf, ctx->pass, size); -- } -- return ctx->pass_len; --} -- --EVP_PKEY *modssl_read_encrypted_pkey(const char *filename, EVP_PKEY **key, -- const char *pass, apr_size_t pass_len) --{ -- pass_ctx ctx; -- -- ctx.pass = pass; -- ctx.pass_len = pass_len; -- return modssl_read_privatekey(filename, key, provide_pass, &ctx); --} -- - /* _________________________________________________________________ - ** - ** Smart shutdown ---- httpd-2.4.35/modules/ssl/ssl_util_ssl.h.r1830819+ -+++ httpd-2.4.35/modules/ssl/ssl_util_ssl.h -@@ -64,8 +64,11 @@ - void modssl_init_app_data2_idx(void); - void *modssl_get_app_data2(SSL *); - void modssl_set_app_data2(SSL *, void *); --EVP_PKEY *modssl_read_privatekey(const char *, EVP_PKEY **, pem_password_cb *, void *); --EVP_PKEY *modssl_read_encrypted_pkey(const char *, EVP_PKEY **, const char *, apr_size_t); -+ -+/* Read private key from filename in either PEM or raw base64(DER) -+ * format, using password entry callback cb and userdata. */ -+EVP_PKEY *modssl_read_privatekey(const char *filename, pem_password_cb *cb, void *ud); -+ - int modssl_smart_shutdown(SSL *ssl); - BOOL modssl_X509_getBC(X509 *, int *, int *); - char *modssl_X509_NAME_ENTRY_to_string(apr_pool_t *p, X509_NAME_ENTRY *xsne, diff --git a/SOURCES/httpd-2.4.35-r1842888.patch b/SOURCES/httpd-2.4.35-r1842888.patch deleted file mode 100644 index 02a25dc..0000000 --- a/SOURCES/httpd-2.4.35-r1842888.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff --git a/modules/filters/mod_deflate.c b/modules/filters/mod_deflate.c -index d218bab..9f86b09 100644 ---- a/modules/filters/mod_deflate.c -+++ b/modules/filters/mod_deflate.c -@@ -864,7 +864,7 @@ static apr_status_t deflate_out_filter(ap_filter_t *f, - - if (c->note_output_name) { - apr_table_setn(r->notes, c->note_output_name, -- (ctx->stream.total_in > 0) -+ (ctx->stream.total_out > 0) - ? apr_off_t_toa(r->pool, - ctx->stream.total_out) - : "-"); -@@ -1336,8 +1336,6 @@ static apr_status_t deflate_in_filter(ap_filter_t *f, - ctx->stream.next_in = (unsigned char *)data; - ctx->stream.avail_in = (int)len; - -- zRC = Z_OK; -- - if (!ctx->validation_buffer) { - while (ctx->stream.avail_in != 0) { - if (ctx->stream.avail_out == 0) { diff --git a/SOURCES/httpd-2.4.35-selinux.patch b/SOURCES/httpd-2.4.35-selinux.patch deleted file mode 100644 index 574259b..0000000 --- a/SOURCES/httpd-2.4.35-selinux.patch +++ /dev/null @@ -1,65 +0,0 @@ - -Log the SELinux context at startup. - -Upstream-Status: unlikely to be any interest in this upstream - -diff --git a/configure.in b/configure.in -index eedba50..a208b53 100644 ---- a/configure.in -+++ b/configure.in -@@ -484,6 +484,11 @@ getloadavg - dnl confirm that a void pointer is large enough to store a long integer - APACHE_CHECK_VOID_PTR_LEN - -+AC_CHECK_LIB(selinux, is_selinux_enabled, [ -+ AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported]) -+ APR_ADDTO(HTTPD_LIBS, [-lselinux]) -+]) -+ - AC_CACHE_CHECK([for gettid()], ac_cv_gettid, - [AC_TRY_RUN(#define _GNU_SOURCE - #include -diff --git a/server/core.c b/server/core.c -index ec74029..cb8e463 100644 ---- a/server/core.c -+++ b/server/core.c -@@ -59,6 +59,10 @@ - #include - #endif - -+#ifdef HAVE_SELINUX -+#include -+#endif -+ - /* LimitRequestBody handling */ - #define AP_LIMIT_REQ_BODY_UNSET ((apr_off_t) -1) - #define AP_DEFAULT_LIMIT_REQ_BODY ((apr_off_t) 0) -@@ -4971,6 +4975,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte - } - #endif - -+#ifdef HAVE_SELINUX -+ { -+ static int already_warned = 0; -+ int is_enabled = is_selinux_enabled() > 0; -+ -+ if (is_enabled && !already_warned) { -+ security_context_t con; -+ -+ if (getcon(&con) == 0) { -+ -+ ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL, -+ "SELinux policy enabled; " -+ "httpd running as context %s", con); -+ -+ already_warned = 1; -+ -+ freecon(con); -+ } -+ } -+ } -+#endif -+ - return OK; - } - diff --git a/SOURCES/httpd-2.4.35-systemd.patch b/SOURCES/httpd-2.4.35-systemd.patch deleted file mode 100644 index 7f5ee3b..0000000 --- a/SOURCES/httpd-2.4.35-systemd.patch +++ /dev/null @@ -1,245 +0,0 @@ ---- httpd-2.4.33/modules/arch/unix/config5.m4.systemd -+++ httpd-2.4.33/modules/arch/unix/config5.m4 -@@ -18,6 +18,16 @@ - fi - ]) - -+APACHE_MODULE(systemd, Systemd support, , , all, [ -+ if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then -+ AC_MSG_WARN([Your system does not support systemd.]) -+ enable_systemd="no" -+ else -+ APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS]) -+ enable_systemd="yes" -+ fi -+]) -+ - APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current]) - - APACHE_MODPATH_FINISH ---- httpd-2.4.33/modules/arch/unix/mod_systemd.c.systemd -+++ httpd-2.4.33/modules/arch/unix/mod_systemd.c -@@ -0,0 +1,223 @@ -+/* Licensed to the Apache Software Foundation (ASF) under one or more -+ * contributor license agreements. See the NOTICE file distributed with -+ * this work for additional information regarding copyright ownership. -+ * The ASF licenses this file to You under the Apache License, Version 2.0 -+ * (the "License"); you may not use this file except in compliance with -+ * the License. You may obtain a copy of the License at -+ * -+ * http://www.apache.org/licenses/LICENSE-2.0 -+ * -+ * Unless required by applicable law or agreed to in writing, software -+ * distributed under the License is distributed on an "AS IS" BASIS, -+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+ * See the License for the specific language governing permissions and -+ * limitations under the License. -+ * -+ */ -+ -+#include -+#include -+#include "ap_mpm.h" -+#include -+#include -+#include -+#include -+#include -+#include -+#include "unixd.h" -+#include "scoreboard.h" -+#include "mpm_common.h" -+ -+#include "systemd/sd-daemon.h" -+#include "systemd/sd-journal.h" -+ -+#if APR_HAVE_UNISTD_H -+#include -+#endif -+ -+static int shutdown_timer = 0; -+static int shutdown_counter = 0; -+static unsigned long bytes_served; -+static pid_t mainpid; -+static char describe_listeners[50]; -+ -+static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog, -+ apr_pool_t *ptemp) -+{ -+ sd_notify(0, -+ "RELOADING=1\n" -+ "STATUS=Reading configuration...\n"); -+ ap_extended_status = 1; -+ return OK; -+} -+ -+static char *dump_listener(ap_listen_rec *lr, apr_pool_t *p) -+{ -+ apr_sockaddr_t *sa = lr->bind_addr; -+ char addr[128]; -+ -+ if (apr_sockaddr_is_wildcard(sa)) { -+ return apr_pstrcat(p, "port ", apr_itoa(p, sa->port), NULL); -+ } -+ -+ apr_sockaddr_ip_getbuf(addr, sizeof addr, sa); -+ -+ return apr_psprintf(p, "%s port %u", addr, sa->port); -+} -+ -+static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog, -+ apr_pool_t *ptemp, server_rec *s) -+{ -+ ap_listen_rec *lr; -+ apr_size_t plen = sizeof describe_listeners; -+ char *p = describe_listeners; -+ -+ if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG) -+ return OK; -+ -+ for (lr = ap_listeners; lr; lr = lr->next) { -+ char *s = dump_listener(lr, ptemp); -+ -+ if (strlen(s) + 3 < plen) { -+ char *newp = apr_cpystrn(p, s, plen); -+ if (lr->next) -+ newp = apr_cpystrn(newp, ", ", 3); -+ plen -= newp - p; -+ p = newp; -+ } -+ else { -+ if (plen < 4) { -+ p = describe_listeners + sizeof describe_listeners - 4; -+ plen = 4; -+ } -+ apr_cpystrn(p, "...", plen); -+ break; -+ } -+ } -+ -+ sd_journal_print(LOG_INFO, "Server configured, listening on: %s", describe_listeners); -+ -+ return OK; -+} -+ -+static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type) -+{ -+ int rv; -+ -+ mainpid = getpid(); -+ -+ rv = sd_notifyf(0, "READY=1\n" -+ "STATUS=Started, listening on: %s\n" -+ "MAINPID=%" APR_PID_T_FMT, -+ describe_listeners, mainpid); -+ if (rv < 0) { -+ ap_log_perror(APLOG_MARK, APLOG_ERR, 0, p, APLOGNO(02395) -+ "sd_notifyf returned an error %d", rv); -+ } -+ -+ return OK; -+} -+ -+static int systemd_monitor(apr_pool_t *p, server_rec *s) -+{ -+ ap_sload_t sload; -+ apr_interval_time_t up_time; -+ char bps[5]; -+ int rv; -+ -+ if (!ap_extended_status) { -+ /* Nothing useful to report if ExtendedStatus disabled. */ -+ return DECLINED; -+ } -+ -+ ap_get_sload(&sload); -+ -+ if (sload.access_count == 0) { -+ rv = sd_notifyf(0, "READY=1\n" -+ "STATUS=Running, listening on: %s\n", -+ describe_listeners); -+ } -+ else { -+ /* up_time in seconds */ -+ up_time = (apr_uint32_t) apr_time_sec(apr_time_now() - -+ ap_scoreboard_image->global->restart_time); -+ -+ apr_strfsize((unsigned long)((float) (sload.bytes_served) -+ / (float) up_time), bps); -+ -+ rv = sd_notifyf(0, "READY=1\n" -+ "STATUS=Total requests: %lu; Idle/Busy workers %d/%d;" -+ "Requests/sec: %.3g; Bytes served/sec: %sB/sec\n", -+ sload.access_count, sload.idle, sload.busy, -+ ((float) sload.access_count) / (float) up_time, bps); -+ } -+ -+ if (rv < 0) { -+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02396) -+ "sd_notifyf returned an error %d", rv); -+ } -+ -+ /* Shutdown httpd when nothing is sent for shutdown_timer seconds. */ -+ if (sload.bytes_served == bytes_served) { -+ /* mpm_common.c: INTERVAL_OF_WRITABLE_PROBES is 10 */ -+ shutdown_counter += 10; -+ if (shutdown_timer > 0 && shutdown_counter >= shutdown_timer) { -+ rv = sd_notifyf(0, "READY=1\n" -+ "STATUS=Stopped as result of IdleShutdown " -+ "timeout."); -+ if (rv < 0) { -+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02804) -+ "sd_notifyf returned an error %d", rv); -+ } -+ kill(mainpid, AP_SIG_GRACEFUL); -+ } -+ } -+ else { -+ shutdown_counter = 0; -+ } -+ -+ bytes_served = sload.bytes_served; -+ -+ return DECLINED; -+} -+ -+static void systemd_register_hooks(apr_pool_t *p) -+{ -+ /* Enable ap_extended_status. */ -+ ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST); -+ /* Grab the listener config. */ -+ ap_hook_post_config(systemd_post_config, NULL, NULL, APR_HOOK_LAST); -+ /* We know the PID in this hook ... */ -+ ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST); -+ /* Used to update httpd's status line using sd_notifyf */ -+ ap_hook_monitor(systemd_monitor, NULL, NULL, APR_HOOK_MIDDLE); -+} -+ -+static const char *set_shutdown_timer(cmd_parms *cmd, void *dummy, -+ const char *arg) -+{ -+ const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY); -+ if (err != NULL) { -+ return err; -+ } -+ -+ shutdown_timer = atoi(arg); -+ return NULL; -+} -+ -+static const command_rec systemd_cmds[] = -+{ -+AP_INIT_TAKE1("IdleShutdown", set_shutdown_timer, NULL, RSRC_CONF, -+ "Number of seconds in idle-state after which httpd is shutdown"), -+ {NULL} -+}; -+ -+AP_DECLARE_MODULE(systemd) = { -+ STANDARD20_MODULE_STUFF, -+ NULL, -+ NULL, -+ NULL, -+ NULL, -+ systemd_cmds, -+ systemd_register_hooks, -+}; diff --git a/SOURCES/httpd-2.4.37-CVE-2006-20001.patch b/SOURCES/httpd-2.4.37-CVE-2006-20001.patch deleted file mode 100644 index 26c9363..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2006-20001.patch +++ /dev/null @@ -1,20 +0,0 @@ -diff --git a/modules/dav/main/util.c b/modules/dav/main/util.c -index 1ae5914027c..3f7822fc931 100644 ---- a/modules/dav/main/util.c -+++ b/modules/dav/main/util.c -@@ -801,8 +801,14 @@ static dav_error * dav_process_if_header(request_rec *r, dav_if_header **p_ih) - "for the same state."); - } - condition = DAV_IF_COND_NOT; -+ list += 2; -+ } -+ else { -+ return dav_new_error(r->pool, HTTP_BAD_REQUEST, -+ DAV_ERR_IF_UNK_CHAR, 0, -+ "Invalid \"If:\" header: " -+ "Unexpected character in List"); - } -- list += 2; - break; - - case ' ': diff --git a/SOURCES/httpd-2.4.37-CVE-2018-17199.patch b/SOURCES/httpd-2.4.37-CVE-2018-17199.patch deleted file mode 100644 index e98a26e..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2018-17199.patch +++ /dev/null @@ -1,39 +0,0 @@ -diff --git a/modules/session/mod_session.c b/modules/session/mod_session.c -index 10e6396..7ee477c 100644 ---- a/modules/session/mod_session.c -+++ b/modules/session/mod_session.c -@@ -126,20 +126,23 @@ static apr_status_t ap_session_load(request_rec * r, session_rec ** z) - - /* found a session that hasn't expired? */ - now = apr_time_now(); -+ - if (zz) { -- if (zz->expiry && zz->expiry < now) { -+ /* load the session attibutes */ -+ rv = ap_run_session_decode(r, zz); -+ -+ /* having a session we cannot decode is just as good as having -+ none at all */ -+ if (OK != rv) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01817) -+ "error while decoding the session, " -+ "session not loaded: %s", r->uri); - zz = NULL; - } -- else { -- /* having a session we cannot decode is just as good as having -- none at all */ -- rv = ap_run_session_decode(r, zz); -- if (OK != rv) { -- ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01817) -- "error while decoding the session, " -- "session not loaded: %s", r->uri); -- zz = NULL; -- } -+ -+ /* invalidate session if session is expired */ -+ if (zz && zz->expiry && zz->expiry < now) { -+ zz = NULL; - } - } - diff --git a/SOURCES/httpd-2.4.37-CVE-2019-0211.patch b/SOURCES/httpd-2.4.37-CVE-2019-0211.patch deleted file mode 100644 index 043476a..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2019-0211.patch +++ /dev/null @@ -1,207 +0,0 @@ -diff --git a/include/scoreboard.h b/include/scoreboard.h -index 9376da2..92d198d 100644 ---- a/include/scoreboard.h -+++ b/include/scoreboard.h -@@ -148,7 +148,9 @@ struct process_score { - apr_uint32_t lingering_close; /* async connections in lingering close */ - apr_uint32_t keep_alive; /* async connections in keep alive */ - apr_uint32_t suspended; /* connections suspended by some module */ -- int bucket; /* Listener bucket used by this child */ -+ int bucket; /* Listener bucket used by this child; this field is DEPRECATED -+ * and no longer updated by the MPMs (i.e. always zero). -+ */ - }; - - /* Scoreboard is now in 'local' memory, since it isn't updated once created, -diff --git a/server/mpm/event/event.c b/server/mpm/event/event.c -index ffe8a23..048ae61 100644 ---- a/server/mpm/event/event.c -+++ b/server/mpm/event/event.c -@@ -2695,7 +2695,6 @@ static int make_child(server_rec * s, int slot, int bucket) - - ap_scoreboard_image->parent[slot].quiescing = 0; - ap_scoreboard_image->parent[slot].not_accepting = 0; -- ap_scoreboard_image->parent[slot].bucket = bucket; - event_note_child_started(slot, pid); - active_daemons++; - retained->total_daemons++; -@@ -2734,6 +2733,7 @@ static void perform_idle_server_maintenance(int child_bucket, int num_buckets) - * that threads_per_child is always > 0 */ - int status = SERVER_DEAD; - int child_threads_active = 0; -+ int bucket = i % num_buckets; - - if (i >= retained->max_daemons_limit && - free_length == retained->idle_spawn_rate[child_bucket]) { -@@ -2757,7 +2757,7 @@ static void perform_idle_server_maintenance(int child_bucket, int num_buckets) - */ - if (status <= SERVER_READY && !ps->quiescing && !ps->not_accepting - && ps->generation == retained->mpm->my_generation -- && ps->bucket == child_bucket) -+ && bucket == child_bucket) - { - ++idle_thread_count; - } -@@ -2768,7 +2768,9 @@ static void perform_idle_server_maintenance(int child_bucket, int num_buckets) - last_non_dead = i; - } - active_thread_count += child_threads_active; -- if (!ps->pid && free_length < retained->idle_spawn_rate[child_bucket]) -+ if (!ps->pid -+ && bucket == child_bucket -+ && free_length < retained->idle_spawn_rate[child_bucket]) - free_slots[free_length++] = i; - else if (child_threads_active == threads_per_child) - had_healthy_child = 1; -@@ -2951,13 +2953,14 @@ static void server_main_loop(int remaining_children_to_start, int num_buckets) - retained->total_daemons--; - if (processed_status == APEXIT_CHILDSICK) { - /* resource shortage, minimize the fork rate */ -- retained->idle_spawn_rate[ps->bucket] = 1; -+ retained->idle_spawn_rate[child_slot % num_buckets] = 1; - } - else if (remaining_children_to_start) { - /* we're still doing a 1-for-1 replacement of dead - * children with new children - */ -- make_child(ap_server_conf, child_slot, ps->bucket); -+ make_child(ap_server_conf, child_slot, -+ child_slot % num_buckets); - --remaining_children_to_start; - } - } -diff --git a/server/mpm/prefork/prefork.c b/server/mpm/prefork/prefork.c -index 8efda72..7c00625 100644 ---- a/server/mpm/prefork/prefork.c -+++ b/server/mpm/prefork/prefork.c -@@ -637,8 +637,9 @@ static void child_main(int child_num_arg, int child_bucket) - } - - --static int make_child(server_rec *s, int slot, int bucket) -+static int make_child(server_rec *s, int slot) - { -+ int bucket = slot % retained->mpm->num_buckets; - int pid; - - if (slot + 1 > retained->max_daemons_limit) { -@@ -716,7 +717,6 @@ static int make_child(server_rec *s, int slot, int bucket) - child_main(slot, bucket); - } - -- ap_scoreboard_image->parent[slot].bucket = bucket; - prefork_note_child_started(slot, pid); - - return 0; -@@ -732,7 +732,7 @@ static void startup_children(int number_to_start) - if (ap_scoreboard_image->servers[i][0].status != SERVER_DEAD) { - continue; - } -- if (make_child(ap_server_conf, i, i % retained->mpm->num_buckets) < 0) { -+ if (make_child(ap_server_conf, i) < 0) { - break; - } - --number_to_start; -@@ -741,8 +741,6 @@ static void startup_children(int number_to_start) - - static void perform_idle_server_maintenance(apr_pool_t *p) - { -- static int bucket_make_child_record = -1; -- static int bucket_kill_child_record = -1; - int i; - int idle_count; - worker_score *ws; -@@ -789,6 +787,7 @@ static void perform_idle_server_maintenance(apr_pool_t *p) - } - retained->max_daemons_limit = last_non_dead + 1; - if (idle_count > ap_daemons_max_free) { -+ static int bucket_kill_child_record = -1; - /* kill off one child... we use the pod because that'll cause it to - * shut down gracefully, in case it happened to pick up a request - * while we were counting -@@ -819,10 +818,7 @@ static void perform_idle_server_maintenance(apr_pool_t *p) - idle_count, total_non_dead); - } - for (i = 0; i < free_length; ++i) { -- bucket_make_child_record++; -- bucket_make_child_record %= retained->mpm->num_buckets; -- make_child(ap_server_conf, free_slots[i], -- bucket_make_child_record); -+ make_child(ap_server_conf, free_slots[i]); - } - /* the next time around we want to spawn twice as many if this - * wasn't good enough, but not if we've just done a graceful -@@ -867,7 +863,7 @@ static int prefork_run(apr_pool_t *_pconf, apr_pool_t *plog, server_rec *s) - - if (one_process) { - AP_MONCONTROL(1); -- make_child(ap_server_conf, 0, 0); -+ make_child(ap_server_conf, 0); - /* NOTREACHED */ - ap_assert(0); - return !OK; -@@ -976,8 +972,7 @@ static int prefork_run(apr_pool_t *_pconf, apr_pool_t *plog, server_rec *s) - /* we're still doing a 1-for-1 replacement of dead - * children with new children - */ -- make_child(ap_server_conf, child_slot, -- ap_get_scoreboard_process(child_slot)->bucket); -+ make_child(ap_server_conf, child_slot); - --remaining_children_to_start; - } - #if APR_HAS_OTHER_CHILD -diff --git a/server/mpm/worker/worker.c b/server/mpm/worker/worker.c -index 8012fe2..a927942 100644 ---- a/server/mpm/worker/worker.c -+++ b/server/mpm/worker/worker.c -@@ -1339,7 +1339,6 @@ static int make_child(server_rec *s, int slot, int bucket) - worker_note_child_lost_slot(slot, pid); - } - ap_scoreboard_image->parent[slot].quiescing = 0; -- ap_scoreboard_image->parent[slot].bucket = bucket; - worker_note_child_started(slot, pid); - return 0; - } -@@ -1388,6 +1387,7 @@ static void perform_idle_server_maintenance(int child_bucket, int num_buckets) - int any_dead_threads = 0; - int all_dead_threads = 1; - int child_threads_active = 0; -+ int bucket = i % num_buckets; - - if (i >= retained->max_daemons_limit && - totally_free_length == retained->idle_spawn_rate[child_bucket]) { -@@ -1420,7 +1420,7 @@ static void perform_idle_server_maintenance(int child_bucket, int num_buckets) - if (status <= SERVER_READY && - !ps->quiescing && - ps->generation == retained->mpm->my_generation && -- ps->bucket == child_bucket) { -+ bucket == child_bucket) { - ++idle_thread_count; - } - if (status >= SERVER_READY && status < SERVER_GRACEFUL) { -@@ -1430,6 +1430,7 @@ static void perform_idle_server_maintenance(int child_bucket, int num_buckets) - } - active_thread_count += child_threads_active; - if (any_dead_threads -+ && bucket == child_bucket - && totally_free_length < retained->idle_spawn_rate[child_bucket] - && free_length < MAX_SPAWN_RATE / num_buckets - && (!ps->pid /* no process in the slot */ -@@ -1615,14 +1616,15 @@ static void server_main_loop(int remaining_children_to_start, int num_buckets) - ps->quiescing = 0; - if (processed_status == APEXIT_CHILDSICK) { - /* resource shortage, minimize the fork rate */ -- retained->idle_spawn_rate[ps->bucket] = 1; -+ retained->idle_spawn_rate[child_slot % num_buckets] = 1; - } - else if (remaining_children_to_start - && child_slot < ap_daemons_limit) { - /* we're still doing a 1-for-1 replacement of dead - * children with new children - */ -- make_child(ap_server_conf, child_slot, ps->bucket); -+ make_child(ap_server_conf, child_slot, -+ child_slot % num_buckets); - --remaining_children_to_start; - } - } diff --git a/SOURCES/httpd-2.4.37-CVE-2019-0215.patch b/SOURCES/httpd-2.4.37-CVE-2019-0215.patch deleted file mode 100644 index 2967584..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2019-0215.patch +++ /dev/null @@ -1,20 +0,0 @@ -diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c -index de0ffb0..e6a9f67 100644 ---- a/modules/ssl/ssl_engine_kernel.c -+++ b/modules/ssl/ssl_engine_kernel.c -@@ -1154,6 +1154,7 @@ static int ssl_hook_Access_modern(request_rec *r, SSLSrvConfigRec *sc, SSLDirCon - ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server); - apr_table_setn(r->notes, "error-notes", - "Reason: Cannot perform Post-Handshake Authentication.
"); -+ SSL_set_verify(ssl, vmode_inplace, NULL); - return HTTP_FORBIDDEN; - } - -@@ -1175,6 +1176,7 @@ static int ssl_hook_Access_modern(request_rec *r, SSLSrvConfigRec *sc, SSLDirCon - * Finally check for acceptable renegotiation results - */ - if (OK != (rc = ssl_check_post_client_verify(r, sc, dc, sslconn, ssl))) { -+ SSL_set_verify(ssl, vmode_inplace, NULL); - return rc; - } - } diff --git a/SOURCES/httpd-2.4.37-CVE-2019-0217.patch b/SOURCES/httpd-2.4.37-CVE-2019-0217.patch deleted file mode 100644 index 1614e72..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2019-0217.patch +++ /dev/null @@ -1,111 +0,0 @@ ---- a/modules/aaa/mod_auth_digest.c 2019/03/12 09:24:19 1855297 -+++ b/modules/aaa/mod_auth_digest.c 2019/03/12 09:24:26 1855298 -@@ -92,7 +92,6 @@ - int check_nc; - const char *algorithm; - char *uri_list; -- const char *ha1; - } digest_config_rec; - - -@@ -153,6 +152,7 @@ - apr_time_t nonce_time; - enum hdr_sts auth_hdr_sts; - int needed_auth; -+ const char *ha1; - client_entry *client; - } digest_header_rec; - -@@ -1304,7 +1304,7 @@ - */ - - static authn_status get_hash(request_rec *r, const char *user, -- digest_config_rec *conf) -+ digest_config_rec *conf, const char **rethash) - { - authn_status auth_result; - char *password; -@@ -1356,7 +1356,7 @@ - } while (current_provider); - - if (auth_result == AUTH_USER_FOUND) { -- conf->ha1 = password; -+ *rethash = password; - } - - return auth_result; -@@ -1483,25 +1483,24 @@ - - /* RFC-2069 */ - static const char *old_digest(const request_rec *r, -- const digest_header_rec *resp, const char *ha1) -+ const digest_header_rec *resp) - { - const char *ha2; - - ha2 = ap_md5(r->pool, (unsigned char *)apr_pstrcat(r->pool, resp->method, ":", - resp->uri, NULL)); - return ap_md5(r->pool, -- (unsigned char *)apr_pstrcat(r->pool, ha1, ":", resp->nonce, -- ":", ha2, NULL)); -+ (unsigned char *)apr_pstrcat(r->pool, resp->ha1, ":", -+ resp->nonce, ":", ha2, NULL)); - } - - /* RFC-2617 */ - static const char *new_digest(const request_rec *r, -- digest_header_rec *resp, -- const digest_config_rec *conf) -+ digest_header_rec *resp) - { - const char *ha1, *ha2, *a2; - -- ha1 = conf->ha1; -+ ha1 = resp->ha1; - - a2 = apr_pstrcat(r->pool, resp->method, ":", resp->uri, NULL); - ha2 = ap_md5(r->pool, (const unsigned char *)a2); -@@ -1514,7 +1513,6 @@ - NULL)); - } - -- - static void copy_uri_components(apr_uri_t *dst, - apr_uri_t *src, request_rec *r) { - if (src->scheme && src->scheme[0] != '\0') { -@@ -1759,7 +1757,7 @@ - return HTTP_UNAUTHORIZED; - } - -- return_code = get_hash(r, r->user, conf); -+ return_code = get_hash(r, r->user, conf, &resp->ha1); - - if (return_code == AUTH_USER_NOT_FOUND) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01790) -@@ -1789,7 +1787,7 @@ - - if (resp->message_qop == NULL) { - /* old (rfc-2069) style digest */ -- if (strcmp(resp->digest, old_digest(r, resp, conf->ha1))) { -+ if (strcmp(resp->digest, old_digest(r, resp))) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01792) - "user %s: password mismatch: %s", r->user, - r->uri); -@@ -1819,7 +1817,7 @@ - return HTTP_UNAUTHORIZED; - } - -- exp_digest = new_digest(r, resp, conf); -+ exp_digest = new_digest(r, resp); - if (!exp_digest) { - /* we failed to allocate a client struct */ - return HTTP_INTERNAL_SERVER_ERROR; -@@ -1903,7 +1901,7 @@ - - /* calculate rspauth attribute - */ -- ha1 = conf->ha1; -+ ha1 = resp->ha1; - - a2 = apr_pstrcat(r->pool, ":", resp->uri, NULL); - ha2 = ap_md5(r->pool, (const unsigned char *)a2); diff --git a/SOURCES/httpd-2.4.37-CVE-2019-0220.patch b/SOURCES/httpd-2.4.37-CVE-2019-0220.patch deleted file mode 100644 index 1fcb68e..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2019-0220.patch +++ /dev/null @@ -1,235 +0,0 @@ -diff --git a/docs/manual/mod/core.html.en b/docs/manual/mod/core.html.en -index 0a24bc8..20d1e5a 100644 ---- a/docs/manual/mod/core.html.en -+++ b/docs/manual/mod/core.html.en -@@ -97,6 +97,7 @@ available -
  • MaxRangeOverlaps
  • -
  • MaxRangeReversals
  • -
  • MaxRanges
  • -+
  • MergeSlashes
  • -
  • MergeTrailers
  • -
  • Mutex
  • -
  • NameVirtualHost
  • -@@ -3465,6 +3466,30 @@ resource - - -
    top
    -+

    MergeSlashes Directive

    -+ -+ -+ -+ -+ -+ -+ -+ -+
    Description:Controls whether the server merges consecutive slashes in URLs.
    Syntax:MergeSlashes ON | OFF
    Default:MergeSlashes ON
    Context:server config, virtual host
    Status:Core
    Module:core
    Compatibility:Available in Apache HTTP Server 2.4.6 in Red Hat Enterprise Linux 7
    -+

    By default, the server merges (or collapses) multiple consecutive slash -+ ('/') characters in the path component of the request URL.

    -+ -+

    When mapping URL's to the filesystem, these multiple slashes are not -+ significant. However, URL's handled other ways, such as by CGI or proxy, -+ might prefer to retain the significance of multiple consecutive slashes. -+ In these cases MergeSlashes can be set to -+ OFF to retain the multiple consecutive slashes. In these -+ configurations, regular expressions used in the configuration file that match -+ the path component of the URL (LocationMatch, -+ RewriteRule, ...) need to take into account multiple -+ consecutive slashes.

    -+
    -+
    top
    -

    MergeTrailers Directive

    - - ---- a/include/http_core.h 2019/03/18 08:49:19 1855736 -+++ b/include/http_core.h 2019/03/18 08:49:59 1855737 -@@ -740,7 +740,7 @@ - #define AP_HTTP_METHODS_LENIENT 1 - #define AP_HTTP_METHODS_REGISTERED 2 - char http_methods; -- -+ unsigned int merge_slashes; - } core_server_config; - - /* for AddOutputFiltersByType in core.c */ -diff --git a/include/httpd.h b/include/httpd.h -index 65392f8..99f7f04 100644 ---- a/include/httpd.h -+++ b/include/httpd.h -@@ -1697,11 +1697,21 @@ AP_DECLARE(int) ap_unescape_url_keep2f(char *url, int decode_slashes); - AP_DECLARE(int) ap_unescape_urlencoded(char *query); - - /** -- * Convert all double slashes to single slashes -- * @param name The string to convert -+ * Convert all double slashes to single slashes, except where significant -+ * to the filesystem on the current platform. -+ * @param name The string to convert, assumed to be a filesystem path - */ - AP_DECLARE(void) ap_no2slash(char *name); - -+/** -+ * Convert all double slashes to single slashes, except where significant -+ * to the filesystem on the current platform. -+ * @param name The string to convert -+ * @param is_fs_path if set to 0, the significance of any double-slashes is -+ * ignored. -+ */ -+AP_DECLARE(void) ap_no2slash_ex(char *name, int is_fs_path); -+ - /** - * Remove all ./ and xx/../ substrings from a file name. Also remove - * any leading ../ or /../ substrings. -diff --git a/server/request.c b/server/request.c -index dbe3e07..d5c558a 100644 ---- a/server/request.c -+++ b/server/request.c -@@ -167,6 +167,8 @@ AP_DECLARE(int) ap_process_request_internal(request_rec *r) - int file_req = (r->main && r->filename); - int access_status; - core_dir_config *d; -+ core_server_config *sconf = -+ ap_get_core_module_config(r->server->module_config); - - /* Ignore embedded %2F's in path for proxy requests */ - if (!r->proxyreq && r->parsed_uri.path) { -@@ -191,6 +193,12 @@ AP_DECLARE(int) ap_process_request_internal(request_rec *r) - } - - ap_getparents(r->uri); /* OK --- shrinking transformations... */ -+ if (sconf->merge_slashes != AP_CORE_CONFIG_OFF) { -+ ap_no2slash(r->uri); -+ if (r->parsed_uri.path) { -+ ap_no2slash(r->parsed_uri.path); -+ } -+ } - - /* All file subrequests are a huge pain... they cannot bubble through the - * next several steps. Only file subrequests are allowed an empty uri, -@@ -1411,20 +1419,7 @@ AP_DECLARE(int) ap_location_walk(request_rec *r) - - cache = prep_walk_cache(AP_NOTE_LOCATION_WALK, r); - cached = (cache->cached != NULL); -- -- /* Location and LocationMatch differ on their behaviour w.r.t. multiple -- * slashes. Location matches multiple slashes with a single slash, -- * LocationMatch doesn't. An exception, for backwards brokenness is -- * absoluteURIs... in which case neither match multiple slashes. -- */ -- if (r->uri[0] != '/') { -- entry_uri = r->uri; -- } -- else { -- char *uri = apr_pstrdup(r->pool, r->uri); -- ap_no2slash(uri); -- entry_uri = uri; -- } -+ entry_uri = r->uri; - - /* If we have an cache->cached location that matches r->uri, - * and the vhost's list of locations hasn't changed, we can skip -@@ -1491,7 +1486,7 @@ AP_DECLARE(int) ap_location_walk(request_rec *r) - pmatch = apr_palloc(rxpool, nmatch*sizeof(ap_regmatch_t)); - } - -- if (ap_regexec(entry_core->r, r->uri, nmatch, pmatch, 0)) { -+ if (ap_regexec(entry_core->r, entry_uri, nmatch, pmatch, 0)) { - continue; - } - -@@ -1501,7 +1496,7 @@ AP_DECLARE(int) ap_location_walk(request_rec *r) - apr_table_setn(r->subprocess_env, - ((const char **)entry_core->refs->elts)[i], - apr_pstrndup(r->pool, -- r->uri + pmatch[i].rm_so, -+ entry_uri + pmatch[i].rm_so, - pmatch[i].rm_eo - pmatch[i].rm_so)); - } - } -diff --git a/server/util.c b/server/util.c -index fd7a0a1..e0c558c 100644 ---- a/server/util.c -+++ b/server/util.c -@@ -561,16 +561,20 @@ AP_DECLARE(void) ap_getparents(char *name) - name[l] = '\0'; - } - } -- --AP_DECLARE(void) ap_no2slash(char *name) -+AP_DECLARE(void) ap_no2slash_ex(char *name, int is_fs_path) - { -+ - char *d, *s; - -+ if (!*name) { -+ return; -+ } -+ - s = d = name; - - #ifdef HAVE_UNC_PATHS - /* Check for UNC names. Leave leading two slashes. */ -- if (s[0] == '/' && s[1] == '/') -+ if (is_fs_path && s[0] == '/' && s[1] == '/') - *d++ = *s++; - #endif - -@@ -587,6 +591,10 @@ AP_DECLARE(void) ap_no2slash(char *name) - *d = '\0'; - } - -+AP_DECLARE(void) ap_no2slash(char *name) -+{ -+ ap_no2slash_ex(name, 1); -+} - - /* - * copy at most n leading directories of s into d -diff --git a/server/core.c b/server/core.c -index b5ab429..a31f1e4 100644 ---- a/server/core.c -+++ b/server/core.c -@@ -493,6 +493,7 @@ static void *create_core_server_config(apr_pool_t *a, server_rec *s) - */ - - conf->trace_enable = AP_TRACE_UNSET; -+ conf->merge_slashes = AP_CORE_CONFIG_UNSET; - - conf->protocols = apr_array_make(a, 5, sizeof(const char *)); - conf->protocols_honor_order = -1; -@@ -561,7 +562,9 @@ static void *merge_core_server_configs(apr_pool_t *p, void *basev, void *virtv) - conf->protocols_honor_order = ((virt->protocols_honor_order < 0)? - base->protocols_honor_order : - virt->protocols_honor_order); -- -+ -+ AP_CORE_MERGE_FLAG(merge_slashes, conf, base, virt); -+ - return conf; - } - -@@ -1872,6 +1875,13 @@ static const char *set_qualify_redirect_url(cmd_parms *cmd, void *d_, int flag) - return NULL; - } - -+static const char *set_core_server_flag(cmd_parms *cmd, void *s_, int flag) -+{ -+ core_server_config *conf = -+ ap_get_core_module_config(cmd->server->module_config); -+ return ap_set_flag_slot(cmd, conf, flag); -+} -+ - static const char *set_override_list(cmd_parms *cmd, void *d_, int argc, char *const argv[]) - { - core_dir_config *d = d_; -@@ -4598,6 +4608,10 @@ AP_INIT_ITERATE("HttpProtocolOptions", set_http_protocol_options, NULL, RSRC_CON - "'Unsafe' or 'Strict' (default). Sets HTTP acceptance rules"), - AP_INIT_ITERATE("RegisterHttpMethod", set_http_method, NULL, RSRC_CONF, - "Registers non-standard HTTP methods"), -+AP_INIT_FLAG("MergeSlashes", set_core_server_flag, -+ (void *)APR_OFFSETOF(core_server_config, merge_slashes), -+ RSRC_CONF, -+ "Controls whether consecutive slashes in the URI path are merged"), - { NULL } - }; - diff --git a/SOURCES/httpd-2.4.37-CVE-2019-10092.patch b/SOURCES/httpd-2.4.37-CVE-2019-10092.patch deleted file mode 100644 index a06d9c2..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2019-10092.patch +++ /dev/null @@ -1,192 +0,0 @@ -diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c -index e419eb6..dcafa9c 100644 ---- a/modules/http/http_protocol.c -+++ b/modules/http/http_protocol.c -@@ -1132,13 +1132,10 @@ static const char *get_canned_error_string(int status, - "\">here.

    \n", - NULL)); - case HTTP_USE_PROXY: -- return(apr_pstrcat(p, -- "

    This resource is only accessible " -- "through the proxy\n", -- ap_escape_html(r->pool, location), -- "
    \nYou will need to configure " -- "your client to use that proxy.

    \n", -- NULL)); -+ return("

    This resource is only accessible " -+ "through the proxy\n" -+ "
    \nYou will need to configure " -+ "your client to use that proxy.

    \n"); - case HTTP_PROXY_AUTHENTICATION_REQUIRED: - case HTTP_UNAUTHORIZED: - return("

    This server could not verify that you\n" -@@ -1154,34 +1151,20 @@ static const char *get_canned_error_string(int status, - "error-notes", - "

    \n")); - case HTTP_FORBIDDEN: -- s1 = apr_pstrcat(p, -- "

    You don't have permission to access ", -- ap_escape_html(r->pool, r->uri), -- "\non this server.
    \n", -- NULL); -- return(add_optional_notes(r, s1, "error-notes", "

    \n")); -+ return(add_optional_notes(r, "

    You don't have permission to access this resource.", "error-notes", "

    \n")); - case HTTP_NOT_FOUND: -- return(apr_pstrcat(p, -- "

    The requested URL ", -- ap_escape_html(r->pool, r->uri), -- " was not found on this server.

    \n", -- NULL)); -+ return("

    The requested URL was not found on this server.

    \n"); - case HTTP_METHOD_NOT_ALLOWED: - return(apr_pstrcat(p, - "

    The requested method ", - ap_escape_html(r->pool, r->method), -- " is not allowed for the URL ", -- ap_escape_html(r->pool, r->uri), -- ".

    \n", -+ " is not allowed for this URL.

    \n", - NULL)); - case HTTP_NOT_ACCEPTABLE: -- s1 = apr_pstrcat(p, -- "

    An appropriate representation of the " -- "requested resource ", -- ap_escape_html(r->pool, r->uri), -- " could not be found on this server.

    \n", -- NULL); -- return(add_optional_notes(r, s1, "variant-list", "")); -+ return(add_optional_notes(r, -+ "

    An appropriate representation of the requested resource " -+ "could not be found on this server.

    \n", -+ "variant-list", "")); - case HTTP_MULTIPLE_CHOICES: - return(add_optional_notes(r, "", "variant-list", "")); - case HTTP_LENGTH_REQUIRED: -@@ -1192,18 +1175,13 @@ static const char *get_canned_error_string(int status, - NULL); - return(add_optional_notes(r, s1, "error-notes", "

    \n")); - case HTTP_PRECONDITION_FAILED: -- return(apr_pstrcat(p, -- "

    The precondition on the request " -- "for the URL ", -- ap_escape_html(r->pool, r->uri), -- " evaluated to false.

    \n", -- NULL)); -+ return("

    The precondition on the request " -+ "for this URL evaluated to false.

    \n"); - case HTTP_NOT_IMPLEMENTED: - s1 = apr_pstrcat(p, - "

    ", -- ap_escape_html(r->pool, r->method), " to ", -- ap_escape_html(r->pool, r->uri), -- " not supported.
    \n", -+ ap_escape_html(r->pool, r->method), " ", -+ " not supported for current URL.
    \n", - NULL); - return(add_optional_notes(r, s1, "error-notes", "

    \n")); - case HTTP_BAD_GATEWAY: -@@ -1211,29 +1189,19 @@ static const char *get_canned_error_string(int status, - "response from an upstream server.
    " CRLF; - return(add_optional_notes(r, s1, "error-notes", "

    \n")); - case HTTP_VARIANT_ALSO_VARIES: -- return(apr_pstrcat(p, -- "

    A variant for the requested " -- "resource\n

    \n",
    --                           ap_escape_html(r->pool, r->uri),
    --                           "\n
    \nis itself a negotiable resource. " -- "This indicates a configuration error.

    \n", -- NULL)); -+ return("

    A variant for the requested " -+ "resource\n

    \n"
    -+               "\n
    \nis itself a negotiable resource. " -+ "This indicates a configuration error.

    \n"); - case HTTP_REQUEST_TIME_OUT: - return("

    Server timeout waiting for the HTTP request from the client.

    \n"); - case HTTP_GONE: -- return(apr_pstrcat(p, -- "

    The requested resource
    ", -- ap_escape_html(r->pool, r->uri), -- "
    \nis no longer available on this server " -- "and there is no forwarding address.\n" -- "Please remove all references to this " -- "resource.

    \n", -- NULL)); -+ return("

    The requested resource is no longer available on this server" -+ " and there is no forwarding address.\n" -+ "Please remove all references to this resource.

    \n"); - case HTTP_REQUEST_ENTITY_TOO_LARGE: - return(apr_pstrcat(p, -- "The requested resource
    ", -- ap_escape_html(r->pool, r->uri), "
    \n", -- "does not allow request data with ", -+ "The requested resource does not allow request data with ", - ap_escape_html(r->pool, r->method), - " requests, or the amount of data provided in\n" - "the request exceeds the capacity limit.\n", -@@ -1317,11 +1285,9 @@ static const char *get_canned_error_string(int status, - "the Server Name Indication (SNI) in use for this\n" - "connection.

    \n"); - case HTTP_UNAVAILABLE_FOR_LEGAL_REASONS: -- s1 = apr_pstrcat(p, -- "

    Access to ", ap_escape_html(r->pool, r->uri), -- "\nhas been denied for legal reasons.
    \n", -- NULL); -- return(add_optional_notes(r, s1, "error-notes", "

    \n")); -+ return(add_optional_notes(r, -+ "

    Access to this URL has been denied for legal reasons.
    \n", -+ "error-notes", "

    \n")); - default: /* HTTP_INTERNAL_SERVER_ERROR */ - /* - * This comparison to expose error-notes could be modified to -diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c -index 800ede1..de48735 100644 ---- a/modules/proxy/mod_proxy.c -+++ b/modules/proxy/mod_proxy.c -@@ -1055,9 +1055,10 @@ static int proxy_handler(request_rec *r) - char *end; - maxfwd = apr_strtoi64(str, &end, 10); - if (maxfwd < 0 || maxfwd == APR_INT64_MAX || *end) { -- return ap_proxyerror(r, HTTP_BAD_REQUEST, -- apr_psprintf(r->pool, -- "Max-Forwards value '%s' could not be parsed", str)); -+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO() -+ "Max-Forwards value '%s' could not be parsed", str); -+ return ap_proxyerror(r, HTTP_BAD_REQUEST, -+ "Max-Forwards request header could not be parsed"); - } - else if (maxfwd == 0) { - switch (r->method_number) { -diff --git a/modules/proxy/mod_proxy_ftp.c b/modules/proxy/mod_proxy_ftp.c -index 4a10987..8f6f853 100644 ---- a/modules/proxy/mod_proxy_ftp.c -+++ b/modules/proxy/mod_proxy_ftp.c -@@ -1024,8 +1024,9 @@ static int proxy_ftp_handler(request_rec *r, proxy_worker *worker, - /* We break the URL into host, port, path-search */ - if (r->parsed_uri.hostname == NULL) { - if (APR_SUCCESS != apr_uri_parse(p, url, &uri)) { -- return ap_proxyerror(r, HTTP_BAD_REQUEST, -- apr_psprintf(p, "URI cannot be parsed: %s", url)); -+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO() -+ "URI cannot be parsed: %s", url); -+ return ap_proxyerror(r, HTTP_BAD_REQUEST, "URI cannot be parsed"); - } - connectname = uri.hostname; - connectport = uri.port; -diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c -index 6501c68..0bbfa59 100644 ---- a/modules/proxy/proxy_util.c -+++ b/modules/proxy/proxy_util.c -@@ -368,12 +368,9 @@ PROXY_DECLARE(char *) - - PROXY_DECLARE(int) ap_proxyerror(request_rec *r, int statuscode, const char *message) - { -- const char *uri = ap_escape_html(r->pool, r->uri); - apr_table_setn(r->notes, "error-notes", - apr_pstrcat(r->pool, -- "The proxy server could not handle the request ", ap_escape_html(r->pool, r->method), " ", uri, -- ".

    \n" -+ "The proxy server could not handle the request

    " - "Reason: ", ap_escape_html(r->pool, message), - "

    ", - NULL)); diff --git a/SOURCES/httpd-2.4.37-CVE-2019-10097.patch b/SOURCES/httpd-2.4.37-CVE-2019-10097.patch deleted file mode 100644 index b0132a9..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2019-10097.patch +++ /dev/null @@ -1,66 +0,0 @@ -diff --git a/modules/metadata/mod_remoteip.c b/modules/metadata/mod_remoteip.c -index 4572ce1..a0cbc0f 100644 ---- a/modules/metadata/mod_remoteip.c -+++ b/modules/metadata/mod_remoteip.c -@@ -987,15 +987,13 @@ static remoteip_parse_status_t remoteip_process_v2_header(conn_rec *c, - return HDR_ERROR; - #endif - default: -- /* unsupported protocol, keep local connection address */ -- return HDR_DONE; -+ /* unsupported protocol */ -+ ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(10183) -+ "RemoteIPProxyProtocol: unsupported protocol %.2hx", -+ (unsigned short)hdr->v2.fam); -+ return HDR_ERROR; - } - break; /* we got a sockaddr now */ -- -- case 0x00: /* LOCAL command */ -- /* keep local connection address for LOCAL */ -- return HDR_DONE; -- - default: - /* not a supported command */ - ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(03507) -@@ -1087,11 +1085,24 @@ static apr_status_t remoteip_input_filter(ap_filter_t *f, - /* try to read a header's worth of data */ - while (!ctx->done) { - if (APR_BRIGADE_EMPTY(ctx->bb)) { -- ret = ap_get_brigade(f->next, ctx->bb, ctx->mode, block, -- ctx->need - ctx->rcvd); -+ apr_off_t got, want = ctx->need - ctx->rcvd; -+ -+ ret = ap_get_brigade(f->next, ctx->bb, ctx->mode, block, want); - if (ret != APR_SUCCESS) { -+ ap_log_cerror(APLOG_MARK, APLOG_ERR, ret, f->c, APLOGNO(10184) -+ "failed reading input"); - return ret; - } -+ -+ ret = apr_brigade_length(ctx->bb, 1, &got); -+ if (ret || got > want) { -+ ap_log_cerror(APLOG_MARK, APLOG_ERR, ret, f->c, APLOGNO(10185) -+ "RemoteIPProxyProtocol header too long, " -+ "got %" APR_OFF_T_FMT " expected %" APR_OFF_T_FMT, -+ got, want); -+ f->c->aborted = 1; -+ return APR_ECONNABORTED; -+ } - } - if (APR_BRIGADE_EMPTY(ctx->bb)) { - return block == APR_NONBLOCK_READ ? APR_SUCCESS : APR_EOF; -@@ -1139,6 +1150,13 @@ static apr_status_t remoteip_input_filter(ap_filter_t *f, - if (ctx->rcvd >= MIN_V2_HDR_LEN) { - ctx->need = MIN_V2_HDR_LEN + - remoteip_get_v2_len((proxy_header *) ctx->header); -+ if (ctx->need > sizeof(proxy_v2)) { -+ ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, f->c, APLOGNO(10186) -+ "RemoteIPProxyProtocol protocol header length too long"); -+ f->c->aborted = 1; -+ apr_brigade_destroy(ctx->bb); -+ return APR_ECONNABORTED; -+ } - } - if (ctx->rcvd >= ctx->need) { - psts = remoteip_process_v2_header(f->c, conn_conf, diff --git a/SOURCES/httpd-2.4.37-CVE-2019-10098.patch b/SOURCES/httpd-2.4.37-CVE-2019-10098.patch deleted file mode 100644 index c3a559f..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2019-10098.patch +++ /dev/null @@ -1,91 +0,0 @@ -diff --git a/include/ap_regex.h b/include/ap_regex.h -index 7d8df79..7af2f99 100644 ---- a/include/ap_regex.h -+++ b/include/ap_regex.h -@@ -84,7 +84,11 @@ extern "C" { - - #define AP_REG_DOLLAR_ENDONLY 0x200 /* '$' matches at end of subject string only */ - --#define AP_REG_MATCH "MATCH_" /** suggested prefix for ap_regname */ -+#define AP_REG_NO_DEFAULT 0x400 /**< Don't implicitely add AP_REG_DEFAULT options */ -+ -+#define AP_REG_MATCH "MATCH_" /**< suggested prefix for ap_regname */ -+ -+#define AP_REG_DEFAULT (AP_REG_DOTALL|AP_REG_DOLLAR_ENDONLY) - - /* Error values: */ - enum { -diff --git a/modules/filters/mod_substitute.c b/modules/filters/mod_substitute.c -index b7d5296..e976c51 100644 ---- a/modules/filters/mod_substitute.c -+++ b/modules/filters/mod_substitute.c -@@ -667,8 +667,10 @@ static const char *set_pattern(cmd_parms *cmd, void *cfg, const char *line) - - /* first see if we can compile the regex */ - if (!is_pattern) { -- r = ap_pregcomp(cmd->pool, from, AP_REG_EXTENDED | -- (ignore_case ? AP_REG_ICASE : 0)); -+ int flags = AP_REG_NO_DEFAULT -+ | (ap_regcomp_get_default_cflags() & AP_REG_DOLLAR_ENDONLY) -+ | (ignore_case ? AP_REG_ICASE : 0); -+ r = ap_pregcomp(cmd->pool, from, flags); - if (!r) - return "Substitute could not compile regex"; - } -diff --git a/server/core.c b/server/core.c -index 76432ce..6d00777 100644 ---- a/server/core.c -+++ b/server/core.c -@@ -4973,7 +4973,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem - init_config_defines(pconf); - apr_pool_cleanup_register(pconf, NULL, reset_config, apr_pool_cleanup_null); - -- ap_regcomp_set_default_cflags(AP_REG_DOLLAR_ENDONLY); -+ ap_regcomp_set_default_cflags(AP_REG_DEFAULT); - - mpm_common_pre_config(pconf); - -diff --git a/server/util_pcre.c b/server/util_pcre.c -index f2cb1bb..2a665c8 100644 ---- a/server/util_pcre.c -+++ b/server/util_pcre.c -@@ -120,7 +120,7 @@ AP_DECLARE(void) ap_regfree(ap_regex_t *preg) - * Compile a regular expression * - *************************************************/ - --static int default_cflags = AP_REG_DOLLAR_ENDONLY; -+static int default_cflags = AP_REG_DEFAULT; - - AP_DECLARE(int) ap_regcomp_get_default_cflags(void) - { -@@ -168,7 +168,8 @@ AP_DECLARE(int) ap_regcomp(ap_regex_t * preg, const char *pattern, int cflags) - int errcode = 0; - int options = PCRE_DUPNAMES; - -- cflags |= default_cflags; -+ if ((cflags & AP_REG_NO_DEFAULT) == 0) -+ cflags |= default_cflags; - if ((cflags & AP_REG_ICASE) != 0) - options |= PCRE_CASELESS; - if ((cflags & AP_REG_NEWLINE) != 0) -diff --git a/server/util_regex.c b/server/util_regex.c -index 2a30d68..5405f8d 100644 ---- a/server/util_regex.c -+++ b/server/util_regex.c -@@ -94,6 +94,7 @@ AP_DECLARE(ap_rxplus_t*) ap_rxplus_compile(apr_pool_t *pool, - } - - /* anything after the current delimiter is flags */ -+ ret->flags = ap_regcomp_get_default_cflags() & AP_REG_DOLLAR_ENDONLY; - while (*++endp) { - switch (*endp) { - case 'i': ret->flags |= AP_REG_ICASE; break; -@@ -106,7 +107,7 @@ AP_DECLARE(ap_rxplus_t*) ap_rxplus_compile(apr_pool_t *pool, - default: break; /* we should probably be stricter here */ - } - } -- if (ap_regcomp(&ret->rx, rxstr, ret->flags) == 0) { -+ if (ap_regcomp(&ret->rx, rxstr, AP_REG_NO_DEFAULT | ret->flags) == 0) { - apr_pool_cleanup_register(pool, &ret->rx, rxplus_cleanup, - apr_pool_cleanup_null); - } diff --git a/SOURCES/httpd-2.4.37-CVE-2020-11984.patch b/SOURCES/httpd-2.4.37-CVE-2020-11984.patch deleted file mode 100644 index 4bb9ea2..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2020-11984.patch +++ /dev/null @@ -1,36 +0,0 @@ ---- a/modules/proxy/mod_proxy_uwsgi.c 2020/07/24 09:31:46 1880250 -+++ b/modules/proxy/mod_proxy_uwsgi.c 2020/07/24 09:35:25 1880251 -@@ -136,7 +136,7 @@ - int j; - - apr_size_t headerlen = 4; -- apr_uint16_t pktsize, keylen, vallen; -+ apr_size_t pktsize, keylen, vallen; - const char *script_name; - const char *path_info; - const char *auth; -@@ -178,6 +178,15 @@ - headerlen += 2 + strlen(env[j].key) + 2 + strlen(env[j].val); - } - -+ pktsize = headerlen - 4; -+ if (pktsize > APR_UINT16_MAX) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10259) -+ "can't send headers to %s:%u: packet size too " -+ "large (%" APR_SIZE_T_FMT ")", -+ conn->hostname, conn->port, pktsize); -+ return HTTP_INTERNAL_SERVER_ERROR; -+ } -+ - ptr = buf = apr_palloc(r->pool, headerlen); - - ptr += 4; -@@ -196,8 +205,6 @@ - ptr += vallen; - } - -- pktsize = headerlen - 4; -- - buf[0] = 0; - buf[1] = (apr_byte_t) (pktsize & 0xff); - buf[2] = (apr_byte_t) ((pktsize >> 8) & 0xff); diff --git a/SOURCES/httpd-2.4.37-CVE-2020-13950.patch b/SOURCES/httpd-2.4.37-CVE-2020-13950.patch deleted file mode 100644 index 419a635..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2020-13950.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c -index 5786ea8..7da9bde 100644 ---- a/modules/proxy/mod_proxy_http.c -+++ b/modules/proxy/mod_proxy_http.c -@@ -637,7 +637,6 @@ static int ap_proxy_http_prefetch(proxy_http_req_t *req, - "chunked body with Content-Length (C-L ignored)", - c->client_ip, c->remote_host ? c->remote_host: ""); - req->old_cl_val = NULL; -- origin->keepalive = AP_CONN_CLOSE; - p_conn->close = 1; - } - diff --git a/SOURCES/httpd-2.4.37-CVE-2020-1934.patch b/SOURCES/httpd-2.4.37-CVE-2020-1934.patch deleted file mode 100644 index 69088b9..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2020-1934.patch +++ /dev/null @@ -1,68 +0,0 @@ ---- a/modules/proxy/mod_proxy_ftp.c 2020/02/07 17:01:07 1873744 -+++ b/modules/proxy/mod_proxy_ftp.c 2020/02/07 17:04:45 1873745 -@@ -218,7 +218,7 @@ - * (EBCDIC) machines either. - */ - static apr_status_t ftp_string_read(conn_rec *c, apr_bucket_brigade *bb, -- char *buff, apr_size_t bufflen, int *eos) -+ char *buff, apr_size_t bufflen, int *eos, apr_size_t *outlen) - { - apr_bucket *e; - apr_status_t rv; -@@ -230,6 +230,7 @@ - /* start with an empty string */ - buff[0] = 0; - *eos = 0; -+ *outlen = 0; - - /* loop through each brigade */ - while (!found) { -@@ -273,6 +274,7 @@ - if (len > 0) { - memcpy(pos, response, len); - pos += len; -+ *outlen += len; - } - } - apr_bucket_delete(e); -@@ -385,28 +387,36 @@ - char buff[5]; - char *mb = msgbuf, *me = &msgbuf[msglen]; - apr_status_t rv; -+ apr_size_t nread; -+ - int eos; - -- if (APR_SUCCESS != (rv = ftp_string_read(ftp_ctrl, bb, response, sizeof(response), &eos))) { -+ if (APR_SUCCESS != (rv = ftp_string_read(ftp_ctrl, bb, response, sizeof(response), &eos, &nread))) { - return -1; - } - /* - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, NULL, APLOGNO(03233) - "<%s", response); - */ -+ if (nread < 4) { -+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, NULL, APLOGNO(10229) "Malformed FTP response '%s'", response); -+ *mb = '\0'; -+ return -1; -+ } -+ - if (!apr_isdigit(response[0]) || !apr_isdigit(response[1]) || -- !apr_isdigit(response[2]) || (response[3] != ' ' && response[3] != '-')) -+ !apr_isdigit(response[2]) || (response[3] != ' ' && response[3] != '-')) - status = 0; - else - status = 100 * response[0] + 10 * response[1] + response[2] - 111 * '0'; - - mb = apr_cpystrn(mb, response + 4, me - mb); - -- if (response[3] == '-') { -+ if (response[3] == '-') { /* multi-line reply "123-foo\nbar\n123 baz" */ - memcpy(buff, response, 3); - buff[3] = ' '; - do { -- if (APR_SUCCESS != (rv = ftp_string_read(ftp_ctrl, bb, response, sizeof(response), &eos))) { -+ if (APR_SUCCESS != (rv = ftp_string_read(ftp_ctrl, bb, response, sizeof(response), &eos, &nread))) { - return -1; - } - mb = apr_cpystrn(mb, response + (' ' == response[0] ? 1 : 4), me - mb); diff --git a/SOURCES/httpd-2.4.37-CVE-2020-35452.patch b/SOURCES/httpd-2.4.37-CVE-2020-35452.patch deleted file mode 100644 index 998c1e5..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2020-35452.patch +++ /dev/null @@ -1,21 +0,0 @@ -diff --git a/modules/aaa/mod_auth_digest.c b/modules/aaa/mod_auth_digest.c -index b760941..0825b1b 100644 ---- a/modules/aaa/mod_auth_digest.c -+++ b/modules/aaa/mod_auth_digest.c -@@ -1422,9 +1422,14 @@ static int check_nonce(request_rec *r, digest_header_rec *resp, - time_rec nonce_time; - char tmp, hash[NONCE_HASH_LEN+1]; - -- if (strlen(resp->nonce) != NONCE_LEN) { -+ /* Since the time part of the nonce is a base64 encoding of an -+ * apr_time_t (8 bytes), it should end with a '=', fail early otherwise. -+ */ -+ if (strlen(resp->nonce) != NONCE_LEN -+ || resp->nonce[NONCE_TIME_LEN - 1] != '=') { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01775) -- "invalid nonce %s received - length is not %d", -+ "invalid nonce '%s' received - length is not %d " -+ "or time encoding is incorrect", - resp->nonce, NONCE_LEN); - note_digest_auth_failure(r, conf, resp, 1); - return HTTP_UNAUTHORIZED; diff --git a/SOURCES/httpd-2.4.37-CVE-2021-26690.patch b/SOURCES/httpd-2.4.37-CVE-2021-26690.patch deleted file mode 100644 index f606576..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2021-26690.patch +++ /dev/null @@ -1,14 +0,0 @@ -diff --git a/modules/session/mod_session.c b/modules/session/mod_session.c -index 7ee477c..049255d 100644 ---- a/modules/session/mod_session.c -+++ b/modules/session/mod_session.c -@@ -404,8 +404,8 @@ static apr_status_t session_identity_decode(request_rec * r, session_rec * z) - char *plast = NULL; - const char *psep = "="; - char *key = apr_strtok(pair, psep, &plast); -- char *val = apr_strtok(NULL, psep, &plast); - if (key && *key) { -+ char *val = apr_strtok(NULL, sep, &plast); - if (!val || !*val) { - apr_table_unset(z->entries, key); - } diff --git a/SOURCES/httpd-2.4.37-CVE-2021-26691.patch b/SOURCES/httpd-2.4.37-CVE-2021-26691.patch deleted file mode 100644 index 786aea2..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2021-26691.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/modules/session/mod_session.c b/modules/session/mod_session.c -index 049255d..af70f6b 100644 ---- a/modules/session/mod_session.c -+++ b/modules/session/mod_session.c -@@ -317,7 +317,7 @@ static apr_status_t ap_session_set(request_rec * r, session_rec * z, - static int identity_count(void *v, const char *key, const char *val) - { - int *count = v; -- *count += strlen(key) * 3 + strlen(val) * 3 + 1; -+ *count += strlen(key) * 3 + strlen(val) * 3 + 2; - return 1; - } - diff --git a/SOURCES/httpd-2.4.37-CVE-2021-30641.patch b/SOURCES/httpd-2.4.37-CVE-2021-30641.patch deleted file mode 100644 index 5a34afb..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2021-30641.patch +++ /dev/null @@ -1,44 +0,0 @@ -diff --git a/server/request.c b/server/request.c -index d5c558a..18625af 100644 ---- a/server/request.c -+++ b/server/request.c -@@ -1419,7 +1419,20 @@ AP_DECLARE(int) ap_location_walk(request_rec *r) - - cache = prep_walk_cache(AP_NOTE_LOCATION_WALK, r); - cached = (cache->cached != NULL); -- entry_uri = r->uri; -+ -+ /* -+ * When merge_slashes is set to AP_CORE_CONFIG_OFF the slashes in r->uri -+ * have not been merged. But for Location walks we always go with merged -+ * slashes no matter what merge_slashes is set to. -+ */ -+ if (sconf->merge_slashes != AP_CORE_CONFIG_OFF) { -+ entry_uri = r->uri; -+ } -+ else { -+ char *uri = apr_pstrdup(r->pool, r->uri); -+ ap_no2slash(uri); -+ entry_uri = uri; -+ } - - /* If we have an cache->cached location that matches r->uri, - * and the vhost's list of locations hasn't changed, we can skip -@@ -1486,7 +1499,7 @@ AP_DECLARE(int) ap_location_walk(request_rec *r) - pmatch = apr_palloc(rxpool, nmatch*sizeof(ap_regmatch_t)); - } - -- if (ap_regexec(entry_core->r, entry_uri, nmatch, pmatch, 0)) { -+ if (ap_regexec(entry_core->r, r->uri, nmatch, pmatch, 0)) { - continue; - } - -@@ -1496,7 +1509,7 @@ AP_DECLARE(int) ap_location_walk(request_rec *r) - apr_table_setn(r->subprocess_env, - ((const char **)entry_core->refs->elts)[i], - apr_pstrndup(r->pool, -- entry_uri + pmatch[i].rm_so, -+ r->uri + pmatch[i].rm_so, - pmatch[i].rm_eo - pmatch[i].rm_so)); - } - } diff --git a/SOURCES/httpd-2.4.37-CVE-2021-33193.patch b/SOURCES/httpd-2.4.37-CVE-2021-33193.patch deleted file mode 100644 index cec1c96..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2021-33193.patch +++ /dev/null @@ -1,706 +0,0 @@ -diff --git a/include/http_core.h b/include/http_core.h -index 8e10988..3ba8069 100644 ---- a/include/http_core.h -+++ b/include/http_core.h -@@ -741,6 +741,7 @@ typedef struct { - #define AP_HTTP_METHODS_REGISTERED 2 - char http_methods; - unsigned int merge_slashes; -+ unsigned int strict_host_check; - } core_server_config; - - /* for AddOutputFiltersByType in core.c */ -@@ -769,6 +770,11 @@ AP_DECLARE(void) ap_set_server_protocol(server_rec* s, const char* proto); - typedef struct core_output_filter_ctx core_output_filter_ctx_t; - typedef struct core_filter_ctx core_ctx_t; - -+struct core_filter_ctx { -+ apr_bucket_brigade *b; -+ apr_bucket_brigade *tmpbb; -+}; -+ - typedef struct core_net_rec { - /** Connection to the client */ - apr_socket_t *client_socket; -diff --git a/include/http_protocol.h b/include/http_protocol.h -index 11c7b2d..e7abdd9 100644 ---- a/include/http_protocol.h -+++ b/include/http_protocol.h -@@ -53,6 +53,13 @@ AP_DECLARE_DATA extern ap_filter_rec_t *ap_old_write_func; - * or control the ones that eventually do. - */ - -+/** -+ * Read an empty request and set reasonable defaults. -+ * @param c The current connection -+ * @return The new request_rec -+ */ -+AP_DECLARE(request_rec *) ap_create_request(conn_rec *c); -+ - /** - * Read a request and fill in the fields. - * @param c The current connection -@@ -60,6 +67,20 @@ AP_DECLARE_DATA extern ap_filter_rec_t *ap_old_write_func; - */ - request_rec *ap_read_request(conn_rec *c); - -+/** -+ * Parse and validate the request line. -+ * @param r The current request -+ * @return 1 on success, 0 on failure -+ */ -+AP_DECLARE(int) ap_parse_request_line(request_rec *r); -+ -+/** -+ * Validate the request header and select vhost. -+ * @param r The current request -+ * @return 1 on success, 0 on failure -+ */ -+AP_DECLARE(int) ap_check_request_header(request_rec *r); -+ - /** - * Read the mime-encoded headers. - * @param r The current request -diff --git a/include/http_vhost.h b/include/http_vhost.h -index 473c9c7..d2d9c97 100644 ---- a/include/http_vhost.h -+++ b/include/http_vhost.h -@@ -99,6 +99,19 @@ AP_DECLARE(void) ap_update_vhost_given_ip(conn_rec *conn); - */ - AP_DECLARE(void) ap_update_vhost_from_headers(request_rec *r); - -+/** -+ * Updates r->server with the best name-based virtual host match, within -+ * the chain of matching virtual hosts selected by ap_update_vhost_given_ip. -+ * @param r The current request -+ * @param require_match 1 to return an HTTP error if the requested hostname is -+ * not explicitly matched to a VirtualHost. -+ * @return return HTTP_OK unless require_match was specified and the requested -+ * hostname did not match any ServerName, ServerAlias, or VirtualHost -+ * address-spec. -+ */ -+AP_DECLARE(int) ap_update_vhost_from_headers_ex(request_rec *r, int require_match); -+ -+ - /** - * Match the host in the header with the hostname of the server for this - * request. -diff --git a/server/core.c b/server/core.c -index 84e80f2..23abf57 100644 ---- a/server/core.c -+++ b/server/core.c -@@ -498,6 +498,8 @@ static void *create_core_server_config(apr_pool_t *a, server_rec *s) - conf->protocols = apr_array_make(a, 5, sizeof(const char *)); - conf->protocols_honor_order = -1; - -+ conf->strict_host_check= AP_CORE_CONFIG_UNSET; -+ - return (void *)conf; - } - -@@ -565,6 +567,12 @@ static void *merge_core_server_configs(apr_pool_t *p, void *basev, void *virtv) - - AP_CORE_MERGE_FLAG(merge_slashes, conf, base, virt); - -+ conf->strict_host_check = (virt->strict_host_check != AP_CORE_CONFIG_UNSET) -+ ? virt->strict_host_check -+ : base->strict_host_check; -+ -+ AP_CORE_MERGE_FLAG(strict_host_check, conf, base, virt); -+ - return conf; - } - -@@ -4546,7 +4554,10 @@ AP_INIT_TAKE2("CGIVar", set_cgi_var, NULL, OR_FILEINFO, - AP_INIT_FLAG("QualifyRedirectURL", set_qualify_redirect_url, NULL, OR_FILEINFO, - "Controls whether HTTP authorization headers, normally hidden, will " - "be passed to scripts"), -- -+AP_INIT_FLAG("StrictHostCheck", set_core_server_flag, -+ (void *)APR_OFFSETOF(core_server_config, strict_host_check), -+ RSRC_CONF, -+ "Controls whether a hostname match is required"), - AP_INIT_TAKE1("ForceType", ap_set_string_slot_lower, - (void *)APR_OFFSETOF(core_dir_config, mime_type), OR_FILEINFO, - "a mime type that overrides other configured type"), -@@ -5581,4 +5592,3 @@ AP_DECLARE_MODULE(core) = { - core_cmds, /* command apr_table_t */ - register_hooks /* register hooks */ - }; -- -diff --git a/server/core_filters.c b/server/core_filters.c -index a6c2bd6..e08801f 100644 ---- a/server/core_filters.c -+++ b/server/core_filters.c -@@ -84,11 +84,6 @@ struct core_output_filter_ctx { - apr_size_t bytes_written; - }; - --struct core_filter_ctx { -- apr_bucket_brigade *b; -- apr_bucket_brigade *tmpbb; --}; -- - - apr_status_t ap_core_input_filter(ap_filter_t *f, apr_bucket_brigade *b, - ap_input_mode_t mode, apr_read_type_e block, -diff --git a/server/protocol.c b/server/protocol.c -index 8d1fdd2..430d91e 100644 ---- a/server/protocol.c -+++ b/server/protocol.c -@@ -609,8 +609,15 @@ AP_CORE_DECLARE(void) ap_parse_uri(request_rec *r, const char *uri) - } - - r->args = r->parsed_uri.query; -- r->uri = r->parsed_uri.path ? r->parsed_uri.path -- : apr_pstrdup(r->pool, "/"); -+ if (r->parsed_uri.path) { -+ r->uri = r->parsed_uri.path; -+ } -+ else if (r->method_number == M_OPTIONS) { -+ r->uri = apr_pstrdup(r->pool, "*"); -+ } -+ else { -+ r->uri = apr_pstrdup(r->pool, "/"); -+ } - - #if defined(OS2) || defined(WIN32) - /* Handle path translations for OS/2 and plug security hole. -@@ -645,13 +652,6 @@ static int field_name_len(const char *field) - - static int read_request_line(request_rec *r, apr_bucket_brigade *bb) - { -- enum { -- rrl_none, rrl_badmethod, rrl_badwhitespace, rrl_excesswhitespace, -- rrl_missinguri, rrl_baduri, rrl_badprotocol, rrl_trailingtext, -- rrl_badmethod09, rrl_reject09 -- } deferred_error = rrl_none; -- char *ll; -- char *uri; - apr_size_t len; - int num_blank_lines = DEFAULT_LIMIT_BLANK_LINES; - core_server_config *conf = ap_get_core_module_config(r->server->module_config); -@@ -711,6 +711,20 @@ static int read_request_line(request_rec *r, apr_bucket_brigade *bb) - } - - r->request_time = apr_time_now(); -+ return 1; -+} -+ -+AP_DECLARE(int) ap_parse_request_line(request_rec *r) -+{ -+ core_server_config *conf = ap_get_core_module_config(r->server->module_config); -+ int strict = (conf->http_conformance != AP_HTTP_CONFORMANCE_UNSAFE); -+ enum { -+ rrl_none, rrl_badmethod, rrl_badwhitespace, rrl_excesswhitespace, -+ rrl_missinguri, rrl_baduri, rrl_badprotocol, rrl_trailingtext, -+ rrl_badmethod09, rrl_reject09 -+ } deferred_error = rrl_none; -+ apr_size_t len = 0; -+ char *uri, *ll; - - r->method = r->the_request; - -@@ -742,7 +756,6 @@ static int read_request_line(request_rec *r, apr_bucket_brigade *bb) - if (deferred_error == rrl_none) - deferred_error = rrl_missinguri; - r->protocol = uri = ""; -- len = 0; - goto rrl_done; - } - else if (strict && ll[0] && apr_isspace(ll[1]) -@@ -773,7 +786,6 @@ static int read_request_line(request_rec *r, apr_bucket_brigade *bb) - /* Verify URI terminated with a single SP, or mark as specific error */ - if (!ll) { - r->protocol = ""; -- len = 0; - goto rrl_done; - } - else if (strict && ll[0] && apr_isspace(ll[1]) -@@ -866,6 +878,14 @@ rrl_done: - r->header_only = 1; - - ap_parse_uri(r, uri); -+ if (r->status == HTTP_OK -+ && (r->parsed_uri.path != NULL) -+ && (r->parsed_uri.path[0] != '/') -+ && (r->method_number != M_OPTIONS -+ || strcmp(r->parsed_uri.path, "*") != 0)) { -+ /* Invalid request-target per RFC 7230 section 5.3 */ -+ r->status = HTTP_BAD_REQUEST; -+ } - - /* With the request understood, we can consider HTTP/0.9 specific errors */ - if (r->proto_num == HTTP_VERSION(0, 9) && deferred_error == rrl_none) { -@@ -973,6 +993,79 @@ rrl_failed: - return 0; - } - -+AP_DECLARE(int) ap_check_request_header(request_rec *r) -+{ -+ core_server_config *conf; -+ int strict_host_check; -+ const char *expect; -+ int access_status; -+ -+ conf = ap_get_core_module_config(r->server->module_config); -+ -+ /* update what we think the virtual host is based on the headers we've -+ * now read. may update status. -+ */ -+ strict_host_check = (conf->strict_host_check == AP_CORE_CONFIG_ON); -+ access_status = ap_update_vhost_from_headers_ex(r, strict_host_check); -+ if (strict_host_check && access_status != HTTP_OK) { -+ if (r->server == ap_server_conf) { -+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(10156) -+ "Requested hostname '%s' did not match any ServerName/ServerAlias " -+ "in the global server configuration ", r->hostname); -+ } -+ else { -+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(10157) -+ "Requested hostname '%s' did not match any ServerName/ServerAlias " -+ "in the matching virtual host (default vhost for " -+ "current connection is %s:%u)", -+ r->hostname, r->server->defn_name, r->server->defn_line_number); -+ } -+ r->status = access_status; -+ } -+ if (r->status != HTTP_OK) { -+ return 0; -+ } -+ -+ if ((!r->hostname && (r->proto_num >= HTTP_VERSION(1, 1))) -+ || ((r->proto_num == HTTP_VERSION(1, 1)) -+ && !apr_table_get(r->headers_in, "Host"))) { -+ /* -+ * Client sent us an HTTP/1.1 or later request without telling us the -+ * hostname, either with a full URL or a Host: header. We therefore -+ * need to (as per the 1.1 spec) send an error. As a special case, -+ * HTTP/1.1 mentions twice (S9, S14.23) that a request MUST contain -+ * a Host: header, and the server MUST respond with 400 if it doesn't. -+ */ -+ ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(00569) -+ "client sent HTTP/1.1 request without hostname " -+ "(see RFC2616 section 14.23): %s", r->uri); -+ r->status = HTTP_BAD_REQUEST; -+ return 0; -+ } -+ -+ if (((expect = apr_table_get(r->headers_in, "Expect")) != NULL) -+ && (expect[0] != '\0')) { -+ /* -+ * The Expect header field was added to HTTP/1.1 after RFC 2068 -+ * as a means to signal when a 100 response is desired and, -+ * unfortunately, to signal a poor man's mandatory extension that -+ * the server must understand or return 417 Expectation Failed. -+ */ -+ if (ap_cstr_casecmp(expect, "100-continue") == 0) { -+ r->expecting_100 = 1; -+ } -+ else { -+ ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00570) -+ "client sent an unrecognized expectation value " -+ "of Expect: %s", expect); -+ r->status = HTTP_EXPECTATION_FAILED; -+ return 0; -+ } -+ } -+ -+ return 1; -+} -+ - static int table_do_fn_check_lengths(void *r_, const char *key, - const char *value) - { -@@ -1256,16 +1349,10 @@ AP_DECLARE(void) ap_get_mime_headers(request_rec *r) - apr_brigade_destroy(tmp_bb); - } - --request_rec *ap_read_request(conn_rec *conn) -+AP_DECLARE(request_rec *) ap_create_request(conn_rec *conn) - { - request_rec *r; - apr_pool_t *p; -- const char *expect; -- int access_status; -- apr_bucket_brigade *tmp_bb; -- apr_socket_t *csd; -- apr_interval_time_t cur_timeout; -- - - apr_pool_create(&p, conn->pool); - apr_pool_tag(p, "request"); -@@ -1304,6 +1391,7 @@ request_rec *ap_read_request(conn_rec *conn) - r->read_body = REQUEST_NO_BODY; - - r->status = HTTP_OK; /* Until further notice */ -+ r->header_only = 0; - r->the_request = NULL; - - /* Begin by presuming any module can make its own path_info assumptions, -@@ -1314,12 +1402,33 @@ request_rec *ap_read_request(conn_rec *conn) - r->useragent_addr = conn->client_addr; - r->useragent_ip = conn->client_ip; - -+ return r; -+} -+ -+/* Apply the server's timeout/config to the connection/request. */ -+static void apply_server_config(request_rec *r) -+{ -+ apr_socket_t *csd; -+ -+ csd = ap_get_conn_socket(r->connection); -+ apr_socket_timeout_set(csd, r->server->timeout); -+ -+ r->per_dir_config = r->server->lookup_defaults; -+} -+ -+request_rec *ap_read_request(conn_rec *conn) -+{ -+ int access_status; -+ apr_bucket_brigade *tmp_bb; -+ -+ request_rec *r = ap_create_request(conn); - tmp_bb = apr_brigade_create(r->pool, r->connection->bucket_alloc); - - ap_run_pre_read_request(r, conn); - - /* Get the request... */ -- if (!read_request_line(r, tmp_bb)) { -+ if (!read_request_line(r, tmp_bb) || !ap_parse_request_line(r)) { -+ apr_brigade_cleanup(tmp_bb); - switch (r->status) { - case HTTP_REQUEST_URI_TOO_LARGE: - case HTTP_BAD_REQUEST: -@@ -1335,49 +1444,38 @@ request_rec *ap_read_request(conn_rec *conn) - "request failed: malformed request line"); - } - access_status = r->status; -- r->status = HTTP_OK; -- ap_die(access_status, r); -- ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); -- ap_run_log_transaction(r); -- r = NULL; -- apr_brigade_destroy(tmp_bb); -- goto traceout; -+ goto die_unusable_input; -+ - case HTTP_REQUEST_TIME_OUT: -+ /* Just log, no further action on this connection. */ - ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, NULL); - if (!r->connection->keepalives) - ap_run_log_transaction(r); -- apr_brigade_destroy(tmp_bb); -- goto traceout; -- default: -- apr_brigade_destroy(tmp_bb); -- r = NULL; -- goto traceout; -+ break; - } -+ /* Not worth dying with. */ -+ conn->keepalive = AP_CONN_CLOSE; -+ apr_pool_destroy(r->pool); -+ goto ignore; - } -+ apr_brigade_cleanup(tmp_bb); - - /* We may have been in keep_alive_timeout mode, so toggle back - * to the normal timeout mode as we fetch the header lines, - * as necessary. - */ -- csd = ap_get_conn_socket(conn); -- apr_socket_timeout_get(csd, &cur_timeout); -- if (cur_timeout != conn->base_server->timeout) { -- apr_socket_timeout_set(csd, conn->base_server->timeout); -- cur_timeout = conn->base_server->timeout; -- } -+ apply_server_config(r); - - if (!r->assbackwards) { - const char *tenc; - - ap_get_mime_headers_core(r, tmp_bb); -+ apr_brigade_cleanup(tmp_bb); - if (r->status != HTTP_OK) { - ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(00567) - "request failed: error reading the headers"); -- ap_send_error_response(r, 0); -- ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); -- ap_run_log_transaction(r); -- apr_brigade_destroy(tmp_bb); -- goto traceout; -+ access_status = r->status; -+ goto die_unusable_input; - } - - tenc = apr_table_get(r->headers_in, "Transfer-Encoding"); -@@ -1393,13 +1491,8 @@ request_rec *ap_read_request(conn_rec *conn) - ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(02539) - "client sent unknown Transfer-Encoding " - "(%s): %s", tenc, r->uri); -- r->status = HTTP_BAD_REQUEST; -- conn->keepalive = AP_CONN_CLOSE; -- ap_send_error_response(r, 0); -- ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); -- ap_run_log_transaction(r); -- apr_brigade_destroy(tmp_bb); -- goto traceout; -+ access_status = HTTP_BAD_REQUEST; -+ goto die_unusable_input; - } - - /* http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-23 -@@ -1412,88 +1505,81 @@ request_rec *ap_read_request(conn_rec *conn) - } - } - -- apr_brigade_destroy(tmp_bb); -- -- /* update what we think the virtual host is based on the headers we've -- * now read. may update status. -- */ -- ap_update_vhost_from_headers(r); -- access_status = r->status; -- -- /* Toggle to the Host:-based vhost's timeout mode to fetch the -- * request body and send the response body, if needed. -- */ -- if (cur_timeout != r->server->timeout) { -- apr_socket_timeout_set(csd, r->server->timeout); -- cur_timeout = r->server->timeout; -- } -- -- /* we may have switched to another server */ -- r->per_dir_config = r->server->lookup_defaults; -- -- if ((!r->hostname && (r->proto_num >= HTTP_VERSION(1, 1))) -- || ((r->proto_num == HTTP_VERSION(1, 1)) -- && !apr_table_get(r->headers_in, "Host"))) { -- /* -- * Client sent us an HTTP/1.1 or later request without telling us the -- * hostname, either with a full URL or a Host: header. We therefore -- * need to (as per the 1.1 spec) send an error. As a special case, -- * HTTP/1.1 mentions twice (S9, S14.23) that a request MUST contain -- * a Host: header, and the server MUST respond with 400 if it doesn't. -- */ -- access_status = HTTP_BAD_REQUEST; -- ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(00569) -- "client sent HTTP/1.1 request without hostname " -- "(see RFC2616 section 14.23): %s", r->uri); -- } -- - /* - * Add the HTTP_IN filter here to ensure that ap_discard_request_body - * called by ap_die and by ap_send_error_response works correctly on - * status codes that do not cause the connection to be dropped and - * in situations where the connection should be kept alive. - */ -- - ap_add_input_filter_handle(ap_http_input_filter_handle, - NULL, r, r->connection); - -- if (access_status != HTTP_OK -- || (access_status = ap_run_post_read_request(r))) { -- ap_die(access_status, r); -- ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); -- ap_run_log_transaction(r); -- r = NULL; -- goto traceout; -+ /* Validate Host/Expect headers and select vhost. */ -+ if (!ap_check_request_header(r)) { -+ /* we may have switched to another server still */ -+ apply_server_config(r); -+ access_status = r->status; -+ goto die_before_hooks; - } - -- if (((expect = apr_table_get(r->headers_in, "Expect")) != NULL) -- && (expect[0] != '\0')) { -- /* -- * The Expect header field was added to HTTP/1.1 after RFC 2068 -- * as a means to signal when a 100 response is desired and, -- * unfortunately, to signal a poor man's mandatory extension that -- * the server must understand or return 417 Expectation Failed. -- */ -- if (strcasecmp(expect, "100-continue") == 0) { -- r->expecting_100 = 1; -- } -- else { -- r->status = HTTP_EXPECTATION_FAILED; -- ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00570) -- "client sent an unrecognized expectation value of " -- "Expect: %s", expect); -- ap_send_error_response(r, 0); -- ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); -- ap_run_log_transaction(r); -- goto traceout; -- } -+ /* we may have switched to another server */ -+ apply_server_config(r); -+ -+ if ((access_status = ap_run_post_read_request(r))) { -+ goto die; - } - -- AP_READ_REQUEST_SUCCESS((uintptr_t)r, (char *)r->method, (char *)r->uri, (char *)r->server->defn_name, r->status); -+ AP_READ_REQUEST_SUCCESS((uintptr_t)r, (char *)r->method, -+ (char *)r->uri, (char *)r->server->defn_name, -+ r->status); -+ - return r; -- traceout: -+ -+ /* Everything falls through on failure */ -+ -+die_unusable_input: -+ /* Input filters are in an undeterminate state, cleanup (including -+ * CORE_IN's socket) such that any further attempt to read is EOF. -+ */ -+ { -+ ap_filter_t *f = conn->input_filters; -+ while (f) { -+ if (f->frec == ap_core_input_filter_handle) { -+ core_net_rec *net = f->ctx; -+ apr_brigade_cleanup(net->in_ctx->b); -+ break; -+ } -+ ap_remove_input_filter(f); -+ f = f->next; -+ } -+ conn->input_filters = r->input_filters = f; -+ conn->keepalive = AP_CONN_CLOSE; -+ } -+ -+die_before_hooks: -+ /* First call to ap_die() (non recursive) */ -+ r->status = HTTP_OK; -+ -+die: -+ ap_die(access_status, r); -+ -+ /* ap_die() sent the response through the output filters, we must now -+ * end the request with an EOR bucket for stream/pipeline accounting. -+ */ -+ { -+ apr_bucket_brigade *eor_bb; -+ eor_bb = apr_brigade_create(conn->pool, conn->bucket_alloc); -+ APR_BRIGADE_INSERT_TAIL(eor_bb, -+ ap_bucket_eor_create(conn->bucket_alloc, r)); -+ ap_pass_brigade(conn->output_filters, eor_bb); -+ apr_brigade_cleanup(eor_bb); -+ } -+ -+ignore: -+ r = NULL; -+ - AP_READ_REQUEST_FAILURE((uintptr_t)r); -- return r; -+ return NULL; - } - - /* if a request with a body creates a subrequest, remove original request's -diff --git a/server/vhost.c b/server/vhost.c -index b23b2dd..6e233b5 100644 ---- a/server/vhost.c -+++ b/server/vhost.c -@@ -34,6 +34,7 @@ - #include "http_vhost.h" - #include "http_protocol.h" - #include "http_core.h" -+#include "http_main.h" - - #if APR_HAVE_ARPA_INET_H - #include -@@ -973,7 +974,13 @@ AP_DECLARE(int) ap_matches_request_vhost(request_rec *r, const char *host, - } - - --static void check_hostalias(request_rec *r) -+/* -+ * Updates r->server from ServerName/ServerAlias. Per the interaction -+ * of ip and name-based vhosts, it only looks in the best match from the -+ * connection-level ip-based matching. -+ * Returns HTTP_BAD_REQUEST if there was no match. -+ */ -+static int update_server_from_aliases(request_rec *r) - { - /* - * Even if the request has a Host: header containing a port we ignore -@@ -1050,11 +1057,18 @@ static void check_hostalias(request_rec *r) - goto found; - } - -- return; -+ if (!r->connection->vhost_lookup_data) { -+ if (matches_aliases(r->server, host)) { -+ s = r->server; -+ goto found; -+ } -+ } -+ return HTTP_BAD_REQUEST; - - found: - /* s is the first matching server, we're done */ - r->server = s; -+ return HTTP_OK; - } - - -@@ -1071,7 +1085,7 @@ static void check_serverpath(request_rec *r) - * This is in conjunction with the ServerPath code in http_core, so we - * get the right host attached to a non- Host-sending request. - * -- * See the comment in check_hostalias about how each vhost can be -+ * See the comment in update_server_from_aliases about how each vhost can be - * listed multiple times. - */ - -@@ -1134,11 +1148,17 @@ static APR_INLINE const char *construct_host_header(request_rec *r, - } - - AP_DECLARE(void) ap_update_vhost_from_headers(request_rec *r) -+{ -+ ap_update_vhost_from_headers_ex(r, 0); -+} -+ -+AP_DECLARE(int) ap_update_vhost_from_headers_ex(request_rec *r, int require_match) - { - core_server_config *conf = ap_get_core_module_config(r->server->module_config); - const char *host_header = apr_table_get(r->headers_in, "Host"); - int is_v6literal = 0; - int have_hostname_from_url = 0; -+ int rc = HTTP_OK; - - if (r->hostname) { - /* -@@ -1151,8 +1171,8 @@ AP_DECLARE(void) ap_update_vhost_from_headers(request_rec *r) - else if (host_header != NULL) { - is_v6literal = fix_hostname(r, host_header, conf->http_conformance); - } -- if (r->status != HTTP_OK) -- return; -+ if (!require_match && r->status != HTTP_OK) -+ return HTTP_OK; - - if (conf->http_conformance != AP_HTTP_CONFORMANCE_UNSAFE) { - /* -@@ -1173,10 +1193,16 @@ AP_DECLARE(void) ap_update_vhost_from_headers(request_rec *r) - /* check if we tucked away a name_chain */ - if (r->connection->vhost_lookup_data) { - if (r->hostname) -- check_hostalias(r); -+ rc = update_server_from_aliases(r); - else - check_serverpath(r); - } -+ else if (require_match && r->hostname) { -+ /* check the base server config */ -+ rc = update_server_from_aliases(r); -+ } -+ -+ return rc; - } - - /** diff --git a/SOURCES/httpd-2.4.37-CVE-2021-34798.patch b/SOURCES/httpd-2.4.37-CVE-2021-34798.patch deleted file mode 100644 index 4a03341..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2021-34798.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/server/scoreboard.c b/server/scoreboard.c -index 23e3d70..7b01bdf 100644 ---- a/server/scoreboard.c -+++ b/server/scoreboard.c -@@ -376,7 +376,7 @@ AP_DECLARE(void) ap_increment_counts(ap_sb_handle_t *sb, request_rec *r) - if (pfn_ap_logio_get_last_bytes != NULL) { - bytes = pfn_ap_logio_get_last_bytes(r->connection); - } -- else if (r->method_number == M_GET && r->method[0] == 'H') { -+ else if (r->method_number == M_GET && r->method && r->method[0] == 'H') { - bytes = 0; - } - else { diff --git a/SOURCES/httpd-2.4.37-CVE-2021-36160.patch b/SOURCES/httpd-2.4.37-CVE-2021-36160.patch deleted file mode 100644 index f67a391..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2021-36160.patch +++ /dev/null @@ -1,45 +0,0 @@ -diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c -index 792d35e..9dcbed1 100644 ---- a/modules/proxy/mod_proxy_uwsgi.c -+++ b/modules/proxy/mod_proxy_uwsgi.c -@@ -453,11 +453,8 @@ static int uwsgi_handler(request_rec *r, proxy_worker * worker, - const char *proxyname, apr_port_t proxyport) - { - int status; -- int delta = 0; -- int decode_status; - proxy_conn_rec *backend = NULL; - apr_pool_t *p = r->pool; -- size_t w_len; - char server_portstr[32]; - char *u_path_info; - apr_uri_t *uri; -@@ -469,23 +466,14 @@ static int uwsgi_handler(request_rec *r, proxy_worker * worker, - - uri = apr_palloc(r->pool, sizeof(*uri)); - -- /* ADD PATH_INFO */ --#if AP_MODULE_MAGIC_AT_LEAST(20111130,0) -- w_len = strlen(worker->s->name); --#else -- w_len = strlen(worker->name); --#endif -- u_path_info = r->filename + 6 + w_len; -- if (u_path_info[0] != '/') { -- delta = 1; -- } -- decode_status = ap_unescape_url(url + w_len - delta); -- if (decode_status) { -+ /* ADD PATH_INFO (unescaped) */ -+ u_path_info = ap_strchr(url + sizeof(UWSGI_SCHEME) + 2, '/'); -+ if (!u_path_info || ap_unescape_url(u_path_info) != OK) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10100) -- "unable to decode uri: %s", url + w_len - delta); -+ "unable to decode uwsgi uri: %s", url); - return HTTP_INTERNAL_SERVER_ERROR; - } -- apr_table_add(r->subprocess_env, "PATH_INFO", url + w_len - delta); -+ apr_table_add(r->subprocess_env, "PATH_INFO", u_path_info); - - - /* Create space for state information */ diff --git a/SOURCES/httpd-2.4.37-CVE-2021-39275.patch b/SOURCES/httpd-2.4.37-CVE-2021-39275.patch deleted file mode 100644 index 590268f..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2021-39275.patch +++ /dev/null @@ -1,21 +0,0 @@ -diff --git a/server/util.c b/server/util.c -index e0c558c..2a5dd04 100644 ---- a/server/util.c -+++ b/server/util.c -@@ -2460,13 +2460,12 @@ AP_DECLARE(char *) ap_escape_quotes(apr_pool_t *p, const char *instring) - * in front of every " that doesn't already have one. - */ - while (*inchr != '\0') { -- if ((*inchr == '\\') && (inchr[1] != '\0')) { -- *outchr++ = *inchr++; -- *outchr++ = *inchr++; -- } - if (*inchr == '"') { - *outchr++ = '\\'; - } -+ if ((*inchr == '\\') && (inchr[1] != '\0')) { -+ *outchr++ = *inchr++; -+ } - if (*inchr != '\0') { - *outchr++ = *inchr++; - } diff --git a/SOURCES/httpd-2.4.37-CVE-2021-40438.patch b/SOURCES/httpd-2.4.37-CVE-2021-40438.patch deleted file mode 100644 index 39758c7..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2021-40438.patch +++ /dev/null @@ -1,126 +0,0 @@ -diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c -index fb897a9..38dbb24 100644 ---- a/modules/mappers/mod_rewrite.c -+++ b/modules/mappers/mod_rewrite.c -@@ -619,6 +619,13 @@ static unsigned is_absolute_uri(char *uri, int *supportsqs) - return 6; - } - break; -+ -+ case 'u': -+ case 'U': -+ if (!ap_cstr_casecmpn(uri, "nix:", 4)) { /* unix: */ -+ *sqs = 1; -+ return (uri[4] == '/' && uri[5] == '/') ? 7 : 5; -+ } - } - - return 0; -diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c -index f383996..6a9ef55 100644 ---- a/modules/proxy/mod_proxy.c -+++ b/modules/proxy/mod_proxy.c -@@ -1717,7 +1717,8 @@ PROXY_DECLARE(const char *) ap_proxy_de_socketfy(apr_pool_t *p, const char *url) - * the UDS path... ignore it - */ - if (!strncasecmp(url, "unix:", 5) && -- ((ptr = ap_strchr_c(url, '|')) != NULL)) { -+ ((ptr = ap_strchr_c(url + 5, '|')) != NULL)) { -+ - /* move past the 'unix:...|' UDS path info */ - const char *ret, *c; - -diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c -index 7714b6c..3dd570c 100644 ---- a/modules/proxy/proxy_util.c -+++ b/modules/proxy/proxy_util.c -@@ -2084,33 +2084,45 @@ static int ap_proxy_retry_worker(const char *proxy_function, proxy_worker *worke - * were passed a UDS url (eg: from mod_proxy) and adjust uds_path - * as required. - */ --static void fix_uds_filename(request_rec *r, char **url) -+static int fix_uds_filename(request_rec *r, char **url) - { -- char *ptr, *ptr2; -- if (!r || !r->filename) return; -+ char *uds_url = r->filename + 6, *origin_url; - - if (!strncmp(r->filename, "proxy:", 6) && -- (ptr2 = ap_strcasestr(r->filename, "unix:")) && -- (ptr = ap_strchr(ptr2, '|'))) { -+ !ap_cstr_casecmpn(uds_url, "unix:", 5) && -+ (origin_url = ap_strchr(uds_url + 5, '|'))) { -+ char *uds_path = NULL; -+ apr_size_t url_len; - apr_uri_t urisock; - apr_status_t rv; -- *ptr = '\0'; -- rv = apr_uri_parse(r->pool, ptr2, &urisock); -- if (rv == APR_SUCCESS) { -- char *rurl = ptr+1; -- char *sockpath = ap_runtime_dir_relative(r->pool, urisock.path); -- apr_table_setn(r->notes, "uds_path", sockpath); -- *url = apr_pstrdup(r->pool, rurl); /* so we get the scheme for the uds */ -- /* r->filename starts w/ "proxy:", so add after that */ -- memmove(r->filename+6, rurl, strlen(rurl)+1); -- ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, -- "*: rewrite of url due to UDS(%s): %s (%s)", -- sockpath, *url, r->filename); -- } -- else { -- *ptr = '|'; -- } -- } -+ -+ *origin_url = '\0'; -+ rv = apr_uri_parse(r->pool, uds_url, &urisock); -+ *origin_url++ = '|'; -+ -+ if (rv == APR_SUCCESS && urisock.path && (!urisock.hostname -+ || !urisock.hostname[0])) { -+ uds_path = ap_runtime_dir_relative(r->pool, urisock.path); -+ } -+ -+ if (!uds_path) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10292) -+ "Invalid proxy UDS filename (%s)", r->filename); -+ return 0; -+ } -+ apr_table_setn(r->notes, "uds_path", uds_path); -+ -+ /* Remove the UDS path from *url and r->filename */ -+ url_len = strlen(origin_url); -+ *url = apr_pstrmemdup(r->pool, origin_url, url_len); -+ memcpy(uds_url, *url, url_len + 1); -+ -+ ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, -+ "*: rewrite of url due to UDS(%s): %s (%s)", -+ uds_path, *url, r->filename); -+ } -+ -+ return 1; - } - - PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, -@@ -2128,7 +2140,9 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, - "%s: found worker %s for %s", - (*worker)->s->scheme, (*worker)->s->name, *url); - *balancer = NULL; -- fix_uds_filename(r, url); -+ if (!fix_uds_filename(r, url)) { -+ return HTTP_INTERNAL_SERVER_ERROR; -+ } - access_status = OK; - } - else if (r->proxyreq == PROXYREQ_PROXY) { -@@ -2159,7 +2173,9 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, - * regarding the Connection header in the request. - */ - apr_table_setn(r->subprocess_env, "proxy-nokeepalive", "1"); -- fix_uds_filename(r, url); -+ if (!fix_uds_filename(r, url)) { -+ return HTTP_INTERNAL_SERVER_ERROR; -+ } - } - } - } diff --git a/SOURCES/httpd-2.4.37-CVE-2021-44224.patch b/SOURCES/httpd-2.4.37-CVE-2021-44224.patch deleted file mode 100644 index d3633fc..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2021-44224.patch +++ /dev/null @@ -1,315 +0,0 @@ -diff --git a/include/http_protocol.h b/include/http_protocol.h -index e7abdd9..e1572dc 100644 ---- a/include/http_protocol.h -+++ b/include/http_protocol.h -@@ -96,6 +96,13 @@ AP_DECLARE(void) ap_get_mime_headers(request_rec *r); - AP_DECLARE(void) ap_get_mime_headers_core(request_rec *r, - apr_bucket_brigade *bb); - -+/** -+ * Run post_read_request hook and validate. -+ * @param r The current request -+ * @return OK or HTTP_... -+ */ -+AP_DECLARE(int) ap_post_read_request(request_rec *r); -+ - /* Finish up stuff after a request */ - - /** -diff --git a/modules/http/http_request.c b/modules/http/http_request.c -index 9e7c4db..e873aab 100644 ---- a/modules/http/http_request.c -+++ b/modules/http/http_request.c -@@ -681,7 +681,7 @@ static request_rec *internal_internal_redirect(const char *new_uri, - * to do their thing on internal redirects as well. Perhaps this is a - * misnamed function. - */ -- if ((access_status = ap_run_post_read_request(new))) { -+ if ((access_status = ap_post_read_request(new))) { - ap_die(access_status, new); - return NULL; - } -diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c -index 6a9ef55..a6df1b8 100644 ---- a/modules/proxy/mod_proxy.c -+++ b/modules/proxy/mod_proxy.c -@@ -584,11 +584,12 @@ static int proxy_detect(request_rec *r) - - if (conf->req && r->parsed_uri.scheme) { - /* but it might be something vhosted */ -- if (!(r->parsed_uri.hostname -- && !strcasecmp(r->parsed_uri.scheme, ap_http_scheme(r)) -- && ap_matches_request_vhost(r, r->parsed_uri.hostname, -- (apr_port_t)(r->parsed_uri.port_str ? r->parsed_uri.port -- : ap_default_port(r))))) { -+ if (!r->parsed_uri.hostname -+ || ap_cstr_casecmp(r->parsed_uri.scheme, ap_http_scheme(r)) != 0 -+ || !ap_matches_request_vhost(r, r->parsed_uri.hostname, -+ (apr_port_t)(r->parsed_uri.port_str -+ ? r->parsed_uri.port -+ : ap_default_port(r)))) { - r->proxyreq = PROXYREQ_PROXY; - r->uri = r->unparsed_uri; - r->filename = apr_pstrcat(r->pool, "proxy:", r->uri, NULL); -@@ -1750,6 +1751,7 @@ static const char * - struct proxy_alias *new; - char *f = cmd->path; - char *r = NULL; -+ const char *real; - char *word; - apr_table_t *params = apr_table_make(cmd->pool, 5); - const apr_array_header_t *arr; -@@ -1815,6 +1817,10 @@ static const char * - if (r == NULL) { - return "ProxyPass|ProxyPassMatch needs a path when not defined in a location"; - } -+ if (!(real = ap_proxy_de_socketfy(cmd->temp_pool, r))) { -+ return "ProxyPass|ProxyPassMatch uses an invalid \"unix:\" URL"; -+ } -+ - - /* if per directory, save away the single alias */ - if (cmd->path) { -@@ -1831,7 +1837,7 @@ static const char * - } - - new->fake = apr_pstrdup(cmd->pool, f); -- new->real = apr_pstrdup(cmd->pool, ap_proxy_de_socketfy(cmd->pool, r)); -+ new->real = apr_pstrdup(cmd->pool, real); - new->flags = flags; - if (use_regex) { - new->regex = ap_pregcomp(cmd->pool, f, AP_REG_EXTENDED); -@@ -2316,6 +2322,7 @@ static const char *add_member(cmd_parms *cmd, void *dummy, const char *arg) - proxy_worker *worker; - char *path = cmd->path; - char *name = NULL; -+ const char *real; - char *word; - apr_table_t *params = apr_table_make(cmd->pool, 5); - const apr_array_header_t *arr; -@@ -2356,6 +2363,9 @@ static const char *add_member(cmd_parms *cmd, void *dummy, const char *arg) - return "BalancerMember must define balancer name when outside section"; - if (!name) - return "BalancerMember must define remote proxy server"; -+ if (!(real = ap_proxy_de_socketfy(cmd->temp_pool, name))) { -+ return "BalancerMember uses an invalid \"unix:\" URL"; -+ } - - ap_str_tolower(path); /* lowercase scheme://hostname */ - -@@ -2368,7 +2378,7 @@ static const char *add_member(cmd_parms *cmd, void *dummy, const char *arg) - } - - /* Try to find existing worker */ -- worker = ap_proxy_get_worker(cmd->temp_pool, balancer, conf, ap_proxy_de_socketfy(cmd->temp_pool, name)); -+ worker = ap_proxy_get_worker(cmd->temp_pool, balancer, conf, real); - if (!worker) { - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, cmd->server, APLOGNO(01147) - "Defining worker '%s' for balancer '%s'", -@@ -2457,7 +2467,13 @@ static const char * - } - } - else { -- worker = ap_proxy_get_worker(cmd->temp_pool, NULL, conf, ap_proxy_de_socketfy(cmd->temp_pool, name)); -+ const char *real; -+ -+ if (!(real = ap_proxy_de_socketfy(cmd->temp_pool, name))) { -+ return "ProxySet uses an invalid \"unix:\" URL"; -+ } -+ -+ worker = ap_proxy_get_worker(cmd->temp_pool, NULL, conf, real); - if (!worker) { - if (in_proxy_section) { - err = ap_proxy_define_worker(cmd->pool, &worker, NULL, -@@ -2599,8 +2615,14 @@ static const char *proxysection(cmd_parms *cmd, void *mconfig, const char *arg) - } - } - else { -+ const char *real; -+ -+ if (!(real = ap_proxy_de_socketfy(cmd->temp_pool, conf->p))) { -+ return " uses an invalid \"unix:\" URL"; -+ } -+ - worker = ap_proxy_get_worker(cmd->temp_pool, NULL, sconf, -- ap_proxy_de_socketfy(cmd->temp_pool, (char*)conf->p)); -+ real); - if (!worker) { - err = ap_proxy_define_worker(cmd->pool, &worker, NULL, - sconf, conf->p, 0); -diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h -index fbbd508..dca6f69 100644 ---- a/modules/proxy/mod_proxy.h -+++ b/modules/proxy/mod_proxy.h -@@ -713,6 +713,8 @@ typedef __declspec(dllimport) const char * - proxy_dir_conf *, const char *); - #endif - -+#define AP_PROXY_WORKER_NO_UDS (1u << 3) -+ - - /* Connection pool API */ - /** -@@ -725,6 +727,24 @@ typedef __declspec(dllimport) const char * - PROXY_DECLARE(char *) ap_proxy_worker_name(apr_pool_t *p, - proxy_worker *worker); - -+ -+/** -+ * Get the worker from proxy configuration, looking for either PREFIXED or -+ * MATCHED or both types of workers according to given mask -+ * @param p memory pool used for finding worker -+ * @param balancer the balancer that the worker belongs to -+ * @param conf current proxy server configuration -+ * @param url url to find the worker from -+ * @param mask bitmask of AP_PROXY_WORKER_IS_* -+ * @return proxy_worker or NULL if not found -+ */ -+PROXY_DECLARE(proxy_worker *) ap_proxy_get_worker_ex(apr_pool_t *p, -+ proxy_balancer *balancer, -+ proxy_server_conf *conf, -+ const char *url, -+ unsigned int mask); -+ -+ - /** - * Get the worker from proxy configuration - * @param p memory pool used for finding worker -@@ -737,6 +757,8 @@ PROXY_DECLARE(proxy_worker *) ap_proxy_get_worker(apr_pool_t *p, - proxy_balancer *balancer, - proxy_server_conf *conf, - const char *url); -+ -+ - /** - * Define and Allocate space for the worker to proxy configuration - * @param p memory pool to allocate worker from -diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c -index 032e0c4..3d5b220 100644 ---- a/modules/proxy/proxy_util.c -+++ b/modules/proxy/proxy_util.c -@@ -1643,10 +1643,11 @@ PROXY_DECLARE(char *) ap_proxy_worker_name(apr_pool_t *p, - return apr_pstrcat(p, "unix:", worker->s->uds_path, "|", worker->s->name, NULL); - } - --PROXY_DECLARE(proxy_worker *) ap_proxy_get_worker(apr_pool_t *p, -- proxy_balancer *balancer, -- proxy_server_conf *conf, -- const char *url) -+PROXY_DECLARE(proxy_worker *) ap_proxy_get_worker_ex(apr_pool_t *p, -+ proxy_balancer *balancer, -+ proxy_server_conf *conf, -+ const char *url, -+ unsigned int mask) - { - proxy_worker *worker; - proxy_worker *max_worker = NULL; -@@ -1662,7 +1663,12 @@ PROXY_DECLARE(proxy_worker *) ap_proxy_get_worker(apr_pool_t *p, - return NULL; - } - -- url = ap_proxy_de_socketfy(p, url); -+ if (!(mask & AP_PROXY_WORKER_NO_UDS)) { -+ url = ap_proxy_de_socketfy(p, url); -+ if (!url) { -+ return NULL; -+ } -+ } - - c = ap_strchr_c(url, ':'); - if (c == NULL || c[1] != '/' || c[2] != '/' || c[3] == '\0') { -@@ -1727,6 +1733,14 @@ PROXY_DECLARE(proxy_worker *) ap_proxy_get_worker(apr_pool_t *p, - return max_worker; - } - -+PROXY_DECLARE(proxy_worker *) ap_proxy_get_worker(apr_pool_t *p, -+ proxy_balancer *balancer, -+ proxy_server_conf *conf, -+ const char *url) -+{ -+ return ap_proxy_get_worker_ex(p, balancer, conf, url, 0); -+} -+ - /* - * To create a worker from scratch first we define the - * specifics of the worker; this is all local data. -@@ -2134,22 +2148,22 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, - - access_status = proxy_run_pre_request(worker, balancer, r, conf, url); - if (access_status == DECLINED && *balancer == NULL) { -- *worker = ap_proxy_get_worker(r->pool, NULL, conf, *url); -+ const int forward = (r->proxyreq == PROXYREQ_PROXY); -+ *worker = ap_proxy_get_worker_ex(r->pool, NULL, conf, *url, -+ forward ? AP_PROXY_WORKER_NO_UDS : 0); - if (*worker) { - ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, - "%s: found worker %s for %s", - (*worker)->s->scheme, (*worker)->s->name, *url); -- *balancer = NULL; -- if (!fix_uds_filename(r, url)) { -+ if (!forward && !fix_uds_filename(r, url)) { - return HTTP_INTERNAL_SERVER_ERROR; - } - access_status = OK; - } -- else if (r->proxyreq == PROXYREQ_PROXY) { -+ else if (forward) { - if (conf->forward) { - ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, - "*: found forward proxy worker for %s", *url); -- *balancer = NULL; - *worker = conf->forward; - access_status = OK; - /* -@@ -2163,8 +2177,8 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, - else if (r->proxyreq == PROXYREQ_REVERSE) { - if (conf->reverse) { - ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, -- "*: using default reverse proxy worker for %s (no keepalive)", *url); -- *balancer = NULL; -+ "*: using default reverse proxy worker for %s " -+ "(no keepalive)", *url); - *worker = conf->reverse; - access_status = OK; - /* -diff --git a/server/protocol.c b/server/protocol.c -index 430d91e..a2aa081 100644 ---- a/server/protocol.c -+++ b/server/protocol.c -@@ -1525,7 +1525,7 @@ request_rec *ap_read_request(conn_rec *conn) - /* we may have switched to another server */ - apply_server_config(r); - -- if ((access_status = ap_run_post_read_request(r))) { -+ if ((access_status = ap_post_read_request(r))) { - goto die; - } - -@@ -1582,6 +1582,27 @@ ignore: - return NULL; - } - -+AP_DECLARE(int) ap_post_read_request(request_rec *r) -+{ -+ int status; -+ -+ if ((status = ap_run_post_read_request(r))) { -+ return status; -+ } -+ -+ /* Enforce http(s) only scheme for non-forward-proxy requests */ -+ if (!r->proxyreq -+ && r->parsed_uri.scheme -+ && (ap_cstr_casecmpn(r->parsed_uri.scheme, "http", 4) != 0 -+ || (r->parsed_uri.scheme[4] != '\0' -+ && (apr_tolower(r->parsed_uri.scheme[4]) != 's' -+ || r->parsed_uri.scheme[5] != '\0')))) { -+ return HTTP_BAD_REQUEST; -+ } -+ -+ return OK; -+} -+ - /* if a request with a body creates a subrequest, remove original request's - * input headers which pertain to the body which has already been read. - * out-of-line helper function for ap_set_sub_req_protocol. diff --git a/SOURCES/httpd-2.4.37-CVE-2021-44790.patch b/SOURCES/httpd-2.4.37-CVE-2021-44790.patch deleted file mode 100644 index 4f244a8..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2021-44790.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff --git a/modules/lua/lua_request.c b/modules/lua/lua_request.c -index 77a88b4..1d8be2e 100644 ---- a/modules/lua/lua_request.c -+++ b/modules/lua/lua_request.c -@@ -376,6 +376,7 @@ static int req_parsebody(lua_State *L) - if (end == NULL) break; - key = (char *) apr_pcalloc(r->pool, 256); - filename = (char *) apr_pcalloc(r->pool, 256); -+ if (end - crlf <= 8) break; - vlen = end - crlf - 8; - buffer = (char *) apr_pcalloc(r->pool, vlen+1); - memcpy(buffer, crlf + 4, vlen); diff --git a/SOURCES/httpd-2.4.37-CVE-2022-22719.patch b/SOURCES/httpd-2.4.37-CVE-2022-22719.patch deleted file mode 100644 index 006cae3..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2022-22719.patch +++ /dev/null @@ -1,70 +0,0 @@ ---- a/modules/lua/lua_request.c 2022/03/07 14:48:54 1898693 -+++ b/modules/lua/lua_request.c 2022/03/07 14:51:19 1898694 -@@ -235,14 +235,16 @@ - { - int rc = OK; - -+ *rbuf = NULL; -+ *size = 0; -+ - if ((rc = ap_setup_client_block(r, REQUEST_CHUNKED_ERROR))) { - return (rc); - } - if (ap_should_client_block(r)) { - - /*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/ -- char argsbuffer[HUGE_STRING_LEN]; -- apr_off_t rsize, len_read, rpos = 0; -+ apr_off_t len_read, rpos = 0; - apr_off_t length = r->remaining; - /*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/ - -@@ -250,18 +252,18 @@ - return APR_EINCOMPLETE; /* Only room for incomplete data chunk :( */ - } - *rbuf = (const char *) apr_pcalloc(r->pool, (apr_size_t) (length + 1)); -- *size = length; -- while ((len_read = ap_get_client_block(r, argsbuffer, sizeof(argsbuffer))) > 0) { -- if ((rpos + len_read) > length) { -- rsize = length - rpos; -- } -- else { -- rsize = len_read; -- } -- -- memcpy((char *) *rbuf + rpos, argsbuffer, (size_t) rsize); -- rpos += rsize; -+ while ((rpos < length) -+ && (len_read = ap_get_client_block(r, (char *) *rbuf + rpos, -+ length - rpos)) > 0) { -+ rpos += len_read; - } -+ if (len_read < 0) { -+ return APR_EINCOMPLETE; -+ } -+ *size = rpos; -+ } -+ else { -+ rc = DONE; - } - - return (rc); -@@ -278,6 +280,8 @@ - { - apr_status_t rc = OK; - -+ *size = 0; -+ - if ((rc = ap_setup_client_block(r, REQUEST_CHUNKED_ERROR))) - return rc; - if (ap_should_client_block(r)) { -@@ -303,6 +307,9 @@ - rpos += rsize; - } - } -+ else { -+ rc = DONE; -+ } - - return rc; - } diff --git a/SOURCES/httpd-2.4.37-CVE-2022-22720.patch b/SOURCES/httpd-2.4.37-CVE-2022-22720.patch deleted file mode 100644 index e4abca2..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2022-22720.patch +++ /dev/null @@ -1,154 +0,0 @@ -diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c -index 9828cdf..6bedcac 100644 ---- a/modules/http/http_filters.c -+++ b/modules/http/http_filters.c -@@ -1605,9 +1605,9 @@ AP_DECLARE(int) ap_map_http_request_error(apr_status_t rv, int status) - */ - AP_DECLARE(int) ap_discard_request_body(request_rec *r) - { -+ int rc = OK; -+ conn_rec *c = r->connection; - apr_bucket_brigade *bb; -- int seen_eos; -- apr_status_t rv; - - /* Sometimes we'll get in a state where the input handling has - * detected an error where we want to drop the connection, so if -@@ -1616,54 +1616,57 @@ AP_DECLARE(int) ap_discard_request_body(request_rec *r) - * - * This function is also a no-op on a subrequest. - */ -- if (r->main || r->connection->keepalive == AP_CONN_CLOSE || -- ap_status_drops_connection(r->status)) { -+ if (r->main || c->keepalive == AP_CONN_CLOSE) { -+ return OK; -+ } -+ if (ap_status_drops_connection(r->status)) { -+ c->keepalive = AP_CONN_CLOSE; - return OK; - } - - bb = apr_brigade_create(r->pool, r->connection->bucket_alloc); -- seen_eos = 0; -- do { -- apr_bucket *bucket; -+ for (;;) { -+ apr_status_t rv; - - rv = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES, - APR_BLOCK_READ, HUGE_STRING_LEN); -- - if (rv != APR_SUCCESS) { -- apr_brigade_destroy(bb); -- return ap_map_http_request_error(rv, HTTP_BAD_REQUEST); -+ rc = ap_map_http_request_error(rv, HTTP_BAD_REQUEST); -+ goto cleanup; - } - -- for (bucket = APR_BRIGADE_FIRST(bb); -- bucket != APR_BRIGADE_SENTINEL(bb); -- bucket = APR_BUCKET_NEXT(bucket)) -- { -- const char *data; -- apr_size_t len; -+ while (!APR_BRIGADE_EMPTY(bb)) { -+ apr_bucket *b = APR_BRIGADE_FIRST(bb); - -- if (APR_BUCKET_IS_EOS(bucket)) { -- seen_eos = 1; -- break; -+ if (APR_BUCKET_IS_EOS(b)) { -+ goto cleanup; - } - -- /* These are metadata buckets. */ -- if (bucket->length == 0) { -- continue; -- } -- -- /* We MUST read because in case we have an unknown-length -- * bucket or one that morphs, we want to exhaust it. -+ /* There is no need to read empty or metadata buckets or -+ * buckets of known length, but we MUST read buckets of -+ * unknown length in order to exhaust them. - */ -- rv = apr_bucket_read(bucket, &data, &len, APR_BLOCK_READ); -+ if (b->length == (apr_size_t)-1) { -+ apr_size_t len; -+ const char *data; -+ -+ rv = apr_bucket_read(b, &data, &len, APR_BLOCK_READ); - if (rv != APR_SUCCESS) { -- apr_brigade_destroy(bb); -- return HTTP_BAD_REQUEST; -+ rc = HTTP_BAD_REQUEST; -+ goto cleanup; - } - } -- apr_brigade_cleanup(bb); -- } while (!seen_eos); - -- return OK; -+ apr_bucket_delete(b); -+ } -+ } -+ -+cleanup: -+ apr_brigade_cleanup(bb); -+ if (rc != OK) { -+ c->keepalive = AP_CONN_CLOSE; -+ } -+ return rc; - } - - /* Here we deal with getting the request message body from the client. -diff --git a/server/protocol.c b/server/protocol.c -index a2aa081..a554970 100644 ---- a/server/protocol.c -+++ b/server/protocol.c -@@ -1666,23 +1666,29 @@ AP_DECLARE(void) ap_set_sub_req_protocol(request_rec *rnew, - rnew->main = (request_rec *) r; - } - --static void end_output_stream(request_rec *r) -+static void end_output_stream(request_rec *r, int status) - { - conn_rec *c = r->connection; - apr_bucket_brigade *bb; - apr_bucket *b; - - bb = apr_brigade_create(r->pool, c->bucket_alloc); -+ if (status != OK) { -+ b = ap_bucket_error_create(status, NULL, r->pool, c->bucket_alloc); -+ APR_BRIGADE_INSERT_TAIL(bb, b); -+ } - b = apr_bucket_eos_create(c->bucket_alloc); - APR_BRIGADE_INSERT_TAIL(bb, b); -+ - ap_pass_brigade(r->output_filters, bb); -+ apr_brigade_cleanup(bb); - } - - AP_DECLARE(void) ap_finalize_sub_req_protocol(request_rec *sub) - { - /* tell the filter chain there is no more content coming */ - if (!sub->eos_sent) { -- end_output_stream(sub); -+ end_output_stream(sub, OK); - } - } - -@@ -1693,11 +1699,11 @@ AP_DECLARE(void) ap_finalize_sub_req_protocol(request_rec *sub) - */ - AP_DECLARE(void) ap_finalize_request_protocol(request_rec *r) - { -- (void) ap_discard_request_body(r); -+ int status = ap_discard_request_body(r); - - /* tell the filter chain there is no more content coming */ - if (!r->eos_sent) { -- end_output_stream(r); -+ end_output_stream(r, status); - } - } - diff --git a/SOURCES/httpd-2.4.37-CVE-2022-22721.patch b/SOURCES/httpd-2.4.37-CVE-2022-22721.patch deleted file mode 100644 index 3985adb..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2022-22721.patch +++ /dev/null @@ -1,103 +0,0 @@ -diff --git a/docs/manual/mod/core.html.en b/docs/manual/mod/core.html.en -index 20d1e5a..e1ec8d0 100644 ---- a/docs/manual/mod/core.html.en -+++ b/docs/manual/mod/core.html.en -@@ -2935,12 +2935,19 @@ from the client - - -
    Description:Determines whether trailers are merged into headers
    Status:Core
    Module:core
    --

    Limit (in bytes) on maximum size of an XML-based request -- body. A value of 0 will disable any checking.

    -+

    Limit (in bytes) on the maximum size of an XML-based request -+ body. A value of 0 will apply a hard limit (depending on -+ 32bit vs 64bit system) allowing for XML escaping within the bounds of -+ the system addressable memory, but it exists for compatibility only -+ and is not recommended since it does not account for memory consumed -+ elsewhere or concurrent requests, which might result in an overall -+ system out-of-memory. -+

    - -

    Example:

    - --
    LimitXMLRequestBody 0
    -+
    # Limit of 1 MiB
    -+    LimitXMLRequestBody 1073741824
    - - - -diff --git a/server/core.c b/server/core.c -index e32613d..8abfa65 100644 ---- a/server/core.c -+++ b/server/core.c -@@ -70,6 +70,8 @@ - /* LimitXMLRequestBody handling */ - #define AP_LIMIT_UNSET ((long) -1) - #define AP_DEFAULT_LIMIT_XML_BODY ((apr_size_t)1000000) -+/* Hard limit for ap_escape_html2() */ -+#define AP_MAX_LIMIT_XML_BODY ((apr_size_t)(APR_SIZE_MAX / 6 - 1)) - - #define AP_MIN_SENDFILE_BYTES (256) - -@@ -3689,6 +3691,11 @@ static const char *set_limit_xml_req_body(cmd_parms *cmd, void *conf_, - if (conf->limit_xml_body < 0) - return "LimitXMLRequestBody requires a non-negative integer."; - -+ /* zero is AP_MAX_LIMIT_XML_BODY (implicitly) */ -+ if ((apr_size_t)conf->limit_xml_body > AP_MAX_LIMIT_XML_BODY) -+ return apr_psprintf(cmd->pool, "LimitXMLRequestBody must not exceed " -+ "%" APR_SIZE_T_FMT, AP_MAX_LIMIT_XML_BODY); -+ - return NULL; - } - -@@ -3777,6 +3784,8 @@ AP_DECLARE(apr_size_t) ap_get_limit_xml_body(const request_rec *r) - conf = ap_get_core_module_config(r->per_dir_config); - if (conf->limit_xml_body == AP_LIMIT_UNSET) - return AP_DEFAULT_LIMIT_XML_BODY; -+ if (conf->limit_xml_body == 0) -+ return AP_MAX_LIMIT_XML_BODY; - - return (apr_size_t)conf->limit_xml_body; - } -diff --git a/server/util.c b/server/util.c -index 2a5dd04..eefdafa 100644 ---- a/server/util.c -+++ b/server/util.c -@@ -2037,11 +2037,14 @@ AP_DECLARE(char *) ap_escape_urlencoded(apr_pool_t *p, const char *buffer) - - AP_DECLARE(char *) ap_escape_html2(apr_pool_t *p, const char *s, int toasc) - { -- int i, j; -+ apr_size_t i, j; - char *x; - - /* first, count the number of extra characters */ -- for (i = 0, j = 0; s[i] != '\0'; i++) -+ for (i = 0, j = 0; s[i] != '\0'; i++) { -+ if (i + j > APR_SIZE_MAX - 6) { -+ abort(); -+ } - if (s[i] == '<' || s[i] == '>') - j += 3; - else if (s[i] == '&') -@@ -2050,6 +2053,7 @@ AP_DECLARE(char *) ap_escape_html2(apr_pool_t *p, const char *s, int toasc) - j += 5; - else if (toasc && !apr_isascii(s[i])) - j += 5; -+ } - - if (j == 0) - return apr_pstrmemdup(p, s, i); -diff --git a/server/util_xml.c b/server/util_xml.c -index 4845194..22806fa 100644 ---- a/server/util_xml.c -+++ b/server/util_xml.c -@@ -85,7 +85,7 @@ AP_DECLARE(int) ap_xml_parse_input(request_rec * r, apr_xml_doc **pdoc) - } - - total_read += len; -- if (limit_xml_body && total_read > limit_xml_body) { -+ if (total_read > limit_xml_body) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(00539) - "XML request body is larger than the configured " - "limit of %lu", (unsigned long)limit_xml_body); diff --git a/SOURCES/httpd-2.4.37-CVE-2022-23943.patch b/SOURCES/httpd-2.4.37-CVE-2022-23943.patch deleted file mode 100644 index 0383d2f..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2022-23943.patch +++ /dev/null @@ -1,377 +0,0 @@ -diff --git a/modules/filters/libsed.h b/modules/filters/libsed.h -index 76cbc0c..0256b1e 100644 ---- a/modules/filters/libsed.h -+++ b/modules/filters/libsed.h -@@ -60,7 +60,7 @@ struct sed_label_s { - }; - - typedef apr_status_t (sed_err_fn_t)(void *data, const char *error); --typedef apr_status_t (sed_write_fn_t)(void *ctx, char *buf, int sz); -+typedef apr_status_t (sed_write_fn_t)(void *ctx, char *buf, apr_size_t sz); - - typedef struct sed_commands_s sed_commands_t; - #define NWFILES 11 /* 10 plus one for standard output */ -@@ -69,7 +69,7 @@ struct sed_commands_s { - sed_err_fn_t *errfn; - void *data; - -- unsigned lsize; -+ apr_size_t lsize; - char *linebuf; - char *lbend; - const char *saveq; -@@ -116,15 +116,15 @@ struct sed_eval_s { - apr_int64_t lnum; - void *fout; - -- unsigned lsize; -+ apr_size_t lsize; - char *linebuf; - char *lspend; - -- unsigned hsize; -+ apr_size_t hsize; - char *holdbuf; - char *hspend; - -- unsigned gsize; -+ apr_size_t gsize; - char *genbuf; - char *lcomend; - -@@ -160,7 +160,7 @@ apr_status_t sed_init_eval(sed_eval_t *eval, sed_commands_t *commands, - sed_err_fn_t *errfn, void *data, - sed_write_fn_t *writefn, apr_pool_t *p); - apr_status_t sed_reset_eval(sed_eval_t *eval, sed_commands_t *commands, sed_err_fn_t *errfn, void *data); --apr_status_t sed_eval_buffer(sed_eval_t *eval, const char *buf, int bufsz, void *fout); -+apr_status_t sed_eval_buffer(sed_eval_t *eval, const char *buf, apr_size_t bufsz, void *fout); - apr_status_t sed_eval_file(sed_eval_t *eval, apr_file_t *fin, void *fout); - apr_status_t sed_finalize_eval(sed_eval_t *eval, void *f); - void sed_destroy_eval(sed_eval_t *eval); -diff --git a/modules/filters/mod_sed.c b/modules/filters/mod_sed.c -index 346c210..8595e41 100644 ---- a/modules/filters/mod_sed.c -+++ b/modules/filters/mod_sed.c -@@ -51,7 +51,7 @@ typedef struct sed_filter_ctxt - apr_bucket_brigade *bbinp; - char *outbuf; - char *curoutbuf; -- int bufsize; -+ apr_size_t bufsize; - apr_pool_t *tpool; - int numbuckets; - } sed_filter_ctxt; -@@ -100,7 +100,7 @@ static void alloc_outbuf(sed_filter_ctxt* ctx) - /* append_bucket - * Allocate a new bucket from buf and sz and append to ctx->bb - */ --static apr_status_t append_bucket(sed_filter_ctxt* ctx, char* buf, int sz) -+static apr_status_t append_bucket(sed_filter_ctxt* ctx, char* buf, apr_size_t sz) - { - apr_status_t status = APR_SUCCESS; - apr_bucket *b; -@@ -133,7 +133,7 @@ static apr_status_t append_bucket(sed_filter_ctxt* ctx, char* buf, int sz) - */ - static apr_status_t flush_output_buffer(sed_filter_ctxt *ctx) - { -- int size = ctx->curoutbuf - ctx->outbuf; -+ apr_size_t size = ctx->curoutbuf - ctx->outbuf; - char *out; - apr_status_t status = APR_SUCCESS; - if ((ctx->outbuf == NULL) || (size <=0)) -@@ -147,12 +147,12 @@ static apr_status_t flush_output_buffer(sed_filter_ctxt *ctx) - /* This is a call back function. When libsed wants to generate the output, - * this function will be invoked. - */ --static apr_status_t sed_write_output(void *dummy, char *buf, int sz) -+static apr_status_t sed_write_output(void *dummy, char *buf, apr_size_t sz) - { - /* dummy is basically filter context. Context is passed during invocation - * of sed_eval_buffer - */ -- int remainbytes = 0; -+ apr_size_t remainbytes = 0; - apr_status_t status = APR_SUCCESS; - sed_filter_ctxt *ctx = (sed_filter_ctxt *) dummy; - if (ctx->outbuf == NULL) { -@@ -168,21 +168,29 @@ static apr_status_t sed_write_output(void *dummy, char *buf, int sz) - } - /* buffer is now full */ - status = append_bucket(ctx, ctx->outbuf, ctx->bufsize); -- /* old buffer is now used so allocate new buffer */ -- alloc_outbuf(ctx); -- /* if size is bigger than the allocated buffer directly add to output -- * brigade */ -- if ((status == APR_SUCCESS) && (sz >= ctx->bufsize)) { -- char* newbuf = apr_pmemdup(ctx->tpool, buf, sz); -- status = append_bucket(ctx, newbuf, sz); -- /* pool might get clear after append_bucket */ -- if (ctx->outbuf == NULL) { -+ if (status == APR_SUCCESS) { -+ /* if size is bigger than the allocated buffer directly add to output -+ * brigade */ -+ if (sz >= ctx->bufsize) { -+ char* newbuf = apr_pmemdup(ctx->tpool, buf, sz); -+ status = append_bucket(ctx, newbuf, sz); -+ if (status == APR_SUCCESS) { -+ /* old buffer is now used so allocate new buffer */ -+ alloc_outbuf(ctx); -+ } -+ else { -+ clear_ctxpool(ctx); -+ } -+ } -+ else { -+ /* old buffer is now used so allocate new buffer */ - alloc_outbuf(ctx); -+ memcpy(ctx->curoutbuf, buf, sz); -+ ctx->curoutbuf += sz; - } - } - else { -- memcpy(ctx->curoutbuf, buf, sz); -- ctx->curoutbuf += sz; -+ clear_ctxpool(ctx); - } - } - else { -diff --git a/modules/filters/sed1.c b/modules/filters/sed1.c -index be03506..67a8d06 100644 ---- a/modules/filters/sed1.c -+++ b/modules/filters/sed1.c -@@ -71,7 +71,7 @@ static apr_status_t dosub(sed_eval_t *eval, char *rhsbuf, int n, - static char *place(sed_eval_t *eval, char *asp, char *al1, char *al2); - static apr_status_t command(sed_eval_t *eval, sed_reptr_t *ipc, - step_vars_storage *step_vars); --static apr_status_t wline(sed_eval_t *eval, char *buf, int sz); -+static apr_status_t wline(sed_eval_t *eval, char *buf, apr_size_t sz); - static apr_status_t arout(sed_eval_t *eval); - - static void eval_errf(sed_eval_t *eval, const char *fmt, ...) -@@ -92,11 +92,11 @@ static void eval_errf(sed_eval_t *eval, const char *fmt, ...) - * grow_buffer - */ - static void grow_buffer(apr_pool_t *pool, char **buffer, -- char **spend, unsigned int *cursize, -- unsigned int newsize) -+ char **spend, apr_size_t *cursize, -+ apr_size_t newsize) - { - char* newbuffer = NULL; -- int spendsize = 0; -+ apr_size_t spendsize = 0; - if (*cursize >= newsize) - return; - /* Avoid number of times realloc is called. It could cause huge memory -@@ -124,7 +124,7 @@ static void grow_buffer(apr_pool_t *pool, char **buffer, - /* - * grow_line_buffer - */ --static void grow_line_buffer(sed_eval_t *eval, int newsize) -+static void grow_line_buffer(sed_eval_t *eval, apr_size_t newsize) - { - grow_buffer(eval->pool, &eval->linebuf, &eval->lspend, - &eval->lsize, newsize); -@@ -133,7 +133,7 @@ static void grow_line_buffer(sed_eval_t *eval, int newsize) - /* - * grow_hold_buffer - */ --static void grow_hold_buffer(sed_eval_t *eval, int newsize) -+static void grow_hold_buffer(sed_eval_t *eval, apr_size_t newsize) - { - grow_buffer(eval->pool, &eval->holdbuf, &eval->hspend, - &eval->hsize, newsize); -@@ -142,7 +142,7 @@ static void grow_hold_buffer(sed_eval_t *eval, int newsize) - /* - * grow_gen_buffer - */ --static void grow_gen_buffer(sed_eval_t *eval, int newsize, -+static void grow_gen_buffer(sed_eval_t *eval, apr_size_t newsize, - char **gspend) - { - if (gspend == NULL) { -@@ -156,9 +156,9 @@ static void grow_gen_buffer(sed_eval_t *eval, int newsize, - /* - * appendmem_to_linebuf - */ --static void appendmem_to_linebuf(sed_eval_t *eval, const char* sz, int len) -+static void appendmem_to_linebuf(sed_eval_t *eval, const char* sz, apr_size_t len) - { -- unsigned int reqsize = (eval->lspend - eval->linebuf) + len; -+ apr_size_t reqsize = (eval->lspend - eval->linebuf) + len; - if (eval->lsize < reqsize) { - grow_line_buffer(eval, reqsize); - } -@@ -169,21 +169,36 @@ static void appendmem_to_linebuf(sed_eval_t *eval, const char* sz, int len) - /* - * append_to_linebuf - */ --static void append_to_linebuf(sed_eval_t *eval, const char* sz) -+static void append_to_linebuf(sed_eval_t *eval, const char* sz, -+ step_vars_storage *step_vars) - { -- int len = strlen(sz); -+ apr_size_t len = strlen(sz); -+ char *old_linebuf = eval->linebuf; - /* Copy string including null character */ - appendmem_to_linebuf(eval, sz, len + 1); - --eval->lspend; /* lspend will now point to NULL character */ -+ /* Sync step_vars after a possible linebuf expansion */ -+ if (step_vars && old_linebuf != eval->linebuf) { -+ if (step_vars->loc1) { -+ step_vars->loc1 = step_vars->loc1 - old_linebuf + eval->linebuf; -+ } -+ if (step_vars->loc2) { -+ step_vars->loc2 = step_vars->loc2 - old_linebuf + eval->linebuf; -+ } -+ if (step_vars->locs) { -+ step_vars->locs = step_vars->locs - old_linebuf + eval->linebuf; -+ } -+ } - } - - /* - * copy_to_linebuf - */ --static void copy_to_linebuf(sed_eval_t *eval, const char* sz) -+static void copy_to_linebuf(sed_eval_t *eval, const char* sz, -+ step_vars_storage *step_vars) - { - eval->lspend = eval->linebuf; -- append_to_linebuf(eval, sz); -+ append_to_linebuf(eval, sz, step_vars); - } - - /* -@@ -191,8 +206,8 @@ static void copy_to_linebuf(sed_eval_t *eval, const char* sz) - */ - static void append_to_holdbuf(sed_eval_t *eval, const char* sz) - { -- int len = strlen(sz); -- unsigned int reqsize = (eval->hspend - eval->holdbuf) + len + 1; -+ apr_size_t len = strlen(sz); -+ apr_size_t reqsize = (eval->hspend - eval->holdbuf) + len + 1; - if (eval->hsize <= reqsize) { - grow_hold_buffer(eval, reqsize); - } -@@ -215,8 +230,8 @@ static void copy_to_holdbuf(sed_eval_t *eval, const char* sz) - */ - static void append_to_genbuf(sed_eval_t *eval, const char* sz, char **gspend) - { -- int len = strlen(sz); -- unsigned int reqsize = (*gspend - eval->genbuf) + len + 1; -+ apr_size_t len = strlen(sz); -+ apr_size_t reqsize = (*gspend - eval->genbuf) + len + 1; - if (eval->gsize < reqsize) { - grow_gen_buffer(eval, reqsize, gspend); - } -@@ -230,8 +245,8 @@ static void append_to_genbuf(sed_eval_t *eval, const char* sz, char **gspend) - */ - static void copy_to_genbuf(sed_eval_t *eval, const char* sz) - { -- int len = strlen(sz); -- unsigned int reqsize = len + 1; -+ apr_size_t len = strlen(sz); -+ apr_size_t reqsize = len + 1; - if (eval->gsize < reqsize) { - grow_gen_buffer(eval, reqsize, NULL); - } -@@ -353,7 +368,7 @@ apr_status_t sed_eval_file(sed_eval_t *eval, apr_file_t *fin, void *fout) - /* - * sed_eval_buffer - */ --apr_status_t sed_eval_buffer(sed_eval_t *eval, const char *buf, int bufsz, void *fout) -+apr_status_t sed_eval_buffer(sed_eval_t *eval, const char *buf, apr_size_t bufsz, void *fout) - { - apr_status_t rv; - -@@ -383,7 +398,7 @@ apr_status_t sed_eval_buffer(sed_eval_t *eval, const char *buf, int bufsz, void - - while (bufsz) { - char *n; -- int llen; -+ apr_size_t llen; - - n = memchr(buf, '\n', bufsz); - if (n == NULL) -@@ -442,7 +457,7 @@ apr_status_t sed_finalize_eval(sed_eval_t *eval, void *fout) - * buffer is not a newline. - */ - /* Assure space for NULL */ -- append_to_linebuf(eval, ""); -+ append_to_linebuf(eval, "", NULL); - } - - *eval->lspend = '\0'; -@@ -666,7 +681,7 @@ static apr_status_t dosub(sed_eval_t *eval, char *rhsbuf, int n, - lp = step_vars->loc2; - step_vars->loc2 = sp - eval->genbuf + eval->linebuf; - append_to_genbuf(eval, lp, &sp); -- copy_to_linebuf(eval, eval->genbuf); -+ copy_to_linebuf(eval, eval->genbuf, step_vars); - return rv; - } - -@@ -676,8 +691,8 @@ static apr_status_t dosub(sed_eval_t *eval, char *rhsbuf, int n, - static char *place(sed_eval_t *eval, char *asp, char *al1, char *al2) - { - char *sp = asp; -- int n = al2 - al1; -- unsigned int reqsize = (sp - eval->genbuf) + n + 1; -+ apr_size_t n = al2 - al1; -+ apr_size_t reqsize = (sp - eval->genbuf) + n + 1; - - if (eval->gsize < reqsize) { - grow_gen_buffer(eval, reqsize, &sp); -@@ -735,7 +750,7 @@ static apr_status_t command(sed_eval_t *eval, sed_reptr_t *ipc, - } - - p1++; -- copy_to_linebuf(eval, p1); -+ copy_to_linebuf(eval, p1, step_vars); - eval->jflag++; - break; - -@@ -745,12 +760,12 @@ static apr_status_t command(sed_eval_t *eval, sed_reptr_t *ipc, - break; - - case GCOM: -- copy_to_linebuf(eval, eval->holdbuf); -+ copy_to_linebuf(eval, eval->holdbuf, step_vars); - break; - - case CGCOM: -- append_to_linebuf(eval, "\n"); -- append_to_linebuf(eval, eval->holdbuf); -+ append_to_linebuf(eval, "\n", step_vars); -+ append_to_linebuf(eval, eval->holdbuf, step_vars); - break; - - case HCOM: -@@ -881,7 +896,7 @@ static apr_status_t command(sed_eval_t *eval, sed_reptr_t *ipc, - if (rv != APR_SUCCESS) - return rv; - } -- append_to_linebuf(eval, "\n"); -+ append_to_linebuf(eval, "\n", step_vars); - eval->pending = ipc->next; - break; - -@@ -956,7 +971,7 @@ static apr_status_t command(sed_eval_t *eval, sed_reptr_t *ipc, - - case XCOM: - copy_to_genbuf(eval, eval->linebuf); -- copy_to_linebuf(eval, eval->holdbuf); -+ copy_to_linebuf(eval, eval->holdbuf, step_vars); - copy_to_holdbuf(eval, eval->genbuf); - break; - -@@ -1013,7 +1028,7 @@ static apr_status_t arout(sed_eval_t *eval) - /* - * wline - */ --static apr_status_t wline(sed_eval_t *eval, char *buf, int sz) -+static apr_status_t wline(sed_eval_t *eval, char *buf, apr_size_t sz) - { - apr_status_t rv = APR_SUCCESS; - rv = eval->writefn(eval->fout, buf, sz); diff --git a/SOURCES/httpd-2.4.37-CVE-2022-26377.patch b/SOURCES/httpd-2.4.37-CVE-2022-26377.patch deleted file mode 100644 index d954758..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2022-26377.patch +++ /dev/null @@ -1,26 +0,0 @@ -diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c -index 6faabea..058b03f 100644 ---- a/modules/proxy/mod_proxy_ajp.c -+++ b/modules/proxy/mod_proxy_ajp.c -@@ -249,9 +249,18 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r, - /* read the first bloc of data */ - input_brigade = apr_brigade_create(p, r->connection->bucket_alloc); - tenc = apr_table_get(r->headers_in, "Transfer-Encoding"); -- if (tenc && (strcasecmp(tenc, "chunked") == 0)) { -- /* The AJP protocol does not want body data yet */ -- ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(00870) "request is chunked"); -+ if (tenc) { -+ if (ap_cstr_casecmp(tenc, "chunked") == 0) { -+ /* The AJP protocol does not want body data yet */ -+ ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(00870) -+ "request is chunked"); -+ } -+ else { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10396) -+ "%s Transfer-Encoding is not supported", -+ tenc); -+ return HTTP_INTERNAL_SERVER_ERROR; -+ } - } else { - /* Get client provided Content-Length header */ - content_length = get_content_length(r); diff --git a/SOURCES/httpd-2.4.37-CVE-2022-28614.patch b/SOURCES/httpd-2.4.37-CVE-2022-28614.patch deleted file mode 100644 index 3860dbe..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2022-28614.patch +++ /dev/null @@ -1,47 +0,0 @@ -diff --git a/include/http_protocol.h b/include/http_protocol.h -index e1572dc..8ed77ac 100644 ---- a/include/http_protocol.h -+++ b/include/http_protocol.h -@@ -439,7 +439,27 @@ AP_DECLARE(int) ap_rwrite(const void *buf, int nbyte, request_rec *r); - */ - static APR_INLINE int ap_rputs(const char *str, request_rec *r) - { -- return ap_rwrite(str, (int)strlen(str), r); -+ apr_size_t len; -+ -+ len = strlen(str); -+ -+ for (;;) { -+ if (len <= INT_MAX) { -+ return ap_rwrite(str, (int)len, r); -+ } -+ else { -+ int rc; -+ -+ rc = ap_rwrite(str, INT_MAX, r); -+ if (rc < 0) { -+ return rc; -+ } -+ else { -+ str += INT_MAX; -+ len -= INT_MAX; -+ } -+ } -+ } - } - - /** -diff --git a/server/protocol.c b/server/protocol.c -index a554970..ea461a2 100644 ---- a/server/protocol.c -+++ b/server/protocol.c -@@ -2107,6 +2107,9 @@ AP_DECLARE(int) ap_rputc(int c, request_rec *r) - - AP_DECLARE(int) ap_rwrite(const void *buf, int nbyte, request_rec *r) - { -+ if (nbyte < 0) -+ return -1; -+ - if (r->connection->aborted) - return -1; - diff --git a/SOURCES/httpd-2.4.37-CVE-2022-28615.patch b/SOURCES/httpd-2.4.37-CVE-2022-28615.patch deleted file mode 100644 index 575f4a3..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2022-28615.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff --git a/server/util.c b/server/util.c -index eefdafa..45051b7 100644 ---- a/server/util.c -+++ b/server/util.c -@@ -186,7 +186,7 @@ AP_DECLARE(char *) ap_ht_time(apr_pool_t *p, apr_time_t t, const char *fmt, - */ - AP_DECLARE(int) ap_strcmp_match(const char *str, const char *expected) - { -- int x, y; -+ apr_size_t x, y; - - for (x = 0, y = 0; expected[y]; ++y, ++x) { - if ((!str[x]) && (expected[y] != '*')) -@@ -210,7 +210,7 @@ AP_DECLARE(int) ap_strcmp_match(const char *str, const char *expected) - - AP_DECLARE(int) ap_strcasecmp_match(const char *str, const char *expected) - { -- int x, y; -+ apr_size_t x, y; - - for (x = 0, y = 0; expected[y]; ++y, ++x) { - if (!str[x] && expected[y] != '*') diff --git a/SOURCES/httpd-2.4.37-CVE-2022-29404.patch b/SOURCES/httpd-2.4.37-CVE-2022-29404.patch deleted file mode 100644 index 08d0b7b..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2022-29404.patch +++ /dev/null @@ -1,90 +0,0 @@ -diff --git a/docs/manual/mod/core.html.en b/docs/manual/mod/core.html.en -index e1ec8d0..833fa7b 100644 ---- a/docs/manual/mod/core.html.en -+++ b/docs/manual/mod/core.html.en -@@ -2748,16 +2748,16 @@ subrequests - Description:Restricts the total size of the HTTP request body sent - from the client - Syntax:LimitRequestBody bytes --Default:LimitRequestBody 0 -+Default:LimitRequestBody 1073741824 - Context:server config, virtual host, directory, .htaccess - Override:All - Status:Core - Module:core -+Compatibility:In Apache HTTP Server 2.4.53 and earlier, the default value -+ was 0 (unlimited) - --

    This directive specifies the number of bytes from 0 -- (meaning unlimited) to 2147483647 (2GB) that are allowed in a -- request body. See the note below for the limited applicability -- to proxy requests.

    -+

    This directive specifies the number of bytes -+ that are allowed in a request body. A value of 0 means unlimited.

    - -

    The LimitRequestBody directive allows - the user to set a limit on the allowed size of an HTTP request -@@ -2783,12 +2783,6 @@ from the client - -

    LimitRequestBody 102400
    - -- --

    For a full description of how this directive is interpreted by -- proxy requests, see the mod_proxy documentation.

    --
    -- -- -
    -
    top
    -

    LimitRequestFields Directive

    -diff --git a/docs/manual/mod/mod_proxy.html.en b/docs/manual/mod/mod_proxy.html.en -index 2cc6ace..c9e4634 100644 ---- a/docs/manual/mod/mod_proxy.html.en -+++ b/docs/manual/mod/mod_proxy.html.en -@@ -459,9 +459,6 @@ ProxyPass "/examples" "http://backend.example.com/examples" timeout=10 - Content-Length header, but the server is configured to filter incoming - request bodies.

    - --

    LimitRequestBody only applies to -- request bodies that the server will spool to disk

    -- -
    top
    -
    -

    Reverse Proxy Request Headers

    -diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c -index 6bedcac..393343a 100644 ---- a/modules/http/http_filters.c -+++ b/modules/http/http_filters.c -@@ -1710,6 +1710,7 @@ AP_DECLARE(int) ap_setup_client_block(request_rec *r, int read_policy) - { - const char *tenc = apr_table_get(r->headers_in, "Transfer-Encoding"); - const char *lenp = apr_table_get(r->headers_in, "Content-Length"); -+ apr_off_t limit_req_body = ap_get_limit_req_body(r); - - r->read_body = read_policy; - r->read_chunked = 0; -@@ -1748,6 +1749,11 @@ AP_DECLARE(int) ap_setup_client_block(request_rec *r, int read_policy) - return HTTP_REQUEST_ENTITY_TOO_LARGE; - } - -+ if (limit_req_body > 0 && (r->remaining > limit_req_body)) { -+ /* will be logged when the body is discarded */ -+ return HTTP_REQUEST_ENTITY_TOO_LARGE; -+ } -+ - #ifdef AP_DEBUG - { - /* Make sure ap_getline() didn't leave any droppings. */ -diff --git a/server/core.c b/server/core.c -index a0bfaad..6556f20 100644 ---- a/server/core.c -+++ b/server/core.c -@@ -65,7 +65,7 @@ - - /* LimitRequestBody handling */ - #define AP_LIMIT_REQ_BODY_UNSET ((apr_off_t) -1) --#define AP_DEFAULT_LIMIT_REQ_BODY ((apr_off_t) 0) -+#define AP_DEFAULT_LIMIT_REQ_BODY ((apr_off_t) 1<<30) /* 1GB */ - - /* LimitXMLRequestBody handling */ - #define AP_LIMIT_UNSET ((long) -1) diff --git a/SOURCES/httpd-2.4.37-CVE-2022-30522.patch b/SOURCES/httpd-2.4.37-CVE-2022-30522.patch deleted file mode 100644 index 92cffdc..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2022-30522.patch +++ /dev/null @@ -1,541 +0,0 @@ -diff --git a/modules/filters/mod_sed.c b/modules/filters/mod_sed.c -index 8595e41..9b99a6b 100644 ---- a/modules/filters/mod_sed.c -+++ b/modules/filters/mod_sed.c -@@ -59,7 +59,7 @@ typedef struct sed_filter_ctxt - module AP_MODULE_DECLARE_DATA sed_module; - - /* This function will be call back from libsed functions if there is any error -- * happend during execution of sed scripts -+ * happened during execution of sed scripts - */ - static apr_status_t log_sed_errf(void *data, const char *error) - { -@@ -276,7 +276,7 @@ static apr_status_t sed_response_filter(ap_filter_t *f, - apr_bucket_brigade *bb) - { - apr_bucket *b; -- apr_status_t status; -+ apr_status_t status = APR_SUCCESS; - sed_config *cfg = ap_get_module_config(f->r->per_dir_config, - &sed_module); - sed_filter_ctxt *ctx = f->ctx; -@@ -301,9 +301,9 @@ static apr_status_t sed_response_filter(ap_filter_t *f, - return status; - ctx = f->ctx; - apr_table_unset(f->r->headers_out, "Content-Length"); -- } - -- ctx->bb = apr_brigade_create(f->r->pool, f->c->bucket_alloc); -+ ctx->bb = apr_brigade_create(f->r->pool, f->c->bucket_alloc); -+ } - - /* Here is the main logic. Iterate through all the buckets, read the - * content of the bucket, call sed_eval_buffer on the data. -@@ -325,63 +325,52 @@ static apr_status_t sed_response_filter(ap_filter_t *f, - * in sed's internal buffer which can't be flushed until new line - * character is arrived. - */ -- for (b = APR_BRIGADE_FIRST(bb); b != APR_BRIGADE_SENTINEL(bb);) { -- const char *buf = NULL; -- apr_size_t bytes = 0; -+ while (!APR_BRIGADE_EMPTY(bb)) { -+ b = APR_BRIGADE_FIRST(bb); - if (APR_BUCKET_IS_EOS(b)) { -- apr_bucket *b1 = APR_BUCKET_NEXT(b); - /* Now clean up the internal sed buffer */ - sed_finalize_eval(&ctx->eval, ctx); - status = flush_output_buffer(ctx); - if (status != APR_SUCCESS) { -- clear_ctxpool(ctx); -- return status; -+ break; - } -+ /* Move the eos bucket to ctx->bb brigade */ - APR_BUCKET_REMOVE(b); -- /* Insert the eos bucket to ctx->bb brigade */ - APR_BRIGADE_INSERT_TAIL(ctx->bb, b); -- b = b1; - } - else if (APR_BUCKET_IS_FLUSH(b)) { -- apr_bucket *b1 = APR_BUCKET_NEXT(b); -- APR_BUCKET_REMOVE(b); - status = flush_output_buffer(ctx); - if (status != APR_SUCCESS) { -- clear_ctxpool(ctx); -- return status; -+ break; - } -+ /* Move the flush bucket to ctx->bb brigade */ -+ APR_BUCKET_REMOVE(b); - APR_BRIGADE_INSERT_TAIL(ctx->bb, b); -- b = b1; -- } -- else if (APR_BUCKET_IS_METADATA(b)) { -- b = APR_BUCKET_NEXT(b); - } -- else if (apr_bucket_read(b, &buf, &bytes, APR_BLOCK_READ) -- == APR_SUCCESS) { -- apr_bucket *b1 = APR_BUCKET_NEXT(b); -- status = sed_eval_buffer(&ctx->eval, buf, bytes, ctx); -- if (status != APR_SUCCESS) { -- clear_ctxpool(ctx); -- return status; -+ else { -+ if (!APR_BUCKET_IS_METADATA(b)) { -+ const char *buf = NULL; -+ apr_size_t bytes = 0; -+ -+ status = apr_bucket_read(b, &buf, &bytes, APR_BLOCK_READ); -+ if (status == APR_SUCCESS) { -+ status = sed_eval_buffer(&ctx->eval, buf, bytes, ctx); -+ } -+ if (status != APR_SUCCESS) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, status, f->r, APLOGNO(10394) "error evaluating sed on output"); -+ break; -+ } - } -- APR_BUCKET_REMOVE(b); - apr_bucket_delete(b); -- b = b1; -- } -- else { -- apr_bucket *b1 = APR_BUCKET_NEXT(b); -- APR_BUCKET_REMOVE(b); -- b = b1; - } - } -- apr_brigade_cleanup(bb); -- status = flush_output_buffer(ctx); -- if (status != APR_SUCCESS) { -- clear_ctxpool(ctx); -- return status; -+ if (status == APR_SUCCESS) { -+ status = flush_output_buffer(ctx); - } - if (!APR_BRIGADE_EMPTY(ctx->bb)) { -- status = ap_pass_brigade(f->next, ctx->bb); -+ if (status == APR_SUCCESS) { -+ status = ap_pass_brigade(f->next, ctx->bb); -+ } - apr_brigade_cleanup(ctx->bb); - } - clear_ctxpool(ctx); -@@ -432,7 +421,7 @@ static apr_status_t sed_request_filter(ap_filter_t *f, - * the buckets in bbinp and read the data from buckets and invoke - * sed_eval_buffer on the data. libsed will generate its output using - * sed_write_output which will add data in ctx->bb. Do it until it have -- * atleast one bucket in ctx->bb. At the end of data eos bucket -+ * at least one bucket in ctx->bb. At the end of data eos bucket - * should be there. - * - * Once eos bucket is seen, then invoke sed_finalize_eval to clear the -@@ -474,8 +463,10 @@ static apr_status_t sed_request_filter(ap_filter_t *f, - if (apr_bucket_read(b, &buf, &bytes, APR_BLOCK_READ) - == APR_SUCCESS) { - status = sed_eval_buffer(&ctx->eval, buf, bytes, ctx); -- if (status != APR_SUCCESS) -+ if (status != APR_SUCCESS) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, status, f->r, APLOGNO(10395) "error evaluating sed on input"); - return status; -+ } - flush_output_buffer(ctx); - } - } -diff --git a/modules/filters/sed1.c b/modules/filters/sed1.c -index 67a8d06..047f49b 100644 ---- a/modules/filters/sed1.c -+++ b/modules/filters/sed1.c -@@ -87,18 +87,20 @@ static void eval_errf(sed_eval_t *eval, const char *fmt, ...) - } - - #define INIT_BUF_SIZE 1024 -+#define MAX_BUF_SIZE 1024*8192 - - /* - * grow_buffer - */ --static void grow_buffer(apr_pool_t *pool, char **buffer, -+static apr_status_t grow_buffer(apr_pool_t *pool, char **buffer, - char **spend, apr_size_t *cursize, - apr_size_t newsize) - { - char* newbuffer = NULL; - apr_size_t spendsize = 0; -- if (*cursize >= newsize) -- return; -+ if (*cursize >= newsize) { -+ return APR_SUCCESS; -+ } - /* Avoid number of times realloc is called. It could cause huge memory - * requirement if line size is huge e.g 2 MB */ - if (newsize < *cursize * 2) { -@@ -107,6 +109,9 @@ static void grow_buffer(apr_pool_t *pool, char **buffer, - - /* Align it to 4 KB boundary */ - newsize = (newsize + ((1 << 12) - 1)) & ~((1 << 12) - 1); -+ if (newsize > MAX_BUF_SIZE) { -+ return APR_ENOMEM; -+ } - newbuffer = apr_pcalloc(pool, newsize); - if (*spend && *buffer && (*cursize > 0)) { - spendsize = *spend - *buffer; -@@ -119,63 +124,77 @@ static void grow_buffer(apr_pool_t *pool, char **buffer, - if (spend != buffer) { - *spend = *buffer + spendsize; - } -+ return APR_SUCCESS; - } - - /* - * grow_line_buffer - */ --static void grow_line_buffer(sed_eval_t *eval, apr_size_t newsize) -+static apr_status_t grow_line_buffer(sed_eval_t *eval, apr_size_t newsize) - { -- grow_buffer(eval->pool, &eval->linebuf, &eval->lspend, -+ return grow_buffer(eval->pool, &eval->linebuf, &eval->lspend, - &eval->lsize, newsize); - } - - /* - * grow_hold_buffer - */ --static void grow_hold_buffer(sed_eval_t *eval, apr_size_t newsize) -+static apr_status_t grow_hold_buffer(sed_eval_t *eval, apr_size_t newsize) - { -- grow_buffer(eval->pool, &eval->holdbuf, &eval->hspend, -+ return grow_buffer(eval->pool, &eval->holdbuf, &eval->hspend, - &eval->hsize, newsize); - } - - /* - * grow_gen_buffer - */ --static void grow_gen_buffer(sed_eval_t *eval, apr_size_t newsize, -+static apr_status_t grow_gen_buffer(sed_eval_t *eval, apr_size_t newsize, - char **gspend) - { -+ apr_status_t rc = 0; - if (gspend == NULL) { - gspend = &eval->genbuf; - } -- grow_buffer(eval->pool, &eval->genbuf, gspend, -- &eval->gsize, newsize); -- eval->lcomend = &eval->genbuf[71]; -+ rc = grow_buffer(eval->pool, &eval->genbuf, gspend, -+ &eval->gsize, newsize); -+ if (rc == APR_SUCCESS) { -+ eval->lcomend = &eval->genbuf[71]; -+ } -+ return rc; - } - - /* - * appendmem_to_linebuf - */ --static void appendmem_to_linebuf(sed_eval_t *eval, const char* sz, apr_size_t len) -+static apr_status_t appendmem_to_linebuf(sed_eval_t *eval, const char* sz, apr_size_t len) - { -+ apr_status_t rc = 0; - apr_size_t reqsize = (eval->lspend - eval->linebuf) + len; - if (eval->lsize < reqsize) { -- grow_line_buffer(eval, reqsize); -+ rc = grow_line_buffer(eval, reqsize); -+ if (rc != APR_SUCCESS) { -+ return rc; -+ } - } - memcpy(eval->lspend, sz, len); - eval->lspend += len; -+ return APR_SUCCESS; - } - - /* - * append_to_linebuf - */ --static void append_to_linebuf(sed_eval_t *eval, const char* sz, -+static apr_status_t append_to_linebuf(sed_eval_t *eval, const char* sz, - step_vars_storage *step_vars) - { - apr_size_t len = strlen(sz); - char *old_linebuf = eval->linebuf; -+ apr_status_t rc = 0; - /* Copy string including null character */ -- appendmem_to_linebuf(eval, sz, len + 1); -+ rc = appendmem_to_linebuf(eval, sz, len + 1); -+ if (rc != APR_SUCCESS) { -+ return rc; -+ } - --eval->lspend; /* lspend will now point to NULL character */ - /* Sync step_vars after a possible linebuf expansion */ - if (step_vars && old_linebuf != eval->linebuf) { -@@ -189,68 +208,84 @@ static void append_to_linebuf(sed_eval_t *eval, const char* sz, - step_vars->locs = step_vars->locs - old_linebuf + eval->linebuf; - } - } -+ return APR_SUCCESS; - } - - /* - * copy_to_linebuf - */ --static void copy_to_linebuf(sed_eval_t *eval, const char* sz, -+static apr_status_t copy_to_linebuf(sed_eval_t *eval, const char* sz, - step_vars_storage *step_vars) - { - eval->lspend = eval->linebuf; -- append_to_linebuf(eval, sz, step_vars); -+ return append_to_linebuf(eval, sz, step_vars); - } - - /* - * append_to_holdbuf - */ --static void append_to_holdbuf(sed_eval_t *eval, const char* sz) -+static apr_status_t append_to_holdbuf(sed_eval_t *eval, const char* sz) - { - apr_size_t len = strlen(sz); - apr_size_t reqsize = (eval->hspend - eval->holdbuf) + len + 1; -+ apr_status_t rc = 0; - if (eval->hsize <= reqsize) { -- grow_hold_buffer(eval, reqsize); -+ rc = grow_hold_buffer(eval, reqsize); -+ if (rc != APR_SUCCESS) { -+ return rc; -+ } - } - memcpy(eval->hspend, sz, len + 1); - /* hspend will now point to NULL character */ - eval->hspend += len; -+ return APR_SUCCESS; - } - - /* - * copy_to_holdbuf - */ --static void copy_to_holdbuf(sed_eval_t *eval, const char* sz) -+static apr_status_t copy_to_holdbuf(sed_eval_t *eval, const char* sz) - { - eval->hspend = eval->holdbuf; -- append_to_holdbuf(eval, sz); -+ return append_to_holdbuf(eval, sz); - } - - /* - * append_to_genbuf - */ --static void append_to_genbuf(sed_eval_t *eval, const char* sz, char **gspend) -+static apr_status_t append_to_genbuf(sed_eval_t *eval, const char* sz, char **gspend) - { - apr_size_t len = strlen(sz); - apr_size_t reqsize = (*gspend - eval->genbuf) + len + 1; -+ apr_status_t rc = 0; - if (eval->gsize < reqsize) { -- grow_gen_buffer(eval, reqsize, gspend); -+ rc = grow_gen_buffer(eval, reqsize, gspend); -+ if (rc != APR_SUCCESS) { -+ return rc; -+ } - } - memcpy(*gspend, sz, len + 1); - /* *gspend will now point to NULL character */ - *gspend += len; -+ return APR_SUCCESS; - } - - /* - * copy_to_genbuf - */ --static void copy_to_genbuf(sed_eval_t *eval, const char* sz) -+static apr_status_t copy_to_genbuf(sed_eval_t *eval, const char* sz) - { - apr_size_t len = strlen(sz); - apr_size_t reqsize = len + 1; -+ apr_status_t rc = APR_SUCCESS;; - if (eval->gsize < reqsize) { -- grow_gen_buffer(eval, reqsize, NULL); -+ rc = grow_gen_buffer(eval, reqsize, NULL); -+ if (rc != APR_SUCCESS) { -+ return rc; -+ } - } - memcpy(eval->genbuf, sz, len + 1); -+ return rc; - } - - /* -@@ -397,6 +432,7 @@ apr_status_t sed_eval_buffer(sed_eval_t *eval, const char *buf, apr_size_t bufsz - } - - while (bufsz) { -+ apr_status_t rc = 0; - char *n; - apr_size_t llen; - -@@ -411,7 +447,10 @@ apr_status_t sed_eval_buffer(sed_eval_t *eval, const char *buf, apr_size_t bufsz - break; - } - -- appendmem_to_linebuf(eval, buf, llen + 1); -+ rc = appendmem_to_linebuf(eval, buf, llen + 1); -+ if (rc != APR_SUCCESS) { -+ return rc; -+ } - --eval->lspend; - /* replace new line character with NULL */ - *eval->lspend = '\0'; -@@ -426,7 +465,10 @@ apr_status_t sed_eval_buffer(sed_eval_t *eval, const char *buf, apr_size_t bufsz - - /* Save the leftovers for later */ - if (bufsz) { -- appendmem_to_linebuf(eval, buf, bufsz); -+ apr_status_t rc = appendmem_to_linebuf(eval, buf, bufsz); -+ if (rc != APR_SUCCESS) { -+ return rc; -+ } - } - - return APR_SUCCESS; -@@ -448,6 +490,7 @@ apr_status_t sed_finalize_eval(sed_eval_t *eval, void *fout) - /* Process leftovers */ - if (eval->lspend > eval->linebuf) { - apr_status_t rv; -+ apr_status_t rc = 0; - - if (eval->lreadyflag) { - eval->lreadyflag = 0; -@@ -457,7 +500,10 @@ apr_status_t sed_finalize_eval(sed_eval_t *eval, void *fout) - * buffer is not a newline. - */ - /* Assure space for NULL */ -- append_to_linebuf(eval, "", NULL); -+ rc = append_to_linebuf(eval, "", NULL); -+ if (rc != APR_SUCCESS) { -+ return rc; -+ } - } - - *eval->lspend = '\0'; -@@ -655,11 +701,15 @@ static apr_status_t dosub(sed_eval_t *eval, char *rhsbuf, int n, - sp = eval->genbuf; - rp = rhsbuf; - sp = place(eval, sp, lp, step_vars->loc1); -+ if (sp == NULL) { -+ return APR_EGENERAL; -+ } - while ((c = *rp++) != 0) { - if (c == '&') { - sp = place(eval, sp, step_vars->loc1, step_vars->loc2); -- if (sp == NULL) -+ if (sp == NULL) { - return APR_EGENERAL; -+ } - } - else if (c == '\\') { - c = *rp++; -@@ -675,13 +725,19 @@ static apr_status_t dosub(sed_eval_t *eval, char *rhsbuf, int n, - *sp++ = c; - if (sp >= eval->genbuf + eval->gsize) { - /* expand genbuf and set the sp appropriately */ -- grow_gen_buffer(eval, eval->gsize + 1024, &sp); -+ rv = grow_gen_buffer(eval, eval->gsize + 1024, &sp); -+ if (rv != APR_SUCCESS) { -+ return rv; -+ } - } - } - lp = step_vars->loc2; - step_vars->loc2 = sp - eval->genbuf + eval->linebuf; -- append_to_genbuf(eval, lp, &sp); -- copy_to_linebuf(eval, eval->genbuf, step_vars); -+ rv = append_to_genbuf(eval, lp, &sp); -+ if (rv != APR_SUCCESS) { -+ return rv; -+ } -+ rv = copy_to_linebuf(eval, eval->genbuf, step_vars); - return rv; - } - -@@ -695,7 +751,10 @@ static char *place(sed_eval_t *eval, char *asp, char *al1, char *al2) - apr_size_t reqsize = (sp - eval->genbuf) + n + 1; - - if (eval->gsize < reqsize) { -- grow_gen_buffer(eval, reqsize, &sp); -+ apr_status_t rc = grow_gen_buffer(eval, reqsize, &sp); -+ if (rc != APR_SUCCESS) { -+ return NULL; -+ } - } - memcpy(sp, al1, n); - return sp + n; -@@ -750,7 +809,8 @@ static apr_status_t command(sed_eval_t *eval, sed_reptr_t *ipc, - } - - p1++; -- copy_to_linebuf(eval, p1, step_vars); -+ rv = copy_to_linebuf(eval, p1, step_vars); -+ if (rv != APR_SUCCESS) return rv; - eval->jflag++; - break; - -@@ -760,21 +820,27 @@ static apr_status_t command(sed_eval_t *eval, sed_reptr_t *ipc, - break; - - case GCOM: -- copy_to_linebuf(eval, eval->holdbuf, step_vars); -+ rv = copy_to_linebuf(eval, eval->holdbuf, step_vars); -+ if (rv != APR_SUCCESS) return rv; - break; - - case CGCOM: -- append_to_linebuf(eval, "\n", step_vars); -- append_to_linebuf(eval, eval->holdbuf, step_vars); -+ rv = append_to_linebuf(eval, "\n", step_vars); -+ if (rv != APR_SUCCESS) return rv; -+ rv = append_to_linebuf(eval, eval->holdbuf, step_vars); -+ if (rv != APR_SUCCESS) return rv; - break; - - case HCOM: -- copy_to_holdbuf(eval, eval->linebuf); -+ rv = copy_to_holdbuf(eval, eval->linebuf); -+ if (rv != APR_SUCCESS) return rv; - break; - - case CHCOM: -- append_to_holdbuf(eval, "\n"); -- append_to_holdbuf(eval, eval->linebuf); -+ rv = append_to_holdbuf(eval, "\n"); -+ if (rv != APR_SUCCESS) return rv; -+ rv = append_to_holdbuf(eval, eval->linebuf); -+ if (rv != APR_SUCCESS) return rv; - break; - - case ICOM: -@@ -896,7 +962,8 @@ static apr_status_t command(sed_eval_t *eval, sed_reptr_t *ipc, - if (rv != APR_SUCCESS) - return rv; - } -- append_to_linebuf(eval, "\n", step_vars); -+ rv = append_to_linebuf(eval, "\n", step_vars); -+ if (rv != APR_SUCCESS) return rv; - eval->pending = ipc->next; - break; - -@@ -970,9 +1037,12 @@ static apr_status_t command(sed_eval_t *eval, sed_reptr_t *ipc, - break; - - case XCOM: -- copy_to_genbuf(eval, eval->linebuf); -- copy_to_linebuf(eval, eval->holdbuf, step_vars); -- copy_to_holdbuf(eval, eval->genbuf); -+ rv = copy_to_genbuf(eval, eval->linebuf); -+ if (rv != APR_SUCCESS) return rv; -+ rv = copy_to_linebuf(eval, eval->holdbuf, step_vars); -+ if (rv != APR_SUCCESS) return rv; -+ rv = copy_to_holdbuf(eval, eval->genbuf); -+ if (rv != APR_SUCCESS) return rv; - break; - - case YCOM: diff --git a/SOURCES/httpd-2.4.37-CVE-2022-30556.patch b/SOURCES/httpd-2.4.37-CVE-2022-30556.patch deleted file mode 100644 index 971a8d9..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2022-30556.patch +++ /dev/null @@ -1,233 +0,0 @@ -diff --git a/modules/lua/lua_request.c b/modules/lua/lua_request.c -index ba63584..c1ba74a 100644 ---- a/modules/lua/lua_request.c -+++ b/modules/lua/lua_request.c -@@ -2193,23 +2193,20 @@ static int lua_websocket_greet(lua_State *L) - return 0; - } - --static apr_status_t lua_websocket_readbytes(conn_rec* c, char* buffer, -- apr_off_t len) -+static apr_status_t lua_websocket_readbytes(conn_rec* c, -+ apr_bucket_brigade *brigade, -+ char* buffer, apr_off_t len) - { -- apr_bucket_brigade *brigade = apr_brigade_create(c->pool, c->bucket_alloc); -+ apr_size_t delivered; - apr_status_t rv; -+ - rv = ap_get_brigade(c->input_filters, brigade, AP_MODE_READBYTES, - APR_BLOCK_READ, len); - if (rv == APR_SUCCESS) { -- if (!APR_BRIGADE_EMPTY(brigade)) { -- apr_bucket* bucket = APR_BRIGADE_FIRST(brigade); -- const char* data = NULL; -- apr_size_t data_length = 0; -- rv = apr_bucket_read(bucket, &data, &data_length, APR_BLOCK_READ); -- if (rv == APR_SUCCESS) { -- memcpy(buffer, data, len); -- } -- apr_bucket_delete(bucket); -+ delivered = len; -+ rv = apr_brigade_flatten(brigade, buffer, &delivered); -+ if ((rv == APR_SUCCESS) && (delivered < len)) { -+ rv = APR_INCOMPLETE; - } - } - apr_brigade_cleanup(brigade); -@@ -2239,35 +2236,28 @@ static int lua_websocket_peek(lua_State *L) - - static int lua_websocket_read(lua_State *L) - { -- apr_socket_t *sock; - apr_status_t rv; - int do_read = 1; - int n = 0; -- apr_size_t len = 1; - apr_size_t plen = 0; - unsigned short payload_short = 0; - apr_uint64_t payload_long = 0; - unsigned char *mask_bytes; - char byte; -- int plaintext; -- -- -+ apr_bucket_brigade *brigade; -+ conn_rec* c; -+ - request_rec *r = ap_lua_check_request_rec(L, 1); -- plaintext = ap_lua_ssl_is_https(r->connection) ? 0 : 1; -+ c = r->connection; - -- - mask_bytes = apr_pcalloc(r->pool, 4); -- sock = ap_get_conn_socket(r->connection); -+ -+ brigade = apr_brigade_create(r->pool, c->bucket_alloc); - - while (do_read) { - do_read = 0; - /* Get opcode and FIN bit */ -- if (plaintext) { -- rv = apr_socket_recv(sock, &byte, &len); -- } -- else { -- rv = lua_websocket_readbytes(r->connection, &byte, 1); -- } -+ rv = lua_websocket_readbytes(c, brigade, &byte, 1); - if (rv == APR_SUCCESS) { - unsigned char ubyte, fin, opcode, mask, payload; - ubyte = (unsigned char)byte; -@@ -2277,12 +2267,7 @@ static int lua_websocket_read(lua_State *L) - opcode = ubyte & 0xf; - - /* Get the payload length and mask bit */ -- if (plaintext) { -- rv = apr_socket_recv(sock, &byte, &len); -- } -- else { -- rv = lua_websocket_readbytes(r->connection, &byte, 1); -- } -+ rv = lua_websocket_readbytes(c, brigade, &byte, 1); - if (rv == APR_SUCCESS) { - ubyte = (unsigned char)byte; - /* Mask is the first bit */ -@@ -2293,40 +2278,25 @@ static int lua_websocket_read(lua_State *L) - - /* Extended payload? */ - if (payload == 126) { -- len = 2; -- if (plaintext) { -- /* XXX: apr_socket_recv does not receive len bits, only up to len bits! */ -- rv = apr_socket_recv(sock, (char*) &payload_short, &len); -- } -- else { -- rv = lua_websocket_readbytes(r->connection, -- (char*) &payload_short, 2); -- } -- payload_short = ntohs(payload_short); -+ rv = lua_websocket_readbytes(c, brigade, -+ (char*) &payload_short, 2); - -- if (rv == APR_SUCCESS) { -- plen = payload_short; -- } -- else { -+ if (rv != APR_SUCCESS) { - return 0; - } -+ -+ plen = ntohs(payload_short); - } - /* Super duper extended payload? */ - if (payload == 127) { -- len = 8; -- if (plaintext) { -- rv = apr_socket_recv(sock, (char*) &payload_long, &len); -- } -- else { -- rv = lua_websocket_readbytes(r->connection, -- (char*) &payload_long, 8); -- } -- if (rv == APR_SUCCESS) { -- plen = ap_ntoh64(&payload_long); -- } -- else { -+ rv = lua_websocket_readbytes(c, brigade, -+ (char*) &payload_long, 8); -+ -+ if (rv != APR_SUCCESS) { - return 0; - } -+ -+ plen = ap_ntoh64(&payload_long); - } - ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(03210) - "Websocket: Reading %" APR_SIZE_T_FMT " (%s) bytes, masking is %s. %s", -@@ -2335,46 +2305,27 @@ static int lua_websocket_read(lua_State *L) - mask ? "on" : "off", - fin ? "This is a final frame" : "more to follow"); - if (mask) { -- len = 4; -- if (plaintext) { -- rv = apr_socket_recv(sock, (char*) mask_bytes, &len); -- } -- else { -- rv = lua_websocket_readbytes(r->connection, -- (char*) mask_bytes, 4); -- } -+ rv = lua_websocket_readbytes(c, brigade, -+ (char*) mask_bytes, 4); -+ - if (rv != APR_SUCCESS) { - return 0; - } - } - if (plen < (HUGE_STRING_LEN*1024) && plen > 0) { - apr_size_t remaining = plen; -- apr_size_t received; -- apr_off_t at = 0; - char *buffer = apr_palloc(r->pool, plen+1); - buffer[plen] = 0; - -- if (plaintext) { -- while (remaining > 0) { -- received = remaining; -- rv = apr_socket_recv(sock, buffer+at, &received); -- if (received > 0 ) { -- remaining -= received; -- at += received; -- } -- } -- ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, -- "Websocket: Frame contained %" APR_OFF_T_FMT " bytes, pushed to Lua stack", -- at); -- } -- else { -- rv = lua_websocket_readbytes(r->connection, buffer, -- remaining); -- ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, -- "Websocket: SSL Frame contained %" APR_SIZE_T_FMT " bytes, "\ -- "pushed to Lua stack", -- remaining); -+ rv = lua_websocket_readbytes(c, brigade, buffer, remaining); -+ -+ if (rv != APR_SUCCESS) { -+ return 0; - } -+ -+ ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, -+ "Websocket: Frame contained %" APR_SIZE_T_FMT \ -+ " bytes, pushed to Lua stack", remaining); - if (mask) { - for (n = 0; n < plen; n++) { - buffer[n] ^= mask_bytes[n%4]; -@@ -2386,14 +2337,25 @@ static int lua_websocket_read(lua_State *L) - return 2; - } - -- - /* Decide if we need to react to the opcode or not */ - if (opcode == 0x09) { /* ping */ - char frame[2]; -- plen = 2; -+ apr_bucket *b; -+ - frame[0] = 0x8A; - frame[1] = 0; -- apr_socket_send(sock, frame, &plen); /* Pong! */ -+ -+ /* Pong! */ -+ b = apr_bucket_transient_create(frame, 2, c->bucket_alloc); -+ APR_BRIGADE_INSERT_TAIL(brigade, b); -+ -+ rv = ap_pass_brigade(c->output_filters, brigade); -+ apr_brigade_cleanup(brigade); -+ -+ if (rv != APR_SUCCESS) { -+ return 0; -+ } -+ - do_read = 1; - } - } diff --git a/SOURCES/httpd-2.4.37-CVE-2022-31813.patch b/SOURCES/httpd-2.4.37-CVE-2022-31813.patch deleted file mode 100644 index bc0e232..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2022-31813.patch +++ /dev/null @@ -1,229 +0,0 @@ -diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c -index efcc6ca..6626ea0 100644 ---- a/modules/proxy/proxy_util.c -+++ b/modules/proxy/proxy_util.c -@@ -3631,12 +3631,14 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - char **old_cl_val, - char **old_te_val) - { -+ int rc = OK; - conn_rec *c = r->connection; - int counter; - char *buf; -+ apr_table_t *saved_headers_in = r->headers_in; -+ const char *saved_host = apr_table_get(saved_headers_in, "Host"); - const apr_array_header_t *headers_in_array; - const apr_table_entry_t *headers_in; -- apr_table_t *saved_headers_in; - apr_bucket *e; - int do_100_continue; - conn_rec *origin = p_conn->connection; -@@ -3672,6 +3674,52 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - ap_xlate_proto_to_ascii(buf, strlen(buf)); - e = apr_bucket_pool_create(buf, strlen(buf), p, c->bucket_alloc); - APR_BRIGADE_INSERT_TAIL(header_brigade, e); -+ -+ /* -+ * Make a copy on r->headers_in for the request we make to the backend, -+ * modify the copy in place according to our configuration and connection -+ * handling, use it to fill in the forwarded headers' brigade, and finally -+ * restore the saved/original ones in r->headers_in. -+ * -+ * Note: We need to take r->pool for apr_table_copy as the key / value -+ * pairs in r->headers_in have been created out of r->pool and -+ * p might be (and actually is) a longer living pool. -+ * This would trigger the bad pool ancestry abort in apr_table_copy if -+ * apr is compiled with APR_POOL_DEBUG. -+ * -+ * icing: if p indeed lives longer than r->pool, we should allocate -+ * all new header values from r->pool as well and avoid leakage. -+ */ -+ r->headers_in = apr_table_copy(r->pool, saved_headers_in); -+ -+ /* Return the original Transfer-Encoding and/or Content-Length values -+ * then drop the headers, they must be set by the proxy handler based -+ * on the actual body being forwarded. -+ */ -+ if ((*old_te_val = (char *)apr_table_get(r->headers_in, -+ "Transfer-Encoding"))) { -+ apr_table_unset(r->headers_in, "Transfer-Encoding"); -+ } -+ if ((*old_cl_val = (char *)apr_table_get(r->headers_in, -+ "Content-Length"))) { -+ apr_table_unset(r->headers_in, "Content-Length"); -+ } -+ -+ /* Clear out hop-by-hop request headers not to forward */ -+ if (ap_proxy_clear_connection(r, r->headers_in) < 0) { -+ rc = HTTP_BAD_REQUEST; -+ goto cleanup; -+ } -+ -+ /* RFC2616 13.5.1 says we should strip these */ -+ apr_table_unset(r->headers_in, "Keep-Alive"); -+ apr_table_unset(r->headers_in, "Upgrade"); -+ apr_table_unset(r->headers_in, "Trailer"); -+ apr_table_unset(r->headers_in, "TE"); -+ -+ /* We used to send `Host: ` always first, so let's keep it that -+ * way. No telling which legacy backend is relying no this. -+ */ - if (dconf->preserve_host == 0) { - if (ap_strchr_c(uri->hostname, ':')) { /* if literal IPv6 address */ - if (uri->port_str && uri->port != DEFAULT_HTTP_PORT) { -@@ -3693,7 +3741,7 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - /* don't want to use r->hostname, as the incoming header might have a - * port attached - */ -- const char* hostname = apr_table_get(r->headers_in,"Host"); -+ const char* hostname = saved_host; - if (!hostname) { - hostname = r->server->server_hostname; - ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01092) -@@ -3707,21 +3755,7 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - ap_xlate_proto_to_ascii(buf, strlen(buf)); - e = apr_bucket_pool_create(buf, strlen(buf), p, c->bucket_alloc); - APR_BRIGADE_INSERT_TAIL(header_brigade, e); -- -- /* -- * Save the original headers in here and restore them when leaving, since -- * we will apply proxy purpose only modifications (eg. clearing hop-by-hop -- * headers, add Via or X-Forwarded-* or Expect...), whereas the originals -- * will be needed later to prepare the correct response and logging. -- * -- * Note: We need to take r->pool for apr_table_copy as the key / value -- * pairs in r->headers_in have been created out of r->pool and -- * p might be (and actually is) a longer living pool. -- * This would trigger the bad pool ancestry abort in apr_table_copy if -- * apr is compiled with APR_POOL_DEBUG. -- */ -- saved_headers_in = r->headers_in; -- r->headers_in = apr_table_copy(r->pool, saved_headers_in); -+ apr_table_unset(r->headers_in, "Host"); - - /* handle Via */ - if (conf->viaopt == via_block) { -@@ -3788,8 +3822,6 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - */ - if (dconf->add_forwarded_headers) { - if (PROXYREQ_REVERSE == r->proxyreq) { -- const char *buf; -- - /* Add X-Forwarded-For: so that the upstream has a chance to - * determine, where the original request came from. - */ -@@ -3799,8 +3831,9 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - /* Add X-Forwarded-Host: so that upstream knows what the - * original request hostname was. - */ -- if ((buf = apr_table_get(r->headers_in, "Host"))) { -- apr_table_mergen(r->headers_in, "X-Forwarded-Host", buf); -+ if (saved_host) { -+ apr_table_mergen(r->headers_in, "X-Forwarded-Host", -+ saved_host); - } - - /* Add X-Forwarded-Server: so that upstream knows what the -@@ -3812,10 +3845,27 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - } - } - -+ /* Do we want to strip Proxy-Authorization ? -+ * If we haven't used it, then NO -+ * If we have used it then MAYBE: RFC2616 says we MAY propagate it. -+ * So let's make it configurable by env. -+ */ -+ if (r->user != NULL /* we've authenticated */ -+ && !apr_table_get(r->subprocess_env, "Proxy-Chain-Auth")) { -+ apr_table_unset(r->headers_in, "Proxy-Authorization"); -+ } -+ -+ /* for sub-requests, ignore freshness/expiry headers */ -+ if (r->main) { -+ apr_table_unset(r->headers_in, "If-Match"); -+ apr_table_unset(r->headers_in, "If-Modified-Since"); -+ apr_table_unset(r->headers_in, "If-Range"); -+ apr_table_unset(r->headers_in, "If-Unmodified-Since"); -+ apr_table_unset(r->headers_in, "If-None-Match"); -+ } -+ -+ /* run hook to fixup the request we are about to send */ - proxy_run_fixups(r); -- if (ap_proxy_clear_connection(r, r->headers_in) < 0) { -- return HTTP_BAD_REQUEST; -- } - - creds = apr_table_get(r->notes, "proxy-basic-creds"); - if (creds) { -@@ -3827,55 +3877,8 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - headers_in = (const apr_table_entry_t *) headers_in_array->elts; - for (counter = 0; counter < headers_in_array->nelts; counter++) { - if (headers_in[counter].key == NULL -- || headers_in[counter].val == NULL -- -- /* Already sent */ -- || !strcasecmp(headers_in[counter].key, "Host") -- -- /* Clear out hop-by-hop request headers not to send -- * RFC2616 13.5.1 says we should strip these headers -- */ -- || !strcasecmp(headers_in[counter].key, "Keep-Alive") -- || !strcasecmp(headers_in[counter].key, "TE") -- || !strcasecmp(headers_in[counter].key, "Trailer") -- || !strcasecmp(headers_in[counter].key, "Upgrade") -- -- ) { -- continue; -- } -- /* Do we want to strip Proxy-Authorization ? -- * If we haven't used it, then NO -- * If we have used it then MAYBE: RFC2616 says we MAY propagate it. -- * So let's make it configurable by env. -- */ -- if (!strcasecmp(headers_in[counter].key,"Proxy-Authorization")) { -- if (r->user != NULL) { /* we've authenticated */ -- if (!apr_table_get(r->subprocess_env, "Proxy-Chain-Auth")) { -- continue; -- } -- } -- } -- -- /* Skip Transfer-Encoding and Content-Length for now. -- */ -- if (!strcasecmp(headers_in[counter].key, "Transfer-Encoding")) { -- *old_te_val = headers_in[counter].val; -- continue; -- } -- if (!strcasecmp(headers_in[counter].key, "Content-Length")) { -- *old_cl_val = headers_in[counter].val; -- continue; -- } -- -- /* for sub-requests, ignore freshness/expiry headers */ -- if (r->main) { -- if ( !strcasecmp(headers_in[counter].key, "If-Match") -- || !strcasecmp(headers_in[counter].key, "If-Modified-Since") -- || !strcasecmp(headers_in[counter].key, "If-Range") -- || !strcasecmp(headers_in[counter].key, "If-Unmodified-Since") -- || !strcasecmp(headers_in[counter].key, "If-None-Match")) { -- continue; -- } -+ || headers_in[counter].val == NULL) { -+ continue; - } - - buf = apr_pstrcat(p, headers_in[counter].key, ": ", -@@ -3886,11 +3889,9 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - APR_BRIGADE_INSERT_TAIL(header_brigade, e); - } - -- /* Restore the original headers in (see comment above), -- * we won't modify them anymore. -- */ -+cleanup: - r->headers_in = saved_headers_in; -- return OK; -+ return rc; - } - - PROXY_DECLARE(int) ap_proxy_prefetch_input(request_rec *r, diff --git a/SOURCES/httpd-2.4.37-CVE-2022-36760.patch b/SOURCES/httpd-2.4.37-CVE-2022-36760.patch deleted file mode 100644 index 5a34c30..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2022-36760.patch +++ /dev/null @@ -1,23 +0,0 @@ -From 5efc9507c487c37dfe2a279a4a0335cad701cd5f Mon Sep 17 00:00:00 2001 -From: Eric Covener -Date: Tue, 10 Jan 2023 13:19:07 +0000 -Subject: [PATCH] cleanup on error - -git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1906540 13f79535-47bb-0310-9956-ffa450edef68 ---- - modules/proxy/mod_proxy_ajp.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c -index 9cd7adbcbbf..07f37392d88 100644 ---- a/modules/proxy/mod_proxy_ajp.c -+++ b/modules/proxy/mod_proxy_ajp.c -@@ -255,6 +255,8 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r, - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10396) - "%s Transfer-Encoding is not supported", - tenc); -+ /* We had a failure: Close connection to backend */ -+ conn->close = 1; - return HTTP_INTERNAL_SERVER_ERROR; - } - } else { diff --git a/SOURCES/httpd-2.4.37-CVE-2022-37436.patch b/SOURCES/httpd-2.4.37-CVE-2022-37436.patch deleted file mode 100644 index 26311e8..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2022-37436.patch +++ /dev/null @@ -1,129 +0,0 @@ -From 8b6d55f6a047acf62675e32606b037f5eea8ccc7 Mon Sep 17 00:00:00 2001 -From: Eric Covener -Date: Tue, 10 Jan 2023 13:20:09 +0000 -Subject: [PATCH] Merge r1906539 from trunk: - -fail on bad header - -Submitted By: covener -Reviewed By: covener, rpluem, gbechis - - -git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1906541 13f79535-47bb-0310-9956-ffa450edef68 ---- - modules/proxy/mod_proxy_http.c | 46 ++++++++++++++++++++-------------- - server/protocol.c | 2 ++ - 2 files changed, 29 insertions(+), 19 deletions(-) - -diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c -index d74ae054ac9..ec4e7fb06b5 100644 ---- a/modules/proxy/mod_proxy_http.c -+++ b/modules/proxy/mod_proxy_http.c -@@ -788,7 +788,7 @@ static void process_proxy_header(request_rec *r, proxy_dir_conf *c, - * any sense at all, since we depend on buffer still containing - * what was read by ap_getline() upon return. - */ --static void ap_proxy_read_headers(request_rec *r, request_rec *rr, -+static apr_status_t ap_proxy_read_headers(request_rec *r, request_rec *rr, - char *buffer, int size, - conn_rec *c, int *pread_len) - { -@@ -820,19 +820,26 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr, - rc = ap_proxygetline(tmp_bb, buffer, size, rr, - AP_GETLINE_FOLD | AP_GETLINE_NOSPC_EOL, &len); - -- if (len <= 0) -- break; - -- if (APR_STATUS_IS_ENOSPC(rc)) { -- /* The header could not fit in the provided buffer, warn. -- * XXX: falls through with the truncated header, 5xx instead? -- */ -- int trunc = (len > 128 ? 128 : len) / 2; -- ap_log_rerror(APLOG_MARK, APLOG_WARNING, rc, r, APLOGNO(10124) -- "header size is over the limit allowed by " -- "ResponseFieldSize (%d bytes). " -- "Bad response header: '%.*s[...]%s'", -- size, trunc, buffer, buffer + len - trunc); -+ if (rc != APR_SUCCESS) { -+ if (APR_STATUS_IS_ENOSPC(rc)) { -+ int trunc = (len > 128 ? 128 : len) / 2; -+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, rc, r, APLOGNO(10124) -+ "header size is over the limit allowed by " -+ "ResponseFieldSize (%d bytes). " -+ "Bad response header: '%.*s[...]%s'", -+ size, trunc, buffer, buffer + len - trunc); -+ } -+ else { -+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, rc, r, APLOGNO(10404) -+ "Error reading headers from backend"); -+ } -+ r->headers_out = NULL; -+ return rc; -+ } -+ -+ if (len <= 0) { -+ break; - } - else { - ap_log_rerror(APLOG_MARK, APLOG_TRACE4, 0, r, "%s", buffer); -@@ -855,7 +862,7 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr, - if (psc->badopt == bad_error) { - /* Nope, it wasn't even an extra HTTP header. Give up. */ - r->headers_out = NULL; -- return; -+ return APR_EINVAL; - } - else if (psc->badopt == bad_body) { - /* if we've already started loading headers_out, then -@@ -869,13 +876,13 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr, - "in headers returned by %s (%s)", - r->uri, r->method); - *pread_len = len; -- return; -+ return APR_SUCCESS; - } - else { - ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01099) - "No HTTP headers returned by %s (%s)", - r->uri, r->method); -- return; -+ return APR_SUCCESS; - } - } - } -@@ -905,6 +912,7 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr, - process_proxy_header(r, dconf, buffer, value); - saw_headers = 1; - } -+ return APR_SUCCESS; - } - - -@@ -1218,10 +1226,10 @@ int ap_proxy_http_process_response(proxy_http_req_t *req) - "Set-Cookie", NULL); - - /* shove the headers direct into r->headers_out */ -- ap_proxy_read_headers(r, backend->r, buffer, response_field_size, -- origin, &pread_len); -+ rc = ap_proxy_read_headers(r, backend->r, buffer, response_field_size, -+ origin, &pread_len); - -- if (r->headers_out == NULL) { -+ if (rc != APR_SUCCESS || r->headers_out == NULL) { - ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01106) - "bad HTTP/%d.%d header returned by %s (%s)", - major, minor, r->uri, r->method); -diff --git a/server/protocol.c b/server/protocol.c -index 7adc7f75c10..6f9540ad1de 100644 ---- a/server/protocol.c -+++ b/server/protocol.c -@@ -508,6 +508,8 @@ AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n, - /* PR#43039: We shouldn't accept NULL bytes within the line */ - bytes_handled = strlen(*s); - if (bytes_handled < *read) { -+ ap_log_data(APLOG_MARK, APLOG_DEBUG, ap_server_conf, -+ "NULL bytes in header", *s, *read, 0); - *read = bytes_handled; - if (rv == APR_SUCCESS) { - rv = APR_EINVAL; diff --git a/SOURCES/httpd-2.4.37-CVE-2023-25690.patch b/SOURCES/httpd-2.4.37-CVE-2023-25690.patch deleted file mode 100644 index bb856b7..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2023-25690.patch +++ /dev/null @@ -1,586 +0,0 @@ -diff --git a/docs/manual/mod/mod_rewrite.html.en b/docs/manual/mod/mod_rewrite.html.en -index 815ec72..2b8ed35 100644 ---- a/docs/manual/mod/mod_rewrite.html.en -+++ b/docs/manual/mod/mod_rewrite.html.en -@@ -1265,7 +1265,17 @@ cannot use $N in the substitution string! - B - Escape non-alphanumeric characters in backreferences before - applying the transformation. details ... -- -+ -+ -+ BCTLS -+ Like [B], but only escape control characters and spaces. -+ details ... -+ -+ -+ BNE -+ Characters of [B] or [BCTLS] which should not be escaped. -+ details ... -+ - - backrefnoplus|BNP - If backreferences are being escaped, spaces should be escaped to -diff --git a/docs/manual/rewrite/flags.html.en b/docs/manual/rewrite/flags.html.en -index 80d0759..734809a 100644 ---- a/docs/manual/rewrite/flags.html.en -+++ b/docs/manual/rewrite/flags.html.en -@@ -85,10 +85,6 @@ of how you might use them.

    -

    B (escape backreferences)

    -

    The [B] flag instructs RewriteRule to escape non-alphanumeric - characters before applying the transformation.

    --

    In 2.4.26 and later, you can limit the escaping to specific characters --in backreferences by listing them: [B=#?;]. Note: The space --character can be used in the list of characters to escape, but it cannot be --the last character in the list.

    - -

    mod_rewrite has to unescape URLs before mapping them, - so backreferences are unescaped at the time they are applied. -@@ -120,6 +116,20 @@ when the backend may break if presented with an unescaped URL.

    - -

    An alternative to this flag is using a RewriteCond to capture against %{THE_REQUEST} which will capture - strings in the encoded form.

    -+ -+

    In 2.4.26 and later, you can limit the escaping to specific characters -+in backreferences by listing them: [B=#?;]. Note: The space -+character can be used in the list of characters to escape, but you must quote -+the entire third argument of RewriteRule -+and the space must not be the last character in the list.

    -+ -+
    # Escape spaces and question marks.  The quotes around the final argument
    -+# are required when a space is included.
    -+RewriteRule "^search/(.*)$" "/search.php?term=$1" "[B= ?]"
    -+ -+

    To limit the characters escaped this way, see #flag_bne -+and #flag_bctls

    -+ -
    top
    -
    -

    BNP|backrefnoplus (don't escape space to +)

    -diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c -index 38dbb24..b71c67c 100644 ---- a/modules/mappers/mod_rewrite.c -+++ b/modules/mappers/mod_rewrite.c -@@ -101,6 +101,8 @@ - #include "mod_rewrite.h" - #include "ap_expr.h" - -+#include "test_char.h" -+ - static ap_dbd_t *(*dbd_acquire)(request_rec*) = NULL; - static void (*dbd_prepare)(server_rec*, const char*, const char*) = NULL; - static const char* really_last_key = "rewrite_really_last"; -@@ -168,6 +170,8 @@ static const char* really_last_key = "rewrite_really_last"; - #define RULEFLAG_END (1<<17) - #define RULEFLAG_ESCAPENOPLUS (1<<18) - #define RULEFLAG_QSLAST (1<<19) -+#define RULEFLAG_QSNONE (1<<20) /* programattic only */ -+#define RULEFLAG_ESCAPECTLS (1<<21) - - /* return code of the rewrite rule - * the result may be escaped - or not -@@ -321,7 +325,8 @@ typedef struct { - data_item *cookie; /* added cookies */ - int skip; /* number of next rules to skip */ - int maxrounds; /* limit on number of loops with N flag */ -- char *escapes; /* specific backref escapes */ -+ const char *escapes; /* specific backref escapes */ -+ const char *noescapes; /* specific backref chars not to escape */ - } rewriterule_entry; - - typedef struct { -@@ -422,7 +427,9 @@ static const char *rewritemap_mutex_type = "rewrite-map"; - /* Optional functions imported from mod_ssl when loaded: */ - static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *rewrite_ssl_lookup = NULL; - static APR_OPTIONAL_FN_TYPE(ssl_is_https) *rewrite_is_https = NULL; --static char *escape_backref(apr_pool_t *p, const char *path, const char *escapeme, int noplus); -+static char *escape_backref(apr_pool_t *p, const char *path, -+ const char *escapeme, const char *noescapeme, -+ int flags); - - /* - * +-------------------------------------------------------+ -@@ -645,18 +652,26 @@ static APR_INLINE unsigned char *c2x(unsigned what, unsigned char prefix, - return where; - } - -+ - /* - * Escapes a backreference in a similar way as php's urlencode does. - * Based on ap_os_escape_path in server/util.c - */ --static char *escape_backref(apr_pool_t *p, const char *path, const char *escapeme, int noplus) { -- char *copy = apr_palloc(p, 3 * strlen(path) + 3); -+static char *escape_backref(apr_pool_t *p, const char *path, -+ const char *escapeme, const char *noescapeme, -+ int flags) -+{ -+ char *copy = apr_palloc(p, 3 * strlen(path) + 1); - const unsigned char *s = (const unsigned char *)path; - unsigned char *d = (unsigned char *)copy; -- unsigned c; -+ int noplus = (flags & RULEFLAG_ESCAPENOPLUS) != 0; -+ int ctls = (flags & RULEFLAG_ESCAPECTLS) != 0; -+ unsigned char c; - - while ((c = *s)) { -- if (!escapeme) { -+ if (((ctls ? !TEST_CHAR(c, T_VCHAR_OBSTEXT) : !escapeme) -+ || (escapeme && ap_strchr_c(escapeme, c))) -+ && (!noescapeme || !ap_strchr_c(noescapeme, c))) { - if (apr_isalnum(c) || c == '_') { - *d++ = c; - } -@@ -667,23 +682,8 @@ static char *escape_backref(apr_pool_t *p, const char *path, const char *escapem - d = c2x(c, '%', d); - } - } -- else { -- const char *esc = escapeme; -- while (*esc) { -- if (c == *esc) { -- if (c == ' ' && !noplus) { -- *d++ = '+'; -- } -- else { -- d = c2x(c, '%', d); -- } -- break; -- } -- ++esc; -- } -- if (!*esc) { -- *d++ = c; -- } -+ else { -+ *d++ = c; - } - ++s; - } -@@ -761,15 +761,24 @@ static char *escape_absolute_uri(apr_pool_t *p, char *uri, unsigned scheme) - ap_escape_uri(p, cp), NULL); - } - -+ - /* - * split out a QUERY_STRING part from - * the current URI string - */ --static void splitout_queryargs(request_rec *r, int qsappend, int qsdiscard, -- int qslast) -+static void splitout_queryargs(request_rec *r, int flags) - { - char *q; - int split; -+ int qsappend = flags & RULEFLAG_QSAPPEND; -+ int qsdiscard = flags & RULEFLAG_QSDISCARD; -+ int qslast = flags & RULEFLAG_QSLAST; -+ -+ if (flags & RULEFLAG_QSNONE) { -+ rewritelog((r, 2, NULL, "discarding query string, no parse from substitution")); -+ r->args = NULL; -+ return; -+ } - - /* don't touch, unless it's a scheme for which a query string makes sense. - * See RFC 1738 and RFC 2368. -@@ -794,7 +803,7 @@ static void splitout_queryargs(request_rec *r, int qsappend, int qsdiscard, - olduri = apr_pstrdup(r->pool, r->filename); - *q++ = '\0'; - if (qsappend) { -- if (*q) { -+ if (*q) { - r->args = apr_pstrcat(r->pool, q, "&" , r->args, NULL); - } - } -@@ -802,9 +811,9 @@ static void splitout_queryargs(request_rec *r, int qsappend, int qsdiscard, - r->args = apr_pstrdup(r->pool, q); - } - -- if (r->args) { -+ if (r->args) { - len = strlen(r->args); -- -+ - if (!len) { - r->args = NULL; - } -@@ -2436,7 +2445,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry) - /* escape the backreference */ - char *tmp2, *tmp; - tmp = apr_pstrmemdup(pool, bri->source + bri->regmatch[n].rm_so, span); -- tmp2 = escape_backref(pool, tmp, entry->escapes, entry->flags & RULEFLAG_ESCAPENOPLUS); -+ tmp2 = escape_backref(pool, tmp, entry->escapes, entry->noescapes, -+ entry->flags); - rewritelog((ctx->r, 5, ctx->perdir, "escaping backreference '%s' to '%s'", - tmp, tmp2)); - -@@ -2733,7 +2743,7 @@ static apr_status_t rewritelock_remove(void *data) - * XXX: what an inclined parser. Seems we have to leave it so - * for backwards compat. *sigh* - */ --static int parseargline(char *str, char **a1, char **a2, char **a3) -+static int parseargline(char *str, char **a1, char **a2, char **a2_end, char **a3) - { - char quote; - -@@ -2784,8 +2794,10 @@ static int parseargline(char *str, char **a1, char **a2, char **a3) - - if (!*str) { - *a3 = NULL; /* 3rd argument is optional */ -+ *a2_end = str; - return 0; - } -+ *a2_end = str; - *str++ = '\0'; - - while (apr_isspace(*str)) { -@@ -3323,7 +3335,7 @@ static const char *cmd_rewritecond(cmd_parms *cmd, void *in_dconf, - rewrite_server_conf *sconf; - rewritecond_entry *newcond; - ap_regex_t *regexp; -- char *a1 = NULL, *a2 = NULL, *a3 = NULL; -+ char *a1 = NULL, *a2 = NULL, *a2_end, *a3 = NULL; - const char *err; - - sconf = ap_get_module_config(cmd->server->module_config, &rewrite_module); -@@ -3341,7 +3353,7 @@ static const char *cmd_rewritecond(cmd_parms *cmd, void *in_dconf, - * of the argument line. So we can use a1 .. a3 without - * copying them again. - */ -- if (parseargline(str, &a1, &a2, &a3)) { -+ if (parseargline(str, &a1, &a2, &a2_end, &a3)) { - return apr_pstrcat(cmd->pool, "RewriteCond: bad argument line '", str, - "'", NULL); - } -@@ -3500,13 +3512,24 @@ static const char *cmd_rewriterule_setflag(apr_pool_t *p, void *_cfg, - case 'B': - if (!*key || !strcasecmp(key, "ackrefescaping")) { - cfg->flags |= RULEFLAG_ESCAPEBACKREF; -- if (val && *val) { -+ if (val && *val) { - cfg->escapes = val; - } - } -+ else if (!strcasecmp(key, "NE")) { -+ if (val && *val) { -+ cfg->noescapes = val; -+ } -+ else { -+ return "flag 'BNE' wants a list of characters (i.e. [BNE=...])"; -+ } -+ } - else if (!strcasecmp(key, "NP") || !strcasecmp(key, "ackrefernoplus")) { - cfg->flags |= RULEFLAG_ESCAPENOPLUS; - } -+ else if (!strcasecmp(key, "CTLS")) { -+ cfg->flags |= RULEFLAG_ESCAPECTLS|RULEFLAG_ESCAPEBACKREF; -+ } - else { - ++error; - } -@@ -3749,7 +3772,7 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf, - rewrite_server_conf *sconf; - rewriterule_entry *newrule; - ap_regex_t *regexp; -- char *a1 = NULL, *a2 = NULL, *a3 = NULL; -+ char *a1 = NULL, *a2 = NULL, *a2_end, *a3 = NULL; - const char *err; - - sconf = ap_get_module_config(cmd->server->module_config, &rewrite_module); -@@ -3763,12 +3786,11 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf, - } - - /* parse the argument line ourself */ -- if (parseargline(str, &a1, &a2, &a3)) { -+ if (parseargline(str, &a1, &a2, &a2_end, &a3)) { - return apr_pstrcat(cmd->pool, "RewriteRule: bad argument line '", str, - "'", NULL); - } - -- /* arg3: optional flags field */ - newrule->forced_mimetype = NULL; - newrule->forced_handler = NULL; - newrule->forced_responsecode = HTTP_MOVED_TEMPORARILY; -@@ -3777,6 +3799,9 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf, - newrule->cookie = NULL; - newrule->skip = 0; - newrule->maxrounds = REWRITE_MAX_ROUNDS; -+ newrule->escapes = newrule->noescapes = NULL; -+ -+ /* arg3: optional flags field */ - if (a3 != NULL) { - if ((err = cmd_parseflagfield(cmd->pool, newrule, a3, - cmd_rewriterule_setflag)) != NULL) { -@@ -3810,6 +3835,17 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf, - newrule->flags |= RULEFLAG_NOSUB; - } - -+ if (*(a2_end-1) == '?') { -+ /* a literal ? at the end of the unsubstituted rewrite rule */ -+ newrule->flags |= RULEFLAG_QSNONE; -+ *(a2_end-1) = '\0'; /* trailing ? has done its job */ -+ } -+ else if (newrule->flags & RULEFLAG_QSDISCARD) { -+ if (NULL == ap_strchr(newrule->output, '?')) { -+ newrule->flags |= RULEFLAG_QSNONE; -+ } -+ } -+ - /* now, if the server or per-dir config holds an - * array of RewriteCond entries, we take it for us - * and clear the array -@@ -4215,9 +4251,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) - r->path_info = NULL; - } - -- splitout_queryargs(r, p->flags & RULEFLAG_QSAPPEND, -- p->flags & RULEFLAG_QSDISCARD, -- p->flags & RULEFLAG_QSLAST); -+ splitout_queryargs(r, p->flags); - - /* Add the previously stripped per-directory location prefix, unless - * (1) it's an absolute URL path and -@@ -4696,8 +4730,25 @@ static int hook_uri2file(request_rec *r) - } - - if (rulestatus) { -- unsigned skip; -- apr_size_t flen; -+ unsigned skip_absolute = is_absolute_uri(r->filename, NULL); -+ apr_size_t flen = r->filename ? strlen(r->filename) : 0; -+ int to_proxyreq = (flen > 6 && strncmp(r->filename, "proxy:", 6) == 0); -+ int will_escape = skip_absolute && (rulestatus != ACTION_NOESCAPE); -+ -+ if (r->args -+ && !will_escape -+ && *(ap_scan_vchar_obstext(r->args))) { -+ /* -+ * We have a raw control character or a ' ' in r->args. -+ * Correct encoding was missed. -+ * Correct encoding was missed and we're not going to escape -+ * it before returning. -+ */ -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10410) -+ "Rewritten query string contains control " -+ "characters or spaces"); -+ return HTTP_FORBIDDEN; -+ } - - if (ACTION_STATUS == rulestatus) { - int n = r->status; -@@ -4706,8 +4757,7 @@ static int hook_uri2file(request_rec *r) - return n; - } - -- flen = r->filename ? strlen(r->filename) : 0; -- if (flen > 6 && strncmp(r->filename, "proxy:", 6) == 0) { -+ if (to_proxyreq) { - /* it should be go on as an internal proxy request */ - - /* check if the proxy module is enabled, so -@@ -4749,7 +4799,7 @@ static int hook_uri2file(request_rec *r) - r->filename)); - return OK; - } -- else if ((skip = is_absolute_uri(r->filename, NULL)) > 0) { -+ else if (skip_absolute > 0) { - int n; - - /* it was finally rewritten to a remote URL */ -@@ -4757,7 +4807,7 @@ static int hook_uri2file(request_rec *r) - if (rulestatus != ACTION_NOESCAPE) { - rewritelog((r, 1, NULL, "escaping %s for redirect", - r->filename)); -- r->filename = escape_absolute_uri(r->pool, r->filename, skip); -+ r->filename = escape_absolute_uri(r->pool, r->filename, skip_absolute); - } - - /* append the QUERY_STRING part */ -@@ -4981,7 +5031,26 @@ static int hook_fixup(request_rec *r) - */ - rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory); - if (rulestatus) { -- unsigned skip; -+ unsigned skip_absolute = is_absolute_uri(r->filename, NULL); -+ int to_proxyreq = 0; -+ int will_escape = 0; -+ -+ l = strlen(r->filename); -+ to_proxyreq = l > 6 && strncmp(r->filename, "proxy:", 6) == 0; -+ will_escape = skip_absolute && (rulestatus != ACTION_NOESCAPE); -+ -+ if (r->args -+ && !will_escape -+ && *(ap_scan_vchar_obstext(r->args))) { -+ /* -+ * We have a raw control character or a ' ' in r->args. -+ * Correct encoding was missed. -+ */ -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10411) -+ "Rewritten query string contains control " -+ "characters or spaces"); -+ return HTTP_FORBIDDEN; -+ } - - if (ACTION_STATUS == rulestatus) { - int n = r->status; -@@ -4990,8 +5059,7 @@ static int hook_fixup(request_rec *r) - return n; - } - -- l = strlen(r->filename); -- if (l > 6 && strncmp(r->filename, "proxy:", 6) == 0) { -+ if (to_proxyreq) { - /* it should go on as an internal proxy request */ - - /* make sure the QUERY_STRING and -@@ -5015,7 +5083,7 @@ static int hook_fixup(request_rec *r) - "%s [OK]", r->filename)); - return OK; - } -- else if ((skip = is_absolute_uri(r->filename, NULL)) > 0) { -+ else if (skip_absolute > 0) { - /* it was finally rewritten to a remote URL */ - - /* because we are in a per-dir context -@@ -5024,7 +5092,7 @@ static int hook_fixup(request_rec *r) - */ - if (dconf->baseurl != NULL) { - /* skip 'scheme://' */ -- cp = r->filename + skip; -+ cp = r->filename + skip_absolute; - - if ((cp = ap_strchr(cp, '/')) != NULL && *(++cp)) { - rewritelog((r, 2, dconf->directory, -@@ -5069,7 +5137,7 @@ static int hook_fixup(request_rec *r) - if (rulestatus != ACTION_NOESCAPE) { - rewritelog((r, 1, dconf->directory, "escaping %s for redirect", - r->filename)); -- r->filename = escape_absolute_uri(r->pool, r->filename, skip); -+ r->filename = escape_absolute_uri(r->pool, r->filename, skip_absolute); - } - - /* append the QUERY_STRING part */ -diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c -index cbb0872..873ccf1 100644 ---- a/modules/proxy/mod_proxy_ajp.c -+++ b/modules/proxy/mod_proxy_ajp.c -@@ -69,6 +69,16 @@ static int proxy_ajp_canon(request_rec *r, char *url) - path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, - r->proxyreq); - search = r->args; -+ if (search && *(ap_scan_vchar_obstext(search))) { -+ /* -+ * We have a raw control character or a ' ' in r->args. -+ * Correct encoding was missed. -+ */ -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10406) -+ "To be forwarded query string contains control " -+ "characters or spaces"); -+ return HTTP_FORBIDDEN; -+ } - } - if (path == NULL) - return HTTP_BAD_REQUEST; -diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c -index 3a28038..c599e1a 100644 ---- a/modules/proxy/mod_proxy_balancer.c -+++ b/modules/proxy/mod_proxy_balancer.c -@@ -106,6 +106,16 @@ static int proxy_balancer_canon(request_rec *r, char *url) - path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, - r->proxyreq); - search = r->args; -+ if (search && *(ap_scan_vchar_obstext(search))) { -+ /* -+ * We have a raw control character or a ' ' in r->args. -+ * Correct encoding was missed. -+ */ -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10407) -+ "To be forwarded query string contains control " -+ "characters or spaces"); -+ return HTTP_FORBIDDEN; -+ } - } - if (path == NULL) - return HTTP_BAD_REQUEST; -diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c -index 7573638..fe7b322 100644 ---- a/modules/proxy/mod_proxy_http.c -+++ b/modules/proxy/mod_proxy_http.c -@@ -90,6 +90,16 @@ static int proxy_http_canon(request_rec *r, char *url) - path = ap_proxy_canonenc(r->pool, url, strlen(url), - enc_path, 0, r->proxyreq); - search = r->args; -+ if (search && *(ap_scan_vchar_obstext(search))) { -+ /* -+ * We have a raw control character or a ' ' in r->args. -+ * Correct encoding was missed. -+ */ -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10408) -+ "To be forwarded query string contains control " -+ "characters or spaces"); -+ return HTTP_FORBIDDEN; -+ } - } - break; - case PROXYREQ_PROXY: -diff --git a/modules/proxy/mod_proxy_wstunnel.c b/modules/proxy/mod_proxy_wstunnel.c -index e005a94..f5e27d9 100644 ---- a/modules/proxy/mod_proxy_wstunnel.c -+++ b/modules/proxy/mod_proxy_wstunnel.c -@@ -77,6 +77,16 @@ static int proxy_wstunnel_canon(request_rec *r, char *url) - path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, - r->proxyreq); - search = r->args; -+ if (search && *(ap_scan_vchar_obstext(search))) { -+ /* -+ * We have a raw control character or a ' ' in r->args. -+ * Correct encoding was missed. -+ */ -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10409) -+ "To be forwarded query string contains control " -+ "characters or spaces"); -+ return HTTP_FORBIDDEN; -+ } - } - if (path == NULL) - return HTTP_BAD_REQUEST; -diff --git a/server/gen_test_char.c b/server/gen_test_char.c -index 48ae6f4..6a153a3 100644 ---- a/server/gen_test_char.c -+++ b/server/gen_test_char.c -@@ -169,5 +169,15 @@ int main(int argc, char *argv[]) - - printf("\n};\n"); - -+ -+ printf( -+ "/* we assume the folks using this ensure 0 <= c < 256... which means\n" -+ " * you need a cast to (unsigned char) first, you can't just plug a\n" -+ " * char in here and get it to work, because if char is signed then it\n" -+ " * will first be sign extended.\n" -+ " */\n" -+ "#define TEST_CHAR(c, f) (test_char_table[(unsigned char)(c)] & (f))\n" -+ ); -+ - return 0; - } -diff --git a/server/util.c b/server/util.c -index 45051b7..9d897d4 100644 ---- a/server/util.c -+++ b/server/util.c -@@ -74,13 +74,6 @@ - */ - #include "test_char.h" - --/* we assume the folks using this ensure 0 <= c < 256... which means -- * you need a cast to (unsigned char) first, you can't just plug a -- * char in here and get it to work, because if char is signed then it -- * will first be sign extended. -- */ --#define TEST_CHAR(c, f) (test_char_table[(unsigned char)(c)] & (f)) -- - /* Win32/NetWare/OS2 need to check for both forward and back slashes - * in ap_getparents() and ap_escape_url. - */ diff --git a/SOURCES/httpd-2.4.37-CVE-2023-27522.patch b/SOURCES/httpd-2.4.37-CVE-2023-27522.patch deleted file mode 100644 index 8a8f7bd..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2023-27522.patch +++ /dev/null @@ -1,89 +0,0 @@ -diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c -index 9dcbed1..a1b564d 100644 ---- a/modules/proxy/mod_proxy_uwsgi.c -+++ b/modules/proxy/mod_proxy_uwsgi.c -@@ -304,18 +304,16 @@ static int uwsgi_response(request_rec *r, proxy_conn_rec * backend, - pass_bb = apr_brigade_create(r->pool, c->bucket_alloc); - - len = ap_getline(buffer, sizeof(buffer), rp, 1); -- - if (len <= 0) { -- /* oops */ -+ /* invalid or empty */ - return HTTP_INTERNAL_SERVER_ERROR; - } -- - backend->worker->s->read += len; -- -- if (len >= sizeof(buffer) - 1) { -- /* oops */ -+ if ((apr_size_t)len >= sizeof(buffer)) { -+ /* too long */ - return HTTP_INTERNAL_SERVER_ERROR; - } -+ - /* Position of http status code */ - if (apr_date_checkmask(buffer, "HTTP/#.# ###*")) { - status_start = 9; -@@ -324,8 +322,8 @@ static int uwsgi_response(request_rec *r, proxy_conn_rec * backend, - status_start = 7; - } - else { -- /* oops */ -- return HTTP_INTERNAL_SERVER_ERROR; -+ /* not HTTP */ -+ return HTTP_BAD_GATEWAY; - } - status_end = status_start + 3; - -@@ -345,21 +343,44 @@ static int uwsgi_response(request_rec *r, proxy_conn_rec * backend, - } - r->status_line = apr_pstrdup(r->pool, &buffer[status_start]); - -- /* start parsing headers */ -+ /* parse headers */ - while ((len = ap_getline(buffer, sizeof(buffer), rp, 1)) > 0) { -+ if ((apr_size_t)len >= sizeof(buffer)) { -+ /* too long */ -+ len = -1; -+ break; -+ } - value = strchr(buffer, ':'); -- /* invalid header skip */ -- if (!value) -- continue; -- *value = '\0'; -- ++value; -+ if (!value) { -+ /* invalid header */ -+ len = -1; -+ break; -+ } -+ *value++ = '\0'; -+ if (*ap_scan_http_token(buffer)) { -+ /* invalid name */ -+ len = -1; -+ break; -+ } - while (apr_isspace(*value)) - ++value; - for (end = &value[strlen(value) - 1]; - end > value && apr_isspace(*end); --end) - *end = '\0'; -+ if (*ap_scan_http_field_content(value)) { -+ /* invalid value */ -+ len = -1; -+ break; -+ } - apr_table_add(r->headers_out, buffer, value); - } -+ if (len < 0) { -+ /* Reset headers, but not to NULL because things below the chain expect -+ * this to be non NULL e.g. the ap_content_length_filter. -+ */ -+ r->headers_out = apr_table_make(r->pool, 1); -+ return HTTP_BAD_GATEWAY; -+ } - - if ((buf = apr_table_get(r->headers_out, "Content-Type"))) { - ap_set_content_type(r, apr_pstrdup(r->pool, buf)); diff --git a/SOURCES/httpd-2.4.37-CVE-2023-31122.patch b/SOURCES/httpd-2.4.37-CVE-2023-31122.patch deleted file mode 100644 index c2aa207..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2023-31122.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- a/modules/core/mod_macro.c 2023/10/16 06:19:16 1912992 -+++ b/modules/core/mod_macro.c 2023/10/16 06:38:32 1912993 -@@ -483,7 +483,7 @@ - for (i = 0; i < contents->nelts; i++) { - const char *errmsg; - /* copy the line and substitute macro parameters */ -- strncpy(line, ((char **) contents->elts)[i], MAX_STRING_LEN - 1); -+ apr_cpystrn(line, ((char **) contents->elts)[i], MAX_STRING_LEN); - errmsg = substitute_macro_args(line, MAX_STRING_LEN, - macro, replacements, used); - if (errmsg) { diff --git a/SOURCES/httpd-2.4.37-CVE-2023-38709.patch b/SOURCES/httpd-2.4.37-CVE-2023-38709.patch deleted file mode 100644 index 53bbbd4..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2023-38709.patch +++ /dev/null @@ -1,74 +0,0 @@ -diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c -index 393343a..16cb23c 100644 ---- a/modules/http/http_filters.c -+++ b/modules/http/http_filters.c -@@ -1348,6 +1348,9 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f, - */ - apr_table_clear(r->headers_out); - apr_table_clear(r->err_headers_out); -+ r->content_type = r->content_encoding = NULL; -+ r->content_languages = NULL; -+ r->clength = r->chunked = 0; - apr_brigade_cleanup(b); - - /* Don't recall ap_die() if we come back here (from its own internal -@@ -1364,8 +1367,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f, - APR_BRIGADE_INSERT_TAIL(b, e); - e = apr_bucket_eos_create(c->bucket_alloc); - APR_BRIGADE_INSERT_TAIL(b, e); -- r->content_type = r->content_encoding = NULL; -- r->content_languages = NULL; - ap_set_content_length(r, 0); - recursive_error = 1; - } -@@ -1392,6 +1393,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f, - if (!apr_is_empty_table(r->err_headers_out)) { - r->headers_out = apr_table_overlay(r->pool, r->err_headers_out, - r->headers_out); -+ apr_table_clear(r->err_headers_out); - } - - /* -@@ -1411,6 +1413,17 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f, - fixup_vary(r); - } - -+ -+ /* -+ * Control cachability for non-cacheable responses if not already set by -+ * some other part of the server configuration. -+ */ -+ if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) { -+ char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN); -+ ap_recent_rfc822_date(date, r->request_time); -+ apr_table_addn(r->headers_out, "Expires", date); -+ } -+ - /* - * Now remove any ETag response header field if earlier processing - * says so (such as a 'FileETag None' directive). -@@ -1423,6 +1436,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f, - basic_http_header_check(r, &protocol); - ap_set_keepalive(r); - -+ /* 204/304 responses don't have content related headers */ - if (AP_STATUS_IS_HEADER_ONLY(r->status)) { - apr_table_unset(r->headers_out, "Transfer-Encoding"); - apr_table_unset(r->headers_out, "Content-Length"); -@@ -1465,16 +1479,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f, - apr_table_setn(r->headers_out, "Content-Language", field); - } - -- /* -- * Control cachability for non-cacheable responses if not already set by -- * some other part of the server configuration. -- */ -- if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) { -- char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN); -- ap_recent_rfc822_date(date, r->request_time); -- apr_table_addn(r->headers_out, "Expires", date); -- } -- - /* This is a hack, but I can't find anyway around it. The idea is that - * we don't want to send out 0 Content-Lengths if it is a head request. - * This happens when modules try to outsmart the server, and return diff --git a/SOURCES/httpd-2.4.37-CVE-2024-38473.patch b/SOURCES/httpd-2.4.37-CVE-2024-38473.patch deleted file mode 100644 index 7c26944..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2024-38473.patch +++ /dev/null @@ -1,172 +0,0 @@ -diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c -index a6df1b8..94ec87e 100644 ---- a/modules/proxy/mod_proxy.c -+++ b/modules/proxy/mod_proxy.c -@@ -968,6 +968,7 @@ static int proxy_fixup(request_rec *r) - - return OK; /* otherwise; we've done the best we can */ - } -+ - /* Send a redirection if the request contains a hostname which is not */ - /* fully qualified, i.e. doesn't have a domain name appended. Some proxy */ - /* servers like Netscape's allow this and access hosts from the local */ -@@ -1021,7 +1022,7 @@ static int proxy_handler(request_rec *r) - ap_get_module_config(sconf, &proxy_module); - apr_array_header_t *proxies = conf->proxies; - struct proxy_remote *ents = (struct proxy_remote *) proxies->elts; -- int i, rc, access_status; -+ int rc = DECLINED, access_status, i; - int direct_connect = 0; - const char *str; - apr_int64_t maxfwd; -@@ -1036,19 +1037,28 @@ static int proxy_handler(request_rec *r) - return DECLINED; - } - -- if (!r->proxyreq) { -- /* We may have forced the proxy handler via config or .htaccess */ -- if (r->handler && -- strncmp(r->handler, "proxy:", 6) == 0 && -- strncmp(r->filename, "proxy:", 6) != 0) { -- r->proxyreq = PROXYREQ_REVERSE; -- r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); -+ /* We may have forced the proxy handler via config or .htaccess */ -+ if (!r->proxyreq && r->handler && strncmp(r->handler, "proxy:", 6) == 0) { -+ char *old_filename = r->filename; -+ -+ r->proxyreq = PROXYREQ_REVERSE; -+ r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); -+ -+ /* Still need to fixup/canonicalize r->filename */ -+ rc = ap_proxy_fixup_uds_filename(r); -+ if (rc <= OK) { -+ rc = proxy_fixup(r); - } -- else { -- return DECLINED; -+ if (rc != OK) { -+ r->filename = old_filename; -+ r->proxyreq = 0; - } -- } else if (strncmp(r->filename, "proxy:", 6) != 0) { -- return DECLINED; -+ } -+ else if (r->proxyreq && strncmp(r->filename, "proxy:", 6) == 0) { -+ rc = OK; -+ } -+ if (rc != OK) { -+ return rc; - } - - /* handle max-forwards / OPTIONS / TRACE */ -diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h -index e5c0a26..354f395 100644 ---- a/modules/proxy/mod_proxy.h -+++ b/modules/proxy/mod_proxy.h -@@ -921,6 +921,14 @@ PROXY_DECLARE(proxy_balancer_shared *) ap_proxy_find_balancershm(ap_slotmem_prov - proxy_balancer *balancer, - unsigned int *index); - -+/* -+ * Strip the UDS part of r->filename if any, and put the UDS path in -+ * r->notes ("uds_path") -+ * @param r current request -+ * @return OK if fixed up, DECLINED if not UDS, or an HTTP_XXX error -+ */ -+PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r); -+ - /** - * Get the most suitable worker and/or balancer for the request - * @param worker worker used for processing request -diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c -index 6626ea0..6244e74 100644 ---- a/modules/proxy/proxy_util.c -+++ b/modules/proxy/proxy_util.c -@@ -2098,7 +2098,7 @@ static int ap_proxy_retry_worker(const char *proxy_function, proxy_worker *worke - * were passed a UDS url (eg: from mod_proxy) and adjust uds_path - * as required. - */ --static int fix_uds_filename(request_rec *r, char **url) -+PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r) - { - char *uds_url = r->filename + 6, *origin_url; - -@@ -2106,7 +2106,6 @@ static int fix_uds_filename(request_rec *r, char **url) - !ap_cstr_casecmpn(uds_url, "unix:", 5) && - (origin_url = ap_strchr(uds_url + 5, '|'))) { - char *uds_path = NULL; -- apr_size_t url_len; - apr_uri_t urisock; - apr_status_t rv; - -@@ -2122,21 +2121,20 @@ static int fix_uds_filename(request_rec *r, char **url) - if (!uds_path) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10292) - "Invalid proxy UDS filename (%s)", r->filename); -- return 0; -+ return HTTP_BAD_REQUEST; - } - apr_table_setn(r->notes, "uds_path", uds_path); - -- /* Remove the UDS path from *url and r->filename */ -- url_len = strlen(origin_url); -- *url = apr_pstrmemdup(r->pool, origin_url, url_len); -- memcpy(uds_url, *url, url_len + 1); -- - ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, -- "*: rewrite of url due to UDS(%s): %s (%s)", -- uds_path, *url, r->filename); -+ "*: fixup UDS from %s: %s (%s)", -+ r->filename, origin_url, uds_path); -+ -+ /* Overwrite the UDS part in place */ -+ memmove(uds_url, origin_url, strlen(origin_url) + 1); -+ return OK; - } - -- return 1; -+ return DECLINED; - } - - PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, -@@ -2155,9 +2153,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, - ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, - "%s: found worker %s for %s", - (*worker)->s->scheme, (*worker)->s->name, *url); -- if (!forward && !fix_uds_filename(r, url)) { -- return HTTP_INTERNAL_SERVER_ERROR; -- } - access_status = OK; - } - else if (forward) { -@@ -2187,9 +2182,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, - * regarding the Connection header in the request. - */ - apr_table_setn(r->subprocess_env, "proxy-nokeepalive", "1"); -- if (!fix_uds_filename(r, url)) { -- return HTTP_INTERNAL_SERVER_ERROR; -- } - } - } - } -@@ -2199,6 +2191,20 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, - "all workers are busy. Unable to serve %s", *url); - access_status = HTTP_SERVICE_UNAVAILABLE; - } -+ -+ if (access_status == OK && r->proxyreq == PROXYREQ_REVERSE) { -+ int rc = ap_proxy_fixup_uds_filename(r); -+ if (ap_is_HTTP_ERROR(rc)) { -+ return rc; -+ } -+ /* If the URL has changed in r->filename, take everything after -+ * the "proxy:" prefix. -+ */ -+ if (rc == OK) { -+ *url = apr_pstrdup(r->pool, r->filename + 6); -+ } -+ } -+ - return access_status; - } - diff --git a/SOURCES/httpd-2.4.37-CVE-2024-38474+.patch b/SOURCES/httpd-2.4.37-CVE-2024-38474+.patch deleted file mode 100644 index 2228924..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2024-38474+.patch +++ /dev/null @@ -1,439 +0,0 @@ -diff --git a/docs/manual/mod/mod_rewrite.html.en b/docs/manual/mod/mod_rewrite.html.en -index 2b8ed35..b7f1c31 100644 ---- a/docs/manual/mod/mod_rewrite.html.en -+++ b/docs/manual/mod/mod_rewrite.html.en -@@ -1403,6 +1403,16 @@ cannot use $N in the substitution string! - Force the MIME-type of the target file - to be the specified type. details ... - -+ -+ UnsafeAllow3F -+ Allows substitutions from URL's that may be unsafe. -+ details ... -+ -+ -+ UnsafePrefixStat -+ Allows potentially unsafe substitutions from a leading variable or backreference to a filesystem path. -+ details ... -+ - - -

    Home directory expansion

    -diff --git a/docs/manual/rewrite/flags.html.en b/docs/manual/rewrite/flags.html.en -index 734809a..30d549d 100644 ---- a/docs/manual/rewrite/flags.html.en -+++ b/docs/manual/rewrite/flags.html.en -@@ -768,6 +768,30 @@ re-processing (including subsequent rounds of mod_rewrite processing). - The L flag can be useful in this context to end the - current round of mod_rewrite processing.

    - -+
    -+ -+
    -+

    UnsafeAllow3F

    -+ -+

    -+Setting this flag is required to allow a rewrite to continue If the -+HTTP request being written has an encoded question mark, '%3f', and the -+rewritten result has a '?' in the substiution. This protects from a malicious -+URL taking advantage of a capture and re-substitution of the encoded -+question mark.

    -+ -+
    -+
    -+

    UnsafePrefixStat

    -+ -+

    -+Setting this flag is required in server-scoped substitutions -+start with a variable or backreference and resolve to a filesystem path. -+These substitutions are not prefixed with the document root. -+This protects from a malicious URL causing the expanded substitution to -+map to an unexpected filesystem location. -+

    -+ -
    -
    -

    Available Languages:  en  | -diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c -index b71c67c..797f093 100644 ---- a/modules/mappers/mod_rewrite.c -+++ b/modules/mappers/mod_rewrite.c -@@ -172,6 +172,8 @@ static const char* really_last_key = "rewrite_really_last"; - #define RULEFLAG_QSLAST (1<<19) - #define RULEFLAG_QSNONE (1<<20) /* programattic only */ - #define RULEFLAG_ESCAPECTLS (1<<21) -+#define RULEFLAG_UNSAFE_PREFIX_STAT (1<<22) -+#define RULEFLAG_UNSAFE_ALLOW3F (1<<23) - - /* return code of the rewrite rule - * the result may be escaped - or not -@@ -179,7 +181,7 @@ static const char* really_last_key = "rewrite_really_last"; - #define ACTION_NORMAL (1<<0) - #define ACTION_NOESCAPE (1<<1) - #define ACTION_STATUS (1<<2) -- -+#define ACTION_STATUS_SET (1<<3) - - #define MAPTYPE_TXT (1<<0) - #define MAPTYPE_DBM (1<<1) -@@ -203,6 +205,7 @@ static const char* really_last_key = "rewrite_really_last"; - #define OPTION_IGNORE_INHERIT (1<<8) - #define OPTION_IGNORE_CONTEXT_INFO (1<<9) - #define OPTION_LEGACY_PREFIX_DOCROOT (1<<10) -+#define OPTION_UNSAFE_PREFIX_STAT (1<<12) - - #ifndef RAND_MAX - #define RAND_MAX 32767 -@@ -296,6 +299,14 @@ typedef enum { - CONDPAT_AP_EXPR - } pattern_type; - -+typedef enum { -+ RULE_RC_NOMATCH = 0, /* the rule didn't match */ -+ RULE_RC_MATCH = 1, /* a matching rule w/ substitution */ -+ RULE_RC_NOSUB = 2, /* a matching rule w/ no substitution */ -+ RULE_RC_STATUS_SET = 3 /* a matching rule that has set an HTTP error -+ to be returned in r->status */ -+} rule_return_type; -+ - typedef struct { - char *input; /* Input string of RewriteCond */ - char *pattern; /* the RegExp pattern string */ -@@ -927,10 +938,15 @@ static void fully_qualify_uri(request_rec *r) - return; - } - -+static int startsWith(request_rec *r, const char *haystack, const char *needle) { -+ int rc = (ap_strstr_c(haystack, needle) == haystack); -+ rewritelog((r, 5, NULL, "prefix_stat startsWith(%s, %s) %d", haystack, needle, rc)); -+ return rc; -+} - /* -- * stat() only the first segment of a path -+ * stat() only the first segment of a path, and only if it matches the output of the last matching rule - */ --static int prefix_stat(const char *path, apr_pool_t *pool) -+static int prefix_stat(request_rec *r, const char *path, apr_pool_t *pool, rewriterule_entry *lastsub) - { - const char *curpath = path; - const char *root; -@@ -964,10 +980,36 @@ static int prefix_stat(const char *path, apr_pool_t *pool) - apr_finfo_t sb; - - if (apr_stat(&sb, statpath, APR_FINFO_MIN, pool) == APR_SUCCESS) { -- return 1; -+ if (!lastsub) { -+ rewritelog((r, 3, NULL, "prefix_stat no lastsub subst prefix %s", statpath)); -+ return 1; -+ } -+ -+ rewritelog((r, 3, NULL, "prefix_stat compare statpath %s and lastsub output %s STATOK %d ", -+ statpath, lastsub->output, lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT)); -+ if (lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT) { -+ return 1; -+ } -+ else { -+ const char *docroot = ap_document_root(r); -+ const char *context_docroot = ap_context_document_root(r); -+ /* -+ * As an example, path (r->filename) is /var/foo/bar/baz.html -+ * even if the flag is not set, we can accept a rule that -+ * began with a literal /var (stapath), or if the entire path -+ * starts with the docroot or context document root -+ */ -+ if (startsWith(r, lastsub->output, statpath) || -+ startsWith(r, path, docroot) || -+ ((docroot != context_docroot) && -+ startsWith(r, path, context_docroot))) { -+ return 1; -+ } -+ } - } - } - -+ /* prefix will be added */ - return 0; - } - -@@ -3046,6 +3088,9 @@ static const char *cmd_rewriteoptions(cmd_parms *cmd, - else if (!strcasecmp(w, "legacyprefixdocroot")) { - options |= OPTION_LEGACY_PREFIX_DOCROOT; - } -+ else if (!strcasecmp(w, "UnsafePrefixStat")) { -+ options |= OPTION_UNSAFE_PREFIX_STAT; -+ } - else { - return apr_pstrcat(cmd->pool, "RewriteOptions: unknown option '", - w, "'", NULL); -@@ -3752,6 +3797,18 @@ static const char *cmd_rewriterule_setflag(apr_pool_t *p, void *_cfg, - ++error; - } - break; -+ case 'u': -+ case 'U': -+ if (!strcasecmp(key, "nsafePrefixStat")){ -+ cfg->flags |= (RULEFLAG_UNSAFE_PREFIX_STAT); -+ } -+ else if(!strcasecmp(key, "nsafeAllow3F")) { -+ cfg->flags |= RULEFLAG_UNSAFE_ALLOW3F; -+ } -+ else { -+ ++error; -+ } -+ break; - default: - ++error; - break; -@@ -4102,7 +4159,8 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p, - /* - * Apply a single RewriteRule - */ --static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) -+static rule_return_type apply_rewrite_rule(rewriterule_entry *p, -+ rewrite_ctx *ctx) - { - ap_regmatch_t regmatch[AP_MAX_REG_MATCH]; - apr_array_header_t *rewriteconds; -@@ -4153,7 +4211,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) - rc = !ap_regexec(p->regexp, ctx->uri, AP_MAX_REG_MATCH, regmatch, 0); - if (! (( rc && !(p->flags & RULEFLAG_NOTMATCH)) || - (!rc && (p->flags & RULEFLAG_NOTMATCH)) ) ) { -- return 0; -+ return RULE_RC_NOMATCH; - } - - /* It matched, wow! Now it's time to prepare the context structure for -@@ -4204,7 +4262,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) - } - } - else if (!rc) { -- return 0; -+ return RULE_RC_NOMATCH; - } - - /* If some HTTP header was involved in the condition, remember it -@@ -4224,6 +4282,15 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) - newuri = do_expand(p->output, ctx, p); - rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri, - newuri)); -+ if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) && -+ ap_strcasestr(r->unparsed_uri, "%3f") && -+ ap_strchr_c(newuri, '?')) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO() -+ "Unsafe URL with %%3f URL rewritten without " -+ "UnsafeAllow3F"); -+ r->status = HTTP_FORBIDDEN; -+ return RULE_RC_STATUS_SET; -+ } - } - - /* expand [E=var:val] and [CO=] */ -@@ -4241,7 +4308,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) - r->status = p->forced_responsecode; - } - -- return 2; -+ return RULE_RC_NOSUB; - } - - /* Now adjust API's knowledge about r->filename and r->args */ -@@ -4293,7 +4360,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) - r->filename)); - - r->filename = apr_pstrcat(r->pool, "proxy:", r->filename, NULL); -- return 1; -+ return RULE_RC_MATCH; - } - - /* If this rule is explicitly forced for HTTP redirection -@@ -4308,7 +4375,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) - r->filename)); - - r->status = p->forced_responsecode; -- return 1; -+ return RULE_RC_MATCH; - } - - /* Special Rewriting Feature: Self-Reduction -@@ -4330,7 +4397,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) - "with %s", p->forced_responsecode, r->filename)); - - r->status = p->forced_responsecode; -- return 1; -+ return RULE_RC_MATCH; - } - - /* Finally remember the forced mime-type */ -@@ -4339,7 +4406,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) - /* Puuhhhhhhhh... WHAT COMPLICATED STUFF ;_) - * But now we're done for this particular rule. - */ -- return 1; -+ return RULE_RC_MATCH; - } - - /* -@@ -4347,13 +4414,13 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) - * i.e. a list of rewrite rules - */ - static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, -- char *perdir) -+ char *perdir, rewriterule_entry **lastsub) - { - rewriterule_entry *entries; - rewriterule_entry *p; - int i; - int changed; -- int rc; -+ rule_return_type rc; - int s; - rewrite_ctx *ctx; - int round = 1; -@@ -4361,6 +4428,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, - ctx = apr_palloc(r->pool, sizeof(*ctx)); - ctx->perdir = perdir; - ctx->r = r; -+ *lastsub = NULL; - - /* - * Iterate over all existing rules -@@ -4388,7 +4456,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, - ctx->vary = NULL; - rc = apply_rewrite_rule(p, ctx); - -- if (rc) { -+ if (rc != RULE_RC_NOMATCH) { -+ -+ if (!(p->flags & RULEFLAG_NOSUB)) { -+ rewritelog((r, 2, perdir, "setting lastsub to rule with output %s", p->output)); -+ *lastsub = p; -+ } - - /* Catch looping rules with pathinfo growing unbounded */ - if ( strlen( r->filename ) > 2*r->server->limit_req_line ) { -@@ -4408,6 +4481,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, - apr_table_merge(r->headers_out, "Vary", ctx->vary); - } - -+ -+ /* Error while evaluating rule, r->status set */ -+ if (RULE_RC_STATUS_SET == rc) { -+ return ACTION_STATUS_SET; -+ } -+ - /* - * The rule sets the response code (implies match-only) - */ -@@ -4418,7 +4497,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, - /* - * Indicate a change if this was not a match-only rule. - */ -- if (rc != 2) { -+ if (rc != RULE_RC_NOSUB) { - changed = ((p->flags & RULEFLAG_NOESCAPE) - ? ACTION_NOESCAPE : ACTION_NORMAL); - } -@@ -4607,6 +4686,7 @@ static int hook_uri2file(request_rec *r) - int rulestatus; - void *skipdata; - const char *oargs; -+ rewriterule_entry *lastsub = NULL; - - /* - * retrieve the config structures -@@ -4718,7 +4798,7 @@ static int hook_uri2file(request_rec *r) - /* - * now apply the rules ... - */ -- rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL); -+ rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL, &lastsub); - apr_table_setn(r->notes, "mod_rewrite_rewritten", - apr_psprintf(r->pool,"%d",rulestatus)); - } -@@ -4756,6 +4836,9 @@ static int hook_uri2file(request_rec *r) - r->status = HTTP_OK; - return n; - } -+ else if (ACTION_STATUS_SET == rulestatus) { -+ return r->status; -+ } - - if (to_proxyreq) { - /* it should be go on as an internal proxy request */ -@@ -4875,23 +4958,29 @@ static int hook_uri2file(request_rec *r) - return HTTP_BAD_REQUEST; - } - -- /* if there is no valid prefix, we call -- * the translator from the core and -- * prefix the filename with document_root -+ /* We have r->filename as a path in a server-context rewrite without -+ * the PT flag. The historical behavior is to treat it as a verbatim -+ * filesystem path iff the first component of the path exists and is -+ * readable by httpd. Otherwise, it is interpreted as DocumentRoot -+ * relative. - * - * NOTICE: - * We cannot leave out the prefix_stat because -- * - when we always prefix with document_root -- * then no absolute path can be created, e.g. via -- * emulating a ScriptAlias directive, etc. -- * - when we always NOT prefix with document_root -+ * - If we always prefix with document_root -+ * then no absolute path can could ever be used in -+ * a substitution. e.g. emulating an Alias. -+ * - If we never prefix with document_root - * then the files under document_root have to - * be references directly and document_root - * gets never used and will be a dummy parameter - -- * this is also bad -+ * this is also bad. -+ * - Later addition: This part is questionable. -+ * If we had never prefixed, users would just -+ * need %{DOCUMENT_ROOT} in substitutions or the -+ * [PT] flag. - * - * BUT: -- * Under real Unix systems this is no problem, -+ * Under real Unix systems this is no perf problem, - * because we only do stat() on the first directory - * and this gets cached by the kernel for along time! - */ -@@ -4900,7 +4989,9 @@ static int hook_uri2file(request_rec *r) - uri_reduced = apr_table_get(r->notes, "mod_rewrite_uri_reduced"); - } - -- if (!prefix_stat(r->filename, r->pool) || uri_reduced != NULL) { -+ if (!prefix_stat(r, r->filename, r->pool, -+ conf->options & OPTION_UNSAFE_PREFIX_STAT ? NULL : lastsub) -+ || uri_reduced != NULL) { - int res; - char *tmp = r->uri; - -@@ -4945,6 +5036,7 @@ static int hook_fixup(request_rec *r) - char *ofilename, *oargs; - int is_proxyreq; - void *skipdata; -+ rewriterule_entry *lastsub; - - dconf = (rewrite_perdir_conf *)ap_get_module_config(r->per_dir_config, - &rewrite_module); -@@ -5029,7 +5121,7 @@ static int hook_fixup(request_rec *r) - /* - * now apply the rules ... - */ -- rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory); -+ rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory, &lastsub); - if (rulestatus) { - unsigned skip_absolute = is_absolute_uri(r->filename, NULL); - int to_proxyreq = 0; -@@ -5058,6 +5150,9 @@ static int hook_fixup(request_rec *r) - r->status = HTTP_OK; - return n; - } -+ else if (ACTION_STATUS_SET == rulestatus) { -+ return r->status; -+ } - - if (to_proxyreq) { - /* it should go on as an internal proxy request */ diff --git a/SOURCES/httpd-2.4.37-CVE-2024-38476.patch b/SOURCES/httpd-2.4.37-CVE-2024-38476.patch deleted file mode 100644 index 7f165e1..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2024-38476.patch +++ /dev/null @@ -1,301 +0,0 @@ - --- backported bnotes needed by this CVE fix from https://svn.apache.org/viewvc?view=revision&revision=1887384 --- modified it a little bit so it actually doesn't store bnotes into req structure to not brake compatibility --- but it stores AP_REQUEST_TRUSTED_CT info into r->notes - -diff --git a/include/http_protocol.h b/include/http_protocol.h -index 8ed77ac..81949ca 100644 ---- a/include/http_protocol.h -+++ b/include/http_protocol.h -@@ -402,6 +402,17 @@ AP_DECLARE(void) ap_clear_method_list(ap_method_list_t *l); - */ - AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct); - -+/** -+ * Set the content type for this request (r->content_type). -+ * @param r The current request -+ * @param ct The new content type -+ * @param trusted If non-zero, The content-type should come from a -+ * trusted source such as server configuration rather -+ * than application output. -+ * for the AddOutputFilterByType directive to work correctly. -+ */ -+AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted); -+ - /** - * Set the Accept-Ranges header for this response - * @param r The current request -diff --git a/include/httpd.h b/include/httpd.h -index 99f7f04..d8746c1 100644 ---- a/include/httpd.h -+++ b/include/httpd.h -@@ -645,6 +645,7 @@ struct ap_method_list_t { - /** the array used for extension methods */ - apr_array_header_t *method_list; - }; -+/** @} */ - - /** - * @defgroup module_magic Module Magic mime types -@@ -715,6 +716,31 @@ struct ap_method_list_t { - - /** @} // values_request_rec_used_path_info */ - -+#define AP_REQUEST_TRUSTED_CT "rh-bnotes-trusted-ct" -+ -+/** -+ * This is a convenience macro to ease with getting specific request -+ * binary notes. -+ */ -+#define AP_REQUEST_GET_BNOTE(r, mask) (apr_table_get(r->notes, mask) ? 1 : 0) -+ -+/** -+ * This is a convenience macro to ease with setting specific request -+ * binary notes. -+ */ -+#define AP_REQUEST_SET_BNOTE(r, mask, val) do { \ -+ if (val) \ -+ apr_table_setn(r->notes, mask, "1"); \ -+ else \ -+ apr_table_unset(r->notes, mask); \ -+} while (0) -+ -+/** -+ * Returns true if the content-type field is from a trusted source -+ */ -+#define AP_REQUEST_IS_TRUSTED_CT(r) \ -+ (!!AP_REQUEST_GET_BNOTE((r), AP_REQUEST_TRUSTED_CT)) -+/** @} */ - - /* - * Things which may vary per file-lookup WITHIN a request --- -diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c -index df862e0..d003aea 100644 ---- a/modules/http/http_protocol.c -+++ b/modules/http/http_protocol.c -@@ -1077,8 +1077,14 @@ AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct) - } - else if (!r->content_type || strcmp(r->content_type, ct)) { - r->content_type = ct; -+ AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, 0); - } - } -+AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted) -+{ -+ ap_set_content_type(r, ct); -+ AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, trusted ? AP_REQUEST_TRUSTED_CT : 0); -+} - - AP_DECLARE(void) ap_set_accept_ranges(request_rec *r) - { -diff --git a/modules/http/mod_mime.c b/modules/http/mod_mime.c -index 28c53be..4cd1c48 100644 ---- a/modules/http/mod_mime.c -+++ b/modules/http/mod_mime.c -@@ -759,7 +759,7 @@ static int find_ct(request_rec *r) - int found_metadata = 0; - - if (r->finfo.filetype == APR_DIR) { -- ap_set_content_type(r, DIR_MAGIC_TYPE); -+ ap_set_content_type_ex(r, DIR_MAGIC_TYPE, 1); - return OK; - } - -@@ -837,7 +837,7 @@ static int find_ct(request_rec *r) - if (exinfo == NULL || !exinfo->forced_type) { - if ((type = apr_hash_get(mime_type_extensions, ext, - APR_HASH_KEY_STRING)) != NULL) { -- ap_set_content_type(r, (char*) type); -+ ap_set_content_type_ex(r, (char*) type, 1); - found = 1; - } - } -@@ -846,7 +846,7 @@ static int find_ct(request_rec *r) - - /* empty string is treated as special case for RemoveType */ - if (exinfo->forced_type && *exinfo->forced_type) { -- ap_set_content_type(r, exinfo->forced_type); -+ ap_set_content_type_ex(r, exinfo->forced_type, 1); - found = 1; - } - -@@ -951,33 +951,33 @@ static int find_ct(request_rec *r) - memcpy(tmp, ctp->subtype, ctp->subtype_len); - tmp += ctp->subtype_len; - *tmp = 0; -- ap_set_content_type(r, base_content_type); -+ ap_set_content_type_ex(r, base_content_type, AP_REQUEST_IS_TRUSTED_CT(r)); - while (pp != NULL) { - if (charset && !strcmp(pp->attr, "charset")) { - if (!override) { -- ap_set_content_type(r, -+ ap_set_content_type_ex(r, - apr_pstrcat(r->pool, - r->content_type, - "; charset=", - charset, -- NULL)); -+ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); - override = 1; - } - } - else { -- ap_set_content_type(r, -+ ap_set_content_type_ex(r, - apr_pstrcat(r->pool, - r->content_type, - "; ", pp->attr, - "=", pp->val, -- NULL)); -+ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); - } - pp = pp->next; - } - if (charset && !override) { -- ap_set_content_type(r, apr_pstrcat(r->pool, r->content_type, -+ ap_set_content_type_ex(r, apr_pstrcat(r->pool, r->content_type, - "; charset=", charset, -- NULL)); -+ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); - } - } - } -diff --git a/modules/mappers/mod_actions.c b/modules/mappers/mod_actions.c -index ac9c3b7..5e398b5 100644 ---- a/modules/mappers/mod_actions.c -+++ b/modules/mappers/mod_actions.c -@@ -182,8 +182,10 @@ static int action_handler(request_rec *r) - return DECLINED; - - /* Second, check for actions (which override the method scripts) */ -- action = r->handler ? r->handler : -- ap_field_noparam(r->pool, r->content_type); -+ action = r->handler; -+ if (!action && AP_REQUEST_IS_TRUSTED_CT(r)) { -+ action = ap_field_noparam(r->pool, r->content_type); -+ } - - if (action && (t = apr_table_get(conf->action_types, action))) { - int virtual = (*t++ == '0' ? 0 : 1); -diff --git a/modules/mappers/mod_negotiation.c b/modules/mappers/mod_negotiation.c -index da68353..e91ba5f 100644 ---- a/modules/mappers/mod_negotiation.c -+++ b/modules/mappers/mod_negotiation.c -@@ -1169,7 +1169,7 @@ static int read_types_multi(negotiation_state *neg) - * might be doing. - */ - if (sub_req->handler && !sub_req->content_type) { -- ap_set_content_type(sub_req, CGI_MAGIC_TYPE); -+ ap_set_content_type_ex(sub_req, CGI_MAGIC_TYPE, 1); - } - - /* -@@ -3008,14 +3008,14 @@ static int handle_map_file(request_rec *r) - /* set MIME type and charset as negotiated */ - if (best->mime_type && *best->mime_type) { - if (best->content_charset && *best->content_charset) { -- ap_set_content_type(r, apr_pstrcat(r->pool, -+ ap_set_content_type_ex(r, apr_pstrcat(r->pool, - best->mime_type, - "; charset=", - best->content_charset, -- NULL)); -+ NULL), 1); - } - else { -- ap_set_content_type(r, apr_pstrdup(r->pool, best->mime_type)); -+ ap_set_content_type_ex(r, apr_pstrdup(r->pool, best->mime_type), 1); - } - } - -diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c -index a25c7ae..2b70d66 100644 ---- a/modules/mappers/mod_rewrite.c -+++ b/modules/mappers/mod_rewrite.c -@@ -5477,7 +5477,7 @@ static int hook_mimetype(request_rec *r) - rewritelog((r, 1, NULL, "force filename %s to have MIME-type '%s'", - r->filename, t)); - -- ap_set_content_type(r, t); -+ ap_set_content_type_ex(r, t, 1); - } - - /* handler */ -diff --git a/modules/metadata/mod_headers.c b/modules/metadata/mod_headers.c -index 1ea970d..55ab281 100644 ---- a/modules/metadata/mod_headers.c -+++ b/modules/metadata/mod_headers.c -@@ -792,14 +792,14 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers, - break; - case hdr_set: - if (!strcasecmp(hdr->header, "Content-Type")) { -- ap_set_content_type(r, process_tags(hdr, r)); -+ ap_set_content_type_ex(r, process_tags(hdr, r), 1); - } - apr_table_setn(headers, hdr->header, process_tags(hdr, r)); - break; - case hdr_setifempty: - if (NULL == apr_table_get(headers, hdr->header)) { - if (!strcasecmp(hdr->header, "Content-Type")) { -- ap_set_content_type(r, process_tags(hdr, r)); -+ ap_set_content_type_ex(r, process_tags(hdr, r), 1); - } - apr_table_setn(headers, hdr->header, process_tags(hdr, r)); - } -@@ -818,7 +818,7 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers, - const char *repl = process_regexp(hdr, r->content_type, r); - if (repl == NULL) - return 0; -- ap_set_content_type(r, repl); -+ ap_set_content_type_ex(r, repl, 1); - } - if (apr_table_get(headers, hdr->header)) { - edit_do ed; -diff --git a/modules/metadata/mod_mime_magic.c b/modules/metadata/mod_mime_magic.c -index c12529a..fe30f27 100644 ---- a/modules/metadata/mod_mime_magic.c -+++ b/modules/metadata/mod_mime_magic.c -@@ -789,7 +789,7 @@ static int magic_rsl_to_request(request_rec *r) - /* XXX: this could be done at config time I'm sure... but I'm - * confused by all this magic_rsl stuff. -djg */ - ap_content_type_tolower(tmp); -- ap_set_content_type(r, tmp); -+ ap_set_content_type_ex(r, tmp, 1); - - if (state == rsl_encoding) { - tmp = rsl_strdup(r, encoding_frag, -@@ -2326,7 +2326,7 @@ static int revision_suffix(request_rec *r) - - /* extract content type/encoding/language from sub-request */ - if (sub->content_type) { -- ap_set_content_type(r, apr_pstrdup(r->pool, sub->content_type)); -+ ap_set_content_type_ex(r, apr_pstrdup(r->pool, sub->content_type), 1); - #if MIME_MAGIC_DEBUG - ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01557) - MODNAME ": subrequest %s got %s", -diff --git a/server/config.c b/server/config.c -index f815b22..fc4d76b 100644 ---- a/server/config.c -+++ b/server/config.c -@@ -419,7 +419,7 @@ AP_CORE_DECLARE(int) ap_invoke_handler(request_rec *r) - } - - if (!r->handler) { -- if (r->content_type) { -+ if (r->content_type && AP_REQUEST_IS_TRUSTED_CT(r)) { - handler = r->content_type; - if ((p=ap_strchr_c(handler, ';')) != NULL) { - char *new_handler = (char *)apr_pmemdup(r->pool, handler, -diff --git a/server/core.c b/server/core.c -index 8575aae..82706cf 100644 ---- a/server/core.c -+++ b/server/core.c -@@ -4722,7 +4722,7 @@ static int core_override_type(request_rec *r) - /* Check for overrides with ForceType / SetHandler - */ - if (conf->mime_type && strcmp(conf->mime_type, "none")) -- ap_set_content_type(r, (char*) conf->mime_type); -+ ap_set_content_type_ex(r, (char*) conf->mime_type, 1); - - if (conf->expr_handler) { - const char *err; diff --git a/SOURCES/httpd-2.4.37-CVE-2024-38477.patch b/SOURCES/httpd-2.4.37-CVE-2024-38477.patch deleted file mode 100644 index 38dc2db..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2024-38477.patch +++ /dev/null @@ -1,29 +0,0 @@ -diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c -index 6244e74..f5c3283 100644 ---- a/modules/proxy/proxy_util.c -+++ b/modules/proxy/proxy_util.c -@@ -2406,6 +2406,13 @@ ap_proxy_determine_connection(apr_pool_t *p, request_rec *r, - apr_pstrcat(p,"URI cannot be parsed: ", *url, - NULL)); - } -+ -+ if (!uri->hostname) { -+ return ap_proxyerror(r, HTTP_BAD_REQUEST, -+ apr_pstrcat(p,"URI has no hostname: ", *url, -+ NULL)); -+ } -+ - if (!uri->port) { - uri->port = ap_proxy_port_of_scheme(uri->scheme); - } -@@ -3727,6 +3734,10 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - * way. No telling which legacy backend is relying no this. - */ - if (dconf->preserve_host == 0) { -+ if (!uri->hostname) { -+ rc = HTTP_BAD_REQUEST; -+ goto cleanup; -+ } - if (ap_strchr_c(uri->hostname, ':')) { /* if literal IPv6 address */ - if (uri->port_str && uri->port != DEFAULT_HTTP_PORT) { - buf = apr_pstrcat(p, "Host: [", uri->hostname, "]:", diff --git a/SOURCES/httpd-2.4.37-CVE-2024-39573.patch b/SOURCES/httpd-2.4.37-CVE-2024-39573.patch deleted file mode 100644 index e472b5e..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2024-39573.patch +++ /dev/null @@ -1,56 +0,0 @@ -diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c -index 797f093..114b126 100644 ---- a/modules/mappers/mod_rewrite.c -+++ b/modules/mappers/mod_rewrite.c -@@ -4311,6 +4311,32 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p, - return RULE_RC_NOSUB; - } - -+ /* Add the previously stripped per-directory location prefix, unless -+ * (1) it's an absolute URL path and -+ * (2) it's a full qualified URL -+ */ -+ if (!is_proxyreq && *newuri != '/' && !is_absolute_uri(newuri, NULL)) { -+ if (ctx->perdir) { -+ rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", -+ newuri, ctx->perdir, newuri)); -+ -+ newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL); -+ } -+ else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) { -+ /* Not an absolute URI-path and the scheme (if any) is unknown, -+ * and it won't be passed to fully_qualify_uri() below either, -+ * so add an implicit '/' prefix. This avoids potentially a common -+ * rule like "RewriteRule ^/some/path(.*) $1" that is given a path -+ * like "/some/pathscheme:..." to produce the fully qualified URL -+ * "scheme:..." which could be misinterpreted later. -+ */ -+ rewritelog((r, 3, ctx->perdir, "add root prefix: %s -> /%s", -+ newuri, newuri)); -+ -+ newuri = apr_pstrcat(r->pool, "/", newuri, NULL); -+ } -+ } -+ - /* Now adjust API's knowledge about r->filename and r->args */ - r->filename = newuri; - -@@ -4320,18 +4346,6 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p, - - splitout_queryargs(r, p->flags); - -- /* Add the previously stripped per-directory location prefix, unless -- * (1) it's an absolute URL path and -- * (2) it's a full qualified URL -- */ -- if ( ctx->perdir && !is_proxyreq && *r->filename != '/' -- && !is_absolute_uri(r->filename, NULL)) { -- rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", -- r->filename, ctx->perdir, r->filename)); -- -- r->filename = apr_pstrcat(r->pool, ctx->perdir, r->filename, NULL); -- } -- - /* If this rule is forced for proxy throughput - * (`RewriteRule ... ... [P]') then emulate mod_proxy's - * URL-to-filename handler to be sure mod_proxy is triggered diff --git a/SOURCES/httpd-2.4.37-CVE-2024-39884+.patch b/SOURCES/httpd-2.4.37-CVE-2024-39884+.patch deleted file mode 100644 index 03aae94..0000000 --- a/SOURCES/httpd-2.4.37-CVE-2024-39884+.patch +++ /dev/null @@ -1,266 +0,0 @@ -diff --git a/modules/cluster/mod_heartmonitor.c b/modules/cluster/mod_heartmonitor.c -index 965fef5..6df3bf4 100644 ---- a/modules/cluster/mod_heartmonitor.c -+++ b/modules/cluster/mod_heartmonitor.c -@@ -782,7 +782,7 @@ static int hm_handler(request_rec *r) - hmserver.seen = apr_time_now(); - hm_update_stat(ctx, &hmserver, r->pool); - -- ap_set_content_type(r, "text/plain"); -+ ap_set_content_type_ex(r, "text/plain", 1); - ap_set_content_length(r, 2); - ap_rputs("OK", r); - ap_rflush(r); -diff --git a/modules/dav/main/mod_dav.c b/modules/dav/main/mod_dav.c -index 792b514..28479b9 100644 ---- a/modules/dav/main/mod_dav.c -+++ b/modules/dav/main/mod_dav.c -@@ -323,7 +323,7 @@ static int dav_error_response(request_rec *r, int status, const char *body) - r->status = status; - r->status_line = ap_get_status_line(status); - -- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); -+ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); - - /* begin the response now... */ - ap_rvputs(r, -@@ -354,7 +354,7 @@ static int dav_error_response_tag(request_rec *r, - { - r->status = err->status; - -- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); -+ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); - - ap_rputs(DAV_XML_HEADER DEBUG_CR - "status = status; -- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); -+ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); - - /* Send the headers and actual multistatus response now... */ - ap_fputs(r->output_filters, bb, DAV_XML_HEADER DEBUG_CR -@@ -1923,7 +1923,7 @@ static int dav_method_options(request_rec *r) - - /* send the options response */ - r->status = HTTP_OK; -- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); -+ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); - - /* send the headers and response body */ - ap_rputs(DAV_XML_HEADER DEBUG_CR -@@ -3191,7 +3191,7 @@ static int dav_method_lock(request_rec *r) - (*locks_hooks->close_lockdb)(lockdb); - - r->status = HTTP_OK; -- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); -+ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); - - ap_rputs(DAV_XML_HEADER DEBUG_CR "" DEBUG_CR, r); - if (lock == NULL) -diff --git a/modules/examples/mod_example_hooks.c b/modules/examples/mod_example_hooks.c -index d818dc1..4d79b86 100644 ---- a/modules/examples/mod_example_hooks.c -+++ b/modules/examples/mod_example_hooks.c -@@ -993,7 +993,7 @@ static int x_handler(request_rec *r) - * Set the Content-type header. Note that we do not actually have to send - * the headers: this is done by the http core. - */ -- ap_set_content_type(r, "text/html"); -+ ap_set_content_type_ex(r, "text/html", 1); - /* - * If we're only supposed to send header information (HEAD request), we're - * already there. -diff --git a/modules/filters/mod_data.c b/modules/filters/mod_data.c -index d083d32..489e76c 100644 ---- a/modules/filters/mod_data.c -+++ b/modules/filters/mod_data.c -@@ -117,7 +117,7 @@ static apr_status_t data_out_filter(ap_filter_t *f, apr_bucket_brigade *bb) - } - } - -- ap_set_content_type(r, "text/plain"); -+ ap_set_content_type_ex(r, "text/plain", 1); - - } - -diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c -index a46a944..05f994c 100644 ---- a/modules/filters/mod_include.c -+++ b/modules/filters/mod_include.c -@@ -3971,7 +3971,7 @@ static int include_fixup(request_rec *r) - if (r->handler && (strcmp(r->handler, "server-parsed") == 0)) - { - if (!r->content_type || !*r->content_type) { -- ap_set_content_type(r, "text/html"); -+ ap_set_content_type_ex(r, "text/html", 1); - } - r->handler = "default-handler"; - } -diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c -index ea6bf03..8b619e8 100644 ---- a/modules/filters/mod_proxy_html.c -+++ b/modules/filters/mod_proxy_html.c -@@ -933,7 +933,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb) - ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, f->r, APLOGNO(01422) - "No i18n support found. Install mod_xml2enc if required"); - enc = XML_CHAR_ENCODING_NONE; -- ap_set_content_type(f->r, "text/html;charset=utf-8"); -+ ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1); - } - else { - /* if we wanted a non-default charset_out, insert the -@@ -949,7 +949,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb) - cenc, NULL)); - } - else /* Normal case, everything worked, utf-8 output */ -- ap_set_content_type(f->r, "text/html;charset=utf-8"); -+ ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1); - } - - ap_fputs(f->next, ctxt->bb, ctxt->cfg->doctype); -diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c -index 66cd31c..4650d18 100644 ---- a/modules/generators/mod_cgi.c -+++ b/modules/generators/mod_cgi.c -@@ -795,7 +795,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, - /* Force sub_req to be treated as a CGI request, even if ordinary - * typing rules would have called it something else. - */ -- ap_set_content_type(rr, CGI_MAGIC_TYPE); -+ ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1); - - /* Run it. */ - rr_status = ap_run_sub_req(rr); -diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c -index 102d2b3..57e119f 100644 ---- a/modules/generators/mod_cgid.c -+++ b/modules/generators/mod_cgid.c -@@ -1801,7 +1801,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, - /* Force sub_req to be treated as a CGI request, even if ordinary - * typing rules would have called it something else. - */ -- ap_set_content_type(rr, CGI_MAGIC_TYPE); -+ ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1); - - /* Run it. */ - rr_status = ap_run_sub_req(rr); -diff --git a/modules/generators/mod_info.c b/modules/generators/mod_info.c -index e5e63de..67df675 100644 ---- a/modules/generators/mod_info.c -+++ b/modules/generators/mod_info.c -@@ -777,7 +777,7 @@ static int display_info(request_rec * r) - return DECLINED; - } - -- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); -+ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); - - ap_rputs(DOCTYPE_XHTML_1_0T - "\n" -diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c -index 5bada07..2cb38c7 100644 ---- a/modules/generators/mod_status.c -+++ b/modules/generators/mod_status.c -@@ -273,7 +273,7 @@ static int status_handler(request_rec *r) - if (r->method_number != M_GET) - return DECLINED; - -- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); -+ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); - - /* - * Simple table-driven form data set parser that lets you alter the header -@@ -301,7 +301,7 @@ static int status_handler(request_rec *r) - no_table_report = 1; - break; - case STAT_OPT_AUTO: -- ap_set_content_type(r, "text/plain; charset=ISO-8859-1"); -+ ap_set_content_type_ex(r, "text/plain; charset=ISO-8859-1", 1); - short_report = 1; - break; - } -diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c -index 16cb23c..27c44b2 100644 ---- a/modules/http/http_filters.c -+++ b/modules/http/http_filters.c -@@ -1245,7 +1245,7 @@ AP_DECLARE_NONSTD(int) ap_send_http_trace(request_rec *r) - } - } - -- ap_set_content_type(r, "message/http"); -+ ap_set_content_type_ex(r, "message/http", 1); - - /* Now we recreate the request, and echo it back */ - -diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c -index 417fee6..d003aea 100644 ---- a/modules/http/http_protocol.c -+++ b/modules/http/http_protocol.c -@@ -1423,10 +1423,10 @@ AP_DECLARE(void) ap_send_error_response(request_rec *r, int recursive_error) - request_conf->suppress_charset = 1; /* avoid adding default - * charset later - */ -- ap_set_content_type(r, "text/html"); -+ ap_set_content_type_ex(r, "text/html", 1); - } - else { -- ap_set_content_type(r, "text/html; charset=iso-8859-1"); -+ ap_set_content_type_ex(r, "text/html; charset=iso-8859-1", 1); - } - - if ((status == HTTP_METHOD_NOT_ALLOWED) -diff --git a/modules/http/http_request.c b/modules/http/http_request.c -index e873aab..3521cfb 100644 ---- a/modules/http/http_request.c -+++ b/modules/http/http_request.c -@@ -709,7 +709,7 @@ AP_DECLARE(void) ap_internal_fast_redirect(request_rec *rr, request_rec *r) - r->args = rr->args; - r->finfo = rr->finfo; - r->handler = rr->handler; -- ap_set_content_type(r, rr->content_type); -+ ap_set_content_type_ex(r, rr->content_type, AP_REQUEST_IS_TRUSTED_CT(rr)); - r->content_encoding = rr->content_encoding; - r->content_languages = rr->content_languages; - r->per_dir_config = rr->per_dir_config; -diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c -index eecb3f7..b71dc98 100644 ---- a/modules/ldap/util_ldap.c -+++ b/modules/ldap/util_ldap.c -@@ -125,7 +125,7 @@ static int util_ldap_handler(request_rec *r) - st = (util_ldap_state_t *) ap_get_module_config(r->server->module_config, - &ldap_module); - -- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); -+ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); - - if (r->header_only) - return OK; -diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c -index 187a500..3e14933 100644 ---- a/modules/mappers/mod_imagemap.c -+++ b/modules/mappers/mod_imagemap.c -@@ -475,7 +475,7 @@ static int imap_reply(request_rec *r, const char *redirect) - - static void menu_header(request_rec *r, char *menu) - { -- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); -+ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); - - ap_rvputs(r, DOCTYPE_HTML_3_2, "\nMenu for ", - ap_escape_html(r->pool, r->uri), -diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c -index c599e1a..d5c20af 100644 ---- a/modules/proxy/mod_proxy_balancer.c -+++ b/modules/proxy/mod_proxy_balancer.c -@@ -1480,7 +1480,7 @@ static int balancer_handler(request_rec *r) - - if (apr_table_get(params, "xml")) { - char date[APR_RFC822_DATE_LEN]; -- ap_set_content_type(r, "text/xml"); -+ ap_set_content_type_ex(r, "text/xml", 1); - ap_rputs("<?xml version='1.0' encoding='UTF-8' ?>\n", r); - ap_rputs("<httpd:manager xmlns:httpd='http://httpd.apache.org'>\n", r); - ap_rputs(" <httpd:balancers>\n", r); diff --git a/SOURCES/httpd-2.4.37-add-SNI-support.patch b/SOURCES/httpd-2.4.37-add-SNI-support.patch deleted file mode 100644 index 8b8d9ad..0000000 --- a/SOURCES/httpd-2.4.37-add-SNI-support.patch +++ /dev/null @@ -1,92 +0,0 @@ -commit 4c0e27d7bfbf46f14dfbd5d888e56c64ad8c8de5 -Author: Tomas Korbar <tkorbar@redhat.com> -Date: Mon Sep 19 13:22:27 2022 +0200 - - Backport refactor of SNI support to httpd-2.4.37 - -diff --git a/modules/http2/mod_proxy_http2.c b/modules/http2/mod_proxy_http2.c -index a7e0dcd..31ccd32 100644 ---- a/modules/http2/mod_proxy_http2.c -+++ b/modules/http2/mod_proxy_http2.c -@@ -591,16 +591,6 @@ run_connect: - } - - if (!ctx->p_conn->data) { -- /* New conection: set a note on the connection what CN is -- * requested and what protocol we want */ -- if (ctx->p_conn->ssl_hostname) { -- ap_log_cerror(APLOG_MARK, APLOG_TRACE1, status, ctx->owner, -- "set SNI to %s for (%s)", -- ctx->p_conn->ssl_hostname, -- ctx->p_conn->hostname); -- apr_table_setn(ctx->p_conn->connection->notes, -- "proxy-request-hostname", ctx->p_conn->ssl_hostname); -- } - if (ctx->is_ssl) { - apr_table_setn(ctx->p_conn->connection->notes, - "proxy-request-alpn-protos", "h2"); -diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c -index 1b7bb81..c1c591a 100644 ---- a/modules/proxy/mod_proxy_http.c -+++ b/modules/proxy/mod_proxy_http.c -@@ -2111,19 +2111,6 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker, - req->origin->keepalive = AP_CONN_CLOSE; - } - -- /* -- * On SSL connections set a note on the connection what CN is -- * requested, such that mod_ssl can check if it is requested to do -- * so. -- * -- * https://github.com/apache/httpd/commit/7d272e2628b4ae05f68cdc74b070707250896a34 -- */ -- if (backend->ssl_hostname) { -- apr_table_setn(backend->connection->notes, -- "proxy-request-hostname", -- backend->ssl_hostname); -- } -- - /* Step Four: Send the Request - * On the off-chance that we forced a 100-Continue as a - * kinda HTTP ping test, allow for retries -diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c -index ec9a414..805820d 100644 ---- a/modules/proxy/proxy_util.c -+++ b/modules/proxy/proxy_util.c -@@ -3261,6 +3261,16 @@ static int proxy_connection_create(const char *proxy_function, - backend_addr, conn->hostname); - return HTTP_INTERNAL_SERVER_ERROR; - } -+ if (conn->ssl_hostname) { -+ /* Set a note on the connection about what CN is requested, -+ * such that mod_ssl can check if it is requested to do so. -+ */ -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, conn->connection, -+ "%s: set SNI to %s for (%s)", proxy_function, -+ conn->ssl_hostname, conn->hostname); -+ apr_table_setn(conn->connection->notes, "proxy-request-hostname", -+ conn->ssl_hostname); -+ } - } - else { - /* TODO: See if this will break FTP */ -diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c -index 4e3875a..9b4280c 100644 ---- a/modules/ssl/ssl_engine_io.c -+++ b/modules/ssl/ssl_engine_io.c -@@ -1273,7 +1273,6 @@ static apr_status_t ssl_io_filter_handshake(ssl_filter_ctx_t *filter_ctx) - ((dc->proxy->ssl_check_peer_cn != FALSE) || - (dc->proxy->ssl_check_peer_name == TRUE)) && - hostname_note) { -- apr_table_unset(c->notes, "proxy-request-hostname"); - if (!cert - || modssl_X509_match_name(c->pool, cert, hostname_note, - TRUE, server) == FALSE) { -@@ -1290,7 +1289,6 @@ static apr_status_t ssl_io_filter_handshake(ssl_filter_ctx_t *filter_ctx) - - hostname = ssl_var_lookup(NULL, server, c, NULL, - "SSL_CLIENT_S_DN_CN"); -- apr_table_unset(c->notes, "proxy-request-hostname"); - - /* Do string match or simplest wildcard match if that - * fails. */ diff --git a/SOURCES/httpd-2.4.37-balancer-failover.patch b/SOURCES/httpd-2.4.37-balancer-failover.patch deleted file mode 100644 index ca691f7..0000000 --- a/SOURCES/httpd-2.4.37-balancer-failover.patch +++ /dev/null @@ -1,225 +0,0 @@ -diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c -index ec1e042..2c0500f 100644 ---- a/modules/proxy/mod_proxy_http.c -+++ b/modules/proxy/mod_proxy_http.c -@@ -310,16 +310,18 @@ static int stream_reqbody_read(proxy_http_req_t *req, apr_bucket_brigade *bb, - return OK; - } - --static int stream_reqbody(proxy_http_req_t *req, rb_methods rb_method) -+static int stream_reqbody(proxy_http_req_t *req) - { - request_rec *r = req->r; - int seen_eos = 0, rv = OK; - apr_size_t hdr_len; - char chunk_hdr[20]; /* must be here due to transient bucket. */ -+ conn_rec *origin = req->origin; - proxy_conn_rec *p_conn = req->backend; - apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc; - apr_bucket_brigade *header_brigade = req->header_brigade; - apr_bucket_brigade *input_brigade = req->input_brigade; -+ rb_methods rb_method = req->rb_method; - apr_off_t bytes, bytes_streamed = 0; - apr_bucket *e; - -@@ -333,7 +335,7 @@ static int stream_reqbody(proxy_http_req_t *req, rb_methods rb_method) - } - - if (!APR_BRIGADE_EMPTY(input_brigade)) { -- /* If this brigade contains EOS, either stop or remove it. */ -+ /* If this brigade contains EOS, remove it and be done. */ - if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) { - seen_eos = 1; - -@@ -375,7 +377,8 @@ static int stream_reqbody(proxy_http_req_t *req, rb_methods rb_method) - APR_BRIGADE_INSERT_TAIL(input_brigade, e); - } - } -- else if (bytes_streamed > req->cl_val) { -+ else if (rb_method == RB_STREAM_CL -+ && bytes_streamed > req->cl_val) { - /* C-L < bytes streamed?!? - * We will error out after the body is completely - * consumed, but we can't stream more bytes at the -@@ -407,7 +410,7 @@ static int stream_reqbody(proxy_http_req_t *req, rb_methods rb_method) - APR_BRIGADE_PREPEND(input_brigade, header_brigade); - - /* Flush here on EOS because we won't stream_reqbody_read() again */ -- rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, req->origin, -+ rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, - input_brigade, seen_eos); - if (rv != OK) { - return rv; -@@ -454,10 +457,6 @@ static int spool_reqbody_cl(proxy_http_req_t *req, apr_off_t *bytes_spooled) - /* If this brigade contains EOS, either stop or remove it. */ - if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) { - seen_eos = 1; -- -- /* We can't pass this EOS to the output_filters. */ -- e = APR_BRIGADE_LAST(input_brigade); -- apr_bucket_delete(e); - } - - apr_brigade_length(input_brigade, 1, &bytes); -@@ -644,7 +643,18 @@ static int ap_proxy_http_prefetch(proxy_http_req_t *req, - */ - temp_brigade = apr_brigade_create(p, bucket_alloc); - block = req->prefetch_nonblocking ? APR_NONBLOCK_READ : APR_BLOCK_READ; -- do { -+ -+ /* Account for saved input, if any. */ -+ apr_brigade_length(input_brigade, 0, &bytes_read); -+ -+ /* Ensure we don't hit a wall where we have a buffer too small -+ * for ap_get_brigade's filters to fetch us another bucket, -+ * surrender once we hit 80 bytes less than MAX_MEM_SPOOL -+ * (an arbitrary value). -+ */ -+ while (bytes_read < MAX_MEM_SPOOL - 80 -+ && (APR_BRIGADE_EMPTY(input_brigade) -+ || !APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade)))) { - status = ap_get_brigade(r->input_filters, temp_brigade, - AP_MODE_READBYTES, block, - MAX_MEM_SPOOL - bytes_read); -@@ -686,15 +696,7 @@ static int ap_proxy_http_prefetch(proxy_http_req_t *req, - c->client_ip, c->remote_host ? c->remote_host: ""); - return HTTP_INTERNAL_SERVER_ERROR; - } -- -- /* Ensure we don't hit a wall where we have a buffer too small -- * for ap_get_brigade's filters to fetch us another bucket, -- * surrender once we hit 80 bytes less than MAX_MEM_SPOOL -- * (an arbitrary value.) -- */ -- } while ((bytes_read < MAX_MEM_SPOOL - 80) -- && !APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade)) -- && !req->prefetch_nonblocking); -+ } - - /* Use chunked request body encoding or send a content-length body? - * -@@ -838,35 +840,21 @@ static int ap_proxy_http_request(proxy_http_req_t *req) - { - int rv; - request_rec *r = req->r; -- apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc; -- apr_bucket_brigade *header_brigade = req->header_brigade; -- apr_bucket_brigade *input_brigade = req->input_brigade; - - /* send the request header/body, if any. */ - switch (req->rb_method) { -+ case RB_SPOOL_CL: - case RB_STREAM_CL: - case RB_STREAM_CHUNKED: - if (req->do_100_continue) { -- rv = ap_proxy_pass_brigade(bucket_alloc, r, req->backend, -- req->origin, header_brigade, 1); -+ rv = ap_proxy_pass_brigade(req->bucket_alloc, r, req->backend, -+ req->origin, req->header_brigade, 1); - } - else { -- rv = stream_reqbody(req, req->rb_method); -+ rv = stream_reqbody(req); - } - break; - -- case RB_SPOOL_CL: -- /* Prefetch has built the header and spooled the whole body; -- * if we don't expect 100-continue we can flush both all at once, -- * otherwise flush the header only. -- */ -- if (!req->do_100_continue) { -- APR_BRIGADE_CONCAT(header_brigade, input_brigade); -- } -- rv = ap_proxy_pass_brigade(bucket_alloc, r, req->backend, -- req->origin, header_brigade, 1); -- break; -- - default: - /* shouldn't be possible */ - rv = HTTP_INTERNAL_SERVER_ERROR; -@@ -1577,15 +1565,10 @@ int ap_proxy_http_process_response(proxy_http_req_t *req) - - /* Send the request body (fully). */ - switch(req->rb_method) { -+ case RB_SPOOL_CL: - case RB_STREAM_CL: - case RB_STREAM_CHUNKED: -- status = stream_reqbody(req, req->rb_method); -- break; -- case RB_SPOOL_CL: -- /* Prefetch has spooled the whole body, flush it. */ -- status = ap_proxy_pass_brigade(req->bucket_alloc, r, -- backend, origin, -- req->input_brigade, 1); -+ status = stream_reqbody(req); - break; - default: - /* Shouldn't happen */ -@@ -1940,6 +1923,7 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker, - const char *u; - proxy_http_req_t *req = NULL; - proxy_conn_rec *backend = NULL; -+ apr_bucket_brigade *input_brigade = NULL; - int is_ssl = 0; - conn_rec *c = r->connection; - proxy_dir_conf *dconf; -@@ -2005,8 +1989,20 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker, - - dconf = ap_get_module_config(r->per_dir_config, &proxy_module); - -+ /* We possibly reuse input data prefetched in previous call(s), e.g. for a -+ * balancer fallback scenario, and in this case the 100 continue settings -+ * should be consistent between balancer members. If not, we need to ignore -+ * Proxy100Continue on=>off once we tried to prefetch already, otherwise -+ * the HTTP_IN filter won't send 100 Continue for us anymore, and we might -+ * deadlock with the client waiting for each other. Note that off=>on is -+ * not an issue because in this case r->expecting_100 is false (the 100 -+ * Continue is out already), but we make sure that prefetch will be -+ * nonblocking to avoid passing more time there. -+ */ -+ apr_pool_userdata_get((void **)&input_brigade, "proxy-req-input", p); -+ - /* Should we handle end-to-end or ping 100-continue? */ -- if ((r->expecting_100 && dconf->forward_100_continue) -+ if ((r->expecting_100 && (dconf->forward_100_continue || input_brigade)) - || PROXY_DO_100_CONTINUE(worker, r)) { - /* We need to reset r->expecting_100 or prefetching will cause - * ap_http_filter() to send "100 Continue" response by itself. So -@@ -2023,7 +2019,8 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker, - /* Should we block while prefetching the body or try nonblocking and flush - * data to the backend ASAP? - */ -- else if (apr_table_get(r->subprocess_env, "proxy-prefetch-nonblocking")) { -+ else if (input_brigade || apr_table_get(r->subprocess_env, -+ "proxy-prefetch-nonblocking")) { - req->prefetch_nonblocking = 1; - } - -@@ -2048,6 +2045,17 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker, - sizeof(req->server_portstr)))) - goto cleanup; - -+ /* The header is always (re-)built since it depends on worker settings, -+ * but the body can be fetched only once (even partially), so it's saved -+ * in between proxy_http_handler() calls should we come back here. -+ */ -+ req->header_brigade = apr_brigade_create(p, req->bucket_alloc); -+ if (input_brigade == NULL) { -+ input_brigade = apr_brigade_create(p, req->bucket_alloc); -+ apr_pool_userdata_setn(input_brigade, "proxy-req-input", NULL, p); -+ } -+ req->input_brigade = input_brigade; -+ - /* Prefetch (nonlocking) the request body so to increase the chance to get - * the whole (or enough) body and determine Content-Length vs chunked or - * spooled. By doing this before connecting or reusing the backend, we want -@@ -2058,8 +2066,6 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker, - * to reduce to the minimum the unavoidable local is_socket_connected() vs - * remote keepalive race condition. - */ -- req->input_brigade = apr_brigade_create(p, req->bucket_alloc); -- req->header_brigade = apr_brigade_create(p, req->bucket_alloc); - if ((status = ap_proxy_http_prefetch(req, uri, locurl)) != OK) - goto cleanup; - diff --git a/SOURCES/httpd-2.4.37-fips-segfault.patch b/SOURCES/httpd-2.4.37-fips-segfault.patch deleted file mode 100644 index 6039980..0000000 --- a/SOURCES/httpd-2.4.37-fips-segfault.patch +++ /dev/null @@ -1,42 +0,0 @@ -diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c -index 37947e7..b50c259 100644 ---- a/modules/ssl/mod_ssl.c -+++ b/modules/ssl/mod_ssl.c -@@ -331,9 +331,6 @@ static apr_status_t ssl_cleanup_pre_config(void *data) - /* - * Try to kill the internals of the SSL library. - */ --#ifdef HAVE_FIPS -- FIPS_mode_set(0); --#endif - /* Corresponds to OBJ_create()s */ - OBJ_cleanup(); - /* Corresponds to OPENSSL_load_builtin_modules() */ -diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c -index 5063a72..21e41e2 100644 ---- a/modules/ssl/ssl_engine_init.c -+++ b/modules/ssl/ssl_engine_init.c -@@ -183,6 +183,14 @@ int ssl_is_challenge(conn_rec *c, const char *servername, - return 0; - } - -+#ifdef HAVE_FIPS -+static apr_status_t ssl_fips_cleanup(void *data) -+{ -+ FIPS_mode_set(0); -+ return APR_SUCCESS; -+} -+#endif -+ - /* - * Per-module initialization - */ -@@ -316,6 +324,8 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog, - if (FIPS_mode_set(1)) { - ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, s, APLOGNO(01884) - "Operating in SSL FIPS mode"); -+ apr_pool_cleanup_register(p, NULL, ssl_fips_cleanup, -+ apr_pool_cleanup_null); - } - else { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01885) "FIPS mode failed"); diff --git a/SOURCES/httpd-2.4.37-hcheck-mem-issues.patch b/SOURCES/httpd-2.4.37-hcheck-mem-issues.patch deleted file mode 100644 index 810b9f2..0000000 --- a/SOURCES/httpd-2.4.37-hcheck-mem-issues.patch +++ /dev/null @@ -1,199 +0,0 @@ -diff --git a/modules/proxy/mod_proxy_hcheck.c b/modules/proxy/mod_proxy_hcheck.c -index bd89779..d7c0a68 100644 ---- a/modules/proxy/mod_proxy_hcheck.c -+++ b/modules/proxy/mod_proxy_hcheck.c -@@ -33,7 +33,6 @@ module AP_MODULE_DECLARE_DATA proxy_hcheck_module; - #endif - #else - #define HC_USE_THREADS 0 --typedef void apr_thread_pool_t; - #endif - - typedef struct { -@@ -73,7 +72,7 @@ typedef struct { - proxy_balancer *balancer; - proxy_worker *worker; - proxy_worker *hc; -- apr_time_t now; -+ apr_time_t *now; - } baton_t; - - static void *hc_create_config(apr_pool_t *p, server_rec *s) -@@ -89,7 +88,10 @@ static void *hc_create_config(apr_pool_t *p, server_rec *s) - } - - static ap_watchdog_t *watchdog; --static int tpsize = HC_THREADPOOL_SIZE; -+#if HC_USE_THREADS -+static apr_thread_pool_t *hctp; -+static int tpsize; -+#endif - - /* - * This serves double duty by not only validating (and creating) -@@ -825,29 +827,28 @@ static void * APR_THREAD_FUNC hc_check(apr_thread_t *thread, void *b) - server_rec *s = baton->ctx->s; - proxy_worker *worker = baton->worker; - proxy_worker *hc = baton->hc; -- apr_time_t now = baton->now; -+ apr_time_t now; - apr_status_t rv; - - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(03256) - "%sHealth checking %s", (thread ? "Threaded " : ""), - worker->s->name); - -- worker->s->updated = now; - if (hc->s->method == TCP) { - rv = hc_check_tcp(baton); - } - else { - rv = hc_check_http(baton); - } -+ -+ now = apr_time_now(); - if (rv == APR_ENOTIMPL) { - ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(03257) - "Somehow tried to use unimplemented hcheck method: %d", - (int)hc->s->method); -- apr_pool_destroy(baton->ptemp); -- return NULL; - } - /* what state are we in ? */ -- if (PROXY_WORKER_IS_HCFAILED(worker)) { -+ else if (PROXY_WORKER_IS_HCFAILED(worker)) { - if (rv == APR_SUCCESS) { - worker->s->pcount += 1; - if (worker->s->pcount >= worker->s->passes) { -@@ -860,7 +861,8 @@ static void * APR_THREAD_FUNC hc_check(apr_thread_t *thread, void *b) - - } - } -- } else { -+ } -+ else { - if (rv != APR_SUCCESS) { - worker->s->error_time = now; - worker->s->fcount += 1; -@@ -873,7 +875,12 @@ static void * APR_THREAD_FUNC hc_check(apr_thread_t *thread, void *b) - } - } - } -+ if (baton->now) { -+ *baton->now = now; -+ } - apr_pool_destroy(baton->ptemp); -+ worker->s->updated = now; -+ - return NULL; - } - -@@ -881,12 +888,10 @@ static apr_status_t hc_watchdog_callback(int state, void *data, - apr_pool_t *pool) - { - apr_status_t rv = APR_SUCCESS; -- apr_time_t now = apr_time_now(); - proxy_balancer *balancer; - sctx_t *ctx = (sctx_t *)data; - server_rec *s = ctx->s; - proxy_server_conf *conf; -- static apr_thread_pool_t *hctp = NULL; - - switch (state) { - case AP_WATCHDOG_STATE_STARTING: -@@ -913,7 +918,6 @@ static apr_status_t hc_watchdog_callback(int state, void *data, - "Skipping apr_thread_pool_create()"); - hctp = NULL; - } -- - #endif - break; - -@@ -929,45 +933,53 @@ static apr_status_t hc_watchdog_callback(int state, void *data, - ctx->s = s; - for (i = 0; i < conf->balancers->nelts; i++, balancer++) { - int n; -+ apr_time_t now; - proxy_worker **workers; - proxy_worker *worker; - /* Have any new balancers or workers been added dynamically? */ - ap_proxy_sync_balancer(balancer, s, conf); - workers = (proxy_worker **)balancer->workers->elts; -+ now = apr_time_now(); - for (n = 0; n < balancer->workers->nelts; n++) { - worker = *workers; - if (!PROXY_WORKER_IS(worker, PROXY_WORKER_STOPPED) && -- (worker->s->method != NONE) && -- (now > worker->s->updated + worker->s->interval)) { -+ (worker->s->method != NONE) && -+ (worker->s->updated != 0) && -+ (now > worker->s->updated + worker->s->interval)) { - baton_t *baton; - apr_pool_t *ptemp; -+ - ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, - "Checking %s worker: %s [%d] (%pp)", balancer->s->name, - worker->s->name, worker->s->method, worker); - - if ((rv = hc_init_worker(ctx, worker)) != APR_SUCCESS) { -+ worker->s->updated = now; - return rv; - } -- /* This pool must last the lifetime of the (possible) thread */ -+ worker->s->updated = 0; -+ -+ /* This pool has the lifetime of the check */ - apr_pool_create(&ptemp, ctx->p); - apr_pool_tag(ptemp, "hc_request"); -- baton = apr_palloc(ptemp, sizeof(baton_t)); -+ baton = apr_pcalloc(ptemp, sizeof(baton_t)); - baton->ctx = ctx; -- baton->now = now; - baton->balancer = balancer; - baton->worker = worker; - baton->ptemp = ptemp; - baton->hc = hc_get_hcworker(ctx, worker, ptemp); -- -- if (!hctp) { -- hc_check(NULL, baton); -- } - #if HC_USE_THREADS -- else { -- rv = apr_thread_pool_push(hctp, hc_check, (void *)baton, -- APR_THREAD_TASK_PRIORITY_NORMAL, NULL); -+ if (hctp) { -+ apr_thread_pool_push(hctp, hc_check, (void *)baton, -+ APR_THREAD_TASK_PRIORITY_NORMAL, -+ NULL); - } -+ else - #endif -+ { -+ baton->now = &now; -+ hc_check(NULL, baton); -+ } - } - workers++; - } -@@ -986,9 +998,9 @@ static apr_status_t hc_watchdog_callback(int state, void *data, - ap_log_error(APLOG_MARK, APLOG_INFO, rv, s, APLOGNO(03315) - "apr_thread_pool_destroy() failed"); - } -+ hctp = NULL; - } - #endif -- hctp = NULL; - break; - } - return rv; -@@ -996,7 +1008,10 @@ static apr_status_t hc_watchdog_callback(int state, void *data, - static int hc_pre_config(apr_pool_t *pconf, apr_pool_t *plog, - apr_pool_t *ptemp) - { -+#if HC_USE_THREADS -+ hctp = NULL; - tpsize = HC_THREADPOOL_SIZE; -+#endif - return OK; - } - static int hc_post_config(apr_pool_t *p, apr_pool_t *plog, diff --git a/SOURCES/httpd-2.4.37-htcacheclean-dont-break.patch b/SOURCES/httpd-2.4.37-htcacheclean-dont-break.patch deleted file mode 100644 index 17cc64e..0000000 --- a/SOURCES/httpd-2.4.37-htcacheclean-dont-break.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/support/htcacheclean.c b/support/htcacheclean.c -index 8692377..fde34c9 100644 ---- a/support/htcacheclean.c -+++ b/support/htcacheclean.c -@@ -557,8 +557,6 @@ static int list_urls(char *path, apr_pool_t *pool, apr_off_t round) - } - } - } -- -- break; - } - } - } diff --git a/SOURCES/httpd-2.4.37-mod-md-mod-ssl-hooks.patch b/SOURCES/httpd-2.4.37-mod-md-mod-ssl-hooks.patch deleted file mode 100644 index d7df65a..0000000 --- a/SOURCES/httpd-2.4.37-mod-md-mod-ssl-hooks.patch +++ /dev/null @@ -1,544 +0,0 @@ -diff --git a/modules/ssl/mod_ssl.h b/modules/ssl/mod_ssl.h -index 24a65a0..a360911 100644 ---- a/modules/ssl/mod_ssl.h -+++ b/modules/ssl/mod_ssl.h -@@ -29,6 +29,7 @@ - #include "httpd.h" - #include "http_config.h" - #include "apr_optional.h" -+#include "apr_tables.h" /* for apr_array_header_t */ - - /* Create a set of SSL_DECLARE(type), SSL_DECLARE_NONSTD(type) and - * SSL_DECLARE_DATA with appropriate export and import tags for the platform -@@ -86,6 +87,34 @@ APR_DECLARE_OPTIONAL_FN(int, ssl_engine_disable, (conn_rec *)); - APR_DECLARE_OPTIONAL_FN(int, ssl_engine_set, (conn_rec *, - ap_conf_vector_t *, - int proxy, int enable)); -+ -+/* Check for availability of new hooks */ -+#define SSL_CERT_HOOKS -+#ifdef SSL_CERT_HOOKS -+ -+/** Lets others add certificate and key files to the given server. -+ * For each cert a key must also be added. -+ * @param cert_file and array of const char* with the path to the certificate chain -+ * @param key_file and array of const char* with the path to the private key file -+ */ -+APR_DECLARE_EXTERNAL_HOOK(ssl, SSL, int, add_cert_files, -+ (server_rec *s, apr_pool_t *p, -+ apr_array_header_t *cert_files, -+ apr_array_header_t *key_files)) -+ -+/** In case no certificates are available for a server, this -+ * lets other modules add a fallback certificate for the time -+ * being. Regular requests against this server will be answered -+ * with a 503. -+ * @param cert_file and array of const char* with the path to the certificate chain -+ * @param key_file and array of const char* with the path to the private key file -+ */ -+APR_DECLARE_EXTERNAL_HOOK(ssl, SSL, int, add_fallback_cert_files, -+ (server_rec *s, apr_pool_t *p, -+ apr_array_header_t *cert_files, -+ apr_array_header_t *key_files)) -+ -+#endif /* SSL_CERT_HOOKS */ - - #endif /* __MOD_SSL_H__ */ - /** @} */ -diff --git a/modules/ssl/mod_ssl_openssl.h b/modules/ssl/mod_ssl_openssl.h -index 0fa654a..d4f684f 100644 ---- a/modules/ssl/mod_ssl_openssl.h -+++ b/modules/ssl/mod_ssl_openssl.h -@@ -69,5 +69,45 @@ APR_DECLARE_EXTERNAL_HOOK(ssl, SSL, int, pre_handshake, - APR_DECLARE_EXTERNAL_HOOK(ssl, SSL, int, proxy_post_handshake, - (conn_rec *c, SSL *ssl)) - -+/** On TLS connections that do not relate to a configured virtual host, -+ * allow other modules to provide a X509 certificate and EVP_PKEY to -+ * be used on the connection. This first hook which does not -+ * return DECLINED will determine the outcome. */ -+APR_DECLARE_EXTERNAL_HOOK(ssl, SSL, int, answer_challenge, -+ (conn_rec *c, const char *server_name, -+ X509 **pcert, EVP_PKEY **pkey)) -+ -+/** During post_config phase, ask around if someone wants to provide -+ * OCSP stapling status information for the given cert (with the also -+ * provided issuer certificate). The first hook which does not -+ * return DECLINED promises to take responsibility (and respond -+ * in later calls via hook ssl_get_stapling_status). -+ * If no hook takes over, mod_ssl's own stapling implementation will -+ * be applied (if configured). -+ */ -+APR_DECLARE_EXTERNAL_HOOK(ssl, SSL, int, init_stapling_status, -+ (server_rec *s, apr_pool_t *p, -+ X509 *cert, X509 *issuer)) -+ -+/** Anyone answering positive to ssl_init_stapling_status for a -+ * certificate, needs to register here and supply the actual OCSP stapling -+ * status data (OCSP_RESP) for a new connection. -+ * A hook supplying the response data must return APR_SUCCESS. -+ * The data is returned in DER encoded bytes via pder and pderlen. The -+ * returned pointer may be NULL, which indicates that data is (currently) -+ * unavailable. -+ * If DER data is returned, it MUST come from a response with -+ * status OCSP_RESPONSE_STATUS_SUCCESSFUL and V_OCSP_CERTSTATUS_GOOD -+ * or V_OCSP_CERTSTATUS_REVOKED, not V_OCSP_CERTSTATUS_UNKNOWN. This means -+ * errors in OCSP retrieval are to be handled/logged by the hook and -+ * are not done by mod_ssl. -+ * Any DER bytes returned MUST be allocated via malloc() and ownership -+ * passes to mod_ssl. Meaning, the hook must return a malloced copy of -+ * the data it has. mod_ssl (or OpenSSL) will free it. -+ */ -+APR_DECLARE_EXTERNAL_HOOK(ssl, SSL, int, get_stapling_status, -+ (unsigned char **pder, int *pderlen, -+ conn_rec *c, server_rec *s, X509 *cert)) -+ - #endif /* __MOD_SSL_OPENSSL_H__ */ - /** @} */ -diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c -index 21e41e2..ef631c1 100644 ---- a/modules/ssl/ssl_engine_init.c -+++ b/modules/ssl/ssl_engine_init.c -@@ -36,6 +36,25 @@ APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, init_server, - (server_rec *s,apr_pool_t *p,int is_proxy,SSL_CTX *ctx), - (s,p,is_proxy,ctx), OK, DECLINED) - -+APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, add_cert_files, -+ (server_rec *s, apr_pool_t *p, -+ apr_array_header_t *cert_files, apr_array_header_t *key_files), -+ (s, p, cert_files, key_files), -+ OK, DECLINED) -+ -+APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, add_fallback_cert_files, -+ (server_rec *s, apr_pool_t *p, -+ apr_array_header_t *cert_files, apr_array_header_t *key_files), -+ (s, p, cert_files, key_files), -+ OK, DECLINED) -+ -+APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, answer_challenge, -+ (conn_rec *c, const char *server_name, -+ X509 **pcert, EVP_PKEY **pkey), -+ (c, server_name, pcert, pkey), -+ DECLINED, DECLINED) -+ -+ - /* _________________________________________________________________ - ** - ** Module Initialization -@@ -165,18 +184,18 @@ static void ssl_add_version_components(apr_pool_t *p, - modver, AP_SERVER_BASEVERSION, incver); - } - --/**************************************************************************************************/ --/* Managed Domains Interface */ -- --static APR_OPTIONAL_FN_TYPE(md_is_managed) *md_is_managed; --static APR_OPTIONAL_FN_TYPE(md_get_certificate) *md_get_certificate; --static APR_OPTIONAL_FN_TYPE(md_is_challenge) *md_is_challenge; -+/* _________________________________________________________________ -+** -+** Let other answer special connection attempts. -+** Used in ACME challenge handling by mod_md. -+** _________________________________________________________________ -+*/ - - int ssl_is_challenge(conn_rec *c, const char *servername, - X509 **pcert, EVP_PKEY **pkey) - { -- if (md_is_challenge) { -- return md_is_challenge(c, servername, pcert, pkey); -+ if (APR_SUCCESS == ssl_run_answer_challenge(c, servername, pcert, pkey)) { -+ return 1; - } - *pcert = NULL; - *pkey = NULL; -@@ -231,16 +250,6 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog, - ssl_config_global_create(base_server); /* just to avoid problems */ - ssl_config_global_fix(mc); - -- /* Initialize our interface to mod_md, if it is loaded -- */ -- md_is_managed = APR_RETRIEVE_OPTIONAL_FN(md_is_managed); -- md_get_certificate = APR_RETRIEVE_OPTIONAL_FN(md_get_certificate); -- md_is_challenge = APR_RETRIEVE_OPTIONAL_FN(md_is_challenge); -- if (!md_is_managed || !md_get_certificate) { -- md_is_managed = NULL; -- md_get_certificate = NULL; -- } -- - /* - * try to fix the configuration and open the dedicated SSL - * logfile as early as possible -@@ -1392,8 +1401,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s, - * loaded via SSLOpenSSLConfCmd Certificate), so for 1.0.2 and - * later, we defer to the code in ssl_init_server_ctx. - */ -- if ((mctx->stapling_enabled == TRUE) && -- !ssl_stapling_init_cert(s, p, ptemp, mctx, cert)) { -+ if (!ssl_stapling_init_cert(s, p, ptemp, mctx, cert)) { - ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02567) - "Unable to configure certificate %s for stapling", - key_id); -@@ -1788,11 +1796,13 @@ static apr_status_t ssl_init_server_ctx(server_rec *s, - apr_array_header_t *pphrases) - { - apr_status_t rv; -+ modssl_pk_server_t *pks; - #ifdef HAVE_SSL_CONF_CMD - ssl_ctx_param_t *param = (ssl_ctx_param_t *)sc->server->ssl_ctx_param->elts; - SSL_CONF_CTX *cctx = sc->server->ssl_ctx_config; - int i; - #endif -+ int n; - - /* - * Check for problematic re-initializations -@@ -1804,50 +1814,24 @@ static apr_status_t ssl_init_server_ctx(server_rec *s, - return APR_EGENERAL; - } - -- ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(10083) -- "Init: (%s) mod_md support is %s.", ssl_util_vhostid(p, s), -- md_is_managed? "available" : "unavailable"); -- if (md_is_managed && md_is_managed(s)) { -- modssl_pk_server_t *const pks = sc->server->pks; -- if (pks->cert_files->nelts > 0 || pks->key_files->nelts > 0) { -- ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(10084) -- "Init: (%s) You configured certificate/key files on this host, but " -- "is is covered by a Managed Domain. You need to remove these directives " -- "for the Managed Domain to take over.", ssl_util_vhostid(p, s)); -- } -- else { -- const char *key_file, *cert_file, *chain_file; -- -- key_file = cert_file = chain_file = NULL; -- -- if (md_get_certificate) { -- rv = md_get_certificate(s, p, &key_file, &cert_file); -- } -- else { -- rv = APR_ENOTIMPL; -- } -- -- if (key_file && cert_file) { -- ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s, -- "%s: installing key=%s, cert=%s, chain=%s", -- ssl_util_vhostid(p, s), key_file, cert_file, chain_file); -- APR_ARRAY_PUSH(pks->key_files, const char *) = key_file; -- APR_ARRAY_PUSH(pks->cert_files, const char *) = cert_file; -- sc->server->cert_chain = chain_file; -- } -- -- if (APR_STATUS_IS_EAGAIN(rv)) { -- /* Managed Domain not ready yet. This is not a reason to fail the config */ -- ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(10085) -- "Init: %s will respond with '503 Service Unavailable' for now. This " -- "host is part of a Managed Domain, but no SSL certificate is " -- "available (yet).", ssl_util_vhostid(p, s)); -- pks->service_unavailable = 1; -- } -- else if (rv != APR_SUCCESS) { -- return rv; -- } -- } -+ /* Allow others to provide certificate files */ -+ pks = sc->server->pks; -+ n = pks->cert_files->nelts; -+ ssl_run_add_cert_files(s, p, pks->cert_files, pks->key_files); -+ -+ if (n < pks->cert_files->nelts) { -+ /* this overrides any old chain configuration */ -+ sc->server->cert_chain = NULL; -+ } -+ -+ if (apr_is_empty_array(pks->cert_files) && !sc->server->cert_chain) { -+ ssl_run_add_fallback_cert_files(s, p, pks->cert_files, pks->key_files); -+ -+ pks->service_unavailable = 1; -+ ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(10085) -+ "Init: %s will respond with '503 Service Unavailable' for now. There " -+ "are no SSL certificates configured and no other module contributed any.", -+ ssl_util_vhostid(p, s)); - } - - if ((rv = ssl_init_ctx(s, p, ptemp, sc->server)) != APR_SUCCESS) { -@@ -1900,7 +1884,7 @@ static apr_status_t ssl_init_server_ctx(server_rec *s, - * (late) point makes sure that we catch both certificates loaded - * via SSLCertificateFile and SSLOpenSSLConfCmd Certificate. - */ -- if (sc->server->stapling_enabled == TRUE) { -+ do { - X509 *cert; - int i = 0; - int ret = SSL_CTX_set_current_cert(sc->server->ssl_ctx, -@@ -1917,7 +1901,7 @@ static apr_status_t ssl_init_server_ctx(server_rec *s, - SSL_CERT_SET_NEXT); - i++; - } -- } -+ } while(0); - #endif - - #ifdef HAVE_TLS_SESSION_TICKETS -diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c -index e6a9f67..a5e86e4 100644 ---- a/modules/ssl/ssl_engine_kernel.c -+++ b/modules/ssl/ssl_engine_kernel.c -@@ -2303,6 +2303,37 @@ void ssl_callback_Info(const SSL *ssl, int where, int rc) - } - - #ifdef HAVE_TLSEXT -+ -+static apr_status_t set_challenge_creds(conn_rec *c, const char *servername, -+ SSL *ssl, X509 *cert, EVP_PKEY *key) -+{ -+ SSLConnRec *sslcon = myConnConfig(c); -+ -+ sslcon->service_unavailable = 1; -+ if ((SSL_use_certificate(ssl, cert) < 1)) { -+ ap_log_cerror(APLOG_MARK, APLOG_WARNING, 0, c, APLOGNO(10086) -+ "Failed to configure challenge certificate %s", -+ servername); -+ return APR_EGENERAL; -+ } -+ -+ if (!SSL_use_PrivateKey(ssl, key)) { -+ ap_log_cerror(APLOG_MARK, APLOG_WARNING, 0, c, APLOGNO(10087) -+ "error '%s' using Challenge key: %s", -+ ERR_error_string(ERR_peek_last_error(), NULL), -+ servername); -+ return APR_EGENERAL; -+ } -+ -+ if (SSL_check_private_key(ssl) < 1) { -+ ap_log_cerror(APLOG_MARK, APLOG_WARNING, 0, c, APLOGNO(10088) -+ "Challenge certificate and private key %s " -+ "do not match", servername); -+ return APR_EGENERAL; -+ } -+ return APR_SUCCESS; -+} -+ - /* - * This function sets the virtual host from an extended - * client hello with a server name indication extension ("SNI", cf. RFC 6066). -@@ -2332,30 +2363,12 @@ static apr_status_t init_vhost(conn_rec *c, SSL *ssl) - return APR_SUCCESS; - } - else if (ssl_is_challenge(c, servername, &cert, &key)) { -- -- sslcon->service_unavailable = 1; -- if ((SSL_use_certificate(ssl, cert) < 1)) { -- ap_log_cerror(APLOG_MARK, APLOG_WARNING, 0, c, APLOGNO(10086) -- "Failed to configure challenge certificate %s", -- servername); -+ /* With ACMEv1 we can have challenge connections to a unknown domains -+ * that need to be answered with a special certificate and will -+ * otherwise not answer any requests. */ -+ if (set_challenge_creds(c, servername, ssl, cert, key) != APR_SUCCESS) { - return APR_EGENERAL; - } -- -- if (!SSL_use_PrivateKey(ssl, key)) { -- ap_log_cerror(APLOG_MARK, APLOG_WARNING, 0, c, APLOGNO(10087) -- "error '%s' using Challenge key: %s", -- ERR_error_string(ERR_peek_last_error(), NULL), -- servername); -- return APR_EGENERAL; -- } -- -- if (SSL_check_private_key(ssl) < 1) { -- ap_log_cerror(APLOG_MARK, APLOG_WARNING, 0, c, APLOGNO(10088) -- "Challenge certificate and private key %s " -- "do not match", servername); -- return APR_EGENERAL; -- } -- - } - else { - ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02044) -@@ -2648,6 +2661,23 @@ int ssl_callback_alpn_select(SSL *ssl, - proposed); - return SSL_TLSEXT_ERR_ALERT_FATAL; - } -+ -+ /* protocol was switched, this could be a challenge protocol such as "acme-tls/1". -+ * For that to work, we need to allow overrides to our ssl certificate. -+ * However, exclude challenge checks on our best known traffic protocol. -+ * (http/1.1 is the default, we never switch to it anyway.) -+ */ -+ if (strcmp("h2", proposed)) { -+ const char *servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name); -+ X509 *cert; -+ EVP_PKEY *key; -+ -+ if (ssl_is_challenge(c, servername, &cert, &key)) { -+ if (set_challenge_creds(c, servername, ssl, cert, key) != APR_SUCCESS) { -+ return SSL_TLSEXT_ERR_ALERT_FATAL; -+ } -+ } -+ } - } - - return SSL_TLSEXT_ERR_OK; -diff --git a/modules/ssl/ssl_util_stapling.c b/modules/ssl/ssl_util_stapling.c -index c3e2cfa..4df0a9a 100644 ---- a/modules/ssl/ssl_util_stapling.c -+++ b/modules/ssl/ssl_util_stapling.c -@@ -31,12 +31,28 @@ - #include "ssl_private.h" - #include "ap_mpm.h" - #include "apr_thread_mutex.h" -+#include "mod_ssl_openssl.h" -+ -+APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, init_stapling_status, -+ (server_rec *s, apr_pool_t *p, -+ X509 *cert, X509 *issuer), -+ (s, p, cert, issuer), -+ DECLINED, DECLINED) -+ -+APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, get_stapling_status, -+ (unsigned char **pder, int *pderlen, -+ conn_rec *c, server_rec *s, X509 *cert), -+ (pder, pderlen, c, s, cert), -+ DECLINED, DECLINED) -+ - - #ifdef HAVE_OCSP_STAPLING - - static int stapling_cache_mutex_on(server_rec *s); - static int stapling_cache_mutex_off(server_rec *s); - -+static int stapling_cb(SSL *ssl, void *arg); -+ - /** - * Maxiumum OCSP stapling response size. This should be the response for a - * single certificate and will typically include the responder certificate chain -@@ -119,7 +135,38 @@ int ssl_stapling_init_cert(server_rec *s, apr_pool_t *p, apr_pool_t *ptemp, - OCSP_CERTID *cid = NULL; - STACK_OF(OPENSSL_STRING) *aia = NULL; - -- if ((x == NULL) || (X509_digest(x, EVP_sha1(), idx, NULL) != 1)) -+ if (x == NULL) -+ return 0; -+ -+ if (!(issuer = stapling_get_issuer(mctx, x))) { -+ /* In Apache pre 2.4.40, we use to come here only when mod_ssl stapling -+ * was enabled. With the new hooks, we give other modules the chance -+ * to provide stapling status. However, we do not want to log ssl errors -+ * where we did not do so in the past. */ -+ if (mctx->stapling_enabled == TRUE) { -+ ssl_log_xerror(SSLLOG_MARK, APLOG_ERR, 0, ptemp, s, x, APLOGNO(02217) -+ "ssl_stapling_init_cert: can't retrieve issuer " -+ "certificate!"); -+ return 0; -+ } -+ return 1; -+ } -+ -+ if (ssl_run_init_stapling_status(s, p, x, issuer) == APR_SUCCESS) { -+ /* Someone's taken over or mod_ssl's own implementation is not enabled */ -+ if (mctx->stapling_enabled != TRUE) { -+ SSL_CTX_set_tlsext_status_cb(mctx->ssl_ctx, stapling_cb); -+ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO() "OCSP stapling added via hook"); -+ } -+ return 1; -+ } -+ -+ if (mctx->stapling_enabled != TRUE) { -+ /* mod_ssl's own implementation is not enabled */ -+ return 1; -+ } -+ -+ if (X509_digest(x, EVP_sha1(), idx, NULL) != 1) - return 0; - - cinf = apr_hash_get(stapling_certinfo, idx, sizeof(idx)); -@@ -139,13 +186,6 @@ int ssl_stapling_init_cert(server_rec *s, apr_pool_t *p, apr_pool_t *ptemp, - return 1; - } - -- if (!(issuer = stapling_get_issuer(mctx, x))) { -- ssl_log_xerror(SSLLOG_MARK, APLOG_ERR, 0, ptemp, s, x, APLOGNO(02217) -- "ssl_stapling_init_cert: can't retrieve issuer " -- "certificate!"); -- return 0; -- } -- - cid = OCSP_cert_to_id(NULL, x, issuer); - X509_free(issuer); - if (!cid) { -@@ -182,18 +222,16 @@ int ssl_stapling_init_cert(server_rec *s, apr_pool_t *p, apr_pool_t *ptemp, - mctx->sc->vhost_id); - - apr_hash_set(stapling_certinfo, cinf->idx, sizeof(cinf->idx), cinf); -- -+ - return 1; - } - --static certinfo *stapling_get_certinfo(server_rec *s, modssl_ctx_t *mctx, -+static certinfo *stapling_get_certinfo(server_rec *s, X509 *x, modssl_ctx_t *mctx, - SSL *ssl) - { - certinfo *cinf; -- X509 *x; - UCHAR idx[SHA_DIGEST_LENGTH]; -- x = SSL_get_certificate(ssl); -- if ((x == NULL) || (X509_digest(x, EVP_sha1(), idx, NULL) != 1)) -+ if (X509_digest(x, EVP_sha1(), idx, NULL) != 1) - return NULL; - cinf = apr_hash_get(stapling_certinfo, idx, sizeof(idx)); - if (cinf && cinf->cid) -@@ -750,18 +788,34 @@ static int stapling_cb(SSL *ssl, void *arg) - OCSP_RESPONSE *rsp = NULL; - int rv; - BOOL ok = TRUE; -+ X509 *x; -+ unsigned char *rspder = NULL; -+ int rspderlen; - -+ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01951) -+ "stapling_cb: OCSP Stapling callback called"); -+ -+ x = SSL_get_certificate(ssl); -+ if (x == NULL) { -+ return SSL_TLSEXT_ERR_NOACK; -+ } -+ -+ if (ssl_run_get_stapling_status(&rspder, &rspderlen, conn, s, x) == APR_SUCCESS) { -+ /* a hook handles stapling for this certicate and determines the response */ -+ if (rspder == NULL || rspderlen <= 0) { -+ return SSL_TLSEXT_ERR_NOACK; -+ } -+ SSL_set_tlsext_status_ocsp_resp(ssl, rspder, rspderlen); -+ return SSL_TLSEXT_ERR_OK; -+ } -+ - if (sc->server->stapling_enabled != TRUE) { - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01950) - "stapling_cb: OCSP Stapling disabled"); - return SSL_TLSEXT_ERR_NOACK; - } - -- ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01951) -- "stapling_cb: OCSP Stapling callback called"); -- -- cinf = stapling_get_certinfo(s, mctx, ssl); -- if (cinf == NULL) { -+ if ((cinf = stapling_get_certinfo(s, x, mctx, ssl)) == NULL) { - return SSL_TLSEXT_ERR_NOACK; - } - -@@ -864,9 +918,10 @@ apr_status_t modssl_init_stapling(server_rec *s, apr_pool_t *p, - if (mctx->stapling_responder_timeout == UNSET) { - mctx->stapling_responder_timeout = 10 * APR_USEC_PER_SEC; - } -+ - SSL_CTX_set_tlsext_status_cb(ctx, stapling_cb); - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01960) "OCSP stapling initialized"); -- -+ - return APR_SUCCESS; - } - diff --git a/SOURCES/httpd-2.4.37-mod-md-perms.patch b/SOURCES/httpd-2.4.37-mod-md-perms.patch deleted file mode 100644 index 78c0fc3..0000000 --- a/SOURCES/httpd-2.4.37-mod-md-perms.patch +++ /dev/null @@ -1,44 +0,0 @@ -diff --git a/modules/md/mod_md_os.c b/modules/md/mod_md_os.c -index f96d566..8df0248 100644 ---- a/modules/md/mod_md_os.c -+++ b/modules/md/mod_md_os.c -@@ -41,14 +41,20 @@ - - apr_status_t md_try_chown(const char *fname, unsigned int uid, int gid, apr_pool_t *p) - { --#if AP_NEED_SET_MUTEX_PERMS -- if (-1 == chown(fname, (uid_t)uid, (gid_t)gid)) { -- apr_status_t rv = APR_FROM_OS_ERROR(errno); -- if (!APR_STATUS_IS_ENOENT(rv)) { -- ap_log_perror(APLOG_MARK, APLOG_ERR, rv, p, APLOGNO(10082) -- "Can't change owner of %s", fname); -+#if AP_NEED_SET_MUTEX_PERMS && HAVE_UNISTD_H -+ /* Since we only switch user when running as root, we only need to chown directories -+ * in that case. Otherwise, the server will ignore any "user/group" directives and -+ * child processes have the same privileges as the parent. -+ */ -+ if (!geteuid()) { -+ if (-1 == chown(fname, (uid_t)uid, (gid_t)gid)) { -+ apr_status_t rv = APR_FROM_OS_ERROR(errno); -+ if (!APR_STATUS_IS_ENOENT(rv)) { -+ ap_log_perror(APLOG_MARK, APLOG_ERR, rv, p, APLOGNO(10082) -+ "Can't change owner of %s", fname); -+ } -+ return rv; - } -- return rv; - } - return APR_SUCCESS; - #else -@@ -58,11 +64,7 @@ apr_status_t md_try_chown(const char *fname, unsigned int uid, int gid, apr_pool - - apr_status_t md_make_worker_accessible(const char *fname, apr_pool_t *p) - { --#if AP_NEED_SET_MUTEX_PERMS - return md_try_chown(fname, ap_unixd_config.user_id, -1, p); --#else -- return APR_ENOTIMPL; --#endif - } - - #ifdef WIN32 diff --git a/SOURCES/httpd-2.4.37-mod-mime-magic-strdup.patch b/SOURCES/httpd-2.4.37-mod-mime-magic-strdup.patch deleted file mode 100644 index e093818..0000000 --- a/SOURCES/httpd-2.4.37-mod-mime-magic-strdup.patch +++ /dev/null @@ -1,24 +0,0 @@ -diff --git a/docs/conf/magic b/docs/conf/magic -index 7c56119..bc891d9 100644 ---- a/docs/conf/magic -+++ b/docs/conf/magic -@@ -87,7 +87,7 @@ - # Microsoft WAVE format (*.wav) - # [GRR 950115: probably all of the shorts and longs should be leshort/lelong] - # Microsoft RIFF --0 string RIFF audio/unknown -+0 string RIFF - # - WAVE format - >8 string WAVE audio/x-wav - # MPEG audio. ---- a/modules/metadata/mod_mime_magic.c 2013/06/11 07:36:13 1491699 -+++ b/modules/metadata/mod_mime_magic.c 2013/06/11 07:41:40 1491700 -@@ -606,7 +606,7 @@ - /* high overhead for 1 char - just hope they don't do this much */ - str[0] = c; - str[1] = '\0'; -- return magic_rsl_add(r, str); -+ return magic_rsl_add(r, apr_pstrdup(r->pool, str)); - } - - /* allocate and copy a contiguous string from a result string list */ diff --git a/SOURCES/httpd-2.4.37-mod_status-duplicate-key.patch b/SOURCES/httpd-2.4.37-mod_status-duplicate-key.patch deleted file mode 100644 index a48fad6..0000000 --- a/SOURCES/httpd-2.4.37-mod_status-duplicate-key.patch +++ /dev/null @@ -1,170 +0,0 @@ -commit 84e6f25f67de9a9bddefdcdbfee3f251fead647e -Author: Tomas Korbar <tkorbar@redhat.com> -Date: Thu Jul 20 14:41:33 2023 +0200 - - Fix duplicate presence of keys printed by mod_status - -diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c -index 5917953..5bada07 100644 ---- a/modules/generators/mod_status.c -+++ b/modules/generators/mod_status.c -@@ -186,7 +186,8 @@ static int status_handler(request_rec *r) - apr_uint32_t up_time; - ap_loadavg_t t; - int j, i, res, written; -- int ready; -+ int idle; -+ int graceful; - int busy; - unsigned long count; - unsigned long lres, my_lres, conn_lres; -@@ -203,6 +204,7 @@ static int status_handler(request_rec *r) - char *stat_buffer; - pid_t *pid_buffer, worker_pid; - int *thread_idle_buffer = NULL; -+ int *thread_graceful_buffer = NULL; - int *thread_busy_buffer = NULL; - clock_t tu, ts, tcu, tcs; - clock_t gu, gs, gcu, gcs; -@@ -231,7 +233,8 @@ static int status_handler(request_rec *r) - #endif - #endif - -- ready = 0; -+ idle = 0; -+ graceful = 0; - busy = 0; - count = 0; - bcount = 0; -@@ -250,6 +253,7 @@ static int status_handler(request_rec *r) - stat_buffer = apr_palloc(r->pool, server_limit * thread_limit * sizeof(char)); - if (is_async) { - thread_idle_buffer = apr_palloc(r->pool, server_limit * sizeof(int)); -+ thread_graceful_buffer = apr_palloc(r->pool, server_limit * sizeof(int)); - thread_busy_buffer = apr_palloc(r->pool, server_limit * sizeof(int)); - } - -@@ -318,6 +322,7 @@ static int status_handler(request_rec *r) - ps_record = ap_get_scoreboard_process(i); - if (is_async) { - thread_idle_buffer[i] = 0; -+ thread_graceful_buffer[i] = 0; - thread_busy_buffer[i] = 0; - } - for (j = 0; j < thread_limit; ++j) { -@@ -336,18 +341,20 @@ static int status_handler(request_rec *r) - && ps_record->pid) { - if (res == SERVER_READY) { - if (ps_record->generation == mpm_generation) -- ready++; -+ idle++; - if (is_async) - thread_idle_buffer[i]++; - } - else if (res != SERVER_DEAD && - res != SERVER_STARTING && - res != SERVER_IDLE_KILL) { -- busy++; -- if (is_async) { -- if (res == SERVER_GRACEFUL) -- thread_idle_buffer[i]++; -- else -+ if (res == SERVER_GRACEFUL) { -+ graceful++; -+ if (is_async) -+ thread_graceful_buffer[i]++; -+ } else { -+ busy++; -+ if (is_async) - thread_busy_buffer[i]++; - } - } -@@ -548,10 +555,10 @@ static int status_handler(request_rec *r) - } /* ap_extended_status */ - - if (!short_report) -- ap_rprintf(r, "<dt>%d requests currently being processed, " -- "%d idle workers</dt>\n", busy, ready); -+ ap_rprintf(r, "<dt>%d requests currently being processed, %d workers gracefully restarting, " -+ "%d idle workers</dt>\n", busy, graceful, idle); - else -- ap_rprintf(r, "BusyWorkers: %d\nIdleWorkers: %d\n", busy, ready); -+ ap_rprintf(r, "BusyWorkers: %d\nGracefulWorkers: %d\nIdleWorkers: %d\n", busy, graceful, idle); - - if (!short_report) - ap_rputs("</dl>", r); -@@ -559,11 +566,6 @@ static int status_handler(request_rec *r) - if (is_async) { - int write_completion = 0, lingering_close = 0, keep_alive = 0, - connections = 0, stopping = 0, procs = 0; -- /* -- * These differ from 'busy' and 'ready' in how gracefully finishing -- * threads are counted. XXX: How to make this clear in the html? -- */ -- int busy_workers = 0, idle_workers = 0; - if (!short_report) - ap_rputs("\n\n<table rules=\"all\" cellpadding=\"1%\">\n" - "<tr><th rowspan=\"2\">Slot</th>" -@@ -573,7 +575,7 @@ static int status_handler(request_rec *r) - "<th colspan=\"2\">Threads</th>" - "<th colspan=\"3\">Async connections</th></tr>\n" - "<tr><th>total</th><th>accepting</th>" -- "<th>busy</th><th>idle</th>" -+ "<th>busy</th><th>graceful</th><th>idle</th>" - "<th>writing</th><th>keep-alive</th><th>closing</th></tr>\n", r); - for (i = 0; i < server_limit; ++i) { - ps_record = ap_get_scoreboard_process(i); -@@ -582,8 +584,6 @@ static int status_handler(request_rec *r) - write_completion += ps_record->write_completion; - keep_alive += ps_record->keep_alive; - lingering_close += ps_record->lingering_close; -- busy_workers += thread_busy_buffer[i]; -- idle_workers += thread_idle_buffer[i]; - procs++; - if (ps_record->quiescing) { - stopping++; -@@ -599,7 +599,7 @@ static int status_handler(request_rec *r) - ap_rprintf(r, "<tr><td>%u</td><td>%" APR_PID_T_FMT "</td>" - "<td>%s%s</td>" - "<td>%u</td><td>%s</td>" -- "<td>%u</td><td>%u</td>" -+ "<td>%u</td><td>%u</td><td>%u</td>" - "<td>%u</td><td>%u</td><td>%u</td>" - "</tr>\n", - i, ps_record->pid, -@@ -607,6 +607,7 @@ static int status_handler(request_rec *r) - ps_record->connections, - ps_record->not_accepting ? "no" : "yes", - thread_busy_buffer[i], -+ thread_graceful_buffer[i], - thread_idle_buffer[i], - ps_record->write_completion, - ps_record->keep_alive, -@@ -618,25 +619,22 @@ static int status_handler(request_rec *r) - ap_rprintf(r, "<tr><td>Sum</td>" - "<td>%d</td><td>%d</td>" - "<td>%d</td><td> </td>" -- "<td>%d</td><td>%d</td>" -+ "<td>%d</td><td>%d</td><td>%d</td>" - "<td>%d</td><td>%d</td><td>%d</td>" - "</tr>\n</table>\n", - procs, stopping, - connections, -- busy_workers, idle_workers, -+ busy, graceful, idle, - write_completion, keep_alive, lingering_close); - } - else { - ap_rprintf(r, "Processes: %d\n" - "Stopping: %d\n" -- "BusyWorkers: %d\n" -- "IdleWorkers: %d\n" - "ConnsTotal: %d\n" - "ConnsAsyncWriting: %d\n" - "ConnsAsyncKeepAlive: %d\n" - "ConnsAsyncClosing: %d\n", - procs, stopping, -- busy_workers, idle_workers, - connections, - write_completion, keep_alive, lingering_close); - } diff --git a/SOURCES/httpd-2.4.37-pr37355.patch b/SOURCES/httpd-2.4.37-pr37355.patch deleted file mode 100644 index 0d161a5..0000000 --- a/SOURCES/httpd-2.4.37-pr37355.patch +++ /dev/null @@ -1,143 +0,0 @@ -diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c -index d13c249..f383996 100644 ---- a/modules/proxy/mod_proxy.c -+++ b/modules/proxy/mod_proxy.c -@@ -1200,11 +1200,20 @@ static int proxy_handler(request_rec *r) - /* handle the scheme */ - ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01142) - "Trying to run scheme_handler against proxy"); -+ -+ if (ents[i].creds) { -+ apr_table_set(r->notes, "proxy-basic-creds", ents[i].creds); -+ ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, -+ "Using proxy auth creds %s", ents[i].creds); -+ } -+ - access_status = proxy_run_scheme_handler(r, worker, - conf, url, - ents[i].hostname, - ents[i].port); - -+ if (ents[i].creds) apr_table_unset(r->notes, "proxy-basic-creds"); -+ - /* Did the scheme handler process the request? */ - if (access_status != DECLINED) { - const char *cl_a; -@@ -1621,8 +1630,8 @@ static void *merge_proxy_dir_config(apr_pool_t *p, void *basev, void *addv) - return new; - } - --static const char * -- add_proxy(cmd_parms *cmd, void *dummy, const char *f1, const char *r1, int regex) -+static const char *add_proxy(cmd_parms *cmd, void *dummy, const char *f1, -+ const char *r1, const char *creds, int regex) - { - server_rec *s = cmd->server; - proxy_server_conf *conf = -@@ -1680,19 +1689,24 @@ static const char * - new->port = port; - new->regexp = reg; - new->use_regex = regex; -+ if (creds) { -+ new->creds = apr_pstrcat(cmd->pool, "Basic ", -+ ap_pbase64encode(cmd->pool, (char *)creds), -+ NULL); -+ } - return NULL; - } - --static const char * -- add_proxy_noregex(cmd_parms *cmd, void *dummy, const char *f1, const char *r1) -+static const char *add_proxy_noregex(cmd_parms *cmd, void *dummy, const char *f1, -+ const char *r1, const char *creds) - { -- return add_proxy(cmd, dummy, f1, r1, 0); -+ return add_proxy(cmd, dummy, f1, r1, creds, 0); - } - --static const char * -- add_proxy_regex(cmd_parms *cmd, void *dummy, const char *f1, const char *r1) -+static const char *add_proxy_regex(cmd_parms *cmd, void *dummy, const char *f1, -+ const char *r1, const char *creds) - { -- return add_proxy(cmd, dummy, f1, r1, 1); -+ return add_proxy(cmd, dummy, f1, r1, creds, 1); - } - - PROXY_DECLARE(const char *) ap_proxy_de_socketfy(apr_pool_t *p, const char *url) -@@ -2638,9 +2652,9 @@ static const command_rec proxy_cmds[] = - "location, in regular expression syntax"), - AP_INIT_FLAG("ProxyRequests", set_proxy_req, NULL, RSRC_CONF, - "on if the true proxy requests should be accepted"), -- AP_INIT_TAKE2("ProxyRemote", add_proxy_noregex, NULL, RSRC_CONF, -+ AP_INIT_TAKE23("ProxyRemote", add_proxy_noregex, NULL, RSRC_CONF, - "a scheme, partial URL or '*' and a proxy server"), -- AP_INIT_TAKE2("ProxyRemoteMatch", add_proxy_regex, NULL, RSRC_CONF, -+ AP_INIT_TAKE23("ProxyRemoteMatch", add_proxy_regex, NULL, RSRC_CONF, - "a regex pattern and a proxy server"), - AP_INIT_FLAG("ProxyPassInterpolateEnv", ap_set_flag_slot_char, - (void*)APR_OFFSETOF(proxy_dir_conf, interpolate_env), -diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h -index 288c5d4..57cc92f 100644 ---- a/modules/proxy/mod_proxy.h -+++ b/modules/proxy/mod_proxy.h -@@ -116,6 +116,7 @@ struct proxy_remote { - const char *protocol; /* the scheme used to talk to this proxy */ - const char *hostname; /* the hostname of this proxy */ - ap_regex_t *regexp; /* compiled regex (if any) for the remote */ -+ const char *creds; /* auth credentials (if any) for the proxy */ - int use_regex; /* simple boolean. True if we have a regex pattern */ - apr_port_t port; /* the port for this proxy */ - }; -diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c -index 0759dac..2bfc8f0 100644 ---- a/modules/proxy/proxy_util.c -+++ b/modules/proxy/proxy_util.c -@@ -2446,11 +2446,14 @@ ap_proxy_determine_connection(apr_pool_t *p, request_rec *r, - * So let's make it configurable by env. - * The logic here is the same used in mod_proxy_http. - */ -- proxy_auth = apr_table_get(r->headers_in, "Proxy-Authorization"); -+ proxy_auth = apr_table_get(r->notes, "proxy-basic-creds"); -+ if (proxy_auth == NULL) -+ proxy_auth = apr_table_get(r->headers_in, "Proxy-Authorization"); -+ - if (proxy_auth != NULL && - proxy_auth[0] != '\0' && -- r->user == NULL && /* we haven't yet authenticated */ -- apr_table_get(r->subprocess_env, "Proxy-Chain-Auth")) { -+ (r->user == NULL /* we haven't yet authenticated */ -+ || apr_table_get(r->subprocess_env, "Proxy-Chain-Auth"))) { - forward->proxy_auth = apr_pstrdup(conn->pool, proxy_auth); - } - } -@@ -2672,7 +2675,8 @@ static apr_status_t send_http_connect(proxy_conn_rec *backend, - nbytes = apr_snprintf(buffer, sizeof(buffer), - "CONNECT %s:%d HTTP/1.0" CRLF, - forward->target_host, forward->target_port); -- /* Add proxy authorization from the initial request if necessary */ -+ /* Add proxy authorization from the configuration, or initial -+ * request if necessary */ - if (forward->proxy_auth != NULL) { - nbytes += apr_snprintf(buffer + nbytes, sizeof(buffer) - nbytes, - "Proxy-Authorization: %s" CRLF, -@@ -3567,6 +3571,7 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - apr_bucket *e; - int do_100_continue; - conn_rec *origin = p_conn->connection; -+ const char *creds; - proxy_dir_conf *dconf = ap_get_module_config(r->per_dir_config, &proxy_module); - - /* -@@ -3743,6 +3748,11 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - return HTTP_BAD_REQUEST; - } - -+ creds = apr_table_get(r->notes, "proxy-basic-creds"); -+ if (creds) { -+ apr_table_mergen(r->headers_in, "Proxy-Authorization", creds); -+ } -+ - /* send request headers */ - headers_in_array = apr_table_elts(r->headers_in); - headers_in = (const apr_table_entry_t *) headers_in_array->elts; diff --git a/SOURCES/httpd-2.4.37-proxy-continue.patch b/SOURCES/httpd-2.4.37-proxy-continue.patch deleted file mode 100644 index 932b043..0000000 --- a/SOURCES/httpd-2.4.37-proxy-continue.patch +++ /dev/null @@ -1,1713 +0,0 @@ -diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c -index de48735..d13c249 100644 ---- a/modules/proxy/mod_proxy.c -+++ b/modules/proxy/mod_proxy.c -@@ -1574,6 +1574,8 @@ static void *create_proxy_dir_config(apr_pool_t *p, char *dummy) - new->error_override_set = 0; - new->add_forwarded_headers = 1; - new->add_forwarded_headers_set = 0; -+ new->forward_100_continue = 1; -+ new->forward_100_continue_set = 0; - - return (void *) new; - } -@@ -1610,6 +1612,11 @@ static void *merge_proxy_dir_config(apr_pool_t *p, void *basev, void *addv) - : add->add_forwarded_headers; - new->add_forwarded_headers_set = add->add_forwarded_headers_set - || base->add_forwarded_headers_set; -+ new->forward_100_continue = -+ (add->forward_100_continue_set == 0) ? base->forward_100_continue -+ : add->forward_100_continue; -+ new->forward_100_continue_set = add->forward_100_continue_set -+ || base->forward_100_continue_set; - - return new; - } -@@ -2110,6 +2117,14 @@ static const char * - conf->preserve_host_set = 1; - return NULL; - } -+static const char * -+ forward_100_continue(cmd_parms *parms, void *dconf, int flag) -+{ -+ proxy_dir_conf *conf = dconf; -+ conf->forward_100_continue = flag; -+ conf->forward_100_continue_set = 1; -+ return NULL; -+} - - static const char * - set_recv_buffer_size(cmd_parms *parms, void *dummy, const char *arg) -@@ -2683,6 +2698,9 @@ static const command_rec proxy_cmds[] = - "Configure local source IP used for request forward"), - AP_INIT_FLAG("ProxyAddHeaders", add_proxy_http_headers, NULL, RSRC_CONF|ACCESS_CONF, - "on if X-Forwarded-* headers should be added or completed"), -+ AP_INIT_FLAG("Proxy100Continue", forward_100_continue, NULL, RSRC_CONF|ACCESS_CONF, -+ "on if 100-Continue should be forwarded to the origin server, off if the " -+ "proxy should handle it by itself"), - {NULL} - }; - -diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h -index 3419023..288c5d4 100644 ---- a/modules/proxy/mod_proxy.h -+++ b/modules/proxy/mod_proxy.h -@@ -240,6 +240,8 @@ typedef struct { - /** Named back references */ - apr_array_header_t *refs; - -+ unsigned int forward_100_continue:1; -+ unsigned int forward_100_continue_set:1; - } proxy_dir_conf; - - /* if we interpolate env vars per-request, we'll need a per-request -@@ -380,6 +382,12 @@ do { \ - (w)->s->io_buffer_size_set = (c)->io_buffer_size_set; \ - } while (0) - -+#define PROXY_DO_100_CONTINUE(w, r) \ -+((w)->s->ping_timeout_set \ -+ && (PROXYREQ_REVERSE == (r)->proxyreq) \ -+ && !(apr_table_get((r)->subprocess_env, "force-proxy-request-1.0")) \ -+ && ap_request_has_body((r))) -+ - /* use 2 hashes */ - typedef struct { - unsigned int def; -diff --git a/modules/proxy/mod_proxy_ftp.c b/modules/proxy/mod_proxy_ftp.c -index 8f6f853..8d66b4a 100644 ---- a/modules/proxy/mod_proxy_ftp.c -+++ b/modules/proxy/mod_proxy_ftp.c -@@ -1181,12 +1181,10 @@ static int proxy_ftp_handler(request_rec *r, proxy_worker *worker, - return HTTP_SERVICE_UNAVAILABLE; - } - -- if (!backend->connection) { -- status = ap_proxy_connection_create_ex("FTP", backend, r); -- if (status != OK) { -- proxy_ftp_cleanup(r, backend); -- return status; -- } -+ status = ap_proxy_connection_create_ex("FTP", backend, r); -+ if (status != OK) { -+ proxy_ftp_cleanup(r, backend); -+ return status; - } - - /* Use old naming */ -diff --git a/modules/proxy/mod_proxy_hcheck.c b/modules/proxy/mod_proxy_hcheck.c -index 2783a58..dd8e407 100644 ---- a/modules/proxy/mod_proxy_hcheck.c -+++ b/modules/proxy/mod_proxy_hcheck.c -@@ -762,10 +762,8 @@ static apr_status_t hc_check_http(baton_t *baton) - } - - r = create_request_rec(ptemp, ctx->s, baton->balancer, wctx->method); -- if (!backend->connection) { -- if ((status = ap_proxy_connection_create_ex("HCOH", backend, r)) != OK) { -- return backend_cleanup("HCOH", backend, ctx->s, status); -- } -+ if ((status = ap_proxy_connection_create_ex("HCOH", backend, r)) != OK) { -+ return backend_cleanup("HCOH", backend, ctx->s, status); - } - set_request_connection(r, backend->connection); - -diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c -index 56af9a8..f007ad6 100644 ---- a/modules/proxy/mod_proxy_http.c -+++ b/modules/proxy/mod_proxy_http.c -@@ -216,8 +216,12 @@ static void add_cl(apr_pool_t *p, - APR_BRIGADE_INSERT_TAIL(header_brigade, e); - } - --#define ASCII_CRLF "\015\012" --#define ASCII_ZERO "\060" -+#ifndef CRLF_ASCII -+#define CRLF_ASCII "\015\012" -+#endif -+#ifndef ZERO_ASCII -+#define ZERO_ASCII "\060" -+#endif - - static void terminate_headers(apr_bucket_alloc_t *bucket_alloc, - apr_bucket_brigade *header_brigade) -@@ -225,304 +229,228 @@ static void terminate_headers(apr_bucket_alloc_t *bucket_alloc, - apr_bucket *e; - - /* add empty line at the end of the headers */ -- e = apr_bucket_immortal_create(ASCII_CRLF, 2, bucket_alloc); -+ e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc); - APR_BRIGADE_INSERT_TAIL(header_brigade, e); - } - - - #define MAX_MEM_SPOOL 16384 - --static int stream_reqbody_chunked(apr_pool_t *p, -- request_rec *r, -- proxy_conn_rec *p_conn, -- conn_rec *origin, -- apr_bucket_brigade *header_brigade, -- apr_bucket_brigade *input_brigade) --{ -- int seen_eos = 0, rv = OK; -- apr_size_t hdr_len; -- apr_off_t bytes; -- apr_status_t status; -- apr_bucket_alloc_t *bucket_alloc = r->connection->bucket_alloc; -- apr_bucket_brigade *bb; -- apr_bucket *e; -- -- add_te_chunked(p, bucket_alloc, header_brigade); -- terminate_headers(bucket_alloc, header_brigade); -+typedef enum { -+ RB_INIT = 0, -+ RB_STREAM_CL, -+ RB_STREAM_CHUNKED, -+ RB_SPOOL_CL -+} rb_methods; - -- while (!APR_BUCKET_IS_EOS(APR_BRIGADE_FIRST(input_brigade))) -- { -- char chunk_hdr[20]; /* must be here due to transient bucket. */ -+typedef struct { -+ apr_pool_t *p; -+ request_rec *r; -+ proxy_worker *worker; -+ proxy_server_conf *sconf; - -- /* If this brigade contains EOS, either stop or remove it. */ -- if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) { -- seen_eos = 1; -- -- /* We can't pass this EOS to the output_filters. */ -- e = APR_BRIGADE_LAST(input_brigade); -- apr_bucket_delete(e); -- } -- -- apr_brigade_length(input_brigade, 1, &bytes); -+ char server_portstr[32]; -+ proxy_conn_rec *backend; -+ conn_rec *origin; - -- hdr_len = apr_snprintf(chunk_hdr, sizeof(chunk_hdr), -- "%" APR_UINT64_T_HEX_FMT CRLF, -- (apr_uint64_t)bytes); -+ apr_bucket_alloc_t *bucket_alloc; -+ apr_bucket_brigade *header_brigade; -+ apr_bucket_brigade *input_brigade; -+ char *old_cl_val, *old_te_val; -+ apr_off_t cl_val; - -- ap_xlate_proto_to_ascii(chunk_hdr, hdr_len); -- e = apr_bucket_transient_create(chunk_hdr, hdr_len, -- bucket_alloc); -- APR_BRIGADE_INSERT_HEAD(input_brigade, e); -+ rb_methods rb_method; - -- /* -- * Append the end-of-chunk CRLF -- */ -- e = apr_bucket_immortal_create(ASCII_CRLF, 2, bucket_alloc); -- APR_BRIGADE_INSERT_TAIL(input_brigade, e); -+ int expecting_100; -+ unsigned int do_100_continue:1, -+ prefetch_nonblocking:1; -+} proxy_http_req_t; - -- if (header_brigade) { -- /* we never sent the header brigade, so go ahead and -- * take care of that now -- */ -- bb = header_brigade; -- -- /* -- * Save input_brigade in bb brigade. (At least) in the SSL case -- * input_brigade contains transient buckets whose data would get -- * overwritten during the next call of ap_get_brigade in the loop. -- * ap_save_brigade ensures these buckets to be set aside. -- * Calling ap_save_brigade with NULL as filter is OK, because -- * bb brigade already has been created and does not need to get -- * created by ap_save_brigade. -- */ -- status = ap_save_brigade(NULL, &bb, &input_brigade, p); -- if (status != APR_SUCCESS) { -- return HTTP_INTERNAL_SERVER_ERROR; -- } -- -- header_brigade = NULL; -- } -- else { -- bb = input_brigade; -+/* Read what's in the client pipe. If nonblocking is set and read is EAGAIN, -+ * pass a FLUSH bucket to the backend and read again in blocking mode. -+ */ -+static int stream_reqbody_read(proxy_http_req_t *req, apr_bucket_brigade *bb, -+ int nonblocking) -+{ -+ request_rec *r = req->r; -+ proxy_conn_rec *p_conn = req->backend; -+ apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc; -+ apr_read_type_e block = nonblocking ? APR_NONBLOCK_READ : APR_BLOCK_READ; -+ apr_status_t status; -+ int rv; -+ -+ for (;;) { -+ status = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES, -+ block, HUGE_STRING_LEN); -+ if (block == APR_BLOCK_READ -+ || (!APR_STATUS_IS_EAGAIN(status) -+ && (status != APR_SUCCESS || !APR_BRIGADE_EMPTY(bb)))) { -+ break; - } - -- /* The request is flushed below this loop with chunk EOS header */ -- rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, bb, 0); -+ /* Flush and retry (blocking) */ -+ apr_brigade_cleanup(bb); -+ rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, req->origin, bb, 1); - if (rv != OK) { - return rv; - } -- -- if (seen_eos) { -- break; -- } -- -- status = ap_get_brigade(r->input_filters, input_brigade, -- AP_MODE_READBYTES, APR_BLOCK_READ, -- HUGE_STRING_LEN); -- -- if (status != APR_SUCCESS) { -- conn_rec *c = r->connection; -- ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02608) -- "read request body failed to %pI (%s)" -- " from %s (%s)", p_conn->addr, -- p_conn->hostname ? p_conn->hostname: "", -- c->client_ip, c->remote_host ? c->remote_host: ""); -- return ap_map_http_request_error(status, HTTP_BAD_REQUEST); -- } -+ block = APR_BLOCK_READ; - } - -- if (header_brigade) { -- /* we never sent the header brigade because there was no request body; -- * send it now -- */ -- bb = header_brigade; -- } -- else { -- if (!APR_BRIGADE_EMPTY(input_brigade)) { -- /* input brigade still has an EOS which we can't pass to the output_filters. */ -- e = APR_BRIGADE_LAST(input_brigade); -- AP_DEBUG_ASSERT(APR_BUCKET_IS_EOS(e)); -- apr_bucket_delete(e); -- } -- bb = input_brigade; -- } -- -- e = apr_bucket_immortal_create(ASCII_ZERO ASCII_CRLF -- /* <trailers> */ -- ASCII_CRLF, -- 5, bucket_alloc); -- APR_BRIGADE_INSERT_TAIL(bb, e); -- -- if (apr_table_get(r->subprocess_env, "proxy-sendextracrlf")) { -- e = apr_bucket_immortal_create(ASCII_CRLF, 2, bucket_alloc); -- APR_BRIGADE_INSERT_TAIL(bb, e); -+ if (status != APR_SUCCESS) { -+ conn_rec *c = r->connection; -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02608) -+ "read request body failed to %pI (%s)" -+ " from %s (%s)", p_conn->addr, -+ p_conn->hostname ? p_conn->hostname: "", -+ c->client_ip, c->remote_host ? c->remote_host: ""); -+ return ap_map_http_request_error(status, HTTP_BAD_REQUEST); - } - -- /* Now we have headers-only, or the chunk EOS mark; flush it */ -- rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, bb, 1); -- return rv; -+ return OK; - } - --static int stream_reqbody_cl(apr_pool_t *p, -- request_rec *r, -- proxy_conn_rec *p_conn, -- conn_rec *origin, -- apr_bucket_brigade *header_brigade, -- apr_bucket_brigade *input_brigade, -- char *old_cl_val) -+static int stream_reqbody(proxy_http_req_t *req, rb_methods rb_method) - { -- int seen_eos = 0, rv = 0; -- apr_status_t status = APR_SUCCESS; -- apr_bucket_alloc_t *bucket_alloc = r->connection->bucket_alloc; -- apr_bucket_brigade *bb; -+ request_rec *r = req->r; -+ int seen_eos = 0, rv = OK; -+ apr_size_t hdr_len; -+ char chunk_hdr[20]; /* must be here due to transient bucket. */ -+ proxy_conn_rec *p_conn = req->backend; -+ apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc; -+ apr_bucket_brigade *header_brigade = req->header_brigade; -+ apr_bucket_brigade *input_brigade = req->input_brigade; -+ apr_off_t bytes, bytes_streamed = 0; - apr_bucket *e; -- apr_off_t cl_val = 0; -- apr_off_t bytes; -- apr_off_t bytes_streamed = 0; -- -- if (old_cl_val) { -- char *endstr; - -- add_cl(p, bucket_alloc, header_brigade, old_cl_val); -- status = apr_strtoff(&cl_val, old_cl_val, &endstr, 10); -- -- if (status || *endstr || endstr == old_cl_val || cl_val < 0) { -- ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01085) -- "could not parse request Content-Length (%s)", -- old_cl_val); -- return HTTP_BAD_REQUEST; -+ do { -+ if (APR_BRIGADE_EMPTY(input_brigade) -+ && APR_BRIGADE_EMPTY(header_brigade)) { -+ rv = stream_reqbody_read(req, input_brigade, 1); -+ if (rv != OK) { -+ return rv; -+ } - } -- } -- terminate_headers(bucket_alloc, header_brigade); -- -- while (!APR_BUCKET_IS_EOS(APR_BRIGADE_FIRST(input_brigade))) -- { -- apr_brigade_length(input_brigade, 1, &bytes); -- bytes_streamed += bytes; -- -- /* If this brigade contains EOS, either stop or remove it. */ -- if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) { -- seen_eos = 1; - -- /* We can't pass this EOS to the output_filters. */ -- e = APR_BRIGADE_LAST(input_brigade); -- apr_bucket_delete(e); -+ if (!APR_BRIGADE_EMPTY(input_brigade)) { -+ /* If this brigade contains EOS, either stop or remove it. */ -+ if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) { -+ seen_eos = 1; - -- if (apr_table_get(r->subprocess_env, "proxy-sendextracrlf")) { -- e = apr_bucket_immortal_create(ASCII_CRLF, 2, bucket_alloc); -- APR_BRIGADE_INSERT_TAIL(input_brigade, e); -+ /* We can't pass this EOS to the output_filters. */ -+ e = APR_BRIGADE_LAST(input_brigade); -+ apr_bucket_delete(e); - } -- } - -- /* C-L < bytes streamed?!? -- * We will error out after the body is completely -- * consumed, but we can't stream more bytes at the -- * back end since they would in part be interpreted -- * as another request! If nothing is sent, then -- * just send nothing. -- * -- * Prevents HTTP Response Splitting. -- */ -- if (bytes_streamed > cl_val) { -- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01086) -- "read more bytes of request body than expected " -- "(got %" APR_OFF_T_FMT ", expected %" APR_OFF_T_FMT ")", -- bytes_streamed, cl_val); -- return HTTP_INTERNAL_SERVER_ERROR; -- } -- -- if (header_brigade) { -- /* we never sent the header brigade, so go ahead and -- * take care of that now -- */ -- bb = header_brigade; -+ apr_brigade_length(input_brigade, 1, &bytes); -+ bytes_streamed += bytes; - -- /* -- * Save input_brigade in bb brigade. (At least) in the SSL case -- * input_brigade contains transient buckets whose data would get -- * overwritten during the next call of ap_get_brigade in the loop. -- * ap_save_brigade ensures these buckets to be set aside. -- * Calling ap_save_brigade with NULL as filter is OK, because -- * bb brigade already has been created and does not need to get -- * created by ap_save_brigade. -- */ -- status = ap_save_brigade(NULL, &bb, &input_brigade, p); -- if (status != APR_SUCCESS) { -+ if (rb_method == RB_STREAM_CHUNKED) { -+ if (bytes) { -+ /* -+ * Prepend the size of the chunk -+ */ -+ hdr_len = apr_snprintf(chunk_hdr, sizeof(chunk_hdr), -+ "%" APR_UINT64_T_HEX_FMT CRLF, -+ (apr_uint64_t)bytes); -+ ap_xlate_proto_to_ascii(chunk_hdr, hdr_len); -+ e = apr_bucket_transient_create(chunk_hdr, hdr_len, -+ bucket_alloc); -+ APR_BRIGADE_INSERT_HEAD(input_brigade, e); -+ -+ /* -+ * Append the end-of-chunk CRLF -+ */ -+ e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc); -+ APR_BRIGADE_INSERT_TAIL(input_brigade, e); -+ } -+ if (seen_eos) { -+ /* -+ * Append the tailing 0-size chunk -+ */ -+ e = apr_bucket_immortal_create(ZERO_ASCII CRLF_ASCII -+ /* <trailers> */ -+ CRLF_ASCII, -+ 5, bucket_alloc); -+ APR_BRIGADE_INSERT_TAIL(input_brigade, e); -+ } -+ } -+ else if (bytes_streamed > req->cl_val) { -+ /* C-L < bytes streamed?!? -+ * We will error out after the body is completely -+ * consumed, but we can't stream more bytes at the -+ * back end since they would in part be interpreted -+ * as another request! If nothing is sent, then -+ * just send nothing. -+ * -+ * Prevents HTTP Response Splitting. -+ */ -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01086) -+ "read more bytes of request body than expected " -+ "(got %" APR_OFF_T_FMT ", expected " -+ "%" APR_OFF_T_FMT ")", -+ bytes_streamed, req->cl_val); - return HTTP_INTERNAL_SERVER_ERROR; - } - -- header_brigade = NULL; -- } -- else { -- bb = input_brigade; -- } -- -- /* Once we hit EOS, we are ready to flush. */ -- rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, bb, seen_eos); -- if (rv != OK) { -- return rv ; -- } -- -- if (seen_eos) { -- break; -+ if (seen_eos && apr_table_get(r->subprocess_env, -+ "proxy-sendextracrlf")) { -+ e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc); -+ APR_BRIGADE_INSERT_TAIL(input_brigade, e); -+ } - } - -- status = ap_get_brigade(r->input_filters, input_brigade, -- AP_MODE_READBYTES, APR_BLOCK_READ, -- HUGE_STRING_LEN); -+ /* If we never sent the header brigade, go ahead and take care of -+ * that now by prepending it (once only since header_brigade will be -+ * empty afterward). -+ */ -+ APR_BRIGADE_PREPEND(input_brigade, header_brigade); - -- if (status != APR_SUCCESS) { -- conn_rec *c = r->connection; -- ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02609) -- "read request body failed to %pI (%s)" -- " from %s (%s)", p_conn->addr, -- p_conn->hostname ? p_conn->hostname: "", -- c->client_ip, c->remote_host ? c->remote_host: ""); -- return ap_map_http_request_error(status, HTTP_BAD_REQUEST); -+ /* Flush here on EOS because we won't stream_reqbody_read() again */ -+ rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, req->origin, -+ input_brigade, seen_eos); -+ if (rv != OK) { -+ return rv; - } -- } -+ } while (!seen_eos); - -- if (bytes_streamed != cl_val) { -+ if (rb_method == RB_STREAM_CL && bytes_streamed != req->cl_val) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01087) - "client %s given Content-Length did not match" - " number of body bytes read", r->connection->client_ip); - return HTTP_BAD_REQUEST; - } - -- if (header_brigade) { -- /* we never sent the header brigade since there was no request -- * body; send it now with the flush flag -- */ -- bb = header_brigade; -- return(ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, bb, 1)); -- } -- - return OK; - } - --static int spool_reqbody_cl(apr_pool_t *p, -- request_rec *r, -- proxy_conn_rec *p_conn, -- conn_rec *origin, -- apr_bucket_brigade *header_brigade, -- apr_bucket_brigade *input_brigade, -- int force_cl) -+static int spool_reqbody_cl(proxy_http_req_t *req, apr_off_t *bytes_spooled) - { -- int seen_eos = 0; -- apr_status_t status; -- apr_bucket_alloc_t *bucket_alloc = r->connection->bucket_alloc; -+ apr_pool_t *p = req->p; -+ request_rec *r = req->r; -+ int seen_eos = 0, rv = OK; -+ apr_status_t status = APR_SUCCESS; -+ apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc; -+ apr_bucket_brigade *input_brigade = req->input_brigade; - apr_bucket_brigade *body_brigade; - apr_bucket *e; -- apr_off_t bytes, bytes_spooled = 0, fsize = 0; -+ apr_off_t bytes, fsize = 0; - apr_file_t *tmpfile = NULL; - apr_off_t limit; - - body_brigade = apr_brigade_create(p, bucket_alloc); -+ *bytes_spooled = 0; - - limit = ap_get_limit_req_body(r); - -- while (!APR_BUCKET_IS_EOS(APR_BRIGADE_FIRST(input_brigade))) -- { -+ do { -+ if (APR_BRIGADE_EMPTY(input_brigade)) { -+ rv = stream_reqbody_read(req, input_brigade, 0); -+ if (rv != OK) { -+ return rv; -+ } -+ } -+ - /* If this brigade contains EOS, either stop or remove it. */ - if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) { - seen_eos = 1; -@@ -534,13 +462,13 @@ static int spool_reqbody_cl(apr_pool_t *p, - - apr_brigade_length(input_brigade, 1, &bytes); - -- if (bytes_spooled + bytes > MAX_MEM_SPOOL) { -+ if (*bytes_spooled + bytes > MAX_MEM_SPOOL) { - /* - * LimitRequestBody does not affect Proxy requests (Should it?). - * Let it take effect if we decide to store the body in a - * temporary file on disk. - */ -- if (limit && (bytes_spooled + bytes > limit)) { -+ if (limit && (*bytes_spooled + bytes > limit)) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01088) - "Request body is larger than the configured " - "limit of %" APR_OFF_T_FMT, limit); -@@ -610,69 +538,42 @@ static int spool_reqbody_cl(apr_pool_t *p, - - } - -- bytes_spooled += bytes; -- -- if (seen_eos) { -- break; -- } -- -- status = ap_get_brigade(r->input_filters, input_brigade, -- AP_MODE_READBYTES, APR_BLOCK_READ, -- HUGE_STRING_LEN); -- -- if (status != APR_SUCCESS) { -- conn_rec *c = r->connection; -- ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02610) -- "read request body failed to %pI (%s)" -- " from %s (%s)", p_conn->addr, -- p_conn->hostname ? p_conn->hostname: "", -- c->client_ip, c->remote_host ? c->remote_host: ""); -- return ap_map_http_request_error(status, HTTP_BAD_REQUEST); -- } -- } -+ *bytes_spooled += bytes; -+ } while (!seen_eos); - -- if (bytes_spooled || force_cl) { -- add_cl(p, bucket_alloc, header_brigade, apr_off_t_toa(p, bytes_spooled)); -- } -- terminate_headers(bucket_alloc, header_brigade); -- APR_BRIGADE_CONCAT(header_brigade, body_brigade); -+ APR_BRIGADE_CONCAT(input_brigade, body_brigade); - if (tmpfile) { -- apr_brigade_insert_file(header_brigade, tmpfile, 0, fsize, p); -+ apr_brigade_insert_file(input_brigade, tmpfile, 0, fsize, p); - } - if (apr_table_get(r->subprocess_env, "proxy-sendextracrlf")) { -- e = apr_bucket_immortal_create(ASCII_CRLF, 2, bucket_alloc); -- APR_BRIGADE_INSERT_TAIL(header_brigade, e); -+ e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc); -+ APR_BRIGADE_INSERT_TAIL(input_brigade, e); - } -- /* This is all a single brigade, pass with flush flagged */ -- return(ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, header_brigade, 1)); -+ return OK; - } - --static --int ap_proxy_http_request(apr_pool_t *p, request_rec *r, -- proxy_conn_rec *p_conn, proxy_worker *worker, -- proxy_server_conf *conf, -- apr_uri_t *uri, -- char *url, char *server_portstr) -+static int ap_proxy_http_prefetch(proxy_http_req_t *req, -+ apr_uri_t *uri, char *url) - { -+ apr_pool_t *p = req->p; -+ request_rec *r = req->r; - conn_rec *c = r->connection; -- apr_bucket_alloc_t *bucket_alloc = c->bucket_alloc; -- apr_bucket_brigade *header_brigade; -- apr_bucket_brigade *input_brigade; -+ proxy_conn_rec *p_conn = req->backend; -+ apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc; -+ apr_bucket_brigade *header_brigade = req->header_brigade; -+ apr_bucket_brigade *input_brigade = req->input_brigade; - apr_bucket_brigade *temp_brigade; - apr_bucket *e; - char *buf; - apr_status_t status; -- enum rb_methods {RB_INIT, RB_STREAM_CL, RB_STREAM_CHUNKED, RB_SPOOL_CL}; -- enum rb_methods rb_method = RB_INIT; -- char *old_cl_val = NULL; -- char *old_te_val = NULL; - apr_off_t bytes_read = 0; - apr_off_t bytes; - int force10, rv; -+ apr_read_type_e block; - conn_rec *origin = p_conn->connection; - - if (apr_table_get(r->subprocess_env, "force-proxy-request-1.0")) { -- if (r->expecting_100) { -+ if (req->expecting_100) { - return HTTP_EXPECTATION_FAILED; - } - force10 = 1; -@@ -680,17 +581,14 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r, - force10 = 0; - } - -- header_brigade = apr_brigade_create(p, bucket_alloc); - rv = ap_proxy_create_hdrbrgd(p, header_brigade, r, p_conn, -- worker, conf, uri, url, server_portstr, -- &old_cl_val, &old_te_val); -+ req->worker, req->sconf, -+ uri, url, req->server_portstr, -+ &req->old_cl_val, &req->old_te_val); - if (rv != OK) { - return rv; - } - -- /* We have headers, let's figure out our request body... */ -- input_brigade = apr_brigade_create(p, bucket_alloc); -- - /* sub-requests never use keepalives, and mustn't pass request bodies. - * Because the new logic looks at input_brigade, we will self-terminate - * input_brigade and jump past all of the request body logic... -@@ -703,9 +601,9 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r, - if (!r->kept_body && r->main) { - /* XXX: Why DON'T sub-requests use keepalives? */ - p_conn->close = 1; -- old_cl_val = NULL; -- old_te_val = NULL; -- rb_method = RB_STREAM_CL; -+ req->old_te_val = NULL; -+ req->old_cl_val = NULL; -+ req->rb_method = RB_STREAM_CL; - e = apr_bucket_eos_create(input_brigade->bucket_alloc); - APR_BRIGADE_INSERT_TAIL(input_brigade, e); - goto skip_body; -@@ -719,18 +617,19 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r, - * encoding has been done by the extensions' handler, and - * do not modify add_te_chunked's logic - */ -- if (old_te_val && strcasecmp(old_te_val, "chunked") != 0) { -+ if (req->old_te_val && ap_cstr_casecmp(req->old_te_val, "chunked") != 0) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01093) -- "%s Transfer-Encoding is not supported", old_te_val); -+ "%s Transfer-Encoding is not supported", -+ req->old_te_val); - return HTTP_INTERNAL_SERVER_ERROR; - } - -- if (old_cl_val && old_te_val) { -+ if (req->old_cl_val && req->old_te_val) { - ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01094) - "client %s (%s) requested Transfer-Encoding " - "chunked body with Content-Length (C-L ignored)", - c->client_ip, c->remote_host ? c->remote_host: ""); -- old_cl_val = NULL; -+ req->old_cl_val = NULL; - origin->keepalive = AP_CONN_CLOSE; - p_conn->close = 1; - } -@@ -744,10 +643,19 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r, - * reasonable size. - */ - temp_brigade = apr_brigade_create(p, bucket_alloc); -+ block = req->prefetch_nonblocking ? APR_NONBLOCK_READ : APR_BLOCK_READ; - do { - status = ap_get_brigade(r->input_filters, temp_brigade, -- AP_MODE_READBYTES, APR_BLOCK_READ, -+ AP_MODE_READBYTES, block, - MAX_MEM_SPOOL - bytes_read); -+ /* ap_get_brigade may return success with an empty brigade -+ * for a non-blocking read which would block -+ */ -+ if (block == APR_NONBLOCK_READ -+ && ((status == APR_SUCCESS && APR_BRIGADE_EMPTY(temp_brigade)) -+ || APR_STATUS_IS_EAGAIN(status))) { -+ break; -+ } - if (status != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01095) - "prefetch request body failed to %pI (%s)" -@@ -785,7 +693,8 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r, - * (an arbitrary value.) - */ - } while ((bytes_read < MAX_MEM_SPOOL - 80) -- && !APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))); -+ && !APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade)) -+ && !req->prefetch_nonblocking); - - /* Use chunked request body encoding or send a content-length body? - * -@@ -822,7 +731,8 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r, - * is absent, and the filters are unchanged (the body won't - * be resized by another content filter). - */ -- if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) { -+ if (!APR_BRIGADE_EMPTY(input_brigade) -+ && APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) { - /* The whole thing fit, so our decision is trivial, use - * the filtered bytes read from the client for the request - * body Content-Length. -@@ -830,34 +740,43 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r, - * If we expected no body, and read no body, do not set - * the Content-Length. - */ -- if (old_cl_val || old_te_val || bytes_read) { -- old_cl_val = apr_off_t_toa(r->pool, bytes_read); -+ if (req->old_cl_val || req->old_te_val || bytes_read) { -+ req->old_cl_val = apr_off_t_toa(r->pool, bytes_read); -+ req->cl_val = bytes_read; - } -- rb_method = RB_STREAM_CL; -+ req->rb_method = RB_STREAM_CL; - } -- else if (old_te_val) { -+ else if (req->old_te_val) { - if (force10 - || (apr_table_get(r->subprocess_env, "proxy-sendcl") - && !apr_table_get(r->subprocess_env, "proxy-sendchunks") - && !apr_table_get(r->subprocess_env, "proxy-sendchunked"))) { -- rb_method = RB_SPOOL_CL; -+ req->rb_method = RB_SPOOL_CL; - } - else { -- rb_method = RB_STREAM_CHUNKED; -+ req->rb_method = RB_STREAM_CHUNKED; - } - } -- else if (old_cl_val) { -+ else if (req->old_cl_val) { - if (r->input_filters == r->proto_input_filters) { -- rb_method = RB_STREAM_CL; -+ char *endstr; -+ status = apr_strtoff(&req->cl_val, req->old_cl_val, &endstr, 10); -+ if (status != APR_SUCCESS || *endstr || req->cl_val < 0) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01085) -+ "could not parse request Content-Length (%s)", -+ req->old_cl_val); -+ return HTTP_BAD_REQUEST; -+ } -+ req->rb_method = RB_STREAM_CL; - } - else if (!force10 - && (apr_table_get(r->subprocess_env, "proxy-sendchunks") - || apr_table_get(r->subprocess_env, "proxy-sendchunked")) - && !apr_table_get(r->subprocess_env, "proxy-sendcl")) { -- rb_method = RB_STREAM_CHUNKED; -+ req->rb_method = RB_STREAM_CHUNKED; - } - else { -- rb_method = RB_SPOOL_CL; -+ req->rb_method = RB_SPOOL_CL; - } - } - else { -@@ -865,7 +784,31 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r, - * requests, and has the behavior that it will not add any C-L - * when the old_cl_val is NULL. - */ -- rb_method = RB_SPOOL_CL; -+ req->rb_method = RB_SPOOL_CL; -+ } -+ -+ switch (req->rb_method) { -+ case RB_STREAM_CHUNKED: -+ add_te_chunked(req->p, bucket_alloc, header_brigade); -+ break; -+ -+ case RB_STREAM_CL: -+ if (req->old_cl_val) { -+ add_cl(req->p, bucket_alloc, header_brigade, req->old_cl_val); -+ } -+ break; -+ -+ default: /* => RB_SPOOL_CL */ -+ /* If we have to spool the body, do it now, before connecting or -+ * reusing the backend connection. -+ */ -+ rv = spool_reqbody_cl(req, &bytes); -+ if (rv != OK) { -+ return rv; -+ } -+ if (bytes || req->old_te_val || req->old_cl_val) { -+ add_cl(p, bucket_alloc, header_brigade, apr_off_t_toa(p, bytes)); -+ } - } - - /* Yes I hate gotos. This is the subrequest shortcut */ -@@ -886,23 +829,44 @@ skip_body: - e = apr_bucket_pool_create(buf, strlen(buf), p, c->bucket_alloc); - APR_BRIGADE_INSERT_TAIL(header_brigade, e); - } -+ terminate_headers(bucket_alloc, header_brigade); - -- /* send the request body, if any. */ -- switch(rb_method) { -- case RB_STREAM_CHUNKED: -- rv = stream_reqbody_chunked(p, r, p_conn, origin, header_brigade, -- input_brigade); -- break; -+ return OK; -+} -+ -+static int ap_proxy_http_request(proxy_http_req_t *req) -+{ -+ int rv; -+ request_rec *r = req->r; -+ apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc; -+ apr_bucket_brigade *header_brigade = req->header_brigade; -+ apr_bucket_brigade *input_brigade = req->input_brigade; -+ -+ /* send the request header/body, if any. */ -+ switch (req->rb_method) { - case RB_STREAM_CL: -- rv = stream_reqbody_cl(p, r, p_conn, origin, header_brigade, -- input_brigade, old_cl_val); -+ case RB_STREAM_CHUNKED: -+ if (req->do_100_continue) { -+ rv = ap_proxy_pass_brigade(bucket_alloc, r, req->backend, -+ req->origin, header_brigade, 1); -+ } -+ else { -+ rv = stream_reqbody(req, req->rb_method); -+ } - break; -+ - case RB_SPOOL_CL: -- rv = spool_reqbody_cl(p, r, p_conn, origin, header_brigade, -- input_brigade, (old_cl_val != NULL) -- || (old_te_val != NULL) -- || (bytes_read > 0)); -+ /* Prefetch has built the header and spooled the whole body; -+ * if we don't expect 100-continue we can flush both all at once, -+ * otherwise flush the header only. -+ */ -+ if (!req->do_100_continue) { -+ APR_BRIGADE_CONCAT(header_brigade, input_brigade); -+ } -+ rv = ap_proxy_pass_brigade(bucket_alloc, r, req->backend, -+ req->origin, header_brigade, 1); - break; -+ - default: - /* shouldn't be possible */ - rv = HTTP_INTERNAL_SERVER_ERROR; -@@ -910,10 +874,12 @@ skip_body: - } - - if (rv != OK) { -+ conn_rec *c = r->connection; - /* apr_status_t value has been logged in lower level method */ - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01097) - "pass request body failed to %pI (%s) from %s (%s)", -- p_conn->addr, p_conn->hostname ? p_conn->hostname: "", -+ req->backend->addr, -+ req->backend->hostname ? req->backend->hostname: "", - c->client_ip, c->remote_host ? c->remote_host: ""); - return rv; - } -@@ -1189,12 +1155,16 @@ static int add_trailers(void *data, const char *key, const char *val) - } - - static --apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, -- proxy_conn_rec **backend_ptr, -- proxy_worker *worker, -- proxy_server_conf *conf, -- char *server_portstr) { -+int ap_proxy_http_process_response(proxy_http_req_t *req) -+{ -+ apr_pool_t *p = req->p; -+ request_rec *r = req->r; - conn_rec *c = r->connection; -+ proxy_worker *worker = req->worker; -+ proxy_conn_rec *backend = req->backend; -+ conn_rec *origin = req->origin; -+ int do_100_continue = req->do_100_continue; -+ - char *buffer; - char fixed_buffer[HUGE_STRING_LEN]; - const char *buf; -@@ -1217,19 +1187,11 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - int proxy_status = OK; - const char *original_status_line = r->status_line; - const char *proxy_status_line = NULL; -- proxy_conn_rec *backend = *backend_ptr; -- conn_rec *origin = backend->connection; - apr_interval_time_t old_timeout = 0; - proxy_dir_conf *dconf; -- int do_100_continue; - - dconf = ap_get_module_config(r->per_dir_config, &proxy_module); - -- do_100_continue = (worker->s->ping_timeout_set -- && ap_request_has_body(r) -- && (PROXYREQ_REVERSE == r->proxyreq) -- && !(apr_table_get(r->subprocess_env, "force-proxy-request-1.0"))); -- - bb = apr_brigade_create(p, c->bucket_alloc); - pass_bb = apr_brigade_create(p, c->bucket_alloc); - -@@ -1248,7 +1210,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - } - - /* Setup for 100-Continue timeout if appropriate */ -- if (do_100_continue) { -+ if (do_100_continue && worker->s->ping_timeout_set) { - apr_socket_timeout_get(backend->sock, &old_timeout); - if (worker->s->ping_timeout != old_timeout) { - apr_status_t rc; -@@ -1273,6 +1235,8 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - origin->local_addr->port)); - do { - apr_status_t rc; -+ int major = 0, minor = 0; -+ int toclose = 0; - - apr_brigade_cleanup(bb); - -@@ -1360,9 +1324,6 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - * This is buggy if we ever see an HTTP/1.10 - */ - if (apr_date_checkmask(buffer, "HTTP/#.# ###*")) { -- int major, minor; -- int toclose; -- - major = buffer[5] - '0'; - minor = buffer[7] - '0'; - -@@ -1412,8 +1373,8 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - "Set-Cookie", NULL); - - /* shove the headers direct into r->headers_out */ -- ap_proxy_read_headers(r, backend->r, buffer, response_field_size, origin, -- &pread_len); -+ ap_proxy_read_headers(r, backend->r, buffer, response_field_size, -+ origin, &pread_len); - - if (r->headers_out == NULL) { - ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01106) -@@ -1491,7 +1452,8 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - r->headers_out = ap_proxy_clean_warnings(p, r->headers_out); - - /* handle Via header in response */ -- if (conf->viaopt != via_off && conf->viaopt != via_block) { -+ if (req->sconf->viaopt != via_off -+ && req->sconf->viaopt != via_block) { - const char *server_name = ap_get_server_name(r); - /* If USE_CANONICAL_NAME_OFF was configured for the proxy virtual host, - * then the server name returned by ap_get_server_name() is the -@@ -1502,18 +1464,18 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - server_name = r->server->server_hostname; - /* create a "Via:" response header entry and merge it */ - apr_table_addn(r->headers_out, "Via", -- (conf->viaopt == via_full) -+ (req->sconf->viaopt == via_full) - ? apr_psprintf(p, "%d.%d %s%s (%s)", - HTTP_VERSION_MAJOR(r->proto_num), - HTTP_VERSION_MINOR(r->proto_num), - server_name, -- server_portstr, -+ req->server_portstr, - AP_SERVER_BASEVERSION) - : apr_psprintf(p, "%d.%d %s%s", - HTTP_VERSION_MAJOR(r->proto_num), - HTTP_VERSION_MINOR(r->proto_num), - server_name, -- server_portstr) -+ req->server_portstr) - ); - } - -@@ -1531,18 +1493,6 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - } - - if (ap_is_HTTP_INFO(proxy_status)) { -- interim_response++; -- /* Reset to old timeout iff we've adjusted it */ -- if (do_100_continue -- && (r->status == HTTP_CONTINUE) -- && (worker->s->ping_timeout != old_timeout)) { -- apr_socket_timeout_set(backend->sock, old_timeout); -- } -- } -- else { -- interim_response = 0; -- } -- if (interim_response) { - /* RFC2616 tells us to forward this. - * - * OTOH, an interim response here may mean the backend -@@ -1563,7 +1513,13 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, - "HTTP: received interim %d response", r->status); - if (!policy -- || (!strcasecmp(policy, "RFC") && ((r->expecting_100 = 1)))) { -+ || (!strcasecmp(policy, "RFC") -+ && (proxy_status != HTTP_CONTINUE -+ || (req->expecting_100 = 1)))) { -+ if (proxy_status == HTTP_CONTINUE) { -+ r->expecting_100 = req->expecting_100; -+ req->expecting_100 = 0; -+ } - ap_send_interim_response(r, 1); - } - /* FIXME: refine this to be able to specify per-response-status -@@ -1573,7 +1529,106 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01108) - "undefined proxy interim response policy"); - } -+ interim_response++; - } -+ else { -+ interim_response = 0; -+ } -+ -+ /* If we still do 100-continue (end-to-end or ping), either the -+ * current response is the expected "100 Continue" and we are done -+ * with this mode, or this is another interim response and we'll wait -+ * for the next one, or this is a final response and hence the backend -+ * did not honor our expectation. -+ */ -+ if (do_100_continue && (!interim_response -+ || proxy_status == HTTP_CONTINUE)) { -+ /* RFC 7231 - Section 5.1.1 - Expect - Requirement for servers -+ * A server that responds with a final status code before -+ * reading the entire message body SHOULD indicate in that -+ * response whether it intends to close the connection or -+ * continue reading and discarding the request message. -+ * -+ * So, if this response is not an interim 100 Continue, we can -+ * avoid sending the request body if the backend responded with -+ * "Connection: close" or HTTP < 1.1, and either let the core -+ * discard it or the caller try another balancer member with the -+ * same body (given status 503, though not implemented yet). -+ */ -+ int do_send_body = (proxy_status == HTTP_CONTINUE -+ || (!toclose && major > 0 && minor > 0)); -+ -+ /* Reset to old timeout iff we've adjusted it. */ -+ if (worker->s->ping_timeout_set) { -+ apr_socket_timeout_set(backend->sock, old_timeout); -+ } -+ -+ ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(10153) -+ "HTTP: %s100 continue sent by %pI (%s): " -+ "%ssending body (response: HTTP/%i.%i %s)", -+ proxy_status != HTTP_CONTINUE ? "no " : "", -+ backend->addr, -+ backend->hostname ? backend->hostname : "", -+ do_send_body ? "" : "not ", -+ major, minor, proxy_status_line); -+ -+ if (do_send_body) { -+ int status; -+ -+ /* Send the request body (fully). */ -+ switch(req->rb_method) { -+ case RB_STREAM_CL: -+ case RB_STREAM_CHUNKED: -+ status = stream_reqbody(req, req->rb_method); -+ break; -+ case RB_SPOOL_CL: -+ /* Prefetch has spooled the whole body, flush it. */ -+ status = ap_proxy_pass_brigade(req->bucket_alloc, r, -+ backend, origin, -+ req->input_brigade, 1); -+ break; -+ default: -+ /* Shouldn't happen */ -+ status = HTTP_INTERNAL_SERVER_ERROR; -+ break; -+ } -+ if (status != OK) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, -+ APLOGNO(10154) "pass request body failed " -+ "to %pI (%s) from %s (%s) with status %i", -+ backend->addr, -+ backend->hostname ? backend->hostname : "", -+ c->client_ip, -+ c->remote_host ? c->remote_host : "", -+ status); -+ backend->close = 1; -+ return status; -+ } -+ } -+ else { -+ /* If we don't read the client connection any further, since -+ * there are pending data it should be "Connection: close"d to -+ * prevent reuse. We don't exactly c->keepalive = AP_CONN_CLOSE -+ * here though, because error_override or a potential retry on -+ * another backend could finally read that data and finalize -+ * the request processing, making keep-alive possible. So what -+ * we do is restoring r->expecting_100 for ap_set_keepalive() -+ * to do the right thing according to the final response and -+ * any later update of r->expecting_100. -+ */ -+ r->expecting_100 = req->expecting_100; -+ req->expecting_100 = 0; -+ } -+ -+ /* Once only! */ -+ do_100_continue = 0; -+ } -+ -+ if (interim_response) { -+ /* Already forwarded above, read next response */ -+ continue; -+ } -+ - /* Moved the fixups of Date headers and those affected by - * ProxyPassReverse/etc from here to ap_proxy_read_headers - */ -@@ -1648,7 +1703,6 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - - /* send body - but only if a body is expected */ - if ((!r->header_only) && /* not HEAD request */ -- !interim_response && /* not any 1xx response */ - (proxy_status != HTTP_NO_CONTENT) && /* not 204 */ - (proxy_status != HTTP_NOT_MODIFIED)) { /* not 304 */ - -@@ -1697,7 +1751,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - - rv = ap_get_brigade(backend->r->input_filters, bb, - AP_MODE_READBYTES, mode, -- conf->io_buffer_size); -+ req->sconf->io_buffer_size); - - /* ap_get_brigade will return success with an empty brigade - * for a non-blocking read which would block: */ -@@ -1789,7 +1843,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - ap_proxy_release_connection(backend->worker->s->scheme, - backend, r->server); - /* Ensure that the backend is not reused */ -- *backend_ptr = NULL; -+ req->backend = NULL; - - } - -@@ -1798,12 +1852,13 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - || c->aborted) { - /* Ack! Phbtt! Die! User aborted! */ - /* Only close backend if we haven't got all from the -- * backend. Furthermore if *backend_ptr is NULL it is no -+ * backend. Furthermore if req->backend is NULL it is no - * longer safe to fiddle around with backend as it might - * be already in use by another thread. - */ -- if (*backend_ptr) { -- backend->close = 1; /* this causes socket close below */ -+ if (req->backend) { -+ /* this causes socket close below */ -+ req->backend->close = 1; - } - finish = TRUE; - } -@@ -1816,7 +1871,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - } - ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, "end body send"); - } -- else if (!interim_response) { -+ else { - ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, "header only"); - - /* make sure we release the backend connection as soon -@@ -1826,7 +1881,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, - */ - ap_proxy_release_connection(backend->worker->s->scheme, - backend, r->server); -- *backend_ptr = NULL; -+ req->backend = NULL; - - /* Pass EOS bucket down the filter chain. */ - e = apr_bucket_eos_create(c->bucket_alloc); -@@ -1880,14 +1935,17 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker, - apr_port_t proxyport) - { - int status; -- char server_portstr[32]; - char *scheme; - const char *proxy_function; - const char *u; -+ proxy_http_req_t *req = NULL; - proxy_conn_rec *backend = NULL; - int is_ssl = 0; - conn_rec *c = r->connection; -+ proxy_dir_conf *dconf; - int retry = 0; -+ char *locurl = url; -+ int toclose = 0; - /* - * Use a shorter-lived pool to reduce memory usage - * and avoid a memory leak -@@ -1928,14 +1986,47 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker, - } - ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "HTTP: serving URL %s", url); - -- - /* create space for state information */ - if ((status = ap_proxy_acquire_connection(proxy_function, &backend, -- worker, r->server)) != OK) -- goto cleanup; -+ worker, r->server)) != OK) { -+ return status; -+ } - - backend->is_ssl = is_ssl; - -+ req = apr_pcalloc(p, sizeof(*req)); -+ req->p = p; -+ req->r = r; -+ req->sconf = conf; -+ req->worker = worker; -+ req->backend = backend; -+ req->bucket_alloc = c->bucket_alloc; -+ req->rb_method = RB_INIT; -+ -+ dconf = ap_get_module_config(r->per_dir_config, &proxy_module); -+ -+ /* Should we handle end-to-end or ping 100-continue? */ -+ if ((r->expecting_100 && dconf->forward_100_continue) -+ || PROXY_DO_100_CONTINUE(worker, r)) { -+ /* We need to reset r->expecting_100 or prefetching will cause -+ * ap_http_filter() to send "100 Continue" response by itself. So -+ * we'll use req->expecting_100 in mod_proxy_http to determine whether -+ * the client should be forwarded "100 continue", and r->expecting_100 -+ * will be restored at the end of the function with the actual value of -+ * req->expecting_100 (i.e. cleared only if mod_proxy_http sent the -+ * "100 Continue" according to its policy). -+ */ -+ req->do_100_continue = req->prefetch_nonblocking = 1; -+ req->expecting_100 = r->expecting_100; -+ r->expecting_100 = 0; -+ } -+ /* Should we block while prefetching the body or try nonblocking and flush -+ * data to the backend ASAP? -+ */ -+ else if (apr_table_get(r->subprocess_env, "proxy-prefetch-nonblocking")) { -+ req->prefetch_nonblocking = 1; -+ } -+ - /* - * In the case that we are handling a reverse proxy connection and this - * is not a request that is coming over an already kept alive connection -@@ -1949,15 +2040,53 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker, - backend->close = 1; - } - -+ /* Step One: Determine Who To Connect To */ -+ if ((status = ap_proxy_determine_connection(p, r, conf, worker, backend, -+ uri, &locurl, proxyname, -+ proxyport, req->server_portstr, -+ sizeof(req->server_portstr)))) -+ goto cleanup; -+ -+ /* Prefetch (nonlocking) the request body so to increase the chance to get -+ * the whole (or enough) body and determine Content-Length vs chunked or -+ * spooled. By doing this before connecting or reusing the backend, we want -+ * to minimize the delay between this connection is considered alive and -+ * the first bytes sent (should the client's link be slow or some input -+ * filter retain the data). This is a best effort to prevent the backend -+ * from closing (from under us) what it thinks is an idle connection, hence -+ * to reduce to the minimum the unavoidable local is_socket_connected() vs -+ * remote keepalive race condition. -+ */ -+ req->input_brigade = apr_brigade_create(p, req->bucket_alloc); -+ req->header_brigade = apr_brigade_create(p, req->bucket_alloc); -+ if ((status = ap_proxy_http_prefetch(req, uri, locurl)) != OK) -+ goto cleanup; -+ -+ /* We need to reset backend->close now, since ap_proxy_http_prefetch() set -+ * it to disable the reuse of the connection *after* this request (no keep- -+ * alive), not to close any reusable connection before this request. However -+ * assure what is expected later by using a local flag and do the right thing -+ * when ap_proxy_connect_backend() below provides the connection to close. -+ */ -+ toclose = backend->close; -+ backend->close = 0; -+ - while (retry < 2) { -- char *locurl = url; -+ if (retry) { -+ char *newurl = url; - -- /* Step One: Determine Who To Connect To */ -- if ((status = ap_proxy_determine_connection(p, r, conf, worker, backend, -- uri, &locurl, proxyname, -- proxyport, server_portstr, -- sizeof(server_portstr))) != OK) -- break; -+ /* Step One (again): (Re)Determine Who To Connect To */ -+ if ((status = ap_proxy_determine_connection(p, r, conf, worker, -+ backend, uri, &newurl, proxyname, proxyport, -+ req->server_portstr, sizeof(req->server_portstr)))) -+ break; -+ -+ /* The code assumes locurl is not changed during the loop, or -+ * ap_proxy_http_prefetch() would have to be called every time, -+ * and header_brigade be changed accordingly... -+ */ -+ AP_DEBUG_ASSERT(strcmp(newurl, locurl) == 0); -+ } - - /* Step Two: Make the Connection */ - if (ap_proxy_check_connection(proxy_function, backend, r->server, 1, -@@ -1972,54 +2101,64 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker, - } - - /* Step Three: Create conn_rec */ -- if (!backend->connection) { -- if ((status = ap_proxy_connection_create_ex(proxy_function, -- backend, r)) != OK) -- break; -- /* -- * On SSL connections set a note on the connection what CN is -- * requested, such that mod_ssl can check if it is requested to do -- * so. -- */ -- if (backend->ssl_hostname) { -- apr_table_setn(backend->connection->notes, -- "proxy-request-hostname", -- backend->ssl_hostname); -- } -+ if ((status = ap_proxy_connection_create_ex(proxy_function, -+ backend, r)) != OK) -+ break; -+ req->origin = backend->connection; -+ -+ /* Don't recycle the connection if prefetch (above) told not to do so */ -+ if (toclose) { -+ backend->close = 1; -+ req->origin->keepalive = AP_CONN_CLOSE; -+ } -+ -+ /* -+ * On SSL connections set a note on the connection what CN is -+ * requested, such that mod_ssl can check if it is requested to do -+ * so. -+ * -+ * https://github.com/apache/httpd/commit/7d272e2628b4ae05f68cdc74b070707250896a34 -+ */ -+ if (backend->ssl_hostname) { -+ apr_table_setn(backend->connection->notes, -+ "proxy-request-hostname", -+ backend->ssl_hostname); - } - - /* Step Four: Send the Request - * On the off-chance that we forced a 100-Continue as a - * kinda HTTP ping test, allow for retries - */ -- if ((status = ap_proxy_http_request(p, r, backend, worker, -- conf, uri, locurl, server_portstr)) != OK) { -- if ((status == HTTP_SERVICE_UNAVAILABLE) && worker->s->ping_timeout_set) { -- backend->close = 1; -+ status = ap_proxy_http_request(req); -+ if (status != OK) { -+ if (req->do_100_continue && status == HTTP_SERVICE_UNAVAILABLE) { - ap_log_rerror(APLOG_MARK, APLOG_INFO, status, r, APLOGNO(01115) - "HTTP: 100-Continue failed to %pI (%s)", - worker->cp->addr, worker->s->hostname_ex); -+ backend->close = 1; - retry++; - continue; -- } else { -- break; -- } -+ } - -+ break; - } - - /* Step Five: Receive the Response... Fall thru to cleanup */ -- status = ap_proxy_http_process_response(p, r, &backend, worker, -- conf, server_portstr); -+ status = ap_proxy_http_process_response(req); - - break; - } - - /* Step Six: Clean Up */ - cleanup: -- if (backend) { -+ if (req->backend) { - if (status != OK) -- backend->close = 1; -- ap_proxy_http_cleanup(proxy_function, r, backend); -+ req->backend->close = 1; -+ ap_proxy_http_cleanup(proxy_function, r, req->backend); -+ } -+ if (req->expecting_100) { -+ /* Restore r->expecting_100 if we didn't touch it */ -+ r->expecting_100 = req->expecting_100; - } - return status; - } -diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c -index c5d4f8e..e1253e4 100644 ---- a/modules/proxy/mod_proxy_uwsgi.c -+++ b/modules/proxy/mod_proxy_uwsgi.c -@@ -509,12 +509,11 @@ static int uwsgi_handler(request_rec *r, proxy_worker * worker, - } - - /* Step Three: Create conn_rec */ -- if (!backend->connection) { -- if ((status = ap_proxy_connection_create(UWSGI_SCHEME, backend, -- r->connection, -- r->server)) != OK) -- goto cleanup; -- } -+ if ((status = ap_proxy_connection_create(UWSGI_SCHEME, backend, -+ r->connection, -+ r->server)) != OK) -+ goto cleanup; -+ - - /* Step Four: Process the Request */ - if (((status = ap_setup_client_block(r, REQUEST_CHUNKED_ERROR)) != OK) -diff --git a/modules/proxy/mod_proxy_wstunnel.c b/modules/proxy/mod_proxy_wstunnel.c -index 9dda010..4aadbab 100644 ---- a/modules/proxy/mod_proxy_wstunnel.c -+++ b/modules/proxy/mod_proxy_wstunnel.c -@@ -284,8 +284,8 @@ static int proxy_wstunnel_handler(request_rec *r, proxy_worker *worker, - char server_portstr[32]; - proxy_conn_rec *backend = NULL; - char *scheme; -- int retry; - apr_pool_t *p = r->pool; -+ char *locurl = url; - apr_uri_t *uri; - int is_ssl = 0; - const char *upgrade_method = *worker->s->upgrade ? worker->s->upgrade : "WebSocket"; -@@ -318,59 +318,51 @@ static int proxy_wstunnel_handler(request_rec *r, proxy_worker *worker, - ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(02451) "serving URL %s", url); - - /* create space for state information */ -- status = ap_proxy_acquire_connection(scheme, &backend, worker, -- r->server); -+ status = ap_proxy_acquire_connection(scheme, &backend, worker, r->server); - if (status != OK) { -- if (backend) { -- backend->close = 1; -- ap_proxy_release_connection(scheme, backend, r->server); -- } -- return status; -+ goto cleanup; - } - - backend->is_ssl = is_ssl; - backend->close = 0; - -- retry = 0; -- while (retry < 2) { -- char *locurl = url; -- /* Step One: Determine Who To Connect To */ -- status = ap_proxy_determine_connection(p, r, conf, worker, backend, -- uri, &locurl, proxyname, proxyport, -- server_portstr, -- sizeof(server_portstr)); -- -- if (status != OK) -- break; -- -- /* Step Two: Make the Connection */ -- if (ap_proxy_connect_backend(scheme, backend, worker, r->server)) { -- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02452) -- "failed to make connection to backend: %s", -- backend->hostname); -- status = HTTP_SERVICE_UNAVAILABLE; -- break; -- } -- -- /* Step Three: Create conn_rec */ -- if (!backend->connection) { -- status = ap_proxy_connection_create_ex(scheme, backend, r); -- if (status != OK) { -- break; -- } -- } -- -- backend->close = 1; /* must be after ap_proxy_determine_connection */ -- -+ /* Step One: Determine Who To Connect To */ -+ status = ap_proxy_determine_connection(p, r, conf, worker, backend, -+ uri, &locurl, proxyname, proxyport, -+ server_portstr, -+ sizeof(server_portstr)); -+ -+ if (status != OK) { -+ goto cleanup; -+ } -+ -+ /* Step Two: Make the Connection */ -+ if (ap_proxy_connect_backend(scheme, backend, worker, r->server)) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02452) -+ "failed to make connection to backend: %s", -+ backend->hostname); -+ status = HTTP_SERVICE_UNAVAILABLE; -+ goto cleanup; -+ } - -- /* Step Three: Process the Request */ -- status = proxy_wstunnel_request(p, r, backend, worker, conf, uri, locurl, -- server_portstr); -- break; -+ /* Step Three: Create conn_rec */ -+ /* keep it because of */ -+ /* https://github.com/apache/httpd/commit/313d5ee40f390da1a6ee2c2752864ad3aad0a1c3 */ -+ status = ap_proxy_connection_create_ex(scheme, backend, r); -+ if (status != OK) { -+ goto cleanup; - } -+ -+ /* Step Four: Process the Request */ -+ status = proxy_wstunnel_request(p, r, backend, worker, conf, uri, locurl, -+ server_portstr); - -+cleanup: - /* Do not close the socket */ -- ap_proxy_release_connection(scheme, backend, r->server); -+ if (backend) { -+ backend->close = 1; -+ ap_proxy_release_connection(scheme, backend, r->server); -+ } - return status; - } - -diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c -index 0bbfa59..0759dac 100644 ---- a/modules/proxy/proxy_util.c -+++ b/modules/proxy/proxy_util.c -@@ -3573,10 +3573,7 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - * To be compliant, we only use 100-Continue for requests with bodies. - * We also make sure we won't be talking HTTP/1.0 as well. - */ -- do_100_continue = (worker->s->ping_timeout_set -- && ap_request_has_body(r) -- && (PROXYREQ_REVERSE == r->proxyreq) -- && !(apr_table_get(r->subprocess_env, "force-proxy-request-1.0"))); -+ do_100_continue = PROXY_DO_100_CONTINUE(worker, r); - - if (apr_table_get(r->subprocess_env, "force-proxy-request-1.0")) { - /* -@@ -3593,7 +3590,9 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - buf = apr_pstrcat(p, r->method, " ", url, " HTTP/1.1" CRLF, NULL); - } - if (apr_table_get(r->subprocess_env, "proxy-nokeepalive")) { -- origin->keepalive = AP_CONN_CLOSE; -+ if (origin) { -+ origin->keepalive = AP_CONN_CLOSE; -+ } - p_conn->close = 1; - } - ap_xlate_proto_to_ascii(buf, strlen(buf)); -@@ -3685,14 +3684,6 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - if (do_100_continue) { - const char *val; - -- if (!r->expecting_100) { -- /* Don't forward any "100 Continue" response if the client is -- * not expecting it. -- */ -- apr_table_setn(r->subprocess_env, "proxy-interim-response", -- "Suppress"); -- } -- - /* Add the Expect header if not already there. */ - if (((val = apr_table_get(r->headers_in, "Expect")) == NULL) - || (strcasecmp(val, "100-Continue") != 0 /* fast path */ -diff --git a/server/protocol.c b/server/protocol.c -index 8d90055..8d1fdd2 100644 ---- a/server/protocol.c -+++ b/server/protocol.c -@@ -2188,21 +2188,23 @@ AP_DECLARE(void) ap_send_interim_response(request_rec *r, int send_headers) - "Status is %d - not sending interim response", r->status); - return; - } -- if ((r->status == HTTP_CONTINUE) && !r->expecting_100) { -- /* -- * Don't send 100-Continue when there was no Expect: 100-continue -- * in the request headers. For origin servers this is a SHOULD NOT -- * for proxies it is a MUST NOT according to RFC 2616 8.2.3 -- */ -- return; -- } -+ if (r->status == HTTP_CONTINUE) { -+ if (!r->expecting_100) { -+ /* -+ * Don't send 100-Continue when there was no Expect: 100-continue -+ * in the request headers. For origin servers this is a SHOULD NOT -+ * for proxies it is a MUST NOT according to RFC 2616 8.2.3 -+ */ -+ return; -+ } - -- /* if we send an interim response, we're no longer in a state of -- * expecting one. Also, this could feasibly be in a subrequest, -- * so we need to propagate the fact that we responded. -- */ -- for (rr = r; rr != NULL; rr = rr->main) { -- rr->expecting_100 = 0; -+ /* if we send an interim response, we're no longer in a state of -+ * expecting one. Also, this could feasibly be in a subrequest, -+ * so we need to propagate the fact that we responded. -+ */ -+ for (rr = r; rr != NULL; rr = rr->main) { -+ rr->expecting_100 = 0; -+ } - } - - status_line = apr_pstrcat(r->pool, AP_SERVER_PROTOCOL, " ", r->status_line, CRLF, NULL); diff --git a/SOURCES/httpd-2.4.37-r1828172+.patch b/SOURCES/httpd-2.4.37-r1828172+.patch deleted file mode 100644 index 72b124b..0000000 --- a/SOURCES/httpd-2.4.37-r1828172+.patch +++ /dev/null @@ -1,1420 +0,0 @@ -# ./pullrev.sh 1828172 1862968 1863191 1867878 1867882 1867968 1867970 1867971 -http://svn.apache.org/viewvc?view=revision&revision=1828172 -http://svn.apache.org/viewvc?view=revision&revision=1862968 -http://svn.apache.org/viewvc?view=revision&revision=1863191 -http://svn.apache.org/viewvc?view=revision&revision=1867878 -http://svn.apache.org/viewvc?view=revision&revision=1867882 -http://svn.apache.org/viewvc?view=revision&revision=1867968 -http://svn.apache.org/viewvc?view=revision&revision=1867970 -http://svn.apache.org/viewvc?view=revision&revision=1867971 - ---- httpd-2.4.41/modules/generators/mod_cgi.c -+++ httpd-2.4.41/modules/generators/mod_cgi.c -@@ -92,6 +92,10 @@ - apr_size_t bufbytes; - } cgi_server_conf; - -+typedef struct { -+ apr_interval_time_t timeout; -+} cgi_dirconf; -+ - static void *create_cgi_config(apr_pool_t *p, server_rec *s) - { - cgi_server_conf *c = -@@ -112,6 +116,12 @@ - return overrides->logname ? overrides : base; - } - -+static void *create_cgi_dirconf(apr_pool_t *p, char *dummy) -+{ -+ cgi_dirconf *c = (cgi_dirconf *) apr_pcalloc(p, sizeof(cgi_dirconf)); -+ return c; -+} -+ - static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg) - { - server_rec *s = cmd->server; -@@ -150,6 +160,17 @@ - return NULL; - } - -+static const char *set_script_timeout(cmd_parms *cmd, void *dummy, const char *arg) -+{ -+ cgi_dirconf *dc = dummy; -+ -+ if (ap_timeout_parameter_parse(arg, &dc->timeout, "s") != APR_SUCCESS) { -+ return "CGIScriptTimeout has wrong format"; -+ } -+ -+ return NULL; -+} -+ - static const command_rec cgi_cmds[] = - { - AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF, -@@ -158,6 +179,9 @@ - "the maximum length (in bytes) of the script debug log"), - AP_INIT_TAKE1("ScriptLogBuffer", set_scriptlog_buffer, NULL, RSRC_CONF, - "the maximum size (in bytes) to record of a POST request"), -+AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_CONF, -+ "The amount of time to wait between successful reads from " -+ "the CGI script, in seconds."), - {NULL} - }; - -@@ -471,23 +495,26 @@ - apr_filepath_name_get(r->filename)); - } - else { -+ cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module); -+ apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; -+ - apr_pool_note_subprocess(p, procnew, APR_KILL_AFTER_TIMEOUT); - - *script_in = procnew->out; - if (!*script_in) - return APR_EBADF; -- apr_file_pipe_timeout_set(*script_in, r->server->timeout); -+ apr_file_pipe_timeout_set(*script_in, timeout); - - if (e_info->prog_type == RUN_AS_CGI) { - *script_out = procnew->in; - if (!*script_out) - return APR_EBADF; -- apr_file_pipe_timeout_set(*script_out, r->server->timeout); -+ apr_file_pipe_timeout_set(*script_out, timeout); - - *script_err = procnew->err; - if (!*script_err) - return APR_EBADF; -- apr_file_pipe_timeout_set(*script_err, r->server->timeout); -+ apr_file_pipe_timeout_set(*script_err, timeout); - } - } - } -@@ -541,212 +568,10 @@ - return APR_SUCCESS; - } - --static void discard_script_output(apr_bucket_brigade *bb) --{ -- apr_bucket *e; -- const char *buf; -- apr_size_t len; -- apr_status_t rv; -- -- for (e = APR_BRIGADE_FIRST(bb); -- e != APR_BRIGADE_SENTINEL(bb); -- e = APR_BUCKET_NEXT(e)) -- { -- if (APR_BUCKET_IS_EOS(e)) { -- break; -- } -- rv = apr_bucket_read(e, &buf, &len, APR_BLOCK_READ); -- if (rv != APR_SUCCESS) { -- break; -- } -- } --} -- - #if APR_FILES_AS_SOCKETS -- --/* A CGI bucket type is needed to catch any output to stderr from the -- * script; see PR 22030. */ --static const apr_bucket_type_t bucket_type_cgi; -- --struct cgi_bucket_data { -- apr_pollset_t *pollset; -- request_rec *r; --}; -- --/* Create a CGI bucket using pipes from script stdout 'out' -- * and stderr 'err', for request 'r'. */ --static apr_bucket *cgi_bucket_create(request_rec *r, -- apr_file_t *out, apr_file_t *err, -- apr_bucket_alloc_t *list) --{ -- apr_bucket *b = apr_bucket_alloc(sizeof(*b), list); -- apr_status_t rv; -- apr_pollfd_t fd; -- struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data); -- -- APR_BUCKET_INIT(b); -- b->free = apr_bucket_free; -- b->list = list; -- b->type = &bucket_type_cgi; -- b->length = (apr_size_t)(-1); -- b->start = -1; -- -- /* Create the pollset */ -- rv = apr_pollset_create(&data->pollset, 2, r->pool, 0); -- if (rv != APR_SUCCESS) { -- ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01217) -- "apr_pollset_create(); check system or user limits"); -- return NULL; -- } -- -- fd.desc_type = APR_POLL_FILE; -- fd.reqevents = APR_POLLIN; -- fd.p = r->pool; -- fd.desc.f = out; /* script's stdout */ -- fd.client_data = (void *)1; -- rv = apr_pollset_add(data->pollset, &fd); -- if (rv != APR_SUCCESS) { -- ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01218) -- "apr_pollset_add(); check system or user limits"); -- return NULL; -- } -- -- fd.desc.f = err; /* script's stderr */ -- fd.client_data = (void *)2; -- rv = apr_pollset_add(data->pollset, &fd); -- if (rv != APR_SUCCESS) { -- ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01219) -- "apr_pollset_add(); check system or user limits"); -- return NULL; -- } -- -- data->r = r; -- b->data = data; -- return b; --} -- --/* Create a duplicate CGI bucket using given bucket data */ --static apr_bucket *cgi_bucket_dup(struct cgi_bucket_data *data, -- apr_bucket_alloc_t *list) --{ -- apr_bucket *b = apr_bucket_alloc(sizeof(*b), list); -- APR_BUCKET_INIT(b); -- b->free = apr_bucket_free; -- b->list = list; -- b->type = &bucket_type_cgi; -- b->length = (apr_size_t)(-1); -- b->start = -1; -- b->data = data; -- return b; --} -- --/* Handle stdout from CGI child. Duplicate of logic from the _read -- * method of the real APR pipe bucket implementation. */ --static apr_status_t cgi_read_stdout(apr_bucket *a, apr_file_t *out, -- const char **str, apr_size_t *len) --{ -- char *buf; -- apr_status_t rv; -- -- *str = NULL; -- *len = APR_BUCKET_BUFF_SIZE; -- buf = apr_bucket_alloc(*len, a->list); /* XXX: check for failure? */ -- -- rv = apr_file_read(out, buf, len); -- -- if (rv != APR_SUCCESS && rv != APR_EOF) { -- apr_bucket_free(buf); -- return rv; -- } -- -- if (*len > 0) { -- struct cgi_bucket_data *data = a->data; -- apr_bucket_heap *h; -- -- /* Change the current bucket to refer to what we read */ -- a = apr_bucket_heap_make(a, buf, *len, apr_bucket_free); -- h = a->data; -- h->alloc_len = APR_BUCKET_BUFF_SIZE; /* note the real buffer size */ -- *str = buf; -- APR_BUCKET_INSERT_AFTER(a, cgi_bucket_dup(data, a->list)); -- } -- else { -- apr_bucket_free(buf); -- a = apr_bucket_immortal_make(a, "", 0); -- *str = a->data; -- } -- return rv; --} -- --/* Read method of CGI bucket: polls on stderr and stdout of the child, -- * sending any stderr output immediately away to the error log. */ --static apr_status_t cgi_bucket_read(apr_bucket *b, const char **str, -- apr_size_t *len, apr_read_type_e block) --{ -- struct cgi_bucket_data *data = b->data; -- apr_interval_time_t timeout; -- apr_status_t rv; -- int gotdata = 0; -- -- timeout = block == APR_NONBLOCK_READ ? 0 : data->r->server->timeout; -- -- do { -- const apr_pollfd_t *results; -- apr_int32_t num; -- -- rv = apr_pollset_poll(data->pollset, timeout, &num, &results); -- if (APR_STATUS_IS_TIMEUP(rv)) { -- if (timeout) { -- ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, data->r, APLOGNO(01220) -- "Timeout waiting for output from CGI script %s", -- data->r->filename); -- return rv; -- } -- else { -- return APR_EAGAIN; -- } -- } -- else if (APR_STATUS_IS_EINTR(rv)) { -- continue; -- } -- else if (rv != APR_SUCCESS) { -- ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, data->r, APLOGNO(01221) -- "poll failed waiting for CGI child"); -- return rv; -- } -- -- for (; num; num--, results++) { -- if (results[0].client_data == (void *)1) { -- /* stdout */ -- rv = cgi_read_stdout(b, results[0].desc.f, str, len); -- if (APR_STATUS_IS_EOF(rv)) { -- rv = APR_SUCCESS; -- } -- gotdata = 1; -- } else { -- /* stderr */ -- apr_status_t rv2 = log_script_err(data->r, results[0].desc.f); -- if (APR_STATUS_IS_EOF(rv2)) { -- apr_pollset_remove(data->pollset, &results[0]); -- } -- } -- } -- -- } while (!gotdata); -- -- return rv; --} -- --static const apr_bucket_type_t bucket_type_cgi = { -- "CGI", 5, APR_BUCKET_DATA, -- apr_bucket_destroy_noop, -- cgi_bucket_read, -- apr_bucket_setaside_notimpl, -- apr_bucket_split_notimpl, -- apr_bucket_copy_notimpl --}; -- -+#define WANT_CGI_BUCKET - #endif -+#include "cgi_common.h" - - static int cgi_handler(request_rec *r) - { -@@ -766,6 +591,8 @@ - apr_status_t rv; - cgi_exec_info_t e_info; - conn_rec *c; -+ cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module); -+ apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; - - if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { - return DECLINED; -@@ -925,10 +752,7 @@ - AP_DEBUG_ASSERT(script_in != NULL); - - #if APR_FILES_AS_SOCKETS -- apr_file_pipe_timeout_set(script_in, 0); -- apr_file_pipe_timeout_set(script_err, 0); -- -- b = cgi_bucket_create(r, script_in, script_err, c->bucket_alloc); -+ b = cgi_bucket_create(r, dc->timeout, script_in, script_err, c->bucket_alloc); - if (b == NULL) - return HTTP_INTERNAL_SERVER_ERROR; - #else -@@ -938,111 +762,7 @@ - b = apr_bucket_eos_create(c->bucket_alloc); - APR_BRIGADE_INSERT_TAIL(bb, b); - -- /* Handle script return... */ -- if (!nph) { -- const char *location; -- char sbuf[MAX_STRING_LEN]; -- int ret; -- -- if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, -- APLOG_MODULE_INDEX))) -- { -- ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err); -- -- /* -- * ret could be HTTP_NOT_MODIFIED in the case that the CGI script -- * does not set an explicit status and ap_meets_conditions, which -- * is called by ap_scan_script_header_err_brigade, detects that -- * the conditions of the requests are met and the response is -- * not modified. -- * In this case set r->status and return OK in order to prevent -- * running through the error processing stack as this would -- * break with mod_cache, if the conditions had been set by -- * mod_cache itself to validate a stale entity. -- * BTW: We circumvent the error processing stack anyway if the -- * CGI script set an explicit status code (whatever it is) and -- * the only possible values for ret here are: -- * -- * HTTP_NOT_MODIFIED (set by ap_meets_conditions) -- * HTTP_PRECONDITION_FAILED (set by ap_meets_conditions) -- * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the -- * processing of the response of the CGI script, e.g broken headers -- * or a crashed CGI process). -- */ -- if (ret == HTTP_NOT_MODIFIED) { -- r->status = ret; -- return OK; -- } -- -- return ret; -- } -- -- location = apr_table_get(r->headers_out, "Location"); -- -- if (location && r->status == 200) { -- /* For a redirect whether internal or not, discard any -- * remaining stdout from the script, and log any remaining -- * stderr output, as normal. */ -- discard_script_output(bb); -- apr_brigade_destroy(bb); -- apr_file_pipe_timeout_set(script_err, r->server->timeout); -- log_script_err(r, script_err); -- } -- -- if (location && location[0] == '/' && r->status == 200) { -- /* This redirect needs to be a GET no matter what the original -- * method was. -- */ -- r->method = "GET"; -- r->method_number = M_GET; -- -- /* We already read the message body (if any), so don't allow -- * the redirected request to think it has one. We can ignore -- * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR. -- */ -- apr_table_unset(r->headers_in, "Content-Length"); -- -- ap_internal_redirect_handler(location, r); -- return OK; -- } -- else if (location && r->status == 200) { -- /* XXX: Note that if a script wants to produce its own Redirect -- * body, it now has to explicitly *say* "Status: 302" -- */ -- return HTTP_MOVED_TEMPORARILY; -- } -- -- rv = ap_pass_brigade(r->output_filters, bb); -- } -- else /* nph */ { -- struct ap_filter_t *cur; -- -- /* get rid of all filters up through protocol... since we -- * haven't parsed off the headers, there is no way they can -- * work -- */ -- -- cur = r->proto_output_filters; -- while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) { -- cur = cur->next; -- } -- r->output_filters = r->proto_output_filters = cur; -- -- rv = ap_pass_brigade(r->output_filters, bb); -- } -- -- /* don't soak up script output if errors occurred writing it -- * out... otherwise, we prolong the life of the script when the -- * connection drops or we stopped sending output for some other -- * reason */ -- if (rv == APR_SUCCESS && !r->connection->aborted) { -- apr_file_pipe_timeout_set(script_err, r->server->timeout); -- log_script_err(r, script_err); -- } -- -- apr_file_close(script_err); -- -- return OK; /* NOT r->status, even if it has changed. */ -+ return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err); - } - - /*============================================================================ -@@ -1277,7 +997,7 @@ - AP_DECLARE_MODULE(cgi) = - { - STANDARD20_MODULE_STUFF, -- NULL, /* dir config creater */ -+ create_cgi_dirconf, /* dir config creater */ - NULL, /* dir merger --- default is to override */ - create_cgi_config, /* server config */ - merge_cgi_config, /* merge server config */ ---- httpd-2.4.41/modules/generators/config5.m4 -+++ httpd-2.4.41/modules/generators/config5.m4 -@@ -78,4 +78,15 @@ - - APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current]) - -+AC_ARG_ENABLE(cgid-fdpassing, -+ [APACHE_HELP_STRING(--enable-cgid-fdpassing,Enable experimental mod_cgid support for fd passing)], -+ [if test "$enableval" = "yes"; then -+ AC_CHECK_DECL(CMSG_DATA, -+ [AC_DEFINE([HAVE_CGID_FDPASSING], 1, [Enable FD passing support in mod_cgid])], -+ [AC_MSG_ERROR([cannot support mod_cgid fd-passing on this system])], [ -+#include <sys/types.h> -+#include <sys/socket.h>]) -+ fi -+]) -+ - APACHE_MODPATH_FINISH ---- httpd-2.4.41/modules/generators/mod_cgid.c -+++ httpd-2.4.41/modules/generators/mod_cgid.c -@@ -342,15 +342,19 @@ - return close(fd); - } - --/* deal with incomplete reads and signals -- * assume you really have to read buf_size bytes -- */ --static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size) -+/* Read from the socket dealing with incomplete messages and signals. -+ * Returns 0 on success or errno on failure. Stderr fd passed as -+ * auxiliary data from other end is written to *errfd, or else stderr -+ * fileno if not present. */ -+static apr_status_t sock_readhdr(int fd, int *errfd, void *vbuf, size_t buf_size) - { -- char *buf = vbuf; - int rc; -+#ifndef HAVE_CGID_FDPASSING -+ char *buf = vbuf; - size_t bytes_read = 0; - -+ if (errfd) *errfd = 0; -+ - do { - do { - rc = read(fd, buf + bytes_read, buf_size - bytes_read); -@@ -365,9 +369,60 @@ - } - } while (bytes_read < buf_size); - -+ -+#else /* with FD passing */ -+ struct msghdr msg = {0}; -+ struct iovec vec = {vbuf, buf_size}; -+ struct cmsghdr *cmsg; -+ union { /* union to ensure alignment */ -+ struct cmsghdr cm; -+ char buf[CMSG_SPACE(sizeof(int))]; -+ } u; -+ -+ msg.msg_iov = &vec; -+ msg.msg_iovlen = 1; -+ -+ if (errfd) { -+ msg.msg_control = u.buf; -+ msg.msg_controllen = sizeof(u.buf); -+ *errfd = 0; -+ } -+ -+ /* use MSG_WAITALL to skip loop on truncated reads */ -+ do { -+ rc = recvmsg(fd, &msg, MSG_WAITALL); -+ } while (rc < 0 && errno == EINTR); -+ -+ if (rc == 0) { -+ return ECONNRESET; -+ } -+ else if (rc < 0) { -+ return errno; -+ } -+ else if (rc != buf_size) { -+ /* MSG_WAITALL should ensure the recvmsg blocks until the -+ * entire length is read, but let's be paranoid. */ -+ return APR_INCOMPLETE; -+ } -+ -+ if (errfd -+ && (cmsg = CMSG_FIRSTHDR(&msg)) != NULL -+ && cmsg->cmsg_len == CMSG_LEN(sizeof(*errfd)) -+ && cmsg->cmsg_level == SOL_SOCKET -+ && cmsg->cmsg_type == SCM_RIGHTS) { -+ *errfd = *((int *) CMSG_DATA(cmsg)); -+ } -+#endif -+ - return APR_SUCCESS; - } - -+/* As sock_readhdr but without auxiliary fd passing. */ -+static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size) -+{ -+ return sock_readhdr(fd, NULL, vbuf, buf_size); -+} -+ - /* deal with signals - */ - static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) -@@ -384,7 +439,7 @@ - return APR_SUCCESS; - } - --static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) -+static apr_status_t sock_writev(int fd, int auxfd, request_rec *r, int count, ...) - { - va_list ap; - int rc; -@@ -399,9 +454,39 @@ - } - va_end(ap); - -+#ifndef HAVE_CGID_FDPASSING - do { - rc = writev(fd, vec, count); - } while (rc < 0 && errno == EINTR); -+#else -+ { -+ struct msghdr msg = { 0 }; -+ struct cmsghdr *cmsg; -+ union { /* union for alignment */ -+ char buf[CMSG_SPACE(sizeof(int))]; -+ struct cmsghdr align; -+ } u; -+ -+ msg.msg_iov = vec; -+ msg.msg_iovlen = count; -+ -+ if (auxfd) { -+ msg.msg_control = u.buf; -+ msg.msg_controllen = sizeof(u.buf); -+ -+ cmsg = CMSG_FIRSTHDR(&msg); -+ cmsg->cmsg_level = SOL_SOCKET; -+ cmsg->cmsg_type = SCM_RIGHTS; -+ cmsg->cmsg_len = CMSG_LEN(sizeof(int)); -+ *((int *) CMSG_DATA(cmsg)) = auxfd; -+ } -+ -+ do { -+ rc = sendmsg(fd, &msg, 0); -+ } while (rc < 0 && errno == EINTR); -+ } -+#endif -+ - if (rc < 0) { - return errno; - } -@@ -410,7 +495,7 @@ - } - - static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, -- cgid_req_t *req) -+ int *errfd, cgid_req_t *req) - { - int i; - char **environ; -@@ -421,7 +506,7 @@ - r->server = apr_pcalloc(r->pool, sizeof(server_rec)); - - /* read the request header */ -- stat = sock_read(fd, req, sizeof(*req)); -+ stat = sock_readhdr(fd, errfd, req, sizeof(*req)); - if (stat != APR_SUCCESS) { - return stat; - } -@@ -479,14 +564,15 @@ - return APR_SUCCESS; - } - --static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, -- int req_type) -+static apr_status_t send_req(int fd, apr_file_t *errpipe, request_rec *r, -+ char *argv0, char **env, int req_type) - { - int i; - cgid_req_t req = {0}; - apr_status_t stat; - ap_unix_identity_t * ugid = ap_run_get_suexec_identity(r); - core_dir_config *core_conf = ap_get_core_module_config(r->per_dir_config); -+ int errfd; - - - if (ugid == NULL) { -@@ -507,16 +593,21 @@ - req.args_len = r->args ? strlen(r->args) : 0; - req.loglevel = r->server->log.level; - -+ if (errpipe) -+ apr_os_file_get(&errfd, errpipe); -+ else -+ errfd = 0; -+ - /* Write the request header */ - if (req.args_len) { -- stat = sock_writev(fd, r, 5, -+ stat = sock_writev(fd, errfd, r, 5, - &req, sizeof(req), - r->filename, req.filename_len, - argv0, req.argv0_len, - r->uri, req.uri_len, - r->args, req.args_len); - } else { -- stat = sock_writev(fd, r, 4, -+ stat = sock_writev(fd, errfd, r, 4, - &req, sizeof(req), - r->filename, req.filename_len, - argv0, req.argv0_len, -@@ -531,7 +622,7 @@ - for (i = 0; i < req.env_count; i++) { - apr_size_t curlen = strlen(env[i]); - -- if ((stat = sock_writev(fd, r, 2, &curlen, sizeof(curlen), -+ if ((stat = sock_writev(fd, 0, r, 2, &curlen, sizeof(curlen), - env[i], curlen)) != APR_SUCCESS) { - return stat; - } -@@ -582,20 +673,34 @@ - } - } - -+/* Callback executed in the forked child process if exec of the CGI -+ * script fails. For the fd-passing case, output to stderr goes to -+ * the client (request handling thread) and is logged via -+ * ap_log_rerror there. For the non-fd-passing case, the "fake" -+ * request_rec passed via userdata is used to log. */ - static void cgid_child_errfn(apr_pool_t *pool, apr_status_t err, - const char *description) - { -- request_rec *r; - void *vr; - - apr_pool_userdata_get(&vr, ERRFN_USERDATA_KEY, pool); -- r = vr; -- -- /* sure we got r, but don't call ap_log_rerror() because we don't -- * have r->headers_in and possibly other storage referenced by -- * ap_log_rerror() -- */ -- ap_log_error(APLOG_MARK, APLOG_ERR, err, r->server, APLOGNO(01241) "%s", description); -+ if (vr) { -+ request_rec *r = vr; -+ -+ /* sure we got r, but don't call ap_log_rerror() because we don't -+ * have r->headers_in and possibly other storage referenced by -+ * ap_log_rerror() -+ */ -+ ap_log_error(APLOG_MARK, APLOG_ERR, err, r->server, APLOGNO(01241) "%s", description); -+ } -+ else { -+ const char *logstr; -+ -+ logstr = apr_psprintf(pool, APLOGNO(01241) "error spawning CGI child: %s (%pm)\n", -+ description, &err); -+ fputs(logstr, stderr); -+ fflush(stderr); -+ } - } - - static int cgid_server(void *data) -@@ -669,7 +774,7 @@ - } - - while (!daemon_should_exit) { -- int errfileno = STDERR_FILENO; -+ int errfileno; - char *argv0 = NULL; - char **env = NULL; - const char * const *argv; -@@ -709,7 +814,7 @@ - r = apr_pcalloc(ptrans, sizeof(request_rec)); - procnew = apr_pcalloc(ptrans, sizeof(*procnew)); - r->pool = ptrans; -- stat = get_req(sd2, r, &argv0, &env, &cgid_req); -+ stat = get_req(sd2, r, &argv0, &env, &errfileno, &cgid_req); - if (stat != APR_SUCCESS) { - ap_log_error(APLOG_MARK, APLOG_ERR, stat, - main_server, APLOGNO(01248) -@@ -741,6 +846,16 @@ - continue; - } - -+ if (errfileno == 0) { -+ errfileno = STDERR_FILENO; -+ } -+ else { -+ ap_log_error(APLOG_MARK, APLOG_DEBUG, rv, main_server, -+ "using passed fd %d as stderr", errfileno); -+ /* Limit the received fd lifetime to pool lifetime */ -+ apr_pool_cleanup_register(ptrans, (void *)((long)errfileno), -+ close_unix_socket, close_unix_socket); -+ } - apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool); - apr_os_file_put(&inout, &sd2, 0, r->pool); - -@@ -800,7 +915,10 @@ - close(sd2); - } - else { -- apr_pool_userdata_set(r, ERRFN_USERDATA_KEY, apr_pool_cleanup_null, ptrans); -+ if (errfileno == STDERR_FILENO) { -+ /* Used by cgid_child_errfn without fd-passing. */ -+ apr_pool_userdata_set(r, ERRFN_USERDATA_KEY, apr_pool_cleanup_null, ptrans); -+ } - - argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args); - -@@ -1099,6 +1217,33 @@ - return ret; - } - -+/* Soak up stderr from a script and redirect it to the error log. -+ * TODO: log_scripterror() and this could move to cgi_common.h. */ -+static apr_status_t log_script_err(request_rec *r, apr_file_t *script_err) -+{ -+ char argsbuffer[HUGE_STRING_LEN]; -+ char *newline; -+ apr_status_t rv; -+ cgid_server_conf *conf = ap_get_module_config(r->server->module_config, &cgid_module); -+ -+ while ((rv = apr_file_gets(argsbuffer, HUGE_STRING_LEN, -+ script_err)) == APR_SUCCESS) { -+ -+ newline = strchr(argsbuffer, '\n'); -+ if (newline) { -+ char *prev = newline - 1; -+ if (prev >= argsbuffer && *prev == '\r') { -+ newline = prev; -+ } -+ -+ *newline = '\0'; -+ } -+ log_scripterror(r, conf, r->status, 0, argsbuffer); -+ } -+ -+ return rv; -+} -+ - static int log_script(request_rec *r, cgid_server_conf * conf, int ret, - char *dbuf, const char *sbuf, apr_bucket_brigade *bb, - apr_file_t *script_err) -@@ -1204,6 +1349,13 @@ - return ret; - } - -+/* Pull in CGI bucket implementation. */ -+#define cgi_server_conf cgid_server_conf -+#ifdef HAVE_CGID_FDPASSING -+#define WANT_CGI_BUCKET -+#endif -+#include "cgi_common.h" -+ - static int connect_to_daemon(int *sdptr, request_rec *r, - cgid_server_conf *conf) - { -@@ -1270,27 +1422,6 @@ - return OK; - } - --static void discard_script_output(apr_bucket_brigade *bb) --{ -- apr_bucket *e; -- const char *buf; -- apr_size_t len; -- apr_status_t rv; -- -- for (e = APR_BRIGADE_FIRST(bb); -- e != APR_BRIGADE_SENTINEL(bb); -- e = APR_BUCKET_NEXT(e)) -- { -- if (APR_BUCKET_IS_EOS(e)) { -- break; -- } -- rv = apr_bucket_read(e, &buf, &len, APR_BLOCK_READ); -- if (rv != APR_SUCCESS) { -- break; -- } -- } --} -- - /**************************************************************** - * - * Actual cgid handling... -@@ -1395,6 +1526,7 @@ - - static int cgid_handler(request_rec *r) - { -+ conn_rec *c = r->connection; - int retval, nph, dbpos; - char *argv0, *dbuf; - apr_bucket_brigade *bb; -@@ -1404,10 +1536,11 @@ - int seen_eos, child_stopped_reading; - int sd; - char **env; -- apr_file_t *tempsock; -+ apr_file_t *tempsock, *script_err, *errpipe_out; - struct cleanup_script_info *info; - apr_status_t rv; - cgid_dirconf *dc; -+ apr_interval_time_t timeout; - - if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { - return DECLINED; -@@ -1416,7 +1549,7 @@ - conf = ap_get_module_config(r->server->module_config, &cgid_module); - dc = ap_get_module_config(r->per_dir_config, &cgid_module); - -- -+ timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; - is_included = !strcmp(r->protocol, "INCLUDED"); - - if ((argv0 = strrchr(r->filename, '/')) != NULL) { -@@ -1469,6 +1602,17 @@ - } - */ - -+#ifdef HAVE_CGID_FDPASSING -+ rv = apr_file_pipe_create(&script_err, &errpipe_out, r->pool); -+ if (rv) { -+ return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10176) -+ "could not create pipe for stderr"); -+ } -+#else -+ script_err = NULL; -+ errpipe_out = NULL; -+#endif -+ - /* - * httpd core function used to add common environment variables like - * DOCUMENT_ROOT. -@@ -1481,12 +1625,16 @@ - return retval; - } - -- rv = send_req(sd, r, argv0, env, CGI_REQ); -+ rv = send_req(sd, errpipe_out, r, argv0, env, CGI_REQ); - if (rv != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01268) - "write to cgi daemon process"); - } - -+ /* The write-end of the pipe is only used by the server, so close -+ * it here. */ -+ if (errpipe_out) apr_file_close(errpipe_out); -+ - info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); - info->conf = conf; - info->r = r; -@@ -1508,12 +1656,7 @@ - */ - - apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool); -- if (dc->timeout > 0) { -- apr_file_pipe_timeout_set(tempsock, dc->timeout); -- } -- else { -- apr_file_pipe_timeout_set(tempsock, r->server->timeout); -- } -+ apr_file_pipe_timeout_set(tempsock, timeout); - apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket); - - /* Transfer any put/post args, CERN style... -@@ -1605,114 +1748,19 @@ - */ - shutdown(sd, 1); - -- /* Handle script return... */ -- if (!nph) { -- conn_rec *c = r->connection; -- const char *location; -- char sbuf[MAX_STRING_LEN]; -- int ret; -- -- bb = apr_brigade_create(r->pool, c->bucket_alloc); -- b = apr_bucket_pipe_create(tempsock, c->bucket_alloc); -- APR_BRIGADE_INSERT_TAIL(bb, b); -- b = apr_bucket_eos_create(c->bucket_alloc); -- APR_BRIGADE_INSERT_TAIL(bb, b); -- -- if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, -- APLOG_MODULE_INDEX))) -- { -- ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL); -- -- /* -- * ret could be HTTP_NOT_MODIFIED in the case that the CGI script -- * does not set an explicit status and ap_meets_conditions, which -- * is called by ap_scan_script_header_err_brigade, detects that -- * the conditions of the requests are met and the response is -- * not modified. -- * In this case set r->status and return OK in order to prevent -- * running through the error processing stack as this would -- * break with mod_cache, if the conditions had been set by -- * mod_cache itself to validate a stale entity. -- * BTW: We circumvent the error processing stack anyway if the -- * CGI script set an explicit status code (whatever it is) and -- * the only possible values for ret here are: -- * -- * HTTP_NOT_MODIFIED (set by ap_meets_conditions) -- * HTTP_PRECONDITION_FAILED (set by ap_meets_conditions) -- * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the -- * processing of the response of the CGI script, e.g broken headers -- * or a crashed CGI process). -- */ -- if (ret == HTTP_NOT_MODIFIED) { -- r->status = ret; -- return OK; -- } -- -- return ret; -- } -- -- location = apr_table_get(r->headers_out, "Location"); -- -- if (location && location[0] == '/' && r->status == 200) { -- -- /* Soak up all the script output */ -- discard_script_output(bb); -- apr_brigade_destroy(bb); -- /* This redirect needs to be a GET no matter what the original -- * method was. -- */ -- r->method = "GET"; -- r->method_number = M_GET; -- -- /* We already read the message body (if any), so don't allow -- * the redirected request to think it has one. We can ignore -- * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR. -- */ -- apr_table_unset(r->headers_in, "Content-Length"); -- -- ap_internal_redirect_handler(location, r); -- return OK; -- } -- else if (location && r->status == 200) { -- /* XXX: Note that if a script wants to produce its own Redirect -- * body, it now has to explicitly *say* "Status: 302" -- */ -- discard_script_output(bb); -- apr_brigade_destroy(bb); -- return HTTP_MOVED_TEMPORARILY; -- } -- -- rv = ap_pass_brigade(r->output_filters, bb); -- if (rv != APR_SUCCESS) { -- ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r, -- "Failed to flush CGI output to client"); -- } -- } -- -- if (nph) { -- conn_rec *c = r->connection; -- struct ap_filter_t *cur; -- -- /* get rid of all filters up through protocol... since we -- * haven't parsed off the headers, there is no way they can -- * work -- */ -- -- cur = r->proto_output_filters; -- while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) { -- cur = cur->next; -- } -- r->output_filters = r->proto_output_filters = cur; -- -- bb = apr_brigade_create(r->pool, c->bucket_alloc); -- b = apr_bucket_pipe_create(tempsock, c->bucket_alloc); -- APR_BRIGADE_INSERT_TAIL(bb, b); -- b = apr_bucket_eos_create(c->bucket_alloc); -- APR_BRIGADE_INSERT_TAIL(bb, b); -- ap_pass_brigade(r->output_filters, bb); -- } -+ bb = apr_brigade_create(r->pool, c->bucket_alloc); -+#ifdef HAVE_CGID_FDPASSING -+ b = cgi_bucket_create(r, dc->timeout, tempsock, script_err, c->bucket_alloc); -+ if (b == NULL) -+ return HTTP_INTERNAL_SERVER_ERROR; /* should call log_scripterror() w/ _UNAVAILABLE? */ -+#else -+ b = apr_bucket_pipe_create(tempsock, c->bucket_alloc); -+#endif -+ APR_BRIGADE_INSERT_TAIL(bb, b); -+ b = apr_bucket_eos_create(c->bucket_alloc); -+ APR_BRIGADE_INSERT_TAIL(bb, b); - -- return OK; /* NOT r->status, even if it has changed. */ -+ return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err); - } - - -@@ -1829,7 +1877,7 @@ - return retval; - } - -- send_req(sd, r, command, env, SSI_REQ); -+ send_req(sd, NULL, r, command, env, SSI_REQ); - - info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); - info->conf = conf; ---- httpd-2.4.41/modules/generators/cgi_common.h -+++ httpd-2.4.41/modules/generators/cgi_common.h -@@ -0,0 +1,359 @@ -+/* Licensed to the Apache Software Foundation (ASF) under one or more -+ * contributor license agreements. See the NOTICE file distributed with -+ * this work for additional information regarding copyright ownership. -+ * The ASF licenses this file to You under the Apache License, Version 2.0 -+ * (the "License"); you may not use this file except in compliance with -+ * the License. You may obtain a copy of the License at -+ * -+ * http://www.apache.org/licenses/LICENSE-2.0 -+ * -+ * Unless required by applicable law or agreed to in writing, software -+ * distributed under the License is distributed on an "AS IS" BASIS, -+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+ * See the License for the specific language governing permissions and -+ * limitations under the License. -+ */ -+ -+#include "apr.h" -+#include "apr_strings.h" -+#include "apr_buckets.h" -+#include "apr_lib.h" -+#include "apr_poll.h" -+ -+#define APR_WANT_STRFUNC -+#define APR_WANT_MEMFUNC -+#include "apr_want.h" -+ -+#include "httpd.h" -+#include "util_filter.h" -+ -+static void discard_script_output(apr_bucket_brigade *bb) -+{ -+ apr_bucket *e; -+ const char *buf; -+ apr_size_t len; -+ -+ for (e = APR_BRIGADE_FIRST(bb); -+ e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e); -+ e = APR_BRIGADE_FIRST(bb)) -+ { -+ if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) { -+ break; -+ } -+ apr_bucket_delete(e); -+ } -+} -+ -+#ifdef WANT_CGI_BUCKET -+/* A CGI bucket type is needed to catch any output to stderr from the -+ * script; see PR 22030. */ -+static const apr_bucket_type_t bucket_type_cgi; -+ -+struct cgi_bucket_data { -+ apr_pollset_t *pollset; -+ request_rec *r; -+ apr_interval_time_t timeout; -+}; -+ -+/* Create a CGI bucket using pipes from script stdout 'out' -+ * and stderr 'err', for request 'r'. */ -+static apr_bucket *cgi_bucket_create(request_rec *r, -+ apr_interval_time_t timeout, -+ apr_file_t *out, apr_file_t *err, -+ apr_bucket_alloc_t *list) -+{ -+ apr_bucket *b = apr_bucket_alloc(sizeof(*b), list); -+ apr_status_t rv; -+ apr_pollfd_t fd; -+ struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data); -+ -+ /* Disable APR timeout handling since we'll use poll() entirely. */ -+ apr_file_pipe_timeout_set(out, 0); -+ apr_file_pipe_timeout_set(err, 0); -+ -+ APR_BUCKET_INIT(b); -+ b->free = apr_bucket_free; -+ b->list = list; -+ b->type = &bucket_type_cgi; -+ b->length = (apr_size_t)(-1); -+ b->start = -1; -+ -+ /* Create the pollset */ -+ rv = apr_pollset_create(&data->pollset, 2, r->pool, 0); -+ if (rv != APR_SUCCESS) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01217) -+ "apr_pollset_create(); check system or user limits"); -+ return NULL; -+ } -+ -+ fd.desc_type = APR_POLL_FILE; -+ fd.reqevents = APR_POLLIN; -+ fd.p = r->pool; -+ fd.desc.f = out; /* script's stdout */ -+ fd.client_data = (void *)1; -+ rv = apr_pollset_add(data->pollset, &fd); -+ if (rv != APR_SUCCESS) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01218) -+ "apr_pollset_add(); check system or user limits"); -+ return NULL; -+ } -+ -+ fd.desc.f = err; /* script's stderr */ -+ fd.client_data = (void *)2; -+ rv = apr_pollset_add(data->pollset, &fd); -+ if (rv != APR_SUCCESS) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01219) -+ "apr_pollset_add(); check system or user limits"); -+ return NULL; -+ } -+ -+ data->r = r; -+ data->timeout = timeout; -+ b->data = data; -+ return b; -+} -+ -+/* Create a duplicate CGI bucket using given bucket data */ -+static apr_bucket *cgi_bucket_dup(struct cgi_bucket_data *data, -+ apr_bucket_alloc_t *list) -+{ -+ apr_bucket *b = apr_bucket_alloc(sizeof(*b), list); -+ APR_BUCKET_INIT(b); -+ b->free = apr_bucket_free; -+ b->list = list; -+ b->type = &bucket_type_cgi; -+ b->length = (apr_size_t)(-1); -+ b->start = -1; -+ b->data = data; -+ return b; -+} -+ -+/* Handle stdout from CGI child. Duplicate of logic from the _read -+ * method of the real APR pipe bucket implementation. */ -+static apr_status_t cgi_read_stdout(apr_bucket *a, apr_file_t *out, -+ const char **str, apr_size_t *len) -+{ -+ char *buf; -+ apr_status_t rv; -+ -+ *str = NULL; -+ *len = APR_BUCKET_BUFF_SIZE; -+ buf = apr_bucket_alloc(*len, a->list); /* XXX: check for failure? */ -+ -+ rv = apr_file_read(out, buf, len); -+ -+ if (rv != APR_SUCCESS && rv != APR_EOF) { -+ apr_bucket_free(buf); -+ return rv; -+ } -+ -+ if (*len > 0) { -+ struct cgi_bucket_data *data = a->data; -+ apr_bucket_heap *h; -+ -+ /* Change the current bucket to refer to what we read */ -+ a = apr_bucket_heap_make(a, buf, *len, apr_bucket_free); -+ h = a->data; -+ h->alloc_len = APR_BUCKET_BUFF_SIZE; /* note the real buffer size */ -+ *str = buf; -+ APR_BUCKET_INSERT_AFTER(a, cgi_bucket_dup(data, a->list)); -+ } -+ else { -+ apr_bucket_free(buf); -+ a = apr_bucket_immortal_make(a, "", 0); -+ *str = a->data; -+ } -+ return rv; -+} -+ -+/* Read method of CGI bucket: polls on stderr and stdout of the child, -+ * sending any stderr output immediately away to the error log. */ -+static apr_status_t cgi_bucket_read(apr_bucket *b, const char **str, -+ apr_size_t *len, apr_read_type_e block) -+{ -+ struct cgi_bucket_data *data = b->data; -+ apr_interval_time_t timeout = 0; -+ apr_status_t rv; -+ int gotdata = 0; -+ -+ if (block != APR_NONBLOCK_READ) { -+ timeout = data->timeout > 0 ? data->timeout : data->r->server->timeout; -+ } -+ -+ do { -+ const apr_pollfd_t *results; -+ apr_int32_t num; -+ -+ rv = apr_pollset_poll(data->pollset, timeout, &num, &results); -+ if (APR_STATUS_IS_TIMEUP(rv)) { -+ if (timeout) { -+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, data->r, APLOGNO(01220) -+ "Timeout waiting for output from CGI script %s", -+ data->r->filename); -+ return rv; -+ } -+ else { -+ return APR_EAGAIN; -+ } -+ } -+ else if (APR_STATUS_IS_EINTR(rv)) { -+ continue; -+ } -+ else if (rv != APR_SUCCESS) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, data->r, APLOGNO(01221) -+ "poll failed waiting for CGI child"); -+ return rv; -+ } -+ -+ for (; num; num--, results++) { -+ if (results[0].client_data == (void *)1) { -+ /* stdout */ -+ rv = cgi_read_stdout(b, results[0].desc.f, str, len); -+ if (APR_STATUS_IS_EOF(rv)) { -+ rv = APR_SUCCESS; -+ } -+ gotdata = 1; -+ } else { -+ /* stderr */ -+ apr_status_t rv2 = log_script_err(data->r, results[0].desc.f); -+ if (APR_STATUS_IS_EOF(rv2)) { -+ apr_pollset_remove(data->pollset, &results[0]); -+ } -+ } -+ } -+ -+ } while (!gotdata); -+ -+ return rv; -+} -+ -+static const apr_bucket_type_t bucket_type_cgi = { -+ "CGI", 5, APR_BUCKET_DATA, -+ apr_bucket_destroy_noop, -+ cgi_bucket_read, -+ apr_bucket_setaside_notimpl, -+ apr_bucket_split_notimpl, -+ apr_bucket_copy_notimpl -+}; -+ -+#endif /* WANT_CGI_BUCKET */ -+ -+/* Handle the CGI response output, having set up the brigade with the -+ * CGI or PIPE bucket as appropriate. */ -+static int cgi_handle_response(request_rec *r, int nph, apr_bucket_brigade *bb, -+ apr_interval_time_t timeout, cgi_server_conf *conf, -+ char *logdata, apr_file_t *script_err) -+{ -+ apr_status_t rv; -+ -+ /* Handle script return... */ -+ if (!nph) { -+ const char *location; -+ char sbuf[MAX_STRING_LEN]; -+ int ret; -+ -+ if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, -+ APLOG_MODULE_INDEX))) -+ { -+ ret = log_script(r, conf, ret, logdata, sbuf, bb, script_err); -+ -+ /* -+ * ret could be HTTP_NOT_MODIFIED in the case that the CGI script -+ * does not set an explicit status and ap_meets_conditions, which -+ * is called by ap_scan_script_header_err_brigade, detects that -+ * the conditions of the requests are met and the response is -+ * not modified. -+ * In this case set r->status and return OK in order to prevent -+ * running through the error processing stack as this would -+ * break with mod_cache, if the conditions had been set by -+ * mod_cache itself to validate a stale entity. -+ * BTW: We circumvent the error processing stack anyway if the -+ * CGI script set an explicit status code (whatever it is) and -+ * the only possible values for ret here are: -+ * -+ * HTTP_NOT_MODIFIED (set by ap_meets_conditions) -+ * HTTP_PRECONDITION_FAILED (set by ap_meets_conditions) -+ * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the -+ * processing of the response of the CGI script, e.g broken headers -+ * or a crashed CGI process). -+ */ -+ if (ret == HTTP_NOT_MODIFIED) { -+ r->status = ret; -+ return OK; -+ } -+ -+ return ret; -+ } -+ -+ location = apr_table_get(r->headers_out, "Location"); -+ -+ if (location && r->status == 200) { -+ /* For a redirect whether internal or not, discard any -+ * remaining stdout from the script, and log any remaining -+ * stderr output, as normal. */ -+ discard_script_output(bb); -+ apr_brigade_destroy(bb); -+ -+ if (script_err) { -+ apr_file_pipe_timeout_set(script_err, timeout); -+ log_script_err(r, script_err); -+ } -+ } -+ -+ if (location && location[0] == '/' && r->status == 200) { -+ /* This redirect needs to be a GET no matter what the original -+ * method was. -+ */ -+ r->method = "GET"; -+ r->method_number = M_GET; -+ -+ /* We already read the message body (if any), so don't allow -+ * the redirected request to think it has one. We can ignore -+ * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR. -+ */ -+ apr_table_unset(r->headers_in, "Content-Length"); -+ -+ ap_internal_redirect_handler(location, r); -+ return OK; -+ } -+ else if (location && r->status == 200) { -+ /* XXX: Note that if a script wants to produce its own Redirect -+ * body, it now has to explicitly *say* "Status: 302" -+ */ -+ discard_script_output(bb); -+ apr_brigade_destroy(bb); -+ return HTTP_MOVED_TEMPORARILY; -+ } -+ -+ rv = ap_pass_brigade(r->output_filters, bb); -+ } -+ else /* nph */ { -+ struct ap_filter_t *cur; -+ -+ /* get rid of all filters up through protocol... since we -+ * haven't parsed off the headers, there is no way they can -+ * work -+ */ -+ -+ cur = r->proto_output_filters; -+ while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) { -+ cur = cur->next; -+ } -+ r->output_filters = r->proto_output_filters = cur; -+ -+ rv = ap_pass_brigade(r->output_filters, bb); -+ } -+ -+ /* don't soak up script output if errors occurred writing it -+ * out... otherwise, we prolong the life of the script when the -+ * connection drops or we stopped sending output for some other -+ * reason */ -+ if (script_err && rv == APR_SUCCESS && !r->connection->aborted) { -+ apr_file_pipe_timeout_set(script_err, timeout); -+ log_script_err(r, script_err); -+ } -+ -+ if (script_err) apr_file_close(script_err); -+ -+ return OK; /* NOT r->status, even if it has changed. */ -+} diff --git a/SOURCES/httpd-2.4.37-r1840554.patch b/SOURCES/httpd-2.4.37-r1840554.patch deleted file mode 100644 index 7b379e1..0000000 --- a/SOURCES/httpd-2.4.37-r1840554.patch +++ /dev/null @@ -1,35 +0,0 @@ -diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c -index 7a82a90..6c244b6 100644 ---- a/modules/arch/unix/mod_systemd.c -+++ b/modules/arch/unix/mod_systemd.c -@@ -100,6 +100,21 @@ static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog, - return OK; - } - -+/* Report the service is ready in post_config, which could be during -+ * startup or after a reload. The server could still hit a fatal -+ * startup error after this point during ap_run_mpm(), so this is -+ * perhaps too early, but by post_config listen() has been called on -+ * the TCP ports so new connections will not be rejected. There will -+ * always be a possible async failure event simultaneous to the -+ * service reporting "ready", so this should be good enough. */ -+static int systemd_post_config_last(apr_pool_t *p, apr_pool_t *plog, -+ apr_pool_t *ptemp, server_rec *main_server) -+{ -+ sd_notify(0, "READY=1\n" -+ "STATUS=Configuration loaded.\n"); -+ return OK; -+} -+ - static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type) - { - int rv; -@@ -187,6 +202,8 @@ static void systemd_register_hooks(apr_pool_t *p) - ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST); - /* Grab the listener config. */ - ap_hook_post_config(systemd_post_config, NULL, NULL, APR_HOOK_LAST); -+ /* Signal service is ready. */ -+ ap_hook_post_config(systemd_post_config_last, NULL, NULL, APR_HOOK_REALLY_LAST); - /* We know the PID in this hook ... */ - ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST); - /* Used to update httpd's status line using sd_notifyf */ diff --git a/SOURCES/httpd-2.4.37-r1845768+.patch b/SOURCES/httpd-2.4.37-r1845768+.patch deleted file mode 100644 index a51934f..0000000 --- a/SOURCES/httpd-2.4.37-r1845768+.patch +++ /dev/null @@ -1,48 +0,0 @@ -diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c -index 70d151e..e4f5fc8 100644 ---- a/modules/ssl/ssl_engine_init.c -+++ b/modules/ssl/ssl_engine_init.c -@@ -1095,7 +1095,9 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s, - /* - * Read a file that optionally contains the server certificate in PEM - * format, possibly followed by a sequence of CA certificates that -- * should be sent to the peer in the SSL Certificate message. -+ * should be sent to the peer in the SSL Certificate message. Returns -+ * 0 on success, otherwise the OpenSSL error stack contents should be -+ * reported. - */ - static int use_certificate_chain( - SSL_CTX *ctx, char *file, int skipfirst, pem_password_cb *cb) -@@ -1128,8 +1130,10 @@ static int use_certificate_chain( - ctx->extra_certs = NULL; - } - #endif -+ - /* create new extra chain by loading the certs */ - n = 0; -+ ERR_clear_error(); - while ((x509 = PEM_read_bio_X509(bio, NULL, cb, NULL)) != NULL) { - if (!SSL_CTX_add_extra_chain_cert(ctx, x509)) { - X509_free(x509); -@@ -1190,6 +1194,7 @@ static apr_status_t ssl_init_ctx_cert_chain(server_rec *s, - if (n < 0) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01903) - "Failed to configure CA certificate chain!"); -+ ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); - return ssl_die(s); - } - -diff --git a/modules/ssl/ssl_util_ocsp.c b/modules/ssl/ssl_util_ocsp.c -index b11a6e9..b66e151 100644 ---- a/modules/ssl/ssl_util_ocsp.c -+++ b/modules/ssl/ssl_util_ocsp.c -@@ -363,7 +363,9 @@ static STACK_OF(X509) *modssl_read_ocsp_certificates(const char *file) - BIO_free(bio); - return NULL; - } -+ - /* create new extra chain by loading the certs */ -+ ERR_clear_error(); - while ((x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL)) != NULL) { - if (!other_certs) { - other_certs = sk_X509_new_null(); diff --git a/SOURCES/httpd-2.4.37-r1851471.patch b/SOURCES/httpd-2.4.37-r1851471.patch deleted file mode 100644 index 03e3301..0000000 --- a/SOURCES/httpd-2.4.37-r1851471.patch +++ /dev/null @@ -1,44 +0,0 @@ -diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c -index 0958135..018b667 100644 ---- a/modules/ssl/ssl_engine_io.c -+++ b/modules/ssl/ssl_engine_io.c -@@ -200,6 +200,8 @@ static int bio_filter_out_write(BIO *bio, const char *in, int inl) - apr_bucket *e; - int need_flush; - -+ BIO_clear_retry_flags(bio); -+ - #ifndef SSL_OP_NO_RENEGOTIATION - /* Abort early if the client has initiated a renegotiation. */ - if (outctx->filter_ctx->config->reneg_state == RENEG_ABORT) { -@@ -208,12 +210,6 @@ static int bio_filter_out_write(BIO *bio, const char *in, int inl) - } - #endif - -- /* when handshaking we'll have a small number of bytes. -- * max size SSL will pass us here is about 16k. -- * (16413 bytes to be exact) -- */ -- BIO_clear_retry_flags(bio); -- - /* Use a transient bucket for the output data - any downstream - * filter must setaside if necessary. */ - e = apr_bucket_transient_create(in, inl, outctx->bb->bucket_alloc); -@@ -460,6 +456,8 @@ static int bio_filter_in_read(BIO *bio, char *in, int inlen) - if (!in) - return 0; - -+ BIO_clear_retry_flags(bio); -+ - #ifndef SSL_OP_NO_RENEGOTIATION - /* Abort early if the client has initiated a renegotiation. */ - if (inctx->filter_ctx->config->reneg_state == RENEG_ABORT) { -@@ -468,8 +466,6 @@ static int bio_filter_in_read(BIO *bio, char *in, int inlen) - } - #endif - -- BIO_clear_retry_flags(bio); -- - if (!inctx->bb) { - inctx->rc = APR_EOF; - return -1; diff --git a/SOURCES/httpd-2.4.37-r1861793+.patch b/SOURCES/httpd-2.4.37-r1861793+.patch deleted file mode 100644 index 4ac9c2d..0000000 --- a/SOURCES/httpd-2.4.37-r1861793+.patch +++ /dev/null @@ -1,209 +0,0 @@ -diff --git a/configure.in b/configure.in -index de6a8ad..4ca489d 100644 ---- a/configure.in -+++ b/configure.in -@@ -465,6 +465,28 @@ LIBS="" - AC_SEARCH_LIBS(crypt, crypt) - CRYPT_LIBS="$LIBS" - APACHE_SUBST(CRYPT_LIBS) -+ -+if test "$ac_cv_search_crypt" != "no"; then -+ # Test crypt() with the SHA-512 test vector from https://akkadia.org/drepper/SHA-crypt.txt -+ AC_CACHE_CHECK([whether crypt() supports SHA-2], [ap_cv_crypt_sha2], [ -+ AC_RUN_IFELSE([AC_LANG_PROGRAM([[ -+#include <crypt.h> -+#include <stdlib.h> -+#include <string.h> -+ -+#define PASSWD_0 "Hello world!" -+#define SALT_0 "\$6\$saltstring" -+#define EXPECT_0 "\$6\$saltstring\$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjnQJu" \ -+ "esI68u4OTLiBFdcbYEdFCoEOfaS35inz1" -+]], [char *result = crypt(PASSWD_0, SALT_0); -+ if (!result) return 1; -+ if (strcmp(result, EXPECT_0)) return 2; -+])], [ap_cv_crypt_sha2=yes], [ap_cv_crypt_sha2=no])]) -+ if test "$ap_cv_crypt_sha2" = yes; then -+ AC_DEFINE([HAVE_CRYPT_SHA2], 1, [Define if crypt() supports SHA-2 hashes]) -+ fi -+fi -+ - LIBS="$saved_LIBS" - - dnl See Comment #Spoon -diff --git a/support/htpasswd.c b/support/htpasswd.c -index 660a27c..136f62a 100644 ---- a/support/htpasswd.c -+++ b/support/htpasswd.c -@@ -98,28 +98,32 @@ static int mkrecord(struct passwd_ctx *ctx, char *user) - static void usage(void) - { - apr_file_printf(errfile, "Usage:" NL -- "\thtpasswd [-cimBdpsDv] [-C cost] passwordfile username" NL -- "\thtpasswd -b[cmBdpsDv] [-C cost] passwordfile username password" NL -+ "\thtpasswd [-cimB25dpsDv] [-C cost] [-r rounds] passwordfile username" NL -+ "\thtpasswd -b[cmB25dpsDv] [-C cost] [-r rounds] passwordfile username password" NL - NL -- "\thtpasswd -n[imBdps] [-C cost] username" NL -- "\thtpasswd -nb[mBdps] [-C cost] username password" NL -+ "\thtpasswd -n[imB25dps] [-C cost] [-r rounds] username" NL -+ "\thtpasswd -nb[mB25dps] [-C cost] [-r rounds] username password" NL - " -c Create a new file." NL - " -n Don't update file; display results on stdout." NL - " -b Use the password from the command line rather than prompting " - "for it." NL - " -i Read password from stdin without verification (for script usage)." NL - " -m Force MD5 encryption of the password (default)." NL -- " -B Force bcrypt encryption of the password (very secure)." NL -+ " -2 Force SHA-256 crypt() hash of the password (secure)." NL -+ " -5 Force SHA-512 crypt() hash of the password (secure)." NL -+ " -B Force bcrypt encryption of the password (very secure)." NL - " -C Set the computing time used for the bcrypt algorithm" NL - " (higher is more secure but slower, default: %d, valid: 4 to 31)." NL -+ " -r Set the number of rounds used for the SHA-256, SHA-512 algorithms" NL -+ " (higher is more secure but slower, default: 5000)." NL - " -d Force CRYPT encryption of the password (8 chars max, insecure)." NL -- " -s Force SHA encryption of the password (insecure)." NL -+ " -s Force SHA-1 encryption of the password (insecure)." NL - " -p Do not encrypt the password (plaintext, insecure)." NL - " -D Delete the specified user." NL - " -v Verify password for the specified user." NL - "On other systems than Windows and NetWare the '-p' flag will " - "probably not work." NL -- "The SHA algorithm does not use a salt and is less secure than the " -+ "The SHA-1 algorithm does not use a salt and is less secure than the " - "MD5 algorithm." NL, - BCRYPT_DEFAULT_COST - ); -@@ -178,7 +182,7 @@ static void check_args(int argc, const char *const argv[], - if (rv != APR_SUCCESS) - exit(ERR_SYNTAX); - -- while ((rv = apr_getopt(state, "cnmspdBbDiC:v", &opt, &opt_arg)) == APR_SUCCESS) { -+ while ((rv = apr_getopt(state, "cnmspdBbDi25C:r:v", &opt, &opt_arg)) == APR_SUCCESS) { - switch (opt) { - case 'c': - *mask |= APHTP_NEWFILE; -diff --git a/support/passwd_common.c b/support/passwd_common.c -index 664e509..d45657c 100644 ---- a/support/passwd_common.c -+++ b/support/passwd_common.c -@@ -185,10 +185,15 @@ int mkhash(struct passwd_ctx *ctx) - #if CRYPT_ALGO_SUPPORTED - char *cbuf; - #endif -+#ifdef HAVE_CRYPT_SHA2 -+ const char *setting; -+ char method; -+#endif - -- if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT) { -+ if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT -+ && ctx->alg != ALG_CRYPT_SHA256 && ctx->alg != ALG_CRYPT_SHA512 ) { - apr_file_printf(errfile, -- "Warning: Ignoring -C argument for this algorithm." NL); -+ "Warning: Ignoring -C/-r argument for this algorithm." NL); - } - - if (ctx->passwd == NULL) { -@@ -246,6 +251,34 @@ int mkhash(struct passwd_ctx *ctx) - break; - #endif /* CRYPT_ALGO_SUPPORTED */ - -+#ifdef HAVE_CRYPT_SHA2 -+ case ALG_CRYPT_SHA256: -+ case ALG_CRYPT_SHA512: -+ ret = generate_salt(salt, 16, &ctx->errstr, ctx->pool); -+ if (ret != 0) -+ break; -+ -+ method = ctx->alg == ALG_CRYPT_SHA256 ? '5': '6'; -+ -+ if (ctx->cost) -+ setting = apr_psprintf(ctx->pool, "$%c$rounds=%d$%s", -+ method, ctx->cost, salt); -+ else -+ setting = apr_psprintf(ctx->pool, "$%c$%s", -+ method, salt); -+ -+ cbuf = crypt(pw, setting); -+ if (cbuf == NULL) { -+ rv = APR_FROM_OS_ERROR(errno); -+ ctx->errstr = apr_psprintf(ctx->pool, "crypt() failed: %pm", &rv); -+ ret = ERR_PWMISMATCH; -+ break; -+ } -+ -+ apr_cpystrn(ctx->out, cbuf, ctx->out_len - 1); -+ break; -+#endif /* HAVE_CRYPT_SHA2 */ -+ - #if BCRYPT_ALGO_SUPPORTED - case ALG_BCRYPT: - rv = apr_generate_random_bytes((unsigned char*)salt, 16); -@@ -294,6 +327,19 @@ int parse_common_options(struct passwd_ctx *ctx, char opt, - case 's': - ctx->alg = ALG_APSHA; - break; -+#ifdef HAVE_CRYPT_SHA2 -+ case '2': -+ ctx->alg = ALG_CRYPT_SHA256; -+ break; -+ case '5': -+ ctx->alg = ALG_CRYPT_SHA512; -+ break; -+#else -+ case '2': -+ case '5': -+ ctx->errstr = "SHA-2 crypt() algorithms are not supported on this platform."; -+ return ERR_ALG_NOT_SUPP; -+#endif - case 'p': - ctx->alg = ALG_PLAIN; - #if !PLAIN_ALGO_SUPPORTED -@@ -324,11 +370,12 @@ int parse_common_options(struct passwd_ctx *ctx, char opt, - return ERR_ALG_NOT_SUPP; - #endif - break; -- case 'C': { -+ case 'C': -+ case 'r': { - char *endptr; - long num = strtol(opt_arg, &endptr, 10); - if (*endptr != '\0' || num <= 0) { -- ctx->errstr = "argument to -C must be a positive integer"; -+ ctx->errstr = "argument to -C/-r must be a positive integer"; - return ERR_SYNTAX; - } - ctx->cost = num; -diff --git a/support/passwd_common.h b/support/passwd_common.h -index 660081e..f1b3cd7 100644 ---- a/support/passwd_common.h -+++ b/support/passwd_common.h -@@ -28,6 +28,8 @@ - #include "apu_version.h" - #endif - -+#include "ap_config_auto.h" -+ - #define MAX_STRING_LEN 256 - - #define ALG_PLAIN 0 -@@ -35,6 +37,8 @@ - #define ALG_APMD5 2 - #define ALG_APSHA 3 - #define ALG_BCRYPT 4 -+#define ALG_CRYPT_SHA256 5 -+#define ALG_CRYPT_SHA512 6 - - #define BCRYPT_DEFAULT_COST 5 - -@@ -84,7 +88,7 @@ struct passwd_ctx { - apr_size_t out_len; - char *passwd; - int alg; -- int cost; -+ int cost; /* cost for bcrypt, rounds for SHA-2 */ - enum { - PW_PROMPT = 0, - PW_ARG, diff --git a/SOURCES/httpd-2.4.37-r1862410.patch b/SOURCES/httpd-2.4.37-r1862410.patch deleted file mode 100644 index a21d24d..0000000 --- a/SOURCES/httpd-2.4.37-r1862410.patch +++ /dev/null @@ -1,108 +0,0 @@ ---- a/modules/dav/main/mod_dav.c -+++ b/modules/dav/main/mod_dav.c -@@ -557,6 +557,7 @@ - dav_begin_multistatus(bb, r, status, namespaces); - - apr_pool_create(&subpool, r->pool); -+ apr_pool_tag(subpool, "mod_dav-multistatus"); - - for (; first != NULL; first = first->next) { - apr_pool_clear(subpool); -@@ -1980,8 +1981,9 @@ - ** Note: we cast to lose the "const". The propdb won't try to change - ** the resource, however, since we are opening readonly. - */ -- err = dav_open_propdb(ctx->r, ctx->w.lockdb, wres->resource, 1, -- ctx->doc ? ctx->doc->namespaces : NULL, &propdb); -+ err = dav_popen_propdb(ctx->scratchpool, -+ ctx->r, ctx->w.lockdb, wres->resource, 1, -+ ctx->doc ? ctx->doc->namespaces : NULL, &propdb); - if (err != NULL) { - /* ### do something with err! */ - ---- a/modules/dav/main/mod_dav.h -+++ b/modules/dav/main/mod_dav.h -@@ -1590,6 +1590,16 @@ - apr_array_header_t *ns_xlate, - dav_propdb **propdb); - -+DAV_DECLARE(dav_error *) dav_popen_propdb( -+ apr_pool_t *p, -+ request_rec *r, -+ dav_lockdb *lockdb, -+ const dav_resource *resource, -+ int ro, -+ apr_array_header_t *ns_xlate, -+ dav_propdb **propdb); -+ -+ - DAV_DECLARE(void) dav_close_propdb(dav_propdb *db); - - DAV_DECLARE(dav_get_props_result) dav_get_props( ---- a/modules/dav/main/props.c -+++ b/modules/dav/main/props.c -@@ -323,7 +323,7 @@ - { - /* need to escape the uri that's in the resource struct because during - * the property walker it's not encoded. */ -- const char *e_uri = ap_escape_uri(propdb->resource->pool, -+ const char *e_uri = ap_escape_uri(propdb->p, - propdb->resource->uri); - - /* perform a "GET" on the resource's URI (note that the resource -@@ -524,8 +524,21 @@ - apr_array_header_t * ns_xlate, - dav_propdb **p_propdb) - { -- dav_propdb *propdb = apr_pcalloc(r->pool, sizeof(*propdb)); -+ return dav_popen_propdb(r->pool, r, lockdb, resource, ro, ns_xlate, p_propdb); -+} - -+DAV_DECLARE(dav_error *)dav_popen_propdb(apr_pool_t *p, -+ request_rec *r, dav_lockdb *lockdb, -+ const dav_resource *resource, -+ int ro, -+ apr_array_header_t * ns_xlate, -+ dav_propdb **p_propdb) -+{ -+ dav_propdb *propdb = NULL; -+ -+ propdb = apr_pcalloc(p, sizeof(*propdb)); -+ propdb->p = p; -+ - *p_propdb = NULL; - - #if DAV_DEBUG -@@ -537,7 +550,6 @@ - #endif - - propdb->r = r; -- apr_pool_create(&propdb->p, r->pool); - propdb->resource = resource; - propdb->ns_xlate = ns_xlate; - -@@ -562,10 +574,10 @@ - (*propdb->db_hooks->close)(propdb->db); - } - -- /* Currently, mod_dav's pool usage doesn't allow clearing this pool. */ --#if 0 -- apr_pool_destroy(propdb->p); --#endif -+ if (propdb->subreq) { -+ ap_destroy_sub_req(propdb->subreq); -+ propdb->subreq = NULL; -+ } - } - - DAV_DECLARE(dav_get_props_result) dav_get_allprops(dav_propdb *propdb, -@@ -739,7 +751,8 @@ - */ - - if (elem->priv == NULL) { -- elem->priv = apr_pcalloc(propdb->p, sizeof(*priv)); -+ /* elem->priv outlives propdb->p. Hence use the request pool */ -+ elem->priv = apr_pcalloc(propdb->r->pool, sizeof(*priv)); - } - priv = elem->priv; - diff --git a/SOURCES/httpd-2.4.37-r1864000.patch b/SOURCES/httpd-2.4.37-r1864000.patch deleted file mode 100644 index 8adecfa..0000000 --- a/SOURCES/httpd-2.4.37-r1864000.patch +++ /dev/null @@ -1,40 +0,0 @@ ---- a/modules/proxy/mod_proxy_hcheck.c 2019/07/30 13:01:08 1863999 -+++ b/modules/proxy/mod_proxy_hcheck.c 2019/07/30 13:01:21 1864000 -@@ -110,6 +110,10 @@ - if (!worker && !v) { - return "Bad call to set_worker_hc_param()"; - } -+ if (!ctx) { -+ ctx = hc_create_config(p, s); -+ ap_set_module_config(s->module_config, &proxy_hcheck_module, ctx); -+ } - temp = (hc_template_t *)v; - if (!strcasecmp(key, "hctemplate")) { - hc_template_t *template; -@@ -1059,6 +1063,8 @@ - int i; - sctx_t *ctx = (sctx_t *) ap_get_module_config(r->server->module_config, - &proxy_hcheck_module); -+ if (!ctx) -+ return; - if (apr_is_empty_table(ctx->conditions)) - return; - -@@ -1088,6 +1094,8 @@ - int i; - sctx_t *ctx = (sctx_t *) ap_get_module_config(r->server->module_config, - &proxy_hcheck_module); -+ if (!ctx) -+ return; - if (apr_is_empty_table(ctx->conditions)) - return; - -@@ -1111,6 +1119,8 @@ - int i; - sctx_t *ctx = (sctx_t *) ap_get_module_config(r->server->module_config, - &proxy_hcheck_module); -+ if (!ctx) -+ return 0; - if (apr_is_empty_table(ctx->conditions)) - return 0; - diff --git a/SOURCES/httpd-2.4.37-r1870095+.patch b/SOURCES/httpd-2.4.37-r1870095+.patch deleted file mode 100644 index bd43c5c..0000000 --- a/SOURCES/httpd-2.4.37-r1870095+.patch +++ /dev/null @@ -1,117 +0,0 @@ -# ./pullrev.sh 1870095 1870097 -http://svn.apache.org/viewvc?view=revision&revision=1870095 -http://svn.apache.org/viewvc?view=revision&revision=1870097 - ---- httpd-2.4.37/modules/ssl/ssl_engine_kernel.c -+++ httpd-2.4.37/modules/ssl/ssl_engine_kernel.c -@@ -114,6 +114,45 @@ - return result; - } - -+/* If a renegotiation is required for the location, and the request -+ * includes a message body (and the client has not requested a "100 -+ * Continue" response), then the client will be streaming the request -+ * body over the wire already. In that case, it is not possible to -+ * stop and perform a new SSL handshake immediately; once the SSL -+ * library moves to the "accept" state, it will reject the SSL packets -+ * which the client is sending for the request body. -+ * -+ * To allow authentication to complete in the hook, the solution used -+ * here is to fill a (bounded) buffer with the request body, and then -+ * to reinject that request body later. -+ * -+ * This function is called to fill the renegotiation buffer for the -+ * location as required, or fail. Returns zero on success or HTTP_ -+ * error code on failure. -+ */ -+static int fill_reneg_buffer(request_rec *r, SSLDirConfigRec *dc) -+{ -+ int rv; -+ apr_size_t rsize; -+ -+ /* ### this is HTTP/1.1 specific, special case for protocol? */ -+ if (r->expecting_100 || !ap_request_has_body(r)) { -+ return 0; -+ } -+ -+ rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE : dc->nRenegBufferSize; -+ if (rsize > 0) { -+ /* Fill the I/O buffer with the request body if possible. */ -+ rv = ssl_io_buffer_fill(r, rsize); -+ } -+ else { -+ /* If the reneg buffer size is set to zero, just fail. */ -+ rv = HTTP_REQUEST_ENTITY_TOO_LARGE; -+ } -+ -+ return rv; -+} -+ - #ifdef HAVE_TLSEXT - static int ap_array_same_str_set(apr_array_header_t *s1, apr_array_header_t *s2) - { -@@ -814,41 +853,14 @@ - } - } - -- /* If a renegotiation is now required for this location, and the -- * request includes a message body (and the client has not -- * requested a "100 Continue" response), then the client will be -- * streaming the request body over the wire already. In that -- * case, it is not possible to stop and perform a new SSL -- * handshake immediately; once the SSL library moves to the -- * "accept" state, it will reject the SSL packets which the client -- * is sending for the request body. -- * -- * To allow authentication to complete in this auth hook, the -- * solution used here is to fill a (bounded) buffer with the -- * request body, and then to reinject that request body later. -- */ -- if (renegotiate && !renegotiate_quick -- && !r->expecting_100 -- && ap_request_has_body(r)) { -- int rv; -- apr_size_t rsize; -- -- rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE : -- dc->nRenegBufferSize; -- if (rsize > 0) { -- /* Fill the I/O buffer with the request body if possible. */ -- rv = ssl_io_buffer_fill(r, rsize); -- } -- else { -- /* If the reneg buffer size is set to zero, just fail. */ -- rv = HTTP_REQUEST_ENTITY_TOO_LARGE; -- } -- -- if (rv) { -+ /* Fill reneg buffer if required. */ -+ if (renegotiate && !renegotiate_quick) { -+ rc = fill_reneg_buffer(r, dc); -+ if (rc) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02257) - "could not buffer message body to allow " - "SSL renegotiation to proceed"); -- return rv; -+ return rc; - } - } - -@@ -1132,6 +1144,17 @@ - } - } - -+ /* Fill reneg buffer if required. */ -+ if (change_vmode) { -+ rc = fill_reneg_buffer(r, dc); -+ if (rc) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10228) -+ "could not buffer message body to allow " -+ "TLS Post-Handshake Authentication to proceed"); -+ return rc; -+ } -+ } -+ - if (change_vmode) { - char peekbuf[1]; - diff --git a/SOURCES/httpd-2.4.37-r1872790.patch b/SOURCES/httpd-2.4.37-r1872790.patch deleted file mode 100644 index 2cab606..0000000 --- a/SOURCES/httpd-2.4.37-r1872790.patch +++ /dev/null @@ -1,636 +0,0 @@ -diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h -index 57cc92f..fbbd508 100644 ---- a/modules/proxy/mod_proxy.h -+++ b/modules/proxy/mod_proxy.h -@@ -288,12 +288,15 @@ typedef struct { - - /* Connection pool */ - struct proxy_conn_pool { -- apr_pool_t *pool; /* The pool used in constructor and destructor calls */ -- apr_sockaddr_t *addr; /* Preparsed remote address info */ -- apr_reslist_t *res; /* Connection resource list */ -- proxy_conn_rec *conn; /* Single connection for prefork mpm */ -+ apr_pool_t *pool; /* The pool used in constructor and destructor calls */ -+ apr_sockaddr_t *addr; /* Preparsed remote address info */ -+ apr_reslist_t *res; /* Connection resource list */ -+ proxy_conn_rec *conn; /* Single connection for prefork mpm */ -+ apr_pool_t *dns_pool; /* The pool used for worker scoped DNS resolutions */ - }; - -+#define AP_VOLATILIZE_T(T, x) (*(T volatile *)&(x)) -+ - /* worker status bits */ - /* - * NOTE: Keep up-to-date w/ proxy_wstat_tbl[] -@@ -475,7 +478,9 @@ struct proxy_worker { - proxy_conn_pool *cp; /* Connection pool to use */ - proxy_worker_shared *s; /* Shared data */ - proxy_balancer *balancer; /* which balancer am I in? */ -+#if APR_HAS_THREADS - apr_thread_mutex_t *tmutex; /* Thread lock for updating address cache */ -+#endif - void *context; /* general purpose storage */ - ap_conf_vector_t *section_config; /* <Proxy>-section wherein defined */ - }; -@@ -534,7 +539,9 @@ struct proxy_balancer { - apr_time_t wupdated; /* timestamp of last change to workers list */ - proxy_balancer_method *lbmethod; - apr_global_mutex_t *gmutex; /* global lock for updating list of workers */ -+#if APR_HAS_THREADS - apr_thread_mutex_t *tmutex; /* Thread lock for updating shm */ -+#endif - proxy_server_conf *sconf; - void *context; /* general purpose storage */ - proxy_balancer_shared *s; /* Shared data */ -diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c -index c59f5e9..3a28038 100644 ---- a/modules/proxy/mod_proxy_balancer.c -+++ b/modules/proxy/mod_proxy_balancer.c -@@ -346,23 +346,27 @@ static proxy_worker *find_best_worker(proxy_balancer *balancer, - proxy_worker *candidate = NULL; - apr_status_t rv; - -+#if APR_HAS_THREADS - if ((rv = PROXY_THREAD_LOCK(balancer)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01163) - "%s: Lock failed for find_best_worker()", - balancer->s->name); - return NULL; - } -+#endif - - candidate = (*balancer->lbmethod->finder)(balancer, r); - - if (candidate) - candidate->s->elected++; - -+#if APR_HAS_THREADS - if ((rv = PROXY_THREAD_UNLOCK(balancer)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01164) - "%s: Unlock failed for find_best_worker()", - balancer->s->name); - } -+#endif - - if (candidate == NULL) { - /* All the workers are in error state or disabled. -@@ -492,11 +496,13 @@ static int proxy_balancer_pre_request(proxy_worker **worker, - /* Step 2: Lock the LoadBalancer - * XXX: perhaps we need the process lock here - */ -+#if APR_HAS_THREADS - if ((rv = PROXY_THREAD_LOCK(*balancer)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01166) - "%s: Lock failed for pre_request", (*balancer)->s->name); - return DECLINED; - } -+#endif - - /* Step 3: force recovery */ - force_recovery(*balancer, r->server); -@@ -557,20 +563,24 @@ static int proxy_balancer_pre_request(proxy_worker **worker, - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01167) - "%s: All workers are in error state for route (%s)", - (*balancer)->s->name, route); -+#if APR_HAS_THREADS - if ((rv = PROXY_THREAD_UNLOCK(*balancer)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01168) - "%s: Unlock failed for pre_request", - (*balancer)->s->name); - } -+#endif - return HTTP_SERVICE_UNAVAILABLE; - } - } - -+#if APR_HAS_THREADS - if ((rv = PROXY_THREAD_UNLOCK(*balancer)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01169) - "%s: Unlock failed for pre_request", - (*balancer)->s->name); - } -+#endif - if (!*worker) { - runtime = find_best_worker(*balancer, r); - if (!runtime) { -@@ -644,12 +654,14 @@ static int proxy_balancer_post_request(proxy_worker *worker, - - apr_status_t rv; - -+#if APR_HAS_THREADS - if ((rv = PROXY_THREAD_LOCK(balancer)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01173) - "%s: Lock failed for post_request", - balancer->s->name); - return HTTP_INTERNAL_SERVER_ERROR; - } -+#endif - - if (!apr_is_empty_array(balancer->errstatuses) - && !(worker->s->status & PROXY_WORKER_IGNORE_ERRORS)) { -@@ -681,11 +693,12 @@ static int proxy_balancer_post_request(proxy_worker *worker, - worker->s->error_time = apr_time_now(); - - } -- -+#if APR_HAS_THREADS - if ((rv = PROXY_THREAD_UNLOCK(balancer)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01175) - "%s: Unlock failed for post_request", balancer->s->name); - } -+#endif - ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01176) - "proxy_balancer_post_request for (%s)", balancer->s->name); - -@@ -945,7 +958,6 @@ static int balancer_post_config(apr_pool_t *pconf, apr_pool_t *plog, - PROXY_STRNCPY(balancer->s->sname, sname); /* We know this will succeed */ - - balancer->max_workers = balancer->workers->nelts + balancer->growth; -- - /* Create global mutex */ - rv = ap_global_mutex_create(&(balancer->gmutex), NULL, balancer_mutex_type, - balancer->s->sname, s, pconf, 0); -@@ -955,7 +967,6 @@ static int balancer_post_config(apr_pool_t *pconf, apr_pool_t *plog, - balancer->s->sname); - return HTTP_INTERNAL_SERVER_ERROR; - } -- - apr_pool_cleanup_register(pconf, (void *)s, lock_remove, - apr_pool_cleanup_null); - -@@ -1135,17 +1146,21 @@ static int balancer_handler(request_rec *r) - - balancer = (proxy_balancer *)conf->balancers->elts; - for (i = 0; i < conf->balancers->nelts; i++, balancer++) { -+#if APR_HAS_THREADS - if ((rv = PROXY_THREAD_LOCK(balancer)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01189) - "%s: Lock failed for balancer_handler", - balancer->s->name); - } -+#endif - ap_proxy_sync_balancer(balancer, r->server, conf); -+#if APR_HAS_THREADS - if ((rv = PROXY_THREAD_UNLOCK(balancer)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01190) - "%s: Unlock failed for balancer_handler", - balancer->s->name); - } -+#endif - } - - if (r->args && (r->method_number == M_GET)) { -@@ -1359,11 +1374,13 @@ static int balancer_handler(request_rec *r) - proxy_worker *nworker; - nworker = ap_proxy_get_worker(r->pool, bsel, conf, val); - if (!nworker && storage->num_free_slots(bsel->wslot)) { -+#if APR_HAS_THREADS - if ((rv = PROXY_GLOBAL_LOCK(bsel)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01194) - "%s: Lock failed for adding worker", - bsel->s->name); - } -+#endif - ret = ap_proxy_define_worker(conf->pool, &nworker, bsel, conf, val, 0); - if (!ret) { - unsigned int index; -@@ -1372,53 +1389,76 @@ static int balancer_handler(request_rec *r) - if ((rv = storage->grab(bsel->wslot, &index)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_EMERG, rv, r, APLOGNO(01195) - "worker slotmem_grab failed"); -+#if APR_HAS_THREADS - if ((rv = PROXY_GLOBAL_UNLOCK(bsel)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01196) - "%s: Unlock failed for adding worker", - bsel->s->name); - } -+#endif - return HTTP_BAD_REQUEST; - } - if ((rv = storage->dptr(bsel->wslot, index, (void *)&shm)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_EMERG, rv, r, APLOGNO(01197) - "worker slotmem_dptr failed"); -+#if APR_HAS_THREADS - if ((rv = PROXY_GLOBAL_UNLOCK(bsel)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01198) - "%s: Unlock failed for adding worker", - bsel->s->name); - } -+#endif - return HTTP_BAD_REQUEST; - } - if ((rv = ap_proxy_share_worker(nworker, shm, index)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_EMERG, rv, r, APLOGNO(01199) - "Cannot share worker"); -+#if APR_HAS_THREADS - if ((rv = PROXY_GLOBAL_UNLOCK(bsel)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01200) - "%s: Unlock failed for adding worker", - bsel->s->name); - } -+#endif - return HTTP_BAD_REQUEST; - } - if ((rv = ap_proxy_initialize_worker(nworker, r->server, conf->pool)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_EMERG, rv, r, APLOGNO(01201) - "Cannot init worker"); -+#if APR_HAS_THREADS - if ((rv = PROXY_GLOBAL_UNLOCK(bsel)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01202) - "%s: Unlock failed for adding worker", - bsel->s->name); - } -+#endif - return HTTP_BAD_REQUEST; - } - /* sync all timestamps */ - bsel->wupdated = bsel->s->wupdated = nworker->s->updated = apr_time_now(); - /* by default, all new workers are disabled */ - ap_proxy_set_wstatus(PROXY_WORKER_DISABLED_FLAG, 1, nworker); -+ } else { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10163) -+ "%s: failed to add worker %s", -+ bsel->s->name, val); -+#if APR_HAS_THREADS -+ PROXY_GLOBAL_UNLOCK(bsel); -+#endif -+ return HTTP_BAD_REQUEST; - } -+#if APR_HAS_THREADS - if ((rv = PROXY_GLOBAL_UNLOCK(bsel)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01203) - "%s: Unlock failed for adding worker", - bsel->s->name); - } -+#endif -+ } else { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10164) -+ "%s: failed to add worker %s", -+ bsel->s->name, val); -+ return HTTP_BAD_REQUEST; - } - - } -diff --git a/modules/proxy/mod_proxy_ftp.c b/modules/proxy/mod_proxy_ftp.c -index 5d9175e..5c4d641 100644 ---- a/modules/proxy/mod_proxy_ftp.c -+++ b/modules/proxy/mod_proxy_ftp.c -@@ -979,8 +979,10 @@ static int proxy_ftp_handler(request_rec *r, proxy_worker *worker, - apr_status_t rv; - conn_rec *origin, *data = NULL; - apr_status_t err = APR_SUCCESS; -+#if APR_HAS_THREADS - apr_status_t uerr = APR_SUCCESS; -- apr_bucket_brigade *bb = apr_brigade_create(p, c->bucket_alloc); -+#endif -+ apr_bucket_brigade *bb; - char *buf, *connectname; - apr_port_t connectport; - char *ftpmessage = NULL; -@@ -1120,13 +1122,15 @@ static int proxy_ftp_handler(request_rec *r, proxy_worker *worker, - - if (worker->s->is_address_reusable) { - if (!worker->cp->addr) { -+#if APR_HAS_THREADS - if ((err = PROXY_THREAD_LOCK(worker->balancer)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, err, r, APLOGNO(01037) "lock"); - return HTTP_INTERNAL_SERVER_ERROR; - } -+#endif - } -- connect_addr = worker->cp->addr; -- address_pool = worker->cp->pool; -+ connect_addr = AP_VOLATILIZE_T(apr_sockaddr_t *, worker->cp->addr); -+ address_pool = worker->cp->dns_pool; - } - else - address_pool = r->pool; -@@ -1139,9 +1143,11 @@ static int proxy_ftp_handler(request_rec *r, proxy_worker *worker, - address_pool); - if (worker->s->is_address_reusable && !worker->cp->addr) { - worker->cp->addr = connect_addr; -+#if APR_HAS_THREADS - if ((uerr = PROXY_THREAD_UNLOCK(worker->balancer)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, uerr, r, APLOGNO(01038) "unlock"); - } -+#endif - } - /* - * get all the possible IP addresses for the destname and loop through -@@ -1212,6 +1218,7 @@ static int proxy_ftp_handler(request_rec *r, proxy_worker *worker, - * correct directory... - */ - -+ bb = apr_brigade_create(p, c->bucket_alloc); - - /* possible results: */ - /* 120 Service ready in nnn minutes. */ -diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c -index 2bfc8f0..7714b6c 100644 ---- a/modules/proxy/proxy_util.c -+++ b/modules/proxy/proxy_util.c -@@ -1167,8 +1167,10 @@ PROXY_DECLARE(char *) ap_proxy_define_balancer(apr_pool_t *p, - lbmethod = ap_lookup_provider(PROXY_LBMETHOD, "byrequests", "0"); - - (*balancer)->workers = apr_array_make(p, 5, sizeof(proxy_worker *)); -+#if APR_HAS_THREADS - (*balancer)->gmutex = NULL; - (*balancer)->tmutex = NULL; -+#endif - (*balancer)->lbmethod = lbmethod; - - if (do_malloc) -@@ -1257,7 +1259,9 @@ PROXY_DECLARE(apr_status_t) ap_proxy_share_balancer(proxy_balancer *balancer, - - PROXY_DECLARE(apr_status_t) ap_proxy_initialize_balancer(proxy_balancer *balancer, server_rec *s, apr_pool_t *p) - { -+#if APR_HAS_THREADS - apr_status_t rv = APR_SUCCESS; -+#endif - ap_slotmem_provider_t *storage = balancer->storage; - apr_size_t size; - unsigned int num; -@@ -1297,6 +1301,7 @@ PROXY_DECLARE(apr_status_t) ap_proxy_initialize_balancer(proxy_balancer *balance - if (balancer->lbmethod && balancer->lbmethod->reset) - balancer->lbmethod->reset(balancer, s); - -+#if APR_HAS_THREADS - if (balancer->tmutex == NULL) { - rv = apr_thread_mutex_create(&(balancer->tmutex), APR_THREAD_MUTEX_DEFAULT, p); - if (rv != APR_SUCCESS) { -@@ -1305,6 +1310,7 @@ PROXY_DECLARE(apr_status_t) ap_proxy_initialize_balancer(proxy_balancer *balance - return rv; - } - } -+#endif - return APR_SUCCESS; - } - -@@ -1446,16 +1452,14 @@ static void socket_cleanup(proxy_conn_rec *conn) - - static apr_status_t conn_pool_cleanup(void *theworker) - { -- proxy_worker *worker = (proxy_worker *)theworker; -- if (worker->cp->res) { -- worker->cp->pool = NULL; -- } -+ ((proxy_worker *)theworker)->cp = NULL; - return APR_SUCCESS; - } - - static void init_conn_pool(apr_pool_t *p, proxy_worker *worker) - { - apr_pool_t *pool; -+ apr_pool_t *dns_pool; - proxy_conn_pool *cp; - - /* -@@ -1466,12 +1470,21 @@ static void init_conn_pool(apr_pool_t *p, proxy_worker *worker) - */ - apr_pool_create(&pool, p); - apr_pool_tag(pool, "proxy_worker_cp"); -+ /* -+ * Create a subpool of the connection pool for worker -+ * scoped DNS resolutions. This is needed to avoid race -+ * conditions in using the connection pool by multiple -+ * threads during ramp up. -+ */ -+ apr_pool_create(&dns_pool, pool); -+ apr_pool_tag(dns_pool, "proxy_worker_dns"); - /* - * Alloc from the same pool as worker. - * proxy_conn_pool is permanently attached to the worker. - */ - cp = (proxy_conn_pool *)apr_pcalloc(p, sizeof(proxy_conn_pool)); - cp->pool = pool; -+ cp->dns_pool = dns_pool; - worker->cp = cp; - } - -@@ -1487,14 +1500,6 @@ static apr_status_t connection_cleanup(void *theconn) - proxy_conn_rec *conn = (proxy_conn_rec *)theconn; - proxy_worker *worker = conn->worker; - -- /* -- * If the connection pool is NULL the worker -- * cleanup has been run. Just return. -- */ -- if (!worker->cp->pool) { -- return APR_SUCCESS; -- } -- - if (conn->r) { - apr_pool_destroy(conn->r->pool); - conn->r = NULL; -@@ -1616,7 +1621,7 @@ static apr_status_t connection_destructor(void *resource, void *params, - proxy_worker *worker = params; - - /* Destroy the pool only if not called from reslist_destroy */ -- if (worker->cp->pool) { -+ if (worker->cp) { - proxy_conn_rec *conn = resource; - apr_pool_destroy(conn->pool); - } -@@ -1972,67 +1977,73 @@ PROXY_DECLARE(apr_status_t) ap_proxy_initialize_worker(proxy_worker *worker, ser - ap_proxy_worker_name(p, worker)); - } - else { -- ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(00927) -- "initializing worker %s local", -- ap_proxy_worker_name(p, worker)); - apr_global_mutex_lock(proxy_mutex); -- /* Now init local worker data */ -- if (worker->tmutex == NULL) { -- rv = apr_thread_mutex_create(&(worker->tmutex), APR_THREAD_MUTEX_DEFAULT, p); -- if (rv != APR_SUCCESS) { -- ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(00928) -- "can not create worker thread mutex"); -+ /* Check again after we got the lock if we are still uninitialized */ -+ if (!(AP_VOLATILIZE_T(unsigned int, worker->local_status) & PROXY_WORKER_INITIALIZED)) { -+ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(00927) -+ "initializing worker %s local", -+ ap_proxy_worker_name(p, worker)); -+ /* Now init local worker data */ -+#if APR_HAS_THREADS -+ if (worker->tmutex == NULL) { -+ rv = apr_thread_mutex_create(&(worker->tmutex), APR_THREAD_MUTEX_DEFAULT, p); -+ if (rv != APR_SUCCESS) { -+ ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, APLOGNO(00928) -+ "can not create worker thread mutex"); -+ apr_global_mutex_unlock(proxy_mutex); -+ return rv; -+ } -+ } -+#endif -+ if (worker->cp == NULL) -+ init_conn_pool(p, worker); -+ if (worker->cp == NULL) { -+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(00929) -+ "can not create connection pool"); - apr_global_mutex_unlock(proxy_mutex); -- return rv; -+ return APR_EGENERAL; - } -- } -- if (worker->cp == NULL) -- init_conn_pool(p, worker); -- if (worker->cp == NULL) { -- ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(00929) -- "can not create connection pool"); -- apr_global_mutex_unlock(proxy_mutex); -- return APR_EGENERAL; -- } - -- if (worker->s->hmax) { -- rv = apr_reslist_create(&(worker->cp->res), -- worker->s->min, worker->s->smax, -- worker->s->hmax, worker->s->ttl, -- connection_constructor, connection_destructor, -- worker, worker->cp->pool); -+ if (worker->s->hmax) { -+ rv = apr_reslist_create(&(worker->cp->res), -+ worker->s->min, worker->s->smax, -+ worker->s->hmax, worker->s->ttl, -+ connection_constructor, connection_destructor, -+ worker, worker->cp->pool); - -- apr_pool_cleanup_register(worker->cp->pool, (void *)worker, -- conn_pool_cleanup, -- apr_pool_cleanup_null); -+ apr_pool_pre_cleanup_register(worker->cp->pool, worker, -+ conn_pool_cleanup); - -- ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(00930) -- "initialized pool in child %" APR_PID_T_FMT " for (%s) min=%d max=%d smax=%d", -- getpid(), worker->s->hostname_ex, worker->s->min, -- worker->s->hmax, worker->s->smax); -+ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(00930) -+ "initialized pool in child %" APR_PID_T_FMT " for (%s) min=%d max=%d smax=%d", -+ getpid(), worker->s->hostname_ex, worker->s->min, -+ worker->s->hmax, worker->s->smax); - -- /* Set the acquire timeout */ -- if (rv == APR_SUCCESS && worker->s->acquire_set) { -- apr_reslist_timeout_set(worker->cp->res, worker->s->acquire); -- } -+ /* Set the acquire timeout */ -+ if (rv == APR_SUCCESS && worker->s->acquire_set) { -+ apr_reslist_timeout_set(worker->cp->res, worker->s->acquire); -+ } - -- } -- else { -- void *conn; -+ } -+ else { -+ void *conn; - -- rv = connection_constructor(&conn, worker, worker->cp->pool); -- worker->cp->conn = conn; -+ rv = connection_constructor(&conn, worker, worker->cp->pool); -+ worker->cp->conn = conn; - -- ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(00931) -- "initialized single connection worker in child %" APR_PID_T_FMT " for (%s)", -- getpid(), worker->s->hostname_ex); -+ ap_log_error(APLOG_MARK, APLOG_DEBUG, rv, s, APLOGNO(00931) -+ "initialized single connection worker in child %" APR_PID_T_FMT " for (%s)", -+ getpid(), worker->s->hostname_ex); -+ } -+ if (rv == APR_SUCCESS) { -+ worker->local_status |= (PROXY_WORKER_INITIALIZED); -+ } - } - apr_global_mutex_unlock(proxy_mutex); - - } - if (rv == APR_SUCCESS) { - worker->s->status |= (PROXY_WORKER_INITIALIZED); -- worker->local_status |= (PROXY_WORKER_INITIALIZED); - } - return rv; - } -@@ -2292,13 +2303,13 @@ PROXY_DECLARE(int) ap_proxy_acquire_connection(const char *proxy_function, - else { - /* create the new connection if the previous was destroyed */ - if (!worker->cp->conn) { -- connection_constructor((void **)conn, worker, worker->cp->pool); -+ rv = connection_constructor((void **)conn, worker, worker->cp->pool); - } - else { - *conn = worker->cp->conn; - worker->cp->conn = NULL; -+ rv = APR_SUCCESS; - } -- rv = APR_SUCCESS; - } - - if (rv != APR_SUCCESS) { -@@ -2344,7 +2355,9 @@ ap_proxy_determine_connection(apr_pool_t *p, request_rec *r, - { - int server_port; - apr_status_t err = APR_SUCCESS; -+#if APR_HAS_THREADS - apr_status_t uerr = APR_SUCCESS; -+#endif - const char *uds_path; - - /* -@@ -2481,25 +2494,39 @@ ap_proxy_determine_connection(apr_pool_t *p, request_rec *r, - * we can reuse the address. - */ - if (!worker->cp->addr) { -+#if APR_HAS_THREADS - if ((err = PROXY_THREAD_LOCK(worker)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, err, r, APLOGNO(00945) "lock"); - return HTTP_INTERNAL_SERVER_ERROR; - } -+#endif - - /* -- * Worker can have the single constant backend address. -- * The single DNS lookup is used once per worker. -- * If dynamic change is needed then set the addr to NULL -- * inside dynamic config to force the lookup. -+ * Recheck addr after we got the lock. This may have changed -+ * while waiting for the lock. - */ -- err = apr_sockaddr_info_get(&(worker->cp->addr), -- conn->hostname, APR_UNSPEC, -- conn->port, 0, -- worker->cp->pool); -+ if (!AP_VOLATILIZE_T(apr_sockaddr_t *, worker->cp->addr)) { -+ -+ apr_sockaddr_t *addr; -+ -+ /* -+ * Worker can have the single constant backend address. -+ * The single DNS lookup is used once per worker. -+ * If dynamic change is needed then set the addr to NULL -+ * inside dynamic config to force the lookup. -+ */ -+ err = apr_sockaddr_info_get(&addr, -+ conn->hostname, APR_UNSPEC, -+ conn->port, 0, -+ worker->cp->dns_pool); -+ worker->cp->addr = addr; -+ } - conn->addr = worker->cp->addr; -+#if APR_HAS_THREADS - if ((uerr = PROXY_THREAD_UNLOCK(worker)) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, uerr, r, APLOGNO(00946) "unlock"); - } -+#endif - } - else { - conn->addr = worker->cp->addr; -@@ -3422,7 +3449,9 @@ PROXY_DECLARE(apr_status_t) ap_proxy_sync_balancer(proxy_balancer *b, server_rec - (*runtime)->cp = NULL; - (*runtime)->balancer = b; - (*runtime)->s = shm; -+#if APR_HAS_THREADS - (*runtime)->tmutex = NULL; -+#endif - rv = ap_proxy_initialize_worker(*runtime, s, conf->pool); - if (rv != APR_SUCCESS) { - ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s, APLOGNO(00966) "Cannot init worker"); diff --git a/SOURCES/httpd-2.4.37-r1873907.patch b/SOURCES/httpd-2.4.37-r1873907.patch deleted file mode 100644 index 4ec0cfa..0000000 --- a/SOURCES/httpd-2.4.37-r1873907.patch +++ /dev/null @@ -1,265 +0,0 @@ -diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en -index b543150..ab72d4f 100644 ---- a/docs/manual/mod/mod_ssl.html.en -+++ b/docs/manual/mod/mod_ssl.html.en -@@ -1524,6 +1524,32 @@ The available (case-insensitive) <em>protocol</em>s are:</p> - <div class="example"><h3>Example</h3><pre class="prettyprint lang-config">SSLProtocol TLSv1</pre> - </div> - -+<div class="note"> -+<h3><code class="directive">SSLProtocol</code> for name-based virtual hosts</h3> -+<p> -+Before OpenSSL 1.1.1, even though the Server Name Indication (SNI) allowed to -+determine the targeted virtual host early in the TLS handshake, it was not -+possible to switch the TLS protocol version of the connection at this point, -+and thus the <code class="directive">SSLProtocol</code> negotiated was always based off -+the one of the <em>base virtual host</em> (first virtual host declared on the -+listening <code>IP:port</code> of the connection). -+</p> -+<p> -+Beginning with Apache HTTP server version 2.4.42, when built/linked against -+OpenSSL 1.1.1 or later, and when the SNI is provided by the client in the TLS -+handshake, the <code class="directive">SSLProtocol</code> of each (name-based) virtual -+host can and will be honored. -+</p> -+<p> -+For compatibility with previous versions, if no -+<code class="directive">SSLProtocol</code> is configured in a name-based virtual host, -+the one from the base virtual host still applies, <strong>unless</strong> -+<code class="directive">SSLProtocol</code> is configured globally in which case the -+global value applies (this latter exception is more sensible than compatible, -+though). -+</p> -+</div> -+ - </div> - <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> - <div class="directive-section"><h2><a name="SSLProxyCACertificateFile" id="SSLProxyCACertificateFile">SSLProxyCACertificateFile</a> <a name="sslproxycacertificatefile" id="sslproxycacertificatefile">Directive</a></h2> -diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c -index 0c4bf1f..ca5f702 100644 ---- a/modules/ssl/ssl_engine_config.c -+++ b/modules/ssl/ssl_engine_config.c -@@ -269,6 +269,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p, - mrg->protocol_set = 1; - } - else { -+ mrg->protocol_set = base->protocol_set; - mrg->protocol = base->protocol; - } - -diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c -index 31062bc..70d151e 100644 ---- a/modules/ssl/ssl_engine_init.c -+++ b/modules/ssl/ssl_engine_init.c -@@ -520,7 +520,9 @@ static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s, - "Configuring TLS extension handling"); - - /* -- * Server name indication (SNI) -+ * The Server Name Indication (SNI) provided by the ClientHello can be -+ * used to select the right (name-based-)vhost and its SSL configuration -+ * before the handshake takes place. - */ - if (!SSL_CTX_set_tlsext_servername_callback(mctx->ssl_ctx, - ssl_callback_ServerNameIndication) || -@@ -532,6 +534,16 @@ static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s, - return ssl_die(s); - } - -+#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) -+ /* -+ * The ClientHello callback also allows to retrieve the SNI, but since it -+ * runs at the earliest possible connection stage we can even set the TLS -+ * protocol version(s) according to the selected (name-based-)vhost, which -+ * is not possible at the SNI callback stage (due to OpenSSL internals). -+ */ -+ SSL_CTX_set_client_hello_cb(mctx->ssl_ctx, ssl_callback_ClientHello, NULL); -+#endif -+ - #ifdef HAVE_OCSP_STAPLING - /* - * OCSP Stapling support, status_request extension -@@ -708,7 +720,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, - #else /* #if OPENSSL_VERSION_NUMBER < 0x10100000L */ - /* We first determine the maximum protocol version we should provide */ - #if SSL_HAVE_PROTOCOL_TLSV1_3 -- if (SSL_HAVE_PROTOCOL_TLSV1_3 && (protocol & SSL_PROTOCOL_TLSV1_3)) { -+ if (protocol & SSL_PROTOCOL_TLSV1_3) { - prot = TLS1_3_VERSION; - } else - #endif -diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c -index 8b44674..7313a55 100644 ---- a/modules/ssl/ssl_engine_kernel.c -+++ b/modules/ssl/ssl_engine_kernel.c -@@ -2357,28 +2357,31 @@ static apr_status_t set_challenge_creds(conn_rec *c, const char *servername, - * This function sets the virtual host from an extended - * client hello with a server name indication extension ("SNI", cf. RFC 6066). - */ --static apr_status_t init_vhost(conn_rec *c, SSL *ssl) -+static apr_status_t init_vhost(conn_rec *c, SSL *ssl, const char *servername) - { -- const char *servername; - X509 *cert; - EVP_PKEY *key; - - if (c) { - SSLConnRec *sslcon = myConnConfig(c); -- -- if (sslcon->server != c->base_server) { -- /* already found the vhost */ -- return APR_SUCCESS; -+ -+ if (sslcon->vhost_found) { -+ /* already found the vhost? */ -+ return sslcon->vhost_found > 0 ? APR_SUCCESS : APR_NOTFOUND; - } -+ sslcon->vhost_found = -1; - -- servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name); -+ if (!servername) { -+ servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name); -+ } - if (servername) { - if (ap_vhost_iterate_given_conn(c, ssl_find_vhost, - (void *)servername)) { - ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02043) - "SSL virtual host for servername %s found", - servername); -- -+ -+ sslcon->vhost_found = +1; - return APR_SUCCESS; - } - else if (ssl_is_challenge(c, servername, &cert, &key)) { -@@ -2428,11 +2431,72 @@ static apr_status_t init_vhost(conn_rec *c, SSL *ssl) - int ssl_callback_ServerNameIndication(SSL *ssl, int *al, modssl_ctx_t *mctx) - { - conn_rec *c = (conn_rec *)SSL_get_app_data(ssl); -- apr_status_t status = init_vhost(c, ssl); -+ apr_status_t status = init_vhost(c, ssl, NULL); - - return (status == APR_SUCCESS)? SSL_TLSEXT_ERR_OK : SSL_TLSEXT_ERR_NOACK; - } - -+#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) -+/* -+ * This callback function is called when the ClientHello is received. -+ */ -+int ssl_callback_ClientHello(SSL *ssl, int *al, void *arg) -+{ -+ char *servername = NULL; -+ conn_rec *c = (conn_rec *)SSL_get_app_data(ssl); -+ const unsigned char *pos; -+ size_t len, remaining; -+ (void)arg; -+ -+ /* We can't use SSL_get_servername() at this earliest OpenSSL connection -+ * stage, and there is no SSL_client_hello_get0_servername() provided as -+ * of OpenSSL 1.1.1. So the code below, that extracts the SNI from the -+ * ClientHello's TLS extensions, is taken from some test code in OpenSSL, -+ * i.e. client_hello_select_server_ctx() in "test/handshake_helper.c". -+ */ -+ -+ /* -+ * The server_name extension was given too much extensibility when it -+ * was written, so parsing the normal case is a bit complex. -+ */ -+ if (!SSL_client_hello_get0_ext(ssl, TLSEXT_TYPE_server_name, &pos, -+ &remaining) -+ || remaining <= 2) -+ goto give_up; -+ -+ /* Extract the length of the supplied list of names. */ -+ len = (*(pos++) << 8); -+ len += *(pos++); -+ if (len + 2 != remaining) -+ goto give_up; -+ remaining = len; -+ -+ /* -+ * The list in practice only has a single element, so we only consider -+ * the first one. -+ */ -+ if (remaining <= 3 || *pos++ != TLSEXT_NAMETYPE_host_name) -+ goto give_up; -+ remaining--; -+ -+ /* Now we can finally pull out the byte array with the actual hostname. */ -+ len = (*(pos++) << 8); -+ len += *(pos++); -+ if (len + 2 != remaining) -+ goto give_up; -+ -+ /* Use the SNI to switch to the relevant vhost, should it differ from -+ * c->base_server. -+ */ -+ servername = apr_pstrmemdup(c->pool, (const char *)pos, len); -+ -+give_up: -+ init_vhost(c, ssl, servername); -+ return SSL_CLIENT_HELLO_SUCCESS; -+} -+#endif /* OPENSSL_VERSION_NUMBER < 0x10101000L */ -+ -+ - /* - * Find a (name-based) SSL virtual host where either the ServerName - * or one of the ServerAliases matches the supplied name (to be used -@@ -2452,12 +2516,25 @@ static int ssl_find_vhost(void *servername, conn_rec *c, server_rec *s) - if (found && (ssl = sslcon->ssl) && - (sc = mySrvConfig(s))) { - SSL_CTX *ctx = SSL_set_SSL_CTX(ssl, sc->server->ssl_ctx); -+ - /* - * SSL_set_SSL_CTX() only deals with the server cert, - * so we need to duplicate a few additional settings - * from the ctx by hand - */ - SSL_set_options(ssl, SSL_CTX_get_options(ctx)); -+#if OPENSSL_VERSION_NUMBER >= 0x10100000L \ -+ && (!defined(LIBRESSL_VERSION_NUMBER) \ -+ || LIBRESSL_VERSION_NUMBER >= 0x20800000L) -+ /* -+ * Don't switch the protocol if none is configured for this vhost, -+ * the default in this case is still the base server's SSLProtocol. -+ */ -+ if (myCtxConfig(sslcon, sc)->protocol_set) { -+ SSL_set_min_proto_version(ssl, SSL_CTX_get_min_proto_version(ctx)); -+ SSL_set_max_proto_version(ssl, SSL_CTX_get_max_proto_version(ctx)); -+ } -+#endif - if ((SSL_get_verify_mode(ssl) == SSL_VERIFY_NONE) || - (SSL_num_renegotiations(ssl) == 0)) { - /* -@@ -2654,7 +2731,7 @@ int ssl_callback_alpn_select(SSL *ssl, - * they callback the SNI. We need to make sure that we know which vhost - * we are dealing with so we respect the correct protocols. - */ -- init_vhost(c, ssl); -+ init_vhost(c, ssl, NULL); - - proposed = ap_select_protocol(c, NULL, sslconn->server, client_protos); - if (!proposed) { -diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h -index 8055200..f8a1db7 100644 ---- a/modules/ssl/ssl_private.h -+++ b/modules/ssl/ssl_private.h -@@ -563,6 +563,7 @@ typedef struct { - - const char *cipher_suite; /* cipher suite used in last reneg */ - int service_unavailable; /* thouugh we negotiate SSL, no requests will be served */ -+ int vhost_found; /* whether we found vhost from SNI already */ - } SSLConnRec; - - /* BIG FAT WARNING: SSLModConfigRec has unusual memory lifetime: it is -@@ -946,6 +947,9 @@ void ssl_callback_Info(const SSL *, int, int); - #ifdef HAVE_TLSEXT - int ssl_callback_ServerNameIndication(SSL *, int *, modssl_ctx_t *); - #endif -+#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) -+int ssl_callback_ClientHello(SSL *, int *, void *); -+#endif - #ifdef HAVE_TLS_SESSION_TICKETS - int ssl_callback_SessionTicket(SSL *, unsigned char *, unsigned char *, - EVP_CIPHER_CTX *, HMAC_CTX *, int); diff --git a/SOURCES/httpd-2.4.37-r1877397.patch b/SOURCES/httpd-2.4.37-r1877397.patch deleted file mode 100644 index 93aeb2e..0000000 --- a/SOURCES/httpd-2.4.37-r1877397.patch +++ /dev/null @@ -1,249 +0,0 @@ -diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c -index b286053..8b6c34f 100644 ---- a/modules/ssl/ssl_engine_init.c -+++ b/modules/ssl/ssl_engine_init.c -@@ -824,6 +824,13 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, - SSL_CTX_set_keylog_callback(ctx, modssl_callback_keylog); - } - #endif -+ -+#ifdef SSL_OP_NO_RENEGOTIATION -+ /* For server-side SSL_CTX, disable renegotiation by default.. */ -+ if (!mctx->pkp) { -+ SSL_CTX_set_options(ctx, SSL_OP_NO_RENEGOTIATION); -+ } -+#endif - - return APR_SUCCESS; - } -@@ -845,6 +852,14 @@ static void ssl_init_ctx_session_cache(server_rec *s, - } - } - -+#ifdef SSL_OP_NO_RENEGOTIATION -+/* OpenSSL-level renegotiation protection. */ -+#define MODSSL_BLOCKS_RENEG (0) -+#else -+/* mod_ssl-level renegotiation protection. */ -+#define MODSSL_BLOCKS_RENEG (1) -+#endif -+ - static void ssl_init_ctx_callbacks(server_rec *s, - apr_pool_t *p, - apr_pool_t *ptemp, -@@ -854,7 +869,13 @@ static void ssl_init_ctx_callbacks(server_rec *s, - - SSL_CTX_set_tmp_dh_callback(ctx, ssl_callback_TmpDH); - -- SSL_CTX_set_info_callback(ctx, ssl_callback_Info); -+ /* The info callback is used for debug-level tracing. For OpenSSL -+ * versions where SSL_OP_NO_RENEGOTIATION is not available, the -+ * callback is also used to prevent use of client-initiated -+ * renegotiation. Enable it in either case. */ -+ if (APLOGdebug(s) || MODSSL_BLOCKS_RENEG) { -+ SSL_CTX_set_info_callback(ctx, ssl_callback_Info); -+ } - - #ifdef HAVE_TLS_ALPN - SSL_CTX_set_alpn_select_cb(ctx, ssl_callback_alpn_select, NULL); -diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c -index 836bfdb..0958135 100644 ---- a/modules/ssl/ssl_engine_io.c -+++ b/modules/ssl/ssl_engine_io.c -@@ -200,11 +200,13 @@ static int bio_filter_out_write(BIO *bio, const char *in, int inl) - apr_bucket *e; - int need_flush; - -+#ifndef SSL_OP_NO_RENEGOTIATION - /* Abort early if the client has initiated a renegotiation. */ - if (outctx->filter_ctx->config->reneg_state == RENEG_ABORT) { - outctx->rc = APR_ECONNABORTED; - return -1; - } -+#endif - - /* when handshaking we'll have a small number of bytes. - * max size SSL will pass us here is about 16k. -@@ -458,11 +460,13 @@ static int bio_filter_in_read(BIO *bio, char *in, int inlen) - if (!in) - return 0; - -+#ifndef SSL_OP_NO_RENEGOTIATION - /* Abort early if the client has initiated a renegotiation. */ - if (inctx->filter_ctx->config->reneg_state == RENEG_ABORT) { - inctx->rc = APR_ECONNABORTED; - return -1; - } -+#endif - - BIO_clear_retry_flags(bio); - -diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c -index e217b9d..21f701f 100644 ---- a/modules/ssl/ssl_engine_kernel.c -+++ b/modules/ssl/ssl_engine_kernel.c -@@ -992,7 +992,7 @@ static int ssl_hook_Access_classic(request_rec *r, SSLSrvConfigRec *sc, SSLDirCo - - /* Toggle the renegotiation state to allow the new - * handshake to proceed. */ -- sslconn->reneg_state = RENEG_ALLOW; -+ modssl_set_reneg_state(sslconn, RENEG_ALLOW); - - SSL_renegotiate(ssl); - SSL_do_handshake(ssl); -@@ -1019,7 +1019,7 @@ static int ssl_hook_Access_classic(request_rec *r, SSLSrvConfigRec *sc, SSLDirCo - */ - SSL_peek(ssl, peekbuf, 0); - -- sslconn->reneg_state = RENEG_REJECT; -+ modssl_set_reneg_state(sslconn, RENEG_REJECT); - - if (!SSL_is_init_finished(ssl)) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02261) -@@ -1078,7 +1078,7 @@ static int ssl_hook_Access_modern(request_rec *r, SSLSrvConfigRec *sc, SSLDirCon - (sc->server->auth.verify_mode != SSL_CVERIFY_UNSET)) { - int vmode_inplace, vmode_needed; - int change_vmode = FALSE; -- int old_state, n, rc; -+ int n, rc; - - vmode_inplace = SSL_get_verify_mode(ssl); - vmode_needed = SSL_VERIFY_NONE; -@@ -1180,8 +1180,6 @@ static int ssl_hook_Access_modern(request_rec *r, SSLSrvConfigRec *sc, SSLDirCon - return HTTP_FORBIDDEN; - } - -- old_state = sslconn->reneg_state; -- sslconn->reneg_state = RENEG_ALLOW; - modssl_set_app_data2(ssl, r); - - SSL_do_handshake(ssl); -@@ -1191,7 +1189,6 @@ static int ssl_hook_Access_modern(request_rec *r, SSLSrvConfigRec *sc, SSLDirCon - */ - SSL_peek(ssl, peekbuf, 0); - -- sslconn->reneg_state = old_state; - modssl_set_app_data2(ssl, NULL); - - /* -@@ -2271,8 +2268,8 @@ static void log_tracing_state(const SSL *ssl, conn_rec *c, - /* - * This callback function is executed while OpenSSL processes the SSL - * handshake and does SSL record layer stuff. It's used to trap -- * client-initiated renegotiations, and for dumping everything to the -- * log. -+ * client-initiated renegotiations (where SSL_OP_NO_RENEGOTIATION is -+ * not available), and for dumping everything to the log. - */ - void ssl_callback_Info(const SSL *ssl, int where, int rc) - { -@@ -2284,14 +2281,12 @@ void ssl_callback_Info(const SSL *ssl, int where, int rc) - return; - } - -- /* With TLS 1.3 this callback may be called multiple times on the first -- * negotiation, so the below logic to detect renegotiations can't work. -- * Fortunately renegotiations are forbidden starting with TLS 1.3, and -- * this is enforced by OpenSSL so there's nothing to be done here. -- */ --#if SSL_HAVE_PROTOCOL_TLSV1_3 -- if (SSL_version(ssl) < TLS1_3_VERSION) --#endif -+#ifndef SSL_OP_NO_RENEGOTIATION -+ /* With OpenSSL < 1.1.1 (implying TLS v1.2 or earlier), this -+ * callback is used to block client-initiated renegotiation. With -+ * TLSv1.3 it is unnecessary since renegotiation is forbidden at -+ * protocol level. Otherwise (TLSv1.2 with OpenSSL >=1.1.1), -+ * SSL_OP_NO_RENEGOTIATION is used to block renegotiation. */ - { - SSLConnRec *sslconn; - -@@ -2316,6 +2311,7 @@ void ssl_callback_Info(const SSL *ssl, int where, int rc) - sslconn->reneg_state = RENEG_REJECT; - } - } -+#endif - - s = mySrvFromConn(c); - if (s && APLOGdebug(s)) { -diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h -index 2514407..f4e5ac9 100644 ---- a/modules/ssl/ssl_private.h -+++ b/modules/ssl/ssl_private.h -@@ -508,6 +508,16 @@ typedef struct { - apr_time_t source_mtime; - } ssl_asn1_t; - -+typedef enum { -+ RENEG_INIT = 0, /* Before initial handshake */ -+ RENEG_REJECT, /* After initial handshake; any client-initiated -+ * renegotiation should be rejected */ -+ RENEG_ALLOW, /* A server-initiated renegotiation is taking -+ * place (as dictated by configuration) */ -+ RENEG_ABORT /* Renegotiation initiated by client, abort the -+ * connection */ -+} modssl_reneg_state; -+ - /** - * Define the mod_ssl per-module configuration structure - * (i.e. the global configuration for each httpd process) -@@ -540,18 +550,13 @@ typedef struct { - NON_SSL_SET_ERROR_MSG /* Need to set the error message */ - } non_ssl_request; - -- /* Track the handshake/renegotiation state for the connection so -- * that all client-initiated renegotiations can be rejected, as a -- * partial fix for CVE-2009-3555. */ -- enum { -- RENEG_INIT = 0, /* Before initial handshake */ -- RENEG_REJECT, /* After initial handshake; any client-initiated -- * renegotiation should be rejected */ -- RENEG_ALLOW, /* A server-initiated renegotiation is taking -- * place (as dictated by configuration) */ -- RENEG_ABORT /* Renegotiation initiated by client, abort the -- * connection */ -- } reneg_state; -+#ifndef SSL_OP_NO_RENEGOTIATION -+ /* For OpenSSL < 1.1.1, track the handshake/renegotiation state -+ * for the connection to block client-initiated renegotiations. -+ * For OpenSSL >=1.1.1, the SSL_OP_NO_RENEGOTIATION flag is used in -+ * the SSL * options state with equivalent effect. */ -+ modssl_reneg_state reneg_state; -+#endif - - server_rec *server; - SSLDirConfigRec *dc; -@@ -1130,6 +1135,9 @@ int ssl_is_challenge(conn_rec *c, const char *servername, - * the configured ENGINE. */ - int modssl_is_engine_id(const char *name); - -+/* Set the renegotation state for connection. */ -+void modssl_set_reneg_state(SSLConnRec *sslconn, modssl_reneg_state state); -+ - #endif /* SSL_PRIVATE_H */ - /** @} */ - -diff --git a/modules/ssl/ssl_util_ssl.c b/modules/ssl/ssl_util_ssl.c -index 4fa089b..3413d83 100644 ---- a/modules/ssl/ssl_util_ssl.c -+++ b/modules/ssl/ssl_util_ssl.c -@@ -504,3 +504,19 @@ char *modssl_SSL_SESSION_id2sz(IDCONST unsigned char *id, int idlen, - - return str; - } -+ -+void modssl_set_reneg_state(SSLConnRec *sslconn, modssl_reneg_state state) -+{ -+#ifdef SSL_OP_NO_RENEGOTIATION -+ switch (state) { -+ case RENEG_ALLOW: -+ SSL_clear_options(sslconn->ssl, SSL_OP_NO_RENEGOTIATION); -+ break; -+ default: -+ SSL_set_options(sslconn->ssl, SSL_OP_NO_RENEGOTIATION); -+ break; -+ } -+#else -+ sslconn->reneg_state = state; -+#endif -+} diff --git a/SOURCES/httpd-2.4.37-r1878280.patch b/SOURCES/httpd-2.4.37-r1878280.patch deleted file mode 100644 index 8393411..0000000 --- a/SOURCES/httpd-2.4.37-r1878280.patch +++ /dev/null @@ -1,47 +0,0 @@ -From ced24e032ebe185a2d885fa309d6de47668ba31e Mon Sep 17 00:00:00 2001 -From: Yann Ylavic <ylavic@apache.org> -Date: Fri, 26 Jun 2020 10:21:19 +0000 -Subject: [PATCH] Merge r1878280 from trunk: - -mod_proxy_http: don't strip EOS when spooling request body to file. - -To prevent stream_reqbody() from sending the FILE and FLUSH bucket in separate -brigades, and thus apr_file_setaside() to trigger if network congestion occurs -with the backend, restore the EOS in spool_reqbody_cl() which was stripped -when spooling the request body to a file. - -Until APR r1878279 is released (and installed by users), apr_file_setaside() -on a temporary file (mktemp) will simply drop the file cleanup, leaking the -fd and inode.. - -This fixes BZ 64452. - - -Submitted by: ylavic -Reviewed by: ylavic, jorton, rpluem - - -git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1879226 13f79535-47bb-0310-9956-ffa450edef68 ---- - modules/proxy/mod_proxy_http.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c -index e94bf26d412..7a0f063f705 100644 ---- a/modules/proxy/mod_proxy_http.c -+++ b/modules/proxy/mod_proxy_http.c -@@ -548,6 +548,14 @@ static int spool_reqbody_cl(proxy_http_req_t *req, apr_off_t *bytes_spooled) - e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc); - APR_BRIGADE_INSERT_TAIL(input_brigade, e); - } -+ if (tmpfile) { -+ /* We dropped metadata buckets when spooling to tmpfile, -+ * terminate with EOS for stream_reqbody() to flush the -+ * whole in one go. -+ */ -+ e = apr_bucket_eos_create(bucket_alloc); -+ APR_BRIGADE_INSERT_TAIL(input_brigade, e); -+ } - return OK; - } - diff --git a/SOURCES/httpd-2.4.37-r1878890.patch b/SOURCES/httpd-2.4.37-r1878890.patch deleted file mode 100644 index 0dcc4b0..0000000 --- a/SOURCES/httpd-2.4.37-r1878890.patch +++ /dev/null @@ -1,116 +0,0 @@ -diff --git a/include/util_ldap.h b/include/util_ldap.h -index f7cd736..f401e79 100644 ---- a/include/util_ldap.h -+++ b/include/util_ldap.h -@@ -32,7 +32,6 @@ - #if APR_MAJOR_VERSION < 2 - /* The LDAP API is currently only present in APR 1.x */ - #include "apr_ldap.h" --#include "apr_ldap_rebind.h" - #else - #define APR_HAS_LDAP 0 - #endif -diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c -index 08f986c..eecb3f7 100644 ---- a/modules/ldap/util_ldap.c -+++ b/modules/ldap/util_ldap.c -@@ -140,6 +140,38 @@ static int util_ldap_handler(request_rec *r) - return OK; - } - -+/* For OpenLDAP with the 3-arg version of ldap_set_rebind_proc(), use -+ * a simpler rebind callback than the implementation in APR-util. -+ * Testing for API version >= 3001 appears safe although OpenLDAP -+ * 2.1.x (API version = 2004) also has the 3-arg API. */ -+#if APR_HAS_OPENLDAP_LDAPSDK && defined(LDAP_API_VERSION) && LDAP_API_VERSION >= 3001 -+ -+#define uldap_rebind_init(p) APR_SUCCESS /* noop */ -+ -+static int uldap_rebind_proc(LDAP *ld, const char *url, ber_tag_t request, -+ ber_int_t msgid, void *params) -+{ -+ util_ldap_connection_t *ldc = params; -+ -+ return ldap_bind_s(ld, ldc->binddn, ldc->bindpw, LDAP_AUTH_SIMPLE); -+} -+ -+static apr_status_t uldap_rebind_add(util_ldap_connection_t *ldc) -+{ -+ ldap_set_rebind_proc(ldc->ldap, uldap_rebind_proc, ldc); -+ return APR_SUCCESS; -+} -+ -+#else /* !APR_HAS_OPENLDAP_LDAPSDK */ -+ -+#define USE_APR_LDAP_REBIND -+#include <apr_ldap_rebind.h> -+ -+#define uldap_rebind_init(p) apr_ldap_rebind_init(p) -+#define uldap_rebind_add(ldc) apr_ldap_rebind_add((ldc)->rebind_pool, \ -+ (ldc)->ldap, (ldc)->binddn, \ -+ (ldc)->bindpw) -+#endif - - - /* ------------------------------------------------------------------ */ -@@ -181,6 +213,13 @@ static apr_status_t uldap_connection_unbind(void *param) - util_ldap_connection_t *ldc = param; - - if (ldc) { -+#ifdef USE_APR_LDAP_REBIND -+ /* forget the rebind info for this conn */ -+ if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { -+ apr_pool_clear(ldc->rebind_pool); -+ } -+#endif -+ - if (ldc->ldap) { - if (ldc->r) { - ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, ldc->r, "LDC %pp unbind", ldc); -@@ -189,12 +228,6 @@ static apr_status_t uldap_connection_unbind(void *param) - ldc->ldap = NULL; - } - ldc->bound = 0; -- -- /* forget the rebind info for this conn */ -- if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { -- apr_ldap_rebind_remove(ldc->ldap); -- apr_pool_clear(ldc->rebind_pool); -- } - } - - return APR_SUCCESS; -@@ -330,7 +363,7 @@ static int uldap_connection_init(request_rec *r, - - if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { - /* Now that we have an ldap struct, add it to the referral list for rebinds. */ -- rc = apr_ldap_rebind_add(ldc->rebind_pool, ldc->ldap, ldc->binddn, ldc->bindpw); -+ rc = uldap_rebind_add(ldc); - if (rc != APR_SUCCESS) { - ap_log_error(APLOG_MARK, APLOG_ERR, rc, r->server, APLOGNO(01277) - "LDAP: Unable to add rebind cross reference entry. Out of memory?"); -@@ -855,6 +888,7 @@ static util_ldap_connection_t * - /* whether or not to keep this connection in the pool when it's returned */ - l->keep = (st->connection_pool_ttl == 0) ? 0 : 1; - -+#ifdef USE_APR_LDAP_REBIND - if (l->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { - if (apr_pool_create(&(l->rebind_pool), l->pool) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r, APLOGNO(01286) -@@ -865,6 +899,7 @@ static util_ldap_connection_t * - return NULL; - } - } -+#endif - - if (p) { - p->next = l; -@@ -3051,7 +3086,7 @@ static int util_ldap_post_config(apr_pool_t *p, apr_pool_t *plog, - } - - /* Initialize the rebind callback's cross reference list. */ -- apr_ldap_rebind_init (p); -+ (void) uldap_rebind_init(p); - - #ifdef AP_LDAP_OPT_DEBUG - if (st->debug_level > 0) { diff --git a/SOURCES/httpd-2.4.37-r1879224.patch b/SOURCES/httpd-2.4.37-r1879224.patch deleted file mode 100644 index 2566d8f..0000000 --- a/SOURCES/httpd-2.4.37-r1879224.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c -index c217a0d..d07d0ba 100644 ---- a/modules/ssl/ssl_engine_kernel.c -+++ b/modules/ssl/ssl_engine_kernel.c -@@ -1947,7 +1947,7 @@ static void modssl_proxy_info_log(conn_rec *c, - *cert = info->x509; \ - CRYPTO_add(&(*cert)->references, +1, CRYPTO_LOCK_X509); \ - *pkey = info->x_pkey->dec_pkey; \ -- CRYPTO_add(&(*pkey)->references, +1, CRYPTO_LOCK_X509_PKEY) -+ CRYPTO_add(&(*pkey)->references, +1, CRYPTO_LOCK_EVP_PKEY) - #else - #define modssl_set_cert_info(info, cert, pkey) \ - *cert = info->x509; \ diff --git a/SOURCES/httpd-2.4.37-r1881459.patch b/SOURCES/httpd-2.4.37-r1881459.patch deleted file mode 100644 index 0f73c06..0000000 --- a/SOURCES/httpd-2.4.37-r1881459.patch +++ /dev/null @@ -1,16 +0,0 @@ ---- a/modules/generators/cgi_common.h 2020/09/04 13:16:53 1881458 -+++ b/modules/generators/cgi_common.h 2020/09/04 13:56:25 1881459 -@@ -259,6 +259,13 @@ - if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, - APLOG_MODULE_INDEX))) - { -+ /* In the case of a timeout reading script output, clear -+ * the brigade to avoid a second attempt to read the -+ * output. */ -+ if (ret == HTTP_GATEWAY_TIME_OUT) { -+ apr_brigade_cleanup(bb); -+ } -+ - ret = log_script(r, conf, ret, logdata, sbuf, bb, script_err); - - /* diff --git a/SOURCES/httpd-2.4.37-r1885607.patch b/SOURCES/httpd-2.4.37-r1885607.patch deleted file mode 100644 index 124d06c..0000000 --- a/SOURCES/httpd-2.4.37-r1885607.patch +++ /dev/null @@ -1,849 +0,0 @@ -diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h -index fbbd508..8fcd26d 100644 ---- a/modules/proxy/mod_proxy.h -+++ b/modules/proxy/mod_proxy.h -@@ -1168,6 +1168,55 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - char **old_cl_val, - char **old_te_val); - -+/** -+ * Prefetch the client request body (in memory), up to a limit. -+ * Read what's in the client pipe. If nonblocking is set and read is EAGAIN, -+ * pass a FLUSH bucket to the backend and read again in blocking mode. -+ * @param r client request -+ * @param backend backend connection -+ * @param input_brigade input brigade to use/fill -+ * @param block blocking or non-blocking mode -+ * @param bytes_read number of bytes read -+ * @param max_read maximum number of bytes to read -+ * @return OK or HTTP_* error code -+ * @note max_read is rounded up to APR_BUCKET_BUFF_SIZE -+ */ -+PROXY_DECLARE(int) ap_proxy_prefetch_input(request_rec *r, -+ proxy_conn_rec *backend, -+ apr_bucket_brigade *input_brigade, -+ apr_read_type_e block, -+ apr_off_t *bytes_read, -+ apr_off_t max_read); -+ -+/** -+ * Spool the client request body to memory, or disk above given limit. -+ * @param r client request -+ * @param backend backend connection -+ * @param input_brigade input brigade to use/fill -+ * @param bytes_spooled number of bytes spooled -+ * @param max_mem_spool maximum number of in-memory bytes -+ * @return OK or HTTP_* error code -+ */ -+PROXY_DECLARE(int) ap_proxy_spool_input(request_rec *r, -+ proxy_conn_rec *backend, -+ apr_bucket_brigade *input_brigade, -+ apr_off_t *bytes_spooled, -+ apr_off_t max_mem_spool); -+ -+/** -+ * Read what's in the client pipe. If the read would block (EAGAIN), -+ * pass a FLUSH bucket to the backend and read again in blocking mode. -+ * @param r client request -+ * @param backend backend connection -+ * @param input_brigade brigade to use/fill -+ * @param max_read maximum number of bytes to read -+ * @return OK or HTTP_* error code -+ */ -+PROXY_DECLARE(int) ap_proxy_read_input(request_rec *r, -+ proxy_conn_rec *backend, -+ apr_bucket_brigade *input_brigade, -+ apr_off_t max_read); -+ - /** - * @param bucket_alloc bucket allocator - * @param r request -diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c -index 2e97408..f9cf716 100644 ---- a/modules/proxy/mod_proxy_fcgi.c -+++ b/modules/proxy/mod_proxy_fcgi.c -@@ -521,7 +521,8 @@ static int handle_headers(request_rec *r, int *state, - static apr_status_t dispatch(proxy_conn_rec *conn, proxy_dir_conf *conf, - request_rec *r, apr_pool_t *setaside_pool, - apr_uint16_t request_id, const char **err, -- int *bad_request, int *has_responded) -+ int *bad_request, int *has_responded, -+ apr_bucket_brigade *input_brigade) - { - apr_bucket_brigade *ib, *ob; - int seen_end_of_headers = 0, done = 0, ignore_body = 0; -@@ -583,9 +584,26 @@ static apr_status_t dispatch(proxy_conn_rec *conn, proxy_dir_conf *conf, - int last_stdin = 0; - char *iobuf_cursor; - -- rv = ap_get_brigade(r->input_filters, ib, -- AP_MODE_READBYTES, APR_BLOCK_READ, -- iobuf_size); -+ if (APR_BRIGADE_EMPTY(input_brigade)) { -+ rv = ap_get_brigade(r->input_filters, ib, -+ AP_MODE_READBYTES, APR_BLOCK_READ, -+ iobuf_size); -+ } -+ else { -+ apr_bucket *e; -+ APR_BRIGADE_CONCAT(ib, input_brigade); -+ rv = apr_brigade_partition(ib, iobuf_size, &e); -+ if (rv == APR_SUCCESS) { -+ while (e != APR_BRIGADE_SENTINEL(ib) -+ && APR_BUCKET_IS_METADATA(e)) { -+ e = APR_BUCKET_NEXT(e); -+ } -+ apr_brigade_split_ex(ib, e, input_brigade); -+ } -+ else if (rv == APR_INCOMPLETE) { -+ rv = APR_SUCCESS; -+ } -+ } - if (rv != APR_SUCCESS) { - *err = "reading input brigade"; - *bad_request = 1; -@@ -924,7 +942,8 @@ static int fcgi_do_request(apr_pool_t *p, request_rec *r, - conn_rec *origin, - proxy_dir_conf *conf, - apr_uri_t *uri, -- char *url, char *server_portstr) -+ char *url, char *server_portstr, -+ apr_bucket_brigade *input_brigade) - { - /* Request IDs are arbitrary numbers that we assign to a - * single request. This would allow multiplex/pipelining of -@@ -960,7 +979,8 @@ static int fcgi_do_request(apr_pool_t *p, request_rec *r, - - /* Step 3: Read records from the back end server and handle them. */ - rv = dispatch(conn, conf, r, temp_pool, request_id, -- &err, &bad_request, &has_responded); -+ &err, &bad_request, &has_responded, -+ input_brigade); - if (rv != APR_SUCCESS) { - /* If the client aborted the connection during retrieval or (partially) - * sending the response, don't return a HTTP_SERVICE_UNAVAILABLE, since -@@ -996,6 +1016,8 @@ static int fcgi_do_request(apr_pool_t *p, request_rec *r, - - #define FCGI_SCHEME "FCGI" - -+#define MAX_MEM_SPOOL 16384 -+ - /* - * This handles fcgi:(dest) URLs - */ -@@ -1008,6 +1030,8 @@ static int proxy_fcgi_handler(request_rec *r, proxy_worker *worker, - char server_portstr[32]; - conn_rec *origin = NULL; - proxy_conn_rec *backend = NULL; -+ apr_bucket_brigade *input_brigade; -+ apr_off_t input_bytes = 0; - apr_uri_t *uri; - - proxy_dir_conf *dconf = ap_get_module_config(r->per_dir_config, -@@ -1050,6 +1074,101 @@ static int proxy_fcgi_handler(request_rec *r, proxy_worker *worker, - goto cleanup; - } - -+ /* We possibly reuse input data prefetched in previous call(s), e.g. for a -+ * balancer fallback scenario. -+ */ -+ apr_pool_userdata_get((void **)&input_brigade, "proxy-fcgi-input", p); -+ if (input_brigade == NULL) { -+ const char *old_te = apr_table_get(r->headers_in, "Transfer-Encoding"); -+ const char *old_cl = NULL; -+ if (old_te) { -+ apr_table_unset(r->headers_in, "Content-Length"); -+ } -+ else { -+ old_cl = apr_table_get(r->headers_in, "Content-Length"); -+ } -+ -+ input_brigade = apr_brigade_create(p, r->connection->bucket_alloc); -+ apr_pool_userdata_setn(input_brigade, "proxy-fcgi-input", NULL, p); -+ -+ /* Prefetch (nonlocking) the request body so to increase the chance -+ * to get the whole (or enough) body and determine Content-Length vs -+ * chunked or spooled. By doing this before connecting or reusing the -+ * backend, we want to minimize the delay between this connection is -+ * considered alive and the first bytes sent (should the client's link -+ * be slow or some input filter retain the data). This is a best effort -+ * to prevent the backend from closing (from under us) what it thinks is -+ * an idle connection, hence to reduce to the minimum the unavoidable -+ * local is_socket_connected() vs remote keepalive race condition. -+ */ -+ status = ap_proxy_prefetch_input(r, backend, input_brigade, -+ APR_NONBLOCK_READ, &input_bytes, -+ MAX_MEM_SPOOL); -+ if (status != OK) { -+ goto cleanup; -+ } -+ -+ /* -+ * The request body is streamed by default, using either C-L or -+ * chunked T-E, like this: -+ * -+ * The whole body (including no body) was received on prefetch, i.e. -+ * the input brigade ends with EOS => C-L = input_bytes. -+ * -+ * C-L is known and reliable, i.e. only protocol filters in the input -+ * chain thus none should change the body => use C-L from client. -+ * -+ * The administrator has not "proxy-sendcl" which prevents T-E => use -+ * T-E and chunks. -+ * -+ * Otherwise we need to determine and set a content-length, so spool -+ * the entire request body to memory/temporary file (MAX_MEM_SPOOL), -+ * such that we finally know its length => C-L = input_bytes. -+ */ -+ if (!APR_BRIGADE_EMPTY(input_brigade) -+ && APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) { -+ /* The whole thing fit, so our decision is trivial, use the input -+ * bytes for the Content-Length. If we expected no body, and read -+ * no body, do not set the Content-Length. -+ */ -+ if (old_cl || old_te || input_bytes) { -+ apr_table_setn(r->headers_in, "Content-Length", -+ apr_off_t_toa(p, input_bytes)); -+ if (old_te) { -+ apr_table_unset(r->headers_in, "Transfer-Encoding"); -+ } -+ } -+ } -+ else if (old_cl && r->input_filters == r->proto_input_filters) { -+ /* Streaming is possible by preserving the existing C-L */ -+ } -+ else if (!apr_table_get(r->subprocess_env, "proxy-sendcl")) { -+ /* Streaming is possible using T-E: chunked */ -+ } -+ else { -+ /* No streaming, C-L is the only option so spool to memory/file */ -+ apr_bucket_brigade *tmp_bb; -+ apr_off_t remaining_bytes = 0; -+ -+ AP_DEBUG_ASSERT(MAX_MEM_SPOOL >= input_bytes); -+ tmp_bb = apr_brigade_create(p, r->connection->bucket_alloc); -+ status = ap_proxy_spool_input(r, backend, tmp_bb, &remaining_bytes, -+ MAX_MEM_SPOOL - input_bytes); -+ if (status != OK) { -+ goto cleanup; -+ } -+ -+ APR_BRIGADE_CONCAT(input_brigade, tmp_bb); -+ input_bytes += remaining_bytes; -+ -+ apr_table_setn(r->headers_in, "Content-Length", -+ apr_off_t_toa(p, input_bytes)); -+ if (old_te) { -+ apr_table_unset(r->headers_in, "Transfer-Encoding"); -+ } -+ } -+ } -+ - /* This scheme handler does not reuse connections by default, to - * avoid tying up a fastcgi that isn't expecting to work on - * parallel requests. But if the user went out of their way to -@@ -1074,7 +1193,7 @@ static int proxy_fcgi_handler(request_rec *r, proxy_worker *worker, - - /* Step Three: Process the Request */ - status = fcgi_do_request(p, r, backend, origin, dconf, uri, url, -- server_portstr); -+ server_portstr, input_brigade); - - cleanup: - ap_proxy_release_connection(FCGI_SCHEME, backend, r->server); -diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c -index df10997..7f67f26 100644 ---- a/modules/proxy/mod_proxy_http.c -+++ b/modules/proxy/mod_proxy_http.c -@@ -266,50 +266,6 @@ typedef struct { - prefetch_nonblocking:1; - } proxy_http_req_t; - --/* Read what's in the client pipe. If nonblocking is set and read is EAGAIN, -- * pass a FLUSH bucket to the backend and read again in blocking mode. -- */ --static int stream_reqbody_read(proxy_http_req_t *req, apr_bucket_brigade *bb, -- int nonblocking) --{ -- request_rec *r = req->r; -- proxy_conn_rec *p_conn = req->backend; -- apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc; -- apr_read_type_e block = nonblocking ? APR_NONBLOCK_READ : APR_BLOCK_READ; -- apr_status_t status; -- int rv; -- -- for (;;) { -- status = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES, -- block, HUGE_STRING_LEN); -- if (block == APR_BLOCK_READ -- || (!APR_STATUS_IS_EAGAIN(status) -- && (status != APR_SUCCESS || !APR_BRIGADE_EMPTY(bb)))) { -- break; -- } -- -- /* Flush and retry (blocking) */ -- apr_brigade_cleanup(bb); -- rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, req->origin, bb, 1); -- if (rv != OK) { -- return rv; -- } -- block = APR_BLOCK_READ; -- } -- -- if (status != APR_SUCCESS) { -- conn_rec *c = r->connection; -- ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02608) -- "read request body failed to %pI (%s)" -- " from %s (%s)", p_conn->addr, -- p_conn->hostname ? p_conn->hostname: "", -- c->client_ip, c->remote_host ? c->remote_host: ""); -- return ap_map_http_request_error(status, HTTP_BAD_REQUEST); -- } -- -- return OK; --} -- - static int stream_reqbody(proxy_http_req_t *req) - { - request_rec *r = req->r; -@@ -328,7 +284,8 @@ static int stream_reqbody(proxy_http_req_t *req) - do { - if (APR_BRIGADE_EMPTY(input_brigade) - && APR_BRIGADE_EMPTY(header_brigade)) { -- rv = stream_reqbody_read(req, input_brigade, 1); -+ rv = ap_proxy_read_input(r, p_conn, input_brigade, -+ HUGE_STRING_LEN); - if (rv != OK) { - return rv; - } -@@ -409,7 +366,7 @@ static int stream_reqbody(proxy_http_req_t *req) - */ - APR_BRIGADE_PREPEND(input_brigade, header_brigade); - -- /* Flush here on EOS because we won't stream_reqbody_read() again */ -+ /* Flush here on EOS because we won't ap_proxy_read_input() again. */ - rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin, - input_brigade, seen_eos); - if (rv != OK) { -@@ -427,137 +384,6 @@ static int stream_reqbody(proxy_http_req_t *req) - return OK; - } - --static int spool_reqbody_cl(proxy_http_req_t *req, apr_off_t *bytes_spooled) --{ -- apr_pool_t *p = req->p; -- request_rec *r = req->r; -- int seen_eos = 0, rv = OK; -- apr_status_t status = APR_SUCCESS; -- apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc; -- apr_bucket_brigade *input_brigade = req->input_brigade; -- apr_bucket_brigade *body_brigade; -- apr_bucket *e; -- apr_off_t bytes, fsize = 0; -- apr_file_t *tmpfile = NULL; -- apr_off_t limit; -- -- body_brigade = apr_brigade_create(p, bucket_alloc); -- *bytes_spooled = 0; -- -- limit = ap_get_limit_req_body(r); -- -- do { -- if (APR_BRIGADE_EMPTY(input_brigade)) { -- rv = stream_reqbody_read(req, input_brigade, 0); -- if (rv != OK) { -- return rv; -- } -- } -- -- /* If this brigade contains EOS, either stop or remove it. */ -- if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) { -- seen_eos = 1; -- } -- -- apr_brigade_length(input_brigade, 1, &bytes); -- -- if (*bytes_spooled + bytes > MAX_MEM_SPOOL) { -- /* -- * LimitRequestBody does not affect Proxy requests (Should it?). -- * Let it take effect if we decide to store the body in a -- * temporary file on disk. -- */ -- if (limit && (*bytes_spooled + bytes > limit)) { -- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01088) -- "Request body is larger than the configured " -- "limit of %" APR_OFF_T_FMT, limit); -- return HTTP_REQUEST_ENTITY_TOO_LARGE; -- } -- /* can't spool any more in memory; write latest brigade to disk */ -- if (tmpfile == NULL) { -- const char *temp_dir; -- char *template; -- -- status = apr_temp_dir_get(&temp_dir, p); -- if (status != APR_SUCCESS) { -- ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01089) -- "search for temporary directory failed"); -- return HTTP_INTERNAL_SERVER_ERROR; -- } -- apr_filepath_merge(&template, temp_dir, -- "modproxy.tmp.XXXXXX", -- APR_FILEPATH_NATIVE, p); -- status = apr_file_mktemp(&tmpfile, template, 0, p); -- if (status != APR_SUCCESS) { -- ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01090) -- "creation of temporary file in directory " -- "%s failed", temp_dir); -- return HTTP_INTERNAL_SERVER_ERROR; -- } -- } -- for (e = APR_BRIGADE_FIRST(input_brigade); -- e != APR_BRIGADE_SENTINEL(input_brigade); -- e = APR_BUCKET_NEXT(e)) { -- const char *data; -- apr_size_t bytes_read, bytes_written; -- -- apr_bucket_read(e, &data, &bytes_read, APR_BLOCK_READ); -- status = apr_file_write_full(tmpfile, data, bytes_read, &bytes_written); -- if (status != APR_SUCCESS) { -- const char *tmpfile_name; -- -- if (apr_file_name_get(&tmpfile_name, tmpfile) != APR_SUCCESS) { -- tmpfile_name = "(unknown)"; -- } -- ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01091) -- "write to temporary file %s failed", -- tmpfile_name); -- return HTTP_INTERNAL_SERVER_ERROR; -- } -- AP_DEBUG_ASSERT(bytes_read == bytes_written); -- fsize += bytes_written; -- } -- apr_brigade_cleanup(input_brigade); -- } -- else { -- -- /* -- * Save input_brigade in body_brigade. (At least) in the SSL case -- * input_brigade contains transient buckets whose data would get -- * overwritten during the next call of ap_get_brigade in the loop. -- * ap_save_brigade ensures these buckets to be set aside. -- * Calling ap_save_brigade with NULL as filter is OK, because -- * body_brigade already has been created and does not need to get -- * created by ap_save_brigade. -- */ -- status = ap_save_brigade(NULL, &body_brigade, &input_brigade, p); -- if (status != APR_SUCCESS) { -- return HTTP_INTERNAL_SERVER_ERROR; -- } -- -- } -- -- *bytes_spooled += bytes; -- } while (!seen_eos); -- -- APR_BRIGADE_CONCAT(input_brigade, body_brigade); -- if (tmpfile) { -- apr_brigade_insert_file(input_brigade, tmpfile, 0, fsize, p); -- } -- if (apr_table_get(r->subprocess_env, "proxy-sendextracrlf")) { -- e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc); -- APR_BRIGADE_INSERT_TAIL(input_brigade, e); -- } -- if (tmpfile) { -- /* We dropped metadata buckets when spooling to tmpfile, -- * terminate with EOS for stream_reqbody() to flush the -- * whole in one go. -- */ -- e = apr_bucket_eos_create(bucket_alloc); -- APR_BRIGADE_INSERT_TAIL(input_brigade, e); -- } -- return OK; --} - - static int ap_proxy_http_prefetch(proxy_http_req_t *req, - apr_uri_t *uri, char *url) -@@ -569,14 +395,12 @@ static int ap_proxy_http_prefetch(proxy_http_req_t *req, - apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc; - apr_bucket_brigade *header_brigade = req->header_brigade; - apr_bucket_brigade *input_brigade = req->input_brigade; -- apr_bucket_brigade *temp_brigade; - apr_bucket *e; -- char *buf; - apr_status_t status; -+ char *buf; - apr_off_t bytes_read = 0; - apr_off_t bytes; - int force10, rv; -- apr_read_type_e block; - conn_rec *origin = p_conn->connection; - - if (apr_table_get(r->subprocess_env, "force-proxy-request-1.0")) { -@@ -641,69 +465,12 @@ static int ap_proxy_http_prefetch(proxy_http_req_t *req, - p_conn->close = 1; - } - -- /* Prefetch MAX_MEM_SPOOL bytes -- * -- * This helps us avoid any election of C-L v.s. T-E -- * request bodies, since we are willing to keep in -- * memory this much data, in any case. This gives -- * us an instant C-L election if the body is of some -- * reasonable size. -- */ -- temp_brigade = apr_brigade_create(p, bucket_alloc); -- block = req->prefetch_nonblocking ? APR_NONBLOCK_READ : APR_BLOCK_READ; -- -- /* Account for saved input, if any. */ -- apr_brigade_length(input_brigade, 0, &bytes_read); -- -- /* Ensure we don't hit a wall where we have a buffer too small -- * for ap_get_brigade's filters to fetch us another bucket, -- * surrender once we hit 80 bytes less than MAX_MEM_SPOOL -- * (an arbitrary value). -- */ -- while (bytes_read < MAX_MEM_SPOOL - 80 -- && (APR_BRIGADE_EMPTY(input_brigade) -- || !APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade)))) { -- status = ap_get_brigade(r->input_filters, temp_brigade, -- AP_MODE_READBYTES, block, -- MAX_MEM_SPOOL - bytes_read); -- /* ap_get_brigade may return success with an empty brigade -- * for a non-blocking read which would block -- */ -- if (block == APR_NONBLOCK_READ -- && ((status == APR_SUCCESS && APR_BRIGADE_EMPTY(temp_brigade)) -- || APR_STATUS_IS_EAGAIN(status))) { -- break; -- } -- if (status != APR_SUCCESS) { -- ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01095) -- "prefetch request body failed to %pI (%s)" -- " from %s (%s)", -- p_conn->addr, p_conn->hostname ? p_conn->hostname: "", -- c->client_ip, c->remote_host ? c->remote_host: ""); -- return ap_map_http_request_error(status, HTTP_BAD_REQUEST); -- } -- -- apr_brigade_length(temp_brigade, 1, &bytes); -- bytes_read += bytes; -- -- /* -- * Save temp_brigade in input_brigade. (At least) in the SSL case -- * temp_brigade contains transient buckets whose data would get -- * overwritten during the next call of ap_get_brigade in the loop. -- * ap_save_brigade ensures these buckets to be set aside. -- * Calling ap_save_brigade with NULL as filter is OK, because -- * input_brigade already has been created and does not need to get -- * created by ap_save_brigade. -- */ -- status = ap_save_brigade(NULL, &input_brigade, &temp_brigade, p); -- if (status != APR_SUCCESS) { -- ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01096) -- "processing prefetched request body failed" -- " to %pI (%s) from %s (%s)", -- p_conn->addr, p_conn->hostname ? p_conn->hostname: "", -- c->client_ip, c->remote_host ? c->remote_host: ""); -- return HTTP_INTERNAL_SERVER_ERROR; -- } -+ rv = ap_proxy_prefetch_input(r, req->backend, input_brigade, -+ req->prefetch_nonblocking ? APR_NONBLOCK_READ -+ : APR_BLOCK_READ, -+ &bytes_read, MAX_MEM_SPOOL); -+ if (rv != OK) { -+ return rv; - } - - /* Use chunked request body encoding or send a content-length body? -@@ -772,7 +539,7 @@ static int ap_proxy_http_prefetch(proxy_http_req_t *req, - char *endstr; - status = apr_strtoff(&req->cl_val, req->old_cl_val, &endstr, 10); - if (status != APR_SUCCESS || *endstr || req->cl_val < 0) { -- ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01085) -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01085) - "could not parse request Content-Length (%s)", - req->old_cl_val); - return HTTP_BAD_REQUEST; -@@ -812,7 +579,8 @@ static int ap_proxy_http_prefetch(proxy_http_req_t *req, - /* If we have to spool the body, do it now, before connecting or - * reusing the backend connection. - */ -- rv = spool_reqbody_cl(req, &bytes); -+ rv = ap_proxy_spool_input(r, p_conn, input_brigade, -+ &bytes, MAX_MEM_SPOOL); - if (rv != OK) { - return rv; - } -diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c -index ab88d8f..973aa83 100644 ---- a/modules/proxy/proxy_util.c -+++ b/modules/proxy/proxy_util.c -@@ -3866,6 +3866,268 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, - return OK; - } - -+PROXY_DECLARE(int) ap_proxy_prefetch_input(request_rec *r, -+ proxy_conn_rec *backend, -+ apr_bucket_brigade *input_brigade, -+ apr_read_type_e block, -+ apr_off_t *bytes_read, -+ apr_off_t max_read) -+{ -+ apr_pool_t *p = r->pool; -+ conn_rec *c = r->connection; -+ apr_bucket_brigade *temp_brigade; -+ apr_status_t status; -+ apr_off_t bytes; -+ -+ *bytes_read = 0; -+ if (max_read < APR_BUCKET_BUFF_SIZE) { -+ max_read = APR_BUCKET_BUFF_SIZE; -+ } -+ -+ /* Prefetch max_read bytes -+ * -+ * This helps us avoid any election of C-L v.s. T-E -+ * request bodies, since we are willing to keep in -+ * memory this much data, in any case. This gives -+ * us an instant C-L election if the body is of some -+ * reasonable size. -+ */ -+ temp_brigade = apr_brigade_create(p, input_brigade->bucket_alloc); -+ -+ /* Account for saved input, if any. */ -+ apr_brigade_length(input_brigade, 0, bytes_read); -+ -+ /* Ensure we don't hit a wall where we have a buffer too small for -+ * ap_get_brigade's filters to fetch us another bucket, surrender -+ * once we hit 80 bytes (an arbitrary value) less than max_read. -+ */ -+ while (*bytes_read < max_read - 80 -+ && (APR_BRIGADE_EMPTY(input_brigade) -+ || !APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade)))) { -+ status = ap_get_brigade(r->input_filters, temp_brigade, -+ AP_MODE_READBYTES, block, -+ max_read - *bytes_read); -+ /* ap_get_brigade may return success with an empty brigade -+ * for a non-blocking read which would block -+ */ -+ if (block == APR_NONBLOCK_READ -+ && ((status == APR_SUCCESS && APR_BRIGADE_EMPTY(temp_brigade)) -+ || APR_STATUS_IS_EAGAIN(status))) { -+ break; -+ } -+ if (status != APR_SUCCESS) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01095) -+ "prefetch request body failed to %pI (%s)" -+ " from %s (%s)", backend->addr, -+ backend->hostname ? backend->hostname : "", -+ c->client_ip, c->remote_host ? c->remote_host : ""); -+ return ap_map_http_request_error(status, HTTP_BAD_REQUEST); -+ } -+ -+ apr_brigade_length(temp_brigade, 1, &bytes); -+ *bytes_read += bytes; -+ -+ /* -+ * Save temp_brigade in input_brigade. (At least) in the SSL case -+ * temp_brigade contains transient buckets whose data would get -+ * overwritten during the next call of ap_get_brigade in the loop. -+ * ap_save_brigade ensures these buckets to be set aside. -+ * Calling ap_save_brigade with NULL as filter is OK, because -+ * input_brigade already has been created and does not need to get -+ * created by ap_save_brigade. -+ */ -+ status = ap_save_brigade(NULL, &input_brigade, &temp_brigade, p); -+ if (status != APR_SUCCESS) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01096) -+ "processing prefetched request body failed" -+ " to %pI (%s) from %s (%s)", backend->addr, -+ backend->hostname ? backend->hostname : "", -+ c->client_ip, c->remote_host ? c->remote_host : ""); -+ return HTTP_INTERNAL_SERVER_ERROR; -+ } -+ } -+ -+ return OK; -+} -+ -+PROXY_DECLARE(int) ap_proxy_read_input(request_rec *r, -+ proxy_conn_rec *backend, -+ apr_bucket_brigade *bb, -+ apr_off_t max_read) -+{ -+ apr_bucket_alloc_t *bucket_alloc = bb->bucket_alloc; -+ apr_read_type_e block = (backend->connection) ? APR_NONBLOCK_READ -+ : APR_BLOCK_READ; -+ apr_status_t status; -+ int rv; -+ -+ for (;;) { -+ apr_brigade_cleanup(bb); -+ status = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES, -+ block, max_read); -+ if (block == APR_BLOCK_READ -+ || (!(status == APR_SUCCESS && APR_BRIGADE_EMPTY(bb)) -+ && !APR_STATUS_IS_EAGAIN(status))) { -+ break; -+ } -+ -+ /* Flush and retry (blocking) */ -+ apr_brigade_cleanup(bb); -+ rv = ap_proxy_pass_brigade(bucket_alloc, r, backend, -+ backend->connection, bb, 1); -+ if (rv != OK) { -+ return rv; -+ } -+ block = APR_BLOCK_READ; -+ } -+ -+ if (status != APR_SUCCESS) { -+ conn_rec *c = r->connection; -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02608) -+ "read request body failed to %pI (%s)" -+ " from %s (%s)", backend->addr, -+ backend->hostname ? backend->hostname : "", -+ c->client_ip, c->remote_host ? c->remote_host : ""); -+ return ap_map_http_request_error(status, HTTP_BAD_REQUEST); -+ } -+ -+ return OK; -+} -+ -+PROXY_DECLARE(int) ap_proxy_spool_input(request_rec *r, -+ proxy_conn_rec *backend, -+ apr_bucket_brigade *input_brigade, -+ apr_off_t *bytes_spooled, -+ apr_off_t max_mem_spool) -+{ -+ apr_pool_t *p = r->pool; -+ int seen_eos = 0, rv = OK; -+ apr_status_t status = APR_SUCCESS; -+ apr_bucket_alloc_t *bucket_alloc = input_brigade->bucket_alloc; -+ apr_bucket_brigade *body_brigade; -+ apr_bucket *e; -+ apr_off_t bytes, fsize = 0; -+ apr_file_t *tmpfile = NULL; -+ apr_off_t limit; -+ -+ *bytes_spooled = 0; -+ body_brigade = apr_brigade_create(p, bucket_alloc); -+ -+ limit = ap_get_limit_req_body(r); -+ -+ do { -+ if (APR_BRIGADE_EMPTY(input_brigade)) { -+ rv = ap_proxy_read_input(r, backend, input_brigade, -+ HUGE_STRING_LEN); -+ if (rv != OK) { -+ return rv; -+ } -+ } -+ -+ /* If this brigade contains EOS, either stop or remove it. */ -+ if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) { -+ seen_eos = 1; -+ } -+ -+ apr_brigade_length(input_brigade, 1, &bytes); -+ -+ if (*bytes_spooled + bytes > max_mem_spool) { -+ /* -+ * LimitRequestBody does not affect Proxy requests (Should it?). -+ * Let it take effect if we decide to store the body in a -+ * temporary file on disk. -+ */ -+ if (limit && (*bytes_spooled + bytes > limit)) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01088) -+ "Request body is larger than the configured " -+ "limit of %" APR_OFF_T_FMT, limit); -+ return HTTP_REQUEST_ENTITY_TOO_LARGE; -+ } -+ /* can't spool any more in memory; write latest brigade to disk */ -+ if (tmpfile == NULL) { -+ const char *temp_dir; -+ char *template; -+ -+ status = apr_temp_dir_get(&temp_dir, p); -+ if (status != APR_SUCCESS) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01089) -+ "search for temporary directory failed"); -+ return HTTP_INTERNAL_SERVER_ERROR; -+ } -+ apr_filepath_merge(&template, temp_dir, -+ "modproxy.tmp.XXXXXX", -+ APR_FILEPATH_NATIVE, p); -+ status = apr_file_mktemp(&tmpfile, template, 0, p); -+ if (status != APR_SUCCESS) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01090) -+ "creation of temporary file in directory " -+ "%s failed", temp_dir); -+ return HTTP_INTERNAL_SERVER_ERROR; -+ } -+ } -+ for (e = APR_BRIGADE_FIRST(input_brigade); -+ e != APR_BRIGADE_SENTINEL(input_brigade); -+ e = APR_BUCKET_NEXT(e)) { -+ const char *data; -+ apr_size_t bytes_read, bytes_written; -+ -+ apr_bucket_read(e, &data, &bytes_read, APR_BLOCK_READ); -+ status = apr_file_write_full(tmpfile, data, bytes_read, &bytes_written); -+ if (status != APR_SUCCESS) { -+ const char *tmpfile_name; -+ -+ if (apr_file_name_get(&tmpfile_name, tmpfile) != APR_SUCCESS) { -+ tmpfile_name = "(unknown)"; -+ } -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01091) -+ "write to temporary file %s failed", -+ tmpfile_name); -+ return HTTP_INTERNAL_SERVER_ERROR; -+ } -+ AP_DEBUG_ASSERT(bytes_read == bytes_written); -+ fsize += bytes_written; -+ } -+ apr_brigade_cleanup(input_brigade); -+ } -+ else { -+ -+ /* -+ * Save input_brigade in body_brigade. (At least) in the SSL case -+ * input_brigade contains transient buckets whose data would get -+ * overwritten during the next call of ap_get_brigade in the loop. -+ * ap_save_brigade ensures these buckets to be set aside. -+ * Calling ap_save_brigade with NULL as filter is OK, because -+ * body_brigade already has been created and does not need to get -+ * created by ap_save_brigade. -+ */ -+ status = ap_save_brigade(NULL, &body_brigade, &input_brigade, p); -+ if (status != APR_SUCCESS) { -+ return HTTP_INTERNAL_SERVER_ERROR; -+ } -+ -+ } -+ -+ *bytes_spooled += bytes; -+ } while (!seen_eos); -+ -+ APR_BRIGADE_CONCAT(input_brigade, body_brigade); -+ if (tmpfile) { -+ apr_brigade_insert_file(input_brigade, tmpfile, 0, fsize, p); -+ } -+ if (apr_table_get(r->subprocess_env, "proxy-sendextracrlf")) { -+ e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc); -+ APR_BRIGADE_INSERT_TAIL(input_brigade, e); -+ } -+ if (tmpfile) { -+ /* We dropped metadata buckets when spooling to tmpfile, -+ * terminate with EOS to allow for flushing in a one go. -+ */ -+ e = apr_bucket_eos_create(bucket_alloc); -+ APR_BRIGADE_INSERT_TAIL(input_brigade, e); -+ } -+ return OK; -+} -+ - PROXY_DECLARE(int) ap_proxy_pass_brigade(apr_bucket_alloc_t *bucket_alloc, - request_rec *r, proxy_conn_rec *p_conn, - conn_rec *origin, apr_bucket_brigade *bb, diff --git a/SOURCES/httpd-2.4.37-r1919325.patch b/SOURCES/httpd-2.4.37-r1919325.patch deleted file mode 100644 index 7ec9972..0000000 --- a/SOURCES/httpd-2.4.37-r1919325.patch +++ /dev/null @@ -1,217 +0,0 @@ -diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c -index 114b126..a25c7ae 100644 ---- a/modules/mappers/mod_rewrite.c -+++ b/modules/mappers/mod_rewrite.c -@@ -2343,9 +2343,16 @@ static APR_INLINE char *find_char_in_curlies(char *s, int c) - * of an earlier expansion to include expansion specifiers that - * are interpreted by a later expansion, producing results that - * were not intended by the administrator. -+ * -+ * unsafe_qmark if not NULL will be set to 1 or 0 if a question mark -+ * is found respectively in a literal or in a lookup/expansion (whether -+ * it's the first or last qmark depends on [QSL]). Should be initialized -+ * to -1 and remains so if no qmark is found. - */ --static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry) -+static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry, -+ int *unsafe_qmark) - { -+#define EXPAND_SPECIALS "\\$%" - result_list *result, *current; - result_list sresult[SMALL_EXPANSION]; - unsigned spc = 0; -@@ -2353,8 +2360,29 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry) - char *p, *c; - apr_pool_t *pool = ctx->r->pool; - -- span = strcspn(input, "\\$%"); - inputlen = strlen(input); -+ if (!unsafe_qmark) { -+ span = strcspn(input, EXPAND_SPECIALS); -+ } -+ else { -+ span = strcspn(input, EXPAND_SPECIALS "?"); -+ if (input[span] == '?') { -+ /* this qmark is not from an expansion thus safe */ -+ *unsafe_qmark = 0; -+ -+ /* keep tracking only if interested in the last qmark */ -+ if (entry && (entry->flags & RULEFLAG_QSLAST)) { -+ do { -+ span++; -+ span += strcspn(input + span, EXPAND_SPECIALS "?"); -+ } while (input[span] == '?'); -+ } -+ else { -+ unsafe_qmark = NULL; -+ span += strcspn(input + span, EXPAND_SPECIALS); -+ } -+ } -+ } - - /* fast exit */ - if (inputlen == span) { -@@ -2372,6 +2400,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry) - - /* loop for specials */ - do { -+ int expanded = 0; -+ - /* prepare next entry */ - if (current->len) { - current->next = (spc < SMALL_EXPANSION) -@@ -2417,6 +2447,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry) - current->len = span; - current->string = p; - outlen += span; -+ -+ expanded = 1; - p = endp + 1; - } - -@@ -2456,19 +2488,18 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry) - } - - /* reuse of key variable as result */ -- key = lookup_map(ctx->r, map, do_expand(key, ctx, entry)); -- -+ key = lookup_map(ctx->r, map, do_expand(key, ctx, entry, NULL)); - if (!key && dflt && *dflt) { -- key = do_expand(dflt, ctx, entry); -+ key = do_expand(dflt, ctx, entry, NULL); - } -- -- if (key) { -+ if (key && *key) { - span = strlen(key); - current->len = span; - current->string = key; - outlen += span; - } - -+ expanded = 1; - p = endp + 1; - } - } -@@ -2498,8 +2529,9 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry) - current->len = span; - current->string = bri->source + bri->regmatch[n].rm_so; - } -- - outlen += span; -+ -+ expanded = 1; - } - - p += 2; -@@ -2512,8 +2544,41 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry) - ++outlen; - } - -+ if (unsafe_qmark && expanded && current->len -+ && memchr(current->string, '?', current->len)) { -+ /* this qmark is from an expansion thus unsafe */ -+ *unsafe_qmark = 1; -+ -+ /* keep tracking only if interested in the last qmark */ -+ if (!entry || !(entry->flags & RULEFLAG_QSLAST)) { -+ unsafe_qmark = NULL; -+ } -+ } -+ - /* check the remainder */ -- if (*p && (span = strcspn(p, "\\$%")) > 0) { -+ if (!unsafe_qmark) { -+ span = strcspn(p, EXPAND_SPECIALS); -+ } -+ else { -+ span = strcspn(p, EXPAND_SPECIALS "?"); -+ if (p[span] == '?') { -+ /* this qmark is not from an expansion thus safe */ -+ *unsafe_qmark = 0; -+ -+ /* keep tracking only if interested in the last qmark */ -+ if (entry && (entry->flags & RULEFLAG_QSLAST)) { -+ do { -+ span++; -+ span += strcspn(p + span, EXPAND_SPECIALS "?"); -+ } while (p[span] == '?'); -+ } -+ else { -+ unsafe_qmark = NULL; -+ span += strcspn(p + span, EXPAND_SPECIALS); -+ } -+ } -+ } -+ if (span > 0) { - if (current->len) { - current->next = (spc < SMALL_EXPANSION) - ? &(sresult[spc++]) -@@ -2558,7 +2623,7 @@ static void do_expand_env(data_item *env, rewrite_ctx *ctx) - char *name, *val; - - while (env) { -- name = do_expand(env->data, ctx, NULL); -+ name = do_expand(env->data, ctx, NULL, NULL); - if (*name == '!') { - name++; - apr_table_unset(ctx->r->subprocess_env, name); -@@ -2685,7 +2750,7 @@ static void add_cookie(request_rec *r, char *s) - static void do_expand_cookie(data_item *cookie, rewrite_ctx *ctx) - { - while (cookie) { -- add_cookie(ctx->r, do_expand(cookie->data, ctx, NULL)); -+ add_cookie(ctx->r, do_expand(cookie->data, ctx, NULL, NULL)); - cookie = cookie->next; - } - -@@ -3964,7 +4029,7 @@ static int apply_rewrite_cond(rewritecond_entry *p, rewrite_ctx *ctx) - int basis; - - if (p->ptype != CONDPAT_AP_EXPR) -- input = do_expand(p->input, ctx, NULL); -+ input = do_expand(p->input, ctx, NULL, NULL); - - switch (p->ptype) { - case CONDPAT_FILE_EXISTS: -@@ -4128,7 +4193,7 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p, - char *expanded; - - if (p->forced_mimetype) { -- expanded = do_expand(p->forced_mimetype, ctx, p); -+ expanded = do_expand(p->forced_mimetype, ctx, p, NULL); - - if (*expanded) { - ap_str_tolower(expanded); -@@ -4142,7 +4207,7 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p, - } - - if (p->forced_handler) { -- expanded = do_expand(p->forced_handler, ctx, p); -+ expanded = do_expand(p->forced_handler, ctx, p, NULL); - - if (*expanded) { - ap_str_tolower(expanded); -@@ -4279,12 +4344,18 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p, - - /* expand the result */ - if (!(p->flags & RULEFLAG_NOSUB)) { -- newuri = do_expand(p->output, ctx, p); -+ int unsafe_qmark = -1; -+ -+ if (p->flags & RULEFLAG_UNSAFE_ALLOW3F) { -+ newuri = do_expand(p->output, ctx, p, NULL); -+ } -+ else { -+ newuri = do_expand(p->output, ctx, p, &unsafe_qmark); -+ } - rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri, - newuri)); -- if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) && -- ap_strcasestr(r->unparsed_uri, "%3f") && -- ap_strchr_c(newuri, '?')) { -+ -+ if (unsafe_qmark > 0) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO() - "Unsafe URL with %%3f URL rewritten without " - "UnsafeAllow3F"); diff --git a/SOURCES/httpd-2.4.37-r1922080.patch b/SOURCES/httpd-2.4.37-r1922080.patch deleted file mode 100644 index 6a81fab..0000000 --- a/SOURCES/httpd-2.4.37-r1922080.patch +++ /dev/null @@ -1,64 +0,0 @@ -diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c -index 94ec87e..16ebd98 100644 ---- a/modules/proxy/mod_proxy.c -+++ b/modules/proxy/mod_proxy.c -@@ -1043,6 +1043,7 @@ static int proxy_handler(request_rec *r) - - r->proxyreq = PROXYREQ_REVERSE; - r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); -+ apr_table_setn(r->notes, "proxy-sethandler", "1"); - - /* Still need to fixup/canonicalize r->filename */ - rc = ap_proxy_fixup_uds_filename(r); -@@ -1055,6 +1056,7 @@ static int proxy_handler(request_rec *r) - } - } - else if (r->proxyreq && strncmp(r->filename, "proxy:", 6) == 0) { -+ apr_table_unset(r->notes, "proxy-sethandler"); - rc = OK; - } - if (rc != OK) { -diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c -index f9cf716..fa0b810 100644 ---- a/modules/proxy/mod_proxy_fcgi.c -+++ b/modules/proxy/mod_proxy_fcgi.c -@@ -63,6 +63,8 @@ static int proxy_fcgi_canon(request_rec *r, char *url) - apr_port_t port, def_port; - fcgi_req_config_t *rconf = NULL; - const char *pathinfo_type = NULL; -+ fcgi_dirconf_t *dconf = ap_get_module_config(r->per_dir_config, -+ &proxy_fcgi_module); - - if (ap_cstr_casecmpn(url, "fcgi:", 5) == 0) { - url += 5; -@@ -92,7 +94,29 @@ static int proxy_fcgi_canon(request_rec *r, char *url) - host = apr_pstrcat(r->pool, "[", host, "]", NULL); - } - -- if (apr_table_get(r->notes, "proxy-nocanon")) { -+ if (apr_table_get(r->notes, "proxy-sethandler") -+ || apr_table_get(r->notes, "proxy-nocanon")){ -+ -+ char *c = url; -+ -+ /* We do not call ap_proxy_canonenc_ex() on the path here, don't -+ * let control characters pass still, and for php-fpm no '?' either. -+ */ -+ if (FCGI_MAY_BE_FPM(dconf)) { -+ while (!apr_iscntrl(*c) && *c != '?') -+ c++; -+ } -+ else { -+ while (!apr_iscntrl(*c)) -+ c++; -+ } -+ if (*c) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10414) -+ "To be forwarded path contains control characters%s (%s)", -+ FCGI_MAY_BE_FPM(dconf) ? " or '?'" : "", url); -+ return HTTP_FORBIDDEN; -+ } -+ - path = url; /* this is the raw path */ - } - else { diff --git a/SOURCES/httpd-2.4.37-reply-two-tls-rec.patch b/SOURCES/httpd-2.4.37-reply-two-tls-rec.patch deleted file mode 100644 index a4a3835..0000000 --- a/SOURCES/httpd-2.4.37-reply-two-tls-rec.patch +++ /dev/null @@ -1,188 +0,0 @@ -diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c -index 018b667..4e3875a 100644 ---- a/modules/ssl/ssl_engine_io.c -+++ b/modules/ssl/ssl_engine_io.c -@@ -1598,18 +1598,32 @@ static apr_status_t ssl_io_filter_input(ap_filter_t *f, - } - - --/* ssl_io_filter_output() produces one SSL/TLS message per bucket -+/* ssl_io_filter_output() produces one SSL/TLS record per bucket - * passed down the output filter stack. This results in a high -- * overhead (network packets) for any output comprising many small -- * buckets. SSI page applied through the HTTP chunk filter, for -- * example, may produce many brigades containing small buckets - -- * [chunk-size CRLF] [chunk-data] [CRLF]. -+ * overhead (more network packets & TLS processing) for any output -+ * comprising many small buckets. SSI output passed through the HTTP -+ * chunk filter, for example, may produce many brigades containing -+ * small buckets - [chunk-size CRLF] [chunk-data] [CRLF]. - * -- * The coalescing filter merges many small buckets into larger buckets -- * where possible, allowing the SSL I/O output filter to handle them -- * more efficiently. */ -+ * Sending HTTP response headers as a separate TLS record to the -+ * response body also reveals information to a network observer (the -+ * size of headers) which can be significant. -+ * -+ * The coalescing filter merges data buckets with the aim of producing -+ * fewer, larger TLS records - without copying/buffering all content -+ * and introducing unnecessary overhead. -+ * -+ * ### This buffering could be probably be done more comprehensively -+ * ### in ssl_io_filter_output itself. -+ * -+ * ### Another possible performance optimisation in particular for the -+ * ### [HEAP] [FILE] HTTP response case is using a brigade rather than -+ * ### a char array to buffer; using apr_brigade_write() to append -+ * ### will use already-allocated memory from the HEAP, reducing # of -+ * ### copies. -+ */ - --#define COALESCE_BYTES (2048) -+#define COALESCE_BYTES (AP_IOBUFSIZE) - - struct coalesce_ctx { - char buffer[COALESCE_BYTES]; -@@ -1622,11 +1636,12 @@ static apr_status_t ssl_io_filter_coalesce(ap_filter_t *f, - apr_bucket *e, *upto; - apr_size_t bytes = 0; - struct coalesce_ctx *ctx = f->ctx; -+ apr_size_t buffered = ctx ? ctx->bytes : 0; /* space used on entry */ - unsigned count = 0; - - /* The brigade consists of zero-or-more small data buckets which -- * can be coalesced (the prefix), followed by the remainder of the -- * brigade. -+ * can be coalesced (referred to as the "prefix"), followed by the -+ * remainder of the brigade. - * - * Find the last bucket - if any - of that prefix. count gives - * the number of buckets in the prefix. The "prefix" must contain -@@ -1641,24 +1656,97 @@ static apr_status_t ssl_io_filter_coalesce(ap_filter_t *f, - e != APR_BRIGADE_SENTINEL(bb) - && !APR_BUCKET_IS_METADATA(e) - && e->length != (apr_size_t)-1 -- && e->length < COALESCE_BYTES -- && (bytes + e->length) < COALESCE_BYTES -- && (ctx == NULL -- || bytes + ctx->bytes + e->length < COALESCE_BYTES); -+ && e->length <= COALESCE_BYTES -+ && (buffered + bytes + e->length) <= COALESCE_BYTES; - e = APR_BUCKET_NEXT(e)) { - if (e->length) count++; /* don't count zero-length buckets */ - bytes += e->length; - } -+ -+ /* If there is room remaining and the next bucket is a data -+ * bucket, try to include it in the prefix to coalesce. For a -+ * typical [HEAP] [FILE] HTTP response brigade, this handles -+ * merging the headers and the start of the body into a single TLS -+ * record. */ -+ if (bytes + buffered > 0 -+ && bytes + buffered < COALESCE_BYTES -+ && e != APR_BRIGADE_SENTINEL(bb) -+ && !APR_BUCKET_IS_METADATA(e)) { -+ apr_status_t rv = APR_SUCCESS; -+ -+ /* For an indeterminate length bucket (PIPE/CGI/...), try a -+ * non-blocking read to have it morph into a HEAP. If the -+ * read fails with EAGAIN, it is harmless to try a split -+ * anyway, split is ENOTIMPL for most PIPE-like buckets. */ -+ if (e->length == (apr_size_t)-1) { -+ const char *discard; -+ apr_size_t ignore; -+ -+ rv = apr_bucket_read(e, &discard, &ignore, APR_NONBLOCK_READ); -+ if (rv != APR_SUCCESS && !APR_STATUS_IS_EAGAIN(rv)) { -+ ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, f->c, APLOGNO(10232) -+ "coalesce failed to read from %s bucket", -+ e->type->name); -+ return AP_FILTER_ERROR; -+ } -+ } -+ -+ if (rv == APR_SUCCESS) { -+ /* If the read above made the bucket morph, it may now fit -+ * entirely within the buffer. Otherwise, split it so it does -+ * fit. */ -+ if (e->length > COALESCE_BYTES -+ || e->length + buffered + bytes > COALESCE_BYTES) { -+ rv = apr_bucket_split(e, COALESCE_BYTES - (buffered + bytes)); -+ } -+ -+ if (rv == APR_SUCCESS && e->length == 0) { -+ /* As above, don't count in the prefix if the bucket is -+ * now zero-length. */ -+ } -+ else if (rv == APR_SUCCESS) { -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE4, 0, f->c, -+ "coalesce: adding %" APR_SIZE_T_FMT " bytes " -+ "from split %s bucket, total %" APR_SIZE_T_FMT, -+ e->length, e->type->name, bytes + buffered); -+ -+ count++; -+ bytes += e->length; -+ e = APR_BUCKET_NEXT(e); -+ } -+ else if (rv != APR_ENOTIMPL) { -+ ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, f->c, APLOGNO(10233) -+ "coalesce: failed to split data bucket"); -+ return AP_FILTER_ERROR; -+ } -+ } -+ } -+ -+ /* The prefix is zero or more buckets. upto now points to the -+ * bucket AFTER the end of the prefix, which may be the brigade -+ * sentinel. */ - upto = e; - -- /* Coalesce the prefix, if: -- * a) more than one bucket is found to coalesce, or -- * b) the brigade contains only a single data bucket, or -- * c) the data bucket is not last but we have buffered data already. -+ /* Coalesce the prefix, if any of the following are true: -+ * -+ * a) the prefix is more than one bucket -+ * OR -+ * b) the prefix is the entire brigade, which is a single bucket -+ * AND the prefix length is smaller than the buffer size, -+ * OR -+ * c) the prefix is a single bucket -+ * AND there is buffered data from a previous pass. -+ * -+ * The aim with (b) is to buffer a small bucket so it can be -+ * coalesced with future invocations of this filter. e.g. three -+ * calls each with a single 100 byte HEAP bucket should get -+ * coalesced together. But an invocation with a 8192 byte HEAP -+ * should pass through untouched. - */ - if (bytes > 0 - && (count > 1 -- || (upto == APR_BRIGADE_SENTINEL(bb)) -+ || (upto == APR_BRIGADE_SENTINEL(bb) -+ && bytes < COALESCE_BYTES) - || (ctx && ctx->bytes > 0))) { - /* If coalescing some bytes, ensure a context has been - * created. */ -@@ -1669,7 +1757,8 @@ static apr_status_t ssl_io_filter_coalesce(ap_filter_t *f, - - ap_log_cerror(APLOG_MARK, APLOG_TRACE4, 0, f->c, - "coalesce: have %" APR_SIZE_T_FMT " bytes, " -- "adding %" APR_SIZE_T_FMT " more", ctx->bytes, bytes); -+ "adding %" APR_SIZE_T_FMT " more (buckets=%u)", -+ ctx->bytes, bytes, count); - - /* Iterate through the prefix segment. For non-fatal errors - * in this loop it is safe to break out and fall back to the -@@ -1684,7 +1773,8 @@ static apr_status_t ssl_io_filter_coalesce(ap_filter_t *f, - if (APR_BUCKET_IS_METADATA(e) - || e->length == (apr_size_t)-1) { - ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, f->c, APLOGNO(02012) -- "unexpected bucket type during coalesce"); -+ "unexpected %s bucket during coalesce", -+ e->type->name); - break; /* non-fatal error; break out */ - } - diff --git a/SOURCES/httpd-2.4.37-session-expiry-updt-int.patch b/SOURCES/httpd-2.4.37-session-expiry-updt-int.patch deleted file mode 100644 index 8c5b852..0000000 --- a/SOURCES/httpd-2.4.37-session-expiry-updt-int.patch +++ /dev/null @@ -1,194 +0,0 @@ -diff --git a/docs/manual/mod/mod_session.html.en b/docs/manual/mod/mod_session.html.en -index 6834f8e..9f8301f 100644 ---- a/docs/manual/mod/mod_session.html.en -+++ b/docs/manual/mod/mod_session.html.en -@@ -82,6 +82,7 @@ - <li><img alt="" src="../images/down.gif" /> <a href="#sessionheader">SessionHeader</a></li> - <li><img alt="" src="../images/down.gif" /> <a href="#sessioninclude">SessionInclude</a></li> - <li><img alt="" src="../images/down.gif" /> <a href="#sessionmaxage">SessionMaxAge</a></li> -+<li><img alt="" src="../images/down.gif" /> <a href="#sessionexpiryupdateinterval">SessionExpiryUpdateInterval</a></li> - </ul> - <h3>Bugfix checklist</h3><ul class="seealso"><li><a href="https://www.apache.org/dist/httpd/CHANGES_2.4">httpd changelog</a></li><li><a href="https://bz.apache.org/bugzilla/buglist.cgi?bug_status=__open__&list_id=144532&product=Apache%20httpd-2&query_format=specific&order=changeddate%20DESC%2Cpriority%2Cbug_severity&component=mod_session">Known issues</a></li><li><a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2&component=mod_session">Report a bug</a></li></ul><h3>See also</h3> - <ul class="seealso"> -@@ -482,6 +483,37 @@ AuthName realm - - <p>Setting the maxage to zero disables session expiry.</p> - -+</div> -+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> -+<div class="directive-section"><h2><a name="SessionExpiryUpdateInterval" id="sessionexpiryupdateinterval">SessionExpiryUpdateInterval</a> <a name="sessionexpiryupdateinterval" id="sessionexpiryupdateinterval">Directive</a></h2> -+<table class="directive"> -+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Define the number of seconds a session's expiry may change without the session being updated</td></tr> -+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SessionExpiryUpdateInterval <var>interval</var></code></td></tr> -+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SessionExpiryUpdateInterval 0 (always update)</code></td></tr> -+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr> -+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_session</td></tr> -+</table> -+ <p>The <code class="directive">SessionExpiryUpdateInterval</code> directive allows -+ sessions to avoid the cost associated with writing the session each request -+ when only the expiry time has changed. This can be used to make a website -+ more efficient or reduce load on a database when using -+ <module>mod_session_dbd</module>. The session is always written if the data -+ stored in the session has changed or the expiry has changed by more than the -+ configured interval.</p> -+ -+ <p>Setting the interval to zero disables this directive, and the session -+ expiry is refreshed for each request.</p> -+ -+ <p>This directive only has an effect when combined with <code class="directive"><a href="../mod/mod_session.html#sessionmaxage">SessionMaxAge</a></code> to enable session -+ expiry. Sessions without an expiry are only written when the data stored in -+ the session has changed.</p> -+ -+ <div class="warning"><h3>Warning</h3> -+ <p>Because the session expiry may not be refreshed with each request, it's -+ possible for sessions to expire up to <var>interval</var> seconds early. -+ Using a small interval usually provides sufficient savings while having a -+ minimal effect on expiry resolution.</p></div> -+ - </div> - </div> - <div class="bottomlang"> -diff --git a/modules/session/mod_session.c b/modules/session/mod_session.c -index d517020..10e6396 100644 ---- a/modules/session/mod_session.c -+++ b/modules/session/mod_session.c -@@ -177,6 +177,7 @@ static apr_status_t ap_session_save(request_rec * r, session_rec * z) - { - if (z) { - apr_time_t now = apr_time_now(); -+ apr_time_t initialExpiry = z->expiry; - int rv = 0; - - session_dir_conf *dconf = ap_get_module_config(r->per_dir_config, -@@ -207,6 +208,17 @@ static apr_status_t ap_session_save(request_rec * r, session_rec * z) - z->expiry = now + z->maxage * APR_USEC_PER_SEC; - } - -+ /* don't save if the only change is the expiry by a small amount */ -+ if (!z->dirty && dconf->expiry_update_time -+ && (z->expiry - initialExpiry < dconf->expiry_update_time)) { -+ return APR_SUCCESS; -+ } -+ -+ /* also don't save sessions that didn't change at all */ -+ if (!z->dirty && !z->maxage) { -+ return APR_SUCCESS; -+ } -+ - /* encode the session */ - rv = ap_run_session_encode(r, z); - if (OK != rv) { -@@ -553,6 +565,10 @@ static void *merge_session_dir_config(apr_pool_t * p, void *basev, void *addv) - new->env_set = add->env_set || base->env_set; - new->includes = apr_array_append(p, base->includes, add->includes); - new->excludes = apr_array_append(p, base->excludes, add->excludes); -+ new->expiry_update_time = (add->expiry_update_set == 0) -+ ? base->expiry_update_time -+ : add->expiry_update_time; -+ new->expiry_update_set = add->expiry_update_set || base->expiry_update_set; - - return new; - } -@@ -622,6 +638,21 @@ static const char *add_session_exclude(cmd_parms * cmd, void *dconf, const char - return NULL; - } - -+static const char * -+ set_session_expiry_update(cmd_parms * parms, void *dconf, const char *arg) -+{ -+ session_dir_conf *conf = dconf; -+ -+ conf->expiry_update_time = atoi(arg); -+ if (conf->expiry_update_time < 0) { -+ return "SessionExpiryUpdateInterval must be positive or nul"; -+ } -+ conf->expiry_update_time = apr_time_from_sec(conf->expiry_update_time); -+ conf->expiry_update_set = 1; -+ -+ return NULL; -+} -+ - - static const command_rec session_cmds[] = - { -@@ -637,6 +668,9 @@ static const command_rec session_cmds[] = - "URL prefixes to include in the session. Defaults to all URLs"), - AP_INIT_TAKE1("SessionExclude", add_session_exclude, NULL, RSRC_CONF|OR_AUTHCFG, - "URL prefixes to exclude from the session. Defaults to no URLs"), -+ AP_INIT_TAKE1("SessionExpiryUpdateInterval", set_session_expiry_update, NULL, RSRC_CONF|OR_AUTHCFG, -+ "time interval for which a session's expiry time may change " -+ "without having to be rewritten. Zero to disable"), - {NULL} - }; - -diff --git a/modules/session/mod_session.h b/modules/session/mod_session.h -index a6dd5e9..bdeb532 100644 ---- a/modules/session/mod_session.h -+++ b/modules/session/mod_session.h -@@ -115,6 +115,9 @@ typedef struct { - * URLs included if empty */ - apr_array_header_t *excludes; /* URL prefixes to be excluded. No - * URLs excluded if empty */ -+ apr_time_t expiry_update_time; /* seconds the session expiry may change and -+ * not have to be rewritten */ -+ int expiry_update_set; - } session_dir_conf; - - /** -diff --git a/modules/session/mod_session_cookie.c b/modules/session/mod_session_cookie.c -index 6a02322..4aa75e4 100644 ---- a/modules/session/mod_session_cookie.c -+++ b/modules/session/mod_session_cookie.c -@@ -60,9 +60,6 @@ static apr_status_t session_cookie_save(request_rec * r, session_rec * z) - session_cookie_dir_conf *conf = ap_get_module_config(r->per_dir_config, - &session_cookie_module); - -- /* don't cache auth protected pages */ -- apr_table_addn(r->headers_out, "Cache-Control", "no-cache"); -- - /* create RFC2109 compliant cookie */ - if (conf->name_set) { - if (z->encoded && z->encoded[0]) { -@@ -162,6 +159,9 @@ static apr_status_t session_cookie_load(request_rec * r, session_rec ** z) - /* put the session in the notes so we don't have to parse it again */ - apr_table_setn(m->notes, note, (char *)zz); - -+ /* don't cache auth protected pages */ -+ apr_table_addn(r->headers_out, "Cache-Control", "no-cache, private"); -+ - return OK; - - } -diff --git a/modules/session/mod_session_dbd.c b/modules/session/mod_session_dbd.c -index 0be7306..f683da2 100644 ---- a/modules/session/mod_session_dbd.c -+++ b/modules/session/mod_session_dbd.c -@@ -245,6 +245,9 @@ static apr_status_t session_dbd_load(request_rec * r, session_rec ** z) - /* put the session in the notes so we don't have to parse it again */ - apr_table_setn(m->notes, note, (char *)zz); - -+ /* don't cache pages with a session */ -+ apr_table_addn(r->headers_out, "Cache-Control", "no-cache, private"); -+ - return OK; - - } -@@ -409,9 +412,6 @@ static apr_status_t session_dbd_save(request_rec * r, session_rec * z) - if (conf->name_set || conf->name2_set) { - char *oldkey = NULL, *newkey = NULL; - -- /* don't cache pages with a session */ -- apr_table_addn(r->headers_out, "Cache-Control", "no-cache"); -- - /* if the session is new or changed, make a new session ID */ - if (z->uuid) { - oldkey = apr_pcalloc(r->pool, APR_UUID_FORMATTED_LENGTH + 1); -@@ -458,7 +458,7 @@ static apr_status_t session_dbd_save(request_rec * r, session_rec * z) - else if (conf->peruser) { - - /* don't cache pages with a session */ -- apr_table_addn(r->headers_out, "Cache-Control", "no-cache"); -+ apr_table_addn(r->headers_out, "Cache-Control", "no-cache, private"); - - if (r->user) { - ret = dbd_save(r, r->user, r->user, z->encoded, z->expiry); diff --git a/SOURCES/httpd-2.4.37-ssl-proxy-chains.patch b/SOURCES/httpd-2.4.37-ssl-proxy-chains.patch deleted file mode 100644 index e7ec218..0000000 --- a/SOURCES/httpd-2.4.37-ssl-proxy-chains.patch +++ /dev/null @@ -1,101 +0,0 @@ -diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c -index 8b6c34f..3587fb5 100644 ---- a/modules/ssl/ssl_engine_init.c -+++ b/modules/ssl/ssl_engine_init.c -@@ -1609,6 +1609,10 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s, - STACK_OF(X509) *chain; - X509_STORE_CTX *sctx; - X509_STORE *store = SSL_CTX_get_cert_store(mctx->ssl_ctx); -+ int addl_chain = 0; /* non-zero if additional chain certs were -+ * added to store */ -+ -+ ap_assert(store != NULL); /* safe to assume always non-NULL? */ - - #if OPENSSL_VERSION_NUMBER >= 0x1010100fL - /* For OpenSSL >=1.1.1, turn on client cert support which is -@@ -1653,20 +1657,28 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s, - } - } - -- if ((ncerts = sk_X509_INFO_num(sk)) <= 0) { -- sk_X509_INFO_free(sk); -- ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(02206) -- "no client certs found for SSL proxy"); -- return APR_SUCCESS; -- } -- - /* Check that all client certs have got certificates and private -- * keys. */ -- for (n = 0; n < ncerts; n++) { -+ * keys. Note the number of certs in the stack may decrease -+ * during the loop. */ -+ for (n = 0; n < sk_X509_INFO_num(sk); n++) { - X509_INFO *inf = sk_X509_INFO_value(sk, n); -+ int has_privkey = inf->x_pkey && inf->x_pkey->dec_pkey; -+ -+ /* For a lone certificate in the file, trust it as a -+ * CA/intermediate certificate. */ -+ if (inf->x509 && !has_privkey && !inf->enc_data) { -+ ssl_log_xerror(SSLLOG_MARK, APLOG_DEBUG, 0, ptemp, s, inf->x509, -+ APLOGNO(10261) "Trusting non-leaf certificate"); -+ X509_STORE_add_cert(store, inf->x509); /* increments inf->x509 */ -+ /* Delete from the stack and iterate again. */ -+ X509_INFO_free(inf); -+ sk_X509_INFO_delete(sk, n); -+ n--; -+ addl_chain = 1; -+ continue; -+ } - -- if (!inf->x509 || !inf->x_pkey || !inf->x_pkey->dec_pkey || -- inf->enc_data) { -+ if (!has_privkey || inf->enc_data) { - sk_X509_INFO_free(sk); - ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s, APLOGNO(02252) - "incomplete client cert configured for SSL proxy " -@@ -1683,13 +1695,21 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s, - } - } - -+ if ((ncerts = sk_X509_INFO_num(sk)) <= 0) { -+ sk_X509_INFO_free(sk); -+ ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(02206) -+ "no client certs found for SSL proxy"); -+ return APR_SUCCESS; -+ } -+ - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02207) - "loaded %d client certs for SSL proxy", - ncerts); - pkp->certs = sk; - -- -- if (!pkp->ca_cert_file || !store) { -+ /* If any chain certs are configured, build the ->ca_certs chains -+ * corresponding to the loaded keypairs. */ -+ if (!pkp->ca_cert_file && !addl_chain) { - return APR_SUCCESS; - } - -diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h -index 2a08d1c..8055200 100644 ---- a/modules/ssl/ssl_private.h -+++ b/modules/ssl/ssl_private.h -@@ -655,10 +655,13 @@ typedef struct { - const char *cert_file; - const char *cert_path; - const char *ca_cert_file; -- STACK_OF(X509_INFO) *certs; /* Contains End Entity certs */ -- STACK_OF(X509) **ca_certs; /* Contains ONLY chain certs for -- * each item in certs. -- * (ptr to array of ptrs) */ -+ /* certs is a stack of configured cert, key pairs. */ -+ STACK_OF(X509_INFO) *certs; -+ /* ca_certs contains ONLY chain certs for each item in certs. -+ * ca_certs[n] is a pointer to the (STACK_OF(X509) *) stack which -+ * holds the cert chain for the 'n'th cert in the certs stack, or -+ * NULL if no chain is configured. */ -+ STACK_OF(X509) **ca_certs; - } modssl_pk_proxy_t; - - /** stuff related to authentication that can also be per-dir */ diff --git a/SOURCES/httpd-2.4.37-sslkeylogfile-support.patch b/SOURCES/httpd-2.4.37-sslkeylogfile-support.patch deleted file mode 100644 index 9d4cc19..0000000 --- a/SOURCES/httpd-2.4.37-sslkeylogfile-support.patch +++ /dev/null @@ -1,123 +0,0 @@ -diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c -index 1d201d9..0c4bf1f 100644 ---- a/modules/ssl/ssl_engine_config.c -+++ b/modules/ssl/ssl_engine_config.c -@@ -75,6 +75,10 @@ SSLModConfigRec *ssl_config_global_create(server_rec *s) - mc->stapling_refresh_mutex = NULL; - #endif - -+#ifdef HAVE_OPENSSL_KEYLOG -+ mc->keylog_file = NULL; -+#endif -+ - apr_pool_userdata_set(mc, SSL_MOD_CONFIG_KEY, - apr_pool_cleanup_null, - pool); -diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c -index ef631c1..b286053 100644 ---- a/modules/ssl/ssl_engine_init.c -+++ b/modules/ssl/ssl_engine_init.c -@@ -437,6 +437,28 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog, - init_bio_methods(); - #endif - -+#ifdef HAVE_OPENSSL_KEYLOG -+ { -+ const char *logfn = getenv("SSLKEYLOGFILE"); -+ -+ if (logfn) { -+ rv = apr_file_open(&mc->keylog_file, logfn, -+ APR_FOPEN_CREATE|APR_FOPEN_WRITE|APR_FOPEN_APPEND|APR_FOPEN_LARGEFILE, -+ APR_FPROT_UREAD|APR_FPROT_UWRITE, -+ mc->pPool); -+ if (rv) { -+ ap_log_error(APLOG_MARK, APLOG_NOTICE, rv, s, APLOGNO(10226) -+ "Could not open log file '%s' configured via SSLKEYLOGFILE", -+ logfn); -+ return rv; -+ } -+ -+ ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, s, APLOGNO(10227) -+ "Init: Logging SSL private key material to %s", logfn); -+ } -+ } -+#endif -+ - return OK; - } - -@@ -796,6 +818,12 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, - * https://github.com/openssl/openssl/issues/7178 */ - SSL_CTX_clear_mode(ctx, SSL_MODE_AUTO_RETRY); - #endif -+ -+#ifdef HAVE_OPENSSL_KEYLOG -+ if (mctx->sc->mc->keylog_file) { -+ SSL_CTX_set_keylog_callback(ctx, modssl_callback_keylog); -+ } -+#endif - - return APR_SUCCESS; - } -diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c -index 6611610..7058865 100644 ---- a/modules/ssl/ssl_engine_kernel.c -+++ b/modules/ssl/ssl_engine_kernel.c -@@ -2719,3 +2719,17 @@ int ssl_callback_SRPServerParams(SSL *ssl, int *ad, void *arg) - } - - #endif /* HAVE_SRP */ -+ -+ -+#ifdef HAVE_OPENSSL_KEYLOG -+/* Callback used with SSL_CTX_set_keylog_callback. */ -+void modssl_callback_keylog(const SSL *ssl, const char *line) -+{ -+ conn_rec *conn = SSL_get_app_data(ssl); -+ SSLSrvConfigRec *sc = mySrvConfig(conn->base_server); -+ -+ if (sc && sc->mc->keylog_file) { -+ apr_file_printf(sc->mc->keylog_file, "%s\n", line); -+ } -+} -+#endif -diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h -index 0fac5d1..2514407 100644 ---- a/modules/ssl/ssl_private.h -+++ b/modules/ssl/ssl_private.h -@@ -250,6 +250,10 @@ void free_bio_methods(void); - #endif - #endif - -+#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) -+#define HAVE_OPENSSL_KEYLOG -+#endif -+ - /* mod_ssl headers */ - #include "ssl_util_ssl.h" - -@@ -617,6 +621,12 @@ typedef struct { - apr_global_mutex_t *stapling_cache_mutex; - apr_global_mutex_t *stapling_refresh_mutex; - #endif -+ -+#ifdef HAVE_OPENSSL_KEYLOG -+ /* Used for logging if SSLKEYLOGFILE is set at startup. */ -+ apr_file_t *keylog_file; -+#endif -+ - } SSLModConfigRec; - - /** Structure representing configured filenames for certs and keys for -@@ -970,6 +980,11 @@ int ssl_stapling_init_cert(server_rec *, apr_pool_t *, apr_pool_t *, - int ssl_callback_SRPServerParams(SSL *, int *, void *); - #endif - -+#ifdef HAVE_OPENSSL_KEYLOG -+/* Callback used with SSL_CTX_set_keylog_callback. */ -+void modssl_callback_keylog(const SSL *ssl, const char *line); -+#endif -+ - /** I/O */ - void ssl_io_filter_init(conn_rec *, request_rec *r, SSL *); - void ssl_io_filter_register(apr_pool_t *); diff --git a/SOURCES/httpd-2.4.37-usertrack-samesite.patch b/SOURCES/httpd-2.4.37-usertrack-samesite.patch deleted file mode 100644 index 592616e..0000000 --- a/SOURCES/httpd-2.4.37-usertrack-samesite.patch +++ /dev/null @@ -1,178 +0,0 @@ -diff --git a/docs/manual/mod/mod_usertrack.html.en b/docs/manual/mod/mod_usertrack.html.en -index b212747..d2da9b9 100644 ---- a/docs/manual/mod/mod_usertrack.html.en -+++ b/docs/manual/mod/mod_usertrack.html.en -@@ -47,7 +47,10 @@ - <ul id="toc"> - <li><img alt="" src="../images/down.gif" /> <a href="#cookiedomain">CookieDomain</a></li> - <li><img alt="" src="../images/down.gif" /> <a href="#cookieexpires">CookieExpires</a></li> -+<li><img alt="" src="../images/down.gif" /> <a href="#cookiehttponly">CookieHTTPOnly</a></li> - <li><img alt="" src="../images/down.gif" /> <a href="#cookiename">CookieName</a></li> -+<li><img alt="" src="../images/down.gif" /> <a href="#cookiesamesite">CookieSameSite</a></li> -+<li><img alt="" src="../images/down.gif" /> <a href="#cookiesecure">CookieSecure</a></li> - <li><img alt="" src="../images/down.gif" /> <a href="#cookiestyle">CookieStyle</a></li> - <li><img alt="" src="../images/down.gif" /> <a href="#cookietracking">CookieTracking</a></li> - </ul> -@@ -127,6 +130,22 @@ CustomLog "logs/clickstream.log" usertrack</pre> - <pre class="prettyprint lang-config">CookieExpires "3 weeks"</pre> - - -+</div> -+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> -+<div class="directive-section"><h2><a name="CookieHTTPOnly" id="CookieHTTPOnly">CookieHTTPOnly</a> <a name="cookiehttponly" id="cookiehttponly">Directive</a></h2> -+<table class="directive"> -+<tbody><tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Adds the 'HTTPOnly' attribute to the cookie</td></tr> -+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>CookieHTTPOnly on|off</code></td></tr> -+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>CookieHTTPOnly off</code></td></tr> -+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr> -+<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>FileInfo</td></tr> -+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> -+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_usertrack</td></tr> -+</tbody></table> -+ <p>When set to 'ON', the 'HTTPOnly' cookie attribute is added to this -+ modules tracking cookie. This attribute instructs browsers to block javascript -+ from reading the value of the cookie.</p> -+ - </div> - <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> - <div class="directive-section"><h2><a name="CookieName" id="CookieName">CookieName</a> <a name="cookiename" id="cookiename">Directive</a></h2> -@@ -150,6 +169,45 @@ CustomLog "logs/clickstream.log" usertrack</pre> - <pre class="prettyprint lang-config">CookieName clicktrack</pre> - - -+</div> -+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> -+<div class="directive-section"><h2><a name="CookieSameSite" id="CookieSameSite">CookieSameSite</a> <a name="cookiesamesite" id="cookiesamesite">Directive</a></h2> -+<table class="directive"> -+<tbody><tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Adds the 'SameSite' attribute to the cookie</td></tr> -+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>CookieSameSite None|Lax|Strict</code></td></tr> -+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>unset</code></td></tr> -+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr> -+<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>FileInfo</td></tr> -+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> -+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_usertrack</td></tr> -+</tbody></table> -+ <p>When set to 'None', 'Lax', or 'Strict', the 'SameSite' cookie attribute -+ is added to this modules tracking cookie with the corresponding value. -+ This attribute instructs browser on how to treat the cookie when it is -+ requested in a cross-site context.</p> -+ -+ <div class="note"> -+ <p>A value of 'None' sets 'SameSite=None', which is the most liberal setting. To -+ omit this attribute, omit the directive entirely.</p> -+ </div> -+ -+ -+</div> -+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> -+<div class="directive-section"><h2><a name="CookieSecure" id="CookieSecure">CookieSecure</a> <a name="cookiesecure" id="cookiesecure">Directive</a></h2> -+<table class="directive"> -+<tbody><tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Adds the 'Secure' attribute to the cookie</td></tr> -+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>CookieSecure on|off</code></td></tr> -+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>CookieSecure off</code></td></tr> -+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr> -+<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>FileInfo</td></tr> -+<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> -+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_usertrack</td></tr> -+</tbody></table> -+ <p>When set to 'ON', the 'Secure' cookie attribute is added to this -+ modules tracking cookie. This attribute instructs browsers to only -+ transmit the cookie over HTTPS.</p> -+ - </div> - <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> - <div class="directive-section"><h2><a name="CookieStyle" id="CookieStyle">CookieStyle</a> <a name="cookiestyle" id="cookiestyle">Directive</a></h2> -diff --git a/modules/metadata/mod_usertrack.c b/modules/metadata/mod_usertrack.c -index 73a9f45..65759c2 100644 ---- a/modules/metadata/mod_usertrack.c -+++ b/modules/metadata/mod_usertrack.c -@@ -86,6 +86,9 @@ typedef struct { - const char *cookie_domain; - char *regexp_string; /* used to compile regexp; save for debugging */ - ap_regex_t *regexp; /* used to find usertrack cookie in cookie header */ -+ int is_secure; -+ int is_httponly; -+ const char *samesite; - } cookie_dir_rec; - - /* Make Cookie: Now we have to generate something that is going to be -@@ -143,6 +146,21 @@ static void make_cookie(request_rec *r) - : ""), - NULL); - } -+ if (dcfg->samesite != NULL) { -+ new_cookie = apr_pstrcat(r->pool, new_cookie, "; ", -+ dcfg->samesite, -+ NULL); -+ } -+ if (dcfg->is_secure) { -+ new_cookie = apr_pstrcat(r->pool, new_cookie, "; Secure", -+ NULL); -+ } -+ if (dcfg->is_httponly) { -+ new_cookie = apr_pstrcat(r->pool, new_cookie, "; HttpOnly", -+ NULL); -+ } -+ -+ - - apr_table_addn(r->err_headers_out, - (dcfg->style == CT_COOKIE2 ? "Set-Cookie2" : "Set-Cookie"), -@@ -269,6 +287,7 @@ static void *make_cookie_dir(apr_pool_t *p, char *d) - dcfg->cookie_domain = NULL; - dcfg->style = CT_UNSET; - dcfg->enabled = 0; -+ /* calloc'ed to disabled: samesite, is_secure, is_httponly */ - - /* In case the user does not use the CookieName directive, - * we need to compile the regexp for the default cookie name. */ -@@ -429,6 +448,31 @@ static const char *set_cookie_style(cmd_parms *cmd, void *mconfig, - return NULL; - } - -+/* -+ * SameSite enabled disabled -+ */ -+ -+static const char *set_samesite_value(cmd_parms *cmd, void *mconfig, -+ const char *name) -+{ -+ cookie_dir_rec *dcfg; -+ -+ dcfg = (cookie_dir_rec *) mconfig; -+ -+ if (strcasecmp(name, "strict") == 0) { -+ dcfg->samesite = "SameSite=Strict"; -+ } else if (strcasecmp(name, "lax") == 0) { -+ dcfg->samesite = "SameSite=Lax"; -+ } else if (strcasecmp(name, "none") == 0) { -+ dcfg->samesite = "SameSite=None"; -+ } else { -+ return "CookieSameSite accepts 'Strict', 'Lax', or 'None'"; -+ } -+ -+ -+ return NULL; -+} -+ - static const command_rec cookie_log_cmds[] = { - AP_INIT_TAKE1("CookieExpires", set_cookie_exp, NULL, OR_FILEINFO, - "an expiry date code"), -@@ -440,6 +484,17 @@ static const command_rec cookie_log_cmds[] = { - "whether or not to enable cookies"), - AP_INIT_TAKE1("CookieName", set_cookie_name, NULL, OR_FILEINFO, - "name of the tracking cookie"), -+ AP_INIT_FLAG("CookieTracking", set_cookie_enable, NULL, OR_FILEINFO, -+ "whether or not to enable cookies"), -+ AP_INIT_TAKE1("CookieSameSite", set_samesite_value, NULL, OR_FILEINFO, -+ "SameSite setting"), -+ AP_INIT_FLAG("CookieSecure", ap_set_flag_slot, -+ (void *)APR_OFFSETOF(cookie_dir_rec, is_secure), OR_FILEINFO, -+ "is cookie secure"), -+ AP_INIT_FLAG("CookieHttpOnly", ap_set_flag_slot, -+ (void *)APR_OFFSETOF(cookie_dir_rec, is_httponly),OR_FILEINFO, -+ "is cookie http only"), -+ - {NULL} - }; - diff --git a/SOURCES/httpd-2.4.57-r1884505+.patch b/SOURCES/httpd-2.4.57-r1884505+.patch deleted file mode 100644 index 97bc6a8..0000000 --- a/SOURCES/httpd-2.4.57-r1884505+.patch +++ /dev/null @@ -1,39 +0,0 @@ -# ./pullrev.sh 1884505 1915625 -http://svn.apache.org/viewvc?view=revision&revision=1884505 -http://svn.apache.org/viewvc?view=revision&revision=1915625 - ---- httpd-2.4.57/modules/filters/mod_xml2enc.c -+++ httpd-2.4.57/modules/filters/mod_xml2enc.c -@@ -329,7 +329,7 @@ - apr_bucket* bstart; - apr_size_t insz = 0; - int pending_meta = 0; -- char *ctype; -+ char *mtype; - char *p; - - if (!ctx || !f->r->content_type) { -@@ -338,13 +338,17 @@ - return ap_pass_brigade(f->next, bb) ; - } - -- ctype = apr_pstrdup(f->r->pool, f->r->content_type); -- for (p = ctype; *p; ++p) -- if (isupper(*p)) -- *p = tolower(*p); -+ /* Extract the media type, ignoring parameters in content-type. */ -+ mtype = apr_pstrdup(f->r->pool, f->r->content_type); -+ if ((p = ap_strchr(mtype, ';')) != NULL) *p = '\0'; -+ ap_str_tolower(mtype); - -- /* only act if starts-with "text/" or contains "xml" */ -- if (strncmp(ctype, "text/", 5) && !strstr(ctype, "xml")) { -+ /* Accept text/ types, plus any XML media type per RFC 7303. */ -+ if (!(strncmp(mtype, "text/", 5) == 0 -+ || strcmp(mtype, "application/xml") == 0 -+ || (strlen(mtype) > 7 /* minimum 'a/b+xml' length */ -+ && (p = strstr(mtype, "+xml")) != NULL -+ && strlen(p) == 4 /* ensures +xml is a suffix */))) { - ap_remove_output_filter(f); - return ap_pass_brigade(f->next, bb) ; - } diff --git a/action-configtest.sh b/action-configtest.sh new file mode 100644 index 0000000..711d9cd --- /dev/null +++ b/action-configtest.sh @@ -0,0 +1,2 @@ +#!/bin/sh +exec /usr/sbin/httpd -t diff --git a/action-graceful.sh b/action-graceful.sh new file mode 100644 index 0000000..4976087 --- /dev/null +++ b/action-graceful.sh @@ -0,0 +1,2 @@ +#!/bin/sh +exec /sbin/apachectl graceful diff --git a/apachectl.sh b/apachectl.sh new file mode 100755 index 0000000..823db3b --- /dev/null +++ b/apachectl.sh @@ -0,0 +1,74 @@ +#!/usr/bin/sh +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +### +### NOTE: This is a replacement version of the "apachectl" script with +### some differences in behaviour to the version distributed with +### Apache httpd. Please read the apachectl(8) man page for more +### information. +### + +if [ "x$1" = "x-k" ]; then + shift +fi + +ACMD="$1" +ARGV="$@" +SVC='httpd.service' +HTTPD='@HTTPDBIN@' + +if [ "x$2" != "x" ] ; then + echo Passing arguments to httpd using apachectl is no longer supported. + echo You can only start/stop/restart httpd using this script. + echo To pass extra arguments to httpd, see the $SVC'(8)' + echo man page. + exit 1 +fi + +case $ACMD in +start|stop|restart|status) + /usr/bin/systemctl --no-pager $ACMD $SVC + ERROR=$? + ;; +graceful) + if /usr/bin/systemctl -q is-active $SVC; then + /usr/bin/systemctl kill --signal=SIGUSR1 --kill-who=main $SVC + else + /usr/bin/systemctl start $SVC + fi + ERROR=$? + ;; +graceful-stop) + /usr/bin/systemctl kill --signal=SIGWINCH --kill-who=main $SVC + ERROR=$? + ;; +configtest|-t) + $HTTPD -t + ERROR=$? + ;; +-v|-V) + $HTTPD $ACMD + ERROR=$? + ;; +*) + echo apachectl: The \"$ACMD\" option is not supported. 1>&2 + ERROR=2 + ;; +esac + +exit $ERROR + diff --git a/apachectl.xml b/apachectl.xml new file mode 100644 index 0000000..fb3a86d --- /dev/null +++ b/apachectl.xml @@ -0,0 +1,192 @@ +<?xml version='1.0' encoding='UTF-8' ?> +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN" + "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">[ + +]> +<!-- + Copyright 2020 Red Hat, Inc. + Copyright 2018 Frank Dana + + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +--> +<refentry> + <refentryinfo> + <title>apachectl + httpd + Apache man pageApache Software Foundation contributors + Fedora man pageDanaFrank + + + + apachectl + 8 + + + + apachectl + Server control interface for httpd + + + + + apachectl + command + + + + + + + Description + + apachectl is a front end to the Apache HyperText + Transfer Protocol (HTTP) server. It is designed to help the + administrator control the functioning of the Apache + httpd daemon. + + The apachectl script takes one-word arguments like + , + , and + , and translates them + into appropriate signals to httpd. + + The apachectl script returns a 0 exit value on + success, and >0 if an error occurs. + + + Compatibility + + The version of apachectl used on this + system is a replacement script intended to be mostly (but not + completely) compatible with the version provided with + Apache httpd. This + apachectl mostly acts as a wrapper around + systemctl and manipulates the + systemd service for httpd. + The interface to the Apache version of + apachectl is described at . + + The following differences are present in the version of + apachectl present on this system: + + + Option arguments passed when starting + httpd are not allowed. These should be + configured in the systemd service directly (see httpd.service8). + + The "fullstatus" option is + not available. + + The "status" option does + not use or rely on the running server's + server-status output. + + + + + + + + Options + + + + + Start the Apache httpd daemon. Gives an error if it + is already running. This is equivalent to systemctl start httpd.service. + + + + + + + Stops the Apache httpd daemon. This is equivalent to + systemctl stop httpd.service. + + + + + + + Restarts the Apache httpd daemon. If the daemon is + not running, it is started. This is equivalent + to systemctl restart httpd.service. + + + + + + + Displays a brief status report. This is equivalent to systemctl status httpd.service. + + + + + + + Gracefully restarts the Apache httpd daemon. If the + daemon is not running, it is started. This differs from a normal + restart in that currently open connections are not aborted. A side + effect is that old log files will not be closed immediately. This + means that if used in a log rotation script, a substantial delay may + be necessary to ensure that the old log files are closed before + processing them. This is equivalent to + systemctl kill --signal=SIGUSR1 --kill-who=main httpd.service. + + + + + + + Gracefully stops the Apache httpd daemon. + This differs from a normal stop in that currently open connections are not + aborted. A side effect is that old log files will not be closed immediately. + This is equivalent to + systemctl kill --signal=SIGWINCH --kill-who=main httpd.service. + + + + + | + + Run a configuration file syntax test. It parses the configuration + files and either reports Syntax OK + or detailed information about the particular syntax error. This is + equivalent to httpd -t. + + + + + + + Bugs + Please report bugs by filing an issue in @BUG_REPORT_URL@. + + + + See also + + + httpd8, + httpd.conf5, + systemd1, + systemctl1, + httpd.service8 + + + + diff --git a/SOURCES/config.layout b/config.layout similarity index 100% rename from SOURCES/config.layout rename to config.layout diff --git a/SOURCES/htcacheclean.service b/htcacheclean.service similarity index 83% rename from SOURCES/htcacheclean.service rename to htcacheclean.service index d1e9d60..e3eeef9 100644 --- a/SOURCES/htcacheclean.service +++ b/htcacheclean.service @@ -7,5 +7,10 @@ Documentation=man:htcacheclean.service(8) Type=forking User=apache PIDFile=/run/httpd/htcacheclean/pid +Environment=LANG=C EnvironmentFile=/etc/sysconfig/htcacheclean ExecStart=/usr/sbin/htcacheclean -P /run/httpd/htcacheclean/pid -d $INTERVAL -p $CACHE_ROOT -l $LIMIT $OPTIONS +PrivateTmp=true + +[Install] +WantedBy=multi-user.target diff --git a/SOURCES/htcacheclean.service.xml b/htcacheclean.service.xml similarity index 100% rename from SOURCES/htcacheclean.service.xml rename to htcacheclean.service.xml diff --git a/SOURCES/htcacheclean.sysconf b/htcacheclean.sysconf similarity index 100% rename from SOURCES/htcacheclean.sysconf rename to htcacheclean.sysconf diff --git a/SOURCES/httpd-2.4.28-apxs.patch b/httpd-2.4.43-apxs.patch similarity index 84% rename from SOURCES/httpd-2.4.28-apxs.patch rename to httpd-2.4.43-apxs.patch index 7016dec..808d6a8 100644 --- a/SOURCES/httpd-2.4.28-apxs.patch +++ b/httpd-2.4.43-apxs.patch @@ -1,8 +1,11 @@ + +Upstream-Status: local customisation + diff --git a/support/apxs.in b/support/apxs.in -index ad1287f..efcfcf6 100644 +index b2705fa..c331631 100644 --- a/support/apxs.in +++ b/support/apxs.in -@@ -25,7 +25,18 @@ package apxs; +@@ -35,7 +35,18 @@ if ($ddi >= 0) { my %config_vars = (); @@ -19,10 +22,10 @@ index ad1287f..efcfcf6 100644 + +my $installbuilddir = $libdir . "/httpd/build"; + - get_config_vars("$installbuilddir/config_vars.mk",\%config_vars); + get_config_vars($destdir . "$installbuilddir/config_vars.mk",\%config_vars); # read the configuration variables once -@@ -275,7 +286,7 @@ if ($opt_g) { +@@ -285,7 +296,7 @@ if ($opt_g) { $data =~ s|%NAME%|$name|sg; $data =~ s|%TARGET%|$CFG_TARGET|sg; $data =~ s|%PREFIX%|$prefix|sg; @@ -31,7 +34,7 @@ index ad1287f..efcfcf6 100644 my ($mkf, $mods, $src) = ($data =~ m|^(.+)-=#=-\n(.+)-=#=-\n(.+)|s); -@@ -453,11 +464,11 @@ if ($opt_c) { +@@ -463,11 +474,11 @@ if ($opt_c) { my $ldflags = "$CFG_LDFLAGS"; if ($opt_p == 1) { @@ -45,7 +48,7 @@ index ad1287f..efcfcf6 100644 chomp($apu_libs); } -@@ -672,8 +683,8 @@ __DATA__ +@@ -682,8 +693,8 @@ __DATA__ builddir=. top_srcdir=%PREFIX% diff --git a/SOURCES/httpd-2.4.35-cachehardmax.patch b/httpd-2.4.43-cachehardmax.patch similarity index 99% rename from SOURCES/httpd-2.4.35-cachehardmax.patch rename to httpd-2.4.43-cachehardmax.patch index 5051099..755f822 100644 --- a/SOURCES/httpd-2.4.35-cachehardmax.patch +++ b/httpd-2.4.43-cachehardmax.patch @@ -13,7 +13,7 @@ index 6b92151..4c42a8e 100644 /* A linked-list of authn providers. */ diff --git a/modules/cache/mod_cache.c b/modules/cache/mod_cache.c -index 56a09f5..41015b5 100644 +index 3b9aa4f..8268503 100644 --- a/modules/cache/mod_cache.c +++ b/modules/cache/mod_cache.c @@ -1455,6 +1455,11 @@ static apr_status_t cache_save_filter(ap_filter_t *f, apr_bucket_brigade *in) diff --git a/SOURCES/httpd-2.4.35-corelimit.patch b/httpd-2.4.43-corelimit.patch similarity index 77% rename from SOURCES/httpd-2.4.35-corelimit.patch rename to httpd-2.4.43-corelimit.patch index 22768d4..8c9899c 100644 --- a/SOURCES/httpd-2.4.35-corelimit.patch +++ b/httpd-2.4.43-corelimit.patch @@ -1,15 +1,11 @@ -Bump up the core size limit if CoreDumpDirectory is -configured. - -Upstream-Status: Was discussed but there are competing desires; - there are portability oddities here too. +Upstream-Status: local customisation diff --git a/server/core.c b/server/core.c -index aa62e15..ec74029 100644 +index 79b2a82..dc0f17a 100644 --- a/server/core.c +++ b/server/core.c -@@ -4952,6 +4952,25 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte +@@ -4996,6 +4996,25 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte } apr_pool_cleanup_register(pconf, NULL, ap_mpm_end_gen_helper, apr_pool_cleanup_null); diff --git a/SOURCES/httpd-2.4.35-deplibs.patch b/httpd-2.4.43-deplibs.patch similarity index 78% rename from SOURCES/httpd-2.4.35-deplibs.patch rename to httpd-2.4.43-deplibs.patch index f7bc129..c60f5a5 100644 --- a/SOURCES/httpd-2.4.35-deplibs.patch +++ b/httpd-2.4.43-deplibs.patch @@ -1,13 +1,8 @@ - -Link straight against .la files. - -Upstream-Status: vendor specific - diff --git a/configure.in b/configure.in -index 9feaceb..82bfeef 100644 +index f8f9442..f276550 100644 --- a/configure.in +++ b/configure.in -@@ -784,9 +784,9 @@ APACHE_SUBST(INSTALL_SUEXEC) +@@ -786,9 +786,9 @@ APACHE_SUBST(INSTALL_SUEXEC) dnl APR should go after the other libs, so the right symbols can be picked up if test x${apu_found} != xobsolete; then diff --git a/httpd-2.4.43-enable-sslv3.patch b/httpd-2.4.43-enable-sslv3.patch new file mode 100644 index 0000000..2861605 --- /dev/null +++ b/httpd-2.4.43-enable-sslv3.patch @@ -0,0 +1,62 @@ +diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c +index 979489c..3d6443b 100644 +--- a/modules/ssl/ssl_engine_config.c ++++ b/modules/ssl/ssl_engine_config.c +@@ -1485,6 +1485,10 @@ static const char *ssl_cmd_protocol_parse(cmd_parms *parms, + #endif + else if (strcEQ(w, "all")) { + thisopt = SSL_PROTOCOL_ALL; ++#ifndef OPENSSL_NO_SSL3 ++ /* by default, ALL kw doesn't turn on SSLv3 */ ++ thisopt &= ~SSL_PROTOCOL_SSLV3; ++#endif + } + else { + return apr_pstrcat(parms->temp_pool, +diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c +index b0fcf81..ab6f263 100644 +--- a/modules/ssl/ssl_engine_init.c ++++ b/modules/ssl/ssl_engine_init.c +@@ -568,6 +568,28 @@ static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s, + } + #endif + ++/* ++ * Enable/disable SSLProtocol. If the mod_ssl enables protocol ++ * which is disabled by default by OpenSSL, show a warning. ++ * "option" is for example SSL_OP_NO_SSLv3. ++ */ ++static void ssl_set_ctx_protocol_option(server_rec *s, ++ SSL_CTX *ctx, ++ long option, ++ int enabled, ++ const char *name) ++{ ++ if (!enabled) { ++ SSL_CTX_set_options(ctx, option); ++ } ++ else if (SSL_CTX_get_options(ctx) & option) { ++ SSL_CTX_clear_options(ctx, option); ++ ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(02904) ++ "Allowing SSLProtocol %s even though it is disabled " ++ "by OpenSSL by default on this system", name); ++ } ++} ++ + static apr_status_t ssl_init_ctx_protocol(server_rec *s, + apr_pool_t *p, + apr_pool_t *ptemp, +@@ -735,9 +757,13 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + } + if (prot == TLS1_1_VERSION && protocol & SSL_PROTOCOL_TLSV1) { + prot = TLS1_VERSION; ++ ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_TLSv1, ++ protocol & SSL_PROTOCOL_TLSV1, "TLSv1"); + } + #ifndef OPENSSL_NO_SSL3 + if (prot == TLS1_VERSION && protocol & SSL_PROTOCOL_SSLV3) { ++ ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_SSLv3, ++ protocol & SSL_PROTOCOL_SSLV3, "SSLv3"); + prot = SSL3_VERSION; + } + #endif diff --git a/SOURCES/httpd-2.4.37-logjournal.patch b/httpd-2.4.43-logjournal.patch similarity index 97% rename from SOURCES/httpd-2.4.37-logjournal.patch rename to httpd-2.4.43-logjournal.patch index 721911c..cfbd9dc 100644 --- a/SOURCES/httpd-2.4.37-logjournal.patch +++ b/httpd-2.4.43-logjournal.patch @@ -1,5 +1,5 @@ diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4 -index 762e773e94..0848d2e377 100644 +index 762e773..0848d2e 100644 --- a/modules/loggers/config.m4 +++ b/modules/loggers/config.m4 @@ -5,6 +5,8 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]]) @@ -12,7 +12,7 @@ index 762e773e94..0848d2e377 100644 APACHE_MODULE(log_forensic, forensic logging) diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c -index 996c09cf49..50a056a2f8 100644 +index 996c09c..50a056a 100644 --- a/modules/loggers/mod_log_config.c +++ b/modules/loggers/mod_log_config.c @@ -172,6 +172,10 @@ diff --git a/httpd-2.4.43-mod_systemd.patch b/httpd-2.4.43-mod_systemd.patch new file mode 100644 index 0000000..8d7922e --- /dev/null +++ b/httpd-2.4.43-mod_systemd.patch @@ -0,0 +1,96 @@ + +More verbose startup logging for mod_systemd. + +--- httpd-2.4.43/modules/arch/unix/mod_systemd.c.mod_systemd ++++ httpd-2.4.43/modules/arch/unix/mod_systemd.c +@@ -29,11 +29,14 @@ + #include "mpm_common.h" + + #include "systemd/sd-daemon.h" ++#include "systemd/sd-journal.h" + + #if APR_HAVE_UNISTD_H + #include + #endif + ++static char describe_listeners[30]; ++ + static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog, + apr_pool_t *ptemp) + { +@@ -44,6 +47,20 @@ + return OK; + } + ++static char *dump_listener(ap_listen_rec *lr, apr_pool_t *p) ++{ ++ apr_sockaddr_t *sa = lr->bind_addr; ++ char addr[128]; ++ ++ if (apr_sockaddr_is_wildcard(sa)) { ++ return apr_pstrcat(p, "port ", apr_itoa(p, sa->port), NULL); ++ } ++ ++ apr_sockaddr_ip_getbuf(addr, sizeof addr, sa); ++ ++ return apr_psprintf(p, "%s port %u", addr, sa->port); ++} ++ + /* Report the service is ready in post_config, which could be during + * startup or after a reload. The server could still hit a fatal + * startup error after this point during ap_run_mpm(), so this is +@@ -51,19 +68,51 @@ + * the TCP ports so new connections will not be rejected. There will + * always be a possible async failure event simultaneous to the + * service reporting "ready", so this should be good enough. */ +-static int systemd_post_config(apr_pool_t *p, apr_pool_t *plog, ++static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog, + apr_pool_t *ptemp, server_rec *main_server) + { ++ ap_listen_rec *lr; ++ apr_size_t plen = sizeof describe_listeners; ++ char *p = describe_listeners; ++ ++ if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG) ++ return OK; ++ ++ for (lr = ap_listeners; lr; lr = lr->next) { ++ char *s = dump_listener(lr, ptemp); ++ ++ if (strlen(s) + 3 < plen) { ++ char *newp = apr_cpystrn(p, s, plen); ++ if (lr->next) ++ newp = apr_cpystrn(newp, ", ", 3); ++ plen -= newp - p; ++ p = newp; ++ } ++ else { ++ if (plen < 4) { ++ p = describe_listeners + sizeof describe_listeners - 4; ++ plen = 4; ++ } ++ apr_cpystrn(p, "...", plen); ++ break; ++ } ++ } ++ + sd_notify(0, "READY=1\n" + "STATUS=Configuration loaded.\n"); ++ ++ sd_journal_print(LOG_INFO, "Server configured, listening on: %s", ++ describe_listeners); ++ + return OK; + } + + static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type) + { + sd_notifyf(0, "READY=1\n" +- "STATUS=Processing requests...\n" +- "MAINPID=%" APR_PID_T_FMT, getpid()); ++ "STATUS=Started, listening on: %s\n" ++ "MAINPID=%" APR_PID_T_FMT, ++ describe_listeners, getpid()); + + return OK; + } diff --git a/SOURCES/httpd-2.4.28-socket-activation.patch b/httpd-2.4.43-socket-activation.patch similarity index 92% rename from SOURCES/httpd-2.4.28-socket-activation.patch rename to httpd-2.4.43-socket-activation.patch index dbdd80c..77eaa45 100644 --- a/SOURCES/httpd-2.4.28-socket-activation.patch +++ b/httpd-2.4.43-socket-activation.patch @@ -1,8 +1,8 @@ diff --git a/server/listen.c b/server/listen.c -index a8e9e6f..1a6c1d3 100644 +index 9577d60..d718db1 100644 --- a/server/listen.c +++ b/server/listen.c -@@ -34,6 +34,10 @@ +@@ -35,6 +35,10 @@ #include #endif @@ -13,7 +13,7 @@ index a8e9e6f..1a6c1d3 100644 /* we know core's module_index is 0 */ #undef APLOG_MODULE_INDEX #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX -@@ -59,9 +63,12 @@ static int ap_listenbacklog; +@@ -60,9 +64,12 @@ static int ap_listenbacklog; static int ap_listencbratio; static int send_buffer_size; static int receive_buffer_size; @@ -27,7 +27,7 @@ index a8e9e6f..1a6c1d3 100644 { apr_socket_t *s = server->sd; int one = 1; -@@ -94,20 +101,6 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server) +@@ -95,20 +102,6 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server) return stat; } @@ -48,7 +48,7 @@ index a8e9e6f..1a6c1d3 100644 /* * To send data over high bandwidth-delay connections at full * speed we must force the TCP window to open wide enough to keep the -@@ -169,21 +162,37 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server) +@@ -170,21 +163,37 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server) } #endif @@ -100,7 +100,7 @@ index a8e9e6f..1a6c1d3 100644 } #ifdef WIN32 -@@ -315,6 +324,123 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to, +@@ -335,6 +344,123 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to, return found; } @@ -223,8 +223,8 @@ index a8e9e6f..1a6c1d3 100644 + static const char *alloc_listener(process_rec *process, const char *addr, apr_port_t port, const char* proto, - void *slave) -@@ -495,7 +621,7 @@ static int open_listeners(apr_pool_t *pool) + const char *scope_id, void *slave, +@@ -529,7 +655,7 @@ static int open_listeners(apr_pool_t *pool) } } #endif @@ -233,7 +233,7 @@ index a8e9e6f..1a6c1d3 100644 ++num_open; } else { -@@ -607,8 +733,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) +@@ -641,8 +767,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) } } @@ -264,7 +264,7 @@ index a8e9e6f..1a6c1d3 100644 } for (lr = ap_listeners; lr; lr = lr->next) { -@@ -698,7 +844,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s, +@@ -732,7 +878,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s, duplr->bind_addr); return stat; } @@ -273,7 +273,7 @@ index a8e9e6f..1a6c1d3 100644 #if AP_NONBLOCK_WHEN_MULTI_LISTEN use_nonblock = (ap_listeners && ap_listeners->next); stat = apr_socket_opt_set(duplr->sd, APR_SO_NONBLOCK, use_nonblock); -@@ -825,6 +971,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, +@@ -859,6 +1005,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, if (argc < 1 || argc > 2) { return "Listen requires 1 or 2 arguments."; } @@ -285,7 +285,7 @@ index a8e9e6f..1a6c1d3 100644 rv = apr_parse_addr_port(&host, &scope_id, &port, argv[0], cmd->pool); if (rv != APR_SUCCESS) { -@@ -856,6 +1007,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, +@@ -894,6 +1045,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, ap_str_tolower(proto); } @@ -295,6 +295,6 @@ index a8e9e6f..1a6c1d3 100644 + } +#endif + - return alloc_listener(cmd->server->process, host, port, proto, NULL); + return alloc_listener(cmd->server->process, host, port, proto, + scope_id, NULL, cmd->temp_pool); } - diff --git a/SOURCES/httpd-2.4.35-sslciphdefault.patch b/httpd-2.4.43-sslciphdefault.patch similarity index 88% rename from SOURCES/httpd-2.4.35-sslciphdefault.patch rename to httpd-2.4.43-sslciphdefault.patch index 9e740dd..85ae568 100644 --- a/SOURCES/httpd-2.4.35-sslciphdefault.patch +++ b/httpd-2.4.43-sslciphdefault.patch @@ -1,8 +1,8 @@ diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c -index 4cfd2d0..6ac55bd 100644 +index 97778a8..27e7a53 100644 --- a/modules/ssl/ssl_engine_config.c +++ b/modules/ssl/ssl_engine_config.c -@@ -776,9 +776,11 @@ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd, +@@ -778,9 +778,11 @@ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd, } if (!strcmp("SSL", arg1)) { @@ -16,7 +16,7 @@ index 4cfd2d0..6ac55bd 100644 dc->szCipherSuite = arg2; } else { -@@ -1542,8 +1544,10 @@ const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *cmd, +@@ -1544,8 +1546,10 @@ const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *cmd, } if (!strcmp("SSL", arg1)) { diff --git a/SOURCES/httpd-2.4.37-sslprotdefault.patch b/httpd-2.4.43-sslprotdefault.patch similarity index 85% rename from SOURCES/httpd-2.4.37-sslprotdefault.patch rename to httpd-2.4.43-sslprotdefault.patch index 546fa1f..d089823 100644 --- a/SOURCES/httpd-2.4.37-sslprotdefault.patch +++ b/httpd-2.4.43-sslprotdefault.patch @@ -1,5 +1,5 @@ diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c -index 55c237e..5467d23 100644 +index 27e7a53..b53f3f8 100644 --- a/modules/ssl/ssl_engine_config.c +++ b/modules/ssl/ssl_engine_config.c @@ -119,7 +119,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p) @@ -11,19 +11,20 @@ index 55c237e..5467d23 100644 mctx->protocol_set = 0; mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET; -@@ -262,6 +262,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p, - { +@@ -263,6 +263,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p, if (add->protocol_set) { + mrg->protocol_set = 1; mrg->protocol = add->protocol; + mrg->protocol_set = 1; } else { - mrg->protocol = base->protocol; + mrg->protocol_set = base->protocol_set; + diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c -index e3f62fe..31fc0e6 100644 +index bfad47a..b0fcf81 100644 --- a/modules/ssl/ssl_engine_init.c +++ b/modules/ssl/ssl_engine_init.c -@@ -568,6 +568,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, +@@ -577,6 +577,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL; char *cp; int protocol = mctx->protocol; @@ -31,7 +32,7 @@ index e3f62fe..31fc0e6 100644 SSLSrvConfigRec *sc = mySrvConfig(s); #if OPENSSL_VERSION_NUMBER >= 0x10100000L int prot; -@@ -577,12 +578,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, +@@ -586,12 +587,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, * Create the new per-server SSL context */ if (protocol == SSL_PROTOCOL_NONE) { @@ -55,7 +56,7 @@ index e3f62fe..31fc0e6 100644 #ifndef OPENSSL_NO_SSL3 (protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""), #endif -@@ -595,7 +602,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, +@@ -604,7 +611,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, #endif #endif NULL); @@ -65,7 +66,7 @@ index e3f62fe..31fc0e6 100644 ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, "Creating new SSL context (protocols: %s)", cp); -@@ -696,13 +704,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, +@@ -705,13 +713,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, prot = SSL3_VERSION; #endif } else { @@ -87,7 +88,7 @@ index e3f62fe..31fc0e6 100644 /* Next we scan for the minimal protocol version we should provide, * but we do not allow holes between max and min */ -@@ -726,7 +736,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, +@@ -731,7 +741,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, prot = SSL3_VERSION; } #endif diff --git a/SOURCES/httpd-2.4.37-r1842929+.patch b/httpd-2.4.48-r1842929+.patch similarity index 79% rename from SOURCES/httpd-2.4.37-r1842929+.patch rename to httpd-2.4.48-r1842929+.patch index ab5bba6..c1837e7 100644 --- a/SOURCES/httpd-2.4.37-r1842929+.patch +++ b/httpd-2.4.48-r1842929+.patch @@ -1,15 +1,11 @@ -# ./pullrev.sh 1842929 1842931 1852982 1853631 1857731 -http://svn.apache.org/viewvc?view=revision&revision=1842929 -http://svn.apache.org/viewvc?view=revision&revision=1842931 -http://svn.apache.org/viewvc?view=revision&revision=1852982 -http://svn.apache.org/viewvc?view=revision&revision=1857731 -http://svn.apache.org/viewvc?view=revision&revision=1853631 + +Upstream-Status: in trunk, not proposed for 2.4.x diff --git a/Makefile.in b/Makefile.in -index 06b8c5a..9eeb5c7 100644 +index 6747aea..40c7076 100644 --- a/Makefile.in +++ b/Makefile.in -@@ -213,6 +213,7 @@ install-cgi: +@@ -233,6 +233,7 @@ install-cgi: install-other: @test -d $(DESTDIR)$(logfiledir) || $(MKINSTALLDIRS) $(DESTDIR)$(logfiledir) @test -d $(DESTDIR)$(runtimedir) || $(MKINSTALLDIRS) $(DESTDIR)$(runtimedir) @@ -18,7 +14,7 @@ index 06b8c5a..9eeb5c7 100644 file=apachecore.$$ext; \ if test -f $$file; then \ diff --git a/acinclude.m4 b/acinclude.m4 -index 0ad0c13..a8c2804 100644 +index b6ef442..98f1441 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -45,6 +45,7 @@ AC_DEFUN([APACHE_GEN_CONFIG_VARS],[ @@ -29,7 +25,7 @@ index 0ad0c13..a8c2804 100644 APACHE_SUBST(other_targets) APACHE_SUBST(progname) APACHE_SUBST(prefix) -@@ -663,6 +664,7 @@ AC_DEFUN([APACHE_EXPORT_ARGUMENTS],[ +@@ -665,6 +666,7 @@ AC_DEFUN([APACHE_EXPORT_ARGUMENTS],[ APACHE_SUBST_EXPANDED_ARG(runtimedir) APACHE_SUBST_EXPANDED_ARG(logfiledir) APACHE_SUBST_EXPANDED_ARG(proxycachedir) @@ -38,7 +34,7 @@ index 0ad0c13..a8c2804 100644 dnl diff --git a/configure.in b/configure.in -index a208b53..de6a8ad 100644 +index 37346b2..f303784 100644 --- a/configure.in +++ b/configure.in @@ -41,7 +41,7 @@ dnl Something seems broken here. @@ -63,7 +59,7 @@ index 2b4a70c..e076f41 100644 #endif /* AP_CONFIG_LAYOUT_H */ diff --git a/include/http_config.h b/include/http_config.h -index adc5825..effccc1 100644 +index 77657ae..384a90f 100644 --- a/include/http_config.h +++ b/include/http_config.h @@ -757,6 +757,14 @@ AP_DECLARE(char *) ap_server_root_relative(apr_pool_t *p, const char *fname); @@ -130,48 +126,11 @@ index addfd7e..2389f8f 100644 dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL, APR_HOOK_MIDDLE); dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE); -diff --git a/modules/md/mod_md_config.c b/modules/md/mod_md_config.c -index 336a21b..4d50e26 100644 ---- a/modules/md/mod_md_config.c -+++ b/modules/md/mod_md_config.c -@@ -54,10 +54,18 @@ - - #define DEF_VAL (-1) - -+#ifndef MD_DEFAULT_BASE_DIR -+#define MD_DEFAULT_BASE_DIR "md" -+#endif -+ - /* Default settings for the global conf */ - static md_mod_conf_t defmc = { - NULL, -- "md", -+#if 1 -+ NULL, /* apply default state-dir-relative */ -+#else -+ MD_DEFAULT_BASE_DIR, -+#endif - NULL, - NULL, - 80, -@@ -864,6 +872,12 @@ apr_status_t md_config_post_config(server_rec *s, apr_pool_t *p) - if (mc->hsts_max_age > 0) { - mc->hsts_header = apr_psprintf(p, "max-age=%d", mc->hsts_max_age); - } -+ -+#if 1 -+ if (mc->base_dir == NULL) { -+ mc->base_dir = ap_state_dir_relative(p, MD_DEFAULT_BASE_DIR); -+ } -+#endif - - return APR_SUCCESS; - } diff --git a/server/core.c b/server/core.c -index bbe52e0..b5ab429 100644 +index d135764..c2176b9 100644 --- a/server/core.c +++ b/server/core.c -@@ -133,6 +133,8 @@ AP_DECLARE_DATA int ap_main_state = AP_SQ_MS_INITIAL_STARTUP; +@@ -142,6 +142,8 @@ AP_DECLARE_DATA int ap_main_state = AP_SQ_MS_INITIAL_STARTUP; AP_DECLARE_DATA int ap_run_mode = AP_SQ_RM_UNKNOWN; AP_DECLARE_DATA int ap_config_generation = 0; @@ -180,7 +139,7 @@ index bbe52e0..b5ab429 100644 static void *create_core_dir_config(apr_pool_t *a, char *dir) { core_dir_config *conf; -@@ -1411,12 +1413,15 @@ AP_DECLARE(const char *) ap_resolve_env(apr_pool_t *p, const char * word) +@@ -1444,13 +1446,16 @@ AP_DECLARE(const char *) ap_resolve_env(apr_pool_t *p, const char * word) return res_buf; } @@ -191,6 +150,7 @@ index bbe52e0..b5ab429 100644 ap_server_config_defines = saved_server_config_defines; saved_server_config_defines = NULL; server_config_defined_vars = NULL; + ap_runtime_dir = NULL; - return OK; + core_state_dir = NULL; + @@ -198,7 +158,7 @@ index bbe52e0..b5ab429 100644 } /* -@@ -3108,6 +3113,24 @@ static const char *set_runtime_dir(cmd_parms *cmd, void *dummy, const char *arg) +@@ -3220,6 +3225,24 @@ static const char *set_runtime_dir(cmd_parms *cmd, void *dummy, const char *arg) return NULL; } @@ -223,7 +183,7 @@ index bbe52e0..b5ab429 100644 static const char *set_timeout(cmd_parms *cmd, void *dummy, const char *arg) { const char *err = ap_check_cmd_context(cmd, NOT_IN_DIR_CONTEXT); -@@ -4409,6 +4432,8 @@ AP_INIT_TAKE1("ServerRoot", set_server_root, NULL, RSRC_CONF | EXEC_ON_READ, +@@ -4521,6 +4544,8 @@ AP_INIT_TAKE1("ServerRoot", set_server_root, NULL, RSRC_CONF | EXEC_ON_READ, "Common directory of server-related files (logs, confs, etc.)"), AP_INIT_TAKE1("DefaultRuntimeDir", set_runtime_dir, NULL, RSRC_CONF | EXEC_ON_READ, "Common directory for run-time files (shared memory, locks, etc.)"), @@ -232,7 +192,7 @@ index bbe52e0..b5ab429 100644 AP_INIT_TAKE1("ErrorLog", set_server_string_slot, (void *)APR_OFFSETOF(server_rec, error_fname), RSRC_CONF, "The filename of the error log"), -@@ -4932,8 +4957,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem +@@ -5055,8 +5080,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem if (!saved_server_config_defines) init_config_defines(pconf); @@ -240,9 +200,9 @@ index bbe52e0..b5ab429 100644 - apr_pool_cleanup_null); + apr_pool_cleanup_register(pconf, NULL, reset_config, apr_pool_cleanup_null); - ap_regcomp_set_default_cflags(AP_REG_DOLLAR_ENDONLY); + ap_regcomp_set_default_cflags(AP_REG_DEFAULT); -@@ -5202,6 +5226,27 @@ AP_DECLARE(int) ap_state_query(int query) +@@ -5303,6 +5327,27 @@ AP_DECLARE(int) ap_state_query(int query) } } diff --git a/httpd-2.4.53-detect-systemd.patch b/httpd-2.4.53-detect-systemd.patch new file mode 100644 index 0000000..d501b06 --- /dev/null +++ b/httpd-2.4.53-detect-systemd.patch @@ -0,0 +1,45 @@ +diff --git a/Makefile.in b/Makefile.in +index a2e9c82..bd8045c 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -4,7 +4,7 @@ CLEAN_SUBDIRS = test + + PROGRAM_NAME = $(progname) + PROGRAM_SOURCES = modules.c +-PROGRAM_LDADD = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(PCRE_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS) ++PROGRAM_LDADD = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS) + PROGRAM_PRELINK = $(COMPILE) -c $(top_srcdir)/server/buildmark.c + PROGRAM_DEPENDENCIES = \ + server/libmain.la \ +diff --git a/acinclude.m4 b/acinclude.m4 +index 97484c9..05abe18 100644 +--- a/acinclude.m4 ++++ b/acinclude.m4 +@@ -631,6 +631,7 @@ case $host in + if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then + AC_MSG_WARN([Your system does not support systemd.]) + else ++ APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS]) + AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported]) + fi + fi +diff --git a/configure.in b/configure.in +index cf437fe..521fc45 100644 +--- a/configure.in ++++ b/configure.in +@@ -239,6 +239,7 @@ if test "x$PCRE_CONFIG" != "x"; then + AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG]) + APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`]) + APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs8 2>/dev/null || $PCRE_CONFIG --libs`]) ++ APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)]) + else + AC_MSG_ERROR([pcre(2)-config for libpcre not found. PCRE is required and available from http://pcre.org/]) + fi +@@ -734,6 +735,7 @@ APACHE_SUBST(OS_DIR) + APACHE_SUBST(BUILTIN_LIBS) + APACHE_SUBST(SHLIBPATH_VAR) + APACHE_SUBST(OS_SPECIFIC_VARS) ++APACHE_SUBST(HTTPD_LIBS) + + PRE_SHARED_CMDS='echo ""' + POST_SHARED_CMDS='echo ""' diff --git a/httpd-2.4.53-export.patch b/httpd-2.4.53-export.patch new file mode 100644 index 0000000..d240360 --- /dev/null +++ b/httpd-2.4.53-export.patch @@ -0,0 +1,56 @@ +diff --git a/Makefile.in b/Makefile.in +index bd8045c..d6733a5 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test + + PROGRAM_NAME = $(progname) + PROGRAM_SOURCES = modules.c +-PROGRAM_LDADD = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS) ++PROGRAM_LDADD = buildmark.o $(HTTPD_LDFLAGS) \ ++ $(PROGRAM_LDDEPS) \ ++ $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS) + PROGRAM_PRELINK = $(COMPILE) -c $(top_srcdir)/server/buildmark.c ++PROGRAM_LDDEPS = \ ++ $(BUILTIN_LIBS) \ ++ $(MPM_LIB) \ ++ -Wl,--whole-archive,server/.libs/libmain.a,--no-whole-archive \ ++ os/$(OS_DIR)/libos.la + PROGRAM_DEPENDENCIES = \ + server/libmain.la \ + $(BUILTIN_LIBS) \ +diff --git a/server/Makefile.in b/server/Makefile.in +index 8111877..f00bb3f 100644 +--- a/server/Makefile.in ++++ b/server/Makefile.in +@@ -12,7 +12,7 @@ LTLIBRARY_SOURCES = \ + connection.c listen.c util_mutex.c \ + mpm_common.c mpm_unix.c mpm_fdqueue.c \ + util_charset.c util_cookies.c util_debug.c util_xml.c \ +- util_filter.c util_pcre.c util_regex.c exports.c \ ++ util_filter.c util_pcre.c util_regex.c \ + scoreboard.c error_bucket.c protocol.c core.c request.c ssl.c provider.c \ + eoc_bucket.c eor_bucket.c core_filters.c \ + util_expr_parse.c util_expr_scan.c util_expr_eval.c +diff --git a/server/main.c b/server/main.c +index 7da7aa2..e63d2eb 100644 +--- a/server/main.c ++++ b/server/main.c +@@ -857,17 +857,3 @@ int main(int argc, const char * const argv[]) + return !OK; + } + +-#ifdef AP_USING_AUTOCONF +-/* This ugly little hack pulls any function referenced in exports.c into +- * the web server. exports.c is generated during the build, and it +- * has all of the APR functions specified by the apr/apr.exports and +- * apr-util/aprutil.exports files. +- */ +-const void *ap_suck_in_APR(void); +-const void *ap_suck_in_APR(void) +-{ +- extern const void *ap_ugly_hack; +- +- return ap_ugly_hack; +-} +-#endif diff --git a/httpd-2.4.53-separate-systemd-fns.patch b/httpd-2.4.53-separate-systemd-fns.patch new file mode 100644 index 0000000..88b99ff --- /dev/null +++ b/httpd-2.4.53-separate-systemd-fns.patch @@ -0,0 +1,286 @@ +diff --git a/acinclude.m4 b/acinclude.m4 +index 05abe18..97484c9 100644 +--- a/acinclude.m4 ++++ b/acinclude.m4 +@@ -631,7 +631,6 @@ case $host in + if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then + AC_MSG_WARN([Your system does not support systemd.]) + else +- APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS]) + AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported]) + fi + fi +diff --git a/include/ap_listen.h b/include/ap_listen.h +index 58c2574..d5ed968 100644 +--- a/include/ap_listen.h ++++ b/include/ap_listen.h +@@ -29,6 +29,7 @@ + #include "apr_network_io.h" + #include "httpd.h" + #include "http_config.h" ++#include "apr_optional.h" + + #ifdef __cplusplus + extern "C" { +@@ -143,6 +144,15 @@ AP_DECLARE_NONSTD(const char *) ap_set_receive_buffer_size(cmd_parms *cmd, + void *dummy, + const char *arg); + ++#ifdef HAVE_SYSTEMD ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_find_systemd_socket, (process_rec *, apr_port_t)); ++ ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_systemd_listen_fds, (int)); ++#endif ++ ++ + #define LISTEN_COMMANDS \ + AP_INIT_TAKE1("ListenBacklog", ap_set_listenbacklog, NULL, RSRC_CONF, \ + "Maximum length of the queue of pending connections, as used by listen(2)"), \ +diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c +index eda1272..fc059fc 100644 +--- a/modules/arch/unix/mod_systemd.c ++++ b/modules/arch/unix/mod_systemd.c +@@ -35,6 +35,15 @@ + #include + #endif + ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_find_systemd_socket, (process_rec *, apr_port_t)); ++ ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_systemd_listen_fds, (int)); ++ ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_systemd_journal_stream_fd, (const char *, int, int)); ++ + static char describe_listeners[30]; + + static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog, +@@ -145,8 +154,47 @@ static int systemd_monitor(apr_pool_t *p, server_rec *s) + return DECLINED; + } + ++static int ap_find_systemd_socket(process_rec * process, apr_port_t port) { ++ int fdcount, fd; ++ int sdc = sd_listen_fds(0); ++ ++ if (sdc < 0) { ++ ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486) ++ "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d", ++ sdc); ++ return -1; ++ } ++ ++ if (sdc == 0) { ++ ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487) ++ "find_systemd_socket: At least one socket must be set."); ++ return -1; ++ } ++ ++ fdcount = atoi(getenv("LISTEN_FDS")); ++ for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) { ++ if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) { ++ return fd; ++ } ++ } ++ ++ return -1; ++} ++ ++static int ap_systemd_listen_fds(int unset_environment){ ++ return sd_listen_fds(unset_environment); ++} ++ ++static int ap_systemd_journal_stream_fd(const char *identifier, int priority, int level_prefix){ ++ return sd_journal_stream_fd("httpd", priority, 0); ++} ++ + static void systemd_register_hooks(apr_pool_t *p) + { ++ APR_REGISTER_OPTIONAL_FN(ap_systemd_listen_fds); ++ APR_REGISTER_OPTIONAL_FN(ap_find_systemd_socket); ++ APR_REGISTER_OPTIONAL_FN(ap_systemd_journal_stream_fd); ++ + /* Enable ap_extended_status. */ + ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST); + /* Signal service is ready. */ +diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4 +index 0848d2e..8af2299 100644 +--- a/modules/loggers/config.m4 ++++ b/modules/loggers/config.m4 +@@ -5,7 +5,6 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]]) + APACHE_MODPATH_INIT(loggers) + + APACHE_MODULE(log_config, logging configuration. You won't be able to log requests to the server without this module., , , yes) +-APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS]) + + APACHE_MODULE(log_debug, configurable debug logging, , , most) + APACHE_MODULE(log_forensic, forensic logging) +diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c +index 0b11f60..c3f0a51 100644 +--- a/modules/loggers/mod_log_config.c ++++ b/modules/loggers/mod_log_config.c +@@ -172,10 +172,6 @@ + #include + #endif + +-#ifdef HAVE_SYSTEMD +-#include +-#endif +- + #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b" + + module AP_MODULE_DECLARE_DATA log_config_module; +@@ -1640,8 +1636,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd, + { + #ifdef HAVE_SYSTEMD + int fd; ++ APR_OPTIONAL_FN_TYPE(ap_systemd_journal_stream_fd) *systemd_journal_stream_fd; ++ ++ systemd_journal_stream_fd = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_journal_stream_fd); ++ if (systemd_journal_stream_fd == NULL) { ++ return APR_ENOTIMPL; ++ } + +- fd = sd_journal_stream_fd("httpd", priority, 0); ++ fd = systemd_journal_stream_fd("httpd", priority, 0); ++ + if (fd < 0) return fd; + + /* This is an AF_UNIX socket fd so is more pipe-like than +diff --git a/modules/loggers/mod_log_config.h b/modules/loggers/mod_log_config.h +index 877a593..bd52a98 100644 +--- a/modules/loggers/mod_log_config.h ++++ b/modules/loggers/mod_log_config.h +@@ -69,6 +69,10 @@ APR_DECLARE_OPTIONAL_FN(ap_log_writer_init*, ap_log_set_writer_init,(ap_log_writ + */ + APR_DECLARE_OPTIONAL_FN(ap_log_writer*, ap_log_set_writer, (ap_log_writer* func)); + ++#ifdef HAVE_SYSTEMD ++APR_DECLARE_OPTIONAL_FN(int, ap_systemd_journal_stream_fd, (const char *, int, int)); ++#endif ++ + #endif /* MOD_LOG_CONFIG */ + /** @} */ + +diff --git a/server/listen.c b/server/listen.c +index e2e028a..5d1c0e1 100644 +--- a/server/listen.c ++++ b/server/listen.c +@@ -34,10 +34,6 @@ + #include + #endif + +-#ifdef HAVE_SYSTEMD +-#include +-#endif +- + /* we know core's module_index is 0 */ + #undef APLOG_MODULE_INDEX + #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX +@@ -325,34 +321,6 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to, + } + + #ifdef HAVE_SYSTEMD +- +-static int find_systemd_socket(process_rec * process, apr_port_t port) { +- int fdcount, fd; +- int sdc = sd_listen_fds(0); +- +- if (sdc < 0) { +- ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486) +- "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d", +- sdc); +- return -1; +- } +- +- if (sdc == 0) { +- ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487) +- "find_systemd_socket: At least one socket must be set."); +- return -1; +- } +- +- fdcount = atoi(getenv("LISTEN_FDS")); +- for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) { +- if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) { +- return fd; +- } +- } +- +- return -1; +-} +- + static apr_status_t alloc_systemd_listener(process_rec * process, + int fd, const char *proto, + ap_listen_rec **out_rec) +@@ -412,6 +380,14 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port, + { + ap_listen_rec *last, *new; + apr_status_t rv; ++ APR_OPTIONAL_FN_TYPE(ap_find_systemd_socket) *find_systemd_socket; ++ ++ find_systemd_socket = APR_RETRIEVE_OPTIONAL_FN(ap_find_systemd_socket); ++ ++ if (!find_systemd_socket) ++ return "Systemd socket activation is used, but mod_systemd is probably " ++ "not loaded"; ++ + int fd = find_systemd_socket(process, port); + if (fd < 0) { + return "Systemd socket activation is used, but this port is not " +@@ -438,7 +414,6 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port, + + return NULL; + } +- + #endif /* HAVE_SYSTEMD */ + + static const char *alloc_listener(process_rec *process, const char *addr, +@@ -707,6 +682,9 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) + int num_listeners = 0; + const char* proto; + int found; ++#ifdef HAVE_SYSTEMD ++ APR_OPTIONAL_FN_TYPE(ap_systemd_listen_fds) *systemd_listen_fds; ++#endif + + for (ls = s; ls; ls = ls->next) { + proto = ap_get_server_protocol(ls); +@@ -746,7 +724,10 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) + apr_pool_cleanup_null, s->process->pool); + } + else { +- sd_listen_fds(1); ++ systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds); ++ if (systemd_listen_fds != NULL) { ++ systemd_listen_fds(1); ++ } + } + } + else +@@ -963,6 +944,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, + apr_port_t port; + apr_status_t rv; + const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY); ++#ifdef HAVE_SYSTEMD ++ APR_OPTIONAL_FN_TYPE(ap_systemd_listen_fds) *systemd_listen_fds; ++#endif + + if (err != NULL) { + return err; +@@ -973,7 +957,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, + } + #ifdef HAVE_SYSTEMD + if (use_systemd == -1) { +- use_systemd = sd_listen_fds(0) > 0; ++ systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds); ++ if (systemd_listen_fds != NULL) { ++ use_systemd = systemd_listen_fds(0) > 0; ++ } else { ++ use_systemd = 0; ++ } + } + #endif + diff --git a/httpd-2.4.54-icons.patch b/httpd-2.4.54-icons.patch new file mode 100644 index 0000000..efc0c4d --- /dev/null +++ b/httpd-2.4.54-icons.patch @@ -0,0 +1,49 @@ +diff --git a/docs/conf/extra/httpd-autoindex.conf.in b/docs/conf/extra/httpd-autoindex.conf.in +index 51b02ed..93a2b87 100644 +--- a/docs/conf/extra/httpd-autoindex.conf.in ++++ b/docs/conf/extra/httpd-autoindex.conf.in +@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable VersionSort + Alias /icons/ "@exp_iconsdir@/" + + +- Options Indexes MultiViews ++ Options Indexes MultiViews FollowSymlinks + AllowOverride None + Require all granted + +@@ -37,6 +37,7 @@ AddIconByType (TXT,/icons/text.gif) text/* + AddIconByType (IMG,/icons/image2.gif) image/* + AddIconByType (SND,/icons/sound2.gif) audio/* + AddIconByType (VID,/icons/movie.gif) video/* ++AddIconByType /icons/bomb.gif application/x-coredump + + AddIcon /icons/binary.gif .bin .exe + AddIcon /icons/binhex.gif .hqx +@@ -53,7 +54,6 @@ AddIcon /icons/dvi.gif .dvi + AddIcon /icons/uuencoded.gif .uu + AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl + AddIcon /icons/tex.gif .tex +-AddIcon /icons/bomb.gif core + + AddIcon /icons/back.gif .. + AddIcon /icons/hand.right.gif README +diff --git a/docs/conf/magic b/docs/conf/magic +index bc891d9..9a41b44 100644 +--- a/docs/conf/magic ++++ b/docs/conf/magic +@@ -383,3 +383,15 @@ + 4 string moov video/quicktime + 4 string mdat video/quicktime + ++ ++#------------------------------------------------------------------------------ ++# application/x-coredump for LE/BE ELF ++# ++0 string \177ELF ++>5 byte 1 ++>16 leshort 4 application/x-coredump ++ ++0 string \177ELF ++>5 byte 2 ++>16 beshort 4 application/x-coredump ++ diff --git a/httpd-2.4.54-selinux.patch b/httpd-2.4.54-selinux.patch new file mode 100644 index 0000000..661b983 --- /dev/null +++ b/httpd-2.4.54-selinux.patch @@ -0,0 +1,64 @@ + +Upstream-Status: in trunk not in 2.4.x + +diff --git a/configure.in b/configure.in +index 74015ca..8c0ee10 100644 +--- httpd-2.4.54/modules/arch/unix/config5.m4.selinux ++++ httpd-2.4.54/modules/arch/unix/config5.m4 +@@ -23,6 +23,11 @@ + AC_MSG_WARN([Your system does not support systemd.]) + enable_systemd="no" + else ++ AC_CHECK_LIB(selinux, is_selinux_enabled, [ ++ AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported]) ++ APR_ADDTO(MOD_SYSTEMD_LDADD, [-lselinux]) ++ ]) ++ + APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS]) + fi + ]) +--- httpd-2.4.54/modules/arch/unix/mod_systemd.c.selinux ++++ httpd-2.4.54/modules/arch/unix/mod_systemd.c +@@ -35,6 +35,10 @@ + #include + #endif + ++#ifdef HAVE_SELINUX ++#include ++#endif ++ + APR_DECLARE_OPTIONAL_FN(int, + ap_find_systemd_socket, (process_rec *, apr_port_t)); + +@@ -70,6 +74,20 @@ + return apr_psprintf(p, "%s port %u", addr, sa->port); + } + ++#ifdef HAVE_SELINUX ++static void log_selinux_context(void) ++{ ++ char *con; ++ ++ if (is_selinux_enabled() && getcon(&con) == 0) { ++ ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL, ++ "SELinux policy enabled; " ++ "httpd running as context %s", con); ++ freecon(con); ++ } ++} ++#endif ++ + /* Report the service is ready in post_config, which could be during + * startup or after a reload. The server could still hit a fatal + * startup error after this point during ap_run_mpm(), so this is +@@ -87,6 +105,10 @@ + if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG) + return OK; + ++#ifdef HAVE_SELINUX ++ log_selinux_context(); ++#endif ++ + for (lr = ap_listeners; lr; lr = lr->next) { + char *s = dump_listener(lr, ptemp); + diff --git a/SOURCES/httpd-2.4.35-full-release.patch b/httpd-2.4.59-full-release.patch similarity index 79% rename from SOURCES/httpd-2.4.35-full-release.patch rename to httpd-2.4.59-full-release.patch index ab8cc2a..da28640 100644 --- a/SOURCES/httpd-2.4.35-full-release.patch +++ b/httpd-2.4.59-full-release.patch @@ -1,8 +1,6 @@ -diff --git a/server/core.c b/server/core.c -index cb8e463..daf76b3 100644 ---- a/server/core.c -+++ b/server/core.c -@@ -3430,6 +3430,7 @@ enum server_token_type { +--- httpd-2.4.59/server/core.c.full-release ++++ httpd-2.4.59/server/core.c +@@ -3586,6 +3586,7 @@ SrvTk_MINIMAL, /* eg: Apache/2.0.41 */ SrvTk_OS, /* eg: Apache/2.0.41 (UNIX) */ SrvTk_FULL, /* eg: Apache/2.0.41 (UNIX) PHP/4.2.2 FooBar/1.2b */ @@ -10,7 +8,7 @@ index cb8e463..daf76b3 100644 SrvTk_PRODUCT_ONLY /* eg: Apache */ }; static enum server_token_type ap_server_tokens = SrvTk_FULL; -@@ -3506,7 +3507,10 @@ static void set_banner(apr_pool_t *pconf) +@@ -3662,7 +3663,10 @@ else if (ap_server_tokens == SrvTk_MAJOR) { ap_add_version_component(pconf, AP_SERVER_BASEPRODUCT "/" AP_SERVER_MAJORVERSION); } @@ -22,7 +20,7 @@ index cb8e463..daf76b3 100644 ap_add_version_component(pconf, AP_SERVER_BASEVERSION " (" PLATFORM ")"); } -@@ -3514,7 +3518,7 @@ static void set_banner(apr_pool_t *pconf) +@@ -3670,7 +3674,7 @@ * Lock the server_banner string if we're not displaying * the full set of tokens */ @@ -31,8 +29,8 @@ index cb8e463..daf76b3 100644 banner_locked++; } server_description = AP_SERVER_BASEVERSION " (" PLATFORM ")"; -@@ -3547,8 +3551,11 @@ static const char *set_serv_tokens(cmd_parms *cmd, void *dummy, - else if (!strcasecmp(arg, "Full")) { +@@ -3703,8 +3707,11 @@ + else if (!ap_cstr_casecmp(arg, "Full")) { ap_server_tokens = SrvTk_FULL; } + else if (!strcasecmp(arg, "Full-Release")) { diff --git a/httpd-2.4.59-no-engine.patch b/httpd-2.4.59-no-engine.patch new file mode 100644 index 0000000..e144735 --- /dev/null +++ b/httpd-2.4.59-no-engine.patch @@ -0,0 +1,11 @@ +--- httpd-2.4.59/modules/ssl/ssl_private.h.no-engine ++++ httpd-2.4.59/modules/ssl/ssl_private.h +@@ -112,7 +112,7 @@ + || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \ + && !defined(OPENSSL_NO_ENGINE) + #include +-#define MODSSL_HAVE_ENGINE_API 1 ++#define MODSSL_HAVE_ENGINE_API 0 + #endif + #ifndef MODSSL_HAVE_ENGINE_API + #define MODSSL_HAVE_ENGINE_API 0 diff --git a/SOURCES/httpd-2.4.35-freebind.patch b/httpd-2.4.62-freebind.patch similarity index 91% rename from SOURCES/httpd-2.4.35-freebind.patch rename to httpd-2.4.62-freebind.patch index dc34c4e..93a0143 100644 --- a/SOURCES/httpd-2.4.35-freebind.patch +++ b/httpd-2.4.62-freebind.patch @@ -1,85 +1,5 @@ -diff --git a/include/ap_listen.h b/include/ap_listen.h -index 58c2574..1a53292 100644 ---- a/include/ap_listen.h -+++ b/include/ap_listen.h -@@ -137,6 +137,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listenbacklog(cmd_parms *cmd, void *dummy - AP_DECLARE_NONSTD(const char *) ap_set_listencbratio(cmd_parms *cmd, void *dummy, const char *arg); - AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, - int argc, char *const argv[]); -+AP_DECLARE_NONSTD(const char *) ap_set_freelistener(cmd_parms *cmd, void *dummy, -+ int argc, char *const argv[]); -+ - AP_DECLARE_NONSTD(const char *) ap_set_send_buffer_size(cmd_parms *cmd, void *dummy, - const char *arg); - AP_DECLARE_NONSTD(const char *) ap_set_receive_buffer_size(cmd_parms *cmd, -@@ -150,6 +153,8 @@ AP_INIT_TAKE1("ListenCoresBucketsRatio", ap_set_listencbratio, NULL, RSRC_CONF, - "Ratio between the number of CPU cores (online) and the number of listeners buckets"), \ - AP_INIT_TAKE_ARGV("Listen", ap_set_listener, NULL, RSRC_CONF, \ - "A port number or a numeric IP address and a port number, and an optional protocol"), \ -+AP_INIT_TAKE_ARGV("ListenFree", ap_set_freelistener, NULL, RSRC_CONF, \ -+ "A port number or a numeric IP address and a port number, and an optional protocol"), \ - AP_INIT_TAKE1("SendBufferSize", ap_set_send_buffer_size, NULL, RSRC_CONF, \ - "Send buffer size in bytes"), \ - AP_INIT_TAKE1("ReceiveBufferSize", ap_set_receive_buffer_size, NULL, \ -diff --git a/server/listen.c b/server/listen.c -index 1a6c1d3..d375fee 100644 ---- a/server/listen.c -+++ b/server/listen.c -@@ -63,6 +63,7 @@ static int ap_listenbacklog; - static int ap_listencbratio; - static int send_buffer_size; - static int receive_buffer_size; -+static int ap_listenfreebind; - #ifdef HAVE_SYSTEMD - static int use_systemd = -1; - #endif -@@ -162,6 +163,21 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server, int do_bind_ - } - #endif - -+ -+#if defined(APR_SO_FREEBIND) -+ if (ap_listenfreebind) { -+ if (apr_socket_opt_set(s, APR_SO_FREEBIND, one) < 0) { -+ stat = apr_get_netos_error(); -+ ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(02182) -+ "make_sock: apr_socket_opt_set: " -+ "error setting APR_SO_FREEBIND"); -+ apr_socket_close(s); -+ return stat; -+ } -+ } -+#endif -+ -+ - if (do_bind_listen) { - #if APR_HAVE_IPV6 - if (server->bind_addr->family == APR_INET6) { -@@ -956,6 +972,7 @@ AP_DECLARE(void) ap_listen_pre_config(void) - } - } - -+ - AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, - int argc, char *const argv[]) - { -@@ -1016,6 +1033,14 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, - return alloc_listener(cmd->server->process, host, port, proto, NULL); - } - -+AP_DECLARE_NONSTD(const char *) ap_set_freelistener(cmd_parms *cmd, void *dummy, -+ int argc, -+ char *const argv[]) -+{ -+ ap_listenfreebind = 1; -+ return ap_set_listener(cmd, dummy, argc, argv); -+} -+ - AP_DECLARE_NONSTD(const char *) ap_set_listenbacklog(cmd_parms *cmd, - void *dummy, - const char *arg) diff --git a/docs/manual/mod/mpm_common.html.en b/docs/manual/mod/mpm_common.html.en -index 5d688e4..eb66c19 100644 +index d7a2fea..c911a4e 100644 --- a/docs/manual/mod/mpm_common.html.en +++ b/docs/manual/mod/mpm_common.html.en @@ -42,6 +42,7 @@ more than one multi-processing module (MPM) @@ -90,7 +10,7 @@ index 5d688e4..eb66c19 100644

  • ListenBackLog
  • ListenCoresBucketsRatio
  • MaxConnectionsPerChild
  • -@@ -233,6 +234,31 @@ discussion of the Address already in use error message, +@@ -244,6 +245,31 @@ discussion of the Address already in use error message, including other causes.
    @@ -122,4 +42,83 @@ index 5d688e4..eb66c19 100644
    top

    ListenBackLog Directive

    - +diff --git a/include/ap_listen.h b/include/ap_listen.h +index d5ed968..be1a60c 100644 +--- a/include/ap_listen.h ++++ b/include/ap_listen.h +@@ -138,6 +138,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listenbacklog(cmd_parms *cmd, void *dummy + AP_DECLARE_NONSTD(const char *) ap_set_listencbratio(cmd_parms *cmd, void *dummy, const char *arg); + AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, + int argc, char *const argv[]); ++AP_DECLARE_NONSTD(const char *) ap_set_freelistener(cmd_parms *cmd, void *dummy, ++ int argc, char *const argv[]); ++ + AP_DECLARE_NONSTD(const char *) ap_set_send_buffer_size(cmd_parms *cmd, void *dummy, + const char *arg); + AP_DECLARE_NONSTD(const char *) ap_set_receive_buffer_size(cmd_parms *cmd, +@@ -160,6 +163,8 @@ AP_INIT_TAKE1("ListenCoresBucketsRatio", ap_set_listencbratio, NULL, RSRC_CONF, + "Ratio between the number of CPU cores (online) and the number of listeners buckets"), \ + AP_INIT_TAKE_ARGV("Listen", ap_set_listener, NULL, RSRC_CONF, \ + "A port number or a numeric IP address and a port number, and an optional protocol"), \ ++AP_INIT_TAKE_ARGV("ListenFree", ap_set_freelistener, NULL, RSRC_CONF, \ ++ "A port number or a numeric IP address and a port number, and an optional protocol"), \ + AP_INIT_TAKE1("SendBufferSize", ap_set_send_buffer_size, NULL, RSRC_CONF, \ + "Send buffer size in bytes"), \ + AP_INIT_TAKE1("ReceiveBufferSize", ap_set_receive_buffer_size, NULL, \ +diff --git a/server/listen.c b/server/listen.c +index 2a4e87a..280bbe7 100644 +--- a/server/listen.c ++++ b/server/listen.c +@@ -60,6 +60,7 @@ static int ap_listenbacklog; + static int ap_listencbratio; + static int send_buffer_size; + static int receive_buffer_size; ++static int ap_listenfreebind; + #ifdef HAVE_SYSTEMD + static int use_systemd = -1; + #endif +@@ -159,6 +160,21 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server, int do_bind_ + } + #endif + ++ ++#if defined(APR_SO_FREEBIND) ++ if (ap_listenfreebind) { ++ if (apr_socket_opt_set(s, APR_SO_FREEBIND, one) < 0) { ++ stat = apr_get_netos_error(); ++ ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(02182) ++ "make_sock: apr_socket_opt_set: " ++ "error setting APR_SO_FREEBIND"); ++ apr_socket_close(s); ++ return stat; ++ } ++ } ++#endif ++ ++ + if (do_bind_listen) { + #if APR_HAVE_IPV6 + if (server->bind_addr->family == APR_INET6) { +@@ -971,6 +987,7 @@ AP_DECLARE(void) ap_listen_pre_config(void) + } + } + ++ + AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, + int argc, char *const argv[]) + { +@@ -1044,6 +1061,14 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, + scope_id, NULL, cmd->temp_pool); + } + ++AP_DECLARE_NONSTD(const char *) ap_set_freelistener(cmd_parms *cmd, void *dummy, ++ int argc, ++ char *const argv[]) ++{ ++ ap_listenfreebind = 1; ++ return ap_set_listener(cmd, dummy, argc, argv); ++} ++ + AP_DECLARE_NONSTD(const char *) ap_set_listenbacklog(cmd_parms *cmd, + void *dummy, + const char *arg) diff --git a/SOURCES/httpd-2.4.37-proxy-ws-idle-timeout.patch b/httpd-2.4.62-proxy-ws-idle-timeout.patch similarity index 68% rename from SOURCES/httpd-2.4.37-proxy-ws-idle-timeout.patch rename to httpd-2.4.62-proxy-ws-idle-timeout.patch index ef4408c..1c37b3e 100644 --- a/SOURCES/httpd-2.4.37-proxy-ws-idle-timeout.patch +++ b/httpd-2.4.62-proxy-ws-idle-timeout.patch @@ -1,25 +1,20 @@ diff --git a/docs/manual/mod/mod_proxy_wstunnel.html.en b/docs/manual/mod/mod_proxy_wstunnel.html.en -index 21ffbe2..16e1628 100644 +index c5004b8..a0ae3c8 100644 --- a/docs/manual/mod/mod_proxy_wstunnel.html.en +++ b/docs/manual/mod/mod_proxy_wstunnel.html.en -@@ -60,14 +60,33 @@ NONE means you bypass the check for the header but still upgrade to WebSocket. - ANY means that Upgrade will read in the request headers and use - in the response Upgrade

    - --
    Support Apache!

    Directives

    --

    This module provides no -- directives.

    -+

    Directives

    -+

    Bugfix checklist

    See also

    +@@ -121,6 +122,23 @@ WebSocket always happens. + WebSocket requests as in httpd 2.4.46 and earlier.

    -+
    top
    +
    ++ +
    + @@ -40,21 +35,18 @@ index 21ffbe2..16e1628 100644

    Available Languages:  en  | diff --git a/modules/proxy/mod_proxy_wstunnel.c b/modules/proxy/mod_proxy_wstunnel.c -index 4aadbab..ca3ed3a 100644 +index 30ba1b4..e27e6f8 100644 --- a/modules/proxy/mod_proxy_wstunnel.c +++ b/modules/proxy/mod_proxy_wstunnel.c -@@ -18,6 +18,10 @@ - - module AP_MODULE_DECLARE_DATA proxy_wstunnel_module; - -+typedef struct { +@@ -22,6 +22,7 @@ module AP_MODULE_DECLARE_DATA proxy_wstunnel_module; + typedef struct { + unsigned int fallback_to_proxy_http :1, + fallback_to_proxy_http_set :1; + apr_time_t idle_timeout; -+} proxyws_dir_conf; -+ - /* - * Canonicalise http-like URLs. - * scheme is the scheme for the URL -@@ -108,6 +112,8 @@ static int proxy_wstunnel_request(apr_pool_t *p, request_rec *r, + } proxyws_dir_conf; + + static int can_fallback_to_proxy_http; +@@ -176,6 +177,8 @@ static int proxy_wstunnel_request(apr_pool_t *p, request_rec *r, conn_rec *c = r->connection; apr_socket_t *sock = conn->sock; conn_rec *backconn = conn->connection; @@ -63,7 +55,7 @@ index 4aadbab..ca3ed3a 100644 char *buf; apr_bucket_brigade *header_brigade; apr_bucket *e; -@@ -185,10 +191,13 @@ static int proxy_wstunnel_request(apr_pool_t *p, request_rec *r, +@@ -253,10 +256,13 @@ static int proxy_wstunnel_request(apr_pool_t *p, request_rec *r, c->keepalive = AP_CONN_CLOSE; do { /* Loop until done (one side closes the connection, or an error) */ @@ -78,7 +70,7 @@ index 4aadbab..ca3ed3a 100644 } ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(02444) "error apr_poll()"); return HTTP_INTERNAL_SERVER_ERROR; -@@ -366,6 +375,38 @@ cleanup: +@@ -442,11 +448,26 @@ cleanup: return status; } @@ -96,37 +88,22 @@ index 4aadbab..ca3ed3a 100644 + return NULL; +} + -+static void *create_proxyws_dir_config(apr_pool_t *p, char *dummy) -+{ -+ proxyws_dir_conf *new = -+ (proxyws_dir_conf *) apr_pcalloc(p, sizeof(proxyws_dir_conf)); -+ + static void *create_proxyws_dir_config(apr_pool_t *p, char *dummy) + { + proxyws_dir_conf *new = + (proxyws_dir_conf *) apr_pcalloc(p, sizeof(proxyws_dir_conf)); + + new->idle_timeout = -1; /* no timeout */ -+ -+ return (void *) new; -+} -+ -+static const command_rec ws_proxy_cmds[] = -+{ + new->fallback_to_proxy_http = 1; + + return (void *) new; +@@ -489,7 +510,8 @@ static const command_rec ws_proxy_cmds[] = + proxyws_fallback_to_proxy_http, NULL, RSRC_CONF|ACCESS_CONF, + "whether to let mod_proxy_http handle the upgrade and tunneling, " + "On by default"), +- + AP_INIT_TAKE1("ProxyWebsocketIdleTimeout", proxyws_set_idle, NULL, RSRC_CONF|ACCESS_CONF, + "timeout for activity in either direction, unlimited by default."), -+ -+ {NULL} -+}; -+ - static void ap_proxy_http_register_hook(apr_pool_t *p) - { - proxy_hook_scheme_handler(proxy_wstunnel_handler, NULL, NULL, APR_HOOK_FIRST); -@@ -374,10 +415,10 @@ static void ap_proxy_http_register_hook(apr_pool_t *p) - - AP_DECLARE_MODULE(proxy_wstunnel) = { - STANDARD20_MODULE_STUFF, -- NULL, /* create per-directory config structure */ -+ create_proxyws_dir_config, /* create per-directory config structure */ - NULL, /* merge per-directory config structures */ - NULL, /* create per-server config structure */ - NULL, /* merge per-server config structures */ -- NULL, /* command apr_table_t */ -+ ws_proxy_cmds, /* command apr_table_t */ - ap_proxy_http_register_hook /* register hooks */ + {NULL} }; + diff --git a/httpd-2.4.63.tar.bz2.asc b/httpd-2.4.63.tar.bz2.asc new file mode 100644 index 0000000..29fa960 --- /dev/null +++ b/httpd-2.4.63.tar.bz2.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEqT1i7MPI6hLbIg7JNOp25nkUhagFAmeOpZMACgkQNOp25nkU +hajzCg/+I/j8u/tCFeaQAf5ZKyGZ8Kcpxf+/lP4Kr79emBwdROZFGP+ipfuyRpax +A8/WXTeVs6bWmg5edPIQAC1mDpj7rx2Pwa7xKV+/3/npQMPV4cqgbZfzgQD2NnoD +8Qs6pkjwF6ygn+4y/KQLF5MIh4G0lIkx/ddt+lHbt2FkJXT5JV1cyJ+kKrTLJdlB +RDMXcF2XleFFzApf9VCYWFPTlgmxAe4FG65JMwxh3WJeiX0vrLH+GnOyAXHotBOs +NbXQKQD5cM6/JzA3F4Jni/2co9Wsjg+zENx3hIjxJZvVtXRIC4BpmAJOeQIyoNwo +VVwe3Uo9Cz+ZFTYMecwnR/B5tm4IkQ0K9MXRK/jxxKds4CF/bnt0BClaSRqXrJJW +hwciu0Yw9nsCCQbz+vwMKVMRtQ1m2/Cl3+9K/9RYwdgfTQmNYcu3J+19trvRx2Vf +OVtwFNm2tps2YtOV1NAnr2huHt257WVis9ElCOwIpUqwJZvzLCG2VaSq0vlYZqP8 +iQoQA25f9Ln34KdpF7BU2PO9LraFJNTHFIed3cd8L7U14H9iQ93mSUlibzY3HvK4 +B3qeXmsn3YpJpgsvhOUPR7mTlhOsPSIdRW0vuLOrN5Rz3uVWRG8vpjCeZCYSYWBf +4KzbwEZ6n9dfc2D5N6Yx3uTdmKhAg1O1ryk7E6Sp+pVybFQrzsc= +=ttO/ +-----END PGP SIGNATURE----- diff --git a/SOURCES/httpd-init.service b/httpd-init.service similarity index 100% rename from SOURCES/httpd-init.service rename to httpd-init.service diff --git a/SOURCES/httpd-ssl-gencerts b/httpd-ssl-gencerts similarity index 100% rename from SOURCES/httpd-ssl-gencerts rename to httpd-ssl-gencerts diff --git a/SOURCES/httpd-ssl-pass-dialog b/httpd-ssl-pass-dialog similarity index 100% rename from SOURCES/httpd-ssl-pass-dialog rename to httpd-ssl-pass-dialog diff --git a/SOURCES/httpd.conf b/httpd.conf similarity index 98% rename from SOURCES/httpd.conf rename to httpd.conf index 6ab68cb..609b2e2 100644 --- a/SOURCES/httpd.conf +++ b/httpd.conf @@ -38,8 +38,10 @@ ServerRoot "/etc/httpd" # ports, instead of the default. See also the # directive. # -# Change this to Listen on specific IP addresses as shown below to -# prevent Apache from glomming onto all bound IP addresses. +# Change this to Listen on a specific IP address, but note that if +# httpd.service is enabled to run at boot time, the address may not be +# available when the service starts. See the httpd.service(8) man +# page for more information. # #Listen 12.34.56.78:80 Listen 80 diff --git a/SOURCES/httpd.conf.xml b/httpd.conf.xml similarity index 94% rename from SOURCES/httpd.conf.xml rename to httpd.conf.xml index 705e527..13e5d69 100644 --- a/SOURCES/httpd.conf.xml +++ b/httpd.conf.xml @@ -71,7 +71,7 @@ appropriate directive so that module is loaded by default. - Some notable configured defaults are:. + Some notable configured defaults are: @@ -81,7 +81,7 @@ - The daemon lists on TCP port 80. + The daemon listens on TCP port 80. @@ -129,12 +129,12 @@ Module configuration files Module configuration files are provided in the - /etc/httpd/conf.modules.d/ directory. Filenames - in this directory are by convention prefixed with two digit numeric - prefix to ensure they are processed in the desired order. Core - modules provide with the httpd package are - loaded by files with a prefix to ensure - these are loaded first. Only filenames with a + /etc/httpd/conf.modules.d/ directory. + Filenames in this directory are by convention prefixed with two + digit numeric prefix to ensure they are processed in the desired + order. Core modules provided with the httpd + package are loaded by files with a prefix + to ensure these load first. Only filenames with a suffix in this directory will be processed. @@ -160,8 +160,8 @@ /etc/httpd/conf.modules.d/00-systemd.conf This file loads which is necessary for the correct operation of the - httpd.service service, and should not be - removed or disabled. + httpd.service systemd unit, and should + not be removed or disabled. diff --git a/SOURCES/httpd.logrotate b/httpd.logrotate similarity index 58% rename from SOURCES/httpd.logrotate rename to httpd.logrotate index 28c9730..c5a008c 100644 --- a/SOURCES/httpd.logrotate +++ b/httpd.logrotate @@ -1,3 +1,5 @@ +# Note that logs are not compressed unless "compress" is configured, +# which can be done either here or globally in /etc/logrotate.conf. /var/log/httpd/*log { missingok notifempty diff --git a/SOURCES/httpd.service b/httpd.service similarity index 70% rename from SOURCES/httpd.service rename to httpd.service index 6ff4e8b..b75e28c 100644 --- a/SOURCES/httpd.service +++ b/httpd.service @@ -26,7 +26,25 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful # Send SIGWINCH for graceful stop KillSignal=SIGWINCH KillMode=mixed +DevicePolicy=closed +KeyringMode=private +LockPersonality=yes +MemoryDenyWriteExecute=yes +OOMPolicy=continue +PrivateDevices=yes PrivateTmp=true +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=read-only +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=yes +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native [Install] WantedBy=multi-user.target diff --git a/SOURCES/httpd.service.xml b/httpd.service.xml similarity index 78% rename from SOURCES/httpd.service.xml rename to httpd.service.xml index b2c72dd..f8ec343 100644 --- a/SOURCES/httpd.service.xml +++ b/httpd.service.xml @@ -175,12 +175,17 @@ Wants=network-online.target System packages (including the httpd package itself) may restart the httpd service automatically after packages are upgraded, installed, or removed. This is done using the - systemctl reload httpd.service, which - produces a graceful restart by default as - described above. + systemctl try-restart httpd.service command, which + stops then starts the service if it is running. - To suppress automatic reloads entirely, create the file - /etc/sysconfig/httpd-disable-posttrans. + To disable automatic restarts, create the file + /etc/sysconfig/httpd-disable-posttrans. + When httpd interfaces are added in an update, + it may not be safe to reload a running + service after upgrading, if updated modules require interfaces + only available in the updated httpd binary. + It is recommended to allow automatic restarts for this + reason. @@ -221,15 +226,69 @@ Wants=network-online.target types. See httpd_selinux8 for more information. + - The httpd service enables PrivateTmp - by default. The /tmp and - /var/tmp directories available within the - httpd process (and CGI scripts, etc) are not shared by other - processes. See + + Process policies and restrictions + + The httpd.service unit enables a + variety of sandboxing options. Many of these prevent the service + from changing the system configuration or attributes of the + kernel - such as ProtectClock and + ProtectKernelModules. See systemd.exec5 - for more information. + and + systemd.service5 + for more information on these options. Particular notice should + be taken of the following: + + PrivateTmp is enabled by + default. The /tmp and + /var/tmp directories available within the + httpd process (and CGI scripts, etc) are not shared by other + processes. + + OOMPolicy is set to + continue by default. Under the default + Out-of-Memory policy, the entire service will be terminated if + any process is killed by the kernel OOM killer. By setting + the policy to continue, httpd will + continue to run (and recover) if a single child is terminated + because of excess memory consumption. + + ProtectHome is set to + read-only by default. CGI scripts run via + UserDir will not be able modify any + content in /home by + default. + + ProtectSystem is set to + yes by default; this mounts various + system paths like /usr and + /boot as read-only by + default. + + + + + + + Logging and log file rotation + + The httpd daemon is configured to log + to the /var/log/httpd directory by default, + and a drop-in for logrotate is provided at + /etc/logrotate.d/httpd to enable log file + rotation. The httpd.service systemd unit is + reloaded after a logrotate run. + + Log file compression is not enabled by default; since + httpd can continue writing to open log files + for some time after a reload (graceful restart), if compression + is enabled the delaycompress option must be + present (as in the default) to delay compression of log files to + a later rotation run. @@ -260,9 +319,9 @@ Wants=network-online.target Instantiated services - The httpd@.service unit is an - instantiated template service. An instance of this unit will be - started using the configuration file + The httpd@.service unit is a template + for creating instantiated services. An instance of this unit + will be started using the configuration file /etc/httpd/conf/INSTANCE.conf, where INSTANCE is replaced with the instance name. For example, systemctl start @@ -280,7 +339,7 @@ Wants=network-online.target paths, and Listen to choose different ports. The example configuration file /usr/share/doc/httpd/instance.conf - demonstrates how to make such changes using + demonstrates how to make such changes using the variable. It can be useful to configure instances of @@ -322,7 +381,8 @@ ReloadPropagatedFrom=httpd.service systemd.exec5, systemd.socket5, httpd_selinux8, - semanage8 + semanage8, + logrotate8 diff --git a/SOURCES/httpd.socket b/httpd.socket similarity index 100% rename from SOURCES/httpd.socket rename to httpd.socket diff --git a/SPECS/httpd.spec b/httpd.spec similarity index 50% rename from SPECS/httpd.spec rename to httpd.spec index 96816e1..c2659f1 100644 --- a/SPECS/httpd.spec +++ b/httpd.spec @@ -4,349 +4,193 @@ %define mmn 20120211 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits} %define vstring %(source /etc/os-release; echo ${NAME}) +%define bugurl %(source /etc/os-release; echo ${BUG_REPORT_URL}) %if 0%{?fedora} > 26 || 0%{?rhel} > 7 %global mpm event %else %global mpm prefork %endif +%if 0%{?fedora} > 35 || 0%{?rhel} > 9 +%bcond_without pcre2 +%bcond_with pcre +%else +%bcond_with pcre2 +%bcond_without pcre +%endif + +# Similar issue to https://bugzilla.redhat.com/show_bug.cgi?id=2043092 +%undefine _package_note_flags + Summary: Apache HTTP Server Name: httpd -Version: 2.4.37 -Release: 65%{?dist}.3 +Version: 2.4.63 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 -Source2: httpd.logrotate -Source3: instance.conf -Source4: httpd-ssl-pass-dialog -Source5: httpd.tmpfiles -Source6: httpd.service -Source7: action-graceful.sh -Source8: action-configtest.sh -Source10: httpd.conf -Source11: 00-base.conf -Source12: 00-mpm.conf -Source13: 00-lua.conf -Source14: 01-cgi.conf -Source15: 00-dav.conf -Source16: 00-proxy.conf -Source17: 00-ssl.conf -Source18: 01-ldap.conf -Source19: 00-proxyhtml.conf -Source20: userdir.conf -Source21: ssl.conf -Source22: welcome.conf -Source23: manual.conf -Source24: 00-systemd.conf -Source25: 01-session.conf -Source26: 10-listen443.conf -Source27: httpd.socket -Source28: 00-optional.conf -# Documentation +Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc +# gpg key file downloaded and verified by luhliarik +# https://httpd.apache.org/dev/verification.html +Source2: https://dist.apache.org/repos/dist/release/httpd/KEYS +Source3: httpd.logrotate +Source4: instance.conf +Source5: httpd-ssl-pass-dialog +Source6: httpd.tmpfiles +Source7: httpd.service +Source8: action-graceful.sh +Source9: action-configtest.sh +Source10: server-status.conf +Source11: httpd.conf +Source12: 00-base.conf +Source13: 00-mpm.conf +Source14: 00-lua.conf +Source15: 01-cgi.conf +Source16: 00-dav.conf +Source17: 00-proxy.conf +Source18: 00-ssl.conf +Source19: 01-ldap.conf +Source20: 00-proxyhtml.conf +Source21: userdir.conf +Source22: ssl.conf +Source23: welcome.conf +Source24: manual.conf +Source25: 00-systemd.conf +Source26: 01-session.conf +Source27: 10-listen443.conf +Source28: httpd.socket +Source29: 00-optional.conf Source30: README.confd Source31: README.confmod Source32: httpd.service.xml Source33: htcacheclean.service.xml Source34: httpd.conf.xml +Source35: 00-brotli.conf Source40: htcacheclean.service Source41: htcacheclean.sysconf Source42: httpd-init.service Source43: httpd-ssl-gencerts Source44: httpd@.service Source45: config.layout -Source46: apache-poweredby.png +Source46: apachectl.sh +Source47: apachectl.xml +Source48: apache-poweredby.png +Source49: httpd.sysusers # build/scripts patches -# http://bugzilla.redhat.com/show_bug.cgi?id=1231924 -# http://bugzilla.redhat.com/show_bug.cgi?id=842736 -# http://bugzilla.redhat.com/show_bug.cgi?id=1214401 -Patch1: httpd-2.4.35-apachectl.patch -Patch2: httpd-2.4.28-apxs.patch -Patch3: httpd-2.4.35-deplibs.patch - +Patch1: httpd-2.4.59-full-release.patch +Patch2: httpd-2.4.43-apxs.patch +Patch3: httpd-2.4.43-deplibs.patch # Needed for socket activation and mod_systemd patch -Patch19: httpd-2.4.35-detect-systemd.patch - +Patch19: httpd-2.4.53-detect-systemd.patch # Features/functional changes -Patch20: httpd-2.4.32-export.patch -Patch21: httpd-2.4.35-corelimit.patch -Patch22: httpd-2.4.35-selinux.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1170215 -Patch23: httpd-2.4.28-icons.patch -Patch24: httpd-2.4.35-systemd.patch -Patch25: httpd-2.4.35-cachehardmax.patch -Patch26: httpd-2.4.28-socket-activation.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1109119 -Patch27: httpd-2.4.35-sslciphdefault.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1332242 -Patch28: httpd-2.4.28-statements-comment.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=811714 -Patch29: httpd-2.4.35-full-release.patch -Patch30: httpd-2.4.35-freebind.patch -Patch31: httpd-2.4.35-r1830819+.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1638738 -Patch32: httpd-2.4.37-sslprotdefault.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1747898 -Patch33: httpd-2.4.37-mod-md-mod-ssl-hooks.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1725031 -Patch34: httpd-2.4.37-r1861793+.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1704317 -Patch35: httpd-2.4.37-sslkeylogfile-support.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1794728 -Patch36: httpd-2.4.37-session-expiry-updt-int.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1209162 -Patch37: httpd-2.4.37-logjournal.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1869576 -Patch38: httpd-2.4.37-pr37355.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1896176 -Patch39: httpd-2.4.37-proxy-ws-idle-timeout.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1883648 -Patch40: httpd-2.4.37-ssl-proxy-chains.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1935742 -Patch41: httpd-2.4.37-usertrack-samesite.patch +Patch20: httpd-2.4.48-r1842929+.patch +Patch21: httpd-2.4.43-mod_systemd.patch +Patch22: httpd-2.4.53-export.patch +Patch23: httpd-2.4.43-corelimit.patch +Patch24: httpd-2.4.54-icons.patch +Patch25: httpd-2.4.43-cachehardmax.patch +Patch26: httpd-2.4.43-socket-activation.patch +Patch27: httpd-2.4.43-sslciphdefault.patch +Patch29: httpd-2.4.43-sslprotdefault.patch +Patch30: httpd-2.4.43-logjournal.patch +Patch31: httpd-2.4.53-separate-systemd-fns.patch +Patch32: httpd-2.4.54-selinux.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=1949606 +Patch33: httpd-2.4.62-freebind.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=1947496 +Patch34: httpd-2.4.62-proxy-ws-idle-timeout.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 -Patch61: httpd-2.4.35-r1738878.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1170206 -Patch62: httpd-2.4.35-r1633085.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1448892 -Patch63: httpd-2.4.28-r1811831.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1602548 -Patch65: httpd-2.4.35-r1842888.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1653009 -# https://bugzilla.redhat.com/show_bug.cgi?id=1672977 -# https://bugzilla.redhat.com/show_bug.cgi?id=1673022 -Patch66: httpd-2.4.37-r1842929+.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1630432 -Patch67: httpd-2.4.35-r1825120.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1670716 -Patch68: httpd-2.4.37-fips-segfault.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1669221 -Patch70: httpd-2.4.37-r1840554.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1673022 -Patch71: httpd-2.4.37-mod-md-perms.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1724549 -Patch72: httpd-2.4.37-mod-mime-magic-strdup.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1724034 -Patch73: httpd-2.4.35-ocsp-wrong-ctx.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1633224 -Patch74: httpd-2.4.37-r1828172+.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1775158 -Patch75: httpd-2.4.37-r1870095+.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1771847 -Patch76: httpd-2.4.37-proxy-continue.patch -Patch77: httpd-2.4.37-balancer-failover.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1875844 -Patch78: httpd-2.4.37-r1881459.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1891829 -Patch79: httpd-2.4.37-r1864000.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1868608 -Patch80: httpd-2.4.37-r1872790.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1861380 -Patch81: httpd-2.4.37-r1879224.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1680118 -Patch82: httpd-2.4.37-r1877397.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1847585 -Patch83: httpd-2.4.37-r1878890.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1918741 -Patch84: httpd-2.4.37-r1878280.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1891594 -Patch85: httpd-2.4.37-htcacheclean-dont-break.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1937334 -Patch86: httpd-2.4.37-r1873907.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1680111 -Patch87: httpd-2.4.37-reply-two-tls-rec.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1905613 -Patch88: httpd-2.4.37-r1845768+.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2001046 -Patch89: httpd-2.4.37-r1862410.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1984828 -Patch90: httpd-2.4.37-hcheck-mem-issues.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2017543 -Patch91: httpd-2.4.37-add-SNI-support.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2159603 -Patch92: httpd-2.4.37-mod_status-duplicate-key.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2221083 -Patch93: httpd-2.4.37-r1885607.patch -# https://issues.redhat.com/browse/RHEL-14321 -Patch94: httpd-2.4.57-r1884505+.patch -# https://bz.apache.org/bugzilla/show_bug.cgi?id=69197 -Patch95: httpd-2.4.37-r1919325.patch -# https://issues.redhat.com/browse/RHEL-56068 -Patch96: httpd-2.4.37-r1922080.patch +Patch60: httpd-2.4.43-enable-sslv3.patch +Patch61: httpd-2.4.59-no-engine.patch # Security fixes -Patch200: httpd-2.4.37-r1851471.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1694980 -Patch201: httpd-2.4.37-CVE-2019-0211.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1695025 -Patch202: httpd-2.4.37-CVE-2019-0215.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1696141 -Patch203: httpd-2.4.37-CVE-2019-0217.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1696097 -Patch204: httpd-2.4.37-CVE-2019-0220.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1741860 -# https://bugzilla.redhat.com/show_bug.cgi?id=1741864 -# https://bugzilla.redhat.com/show_bug.cgi?id=1741868 -Patch205: httpd-2.4.34-CVE-2019-9511-and-9516-and-9517.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1823259 -# https://bugzilla.redhat.com/show_bug.cgi?id=1747284 -# fixes both CVE-2020-1927 and CVE-2019-10098 -Patch206: httpd-2.4.37-CVE-2019-10098.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1747281 -Patch207: httpd-2.4.37-CVE-2019-10092.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1747291 -Patch208: httpd-2.4.37-CVE-2019-10097.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1820772 -Patch209: httpd-2.4.37-CVE-2020-1934.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1668493 -Patch210: httpd-2.4.37-CVE-2018-17199.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1866563 -Patch211: httpd-2.4.37-CVE-2020-11984.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1972500 -Patch212: httpd-2.4.37-CVE-2021-30641.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1968307 -Patch213: httpd-2.4.37-CVE-2021-26690.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2005117 -Patch214: httpd-2.4.37-CVE-2021-40438.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1966732 -Patch215: httpd-2.4.37-CVE-2021-26691.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1968278 -Patch216: httpd-2.4.37-CVE-2020-35452.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2005128 -Patch217: httpd-2.4.37-CVE-2021-34798.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2005119 -Patch218: httpd-2.4.37-CVE-2021-39275.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2005124 -Patch219: httpd-2.4.37-CVE-2021-36160.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1966728 -Patch220: httpd-2.4.37-CVE-2021-33193.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2034674 -Patch221: httpd-2.4.37-CVE-2021-44790.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2034672 -Patch222: httpd-2.4.37-CVE-2021-44224.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2064321 -Patch223: httpd-2.4.37-CVE-2022-22720.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1966738 -Patch224: httpd-2.4.37-CVE-2020-13950.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2064322 -Patch225: httpd-2.4.37-CVE-2022-22719.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2064320 -Patch226: httpd-2.4.37-CVE-2022-22721.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2065324 -Patch227: httpd-2.4.37-CVE-2022-23943.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2095002 -Patch228: httpd-2.4.37-CVE-2022-28614.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2095006 -Patch229: httpd-2.4.37-CVE-2022-28615.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2095015 -Patch230: httpd-2.4.37-CVE-2022-30522.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2095018 -Patch231: httpd-2.4.37-CVE-2022-30556.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2095020 -Patch232: httpd-2.4.37-CVE-2022-31813.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2095012 -Patch233: httpd-2.4.37-CVE-2022-29404.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2094997 -Patch234: httpd-2.4.37-CVE-2022-26377.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2161773 -Patch235: httpd-2.4.37-CVE-2022-37436.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2161774 -Patch236: httpd-2.4.37-CVE-2006-20001.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2161777 -Patch237: httpd-2.4.37-CVE-2022-36760.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2176209 -Patch238: httpd-2.4.37-CVE-2023-25690.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2176211 -Patch239: httpd-2.4.37-CVE-2023-27522.patch -# https://issues.redhat.com/browse/RHEL-14448 -Patch240: httpd-2.4.37-CVE-2023-31122.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2273491 -Patch241: httpd-2.4.37-CVE-2023-38709.patch -# CVE-2024-38474 and CVE-2024-38475 fixed in one patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2295013 -# https://bugzilla.redhat.com/show_bug.cgi?id=2295014 -Patch242: httpd-2.4.37-CVE-2024-38474+.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2295012 -Patch243: httpd-2.4.37-CVE-2024-38473.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2295016 -Patch244: httpd-2.4.37-CVE-2024-38477.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2295022 -Patch245: httpd-2.4.37-CVE-2024-39573.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2295015 -Patch246: httpd-2.4.37-CVE-2024-38476.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2297362 -# https://bugzilla.redhat.com/show_bug.cgi?id=2295761 -Patch247: httpd-2.4.37-CVE-2024-39884+.patch +# Patch200: ... -License: ASL 2.0 -Group: System Environment/Daemons -BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root -BuildRequires: autoconf, perl-interpreter, perl-generators, pkgconfig, findutils, xmlto -BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel -BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0 -BuildRequires: systemd-devel -# web server testpage added to redhat-logos in 82.0 (rhbz1896319) -# new logo requires new footer copyring which was added in rhbz1934800 -Requires: /etc/mime.types, system-logos(httpd-logo-ng) -Obsoletes: httpd-suexec +# Apache-2.0: everything +# BSD-3-Clause: util_pcre.c, ap_regex.h +# metamail AND HPND-sell-variant:: server/util_md5.c: +# Spencer-94: modules/metadata/mod_mime_magic.c +License: Apache-2.0 AND (BSD-3-Clause AND metamail AND HPND-sell-variant AND Spencer-94) + +BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto +BuildRequires: perl-interpreter, perl-generators, systemd-devel +BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel +BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0 +BuildRequires: openldap-devel +BuildRequires: systemd-rpm-macros +%if %{with pcre2} +BuildRequires: pcre2-devel +%endif +%if %{with pcre} +BuildRequires: pcre-devel > 5.0 +%endif +BuildRequires: gnupg2 +Requires: system-logos(httpd-logo-ng) Provides: webserver -Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} -Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa} -Requires: httpd-tools = %{version}-%{release} -Requires: httpd-filesystem = %{version}-%{release} -Requires: mod_http2 >= 1.15.7-5 -Requires(pre): httpd-filesystem -Requires(preun): systemd-units -Requires(postun): systemd-units -Requires(post): systemd-units -Conflicts: apr < 1.5.0-1 +Requires: httpd-core = 0:%{version}-%{release} +Recommends: mod_http2, mod_lua +%{?systemd_requires} %description The Apache HTTP Server is a powerful, efficient, and extensible web server. +%package core +Summary: httpd minimal core +Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} +Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa} +Provides: mod_proxy_uwsgi = %{version}-%{release} +Requires: /etc/mime.types +Requires: httpd-tools = %{version}-%{release} +Requires: httpd-filesystem = %{version}-%{release} +%if 0%{?fedora} > 39 || 0%{?rhel} > 9 +Requires: apr-util-1(dbm)%{_isa} +%endif +Requires(pre): httpd-filesystem +Conflicts: apr < 1.5.0-1 +Conflicts: httpd < 2.4.53-2 +Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2 + +%description core +The httpd-core package contains essential httpd binaries. + %package devel -Group: Development/Libraries -Summary: Development interfaces for the Apache HTTP server -Requires: apr-devel, apr-util-devel, pkgconfig -Requires: httpd = %{version}-%{release} +Summary: Development interfaces for the Apache HTTP Server +Requires: apr-devel, apr-util-devel, pkgconfig, libtool +Requires: httpd-core = 0:%{version}-%{release} %description devel The httpd-devel package contains the APXS binary and other files that you need to build Dynamic Shared Objects (DSOs) for the Apache HTTP Server. -If you are installing the Apache HTTP server and you want to be +If you are installing the Apache HTTP Server and you want to be able to compile or develop additional modules for Apache, you need to install this package. %package manual -Group: Documentation -Summary: Documentation for the Apache HTTP server -Requires: httpd = %{version}-%{release} -Obsoletes: secureweb-manual, apache-manual +Summary: Documentation for the Apache HTTP Server +Requires: httpd-core = 0:%{version}-%{release} BuildArch: noarch %description manual The httpd-manual package contains the complete manual and -reference guide for the Apache HTTP server. The information can -also be found at http://httpd.apache.org/docs/2.2/. +reference guide for the Apache HTTP Server. The information can +also be found at https://httpd.apache.org/docs/2.4/. %package filesystem -Group: System Environment/Daemons -Summary: The basic directory layout for the Apache HTTP server +Summary: The basic directory layout for the Apache HTTP Server BuildArch: noarch -Requires(pre): /usr/sbin/useradd +%{?sysusers_requires_compat} %description filesystem The httpd-filesystem package contains the basic directory layout -for the Apache HTTP server including the correct permissions +for the Apache HTTP Server including the correct permissions for the directories. %package tools -Group: System Environment/Daemons Summary: Tools for use with the Apache HTTP Server %description tools @@ -354,27 +198,27 @@ The httpd-tools package contains tools which can be used with the Apache HTTP Server. %package -n mod_ssl -Group: System Environment/Daemons Summary: SSL/TLS module for the Apache HTTP Server Epoch: 1 BuildRequires: openssl-devel Requires(pre): httpd-filesystem -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} -Requires: sscg >= 3.0.0-7, /usr/bin/hostname -Obsoletes: stronghold-mod_ssl +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: sscg >= 3.0.3, /usr/bin/hostname # Require an OpenSSL which supports PROFILE=SYSTEM Conflicts: openssl-libs < 1:1.0.1h-4 +# mod_ssl/mod_nss cannot both be loaded simultaneously +Conflicts: mod_nss %description -n mod_ssl -The mod_ssl module provides strong cryptography for the Apache Web +The mod_ssl module provides strong cryptography for the Apache HTTP server via the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. %package -n mod_proxy_html -Group: System Environment/Daemons Summary: HTML and XML content filters for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} BuildRequires: libxml2-devel +BuildRequires: make Epoch: 1 Obsoletes: mod_proxy_html < 1:2.4.1-2 @@ -383,9 +227,8 @@ The mod_proxy_html and mod_xml2enc modules provide filters which can transform and modify HTML and XML content. %package -n mod_ldap -Group: System Environment/Daemons Summary: LDAP authentication modules for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} Requires: apr-util-ldap %description -n mod_ldap @@ -393,130 +236,24 @@ The mod_ldap and mod_authnz_ldap modules add support for LDAP authentication to the Apache HTTP Server. %package -n mod_session -Group: System Environment/Daemons Summary: Session interface for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} %description -n mod_session The mod_session module and associated backends provide an abstract interface for storing and accessing per-user session data. +%package -n mod_lua +Summary: Lua scripting support for the Apache HTTP Server +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} + +%description -n mod_lua +The mod_lua module allows the server to be extended with scripts +written in the Lua programming language. + %prep -%setup -q -%patch1 -p1 -b .apctl -%patch2 -p1 -b .apxs -%patch3 -p1 -b .deplibs - -%patch19 -p1 -b .detectsystemd -%patch20 -p1 -b .export -%patch21 -p1 -b .corelimit -%patch22 -p1 -b .selinux -%patch23 -p1 -b .icons -%patch24 -p1 -b .systemd -%patch25 -p1 -b .cachehardmax -%patch26 -p1 -b .socketactivation -%patch27 -p1 -b .sslciphdefault -%patch28 -p1 -b .statementscomment -%patch29 -p1 -b .fullrelease -%patch30 -p1 -b .freebind -%patch31 -p1 -b .r1830819+ -%patch32 -p1 -b .sslprotdefault -%patch33 -p1 -b .mod-md-mod-ssl-hooks -%patch34 -p1 -b .r1861793+ -%patch35 -p1 -b .sslkeylogfile-support -%patch36 -p1 -b .session-expiry -%patch37 -p1 -b .logjournal -%patch38 -p1 -b .pr37355 -%patch39 -p1 -b .proxy-ws-idle-timeout -%patch40 -p1 -b .ssl-proxy-chains -%patch41 -p1 -b .usertrack-samesite - -%patch61 -p1 -b .r1738878 -%patch62 -p1 -b .r1633085 -%patch63 -p1 -b .r1811831 -%patch65 -p1 -b .r1842888 -%patch66 -p1 -b .r1842929+ -%patch67 -p1 -b .r1825120 -%patch68 -p1 -b .fipscore -%patch70 -p1 -b .r1840554 -%patch71 -p1 -b .modmdperms -%patch72 -p1 -b .mimemagic -%patch73 -p1 -b .ocspwrongctx -%patch74 -p1 -b .r1828172+ -%patch75 -p1 -b .r1870095+ -%patch76 -p1 -b .proxy-continue -%patch77 -p1 -b .balancer-failover -%patch78 -p1 -b .r1881459 -%patch79 -p1 -b .r1864000 -%patch80 -p1 -b .r1872790 -%patch81 -p1 -b .r1879224 -%patch82 -p1 -b .r1877397 -%patch83 -p1 -b .r1878890 -%patch84 -p1 -b .r1878280 -%patch85 -p1 -b .htcacheclean-dont-break -%patch86 -p1 -b .r1873907 -%patch87 -p1 -b .reply-two-tls-rec -%patch88 -p1 -b .r1845768+ -%patch89 -p1 -b .r1862410 -%patch90 -p1 -b .hcheck-mem-issues -%patch91 -p1 -b .SNI -%patch92 -p1 -b .mod_status-dupl -%patch93 -p1 -b .r1885607 -%patch94 -p1 -b .r1884505+ - -%patch200 -p1 -b .r1851471 -%patch201 -p1 -b .CVE-2019-0211 -%patch202 -p1 -b .CVE-2019-0215 -%patch203 -p1 -b .CVE-2019-0217 -%patch204 -p1 -b .CVE-2019-0220 -%patch205 -p1 -b .CVE-2019-9511-and-9516-and-9517 -%patch206 -p1 -b .CVE-2019-10098 -%patch207 -p1 -b .CVE-2019-10092 -%patch208 -p1 -b .CVE-2019-10097 -%patch209 -p1 -b .CVE-2020-1934 -%patch210 -p1 -b .CVE-2018-17199 -%patch211 -p1 -b .CVE-2020-11984 -%patch212 -p1 -b .CVE-2021-30641 -%patch213 -p1 -b .CVE-2021-26690 -%patch214 -p1 -b .CVE-2021-40438 -%patch215 -p1 -b .CVE-2021-26691 -%patch216 -p1 -b .CVE-2020-35452 -%patch217 -p1 -b .CVE-2021-34798 -%patch218 -p1 -b .CVE-2021-39275 -%patch219 -p1 -b .CVE-2021-36160 -%patch220 -p1 -b .CVE-2021-33193 -%patch221 -p1 -b .CVE-2021-44790 -%patch222 -p1 -b .CVE-2021-44224 -%patch223 -p1 -b .CVE-2022-22720 -%patch224 -p1 -b .CVE-2020-13950 -%patch225 -p1 -b .CVE-2022-22719 -%patch226 -p1 -b .CVE-2022-22721 -%patch227 -p1 -b .CVE-2022-23943 -%patch228 -p1 -b .CVE-2022-28614 -%patch229 -p1 -b .CVE-2022-28615 -%patch230 -p1 -b .CVE-2022-30522 -%patch231 -p1 -b .CVE-2022-30556 -%patch232 -p1 -b .CVE-2022-31813 -%patch233 -p1 -b .CVE-2022-29404 -%patch234 -p1 -b .CVE-2022-26377 -%patch235 -p1 -b .CVE-2022-37436 -%patch236 -p1 -b .CVE-2006-20001 -%patch237 -p1 -b .CVE-2022-36760 -%patch238 -p1 -b .CVE-2023-25690 -%patch239 -p1 -b .CVE-2023-27522 -%patch240 -p1 -b .CVE-2023-31122 -%patch241 -p1 -b .CVE-2023-38709 -%patch242 -p1 -b .CVE-2024-38474+ -%patch243 -p1 -b .CVE-2024-38473 -%patch244 -p1 -b .CVE-2024-38477 -%patch245 -p1 -b .CVE-2024-39573 - -# CVE-2024-38474 regression fix -%patch95 -p1 -b .r1919325 -%patch246 -p1 -b .CVE-2024-38476 -%patch247 -p1 -b .CVE-2024-39884+ - -%patch96 -p1 -b .r1922080 +%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' +%autosetup -p1 -S gendiff # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -534,6 +271,7 @@ sed < $RPM_SOURCE_DIR/httpd.conf >> instance.conf ' /^ *ErrorLog .logs/s,logs/,logs/${HTTPD_INSTANCE}_, ' touch -r $RPM_SOURCE_DIR/instance.conf instance.conf +cp -p $RPM_SOURCE_DIR/server-status.conf server-status.conf # Safety check: prevent build if defined MMN does not equal upstream MMN. vmmn=`echo MODULE_MAGIC_NUMBER_MAJOR | cpp -include include/ap_mmn.h | sed -n '/^2/p'` @@ -544,7 +282,7 @@ if test "x${vmmn}" != "x%{mmn}"; then fi # A new logo which comes together with a new test page -cp %{SOURCE46} ./docs/icons/apache_pb3.png +cp %{SOURCE48} ./docs/icons/apache_pb3.png # Provide default layout cp $RPM_SOURCE_DIR/config.layout . @@ -555,13 +293,16 @@ s,@DOCROOT@,%{docroot},g s,@LOGDIR@,%{_localstatedir}/log/httpd,g ' < $RPM_SOURCE_DIR/httpd.conf.xml \ > httpd.conf.xml +sed 's|@BUG_REPORT_URL@|%{bugurl}|g' < $RPM_SOURCE_DIR/apachectl.xml > apachectl.xml xmlto man ./httpd.conf.xml xmlto man $RPM_SOURCE_DIR/htcacheclean.service.xml xmlto man $RPM_SOURCE_DIR/httpd.service.xml +xmlto man apachectl.xml : Building with MMN %{mmn}, MMN-ISA %{mmnisa} : Default MPM is %{mpm}, vendor string is '%{vstring}' +: Regex Engine: PCRE=%{with pcre} PCRE2=%{with pcre2} %build # forcibly prevent use of bundled apr, apr-util, pcre @@ -574,11 +315,7 @@ autoheader && autoconf || exit 1 %{__perl} -pi -e "s:\@exp_installbuilddir\@:%{_libdir}/httpd/build:g" \ support/apxs.in -export CFLAGS=$RPM_OPT_FLAGS -export LDFLAGS="-Wl,-z,relro,-z,now" - -# Hard-code path to links to avoid unnecessary builddep -export LYNX_PATH=/usr/bin/links +%set_build_flags # Build the daemon ./configure \ @@ -606,26 +343,39 @@ export LYNX_PATH=/usr/bin/links --with-suexec-uidmin=1000 --with-suexec-gidmin=1000 \ --with-brotli \ --enable-pie \ - --with-pcre \ +%if %{with pcre2} + --with-pcre2=%{_bindir}/pcre2-config \ +%endif +%if %{with pcre} + --with-pcre=%{_bindir}/pcre-config \ +%endif --enable-mods-shared=all \ --enable-ssl --with-ssl --disable-distcache \ --enable-proxy --enable-proxy-fdpass \ --enable-cache \ --enable-disk-cache \ --enable-ldap --enable-authnz-ldap \ - --enable-cgid --enable-cgi \ + --enable-cgid --enable-cgi --enable-authnz-fcgi \ --enable-cgid-fdpassing \ --enable-authn-anon --enable-authn-alias \ + --enable-systemd \ --disable-imagemap --disable-file-cache \ --disable-http2 \ --disable-md \ $* -make %{?_smp_mflags} + +if grep -q ac_cv_have_threadsafe_pollset=no config.log; then + cat config.log + : Failed to find thread-safe APR. + exit 1 +fi + +%make_build %install rm -rf $RPM_BUILD_ROOT -make DESTDIR=$RPM_BUILD_ROOT install +%make_install # Install systemd service files mkdir -p $RPM_BUILD_ROOT%{_unitdir} @@ -644,7 +394,8 @@ install -m 644 $RPM_SOURCE_DIR/README.confmod \ $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/README for f in 00-base.conf 00-mpm.conf 00-lua.conf 01-cgi.conf 00-dav.conf \ 00-proxy.conf 00-ssl.conf 01-ldap.conf 00-proxyhtml.conf \ - 01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf; do + 01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf \ + 00-brotli.conf; do install -m 644 -p $RPM_SOURCE_DIR/$f \ $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/$f done @@ -657,8 +408,9 @@ touch -r $RPM_SOURCE_DIR/00-mpm.conf \ # install systemd override drop directory # Web application packages can drop snippets into this location if # they need ExecStart[pre|post]. -mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d -mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d +mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d \ + $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/httpd.service.d install -m 644 -p $RPM_SOURCE_DIR/10-listen443.conf \ $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d/10-listen443.conf @@ -691,19 +443,22 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.tmpfiles \ $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d/httpd.conf # Other directories -mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/dav \ - $RPM_BUILD_ROOT%{_localstatedir}/lib/httpd \ +mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/httpd \ $RPM_BUILD_ROOT/run/httpd/htcacheclean # Substitute in defaults which are usually done (badly) by "make install" sed -i \ - "s,@@ServerRoot@@/var,%{_localstatedir}/lib/dav,; + "/^DavLockDB/d; s,@@ServerRoot@@/user.passwd,/etc/httpd/conf/user.passwd,; s,@@ServerRoot@@/docs,%{docroot},; s,@@ServerRoot@@,%{docroot},; s,@@Port@@,80,;" \ docs/conf/extra/*.conf +# Set correct path for httpd binary in apachectl script +sed 's,@HTTPDBIN@,%{_sbindir}/httpd,g' $RPM_SOURCE_DIR/apachectl.sh \ + > apachectl.sh + # Create cache directory mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/cache/httpd \ $RPM_BUILD_ROOT%{_localstatedir}/cache/httpd/proxy \ @@ -714,17 +469,22 @@ echo %{mmnisa} > $RPM_BUILD_ROOT%{_includedir}/httpd/.mmn mkdir -p $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d cat > $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d/macros.httpd <= 9 +ln -s ../../pixmaps/system-noindex-logo.png \ + $RPM_BUILD_ROOT%{contentdir}/icons/system_noindex_logo.png +%endif + # symlinks for /etc/httpd rmdir $RPM_BUILD_ROOT/etc/httpd/{state,run} ln -s ../..%{_localstatedir}/log/httpd $RPM_BUILD_ROOT/etc/httpd/logs @@ -766,7 +532,9 @@ install -m755 $RPM_SOURCE_DIR/httpd-ssl-pass-dialog \ install -m755 $RPM_SOURCE_DIR/httpd-ssl-gencerts \ $RPM_BUILD_ROOT%{_libexecdir}/httpd-ssl-gencerts -# Install action scripts +# Install scripts +install -m 755 apachectl.sh $RPM_BUILD_ROOT%{_sbindir}/apachectl +touch -r $RPM_SOURCE_DIR/apachectl.sh $RPM_BUILD_ROOT%{_sbindir}/apachectl mkdir -p $RPM_BUILD_ROOT%{_libexecdir}/initscripts/legacy-actions/httpd for f in graceful configtest; do install -p -m 755 $RPM_SOURCE_DIR/action-${f}.sh \ @@ -781,7 +549,7 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.logrotate \ # Install man pages install -d $RPM_BUILD_ROOT%{_mandir}/man8 $RPM_BUILD_ROOT%{_mandir}/man5 install -m 644 -p httpd.service.8 httpd-init.service.8 httpd.socket.8 \ - httpd@.service.8 htcacheclean.service.8 \ + httpd@.service.8 htcacheclean.service.8 apachectl.8 \ $RPM_BUILD_ROOT%{_mandir}/man8 install -m 644 -p httpd.conf.5 \ $RPM_BUILD_ROOT%{_mandir}/man5 @@ -804,6 +572,29 @@ sed -i '/.*DEFAULT_..._LIBEXECDIR/d;/DEFAULT_..._INSTALLBUILDDIR/d' \ sed -i '/instdso/s,top_srcdir,top_builddir,' \ $RPM_BUILD_ROOT%{_libdir}/httpd/build/special.mk +# vendor-apxs uses an unsanitized config_vars.mk which may +# have dependencies on redhat-rpm-config. apxs uses the +# config_vars.mk with a sanitized config_vars.mk +cp -p $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk \ + $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk + +# Sanitize CFLAGS & LIBTOOL in standard config_vars.mk +sed -e '/^[A-Z]*FLAGS = /s,-specs[^ ]*,,g' \ + -e '/^LIBTOOL/s,/.*/libtool,%{_bindir}/libtool,' \ + -i $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk +diff -u $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk \ + $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk || true + +sed 's/config_vars.mk/vendor_config_vars.mk/' \ + $RPM_BUILD_ROOT%{_bindir}/apxs \ + > $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs +touch -r $RPM_BUILD_ROOT%{_bindir}/apxs \ + $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs +chmod 755 $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs + +# Fix content dir in sysusers file and install it +install -p -D -m 0644 %{SOURCE49} %{buildroot}%{_sysusersdir}/httpd.conf + # Remove unpackaged files rm -vf \ $RPM_BUILD_ROOT%{_libdir}/*.exp \ @@ -819,11 +610,7 @@ rm -vf \ rm -rf $RPM_BUILD_ROOT/etc/httpd/conf/{original,extra} %pre filesystem -getent group apache >/dev/null || groupadd -g 48 -r apache -getent passwd apache >/dev/null || \ - useradd -r -u 48 -g apache -s /sbin/nologin \ - -d %{contentdir} -c "Apache" apache -exit 0 +%sysusers_create_compat %{SOURCE49} %post %systemd_post httpd.service htcacheclean.service httpd.socket @@ -834,35 +621,41 @@ exit 0 %postun %systemd_postun httpd.service htcacheclean.service httpd.socket -# Trigger for conversion from SysV, per guidelines at: -# https://fedoraproject.org/wiki/Packaging:ScriptletSnippets#Systemd -%triggerun -- httpd < 2.2.21-5 -# Save the current service runlevel info -# User must manually run systemd-sysv-convert --apply httpd -# to migrate them to systemd targets -/usr/bin/systemd-sysv-convert --save httpd.service >/dev/null 2>&1 ||: - -# Run these because the SysV package being removed won't do them -/sbin/chkconfig --del httpd >/dev/null 2>&1 || : - %posttrans test -f /etc/sysconfig/httpd-disable-posttrans || \ /bin/systemctl try-restart --no-block httpd.service htcacheclean.service >/dev/null 2>&1 || : %check -# Check the built modules are all PIC -if readelf -d $RPM_BUILD_ROOT%{_libdir}/httpd/modules/*.so | grep TEXTREL; then - : modules contain non-relocatable code - exit 1 -fi +make -C server exports.o +nm --defined httpd > exports-actual.list set +x rv=0 +nm --defined-only server/exports.o | \ + sed -n '/ap_hack_/{s/.* ap_hack_//;/^ap[ru]/d;p;}' | \ + while read sym; do + if ! grep -q " "$sym\$ exports-actual.list; then + echo ERROR: Symbol $sym missing in httpd exports + rv=1 + fi + done +if [ $rv -eq 0 ]; then + echo PASS: Symbol export list verified. +fi +# Check the built modules are all PIC +if readelf -d $RPM_BUILD_ROOT%{_libdir}/httpd/modules/*.so | grep TEXTREL; then + echo FAIL: Modules contain non-relocatable code + rv=1 +else + echo PASS: No non-relocatable code in module builds +fi # Ensure every mod_* that's built is loaded. for f in $RPM_BUILD_ROOT%{_libdir}/httpd/modules/*.so; do m=${f##*/} if ! grep -q $m $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/*.conf; then - echo ERROR: Module $m not configured. Disable it, or load it. + echo FAIL: Module $m not configured. Disable it, or load it. rv=1 + else + echo PASS: Module $m is configured and loaded. fi done # Ensure every loaded mod_* is actually built @@ -870,28 +663,41 @@ mods=`grep -h ^LoadModule $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/*.c for m in $mods; do f=$RPM_BUILD_ROOT%{_libdir}/httpd/modules/${m} if ! test -x $f; then - echo ERROR: Module $m is configured but not built. + echo FAIL: Module $m is configured but not built. rv=1 + else + echo PASS: Loaded module $m is installed. fi done set -x exit $rv -%clean -rm -rf $RPM_BUILD_ROOT - %files -%defattr(-,root,root) +%{_mandir}/man8/* +%{_mandir}/man5/* +%exclude %{_mandir}/man8/httpd-init.* +%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-brotli.conf +%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-systemd.conf +%{_libdir}/httpd/modules/mod_brotli.so +%{_libdir}/httpd/modules/mod_systemd.so + +%{_unitdir}/httpd.service +%{_unitdir}/httpd@.service +%{_unitdir}/htcacheclean.service +%{_unitdir}/*.socket + +%files core %doc ABOUT_APACHE README CHANGES LICENSE VERSIONING NOTICE %doc docs/conf/extra/*.conf -%doc instance.conf +%doc instance.conf server-status.conf %{_sysconfdir}/httpd/modules %{_sysconfdir}/httpd/logs %{_sysconfdir}/httpd/state %{_sysconfdir}/httpd/run %dir %{_sysconfdir}/httpd/conf + %config(noreplace) %{_sysconfdir}/httpd/conf/httpd.conf %config(noreplace) %{_sysconfdir}/httpd/conf/magic @@ -903,9 +709,13 @@ rm -rf $RPM_BUILD_ROOT %dir %{_sysconfdir}/httpd/conf.modules.d %{_sysconfdir}/httpd/conf.modules.d/README + %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/*.conf +%exclude %{_sysconfdir}/httpd/conf.modules.d/00-brotli.conf +%exclude %{_sysconfdir}/httpd/conf.modules.d/00-systemd.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/00-ssl.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf +%exclude %{_sysconfdir}/httpd/conf.modules.d/00-lua.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/01-ldap.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/01-session.conf @@ -924,38 +734,34 @@ rm -rf $RPM_BUILD_ROOT %dir %{_libdir}/httpd %dir %{_libdir}/httpd/modules %{_libdir}/httpd/modules/mod*.so +%exclude %{_libdir}/httpd/modules/mod_brotli.so +%exclude %{_libdir}/httpd/modules/mod_systemd.so %exclude %{_libdir}/httpd/modules/mod_auth_form.so %exclude %{_libdir}/httpd/modules/mod_ssl.so %exclude %{_libdir}/httpd/modules/mod_*ldap.so %exclude %{_libdir}/httpd/modules/mod_proxy_html.so %exclude %{_libdir}/httpd/modules/mod_xml2enc.so %exclude %{_libdir}/httpd/modules/mod_session*.so +%exclude %{_libdir}/httpd/modules/mod_lua.so %dir %{contentdir}/error %dir %{contentdir}/error/include %dir %{contentdir}/noindex +%dir %{contentdir}/server-status %{contentdir}/icons/* %{contentdir}/error/README %{contentdir}/error/*.var %{contentdir}/error/include/*.html %{contentdir}/noindex/index.html +%{contentdir}/server-status/* %attr(0710,root,apache) %dir /run/httpd %attr(0700,apache,apache) %dir /run/httpd/htcacheclean %attr(0700,root,root) %dir %{_localstatedir}/log/httpd -%attr(0700,apache,apache) %dir %{_localstatedir}/lib/dav %attr(0700,apache,apache) %dir %{_localstatedir}/lib/httpd %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd/proxy -%{_mandir}/man8/* -%{_mandir}/man5/* -%exclude %{_mandir}/man8/httpd-init.* - -%{_unitdir}/httpd.service -%{_unitdir}/httpd@.service -%{_unitdir}/htcacheclean.service -%{_unitdir}/*.socket %files filesystem %dir %{_sysconfdir}/httpd @@ -968,9 +774,10 @@ rm -rf $RPM_BUILD_ROOT %dir %{contentdir}/icons %attr(755,root,root) %dir %{_unitdir}/httpd.service.d %attr(755,root,root) %dir %{_unitdir}/httpd.socket.d +%attr(755,root,root) %dir %{_sysconfdir}/systemd/system/httpd.service.d +%{_sysusersdir}/httpd.conf %files tools -%defattr(-,root,root) %{_bindir}/* %{_mandir}/man1/* %doc LICENSE NOTICE @@ -978,12 +785,10 @@ rm -rf $RPM_BUILD_ROOT %exclude %{_mandir}/man1/apxs.1* %files manual -%defattr(-,root,root) %{contentdir}/manual %config(noreplace) %{_sysconfdir}/httpd/conf.d/manual.conf %files -n mod_ssl -%defattr(-,root,root) %{_libdir}/httpd/modules/mod_ssl.so %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-ssl.conf %config(noreplace) %{_sysconfdir}/httpd/conf.d/ssl.conf @@ -995,403 +800,552 @@ rm -rf $RPM_BUILD_ROOT %{_mandir}/man8/httpd-init.* %files -n mod_proxy_html -%defattr(-,root,root) %{_libdir}/httpd/modules/mod_proxy_html.so %{_libdir}/httpd/modules/mod_xml2enc.so %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf %files -n mod_ldap -%defattr(-,root,root) %{_libdir}/httpd/modules/mod_*ldap.so %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-ldap.conf %files -n mod_session -%defattr(-,root,root) %{_libdir}/httpd/modules/mod_session*.so %{_libdir}/httpd/modules/mod_auth_form.so %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-session.conf +%files -n mod_lua +%{_libdir}/httpd/modules/mod_lua.so +%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-lua.conf + %files devel -%defattr(-,root,root) %{_includedir}/httpd %{_bindir}/apxs %{_mandir}/man1/apxs.1* %dir %{_libdir}/httpd/build %{_libdir}/httpd/build/*.mk %{_libdir}/httpd/build/*.sh +%{_libdir}/httpd/build/vendor-apxs %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Wed Jan 29 2025 LuboÅ¡ Uhliarik - 2.4.37-65.3 -- Resolves: RHEL-56068 - Apache HTTPD no longer parse PHP files with - unicode characters in the name +* Mon Jan 27 2025 LuboÅ¡ Uhliarik - 2.4.63-1 +- new version 2.4.63 +- Resolves: RHEL-76358 - httpd rebase to 2.4.63 +- Resolves: RHEL-73414 - RewriteRule proxying to UDS (unix domain socket) + configured in .htaccess doesn't work on httpd-2.4.62-1 +- Resolves: RHEL-66489 - Apache HTTPD no longer parse PHP files with unicode + characters in the name -* Tue Aug 06 2024 LuboÅ¡ Uhliarik - 2.4.37-65.2 -- Resolves: RHEL-46040 - httpd:2.4/httpd: Security issues via backend - applications whose response headers are malicious or exploitable (CVE-2024-38476) -- Resolves: RHEL-53022 - Regression introduced by CVE-2024-38474 fix +* Tue Oct 29 2024 Troy Dawson - 2.4.62-5 +- Bump release for October 2024 mass rebuild: + Resolves: RHEL-64018 -* Thu Jul 11 2024 LuboÅ¡ Uhliarik - 2.4.37-65.1 -- Resolves: RHEL-45812 - httpd:2.4/httpd: Substitution encoding issue - in mod_rewrite (CVE-2024-38474) -- Resolves: RHEL-45785 - httpd:2.4/httpd: Encoding problem in +* Mon Aug 12 2024 LuboÅ¡ Uhliarik - 2.4.62-4 +- Resolves: RHEL-50031 - httpd default config changes + +* Thu Aug 08 2024 LuboÅ¡ Uhliarik - 2.4.62-3 +- Resolves: RHEL-53632 - RFE: httpd, add IP_FREEBIND support for Listen +- Resolves: RHEL-53722 - [RFE] ProxyWebsocketIdleTimeout from + httpd mod_proxy_wstunnel + +* Sat Aug 03 2024 LuboÅ¡ Uhliarik - 2.4.62-2 +- Resolves: RHEL-52722 - Regression introduced by CVE-2024-38474 fix + +* Fri Jul 19 2024 LuboÅ¡ Uhliarik - 2.4.62-1 +- new version 2.4.62 +- Resolves: RHEL-33446 + +* Wed Jul 03 2024 LuboÅ¡ Uhliarik - 2.4.61-1 +- new version 2.4.61 +- Resolves: RHEL-45753 - httpd: Potential SSRF in + mod_rewrite (CVE-2024-39573) +- Resolves: RHEL-45757 - httpd: null pointer dereference in + mod_proxy (CVE-2024-38477) +- Resolves: RHEL-45776 - httpd: Improper escaping of output in + mod_rewrite (CVE-2024-38475) +- Resolves: RHEL-45791 - httpd: Encoding problem in mod_proxy (CVE-2024-38473) -- Resolves: RHEL-45777 - httpd:2.4/httpd: Improper escaping of output - in mod_rewrite (CVE-2024-38475) -- Resolves: RHEL-45758 - httpd:2.4/httpd: null pointer dereference - in mod_proxy (CVE-2024-38477) -- Resolves: RHEL-45743 - httpd:2.4/httpd: Potential SSRF - in mod_rewrite (CVE-2024-39573) +- Resolves: RHEL-45811 - httpd: Substitution encoding issue in + mod_rewrite (CVE-2024-38474) +- Resolves: RHEL-46051 - httpd: Security issues via backend applications + whose response headers are malicious or exploitable (CVE-2024-38476) -* Wed Jun 12 2024 LuboÅ¡ Uhliarik - 2.4.37-65 -- Resolves: RHEL-31857 - httpd:2.4/httpd: HTTP response - splitting (CVE-2023-38709) +* Mon Jun 24 2024 Troy Dawson - 2.4.59-4.4 +- Bump release for June 2024 mass rebuild -* Fri Feb 16 2024 Joe Orton - 2.4.37-64 -- Resolves: RHEL-14448 - httpd: mod_macro: out-of-bounds read - vulnerability (CVE-2023-31122) +* Thu May 23 2024 Joe Orton - 2.4.59-3.4 +- mod_ssl: disable ENGINE support + Resolves: RHEL-33734 -* Wed Feb 14 2024 Joe Orton - 2.4.37-63 -- mod_xml2enc: fix media type handling - Resolves: RHEL-14321 +* Fri May 17 2024 Joe Orton - 2.4.59-3.2 +- mod_ssl: use SSL_OP_NO_RENEGOTIATION -* Thu Aug 17 2023 Johnny Hughes - 2.4.37-62 -- change for CentOS Stream Branding +* Fri May 3 2024 Joe Orton - 2.4.59-3.1 +- apachectl(8): use BUG_REPORT_URL from /etc/os-release +- apachectl(8): fix grammar (#2278748) +- httpd.service.xml(8): mention ProtectSystem= setting -* Thu Jul 27 2023 LuboÅ¡ Uhliarik - 2.4.37-62 -- Resolves: #2221083 - Apache Bug 57087: mod_proxy_fcgi doesn't send cgi - CONTENT_LENGTH variable when the client request used Transfer-Encoding:chunked +* Wed May 1 2024 Joe Orton - 2.4.59-3 +- add ServerTokens: Full-Release support -* Thu Jul 20 2023 Tomas Korbar - 2.4.37-61 -- Fix issue found by covscan -- Related: #2159603 +* Mon Apr 15 2024 Joe Orton - 2.4.59-2 +- mod_ssl: add DH param handling fix (r1916863) -* Mon Jul 17 2023 Tomas Korbar - 2.4.37-60 -- Another rebuild because of mistake in workflow -- Related: #2159603 +* Fri Apr 5 2024 Joe Orton - 2.4.59-1 +- update to 2.4.59 -* Mon Jul 17 2023 Tomas Korbar - 2.4.37-59 -- Rebuild because of mistake in workflow -- Related: #2159603 +* Thu Mar 28 2024 Joe Orton - 2.4.58-8 +- rebuild to fix changelog ordering -* Mon Jul 17 2023 Tomas Korbar - 2.4.37-58 -- Resolves: #2159603 - mod_status lists BusyWorkers IdleWorkers keys twice +* Thu Mar 7 2024 Rahul Sundaram - 2.4.58-7 +- Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening +- updated httpd.service(5) (Joe Orton) -* Thu May 25 2023 LuboÅ¡ Uhliarik - 2.4.37-57 -- Resolves: #2176723 - CVE-2023-27522 httpd:2.4/httpd: mod_proxy_uwsgi HTTP - response splitting +* Wed Jan 24 2024 Fedora Release Engineering - 2.4.58-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild -* Thu Apr 27 2023 LuboÅ¡ Uhliarik - 2.4.37-56.5 -- Resolves: #2190133 - mod_rewrite regression with CVE-2023-25690 +* Sat Jan 20 2024 Fedora Release Engineering - 2.4.58-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild -* Sat Mar 18 2023 LuboÅ¡ Uhliarik - 2.4.37-56.4 -- Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting - with mod_rewrite and mod_proxy +* Fri Jan 5 2024 Joe Orton - 2.4.58-4 +- fix OpenSSL 3.0 deprecation warnings (r1913912, r1915067) +- mod_ssl: move to provider API for pkcs11 support (#2253014) -* Tue Jan 31 2023 LuboÅ¡ Uhliarik - 2.4.37-56 -- Resolves: #2162499 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write - of zero byte -- Resolves: #2162485 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting -- Resolves: #2162509 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request - smuggling +* Fri Dec 8 2023 Joe Orton - 2.4.58-3 +- mod_dav_fs: add DAVLockDBType, use global lock around lockdb +- fix build with libxml2 2.12 -* Thu Jan 26 2023 LuboÅ¡ Uhliarik - 2.4.37-55 -- Resolves: #2155961 - prevent sscg creating /dhparams.pem +* Thu Nov 2 2023 Joe Orton - 2.4.58-2 +- add dependency on apr-util-1(dbm) so a DBM provider is present -* Thu Dec 08 2022 LuboÅ¡ Uhliarik - 2.4.37-54 -- Resolves: #2095650 - Dependency from mod_http2 on httpd broken +* Fri Oct 20 2023 LuboÅ¡ Uhliarik - 2.4.58-1 +- new version 2.4.58 -* Wed Nov 09 2022 LuboÅ¡ Uhliarik - 2.4.37-53 -- Resolves: #2050888 - httpd with SSL fails to start unless hostname command - was installed +* Fri Oct 06 2023 LuboÅ¡ Uhliarik - 2.4.57-4 +- SPDX migration -* Mon Sep 19 2022 Tomas Korbar - 2.4.37-52 -- Add the SNI support in mod_proxy_wstunnel module for Apache httpd -- Resolves: rhbz#2017543 +* Thu Jul 20 2023 Fedora Release Engineering - 2.4.57-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild -* Mon Jul 25 2022 LuboÅ¡ Uhliarik - 2.4.37-51 -- Resolves: #2097015 - CVE-2022-28614 httpd:2.4/httpd: out-of-bounds read via - ap_rwrite() -- Resolves: #2097031 - CVE-2022-28615 httpd:2.4/httpd: out-of-bounds read in - ap_strcmp_match() -- Resolves: #2097458 - CVE-2022-30522 httpd:2.4/httpd: mod_sed: DoS - vulnerability -- Resolves: #2097480 - CVE-2022-30556 httpd:2.4/httpd: mod_lua: Information - disclosure with websockets -- Resolves: #2098247 - CVE-2022-31813 httpd:2.4/httpd: mod_proxy: - X-Forwarded-For dropped by hop-by-hop mechanism -- Resolves: #2097451 - CVE-2022-29404 httpd:2.4/httpd: mod_lua: DoS in - r:parsebody -- Resolves: #2096997 - CVE-2022-26377 httpd:2.4/httpd: mod_proxy_ajp: Possible - request smuggling +* Wed Jul 5 2023 Joe Orton - 2.4.57-2 +- package /etc/systemd/httpd/httpd.service.d +- also sanitize LDFLAGS/CXXFLAGS in non-vendor config_vars.mk -* Tue Jun 21 2022 LuboÅ¡ Uhliarik - 2.4.37-50 -- Resolves: #2065237 - CVE-2022-22719 httpd:2.4/httpd: mod_lua: Use of - uninitialized value of in r:parsebody -- Resolves: #2065267 - CVE-2022-22721 httpd:2.4/httpd: core: Possible buffer - overflow with very large or unlimited LimitXMLRequestBody -- Resolves: #2065324 - CVE-2022-23943 httpd:2.4/httpd: mod_sed: Read/write - beyond bounds +* Tue Apr 11 2023 LuboÅ¡ Uhliarik - 2.4.57-1 +- new version 2.4.57 -* Fri Jun 10 2022 LuboÅ¡ Uhliarik - 2.4.37-49 -- Resolves: #2090848 - CVE-2020-13950 httpd:2.4/httpd: mod_proxy NULL pointer - dereference +* Thu Mar 09 2023 LuboÅ¡ Uhliarik - 2.4.56-1 +- new version 2.4.56 -* Mon Mar 21 2022 LuboÅ¡ Uhliarik - 2.4.37-48 -- Resolves: #2065249 - CVE-2022-22720 httpd:2.4/httpd: HTTP request smuggling - vulnerability in Apache HTTP Server 2.4.52 and earlier +* Tue Mar 7 2023 Joe Orton - 2.4.55-3 +- build and load mod_authnz_fcgi -* Thu Jan 20 2022 LuboÅ¡ Uhliarik - 2.4.37-47 -- Resolves: #2035030 - CVE-2021-44224 httpd:2.4/httpd: possible NULL dereference - or SSRF in forward proxy configurations +* Fri Feb 03 2023 LuboÅ¡ Uhliarik - 2.4.55-2 +- rebuilt with new apr/apr-util -* Mon Jan 10 2022 LuboÅ¡ Uhliarik - 2.4.37-46 -- Resolves: #2035063 - CVE-2021-44790 httpd:2.4/httpd: mod_lua: possible buffer - overflow when parsing multipart content +* Wed Jan 25 2023 LuboÅ¡ Uhliarik - 2.4.55-1 +- new version 2.4.55 -* Thu Jan 06 2022 LuboÅ¡ Uhliarik - 2.4.37-45 -- Resolves: #2007199 - CVE-2021-36160 httpd:2.4/httpd: mod_proxy_uwsgi: - out-of-bounds read via a crafted request uri-path -- Resolves: #1972491 - CVE-2021-33193 httpd:2.4/mod_http2: Request splitting via - HTTP/2 method injection and mod_proxy +* Tue Jan 24 2023 LuboÅ¡ Uhliarik - 2.4.54-12 +- prevent sscg writing /dhparams.pem -* Mon Nov 29 2021 LuboÅ¡ Uhliarik - 2.4.37-44 -- Resolves: #1968278 - CVE-2020-35452 httpd:2.4/httpd: Single zero byte stack - overflow in mod_auth_digest -- Resolves: #2001046 - Apache httpd OOME with mod_dav in RHEL 8 -- Resolves: #2005128 (CVE-2021-34798) - CVE-2021-34798 httpd: NULL pointer - dereference via malformed requests -- Resolves: #1984828 - mod_proxy_hcheck piles up health checks leading to high - memory consumption -- Resolves: #2005119 - CVE-2021-39275 httpd: out-of-bounds write in - ap_escape_quotes() via malicious input +* Thu Jan 19 2023 Fedora Release Engineering - 2.4.54-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild -* Tue Oct 26 2021 LuboÅ¡ Uhliarik - 2.4.37-43 -- Related: #2007236 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via - a crafted request uri-path +* Tue Dec 20 2022 Joe Orton - 2.4.54-10 +- htcacheclean.service: add [Install] section, PrivateTmp=yes, + Environment=LANG=C (#2149714) -* Thu Sep 30 2021 LuboÅ¡ Uhliarik - 2.4.37-42 -- Resolves: #2007236 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via - a crafted request uri-path -- Resolves: #1969229 - CVE-2021-26691 httpd:2.4/httpd: Heap overflow in - mod_session +* Mon Dec 19 2022 Joe Orton - 2.4.54-9 +- move SELinux context logging to mod_systemd -* Fri Jul 09 2021 LuboÅ¡ Uhliarik - 2.4.37-41 -- Resolves: #1680111 - httpd sends reply to HTTPS GET using two TLS records -- Resolves: #1905613 - mod_ssl does not like valid certificate chain -- Resolves: #1935742 - [RFE] backport samesite/httponly/secure flags for - usertrack -- Resolves: #1972500 - CVE-2021-30641 httpd:2.4/httpd: MergeSlashes regression -- Resolves: #1968307 - CVE-2021-26690 httpd:2.4/httpd: mod_session NULL pointer - dereference in parser -- Resolves: #1934741 - Apache trademark update - new logo +* Mon Dec 19 2022 Joe Orton - 2.4.54-8 +- define _httpd_statedir macro -* Fri May 14 2021 Lubos Uhliarik - 2.4.37-40 -- Resolves: #1952557 - mod_proxy_wstunnel.html is a malformed XML -- Resolves: #1937334 - SSLProtocol with based virtual hosts +* Wed Nov 30 2022 LuboÅ¡ Uhliarik - 2.4.54-7 +- reduce AH03408 level to INFO in proxy_util.c -* Tue Jan 26 2021 Artem Egorenkov - 2.4.37-39 +* Thu Oct 13 2022 LuboÅ¡ Uhliarik - 2.4.54-6 +- Provide a sysusers.d file to get user() and group() provides (#2134430) + +* Thu Jul 21 2022 Fedora Release Engineering - 2.4.54-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Fri Jun 24 2022 LuboÅ¡ Uhliarik - 2.4.54-4 +- fix downgrade/upgrade issues +- mod_ssl and other modules should depend only on httpd-core package + +* Fri Jun 17 2022 Joe Orton - 2.4.54-3 +- update PCRE config selection + +* Thu Jun 09 2022 LuboÅ¡ Uhliarik - 2.4.54-2 +- new version 2.4.54 + +* Mon May 16 2022 Joe Orton - 2.4.53-7 +- disable package notes + +* Fri May 13 2022 Joe Orton - 2.4.53-6 +- use %%set_build_flags macro + +* Thu Apr 21 2022 LuboÅ¡ Uhliarik - 2.4.53-5 +- don't use bomb.gif icon for all files/dirs ending with core + +* Wed Apr 20 2022 Joe Orton - 2.4.53-4 +- switch to PCRE2 for new releases + +* Thu Apr 07 2022 LuboÅ¡ Uhliarik - 2.4.53-3 +- Related: #2070517 - fix issue when mod_systemd is not loaded + +* Wed Mar 30 2022 LuboÅ¡ Uhliarik - 2.4.53-2 +- Resolves: #2070517 - Allow install httpd with smaller footprint +- try to minimize httpd dependencies (new httpd-core package) +- mod_systemd and mod_brotli are now in the main httpd package + +* Thu Mar 17 2022 LuboÅ¡ Uhliarik - 2.4.53-1 +- new version 2.4.53 +- fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719 + +* Tue Feb 1 2022 Joe Orton - 2.4.52-5 +- rebuild for new OpenLDAP (#2032699) + +* Mon Jan 31 2022 Joe Orton - 2.4.52-4 +- add libtool to Requires: for httpd-devel (#2048281) + +* Fri Jan 28 2022 Joe Orton - 2.4.52-3 +- use LIBTOOL=/usr/bin/libtool in the non-vendor config_vars.mk + +* Thu Jan 20 2022 Fedora Release Engineering - 2.4.52-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Wed Dec 22 2021 Joe Orton - 2.4.52-1 +- update to 2.4.52 + +* Mon Dec 06 2021 Neal Gompa - 2.4.51-3 +- Use NAME from os-release(5) for vendor string + Related: #2029071 - httpd on CentOS identifies as RHEL + +* Tue Oct 12 2021 Joe Orton - 2.4.51-2 +- mod_ssl: updated patch for OpenSSL 3.0 compatibility (#2007178) +- mod_deflate/core: add two brigade handling correctness fixes + +* Thu Oct 07 2021 Patrick Uiterwijk - 2.4.51-1 +- new version 2.4.51 + +* Tue Oct 05 2021 LuboÅ¡ Uhliarik - 2.4.50-1 +- new version 2.4.50 + +* Wed Sep 22 2021 LuboÅ¡ Uhliarik - 2.4.49-3 +- Rebuilt for CI testing + +* Thu Sep 16 2021 LuboÅ¡ Uhliarik - 2.4.49-1 +- new version 2.4.49 (#2004776) + +* Tue Sep 14 2021 Sahana Prasad - 2.4.48-8 +- Rebuilt with OpenSSL 3.0.0 + +* Fri Aug 06 2021 LuboÅ¡ Uhliarik - 2.4.48-7 +- add symlink to system logo for noindex test page + +* Fri Aug 6 2021 Joe Orton - 2.4.48-4 +- add OpenSSL 3.x compatibility patch + +* Thu Jul 22 2021 Fedora Release Engineering - 2.4.48-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Fri Jul 16 2021 Joe Orton - 2.4.48-2 +- mod_cgi/mod_cgid: update to unification from trunk +- httpd.conf: add note on care with Listen and starting at boot + +* Wed Jun 02 2021 LuboÅ¡ Uhliarik - 2.4.48-1 +- new version 2.4.48 +- Resolves: #1964746 - httpd-2.4.48 is available + +* Mon May 03 2021 Lubos Uhliarik - 2.4.46-13 +- Related: #1934739 - Apache trademark update - new logo + +* Fri Apr 9 2021 Joe Orton - 2.4.46-12 +- use OOMPolicy=continue in httpd.service, httpd@.service (#1947475) + +* Wed Mar 31 2021 Lubos Uhliarik - 2.4.46-11 +- Resolves: #1934739 - Apache trademark update - new logo + +* Tue Feb 23 2021 Joe Orton - 2.4.46-10 +- add Conflicts: with mod_nss +- drop use of apr_ldap_rebind (r1878890, #1847585) + +* Mon Feb 01 2021 Lubos Uhliarik - 2.4.46-9 +- Resolves: #1914182 - RFE: CustomLog should be able to use journald + +* Tue Jan 26 2021 Fedora Release Engineering - 2.4.46-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Wed Jan 20 2021 Artem Egorenkov - 2.4.46-7 - prevent htcacheclean from while break when first file processed -* Tue Jan 26 2021 Lubos Uhliarik - 2.4.37-38 -- Resolves: #1918741 - Thousands of /tmp/modproxy.tmp.* files created by apache +* Thu Dec 17 2020 Joe Orton - 2.4.46-6 +- move mod_lua to a subpackage +- Recommends: both mod_lua and mod_http2 -* Wed Dec 09 2020 Lubos Uhliarik - 2.4.37-37 -- Resolves: #1883648 - [RFE] Update httpd directive SSLProxyMachineCertificateFile - to be able to handle certs without matching private key +* Fri Nov 6 2020 Joe Orton - 2.4.46-5 +- add %%_httpd_requires to macros -* Mon Nov 30 2020 Lubos Uhliarik - 2.4.37-36 -- Resolves: #1896176 - [RFE] ProxyWebsocketIdleTimeout from httpd - mod_proxy_wstunnel -- Resolves: #1847585 - mod_ldap: High CPU usage at apr_ldap_rebind_remove() +* Thu Aug 27 2020 Joe Orton - 2.4.46-4 +- use make macros (Tom Stellard) -* Wed Nov 11 2020 Lubos Uhliarik - 2.4.37-35 -- Resolves: #1651376 - centralizing default index.html for httpd +* Thu Aug 27 2020 Joe Orton - 2.4.46-3 +- strip /usr/bin/apxs CFLAGS further -* Fri Nov 06 2020 Lubos Uhliarik - 2.4.37-33 -- Resolves: #1868608 - Intermittent Segfault in Apache httpd due to pool - concurrency issues -- Resolves: #1861380 - httpd/mod_proxy_http/mod_ssl aborted when sending - a client cert to backend server -- Resolves: #1680118 - unorderly connection close when client attempts - renegotiation +* Thu Aug 27 2020 Joe Orton - 2.4.46-2 +- sanitize CFLAGS used by /usr/bin/apxs by default (#1873020) +- add $libdir/httpd/build/vendor-apxs which exposes full CFLAGS +- redefine _httpd_apxs RPM macro to use vendor-apxs -* Thu Oct 29 2020 Lubos Uhliarik - 2.4.37-31 -- Resolves: #1677590 - CVE-2018-17199 httpd:2.4/httpd: mod_session_cookie does - not respect expiry time -- Resolves: #1869075 - CVE-2020-11984 httpd:2.4/httpd: mod_proxy_uswgi buffer - overflow -- Resolves: #1872828 - httpd: typo in htpasswd, contained in httpd-tools package -- Resolves: #1869576 - httpd : mod_proxy should allow to specify - Proxy-Authorization in ProxyRemote directive -- Resolves: #1875844 - mod_cgid takes CGIDScriptTimeout x 2 seconds for timeout -- Resolves: #1891829 - mod_proxy_hcheck Doesn't perform checks when in - a balancer +* Tue Aug 25 2020 Lubos Uhliarik - 2.4.46-1 +- new version 2.4.46 +- remove obsolete parts of this spec file +- fix systemd detection patch -* Mon Jun 15 2020 Joe Orton - 2.4.37-30 -- Resolves: #1209162 - support logging to journald from CustomLog +* Tue Jul 28 2020 Fedora Release Engineering - 2.4.43-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild -* Mon Jun 08 2020 Lubos Uhliarik - 2.4.37-29 -- Resolves: #1823263 (CVE-2020-1934) - CVE-2020-1934 httpd: mod_proxy_ftp use of - uninitialized value +* Thu Jul 09 2020 Lubos Uhliarik - 2.4.43-6 +- fix macro in mod_lua for lua 4.5 -* Fri May 29 2020 Lubos Uhliarik - 2.4.37-28 -- Related: #1771847 - BalancerMember ping parameter for mod_proxy_http - doesn't work +* Thu Jul 09 2020 Lubos Uhliarik - 2.4.43-5 +- Remove %ghosted /etc/sysconfig/httpd file (#1850082) -* Tue Apr 14 2020 Lubos Uhliarik - 2.4.37-27 -- Resolves: #1823259 - CVE-2020-1927 httpd:2.4/httpd: mod_rewrite configurations - vulnerable to open redirect -- Resolves: #1747284 - CVE-2019-10098 httpd:2.4/httpd: mod_rewrite potential - open redirect -- Resolves: #1747281 - CVE-2019-10092 httpd:2.4/httpd: limited cross-site - scripting in mod_proxy error page -- Resolves: #1747291 - CVE-2019-10097 httpd:2.4/httpd: null-pointer dereference - in mod_remoteip -- Resolves: #1771847 - BalancerMember ping parameter for mod_proxy_http - doesn't work -- Resolves: #1794728 - Backport of SessionExpiryUpdateInterval directive +* Tue Jul 7 2020 Joe Orton - 2.4.43-4 +- use gettid() directly and use it for built-in ErrorLogFormat -* Mon Dec 02 2019 Lubos Uhliarik - 2.4.37-21 -- Resolves: #1775158 - POST request with TLS 1.3 PHA client auth fails: - Re-negotiation handshake failed: Client certificate missing +* Fri Apr 17 2020 Joe Orton - 2.4.43-3 +- mod_ssl: updated coalescing filter to improve TLS efficiency -* Sun Dec 01 2019 Lubos Uhliarik - 2.4.37-20 -- Resolves: #1704317 - Add support for SSLKEYLOGFILE +* Fri Apr 17 2020 Joe Orton - 2.4.43-2 +- mod_ssl: fix leak in OCSP stapling code (PR 63687, r1876548) +- mod_systemd: restore descriptive startup logging -* Thu Nov 28 2019 Joe Orton - 2.4.37-19 -- mod_cgid: enable fd passing (#1633224) +* Tue Mar 31 2020 Lubos Uhliarik - 2.4.43-1 +- new version 2.4.43 (#1819023) -* Mon Nov 18 2019 Lubos Uhliarik - 2.4.37-18 -- Resolves: #1744121 - Unexpected OCSP in proxy SSL connection -- Resolves: #1725031 - htpasswd: support SHA-x passwords for FIPS compatibility -- Resolves: #1633224 - mod_cgid logging issues +* Wed Jan 29 2020 Fedora Release Engineering - 2.4.41-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild -* Wed Oct 02 2019 Lubos Uhliarik - 2.4.37-17 +* Mon Jan 20 2020 Joe Orton - 2.4.41-12 +- mod_systemd: fix timeouts on reload w/ExtendedStatus off (#1590877) + +* Mon Jan 6 2020 Joe Orton - 2.4.41-11 +- apachectl(8): update authors + +* Sat Dec 7 2019 FeRD (Frank Dana) - 2.4.41-10 +- apachectl: Add man page for Fedora version + +* Thu Nov 21 2019 Joe Orton - 2.4.41-9 +- mod_ssl: fix request body buffering w/TLSv1.3 PHA (#1775146) + +* Wed Nov 13 2019 Joe Orton - 2.4.41-8 +- apachectl: in graceful/graceful-stop, only signal main process (#1758798) + +* Mon Nov 11 2019 Lubos Uhliarik - 2.4.41-7 +- add automatic source tarball signature verification in %prep section + +* Fri Oct 4 2019 Joe Orton - 2.4.41-6 +- mod_cgid/mod_cgi: further upstream consolidation patches + +* Thu Oct 3 2019 Joe Orton - 2.4.41-5 +- mod_proxy_balancer: fix balancer-manager XSRF check (PR 63688) + +* Wed Oct 2 2019 Joe Orton - 2.4.41-4 +- mod_cgid: possible stdout timeout handling fix (#1757683) + +* Wed Sep 25 2019 Joe Orton - 2.4.41-3 +- mod_ssl: restore dependency on /usr/bin/hostname (#1135118) + +* Thu Sep 19 2019 Stephen Gallagher - 2.4.41-2 +- Use testpage from system-logos-httpd for proper branding + +* Thu Aug 15 2019 Joe Orton - 2.4.41-1 +- update to 2.4.41 + +* Thu Jul 25 2019 Fedora Release Engineering - 2.4.39-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Tue Jul 23 2019 Joe Orton - 2.4.39-12 +- drop /var/lib/dav directory, since mod_dav_fs uses statedir + +* Wed Jul 17 2019 Joe Orton - 2.4.39-11 +- mod_cgid: use fd passing to fix script stderr handling (#1591157) + +* Mon Jul 8 2019 Joe Orton - 2.4.39-10 +- htpasswd: add SHA-256/512 support +- apachectl: restore -V/-v/-t support (#1727434) + +* Fri Jun 21 2019 Joe Orton - 2.4.39-9 +- create instance-specific StateDir in httpd@.service, instance.conf + +* Thu Jun 20 2019 Joe Orton - 2.4.39-8 +- remove superfluous ap_hack_ symbols from httpd binary +- more verbose %%check section + +* Thu Jun 13 2019 Lubos Uhliarik - 2.4.39-7 - remove bundled mod_md module -- Related: #1747898 - add mod_md package -* Thu Aug 29 2019 Lubos Uhliarik - 2.4.37-16 -- Resolves: #1744999 - CVE-2019-9511 httpd:2.4/mod_http2: HTTP/2: large amount - of data request leads to denial of service -- Resolves: #1745086 - CVE-2019-9516 httpd:2.4/mod_http2: HTTP/2: 0-length - headers leads to denial of service -- Resolves: #1745154 - CVE-2019-9517 httpd:2.4/mod_http2: HTTP/2: request for - large response leads to denial of service +* Thu Jun 13 2019 Joe Orton - 2.4.39-6 +- mod_ssl: fix "httpd -L" (etc) before httpd-init.service runs -* Tue Jul 16 2019 Lubos Uhliarik - 2.4.37-15 -- Resolves: #1730721 - absolute path used for default state and runtime dir by - default +* Wed Jun 12 2019 Joe Orton - 2.4.39-5 +- fixes for StateDir directive (upstream r1857731, r1857731) -* Thu Jun 27 2019 Lubos Uhliarik - 2.4.37-14 -- Resolves: #1724549 - httpd response contains garbage in Content-Type header +* Thu May 02 2019 Lubos Uhliarik - 2.4.39-4 +- httpd dependency on initscripts is unspecified (#1705188) -* Wed Jun 12 2019 Lubos Uhliarik - 2.4.37-13 -- Resolves: #1696142 - CVE-2019-0217 httpd:2.4/httpd: mod_auth_digest: access - control bypass due to race condition -- Resolves: #1696097 - CVE-2019-0220 httpd:2.4/httpd: URL normalization - inconsistency -- Resolves: #1669221 - `ExtendedStatus Off` directive when using mod_systemd - causes systemctl to hang -- Resolves: #1673022 - httpd can not be started with mod_md enabled +* Tue Apr 9 2019 Joe Orton - 2.4.39-3 +- fix statedir symlink to point to /var/lib/httpd (#1697662) +- mod_reqtimeout: fix default values regression (PR 63325) -* Mon Apr 08 2019 Lubos Uhliarik - 2.4.37-11 -- Resolves: #1695432 - CVE-2019-0211 httpd: privilege escalation - from modules scripts -- Resolves: #1696091 - CVE-2019-0215 httpd:2.4/httpd: mod_ssl: access control - bypass when using per-location client certification authentication +* Tue Apr 02 2019 Lubos Uhliarik - 2.4.39-2 +- update to 2.4.39 -* Wed Feb 06 2019 Lubos Uhliarik - 2.4.37-10 -- Resolves: #1672977 - state-dir corruption on reload +* Thu Feb 28 2019 Joe Orton - 2.4.38-6 +- apachectl: cleanup and replace script wholesale (#1641237) + * drop "apachectl fullstatus" support + * run systemctl with --no-pager option + * implement graceful&graceful-stop by signal directly +- run "httpd -t" from legacy action script -* Tue Feb 05 2019 Lubos Uhliarik - 2.4.37-9 -- Resolves: #1670716 - Coredump when starting in FIPS mode +* Tue Feb 05 2019 Lubos Uhliarik - 2.4.38-5 +- segmentation fault fix (FIPS) -* Fri Feb 1 2019 Joe Orton - 2.4.37-8 -- add security fix for CVE-2019-0190 (#1671282) +* Tue Feb 5 2019 Joe Orton - 2.4.38-4 +- use serverroot-relative statedir, rundir by default -* Tue Dec 11 2018 Joe Orton - 2.4.37-7 -- add DefaultStateDir/ap_state_dir_relative() (#1653009) +* Fri Feb 01 2019 Fedora Release Engineering - 2.4.38-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Wed Jan 23 2019 Lubos Uhliarik - 2.4.38-2 +- new version 2.4.38 (#1668125) + +* Mon Jan 14 2019 Björn Esser - 2.4.37-6 +- Rebuilt for libcrypt.so.2 (#1666033) + +* Thu Nov 22 2018 LuboÅ¡ Uhliarik - 2.4.37-5 +- Resolves: #1652678 - TLS connection allowed while all protocols are forbidden + +* Thu Nov 8 2018 Joe Orton - 2.4.37-4 +- add httpd.conf(5) (#1611361) + +* Wed Nov 07 2018 LuboÅ¡ Uhliarik - 2.4.37-3 +- Resolves: #1647241 - fix apachectl script + +* Wed Oct 31 2018 Joe Orton - 2.4.37-2 +- add DefaultStateDir/ap_state_dir_relative() - mod_dav_fs: use state dir for default DAVLockDB - mod_md: use state dir for default MDStoreDir -* Mon Dec 10 2018 Joe Orton - 2.4.37-6 -- add httpd.conf(5) (#1611361) +* Wed Oct 31 2018 Joe Orton - 2.4.37-1 +- update to 2.4.37 -* Mon Nov 26 2018 LuboÅ¡ Uhliarik - 2.4.37-5 -- Resolves: #1652966 - Missing RELEASE in http header +* Wed Oct 31 2018 Joe Orton - 2.4.34-11 +- add htcacheclean.service(8) man page -* Fri Nov 23 2018 LuboÅ¡ Uhliarik - 2.4.37-4 -- Resolves: #1641951 - No Documentation= line in htcacheclean.service files - -* Fri Nov 23 2018 LuboÅ¡ Uhliarik - 2.4.37-3 -- Resolves: #1643713 - TLS connection allowed while all protocols are forbidden - -* Thu Nov 22 2018 Joe Orton - 2.4.37-2 -- mod_ssl: fix off-by-one causing crashes in CGI children (#1649428) - -* Wed Nov 21 2018 Lubos Uhliarik - 2.4.37-1 -- Resolves: #1644625 - httpd rebase to 2.4.37 - -* Thu Oct 18 2018 LuboÅ¡ Uhliarik - 2.4.35-10 -- Related: #1493510 - RFE: httpd, add IP_FREEBIND support for Listen - -* Tue Oct 16 2018 Lubos Uhliarik - 2.4.35-9 -- mod_ssl: allow sending multiple CA names which differ only in case - -* Tue Oct 16 2018 Joe Orton - 2.4.35-7 -- mod_ssl: drop SSLRandomSeed from default config (#1638730) -- mod_ssl: follow OpenSSL protocol defaults if SSLProtocol - is not configured (Rob Crittenden, #1638738) - -* Mon Oct 15 2018 Joe Orton - 2.4.35-5 -- mod_ssl: don't require SSLCryptoDevice to be set for PKCS#11 cert - -* Mon Oct 15 2018 Lubos Uhliarik - 2.4.35-4 -- Resolves: #1635681 - sync with Fedora 28/29 httpd -- comment-out SSLProtocol, SSLProxyProtocol from ssl.conf in default - configuration; now follow OpenSSL system default (#1468322) -- dropped NPN support -- mod_md: change hard-coded default MdStoreDir to state/md (#1563846) -- don't block on service try-restart in posttrans scriptlet -- build and load mod_brotli -- mod_systemd: show bound ports in status and log to journal - at startup -- updated httpd.service.xml man page -- tweak wording in privkey passphrase prompt -- drop sslmultiproxy patch +* Fri Sep 28 2018 Joe Orton - 2.4.34-10 - apachectl: don't read /etc/sysconfig/httpd -- drop irrelevant Obsoletes for devel subpackage -- move instantiated httpd@.service to main httpd package -* Mon Oct 15 2018 Lubos Uhliarik - 2.4.35-3 -- Resolves: #1602548 - various covscan fixes +* Tue Sep 25 2018 Joe Orton - 2.4.34-9 +- fix build if OpenSSL built w/o SSLv3 support -* Thu Sep 27 2018 Lubos Uhliarik - 2.4.35-2 -- apache httpd can work with TLS 1.3 (#1617997) -- drop SSLv3 support patch +* Fri Sep 21 2018 Joe Orton - 2.4.34-8 +- comment-out SSLProtocol, SSLProxyProtocol from ssl.conf in + default configuration; now follow OpenSSL system default (#1468322) -* Thu Sep 27 2018 Lubos Uhliarik - 2.4.35-1 -- new version 2.4.35 (#1632754) +* Fri Sep 21 2018 Joe Orton - 2.4.34-7 +- mod_ssl: follow OpenSSL protocol defaults if SSLProtocol + is not configured (Rob Crittenden, #1618371) -* Mon Sep 03 2018 Lubos Uhliarik - 2.4.33-4 -- mod_ssl: enable SSLv3 and change behavior of "SSLProtocol All" - configuration (#1622630) +* Tue Aug 28 2018 LuboÅ¡ Uhliarik - 2.4.34-6 +- mod_ssl: enable SSLv3 and change behavior of "SSLProtocol All" + configuration (#1624777) -* Thu Jul 26 2018 Joe Orton - 2.4.33-3 -- mod_ssl: add PKCS#11 cert/key support (Anderson Sasaki, #1527084) +* Tue Aug 21 2018 Joe Orton - 2.4.34-5 +- mod_ssl: further TLSv1.3 fix (#1619389) -* Mon Apr 30 2018 LuboÅ¡ Uhliarik - 2.4.33-2 -- new version 2.4.33 +* Mon Aug 13 2018 Joe Orton - 2.4.34-4 +- mod_ssl: backport TLSv1.3 support changes from upstream (#1615059) + +* Fri Jul 20 2018 Joe Orton - 2.4.34-3 +- mod_ssl: fix OCSP regression (upstream r1555631) + +* Wed Jul 18 2018 Joe Orton - 2.4.34-2 +- update Obsoletes for mod_proxy_uswgi (#1599113) + +* Wed Jul 18 2018 Joe Orton - 2.4.34-1 +- update to 2.4.34 (#1601160) + +* Mon Jul 16 2018 Joe Orton - 2.4.33-10 +- don't block on service try-restart in posttrans scriptlet +- add Lua-based /server-status example page to docs +- obsoletes: and provides: for mod_proxy_uswgi (#1599113) + +* Fri Jul 13 2018 Fedora Release Engineering - 2.4.33-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Fri Jul 6 2018 Joe Orton - 2.4.33-8 +- add per-request memory leak fix (upstream r1833014) + +* Fri Jul 6 2018 Joe Orton - 2.4.33-7 +- mod_ssl: add PKCS#11 cert/key support (Anderson Sasaki) + +* Tue Jun 12 2018 Joe Orton - 2.4.33-6 +- mod_systemd: show bound ports in status and log to journal + at startup. + +* Thu Apr 19 2018 Joe Orton - 2.4.33-5 +- add httpd@.service; update httpd.service(8) and add new stub + +* Mon Apr 16 2018 Joe Orton - 2.4.33-4 +- mod_md: change hard-coded default MdStoreDir to state/md (#1563846) + +* Thu Apr 12 2018 Joe Orton - 2.4.33-3 +- mod_ssl: drop implicit 'SSLEngine on' for vhost w/o certs (#1564537) + +* Fri Mar 30 2018 Adam Williamson - 2.4.33-2 +- Exclude mod_md config file from main package (#1562413) + +* Wed Mar 28 2018 Joe Orton - 2.4.33-1 +- rebase to 2.4.33 (#1560174) - add mod_md subpackage; load mod_proxy_uwsgi by default -* Mon Apr 30 2018 Joe Orton - 2.4.28-8 -- remove %%ghosted /etc/sysconfig/httpd (#1572676) +* Mon Mar 05 2018 Jitka Plesnikova - 2.4.29-8 +- Rebuilt with brotli 1.0.3 -* Wed Mar 07 2018 LuboÅ¡ Uhliarik - 2.4.28-2 -- Resolves: #1512563 - httpd: update welcome page branding -- Resolves: #1511123 - RFE: httpd use event MPM by default -- Resolves: #1493510 - RFE: httpd, add IP_FREEBIND support for Listen +* Mon Feb 26 2018 Joe Orton - 2.4.29-7 +- simplify liblua detection in configure + +* Wed Feb 07 2018 Fedora Release Engineering - 2.4.29-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Sat Jan 27 2018 Joe Orton - 2.4.29-5 +- link mod_lua against -lcrypt (#1538992) + +* Fri Jan 26 2018 Paul Howarth - 2.4.29-4 +- Rebuild with updated flags to work around compiler issues on i686 + (#1538648, #1538693) + +* Sat Jan 20 2018 Björn Esser - 2.4.29-3 +- Rebuilt for switch to libxcrypt + +* Thu Nov 23 2017 Joe Orton - 2.4.29-2 +- build and load mod_brotli + +* Wed Oct 25 2017 LuboÅ¡ Uhliarik - 2.4.29-1 +- new version 2.4.29 + +* Tue Oct 10 2017 Joe Orton - 2.4.28-3 +- drop obsolete Obsoletes +- update docs, Summary +- trim %%changelog + +* Tue Oct 10 2017 Patrick Uiterwijk - 2.4.28-2 +- Backport patch for fixing ticket key usage * Fri Oct 06 2017 LuboÅ¡ Uhliarik - 2.4.28-1 - new version 2.4.28 @@ -1415,13 +1369,10 @@ rm -rf $RPM_BUILD_ROOT - use sscg defaults; append CA cert to generated cert - document httpd-init.service in httpd-init.service(8) -* Thu Sep 21 2017 Jeroen van Meeuwen - 2.4.27-8 -- Address CVE-2017-9798 by applying patch from upstream (#1490344) - * Wed Sep 20 2017 Stephen Gallagher - 2.4.27-8.1 - Generate SSL certificates on service start, not %%posttrans -* Tue Sep 19 2017 Joe Orton - 2.4.27-8.1 +* Tue Sep 19 2017 Joe Orton - 2.4.27-8 - move httpd.service.d, httpd.socket.d dirs to -filesystem * Wed Sep 13 2017 Joe Orton - 2.4.27-7 @@ -1904,124 +1855,3 @@ rm -rf $RPM_BUILD_ROOT - split all LoadModules to conf.modules.d/*.conf - include conf.d/*.conf at end of httpd.conf - trim %%changelog - -* Mon Feb 13 2012 Joe Orton - 2.2.22-2 -- fix build against PCRE 8.30 - -* Mon Feb 13 2012 Joe Orton - 2.2.22-1 -- update to 2.2.22 - -* Fri Feb 10 2012 Petr Pisar - 2.2.21-8 -- Rebuild against PCRE 8.30 - -* Mon Jan 23 2012 Jan Kaluza - 2.2.21-7 -- fix #783629 - start httpd after named - -* Mon Jan 16 2012 Joe Orton - 2.2.21-6 -- complete conversion to systemd, drop init script (#770311) -- fix comments in /etc/sysconfig/httpd (#771024) -- enable PrivateTmp in service file (#781440) -- set LANG=C in /etc/sysconfig/httpd - -* Fri Jan 13 2012 Fedora Release Engineering - 2.2.21-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild - -* Tue Dec 06 2011 Jan Kaluza - 2.2.21-4 -- fix #751591 - start httpd after remote-fs - -* Mon Oct 24 2011 Jan Kaluza - 2.2.21-3 -- allow change state of BalancerMember in mod_proxy_balancer web interface - -* Thu Sep 22 2011 Ville Skyttä - 2.2.21-2 -- Make mmn available as %%{_httpd_mmn}. -- Add .svgz to AddEncoding x-gzip example in httpd.conf. - -* Tue Sep 13 2011 Joe Orton - 2.2.21-1 -- update to 2.2.21 - -* Mon Sep 5 2011 Joe Orton - 2.2.20-1 -- update to 2.2.20 -- fix MPM stub man page generation - -* Wed Aug 10 2011 Jan Kaluza - 2.2.19-5 -- fix #707917 - add httpd-ssl-pass-dialog to ask for SSL password using systemd - -* Fri Jul 22 2011 Iain Arnell 1:2.2.19-4 -- rebuild while rpm-4.9.1 is untagged to remove trailing slash in provided - directory names - -* Wed Jul 20 2011 Jan Kaluza - 2.2.19-3 -- fix #716621 - suexec now works without setuid bit - -* Thu Jul 14 2011 Jan Kaluza - 2.2.19-2 -- fix #689091 - backported patch from 2.3 branch to support IPv6 in logresolve - -* Fri Jul 1 2011 Joe Orton - 2.2.19-1 -- update to 2.2.19 -- enable dbd, authn_dbd in default config - -* Thu Apr 14 2011 Joe Orton - 2.2.17-13 -- fix path expansion in service files - -* Tue Apr 12 2011 Joe Orton - 2.2.17-12 -- add systemd service files (#684175, thanks to Jóhann B. Guðmundsson) - -* Wed Mar 23 2011 Joe Orton - 2.2.17-11 -- minor updates to httpd.conf -- drop old patches - -* Wed Mar 2 2011 Joe Orton - 2.2.17-10 -- rebuild - -* Wed Feb 23 2011 Joe Orton - 2.2.17-9 -- use arch-specific mmn - -* Wed Feb 09 2011 Fedora Release Engineering - 2.2.17-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild - -* Mon Jan 31 2011 Joe Orton - 2.2.17-7 -- generate dummy mod_ssl cert with CA:FALSE constraint (#667841) -- add man page stubs for httpd.event, httpd.worker -- drop distcache support -- add STOP_TIMEOUT support to init script - -* Sat Jan 8 2011 Joe Orton - 2.2.17-6 -- update default SSLCipherSuite per upstream trunk - -* Wed Jan 5 2011 Joe Orton - 2.2.17-5 -- fix requires (#667397) - -* Wed Jan 5 2011 Joe Orton - 2.2.17-4 -- de-ghost /var/run/httpd - -* Tue Jan 4 2011 Joe Orton - 2.2.17-3 -- add tmpfiles.d configuration, ghost /var/run/httpd (#656600) - -* Sat Nov 20 2010 Joe Orton - 2.2.17-2 -- drop setuid bit, use capabilities for suexec binary - -* Wed Oct 27 2010 Joe Orton - 2.2.17-1 -- update to 2.2.17 - -* Fri Sep 10 2010 Joe Orton - 2.2.16-2 -- link everything using -z relro and -z now - -* Mon Jul 26 2010 Joe Orton - 2.2.16-1 -- update to 2.2.16 - -* Fri Jul 9 2010 Joe Orton - 2.2.15-3 -- default config tweaks: - * harden httpd.conf w.r.t. .htaccess restriction (#591293) - * load mod_substitute, mod_version by default - * drop proxy_ajp.conf, load mod_proxy_ajp in httpd.conf - * add commented list of shipped-but-unloaded modules - * bump up worker defaults a little - * drop KeepAliveTimeout to 5 secs per upstream -- fix LSB compliance in init script (#522074) -- bundle NOTICE in -tools -- use init script in logrotate postrotate to pick up PIDFILE -- drop some old Obsoletes/Conflicts - -* Sun Apr 04 2010 Robert Scheck - 2.2.15-1 -- update to 2.2.15 (#572404, #579311) - diff --git a/httpd.sysusers b/httpd.sysusers new file mode 100644 index 0000000..26fe0e4 --- /dev/null +++ b/httpd.sysusers @@ -0,0 +1,2 @@ +g apache 48 +u apache 48 "Apache" /usr/share/httpd /sbin/nologin diff --git a/SOURCES/httpd.tmpfiles b/httpd.tmpfiles similarity index 100% rename from SOURCES/httpd.tmpfiles rename to httpd.tmpfiles diff --git a/SOURCES/httpd@.service b/httpd@.service similarity index 55% rename from SOURCES/httpd@.service rename to httpd@.service index c58ae88..8b20b90 100644 --- a/SOURCES/httpd@.service +++ b/httpd@.service @@ -12,12 +12,32 @@ Environment=LANG=C Environment=HTTPD_INSTANCE=%i ExecStartPre=/bin/mkdir -m 710 -p /run/httpd/instance-%i ExecStartPre=/bin/chown root.apache /run/httpd/instance-%i +ExecStartPre=/bin/mkdir -m 700 -p /var/lib/httpd/instance-%i +ExecStartPre=/bin/chown apache.apache /var/lib/httpd/instance-%i ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND -f conf/%i.conf ExecReload=/usr/sbin/httpd $OPTIONS -k graceful -f conf/%i.conf # Send SIGWINCH for graceful stop KillSignal=SIGWINCH KillMode=mixed +DevicePolicy=closed +KeyringMode=private +LockPersonality=yes +MemoryDenyWriteExecute=yes +OOMPolicy=continue +PrivateDevices=yes PrivateTmp=true +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=read-only +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=yes +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native [Install] WantedBy=multi-user.target diff --git a/SOURCES/instance.conf b/instance.conf similarity index 79% rename from SOURCES/instance.conf rename to instance.conf index f2b03f7..074fb66 100644 --- a/SOURCES/instance.conf +++ b/instance.conf @@ -1,6 +1,6 @@ # # This is an example instance-specific configuration file. See the -# httpd.service(8) man page for detailed information on using the +# httpd@.service(8) man page for detailed information on using the # the httpd@.service with instances. # # To use this example, copy instance.conf to /etc/httpd/conf/foobar.conf @@ -10,7 +10,7 @@ # # systemctl start httpd@foobar.service # # The changes compared to the default are: -# - DefaultRuntime and Pidfile renamed to be instance-specific +# - DefaultRuntime, DefaultStateDir and Pidfile renamed to instance-specific # - default logfile names are prefixed with the instance name # - /etc/httpd/conf.d is NOT included by default (conf.modules.d still is) # @@ -20,4 +20,5 @@ # DefaultRuntimeDir /run/httpd/instance-${HTTPD_INSTANCE} +DefaultStateDir /var/lib/httpd/instance-${HTTPD_INSTANCE} PidFile /run/httpd/instance-${HTTPD_INSTANCE}.pid diff --git a/SOURCES/manual.conf b/manual.conf similarity index 100% rename from SOURCES/manual.conf rename to manual.conf diff --git a/server-status.conf b/server-status.conf new file mode 100644 index 0000000..be98f1b --- /dev/null +++ b/server-status.conf @@ -0,0 +1,10 @@ +# +# Lua-based server-status page; requires mod_lua to be loaded +# as per default configuration. +# +LuaMapHandler ^/server-status$ /usr/share/httpd/server-status/server-status.lua + + + AllowOverride None + Require local + diff --git a/sources b/sources new file mode 100644 index 0000000..63bea6a --- /dev/null +++ b/sources @@ -0,0 +1,2 @@ +SHA512 (apache-poweredby.png) = 51d2796ca0ed0f48c5aaaa207c3778ae99ff3652653099d65d30138ec4568f409db846943ed7c0e2d8a4e1aa29281e0d0daae24056c41cf49760dacba153eb00 +SHA512 (httpd-2.4.63.tar.bz2) = a804ca564dfee5907fe4ce4f36884815bace0621bc7b8c9aa7c99472a954aa19cb13733f90678ff3d58ab3c76cc0e33a27e1035dc1d8cb597a9622154c59ef48 diff --git a/SOURCES/ssl.conf b/ssl.conf similarity index 100% rename from SOURCES/ssl.conf rename to ssl.conf diff --git a/SOURCES/userdir.conf b/userdir.conf similarity index 100% rename from SOURCES/userdir.conf rename to userdir.conf diff --git a/SOURCES/welcome.conf b/welcome.conf similarity index 79% rename from SOURCES/welcome.conf rename to welcome.conf index 37b7394..232c251 100644 --- a/SOURCES/welcome.conf +++ b/welcome.conf @@ -16,4 +16,5 @@ Alias /.noindex.html /usr/share/httpd/noindex/index.html -Alias /poweredby.png /usr/share/httpd/icons/apache_pb3.png \ No newline at end of file +Alias /poweredby.png /usr/share/httpd/icons/apache_pb3.png +Alias /system_noindex_logo.png /usr/share/httpd/icons/system_noindex_logo.png

    Description:Sets the maximum amount of time to wait for data on the websockets tunnel