From 63cd8f8e1ee6d8c11958c9ee47d5c79a43ba46af Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Tue, 12 Jul 2011 10:42:10 +0000
Subject: [PATCH] Perform an appropriate validUntil check on all input
 channels. Relies on an updated aggregator snapshot.

---
 mdx/at_aconet/beans.xml                |   9 ++++++--
 mdx/au_aaf/beans.xml                   |   9 ++++++--
 mdx/ca_caf/beans.xml                   |   9 ++++++--
 mdx/ch_switchaai/beans.xml             |   9 ++++++--
 mdx/cz_eduid/beans.xml                 |   9 ++++++--
 mdx/de_dfnaai/beans.xml                |   9 ++++++--
 mdx/es_sir/beans.xml                   |   9 ++++++--
 mdx/eu_clarin/beans.xml                |  15 +++++++++++++
 mdx/fi_haka/beans.xml                  |   9 ++++++--
 mdx/fr_renater/beans.xml               |   9 ++++++--
 mdx/gr_grnet/beans.xml                 |   9 ++++++--
 mdx/hu_eduid/beans.xml                 |   9 ++++++--
 mdx/ie_edugate/beans.xml               |  28 +++++++++++++++++++++++--
 mdx/int_edugain/beans.xml              |  28 +++++++++++++++++++++----
 mdx/it_idem/beans.xml                  |   9 ++++++--
 mdx/jp_gakunin/beans.xml               |   9 ++++++--
 mdx/lv_laife/beans.xml                 |   8 +++++--
 mdx/se_swamid/beans.xml                |  14 +++++++++++--
 mdx/si_arnes/beans.xml                 |  14 +++++++++++--
 mdx/uk_eduserv/beans.xml               |  14 +++++++++++--
 mdx/us_incommon/beans.xml              |   9 ++++++--
 mdx/validation-beans.xml               |  20 ++++++++++++++++++
 tools/ukf-mda/ukf-mda-0.6-SNAPSHOT.jar | Bin 12877 -> 12875 bytes
 23 files changed, 225 insertions(+), 42 deletions(-)

diff --git a/mdx/at_aconet/beans.xml b/mdx/at_aconet/beans.xml
index 35bc7087..afd19fcc 100644
--- a/mdx/at_aconet/beans.xml
+++ b/mdx/at_aconet/beans.xml
@@ -46,9 +46,14 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="at_aconet_productionAggregate"/>
-                <ref bean="at_aconet_checkSignature"/>
                 
-                <!-- failure to validate signature is fatal -->
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
+                <ref bean="at_aconet_checkSignature"/>
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/au_aaf/beans.xml b/mdx/au_aaf/beans.xml
index c868a40f..4cd206ed 100644
--- a/mdx/au_aaf/beans.xml
+++ b/mdx/au_aaf/beans.xml
@@ -46,9 +46,14 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="au_aaf_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
                 <ref bean="au_aaf_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/ca_caf/beans.xml b/mdx/ca_caf/beans.xml
index fe4245e0..67b1b7c6 100644
--- a/mdx/ca_caf/beans.xml
+++ b/mdx/ca_caf/beans.xml
@@ -46,9 +46,14 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="ca_caf_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
                 <ref bean="ca_caf_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/ch_switchaai/beans.xml b/mdx/ch_switchaai/beans.xml
index d3715a04..be4f459d 100644
--- a/mdx/ch_switchaai/beans.xml
+++ b/mdx/ch_switchaai/beans.xml
@@ -46,9 +46,14 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="ch_switchaai_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
                 <ref bean="ch_switchaai_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/cz_eduid/beans.xml b/mdx/cz_eduid/beans.xml
index 8a8d1a26..9def3abd 100644
--- a/mdx/cz_eduid/beans.xml
+++ b/mdx/cz_eduid/beans.xml
@@ -56,9 +56,14 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="cz_eduid_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
                 <ref bean="cz_eduid_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/de_dfnaai/beans.xml b/mdx/de_dfnaai/beans.xml
index 64a9b7cd..92ecea80 100644
--- a/mdx/de_dfnaai/beans.xml
+++ b/mdx/de_dfnaai/beans.xml
@@ -46,9 +46,14 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="de_dfnaai_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
                 <ref bean="de_dfnaai_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/es_sir/beans.xml b/mdx/es_sir/beans.xml
index 91a27f4b..956e26ba 100644
--- a/mdx/es_sir/beans.xml
+++ b/mdx/es_sir/beans.xml
@@ -46,9 +46,14 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="es_sir_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
                 <ref bean="es_sir_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/eu_clarin/beans.xml b/mdx/eu_clarin/beans.xml
index 36eb07f4..28a2f10b 100644
--- a/mdx/eu_clarin/beans.xml
+++ b/mdx/eu_clarin/beans.xml
@@ -24,6 +24,21 @@
         <property name="composedStages">
             <list>
                 <ref bean="eu_clarin_exportAggregate"/>
+                
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <!--
+                    Check for validUntil fails because this is a static file.
+                    No signature check, because the file is also unsigned.
+                -->
+                <!--
+                <ref bean="check_validUntil"/>
+                <ref bean="errorTerminatingFilter"/>
+                -->
+                
                 <ref bean="disassemble"/>
                 <ref bean="standardImportActions"/>
             </list>
diff --git a/mdx/fi_haka/beans.xml b/mdx/fi_haka/beans.xml
index c4c40790..455421fe 100644
--- a/mdx/fi_haka/beans.xml
+++ b/mdx/fi_haka/beans.xml
@@ -46,9 +46,14 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="fi_haka_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
                 <ref bean="fi_haka_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/fr_renater/beans.xml b/mdx/fr_renater/beans.xml
index 8e9692f2..507fc6cb 100644
--- a/mdx/fr_renater/beans.xml
+++ b/mdx/fr_renater/beans.xml
@@ -56,9 +56,14 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="fr_renater_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
                 <ref bean="fr_renater_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/gr_grnet/beans.xml b/mdx/gr_grnet/beans.xml
index 5f761fcf..1f32559f 100644
--- a/mdx/gr_grnet/beans.xml
+++ b/mdx/gr_grnet/beans.xml
@@ -46,9 +46,14 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="gr_grnet_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
                 <ref bean="gr_grnet_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/hu_eduid/beans.xml b/mdx/hu_eduid/beans.xml
index 9e2864e7..b84ffc27 100644
--- a/mdx/hu_eduid/beans.xml
+++ b/mdx/hu_eduid/beans.xml
@@ -46,9 +46,14 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="hu_eduid_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
                 <ref bean="hu_eduid_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/ie_edugate/beans.xml b/mdx/ie_edugate/beans.xml
index 5ee0d530..da61e224 100644
--- a/mdx/ie_edugate/beans.xml
+++ b/mdx/ie_edugate/beans.xml
@@ -45,6 +45,25 @@
         <property name="verificationCertificate" ref="ie_edugate_signingCertificate"/>
     </bean>
     
+    <!--
+        ie_edugate_validUntil
+        
+        Check that an aggregate has a validUntil instant specified, and that it has not
+        yet expired.  Sets a bound of 30 days on the validity interval.
+    -->
+    <bean id="ie_edugate_validUntil" class="net.shibboleth.metadata.dom.saml.ValidateValidUntilStage"
+        init-method="initialize" lazy-init="true">
+        <property name="id" value="ie_edugate_validUntil"/>
+        <!--
+            The validUntil attribute must be present.
+        -->
+        <property name="requireValidUntil" value="true"/>
+        <!--
+            Validity interval must not exceed 30 days.
+        -->
+        <property name="maxValidityInterval" value="#{ 1000L * 60 * 60 * 24 * 30 }"/>
+    </bean>
+    
     <!--
         Fetch and process the exported entities as a collection.
     -->
@@ -54,9 +73,14 @@
         <property name="composedStages">
             <list>
                 <ref bean="ie_edugate_exportAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="ie_edugate_validUntil"/>
                 <ref bean="ie_edugate_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/int_edugain/beans.xml b/mdx/int_edugain/beans.xml
index 066f161c..6a6f2a76 100644
--- a/mdx/int_edugain/beans.xml
+++ b/mdx/int_edugain/beans.xml
@@ -59,9 +59,19 @@
         <property name="composedStages">
             <list>
                 <ref bean="int_edugain_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <!--
+                    no validUntil element is present at the moment
+                -->
+                <!--
+                <ref bean="check_validUntil"/>
+                -->
                 <ref bean="int_edugain_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
@@ -80,9 +90,19 @@
         <property name="composedStages">
             <list>
                 <ref bean="int_edugain_testAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <!--
+                    no validUntil element is present at the moment
+                -->
+                <!--
+                <ref bean="check_validUntil"/>
+                -->
                 <ref bean="int_edugain_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/it_idem/beans.xml b/mdx/it_idem/beans.xml
index 84da9f23..71475886 100644
--- a/mdx/it_idem/beans.xml
+++ b/mdx/it_idem/beans.xml
@@ -46,9 +46,14 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="it_idem_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
                 <ref bean="it_idem_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/jp_gakunin/beans.xml b/mdx/jp_gakunin/beans.xml
index ffe92c56..ea754c95 100644
--- a/mdx/jp_gakunin/beans.xml
+++ b/mdx/jp_gakunin/beans.xml
@@ -46,9 +46,14 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="jp_gakunin_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
                 <ref bean="jp_gakunin_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/lv_laife/beans.xml b/mdx/lv_laife/beans.xml
index 78c13e73..5f8344da 100644
--- a/mdx/lv_laife/beans.xml
+++ b/mdx/lv_laife/beans.xml
@@ -26,9 +26,13 @@
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="lv_laife_productionAggregate"/>
                 
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
                 <!-- this metadata is not signed -->
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/se_swamid/beans.xml b/mdx/se_swamid/beans.xml
index 256954f0..4e246359 100644
--- a/mdx/se_swamid/beans.xml
+++ b/mdx/se_swamid/beans.xml
@@ -46,9 +46,19 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="se_swamid_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <!--
+                	No validUntil attribute at present.
+                -->
+                <!--
+                <ref bean="check_validUntil"/>
+                -->
                 <ref bean="se_swamid_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/si_arnes/beans.xml b/mdx/si_arnes/beans.xml
index 608bdb86..4fac4287 100644
--- a/mdx/si_arnes/beans.xml
+++ b/mdx/si_arnes/beans.xml
@@ -46,9 +46,19 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="si_arnes_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <!--
+                    No validUntil attribute in this metadata
+                -->
+                <!--
+                <ref bean="check_validUntil"/>
+                -->
                 <ref bean="si_arnes_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/uk_eduserv/beans.xml b/mdx/uk_eduserv/beans.xml
index b6804f2a..acc57376 100644
--- a/mdx/uk_eduserv/beans.xml
+++ b/mdx/uk_eduserv/beans.xml
@@ -44,9 +44,19 @@
         <property name="composedStages">
             <list>
                 <ref bean="uk_eduserv_exportAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <!--
+                    No validUntil attribute in this metadata.
+                -->
+                <!--
+                <ref bean="check_validUntil"/>
+                -->
                 <ref bean="uk_eduserv_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/us_incommon/beans.xml b/mdx/us_incommon/beans.xml
index 08d457e1..85b3b9f2 100644
--- a/mdx/us_incommon/beans.xml
+++ b/mdx/us_incommon/beans.xml
@@ -45,9 +45,14 @@
             <list>
                 <!-- no export aggregate; use the production one instead -->
                 <ref bean="us_incommon_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
                 <ref bean="us_incommon_checkSignature"/>
-                
-                <!-- failure to validate signature is fatal -->
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
diff --git a/mdx/validation-beans.xml b/mdx/validation-beans.xml
index 97f50a28..8f489402 100644
--- a/mdx/validation-beans.xml
+++ b/mdx/validation-beans.xml
@@ -203,6 +203,26 @@
             </bean>
         </property>
     </bean>
+
+    <!--
+        check_validUntil
+        
+        Check that an aggregate has a validUntil instant specified, and that it has not
+        yet expired.  Does not put an upper bound on validUntil intervals.
+    -->
+    <bean id="check_validUntil" class="net.shibboleth.metadata.dom.saml.ValidateValidUntilStage"
+        init-method="initialize" lazy-init="true">
+        <property name="id" value="check_validUntil"/>
+        <!--
+            The validUntil attribute must be present.
+        -->
+        <property name="requireValidUntil" value="true"/>
+        <!--
+            Do not constrain the validity interval in this general stage.
+            Constrain in necessary on a per-channel basis.
+        -->
+        <property name="maxValidityInterval" value="0"/>
+    </bean>
     
     <!--
         check_vhosts
diff --git a/tools/ukf-mda/ukf-mda-0.6-SNAPSHOT.jar b/tools/ukf-mda/ukf-mda-0.6-SNAPSHOT.jar
index 407bbb62925596816488387d5bfdfb6dc9ca413b..d31778af31ff83619ebd6ad77b1023e2c75e04a6 100644
GIT binary patch
delta 1572
zcmX?`ayo@Kz?+$civa}En_f@kRpCf$dTn=4;C{hG%Q|7>IK4PM285EsK@TUMl4Ax@
zua!X5WC2EfK_G1hHUUaVOjeYYo}A6dCD_pL+U}QIK)5P11H(Bs1_np4%tA)f`mep>
ztTnD8w}Wh0LpF3Mt>xSpI$5i;?snYuO$B>*-+9aVPf+-ObNnAB7vab1_CIF#6y~iw
z;?ONMyCglYEdANcnYG_;_xI0d^m(|jk;PdtYWtoAiLS5LyTr1@c%I)nt2A$FjOx|d
zi#Xmo{5r)w&pv9M{ntMyF1oMkGH+>AIlQG_dy43~Q&DG&TcWnka{6c$e&^FteVLbB
zuNnD|Zo0JbZd+N(i<#5cg>du4&V0k=Ty%0Zw{YwW-^J3lJjYKz`Du}L&E-SSb(v2u
zw5!d^!zvUWzn^BfGA#8(!S+A$p&}Ahuj4X<Z%kY?A#B;5m5X*=-_jMg`ANsJ0@0~g
zbW-AtW-P7ujs8)%=YoU$;XCryi$2@&+C;Y~eoZ-l{|JMhq(sVzzqV~Ae#sqHQahy?
zze}<i-TWj~e^$4BH}7lDT;Ch35)xV#+UH$7wq<Se7Nr>$-JjXc8J>}uX7t4O_^L}m
znUSj}zOQcddd#GEsUT&?{>wbhGmB=oT-hX|XQ(o*TTL(dPW=JVwvRs+Jm(I7-Z`aY
zjc<_HRIZfXW1FVG)iUBymv(xayS6}m(Z<kQ>c7_thZYq`=jz;SUREKn(?o5;^3@(U
zAKCq1H79YJ)t!}*Qoko1KKx<k_BU-^ySJ@y>6;|_?y|@_!#QtD!XNL>OcJ`D%y%b2
z;>?zVyONTm%z4kq7;QLgP`{**dwXYD-I8yq8Fxi|-95h=J^A0td1XcXZC&G|`PRa-
z_O3bJVizELIB-$hUO$Uy7Wublj*0#EG0<67$aB22GgO}|=VQRJbu;%r__tMp>EnJa
zX}$13hrF`mE$ucLpZ{N4*~;X`St9-@UOe;5ql;M=rn^p>_~u-$^4G>GEIv{7)muI?
z^<9{C&(`6S#>tczi@8<{OBc2AeV+D3<>a3uV!!q$?3i@_;LLK1`RTQbttF~$eu~y^
znfkZor1<398@3rttyzEY$W1p5d4o2QbpdY*tK!x@;xRg*xL)u{S@L#)Be!&(X_R-p
zs9|SyDwg^?<9KY>c8A}Z8{VIgl&}j_+45b7Z^79~s*an?%|Eg-NALJw7yr;_x$ler
z%zO0~u1I~U4$E>J48Y8_`5#LTJ2<!H@@xaqo7H&Jn81vFem1bo<{4s25RttS!7N}Y
zVOd@XLs{`SGcz!APkyVS1*WA`?LhSAXw_6Uu)tw$6L_|t{9oG&Y?qCW9+=M6F#^+z
zbnL<O6CGz>lzcteL^la6GgDWZ={?KjKt`#_7j*R%K*d6KyR1PWuvlmWVlAXHVo75h
z4_Kk49=JG}9Hl4CB+d&K^5+%R4)A7V5@80FOW+W&(@ji_*aIv;)OZ;f^ij-dn0!&s
z4s2K4p?7sx85tM~frX6`ikeO_u)&`CYG8$n7I6Ie0#x*fgMq;XMd3P$$&3a@lmAJG
zV7Q=$V`JwYpr(yLO=c*XSSA^`g3aCYocC-OP{}i(LzPgJh$sThm6`0P$T7LofF}kR
z_$UP?KU}c@!~g&HR2Ue1T|*poJ^kGDa}&!_^YjtH0WPLdG%KTM=AQh~z(^k50&NsE
oK0q~UllxV<CKnlMFiwT?I3_<(WuJV(P>b>9<llxqY@5KE0MW)}5dZ)H

delta 1551
zcmX?|ayErGz?+$civa|3JkCz!RpH3?IBU1hS)Oa6Wu35aoL-zB142nn)2WH4<d{L!
zYb6jhS%6WWIluMHWG6;r!Jeiwb}t{@l~HGAU^vOfz~DGJfKhsKysqZtQ;a<It|A{;
zT?FGd=(YxbWYt~Zk*%^VD@gTX{_WRMVe87L@3uW?pY*8yLwEdvjHDk=*y|@7o?ClV
zB13emXZf?V^0av~Z>I0B`Tc?OK<XXS2?-i5+0(>L)?~chxuUy4`{mBC&F9umTD_zy
zRAiy7M||bM$-hs3b)P41`O72pW1GQ*lo|Dft(y*oMy{^x3s@Z%tP%ITD|+9TR^`~l
zyAKyegjsF7eW8!Xw)oQ2tj2}flVcM-^eRge7jf^+ELq&XaKFzy{zYlNEd7;d75f`E
zr5C5SvK#%&lboCt+Q#$w>Higr4qS--?j?PwPo#B=(NjOst9zG)ewn4}ZqmAX#ga6|
z-#rI)>T_=#>VMqI#wL;XXQQ&!`^5(~yGjK4*ZrC;aVU`4U83ms@d?KaWtR83y{kG<
z+qTeW+n=WWPo^Ed+xB(CH>Vq`5)xVx4e~Dj>RH>oMQMh_QB7v`l^^ae<*B^9QA_u<
z?ZY2R9?3k*Gxdz_+)ZhFJhNza%$2nw=L}S)b*r6AJanM4zOD1eg6G`f%R8o&tl<q3
zo642as}|H-bDujzN_;}1#T|iH&#!TnE6s{nTDvKJR)8w|_KU|R-OcVwpWvM=RJp5l
zif-OVzlS`VuiWvgy>w%`j9gp)-c<9DJ6l~<i>9n8n9pW#*5KC5S;wwlIwGQX?D~J9
z!xMd^*J!Jy6<j?a+NNFqze%w-dxu}oXXUNh&aWqBsCliLuK3?vWr5q<ob6{s_P_PX
z__j%|xYECrr}hX}b#KA89k%yocIdvEnGoUgSm9S^OQ=3qPGR`5bu()()LFGTTv>mr
z?R2QfgxPluALifNv~&N<D^84$S$1)MT;FX{^(Mpg#c8FJ9%awBO{jABVyahLYkSM0
zjd{zmdKrbA?naX0e#`kX=dM_Ic#oQ`r;+{6&V#u;;h)|YKH~Lzdh@`K>N&LrUnQBh
zO#R!ja(Qs{2D3uTpJC0Nn|lN79_R#F_-|Byk-D=%_=H0H9=8d<1$Vb9TuUo#E?VAk
z&OA`T<hVhH<(c3;thf9dYhBMB_^?n(Z{gmp?77o)I4AAhc`}zL_tCf8v8~2)%@+PI
z|FWxP(X^%SVcCp>;Y;J0&3{;O*qM!*PfgC|*~VNGeP*)?ZyFOQ%WdxEXJcostvs`N
znwSz3vytoB&ATOnS-=cISzZ=qy_PeZ6%~&&GXpd9<ku=%U|K@e4n%K`R83_A3mnuo
zfoJu}f3>Z^x!Fob4@_t47=h^pI`-h){Yb}|7bSO3HquQ}06No7+2ig(F?I%qrTh#G
z*5G0ULM&<g$TB&QQEKuzU44)@Ch18tCGdbn%=P3HfF80_e6%@Sj){Tc3b44)MbRqB
z3s%^#r>Fq*u$^vVV#FR`d7{S4z@U$!u!$e6@Rgo2C_p9)=u0zoi-Cpqi%IbZcr!AI
zFoOy=4hCQ_O)daRZ;${>TgggH-mkBq02H>X;n>)@2k3^491IL*D8{qNLKVyDAe#jY
zV7oofdCztMH9Z5mO9@4jm?BtHt$|o9Fu?7Q<QRZq1O);N|NlQwVPNoe4RO@<^mEhC
zO)N{z(?{3>E{;(&E5r0MfHd=}PTr`hs*O*BHi`zn$qt4QOw&QyOeUW*)M9$A1!Njd
M);5x2+X7Y!0Bapp#Q*>R