From 75326e397c619a2b58963d3fd9fc1a1a5eda13a0 Mon Sep 17 00:00:00 2001 From: Jin Date: Thu, 6 Oct 2022 09:52:56 -0700 Subject: [PATCH] fix: adding one more pattern to relax the regex check for sts and impersonation url endpoints (#1158) * fix: relax regex for sts and impersonation url with one more pattern * adding more testcases for invalid url * chore: update token --- google/auth/external_account.py | 2 ++ system_tests/secrets.tar.enc | Bin 10324 -> 10324 bytes tests/test_external_account.py | 20 ++++++++++++++++++++ 3 files changed, 22 insertions(+) diff --git a/google/auth/external_account.py b/google/auth/external_account.py index a87f92ea4..eb216fb72 100644 --- a/google/auth/external_account.py +++ b/google/auth/external_account.py @@ -443,6 +443,7 @@ def validate_token_url(token_url): "^sts\\.googleapis\\.com$", "^sts\\.[^\\.\\s\\/\\\\]+\\.googleapis\\.com$", "^[^\\.\\s\\/\\\\]+\\-sts\\.googleapis\\.com$", + "^sts\\-[^\\.\\s\\/\\\\]+\\.p\\.googleapis\\.com$", ] if not Credentials.is_valid_url(_TOKEN_URL_PATTERNS, token_url): @@ -455,6 +456,7 @@ def validate_service_account_impersonation_url(url): "^iamcredentials\\.googleapis\\.com$", "^iamcredentials\\.[^\\.\\s\\/\\\\]+\\.googleapis\\.com$", "^[^\\.\\s\\/\\\\]+\\-iamcredentials\\.googleapis\\.com$", + "^iamcredentials\\-[^\\.\\s\\/\\\\]+\\.p\\.googleapis\\.com$", ] if not Credentials.is_valid_url( diff --git a/system_tests/secrets.tar.enc b/system_tests/secrets.tar.enc index 2bef7d971ed407a5c67431d403624e65b2c28877..78f7254cb92a2cbd1bdb0b492bb9168b9fe9ff68 100644 GIT binary patch literal 10324 zcmV-aD67{BB>?tKRTEJdB@TmuReiXBq3L?~*709=*oKQlai!e(>Z1k*vS$*iPyni{ zhrCLxGYotSes)LNKEcTGo+A~c=&)CV&{*pttenk|#tE_%9sVyD-MFJ9aqML{9FwA5 z0@wso8t-<+lM(*7O;gYnTFKS;pE`PE*kXcJ-O(V>w8rG{IV!Gxg*lKWjf~u$XdnoR z(FpB(Nre(WHtlqt`lTc_yWE7ToU3=o1gp_WP{%4!i+F9t?qHg%cH<3~8to?lnaj{?>Z8mkWMZ;D4E*f?ISyH;ENEm+0qBH-A( ztCY^|RIToqYzJVb{tVI>dG#~CiW7g`kS$)`{f*sm-xNXOr7uoF%X8!8jbTVaMn@0| z(4HTr)?rh9iEq0Z&LX{IV2zGf8;U6V$_CW+I80qwP6&El^}QPTc@K$)%wh~EC#~TB zRTcyo7}M3YtetA z)P>ZESjC4D_Y~fCXL=c}9k~qN>)GeFt792I=y$1dp_k;P+}bdseX8aBc;AV)x#W`0 zb&ZKR>jVRm(%G!(j}ixJ?z0=%R}9huU)?C)=nW% zGq>?~jyG!J`fo`q9(wPtWigN^WV2GS=#aAJ+`Sm|Q1SN(UvH$>yOiT7(sOa`aAYYn zzzlht0=P>rL~k&aC%)Eubr7O(QGcSckVw1oG>_bKNkTlzbixmiXC$7RQCy0j%Ls~u zk)fV76(VcCeWjmQv5UOdjW(**HH-0ujiM`k*&vfbeOWEDi1`ipNQoYH_0jMGjW~OJ z%`i0Yfxsq-ZyU^@2V7jg@q_5^)maO^F^t@}q}!Ni_S&95Rod`&=}>8K>Mem5E&R~I zZus_3#4#zK@I0*r19NNyv?Z_`xcs}69ki9riXj%IIC}D!@V9JxcaGF3W(nmKFY4Q8 zc|i1WKaZUK+h+kLz4)0By z$r5eyf=AZcSSWU6u!9{D6{oo$i%}Jpe<+vyx z$*M{5>i~R1tFo`BL#Xa699FkHoP_;9iu9eabY$=#lYRC(yR0&P+R{M@YZG5(BaI{{ zcG(AdUxFihGsVrxbvQdzt3Vy-zq@bOUfsAe_vSlOug0-L@QJ%; zejIJ-w}aDt)#IqZZM#st?Mz4#T=%?Kf76{Xz0A1a0QU7^{usw|en^K8j2@0)Gq9~u zBOAl4L}v6800>rFa>S>HI1HafEh=kt<5{M}YY1>o)J3Ga$bSl;81 ztR(V8FvTzsFYyW#MpYu|k4$P~F~Yh)IhJoEPu4l-85MQm>tyqnsb79qM7*Q#&%<|; zHC-z*D4PrhS%>t;T&0G=Ahwes%JYWvFm%~tBKzr7F0l537U6Y4V+}+|LNgJ43js)f zr((5n2`q(Ljb1l5372y!laYg~oICtc`m9Za1hn(=HG7XGk=Sh>$C%l;$&@y4|HA+bFukFE=ol&mjKAy*tBku(7L%+@I7JZeu*%KmJ;cRXGwZ^>j4Wl!F|EkY*dm z3>`SHtZfQA$s4kuNL^_dFClZ7Gt~;_3!!>G2Dm9<(hTM;{XsNqNEhTPidfF+tFS9t z3`ROHG)<{fI&Qq01oN|FX$j?QFma0ec*&k>xn4t(BqjqQ@(-Gnf`;rls~QFnD0Z#f zS8<`{(U;DXjx=Kh$&FNPP`QSc_mvjKG0XrvVEn~$?!Fnb_QYM-p&`f{8A3Lp8G}~_aUZlp)#HDez$!44Pq$uum?US_ghp?%=Su&qXOAc1DM@vH z%;PVFR@8YGw7iU2xD%)GnuH_@X<0amy?nR-7r^SV+olO_2o;sv7@aQ7uhnPk?)|uMy4ltMCcmsjf+QwtK*MFtewOQYTe!n( zmQ;rUrMLEL6utU_;Kd*dQf2)jwAVk)^cp238=X5p|kxIZfN9Jm# zfRcXot!BLIJrQBp^&B`HqvZYLUV191}-QAwkGkEa@YVzMV z>F>CtMt3~qo=xFq)K6#sl&;!dg&N(Z8cllT(!E7Qa}F2Qx~*x)?{$BiAHxJCqd!iH zbG3g_uG%lS+y-qpQA)B}a}}uBhyVQ`)Ozk0`YTqtNWS3IWsF3Q3mExL+q9|!l|*22 zFGYHs`VoH3L#kZzSS>I@!a5yNGDnJF;`XUaaVSn3yb%akf_0BUP)vmDKUjI&N}>b? zF>x1J*f1n>!s76;ULUJ#nAl zswc$iX$xupm8)#uR2#{Py!yRWYo#C7q5k@=P5zET#+)+Bayukf3xOF(Q|Bs!OzdBfhA(fyD|t58!E6Bw5N`ypSpd6 z_M;W|YBKHHwa~5amwUA=EBU80SEpuhXy<`8vJCmxsdaS%>Yh2!e65-_mCp_^+M&Qa z-5|4ms-qMhzr&1tX$(LR$D%Vn+k{pLGW+(59;Tjrg^;!v&HZvcraKomO{VDtwc?=f zaDsO%AY#%obw=#HrqxFxqmrG(Im7JUxn63AkNB=$Z3lzdiC+qR^?ah z9M@>-5`Lku&*FRbAzoMBUSO)L|2bFU`3Jo^)-v!9I?CByCPQLL{V#uBFH{g7g8 zXRiRd2dRX6#3Xl?$+&nyR0eC&(_}Frxti`}@s%6o>Xf#@)AX#vN}_nw?f?TWYmNNzha;%vXB06??_AS?Sva{r6%n9F zMQ!K^*?)i}vs?PhF-=A|$lWM?we0aHW}BJ+mA;1cI~1rrD&5Kji_i-Ya|KK1Y%1Th zo~CMqhP$>H4A*-AuTQXz$Ecw~N;oIEe1Q(P5xw#l6u?d_EhlUMn?Y(2>P6dh#!tV4Rky2eCWq<@Y2CS3!vwVr3{)` zM+J8o(NFvdzrwiBgU`#=cShyj62o{iaXRLs|7XH9^9}v$5nG`8`+r#vGQrzzpHdg@F3SBeYMiE`y2|YtD9OkAlw41phXpYV=Zd=fUR=m%Kp4(0WU9aTo z0GiLwzuRkTn5_B5F!E48`PN$(@A#;KNwv&xA4YN80n)gHy@*m;Otji+G!@gsq_g3^_BOux~x7o|3(yNz^q&7UrqG{D|*JIwXjh zpNBTjq<1`;Mt-xt<>Y_kK^?QCxVPXN2p_uvgl}x>=QDq6Azl${&FT}u$V&*m;ww4Y zY0Mcqr~GM=0un?_eCb+I!ZFeU1KBH`yHTl&vpq~Y{5+u_Cx+0@K32HOijaK{$eIA96!>4rE4`!MybcS^6`+(Tat^FMx@R?tlg zQ26@RIImb;nKUQ(b`E_kdzyH(6s6DRT}D0K<3x-l!fqIRpBT2`;xV`4a)LYPJP{14 zU@JNrAhyp4Llj~5izwfnvNIH1b^9bQfe*Y6F0=jwK-Uc4m~6GyNCmZj>xwe6H1zc8BKJ`M{TE|??WZ<(#kBhiWmBum(1jflRGs&#{b zcj#O^%{o1F$8-Z^C^(h1R%1Ny->ahls{k;mMnB*l;>LA$d~y7O*lr&YsI~otVROd8 z%*^6;Jvq{rj!5runT?iaGyW98&fX-blNil^jeoPawZ%KTvhMCG{jeavg9VG6%XOv< zb=RBn|h%(BS4Q{N6PvF-|EEC-j`u04dLAIqvL@LHdG%>YRn$A?yllaV<_G zKWnf^nETKuW;xA=$5!0s5QeDxhv3T=MYcm?DMa*0b+Oz(&2!1tR6R?$?zC_&y;B2f zZ)?}orL#8YRQ}S3kot8 z$%44VsU6GhwOiWARHj8_1_v~@>V2C2ml$Y6CE!Oql?t4L<1H)nLP<-amq~i;=QH$2 zHNK>t7s)%QKPy&_uVI@~)C12E9vL=UMg*Gvos1>@h2~| zbn%ix`K2tDI*y-<%$3k5=g-BOnBnmJ*6hUI(45Msw&gEIBk{9|dJ>ivGgW8X`)c|7 z`#g@|9aBSntj*000%Ucgs59^BObGe=>Jg6zg$>4-wNX03v@HNj*gsc6-X}`&L%>W+ zJuN{}s@LNr$X|H>dFX08)c6(PpqPN+1{t&elKeUIvi2nh$*Y}(X%Yh zkFv9fJLHc@%OsDi+u1$)U3obhR;P;mCoNdmEgOep`B_>4*AxdrK1E$~vv-P0?nuOG zE~y>WjlbxqeL#!k9L$sn8cEYR)>b8W(=rk;%4ZY*?%}YicAh8LUGt zMGsR!N(@(U6Z;G}ogZf0Lxf{RJW6E7;fVerz?a@R`P)*}F*>BU8Eud9#J=!V7sdoh zz51{D1K)O|^ZXBR{d zo@zA`3~WJJt{UIWo{Wf{PFY#WVOF172 zpdBdqfyUOr1HyhqQd~UklTCjI4@0kawac z@x{Ip{7!8&oA0Yu2t*#+P+CUA+YF6B!No%!(ZZ^C*g1uSZ~R$Wvy-z&mp1c+AmTA0 zn}tT5NLV5diOo!x#;Ba$D*`?k{#hr#2YKp8{%16ka@sI#@na*Dr6SO+kR92-a`nmd zPg8}ttwdx|ZMqm_?s+q>*8f$~=DP5k&3=sy*?rFCz=<8s#Z?T`MSR@|b&q;wY5Y6Bi)d32H3fC!RrcLPwlqH6yUa<^T zk8q3u|5Hk?9KY5>m^W-TR{g|uSDx`~)p1xsBg#_52}(ZkwnBEc{}K5KJccb0k#Q>j z-Jfqu0QAD{>8IdR>A$a7#8#}-NEBq8$056=umd1NM>-;SKLE9rN~TM$hN>EFm$3?X zGSlrC1=$N0!sJ8rDNC)5PyHgLe5AK+^RtRz)nUblS{sf<)L_6WMzO-1f~>^(4) z+)r8_o9Yg!c_HPy$4EDK8)cB=cH9(gpnyN*$BPVDlYoePJ44P|2bEFG^2=Y8Pw=sK zE>r!gDx{4~90!C%Vvt?v^~jxhoDUz2Q|@?k)F(Xog8dwUQH^Y z*%f1IXV~Jc(!npjB zccuP{@Dig~j@k-SZk<^n@K=?{YPLtHfSDklu!6UiB_tK%=gX)Jy7rRQV?`)Fi7dqS zR-%?44%p6*72)DoaK!VmE>A7=mNFLBm0BYzNoA1JCaY%(9wAzx zx&*_E>M3gX4T3s;q$RDmShAyd#JyNk z9lr8qrq-Y&er*USj~_YD%@O|=2$%rO7+B{?Q=|UIMIlp?D&p8=l1>##`*u7NaOvpq;MtAyi>6Axs*ps(!O4_dfyjP7ZZXmL7whn`dKO`{D z&u}8Z+0EVZk%AH&;pZ?f>{kbtxF8E3uwNGX5!ZbJluaa_X)YZ@{kV zWU0MUF&mCV-W7v5_36l2Vb^|kST+6g>Siyllw>M&fi$MK@aMepOXHma(2>0&a1KWu z+WUk`LkTv}=9MC;?ERE77M(|&%j%07s+|YiwC`6H-5`zysCaA59Oo&ypqKao*Gg)g z1R(jgJSvIWBK#iKP}H7NUwa)6gfb~xxNBAqan_lDvp&8EDDP#(Awz#&BcQta?&n|s zSqk*RjxxXrT8^zf7{4-wDt5zArrHvE+f>_SCeX5hZHGf_iRAcaVS!+VG-aq&!D!DC zl9#c(gb|+$)H}NCQCS+C(S^GQ3qE|$6y(DmRcd3q8&-D>7U-OlAi9awv=?9v;@o+5 zUD3~l&>}co!FB(4O}7D9^8%AQT)nWORp*wA#HIQwqDC4+yu-S9@ErF>|D^Nc3mJPC zcUM48F>`y7{YDITj@7*H9jU@_VUQbzRn>y`fWs;TsH7ar8hy zt;AF}+0$t%V04&Y3oZNnyBu91ru>{r@v;}$@4Rb4t--)m958i-QTitHGm2?Y^j~V8(h%LK z^ob&A1;=3}wlmZy5NF|#V>3zue1x4vwH)j&>!r0F#_ac@Hv4E9`|{Egir(t+DYqY3hJw5O zt9%PEmhdo^#qL>qQRaJI}X)lM#2k;hkMIpf#$b}jV}a1nmHbIw$HM^^~wJ zdmhqfAKb-bYIN8Y~*aPha z^@CFMV#g8tyKRdzPkKo5WVNk#$L~HJMtI%Uo}lNjq1T2KOl7l&wZ~T?p89U0dr<_t zAZ1wwkUi)HN{~bS`@I+mNR`H>-V-xjj0^9K41-*+iHDewvFkl}JX?51Zt!D*3elL< z8GN5H4NU;pmM!t*vnHTr4}V>4Tpq`tc$C|5SV00IN8g@f@dlmQcp!1E_(iw;z7$p2 z!8kz)8|DtbiP6HO!aEt+JiUz!Ke}M3H{B2iZd+l8Wfy?UPQ_K~VI+7>$po-mVPq_n z0NnfL$3%Qtcnj2}5EosTm>pKTmUEKVp7Eat7P;^_kesAw?aq67OGR7G!~V+p5ML8( zi*mHn_kGt+GwgdhTI5KRWYp=?H~lVdGTHUOf*1?MEV}^osan1*QsVGv1MQNV@hY+h zAC6B?17w{%Ile@IPmz+sh5Rj_lsQ}}A|i8_J12{*!-&0w3I5>|xozCpfJpFb<=2z~ zg!)Zatej8LsktWtNO!`nUor;g%?<{lEBxpDEUEko5@Sp!^-MqTxQFL8F5&G2pzb(t zjQ%tEwFT^KetZ4RhePy8*;jV)qIUTW zFj^h4o@dyaysh3h>vRQ>-WKp%7YqZKfSIPAv(B^pgsadc6#W1uK)od!u3h<5>2?!% zu^rPNj_8wj?x%SrH|fU{QpW-H|5h^w{p11WL55N`mgDQjgSv4?TW~A1)A(Gl0V-KZ zGg+mZwi6GO%@N$1gqGnJv3Q@o{#VbMQ9(zCIlfKoVx0N&uA?s zQ6f_g8pImu-qJltdr;2)_DMvDLOhI9K2GWKT7ShooA;e|#-C>mW5o13e}6d-O{^dx zIJ|WX!^=p{H5Lx9`BlMUv}5K+a<}q6DjCU&dyk4PjNkWKVJEs~ce+NvoeUhjux$*O zu>1+|IW$wMThnpXqYuKE=~KF9Gv(+4Zl^W5wFfmBaVp1Vt8U=X>Aq`O$!y^Ixq9LD z;z&fC9f4)8xu|h~GgpoqF#u(>IPaard=x+|6NX^0c%R#b2QZYEPxfGBIbAd0Gu<^{ zy#d8HB%`>6$Cr^cU`r7@gRll|-pvFO^Zoo9_iGZtZ#aPUbIc-x);Ow0QlD7q)nW~Q z`5ey_5kD0D$JJK(DQhP$p=c-ztSx){%F6?AI~jrE&{vEgFyNNg8c7|2vt_Cvv{G5R z;q_xIK&y44jfU3wXl>q)OgE=dLH5Nc>0SB6Ut(H!=3G}?tmj*P&`}7zaJbFB(hP=t z0}?;ycsS|XOFG6q9Yo%_=a)Hv*^R*Tzi@?mFy8mU8S>JWYk)CN5}RW#aNt}ujlh)J zNmXC+kd=^fi?#6+!qKr`X=#d7GOxv~ZNfhcpa5MyRYMYg9e|>#4wf51eRkd<@FCSc zt-7Jsp>6Fgippr$2cqmG!^Pa;ZA(W~;Gx3WT0*DbyWZx-9Rt?(ebiz~r(kE#m=q8M zJYg7v7ZZeK6nXC#;(>HEzkZ_BPWEnGy91dCj)02U!}CC0krL}{i#R}ja-@TPo1;c0 m(FEmGkUwT^F)4XOoasezkp?tKRTFk_w18kmI}y6zOFeg-{S?R+ixu?HNaQlJZHoE6!Qv9CPyni{ zhrF?}jX2I^-%CD~_{MTdln;ysuG!I1$1mI*hedJVkS5(9k4~5XLnMpVs7McE21T$E zPkfM$FKVuwuyAIFdLw*^1g6PlJ;Gi@|IVX+L!6~s*>^WY^+f!dbA@YT`+8~R+h>1& zH{e#7zIl0pflh!qv!dgpfCw>fHE?cxj5z#JASSy^5Qd+!uvxVQ1j&QGVz@-!=BsGG z7z0LVB*5=KD%GSWlua3adV@#L&+M$#Lm}yxJ^Q<3K zXN;o&(Pw`cO8647BE7bJ4)D#}Gea9Gyj~TNIbYtRtUo8FWk7*WObE866%{nX^3n-4 zaQGQLSMIiqO@jnFi0I zo2{a00Gu-jo~2U~U%A!5Vk_@#u-kVTpJZ~?&IBE8<83HRqK|8EptRE8kfJ34aO${7 zt5~q?eQSH|5*aKCP4Da)MPL!`b;}=cLUe-Vp#bBY6=y{OMs}u~ELIa+@Bf$%!uX{RRthDJ!q2K9H(mv>1^JPg|jc&8k=Ea=hhB!}h zDG|jCVK95Y_d`DlaFf4OCZ2DkuXmX`PQgQhq`aHMr%gizDxP8#T|l<~VCk6~SAM?A zY4OTOV>E-GmIUK;GudckAoDF2a=jjsf;fEaonmm7R3=?>;lA~gzN&Dw$Z};5?6pD1 zXR%lkG;3=uz05!+jKw7h%@fOjhf@R_bJ>O7m1Z+DMM{y>)%d_w7GcNr|z6#e-w$Rk2nQ=k}?OzGXZH;ez+6&FxD|2?V$68*62Yt~e%E7~Ho z6|d|$P_eT!LX|}xNaHcTN`OgIZ~$6(xjfW-SE5B8QM88^SM02J_aFf2y}X!{ti_w@ zswtLF`xNhGYEKG5piO2Ikv-LV!@603mLt_2e^z39|epp8rA4l$^mBlrU)8r*gT))?7{^TFD^c+ z29kHHO$NMCnQ<4N!`DI2&bZ1`OWB|d#>)s3?N{c5*;YlN1d%)NfQ5j&ly$A#-jj$F8zFHMzSf;QL{e0l?pUe%3$-K({OJlbVXC3iN}kz15R6qS>0-=r3!)@S$n|D@thNnFcnVPig4uCG%?toi*2-5X>XNtfO527&I+7F0 z2yIo&3MvRCy30WdCU#q%j@o4paXhm{Na(!oS)2fL#sGPfW;V`*LD49S@48%w9 ztqq@`=_4df4%;~wd|St>xX&EaO>s?oSUkDY|JKJO2to*NN;z7 zUTAJG_-*umn2UtP0xt>y*Q^taD168wi1b=-<{|=xB&A1*x43q9kfE;g=D<3ML<@f0V2CyMWnHUt^${A_IQ#aTBita!i*!)_;u{>VI6Ou1)1Hp)%N7_T=P$vik z8|-c$d!@k!hC8b=wEYOh8T*eBL3)k~3X$N>)DcKEccqtZ0}ot)*B4HoeO42ky>cYR zc9w}%G{&m{L6Qfq*kRsjSDDDCE13G&fB)?ln;FK*gW@$9LnI|bAMFl*y#x!rVIA6F zb{?=Yk#RJv&zVW+iDCC;8ociGg*}D;q_q|Ui2-=RIb_59hUM?%mmAbbg|ln+D6H%# zE{r0n1|DV+j-!!oArxy3X7@2hw@=jV05oA>amE%QSZM}(ZeB`2q@{qz;8n3p=`QNDfTSE z^HfoOqPCMD4MY-t5^JrPg+o*A5KV&2T&_h%(frx!9~%B(c#MhL z*80N;VK-|@Y21k#6es087~&B%vOF&1NoG)ZNuBQqLOwBa7z`u&-o%3ww@>Z)!W)`b zr5atZ5A1(iYyb7GboVfvx2@|`sO>Z@Y?q5R^Vc~)I8~4m1jq0WPuSR#zQM`Fl)pa{6H!)6AM&G-yjLIO6ZE)<<#*&CI{~DoY zmW`%0H!j?OvYJJR{0>NlSfcvW>)eY(0_+3| zL|~7>0CIo&fALZ{&r7^#-4hTV2kU=_XD{Ar#hPzb1PAYVA6Q}Il?0TY5+~L3#ASEuFb*MVeNlk?~Z(&=++?{5mRGD~&o zLm#p4=Y+0y}k2jizf_T@J?9!%9LTXg&kmkaQh$RRv3M#LT z1g6VF5D-IyF!m9@zZ6CP(d`%)QPXayit@{%(N^D>;<4?lC7Uh)ZE*(f0w)S$^ zv|i^Z$Yk<@BEiH#9*^L$h_G%!U8h_}3dX6e#YEXqs*3eK`_#kSWmA#P3* zl1u@^;-=bAxw>IN5o|#&I{2@7P&hFnuPRB4yl89=mYdNl2+kn76dq=zEkr&xz+`@v${TpIlHu#dKC*pRzWfNJ*N69Bl&AjLp0U{kj{U zDZ^X@CoI>3kcFO<;6?glpSt_y&EqT&W8v1=WY^`>e(@+kDLs$no{S%uWI?HRfJGLr z&${XSG23b&*2Mu&cJ99|O{I0*2~mA6%_`xn?aRg<=50fbfGZMmYq;McmeX|c&s$ei z*8gQ{&=kVm$;#hU+EOV_X14QXc)7ST=Fn5T#py}ih~C`yHyB_z{eFG%`d`h0X}JW6 zUZ~8@*?9m3-*GQgDPIgPG9PB_fkCoL4Q0Jb*j4+0Qjt}ju=NVfy(c;{5@0?aXJOJ& z(kgkp!w?nW=-_`s4Exu1z4zCj^->}iDu$O3s9{rYR)DK2{`GCxqVX6&EJ9o?>P#s! zQqR^9KIp=Au^A`9(S-n(tSETjPyY${ zpRKg}kx9VmWUu9J}jB;EJPrs95d;aQ=U9XL- zKa_$k`_zP7?Q_`{W9$?N?5ftm-mNcx#+mrAV(rOH=`#@_A`}FfPwb4dZoPma2t(~U z*_yZqWsa@v`#7>fz{gzA+`Y@}ov%2Pmj!&!G`D9Fiho{yz<%c+Gls%uPXQEA?j-*P6dh1=&7BtM}%|cO*H{B3N6=!jGuOUVWR~+rk!lCDCayh&QBa*^@xa>-e;DME33ISgl1v)pCX-f zr7&B!%x%P3@?MK0XZkd*d8>?Jwsj2!t;x^G)Dc6>MCyWx1EnInjQIp~dYKh3 zrM-cc=SLHqk$o+#McQiz{kz%(Zb$!gCrh`|W7)xAgsJ{fN0%Rs((!G1Fk2`dCYKmp z8@+Cy#IVnIvLKg26D%X(`3|*d|AGjy>Tku`gnw4Hjqxr)NFd8`k?ml(&_Ixj4rkQr z77bBdhKQd3AN{Y``~(EWq+8-??Hd5edR&@72a$=XrwmmBwtu6H1Wu2B4l}xeT*6jM zl8(Asacd7DG*m@2Pec^un&LkI zwk!p^V;`G8KeUZ-HZTathC0oTm$y;S>jMu|-216b6C&Fr9=C7qSpaW%*>YaQSfGKj z_REV1jC@r16inqdUDT1o!2U34czKL;3d$W{&NfEsf`ki3K2SK(;CE*mr92tY02xKw z=wqt^{zZ*(+pc|<;G?69MuxU=WADrPIL<`*++&NVsN&=cWoc^RmYeffoYH%?SnB&{ zz%(RY2MHJ`i;?rPcCg@I@g95!00osbgwZi|@`CdD?!$5lYrCi{v9tJ`cCx1X0!`%Y_H{ z|1s!6aJBm9XJK(R64s5OVv?a{c(XBToDqd#i!)8N+Q~osV*C3VM;7n@-3A)H$ z_X0YXvh=s>!RRVPU|4Rr1~5(4GzG6gp~Wsm%OxMUV6?t7?_Wg>WiI23U*kmlnmo2C z(iedZ4e|`phZ&r@6Esy!C9(rK1T*NRG@_nD^%cgLze?v->151;Rh2pQuLX~9$M0#m zb+i5ROQGHK+51_`6|~t|!#~nNCWYtn+Ik`VZc?V;#lk3^le&kL z`t}(BXnEZDAXp2I(V&=N7=rk-u==B$y32ufdI8Yvi?2)_)WM`;K682z*Et;#;Ahrp zWHpJXO-0K_rRiIg2pl{UF5bXRld3G^%-KZjr{~{8&LznFPiWXD4%Smjq$2wLO-MZY zq%{#?%+ddI-y=W1vbHI(4STuKG=9Q7H}!r1y9+ntx;&VP{TcNR#Y9jZ6-b`3qKTqK zqCzFB?@9}#qSg?$aP{+SlEh!;tIuN)tEHBk7Qx1i2``+hBC$>mZdL}ZeGO0cSMv>Y z@!VW>WvIAhI=twNCrX{mkDo~m#%0@e#B99%Tb$*}!gg_ga;9mZrt6hy)<9M~yi0P=apT|R{#mmf$`~YCbwE&ywSL|=Q;DkY;06h; z=;X0+r#fj$>Z=Ym@FIEB3J%a6;x<; zsxH#_?6j$jCV-JO?8||e!z@}WHU`t(wcaICHA;;$hUzxauH&l_t?(`2;ZwDce$E4> znZ^xkM#N(g4rC7!E#Z%w3rO>lxmzc8sTD|Z?!+}D-Au*Xp+6w`9vS12yqX;;&$&$N4X4E;RPk(o@u^*dV&Vcq)5#wq$Qss_a zc@J=u?eAmiw8f4{p3e!`@ZiFDwDZ!skV|;BJLNP*PI=rivxly7z>yG8t^fRjXTm`j z;veDMqfmcN{+LD~9EPXh7-fuRNT3PO&DlJ8@VpB(QYZ3U8q|b{B8V3P4a-%5<3=t0 zS3PR8yci-!J|OK!v64VAs041)m1ffP(jHW^PeZ?$kH=@IZG$P@d1X#3%))=ZEBTg0 zi5A)DEx+Gg;4w*k_?XCYJd~t#l87{K<&pVG0OGi$!={1=ZAnh@=JMQ^bpH-rkPCs< zsF;WH(5AJQ8*712F)N12H0v9NabF)Ayz|4uk*^*!y?{3h{r@)Q1WP);GI~V8Ii8H^ ze;~0Rn#n);&WYYv6N|$t>G>!k{djVS?(O2Zq=9uQD8_eKQe5;RB^l2Nc;0rL z4hNzhBxY_83zM0w)RKzSki0=r#~-%TNd0-`8xQ$k4R9kTj-s6K35dUn6#Z2L7n& z5ZEYlj?7zZ5-#_QL7QVu;nm^SUz2h}cL9L(}Y*;S(oZIaAfn60RhK$a0-no3S z^o37)|kD8@V84340;|!!Gfl_21R1H0g!Iu;)Ai4=2Y?MdmD>Q4|sKcN&PLIX7hR z9eV6>F%b=SOHk$K;{%Gk!WGvfDqqlBm)!57Zx^pdg5GU$OjZ^)+)mPY*b zl9lJu8_qbTKVO*AT%$f{VT2$IdhI;V7XEawWa{UL8cbvX4fvLJmna7Zgy?}#>e>*2 zY{pTwRA4`3pl87`(+iC?lL(e95Lh3*m%|9bLKdaJ!q+CkfSRwRt=sWo`u;ZXJp3$2 zHY{Mw=jtyy{i8q55(FZzyz0~fg--HlACBOC@71#hCKZH{?`cZ9Lw1F@c0wGu!#=ka{Xg}t8Zj48CL!f1$R~f^2;eq?ZWJ(f*DkX>*gW0R z=B7uvhV%>?d6I|^B341WITNTdgYNpL(L$8xboKv#u2oxXwMwWk>n4_T-F3<1#SmrO zwV4tLSj*X>%J97^l|G;Znqlm=*<=LC=0D@)%g%-N`gs-2-{6#{A5o1B?8rB$mFN+^ zC6jUbY?(9w)9*&ORHWRQBDY%8wFybBuyLDN*tci1WoV&=LG$IjFn>7}&&>J3kWN^~ ze3BH>GP^3jWt5l5T|pddrZc85axF2fDMvCGbr1H=>Vm zPxrhEeA8EUCN5jKrwr}&$%o1KxpmUomOPJD8d+K;w0;EgB?|%pB1UC15*hqeXZ9SX z+AUTZ{SUvo+r(rhLjVk%xGV_~t|eMO_a-ohtEWzn(;AH7kVpzacG-~~3MNIkhA`7k zqO#8MP&6SdEQg;PZcY{Xy;0c<(}C2>r5N>gu@)MLow8BWBs`Vw;O+XB_E-7-rOhox z!|P9PvpLG|I9vEljk?Z|FrAIpg6m%HDj?;S>peFyr)^^J4p z$5R8M@HzEh2z9I{tP|H*?1BZf-l4`un}^fW_X*#B-#Qf|90gPOyVz7u{209@hAr0k|7{Z;lNLn-J$3#$db>3rb$tjpQR|yd-Y%0N zJCLoJQ>5sk!9f!ps@=aghb|)!nV_-k*?rQzjQZp5g(6PY0n7?xw~n3z5Lu*q1Atn- z-4_#hBx%u~G=1P|eXl`c+c9k!r9|b=3 z^vs~b$m&QxX8S_r7QOPu0r5aAq2he)X>mrf2)Hbw@A;_p=g;;ZfbE+=kzX(wF(@+| zPD<@{*fXf8=tpVfa4@r%c``magq?J^=&F}23iRY)yqacd;Y6Fp7BtwCm>SUMDyVeE zka3+M<%Mb&!%w&wP8Dw(#``OYGG43us>E!8$QKbWlgF{+PPGyZEA7?5-=7j)gH`x+ zE5MTZV=LfsJac;3C02pk(RJ*s@but9kh+9X@mxiXpYdm4RvVdkm9&8-tHGoK)koPx zb704{Xr{+ zDZZ1_Y4zCYv@pZj@IPVw=$&Nf@d#ADxj&8rU*^GIJx{YvS5&99vrE6{p0VbNO=V{{ zclCV-Q|lA5Teo}KxBcke&h;<+D}vUc#G>YY=FzV?0Fp`N3~io!zDt}|WK03m9KHw0(U;re_kY2hTO5^$efu<P8UPqViTuk zyrUG?tc#K^%7hJLGNY6= z{*;a9!o!^1}Gdh#CVe8j#ypb$e=`)PB9#2ybxl9!#i7m)2P{a+26*emEF>Y zIkbkRUNn|}+bgMWmR=H&4M=9Pk*CosYw9}h6P!}Zov=I!r9KE4?OG+$m$-9Ck(Pi! zOxO%Ed3`PTSc>25)<)`SQz2HkFR|{uuRPPIwbaAPoIC;S2JmnfB2W5_gh*e zjZ^MzH-#Ax|F0fv?&ekG*^o1KmU(%GTpM9#(J44%tsJ$`C$_k%#TmI%Ag!m2ER3*b z7x$&&Rx9k7`aC%jX>0aZra8d~Rd|2^aoWX&WXi;wq9Z0prGEcTv`cOpKxAUK0EmWF zfVQglqm|^MC;;ZW?EB7oa{3SvXR~=jf0xUu+alu>_Dr3n0A8`0l&@`AjX%wmr93!F z2L_$19N(<_5FOS9+y8vmR+t;*;>?v6h0U20PgXq~H4{JfF&}t{ib=PM$B>!RLqy$6 zR0DS1Jo13i9tQW30Ct(5^h+KR<$mZ%UbeNd;vsWW?_wX1mYRFqW)NYz8XGfGzg!c_ zXtHI2?#o_T&vhyYbu<2EQiz5fOuZf!X7%nfNo)ywD{ac3bz+e@%8-^&?t8wLzTrl| z&|9QktxM?(Bc%3G0u-t*e&eN2q9D#E8q4%bZA1utiVgX&TAgQgID~p<%>bv`J;p86 z3{}6)qYqvZ29x3Q9cbf=IO}ch_bL5iY?Npu63tKY=M*X4$M%Wi0~ z-#}1dT%LWPnmM#>Jw_vLM462P~xKR zNS&HxzKQeZf?kJ}vIzCQhGpHWJBVXD)sD`nS~UHRy&qk=aC)rA{5UjP7{mtlN!uxn zzy240|4rW^%v-}@gCTPGSd~EWJ3?*QDv4XjA)Tl&YeIY~FBF!xydWlA^v{m4W0}-r zoQ#_a7+k2W2ol0K>R1^J!L!fN9h8V*Dr(UVfT!(mmq^3 zA_9)pdb;qlZ&0o;R~UH!2sfinORU?XL0-^-+5=