From 5ff36b5c40d40b3804a8a003b9cd7ab1116d5ddd Mon Sep 17 00:00:00 2001
From: Joe DeCock <josephdecock@gmail.com>
Date: Sat, 7 Dec 2024 14:22:33 -0600
Subject: [PATCH] Fix static signing in hosts

---
 .../Configuration/IdentityServerExtensions.cs |  31 -----------
 hosts/main/IdentityServerExtensions.cs        |  51 ++++++++++--------
 .../TestKeys/identityserver.test.ecdsa.p12    | Bin 2800 -> 0 bytes
 .../main/TestKeys/identityserver.test.rsa.p12 | Bin 4079 -> 0 bytes
 4 files changed, 30 insertions(+), 52 deletions(-)
 delete mode 100644 hosts/main/TestKeys/identityserver.test.ecdsa.p12
 delete mode 100644 hosts/main/TestKeys/identityserver.test.rsa.p12

diff --git a/hosts/Configuration/IdentityServerExtensions.cs b/hosts/Configuration/IdentityServerExtensions.cs
index 1911f5720..54e279d40 100644
--- a/hosts/Configuration/IdentityServerExtensions.cs
+++ b/hosts/Configuration/IdentityServerExtensions.cs
@@ -35,7 +35,6 @@ internal static WebApplicationBuilder ConfigureIdentityServer(this WebApplicatio
             .AddInMemoryIdentityResources(Resources.IdentityResources)
             .AddInMemoryApiScopes(Resources.ApiScopes)
             .AddInMemoryApiResources(Resources.ApiResources)
-            //.AddStaticSigningCredential()
             .AddExtensionGrantValidator<Extensions.ExtensionGrantValidator>()
             .AddExtensionGrantValidator<Extensions.NoSubjectExtensionGrantValidator>()
             .AddJwtBearerClientAuthentication()
@@ -67,34 +66,4 @@ internal static WebApplicationBuilder ConfigureIdentityServer(this WebApplicatio
 
         return builder;
     }
-    
-    private static IIdentityServerBuilder AddStaticSigningCredential(this IIdentityServerBuilder builder)
-    {
-        // create random RS256 key
-        //builder.AddDeveloperSigningCredential();
-
-
-#pragma warning disable SYSLIB0057 // Type or member is obsolete
-        // TODO - Use X509CertificateLoader in a future release (when we drop NET8 support)
-
-        // use an RSA-based certificate with RS256
-        using var rsaCert = new X509Certificate2("./testkeys/identityserver.test.rsa.p12", "changeit");
-        builder.AddSigningCredential(rsaCert, "RS256");
-
-        // ...and PS256
-        builder.AddSigningCredential(rsaCert, "PS256");
-
-        // or manually extract ECDSA key from certificate (directly using the certificate is not support by Microsoft right now)
-        using var ecCert = new X509Certificate2("./testkeys/identityserver.test.ecdsa.p12", "changeit");
-#pragma warning restore SYSLIB0057 // Type or member is obsolete
-
-        var key = new ECDsaSecurityKey(ecCert.GetECDsaPrivateKey())
-        {
-            KeyId = CryptoRandom.CreateUniqueId(16, CryptoRandom.OutputFormat.Hex)
-        };
-
-        return builder.AddSigningCredential(
-            key,
-            IdentityServerConstants.ECDsaSigningAlgorithm.ES256);
-    }
 }
diff --git a/hosts/main/IdentityServerExtensions.cs b/hosts/main/IdentityServerExtensions.cs
index de1097ea1..0228a3dad 100644
--- a/hosts/main/IdentityServerExtensions.cs
+++ b/hosts/main/IdentityServerExtensions.cs
@@ -77,33 +77,42 @@ internal static WebApplicationBuilder ConfigureIdentityServer(this WebApplicatio
         return builder;
     }
 
+    // To use static signing credentials, create keys and add it to the certificate store.
+    // This shows how to create both rsa and ec keys, in case you had clients that were configured to use different algorithms
+    // You can create keys for dev use with the mkcert util:
+    //    mkcert -pkcs12 identityserver.test.rsa
+    //    mkcert -pkcs12 -ecdsa identityserver.test.ecdsa
+    // Then import the keys into the certificate manager. This code expect keys in the personal store of the current user.
     private static IIdentityServerBuilder AddStaticSigningCredential(this IIdentityServerBuilder builder)
     {
-        // create random RS256 key
-        //builder.AddDeveloperSigningCredential();
-
-
-#pragma warning disable SYSLIB0057 // Type or member is obsolete
-        // TODO - Use X509CertificateLoader in a future release (when we drop NET8 support)
-
-        // use an RSA-based certificate with RS256
-        using var rsaCert = new X509Certificate2("./testkeys/identityserver.test.rsa.p12", "changeit");
-        builder.AddSigningCredential(rsaCert, "RS256");
+        var store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
+        try
+        {
+            store.Open(OpenFlags.ReadOnly);
 
-        // ...and PS256
-        builder.AddSigningCredential(rsaCert, "PS256");
+            var subs = store.Certificates.Select(c => c.Subject);
+            var subNames = store.Certificates.Select(c => c.SubjectName);
 
-        // or manually extract ECDSA key from certificate (directly using the certificate is not support by Microsoft right now)
-        using var ecCert = new X509Certificate2("./testkeys/identityserver.test.ecdsa.p12", "changeit");
-#pragma warning restore SYSLIB0057 // Type or member is obsolete
+            var rsaCert = store.Certificates
+                .Find(X509FindType.FindBySubjectName, "identityserver.test.rsa", true)
+                .Single();
+            builder.AddSigningCredential(rsaCert, "RS256");
+            builder.AddSigningCredential(rsaCert, "PS256");
 
-        var key = new ECDsaSecurityKey(ecCert.GetECDsaPrivateKey())
+            var ecCert = store.Certificates
+                .Find(X509FindType.FindBySubjectName, "identityserver.test.ecdsa", true)
+                .Single();  
+            var key = new ECDsaSecurityKey(ecCert.GetECDsaPrivateKey())
+            {
+                KeyId = CryptoRandom.CreateUniqueId(16, CryptoRandom.OutputFormat.Hex)
+            };
+            builder.AddSigningCredential(key, IdentityServerConstants.ECDsaSigningAlgorithm.ES256);
+        }
+        finally
         {
-            KeyId = CryptoRandom.CreateUniqueId(16, CryptoRandom.OutputFormat.Hex)
-        };
+            store.Close();
+        }
 
-        return builder.AddSigningCredential(
-            key,
-            IdentityServerConstants.ECDsaSigningAlgorithm.ES256);
+        return builder;
     }
 }
\ No newline at end of file
diff --git a/hosts/main/TestKeys/identityserver.test.ecdsa.p12 b/hosts/main/TestKeys/identityserver.test.ecdsa.p12
deleted file mode 100644
index 5b21ec1bafb4d2936dda7778a692cbdd055d2e2d..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 2800
zcmV<M3J>)#f(q;c0Ru3C3b+OdDuzgg_YDCD0ic2ksRV)wr7(gDp)i68j|K@UhDe6@
z4FLxRpn?g2FoFqu0s#Opf(dm72`Yw2hW8Bt2LUh~1_~;MNQU<f0So~KFb)I=m5j6I
zILW*O0s;sCfPx7~(QOZ77$0V2n6F_3JvH3lgMw?B%mGXQBSAd3QC5y;2AMGDFkykF
zP^SAT-ao(=fJ)Znfaf3%a<i|9y7aa(t)@`e<IZhk+h5tDOOEZgfv1t1BFd^`3E{>u
zg&t*<UG0-rVA%mjjl(<YE;O)JLq}z`AZ)N4lSQ3lZzPG2!IuI8%Q6z^T*eYG4tv4z
z_f_dfjBm%DNZWH_vqfP{5lz$wR~}n!?=@&aG>oiblmJLm-f`b8IidmKxTn<RDaYuD
z@20boq4-;~reu`^YZN+RYDzAgw;^Tvyve%wbUSbqAf2XGMbl>8Ot}&XhRyhWSTU+!
zx{svSK%;T=aX?fK$Va%JtQtgkv2Sb}jAJ8^7GfC@hVY%)hV9)P$v>Kd7z&OK1>nFi
zJ8Ee{gtQN&cN9p@Oe1D9f@Yl6jkUfGPJRDJ)lvJNAEBg^_HX;e3$76s_V$A!n$~D_
zua=!!!Oa44-nM(usEiZU;nCJ&xs&C__ds4&u)y^tXf=>`nYDg1R-s&|_vu!Qu>~S`
z_)bMs*$si{#$8kUuabZ{P?>43#x{naU%+l&2wVCs0;_(5C{SbGtSSa&EMQsa0&2ul
z4@TnlZcYS)%$P{YyRQ)zx)n|+fVYT%DA7fBe9+D7w6%cC86sSD>f{nXzj^>x8q6LJ
zK|=9jRcLAF<9<RPRXZc~7+}fxGY%~^qha%f*>pd4osdNhGL><cf>##Yvhwirx%b)t
zLcsy8;p#{@)>xDqUjS4Hrm1ELZA#!K3Zcd*`v$TZt!&xV&f!+CZ17xBcgRZcH?;~u
z71aAJ<d#wk1KyDtLx<7Lqg;ijf$TM95i9KCXjfoyu8Am8O+QwkYZSYMgDZ$oR?!ag
z8}1$SZqpN;R_R-<CFi`r%-k*OV%Me)DXq&7R9qRxMvj*dH7O)M!@zQb(m*f}3^xMG
zT3-mDs!|<fFQ%dck}^-C2#<ksw`s7q0mN;szAUTg)K6Fdba~CAQ0cfmbs4oErd5ll
znQ;;hzFc&Ir)JSiY@Cus>E2zd$Q*pThVlnxP{5N^S_I_xbS~;!7b57F^*>bI(W;|x
zsbU1d4(NC}n-7G_I^BW=_k(~|@NCK(GpoXy*yW6ATZ0rPUqF2qDTK5MY>j%0EnX)P
z;A)s8+`eyKkvgSv6tN@MZ>k)Bb2s7fIGr}SU0*bG1Rp84udQ6ghVPk8?bhhKl!U_h
zLp6Nro}rjfIB#@qG>f`j36h#KSjMr^!pdp&V`uXEfWuwf-sms73jaV{wE_OSuMkAi
z2|=vVdmY2TfNSMFG1&!7J5F!5SsaA2Iw<>oEmu(L!vZ7Ew6vuRAZ3vOKr5+PY1cb;
zBm>>An#p{OfhIxyZ8*}dM!qrmhr8}ama+X)z)7S+gSPT-#rotBU0KSk7TzYfD;FyW
z+93ixe&gN_pm6`b>kx&yx+z~5^ymb)m{-l`<Y2dD$1VxLFaZsq$)G-fi!c#>By1t~
z9_~X4CZ8_=O@(YV<YbT0BAI!@1jWS)Gl8#OEHjsd4+CA=N8#roWQ?05FBXh02x(<b
zNPJ^;q6`mgG*q_S0F}h~pw`|BF%g^GXanpER$y~OQ#e$O!J${6&i2<D@Qwhel4W`#
z&lz*PMqvCX6vlkB_iOxsH#KBNp83<CWDm$oI##9_(m*<Iuup7xz0OA41DTPUgdhi#
zC_mO3gd{ZtF@`>OF_imga#HcdA_tV1kR1WPVU@ct{_`tVsMa`XA!1I`+O<;Vi`i6y
zt=D!ent;aJU|DWZ(!ONwafV*VFj=JbKW?2K&DnfaL?Rx=8svpdD3~4b{(01HsAAc7
zsx~`w#zJ!2C?6Hn3{M>#uGAcV8^~qAXT}1>^lv+&5nbB!m!rUNDwK?H-3jbawpFQ@
zNEfpc#AJJ1pjG!Z6B<V7UR@P<y#0HYF6u@1Df1Bn4Z6lJh=DPHHzmf3z#D0%<UsG|
z{umh4*I`uY=!e(4c<|8L=(og8Iax2$1#`Eh>7SBw17N|MdYN=(p@$l=ju@gVm|>;_
zH9<Q5e*1IrY7&5n(ExqC7oLKCLtdzb@cIvH_ouECXrqpo;C%j~5ch0#tW;4`Jll3%
zebLpPob_%RPzz_FBp+&j*d>N?nR}o^%x*`rDt8{7C4)RZ>XutnLT|eFbcAg}Xp8)j
zCQ&_Isd=sG^fM31aUaMaewhk8UjiJCnjd5T@9ftXOX8@m3l@`oI-I3Xc_%iatr(BX
zq??CLaAat5dm>C;b&bT7oV0`Dh6OvHtP$hhmTZN-W+(ncP*`b=^1RkgCCR@@@?A}n
z?Fw-?K|QHMt`M)m+XoxXFX~*v<foveSDfV15@`SYt^eq?XNARVLRphX4+c!-r0ysm
zXffJ({}0#O;tlS<Se0YyK&lG_5F&ld+NqnAk@E-n#R+0avIC|nVr|gq^VK&rE~S$O
z&|WAdxUe*wRR0y?Y;g*)&86r=Q<_yI0H0OKP*3<rqju4BqB@sq><3!-movih1?G$|
z!exl_y6esayKp9(%VO!OWKO+RW+Q04rBW@LoJx0G&}JCH9bDT_uAyZ=sx{~^@BQC4
zc#o%$fP#Vy51?_r-S}<;Q`rohGugts?Hg(~NZ>dm$2C1{H=~qr&Q6e!)4)vW`%CF5
zFW)bVs=9-JG0$x0k6Zz6r~1=^8)q{vL+`WqvBB#UYw-OSAJ%-lRpmz|>_*_zxS${5
zz<GhSrL0~7E6-qNSVkRJy@GS$VUy$g+oT5at*#NzQB3#=drMVl2O=n4Dcg`pU1dOq
zBt68s1A*;Hc(CLfvWpv9qjd*yE^63t9KWKzTW!lCak9od7tJa*<d@r#G(5M!;emQR
zMwSNQ4qsAce<79@Rwb{ggoU#Gt8JL{N>8OdW%Yt|i=`Vu*X&c$4v3`Z!!EN~5DY4A
z#bCHb+<VVmx}}yHo~nLc(V)9W&c3$K8?Zf3LcfNudt+_)_~1XmKTQxKtFW<W=ZSKE
z`_dso_cnCv3SHxak<zi!pd)q7#4f>tNN(ac1)`<m-iZ#Vq=F@Q8L8}YKiy>+VRx*<
zm2i=dA3AiDMVH`upgN~0zjjjt(WmS&M-~mMTn%UAR!6?9H>AU&)e^m?sni#HFoFRJ
z1_>&LNQU<f0S5t~f&2u4`7nX@FoE+13o3?4hW8Bt3<?1Ppn<$Ffw?do1_~;MNQU<f
z0So~HFb)I=h;|Di-C>dt0s;sC1c8`?*+p4`19XoXR8YA*h$ztYgk{jUz`}67-o_dh
z?(;nY8funYHyLez`In06=(6>_6;s=amR|^d3Tv1Teq1^TUS`SdmN@h_39%gNCb=lq
zWI{}GSE>`a7rGbBi~!72und-)J&nSFocq;p!?ilC9~#V(%@(o8aOY*rILVzWO87O?
z5d$v)Mq_{i&We}-|5&DHb^AauB`_lf2`Yw2hW8Bt2^BFG1Qh-Aj{vBSz>?1cp=}|P
z0GS_v3jr`IFdr}n1_dh)0|FWZ6bRdW3Y$Ig^%LTtE~XY{xf$sG!2}3qtnM_TZQ%7&
CuqdPe

diff --git a/hosts/main/TestKeys/identityserver.test.rsa.p12 b/hosts/main/TestKeys/identityserver.test.rsa.p12
deleted file mode 100644
index 07a23dee1dc108cc4dbf2c1dd5fa04849baedb00..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 4079
zcmV<L4-oJ$f)DEg0Ru3C54Q#hDuzgg_YDCD0ic2ps04x!q%eXHpfG|8R|W|xhDe6@
z4FLxRpn?iWFoFt10s#Opf(ktb2`Yw2hW8Bt2LUh~1_~;MNQU<f0So~KFb)I=6$WG7
z2yN6}0s;sCfPxATam$ls<qFD`X^3*5>rW6|_X=A5EAGO(b&8UWy2$5{ivA<$2$3VO
z=zLzcbN_li7Dl{?!UJX9vB-F#&V5ueFF}Bso;^8?5|?l)Cl{Y1RIIp{;+`DDJ&J@6
z&okckcUyiqIGr8-P7Bbs;)_~pI}foWHm#r7MMjI8ihPKrBBiC;IX3uXcQep9F51OK
zCSshjT{ci?<jcyWrx<^@xRvc7<v0Klxv@#K>N_;IW<GMxG>OKdqzb?5`M$9zsWL&v
z&g%wN^XScl7J{@aAI2wiBDPoF7!+|beqqT6So*W9I+3^rb52XcG`090u(nFhG&6k^
zs2e{qS}Oht8THi{vR>!Lo)j2&m3Abew|Ek#SQ3z9qu>&MI3`rr+S`)kxwV_wA}zlo
z=V+VCl?H;)Wrk;+36XBJi+lUUV<FW>ci)r}XK6wW#G(=|99J$6AoQU}dJ*$uVh?{=
zzZ7Sn_8ZJMmM{Awrc|2mrD5HMPtUNTtIbDE|CpqQEP{p=9KZZet(2h!0Oi4bItux7
zZ2f8kDDxpFQjGSA+6~2a<<oYb|4}rQWd`B?u<m?i_<rvv5Ey?P5jea1AnS!mNt2qz
zzr1BD|9t-Jx^I<=O*Ds0k?sG3(^!!ZCMQwhemp}%w*WB>`y)f8vx2^pMBdsta?a^b
zICZ(P%_7QCD=)4Q8$54)@WxZ(Y@~_SSnswMYSJaD{_&J6^qmk9MDMEl`4D|a9n8i_
zB?1FgoJl6%!Tr%uO3aPLK4_weJ^M_jfD)7L7@ygy*gr>G`=`KvNhOb~qkC29v*`Uf
zZXKD<#e$MpX?ZXzclIlpwX5jUs`+Y^T@acheS>#N1W+IGMwq)?Gya}8@TDcg#8CBe
z6-(OHyzkRv{MAr<xq*9vYb6(Fu;UUcfh71Xt+QrT?|1B_h9+!uD!+||ww-mWBF!}d
z;GrzoI2Pvcl$Q~cJ<LKG&^h~@r9>ZCvXL>zO`H#Mk~RaC_H7Qg{i?_EJmO-|+vG78
zN2B-F17Cg6IBG(^Mkb16@TucAFI=J5cc3g{T%?hWo63j=?{f^zJ^?jgZ2@Bu^2>$H
z)1VY9JKO2&u~bG7@#P77Pcl>qwN#at<g4%pWl$|*9_-_MOactAq=zymljGPBQv^0i
zF4L><@w|KbEt%Si1)g)O_Kr{O&i|!DGHsw8(++mwsQw3?^fva_UNc6<h4R6c#vOH3
zE16*@C6(7eh!K5C!~82-J*C$YtA;!cW4yL?18y{*7(|fgYVxel!XGb_Gif2%{@s$j
zK+(x@Hh=dzkH{&~%}iRvf2(*Tr!n#n^Q4IaW8etu#pcIz&Yi@x$@o`qxANv(*t`l8
zW3ql)pfm(i#WA*&j{X$}=UZS%PZq2D8zP(~IHdQe%&4o?(tOi(IT;|Rz3>Fm?51%e
z?JYD<v>&Wjk_gWkT^N8-U=_`)$4fg<+~Q&|na#GQI^>*qf@ykct#Ur>1NNlc7}9#F
z?p^eLwksGd1`=rYUY>hHe+T8Y>BYnT@)FKlS!wh-VoA4H6X*GgJ07Z~VSaoyuMbdM
zCEw%%pCoaQ0yBsg{F-WK{l=}W=f9hSy+bz<r=0Q;r^bOJLm<X~Q_vhi_Y-<gdBN8t
z*!se51sxxEPAj;F`U+FK74c8?PKmOpn{gRfuRJE5J%ndcdblEo?k{n8+h*MVn~%Gv
z6p_c;DLW$ubu-_SnCJC>T~ZK?)eTit%8E)+Uu7)~oDYNQGyWx`A>KdHPjXiJ>43T#
z(%D+_Ub^agnGxlE%}()oOQO*&>EVG|9*X|gr<^wN+Ed(NSb_qR*)6)(vO6_ZYoMWE
z0`u|)NoKq3*(BZEaRN?mKkhCJvhoMFVDpvK3tWe^Vd9tFwu@<5rhsga*a02zA>9gE
zkoI1%8lDj$II<ca?4K&G_X9ICQ*hL0<%=y*X!d;&iGT{yttMYFVX83zHe@H?HF*P5
z{masbSlPNL)d$SU9h<N>A^@xQ`K)<WTC_F$ms?K)U>NTz6>@{?sV2+4-&1F3dh0A^
zJ?yaVok?~m$7|K7TK`8oi<*AA(08C4s4Bw?&VU1!*2kaS--stgq7uuEy~a{a%a}~m
z!$y8oLIjx1$*@5yT5OW>4sR=O?^hd)OhTpq?ET<!d%Fr5!{f;G%w8X1JS2!NY0?RY
zbXh`#*5Bx*G$Vxv`Mv@lHuqj@=@uLe>mz8x6ju=Jn~@xXz{tP^a6At(P~&1)ULB%;
zUSLavQ-G4tk2w)cVW|(w_ob^L*PO91o4(xlmrM&{e8@z}s#_+cPax=nfdu1$Tk!n^
zS0=(To04nV*TXP};$$Ox8NMkjm1vw<HVOf}cd{`M<%+mrCXJgVaJhhy%79T^c&)vj
zW6$)nE<7{Y>Gb7e51&u;2C<xIvhGCoy5Y;catjh|_Bu4Ev^=|UT1)^BfpRXWXiA-7
zkyVCo{-EHNoc4@idQ+&$3pCACh*Cg0gdEE5wlTS8?0hD;T=ng8;AjYP38?q(rjHHV
zhzb-^C0V`7Sead{t`6_~9)ODP@#!+oG#3Tp256mG#zGdR<3cVVZHf)}HS}?K{FZjD
zNMwVKx#Ox4FU_Q?G29C}Y+;9<r1bweN#d^Te>`|G=x#KPUuJz~egVf<6=dio7bk4d
z(+OFUh#kT<P}Kve+r-ToC$P6m97lsmy_>uh!91d8{$U1UNXm)ImHpugw>LvxMER;V
z^>MI%uZ2UM6M4`w@jTT&$)4x1FwjiD0~LjWbp2sc3wTqz!c=ZdQ|V_LThS=OVa5z{
z6HKk=EJyK6l6`|b6$F&^N}wCL0Oy&0yQNrPY}|weC`!(h#-E;x!73K&ckVO6yKVsh
z&1K>yki7n=)!+vl3~lHZC){qy`44D4<`{(A;^qyLU%;e@pqI~mno&Ye7mD&D0YsV7
zaqrru!Ue3*|4UGV_>6`ct+NRQYk^?vaiOsESMBa?1_o=j3e-g95i}bS4I!F&Uv_~1
zeahC<H*pJCaSrrQNm<@*G^PzSgMUXy0$Z~}5STqavbH!-tHD(ldu^_uJo5To81^9;
z?b?PoiR`j*;)-V`$7A77WedPjDERl(8QTzZvX0z&$?uP$A%XOM_@zsB<sq~yt)DYZ
zCo`tP&Xt+G2rCeBWmG)?lQq3+zVNnSLN3?C9w4t^kML+k6Dv`TOE`nCsUgYckd&tP
zI)C!z>{W<0K&&wX4o4R)hv}#xf=c0Xp#3;oZJk+cnFi|y`!Cnfk*oXi0Mod-QLa*x
zFrGKUI}P8}MSIRCog6;w9(@+C?wjdXlSt<Q>_e+VAmuUN7|Z|cV$3vm5Wy2#u(@ze
zvAi*qB^c5L;EGJyibjhvpcMH+S^uqVi-{O!Wk0OTIY&j^PT!n{FoFd^1_>&LNQU<f
z0S5t~f(0@Jf(0%xf(0rtf(0f93o3?4hW8Bt3<?1Ppn?SMFoFc?FdPO7Duzgg_YDCI
z0Ru1&1PIJ~0aCX6F-Zaf2ml0v1jrucR^Z{`w^IRnr@FDToiSaPkXh8Ku|#r;KAs$@
zj-x77X^KL(OR>@QNj8^oVGjKCp@a4KFO#KVwX+T5uQR{DcJIUYqvMfA>w@l#P17y3
z?PxMFF|fRR^KGGWLOcOHpS-$07)Pi7#0@YDM=dyDOYu*=#eLoGI*1&cgA0h%(SmL5
zx&%!%!tf@T%bNKsV;T={yG&Owgq(W#=>(iWFfr>W(`%zDI<I0_&_rgu7y8)cdx+Mm
z`SQJmX%q~{?9TI;T3PgvG%UGH%a}FCi3b}&^RSn&IC!T(0S*zH;~0>e&t{E~MkQ(a
zZ)GQmI9|7e^&l!u&4$!bON)e(qyEFud~*pigeWbzxD`F0wE*ay9*xWakjaX8@O=WC
z-w7KB$G3it9jDWPCU(2!RC7_6ljbE6Pv|E8oAL>N=T4|K+ieN0^tYfuZ3aZI|0SN=
z_?Dq=B_<kEYWlepp}}mjXQ3Su=klna7pp_Z0q<qRCGf%!kw#a`fG+3#<BZ5K!SYkk
zbihBc!!`jjQu9pRoCe4>xpLL{Aqs5lO!{Vh%ZqZ+rApBq{^4eLxHlP#P*<S&N-(?I
zc~_0C(x69#**V7x`@%(~1UXc0`z0P7XaX@kZBF0N#4bT-R8G;OXhO>7sg&gu{D{!G
zyaI7rQgF%{`z(D$Ps?isVAQcvopbVrTg2ELdy<a}k-@zPb#|Q@s`KK(J2Qe0IuAX_
zgMjdiv1-=MC2kx8jE#7!bK>b92SiIAgtJH7=SXNc1r-EQ@K_Tn1DzWNJV@)4=Y8C9
zlzvR1Vd^kH$0ZYbz*7L$(c?aoA8f1IFNmkl#4AZufv*+}V-l{tiiZR06CCklr;KJH
z%kNDygSPK?ez)S(V;%#BFF~=CEQ~8eE04x?3CEtz%iR>Vtp6k80X>XceNM0quqbyN
zm@fPzKh+6u%SmLnxUc10nT>?3DP(qu%jntQlrt%NfDX`xhTtF`2d-^qw^%FdpOAT9
z{>MG%@MIS-Fgw8)5nOfN^YZw6`u6kzH5%;rIQNt+Mb)gvO#F44g4JEtGZ^W9S{s<>
zEoW6AD7I2b6OvGP9z6{M`QK)IR`@m<hL;Mw6>H5a{ES_O+S}x%f-3?Lxv@&V6`Xf4
zmFyiebL_g9S(hQzPiPGp*UHv!B3#fPSVbP7@$RD)sEUPe<#fDeqQX0#Z-KvYA$u5X
zc6~e`pZF#3+23nA?UTNA1P08I5Ix3k?P4NxCJh?DZB-vY5#la*wmHVT_%1HJJaUJ6
zSS!yvhiTK07=t8D2%+i~@ZJkq-&ags3V33SHC@!C<m}$al{@XHB(-PL28CxkfGskB
zbxetjU4@G^WeA95SkrWlQax)wyZEur&SVFr;V(aZNI2i2I+n4cZLL!K?Fr)dHJWt&
z#l`mq4zCOiQ;$yt@#7Q@82rVQl+_3cAQPsN3Q{7AsZx45g^3Af{-5w}CR(YeuA{n@
z0s1g82!{@VNNqG%MI1t3lEWO|F0m&MGndInWr-%+9MM{XUPehldQ0p57&vAW0ENcb
zKH&=t=ESXg=AO2+r#y5xW>{MCX|VU+?f)i3B@V{*_$+P|lv{0X+9E<8%5@x6$vrV8
zFe3&DDuzgg_YDCF6)_eB6univ-`Ctjrn=2SZf?QhitIe&bucS1A20_71uG5%0vZGq
hg#$sDQ%yq|2Jm8%c+lsp3%uNY1PGzLN^>8>AF)iOsZ9U?