keylime-tpm_cert_store-6.3.2-150400.4.14.1 >
A cZpgp9|PccP3x琔˘Z BX|x`@zu \/\<ה8
sB'AAk FE Iπ m]t%P)ƭ&
j $21dȦHlAl[2 4"6^ "2a'.-x `i͎v":OVw3ۙ(j1ob;h #҅tSVR)?Ql9_]pT\j
C8H
8d23727105174e125e9b4cdc9fc411374fc10e54 46c18020dd263051adf0e56680d326741793bd44d88faee42b3e5b6e961073b6 cZpgp9| 3+ ?A7)Mn[^h/h'3YO[i\)֚o9=&l3 ϛ '"=r?#9Aɸu,>x6T] YCыӞdlZ_9d Dx!51w2dl .bVt-M{u%2L?.T[w`1~yh
2<µZGHO_@ VF4N=ejs!9*3A H > p E ? d - G " ( / L 4 4 4
4 4 0 4
d 4 4 4 > 4 @ d 4 4 h ' T X e ( f 8 p 9 : = k > s F { G 4 H ` 4 I 0 4 X d Y p \ 4 ] X 4 ^ : b c P d e f l u 4 v w 4 x 4 y x z C keylime-tpm_cert_store 6.3.2 150400.4.14.1 Certify store for the TPM Subpackage of keylime for storing the TPM certificates. cZpsheep64 @SUSE Linux Enterprise 15 SUSE LLC Apache-2.0 AND MIT https://www.suse.com/ Unspecified https://github.com/keylime/keylime linux noarch /usr/sbin/sysusers2shadow keylime-user.conf <<"EOF" || [ -f /.buildenv ]
u keylime - "Keylime agent" /var/lib/keylime
EOF
[ -z "${TRANSACTIONAL_UPDATE}" -a -x /usr/bin/systemd-tmpfiles ] &&
/usr/bin/systemd-tmpfiles --create keylime.conf || :
# Help the upgrade process when moving to a non-root services
#
# The '-h' parameter alone will not change the ownership of the linked
# file, only of the link itself. This is secure because the user
# still cannot read or write the file if the linked file does is from
# a different user with restricted permissions.
#
# The '-h' parameter with '-R' will also do the right thing. In this
# case, if the directory is a symlink it will change only the
# ownership of the link and will stop changes, i.e. it will not change
# ownership of the linked directory files.
chown -h -R keylime:tss /var/lib/keylime/ca 2> /dev/null || :
chown -h -R keylime:tss /var/lib/keylime/secure 2> /dev/null || :
chown -h -R keylime:tss /var/lib/keylime/cv_ca 2> /dev/null || :
chown -h -R keylime:tss /var/log/keylime 2> /dev/null || :
chown -h -R keylime:tss /run/keylime 2> /dev/null || :
chown -h keylime:tss /var/lib/keylime/*.sqlite 2> /dev/null || :
chown -h keylime:tss /var/lib/keylime/*.yml 2> /dev/null || :
chown -h keylime:tss /etc/keylime.conf 2> /dev/null || : I n ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ n N z b b b b b c c AAA큤 cZpb bb]cZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZpcZp f3e3d340592dcded58eb49eacd821fb9c2eeabf330fc863542587501c7c3453e 2216947540f0f43ffb0ea2dfec0d35476ee4f339d5d3821feda76fa17fb588c3 4102884842601f314dad09122e48be0e4195abb884bad94630fa5a27dce63e74 b5f76cb9736d1151ab0ac4afd3e516a784ec4b3c3489d54d4eecc263149db24a e2ffa9198a5bbca435dffb1f70db7ccee0bc64c0a8e65feefe4f677cf18f2899 fe3e43ad068add661002f5347c6e4693e6ab6a9022161712cc9ec3e5014ef3a0 7a7439ff573df5bd5497baafb1e6409b367a480aebd2cb8743ee02fe0e0c9e2e ca90d2b52aa97a6cb1dc307e95fe05cb756b09bb4fd96c4b920cb142023a7aa5 c39b89e52ba681db55dc180002ca8b49d88ec89017a685114f14ebb1fa6df530 df2244f9b3c201760d96af60d717402efbc2a33e32fd286f07bec71ace786203 2da47a1670ce8f7c2157ab96d94a51f3874612f04c2670fad76531ada045e914 b5f76cb9736d1151ab0ac4afd3e516a784ec4b3c3489d54d4eecc263149db24a fe3e43ad068add661002f5347c6e4693e6ab6a9022161712cc9ec3e5014ef3a0 9ad0f9190a35c0fb1b8e5626d310897227c2c2d6bca1d204ee4074218e13bce7 7a7439ff573df5bd5497baafb1e6409b367a480aebd2cb8743ee02fe0e0c9e2e ca90d2b52aa97a6cb1dc307e95fe05cb756b09bb4fd96c4b920cb142023a7aa5 c39b89e52ba681db55dc180002ca8b49d88ec89017a685114f14ebb1fa6df530 df2244f9b3c201760d96af60d717402efbc2a33e32fd286f07bec71ace786203 00eb8bd4b8305df7d91e87acc46dff5f3a2de75fc4a962b16a99de41cb721fbd 6c8457a79da5b12a2dc46967e9c964bb9ad0ee27d2cb837efe41396f350a85a0 2ebfaa96fc6ef369b9e4d82fd44fc32bab279d62f3ef0f39b91a90d304106aba 29e56c5530e74f7937fe396ae6dadb73da929fd4cfcca29ea88b102c7070a05c df2c5e5afd753725d08e0d4de854e2c7e99577854a7e7e9d27f76bbfec4e5df8 4bb440894a4c35e4a1878a9d6cc519b2ee5743342657d43747f06e620c926a99 343b27910c0d69aa54a94e2d1819d0a43f290b42e6334148154e0f5097a0b8af 2c5d7bd9f4ac46fab56542eeaa0f92180bb05bd91a9120f36a5c9a999358304f 09bbae7bf3158b4dfbd68fb27aef6b4c17b5169167e9045260ad8fe9b217cd0f acb50f23fe4a71f7d1d4368d4e4c97f935abb545835bba21cb56e22af11a6c50 261af2389b65f0f971df30e0759389e81bcb720e65ad58645d716d46dd3cb2ca aa2fa5681e0b91fe65e3d83ea46c681c9f7c44395122a279afb2f18c0a57765a 2026305005b147d0c77f23935faede0600973ce4bf2be2c15a66cae15394f281 23b9d4a11383c782c4e013f1be9e5e836b892a3d32db56ed54569c1be43c33cd 20eae9bcef20c54e3d3555cc458e516c615b7184c1d50f1009f1dcfa4463aa16 3741c7b7144c212e597ae6d7844d34f0e905e80e9f0594bab6f721f9733bd1ef d302db65467a8bc5c3d50d5ae1d271df0d4ae5c69c44c4a52a362a58325b1ab3 9ffe9b84cd05a83ac73f5d93a6c544e09b305ccfcd12d5a3fd2273e877a17946 c1b42c0a03d93b29d45ca7ebc49afdc3b7e15176f7b819e254e404685a9dd194 f292d76038ec1ecf00d9fc097c717dc1bc5212d55a34d08b34081c3b238ec57e e295a1004f76d5f90c7594fd2af92b4226a5d905d3ba3fef82ebd41c320658f7 07d9033e8a2bbd18e311bc1c63e39a1f483020c94ed088000c960571cf51a94e d009af3a0c8d6557812fc39166f4c4263177a3479e2e69daadbeee888a6c82a8 ec31c5d0a5baf0b25cd12435a4022d817c85385bbfe34419255e84514958f187 ceed5c890c4f80311ff1b21c374e5617b3767ab5bb2f56ff6145398eaa7fa5bc 307c034fa070c2fd70fa2d85d3fad445ed2b364923bea4f7ffb13f3596e51847 469b5c6673f5f004221b019b784291cf5dc6cd7fe15877980350aca0237c6a24 e33162b84c4996da7dc95c7da34eac76eee195c59d4a682a6388a976259644eb 8060713ee5c0b1c91ceb6b52acded1086c8a3022da86f623f458512cdf7dda2c 8718c1ca766626af61ac1cddf1a713000f0277b1cf4eed71d32813b7f44ad703 8144022600b9c04cd6e0338fcb4b77708c10e72a820b7a7c9e24aa6dcf41c59b @ keylime root root keylime root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root tss root root tss root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root keylime-6.3.2-150400.4.14.1.src.rpm group(keylime) keylime-tpm_cert_store user(keylime)
/bin/sh /bin/sh python3-keylime rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PartialHardlinkSets) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) 6.3.2 3.0.4-1 4.6.0-1 4.0.4-1 4.0-1 5.2-1 rust-keylime 4.14.3 cY!@b@b@bUbbV@bs@bs@b a@a@aaq@aq@a aa@a@acaC1`` @`i@````aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com aplanas@suse.com - Backport CVE-2022-3500.patch (CVE-2022-3500) (bsc#1204782)
+ Moderate vulnerability where a node can seems as attested when in
reality it is not properly attested - Drop cfssl default in keylime.conf patch (bsc#1201866) - Use chown -h to adjust persmissions for downgrade migration. This
skip following symlinks and make the migration possible
(bsc#1201466)
- Add logrotate configuration for the services
- Create run directory as non-root user
- Conflict with rust-keylime
- Consolidate in _distconfdir when possible
- Add fix_exit.diff patch, to exit properly in SLE - Remove user downgrade mechanism from the package (CVE-2022-31250, bsc#1200885) - Fix "run_as" configuration parameter and set it to keylime:tss
- Improve downgrade user migration during package update
- Add patches (CVE-2022-1053, boo#1199253):
+ CVE-2022-1053-01.patch
+ CVE-2022-1053-02.patch
+ CVE-2022-1053-03.patch
+ CVE-2022-1053-04.patch - Update to version v6.3.2:
* general: bump Keylime version to 6.3.2
* tpm_main: flush transient objects
* pypi: add notice that the Python API is unstable
* installer: use OpenSSL by default
* Avoid mounting secdir while unmounting it
* remove TPM, VTPM and IMA stubbing support
* archive: remove all archive files
* Change GH reviewers to be from developer group
* added suse / opensuse support with zypper
* Fix tpm import in test_tpm.py
* Fix cfssl configuration in run_tests.sh
* tpm_emulator: improve TPM emulator installation
* config: Add option to enable DB debugging via DEBUG_DB env var
* Enable SQL query cache for JSONPickleType
* tpm_emulator: move everything into systemd services
* Implement broader key support for Keylime's signing mechanisms
* tenant: Use exponential backoff on key verification retries
* tenant: Move JSON parsing to capture possible exceptions
* tenant: Move verifier stop from do_quote to do_verify
* pylint: Fix issues related to W0602 global-variable-not-assigned
* tenant: Handle 404 error from registrar gracefully
* pylint: Fix remaining code with issue R1732 consider-using-with
* pylint: Fix R1732 consider-using-with
* pylint: Fix issue detected by pylint-2.13.0
* pylint: Fix issue detected by pylint-2.13.0
* tenant: verify agent quote before adding to verifier
* README: remove tpm2-abrmd and OSX sections
* pylint: Fix issues related to W0102 dangerous-default-value
* pylint: Fix R0201 no-self-use
* pylint: remove W1203 logging-format-interpolation from ignore list
* pylint: remove R1729 use-a-generator from ignore list
* pylint: remove E1120 no-value-for-parameter from ignore list
* pylint: remove W1201 logging-not-lazy from ignore list
* pylint: fix C0209 consider-using-f-string
* pylint: fix C0201 consider-iterating-dictionary
* pylint: fix W1509 subprocess-popen-preexec-fn
* keylime_tenant non-zero exit code on error
* Fix prepare step adjustments in packit-ci.fmf plan
* failure: fix Pattern type hint
* mypy: add initial Mypy configuration
* ima_ast: add type hints
* failure: add type hints
* logging, config: add type hints for logging module
* algorithms: add type hints
* json: add type hints and add JSONType as custom type
* Full allowlist processing when not adding host
* provider, vTPM: remove vTPM manager and provider code
* tpm: fix that the set of missing PCRs is not serializable in failure
* Restores the option to use keylime agents without mTLS
* services: make the services run as keylime user instead of root
* State in --help that SHA-256 is used for --allowlist-checksum
* config: change cacert.pem to cacert.crt
* registrar_client: validate connections against registrar ca certificate
* tenant: validate connections against verifier ca certificate
* request_client: only add custom adapter if TLS is enabled
* setup: add static assets for webapp
* Add TESTING.md describing testing details
* Fix some remaining log format strings
* Fix for database_url parameter with sqlite
* Enable test basic-attestation-with-unpriviledged-agent in Packit CI
* Use lazy string formatting when logging (#535)
* Make Packit CI plan more resource-saving
* keylime.conf: Document setting ownership in WORK_DIR (/var/lib/keylime)
* agent: Make sure tmpfs is empty even if not mounted or cannot unmount
* agent: Drop privileges by switching to normal user and group
* agent: Move mounting of tmpfs towards beginning of main()
* agent: Read measured boot log near process start
* agent: Open file for IMA log file near process start
* ima: Refactor read_measurement_list() to take file as argument
* Add the policy name to failure event
* tpm_main: Check if tpm_cert_store exists (#553)
* Remove tag input from container build workflow
* Push container images to quay.io/keylime org
* Enable code coverage measurement for e2e tests in Packit CI
* config: fix config search order
* Add defaults for ephemeral keys for agent records
* Update outdated greetings Github messages
* services: add keylime_agent_secure.mount service
* installer.sh: updated tpm2-{tools, tss}, use system packages if possible
* revocation_notifier: convert the data to str in the notifiers
* revocation_notifier: mark webhook threads as daemon and add timeout
* Fix Packit CI test plan Summary
* Enable Packit CI testing on CentOS Stream 8
* Enable Packit CI testing on Fedora Rawhide
* Remove last trace of TPM 1.2 (hopefully)
* verifier: remove start_tornado() function
* verifier: wait for connections to be closed before stopping ioloop
* revocation_notifier: kill ZeroMQ broker if it blocks more than 5s
* Add more e2e tests to Packit CI
* Enable EPEL repo on CentOS Stream in packit.yaml
- Drop already merged patches
* drop_privileges_of_agent_process_after_startup.patch
* config_fix_config_search_order.patch
* services_add_keylime_agent_secure_mount_service.patch - Add upstream patches:
* drop_privileges_of_agent_process_after_startup.patch
* config_fix_config_search_order.patch
* services_add_keylime_agent_secure_mount_service.patch
- Configure the agent to run as non-root (via keylime.conf)
- Add keylime sysuser conf file and deploy as part of the tpm
certificate subpackage
- Prepare the systemd mount unit for /var/lib/keylime/secure - Drop patches beacuse merged upstream:
* version.diff
* cloud_verifier_tornado-use-fork_processes.patch
- Drop binaries not used anymore:
* keylime_provider_platform_init
* keylime_provider_registrar
* keylime_provider_vtpm_add
- Update to version v6.3.1:
* revocation_notifier: mark webhook threads as daemon and add timeout
* Fix Packit CI test plan Summary
* Enable Packit CI testing on CentOS Stream 8
* Enable Packit CI testing on Fedora Rawhide
* Remove last trace of TPM 1.2 (hopefully)
* verifier: remove start_tornado() function
* verifier: wait for connections to be closed before stopping ioloop
* revocation_notifier: kill ZeroMQ broker if it blocks more than 5s
* Add more e2e tests to Packit CI
* Enable EPEL repo on CentOS Stream in packit.yaml
* agent, crypto: add localhost, server and contact ip to agent certificate
* Add better default repo path for run_local.sh
* Fix incorrect variable name in test_restful
* Run existing agent tests against the rust-keylime agent
* Fix small wording mistakes caught while reading the code
* agent: move key and certificate logging levels from debug to info
* agent: allow absolute paths for rsa_keyname and mtls_cert
* Add missing backend parameter
* cloud_verifier_tornado: use fork_processes
* ci: automatically push release to PyPI
* setup.{py,cfg}: Move setup configuration to setup.cfg
* Add iproute tool to Dockerfile
* Pylint does not like single-line functions.
* A small beauty fix
* This is a small fix to proactively fix Issue #840 by identifying non-escaped double quotes in the tpm2-tools output
* setup.py: add version number and new Python versions, drop unsed binaries
* setup.py, config: install default configuration into package path
* ci: move old keylime.conf to keylime.conf.orig before running tests
* retry: fix pylint issue
* Adding Infineon Optiga 034 RSA and ECC certificates for Infineon SLB9675 devices.
* Ensure columns "mb_refstate" and "allowlist" are of type LONGTEXT in table "verifiermain"
* tenant: add exponential backoff option to retry timings
* cloud verifier: add exponential backoff option to retry timings
* tpm: add exponential backoff option to retry timings
* test, retry: add unit test for retry algorithm
* common: add algorithm for retry time calculation
* registrar, tpm_main: ensure that correct types are commited to DB.
* Fix typo for config param listen_notifications
* Lint is _really_ unhappy today.
* Linty fixes
* Adding a unit test file for tpm_main
* tpm_main: check if PCRs for the hash algorithm are available
* tpm_main: handle if tpm2_checkquote returns no PCRs for a hash algorithm
* agent: output supported_version as result not as a status
* Add missing subcommands to -c help message
* tests: fix mtls_cert generation in test_restful.py
* revocation_notifier: fix socket path permission check
* Remove unused database_query config param
* Move umask calls only on entry points
* config: move directory utilities to fs_util - Change back agent_uuid to hostname
- Set tpm_hash_alg to sha256 by default
- Update version.diff patch to point to the correct version number
- Fix issue with Tornado, when multiple workers are started
* Add cloud_verifier_tornado-use-fork_processes.patch (bsc#1195605) - Drop patches beacuse merged upstream:
* 0001-Drop-dataclasses-module-usage.patch
* 0001-config-support-merge-multiple-config-files.patch
* 0001-ca-support-back-old-cyptography-API.patch
- Update to version v6.3.0:
* Coordinated update to fix:
+ bsc#1193997 (CVE-2022-23948)
+ bsc#1193998 (CVE-2021-43310)
+ bsc#1194000 (CVE-2022-23949)
+ bsc#1194002 (CVE-2022-23950)
+ bsc#1194004 (CVE-2022-23951)
+ bsc#1194005 (CVE-2022-23952)
* secure_mount: add umount function
* secure_mount: use /proc/self/mountinfo
* Validate user ID in all public interfaces
* validators: add uuid and agent_id validators
* validators: create validators module
* revocation_notifier: move zmq socket to /var/run/keylime
* Update API version from 1.0 to 2.0
* tpm: do not compress quote with zlib by default
* verifier: persist AK and mTLS certificate to DB
* verifier: use "supported_version" for agent connections
* tenant: add support for "supported_version" option for the verifier
* api_version: add the option for basic validation
* verifier: add supported_version field to DB and API
* agent: add /version to REST API
* verifier, tenant: allow agents to not use mTLS
* tenant, verifier: allow manual configuration of agent mTLS
* tests: migrate to mTLS
* tenant: connect to the agent via mTLS
* verifier: connect to the agent via mTLS
* tornado_requests: handle SSLError
* web_util: add mTLS context generation for agent
* agent: Enable mTLS for agent REST API
* crypto: add helper function for creating self signed certs
* registrar: Allow the agent to registrar with a mTLS certificate
* request_client: add workaround for handling certificates
* request_client: add the option to ignore hostname validation
* Better docs and errors about IMA hash mismatches
* tests: use JSON instead Python string for IMA tests
* verifier: use json.loads(..) instead of ast.literal_eval(..)
* Adding Nuvoton certificate for a post 2020 TPM device. The EK cert
of the device directs to the following download site:
'https://www.nuvoton.com/security/NTC-TPM-EK-Cert/Nuvoton TPM Root
CA 1111.cer' (yes, including the spaces)
* Improve revocation notifier IP description in keylime.conf
* tornado_requests: set Content-Type header correctly for JSON
* tenant: post U key to agent with correct Content-Type header
* Explicitly set permissions on new keylime.conf files installed
* tpm_main: close file descriptor for aik handle
* verifier: do not call finish() twice
* agent: fix payload execution
* tests: add initial tests for web_util module
* config, web_util: move get_restful_params(..) to web_util
* verifier: Also retry on HTTP 500 status code
* agent: improve startup and shutdown
* registrar: cleanup start function
* web_util: move echo_json_response(..) out of config.py
* verifier: fix failure generation for V key
* tornado_requests: cleanup TornadoResponse class
* web_util, verifier: move mTLS SSLContext generation into separate module
* ca: support back old cyptography API
* Fix test branch reference in packit.yaml
* ci: disable DeprecationWarning from pylint in tox
* Enable new test in Packit CI
* tenant: fix reactivate command
* config: support merge multiple config files
* ci: use only fedora-stable for packit
* elchecking: harden example policy against event type manipulation
* elchecking: add new tests
* tests: fix stdout formatting for agent and verifier
* Drop dataclasses module usage
* revocation notifier: handle shutdown of process gracefully
* verifier: handle SIGINT and SIGTERM correctly
* ima_emulator: fix IMA hash validation and add more options
* ima_ast: fix handling ToMToU errors
* Remove leftovers of TPM 1.2 support
* agent: improved validation for post function
* agent: better validation for mask and nonce
* config: add function to validate hex strings
* agent: keys/verify check if challenge was provided
* tpm_main: do not append /usr/local/{bin,lib} to default env
* db: only set length on Text type if supported
* json: do not make sqlalchemy a hard requirement
* Enable functional testing with Packit CI
* ima_emulator: specify sys.argv as the named parameter argv in main()
* elchecking example policy: make it work with Fedora 34
* elchecking example policy: initrd* might be also called initramfs*
* scripts: add mb_refstate generator for example policy
* config: change tpm_hash_alg to SHA1 by default
* parse_mb_bootlog: specify the used hash algorithm used for PCRs
* agent: add warning that on kernels <5.10 IMA only works with SHA1
* tpm: explicitly pass hash alg to sim_extend(..)
* ima emulator: use IMA AST and support multiple hash algorithms
* tests: update IMA allowlist version number
* ima: add option 'log_hash_alg' to IMA allowlist
* ima: remove hard requirement for SHA1 PCR 10
* algorithms: extend Hash class to simplify computing hash values
* config, tpm_main: explicitly handle YAML load errors
* config: private_key must be set to -private.pem not -public.pem
* agent: add UUID option environment
* agent: drop openstack uuid option - Set /var/lib/keylime under the same permissions expected by the code - Add 0001-config-support-merge-multiple-config-files.patch
This will allow the merge of config files in /usr/etc and /etc.
- Move the configuration file to /usr/etc in new distributions
- Add 0001-ca-support-back-old-cyptography-API.patch
This is only required for SLE, but the API is compatible with new versions - Add 0001-Drop-dataclasses-module-usage.patch, to support Python 3.6 - Fix cfssl bcond logic in Tumbleweed / SLE - Update to version v6.2.1:
* Another addition to gitignore
* Update .gitignore with more Keylime-specific files
* json: add support for sqlalchemy.engine.row.Row in newer sqlalchemy
* ima_ast: check if the PCR is the same as in the config
* Fix permissions issue on volume mount in run_local.sh
* Make run_local.sh use a local copy of the repo
* Small updates to GOVERNANCE.md
* Move cargo-tarpaulin install to separate command
* config: drop registrar_* TLS options in [registrar] section
* Fix missing && in Dockerfile
* Remove simplejson from scripts and docs
* Replace simplejson with built-in json module
* Add rust-keylime container dependencies
* config: fix getboolean with fallback
* Clean up CI scripts and rewrite run_local.sh
* ima: for ToMToU errors skip template content validation
* ima: Use a set of entry numbers and file offsets to remember multiple positions
* Rename CONTRIBUTORS.md to CONTRIBUTING.md
* Update GOVERNANCE.md to match MAINTAINERS.md rename
* Update MAINTAINERS
* Update README: remove Gitter, Travis CI
* ca: Use UTC when setting certificate validity
* Tenant commands return json
* scripts: Allow passing a base policy to create_policy tool
* ima: Handle the case of ima-sig with a path with spaces in them
* add length to string object
* scripts: Implement create_policy to create the JSON allowlist from files
* ima: Also add a sha256 default boot_aggregate hash with 64 '0's
* ima: Use seek() to get to the last known last entry
* ima: Extend allowlist to be able to handle generic ima-buf entries
* ima: Extend JSON allowlist with 'ima' entry and 'ignored_keyrings'
* ima: Populate verifier keyrings with keys taken from ima-buf log line
* ima: Remove methods from ImaKeyring that are now in ImaKeyrings
* ima: Start passing ima_keyrings through APIs replacing ima_keyring
* Extend AgentAttestState with ima_keyrings field and use it
* ima: Implement ImaKeyrings class to support multiple keyrings
* verifier: Extend verifier DB to persist learned keyrings
* Fix a couple of pylint errors
* ima: Fix spurious attestation failures
* ima: make ToMToU errors not a failure by default
* Simple fix for tenant error message printout.
* pylint: Fix errors related to R1714
* pylint: Suppress C0201, C0209 and W0602 newly reported errors
* installer: do not install tpm2-abrmd
* tpm: by default use /dev/tpmrm0 instead of tpm2-abrmd
* verifier: add option to send revocation messages via webhook - Fix keylime configuration file attributes - Requires python-psutil
- Disable automatic execution of the payload by default
- Use ramdom UUID by default - Introduce a bcond for cfssl detection - Drop cfssl if we are not in openSUSE - Update to version 6.2.0:
* Fix bug #757 where revoc cert was treated as text
* Code improvement: removal of extra dependencies in measured boot attestation (#755)
* Sanitize the exclude list while it is ingested at `tenant` by removing comments (^#) and empty lines.
* tenant: show severity level and last event id in status
* verifier: move to new failure architecture
* pcr validation: move to new failure architecture
* measured boot: move to new failure architecture
* ima: move to new failure architecture
* failure: add infrastructure to tag and collect revocation events in Keylime
* Simulating use of SSLContext.minimum_version on ssl v3.6
* verifier: fix minor typos
* Add tests for ca_impl_cfssl and ca_util
* Replace M2Crypto with python-cryptography
* tenant: status now shows if a agent was added to the registrar
* tenant: open file to send utf-8 encoded
* Correct some comments about and remove vestige in MB policy
* fixing a small bug that resulted in malformed refstates not failing MBA
* agent: ensure that EK is in PEM format when used as uuid
* Solves #703 by adding a "non-trivial" example of a "measured boot policy" (#734)
* ci: build and publish container images
* codestyle: fix W0612 and R1735 pylint errors
* codestyle: fix W1514 pylint error
* systemd: Add KillSignal=SIGINT to keylime_agent.service
* One-liner to set the minimum version of TLS to v1.2
* pylint fix
* Typo fix: return list order confusion between measured_boot.py and tpm_abstract.py
* Refactor keylime_logging module
* ima: Implement ima-buf validator and validate keys on keyrings (#725)
* Remove Python 2 leftovers
* Additional fix for the processing of "tpm_policy"
* ima: Return an empty allowlist rather than a plain empty list
* verifier: convert (v)tpm_policy in DB from string to JSONPickleType
* verifier: Create AgentAttestState objects from entries in the db
* verifier: Persist the IMA attestation state after running the log verification
* db: Add DB migration file for boottime, ima_pcrs, pcr10, and next_ima_ml_entries
* verifier: Skip attestation one time if agent's boottime changed
* test: Add test case simulating iterative attestation
* verifier: Delete an AgentAttestState when deleting an agent
* ima: Remember the number of lines successfully processed and last IMA PCR value(s)
* ima: Reset the attestation if processing the measurement list fails
* debug: Show line number when PCR match occurs
* verifier: Extend AgentAttestState with state of the IMA PCR
* Consult the AgentAttestState for the next measurement list entry
* Introduce an AgentAttestState class for passing state through the APIs
* verifier: Request IMA log at entry 0 for now
* agent: Get boottime and transfer to verifier
* agent: Add support for optional IMA log offset parameter
* tests: Add a unit test for the IMA function and run it
* agent: Move IMA measurement list reading function to ima.py
* Add default verifier-check value
* Use tox for pylint
* Use Fedora 34 as base image for CI container
* Run ci jobs only when needed
* config: merge convert and list_convert into the same function
* Versioned APIs
* Refacator of check_pcrs to parse then validate (#716)
* Automatically calculates the boot_aggregate from the measured boot log. (#713)
* Set default UUID as lowercase (#699)
* tenant: do_cvdelete wait until 404
* Ensures the output of `bulkinfo` command in `keylime_tenant` is JSON
* ima: Convert pcrval to bytes to increase efficiency
* tests: extend ima tests for signature validation and exclude lists
* Allow agents to specify a contact ip address and port for the tenant and CV (#690)
* verifer: Fix signature and allowlist evaluation bahavior change
* ima: Fix runtime error due to wrong datatype
* tenant: add the option to specify the registrar ip and port
* measured_boot: drop process_refstate
* check_pcrs: match PCR if no mb_refstate is provided
* ci: make run_local.sh work with newer docker versions
* Fixing pylint errors (#698)
* tests: add IMA test where validation should be ignored
* ima: Use ima_ast for parsing and validation
* tests: Add test for ima AST parser
* ima: Introducing a AST for parsing and validation
* Make stalebot a bit nicer
* enable tenant to fetch all (or verifier specific) agents info in a single call from the verifier
* Flush all sessions from TPM device (#682)
* multiple named verifiers sharing a single database
* webapp: fix tls certs paths (#659)
* Corrects markdown to have proper rendering (#673)
* ima_file_signatures: Extract keyidv2 from x509 certs
* installer: Add '-r' option to cp to copy directory (issue #671)
* config: Add optional fallback parameter to get()
* agent: Fix the usage of dmidecode during the agent startup (issue #664)
* agent: Rename allowlist to ima_allowlist in keylime.conf
* Fix decoding error in user_data_encrypt
* agent: Fix issue #667 by testing for an empty ima_sign_verification_keys list
* Addresses issue #660 (database path while running local tests) (#665)
* ima: Return 'None' when ImaKeyring.from_string() called with emtpy string
* tests: Move unittests into files with suffix _test.py
* Fixes and improvements for database configuration (#654)
* Add signature verification support for local and remote IMA signature verification keys (#597)
* install: Remove TPM 1.2 support from installer and bundeling scripts
* CI/CD: Remove tpm1.2 testing support
* Remove duplicated calls to verifier
* Remove adding entropy to system rng
* Cleanup and fix error case in encryptAIK (#648)
* Move measured boot related code into functions to make check_pcrs readable (#642)
* Move code related to tpm2_checkquote into its own function (#639)
* scripts: Cleanup shell script formatting
* installer.sh: Do not delete the local copy of the certificates.
* Fix user_data_encrypt to UTF8 decode before print
* tpm_abstract: Fix adding of entropy
* codestyle: Ignore R1732 implemented by pylint >=2.8.0
* a fix for letting JSON encoding bytes correctly
* Adding back reglist to the list of commands that don't need a -t argument
* Invoke tpm2_evictcontrol for 4.0 and 4.2 tools if aik_handle exists (#624)
* Addresses #436 (#611)
* Fixes #620
* Include PCR16 in the quote only when needed
* Close leaking file descriptors (#622)
* installer.sh: Add missing spaces when efivar is added
* More ima_emulator_adapter cleanups (#616)
* installer: Add json-c-devel/json-c-dev to BUILD_TOOLS for tpm2-tss build
* Remove more commented code in ca_util.py
* installer: Only install efi library on x86_64 systems
* Create allowlist table and basic API support
* installer: Add libuuid-devel/uuid-dev to BUILD_TOOLS for tpm2_tools build
* WIP: Some cleanups (#612)
* Remove _cLime.c
* config: Document the measured boot PCRs and what is using them
* Very simple fix for the agent (re: measured boot) The agent code does not need to import "measured boot policies"
* ima_emulator_adapater: Remove unnecessary global statement
* webapp: Fix private key and certificate path (issue #604)
* Add support for keylime_webapp service to read intervals from keylime.conf - Update to Keylime 6.1.1
+ keylime_tenant add crash with TypeError: Object of type 'bytes' is
not JSON serializable
+ Whenever Keylime agent starts and cannot contact the registrar, it
fails and quits without flushing create EK handles
+ keylime_tenant -c reglist now requires a "-t" parameter for no
reason
+ Duplicated API calls to verifier in webapp backend
+ Installer deletes tpm_cert_store files
+ agent_uuid set to dmidecode crashes Keylime
+ Copying of tpm_cert_store fails during installation
+ If the PCR belong to a measured boot list, it is not validated
+ keylime_tenant --c update fails with a race condition
- Drop patches already present in the new version
+ webapp-fix-tls-certs-paths.patch
+ check_pcrs-match-PCR-if-no-mb_refstate-is-provided.patch
+ tenant-do_cvdelete-wait-until-404.patch - Add tenant-do_cvdelete-wait-until-404.patch to fix the update command - Adjust the default revocation notifier binding IP
- Default to CFSSL in keylime.conf - Add config-libefivars.diff to adjust the path of the library - Add check_pcrs-match-PCR-if-no-mb_refstate-is-provided.patch
(gh#keylime/keylime!695)
- Recommends CFSSL in the registrar (actually should be the CA)
- Change default value for require_ek_cert to False
- Reorder the patches to separate upstream fixes from openSUSE ones - Add webapp-fix-tls-certs-paths.patch (gh#keylime/keylime!659)
- Recommend dmidecode for the agent
- Require libtss2-tcti-{device0,tabrmd0} to use abrmd service
- Add keylime.conf.diff patch to change the default config file
- Add keylime.xml for firewalld service definition - Update to version 6.1.0:
* Update python cryptography lib to v3.3.2
* installer.sh improvments
* run_local.sh: Run unit tests in keylime/tpm/tpm2_objects.py
* Fourth and final PR to address #491 (#580)
* scripts: Also use pylint-3 if pylint is not installed
* agent: Fix the checking for a specific error returned by tpm2_quote
* Allowlist verification - Enhancement #16
* Forgot to remove the original, more crude solution (which caused pylint errors)
* New and improved code to fix issue #582
* Consistent formatting for logging strings /bin/sh /bin/sh sheep64 1666871322
! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 6.3.2-150400.4.14.1 keylime keylime-user.conf keylime.conf keylime tpm_cert_store GS_TPM_RT.pem IFX1.pem IFX15.pem IFX2.pem IFX3.pem IFX4.pem IFX5.pem IFX8.pem IFX_ECC_034.pem IFX_RSA_01I.pem IFX_RSA_02I.pem IFX_RSA_034.pem IFX_RSA_03I.pem IFX_RSA_04I.pem IFX_RSA_05I.pem IFX_RSA_08I.pem IFX_RSA_17I.pem IFX_RSA_18I.pem IFX_RSA_20I.pem IFX_RSA_21I.pem IFX_RSA_RT.pem INF_ECC_010I.pem INF_ECC_010RT.pem INF_ECC_011.pem INF_RSA_010I.pem INF_RSA_010RT.pem INF_RSA_011.pem INF_RSA_022.pem INTEL_I.pem INTEL_RT.pem NTC1.pem NTC2.pem NUVO_0100.pem NUVO_1110.pem NUVO_1111.pem NUVO_2110.pem NUVO_2111.pem STM_ECC_01I.pem STM_ECC_01RT.pem STM_RSA_01I.pem STM_RSA_02I.pem STM_RSA_03I.pem STM_RSA_04I.pem STM_RSA_05I.pem STM_RSA_06I.pem STM_RSA_07I.pem STM_RSA_RT.pem /run/ /usr/lib/sysusers.d/ /usr/lib/tmpfiles.d/ /var/lib/ /var/lib/keylime/ /var/lib/keylime/tpm_cert_store/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:26599/SUSE_SLE-15-SP4_Update/458a67f3585f93f6206694c22bbf221f-keylime.SUSE_SLE-15-SP4_Update cpio xz 5 noarch-suse-linux directory ASCII text P P I[|.G)m, utf-8 e960111339ad56e8c81c6f2149e84cfa3f56a4e367f7c22296c2e075da525f32 ? 7zXZ
! t/GcG]
cNſ^J0ht/%KuS!sh0{"#Ήe57){9q`j*NFl :NIngoٚ7t4GϿr 䖌@|+LmY5awLvn y&-lߎnbF(t+ zR'm5s{ - b'Y#R(#M(/W);2wz ,9d5 wg4Q )\?],ו:
I|rd3- ) !G7GE߅cL^tsY $9, GwxHB#-mPK\W`.(B˖%Nn^:Aˁ3zD3ӿ )Q*[iy 9Јqm`?0 !$nn܋*HÚCB0n@$מ $H=H뿼P]{g9$5TӪtI[.
6.h{Ÿ}zTt^ϱ^''x]mIY2@@oE 0:ݯt CvhK{*X_i0ّ%+B%_!š;GƕGd@-3Y":@#] y~x8ڋ HדD3='^89CyFD2%lJ%Z0(okW*GuǞ\NHw7CRqT#{Vc6 Dz:V=4ϡB: Ԟ(8\,tN3` h창c65+O|*yIz$"i3!< X8U>IQby⎭" <4R 565A@{"wuoilcw
IJ
'Ap ETߜPR sP2zӍnE\jV8 <\ԊYG~ OuR -U]UV
zx x&GA*KG`ywJ~*
ݶ-wK?ehZohb<zIK"!cIOIoH.*MlQG^"Cp:lC|re)^;io4w`k-G yC Kf' g{nx 곤P{ ot.t\k+x)5sQ9hlJ =Żύ`;aq_` hx03ݯwH*B< <=&
@(" Tc$|KJ6!&h *<s%bV+TLl|Ii
X.=6 Ӵo\#}hCAIMG㵘r>͠&iʉ.5?8ӈV G.ﯮm}?tIFk@{} mZĂWILJ"It1A̡aA(pn_ #dq|U>]]u@X+')5U, Dk
_.I3Rv*8ȣK!c>W쟭ML_' Ε,"!. -G ʿN*6SZً4xL
N5"Z@#pە8q^D[W$z>qZ[qc5 X yXx40oL$ 5vln"
O=.b}.# G9~U" gMkCiDȑX{cµi/ 1.T4O9PaLځ9Ĺ`I^ f4[mK؊R`VJ1-SD33r6[S/!?Cñ 6R:sz'ߟ`:_9.66%peţlƻ8?h
&a#E Kv~=
Bbv^Eb< Qb9H}䡇wq_6УPU@oݓUlNn:2LOL:7G!"ߜ& ;X͑K4Rt֭Y}n. p@`nebpƜgrf`}+eѠ0cV'+7jr$O7ۄL!FJ96wj6PZd c<Y2<6v<D/˲ 5ߤBinܳ*Lgm88 nv_%̀;3M-Fp %cL U4p.ǺW%eMA[VֹDɚGû1C"74-9Z!o jeb+Dua^Ge6#i'xbU!5 h
Ӯ%5 l Itˠ|#{/&+סWgio6 x3swڝMahf r/u2wz ;˚fULg%cEW|Lw\KcZ5"
y7D$?ߓ{vh; ι5@X6e7XV'ëT*fixeBk[#l1^Iγgw/ 0;Ryh2Fm%q Vxt~S
};n3>/pP#E6:S^+j˭9JM6׃e@doa`p<K15aNP*ӻ m%%
& [\ AՈ/zT+œpyoB<'q{*i]S@H1\hd/2-\«FDs [N ZIF bbeYmIz0r 6ZIaT ҅(ԹvƵ& K>X iSۯKm #>SʂD|#$KeS_n&FVjBt:7k/c!2&:$b!T) j^F5dϕ2ި#lդE+c,~DA3R Ka;Ŷ+m}ZG"pSPe/Z,'{)_`[K /V" eCebxdY0}l&-[8+u ~ַ5vo֗(MO (Is U^{ bwVAUf=`LJ'Jf}H N >GyT*TȖI#:ڨ6G8Rta
Ũ ئ y&I~ 0my>mI k}Znm@$+i3o0X_rHekXla'z&3JOmY7ySlT f]n(Y/P{pDu4)LH&t 8Kpmphry4&,O:lqvtG[@;ߴ?YMht~,
-!u(i4$[%k*Y@C0Og)6RO2cײktBd2L$5LdK%8}m Qtvm'89s WUM&[JFVyREʣ 4U!&myKRf(ڃo `WKtXv{R%vJQ9<潘B="84Q U1b>̞GB"+{:ӬｍNQGO/]hɇ 5E0U_3}suպX4\KRXMkzV`r?8Si褾.q f矬$gN M E~Uǒe/ D%'?(jR H1e6*d7/'zcײ\h
w;. 6+dެ4euvI$A
Ni\? LB++ݧKnTJںbå`a)9s&8o/4CP P%!
0Rj K{˟+癠pT W;$6 3IJ(JT}sHwJ}c\ezǖv,?)O!%(DpEEl1 lQby# z c] 89`ӛf~CK\Eb&'^d@ +[!
42Y9$LQȞWEڷjΠZwѷX`#6hb>j/f|^^HwjxCq;UJH-rV^CY
Ou8w?ˤ UԸ)L"4-qs*y&K3vp(`g]4ҥ%cеw"^>ivTR^ϕr~؆7ť&WƼ^&O1
~@ƿ1 *T$<52jD\!K+ݷHب`S N6b5GMONvK6%Eިd(=OYW)A|X2$黃X 4F8dv'/qDaB3{,w 8^i
{g4XP[4u-,`OzqɈ'3{B q"kC)^mڞU)"arv%lu*R*X^&6ʋ yvTvQ78+AY)T \fOF;FWjӃEHnt6ӊ )bb4\ߋF#(i_`sDh+DOZ`YV
7X COTva
52A4DV~{f ,PcPG-@ R~ 䛶:ϝv2Y3;z`r)'伜'9ʺ>P~= +>j:p@̀~7ẍ́ 킀
!\suz=zzpH3'r95E*l{UK< )̳R$ kgN-!ؓ 1JoLl=
huI$59Y:, $z0O<^DpuV
xB7chԾwvV( VC9ܙvCf_U#Hзi00QăF< [vU >t\Du+rKߩo~w}=IBVFY3B' O^]HbhOЅ :yKf2٠@\= p!hCxFo뱃 Er]p Б\f44 2G4"
uV;WVh ŅOq &V3k~ BȉEY?L:+Ffށ#᬴4!偈xAB||صmQ,!)"Z5c+ ({GW8%$ y-ZkTP ȳ)?@v
-&J"ܓeԓ >f2 S_5 ԉlhfw*.$Oϰ'hwO+heLy{UF( X) ϭw^ cAPq䟦ϩN(ߘ SQۏ>zԢvD#f,_E5[mj,?v]{;81
*B\GO'e
ז h 2SkAoc^E4a fRWS¸@v0_or*ʵ,=55
kCh=S.m=GT4/Wq
Rzz../"'IE5[; R[R98u%[KAh`t Ma Tj9nk){=gN GOXTpk`gIhIZWRNl1uvV@a#| >e^ ]eѦ%N õKF W<
S39:UB*kz* ٟ[[|J;c!=3
C-A v_ ݅ dzlMB^P Xtk&JWeyse,eYyC lHрZ -B8I `f0(X
A"Ghb lk3%&Љ eW2;2L̛I<ҌmQ}57'A{m>ϴR}C]qGz}FOi-u{9Hz*5 9iHD*\wn8!.GSV8RUNU(Wix^xb B~*麰L Y/E>+ wh Q]p /h> ~^:
ځ E$Bo< ~^ p;X c؎b~TQ0 ug.ۂƄc)/K.Omӽ V dϰu*ZE kET8
ܧ^1"T)蓞c_{'M\qm ف`sqcxZǐ1q$QF@ 0CeE$*2/ н 8I\8ą)r]f| M-W-/+EضX8L]XF)g'f $1 P9PjӪ3X Ъ.C&bց XxBfk(T2+_\Qϙ E <W#lX9uRFJ~D˺
5 m<:?B/Hꪤq Z 9d+\: zEfiٱfJiN;CR`zHmzd(.*<~pli7 Us`3 _og|eAfjۏ`qlCe61b ±XSW e #!DTLyxҝ$a R
lSKjWܯẖBK%M a |ӌ뉁Z:"UY/0I N(ݠHe'
-U PJٯc'uF{_ 4֠[r+_ی/#x-]'Gj)Ch7yՋrF>,h;w-1m#ZT$hwH
"vM 轀/>} iĵ,+ M}OqiɴPh#/bC wcfHCO
[PK*61/%2Y\ykr 1ʣ zpԾa5' =Yr9. / k=<+c2q1//BBw1/HQ|FSi#,7R[r20 \-YmCh u _^(hV ETp\e(IJ'_E+ 7뜙t%OҢ4Ѧ_EfmO~'6@as2E!Oj|[u>'v3INİ~_VRI7CzMZ.C_̧W3xch=OхbR++[ʽwOdJI(?P'Qa#ZGQn s˞%
ma%3#gB@dX֕Yb6d|M]Ձ ^IrP eFvXt=!<(qbg bSth"g)|M\jyl={&uz~ rmT%k jjw"&8N%1焦f9wQkMovnwt }쫏5w)h>cQ&{٘əog}>ѲԞ3|2-u:̥46?m9hI @u"Wғ <loNP(elLE lZ Ω c EE) r6M+ABks*2݄w7 @NK7H8̼LȃI ^x&W e婽vA7%Ud CG{s&#& U96 yKs7>
V} @ /vm z{Eʉ6KmN3FK⍖5(~s:a$ ,@-DogQ "jߵqgԢ_x-{bY?anDmFWpN >t#z5נ7:\odVDA<z
u}DUۦeZɲ',)ѱX4ӱȲjp 9Y\| \y - ɇ[TzķEXC])Cr X2Z;;
J4@O>>+i5OCʘ/ρ ]~Fε8zF @{^ c jx3e,}Ǡ *xaX4 0gq;(6U^Ű Id划aT adN#?lB/H%~!%W U-qz)thk|oHOhWO psOj&l./<Ţqgzlq]~3~όpPb;@ iHт=TlK+.S )dTd+S]YUz' eƴ = X N¤GeR>Kn~X%=_^ʌ\o 1apXf` _ ɣ훊\m%~ CL;Q ]1A62KEIw5t8B>RvL`oQߙ[kiR. 1æ, tb1?MtfVS=|)h
ҚL-+hg" rcd}L|=o&@ I+ta[Dua~VʴfFegdu'DT)Ԃ5}r=>M\6ɠu5 RNdRCh & HAPz6;3ɮ2ݚb|v*Q9s_n9i0q˴W:oz-+]/r_C))^or8Zdaq Y eߘ> ;:2iتLHR| 6& S OrB0c
=/>\{ގv/r8ʹa,(>߹sRXTVІ8)<5* ݷJoBjbm*(9s0 "
jxthL\] HVGCx>ĸM.<|;8 -[ʏ-.$3'>!5Ƙ Ȉq Z /%6R< . r?qyQ^7ՠ~/6!` XK1*ؽ798k!T*Ӊn~CoHeyCtq]^v]ɤq8^ coa: `MԧO<00DpeJ˰IC~" 1(aZ@
v8*QL<.
r- EbI
=aM]}i/W7; _0Qy3
F.]!,y[E:Ih}(fAa1
d> 8HW?Ԑs$_n{fT* Z|yP,'*2ёHh =ILMo
UF)1g4+DPg}6 [݀g?.Lw
Eg:Guo" /3\iA)-7/ao+4֒5ޓ
|^7VT
Xs
ÙOA@w<U7Q:l/,Xy9#~:!oѨ5x|0OxF=QXۆb
l1J@1|SK}jØ 1I {֒]7 k &uT څ[b4]%0kMyw+C^}W l3 ŲH>(|qyF[? +*@[oygX{aQ-v=0 '.2+X.qق
\ l9J!3nmkp=dʨQVl;+4R 2
M2?˳5u♥ ~3&{8s|W;# LuarLŲ+j;`Dk߱-v3vI~(A]Xd6 YvCaRm m&F1jI@kf(vvaIl^dE Yl-yͅxDZ T OEwp&#. I @E}/YζT"E9?{CԖ0rWS# d~czoK>µq;GDrno@uF OOy!X^.*DOq ǀ?=OfpXS|ND 7# kGԜxbe'_UfZe#s#7*6HrЮV)ٌ[H[5uٞ,dUހshǹh4 Yʹ>C wRNONUr
UD";6 wxs>Hsugk=D*pʌn,`QFZDD6א'IdJ n#K/eD8SO o^U%w9oS?%Wϥqs&d3k Lm^'8AS4l T3gTGy'uxlgIt{Bk7g1'1j'm\q&D[V "&o7F]4C2I3ʎS u +pD_d/V`]J) ϚZc)kZWOd,z P鑳=Ń9}~gk4ْwtʓ뿔ܝzp]fD
VErtw\d%-O~:/ Ǯ>BL/Ujoֿ( Nѷjh/!r-F "G `MaT\IYa7+Ge5M#|iOY=mlO ^r{ҿ O5Ŭ5=_Z*Eg"?5K NEjoZwyJRB9J/}VY
J =G*}Y^+dq}$ j& G!Nm". Vo"Ek}BZ >*~4' ;gShQ` GNcBa'\Pǁ^cn(FF1(wCSrx@)sWQ3m P;m= fmWhbt*hu;Z]^* ?*:.0E$M
WK5=j b+@v-mGՃY#e+hT$3 2؞X;3E4[ ,| atY {fyGOdqw. #db:mS¦.)J"BTl@K5= ; ɥRxڤ}xV?ݼBtIm.@u)q8C1
3zH&qPN4S?7U ?X˫Kjl'ę2gu+: wۈa_0nl w cƽ8¥Fo%e#s7 4 S2'q*VGɷ1Y-F/9*-]V0f$T1ߧg6D p_ 1j2#S.;~-nmAV7 XkHmր}, e'~тnz
"s0APn3^VU'H{ 9SA%vHʥO \p[Xv^UgG,[
E6>XnLRd6Y'1#5/X 5=E 0'F tVC&O{߽D]mwn3qPEڊ*ѹͺ0z/t`EjRj"$Lܘb \՞))^Y' n%$9SͲ̳vAu|yk UI Hcrd~̈́fU߰rKt!
זɑEpE c W卝t= i%i-1xq%JNȈ_N9(ʠd
T.HI;
;-Hntjg T+2k5n%v^+(Ik德Ab'(
4 %ε6@&yɑe+][+KNb:Dcޖ. Mr6B1!*kd,/v7K/_nHz rg_Ӹ 7q18VkSjE42|VU@1N @kW@R6L" g,N8)SǯTӋrx^vkIW5m|PEgI6rLg8S}_
alQous} >yy/Y>9*9dDL?56!Lsw
x>F"'c e g
h+]t+ ՚_ΰ}BD:Ϛ,:0ލGgP #=?Xk$:}S.
u h7 k{h$NGWmY f*Ǩ
F(m;g3:wqfk.GOǴV|?.f`_8W@
SEuM
'8$=tJʊ'
w.^($%#r^}?
\`Cw(n6./FcLTS2U~[+'ɾ I5SAĐ~%T 8ܜ2EɺL0%?N;_`y
ԇa" 4ì-ֹCE
#'̴Z,jD %~OxWXj!,MF||+/oa ;u({ Ơ,_U^q_!ri&-/ # g4El %[2 _
E;q-ӜtF34Z>aG|P4 M=.f\aΫӭqd R f6n\Ihc (4non9[hÇy9ȵh,
XDpYC+yA3)zP Et&H_MM-;u[ͩ)&SDBh{ %!!VQ $#-
Y5/hxiDEDtq8T-TڔWi炙
bb[{f]zɗ^50L
C rfͰStո`5[FAUL/x{4bFL]~dQR!T
7u2/#CV %; @"jyʶ"Q/6X%$^ 1=Q> me\K-%!;PcKcp8QչI lLq-i]ZXHs;4{ s<<)d +S:lQ[Q LXЌ
b`eQ+OKBZ k0,Ah ?p `F~l4&fbNQk^=S\*yH A4g%A"K zᤙ&$;ę?}w%'J 8"DskQ6m^`ofRJ A~jK~S[5vmuٚ)6m#" KY @ɾM_b'Pe }PŪw)y BJo㞨a)4u* ʧ[ mV"1$Ƕ{n`7 oǫ$|Q Kܻ+^;71Z4"M)zҊ|+/+f!ߓry2@OR5
8\OJ/,V|8"j K69VÏhPIЛ!Hp붠\Ov w#[R Z3My
sJ?A2PJoM~fsYSrl݆:`z浆a+53hݎ4}vA*gf1U; 1~Ú@N/dņԅ_lβ]&,yqM(#?g8$@21#_vmE
&R6(}#
.!g3y[u1H,LE >R kYX IsUKU~ ]^}@.PB<*]Jx% {oR x\yC6 EڎN5=Qӂ'PFa*NkLdj$ X&>"F7.Ky5 ޣ܆d-SF<+Zmu(12~6ww #h;7i#̻e)Dj|3|էawA4d[z.ܿF\'beV2Q0xl AB8AU.\ƃɦcW)08[0r ϳ}V4@$W!&ˎlAjb2n즯)ZZ*ct@Q]/q(bq nj| b`Rq#^O#G[Eo6B(AVhQx//)ޥg-fWӜ(B$Oji% arBI$Pvέj`]]|9ƌy:!-' 1ep/.+.g)p Q~Ttך7GNa~ lHȨ{`/ 0ӑPIz[A +KV @IQKه^B%Ρ3|WsIvXiv{F?'*Va4{ Zo3l)1ԍ[6
9_c QF@2|{\:Pi$;;](lXj
n\fo#*i~cDt ;ܵoL H"]w;OtC' cK>&J>v7MYTpnsyHR6JT?Btװ=qKS:C7m]qzLyOs0;'eb 5+kБ)u Ym*{+/"3IB5qſzh=*\e6yl'8{ {qvmEY
,f "S1p~tvddyr;xYZ-V@Wv1tA>9&BT: %Zz91 C:7hw=[bVwERyg "J ²Ŷ#O (qy2<
wMb΄@:&kN3JGI|&v3'#pRYz/ Quޥ&QǪ,c }*ԿH ?kgIᚌ
bծY@??IMz xRT{* 60x`>!%E>tZ'We@/ qRu)zBR 'O
ϷO۴=e* `Z/|i cW<ӣ+o7:Mk oDK*0U҃#'iPm
p_5K{W,4$NN pj
bT9i$aKpȗ&?< ޱs?Vzy+ns0|u6༗+_ȳj Bʅ{eO]3+R(PqDTt֞7g䏓ՀjCB BՖ
c+z|;(Dp SOf~ &g@
ob+rz֣H]n38=zQA34K#3ٕHf =dSͫR3䢬㣥r#V >L&bUUKsJMXћ3G}1b @"1^vןdTчE; ?EG;_BWZtn'^+<ʻ[N`Bh$ѣ* y[8\Kԟ`dB=-obLܱHvm\EH鍷1'
&2SgM"QN4ZO$2UC˖ļ®
3гf\C?j|>$HU֘xw6[ui+L-b%liʀO1hc o{brUo8z;W wKnޚ[-IRlmpPRO [ H%[|J d+JO r?YۛCi?Q$?i4
}WѕӆKקhMlWYuXxYj nJdZ%߃k5/ł(|UbbP yT#: h c
YZ