keylime-tpm_cert_store-6.3.2-150400.4.20.1 >  A dap9|qv"%BSky!Äk>=P4%I:L+i2$~ 倔la:ܷdHt62 |e\DJҢ&ȺIJh4Fq$f)ُ t/YAD^-T>&} A8VKD o"{ʔ}BeJc֠EKi/Qn_Look%m*d?R>R5ž +K1afbb0ac910017febecf794f8f95e9b47575676176d5b5de7ee0c178d683a0b5fd5930fbc3b46ea3c0a160f77264249c09698c4a$dap9|+n^r]v 2uũ u?TNXg9>ӞƧ~]4֟w{TeJM|&5z2HmOl{QzjZѫ1LJ?f+=.g^Q<,2\ZIgC>*#E>pE(?d - G "(/L44 4 4 4 04 d444>4@d44h'TXe(f8p9:=>FG4H4Ih4XY\4]4^rbcd eflu(4vw4x4yzCkeylime-tpm_cert_store6.3.2150400.4.20.1Certify store for the TPMSubpackage of keylime for storing the TPM certificates.dagoat26@SUSE Linux Enterprise 15SUSE LLC Apache-2.0 AND MIThttps://www.suse.com/Unspecifiedhttps://github.com/keylime/keylimelinuxnoarch/usr/sbin/sysusers2shadow keylime-user.conf <<"EOF" || [ -f /.buildenv ] u keylime - "Keylime agent" /var/lib/keylime EOF [ -z "${TRANSACTIONAL_UPDATE}" -a -x /usr/bin/systemd-tmpfiles ] && /usr/bin/systemd-tmpfiles --create keylime.conf || : # Help the upgrade process when moving to a non-root services # # The '-h' parameter alone will not change the ownership of the linked # file, only of the link itself. This is secure because the user # still cannot read or write the file if the linked file does is from # a different user with restricted permissions. # # The '-h' parameter with '-R' will also do the right thing. In this # case, if the directory is a symlink it will change only the # ownership of the link and will stop changes, i.e. it will not change # ownership of the linked directory files. chown -h -R keylime:tss /var/lib/keylime/ca 2> /dev/null || : chown -h -R keylime:tss /var/lib/keylime/secure 2> /dev/null || : chown -h -R keylime:tss /var/lib/keylime/cv_ca 2> /dev/null || : chown -h -R keylime:tss /var/log/keylime 2> /dev/null || : chown -h -R keylime:tss /run/keylime 2> /dev/null || : chown -h keylime:tss /var/lib/keylime/*.sqlite 2> /dev/null || : chown -h keylime:tss /var/lib/keylime/*.yml 2> /dev/null || : chown -h keylime:tss /etc/keylime.conf 2> /dev/null || :I n~~~~~~~~~~~~~~~nNzbbbbbccAAA큤dabbb]dadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadadaf3e3d340592dcded58eb49eacd821fb9c2eeabf330fc863542587501c7c3453e2216947540f0f43ffb0ea2dfec0d35476ee4f339d5d3821feda76fa17fb588c34102884842601f314dad09122e48be0e4195abb884bad94630fa5a27dce63e74b5f76cb9736d1151ab0ac4afd3e516a784ec4b3c3489d54d4eecc263149db24ae2ffa9198a5bbca435dffb1f70db7ccee0bc64c0a8e65feefe4f677cf18f2899fe3e43ad068add661002f5347c6e4693e6ab6a9022161712cc9ec3e5014ef3a07a7439ff573df5bd5497baafb1e6409b367a480aebd2cb8743ee02fe0e0c9e2eca90d2b52aa97a6cb1dc307e95fe05cb756b09bb4fd96c4b920cb142023a7aa5c39b89e52ba681db55dc180002ca8b49d88ec89017a685114f14ebb1fa6df530df2244f9b3c201760d96af60d717402efbc2a33e32fd286f07bec71ace7862032da47a1670ce8f7c2157ab96d94a51f3874612f04c2670fad76531ada045e914b5f76cb9736d1151ab0ac4afd3e516a784ec4b3c3489d54d4eecc263149db24afe3e43ad068add661002f5347c6e4693e6ab6a9022161712cc9ec3e5014ef3a09ad0f9190a35c0fb1b8e5626d310897227c2c2d6bca1d204ee4074218e13bce77a7439ff573df5bd5497baafb1e6409b367a480aebd2cb8743ee02fe0e0c9e2eca90d2b52aa97a6cb1dc307e95fe05cb756b09bb4fd96c4b920cb142023a7aa5c39b89e52ba681db55dc180002ca8b49d88ec89017a685114f14ebb1fa6df530df2244f9b3c201760d96af60d717402efbc2a33e32fd286f07bec71ace78620300eb8bd4b8305df7d91e87acc46dff5f3a2de75fc4a962b16a99de41cb721fbd6c8457a79da5b12a2dc46967e9c964bb9ad0ee27d2cb837efe41396f350a85a02ebfaa96fc6ef369b9e4d82fd44fc32bab279d62f3ef0f39b91a90d304106aba29e56c5530e74f7937fe396ae6dadb73da929fd4cfcca29ea88b102c7070a05cdf2c5e5afd753725d08e0d4de854e2c7e99577854a7e7e9d27f76bbfec4e5df84bb440894a4c35e4a1878a9d6cc519b2ee5743342657d43747f06e620c926a99343b27910c0d69aa54a94e2d1819d0a43f290b42e6334148154e0f5097a0b8af2c5d7bd9f4ac46fab56542eeaa0f92180bb05bd91a9120f36a5c9a999358304f09bbae7bf3158b4dfbd68fb27aef6b4c17b5169167e9045260ad8fe9b217cd0facb50f23fe4a71f7d1d4368d4e4c97f935abb545835bba21cb56e22af11a6c50261af2389b65f0f971df30e0759389e81bcb720e65ad58645d716d46dd3cb2caaa2fa5681e0b91fe65e3d83ea46c681c9f7c44395122a279afb2f18c0a57765a2026305005b147d0c77f23935faede0600973ce4bf2be2c15a66cae15394f28123b9d4a11383c782c4e013f1be9e5e836b892a3d32db56ed54569c1be43c33cd20eae9bcef20c54e3d3555cc458e516c615b7184c1d50f1009f1dcfa4463aa163741c7b7144c212e597ae6d7844d34f0e905e80e9f0594bab6f721f9733bd1efd302db65467a8bc5c3d50d5ae1d271df0d4ae5c69c44c4a52a362a58325b1ab39ffe9b84cd05a83ac73f5d93a6c544e09b305ccfcd12d5a3fd2273e877a17946c1b42c0a03d93b29d45ca7ebc49afdc3b7e15176f7b819e254e404685a9dd194f292d76038ec1ecf00d9fc097c717dc1bc5212d55a34d08b34081c3b238ec57ee295a1004f76d5f90c7594fd2af92b4226a5d905d3ba3fef82ebd41c320658f707d9033e8a2bbd18e311bc1c63e39a1f483020c94ed088000c960571cf51a94ed009af3a0c8d6557812fc39166f4c4263177a3479e2e69daadbeee888a6c82a8ec31c5d0a5baf0b25cd12435a4022d817c85385bbfe34419255e84514958f187ceed5c890c4f80311ff1b21c374e5617b3767ab5bb2f56ff6145398eaa7fa5bc307c034fa070c2fd70fa2d85d3fad445ed2b364923bea4f7ffb13f3596e51847469b5c6673f5f004221b019b784291cf5dc6cd7fe15877980350aca0237c6a24e33162b84c4996da7dc95c7da34eac76eee195c59d4a682a6388a976259644eb8060713ee5c0b1c91ceb6b52acded1086c8a3022da86f623f458512cdf7dda2c8718c1ca766626af61ac1cddf1a713000f0277b1cf4eed71d32813b7f44ad7038144022600b9c04cd6e0338fcb4b77708c10e72a820b7a7c9e24aa6dcf41c59b@keylimerootrootkeylimerootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootroottssrootroottssrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootkeylime-6.3.2-150400.4.20.1.src.rpmgroup(keylime)keylime-tpm_cert_storeuser(keylime)     /bin/sh/bin/shpython3-keylimerpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PartialHardlinkSets)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)6.3.23.0.4-14.6.0-14.0.4-14.0-15.2-1rust-keylime4.14.3dF@dE@cY!@b@b@bUbbV@bs@bs@b a@a@aaq@aq@aaa@a@acaC1`` @`i@````aplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.comaplanas@suse.com- Backport patch to avoid the leak of the authorization tag (CVE-2023-38201, boo#1213314) + CVE-2023-38201.patch- Backport patches to avoid DoS via SSL (CVE-2023-38200, boo#1213310) + CVE-2023-38200-01.patch + CVE-2023-38200-02.patch + CVE-2023-38200-03.patch- Backport CVE-2022-3500.patch (CVE-2022-3500) (bsc#1204782) + Moderate vulnerability where a node can seems as attested when in reality it is not properly attested- Drop cfssl default in keylime.conf patch (bsc#1201866)- Use chown -h to adjust persmissions for downgrade migration. This skip following symlinks and make the migration possible (bsc#1201466) - Add logrotate configuration for the services - Create run directory as non-root user - Conflict with rust-keylime - Consolidate in _distconfdir when possible - Add fix_exit.diff patch, to exit properly in SLE- Remove user downgrade mechanism from the package (CVE-2022-31250, bsc#1200885)- Fix "run_as" configuration parameter and set it to keylime:tss - Improve downgrade user migration during package update - Add patches (CVE-2022-1053, boo#1199253): + CVE-2022-1053-01.patch + CVE-2022-1053-02.patch + CVE-2022-1053-03.patch + CVE-2022-1053-04.patch- Update to version v6.3.2: * general: bump Keylime version to 6.3.2 * tpm_main: flush transient objects * pypi: add notice that the Python API is unstable * installer: use OpenSSL by default * Avoid mounting secdir while unmounting it * remove TPM, VTPM and IMA stubbing support * archive: remove all archive files * Change GH reviewers to be from developer group * added suse / opensuse support with zypper * Fix tpm import in test_tpm.py * Fix cfssl configuration in run_tests.sh * tpm_emulator: improve TPM emulator installation * config: Add option to enable DB debugging via DEBUG_DB env var * Enable SQL query cache for JSONPickleType * tpm_emulator: move everything into systemd services * Implement broader key support for Keylime's signing mechanisms * tenant: Use exponential backoff on key verification retries * tenant: Move JSON parsing to capture possible exceptions * tenant: Move verifier stop from do_quote to do_verify * pylint: Fix issues related to W0602 global-variable-not-assigned * tenant: Handle 404 error from registrar gracefully * pylint: Fix remaining code with issue R1732 consider-using-with * pylint: Fix R1732 consider-using-with * pylint: Fix issue detected by pylint-2.13.0 * pylint: Fix issue detected by pylint-2.13.0 * tenant: verify agent quote before adding to verifier * README: remove tpm2-abrmd and OSX sections * pylint: Fix issues related to W0102 dangerous-default-value * pylint: Fix R0201 no-self-use * pylint: remove W1203 logging-format-interpolation from ignore list * pylint: remove R1729 use-a-generator from ignore list * pylint: remove E1120 no-value-for-parameter from ignore list * pylint: remove W1201 logging-not-lazy from ignore list * pylint: fix C0209 consider-using-f-string * pylint: fix C0201 consider-iterating-dictionary * pylint: fix W1509 subprocess-popen-preexec-fn * keylime_tenant non-zero exit code on error * Fix prepare step adjustments in packit-ci.fmf plan * failure: fix Pattern type hint * mypy: add initial Mypy configuration * ima_ast: add type hints * failure: add type hints * logging, config: add type hints for logging module * algorithms: add type hints * json: add type hints and add JSONType as custom type * Full allowlist processing when not adding host * provider, vTPM: remove vTPM manager and provider code * tpm: fix that the set of missing PCRs is not serializable in failure * Restores the option to use keylime agents without mTLS * services: make the services run as keylime user instead of root * State in --help that SHA-256 is used for --allowlist-checksum * config: change cacert.pem to cacert.crt * registrar_client: validate connections against registrar ca certificate * tenant: validate connections against verifier ca certificate * request_client: only add custom adapter if TLS is enabled * setup: add static assets for webapp * Add TESTING.md describing testing details * Fix some remaining log format strings * Fix for database_url parameter with sqlite * Enable test basic-attestation-with-unpriviledged-agent in Packit CI * Use lazy string formatting when logging (#535) * Make Packit CI plan more resource-saving * keylime.conf: Document setting ownership in WORK_DIR (/var/lib/keylime) * agent: Make sure tmpfs is empty even if not mounted or cannot unmount * agent: Drop privileges by switching to normal user and group * agent: Move mounting of tmpfs towards beginning of main() * agent: Read measured boot log near process start * agent: Open file for IMA log file near process start * ima: Refactor read_measurement_list() to take file as argument * Add the policy name to failure event * tpm_main: Check if tpm_cert_store exists (#553) * Remove tag input from container build workflow * Push container images to quay.io/keylime org * Enable code coverage measurement for e2e tests in Packit CI * config: fix config search order * Add defaults for ephemeral keys for agent records * Update outdated greetings Github messages * services: add keylime_agent_secure.mount service * installer.sh: updated tpm2-{tools, tss}, use system packages if possible * revocation_notifier: convert the data to str in the notifiers * revocation_notifier: mark webhook threads as daemon and add timeout * Fix Packit CI test plan Summary * Enable Packit CI testing on CentOS Stream 8 * Enable Packit CI testing on Fedora Rawhide * Remove last trace of TPM 1.2 (hopefully) * verifier: remove start_tornado() function * verifier: wait for connections to be closed before stopping ioloop * revocation_notifier: kill ZeroMQ broker if it blocks more than 5s * Add more e2e tests to Packit CI * Enable EPEL repo on CentOS Stream in packit.yaml - Drop already merged patches * drop_privileges_of_agent_process_after_startup.patch * config_fix_config_search_order.patch * services_add_keylime_agent_secure_mount_service.patch- Add upstream patches: * drop_privileges_of_agent_process_after_startup.patch * config_fix_config_search_order.patch * services_add_keylime_agent_secure_mount_service.patch - Configure the agent to run as non-root (via keylime.conf) - Add keylime sysuser conf file and deploy as part of the tpm certificate subpackage - Prepare the systemd mount unit for /var/lib/keylime/secure- Drop patches beacuse merged upstream: * version.diff * cloud_verifier_tornado-use-fork_processes.patch - Drop binaries not used anymore: * keylime_provider_platform_init * keylime_provider_registrar * keylime_provider_vtpm_add - Update to version v6.3.1: * revocation_notifier: mark webhook threads as daemon and add timeout * Fix Packit CI test plan Summary * Enable Packit CI testing on CentOS Stream 8 * Enable Packit CI testing on Fedora Rawhide * Remove last trace of TPM 1.2 (hopefully) * verifier: remove start_tornado() function * verifier: wait for connections to be closed before stopping ioloop * revocation_notifier: kill ZeroMQ broker if it blocks more than 5s * Add more e2e tests to Packit CI * Enable EPEL repo on CentOS Stream in packit.yaml * agent, crypto: add localhost, server and contact ip to agent certificate * Add better default repo path for run_local.sh * Fix incorrect variable name in test_restful * Run existing agent tests against the rust-keylime agent * Fix small wording mistakes caught while reading the code * agent: move key and certificate logging levels from debug to info * agent: allow absolute paths for rsa_keyname and mtls_cert * Add missing backend parameter * cloud_verifier_tornado: use fork_processes * ci: automatically push release to PyPI * setup.{py,cfg}: Move setup configuration to setup.cfg * Add iproute tool to Dockerfile * Pylint does not like single-line functions. * A small beauty fix * This is a small fix to proactively fix Issue #840 by identifying non-escaped double quotes in the tpm2-tools output * setup.py: add version number and new Python versions, drop unsed binaries * setup.py, config: install default configuration into package path * ci: move old keylime.conf to keylime.conf.orig before running tests * retry: fix pylint issue * Adding Infineon Optiga 034 RSA and ECC certificates for Infineon SLB9675 devices. * Ensure columns "mb_refstate" and "allowlist" are of type LONGTEXT in table "verifiermain" * tenant: add exponential backoff option to retry timings * cloud verifier: add exponential backoff option to retry timings * tpm: add exponential backoff option to retry timings * test, retry: add unit test for retry algorithm * common: add algorithm for retry time calculation * registrar, tpm_main: ensure that correct types are commited to DB. * Fix typo for config param listen_notifications * Lint is _really_ unhappy today. * Linty fixes * Adding a unit test file for tpm_main * tpm_main: check if PCRs for the hash algorithm are available * tpm_main: handle if tpm2_checkquote returns no PCRs for a hash algorithm * agent: output supported_version as result not as a status * Add missing subcommands to -c help message * tests: fix mtls_cert generation in test_restful.py * revocation_notifier: fix socket path permission check * Remove unused database_query config param * Move umask calls only on entry points * config: move directory utilities to fs_util- Change back agent_uuid to hostname - Set tpm_hash_alg to sha256 by default - Update version.diff patch to point to the correct version number - Fix issue with Tornado, when multiple workers are started * Add cloud_verifier_tornado-use-fork_processes.patch (bsc#1195605)- Drop patches beacuse merged upstream: * 0001-Drop-dataclasses-module-usage.patch * 0001-config-support-merge-multiple-config-files.patch * 0001-ca-support-back-old-cyptography-API.patch - Update to version v6.3.0: * Coordinated update to fix: + bsc#1193997 (CVE-2022-23948) + bsc#1193998 (CVE-2021-43310) + bsc#1194000 (CVE-2022-23949) + bsc#1194002 (CVE-2022-23950) + bsc#1194004 (CVE-2022-23951) + bsc#1194005 (CVE-2022-23952) * secure_mount: add umount function * secure_mount: use /proc/self/mountinfo * Validate user ID in all public interfaces * validators: add uuid and agent_id validators * validators: create validators module * revocation_notifier: move zmq socket to /var/run/keylime * Update API version from 1.0 to 2.0 * tpm: do not compress quote with zlib by default * verifier: persist AK and mTLS certificate to DB * verifier: use "supported_version" for agent connections * tenant: add support for "supported_version" option for the verifier * api_version: add the option for basic validation * verifier: add supported_version field to DB and API * agent: add /version to REST API * verifier, tenant: allow agents to not use mTLS * tenant, verifier: allow manual configuration of agent mTLS * tests: migrate to mTLS * tenant: connect to the agent via mTLS * verifier: connect to the agent via mTLS * tornado_requests: handle SSLError * web_util: add mTLS context generation for agent * agent: Enable mTLS for agent REST API * crypto: add helper function for creating self signed certs * registrar: Allow the agent to registrar with a mTLS certificate * request_client: add workaround for handling certificates * request_client: add the option to ignore hostname validation * Better docs and errors about IMA hash mismatches * tests: use JSON instead Python string for IMA tests * verifier: use json.loads(..) instead of ast.literal_eval(..) * Adding Nuvoton certificate for a post 2020 TPM device. The EK cert of the device directs to the following download site: 'https://www.nuvoton.com/security/NTC-TPM-EK-Cert/Nuvoton TPM Root CA 1111.cer' (yes, including the spaces) * Improve revocation notifier IP description in keylime.conf * tornado_requests: set Content-Type header correctly for JSON * tenant: post U key to agent with correct Content-Type header * Explicitly set permissions on new keylime.conf files installed * tpm_main: close file descriptor for aik handle * verifier: do not call finish() twice * agent: fix payload execution * tests: add initial tests for web_util module * config, web_util: move get_restful_params(..) to web_util * verifier: Also retry on HTTP 500 status code * agent: improve startup and shutdown * registrar: cleanup start function * web_util: move echo_json_response(..) out of config.py * verifier: fix failure generation for V key * tornado_requests: cleanup TornadoResponse class * web_util, verifier: move mTLS SSLContext generation into separate module * ca: support back old cyptography API * Fix test branch reference in packit.yaml * ci: disable DeprecationWarning from pylint in tox * Enable new test in Packit CI * tenant: fix reactivate command * config: support merge multiple config files * ci: use only fedora-stable for packit * elchecking: harden example policy against event type manipulation * elchecking: add new tests * tests: fix stdout formatting for agent and verifier * Drop dataclasses module usage * revocation notifier: handle shutdown of process gracefully * verifier: handle SIGINT and SIGTERM correctly * ima_emulator: fix IMA hash validation and add more options * ima_ast: fix handling ToMToU errors * Remove leftovers of TPM 1.2 support * agent: improved validation for post function * agent: better validation for mask and nonce * config: add function to validate hex strings * agent: keys/verify check if challenge was provided * tpm_main: do not append /usr/local/{bin,lib} to default env * db: only set length on Text type if supported * json: do not make sqlalchemy a hard requirement * Enable functional testing with Packit CI * ima_emulator: specify sys.argv as the named parameter argv in main() * elchecking example policy: make it work with Fedora 34 * elchecking example policy: initrd* might be also called initramfs* * scripts: add mb_refstate generator for example policy * config: change tpm_hash_alg to SHA1 by default * parse_mb_bootlog: specify the used hash algorithm used for PCRs * agent: add warning that on kernels <5.10 IMA only works with SHA1 * tpm: explicitly pass hash alg to sim_extend(..) * ima emulator: use IMA AST and support multiple hash algorithms * tests: update IMA allowlist version number * ima: add option 'log_hash_alg' to IMA allowlist * ima: remove hard requirement for SHA1 PCR 10 * algorithms: extend Hash class to simplify computing hash values * config, tpm_main: explicitly handle YAML load errors * config: private_key must be set to -private.pem not -public.pem * agent: add UUID option environment * agent: drop openstack uuid option- Set /var/lib/keylime under the same permissions expected by the code- Add 0001-config-support-merge-multiple-config-files.patch This will allow the merge of config files in /usr/etc and /etc. - Move the configuration file to /usr/etc in new distributions - Add 0001-ca-support-back-old-cyptography-API.patch This is only required for SLE, but the API is compatible with new versions- Add 0001-Drop-dataclasses-module-usage.patch, to support Python 3.6- Fix cfssl bcond logic in Tumbleweed / SLE- Update to version v6.2.1: * Another addition to gitignore * Update .gitignore with more Keylime-specific files * json: add support for sqlalchemy.engine.row.Row in newer sqlalchemy * ima_ast: check if the PCR is the same as in the config * Fix permissions issue on volume mount in run_local.sh * Make run_local.sh use a local copy of the repo * Small updates to GOVERNANCE.md * Move cargo-tarpaulin install to separate command * config: drop registrar_* TLS options in [registrar] section * Fix missing && in Dockerfile * Remove simplejson from scripts and docs * Replace simplejson with built-in json module * Add rust-keylime container dependencies * config: fix getboolean with fallback * Clean up CI scripts and rewrite run_local.sh * ima: for ToMToU errors skip template content validation * ima: Use a set of entry numbers and file offsets to remember multiple positions * Rename CONTRIBUTORS.md to CONTRIBUTING.md * Update GOVERNANCE.md to match MAINTAINERS.md rename * Update MAINTAINERS * Update README: remove Gitter, Travis CI * ca: Use UTC when setting certificate validity * Tenant commands return json * scripts: Allow passing a base policy to create_policy tool * ima: Handle the case of ima-sig with a path with spaces in them * add length to string object * scripts: Implement create_policy to create the JSON allowlist from files * ima: Also add a sha256 default boot_aggregate hash with 64 '0's * ima: Use seek() to get to the last known last entry * ima: Extend allowlist to be able to handle generic ima-buf entries * ima: Extend JSON allowlist with 'ima' entry and 'ignored_keyrings' * ima: Populate verifier keyrings with keys taken from ima-buf log line * ima: Remove methods from ImaKeyring that are now in ImaKeyrings * ima: Start passing ima_keyrings through APIs replacing ima_keyring * Extend AgentAttestState with ima_keyrings field and use it * ima: Implement ImaKeyrings class to support multiple keyrings * verifier: Extend verifier DB to persist learned keyrings * Fix a couple of pylint errors * ima: Fix spurious attestation failures * ima: make ToMToU errors not a failure by default * Simple fix for tenant error message printout. * pylint: Fix errors related to R1714 * pylint: Suppress C0201, C0209 and W0602 newly reported errors * installer: do not install tpm2-abrmd * tpm: by default use /dev/tpmrm0 instead of tpm2-abrmd * verifier: add option to send revocation messages via webhook- Fix keylime configuration file attributes- Requires python-psutil - Disable automatic execution of the payload by default - Use ramdom UUID by default- Introduce a bcond for cfssl detection- Drop cfssl if we are not in openSUSE- Update to version 6.2.0: * Fix bug #757 where revoc cert was treated as text * Code improvement: removal of extra dependencies in measured boot attestation (#755) * Sanitize the exclude list while it is ingested at `tenant` by removing comments (^#) and empty lines. * tenant: show severity level and last event id in status * verifier: move to new failure architecture * pcr validation: move to new failure architecture * measured boot: move to new failure architecture * ima: move to new failure architecture * failure: add infrastructure to tag and collect revocation events in Keylime * Simulating use of SSLContext.minimum_version on ssl v3.6 * verifier: fix minor typos * Add tests for ca_impl_cfssl and ca_util * Replace M2Crypto with python-cryptography * tenant: status now shows if a agent was added to the registrar * tenant: open file to send utf-8 encoded * Correct some comments about and remove vestige in MB policy * fixing a small bug that resulted in malformed refstates not failing MBA * agent: ensure that EK is in PEM format when used as uuid * Solves #703 by adding a "non-trivial" example of a "measured boot policy" (#734) * ci: build and publish container images * codestyle: fix W0612 and R1735 pylint errors * codestyle: fix W1514 pylint error * systemd: Add KillSignal=SIGINT to keylime_agent.service * One-liner to set the minimum version of TLS to v1.2 * pylint fix * Typo fix: return list order confusion between measured_boot.py and tpm_abstract.py * Refactor keylime_logging module * ima: Implement ima-buf validator and validate keys on keyrings (#725) * Remove Python 2 leftovers * Additional fix for the processing of "tpm_policy" * ima: Return an empty allowlist rather than a plain empty list * verifier: convert (v)tpm_policy in DB from string to JSONPickleType * verifier: Create AgentAttestState objects from entries in the db * verifier: Persist the IMA attestation state after running the log verification * db: Add DB migration file for boottime, ima_pcrs, pcr10, and next_ima_ml_entries * verifier: Skip attestation one time if agent's boottime changed * test: Add test case simulating iterative attestation * verifier: Delete an AgentAttestState when deleting an agent * ima: Remember the number of lines successfully processed and last IMA PCR value(s) * ima: Reset the attestation if processing the measurement list fails * debug: Show line number when PCR match occurs * verifier: Extend AgentAttestState with state of the IMA PCR * Consult the AgentAttestState for the next measurement list entry * Introduce an AgentAttestState class for passing state through the APIs * verifier: Request IMA log at entry 0 for now * agent: Get boottime and transfer to verifier * agent: Add support for optional IMA log offset parameter * tests: Add a unit test for the IMA function and run it * agent: Move IMA measurement list reading function to ima.py * Add default verifier-check value * Use tox for pylint * Use Fedora 34 as base image for CI container * Run ci jobs only when needed * config: merge convert and list_convert into the same function * Versioned APIs * Refacator of check_pcrs to parse then validate (#716) * Automatically calculates the boot_aggregate from the measured boot log. (#713) * Set default UUID as lowercase (#699) * tenant: do_cvdelete wait until 404 * Ensures the output of `bulkinfo` command in `keylime_tenant` is JSON * ima: Convert pcrval to bytes to increase efficiency * tests: extend ima tests for signature validation and exclude lists * Allow agents to specify a contact ip address and port for the tenant and CV (#690) * verifer: Fix signature and allowlist evaluation bahavior change * ima: Fix runtime error due to wrong datatype * tenant: add the option to specify the registrar ip and port * measured_boot: drop process_refstate * check_pcrs: match PCR if no mb_refstate is provided * ci: make run_local.sh work with newer docker versions * Fixing pylint errors (#698) * tests: add IMA test where validation should be ignored * ima: Use ima_ast for parsing and validation * tests: Add test for ima AST parser * ima: Introducing a AST for parsing and validation * Make stalebot a bit nicer * enable tenant to fetch all (or verifier specific) agents info in a single call from the verifier * Flush all sessions from TPM device (#682) * multiple named verifiers sharing a single database * webapp: fix tls certs paths (#659) * Corrects markdown to have proper rendering (#673) * ima_file_signatures: Extract keyidv2 from x509 certs * installer: Add '-r' option to cp to copy directory (issue #671) * config: Add optional fallback parameter to get() * agent: Fix the usage of dmidecode during the agent startup (issue #664) * agent: Rename allowlist to ima_allowlist in keylime.conf * Fix decoding error in user_data_encrypt * agent: Fix issue #667 by testing for an empty ima_sign_verification_keys list * Addresses issue #660 (database path while running local tests) (#665) * ima: Return 'None' when ImaKeyring.from_string() called with emtpy string * tests: Move unittests into files with suffix _test.py * Fixes and improvements for database configuration (#654) * Add signature verification support for local and remote IMA signature verification keys (#597) * install: Remove TPM 1.2 support from installer and bundeling scripts * CI/CD: Remove tpm1.2 testing support * Remove duplicated calls to verifier * Remove adding entropy to system rng * Cleanup and fix error case in encryptAIK (#648) * Move measured boot related code into functions to make check_pcrs readable (#642) * Move code related to tpm2_checkquote into its own function (#639) * scripts: Cleanup shell script formatting * installer.sh: Do not delete the local copy of the certificates. * Fix user_data_encrypt to UTF8 decode before print * tpm_abstract: Fix adding of entropy * codestyle: Ignore R1732 implemented by pylint >=2.8.0 * a fix for letting JSON encoding bytes correctly * Adding back reglist to the list of commands that don't need a -t argument * Invoke tpm2_evictcontrol for 4.0 and 4.2 tools if aik_handle exists (#624) * Addresses #436 (#611) * Fixes #620 * Include PCR16 in the quote only when needed * Close leaking file descriptors (#622) * installer.sh: Add missing spaces when efivar is added * More ima_emulator_adapter cleanups (#616) * installer: Add json-c-devel/json-c-dev to BUILD_TOOLS for tpm2-tss build * Remove more commented code in ca_util.py * installer: Only install efi library on x86_64 systems * Create allowlist table and basic API support * installer: Add libuuid-devel/uuid-dev to BUILD_TOOLS for tpm2_tools build * WIP: Some cleanups (#612) * Remove _cLime.c * config: Document the measured boot PCRs and what is using them * Very simple fix for the agent (re: measured boot) The agent code does not need to import "measured boot policies" * ima_emulator_adapater: Remove unnecessary global statement * webapp: Fix private key and certificate path (issue #604) * Add support for keylime_webapp service to read intervals from keylime.conf- Update to Keylime 6.1.1 + keylime_tenant add crash with TypeError: Object of type 'bytes' is not JSON serializable + Whenever Keylime agent starts and cannot contact the registrar, it fails and quits without flushing create EK handles + keylime_tenant -c reglist now requires a "-t" parameter for no reason + Duplicated API calls to verifier in webapp backend + Installer deletes tpm_cert_store files + agent_uuid set to dmidecode crashes Keylime + Copying of tpm_cert_store fails during installation + If the PCR belong to a measured boot list, it is not validated + keylime_tenant --c update fails with a race condition - Drop patches already present in the new version + webapp-fix-tls-certs-paths.patch + check_pcrs-match-PCR-if-no-mb_refstate-is-provided.patch + tenant-do_cvdelete-wait-until-404.patch- Add tenant-do_cvdelete-wait-until-404.patch to fix the update command- Adjust the default revocation notifier binding IP - Default to CFSSL in keylime.conf- Add config-libefivars.diff to adjust the path of the library- Add check_pcrs-match-PCR-if-no-mb_refstate-is-provided.patch (gh#keylime/keylime!695) - Recommends CFSSL in the registrar (actually should be the CA) - Change default value for require_ek_cert to False - Reorder the patches to separate upstream fixes from openSUSE ones- Add webapp-fix-tls-certs-paths.patch (gh#keylime/keylime!659) - Recommend dmidecode for the agent - Require libtss2-tcti-{device0,tabrmd0} to use abrmd service - Add keylime.conf.diff patch to change the default config file - Add keylime.xml for firewalld service definition- Update to version 6.1.0: * Update python cryptography lib to v3.3.2 * installer.sh improvments * run_local.sh: Run unit tests in keylime/tpm/tpm2_objects.py * Fourth and final PR to address #491 (#580) * scripts: Also use pylint-3 if pylint is not installed * agent: Fix the checking for a specific error returned by tpm2_quote * Allowlist verification - Enhancement #16 * Forgot to remove the original, more crude solution (which caused pylint errors) * New and improved code to fix issue #582 * Consistent formatting for logging strings/bin/sh/bin/shgoat26 1692885381    !"#$%&'()*+,-./012346.3.2-150400.4.20.1keylimekeylime-user.confkeylime.confkeylimetpm_cert_storeGS_TPM_RT.pemIFX1.pemIFX15.pemIFX2.pemIFX3.pemIFX4.pemIFX5.pemIFX8.pemIFX_ECC_034.pemIFX_RSA_01I.pemIFX_RSA_02I.pemIFX_RSA_034.pemIFX_RSA_03I.pemIFX_RSA_04I.pemIFX_RSA_05I.pemIFX_RSA_08I.pemIFX_RSA_17I.pemIFX_RSA_18I.pemIFX_RSA_20I.pemIFX_RSA_21I.pemIFX_RSA_RT.pemINF_ECC_010I.pemINF_ECC_010RT.pemINF_ECC_011.pemINF_RSA_010I.pemINF_RSA_010RT.pemINF_RSA_011.pemINF_RSA_022.pemINTEL_I.pemINTEL_RT.pemNTC1.pemNTC2.pemNUVO_0100.pemNUVO_1110.pemNUVO_1111.pemNUVO_2110.pemNUVO_2111.pemSTM_ECC_01I.pemSTM_ECC_01RT.pemSTM_RSA_01I.pemSTM_RSA_02I.pemSTM_RSA_03I.pemSTM_RSA_04I.pemSTM_RSA_05I.pemSTM_RSA_06I.pemSTM_RSA_07I.pemSTM_RSA_RT.pem/run//usr/lib/sysusers.d//usr/lib/tmpfiles.d//var/lib//var/lib/keylime//var/lib/keylime/tpm_cert_store/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:30338/SUSE_SLE-15-SP4_Update/81e57dc32c24dfe133a8899c9581ff6d-keylime.SUSE_SLE-15-SP4_Updatecpioxz5noarch-suse-linuxdirectoryASCII textPPqj{N"Nvsutf-828454cae2ab4d3ce8c46194fb478a014882f6ec405a6d05b95b255f3d5ab69db?7zXZ !t/GcD] cNſ^J0ht/%KuS!sh0{"#Ήe57){9q`j*NFl:NIngoٚ7t4GϿr 䖌@|+LmY5awLvnyKDDZ-M:êvꭗˆEYK.#i} 蔤 [a@nz tdy>2_t'10)/"R,9x㷔oȺ)%OM$L T"zԨ1Ș^hRJHCSa17 buc{'+՞[H˚~]!NԒgmWop8̂" h`t?fz'}#:_IPW{Ax1'~@R¥pbP쵌AGCPhH;tI=3G2&WCvQ5j,XP x^C ̈́xc;(Mz&K?cҰ\+y AosyaYGx!D*2\LΪསhR+a2*e诙f 6pҬ(x A0 Ey2d\L9n56b8oNt/JgkY2R^OKjڱU_[63>5Ow,2I5(wS#Y- D4IrQ3bx&Pqt`'.K4V"i*11s+nDG rZ҈0v;?|T#x5o ܟn\POD8G"!C9;angN+OnQ٣qZoηڵ~Ne[P.Rk|f)"<4s_R7g5+Zn`@2 q&) F̓iMqC'1>8ynqH8>{&\h!Ѐ!mH%Q,r-V(E~E6G\4G},N]5=f6ft0g3Ͻ; eSx؁B.x}4%Wt_.a^P gƥY嗧_+qKNL2qm~XWO:"[nkW3XqB:\/(kb/.>ι onL3v.l'?cn8t*Ɓgyј5z_.iwjH^Hw3ˁ R"v`hɊKS8MƇw ׀īP- Gy zS2R2Gi33¦t>!1WS9 ;qB{'tѵDN4z+Xw01"J3F+Nc;Nv[eA¹gں"s3gX[a`CR3dy:{^]9 ^xY\h1GJ4V %w>Z:T5Kx@4 [PȧwV"<  fr=DV>Gd[GQS`'g;n;x yP} s5&Ez^h9 yA*j'E1YR* :!8PՏD(:A#!i~QKA~:$ø-:/q]H`4a`b]@`|%vT3Car\nlK!}C`+0`&sP6WRcwT~jrTT׿f@m(ȶ/ؽ!W<ZmW])\;U/-:[[S6f]5EogN@HL< qںd-%e+aKJ0_r|Oc=GZ p r!L|HSrb(r<06oPDL=/Uуu3X5"Ȫrj_z{}Ik R?Fiҹ'$ ݝP ގq>b\?\.мO8  `A`'; fJYkdMyN_XpilO3w5'WN\ 'pHa0pGU6]x,[ƿG:O=̅ wsGW2"GvӨ`Qp H>Gi{ZK6 r5vkFXhxfO;=[|>bY.`ne )#X^j" t/J~^m }ҔA{Bc QC?nyvdvђ2@ *|9 SY[` Tؖ+FyUԜYUUӒ3Û}ɈpjvQmlv/γMM6O=D=M넁 XEL 9{Zk.`*~l(.'+Ōe8/|.UaX=Im脭bڹu%l=]VҐ] t|9uځ)B9+@UL@>]߅ k͏~Jʮh5Jy T'S iۘĊdrզW )l8(z*2ᶳEkW3A4?Zdoͭx#=^sDFh+H `O;n%淼HlMԫG)]Y ]<ڷL+ՇZ6sC IB@8#bG4V;2aC"QlI^5)l-w4#B"ϫ"²TcZ∄(X 0|\8F$dziJA69qhwOOXKg`|VKzs^aùCL}HM`kp^,4 W-8m~N LksGavuğz덎hQ23hu54@'EH"}@(c'US= * 1,ljrb?=N=&j3~ͧgC mM~刲O==:  `1l wX]a "܉E6bHg-L^Jƃ:* ܊?by-:<L5\ؿ~I{P͇xAzik?fe-R^ɗ([kMG]0KjKf>s J\2NIwVhҔjz\IMkj+R4x1l~"ᗬtXp`S -[>u ceCsx"1MJS1?V I0=}uAT/v&OY3΅zNԩ>KҋP'"ekc)W98+V\{_@ D1gy8c.d"?Rٿ<%3̪i 'jj50,@ Dž+kM֢PvBo,aDXzĩTEjLCj)b_|gc)K`k L^blwҍ*!_ܷ6])fL&wRcj])\p#%d?xtXs^vft8`$(b/(6wG^d,p \D[֘Xœ 1xwzl o"3{L!#V$S* E, ^i[]ȅFY)w)&/j$:=x'J5s?mτ;MSwydAL;0dnkgڰQW~ԗZ3 4.Dbӛwy8}h+ӹ(҉{q &1M`/u=B f혎iD7v(j.i_ĂJp{l=0mpbV:Yvv Nu0 ϛDw}rg3PYKW'c4Xƚ$ Ѿ;R'.kFȣ:{ClkHU+Z_HJ*{U{f{;CCa2Rӂh]S[޴Ol z B rZ[ A";8rt@X^9C,e R DpAF`\jplL?Xx\LoH&’uS~3 ?R!w_|JQ\hd VCT-г}v\j}AE4/>aRw vxO;=c357N꘯s?9*#0YPQønx2h~|^͌^jCS h6zc :GlD0HPƈԄIi^ɀ-&7 txJ^3f_[5ߠ?Si7R^0c͖_ "< M{'wk)0pE#-aawDz!LO>.MAThjDS `Pfԏ nTn,8c r"nDLY:q'#Am>;҇MewfsD) p {e8TvVPelF=J rVzb'yq ^~ "} " FD&hiWu\zW1k9JlǾL翊2I񸴩Ȳ*TN1ar&5Zp71Y`:dU`O K&{*8XD,#V"y6uA ^NHDO Pj/H[t'w6#`xEȴy2#/!S*\Y_XF߀kNAˊwab^Xat |x§_m+'Q U N@2=^~$4(DIaBKo*+aME; A}{'ݘX59i\b$lDz& 5C,kt2Mb8}*/,/P0+ߩm[y蟤_j`D NWBheL@Xh6EcI:u@nesWx<WQ^gZ+ݫH$-_ {M}]$ ?w4o40G|z|SLQ{A9I1|8 _1Wۺ5m&7Us|4r)2 O1Ypo2t2Ƈ5dzΜ1L8@ ;@`y{(f@TF. (O17T)gR+T튠+Y>x/mF{ׯ9<9f0͸Geij7GZC0Nj8.\ ń(vndV'zAWQ|lřT򩺄ΞL-"ӧM NpjX\ dy;`99 %cd͆>WG*ذT.m_i&Z9X tJI)=~Ӫ¸Ѹ9`|+.nk '+í6``jEC1shYekě#ol K0^ތrK’Bn1rAPXP!-Ƃ +ohѺڣPV.01K7fİtiQE0Y\8G>( 8>Jn٬ :1@/9 l'68Oy>z o&X<"z?H?: o_ԫ5b +]Y]S-s]N{{|pE1sAjҎAbԸFy𬘆-g12&Wώ<@Ύqj=[p t'I_R!+"R>OwfmO;zwX2G Jfˆ>;p hvoA\ }ehkQ>ǐiq8jQW Ҿx͚bBx 2 v=Ƶ{%Rԁ3Il[Ҫ//K 2 't!OV=xB -)tK~kRٳQuHږ؋')xj)k60Ѯ1N2C+uǿynĂU5B;+Cʼn4*'ᘭu2SlI@Ǿ@eK_,!=6E(=v "yD~rr~&J/r$?-@X)[(M4/*3v背~a:$z>AA~H^GāQ|51o#md{-5e kJ}Gh$C#%lb%!E,)ZE/9T{1zE h=铗^`T 5\̊p3}v4l!0 (8 rE_ʅ'gsúԙ  P$H 2yXYb e"s4 >2dSRv6J;D ~[a?M#f+3D{й1SyqMҷ]7xb pV/Y\/CQuVe%nDWq !М%\4Ҩ/^(d!Bn-J-$TylR#a6LU[,\\օHE2w8 trg1Nģ(O,6>U_ڇ!o=>׆RBdaE\i0lG&JdhqY@ }F岊DsPDćQG=WNzcw-5hg~~XTzs ^[~H-)^D獚;r" *p%,8e(ߦ9xJęQ4@ kѠmH¢˷?V@QĴ_77L=cj@-%ӢNK,U>qtT!IȢVSnCLw<#]=TC'AnUX+dF!R؉r='qޥ[/5֏i)Ώ$ɢ{ Vv-f DD7/F86}fO)zia#'_nt G{j`M J(GeMtïV{ܫYU ;AX;>$|+`{1`-D[r](8YVVoVF~2^uM5x0 =G-JL-&•v~XI6'%{AnPXA0w^=QDgm5rx`MoZ$䋎R9Hus9##A|5ɡ[V'Oh桒 Hugn@CVOVUXy({h@VYy )1OORldB)ktSSH~g_?_lB|Y؝Hb8ZNg77U$ֲ A0B0tP>WyYmlҕi]*%Q9!~u֠/ȫT(&Qi{\-0}MAd 0uxQPy 6Gw|/s (韽z H&$KZVZEr_+=W/C8gvda|m Z",&Jm=%jBzdsI.h#c`ӭkPwraP'GäiTo{0{3!x]THR!L|P9ҳ ^68 fd@0'M[9à;у,SZCs(([Xϝ\nAlk?.9#Ϊ|aX& Dy-,NRwxg؃(_5Ȋkl^etxDQ> b>B VٖE2P^f giX=i g[ XXGm%H m97 4!2NA\r b]puQ3qļP= Z3P0,{\ X]nNcoܺ̐RFqOwV! 'i7[€P^TɴZ`7ѮG5%)81+-|81̎uJs#@N.*Pn!,"X?'Ni˦K^ހ\5 }to JM WDQ3ezYO󖂭} 6#B3l[&BPjjPySL 8Ϝdw~tpB;[AˌY׵NLK6l}$x8߰J1lT~?vrE+? D[Wu&wG Q榊a])6Y 174F?x.Н"DA& :᨞œY']I~3KB}Q>]_O6u?}=WVxnǞ.:#|9}E|${ |Lv?h|9j jʀ+ lo]TR{R{YN2+{#BuImBX:b;ՁqդL`7b~\*.j)4)z^:Y_'IQOyY ̴6rAh QZz.X!TWS#Ϲ*G[msܯ6@ oxפ9%Ww9XUh1$ezg(*cvٵٌ 0ѢX `2ϸkX-H]G)`Abi%|"(Co6 $NP~ٯܣ:;m0Cە> kt*!R[ĿjMGc RYn\ecwDKZ%_mYc"WK:PV86y K,@?@M1V,BxZ_{"0lQ&w^EuCasDP6BUOpSZ{I":DEho*f0ٟm\Cqy%mN f<ة;K/FQEP)rYtp7:5Oauתe.Qvi;pHKi AXBB2piD-I .OS6Ϸ s$*"Vb$(Tau7>D}ߦ/=e+>!)&LUE9indhZc8a`P \8m*?h*.L+Ynsv1uVd%_1[DXXպdCDQi.6z'c^U8?; 5EΥ%/9`AJVDȄ(驝Wj &VPxN0v{mfmK#G],p围2oڹb2*%ydL\ !TaDGNt$g>lp\C%`Z[lN0hd6 (aV^SJ;2ek6%vu n\kX,~7\BnuE5I Jba(x??Q})m>GkD}?G}5~[N 8k}eǷ! 5ɩArUbaDyay9\cB#҉5 x_֘qLkgfj/(1X%r[j3gh3F\?MsS_$|1``LM"ʨH~ PW*{ev@{!6Ⱦj[i$t1vk!. [J˲T=>^q.*pO9<,I8#@EǸ6B/Jcs(Oh>pDi/B$ W[?Fjr%rwo1=KᒔSdwKTVN3B#7IE δ(|PGLtT36T9 {qn ީ_O8הj~sC ޠE! ? JiwVLhi!)u6NNF^Hb`os /FمI[G l]}[_4A'򺙲5H":%?dޖgmlJ"EK6p%/yz:g9,N E]б*+M[ 㽚 e4T @I:~}$OStO8M,Ż8FbX}MqxGNarz# }+FS" JLU>:Xe1bHV6} V|y$ U˺An] i 4fo5ˡ(;.#vµШ7pr0o,<J,.LAuyx!'WJ*pC ۔6e(}ʰǫhO7f9 `];_&X׭A㒑u 4gGH]>gAc3im.ubK"Z@m#Ju CN:$/qdyr@vC2d+PsMճa(KC$o5KN@Qӝ6)}9 Jfޔ彤 f"]S L H@ @XK f4Nq>\[N fB.A9 69JIv9Mrtx4Ǭ:St銝kvmd*@Lӎ؍ VD \ Eу ?piOH"Y.-bsuTfCDNJDOpD^ `bG{O>s(ʢA4O:'{b# 7I6X\lO ]re #^il:-Éi\ˣS %]eZ500uM?&sڟGZ2Gw>_(kȬys]:$ 綱V$uh켹#00"yj=q Z蹔 }'S4Ӕìq.&t !i@ϘNa=,u[T;Nx-|Ȱ}K io%5h*ߓ/yX*& #У~D5p?(IRM4+6c(,QNdf b~DIQTd5Xgŭn/0`r>#}/N2jB[8&5emo.=GiG,AIYxu-G:pyU&F2"|ki]2ntbw&Nu $AJ`/^2Hr晙j QesBh="P q9`Jb+RnxMݢsDjuQx7gIOo@99BABC+'(]7{7c\F&uJUKH̰wUhCS y'7㛓f3I'E^A~z#M`B"s0O K| PThCܗCv * ԧqg]="ٷ| D>+(~`$72ս-Ҽta#c\8K1R3V)j_$}!_J͑u(2T]~hMJd"fqǫ?AX'󻞲k\=,)6^8fg`al]~G1-J2L t޷ٲr_Oxh,W>;bkڣu$S&Ck1UaˉYJw Qa?ދzvWfuhqnhI0@5xmJ+a=d*N fєUYud"e iB)oM KĞu!vx[!/Ns}V%ZݴНfߦuCErV>N'GL,7=ȳITqg{Q[٤i&*Ӛtʍjr5f/M; 0#z'ɔt9N&0T`6nk^N!tl'n" &MpO^?B42S5Fg;SyaS}[jlEuHqV['(m}~A Np+?:䵞t> _moRӇȍt\e1Idū"8r;T1-.re N|r/(e nMѭPkgƪsG%C |~X1d&͌-U8ncza]nľoI2[ikF(jHDdwR3)dKi * 7>W%QV}'Aɫ(urVhqk0eʏ5fB< ! fq$e:l_2' sE. $C`% ⥟|H;:ޥ&x>Y;\Z*eT̶O ){{buqBˀ'A'&GU-O20` sIj W؍,>PV j\]0)çyf)(`@b8jtf4 YX1Bb4-i2R߈y *׳kxa*lIpS%mEpwgH g]o)2߉KWB]tHT~ .ȡjִ ?rڙg}5>+71lC-7յj3z}O9٧;5i|!\DݵPY&XgvEf l4a.^/iR>[YɉVfBNi67Ч^Aw-RxwOuW0tXmQmaUF[  |1Z؏xwV-oiiKEp: @t_ޮz!vj-A'\!BHCkXŋ̧a?F>nlۃ@ɠ] W.J? ZS= 6Ha;ojD%X}pq '8QNzR_o({7 D<-)Vqմhw^63B@xaMfZ[eĞ>/d,bWr25]6W:)͘>{B>_9${cP;U2tGƳ*dEW*aS̨rQ0%0뺘WheIB.2H``vdM 8>ب|qч6IxBM,W g0|rM-gEs[Y(>=kסw:fg 2HFvN!|`[-Ow}Qm+;y@jS7i|dznyAT'Y@$[=7+nn>~ cz^7[EΣ.KoTZ~5 P=dҶ߭`iׅo^Vjh XXjqҒD fY$51 xyz D "uV o{ḁysUMb /ﴳ%q4_M6+6Hk "Ho'AՁoxHD-{|$4sΝ!rf><}R/oۙՓ}Mvb3V H"|L1!?G2L٘pծKHc`' c(-<`ggWE ,ƲZrf KaLzF,MQ,u_ةd{^ݵ Ib&XPIa20&Sh 17K\1_2N6DG $}PL&$S6hk}B{QO.ZPp :yH\c m[EzQœeS$u^"'Jnց*f$bA lb[en1.1c+ 5 0BJI Hhphbo|.r}w}yG!npQ@S UEü 'rwk9R`j%>TLGU.4%)\SD.fTײ3ӓbĶ}w9=]b.Lۍ);Mx*p4;_;HO^uս;B*6џ6KoO%?qw+aUۦgĜ#UFe_v/6PތjVqIfal&\d ԵGtjk Da`1tjEDctz1óMÂmsn@1ww;E WVL'|yqCIi[vv9qnlm|g0.*g# c:VM*ch"2_GVl7`+1"lr LJ2 aY~_qm2qL>r]&ϸOv~պ9F&?X 'YeFq]Ҿ:p5;* d} iو~qQxy 9& /˸MA٩s<#7qͫV@vQ aFeHi>/SL]Wn-%sXkTYyzfϵ6Clo(w(\Zɮ\__54Qri>H5>fFeppi\8Eқ/@aW{Tm:!\arD>~v{KjAɸĜp|]kw_GJϸCB;u}!,dw5q&$AoGrsH `Am *e:Ej`tFެ*\ 6\RR 4rYI஁5 gJj%I~tM$kaAXBk*u;B986VЩWgK4^P+9 mMU."{(Z oFЕ]m NKCNu!)8}fXQ)OoigqMq`AR l4y"Bĸoߋ%aCiدY.#LJndѤ<Yƻ  *9$G|&fӰPn`] Pgaaڧpl"~.xU&a'׾a6yЪN Ό,-%Gr4>whհ\4l38_j:L:JG餥".81E̶/I1Fw }&"{<66ha`7EN?} ŲD:5 xݿȝ *2vw&i\3/;Z8ARٻ7`ZzѠ ųT5 T *[LhG]11bxȶu=R"~ob(U&[ꏯIUV" FU 6 ~htv$7:8 j)sTm%j|b:RBVկH*v_M/@sǣ_l9/TΟUwӝP{H/PTv`3̄]"z/u&վ9:"qț'LǎR=n ၘ{vN:̭"qiqG*_J1#tU4&0yD󕧵 pxhLr:/pIѐtG$f r'oOc'&}=/ {),yћ(活eM Tv7ApF:Njk~HMryiP\/bΈwۨa78ng殅X ؚ&+ť W2 PpWB_g辯 Nv(K|S [L_GWXSeex;57URPt-fl{ąF h'v%-3?y9U0q/ŀbW׍:#˘/A`bܹP>katp4K'M0q7v/Z68HX3{h ýak,FY-ɄQt}tT'Gz,ȒQ T";pHe{M-ꌧ` 6pžn]f-}4_D^.(9I>'RYVQ欔Q%bV.6AkMW{*|!H%햳}&vyJ&NϾ)ɽ~ːz::8,'teV5LYgrGIǣ+q BR$2UxMaiKyw`a;'L3:&FT 5+ΨQUT ;[!ָȚB]j+_CYzD]qYLP-^@%dxp$F )\sYXQ[ `-6%sg݅U,3Rl O?/>ӼuhDxTt+ș kqFT &-2fLHxW}ݏ| `?j[K_{6@IuK6+A4K&NjxK{J%Nk2e<Ψg^8U^M[@* pt?er߫n/۫^ILh#&mU@YRI,s=}mdfO /Rq FW4(u`1-.ݙWWfo`edD\#>jKG8`u0\"{N[0aRLz4/M6~Ai%j%9DQa}ͮX)3;2Q~f0VKLyp@?bcYR}+bTVp=*0fCDoZe\ 3\窮=!,) 1f˫ONY>+ m<T]O #mU,Ÿ=l Vߔxxu.u)7nIHiŤ7@2>L^ɭͯl} Чt;33oh YZ