From 0aded868a75742d38d919f011462d58b46667a84 Mon Sep 17 00:00:00 2001 From: Varun Sharma Date: Mon, 6 Feb 2023 00:32:40 -0800 Subject: [PATCH] Update README for rename to secure-repo --- README.md | 44 +++++++++++++++---------------- images/banner1.png | Bin 0 -> 12966 bytes knowledge-base/actions/README.md | 20 +++++++------- 3 files changed, 31 insertions(+), 33 deletions(-) create mode 100644 images/banner1.png diff --git a/README.md b/README.md index 61077e0c..3cf2646a 100644 --- a/README.md +++ b/README.md @@ -1,17 +1,15 @@ -

- -

Secure Workflows

+

-Secure GitHub Actions CI/CD workflows via automated remediations +Secure your GitHub repo with ease through automated security fixes

-[![Maintained by stepsecurity.io](https://img.shields.io/badge/maintained%20by-stepsecurity.io-blueviolet)](https://stepsecurity.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=secure-workflows) -[![Go Report Card](https://goreportcard.com/badge/github.com/step-security/secure-workflows)](https://goreportcard.com/report/github.com/step-security/secure-workflows) -[![codecov](https://codecov.io/gh/step-security/secure-workflows/branch/main/graph/badge.svg?token=02ONA6U92A)](https://codecov.io/gh/step-security/secure-workflows) -[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/step-security/secure-workflows/badge)](https://api.securityscorecards.dev/projects/github.com/step-security/secure-workflows) +[![Maintained by stepsecurity.io](https://img.shields.io/badge/maintained%20by-stepsecurity.io-blueviolet)](https://stepsecurity.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=secure-repo) +[![Go Report Card](https://goreportcard.com/badge/github.com/step-security/secure-repo)](https://goreportcard.com/report/github.com/step-security/secure-repo) +[![codecov](https://codecov.io/gh/step-security/secure-repo/branch/main/graph/badge.svg?token=02ONA6U92A)](https://codecov.io/gh/step-security/secure-repo) +[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/step-security/secure-repo/badge)](https://api.securityscorecards.dev/projects/github.com/step-security/secure-repo)
@@ -31,7 +29,7 @@ Secure GitHub Actions CI/CD workflows via automated remediations ### Hosted Instance: [app.stepsecurity.io/securerepo](https://app.stepsecurity.io/securerepo) -To secure GitHub Actions workflows using a pull request: +To secure your GitHub repo using a pull request: - Go to https://app.stepsecurity.io/securerepo and enter your public GitHub repository - Log in using your GitHub Account (no need to install any App or grant `write` access) @@ -44,7 +42,7 @@ To secure GitHub Actions workflows using a pull request: - Follow the remediation tip that points to https://app.stepsecurity.io

- Secure workflow Scorecard integration screenshot + Secure repo Scorecard integration screenshot

### Self Hosted @@ -75,11 +73,11 @@ In this pull request, minimum permissions are set automatically for the GITHUB_T

Screenshot of token permissions set in a workflow

-#### How does SecureWorkflows fix this issue? +#### How does Secure-Repo fix this issue? -- SecureWorkflows stores the permissions needed by different GitHub Actions in a [knowledge base](<(https://github.com/step-security/secure-workflows/tree/main/knowledge-base/actions)>) +- Secure-Repo stores the permissions needed by different GitHub Actions in a [knowledge base](<(https://github.com/step-security/secure-repo/tree/main/knowledge-base/actions)>) - It looks up the permissions needed by each Action in your workflow and sums the permissions up to come up with a final recommendation -- If you are the owner of a GitHub Action, please [contribute to the knowledge base](https://github.com/step-security/secure-workflows/blob/main/knowledge-base/actions/README.md) +- If you are the owner of a GitHub Action, please [contribute to the knowledge base](https://github.com/step-security/secure-repo/blob/main/knowledge-base/actions/README.md) ### 2. Pin Actions to a full length commit SHA @@ -93,7 +91,7 @@ In this pull request, minimum permissions are set automatically for the GITHUB_T Before the fix, your workflow may look like this (use of `v1` and `latest` tags) -After the fix, SecureWorkflows pins each Action and docker image to an immutable checksum. +After the fix, Secure-Repo pins each Action and docker image to an immutable checksum. **Pull request example**: https://github.com/electron/electron/pull/36343 @@ -101,9 +99,9 @@ In this pull request, the workflow file has the GitHub Actions tags pinned autom

Screenshot of Action pinned to commit SHA

-#### How does SecureWorkflows fix this issue? +#### How does Secure-Repo fix this issue? -- SecureWorkflows automates the process of getting the commit SHA for each mutable Action version or Docker image tag +- Secure-Repo automates the process of getting the commit SHA for each mutable Action version or Docker image tag - It does this by using GitHub and Docker registry APIs ### 3. Add Harden-Runner GitHub Action to each job @@ -120,9 +118,9 @@ This pull request adds the Harden Runner GitHub Action to the workflow file.

Screenshot of Harden-Runner GitHub Action added to a workflow

-#### How does SecureWorkflows fix this issue? +#### How does Secure-Repo fix this issue? -SecureWorkflows updates the YAML file and adds [Harden-Runner GitHub Action](https://github.com/step-security/harden-runner) as the first step to each job. +Secure-Repo updates the YAML file and adds [Harden-Runner GitHub Action](https://github.com/step-security/harden-runner) as the first step to each job. ### 4. Add or update Dependabot configuration @@ -143,9 +141,9 @@ This pull request updates the Dependabot configuration.

Screenshot of Dependabot config updated

-#### How does SecureWorkflows fix this issue? +#### How does Secure-Repo fix this issue? -SecureWorkflows updates the `dependabot.yml` file to add missing ecosystems. For example, if the Dependabot configuration updates npm packages but not GitHub Actions, it is updated to add the GitHub Actions ecosystem. +Secure-Repo updates the `dependabot.yml` file to add missing ecosystems. For example, if the Dependabot configuration updates npm packages but not GitHub Actions, it is updated to add the GitHub Actions ecosystem. ### 5. Add CodeQL workflow (SAST) @@ -163,12 +161,12 @@ After the fix, a `codeql.yml` GitHub Actions workflow gets added to your project This pull request adds CodeQL to the list of workflows. -#### How does SecureWorkflows fix this issue? +#### How does Secure-Repo fix this issue? -SecureWorkflows has a [workflow-templates](https://github.com/step-security/secure-workflows/tree/main/workflow-templates) folder. This folder has the default CodeQL workflow, which gets added as part of the pull request. The placeholder for languages in the template gets replaced with languages for your GitHub repository. +Secure-Repo has a [workflow-templates](https://github.com/step-security/secure-repo/tree/main/workflow-templates) folder. This folder has the default CodeQL workflow, which gets added as part of the pull request. The placeholder for languages in the template gets replaced with languages for your GitHub repository. ## Contributing Contributions are welcome! -If you are the owner of a GitHub Action, please contribute information about the use of GITHUB_TOKEN for your Action. This will enable the community to automatically calculate minimum token permissions for the GITHUB_TOKEN for their workflows. Check out the [Contributing Guide](https://github.com/step-security/secure-workflows/blob/main/knowledge-base/actions/README.md) +If you are the owner of a GitHub Action, please contribute information about the use of GITHUB_TOKEN for your Action. This will enable the community to automatically calculate minimum token permissions for the GITHUB_TOKEN for their workflows. Check out the [Contributing Guide](https://github.com/step-security/secure-repo/blob/main/knowledge-base/actions/README.md) diff --git a/images/banner1.png b/images/banner1.png new file mode 100644 index 0000000000000000000000000000000000000000..7ef1011e571b4c9c39409534226c0e67f3ee2280 GIT binary patch literal 12966 zcmYLP1yqzl*Iq(cq;_c}cj<1FhGi)U>5!5RK|;Eb1(xoXlon|blu)|6K~P${q~l-w zzVG~d&c@k$?=y4n%)K-3%oCxmrhxzW$zuQjfUl$o*8~7Cps3#;fLN$c52f-})EADk zqQP4LfScjrjpkJ(<$?N>(oIg^P0PvJ&C|@)3LsFv^IB@O`a z3n;;5w7uqcvn3oD=2DlPMkFa(c&o=LV#%uej*53kOKS4*bvXW_4@KaKX|Pdz$Hg8Z zF!`le!e1~5}3~y@jF`|wn*2@0a6MWqFocgqK zk3BijY@MKUetmP$biQaKb$?R_pvP*Jx)w|fj9pJTlp+oMv#f>}_=c;B>Hge)^W~lM z{SA%?0m==)DD4P6Tso>C1ksJGN(wX02eFIXGr82l`W~bJX=KnHP8?rU+=Qa(NkS-& z@mnv|e*%=zIYObP(|&M913T$R`W-^9kErM&jsO4zeT9@h^zhk%!FaDB{|8*<#{Zd6 zuUN3&tE{C&zVVS%F{q}`$UjAUkfG2{&@Bhi89Q?bUy{lB3Z~wq^$N9#twpgyUB>R| zyaE*F57o>qAM@b+gF*m-Jkpw%EGL$;Qnju8@#-%s}6j+P2Huszmg9<;tEWPkrjw$Xf-?w`v+AT+UVAubsx4^oMQjlaTfP9q@C z+hg#Zr8%o&rDcv)srv&0N-dllrqV)>%_S|4Llj9X+-?0Z{~kt0Rw!>1wu}qwKEXuq z%%cCX1pcoeL?Dxx48og!ySb;H?s(R=ej{he^D&3-z4w}op%;|{|C%+S?6mx~O|1sxLEhiIK(uJ?_(EKoNBl$pT7(@Wh%rh+%V1g43b{LC4SFgbMipl#zT}^-sM5 zB$&J~fnUiWzO;W$H&r2$8sk9&0o?is{ITmRW+j`$GNs9d{GVSYk)T}#+p1`{5tm?! ze^ErK#sKqg>FY^eM^L|RX;uW5pT$T=KcM94`Gs;mQv@Fa!9;|dyp<$hvg=;`GunD| zh@{Q|{wO~68i>Q}i&+u&l7Fxm#r*~T69-nl#&G3nS1)Bo7}bUgWY?G1qK_7TaLTJk$%os2vIbTMG#)Qv5LV3!`sGtOc zmPsV`g90i-FZt?O3M5y?8Q{Gp3G(;Cv44LGb@plun*S$vV1>(J9?<*dPfek)(^v?M zowEBq78%1AcD{G1{}6!S(fWJ|y+x0Bh>wsQ5ZofY3N&yxUxOEWMw0z=52ZoE2-}8Q z8cQQ4Yo|f3HPQnIwDyvLLrZ)Q5JAI1r3OC*8~S)Z878`O$suz=RW>}fbdQWbNOVh3 zo+t}%ZLZvPl*>X3wU(f23+3{Dnweq1A-o4;R7UmFGszs*Y@~(?$`dOb$;cldsu)6? zxYtsYWD;c&m`V&OJJ*?p`<7q3ZJGYH2SS5Hk6Fdk>`8L8{tX($d(>NnXYO63880rB z%+f**DXK4THe2pH9U9a05dCU1qWJwlp2D#2&M9>9!6ABh&^&NxEq5T((BwITpeG1Y z|L5{^$;?lRTg_-rjLp6u$au|6ww96~owlA`^3aBGU4qLel)!ECjNiofOu@Cux2vea zj(Wigas6(;Eyo64)wLZ+;m%$_7o8uR4oH&Lhz9*F~3~Sr&HW0D68% z!S=U}MNddI4iX)4@RtK-%hoIHC0Ud8lr499F;Ns5?;;I`jaJ;^K|6Vx3D+t&QkSy1 zV6-4_4dbgCIWR2#JoN0(4ePQ^Upo*0Fb}_~r1HLn`?Fnf10ds4GE$?t^d_r4D@PfLR`q3keh#Vkn4)@)5QW46}Eo*cx<$xGoOa&M@zyyDYrta zZF}Q%{sEQyX?d;5%v$^=8;=19MMA~Lt7|*Ux6@HB?cHm6-LoEihb%&E#?IgP>i4Bo zT7d(~Heri_>3tk?z-0T7i<7#Bc5G-T@$RFK9QSOS1~YQNDXo`b9tdt!?li;DoLyr% zfdB+j@Ryj~vzkLzs@~y&x>;n!iM|T;2Zo}^k!8jFe1eW|q^!wzUnkn)5FsT%XrX4b z%Io7>WS4cC9I)ts>#IF#igx340&Sy~;jA$0_7hs%5%Z8G$J~T(*TZGafy@4OD~R8oLBW5Q;>Fl_PtPgi^+kLWYW1I$gC)Ct$?0MB+e%Y1;lvq% z6Wn1ZDIw4)@~m5BLL<|DGp}6x99hTU?O9|M{QEUJ;2CGEel%W90*#>PbPtJ;@{@f_ zuTlB(s-k>aE7`om=JvhsZLc$g*Ev7SBXws4WcfAxnfo?4AAiKa*$MPa3T1A4O%Fpp zC54V*b7U-k)TgS2md~g7omW^u5tu&|LaHhZ)`tDywJVz?;y?0Uwq6kB^PvHRZk5v7 zlejGdQ}ZUJwQiVe&neUHhRp|gMHvtuEQW+)R%`PGr%w?;;dk53kjk(Z#tH(S&q)2t zK~M%VvQ|_Hal?u8%N0ty=4>Br)HV&MxTuISNhp)~R^VGAX>)WzFPq7mUTwon`Zr+* zRaOb#kGG1?VXGyO=HV2~F|-fVn(P4+S@Q*8YjRkBQ#SNi2e(J15kQT$2C2XC(Pp1O zHC7z2$R0z?&7*VR+NX?oY~#JY$I{OF>#VPwh8%}{O9~hcHQ8uB?vN`9ZyM@)r(k6;y@f93K;)%LdBGndNEX=AajUE6G);P-o}iAeNrfo+|4dm2yT zCGo3uVn7-CQ8{}CP=(0N?I%;p87ymWTE}jlms;^N4EZRB1(3;uM3hnoy z;ua*zciaiSH)1{^8XI(VcK$Bt6ASc}w~l?BJ^lTKUnEG93IR3a!f#8fP4MfYnmNDa zE_zymzw-pf_=)f9@*&%N!0h8NQH=YTvEZ&{01A4Cl;34Ap)((oIIMd40&%D zaGQ|kg9eJ0KS##rkC-`CakZ*pEqNYam)U?}^7~>$xSYuK*Yt{<8jKw)%y6U4Ft*#!D+L`-} z+dA^(`_0EkPsz^dT)Pgaqj=H^bdF+fKBdUg?xpG(`zyg{e)XU|l4L)2oZUcsS5FSt zrgQeh;RtcTTo!6I(x=%v~&Oe@T`whHfuOzVJ;0+jW{2QsJEj1hKO9d{`KPw|@ zX`01y(eG~kB45nGR;2t{(5-7GaiW1JZ>W~)ZHCTN4-5B4@6!00u)i!k+b_02i(oIf zYsisLTAuH5;~)`to#i+Kh6B2AEs7ne@w=yt|1eYtapyfJ4ROd1OMD3*FhiRwdZ=~*;V$fp3RUZXFjOw!4 zi=P>9TQaa&Wq}E%X$IS)8&SvoeyY;Wc_doL<;^uJ460}2lsXe(*J;Vu6loGNaYoDn zS~61&pgHn6n`KJimwF|MWZHXzK+x8ZYAOO;*Ei19RE*9ADZ) zK0)4LuUAHt8|T->cy_87Wy7yq;t!JaC(F(o+WHE-><14h&53+|I4bVk8ZI!jZ$?t@QA902|B!ok3-hDQ zu-*Ob{TYh5_#oxQeYatHQ*@CQc+s<7wR9Me7++r_wI*;*m!pp_<#o6IQ5}jvT8$_^ zs)19LZ3ESyA~*qb0vdD~6+!dI3i}t=tkPi)(#?eQu*jQl$s_tTX7ljOSdsTzalvwm zV_1Db_X)=}WrAl$B;@PoeCpYgL>k&QT^>aCpwgwqcpEa7C?~IDb!$0OvVuVq7pjq$ zZ>Vs5Py7oLTJI%0XLZ@5JfVxv)3pNbn}!31t6p+`sXbD)3ArKq6e$6+>bU5&!f1*G z+8IP^Cb8Ri=P52BXBg`-U=YF)3nBRSNYm{=lR77Eq@E(5KMU1uM+Wy^{KaK1MW6_dlsqRxq;?K|?dBku17Z$^&4U;mD01~F5+I$u zNzL8nzPjBX)~n)6sr#4hc7H@b^Y_fd;UO>6Y)1n|n3I&FA|L;!qBI|K zr*JYx-9i8_f4?!jw~}IR?z@^f+-vcB&LqW5lWo!`Jqzw(6UG7`i&fYXxg55tIs7qR z{@5?I#y8acSIgxxH;fx;#Y5qX!5d+9&$_O(Kj6QmA%bM7Zopb_d`+$#pL8m|QV~3M zt&?2pNQ`a|5-hXnPS9(NCDBN7CaR~4#ee#2*~K6b49&!kL+t#dccz(l;3r?`)q9cI zCbi-@Vdq(Y^S1PQA>ouQ!rAb7nxSOcRptyA^Q{oq%$|mJ7sLKZ51ADoiE344nVM{C z75?WHaE-`&XU{*nw%}S0d2}E7@@TWcGlNKQ{vXQUrH0{9_*r{Gn>iVSvaqE?Dv;!z zCFS+_@gKg0(WNlli=_-v-3?m=iJpe-3=hIt53es21*b})#VPWdy55$xwMNk6*5-Wf(@QmJYC_s5?T)pIUh0fI?*9n1Q;d%G8-@cI z`1r-+ISpP;wzVP?+Di)z?pXLQjExq9@vt)2$1^0FUxi%vL3na!55HzBtZXcw_-r@X`Y^SD1E>%eEFY5DkoEakI&Xfn-?L#ad@0y?1UTa&kWT9zRo$s3I0^pHHJqJG7sL$V@#HUrXna^YDWVecowN2N%|qINo1$;TjIl7zzetV< zy*fa$!%VC*n74`Dr^AxKm*bu3LSRPD+JjLHul3*^b28V6L~EMkfLKt}X*g)F9l}Et z^BT4ilFAU_Xj!NHTN3vT!#=-Rn|LDp*VEm(=NAQ%_f#`O}dkaa76ittAj<0`3J!lQ%xzT7A&|GS>yk&72?ZNxi) z7uP&b)WEK@SY5U0q}}44e42GOmV0I!#md?=`g0ln{0;bBwH$=q=mprK5+5yDYV z|MbsLHy-%;z|JVP%j;w{I|RpWMU~MKi=#12h>{WgJs7{pM|5QOpy2IWHog39!u$PC zBOYTi#bhig3)6A9*$sW`=1B*tDN`F;??j!`=S>svM99~dE7e} zQ2le{X5iZ01UVT2GBsz62bK{-U!(a&CK#FYa4MRN2M)Xrcr~XkRO)tYguOpnmq>q9 zLlr6wDWKD zARXhj24v@8VP#`-W@60UY$4+us;?E(oW+_Ux0+?urq+H1V=Qr8JswXKRL74P2RnAj z@gmp9vdN&L&`zCbOcIDY3^T;-nM@*`?eRwhkPE!)K(PvoPlhsI>W6=uTjXxQX0%3o z6!F}0@#Wz2`8dUY!$+Xs|4JQX>SCz$h9#iz0ws)~=%gfY|bwK1O#!%qDKG^A1e&=lXe=DGIETV5M{0hDr7N9_$X-04_buy zvZlr!l#9(uooxm2fv|Lpvz~6{YfMc^(jX0YF=|P@g~JX8D^QqQm!d2b@eB+QR49?Xc==@Rn+Z|ct)Ad)rFhe23YK1nfzH!vLT&Wu z6Gk#Z!Y%sdNhKlX4g512_TVLQ2+S8ow4j6@4xr;E<|;N9oUX0?G|~aEb9Xdsu+SYZ zJ8Y4BSllkNq%H|f5oeC-2>95XN9k@KsKAwiL$slcvx?N!fhU;?CWj5p@f^pb~yA+G}G zv>3bxvID0+i&P9xM4X3r9zmE=F)?#nZ$DKNe(+j#K5iWT{LOUG4rN4d!R zJI}y{bl~OP?u0sEq1IFz&%8^*ZKWlC{i!U0k3jS_tD>;WA2xn6!ro$m_l)w0P#ep_ z%QrPs2~Dz@^su1U-}L3LhP}g2-e0u}IydbJrCKfjNpuoE)2b-o`$FL>tW3#)Xo@-S z(OamUYjc0n0>WW~^_v$efmcT32@<@^cI_sP3hn=-RB%j|nWT319cMBAe z0m{HG6P+19mYFG_Zd>eFsgp4ZZiaHjQe(;m^J&m$MBV0pc!0&+p8IWV+12tL#=WG7 z(oSMCwqRYsb+BYAFEGiRLICGv@dj#i(SauBIuxOvwMO0U*HUXXjPRx8J2qMF0uxGL zq6ndG@xW*6UWxUbG!{$nC~w7Ad1t5E-L#xC?wS|^TV=Awy^t_xU}55y%cZf$2^eG$ z5_?jt)zsr|w@)Y7mX~AE9yMx5q_rRlf~yyP+k2s-an0%W}&BjBp^WnyxdA$&o(N|*AOM1N}g|3 zR9jVW+*?yg1@wng4JXv4to5RQA~5MuKZc&! zws?$KGeh7(AM=56m9zrN5GZG8uV#8KjSDQtnj~c+9lV2i^4jwB2iJ z$D((-M&g(At1VIk14$N%Q`eOc#!u0nBdeDQ;Stbj@YZQBIaBt=-8PH z7X?*;f*RZR`c0}H6`#O4qhdlV41&mSQ@-@D|E_}E+9(=+H74{ynG|FW=)jmn&avPJ z2ejAqN)HX18BLx=s?!si9r*VVG)HR=9B{qvXZXVDxx;ELZf7lEA~DXWYk_jrl1E2i zOn;!twz<|QuutrAnFG8mqnFKB5ZD+<04dnF?F-Uv8l4emy(WShQx$GXs1VyOdCAip zv+Nob$f=2cxov5P-8BqB9Hq2n^+grXY@pR$&i=j)BWN(8%@fBW2!70*+HkueK?Oz) z%SQRxb=`}@$P2K0UTcS6^dBZGg=c9qBgZf08w8bXGD6ORSYi-O@=Ju7k*`+!4#$+V zcsoA)_7S!JMcL!0dA5%BS4$LYQluF=--r}WD$?R^m^RG4rT&s7@+B)6C{}ZwiTOf$ ztR?Pqw}DPWyR*IMzN@L%pG52*p^9{HU{UbI?<}1mn^~5ExhB^+m3XetjAZWBsz2Zf z6S{ny>t+_}EQwimn^hAEs^9AM;1h>^J|LObB-O1nbuO}wCq~quT@52IdogUn%}rxl zNJrRFNXOeZTiTv!t#3+xHrw-N@$~JOLu0*FaMtn1vPtH#=l(Rk5pkBvF)X&w0G8*$ z3KeqVwJ~RHFFS5eib8(_8?dQ2#PEsvHumsJ#8*6v`Ta+@&vc_*XnEbDe+Vg*^946^ zzK#*^%~F%Xk)}0@xsn*Nl}Il3)~cJ=4mE-L&e4q@ zCM71i8z)MH79CW|7Ux+wH=D zyMGzJDk31PW;~20w$i$pxa@7fCy##_=_tiDMfg(mqW7=GXN!p@AN%RuJy7O)0?xO? z@7e@UZ*KknC{kaS%XxDWLg8PzVIFF~X~`b3-AizhBmHvXVr_9C=;#8PlWp9*tnSg1 z!!}q{9jY-iD(OS|61|=^+4zMAMNdNHAoAluVZQx#bd5Iz_{o`Jj4_0C>n(bcF@1?< z2en_IGhX*1xMeBpzGTYJ3GFXag43t?Jh(;ZCe)$XF*_Bj(1fcDs)2(XSBVj!fxVUz zPf4&D!P7VP&7y?bvCM_B>tJ>o)6?^%H0!^e#IWw(_qf%IUQQRwTLPxaOy$v$Xu=h* zr=G4QWEO5?bRB=!7xUuh4P3+DqvT<5H82#1T7(3|1+s)r zZ9sfWP~zWpyYO90L?dUblCo`WOSmk&eiZP9XrHQiGt)g```2uBrK(7q6bzx=5S21& z8Z77&pv_@EOThf9j}|*OR~KD^x>)X+4gXe;SuaKbuHE{S9K} z+IoCJ8@?nW_>~p}lsh4)!;#^!JN6x_<8Dj$lF`( zXqh4WE)olCvq;wH?#;Sx8QfU0W8 zy8ki%P^ZuQON{F+?WxXzT5j8_6=R*|Pha+_&+tYr8?RGVkeHQt-IrAqL!m1%2dC=C zNRx2|-h!M)+Ex0p0CsS|u(E~TlXc0QDZ3g}H4Ik?us4acm(Z>3(5 zBk){CJG@5njSoG0L_)@oy12*rI?weWyq*)ZS3d<%Q)z~@%SoaQYshk3tZ=0ocCr8D za}R9!ZGF|C0naMbHFT8(vB~Zp4h- zg~#+c!B2dXrj1HA$PR8g+j%F&q+CUk07|Gw)Es2Od;Butr?Na=ewiMEgnF_5ZAWEi zi~DV)d%H@0cw7jtk&XcXR_jx6EdxQ;6T`>|F{>vzeN^-?=r7cgHYu}f7;t!qD(W7v z%bb>H*0PMGQ~OiU#15myz{8E9R}jS!kC=D0$?n#)dCi&uZD0M_1z!!%N2)L_Cu|S( zM8+-mo=5uduH(lk{jr}fQo%TDE~`^!KmL`zunb3-=4d-K=7b9)y)yts9NLqmLb!2F zZx;PyJkLnGr?!5cz27?^>o-7q=5Db0``qy8a@4 zRLIhd|J32Vlyh4{Q|2@AQRuCO+P58PwGcTM)`i+nr?sO`(#EaCip5jMld#2KuQyr( z2pzUl%XrO0%=F(5B-!~WgL|59t)uqLjWR2of3oOIekf2~%UMEQOoi$fZ+h`Jzy0}3 z)VSVvrq!WF%UU(EtEHgg*@Aq!+$#>u$$F)c(h|vw8pi1umVoF`AY766Ljt?ZlwIf0 zkV$UKA>WSY7dr&%gx^P3QlQ5#pWy9yaya929>d0r>~{5qr{BqP4+yqih&TM$Bo?&mUj=)d#w<0_sHX}==Z>Q? zs8a`3?1Ghk@<=Oe<&ErTZ==d7^CtDy_r8N^+Nqo3hhjYt2NeG$=%Py<1VNv)b0(KkI;O$Lll)d^mlx1v&p{K%Go*df1Z>+$~Ap zNAO*+WJe(W}EOCi)1o*ut1t3r4jY*72SC+B%xx6i2`Tr{MBt2Bd{CZP14u&{>`T5k=H}mE;TxaND3qB8J@R|)(d|8Xf%9R$mplGYIt;X^cS-;Me z%zYryR7R9^EK>G>_ua;VB5TTUl>-^y_$uVIVP!S=i|X(K{x&<!z^kD+cHD zP&b(Q5ck+L5cu+KZ%al*){s!X%%N#@ssPzpyf{$1G$nO=H8zcN@X!;$^9O5e@rl;b zi`g{2LN&pPPw)=i=*8(pm-cH-b9ts>=C9B~?Hmq`gP3Q>Br+e>3frmBQHDX!9wx7w zWoqsvZ=+5By8hV#nJ??|*K=QWt{zQb@aGUfd8mX)2`Qaan56VSR^0dJsDbDVhbC7M zRw)`AEKq$iL^~NZgSeK1h#S@~I~_SmCcd|mK6LAQ6>5|tGUsD@rft+qQx$#&It!&= zeG>(e#6sV=R=`nlE!| zF)^R%pO!9!-|o;Gwb`GfOic6JM^duKg4mw9243Z zBU&}Zb^zurdL!#?e_L$B)BCK_aGU)4F2M@vXErhw@d8o+%Kt(Dejw}u0GVJY6Q3(C zn264gpi5_nE2E3(lPJUA zmhwzSiqU?H$mlxq9#VA11oD=dqLnXXH2SGli982ZCL`skoe48=lcq2rpTuU!KFy?G zPC?NF+SSd?$;b$2C7#G8ftBTYxas}=7t7Q4vWQNM5hRb??OhPWSAEh!uCr`omHfux zY7cCRF?0~X5!zcTd#R#aZ(_HkMs@#on4E|?LZ;QPXR~XonfMWtm*Lxilp8L$f85Kh zR!|Ly0R$PM=(F5vtrCbXk}3aIXwTSAXYb7ZKs=Jq=t@;E?FkSJsy-^$vf_JX8_Rv`L-}zrWI;9~an$ z8gC38y_LIG9^-%TZImgQHsRfq5g?^Z1PMgh(xy%kBjvc6`}q{rUd#Y$*2K3Q-9$3N z#$z{KfN|i6c(~0awXe0SoXBgQgNF^jLTbWW#e8^E#6 zV3*-Mp%Sw@REz=Ba<*-z^41cQS`Q5fmP@Fh$Yz00067)RfC#mlQz8+v2ThPx5@6 zN6P2?oLSxNijUc^8I1zCvuue+(>{*RZkF8eQ^G&CdP7m5cSxK2l^#4l@a+Ku;KKly zPR8Po=$J9->b23(L~PUSUkV<4yD05@+aFiRZ;H^L2R_0Fo16ZJNeY6}2btkvG~8P$ z`bF{oOHc$5ITWuWHxA|F=QC!Fi+>6O&dVrqj(Z~G<^wg<-JvWW%z6U^8Rt=I`Mk<{=XdNXPC0y z%%{St#JFUP9BVoJPFnc~?y&d=Zy(6pA%dB9WReqtnK+y?<--GrN4*g!>RkOX#mYZk zJ_!0t9p5&|AFneLf1eGrj|UymxmfmNrqXiBs?`4h0~K%(<3g`m8kVU+T~G$?N=55n zRn3h69|`^1BPB5DKh`n`iULwz&1`1Sl3mSgWI_=!RQH;{gkb_B8iIf5&2Y~0PyWjs z6tP#`(YXW`*x^o@d6Zkj>bLs^b8O)$8<_gNV>0V~SrS z`1VV38tp3#R!4l*7ZKQG^dk1e{}d5G-lx6c=HE#EEdI7pOkU%Bt_v;^GW%`DAqf=q z4TVMxsr&v@L{a~#-xcyszHLo)bX>HKBlMOaYE_dc#6|xf!yc1_vEGP-)I+)9Oa_}d zk=}qb(BDUGc0vP4_>~o(B_|*!^_40_`hREw@7B`0fDwr@c|8>d>7W-y_mu@8sz)Vg zb-(DLq5mo~D*WkkN>E9sUCC`1O}on}?Nd&6ivRX|>nlCm@Lb-GPF!ct`z~w(=)ZoT zqD=#0Qc_BH>(e@>mkg&3yZER7@IM*zI#5T+vK@g?Ffr2i__w`z;KFmLgsr?K;aE