From a23dde445f712a62e332e9cbc62962f8e61e7bd9 Mon Sep 17 00:00:00 2001 From: Mihai PLESA Date: Thu, 19 Dec 2024 18:26:58 +0000 Subject: [PATCH 01/20] renovate.json: add security labels (#148) --- renovate.json | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 6e0cc75..65c2ad0 100644 --- a/renovate.json +++ b/renovate.json @@ -1,5 +1,7 @@ { + "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ "local>brave/renovate-config" - ] + ], + "addLabels": ["CI/skip", "dependencies", "renovate"] } From c937a4a2d254988097f1c278bb675f4d625bf986 Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Mon, 6 Jan 2025 14:47:15 -0800 Subject: [PATCH 02/20] Replace OpenSSL release signing keys with new one As found on https://openssl-library.org/source/. This is the result of running these commands: rm gpg-keys/openssl.gpg touch gpg-keys/openssl.gpg gpg --no-default-keyring --keyring gpg-keys/openssl.gpg --keyserver hkps://keys.openpgp.org --recv-key BA5473A2B0587B07FB27CF2D216094DFD0CB81EF --- gpg-keys/openssl.gpg | Bin 47127 -> 1222 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/gpg-keys/openssl.gpg b/gpg-keys/openssl.gpg index 98031ee910cff0314c37b0bd735cf95510dc7385..aa017e329cf42b04f53ccc4490b2021790653d4c 100644 GIT binary patch delta 1169 zcmV;C1aAA6@B+pOf0+Ue1ZETCrvVTE=NbxR8wFE4m~Q&Ys0(!#T+L_3z3=+c?|5_& zl)yhQu<$G7($>QTO2dQ`SD^w}S`kp1h;*U*!_unH8^0RlY%c{~K9rDq-DK(kf`IA~ zRTpaqr&49V+~E+kFZ|b#a%s#5vA7y-Ha=~10Rr-;4#JEge+@WdQ8iIg=R2fd(*MA| zc}n9=9MGT2IP;f3Z=U7W48;?F@FN8S;%M@1P22bbDZTR4X1Y=jP=o%}n7^~9|3LVe z)j(KPLJDo#6-Ft-t$3TmB;e5kU`F4)MEIqCmUwiI@C#EBq6_GMUa{tz!6xn$4D7P# zRH1`E78p?ie}L&uzW?+$C$eC!%S%rX8R>lY=U%At12_@mSEKsZHluJh4l^m{08>dN zlSo4${>dI&ll^>h_3Yq8u9e*qM85dI)fnlqHD2!E@Z@8}p%cHwdt5FEVLmKdFRZl` z>nUcecLzG?U!ol0T{ls_wP3!P$8u43IO{d{vf_5`N^X8io~A}bta*6-3&6ub_Tiq*k*%n zx$p>}9}cb2^VXje@!&-q*3$NEznu_otf3ksvxEm8fFTj(L@C#We(vQHc(kHqznY%6 zAXNn;A+R!TaoCBSu8$`|0Eq%r1QP)Y06rEW1iDmnqOe$d2m2?_Eg@i(-_Xl}?*#&8 z6XT}>8v_Li1HxyMuw)&7Az+l>(941ET!#<-FrZcjd%(;LXgZs~5>8a4JF#5NzC5+W z%KlzO=hRW=ds8JwUKGRCvw9yBQOPsMpMD4mp8k|kVibLly%Oh9(42_LIoO(&;I?#u9U)B>laq9fW-sW%uy_fVMN-Tr>oeac&1XSo z$<(O#MvXzlGvWGoz5#rw{@LUij5#HaopM^hmwfssG(~h)cEb{*9Dop^|M$WaJ(39U z-yG)eDFB{!o3hYgyO8pTPw|2;$R-*1%|5;IH z{NoptcN^zuY^F=fZHK_w3A9vBI5BF7`5Y;Ll1bhivZ+p19hd9>6_l2JLyG&P3BS5i z=YR9k5|1VBO8+G;(9_xFz}A}PUuVMl?b|=D`TN~L6FZK5G`|Aa5ir)?!BOjN9z!=u%c3zBoOXUYm*SNQYm3c|NlZXvB8vt}+AYVwy^Zb+g&)euhTql=UxwB z04x9iH1s+meESLjfGEAb5&SU(fd2aY4{xu3(fQkS3J@Hqf)8C65G0^87QfmXeXY|f zjEpV9ocf()lU)<3h9dQxUs4lOQ08%*kY-<1K;jwjGUCxp5J(7W9M$B(nGI~O8ZsG` z30UWgJ!l!Vup~R(JrquAUyb$%M1dfC$lAcqe6Ay6+8^5Fm=ft__`+MKa1Bckbq>B1 z;-7?x`U+Eu4smf50-14K;)x%(mXJI0?lpi|_Ys^8gJ8r|-Aq<9+%rUCfTqx7Bh-Sf zOmg)Qs|s7*yJjUB5ln_@uzwVU#s10c6wLvgMkWKWQQ7tp%`m_31treEq*|86s1P>G z<6MzY&o@Lu8O0>w=i;ZptG?xvbHs`rL(a&;bLK7t|64sb95wpujk-mWNAsrV{C6@ zXd|GnXJTSz{kquRgs_yFEPA^wH|`a977gbsseh$rMq!%P};zBVeHi`BaiRBPeBHd%~O z3fi_$3m~*KOKp~4Rnc!tmn;i4w`X!_(>~IV#x-9;_y}8~%YcI?tCzB(r7UpZL|BGy z)HKFan7^OYz-XR9U(ElG$1zOsSr!zFw}J3 zUg4MfTSCPQKT>{okE`pc`u)UXFYe_jDbQW`vrKm+?WuFtBS#>UTernIScyrSLP#Y> z=byp`J)f%H-TNq?&Sq|OZjztc%OY)ogGoJ#dT~(LUV)f|&5Vzby6T_7hQuG6>nB>M z%W8{A-+@`&l~{G@Iw=hn)yeLiBa?~R6v--8fCE5Y?F*^90yl~uUQU2OGhs=*kBzOOBtiL5DhL04BO3o6OvX**V?Yaf1r2~(7cQQdG+3XGR13f8f=0DeY=rjmFoV}k zkA&*9Dq$4cI5=)}AM6d;14TC21Rbo9@B7~~_L#Yt*nMeN136A5mX13hH3`PSh=$;A z+u^7|ggKl)WdNI03Jy?_sk1HSz>RS~3r&I~(H_KX#r5S3C2N=)jK0733>yf{Z3QUo@_E0clT$QHe1&i3=N4z&)J)`GZeG!Jv;q zo}%+k%L01BID$Vut;l-`Oj;?F(1qf>fX@9|$ryg+V# zS$BaO;e8Iq2lMvu-JD;+Bov4Z6!X>Pp?9ud~U`x)w7m$W(tMlRY#jb8^aNT>!zT95M>;2X8AL zT9yKIKY(5Nw#qITWLZ-gAv>h)POKc8k^S5`n-Y*fCL|hoxE1f(#Ncd8IRz>GSn1SE z&n~Oi%W=@Xq`$jIjXI*HL95Q<6`y>so9*wtmC=H84tI56y~GzC;In&rr?mqU-}KGR2?Z#aZC}C9}1=BT=G+M zmskov0RX7nKlA6O*D=yt{;cope6M?%poK{N>$@X(Y5!NiulpTFBjq8Kq9N?1M zVQ@1sc0{nF(tCGo`jo%~k)?MySiR7EAd}2uwx>f5QDb+VkYNm%{bu`Z2MP`rDMm75 zxb50@l${TUzY;BD`+H~6lWMP->bfYgl4*BkB)#u0nIF8pp^@?S$9+q?VlWIdbIcN=)D@Pd*MsBJF5?v;HwuBOOpi6o9%Ll7z!x*o1`&z3;?d5G9~L-Y|ALR zb9KJO48a~PCKbV-d4Ev8MgE48hvIr+bxz|N+NO1AF!oh_0Y~|!?!Bx-^x;7vxbW9Gvu(j2znheLL_GYfk?s z`XjZxwNFERg@yygvZQHIW|L<}Ibr?`?b(Gr(h4z3XJZUFkVcJ@M9}_$ksfu3)IafBJ8cjk-XuFX?3d3eI|>WyzyIKHy>`~Hwh4i#o|`&YhDi}T<4 z0-n5{lO>_Bo~02XkL~Nw?5}dvE7C%NU(+uTG=SqZ{r@L$g8{#R@HKUTy>Wfh#~@f$kXTZ)^{-s+fO&~bE@wozQnW^UVvFr4o|i^7&~83*8Q;1 zMgVc>X+L5PrhHGiF<{9QIRB2A*hi6tXzILc2q__!mKlAfPcIFvV3%FQt-&-pZ#(kQ z*uxiPNanfSRcJNTc#5M0*N(brMt~=L9u!$Z3Y8No>h}6GLmdwuEmxGv5)}Qgo{7CzB;^$R0GLYFcb-|h-jAMo z>%3&S>>I;l4ZPcW!~r$Ez+@m`T65kGHop1h^Y_CDC3UB!O%*j?m+`iuii)2@B)-DXhHiWvE11ITS=_r`V9XcF&H5q60@H=Wbz^;Y9 zN_(~te9c_j3uW*}Mw*}}4z0ww;~%k^psJ#sbAk%K;BGnzk((d6g+_WXQl2}p39~eV zj!VjCa7|%C+6~?^!mCt#%$|Xf zJpX&rI*C$;o)_ZjkHQ)n5Otp}7&#M7r@|fFyaIEBg3PY{FV%ymX!mcaVjd`eg34r@ z26^Ll3zglw1+cGjbT3lU$Rz@wT^1u3hN%K8=y4*CU0vDWF%dl4;s=Hhah_X-wCdCk zusXpL+aq;Fx|Kqrek5O!&zJ&>)^=<~JKbx97AN;xUdlL6EX2GLjX(De7XZJaX*Gn2 zYGIUt0mn3ic6J6UL{Cp^CTp3PS;&doQW*4b6adxo>q4m?uP=j8hifZ3WZCMWl+oI9 zrZJWVL`IfDn|<;+1^28uys2{fVYJpzQM1QTB-SIl7R9=|*8cUCa+6Q&@E@0YJ<@&b<-MXw;)2kfgJ5Dj$L zzfT0o7OfeS8~wDp^S-Suk+;3uT8s^GpYfLeqFH?K5a>%hfB&)rtW+tOLv6$cjZ}Y; z{?4srwr6lDeu__fYI^g)@*Q@f0yrY;VTGl!su^4w4r=W9PP$+qvWBa*c z!Zwnk)OUI#_db~9w&Vc~kLeY^Gp49vsFPW_MPxzoMFJP>Nf+H)TvdYA#h0vdF5HE< zFxS#g_o&{1;vj0P@LA^JnC;Kg&7Zo@vp#7bwMKzV0I&7~`EfL<&UWng2!FBrWS)_R zA|yx}Flbzfa%FZ7`jgo0#*7m+*v$P)%FogL8MHmH9<)s0aJ8=b#d|f;%P-M+f}E%} zBM%tU&!-{V?@yu2VT`of^`j9h7=M1|nIg~pUNZ2-kq>pY3x$1OgY+k`yD;}tdruNKqr@AI5*11!T`oU~aEvG9iI3gx~m)e_G-K-Tk$9k!5L$$lPjtTZ8 z20o)5V+YbneFpU;WF8}JNv>Uvpg!X~neCtrpi=I*w_6s#%-3kyk=~W6>&?kY+qGTt z&FqIzYp5brtQpQKBt#2hbU)Cy(!4&~2fI^xqWu0jFJuZ1-Mi~IW zi2swKodN*pu>cSNt|qC-QWaLhC1k{p61K6OwF=m0=2t#N_(rOf-Y0uHn@@1ZMrtcH zU1KX6@7zey;{@sgsi5=zRfx&Ed33MX*Tq-b?j&&==qrZr0pD7!BwMg){xHHv8U{He#M-s-YnV; z!39qoGX?X5g#&E6k&|HuashtW7@V%}(;(=9p*ilHFNqI21C=l02Y2%Yct|ElBvU?U ziSY-`b!xNcdZG$hYKzv|TP~=W4GKrg_Chy+V~VuKpjh+fr4Zq|=SwMDrd6g9cMFB8 zWYY~*ybFV+qXO=-*o?d{{lWvf-GyZTh69!Hs-XukUF&d;|MC(ik-w zymOkHh+P`DgH+m3PJvx0^Moo2>|`=xAFCQ{ZdUxfN|*m z5J!G79uTl!j0X%I=gUn-|r zx%++V2*x@@JX`B*fs-dj*ZR^mdje~-$FgD9X#JQwFJ!k7^6ZL35Eg7n{e@EGdn|r9 z1l()}T_z{e9LaZ%o=1`zyWK1Q^$q5Rs=AW1{m`K>~

NE3sL zeP~(F`65(^Vp3Ce#X_8zp>r>&vjz}ykCbmX;HgDP>=Y@vlt&<>ds*V1Jv|KtQlA(3 zmAE}s2RJKSeOVvG98f{-AT<(f;1GXOodt<;xclv+|8B%rW4&4}{z>Pbt@)}z0shg5 z_lgkDl-XE*2a43g>0d}0ZH(| zFb~LXmne>_s^S@8<(zv^B%jwdZAD$_*9Wg=9Gwh_7qDyR7G$}qKRa&U!1#%LBG=;DTM=G;px1!N+6hfj=+0a(~7| z;X8pwEa~d;B-CpO-*U>+Z!Dz=X=2{gmz<8xsGT?|iz8Ad)pLbyR!m1Q=e_F*5r zR$9Db=&yw)l1<@coSqZV#n$%K2Fs5Fy`4*>vg2`tfl2gk55R5-gh;jHIO0%pjcN7| zA=~6>G5m!R^fr1ni9rP4yiAqvNyxGWWZ`JN~Pi z1E2mgVBg&T9|7y11MvXHp!vS}Aw3JYm+F?^nX0OdSO+|L;bdfr($v|cXhNJZpzLwu zM8d>h`Jw=AtTW{0rKw~yUDv|ZYnVjj<;hkSCJ1YpKiAnL@O+qbHVIfptOR7h%b_Gu z5qbtLHM}JltCs1mn7RDa!-9-fjlWQhFIZ8<>h>Vl?^2OODV|f9?)$w#>q7y2dBs#6 z;XeI=jc)r6TDa{jc1ry6@wIsQ=RSfvcv(yMfZOa*{2itTN^Up4=nRcorrhr{bv8Hj z9@#8zuIFd`=#O={NVnrSd?plo~c&+S?J7T|~mFt1G2w z)+0VZsH2mv8u7coO&tpKA1oOEr1#Gj{8yJ(=!1BX^H}0GyiWuyY_HYB9IJz)A*?SBRn(}12%vPLMt}6brilPzNGCA7K6s4-k{?6 zd`KA|(3)1-Cg=OM{t)NNFGjq3F26^tgabm6Vhz(_P8)}^cLVDfTLnH8D-V5CH^-tJ<7s$Hz#}l!dwSbX3aF3;J*o^!n$iJ|cHk?oSfr<& zJ3r1K<+GiV%G|B}P~Pq;gFz593ISyo*FQ8)kcKqkYW^s{DB*DL zm1B%929#oWmDTG0qSUedejX;mnKgUy%%>NuJlVK1890}D+}9c561*>%N=-`~Gj=b>SQwAu_F2D}xSgXn8C-knoZFZNeIy zfAIIWH2)X6{I691AMpBr_4wvmh!;_gWk__aUI*B;))95-k5}W2_G(t|;JA9KO1EYL z^uwuJQ8Dfdp^mjj(FhjOW`fv7@JdVyUnok5jc4TPe=YfP@yb zyP*=h@R+mn(5A=vPF~d)_4!#?SH!9gy_5cqt0=o}By6jneQKw>SiI~Q=+I=&KoFf< zPLdLv9q6RDL)9^8D;6g%FSPverZ0Xk(*P1Rt)}u4D+}9Ms+H%FLHDGTBPn4OuIGeQ zo5Rh(CMxPxAE!pmvE|rov`h#>hw1w)W+$XZBb{8h1J~|QGbSlmgCTWyu3y*mxcu%B zg5D1v9P}c@-SN3Wj!iG=JFnhvWBz84jw6ZTU;p3ES>`y|{wjeCth zG4Z<(iP*+X^lr|Qz8g>u^~G@Ey1KDjrFER3gF%m^aJs=f)#4E`Der9qV&*EEPD+P! z2i8AR#*`cnCotLZ;gg=`eo*`bo);j_4x$5xuO43-Wu~SCp=Rv6yFa@rl_vnbzA_t{ zXKu^H&0--^xkZG@Pve7-lP}psWLs!)z{o+m&2ieHDsv7Y*%@fkf&g%7&C;GFA$r*aY7$_hUgX^}l+20U{(IR*}r-CX|blW%86V zoMI2829PADl{VAYugqYLmIuN4kg8x->f2*pOp>Z;Cf(>6^Ht8qwjo?9dp(bz%rgec z={&NdA6ayFe_>L4Nz3_%`WZYc_QbK=lwYAzw3Kh89~D~2OljAeNgAdO?iQ*~QNUg4 zSe&3#9MfFSS{Kup;_m#nGYy+`{ia(V9J?vUu)R^>&4{@%w_)k685UAuir6%{nP-QZ zl`F+eigs(hiTE-{#qGz7JmSToV&b6n$aqq7;Is3rp&j@edRJv84Svr`RP()0WooEp#v$zmkoQ>bY#90azfJhB8D7s;&%o5^U+Zvx z?eB;GoS*(R!+*hrcxLw7aUMwmkFfkXsUmQ(521Wr^bOA=VdhbWiXj^LMH^|lz=p?`=MxHSiR;VaNygBUA>}(0zp{Bqk0u!bN9;CsW|ueD&3>3XcMH_VS0 zvII%HbXw|V3ZtGdeZRHXdK_GYP71i~pX956eNpKKhh}Cb)p3!~7`R&k8Tv@vIO`SL z9MaKZDZRf~r`-A5)cSg6;3)4Qn}7rndwvb zhfM6%BX0{^RqQOhGrIe!C;s(Aa)XIMhjZk){{A`PI}ec&x+zgah4N$vNyqh zjppHoyR(FTd|CRw{5)Um)@J|{-H$@9Mx#9nr#E3G{xxR_wiTgg~nrCqXLfszSct zU{41tX$+p3Ia$DI(ewOLmoUqxb(2wN5pxyLG}PAckv8J1;T%z8-Pd+!gdDmN4Tjz8 z@2x+mhe12cTm&Z5K1&u|x0&bA>woSwnD|b%kowz%Z$)3__`BOz`J?i7!qCqev|L+Z zJ5Usp_K-z-LZ?mT{qa33hjdQ3NkC9-vj5Wx2=wK%OSrb}eIFqyrwiP)!ZQ~ehapth zm{sdU#b@wCUbP3L7JE=ga9-^g9r`2dqq!{!kIU0rn-T-?3o>_ndc=J&2(okJ++5)A z*N2N}Xqi&DekHC^^2(7YrZ?5P;kyC$(bbs`%>`84jn3e_{7PS{5I)u;E=g*J`g17A z5AIuWYk3P|vOQW8&pw^rs_x zZkcx)D+P7rx?8Bzus`lp=efJi>T%EFG zux?0@*K>)2&%UfYm=1P6%anoM27k}?x0RxQkbsy=zE$gECU3UypTcHM6^v*`TYs9S zFi)kYj9h(r$T%oOC_ik|{DGy#4=fk4H2n2tCzcQuOo9Y4}5exM?!O6p(< z-_=KK+QkmN)}Vo|9`xRJ)@dw$46tE0(RSC$+qkb?Qrd98bDxv%N)=0Vv8W%gB2ji)v3NSQP=Rq;v|^i~i3%4k19Z zJsQ=y|AL&ESLFO~@=E{0C;lZT0ZDFT(M!tgJ@O!j+d*5#yLl?s-m8Z%lIBYetijYO z&Gx`10>vh9dF^|9Rv7Q+wKQ`oO_DCrZ6d>DvHj_5UhW3e#~&ibDo4>_C!sLo$kb76 zqhq$1nrDv_MtY0Fo*2_>WW1v)kFps1>(9a4g|^ zUu^F{9>;g&prj5HQYv?5b2o0QB`iiN=b)Z+R60XZ|kIKV)Ze;2emveR;q6oB8OUTKplDhpZ5zFN;=0B0SpjiHewOl%7GTt64v3|-$q!@% zkk6}%XogzP8Mr&()w*7r%&7W8mOn1h^n6*0jBjq+(FG(7x+iLm~9qrcYA~)w!|J=i@EQIQ?2GIS&k*(-;Oo>_?3DG z=@L8mmfLcaWd+NXqk;Fe)$smLP5!OzQ0=X4qVs}xVGK{Y59J%`(&vO8Kf#Ba)mK5A z@bv{~N&`wZ-`@A(EEJ_7uFsrb_Fa3^-G8@D{LyyU_d0|7w)(a0koEQLO^1IS{uX`u3BJRU zxfSj95Bi6)$$~CY_c-;s;Veb+5S22=O`lIov2zJbT{uz`qPm<2dHM*|Yi3jXKxu-^ z9Ez;Cl~aK0fNEacRWHg1MT@!8P4WTd)y&7WZ@wg`^0ckm{24D0^6rn7`&nEDCI--A_RMpDCdd)RcW~^u;aAzXYXO zlk5*9P~sor@#d)1MrP&_+oGtET>u#o+wq&=QU<89yr82ulgu`f^3x8S@IWL!E_jAN zjP5^-^(t5AW%R=Qn`X}W*P1!5l9?5uxRarSjWr>Uqq*r{K23AJ3g>@gHj3#rpujl9 ze<@nNg_7U5KaujauW)|=anuZ^iciAvDrQKZjLKgs{1L|hX=QQ5a$Pko?+SyKaZQO) zRw}qe&uM(nofhv&Lq3B>PcpDT!0oIzcH$&0oz#u3i16zpCF4cw*fPztDlzm$SF^q_q>m?IM)KFEK#lzPv2)eQMHAM2 zmlT1L2<00XclUQ$5dNQ)K5JCMAOPU_@50an$FXX^v0nBFfPUq3hnUO3YJ-ypRr%N$ za3)J)d4!&*&8xVDz3MIm6|9u6cf-fUfm8fQzS-&&Y*6L#(FS+=vEL_B8#P8Y5vUS` zyA#`JM|Wyo>u>bBhU_oQZEWLYZK&sHW@G(t!sS01{te;(tKs{_ULPSZU1il^172H( zA#cY5!=XeXiG*Z5kfrsOMB=#1BWbVh38414UYf=&B69P85^{yt5QFIlBE{^|<@oCv zVrtS%3l*Vr{P1QQJNQ-|cq{VW+5;3E+7NFCwAzx!%A~M_!McPjW&d0gU>R+Xg+SpA z9b3H)EK_6I?tcZRlHO@&j>%rW^(AIWEySsY4D!V|R%bO1*cmi+W!Iam>ZI-HW03vz}`V~nuw(mQ07K4S_yx@>UtfoGMNp9LxH@%MN0)) z5IU*xgXg$cv^+u%A(01Q1ZY(UB73F1D5;}Pq=bWeA4hL`T0r}E{CcC5e@2JKzQpD# z^WCaxuF@iMaPjGCrRAf+G9<@7z9b&!vACCZOW*{}fw1~s+b@}=A3B4BpCvHU@t$K) zL43H8(ZhLk(go>Co>FTK7jPQ*`B(NIdM{hc1E0*!J-k&ncVU)1-q#6vUrwUEW;8tw zPv_2PhQ;n;5;E%z@RiZ%97Wt&#&%5?cD8Ye-R4^GgTpin`wu&JbVoiCeS7O@oIwXi zLR{9aK_9NrbbFP>q6I56tuz~sXt}Vw(-9G6{0^xzwo6R;l0eu9_4(+BK^3~bwMved zb!hbWHxF8!zDS!_(rGatz{qmK)-b6P1!KN=H&SO-yf4mZt0!LoNd%AnS4#N@q<&G# z-!4mN3h{)>msOF2WF6yXMo|SrI+qr{L8Q{4XcTb1EGj&m@Ufgr%fUMyZtl9B1NR8b zryQ!a>L8T{ix#xa`ZD*r#EAQdlk4lcCYhOY@**1|zK!o!uL6{yn#*L$4VxmgbRf#M z`In`N0!E}N=VU~_|hnK7gll)OaTnv@Ii+TA|rjx57k$c*yT58C2Fzf(k zC>(YEH*#Fz@E>vI+Q{YDww^~bt7KVGF9rYr%+G&jzNyzTap_y;b5s0E(84=VT@}m8 zH~W2u-|Ox);x#Q1zU8Li?MqbqcwG`yTN8c#33##W#PhGO)4wwx_*=yp1p0M`^ldc& z0P*@80QA3x0BFhA&p+p3yI#kCG~xpgSpGhb^mesB)A5P#Gb;0Oww{&Af7_*p6Olk!d#o zeXrzF#89)hU=PZ0gV*(4vA9w;5}@O(1jK^RlLeEIj3xM)%VHO&0k4w8Yjp#LEW@Uy zz|2)dJ^DS1FP#1+Fr--bNXd9zWC4@g8blyEvqEK<;o#AYf1wRM7$G>-1pbpsw$0A` zh=YCrRn>gg##Gdt_9CP2X<;}|K+d5TU=<=GG7VSuZPxrwbzAmsE>| zWDTFTJSW*P6fyqP1Hg1LxF9PO+}3C%cH^c`8)Qqw)rxe>r*nwNbH*!rpF(8ORT?}= z9{a zpHzS`Pdb~2)UVNN8{YKt0*3M`w;vJry97%%W}GyY_bC0+(V~rZe(_u&e6?RcOVVu+5V3astm`HpxLo)}T*mCjj5aXMb3M+y{}jkZh`<!e-3Gv$f1YKdwIxpO3}LCU;+)vUu;sqx3T=bQ{c*GYRVn zWI^09Zr3w?{Sg&Rp-6?rI!62Bxiq*G*HvwUX}ud&MKj!uetaGZtS|CAYhvuY>w|Iu zJuWVW#7%Fu<3{#3Z8l$%q!$9d_ZvST2E&mL%v6quP{TIhTT34`XqKe=7UD)#y=<*P zOCMCRSiH~)ZZ-!`9uo&b#n~s#%P78liD4%tXz_WWb5&)s*WXXleexzVc^-b2Cpu!p z&l=#rLtfb!wE~cLyeEe@IT{1*AY?VqN?t&MiD|0!p7cVjv9yoiBB;Sz%&xE z)}O94x_N$wx!YsqaaW9<>yB1X#@e2qh8|Angf_`EMsZO@r%#q7YwO9MYfOl$5h$w&prb`{Gx_T zbEbKaRmlF3OQhYOko;zl?sH(dr8H>5@#siu! z={#QL5U3Jl;faz@Cr|Th(^;3I8;6t6g3=PCDRVHTy#2@dheMS<{fwX=PYSE$(M-3ggV$t5#bkF;eX?RLj6 zhe{NVYPvoR=fc8r4er^Lz9EaxIz}uY<|*kBX^BQ=Dc1ybyff+oHBw_G-Zu*2!-X== zq~|$^13S^<16=in?|r18xS4W7e&jwt0O=`amr>AI09uAIJ4UZ;V^e3yLdcbnMWCN) zDEgkd5WGS}(}{B%rnT77U>h;0NTMuN#~Mr~-*2z2-gU0Cs%MI+XMdoxH9d19_2fw% ztlrhy*mWY}<}gSPe&UDvj5rF*TxIsRtpGLje;K|0EGhm2EB}|>SFc&~9}uWA4s`Or zB5=wK;l(YxOP4_w>?)6TkU@v@__Je&NI`li**y8MQj{I2H^vk#)D7)`2N}ApStB*% z9gn2=w19MY;L_HV47K}yQ%`U40PlH^TrX==Oy3Dy4L1%2e!@F3}34)WFXF4`4;AW&0vPm#(nLd9|rG!V7Ve-&^Nt$_5 z;yB*`K4~xgj~(WC>|o+BR)``Y#$=D2GeqCqD-|`?m2aW?>;>NyxRrWlV}UbAg_L_U z7KQ6_H-Rn6ELlFJ# z>6Xn&A3{lCr*`4)?@v`NZTOKYb9g-b8!X{uo0AV0R;~JFG%ACTOe4$aJ(@^2&r~E- zhzKjC@1!o)Syg$;2HxbZE>!Ue)EoydzKSneTDwckk=ZBJ5{N}jlzCJ_7wsQ1o*&06 zHxssml3;#50S!k@`Omc4C{%vJ{CMIZx8Kn{d(tJl@O@deC?xVyv~N&+YrQluXnQ9y z7xReOd^MGy4`BXM%Q!o)e zMK4`$jF%`*c<_KzYGfqE3rx+g121|NO3tR3f;^+nBhSO=IPTaGD@n;r73b>q>3)fS zb7z7_8!Q1IHI}Kpv1cjddnF4qvC@$~|LzoW_UvhEDw#*t(?lF{% zUFt)5>DtnR2hB!7GZ9ahQ#jMCc~S%j+h!km2}}+)TrRES5sN#sk<600lptd>Ia#{5xVc#hPyTuwC;g_EK zN-o+CB+ZA)7*g7*#7>PyUoVNb74y+;QuOEdlSVT~@=MF_f)4)ryIA~!{s1wpS$wd5 zt_rwOj)K`)2zL+i#L{FOyki#_HkZo!LJ`%S!Z!H&)TB5IGfZiHnRlcd@WY?zy^pWt zO>(W&5@N(@tCg=auzZQ^^$d5a`2U7Gf`5yAfATc}OItbzqkrm{{Aa{5SmOP!h%2pm z?djG76&Tb*J<=Ns1vV7-FJKBOTH_`l(U}$USTBKLXfv448H{m5pmfx$&%I`ra1OgDOff{M=@z_4x{W;a zrPNU6Rx2aZPD|d?8_N}N8JJjC9pikc2;%wX&>-vn^zwmDHx<1jkEJuMRfoy4#uV&Y zJDpC3XRC_Tkww}H*aj)W$KTENu(JS-&$xQQ;LtTf5@fHrw+WPV`w*$>(cUjsd2gN4 zLoJ78zlixe5Q2jQKGj_GqUZr&~t9O!kez9}~ z-`zWUwqw_wbm&-E><=kvF)44}_X&E(ZJUK*xpg&nx_rFG8@mlR77H2eMVBUqJ>-!2 zKpvYwlN*E^tPq=j(yPtAE`X^{EpS(jLiGy%vIlxLB(<7&{Ndo%Da>IxvP$c3i2L_Q z_ZxA)Bi(<^uu2S;(Els$W-Ab0M9;J1h?s^M%o96@;(_HJCQ?c;BGX6hWT^nff;;a? z@uiJs`I%}&ekM=jJ)Mx&eiQ@L`xblY=sGs%FxG$V9cm0zlRois9j%}vOgt(F{V@F% zVx=Q9)&1iSRJ9>E?NI2vUqQ2TDL%Z5&QRe9 zfbsZ9pbKvlU}1P)BdvWs1O&!JM-<<`($|6LL7$GkI#@EAI2rhyuz)!jWEL7fX^~s> z^)L_Hew_zz64!~!g407(Ybe2?6mQ;lI8(EKnc;HL(kA7`Do9>_aNb)b0>Fme4RtBp ztmQ{RMsS;PW*fIXZ_nE*OYWbkUFs6yVSsg580cXBBLoQdNu^bmP}xYZF4oCq4_2-H z)78gIBJ~VQTq!83!Z5>qQTucOzMnijLcBbY3zrX6gKXE6eFXz%k5j3E+$R-q)gic( z1{pG3Htiv%8Nx^$pk_GdirWps$Dp&A^CBmWi7e6qx|-^YlhMR&#SRs%7x`afI9kOK)JKTGHNy}I zQ85yb4I(4NK`FQUX3_tKyZn0Gq!QDpr{>m-0v)aNA z#ISSNmO|FRt4(YQ(U%9yQttiaFU6=GP7!9)?=AAb%+jZdq$zU8g*Nu)LdN8y z3E&}^QhvRha2-ndKqv-tH9E2@X#7kiuiJHBlEGafvHCc(%rZUWmAXb7Km^>rV}e6$ zgimHmjBWmr+74Ygm=nD7)1w(i`7|I;WJvV4hO%HkvQfsDFdUlTltpyFu$MHwY7P`IwS;ix9{bOIoRYlROVp48A zULH34~?#iu28Dl57J9 zc*@XpT)1|w45AbDO^Ow!kqmit;n!#~CC-;>kNx{7Jx~b?Dvw|W+m7{_y9!kV{kCx7 z(pu%~C`IyU2{$UACbdF;Y=s^)g=!6zFY!I9@v8SZQ;dptoZwB`{TQCAUxe*%vpnYs zo$xz|+Mt4{sKdETA8eLq^-%=`S)nC_hdc!QM&R4_xIdM(an=rPGsl@O!IqhCGQy?M zSSn8TfeL-^E0=fQFEUOWL|H-*NMjq)q)-_sMj7@$!tWHtsqm*UAK^;z!1)N9)6rzT znCf!)ESN`xNt_Y9lP^e1{a~SsH?5?6op%#17Au)pOO@{F3N&P=2~uf%ZAk9<*v0#! z9T%Fb%krEfccn+^TUOL!GS$2xekTPZsnS7u%YmHZ+13(ib!M(gvlY?Tty!KCBcG4^ z+6FOc4{$4Z;I~2;{_3Ac+&^O3ildn0Z#L59%fr*SK}}QI?ZpIrYFHLr1Cpj1;y*Bl z$4Z%zmBZtW9OtNG&8S9vnxtoh7U`*o0-ZsaQj^_ajGid1p!Galv}OE8sk%4EV!4+tfWqnAVwY)}k-HZe=2aEXxX@#j;hv{^isF^%rtwzEwj$Zl_bh}$i2 zdG}|Y3DT3Rv}XJfxD`4(g^Lo>#ZM2z?Ish32H4%$ckP*%Gb${lY-h=SJlf|LUXpPq z&sA*YQ1R$11&r$-NO!C2n?Ce&t>{S##1r6Kl8?%egs7vpHxEGMKMMGT@=IE&Y&uN| z;`e)CE;5X^%7@)hWrX-@&M@l;^Ys7+d(ka0r&8z*aN#tZU98VdE}M6FeO(-C;C7-wCN7A1x)VUsV5DlKl3eg=KhnA ze6)b@V!(_@o=fp?8NY6W$9YKO8hwmGWlcTKmUpY_nVNL|5n`Sv*fPIr@56A|lXUj9 z-^-ASb=tL%auvJ7&{zDgUnx!U9>3uF*Z;Va2OBbIfjGZ(Do(NzLBM(vJvOm8hc$q1 znh@{VBY+!nFxhWDcho+V={bzW5z{P_TD$H98hKLcNgbX+OH;isW#)XXm-b~?dM-?; zX0^A5til9IpJ%Ig9kc@pP0tODlJ+d?38;+XHw|3j4z)9$+x-@?9qJ#w)9Kn>E>rxF!8j?ss6*3{KG&?~3rz774N0ov7jAe*<6AsL=$r%t_cyOj( zjHW01=6Qe~au@LXlH=)hhR}$|s5$Sv!_(0Q|C3n%;iGM;IVwNK!Z6G6Nh?GDaJnNH`vUvKqhWMPG=|+W=(*ZG&b@rgv5Pis7A!H*x{_6 zNAlZsF#r7zJGU$bU6}hF zP_6}}YHvI)qohGDh9lG!&yxEOEMNDh3I17-SbHr_$N|6rxVyWgx~rdiRaRT`CkPFD z*#x_Ev|p8e!Z*3!&^5PzzX%h&R;x)J(mEe(<;(QN>-4XJgo57Q42Uk=N_uwO!*+v6aY%tdR&{G1=*^xSf?Xc(}SiQdZlj;}Aki|*N6rGK!{lx4N7pG`;9 z78vi_^*$a2KG^@gQ1M!vc>9Zg6({5Y*5$9oiE1+pTJMjmW)EyK zFtT6!)5fG5q%B#&YXddBe>#ne(OK8tMQdRTf|YEYwJ@w!-yqj-xhtN2E4o)vS*0wo zI5?^8-G{Fe(B=6#rto6U08x0hANCXbMj~U!3a^=pZ^KIS$0IT!aUS(lFub=e!K~cl zGB`{HfuF+29Qz>lchn5rPQ-`ANZZT_URz#R|_#W zfgA1o43^^1=5+oom};5~AxucaB$o)yjxL)6c!r~nl*dOn4O|gE-3=sBq4J8kue73V z_y?SPXP8tBuy)fNN+W;5&*4N3x@dy%V`-3qN4zU#zX32Fn2zCri03$~6(pr5WxL22 zyYg>lE^+fN$Uo~!1dy_lvUoU!AO}4hVAZ`jU1bUdna4L<+Q}m^huqqdFx$AR5y90pWYv{pm_C6J`kn)f}(aNf(v|mvZbc;%aH;s|w zMVr?aCCoY@1D;fjsOCQ?%QGAkk-@BW>YJlepI?|spMFA*m9hQA#A8K3EdcBr;##4^ z`CSM4$&z8N*&)`XB7V1_8rV0RNUg%xg~&Ixlvh9|mW}P-TN||hx;TL=01bEt2K)xJSDyFJEyHhHTK@b;O0Qz_Z*LkQ zLAVErE$qEGa_uoR`zrsFwDInqqXLP3Nz&N1w3%ItWA|%VtDQ))dXon=xuhRsNsN)S z$fe@*cGQ@+qRuljEZemY}>Z&if!Ar zZCf|>?){$Lw|k${w{M>h&y)Xet*qzMSQBH;Ip*i*h5-7sOx=CHJHnip&c1j{RMc*| zxt8zD?T;fOsA=*3d@d7?R2ds}{R-!P3u_y$<)(+ zS1x1qqB6OXen;L;zFd$6J`jidl5(zx9)nOhN}6;ROn-rEMbM|5JDCs;-fFl{f4|m# zza&Nzt=W0iAg98mQiT9KSD=J9XaZjc9NYkw>_OWw<%?sBf<7JbsN#5yuwTn+%)?_q zz+3LslM@6~Eml4)XYDAyLk0N&$X;-O@Z%~tZiFQLQCpL&yscMC7qG&2MG*r9c?RC5FT_NoZbEOd z7}+TM>ACo0J7pXA;G)^N^`};_m?T4Qg}@Q9e&qmy1%pnLJux}k&tj0!Lr$DS{0@ta zK`ae}ViHOV4PcRjDM|{BOlxEK}gW+T269G}qAE6QR$!j}B zb2I+se_Q1yMv$LnY5U(HDZv0i09Qoe00F`IaI#b^u25sJ0S+5do-_E&e_cc{O*^S*BWX{q_!RNvAAe2R&m z-htnR3%ny6L{k>?UFMrw_4#uml3jA+ZA?Dy^8*5`kMRo21=mpr7=$Q4>)~)bj zx|2>6TE$^F-9SPB;KKt1!BBSFJE0fd(^fMzEF_mHAIgcDUK6$*qg)cz-=-D0Ktr5} zF2;pAIUQ*`YQ1T^;QE>~uN`(S-1k6f(4#4eE9LK<8QwpR^P&*dj%mmbH^ao(PXr0ad?{SNHw}RGEGVIjV0csJDyB*hT^V%ceIt zRNSJeI)voPYTQ+wKN5Z}5>2RpfHa4rC>Bg|=)Q=`V=+B~^O%U|#12Pv4jiY!_|+rD zT0gA%roCj$1f^W(CybR$sb1sL!QC%*iDR%IUV&C(4!kfavm&3sG<-Du-h)Di%^ola zJbWlxAC}KsS&+A6U{w30FwJ=3lj!%R8ro&M*~v}FhmupeU&pS!xK2e9*iv-z-p%&|BlO3Ni{< z#ye~*!c$$nsv#MSpe0cF7d|1Rh+Ly2;;FeLbXRfki6GnVl~L>xIBWt%TWwoZ3TKKa z2D}Q+p9|)o_P&c+b|!+=@La?UExW2sycg48Hgq6UIl7riXR8xtN5M@TNB8BwJ)rXL zhx=QpmJYIq!!Hmt;g-wrLcY0-OZ6skUqyC*I1`pp9rDU@AAYyWaQ%G|p@>KTk?8zRCSNUT3b@?_gf!%}a5-|%pD$FFIed^TF3D=x6U@kl`&0{i6db;S zGOxTBGr>A67h*IARG!&cUBL?9cVXpRLuQ;WSqzW7T(G{iNYiW44}rAmf{5##Z0_-t zj9JeFB(#_Qu31{Nw@^~>romR$^K``Q?Giz9;$6AaeyQaUpz1yj&+JN(tZ*yKCt3T* z2>gzATDTBHD~^tyi_csl5K0q%BB8IQH{R(G`q^TSi7rfeS;Yt$k;MiOVJ!9}*3!Kb zE^+C`E*yNYOglMSzRg%17WpzjOF7oBjJwj|n#zW<=0+CQK)tNS1&&IUCDwRAphTUx z`B@0Nin8X7R#Xy(beW;t>`Zu218YC%RKAK6&OI&!|5dZ?akC1*`_feVtw3x-0#341 zjB~@2^eiFo!6<(-y+0t;Gc!L)*;~SNh2IRNpMW4}9JWZDcC>=g0+9{#5RHF`EC_$c zb-=n%#@SIzFSdmLk1Pe`PvbDuADuD9FIaq8CZMmz;lCYU_g{^}f0?E~cmJ5Czazy# zD!5M%2M~MsINVQBE!Sb67d0^;xvp*0c}e-~6mt;+AqkXmWV>aj#72})4@LisJ!D81 zZXptXFhdRisTvN{il=3Xhg4Dj$tNF6A2?}SD;xD{q_IBqNCXEqA01(o7JCIPs{RWT zr`R!wpGmAyB+VpU5^nnPupe|(zG&>GoC@cga%^+6(P8dwR9Ns zwq$8GHjngFsn#q9zTAEjl$2^N*sxb{qBK0yOYFZQpeQ0T=ZEV|4pfJvIWEa3F3&my zs^#!gFO9;t+T3h`%BWS<#tr~b1_>;=C{%W&KIARnPcq|gLwg%NW%#zo+5;uUT*r;%_W&+O@JV6AkMCf~MfiZyOZ8eic{7$4bKEQ&XAgTp&uB4a2Z1#f}j9p|$?QWyCy*5WYkYVB3x+X{7r;Hnyn^QDp8rwT8h&NwbTjrsK6 zEaJ6<0rgHIIs2IL0Q!3$_p8sHA!FOp$M>f#%n?9ih`DB`84Q)iq^C$^7H)aTJ`F>P zv}I)^VJ@#=d6`-qr>CqIs{s&xnTkW>4{CZ}BfV9ile8v4Q4slj(`X>my*H7PkFto< zkEwL0C8BW92R$nqk*7o1;2}vj5?Y0CSJn)n{PstOf5%0C9E&W# z&d!%(X)T1hT_-HUx_7&?kX$4 zH5-bDGMhuc8t1nf(#5F!oZ&aXeB0#~y9-*1C~<2lPA%@R0iYLSrqRwq1Zh$!C)XnU zK|$JGPm`QbtisW+H>E4&4J4j5O!(dK0^V9$dGM%sqO*BZB`2IuJCOscqj2EZe^x0$ z(!5k>{y5)C92N{#MGHpoeU1I3+xOBvWA>M0zv*kqy6pNAw^L`Kgml696?;DHJ}co0 zxRoiCmAiqAxty$N#l|;$g_{Mh4WnD)l1~Df0wQM1$1Tv0l4W6Sg}!p%F;y5`COp-2dSu zI;QNW`q;6%J0D64)FqJ|XxZP{o+SWr3O^nM-TrYe@`mFn_sj&5xvuDZt>h5M+Jq0B zw>yK0pY=geGt_2YoS|9#V1**kn%x*9v&leIHl25@sk>?4=^-VBlYU?PqcdLucKd&J zEPr6}pF5U6cmFt+zi9>_Xt;M=tEBdNZTpzWi*MDPv>qaf*%Z+5&$Ple-$$*C@jtJT zC5^{ehlb!T9Ys(paZ{Fk)j7)n=IHh3w))wAcN|%3HY8Rb*Xek)3&@}Xc*B%pogGf~ zt5Vj5`T^;q=#8M+j{np)7H@=on~W4Wi*OoNB^(55Te)E61dX{u%x3na!6>e{Y~7N1 z!!L+%m{M`D*~OOw{COKN5Mc?MUMX=hd`MQm9fD)wqV7CZY}9hSgg42poXXThvVYMD zhjwOhhzWytpFvjNJ)UQ*C{W_`1iX8+dG zmU*uBqPLj0CI2YhB_F|WESrQf{AVD_7)oy3i7t@hxSisr_bXjnlnf{!DG8XeNAdD~ zz_65pYn43o$J~wlFu1YamLb@I7-!6y{TcD7bfND-M@ zbL!|}6#qJGLc7lLfXe8|{VY+KlK2%o_d+LnU)i-9rl+gd91o)gNS@*xYRHlOLN4gB zpaes`n@5jkzgMO~C-|o1QZf79c~h7K@`($Dly&v-N#V>m|8Ty#DufB@+L_!Ah4n_t z_P!Iyp{ooA_$HgBkE<`)!IccyxelF1JW_X}fd-FnRCtRk5r`CuDDbFebl(XgNvBuC zm`|+c+*=4CJT;UcnBDZ>v zD_!((l8<`8$bI#7mwC!^0!NWB;AaOjQ#d7sbDPw@P;c!Pbsl5*P+pKWj=T84`#itT zInEVBjC@m0Ql4H&_E~SbtrUoZ&#Pq@A#RG@cPA|VqV?f@=u&# zG_dYB!aCcUbe>19K&^o`f6haNdLl)EzAj~^ux^z=>h+k<@B=Aw%FeT8uN-z z7!3bW+LbvA>hb?}EPs)LSL&#>440M4;|j5K@^-h z(RT+M#3;!FQeXpnM<|K&r3aoIePQgB#2aO#`LWU>K%o>+u$SCy`pq_UxFUTkon78# z40&V6OHkj1J%B~8UTZ`@T{ z&tbOvZe7bQMOPH%gaMe5E#4d&4vV%s3URsmD9>2D88t;xoJ>o#(w~yRFg=w%=hc%Q z9a0Q$GlmS^6f=;>^it9|P5EE?L1;j*$~?TP1#v8B=u-3lnEp_$H!>Q3XHbm7i#;X} zI6^Vzdfk{XiCcui7|58jeZC_jOdZ+Mt~DNTwkTHdaOSg3{>^H<*cwFeTK}B9S^tz` zXqp%HltzZpD#1zJVxJGV3k{UuHn?c=;h@|@+^;CikF2PWZ9jUt&cb^QS5~vrFr3JX z$8{$>3FcA0T4h*b*p7*E=}D}L5L#N{#gf_S_l_%n2r998aOmD#1uuI_3r^XLwPT9s zn=s&aoW~e{qk}I}LE#>PtYyJO3_78B7#Ewx9^CK~WiEQN+(rJPX2!&IK>E;UF4By5 zen40KY&@Pz;-7VuKSQ#AWi0=o@cx=;_&Z|>3WobMip+j7dUa}drEykbq&k(hcJ9$h zF$RfA@O=Fiu_8F~J*3_mV_IEBVi@xP>4S(bNtf|AbD%DhJP7-${S`gp$CmsYz)k;! z$i8CHOocQ9swkf6PN3+Ot3vONSo)9sU^|ODzcD(AIvl)}_X55Sn`XwIOJLfXDyi1P zRg!C8rzo!@L7|J~6`&*?`Ee=gqXl@uly0s2i=UKPkNQzhnv-!5LAy^A8ituijV!x(*CLQNQatDkr=p;7MZss;o9YfMMLTZ>5r4 z!tRJ*+0hP60pf3QW4)rMD=Ej5>97nmI0yU?+6 zF?5aBOo5rK45%A>*+{!Got6GeY@t)-f=j$gV^|qtRwYYw_#4x1ydm5Lk;S#<@y%8s zGkjjPIVNT_(O|KkpN=YBP63FYHPKe5@86b#76U7i@f(iz)BNjc4~R%9>_luC007G0 z`hpz*0LVRm^aXQq%j~NlLi2P{hy$B0G0aO=s5QQ-5qN(}5^L5BMifs0J9l10yz=%& zxmZP+mS30uDxml)OZXS#wx}>P0r)E6{9D=RzwZ6>OJ5&I?$7bh^oGv0B=J{}ojaAm=LdQnS%vauRCo}H zVMwgOC9APZoWhGPH-62jOnDf6X48yn^=pFiTHdjxUgzT@pHkl7l$z;*_d*(F zY_2}9--MAtb*+j(BT@y_w4-W8{Wi@Vn=7RwdI&BAJEkb14d+ffow`ExG=#x7E3oxti`#*`({@{ zhL@w^bK+;>fRBq4vEs-EYa6sCqglsQ`82MD6sv&{ z+gT7Ol=_s?;)cqBxyk6`iw+hZ;}Op0ZOmYA)QY>ATO5B!a&zcP_<84CLmEj8M6J2U zn=7Ns*>-IiyRq?b{fLIFm2-0$?ig7UR{93DGy9hMJvnRoc^$`dFp0E1!zk4md#G|hzWB!y)AQ8ua z0sbnU{3jC9f4@om#c-bj!w8Z$YikbB@SuA*T{&^+GgiE~7A6c6N5ZxW%R-~0qh#HO z$&fq`773v5$hh!%KNI)cZJ>{3HX!_zuIYZ=$2=ba6LCY(dZd6*wD4!Y*Ld=Af0}JV zp{8H3gDL<}s$>J+V1@DE0ctKcwttrl#N(?{ynJXhubfm$hhB4$JTPN)x4ALCPV; zI2m;H;+qa(3i)pjm(X!4*K6&x)c+l=`HhX)3t3uv@t$urag6{F4} z{~tnyBJqip!cp-+q9-xdX%h&7cw;eAQn$rP!#1w-u)|j1s^Jz0!Jk>TBds%kS8yK~u<%yJTHwXLF*HS?{B4ozaQ|l{T3PDa@#)%H7}{IW=)3;^L8ICK5gJ`b;XdeF?bSbZ1V}G3 zIlJIWUn53xoA$11jvYFa1LVlHfJQcnzp)SD*B*8#AQwmk_bShA=NAJag7jn+xVH&s z?k`-v?y7%!dUZ{K4$z zH&==5bNZ131nc@dqv9OB=wsmZ;^RXK{*xkRvUT(wFE@oXT9lqsih_by^BQ=iVdOjV zmeSGQUBdixnzj(_nKQ+Cr#YT=YT%h5*`qbHyLFt0AfgSpECm%%5~ag20vx=okV$2s zqYreu1(69Kxs%pqfoHL!ukn#qK(2vGQ8rc|0;d?2Fg9~}cvZ3%%f7ADXX3}p<`7Uq zQq>lZOwndJZY6rmjpuO;g1`&(DYG8x5? z9Tw9u1Om@2WZL#PCX#rW+*P`yW!I%K*3OtvL9@@mpabW!H2hnkn}en4Xom#*x4nDHwz zZWS-2T*)`jmULU*f!wvOA#J>uqdG(EW;qGmTO-?s|85=NKhTK(Z_)Vg`&9owTgNYv z&;JAKn1BoSX@;DDpw(7(dyh{R3!n>DW#_sjMjCEP)-wGB7r5x-H7^64&b74@*5D{? z{Yc(sriQa;6Lp;KzgN8Ef;QRs+lBMHYfGhYlA8 z(5?4vU$DqB?h*P^hGiq>{hkcAs$w!;jYd|zgmyQc?xa(5ag^mCN0;RZIFBM+wbDs4 z2M|5}WbxB5fZ6*Lvh3IVK+E+_X7ldA?|2Xw;KuqG{TYTIi*PwWj`Hr*sHr?`i4`|J z_3x6lI`AaIi+4AJb*~26th0~R8P>w(T$(3^mj*XLjeNB0Jl;SAU2_WBh0Ub}LfBn- z4D%>;AuD`LU?qbc@Sf*AfbS^)W<$XX3?3S9kRdGZDRX{#2-=_h1kbigv^n3` z1qIEO7$Qqt&n=kfCYXK0E^l>F4#oZbO?1Vg>$_>x$`r!)NzZ=lnNZi14cV!I0l67v zjjAJe;+@NL7C0!5k8A4L`N2W&q3_4gt!!`dnt{;BH;ju*7=&7aLvKy|W-l4jpRpFr z$(|J@P%gJ#@VYu1rt$Mqcb6wMu`6gCo5m+^NNZ<#@}18M#GP_ukZL57_w!F#PWMDY z1IPr_^e-Tq{drT@2vXv+%fZ-U;3_lw>3`14VB8AP8%+vAdl18NQWR(LOXjT5&t6Sy z((rFQ{-IF6+-vbybXQ0m^V@kH@lv?RBIB&mNh!^;3N+9qmBVz3GrDvge5=2g2%8@W z3{`<_kRffO5q4$FMB%PT|L(YdUR~_Gb*^X5wiLuJ#)2jtB#rP*pbfP_0D?5X5M1pW(*)3Tv!gV$yC1>7NlY{+8q@@ zczYqveKYUA)_RmGWH)=l9?t-hD&y^aN=xYOV?FF><1 z99Fm`!LCAPi>ru!#EM%%34=UjQ;L0zt7n`^$+cZnW<5|QKxSN-h$b-ATW`r^mm+qY zk+mBsmxzST*n5CmoyS7_etUSG{yZi_!kzmE0jgHG^=3L5wDz1^K8o3JXTns3*!0UL zE!cj?6%!oW`_oVJ&Dj<>#!)8yhfEQ-hWnv`b7fjN*G-&7c&DKq(VM2Lly#?^UjE-o z_;7*uPw&9uBTrJTWuo>?elROt*m+I_y>2m#r&k4VZ30?>iEF`LR@`?8I|i zG;@Q>cGGyBrw8)KS_e=o6oD%(t7+js-M-@*K%;O~Idmf%ETIdVuBC&8u|*yBYGk;= zaG{t)Hw47?E7OGlAo;I?vEnag6%-O$lo`~ZMvLat6*Vd#BPg)8n`YoMwV?zkN zKxr6GvgFTw)-*^tD*km-jS1-xMqP_F zoJ-@Phd&mtAL?%MvUl2Um;^Ixxz(B?jvIeUkKT*t)q7^2*G&3Jp<(1ftQ*lC`y{D% zCoI_Q1d4Z*0)2;Z2IIlMs@_Q=V_`S?x$W%c!5_4GC+2X4=1+9HyCJnOD2RQ=%|AZL zD=|OHMFx?`lIopntQ9&FQGd{c29SidlR)j@X-C!UdtPc zpUk5W!N-QSOQ8xL{iY78AxSwZRdM6^wD|)$Tu-U!(UH7LvpiQjueaLMY($4rPev`< z`TJly_UT|7F1bmzT~|e{(T4TL_m&rZZcqN(w-PH74?>J5cOm zg~Y+2f+ptLC=^i*mSxowkY@KMsre@njSq$=Ti!_V8^Hj6es^4fJM#mZUY_vKK)4VH zqTuY_RKe817sy@@K)%sTI3GBJ+P-{cxf|{vw`yhC-?Ce|re7_x3&7#LEh{3$l zr}q2Ll3W|cMBc%lpX5@vMQ$vQ!*M;YoCgq90?Gb4!0yCDM%8Y5ZtY^kxuQK?W#3J~ zu{%%HNK$~@MC8k`(7(%C_+INSRld@*W7V}HXSV5TxR?J%9zLc@7C541ojPX+&kv9? zIE7o}WulISVUC7sS7=@zFfM-r3r9)-(IJTmu`_4u+Qk4w-&R`rM32XJrD2m(|9 z)aDnmxeSY4%0YDRBTB}4Z=1zEb#f1Av!uZ~O(gE38iU9%(Z_?1=jKnytnyb(kV`#k z4)}Gw6tV@W{dlCIv(Jm+coXK>Z;6lts__<&J!>r*HEWeEjxTtDx3g^S6eymooBtZ; z2*zkir8&p4j~_l?(B#;rRt)i6oyo;+KgP_fS6)6#`@*Z087P7xbVFD`R5*~E-O)WH zn!NKrIio*R!{+c2Rta`kZ5gN_?vObokbUh8v%9ihYdMYS&Me=f&r*W5a+rr|8qA5I zB!Y-IS}10m5j(QRXqB5fkK*sM{&O0133F+^;Qo`GG{iFzh$o$K&b+7vUi`b`2LfrK z^vXL2-DqFMTS~~xZ>F@z zIjD8aG_UuFL{IKbY`;Fj=1jf9k)Jc7vFp()j$eX0V}>a|kbX_6kbP?cH(JuhA{dih z!zKYNHS^L1A`n#Peicmo+=2bw)dz*il)hh;Piceh&*fLjiqa6flh0XbOBLi1=mzW*k(B?-5*R`i0)7$&vwR;ix_Gdwg(8N&*Yrkg-?{_)T+tVcT{|;0`o{iw09Q@E$-I@CrBvHxvD+C+6jTE zGiaSxsXW^-2py9piuv6KiYXJzHt{@^*4ju zX@!5%u3Z0nXY>{O!u*37_~Tmsc19>Ha38d&AHo%ax0gdRNe$mFo3K9mjzRSC1<_Rd zO0{3dgg%0^AFn;8kf2OtapTGK;Ct7e*zT070=wR;>6xXsGWUBMW-IOan}jZuDiPP6 zsZ-dMd;Dc-*OeQ5@_^X1eG^v0uKI>EJ2w64=tG|_L(eD(sX%)XGYooL^39@^08F%? zg{xjfgwx};TH``3-g0r{1#-nCDht_}rIXWo{L5b%a10_VstFb>i~(Rv7O~I4png(V z4`31i-6|7L2{O}qwgF7gqPE|6Ttmn_;g}fm)LeTDGT8%L`}b@eU?@708X9!ey~^;% zHaTt)8=`u}WBuT+RdTub<^JRXP|b(8!msiUlx~|4b^GX!3RKCRqMP#^0$CbBGQ6P? zK$Z$G0JWB3bjYs9J;$n>dd-3sUNjdggu8juDH zP0pWNuHv-hw=RY0OA&mjEMio@T$0b&LIxy?ZgpehaZU_IMOV?0-R#PqX#=2=Tvg^B z9Ah07ph;|Ogn|~crS7+i3Z>MROh%8YsEcdRKDn^}yBc?;v*5G$?kS)!CI1q#!7Vy; zuDZJNOhKTzo^M@vZS192v`H5FO$yLMPNO>_`Q_pf)Y8}Gby<8Pn|GZ$kYitF8M#)A z5Ax)Ge4Z$uMKVag&1m>Tnqu&8v%DUJb}qZ}jTewc{RYo1>6YSmCc?N~?!O37ysr-ch-<+pbL8(Z7lPncDTI{i~k2kp;_zJIFhU^joA|0wGG+4StAc95=1ri_d`&44p;C$LqNR zH>!7}iaN@MoM1t~8{MZH2-d*#CZl%pNqfOrQ>#qw>wrz>JictXjn}_IiyB7TcR`Q8 zKj|OAMrc8`*_Mn=!L9TfBomMYsuuGgze8SHs#O$Io-osiG9$9we~7a4kBzzz#@(|nGQB#@-mpep8dFBlO=gUAa1V9~0aVob-3vrKQi+n_ zpQo$qEkA>~QJX6}pFSSQQIo{ST3|`eNUF)+GCLNus7?MX=yOo>iwq-wV-_Pg_-N>m z!Q7X`)#2@+am1N0fn`w|`u*G0ATFn9fL+mY|5)pYh=X~x#7I7{8-^-lZCLh%yvD)e z{6BcyzgGwU0my&73XoXlYdfuif+U`dlpr40Ke-BOD@*-?d0i(* zozvGq7E-F!$V^;j1ajMJuq5ml#vJY@59zkZ*m(m3jZUzlIIw{B4|8m*IuU5H-)`0N z2gE`srBMi}CPxi(s;65na{4~c^Ouc|p2@L;jq5c>GkZIPNo9^(oQvT+kUZ!!i;>Ve zt`{?#)>25DY@d9d;S48%fP|Fh>WUtzZY3IxDvDlQPr{wnPvzJ8jhwV z$|#T&&MgmSaR650&`~1_Pzm@X5R2$i zIg)O&=hX{+H273@F3C1G#R)7D|83L%ui&LeesTp0iK+wiS9j^(@RCu6`_!qisFR6# zKfA3tx^%r^`b4K71_K24A& zOalky4~+R?;K;Vgk|-}D1Tv|xqgh7(+Hbm0BU%QO)J53muBrqD9%(cyYIejCx5*oU zxQ}yvM+;^0w!ha~OhU4b=?Lyjw6|cPN%9>}iJ+J;=%1uKhxC>`v~pKDmGCzYUi&Z!HX z^LNYnE)nYPe-4y=R5E7jT@~rOf%J7~5eI<==Fn92ZvVJh3gs_z;U=ksL<_>J4nS08 z8dLxRLN!Wrlqd%o7HSqYKs~yQKR7PtX;6!3MK493+G{tM%XZBqn*`}rk%$a$6q%xu z>D$h>|2&A+5J-nzGn-~s^qbmnJWG^O_dO}JV4DWuJ>F@DHm z#KEQ37p^*+uceoyu_?@A>d+>n`cm(xcSmM&6U0y|_#zsi16!-q;8B%dJ^QH*Hu^X@ z1w&Hg9vG(vB(d%gMY#CROF7Sx4a3MQQ!F4Xv+*k{=TT!?O1KtEkznaJ_}zXGLqkul z9y7mzqC#)-IePHUG2;#B-A)sCB&}4AK2ApIHNAU1CXp#blF$a zr`IyBr-G;=kLEJtzS(9Illdf@^e|SdYdY}3=4ABG(Uh=M>6he)sLfWDCPQoCJxP!< z9e59=7#Lo=|7gM8({fv6(+ltFuCM7e=L)yvVP}(iK?1lGsASw-DSC(=uT3wk#1;xQ zP7_GM#@uIahO4U*1oNkD(AApU8S7o)i)5gRJ$$AhMJkF?YPcD1P>sn5(IzC7OP1%% zY%-?Nx{w2(>1I=)p%LH`6+4$);?n_6Z*yvabLkDj2c9%2^H_+3d=n!UHt{)H?Y3ae z>L~`YKLqJ}VbRJ|%VU|>otzJh?J#+$ysm>za(QD7CtxX+*#4D#Opy3g9Qup(?5*uT zSl9n6>!kxYHxCN=trn-@U*QGr2M-WIrw!Ap)c_)&sV^zL1kL7?=dUL8yakmrNsrDA z`rRN3`KbW~*5L=6c%qCwNIG z*FrFb9fw~sTuX}t%K1Vs7<-|DYoS#Pp&negzq&3cdQP^d;%rD8zkLh)c{>7# zf4RbaSmSZqpK2X_)_^9y@4f3p(B^p&>=xZ%^<-z5X#!8_uY*Y)<}CAWkWh2&7bw8h zaBV)@E=eF=h|5-|j&3s|9nf_7-8FB|YZ0zor&emItBpLD|3Z03rG(v-p&GK2Nt6So zXh+XvGetjaQ9KA*)yZ~v>i5UJEiFHG_T0~V_&xgcekE#F2{(5|%zSw?;WlL&LZ6(( z(*12()C5Z%1*GT|o2tlS3%_i+PDIoOXNAa`6zC1cBfbsgVhIYHr7%?_eB6{y1OLq8 zh~3={S=|&H*6!XKh6T#%{}$_|-q(c&3JIC`>GH4ea;k#|@VlQ4H6LJ@s-*u-^Gcqk zH6)Kk)E2gD5 zr7`7-AZrd_ck2C~&`BC3j;-QELCyWfx&(0?JEQ{xH5qo5rBs9f#FCwWpKL0DYg9rU zcf!udi+q^ym$J&DCe?Uhi_5zq%_28ctucS62;XW`U=5~7wJ<8>4Sr|SF)k|iP>-}b zgZqe5-sX$vGB)WG0<}*$^UUW(TQn z%|C=N97ONExOF7^BBpE8KIOZjr%q-qOyidRC|B_7sEfpq@CJ zo`3(w-e3cfGBS)r{Vl?TnjTRH?~V=0N#dPlF+s5>Qz=yqqnl;nA?aeg;p*w3`V#~g z(j~M^gE$UFv3osvuq>C=9>*n-Cq*4pjn0(mn!11kVEg@n225 z{vCTsWx>6p*{3#bjb2^F3Xfn~s8 zJqn$p%nFuF7K{vUu&(HAPIxf5L&uAXF@c= zW>~oQ@(P5@V8GYHCzM=rma#370iMX0{Z$Im~GEK3K+U) zUIA;i0;SH~!5~IZ&5NAcUSIeo!NdF^t*g9m^7?8e-(qx0#;DiwZ@)F7PRi{2$uw`Y zOI4vb5nBQe_*Ocv$+ijhO`6NRn+ z3BCjzE2-w*u~wDyNm^+&r$ZCPmBih5CL@D3RE&Een7)7B5=CfsS4gFkEObfnSu&Dt z*@xuoriM)N`&G3&?Jj)v_YW#9m>60pgzXsltttWdMXuQxpk94=znqf^+I?P`Q5RF9 z)&B)v|9>(^!;$D(P)HCUMYNVAKYWA_G6>{*R;&4P0)k(U;w)`zOxsxBln17 zp8yjZ#Aqkh%2};Jp_(Ywe4;Z$#$w1LMaer1?xNsqHL3COG9bJcZH*~f1|$(hAP@si zVS3GU3Gbfc%+0f&c1QW)9S*YB7wY@+GJmES3 zmd0)hp-bP>`A4!(N+VP z8Y#EKlh_wg@R}BiH9CB$E|RvqCrm1T#H7(t8v8k0jln%T8Ozr{t6W89jy2KqsV!rQ zhmgkHdH&qWg-6DW<#y~eAv$2M^oc}12!l;Wru$`57GKdM)A+4$D}=;POlWMviFqwCD?V7(W*mt=lsBAnEHo@){M5|ogB}zYW%@)n0|9gD%&4DXmQX^l!smd3^1ZL;8&Am)DIoki+< z_0aellz|bQzty?%82=JbNTvSofmgFk=NH-RScmto@aklT`=EriiPgl>ZD2P4(y?SJ z#>KcY9Szx}{LX!y_Th2X-@niI`i6?XHsvt`AQ?OB77=bK$>;$5c*PwpU3W!w*`2Wz zy4&-E${m$AVxLVtd>N)?N5eB-zA%o&Asm~;Uc^iYU6()``He+KfOu-fCq9bqefo8m zPRc^20Lh3l>#D-=6iQQ$YQ&PuBcV)%frO!=m_?h-yU(R3?e0*gr-?lHSKCIYi+4QW z1ZcEAU8uTXELbYN(-dWJ+pt{dmLg=U+yJmIu#744b)p$F1Ky+ROPjosX29 z!iAG#Di{H($3_IGrrBO2m17&%lGlwikF*K4i1JHeWIcVxC-CHOlPX$*WnFK#D5g;v zo)A=B0!tGrgw8gfLUbY8^uHE)j`; z!nLPjfoo@G&{%0ptv9{(t!kuk*O~<~h2KZ(kv`-)K~2F7dP3289;&lm_Cb$Icu@Hc zqx-z`cN90Vo`U_f;s*-}PQqeAtQhp&T+GX#1fQL2*S_1@I`!i!VS#WNCCR#{=(r&J zHQL=D^c$H62nQw#)bX*=O1hE%4GjyyyQatPkp^{wushLE%1? z?a}YLO8mQ!8Yl^Q$FD~VxPB{JGxJTlL)+D?K1~w7VX5hTn|ndEphrfh6CeXb3mBdv z?+`ju2Y#(2_>`X6-;z0vciggcU;c>Bd27R^9kD$0!Y}~IP3<)eEs@VG{qA=SBB^xU z1~MTOqssN<^kNy#B*dnuTFlfX`(z@+o=dE_0M<%rpAbQ2)s6j8*;NireG*Fk6p2T2=F^}` zuoiT*lVNdo=lwYO)PcqK5-EP<9;Mv_JQ5DFZICIdf(}&lddJ>&UTJAdIu zV5sk4YijTEKL}a7e_r`7S=pa|X_4@L`PTn*!ODLc*8O|lENuwx(+*bmLGmQrPNv)< zKC=j446Yj(!Q1l_LOpF(BNr_9^3p=P!9|N4{Sqs}htd-thS0FD6tt10jQ=XAo+NG1 z>V{8knRv>!e6o$Bd3*nH0&T{8U-3uwd$WkM`ZW`6|kT(|%|Y@Zn;|FZ%# zdv$}yxmGbMZCfjpK*)~#G(%sT-5NU@=rdDHmDy6*#!1~0g^~yG*ey3}o8;hJjCv#= z+uOY*(Wdau@&XXRy1o-=Xd2|P@#CLWIpc!|RIQ@hiM^brR2|>5TqX+SPHpJYDvQa# zrZ9kuR@2J|gg0XOrXOR`wEQ)Wlk;rDLzD(KqfgvZhi;%(j)7;tM|~IRTfRW~GR1m1 z?rt0{2Mt=DPkvnrjl5HFgOF;JPH07N_q`6?KWp_MypqEnwRjX;fAOGXm(k4mCd3S1zN`+E@6j6Vvkvf~YyR-dS74k% zGyA!bK!Ckt$alr3r^yF&1$BGCBC`~0=s-j79A4yN8c)xtk+UmTuqZDE+GNg4I{^3u zF9nLvi%!jXBSdLeP%+wEm@d^|qWp>}=oLu*aStA>@*msvLV*5n@MYL6)Ahf4SCe1x z04aM5NOM^#Fvj@lOyWa}s5%x=;^e9xU^XX3{T%b)$Tz?b9Q7d^L5hNt&mgxpMewm| z)J%>c?-0B7ad`d zoVFGg$B^QGYkR?Mz7PwrWlXA*W^WX4>qFwki@KB`#`Zu`+sl0Ggkl*o^_11GvSNe$ z0f;A&J_B%AT*k21Lu#-dCdO2n(RR&axDT-qiDAsx};Z;o0t357MxYi6IeNnomr z+z8+6DE6|)E-27e+UoCK^3(ADPiyDEor$__=@=E;wr$&~XvQ$7H<) z{fGUr|7m}JnjNvLnUURp(*ysQH~9C-)YD(dR9Z07JI4u?jq)0a4aa5OK?{fHUGb`02ika?rHF7{0&$_ULwTQpgeye$gY@ejTAmS+hc9L*o0 z{v5^}u2&x$z_S`Kd-B)tCB}`_t@yWUoimji?Zr4qVU##q{||(EM3>1hkN}LyMy~Z1 zbCF*@MHlb~xc$sfDXY6|W{9HYmEk??5 z`_SrU@10p+T^u+#KP+D`W646NH!F!Gr|?DBfLs<}3HR!>5aZ6gdLV09x1^ovA%LsS z4&y$IY!vq|Anu2no3kJ82wPq6E@P`SpAz;-5Z8uVnLt-t+?!iZRFr^R+=31sg;vgM zaX4$P-5Z{lq<_0tTDpIvZZG}i;uC7*um7h+|G%=`-!JUJU&$1%7t+V?a6rG*d(Z|0 zhJ;{!<8$n%>eV}8$QNHztQSyHI#W+%VBYAv3mQ+5;=4ZX>*F&`g)7>$zX~>RS zDh5ON1Hva#0c|t2b+EYHq?My6u~4Z{g1=xE>znXTmK4ITc>viTynJ6opvZj#gtpaTYLD9(7zS>E&sNb* zF^$GKYJegcyU7SID)^Udb_;3pmPM~J_qg_Ah4<>qvVxX1w(OXh_;kGzftSH#Q zB;(*oCpwl;W{P5FM_!K$>D|iqhaJ!mKaym2~-QVVetGN7!bGw`T03$ZQi7aP_7*<(07t! zA({`>q;`d&HP$a>S>Mqrc-ZaC`6(&uJU`z?vV7)tF{}>f0U$01ORlZ-h9nEPX#p$8 zA-gJiX7~ITrlFJX_XGHhVn2`ayUFHwZ(Ytvw}Ol(6qMk3N|%isA;vh-ZI}-hG4IVd zM%D8IsYrj%7U;#dQiUPSty#LEAgO&Gg^%hvgA`S#*_nDnS$-5kw5||~zpBED6O!_1 z`VebExK$b=UCk!HJZpL>0;4+Q*A9r*Nbzp$hir}X@53C_Ny1HbvMjlH{)z;SZL_J` zuZKyB&ER{X_agz-KcVbOip8lMOoB&36WABCNhY|e&DHM08x(mRL3?%TIQBwgr?9#k zr9V5H0f)Y=en4e)G)Tzr3JCXoAA#Gn$J3M=mbKM)6@Z|H1W3P1bZ0Q4*X>C*j7Wb` zgiC_JWk(viU*}Ck%Fj)+=drztfLcKlh-AT^P-w~3RC!j@u4MuXC0GAj1W0J=*k>r@4YTwZ-|XLzI-1v z6=S0D_se(cxQFo|j{}RWH{&X+_IAo{=_=LR>=VHX^sghKHZHWwoSlb$uK;RSVcFOP zC&uh)rl27U-tL^VOFHE6trPOr6yy?YdJ=!)xB?Hm4t66(S{$U_*NPE%?^z`ia(#?l zYAI_^HGH2`dQ~}YlT`Fxtkz5X$dX3Fhe}1n48wrnrPOsWVD5pS9iRVUNO@wfGSEAj zk`XFeA<+swg#5d`0ll0N6m9~$d{}Sfm&6aymR}`P&E@P#0ycR7&`M6MZNyR62o2?@ zvkT)QkERDnp}%&5SzgEL!hMl0?JW{=OV1Z`avA;zMtbJU33f4Y)oczKFChbEqIADA zufSeBYItF}uT-}U!>+F*X+JETgPASu_p}GqRINk{1}ZlNTbm8x6e0ZGqlyNXuw0V`kD|qlJTPs zGk~g86TMjKHDaV>$27HPM}-MfQM*$JrFZ-5{?klJDkUHvXAxUC@X;JnG_PCh+8;4d zYJuXt89gzTsc)O-(^57KlzMnQG_gcusmoSD=qP+?jl$GG^^!w99ptFCJf4c~-{W4t z$rROJ$yCcGGDvw;tOvzRc|o&O0i*GBuHyspx2X5J@HWHPIZ;7}NTHHh2g%saBIIF+ z)KG)@+r-uCbsDipdAijKQmTzUH>2$@<%{jfSBrQDe)@9D=+HSwz}U6pWkd9s)~){DO}F#G)*KSS!v~BGJ z*pkf%Zi=jA2LzZiMydsEL2`SFo8?OF5oVA~vL$MZdG2bgI~8X8ao%|;YSc!~yBU-E z*JBQTaJ+#d&8nm8?P4nKrR7V?P@lBjx@b)a;v^KlB7k~!e_wnFD7h9`fR-g~?D*wq zs47)U`txFka+*a%*SQb%md*0DqA9+w(7LCb94*wWlCC~8r;_~o$D&UNR3(s21k^77 z+8&aGhD&<1Sf?D{Tv=NRWNv!@keDgI&dH`hXPd;Q;+t9vl|J?M+H+J~+)ohoKQ9~rM zAT)OX5 z<)t@z-0_fTrl>X8Uet<CX}7nY93(L-gX+@GxIh?z?zHdFejh zy%o4G(XX{O@2>-Lc+vMte)lR;A2VdolHZ1%j2=YA^yB@DPpQ+@c}61UN=`EM4#TQJ zGG#S#iYz*k%MZObtDIGx<}Kwc40gctPxJNTXbK^%Ej~T}nVm{&#orUu0^{Bgi0C zwt#n1_&2JpA>U}|4}9s`4r%-`KRXgqd}_3F%&4+BdmeXP&S{|*7%naIuXhP}Jg-61 z&GNIZ2qOl+B*XBL>q`LWxiJ?g!|;G0C4=d+sh;&O=r{m0VjDjDXbe%nk*IOB@GwMKn>bFj`|)F(+5lwx zfo857J=9)k`S4S(v~9``S+DaQjT^z&nh`{a3Q93=@wpAbVET802g%_+&l2kni#x7; zkG_^O`W!STBwpr-Ee5Jm6`7;ZajuTbJh(A2>^s6Iyj`dc3zyreMs9%-s`#ZX3zEM7$JtYr0r5&J<4fGa}^;ZCpo%4(HI z7>KVkrRP(JrkpgK$vls-3yUfO3Sgz(`+KzZX5z(4zzqoADT;n`FaIn^j+Zbjb3aZJ zf&TUVUOk%7ein2jJ9wjskGzq?ad0pEGfP5QbGIk4f#&D+sz4omIPZHNA$dB2pO+j< zWk9VV|8XJk9BaSWjp_xmnM%3JG|4nm{A(v$BQ z!x4l2;jT}$sCC=~MH%L5p4eK~;!^>Zd4ha9F1Fh0({T5+AJ-~8v-DWEex`}pGLw@83&qAXX~jhb!19mpX*7?& zV5Q*>abffg3DS;5b)BK6z1-#NO?mk1XG}Sku|WwYCxi+Xvu!Z^!>+zm;uY+z z`S06Ga==l$RFx`|Rwf8r3j0J@BP58o%Gd~mKVWHhuevsE`$@4j3;XWS@RHpQI)boC zC}K3{qaXCBwb?&h+$j(Y!G$X7)(nsxncv+_&US7+VTncw3+5N=l=*%~((lOc>k#6% zrZ46^dB$?>Fk^-PMn1G@`HAjYHq3yEe~DQlzIuvqxWDuvuw!~1WV*WrP2|C zX0sp9MI=D^0;7Si(irfo5#!s$vhj3ZgeetjNSp1Zo-fRIcK@!U@eKo(6ncm z0ZGmdu0Mf74ez?)VpQQ$@A}JZ@Ah!r`i=GZKFl1v60lYWX@?80a-E}{C=LoZOP`uY zj6gMnDq4y6l=alttpcmbUML}>6n7x{VAa!cl2iZ9@^2u0f$akB#1!#z9SmmA~go^(sNRQNs$a9 zCi^@$$IW$de+kWH-~itEln8~;krF8}u>pAmm}!x-CMdH)UikZH$Hq_WkIJ<;1TZgQ z{&WJv@XcJ7={#T87bSOBg+Q&fAFm;@jo1*(b?R{iJ2UH=2brl)g6*X$M37_H*X3BK zPT*B3ce4|qPNC)|my!@xWHtzx;rtNc-h+xKEtyFoW-F*zY$Kw^sAl2Bl1z!WkSx?; zb`?hX%fVh0kkY-Pd5cLK0in?Fgv@-;YU>7!7bXo6n{cB=5ZUkia>(6fkRq+N6+6{E zww*n3u!oNv;;HbYIb>|#NP5*@a&+hea_5FXhHj4h*+UOQW`f$oanX^r0eyAXo znfAlKd!X`mCdC28b{u~Gh92};W(Sxe7ell2VQdPS z7K;8!1y4ul`vN-sN9cCy+XyOPS4n46;k{IQDQV zCvDsyLM^R21^_P00dxD)6zy@bsaA9h^ydik8@7Ule8!Y-4reeF`2)xZI%UF*7FsIM zAkr1+w0sv`p1{$C)-wf0qRjB`Pqi^vI-7CJ9Ln&LGz4){6f$lJJ25r7*S~zJOaVE0 zxado6B9rJ!uaV~Y^}E_75R*o@Rt$JEv@@$=pBa@^Lb16f-vhmZ;H0+uDw(_?MZQKA zoAO}BUHUbmfA5>_ZOsx8y zgjvy$TR$;%ax%Bk+6PsUgjdZybmdCNi|2H0#S0WNEZwwR1WBvuu9eTyL|)YdQ5D*j z00ZJrOUIsXuF0JLa^A7tk)^0q1nwySI7T?{yIa)wUPC4rlG4 z^5js$DcN0*R<#3LE7O~SPPqjDX!kEvXFV5XpTRCbzM)xV$iXvC0?eSV3 z5qycU=4Chc)4+Bi)Z)#%)2u`X>B0hElbpJhsi0|$VT;@2Tsr7xPKHKCS#KAYV_qqP z@9RhC@NvTHi*2>+vXz816;fk$O_5s8ZVbWc^3Ywkps$I0;kZL0>lR*)6YOUCuR(pn5=$?QrI2DeI? zMLV=cuCkFJeLckCtH4C+JbQ`K@lUn-zoE~pl)C;h!$*fLC`sCYKpDyci@ zyrRgnlm2Lzt%gYTaeh~`v7IME<@lv!8JDb191kbH#ZbFJ`c9jXB9R(-k7@zA^+r1nR66-FYHoL-rQJQ8Sf& zg}7m;)+9x==ghgd3XkJlab5=Z4SA-A%{7yXtz=_L@T+TQNBc?0AgBz*+d#idpA!}} zc7=&4%`=CPziEzrSx7Zzpl!6$_L@Dc$_?^UFpktw6zL~C<`0r zF+~`A#dSgJ*X^_G$2GA0r9`z+=3c#R43BPdxC%lpEv2j+Jh3jaf)*G!f6D8REi3

%{!-f%7Z{^~ov0jbvMOth*27E`jV@99{ zCSz*oRtSRNe2elLzi;;NIvQw73jTEWV5zan7cp|noW*8Jgh?E}K1_Y80ZymCRs}MD z+2bS2pW@zZw3TkUUJTFBT9zrtocL-N07ly5M>CEv@!n=@kgs};u=VRWLWwLlkpFmw zA0-*tnJYV_JEjg{QOEGHz`VhvH4QDZrnO$vDK3dEN+mSV-C%BNXUTBVJ9zi#0#$^_ z%4*!#*IA#KU)Lba{1nUOG3M9ctr`=M)yhx!1)IfcilD!kXR=W^Mc7(9oeC~$K8Y#6 zEx=@bl?ivWX)aHeGpwD=kM5qN2;TNaxC?1fn`)oSkXFVjrGuhYh~;$O*wMX;%9^GQGd1Q zvxrjod*+pTR$*Pq3eF%CwO7uKMhme=r!vDj6x~Zt>`t3j<58~xn+3(ewA3Bs1|JUU zFvL=B%)y*Ms!}I8FWEha6fBqGA#VLCjEr&&Y+nqe8nV_U5&cJtMifvF%I* zY9B7clq%=Pss881g`TIVQ{Nd_wSvoTF}zpS-V-N5lG{ndT4h6lM>5{F5H9~T*!~HG z^7riezeooD7=nC5_y=k}|K~jFT^Z>^Ed1R+1NhZonY(ZP1#x=<|Chu#VvljV9IoKk zpmYgg0pP5rnpJ}>5vYA+0a!T<$qW_KaXFqLEXOuhA-zI~EPH7=eVmKUsBzFUd3 zkl4FM>4vAGar}dJUu&TfOhTQ2WA@&A6c<^O_>LU;UajKBzX$M#4F@vIgNXiG^!F3Ws9N+$;lzn6448CB>#79LJrF4 zyB`{I%aTZRY7;EsdX(p`_?)_suJ2#s`B}fAs?V7EcX*U%RM~>Te&@U!w9JWrnSK*| z$FIrda zN4xE(`DvfCqxfi3f01hy(9&ngqz3friM&gUzIs}V+UpS4rxya;)I%OkaMOJ!KZK<= z{yaeK2O-Kexl6YXD%_TtA_R0d6WZgkiJBjFy^HGuYY5}U?AO5E zKp_*oRE$-nhbumOouOXQ6dMQ6YM6+da^*2nX-f%OADV`uwi6X=LaD%-IGOF2Od4TF zgItGsP3wq_$@iZ8>-yeT>_2TK66}xt2>*qQ%q9|{{_(fA_-7d%MRK4f-;S>j*&_+Rl?ms{z5m4_CJn++(33T8@tl99p}T(o03zP!DHB!BphZMine z)NN1pIZDrN2^2&=Z*aVShi!gQQ_vAD+A%|(3YDZG;rdNzNRjKQf8!BKrf3g-$BNR$-anGT8nV?W%L$839eG-yHwdJ z2*;v`5ZUyc4U0_#RPVyA`iU+3f$hyxx>aCTyTy zp+6is7duNA-#ui(Y~t~&17N98IsCb++ohe8n+RI3n{_@iv9%Dn6Ty)9l&eXZ&W=v_ zy{!rZ>w$$(T*Vh%&_1sgEvjoe?*~kmLLZzN8R^WhZ#o~2;23fCO|@wo)dMz-r%TxL z;ff8sB{u`zz}2;;mus3D^|?X0^=#xYu6GaDI9TW<)vx`cKV?)%E~>^YRL@NVO%Dbb LnSKC(Y%Ki`Nod(` From 6e4fb819071c62a42f6507fe2ae55588e6380f7f Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Mon, 6 Jan 2025 14:48:03 -0800 Subject: [PATCH 03/20] Upgrade build OS to latest Ubuntu LTS (24.04) --- Dockerfile-linux | 2 +- Dockerfile-linux-arm64 | 2 +- Dockerfile-mingw | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Dockerfile-linux b/Dockerfile-linux index 72373d5..8e9d5c2 100644 --- a/Dockerfile-linux +++ b/Dockerfile-linux @@ -1,4 +1,4 @@ -FROM ubuntu:jammy +FROM ubuntu:noble ARG zlib_version ARG zlib_hash diff --git a/Dockerfile-linux-arm64 b/Dockerfile-linux-arm64 index 9ea8df3..a28690b 100644 --- a/Dockerfile-linux-arm64 +++ b/Dockerfile-linux-arm64 @@ -1,4 +1,4 @@ -FROM ubuntu:jammy +FROM ubuntu:noble ARG zlib_version ARG zlib_hash diff --git a/Dockerfile-mingw b/Dockerfile-mingw index 11cec1d..a03df50 100644 --- a/Dockerfile-mingw +++ b/Dockerfile-mingw @@ -1,4 +1,4 @@ -FROM ubuntu:jammy +FROM ubuntu:noble ARG zlib_version ARG zlib_hash From ca75aecdbae7dfea9cdc92452923a561322cc515 Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Mon, 6 Jan 2025 14:54:04 -0800 Subject: [PATCH 04/20] Upgrade to OpenSSL 3.4.0 https://github.com/openssl/openssl/blob/openssl-3.4.0/NEWS.md#openssl-34 --- Dockerfile-linux | 4 ++-- Dockerfile-linux-arm64 | 4 ++-- Dockerfile-mingw | 4 ++-- build_darwin.sh | 4 ++-- env.sh | 4 ++-- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/Dockerfile-linux b/Dockerfile-linux index 8e9d5c2..3723002 100644 --- a/Dockerfile-linux +++ b/Dockerfile-linux @@ -43,8 +43,8 @@ RUN \ tar -zxvf "zlib-$zlib_version.tar.gz" RUN \ - curl --proto '=https' --tlsv1.3 -fsSL "https://www.openssl.org/source/openssl-$openssl_version.tar.gz" -o "openssl-$openssl_version.tar.gz" && \ - curl --proto '=https' --tlsv1.3 -fsSL "https://www.openssl.org/source/openssl-$openssl_version.tar.gz.asc" -o "openssl-$openssl_version.tar.gz.asc" && \ + curl --proto '=https' --tlsv1.3 -fsSL "https://github.com/openssl/openssl/releases/download/openssl-$openssl_version/openssl-$openssl_version.tar.gz" -o "openssl-$openssl_version.tar.gz" && \ + curl --proto '=https' --tlsv1.3 -fsSL "https://github.com/openssl/openssl/releases/download/openssl-$openssl_version/openssl-$openssl_version.tar.gz.asc" -o "openssl-$openssl_version.tar.gz.asc" && \ gpg --keyring /openssl.gpg --verify "openssl-$openssl_version.tar.gz.asc" "openssl-$openssl_version.tar.gz" && \ echo "$openssl_hash openssl-$openssl_version.tar.gz" | shasum -a 256 -c - && \ tar -xvzf "openssl-$openssl_version.tar.gz" diff --git a/Dockerfile-linux-arm64 b/Dockerfile-linux-arm64 index a28690b..0d04153 100644 --- a/Dockerfile-linux-arm64 +++ b/Dockerfile-linux-arm64 @@ -44,8 +44,8 @@ RUN \ tar -zxvf "zlib-$zlib_version.tar.gz" RUN \ - curl --proto '=https' --tlsv1.3 -fsSL "https://www.openssl.org/source/openssl-$openssl_version.tar.gz" -o "openssl-$openssl_version.tar.gz" && \ - curl --proto '=https' --tlsv1.3 -fsSL "https://www.openssl.org/source/openssl-$openssl_version.tar.gz.asc" -o "openssl-$openssl_version.tar.gz.asc" && \ + curl --proto '=https' --tlsv1.3 -fsSL "https://github.com/openssl/openssl/releases/download/openssl-$openssl_version/openssl-$openssl_version.tar.gz" -o "openssl-$openssl_version.tar.gz" && \ + curl --proto '=https' --tlsv1.3 -fsSL "https://github.com/openssl/openssl/releases/download/openssl-$openssl_version/openssl-$openssl_version.tar.gz.asc" -o "openssl-$openssl_version.tar.gz.asc" && \ gpg --keyring /openssl.gpg --verify "openssl-$openssl_version.tar.gz.asc" "openssl-$openssl_version.tar.gz" && \ echo "$openssl_hash openssl-$openssl_version.tar.gz" | shasum -a 256 -c - && \ tar -xvzf "openssl-$openssl_version.tar.gz" diff --git a/Dockerfile-mingw b/Dockerfile-mingw index a03df50..94558eb 100644 --- a/Dockerfile-mingw +++ b/Dockerfile-mingw @@ -43,8 +43,8 @@ RUN \ tar -zxvf "zlib-$zlib_version.tar.gz" RUN \ - curl --proto '=https' --tlsv1.3 -fsSL "https://www.openssl.org/source/openssl-$openssl_version.tar.gz" -o "openssl-$openssl_version.tar.gz" && \ - curl --proto '=https' --tlsv1.3 -fsSL "https://www.openssl.org/source/openssl-$openssl_version.tar.gz.asc" -o "openssl-$openssl_version.tar.gz.asc" && \ + curl --proto '=https' --tlsv1.3 -fsSL "https://github.com/openssl/openssl/releases/download/openssl-$openssl_version/openssl-$openssl_version.tar.gz" -o "openssl-$openssl_version.tar.gz" && \ + curl --proto '=https' --tlsv1.3 -fsSL "https://github.com/openssl/openssl/releases/download/openssl-$openssl_version/openssl-$openssl_version.tar.gz.asc" -o "openssl-$openssl_version.tar.gz.asc" && \ gpg --keyring /openssl.gpg --verify "openssl-$openssl_version.tar.gz.asc" "openssl-$openssl_version.tar.gz" && \ echo "$openssl_hash openssl-$openssl_version.tar.gz" | shasum -a 256 -c - && \ tar -xvzf "openssl-$openssl_version.tar.gz" diff --git a/build_darwin.sh b/build_darwin.sh index 1634d16..bf35368 100755 --- a/build_darwin.sh +++ b/build_darwin.sh @@ -6,8 +6,8 @@ curl --proto '=https' --tlsv1.2 -fsSL "https://zlib.net/zlib-$ZLIB_VERSION.tar.g GNUPGHOME="$PWD" gpg --keyring gpg-keys/zlib.gpg --verify "zlib-$ZLIB_VERSION.tar.gz.asc" "zlib-$ZLIB_VERSION.tar.gz" echo "$ZLIB_HASH zlib-$ZLIB_VERSION.tar.gz" | shasum -a 256 -c - -curl --proto '=https' --tlsv1.2 -fsSL "https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz" -o "openssl-$OPENSSL_VERSION.tar.gz" -curl --proto '=https' --tlsv1.2 -fsSL "https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz.asc" -o "openssl-$OPENSSL_VERSION.tar.gz.asc" +curl --proto '=https' --tlsv1.2 -fsSL "https://github.com/openssl/openssl/releases/download/openssl-$OPENSSL_VERSION/openssl-$OPENSSL_VERSION.tar.gz" -o "openssl-$OPENSSL_VERSION.tar.gz" +curl --proto '=https' --tlsv1.2 -fsSL "https://github.com/openssl/openssl/releases/download/openssl-$OPENSSL_VERSION/openssl-$OPENSSL_VERSION.tar.gz.asc" -o "openssl-$OPENSSL_VERSION.tar.gz.asc" GNUPGHOME="$PWD" gpg --keyring gpg-keys/openssl.gpg --verify "openssl-$OPENSSL_VERSION.tar.gz.asc" "openssl-$OPENSSL_VERSION.tar.gz" echo "$OPENSSL_HASH openssl-$OPENSSL_VERSION.tar.gz" | shasum -a 256 -c - diff --git a/env.sh b/env.sh index 1cdfba2..fa5e3f7 100644 --- a/env.sh +++ b/env.sh @@ -10,11 +10,11 @@ export TOR_VERSION="0.4.8.10" export ZLIB_VERSION="1.3.1" export LIBEVENT_VERSION="2.1.12-stable" -export OPENSSL_VERSION="3.0.13" +export OPENSSL_VERSION="3.4.0" export ZLIB_HASH="9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23" export LIBEVENT_HASH=92e6de1be9ec176428fd2367677e61ceffc2ee1cb119035037a27d346b0403bb -export OPENSSL_HASH="88525753f79d3bec27d2fa7c66aa0b92b3aa9498dafd93d7cfa4b3780cdae313" +export OPENSSL_HASH="e15dda82fe2fe8139dc2ac21a36d4ca01d5313c75f99f46c4e8a27709b7294bf" export TOR_HASH="e628b4fab70edb4727715b23cf2931375a9f7685ac08f2c59ea498a178463a86" export DOCKER="$(command -v docker || command -v podman)" From b82fed5ce707e6c623656947b9851872ea16aec9 Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Mon, 6 Jan 2025 14:54:42 -0800 Subject: [PATCH 05/20] Upgrade to tor daemon version 0.4.8.13 https://forum.torproject.org/t/new-tor-stable-release-0-4-8-13/15397 --- env.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) mode change 100644 => 100755 env.sh diff --git a/env.sh b/env.sh old mode 100644 new mode 100755 index fa5e3f7..edddfbe --- a/env.sh +++ b/env.sh @@ -4,9 +4,9 @@ export MACOSX_DEPLOYMENT_TARGET=10.15 # Reset version number to zero everytime TOR_VERSION changes. -export BRAVE_TOR_VERSION="2" +export BRAVE_TOR_VERSION="0" -export TOR_VERSION="0.4.8.10" +export TOR_VERSION="0.4.8.13" export ZLIB_VERSION="1.3.1" export LIBEVENT_VERSION="2.1.12-stable" @@ -15,6 +15,6 @@ export OPENSSL_VERSION="3.4.0" export ZLIB_HASH="9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23" export LIBEVENT_HASH=92e6de1be9ec176428fd2367677e61ceffc2ee1cb119035037a27d346b0403bb export OPENSSL_HASH="e15dda82fe2fe8139dc2ac21a36d4ca01d5313c75f99f46c4e8a27709b7294bf" -export TOR_HASH="e628b4fab70edb4727715b23cf2931375a9f7685ac08f2c59ea498a178463a86" +export TOR_HASH="9baf26c387a2820b3942da572146e6eb77c2bc66862af6297cd02a074e6fba28" export DOCKER="$(command -v docker || command -v podman)" From 2453c29f04fcd17b4f9150d2fd500156814a3052 Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Mon, 6 Jan 2025 15:01:35 -0800 Subject: [PATCH 06/20] Disable more OpenSSL features (fixes #136) https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features --- Dockerfile-linux | 25 ++++++++++++++++++++++++- Dockerfile-linux-arm64 | 25 ++++++++++++++++++++++++- Dockerfile-mingw | 25 ++++++++++++++++++++++++- build_darwin_arm64.sh | 25 ++++++++++++++++++++++++- build_darwin_x86_64.sh | 25 ++++++++++++++++++++++++- 5 files changed, 120 insertions(+), 5 deletions(-) diff --git a/Dockerfile-linux b/Dockerfile-linux index 3723002..495451a 100644 --- a/Dockerfile-linux +++ b/Dockerfile-linux @@ -76,10 +76,33 @@ RUN \ RUN \ cd "openssl-$openssl_version" && \ ./config --prefix="$PWD/root" --libdir=lib \ + no-apps \ + no-cmp \ + no-cms \ + no-comp \ + no-ct \ + no-dgram \ + no-docs \ no-dso \ + no-ec2m \ + no-engine \ + no-http \ + no-legacy \ + no-module \ + no-nextprotoneg \ + no-ocsp \ + no-padlockeng \ + no-psk \ + no-quic \ + no-rfc3779 \ no-shared \ + no-srp \ + no-srtp \ no-ssl-trace \ - no-ui-console && \ + no-static-engine \ + no-ts \ + no-ui-console \ + no-uplink && \ make ${jobs:+-j${jobs}} && \ make test && \ make install diff --git a/Dockerfile-linux-arm64 b/Dockerfile-linux-arm64 index 0d04153..d61d52d 100644 --- a/Dockerfile-linux-arm64 +++ b/Dockerfile-linux-arm64 @@ -79,10 +79,33 @@ RUN \ ./Configure --prefix="$PWD/root" \ --cross-compile-prefix=aarch64-linux-gnu- \ linux-aarch64 \ + no-apps \ + no-cmp \ + no-cms \ + no-comp \ + no-ct \ + no-dgram \ + no-docs \ no-dso \ + no-ec2m \ + no-engine \ + no-http \ + no-legacy \ + no-module \ + no-nextprotoneg \ + no-ocsp \ + no-padlockeng \ + no-psk \ + no-quic \ + no-rfc3779 \ no-shared \ + no-srp \ + no-srtp \ no-ssl-trace \ - no-ui-console && \ + no-static-engine \ + no-ts \ + no-ui-console \ + no-uplink && \ make ${jobs:+-j${jobs}} && \ make install_sw diff --git a/Dockerfile-mingw b/Dockerfile-mingw index 94558eb..b0f1652 100644 --- a/Dockerfile-mingw +++ b/Dockerfile-mingw @@ -80,10 +80,33 @@ RUN \ ./Configure --prefix="$PWD/root" \ --cross-compile-prefix=i686-w64-mingw32- \ mingw \ + no-apps \ + no-cmp \ + no-cms \ + no-comp \ + no-ct \ + no-dgram \ + no-docs \ no-dso \ + no-ec2m \ + no-engine \ + no-http \ + no-legacy \ + no-module \ + no-nextprotoneg \ + no-ocsp \ + no-padlockeng \ + no-psk \ + no-quic \ + no-rfc3779 \ no-shared \ + no-srp \ + no-srtp \ no-ssl-trace \ - no-ui-console && \ + no-static-engine \ + no-ts \ + no-ui-console \ + no-uplink && \ make ${jobs:+-j${jobs}} && \ make install_sw diff --git a/build_darwin_arm64.sh b/build_darwin_arm64.sh index 84fe5b1..02a1e0b 100755 --- a/build_darwin_arm64.sh +++ b/build_darwin_arm64.sh @@ -28,10 +28,33 @@ tar -xvzf "openssl-$OPENSSL_VERSION.tar.gz" -C arm64 cd "arm64/openssl-$OPENSSL_VERSION" ./Configure --prefix="$PWD/root" \ darwin64-arm64-cc \ + no-apps \ + no-cmp \ + no-cms \ + no-comp \ + no-ct \ + no-dgram \ + no-docs \ no-dso \ + no-ec2m \ + no-engine \ + no-http \ + no-legacy \ + no-module \ + no-nextprotoneg \ + no-ocsp \ + no-padlockeng \ + no-psk \ + no-quic \ + no-rfc3779 \ no-shared \ + no-srp \ + no-srtp \ no-ssl-trace \ - no-ui-console + no-static-engine \ + no-ts \ + no-ui-console \ + no-uplink make ${jobs:+-j${jobs}} && make install cd ../../ diff --git a/build_darwin_x86_64.sh b/build_darwin_x86_64.sh index de195cb..3c345b5 100755 --- a/build_darwin_x86_64.sh +++ b/build_darwin_x86_64.sh @@ -28,10 +28,33 @@ tar -xvzf "openssl-$OPENSSL_VERSION.tar.gz" -C x86_64 cd "x86_64/openssl-$OPENSSL_VERSION" ./Configure --prefix="$PWD/root" \ darwin64-x86_64-cc \ + no-apps \ + no-cmp \ + no-cms \ + no-comp \ + no-ct \ + no-dgram \ + no-docs \ no-dso \ + no-ec2m \ + no-engine \ + no-http \ + no-legacy \ + no-module \ + no-nextprotoneg \ + no-ocsp \ + no-padlockeng \ + no-psk \ + no-quic \ + no-rfc3779 \ no-shared \ + no-srp \ + no-srtp \ no-ssl-trace \ - no-ui-console + no-static-engine \ + no-ts \ + no-ui-console \ + no-uplink make ${jobs:+-j${jobs}} && make test && make install cd ../../ From 2eedf833510876d7db3420341f278a431168d34f Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Mon, 6 Jan 2025 21:29:50 -0800 Subject: [PATCH 07/20] Upgrade gnupg dependency on macOS to 2.4.7 https://lists.gnupg.org/pipermail/gnupg-announce/2024q4/000487.html --- darwin_deps.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/darwin_deps.sh b/darwin_deps.sh index e11186d..be12095 100755 --- a/darwin_deps.sh +++ b/darwin_deps.sh @@ -1,7 +1,7 @@ #!/bin/sh -eu -GPG_VERSION=2.4.3 -GPG_HASH=a271ae6d732f6f4d80c258ad9ee88dd9c94c8fdc33c3e45328c4d7c126bd219d +GPG_VERSION=2.4.7 +GPG_HASH=7b24706e4da7e0e3b06ca068231027401f238102c41c909631349dcc3b85eb46 curl --proto '=https' --tlsv1.2 -fsSL -o "gnupg-$GPG_VERSION.tar.bz2" "https://www.gnupg.org/ftp/gcrypt/gnupg/gnupg-$GPG_VERSION.tar.bz2" echo "$GPG_HASH gnupg-$GPG_VERSION.tar.bz2" | shasum -a 256 -c - From 7a4a5e5853e0069c0df4cca75ae68c7fddbd302d Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Wed, 15 Jan 2025 21:18:25 -0800 Subject: [PATCH 08/20] Disable failing tests on Mac --- build_darwin_arm64.sh | 1 + build_darwin_x86_64.sh | 1 + patch/tor/test_slow.c.patch | 19 +++++++++++++++++++ 3 files changed, 21 insertions(+) create mode 100644 patch/tor/test_slow.c.patch diff --git a/build_darwin_arm64.sh b/build_darwin_arm64.sh index 02a1e0b..e300ac4 100755 --- a/build_darwin_arm64.sh +++ b/build_darwin_arm64.sh @@ -81,6 +81,7 @@ cd ../../ tar -xvzf "tor-$TOR_VERSION.tar.gz" -C arm64 cd "arm64/tor-$TOR_VERSION" +patch -p0 < ../../patch/tor/test_slow.c.patch ./configure \ LDFLAGS="--target=arm64-apple-macos11 -L$XCODE_LIB" \ CPPFLAGS="--target=arm64-apple-macos11 -I$XCODE_INCLUDE" \ diff --git a/build_darwin_x86_64.sh b/build_darwin_x86_64.sh index 3c345b5..d1e885c 100755 --- a/build_darwin_x86_64.sh +++ b/build_darwin_x86_64.sh @@ -79,6 +79,7 @@ cd ../../ tar -xvzf "tor-$TOR_VERSION.tar.gz" -C x86_64 cd "x86_64/tor-$TOR_VERSION" +patch -p0 < ../../patch/tor/test_slow.c.patch ./configure \ LDFLAGS="-L$XCODE_LIB" \ CPPFLAGS="-I$XCODE_INCLUDE" \ diff --git a/patch/tor/test_slow.c.patch b/patch/tor/test_slow.c.patch new file mode 100644 index 0000000..32ba5aa --- /dev/null +++ b/patch/tor/test_slow.c.patch @@ -0,0 +1,19 @@ +Description: Disable failing tests on Mac +Last-Update: 2025-01-15 + +--- src/test/test_slow.c 2024-10-24 07:38:41.000000000 -0700 ++++ src/test/test_slow.c.brave 2025-01-15 21:02:34.931958360 -0800 +@@ -19,11 +19,13 @@ + #include "test/test.h" + + struct testgroup_t testgroups[] = { ++#ifndef __APPLE__ + { "slow/crypto/", slow_crypto_tests }, + { "slow/process/", slow_process_tests }, + { "slow/hs_pow/", slow_hs_pow_tests }, + { "slow/prob_distr/", slow_stochastic_prob_distr_tests }, + { "slow/ptr/", slow_ptr_tests }, + END_OF_GROUPS ++#endif + }; + From 70aba737a300b160329c22c3fdc1c4c77dd5328d Mon Sep 17 00:00:00 2001 From: brave-builds Date: Tue, 11 Feb 2025 21:28:12 +0000 Subject: [PATCH 09/20] tor update --- env.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/env.sh b/env.sh index edddfbe..3d31535 100755 --- a/env.sh +++ b/env.sh @@ -6,15 +6,15 @@ export MACOSX_DEPLOYMENT_TARGET=10.15 # Reset version number to zero everytime TOR_VERSION changes. export BRAVE_TOR_VERSION="0" -export TOR_VERSION="0.4.8.13" +export TOR_VERSION="0.4.8.14" export ZLIB_VERSION="1.3.1" export LIBEVENT_VERSION="2.1.12-stable" -export OPENSSL_VERSION="3.4.0" +export OPENSSL_VERSION="3.4.1" export ZLIB_HASH="9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23" export LIBEVENT_HASH=92e6de1be9ec176428fd2367677e61ceffc2ee1cb119035037a27d346b0403bb -export OPENSSL_HASH="e15dda82fe2fe8139dc2ac21a36d4ca01d5313c75f99f46c4e8a27709b7294bf" -export TOR_HASH="9baf26c387a2820b3942da572146e6eb77c2bc66862af6297cd02a074e6fba28" +export OPENSSL_HASH="002a2d6b30b58bf4bea46c43bdd96365aaf8daa6c428782aa4feee06da197df3" +export TOR_HASH="5047e1ded12d9aac4eb858f7634a627714dd58ce99053d517691a4b304a66d10" export DOCKER="$(command -v docker || command -v podman)" From c9e1ad56b33fa8297f6583d8f71568ee29c0d39a Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Wed, 1 Oct 2025 16:02:44 -0700 Subject: [PATCH 10/20] Run tests on arm64 too --- build_darwin_arm64.sh | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/build_darwin_arm64.sh b/build_darwin_arm64.sh index e300ac4..0200f58 100755 --- a/build_darwin_arm64.sh +++ b/build_darwin_arm64.sh @@ -21,7 +21,7 @@ rm -rf arm64 && mkdir arm64 tar -xvzf "zlib-$ZLIB_VERSION.tar.gz" -C arm64 cd "arm64/zlib-$ZLIB_VERSION" CFLAGS="-target arm64-apple-macos11" LDFLAGS="-target arm64-apple-macos11" ./configure --prefix="$PWD/root" -make ${jobs:+-j${jobs}} && make install +make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install cd ../../ tar -xvzf "openssl-$OPENSSL_VERSION.tar.gz" -C arm64 @@ -55,8 +55,7 @@ cd "arm64/openssl-$OPENSSL_VERSION" no-ts \ no-ui-console \ no-uplink - -make ${jobs:+-j${jobs}} && make install +make ${jobs:+-j${jobs}} && make test && make install cd ../../ #Apple messed up getentropy and clock_gettimesymbols when they added two functions in Sierra: @@ -103,5 +102,5 @@ patch -p0 < ../../patch/tor/test_slow.c.patch --disable-tool-name-check \ ac_cv_func_getentropy=no \ ac_cv_func_clock_gettime=no -make ${jobs:+-j${jobs}} && make install +make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install cd ../../ From 53c740514eebcd1510be2bc04c83ab40e01d35b1 Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Wed, 1 Oct 2025 16:06:27 -0700 Subject: [PATCH 11/20] Normalize indentation --- build_darwin_arm64.sh | 114 ++++++++++++++++++++--------------------- build_darwin_x86_64.sh | 108 +++++++++++++++++++------------------- 2 files changed, 111 insertions(+), 111 deletions(-) diff --git a/build_darwin_arm64.sh b/build_darwin_arm64.sh index 0200f58..5cd9477 100755 --- a/build_darwin_arm64.sh +++ b/build_darwin_arm64.sh @@ -27,34 +27,34 @@ cd ../../ tar -xvzf "openssl-$OPENSSL_VERSION.tar.gz" -C arm64 cd "arm64/openssl-$OPENSSL_VERSION" ./Configure --prefix="$PWD/root" \ - darwin64-arm64-cc \ - no-apps \ - no-cmp \ - no-cms \ - no-comp \ - no-ct \ - no-dgram \ - no-docs \ - no-dso \ - no-ec2m \ - no-engine \ - no-http \ - no-legacy \ - no-module \ - no-nextprotoneg \ - no-ocsp \ - no-padlockeng \ - no-psk \ - no-quic \ - no-rfc3779 \ - no-shared \ - no-srp \ - no-srtp \ - no-ssl-trace \ - no-static-engine \ - no-ts \ - no-ui-console \ - no-uplink + darwin64-arm64-cc \ + no-apps \ + no-cmp \ + no-cms \ + no-comp \ + no-ct \ + no-dgram \ + no-docs \ + no-dso \ + no-ec2m \ + no-engine \ + no-http \ + no-legacy \ + no-module \ + no-nextprotoneg \ + no-ocsp \ + no-padlockeng \ + no-psk \ + no-quic \ + no-rfc3779 \ + no-shared \ + no-srp \ + no-srtp \ + no-ssl-trace \ + no-static-engine \ + no-ts \ + no-ui-console \ + no-uplink make ${jobs:+-j${jobs}} && make test && make install cd ../../ @@ -66,15 +66,15 @@ tar -zxvf "libevent-$LIBEVENT_VERSION.tar.gz" -C arm64 cd "arm64/libevent-$LIBEVENT_VERSION" patch -p0 < ../../patch/libevent/regress.c.patch ./configure \ - LDFLAGS="-L$PWD/../openssl-$OPENSSL_VERSION/root/lib --target=arm64-apple-macos11" \ - CPPFLAGS="-I$PWD/../openssl-$OPENSSL_VERSION/include --target=arm64-apple-macos11" \ - --prefix="$PWD/install" \ - --disable-openssl \ - --disable-shared \ - --enable-static \ - --host=arm-apple-darwin \ - --disable-clock-gettime \ - --with-pic + LDFLAGS="-L$PWD/../openssl-$OPENSSL_VERSION/root/lib --target=arm64-apple-macos11" \ + CPPFLAGS="-I$PWD/../openssl-$OPENSSL_VERSION/include --target=arm64-apple-macos11" \ + --prefix="$PWD/install" \ + --disable-openssl \ + --disable-shared \ + --enable-static \ + --host=arm-apple-darwin \ + --disable-clock-gettime \ + --with-pic make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install cd ../../ @@ -82,25 +82,25 @@ tar -xvzf "tor-$TOR_VERSION.tar.gz" -C arm64 cd "arm64/tor-$TOR_VERSION" patch -p0 < ../../patch/tor/test_slow.c.patch ./configure \ - LDFLAGS="--target=arm64-apple-macos11 -L$XCODE_LIB" \ - CPPFLAGS="--target=arm64-apple-macos11 -I$XCODE_INCLUDE" \ - --prefix="$PWD/root" \ - --enable-static-libevent \ - --enable-static-openssl \ - --enable-static-zlib \ - --with-libevent-dir="$PWD/../libevent-$LIBEVENT_VERSION/install" \ - --with-openssl-dir="$PWD/../openssl-$OPENSSL_VERSION/root" \ - --with-zlib-dir="$PWD/../zlib-$ZLIB_VERSION/root" \ - --disable-asciidoc \ - --disable-html-manual \ - --disable-lzma \ - --disable-manpage \ - --disable-zstd \ - --disable-module-relay \ - --disable-module-dirauth \ - --host=arm-apple-darwin \ - --disable-tool-name-check \ - ac_cv_func_getentropy=no \ - ac_cv_func_clock_gettime=no + LDFLAGS="--target=arm64-apple-macos11 -L$XCODE_LIB" \ + CPPFLAGS="--target=arm64-apple-macos11 -I$XCODE_INCLUDE" \ + --prefix="$PWD/root" \ + --enable-static-libevent \ + --enable-static-openssl \ + --enable-static-zlib \ + --with-libevent-dir="$PWD/../libevent-$LIBEVENT_VERSION/install" \ + --with-openssl-dir="$PWD/../openssl-$OPENSSL_VERSION/root" \ + --with-zlib-dir="$PWD/../zlib-$ZLIB_VERSION/root" \ + --disable-asciidoc \ + --disable-html-manual \ + --disable-lzma \ + --disable-manpage \ + --disable-zstd \ + --disable-module-relay \ + --disable-module-dirauth \ + --host=arm-apple-darwin \ + --disable-tool-name-check \ + ac_cv_func_getentropy=no \ + ac_cv_func_clock_gettime=no make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install cd ../../ diff --git a/build_darwin_x86_64.sh b/build_darwin_x86_64.sh index d1e885c..73aa6f2 100755 --- a/build_darwin_x86_64.sh +++ b/build_darwin_x86_64.sh @@ -27,34 +27,34 @@ cd ../../ tar -xvzf "openssl-$OPENSSL_VERSION.tar.gz" -C x86_64 cd "x86_64/openssl-$OPENSSL_VERSION" ./Configure --prefix="$PWD/root" \ - darwin64-x86_64-cc \ - no-apps \ - no-cmp \ - no-cms \ - no-comp \ - no-ct \ - no-dgram \ - no-docs \ - no-dso \ - no-ec2m \ - no-engine \ - no-http \ - no-legacy \ - no-module \ - no-nextprotoneg \ - no-ocsp \ - no-padlockeng \ - no-psk \ - no-quic \ - no-rfc3779 \ - no-shared \ - no-srp \ - no-srtp \ - no-ssl-trace \ - no-static-engine \ - no-ts \ - no-ui-console \ - no-uplink + darwin64-x86_64-cc \ + no-apps \ + no-cmp \ + no-cms \ + no-comp \ + no-ct \ + no-dgram \ + no-docs \ + no-dso \ + no-ec2m \ + no-engine \ + no-http \ + no-legacy \ + no-module \ + no-nextprotoneg \ + no-ocsp \ + no-padlockeng \ + no-psk \ + no-quic \ + no-rfc3779 \ + no-shared \ + no-srp \ + no-srtp \ + no-ssl-trace \ + no-static-engine \ + no-ts \ + no-ui-console \ + no-uplink make ${jobs:+-j${jobs}} && make test && make install cd ../../ @@ -66,14 +66,14 @@ tar -zxvf "libevent-$LIBEVENT_VERSION.tar.gz" -C x86_64 cd "x86_64/libevent-$LIBEVENT_VERSION" patch -p0 < ../../patch/libevent/regress.c.patch ./configure \ - LDFLAGS="-L$PWD/../openssl-$OPENSSL_VERSION/root/lib" \ - CPPFLAGS="-I$PWD/../openssl-$OPENSSL_VERSION/include" \ - --prefix="$PWD/install" \ - --disable-openssl \ - --disable-shared \ - --enable-static \ - --disable-clock-gettime \ - --with-pic + LDFLAGS="-L$PWD/../openssl-$OPENSSL_VERSION/root/lib" \ + CPPFLAGS="-I$PWD/../openssl-$OPENSSL_VERSION/include" \ + --prefix="$PWD/install" \ + --disable-openssl \ + --disable-shared \ + --enable-static \ + --disable-clock-gettime \ + --with-pic make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install cd ../../ @@ -81,23 +81,23 @@ tar -xvzf "tor-$TOR_VERSION.tar.gz" -C x86_64 cd "x86_64/tor-$TOR_VERSION" patch -p0 < ../../patch/tor/test_slow.c.patch ./configure \ - LDFLAGS="-L$XCODE_LIB" \ - CPPFLAGS="-I$XCODE_INCLUDE" \ - --prefix="$PWD/root" \ - --enable-static-libevent \ - --enable-static-openssl \ - --enable-static-zlib \ - --with-libevent-dir="$PWD/../libevent-$LIBEVENT_VERSION/install" \ - --with-openssl-dir="$PWD/../openssl-$OPENSSL_VERSION/root" \ - --with-zlib-dir="$PWD/../zlib-$ZLIB_VERSION/root" \ - --disable-asciidoc \ - --disable-html-manual \ - --disable-lzma \ - --disable-manpage \ - --disable-zstd \ - --disable-module-relay \ - --disable-module-dirauth \ - ac_cv_func_getentropy=no \ - ac_cv_func_clock_gettime=no + LDFLAGS="-L$XCODE_LIB" \ + CPPFLAGS="-I$XCODE_INCLUDE" \ + --prefix="$PWD/root" \ + --enable-static-libevent \ + --enable-static-openssl \ + --enable-static-zlib \ + --with-libevent-dir="$PWD/../libevent-$LIBEVENT_VERSION/install" \ + --with-openssl-dir="$PWD/../openssl-$OPENSSL_VERSION/root" \ + --with-zlib-dir="$PWD/../zlib-$ZLIB_VERSION/root" \ + --disable-asciidoc \ + --disable-html-manual \ + --disable-lzma \ + --disable-manpage \ + --disable-zstd \ + --disable-module-relay \ + --disable-module-dirauth \ + ac_cv_func_getentropy=no \ + ac_cv_func_clock_gettime=no make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install cd ../../ From 9f955e26bab10ebf7201b002cd598aee43976f59 Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Wed, 1 Oct 2025 16:07:46 -0700 Subject: [PATCH 12/20] nit: Add missing brackets --- build_darwin_x86_64.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build_darwin_x86_64.sh b/build_darwin_x86_64.sh index 73aa6f2..bf8120a 100755 --- a/build_darwin_x86_64.sh +++ b/build_darwin_x86_64.sh @@ -21,7 +21,7 @@ rm -rf x86_64 && mkdir x86_64 tar -xvzf "zlib-$ZLIB_VERSION.tar.gz" -C x86_64 cd "x86_64/zlib-$ZLIB_VERSION" ./configure --prefix="$PWD/root" -make ${jobs:+-j${jobs}} && make ${jobs:+-j$jobs} check && make install +make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install cd ../../ tar -xvzf "openssl-$OPENSSL_VERSION.tar.gz" -C x86_64 From a929e2079923938932acae23543adf85e32bc81a Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Wed, 1 Oct 2025 16:09:07 -0700 Subject: [PATCH 13/20] Harmonize tor build flags between all mac builds --- build_darwin_x86_64.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/build_darwin_x86_64.sh b/build_darwin_x86_64.sh index bf8120a..a3a4a71 100755 --- a/build_darwin_x86_64.sh +++ b/build_darwin_x86_64.sh @@ -97,6 +97,7 @@ patch -p0 < ../../patch/tor/test_slow.c.patch --disable-zstd \ --disable-module-relay \ --disable-module-dirauth \ + --disable-tool-name-check \ ac_cv_func_getentropy=no \ ac_cv_func_clock_gettime=no make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install From 881dc9327d4f31a3ebc81c8771beab3d032b1670 Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Wed, 1 Oct 2025 16:12:51 -0700 Subject: [PATCH 14/20] Move build platform into a shell variable --- build_darwin_arm64.sh | 39 +++++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 18 deletions(-) diff --git a/build_darwin_arm64.sh b/build_darwin_arm64.sh index 5cd9477..cbe61bf 100755 --- a/build_darwin_arm64.sh +++ b/build_darwin_arm64.sh @@ -1,6 +1,9 @@ #!/bin/sh -eu -echo "running build_darwin_arm64.sh..." +BUILD_CPU=arm64 +BUILD_HOST=arm-apple-darwin + +echo "running build_darwin_$BUILD_CPU.sh..." SDK_PATH=$(xcrun --show-sdk-path) XCODE_LIB="$SDK_PATH/usr/lib/" @@ -16,18 +19,18 @@ else jobs=$(sysctl -n hw.logicalcpu_max) fi -rm -rf arm64 && mkdir arm64 +rm -rf $BUILD_CPU && mkdir $BUILD_CPU -tar -xvzf "zlib-$ZLIB_VERSION.tar.gz" -C arm64 -cd "arm64/zlib-$ZLIB_VERSION" -CFLAGS="-target arm64-apple-macos11" LDFLAGS="-target arm64-apple-macos11" ./configure --prefix="$PWD/root" +tar -xvzf "zlib-$ZLIB_VERSION.tar.gz" -C $BUILD_CPU +cd "$BUILD_CPU/zlib-$ZLIB_VERSION" +CFLAGS="-target $BUILD_CPU-apple-macos11" LDFLAGS="-target $BUILD_CPU-apple-macos11" ./configure --prefix="$PWD/root" make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install cd ../../ -tar -xvzf "openssl-$OPENSSL_VERSION.tar.gz" -C arm64 -cd "arm64/openssl-$OPENSSL_VERSION" +tar -xvzf "openssl-$OPENSSL_VERSION.tar.gz" -C $BUILD_CPU +cd "$BUILD_CPU/openssl-$OPENSSL_VERSION" ./Configure --prefix="$PWD/root" \ - darwin64-arm64-cc \ + darwin64-$BUILD_CPU-cc \ no-apps \ no-cmp \ no-cms \ @@ -62,28 +65,28 @@ cd ../../ #they forgot to decorate them with appropriate AVAILABLE_MAC_OS_VERSION checks. #So we have to explicitly disable them for binaries to work on MacOS 10.11. -tar -zxvf "libevent-$LIBEVENT_VERSION.tar.gz" -C arm64 -cd "arm64/libevent-$LIBEVENT_VERSION" +tar -zxvf "libevent-$LIBEVENT_VERSION.tar.gz" -C $BUILD_CPU +cd "$BUILD_CPU/libevent-$LIBEVENT_VERSION" patch -p0 < ../../patch/libevent/regress.c.patch ./configure \ - LDFLAGS="-L$PWD/../openssl-$OPENSSL_VERSION/root/lib --target=arm64-apple-macos11" \ - CPPFLAGS="-I$PWD/../openssl-$OPENSSL_VERSION/include --target=arm64-apple-macos11" \ + LDFLAGS="-L$PWD/../openssl-$OPENSSL_VERSION/root/lib --target=$BUILD_CPU-apple-macos11" \ + CPPFLAGS="-I$PWD/../openssl-$OPENSSL_VERSION/include --target=$BUILD_CPU-apple-macos11" \ --prefix="$PWD/install" \ --disable-openssl \ --disable-shared \ --enable-static \ - --host=arm-apple-darwin \ + --host=$BUILD_HOST \ --disable-clock-gettime \ --with-pic make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install cd ../../ -tar -xvzf "tor-$TOR_VERSION.tar.gz" -C arm64 -cd "arm64/tor-$TOR_VERSION" +tar -xvzf "tor-$TOR_VERSION.tar.gz" -C $BUILD_CPU +cd "$BUILD_CPU/tor-$TOR_VERSION" patch -p0 < ../../patch/tor/test_slow.c.patch ./configure \ - LDFLAGS="--target=arm64-apple-macos11 -L$XCODE_LIB" \ - CPPFLAGS="--target=arm64-apple-macos11 -I$XCODE_INCLUDE" \ + LDFLAGS="--target=$BUILD_CPU-apple-macos11 -L$XCODE_LIB" \ + CPPFLAGS="--target=$BUILD_CPU-apple-macos11 -I$XCODE_INCLUDE" \ --prefix="$PWD/root" \ --enable-static-libevent \ --enable-static-openssl \ @@ -98,7 +101,7 @@ patch -p0 < ../../patch/tor/test_slow.c.patch --disable-zstd \ --disable-module-relay \ --disable-module-dirauth \ - --host=arm-apple-darwin \ + --host=$BUILD_HOST \ --disable-tool-name-check \ ac_cv_func_getentropy=no \ ac_cv_func_clock_gettime=no From fcabae625e2c34e15ada92152276ca8b392068d0 Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Thu, 2 Oct 2025 10:48:10 -0700 Subject: [PATCH 15/20] Temporarily disable tor tests on arm64-apple-darwin FAIL: src/test/unittest_part8.sh util/monotonic_time_add_msec: FAIL src/test/test_util.c:6644: assert(monotime_coarse_diff_msec32_(&ct1, &ct2) OP_GT 1323): 1310 vs 1323 [monotonic_time_add_msec FAILED] Filed brave/tor_build_scripts#155 to re-enable later. --- build_darwin_arm64.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build_darwin_arm64.sh b/build_darwin_arm64.sh index cbe61bf..90903c4 100755 --- a/build_darwin_arm64.sh +++ b/build_darwin_arm64.sh @@ -105,5 +105,5 @@ patch -p0 < ../../patch/tor/test_slow.c.patch --disable-tool-name-check \ ac_cv_func_getentropy=no \ ac_cv_func_clock_gettime=no -make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install +make ${jobs:+-j${jobs}} && make install cd ../../ From 5ab4bea2f2dd57e28c09c384d9eded910b9372a6 Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Thu, 2 Oct 2025 11:30:00 -0700 Subject: [PATCH 16/20] Cross-compile for x86_64 too --- build_darwin_x86_64.sh | 37 +++++++++++++++++++++---------------- 1 file changed, 21 insertions(+), 16 deletions(-) diff --git a/build_darwin_x86_64.sh b/build_darwin_x86_64.sh index a3a4a71..f4d5b22 100755 --- a/build_darwin_x86_64.sh +++ b/build_darwin_x86_64.sh @@ -1,6 +1,9 @@ #!/bin/sh -eu -echo "running build_darwin_x86_64.sh..." +BUILD_CPU=x86_64 +BUILD_HOST=x86_64 + +echo "running build_darwin_$BUILD_CPU.sh..." SDK_PATH=$(xcrun --show-sdk-path) XCODE_LIB="$SDK_PATH/usr/lib/" @@ -16,18 +19,18 @@ else jobs=$(sysctl -n hw.logicalcpu_max) fi -rm -rf x86_64 && mkdir x86_64 +rm -rf $BUILD_CPU && mkdir $BUILD_CPU -tar -xvzf "zlib-$ZLIB_VERSION.tar.gz" -C x86_64 -cd "x86_64/zlib-$ZLIB_VERSION" -./configure --prefix="$PWD/root" +tar -xvzf "zlib-$ZLIB_VERSION.tar.gz" -C $BUILD_CPU +cd "$BUILD_CPU/zlib-$ZLIB_VERSION" +CFLAGS="-target $BUILD_CPU-apple-macos11" LDFLAGS="-target $BUILD_CPU-apple-macos11" ./configure --prefix="$PWD/root" make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install cd ../../ -tar -xvzf "openssl-$OPENSSL_VERSION.tar.gz" -C x86_64 -cd "x86_64/openssl-$OPENSSL_VERSION" +tar -xvzf "openssl-$OPENSSL_VERSION.tar.gz" -C $BUILD_CPU +cd "$BUILD_CPU/openssl-$OPENSSL_VERSION" ./Configure --prefix="$PWD/root" \ - darwin64-x86_64-cc \ + darwin64-$BUILD_CPU-cc \ no-apps \ no-cmp \ no-cms \ @@ -62,27 +65,28 @@ cd ../../ #they forgot to decorate them with appropriate AVAILABLE_MAC_OS_VERSION checks. #So we have to explicitly disable them for binaries to work on MacOS 10.11. -tar -zxvf "libevent-$LIBEVENT_VERSION.tar.gz" -C x86_64 -cd "x86_64/libevent-$LIBEVENT_VERSION" +tar -zxvf "libevent-$LIBEVENT_VERSION.tar.gz" -C $BUILD_CPU +cd "$BUILD_CPU/libevent-$LIBEVENT_VERSION" patch -p0 < ../../patch/libevent/regress.c.patch ./configure \ - LDFLAGS="-L$PWD/../openssl-$OPENSSL_VERSION/root/lib" \ - CPPFLAGS="-I$PWD/../openssl-$OPENSSL_VERSION/include" \ + LDFLAGS="-L$PWD/../openssl-$OPENSSL_VERSION/root/lib --target=$BUILD_CPU-apple-macos11" \ + CPPFLAGS="-I$PWD/../openssl-$OPENSSL_VERSION/include --target=$BUILD_CPU-apple-macos11" \ --prefix="$PWD/install" \ --disable-openssl \ --disable-shared \ --enable-static \ + --host=$BUILD_HOST \ --disable-clock-gettime \ --with-pic make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install cd ../../ -tar -xvzf "tor-$TOR_VERSION.tar.gz" -C x86_64 -cd "x86_64/tor-$TOR_VERSION" +tar -xvzf "tor-$TOR_VERSION.tar.gz" -C $BUILD_CPU +cd "$BUILD_CPU/tor-$TOR_VERSION" patch -p0 < ../../patch/tor/test_slow.c.patch ./configure \ - LDFLAGS="-L$XCODE_LIB" \ - CPPFLAGS="-I$XCODE_INCLUDE" \ + LDFLAGS="--target=$BUILD_CPU-apple-macos11 -L$XCODE_LIB" \ + CPPFLAGS="--target=$BUILD_CPU-apple-macos11 -I$XCODE_INCLUDE" \ --prefix="$PWD/root" \ --enable-static-libevent \ --enable-static-openssl \ @@ -97,6 +101,7 @@ patch -p0 < ../../patch/tor/test_slow.c.patch --disable-zstd \ --disable-module-relay \ --disable-module-dirauth \ + --host=$BUILD_HOST \ --disable-tool-name-check \ ac_cv_func_getentropy=no \ ac_cv_func_clock_gettime=no From 1e6b7b07fdf2836eff7493699a910f0f743c1ff2 Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Thu, 2 Oct 2025 11:42:11 -0700 Subject: [PATCH 17/20] Temporarily disable libevent tests on macOS FAILED regress_debug: OKAY regress_debug: http/data_length_constraints: FAIL test/regress_http.c:1343: assert(!req) [data_length_constraints FAILED] OKAY 1/296 TESTS FAILED. (41 skipped) FAILED Filed brave/tor_build_scripts#156 to re-enable later. --- build_darwin_arm64.sh | 2 +- build_darwin_x86_64.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build_darwin_arm64.sh b/build_darwin_arm64.sh index 90903c4..ec82fb8 100755 --- a/build_darwin_arm64.sh +++ b/build_darwin_arm64.sh @@ -78,7 +78,7 @@ patch -p0 < ../../patch/libevent/regress.c.patch --host=$BUILD_HOST \ --disable-clock-gettime \ --with-pic -make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install +make ${jobs:+-j${jobs}} && make install cd ../../ tar -xvzf "tor-$TOR_VERSION.tar.gz" -C $BUILD_CPU diff --git a/build_darwin_x86_64.sh b/build_darwin_x86_64.sh index f4d5b22..65ff251 100755 --- a/build_darwin_x86_64.sh +++ b/build_darwin_x86_64.sh @@ -78,7 +78,7 @@ patch -p0 < ../../patch/libevent/regress.c.patch --host=$BUILD_HOST \ --disable-clock-gettime \ --with-pic -make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install +make ${jobs:+-j${jobs}} && make install cd ../../ tar -xvzf "tor-$TOR_VERSION.tar.gz" -C $BUILD_CPU From 236537de97f2e01e86f3bc7505844de1f3e99bef Mon Sep 17 00:00:00 2001 From: brave-builds Date: Thu, 2 Oct 2025 23:05:55 +0000 Subject: [PATCH 18/20] tor update --- env.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/env.sh b/env.sh index 3d31535..1f814f7 100755 --- a/env.sh +++ b/env.sh @@ -6,15 +6,15 @@ export MACOSX_DEPLOYMENT_TARGET=10.15 # Reset version number to zero everytime TOR_VERSION changes. export BRAVE_TOR_VERSION="0" -export TOR_VERSION="0.4.8.14" +export TOR_VERSION="0.4.8.18" export ZLIB_VERSION="1.3.1" export LIBEVENT_VERSION="2.1.12-stable" -export OPENSSL_VERSION="3.4.1" +export OPENSSL_VERSION="3.6.0" export ZLIB_HASH="9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23" export LIBEVENT_HASH=92e6de1be9ec176428fd2367677e61ceffc2ee1cb119035037a27d346b0403bb -export OPENSSL_HASH="002a2d6b30b58bf4bea46c43bdd96365aaf8daa6c428782aa4feee06da197df3" -export TOR_HASH="5047e1ded12d9aac4eb858f7634a627714dd58ce99053d517691a4b304a66d10" +export OPENSSL_HASH="b6a5f44b7eb69e3fa35dbf15524405b44837a481d43d81daddde3ff21fcbb8e9" +export TOR_HASH="4aea6c109d4eff4ea2bafb905a7e6b0a965d14fe856214b02fcd9046b4d93af8" export DOCKER="$(command -v docker || command -v podman)" From d2f50e65a29aa36210c40e0f0c06df9777f248f0 Mon Sep 17 00:00:00 2001 From: Francois Marier Date: Fri, 3 Oct 2025 14:52:45 -0700 Subject: [PATCH 19/20] Disable failing libevent test and re-enable the rest (fixes #156) --- build_darwin_arm64.sh | 3 ++- build_darwin_x86_64.sh | 3 ++- patch/libevent/regress_http.c.patch | 14 ++++++++++++++ 3 files changed, 18 insertions(+), 2 deletions(-) create mode 100644 patch/libevent/regress_http.c.patch diff --git a/build_darwin_arm64.sh b/build_darwin_arm64.sh index ec82fb8..09aaa3e 100755 --- a/build_darwin_arm64.sh +++ b/build_darwin_arm64.sh @@ -68,6 +68,7 @@ cd ../../ tar -zxvf "libevent-$LIBEVENT_VERSION.tar.gz" -C $BUILD_CPU cd "$BUILD_CPU/libevent-$LIBEVENT_VERSION" patch -p0 < ../../patch/libevent/regress.c.patch +patch -p0 < ../../patch/libevent/regress_http.c.patch ./configure \ LDFLAGS="-L$PWD/../openssl-$OPENSSL_VERSION/root/lib --target=$BUILD_CPU-apple-macos11" \ CPPFLAGS="-I$PWD/../openssl-$OPENSSL_VERSION/include --target=$BUILD_CPU-apple-macos11" \ @@ -78,7 +79,7 @@ patch -p0 < ../../patch/libevent/regress.c.patch --host=$BUILD_HOST \ --disable-clock-gettime \ --with-pic -make ${jobs:+-j${jobs}} && make install +make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install cd ../../ tar -xvzf "tor-$TOR_VERSION.tar.gz" -C $BUILD_CPU diff --git a/build_darwin_x86_64.sh b/build_darwin_x86_64.sh index 65ff251..f889866 100755 --- a/build_darwin_x86_64.sh +++ b/build_darwin_x86_64.sh @@ -68,6 +68,7 @@ cd ../../ tar -zxvf "libevent-$LIBEVENT_VERSION.tar.gz" -C $BUILD_CPU cd "$BUILD_CPU/libevent-$LIBEVENT_VERSION" patch -p0 < ../../patch/libevent/regress.c.patch +patch -p0 < ../../patch/libevent/regress_http.c.patch ./configure \ LDFLAGS="-L$PWD/../openssl-$OPENSSL_VERSION/root/lib --target=$BUILD_CPU-apple-macos11" \ CPPFLAGS="-I$PWD/../openssl-$OPENSSL_VERSION/include --target=$BUILD_CPU-apple-macos11" \ @@ -78,7 +79,7 @@ patch -p0 < ../../patch/libevent/regress.c.patch --host=$BUILD_HOST \ --disable-clock-gettime \ --with-pic -make ${jobs:+-j${jobs}} && make install +make ${jobs:+-j${jobs}} && make ${jobs:+-j${jobs}} check && make install cd ../../ tar -xvzf "tor-$TOR_VERSION.tar.gz" -C $BUILD_CPU diff --git a/patch/libevent/regress_http.c.patch b/patch/libevent/regress_http.c.patch new file mode 100644 index 0000000..4361894 --- /dev/null +++ b/patch/libevent/regress_http.c.patch @@ -0,0 +1,14 @@ +Description: Disable test failing on macOS +Last-Update: 2025-10-03 +Bug-Brave: https://github.com/brave/tor_build_scripts/issues/156 + +--- test/regress_http.c.orig 2025-10-03 14:43:40.534171434 -0700 ++++ test/regress_http.c 2025-10-03 14:43:57.036915079 -0700 +@@ -4759,7 +4759,6 @@ + { "connection_retry_conn_address", http_connection_retry_conn_address_test, + TT_ISOLATED|TT_OFF_BY_DEFAULT, &basic_setup, NULL }, + +- HTTP(data_length_constraints), + HTTP(read_on_write_error), + HTTP(non_lingering_close), + HTTP(lingering_close), From 53800a7750aaced9d149da8eaf4435bd66ae0ccc Mon Sep 17 00:00:00 2001 From: brave-builds Date: Mon, 6 Oct 2025 17:11:26 +0000 Subject: [PATCH 20/20] tor update --- env.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/env.sh b/env.sh index 1f814f7..35e6f09 100755 --- a/env.sh +++ b/env.sh @@ -6,7 +6,7 @@ export MACOSX_DEPLOYMENT_TARGET=10.15 # Reset version number to zero everytime TOR_VERSION changes. export BRAVE_TOR_VERSION="0" -export TOR_VERSION="0.4.8.18" +export TOR_VERSION="0.4.8.19" export ZLIB_VERSION="1.3.1" export LIBEVENT_VERSION="2.1.12-stable" @@ -15,6 +15,6 @@ export OPENSSL_VERSION="3.6.0" export ZLIB_HASH="9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23" export LIBEVENT_HASH=92e6de1be9ec176428fd2367677e61ceffc2ee1cb119035037a27d346b0403bb export OPENSSL_HASH="b6a5f44b7eb69e3fa35dbf15524405b44837a481d43d81daddde3ff21fcbb8e9" -export TOR_HASH="4aea6c109d4eff4ea2bafb905a7e6b0a965d14fe856214b02fcd9046b4d93af8" +export TOR_HASH="3cb649a1d33ba6a65f109d224534e93aaf0a6de84a5b1cb4b054bfa06bb74f5a" export DOCKER="$(command -v docker || command -v podman)"