From efb425046d8e333ef94752aa1b737f116137cb57 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Tue, 11 Apr 2023 16:46:39 -0400
Subject: [PATCH 01/31] Initial prototypes for new X.509 certificate support
 (Issue #53)

---
 cups/cups.h        |  4 +++-
 cups/tls-openssl.c | 25 ++++++++++++++++++-------
 2 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/cups/cups.h b/cups/cups.h
index 6450230ea..60afe5f54 100644
--- a/cups/cups.h
+++ b/cups/cups.h
@@ -336,7 +336,8 @@ extern const char	*cupsLocalizeDestMedia(http_t *http, cups_dest_t *dest, cups_d
 extern const char	*cupsLocalizeDestOption(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, const char *option) _CUPS_PUBLIC;
 extern const char	*cupsLocalizeDestValue(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, const char *option, const char *value) _CUPS_PUBLIC;
 
-extern int		cupsMakeServerCredentials(const char *path, const char *common_name, int num_alt_names, const char **alt_names, time_t expiration_date) _CUPS_PUBLIC;
+extern bool		cupsMakeServerCredentials(const char *path, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *root_name, const char *common_name, int num_alt_names, const char **alt_names, time_t expiration_date) _CUPS_PUBLIC;
+extern char		*cupsMakeServerRequest(const char *path, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name, int num_alt_names, const char **alt_names) _CUPS_PUBLIC;
 
 extern char		*cupsNotifySubject(cups_lang_t *lang, ipp_t *event) _CUPS_PUBLIC;
 extern char		*cupsNotifyText(cups_lang_t *lang, ipp_t *event) _CUPS_PUBLIC;
@@ -349,6 +350,7 @@ extern ssize_t		cupsReadResponseData(http_t *http, char *buffer, size_t length)
 extern size_t		cupsRemoveDest(const char *name, const char *instance, size_t num_dests, cups_dest_t **dests) _CUPS_PUBLIC;
 extern size_t		cupsRemoveOption(const char *name, size_t num_options, cups_option_t **options) _CUPS_PUBLIC;
 
+extern bool		cupsSaveServerCredentials(const char *path, const char *pem) _CUPS_PUBLIC;
 extern http_status_t	cupsSendRequest(http_t *http, ipp_t *request, const char *resource, size_t length) _CUPS_PUBLIC;
 extern void		cupsSetOAuthCB(cups_oauth_cb_t cb, void *data) _CUPS_PUBLIC;
 extern void		cupsSetClientCertCB(cups_client_cert_cb_t cb, void *user_data) _CUPS_PUBLIC;
diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index 258b4eee7..4fc17ff48 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -64,9 +64,15 @@ static int		tls_options = -1,/* Options for TLS connections */
  * 'cupsMakeServerCredentials()' - Make a self-signed certificate and private key pair.
  */
 
-int					// O - 1 on success, 0 on failure
+bool					// O - `true` on success, `false` on failure
 cupsMakeServerCredentials(
-    const char *path,			// I - Path to keychain/directory
+    const char *path,			// I - Path to keychain/directory or `NULL` for default
+    const char *organization,		// I - Organization or `NULL` to use common name
+    const char *org_unit,		// I - Organizational unit or `NULL` for none
+    const char *locality,		// I - City/town or `NULL` for "Unknown"
+    const char *state_province,		// I - State/province or `NULL` for "Unknown"
+    const char *country,		// I - Country or `NULL` for locale-based default
+    const char *root_name,		// I - Root certificate/domain name or `NULL` for site/self-signed
     const char *common_name,		// I - Common name
     int        num_alt_names,		// I - Number of subject alternate names
     const char **alt_names,		// I - Subject Alternate Names
@@ -177,16 +183,19 @@ cupsMakeServerCredentials(
   language = cupsLangDefault();
   langname = cupsLangGetName(language);
   name     = X509_NAME_new();
-  if (strlen(langname) == 5)
+  if (country)
+    X509_NAME_add_entry_by_txt(name, SN_countryName, MBSTRING_ASC, (unsigned char *)country, -1, -1, 0);
+  else if (strlen(langname) == 5)
     X509_NAME_add_entry_by_txt(name, SN_countryName, MBSTRING_ASC, (unsigned char *)langname + 3, -1, -1, 0);
   else
     X509_NAME_add_entry_by_txt(name, SN_countryName, MBSTRING_ASC, (unsigned char *)"US", -1, -1, 0);
   X509_NAME_add_entry_by_txt(name, SN_commonName, MBSTRING_ASC, (unsigned char *)common_name, -1, -1, 0);
-  X509_NAME_add_entry_by_txt(name, SN_organizationName, MBSTRING_ASC, (unsigned char *)common_name, -1, -1, 0);
-  X509_NAME_add_entry_by_txt(name, SN_organizationalUnitName, MBSTRING_ASC, (unsigned char *)"Unknown", -1, -1, 0);
-  X509_NAME_add_entry_by_txt(name, SN_stateOrProvinceName, MBSTRING_ASC, (unsigned char *)"Unknown", -1, -1, 0);
-  X509_NAME_add_entry_by_txt(name, SN_localityName, MBSTRING_ASC, (unsigned char *)"Unknown", -1, -1, 0);
+  X509_NAME_add_entry_by_txt(name, SN_organizationName, MBSTRING_ASC, (unsigned char *)(organization ? organization : common_name), -1, -1, 0);
+  X509_NAME_add_entry_by_txt(name, SN_organizationalUnitName, MBSTRING_ASC, (unsigned char *)(org_unit ? org_unit : ""), -1, -1, 0);
+  X509_NAME_add_entry_by_txt(name, SN_stateOrProvinceName, MBSTRING_ASC, (unsigned char *)(state_province ? state_province : "Unknown"), -1, -1, 0);
+  X509_NAME_add_entry_by_txt(name, SN_localityName, MBSTRING_ASC, (unsigned char *)(locality ? locality : "Unknown"), -1, -1, 0);
 
+  // TODO set issuer name to CA subject name (X509_get_subject_name)
   X509_set_issuer_name(cert, name);
   X509_set_subject_name(cert, name);
   X509_NAME_free(name);
@@ -218,6 +227,7 @@ cupsMakeServerCredentials(
   }
 
   // Add extensions that are required to make Chrome happy...
+  // TODO: Support creating CA certs
   http_x509_add_ext(cert, NID_basic_constraints, "critical,CA:FALSE,pathlen:0");
   http_x509_add_ext(cert, NID_key_usage, "critical,digitalSignature,keyEncipherment");
   http_x509_add_ext(cert, NID_ext_key_usage, "1.3.6.1.5.5.7.3.1");
@@ -225,6 +235,7 @@ cupsMakeServerCredentials(
   http_x509_add_ext(cert, NID_authority_key_identifier, "keyid,issuer");
   X509_set_version(cert, 2); // v3
 
+  // TODO: Sign with CA key when available
   X509_sign(cert, pkey, EVP_sha256());
 
   // Save them...

From 3da4b2f67d1818cd12c4cad18151bde152df4c8d Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Fri, 14 Apr 2023 10:12:11 -0400
Subject: [PATCH 02/31] Save work on new cupsMakeCredentials.

---
 cups/cups.h        |   6 +-
 cups/http.h        |   4 +-
 cups/testcreds.c   |   4 +-
 cups/testhttp.c    |   2 +-
 cups/tls-openssl.c | 377 +++++++++++++++++++++++++--------------------
 5 files changed, 222 insertions(+), 171 deletions(-)

diff --git a/cups/cups.h b/cups/cups.h
index 60afe5f54..1383713f8 100644
--- a/cups/cups.h
+++ b/cups/cups.h
@@ -336,8 +336,8 @@ extern const char	*cupsLocalizeDestMedia(http_t *http, cups_dest_t *dest, cups_d
 extern const char	*cupsLocalizeDestOption(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, const char *option) _CUPS_PUBLIC;
 extern const char	*cupsLocalizeDestValue(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, const char *option, const char *value) _CUPS_PUBLIC;
 
-extern bool		cupsMakeServerCredentials(const char *path, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *root_name, const char *common_name, int num_alt_names, const char **alt_names, time_t expiration_date) _CUPS_PUBLIC;
-extern char		*cupsMakeServerRequest(const char *path, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name, int num_alt_names, const char **alt_names) _CUPS_PUBLIC;
+extern bool		cupsMakeServerCredentials(const char *path, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *root_name, bool ca_cert, const char *common_name, size_t num_alt_names, const char **alt_names, time_t expiration_date) _CUPS_PUBLIC;
+extern char		*cupsMakeServerRequest(const char *path, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name, size_t num_alt_names, const char **alt_names) _CUPS_PUBLIC;
 
 extern char		*cupsNotifySubject(cups_lang_t *lang, ipp_t *event) _CUPS_PUBLIC;
 extern char		*cupsNotifyText(cups_lang_t *lang, ipp_t *event) _CUPS_PUBLIC;
@@ -361,7 +361,7 @@ extern void		cupsSetEncryption(http_encryption_t e) _CUPS_PUBLIC;
 extern void		cupsSetPasswordCB(cups_password_cb_t cb, void *user_data) _CUPS_PUBLIC;
 extern void		cupsSetServer(const char *server) _CUPS_PUBLIC;
 extern void		cupsSetServerCertCB(cups_server_cert_cb_t cb, void *user_data) _CUPS_PUBLIC;
-extern int		cupsSetServerCredentials(const char *path, const char *common_name, int auto_create) _CUPS_PUBLIC;
+extern bool		cupsSetServerCredentials(const char *path, const char *common_name, bool auto_create) _CUPS_PUBLIC;
 extern void		cupsSetUser(const char *user) _CUPS_PUBLIC;
 extern void		cupsSetUserAgent(const char *user_agent) _CUPS_PUBLIC;
 extern http_status_t	cupsStartDestDocument(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, int job_id, const char *docname, const char *format, size_t num_options, cups_option_t *options, bool last_document) _CUPS_PUBLIC;
diff --git a/cups/http.h b/cups/http.h
index 8f9dfbc9b..559e52aff 100644
--- a/cups/http.h
+++ b/cups/http.h
@@ -458,9 +458,9 @@ extern void		httpClose(http_t *http) _CUPS_PUBLIC;
 extern void		httpClearCookie(http_t *http) _CUPS_PUBLIC;
 extern bool		httpCompareCredentials(cups_array_t *cred1, cups_array_t *cred2) _CUPS_PUBLIC;
 extern http_t		*httpConnect(const char *host, int port, http_addrlist_t *addrlist, int family, http_encryption_t encryption, bool blocking, int msec, int *cancel) _CUPS_PUBLIC;
-extern int		httpCopyCredentials(http_t *http, cups_array_t **credentials) _CUPS_PUBLIC;
+extern bool		httpCopyCredentials(http_t *http, cups_array_t **credentials) _CUPS_PUBLIC;
 extern cups_array_t	*httpCreateCredentials(const void *data, size_t datalen) _CUPS_PUBLIC;
-extern int		httpCredentialsAreValidForName(cups_array_t *credentials, const char *common_name);
+extern bool		httpCredentialsAreValidForName(cups_array_t *credentials, const char *common_name);
 extern time_t		httpCredentialsGetExpiration(cups_array_t *credentials) _CUPS_PUBLIC;
 extern http_trust_t	httpCredentialsGetTrust(cups_array_t *credentials, const char *common_name) _CUPS_PUBLIC;
 extern size_t		httpCredentialsString(cups_array_t *credentials, char *buffer, size_t bufsize) _CUPS_PUBLIC;
diff --git a/cups/testcreds.c b/cups/testcreds.c
index deacbe03a..2ea765f5a 100644
--- a/cups/testcreds.c
+++ b/cups/testcreds.c
@@ -82,7 +82,7 @@ main(int  argc,				/* I - Number of command-line arguments */
       else
         printf("    Trust: %s (%s)\n", trusts[trust], cupsLastErrorString());
       printf("    Expiration: %s\n", httpGetDateString(httpCredentialsGetExpiration(hcreds), datestr, sizeof(datestr)));
-      printf("    IsValidName: %d\n", httpCredentialsAreValidForName(hcreds, hostname));
+      printf("    IsValidName: %s\n", httpCredentialsAreValidForName(hcreds, hostname) ? "true" : "false");
       printf("    String: \"%s\"\n", hinfo);
 
       httpFreeCredentials(hcreds);
@@ -109,7 +109,7 @@ main(int  argc,				/* I - Number of command-line arguments */
 
     printf("    Certificate Count: %u\n", (unsigned)cupsArrayGetCount(tcreds));
     printf("    Expiration: %s\n", httpGetDateString(httpCredentialsGetExpiration(tcreds), datestr, sizeof(datestr)));
-    printf("    IsValidName: %d\n", httpCredentialsAreValidForName(tcreds, hostname));
+    printf("    IsValidName: %s\n", httpCredentialsAreValidForName(tcreds, hostname) ? "true" : "false");
     printf("    String: \"%s\"\n", tinfo);
 
     httpFreeCredentials(tcreds);
diff --git a/cups/testhttp.c b/cups/testhttp.c
index 60afda9ba..161062683 100644
--- a/cups/testhttp.c
+++ b/cups/testhttp.c
@@ -675,7 +675,7 @@ main(int  argc,				/* I - Number of command-line arguments */
 	printf("Count: %u\n", (unsigned)cupsArrayGetCount(creds));
         printf("Trust: %s\n", trusts[trust]);
         printf("Expiration: %s\n", httpGetDateString(httpCredentialsGetExpiration(creds), expstr, sizeof(expstr)));
-        printf("IsValidName: %d\n", httpCredentialsAreValidForName(creds, hostname));
+        printf("IsValidName: %s\n", httpCredentialsAreValidForName(creds, hostname) ? "true" : "false");
         printf("String: \"%s\"\n", info);
 
 	printf("LoadCredentials: %s\n", httpLoadCredentials(NULL, &lcreds, hostname) ? "true" : "false");
diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index 4fc17ff48..ecf743d47 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -1,28 +1,24 @@
-/*
- * TLS support code for CUPS using OpenSSL/LibreSSL.
- *
- * Copyright © 2020-2022 by OpenPrinting
- * Copyright © 2007-2019 by Apple Inc.
- * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
- *
- * Licensed under Apache License v2.0.  See the file "LICENSE" for more
- * information.
- */
-
-/**** This file is included from tls.c ****/
-
-/*
- * Include necessary headers...
- */
+//
+// TLS support code for CUPS using OpenSSL/LibreSSL.
+//
+// Note: This file is included from tls.c
+//
+// Copyright © 2020-2023 by OpenPrinting
+// Copyright © 2007-2019 by Apple Inc.
+// Copyright © 1997-2007 by Easy Software Products, all rights reserved.
+//
+// Licensed under Apache License v2.0.  See the file "LICENSE" for more
+// information.
+//
 
 #include <sys/stat.h>
 #include <openssl/x509v3.h>
 #define USE_EC 0			// Set to 1 to generate EC certs
 
 
-/*
- * Local functions...
- */
+//
+// Local functions...
+//
 
 static long		http_bio_ctrl(BIO *h, int cmd, long arg1, void *arg2);
 static int		http_bio_free(BIO *data);
@@ -37,14 +33,14 @@ static time_t		http_get_date(X509 *cert, int which);
 //static void		http_load_crl(void);
 static const char	*http_make_path(char *buffer, size_t bufsize, const char *dirname, const char *filename, const char *ext);
 static bool		http_x509_add_ext(X509 *cert, int nid, const char *value);
-static void		http_x509_add_san(X509 *cert, const char *name);
+static void		http_x509_add_san(GENERAL_NAMES *gens, const char *name);
 
 
-/*
- * Local globals...
- */
+//
+// Local globals...
+//
 
-static int		tls_auto_create = 0;
+static bool		tls_auto_create = false;
 					/* Auto-create self-signed certs? */
 static BIO_METHOD	*tls_bio_method = NULL;
 					/* OpenSSL BIO method */
@@ -73,12 +69,13 @@ cupsMakeServerCredentials(
     const char *state_province,		// I - State/province or `NULL` for "Unknown"
     const char *country,		// I - Country or `NULL` for locale-based default
     const char *root_name,		// I - Root certificate/domain name or `NULL` for site/self-signed
+    bool       ca_cert,			// I - Make CA certificate?
     const char *common_name,		// I - Common name
-    int        num_alt_names,		// I - Number of subject alternate names
+    size_t     num_alt_names,		// I - Number of subject alternate names
     const char **alt_names,		// I - Subject Alternate Names
     time_t     expiration_date)		// I - Expiration date
 {
-  int		result = 0;		// Return value
+  bool		result = false;		// Return value
   EVP_PKEY	*pkey;			// Private key
 #if defined(EVP_PKEY_EC) && USE_EC
   EC_KEY	*ec;			// EC key
@@ -86,6 +83,10 @@ cupsMakeServerCredentials(
   RSA		*rsa;			// RSA key pair
 #endif // EVP_PKEY_EC && USE_EC
   X509		*cert;			// Certificate
+  X509		*root_cert = NULL;	// Root certificate, if any
+  EVP_PKEY	*root_key = NULL;	// Root private key, if any
+  char		root_crtfile[1024],	// Path to root certificate
+		root_keyfile[1024];	// Path to root private key
   cups_lang_t	*language;		// Default language info
   const char	*langname;		// Language name
   time_t	curtime;		// Current time
@@ -97,9 +98,10 @@ cupsMakeServerCredentials(
   char		temp[1024],		// Temporary directory name
  		crtfile[1024],		// Certificate filename
 		keyfile[1024];		// Private key filename
+  GENERAL_NAMES *gens;			// Names for SubjectAltName certificate extension
 
 
-  DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, alt_names, (int)expiration_date));
+  DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", organization=\"%s\", org_unit=\"%s\", locality=\"%s\", state_province=\"%s\", country=\"%s\", common_name=\"%s\", num_alt_names=%u, alt_names=%p, expiration_date=%ld)", path, organization, org_unit, locality, state_province, country, common_name, (unsigned)num_alt_names, alt_names, (long)expiration_date));
 
   // Filenames...
   if (!path)
@@ -108,7 +110,7 @@ cupsMakeServerCredentials(
   if (!path || !common_name)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(EINVAL), 0);
-    return (0);
+    return (false);
   }
 
   http_make_path(crtfile, sizeof(crtfile), path, common_name, "crt");
@@ -121,13 +123,13 @@ cupsMakeServerCredentials(
   if ((ec = EC_KEY_new_by_curve_name(NID_secp384r1)) == NULL)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create key pair."), 1);
-    return (0);
+    return (false);
   }
 #else
   if ((rsa = RSA_generate_key(3072, RSA_F4, NULL, NULL)) == NULL)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create key pair."), 1);
-    return (0);
+    return (false);
   }
 #endif // EVP_PKEY_EC && USE_EC
 
@@ -140,7 +142,7 @@ cupsMakeServerCredentials(
 #endif // EVP_PKEY_EC && USE_EC
 
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create private key."), 1);
-    return (0);
+    return (false);
   }
 
 #if defined(EVP_PKEY_EC) && USE_EC
@@ -158,7 +160,7 @@ cupsMakeServerCredentials(
   {
     EVP_PKEY_free(pkey);
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create X.509 certificate."), 1);
-    return (0);
+    return (false);
   }
 
   curtime = time(NULL);
@@ -180,6 +182,33 @@ cupsMakeServerCredentials(
 
   X509_set_pubkey(cert, pkey);
 
+  // Try loading a root certificate...
+  http_make_path(root_crtfile, sizeof(root_crtfile), path, root_name ? root_name : "_site_", "crt");
+  http_make_path(root_keyfile, sizeof(root_keyfile), path, root_name ? root_name : "_site_", "key");
+
+  if (!ca_cert && !access(root_crtfile, 0) && !access(root_keyfile, 0))
+  {
+    if ((bio = BIO_new_file(root_crtfile, "rb")) != NULL)
+    {
+      PEM_read_bio_X509(bio, &root_cert, /*cb*/NULL, /*u*/NULL);
+      BIO_free(bio);
+
+      if ((bio = BIO_new_file(root_keyfile, "rb")) != NULL)
+      {
+	PEM_read_bio_PrivateKey(bio, &root_key, /*cb*/NULL, /*u*/NULL);
+	BIO_free(bio);
+      }
+
+      if (!root_key)
+      {
+        // Only use root certificate if we have the key...
+        X509_free(root_cert);
+        root_cert = NULL;
+      }
+    }
+
+  }
+
   language = cupsLangDefault();
   langname = cupsLangGetName(language);
   name     = X509_NAME_new();
@@ -196,47 +225,64 @@ cupsMakeServerCredentials(
   X509_NAME_add_entry_by_txt(name, SN_localityName, MBSTRING_ASC, (unsigned char *)(locality ? locality : "Unknown"), -1, -1, 0);
 
   // TODO set issuer name to CA subject name (X509_get_subject_name)
-  X509_set_issuer_name(cert, name);
+  if (root_cert)
+    X509_set_issuer_name(cert, X509_get_subject_name(root_cert));
+  else
+    X509_set_issuer_name(cert, name);
   X509_set_subject_name(cert, name);
   X509_NAME_free(name);
 
-  http_x509_add_san(cert, common_name);
-  if (!strstr(common_name, ".local"))
+  gens = sk_GENERAL_NAME_new_null();
+  http_x509_add_san(gens, common_name);
+  if (strstr(common_name, ".local") == NULL && !ca_cert)
   {
     // Add common_name.local to the list, too...
     char	localname[256],		// hostname.local
 		*localptr;		// Pointer into localname
 
-    cupsCopyString(localname, common_name, sizeof(localname));
+    strlcpy(localname, common_name, sizeof(localname));
     if ((localptr = strchr(localname, '.')) != NULL)
       *localptr = '\0';
-    cupsConcatString(localname, ".local", sizeof(localname));
+    strlcat(localname, ".local", sizeof(localname));
 
-    http_x509_add_san(cert, localname);
+    http_x509_add_san(gens, localname);
   }
 
   if (num_alt_names > 0)
   {
-    int i;                              // Looping var...
+    size_t i;				// Looping var...
 
     for (i = 0; i < num_alt_names; i ++)
     {
       if (strcmp(alt_names[i], "localhost"))
-        http_x509_add_san(cert, alt_names[i]);
+        http_x509_add_san(gens, alt_names[i]);
     }
   }
 
+  // Add extension with DNS names and free buffer for GENERAL_NAME
+  X509_add1_ext_i2d(cert, NID_subject_alt_name, gens, 0, X509V3_ADD_DEFAULT);
+  sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
+
   // Add extensions that are required to make Chrome happy...
-  // TODO: Support creating CA certs
-  http_x509_add_ext(cert, NID_basic_constraints, "critical,CA:FALSE,pathlen:0");
-  http_x509_add_ext(cert, NID_key_usage, "critical,digitalSignature,keyEncipherment");
+  if (ca_cert)
+  {
+    http_x509_add_ext(cert, NID_basic_constraints, "critical,CA:TRUE,pathlen:0");
+    http_x509_add_ext(cert, NID_key_usage, "critical,cRLSign,digitalSignature,keyCertSign");
+  }
+  else
+  {
+    http_x509_add_ext(cert, NID_basic_constraints, "critical,CA:FALSE,pathlen:0");
+    http_x509_add_ext(cert, NID_key_usage, "critical,digitalSignature,keyEncipherment");
+  }
   http_x509_add_ext(cert, NID_ext_key_usage, "1.3.6.1.5.5.7.3.1");
   http_x509_add_ext(cert, NID_subject_key_identifier, "hash");
   http_x509_add_ext(cert, NID_authority_key_identifier, "keyid,issuer");
   X509_set_version(cert, 2); // v3
 
-  // TODO: Sign with CA key when available
-  X509_sign(cert, pkey, EVP_sha256());
+  if (root_key)
+    X509_sign(cert, root_key, EVP_sha256());
+  else
+    X509_sign(cert, pkey, EVP_sha256());
 
   // Save them...
   if ((bio = BIO_new_file(keyfile, "wb")) == NULL)
@@ -267,9 +313,12 @@ cupsMakeServerCredentials(
     goto done;
   }
 
+  if (root_cert)
+    PEM_write_bio_X509(bio, root_cert);
+
   BIO_free(bio);
 
-  result = 1;
+  result = true;
   DEBUG_puts("1cupsMakeServerCredentials: Successfully created credentials.");
 
   // Cleanup...
@@ -278,22 +327,27 @@ cupsMakeServerCredentials(
   X509_free(cert);
   EVP_PKEY_free(pkey);
 
+  if (root_cert)
+    X509_free(root_cert);
+  if (root_key)
+    EVP_PKEY_free(root_key);
+
   return (result);
 }
 
 
-/*
- * 'cupsSetServerCredentials()' - Set the default server credentials.
- *
- * Note: The server credentials are used by all threads in the running process.
- * This function is threadsafe.
- */
+//
+// 'cupsSetServerCredentials()' - Set the default server credentials.
+//
+// Note: The server credentials are used by all threads in the running process.
+// This function is threadsafe.
+//
 
-int					// O - 1 on success, 0 on failure
+bool					// O - `true` on success, `false` on failure
 cupsSetServerCredentials(
     const char *path,			// I - Path to keychain/directory
     const char *common_name,		// I - Default common name for server
-    int        auto_create)		// I - 1 = automatically create self-signed certificates
+    bool       auto_create)		// I - `true` = automatically create self-signed certificates
 {
   char	temp[1024];			// Default path buffer
 
@@ -343,12 +397,12 @@ cupsSetServerCredentials(
 }
 
 
-/*
- * 'httpCopyCredentials()' - Copy the credentials associated with the peer in
- *                           an encrypted connection.
- */
+//
+// 'httpCopyCredentials()' - Copy the credentials associated with the peer in
+//                           an encrypted connection.
+//
 
-int					// O - Status of call (0 = success)
+bool					// O - Status of call (`true` = success)
 httpCopyCredentials(
     http_t	 *http,			// I - Connection to server
     cups_array_t **credentials)		// O - Array of credentials
@@ -362,7 +416,7 @@ httpCopyCredentials(
     *credentials = NULL;
 
   if (!http || !http->tls || !credentials)
-    return (-1);
+    return (false);
 
   *credentials = cupsArrayNew(NULL, NULL, NULL, 0, NULL, NULL);
   chain        = SSL_get_peer_cert_chain(http->tls);
@@ -397,13 +451,13 @@ httpCopyCredentials(
     }
   }
 
-  return (0);
+  return (true);
 }
 
 
-/*
- * '_httpCreateCredentials()' - Create credentials in the internal format.
- */
+//
+// '_httpCreateCredentials()' - Create credentials in the internal format.
+//
 
 http_tls_credentials_t			// O - Internal credentials
 _httpCreateCredentials(
@@ -415,9 +469,9 @@ _httpCreateCredentials(
 }
 
 
-/*
- * '_httpFreeCredentials()' - Free internal credentials.
- */
+//
+// '_httpFreeCredentials()' - Free internal credentials.
+//
 
 void
 _httpFreeCredentials(
@@ -427,23 +481,24 @@ _httpFreeCredentials(
 }
 
 
-/*
- * 'httpCredentialsAreValidForName()' - Return whether the credentials are valid for the given name.
- */
+//
+// 'httpCredentialsAreValidForName()' - Return whether the credentials are valid
+//                                      for the given name.
+//
 
-int					// O - 1 if valid, 0 otherwise
+bool					// O - `true` if valid, `false` otherwise
 httpCredentialsAreValidForName(
     cups_array_t *credentials,		// I - Credentials
     const char   *common_name)		// I - Name to check
 {
   X509	*cert;				// Certificate
-  int	result = 0;			// Result
+  bool	result = false;			// Result
 
 
   cert = http_create_credential((http_credential_t *)cupsArrayGetFirst(credentials));
   if (cert)
   {
-    result = X509_check_host(cert, common_name, strlen(common_name), 0, NULL);
+    result = X509_check_host(cert, common_name, strlen(common_name), 0, NULL) != 0;
 
     X509_free(cert);
   }
@@ -452,9 +507,9 @@ httpCredentialsAreValidForName(
 }
 
 
-/*
- * 'httpCredentialsGetTrust()' - Return the trust of credentials.
- */
+//
+// 'httpCredentialsGetTrust()' - Return the trust of credentials.
+//
 
 http_trust_t				// O - Level of trust
 httpCredentialsGetTrust(
@@ -596,9 +651,9 @@ httpCredentialsGetTrust(
 }
 
 
-/*
- * 'httpCredentialsGetExpiration()' - Return the expiration date of the credentials.
- */
+//
+// 'httpCredentialsGetExpiration()' - Return the expiration date of the credentials.
+//
 
 time_t					// O - Expiration date of credentials
 httpCredentialsGetExpiration(
@@ -618,9 +673,9 @@ httpCredentialsGetExpiration(
 }
 
 
-/*
- * 'httpCredentialsString()' - Return a string representing the credentials.
- */
+//
+// 'httpCredentialsString()' - Return a string representing the credentials.
+//
 
 size_t					// O - Total size of credentials string
 httpCredentialsString(
@@ -706,9 +761,9 @@ httpCredentialsString(
 }
 
 
-/*
- * 'httpLoadCredentials()' - Load X.509 credentials from a keychain file.
- */
+//
+// 'httpLoadCredentials()' - Load X.509 credentials from a keychain file.
+//
 
 bool					// O - `true` on success, `false` on error
 httpLoadCredentials(
@@ -724,7 +779,7 @@ httpLoadCredentials(
   size_t		alloc_data = 0,	// Bytes allocated
 			num_data = 0,	// Bytes used
 			decoded;	// Bytes decoded
-  int			in_certificate = 0;
+  bool			in_certificate = false;
 					// In a certificate?
 
 
@@ -750,25 +805,19 @@ httpLoadCredentials(
     {
       if (in_certificate)
       {
-       /*
-	* Missing END CERTIFICATE...
-	*/
-
+        // Missing END CERTIFICATE...
         httpFreeCredentials(*credentials);
 	*credentials = NULL;
         break;
       }
 
-      in_certificate = 1;
+      in_certificate = true;
     }
     else if (!strcmp(line, "-----END CERTIFICATE-----"))
     {
       if (!in_certificate || !num_data)
       {
-       /*
-	* Missing data...
-	*/
-
+        // Missing data...
         httpFreeCredentials(*credentials);
 	*credentials = NULL;
         break;
@@ -785,7 +834,7 @@ httpLoadCredentials(
       }
 
       num_data       = 0;
-      in_certificate = 0;
+      in_certificate = false;
     }
     else if (in_certificate)
     {
@@ -823,10 +872,7 @@ httpLoadCredentials(
 
   if (in_certificate)
   {
-   /*
-    * Missing END CERTIFICATE...
-    */
-
+    // Missing END CERTIFICATE...
     httpFreeCredentials(*credentials);
     *credentials = NULL;
   }
@@ -838,9 +884,9 @@ httpLoadCredentials(
 }
 
 
-/*
- * 'httpSaveCredentials()' - Save X.509 credentials to a keychain file.
- */
+//
+// 'httpSaveCredentials()' - Save X.509 credentials to a keychain file.
+//
 
 bool					// O - `true` on success, `false` on error
 httpSaveCredentials(
@@ -893,9 +939,9 @@ httpSaveCredentials(
 }
 
 
-/*
- * '_httpTLSInitialize()' - Initialize the TLS stack.
- */
+//
+// '_httpTLSInitialize()' - Initialize the TLS stack.
+//
 
 void
 _httpTLSInitialize(void)
@@ -904,9 +950,9 @@ _httpTLSInitialize(void)
 }
 
 
-/*
- * '_httpTLSPending()' - Return the number of pending TLS-encrypted bytes.
- */
+//
+// '_httpTLSPending()' - Return the number of pending TLS-encrypted bytes.
+//
 
 size_t					// O - Bytes available
 _httpTLSPending(http_t *http)		// I - HTTP connection
@@ -915,9 +961,9 @@ _httpTLSPending(http_t *http)		// I - HTTP connection
 }
 
 
-/*
- * '_httpTLSRead()' - Read from a SSL/TLS connection.
- */
+//
+// '_httpTLSRead()' - Read from a SSL/TLS connection.
+//
 
 int					// O - Bytes read
 _httpTLSRead(http_t *http,		// I - Connection to server
@@ -933,9 +979,9 @@ _httpTLSRead(http_t *http,		// I - Connection to server
 }
 
 
-/*
- * '_httpTLSSetOptions()' - Set TLS protocol and cipher suite options.
- */
+//
+// '_httpTLSSetOptions()' - Set TLS protocol and cipher suite options.
+//
 
 void
 _httpTLSSetOptions(int options,		// I - Options
@@ -951,11 +997,11 @@ _httpTLSSetOptions(int options,		// I - Options
 }
 
 
-/*
- * '_httpTLSStart()' - Set up SSL/TLS support on a connection.
- */
+//
+// '_httpTLSStart()' - Set up SSL/TLS support on a connection.
+//
 
-bool					/* O - `true` on success, `false` on failure */
+bool					// O - `true` on success, `false` on failure
 _httpTLSStart(http_t *http)		// I - Connection to server
 {
   BIO		*bio;			// Basic input/output context
@@ -1096,7 +1142,7 @@ _httpTLSStart(http_t *http)		// I - Connection to server
     {
       DEBUG_printf(("4_httpTLSStart: Auto-create credentials for \"%s\".", cn));
 
-      if (!cupsMakeServerCredentials(tls_keypath, cn, 0, NULL, time(NULL) + 3650 * 86400))
+      if (!cupsMakeServerCredentials(tls_keypath, NULL, NULL, NULL, NULL, NULL, NULL, false, cn, 0, NULL, time(NULL) + 3650 * 86400))
       {
 	DEBUG_puts("4_httpTLSStart: cupsMakeServerCredentials failed.");
 	http->error  = errno = EINVAL;
@@ -1219,9 +1265,9 @@ _httpTLSStart(http_t *http)		// I - Connection to server
 }
 
 
-/*
- * '_httpTLSStop()' - Shut down SSL/TLS on a connection.
- */
+//
+// '_httpTLSStop()' - Shut down SSL/TLS on a connection.
+//
 
 void
 _httpTLSStop(http_t *http)		// I - Connection to server
@@ -1239,9 +1285,9 @@ _httpTLSStop(http_t *http)		// I - Connection to server
 }
 
 
-/*
- * '_httpTLSWrite()' - Write to a SSL/TLS connection.
- */
+//
+// '_httpTLSWrite()' - Write to a SSL/TLS connection.
+//
 
 int					// O - Bytes written
 _httpTLSWrite(http_t     *http,		// I - Connection to server
@@ -1252,9 +1298,9 @@ _httpTLSWrite(http_t     *http,		// I - Connection to server
 }
 
 
-/*
- * 'http_bio_ctrl()' - Control the HTTP connection.
- */
+//
+// 'http_bio_ctrl()' - Control the HTTP connection.
+//
 
 static long				// O - Result/data
 http_bio_ctrl(BIO  *h,			// I - BIO data
@@ -1296,9 +1342,9 @@ http_bio_ctrl(BIO  *h,			// I - BIO data
 }
 
 
-/*
- * 'http_bio_free()' - Free OpenSSL data.
- */
+//
+// 'http_bio_free()' - Free OpenSSL data.
+//
 
 static int				// O - 1 on success, 0 on failure
 http_bio_free(BIO *h)			// I - BIO data
@@ -1315,9 +1361,9 @@ http_bio_free(BIO *h)			// I - BIO data
 }
 
 
-/*
- * 'http_bio_new()' - Initialize an OpenSSL BIO structure.
- */
+//
+// 'http_bio_new()' - Initialize an OpenSSL BIO structure.
+//
 
 static int				// O - 1 on success, 0 on failure
 http_bio_new(BIO *h)			// I - BIO data
@@ -1334,9 +1380,9 @@ http_bio_new(BIO *h)			// I - BIO data
 }
 
 
-/*
- * 'http_bio_puts()' - Send a string for OpenSSL.
- */
+//
+// 'http_bio_puts()' - Send a string for OpenSSL.
+//
 
 static int				// O - Bytes written
 http_bio_puts(BIO        *h,		// I - BIO data
@@ -1352,9 +1398,9 @@ http_bio_puts(BIO        *h,		// I - BIO data
 }
 
 
-/*
- * 'http_bio_read()' - Read data for OpenSSL.
- */
+//
+// 'http_bio_read()' - Read data for OpenSSL.
+//
 
 static int				// O - Bytes read
 http_bio_read(BIO  *h,			// I - BIO data
@@ -1393,9 +1439,9 @@ http_bio_read(BIO  *h,			// I - BIO data
 }
 
 
-/*
- * 'http_bio_write()' - Write data for OpenSSL.
- */
+//
+// 'http_bio_write()' - Write data for OpenSSL.
+//
 
 static int				// O - Bytes written
 http_bio_write(BIO        *h,		// I - BIO data
@@ -1414,9 +1460,9 @@ http_bio_write(BIO        *h,		// I - BIO data
 }
 
 
-/*
- * 'http_create_credential()' - Create a single credential in the internal format.
- */
+//
+// 'http_create_credential()' - Create a single credential in the internal format.
+//
 
 static X509 *				// O - Certificate
 http_create_credential(
@@ -1440,9 +1486,9 @@ http_create_credential(
 }
 
 
-/*
- * 'http_default_path()' - Get the default credential store path.
- */
+//
+// 'http_default_path()' - Get the default credential store path.
+//
 
 static const char *			// O - Path or NULL on error
 http_default_path(
@@ -1538,9 +1584,9 @@ http_get_date(X509 *cert,		// I - Certificate
 
 
 #if 0
-/*
- * 'http_load_crl()' - Load the certificate revocation list, if any.
- */
+//
+// 'http_load_crl()' - Load the certificate revocation list, if any.
+//
 
 static void
 http_load_crl(void)
@@ -1634,9 +1680,9 @@ http_load_crl(void)
 #endif // 0
 
 
-/*
- * 'http_make_path()' - Format a filename for a certificate or key file.
- */
+//
+// 'http_make_path()' - Format a filename for a certificate or key file.
+//
 
 static const char *			// O - Filename
 http_make_path(
@@ -1713,17 +1759,22 @@ http_x509_add_ext(X509       *cert,	// I - Certificate
 
 
 //
-// 'http_x509_add_san()' - Add a subjectAltName extension to an X.509 certificate.
+// 'http_x509_add_san()' - Add a subjectAltName to GENERAL_NAMES used for
+//                         the extension to an X.509 certificate.
 //
 
 static void
-http_x509_add_san(X509       *cert,	// I - Certificate
-                  const char *name)	// I - Hostname
+http_x509_add_san(GENERAL_NAMES *gens,	// I - Concatenation of DNS names
+                  const char    *name)	// I - Hostname
 {
-  char		dns_name[1024];		// DNS: prefixed hostname
+  GENERAL_NAME *gen_dns = GENERAL_NAME_new();
+					// DNS: name
+  ASN1_IA5STRING *ia5 = ASN1_IA5STRING_new();
+					// Hostname string
 
 
-  // The subjectAltName value for DNS names starts with a DNS: prefix...
-  snprintf(dns_name, sizeof(dns_name), "DNS:%s", name);
-  http_x509_add_ext(cert, NID_subject_alt_name, dns_name);
+  // Set the strings and push it on the GENERAL_NAMES list...
+  ASN1_STRING_set(ia5, name, strlen(name));
+  GENERAL_NAME_set0_value(gen_dns, GEN_DNS, ia5);
+  sk_GENERAL_NAME_push(gens, gen_dns);
 }

From 6b6c8205b916c6f67fa474aba98f89145cd803f0 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Fri, 14 Apr 2023 13:09:44 -0400
Subject: [PATCH 03/31] Add credential type argument to
 cupsMakeServerCredentials.

---
 cups/cups.h        |  97 +++++++++++++++++----------------
 cups/tls-openssl.c | 130 ++++++++++++++++++++++++++++-----------------
 2 files changed, 133 insertions(+), 94 deletions(-)

diff --git a/cups/cups.h b/cups/cups.h
index 1383713f8..38e5a22e9 100644
--- a/cups/cups.h
+++ b/cups/cups.h
@@ -42,44 +42,6 @@ extern "C" {
 #  define CUPS_LENGTH_VARIABLE		(ssize_t)0
 #  define CUPS_TIMEOUT_DEFAULT		0
 
-typedef enum cups_whichjobs_e		// Which jobs for @link cupsGetJobs@
-{
-  CUPS_WHICHJOBS_ALL = -1,		// All jobs
-  CUPS_WHICHJOBS_ACTIVE,		// Pending/held/processing jobs
-  CUPS_WHICHJOBS_COMPLETED		// Completed/canceled/aborted jobs
-} cups_whichjobs_t;
-
-// Flags for cupsConnectDest and cupsEnumDests
-#  define CUPS_DEST_FLAGS_NONE		0x00
-					// No flags are set
-#  define CUPS_DEST_FLAGS_UNCONNECTED	0x01
-					// There is no connection
-#  define CUPS_DEST_FLAGS_MORE		0x02
-					// There are more destinations
-#  define CUPS_DEST_FLAGS_REMOVED	0x04
-					// The destination has gone away
-#  define CUPS_DEST_FLAGS_ERROR		0x08
-					// An error occurred
-#  define CUPS_DEST_FLAGS_RESOLVING	0x10
-					// The destination address is being resolved
-#  define CUPS_DEST_FLAGS_CONNECTING	0x20
-					// A connection is being established
-#  define CUPS_DEST_FLAGS_CANCELED	0x40
-					// Operation was canceled
-#  define CUPS_DEST_FLAGS_DEVICE        0x80
-                                        // For @link cupsConnectDest@: Connect to device
-
-// Flags for cupsGetDestMediaByName/Size
-#  define CUPS_MEDIA_FLAGS_DEFAULT 	0x00
-					// Find the closest size supported by the printer
-#  define CUPS_MEDIA_FLAGS_BORDERLESS	0x01
-					// Find a borderless size
-#  define CUPS_MEDIA_FLAGS_DUPLEX	0x02
-					// Find a size compatible with 2-sided printing
-#  define CUPS_MEDIA_FLAGS_EXACT	0x04
-					// Find an exact match for the size
-#  define CUPS_MEDIA_FLAGS_READY	0x08
-					// If the printer supports media sensing, find the size amongst the "ready" media.
 
 // Options and values
 #  define CUPS_COPIES			"copies"
@@ -148,8 +110,9 @@ typedef enum cups_whichjobs_e		// Which jobs for @link cupsGetJobs@
 #  define CUPS_PRINT_COLOR_MODE_SUPPORTED "print-color-mode-supported"
 
 #  define CUPS_PRINT_COLOR_MODE_AUTO	"auto"
-#  define CUPS_PRINT_COLOR_MODE_MONOCHROME "monochrome"
+#  define CUPS_PRINT_COLOR_MODE_BI_LEVEL "bi-level"
 #  define CUPS_PRINT_COLOR_MODE_COLOR	"color"
+#  define CUPS_PRINT_COLOR_MODE_MONOCHROME "monochrome"
 
 #  define CUPS_PRINT_QUALITY		"print-quality"
 #  define CUPS_PRINT_QUALITY_SUPPORTED	"print-quality-supported"
@@ -170,9 +133,43 @@ typedef enum cups_whichjobs_e		// Which jobs for @link cupsGetJobs@
 // Types and structures...
 //
 
-typedef unsigned cups_ptype_t;		// Printer type/capability bits
-enum cups_ptype_e			// Printer type/capability bit constants
-{					// Not a typedef'd enum so we can OR
+typedef enum cups_credtype_e		// X.509 credential types
+{
+  CUPS_CREDTYPE_DEFAULT,		// Default type
+  CUPS_CREDTYPE_RSA_2048_SHA256,	// RSA with 2048-bit keys and SHA-256 hash
+  CUPS_CREDTYPE_RSA_3072_SHA256,	// RSA with 3072-bit keys and SHA-256 hash
+  CUPS_CREDTYPE_RSA_4096_SHA256,	// RSA with 4096-bit keys and SHA-256 hash
+  CUPS_CREDTYPE_ECDSA_P256_SHA256,	// ECDSA using the P-256 curve with SHA-256 hash
+  CUPS_CREDTYPE_ECDSA_P384_SHA256,	// ECDSA using the P-384 curve with SHA-256 hash
+  CUPS_CREDTYPE_ECDSA_P521_SHA256	// ECDSA using the P-521 curve with SHA-256 hash
+} cups_credtype_t;
+
+enum cups_dest_flags_e			// Flags for @link cupsConnectDest@ and @link cupsEnumDests@
+{
+  CUPS_DEST_FLAGS_NONE = 0x00,		// No flags are set
+  CUPS_DEST_FLAGS_UNCONNECTED = 0x01,	// There is no connection
+  CUPS_DEST_FLAGS_MORE = 0x02,		// There are more destinations
+  CUPS_DEST_FLAGS_REMOVED = 0x04,	// The destination has gone away
+  CUPS_DEST_FLAGS_ERROR = 0x08,		// An error occurred
+  CUPS_DEST_FLAGS_RESOLVING = 0x10,	// The destination address is being resolved
+  CUPS_DEST_FLAGS_CONNECTING = 0x20,	// A connection is being established
+  CUPS_DEST_FLAGS_CANCELED = 0x40,	// Operation was canceled
+  CUPS_DEST_FLAGS_DEVICE = 0x80		// For @link cupsConnectDest@: Connect to device
+};
+typedef unsigned cups_dest_flags_t;	// Combined flags for @link cupsConnectDest@ and @link cupsEnumDests@
+
+enum cups_media_flags_e			// Flags for @link cupsGetDestMediaByName@ and @link cupsGetDestMediaBySize@
+{
+  CUPS_MEDIA_FLAGS_DEFAULT = 0x00,	// Find the closest size supported by the printer
+  CUPS_MEDIA_FLAGS_BORDERLESS = 0x01,	// Find a borderless size
+  CUPS_MEDIA_FLAGS_DUPLEX = 0x02,	// Find a size compatible with 2-sided printing
+  CUPS_MEDIA_FLAGS_EXACT = 0x04,	// Find an exact match for the size
+  CUPS_MEDIA_FLAGS_READY = 0x08		// If the printer supports media sensing, find the size amongst the "ready" media.
+};
+typedef unsigned cups_media_flags_t;	// Combined flags for @link cupsGetDestMediaByName@ and @link cupsGetDestMediaBySize@
+
+enum cups_ptype_e			// Printer type/capability flags
+{
   CUPS_PRINTER_LOCAL = 0x0000,		// Local printer or class
   CUPS_PRINTER_CLASS = 0x0001,		// Printer class
   CUPS_PRINTER_REMOTE = 0x0002,		// Remote printer or class
@@ -201,6 +198,14 @@ enum cups_ptype_e			// Printer type/capability bit constants
   CUPS_PRINTER_MFP = 0x4000000,		// Printer with scanning capabilities
   CUPS_PRINTER_OPTIONS = 0x6fffc	// ~(CLASS | REMOTE | IMPLICIT | DEFAULT | FAX | REJECTING | DELETE | NOT_SHARED | AUTHENTICATED | COMMANDS | DISCOVERED) @private@
 };
+typedef unsigned cups_ptype_t;		// Combined printer type/capability flags
+
+typedef enum cups_whichjobs_e		// Which jobs for @link cupsGetJobs@
+{
+  CUPS_WHICHJOBS_ALL = -1,		// All jobs
+  CUPS_WHICHJOBS_ACTIVE,		// Pending/held/processing jobs
+  CUPS_WHICHJOBS_COMPLETED		// Completed/canceled/aborted jobs
+} cups_whichjobs_t;
 
 typedef struct cups_option_s		//// Printer Options
 {
@@ -235,7 +240,7 @@ typedef struct cups_job_s		// Job
   time_t	processing_time;	// Time the job was processed
 } cups_job_t;
 
-typedef struct cups_size_s		//// Media Size
+typedef struct cups_size_s		//// Media information
 {
   char		media[128],		// Media name to use
 		color[128],		// Media color (blank for any/auto)
@@ -252,7 +257,7 @@ typedef struct cups_size_s		//// Media Size
 typedef bool (*cups_client_cert_cb_t)(http_t *http, void *tls, cups_array_t *distinguished_names, void *user_data);
 					// Client credentials callback
 
-typedef bool (*cups_dest_cb_t)(void *user_data, unsigned flags, cups_dest_t *dest);
+typedef bool (*cups_dest_cb_t)(void *user_data, cups_dest_flags_t flags, cups_dest_t *dest);
 			      		// Destination enumeration callback
 
 typedef const char *(*cups_oauth_cb_t)(http_t *http, const char *realm, const char *scope, const char *resource, void *user_data);
@@ -336,8 +341,8 @@ extern const char	*cupsLocalizeDestMedia(http_t *http, cups_dest_t *dest, cups_d
 extern const char	*cupsLocalizeDestOption(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, const char *option) _CUPS_PUBLIC;
 extern const char	*cupsLocalizeDestValue(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, const char *option, const char *value) _CUPS_PUBLIC;
 
-extern bool		cupsMakeServerCredentials(const char *path, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *root_name, bool ca_cert, const char *common_name, size_t num_alt_names, const char **alt_names, time_t expiration_date) _CUPS_PUBLIC;
-extern char		*cupsMakeServerRequest(const char *path, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name, size_t num_alt_names, const char **alt_names) _CUPS_PUBLIC;
+extern bool		cupsMakeServerCredentials(const char *path, cups_credtype_t type, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *root_name, bool ca_cert, const char *common_name, size_t num_alt_names, const char **alt_names, time_t expiration_date) _CUPS_PUBLIC;
+extern char		*cupsMakeServerRequest(const char *path, cups_credtype_t type, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name, size_t num_alt_names, const char **alt_names) _CUPS_PUBLIC;
 
 extern char		*cupsNotifySubject(cups_lang_t *lang, ipp_t *event) _CUPS_PUBLIC;
 extern char		*cupsNotifyText(cups_lang_t *lang, ipp_t *event) _CUPS_PUBLIC;
diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index ecf743d47..ef35fa247 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -13,7 +13,6 @@
 
 #include <sys/stat.h>
 #include <openssl/x509v3.h>
-#define USE_EC 0			// Set to 1 to generate EC certs
 
 
 //
@@ -41,47 +40,58 @@ static void		http_x509_add_san(GENERAL_NAMES *gens, const char *name);
 //
 
 static bool		tls_auto_create = false;
-					/* Auto-create self-signed certs? */
+					// Auto-create self-signed certs?
 static BIO_METHOD	*tls_bio_method = NULL;
-					/* OpenSSL BIO method */
+					// OpenSSL BIO method
 static char		*tls_common_name = NULL;
-					/* Default common name */
-//static X509_CRL		*tls_crl = NULL;/* Certificate revocation list */
+					// Default common name
+//static X509_CRL		*tls_crl = NULL;// Certificate revocation list
 static char		*tls_keypath = NULL;
-					/* Server cert keychain path */
+					// Server cert keychain path
 static cups_mutex_t	tls_mutex = CUPS_MUTEX_INITIALIZER;
-					/* Mutex for keychain/certs */
-static int		tls_options = -1,/* Options for TLS connections */
+					// Mutex for keychain/certs
+static int		tls_options = -1,// Options for TLS connections
 			tls_min_version = _HTTP_TLS_1_2,
 			tls_max_version = _HTTP_TLS_MAX;
 
 
-/*
- * 'cupsMakeServerCredentials()' - Make a self-signed certificate and private key pair.
- */
+//
+// 'cupsMakeServerCredentials()' - Make an X.509 certificate and private key pair.
+//
+// This function creates an X.509 certificate and private key pair.  The
+// certificate and key are stored in the directory "path" or, if "path" is
+// `NULL`, in a per-user or system-wide (when running as root) certificate/key
+// store.  The generated certificate is signed by the named root certificate or,
+// if "root_name" is `NULL`, a site-wide default root certificate.  When
+// "root_name" is `NULL` and there is no site-wide default root certificate, a
+// self-signed certificate is generated instead.
+//
+// The type of certificate depends on the version of the TLS library in use but
+// will be either 3072-bit RSA or 384-bit ECDSA with SHA-256 signature.
+//
 
 bool					// O - `true` on success, `false` on failure
 cupsMakeServerCredentials(
-    const char *path,			// I - Path to keychain/directory or `NULL` for default
-    const char *organization,		// I - Organization or `NULL` to use common name
-    const char *org_unit,		// I - Organizational unit or `NULL` for none
-    const char *locality,		// I - City/town or `NULL` for "Unknown"
-    const char *state_province,		// I - State/province or `NULL` for "Unknown"
-    const char *country,		// I - Country or `NULL` for locale-based default
-    const char *root_name,		// I - Root certificate/domain name or `NULL` for site/self-signed
-    bool       ca_cert,			// I - Make CA certificate?
-    const char *common_name,		// I - Common name
-    size_t     num_alt_names,		// I - Number of subject alternate names
-    const char **alt_names,		// I - Subject Alternate Names
-    time_t     expiration_date)		// I - Expiration date
+    const char      *path,		// I - Directory path or `NULL` for default
+    cups_credtype_t type,		// I - Type of certificate/keys to generate
+    const char      *organization,	// I - Organization or `NULL` to use common name
+    const char      *org_unit,		// I - Organizational unit or `NULL` for none
+    const char      *locality,		// I - City/town or `NULL` for "Unknown"
+    const char      *state_province,	// I - State/province or `NULL` for "Unknown"
+    const char      *country,		// I - Country or `NULL` for locale-based default
+    const char      *root_name,		// I - Root certificate/domain name or `NULL` for site/self-signed
+    bool            ca_cert,		// I - Make CA certificate?
+    const char      *common_name,	// I - Common name
+    size_t          num_alt_names,	// I - Number of subject alternate names
+    const char      **alt_names,	// I - Subject Alternate Names
+    time_t          expiration_date)	// I - Expiration date
 {
   bool		result = false;		// Return value
   EVP_PKEY	*pkey;			// Private key
-#if defined(EVP_PKEY_EC) && USE_EC
-  EC_KEY	*ec;			// EC key
-#else
-  RSA		*rsa;			// RSA key pair
-#endif // EVP_PKEY_EC && USE_EC
+#if defined(EVP_PKEY_EC)
+  EC_KEY	*ec = NULL;		// EC key
+#endif // EVP_PKEY_EC
+  RSA		*rsa = NULL;		// RSA key pair
   X509		*cert;			// Certificate
   X509		*root_cert = NULL;	// Root certificate, if any
   EVP_PKEY	*root_key = NULL;	// Root private key, if any
@@ -119,37 +129,62 @@ cupsMakeServerCredentials(
   // Create the encryption key...
   DEBUG_puts("1cupsMakeServerCredentials: Creating key pair.");
 
-#if defined(EVP_PKEY_EC) && USE_EC
-  if ((ec = EC_KEY_new_by_curve_name(NID_secp384r1)) == NULL)
+  switch (type)
   {
-    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create key pair."), 1);
-    return (false);
+#if defined(EVP_PKEY_EC)
+    case CUPS_CREDTYPE_ECDSA_P256_SHA256 :
+	ec = EC_KEY_new_by_curve_name(NID_secp256k1);
+	break;
+
+    case CUPS_CREDTYPE_ECDSA_P384_SHA256 :
+	ec = EC_KEY_new_by_curve_name(NID_secp384r1);
+	break;
+
+    case CUPS_CREDTYPE_ECDSA_P521_SHA256 :
+	ec = EC_KEY_new_by_curve_name(NID_secp521r1);
+	break;
+#endif // EVP_PKEY_EC && USE_EC
+
+    case CUPS_CREDTYPE_RSA_2048_SHA256 :
+	rsa = RSA_generate_key(2048, RSA_F4, NULL, NULL);
+	break;
+
+    default :
+    case CUPS_CREDTYPE_RSA_3072_SHA256 :
+	rsa = RSA_generate_key(3072, RSA_F4, NULL, NULL);
+	break;
+
+    case CUPS_CREDTYPE_RSA_4096_SHA256 :
+	rsa = RSA_generate_key(4096, RSA_F4, NULL, NULL);
+	break;
   }
-#else
-  if ((rsa = RSA_generate_key(3072, RSA_F4, NULL, NULL)) == NULL)
+
+  if (!rsa && !ec)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create key pair."), 1);
     return (false);
   }
-#endif // EVP_PKEY_EC && USE_EC
 
   if ((pkey = EVP_PKEY_new()) == NULL)
   {
-#if defined(EVP_PKEY_EC) && USE_EC
-    EC_KEY_free(ec);
-#else
-    RSA_free(rsa);
+#if defined(EVP_PKEY_EC)
+    if (ec)
+      EC_KEY_free(ec);
 #endif // EVP_PKEY_EC && USE_EC
 
+    if (rsa)
+      RSA_free(rsa);
+
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create private key."), 1);
     return (false);
   }
 
-#if defined(EVP_PKEY_EC) && USE_EC
-  EVP_PKEY_assign_EC_KEY(pkey, ec);
-#else
+#if defined(EVP_PKEY_EC)
+  if (ec)
+    EVP_PKEY_assign_EC_KEY(pkey, ec);
+  else
+#endif // EVP_PKEY_EC
   EVP_PKEY_assign_RSA(pkey, rsa);
-#endif // EVP_PKEY_EC && USE_EC
 
   DEBUG_puts("1cupsMakeServerCredentials: Key pair created.");
 
@@ -224,7 +259,6 @@ cupsMakeServerCredentials(
   X509_NAME_add_entry_by_txt(name, SN_stateOrProvinceName, MBSTRING_ASC, (unsigned char *)(state_province ? state_province : "Unknown"), -1, -1, 0);
   X509_NAME_add_entry_by_txt(name, SN_localityName, MBSTRING_ASC, (unsigned char *)(locality ? locality : "Unknown"), -1, -1, 0);
 
-  // TODO set issuer name to CA subject name (X509_get_subject_name)
   if (root_cert)
     X509_set_issuer_name(cert, X509_get_subject_name(root_cert));
   else
@@ -545,8 +579,8 @@ httpCredentialsGetTrust(
 
   if (tcreds)
   {
-    char	credentials_str[1024],	/* String for incoming credentials */
-		tcreds_str[1024];	/* String for saved credentials */
+    char	credentials_str[1024],	// String for incoming credentials
+		tcreds_str[1024];	// String for saved credentials
 
     httpCredentialsString(credentials, credentials_str, sizeof(credentials_str));
     httpCredentialsString(tcreds, tcreds_str, sizeof(tcreds_str));
@@ -849,7 +883,7 @@ httpLoadCredentials(
       else if ((num_data + strlen(line)) >= alloc_data)
       {
         unsigned char *tdata = realloc(data, alloc_data + 1024);
-					/* Expanded buffer */
+					// Expanded buffer
 
 	if (!tdata)
 	{
@@ -1142,7 +1176,7 @@ _httpTLSStart(http_t *http)		// I - Connection to server
     {
       DEBUG_printf(("4_httpTLSStart: Auto-create credentials for \"%s\".", cn));
 
-      if (!cupsMakeServerCredentials(tls_keypath, NULL, NULL, NULL, NULL, NULL, NULL, false, cn, 0, NULL, time(NULL) + 3650 * 86400))
+      if (!cupsMakeServerCredentials(tls_keypath, CUPS_CREDTYPE_DEFAULT, NULL, NULL, NULL, NULL, NULL, NULL, false, cn, 0, NULL, time(NULL) + 3650 * 86400))
       {
 	DEBUG_puts("4_httpTLSStart: cupsMakeServerCredentials failed.");
 	http->error  = errno = EINVAL;

From d630e9e4bb18193aafc195060c02ffccec4b60fc Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Fri, 14 Apr 2023 16:23:48 -0400
Subject: [PATCH 04/31] Save work.

---
 cups/cups.h        |   4 +-
 cups/tls-openssl.c | 503 +++++++++++++++++++++++++++++++++------------
 2 files changed, 368 insertions(+), 139 deletions(-)

diff --git a/cups/cups.h b/cups/cups.h
index 38e5a22e9..43e0dcf5a 100644
--- a/cups/cups.h
+++ b/cups/cups.h
@@ -133,7 +133,7 @@ extern "C" {
 // Types and structures...
 //
 
-typedef enum cups_credtype_e		// X.509 credential types
+typedef enum cups_credtype_e		// X.509 credential types for @link cupsMakeServerCredentials@ and @link cupsMakeServerRequest@
 {
   CUPS_CREDTYPE_DEFAULT,		// Default type
   CUPS_CREDTYPE_RSA_2048_SHA256,	// RSA with 2048-bit keys and SHA-256 hash
@@ -355,7 +355,7 @@ extern ssize_t		cupsReadResponseData(http_t *http, char *buffer, size_t length)
 extern size_t		cupsRemoveDest(const char *name, const char *instance, size_t num_dests, cups_dest_t **dests) _CUPS_PUBLIC;
 extern size_t		cupsRemoveOption(const char *name, size_t num_options, cups_option_t **options) _CUPS_PUBLIC;
 
-extern bool		cupsSaveServerCredentials(const char *path, const char *pem) _CUPS_PUBLIC;
+extern bool		cupsSaveServerCredentials(const char *path, const char *common_name, const char *pem) _CUPS_PUBLIC;
 extern http_status_t	cupsSendRequest(http_t *http, ipp_t *request, const char *resource, size_t length) _CUPS_PUBLIC;
 extern void		cupsSetOAuthCB(cups_oauth_cb_t cb, void *data) _CUPS_PUBLIC;
 extern void		cupsSetClientCertCB(cups_client_cert_cb_t cb, void *user_data) _CUPS_PUBLIC;
diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index ef35fa247..c07fc3d83 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -19,6 +19,8 @@
 // Local functions...
 //
 
+static void		http_add_san(GENERAL_NAMES *gens, const char *name);
+
 static long		http_bio_ctrl(BIO *h, int cmd, long arg1, void *arg2);
 static int		http_bio_free(BIO *data);
 static int		http_bio_new(BIO *h);
@@ -27,12 +29,19 @@ static int		http_bio_read(BIO *h, char *buf, int size);
 static int		http_bio_write(BIO *h, const char *buf, int num);
 
 static X509		*http_create_credential(http_credential_t *credential);
+static X509_NAME	*http_create_name(const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name);
+static EVP_PKEY		*http_create_key(cups_credtype_t type);
+static GENERAL_NAMES	*http_create_san(const char *common_name, size_t num_alt_names, const char **alt_names);
+
 static const char	*http_default_path(char *buffer, size_t bufsize);
+
 static time_t		http_get_date(X509 *cert, int which);
+
 //static void		http_load_crl(void);
+
 static const char	*http_make_path(char *buffer, size_t bufsize, const char *dirname, const char *filename, const char *ext);
+
 static bool		http_x509_add_ext(X509 *cert, int nid, const char *value);
-static void		http_x509_add_san(GENERAL_NAMES *gens, const char *name);
 
 
 //
@@ -66,13 +75,10 @@ static int		tls_options = -1,// Options for TLS connections
 // "root_name" is `NULL` and there is no site-wide default root certificate, a
 // self-signed certificate is generated instead.
 //
-// The type of certificate depends on the version of the TLS library in use but
-// will be either 3072-bit RSA or 384-bit ECDSA with SHA-256 signature.
-//
 
 bool					// O - `true` on success, `false` on failure
 cupsMakeServerCredentials(
-    const char      *path,		// I - Directory path or `NULL` for default
+    const char      *path,		// I - Directory path for certificate/key store or `NULL` for default
     cups_credtype_t type,		// I - Type of certificate/keys to generate
     const char      *organization,	// I - Organization or `NULL` to use common name
     const char      *org_unit,		// I - Organizational unit or `NULL` for none
@@ -87,18 +93,12 @@ cupsMakeServerCredentials(
     time_t          expiration_date)	// I - Expiration date
 {
   bool		result = false;		// Return value
-  EVP_PKEY	*pkey;			// Private key
-#if defined(EVP_PKEY_EC)
-  EC_KEY	*ec = NULL;		// EC key
-#endif // EVP_PKEY_EC
-  RSA		*rsa = NULL;		// RSA key pair
+  EVP_PKEY	*pkey;			// Key pair
   X509		*cert;			// Certificate
   X509		*root_cert = NULL;	// Root certificate, if any
   EVP_PKEY	*root_key = NULL;	// Root private key, if any
   char		root_crtfile[1024],	// Path to root certificate
 		root_keyfile[1024];	// Path to root private key
-  cups_lang_t	*language;		// Default language info
-  const char	*langname;		// Language name
   time_t	curtime;		// Current time
   X509_NAME	*name;			// Subject/issuer name
   ASN1_INTEGER	*serial;		// Serial number
@@ -111,7 +111,7 @@ cupsMakeServerCredentials(
   GENERAL_NAMES *gens;			// Names for SubjectAltName certificate extension
 
 
-  DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", organization=\"%s\", org_unit=\"%s\", locality=\"%s\", state_province=\"%s\", country=\"%s\", common_name=\"%s\", num_alt_names=%u, alt_names=%p, expiration_date=%ld)", path, organization, org_unit, locality, state_province, country, common_name, (unsigned)num_alt_names, alt_names, (long)expiration_date));
+  DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", type=%d, organization=\"%s\", org_unit=\"%s\", locality=\"%s\", state_province=\"%s\", country=\"%s\", root_name=\"%s\", ca_cert=%s, common_name=\"%s\", num_alt_names=%u, alt_names=%p, expiration_date=%ld)", path, type, organization, org_unit, locality, state_province, country, root_name, ca_cert ? "true" : "false", common_name, (unsigned)num_alt_names, alt_names, (long)expiration_date));
 
   // Filenames...
   if (!path)
@@ -129,62 +129,8 @@ cupsMakeServerCredentials(
   // Create the encryption key...
   DEBUG_puts("1cupsMakeServerCredentials: Creating key pair.");
 
-  switch (type)
-  {
-#if defined(EVP_PKEY_EC)
-    case CUPS_CREDTYPE_ECDSA_P256_SHA256 :
-	ec = EC_KEY_new_by_curve_name(NID_secp256k1);
-	break;
-
-    case CUPS_CREDTYPE_ECDSA_P384_SHA256 :
-	ec = EC_KEY_new_by_curve_name(NID_secp384r1);
-	break;
-
-    case CUPS_CREDTYPE_ECDSA_P521_SHA256 :
-	ec = EC_KEY_new_by_curve_name(NID_secp521r1);
-	break;
-#endif // EVP_PKEY_EC && USE_EC
-
-    case CUPS_CREDTYPE_RSA_2048_SHA256 :
-	rsa = RSA_generate_key(2048, RSA_F4, NULL, NULL);
-	break;
-
-    default :
-    case CUPS_CREDTYPE_RSA_3072_SHA256 :
-	rsa = RSA_generate_key(3072, RSA_F4, NULL, NULL);
-	break;
-
-    case CUPS_CREDTYPE_RSA_4096_SHA256 :
-	rsa = RSA_generate_key(4096, RSA_F4, NULL, NULL);
-	break;
-  }
-
-  if (!rsa && !ec)
-  {
-    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create key pair."), 1);
-    return (false);
-  }
-
-  if ((pkey = EVP_PKEY_new()) == NULL)
-  {
-#if defined(EVP_PKEY_EC)
-    if (ec)
-      EC_KEY_free(ec);
-#endif // EVP_PKEY_EC && USE_EC
-
-    if (rsa)
-      RSA_free(rsa);
-
-    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create private key."), 1);
+  if ((pkey = http_create_key(type)) == NULL)
     return (false);
-  }
-
-#if defined(EVP_PKEY_EC)
-  if (ec)
-    EVP_PKEY_assign_EC_KEY(pkey, ec);
-  else
-#endif // EVP_PKEY_EC
-  EVP_PKEY_assign_RSA(pkey, rsa);
 
   DEBUG_puts("1cupsMakeServerCredentials: Key pair created.");
 
@@ -244,20 +190,7 @@ cupsMakeServerCredentials(
 
   }
 
-  language = cupsLangDefault();
-  langname = cupsLangGetName(language);
-  name     = X509_NAME_new();
-  if (country)
-    X509_NAME_add_entry_by_txt(name, SN_countryName, MBSTRING_ASC, (unsigned char *)country, -1, -1, 0);
-  else if (strlen(langname) == 5)
-    X509_NAME_add_entry_by_txt(name, SN_countryName, MBSTRING_ASC, (unsigned char *)langname + 3, -1, -1, 0);
-  else
-    X509_NAME_add_entry_by_txt(name, SN_countryName, MBSTRING_ASC, (unsigned char *)"US", -1, -1, 0);
-  X509_NAME_add_entry_by_txt(name, SN_commonName, MBSTRING_ASC, (unsigned char *)common_name, -1, -1, 0);
-  X509_NAME_add_entry_by_txt(name, SN_organizationName, MBSTRING_ASC, (unsigned char *)(organization ? organization : common_name), -1, -1, 0);
-  X509_NAME_add_entry_by_txt(name, SN_organizationalUnitName, MBSTRING_ASC, (unsigned char *)(org_unit ? org_unit : ""), -1, -1, 0);
-  X509_NAME_add_entry_by_txt(name, SN_stateOrProvinceName, MBSTRING_ASC, (unsigned char *)(state_province ? state_province : "Unknown"), -1, -1, 0);
-  X509_NAME_add_entry_by_txt(name, SN_localityName, MBSTRING_ASC, (unsigned char *)(locality ? locality : "Unknown"), -1, -1, 0);
+  name = http_create_name(organization, org_unit, locality, state_province, country, common_name);
 
   if (root_cert)
     X509_set_issuer_name(cert, X509_get_subject_name(root_cert));
@@ -266,48 +199,29 @@ cupsMakeServerCredentials(
   X509_set_subject_name(cert, name);
   X509_NAME_free(name);
 
-  gens = sk_GENERAL_NAME_new_null();
-  http_x509_add_san(gens, common_name);
-  if (strstr(common_name, ".local") == NULL && !ca_cert)
-  {
-    // Add common_name.local to the list, too...
-    char	localname[256],		// hostname.local
-		*localptr;		// Pointer into localname
-
-    strlcpy(localname, common_name, sizeof(localname));
-    if ((localptr = strchr(localname, '.')) != NULL)
-      *localptr = '\0';
-    strlcat(localname, ".local", sizeof(localname));
-
-    http_x509_add_san(gens, localname);
-  }
-
-  if (num_alt_names > 0)
-  {
-    size_t i;				// Looping var...
-
-    for (i = 0; i < num_alt_names; i ++)
-    {
-      if (strcmp(alt_names[i], "localhost"))
-        http_x509_add_san(gens, alt_names[i]);
-    }
-  }
-
-  // Add extension with DNS names and free buffer for GENERAL_NAME
-  X509_add1_ext_i2d(cert, NID_subject_alt_name, gens, 0, X509V3_ADD_DEFAULT);
-  sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
-
-  // Add extensions that are required to make Chrome happy...
   if (ca_cert)
   {
+    // Add extensions that are required to make Chrome happy...
     http_x509_add_ext(cert, NID_basic_constraints, "critical,CA:TRUE,pathlen:0");
     http_x509_add_ext(cert, NID_key_usage, "critical,cRLSign,digitalSignature,keyCertSign");
   }
   else
   {
+    // Add extension with DNS names and free buffer for GENERAL_NAME
+    if ((gens = http_create_san(common_name, num_alt_names, alt_names)) == NULL)
+    {
+      // TODO: Set error?
+      goto done;
+    }
+
+    X509_add1_ext_i2d(cert, NID_subject_alt_name, gens, 0, X509V3_ADD_DEFAULT);
+    sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
+
+    // Add extensions that are required to make Chrome happy...
     http_x509_add_ext(cert, NID_basic_constraints, "critical,CA:FALSE,pathlen:0");
     http_x509_add_ext(cert, NID_key_usage, "critical,digitalSignature,keyEncipherment");
   }
+
   http_x509_add_ext(cert, NID_ext_key_usage, "1.3.6.1.5.5.7.3.1");
   http_x509_add_ext(cert, NID_subject_key_identifier, "hash");
   http_x509_add_ext(cert, NID_authority_key_identifier, "keyid,issuer");
@@ -370,6 +284,168 @@ cupsMakeServerCredentials(
 }
 
 
+//
+// 'cupsMakeServerRequest()' - Make an X.509 Certificate Signing Request.
+//
+// This function creates an X.509 certificate signing request (CSR) and
+// associated private key.  The CSR and key are stored in the directory "path"
+// or, if "path" is `NULL`, in a per-user or system-wide (when running as root)
+// certificate/key store.
+//
+// The CSR is returned as a string that must be freed using the `free` function.
+//
+
+char *					// O - PEM-encoded certificate signing request
+cupsMakeServerRequest(
+    const char      *path,		// I - Directory path for certificate/key store or `NULL` for default
+    cups_credtype_t type,		// I - Type of certificate/keys to generate
+    const char      *organization,	// I - Organization or `NULL` to use common name
+    const char      *org_unit,		// I - Organizational unit or `NULL` for none
+    const char      *locality,		// I - City/town or `NULL` for "Unknown"
+    const char      *state_province,	// I - State/province or `NULL` for "Unknown"
+    const char      *country,		// I - Country or `NULL` for locale-based default
+    const char      *common_name,	// I - Common name
+    size_t          num_alt_names,	// I - Number of subject alternate names
+    const char      **alt_names)	// I - Subject Alternate Names
+{
+  char		*result = NULL;		// Return value
+  EVP_PKEY	*pkey;			// Key pair
+  X509_REQ	*csr;			// Certificate signing request
+  X509_NAME	*name;			// Subject/issuer name
+  BIO		*bio;			// Output file
+  char		temp[1024],		// Temporary directory name
+ 		csrfile[1024],		// Certificate signing request filename
+		keyfile[1024];		// Private key filename
+//  GENERAL_NAMES *gens;			// Names for SubjectAltName certificate extension
+
+
+  DEBUG_printf(("cupsMakeServerRequest(path=\"%s\", type=%d, organization=\"%s\", org_unit=\"%s\", locality=\"%s\", state_province=\"%s\", country=\"%s\", common_name=\"%s\", num_alt_names=%u, alt_names=%p)", path, type, organization, org_unit, locality, state_province, country, common_name, (unsigned)num_alt_names, alt_names));
+
+  // Filenames...
+  if (!path)
+    path = http_default_path(temp, sizeof(temp));
+
+  if (!path || !common_name)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(EINVAL), 0);
+    return (false);
+  }
+
+  http_make_path(csrfile, sizeof(csrfile), path, common_name, "csr");
+  http_make_path(keyfile, sizeof(keyfile), path, common_name, "key");
+
+  // Create the encryption key...
+  DEBUG_puts("1cupsMakeServerRequest: Creating key pair.");
+
+  if ((pkey = http_create_key(type)) == NULL)
+    return (false);
+
+  DEBUG_puts("1cupsMakeServerRequest: Key pair created.");
+
+  // Create the X.509 certificate...
+  DEBUG_puts("1cupsMakeServerRequest: Generating self-signed X.509 certificate.");
+
+  if ((csr = X509_REQ_new()) == NULL)
+  {
+    EVP_PKEY_free(pkey);
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create X.509 certificate signing request."), 1);
+    return (NULL);
+  }
+
+  X509_REQ_set_pubkey(csr, pkey);
+
+  if ((name = http_create_name(organization, org_unit, locality, state_province, country, common_name)) == NULL)
+    goto done;
+
+  X509_REQ_set_subject_name(csr, name);
+  X509_NAME_free(name);
+
+  // Add extension with DNS names and free buffer for GENERAL_NAME
+//  if ((gens = http_create_san(common_name, num_alt_names, alt_names)) == NULL)
+//  {
+//    // TODO: Set error?
+//    goto done;
+//  }
+
+  // TODO: Make this STACKOF and use X509_REQ_add_extensions
+//  X509_REQ_add1_ext_i2d(csr, NID_subject_alt_name, gens, 0, X509V3_ADD_DEFAULT);
+//  sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
+
+  X509_REQ_sign(csr, pkey, EVP_sha256());
+
+  // Save them...
+  if ((bio = BIO_new_file(keyfile, "wb")) == NULL)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
+    goto done;
+  }
+
+  if (!PEM_write_bio_PrivateKey(bio, pkey, NULL, NULL, 0, NULL, NULL))
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to write private key."), 1);
+    BIO_free(bio);
+    goto done;
+  }
+
+  BIO_free(bio);
+
+  if ((bio = BIO_new_file(csrfile, "wb")) == NULL)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
+    goto done;
+  }
+
+  if (!PEM_write_bio_X509_REQ(bio, csr))
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to write X.509 certificate signing request."), 1);
+    BIO_free(bio);
+    goto done;
+  }
+
+  BIO_free(bio);
+
+  // TODO: Copy CSR to returned string
+  result = strdup("");
+  DEBUG_puts("1cupsMakeServerRequest: Successfully created signing request.");
+
+  // Cleanup...
+  done:
+
+  X509_REQ_free(csr);
+  EVP_PKEY_free(pkey);
+
+  return (result);
+}
+
+
+//
+// 'cupsSaveServerCredentials()' - Save the X.509 certificate chain associated
+//                                 with a server.
+//
+// This function saves the the PEM-encoded X.509 certificate chain string to
+// the directory "path" or, if "path" is `NULL`, in a per-user or system-wide
+// (when running as root) certificate/key store.  The "common_name" value must
+// match the value supplied when the @link cupsMakeServerRequest@ function was
+// called to obtain the certificate signing request (CSR).  The saved
+// certificate is paired with the private key that was generated for the CSR,
+// allowing it to be used for encryption and signing.
+//
+
+extern bool				// O - `true` on success, `false` on failure
+cupsSaveServerCredentials(
+    const char *path,			// I - Directory path for certificate/key store or `NULL` for default
+    const char *common_name,		// I - Common name for certificate
+    const char *pem)			// I - PEM-encoded certificate chain
+{
+  // TODO: Implement cupsSaveServerCredentials
+  (void)path;
+  (void)common_name;
+  (void)pem;
+
+  return (false);
+}
+
+
 //
 // 'cupsSetServerCredentials()' - Set the default server credentials.
 //
@@ -379,7 +455,7 @@ cupsMakeServerCredentials(
 
 bool					// O - `true` on success, `false` on failure
 cupsSetServerCredentials(
-    const char *path,			// I - Path to keychain/directory
+    const char *path,			// I - Directory path for certificate/key store or `NULL` for default
     const char *common_name,		// I - Default common name for server
     bool       auto_create)		// I - `true` = automatically create self-signed certificates
 {
@@ -1332,6 +1408,28 @@ _httpTLSWrite(http_t     *http,		// I - Connection to server
 }
 
 
+//
+// 'http_add_san()' - Add a subjectAltName to GENERAL_NAMES used for
+//                    the extension to an X.509 certificate/signing request.
+//
+
+static void
+http_add_san(GENERAL_NAMES *gens,	// I - Concatenation of DNS names
+             const char    *name)	// I - Hostname
+{
+  GENERAL_NAME *gen_dns = GENERAL_NAME_new();
+					// DNS: name
+  ASN1_IA5STRING *ia5 = ASN1_IA5STRING_new();
+					// Hostname string
+
+
+  // Set the strings and push it on the GENERAL_NAMES list...
+  ASN1_STRING_set(ia5, name, strlen(name));
+  GENERAL_NAME_set0_value(gen_dns, GEN_DNS, ia5);
+  sk_GENERAL_NAME_push(gens, gen_dns);
+}
+
+
 //
 // 'http_bio_ctrl()' - Control the HTTP connection.
 //
@@ -1520,6 +1618,159 @@ http_create_credential(
 }
 
 
+//
+// 'http_create_key()' - Create a suitable key pair for a certificate/signing request.
+//
+
+static EVP_PKEY *			// O - Key pair
+http_create_key(cups_credtype_t type)	// I - Type of key
+{
+  EVP_PKEY	*pkey;			// Key pair
+#if defined(EVP_PKEY_EC)
+  EC_KEY	*ec = NULL;		// EC key
+#endif // EVP_PKEY_EC
+  RSA		*rsa = NULL;		// RSA key pair
+
+
+  switch (type)
+  {
+#if defined(EVP_PKEY_EC)
+    case CUPS_CREDTYPE_ECDSA_P256_SHA256 :
+	ec = EC_KEY_new_by_curve_name(NID_secp256k1);
+	break;
+
+    case CUPS_CREDTYPE_ECDSA_P384_SHA256 :
+	ec = EC_KEY_new_by_curve_name(NID_secp384r1);
+	break;
+
+    case CUPS_CREDTYPE_ECDSA_P521_SHA256 :
+	ec = EC_KEY_new_by_curve_name(NID_secp521r1);
+	break;
+#endif // EVP_PKEY_EC && USE_EC
+
+    case CUPS_CREDTYPE_RSA_2048_SHA256 :
+	rsa = RSA_generate_key(2048, RSA_F4, NULL, NULL);
+	break;
+
+    default :
+    case CUPS_CREDTYPE_RSA_3072_SHA256 :
+	rsa = RSA_generate_key(3072, RSA_F4, NULL, NULL);
+	break;
+
+    case CUPS_CREDTYPE_RSA_4096_SHA256 :
+	rsa = RSA_generate_key(4096, RSA_F4, NULL, NULL);
+	break;
+  }
+
+  if (!rsa && !ec)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create key pair."), 1);
+    return (NULL);
+  }
+
+  if ((pkey = EVP_PKEY_new()) == NULL)
+  {
+#if defined(EVP_PKEY_EC)
+    if (ec)
+      EC_KEY_free(ec);
+#endif // EVP_PKEY_EC && USE_EC
+
+    if (rsa)
+      RSA_free(rsa);
+
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create private key."), 1);
+    return (NULL);
+  }
+
+#if defined(EVP_PKEY_EC)
+  if (ec)
+    EVP_PKEY_assign_EC_KEY(pkey, ec);
+  else
+#endif // EVP_PKEY_EC
+  EVP_PKEY_assign_RSA(pkey, rsa);
+
+  return (pkey);
+}
+
+
+//
+// 'http_create_name()' - Create an X.509 name value for a certificate/signing request.
+//
+
+static X509_NAME *			// O - X.509 name value
+http_create_name(
+    const char      *organization,	// I - Organization or `NULL` to use common name
+    const char      *org_unit,		// I - Organizational unit or `NULL` for none
+    const char      *locality,		// I - City/town or `NULL` for "Unknown"
+    const char      *state_province,	// I - State/province or `NULL` for "Unknown"
+    const char      *country,		// I - Country or `NULL` for locale-based default
+    const char      *common_name)	// I - Common name
+{
+  X509_NAME	*name;			// Subject/issuer name
+  cups_lang_t	*language;		// Default language info
+  const char	*langname;		// Language name
+
+
+  language = cupsLangDefault();
+  langname = cupsLangGetName(language);
+  name     = X509_NAME_new();
+  if (country)
+    X509_NAME_add_entry_by_txt(name, SN_countryName, MBSTRING_ASC, (unsigned char *)country, -1, -1, 0);
+  else if (strlen(langname) == 5)
+    X509_NAME_add_entry_by_txt(name, SN_countryName, MBSTRING_ASC, (unsigned char *)langname + 3, -1, -1, 0);
+  else
+    X509_NAME_add_entry_by_txt(name, SN_countryName, MBSTRING_ASC, (unsigned char *)"US", -1, -1, 0);
+  X509_NAME_add_entry_by_txt(name, SN_commonName, MBSTRING_ASC, (unsigned char *)common_name, -1, -1, 0);
+  X509_NAME_add_entry_by_txt(name, SN_organizationName, MBSTRING_ASC, (unsigned char *)(organization ? organization : common_name), -1, -1, 0);
+  X509_NAME_add_entry_by_txt(name, SN_organizationalUnitName, MBSTRING_ASC, (unsigned char *)(org_unit ? org_unit : ""), -1, -1, 0);
+  X509_NAME_add_entry_by_txt(name, SN_stateOrProvinceName, MBSTRING_ASC, (unsigned char *)(state_province ? state_province : "Unknown"), -1, -1, 0);
+  X509_NAME_add_entry_by_txt(name, SN_localityName, MBSTRING_ASC, (unsigned char *)(locality ? locality : "Unknown"), -1, -1, 0);
+
+  return (name);
+}
+
+
+//
+// 'http_create_san()' - Create a list of subjectAltName values for a certificate/signing request.
+//
+
+static GENERAL_NAMES *			// O - List of subjectAltName values
+http_create_san(
+    const char *common_name,		// I - Common name
+    size_t     num_alt_names,		// I - Number of alternate names
+    const char **alt_names)		// I - List of alternate names
+{
+  GENERAL_NAMES	*gens;			// List of subjectAltName values
+  size_t	i;			// Looping var
+
+
+  gens = sk_GENERAL_NAME_new_null();
+
+  http_add_san(gens, common_name);
+  if (strstr(common_name, ".local") == NULL)
+  {
+    // Add common_name.local to the list, too...
+    char	localname[256],		// hostname.local
+		*localptr;		// Pointer into localname
+
+    strlcpy(localname, common_name, sizeof(localname));
+    if ((localptr = strchr(localname, '.')) != NULL)
+      *localptr = '\0';
+    strlcat(localname, ".local", sizeof(localname));
+
+    http_add_san(gens, localname);
+  }
+
+  for (i = 0; i < num_alt_names; i ++)
+  {
+    if (strcmp(alt_names[i], "localhost"))
+      http_add_san(gens, alt_names[i]);
+  }
+
+  return (gens);
+}
+
+
 //
 // 'http_default_path()' - Get the default credential store path.
 //
@@ -1790,25 +2041,3 @@ http_x509_add_ext(X509       *cert,	// I - Certificate
 
   return (ret);
 }
-
-
-//
-// 'http_x509_add_san()' - Add a subjectAltName to GENERAL_NAMES used for
-//                         the extension to an X.509 certificate.
-//
-
-static void
-http_x509_add_san(GENERAL_NAMES *gens,	// I - Concatenation of DNS names
-                  const char    *name)	// I - Hostname
-{
-  GENERAL_NAME *gen_dns = GENERAL_NAME_new();
-					// DNS: name
-  ASN1_IA5STRING *ia5 = ASN1_IA5STRING_new();
-					// Hostname string
-
-
-  // Set the strings and push it on the GENERAL_NAMES list...
-  ASN1_STRING_set(ia5, name, strlen(name));
-  GENERAL_NAME_set0_value(gen_dns, GEN_DNS, ia5);
-  sk_GENERAL_NAME_push(gens, gen_dns);
-}

From e7a984bd99f9b2a0992c84005911c37a4aba23f5 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Fri, 21 Apr 2023 23:45:00 -0400
Subject: [PATCH 05/31] Fix some Coverity issues.

---
 tools/ippeveprinter.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/tools/ippeveprinter.c b/tools/ippeveprinter.c
index a19dcc989..6f6dc3dae 100644
--- a/tools/ippeveprinter.c
+++ b/tools/ippeveprinter.c
@@ -1586,7 +1586,7 @@ create_printer(
     * Extract up to 3 icons...
     */
 
-    for (i = 1, iconsptr = strchr(icons, ','); iconsptr && i < 3; i ++, iconsptr = strchr(iconsptr, ','))
+    for (i = 1, iconsptr = strchr(printer->icons, ','); iconsptr && i < 3; i ++, iconsptr = strchr(iconsptr, ','))
     {
       *iconsptr++ = '\0';
       printer->icons[i] = iconsptr;
@@ -5995,7 +5995,10 @@ process_job(ippeve_job_t *job)		/* I - Job */
     }
 
     if (mystdout < 0)
-      mystdout = open("/dev/null", O_WRONLY | O_BINARY);
+    {
+      if ((mystdout = open("/dev/null", O_WRONLY | O_BINARY)) < 0)
+        fprintf(stderr, "[Job %d] Unable to redirect command output to /dev/null: %s", job->id, strerror(errno));
+    }
 
     if (pipe(mypipe))
     {

From 8a70202a99f14600ccf363c35698994d6bd82556 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Sun, 23 Apr 2023 17:45:19 -0400
Subject: [PATCH 06/31] Fix compile error

---
 tools/ippeveprinter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/ippeveprinter.c b/tools/ippeveprinter.c
index 6f6dc3dae..a384d7adb 100644
--- a/tools/ippeveprinter.c
+++ b/tools/ippeveprinter.c
@@ -1586,7 +1586,7 @@ create_printer(
     * Extract up to 3 icons...
     */
 
-    for (i = 1, iconsptr = strchr(printer->icons, ','); iconsptr && i < 3; i ++, iconsptr = strchr(iconsptr, ','))
+    for (i = 1, iconsptr = strchr(printer->icons[0], ','); iconsptr && i < 3; i ++, iconsptr = strchr(iconsptr, ','))
     {
       *iconsptr++ = '\0';
       printer->icons[i] = iconsptr;

From 9e3f27277693bd7ba49633c5914f0b11ed7d22ba Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Thu, 4 May 2023 12:27:32 -0400
Subject: [PATCH 07/31] Rework OpenSSL X.509 extension handling.

---
 cups/cups.h        |  150 +++---
 cups/tls-gnutls.c  | 1101 ++++++++++++++------------------------------
 cups/tls-openssl.c |  799 ++++++++++----------------------
 cups/tls.c         |  583 ++++++++++++++++++++++-
 4 files changed, 1231 insertions(+), 1402 deletions(-)

diff --git a/cups/cups.h b/cups/cups.h
index 43e0dcf5a..c455672b1 100644
--- a/cups/cups.h
+++ b/cups/cups.h
@@ -133,74 +133,101 @@ extern "C" {
 // Types and structures...
 //
 
-typedef enum cups_credtype_e		// X.509 credential types for @link cupsMakeServerCredentials@ and @link cupsMakeServerRequest@
+enum cups_credpurpose_e			//// X.509 credential purposes
 {
-  CUPS_CREDTYPE_DEFAULT,		// Default type
-  CUPS_CREDTYPE_RSA_2048_SHA256,	// RSA with 2048-bit keys and SHA-256 hash
-  CUPS_CREDTYPE_RSA_3072_SHA256,	// RSA with 3072-bit keys and SHA-256 hash
-  CUPS_CREDTYPE_RSA_4096_SHA256,	// RSA with 4096-bit keys and SHA-256 hash
-  CUPS_CREDTYPE_ECDSA_P256_SHA256,	// ECDSA using the P-256 curve with SHA-256 hash
-  CUPS_CREDTYPE_ECDSA_P384_SHA256,	// ECDSA using the P-384 curve with SHA-256 hash
-  CUPS_CREDTYPE_ECDSA_P521_SHA256	// ECDSA using the P-521 curve with SHA-256 hash
+  CUPS_CREDPURPOSE_SERVER_AUTH = 0x01,		// serverAuth
+  CUPS_CREDPURPOSE_CLIENT_AUTH = 0x02,		// clientAuth
+  CUPS_CREDPURPOSE_CODE_SIGNING = 0x04,		// codeSigning
+  CUPS_CREDPURPOSE_EMAIL_PROTECTION = 0x08,	// emailProtection
+  CUPS_CREDPURPOSE_TIME_STAMPING = 0x10,	// timeStamping
+  CUPS_CREDPURPOSE_OCSP_SIGNING = 0x20		// OCSPSigning
+};
+typedef unsigned cups_credpurpose_t;	//// Combined X.509 credential purposes for @link cupsCreateCredentials@ and @link cupsCreateCredentialsRequest@
+
+typedef enum cups_credtype_e		//// X.509 credential types for @link cupsCreateCredentials@ and @link cupsCreateCredentialsRequest@
+{
+  CUPS_CREDTYPE_DEFAULT,			// Default type
+  CUPS_CREDTYPE_RSA_2048_SHA256,		// RSA with 2048-bit keys and SHA-256 hash
+  CUPS_CREDTYPE_RSA_3072_SHA256,		// RSA with 3072-bit keys and SHA-256 hash
+  CUPS_CREDTYPE_RSA_4096_SHA256,		// RSA with 4096-bit keys and SHA-256 hash
+  CUPS_CREDTYPE_ECDSA_P256_SHA256,		// ECDSA using the P-256 curve with SHA-256 hash
+  CUPS_CREDTYPE_ECDSA_P384_SHA256,		// ECDSA using the P-384 curve with SHA-256 hash
+  CUPS_CREDTYPE_ECDSA_P521_SHA256		// ECDSA using the P-521 curve with SHA-256 hash
 } cups_credtype_t;
 
-enum cups_dest_flags_e			// Flags for @link cupsConnectDest@ and @link cupsEnumDests@
+enum cups_credusage_e			//// X.509 keyUsage flags
 {
-  CUPS_DEST_FLAGS_NONE = 0x00,		// No flags are set
-  CUPS_DEST_FLAGS_UNCONNECTED = 0x01,	// There is no connection
-  CUPS_DEST_FLAGS_MORE = 0x02,		// There are more destinations
-  CUPS_DEST_FLAGS_REMOVED = 0x04,	// The destination has gone away
-  CUPS_DEST_FLAGS_ERROR = 0x08,		// An error occurred
-  CUPS_DEST_FLAGS_RESOLVING = 0x10,	// The destination address is being resolved
-  CUPS_DEST_FLAGS_CONNECTING = 0x20,	// A connection is being established
-  CUPS_DEST_FLAGS_CANCELED = 0x40,	// Operation was canceled
-  CUPS_DEST_FLAGS_DEVICE = 0x80		// For @link cupsConnectDest@: Connect to device
+  CUPS_CREDUSAGE_DIGITAL_SIGNATURE = 0x001,	// digitalSignature
+  CUPS_CREDUSAGE_NON_REPUDIATION = 0x002,	// nonRepudiation/contentCommitment
+  CUPS_CREDUSAGE_KEY_ENCIPHERMENT = 0x004,	// keyEncipherment
+  CUPS_CREDUSAGE_DATA_ENCIPHERMENT = 0x008,	// dataEncipherment
+  CUPS_CREDUSAGE_KEY_AGREEMENT = 0x010,		// keyAgreement
+  CUPS_CREDUSAGE_KEY_CERT_SIGN = 0x020,		// keyCertSign
+  CUPS_CREDUSAGE_CRL_SIGN = 0x040,		// cRLSign
+  CUPS_CREDUSAGE_ENCIPHER_ONLY = 0x080,		// encipherOnly
+  CUPS_CREDUSAGE_DECIPHER_ONLY = 0x100,		// decipherOnly
+  CUPS_CREDUSAGE_DEFAULT_CA = 0x061,		// Defaults for CA certs
+  CUPS_CREDUSAGE_DEFAULT_TLS = 0x005		// Defaults for TLS certs
 };
-typedef unsigned cups_dest_flags_t;	// Combined flags for @link cupsConnectDest@ and @link cupsEnumDests@
+typedef unsigned cups_credusage_t;	//// Combined X.509 keyUsage flags for @link cupsCreateCredentials@ and @link cupsCreateCredentialsRequest@
 
-enum cups_media_flags_e			// Flags for @link cupsGetDestMediaByName@ and @link cupsGetDestMediaBySize@
+enum cups_dest_flags_e			//// Flags for @link cupsConnectDest@ and @link cupsEnumDests@
 {
-  CUPS_MEDIA_FLAGS_DEFAULT = 0x00,	// Find the closest size supported by the printer
-  CUPS_MEDIA_FLAGS_BORDERLESS = 0x01,	// Find a borderless size
-  CUPS_MEDIA_FLAGS_DUPLEX = 0x02,	// Find a size compatible with 2-sided printing
-  CUPS_MEDIA_FLAGS_EXACT = 0x04,	// Find an exact match for the size
-  CUPS_MEDIA_FLAGS_READY = 0x08		// If the printer supports media sensing, find the size amongst the "ready" media.
+  CUPS_DEST_FLAGS_NONE = 0x00,			// No flags are set
+  CUPS_DEST_FLAGS_UNCONNECTED = 0x01,		// There is no connection
+  CUPS_DEST_FLAGS_MORE = 0x02,			// There are more destinations
+  CUPS_DEST_FLAGS_REMOVED = 0x04,		// The destination has gone away
+  CUPS_DEST_FLAGS_ERROR = 0x08,			// An error occurred
+  CUPS_DEST_FLAGS_RESOLVING = 0x10,		// The destination address is being resolved
+  CUPS_DEST_FLAGS_CONNECTING = 0x20,		// A connection is being established
+  CUPS_DEST_FLAGS_CANCELED = 0x40,		// Operation was canceled
+  CUPS_DEST_FLAGS_DEVICE = 0x80			// For @link cupsConnectDest@: Connect to device
 };
-typedef unsigned cups_media_flags_t;	// Combined flags for @link cupsGetDestMediaByName@ and @link cupsGetDestMediaBySize@
+typedef unsigned cups_dest_flags_t;	//// Combined flags for @link cupsConnectDest@ and @link cupsEnumDests@
 
-enum cups_ptype_e			// Printer type/capability flags
+enum cups_media_flags_e			//// Flags for @link cupsGetDestMediaByName@ and @link cupsGetDestMediaBySize@
 {
-  CUPS_PRINTER_LOCAL = 0x0000,		// Local printer or class
-  CUPS_PRINTER_CLASS = 0x0001,		// Printer class
-  CUPS_PRINTER_REMOTE = 0x0002,		// Remote printer or class
-  CUPS_PRINTER_BW = 0x0004,		// Can do B&W printing
-  CUPS_PRINTER_COLOR = 0x0008,		// Can do color printing
-  CUPS_PRINTER_DUPLEX = 0x0010,		// Can do two-sided printing
-  CUPS_PRINTER_STAPLE = 0x0020,		// Can staple output
-  CUPS_PRINTER_COPIES = 0x0040,		// Can do copies in hardware
-  CUPS_PRINTER_COLLATE = 0x0080,	// Can quickly collate copies
-  CUPS_PRINTER_PUNCH = 0x0100,		// Can punch output
-  CUPS_PRINTER_COVER = 0x0200,		// Can cover output
-  CUPS_PRINTER_BIND = 0x0400,		// Can bind output
-  CUPS_PRINTER_SORT = 0x0800,		// Can sort output
-  CUPS_PRINTER_SMALL = 0x1000,		// Can print on Letter/Legal/A4-size media
-  CUPS_PRINTER_MEDIUM = 0x2000,		// Can print on Tabloid/B/C/A3/A2-size media
-  CUPS_PRINTER_LARGE = 0x4000,		// Can print on D/E/A1/A0-size media
-  CUPS_PRINTER_VARIABLE = 0x8000,	// Can print on rolls and custom-size media
-  CUPS_PRINTER_DEFAULT = 0x20000,	// Default printer on network
-  CUPS_PRINTER_FAX = 0x40000,		// Fax queue
-  CUPS_PRINTER_REJECTING = 0x80000,	// Printer is rejecting jobs
-  CUPS_PRINTER_NOT_SHARED = 0x200000,	// Printer is not shared
-  CUPS_PRINTER_AUTHENTICATED = 0x400000,// Printer requires authentication
-  CUPS_PRINTER_COMMANDS = 0x800000,	// Printer supports maintenance commands
-  CUPS_PRINTER_DISCOVERED = 0x1000000,	// Printer was discovered
-  CUPS_PRINTER_SCANNER = 0x2000000,	// Scanner-only device
-  CUPS_PRINTER_MFP = 0x4000000,		// Printer with scanning capabilities
-  CUPS_PRINTER_OPTIONS = 0x6fffc	// ~(CLASS | REMOTE | IMPLICIT | DEFAULT | FAX | REJECTING | DELETE | NOT_SHARED | AUTHENTICATED | COMMANDS | DISCOVERED) @private@
+  CUPS_MEDIA_FLAGS_DEFAULT = 0x00,		// Find the closest size supported by the printer
+  CUPS_MEDIA_FLAGS_BORDERLESS = 0x01,		// Find a borderless size
+  CUPS_MEDIA_FLAGS_DUPLEX = 0x02,		// Find a size compatible with 2-sided printing
+  CUPS_MEDIA_FLAGS_EXACT = 0x04,		// Find an exact match for the size
+  CUPS_MEDIA_FLAGS_READY = 0x08			// If the printer supports media sensing, find the size amongst the "ready" media.
 };
-typedef unsigned cups_ptype_t;		// Combined printer type/capability flags
+typedef unsigned cups_media_flags_t;	//// Combined flags for @link cupsGetDestMediaByName@ and @link cupsGetDestMediaBySize@
 
-typedef enum cups_whichjobs_e		// Which jobs for @link cupsGetJobs@
+enum cups_ptype_e			//// Printer type/capability flags
+{
+  CUPS_PRINTER_LOCAL = 0x0000,			// Local printer or class
+  CUPS_PRINTER_CLASS = 0x0001,			// Printer class
+  CUPS_PRINTER_REMOTE = 0x0002,			// Remote printer or class
+  CUPS_PRINTER_BW = 0x0004,			// Can do B&W printing
+  CUPS_PRINTER_COLOR = 0x0008,			// Can do color printing
+  CUPS_PRINTER_DUPLEX = 0x0010,			// Can do two-sided printing
+  CUPS_PRINTER_STAPLE = 0x0020,			// Can staple output
+  CUPS_PRINTER_COPIES = 0x0040,			// Can do copies in hardware
+  CUPS_PRINTER_COLLATE = 0x0080,		// Can quickly collate copies
+  CUPS_PRINTER_PUNCH = 0x0100,			// Can punch output
+  CUPS_PRINTER_COVER = 0x0200,			// Can cover output
+  CUPS_PRINTER_BIND = 0x0400,			// Can bind output
+  CUPS_PRINTER_SORT = 0x0800,			// Can sort output
+  CUPS_PRINTER_SMALL = 0x1000,			// Can print on Letter/Legal/A4-size media
+  CUPS_PRINTER_MEDIUM = 0x2000,			// Can print on Tabloid/B/C/A3/A2-size media
+  CUPS_PRINTER_LARGE = 0x4000,			// Can print on D/E/A1/A0-size media
+  CUPS_PRINTER_VARIABLE = 0x8000,		// Can print on rolls and custom-size media
+  CUPS_PRINTER_DEFAULT = 0x20000,		// Default printer on network
+  CUPS_PRINTER_FAX = 0x40000,			// Fax queue
+  CUPS_PRINTER_REJECTING = 0x80000,		// Printer is rejecting jobs
+  CUPS_PRINTER_NOT_SHARED = 0x200000,		// Printer is not shared
+  CUPS_PRINTER_AUTHENTICATED = 0x400000,	// Printer requires authentication
+  CUPS_PRINTER_COMMANDS = 0x800000,		// Printer supports maintenance commands
+  CUPS_PRINTER_DISCOVERED = 0x1000000,		// Printer was discovered
+  CUPS_PRINTER_SCANNER = 0x2000000,		// Scanner-only device
+  CUPS_PRINTER_MFP = 0x4000000,			// Printer with scanning capabilities
+  CUPS_PRINTER_OPTIONS = 0x6fffc		// ~(CLASS | REMOTE | IMPLICIT | DEFAULT | FAX | REJECTING | DELETE | NOT_SHARED | AUTHENTICATED | COMMANDS | DISCOVERED) @private@
+};
+typedef unsigned cups_ptype_t;		//// Combined printer type/capability flags
+
+typedef enum cups_whichjobs_e		//// Which jobs for @link cupsGetJobs@
 {
   CUPS_WHICHJOBS_ALL = -1,		// All jobs
   CUPS_WHICHJOBS_ACTIVE,		// Pending/held/processing jobs
@@ -284,10 +311,15 @@ extern bool		cupsCheckDestSupported(http_t *http, cups_dest_t *dest, cups_dinfo_
 extern ipp_status_t	cupsCloseDestJob(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, int job_id) _CUPS_PUBLIC;
 extern size_t		cupsConcatString(char *dst, const char *src, size_t dstsize) _CUPS_PUBLIC;
 extern http_t		*cupsConnectDest(cups_dest_t *dest, unsigned flags, int msec, int *cancel, char *resource, size_t resourcesize, cups_dest_cb_t cb, void *user_data) _CUPS_PUBLIC;
+extern char		*cupsCopyCredentials(const char *path, const char *common_name) _CUPS_PUBLIC;
+extern char		*cupsCopyCredentialsKey(const char *path, const char *common_name) _CUPS_PUBLIC;
+extern char		*cupsCopyCredentialsRequest(const char *path, const char *common_name) _CUPS_PUBLIC;
 extern size_t		cupsCopyDest(cups_dest_t *dest, size_t num_dests, cups_dest_t **dests) _CUPS_PUBLIC;
 extern cups_dinfo_t	*cupsCopyDestInfo(http_t *http, cups_dest_t *dest) _CUPS_PUBLIC;
 extern int		cupsCopyDestConflicts(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, size_t num_options, cups_option_t *options, const char *new_option, const char *new_value, size_t *num_conflicts, cups_option_t **conflicts, size_t *num_resolved, cups_option_t **resolved) _CUPS_PUBLIC;
 extern size_t		cupsCopyString(char *dst, const char *src, size_t dstsize) _CUPS_PUBLIC;
+extern bool		cupsCreateCredentials(const char *path, bool ca_cert, cups_credpurpose_t purpose, cups_credtype_t type, cups_credusage_t usage, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name, size_t num_alt_names, const char **alt_names, const char *root_name, time_t expiration_date) _CUPS_PUBLIC;
+extern bool		cupsCreateCredentialsRequest(const char *path, cups_credpurpose_t purpose, cups_credtype_t type, cups_credusage_t usage, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name, size_t num_alt_names, const char **alt_names) _CUPS_PUBLIC;
 extern ipp_status_t	cupsCreateDestJob(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, int *job_id, const char *title, size_t num_options, cups_option_t *options) _CUPS_PUBLIC;
 
 extern int		cupsDoAuthentication(http_t *http, const char *method, const char *resource) _CUPS_PUBLIC;
@@ -341,9 +373,6 @@ extern const char	*cupsLocalizeDestMedia(http_t *http, cups_dest_t *dest, cups_d
 extern const char	*cupsLocalizeDestOption(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, const char *option) _CUPS_PUBLIC;
 extern const char	*cupsLocalizeDestValue(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, const char *option, const char *value) _CUPS_PUBLIC;
 
-extern bool		cupsMakeServerCredentials(const char *path, cups_credtype_t type, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *root_name, bool ca_cert, const char *common_name, size_t num_alt_names, const char **alt_names, time_t expiration_date) _CUPS_PUBLIC;
-extern char		*cupsMakeServerRequest(const char *path, cups_credtype_t type, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name, size_t num_alt_names, const char **alt_names) _CUPS_PUBLIC;
-
 extern char		*cupsNotifySubject(cups_lang_t *lang, ipp_t *event) _CUPS_PUBLIC;
 extern char		*cupsNotifyText(cups_lang_t *lang, ipp_t *event) _CUPS_PUBLIC;
 
@@ -355,7 +384,7 @@ extern ssize_t		cupsReadResponseData(http_t *http, char *buffer, size_t length)
 extern size_t		cupsRemoveDest(const char *name, const char *instance, size_t num_dests, cups_dest_t **dests) _CUPS_PUBLIC;
 extern size_t		cupsRemoveOption(const char *name, size_t num_options, cups_option_t **options) _CUPS_PUBLIC;
 
-extern bool		cupsSaveServerCredentials(const char *path, const char *common_name, const char *pem) _CUPS_PUBLIC;
+extern bool		cupsSaveCredentials(const char *path, const char *common_name, const char *credentials, const char *key) _CUPS_PUBLIC;
 extern http_status_t	cupsSendRequest(http_t *http, ipp_t *request, const char *resource, size_t length) _CUPS_PUBLIC;
 extern void		cupsSetOAuthCB(cups_oauth_cb_t cb, void *data) _CUPS_PUBLIC;
 extern void		cupsSetClientCertCB(cups_client_cert_cb_t cb, void *user_data) _CUPS_PUBLIC;
@@ -369,6 +398,7 @@ extern void		cupsSetServerCertCB(cups_server_cert_cb_t cb, void *user_data) _CUP
 extern bool		cupsSetServerCredentials(const char *path, const char *common_name, bool auto_create) _CUPS_PUBLIC;
 extern void		cupsSetUser(const char *user) _CUPS_PUBLIC;
 extern void		cupsSetUserAgent(const char *user_agent) _CUPS_PUBLIC;
+extern bool		cupsSignCredentialsRequest(const char *path, const char *common_name, const char *request, const char *root_name, time_t expiration_date) _CUPS_PUBLIC;
 extern http_status_t	cupsStartDestDocument(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, int job_id, const char *docname, const char *format, size_t num_options, cups_option_t *options, bool last_document) _CUPS_PUBLIC;
 extern int		cupsTempFd(const char *prefix, const char *suffix, char *filename, size_t len) _CUPS_PUBLIC;
 extern cups_file_t	*cupsTempFile(const char *prefix, const char *suffix, char *filename, size_t len) _CUPS_PUBLIC;
diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index 92f856e54..ba05da168 100644
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -1,88 +1,78 @@
-/*
- * TLS support code for CUPS using GNU TLS.
- *
- * Copyright © 2020-2022 by OpenPrinting
- * Copyright © 2007-2019 by Apple Inc.
- * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
- *
- * Licensed under Apache License v2.0.  See the file "LICENSE" for more
- * information.
- */
-
-/**** This file is included from tls.c ****/
-
-/*
- * Include necessary headers...
- */
-
-#include <sys/stat.h>
-
-
-/*
- * Local globals...
- */
-
-static int		tls_auto_create = 0;
-					/* Auto-create self-signed certs? */
-static char		*tls_common_name = NULL;
-					/* Default common name */
-static gnutls_x509_crl_t tls_crl = NULL;/* Certificate revocation list */
-static char		*tls_keypath = NULL;
-					/* Server cert keychain path */
-static cups_mutex_t	tls_mutex = CUPS_MUTEX_INITIALIZER;
-					/* Mutex for keychain/certs */
-static int		tls_options = -1,/* Options for TLS connections */
-			tls_min_version = _HTTP_TLS_1_0,
-			tls_max_version = _HTTP_TLS_MAX;
-
-
-/*
- * Local functions...
- */
-
-static gnutls_x509_crt_t http_gnutls_create_credential(http_credential_t *credential);
-static const char	*http_gnutls_default_path(char *buffer, size_t bufsize);
-static void		http_gnutls_load_crl(void);
-static const char	*http_gnutls_make_path(char *buffer, size_t bufsize, const char *dirname, const char *filename, const char *ext);
-static ssize_t		http_gnutls_read(gnutls_transport_ptr_t ptr, void *data, size_t length);
-static ssize_t		http_gnutls_write(gnutls_transport_ptr_t ptr, const void *data, size_t length);
-
-
-/*
- * 'cupsMakeServerCredentials()' - Make a self-signed certificate and private key pair.
- */
-
-int					/* O - 1 on success, 0 on failure */
-cupsMakeServerCredentials(
-    const char *path,			/* I - Path to keychain/directory */
-    const char *common_name,		/* I - Common name */
-    int        num_alt_names,		/* I - Number of subject alternate names */
-    const char **alt_names,		/* I - Subject Alternate Names */
-    time_t     expiration_date)		/* I - Expiration date */
-{
-  gnutls_x509_crt_t	crt;		/* Self-signed certificate */
-  gnutls_x509_privkey_t	key;		/* Encryption private key */
-  char			temp[1024],	/* Temporary directory name */
- 			crtfile[1024],	/* Certificate filename */
-			keyfile[1024];	/* Private key filename */
-  cups_lang_t		*language;	/* Default language info */
-  const char		*langname;	/* Default language name */
-  cups_file_t		*fp;		/* Key/cert file */
-  unsigned char		buffer[8192];	/* Buffer for x509 data */
-  size_t		bytes;		/* Number of bytes of data */
-  unsigned char		serial[4];	/* Serial number buffer */
-  time_t		curtime;	/* Current time */
-  int			result;		/* Result of GNU TLS calls */
-
-
-  DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, alt_names, (int)expiration_date));
-
- /*
-  * Filenames...
-  */
+//
+// TLS support code for CUPS using GNU TLS.
+//
+// Copyright © 2020-2023 by OpenPrinting
+// Copyright © 2007-2019 by Apple Inc.
+// Copyright © 1997-2007 by Easy Software Products, all rights reserved.
+//
+// Licensed under Apache License v2.0.  See the file "LICENSE" for more
+// information.
+//
+
+//// This file is included from tls.c
+
+
+//
+// Local functions...
+//
+
+static gnutls_x509_crt_t gnutls_create_credential(http_credential_t *credential);
+static gnutls_x509_privkey_t gnutls_create_key(cups_credtype_t type);
+static void		gnutls_load_crl(void);
+static ssize_t		gnutls_read(gnutls_transport_ptr_t ptr, void *data, size_t length);
+static ssize_t		gnutls_write(gnutls_transport_ptr_t ptr, const void *data, size_t length);
+
+
+//
+// 'cupsCreateCredentials()' - Make an X.509 certificate and private key pair.
+//
+// This function creates an X.509 certificate and private key pair.  The
+// certificate and key are stored in the directory "path" or, if "path" is
+// `NULL`, in a per-user or system-wide (when running as root) certificate/key
+// store.  The generated certificate is signed by the named root certificate or,
+// if "root_name" is `NULL`, a site-wide default root certificate.  When
+// "root_name" is `NULL` and there is no site-wide default root certificate, a
+// self-signed certificate is generated instead.
+//
 
+bool					// O - `true` on success, `false` on error
+cupsCreateCredentials(
+    const char         *path,		// I - Directory path for certificate/key store or `NULL` for default
+    bool               ca_cert,		// I - `true` to create a CA certificate, `false` for a client/server certificate
+    cups_credpurpose_t purpose,		// I - Credential purposes
+    cups_credtype_t    type,		// I - Credential type
+    cups_credusage_t   usage,		// I - Credential usages
+    const char         *organization,	// I - Organization or `NULL` to use common name
+    const char         *org_unit,	// I - Organizational unit or `NULL` for none
+    const char         *locality,	// I - City/town or `NULL` for "Unknown"
+    const char         *state_province,	// I - State/province or `NULL` for "Unknown"
+    const char         *country,	// I - Country or `NULL` for locale-based default
+    const char         *common_name,	// I - Common name
+    size_t             num_alt_names,	// I - Number of subject alternate names
+    const char         **alt_names,	// I - Subject Alternate Names
+    const char         *root_name,	// I - Root certificate/domain name or `NULL` for site/self-signed
+    time_t             expiration_date)	// I - Expiration date
+{
+  gnutls_x509_crt_t	crt;		// Self-signed certificate
+  gnutls_x509_privkey_t	key;		// Encryption private key
+  char			temp[1024],	// Temporary directory name
+ 			crtfile[1024],	// Certificate filename
+			keyfile[1024];	// Private key filename
+  cups_lang_t		*language;	// Default language info
+  const char		*langname;	// Default language name
+  cups_file_t		*fp;		// Key/cert file
+  unsigned char		buffer[8192];	// Buffer for x509 data
+  size_t		bytes;		// Number of bytes of data
+  unsigned char		serial[4];	// Serial number buffer
+  time_t		curtime;	// Current time
+  int			result;		// Result of GNU TLS calls
+
+
+  DEBUG_printf(("cupsCreateCredentials(path=\"%s\", ca_cert=%s, purpose=0x%x, type=%d, usage=0x%x, organization=\"%s\", org_unit=\"%s\", locality=\"%s\", state_province=\"%s\", country=\"%s\", common_name=\"%s\", num_alt_names=%u, alt_names=%p, root_name=\"%s\", expiration_date=%ld)", path, ca_cert ? "true" : "false", purpose, type, usage, organization, org_unit, locality, state_province, country, common_name, (unsigned)num_alt_names, alt_names, root_name, (long)expiration_date));
+
+  // Filenames...
   if (!path)
-    path = http_gnutls_default_path(temp, sizeof(temp));
+    path = http_default_path(temp, sizeof(temp));
 
   if (!path || !common_name)
   {
@@ -90,52 +80,42 @@ cupsMakeServerCredentials(
     return (0);
   }
 
-  http_gnutls_make_path(crtfile, sizeof(crtfile), path, common_name, "crt");
-  http_gnutls_make_path(keyfile, sizeof(keyfile), path, common_name, "key");
+  http_make_path(crtfile, sizeof(crtfile), path, common_name, "crt");
+  http_make_path(keyfile, sizeof(keyfile), path, common_name, "key");
 
- /*
-  * Create the encryption key...
-  */
+  // Create the encryption key...
+  DEBUG_puts("1cupsCreateCredentials: Creating key pair.");
 
-  DEBUG_puts("1cupsMakeServerCredentials: Creating key pair.");
+  key = gnutls_create_key(type);
 
-  gnutls_x509_privkey_init(&key);
-  gnutls_x509_privkey_generate(key, GNUTLS_PK_RSA, 3072, 0);
-
-  DEBUG_puts("1cupsMakeServerCredentials: Key pair created.");
-
- /*
-  * Save it...
-  */
+  DEBUG_puts("1cupsCreateCredentials: Key pair created.");
 
+  // Save it...
   bytes = sizeof(buffer);
 
   if ((result = gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
   {
-    DEBUG_printf(("1cupsMakeServerCredentials: Unable to export private key: %s", gnutls_strerror(result)));
+    DEBUG_printf(("1cupsCreateCredentials: Unable to export private key: %s", gnutls_strerror(result)));
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
     gnutls_x509_privkey_deinit(key);
     return (0);
   }
   else if ((fp = cupsFileOpen(keyfile, "w")) != NULL)
   {
-    DEBUG_printf(("1cupsMakeServerCredentials: Writing private key to \"%s\".", keyfile));
+    DEBUG_printf(("1cupsCreateCredentials: Writing private key to \"%s\".", keyfile));
     cupsFileWrite(fp, (char *)buffer, bytes);
     cupsFileClose(fp);
   }
   else
   {
-    DEBUG_printf(("1cupsMakeServerCredentials: Unable to create private key file \"%s\": %s", keyfile, strerror(errno)));
+    DEBUG_printf(("1cupsCreateCredentials: Unable to create private key file \"%s\": %s", keyfile, strerror(errno)));
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
     gnutls_x509_privkey_deinit(key);
     return (0);
   }
 
- /*
-  * Create the self-signed certificate...
-  */
-
-  DEBUG_puts("1cupsMakeServerCredentials: Generating self-signed X.509 certificate.");
+  // Create the self-signed certificate...
+  DEBUG_puts("1cupsCreateCredentials: Generating self-signed X.509 certificate.");
 
   language  = cupsLangDefault();
   langname  = cupsLangGetName(language);
@@ -155,7 +135,7 @@ cupsMakeServerCredentials(
   gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME, 0, "Unknown", 7);
   gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0, "Unknown", 7);
   gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_LOCALITY_NAME, 0, "Unknown", 7);
-/*  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_PKCS9_EMAIL, 0, ServerAdmin, strlen(ServerAdmin));*/
+//  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_PKCS9_EMAIL, 0, ServerAdmin, strlen(ServerAdmin));
   gnutls_x509_crt_set_key(crt, key);
   gnutls_x509_crt_set_serial(crt, serial, sizeof(serial));
   gnutls_x509_crt_set_activation_time(crt, curtime);
@@ -164,11 +144,8 @@ cupsMakeServerCredentials(
   gnutls_x509_crt_set_subject_alt_name(crt, GNUTLS_SAN_DNSNAME, common_name, (unsigned)strlen(common_name), GNUTLS_FSAN_SET);
   if (!strchr(common_name, '.'))
   {
-   /*
-    * Add common_name.local to the list, too...
-    */
-
-    char localname[256];                /* hostname.local */
+    // Add common_name.local to the list, too...
+    char localname[256];                // hostname.local
 
     snprintf(localname, sizeof(localname), "%s.local", common_name);
     gnutls_x509_crt_set_subject_alt_name(crt, GNUTLS_SAN_DNSNAME, localname, (unsigned)strlen(localname), GNUTLS_FSAN_APPEND);
@@ -176,7 +153,7 @@ cupsMakeServerCredentials(
   gnutls_x509_crt_set_subject_alt_name(crt, GNUTLS_SAN_DNSNAME, "localhost", 9, GNUTLS_FSAN_APPEND);
   if (num_alt_names > 0)
   {
-    int i;                              /* Looping var */
+    size_t i;				// Looping var
 
     for (i = 0; i < num_alt_names; i ++)
     {
@@ -196,14 +173,11 @@ cupsMakeServerCredentials(
 
   gnutls_x509_crt_sign(crt, crt, key);
 
- /*
-  * Save it...
-  */
-
+  // Save it...
   bytes = sizeof(buffer);
   if ((result = gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
   {
-    DEBUG_printf(("1cupsMakeServerCredentials: Unable to export public key and X.509 certificate: %s", gnutls_strerror(result)));
+    DEBUG_printf(("1cupsCreateCredentials: Unable to export public key and X.509 certificate: %s", gnutls_strerror(result)));
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
     gnutls_x509_crt_deinit(crt);
     gnutls_x509_privkey_deinit(key);
@@ -211,105 +185,41 @@ cupsMakeServerCredentials(
   }
   else if ((fp = cupsFileOpen(crtfile, "w")) != NULL)
   {
-    DEBUG_printf(("1cupsMakeServerCredentials: Writing public key and X.509 certificate to \"%s\".", crtfile));
+    DEBUG_printf(("1cupsCreateCredentials: Writing public key and X.509 certificate to \"%s\".", crtfile));
     cupsFileWrite(fp, (char *)buffer, bytes);
     cupsFileClose(fp);
   }
   else
   {
-    DEBUG_printf(("1cupsMakeServerCredentials: Unable to create public key and X.509 certificate file \"%s\": %s", crtfile, strerror(errno)));
+    DEBUG_printf(("1cupsCreateCredentials: Unable to create public key and X.509 certificate file \"%s\": %s", crtfile, strerror(errno)));
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
     gnutls_x509_crt_deinit(crt);
     gnutls_x509_privkey_deinit(key);
     return (0);
   }
 
- /*
-  * Cleanup...
-  */
-
+  // Cleanup...
   gnutls_x509_crt_deinit(crt);
   gnutls_x509_privkey_deinit(key);
 
-  DEBUG_puts("1cupsMakeServerCredentials: Successfully created credentials.");
-
-  return (1);
-}
-
-
-/*
- * 'cupsSetServerCredentials()' - Set the default server credentials.
- *
- * Note: The server credentials are used by all threads in the running process.
- * This function is threadsafe.
- */
-
-int					/* O - 1 on success, 0 on failure */
-cupsSetServerCredentials(
-    const char *path,			/* I - Path to keychain/directory */
-    const char *common_name,		/* I - Default common name for server */
-    int        auto_create)		/* I - 1 = automatically create self-signed certificates */
-{
-  char	temp[1024];			/* Default path buffer */
-
-
-  DEBUG_printf(("cupsSetServerCredentials(path=\"%s\", common_name=\"%s\", auto_create=%d)", path, common_name, auto_create));
-
- /*
-  * Use defaults as needed...
-  */
-
-  if (!path)
-    path = http_gnutls_default_path(temp, sizeof(temp));
-
- /*
-  * Range check input...
-  */
-
-  if (!path || !common_name)
-  {
-    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(EINVAL), 0);
-    return (0);
-  }
-
-  cupsMutexLock(&tls_mutex);
-
- /*
-  * Free old values...
-  */
-
-  if (tls_keypath)
-    _cupsStrFree(tls_keypath);
-
-  if (tls_common_name)
-    _cupsStrFree(tls_common_name);
-
- /*
-  * Save the new values...
-  */
-
-  tls_keypath     = _cupsStrAlloc(path);
-  tls_auto_create = auto_create;
-  tls_common_name = _cupsStrAlloc(common_name);
-
-  cupsMutexUnlock(&tls_mutex);
+  DEBUG_puts("1cupsCreateCredentials: Successfully created credentials.");
 
   return (1);
 }
 
 
-/*
- * 'httpCopyCredentials()' - Copy the credentials associated with the peer in
- *                           an encrypted connection.
- */
+//
+// 'httpCopyCredentials()' - Copy the credentials associated with the peer in
+//                           an encrypted connection.
+//
 
-int					/* O - Status of call (0 = success) */
+int					// O - Status of call (0 = success)
 httpCopyCredentials(
-    http_t	 *http,			/* I - Connection to server */
-    cups_array_t **credentials)		/* O - Array of credentials */
+    http_t	 *http,			// I - Connection to server
+    cups_array_t **credentials)		// O - Array of credentials
 {
-  unsigned		count;		/* Number of certificates */
-  const gnutls_datum_t *certs;		/* Certificates */
+  unsigned		count;		// Number of certificates
+  const gnutls_datum_t *certs;		// Certificates
 
 
   DEBUG_printf(("httpCopyCredentials(http=%p, credentials=%p)", http, credentials));
@@ -339,13 +249,13 @@ httpCopyCredentials(
 }
 
 
-/*
- * '_httpCreateCredentials()' - Create credentials in the internal format.
- */
+//
+// '_httpCreateCredentials()' - Create credentials in the internal format.
+//
 
-http_tls_credentials_t			/* O - Internal credentials */
+http_tls_credentials_t			// O - Internal credentials
 _httpCreateCredentials(
-    cups_array_t *credentials)		/* I - Array of credentials */
+    cups_array_t *credentials)		// I - Array of credentials
 {
   (void)credentials;
 
@@ -353,32 +263,20 @@ _httpCreateCredentials(
 }
 
 
-/*
- * '_httpFreeCredentials()' - Free internal credentials.
- */
+//
+// 'httpCredentialsAreValidForName()' - Return whether the credentials are valid for the given name.
+//
 
-void
-_httpFreeCredentials(
-    http_tls_credentials_t credentials)	/* I - Internal credentials */
-{
-  (void)credentials;
-}
-
-
-/*
- * 'httpCredentialsAreValidForName()' - Return whether the credentials are valid for the given name.
- */
-
-int					/* O - 1 if valid, 0 otherwise */
+int					// O - 1 if valid, 0 otherwise
 httpCredentialsAreValidForName(
-    cups_array_t *credentials,		/* I - Credentials */
-    const char   *common_name)		/* I - Name to check */
+    cups_array_t *credentials,		// I - Credentials
+    const char   *common_name)		// I - Name to check
 {
-  gnutls_x509_crt_t	cert;		/* Certificate */
-  int			result = 0;	/* Result */
+  gnutls_x509_crt_t	cert;		// Certificate
+  int			result = 0;	// Result
 
 
-  cert = http_gnutls_create_credential((http_credential_t *)cupsArrayGetFirst(credentials));
+  cert = gnutls_create_credential((http_credential_t *)cupsArrayGetFirst(credentials));
   if (cert)
   {
     result = gnutls_x509_crt_check_hostname(cert, common_name) != 0;
@@ -386,11 +284,11 @@ httpCredentialsAreValidForName(
     if (result)
     {
       gnutls_x509_crl_iter_t iter = NULL;
-					/* Iterator */
-      unsigned char	cserial[1024],	/* Certificate serial number */
-			rserial[1024];	/* Revoked serial number */
-      size_t		cserial_size,	/* Size of cert serial number */
-			rserial_size;	/* Size of revoked serial number */
+					// Iterator
+      unsigned char	cserial[1024],	// Certificate serial number
+			rserial[1024];	// Revoked serial number
+      size_t		cserial_size,	// Size of cert serial number
+			rserial_size;	// Size of revoked serial number
 
       cupsMutexLock(&tls_mutex);
 
@@ -424,21 +322,21 @@ httpCredentialsAreValidForName(
 }
 
 
-/*
- * 'httpCredentialsGetTrust()' - Return the trust of credentials.
- */
+//
+// 'httpCredentialsGetTrust()' - Return the trust of credentials.
+//
 
-http_trust_t				/* O - Level of trust */
+http_trust_t				// O - Level of trust
 httpCredentialsGetTrust(
-    cups_array_t *credentials,		/* I - Credentials */
-    const char   *common_name)		/* I - Common name for trust lookup */
+    cups_array_t *credentials,		// I - Credentials
+    const char   *common_name)		// I - Common name for trust lookup
 {
   http_trust_t		trust = HTTP_TRUST_OK;
-					/* Trusted? */
-  gnutls_x509_crt_t	cert;		/* Certificate */
-  cups_array_t		*tcreds = NULL;	/* Trusted credentials */
+					// Trusted?
+  gnutls_x509_crt_t	cert;		// Certificate
+  cups_array_t		*tcreds = NULL;	// Trusted credentials
   _cups_globals_t	*cg = _cupsGlobals();
-					/* Per-thread globals */
+					// Per-thread globals
 
 
   if (!common_name)
@@ -447,7 +345,7 @@ httpCredentialsGetTrust(
     return (HTTP_TRUST_UNKNOWN);
   }
 
-  if ((cert = http_gnutls_create_credential((http_credential_t *)cupsArrayGetFirst(credentials))) == NULL)
+  if ((cert = gnutls_create_credential((http_credential_t *)cupsArrayGetFirst(credentials))) == NULL)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create credentials from array."), 1);
     return (HTTP_TRUST_UNKNOWN);
@@ -456,66 +354,48 @@ httpCredentialsGetTrust(
   if (cg->any_root < 0)
   {
     _cupsSetDefaults();
-    http_gnutls_load_crl();
+    gnutls_load_crl();
   }
 
- /*
-  * Look this common name up in the default keychains...
-  */
-
+  // Look this common name up in the default keychains...
   httpLoadCredentials(NULL, &tcreds, common_name);
 
   if (tcreds)
   {
-    char	credentials_str[1024],	/* String for incoming credentials */
-		tcreds_str[1024];	/* String for saved credentials */
+    char	credentials_str[1024],	// String for incoming credentials
+		tcreds_str[1024];	// String for saved credentials
 
     httpCredentialsString(credentials, credentials_str, sizeof(credentials_str));
     httpCredentialsString(tcreds, tcreds_str, sizeof(tcreds_str));
 
     if (strcmp(credentials_str, tcreds_str))
     {
-     /*
-      * Credentials don't match, let's look at the expiration date of the new
-      * credentials and allow if the new ones have a later expiration...
-      */
-
+      // Credentials don't match, let's look at the expiration date of the new
+      // credentials and allow if the new ones have a later expiration...
       if (!cg->trust_first)
       {
-       /*
-        * Do not trust certificates on first use...
-	*/
-
+        // Do not trust certificates on first use...
         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
 
         trust = HTTP_TRUST_INVALID;
       }
       else if (httpCredentialsGetExpiration(credentials) <= httpCredentialsGetExpiration(tcreds))
       {
-       /*
-        * The new credentials are not newly issued...
-	*/
-
+        // The new credentials are not newly issued...
         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("New credentials are older than stored credentials."), 1);
 
         trust = HTTP_TRUST_INVALID;
       }
       else if (!httpCredentialsAreValidForName(credentials, common_name))
       {
-       /*
-        * The common name does not match the issued certificate...
-	*/
-
+        // The common name does not match the issued certificate...
         _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("New credentials are not valid for name."), 1);
 
         trust = HTTP_TRUST_INVALID;
       }
       else if (httpCredentialsGetExpiration(tcreds) < time(NULL))
       {
-       /*
-        * Save the renewed credentials...
-	*/
-
+        // Save the renewed credentials...
 	trust = HTTP_TRUST_RENEWED;
 
         httpSaveCredentials(NULL, credentials, common_name);
@@ -531,33 +411,24 @@ httpCredentialsGetTrust(
   }
   else if (!cg->trust_first)
   {
-   /*
-    * See if we have a site CA certificate we can compare...
-    */
-
+    // See if we have a site CA certificate we can compare...
     if (!httpLoadCredentials(NULL, &tcreds, "site"))
     {
       if (cupsArrayGetCount(credentials) != (cupsArrayGetCount(tcreds) + 1))
       {
-       /*
-        * Certificate isn't directly generated from the CA cert...
-	*/
-
+        // Certificate isn't directly generated from the CA cert...
         trust = HTTP_TRUST_INVALID;
       }
       else
       {
-       /*
-        * Do a tail comparison of the two certificates...
-	*/
+        // Do a tail comparison of the two certificates...
+        http_credential_t *a, *b;	// Certificates
 
-        http_credential_t	*a, *b;		/* Certificates */
-
-        for (a = (http_credential_t *)cupsArrayGetFirst(tcreds), b = (http_credential_t *)cupsArrayGetElement(credentials, 1);
-	     a && b;
-	     a = (http_credential_t *)cupsArrayGetNext(tcreds), b = (http_credential_t *)cupsArrayGetNext(credentials))
+        for (a = (http_credential_t *)cupsArrayGetFirst(tcreds), b = (http_credential_t *)cupsArrayGetElement(credentials, 1); a && b; a = (http_credential_t *)cupsArrayGetNext(tcreds), b = (http_credential_t *)cupsArrayGetNext(credentials))
+        {
 	  if (a->datalen != b->datalen || memcmp(a->data, b->data, a->datalen))
 	    break;
+	}
 
         if (a || b)
 	  trust = HTTP_TRUST_INVALID;
@@ -575,7 +446,7 @@ httpCredentialsGetTrust(
 
   if (trust == HTTP_TRUST_OK && !cg->expired_certs)
   {
-    time_t	curtime;		/* Current date/time */
+    time_t	curtime;		// Current date/time
 
     time(&curtime);
     if (curtime < gnutls_x509_crt_get_activation_time(cert) ||
@@ -598,19 +469,19 @@ httpCredentialsGetTrust(
 }
 
 
-/*
- * 'httpCredentialsGetExpiration()' - Return the expiration date of the credentials.
- */
+//
+// 'httpCredentialsGetExpiration()' - Return the expiration date of the credentials.
+//
 
-time_t					/* O - Expiration date of credentials */
+time_t					// O - Expiration date of credentials
 httpCredentialsGetExpiration(
-    cups_array_t *credentials)		/* I - Credentials */
+    cups_array_t *credentials)		// I - Credentials
 {
-  gnutls_x509_crt_t	cert;		/* Certificate */
-  time_t		result = 0;	/* Result */
+  gnutls_x509_crt_t	cert;		// Certificate
+  time_t		result = 0;	// Result
 
 
-  cert = http_gnutls_create_credential((http_credential_t *)cupsArrayGetFirst(credentials));
+  cert = gnutls_create_credential((http_credential_t *)cupsArrayGetFirst(credentials));
   if (cert)
   {
     result = gnutls_x509_crt_get_expiration_time(cert);
@@ -621,18 +492,18 @@ httpCredentialsGetExpiration(
 }
 
 
-/*
- * 'httpCredentialsString()' - Return a string representing the credentials.
- */
+//
+// 'httpCredentialsString()' - Return a string representing the credentials.
+//
 
-size_t					/* O - Total size of credentials string */
+size_t					// O - Total size of credentials string
 httpCredentialsString(
-    cups_array_t *credentials,		/* I - Credentials */
-    char         *buffer,		/* I - Buffer or @code NULL@ */
-    size_t       bufsize)		/* I - Size of buffer */
+    cups_array_t *credentials,		// I - Credentials
+    char         *buffer,		// I - Buffer or @code NULL@
+    size_t       bufsize)		// I - Size of buffer
 {
-  http_credential_t	*first;		/* First certificate */
-  gnutls_x509_crt_t	cert;		/* Certificate */
+  http_credential_t	*first;		// First certificate
+  gnutls_x509_crt_t	cert;		// Certificate
 
 
   DEBUG_printf(("httpCredentialsString(credentials=%p, buffer=%p, bufsize=" CUPS_LLFMT ")", credentials, buffer, CUPS_LLCAST bufsize));
@@ -644,15 +515,15 @@ httpCredentialsString(
     *buffer = '\0';
 
   if ((first = (http_credential_t *)cupsArrayGetFirst(credentials)) != NULL &&
-      (cert = http_gnutls_create_credential(first)) != NULL)
+      (cert = gnutls_create_credential(first)) != NULL)
   {
-    char		name[256],	/* Common name associated with cert */
-			issuer[256];	/* Issuer associated with cert */
-    size_t		len;		/* Length of string */
-    time_t		expiration;	/* Expiration date of cert */
+    char		name[256],	// Common name associated with cert
+			issuer[256];	// Issuer associated with cert
+    size_t		len;		// Length of string
+    time_t		expiration;	// Expiration date of cert
     char		expstr[256];	// Expiration date as string */
-    int			sigalg;	/* Signature algorithm */
-    unsigned char	md5_digest[16];	/* MD5 result */
+    int			sigalg;		// Signature algorithm
+    unsigned char	md5_digest[16];	// MD5 result
 
     len = sizeof(name) - 1;
     if (gnutls_x509_crt_get_dn_by_oid(cert, GNUTLS_OID_X520_COMMON_NAME, 0, 0, name, &len) >= 0)
@@ -682,214 +553,39 @@ httpCredentialsString(
 }
 
 
-/*
- * 'httpLoadCredentials()' - Load X.509 credentials from a keychain file.
- */
-
-bool					// O - `true` on success, `false` on error
-httpLoadCredentials(
-    const char   *path,			/* I  - Keychain/PKCS#12 path */
-    cups_array_t **credentials,		/* IO - Credentials */
-    const char   *common_name)		/* I  - Common name for credentials */
-{
-  cups_file_t		*fp;		/* Certificate file */
-  char			filename[1024],	/* filename.crt */
-			temp[1024],	/* Temporary string */
-			line[256];	/* Base64-encoded line */
-  unsigned char		*data = NULL;	/* Buffer for cert data */
-  size_t		alloc_data = 0,	/* Bytes allocated */
-			num_data = 0;	/* Bytes used */
-  size_t		decoded;	/* Bytes decoded */
-  int			in_certificate = 0;
-					/* In a certificate? */
-
-
-  if (credentials)
-    *credentials = NULL;
-
-  if (!credentials || !common_name)
-    return (false);
-
-  if (!path)
-    path = http_gnutls_default_path(temp, sizeof(temp));
-  if (!path)
-    return (false);
-
-  http_gnutls_make_path(filename, sizeof(filename), path, common_name, "crt");
-
-  if ((fp = cupsFileOpen(filename, "r")) == NULL)
-    return (false);
-
-  while (cupsFileGets(fp, line, sizeof(line)))
-  {
-    if (!strcmp(line, "-----BEGIN CERTIFICATE-----"))
-    {
-      if (in_certificate)
-      {
-       /*
-	* Missing END CERTIFICATE...
-	*/
-
-        httpFreeCredentials(*credentials);
-	*credentials = NULL;
-        break;
-      }
-
-      in_certificate = 1;
-    }
-    else if (!strcmp(line, "-----END CERTIFICATE-----"))
-    {
-      if (!in_certificate || !num_data)
-      {
-       /*
-	* Missing data...
-	*/
-
-        httpFreeCredentials(*credentials);
-	*credentials = NULL;
-        break;
-      }
-
-      if (!*credentials)
-        *credentials = cupsArrayNew(NULL, NULL, NULL, 0, NULL, NULL);
-
-      if (httpAddCredential(*credentials, data, num_data))
-      {
-        httpFreeCredentials(*credentials);
-	*credentials = NULL;
-        break;
-      }
-
-      num_data       = 0;
-      in_certificate = 0;
-    }
-    else if (in_certificate)
-    {
-      if (alloc_data == 0)
-      {
-        data       = malloc(2048);
-	alloc_data = 2048;
-
-        if (!data)
-	  break;
-      }
-      else if ((num_data + strlen(line)) >= alloc_data)
-      {
-        unsigned char *tdata = realloc(data, alloc_data + 1024);
-					/* Expanded buffer */
-
-	if (!tdata)
-	{
-	  httpFreeCredentials(*credentials);
-	  *credentials = NULL;
-	  break;
-	}
-
-	data       = tdata;
-        alloc_data += 1024;
-      }
-
-      decoded = (size_t)(alloc_data - num_data);
-      httpDecode64((char *)data + num_data, &decoded, line, NULL);
-      num_data += (size_t)decoded;
-    }
-  }
-
-  cupsFileClose(fp);
-
-  if (in_certificate)
-  {
-   /*
-    * Missing END CERTIFICATE...
-    */
-
-    httpFreeCredentials(*credentials);
-    *credentials = NULL;
-  }
-
-  if (data)
-    free(data);
-
-  return (*credentials != NULL);
-}
-
-
-/*
- * 'httpSaveCredentials()' - Save X.509 credentials to a keychain file.
- */
+//
+// '_httpFreeCredentials()' - Free internal credentials.
+//
 
-bool					// O - `true` on success, `false` on error
-httpSaveCredentials(
-    const char   *path,			/* I - Keychain/PKCS#12 path */
-    cups_array_t *credentials,		/* I - Credentials */
-    const char   *common_name)		/* I - Common name for credentials */
+void
+_httpFreeCredentials(
+    http_tls_credentials_t credentials)	// I - Internal credentials
 {
-  cups_file_t		*fp;		/* Certificate file */
-  char			filename[1024],	/* filename.crt */
-			nfilename[1024],/* filename.crt.N */
-			temp[1024],	/* Temporary string */
-			line[256];	/* Base64-encoded line */
-  const unsigned char	*ptr;		/* Pointer into certificate */
-  ssize_t		remaining;	/* Bytes left */
-  http_credential_t	*cred;		/* Current credential */
-
-
-  if (!credentials || !common_name)
-    return (false);
-
-  if (!path)
-    path = http_gnutls_default_path(temp, sizeof(temp));
-  if (!path)
-    return (false);
-
-  http_gnutls_make_path(filename, sizeof(filename), path, common_name, "crt");
-  snprintf(nfilename, sizeof(nfilename), "%s.N", filename);
-
-  if ((fp = cupsFileOpen(nfilename, "w")) == NULL)
-    return (false);
-
-  fchmod(cupsFileNumber(fp), 0600);
-
-  for (cred = (http_credential_t *)cupsArrayGetFirst(credentials);
-       cred;
-       cred = (http_credential_t *)cupsArrayGetNext(credentials))
-  {
-    cupsFilePuts(fp, "-----BEGIN CERTIFICATE-----\n");
-    for (ptr = cred->data, remaining = (ssize_t)cred->datalen; remaining > 0; remaining -= 45, ptr += 45)
-    {
-      httpEncode64(line, sizeof(line), (char *)ptr, remaining > 45 ? 45 : (size_t)remaining, false);
-      cupsFilePrintf(fp, "%s\n", line);
-    }
-    cupsFilePuts(fp, "-----END CERTIFICATE-----\n");
-  }
-
-  cupsFileClose(fp);
-
-  return (!rename(nfilename, filename));
+  (void)credentials;
 }
 
 
-/*
- * 'http_gnutls_create_credential()' - Create a single credential in the internal format.
- */
+//
+// 'gnutls_create_credential()' - Create a single credential in the internal format.
+//
 
-static gnutls_x509_crt_t			/* O - Certificate */
-http_gnutls_create_credential(
-    http_credential_t *credential)		/* I - Credential */
+static gnutls_x509_crt_t			// O - Certificate
+gnutls_create_credential(
+    http_credential_t *credential)		// I - Credential
 {
-  int			result;			/* Result from GNU TLS */
-  gnutls_x509_crt_t	cert;			/* Certificate */
-  gnutls_datum_t	datum;			/* Data record */
+  int			result;			// Result from GNU TLS
+  gnutls_x509_crt_t	cert;			// Certificate
+  gnutls_datum_t	datum;			// Data record
 
 
-  DEBUG_printf(("3http_gnutls_create_credential(credential=%p)", credential));
+  DEBUG_printf(("3gnutls_create_credential(credential=%p)", credential));
 
   if (!credential)
     return (NULL);
 
   if ((result = gnutls_x509_crt_init(&cert)) < 0)
   {
-    DEBUG_printf(("4http_gnutls_create_credential: init error: %s", gnutls_strerror(result)));
+    DEBUG_printf(("4gnutls_create_credential: init error: %s", gnutls_strerror(result)));
     return (NULL);
   }
 
@@ -898,7 +594,7 @@ http_gnutls_create_credential(
 
   if ((result = gnutls_x509_crt_import(cert, &datum, GNUTLS_X509_FMT_DER)) < 0)
   {
-    DEBUG_printf(("4http_gnutls_create_credential: import error: %s", gnutls_strerror(result)));
+    DEBUG_printf(("4gnutls_create_credential: import error: %s", gnutls_strerror(result)));
 
     gnutls_x509_crt_deinit(cert);
     return (NULL);
@@ -908,79 +604,72 @@ http_gnutls_create_credential(
 }
 
 
-/*
- * 'http_gnutls_default_path()' - Get the default credential store path.
- */
+//
+// 'gnutls_create_key()' - Create a private key.
+//
 
-static const char *			/* O - Path or NULL on error */
-http_gnutls_default_path(char   *buffer,/* I - Path buffer */
-                         size_t bufsize)/* I - Size of path buffer */
+static gnutls_x509_privkey_t		// O - Private key
+gnutls_create_key(cups_credtype_t type)	// I - Type of key
 {
-  _cups_globals_t	*cg = _cupsGlobals();
-					/* Pointer to library globals */
+  gnutls_x509_privkey_t	key;		// Private key
 
 
-  if (cg->userconfig)
-  {
-    if (mkdir(cg->userconfig, 0755) && errno != EEXIST)
-    {
-      DEBUG_printf(("1http_gnutls_default_path: Failed to make directory '%s': %s", cg->userconfig, strerror(errno)));
-      return (NULL);
-    }
-
-    snprintf(buffer, bufsize, "%s/ssl", cg->userconfig);
+  gnutls_x509_privkey_init(&key);
 
-    if (mkdir(buffer, 0700) && errno != EEXIST)
-    {
-      DEBUG_printf(("1http_gnutls_default_path: Failed to make directory '%s': %s", buffer, strerror(errno)));
-      return (NULL);
-    }
-  }
-  else
+  switch (type)
   {
-    if (mkdir(cg->sysconfig, 0755) && errno != EEXIST)
-    {
-      DEBUG_printf(("1http_gnutls_default_path: Failed to make directory '%s': %s", cg->sysconfig, strerror(errno)));
-      return (NULL);
-    }
-
-    snprintf(buffer, bufsize, "%s/ssl", cg->sysconfig);
-
-    if (mkdir(buffer, 0700) && errno != EEXIST)
-    {
-      DEBUG_printf(("1http_gnutls_default_path: Failed to make directory '%s': %s", buffer, strerror(errno)));
-      return (NULL);
-    }
+    case CUPS_CREDTYPE_ECDSA_P256_SHA256 :
+	gnutls_x509_privkey_generate(key, GNUTLS_PK_ECDSA, GNUTLS_CURVE_TO_BITS(GNUTLS_ECC_CURVE_SECP256R1), 0);
+	break;
+
+    case CUPS_CREDTYPE_ECDSA_P384_SHA256 :
+	gnutls_x509_privkey_generate(key, GNUTLS_PK_ECDSA, GNUTLS_CURVE_TO_BITS(GNUTLS_ECC_CURVE_SECP384R1), 0);
+	break;
+
+    case CUPS_CREDTYPE_ECDSA_P521_SHA256 :
+	gnutls_x509_privkey_generate(key, GNUTLS_PK_ECDSA, GNUTLS_CURVE_TO_BITS(GNUTLS_ECC_CURVE_SECP521R1), 0);
+	break;
+
+    case CUPS_CREDTYPE_RSA_2048_SHA256 :
+	gnutls_x509_privkey_generate(key, GNUTLS_PK_RSA, 2048, 0);
+	break;
+
+    default :
+    case CUPS_CREDTYPE_RSA_3072_SHA256 :
+	gnutls_x509_privkey_generate(key, GNUTLS_PK_RSA, 3072, 0);
+	break;
+
+    case CUPS_CREDTYPE_RSA_4096_SHA256 :
+	gnutls_x509_privkey_generate(key, GNUTLS_PK_RSA, 4096, 0);
+	break;
   }
 
-  DEBUG_printf(("1http_gnutls_default_path: Using default path \"%s\".", buffer));
-
-  return (buffer);
+  return (key);
 }
 
 
-/*
- * 'http_gnutls_load_crl()' - Load the certificate revocation list, if any.
- */
+//
+// 'gnutls_load_crl()' - Load the certificate revocation list, if any.
+//
 
 static void
-http_gnutls_load_crl(void)
+gnutls_load_crl(void)
 {
   cupsMutexLock(&tls_mutex);
 
   if (!gnutls_x509_crl_init(&tls_crl))
   {
-    cups_file_t		*fp;		/* CRL file */
-    char		filename[1024],	/* site.crl */
-			line[256];	/* Base64-encoded line */
-    unsigned char	*data = NULL;	/* Buffer for cert data */
-    size_t		alloc_data = 0,	/* Bytes allocated */
-			num_data = 0;	/* Bytes used */
-    size_t		decoded;	/* Bytes decoded */
-    gnutls_datum_t	datum;		/* Data record */
+    cups_file_t		*fp;		// CRL file
+    char		filename[1024],	// site.crl
+			line[256];	// Base64-encoded line
+    unsigned char	*data = NULL;	// Buffer for cert data
+    size_t		alloc_data = 0,	// Bytes allocated
+			num_data = 0;	// Bytes used
+    size_t		decoded;	// Bytes decoded
+    gnutls_datum_t	datum;		// Data record
 
 
-    http_gnutls_make_path(filename, sizeof(filename), CUPS_SERVERROOT, "site", "crl");
+    http_make_path(filename, sizeof(filename), CUPS_SERVERROOT, "site", "crl");
 
     if ((fp = cupsFileOpen(filename, "r")) != NULL)
     {
@@ -990,10 +679,7 @@ http_gnutls_load_crl(void)
 	{
 	  if (num_data)
 	  {
-	   /*
-	    * Missing END X509 CRL...
-	    */
-
+	    // Missing END X509 CRL...
 	    break;
 	  }
 	}
@@ -1001,10 +687,7 @@ http_gnutls_load_crl(void)
 	{
 	  if (!num_data)
 	  {
-	   /*
-	    * Missing data...
-	    */
-
+	    // Missing data...
 	    break;
 	  }
 
@@ -1028,7 +711,7 @@ http_gnutls_load_crl(void)
 	  else if ((num_data + strlen(line)) >= alloc_data)
 	  {
 	    unsigned char *tdata = realloc(data, alloc_data + 1024);
-					    /* Expanded buffer */
+					    // Expanded buffer
 
 	    if (!tdata)
 	      break;
@@ -1054,68 +737,27 @@ http_gnutls_load_crl(void)
 }
 
 
-/*
- * 'http_gnutls_make_path()' - Format a filename for a certificate or key file.
- */
+//
+// 'gnutls_read()' - Read function for the GNU TLS library.
+//
 
-static const char *			/* O - Filename */
-http_gnutls_make_path(
-    char       *buffer,			/* I - Filename buffer */
-    size_t     bufsize,			/* I - Size of buffer */
-    const char *dirname,		/* I - Directory */
-    const char *filename,		/* I - Filename (usually hostname) */
-    const char *ext)			/* I - Extension */
+static ssize_t				// O - Number of bytes read or -1 on error
+gnutls_read(
+    gnutls_transport_ptr_t ptr,		// I - Connection to server
+    void                   *data,	// I - Buffer
+    size_t                 length)	// I - Number of bytes to read
 {
-  char	*bufptr,			/* Pointer into buffer */
-	*bufend = buffer + bufsize - 1;	/* End of buffer */
-
+  http_t	*http;			// HTTP connection
+  ssize_t	bytes;			// Bytes read
 
-  snprintf(buffer, bufsize, "%s/", dirname);
-  bufptr = buffer + strlen(buffer);
 
-  while (*filename && bufptr < bufend)
-  {
-    if (_cups_isalnum(*filename) || *filename == '-' || *filename == '.')
-      *bufptr++ = *filename;
-    else
-      *bufptr++ = '_';
-
-    filename ++;
-  }
-
-  if (bufptr < bufend)
-    *bufptr++ = '.';
-
-  cupsCopyString(bufptr, ext, (size_t)(bufend - bufptr + 1));
-
-  return (buffer);
-}
-
-
-/*
- * 'http_gnutls_read()' - Read function for the GNU TLS library.
- */
-
-static ssize_t				/* O - Number of bytes read or -1 on error */
-http_gnutls_read(
-    gnutls_transport_ptr_t ptr,		/* I - Connection to server */
-    void                   *data,	/* I - Buffer */
-    size_t                 length)	/* I - Number of bytes to read */
-{
-  http_t	*http;			/* HTTP connection */
-  ssize_t	bytes;			/* Bytes read */
-
-
-  DEBUG_printf(("5http_gnutls_read(ptr=%p, data=%p, length=%d)", ptr, data, (int)length));
+  DEBUG_printf(("5gnutls_read(ptr=%p, data=%p, length=%d)", ptr, data, (int)length));
 
   http = (http_t *)ptr;
 
   if (!http->blocking || http->timeout_value > 0.0)
   {
-   /*
-    * Make sure we have data before we read...
-    */
-
+    // Make sure we have data before we read...
     while (!_httpWait(http, http->wait_value, 0))
     {
       if (http->timeout_cb && (*http->timeout_cb)(http, http->timeout_data))
@@ -1127,79 +769,73 @@ http_gnutls_read(
   }
 
   bytes = recv(http->fd, data, length, 0);
-  DEBUG_printf(("5http_gnutls_read: bytes=%d", (int)bytes));
+  DEBUG_printf(("5gnutls_read: bytes=%d", (int)bytes));
   return (bytes);
 }
 
 
-/*
- * 'http_gnutls_write()' - Write function for the GNU TLS library.
- */
+//
+// 'gnutls_write()' - Write function for the GNU TLS library.
+//
 
-static ssize_t				/* O - Number of bytes written or -1 on error */
-http_gnutls_write(
-    gnutls_transport_ptr_t ptr,		/* I - Connection to server */
-    const void             *data,	/* I - Data buffer */
-    size_t                 length)	/* I - Number of bytes to write */
+static ssize_t				// O - Number of bytes written or -1 on error
+gnutls_write(
+    gnutls_transport_ptr_t ptr,		// I - Connection to server
+    const void             *data,	// I - Data buffer
+    size_t                 length)	// I - Number of bytes to write
 {
-  ssize_t bytes;			/* Bytes written */
+  ssize_t bytes;			// Bytes written
 
 
-  DEBUG_printf(("5http_gnutls_write(ptr=%p, data=%p, length=%d)", ptr, data,
+  DEBUG_printf(("5gnutls_write(ptr=%p, data=%p, length=%d)", ptr, data,
                 (int)length));
   bytes = send(((http_t *)ptr)->fd, data, length, 0);
-  DEBUG_printf(("5http_gnutls_write: bytes=%d", (int)bytes));
+  DEBUG_printf(("5gnutls_write: bytes=%d", (int)bytes));
 
   return (bytes);
 }
 
 
-/*
- * '_httpTLSInitialize()' - Initialize the TLS stack.
- */
+//
+// '_httpTLSInitialize()' - Initialize the TLS stack.
+//
 
 void
 _httpTLSInitialize(void)
 {
- /*
-  * Initialize GNU TLS...
-  */
-
+  // Initialize GNU TLS...
   gnutls_global_init();
 }
 
 
-/*
- * '_httpTLSPending()' - Return the number of pending TLS-encrypted bytes.
- */
+//
+// '_httpTLSPending()' - Return the number of pending TLS-encrypted bytes.
+//
 
-size_t					/* O - Bytes available */
-_httpTLSPending(http_t *http)		/* I - HTTP connection */
+size_t					// O - Bytes available
+_httpTLSPending(http_t *http)		// I - HTTP connection
 {
   return (gnutls_record_check_pending(http->tls));
 }
 
 
-/*
- * '_httpTLSRead()' - Read from a SSL/TLS connection.
- */
+//
+// '_httpTLSRead()' - Read from a SSL/TLS connection.
+//
 
-int					/* O - Bytes read */
-_httpTLSRead(http_t *http,		/* I - Connection to server */
-	     char   *buf,		/* I - Buffer to store data */
-	     int    len)		/* I - Length of buffer */
+int					// O - Bytes read
+_httpTLSRead(http_t *http,		// I - Connection to server
+	     char   *buf,		// I - Buffer to store data
+	     int    len)		// I - Length of buffer
 {
-  ssize_t	result;			/* Return value */
+  ssize_t	result;			// Return value
 
 
   result = gnutls_record_recv(http->tls, buf, (size_t)len);
 
   if (result < 0 && !errno)
   {
-   /*
-    * Convert GNU TLS error to errno value...
-    */
-
+    // Convert GNU TLS error to errno value...
     switch (result)
     {
       case GNUTLS_E_INTERRUPTED :
@@ -1222,43 +858,25 @@ _httpTLSRead(http_t *http,		/* I - Connection to server */
 }
 
 
-/*
- * '_httpTLSSetOptions()' - Set TLS protocol and cipher suite options.
- */
-
-void
-_httpTLSSetOptions(int options,		/* I - Options */
-                   int min_version,	/* I - Minimum TLS version */
-                   int max_version)	/* I - Maximum TLS version */
-{
-  if (!(options & _HTTP_TLS_SET_DEFAULT) || tls_options < 0)
-  {
-    tls_options     = options;
-    tls_min_version = min_version;
-    tls_max_version = max_version;
-  }
-}
-
-
-/*
- * '_httpTLSStart()' - Set up SSL/TLS support on a connection.
- */
+//
+// '_httpTLSStart()' - Set up SSL/TLS support on a connection.
+//
 
-bool					/* O - `true` on success, `false` on failure */
-_httpTLSStart(http_t *http)		/* I - Connection to server */
+bool					// O - `true` on success, `false` on failure
+_httpTLSStart(http_t *http)		// I - Connection to server
 {
-  char			hostname[256],	/* Hostname */
-			*hostptr;	/* Pointer into hostname */
-  int			status;		/* Status of handshake */
+  char			hostname[256],	// Hostname
+			*hostptr;	// Pointer into hostname
+  int			status;		// Status of handshake
   gnutls_certificate_credentials_t *credentials;
-					/* TLS credentials */
+					// TLS credentials
   char			priority_string[2048];
-					/* Priority string */
-  int			version;	/* Current version */
-  double		old_timeout;	/* Old timeout value */
-  http_timeout_cb_t	old_cb;		/* Old timeout callback */
-  void			*old_data;	/* Old timeout data */
-  static const char * const versions[] =/* SSL/TLS versions */
+					// Priority string
+  int			version;	// Current version
+  double		old_timeout;	// Old timeout value
+  http_timeout_cb_t	old_cb;		// Old timeout callback
+  void			*old_data;	// Old timeout data
+  static const char * const versions[] =// SSL/TLS versions
   {
     "VERS-SSL3.0",
     "VERS-TLS1.0",
@@ -1324,23 +942,16 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
 
   if (http->mode == _HTTP_MODE_CLIENT)
   {
-   /*
-    * Client: get the hostname to use for TLS...
-    */
-
+    // Client: get the hostname to use for TLS...
     if (httpAddrIsLocalhost(http->hostaddr))
     {
       cupsCopyString(hostname, "localhost", sizeof(hostname));
     }
     else
     {
-     /*
-      * Otherwise make sure the hostname we have does not end in a trailing dot.
-      */
-
+      // Otherwise make sure the hostname we have does not end in a trailing dot.
       cupsCopyString(hostname, http->hostname, sizeof(hostname));
-      if ((hostptr = hostname + strlen(hostname) - 1) >= hostname &&
-	  *hostptr == '.')
+      if ((hostptr = hostname + strlen(hostname) - 1) >= hostname && *hostptr == '.')
 	*hostptr = '\0';
     }
 
@@ -1348,10 +959,7 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
   }
   else
   {
-   /*
-    * Server: get certificate and private key...
-    */
-
+    // Server: get certificate and private key...
     char	crtfile[1024],		// Certificate file
 		keyfile[1024];		// Private key file
     const char	*cn,			// Common name to lookup
@@ -1360,20 +968,14 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
 
     if (http->fields[HTTP_FIELD_HOST])
     {
-     /*
-      * Use hostname for TLS upgrade...
-      */
-
+      // Use hostname for TLS upgrade...
       cupsCopyString(hostname, http->fields[HTTP_FIELD_HOST], sizeof(hostname));
     }
     else
     {
-     /*
-      * Resolve hostname from connection address...
-      */
-
-      http_addr_t	addr;		/* Connection address */
-      socklen_t		addrlen;	/* Length of address */
+      // Resolve hostname from connection address...
+      http_addr_t	addr;		// Connection address
+      socklen_t		addrlen;	// Length of address
 
       addrlen = sizeof(addr);
       if (getsockname(http->fd, (struct sockaddr *)&addr, &addrlen))
@@ -1382,7 +984,9 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
 	hostname[0] = '\0';
       }
       else if (httpAddrIsLocalhost(&addr))
+      {
 	hostname[0] = '\0';
+      }
       else
       {
 	httpAddrLookup(&addr, hostname, sizeof(hostname));
@@ -1391,7 +995,7 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
     }
 
     if (isdigit(hostname[0] & 255) || hostname[0] == '[')
-      hostname[0] = '\0';		/* Don't allow numeric addresses */
+      hostname[0] = '\0';		// Don't allow numeric addresses
 
     cupsMutexLock(&tls_mutex);
 
@@ -1403,13 +1007,13 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
     if (cn)
     {
       // First look in the CUPS keystore...
-      http_gnutls_make_path(crtfile, sizeof(crtfile), tls_keypath, cn, "crt");
-      http_gnutls_make_path(keyfile, sizeof(keyfile), tls_keypath, cn, "key");
+      http_make_path(crtfile, sizeof(crtfile), tls_keypath, cn, "crt");
+      http_make_path(keyfile, sizeof(keyfile), tls_keypath, cn, "key");
 
       if (access(crtfile, R_OK) || access(keyfile, R_OK))
       {
         // No CUPS-managed certs, look for CA certs...
-        char cacrtfile[1024], cakeyfile[1024];	/* CA cert files */
+        char cacrtfile[1024], cakeyfile[1024];	// CA cert files
 
         snprintf(cacrtfile, sizeof(cacrtfile), "/etc/letsencrypt/live/%s/fullchain.pem", cn);
         snprintf(cakeyfile, sizeof(cakeyfile), "/etc/letsencrypt/live/%s/privkey.pem", cn);
@@ -1440,9 +1044,9 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
     {
       DEBUG_printf(("4_httpTLSStart: Auto-create credentials for \"%s\".", cn));
 
-      if (!cupsMakeServerCredentials(tls_keypath, cn, 0, NULL, time(NULL) + 3650 * 86400))
+      if (!cupsCreateCredentials(tls_keypath, cn, 0, NULL, time(NULL) + 3650 * 86400))
       {
-	DEBUG_puts("4_httpTLSStart: cupsMakeServerCredentials failed.");
+	DEBUG_puts("4_httpTLSStart: cupsCreateCredentials failed.");
 	http->error  = errno = EINVAL;
 	http->status = HTTP_STATUS_ERROR;
 	_cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create server credentials."), 1);
@@ -1482,10 +1086,7 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
 
   if (tls_max_version < _HTTP_TLS_MAX)
   {
-   /*
-    * Require specific TLS versions...
-    */
-
+    // Require specific TLS versions...
     cupsConcatString(priority_string, ":-VERS-TLS-ALL", sizeof(priority_string));
     for (version = tls_min_version; version <= tls_max_version; version ++)
     {
@@ -1495,18 +1096,12 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
   }
   else if (tls_min_version == _HTTP_TLS_SSL3)
   {
-   /*
-    * Allow all versions of TLS and SSL/3.0...
-    */
-
+    // Allow all versions of TLS and SSL/3.0...
     cupsConcatString(priority_string, ":+VERS-TLS-ALL:+VERS-SSL3.0", sizeof(priority_string));
   }
   else
   {
-   /*
-    * Require a minimum version...
-    */
-
+    // Require a minimum version...
     cupsConcatString(priority_string, ":+VERS-TLS-ALL", sizeof(priority_string));
     for (version = 0; version < tls_min_version; version ++)
     {
@@ -1529,24 +1124,21 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
   gnutls_priority_set_direct(http->tls, priority_string, NULL);
 
 #else
-  gnutls_priority_t priority;		/* Priority */
+  gnutls_priority_t priority;		// Priority
 
   gnutls_priority_init(&priority, priority_string, NULL);
   gnutls_priority_set(http->tls, priority);
   gnutls_priority_deinit(priority);
-#endif /* HAVE_GNUTLS_PRIORITY_SET_DIRECT */
+#endif // HAVE_GNUTLS_PRIORITY_SET_DIRECT
 
   gnutls_transport_set_ptr(http->tls, (gnutls_transport_ptr_t)http);
-  gnutls_transport_set_pull_function(http->tls, http_gnutls_read);
+  gnutls_transport_set_pull_function(http->tls, gnutls_read);
 #ifdef HAVE_GNUTLS_TRANSPORT_SET_PULL_TIMEOUT_FUNCTION
   gnutls_transport_set_pull_timeout_function(http->tls, (gnutls_pull_timeout_func)httpWait);
-#endif /* HAVE_GNUTLS_TRANSPORT_SET_PULL_TIMEOUT_FUNCTION */
-  gnutls_transport_set_push_function(http->tls, http_gnutls_write);
-
- /*
-  * Enforce a minimum timeout of 10 seconds for the TLS handshake...
-  */
+#endif // HAVE_GNUTLS_TRANSPORT_SET_PULL_TIMEOUT_FUNCTION
+  gnutls_transport_set_push_function(http->tls, gnutls_write);
 
+  // Enforce a minimum timeout of 10 seconds for the TLS handshake...
   old_timeout  = http->timeout_value;
   old_cb       = http->timeout_cb;
   old_data     = http->timeout_data;
@@ -1557,10 +1149,7 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
     httpSetTimeout(http, 10.0, NULL, NULL);
   }
 
- /*
-  * Do the TLS handshake...
-  */
-
+  // Do the TLS handshake...
   while ((status = gnutls_handshake(http->tls)) != GNUTLS_E_SUCCESS)
   {
     DEBUG_printf(("5_httpStartTLS: gnutls_handshake returned %d (%s)",
@@ -1584,10 +1173,7 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
     }
   }
 
- /*
-  * Restore the previous timeout settings...
-  */
-
+  // Restore the previous timeout settings...
   httpSetTimeout(http, old_timeout, old_cb, old_data);
 
   http->tls_credentials = credentials;
@@ -1596,14 +1182,14 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
 }
 
 
-/*
- * '_httpTLSStop()' - Shut down SSL/TLS on a connection.
- */
+//
+// '_httpTLSStop()' - Shut down SSL/TLS on a connection.
+//
 
 void
-_httpTLSStop(http_t *http)		/* I - Connection to server */
+_httpTLSStop(http_t *http)		// I - Connection to server
 {
-  int	error;				/* Error code */
+  int	error;				// Error code
 
 
   error = gnutls_bye(http->tls, http->mode == _HTTP_MODE_CLIENT ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
@@ -1622,16 +1208,16 @@ _httpTLSStop(http_t *http)		/* I - Connection to server */
 }
 
 
-/*
- * '_httpTLSWrite()' - Write to a SSL/TLS connection.
- */
+//
+// '_httpTLSWrite()' - Write to a SSL/TLS connection.
+//
 
-int					/* O - Bytes written */
-_httpTLSWrite(http_t     *http,		/* I - Connection to server */
-	      const char *buf,		/* I - Buffer holding data */
-	      int        len)		/* I - Length of buffer */
+int					// O - Bytes written
+_httpTLSWrite(http_t     *http,		// I - Connection to server
+	      const char *buf,		// I - Buffer holding data
+	      int        len)		// I - Length of buffer
 {
-  ssize_t	result;			/* Return value */
+  ssize_t	result;			// Return value
 
 
   DEBUG_printf(("5_httpTLSWrite(http=%p, buf=%p, len=%d)", http, buf, len));
@@ -1640,10 +1226,7 @@ _httpTLSWrite(http_t     *http,		/* I - Connection to server */
 
   if (result < 0 && !errno)
   {
-   /*
-    * Convert GNU TLS error to errno value...
-    */
-
+    // Convert GNU TLS error to errno value...
     switch (result)
     {
       case GNUTLS_E_INTERRUPTED :
diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index c07fc3d83..172e82f89 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -11,7 +11,6 @@
 // information.
 //
 
-#include <sys/stat.h>
 #include <openssl/x509v3.h>
 
 
@@ -19,7 +18,6 @@
 // Local functions...
 //
 
-static void		http_add_san(GENERAL_NAMES *gens, const char *name);
 
 static long		http_bio_ctrl(BIO *h, int cmd, long arg1, void *arg2);
 static int		http_bio_free(BIO *data);
@@ -28,44 +26,46 @@ static int		http_bio_puts(BIO *h, const char *str);
 static int		http_bio_read(BIO *h, char *buf, int size);
 static int		http_bio_write(BIO *h, const char *buf, int num);
 
-static X509		*http_create_credential(http_credential_t *credential);
-static X509_NAME	*http_create_name(const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name);
-static EVP_PKEY		*http_create_key(cups_credtype_t type);
-static GENERAL_NAMES	*http_create_san(const char *common_name, size_t num_alt_names, const char **alt_names);
-
-static const char	*http_default_path(char *buffer, size_t bufsize);
-
-static time_t		http_get_date(X509 *cert, int which);
-
-//static void		http_load_crl(void);
-
-static const char	*http_make_path(char *buffer, size_t bufsize, const char *dirname, const char *filename, const char *ext);
-
-static bool		http_x509_add_ext(X509 *cert, int nid, const char *value);
+static bool		openssl_add_ext(STACK_OF(X509_EXTENSION) *exts, int nid, const char *value);
+static X509		*openssl_create_credential(http_credential_t *credential);
+static X509_NAME	*openssl_create_name(const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name);
+static EVP_PKEY		*openssl_create_key(cups_credtype_t type);
+static bool		openssl_create_san(STACK_OF(X509_EXTENSION) *exts, const char *common_name, size_t num_alt_names, const char **alt_names);
+static time_t		openssl_get_date(X509 *cert, int which);
+//static void		openssl_load_crl(void);
 
 
 //
 // Local globals...
 //
 
-static bool		tls_auto_create = false;
-					// Auto-create self-signed certs?
 static BIO_METHOD	*tls_bio_method = NULL;
 					// OpenSSL BIO method
-static char		*tls_common_name = NULL;
-					// Default common name
-//static X509_CRL		*tls_crl = NULL;// Certificate revocation list
-static char		*tls_keypath = NULL;
-					// Server cert keychain path
-static cups_mutex_t	tls_mutex = CUPS_MUTEX_INITIALIZER;
-					// Mutex for keychain/certs
-static int		tls_options = -1,// Options for TLS connections
-			tls_min_version = _HTTP_TLS_1_2,
-			tls_max_version = _HTTP_TLS_MAX;
-
-
-//
-// 'cupsMakeServerCredentials()' - Make an X.509 certificate and private key pair.
+static const char * const tls_purpose_oids[] =
+{					// OIDs for each key purpose value
+  "1.3.6.1.5.5.7.3.1",			// serverAuth
+  "1.3.6.1.5.5.7.3.2",			// clientAuth
+  "1.3.6.1.5.5.7.3.3",			// codeSigning
+  "1.3.6.1.5.5.7.3.4",			// emailProtection
+  "1.3.6.1.5.5.7.3.8",			// timeStamping
+  "1.3.6.1.5.5.7.3.9"			// OCSPSigning
+};
+static const char * const tls_usage_strings[] =
+{					// Strings for each key usage value
+  "digitalSignature",
+  "nonRepudiation",
+  "keyEncipherment",
+  "dataEncipherment",
+  "keyAgreement",
+  "keyCertSign",
+  "cRLSign",
+  "encipherOnly",
+  "decipherOnly"
+};
+
+
+//
+// 'cupsCreateCredentials()' - Make an X.509 certificate and private key pair.
 //
 // This function creates an X.509 certificate and private key pair.  The
 // certificate and key are stored in the directory "path" or, if "path" is
@@ -77,20 +77,22 @@ static int		tls_options = -1,// Options for TLS connections
 //
 
 bool					// O - `true` on success, `false` on failure
-cupsMakeServerCredentials(
-    const char      *path,		// I - Directory path for certificate/key store or `NULL` for default
-    cups_credtype_t type,		// I - Type of certificate/keys to generate
-    const char      *organization,	// I - Organization or `NULL` to use common name
-    const char      *org_unit,		// I - Organizational unit or `NULL` for none
-    const char      *locality,		// I - City/town or `NULL` for "Unknown"
-    const char      *state_province,	// I - State/province or `NULL` for "Unknown"
-    const char      *country,		// I - Country or `NULL` for locale-based default
-    const char      *root_name,		// I - Root certificate/domain name or `NULL` for site/self-signed
-    bool            ca_cert,		// I - Make CA certificate?
-    const char      *common_name,	// I - Common name
-    size_t          num_alt_names,	// I - Number of subject alternate names
-    const char      **alt_names,	// I - Subject Alternate Names
-    time_t          expiration_date)	// I - Expiration date
+cupsCreateCredentials(
+    const char         *path,		// I - Directory path for certificate/key store or `NULL` for default
+    bool               ca_cert,		// I - `true` to create a CA certificate, `false` for a client/server certificate
+    cups_credpurpose_t purpose,		// I - Credential purposes
+    cups_credtype_t    type,		// I - Credential type
+    cups_credusage_t   usage,		// I - Credential usages
+    const char         *organization,	// I - Organization or `NULL` to use common name
+    const char         *org_unit,	// I - Organizational unit or `NULL` for none
+    const char         *locality,	// I - City/town or `NULL` for "Unknown"
+    const char         *state_province,	// I - State/province or `NULL` for "Unknown"
+    const char         *country,	// I - Country or `NULL` for locale-based default
+    const char         *common_name,	// I - Common name
+    size_t             num_alt_names,	// I - Number of subject alternate names
+    const char         **alt_names,	// I - Subject Alternate Names
+    const char         *root_name,	// I - Root certificate/domain name or `NULL` for site/self-signed
+    time_t             expiration_date)	// I - Expiration date
 {
   bool		result = false;		// Return value
   EVP_PKEY	*pkey;			// Key pair
@@ -105,13 +107,18 @@ cupsMakeServerCredentials(
   ASN1_TIME	*notBefore,		// Initial date
 		*notAfter;		// Expiration date
   BIO		*bio;			// Output file
-  char		temp[1024],		// Temporary directory name
+  char		temp[1024],		// Temporary string
+		*tempptr,		// Pointer into temporary string
  		crtfile[1024],		// Certificate filename
 		keyfile[1024];		// Private key filename
-  GENERAL_NAMES *gens;			// Names for SubjectAltName certificate extension
+  STACK_OF(X509_EXTENSION) *exts;	// Extensions
+  X509_EXTENSION *ext;			// Current extension
+  unsigned	i;			// Looping var
+  cups_credpurpose_t purpose_bit;	// Current purpose
+  cups_credusage_t usage_bit;		// Current usage
 
 
-  DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", type=%d, organization=\"%s\", org_unit=\"%s\", locality=\"%s\", state_province=\"%s\", country=\"%s\", root_name=\"%s\", ca_cert=%s, common_name=\"%s\", num_alt_names=%u, alt_names=%p, expiration_date=%ld)", path, type, organization, org_unit, locality, state_province, country, root_name, ca_cert ? "true" : "false", common_name, (unsigned)num_alt_names, alt_names, (long)expiration_date));
+  DEBUG_printf(("cupsCreateCredentials(path=\"%s\", ca_cert=%s, purpose=0x%x, type=%d, usage=0x%x, organization=\"%s\", org_unit=\"%s\", locality=\"%s\", state_province=\"%s\", country=\"%s\", common_name=\"%s\", num_alt_names=%u, alt_names=%p, root_name=\"%s\", expiration_date=%ld)", path, ca_cert ? "true" : "false", purpose, type, usage, organization, org_unit, locality, state_province, country, common_name, (unsigned)num_alt_names, alt_names, root_name, (long)expiration_date));
 
   // Filenames...
   if (!path)
@@ -127,15 +134,15 @@ cupsMakeServerCredentials(
   http_make_path(keyfile, sizeof(keyfile), path, common_name, "key");
 
   // Create the encryption key...
-  DEBUG_puts("1cupsMakeServerCredentials: Creating key pair.");
+  DEBUG_puts("1cupsCreateCredentials: Creating key pair.");
 
-  if ((pkey = http_create_key(type)) == NULL)
+  if ((pkey = openssl_create_key(type)) == NULL)
     return (false);
 
-  DEBUG_puts("1cupsMakeServerCredentials: Key pair created.");
+  DEBUG_puts("1cupsCreateCredentials: Key pair created.");
 
   // Create the X.509 certificate...
-  DEBUG_puts("1cupsMakeServerCredentials: Generating self-signed X.509 certificate.");
+  DEBUG_puts("1cupsCreateCredentials: Generating self-signed X.509 certificate.");
 
   if ((cert = X509_new()) == NULL)
   {
@@ -190,7 +197,7 @@ cupsMakeServerCredentials(
 
   }
 
-  name = http_create_name(organization, org_unit, locality, state_province, country, common_name);
+  name = openssl_create_name(organization, org_unit, locality, state_province, country, common_name);
 
   if (root_cert)
     X509_set_issuer_name(cert, X509_get_subject_name(root_cert));
@@ -199,32 +206,56 @@ cupsMakeServerCredentials(
   X509_set_subject_name(cert, name);
   X509_NAME_free(name);
 
+  exts = sk_X509_EXTENSION_new_null();
+
   if (ca_cert)
   {
     // Add extensions that are required to make Chrome happy...
-    http_x509_add_ext(cert, NID_basic_constraints, "critical,CA:TRUE,pathlen:0");
-    http_x509_add_ext(cert, NID_key_usage, "critical,cRLSign,digitalSignature,keyCertSign");
+    openssl_add_ext(exts, NID_basic_constraints, "critical,CA:TRUE,pathlen:0");
   }
   else
   {
     // Add extension with DNS names and free buffer for GENERAL_NAME
-    if ((gens = http_create_san(common_name, num_alt_names, alt_names)) == NULL)
-    {
-      // TODO: Set error?
+    if (!openssl_create_san(exts, common_name, num_alt_names, alt_names))
       goto done;
-    }
-
-    X509_add1_ext_i2d(cert, NID_subject_alt_name, gens, 0, X509V3_ADD_DEFAULT);
-    sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
 
     // Add extensions that are required to make Chrome happy...
-    http_x509_add_ext(cert, NID_basic_constraints, "critical,CA:FALSE,pathlen:0");
-    http_x509_add_ext(cert, NID_key_usage, "critical,digitalSignature,keyEncipherment");
+    openssl_add_ext(exts, NID_basic_constraints, "critical,CA:FALSE,pathlen:0");
   }
 
-  http_x509_add_ext(cert, NID_ext_key_usage, "1.3.6.1.5.5.7.3.1");
-  http_x509_add_ext(cert, NID_subject_key_identifier, "hash");
-  http_x509_add_ext(cert, NID_authority_key_identifier, "keyid,issuer");
+  cupsCopyString(temp, "critical", sizeof(temp));
+  for (tempptr = temp + strlen(temp), i = 0, usage_bit = CUPS_CREDUSAGE_DIGITAL_SIGNATURE; i < (sizeof(tls_usage_strings) / sizeof(tls_usage_strings[0])); i ++, usage_bit *= 2)
+  {
+    if (!(usage & usage_bit))
+      continue;
+
+    snprintf(tempptr, sizeof(temp) - (size_t)(tempptr - temp), ",%s", tls_usage_strings[i]);
+
+    tempptr += strlen(tempptr);
+  }
+  openssl_add_ext(exts, NID_key_usage, temp);
+
+  temp[0] = '\0';
+  for (tempptr = temp, i = 0, purpose_bit = CUPS_CREDPURPOSE_SERVER_AUTH; i < (sizeof(tls_purpose_oids) / sizeof(tls_purpose_oids[0])); i ++, purpose_bit *= 2)
+  {
+    if (!(purpose & purpose_bit))
+      continue;
+
+    if (tempptr == temp)
+      cupsCopyString(temp, tls_purpose_oids[i], sizeof(temp));
+    else
+      snprintf(tempptr, sizeof(temp) - (size_t)(tempptr - temp), ",%s", tls_purpose_oids[i]);
+
+    tempptr += strlen(tempptr);
+  }
+  openssl_add_ext(exts, NID_ext_key_usage, temp);
+
+  openssl_add_ext(exts, NID_subject_key_identifier, "hash");
+  openssl_add_ext(exts, NID_authority_key_identifier, "keyid,issuer");
+
+  while ((ext = sk_X509_EXTENSION_pop(exts)) != NULL)
+    X509_add_ext(cert, ext, -1);
+
   X509_set_version(cert, 2); // v3
 
   if (root_key)
@@ -267,7 +298,7 @@ cupsMakeServerCredentials(
   BIO_free(bio);
 
   result = true;
-  DEBUG_puts("1cupsMakeServerCredentials: Successfully created credentials.");
+  DEBUG_puts("1cupsCreateCredentials: Successfully created credentials.");
 
   // Cleanup...
   done:
@@ -285,28 +316,28 @@ cupsMakeServerCredentials(
 
 
 //
-// 'cupsMakeServerRequest()' - Make an X.509 Certificate Signing Request.
+// 'cupsCreateCredentialsRequest()' - Make an X.509 Certificate Signing Request.
 //
 // This function creates an X.509 certificate signing request (CSR) and
 // associated private key.  The CSR and key are stored in the directory "path"
 // or, if "path" is `NULL`, in a per-user or system-wide (when running as root)
 // certificate/key store.
 //
-// The CSR is returned as a string that must be freed using the `free` function.
-//
 
-char *					// O - PEM-encoded certificate signing request
-cupsMakeServerRequest(
-    const char      *path,		// I - Directory path for certificate/key store or `NULL` for default
-    cups_credtype_t type,		// I - Type of certificate/keys to generate
-    const char      *organization,	// I - Organization or `NULL` to use common name
-    const char      *org_unit,		// I - Organizational unit or `NULL` for none
-    const char      *locality,		// I - City/town or `NULL` for "Unknown"
-    const char      *state_province,	// I - State/province or `NULL` for "Unknown"
-    const char      *country,		// I - Country or `NULL` for locale-based default
-    const char      *common_name,	// I - Common name
-    size_t          num_alt_names,	// I - Number of subject alternate names
-    const char      **alt_names)	// I - Subject Alternate Names
+bool					// O - `true` on success, `false` on error
+cupsCreateCredentialsRequest(
+    const char         *path,		// I - Directory path for certificate/key store or `NULL` for default
+    cups_credpurpose_t purpose,		// I - Credential purposes
+    cups_credtype_t    type,		// I - Credential type
+    cups_credusage_t   usage,		// I - Credential usages
+    const char         *organization,	// I - Organization or `NULL` to use common name
+    const char         *org_unit,	// I - Organizational unit or `NULL` for none
+    const char         *locality,	// I - City/town or `NULL` for "Unknown"
+    const char         *state_province,	// I - State/province or `NULL` for "Unknown"
+    const char         *country,	// I - Country or `NULL` for locale-based default
+    const char         *common_name,	// I - Common name
+    size_t             num_alt_names,	// I - Number of subject alternate names
+    const char         **alt_names)	// I - Subject Alternate Names
 {
   char		*result = NULL;		// Return value
   EVP_PKEY	*pkey;			// Key pair
@@ -314,12 +345,16 @@ cupsMakeServerRequest(
   X509_NAME	*name;			// Subject/issuer name
   BIO		*bio;			// Output file
   char		temp[1024],		// Temporary directory name
+		*tempptr,		// Pointer into temporary string
  		csrfile[1024],		// Certificate signing request filename
 		keyfile[1024];		// Private key filename
-//  GENERAL_NAMES *gens;			// Names for SubjectAltName certificate extension
+  STACK_OF(X509_EXTENSION) *exts;	// Extensions
+  unsigned	i;			// Looping var
+  cups_credpurpose_t purpose_bit;	// Current purpose
+  cups_credusage_t usage_bit;		// Current usage
 
 
-  DEBUG_printf(("cupsMakeServerRequest(path=\"%s\", type=%d, organization=\"%s\", org_unit=\"%s\", locality=\"%s\", state_province=\"%s\", country=\"%s\", common_name=\"%s\", num_alt_names=%u, alt_names=%p)", path, type, organization, org_unit, locality, state_province, country, common_name, (unsigned)num_alt_names, alt_names));
+  DEBUG_printf(("cupsCreateCredentialsRequest(path=\"%s\", purpose=0x%x, type=%d, usage=0x%x, organization=\"%s\", org_unit=\"%s\", locality=\"%s\", state_province=\"%s\", country=\"%s\", common_name=\"%s\", num_alt_names=%u, alt_names=%p)", path, purpose, type, usage, organization, org_unit, locality, state_province, country, common_name, (unsigned)num_alt_names, alt_names));
 
   // Filenames...
   if (!path)
@@ -335,15 +370,15 @@ cupsMakeServerRequest(
   http_make_path(keyfile, sizeof(keyfile), path, common_name, "key");
 
   // Create the encryption key...
-  DEBUG_puts("1cupsMakeServerRequest: Creating key pair.");
+  DEBUG_puts("1cupsCreateCredentialsRequest: Creating key pair.");
 
-  if ((pkey = http_create_key(type)) == NULL)
+  if ((pkey = openssl_create_key(type)) == NULL)
     return (false);
 
-  DEBUG_puts("1cupsMakeServerRequest: Key pair created.");
+  DEBUG_puts("1cupsCreateCredentialsRequest: Key pair created.");
 
   // Create the X.509 certificate...
-  DEBUG_puts("1cupsMakeServerRequest: Generating self-signed X.509 certificate.");
+  DEBUG_puts("1cupsCreateCredentialsRequest: Generating self-signed X.509 certificate.");
 
   if ((csr = X509_REQ_new()) == NULL)
   {
@@ -354,25 +389,50 @@ cupsMakeServerRequest(
 
   X509_REQ_set_pubkey(csr, pkey);
 
-  if ((name = http_create_name(organization, org_unit, locality, state_province, country, common_name)) == NULL)
+  if ((name = openssl_create_name(organization, org_unit, locality, state_province, country, common_name)) == NULL)
     goto done;
 
   X509_REQ_set_subject_name(csr, name);
   X509_NAME_free(name);
 
   // Add extension with DNS names and free buffer for GENERAL_NAME
-//  if ((gens = http_create_san(common_name, num_alt_names, alt_names)) == NULL)
-//  {
-//    // TODO: Set error?
-//    goto done;
-//  }
+  exts = sk_X509_EXTENSION_new_null();
+
+  if (!openssl_create_san(exts, common_name, num_alt_names, alt_names))
+    goto done;
+
+  cupsCopyString(temp, "critical", sizeof(temp));
+  for (tempptr = temp + strlen(temp), i = 0, usage_bit = CUPS_CREDUSAGE_DIGITAL_SIGNATURE; i < (sizeof(tls_usage_strings) / sizeof(tls_usage_strings[0])); i ++, usage_bit *= 2)
+  {
+    if (!(usage & usage_bit))
+      continue;
+
+    snprintf(tempptr, sizeof(temp) - (size_t)(tempptr - temp), ",%s", tls_usage_strings[i]);
+
+    tempptr += strlen(tempptr);
+  }
+  openssl_add_ext(exts, NID_key_usage, temp);
 
-  // TODO: Make this STACKOF and use X509_REQ_add_extensions
-//  X509_REQ_add1_ext_i2d(csr, NID_subject_alt_name, gens, 0, X509V3_ADD_DEFAULT);
-//  sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
+  temp[0] = '\0';
+  for (tempptr = temp, i = 0, purpose_bit = CUPS_CREDPURPOSE_SERVER_AUTH; i < (sizeof(tls_purpose_oids) / sizeof(tls_purpose_oids[0])); i ++, purpose_bit *= 2)
+  {
+    if (!(purpose & purpose_bit))
+      continue;
+
+    if (tempptr == temp)
+      cupsCopyString(temp, tls_purpose_oids[i], sizeof(temp));
+    else
+      snprintf(tempptr, sizeof(temp) - (size_t)(tempptr - temp), ",%s", tls_purpose_oids[i]);
+
+    tempptr += strlen(tempptr);
+  }
+  openssl_add_ext(exts, NID_ext_key_usage, temp);
 
+  X509_REQ_add_extensions(csr, exts);
   X509_REQ_sign(csr, pkey, EVP_sha256());
 
+  sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
+
   // Save them...
   if ((bio = BIO_new_file(keyfile, "wb")) == NULL)
   {
@@ -406,7 +466,7 @@ cupsMakeServerRequest(
 
   // TODO: Copy CSR to returned string
   result = strdup("");
-  DEBUG_puts("1cupsMakeServerRequest: Successfully created signing request.");
+  DEBUG_puts("1cupsCreateCredentialsRequest: Successfully created signing request.");
 
   // Cleanup...
   done:
@@ -419,94 +479,27 @@ cupsMakeServerRequest(
 
 
 //
-// 'cupsSaveServerCredentials()' - Save the X.509 certificate chain associated
-//                                 with a server.
-//
-// This function saves the the PEM-encoded X.509 certificate chain string to
-// the directory "path" or, if "path" is `NULL`, in a per-user or system-wide
-// (when running as root) certificate/key store.  The "common_name" value must
-// match the value supplied when the @link cupsMakeServerRequest@ function was
-// called to obtain the certificate signing request (CSR).  The saved
-// certificate is paired with the private key that was generated for the CSR,
-// allowing it to be used for encryption and signing.
+// 'cupsSignCredentialsRequest()' - Sign an X.509 certificate signing request to produce an X.509 certificate chain.
 //
 
-extern bool				// O - `true` on success, `false` on failure
-cupsSaveServerCredentials(
+bool					// O - `true` on success, `false` on failure
+cupsSignCredentialsRequest(
     const char *path,			// I - Directory path for certificate/key store or `NULL` for default
-    const char *common_name,		// I - Common name for certificate
-    const char *pem)			// I - PEM-encoded certificate chain
+    const char *common_name,		// I - Common name to use
+    const char *request,		// I - PEM-encoded CSR
+    const char *root_name,		// I - Root certificate
+    time_t     expiration_date)		// I - Certificate expiration date
 {
-  // TODO: Implement cupsSaveServerCredentials
   (void)path;
   (void)common_name;
-  (void)pem;
+  (void)request;
+  (void)root_name;
+  (void)expiration_date;
 
   return (false);
 }
 
 
-//
-// 'cupsSetServerCredentials()' - Set the default server credentials.
-//
-// Note: The server credentials are used by all threads in the running process.
-// This function is threadsafe.
-//
-
-bool					// O - `true` on success, `false` on failure
-cupsSetServerCredentials(
-    const char *path,			// I - Directory path for certificate/key store or `NULL` for default
-    const char *common_name,		// I - Default common name for server
-    bool       auto_create)		// I - `true` = automatically create self-signed certificates
-{
-  char	temp[1024];			// Default path buffer
-
-
-  DEBUG_printf(("cupsSetServerCredentials(path=\"%s\", common_name=\"%s\", auto_create=%d)", path, common_name, auto_create));
-
- /*
-  * Use defaults as needed...
-  */
-
-  if (!path)
-    path = http_default_path(temp, sizeof(temp));
-
- /*
-  * Range check input...
-  */
-
-  if (!path || !common_name)
-  {
-    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(EINVAL), 0);
-    return (0);
-  }
-
-  cupsMutexLock(&tls_mutex);
-
- /*
-  * Free old values...
-  */
-
-  if (tls_keypath)
-    _cupsStrFree(tls_keypath);
-
-  if (tls_common_name)
-    _cupsStrFree(tls_common_name);
-
- /*
-  * Save the new values...
-  */
-
-  tls_keypath     = _cupsStrAlloc(path);
-  tls_auto_create = auto_create;
-  tls_common_name = _cupsStrAlloc(common_name);
-
-  cupsMutexUnlock(&tls_mutex);
-
-  return (1);
-}
-
-
 //
 // 'httpCopyCredentials()' - Copy the credentials associated with the peer in
 //                           an encrypted connection.
@@ -579,18 +572,6 @@ _httpCreateCredentials(
 }
 
 
-//
-// '_httpFreeCredentials()' - Free internal credentials.
-//
-
-void
-_httpFreeCredentials(
-    http_tls_credentials_t credentials)	// I - Internal credentials
-{
-  X509_free(credentials);
-}
-
-
 //
 // 'httpCredentialsAreValidForName()' - Return whether the credentials are valid
 //                                      for the given name.
@@ -605,7 +586,7 @@ httpCredentialsAreValidForName(
   bool	result = false;			// Result
 
 
-  cert = http_create_credential((http_credential_t *)cupsArrayGetFirst(credentials));
+  cert = openssl_create_credential((http_credential_t *)cupsArrayGetFirst(credentials));
   if (cert)
   {
     result = X509_check_host(cert, common_name, strlen(common_name), 0, NULL) != 0;
@@ -638,7 +619,7 @@ httpCredentialsGetTrust(
     return (HTTP_TRUST_UNKNOWN);
   }
 
-  if ((cert = http_create_credential((http_credential_t *)cupsArrayGetFirst(credentials))) == NULL)
+  if ((cert = openssl_create_credential((http_credential_t *)cupsArrayGetFirst(credentials))) == NULL)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create credentials from array."), 1);
     return (HTTP_TRUST_UNKNOWN);
@@ -647,7 +628,7 @@ httpCredentialsGetTrust(
   if (cg->any_root < 0)
   {
     _cupsSetDefaults();
-//    http_load_crl();
+//    openssl_load_crl();
   }
 
   // Look this common name up in the default keychains...
@@ -742,7 +723,7 @@ httpCredentialsGetTrust(
     time_t	curtime;		// Current date/time
 
     time(&curtime);
-    if (curtime < http_get_date(cert, 0) || curtime > http_get_date(cert, 1))
+    if (curtime < openssl_get_date(cert, 0) || curtime > openssl_get_date(cert, 1))
     {
       _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Credentials have expired."), 1);
       trust = HTTP_TRUST_EXPIRED;
@@ -773,9 +754,9 @@ httpCredentialsGetExpiration(
   X509		*cert;			// Certificate
 
 
-  if ((cert = http_create_credential((http_credential_t *)cupsArrayGetFirst(credentials))) != NULL)
+  if ((cert = openssl_create_credential((http_credential_t *)cupsArrayGetFirst(credentials))) != NULL)
   {
-    result = http_get_date(cert, 1);
+    result = openssl_get_date(cert, 1);
     X509_free(cert);
   }
 
@@ -806,7 +787,7 @@ httpCredentialsString(
     *buffer = '\0';
 
   first = (http_credential_t *)cupsArrayGetFirst(credentials);
-  cert  = http_create_credential(first);
+  cert  = openssl_create_credential(first);
 
   if (cert)
   {
@@ -820,7 +801,7 @@ httpCredentialsString(
 
     X509_NAME_get_text_by_NID(X509_get_subject_name(cert), NID_commonName, name, sizeof(name));
     X509_NAME_get_text_by_NID(X509_get_issuer_name(cert), NID_commonName, issuer, sizeof(issuer));
-    expiration = http_get_date(cert, 1);
+    expiration = openssl_get_date(cert, 1);
 
     switch (X509_get_signature_nid(cert))
     {
@@ -872,180 +853,14 @@ httpCredentialsString(
 
 
 //
-// 'httpLoadCredentials()' - Load X.509 credentials from a keychain file.
-//
-
-bool					// O - `true` on success, `false` on error
-httpLoadCredentials(
-    const char   *path,			// I  - Keychain/PKCS#12 path
-    cups_array_t **credentials,		// IO - Credentials
-    const char   *common_name)		// I  - Common name for credentials
-{
-  cups_file_t		*fp;		// Certificate file
-  char			filename[1024],	// filename.crt
-			temp[1024],	// Temporary string
-			line[256];	// Base64-encoded line
-  unsigned char		*data = NULL;	// Buffer for cert data
-  size_t		alloc_data = 0,	// Bytes allocated
-			num_data = 0,	// Bytes used
-			decoded;	// Bytes decoded
-  bool			in_certificate = false;
-					// In a certificate?
-
-
-  if (credentials)
-    *credentials = NULL;
-
-  if (!credentials || !common_name)
-    return (false);
-
-  if (!path)
-    path = http_default_path(temp, sizeof(temp));
-  if (!path)
-    return (false);
-
-  http_make_path(filename, sizeof(filename), path, common_name, "crt");
-
-  if ((fp = cupsFileOpen(filename, "r")) == NULL)
-    return (false);
-
-  while (cupsFileGets(fp, line, sizeof(line)))
-  {
-    if (!strcmp(line, "-----BEGIN CERTIFICATE-----"))
-    {
-      if (in_certificate)
-      {
-        // Missing END CERTIFICATE...
-        httpFreeCredentials(*credentials);
-	*credentials = NULL;
-        break;
-      }
-
-      in_certificate = true;
-    }
-    else if (!strcmp(line, "-----END CERTIFICATE-----"))
-    {
-      if (!in_certificate || !num_data)
-      {
-        // Missing data...
-        httpFreeCredentials(*credentials);
-	*credentials = NULL;
-        break;
-      }
-
-      if (!*credentials)
-        *credentials = cupsArrayNew(NULL, NULL, NULL, 0, NULL, NULL);
-
-      if (httpAddCredential(*credentials, data, num_data))
-      {
-        httpFreeCredentials(*credentials);
-	*credentials = NULL;
-        break;
-      }
-
-      num_data       = 0;
-      in_certificate = false;
-    }
-    else if (in_certificate)
-    {
-      if (alloc_data == 0)
-      {
-        data       = malloc(2048);
-	alloc_data = 2048;
-
-        if (!data)
-	  break;
-      }
-      else if ((num_data + strlen(line)) >= alloc_data)
-      {
-        unsigned char *tdata = realloc(data, alloc_data + 1024);
-					// Expanded buffer
-
-	if (!tdata)
-	{
-	  httpFreeCredentials(*credentials);
-	  *credentials = NULL;
-	  break;
-	}
-
-	data       = tdata;
-        alloc_data += 1024;
-      }
-
-      decoded = alloc_data - num_data;
-      httpDecode64((char *)data + num_data, &decoded, line, NULL);
-      num_data += (size_t)decoded;
-    }
-  }
-
-  cupsFileClose(fp);
-
-  if (in_certificate)
-  {
-    // Missing END CERTIFICATE...
-    httpFreeCredentials(*credentials);
-    *credentials = NULL;
-  }
-
-  if (data)
-    free(data);
-
-  return (*credentials != NULL);
-}
-
-
-//
-// 'httpSaveCredentials()' - Save X.509 credentials to a keychain file.
+// '_httpFreeCredentials()' - Free internal credentials.
 //
 
-bool					// O - `true` on success, `false` on error
-httpSaveCredentials(
-    const char   *path,			// I - Keychain/PKCS#12 path
-    cups_array_t *credentials,		// I - Credentials
-    const char   *common_name)		// I - Common name for credentials
+void
+_httpFreeCredentials(
+    http_tls_credentials_t credentials)	// I - Internal credentials
 {
-  cups_file_t		*fp;		// Certificate file
-  char			filename[1024],	// filename.crt
-			nfilename[1024],// filename.crt.N
-			temp[1024],	// Temporary string
-			line[256];	// Base64-encoded line
-  const unsigned char	*ptr;		// Pointer into certificate
-  ssize_t		remaining;	// Bytes left
-  http_credential_t	*cred;		// Current credential
-
-
-  if (!credentials || !common_name)
-    return (false);
-
-  if (!path)
-    path = http_default_path(temp, sizeof(temp));
-  if (!path)
-    return (false);
-
-  http_make_path(filename, sizeof(filename), path, common_name, "crt");
-  snprintf(nfilename, sizeof(nfilename), "%s.N", filename);
-
-  if ((fp = cupsFileOpen(nfilename, "w")) == NULL)
-    return (false);
-
-#ifndef _WIN32
-  fchmod(cupsFileNumber(fp), 0600);
-#endif // !_WIN32
-
-  for (cred = (http_credential_t *)cupsArrayGetFirst(credentials); cred; cred = (http_credential_t *)cupsArrayGetNext(credentials))
-  {
-    cupsFilePuts(fp, "-----BEGIN CERTIFICATE-----\n");
-    for (ptr = cred->data, remaining = (ssize_t)cred->datalen; remaining > 0; remaining -= 45, ptr += 45)
-    {
-      httpEncode64(line, sizeof(line), (char *)ptr, remaining > 45 ? 45 : (size_t)remaining, false);
-      cupsFilePrintf(fp, "%s\n", line);
-    }
-    cupsFilePuts(fp, "-----END CERTIFICATE-----\n");
-  }
-
-  cupsFileClose(fp);
-
-  return (!rename(nfilename, filename));
+  X509_free(credentials);
 }
 
 
@@ -1089,24 +904,6 @@ _httpTLSRead(http_t *http,		// I - Connection to server
 }
 
 
-//
-// '_httpTLSSetOptions()' - Set TLS protocol and cipher suite options.
-//
-
-void
-_httpTLSSetOptions(int options,		// I - Options
-                   int min_version,	// I - Minimum TLS version
-                   int max_version)	// I - Maximum TLS version
-{
-  if (!(options & _HTTP_TLS_SET_DEFAULT) || tls_options < 0)
-  {
-    tls_options     = options;
-    tls_min_version = min_version;
-    tls_max_version = max_version;
-  }
-}
-
-
 //
 // '_httpTLSStart()' - Set up SSL/TLS support on a connection.
 //
@@ -1252,9 +1049,9 @@ _httpTLSStart(http_t *http)		// I - Connection to server
     {
       DEBUG_printf(("4_httpTLSStart: Auto-create credentials for \"%s\".", cn));
 
-      if (!cupsMakeServerCredentials(tls_keypath, CUPS_CREDTYPE_DEFAULT, NULL, NULL, NULL, NULL, NULL, NULL, false, cn, 0, NULL, time(NULL) + 3650 * 86400))
+      if (!cupsCreateCredentials(tls_keypath, false, CUPS_CREDPURPOSE_SERVER_AUTH, CUPS_CREDTYPE_DEFAULT, CUPS_CREDUSAGE_DEFAULT_TLS, NULL, NULL, NULL, NULL, NULL, cn, 0, NULL, NULL, time(NULL) + 3650 * 86400))
       {
-	DEBUG_puts("4_httpTLSStart: cupsMakeServerCredentials failed.");
+	DEBUG_puts("4_httpTLSStart: cupsCreateCredentials failed.");
 	http->error  = errno = EINVAL;
 	http->status = HTTP_STATUS_ERROR;
 	_cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create server credentials."), 1);
@@ -1408,28 +1205,6 @@ _httpTLSWrite(http_t     *http,		// I - Connection to server
 }
 
 
-//
-// 'http_add_san()' - Add a subjectAltName to GENERAL_NAMES used for
-//                    the extension to an X.509 certificate/signing request.
-//
-
-static void
-http_add_san(GENERAL_NAMES *gens,	// I - Concatenation of DNS names
-             const char    *name)	// I - Hostname
-{
-  GENERAL_NAME *gen_dns = GENERAL_NAME_new();
-					// DNS: name
-  ASN1_IA5STRING *ia5 = ASN1_IA5STRING_new();
-					// Hostname string
-
-
-  // Set the strings and push it on the GENERAL_NAMES list...
-  ASN1_STRING_set(ia5, name, strlen(name));
-  GENERAL_NAME_set0_value(gen_dns, GEN_DNS, ia5);
-  sk_GENERAL_NAME_push(gens, gen_dns);
-}
-
-
 //
 // 'http_bio_ctrl()' - Control the HTTP connection.
 //
@@ -1593,11 +1368,39 @@ http_bio_write(BIO        *h,		// I - BIO data
 
 
 //
-// 'http_create_credential()' - Create a single credential in the internal format.
+// 'openssl_add_ext()' - Add an extension.
+//
+
+static bool				// O - `true` on success, `false` on error
+openssl_add_ext(
+    STACK_OF(X509_EXTENSION) *exts,	// I - Stack of extensions
+    int                      nid,	// I - Extension ID
+    const char               *value)	// I - Value
+{
+  X509_EXTENSION *ext = NULL;		// Extension
+
+
+  DEBUG_printf(("3openssl_add_ext(exts=%p, nid=%d, value=\"%s\")", (void *)exts, nid, value));
+
+  // Create and add the extension...
+  if ((ext = X509V3_EXT_conf_nid(/*conf*/NULL, /*ctx*/NULL, nid, value)) == NULL)
+  {
+    DEBUG_puts("4openssl_add_ext: Unable to create extension, returning false.");
+    return (false);
+  }
+
+  sk_X509_EXTENSION_push(exts, ext);
+
+  return (true);
+}
+
+
+//
+// 'openssl_create_credential()' - Create a single credential in the internal format.
 //
 
 static X509 *				// O - Certificate
-http_create_credential(
+openssl_create_credential(
     http_credential_t *credential)	// I - Credential
 {
   X509	*cert = NULL;			// Certificate
@@ -1619,11 +1422,11 @@ http_create_credential(
 
 
 //
-// 'http_create_key()' - Create a suitable key pair for a certificate/signing request.
+// 'openssl_create_key()' - Create a suitable key pair for a certificate/signing request.
 //
 
 static EVP_PKEY *			// O - Key pair
-http_create_key(cups_credtype_t type)	// I - Type of key
+openssl_create_key(cups_credtype_t type)	// I - Type of key
 {
   EVP_PKEY	*pkey;			// Key pair
 #if defined(EVP_PKEY_EC)
@@ -1694,11 +1497,11 @@ http_create_key(cups_credtype_t type)	// I - Type of key
 
 
 //
-// 'http_create_name()' - Create an X.509 name value for a certificate/signing request.
+// 'openssl_create_name()' - Create an X.509 name value for a certificate/signing request.
 //
 
 static X509_NAME *			// O - X.509 name value
-http_create_name(
+openssl_create_name(
     const char      *organization,	// I - Organization or `NULL` to use common name
     const char      *org_unit,		// I - Organizational unit or `NULL` for none
     const char      *locality,		// I - City/town or `NULL` for "Unknown"
@@ -1731,104 +1534,60 @@ http_create_name(
 
 
 //
-// 'http_create_san()' - Create a list of subjectAltName values for a certificate/signing request.
+// 'openssl_create_san()' - Create a list of subjectAltName values for a certificate/signing request.
 //
 
-static GENERAL_NAMES *			// O - List of subjectAltName values
-http_create_san(
+static bool				// O - `true` on success, `false` otherwise
+openssl_create_san(
+    STACK_OF(X509_EXTENSION) *exts,	// I - Extensions
     const char *common_name,		// I - Common name
     size_t     num_alt_names,		// I - Number of alternate names
     const char **alt_names)		// I - List of alternate names
 {
-  GENERAL_NAMES	*gens;			// List of subjectAltName values
+  char		temp[2048],		// Temporary string
+		*tempptr;		// Pointer into temporary string
   size_t	i;			// Looping var
 
 
-  gens = sk_GENERAL_NAME_new_null();
+  // Add the common name
+  snprintf(temp, sizeof(temp), "dns:%s", common_name);
+  tempptr = temp + strlen(temp);
 
-  http_add_san(gens, common_name);
   if (strstr(common_name, ".local") == NULL)
   {
     // Add common_name.local to the list, too...
     char	localname[256],		// hostname.local
 		*localptr;		// Pointer into localname
 
-    strlcpy(localname, common_name, sizeof(localname));
+    cupsCopyString(localname, common_name, sizeof(localname));
     if ((localptr = strchr(localname, '.')) != NULL)
       *localptr = '\0';
-    strlcat(localname, ".local", sizeof(localname));
 
-    http_add_san(gens, localname);
+    snprintf(tempptr, sizeof(temp) - (size_t)(tempptr - temp), ",dns:%s.local", localname);
+    tempptr += strlen(tempptr);
   }
 
+  // Add any alternate names...
   for (i = 0; i < num_alt_names; i ++)
   {
     if (strcmp(alt_names[i], "localhost"))
-      http_add_san(gens, alt_names[i]);
-  }
-
-  return (gens);
-}
-
-
-//
-// 'http_default_path()' - Get the default credential store path.
-//
-
-static const char *			// O - Path or NULL on error
-http_default_path(
-    char   *buffer,			// I - Path buffer
-    size_t bufsize)			// I - Size of path buffer
-{
-  _cups_globals_t	*cg = _cupsGlobals();
-					// Pointer to library globals
-
-
-  if (cg->userconfig)
-  {
-    if (mkdir(cg->userconfig, 0755) && errno != EEXIST)
-    {
-      DEBUG_printf(("1http_default_path: Failed to make directory '%s': %s", cg->userconfig, strerror(errno)));
-      return (NULL);
-    }
-
-    snprintf(buffer, bufsize, "%s/ssl", cg->userconfig);
-
-    if (mkdir(buffer, 0700) && errno != EEXIST)
-    {
-      DEBUG_printf(("1http_default_path: Failed to make directory '%s': %s", buffer, strerror(errno)));
-      return (NULL);
-    }
-  }
-  else
-  {
-    if (mkdir(cg->sysconfig, 0755) && errno != EEXIST)
     {
-      DEBUG_printf(("1http_default_path: Failed to make directory '%s': %s", cg->sysconfig, strerror(errno)));
-      return (NULL);
-    }
-
-    snprintf(buffer, bufsize, "%s/ssl", cg->sysconfig);
-
-    if (mkdir(buffer, 0700) && errno != EEXIST)
-    {
-      DEBUG_printf(("1http_default_path: Failed to make directory '%s': %s", buffer, strerror(errno)));
-      return (NULL);
+      snprintf(tempptr, sizeof(temp) - (size_t)(tempptr - temp), ",dns:%s", alt_names[i]);
+      tempptr += strlen(tempptr);
     }
   }
 
-  DEBUG_printf(("1http_default_path: Using default path \"%s\".", buffer));
-
-  return (buffer);
+  // Return the stack
+  return (openssl_add_ext(exts, NID_subject_alt_name, temp));
 }
 
 
 //
-// 'http_get_date()' - Get the notBefore or notAfter date of a certificate.
+// 'openssl_get_date()' - Get the notBefore or notAfter date of a certificate.
 //
 
 static time_t				// O - UNIX time in seconds
-http_get_date(X509 *cert,		// I - Certificate
+openssl_get_date(X509 *cert,		// I - Certificate
               int  which)		// I - 0 for notBefore, 1 for notAfter
 {
   unsigned char	*expiration;		// Expiration date of cert
@@ -1870,11 +1629,11 @@ http_get_date(X509 *cert,		// I - Certificate
 
 #if 0
 //
-// 'http_load_crl()' - Load the certificate revocation list, if any.
+// 'openssl_load_crl()' - Load the certificate revocation list, if any.
 //
 
 static void
-http_load_crl(void)
+openssl_load_crl(void)
 {
   cupsMutexLock(&tls_mutex);
 
@@ -1963,81 +1722,3 @@ http_load_crl(void)
   cupsMutexUnlock(&tls_mutex);
 }
 #endif // 0
-
-
-//
-// 'http_make_path()' - Format a filename for a certificate or key file.
-//
-
-static const char *			// O - Filename
-http_make_path(
-    char       *buffer,			// I - Filename buffer
-    size_t     bufsize,			// I - Size of buffer
-    const char *dirname,		// I - Directory
-    const char *filename,		// I - Filename (usually hostname)
-    const char *ext)			// I - Extension
-{
-  char	*bufptr,			// Pointer into buffer
-	*bufend = buffer + bufsize - 1;	// End of buffer
-
-
-  snprintf(buffer, bufsize, "%s/", dirname);
-  bufptr = buffer + strlen(buffer);
-
-  while (*filename && bufptr < bufend)
-  {
-    if (_cups_isalnum(*filename) || *filename == '-' || *filename == '.')
-      *bufptr++ = *filename;
-    else
-      *bufptr++ = '_';
-
-    filename ++;
-  }
-
-  if (bufptr < bufend && filename[-1] != '.')
-    *bufptr++ = '.';
-
-  cupsCopyString(bufptr, ext, (size_t)(bufend - bufptr + 1));
-
-  return (buffer);
-}
-
-
-//
-// 'http_x509_add_ext()' - Add an extension to a certificate.
-//
-
-static bool
-http_x509_add_ext(X509       *cert,	// I - Certificate
-                  int        nid,	// I - Extension ID
-                  const char *value)	// I - Value
-{
-  bool			ret;		// Return value
-  X509_EXTENSION	*ex = NULL;	// Extension
-  X509V3_CTX		ctx;		// Certificate context
-
-
-  DEBUG_printf(("3http_x509_add_ext(cert=%p, nid=%d, value=\"%s\")", (void *)cert, nid, value));
-
-  // Don't use a configuration database...
-  X509V3_set_ctx_nodb(&ctx);
-
-  // Self-signed certificates use the same issuer and subject...
-  X509V3_set_ctx(&ctx, /*issuer*/cert, /*subject*/cert, /*req*/NULL, /*crl*/NULL, /*flags*/0);
-
-  // Create and add the extension...
-  if ((ex = X509V3_EXT_conf_nid(/*conf*/NULL, &ctx, nid, value)) == NULL)
-  {
-    DEBUG_puts("4http_x509_add_ext: Unable to create extension, returning false.");
-    return (false);
-  }
-
-  ret = X509_add_ext(cert, ex, -1) != 0;
-
-  DEBUG_printf(("4http_x509_add_ext: X509_add_ext returned %s.", ret ? "true" : "false"));
-
-  // Free the extension and return...
-  X509_EXTENSION_free(ex);
-
-  return (ret);
-}
diff --git a/cups/tls.c b/cups/tls.c
index 165d55874..1ad53348e 100644
--- a/cups/tls.c
+++ b/cups/tls.c
@@ -1,22 +1,19 @@
-/*
- * TLS routines for CUPS.
- *
- * Copyright © 2021-2022 by OpenPrinting.
- * Copyright @ 2007-2014 by Apple Inc.
- * Copyright @ 1997-2007 by Easy Software Products, all rights reserved.
- *
- * Licensed under Apache License v2.0.  See the file "LICENSE" for more
- * information.
- */
-
-/*
- * Include necessary headers...
- */
+//
+// TLS routines for CUPS.
+//
+// Copyright © 2021-2023 by OpenPrinting.
+// Copyright @ 2007-2014 by Apple Inc.
+// Copyright @ 1997-2007 by Easy Software Products, all rights reserved.
+//
+// Licensed under Apache License v2.0.  See the file "LICENSE" for more
+// information.
+//
 
 #include "cups-private.h"
 #include "debug-internal.h"
 #include <fcntl.h>
 #include <math.h>
+#include <sys/stat.h>
 #ifdef _WIN32
 #  include <tchar.h>
 #else
@@ -24,17 +21,555 @@
 #  include <signal.h>
 #  include <sys/time.h>
 #  include <sys/resource.h>
-#endif /* _WIN32 */
+#endif // _WIN32
 
 
-/*
- * Include platform-specific TLS code...
- */
+//
+// Local globals...
+//
 
-#ifdef HAVE_TLS
-#  ifdef HAVE_OPENSSL
+static bool		tls_auto_create = false;
+					// Auto-create self-signed certs?
+static char		*tls_common_name = NULL;
+					// Default common name
+static char		*tls_keypath = NULL;
+					// Certificate store path
+static cups_mutex_t	tls_mutex = CUPS_MUTEX_INITIALIZER;
+					// Mutex for certificates
+static int		tls_options = -1,// Options for TLS connections
+			tls_min_version = _HTTP_TLS_1_2,
+			tls_max_version = _HTTP_TLS_MAX;
+
+
+//
+// Local functions...
+//
+
+static char		*http_copy_file(const char *path, const char *common_name, const char *ext);
+static const char	*http_default_path(char *buffer, size_t bufsize);
+static const char	*http_make_path(char *buffer, size_t bufsize, const char *dirname, const char *filename, const char *ext);
+static bool		http_save_file(const char *path, const char *common_name, const char *ext, const char *value);
+
+
+//
+// Include platform-specific TLS code...
+//
+
+#ifdef HAVE_OPENSSL
 #    include "tls-openssl.c"
-#  elif defined(HAVE_GNUTLS)
-#    include "tls-gnutls.c"
-#  endif /* HAVE_OPENSSL */
-#endif /* HAVE_TLS */
+#else // HAVE_GNUTLS
+#  include "tls-gnutls.c"
+#endif /* HAVE_OPENSSL */
+
+
+//
+// 'cupsCopyCredentials()' - Copy the X.509 certificate chain to a string.
+//
+
+char *
+cupsCopyCredentials(
+    const char *path,			// I - Directory path for certificate/key store or `NULL` for default
+    const char *common_name)		// I - Common name
+{
+  return (http_copy_file(path, common_name, "crt"));
+}
+
+
+//
+// 'cupsCopyCredentialsKey()' - Copy the private key to a string.
+//
+
+char *
+cupsCopyCredentialsKey(
+    const char *path,			// I - Directory path for certificate/key store or `NULL` for default
+    const char *common_name)		// I - Common name
+{
+  return (http_copy_file(path, common_name, "key"));
+}
+
+
+//
+// 'cupsCopyCredentialsRequest()' - Copy the X.509 certificate signing request to a string.
+//
+
+char *
+cupsCopyCredentialsRequest(
+    const char *path,			// I - Directory path for certificate/key store or `NULL` for default
+    const char *common_name)		// I - Common name
+{
+  return (http_copy_file(path, common_name, "csr"));
+}
+
+
+//
+// 'cupsSaveServerCredentials()' - Save the X.509 certificate chain associated
+//                                 with a server.
+//
+// This function saves the the PEM-encoded X.509 certificate chain string to
+// the directory "path" or, if "path" is `NULL`, in a per-user or system-wide
+// (when running as root) certificate/key store.  The "common_name" value must
+// match the value supplied when the @link cupsMakeServerRequest@ function was
+// called to obtain the certificate signing request (CSR).  The saved
+// certificate is paired with the private key that was generated for the CSR,
+// allowing it to be used for encryption and signing.
+//
+
+extern bool				// O - `true` on success, `false` on failure
+cupsSaveCredentials(
+    const char *path,			// I - Directory path for certificate/key store or `NULL` for default
+    const char *common_name,		// I - Common name for certificate
+    const char *credentials,		// I - PEM-encoded certificate chain
+    const char *key)			// I - PEM-encoded private key or `NULL` for none
+{
+  if (http_save_file(path, common_name, "crt", credentials))
+  {
+    if (key)
+      return (http_save_file(path, common_name, "key", key));
+    else
+      return (true);
+  }
+
+  return (false);
+}
+
+
+//
+// 'cupsSetServerCredentials()' - Set the default server credentials.
+//
+// Note: The server credentials are used by all threads in the running process.
+// This function is threadsafe.
+//
+
+bool					// O - `true` on success, `false` on failure
+cupsSetServerCredentials(
+    const char *path,			// I - Directory path for certificate/key store or `NULL` for default
+    const char *common_name,		// I - Default common name for server
+    bool       auto_create)		// I - `true` = automatically create self-signed certificates
+{
+  char	temp[1024];			// Default path buffer
+
+
+  DEBUG_printf(("cupsSetServerCredentials(path=\"%s\", common_name=\"%s\", auto_create=%d)", path, common_name, auto_create));
+
+ /*
+  * Use defaults as needed...
+  */
+
+  if (!path)
+    path = http_default_path(temp, sizeof(temp));
+
+ /*
+  * Range check input...
+  */
+
+  if (!path || !common_name)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(EINVAL), 0);
+    return (0);
+  }
+
+  cupsMutexLock(&tls_mutex);
+
+ /*
+  * Free old values...
+  */
+
+  if (tls_keypath)
+    _cupsStrFree(tls_keypath);
+
+  if (tls_common_name)
+    _cupsStrFree(tls_common_name);
+
+ /*
+  * Save the new values...
+  */
+
+  tls_keypath     = _cupsStrAlloc(path);
+  tls_auto_create = auto_create;
+  tls_common_name = _cupsStrAlloc(common_name);
+
+  cupsMutexUnlock(&tls_mutex);
+
+  return (1);
+}
+
+
+//
+// 'httpLoadCredentials()' - Load X.509 credentials from a keychain file.
+//
+
+bool					// O - `true` on success, `false` on error
+httpLoadCredentials(
+    const char   *path,			// I  - Keychain/PKCS#12 path
+    cups_array_t **credentials,		// IO - Credentials
+    const char   *common_name)		// I  - Common name for credentials
+{
+  cups_file_t		*fp;		// Certificate file
+  char			filename[1024],	// filename.crt
+			temp[1024],	// Temporary string
+			line[256];	// Base64-encoded line
+  unsigned char		*data = NULL;	// Buffer for cert data
+  size_t		alloc_data = 0,	// Bytes allocated
+			num_data = 0,	// Bytes used
+			decoded;	// Bytes decoded
+  bool			in_certificate = false;
+					// In a certificate?
+
+
+  if (credentials)
+    *credentials = NULL;
+
+  if (!credentials || !common_name)
+    return (false);
+
+  if (!path)
+    path = http_default_path(temp, sizeof(temp));
+  if (!path)
+    return (false);
+
+  http_make_path(filename, sizeof(filename), path, common_name, "crt");
+
+  if ((fp = cupsFileOpen(filename, "r")) == NULL)
+    return (false);
+
+  while (cupsFileGets(fp, line, sizeof(line)))
+  {
+    if (!strcmp(line, "-----BEGIN CERTIFICATE-----"))
+    {
+      if (in_certificate)
+      {
+        // Missing END CERTIFICATE...
+        httpFreeCredentials(*credentials);
+	*credentials = NULL;
+        break;
+      }
+
+      in_certificate = true;
+    }
+    else if (!strcmp(line, "-----END CERTIFICATE-----"))
+    {
+      if (!in_certificate || !num_data)
+      {
+        // Missing data...
+        httpFreeCredentials(*credentials);
+	*credentials = NULL;
+        break;
+      }
+
+      if (!*credentials)
+        *credentials = cupsArrayNew(NULL, NULL, NULL, 0, NULL, NULL);
+
+      if (httpAddCredential(*credentials, data, num_data))
+      {
+        httpFreeCredentials(*credentials);
+	*credentials = NULL;
+        break;
+      }
+
+      num_data       = 0;
+      in_certificate = false;
+    }
+    else if (in_certificate)
+    {
+      if (alloc_data == 0)
+      {
+        data       = malloc(2048);
+	alloc_data = 2048;
+
+        if (!data)
+	  break;
+      }
+      else if ((num_data + strlen(line)) >= alloc_data)
+      {
+        unsigned char *tdata = realloc(data, alloc_data + 1024);
+					// Expanded buffer
+
+	if (!tdata)
+	{
+	  httpFreeCredentials(*credentials);
+	  *credentials = NULL;
+	  break;
+	}
+
+	data       = tdata;
+        alloc_data += 1024;
+      }
+
+      decoded = alloc_data - num_data;
+      httpDecode64((char *)data + num_data, &decoded, line, NULL);
+      num_data += (size_t)decoded;
+    }
+  }
+
+  cupsFileClose(fp);
+
+  if (in_certificate)
+  {
+    // Missing END CERTIFICATE...
+    httpFreeCredentials(*credentials);
+    *credentials = NULL;
+  }
+
+  if (data)
+    free(data);
+
+  return (*credentials != NULL);
+}
+
+
+//
+// 'httpSaveCredentials()' - Save X.509 credentials to a keychain file.
+//
+
+bool					// O - `true` on success, `false` on error
+httpSaveCredentials(
+    const char   *path,			// I - Keychain/PKCS#12 path
+    cups_array_t *credentials,		// I - Credentials
+    const char   *common_name)		// I - Common name for credentials
+{
+  cups_file_t		*fp;		// Certificate file
+  char			filename[1024],	// filename.crt
+			nfilename[1024],// filename.crt.N
+			temp[1024],	// Temporary string
+			line[256];	// Base64-encoded line
+  const unsigned char	*ptr;		// Pointer into certificate
+  ssize_t		remaining;	// Bytes left
+  http_credential_t	*cred;		// Current credential
+
+
+  if (!credentials || !common_name)
+    return (false);
+
+  if (!path)
+    path = http_default_path(temp, sizeof(temp));
+  if (!path)
+    return (false);
+
+  http_make_path(filename, sizeof(filename), path, common_name, "crt");
+  snprintf(nfilename, sizeof(nfilename), "%s.N", filename);
+
+  if ((fp = cupsFileOpen(nfilename, "w")) == NULL)
+    return (false);
+
+#ifndef _WIN32
+  fchmod(cupsFileNumber(fp), 0600);
+#endif // !_WIN32
+
+  for (cred = (http_credential_t *)cupsArrayGetFirst(credentials); cred; cred = (http_credential_t *)cupsArrayGetNext(credentials))
+  {
+    cupsFilePuts(fp, "-----BEGIN CERTIFICATE-----\n");
+    for (ptr = cred->data, remaining = (ssize_t)cred->datalen; remaining > 0; remaining -= 45, ptr += 45)
+    {
+      httpEncode64(line, sizeof(line), (char *)ptr, remaining > 45 ? 45 : (size_t)remaining, false);
+      cupsFilePrintf(fp, "%s\n", line);
+    }
+    cupsFilePuts(fp, "-----END CERTIFICATE-----\n");
+  }
+
+  cupsFileClose(fp);
+
+  return (!rename(nfilename, filename));
+}
+
+
+//
+// '_httpTLSSetOptions()' - Set TLS protocol and cipher suite options.
+//
+
+void
+_httpTLSSetOptions(int options,		// I - Options
+                   int min_version,	// I - Minimum TLS version
+                   int max_version)	// I - Maximum TLS version
+{
+  if (!(options & _HTTP_TLS_SET_DEFAULT) || tls_options < 0)
+  {
+    tls_options     = options;
+    tls_min_version = min_version;
+    tls_max_version = max_version;
+  }
+}
+
+
+//
+// 'http_copy_file()' - Copy the contents of a file to a string.
+//
+
+static char *
+http_copy_file(const char *path,	// I - Directory
+               const char *common_name,	// I - Common name
+               const char *ext)		// I - Extension
+{
+  char		*s = NULL;		// String
+  int		fd;			// File descriptor
+  char		defpath[1024],		// Default path
+		filename[1024];		// Filename
+  struct stat	fileinfo;		// File information
+
+
+  if (!common_name)
+    return (NULL);
+
+  if (!path)
+    path = http_default_path(defpath, sizeof(defpath));
+
+  if ((fd = open(http_make_path(filename, sizeof(filename), path, common_name, ext), O_RDONLY)) < 0)
+    return (NULL);
+
+  if (fstat(fd, &fileinfo))
+    goto done;
+
+  if (fileinfo.st_size > 65536)
+  {
+    close(fd);
+    return (NULL);
+  }
+
+  if ((s = calloc(1, (size_t)fileinfo.st_size + 1)) == NULL)
+  {
+    close(fd);
+    return (NULL);
+  }
+
+  if (read(fd, s, (size_t)fileinfo.st_size) < 0)
+  {
+    free(s);
+    s = NULL;
+  }
+
+  done:
+
+  close(fd);
+
+  return (s);
+}
+
+
+//
+// 'http_default_path()' - Get the default credential store path.
+//
+
+static const char *			// O - Path or NULL on error
+http_default_path(
+    char   *buffer,			// I - Path buffer
+    size_t bufsize)			// I - Size of path buffer
+{
+  _cups_globals_t	*cg = _cupsGlobals();
+					// Pointer to library globals
+
+
+  if (cg->userconfig)
+  {
+    if (mkdir(cg->userconfig, 0755) && errno != EEXIST)
+    {
+      DEBUG_printf(("1http_default_path: Failed to make directory '%s': %s", cg->userconfig, strerror(errno)));
+      return (NULL);
+    }
+
+    snprintf(buffer, bufsize, "%s/ssl", cg->userconfig);
+
+    if (mkdir(buffer, 0700) && errno != EEXIST)
+    {
+      DEBUG_printf(("1http_default_path: Failed to make directory '%s': %s", buffer, strerror(errno)));
+      return (NULL);
+    }
+  }
+  else
+  {
+    if (mkdir(cg->sysconfig, 0755) && errno != EEXIST)
+    {
+      DEBUG_printf(("1http_default_path: Failed to make directory '%s': %s", cg->sysconfig, strerror(errno)));
+      return (NULL);
+    }
+
+    snprintf(buffer, bufsize, "%s/ssl", cg->sysconfig);
+
+    if (mkdir(buffer, 0700) && errno != EEXIST)
+    {
+      DEBUG_printf(("1http_default_path: Failed to make directory '%s': %s", buffer, strerror(errno)));
+      return (NULL);
+    }
+  }
+
+  DEBUG_printf(("1http_default_path: Using default path \"%s\".", buffer));
+
+  return (buffer);
+}
+
+
+//
+// 'http_make_path()' - Format a filename for a certificate or key file.
+//
+
+static const char *			// O - Filename
+http_make_path(
+    char       *buffer,			// I - Filename buffer
+    size_t     bufsize,			// I - Size of buffer
+    const char *dirname,		// I - Directory
+    const char *filename,		// I - Filename (usually hostname)
+    const char *ext)			// I - Extension
+{
+  char	*bufptr,			// Pointer into buffer
+	*bufend = buffer + bufsize - 1;	// End of buffer
+
+
+  snprintf(buffer, bufsize, "%s/", dirname);
+  bufptr = buffer + strlen(buffer);
+
+  while (*filename && bufptr < bufend)
+  {
+    if (_cups_isalnum(*filename) || *filename == '-' || *filename == '.')
+      *bufptr++ = *filename;
+    else
+      *bufptr++ = '_';
+
+    filename ++;
+  }
+
+  if (bufptr < bufend && filename[-1] != '.')
+    *bufptr++ = '.';
+
+  cupsCopyString(bufptr, ext, (size_t)(bufend - bufptr + 1));
+
+  return (buffer);
+}
+
+
+//
+// 'http_save_file()' - Save a string to a file.
+//
+
+static bool				// O - `true` on success, `false` on failure
+http_save_file(const char *path,	// I - Directory path for certificate/key store or `NULL` for default
+               const char *common_name,	// I - Common name
+               const char *ext,		// I - Extension
+	       const char *value)	// I - String value
+{
+  char	defpath[1024],			// Default path
+	filename[1024];			// Output filename
+  int	fd;				// File descriptor
+
+
+  // Range check input...
+  if (!common_name || !value)
+    return (false);
+
+  // Get default path as needed...
+  if (!path)
+    path = http_default_path(defpath, sizeof(defpath));
+
+  if ((fd = open(http_make_path(filename, sizeof(filename), path, common_name, ext), O_CREAT | O_WRONLY | O_TRUNC, 0644)) < 0)
+    return (false);
+
+  if (write(fd, value, strlen(value)) < 0)
+  {
+    close(fd);
+    unlink(filename);
+    return (false);
+  }
+
+  close(fd);
+
+  return (true);
+}
+
+

From ff12bf3dede813fe8c4667f4dc392e42974f7bc5 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Thu, 4 May 2023 18:01:21 -0400
Subject: [PATCH 08/31] Stub out a new unit test/test command for the
 credentials APIs.

---
 cups/testcreds.c | 594 +++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 518 insertions(+), 76 deletions(-)

diff --git a/cups/testcreds.c b/cups/testcreds.c
index 2ea765f5a..43dc98c3a 100644
--- a/cups/testcreds.c
+++ b/cups/testcreds.c
@@ -1,105 +1,472 @@
-/*
- * HTTP credentials test program for CUPS.
- *
- * Copyright © 2022 by OpenPrinting.
- * Copyright © 2007-2016 by Apple Inc.
- * Copyright © 1997-2006 by Easy Software Products.
- *
- * Licensed under Apache License v2.0.  See the file "LICENSE" for more
- * information.
- */
-
-/*
- * Include necessary headers...
- */
+//
+// X.509 credentials test program for CUPS.
+//
+// Copyright © 2022-2023 by OpenPrinting.
+// Copyright © 2007-2016 by Apple Inc.
+// Copyright © 1997-2006 by Easy Software Products.
+//
+// Licensed under Apache License v2.0.  See the file "LICENSE" for more
+// information.
+//
+// Usage: testcreds [OPTIONS] [SUB-COMMAND] [ARGUMENT]
+//
+// Sub-Commands:
+//
+//   ca COMMON-NAME             Sign a CSR to produce a certificate.
+//   cacert COMMON-NAME         Create a CA certificate.
+//   cert COMMON-NAME           Create a certificate.
+//   client URI                 Connect to URI.
+//   csr COMMON-NAME            Create a certificate signing request.
+//   server COMMON-NAME[:PORT]  Run a HTTPS server (default port 8NNN.)
+//   show COMMON-NAME           Show stored credentials for COMMON-NAME.
+//
+// Options:
+//
+//   -C COUNTRY                 Set country.
+//   -L LOCALITY                Set locality name.
+//   -O ORGANIZATION            Set organization name.
+//   -S STATE                   Set state.
+//   -U ORGANIZATIONAL-UNIT     Set organizational unit name.
+//   -a SUBJECT-ALT-NAME        Add a subjectAltName.
+//   -d DAYS                    Set expiration date in days.
+//   -p PURPOSE                 Comma-delimited certificate purpose (serverAuth,
+//                              clientAuth, codeSigning, emailProtection,
+//                              timeStamping, OCSPSigning)
+//   -r ROOT-NAME               Name of root certificate
+//   -t TYPE                    Certificate type (rsa-2048, rsa-3072, rsa-4096,
+//                              ecdsa-p256, ecdsa-p384, ecdsa-p521)
+//   -u USAGE                   Comma-delimited key usage (digitalSignature,
+//                              nonRepudiation, keyEncipherment,
+//                              dataEncipherment, keyAgreement, keyCertSign,
+//                              cRLSign, encipherOnly, decipherOnly, default-ca,
+//                              default-tls)
+//
 
 #include "cups-private.h"
+#include "test-internal.h"
 
 
-/*
- * 'main()' - Main entry.
- */
+//
+// Local functions...
+//
 
-int					/* O - Exit status */
-main(int  argc,				/* I - Number of command-line arguments */
-     char *argv[])			/* I - Command-line arguments */
-{
-  http_t	*http;			/* HTTP connection */
-  char		scheme[HTTP_MAX_URI],	/* Scheme from URI */
-		hostname[HTTP_MAX_URI],	/* Hostname from URI */
-		username[HTTP_MAX_URI],	/* Username:password from URI */
-		resource[HTTP_MAX_URI];	/* Resource from URI */
-  int		port;			/* Port number from URI */
-  http_trust_t	trust;			/* Trust evaluation for connection */
-  cups_array_t	*hcreds,		/* Credentials from connection */
-		*tcreds;		/* Credentials from trust store */
-  char		hinfo[1024],		/* String for connection credentials */
-		tinfo[1024],		/* String for trust store credentials */
-		datestr[256];		// Date string
-  static const char *trusts[] =		/* Trust strings */
-  { "OK", "Invalid", "Changed", "Expired", "Renewed", "Unknown" };
+static int	test_ca(const char *arg);
+static int	test_cacert(const char *arg);
+static int	test_cert(const char *arg);
+static int	test_client(const char *arg);
+static int	test_csr(const char *arg);
+static int	test_server(const char *arg);
+static int	test_show(const char *arg);
+static int	usage(FILE *fp);
 
 
- /*
-  * Check command-line...
-  */
+//
+// 'main()' - Main entry.
+//
 
-  if (argc != 2)
-  {
-    puts("Usage: ./testcreds hostname");
-    puts("       ./testcreds https://hostname[:port]");
-    return (1);
-  }
+int					// O - Exit status
+main(int  argc,				// I - Number of command-line arguments
+     char *argv[])			// I - Command-line arguments
+{
+  int		i;			// Looping var
+  const char	*subcommand = NULL,	// Sub-command
+		*arg = NULL,		// Argument for sub-command
+		*opt,			// Current option character
+		*root_name = NULL,	// Name of root certificate
+		*organization = NULL,	// Organization
+		*org_unit = NULL,	// Organizational unit
+		*locality = NULL,	// Locality
+		*state = NULL,		// State/province
+		*country = NULL,	// Country
+		*alt_names[100];	// Subject alternate names
+  size_t	num_alt_names = 0;
+  int		days;			// Days until expiration
+  cups_credpurpose_t purpose = CUPS_CREDPURPOSE_SERVER_AUTH;
+					// Certificate purpose
+  cups_credtype_t type = CUPS_CREDTYPE_DEFAULT;
+					// Certificate type
+  cups_credusage_t keyusage = CUPS_CREDUSAGE_DEFAULT_TLS;
+					// Key usage
 
-  if (!strncmp(argv[1], "https://", 8))
-  {
-   /*
-    * Connect to the host and validate credentials...
-    */
 
-    if (httpSeparateURI(HTTP_URI_CODING_MOST, argv[1], scheme, sizeof(scheme), username, sizeof(username), hostname, sizeof(hostname), &port, resource, sizeof(resource)) < HTTP_URI_STATUS_OK)
+  // Check command-line...
+  for (i = 1; i < argc; i ++)
+  {
+    if (!strcmp(argv[i], "--help"))
     {
-      printf("ERROR: Bad URI \"%s\".\n", argv[1]);
-      return (1);
+      return (usage(stdout));
     }
-
-    if ((http = httpConnect(hostname, port, NULL, AF_UNSPEC, HTTP_ENCRYPTION_ALWAYS, 1, 30000, NULL)) == NULL)
+    else if (!strncmp(argv[i], "--", 2))
     {
-      printf("ERROR: Unable to connect to \"%s\" on port %d: %s\n", hostname, port, cupsLastErrorString());
-      return (1);
+      fprintf(stderr, "testcreds: Unknown option '%s'.\n", argv[i]);
+      return (usage(stderr));
     }
-
-    puts("HTTP Credentials:");
-    if (httpCopyCredentials(http, &hcreds))
+    else if (argv[i][0] == '-')
     {
-      trust = httpCredentialsGetTrust(hcreds, hostname);
+      for (opt = argv[i] + 1; *opt; opt ++)
+      {
+        switch (*opt)
+        {
+          case 'C' : // -C COUNTRY
+              i ++;
+              if (i >= argc)
+              {
+                fputs("testcreds: Missing country after '-C'.\n", stderr);
+                return (usage(stderr));
+	      }
+	      country = argv[i];
+	      break;
+
+          case 'L' : // -L LOCALITY
+              i ++;
+              if (i >= argc)
+              {
+                fputs("testcreds: Missing locality/city/town after '-L'.\n", stderr);
+                return (usage(stderr));
+	      }
+	      locality = argv[i];
+	      break;
+
+          case 'O' : // -O ORGANIZATION
+              i ++;
+              if (i >= argc)
+              {
+                fputs("testcreds: Missing organization after '-O'.\n", stderr);
+                return (usage(stderr));
+	      }
+	      organization = argv[i];
+	      break;
+
+          case 'S' : // -S STATE
+              i ++;
+              if (i >= argc)
+              {
+                fputs("testcreds: Missing state/province after '-S'.\n", stderr);
+                return (usage(stderr));
+	      }
+	      state = argv[i];
+	      break;
 
-      httpCredentialsString(hcreds, hinfo, sizeof(hinfo));
+          case 'U' : // -U ORGANIZATIONAL-UNIT
+              i ++;
+              if (i >= argc)
+              {
+                fputs("testcreds: Missing organizational unit after '-U'.\n", stderr);
+                return (usage(stderr));
+	      }
+	      org_unit = argv[i];
+	      break;
 
-      printf("    Certificate Count: %u\n", (unsigned)cupsArrayGetCount(hcreds));
-      if (trust == HTTP_TRUST_OK)
-        puts("    Trust: OK");
-      else
-        printf("    Trust: %s (%s)\n", trusts[trust], cupsLastErrorString());
-      printf("    Expiration: %s\n", httpGetDateString(httpCredentialsGetExpiration(hcreds), datestr, sizeof(datestr)));
-      printf("    IsValidName: %s\n", httpCredentialsAreValidForName(hcreds, hostname) ? "true" : "false");
-      printf("    String: \"%s\"\n", hinfo);
+          case 'a' : // -a SUBJECT-ALT-NAME
+              i ++;
+              if (i >= argc)
+              {
+                fputs("testcreds: Missing subjectAltName after '-a'.\n", stderr);
+                return (usage(stderr));
+	      }
+	      if (num_alt_names >= (sizeof(alt_names) / sizeof(alt_names[0])))
+	      {
+	        fputs("testcreds: Too many subjectAltName values.\n", stderr);
+	        return (1);
+	      }
+	      alt_names[num_alt_names ++] = argv[i];
+	      break;
 
-      httpFreeCredentials(hcreds);
+          case 'd' : // -d DAYS
+              i ++;
+              if (i >= argc)
+              {
+                fputs("testcreds: Missing expiration days after '-d'.\n", stderr);
+                return (usage(stderr));
+	      }
+	      if ((days = atoi(argv[i])) <= 0)
+	      {
+	        fprintf(stderr, "testcreds: Bad DAYS value '%s' after '-d'.\n", argv[i]);
+	        return (1);
+	      }
+	      break;
+
+          case 'p' : // -p PURPOSE
+              i ++;
+              if (i >= argc)
+              {
+                fputs("testcreds: Missing purpose after '-p'.\n", stderr);
+                return (usage(stderr));
+	      }
+	      purpose = 0;
+	      if (strstr(argv[i], "serverAuth"))
+	        purpose |= CUPS_CREDPURPOSE_SERVER_AUTH;
+	      if (strstr(argv[i], "clientAuth"))
+	        purpose |= CUPS_CREDPURPOSE_CLIENT_AUTH;
+	      if (strstr(argv[i], "codeSigning"))
+	        purpose |= CUPS_CREDPURPOSE_CODE_SIGNING;
+	      if (strstr(argv[i], "emailProtection"))
+	        purpose |= CUPS_CREDPURPOSE_EMAIL_PROTECTION;
+	      if (strstr(argv[i], "timeStamping"))
+	        purpose |= CUPS_CREDPURPOSE_TIME_STAMPING;
+	      if (strstr(argv[i], "OCSPSigning"))
+	        purpose |= CUPS_CREDPURPOSE_OCSP_SIGNING;
+              if (purpose == 0)
+              {
+                fprintf(stderr, "testcreds: Bad purpose '%s'.\n", argv[i]);
+                return (usage(stderr));
+	      }
+	      break;
+
+          case 'r' : // -r ROOT-NAME
+              i ++;
+              if (i >= argc)
+              {
+                fputs("testcreds: Missing root name after '-r'.\n", stderr);
+                return (usage(stderr));
+	      }
+	      root_name = argv[i];
+	      break;
+
+          case 't' : // -t TYPE
+              i ++;
+              if (i >= argc)
+              {
+                fputs("testcreds: Missing certificate type after '-t'.\n", stderr);
+                return (usage(stderr));
+	      }
+	      if (!strcmp(argv[i], "default"))
+	      {
+	        type = CUPS_CREDTYPE_DEFAULT;
+	      }
+	      else if (!strcmp(argv[i], "rsa-2048"))
+	      {
+	        type = CUPS_CREDTYPE_RSA_2048_SHA256;
+	      }
+	      else if (!strcmp(argv[i], "rsa-3072"))
+	      {
+	        type = CUPS_CREDTYPE_RSA_3072_SHA256;
+	      }
+	      else if (!strcmp(argv[i], "rsa-4096"))
+	      {
+	        type = CUPS_CREDTYPE_RSA_4096_SHA256;
+	      }
+	      else if (!strcmp(argv[i], "ecdsa-p256"))
+	      {
+	        type = CUPS_CREDTYPE_ECDSA_P256_SHA256;
+	      }
+	      else if (!strcmp(argv[i], "ecdsa-p384"))
+	      {
+	        type = CUPS_CREDTYPE_ECDSA_P384_SHA256;
+	      }
+	      else if (!strcmp(argv[i], "ecdsa-p521"))
+	      {
+	        type = CUPS_CREDTYPE_ECDSA_P521_SHA256;
+	      }
+	      else
+	      {
+	        fprintf(stderr, "testcreds: Bad certificate type '%s'.\n", argv[i]);
+	        return (usage(stderr));
+	      }
+	      break;
+
+          case 'u' : // -u USAGE
+              i ++;
+              if (i >= argc)
+              {
+                fputs("testcreds: Missing key usage after '-u'.\n", stderr);
+                return (usage(stderr));
+	      }
+	      keyusage = 0;
+	      if (strstr(argv[i], "default-ca"))
+	        keyusage = CUPS_CREDUSAGE_DEFAULT_CA;
+	      if (strstr(argv[i], "default-tls"))
+	        keyusage = CUPS_CREDUSAGE_DEFAULT_TLS;
+	      if (strstr(argv[i], "digitalSignature"))
+	        keyusage |= CUPS_CREDUSAGE_DIGITAL_SIGNATURE;
+	      if (strstr(argv[i], "nonRepudiation"))
+	        keyusage |= CUPS_CREDUSAGE_NON_REPUDIATION;
+	      if (strstr(argv[i], "keyEncipherment"))
+	        keyusage |= CUPS_CREDUSAGE_KEY_ENCIPHERMENT;
+	      if (strstr(argv[i], "dataEncipherment"))
+	        keyusage |= CUPS_CREDUSAGE_DATA_ENCIPHERMENT;
+	      if (strstr(argv[i], "keyAgreement"))
+	        keyusage |= CUPS_CREDUSAGE_KEY_AGREEMENT;
+	      if (strstr(argv[i], "keyCertSign"))
+	        keyusage |= CUPS_CREDUSAGE_KEY_CERT_SIGN;
+	      if (strstr(argv[i], "cRLSign"))
+	        keyusage |= CUPS_CREDUSAGE_CRL_SIGN;
+	      if (strstr(argv[i], "encipherOnly"))
+	        keyusage |= CUPS_CREDUSAGE_ENCIPHER_ONLY;
+	      if (strstr(argv[i], "decipherOnly"))
+	        keyusage |= CUPS_CREDUSAGE_DECIPHER_ONLY;
+	      if (keyusage == 0)
+	      {
+	        fprintf(stderr, "testcreds: Bad key usage '%s'.\n", argv[i]);
+	        return (usage(stderr));
+	      }
+	      break;
+
+          default :
+              fprintf(stderr, "testcreds: Unknown option '-%c'.\n", *opt);
+              return (usage(stderr));
+	}
+      }
+    }
+    else if (!subcommand)
+    {
+      subcommand = argv[i];
+    }
+    else if (!arg)
+    {
+      arg = argv[i];
     }
     else
-      puts("    Not present (error).");
+    {
+      fprintf(stderr, "testcreds: Unknown option '%s'.\n", argv[i]);
+      return (usage(stderr));
+    }
+  }
+
+  if (!subcommand)
+  {
+    fputs("testcreds: Missing sub-command.\n", stderr);
+    return (usage(stderr));
+  }
+  else if (!arg)
+  {
+    fputs("testcreds: Missing sub-command argument.\n", stderr);
+    return (usage(stderr));
+  }
 
-    puts("");
+  // Run the corresponding sub-command...
+  if (!strcmp(subcommand, "ca"))
+  {
+    return (test_ca(arg));
+  }
+  else if (!strcmp(subcommand, "cacert"))
+  {
+    return (test_cacert(arg));
+  }
+  else if (!strcmp(subcommand, "cert"))
+  {
+    return (test_cert(arg));
+  }
+  else if (!strcmp(subcommand, "client"))
+  {
+    return (test_client(arg));
+  }
+  else if (!strcmp(subcommand, "csr"))
+  {
+    return (test_csr(arg));
+  }
+  else if (!strcmp(subcommand, "server"))
+  {
+    return (test_server(arg));
+  }
+  else if (!strcmp(subcommand, "show"))
+  {
+    return (test_show(arg));
   }
   else
   {
-   /*
-    * Load stored credentials...
-    */
+    fprintf(stderr, "testcreds: Unknown sub-command '%s'.\n", subcommand);
+    return (usage(stderr));
+  }
+}
+
+
+//
+// 'test_ca()' - Test generating a certificate from a CSR.
+//
+
+static int				// O - Exit status
+test_ca(const char *arg)		// I - Common name
+{
+  (void)arg;
+  return (1);
+}
+
+
+//
+// 'test_cacert()' - Test creating a CA certificate.
+//
+
+static int				// O - Exit status
+test_cacert(const char *arg)		// I - Common name
+{
+  (void)arg;
+  return (1);
+}
+
+
+//
+// 'test_cert()' - Test creating a self-signed certificate.
+//
+
+static int				// O - Exit status
+test_cert(const char *arg)		// I - Common name
+{
+  (void)arg;
+  return (1);
+}
+
+
+//
+// 'test_client()' - Test connecting to a HTTPS server.
+//
+
+static int				// O - Exit status
+test_client(const char *arg)		// I - URI
+{
+  http_t	*http;			// HTTP connection
+  char		scheme[HTTP_MAX_URI],	// Scheme from URI
+		hostname[HTTP_MAX_URI],	// Hostname from URI
+		username[HTTP_MAX_URI],	// Username:password from URI
+		resource[HTTP_MAX_URI];	// Resource from URI
+  int		port;			// Port number from URI
+  http_trust_t	trust;			// Trust evaluation for connection
+  cups_array_t	*hcreds,		// Credentials from connection
+		*tcreds;		// Credentials from trust store
+  char		hinfo[1024],		// String for connection credentials
+		tinfo[1024],		// String for trust store credentials
+		datestr[256];		// Date string
+  static const char *trusts[] =		// Trust strings
+  { "OK", "Invalid", "Changed", "Expired", "Renewed", "Unknown" };
+
+
+  // Connect to the host and validate credentials...
+  if (httpSeparateURI(HTTP_URI_CODING_MOST, arg, scheme, sizeof(scheme), username, sizeof(username), hostname, sizeof(hostname), &port, resource, sizeof(resource)) < HTTP_URI_STATUS_OK)
+  {
+    fprintf(stderr, "testcreds: Bad URI '%s'.\n", arg);
+    return (1);
+  }
+
+  if ((http = httpConnect(hostname, port, NULL, AF_UNSPEC, HTTP_ENCRYPTION_ALWAYS, 1, 30000, NULL)) == NULL)
+  {
+    fprintf(stderr, "testcreds: Unable to connect to '%s' on port %d: %s\n", hostname, port, cupsLastErrorString());
+    return (1);
+  }
+
+  puts("TLS Server Credentials:");
+  if (httpCopyCredentials(http, &hcreds))
+  {
+    trust = httpCredentialsGetTrust(hcreds, hostname);
+
+    httpCredentialsString(hcreds, hinfo, sizeof(hinfo));
+
+    printf("    Certificate Count: %u\n", (unsigned)cupsArrayGetCount(hcreds));
+    if (trust == HTTP_TRUST_OK)
+      puts("    Trust: OK");
+    else
+      printf("    Trust: %s (%s)\n", trusts[trust], cupsLastErrorString());
+    printf("    Expiration: %s\n", httpGetDateString(httpCredentialsGetExpiration(hcreds), datestr, sizeof(datestr)));
+    printf("    IsValidName: %s\n", httpCredentialsAreValidForName(hcreds, hostname) ? "true" : "false");
+    printf("    String: \"%s\"\n", hinfo);
 
-    cupsCopyString(hostname, argv[1], sizeof(hostname));
+    httpFreeCredentials(hcreds);
   }
+  else
+  {
+    puts("    Not present (error).");
+  }
+
+  puts("");
 
   printf("Trust Store for \"%s\":\n", hostname);
 
@@ -115,7 +482,82 @@ main(int  argc,				/* I - Number of command-line arguments */
     httpFreeCredentials(tcreds);
   }
   else
+  {
     puts("    Not present.");
+  }
 
   return (0);
 }
+
+
+//
+// 'test_csr()' - Test creating a certificate signing request.
+//
+
+static int				// O - Exit status
+test_csr(const char *arg)		// I - Common name
+{
+  (void)arg;
+  return (1);
+}
+
+
+//
+// 'test_server()' - Test running a server.
+//
+
+static int				// O - Exit status
+test_server(const char *arg)		// I - Hostname/port
+{
+  (void)arg;
+  return (1);
+}
+
+
+//
+// 'test_show()' - Test showing stored certificates.
+//
+
+static int				// O - Exit status
+test_show(const char *arg)		// I - Common name
+{
+  (void)arg;
+  return (1);
+}
+
+
+//
+// 'usage()' - Show program usage...
+//
+
+static int				// O - Exit code
+usage(FILE *fp)				// I - Output file (stdout or stderr)
+{
+  fputs("Usage: testcreds [OPTIONS] [SUB-COMMAND] [ARGUMENT]\n", fp);
+  fputs("\n", fp);
+  fputs("Sub-Commands:\n", fp);
+  fputs("\n", fp);
+  fputs("  ca COMMON-NAME             Sign a CSR to produce a certificate.\n", fp);
+  fputs("  cacert COMMON-NAME         Create a CA certificate.\n", fp);
+  fputs("  cert COMMON-NAME           Create a certificate.\n", fp);
+  fputs("  client URI                 Connect to URI.\n", fp);
+  fputs("  csr COMMON-NAME            Create a certificate signing request.\n", fp);
+  fputs("  server COMMON-NAME[:PORT]  Run a HTTPS server (default port 8NNN.)\n", fp);
+  fputs("  show COMMON-NAME           Show stored credentials for COMMON-NAME.\n", fp);
+  fputs("\n", fp);
+  fputs("Options:\n", fp);
+  fputs("\n", fp);
+  fputs("  -C COUNTRY                 Set country.\n", fp);
+  fputs("  -L LOCALITY                Set locality name.\n", fp);
+  fputs("  -O ORGANIZATION            Set organization name.\n", fp);
+  fputs("  -S STATE                   Set state.\n", fp);
+  fputs("  -U ORGANIZATIONAL-UNIT     Set organizational unit name.\n", fp);
+  fputs("  -a SUBJECT-ALT-NAME        Add a subjectAltName.\n", fp);
+  fputs("  -d DAYS                    Set expiration date in days.\n", fp);
+  fputs("  -p PURPOSE                 Comma-delimited certificate purpose (serverAuth, clientAuth, codeSigning, emailProtection, timeStamping, OCSPSigning)\n", fp);
+  fputs("  -r ROOT-NAME               Name of root certificate\n", fp);
+  fputs("  -t TYPE                    Certificate type (rsa-2048, rsa-3072, rsa-4096, ecdsa-p256, ecdsa-p384, ecdsa-p521)\n", fp);
+  fputs("  -u USAGE                   Comma-delimited key usage (digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly, default-ca, default-tls)\n", fp);
+
+  return (fp == stderr);
+}

From 101006e50c0981b67e412b7da18582517489a83e Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Sun, 7 May 2023 17:19:49 -0400
Subject: [PATCH 09/31] More cert test stuff.

---
 cups/testcreds.c | 220 +++++++++++++++++++++++++++++++++++------------
 1 file changed, 166 insertions(+), 54 deletions(-)

diff --git a/cups/testcreds.c b/cups/testcreds.c
index 43dc98c3a..31556afe7 100644
--- a/cups/testcreds.c
+++ b/cups/testcreds.c
@@ -44,19 +44,27 @@
 
 #include "cups-private.h"
 #include "test-internal.h"
+#include <sys/stat.h>
+
+
+//
+// Constants...
+//
+
+#define TEST_CERT_PATH	".testssl"
 
 
 //
 // Local functions...
 //
 
-static int	test_ca(const char *arg);
-static int	test_cacert(const char *arg);
-static int	test_cert(const char *arg);
-static int	test_client(const char *arg);
-static int	test_csr(const char *arg);
-static int	test_server(const char *arg);
-static int	test_show(const char *arg);
+static int	do_unit_tests(void);
+static int	test_ca(const char *common_name, const char *root_name, int days);
+static int	test_cert(bool ca_cert, cups_credpurpose_t purpose, cups_credtype_t type, cups_credusage_t keyusage, const char *organization, const char *org_unit, const char *locality, const char *state, const char *country, const char *root_name, const char *common_name, size_t num_alt_names, const char **alt_names, int days);
+static int	test_client(const char *uri);
+static int	test_csr(cups_credpurpose_t purpose, cups_credtype_t type, cups_credusage_t keyusage, const char *organization, const char *org_unit, const char *locality, const char *state, const char *country, const char *common_name, size_t num_alt_names, const char **alt_names);
+static int	test_server(const char *host_port);
+static int	test_show(const char *common_name);
 static int	usage(FILE *fp);
 
 
@@ -80,7 +88,7 @@ main(int  argc,				// I - Number of command-line arguments
 		*country = NULL,	// Country
 		*alt_names[100];	// Subject alternate names
   size_t	num_alt_names = 0;
-  int		days;			// Days until expiration
+  int		days = 0;		// Days until expiration
   cups_credpurpose_t purpose = CUPS_CREDPURPOSE_SERVER_AUTH;
 					// Certificate purpose
   cups_credtype_t type = CUPS_CREDTYPE_DEFAULT;
@@ -323,10 +331,14 @@ main(int  argc,				// I - Number of command-line arguments
     }
   }
 
+  // Make certificate directory
+  if (access(TEST_CERT_PATH, 0))
+    mkdir(TEST_CERT_PATH, 0700);
+
+  // Do unit tests or sub-command...
   if (!subcommand)
   {
-    fputs("testcreds: Missing sub-command.\n", stderr);
-    return (usage(stderr));
+    return (do_unit_tests());
   }
   else if (!arg)
   {
@@ -337,15 +349,15 @@ main(int  argc,				// I - Number of command-line arguments
   // Run the corresponding sub-command...
   if (!strcmp(subcommand, "ca"))
   {
-    return (test_ca(arg));
+    return (test_ca(arg, root_name, days));
   }
   else if (!strcmp(subcommand, "cacert"))
   {
-    return (test_cacert(arg));
+    return (test_cert(true, purpose, type, keyusage, organization, org_unit, locality, state, country, root_name, arg, num_alt_names, alt_names, days));
   }
   else if (!strcmp(subcommand, "cert"))
   {
-    return (test_cert(arg));
+    return (test_cert(false, purpose, type, keyusage, organization, org_unit, locality, state, country, root_name, arg, num_alt_names, alt_names, days));
   }
   else if (!strcmp(subcommand, "client"))
   {
@@ -353,7 +365,7 @@ main(int  argc,				// I - Number of command-line arguments
   }
   else if (!strcmp(subcommand, "csr"))
   {
-    return (test_csr(arg));
+    return (test_csr(purpose, type, keyusage, organization, org_unit, locality, state, country, arg, num_alt_names, alt_names));
   }
   else if (!strcmp(subcommand, "server"))
   {
@@ -372,25 +384,29 @@ main(int  argc,				// I - Number of command-line arguments
 
 
 //
-// 'test_ca()' - Test generating a certificate from a CSR.
+// 'do_unit_tests()' - Do unit tests.
 //
 
 static int				// O - Exit status
-test_ca(const char *arg)		// I - Common name
+do_unit_tests(void)
 {
-  (void)arg;
   return (1);
 }
 
 
 //
-// 'test_cacert()' - Test creating a CA certificate.
+// 'test_ca()' - Test generating a certificate from a CSR.
 //
 
 static int				// O - Exit status
-test_cacert(const char *arg)		// I - Common name
+test_ca(const char *common_name,	// I - Common name
+        const char *root_name,		// I - Root certificate name
+        int        days)		// I - Number of days
 {
-  (void)arg;
+  (void)common_name;
+  (void)root_name;
+  (void)days;
+
   return (1);
 }
 
@@ -400,10 +416,55 @@ test_cacert(const char *arg)		// I - Common name
 //
 
 static int				// O - Exit status
-test_cert(const char *arg)		// I - Common name
+test_cert(
+    bool               ca_cert,		// I - `true` for a CA certificate, `false` for a regular one
+    cups_credpurpose_t purpose,		// I - Certificate purpose
+    cups_credtype_t    type,		// I - Certificate type
+    cups_credusage_t   keyusage,	// I - Key usage
+    const char         *organization,	// I - Organization
+    const char         *org_unit,	// I - Organizational unit
+    const char         *locality,	// I - Locality (city/town/etc.)
+    const char         *state,		// I - State/province
+    const char         *country,	// I - Country
+    const char         *root_name,	// I - Root certificate name
+    const char         *common_name,	// I - Common name
+    size_t             num_alt_names,	// I - Number of subjectAltName's
+    const char         **alt_names,	// I - subjectAltName's
+    int                days)		// I - Number of days until expiration
 {
-  (void)arg;
-  return (1);
+  char	*cert,				// Certificate
+	*key;				// Private key
+
+
+  if (!cupsCreateCredentials(TEST_CERT_PATH, ca_cert, purpose, type, keyusage, organization, org_unit, locality, state, country, common_name, num_alt_names, alt_names, root_name, time(NULL) + days * 86400))
+  {
+    fprintf(stderr, "testcreds: Unable to create certificate (%s)\n", cupsLastErrorString());
+    return (1);
+  }
+
+  if ((cert = cupsCopyCredentials(TEST_CERT_PATH, common_name)) != NULL)
+  {
+    puts(cert);
+    free(cert);
+  }
+  else
+  {
+    fprintf(stderr, "testcreds: Unable to get generated certificate for '%s'.\n", common_name);
+    return (1);
+  }
+
+  if ((key = cupsCopyCredentialsKey(TEST_CERT_PATH, common_name)) != NULL)
+  {
+    puts(key);
+    free(key);
+  }
+  else
+  {
+    fprintf(stderr, "testcreds: Unable to get generated private key for '%s'.\n", common_name);
+    return (1);
+  }
+
+  return (0);
 }
 
 
@@ -412,7 +473,7 @@ test_cert(const char *arg)		// I - Common name
 //
 
 static int				// O - Exit status
-test_client(const char *arg)		// I - URI
+test_client(const char *uri)		// I - URI
 {
   http_t	*http;			// HTTP connection
   char		scheme[HTTP_MAX_URI],	// Scheme from URI
@@ -421,19 +482,17 @@ test_client(const char *arg)		// I - URI
 		resource[HTTP_MAX_URI];	// Resource from URI
   int		port;			// Port number from URI
   http_trust_t	trust;			// Trust evaluation for connection
-  cups_array_t	*hcreds,		// Credentials from connection
-		*tcreds;		// Credentials from trust store
+  cups_array_t	*hcreds;		// Credentials from connection
   char		hinfo[1024],		// String for connection credentials
-		tinfo[1024],		// String for trust store credentials
 		datestr[256];		// Date string
   static const char *trusts[] =		// Trust strings
   { "OK", "Invalid", "Changed", "Expired", "Renewed", "Unknown" };
 
 
   // Connect to the host and validate credentials...
-  if (httpSeparateURI(HTTP_URI_CODING_MOST, arg, scheme, sizeof(scheme), username, sizeof(username), hostname, sizeof(hostname), &port, resource, sizeof(resource)) < HTTP_URI_STATUS_OK)
+  if (httpSeparateURI(HTTP_URI_CODING_MOST, uri, scheme, sizeof(scheme), username, sizeof(username), hostname, sizeof(hostname), &port, resource, sizeof(resource)) < HTTP_URI_STATUS_OK)
   {
-    fprintf(stderr, "testcreds: Bad URI '%s'.\n", arg);
+    fprintf(stderr, "testcreds: Bad URI '%s'.\n", uri);
     return (1);
   }
 
@@ -468,22 +527,46 @@ test_client(const char *arg)		// I - URI
 
   puts("");
 
-  printf("Trust Store for \"%s\":\n", hostname);
+  return (test_show(hostname));
+}
 
-  if (httpLoadCredentials(NULL, &tcreds, hostname))
-  {
-    httpCredentialsString(tcreds, tinfo, sizeof(tinfo));
 
-    printf("    Certificate Count: %u\n", (unsigned)cupsArrayGetCount(tcreds));
-    printf("    Expiration: %s\n", httpGetDateString(httpCredentialsGetExpiration(tcreds), datestr, sizeof(datestr)));
-    printf("    IsValidName: %s\n", httpCredentialsAreValidForName(tcreds, hostname) ? "true" : "false");
-    printf("    String: \"%s\"\n", tinfo);
+//
+// 'test_csr()' - Test creating a certificate signing request.
+//
 
-    httpFreeCredentials(tcreds);
+static int				// O - Exit status
+test_csr(
+    cups_credpurpose_t purpose,		// I - Certificate purpose
+    cups_credtype_t    type,		// I - Certificate type
+    cups_credusage_t   keyusage,	// I - Key usage
+    const char         *organization,	// I - Organization
+    const char         *org_unit,	// I - Organizational unit
+    const char         *locality,	// I - Locality (city/town/etc.)
+    const char         *state,		// I - State/province
+    const char         *country,	// I - Country
+    const char         *common_name,	// I - Common name
+    size_t             num_alt_names,	// I - Number of subjectAltName's
+    const char         **alt_names)	// I - subjectAltName's
+{
+  char	*csr;				// Certificate request
+
+
+  if (!cupsCreateCredentialsRequest(TEST_CERT_PATH, purpose, type, keyusage, organization, org_unit, locality, state, country, common_name, num_alt_names, alt_names))
+  {
+    fprintf(stderr, "testcreds: Unable to create certificate request (%s)\n", cupsLastErrorString());
+    return (1);
+  }
+
+  if ((csr = cupsCopyCredentialsRequest(TEST_CERT_PATH, common_name)) != NULL)
+  {
+    puts(csr);
+    free(csr);
   }
   else
   {
-    puts("    Not present.");
+    fprintf(stderr, "testcreds: Unable to get generated certificate request for '%s'.\n", common_name);
+    return (1);
   }
 
   return (0);
@@ -491,25 +574,32 @@ test_client(const char *arg)		// I - URI
 
 
 //
-// 'test_csr()' - Test creating a certificate signing request.
+// 'test_server()' - Test running a server.
 //
 
 static int				// O - Exit status
-test_csr(const char *arg)		// I - Common name
+test_server(const char *host_port)	// I - Hostname/port
 {
-  (void)arg;
-  return (1);
-}
+  char	host[256],			// Hostname
+	*hostptr;			// Pointer into hostname
+  int	port;				// Port number
 
 
-//
-// 'test_server()' - Test running a server.
-//
+  cupsCopyString(host, host_port, sizeof(host));
+  if ((hostptr = strrchr(host, ':')) != NULL)
+  {
+    // Extract the port number from the argument...
+    *hostptr++ = '\0';
+    port       = atoi(hostptr);
+  }
+  else
+  {
+    // Use the default port 8NNN where NNN is the bottom 3 digits of the UID...
+    port = 8000 + (int)getuid() % 1000;
+  }
+
+  printf("Listening for connections on port %d...\n", port);
 
-static int				// O - Exit status
-test_server(const char *arg)		// I - Hostname/port
-{
-  (void)arg;
   return (1);
 }
 
@@ -519,10 +609,32 @@ test_server(const char *arg)		// I - Hostname/port
 //
 
 static int				// O - Exit status
-test_show(const char *arg)		// I - Common name
+test_show(const char *common_name)	// I - Common name
 {
-  (void)arg;
-  return (1);
+  cups_array_t	*tcreds;		// Credentials from trust store
+  char		tinfo[1024],		// String for trust store credentials
+		datestr[256];		// Date string
+
+
+  printf("Trust Store for \"%s\":\n", common_name);
+
+  if (httpLoadCredentials(NULL, &tcreds, common_name))
+  {
+    httpCredentialsString(tcreds, tinfo, sizeof(tinfo));
+
+    printf("    Certificate Count: %u\n", (unsigned)cupsArrayGetCount(tcreds));
+    printf("    Expiration: %s\n", httpGetDateString(httpCredentialsGetExpiration(tcreds), datestr, sizeof(datestr)));
+    printf("    IsValidName: %s\n", httpCredentialsAreValidForName(tcreds, common_name) ? "true" : "false");
+    printf("    String: \"%s\"\n", tinfo);
+
+    httpFreeCredentials(tcreds);
+  }
+  else
+  {
+    puts("    Not present.");
+  }
+
+  return (0);
 }
 
 

From 79d237d969927c3c587b2af0d9acb011247ae2ad Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Sun, 7 May 2023 18:01:32 -0400
Subject: [PATCH 10/31] Separate 'unittests' target, drop 'local' target.

---
 Makedefs.in       |  8 --------
 Makefile          | 13 ++++++++++++-
 configure         | 15 ---------------
 configure.ac      |  9 ---------
 cups/Makefile     |  7 +++++++
 doc/Makefile      |  9 ++++++++-
 examples/Makefile |  7 +++++++
 man/Makefile      |  8 ++++----
 tools/Makefile    |  9 ++++-----
 9 files changed, 42 insertions(+), 43 deletions(-)

diff --git a/Makedefs.in b/Makedefs.in
index a8edba1ef..8824d7981 100644
--- a/Makedefs.in
+++ b/Makedefs.in
@@ -49,14 +49,6 @@ INSTALL_LIB	=	$(INSTALL) -c -m 755
 INSTALL_MAN	=	$(INSTALL) -c -m 444
 
 
-#
-# Cross-compilation support: "local" target is used for any tools that are
-# built and run locally.
-#
-
-LOCALTARGET     =       @LOCALTARGET@
-
-
 #
 # Libraries...
 #
diff --git a/Makefile b/Makefile
index 2e8353f97..76acc66bc 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 #
 # Top-level Makefile for libcups.
 #
-# Copyright © 2020-2022 by OpenPrinting
+# Copyright © 2020-2023 by OpenPrinting
 #
 # Licensed under Apache License v2.0.  See the file "LICENSE" for more
 # information.
@@ -100,6 +100,17 @@ uninstall:
 	done
 
 
+#
+# Build all unit tests...
+#
+
+unittests:	all
+	for dir in $(DIRS); do\
+		echo "======== unittests in $$dir ========";\
+		(cd $$dir ; $(MAKE) $(MFLAGS) unittests) || exit 1;\
+	done
+
+
 #
 # Test everything...
 #
diff --git a/configure b/configure
index fb9c87b08..70b354830 100755
--- a/configure
+++ b/configure
@@ -684,7 +684,6 @@ CC
 OPTIM
 DSOFLAGS
 CODE_SIGN
-LOCALTARGET
 host_os
 host_vendor
 host_cpu
@@ -2558,20 +2557,6 @@ then :
 fi
 
 
-if test "$build" = "$host"
-then :
-
-    # No, build local targets
-    LOCALTARGET="local"
-
-else $as_nop
-
-    # Yes, don't build local targets
-    LOCALTARGET=""
-
-fi
-
-
 for ac_prog in codesign true
 do
   # Extract the first word of "$ac_prog", so it can be a program name with args.
diff --git a/configure.ac b/configure.ac
index f04930282..fba17aa9e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -46,15 +46,6 @@ AS_IF([test "x$host_os_version" = x], [
 
 
 dnl Determine whether we are cross-compiling...
-AS_IF([test "$build" = "$host"], [
-    # No, build local targets
-    LOCALTARGET="local"
-], [
-    # Yes, don't build local targets
-    LOCALTARGET=""
-])
-AC_SUBST([LOCALTARGET])
-
 AC_PATH_PROGS([CODE_SIGN], [codesign true])
 
 
diff --git a/cups/Makefile b/cups/Makefile
index 62d12b36a..c4a876a7f 100644
--- a/cups/Makefile
+++ b/cups/Makefile
@@ -218,6 +218,13 @@ fuzz:		$(UNITTARGETS)
 	AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=yes AFL_NO_UI=yes afl-fuzz -n -i json-afl-in -o json-afl-out -V 120  -- ./testjson 2>>fuzz.log
 
 
+#
+# Make unit tests...
+#
+
+unittests:	$(UNITTARGETS)
+
+
 #
 # Remove object and target files...
 #
diff --git a/doc/Makefile b/doc/Makefile
index 495a2ad8a..5d00c7da5 100644
--- a/doc/Makefile
+++ b/doc/Makefile
@@ -37,12 +37,19 @@ libs:
 
 
 #
-# Make unit tests...
+# Run unit tests...
 #
 
 test:
 
 
+#
+# Make unit tests...
+#
+
+unittests:
+
+
 #
 # Remove all generated files...
 #
diff --git a/examples/Makefile b/examples/Makefile
index bdda03ded..0f5395dd7 100644
--- a/examples/Makefile
+++ b/examples/Makefile
@@ -104,6 +104,13 @@ all:
 libs:
 
 
+#
+# Run unit tests...
+#
+
+test:
+
+
 #
 # Make unit tests...
 #
diff --git a/man/Makefile b/man/Makefile
index 355c302b0..1ca31e5ad 100644
--- a/man/Makefile
+++ b/man/Makefile
@@ -1,7 +1,7 @@
 #
 # Man page makefile for libcups.
 #
-# Copyright © 2021 by OpenPrinting.
+# Copyright © 2021-2023 by OpenPrinting.
 # Copyright © 2007-2019 by Apple Inc.
 # Copyright © 1993-2006 by Easy Software Products.
 #
@@ -33,7 +33,7 @@ all:		$(LOCALTARGET)
 
 
 #
-# Make unit tests...
+# Run unit tests...
 #
 
 test:
@@ -85,10 +85,10 @@ uninstall:
 
 
 #
-# Local programs (not built when cross-compiling...)
+# Unit test programs (not built when cross-compiling...)
 #
 
-local:
+unittests:
 
 
 #
diff --git a/tools/Makefile b/tools/Makefile
index af2eadc96..f1fac06a7 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -25,8 +25,7 @@ IPPTOOLS	=	\
 			ippfind \
 			ipptool
 TARGETS		=	\
-			$(IPPTOOLS) \
-			$(LOCALTARGET)
+			$(IPPTOOLS)
 
 
 #
@@ -100,17 +99,17 @@ uninstall:
 
 
 #
-# Local programs (not built when cross-compiling...)
+# Unit test programs (not built when cross-compiling...)
 #
 
-local:		ippeveprinter-static ippfind-static ipptool-static
+unittests:	ippeveprinter-static ippfind-static ipptool-static
 
 
 #
 # Test everything...
 #
 
-test:		local
+test:		unittests
 	./run-tests.sh
 
 

From 677e1bd60186491d7d035d53da7b88722a4dfdda Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Mon, 8 May 2023 08:56:12 -0400
Subject: [PATCH 11/31] Fix up subjectAltName support.

---
 cups/testcreds.c   | 2 +-
 cups/tls-openssl.c | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/cups/testcreds.c b/cups/testcreds.c
index 31556afe7..a71617377 100644
--- a/cups/testcreds.c
+++ b/cups/testcreds.c
@@ -88,7 +88,7 @@ main(int  argc,				// I - Number of command-line arguments
 		*country = NULL,	// Country
 		*alt_names[100];	// Subject alternate names
   size_t	num_alt_names = 0;
-  int		days = 0;		// Days until expiration
+  int		days = 365;		// Days until expiration
   cups_credpurpose_t purpose = CUPS_CREDPURPOSE_SERVER_AUTH;
 					// Certificate purpose
   cups_credtype_t type = CUPS_CREDTYPE_DEFAULT;
diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index 172e82f89..815e3bdab 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -1550,7 +1550,7 @@ openssl_create_san(
 
 
   // Add the common name
-  snprintf(temp, sizeof(temp), "dns:%s", common_name);
+  snprintf(temp, sizeof(temp), "DNS:%s", common_name);
   tempptr = temp + strlen(temp);
 
   if (strstr(common_name, ".local") == NULL)
@@ -1563,7 +1563,7 @@ openssl_create_san(
     if ((localptr = strchr(localname, '.')) != NULL)
       *localptr = '\0';
 
-    snprintf(tempptr, sizeof(temp) - (size_t)(tempptr - temp), ",dns:%s.local", localname);
+    snprintf(tempptr, sizeof(temp) - (size_t)(tempptr - temp), ",DNS:%s.local", localname);
     tempptr += strlen(tempptr);
   }
 
@@ -1572,7 +1572,7 @@ openssl_create_san(
   {
     if (strcmp(alt_names[i], "localhost"))
     {
-      snprintf(tempptr, sizeof(temp) - (size_t)(tempptr - temp), ",dns:%s", alt_names[i]);
+      snprintf(tempptr, sizeof(temp) - (size_t)(tempptr - temp), ",DNS:%s", alt_names[i]);
       tempptr += strlen(tempptr);
     }
   }

From 2d570f332d944ee406f9e12313f5519bed9c45f3 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Mon, 8 May 2023 08:58:19 -0400
Subject: [PATCH 12/31] Don't use _cupsStrAlloc for globals - causes recursion.

---
 cups/cups-private.h | 4 ++--
 cups/globals.c      | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/cups/cups-private.h b/cups/cups-private.h
index 4584c531e..6822d017f 100644
--- a/cups/cups-private.h
+++ b/cups/cups-private.h
@@ -76,8 +76,8 @@ typedef struct _cups_globals_s		/**** CUPS global state data ****/
 {
   /* Multiple places... */
   const char		*datadir,	// Data directory (CUPS_DATADIR environment var)
-			*sysconfig,	// System config files (CUPS_SERVERROOT environment var)
-			*userconfig;	// User-specific config files (various environment vars)
+			*sysconfig;	// System config files (CUPS_SERVERROOT environment var)
+  char			*userconfig;	// User-specific config files
 #ifndef _WIN32
 #define PW_BUF_SIZE 16384		/* As per glibc manual page */
   char			pw_buf[PW_BUF_SIZE];
diff --git a/cups/globals.c b/cups/globals.c
index f9400ad0a..949120962 100644
--- a/cups/globals.c
+++ b/cups/globals.c
@@ -360,7 +360,8 @@ cups_globals_alloc(void)
   }
 #  endif // __APPLE__
 
-  cg->userconfig = _cupsStrAlloc(temp);
+  // Can't use _cupsStrAlloc since it causes a loop with debug logging enabled
+  cg->userconfig = strdup(temp);
 #endif // _WIN32
 
   return (cg);
@@ -393,14 +394,13 @@ cups_globals_free(_cups_globals_t *cg)	// I - Pointer to global data
 
   httpClose(cg->http);
 
-#ifdef HAVE_TLS
   _httpFreeCredentials(cg->tls_credentials);
-#endif // HAVE_TLS
 
   cupsFileClose(cg->stdio_files[0]);
   cupsFileClose(cg->stdio_files[1]);
   cupsFileClose(cg->stdio_files[2]);
 
+  free(cg->userconfig);
   free(cg->raster_error.start);
   free(cg);
 }

From db2cd3db47f211b10eb4639f54daaff44cf62af2 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Wed, 10 May 2023 19:07:04 -0400
Subject: [PATCH 13/31] Fix testpwg.

---
 configure                                     |  29 +-
 configure.ac                                  |  13 +-
 cups/Makefile                                 |   9 +-
 cups/pwg-media.c                              |  18 +-
 cups/testpwg.c                                | 638 ++++--------------
 xcode/libcups.xcodeproj/project.pbxproj       |  15 +-
 .../xcshareddata/xcschemes/Tests.xcscheme     |   2 +-
 .../xcshareddata/xcschemes/fuzzipp.xcscheme   |   2 +-
 .../xcshareddata/xcschemes/ippevepcl.xcscheme |   2 +-
 .../xcshareddata/xcschemes/ippeveps.xcscheme  |   2 +-
 .../xcshareddata/xcschemes/libcups.xcscheme   |   2 +-
 .../xcshareddata/xcschemes/testcreds.xcscheme |   2 +-
 .../xcshareddata/xcschemes/testlang.xcscheme  |   2 +-
 .../xcshareddata/xcschemes/testpwg.xcscheme   |   2 +-
 .../xcschemes/testtestpage.xcscheme           |   2 +-
 15 files changed, 188 insertions(+), 552 deletions(-)

diff --git a/configure b/configure
index 70b354830..c16cb2bc1 100755
--- a/configure
+++ b/configure
@@ -744,7 +744,7 @@ enable_static
 enable_shared
 enable_debug
 enable_maintainer
-enable_sanitizer
+with_sanitizer
 with_dsoflags
 with_ldflags
 with_domainsocket
@@ -1385,13 +1385,14 @@ Optional Features:
   --disable-shared        do not install shared library
   --enable-debug          turn on debugging, default=no
   --enable-maintainer     turn on maintainer mode, default=no
-  --enable-sanitizer      build with AddressSanitizer, default=no
 
 Optional Packages:
   --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
   --without-PACKAGE       do not use PACKAGE (same as --with-PACKAGE=no)
   --with-dnssd=LIBRARY    set DNS-SD library (auto, avahi, mdnsresponder)
   --with-tls=...          use gnutls or openssl/libressl for TLS support
+  --with-sanitizer        build with address, leak, memory, thread, or
+                          undefined sanitizer, default=no
   --with-dsoflags=...     Specify additional DSOFLAGS
   --with-ldflags=...      Specify additional LDFLAGS
   --with-domainsocket     set unix domain socket name
@@ -5202,12 +5203,24 @@ then :
   enableval=$enable_maintainer;
 fi
 
-# Check whether --enable-sanitizer was given.
-if test ${enable_sanitizer+y}
+
+# Check whether --with-sanitizer was given.
+if test ${with_sanitizer+y}
 then :
-  enableval=$enable_sanitizer;
+  withval=$with_sanitizer;
 fi
 
+if test "x$with_sanitizer" = x
+then :
+
+    with_sanitizer="address"
+
+elif test "$with_sanitizer" != address -a "$with_sanitizer" != leak -a "$with_sanitizer" != memory -a "$with_sanitizer" != no -a "$with_sanitizer" != thread -a "$with_sanitizer" != undefined
+then :
+
+    as_fn_error $? "Unsupported --with-sanitizer value \"$with_sanitizer\" specified." "$LINENO" 5
+
+fi
 
 if test x$enable_debug = xyes
 then :
@@ -5233,11 +5246,11 @@ WARNINGS=""
 if test -n "$GCC"
 then :
 
-    if test x$enable_sanitizer = xyes
+    if test x$with_sanitizer != xno
 then :
 
-	# Use -fsanitize=address with debugging...
-	OPTIM="$OPTIM -fsanitize=address"
+	# Use -fsanitize=FOO with debugging...
+	OPTIM="$OPTIM -fsanitize=$with_sanitizer"
 
 elif echo "$CPPFLAGS $CFLAGS" | grep -q _FORTIFY_SOURCE
 then :
diff --git a/configure.ac b/configure.ac
index fba17aa9e..899e31c62 100644
--- a/configure.ac
+++ b/configure.ac
@@ -454,7 +454,12 @@ AC_SUBST([LIBCUPS_STATIC])
 dnl Extra compiler options...
 AC_ARG_ENABLE([debug], AS_HELP_STRING([--enable-debug], [turn on debugging, default=no]))
 AC_ARG_ENABLE([maintainer], AS_HELP_STRING([--enable-maintainer], [turn on maintainer mode, default=no]))
-AC_ARG_ENABLE([sanitizer], AS_HELP_STRING([--enable-sanitizer], [build with AddressSanitizer, default=no]))
+AC_ARG_WITH([sanitizer], AS_HELP_STRING([--with-sanitizer], [build with address, leak, memory, thread, or undefined sanitizer, default=no]))
+AS_IF([test "x$with_sanitizer" = x], [
+    with_sanitizer="address"
+], [test "$with_sanitizer" != address -a "$with_sanitizer" != leak -a "$with_sanitizer" != memory -a "$with_sanitizer" != no -a "$with_sanitizer" != thread -a "$with_sanitizer" != undefined], [
+    AC_MSG_ERROR([Unsupported --with-sanitizer value "$with_sanitizer" specified.])
+])
 
 AS_IF([test x$enable_debug = xyes], [
     CSFLAGS=""
@@ -473,9 +478,9 @@ WARNINGS=""
 AC_SUBST([WARNINGS])
 
 AS_IF([test -n "$GCC"], [
-    AS_IF([test x$enable_sanitizer = xyes], [
-	# Use -fsanitize=address with debugging...
-	OPTIM="$OPTIM -fsanitize=address"
+    AS_IF([test x$with_sanitizer != xno], [
+	# Use -fsanitize=FOO with debugging...
+	OPTIM="$OPTIM -fsanitize=$with_sanitizer"
     ], [echo "$CPPFLAGS $CFLAGS" | grep -q _FORTIFY_SOURCE], [
         # Don't add _FORTIFY_SOURCE if it is already there
     ], [
diff --git a/cups/Makefile b/cups/Makefile
index c4a876a7f..9d44aa5d3 100644
--- a/cups/Makefile
+++ b/cups/Makefile
@@ -74,6 +74,7 @@ TESTOBJS	= \
 		testjson.o \
 		testjwt.o \
 		testoptions.o \
+		testpwg.o \
 		testraster.o \
 		testtestpage.o \
 		testthreads.o \
@@ -83,7 +84,6 @@ OBJS	=	\
 		$(TESTOBJS)
 
 #		testlang.o \
-#		testpwg.o \
 
 
 #
@@ -156,13 +156,13 @@ UNITTARGETS =	\
 		testjson \
 		testjwt \
 		testoptions \
+		testpwg \
 		testraster \
 		testtestpage \
 		testthreads \
 		tlscheck
 
 #		testlang \
-#		testpwg \
 
 TARGETS	=	\
 		$(LIBTARGETS)
@@ -181,6 +181,7 @@ all:		$(TARGETS)
 
 test:		$(UNITTARGETS)
 	rm -f test.log
+	date >test.log
 	echo Running array API tests...
 	./testarray 2>>test.log
 #	if test `uname` != Darwin; then \
@@ -207,6 +208,8 @@ test:		$(UNITTARGETS)
 	./testjwt 2>>test.log
 	echo Running option API tests...
 	./testoptions 2>>test.log
+	echo Running PWG API tests...
+	./testpwg 2>>test.log
 	echo Running raster API tests...
 	./testraster 2>>test.log
 	./testtestpage 2>>test.log
@@ -579,8 +582,6 @@ testpwg:	testpwg.o $(LIBCUPS_STATIC) test.ppd
 	echo Linking $@...
 	$(CC) $(LDFLAGS) $(OPTIM) -o $@ testpwg.o $(LIBCUPS_STATIC) $(LIBS)
 	$(CODE_SIGN) $(CSFLAGS) $@
-	echo Running PWG API tests...
-	./testpwg test.ppd
 
 
 #
diff --git a/cups/pwg-media.c b/cups/pwg-media.c
index 4d329b606..42cb91d35 100644
--- a/cups/pwg-media.c
+++ b/cups/pwg-media.c
@@ -1,7 +1,7 @@
 /*
  * PWG media name API implementation for CUPS.
  *
- * Copyright © 2022 by OpenPrinting.
+ * Copyright © 2022-2023 by OpenPrinting.
  * Copyright © 2009-2019 by Apple Inc.
  *
  * Licensed under Apache License v2.0.  See the file "LICENSE" for more
@@ -970,16 +970,18 @@ pwg_format_inches(char   *buf,		// I - Buffer
                   size_t bufsize,	// I - Size of buffer
                   int    val)		// I - Value in hundredths of millimeters
 {
-  int	thousandths,			// Thousandths of inches
-	integer,			// Integer portion
+  int	integer,			// Integer portion
 	fraction;			// Fractional portion
 
 
-  // Convert hundredths of millimeters to thousandths of inches and round to
-  // the nearest thousandth.
-  thousandths = (val * 1000 + 1270) / 2540;
-  integer     = thousandths / 1000;
-  fraction    = thousandths % 1000;
+  // Convert hundredths of millimeters to inches and thousandths.
+  integer  = val / 2540;
+  fraction = ((val % 2540) * 1000 + 1270) / 2540;
+  if (fraction >= 1000)
+  {
+    integer ++;
+    fraction -= 1000;
+  }
 
   // Format as a pair of integers (avoids locale stuff), avoiding trailing zeros...
   if (fraction == 0)
diff --git a/cups/testpwg.c b/cups/testpwg.c
index 6473c8cf9..feacdb1e0 100644
--- a/cups/testpwg.c
+++ b/cups/testpwg.c
@@ -1,565 +1,167 @@
-/*
- * PWG unit test program for CUPS.
- *
- * Copyright 2009-2016 by Apple Inc.
- *
- * Licensed under Apache License v2.0.  See the file "LICENSE" for more information.
- */
+//
+// PWG unit test program for CUPS.
+//
+// Copyright © 2023 by OpenPrinting.
+// Copyright © 2009-2016 by Apple Inc.
+//
+// Licensed under Apache License v2.0.  See the file "LICENSE" for more information.
+//
 
 /*
  * Include necessary headers...
  */
 
-#include "ppd-private.h"
-#include "file-private.h"
-
-
-/*
- * Local functions...
- */
+#include "cups.h"
+#include "pwg-private.h"
+#include "test-internal.h"
+#include <ctype.h>
 
-static int	test_pagesize(_ppd_cache_t *pc, ppd_file_t *ppd,
-		              const char *ppdsize);
-static int	test_ppd_cache(_ppd_cache_t *pc, ppd_file_t *ppd);
 
+//
+// 'main()' - Main entry.
+//
 
-/*
- * 'main()' - Main entry.
- */
-
-int					/* O - Exit status */
-main(int  argc,				/* I - Number of command-line args */
-     char *argv[])			/* I - Command-line arguments */
+int					// O - Exit status
+main(int  argc,				// I - Number of command-line args
+     char *argv[])			// I - Command-line arguments
 {
-  int			status;		/* Status of tests (0 = success, 1 = fail) */
-  const char		*ppdfile;	/* PPD filename */
-  ppd_file_t		*ppd;		/* PPD file */
-  _ppd_cache_t		*pc;		/* PPD cache and PWG mapping data */
-  const pwg_media_t	*pwgmedia;	/* PWG media size */
-  size_t		i,		/* Looping var */
-			num_media;	/* Number of media sizes */
-  const pwg_media_t	*mediatable;	/* Media size table */
-  int			dupmedia = 0;	/* Duplicate media sizes? */
-
-
-  status = 0;
+  const pwg_media_t *pwg;		// PWG media size
+  size_t	i,			// Looping var
+		num_media;		// Number of media sizes
+  const pwg_media_t *mediatable;	// Media size table
 
-  if (argc < 2 || argc > 3)
-  {
-    puts("Usage: ./testpwg filename.ppd [jobfile]");
-    return (1);
-  }
-
-  ppdfile = argv[1];
-
-  printf("ppdOpenFile(%s): ", ppdfile);
-  if ((ppd = ppdOpenFile(ppdfile)) == NULL)
-  {
-    ppd_status_t err;			/* Last error in file */
-    int		line;			/* Line number in file */
-
-
-    err = ppdLastError(&line);
-
-    printf("FAIL (%s on line %d)\n", ppdErrorString(err), line);
-
-    return (1);
-  }
-  else
-    puts("PASS");
 
-  fputs("_ppdCacheCreateWithPPD(ppd): ", stdout);
-  if ((pc = _ppdCacheCreateWithPPD(ppd)) == NULL)
-  {
-    puts("FAIL");
-    status ++;
-  }
-  else
+  if (argc > 1)
   {
-    puts("PASS");
-    status += test_ppd_cache(pc, ppd);
+    // Decode media sizes...
+    int	j;				// Looping var
 
-    if (argc == 3)
+    for (j = 1; j < argc; j ++)
     {
-     /*
-      * Test PageSize mapping code.
-      */
-
-      int		fd;		/* Job file descriptor */
-      const char	*pagesize;	/* PageSize value */
-      ipp_t		*job;		/* Job attributes */
-      ipp_attribute_t	*media;		/* Media attribute */
+      int	width, length;		// Width and length
 
-      if ((fd = open(argv[2], O_RDONLY)) >= 0)
-      {
-	job = ippNew();
-	ippReadFile(fd, job);
-	close(fd);
+      if (isdigit(argv[j][0] & 255) && sscanf(argv[j], "%d,%d", &width, &length) == 2)
+        pwg = pwgMediaForSize(width, length);
+      else if ((pwg = pwgMediaForLegacy(argv[j])) == NULL)
+        pwg = pwgMediaForPWG(argv[j]);
 
-        if ((media = ippFindAttribute(job, "media", IPP_TAG_ZERO)) != NULL &&
-	    media->value_tag != IPP_TAG_NAME &&
-	    media->value_tag != IPP_TAG_KEYWORD)
-	  media = NULL;
-
-	if (media)
-	  printf("_ppdCacheGetPageSize(media=%s): ",
-	         media->values[0].string.text);
-	else
-	  fputs("_ppdCacheGetPageSize(media-col): ", stdout);
-
-        fflush(stdout);
-
-	if ((pagesize = _ppdCacheGetPageSize(pc, job, NULL, NULL)) == NULL)
-	{
-	  puts("FAIL (Not Found)");
-	  status = 1;
-	}
-	else if (media && _cups_strcasecmp(pagesize, media->values[0].string.text))
-	{
-	  printf("FAIL (Got \"%s\", Expected \"%s\")\n", pagesize,
-		 media->values[0].string.text);
-	  status = 1;
-	}
-	else
-	  printf("PASS (%s)\n", pagesize);
-
-	ippDelete(job);
-      }
+      if (pwg)
+        printf("%s = %s (%.2fx%.2fmm", argv[j], pwg->pwg, pwg->width * 0.01, pwg->length * 0.01);
       else
-      {
-        perror(argv[2]);
-	status = 1;
-      }
+        printf("%s = BAD\n", argv[j]);
     }
 
-   /*
-    * _ppdCacheDestroy should never fail...
-    */
-
-    fputs("_ppdCacheDestroy(pc): ", stdout);
-    _ppdCacheDestroy(pc);
-    puts("PASS");
+    return (0);
   }
 
-  fputs("pwgMediaForPWG(\"iso_a4_210x297mm\"): ", stdout);
-  if ((pwgmedia = pwgMediaForPWG("iso_a4_210x297mm")) == NULL)
-  {
-    puts("FAIL (not found)");
-    status ++;
-  }
-  else if (strcmp(pwgmedia->pwg, "iso_a4_210x297mm"))
-  {
-    printf("FAIL (%s)\n", pwgmedia->pwg);
-    status ++;
-  }
-  else if (pwgmedia->width != 21000 || pwgmedia->length != 29700)
-  {
-    printf("FAIL (%dx%d)\n", pwgmedia->width, pwgmedia->length);
-    status ++;
-  }
+  testBegin("pwgMediaForPWG(\"iso_a4_210x297mm\")");
+  if ((pwg = pwgMediaForPWG("iso_a4_210x297mm")) == NULL)
+    testEndMessage(false, "not found");
+  else if (strcmp(pwg->pwg, "iso_a4_210x297mm"))
+    testEndMessage(false, "%s", pwg->pwg);
+  else if (pwg->width != 21000 || pwg->length != 29700)
+    testEndMessage(false, "%dx%d", pwg->width, pwg->length);
   else
-    puts("PASS");
+    testEnd(true);
 
-  fputs("pwgMediaForPWG(\"roll_max_36.1025x3622.0472in\"): ", stdout);
-  if ((pwgmedia = pwgMediaForPWG("roll_max_36.1025x3622.0472in")) == NULL)
-  {
-    puts("FAIL (not found)");
-    status ++;
-  }
-  else if (pwgmedia->width != 91700 || pwgmedia->length != 9199999)
-  {
-    printf("FAIL (%dx%d)\n", pwgmedia->width, pwgmedia->length);
-    status ++;
-  }
+  testBegin("pwgMediaForPWG(\"roll_max_36.1025x3622.0472in\")");
+  if ((pwg = pwgMediaForPWG("roll_max_36.1025x3622.0472in")) == NULL)
+    testEndMessage(false, "not found");
+  else if (pwg->width != 91700 || pwg->length != 9199999)
+    testEndMessage(false, "%dx%d", pwg->width, pwg->length);
   else
-    printf("PASS (%dx%d)\n", pwgmedia->width, pwgmedia->length);
+    testEndMessage(true, "%dx%d", pwg->width, pwg->length);
 
-  fputs("pwgMediaForPWG(\"disc_test_10x100mm\"): ", stdout);
-  if ((pwgmedia = pwgMediaForPWG("disc_test_10x100mm")) == NULL)
-  {
-    puts("FAIL (not found)");
-    status ++;
-  }
-  else if (pwgmedia->width != 10000 || pwgmedia->length != 10000)
-  {
-    printf("FAIL (%dx%d)\n", pwgmedia->width, pwgmedia->length);
-    status ++;
-  }
+  testBegin("pwgMediaForPWG(\"disc_test_10x100mm\")");
+  if ((pwg = pwgMediaForPWG("disc_test_10x100mm")) == NULL)
+    testEndMessage(false, "not found");
+  else if (pwg->width != 10000 || pwg->length != 10000)
+    testEndMessage(false, "%dx%d", pwg->width, pwg->length);
   else
-    printf("PASS (%dx%d)\n", pwgmedia->width, pwgmedia->length);
-
-  fputs("pwgMediaForLegacy(\"na-letter\"): ", stdout);
-  if ((pwgmedia = pwgMediaForLegacy("na-letter")) == NULL)
-  {
-    puts("FAIL (not found)");
-    status ++;
-  }
-  else if (strcmp(pwgmedia->pwg, "na_letter_8.5x11in"))
-  {
-    printf("FAIL (%s)\n", pwgmedia->pwg);
-    status ++;
-  }
-  else if (pwgmedia->width != 21590 || pwgmedia->length != 27940)
-  {
-    printf("FAIL (%dx%d)\n", pwgmedia->width, pwgmedia->length);
-    status ++;
-  }
+    testEndMessage(true, "%dx%d", pwg->width, pwg->length);
+
+  testBegin("pwgMediaForLegacy(\"na-letter\")");
+  if ((pwg = pwgMediaForLegacy("na-letter")) == NULL)
+    testEndMessage(false, "not found");
+  else if (strcmp(pwg->pwg, "na_letter_8.5x11in"))
+    testEndMessage(false, "%s", pwg->pwg);
+  else if (pwg->width != 21590 || pwg->length != 27940)
+    testEndMessage(false, "%dx%d", pwg->width, pwg->length);
   else
-    puts("PASS");
-
-  fputs("pwgMediaForPPD(\"4x6\"): ", stdout);
-  if ((pwgmedia = pwgMediaForPPD("4x6")) == NULL)
-  {
-    puts("FAIL (not found)");
-    status ++;
-  }
-  else if (strcmp(pwgmedia->pwg, "na_index-4x6_4x6in"))
-  {
-    printf("FAIL (%s)\n", pwgmedia->pwg);
-    status ++;
-  }
-  else if (pwgmedia->width != 10160 || pwgmedia->length != 15240)
-  {
-    printf("FAIL (%dx%d)\n", pwgmedia->width, pwgmedia->length);
-    status ++;
-  }
+    testEnd(true);
+
+  testBegin("pwgMediaForPPD(\"4x6\")");
+  if ((pwg = pwgMediaForPPD("4x6")) == NULL)
+    testEndMessage(false, "not found");
+  else if (strcmp(pwg->pwg, "na_index-4x6_4x6in"))
+    testEndMessage(false, "%s", pwg->pwg);
+  else if (pwg->width != 10160 || pwg->length != 15240)
+    testEndMessage(false, "%dx%d", pwg->width, pwg->length);
   else
-    puts("PASS");
-
-  fputs("pwgMediaForPPD(\"10x15cm\"): ", stdout);
-  if ((pwgmedia = pwgMediaForPPD("10x15cm")) == NULL)
-  {
-    puts("FAIL (not found)");
-    status ++;
-  }
-  else if (strcmp(pwgmedia->pwg, "om_100x150mm_100x150mm"))
-  {
-    printf("FAIL (%s)\n", pwgmedia->pwg);
-    status ++;
-  }
-  else if (pwgmedia->width != 10000 || pwgmedia->length != 15000)
-  {
-    printf("FAIL (%dx%d)\n", pwgmedia->width, pwgmedia->length);
-    status ++;
-  }
+    testEnd(true);
+
+  testBegin("pwgMediaForPPD(\"10x15cm\")");
+  if ((pwg = pwgMediaForPPD("10x15cm")) == NULL)
+    testEndMessage(false, "not found");
+  else if (strcmp(pwg->pwg, "om_100x150mm_100x150mm"))
+    testEndMessage(false, "%s", pwg->pwg);
+  else if (pwg->width != 10000 || pwg->length != 15000)
+    testEndMessage(false, "%dx%d", pwg->width, pwg->length);
   else
-    puts("PASS");
-
-  fputs("pwgMediaForPPD(\"Custom.10x15cm\"): ", stdout);
-  if ((pwgmedia = pwgMediaForPPD("Custom.10x15cm")) == NULL)
-  {
-    puts("FAIL (not found)");
-    status ++;
-  }
-  else if (strcmp(pwgmedia->pwg, "custom_10x15cm_100x150mm"))
-  {
-    printf("FAIL (%s)\n", pwgmedia->pwg);
-    status ++;
-  }
-  else if (pwgmedia->width != 10000 || pwgmedia->length != 15000)
-  {
-    printf("FAIL (%dx%d)\n", pwgmedia->width, pwgmedia->length);
-    status ++;
-  }
+    testEnd(true);
+
+  testBegin("pwgMediaForPPD(\"Custom.10x15cm\")");
+  if ((pwg = pwgMediaForPPD("Custom.10x15cm")) == NULL)
+    testEndMessage(false, "not found");
+  else if (strcmp(pwg->pwg, "custom_10x15cm_100x150mm"))
+    testEndMessage(false, "%s", pwg->pwg);
+  else if (pwg->width != 10000 || pwg->length != 15000)
+    testEndMessage(false, "%dx%d", pwg->width, pwg->length);
   else
-    puts("PASS");
+    testEnd(true);
 
-  fputs("pwgMediaForSize(29700, 42000): ", stdout);
-  if ((pwgmedia = pwgMediaForSize(29700, 42000)) == NULL)
-  {
-    puts("FAIL (not found)");
-    status ++;
-  }
-  else if (strcmp(pwgmedia->pwg, "iso_a3_297x420mm"))
-  {
-    printf("FAIL (%s)\n", pwgmedia->pwg);
-    status ++;
-  }
+  testBegin("pwgMediaForSize(29700, 42000)");
+  if ((pwg = pwgMediaForSize(29700, 42000)) == NULL)
+    testEndMessage(false, "not found");
+  else if (strcmp(pwg->pwg, "iso_a3_297x420mm"))
+    testEndMessage(false, "%s", pwg->pwg);
   else
-    puts("PASS");
+    testEnd(true);
 
-  fputs("pwgMediaForSize(9842, 19050): ", stdout);
-  if ((pwgmedia = pwgMediaForSize(9842, 19050)) == NULL)
-  {
-    puts("FAIL (not found)");
-    status ++;
-  }
-  else if (strcmp(pwgmedia->pwg, "na_monarch_3.875x7.5in"))
-  {
-    printf("FAIL (%s)\n", pwgmedia->pwg);
-    status ++;
-  }
+  testBegin("pwgMediaForSize(9842, 19050)");
+  if ((pwg = pwgMediaForSize(9842, 19050)) == NULL)
+    testEndMessage(false, "not found");
+  else if (strcmp(pwg->pwg, "na_monarch_3.875x7.5in"))
+    testEndMessage(false, "%s", pwg->pwg);
   else
-    printf("PASS (%s)\n", pwgmedia->pwg);
+    testEndMessage(true, "%s", pwg->pwg);
 
-  fputs("pwgMediaForSize(9800, 19000): ", stdout);
-  if ((pwgmedia = pwgMediaForSize(9800, 19000)) == NULL)
-  {
-    puts("FAIL (not found)");
-    status ++;
-  }
-  else if (strcmp(pwgmedia->pwg, "jpn_you6_98x190mm"))
-  {
-    printf("FAIL (%s)\n", pwgmedia->pwg);
-    status ++;
-  }
+  testBegin("pwgMediaForSize(9800, 19000)");
+  if ((pwg = pwgMediaForSize(9800, 19000)) == NULL)
+    testEndMessage(false, "not found");
+  else if (strcmp(pwg->pwg, "jpn_you6_98x190mm"))
+    testEndMessage(false, "%s", pwg->pwg);
   else
-    printf("PASS (%s)\n", pwgmedia->pwg);
+    testEndMessage(true, "%s", pwg->pwg);
 
-  fputs("Duplicate size test: ", stdout);
-  for (mediatable = _pwgMediaTable(&num_media);
-       num_media > 1;
-       num_media --, mediatable ++)
+  testBegin("Duplicate size test");
+  for (mediatable = _pwgMediaTable(&num_media); num_media > 1; num_media --, mediatable ++)
   {
-    for (i = num_media - 1, pwgmedia = mediatable + 1; i > 0; i --, pwgmedia ++)
+    for (i = num_media - 1, pwg = mediatable + 1; i > 0; i --, pwg ++)
     {
-      if (pwgmedia->width == mediatable->width &&
-          pwgmedia->length == mediatable->length)
+      if (pwg->width == mediatable->width && pwg->length == mediatable->length)
       {
-        if (!dupmedia)
-        {
-          dupmedia = 1;
-          status ++;
-          puts("FAIL");
-        }
-
-        printf("    %s and %s have the same dimensions (%dx%d)\n",
-               pwgmedia->pwg, mediatable->pwg, pwgmedia->width,
-               pwgmedia->length);
+	testEndMessage(false, "%s and %s have the same dimensions (%dx%d)", pwg->pwg, mediatable->pwg, pwg->width, pwg->length);
+	break;
       }
     }
-  }
-  if (!dupmedia)
-    puts("PASS");
-
-
-  return (status);
-}
-
-
-/*
- * 'test_pagesize()' - Test the PWG mapping functions.
- */
-
-static int				/* O - 1 on failure, 0 on success */
-test_pagesize(_ppd_cache_t *pc,		/* I - PWG mapping data */
-              ppd_file_t   *ppd,	/* I - PPD file */
-	      const char   *ppdsize)	/* I - PPD page size */
-{
-  int		status = 0;		/* Return status */
-  ipp_t		*job;			/* Job attributes */
-  const char	*pagesize;		/* PageSize value */
-
-
-  if (ppdPageSize(ppd, ppdsize))
-  {
-    printf("_ppdCacheGetPageSize(keyword=%s): ", ppdsize);
-    fflush(stdout);
-
-    if ((pagesize = _ppdCacheGetPageSize(pc, NULL, ppdsize, NULL)) == NULL)
-    {
-      puts("FAIL (Not Found)");
-      status = 1;
-    }
-    else if (_cups_strcasecmp(pagesize, ppdsize))
-    {
-      printf("FAIL (Got \"%s\", Expected \"%s\")\n", pagesize, ppdsize);
-      status = 1;
-    }
-    else
-      puts("PASS");
 
-    job = ippNew();
-    ippAddString(job, IPP_TAG_JOB, IPP_TAG_KEYWORD, "media", NULL, ppdsize);
-
-    printf("_ppdCacheGetPageSize(media=%s): ", ppdsize);
-    fflush(stdout);
-
-    if ((pagesize = _ppdCacheGetPageSize(pc, job, NULL, NULL)) == NULL)
-    {
-      puts("FAIL (Not Found)");
-      status = 1;
-    }
-    else if (_cups_strcasecmp(pagesize, ppdsize))
-    {
-      printf("FAIL (Got \"%s\", Expected \"%s\")\n", pagesize, ppdsize);
-      status = 1;
-    }
-    else
-      puts("PASS");
-
-    ippDelete(job);
+    if (i > 0)
+      break;
   }
 
-  return (status);
-}
-
-
-/*
- * 'test_ppd_cache()' - Test the PPD cache functions.
- */
-
-static int				/* O - 1 on failure, 0 on success */
-test_ppd_cache(_ppd_cache_t *pc,	/* I - PWG mapping data */
-               ppd_file_t   *ppd)	/* I - PPD file */
-{
-  int		i,			/* Looping var */
-		status = 0;		/* Return status */
-  _ppd_cache_t	*pc2;			/* Loaded data */
-  pwg_size_t	*size,			/* Size from original */
-		*size2;			/* Size from saved */
-  pwg_map_t	*map,			/* Map from original */
-		*map2;			/* Map from saved */
-
-
- /*
-  * Verify that we can write and read back the same data...
-  */
-
-  fputs("_ppdCacheWriteFile(test.pwg): ", stdout);
-  if (!_ppdCacheWriteFile(pc, "test.pwg", NULL))
-  {
-    puts("FAIL");
-    status ++;
-  }
-  else
-    puts("PASS");
-
-  fputs("_ppdCacheCreateWithFile(test.pwg): ", stdout);
-  if ((pc2 = _ppdCacheCreateWithFile("test.pwg", NULL)) == NULL)
-  {
-    puts("FAIL");
-    status ++;
-  }
-  else
-  {
-    // TODO: FINISH ADDING ALL VALUES IN STRUCTURE
-    if (pc2->num_sizes != pc->num_sizes)
-    {
-      if (!status)
-        puts("FAIL");
-
-      printf("    SAVED num_sizes=%d, ORIG num_sizes=%d\n", pc2->num_sizes,
-             pc->num_sizes);
-
-      status ++;
-    }
-    else
-    {
-      for (i = pc->num_sizes, size = pc->sizes, size2 = pc2->sizes;
-           i > 0;
-	   i --, size ++, size2 ++)
-      {
-        if (strcmp(size2->map.pwg, size->map.pwg) ||
-	    strcmp(size2->map.ppd, size->map.ppd) ||
-	    size2->width != size->width ||
-	    size2->length != size->length ||
-	    size2->left != size->left ||
-	    size2->bottom != size->bottom ||
-	    size2->right != size->right ||
-	    size2->top != size->top)
-	{
-	  if (!status)
-	    puts("FAIL");
-
-	  if (strcmp(size->map.pwg, size2->map.pwg))
-	    printf("    SAVED size->map.pwg=\"%s\", ORIG "
-	           "size->map.pwg=\"%s\"\n", size2->map.pwg, size->map.pwg);
-
-	  if (strcmp(size2->map.ppd, size->map.ppd))
-	    printf("    SAVED size->map.ppd=\"%s\", ORIG "
-	           "size->map.ppd=\"%s\"\n", size2->map.ppd, size->map.ppd);
-
-	  if (size2->width != size->width)
-	    printf("    SAVED size->width=%d, ORIG size->width=%d\n",
-		   size2->width, size->width);
-
-	  if (size2->length != size->length)
-	    printf("    SAVED size->length=%d, ORIG size->length=%d\n",
-		   size2->length, size->length);
-
-	  if (size2->left != size->left)
-	    printf("    SAVED size->left=%d, ORIG size->left=%d\n",
-		   size2->left, size->left);
-
-	  if (size2->bottom != size->bottom)
-	    printf("    SAVED size->bottom=%d, ORIG size->bottom=%d\n",
-		   size2->bottom, size->bottom);
-
-	  if (size2->right != size->right)
-	    printf("    SAVED size->right=%d, ORIG size->right=%d\n",
-		   size2->right, size->right);
-
-	  if (size2->top != size->top)
-	    printf("    SAVED size->top=%d, ORIG size->top=%d\n",
-		   size2->top, size->top);
-
-	  status ++;
-	  break;
-	}
-      }
-
-      for (i = pc->num_sources, map = pc->sources, map2 = pc2->sources;
-           i > 0;
-	   i --, map ++, map2 ++)
-      {
-        if (strcmp(map2->pwg, map->pwg) ||
-	    strcmp(map2->ppd, map->ppd))
-	{
-	  if (!status)
-	    puts("FAIL");
-
-	  if (strcmp(map->pwg, map2->pwg))
-	    printf("    SAVED source->pwg=\"%s\", ORIG source->pwg=\"%s\"\n",
-	           map2->pwg, map->pwg);
-
-	  if (strcmp(map2->ppd, map->ppd))
-	    printf("    SAVED source->ppd=\"%s\", ORIG source->ppd=\"%s\"\n",
-	           map2->ppd, map->ppd);
-
-	  status ++;
-	  break;
-	}
-      }
-
-      for (i = pc->num_types, map = pc->types, map2 = pc2->types;
-           i > 0;
-	   i --, map ++, map2 ++)
-      {
-        if (strcmp(map2->pwg, map->pwg) ||
-	    strcmp(map2->ppd, map->ppd))
-	{
-	  if (!status)
-	    puts("FAIL");
-
-	  if (strcmp(map->pwg, map2->pwg))
-	    printf("    SAVED type->pwg=\"%s\", ORIG type->pwg=\"%s\"\n",
-	           map2->pwg, map->pwg);
-
-	  if (strcmp(map2->ppd, map->ppd))
-	    printf("    SAVED type->ppd=\"%s\", ORIG type->ppd=\"%s\"\n",
-	           map2->ppd, map->ppd);
-
-	  status ++;
-	  break;
-	}
-      }
-    }
-
-    if (!status)
-      puts("PASS");
-
-    _ppdCacheDestroy(pc2);
-  }
-
- /*
-  * Test PageSize mapping code...
-  */
-
-  status += test_pagesize(pc, ppd, "Letter");
-  status += test_pagesize(pc, ppd, "na-letter");
-  status += test_pagesize(pc, ppd, "A4");
-  status += test_pagesize(pc, ppd, "iso-a4");
+  if (num_media == 1)
+    testEnd(true);
 
-  return (status);
+  return (testsPassed ? 0 : 1);
 }
diff --git a/xcode/libcups.xcodeproj/project.pbxproj b/xcode/libcups.xcodeproj/project.pbxproj
index 19a04fc46..8ab966f94 100644
--- a/xcode/libcups.xcodeproj/project.pbxproj
+++ b/xcode/libcups.xcodeproj/project.pbxproj
@@ -30,6 +30,7 @@
 				2797D73728E5D24E0056D546 /* PBXTargetDependency */,
 				2794DA8D29DCBDEB00B71A3F /* PBXTargetDependency */,
 				271284B91CC11FA500E517C7 /* PBXTargetDependency */,
+				27C2A7A72A0C59EA00C20AEF /* PBXTargetDependency */,
 				271284BF1CC11FA500E517C7 /* PBXTargetDependency */,
 				27D3967927BA8224003D3D8E /* PBXTargetDependency */,
 				274770E42345347D0089BC31 /* PBXTargetDependency */,
@@ -770,6 +771,13 @@
 			remoteGlobalIDString = 2797D72228E5D2360056D546;
 			remoteInfo = testjson;
 		};
+		27C2A7A62A0C59EA00C20AEF /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 72BF96371333042100B1EAD7 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 724FA5F71CC038190092477B;
+			remoteInfo = testpwg;
+		};
 		27D3966A27BA81D3003D3D8E /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
 			containerPortal = 72BF96371333042100B1EAD7 /* Project object */;
@@ -2665,7 +2673,7 @@
 			isa = PBXProject;
 			attributes = {
 				BuildIndependentTargetsInParallel = YES;
-				LastUpgradeCheck = 1420;
+				LastUpgradeCheck = 1430;
 				ORGANIZATIONNAME = "Apple Inc.";
 				TargetAttributes = {
 					270695FD1CADF3E200FFE5FB = {
@@ -3284,6 +3292,11 @@
 			target = 2797D72228E5D2360056D546 /* testjson */;
 			targetProxy = 2797D73628E5D24E0056D546 /* PBXContainerItemProxy */;
 		};
+		27C2A7A72A0C59EA00C20AEF /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 724FA5F71CC038190092477B /* testpwg */;
+			targetProxy = 27C2A7A62A0C59EA00C20AEF /* PBXContainerItemProxy */;
+		};
 		27D3966927BA81D3003D3D8E /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = 274FF6891333B1C400317ECB /* libcups3_static */;
diff --git a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/Tests.xcscheme b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/Tests.xcscheme
index 6d2f41f0b..60892d3d4 100644
--- a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/Tests.xcscheme
+++ b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/Tests.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "1420"
+   LastUpgradeVersion = "1430"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"
diff --git a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/fuzzipp.xcscheme b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/fuzzipp.xcscheme
index 9222b7d12..c16a9821e 100644
--- a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/fuzzipp.xcscheme
+++ b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/fuzzipp.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "1420"
+   LastUpgradeVersion = "1430"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"
diff --git a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/ippevepcl.xcscheme b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/ippevepcl.xcscheme
index 128c43002..a542233ed 100644
--- a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/ippevepcl.xcscheme
+++ b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/ippevepcl.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "1420"
+   LastUpgradeVersion = "1430"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"
diff --git a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/ippeveps.xcscheme b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/ippeveps.xcscheme
index 901303aeb..4aad36d6e 100644
--- a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/ippeveps.xcscheme
+++ b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/ippeveps.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "1420"
+   LastUpgradeVersion = "1430"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"
diff --git a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/libcups.xcscheme b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/libcups.xcscheme
index b5afff938..15622d91f 100644
--- a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/libcups.xcscheme
+++ b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/libcups.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "1420"
+   LastUpgradeVersion = "1430"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"
diff --git a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testcreds.xcscheme b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testcreds.xcscheme
index 16e63a450..90cc38e83 100644
--- a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testcreds.xcscheme
+++ b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testcreds.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "1420"
+   LastUpgradeVersion = "1430"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"
diff --git a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testlang.xcscheme b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testlang.xcscheme
index cc6c89a89..e114b10dd 100644
--- a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testlang.xcscheme
+++ b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testlang.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "1420"
+   LastUpgradeVersion = "1430"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"
diff --git a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testpwg.xcscheme b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testpwg.xcscheme
index 03a8e8c23..339475ceb 100644
--- a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testpwg.xcscheme
+++ b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testpwg.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "1420"
+   LastUpgradeVersion = "1430"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"
diff --git a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testtestpage.xcscheme b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testtestpage.xcscheme
index bbae4b1f6..7478126ed 100644
--- a/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testtestpage.xcscheme
+++ b/xcode/libcups.xcodeproj/xcshareddata/xcschemes/testtestpage.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "1420"
+   LastUpgradeVersion = "1430"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"

From 3b2aa18156dd33dc1f85ec82d4865edd51f00a14 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Fri, 12 May 2023 13:17:03 -0400
Subject: [PATCH 14/31] Save additions to support server mode in testcreds.

---
 cups/testcreds.c | 133 +++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 129 insertions(+), 4 deletions(-)

diff --git a/cups/testcreds.c b/cups/testcreds.c
index a71617377..c49ac913f 100644
--- a/cups/testcreds.c
+++ b/cups/testcreds.c
@@ -45,6 +45,7 @@
 #include "cups-private.h"
 #include "test-internal.h"
 #include <sys/stat.h>
+#include <poll.h>
 
 
 //
@@ -580,11 +581,17 @@ test_csr(
 static int				// O - Exit status
 test_server(const char *host_port)	// I - Hostname/port
 {
-  char	host[256],			// Hostname
-	*hostptr;			// Pointer into hostname
-  int	port;				// Port number
+  char		host[256],		// Hostname
+		*hostptr;		// Pointer into hostname
+  int		port;			// Port number
+  nfds_t	i,			// Looping var
+		num_listeners = 0;	// Number of listeners
+  struct pollfd	listeners[2];		// Listeners
+  http_addr_t	addr;			// Listen address
+  http_t	*http;			// Client
 
 
+  // Get the host and port...
   cupsCopyString(host, host_port, sizeof(host));
   if ((hostptr = strrchr(host, ':')) != NULL)
   {
@@ -598,9 +605,127 @@ test_server(const char *host_port)	// I - Hostname/port
     port = 8000 + (int)getuid() % 1000;
   }
 
+  // Setup listeners for IPv4 and IPv6...
+  memset(&addr, 0, sizeof(addr));
+  addr.ipv4.sin_family = AF_INET;
+
+  if ((listeners[num_listeners].fd = httpAddrListen(&addr, port)) > 0)
+  {
+    listeners[num_listeners].events = POLLIN | POLLERR;
+    num_listeners ++;
+  }
+
+  addr.ipv6.sin6_family = AF_INET6;
+
+  if ((listeners[num_listeners].fd = httpAddrListen(&addr, port)) > 0)
+  {
+    listeners[num_listeners].events = POLLIN | POLLERR;
+    num_listeners ++;
+  }
+
+  if (num_listeners == 0)
+  {
+    fprintf(stderr, "testcreds: Unable to listen on port %d: %s\n", port, cupsLastErrorString());
+    return (1);
+  }
+
   printf("Listening for connections on port %d...\n", port);
 
-  return (1);
+  // Set certificate info...
+  cupsSetServerCredentials(TEST_CERT_PATH, host, true);
+
+  // Wait for connections...
+  for (;;)
+  {
+    http_state_t	state;		// HTTP request state
+    char		resource[1024];	// Resource path
+
+    // Look for new connections...
+    if (poll(listeners, num_listeners, 1000) < 0)
+    {
+      if (errno == EINTR || errno == EAGAIN)
+        continue;
+
+      perror("testcreds: Unable to poll");
+      break;
+    }
+
+    // Try accepting a connection...
+    for (i = 0, http = NULL; i < num_listeners; i ++)
+    {
+      if (listeners[i].revents & POLLIN)
+      {
+        if ((http = httpAcceptConnection(listeners[i].fd, true)) != NULL)
+          break;
+
+        fprintf(stderr, "testcreds: Unable to accept connection: %s\n", cupsLastErrorString());
+      }
+    }
+
+    if (!http)
+      continue;
+
+    // Negotiate a secure connection...
+    if (!httpSetEncryption(http, HTTP_ENCRYPTION_ALWAYS))
+    {
+      fprintf(stderr, "testcreds: Unable to encrypt connection: %s\n", cupsLastErrorString());
+      httpClose(http);
+      continue;
+    }
+
+    // Process a single request and then close it out...
+    while ((state = httpReadRequest(http, resource, sizeof(resource))) == HTTP_STATE_WAITING)
+      usleep(1000);
+
+    if (state == HTTP_STATE_ERROR)
+    {
+      if (httpError(http) == EPIPE)
+	fputs("testcreds: Client closed connection.\n", stderr);
+      else
+	fprintf(stderr, "testcreds: Bad request line (%s).\n", strerror(httpError(http)));
+    }
+    else if (state == HTTP_STATE_UNKNOWN_METHOD)
+    {
+      fputs("testcreds: Bad/unknown operation.\n", stderr);
+    }
+    else if (state == HTTP_STATE_UNKNOWN_VERSION)
+    {
+      fputs("testcreds: Bad HTTP version.\n", stderr);
+    }
+    else
+    {
+      printf("%s %s\n", httpStateString(state), resource);
+
+      if (state == HTTP_STATE_GET || state == HTTP_STATE_HEAD)
+      {
+        httpClearFields(http);
+        httpSetField(http, HTTP_FIELD_CONTENT_TYPE, "text/plain");
+        httpSetField(http, HTTP_FIELD_CONNECTION, "close");
+	httpSetLength(http, strlen(resource) + 1);
+	httpWriteResponse(http, HTTP_STATUS_OK);
+
+        if (state == HTTP_STATE_GET)
+        {
+          // Echo back the resource path...
+          httpWrite(http, resource, strlen(resource));
+          httpWrite(http, "\n", 1);
+          httpFlushWrite(http);
+        }
+      }
+      else
+      {
+        httpWriteResponse(http, HTTP_STATUS_BAD_REQUEST);
+      }
+    }
+
+    httpClose(http);
+  }
+
+  // Close listeners and return...
+  for (i = 0; i < num_listeners; i ++)
+    httpAddrClose(&addr, listeners[i].fd);
+
+  return (0);
 }
 
 

From 4f73e4878587169ca584475c4291d82ce2ccfaa2 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Sat, 13 May 2023 17:37:46 -0400
Subject: [PATCH 15/31] Mirror JSON output fix from CUPS 2.x repo.

---
 tools/ipptool.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/ipptool.c b/tools/ipptool.c
index 51d4acd13..d45a89bd6 100644
--- a/tools/ipptool.c
+++ b/tools/ipptool.c
@@ -4878,6 +4878,7 @@ print_json_attr(
 
     default :
         /* Out-of-band value */
+        cupsFilePrintf(data->outfile, ": null");
 	break;
   }
 }

From 8b05605d8522e1aa923267ccb548532a60569338 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Tue, 16 May 2023 10:48:31 -0400
Subject: [PATCH 16/31] Save work.

---
 cups/tls-openssl.c                      | 59 +++++++++++++++++++++++++
 xcode/libcups.xcodeproj/project.pbxproj |  6 +++
 2 files changed, 65 insertions(+)

diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index 815e3bdab..74f698eee 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -12,6 +12,9 @@
 //
 
 #include <openssl/x509v3.h>
+#include <openssl/evp.h>
+#include <openssl/objects.h>
+#include <openssl/obj_mac.h>
 
 
 //
@@ -1429,6 +1432,7 @@ static EVP_PKEY *			// O - Key pair
 openssl_create_key(cups_credtype_t type)	// I - Type of key
 {
   EVP_PKEY	*pkey;			// Key pair
+#if 0
 #if defined(EVP_PKEY_EC)
   EC_KEY	*ec = NULL;		// EC key
 #endif // EVP_PKEY_EC
@@ -1491,6 +1495,61 @@ openssl_create_key(cups_credtype_t type)	// I - Type of key
   else
 #endif // EVP_PKEY_EC
   EVP_PKEY_assign_RSA(pkey, rsa);
+#else
+  EVP_PKEY_CTX	*ctx;			// Key generation context
+  int		algid;			// Algorithm NID
+  int		bits = 0;		// Bits
+
+
+  switch (type)
+  {
+    case CUPS_CREDTYPE_ECDSA_P256_SHA256 :
+        algid = EVP_PKEY_EC;
+	break;
+
+    case CUPS_CREDTYPE_ECDSA_P384_SHA256 :
+        algid = EVP_PKEY_EC;
+	break;
+
+    case CUPS_CREDTYPE_ECDSA_P521_SHA256 :
+        algid = EVP_PKEY_EC;
+	break;
+
+    case CUPS_CREDTYPE_RSA_2048_SHA256 :
+        algid = EVP_PKEY_RSA;
+        bits  = 2048;
+	break;
+
+    default :
+    case CUPS_CREDTYPE_RSA_3072_SHA256 :
+        algid = EVP_PKEY_RSA;
+        bits  = 3072;
+	break;
+
+    case CUPS_CREDTYPE_RSA_4096_SHA256 :
+        algid = EVP_PKEY_RSA;
+        bits  = 4096;
+	break;
+  }
+
+  pkey = NULL;
+
+  if ((ctx = EVP_PKEY_CTX_new_id(algid, NULL)) == NULL)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create private key context."), 1);
+  }
+  else if (EVP_PKEY_keygen_init(ctx) <= 0)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to initialize private key context."), 1);
+  }
+  else if (bits && EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, bits) <= 0)
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to configure private key context."), 1);
+  else if (EVP_PKEY_keygen(ctx, &pkey) <= 0)
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create private key."), 1);
+
+  EVP_PKEY_free(pkey);
+#endif // 0
+
 
   return (pkey);
 }
diff --git a/xcode/libcups.xcodeproj/project.pbxproj b/xcode/libcups.xcodeproj/project.pbxproj
index 8ab966f94..6d7fa02ed 100644
--- a/xcode/libcups.xcodeproj/project.pbxproj
+++ b/xcode/libcups.xcodeproj/project.pbxproj
@@ -136,6 +136,9 @@
 		2712865D1CC1309000E517C7 /* libcups_static.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 72A4332F155844CF002E172D /* libcups_static.a */; };
 		2712865E1CC1309000E517C7 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 2767FC591926750C000F61D3 /* CoreFoundation.framework */; };
 		271286691CC130C700E517C7 /* tlscheck.c in Sources */ = {isa = PBXBuildFile; fileRef = 271286681CC130BD00E517C7 /* tlscheck.c */; };
+		271607952A0EC955002508F6 /* libz.tbd in Frameworks */ = {isa = PBXBuildFile; fileRef = 27D3967A27BB389C003D3D8E /* libz.tbd */; };
+		271607962A0EC96B002508F6 /* libresolv.tbd in Frameworks */ = {isa = PBXBuildFile; fileRef = 27D3968227BB390D003D3D8E /* libresolv.tbd */; };
+		271607972A0EC971002508F6 /* libiconv.tbd in Frameworks */ = {isa = PBXBuildFile; fileRef = 27D3967E27BB38E6003D3D8E /* libiconv.tbd */; };
 		273B1EA1226B3E4800428143 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 2767FC591926750C000F61D3 /* CoreFoundation.framework */; };
 		273B1EA2226B3E4800428143 /* libresolv.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 2767FC5B1926750C000F61D3 /* libresolv.dylib */; };
 		273B1EA3226B3E4800428143 /* libz.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 2767FC5C1926750C000F61D3 /* libz.dylib */; };
@@ -1724,7 +1727,10 @@
 			buildActionMask = 2147483647;
 			files = (
 				279B960D28C582F000869E97 /* SystemConfiguration.framework in Frameworks */,
+				271607952A0EC955002508F6 /* libz.tbd in Frameworks */,
+				271607972A0EC971002508F6 /* libiconv.tbd in Frameworks */,
 				27CAFC7C282C8C6F00FE02FC /* libcrypto.a in Frameworks */,
+				271607962A0EC96B002508F6 /* libresolv.tbd in Frameworks */,
 				27CAFC7D282C8C6F00FE02FC /* libssl.a in Frameworks */,
 				724FA5FF1CC038190092477B /* libcups_static.a in Frameworks */,
 				724FA6001CC038190092477B /* CoreFoundation.framework in Frameworks */,

From ca61e3bb5a1f1e7af32a5aa460d71803b40f7d9d Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Tue, 16 May 2023 11:22:06 -0400
Subject: [PATCH 17/31] Fix OpenSSL key generation to use modern API that
 doesn't crash with EC keys.

Implement first pass of unit tests with testcreds.

Update alt_names to use const char * const * type.
---
 cups/cups.h        |  4 +-
 cups/testcreds.c   | 70 +++++++++++++++++++++++++++++++-
 cups/tls-openssl.c | 99 +++++++++-------------------------------------
 3 files changed, 89 insertions(+), 84 deletions(-)

diff --git a/cups/cups.h b/cups/cups.h
index c455672b1..940def6e0 100644
--- a/cups/cups.h
+++ b/cups/cups.h
@@ -318,8 +318,8 @@ extern size_t		cupsCopyDest(cups_dest_t *dest, size_t num_dests, cups_dest_t **d
 extern cups_dinfo_t	*cupsCopyDestInfo(http_t *http, cups_dest_t *dest) _CUPS_PUBLIC;
 extern int		cupsCopyDestConflicts(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, size_t num_options, cups_option_t *options, const char *new_option, const char *new_value, size_t *num_conflicts, cups_option_t **conflicts, size_t *num_resolved, cups_option_t **resolved) _CUPS_PUBLIC;
 extern size_t		cupsCopyString(char *dst, const char *src, size_t dstsize) _CUPS_PUBLIC;
-extern bool		cupsCreateCredentials(const char *path, bool ca_cert, cups_credpurpose_t purpose, cups_credtype_t type, cups_credusage_t usage, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name, size_t num_alt_names, const char **alt_names, const char *root_name, time_t expiration_date) _CUPS_PUBLIC;
-extern bool		cupsCreateCredentialsRequest(const char *path, cups_credpurpose_t purpose, cups_credtype_t type, cups_credusage_t usage, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name, size_t num_alt_names, const char **alt_names) _CUPS_PUBLIC;
+extern bool		cupsCreateCredentials(const char *path, bool ca_cert, cups_credpurpose_t purpose, cups_credtype_t type, cups_credusage_t usage, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name, size_t num_alt_names, const char * const *alt_names, const char *root_name, time_t expiration_date) _CUPS_PUBLIC;
+extern bool		cupsCreateCredentialsRequest(const char *path, cups_credpurpose_t purpose, cups_credtype_t type, cups_credusage_t usage, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name, size_t num_alt_names, const char * const *alt_names) _CUPS_PUBLIC;
 extern ipp_status_t	cupsCreateDestJob(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, int *job_id, const char *title, size_t num_options, cups_option_t *options) _CUPS_PUBLIC;
 
 extern int		cupsDoAuthentication(http_t *http, const char *method, const char *resource) _CUPS_PUBLIC;
diff --git a/cups/testcreds.c b/cups/testcreds.c
index c49ac913f..f4f2ccc6e 100644
--- a/cups/testcreds.c
+++ b/cups/testcreds.c
@@ -391,7 +391,75 @@ main(int  argc,				// I - Number of command-line arguments
 static int				// O - Exit status
 do_unit_tests(void)
 {
-  return (1);
+  cups_credtype_t	type;		// Current credential type
+  char			*data;		// Cert data
+  static const char * const alt_names[] =
+  {					// subjectAltName values
+    "printer.example.com",
+    "localhost"
+  };
+  static const char * const types[] =
+  {					// Credential types
+    "default",
+    "rsa-2048",
+    "rsa-3072",
+    "rsa-4096",
+    "ecdsa-p256",
+    "ecdsa-p384",
+    "ecdsa-p521"
+  };
+
+
+  for (type = CUPS_CREDTYPE_DEFAULT; type <= CUPS_CREDTYPE_ECDSA_P521_SHA256; type ++)
+  {
+    testBegin("cupsCreateCredentials(_site_, %s, no alt names, CA)", types[type]);
+    if (cupsCreateCredentials(TEST_CERT_PATH, true, CUPS_CREDPURPOSE_SERVER_AUTH, type, CUPS_CREDUSAGE_DEFAULT_TLS, "Organization", "Unit", "Locality", "Ontario", "CA", "_site_", 0, NULL, NULL, time(NULL) + 30 * 86400))
+    {
+      testEnd(true);
+
+      testBegin("cupsCopyCredentials(_site_)");
+      data = cupsCopyCredentials(TEST_CERT_PATH, "_site_");
+      testEnd(data != NULL);
+      free(data);
+
+      testBegin("cupsCopyCredentialsKey(_site_)");
+      data = cupsCopyCredentialsKey(TEST_CERT_PATH, "_site_");
+      testEnd(data != NULL);
+      free(data);
+    }
+    else
+    {
+      testEndMessage(false, "%s", cupsLastErrorString());
+    }
+
+    testBegin("cupsCreateCredentials(printer, %s, alt names, signed by CA cert)", types[type]);
+    if (cupsCreateCredentials(TEST_CERT_PATH, false, CUPS_CREDPURPOSE_SERVER_AUTH, type, CUPS_CREDUSAGE_DEFAULT_TLS, "Organization", "Unit", "Locality", "Ontario", "CA", "printer", sizeof(alt_names) / sizeof(alt_names[0]), alt_names, "_site_", time(NULL) + 30 * 86400))
+      testEnd(true);
+    else
+      testEndMessage(false, "%s", cupsLastErrorString());
+
+    testBegin("cupsCreateCredentialsRequest(printer, %s, alt names)", types[type]);
+    if (cupsCreateCredentialsRequest(TEST_CERT_PATH, CUPS_CREDPURPOSE_SERVER_AUTH, type, CUPS_CREDUSAGE_DEFAULT_TLS, "Organization", "Unit", "Locality", "Ontario", "CA", "printer", sizeof(alt_names) / sizeof(alt_names[0]), alt_names))
+    {
+      testEnd(true);
+
+      testBegin("cupsCopyCredentialsRequest(printer)");
+      data = cupsCopyCredentialsRequest(TEST_CERT_PATH, "printer");
+      testEnd(data != NULL);
+      free(data);
+
+      testBegin("cupsCopyCredentialsKey(printer)");
+      data = cupsCopyCredentialsKey(TEST_CERT_PATH, "printer");
+      testEnd(data != NULL);
+      free(data);
+    }
+    else
+    {
+      testEndMessage(false, "%s", cupsLastErrorString());
+    }
+  }
+
+  return (testsPassed ? 0 : 1);
 }
 
 
diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index 74f698eee..0adaf6be6 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -33,7 +33,7 @@ static bool		openssl_add_ext(STACK_OF(X509_EXTENSION) *exts, int nid, const char
 static X509		*openssl_create_credential(http_credential_t *credential);
 static X509_NAME	*openssl_create_name(const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name);
 static EVP_PKEY		*openssl_create_key(cups_credtype_t type);
-static bool		openssl_create_san(STACK_OF(X509_EXTENSION) *exts, const char *common_name, size_t num_alt_names, const char **alt_names);
+static bool		openssl_create_san(STACK_OF(X509_EXTENSION) *exts, const char *common_name, size_t num_alt_names, const char * const *alt_names);
 static time_t		openssl_get_date(X509 *cert, int which);
 //static void		openssl_load_crl(void);
 
@@ -93,7 +93,7 @@ cupsCreateCredentials(
     const char         *country,	// I - Country or `NULL` for locale-based default
     const char         *common_name,	// I - Common name
     size_t             num_alt_names,	// I - Number of subject alternate names
-    const char         **alt_names,	// I - Subject Alternate Names
+    const char * const *alt_names,	// I - Subject Alternate Names
     const char         *root_name,	// I - Root certificate/domain name or `NULL` for site/self-signed
     time_t             expiration_date)	// I - Expiration date
 {
@@ -340,7 +340,7 @@ cupsCreateCredentialsRequest(
     const char         *country,	// I - Country or `NULL` for locale-based default
     const char         *common_name,	// I - Common name
     size_t             num_alt_names,	// I - Number of subject alternate names
-    const char         **alt_names)	// I - Subject Alternate Names
+    const char * const *alt_names)	// I - Subject Alternate Names
 {
   char		*result = NULL;		// Return value
   EVP_PKEY	*pkey;			// Key pair
@@ -1429,90 +1429,31 @@ openssl_create_credential(
 //
 
 static EVP_PKEY *			// O - Key pair
-openssl_create_key(cups_credtype_t type)	// I - Type of key
+openssl_create_key(
+    cups_credtype_t type)		// I - Type of key
 {
   EVP_PKEY	*pkey;			// Key pair
-#if 0
-#if defined(EVP_PKEY_EC)
-  EC_KEY	*ec = NULL;		// EC key
-#endif // EVP_PKEY_EC
-  RSA		*rsa = NULL;		// RSA key pair
-
-
-  switch (type)
-  {
-#if defined(EVP_PKEY_EC)
-    case CUPS_CREDTYPE_ECDSA_P256_SHA256 :
-	ec = EC_KEY_new_by_curve_name(NID_secp256k1);
-	break;
-
-    case CUPS_CREDTYPE_ECDSA_P384_SHA256 :
-	ec = EC_KEY_new_by_curve_name(NID_secp384r1);
-	break;
-
-    case CUPS_CREDTYPE_ECDSA_P521_SHA256 :
-	ec = EC_KEY_new_by_curve_name(NID_secp521r1);
-	break;
-#endif // EVP_PKEY_EC && USE_EC
-
-    case CUPS_CREDTYPE_RSA_2048_SHA256 :
-	rsa = RSA_generate_key(2048, RSA_F4, NULL, NULL);
-	break;
-
-    default :
-    case CUPS_CREDTYPE_RSA_3072_SHA256 :
-	rsa = RSA_generate_key(3072, RSA_F4, NULL, NULL);
-	break;
-
-    case CUPS_CREDTYPE_RSA_4096_SHA256 :
-	rsa = RSA_generate_key(4096, RSA_F4, NULL, NULL);
-	break;
-  }
-
-  if (!rsa && !ec)
-  {
-    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create key pair."), 1);
-    return (NULL);
-  }
-
-  if ((pkey = EVP_PKEY_new()) == NULL)
-  {
-#if defined(EVP_PKEY_EC)
-    if (ec)
-      EC_KEY_free(ec);
-#endif // EVP_PKEY_EC && USE_EC
-
-    if (rsa)
-      RSA_free(rsa);
-
-    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create private key."), 1);
-    return (NULL);
-  }
-
-#if defined(EVP_PKEY_EC)
-  if (ec)
-    EVP_PKEY_assign_EC_KEY(pkey, ec);
-  else
-#endif // EVP_PKEY_EC
-  EVP_PKEY_assign_RSA(pkey, rsa);
-#else
   EVP_PKEY_CTX	*ctx;			// Key generation context
   int		algid;			// Algorithm NID
   int		bits = 0;		// Bits
+  int		curveid = 0;		// Curve NID
 
 
   switch (type)
   {
     case CUPS_CREDTYPE_ECDSA_P256_SHA256 :
-        algid = EVP_PKEY_EC;
+        algid   = EVP_PKEY_EC;
+        curveid = NID_secp256k1;
 	break;
 
     case CUPS_CREDTYPE_ECDSA_P384_SHA256 :
-        algid = EVP_PKEY_EC;
+        algid   = EVP_PKEY_EC;
+        curveid = NID_secp384r1;
 	break;
 
     case CUPS_CREDTYPE_ECDSA_P521_SHA256 :
-        algid = EVP_PKEY_EC;
+        algid   = EVP_PKEY_EC;
+        curveid = NID_secp521r1;
 	break;
 
     case CUPS_CREDTYPE_RSA_2048_SHA256 :
@@ -1535,21 +1476,17 @@ openssl_create_key(cups_credtype_t type)	// I - Type of key
   pkey = NULL;
 
   if ((ctx = EVP_PKEY_CTX_new_id(algid, NULL)) == NULL)
-  {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create private key context."), 1);
-  }
   else if (EVP_PKEY_keygen_init(ctx) <= 0)
-  {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to initialize private key context."), 1);
-  }
   else if (bits && EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, bits) <= 0)
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to configure private key context."), 1);
+  else if (curveid && EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, curveid) <= 0)
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to configure private key context."), 1);
   else if (EVP_PKEY_keygen(ctx, &pkey) <= 0)
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create private key."), 1);
 
-  EVP_PKEY_free(pkey);
-#endif // 0
-
+  EVP_PKEY_CTX_free(ctx);
 
   return (pkey);
 }
@@ -1599,9 +1536,9 @@ openssl_create_name(
 static bool				// O - `true` on success, `false` otherwise
 openssl_create_san(
     STACK_OF(X509_EXTENSION) *exts,	// I - Extensions
-    const char *common_name,		// I - Common name
-    size_t     num_alt_names,		// I - Number of alternate names
-    const char **alt_names)		// I - List of alternate names
+    const char         *common_name,	// I - Common name
+    size_t             num_alt_names,	// I - Number of alternate names
+    const char * const *alt_names)	// I - List of alternate names
 {
   char		temp[2048],		// Temporary string
 		*tempptr;		// Pointer into temporary string

From cf992f5b46f940d8bc3bc2438f04b0309598ab32 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Tue, 16 May 2023 13:50:59 -0400
Subject: [PATCH 18/31] Save work on GNU TLS.

---
 cups/tls-gnutls.c | 170 ++++++++++++++++++++++++++++++++++------------
 1 file changed, 126 insertions(+), 44 deletions(-)

diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index ba05da168..e1c9059e5 100644
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -18,9 +18,16 @@
 
 static gnutls_x509_crt_t gnutls_create_credential(http_credential_t *credential);
 static gnutls_x509_privkey_t gnutls_create_key(cups_credtype_t type);
+static ssize_t		gnutls_http_read(gnutls_transport_ptr_t ptr, void *data, size_t length);
+static ssize_t		gnutls_http_write(gnutls_transport_ptr_t ptr, const void *data, size_t length);
 static void		gnutls_load_crl(void);
-static ssize_t		gnutls_read(gnutls_transport_ptr_t ptr, void *data, size_t length);
-static ssize_t		gnutls_write(gnutls_transport_ptr_t ptr, const void *data, size_t length);
+
+
+//
+// Local globals...
+//
+
+static gnutls_x509_crl_t tls_crl = NULL;/* Certificate revocation list */
 
 
 //
@@ -49,7 +56,7 @@ cupsCreateCredentials(
     const char         *country,	// I - Country or `NULL` for locale-based default
     const char         *common_name,	// I - Common name
     size_t             num_alt_names,	// I - Number of subject alternate names
-    const char         **alt_names,	// I - Subject Alternate Names
+    const char * const *alt_names,	// I - Subject Alternate Names
     const char         *root_name,	// I - Root certificate/domain name or `NULL` for site/self-signed
     time_t             expiration_date)	// I - Expiration date
 {
@@ -58,8 +65,7 @@ cupsCreateCredentials(
   char			temp[1024],	// Temporary directory name
  			crtfile[1024],	// Certificate filename
 			keyfile[1024];	// Private key filename
-  cups_lang_t		*language;	// Default language info
-  const char		*langname;	// Default language name
+  unsigned		gnutls_usage = 0;// GNU TLS keyUsage bits
   cups_file_t		*fp;		// Key/cert file
   unsigned char		buffer[8192];	// Buffer for x509 data
   size_t		bytes;		// Number of bytes of data
@@ -77,7 +83,7 @@ cupsCreateCredentials(
   if (!path || !common_name)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(EINVAL), 0);
-    return (0);
+    return (false);
   }
 
   http_make_path(crtfile, sizeof(crtfile), path, common_name, "crt");
@@ -98,7 +104,7 @@ cupsCreateCredentials(
     DEBUG_printf(("1cupsCreateCredentials: Unable to export private key: %s", gnutls_strerror(result)));
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
     gnutls_x509_privkey_deinit(key);
-    return (0);
+    return (false);
   }
   else if ((fp = cupsFileOpen(keyfile, "w")) != NULL)
   {
@@ -111,36 +117,41 @@ cupsCreateCredentials(
     DEBUG_printf(("1cupsCreateCredentials: Unable to create private key file \"%s\": %s", keyfile, strerror(errno)));
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
     gnutls_x509_privkey_deinit(key);
-    return (0);
+    return (false);
   }
 
-  // Create the self-signed certificate...
-  DEBUG_puts("1cupsCreateCredentials: Generating self-signed X.509 certificate.");
+  // Create the certificate...
+  DEBUG_puts("1cupsCreateCredentials: Generating X.509 certificate.");
 
-  language  = cupsLangDefault();
-  langname  = cupsLangGetName(language);
   curtime   = time(NULL);
   serial[0] = (unsigned char)(curtime >> 24);
   serial[1] = (unsigned char)(curtime >> 16);
   serial[2] = (unsigned char)(curtime >> 8);
   serial[3] = (unsigned char)(curtime);
 
+  if (!organization)
+    organization = common_name;
+  if (!org_unit)
+    org_unit = "";
+  if (!locality)
+    locality = "Unknown";
+  if (!state_province)
+    state_province = "Unknown";
+  if (!country)
+    country = "US";
+
   gnutls_x509_crt_init(&crt);
-  if (strlen(langname) == 5)
-    gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COUNTRY_NAME, 0, langname + 3, 2);
-  else
-    gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COUNTRY_NAME, 0, "US", 2);
+  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COUNTRY_NAME, 0, "US", 2);
   gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COMMON_NAME, 0, common_name, strlen(common_name));
-  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_ORGANIZATION_NAME, 0, common_name, strlen(common_name));
-  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME, 0, "Unknown", 7);
-  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0, "Unknown", 7);
-  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_LOCALITY_NAME, 0, "Unknown", 7);
-//  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_PKCS9_EMAIL, 0, ServerAdmin, strlen(ServerAdmin));
+  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_ORGANIZATION_NAME, 0, organization, strlen(organization));
+  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME, 0, org_unit, strlen(org_unit));
+  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0, state_province, strlen(state_province));
+  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_LOCALITY_NAME, 0, locality, strlen(locality));
   gnutls_x509_crt_set_key(crt, key);
   gnutls_x509_crt_set_serial(crt, serial, sizeof(serial));
   gnutls_x509_crt_set_activation_time(crt, curtime);
   gnutls_x509_crt_set_expiration_time(crt, expiration_date);
-  gnutls_x509_crt_set_ca_status(crt, 0);
+  gnutls_x509_crt_set_ca_status(crt, ca_cert ? 1 : 0);
   gnutls_x509_crt_set_subject_alt_name(crt, GNUTLS_SAN_DNSNAME, common_name, (unsigned)strlen(common_name), GNUTLS_FSAN_SET);
   if (!strchr(common_name, '.'))
   {
@@ -163,8 +174,38 @@ cupsCreateCredentials(
       }
     }
   }
-  gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_TLS_WWW_SERVER, 0);
-  gnutls_x509_crt_set_key_usage(crt, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT);
+
+  if (purpose & CUPS_CREDPURPOSE_SERVER_AUTH)
+    gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_TLS_WWW_SERVER, 0);
+  if (purpose & CUPS_CREDPURPOSE_CLIENT_AUTH)
+    gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_TLS_WWW_CLIENT, 0);
+  if (purpose & CUPS_CREDPURPOSE_CODE_SIGNING)
+    gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_CODE_SIGNING, 0);
+  if (purpose & CUPS_CREDPURPOSE_EMAIL_PROTECTION)
+    gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_EMAIL_PROTECTION, 0);
+  if (purpose & CUPS_CREDPURPOSE_OCSP_SIGNING)
+    gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_OCSP_SIGNING, 0);
+
+  if (usage & CUPS_CREDUSAGE_DIGITAL_SIGNATURE)
+    gnutls_usage |= GNUTLS_KEY_DIGITAL_SIGNATURE;
+  if (usage & CUPS_CREDUSAGE_NON_REPUDIATION)
+    gnutls_usage |= GNUTLS_KEY_NON_REPUDIATION;
+  if (usage & CUPS_CREDUSAGE_KEY_ENCIPHERMENT)
+    gnutls_usage |= GNUTLS_KEY_KEY_ENCIPHERMENT;
+  if (usage & CUPS_CREDUSAGE_DATA_ENCIPHERMENT)
+    gnutls_usage |= GNUTLS_KEY_DATA_ENCIPHERMENT;
+  if (usage & CUPS_CREDUSAGE_KEY_AGREEMENT)
+    gnutls_usage |= GNUTLS_KEY_KEY_AGREEMENT;
+  if (usage & CUPS_CREDUSAGE_KEY_CERT_SIGN)
+    gnutls_usage |= GNUTLS_KEY_KEY_CERT_SIGN;
+  if (usage & CUPS_CREDUSAGE_CRL_SIGN)
+    gnutls_usage |= GNUTLS_KEY_CRL_SIGN;
+  if (usage & CUPS_CREDUSAGE_ENCIPHER_ONLY)
+    gnutls_usage |= GNUTLS_KEY_ENCIPHER_ONLY;
+  if (usage & CUPS_CREDUSAGE_DECIPHER_ONLY)
+    gnutls_usage |= GNUTLS_KEY_DECIPHER_ONLY;
+ 
+  gnutls_x509_crt_set_key_usage(crt, gnutls_usage);
   gnutls_x509_crt_set_version(crt, 3);
 
   bytes = sizeof(buffer);
@@ -181,7 +222,7 @@ cupsCreateCredentials(
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
     gnutls_x509_crt_deinit(crt);
     gnutls_x509_privkey_deinit(key);
-    return (0);
+    return (false);
   }
   else if ((fp = cupsFileOpen(crtfile, "w")) != NULL)
   {
@@ -195,7 +236,7 @@ cupsCreateCredentials(
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
     gnutls_x509_crt_deinit(crt);
     gnutls_x509_privkey_deinit(key);
-    return (0);
+    return (false);
   }
 
   // Cleanup...
@@ -204,7 +245,48 @@ cupsCreateCredentials(
 
   DEBUG_puts("1cupsCreateCredentials: Successfully created credentials.");
 
-  return (1);
+  return (true);
+}
+
+
+//
+// 'cupsCreateCredentialsRequest()' - Make an X.509 Certificate Signing Request.
+//
+// This function creates an X.509 certificate signing request (CSR) and
+// associated private key.  The CSR and key are stored in the directory "path"
+// or, if "path" is `NULL`, in a per-user or system-wide (when running as root)
+// certificate/key store.
+//
+
+bool					// O - `true` on success, `false` on error
+cupsCreateCredentialsRequest(
+    const char         *path,		// I - Directory path for certificate/key store or `NULL` for default
+    cups_credpurpose_t purpose,		// I - Credential purposes
+    cups_credtype_t    type,		// I - Credential type
+    cups_credusage_t   usage,		// I - Credential usages
+    const char         *organization,	// I - Organization or `NULL` to use common name
+    const char         *org_unit,	// I - Organizational unit or `NULL` for none
+    const char         *locality,	// I - City/town or `NULL` for "Unknown"
+    const char         *state_province,	// I - State/province or `NULL` for "Unknown"
+    const char         *country,	// I - Country or `NULL` for locale-based default
+    const char         *common_name,	// I - Common name
+    size_t             num_alt_names,	// I - Number of subject alternate names
+    const char * const *alt_names)	// I - Subject Alternate Names
+{
+  (void)path;
+  (void)purpose;
+  (void)type;
+  (void)usage;
+  (void)organization;
+  (void)org_unit;
+  (void)locality;
+  (void)state_province;
+  (void)country;
+  (void)common_name;
+  (void)num_alt_names;
+  (void)alt_names;
+
+  return (false);
 }
 
 
@@ -213,7 +295,7 @@ cupsCreateCredentials(
 //                           an encrypted connection.
 //
 
-int					// O - Status of call (0 = success)
+bool					// O - `true` on success, `false` on failure
 httpCopyCredentials(
     http_t	 *http,			// I - Connection to server
     cups_array_t **credentials)		// O - Array of credentials
@@ -228,7 +310,7 @@ httpCopyCredentials(
     *credentials = NULL;
 
   if (!http || !http->tls || !credentials)
-    return (-1);
+    return (false);
 
   *credentials = cupsArrayNew(NULL, NULL, NULL, 0, NULL, NULL);
   certs        = gnutls_certificate_get_peers(http->tls, &count);
@@ -245,7 +327,7 @@ httpCopyCredentials(
     }
   }
 
-  return (0);
+  return (true);
 }
 
 
@@ -267,13 +349,13 @@ _httpCreateCredentials(
 // 'httpCredentialsAreValidForName()' - Return whether the credentials are valid for the given name.
 //
 
-int					// O - 1 if valid, 0 otherwise
+bool					// O - `true` if valid, `false` otherwise
 httpCredentialsAreValidForName(
     cups_array_t *credentials,		// I - Credentials
     const char   *common_name)		// I - Name to check
 {
   gnutls_x509_crt_t	cert;		// Certificate
-  int			result = 0;	// Result
+  bool			result = false;	// Result
 
 
   cert = gnutls_create_credential((http_credential_t *)cupsArrayGetFirst(credentials));
@@ -303,7 +385,7 @@ httpCredentialsAreValidForName(
         {
           if (cserial_size == rserial_size && !memcmp(cserial, rserial, rserial_size))
 	  {
-	    result = 0;
+	    result = false;
 	    break;
 	  }
 
@@ -738,11 +820,11 @@ gnutls_load_crl(void)
 
 
 //
-// 'gnutls_read()' - Read function for the GNU TLS library.
+// 'gnutls_http_read()' - Read function for the GNU TLS library.
 //
 
 static ssize_t				// O - Number of bytes read or -1 on error
-gnutls_read(
+gnutls_http_read(
     gnutls_transport_ptr_t ptr,		// I - Connection to server
     void                   *data,	// I - Buffer
     size_t                 length)	// I - Number of bytes to read
@@ -751,7 +833,7 @@ gnutls_read(
   ssize_t	bytes;			// Bytes read
 
 
-  DEBUG_printf(("5gnutls_read(ptr=%p, data=%p, length=%d)", ptr, data, (int)length));
+  DEBUG_printf(("5gnutls_http_read(ptr=%p, data=%p, length=%d)", ptr, data, (int)length));
 
   http = (http_t *)ptr;
 
@@ -769,17 +851,17 @@ gnutls_read(
   }
 
   bytes = recv(http->fd, data, length, 0);
-  DEBUG_printf(("5gnutls_read: bytes=%d", (int)bytes));
+  DEBUG_printf(("5gnutls_http_read: bytes=%d", (int)bytes));
   return (bytes);
 }
 
 
 //
-// 'gnutls_write()' - Write function for the GNU TLS library.
+// 'gnutls_http_write()' - Write function for the GNU TLS library.
 //
 
 static ssize_t				// O - Number of bytes written or -1 on error
-gnutls_write(
+gnutls_http_write(
     gnutls_transport_ptr_t ptr,		// I - Connection to server
     const void             *data,	// I - Data buffer
     size_t                 length)	// I - Number of bytes to write
@@ -787,10 +869,10 @@ gnutls_write(
   ssize_t bytes;			// Bytes written
 
 
-  DEBUG_printf(("5gnutls_write(ptr=%p, data=%p, length=%d)", ptr, data,
+  DEBUG_printf(("5gnutls_http_write(ptr=%p, data=%p, length=%d)", ptr, data,
                 (int)length));
   bytes = send(((http_t *)ptr)->fd, data, length, 0);
-  DEBUG_printf(("5gnutls_write: bytes=%d", (int)bytes));
+  DEBUG_printf(("5gnutls_http_write: bytes=%d", (int)bytes));
 
   return (bytes);
 }
@@ -1044,7 +1126,7 @@ _httpTLSStart(http_t *http)		// I - Connection to server
     {
       DEBUG_printf(("4_httpTLSStart: Auto-create credentials for \"%s\".", cn));
 
-      if (!cupsCreateCredentials(tls_keypath, cn, 0, NULL, time(NULL) + 3650 * 86400))
+      if (!cupsCreateCredentials(tls_keypath, false, CUPS_CREDPURPOSE_SERVER_AUTH, CUPS_CREDTYPE_DEFAULT, CUPS_CREDUSAGE_DEFAULT_TLS, NULL, NULL, NULL, NULL, NULL, cn, 0, NULL, NULL, time(NULL) + 3650 * 86400))
       {
 	DEBUG_puts("4_httpTLSStart: cupsCreateCredentials failed.");
 	http->error  = errno = EINVAL;
@@ -1132,11 +1214,11 @@ _httpTLSStart(http_t *http)		// I - Connection to server
 #endif // HAVE_GNUTLS_PRIORITY_SET_DIRECT
 
   gnutls_transport_set_ptr(http->tls, (gnutls_transport_ptr_t)http);
-  gnutls_transport_set_pull_function(http->tls, gnutls_read);
+  gnutls_transport_set_pull_function(http->tls, gnutls_http_read);
 #ifdef HAVE_GNUTLS_TRANSPORT_SET_PULL_TIMEOUT_FUNCTION
   gnutls_transport_set_pull_timeout_function(http->tls, (gnutls_pull_timeout_func)httpWait);
 #endif // HAVE_GNUTLS_TRANSPORT_SET_PULL_TIMEOUT_FUNCTION
-  gnutls_transport_set_push_function(http->tls, gnutls_write);
+  gnutls_transport_set_push_function(http->tls, gnutls_http_write);
 
   // Enforce a minimum timeout of 10 seconds for the TLS handshake...
   old_timeout  = http->timeout_value;

From 57d3a3d9bb7b79d19462fa240cb1284849b0f80f Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Tue, 16 May 2023 17:06:16 -0400
Subject: [PATCH 19/31] Implement root certificate/key support.

Ignore generated files.
---
 .gitignore        |  2 ++
 cups/tls-gnutls.c | 65 ++++++++++++++++++++++++++++++++++++++++++++---
 2 files changed, 63 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 61887bec7..9f46b6001 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,6 +9,7 @@
 /configure~
 /cups3.pc
 /Makedefs
+/cups/.testssl
 /cups/fuzzipp
 /cups/libcups.a
 /cups/libcups.dylib
@@ -23,6 +24,7 @@
 /cups/locale/
 /cups/rasterbench
 /cups/test.json
+/cups/test.log
 /cups/test.pwg
 /cups/test.raster
 /cups/testarray
diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index e1c9059e5..49cbe2a3a 100644
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -60,14 +60,18 @@ cupsCreateCredentials(
     const char         *root_name,	// I - Root certificate/domain name or `NULL` for site/self-signed
     time_t             expiration_date)	// I - Expiration date
 {
-  gnutls_x509_crt_t	crt;		// Self-signed certificate
+  gnutls_x509_crt_t	crt;		// New certificate
   gnutls_x509_privkey_t	key;		// Encryption private key
+  gnutls_x509_crt_t	root_crt = NULL;// Root certificate
+  gnutls_x509_privkey_t	root_key = NULL;// Root private key
   char			temp[1024],	// Temporary directory name
  			crtfile[1024],	// Certificate filename
-			keyfile[1024];	// Private key filename
+			keyfile[1024],	// Private key filename
+ 			*root_crtdata,	// Root certificate data
+			*root_keydata;	// Root private key data
   unsigned		gnutls_usage = 0;// GNU TLS keyUsage bits
   cups_file_t		*fp;		// Key/cert file
-  unsigned char		buffer[8192];	// Buffer for x509 data
+  unsigned char		buffer[65536];	// Buffer for x509 data
   size_t		bytes;		// Number of bytes of data
   unsigned char		serial[4];	// Serial number buffer
   time_t		curtime;	// Current time
@@ -212,7 +216,60 @@ cupsCreateCredentials(
   if (gnutls_x509_crt_get_key_id(crt, 0, buffer, &bytes) >= 0)
     gnutls_x509_crt_set_subject_key_id(crt, buffer, bytes);
 
-  gnutls_x509_crt_sign(crt, crt, key);
+  // Try loading a root certificate...
+  if (!ca_cert)
+  {
+    root_crtdata = cupsCopyCredentials(path, root_name ? root_name : "_site_");
+    root_keydata = cupsCopyCredentialsKey(path, root_name ? root_name : "_site_");
+
+    if (root_crtdata && root_keydata)
+    {
+      // Load root certificate...
+      gnutls_datum_t    datum;          // Datum for cert/key
+
+      datum.data = (unsigned char *)root_crtdata;
+      datum.size = strlen(root_crtdata);
+
+      gnutls_x509_crt_init(&root_crt);
+      if (gnutls_x509_crt_import(root_crt, &datum, GNUTLS_X509_FMT_PEM) < 0)
+      {
+        // No good, clear it...
+        gnutls_x509_crt_deinit(root_crt);
+        root_crt = NULL;
+      }
+      else
+      {
+        // Load root private key...
+        datum.data = (unsigned char *)root_keydata;
+        datum.size = strlen(root_keydata);
+
+        gnutls_x509_privkey_init(&root_key);
+        if (gnutls_x509_privkey_import(root_key, &datum, GNUTLS_X509_FMT_PEM) < 0)
+        {
+          // No food, clear them...
+          gnutls_x509_privkey_deinit(root_key);
+          root_key = NULL;
+
+          gnutls_x509_crt_deinit(root_crt);
+          root_crt = NULL;
+        }
+      }
+    }
+
+    free(root_crtdata);
+    free(root_keydata);
+  }
+
+  if (root_crt && root_key)
+  {
+    gnutls_x509_crt_sign(crt, root_crt, root_key);
+    gnutls_x509_crt_deinit(root_crt);
+    gnutls_x509_privkey_deinit(root_key);
+  }
+  else
+  {
+    gnutls_x509_crt_sign(crt, crt, key);
+  }
 
   // Save it...
   bytes = sizeof(buffer);

From 41255a85e9ffbc04b7d2272aa364ef7d4d3233d2 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Thu, 18 May 2023 10:13:31 -0400
Subject: [PATCH 20/31] Add GNU TLS CSR generation, clean up CRT generation.

---
 cups/tls-gnutls.c | 219 +++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 188 insertions(+), 31 deletions(-)

diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index 49cbe2a3a..328fc54df 100644
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -60,8 +60,9 @@ cupsCreateCredentials(
     const char         *root_name,	// I - Root certificate/domain name or `NULL` for site/self-signed
     time_t             expiration_date)	// I - Expiration date
 {
-  gnutls_x509_crt_t	crt;		// New certificate
-  gnutls_x509_privkey_t	key;		// Encryption private key
+  bool			ret = false;	// Return value
+  gnutls_x509_crt_t	crt = NULL;	// New certificate
+  gnutls_x509_privkey_t	key = NULL;	// Encryption private key
   gnutls_x509_crt_t	root_crt = NULL;// Root certificate
   gnutls_x509_privkey_t	root_key = NULL;// Root private key
   char			temp[1024],	// Temporary directory name
@@ -87,7 +88,7 @@ cupsCreateCredentials(
   if (!path || !common_name)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(EINVAL), 0);
-    return (false);
+    goto done;
   }
 
   http_make_path(crtfile, sizeof(crtfile), path, common_name, "crt");
@@ -107,8 +108,7 @@ cupsCreateCredentials(
   {
     DEBUG_printf(("1cupsCreateCredentials: Unable to export private key: %s", gnutls_strerror(result)));
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
-    gnutls_x509_privkey_deinit(key);
-    return (false);
+    goto done;
   }
   else if ((fp = cupsFileOpen(keyfile, "w")) != NULL)
   {
@@ -120,8 +120,7 @@ cupsCreateCredentials(
   {
     DEBUG_printf(("1cupsCreateCredentials: Unable to create private key file \"%s\": %s", keyfile, strerror(errno)));
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
-    gnutls_x509_privkey_deinit(key);
-    return (false);
+    goto done;
   }
 
   // Create the certificate...
@@ -277,9 +276,7 @@ cupsCreateCredentials(
   {
     DEBUG_printf(("1cupsCreateCredentials: Unable to export public key and X.509 certificate: %s", gnutls_strerror(result)));
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
-    gnutls_x509_crt_deinit(crt);
-    gnutls_x509_privkey_deinit(key);
-    return (false);
+    goto done;
   }
   else if ((fp = cupsFileOpen(crtfile, "w")) != NULL)
   {
@@ -291,18 +288,22 @@ cupsCreateCredentials(
   {
     DEBUG_printf(("1cupsCreateCredentials: Unable to create public key and X.509 certificate file \"%s\": %s", crtfile, strerror(errno)));
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
-    gnutls_x509_crt_deinit(crt);
-    gnutls_x509_privkey_deinit(key);
-    return (false);
+    goto done;
   }
 
+  DEBUG_puts("1cupsCreateCredentials: Successfully created credentials.");
+
+  ret = true;
+
   // Cleanup...
-  gnutls_x509_crt_deinit(crt);
-  gnutls_x509_privkey_deinit(key);
+  done:
 
-  DEBUG_puts("1cupsCreateCredentials: Successfully created credentials.");
+  if (crt)
+    gnutls_x509_crt_deinit(crt);
+  if (key)
+    gnutls_x509_privkey_deinit(key);
 
-  return (true);
+  return (ret);
 }
 
 
@@ -330,20 +331,176 @@ cupsCreateCredentialsRequest(
     size_t             num_alt_names,	// I - Number of subject alternate names
     const char * const *alt_names)	// I - Subject Alternate Names
 {
-  (void)path;
-  (void)purpose;
-  (void)type;
-  (void)usage;
-  (void)organization;
-  (void)org_unit;
-  (void)locality;
-  (void)state_province;
-  (void)country;
-  (void)common_name;
-  (void)num_alt_names;
-  (void)alt_names;
-
-  return (false);
+  bool			ret = false;	// Return value
+  gnutls_x509_crq_t	crq = NULL;	// Certificate request
+  gnutls_x509_privkey_t	key = NULL;	// Private/public key pair
+  char			temp[1024],	// Temporary directory name
+ 			csrfile[1024],	// Certificate signing request filename
+			keyfile[1024];	// Private key filename
+  unsigned		gnutls_usage = 0;// GNU TLS keyUsage bits
+  cups_file_t		*fp;		// Key/cert file
+  unsigned char		buffer[8192];	// Buffer for key/cert data
+  size_t		bytes;		// Number of bytes of data
+  int			status;		// GNU TLS status
+
+
+  DEBUG_printf(("cupsCreateCredentialsRequest(path=\"%s\", purpose=0x%x, type=%d, usage=0x%x, organization=\"%s\", org_unit=\"%s\", locality=\"%s\", state_province=\"%s\", country=\"%s\", common_name=\"%s\", num_alt_names=%u, alt_names=%p)", path, purpose, type, usage, organization, org_unit, locality, state_province, country, common_name, (unsigned)num_alt_names, alt_names));
+
+  // Filenames...
+  if (!path)
+    path = http_default_path(temp, sizeof(temp));
+
+  if (!path || !common_name)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(EINVAL), 0);
+    goto done;
+  }
+
+  http_make_path(csrfile, sizeof(csrfile), path, common_name, "csr");
+  http_make_path(keyfile, sizeof(keyfile), path, common_name, "key");
+
+  // Create the encryption key...
+  DEBUG_puts("1cupsCreateCredentialsRequest: Creating key pair.");
+
+  key = gnutls_create_key(type);
+
+  DEBUG_puts("1cupsCreateCredentialsRequest: Key pair created.");
+
+  // Save it...
+  bytes = sizeof(buffer);
+
+  if ((result = gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
+  {
+    DEBUG_printf(("1cupsCreateCredentialsRequest: Unable to export private key: %s", gnutls_strerror(result)));
+    goto done;
+  }
+  else if ((fp = cupsFileOpen(keyfile, "w")) != NULL)
+  {
+    DEBUG_printf(("1cupsCreateCredentialsRequest: Writing private key to \"%s\".", keyfile));
+    cupsFileWrite(fp, (char *)buffer, bytes);
+    cupsFileClose(fp);
+  }
+  else
+  {
+    DEBUG_printf(("1cupsCreateCredentialsRequest: Unable to create private key file \"%s\": %s", keyfile, strerror(errno)));
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
+    goto done;
+  }
+
+  // Create the certificate...
+  DEBUG_puts("1cupsCreateCredentialsRequest: Generating X.509 certificate request.");
+
+  if (!organization)
+    organization = common_name;
+  if (!org_unit)
+    org_unit = "";
+  if (!locality)
+    locality = "Unknown";
+  if (!state_province)
+    state_province = "Unknown";
+  if (!country)
+    country = "US";
+
+  gnutls_x509_crq_init(&crq);
+  gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_COUNTRY_NAME, 0, country, (unsigned)strlen(country));
+  gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_COMMON_NAME, 0, hostname, (unsigned)strlen(hostname));
+  gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_ORGANIZATION_NAME, 0, organization, (unsigned)strlen(organization));
+  gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME, 0, org_unit, (unsigned)strlen(org_unit));
+  gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0, state_province, (unsigned)strlen(state_province));
+  gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_LOCALITY_NAME, 0, locality, (unsigned)strlen(locality));
+  gnutls_x509_crq_set_key(crq, key);
+  gnutls_x509_crq_set_subject_alt_name(crq, GNUTLS_SAN_DNSNAME, common_name, (unsigned)strlen(common_name), GNUTLS_FSAN_SET);
+  if (!strchr(common_name, '.'))
+  {
+    // Add common_name.local to the list, too...
+    char localname[256];                // hostname.local
+
+    snprintf(localname, sizeof(localname), "%s.local", common_name);
+    gnutls_x509_crq_set_subject_alt_name(crq, GNUTLS_SAN_DNSNAME, localname, (unsigned)strlen(localname), GNUTLS_FSAN_APPEND);
+  }
+  gnutls_x509_crq_set_subject_alt_name(crq, GNUTLS_SAN_DNSNAME, "localhost", 9, GNUTLS_FSAN_APPEND);
+  if (num_alt_names > 0)
+  {
+    size_t i;				// Looping var
+
+    for (i = 0; i < num_alt_names; i ++)
+    {
+      if (strcmp(alt_names[i], "localhost"))
+      {
+        gnutls_x509_crq_set_subject_alt_name(crq, GNUTLS_SAN_DNSNAME, alt_names[i], (unsigned)strlen(alt_names[i]), GNUTLS_FSAN_APPEND);
+      }
+    }
+  }
+
+  if (purpose & CUPS_CREDPURPOSE_SERVER_AUTH)
+    gnutls_x509_crq_set_key_purpose_oid(crq, GNUTLS_KP_TLS_WWW_SERVER, 0);
+  if (purpose & CUPS_CREDPURPOSE_CLIENT_AUTH)
+    gnutls_x509_crq_set_key_purpose_oid(crq, GNUTLS_KP_TLS_WWW_CLIENT, 0);
+  if (purpose & CUPS_CREDPURPOSE_CODE_SIGNING)
+    gnutls_x509_crq_set_key_purpose_oid(crq, GNUTLS_KP_CODE_SIGNING, 0);
+  if (purpose & CUPS_CREDPURPOSE_EMAIL_PROTECTION)
+    gnutls_x509_crq_set_key_purpose_oid(crq, GNUTLS_KP_EMAIL_PROTECTION, 0);
+  if (purpose & CUPS_CREDPURPOSE_OCSP_SIGNING)
+    gnutls_x509_crq_set_key_purpose_oid(crq, GNUTLS_KP_OCSP_SIGNING, 0);
+
+  if (usage & CUPS_CREDUSAGE_DIGITAL_SIGNATURE)
+    gnutls_usage |= GNUTLS_KEY_DIGITAL_SIGNATURE;
+  if (usage & CUPS_CREDUSAGE_NON_REPUDIATION)
+    gnutls_usage |= GNUTLS_KEY_NON_REPUDIATION;
+  if (usage & CUPS_CREDUSAGE_KEY_ENCIPHERMENT)
+    gnutls_usage |= GNUTLS_KEY_KEY_ENCIPHERMENT;
+  if (usage & CUPS_CREDUSAGE_DATA_ENCIPHERMENT)
+    gnutls_usage |= GNUTLS_KEY_DATA_ENCIPHERMENT;
+  if (usage & CUPS_CREDUSAGE_KEY_AGREEMENT)
+    gnutls_usage |= GNUTLS_KEY_KEY_AGREEMENT;
+  if (usage & CUPS_CREDUSAGE_KEY_CERT_SIGN)
+    gnutls_usage |= GNUTLS_KEY_KEY_CERT_SIGN;
+  if (usage & CUPS_CREDUSAGE_CRL_SIGN)
+    gnutls_usage |= GNUTLS_KEY_CRL_SIGN;
+  if (usage & CUPS_CREDUSAGE_ENCIPHER_ONLY)
+    gnutls_usage |= GNUTLS_KEY_ENCIPHER_ONLY;
+  if (usage & CUPS_CREDUSAGE_DECIPHER_ONLY)
+    gnutls_usage |= GNUTLS_KEY_DECIPHER_ONLY;
+
+  gnutls_x509_crq_set_key_usage(crq, gnutls_usage);
+  gnutls_x509_crq_set_version(crq, 3);
+
+  gnutls_x509_crq_sign2(crq, key, GNUTLS_DIG_SHA256, 0);
+
+  // Save it...
+  bytes = sizeof(buffer);
+  if ((result = gnutls_x509_crq_export(crq, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
+  {
+    DEBUG_printf(("1cupsCreateCredentialsRequest: Unable to export public key and X.509 certificate request: %s", gnutls_strerror(result)));
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
+    goto done;
+  }
+  else if ((fp = cupsFileOpen(crqfile, "w")) != NULL)
+  {
+    DEBUG_printf(("1cupsCreateCredentialsRequest: Writing public key and X.509 certificate request to \"%s\".", crtfile));
+    cupsFileWrite(fp, (char *)buffer, bytes);
+    cupsFileClose(fp);
+  }
+  else
+  {
+    DEBUG_printf(("1cupsCreateCredentialsRequest: Unable to create public key and X.509 certificate request file \"%s\": %s", crtfile, strerror(errno)));
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
+    goto done;
+  }
+
+  DEBUG_puts("1cupsCreateCredentialsRequest: Successfully created credentials request.");
+
+  ret = true;
+
+  // Cleanup...
+  done:
+
+  if (crq)
+    gnutls_x509_crq_deinit(crq);
+  if (key)
+    gnutls_x509_privkey_deinit(key);
+
+  return (ret);
 }
 
 

From 97e2b7c7b96476598902cc4e1677ec54b4054be2 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Thu, 18 May 2023 10:16:49 -0400
Subject: [PATCH 21/31] Fix typos in new CSR code.

---
 cups/tls-gnutls.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index 328fc54df..1fd158c6f 100644
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -341,7 +341,7 @@ cupsCreateCredentialsRequest(
   cups_file_t		*fp;		// Key/cert file
   unsigned char		buffer[8192];	// Buffer for key/cert data
   size_t		bytes;		// Number of bytes of data
-  int			status;		// GNU TLS status
+  int			result;		// GNU TLS status
 
 
   DEBUG_printf(("cupsCreateCredentialsRequest(path=\"%s\", purpose=0x%x, type=%d, usage=0x%x, organization=\"%s\", org_unit=\"%s\", locality=\"%s\", state_province=\"%s\", country=\"%s\", common_name=\"%s\", num_alt_names=%u, alt_names=%p)", path, purpose, type, usage, organization, org_unit, locality, state_province, country, common_name, (unsigned)num_alt_names, alt_names));
@@ -403,7 +403,7 @@ cupsCreateCredentialsRequest(
 
   gnutls_x509_crq_init(&crq);
   gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_COUNTRY_NAME, 0, country, (unsigned)strlen(country));
-  gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_COMMON_NAME, 0, hostname, (unsigned)strlen(hostname));
+  gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_COMMON_NAME, 0, common_name, (unsigned)strlen(common_name));
   gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_ORGANIZATION_NAME, 0, organization, (unsigned)strlen(organization));
   gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME, 0, org_unit, (unsigned)strlen(org_unit));
   gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0, state_province, (unsigned)strlen(state_province));
@@ -475,15 +475,15 @@ cupsCreateCredentialsRequest(
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
     goto done;
   }
-  else if ((fp = cupsFileOpen(crqfile, "w")) != NULL)
+  else if ((fp = cupsFileOpen(csrfile, "w")) != NULL)
   {
-    DEBUG_printf(("1cupsCreateCredentialsRequest: Writing public key and X.509 certificate request to \"%s\".", crtfile));
+    DEBUG_printf(("1cupsCreateCredentialsRequest: Writing public key and X.509 certificate request to \"%s\".", csrfile));
     cupsFileWrite(fp, (char *)buffer, bytes);
     cupsFileClose(fp);
   }
   else
   {
-    DEBUG_printf(("1cupsCreateCredentialsRequest: Unable to create public key and X.509 certificate request file \"%s\": %s", crtfile, strerror(errno)));
+    DEBUG_printf(("1cupsCreateCredentialsRequest: Unable to create public key and X.509 certificate request file \"%s\": %s", csrfile, strerror(errno)));
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
     goto done;
   }

From 6227ff60a6f31d8a2811b9b2a0c4f68372c26cc5 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Thu, 25 May 2023 07:10:12 -0400
Subject: [PATCH 22/31] Save work.

---
 cups/cups.h        |   8 +-
 cups/testcreds.c   |  33 +++++--
 cups/tls-openssl.c | 210 +++++++++++++++++++++++++++++++++++++++------
 3 files changed, 217 insertions(+), 34 deletions(-)

diff --git a/cups/cups.h b/cups/cups.h
index 940def6e0..304938fc3 100644
--- a/cups/cups.h
+++ b/cups/cups.h
@@ -140,7 +140,8 @@ enum cups_credpurpose_e			//// X.509 credential purposes
   CUPS_CREDPURPOSE_CODE_SIGNING = 0x04,		// codeSigning
   CUPS_CREDPURPOSE_EMAIL_PROTECTION = 0x08,	// emailProtection
   CUPS_CREDPURPOSE_TIME_STAMPING = 0x10,	// timeStamping
-  CUPS_CREDPURPOSE_OCSP_SIGNING = 0x20		// OCSPSigning
+  CUPS_CREDPURPOSE_OCSP_SIGNING = 0x20,		// OCSPSigning
+  CUPS_CREDPURPOSE_ALL = 0x3f			// All purposes
 };
 typedef unsigned cups_credpurpose_t;	//// Combined X.509 credential purposes for @link cupsCreateCredentials@ and @link cupsCreateCredentialsRequest@
 
@@ -167,7 +168,8 @@ enum cups_credusage_e			//// X.509 keyUsage flags
   CUPS_CREDUSAGE_ENCIPHER_ONLY = 0x080,		// encipherOnly
   CUPS_CREDUSAGE_DECIPHER_ONLY = 0x100,		// decipherOnly
   CUPS_CREDUSAGE_DEFAULT_CA = 0x061,		// Defaults for CA certs
-  CUPS_CREDUSAGE_DEFAULT_TLS = 0x005		// Defaults for TLS certs
+  CUPS_CREDUSAGE_DEFAULT_TLS = 0x005,		// Defaults for TLS certs
+  CUPS_CREDUSAGE_ALL = 0x1ff			// All keyUsage flags
 };
 typedef unsigned cups_credusage_t;	//// Combined X.509 keyUsage flags for @link cupsCreateCredentials@ and @link cupsCreateCredentialsRequest@
 
@@ -398,7 +400,7 @@ extern void		cupsSetServerCertCB(cups_server_cert_cb_t cb, void *user_data) _CUP
 extern bool		cupsSetServerCredentials(const char *path, const char *common_name, bool auto_create) _CUPS_PUBLIC;
 extern void		cupsSetUser(const char *user) _CUPS_PUBLIC;
 extern void		cupsSetUserAgent(const char *user_agent) _CUPS_PUBLIC;
-extern bool		cupsSignCredentialsRequest(const char *path, const char *common_name, const char *request, const char *root_name, time_t expiration_date) _CUPS_PUBLIC;
+extern bool		cupsSignCredentialsRequest(const char *path, const char *common_name, const char *request, const char *root_name, cups_credpurpose_t allowed_purpose, cups_credusage_t allowed_usage, const char *allowed_domain, time_t expiration_date) _CUPS_PUBLIC;
 extern http_status_t	cupsStartDestDocument(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, int job_id, const char *docname, const char *format, size_t num_options, cups_option_t *options, bool last_document) _CUPS_PUBLIC;
 extern int		cupsTempFd(const char *prefix, const char *suffix, char *filename, size_t len) _CUPS_PUBLIC;
 extern cups_file_t	*cupsTempFile(const char *prefix, const char *suffix, char *filename, size_t len) _CUPS_PUBLIC;
diff --git a/cups/testcreds.c b/cups/testcreds.c
index f4f2ccc6e..39b292605 100644
--- a/cups/testcreds.c
+++ b/cups/testcreds.c
@@ -438,20 +438,39 @@ do_unit_tests(void)
     else
       testEndMessage(false, "%s", cupsLastErrorString());
 
-    testBegin("cupsCreateCredentialsRequest(printer, %s, alt names)", types[type]);
-    if (cupsCreateCredentialsRequest(TEST_CERT_PATH, CUPS_CREDPURPOSE_SERVER_AUTH, type, CUPS_CREDUSAGE_DEFAULT_TLS, "Organization", "Unit", "Locality", "Ontario", "CA", "printer", sizeof(alt_names) / sizeof(alt_names[0]), alt_names))
+    testBegin("cupsCreateCredentialsRequest(altprinter, %s, alt names)", types[type]);
+    if (cupsCreateCredentialsRequest(TEST_CERT_PATH, CUPS_CREDPURPOSE_SERVER_AUTH, type, CUPS_CREDUSAGE_DEFAULT_TLS, "Organization", "Unit", "Locality", "Ontario", "CA", "altprinter", sizeof(alt_names) / sizeof(alt_names[0]), alt_names))
     {
       testEnd(true);
 
-      testBegin("cupsCopyCredentialsRequest(printer)");
-      data = cupsCopyCredentialsRequest(TEST_CERT_PATH, "printer");
+      testBegin("cupsCopyCredentialsKey(altprinter)");
+      data = cupsCopyCredentialsKey(TEST_CERT_PATH, "altprinter");
       testEnd(data != NULL);
       free(data);
 
-      testBegin("cupsCopyCredentialsKey(printer)");
-      data = cupsCopyCredentialsKey(TEST_CERT_PATH, "printer");
+      testBegin("cupsCopyCredentialsRequest(altprinter)");
+      data = cupsCopyCredentialsRequest(TEST_CERT_PATH, "altprinter");
       testEnd(data != NULL);
-      free(data);
+
+      if (data)
+      {
+        testBegin("cupsSignCredentialsRequest(altprinter)");
+        if (cupsSignCredentialsRequest(TEST_CERT_PATH, "altprinter", data, "_site_", CUPS_CREDPURPOSE_ALL, CUPS_CREDUSAGE_ALL, /*allowed_domain*/NULL, time(NULL) + 30 * 86400))
+        {
+          testEnd(true);
+	  free(data);
+
+	  testBegin("cupsCopyCredentialsKey(altprinter)");
+	  data = cupsCopyCredentialsKey(TEST_CERT_PATH, "altprinter");
+	  testEnd(data != NULL);
+        }
+        else
+        {
+	  testEndMessage(false, "%s", cupsLastErrorString());
+        }
+
+        free(data);
+      }
     }
     else
     {
diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index 0adaf6be6..4c88e6920 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -102,8 +102,11 @@ cupsCreateCredentials(
   X509		*cert;			// Certificate
   X509		*root_cert = NULL;	// Root certificate, if any
   EVP_PKEY	*root_key = NULL;	// Root private key, if any
-  char		root_crtfile[1024],	// Path to root certificate
-		root_keyfile[1024];	// Path to root private key
+  char		defpath[1024],		// Default path
+ 		crtfile[1024],		// Certificate filename
+		keyfile[1024],		// Private key filename
+		root_crtfile[1024],	// Root certificate filename
+		root_keyfile[1024];	// Root private key filename
   time_t	curtime;		// Current time
   X509_NAME	*name;			// Subject/issuer name
   ASN1_INTEGER	*serial;		// Serial number
@@ -111,9 +114,7 @@ cupsCreateCredentials(
 		*notAfter;		// Expiration date
   BIO		*bio;			// Output file
   char		temp[1024],		// Temporary string
-		*tempptr,		// Pointer into temporary string
- 		crtfile[1024],		// Certificate filename
-		keyfile[1024];		// Private key filename
+		*tempptr;		// Pointer into temporary string
   STACK_OF(X509_EXTENSION) *exts;	// Extensions
   X509_EXTENSION *ext;			// Current extension
   unsigned	i;			// Looping var
@@ -125,7 +126,7 @@ cupsCreateCredentials(
 
   // Filenames...
   if (!path)
-    path = http_default_path(temp, sizeof(temp));
+    path = http_default_path(defpath, sizeof(defpath));
 
   if (!path || !common_name)
   {
@@ -133,9 +134,6 @@ cupsCreateCredentials(
     return (false);
   }
 
-  http_make_path(crtfile, sizeof(crtfile), path, common_name, "crt");
-  http_make_path(keyfile, sizeof(keyfile), path, common_name, "key");
-
   // Create the encryption key...
   DEBUG_puts("1cupsCreateCredentials: Creating key pair.");
 
@@ -145,7 +143,7 @@ cupsCreateCredentials(
   DEBUG_puts("1cupsCreateCredentials: Key pair created.");
 
   // Create the X.509 certificate...
-  DEBUG_puts("1cupsCreateCredentials: Generating self-signed X.509 certificate.");
+  DEBUG_puts("1cupsCreateCredentials: Generating X.509 certificate.");
 
   if ((cert = X509_new()) == NULL)
   {
@@ -173,6 +171,10 @@ cupsCreateCredentials(
 
   X509_set_pubkey(cert, pkey);
 
+  name = openssl_create_name(organization, org_unit, locality, state_province, country, common_name);
+
+  X509_set_subject_name(cert, name);
+
   // Try loading a root certificate...
   http_make_path(root_crtfile, sizeof(root_crtfile), path, root_name ? root_name : "_site_", "crt");
   http_make_path(root_keyfile, sizeof(root_keyfile), path, root_name ? root_name : "_site_", "key");
@@ -198,15 +200,18 @@ cupsCreateCredentials(
       }
     }
 
+    if (!root_cert || !root_key)
+    {
+      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to load X.509 CA certificate and private key."), 1);
+      goto done;
+    }
   }
 
-  name = openssl_create_name(organization, org_unit, locality, state_province, country, common_name);
-
   if (root_cert)
     X509_set_issuer_name(cert, X509_get_subject_name(root_cert));
   else
     X509_set_issuer_name(cert, name);
-  X509_set_subject_name(cert, name);
+
   X509_NAME_free(name);
 
   exts = sk_X509_EXTENSION_new_null();
@@ -267,6 +272,9 @@ cupsCreateCredentials(
     X509_sign(cert, pkey, EVP_sha256());
 
   // Save them...
+  http_make_path(crtfile, sizeof(crtfile), path, common_name, "crt");
+  http_make_path(keyfile, sizeof(keyfile), path, common_name, "key");
+
   if ((bio = BIO_new_file(keyfile, "wb")) == NULL)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
@@ -487,19 +495,173 @@ cupsCreateCredentialsRequest(
 
 bool					// O - `true` on success, `false` on failure
 cupsSignCredentialsRequest(
-    const char *path,			// I - Directory path for certificate/key store or `NULL` for default
-    const char *common_name,		// I - Common name to use
-    const char *request,		// I - PEM-encoded CSR
-    const char *root_name,		// I - Root certificate
-    time_t     expiration_date)		// I - Certificate expiration date
+    const char         *path,		// I - Directory path for certificate/key store or `NULL` for default
+    const char         *common_name,	// I - Common name to use
+    const char         *request,	// I - PEM-encoded CSR
+    const char         *root_name,	// I - Root certificate
+    cups_credpurpose_t allowed_purpose,	// I - Allowed credential purpose(s)
+    cups_credusage_t   allowed_usage,	// I - Allowed credential usage(s)
+    const char         *allowed_domain,	// I - Allowed domain name (beyond .local) or `NULL` for just .local
+    time_t             expiration_date)	// I - Certificate expiration date
 {
-  (void)path;
-  (void)common_name;
-  (void)request;
-  (void)root_name;
-  (void)expiration_date;
+  bool		result = false;		// Return value
+  X509		*cert = NULL;		// Certificate
+  X509_REQ	*crq = NULL;		// Certificate request
+  X509		*root_cert = NULL;	// Root certificate, if any
+  EVP_PKEY	*root_key = NULL;	// Root private key, if any
+  char		defpath[1024],		// Default path
+		crtfile[1024],		// Certificate filename
+		root_crtfile[1024],	// Root certificate filename
+		root_keyfile[1024];	// Root private key filename
+  time_t	curtime;		// Current time
+  ASN1_INTEGER	*serial;		// Serial number
+  ASN1_TIME	*notBefore,		// Initial date
+		*notAfter;		// Expiration date
+  BIO		*bio;			// Output file
+#if 0
+  char		temp[1024],		// Temporary string
+		*tempptr;		// Pointer into temporary string
+  STACK_OF(X509_EXTENSION) *exts;	// Extensions
+  X509_EXTENSION *ext;			// Current extension
+  unsigned	i;			// Looping var
+  cups_credpurpose_t purpose_bit;	// Current purpose
+  cups_credusage_t usage_bit;		// Current usage
+#endif // 0
+
+
+  DEBUG_printf(("cupsSignCredentialsRequest(path=\"%s\", common_name=\"%s\", request=\"%s\", root_name=\"%s\", allowed_purpose=0x%x, allowed_usage=0x%x, allowed_domain=\"%s\", expiration_date=%ld)", path, common_name, request, root_name, allowed_purpose, allowed_usage, allowed_domain, (long)expiration_date));
+
+  // Filenames...
+  if (!path)
+    path = http_default_path(defpath, sizeof(defpath));
+
+  if (!path || !common_name || !request)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(EINVAL), 0);
+    return (false);
+  }
+
+  // Import the X.509 certificate request...
+  DEBUG_puts("1cupsCreateCredentials: Importing X.509 certificate request.");
+  if ((bio = BIO_new_mem_buf(request, (int)strlen(request))) != NULL)
+  {
+    PEM_read_bio_X509_REQ(bio, &crq, /*cb*/NULL, /*u*/NULL);
+    BIO_free(bio);
+  }
+
+  if (!crq)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to import X.509 certificate request."), 1);
+    return (false);
+  }
+
+  if (X509_REQ_verify(crq, X509_REQ_get_pubkey(crq)) < 0)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to verify X.509 certificate request."), 1);
+    goto done;
+  }
+
+  // Create the X.509 certificate...
+  DEBUG_puts("1cupsSignCredentialsRequest: Generating X.509 certificate.");
 
-  return (false);
+  if ((cert = X509_new()) == NULL)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create X.509 certificate."), 1);
+    goto done;
+  }
+
+  curtime = time(NULL);
+
+  notBefore = ASN1_TIME_new();
+  ASN1_TIME_set(notBefore, curtime);
+  X509_set_notBefore(cert, notBefore);
+  ASN1_TIME_free(notBefore);
+
+  notAfter  = ASN1_TIME_new();
+  ASN1_TIME_set(notAfter, expiration_date);
+  X509_set_notAfter(cert, notAfter);
+  ASN1_TIME_free(notAfter);
+
+  serial = ASN1_INTEGER_new();
+  ASN1_INTEGER_set(serial, (int)curtime);
+  X509_set_serialNumber(cert, serial);
+  ASN1_INTEGER_free(serial);
+
+  X509_set_pubkey(cert, X509_REQ_get_pubkey(crq));
+
+  X509_set_issuer_name(cert, X509_get_subject_name(root_cert));
+  X509_set_subject_name(cert, X509_REQ_get_subject_name(crq));
+  X509_set_version(cert, 2); // v3
+
+  // Try loading a root certificate...
+  http_make_path(root_crtfile, sizeof(root_crtfile), path, root_name ? root_name : "_site_", "crt");
+  http_make_path(root_keyfile, sizeof(root_keyfile), path, root_name ? root_name : "_site_", "key");
+
+  if (!access(root_crtfile, 0) && !access(root_keyfile, 0))
+  {
+    if ((bio = BIO_new_file(root_crtfile, "rb")) != NULL)
+    {
+      PEM_read_bio_X509(bio, &root_cert, /*cb*/NULL, /*u*/NULL);
+      BIO_free(bio);
+
+      if ((bio = BIO_new_file(root_keyfile, "rb")) != NULL)
+      {
+	PEM_read_bio_PrivateKey(bio, &root_key, /*cb*/NULL, /*u*/NULL);
+	BIO_free(bio);
+      }
+
+      if (!root_key)
+      {
+        // Only use root certificate if we have the key...
+        X509_free(root_cert);
+        root_cert = NULL;
+      }
+    }
+  }
+
+  if (!root_cert || !root_key)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to load X.509 CA certificate and private key."), 1);
+    goto done;
+  }
+
+  X509_sign(cert, root_key, EVP_sha256());
+
+  // Save the certificate...
+  http_make_path(crtfile, sizeof(crtfile), path, common_name, "crt");
+
+  if ((bio = BIO_new_file(crtfile, "wb")) == NULL)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
+    goto done;
+  }
+
+  if (!PEM_write_bio_X509(bio, cert))
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to write X.509 certificate."), 1);
+    BIO_free(bio);
+    goto done;
+  }
+
+  PEM_write_bio_X509(bio, root_cert);
+
+  BIO_free(bio);
+  result = true;
+  DEBUG_puts("1cupsSignRequest: Successfully created credentials.");
+
+  // Cleanup...
+  done:
+
+  if (crq)
+    X509_REQ_free(crq);
+  if (cert)
+    X509_free(cert);
+  if (root_cert)
+    X509_free(root_cert);
+  if (root_key)
+    EVP_PKEY_free(root_key);
+
+  return (result);
 }
 
 

From 79af0a94ff17230aef93e002faa7ace22e92b1aa Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Thu, 25 May 2023 13:14:27 -0400
Subject: [PATCH 23/31] Copy extensions from request to certificate.

Add callback for validating subjectAltName.

TODO: Still need to validate extensions.
---
 cups/cups.h        |  5 +++-
 cups/testcreds.c   |  2 +-
 cups/tls-openssl.c | 62 ++++++++++++++++++++++++++++++++--------------
 3 files changed, 49 insertions(+), 20 deletions(-)

diff --git a/cups/cups.h b/cups/cups.h
index 304938fc3..ccb035a3e 100644
--- a/cups/cups.h
+++ b/cups/cups.h
@@ -283,6 +283,9 @@ typedef struct cups_size_s		//// Media information
 		top;			// Top margin in hundredths of millimeters
 } cups_size_t;
 
+typedef bool (*cups_cert_sign_cb_t)(const char *subject_alt_name, void *user_data);
+					// Certificate signing subjectAltName callback
+
 typedef bool (*cups_client_cert_cb_t)(http_t *http, void *tls, cups_array_t *distinguished_names, void *user_data);
 					// Client credentials callback
 
@@ -400,7 +403,7 @@ extern void		cupsSetServerCertCB(cups_server_cert_cb_t cb, void *user_data) _CUP
 extern bool		cupsSetServerCredentials(const char *path, const char *common_name, bool auto_create) _CUPS_PUBLIC;
 extern void		cupsSetUser(const char *user) _CUPS_PUBLIC;
 extern void		cupsSetUserAgent(const char *user_agent) _CUPS_PUBLIC;
-extern bool		cupsSignCredentialsRequest(const char *path, const char *common_name, const char *request, const char *root_name, cups_credpurpose_t allowed_purpose, cups_credusage_t allowed_usage, const char *allowed_domain, time_t expiration_date) _CUPS_PUBLIC;
+extern bool		cupsSignCredentialsRequest(const char *path, const char *common_name, const char *request, const char *root_name, cups_credpurpose_t allowed_purpose, cups_credusage_t allowed_usage, cups_cert_sign_cb_t cb, void *cb_data, time_t expiration_date) _CUPS_PUBLIC;
 extern http_status_t	cupsStartDestDocument(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, int job_id, const char *docname, const char *format, size_t num_options, cups_option_t *options, bool last_document) _CUPS_PUBLIC;
 extern int		cupsTempFd(const char *prefix, const char *suffix, char *filename, size_t len) _CUPS_PUBLIC;
 extern cups_file_t	*cupsTempFile(const char *prefix, const char *suffix, char *filename, size_t len) _CUPS_PUBLIC;
diff --git a/cups/testcreds.c b/cups/testcreds.c
index 39b292605..4fc8ab6d5 100644
--- a/cups/testcreds.c
+++ b/cups/testcreds.c
@@ -455,7 +455,7 @@ do_unit_tests(void)
       if (data)
       {
         testBegin("cupsSignCredentialsRequest(altprinter)");
-        if (cupsSignCredentialsRequest(TEST_CERT_PATH, "altprinter", data, "_site_", CUPS_CREDPURPOSE_ALL, CUPS_CREDUSAGE_ALL, /*allowed_domain*/NULL, time(NULL) + 30 * 86400))
+        if (cupsSignCredentialsRequest(TEST_CERT_PATH, "altprinter", data, "_site_", CUPS_CREDPURPOSE_ALL, CUPS_CREDUSAGE_ALL, /*cb*/NULL, /*cb_data*/NULL, time(NULL) + 30 * 86400))
         {
           testEnd(true);
 	  free(data);
diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index 4c88e6920..0a8db4827 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -495,14 +495,15 @@ cupsCreateCredentialsRequest(
 
 bool					// O - `true` on success, `false` on failure
 cupsSignCredentialsRequest(
-    const char         *path,		// I - Directory path for certificate/key store or `NULL` for default
-    const char         *common_name,	// I - Common name to use
-    const char         *request,	// I - PEM-encoded CSR
-    const char         *root_name,	// I - Root certificate
-    cups_credpurpose_t allowed_purpose,	// I - Allowed credential purpose(s)
-    cups_credusage_t   allowed_usage,	// I - Allowed credential usage(s)
-    const char         *allowed_domain,	// I - Allowed domain name (beyond .local) or `NULL` for just .local
-    time_t             expiration_date)	// I - Certificate expiration date
+    const char          *path,		// I - Directory path for certificate/key store or `NULL` for default
+    const char          *common_name,	// I - Common name to use
+    const char          *request,	// I - PEM-encoded CSR
+    const char          *root_name,	// I - Root certificate
+    cups_credpurpose_t  allowed_purpose,// I - Allowed credential purpose(s)
+    cups_credusage_t    allowed_usage,	// I - Allowed credential usage(s)
+    cups_cert_sign_cb_t cb,		// I - subjectAltName callback or `NULL` to allow just .local
+    void                *cb_data,	// I - Callback data
+    time_t              expiration_date)// I - Certificate expiration date
 {
   bool		result = false;		// Return value
   X509		*cert = NULL;		// Certificate
@@ -518,18 +519,17 @@ cupsSignCredentialsRequest(
   ASN1_TIME	*notBefore,		// Initial date
 		*notAfter;		// Expiration date
   BIO		*bio;			// Output file
-#if 0
-  char		temp[1024],		// Temporary string
-		*tempptr;		// Pointer into temporary string
-  STACK_OF(X509_EXTENSION) *exts;	// Extensions
+  char		temp[1024];		// Temporary string
+//  char		*tempptr; 		// Pointer into temporary string
+  int		i,			// Looping var
+		num_exts;		// Number of extensions
+  STACK_OF(X509_EXTENSION) *exts = NULL;// Extensions
   X509_EXTENSION *ext;			// Current extension
-  unsigned	i;			// Looping var
-  cups_credpurpose_t purpose_bit;	// Current purpose
-  cups_credusage_t usage_bit;		// Current usage
-#endif // 0
+//  cups_credpurpose_t purpose_bit;	// Current purpose
+//  cups_credusage_t usage_bit;		// Current usage
 
 
-  DEBUG_printf(("cupsSignCredentialsRequest(path=\"%s\", common_name=\"%s\", request=\"%s\", root_name=\"%s\", allowed_purpose=0x%x, allowed_usage=0x%x, allowed_domain=\"%s\", expiration_date=%ld)", path, common_name, request, root_name, allowed_purpose, allowed_usage, allowed_domain, (long)expiration_date));
+  DEBUG_printf(("cupsSignCredentialsRequest(path=\"%s\", common_name=\"%s\", request=\"%s\", root_name=\"%s\", allowed_purpose=0x%x, allowed_usage=0x%x, cb=%p, cb_data=%p, expiration_date=%ld)", path, common_name, request, root_name, allowed_purpose, allowed_usage, cb, cb_data, (long)expiration_date));
 
   // Filenames...
   if (!path)
@@ -589,10 +589,33 @@ cupsSignCredentialsRequest(
 
   X509_set_pubkey(cert, X509_REQ_get_pubkey(crq));
 
-  X509_set_issuer_name(cert, X509_get_subject_name(root_cert));
   X509_set_subject_name(cert, X509_REQ_get_subject_name(crq));
   X509_set_version(cert, 2); // v3
 
+  // Copy/verify extensions...
+  exts     = X509_REQ_get_extensions(crq);
+  num_exts = sk_X509_EXTENSION_num(exts);
+
+  for (i = 0; i < num_exts; i ++)
+  {
+    // Get the extension object...
+    ASN1_OBJECT	*obj;			// Extension object
+
+    ext = sk_X509_EXTENSION_value(exts, i);
+    obj = X509_EXTENSION_get_object(ext);
+
+    // TODO: Use callback to verify subjectAltName values
+    i2t_ASN1_OBJECT(temp, (int)sizeof(temp), obj);
+    fprintf(stderr, "exts[%d]=\"%s\"\n", i, temp);
+
+    (void)cb;
+    (void)cb_data;
+
+    // If we get this far, the object is OK and we can add it...
+    if (!X509_add_ext(cert, ext, -1))
+      goto done;
+  }
+
   // Try loading a root certificate...
   http_make_path(root_crtfile, sizeof(root_crtfile), path, root_name ? root_name : "_site_", "crt");
   http_make_path(root_keyfile, sizeof(root_keyfile), path, root_name ? root_name : "_site_", "key");
@@ -625,6 +648,7 @@ cupsSignCredentialsRequest(
     goto done;
   }
 
+  X509_set_issuer_name(cert, X509_get_subject_name(root_cert));
   X509_sign(cert, root_key, EVP_sha256());
 
   // Save the certificate...
@@ -652,6 +676,8 @@ cupsSignCredentialsRequest(
   // Cleanup...
   done:
 
+  if (exts)
+    sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
   if (crq)
     X509_REQ_free(crq);
   if (cert)

From 8335d5b50169d1d44c9a1bc925000bc75e9927ff Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Fri, 26 May 2023 12:29:52 -0400
Subject: [PATCH 24/31] Save more work.

---
 cups/tls-openssl.c | 36 +++++++++++++++++++++++++++++++-----
 1 file changed, 31 insertions(+), 5 deletions(-)

diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index 0a8db4827..71f5d50d4 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -527,6 +527,9 @@ cupsSignCredentialsRequest(
   X509_EXTENSION *ext;			// Current extension
 //  cups_credpurpose_t purpose_bit;	// Current purpose
 //  cups_credusage_t usage_bit;		// Current usage
+  bool		saw_usage = false,	// Saw NID_key_usage?
+		saw_ext_usage = false,	// Saw NID_ext_key_usage?
+		saw_san = false;	// Saw NID_subject_alt_name?
 
 
   DEBUG_printf(("cupsSignCredentialsRequest(path=\"%s\", common_name=\"%s\", request=\"%s\", root_name=\"%s\", allowed_purpose=0x%x, allowed_usage=0x%x, cb=%p, cb_data=%p, expiration_date=%ld)", path, common_name, request, root_name, allowed_purpose, allowed_usage, cb, cb_data, (long)expiration_date));
@@ -604,18 +607,41 @@ cupsSignCredentialsRequest(
     ext = sk_X509_EXTENSION_value(exts, i);
     obj = X509_EXTENSION_get_object(ext);
 
-    // TODO: Use callback to verify subjectAltName values
-    i2t_ASN1_OBJECT(temp, (int)sizeof(temp), obj);
-    fprintf(stderr, "exts[%d]=\"%s\"\n", i, temp);
+    OBJ_obj2txt(temp, (int)sizeof(temp), obj, 0);
+    fprintf(stderr, "NID %d: %s\n", OBJ_obj2nid(obj), temp);
 
-    (void)cb;
-    (void)cb_data;
+    switch (OBJ_obj2nid(obj))
+    {
+      case NID_ext_key_usage :
+          saw_ext_usage = true;
+          break;
+
+      case NID_key_usage :
+          saw_usage = true;
+          break;
+
+      case NID_subject_alt_name :
+          saw_san = true;
+          // TODO: Use callback to validate subjectAltName values
+          break;
+
+      case NID_basic_constraints :
+	  // Ignore basicConstraints in request...
+	  continue;
+    }
 
     // If we get this far, the object is OK and we can add it...
     if (!X509_add_ext(cert, ext, -1))
       goto done;
   }
 
+  // Add basic constraints for an "edge" certificate...
+  if ((ext = X509V3_EXT_conf_nid(/*conf*/NULL, /*ctx*/NULL, NID_basic_constraints, "critical,CA:FALSE,pathlen:0")) == NULL || !X509_add_ext(cert, ext, -1))
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to add extension to X.509 certificate."), 1);
+    goto done;
+  }
+
   // Try loading a root certificate...
   http_make_path(root_crtfile, sizeof(root_crtfile), path, root_name ? root_name : "_site_", "crt");
   http_make_path(root_keyfile, sizeof(root_keyfile), path, root_name ? root_name : "_site_", "key");

From 453159f31a427c10ed31795ef5378d00e03a17d7 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Tue, 30 May 2023 20:36:38 -0400
Subject: [PATCH 25/31] Implement the rest of the X.509 request validation code
 in cupsSignCredentialsRequest.

---
 cups/cups.h        |   4 +-
 cups/testcreds.c   |  48 ++++++++--
 cups/tls-openssl.c | 213 ++++++++++++++++++++++++++++++++++++++-------
 cups/tls.c         |  25 ++++++
 4 files changed, 251 insertions(+), 39 deletions(-)

diff --git a/cups/cups.h b/cups/cups.h
index ccb035a3e..70139b957 100644
--- a/cups/cups.h
+++ b/cups/cups.h
@@ -283,7 +283,7 @@ typedef struct cups_size_s		//// Media information
 		top;			// Top margin in hundredths of millimeters
 } cups_size_t;
 
-typedef bool (*cups_cert_sign_cb_t)(const char *subject_alt_name, void *user_data);
+typedef bool (*cups_cert_san_cb_t)(const char *common_name, const char *subject_alt_name, void *user_data);
 					// Certificate signing subjectAltName callback
 
 typedef bool (*cups_client_cert_cb_t)(http_t *http, void *tls, cups_array_t *distinguished_names, void *user_data);
@@ -403,7 +403,7 @@ extern void		cupsSetServerCertCB(cups_server_cert_cb_t cb, void *user_data) _CUP
 extern bool		cupsSetServerCredentials(const char *path, const char *common_name, bool auto_create) _CUPS_PUBLIC;
 extern void		cupsSetUser(const char *user) _CUPS_PUBLIC;
 extern void		cupsSetUserAgent(const char *user_agent) _CUPS_PUBLIC;
-extern bool		cupsSignCredentialsRequest(const char *path, const char *common_name, const char *request, const char *root_name, cups_credpurpose_t allowed_purpose, cups_credusage_t allowed_usage, cups_cert_sign_cb_t cb, void *cb_data, time_t expiration_date) _CUPS_PUBLIC;
+extern bool		cupsSignCredentialsRequest(const char *path, const char *common_name, const char *request, const char *root_name, cups_credpurpose_t allowed_purpose, cups_credusage_t allowed_usage, cups_cert_san_cb_t cb, void *cb_data, time_t expiration_date) _CUPS_PUBLIC;
 extern http_status_t	cupsStartDestDocument(http_t *http, cups_dest_t *dest, cups_dinfo_t *info, int job_id, const char *docname, const char *format, size_t num_options, cups_option_t *options, bool last_document) _CUPS_PUBLIC;
 extern int		cupsTempFd(const char *prefix, const char *suffix, char *filename, size_t len) _CUPS_PUBLIC;
 extern cups_file_t	*cupsTempFile(const char *prefix, const char *suffix, char *filename, size_t len) _CUPS_PUBLIC;
diff --git a/cups/testcreds.c b/cups/testcreds.c
index 4fc8ab6d5..ca40d5321 100644
--- a/cups/testcreds.c
+++ b/cups/testcreds.c
@@ -412,7 +412,7 @@ do_unit_tests(void)
 
   for (type = CUPS_CREDTYPE_DEFAULT; type <= CUPS_CREDTYPE_ECDSA_P521_SHA256; type ++)
   {
-    testBegin("cupsCreateCredentials(_site_, %s, no alt names, CA)", types[type]);
+    testBegin("cupsCreateCredentials(_site_, %s, CA)", types[type]);
     if (cupsCreateCredentials(TEST_CERT_PATH, true, CUPS_CREDPURPOSE_SERVER_AUTH, type, CUPS_CREDUSAGE_DEFAULT_TLS, "Organization", "Unit", "Locality", "Ontario", "CA", "_site_", 0, NULL, NULL, time(NULL) + 30 * 86400))
     {
       testEnd(true);
@@ -432,35 +432,69 @@ do_unit_tests(void)
       testEndMessage(false, "%s", cupsLastErrorString());
     }
 
-    testBegin("cupsCreateCredentials(printer, %s, alt names, signed by CA cert)", types[type]);
+    testBegin("cupsCreateCredentials(printer w/alt names, %s, signed by CA cert)", types[type]);
     if (cupsCreateCredentials(TEST_CERT_PATH, false, CUPS_CREDPURPOSE_SERVER_AUTH, type, CUPS_CREDUSAGE_DEFAULT_TLS, "Organization", "Unit", "Locality", "Ontario", "CA", "printer", sizeof(alt_names) / sizeof(alt_names[0]), alt_names, "_site_", time(NULL) + 30 * 86400))
       testEnd(true);
     else
       testEndMessage(false, "%s", cupsLastErrorString());
 
-    testBegin("cupsCreateCredentialsRequest(altprinter, %s, alt names)", types[type]);
+    testBegin("cupsCreateCredentialsRequest(altprinter w/alt names, %s)", types[type]);
     if (cupsCreateCredentialsRequest(TEST_CERT_PATH, CUPS_CREDPURPOSE_SERVER_AUTH, type, CUPS_CREDUSAGE_DEFAULT_TLS, "Organization", "Unit", "Locality", "Ontario", "CA", "altprinter", sizeof(alt_names) / sizeof(alt_names[0]), alt_names))
     {
       testEnd(true);
 
-      testBegin("cupsCopyCredentialsKey(altprinter)");
+      testBegin("cupsCopyCredentialsKey(altprinter w/alt names)");
       data = cupsCopyCredentialsKey(TEST_CERT_PATH, "altprinter");
       testEnd(data != NULL);
       free(data);
 
-      testBegin("cupsCopyCredentialsRequest(altprinter)");
+      testBegin("cupsCopyCredentialsRequest(altprinter w/alt names)");
       data = cupsCopyCredentialsRequest(TEST_CERT_PATH, "altprinter");
       testEnd(data != NULL);
 
       if (data)
       {
-        testBegin("cupsSignCredentialsRequest(altprinter)");
+        testBegin("cupsSignCredentialsRequest(altprinter w/alt names)");
+        if (cupsSignCredentialsRequest(TEST_CERT_PATH, "altprinter", data, "_site_", CUPS_CREDPURPOSE_ALL, CUPS_CREDUSAGE_ALL, /*cb*/NULL, /*cb_data*/NULL, time(NULL) + 30 * 86400))
+        {
+          testEndMessage(false, "Expected a failure");
+        }
+        else
+        {
+	  testEndMessage(true, "%s", cupsLastErrorString());
+        }
+
+        free(data);
+      }
+    }
+    else
+    {
+      testEndMessage(false, "%s", cupsLastErrorString());
+    }
+
+    testBegin("cupsCreateCredentialsRequest(altprinter w/o alt names, %s)", types[type]);
+    if (cupsCreateCredentialsRequest(TEST_CERT_PATH, CUPS_CREDPURPOSE_SERVER_AUTH, type, CUPS_CREDUSAGE_DEFAULT_TLS, "Organization", "Unit", "Locality", "Ontario", "CA", "altprinter", 0, NULL))
+    {
+      testEnd(true);
+
+      testBegin("cupsCopyCredentialsKey(altprinter w/o alt names)");
+      data = cupsCopyCredentialsKey(TEST_CERT_PATH, "altprinter");
+      testEnd(data != NULL);
+      free(data);
+
+      testBegin("cupsCopyCredentialsRequest(altprinter w/o alt names)");
+      data = cupsCopyCredentialsRequest(TEST_CERT_PATH, "altprinter");
+      testEnd(data != NULL);
+
+      if (data)
+      {
+        testBegin("cupsSignCredentialsRequest(altprinter w/o alt names)");
         if (cupsSignCredentialsRequest(TEST_CERT_PATH, "altprinter", data, "_site_", CUPS_CREDPURPOSE_ALL, CUPS_CREDUSAGE_ALL, /*cb*/NULL, /*cb_data*/NULL, time(NULL) + 30 * 86400))
         {
           testEnd(true);
 	  free(data);
 
-	  testBegin("cupsCopyCredentialsKey(altprinter)");
+	  testBegin("cupsCopyCredentialsKey(altprinter w/o alt names)");
 	  data = cupsCopyCredentialsKey(TEST_CERT_PATH, "altprinter");
 	  testEnd(data != NULL);
         }
diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index 71f5d50d4..74b7947cc 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -33,7 +33,7 @@ static bool		openssl_add_ext(STACK_OF(X509_EXTENSION) *exts, int nid, const char
 static X509		*openssl_create_credential(http_credential_t *credential);
 static X509_NAME	*openssl_create_name(const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name);
 static EVP_PKEY		*openssl_create_key(cups_credtype_t type);
-static bool		openssl_create_san(STACK_OF(X509_EXTENSION) *exts, const char *common_name, size_t num_alt_names, const char * const *alt_names);
+static X509_EXTENSION	*openssl_create_san(const char *common_name, size_t num_alt_names, const char * const *alt_names);
 static time_t		openssl_get_date(X509 *cert, int which);
 //static void		openssl_load_crl(void);
 
@@ -224,9 +224,11 @@ cupsCreateCredentials(
   else
   {
     // Add extension with DNS names and free buffer for GENERAL_NAME
-    if (!openssl_create_san(exts, common_name, num_alt_names, alt_names))
+    if ((ext = openssl_create_san(common_name, num_alt_names, alt_names)) == NULL)
       goto done;
 
+    sk_X509_EXTENSION_push(exts, ext);
+
     // Add extensions that are required to make Chrome happy...
     openssl_add_ext(exts, NID_basic_constraints, "critical,CA:FALSE,pathlen:0");
   }
@@ -354,6 +356,7 @@ cupsCreateCredentialsRequest(
   EVP_PKEY	*pkey;			// Key pair
   X509_REQ	*csr;			// Certificate signing request
   X509_NAME	*name;			// Subject/issuer name
+  X509_EXTENSION *ext;			// X509 extension
   BIO		*bio;			// Output file
   char		temp[1024],		// Temporary directory name
 		*tempptr,		// Pointer into temporary string
@@ -409,9 +412,11 @@ cupsCreateCredentialsRequest(
   // Add extension with DNS names and free buffer for GENERAL_NAME
   exts = sk_X509_EXTENSION_new_null();
 
-  if (!openssl_create_san(exts, common_name, num_alt_names, alt_names))
+  if ((ext = openssl_create_san(common_name, num_alt_names, alt_names)) == NULL)
     goto done;
 
+  sk_X509_EXTENSION_push(exts, ext);
+
   cupsCopyString(temp, "critical", sizeof(temp));
   for (tempptr = temp + strlen(temp), i = 0, usage_bit = CUPS_CREDUSAGE_DIGITAL_SIGNATURE; i < (sizeof(tls_usage_strings) / sizeof(tls_usage_strings[0])); i ++, usage_bit *= 2)
   {
@@ -495,15 +500,15 @@ cupsCreateCredentialsRequest(
 
 bool					// O - `true` on success, `false` on failure
 cupsSignCredentialsRequest(
-    const char          *path,		// I - Directory path for certificate/key store or `NULL` for default
-    const char          *common_name,	// I - Common name to use
-    const char          *request,	// I - PEM-encoded CSR
-    const char          *root_name,	// I - Root certificate
-    cups_credpurpose_t  allowed_purpose,// I - Allowed credential purpose(s)
-    cups_credusage_t    allowed_usage,	// I - Allowed credential usage(s)
-    cups_cert_sign_cb_t cb,		// I - subjectAltName callback or `NULL` to allow just .local
-    void                *cb_data,	// I - Callback data
-    time_t              expiration_date)// I - Certificate expiration date
+    const char         *path,		// I - Directory path for certificate/key store or `NULL` for default
+    const char         *common_name,	// I - Common name to use
+    const char         *request,	// I - PEM-encoded CSR
+    const char         *root_name,	// I - Root certificate
+    cups_credpurpose_t allowed_purpose,	// I - Allowed credential purpose(s)
+    cups_credusage_t   allowed_usage,	// I - Allowed credential usage(s)
+    cups_cert_san_cb_t cb,		// I - subjectAltName callback or `NULL` to allow just .local
+    void               *cb_data,	// I - Callback data
+    time_t             expiration_date)	// I - Certificate expiration date
 {
   bool		result = false;		// Return value
   X509		*cert = NULL;		// Certificate
@@ -520,13 +525,12 @@ cupsSignCredentialsRequest(
 		*notAfter;		// Expiration date
   BIO		*bio;			// Output file
   char		temp[1024];		// Temporary string
-//  char		*tempptr; 		// Pointer into temporary string
-  int		i,			// Looping var
+  int		i, j,			// Looping vars
 		num_exts;		// Number of extensions
   STACK_OF(X509_EXTENSION) *exts = NULL;// Extensions
   X509_EXTENSION *ext;			// Current extension
-//  cups_credpurpose_t purpose_bit;	// Current purpose
-//  cups_credusage_t usage_bit;		// Current usage
+  cups_credpurpose_t purpose;		// Current purpose
+  cups_credusage_t usage;		// Current usage
   bool		saw_usage = false,	// Saw NID_key_usage?
 		saw_ext_usage = false,	// Saw NID_ext_key_usage?
 		saw_san = false;	// Saw NID_subject_alt_name?
@@ -544,6 +548,9 @@ cupsSignCredentialsRequest(
     return (false);
   }
 
+  if (!cb)
+    cb = http_default_san_cb;
+
   // Import the X.509 certificate request...
   DEBUG_puts("1cupsCreateCredentials: Importing X.509 certificate request.");
   if ((bio = BIO_new_mem_buf(request, (int)strlen(request))) != NULL)
@@ -602,36 +609,155 @@ cupsSignCredentialsRequest(
   for (i = 0; i < num_exts; i ++)
   {
     // Get the extension object...
-    ASN1_OBJECT	*obj;			// Extension object
+    bool		add_ext = false;	// Add this extension?
+    ASN1_OBJECT		*obj;			// Extension object
+    ASN1_OCTET_STRING	*extdata;		// Extension data string
+    unsigned char	*data = NULL;		// Extension data bytes
+    int			datalen;		// Length of extension data
+
+    ext     = sk_X509_EXTENSION_value(exts, i);
+    obj     = X509_EXTENSION_get_object(ext);
+    extdata = X509_EXTENSION_get_data(ext);
+    datalen = i2d_ASN1_OCTET_STRING(extdata, &data);
+
+#ifdef DEBUG
+    char *tempptr;				// Pointer into string
 
-    ext = sk_X509_EXTENSION_value(exts, i);
-    obj = X509_EXTENSION_get_object(ext);
+    for (j = 0, tempptr = temp; j < datalen; j ++, tempptr += 2)
+      snprintf(tempptr, sizeof(temp) - (size_t)(tempptr - temp), "%02X", data[j]);
 
-    OBJ_obj2txt(temp, (int)sizeof(temp), obj, 0);
-    fprintf(stderr, "NID %d: %s\n", OBJ_obj2nid(obj), temp);
+    DEBUG_printf(("1cupsSignCredentialsRequest: EXT%d=%s", OBJ_obj2nid(obj), temp));
+#endif // DEBUG
 
     switch (OBJ_obj2nid(obj))
     {
       case NID_ext_key_usage :
+          add_ext       = true;
           saw_ext_usage = true;
+
+          if (datalen < 12 || data[2] != 0x30 || data[3] != (datalen - 4))
+          {
+            _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Bad keyUsage extension in X.509 certificate request."), 1);
+	    goto done;
+          }
+
+          for (purpose = 0, j = 4; j < datalen; j += data[j + 1] + 2)
+          {
+            if (data[j] != 0x06 || data[j + 1] != 8 || memcmp(data + j + 2, "+\006\001\005\005\007\003", 7))
+            {
+	      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Bad keyUsage extension in X.509 certificate request."), 1);
+	      goto done;
+            }
+
+            switch (data[j + 9])
+            {
+              case 1 :
+                  purpose |= CUPS_CREDPURPOSE_SERVER_AUTH;
+                  break;
+              case 2 :
+                  purpose |= CUPS_CREDPURPOSE_CLIENT_AUTH;
+                  break;
+              case 3 :
+                  purpose |= CUPS_CREDPURPOSE_CODE_SIGNING;
+                  break;
+              case 4 :
+                  purpose |= CUPS_CREDPURPOSE_EMAIL_PROTECTION;
+                  break;
+              case 8 :
+                  purpose |= CUPS_CREDPURPOSE_TIME_STAMPING;
+                  break;
+              case 9 :
+                  purpose |= CUPS_CREDPURPOSE_OCSP_SIGNING;
+                  break;
+	      default :
+		  _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Bad keyUsage extension in X.509 certificate request."), 1);
+		  goto done;
+            }
+          }
+
+          DEBUG_printf(("1cupsSignCredentialsRequest: purpose=0x%04x", purpose));
+
+          if (purpose & ~allowed_purpose)
+          {
+            _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Bad keyUsage extension in X.509 certificate request."), 1);
+	    goto done;
+          }
           break;
 
       case NID_key_usage :
+          add_ext   = true;
           saw_usage = true;
+
+          if (datalen < 6 || datalen > 7 || data[2] != 0x03 || data[3] != (datalen - 4))
+          {
+            _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Bad extKeyUsage extension in X.509 certificate request."), 1);
+	    goto done;
+          }
+
+          usage = 0;
+          if (data[5] & 0x80)
+	    usage |= CUPS_CREDUSAGE_DIGITAL_SIGNATURE;
+          if (data[5] & 0x40)
+	    usage |= CUPS_CREDUSAGE_NON_REPUDIATION;
+          if (data[5] & 0x20)
+	    usage |= CUPS_CREDUSAGE_KEY_ENCIPHERMENT;
+          if (data[5] & 0x10)
+	    usage |= CUPS_CREDUSAGE_DATA_ENCIPHERMENT;
+          if (data[5] & 0x08)
+	    usage |= CUPS_CREDUSAGE_KEY_AGREEMENT;
+          if (data[5] & 0x04)
+	    usage |= CUPS_CREDUSAGE_KEY_CERT_SIGN;
+          if (data[5] & 0x02)
+	    usage |= CUPS_CREDUSAGE_CRL_SIGN;
+          if (data[5] & 0x01)
+	    usage |= CUPS_CREDUSAGE_ENCIPHER_ONLY;
+          if (datalen == 7 && (data[6] & 0x80))
+	    usage |= CUPS_CREDUSAGE_DECIPHER_ONLY;
+
+          DEBUG_printf(("1cupsSignCredentialsRequest: usage=0x%04x", usage));
+
+          if (usage & ~allowed_usage)
+          {
+            _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Bad extKeyUsage extension in X.509 certificate request."), 1);
+	    goto done;
+          }
           break;
 
       case NID_subject_alt_name :
+          add_ext = true;
           saw_san = true;
-          // TODO: Use callback to validate subjectAltName values
-          break;
 
-      case NID_basic_constraints :
-	  // Ignore basicConstraints in request...
-	  continue;
+          if (datalen < 4 || data[2] != 0x30 || data[3] != (datalen - 4))
+          {
+            _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Bad subjectAltName extension in X.509 certificate request."), 1);
+	    goto done;
+          }
+
+          // Parse the SAN values (there should be an easier/standard OpenSSL API to do this!)
+          for (j = 4, datalen -= 2; j < datalen; j += data[j + 1] + 2)
+          {
+            if (data[j] == 0x82 && data[j + 1])
+            {
+              // GENERAL_STRING for DNS
+              memcpy(temp, data + j + 2, data[j + 1]);
+              temp[data[j + 1]] = '\0';
+
+              DEBUG_printf(("1cupsSignCredentialsRequest: SAN %s", temp));
+
+              if (!(cb)(common_name, temp, cb_data))
+              {
+                _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Validation of subjectAltName in X.509 certificate request failed."), 1);
+                goto done;
+              }
+	    }
+          }
+          break;
     }
 
+    OPENSSL_free(data);
+
     // If we get this far, the object is OK and we can add it...
-    if (!X509_add_ext(cert, ext, -1))
+    if (add_ext && !X509_add_ext(cert, ext, -1))
       goto done;
   }
 
@@ -642,6 +768,34 @@ cupsSignCredentialsRequest(
     goto done;
   }
 
+  // Add key usage extensions as needed...
+  if (!saw_usage)
+  {
+    if ((ext = X509V3_EXT_conf_nid(/*conf*/NULL, /*ctx*/NULL, NID_key_usage, "critical,digitalSignature,keyEncipherment")) == NULL || !X509_add_ext(cert, ext, -1))
+    {
+      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to add extension to X.509 certificate."), 1);
+      goto done;
+    }
+  }
+
+  if (!saw_ext_usage)
+  {
+    if ((ext = X509V3_EXT_conf_nid(/*conf*/NULL, /*ctx*/NULL, NID_ext_key_usage, tls_usage_strings[0])) == NULL || !X509_add_ext(cert, ext, -1))
+    {
+      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to add extension to X.509 certificate."), 1);
+      goto done;
+    }
+  }
+
+  if (!saw_san)
+  {
+    if ((ext = openssl_create_san(common_name, /*num_alt_names*/0, /*alt_names*/NULL)) == NULL || !X509_add_ext(cert, ext, -1))
+    {
+      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to add extension to X.509 certificate."), 1);
+      goto done;
+    }
+  }
+
   // Try loading a root certificate...
   http_make_path(root_crtfile, sizeof(root_crtfile), path, root_name ? root_name : "_site_", "crt");
   http_make_path(root_keyfile, sizeof(root_keyfile), path, root_name ? root_name : "_site_", "key");
@@ -1747,9 +1901,8 @@ openssl_create_name(
 // 'openssl_create_san()' - Create a list of subjectAltName values for a certificate/signing request.
 //
 
-static bool				// O - `true` on success, `false` otherwise
+static X509_EXTENSION *			// O - Extension
 openssl_create_san(
-    STACK_OF(X509_EXTENSION) *exts,	// I - Extensions
     const char         *common_name,	// I - Common name
     size_t             num_alt_names,	// I - Number of alternate names
     const char * const *alt_names)	// I - List of alternate names
@@ -1788,7 +1941,7 @@ openssl_create_san(
   }
 
   // Return the stack
-  return (openssl_add_ext(exts, NID_subject_alt_name, temp));
+  return (X509V3_EXT_conf_nid(/*conf*/NULL, /*ctx*/NULL, NID_subject_alt_name, temp));
 }
 
 
diff --git a/cups/tls.c b/cups/tls.c
index 1ad53348e..bd84d2a37 100644
--- a/cups/tls.c
+++ b/cups/tls.c
@@ -47,6 +47,7 @@ static int		tls_options = -1,// Options for TLS connections
 
 static char		*http_copy_file(const char *path, const char *common_name, const char *ext);
 static const char	*http_default_path(char *buffer, size_t bufsize);
+static bool		http_default_san_cb(const char *common_name, const char *subject_alt_name, void *data);
 static const char	*http_make_path(char *buffer, size_t bufsize, const char *dirname, const char *filename, const char *ext);
 static bool		http_save_file(const char *path, const char *common_name, const char *ext, const char *value);
 
@@ -496,6 +497,30 @@ http_default_path(
 }
 
 
+//
+// 'http_default_san_cb()' - Validate a subjectAltName value.
+//
+
+static bool				// O - `true` if OK, `false` otherwise
+http_default_san_cb(
+    const char *common_name,		// I - Common name value
+    const char *subject_alt_name,	// I - subjectAltName value
+    void       *data)			// I - Callback data (unused)
+{
+  size_t	common_len;		// Common name length
+
+
+  (void)data;
+
+  if (!_cups_strcasecmp(subject_alt_name, common_name) || !_cups_strcasecmp(subject_alt_name, "localhost"))
+    return (true);
+
+  common_len = strlen(common_name);
+
+  return (!_cups_strncasecmp(subject_alt_name, common_name, common_len) && subject_alt_name[common_len] == '.');
+}
+
+
 //
 // 'http_make_path()' - Format a filename for a certificate or key file.
 //

From e20bd45f388369d051270d961cb542c1347da726 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Wed, 31 May 2023 16:29:27 -0400
Subject: [PATCH 26/31] Save work on GNU TLS version of
 cupsSignCredentialsRequest.

---
 cups/debug.c      |  26 ++--
 cups/string.c     |  40 +++---
 cups/tls-gnutls.c | 317 ++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 350 insertions(+), 33 deletions(-)

diff --git a/cups/debug.c b/cups/debug.c
index 005ce8a3f..68466ac67 100644
--- a/cups/debug.c
+++ b/cups/debug.c
@@ -1,7 +1,7 @@
 /*
  * Debugging functions for CUPS.
  *
- * Copyright © 2022 by OpenPrinting.
+ * Copyright © 2022-2023 by OpenPrinting.
  * Copyright © 2008-2018 by Apple Inc.
  *
  * Licensed under Apache License v2.0.  See the file "LICENSE" for more
@@ -148,7 +148,6 @@ _cups_debug_printf(const char *format,	/* I - Printf-style format string */
   else if (buffer[bytes - 1] != '\n')
   {
     buffer[bytes++] = '\n';
-    buffer[bytes]   = '\0';
   }
 
  /*
@@ -381,7 +380,7 @@ _cups_safe_vsnprintf(
 
       if (*format == '%')
       {
-        if (bufptr < bufend)
+        if (bufptr && bufptr < bufend)
 	  *bufptr++ = *format;
         bytes ++;
         format ++;
@@ -493,7 +492,7 @@ _cups_safe_vsnprintf(
 
             bytes += (int)strlen(temp);
 
-            if (bufptr)
+            if (bufptr && bufptr < bufend)
 	    {
 	      cupsCopyString(bufptr, temp, (size_t)(bufend - bufptr));
 	      bufptr += strlen(bufptr);
@@ -523,7 +522,7 @@ _cups_safe_vsnprintf(
 
             bytes += (int)strlen(temp);
 
-	    if (bufptr)
+	    if (bufptr && bufptr < bufend)
 	    {
 	      cupsCopyString(bufptr, temp, (size_t)(bufend - bufptr));
 	      bufptr += strlen(bufptr);
@@ -538,7 +537,7 @@ _cups_safe_vsnprintf(
 
             bytes += (int)strlen(temp);
 
-	    if (bufptr)
+	    if (bufptr && bufptr < bufend)
 	    {
 	      cupsCopyString(bufptr, temp, (size_t)(bufend - bufptr));
 	      bufptr += strlen(bufptr);
@@ -548,10 +547,12 @@ _cups_safe_vsnprintf(
         case 'c' : /* Character or character array */
 	    bytes += width;
 
-	    if (bufptr)
+	    if (bufptr && bufptr < bufend)
 	    {
 	      if (width <= 1)
+	      {
 	        *bufptr++ = (char)va_arg(ap, int);
+	      }
 	      else
 	      {
 		if ((bufptr + width) > bufend)
@@ -567,6 +568,12 @@ _cups_safe_vsnprintf(
 	    if ((s = va_arg(ap, char *)) == NULL)
 	      s = "(null)";
 
+            if (!bufptr)
+	    {
+	      bytes += 2 * strlen(s);
+	      break;
+	    }
+
            /*
 	    * Copy the C string, replacing control chars and \ with
 	    * C character escapes...
@@ -640,7 +647,7 @@ _cups_safe_vsnprintf(
     {
       bytes ++;
 
-      if (bufptr < bufend)
+      if (bufptr && bufptr < bufend)
         *bufptr++ = *format;
 
       format ++;
@@ -651,7 +658,8 @@ _cups_safe_vsnprintf(
   * Nul-terminate the string and return the number of characters needed.
   */
 
-  *bufptr = '\0';
+  if (bufptr)
+    *bufptr = '\0';
 
   return (bytes);
 }
diff --git a/cups/string.c b/cups/string.c
index c72346544..6e650ea62 100644
--- a/cups/string.c
+++ b/cups/string.c
@@ -1,7 +1,7 @@
 /*
  * String functions for CUPS.
  *
- * Copyright © 2022 by OpenPrinting.
+ * Copyright © 2022-2023 by OpenPrinting.
  * Copyright © 2007-2019 by Apple Inc.
  * Copyright © 1997-2007 by Easy Software Products.
  *
@@ -141,6 +141,10 @@ cupsConcatString(char       *dst,	/* O - Destination string */
                  const char *src,	/* I - Source string */
 	         size_t     dstsize)	/* I - Size of destination string buffer */
 {
+  // Range check input...
+  if (!dst || !src || dstsize == 0)
+    return (0);
+
 #ifdef HAVE_STRLCAT
   return (strlcat(dst, src, dstsize));
 
@@ -149,10 +153,7 @@ cupsConcatString(char       *dst,	/* O - Destination string */
   size_t	dstlen;			/* Length of destination string */
 
 
- /*
-  * Figure out how much room is left...
-  */
-
+  // Figure out how much room is left...
   dstlen = strlen(dst);
 
   if (dstsize < (dstlen + 1))
@@ -160,16 +161,10 @@ cupsConcatString(char       *dst,	/* O - Destination string */
 
   dstsize -= dstlen + 1;
 
- /*
-  * Figure out how much room is needed...
-  */
-
+  // Figure out how much room is needed...
   srclen = strlen(src);
 
- /*
-  * Copy the appropriate amount...
-  */
-
+  // Copy the appropriate amount...
   if (srclen > dstsize)
     srclen = dstsize;
 
@@ -177,7 +172,7 @@ cupsConcatString(char       *dst,	/* O - Destination string */
   dst[dstlen + srclen] = '\0';
 
   return (dstlen + srclen);
-#endif /* HAVE_STRLCAT */
+#endif // HAVE_STRLCAT
 }
 
 
@@ -190,25 +185,22 @@ cupsCopyString(char       *dst,		/* O - Destination string */
                const char *src,		/* I - Source string */
 	       size_t     dstsize)	/* I - Size of destination string buffer */
 {
+  // Range check input...
+  if (!dst || !src || dstsize == 0)
+    return (0);
+
 #ifdef HAVE_STRLCPY
   return (strlcpy(dst, src, dstsize));
 
 #else
   size_t	srclen;			/* Length of source string */
 
-
- /*
-  * Figure out how much room is needed...
-  */
-
+  // Figure out how much room is needed...
   dstsize --;
 
   srclen = strlen(src);
 
- /*
-  * Copy the appropriate amount...
-  */
-
+  // Copy the appropriate amount...
   if (srclen > dstsize)
     srclen = dstsize;
 
@@ -216,7 +208,7 @@ cupsCopyString(char       *dst,		/* O - Destination string */
   dst[srclen] = '\0';
 
   return (srclen);
-#endif /* HAVE_STRLCPY */
+#endif // HAVE_STRLCPY
 }
 
 
diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index 1fd158c6f..ae1ccb19f 100644
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -504,6 +504,323 @@ cupsCreateCredentialsRequest(
 }
 
 
+//
+// 'cupsSignCredentialsRequest()' - Sign an X.509 certificate signing request to produce an X.509 certificate chain.
+//
+
+bool					// O - `true` on success, `false` on failure
+cupsSignCredentialsRequest(
+    const char         *path,		// I - Directory path for certificate/key store or `NULL` for default
+    const char         *common_name,	// I - Common name to use
+    const char         *request,	// I - PEM-encoded CSR
+    const char         *root_name,	// I - Root certificate
+    cups_credpurpose_t allowed_purpose,	// I - Allowed credential purpose(s)
+    cups_credusage_t   allowed_usage,	// I - Allowed credential usage(s)
+    cups_cert_san_cb_t cb,		// I - subjectAltName callback or `NULL` to allow just .local
+    void               *cb_data,	// I - Callback data
+    time_t             expiration_date)	// I - Certificate expiration date
+{
+  bool			ret = false;	// Return value
+  int			i,		// Looping var
+			err;		// GNU TLS error code, if any
+  gnutls_x509_crq_t	crq = NULL;	// Certificate request
+  gnutls_x509_crt_t	crt = NULL;	// Certificate
+  gnutls_x509_crt_t	root_crt = NULL;// Root certificate
+  gnutls_x509_privkey_t	root_key = NULL;// Root private key
+  gnutls_datum_t	datum;		// Datum
+  char			defpath[1024],	// Default path
+			temp[1024],	// Temporary string
+ 			crtfile[1024],	// Certificate filename
+ 			*root_crtdata,	// Root certificate data
+			*root_keydata;	// Root private key data
+  size_t		tempsize;	// Size of temporary string
+  cups_credpurpose_t	purpose;	// Credential purpose(s)
+  unsigned		gnutls_usage;	// GNU TLS keyUsage bits
+  cups_credusage_t	usage;		// Credential usage(s)
+  cups_file_t		*fp;		// Key/cert file
+  unsigned char		buffer[65536];	// Buffer for x509 data
+  size_t		bytes;		// Number of bytes of data
+  unsigned char		serial[4];	// Serial number buffer
+  time_t		curtime;	// Current time
+  int			result;		// Result of GNU TLS calls
+
+
+  DEBUG_printf(("cupsSignCredentialsRequest(path=\"%s\", common_name=\"%s\", request=\"%s\", root_name=\"%s\", allowed_purpose=0x%x, allowed_usage=0x%x, cb=%p, cb_data=%p, expiration_date=%ld)", path, common_name, request, root_name, allowed_purpose, allowed_usage, cb, cb_data, (long)expiration_date));
+
+  // Filenames...
+  if (!path)
+    path = http_default_path(defpath, sizeof(defpath));
+
+  if (!path || !common_name || !request)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(EINVAL), 0);
+    goto done;
+  }
+
+  if (!cb)
+    cb = http_default_san_cb;
+
+  // Import the request...
+  gnutls_x509_crq_init(&crq);
+
+  datum.data = (unsigned char *)request;
+  datum.size = strlen(request);
+
+  if ((err = gnutls_x509_crq_import(crq, &datum, GNUTLS_X509_FMT_PEM)) < 0)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(err), 0);
+    goto done;
+  }
+
+  // Create the certificate...
+  DEBUG_puts("1cupsSignCredentialsRequest: Generating X.509 certificate.");
+
+  curtime   = time(NULL);
+  serial[0] = (unsigned char)(curtime >> 24);
+  serial[1] = (unsigned char)(curtime >> 16);
+  serial[2] = (unsigned char)(curtime >> 8);
+  serial[3] = (unsigned char)(curtime);
+
+  gnutls_x509_crt_init(&crt);
+
+  tempsize = sizeof(temp) - 1;
+  if (gnutls_x509_crq_get_dn_by_oid(crq, GNUTLS_OID_X520_COUNTRY_NAME, 0, 0, temp, &tempsize) >= 0)
+    temp[tempsize] = '\0';
+  else
+    cupsCopyString(temp, "US", sizeof(temp));
+  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COUNTRY_NAME, 0, temp, (unsigned)strlen(temp));
+
+  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COMMON_NAME, 0, common_name, strlen(common_name));
+
+  tempsize = sizeof(temp) - 1;
+  if (gnutls_x509_crq_get_dn_by_oid(crq, GNUTLS_OID_X520_ORGANIZATION_NAME, 0, 0, temp, &tempsize) >= 0)
+  {
+    temp[tempsize] = '\0';
+    gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_ORGANIZATION_NAME, 0, temp, (unsigned)strlen(temp));
+  }
+
+  tempsize = sizeof(temp) - 1;
+  if (gnutls_x509_crq_get_dn_by_oid(crq, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME, 0, 0, temp, &tempsize) >= 0)
+  {
+    temp[tempsize] = '\0';
+    gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME, 0, temp, (unsigned)strlen(temp));
+  }
+
+  tempsize = sizeof(temp) - 1;
+  if (gnutls_x509_crq_get_dn_by_oid(crq, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0, 0, temp, &tempsize) >= 0)
+    temp[tempsize] = '\0';
+  else
+    cupsCopyString(temp, "Unknown", sizeof(temp));
+  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0, temp, strlen(temp));
+
+  tempsize = sizeof(temp) - 1;
+  if (gnutls_x509_crq_get_dn_by_oid(crq, GNUTLS_OID_X520_LOCALITY_NAME, 0, 0, temp, &tempsize) >= 0)
+    temp[tempsize] = '\0';
+  else
+    cupsCopyString(temp, "Unknown", sizeof(temp));
+  gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_LOCALITY_NAME, 0, temp, strlen(temp));
+
+//  gnutls_x509_crt_set_key(crt, key);
+  gnutls_x509_crt_set_serial(crt, serial, sizeof(serial));
+  gnutls_x509_crt_set_activation_time(crt, curtime);
+  gnutls_x509_crt_set_expiration_time(crt, expiration_date);
+  gnutls_x509_crt_set_ca_status(crt, 0);
+
+  for (i = 0; i < 100; i ++)
+  {
+    unsigned type;			// Name type
+
+    tempsize = sizeof(temp) - 1;
+    if (gnutls_x509_crq_get_subject_alt_name(crq, i, temp, &tempsize, &type, NULL) < 0)
+      break;
+
+    temp[tempsize] = '\0';
+
+    DEBUG_printf(("1cupsSignCredentialsRequest: SAN %s", temp));
+
+    if (type != GNUTLS_SAN_DNSNAME || (cb)(common_name, temp, cb_data))
+    {
+      // Good subjectAltName
+      gnutls_x509_crt_set_subject_alt_name(crt, type, temp, (unsigned)strlen(temp), i ? GNUTLS_FSAN_APPEND : GNUTLS_FSAN_SET);
+    }
+    else
+    {
+      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Validation of subjectAltName in X.509 certificate request failed."), 1);
+      goto done;
+    }
+  }
+
+  for (purpose = 0, i = 0; i < 100; i ++)
+  {
+    tempsize = sizeof(temp) - 1;
+    if (gnutls_x509_crq_get_key_purpose_oid(crq, i, temp, &tempsize, NULL) < 0)
+      break;
+    temp[tempsize] = '\0';
+
+    if (!strcmp(temp, GNUTLS_KP_TLS_WWW_SERVER))
+      purpose |= CUPS_CREDPURPOSE_SERVER_AUTH;
+    if (!strcmp(temp, GNUTLS_KP_TLS_WWW_CLIENT))
+      purpose |= CUPS_CREDPURPOSE_CLIENT_AUTH;
+    if (!strcmp(temp, GNUTLS_KP_CODE_SIGNING))
+      purpose |= CUPS_CREDPURPOSE_CODE_SIGNING;
+    if (!strcmp(temp, GNUTLS_KP_EMAIL_PROTECTION))
+      purpose |= CUPS_CREDPURPOSE_EMAIL_PROTECTION;
+    if (!strcmp(temp, GNUTLS_KP_OCSP_SIGNING))
+      purpose |= CUPS_CREDPURPOSE_OCSP_SIGNING;
+  }
+  DEBUG_printf(("1cupsSignCredentialsRequest: purpose=0x%04x", purpose));
+
+  if (purpose & ~allowed_purpose)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Bad keyUsage extension in X.509 certificate request."), 1);
+    goto done;
+  }
+
+  if (purpose == 0 || (purpose & CUPS_CREDPURPOSE_SERVER_AUTH))
+    gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_TLS_WWW_SERVER, 0);
+  if (purpose & CUPS_CREDPURPOSE_CLIENT_AUTH)
+    gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_TLS_WWW_CLIENT, 0);
+  if (purpose & CUPS_CREDPURPOSE_CODE_SIGNING)
+    gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_CODE_SIGNING, 0);
+  if (purpose & CUPS_CREDPURPOSE_EMAIL_PROTECTION)
+    gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_EMAIL_PROTECTION, 0);
+  if (purpose & CUPS_CREDPURPOSE_OCSP_SIGNING)
+    gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_OCSP_SIGNING, 0);
+
+  if (gnutls_x509_crq_get_key_usage(crq, &gnutls_usage, NULL) < 0)
+  {
+    // No keyUsage, use default for TLS...
+    gnutls_usage = GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT;
+  }
+  else
+  {
+    // Got keyUsage, convert to CUPS bitfield
+    usage = 0;
+    if (gnutls_usage & GNUTLS_KEY_DIGITAL_SIGNATURE)
+      usage |= CUPS_CREDUSAGE_DIGITAL_SIGNATURE;
+    if (gnutls_usage & GNUTLS_KEY_NON_REPUDIATION)
+      usage |= CUPS_CREDUSAGE_NON_REPUDIATION;
+    if (gnutls_usage & GNUTLS_KEY_KEY_ENCIPHERMENT)
+      usage |= CUPS_CREDUSAGE_KEY_ENCIPHERMENT;
+    if (gnutls_usage & GNUTLS_KEY_DATA_ENCIPHERMENT)
+      usage |= CUPS_CREDUSAGE_DATA_ENCIPHERMENT;
+    if (gnutls_usage & GNUTLS_KEY_KEY_AGREEMENT)
+      usage |= CUPS_CREDUSAGE_KEY_AGREEMENT;
+    if (gnutls_usage & GNUTLS_KEY_KEY_CERT_SIGN)
+      usage |= CUPS_CREDUSAGE_KEY_CERT_SIGN;
+    if (gnutls_usage & GNUTLS_KEY_CRL_SIGN)
+      usage |= CUPS_CREDUSAGE_CRL_SIGN;
+    if (gnutls_usage & GNUTLS_KEY_ENCIPHER_ONLY)
+      usage |= CUPS_CREDUSAGE_ENCIPHER_ONLY;
+    if (gnutls_usage & GNUTLS_KEY_DECIPHER_ONLY)
+      usage |= CUPS_CREDUSAGE_DECIPHER_ONLY;
+
+    DEBUG_printf(("1cupsSignCredentialsRequest: usage=0x%04x", usage));
+
+    if (usage & ~allowed_usage)
+    {
+      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Bad extKeyUsage extension in X.509 certificate request."), 1);
+      goto done;
+    }
+  }
+  gnutls_x509_crt_set_key_usage(crt, gnutls_usage);
+
+  gnutls_x509_crt_set_version(crt, 3);
+
+  bytes = sizeof(buffer);
+  if (gnutls_x509_crt_get_key_id(crt, 0, buffer, &bytes) >= 0)
+    gnutls_x509_crt_set_subject_key_id(crt, buffer, bytes);
+
+  // Try loading a root certificate...
+  root_crtdata = cupsCopyCredentials(path, root_name ? root_name : "_site_");
+  root_keydata = cupsCopyCredentialsKey(path, root_name ? root_name : "_site_");
+
+  if (root_crtdata && root_keydata)
+  {
+    // Load root certificate...
+    datum.data = (unsigned char *)root_crtdata;
+    datum.size = strlen(root_crtdata);
+
+    gnutls_x509_crt_init(&root_crt);
+    if (gnutls_x509_crt_import(root_crt, &datum, GNUTLS_X509_FMT_PEM) < 0)
+    {
+      // No good, clear it...
+      gnutls_x509_crt_deinit(root_crt);
+      root_crt = NULL;
+    }
+    else
+    {
+      // Load root private key...
+      datum.data = (unsigned char *)root_keydata;
+      datum.size = strlen(root_keydata);
+
+      gnutls_x509_privkey_init(&root_key);
+      if (gnutls_x509_privkey_import(root_key, &datum, GNUTLS_X509_FMT_PEM) < 0)
+      {
+        // No food, clear them...
+        gnutls_x509_privkey_deinit(root_key);
+        root_key = NULL;
+
+        gnutls_x509_crt_deinit(root_crt);
+        root_crt = NULL;
+      }
+    }
+  }
+
+  free(root_crtdata);
+  free(root_keydata);
+
+  if (!root_crt || !root_key)
+  {
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to load X.509 CA certificate and private key."), 1);
+    goto done;
+  }
+
+  gnutls_x509_crt_sign(crt, root_crt, root_key);
+
+  // Save it...
+  http_make_path(crtfile, sizeof(crtfile), path, common_name, "crt");
+
+  bytes = sizeof(buffer);
+  if ((result = gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
+  {
+    DEBUG_printf(("1cupsSignCredentialsRequest: Unable to export public key and X.509 certificate: %s", gnutls_strerror(result)));
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
+    goto done;
+  }
+  else if ((fp = cupsFileOpen(crtfile, "w")) != NULL)
+  {
+    DEBUG_printf(("1cupsSignCredentialsRequest: Writing public key and X.509 certificate to \"%s\".", crtfile));
+    cupsFileWrite(fp, (char *)buffer, bytes);
+    cupsFileClose(fp);
+  }
+  else
+  {
+    DEBUG_printf(("1cupsSignCredentialsRequest: Unable to create public key and X.509 certificate file \"%s\": %s", crtfile, strerror(errno)));
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
+    goto done;
+  }
+
+  DEBUG_puts("1cupsSignCredentialsRequest: Successfully created credentials.");
+
+  ret = true;
+
+  // Cleanup...
+  done:
+
+  if (crq)
+    gnutls_x509_crq_deinit(crq);
+  if (crt)
+    gnutls_x509_crt_deinit(crt);
+  if (root_crt)
+    gnutls_x509_crt_deinit(root_crt);
+  if (root_key)
+    gnutls_x509_privkey_deinit(root_key);
+
+  return (ret);
+}
+
+
 //
 // 'httpCopyCredentials()' - Copy the credentials associated with the peer in
 //                           an encrypted connection.

From 20cc44b7411d5b0e3e64cba881638a5161a45e65 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Wed, 31 May 2023 19:58:37 -0400
Subject: [PATCH 27/31] Finalize GNU TLS version of cupsSignCredentialsRequest.

---
 cups/tls-gnutls.c | 53 +++++++++++++++++++++++++----------------------
 1 file changed, 28 insertions(+), 25 deletions(-)

diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index ae1ccb19f..c72a48e9f 100644
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -76,7 +76,7 @@ cupsCreateCredentials(
   size_t		bytes;		// Number of bytes of data
   unsigned char		serial[4];	// Serial number buffer
   time_t		curtime;	// Current time
-  int			result;		// Result of GNU TLS calls
+  int			err;		// Result of GNU TLS calls
 
 
   DEBUG_printf(("cupsCreateCredentials(path=\"%s\", ca_cert=%s, purpose=0x%x, type=%d, usage=0x%x, organization=\"%s\", org_unit=\"%s\", locality=\"%s\", state_province=\"%s\", country=\"%s\", common_name=\"%s\", num_alt_names=%u, alt_names=%p, root_name=\"%s\", expiration_date=%ld)", path, ca_cert ? "true" : "false", purpose, type, usage, organization, org_unit, locality, state_province, country, common_name, (unsigned)num_alt_names, alt_names, root_name, (long)expiration_date));
@@ -104,10 +104,10 @@ cupsCreateCredentials(
   // Save it...
   bytes = sizeof(buffer);
 
-  if ((result = gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
+  if ((err = gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
   {
-    DEBUG_printf(("1cupsCreateCredentials: Unable to export private key: %s", gnutls_strerror(result)));
-    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
+    DEBUG_printf(("1cupsCreateCredentials: Unable to export private key: %s", gnutls_strerror(err)));
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(err), 0);
     goto done;
   }
   else if ((fp = cupsFileOpen(keyfile, "w")) != NULL)
@@ -272,10 +272,10 @@ cupsCreateCredentials(
 
   // Save it...
   bytes = sizeof(buffer);
-  if ((result = gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
+  if ((err = gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
   {
-    DEBUG_printf(("1cupsCreateCredentials: Unable to export public key and X.509 certificate: %s", gnutls_strerror(result)));
-    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
+    DEBUG_printf(("1cupsCreateCredentials: Unable to export public key and X.509 certificate: %s", gnutls_strerror(err)));
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(err), 0);
     goto done;
   }
   else if ((fp = cupsFileOpen(crtfile, "w")) != NULL)
@@ -341,7 +341,7 @@ cupsCreateCredentialsRequest(
   cups_file_t		*fp;		// Key/cert file
   unsigned char		buffer[8192];	// Buffer for key/cert data
   size_t		bytes;		// Number of bytes of data
-  int			result;		// GNU TLS status
+  int			err;		// GNU TLS status
 
 
   DEBUG_printf(("cupsCreateCredentialsRequest(path=\"%s\", purpose=0x%x, type=%d, usage=0x%x, organization=\"%s\", org_unit=\"%s\", locality=\"%s\", state_province=\"%s\", country=\"%s\", common_name=\"%s\", num_alt_names=%u, alt_names=%p)", path, purpose, type, usage, organization, org_unit, locality, state_province, country, common_name, (unsigned)num_alt_names, alt_names));
@@ -369,9 +369,9 @@ cupsCreateCredentialsRequest(
   // Save it...
   bytes = sizeof(buffer);
 
-  if ((result = gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
+  if ((err = gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
   {
-    DEBUG_printf(("1cupsCreateCredentialsRequest: Unable to export private key: %s", gnutls_strerror(result)));
+    DEBUG_printf(("1cupsCreateCredentialsRequest: Unable to export private key: %s", gnutls_strerror(err)));
     goto done;
   }
   else if ((fp = cupsFileOpen(keyfile, "w")) != NULL)
@@ -469,10 +469,10 @@ cupsCreateCredentialsRequest(
 
   // Save it...
   bytes = sizeof(buffer);
-  if ((result = gnutls_x509_crq_export(crq, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
+  if ((err = gnutls_x509_crq_export(crq, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
   {
-    DEBUG_printf(("1cupsCreateCredentialsRequest: Unable to export public key and X.509 certificate request: %s", gnutls_strerror(result)));
-    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
+    DEBUG_printf(("1cupsCreateCredentialsRequest: Unable to export public key and X.509 certificate request: %s", gnutls_strerror(err)));
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(err), 0);
     goto done;
   }
   else if ((fp = cupsFileOpen(csrfile, "w")) != NULL)
@@ -542,7 +542,6 @@ cupsSignCredentialsRequest(
   size_t		bytes;		// Number of bytes of data
   unsigned char		serial[4];	// Serial number buffer
   time_t		curtime;	// Current time
-  int			result;		// Result of GNU TLS calls
 
 
   DEBUG_printf(("cupsSignCredentialsRequest(path=\"%s\", common_name=\"%s\", request=\"%s\", root_name=\"%s\", allowed_purpose=0x%x, allowed_usage=0x%x, cb=%p, cb_data=%p, expiration_date=%ld)", path, common_name, request, root_name, allowed_purpose, allowed_usage, cb, cb_data, (long)expiration_date));
@@ -582,7 +581,9 @@ cupsSignCredentialsRequest(
   serial[3] = (unsigned char)(curtime);
 
   gnutls_x509_crt_init(&crt);
+  gnutls_x509_crt_set_crq(crt, crq);
 
+#if 0
   tempsize = sizeof(temp) - 1;
   if (gnutls_x509_crq_get_dn_by_oid(crq, GNUTLS_OID_X520_COUNTRY_NAME, 0, 0, temp, &tempsize) >= 0)
     temp[tempsize] = '\0';
@@ -619,8 +620,8 @@ cupsSignCredentialsRequest(
   else
     cupsCopyString(temp, "Unknown", sizeof(temp));
   gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_LOCALITY_NAME, 0, temp, strlen(temp));
+#endif // 0
 
-//  gnutls_x509_crt_set_key(crt, key);
   gnutls_x509_crt_set_serial(crt, serial, sizeof(serial));
   gnutls_x509_crt_set_activation_time(crt, curtime);
   gnutls_x509_crt_set_expiration_time(crt, expiration_date);
@@ -641,7 +642,7 @@ cupsSignCredentialsRequest(
     if (type != GNUTLS_SAN_DNSNAME || (cb)(common_name, temp, cb_data))
     {
       // Good subjectAltName
-      gnutls_x509_crt_set_subject_alt_name(crt, type, temp, (unsigned)strlen(temp), i ? GNUTLS_FSAN_APPEND : GNUTLS_FSAN_SET);
+//      gnutls_x509_crt_set_subject_alt_name(crt, type, temp, (unsigned)strlen(temp), i ? GNUTLS_FSAN_APPEND : GNUTLS_FSAN_SET);
     }
     else
     {
@@ -676,6 +677,7 @@ cupsSignCredentialsRequest(
     goto done;
   }
 
+#if 0
   if (purpose == 0 || (purpose & CUPS_CREDPURPOSE_SERVER_AUTH))
     gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_TLS_WWW_SERVER, 0);
   if (purpose & CUPS_CREDPURPOSE_CLIENT_AUTH)
@@ -686,6 +688,7 @@ cupsSignCredentialsRequest(
     gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_EMAIL_PROTECTION, 0);
   if (purpose & CUPS_CREDPURPOSE_OCSP_SIGNING)
     gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_OCSP_SIGNING, 0);
+#endif // 0
 
   if (gnutls_x509_crq_get_key_usage(crq, &gnutls_usage, NULL) < 0)
   {
@@ -723,7 +726,7 @@ cupsSignCredentialsRequest(
       goto done;
     }
   }
-  gnutls_x509_crt_set_key_usage(crt, gnutls_usage);
+//  gnutls_x509_crt_set_key_usage(crt, gnutls_usage);
 
   gnutls_x509_crt_set_version(crt, 3);
 
@@ -782,10 +785,10 @@ cupsSignCredentialsRequest(
   http_make_path(crtfile, sizeof(crtfile), path, common_name, "crt");
 
   bytes = sizeof(buffer);
-  if ((result = gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
+  if ((err = gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_PEM, buffer, &bytes)) < 0)
   {
-    DEBUG_printf(("1cupsSignCredentialsRequest: Unable to export public key and X.509 certificate: %s", gnutls_strerror(result)));
-    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(result), 0);
+    DEBUG_printf(("1cupsSignCredentialsRequest: Unable to export public key and X.509 certificate: %s", gnutls_strerror(err)));
+    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(err), 0);
     goto done;
   }
   else if ((fp = cupsFileOpen(crtfile, "w")) != NULL)
@@ -1186,7 +1189,7 @@ static gnutls_x509_crt_t			// O - Certificate
 gnutls_create_credential(
     http_credential_t *credential)		// I - Credential
 {
-  int			result;			// Result from GNU TLS
+  int			err;			// Result from GNU TLS
   gnutls_x509_crt_t	cert;			// Certificate
   gnutls_datum_t	datum;			// Data record
 
@@ -1196,18 +1199,18 @@ gnutls_create_credential(
   if (!credential)
     return (NULL);
 
-  if ((result = gnutls_x509_crt_init(&cert)) < 0)
+  if ((err = gnutls_x509_crt_init(&cert)) < 0)
   {
-    DEBUG_printf(("4gnutls_create_credential: init error: %s", gnutls_strerror(result)));
+    DEBUG_printf(("4gnutls_create_credential: init error: %s", gnutls_strerror(err)));
     return (NULL);
   }
 
   datum.data = credential->data;
   datum.size = credential->datalen;
 
-  if ((result = gnutls_x509_crt_import(cert, &datum, GNUTLS_X509_FMT_DER)) < 0)
+  if ((err = gnutls_x509_crt_import(cert, &datum, GNUTLS_X509_FMT_DER)) < 0)
   {
-    DEBUG_printf(("4gnutls_create_credential: import error: %s", gnutls_strerror(result)));
+    DEBUG_printf(("4gnutls_create_credential: import error: %s", gnutls_strerror(err)));
 
     gnutls_x509_crt_deinit(cert);
     return (NULL);

From 5ea07175b1e3e72a2d449e53f031d3add717a336 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Wed, 31 May 2023 20:20:13 -0400
Subject: [PATCH 28/31] Add testcreds to test suite.

---
 cups/Makefile | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/cups/Makefile b/cups/Makefile
index 9d44aa5d3..d54962834 100644
--- a/cups/Makefile
+++ b/cups/Makefile
@@ -188,28 +188,43 @@ test:		$(UNITTARGETS)
 #		echo Running CUPS API tests...; \
 #		./testcups 2>>test.log; \
 #	fi
+	echo ""
+	echo Running credentials API tests...
+	./testcreds 2>>test.log
+	echo ""
 	echo Running file API tests...
 	./testfile 2>>test.log
+	echo ""
 	echo Running form API tests...
 	./testform 2>>test.log
+#	echo ""
 #	echo Running cupsGetDests API tests...
 #	./testgetdests 2>>test.log
+	echo ""
 	echo Running hash API tests...
 	./testhash 2>>test.log
+	echo ""
 	echo Running HTTP API tests...
 	./testhttp 2>>test.log
+	echo ""
 	echo Running IPP API tests...
 	./testipp 2>>test.log
+	echo ""
 	echo Running internationalization API tests...
 	./testi18n 2>>test.log
+	echo ""
 	echo Running JSON API tests...
 	./testjson 2>>test.log
+	echo ""
 	echo Running JWT API tests...
 	./testjwt 2>>test.log
+	echo ""
 	echo Running option API tests...
 	./testoptions 2>>test.log
+	echo ""
 	echo Running PWG API tests...
 	./testpwg 2>>test.log
+	echo ""
 	echo Running raster API tests...
 	./testraster 2>>test.log
 	./testtestpage 2>>test.log
@@ -217,6 +232,7 @@ test:		$(UNITTARGETS)
 fuzz:		$(UNITTARGETS)
 	echo Fuzzing IPP API...
 	./fuzzipp 2>fuzz.log
+	echo ""
 	echo Fuzzing JSON API...
 	AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=yes AFL_NO_UI=yes afl-fuzz -n -i json-afl-in -o json-afl-out -V 120  -- ./testjson 2>>fuzz.log
 

From 91951443fa420282b3305964a59fefbb9b20d9df Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Wed, 31 May 2023 20:20:24 -0400
Subject: [PATCH 29/31] Update to use C99 comments.

---
 cups/debug.c  | 306 +++++++++++++++--------------------
 cups/string.c | 429 ++++++++++++++++++++++----------------------------
 2 files changed, 319 insertions(+), 416 deletions(-)

diff --git a/cups/debug.c b/cups/debug.c
index 68466ac67..4b18b367b 100644
--- a/cups/debug.c
+++ b/cups/debug.c
@@ -1,16 +1,16 @@
-/*
- * Debugging functions for CUPS.
- *
- * Copyright © 2022-2023 by OpenPrinting.
- * Copyright © 2008-2018 by Apple Inc.
- *
- * Licensed under Apache License v2.0.  See the file "LICENSE" for more
- * information.
- */
-
-/*
- * Include necessary headers...
- */
+//
+// Debugging functions for CUPS.
+//
+// Copyright © 2022-2023 by OpenPrinting.
+// Copyright © 2008-2018 by Apple Inc.
+//
+// Licensed under Apache License v2.0.  See the file "LICENSE" for more
+// information.
+//
+
+//
+// Include necessary headers...
+//
 
 #include "cups-private.h"
 #include "debug-internal.h"
@@ -20,11 +20,11 @@
 #  include <time.h>
 #  include <io.h>
 #  define getpid (int)GetCurrentProcessId
-int					/* O  - 0 on success, -1 on failure */
-_cups_gettimeofday(struct timeval *tv,	/* I  - Timeval struct */
-                   void		  *tz)	/* I  - Timezone */
+int					// O  - 0 on success, -1 on failure
+_cups_gettimeofday(struct timeval *tv,	// I  - Timeval struct
+                   void		  *tz)	// I  - Timezone
 {
-  struct _timeb timebuffer;		/* Time buffer struct */
+  struct _timeb timebuffer;		// Time buffer struct
   _ftime(&timebuffer);
   tv->tv_sec  = (long)timebuffer.time;
   tv->tv_usec = timebuffer.millitm * 1000;
@@ -33,79 +33,72 @@ _cups_gettimeofday(struct timeval *tv,	/* I  - Timeval struct */
 #else
 #  include <sys/time.h>
 #  include <unistd.h>
-#endif /* _WIN32 */
+#endif // _WIN32
 #include <regex.h>
 #include <fcntl.h>
 
 
 #ifdef DEBUG
-/*
- * Globals...
- */
+//
+// Globals...
+//
 
 int			_cups_debug_fd = -1;
-					/* Debug log file descriptor */
+					// Debug log file descriptor
 int			_cups_debug_level = 1;
-					/* Log level (0 to 9) */
+					// Log level (0 to 9)
 
 
-/*
- * Local globals...
- */
+//
+// Local globals...
+//
 
 static regex_t		*debug_filter = NULL;
-					/* Filter expression for messages */
-static int		debug_init = 0;	/* Did we initialize debugging? */
+					// Filter expression for messages
+static int		debug_init = 0;	// Did we initialize debugging?
 static cups_mutex_t	debug_init_mutex = CUPS_MUTEX_INITIALIZER,
-					/* Mutex to control initialization */
+					// Mutex to control initialization
 			debug_log_mutex = CUPS_MUTEX_INITIALIZER;
-					/* Mutex to serialize log entries */
+					// Mutex to serialize log entries
 
 
-/*
- * 'debug_thread_id()' - Return an integer representing the current thread.
- */
+//
+// 'debug_thread_id()' - Return an integer representing the current thread.
+//
 
-static int				/* O - Local thread ID */
+static int				// O - Local thread ID
 debug_thread_id(void)
 {
-  _cups_globals_t *cg = _cupsGlobals();	/* Global data */
+  _cups_globals_t *cg = _cupsGlobals();	// Global data
 
 
   return (cg->thread_id);
 }
 
 
-/*
- * '_cups_debug_printf()' - Write a formatted line to the log.
- */
+//
+// '_cups_debug_printf()' - Write a formatted line to the log.
+//
 
 void
-_cups_debug_printf(const char *format,	/* I - Printf-style format string */
-                   ...)			/* I - Additional arguments as needed */
+_cups_debug_printf(const char *format,	// I - Printf-style format string
+                   ...)			// I - Additional arguments as needed
 {
-  va_list		ap;		/* Pointer to arguments */
-  struct timeval	curtime;	/* Current time */
-  char			buffer[2048];	/* Output buffer */
-  ssize_t		bytes;		/* Number of bytes in buffer */
-  int			level;		/* Log level in message */
+  va_list		ap;		// Pointer to arguments
+  struct timeval	curtime;	// Current time
+  char			buffer[2048];	// Output buffer
+  ssize_t		bytes;		// Number of bytes in buffer
+  int			level;		// Log level in message
 
 
- /*
-  * See if we need to do any logging...
-  */
-
+  // See if we need to do any logging...
   if (!debug_init)
-    _cups_debug_set(getenv("CUPS_DEBUG_LOG"), getenv("CUPS_DEBUG_LEVEL"),
-                    getenv("CUPS_DEBUG_FILTER"), 0);
+    _cups_debug_set(getenv("CUPS_DEBUG_LOG"), getenv("CUPS_DEBUG_LEVEL"), getenv("CUPS_DEBUG_FILTER"), 0);
 
   if (_cups_debug_fd < 0)
     return;
 
- /*
-  * Filter as needed...
-  */
-
+  // Filter as needed...
   if (isdigit(format[0]))
     level = *format++ - '0';
   else
@@ -116,7 +109,7 @@ _cups_debug_printf(const char *format,	/* I - Printf-style format string */
 
   if (debug_filter)
   {
-    int	result;				/* Filter result */
+    int	result;				// Filter result
 
     cupsMutexLock(&debug_init_mutex);
     result = regexec(debug_filter, format, 0, NULL, 0);
@@ -126,15 +119,9 @@ _cups_debug_printf(const char *format,	/* I - Printf-style format string */
       return;
   }
 
- /*
-  * Format the message...
-  */
-
+  // Format the message...
   gettimeofday(&curtime, NULL);
-  snprintf(buffer, sizeof(buffer), "T%03d %02d:%02d:%02d.%03d  ",
-           debug_thread_id(), (int)((curtime.tv_sec / 3600) % 24),
-	   (int)((curtime.tv_sec / 60) % 60),
-	   (int)(curtime.tv_sec % 60), (int)(curtime.tv_usec / 1000));
+  snprintf(buffer, sizeof(buffer), "T%03d %02d:%02d:%02d.%03d  ", debug_thread_id(), (int)((curtime.tv_sec / 3600) % 24), (int)((curtime.tv_sec / 60) % 60), (int)(curtime.tv_sec % 60), (int)(curtime.tv_usec / 1000));
 
   va_start(ap, format);
   bytes = _cups_safe_vsnprintf(buffer + 19, sizeof(buffer) - 20, format, ap) + 19;
@@ -150,44 +137,34 @@ _cups_debug_printf(const char *format,	/* I - Printf-style format string */
     buffer[bytes++] = '\n';
   }
 
- /*
-  * Write it out...
-  */
-
+  // Write it out...
   cupsMutexLock(&debug_log_mutex);
   write(_cups_debug_fd, buffer, (size_t)bytes);
   cupsMutexUnlock(&debug_log_mutex);
 }
 
 
-/*
- * '_cups_debug_puts()' - Write a single line to the log.
- */
+//
+// '_cups_debug_puts()' - Write a single line to the log.
+//
 
 void
-_cups_debug_puts(const char *s)		/* I - String to output */
+_cups_debug_puts(const char *s)		// I - String to output
 {
-  struct timeval	curtime;	/* Current time */
-  char			buffer[2048];	/* Output buffer */
-  ssize_t		bytes;		/* Number of bytes in buffer */
-  int			level;		/* Log level in message */
+  struct timeval	curtime;	// Current time
+  char			buffer[2048];	// Output buffer
+  ssize_t		bytes;		// Number of bytes in buffer
+  int			level;		// Log level in message
 
 
- /*
-  * See if we need to do any logging...
-  */
-
+  // See if we need to do any logging...
   if (!debug_init)
-    _cups_debug_set(getenv("CUPS_DEBUG_LOG"), getenv("CUPS_DEBUG_LEVEL"),
-                    getenv("CUPS_DEBUG_FILTER"), 0);
+    _cups_debug_set(getenv("CUPS_DEBUG_LOG"), getenv("CUPS_DEBUG_LEVEL"), getenv("CUPS_DEBUG_FILTER"), 0);
 
   if (_cups_debug_fd < 0)
     return;
 
- /*
-  * Filter as needed...
-  */
-
+  // Filter as needed...
   if (isdigit(s[0]))
     level = *s++ - '0';
   else
@@ -198,7 +175,7 @@ _cups_debug_puts(const char *s)		/* I - String to output */
 
   if (debug_filter)
   {
-    int	result;				/* Filter result */
+    int	result;				// Filter result
 
     cupsMutexLock(&debug_init_mutex);
     result = regexec(debug_filter, s, 0, NULL, 0);
@@ -208,16 +185,9 @@ _cups_debug_puts(const char *s)		/* I - String to output */
       return;
   }
 
- /*
-  * Format the message...
-  */
-
+  // Format the message...
   gettimeofday(&curtime, NULL);
-  bytes = snprintf(buffer, sizeof(buffer), "T%03d %02d:%02d:%02d.%03d  %s",
-                   debug_thread_id(), (int)((curtime.tv_sec / 3600) % 24),
-		   (int)((curtime.tv_sec / 60) % 60),
-		   (int)(curtime.tv_sec % 60), (int)(curtime.tv_usec / 1000),
-		   s);
+  bytes = snprintf(buffer, sizeof(buffer), "T%03d %02d:%02d:%02d.%03d  %s", debug_thread_id(), (int)((curtime.tv_sec / 3600) % 24), (int)((curtime.tv_sec / 60) % 60), (int)(curtime.tv_sec % 60), (int)(curtime.tv_usec / 1000), s);
 
   if ((size_t)bytes >= (sizeof(buffer) - 1))
   {
@@ -227,37 +197,30 @@ _cups_debug_puts(const char *s)		/* I - String to output */
   else if (buffer[bytes - 1] != '\n')
   {
     buffer[bytes++] = '\n';
-    buffer[bytes]   = '\0';
   }
 
- /*
-  * Write it out...
-  */
-
+  // Write it out...
   cupsMutexLock(&debug_log_mutex);
   write(_cups_debug_fd, buffer, (size_t)bytes);
   cupsMutexUnlock(&debug_log_mutex);
 }
 
 
-/*
- * '_cups_debug_set()' - Enable or disable debug logging.
- */
+//
+// '_cups_debug_set()' - Enable or disable debug logging.
+//
 
 void
-_cups_debug_set(const char *logfile,	/* I - Log file or NULL */
-                const char *level,	/* I - Log level or NULL */
-		const char *filter,	/* I - Filter string or NULL */
-		int        force)	/* I - Force initialization */
+_cups_debug_set(const char *logfile,	// I - Log file or NULL
+                const char *level,	// I - Log level or NULL
+		const char *filter,	// I - Filter string or NULL
+		int        force)	// I - Force initialization
 {
   cupsMutexLock(&debug_init_mutex);
 
   if (!debug_init || force)
   {
-   /*
-    * Restore debug settings to defaults...
-    */
-
+    // Restore debug settings to defaults...
     if (_cups_debug_fd != -1)
     {
       close(_cups_debug_fd);
@@ -272,17 +235,18 @@ _cups_debug_set(const char *logfile,	/* I - Log file or NULL */
 
     _cups_debug_level = 1;
 
-   /*
-    * Open logs, set log levels, etc.
-    */
-
+    // Open logs, set log levels, etc.
     if (!logfile)
+    {
       _cups_debug_fd = -1;
+    }
     else if (!strcmp(logfile, "-"))
+    {
       _cups_debug_fd = 2;
+    }
     else
     {
-      char	buffer[1024];		/* Filename buffer */
+      char	buffer[1024];		// Filename buffer
 
       snprintf(buffer, sizeof(buffer), logfile, getpid());
 
@@ -298,12 +262,12 @@ _cups_debug_set(const char *logfile,	/* I - Log file or NULL */
     if (filter)
     {
       if ((debug_filter = (regex_t *)calloc(1, sizeof(regex_t))) == NULL)
-	fputs("Unable to allocate memory for CUPS_DEBUG_FILTER - results not "
-	      "filtered!\n", stderr);
+      {
+	fputs("Unable to allocate memory for CUPS_DEBUG_FILTER - results not filtered.\n", stderr);
+      }
       else if (regcomp(debug_filter, filter, REG_EXTENDED))
       {
-	fputs("Bad regular expression in CUPS_DEBUG_FILTER - results not "
-	      "filtered!\n", stderr);
+	fputs("Bad regular expression in CUPS_DEBUG_FILTER - results not filtered.\n", stderr);
 	free(debug_filter);
 	debug_filter = NULL;
       }
@@ -317,56 +281,53 @@ _cups_debug_set(const char *logfile,	/* I - Log file or NULL */
 
 
 #else
-/*
- * '_cups_debug_set()' - Enable or disable debug logging.
- */
+//
+// '_cups_debug_set()' - Enable or disable debug logging.
+//
 
 void
-_cups_debug_set(const char *logfile,	/* I - Log file or NULL */
-		const char *level,	/* I - Log level or NULL */
-		const char *filter,	/* I - Filter string or NULL */
-		int        force)	/* I - Force initialization */
+_cups_debug_set(const char *logfile,	// I - Log file or NULL
+		const char *level,	// I - Log level or NULL
+		const char *filter,	// I - Filter string or NULL
+		int        force)	// I - Force initialization
 {
   (void)logfile;
   (void)level;
   (void)filter;
   (void)force;
 }
-#endif /* DEBUG */
+#endif // DEBUG
 
 
-/*
- * '_cups_safe_vsnprintf()' - Format a string into a fixed size buffer,
- *                            quoting special characters.
- */
+//
+// '_cups_safe_vsnprintf()' - Format a string into a fixed size buffer,
+//                            quoting special characters.
+//
 
-ssize_t					/* O - Number of bytes formatted */
+ssize_t					// O - Number of bytes formatted
 _cups_safe_vsnprintf(
-    char       *buffer,			/* O - Output buffer */
-    size_t     bufsize,			/* O - Size of output buffer */
-    const char *format,			/* I - printf-style format string */
-    va_list    ap)			/* I - Pointer to additional arguments */
+    char       *buffer,			// O - Output buffer
+    size_t     bufsize,			// O - Size of output buffer
+    const char *format,			// I - printf-style format string
+    va_list    ap)			// I - Pointer to additional arguments
 {
-  char		*bufptr,		/* Pointer to position in buffer */
-		*bufend,		/* Pointer to end of buffer */
-		size,			/* Size character (h, l, L) */
-		type;			/* Format type character */
-  int		width,			/* Width of field */
-		prec;			/* Number of characters of precision */
-  char		tformat[100],		/* Temporary format string for snprintf() */
-		*tptr,			/* Pointer into temporary format */
-		temp[1024];		/* Buffer for formatted numbers */
-  char		*s;			/* Pointer to string */
-  ssize_t	bytes;			/* Total number of bytes needed */
+  char		*bufptr,		// Pointer to position in buffer
+		*bufend,		// Pointer to end of buffer
+		size,			// Size character (h, l, L)
+		type;			// Format type character
+  int		width,			// Width of field
+		prec;			// Number of characters of precision
+  char		tformat[100],		// Temporary format string for snprintf()
+		*tptr,			// Pointer into temporary format
+		temp[1024];		// Buffer for formatted numbers
+  char		*s;			// Pointer to string
+  ssize_t	bytes;			// Total number of bytes needed
 
 
   if (!buffer || bufsize < 2 || !format)
     return (-1);
 
- /*
-  * Loop through the format string, formatting as needed...
-  */
-
+  // Loop through the format string, formatting as needed...
   bufptr = buffer;
   bufend = buffer + bufsize - 1;
   bytes  = 0;
@@ -387,14 +348,13 @@ _cups_safe_vsnprintf(
 	continue;
       }
       else if (strchr(" -+#\'", *format))
+      {
         *tptr++ = *format++;
+      }
 
       if (*format == '*')
       {
-       /*
-        * Get width from argument...
-	*/
-
+        // Get width from argument...
 	format ++;
 	width = va_arg(ap, int);
 
@@ -423,10 +383,7 @@ _cups_safe_vsnprintf(
 
         if (*format == '*')
 	{
-         /*
-	  * Get precision from argument...
-	  */
-
+          // Get precision from argument...
 	  format ++;
 	  prec = va_arg(ap, int);
 
@@ -467,7 +424,9 @@ _cups_safe_vsnprintf(
         size = *format++;
       }
       else
+      {
         size = 0;
+      }
 
       if (!*format)
         break;
@@ -480,7 +439,7 @@ _cups_safe_vsnprintf(
 
       switch (type)
       {
-	case 'E' : /* Floating point formats */
+	case 'E' : // Floating point formats
 	case 'G' :
 	case 'e' :
 	case 'f' :
@@ -499,7 +458,7 @@ _cups_safe_vsnprintf(
 	    }
 	    break;
 
-        case 'B' : /* Integer formats */
+        case 'B' : // Integer formats
 	case 'X' :
 	case 'b' :
         case 'd' :
@@ -514,7 +473,7 @@ _cups_safe_vsnprintf(
             if (size == 'L')
 	      snprintf(temp, sizeof(temp), tformat, va_arg(ap, long long));
 	    else
-#  endif /* HAVE_LONG_LONG */
+#  endif // HAVE_LONG_LONG
             if (size == 'l')
 	      snprintf(temp, sizeof(temp), tformat, va_arg(ap, long));
 	    else
@@ -529,7 +488,7 @@ _cups_safe_vsnprintf(
 	    }
 	    break;
 
-	case 'p' : /* Pointer value */
+	case 'p' : // Pointer value
 	    if ((size_t)(width + 2) > sizeof(temp))
 	      break;
 
@@ -544,7 +503,7 @@ _cups_safe_vsnprintf(
 	    }
 	    break;
 
-        case 'c' : /* Character or character array */
+        case 'c' : // Character or character array
 	    bytes += width;
 
 	    if (bufptr && bufptr < bufend)
@@ -564,7 +523,7 @@ _cups_safe_vsnprintf(
 	    }
 	    break;
 
-	case 's' : /* String */
+	case 's' : // String
 	    if ((s = va_arg(ap, char *)) == NULL)
 	      s = "(null)";
 
@@ -574,11 +533,7 @@ _cups_safe_vsnprintf(
 	      break;
 	    }
 
-           /*
-	    * Copy the C string, replacing control chars and \ with
-	    * C character escapes...
-	    */
-
+            // Copy the C string, replacing control chars and \ with C character escapes...
             for (bufend --; *s && bufptr < bufend; s ++)
 	    {
 	      if (*s == '\n')
@@ -638,7 +593,7 @@ _cups_safe_vsnprintf(
             bufend ++;
 	    break;
 
-	case 'n' : /* Output number of chars so far */
+	case 'n' : // Output number of chars so far
 	    *(va_arg(ap, int *)) = (int)bytes;
 	    break;
       }
@@ -654,10 +609,7 @@ _cups_safe_vsnprintf(
     }
   }
 
- /*
-  * Nul-terminate the string and return the number of characters needed.
-  */
-
+  // Nul-terminate the string and return the number of characters needed.
   if (bufptr)
     *bufptr = '\0';
 
diff --git a/cups/string.c b/cups/string.c
index 6e650ea62..02c9b2c4b 100644
--- a/cups/string.c
+++ b/cups/string.c
@@ -1,17 +1,17 @@
-/*
- * String functions for CUPS.
- *
- * Copyright © 2022-2023 by OpenPrinting.
- * Copyright © 2007-2019 by Apple Inc.
- * Copyright © 1997-2007 by Easy Software Products.
- *
- * Licensed under Apache License v2.0.  See the file "LICENSE" for more
- * information.
- */
-
-/*
- * Include necessary headers...
- */
+//
+// String functions for CUPS.
+//
+// Copyright © 2022-2023 by OpenPrinting.
+// Copyright © 2007-2019 by Apple Inc.
+// Copyright © 1997-2007 by Easy Software Products.
+//
+// Licensed under Apache License v2.0.  See the file "LICENSE" for more
+// information.
+//
+
+//
+// Include necessary headers...
+//
 
 #define _CUPS_STRING_C_
 #include "cups-private.h"
@@ -20,46 +20,40 @@
 #include <limits.h>
 
 
-/*
- * Local globals...
- */
+//
+// Local globals...
+//
 
 static cups_mutex_t	sp_mutex = CUPS_MUTEX_INITIALIZER;
-					/* Mutex to control access to pool */
+					// Mutex to control access to pool
 static cups_array_t	*stringpool = NULL;
-					/* Global string pool */
+					// Global string pool
 
 
-/*
- * Local functions...
- */
+//
+// Local functions...
+//
 
 static int	compare_sp_items(_cups_sp_item_t *a, _cups_sp_item_t *b);
 
 
-/*
- * '_cupsStrAlloc()' - Allocate/reference a string.
- */
+//
+// '_cupsStrAlloc()' - Allocate/reference a string.
+//
 
-char *					/* O - String pointer */
-_cupsStrAlloc(const char *s)		/* I - String */
+char *					// O - String pointer
+_cupsStrAlloc(const char *s)		// I - String
 {
-  size_t		slen;		/* Length of string */
-  _cups_sp_item_t	*item,		/* String pool item */
-			*key;		/* Search key */
+  size_t		slen;		// Length of string
+  _cups_sp_item_t	*item,		// String pool item
+			*key;		// Search key
 
 
- /*
-  * Range check input...
-  */
-
+  // Range check input...
   if (!s)
     return (NULL);
 
- /*
-  * Get the string pool...
-  */
-
+  // Get the string pool...
   cupsMutexLock(&sp_mutex);
 
   if (!stringpool)
@@ -72,18 +66,12 @@ _cupsStrAlloc(const char *s)		/* I - String */
     return (NULL);
   }
 
- /*
-  * See if the string is already in the pool...
-  */
-
+  // See if the string is already in the pool...
   key = (_cups_sp_item_t *)(s - offsetof(_cups_sp_item_t, str));
 
   if ((item = (_cups_sp_item_t *)cupsArrayFind(stringpool, key)) != NULL)
   {
-   /*
-    * Found it, return the cached string...
-    */
-
+    // Found it, return the cached string...
     item->ref_count ++;
 
 #ifdef DEBUG_GUARDS
@@ -91,17 +79,14 @@ _cupsStrAlloc(const char *s)		/* I - String */
 
     if (item->guard != _CUPS_STR_GUARD)
       abort();
-#endif /* DEBUG_GUARDS */
+#endif // DEBUG_GUARDS
 
     cupsMutexUnlock(&sp_mutex);
 
     return (item->str);
   }
 
- /*
-  * Not found, so allocate a new one...
-  */
-
+  // Not found, so allocate a new one...
   slen = strlen(s);
   item = (_cups_sp_item_t *)calloc(1, sizeof(_cups_sp_item_t) + slen);
   if (!item)
@@ -118,12 +103,9 @@ _cupsStrAlloc(const char *s)		/* I - String */
   item->guard = _CUPS_STR_GUARD;
 
   DEBUG_printf(("5_cupsStrAlloc: Created string %p(%s) for \"%s\", guard=%08x, ref_count=%d", item, item->str, s, item->guard, item->ref_count));
-#endif /* DEBUG_GUARDS */
-
- /*
-  * Add the string to the pool and return it...
-  */
+#endif // DEBUG_GUARDS
 
+  // Add the string to the pool and return it...
   cupsArrayAdd(stringpool, item);
 
   cupsMutexUnlock(&sp_mutex);
@@ -132,14 +114,14 @@ _cupsStrAlloc(const char *s)		/* I - String */
 }
 
 
-/*
- * 'cupsConcatString()' - Safely concatenate two strings.
- */
+//
+// 'cupsConcatString()' - Safely concatenate two strings.
+//
 
-size_t					/* O - Length of string */
-cupsConcatString(char       *dst,	/* O - Destination string */
-                 const char *src,	/* I - Source string */
-	         size_t     dstsize)	/* I - Size of destination string buffer */
+size_t					// O - Length of string
+cupsConcatString(char       *dst,	// O - Destination string
+                 const char *src,	// I - Source string
+	         size_t     dstsize)	// I - Size of destination string buffer
 {
   // Range check input...
   if (!dst || !src || dstsize == 0)
@@ -149,15 +131,15 @@ cupsConcatString(char       *dst,	/* O - Destination string */
   return (strlcat(dst, src, dstsize));
 
 #else
-  size_t	srclen;			/* Length of source string */
-  size_t	dstlen;			/* Length of destination string */
+  size_t	srclen;			// Length of source string
+  size_t	dstlen;			// Length of destination string
 
 
   // Figure out how much room is left...
   dstlen = strlen(dst);
 
   if (dstsize < (dstlen + 1))
-    return (dstlen);		        /* No room, return immediately... */
+    return (dstlen);		        // No room, return immediately...
 
   dstsize -= dstlen + 1;
 
@@ -176,14 +158,14 @@ cupsConcatString(char       *dst,	/* O - Destination string */
 }
 
 
-/*
- * 'cupsCopyString()' - Safely copy two strings.
- */
+//
+// 'cupsCopyString()' - Safely copy two strings.
+//
 
-size_t					/* O - Length of string */
-cupsCopyString(char       *dst,		/* O - Destination string */
-               const char *src,		/* I - Source string */
-	       size_t     dstsize)	/* I - Size of destination string buffer */
+size_t					// O - Length of string
+cupsCopyString(char       *dst,		// O - Destination string
+               const char *src,		// I - Source string
+	       size_t     dstsize)	// I - Size of destination string buffer
 {
   // Range check input...
   if (!dst || !src || dstsize == 0)
@@ -193,7 +175,7 @@ cupsCopyString(char       *dst,		/* O - Destination string */
   return (strlcpy(dst, src, dstsize));
 
 #else
-  size_t	srclen;			/* Length of source string */
+  size_t	srclen;			// Length of source string
 
   // Figure out how much room is needed...
   dstsize --;
@@ -212,14 +194,14 @@ cupsCopyString(char       *dst,		/* O - Destination string */
 }
 
 
-/*
- * '_cupsStrFlush()' - Flush the string pool.
- */
+//
+// '_cupsStrFlush()' - Flush the string pool.
+//
 
 void
 _cupsStrFlush(void)
 {
-  _cups_sp_item_t	*item;		/* Current item */
+  _cups_sp_item_t	*item;		// Current item
 
 
   DEBUG_printf(("4_cupsStrFlush: %u strings in array", (unsigned)cupsArrayGetCount(stringpool)));
@@ -236,38 +218,31 @@ _cupsStrFlush(void)
 }
 
 
-/*
- * '_cupsStrFormatd()' - Format a floating-point number.
- */
+//
+// '_cupsStrFormatd()' - Format a floating-point number.
+//
 
-char *					/* O - Pointer to end of string */
-_cupsStrFormatd(char         *buf,	/* I - String */
-                char         *bufend,	/* I - End of string buffer */
-		double       number,	/* I - Number to format */
-                struct lconv *loc)	/* I - Locale data */
+char *					// O - Pointer to end of string
+_cupsStrFormatd(char         *buf,	// I - String
+                char         *bufend,	// I - End of string buffer
+		double       number,	// I - Number to format
+                struct lconv *loc)	// I - Locale data
 {
-  char		*bufptr,		/* Pointer into buffer */
-		temp[1024],		/* Temporary string */
-		*tempdec,		/* Pointer to decimal point */
-		*tempptr;		/* Pointer into temporary string */
-  const char	*dec;			/* Decimal point */
-  int		declen;			/* Length of decimal point */
-
+  char		*bufptr,		// Pointer into buffer
+		temp[1024],		// Temporary string
+		*tempdec,		// Pointer to decimal point
+		*tempptr;		// Pointer into temporary string
+  const char	*dec;			// Decimal point
+  int		declen;			// Length of decimal point
 
- /*
-  * Format the number using the "%.12f" format and then eliminate
-  * unnecessary trailing 0's.
-  */
 
+  // Format the number using the "%.12f" format and then eliminate unnecessary trailing 0's.
   snprintf(temp, sizeof(temp), "%.12f", number);
-  for (tempptr = temp + strlen(temp) - 1;
-       tempptr > temp && *tempptr == '0';
-       *tempptr-- = '\0');
-
- /*
-  * Next, find the decimal point...
-  */
+  tempptr = temp + strlen(temp) - 1;
+  while (tempptr > temp && *tempptr == '0')
+    *tempptr-- = '\0';
 
+  // Next, find the decimal point...
   if (loc && loc->decimal_point)
   {
     dec    = loc->decimal_point;
@@ -284,15 +259,15 @@ _cupsStrFormatd(char         *buf,	/* I - String */
   else
     tempdec = strstr(temp, dec);
 
- /*
-  * Copy everything up to the decimal point...
-  */
-
+  // Copy everything up to the decimal point...
   if (tempdec)
   {
-    for (tempptr = temp, bufptr = buf;
-         tempptr < tempdec && bufptr < bufend;
-	 *bufptr++ = *tempptr++);
+    tempptr = temp;
+    bufptr  = buf;
+    while (tempptr < tempdec && bufptr < bufend)
+    {
+      *bufptr++ = *tempptr++;
+    }
 
     tempptr += declen;
 
@@ -316,39 +291,33 @@ _cupsStrFormatd(char         *buf,	/* I - String */
 }
 
 
-/*
- * '_cupsStrFree()' - Free/dereference a string.
- */
+//
+// '_cupsStrFree()' - Free/dereference a string.
+//
 
 void
-_cupsStrFree(const char *s)		/* I - String to free */
+_cupsStrFree(const char *s)		// I - String to free
 {
-  _cups_sp_item_t	*item,		/* String pool item */
-			*key;		/* Search key */
+  _cups_sp_item_t	*item,		// String pool item
+			*key;		// Search key
 
 
- /*
-  * Range check input...
-  */
-
+  // Range check input...
   if (!s)
     return;
 
- /*
-  * Check the string pool...
-  *
-  * We don't need to lock the mutex yet, as we only want to know if
-  * the stringpool is initialized.  The rest of the code will still
-  * work if it is initialized before we lock...
-  */
+  //
+  // Check the string pool...
+  //
+  // We don't need to lock the mutex yet, as we only want to know if
+  // the stringpool is initialized.  The rest of the code will still
+  // work if it is initialized before we lock...
+  //
 
   if (!stringpool)
     return;
 
- /*
-  * See if the string is already in the pool...
-  */
-
+  // See if the string is already in the pool...
   cupsMutexLock(&sp_mutex);
 
   key = (_cups_sp_item_t *)(s - offsetof(_cups_sp_item_t, str));
@@ -356,26 +325,20 @@ _cupsStrFree(const char *s)		/* I - String to free */
   if ((item = (_cups_sp_item_t *)cupsArrayFind(stringpool, key)) != NULL &&
       item == key)
   {
-   /*
-    * Found it, dereference...
-    */
-
+    // Found it, dereference...
 #ifdef DEBUG_GUARDS
     if (key->guard != _CUPS_STR_GUARD)
     {
       DEBUG_printf(("5_cupsStrFree: Freeing string %p(%s), guard=%08x, ref_count=%d", key, key->str, key->guard, key->ref_count));
       abort();
     }
-#endif /* DEBUG_GUARDS */
+#endif // DEBUG_GUARDS
 
     item->ref_count --;
 
     if (!item->ref_count)
     {
-     /*
-      * Remove and free...
-      */
-
+      // Remove and free...
       cupsArrayRemove(stringpool, item);
 
       free(item);
@@ -386,18 +349,18 @@ _cupsStrFree(const char *s)		/* I - String to free */
 }
 
 
-/*
- * '_cupsStrRetain()' - Increment the reference count of a string.
- *
- * Note: This function does not verify that the passed pointer is in the
- *       string pool, so any calls to it MUST know they are passing in a
- *       good pointer.
- */
+//
+// '_cupsStrRetain()' - Increment the reference count of a string.
+//
+// Note: This function does not verify that the passed pointer is in the
+//       string pool, so any calls to it MUST know they are passing in a
+//       good pointer.
+//
 
-char *					/* O - Pointer to string */
-_cupsStrRetain(const char *s)		/* I - String to retain */
+char *					// O - Pointer to string
+_cupsStrRetain(const char *s)		// I - String to retain
 {
-  _cups_sp_item_t	*item;		/* Pointer to string pool item */
+  _cups_sp_item_t	*item;		// Pointer to string pool item
 
 
   if (s)
@@ -411,7 +374,7 @@ _cupsStrRetain(const char *s)		/* I - String to retain */
                     "ref_count=%d", item, s, item->guard, item->ref_count));
       abort();
     }
-#endif /* DEBUG_GUARDS */
+#endif // DEBUG_GUARDS
 
     cupsMutexLock(&sp_mutex);
 
@@ -424,47 +387,41 @@ _cupsStrRetain(const char *s)		/* I - String to retain */
 }
 
 
-/*
- * '_cupsStrScand()' - Scan a string for a floating-point number.
- *
- * This function handles the locale-specific BS so that a decimal
- * point is always the period (".")...
- */
+//
+// '_cupsStrScand()' - Scan a string for a floating-point number.
+//
+// This function handles the locale-specific BS so that a decimal
+// point is always the period (".")...
+//
 
-double					/* O - Number */
-_cupsStrScand(const char   *buf,	/* I - Pointer to number */
-              char         **bufptr,	/* O - New pointer or NULL on error */
-              struct lconv *loc)	/* I - Locale data */
+double					// O - Number
+_cupsStrScand(const char   *buf,	// I - Pointer to number
+              char         **bufptr,	// O - New pointer or NULL on error
+              struct lconv *loc)	// I - Locale data
 {
-  char	temp[1024],			/* Temporary buffer */
-	*tempptr;			/* Pointer into temporary buffer */
-
+  char	temp[1024],			// Temporary buffer
+	*tempptr;			// Pointer into temporary buffer
 
- /*
-  * Range check input...
-  */
 
+  // Range check input...
   if (!buf)
     return (0.0);
 
- /*
-  * Skip leading whitespace...
-  */
-
+  // Skip leading whitespace...
   while (_cups_isspace(*buf))
     buf ++;
 
- /*
-  * Copy leading sign, numbers, period, and then numbers...
-  */
-
+  // Copy leading sign, numbers, period, and then numbers...
   tempptr = temp;
   if (*buf == '-' || *buf == '+')
     *tempptr++ = *buf++;
 
   while (isdigit(*buf & 255))
+  {
     if (tempptr < (temp + sizeof(temp) - 1))
+    {
       *tempptr++ = *buf++;
+    }
     else
     {
       if (bufptr)
@@ -472,13 +429,11 @@ _cupsStrScand(const char   *buf,	/* I - Pointer to number */
 
       return (0.0);
     }
+  }
 
   if (*buf == '.')
   {
-   /*
-    * Read fractional portion of number...
-    */
-
+    // Read fractional portion of number...
     buf ++;
 
     if (loc && loc->decimal_point)
@@ -487,7 +442,9 @@ _cupsStrScand(const char   *buf,	/* I - Pointer to number */
       tempptr += strlen(tempptr);
     }
     else if (tempptr < (temp + sizeof(temp) - 1))
+    {
       *tempptr++ = '.';
+    }
     else
     {
       if (bufptr)
@@ -497,8 +454,11 @@ _cupsStrScand(const char   *buf,	/* I - Pointer to number */
     }
 
     while (isdigit(*buf & 255))
+    {
       if (tempptr < (temp + sizeof(temp) - 1))
+      {
 	*tempptr++ = *buf++;
+      }
       else
       {
 	if (bufptr)
@@ -506,16 +466,16 @@ _cupsStrScand(const char   *buf,	/* I - Pointer to number */
 
 	return (0.0);
       }
+    }
   }
 
   if (*buf == 'e' || *buf == 'E')
   {
-   /*
-    * Read exponent...
-    */
-
+    // Read exponent...
     if (tempptr < (temp + sizeof(temp) - 1))
+    {
       *tempptr++ = *buf++;
+    }
     else
     {
       if (bufptr)
@@ -527,7 +487,9 @@ _cupsStrScand(const char   *buf,	/* I - Pointer to number */
     if (*buf == '+' || *buf == '-')
     {
       if (tempptr < (temp + sizeof(temp) - 1))
+      {
 	*tempptr++ = *buf++;
+      }
       else
       {
 	if (bufptr)
@@ -538,8 +500,11 @@ _cupsStrScand(const char   *buf,	/* I - Pointer to number */
     }
 
     while (isdigit(*buf & 255))
+    {
       if (tempptr < (temp + sizeof(temp) - 1))
+      {
 	*tempptr++ = *buf++;
+      }
       else
       {
 	if (bufptr)
@@ -547,12 +512,10 @@ _cupsStrScand(const char   *buf,	/* I - Pointer to number */
 
 	return (0.0);
       }
+    }
   }
 
- /*
-  * Nul-terminate the temporary string and return the value...
-  */
-
+  // Nul-terminate the temporary string and return the value...
   if (bufptr)
     *bufptr = (char *)buf;
 
@@ -562,36 +525,27 @@ _cupsStrScand(const char   *buf,	/* I - Pointer to number */
 }
 
 
-/*
- * '_cupsStrStatistics()' - Return allocation statistics for string pool.
- */
+//
+// '_cupsStrStatistics()' - Return allocation statistics for string pool.
+//
 
-size_t					/* O - Number of strings */
-_cupsStrStatistics(size_t *alloc_bytes,	/* O - Allocated bytes */
-                   size_t *total_bytes)	/* O - Total string bytes */
+size_t					// O - Number of strings
+_cupsStrStatistics(size_t *alloc_bytes,	// O - Allocated bytes
+                   size_t *total_bytes)	// O - Total string bytes
 {
-  size_t		count,		/* Number of strings */
-			abytes,		/* Allocated string bytes */
-			tbytes,		/* Total string bytes */
-			len;		/* Length of string */
-  _cups_sp_item_t	*item;		/* Current item */
-
+  size_t		count,		// Number of strings
+			abytes,		// Allocated string bytes
+			tbytes,		// Total string bytes
+			len;		// Length of string
+  _cups_sp_item_t	*item;		// Current item
 
- /*
-  * Loop through strings in pool, counting everything up...
-  */
 
+  // Loop through strings in pool, counting everything up...
   cupsMutexLock(&sp_mutex);
 
-  for (count = 0, abytes = 0, tbytes = 0,
-           item = (_cups_sp_item_t *)cupsArrayGetFirst(stringpool);
-       item;
-       item = (_cups_sp_item_t *)cupsArrayGetNext(stringpool))
+  for (count = 0, abytes = 0, tbytes = 0, item = (_cups_sp_item_t *)cupsArrayGetFirst(stringpool); item; item = (_cups_sp_item_t *)cupsArrayGetNext(stringpool))
   {
-   /*
-    * Count allocated memory, using a 64-bit aligned buffer as a basis.
-    */
-
+    // Count allocated memory, using a 64-bit aligned buffer as a basis.
     count  += item->ref_count;
     len    = (strlen(item->str) + 8) & (size_t)~7;
     abytes += sizeof(_cups_sp_item_t) + len;
@@ -600,10 +554,7 @@ _cupsStrStatistics(size_t *alloc_bytes,	/* O - Allocated bytes */
 
   cupsMutexUnlock(&sp_mutex);
 
- /*
-  * Return values...
-  */
-
+  // Return values...
   if (alloc_bytes)
     *alloc_bytes = abytes;
 
@@ -614,13 +565,13 @@ _cupsStrStatistics(size_t *alloc_bytes,	/* O - Allocated bytes */
 }
 
 
-/*
- * '_cups_strcpy()' - Copy a string allowing for overlapping strings.
- */
+//
+// '_cups_strcpy()' - Copy a string allowing for overlapping strings.
+//
 
 void
-_cups_strcpy(char       *dst,		/* I - Destination string */
-             const char *src)		/* I - Source string */
+_cups_strcpy(char       *dst,		// I - Destination string
+             const char *src)		// I - Source string
 {
   while (*src)
     *dst++ = *src++;
@@ -629,13 +580,13 @@ _cups_strcpy(char       *dst,		/* I - Destination string */
 }
 
 
-/*
- * '_cups_strcasecmp()' - Do a case-insensitive comparison.
- */
+//
+// '_cups_strcasecmp()' - Do a case-insensitive comparison.
+//
 
-int				/* O - Result of comparison (-1, 0, or 1) */
-_cups_strcasecmp(const char *s,	/* I - First string */
-                 const char *t)	/* I - Second string */
+int				// O - Result of comparison (-1, 0, or 1)
+_cups_strcasecmp(const char *s,	// I - First string
+                 const char *t)	// I - Second string
 {
   while (*s != '\0' && *t != '\0')
   {
@@ -656,14 +607,14 @@ _cups_strcasecmp(const char *s,	/* I - First string */
     return (-1);
 }
 
-/*
- * '_cups_strncasecmp()' - Do a case-insensitive comparison on up to N chars.
- */
+//
+// '_cups_strncasecmp()' - Do a case-insensitive comparison on up to N chars.
+//
 
-int					/* O - Result of comparison (-1, 0, or 1) */
-_cups_strncasecmp(const char *s,	/* I - First string */
-                  const char *t,	/* I - Second string */
-		  size_t     n)		/* I - Maximum number of characters to compare */
+int					// O - Result of comparison (-1, 0, or 1)
+_cups_strncasecmp(const char *s,	// I - First string
+                  const char *t,	// I - Second string
+		  size_t     n)		// I - Maximum number of characters to compare
 {
   while (*s != '\0' && *t != '\0' && n > 0)
   {
@@ -688,13 +639,13 @@ _cups_strncasecmp(const char *s,	/* I - First string */
 }
 
 
-/*
- * 'compare_sp_items()' - Compare two string pool items...
- */
+//
+// 'compare_sp_items()' - Compare two string pool items...
+//
 
-static int				/* O - Result of comparison */
-compare_sp_items(_cups_sp_item_t *a,	/* I - First item */
-                 _cups_sp_item_t *b)	/* I - Second item */
+static int				// O - Result of comparison
+compare_sp_items(_cups_sp_item_t *a,	// I - First item
+                 _cups_sp_item_t *b)	// I - Second item
 {
   return (strcmp(a->str, b->str));
 }

From 5d17c1e7f6414ec1fbcffc76c12757028d51fd24 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Thu, 1 Jun 2023 12:41:22 -0400
Subject: [PATCH 30/31] Documentation.

---
 cups/Makefile      |   2 +-
 cups/cups.h        |  30 +-
 cups/testcreds.c   |  87 +++-
 cups/tls-gnutls.c  | 147 +++++++
 cups/tls-openssl.c | 147 +++++++
 doc/cupspm.epub    | Bin 229529 -> 236415 bytes
 doc/cupspm.html    | 993 +++++++++++++++++++++++++++++++++++++++++++--
 7 files changed, 1349 insertions(+), 57 deletions(-)

diff --git a/cups/Makefile b/cups/Makefile
index d54962834..5d260992b 100644
--- a/cups/Makefile
+++ b/cups/Makefile
@@ -648,7 +648,7 @@ doc:
 	echo "Generating CUPS Programming Manual..."
 	$(RM) cupspm.xml
 	codedoc --section "Programming" --body cupspm.md cupspm.xml \
-		$(LIBOBJS:.o=.c) $(HEADERS) --coverimage cupspm.png \
+		$(LIBOBJS:.o=.c) tls-openssl.c $(HEADERS) --coverimage cupspm.png \
 		--epub ../doc/cupspm.epub
 	codedoc --section "Programming" --body cupspm.md \
 		cupspm.xml > ../doc/cupspm.html
diff --git a/cups/cups.h b/cups/cups.h
index 70139b957..3fca693c8 100644
--- a/cups/cups.h
+++ b/cups/cups.h
@@ -133,7 +133,7 @@ extern "C" {
 // Types and structures...
 //
 
-enum cups_credpurpose_e			//// X.509 credential purposes
+enum cups_credpurpose_e			// X.509 credential purposes
 {
   CUPS_CREDPURPOSE_SERVER_AUTH = 0x01,		// serverAuth
   CUPS_CREDPURPOSE_CLIENT_AUTH = 0x02,		// clientAuth
@@ -143,9 +143,9 @@ enum cups_credpurpose_e			//// X.509 credential purposes
   CUPS_CREDPURPOSE_OCSP_SIGNING = 0x20,		// OCSPSigning
   CUPS_CREDPURPOSE_ALL = 0x3f			// All purposes
 };
-typedef unsigned cups_credpurpose_t;	//// Combined X.509 credential purposes for @link cupsCreateCredentials@ and @link cupsCreateCredentialsRequest@
+typedef unsigned cups_credpurpose_t;	// Combined X.509 credential purposes for @link cupsCreateCredentials@ and @link cupsCreateCredentialsRequest@
 
-typedef enum cups_credtype_e		//// X.509 credential types for @link cupsCreateCredentials@ and @link cupsCreateCredentialsRequest@
+typedef enum cups_credtype_e		// X.509 credential types for @link cupsCreateCredentials@ and @link cupsCreateCredentialsRequest@
 {
   CUPS_CREDTYPE_DEFAULT,			// Default type
   CUPS_CREDTYPE_RSA_2048_SHA256,		// RSA with 2048-bit keys and SHA-256 hash
@@ -156,7 +156,7 @@ typedef enum cups_credtype_e		//// X.509 credential types for @link cupsCreateCr
   CUPS_CREDTYPE_ECDSA_P521_SHA256		// ECDSA using the P-521 curve with SHA-256 hash
 } cups_credtype_t;
 
-enum cups_credusage_e			//// X.509 keyUsage flags
+enum cups_credusage_e			// X.509 keyUsage flags
 {
   CUPS_CREDUSAGE_DIGITAL_SIGNATURE = 0x001,	// digitalSignature
   CUPS_CREDUSAGE_NON_REPUDIATION = 0x002,	// nonRepudiation/contentCommitment
@@ -171,9 +171,9 @@ enum cups_credusage_e			//// X.509 keyUsage flags
   CUPS_CREDUSAGE_DEFAULT_TLS = 0x005,		// Defaults for TLS certs
   CUPS_CREDUSAGE_ALL = 0x1ff			// All keyUsage flags
 };
-typedef unsigned cups_credusage_t;	//// Combined X.509 keyUsage flags for @link cupsCreateCredentials@ and @link cupsCreateCredentialsRequest@
+typedef unsigned cups_credusage_t;	// Combined X.509 keyUsage flags for @link cupsCreateCredentials@ and @link cupsCreateCredentialsRequest@
 
-enum cups_dest_flags_e			//// Flags for @link cupsConnectDest@ and @link cupsEnumDests@
+enum cups_dest_flags_e			// Flags for @link cupsConnectDest@ and @link cupsEnumDests@
 {
   CUPS_DEST_FLAGS_NONE = 0x00,			// No flags are set
   CUPS_DEST_FLAGS_UNCONNECTED = 0x01,		// There is no connection
@@ -185,9 +185,9 @@ enum cups_dest_flags_e			//// Flags for @link cupsConnectDest@ and @link cupsEnu
   CUPS_DEST_FLAGS_CANCELED = 0x40,		// Operation was canceled
   CUPS_DEST_FLAGS_DEVICE = 0x80			// For @link cupsConnectDest@: Connect to device
 };
-typedef unsigned cups_dest_flags_t;	//// Combined flags for @link cupsConnectDest@ and @link cupsEnumDests@
+typedef unsigned cups_dest_flags_t;	// Combined flags for @link cupsConnectDest@ and @link cupsEnumDests@
 
-enum cups_media_flags_e			//// Flags for @link cupsGetDestMediaByName@ and @link cupsGetDestMediaBySize@
+enum cups_media_flags_e			// Flags for @link cupsGetDestMediaByName@ and @link cupsGetDestMediaBySize@
 {
   CUPS_MEDIA_FLAGS_DEFAULT = 0x00,		// Find the closest size supported by the printer
   CUPS_MEDIA_FLAGS_BORDERLESS = 0x01,		// Find a borderless size
@@ -195,9 +195,9 @@ enum cups_media_flags_e			//// Flags for @link cupsGetDestMediaByName@ and @link
   CUPS_MEDIA_FLAGS_EXACT = 0x04,		// Find an exact match for the size
   CUPS_MEDIA_FLAGS_READY = 0x08			// If the printer supports media sensing, find the size amongst the "ready" media.
 };
-typedef unsigned cups_media_flags_t;	//// Combined flags for @link cupsGetDestMediaByName@ and @link cupsGetDestMediaBySize@
+typedef unsigned cups_media_flags_t;	// Combined flags for @link cupsGetDestMediaByName@ and @link cupsGetDestMediaBySize@
 
-enum cups_ptype_e			//// Printer type/capability flags
+enum cups_ptype_e			// Printer type/capability flags
 {
   CUPS_PRINTER_LOCAL = 0x0000,			// Local printer or class
   CUPS_PRINTER_CLASS = 0x0001,			// Printer class
@@ -227,22 +227,22 @@ enum cups_ptype_e			//// Printer type/capability flags
   CUPS_PRINTER_MFP = 0x4000000,			// Printer with scanning capabilities
   CUPS_PRINTER_OPTIONS = 0x6fffc		// ~(CLASS | REMOTE | IMPLICIT | DEFAULT | FAX | REJECTING | DELETE | NOT_SHARED | AUTHENTICATED | COMMANDS | DISCOVERED) @private@
 };
-typedef unsigned cups_ptype_t;		//// Combined printer type/capability flags
+typedef unsigned cups_ptype_t;		// Combined printer type/capability flags
 
-typedef enum cups_whichjobs_e		//// Which jobs for @link cupsGetJobs@
+typedef enum cups_whichjobs_e		// Which jobs for @link cupsGetJobs@
 {
   CUPS_WHICHJOBS_ALL = -1,		// All jobs
   CUPS_WHICHJOBS_ACTIVE,		// Pending/held/processing jobs
   CUPS_WHICHJOBS_COMPLETED		// Completed/canceled/aborted jobs
 } cups_whichjobs_t;
 
-typedef struct cups_option_s		//// Printer Options
+typedef struct cups_option_s		// Printer Options
 {
   char		*name;			// Name of option
   char		*value;			// Value of option
 } cups_option_t;
 
-typedef struct cups_dest_s		//// Destination
+typedef struct cups_dest_s		// Destination
 {
   char		*name,			// Printer or class name
 		*instance;		// Local instance name or NULL
@@ -269,7 +269,7 @@ typedef struct cups_job_s		// Job
   time_t	processing_time;	// Time the job was processed
 } cups_job_t;
 
-typedef struct cups_size_s		//// Media information
+typedef struct cups_size_s		// Media information
 {
   char		media[128],		// Media name to use
 		color[128],		// Media color (blank for any/auto)
diff --git a/cups/testcreds.c b/cups/testcreds.c
index ca40d5321..b7c868876 100644
--- a/cups/testcreds.c
+++ b/cups/testcreds.c
@@ -25,6 +25,7 @@
 //   -C COUNTRY                 Set country.
 //   -L LOCALITY                Set locality name.
 //   -O ORGANIZATION            Set organization name.
+//   -R CSR-FILENAME            Specify certificate signing request filename.
 //   -S STATE                   Set state.
 //   -U ORGANIZATIONAL-UNIT     Set organizational unit name.
 //   -a SUBJECT-ALT-NAME        Add a subjectAltName.
@@ -60,7 +61,7 @@
 //
 
 static int	do_unit_tests(void);
-static int	test_ca(const char *common_name, const char *root_name, int days);
+static int	test_ca(const char *common_name, const char *csrfile, const char *root_name, int days);
 static int	test_cert(bool ca_cert, cups_credpurpose_t purpose, cups_credtype_t type, cups_credusage_t keyusage, const char *organization, const char *org_unit, const char *locality, const char *state, const char *country, const char *root_name, const char *common_name, size_t num_alt_names, const char **alt_names, int days);
 static int	test_client(const char *uri);
 static int	test_csr(cups_credpurpose_t purpose, cups_credtype_t type, cups_credusage_t keyusage, const char *organization, const char *org_unit, const char *locality, const char *state, const char *country, const char *common_name, size_t num_alt_names, const char **alt_names);
@@ -81,6 +82,7 @@ main(int  argc,				// I - Number of command-line arguments
   const char	*subcommand = NULL,	// Sub-command
 		*arg = NULL,		// Argument for sub-command
 		*opt,			// Current option character
+		*csrfile = NULL,	// Certificste signing request filename
 		*root_name = NULL,	// Name of root certificate
 		*organization = NULL,	// Organization
 		*org_unit = NULL,	// Organizational unit
@@ -146,6 +148,16 @@ main(int  argc,				// I - Number of command-line arguments
 	      organization = argv[i];
 	      break;
 
+          case 'R' : // -R CSR-FILENAME
+              i ++;
+              if (i >= argc)
+              {
+                fputs("testcreds: Missing CSR filename after '-R'.\n", stderr);
+                return (usage(stderr));
+	      }
+	      csrfile = argv[i];
+	      break;
+
           case 'S' : // -S STATE
               i ++;
               if (i >= argc)
@@ -350,7 +362,7 @@ main(int  argc,				// I - Number of command-line arguments
   // Run the corresponding sub-command...
   if (!strcmp(subcommand, "ca"))
   {
-    return (test_ca(arg, root_name, days));
+    return (test_ca(arg, csrfile, root_name, days));
   }
   else if (!strcmp(subcommand, "cacert"))
   {
@@ -522,14 +534,77 @@ do_unit_tests(void)
 
 static int				// O - Exit status
 test_ca(const char *common_name,	// I - Common name
+        const char *csrfile,		// I - CSR filename, if any
         const char *root_name,		// I - Root certificate name
         int        days)		// I - Number of days
 {
-  (void)common_name;
-  (void)root_name;
-  (void)days;
+  char	*request,			// Certificate request
+	*cert;				// Certificate
+
+
+  if (csrfile)
+  {
+    int		csrfd = open(csrfile, O_RDONLY);
+					// File descriptor
+    struct stat	csrinfo;		// File information
 
-  return (1);
+    if (csrfd < 0)
+    {
+      fprintf(stderr, "testcreds: Unable to access '%s': %s\n", csrfile, strerror(errno));
+      return (1);
+    }
+
+    if (fstat(csrfd, &csrinfo))
+    {
+      fprintf(stderr, "testcreds: Unable to stat '%s': %s\n", csrfile, strerror(errno));
+      close(csrfd);
+      return (1);
+    }
+
+    if ((request = malloc((size_t)csrinfo.st_size + 1)) == NULL)
+    {
+      fprintf(stderr, "testcreds: Unable to allocate memory for '%s': %s\n", csrfile, strerror(errno));
+      close(csrfd);
+      return (1);
+    }
+
+    if (read(csrfd, request, (size_t)csrinfo.st_size) < (ssize_t)csrinfo.st_size)
+    {
+      fprintf(stderr, "testcreds: Unable to read '%s'.\n", csrfile);
+      close(csrfd);
+      return (1);
+    }
+
+    close(csrfd);
+    request[csrinfo.st_size] = '\0';
+  }
+  else if ((request = cupsCopyCredentialsRequest(TEST_CERT_PATH, common_name)) == NULL)
+  {
+    fprintf(stderr, "testcreds: No request for '%s'.\n", common_name);
+    return (1);
+  }
+
+  if (!cupsSignCredentialsRequest(TEST_CERT_PATH, common_name, request, root_name, CUPS_CREDPURPOSE_ALL, CUPS_CREDUSAGE_ALL, /*cb*/NULL, /*cb_data*/NULL, time(NULL) + days * 86400))
+  {
+    fprintf(stderr, "testcreds: Unable to create certificate (%s)\n", cupsLastErrorString());
+    free(request);
+    return (1);
+  }
+
+  free(request);
+
+  if ((cert = cupsCopyCredentials(TEST_CERT_PATH, common_name)) != NULL)
+  {
+    puts(cert);
+    free(cert);
+  }
+  else
+  {
+    fprintf(stderr, "testcreds: Unable to get generated certificate for '%s'.\n", common_name);
+    return (1);
+  }
+
+  return (0);
 }
 
 
diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index c72a48e9f..1a27f0885 100644
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -41,6 +41,57 @@ static gnutls_x509_crl_t tls_crl = NULL;/* Certificate revocation list */
 // "root_name" is `NULL` and there is no site-wide default root certificate, a
 // self-signed certificate is generated instead.
 //
+// The "ca_cert" argument specifies whether a CA certificate should be created.
+//
+// The "purpose" argument specifies the purpose(s) used for the credentials as a
+// bitwise OR of the following constants:
+//
+// - `CUPS_CREDPURPOSE_SERVER_AUTH` for validating TLS servers,
+// - `CUPS_CREDPURPOSE_CLIENT_AUTH` for validating TLS clients,
+// - `CUPS_CREDPURPOSE_CODE_SIGNING` for validating compiled code,
+// - `CUPS_CREDPURPOSE_EMAIL_PROTECTION` for validating email messages,
+// - `CUPS_CREDPURPOSE_TIME_STAMPING` for signing timestamps to objects, and/or
+// - `CUPS_CREDPURPOSE_OCSP_SIGNING` for Online Certificate Status Protocol
+//   message signing.
+//
+// The "type" argument specifies the type of credentials using one of the
+// following constants:
+//
+// - `CUPS_CREDTYPE_DEFAULT`: default type (RSA-3072 or P-384),
+// - `CUPS_CREDTYPE_RSA_2048_SHA256`: RSA with 2048-bit keys and SHA-256 hash,
+// - `CUPS_CREDTYPE_RSA_3072_SHA256`: RSA with 3072-bit keys and SHA-256 hash,
+// - `CUPS_CREDTYPE_RSA_4096_SHA256`: RSA with 4096-bit keys and SHA-256 hash,
+// - `CUPS_CREDTYPE_ECDSA_P256_SHA256`: ECDSA using the P-256 curve with SHA-256 hash,
+// - `CUPS_CREDTYPE_ECDSA_P384_SHA256`: ECDSA using the P-384 curve with SHA-256 hash, or
+// - `CUPS_CREDTYPE_ECDSA_P521_SHA256`: ECDSA using the P-521 curve with SHA-256 hash.
+//
+// The "usage" argument specifies the usage(s) for the credentials as a bitwise
+// OR of the following constants:
+//
+// - `CUPS_CREDUSAGE_DIGITAL_SIGNATURE`: digital signatures,
+// - `CUPS_CREDUSAGE_NON_REPUDIATION`: non-repudiation/content commitment,
+// - `CUPS_CREDUSAGE_KEY_ENCIPHERMENT`: key encipherment,
+// - `CUPS_CREDUSAGE_DATA_ENCIPHERMENT`: data encipherment,
+// - `CUPS_CREDUSAGE_KEY_AGREEMENT`: key agreement,
+// - `CUPS_CREDUSAGE_KEY_CERT_SIGN`: key certicate signing,
+// - `CUPS_CREDUSAGE_CRL_SIGN`: certificate revocation list signing,
+// - `CUPS_CREDUSAGE_ENCIPHER_ONLY`: encipherment only,
+// - `CUPS_CREDUSAGE_DECIPHER_ONLY`: decipherment only,
+// - `CUPS_CREDUSAGE_DEFAULT_CA`: defaults for CA certificates,
+// - `CUPS_CREDUSAGE_DEFAULT_TLS`: defaults for TLS certificates, and/or
+// - `CUPS_CREDUSAGE_ALL`: all usages.
+//
+// The "organization", "org_unit", "locality", "state_province", and "country"
+// arguments specify information about the identity and geolocation of the
+// issuer.
+//
+// The "common_name" argument specifies the common name and the "num_alt_names"
+// and "alt_names" arguments specify a list of DNS hostnames for the
+// certificate.
+//
+// The "expiration_date" argument specifies the expiration date and time as a
+// Unix `time_t` value in seconds.
+//
 
 bool					// O - `true` on success, `false` on error
 cupsCreateCredentials(
@@ -315,6 +366,52 @@ cupsCreateCredentials(
 // or, if "path" is `NULL`, in a per-user or system-wide (when running as root)
 // certificate/key store.
 //
+// The "purpose" argument specifies the purpose(s) used for the credentials as a
+// bitwise OR of the following constants:
+//
+// - `CUPS_CREDPURPOSE_SERVER_AUTH` for validating TLS servers,
+// - `CUPS_CREDPURPOSE_CLIENT_AUTH` for validating TLS clients,
+// - `CUPS_CREDPURPOSE_CODE_SIGNING` for validating compiled code,
+// - `CUPS_CREDPURPOSE_EMAIL_PROTECTION` for validating email messages,
+// - `CUPS_CREDPURPOSE_TIME_STAMPING` for signing timestamps to objects, and/or
+// - `CUPS_CREDPURPOSE_OCSP_SIGNING` for Online Certificate Status Protocol
+//   message signing.
+//
+// The "type" argument specifies the type of credentials using one of the
+// following constants:
+//
+// - `CUPS_CREDTYPE_DEFAULT`: default type (RSA-3072 or P-384),
+// - `CUPS_CREDTYPE_RSA_2048_SHA256`: RSA with 2048-bit keys and SHA-256 hash,
+// - `CUPS_CREDTYPE_RSA_3072_SHA256`: RSA with 3072-bit keys and SHA-256 hash,
+// - `CUPS_CREDTYPE_RSA_4096_SHA256`: RSA with 4096-bit keys and SHA-256 hash,
+// - `CUPS_CREDTYPE_ECDSA_P256_SHA256`: ECDSA using the P-256 curve with SHA-256 hash,
+// - `CUPS_CREDTYPE_ECDSA_P384_SHA256`: ECDSA using the P-384 curve with SHA-256 hash, or
+// - `CUPS_CREDTYPE_ECDSA_P521_SHA256`: ECDSA using the P-521 curve with SHA-256 hash.
+//
+// The "usage" argument specifies the usage(s) for the credentials as a bitwise
+// OR of the following constants:
+//
+// - `CUPS_CREDUSAGE_DIGITAL_SIGNATURE`: digital signatures,
+// - `CUPS_CREDUSAGE_NON_REPUDIATION`: non-repudiation/content commitment,
+// - `CUPS_CREDUSAGE_KEY_ENCIPHERMENT`: key encipherment,
+// - `CUPS_CREDUSAGE_DATA_ENCIPHERMENT`: data encipherment,
+// - `CUPS_CREDUSAGE_KEY_AGREEMENT`: key agreement,
+// - `CUPS_CREDUSAGE_KEY_CERT_SIGN`: key certicate signing,
+// - `CUPS_CREDUSAGE_CRL_SIGN`: certificate revocation list signing,
+// - `CUPS_CREDUSAGE_ENCIPHER_ONLY`: encipherment only,
+// - `CUPS_CREDUSAGE_DECIPHER_ONLY`: decipherment only,
+// - `CUPS_CREDUSAGE_DEFAULT_CA`: defaults for CA certificates,
+// - `CUPS_CREDUSAGE_DEFAULT_TLS`: defaults for TLS certificates, and/or
+// - `CUPS_CREDUSAGE_ALL`: all usages.
+//
+// The "organization", "org_unit", "locality", "state_province", and "country"
+// arguments specify information about the identity and geolocation of the
+// issuer.
+//
+// The "common_name" argument specifies the common name and the "num_alt_names"
+// and "alt_names" arguments specify a list of DNS hostnames for the
+// certificate.
+//
 
 bool					// O - `true` on success, `false` on error
 cupsCreateCredentialsRequest(
@@ -507,6 +604,56 @@ cupsCreateCredentialsRequest(
 //
 // 'cupsSignCredentialsRequest()' - Sign an X.509 certificate signing request to produce an X.509 certificate chain.
 //
+// This function creates an X.509 certificate from a signing request.  The
+// certificate is stored in the directory "path" or, if "path" is `NULL`, in a
+// per-user or system-wide (when running as root) certificate/key store.  The
+// generated certificate is signed by the named root certificate or, if
+// "root_name" is `NULL`, a site-wide default root certificate.  When
+// "root_name" is `NULL` and there is no site-wide default root certificate, a
+// self-signed certificate is generated instead.
+//
+// The "allowed_purpose" argument specifies the allowed purpose(s) used for the
+// credentials as a bitwise OR of the following constants:
+//
+// - `CUPS_CREDPURPOSE_SERVER_AUTH` for validating TLS servers,
+// - `CUPS_CREDPURPOSE_CLIENT_AUTH` for validating TLS clients,
+// - `CUPS_CREDPURPOSE_CODE_SIGNING` for validating compiled code,
+// - `CUPS_CREDPURPOSE_EMAIL_PROTECTION` for validating email messages,
+// - `CUPS_CREDPURPOSE_TIME_STAMPING` for signing timestamps to objects, and/or
+// - `CUPS_CREDPURPOSE_OCSP_SIGNING` for Online Certificate Status Protocol
+//   message signing.
+//
+// The "allowed_usage" argument specifies the allowed usage(s) for the
+// credentials as a bitwise OR of the following constants:
+//
+// - `CUPS_CREDUSAGE_DIGITAL_SIGNATURE`: digital signatures,
+// - `CUPS_CREDUSAGE_NON_REPUDIATION`: non-repudiation/content commitment,
+// - `CUPS_CREDUSAGE_KEY_ENCIPHERMENT`: key encipherment,
+// - `CUPS_CREDUSAGE_DATA_ENCIPHERMENT`: data encipherment,
+// - `CUPS_CREDUSAGE_KEY_AGREEMENT`: key agreement,
+// - `CUPS_CREDUSAGE_KEY_CERT_SIGN`: key certicate signing,
+// - `CUPS_CREDUSAGE_CRL_SIGN`: certificate revocation list signing,
+// - `CUPS_CREDUSAGE_ENCIPHER_ONLY`: encipherment only,
+// - `CUPS_CREDUSAGE_DECIPHER_ONLY`: decipherment only,
+// - `CUPS_CREDUSAGE_DEFAULT_CA`: defaults for CA certificates,
+// - `CUPS_CREDUSAGE_DEFAULT_TLS`: defaults for TLS certificates, and/or
+// - `CUPS_CREDUSAGE_ALL`: all usages.
+//
+// The "cb" and "cb_data" arguments specify a function and its data that are
+// used to validate any subjectAltName values in the signing request:
+//
+// ```
+// bool san_cb(const char *common_name, const char *alt_name, void *cb_data) {
+//   ... return true if OK and false if not ...
+// }
+// ```
+//
+// If `NULL`, a default validation function is used that allows "localhost" and
+// variations of the common name.
+//
+// The "expiration_date" argument specifies the expiration date and time as a
+// Unix `time_t` value in seconds.
+//
 
 bool					// O - `true` on success, `false` on failure
 cupsSignCredentialsRequest(
diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index 74b7947cc..b071b33e1 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -78,6 +78,57 @@ static const char * const tls_usage_strings[] =
 // "root_name" is `NULL` and there is no site-wide default root certificate, a
 // self-signed certificate is generated instead.
 //
+// The "ca_cert" argument specifies whether a CA certificate should be created.
+//
+// The "purpose" argument specifies the purpose(s) used for the credentials as a
+// bitwise OR of the following constants:
+//
+// - `CUPS_CREDPURPOSE_SERVER_AUTH` for validating TLS servers,
+// - `CUPS_CREDPURPOSE_CLIENT_AUTH` for validating TLS clients,
+// - `CUPS_CREDPURPOSE_CODE_SIGNING` for validating compiled code,
+// - `CUPS_CREDPURPOSE_EMAIL_PROTECTION` for validating email messages,
+// - `CUPS_CREDPURPOSE_TIME_STAMPING` for signing timestamps to objects, and/or
+// - `CUPS_CREDPURPOSE_OCSP_SIGNING` for Online Certificate Status Protocol
+//   message signing.
+//
+// The "type" argument specifies the type of credentials using one of the
+// following constants:
+//
+// - `CUPS_CREDTYPE_DEFAULT`: default type (RSA-3072 or P-384),
+// - `CUPS_CREDTYPE_RSA_2048_SHA256`: RSA with 2048-bit keys and SHA-256 hash,
+// - `CUPS_CREDTYPE_RSA_3072_SHA256`: RSA with 3072-bit keys and SHA-256 hash,
+// - `CUPS_CREDTYPE_RSA_4096_SHA256`: RSA with 4096-bit keys and SHA-256 hash,
+// - `CUPS_CREDTYPE_ECDSA_P256_SHA256`: ECDSA using the P-256 curve with SHA-256 hash,
+// - `CUPS_CREDTYPE_ECDSA_P384_SHA256`: ECDSA using the P-384 curve with SHA-256 hash, or
+// - `CUPS_CREDTYPE_ECDSA_P521_SHA256`: ECDSA using the P-521 curve with SHA-256 hash.
+//
+// The "usage" argument specifies the usage(s) for the credentials as a bitwise
+// OR of the following constants:
+//
+// - `CUPS_CREDUSAGE_DIGITAL_SIGNATURE`: digital signatures,
+// - `CUPS_CREDUSAGE_NON_REPUDIATION`: non-repudiation/content commitment,
+// - `CUPS_CREDUSAGE_KEY_ENCIPHERMENT`: key encipherment,
+// - `CUPS_CREDUSAGE_DATA_ENCIPHERMENT`: data encipherment,
+// - `CUPS_CREDUSAGE_KEY_AGREEMENT`: key agreement,
+// - `CUPS_CREDUSAGE_KEY_CERT_SIGN`: key certicate signing,
+// - `CUPS_CREDUSAGE_CRL_SIGN`: certificate revocation list signing,
+// - `CUPS_CREDUSAGE_ENCIPHER_ONLY`: encipherment only,
+// - `CUPS_CREDUSAGE_DECIPHER_ONLY`: decipherment only,
+// - `CUPS_CREDUSAGE_DEFAULT_CA`: defaults for CA certificates,
+// - `CUPS_CREDUSAGE_DEFAULT_TLS`: defaults for TLS certificates, and/or
+// - `CUPS_CREDUSAGE_ALL`: all usages.
+//
+// The "organization", "org_unit", "locality", "state_province", and "country"
+// arguments specify information about the identity and geolocation of the
+// issuer.
+//
+// The "common_name" argument specifies the common name and the "num_alt_names"
+// and "alt_names" arguments specify a list of DNS hostnames for the
+// certificate.
+//
+// The "expiration_date" argument specifies the expiration date and time as a
+// Unix `time_t` value in seconds.
+//
 
 bool					// O - `true` on success, `false` on failure
 cupsCreateCredentials(
@@ -336,6 +387,52 @@ cupsCreateCredentials(
 // or, if "path" is `NULL`, in a per-user or system-wide (when running as root)
 // certificate/key store.
 //
+// The "purpose" argument specifies the purpose(s) used for the credentials as a
+// bitwise OR of the following constants:
+//
+// - `CUPS_CREDPURPOSE_SERVER_AUTH` for validating TLS servers,
+// - `CUPS_CREDPURPOSE_CLIENT_AUTH` for validating TLS clients,
+// - `CUPS_CREDPURPOSE_CODE_SIGNING` for validating compiled code,
+// - `CUPS_CREDPURPOSE_EMAIL_PROTECTION` for validating email messages,
+// - `CUPS_CREDPURPOSE_TIME_STAMPING` for signing timestamps to objects, and/or
+// - `CUPS_CREDPURPOSE_OCSP_SIGNING` for Online Certificate Status Protocol
+//   message signing.
+//
+// The "type" argument specifies the type of credentials using one of the
+// following constants:
+//
+// - `CUPS_CREDTYPE_DEFAULT`: default type (RSA-3072 or P-384),
+// - `CUPS_CREDTYPE_RSA_2048_SHA256`: RSA with 2048-bit keys and SHA-256 hash,
+// - `CUPS_CREDTYPE_RSA_3072_SHA256`: RSA with 3072-bit keys and SHA-256 hash,
+// - `CUPS_CREDTYPE_RSA_4096_SHA256`: RSA with 4096-bit keys and SHA-256 hash,
+// - `CUPS_CREDTYPE_ECDSA_P256_SHA256`: ECDSA using the P-256 curve with SHA-256 hash,
+// - `CUPS_CREDTYPE_ECDSA_P384_SHA256`: ECDSA using the P-384 curve with SHA-256 hash, or
+// - `CUPS_CREDTYPE_ECDSA_P521_SHA256`: ECDSA using the P-521 curve with SHA-256 hash.
+//
+// The "usage" argument specifies the usage(s) for the credentials as a bitwise
+// OR of the following constants:
+//
+// - `CUPS_CREDUSAGE_DIGITAL_SIGNATURE`: digital signatures,
+// - `CUPS_CREDUSAGE_NON_REPUDIATION`: non-repudiation/content commitment,
+// - `CUPS_CREDUSAGE_KEY_ENCIPHERMENT`: key encipherment,
+// - `CUPS_CREDUSAGE_DATA_ENCIPHERMENT`: data encipherment,
+// - `CUPS_CREDUSAGE_KEY_AGREEMENT`: key agreement,
+// - `CUPS_CREDUSAGE_KEY_CERT_SIGN`: key certicate signing,
+// - `CUPS_CREDUSAGE_CRL_SIGN`: certificate revocation list signing,
+// - `CUPS_CREDUSAGE_ENCIPHER_ONLY`: encipherment only,
+// - `CUPS_CREDUSAGE_DECIPHER_ONLY`: decipherment only,
+// - `CUPS_CREDUSAGE_DEFAULT_CA`: defaults for CA certificates,
+// - `CUPS_CREDUSAGE_DEFAULT_TLS`: defaults for TLS certificates, and/or
+// - `CUPS_CREDUSAGE_ALL`: all usages.
+//
+// The "organization", "org_unit", "locality", "state_province", and "country"
+// arguments specify information about the identity and geolocation of the
+// issuer.
+//
+// The "common_name" argument specifies the common name and the "num_alt_names"
+// and "alt_names" arguments specify a list of DNS hostnames for the
+// certificate.
+//
 
 bool					// O - `true` on success, `false` on error
 cupsCreateCredentialsRequest(
@@ -497,6 +594,56 @@ cupsCreateCredentialsRequest(
 //
 // 'cupsSignCredentialsRequest()' - Sign an X.509 certificate signing request to produce an X.509 certificate chain.
 //
+// This function creates an X.509 certificate from a signing request.  The
+// certificate is stored in the directory "path" or, if "path" is `NULL`, in a
+// per-user or system-wide (when running as root) certificate/key store.  The
+// generated certificate is signed by the named root certificate or, if
+// "root_name" is `NULL`, a site-wide default root certificate.  When
+// "root_name" is `NULL` and there is no site-wide default root certificate, a
+// self-signed certificate is generated instead.
+//
+// The "allowed_purpose" argument specifies the allowed purpose(s) used for the
+// credentials as a bitwise OR of the following constants:
+//
+// - `CUPS_CREDPURPOSE_SERVER_AUTH` for validating TLS servers,
+// - `CUPS_CREDPURPOSE_CLIENT_AUTH` for validating TLS clients,
+// - `CUPS_CREDPURPOSE_CODE_SIGNING` for validating compiled code,
+// - `CUPS_CREDPURPOSE_EMAIL_PROTECTION` for validating email messages,
+// - `CUPS_CREDPURPOSE_TIME_STAMPING` for signing timestamps to objects, and/or
+// - `CUPS_CREDPURPOSE_OCSP_SIGNING` for Online Certificate Status Protocol
+//   message signing.
+//
+// The "allowed_usage" argument specifies the allowed usage(s) for the
+// credentials as a bitwise OR of the following constants:
+//
+// - `CUPS_CREDUSAGE_DIGITAL_SIGNATURE`: digital signatures,
+// - `CUPS_CREDUSAGE_NON_REPUDIATION`: non-repudiation/content commitment,
+// - `CUPS_CREDUSAGE_KEY_ENCIPHERMENT`: key encipherment,
+// - `CUPS_CREDUSAGE_DATA_ENCIPHERMENT`: data encipherment,
+// - `CUPS_CREDUSAGE_KEY_AGREEMENT`: key agreement,
+// - `CUPS_CREDUSAGE_KEY_CERT_SIGN`: key certicate signing,
+// - `CUPS_CREDUSAGE_CRL_SIGN`: certificate revocation list signing,
+// - `CUPS_CREDUSAGE_ENCIPHER_ONLY`: encipherment only,
+// - `CUPS_CREDUSAGE_DECIPHER_ONLY`: decipherment only,
+// - `CUPS_CREDUSAGE_DEFAULT_CA`: defaults for CA certificates,
+// - `CUPS_CREDUSAGE_DEFAULT_TLS`: defaults for TLS certificates, and/or
+// - `CUPS_CREDUSAGE_ALL`: all usages.
+//
+// The "cb" and "cb_data" arguments specify a function and its data that are
+// used to validate any subjectAltName values in the signing request:
+//
+// ```
+// bool san_cb(const char *common_name, const char *alt_name, void *cb_data) {
+//   ... return true if OK and false if not ...
+// }
+// ```
+//
+// If `NULL`, a default validation function is used that allows "localhost" and
+// variations of the common name.
+//
+// The "expiration_date" argument specifies the expiration date and time as a
+// Unix `time_t` value in seconds.
+//
 
 bool					// O - `true` on success, `false` on failure
 cupsSignCredentialsRequest(
diff --git a/doc/cupspm.epub b/doc/cupspm.epub
index 78381005bfb2453fb8f093fd1511da1a942ef911..f1fd127557216b32c10c38faedd927a6e5ebe0d6 100644
GIT binary patch
delta 89535
zcmV)9K*hhAfe!z+4h>LC0|XQR00000*kr+x4L1YWWWkX~Bm>xF!I5s<1K4E2lT863
z57=bER)9@rJkvn|05~lPlYIdif5??E`kzmM@vNCh4k`K8oy6VtcW8-nGm%A&E`6Cy
zmOhXuN{B&#0YJ;jtUS<pjq_w@U#bdKK;c4)a=W{owK^7o!mit{UHiVj{XZWUk@rEQ
zS(wDH9zETA^2ihMED6H+`qiUVJ|Fz?(f@hf`}W@sCkGclosPVld=bHKfBeUTPvh*>
zqnkWmzTDrxy}jMLeZH5Z*ZWWZ^rt`Vf5bMAu+huNM`$7*T%JGj%pVAOF!0Vt2N&bX
z$xH7vO|Daav4Gya!2tUaegOaEVIGOs2bZVkR+D#ryz--O_xW}2+l9z|FZLJW)uZ>~
z?lwt-?2$K1;#|b}t4GF{e~-L<yZN<<Me65CYP5${5J58YK0M$1L*)a1mETyc--WXq
zUqs%ScYZ5GUikp0z4EVx@rhiJQo~uYyi3FDo7`x5pq_dE-~a19d-Ck*0RHc}H@)*F
zOA()@VVuLP_Pk*P1Hg8fcP28Ceh|T4r31O!2KeWDPjKV0U6$WPf5OY}me4R4AM^cL
zmOXm??Z5r?;Ba^`{A+KT1b5#5_B?Ou&)#3B$tn(Bdbc-WF1~?>vm{E=m)<mjm-u@Q
zJq+glB8=`{dYK<*0~k~|*RQhhpW>zW^w~21ruVO&Pk?P0@bqOA#_#){|MEkaK|g`n
z>ffI{nHP;--Xt(Nf1_#fz@O#e2Vs3WdosgMaYlV_+4pXq!hg@;zvuAZ3;6FV`0s1_
zq+uS=uNd42Ty&Vp-U|fT2I*EdpC(a&FqVK9gJ~-K_k%Fb!T{F9|B!?M!z#Yx<$Ctj
zlmEc47Jhmi#xK1m)a+Svvq7FLaeQBi1vP(OY5v4&K27pGe^~%<{-O@di!zv}Uu^>B
zs|uKBUu^*9>k62s8;mAgT<;M@A!xT@kl)~He!cvNZ-el|9#SQd62cfim((5)&A^Ys
zYuK3?oGy{7ujFyd_#;L;{A->h(271b5Me6jNs5RN-THSK!q}Tdeg<FfiFma@Y6XWF
ze$7|$O#YeWf9YzL!ykBl12KocRx!Nd0}JF(q<RgqBnkuX+47?YMDdQ`2O^uL;WAfW
zn5*+dt&Z-`Y@!#I4pfxP-v46-lQQ~M9p*P-EPKRP9|zfuA0)Rgz2`6z{O>FHFTI}n
zJ5Qhep|AdXviIz(T@&Y@iUoFtD;D5g1y7#f{xqMZf2D^sy$@$r{;}MX|EBPNtB8K#
z+sc_=Byo~0{TWfYo4e(Wh%<Of_YXdTBRzc|=7Y*B=(M2^lZe(&TCE_hT>wiBG*B(!
zdh<^uP9wb@(0pFvxCXbWzpSUVgwlbSC5&?~y*P;lHU|jtUKr1l%4GBn;MjfrP7-2$
zdl(1ze~)}_`3YW0FTF5_Q#Jdhj)q!uiW4;>AfI}aNR+K#&#hlCywZI5zySIWA~DYg
zsUL)^tXOH|J>AWf2J<NKVTAP3+AG9!Nlqj}NX$?K0)AwxsrpT$iNZ`S#Q;yY+63zw
z&|T1g<#8;boONp$oqDhB7Lq9Pp*Pz>E7zdqfAjLN?EyVwaJfH?OyV#AOo;qt2D4Is
z84HYiO3Ow=&I1Qkd8)~nvC2qE)K&l&kcTrrQj{4c$H4Y*U=_lR59NEN;SHo6+AwQY
zZX)*`THJIYz~)(II`~aZpVjFwOzJCr8Rs{H*-aP)JK}?gcRLdrxi5Q&Y3-XM@5QIY
ze>Pa3x~HqqRX$Gn^y2h+A=Dz&lU?iB$4R<i(p%YY`r}!3`SdxgLk43CHj=5aTU|Yq
zJt-8c;!kZ)H_w>CKoVrI8m%|<{$ua_F3$ar-VMwp!ug;W^mv~s@hn*^07XnDH}F%~
zcOha;u7fZY6<&C`N|#YV(t*F2N}N~Re|VbQ7BEsNTa<g6-T6f$U`B9oMw10xO)z>n
zlSB9bHW(-q^5`ktR2k0X|5=D2^t~OpmgXR+4CvcIHoFlE!M#X~R)R>)#bfaKGrBeY
z1^@Z-3)d^>)mJqA`s=yfw41O|0GL1dngRT)_qV^j{&t^eIY?alQpUvzp~U;te<MB*
z#4kjQNA*(g%~NQ;d|eVezujNb<NJt=3<G#mH542h3hM=HM}3?|!q0^Ft?%8yZm}jH
zd%3@V9p*QyDdOXP0-Y^oXZy3&GTRTcY$ZUZoQHt+{KEro@-2Py?Y{pSP6;q2$p^p)
zZ!ScD+lwuLdB}kMnXM4X<rw#^e-Xj;Zmpdc2Cp7L-)R!8h-ZEDdTjiHC49zfg-a~E
z%%C6P{U?I_2FJ^P!R<Cp{qzpU27JhS`WM;-;T*6O58cvFVF{DDN5K3z0163|aEv57
z7P+TZ9Jex004cnk@#*QVM~ef9zUN&u^{cq<%=3YX^Jg=WWq_lwonbtSe^yAAXh7fM
z#r*m|BL+e%zIXGV*ZDW!?$aBOg_S*xCOBGH*Qt--Xq83dpm|&{bpB(vkDS-+2IQ0|
zxy@kxL%RES{N)nZHDVaEU0g1tP9TlIBf(4KdxUPOw}XA+2@h5g9w4<OeNW`GJ^J_>
z2ICVCgi8#&1fycueSiXse@)+be@~|H02e<?;J!%nn?3KRWCeHtg9_(&a;&o7J9u;J
z!)LD1tumaq?=2G=jN0&I>HlK|qa{gem8u0t%)iRz8uM223tZo;?=CJ*uMS5?!^`6f
zwGY50WjS^}^MNH6&>yV-EeH?RuuNQ|t<uXRcMy2kD#~B4V8W=Fe}H55R{ss?{+#yw
z2khlG4QXeyWS-w5PVFSn3C!~b#v^yY3(^p^MZ5Sk$00VKj+Z>96>12h@HKRGn84*p
zUwS~E<=I6<1K0vcJg#@(4Nu2eUmj@quJmy#qC3P)6jWf<=HWH0dr)9W?T4@|&>xRo
zwf3^ratVk5yuO%)fAeq#B*w>$%y3L|<SKGTq1N$)3%E0JK7@!cpWF|lY|s2|pO&IH
zWq`QA2f*NAOF=qYMTl;&I4~|m+5i}~2q-4}oTtfx*4o_*o&r53{FJDv96saUb>c_Z
zCv-(;6PkI(p~UC77BClIo*t&iF&<37Ot@+T36W0(jt0l-e}%-~D^ei8O;#!3^fDB%
zdiiZKK+%&3%J79pSGqixxexR4gb&9MHJy@*(7PM|gP>m2h2dp)Sq_pu2-Cni6t6^T
zoL8I+tpE=dFhnXiy%;VJeVZ*`pNGIy`e}5hDGYrFG(&bk%#%sC=xieH>h*xL55yR^
zNVb4gOs23Ue@r-`UB1dZ6d`diI0#x#94%^SNX?8m2d}Af3%D@~y9bo0QXsyn3xV68
z-z1r^kpRhG6J3CYi)?_DW`F`7+@}L|CLg`Nz?a@7k|7xL1zxs?@};I6L+@L$czsxq
z-*5NfH)5Hu*A$KsqXewgN}fKvua<Bt6jT}*4}wKEe~kC%WNJV{F+;G93FZmBH^N*b
zK%>-XGYK}u1xSj!&^NCJNy3vQuOlIQsEF(=g=4QSO&E|GPcdaZ96A;|e?A?(g~JFN
z)b~ygkLanopt4oSBJEsFo>{AyKu(s$O39ss(Ih~bd?Z4-KFjbC+-57hOqtFyD~$WK
zN08p(e{Vf9!iF1Q`G|A@)QDFll<Q2#Pmf}l13x}p<)WBbEZ2rDK7x)AK5gY$QUQCL
z<xQvt7{3f7l>C>>x@H3$93mh50fZbbkAc4ofxlHP6_c9*^1(C!6N_sPZU~Kp7wRG3
zIzVx(JCrD=AK!TgeedA+zwhJXOs0RALeGIGf5*c_av|Ut1-Juxz@C2%$C>0<VRZ3<
z|AAWz*bTy~STY23QVU{*2NAyqqU$Rh#^G{@^8{%zH5Zbh%Wi-;<A2PCED_y+1QX#`
zqxE*M6;2Yq-o*n7G**%o*uD>8n#6Q4G_@;rW<x_piV?{F0M`lOuE|u%iyUs;*TlxC
ze+^bftikNj>u*uYQ!lhs`RMh(GeZho0x+Rj9)yWvK=A`KF?IN^!o2dg_Qy&Lee`;o
zB#~^xxPOJS*{Nxb>QL4C@oah(_&MB8HH}v>U)kz|dE{Ti6^CP^POftAG5)*TLvgPL
zNH|xY?_k>j&WUg&o{3$O5^2<Pd&De3e?NN7cjSL$`~Q*sPs~3gxW1>sp>5CjsiA*U
zKPnMrLai)~VU=e)7C`vA{_|7--xTYK)wBXeS#?4>rn)T*k>)a}1)RSQd&et|8!?Jk
z3%r!F9b&f+N9Pw;N5{jr=T|3_lTm4FS-J7(_0uO$p6F#fxja6uX;(CAd0ikLf5Y2&
z@yeiS-K5+A2Qwv6_eF`!B8xWoh;2-gN{ri&_!P+J3nC2Tm>&QR-z3OF;O%fCZjt;V
zmE7Cg<10e5pxEFDs1iR0GP43<0WUhZcfIrP#zz;wKX`Ze`xB4_bG%zKf!DYG6h^Z^
zqIe8Kh<8CJ72$w9K;i}vVShFOe-dx-rb`|Q*`fEm19<*k4)deDnGqmsX4$MwcNa5=
z^l6_Sh>t$eJw7z^FwOEpYN-b-7sl7)U^11YcTB`*j_;6oBTpgBQD|yBj?KrgEg%ft
z_9Y;BlOVh|t1t?@(;JY+Glq+bttC(Q;}ZW-O<_6TdvAbZ14ByNe5~#&fBsP3FXk+N
zPjB?b^D<0O?1N3`U(BV`HqK#?=5iG31-KP)8K3V3ckri@XqEWDZT44Lx*sJoKiV(a
z==C^)aYx9B+bckg@c8e|%20{h0hwazGuw{B13grGtnM}`E#r549<L|1Pgk+GgJ^n2
z3WZDvdBImz3W~3B9<l4$f2?xA-X0w2<8`D?&5Y50fU<XA;fCZUVO1hvRd~L9Hy1Nz
zw)GALs=5Cm0XZEe8H9j-{pze~w!q9WJ4zB3NKu5QG0i!*_y9R5lhp`wJqf)~VP56{
zUc<b-L82Im|GRvDEroG!FqqM$NTm4r|Mk>-N{s*uRFmG`J~t{;e>G-XxWnS(LS@2(
zw={Kf8Yy4QKuJp<+ryKfSl%p{JJ(lwy!soKCpD!Z<d$5YLK&9=@-|7|YxFVk?9uBV
z_!Vz}Ay#EtHF;>Mx>$V$r-At26g4Orii>bkLs*g(j7JNEFiIK=POp%t==l<eaJFme
z5c(ubX@D$E6-UzGe|FSn6dEu!DB|9DQ-~r<{Q&;0b%ly8Q7_eRMSKu>10}NUXCg<=
zIwK{ckm@OmQ&n<MAm;um%Jtrmo<jA3L#Nkz7>bT6*${tE{R|{?Q*?*LOJ*TysH6e}
z#1gY}HN(~7N<xzQFoef{TF-Yi{re8c4xDVH19ukfVI{~^f57Qw7Xo;X1QAsX#jg0l
zB8&k9xvb$n`bzqMpCGv*%Jn^v_M|pC$`Ymc0ukm8wgjdcgxL%&7I$U(r^xYam6B>(
z0&EiZ@UB1{*WyG8(U17OH`L-r3EK<NPFoZH-D2$?y)IBuKh)&If2}p-bZ=#-^I|Q@
z)?^%~xY4uuf6w)Vhz_hU+~Qr@J)Yqyiu%OI7yqMkyF@PPikYdt{b=E5@15V!SqIT5
z_h!@D{#|m^uA8Jw1`MaIj!1e<iWa4a1<GOgHK~)StqZxQXx(B3H}=%hua_A9GP6+(
z0GG4Af96F$hKm(Q@rz^?6K9ZzN{0+0_zJiQt!O|7f72K;kmW@f0Yf3+4gm}tkfJn|
z#z0H2C?UNUV#(L{2R~ZTW&RaNC3uJ<<gIVjB`y!-g7u8RN(7F{F$$EYNA?TW0>?C<
zYoLs%%%B5-^XhXyKy0ZMTDu4T6lubPg10a!;8;*qX-*fJs61Jst}082T0&o07NQZ|
z8*94;e{U1YL+a)T=cGn2X=jUhAZ}LZC}L`9YHSLdhB<6r6eyJ-sk(`JA&*6N8{m!d
z>eXS`ywD19oe(DgJ?`Vp=`Z~$aCkX9W1ipm@^_hMsJ_t!s2DMCB<v^-xFFb-NpL%6
zWEV?6Wt%|mS_E!-%Pcw0gp`X%g?Q5^Ep!Ywe}&qg(nPhg^d`yj!pvtfFd)9d={675
z>Dl<?Vsv(OJUJNZy;JvVb*B`*;glRu4#(#QlkZ1oqeC|+$NrWTX3An#Qum?RMlDO#
z0Oc6U!SV3?T#n+UH!P`}9fE*q19HGS8vbZNoBOj24Gp*jAHtdF2E$xrgu+{6sMLx0
zf9|nbUYibYq@I{D<cYTvCwLw*Jj=}Dh8ZJ<UaI!ZL-nyArUla@T>E)8dN;XHlokir
zY0ve@5!u+#(2N3|7S9?Bu3jn@=zY4A-QdC6t*&Dyu$AGzL|uBpOh~q9L+EdQ&`=M2
zbnEoq{3o2|Z+<8Y2%X>@OpYgKWl-dEf3hZ^!^_j-(T`<Fg(+`6Xy+G00B1pyroUvB
zFIRcz$sG?bY%u>=g|qj7(&UVm3u$!h2JiIp<ls9C+7h_Nn>EJ-IAOscE_y8(Z^kEw
z7Kkb8TGoMZJ~_LvR~L=i48hw0Mj@IeABA$E=mzrL@c7tX95T)UT|5RsOr-nAf8yGY
z_J=RXNtdlt-A4OvbU40z=Z1X&hY1+T{Wtpu`@`q^!)I$lKOUaF9l3!Y?vM6|PxpsU
z)&~0h@N7JMb6f)#t!*qe&VU_F7Iom21AxJ$P3sv@zYt<jL4zU;F_|Q!nS!UX^UcZW
zZF50J#tA4UzJqmT=dmpx?5<^Ge<_I?mH(|JKD7a>nrOap3n#eH<YcB-KNT|pOgkH+
zmv>5#R69tMsob4WqBJ?a=1P@{z>s`)wf3R1qqn}?QqvjCDKsGmM4AFLbjs0HIVEog
z#<9!n0Wk%Q{E;C=y_=jBhz~<SmoxZ}ZSW>%3CwHjm0-ZdoBDg>J}oiUf5gySqru<5
z_3v1lsbwy_)ITWuZk_7Z^I7$S>%(S<&SM*$of#J?-1H(%QMocBHHh325WO-~F-T5|
zn@Dz)b`BYS#3${KXK6Ez{VX5hH>Ng2KQy%&QVyy4{9IZF9YFY%OEHqwQYO~{K=YK6
z2j)Im3Ymvfa-SuwEB=qIe|@?kx;upNN-@DD_t9^&JcTp!`UD=lM2A@VWeSAVfsrs8
zh40Y^YpNCLi&d0|qz(sRJ=5Ehp&HUak3PBuhD146OC@g=aw2NT$fkvdDp;|+E}RlU
zX(qOyqIC0Uvd@%df0b>n+R_e?Ea<?5{WSF}db<a|2w3N<G+$_af5mGL$SZ0<aU|I{
zJqO*z=rwO~cO?nuRsKyELw*mwkk`zP`SGSE`(ESK(9wF&mIPwdy&B?%_I&pIw!lf}
z{70|%_q{VBWftXQuNB-?vcDEac{y1&$*X1dUiHkWFg!$?oi=}f+FR4vPi<>jfgST3
zYQMXyeB?X19JDOce=rE_J2KgLh0q&buTOui$+k>&>;4h)NVT#@=1NVxfp@||8zq`x
z93~(kJkgzAjc&NHk1_OdDn(svjy#TJEv((B=$F?7i{I42l}FZl%yeb9Wl0Vl3qcWX
zCOMIRd9S?xZS(LzEvEOcCbtfQRQ%gEJyU3Z-1y0Byi;P!e+%N-gw{%F-+^XT7@|JV
zEFnxgi_M6|fw_IPaQT#!k2Fl?2%z)Q$x-eVCsl3Q9-{&6h$k-_*hpM6`D{DxH?D(j
z6LbVuVd|^YN)OSRz#5K1m9=m>2f0jiWZyK+as$KG`RMf<GJhH;#v2!}Ed$+}Mo*B6
zaXmAIB^@lve=7QiO|ri7Tm__>Cab(^1BR6jf>7NN+WxDI!lsp1%0kQ`+UDG{z8P=O
zO!^ojb3_JM{1B}t$tttAS`V@+WAQp*#t>Ta0lLqkf|Z}M6hx#C4Y@1yy~&j$lxk{u
z7Hg*uV*oGJwt)1cjOqL@E(I|IsB^`fDE8|hL90@~f3_9$D<O;PBu8tw+}54Hh!plU
z$#xwgmTe!wS(}r+SuOl{fMzUZmDPC%s-#4FL^FhUcOJ+(u)FfokiJ~4L&yf~gpO8f
zbU;_*k;-tmh2^}$xy#8wf9%ELR>m1g`5c8K`7MRe+=iLxG9K1WuQ`sXAa`E+l$8w}
zwu4rre-(Rj+-F#5cfhV1c1tyB->PGO>b>Z=KMVi87@)fpMubKU-D5*K$<(lY5F-}G
z4w7`qh@+T|7ieic7ijhCI7SM+u=neE<7R~c8t1sli^i7vX#0p;eS?;M)%YDs;!ABs
zZ5jGtb_0^27@&}BuJGl__(wK#laaC94Y^s0f537HA$T2oWu1vWa6?I|{fHg91{j{U
zpom+JZBeP4v>0E%xukF%<Z#Ol!~&Sk0kJ5R`zQyZh`4<_xb@Q*mbv4G7bdcoMo6E@
z;i|h!nsX}-L)PG1`&*^qK)UJJx5MSxxDEI>%C4S?ykEH<NVTXOe$XtvA}t8EzZ3M$
ze~K*mzHNDQYK&B1hONzbD{>BWF|`@`q0><Zt})<l-~h_7FIvR1WxJ%<1g_v(<jPm0
zObV>{pL?i7NP*g-41vRxY6Uls;FV`hy2+criS8-hzfHjn|0~4(f*o7yJNZpjHSXjg
zIr>lp^=#y!Y|+X|PS6X`uV{bC^KFKqe{FH!fn`dLM~Eh(na`cLX1WZZI?bnBQ_aVA
z`*SgwU66@+S_Fk^rCxblI~*kJJ;s0g-OUq>6!=k-<p@wV7BiCvw&R7BZ6D~CbUS44
zS!pR~j#f795jfOlAF7hhhGHfyKOa*B;N_~y0LsM0@{b5emyCf~=<68!%j_n}f7R`;
zX{N>M!<#TI-t|#=k2$wE(w0R776-^*iJT-6O;SMt!n8E0Pu^2gk>4U>7UBL?nSueQ
zg5^T=n#apFV=9*=5fM4`qc;HCp61u=?pj;{1KA4^2=3+4>$lv>JJ*w*7-RWfDo&&~
zdex!w;6}{eBTDM;t#ed)+vPNYf7Fv}4_%*9A%wG4<fkgYFwuYM^&;*?b+ScY%<2r<
z&RxAq)H=_UC91cc;d1SJgjeaoyP+LurZ+s2=7Uad-tr8}{Y9e>?m#!^E!A3H|14JP
zcxZ|JjYi9Z$?14hcyk@7_*xpC)`+r?h!r#(tY%KW*?@gCJ{g~XH$Hi5e|wABJgc%o
zD%Z+lqSTuix;;mq?HgPT6|`&&$(PZ|l6aF8P^9)C-x-PzCWjUJi-X>ypw$42-WNmn
z5^;nvIWH)JiyPB7t_h02E?JmgdS&oe&wu<%cG0iCeDUMg^)J8r@elPc|M=t6C-rZK
z&l}#oXn5B!)?vd?M<?Gme+>s-A0F4gJ|4XtHom^N(4Iw(_ov@YE+$tE0M0K@M`v%0
zHL>0DxY5P%&GBS>X!}SvA<otL<nrubRK=fL@(U=i2*ubHnPbtIWulM>>1L>bd^Nnh
zn7BO&t!D3rCzpEtx(pl>7Q4}2Y1??<_r!ec#+*aHrU_uj=y;-se^l4(c=%>?eBRcG
zaOJzv@UW#JAx)PyS8tCe=jT6lYWi+?anUx7)8pazq!|;j*~QuL<otAaHaa=@sngb;
zT)ulVI=i|&ZKL@rR|I9mG--e2&)5f=l8`707_@lmPR_=olZzqdsdo2_{^Kf3OSSu=
zSAAeCR5HL{oleeRe_6&C?lWPwJRY7Lo*xWPN1c|AT-(@T^y=N@(0!zJl$G=)L^W0{
z9ZGi^fLV^HyM4-8m%%v_&0oEnoJ<bBJDa>46`!K~&lIEaQ{%|(cA5Bp0rePP{N&y}
znE+gXwBko$uAQoQ6<&IE(5?>8hDR5!vtTznnVh{dh`+;Oe_A*FZv6JUPWyR2K6J4@
zY7<Gtkd<&=W>c9a`3)hxHp^5|lE7b0PDb>XlhAOJiytQ3q>Q=cd6t_uqOVdnjZNP>
zVqD8iX_!@`Oq|MtZHPX~Gs-$DORbO9LYWNwu<T0{rH7Y#ttOa?(^le=&1Rcj*`l>I
zV+^~iop9x4f8%^9FWl*AVdzo<x$<-?rf%5SeD6B^AXGS47cnnfF0XVST8~m0>!w1T
zEz<=}Lfv*{I+wK7rs<R?*j`<i6v0bvdAfyjbYtr)d7==in4qn#&Z4x)ue^#<tD-Vu
zr=#6^A1}j4qDEk^f!X&OWpMmoNp6#gIM}<Zf?0Yce+zFRH?D0yp7Mammq2>>gc#0`
zL58nzXm3S+fWLN%QL$eGWo2p5Bpb6R^eL7ixhV(CJkf}{6T(OuJt4mFLdwp=<HldV
z|9#i=HJ<k$K_z<)&wI?GvoUjcv&)VRUEIjlSRpcyXu?@ur3Q5f$m0Xf8J5I@!q~42
ztV>fZe})QADazY<D=T`+c4LP@0&1b$<BV6%1pZLRVatc1VTT%5x7eTNgF{1apgUVZ
zb;337l|8Mw+ddA8Y0Wn^sd|)lSE`;X`rJdQlCElSrT0B%{K^C;nYH!T-oSErF||rM
zTI~Y~x}U&%M=96~8$fATl_7O82k6W<PX0!&f1QiFk*}P*4ab&u=5VY<-^q3#gu{{J
z-HgBK%-uXZZ*x)d!jdUXH#Hi|I1sLe;^k=h<qY8h?T8eBS2jJVj@KfxI*~|mXXx$T
zoXl=(xnXoyEDjVDx-d6an4hlJVTU!if~43rK5*O(3S~FE8LBK&uS*&|wG#iv{+`U^
zf3@==hm{R}={fW2N%&pakf!*7B2P!n)uk3!a(tUjBB=8ou(>SNS4%#--FtJ5Pq)A|
z_RF)XolM9Bh69Nw#trj#{}cbNJ*S?!sL5PBh!Q^#RqN{+zVvpE>Fut|>}pUD@=+l@
zqc$5G8F?hXSok|hJ2hqjA@F@|rnU%Kf01%`;oosIAV)JBd6sz)cz?^3q|*0iN}4U=
zCaEE^5KbXp##>>^6;v73bYM%PQ|UfI^RNI>E&^F3M2%K|x91rdn(fJ{mAYBQK`H`f
zfwV0i*}|+)=VSNO5eG<mm`)9&vCzoH3ySGvFvg2-Zt{E^R7Z^bld|$j(r?=fe|%s~
z$WRc*W^U>Z`WV6<7q>z$8nPO-@+j5}9)dri5pKerxOkJ#K*v&~!sVrNAoNCyM$oP*
zDu(J(ZggvIbZ1tEWL=#bUtVRfYpX2?z%Nr}QJ(vD6&G=0-6E;P(Kfw>yvNu%R^B*|
zIC;4871B4AUHYV`GJ>Ro9JjRae*;u9&NwF*R|vx}95f4IRP8FooPOwtyN{_6REj+`
zvr+~Fw6s;6wG8J2tq&==hq1(86$hoY7U?oa4@{K><CDg~dc`2KrbA@XDjMcr-5k@i
zKgw2r`=%Q(+JJ2V<89m)G+fU6z%mFA)f(%2k%+JJn{J<Q5v@K|;_7qhf3LnQzh!J%
z-l+4VowC#*mdEAk4{tHYz<eMv5KoGM(&QXvyQ|0kRYaLouKu|9)yJn#!`P0+3A5zN
ze{uEf>64Go{`7~%LcPTtE@pWk-1O#g@i^FO>lg?XOSJo*YQtKkKgNst4z)lmJ@<=T
z%>EMPatc+K6$<QekmvqWe|sRD_Odj%y8*@}k*B{3Kcblb0ah-f<izl1w=!}g$5rD(
z5utLdQ^xjuAcOXJmN!X`*@l-l;mm#`VlLrgKZVi78D@ElXLsfzSCiins#jEUjQJ&v
z98cx0M4c^rE^?-lXU=b!MaB$;3qcuTcb@J)`|8D$oJcce2b|sPf11n3hsd4^9w_?>
z9WFC_v<kXdHVjx^A!@XA8Iw{F770tmpnTLc_y#5$u4m+~=)QY%cLKXw(k_+WmeOuC
zLOX|(T@MZ4Ix}y8+>yM;loPhgo#}P1>P;2ZU`nI}OC}Y&+_W}Z^ro$@)|R|!gHPg4
z%Y}z}+sHO#-WuLxfBbj1TN(>Dn*5y0SiM=>8!`oYz@_YV5BIBNvR_9hi#(ww;bC9b
zM4rgjL`&v<p_4jEr(R0(qr8^o3Gd>w%<gZT2EdN9c<G^R$dMTlTx%ICH>z$WuK29R
ze%?&Z4o7FlBO~)Ab>+*dqm*wJ`|1v|lrT_&qw!Ks(;QR5f67?3HM0ns-Hd)59+cJx
zPz^--8RnPB;kwr8e%2cP*=TrJID?JnR(Ua<EL&1xB)eGihy1&#0-Y5Dt1nv;bVv+h
zrm4?W6g1-biv&cu+_1!vM5iyxy8LltjBTUYay6fS3Z4GV6(-p)dbDbhQNU<gB;GVa
z?h~#U1t-Hwe_4w#>QlU$>7I;O9mCVfl|jmEsS84MH_<58f#zL7EOc_aJeL^@yUT<o
zNy2|RyRSHI$a}i4nBL%BTbn1c&$&H_u1c#&i=N?~v7(swN_;Gq(4m*<qB(gZix~gM
z-ZMA>6)g%KRc0@}eYXY&S<}5I>-Ouxu(8s3Q@>R5e|x*Vo^e&`re3)i@0KU)U0{{=
zrfxA+TgOhfq_t|oCQ@QiZBFF{(C&nT1zgdyhGc>w!?lrkh7ACumggHmDZQ%~JKGGI
z+0I);hjAQ;kM-O>z3whNkg~K68ohLi4iCo6)9^QDL)TL08+>GaY}+>2asJ(NuI@HH
zM%Nnae?2`vmD?AaCz#XVyzwb?yiB;ThP)IvyXur*mHtbq`P~ayz27=SoJ%)@E<Tg>
z7aZ|y59{L9Ee~Mbak_`6sE76y_l(;<H1B(r$g4|1!I$nULstIlY9#S~Kw+%;79x4A
z`{mcI<71Nc+U|O6v+bTAg1h;-_?w@N!}(cwe;mx@_AduLR`uwbc>;%@q2qOH9EEZ+
zD^z?Bbj#n%nQ$wYUkm7FC6F{^Qc9ZepXih0N{Dc*UpHk!unnD9L`N9<S?Q`RdqS6+
zQram-%S;K*=-K$YOs7Ml@7UB?O$_m}oW)soqIb#4<6M4eAXC2qP}PmH`qlzfWme4(
ze`xXQpwUYM*r)V>>^T={JG|ZYuzMX{@%@)Tx_|!S(p)^~q7ag95idSTkXZkrGkiF+
zI%TWrB4nROe?WIKW=MSW`dmLpV=0xs_;WI~GdSIWaIPIwIEgxbr2O|dj|Dc;1yJEh
zt^9pJjd1(^i~}%&GtC#S`?af&7Fu*yf0>jKEvWbRY3nKjKZYf^3Ii9wZEZj8ZYO!X
z*)yCb$nSB6wb{a~`fb>ElO3g0uUVo=HP7dv453%$nm0*4>ox+ZOS(D;S#B^T{Ss!n
z6hSSv4uhb2?dpdvEY<4nAE@HqYK9Jm^HtPWIbVRMAO#mzA`LJPEG$`C)!VCNe=~Jj
zdq%K&z5V#~6e~1cT%KP|{?e?#M^1rUPC5HCpP!9X_)Gx^0XT)KEP8^D!Mp)4o~cYd
zl*_MB?icz)l~&;%Jcoh(yiTo(0#=KdXQllU_sJ=eQ`^8K=18|fGoFJJ9Mw4Mzj(Gr
zu0ZRov(BJ6&(7hP;~=F(e@zR;fBm|obO9a0YwNNQY(BKEq083&v61eFI+piAQ-oxN
z9BK);L*_>{G4ItY&pP_MoeT{;%>Yl!OP5P54<9duPUeHw{w`y#O`0gCfjh1Q>GZ5?
zs#F1IXV-O05ziuNEfO*AAYc|nvM!3m6xTx&%W|IkDGA(ad(6wA^0GmifBOLoy`PDH
ztgyMCTT)^9U5g}lL{7tXgQ~vW*ziCslf_b1X8Z|6vkF0fXl5NSgmR@na5rqYuj|Dq
zz0-31-B;0?qc@Ad!MprQ9TOy%RXiwTYzYmvwM5eu1_9MfMXnI5fN_`=0ib#mwkSn6
zbIB5ix+hpv>)kJ<a81(ie;T!ySR6{=2bND0p-^)t@5b*&rXOsjzakBxyUbj(x6=`3
zKDxO2^XcfV_O_Ak&I=$T`+r}GYem<ak})!v)5D_@6r-^A{xX=a0cvu7aei<%KD}sy
zm}EIuC+H6NV)SDfWG+7D`^(4=<0_bHjmZ0mH%pNYiriydud-t;e|44F&=3@ij7lb2
zSp=XSyNY~9A&CrR&V)~k<Y-c!0kYj$jNn_E{I?H}2<eTSnMEDNzvI;8_1@(wI~pI4
zfaETL6`dzb5jV#!$&+T_o8*NWzDlPx`7EY)AQshfPbR%%a_5e!`1-4_o_}4$Rdi%w
ztM~QBCd>|8Y}bWzf0thBoLr<FflQ1qO-XXT2a}VF@yX?=(cBBCB@%kEc4(InJ5bfN
zBQKujerxYJ-1tOogoL%*_vXvpT@T~%TSBv&DjSvdw{j0Vwzu&TRsW;u?_$WHdm)>d
z2UxTBS~Tu#VRu~5b=cWFc)E_A(oefPlj<6sKm*p<h`^CNf2d>4yH4T#R+n>1QQs^8
z)r&y?>h<R2OS}WvRn-SSbLoQx`IHQRU7}h=T%+=wpOP*}A{1KJo;j>*zL(-fGdvxW
z2$dOMDtJ1XhR#o~3LH@ln}WrmtRV|O1~N@c0?k%=NGTePdm8T=3<ClP3qOThP=*D`
z8W*US#--GHe?Fag-K7s#sq|q9@?-#`9OzLFl5`+P`RMh5Zl`8*Zq7y)nz3qURkQTF
z7J$`j@{%r`z7g#$2*|DRJ<VLJbyJrMC(vhjmh8F-`msCFJHKz-uC~e~odwCFXo4Qp
zPL%;)(@(5jW?W=qR;3>u)c7+js2TM;2`X3ufE>bme>GByYJfjYxdW^Dd9EscYt-Ft
zkwn%l=pc~-{&WPewM0=UmJszVw^(?>f>*+^9e1T>ES;zlzfxF~_z=#-zCy>EuMS7w
zj}MCPy4C8j!cYKD>L-R}eyIYuvWTHxTat!bKg_i<$tD57d_$-HG{Q6;q~E7NF6b(W
z15Ak_f7yD!NCV2#8$31YEK>(zOhxM8zK`x4!)I)5-e^Avr~tBx2V^S)hPbdsjxySF
zlDkaMhWS8W<H0{gn#ciC;d<<;G}(r!7(xbqjs#m(0Q40wH3rAT)XAxcO6HMjGzY0^
zQ(hAaM@RDmo?m}P(I9l4%A(6K!kZ)tWPmGTe-0OSrrKHRs*^SodE2>mV_F%myRLjO
zQoC4AwKO*Ej$OFBrX06d+;ByPURROty-J04-R*6XzR!v(+f=VzCc=(obq9s<o0h$<
zSj{HdW`+r3%GaS;EXKrCl_-EX0E-8~wMVxfeu%!bn1-gaJ*#v#)?J78zR5?=pLl%6
ze<}S;a=$cU#zmuW{;xIOaE63vYPxi0*W%{o%hpXrTg^?*-k(3I7PhUw7rR||wj`yX
z?JDq;-lUrs1m~YbABfoGe1XlAFVvxy%&+F_Y?LBjhzje5Z5DvHu#qO)h6>5t)Vfgo
zn4RE9sz_uH7Hf!uD(n&^xJEV_%@>Xoe|QazRC~y>V}>9hquL1nb_!GR<n-#`Y&5(W
zUHy6Trj!R<zJEKq;56o=v#a67#o74H<;AF|Vt~Q!yEH>U{bz$IT~~a&6n5^Km~NQN
ziMTye+o5MzJan_JmbuxSv^;_`zt3P5hyTEOM0y-ueMyjCwZ?&oL9Y^gku2M)f9o_~
z#5mm2eiYfk_)hUU+uIp!-->)7MUug=D5)#Ktube{jFbh)n0zB9)GdcbM9bU3U*!qL
zEV2lwSq-^U%syy-O8Q{R?bJwA!SxJPU6~F@wU3#un_4`<a+xXgUAd@@CP36zsUHp0
zGO3Vc-U>edRzH+S5-%r{|A2wve>J32yvuzr%W)eX1bZ=o*U2Pn2I~e~_x7f3ttMt+
zLspnn%+RShQFArg@mP<zQY^FFt-6WZ(Vh4KxdW^fH$-o)u`9DUe@f?8Ifg5k+B&r)
zS^g;&WF4Q7dsUIF%^r$maTo+r4JFsSPujPO;ai{*qcbXCQarjm8<%?Qe^5NLGGlq`
z8|zr5JJTqcy~nSZ2z?8nL2P?{0uNxX<u64<#&hphkf6#uB&EbENvW7wQTRboiWqmJ
zPv23_TFeaK$>blc^<H&>2OFq+qh-ZZX-q0jtU^2Vh8UznKXX%#HBR1*&__?-P(?DY
z%Fb)1$94bt93XG-Kp7Pkf2>eQvo`#7ny7pZcAtP+U3$}134QM}4nK%A^CRH(WNx!@
zaX;+<z+EX5n*Et#tovF|r9#qE#KYSe#n&kM_q`)b4g~-H*#}G(=yxZ1CWoGa`|j(c
z*w*%38QbG#E~GeXA`hcW2fAq{F4e4sk&Tj5j4Jt?z7at+VLq*Tf0268*v2AmLTgfJ
zFa!wxY`-rG6|<Spfl5mk{oI4BQ&Ol|8(m+Q_ICoLSG3^nv%mh$dsQ`Kxe2CG!Q8kc
zx_&s263pfRtWx00Ci1V+eUWv#F#a<7>4(YLVfmVBvcJ}%W3v(Rd7}~1wIy}TuA3ZZ
zE_$5R6J*~YdrT8#e^IAJlIlREKFf{h;^tGm?o<dDag@v0g+QthC_IuX)0--NTewYY
z%}+5#wD@Lw-VoEjNf;|xL!5L+1vRV?(%pi{nRAXJmG@R&JQ&SY3ejS19Yb_&l3jDE
zY{FV#eqbv;4A!2M00pVCk`SZx?Q(=EZTXudiG&~9TP`13f4Kx`r@bk^F@<s5wKtQ=
z@o0EbD6^~hV6g_KyGm(52S7Yofo6}Xc<vb1Ouwv*Z1i?~f>qj%M+e3|zoj8&bz{sP
zY>?_)$rRk}qm@3~_DJQ!>L_E%Xi*;E=;ZR9Y2i@1l2S7ivft{Gq4!#2Il#<0?5uX&
z#@M#8c9U7If9k5(12JB>#*!4T@3RP#RX&-&0fJNNTs?LmnI9~|ctD01pnIkL86LhH
zpB#>k#wSK~Llyj6YHKF~qjr&iE3=qR<%8qV#RxSl#W!)nQL*K=CzJ1o$Co3sVLkvE
zpHnVY8eg1`F0f9l@xdy7A1Ak!lXQ9Vmy^j4Csysoe^p$hE2}g=zdS|v{L$f+H6qML
zKS<_-DX9q6lsjzM85UW$w~HP*wkpNvllizFU#UgcPBTZZ*+$)}V?r&v921mEqE(e<
z7tdYe&@Y`+*KgPAKdT!+w)P10Dikm}45gbyt8N6=Y?ZO{;Je`&V0?kZio4lq;+3G?
zB3uZHe?PuJ)qANmy44yLi1E-Nvr|57LtXi_6rZKu9uH66nlMQ7c3fhaiVrR>&xXfX
zS@Z4X@U77~dZ3nD8;+`u&hf3?IqIc$>V#`~_|p)bV5$>^hUW+0joyv6aa(m|ob7$r
z8(Z2r-kHkU@|w}COH*6#s$>6NcjT?~v_c;vf6L~ioUN2frEGK3vA0y?Lb|z@6)-aJ
z)@QS{7v{A=EQd)+t86`V+GJbBaO^W%LmgXoG$CU=%uW?&VDs!+b_)JPs#5iIcG$IF
zFOoJI*5ql@`h+NaFFf3tfp*a2QXp(Z14Kjr*1mInkKm1Sjg1#hkxv%Bl6LI-OyB6K
ze{Ko7DSed}uWP~HV3n9nk*gZXw86rmC|J=%QvOUhn_*xX``Ma06X6Gp0Sj|G(zdW1
zD%0&w)ojaF&BF135t;O0X*Ca~sUvj7&|YwTF$}RK$4AO{nPfSQGS2mRDOH-RJJ;GF
z)Jo-{9=h<Y&-EJkT;C_i*7oGpeeSS>f3xL@J32d?oL#*c9$uY|{_Apde&KM-o+S&8
zW7~hM7l9pPy~q1nlT^jWVL6cthcT-S4P_~&q9|eOQraAc<JG3=2|lNl?Bb<-W_|3e
zqE_#e+{Gh9T6FCTk`L~q*QffWaY^z^eM^!FSf6#&;l#H0gWCPL{gl&9k8vj`e+Aj5
zWAlTm*Tt@NNyvH$c)-hE7Uh8ael=LXvcC=o3vJugxdCe(E(#h`c2sLshLIOmgYF*5
zXKd42xx6hpGEDHS83cpDvz}W=Oc%zQhbg8?oUup1Oh`Az&f+9?aRMw~UH8^I_Yh*_
zvNs<Aa7k4KVe!!H^IGJlg0S$3e^|3Wr~c1+?&#G}t=*$zBOj{qsL~y+E9v5KIW7EJ
zr@uqr+EDq#F}VOOMH^4+2$9f*L6vvTi82mXyuZwY)L{^B(H45)U)$ZQr_PSaeCp-?
zb=7}yy#=W1KZ}RXo)uj}z5{iN8!x?C>Z5q##wQtAyKWCP)S>*!-6zt9fBWvNTSIEU
zsN%G(A>DX^%gQ$O$Z?2DTCdH!<cnz>l)6=qohz;G_wk`39Lia2&DC})+N|fUsTXRl
zji-H1EW!bRwmUAKJ11^(78_34g<ExKWqA^8GEGX-R-sessdI`l$^hupj;v5{7w7&*
z{(E<$L5MV~?67?390IQBe+PbVJG!s4)PO=LXd1oBCuWx^Kg!5kReYdABg-TUrHjzo
zou2z2%pUQlRb*SMTeMSU*UnTBdz)6MV3q1TGl+{U@?VFkN~5_+6;AxoDHeK%Yg>C|
zPIE`iw!gW5MZ^D0gWvA%y0xsWZeKOUhr+Zl#6pT-o6V$D`m$3Ef9Z9qXSW67+Ow4g
zsd5zVzdrG1*ZRbC*mP8|-*eMd_pkm(<@A<+G@^ng>0LHa22t$(9E<Dn7wWjU(pXbo
zUzO_KUCP#|!M+YMs&T&h9BbHmF2#%k2|{b5-I=qLM_#}&UZ(P;EavxF6I)|+fc_83
zzHQt_{Gf~WtZ1!~f2w1UkH3O(#JP+bfAo52{nm;jQh&slJ13$#;&Ff_((RAY>nK@W
z->5i8VEV+K_x5sZ$E8dCJ(?Zi5{L1SWl@LG)ut5_`KfGt@Wx6hX1>_6s?mrY?p6BY
zP;4~=9hba~IOOWGkc-z;`;$^^WlVV&h&>?HIc+@E7~>=Zf1Ih-<X$jKH;a0_%#|g+
z%tTsRTzpivNwAt;)n~*r^T|_Qn+w0Qy?BFUvCR9PmGi3ifYliDn<Us?@~;M~)z*UJ
zd5OyY)S)5#kPejy2FLYidtDG_%gDbgj6#Txj!<A+bw>xKSn-=A)A+5erleR_0V@W1
z!VIqNgN248fBaD*IXDJVP>D!O+UB!*E1hh0zM8r|R*&6PQDqrM7TSV<Bn?0E0+IV+
zgkmh*IehL&(QK1nK!pfXySYNb8Pl4*;3<5V8`@Hwc6Db$Q=}qcc$hX!W+ZNpMR#{i
zVdJhooq^)6sBp8A0V5WwEq$2~*ih`>_g2A~t6V9re_Sz(@H*wNS^Q>z{SFY|;Mv|s
zs?s3*GzyW*zEdr|0}=%Fv4NJf)+27IbIRZvP=n{tAPT1`CU!~1B0(Y5sQwjTI4oys
zMli_~Z(<NBho|Gr(TyAs{k`ztqaQD2q=0*Zq|_Vo!lIo)iWFu!R&Cz%hElh)igK20
zD`S(fe;rAT8n0;><Fj%lOxQPAhDAm%$mr%@`xxv~fP7|vGzQF`&{={-syQZwE}n&d
zM>nGfqsJl3;Zw9f^-zS3pfy_pM)H6KB=Nm0U#=v72>?68oE89x_gF{QnP3{S=v<3f
zV2q#y_~`Xpe&8M4NLM){FHWH)ke}&skb}!qf582}@B=*tS}54ysxj$}X%N8;xz*0*
z2Y>pLG^ueiOPT86Zt2pSkU&6g^g%d77k69`P9<qWWr!?Sm@vHo```QXIcEt_KIwfT
zJrv2nP-Vy$;cFOEq*FLsMZT-N>yQj@u+aq-EmkNcw~WBs@nMJp8^Rv#sst59q|mh^
zf4Z}X`1~N!X=eEWcqXBMn>00C7;q`9YB+X_!mSK%gi$<8@67DzHUw+}l&I3GvpW@2
z+1bEfh6Uc8%cqo&%0|9Q#!7i@DJL=-+l|a?;mEY4>8)>BZzPd+Y+n(8VU!3_z=~?D
z*sV4g%X=V+lGHAOY+f~1<@Ivadp6nPe+g3;(M*@G<;0%^y{`z%P8fsy%XMtA&asNZ
zaG#XYoPb&;Xm&2<rD`^6jkxOoQKE^_$-(4seDd~6uP@wP;m0yDmTq@Mwsk>B9$#nI
zJHAMQfj&o%UZ3$J??^qWAyJx2Q-U++Ib=Zk7N##G&8(8F36_+`0qPV+MG|KFe{3CK
zEA3@$94`4@de~*IbHjZR*HZzHNG)@JJS%x07_a2HbTl{=_~+Lzu8OZK2j6bs7~1LS
zAzw(9;VqZJ0j97k^^A|%5MBG?nd?nF2k~5=apTo!5$5iv!#OPL1Pf)m-ya3;=YKvp
zu6;3zYd*5fE#|w5kCE|G>Dt_He-3UExW#JTt+G5>SVb$GElz!4T-*)b`RRMn*oiWa
zy5H7!4)nC8_q0^r%6K`({KOIYb*Wu<G|G7N)i-5FIrEjQG*th_Jz4b@?*22<8P+$U
zQKg0j+h~LDWNo+1{kCpNa32~M6dTliJXwmGr_bDvUB`l+Q)bojn^XT<e{fAl_q%iF
zf~z;jA*Ka(zo!b74$=g#&r$cwHPT~^yfxJ6Mnuad>Rdxv6mdR1tbOsU_RVwm8|Jdy
zAdCHXjpPilTBK;jN#S<2MrGe8WaR!J%CmB;&0!&dIoIYwESAQWJ0P4S7(`V#e{-Tv
zC$Ixb2v?MW>bu^#)|1Ovf7E=4*Ngj=OhRjyN+|7yUHH-c(lsQyuN{ZMde``2*7)*S
z&DNq5duc{4S%V^Iotr?fPQ>jqH!GrEKd%SQXy}H{?|?uC-@$((t?7lEQHEo?U3VUk
z<fVcKB#i~Jk;o0QFr~Rc>K)@n>iEJYkqqQIsV{gU89<7?d;Kl2e}{em|D^cmYY%xr
z&0jL{hsQm72Mel!nD6%CWBh-D1Wl(&a3>)Kugkk)``G35LA6!I8IKxrM>T-yChh{*
z(XbJ)U1z-k@F)^iHIsJGc*A#rTy56~*1-IFu+V5NkRLmZwA!u_>}e`KbOBp!R|mEt
zygT8(bx8RwfRUgbe<TY`eV4UB$EM><H5Ng)4rJk6O*HEUZs)0N1F6)iZBSLaZh$dH
z4L)juiA|8V?gmhC1z~>r!&|1NO~8xhuC~pcROxy{7e(WBx^UbH4Sg7`yLDozxav04
z)u<kzp?+^1v0G8!2wZVrjc`jWS_??aNa~(`wMi4O;k9VKf0ZOeM>`i-R5=WTARWec
zbwE{<aaL*61ab6_l^?akbTn&%dgL#{sCB4#cRCt20k*`cCcv(Sjet=~MVn;%TGTXc
zf_|E$d51w)n>7I~d9l`mbv3L5{05V*wSa{)>uy#Dw4{o20+nsL0j%ifoFG-Jt}rck
z9S1zK_DDCFe-$;M6Rv928D<MZQfGE(0o-u^ZZ>-vlEUcMxB^zo&cOMMw*g*<64+XX
zEiJ=o3su<w;%dtPkt=CjM{Lj))U3m4*R8q%<uHLpe5V%cAkanX&$fKr>5FHrFx!EV
zuc<S(ssyt!4yy^gJG{pUy`gCh@TTjIVb<Mr`z-9^e;=eyK&8Za2t0zHMt5Zgd{S(D
zrn-qMf0iuou26+?)yN3ShUk9SjlI0`(Gj&1WNNq$WR#9OL8gXlKwiLKEihA(U7Rgz
z!OCyKq&gIL%Qc2<I4C}A0d6^wb_Rbfu5MVQYXz^Hb^(t;BZyN?Yogk895FU;USw`j
z3$A*uf6Lxi7}$e4%%jT_%3*i@=(S<D_FqdkszUFnw3GTvS#g_7LK#2g*QDW8AG42;
zEOrm=N<}TCR}Ln0rL2g>E1i$MNI!rvZL0L4(d`cTe^Ra<?=dIjF`tA~YZMbJ8-;JN
zqpVy=S(c09ImsX7%l4QGNM*aS`sU3GHKrw+f5Jpg>F-YU->?QR6fM;Ly&<I`QM)54
zV{FjEz`10H#$w6V!D|zBZeFViHUk>VRx*M$b>tO6XNfq8sUQ*-Lv!?{*RHv<6CHJJ
z?x+J^2Uv$S5G1A>i2kDR+eNo)@)$vNJpS+~Hc;-28$0nPifaaLZ+j4CvsK2ie~0?-
ze+qD;6+6x83KM>ewTg@qGd`URbdaNu%_3>Q7Oh0T7s3IFRT_TTlrx#~crgS|d4v@O
z$myQ$nI|scyyJ)pd*4n|Zyz(8(?8>R@rj*KDZ(Tucb@nd(y1vYT%yw(W<8zD2IfiL
zQo)|*4Q2LI8nNn`>m*s_fdF_whrhVyL=QcRmVbBbq3P#lliy`(cBOG&Dt92;V-?n;
zQY}b7bY@J#)c(lhkZ0^NAhV>TOy&}1rdu|QDq8AQ4|ScXZse0PiAh<=BBkbwPGps{
zo6DjfW)2Tk8%_EV2hwi~X<=syYmR2e_TWZxsXW_|Qpzgb9qFp9%U5d6wXjul{w3RU
zIe&Lmu}_!kvjOk~9@(C9_&JxzbJRaCLr^u(B@FdbUIw~c!M3jhT)bvtcwp6lGmx@|
zwst11uJ3WNyWdVB`$E(Jqn&C7Mp)(ngxL)lMdcS|NEtbEv;&guTsK&v4p!q*%UGb|
zN+>=n1MLKGvi#I{m>yO)iX;PcClZ$HX@55suc!bhNfKvJl0QhM=|p?1t{rS1x_ZzG
zea?rvoyR+oIYp9X&EfgL``!fOdsP{+7D#8rKiL+-pGqHR*!|>F;C>C>--B(#<78rO
zrt;@uwak#b?Xd9UVhN1d^p2vYkaRs!{8x{?sg0$V?$sKpI<pI<Q@P%8yx%dbJ%4}Z
zlP~A+%Q^h@pF`{%PQ;_v=C7`&P_UbkJcdo@55tT+vx}Y58DhPlIzsXnpCG^QVYI6E
zSZx0c`OSz%qjg|u%bC&cR}YAk)v~sUQ4`it$QE8>e##Z*)!DA}uj?Q<(82S5z=(BK
zGQ@7w%Q!c_3<ksc$+EDaY{ey3{D0+A#1!z(v4NPvSw=jjD-7M~aU#c=AL$RF<0H<%
zZ*(C=eKiCONmHPuR0%(N610iV9Z!)?#_f36=}b}eXq7-a5D_|ZBO#FWTsAmos*uoH
z$IZM3Va@0d8qH^O09#dTrKNL9lhCFcn6#*X{hK<|-O*7eUZ?aDy{h&~Ie&VV^3^+D
zxpS-^t~is3U3}?Vv3MOPfVl844p{_yO6w<c5~#3587C-j$uM(hi=~E9ESCA5E-V)(
zW`{lMLlFx_;h;xVl@OMw=z`T${!A3;Lj)+MnC;seSWJ4|<J{ZHbxha3PpLN*>XmeZ
za*-6fP;3ft2~_bgQ`z9=Nq?dOB7Zma)8BDU+}SEcmI5u<y5;{u(|^gdas3{(QsdPf
z0h;<tE59}-QOE#|ZoHk{;saQY$qN4M$-(%t5Z4kv#!9GRO#0nezFVr46l+l0gGl(P
zL1gK7D}AL_ZS<2E4IA(}r1R&ej}0{Gz9a$u7XMg<K-A>@O~IXXt$#<w#cLHE!#G-E
zS1ALMPQ9@cV!qM4U5|>gQC=I0vBo6Tnm>>kJ!Ayw8t9?YDU}|yBFGVr5vQ_%F4H?U
zWlZnZLm8Qj=?l&<&fvahjf?70dKNc+^cwKPM6-2}W3@CfW3_BWi{j>KL4@vmZubAH
zL6yx|9%FU6udW-34uAcRURyugPk0zxa;r?8-FCPiTfKadT<^K%vJW`YD-`4$hWqYV
zP-IVc1Z=fn12imUR5$N1zq>-w?DaQ(oKGrix!zu~iK?`l{IGRD<si+pcN-t{qTAp2
zhH8SaUGb6!leKOZa|fjs$QA(Ukd-Fk(1nq#?*)8@L+s?MqJI*kX;rc8yFM%;DJ!2l
zf-C_@&kcmUY+WGi08ktSl0zp947_xKumUpu*L!Q7H$6M&ygJg)lR@6dmbD)>+2eXQ
zt1`@dHdkxh=C2lrk7(gdv}}}Pek&@}>OFZ_vTSbAy>DEJ&JINGh%uZT>ORDo`umNO
z<|Atroeq$pp?}II`5kpzYwa~*t-aSW3ccfAhlKW0r(PoD-FYkO^EbZV<A#;25R-?y
zuA4Trz{2zKe~+%-4Sy^!5tYKJkf|Zdh~T{Ey@q?f_p{#f-hJ=+-lx6i$8jdoynKxD
z*=FY$+U2Zom+rTMjBFbmYy9%dx$e5MKi4sD9u++6)qkCOJnUMmE&{G9u-3z8J|xxS
z(GizvI``sOvAf?m+8+BB_wf+S2gVORawK)>s@TCYWB1`QvA5s4LdRUg2Fc+;Xi)72
zGP_{E&U#;T0&ZS`;y~n?kStcuzN$N(N6dZn$dL`H<9XDDyY6!)vB%%|nLI78<EK8C
zjT^~lvwz&=i_Y#7oKMUPbm-^4eMZ&Obrk4D9R*cJaIHhCy8MkF)JwIB-FLAfsdW_7
zxY>HfP1{*;eOc^_b@TJ~;bYk<t3wLun#-+h@7x}?^SXKGYH3h<=T60S7*nYl79M--
zqw8(#qib}~b9Jz`56FqQeN@Um+2%V&-i<QmmwyEsO1!T<R&>JC?fHhlxZH;kGbKE#
zX461-Np&KFN{ots<7YS4r}_bXdNbD+l^c#KEd$U=A0Ab+k6?M6dG!;WMdVR6tq2Zx
zzJ0<mZwohFKo4P-#MQm4&mjN@!$wk<J8^Tz`YNbl)++FBT4wScdS0$EhgFOljsf6F
z@_!yS!_{SbBr5fa&Agreyw1OQB|Cc}d)jqCowaVs@@}1pU_u91JZ?)jN0x`#`rT~(
zq8J+fPTNbwz*z^Xl!~K-u$oYnWD&>Sn>8H`<x{MROCvWgGd;`{Z8Q&vglR|*GZA97
zD(R2SDF<#1-5`}!aaQn>eaj+dyL-J0XMZzY5DYz*Gk-47&sliMBFuALI5Ekoz*v}~
z8++0#@>ECRdtJaNPiKpz!UgI7tZS6XSxWbEzOwduTmZ3$@w@x`p2UH{Q`CX^T(NZ8
z_nz?2SFi8~&R4y^#`kgqkUs7(71s>bRMT}X-MY88Cq2&nO7)_tu8$_ni!@WEa(@Eb
zKfSV!RPmH1L+gCwCNpwRZd?d~QENi(#LS>Lgor&mcf*ZAPZ%QpP&+MsLn}yBY&wM?
zC}F8P4jHv9GfCY!|AGwj?xlhp(_`j~c$j3mH~s$g`fw$7SOR27u;7)e64vcaIJ@cT
zYIVRZMFLf*&z}vZVNTy-&Aezu0e=q)qvV}jAeGS}71eoyYp{b)X&DFJ)7_rD+9eu^
zTI>-vE@&geMwl{l({Z`-GZ&`#t31I33tUtX0qmz(@lfw*#>ciAb)kYav~n3fMtmX^
za|q+)_FEFf$@#Z1sC7a%lQost)>{+Xh%#%C(#xHS+XuESLZJX}o`C|!cz<}>a@8!0
z43#kMNgnOfVZu=u<7Uc)d+s~8GfGg{089=KiXn9nPN>RKWkd+b0Y4~hXRq^icDaCz
zjp<32_LHsfT4GK$AkmDoT3_g)G*YE7u&qiwDqQgsMj);mO6X=84Mr%IA!N0Z!si!w
z_^`aFiV-AYcaucr$U=ok(tinrBME!_jeSKd{Mg4*m_+t6CI739!6<oI`V_e|I!X(m
zsXafN2~HlBVBs<u#O4EO%ESO}`7F$VHh2XG%t3u^VT8R+!wBsQ4USiIXHUBn^fxRj
z0%vyo9|Ni@onA!um##jF@h|kxXuo%USQo8nhBZ6N8Ly#>;Yx!Bfq&u$9dy;$%v5a=
zH?)?<lVN<(c>a1cp1LM-9a_-2CZYqxD8?{Ut@5NiUAoAqE+$Gj3Ja%Ioz2ToP_7@M
zcqWM9v(TQNbin(PrN~UEpnY2$rx`N^R?aa#tU8so*mvYmfAfwJx8*J9zW=-#rEO^0
zd8}pU+<4MZ!oK7E<bT+BjccX7*BIBf{Wj6WvHr%l{%0n5Yx&7;Y+LVr7JjldtjWD>
z>xG-D#bn{aVzyL}H|b!Yt0hRSu(sDLz*1oUm}Nt*tI*vPQfVN>vfCBFwHYzh<e!u2
zqt}&3?UEU_hC~1NWQxdTWuC1$#h7M0qf!Ub2iNNI0g|AiE`JopcNGS|_PnAz%Vr3$
z#@_hwLCF#qvOu9|#`uveWv%h;P#xxoc(S&-LPpT)bji~@uP8GrF|2gj&ZIhw5AgW(
z^y>U#cyW1tHTg@GsG>;MtF#=QolVZJP9_&u!^?~BCTHXS9vv1!SY7+0$=RFn;o<0{
zN}M~MUXaLvqJLZ@mlsEWl&9Bx)P8!C_yhWCMB>_?-4zl()2YM*AcH^F`Oq6q^j5Ds
ztSjN8XK7E;nR+0<UHBi9Rnf|>RPU)jw|{8ckJ*KvUc(w>vKC7<>r*;w25_FN(wV3S
zz*BEYw(EcNpwV*03x+z`>0K^d22-_GEizcq>Qe+>(|=$KCDq`mf#`y3cz42bF?)|k
z_k6WnlF3V<dii-fzT+pX{4tVxqn3uv7?dJNLF;)<|C`>GbG5hetkv;;4*9;#1Ip{+
z$UXWc9rqgPxOH~Y)_m3XN`u<syYUG`jc{HZ7N@X5F*jQX*jG37(^8jDyaXfpZo{nW
zg^3l#ZGUdpc+w$n7c`c<E~$1g0*Z@C08#DC?HXPFtQ3F=z;A~+-sU0yOc-t8DLqCm
z57F)ZM-2;pkWo`B@JMt=n-bReK!jH{>Xng$GXXOjj$d2_vH?HZ>(z7Xf2S2{;nux&
z2EA7>=p6|`63={DQ&bWH<4G$aIA@=p8GR#Sw12gs2T`*b(&U$o&J?@s<d)?(@Dl%e
z07iI?6ZL@1u$*5D5M+Vv>OsmTHeJo<4{Vp@3Y=68NY0`gngwst#1CdVO4NGPifBLh
z@3CHvck72a8`iK~P}Y|J&+4SCA_XK1^o77br1cyA-ad*U)YdzIjf%}1*uK<=tZ8yr
zEPu3o(4JV2+o2s+jRhovG{mmEthN09x3kh%WWHEt{M8{WM5UA8c$pEzZ)c5v@Xa;G
zUmeIrsEjbh3foS%dAJbCD(|w~2yLz9t}vgARW3g2=JFS}ryqSUNLIM!a#Wwqekmml
z4zfi@Bb$^zl{0G5GI1kR>||I>ILN#m+kcH6<-Ay2`{Wg(oWXbRiCV~U7ZoOr2dxM;
zS)vc5H?z3*ZhDYrNvAZBo%Lj%a?vuBX%?`e{MTbvLQCJR$LQLM?1<*B)B|U*33X-!
zj_BVUYNGw2(NFFQ{p5ZQZDq6E)1f|?A%@k}2E+C2jLnNMg1InCy8<z2LpoPhk$+B_
z^pO-G)V1LNuC}uo{F!X!;2leFx^t#!E6mxnWgp5Osty<$)4GQFNRP1xWshs+_y>vz
zm;E`&PhX0YMP<yQa(UqbZ&0vg`giz?lFh4IQu^8G{apHRg+f=b^t$|~N%6>CFk=Vf
ztal5@?@glwwvjF17QqD3ci{(u-G7qhE#Zle%Mg0&%X~NN`Oo{tmfkzpA)o|S@c=y-
z`^wqR;o}T%Xf(UM)RLst9izM*F}-!lUPM^pG7FJ1;dJp0E~ibxNsp!Ug8G5w%olUi
zr4sLpRd5)*W%uY!h>8U{Ml4@`bvQb|xH>u>zQsSkA0Ld&=%`%V1Br6!n12%)f|Dmb
z*{v7A63=qnTZJ?qLfBmBESZH=GJ;s8>gG<Ama$JUBh}4R5UJRDhLI*KoJ$+zjxyx(
z?jRKuvg${fy0fi^t@pP3O6L2}0nc)JM&!3u6SHKoNa8E3`nCPr4!di)?Pwn{g*%-~
z!cdGGo>TVj{rBRIgBa=~>VE<;_g7KwBGARuTEjONj=IqgKv<VdjDFnv>dBwXiQ;C2
zTzF3EBsM~*zlb|0PQmkSqZNSsf?1y*W-Zh31L6}-@4nb{CjPN9Bn#KOZDW-L`vtRp
z2{a4kG-M@G-n7l|?a;!oPJ$~9sf%-(rKM-!YYL-AnNEC=bvNJ<fPd^~79eFT-(5|4
z&45e1cPp-GR(7v3=w;mp=6@1T>bPd~_mx=Qp(@|!*i;!U6xge-qmxQ~69@nI73RJ4
zFuW!b6im764LF?wn(P#NS$Lt2U?RAB*<(#biZFYN-|w~a`v?%z77#$w*Hu5P^8JNb
zk0q>~Y<ImQ4l>?63V&yLW}kKaxKp;bnQARVUsYIhCiSEsAT~Psut>Pi{y|GWOzX`2
zu}w7eC_e`$pZiu0)*o4QipA}f%VP+i+ZBr+W5;?U)+}0Vd}o5Ao%|qzHKD1`zIZgP
z;q0(MS!Lzme$VpC2d!WVENmH?E^}N1q=V-b!cfgzYcwk;Q-8-*k{?h!Xzdg`f<5R2
z%se}5*2v~Ud-Q3Iy0jhWnQZk*s%1ZwiGMlQyRVm9=08DGN*`0Bl-yD8amm-!!Y-1c
z*w1xx4>Kwx0$D&rKq-o4lJ2II;9<{`pbFHl^r8{El!7G_d9DI<DYE~@&xo}^@hZN?
z$U&!Xe9KDm8-MHs6Y3WP8wW(GXJp3xTVLil!5X6<L`qbZmLA=AZn)m4M5GjxwJb~H
z(e+KO<5rn|<qeH2uS!;=aJ^%{U!jzRxi6DnAfb03Q-dGCVDa;C5k`KB$tGZ~#R%1z
zs0^_DqHcUVJXR>HArd0!q0zQwz{Us}$1Op7Qd3C-uYazhlU31~L7q~5)XnArgY3aD
zo=_{tf+Mqux8MgMb92PjP*DMlOEDE{Cc%1K;~1_on_(Q&RoF2zuy!wHN}uh|{G~q)
zqcF!Xe^v9ohFM(43fjiHm1nSZKJr(~0&TxCWF4opl?ci;%r2(H#duzo#2DLags~n?
zea}^&Cx0{KHF+O)KX|q$rTX37j}rAo>p4)WKEAk5{)*iv$q%?{{3<{05U~E95_DAc
zk$6d&`tJq_zX;?h_wP_Wb7TJs`>K%T8GO22rOPA}g)f!)j1I2+<@_2`yIG&|0}eBW
zKb;?~GXL8CN<N{_=<iZIP<rjh;XnPVj1O<FR)29=I&)D1BrDACN+&Ug)w-f=bMZ`+
zweqVtPw#3~^_J?wk8*mLm7C+=k89qhNs>!YXl%cdwsx8mdQtrPtO1O4%>$?g^O)%~
z4~FJ&oS{9^$uJ7x2<(F(f&9AhjbmIAom=<=eW(=ryJT3z@Xl~#<Ej@8pnGQ^)Y_@V
zFn^9nOUReevNmxS>T+jpD^1ZMoxJXy;qc*uwbR(D)7-L1&|*JNZX5E~vT$%2zmK6A
z|8U)c7MW<d%dqXfYJ1<FB@t@lT&YogU$k6eF!eDe=HZNWh8jmxysmnjY(<KA4?Ywr
zMXjjM%iueLK9>N88sJF{Kuv~Q)I-qBB7cQJvOsAZzpP*SEQFSsh~@)!19inm+eE)5
zOj<Ygf)X+NHK(jHvgCDSlw`W*QnU9;qhe(e4fLJI2N7>RsWwPb)SFbFhgr{|K%jyE
zOOXypfrZ<Dm*rwHxD5m0?QllU6=&u5L8t+Y+AZI%JsO(yd%G4fCZ|CEG-D!|34fJ+
zie;oXqF_MatadQ=o*ui#^1?ySF#(?tmd7gzMFp-biO}l~S7i;=g)Q4VfuZz_V^f}g
zu`nU<Q^F4%UVF+bk$8@>@107nOnFjqXcgYV%WjfY6ri?8W*w~UL-GUleUK{)H`>W|
zi!|9eXL3}`Iw=`@(=bPeK5ufSjDNB7B#M$-#2R8B{W#BF_9(~cx2p)o6NRr0m&Aj!
z(c$Uk+3Dnbbag&D`+jsrsXt7r1e72I@_`U9j?X=2lCnO41W--z4vxp8lZ!TZ%zJf$
zH#vksj^Cb)Pu|u5#C(%sL@t_v=m2u`Za6-^Iz5|Qj1Dfwlam^-0*H6y!GDcF>{AE0
z7vpy$jP87QS{keJ8$li(HfOOUYXlpXS<$?YiB{U+PY%vcT}v^Eqc9fUfq|Jahs|l4
z<jE|FdY+nx8q1#SZJ*GiC07k{q0OjE*}74qYoID;)5O$(vVh6@NP6+p>FDZkbTqs?
zzK}D1sR;u0xpQ_t96W#Whks{COHT*S|M+6JVW$Wld~x;c$%{W;oqsoc_SM%KE<9&f
z1bm6P#PKd*%R96jKvPN@-UU1ks1`iFydU@%PyY0EEqHvnIr!1RA#`vG&C4Co8zV*P
zDZ!krfG}{!8*~HP)!q#>s_n*WIyYudUp;%;-V-#c>uIg?LIPLwfq$VUNa^c{yeEl#
z?><ES@_hIf4$%1R_+ofWq+@t-c{VDJQg|Kam<<<*0uYR}k<2l$lgY`|+3580a6B|<
z=S%YCPsMT-gv5L9qbZ7N7l0%X=9Htm4fJ0|KV6MZ4#ub7jn3Y|C8A*?PbT77xP)7{
z6Qsl8#n26kVoKJ6g@2<OzC9a_Dns(GQz1ITI2fH>&=y!Qh@CK<3tM3woE_U>OpYWK
zA3%~LhM0_OU4g2#x|*CE|D++C>qH4$+ZTT1f)j}K;SkNgIvAG8KAW*@Ml9<L4|oqZ
zKw?Tvh^@CW10HG?_N9lpCRo?97PT<7Fe+QFenaXK`>9fG*ndxL4TO4UT9ru!ATw?&
zs+38xbZ44|Jb#K|JrvDDGzpWi1E6b>L<+m)l^$l<N~HCyb)he4CWnUFNEZ+&EVx>r
zSEJXnD!uWl^YXPJ{P5)5yGgQ~+G}H|DYn#2qa=SfPes`BH%}+Tc_Hh58HXRG_`@1q
z#mLFpCpwmPZ+|l*gYCjz^L9;>gT+`%R#rk<+uBg?@BYQi@CnTfzc#zU7ybMf{rngG
z{BKS_|5+%sx8!}fhB~_(hqQBWen!=?dPdN$q3@QuVraFIin~{@;`X+q;_f*wf-l<C
zFWS^E+SD)F)Gyl9FWS^E+SD)F)Gyl9FWS^E+SFf;Hh;Cd0@KcFZa(T>UG-iye9SIC
zleFfKIp?&k#{=w%#MVNhzvN7Rh@9!jJ3lcL1CH#Pc_i8)H7IA+jAy2!alcsRKf6JE
z{yE{h6i7;4Z?DcT-<)5#)Igd4L2<d91HLC!C@Qa`=SqHOrjYMO8-c{09}crjECA-w
zDvD75#ee77`KmjuoWmESg}@YYbWKosPtM<myzopk7m$JfvFRZd*FXrQy^F0Xc%QK6
zYnye*ISUyRg+sKg8~A{eoLc!BsEI`)X%OZU9?bTMof=~E$$3NZNpwTfvez7IHN9?e
zP_;Qa+sAV*w_R;?-GJKdAZO*hcad;f`xYXs+JF2u9F>#BG>lobYwdxz!^C0q(O)bh
z)^_ugUB@}=$<|lE%<Ns|v!!lYoIeGTc-%eNzzUWD4tFWi2n51x<}Xo83TW7~D1$w!
zC(obZxb}3ndlv9D2-}-9xy4d45u7@MsF{yD7jVQG(-$b|69A<fZ%Y+k>9dkAE6%du
zihqF?ESvR^c`E+3eJaCnTWE|m=ldksHrC^<z~K5^e9SA`Q@rXNnhswN&JVpAf2I{R
zop#H)CH7tzap%r){_3~&{wa`YUm6k~cSf8Oaa+L{c-Eag!Mw*3UpB{&4trZ2<4$)}
zqaS^51)SdVXTYC?^Q$lpuq;5C8_8VkNPkr*GzVzrY%f2j?)7h#!X4f`Py%=CzvTkA
z&bCVslWWrqW{iox=RWZ!w2)>NW!$E#@zK@r<R@)u)W~W#Ii4I0T~*}_#wP2=BdMmF
zb2Tl&U-hPZy}_MG#H>T=b%`PC!INJ+9O1EPoO`7n+{j)}ar8x{G;D#An|g#Co`0En
zU9nyGEVPkXn&1lyU?tZ#<_^c2*gejYsKqlj%(<C8j{=#kme@Dy|NH@PMByStF%%DW
zk6kndJnAyM{uLDh?4yDdP1Am)89GZD2_zDjMO;zLfK)6-Mh*q3klAMnGY~Fghz+MU
zV)fJ}^o#V54T;cY@}SCT=e+8}!+%4|<p>Aaa}2Uy2jFCKVx?tI#UlA&eW(i|SH7ik
z$OfkR5?Rrhv`hu_nmv7-cSx{yTuF-6=u-nC>ZSiF8s9I2pd|wcvVsV`*7uU}KYc|p
zfZ|Rnx*&PF{xygpBwyFJkivHFf2qm-K3dJW_H+=4V867oy?>#_4Ogi<lYen2aIG(X
zyfByy{j5W^ENls<1{!;q$t$I^nxOs2N{rQ-#>MVfdbH|dF7o>Sn5S6D1$X1=*YF`c
zh(x?*-beUo`}aBzt)(bRu}0;KpnwAN=?o>JOe$_T%|QNQZ_g(x0{y<+>$Y_PRKh${
z5|W9OswlQ&7=*CBB72g7FMmviK$2y<4ONR)Hw$SyEb44yAxKLTOJ8C=G}1C@;!U^B
zJQWQ<F|!i`sHEPVD1CB~?@0mPTZbH!GzcAa2Zu^wP?Ah>N@#lwDWx1S0a+(4LX-ZW
zUV`|{81{|y1uSOI!|MZ1=x1z3`Bi6qL6ONCt&GG*@5ds)P15(Rs(<Mj^|+GSGL>a8
z6C&<N)yt#))otq52&CQ|wanWlkt(ZW4Nh>0IYJA2+k0x;i3HyG9|X`q5fc_*BJ!C|
zGD)W%lY6QlerDB~-ZJg%kq0SeuS`)WA|F=LdlvjJ=CCAt50*R)BplX|TRbQiSn{JR
z@va3XMc1NMDGhps(SQ7Ia(;1j@ZIp_t>#tHF%4PcFz&T5(8$$R_DXwY)NsY4iytOu
ze<}4jH&>kDtU;~eWPJz2C|R<Mr=1CeO47Vgo(R&ArQ|hoI<7hIR%nc45bLXf7#5pl
zw8;v7K2YkuE$C#l38?|dcY0ZC4Nh{7-ON@u4e+*~wT}*{MSm%pLR7X(w%}}MRWy}i
zH``2<4BvvgT~3v)aotqcDsg3dO88oZDhbF{C1>%N0I8o3uHsZ3wIo)eRL@(}w3Wa;
zxT3905I%t_%{2Cqas!<wJz%NRJNk=rB$G!a-$c^PDJZe0x-sD%#mbT;xx(W83%SCQ
z01CMx$Mmep5`QkdJ8vmsl&hplCgTBxtmIK?o3lRU`R2jUSA{A_$vlQxt7jjbE=Tsi
za1|=Di}7?L<0q}{TDDK4NB3DJkfnnvpYd_0AKO2a1h)AI{g*l0drL6{&1v*3y}7T=
zv&$xJKy6E-{59|9R!QMKZJso2`vO*v*1Lr_MvK-xt$z$`>t@cvTT5#?)6^McZw{}*
z02Gg@bM^DrYvZglVHQ@-4UL@LeACe9j`WVieu7XOtw`lqn6`q7Z<fl5nRamyBTXjR
zrQil;1mCI5=Io4Oi%5GfExRJ0?d>{xRT$BQl5CArD}j4(PR$~OpMgcxB1{g0Xw_#7
zF$d8qEq@TeGJq=Vlv)aXeC;@f-rPb@8Mmc6+OeGH`W5HXU2iH7mzlc@_IhVrp+ID+
z;4#mu&2ae-YxfJ)_x;V5rq!`<N9?%{yxY|1ursOyQZX~i3qfA+wMNEP8)LJHvDLy@
z+!PuF-4@0F<h@}4u!i~gAI0z-U;iT#F5{y@VShx&O>B;`@>7Lhx1O)Vv6BFy%LT2)
zv0Ht*Z*mE?bi3-Oe6yzykp?DhbFDeEXMAt2UBYwn?Ui@;<=ne%*9N?MWu*7pSN!=P
zdn?PQZEJr&Cq7;d+~(wqhZ||s?tw3zw%Reyt+V#sBP?ooeKqC^w{O0n5fu-<aQtg?
z{D0jeKQ<2dFx?`59<Rs(L%LC+t;qltfDbMOlnCi(AP4B$hE);3=EZxaM`C{s7fG0N
z_}+B9>$P#`Y28LQ`4#r=#h|a@3+Q0b3k<HX=$g3eJG|Z(u!A#Tn>Szwcfc~c?rwty
ztXhWL^KkR{wKR*C;s{rZtNdeb%tLuI>3<H;|E<c?s|t(v@g+PLc#-6;=*se|_Ihyg
z1800CxfmJ|U!N?zvOJ9)x7yCU>s53)M)q^SrE%@cm!u&wUMdbi6|JM64`cjZL$#GP
z-+1j%##Vq{W7K7LD|pxq=mr6p&A_^kFzpU_-Alg(&>E!x8-f0MGXrMwKxa-mBY!Iq
z_tpv8Wa5PWj-BICdsPhCG#+(t9coQ89R`6#r`5w&3Jq<Ha0xZpj$~Bz;uf$Z(2|6s
zpR&Lue|C-#GoR5VTU@YoshW8}@CseatNcNn%H<3@i4nip&@9}Fu6|RS<T6g$3Lu_B
z3+)W4I(X6{>#jtUu6aWYZ*;CFy?=@0ej|`ybD+N;1et@})JK#tPWOB2`16sc+GVie
z-6P06M+8~#{t;xJ89~<DG=hv=d8%OoCXqc|O`*S=id&EU+7&k7`E&BuF>Xb*>{+ky
z0j5x-_3xdE_TPHGf%adG(Y#DMnE<Sg?|&hEKKH;zCIAV?X#%LcyRQjA34fby@>`cp
z-M~;#na?kM_pNpM<yZ@feW<7n%om-pEpuh%DI;AMoN~Ih+k^UoGF?%oCRfs$NMf6m
ziihi&l(>YaT&HyiN~eu=4DW#~NsVKy*oe#*)Yq4c7Y|_?I*|@GS*>W+W^r+y&Fz_A
znxQ|qEk<?!^V?utH-Ww;u782^jx~p3UnQ2o1!ReHmOf@h1Y2QU;SW;5jB>9ow6~&@
zar5h>nQ?{qR?^&RtB#tb-eFi5{9BfB$bj#i<(~LJRS&jo=$W%b#3JK-6<JH&ue1Cd
zOpcGo=SKMhiV@TmjeQw+mqb8v$U4>0h*So%OcOxq1yyMP=3i}$+JAEggRsU$r3J5A
zk*npxlI;r7W*yy{{P@=`&is1R8%y3Uk(ts`kq!naM?q40+oc@qBKEn+k7cgyDsmey
zJJ|S`T{n|=@4)RVHC(%Rhx+ZZ;U>q!80NNB&@h{;RT_SF>R>sp=Fi_6TS28Beg~hu
z{GE4sHvX*~#Y_d8mVa`}7aAr$i00aOJ7-4+-dBJ8!;{^fu85H?deq{0crm`XJRJ3p
zCns;|ufO(($NcPXfBj~bX0Hy;&X0$0M#u1T_3H8j>oE++Cl^2c?RTuG>=o+GSpr7`
zvuw+l0vNVPb04@7_P&-`P=rjxLm4@|;!yR<QZQYmkv|m?bbmF8qdVjBzrD`>_(Cd1
z)et?n5pnvkWZ7!Tz9c2?<ELchEmn9SSUqVGx-`TAB-`MAI+Ct1J&2M_sTJg}c5x9~
zVFG+r$*WbDC?QwqNthbh=~FG`EgwMET6QiPNjbICdua>9bg~q&URM0kx~kZy!=iRu
zLZf5L5ko_NfPWQMpt~+~*;!)yin#Kgy5*{HUaCtsOIA_f#Yv7<js%vlvl2f{&x9Z7
zea9cI`;LuR8bWPhF$#f&KRO}-wKeKO@J|aBu$y1c`P&+1i28b%hDe0BN1S+zBo*Be
z;Wms-RKTAdkO7;iz#)*U(_F<PtwU`Y%x{L=Cc_o1P=8D%nF`js^t9b;qiD_{Gflqq
zSUJVjOQ)hPCPjvoy-7;dSJ2~dl|F=kxo+JQt{_=b2Yz>PaayYH=U}RNVr`CP>~qX*
zmD|qS(S=<l>2z{lesU=v?AADM<MOq8T4O6uR+N4?YV*Y6*auG^&SmR{Zmy|NN~{p`
zT5&X@M}HhI?;>rWEI@L3f<-?kXXF1KspO_TE{xJII8p$znl8ee^gws8Y^BrDdO(lD
zNLVG~tw-%S^vI_bYqlsab<)N8-W-6m-jP^_3A&|!j62aB!J4(0su1P4+~>Fy!w%gd
z@AHd3-9^|{li8uzu#Jx?4#!hXNok7Iz!ixumw&azT^CyM)G=6~YccVM2)f`?$tHzu
zi|KK|a=Lk9DBonB`?DL=Zp&q`{DXRo59ke^Q|280#<<_OlrmrtmZeQqy=T<}j)8J?
z;^DN<pPfKQKUiO4O~#WF9nlXqr6RNzs$o)_k++?m=#e}$H9_VhjB(ujce2Xy#}|UK
zReyrQE8LBoq$tEuZ7V(Z!P5?ol5*#|b#j}AIsMVGk6#1T(l$38*cHahRnCW&SwP+=
zsf){#Ue)JubDGw(XqvY+O|z7L<GE|ZWNxDZ=4DExw7V5L$6G#2mLW#2MUfT}u}rS6
zutw0>QL((LvaERB_#{?7&;ZLrk~pPGoqx+)$>8i-?}XBgu<?DcG3EaxbpH!^-wt{I
zHIT(J>sBFiy?d~3-h;4iBg``|RO0vYlh(t^jSHu9z7KS~BQ6ebw`n+C<=rGg-CCVN
z<3Vw@%`xsY9bNbnm@)kAUti_kb(*Z`@3tfdglyYC+AxyNXKi26V3%oB&7&FGP=Bo*
zPkbZaFka-k7|IWP3_AdjRyg&+17;@|w*}61^4aQsLbB=+$-15q3XniL&7biZu?|Qk
zy^m<K+VsiR7~0RkmTE>j57Xy+PBy5Pe9ubBliJTap4qq93~v&u0MhlS-1k1?&N7Xh
za49)aQ<8bcQ13vQ%Zt2di&d0|7=JIChpIBX@Mkyt1>bd|bNJ0j7C|{D+F_hM{j7uO
zhR6ox;s(m@&+rK9;wl_8%alnKv9I;oVgE|~tpMZ_YdPcFL*JoOroh2@dZ0U}1Bq4x
z`vlbapt=c}+{rZ%;(PA3@@O4&aBZY4`yk0M?sqLZG-Fd8MwGU^G6Bmi;C}%Uw6##L
zhTVBUoG7DTCq!5+4zV_mLIU}-!)45y4Ls`yKa6O_ph1ofN<{gj38Uh>-sY^Qhp?lI
zfN=&E(giLutOJIBJ)Th@VCD8*Vqm4deC03BUhYbyTi<-)XYZ?V7BDg^yh8mhMOCao
zVtJsr3R;aeI#irQ)x2WB%zs+Tmch-FtWX#0Ekg9T7I3Hnw(;S~#$bzi7>Btt(1CWR
zEdZN2Ik==*8N(k*#momk4RJL#%IR?`nMBUI5$4VnfDLYj@(x<iRF@sVwS{&Zbco{6
zXwwYp5}G}HxW>=wnt5o_5_C{ew~J7k=$M2ObXxIP9g<0@zd~|)sehOWxP&sp!%?ra
zN}elm5fuxh%PacV?{05G;K0mUMt&w0wo+qZQ;UOSd3Q*fyF!tuo;f|TdHe<s2v->I
zU9Y+sSb#o>VUR0fUA<aTv-U=oZg7N)6ru1c5+0U-|HKng3Xjh)EIheoMi9;LbbRMw
zq_m#qCD5a)QTFb^B!5p~xAB^CWL%ggaBEO)CsAB5@Jk**xy8&8`fv*vn!3}o@yW&L
z?CNlQelYodbfyjdsQyuvr{q9knXJo7jk8x=X27j;y({#TyA!z)^Ug)9qPx;!npF43
zUoHgzPGYNkO@2eB6wc*><*pL7!QKkC5-VCoJ!@n|xV>=zq<<%G1<`exuPOqRE6^sn
zc<DYZy!=u4UPP4Z7f((hj&N13tca<F`^z5jzza#^#?qIKC+IkwQW?|u&I?w{h~1IQ
z@4HDfXf!gMd-c!G-o1!2P5u>{AJL%8{$}{G<^%W#i}>>g@Hm^dX|mOHKI`mF?Rz?!
z92GkXKh_gOf`36WACMJ?eSEs?Ep+l_XWctXP9$@WE%C11MfcI$FcY1(_eeX9s$Z=e
zjE$r#lo4B5m<G_lt)t#R^||BnSF-ii2(|AKqKJ=TwxV_Z)b;7s^ZA+6YF6_gvHxGA
z6)Z~P{Y)&v8U8g;snLRp@1QF5rB|dGa22Uu8LLTK>VGC1ujqcj_xnMZZdi5iNUq+N
zitf$p!EOCCQr1OWe95wiTGxJLAm+&mcYe!hmypY2h8YKfe6IeXG<{sBvp|>WU5_v*
z^L9=r=i?ud3dey@0eu*5ED;P|{{Xm(;EM*x5&?sn%9<7Ek{RWyQ(ki79-@#~$nm^z
z0sw|wMt?KVN_dnP_YU@qeI?{aJdM6<88gW@5#*tx1x-4^5UGWq&t$M>Pce06*Yz%R
zFj}bqVg0k65@IV=cMZLwK=9~t!_jwN?zm6Dy<k2exFL#-l@B`QuhB+<LL*9oZlfEp
za@03E`?Ax9`qkk}W-~Tx?QIgz?Y)Hu9rrd0V}GIc(=M#tu)8+vB0F4Te+`Dk<W}G!
zQ*YQnFEy$-Mi4ST6RapM>6QzcFQcYgJ`!=aOFnCX)xid2C^aiqAPGgTbIY2@+l3H^
zvs6B8onP#Sv=g<a{^HbNo3%+J_Fx?!e9-au9GuB2+urff0G4+_fzSc34ry-|{#~!O
zj(<IdNqbZHCcPuQX?p>CV~AThaG(BARh)M>Ib3hHajHH6$6WXwOz%)V1?Wns0SNQN
zP4TzJDF-3WE@R?uql!eL%v1oYXQl#}*j%4;V&thGMo5GX&dAH{_=ps!s5V0<xS&r;
zXV#z@7_BsoIO{!9>`A6M%%tu(UPZD`<9`5QdemEiZjX1#N<~<$G9k-DFjwrsPG7Sy
z5(xfQ5N{n<S6z=`9m<eBDlN^uX+qZvHT#7g?$7_m{H0w`<Ln?=kaAiWDk}47S6$@o
zjX=eiQd(isEe)fKyk_?Kg_(DVZQ<NlQK#g_nvu?Xf1J$T7kiGsTKD=wES5>?r+;B|
zhvuO7p3hZnC=Ru&T>*PqivZErQ|#|EBRLVR*?P)AjQR1yA}27y=-1dT(XQ;J;q?s=
z{#*a<7p^B@Zl%Du6Up9pw{?_4Re&eRl37UCpLD!wGjN%j1MdF|tzn+ISk}%PTI9n~
zzq%&GY1^i*dt&z8!M?Eo=s%aiLVsmRt)V3g_SS9m4Thy#ba(3AP>G~=rZKOMY5>RY
zy~qt+G-uY?hOnVrG;qe1QqQtl0Y6W5m>@AqDxJh_@tA@v`(6SZKmN%PgLgggG0f-(
z+xob@UwlU14CFuo-C2!s?lUvNGC{!V%lvg#07)3*)k^8utCDNN515z++kYx&Vl~hm
zYc^C8r-+-Bq6iCNv_nsg>w};CNr&#S3y(GpuwxIPE?`dP9Yr`B#bL-Ka5`wu^A3zR
zAYI{p>x5|fGP9R(hZk^{u(oNwj^*j=zPSV%Rl{Je+srs8I}8FG+Djab>|1XI7Q#Rf
z#!HqIWtZglvGCsujyU@80)Ib+f4}Y(gDE`E``$Gmc#3{7D4YWKPea1?#^5tM^=i)t
z`jZqX8#|KLqrfJvN5R_URp;(2-JDw_yGOweUaIrplaSh=gZ9U~$$kxV){(mGGbOM!
z6x2-^bEKa&Y#m_iG-L}S6S^<tvoq;972>^Zk5f<DQ!qnAPi_iju7BIqD5rY-!dyRy
zRgV0;4Wk_YZr$D=DA$BfH>aN?;x&ewSVB8@v7X-0<j1MYzPGox_j$?iJg^RK_47fN
z-$g<$o+GeD0)!d1gw+N?DCv)%UT0PW_b*(+KV6kP0px?un5pSaCzM>RYx!r3@9gu!
zz**OzDs|8P3XsHdDSwa;x+96@NYG&Ss9?+5egu^)yWxjV6Y75-gwiAJlCG1RZD8^L
z{=tJiKbxw#H+~#Mf{l+@+z=fUV4(iekVa{8d+Qv6%sK&CXY^m=&R(r+>3i7l(fc5E
z*2%c{iy)Erz{}(CJsYWIFUyrSscUrYV^-r>+>$2%>P<+B_<#S|d-vzIk*h)U=iskE
zW$&#>Sy38$CUdh>$yCV_?NP>-^of$4?ABfdBAXJ%B)|ZmB<8Dc|Mu;3PCxNrH~125
zbE*;x%|>^l`@H%*nUR3lfFBP~)!DD*lVAF4_l+Shd7jjzvu<md28;X`W|(gFHi3`v
z%{)QA2;z#qQGc%!X`QYn!Sw;ICo4F@Go`jHr6Qe?QG+l^^H^rJLjP%YA18^aF>D6K
zbU3sCu`bp2H+XqH7piT&w+)xrR)^kW%rHE|lgELx&*<Xre~9o(D{4Zo^Do^l`oS0E
z^1T#i6DMCRL=*%5f&mlw>}wh}72ai&aE>FbNZ(D%+JA#&2UQqZQV-l_uj0hosyJEE
zPQ}UUHY!eDexK55VQmzDUeQja(_(d7#Rq%gy}D+jk=`kIYLyzPjthIyXqaioX31<N
zH_rReZjzDZ!9~x`gQIQ>d2Z3Gy93*RmJDzE`fNYZt=3CL(CSF>m4%fAyQ`OV_4@MF
zv&jI`w11qkVKf~n-f1=Zg|1Uh6nueHV|)32snjr8VON;ewY1QdiJNs|D=W*Dtfzz-
zoGZ1Ll3{98U&1HRA0BL6q3?b9gwICWkviqEGokb8{P*F*y$67b2WU^LA1oDVgxx7K
zk95w~^_QR%aP3GFtF!m7!dF8@rBIGR423BrNPiA*a#K0T@#GyV-f&{iqC^&f56s_A
z($R>Cq+Fs#y#4buDQbT?ja05^dqk*7e-8w;=B0~%!3vpov*!1!D7mj66{<Rorj6??
zjS1mH=FfPb*OBa?l8qw8juXhKQPk6`mia~{{Q))R%%+{#wEdJ5m${>xJG!}}n>)I>
zaeunmlm2iv?NrU%Pe0XCcQkZILw7WEM?*JBL*x7bZ@+0DQ<f?sT59*9qWl$0u{#j&
zHhKPXx=5)9m1?&<>x&XZ`1@<8eJde-D<@YygbL7+Ne~LL=&T?+%Mzz6EAcC*NU{L#
z#ji^LmDT-v+q-$wyRNFxJdus>-6<pBw|}4A<;k#Hcysl>Lq#*t`G4%2o<&V$1v|pa
z?dq}o@iEHQpsV%B;a&IPwGN1xL;ZT3Wf7#iQyJ6q4LQ9S^Q}0g3Zp72wR?0RxUftG
zs*;cdYCTj1QRVHX+R#lvp;NOMprLcKL~?h@w^7Vc3c67|-%kIMF<tM-$N;08>wmI<
zljo8$DUR6~3dv&vYmB9vrPBa1!VDk-x+)-v+hZ)x7kjDvk;dL`;)T7U7L!rtrVSz+
zX;{>h79LNtkyUC5kf0r2uLrI9x|~?;Uw7FkuH?q@TC`h$T729Hk!YZ9leH9E5*`W)
z7!hNeKvLvKNCFl624@Bltnsr+T7M$Sf!dGE=%5PH3p*3XXd_&%0ee--^fqp%d}I(;
z&bXNJ`=84#ZV8rmwn`Zo;!c>}L0U96pwQT+0zLI54QM^pvIexOa_z*%;%nx|?6tht
zuYqZ=Np$o(;@m#p-0yJ9Kz271DY!T-1!1$AS>JgW`JO>}VSv2dg=7tMSAVU<mqwc3
z-Ehaqy-zw{_IUr6-WjJ0Pkx76I@sURyLnvII!KtrJV*X+^%!}hIz{}O4iWmU=L~<t
zPxm`Q(YJhb?jinGdU25xv&vLj0-MjdLB*2N*$L+4b9Ay6<%&v8uID5-TMg1ks#-Hr
z+XDvOnd#S|pS>~<np!GVjDIwv?wZM$Y8QK!D9}ss&=Y-`C9~J22{z7Ry?S6%29*_e
z<^lzmMX^*G<;aJw?=Mfgy=&+p$`)~9_A$=V1T{nY9w!pr=gj=wyy#|BpeSbr<%tm|
zB9~&xeny`A;CMpCcTi$3<^8mY41#2CCoz?6)<qdKzIAWbylA{<Ykz|81%5$!u8!QZ
z(!OE_)WTL6q|C}BK{C)p(2Ayk{6ui|71sJa=>(WT2G%KHFqjn4{5+={r7dGcd-LmX
z$5=0`&#YVZmdJL_gkh%8jX97SG2Fz$fkR778{#OBEP6Fh+i;)XT48l*T3aoPSHCT*
zC9|9^<UR;hx$}fzkADlQRLv-Ss;QGv{#4U7_`HP(Vui3pa*2UXcw?1LlOQauO+W=(
z5vdPs5JzujXUTv)TLjDe!85(`7+wj9lni3dcXAA=1u{R5vin%9H)<~QjQ<HisE>rl
z<%eCf+HG(kkTmlkEZ3wh4MiQrNc2Dht*1cLSL}4)@HapR!GCj+`v1M}I(HGjZ0*;j
zwsDutr2(6Y<+{s684KE!N%2MNv+AsAxM!8LX(~~CF4BW>2^EMlQ56tdp?vT&mRx$9
zW&wMS#uLarIkAd^;)UWv_w?-e_U-%QcfH#;7gwj<tM}brPkt4qEtGQOdGQe5rP+XG
zTsqFtVrXO+6MxFFMZ`Zrk|1|!9br93A;yEQYO0zWWHq<wYC9?kQ*WD>6@KN8T5gP5
z;(q%OsIpsDTLOvo&oHy#7f&hiQ#ME^@r(qW6!}{*m+R%HcLr79<dFKjHOXq0KE`0_
z%2R#~k!KLxPvZgJPWDuJUOX0=v$CI#@8I6M|5Fgamw)_aI^xS5#XmRDR$FKD6IPTY
zc@*m3a^#*%P7nATeC&A>REW2jBQj_<PU11v>CNT)?%&Jf;0hu4BnK)W2x#nk-N|FH
z0pddW#(9k1{rmArX(KT6anvtp|FxnImJ8I|J?K^U`1BuYP?6YFDvQLn<^mRSU<`bz
z>JYe?jej2(jnm{lFN`dikac7xAO&AO6e~Hx^KJx7h0CJY;vQd7l+5-`MUkw)XgEno
zLQS~BA$i*8eal&mZHFWi^{j-zp&%)SzhJqLgX#+U9npOe)(sU)>R5LVDb|ayZkT!-
zSU2PXe2NE9@)rK2az8uvy)pKUd+)<Fu_NH*!+$gxWNZM1SwX1gB5*ACvs!KrkJD#(
zQRk`U_&ecYUBUwq^-pl<g1!T(p+D)YWOGKEdrg(*9^zr(D`SK^8Dl47>|_i-83RK#
zsv?Gn;PAB=DYF1<LT;nNd}XV_@!THNl@)G-AYw}#I~k&d46(S5bB!M22*MjxHj)k8
zP=7TN7GZf!;F5g+bufUxg$jYoDIE<zPwj+W;xc)AGE((Tv43doq=GaZZ8aVwqV}q?
zMTtaqmy)d~C_8C>H6{}ae@*Y5m6%Kn>Ln&B)2@TCm`&n7mUz19h3{D*%>Bnd9E5k%
z0<Q`Mzf<Jl56?e_lZTW;xReh4iQXqJKY!m`omuoww0WAUO?QB5B}6{X>ilfP!W`~4
z(=2`=N0~U2mk@qbZM;_al3k%KXX-*CCfJy($$DH&2m@i01TMzXkB_zyx3Bcc=#f`h
z%RxwrLBgy%7Enn%5n6%oBNSTK7n+psyFL3K;>qNvKfou$UpfD?X6IWWSpNHxkAI4%
z{7~mmqup&hJzT3-j(nwJ#Jb$lHsK1pg$`a#UTMqXTCa#QEJKDw8RNBH9lky&)tRpY
zxH##LrUTS(36v2y&;gl&T4cdB^-JD?tez8?u>%nUjooriuh~HSTpAy0A$Fo<(1EgJ
zqxvBr+Mmt&slypUa?d)zChKRRZhxF!<os*vN8)T)&7n1b@>fnlI!a4GKLsiu1v($A
z-~)^Ph(q`xj0S_;(DjU?>@y#>y71EP=_t)|`<uj15App&XT%=aD6f5W-cRY%yr0KV
z9qOLd&We_q+P7f;^5zYMN+!HjN@U)9_xkWP?Hy&1MP(o)0}<oqGW~unSbyV<v>zqG
z9eO*1P^SgNIY%oNBsmR4F6NkW7#T#G;}QbB1eoR_dW0eX4BXZGyz_|SQoMthEAEa)
zkXn5J^H9d7nW7o)186ZDoy_OEirX`gGIj!Fr9T}-S<T(n%^tf+Kbr~CS84KQl+s_5
zsaHV<0mLVFN}kC1^oxoantx6B@s;JRG*foBy7blDc;qFfx;LOhXNEw59J70Va`lhP
z>$8jVpe`Z;83tWi{?E}NY{^l76hlH5sD&lU7XyZK@W6WuaE&8Y^p9%$qBLj4PsruQ
zxk!G4EL^YZ_U!HLRrfz`y1nb}sesKA9-XHJ`w5Y`87@%R%cA~g6n~#URw)=?Eg&(A
z`Vi6&8utL}JWR6mp35(X;Rmq5bm%9P^08guIFxkGV&ao(mPdZQh8?hxt!Kl%M!B91
z{WXXOnRrl-!37@3+heX)n=3dW4&)MeXG!6Fky4iX#Xmi-fS7Sz%ck=r(h}~;d_4m1
z<fDmmZ~fAknKwXAm4DM|1_2jT6Znf3Q02$WpYBTZYIHJNykzmp#a#IAkdAs?5n%@T
zsN~|2_9+6}IG1j_!zs`#K0+3A8K?!u@L@F0U<&Xpz#2aI5_n@3O%>J8cUbhZ+zK}?
ztvv<bSB69)ZQg|~4qB~#Xa$;ed`ZgcW=X`RV$tQPYBY@78-Eb)gvWE#M9MhuhM>94
z#*|-7)~`*uFwWmdz;=Fp`{C?-WqM38p5;@akVAkVM989~%bsJfyGdUM1*-=kniTq6
zz$0Zq2G@VeH^f(;mrAqqw`2i(e!2F>F`WrRJb2%+K#Q}a@)2`lETDUANR#nL%BfMs
zQ#7HDXSFFe(0{T6zo-$7793YSf6>g&D@{jJ&O0|fsfPdl6|-)bDi#jW;MemM=L{m;
zp9Bb{Sv82XE~H}S{)8HXAuR&}H&qOlX>9y!2nN177f^ZXJ~QGueEQ|=<d?r)yy@K@
z8+M5L4ky=VAG@lLeV)48$;F4u_g#Ij-H@W0zIs_Acz-MiliEl@o&@b3hK{XMA_trw
zLQ2N&qilfIPzc!tHSGal=ZJaivKkJDQtl^EfEK+2`Q;sThTwk3&*OoO28Mr{<6!Cs
z=Sxf{6E-*iwPK%*;IHToRfjkSxGauX(Ly2uu061lAE*{Dx-B!ZN!9>sK$O2x!MoMi
zW!0iu-!_^PC47I;#P{n-sqh6_mF<g6OcsPO7eq)wChjGeVlV{!AK6NBAOe(+MOp?R
zJ$8YWg@+B92wvBvB6z)m<SaVlD2suYhMyD8M<puDtf&KfPoE-wrQraKHVA10kuD}C
z@`tsybW@BysElvRu^_V=zPojRT2jvP8Hq6fI%>oFd=!79W%ModtR(yi1j0(gOpS#_
zO>X-f)VLGWr4y>l4xt<lly8tdqm{JY+{f{h@7^6lLydG(Sk&-Cem24wr?Q`v`R^-l
zwo|%+x4U|KT)AtKZtd>eU-_N8O5&Yhc*%c#N;7SYkPV*7)rsh?Z>@;2+9gOJa+6QL
zdLKOS?xKJGXMb>(E42Wci=5+$<#OvMByq@mNC)+5+SS7~t<sSW5c`NI>Ka(wpr}Qg
z<5KDVYYL%F)HmEC%J{B(Z96MmUi8W>H=<#Gd3Ew6!Wh8y;hn~gWhJPaTsZPePFKMM
zC0`web`X#yN1${PAkrzZL4>&(=;^fHHqY*`;s$@hF1i9MZjH-CPow$Co01h*|FEzX
zH^|ZZ(eSuvYsS6eLZ_mg@Zeu@{QK9PyO{5M&ZdL3lks;s1*I5^1|q1!0*v`q>L77t
zE@EBgj=5hR=F^x6C>#+aYmD+BO~^%yZ#;)pP>E)FNVzWikUtV3*&2qDM&7f80k{s1
zax8zY6A)X<XZ)%$4*5`7I+^(&HOnWQJ7^oEZ17~2ndpwC8mOXDMnu!AHkqhMW@`oH
z5*9W=egnovwBX6E2v)#^*2*U2vD9lE_;=%)%u3D6agtJ|P$S2v0y+$hvY;-^>4F7W
zR?1X283=xE(_GbTroV?c4LPQu@FMIY8VrA8QGbAnns9tBO$9Yb<!+twKIVMo->kd-
z5N?b2f_X%SSyX-UL7-LRz|~4J;oH$Pe~{Cu26GO+jZ&Rx@1@pjdJ~TxLb)Ox^yteg
zVDg7FFW@?K#5Xk~b*&{nw9UXwD_AM_pdp1#f0b@^f<)B0()GGm9~%-2Yd5;U+l_xN
zbi2_7HEwj|0h@9tlgy<P3T2W=WB|Xx5la77j8ja<5tmEyl*?8{0J7^m#RlE=L`H%r
zL<fM*zoyZMOoS3XFiK-OW?9_l$o}{POvV5GF%WQbP%}5m&6t?UB_@iK@N(?4MZ%zs
zNQjd(`t?a%vZO(YQA_&s;mixjft-H`YwU)HHn?pnyZ(?<iY#wLhRIfn#xUTDkhls!
zQ#p7G7z!4+R_J+T^{6Tw(V1CLL?^cl4B^ZH&b%NP9p5t}!-8sQ15lDOp_l<9bZ`i}
zDvu{@;hQT5Fl#|xyYtJ3;}en)%qQorT(S(yB1Iv*q7O7pj1s}~>hT%w6>@)4OXC!c
z?$eCJ*jNhK`j&>je`YhKVda01SRy-OK@3sOPjr9>>`@xzVI1{UCwN#-q__GOheRFa
z524w&ESU4}oIk>^*rDb%{_*qQd{60{xb*Y6b_{n>LO4Od&4(y|Xc(ZyDhBgMgR^pM
zCV=JLbU3s_O^x^6G3JnC4HkdXFxJZNH$c%xY6}35aAtMe>AW)TIxD*7*vf<np>^)Y
zYh6B&+Bn!82098!fw9Umbx)N`rKFXp!iX8W=UBrsFxe$((iyNx#;A50gd;szSW)&R
z`z^ieNF`fG$4ZpLu?|EiAY97mxBNjS)Pw<hzZ`d7N!2O;>2>GzpMHO|f5)bSkPEUk
z;-s((a;PeQFJ`*Wsg5Lp5PY}p4^SxHxtkTD{-h|X0sB-0BNlP0_TvxYcg`dQjNsjq
zU%<pZ>TExHx8_N{c)<Md@3@?v%}iqLVj28I43;6DTCfZ}(&bo&m~=kNXu}EkfSMEV
zhZp4p$Ff_KC-=6IV`_hP@wR4iEH>Pa96!{Lwfeft=6oF2I<GcCcU{O4HWJxjVImvW
z5ZPcEA{#an*<e{B%a_`U$O_nc86t}tyC{+Ep%|~pY)^>wt~zp<4M&0!DL5hoE%wYW
zc>Q<`3Y9i@7Crf1tuS6oJrBf>bRg<y{<x-mN?t^0CDf;85Ji8F<_$rqyBo=%*c!ie
z<V}OEoDLE^=~}j{(Lw@2fy{)2uF|I{f)v7lim$^zDo6_dd-w{0De7Zjy24IBRQg-*
z;{23>zL`)-KYLV~M>Ta6!aJOBg7p_-$B7`soaXc&;?W>uiK{xJp0r%7_P5;d0HOy`
zOOyY-dNhGi9o~QS@>`cFln8@#pMh5D07JXYx%oXvJz#EqftdkP5q#)MLTAs`YS%Xv
zLFjoFS(+A=18Ei0hr<jv5!knUWf@<%GPz^9bs5;2&lwd@EKm7mpmi-MtsDq&D#4(d
zY_)5VqjP?&dHuQ8)MOVP4wzmTGy`JAb^fh7$*@_lUAcb}d4ulTSUR@IC$~5!(_G^z
z?B)A4dFr$d#w#kK5jM?*EkQB)LS78Q)4ShTzmZ%zRj3#AdPxhq9t>I1&lJXZ$BGk>
zKr~Fr7VqfDVVvQ?@plMi(jj6?mPIpIoUx%Rf-bqlmJlZWsb37V>b9hP{kapp)3W|t
zE;F2Q@t1#K;X45c`|FkLD@VU9Eb27oX3GK@%=MyjcYv-r*O$SEU7)nam`P)2+Z^q$
zY-SxS+L}C%l~Yr}a}Pqw;_s<=&~tqm$0{U<wV$TYBs@~b^_3;p2Pcw%<5xm!Be~!Q
zjH*NIpvod>(Zmnh2wW|II~VS=?MMl3kpt=m=@fqfpgh+Xa#N=d-4q2`JIt8}XF{Fv
zof`1IJN#}g+*yv_exS#Xij|lcHF<;H1iRx(9FVtw<V0)vT9imj2ac$nZX!lt?qF@s
zzZc()EX9Iu^Cv#+8FH`VOKXAyv7{X!2(7r@>(xO*NyDU?yx|}>`1E3;&zGcJ`r4!)
z^YnjAPGo#%3lYfDEBXQ8^=!f{@Ph_#;DhW+c$wGgFi-LWZ))(OCzYPhSjvw0*t6i4
zdmr%GxN08JZO&tUpGE_Dw&E5!$1Kv8!{~+VZN?U|ZHA01(3Dp-imlGJ%s|Z6h0Yg(
zG#nO+#SYrC?$c4PA@M-&%|y2TXm76Gm(PEdH!X3f{Oy&VC?9Xnt}8P-2qE0_wg~^o
z$1iTj=>UUVR)5ZXE>}UA_jT1~%~d&E)4)eSb_KT@c7&m<8&3)}50+LYl#Dpk<jr7X
zrvK+#FFc)8Op{Jp^OK5`3Up&GTgyXP$5C;)k~Lo=^1h<@o=E1cLpT%rAIQ)#?K6Ko
zsvIBsRp1ed51VA{F;1sBemv&;32N+!nXrtB2_DeTN#%|Cjv~r%+hQ6CEP4sY3mHN=
znguHK4N=hY<+?Cz*Vc!kPhH*7TbVQ?Q5&^+KXp`HOxfgX68i8Fr;`Di`^3xu{hbeD
zq`=-jHMuB%D<T-f@Ir=d9?Vaigr|R0lQaM(?Sj$P4DL~lW_S<nKa^7B>lJxRFO4j`
zx80B3^J|@(t|T_&mZHZg94BlF)}N4jkjIb$te6X?)|Lb)xvL2H%7VIAR~J{eauKw6
zysD9nI!yZ*W;O5^-Ot&RW)A$p$retq<`d|v*i&n1-Ng_10=xxvQe9Qkm^Od)$AIB#
z_r?nZ{JDn2FG4>zH}MOpinOfWn6@sO>u`f#?8-4CNLTLEN&wBAKxRjY+6+7bDwEQ^
z!t16Z?jW1E?zF)N%X~!73t)w`Jgg2g+L)FWL=IC5!@b@iKx+gLx*kXH+a@j#3qgO`
zoTZu;;SAaivN|+qY4BPQ6NG=EZHEMFLjv1Kw{2)p)`zI31<=4y!mbVtT58*O3}Ksb
z!8Q|Y4=#MVwxSW_quUWw7RDR1ahg#bKGQ7miQR?Q>1U5v1UY2|(4Ta&Z2Vhj@1Ke_
zDDR&f;K^4hF4jxMA$+>7aTm86ojXsRVW0V$loI1_pL*d*I-W%Q>fe83{2o7w|4kWk
zsUEr8h1_1oS8*E4qSB}9qvm~Wk=KF`^o|uOkXD_$+30V^jqj6)e*x1`e}sK^GhgJZ
zoNZ*BZDg9)>^1Iy0*w2W?Qa1CC!;7HTLO5wc_E)NvaI%D6c4wu@|6C^YKsdv-`1S8
zcpDexaC(L=;o6OMH9mi8-XKz95O(uI9v^NHsW^R<=iR}{raVZz;lyytup7N$gn&c4
zXUv0;cCH!rf_A{O?${lFe-C{!A8ER})|L>YqIFt9(A;ZqX+b*(S~mo>xi-q9$t%#~
zUkeX*2sa|9oDhcna<%Z2?<7|%BGLDde~EHFZah#zuR83?FCKsC3;4D{)i@}|gLzXW
z2q;5&JkYlrXGDF?8ro0@Z*Re;&)Y^j_>x?2|4Pv^tk`gTeLR%@#dXp3(&+CCel?D3
zcB2#MsB`6B4B9@`(sO{EA5hh-&T@GwVBXb35)SKv2A2wBy*iYZH0ML~nO$b_V^lD0
zr!6--4<5Rk#}0o6IZQmOGDcC}C4TlRa$hVjanDQ35{>THlG)9bw+BD_$lQ&(T%W6t
zk)iFe&t;=o8OHpO@-k%Xaf-RGbNs5Jyc~6o{`RS>Hz$xKE3lxPfS%BREB<7Yn!KFZ
zfe-p?@E11z8B;qXDTf380N!!JjSY<rl$tybJF;rtK{<cHy$N*FyHVUnY|-9O<=+ga
zr~s?lrGsf73&>y(Vi?mq@RYI&bUbpBF^v1Vs^5S~pgC-X(|VEh%Uckm^>T1^=5kkv
z)^eG9FDy5FcG<S7__bbyCg6E_e4f-SM4)xG*!G0BDF8vKQjG>tTS66KHv-j+%2056
zfL4Jq%kzKeo_XVd_QS)!TUnV8LN=Zhvjw&L^W+uq$FszgwfMw&xQuZ*fs{~9c3+wB
zT$CN-FVxf&+XDHeSFh#owbSzVu%1w#Q~>h|Mwy1x-s;r)>-LX%A??XJoL9UdqI8kz
zwNvVw5HUCCrVb)jpupdVtH{=ag})z%H(1y@*j|4t9jply^Ge0m!Nl@PRevqYw+b#5
z<?3<}!|xj!Q22uzK6s~!_Jf}!$QDAJ@l}JEnm6dXjIyoiD*Q#O<$Q15bIWRMv2M?u
zJJS^K=L7TmD7il#42YTv6N2651a00`@WH(1=04(sO|^L52+a1RmMAQTunC`-a`nI`
zr*nVB8d9$&nv~1kb5v(6P`jWKlOKxrWCnDM`Tl}4v%)r=(uF|-muOg|%8~<|N>mGa
zE2>2g`qE{rWThpS6l7362G32>IY8x;Uk=bnZ3z{{6Ds8u?GL8>ti#0@M>|ev@O#<%
z4YLa#D7t%^SB-M3zve-lEP3`?Y1chnh{}Ic@A(1({5?Nse<>|CPI3?)9v-d-L_EPm
z)IwP#A^*j+m`sZmCFD;XgVBCDb%{wa?BvCalw(lGp|Mmw-*`tE8C@t=#%<>>Q7OQU
zLGM`6O*lYX2xK&RyEjPY!NiM7Op%omiIOzo65xb<Rpb^etz@PA<3!dpQ0r~8W9NSy
ztE}BRNAl>oQzKKVX+c}WJgvyeR?&y`F%6@-r`G|NIYztuVkWN;it+ZGqA|mmi%l3~
ziOFB`kZY);Sk?UZKd4S?1dsA5t=b%O&x+iFhMViRoj;dgqIzEolz<J%HAG+$y&`g!
zsSzoS2ERbxLrrJZP3FUh^FSt#IP`ypf5?PWxr-W&zNvKNV){_gER}g`+uTKsNteI^
znUrdSSJ&kPB)^1PZ$&SVaO#ajlvQ!DTd~;oW(!n#@GtUKOj4bOa(Z?bOoVPw>_$md
zC6soR!Z9l*>UsCxp1tpKc%5ueoF7iyPzIm#l*I-7v7q?;p|U^IoUKZ727iB9s8`Jf
z8%oqprRZQw3h+1c1-5Bn5L9^b2DH40inzZtl<_GWU~FxY!V2K4jl9qdU|R<cJyx8?
z8S58mHq&5Xwt5=82C_e#Xc5JzRyXxfxyue#p4iehtsx7YBZZt=hlg6pYoAfjW7Z~9
zlh+PcFR7HkDvOf5k9mEdLppyR^VZHNPMGI*(-QVXiQMe|@qhjAHF!VbxGoL2Uc0Y8
z!nN-zBUvdInZLFfGtof_R3LuSJjAW$fWhKN&TvKfRdFssSo2@O<;7^wa2WAqa!Ug%
z0x8zGQawU>{pfy$UzV|dO<7)ek_)jm`(A1_F0r*8$yZ9dTf3|DpTvKMxqDo_)><oG
z=|+p%wbu6t`%M8U-xu6?anCyCFMMEwSX9=oH2dpz)K$<b-og78`~pWld@$ggtq)Q6
z>$~OUl^XXbNHGalDEgOfPw;oe?hLC_cP)CL-tc#|cbp7U-JPC9e|Rt|d=E#_eO?)W
zq!#f$J<#iGs!q#4*=c_vOc>qhxm;nKRbBaR1g*K;ZT|bPMcxC1&>N)h`oVC2U2+o#
zicof}Tos)<c6wj*+k~oSm6dK)VoiaJanAorGu{wOi)ZatBmaMjN2BnLamLSrIH7>8
zcsTbpKK=mHyZCBj4D7uSJ5k@hLIO0G^n~eTj%9Nm^`Uic1Nnb3S4p3<BPuP3N-6+u
zuK8{vKTN{gjykNBIv8$~mF7*+1_F%#P7Z#PD9#q35@k2cEg}*darxcRjX89~-_!IX
z<$&0cpEZ)74^w`zg5%Fpp}#U)JR;z+AJ~cDHJ8rB9J_1_!T}UEizmWnd{{l2;;;_E
zSaexfhk^r~C2@aYY%V;y!@PMXjB94CHWyy|hIW=C?Pp_W;nBme+5g;XPvM1cXismF
zk-e+b;M`a0)@o<zm2YEj&(k6v&U#bywWn{hnp&y;G_RV9awWq3fGX7|Ft7}8wxc?m
z(`8z#X=$m~y+I|*`{6&-gYgv=+i0Q3h0PzL3tiUl;v|1IT?z?v%7m}H5MNXSOeL3=
zDoh0ureq=jTgbsQ0C%7#XSz@d#QHM`M}{84@Xvo2pXVp75Qtv0XA6Pgc`@uErShs!
z2iCE}n@!@4v=`$!z7*Er<Xej}97J+PH!|V3V79n@7of9H3gohORKL#D*yO&Ty%)@h
zE#ovFLivBfC)4q*n67f+r*?%-@{!O*T=4U?SYI9PEV61BBq4#1tU(&%yS$>b!Q)+Z
zufK)oKG$%FB%3Ci@~KJfIaiB(9Aq9@R`472B<iyczvsr|82q-t!Qe=1tT=l1`)LOL
z-hoJRe|da)Ca44{Cyw8ozm>k4BC|?(l5%vTsc?U=JP?T)VEn)SXY|*@!^7|n|Gy9a
z|6d|o14jWSZ}lpBd4HOX*etxuqW))A<oy0#K(?w5=Ht*QZER#zE^tN~(=_DE1~+yz
z=Jxd(qk@x;J1&;yo|Ir(ycK~__@^89r-g7$l1mcB&Rh{usOOV*d7<``k1CleuE9%5
zXp(=5jOFPx>q9{|j&H-k%Pa3_Pc-*Axw-7!{&IbNd3)M@dwlc$x~5E`m`Z-k{OPVl
zucr9O;lRT=OSYuhS}6g1x9~?;7we^6#tjw)=1#7<$JgCci9VR@2A~xoS1H^A;dMHk
zjz%+oj8Wx-#lse04HOMt9B(#LZurZ?qE>(I+Fub8tqpswK3RHY_1HqG3~os*J3_Zo
zj8gsVQY)!h$``Th30_ySqkJTMp{Lbj0gdYd%<?xbqh-4Kq?OI|cRNk<B0FBEbN*(w
z8<fK^rrdJ*>`wO3|JO9m>h~P)k<jds5=l?_O`pLh7|c8bY*_vj;Mw~WaL#Y`7)*b|
zfqe4N%Z*r+FG_mq4G7=Ljz>8k=46!S67Y3{J0k-0f?daVKn=yBv2(-q1eHC<pY)!K
zN3rK?*luU!8~+}VEJ<VLC9W-I;vd@gtB`j}`!UwiR@wk-mzA=w4;#rvD+ZfUu+dD%
zKzWK-IBdnKywcp-t(+=z3w57Zyj*{Qr$bO>5i3p&BUib+h)mJBzyvbLX@(B;i5NY1
zRC8~0P9P`!f)v0!Cf(XjQk#I{`vG4>Ms@k=T}UH}R2i<=-178gjD`trX#$1TR-3qM
z`n!IkQ+(AcYmB*1Y*Wa;ru;jLnKX&0M;u5z*(1f60IEDrnnBWOIgEV5QRsgms(OXx
zG2eB&3G%p-%ISG9iRrHy{$;)Rz*up67p;T6Jh+ODDrl$;zQgbaw+p!2`D^TSCWnv|
z(u__Z@UhdU)Lb3;wg~8`<eL<eh{J6+hj_^`G=WIFku#R?J>}%9LvK5#Fo4Q;9^;jc
z2y0;j$216{z7t?)$AIp1#z22x1Si0(#*KM%07D$ApDfMu&JZkJ6!r+JiM<ED5&wqR
z$I(8dmQP311~8mCCwN;L8q5Z9-#M_x-}%E|L(m`~3KCxEAHp7g(P8#W3PA*3NM{73
zNxPuRh>?pN7(izzvRBwb1sYi7;Xt%nh<y;yza}OgRIy0@04|hO4A6f8=d>^`bm?ex
zK$^d$cfmCqPezzAOd45)Nr-<#RG^^1c??)$v?r%P4kE&bf4R%TBfewwkN!-+o#q{i
zB<*>+@6dRiLE6V&9eA^oPbW}~#U>B|E(+*umX2}}$vWb2hlVoThr77oGU|kjqv_CG
zEtu%}G4$lHf%wcg>5qS=1NKu80DSyqI^v%)iba54G)V7QC%eD9{WCTE6#lsbGfeo1
z{d7Fx;Lbm5@AVJRx*r}x|EqUz_*i_5+JRpEC`WqrW8F|c{Mj+o-H4;%?JG434uXy0
z-mm)&-Al`Nb+0V4`Gx*?_SvyJ-@m3$I{EOAU+dp@ZOV^7%o%@Sz#ij1dnFeEC};if
zr}@h}#a`!)!^*YQjO$o-)5!ktL?hHefe$FjeQzEmzt5ss8J6;Qys@EcY1#9-R#w;0
z*?%|k+D~YMR4{@V;0Q6@LFS(`O-&Vzon>=KtU+-!2L{49NO>>5tbh}oheo2Q8S`SK
z6W{L`?+db-hS7gyGMXv39fOq*#TAPa$4kBy4U8QPC0Pm!;cvCM3|>rFVqOE`*?9qk
zPGy~qa1V;gdI-O~rE}Fb_UiV?;$FG#iFd|){PH-|hJ(SMYe-D8xb0hBjVOotyqgh(
z{C7;d<kfNSx_fnd)jgJGvxAzSKV6+&cU`~Vo?Lvmyy}1UdR^yGw_F0Rv4XDNn}<CK
z&|0<iQEA5V3J@zz8F|i?VL5oqk!_svn>OCcKyb-oFc|ZW05MVu97?%JgwBNDg?o81
zh?9Me$7&3kI*7-ZWi3lVO6I@qU7cO-%MnS?yJral)to6VHO}=afVt9Xv0ox&pTMRn
z3<>r~@Wp=)$O&AKqu|Cio;QFFB4XH&l7O$6%iseJ+Q1SxS%wFo=Wx>#*;e`K(H4w2
zm3;lD&Y!;ff5UuCZi#o`=r9=YvkYE+_g&}v@Az-*ne~abb77uSQGP@ZI<<s1VLZDi
zlg6`)<%lD=QX+MCXfYQjk7pMRD)IhZ`F&`?A>x0ue|Hd~di{_6;(4n`E3D0J%^+Kb
z+TOa76veYg>h|YCr8@+^I%m8c!QMuKUBNG)BthRk+8tS3oGb#eRgDL_)x*St`8>rw
z8`c9qJAt05o#n4W(|pYe8#ftVnebghcw8EILB9B<LRe+i9{#ZI<eK{AFXLx6%FB>P
zt$u%yC*clXX#hEuQmAg4wqU0RL)*;6Xc?`eZ1IxNHSvZn+`{HO_#;>G<Z{ZxB1PAW
zjiy<o372J7Akg2j9Q7J#w@SdlRSNL=LpmJ|a4HV?sGT3D85F}z`B_5jN`7eQ7yydi
zz~U}h_MZP}Y6^70P1EYixkV_s1*j565EFk?fHszf7iWabBO<kIQor|Y7y<eiRXKst
z>_kZHy96&V=GrlXZ;Kh=(O0>F(d-F*3-SYFqHmiaypi<diToT_!Urm2Z8+cVx_JRz
zR=1cL-~v6l0iXAZ<&!kY*(oP30v$`Op4S3x0R=i0MnfcCe2rib&BS;f398G}`^A5$
z)YU}d;Co*@e9?g^J|&Xg5L7g#Qm1X$K7sCy65|fS?|_wbFWw%6omXosiq8K=+#=Al
zN&h=mNT8E^u+*#$i9?;(9*PUSJcXl`hN1xU&LYg&IPQ1d>s#JaGEP9@(yyl%CpRCu
z=MorXdfNOT0OSE^dSu>lGi;nbVjh1riPG}f1DT;~DHW|ES7sw1hdW|hPi@6(SL<-Z
z{7<5|Mi}=1cfdQx8zy;ML-@8ks>@7&)({>hKhWWGC3=Na(xWyZL2YC>e!4G~8|Roe
z<crI_KR92zYBFh9__Fi?fs?fR#=uANq&QMDs<T50(a0?ZhJk|-W~6|l>6Cv%?U-fY
zevQm}qJ!8ovI5l&e;9^0ISyK~89)ktI02Iq$u^S=Dar;+CVHgxC49f^=~1M}+E5NN
z$E?}nO+6ABBv1a|>M_c)Xy!{aM5fp(+1TDZ4{kysG8;C~2=5dRCnE29vf@+^8$@Nb
zEDx~kv4jhS$Pj=3bE(0jb_0`ck_LaB)kIPoi)fjuw3@0%EUYQy`s)#CRoZ=*=dtd%
zWVrSuLh*MIx%fTyLB<1@8i)l-`L*n+^yTln=kKn6x&3&2b$0ybeRmTUI}ykct~Amc
z*pW?0QCT8joUVwPC6#|GNyv0lj*?mBZn!6f<%5tF{loo0@+pM`OA6=rB9VWwdG$nR
z-V&p&UV!!J)oXB7{;&Hu0uZb{#2LG~_=Xn=mkvO0AU;xF_jA4vM<_$^@gVO5+V{ZC
zj@BZ{2tI&0RG?wW5_%=V^5L`NDr{iYk%RE*A?`mYZ<Crl7#HW)XXiH(f&*aLp^n>!
z#SWDFuOy|`I?mIA{S@9LqxgSw8J12{@TF2@TyM4YgR##Cl>yE!YF}5)*2~rNK22+1
zuY1|}Lby1dUtEjCT4=SlDETQ0hjK{OU<`NY$>fTY5xAhAu&g+FBN?65=wGM^UkdvW
zwt)GGw1<T&M6)zySxHJG-@?eIV@kQ1xTNw;0TJ{T5M=et%jINpQg(kVs9^?bdGm+j
z1d{ad(jQ@MVWABkqeyu$pN3UTSs!f;GF}^XtLoqZ;Jd&iQ-jb5Bn6_(qW*)Z?Gwa6
z3np25&rj$u{J^J;JM<HOPqYi4H}Fo#Vp$POP6J`7n5#Su@)SIGjnQ@SQ@Hl3S9ous
z5%ou*j1Bmga{8BR4AOsX-Uy_&R=;a32iM!{y+68s-wS^CyWe3gBt@HZml4cfQyIhX
zmZT6%JPC&}{ni=~$=s&-+3NU`fDhPje5Juj8jI>+0s?v5*aP4m1q)zL&I)vH(#R7c
z@&t{@Bi~p6cTVa1PK|4p+146&46TO;(=le+fUa<-D%?I*p$C6}=0*Pdl0wV{lu|PW
z2Uh-~YSHcaxz<byj?;Tx{I?EDH+bLwnsw8Qu%)$_wm|!vmn}3XuN?6k_7Q;9k=9CM
zg0^g$1W_JlX<DE;>i--a9v;?o0#kDoCSVUAwNNB;{OBhAY-VVZttM|?!qh9AO|l{5
zVr-vza1%XM8AX5fhzeWHCPch7c*8rWIVeYKzjdvdXC$XKW|r~;)Qris=?_u9dwz2D
zkIU<`i}Qdbk8zeJ7((|LWic!Wugw(7%)tqvj;@7=oO=&3B!^<Eha5ylWGx9agqHgr
zhG#=Gzwjj;Sb{~I2Zr)Ouj=;f?d?_fKW@4`osZCYC#rw>_VwO~sxqDHLbQZTcX2!|
z9t>@Qc=pCW>>s{9{LXOD=Su@{@W4VbTlt2QM!eb79_WUh-e8q{fff0@Q=}x(S)5LD
zJkjv@@{AxhKvf@V5Tz%=Vc1S7fkJ#bVx7B)1MGg#prp7~%Tr4e^@nNcxCVW<J^<D0
zXdDVtU_XDI2myF69tKe|+dl|1Q}a&*r%--b>coUYmKigI_$Re~xC`(QXAr!Sh($)o
z-T60vX2~Ja5p9M=mMIjmEQX9wIPn|CFNs-zugojZ0hPIuGz3(DL?)3)Sq^Sz9P86N
zsOb)vZ*AWjHcJ!mQKmRGJs&L*zbl{K<?vOBs(OE%tIWc%b+E;Oxy5`HeZCjCP}26&
zU{D(jbl9T00D{aYzRRL)MwvL&A)|VG02nz2*EKFp&~^Z*4EcsWU_@R20VyC1&4*;q
z(U_{%^K%T?bDRsJ_gU?$u54g4^>?g*(~&96wCddYq0V^jWDh0S^kNMQU-xU2Wv=`F
zGRl84K<KA58yNgSH+i#&iFjop4x#6(W)GuZOg>???O4SIRm_r_?^lmo*p&i+&D@3v
zB|eI`o!C}|rLRgm-NTEtLN<DAtydG*ab$bI-5~Lf2ddF*mTrwkT0O$#;=|@9*wkOK
z);o?!0D`j#rZ1SVFu_J4<|L;SaHs=%Nb`S!1dIr@HY|(#!P({G55TthzdwT2H^WOl
zRmM%noHcVo4TU;T>VTII!(YTOIi8Xjhz}5m*ZB`(33ThmI}sU>iP1%vg(*>oEZt`~
z<Vh$FOu)cCKYst}AY_O4hvLiS$NcnX{tGpEigLkxfODX-c*&n(D*O%F+@)w`C3b&_
zV+ZwDDSTmJ+$|Yr%|>rL7He40IBQN>=9x5d#W-7T-f_;YG|n1krLUR&)tP83zbwiW
zjZO5>;a8@$xFg*kt+d4Hc$_A;#2auRep^d#`K0_@R*yZxb#0!m8&g!K*$mkZWxmj4
z<>)h;QTdJL%#vdN>hf;rk98^B1*CuD3&bYy-YKPk^2o-f%^$g{VgD=cI3$?uBfF$g
z_*A1|M@HxA4frO^(pAVut2Fv4fDkbn2}I6SqRDB3_iT~52;$aCkuu_iXvn;g8|bgX
zXLx9h!a(Q|dOWxwOkg1^yu5l0oaQbu_9kDq5ZjL37@O$eH>&5Fl^S{;OH6+Y=5ZPQ
z&H`)(j^y~Bf1(AB*wPv%QT+(7ckq32b?^jGe5C@Vx6%Dt>ayyw-4JVijnjExrQqC?
z#*7D<0vgU3W(E-GD?=vjKLyM}8lZ@DgHrJra1hH;TM2Hy>H)4N=>$@)LFasy7i=tl
zrO?@|{}30PX>uy;2~nJ_7$Sdy9f(l-n;XjbYoJs9`{AFy`ybXt0C*T?Gm>iP6i{n0
z#Vouv{W)00iBr<4U1b|t#|}%Vi&aR|Li8;=jPi*m(`=IFIt7{4hPRQ3ZoRjnwRV&#
zl)tsc5G~dS*j9ZX?ml^xSU#&}Tj@^3n?xq5cnr=P?0FJrsFH{FZ&!cTJ27Ou#+YNT
zAdk!LhYm|%af9%rcU3oxgega)2ly};J5eWa+R){2Zxjj`El`Exy}f*Y&fo}mt%t_9
z>IZgRo<+6w<56*L-OOswU!)Xx3V(yzF^5=vx^_;FtG2qeH`VvHk;O5XLCy4w;UFr$
z>WueRU1Ge%<n<I@)X;w^F$QUGGdikLi&D%VD1spp8*{QDG@xmA0OrO@dt4)F9tg>g
zOARQN!Oaf&YUc?=yglhEM5a6PDcY|mO=8tDDXMi>!}Ze*PT2SW^#|mlWcH)Ai%kBC
zM$G*H*uH|%dZlDh9+$5T@(H#WSDKbHTziswOv0BEG~88nPC$Pu3BY$a8Z;)fE>X1k
zB@;wvgN$h}cB~0)ULC>T>n<*y;+%ySSJD8i<C>7`M@f;FQ~MjffhSkp)61Ky%Zpz3
zw%5J-*uA<vzPbLz<V74^;{i!&*YA7c5}O|wdB_{aJ9&TBJ->F1N6tiE<6WHcMV`Go
zKRbWdFd*b{j7NWPTo6X(9<ux4`0V}d<<-S?_XPZs8ir+KPENuxr#GAh_$>AM>_Zn~
zwLV;y)+&hu2rK+>#uIe@OOZX~C=?&1nS1<;lip?BR$L^QfX1ZMJ&G&4%+ez5r=uX0
z-yzp>*d`ym#X|jHS@O;G0`X1n_+9t*^z7Z)_3?Y$n&W@#n=2V0_Y)_v_i@3wIDB*j
zSBiPZNQ0eUoZnt`FK<rIjt$uO2}-<lGB%kGV#*UBsve<MEiN!#(lzw2-G6{L+}Y(X
z-76!R$WI{<U@mLL6HctWMmjydKCT}MHSDd%f>j;AyXtl;ON#C@#=OTk>0Vvq5m;mN
zsWOkgIyryGI=Omp4`UMHj6FiyC7I#Gdr-Mow-@K{|Di@U_le67qnUf-yLICXSo?9%
zG5hx9*cb$P5;?t}99w!)@9{WotsfAHt~sKU>d?T)ik<$1s!GJ`ycPB6-&JZ!2r;&~
zVvm((IE?vE6yhz4^8_*tmmt>^$y^e+Rizu!W!QfL8W5IA#>6e0Zkc;t_v>gRZ_?IP
zbU*x0PGt`d4}~vO2%;+paTmXmQ!U7<<U>|Kx8T2kvcU?1vthkZWGGpXCxL`pPM1VG
z0(3JMdy7{Guqx|a56}geJjVsCHH-m`LQLtNFrV<3?gk`$L9jFs``{*tpT$Sgja~9D
zQXqeUd7kl29^{@npCZaI!sArLsta{bx!JAhfj7X7fIX=sQ7cM6QC>^SBoyw*lWK3M
z?x(xc6ZMC`sjA^`>D_HSutA!Cc@@s7P~h_UT+~a5X;6LiR_^r6ht3!Q84b}a-oY%j
zkz&KtKiq77ZALn``J??Uy$jDy>pp}I*s*^WaVkx5Z?rnkF;wS;ljs;RM{>|5v*?_<
z$Fab(t?@Gk(#i>Qoa;in##rmql?Z9y+$z*rAS5lT3n8*k;HPif@PWS}xLLlxfd40`
zE&<5q@W`+2qIwvCpgjV#1cD>Ur5|B!m^(%mP;eC)sERBIRQ3=b_@zr09fY!#^1gqe
zc49AQB0lEr#np%7>)Yq&XMMrgH_HebuvrmVto9%hW<42?H9#{M6q|}kFfqSKx_Vi_
zC4Jo<ga>)h4xWVJjf*^ENU*AuO26Tji+m$y7)~j9h@nmMW4TZ<@$G;pJpJu1K`!-X
zVZmQW!4I7xhw2$Da3?*wZT{fQCVqb|72}-_sg1Z5AJ@u1ww9E?v<`PkD%8JIXaAz1
z(m4~q%X1Fu+<FeVTi!{o7tcoDgKE~0y0kLFS~8fGi?yqr>AYHZm}kEM+>waLz>`WD
zH$|{0rVd>Irb)~%DWzc&VR+Ata2W!z3auijDBrFEyh`cP=8|Nn!Rd&^8cKiPz~4(J
zEFrBV`jS&5$Uqi&X+cH!cm^HePYY2J3~!l3PD(N=^i&cmJ?JV=av?jSvm-h!iH-up
z`u*4uo27|OI|75=N+*zcV<d=-(c&gF*e%@q9FIo(u(=OL`Hn_^B6Ete&o_;rD35%k
zOm+CMdWu2gI%=GgTbF%ZY@2`dLwq>GqP5$?dDM%nySBN-hL%^*a2W6{<pHQo1s_W7
z9tY?(R5j%j%s-uOQh*}~(84;GhV0(^^-$DkTPqP%z*I^?a{UXG<hwmP|9JfV>~z7x
zBsBObE292`31rmb1hQ*}9=0sJ=#jP*17?NKWUegZaWY_>=75cAH1mH$cv`?Wi144H
zxG+xwp50|(cqimP65WBtv*&njY}_C1NxrhZUJ~m>$4Bbufk`*lZ@+(io$`PFOgm;Y
zxQTU|JhH3^dFRgeui^0EuRnVf4KZff6AEX;L9ukC(_;AjYjvXHi6r$r>&utK=;P=a
z%JHuJjNOXgYfgii^w58;6R0x>h3`=kgvJ5r(;S6Rqi0pIGNIxi8!hg$$;&lCAIP)<
z0QbIsjWzGlNm1lNxJhDI#=haX90drb;ohH{d(%fG(~<a!4kboFPoERpr`(NUf4)vn
zIFRS8P&lTWT4C9rVf`a^AN6N=;f(rNP>L0PIHzZ=!8&oBZNPsh)eCS?ZrQEgy&cBY
zW1Mub6x-wy(p0Z)LRlXGM~ZHOH#W2fZbD^maK>5o{27Kn!0!MW0UB~UY>I{8TrbE%
z7G?>-iOF7Cup>VfQcdb#pU&T}254>Jw{?`;C@;{jGMs^$-)Ma}k1~&o6o^}YrAKFd
z0^$6`cg`$z@DhLZ<E#QTX4NL6OpR4PVv?ng;3pno0XguXsvQ<xe3S>0F|heV<Iu{K
zYZx)+&;|h9<9?q_3JsuyQ{`4CZJ-x~+Y@DQ69ox0=*!$dLD>ACPRk3p#!!z!X;%Db
zN)1gYf6E@Iu!aNSJ#;tXqpwB&96E0F@9_g=5}A@(y$*l(#Yz|QAz|i0C=UVk_4VN|
z5a|F8)oVriQo6r}&{Q8t9t?EIqX1*G$qmDz04rth;e0N~Fp}gRPFlxr0gIkr*$e@z
zGXG*(|0PEw-4#VB3VsF;YcUUc*9ADSG7#_&sB;u^2A7#}ffNnZ5M?GlxJ?PCuQeSs
zR&G*B56OQtVI@;hF@Sw(5$Tr?>(CdivXfB?rI@To_tgw~0R|C)qjjK5mrb*AM8bbF
zk)zRU^1C#vWgpcciM*Caq}FPwo_Q!t-&>YGA*GjMH}pWr3xAVi>~IabVi?_vuZWam
zzI6gz+^XkfQ(srSW<w4RjJ?9G$Q4AFDnzx1X%T-_7>w+bYcZEEu!C*f5OD*R<PgFn
zYL=Q=?I@*8hJ`r?lpMYfXfS9&HRJ|VKHaU<fqukkXEMG(=g<>|e+<{b4T%~=N(c-{
zr-jH7A#SaGG^+cFlQ1VtV<9><7y_pLw7s_P%V#1Oe}uiKKgT)ii$+@TdPoWU;wC3>
z1e1TX5CV`oh&l}u{{SCCQm0$uU+hqCiR0wwKaNLy=@j5m7t}6%Gd$gbL<kYSB-~D9
ziu?6?`ViExfk~|~F-i-Awg$n;>^&ZIxy1wFCNmUj#VY2M`d%DCXf3TVB+vS5NLT8q
z2sJlk?T)7AWL~acZkTwRF=oSrY;nQ_bo76O3A~$>Cs>#iz7(N5Hn$%tzw!@R)UiQs
z#yeKLjX15E=>t$r&J%biGE*se0AB-ItdC`m<9lVoRub$>NUq`p){1Dy)@FJm65m9+
zSXu}9UT9LCRnjSZ6J!>3J2g*M8vf>2O0P`3S9W*!c8^uu`n3hM#kpGaQ8aiVXQY2h
zjA_}F+>vAo<`pwhu{g`8T&J$aD<^_=$wJAp$GE?S3|4aL`N#i@THx8Gl}B4<fWsW{
z@gocE`%m2^RUoYo8JE;D3y<I4-kkR?yC-$>D(#Isad~Xi-7_+CuNSB*&?R=Q4R~Mj
z#aiGE4c@%ROhV3krTti6L)&s8n0SB3gYf2Iz>oh)%3>##CT}kZL!3iHv&>LGH^-$Q
zGv!GaU_LU)C08o!d@cHG?^8zoDD6!hZE#Qpve-9<l;kZ`)p^rc>+qJqBbRU>T|GR(
z@GL)03}F@@-Qf4YjQUd|0Z=lN0UmQ{h^2_d>Aozf2SE(Jf5WO$mFrDyw99|S=M4c}
zsGDKJ05*6Kq45NRoS#z7(fm#wCs^RzUsXMV-7mdf545~;g~DZgoz0>TuFNH-fI6&h
zjLpCsgHx)7GRjfY0>s|Sj58*fsm7KB2h-Q^|4%2F!m<^;QFHF7jwck*Zo`(Xh~P-u
zM%k+28wpl+Bnj`*X`(VJXor6j$q^j|mQ10Rma>3l5XOID@VJX{6KY7!1TP5lRp(Y|
zqMD&rpOA#kZW(7|b!ut)c{(uw3ZI<-Mcoi+<i)pgB{GycUeYv;xr8Wf#frnj%L~*a
zv7OaCJzlDU(1_)27{ohRyJ4u+`!LCMd&6L_d@=8NUd(%|xR_fC``&*7H}kEaVhfY5
zrL_87Y8~^QH&<uk@N|RQ!%Xz$Txpubkb6kiu8q+-hjXHg93|r-Z?I}Za@sV3ka$1!
z;xvoPzSd?Fo@(h!_G*TZAv?wpvWZHl3paI1ns^6AnfTuvX-jHJE})b%#6i00YTh^!
zCM3j_YZK7^t)YH<tB`-2a5#$Y>p+r!x}!SB)mbySqmA>Uc5?@!-F6IweVUTB$+L0S
z8fh4SM0X!mF;-bz63J^6w5nJEfsCWbfbO+E#sNo0c(`ikbv{cpVUR5Y!wm*H+)w$>
zz~mI6j=?3^7*O_1VV@F7I|YcB5^@}d;Xl%;bSCD|L8-;G`+R>AOh!?k2FoH9H6nCf
zvR{tQMGPV$W_&nVF-W>C2DC+f!7e2#Hmp$S;f6@GL8Apr7U>ItN6YcnM!kn$9{C;~
zKnB|#5#JH<mPCB$7zENi4m)`<8?i8}A?ac`4t!3TQxY(pTsq2;Ua`R!$|Q8kCrzDX
z=`6tl6!9Y(9H@U>&7x|CJO(3)lOO8|%B&|`g7pMt))Tg4JwYAo2^VHPH)p3M)^h`i
zJN#J>;7{i+g6K1Nm9OL+$R?bUh!VYedlLTe>h){4n!#8?O)2mu!mM2i2n7%7V=DP0
z{IyjD#aBdO++^|slfx^w0J6;2r6;~~eTf`NL|ta#cME?8f4Yp4;=Hyd*BwH)WrJJ;
zaTEFIUcIL1Y$3+YV57v2PjgkE5Me4H@Hdn!2Vur(8yEU01k3a&AEEDTY5)TjLJ&;>
z4IuK;aiRzb_~YClxmdhJ;W>XAuwg7R+-W?oq|~S5L9&&L<h>C@IYUz4AAS^pyWr5z
zkJFEUq1}IkDAx&D54;R57}Lx|pdr;pib6@;`3G}JIA<#SQ*5!z{(?h$gnYk5Ja;K(
zal=Ly4939Nd)Vm5C?3I7E3melaM;OC()4pIg1w9ek8m&ES45h^3&hU%@_m;M(wO9H
zIBt(EejBsVAUC#{8a%fcS0k&14)IN|Ev8Ang)M(p!HTT{6_c>E2=}hmgav+u`$>Kq
zMs%sz+)8^Z7myrc%(##t>L2P+oQ$C|Z_CK)SCwibju&39C&b#zBP3@<?Jm^?J;74F
zTts{Z-Hf*Y=NGe(i$VQ|CdU!%F-W}~NUW&CMIsJGZjpIHiW}!;Jm5S%*mALg($l*%
z3cr6bXERkir_v-<eWIb11Y={NhkjZl;hrf@W(`-ob`g-48+L8I-A2>*0*>ocYgtca
zc(LnH<S3cdCyNv3>xid>>L&cdbpPfG&x>XsfmO<P4Te;U?IP2A$C#^qkf@n!sXkux
zAp9;Ivj}UfB!5sTYQEes(sPw_$6)wgq;h{Ut6}R_qhIVOiv3nO&Z=L`gz;U9lR4Rc
zxCkad5i74c<S;`ZuvWZCRkS$*fSHVCTXKgrFn_O{EywV2fc2Z=`?{1A)GH77sx;!S
zGONSBAJ~?&o&3Hj35u_aASA7d<h~FlIptA*2&!G&-saQ#e8rh~jw$)jx)g|W;RAo!
z7O-kb>4Hjr4hvST939o1Jt`xJJxY%i4Wrn<n4>5=$DuD?$x)6o_7O^izD+YIe5w$v
z;dkE%*rx{u3aKi)$QYF*otGL;|0f;0@8d@%3ywNiMB~zz%gR+L?7AJvxa#<WUZW%P
zBPg(6&V3xgU=_Mdy&LaX(N(2nE1-XD{n{p!yIh`Dmcey$4k}k0&RfS~P`Q1;w{n>2
zRyW;RV{6E`&ZaWTq~?b<@KC@Dr3HEF58zELr_z&h?5SDSj%ZaCi?a4KaR)q$>UDe#
zc?TZZh};YiT-w2(8PQv5_JzGjx;12M0xlOxA#Is%Kr}K-ROVk8$TsRHup)m*^GdAz
zr5M$((*m4b#Du1x)gs#WlmU$V_ya+wd~yQin<(eqIs@#lVAJWPBF7hXC9q(G03CR!
zcpt{4=RdM!4apXrx$b)^YddDguGdo1`u(6oB+hS4z#k{R3&L_iU~{ik5DvVRS`0iL
zh9R9RnVt8l%FlQxm1$g--(P<#bQ7oyB-Pt!jYI-#xDtx}5Q{K;HtuHRv+?5(e-<tu
zp!Q%{Fb0+sCoy0moVF+ejldzag(4<#96iV5=~!VfR(`g=nvZ;u1hjv313`thC{A+g
zRXg{PT)C>c$PZe)y+`r7L1ka}sQ_Fq7b;)_{xsnOvq?ViJ-K5{?%98!;=p3=YczU_
zX3Ap_Qo1wrUy=TT0xg8c3+32JrlUZXP(bCf^fEjM8QcqF<-jN$Zulqh*D`iL9dVMO
zHu40ICl7=-A*ICBb=~Z#!Q(>u*r-L0pzH=*Nh9*1=Qjh&>IVmSfXiji(Rjki&G+96
zza098-Y>_U*MIsEHtT<Z-;U${1I+OKYvsHX(4o!UynH$VLkQn)enpZ80q078PBZEF
z=&1)lZ)ipN<&!VvC;gE><(K2vQ2r*uFMf^_{1q?x{3E|)^8cZP@ta`-xPg9rDNg3D
zhj0HPh9L!@jpiWgvED0XVp7(X$KfOka15fud|&8~Kmjrm_AGxL<(4Wf&EoqQ{F}uT
zd!_fozt(K;ekcm}YAVtAo^fvboK{aBqB~Z|`WT)>1=z8mD8!jPGf<6y)FLwnt{%DV
zLNY)fr`b6W{*3z&B2nJs`<SHrp7kB!Gtg=5Bh6?(w^5DY=c20`#|KD2L>e4&_$N+?
zzt*dN{S)coAnJdN#gkH`=(X>aJ>6Fi18$v#pwVUT^_8DLel`}PefB%@(KHunF7Z!y
zrda4jlAq!>(v8O7n+`|$`n~D!GqJLjvBjULw37cmgSY{y61BgQH(AsZ?r5W^l_htR
z6Qa(mcKJjg+i}GbU261CwOnJGccP6w*B56vXzz|N|3H7Z*l^5SALBx#sWTe9WsWg8
zpJl8Mac+@#S@0<*o*C91W9l8QVfKDFXcXv>QSc2FMdg;4x#6O(YgdD8iZ&UT6GC9f
z^Ghl#s!Q+_V&Oo^OHad=jBst4%saKJa`9ULx<`SRp&P_}Gqu=D+<{<yy@jS~V@rVJ
zTNJqEC(VDY-XfOt+Vtp<ZH6z$ft@crmp%}I@KX-M7IRWXJj)XWTO9KR2(VbzucVKn
z1E{N)Bb0C=^BNzgKg}{ez-Sh71e3?%kA2hP!8Dp#P2M;t)(}SgRepE=H{C`&^;OoC
zJDmFYxMmYqL(uDv2S5m-7py8`Alsa#un-U+`jLOBa;p2S<Y^UDJgrPHvmC8VU^A;K
zVL3Kyly^;|ylWVRly$t7Ju<><rNdLsWtD~E-LAAoY_r_J1gS8}tG+$!zCXP^zPbM8
z;_B>w9$%kboJ)+w^Y=!`H^Nn0q2n9nyX}dL(%JjS^!&zr2h5WlDlac%`W<4{yI0LE
z_=$gJAJhHb4+c29g3?ejiHZV+QoCnK1@ieoMJLc`ot7qsx+k-P@QxKvj3x731vRTe
zOUT@49xFztcIi84`dREq=Y$gFh+G|6P+uYswx7c6i&;Q>c(`iK`ZQ;GHE#$>GI>X(
z^ubMf;IckeDIbJrhP`6}T4iN%XSnO}dm4Y}<r@RmF`tbNyp_d_g+N4#ds+(ZFvKwM
zOZ^=~`VE(m>0J(QCxsj(5BFfVXo!42NHb~hRExk4w19jceoeCh8Rj9y6y@Bcdjz5j
zXBsRTANr%N4)#`$eu$dPWS}={q||1~mA65*uO;?-X&lr0xo{a|zM-d_cb24N-Q<5s
zhIMud@UuL^i?mFiL;788GNlENqt?sV6MB+jQ$-;PcWpsKQ}7byAf&BzbHyM|OGn!V
zz+l5H@PY<U;L@NYfvFkXywq%RemlX@8nP12Kf&sLu3MjGLag7}bycvZI=!wDFWT}7
zZG?`F!NRzZ0?Q|6xw6z9zxes2{t$mwEofyzyF(sd_IXQT&p2|t3|GUT&hoB|?KCf}
zMsr>05(qj2Ms8kAIXy(-_4^(Nd|WO#PX*{{#w9AgvvK~=LZj40UoDLa_~?xWmgq_E
z3RzR$SNt%bl;E?H+*7S=2lYSGM*JjFBFcSU9_Vc)CaOt#*T>g4z1#DP^R9ob(4-_+
zNm@R06{8ebNF)6LDYFE{!@_U}VKJM;eM})%o%ZD7{QB(tMo#Sw(r*U}oZk+-LAg}f
zy_!_s-^7d)?;!Q(x1}v5`!Z=+nD=RtiqCxV72(nG!xFQ^z4NI3B@HKT8Cvh~$-%$3
z3<hMr4%+7V>3LvxIeWTi#Rh-;cl=$p_+iNuyb5f7QI$G9slnU-I6bdn?f}A6;3uEu
z1snUrk6eKl2yNy@*cwpgB>8M}Iix%%^+`+pZ;2bY9x5QPw}6g*d4~H5@)(k*DIA6H
zIn@AcK$E`_29aSMCj;VvH1b<Tcyyj=^x6-eB63WXx-?8X!N;pLyw=!VO*vG5U_jYw
zPnu<A6V=;;bhgggs?&H>?XD*VDbiLY+r(PGS#gcc)!HNrk83d3O-p`dY;rt`A2l&i
zEv;{h@MZ^J)drr@?ZHc2{>;aTU>HR{j22U9R!iMUBR`in-xmPPy665i&y~N+IGrYi
zOaj6|a~#Eq(jpqF>kdV_)S7jFFrqg~a!&9%Oy%mIm-;dt4z+ejR7>B1fH2~SNU(M4
z3BWip;(MhG6Evj=%@RC?e!$?V0E4Gq|Nq~=3OnH|Z{l=GNrn}0if3==lnJ+oBH#+6
zz91V3aaYbmhQdRvSrci*Q0o=!fDI}QTYD?F)c0(!_?=q&aN^T)=PIm!ap?C4S6WC7
zCvDwcXNzmtoowY~RSs(ZqZM4hI9}1Rz!7VnqEeot6E7FoqI=flCjff_j77>O{fBAt
z*%J)Jd^=G1`O4n=)i{2Y6~`xVG-b81XslHlYrFfPUV#kiX#pPu2;iAW0|HD8<7YPL
z$k1C)poTnmT1f7Zh}BYmK(?e}Gtsxd8kt#I<dQs$tJ;C>&q@)?+MMn*w~lw}@AaLl
z9Ei&Oe6iDY7zt=uy955&(6oD>@bu2swaNxhb!$Go>li9mA4g(2!y5Feb=7?6Z(N;H
zt>M#lsMnU!!;0|61&a7!zB}-`kjGauicr4J8wNqLIY3@+v!8B%k977M(C~c}ZhVXT
z8hxa4VG3!)vo~c#7?3r`WXcWX(flIiM;FE03K!I~Ng2hucBJuVu@fpQy5Bi#)|Y$I
z!x0Ev!135~(Jm&~qLFzEivdijC>x1y+ez18p{}I!2~+ty;-ogSh*aY^GK(0Ae>Ol;
zaN!G6lrxndiB4I6KRcmLch!UivsewG65uGl%c5*1yup#q)ZYvTY#2epAbfw4rOz|W
zhZH3<XC))Of<0(cpy&8xeZMK)Y@7)eus)e~ifOpfxWXpXj6333A2cEMu{ma<SeGib
zsb)&`sG;64TzAu9AZreY3oI?)Gxw9_rB(6IY73BtVT`YTQRVh`1EiXB2a@$5srGW4
zfYLs09qCy<cn1u=PoqI4r$VXG35(FbTHr{^A)ncdOAK*>UQaG?EKP0s7*8TFYAjYw
zVuSg3VVUzG`d6_dN0+~z^#0qc*P(c2;W`s*%Iy1c)v7Sl9+s)7Pfy+^ZOA2KqRuA#
z<pgHv1eYU!9ckk$O6P{^8b)a$OqVkFZnHS;pS>4hsG+EZr#Ov?`bq|-jhb8f=_FQW
zwAEF+fKd%wPARO5YAuwG;sCEFSQcFRHmQ>6A|g)KDb0&`G%`kqa}Y06_1)5~9&Bx<
z!XKWSy<^^%Do0tF5McS!d>V~pK`8!}lgVi2$Bk%zA$kc;87LYoiKj5c4o|;)Jk1bZ
zJVES=ECCwQM1vo|MWw2+1bS`Vs^*)Ij77D8&S@4a(Byw_t)`i;ZT=89S7*(^ee`91
z%H8^b)>0HsnG;(UhPz^Yvx=sA^Z>?wLnTd79Z6K=Gs~xkR4~sag{z^xfNxWEELQ+|
z?vjRo*Y$M_zuba_iwM_4E;&py<_W)fI(lTb8+@tJ1D3IW$=BF0&FfR0SJRL@hdmwT
zOKV(Q3RqjcjZKLGatoSi?zUCk5N9{A9Mc!mf{URzr?5bmKYK%M6rP^<I=xe1H|>Cr
zzhJ32kb~2onfSz8ldG#n%64A@S@Ej^UG+?V?)A9pyz#C6UFAh+!gu?32cmo;Zvs(q
z^}y~F3iKY=0I0cJ-ZHOz$u*`w=+6~g!~x77Ny3!wT;V%+&LXBooJ=Ve<1XrdR`<@@
z!EW89D$$ksxu9?nv3GLt&7e6R(5f}8ICgGfujDz9A|W6yo%bKunEiBg1hQ4!XPuaT
zqbqRn4(7_fon&c|_S4bfZPA|`4pQ*ZJ32f(q_?dk^Wsb^iRSYO>&HXX2!wZWL5?lx
zY{{26rBEPxm5U|)(G)K7KLr8o$X})-{<)+0XCtKbs@uDG|FL^}+I@R`^Zr^8!=Er#
zTw2`3czg{0Zqon|(4yWpS@du^8qGR?|KittST?_d<5!d75Vi-ieS#e?JiC-!*)i4e
z-!E>iYbSdfJzqdQ1loRc{L2gk&b_nC%On23-oBXO2=}DX<537=cQOX5_81iIkeB*s
zls@I=d2oU5j;WF;N&}-_<B-My<1vO}2Zb>yVw)2Gz##<0bE)l*M2aU6#H}2EakPxM
z&K^K@+X>^blxbC>gIdN#I^k<P17n3+WdOP&@zDcWkw9%sUA)si=BfmrUlWy{K;4Au
zpl~{Y+5X3OGE+u?W_5j-dOFQ39Sph`Jyz2`ml~a{8v56mDDdXg%0N+?cqs$L&OWiT
zPe2+;IMG5&phklmu0>xC#y3fS4BlA$k`L5#nsHirhTFr@Ekn1KFfQ_j>l50v6UdC_
zr@rE1R@q0^Y*LCW<6HJ>hM@2=YY5qdLts5C%t+WEB@=hn!OQqag^Z{xXB*^@DfMEa
z!RP~b2=zNW;BTnQ02{k0ki)K8!Z<Xnr+_$<nH=ZJ#7qY0jiUQ}AywOdJgBJ)n#LV=
zNW<7C+@m`){69w%R`d_|8wd1H*hOPEYX`;oI=))>Y8t?MMe>E_H33Zd-M|}O_Fl__
z^Ck}v?b2Cgh1BI!LfnSC5de$(G6TJifU`DypMgbw-zZ<$ke&ghWe#^l$b7ZBy=wmK
zUaS1sy~XoqD<8RD%k<fQHkFm6)ofeO)qfRwE+4uCn;{8EO<hfpq(_W@W?a+}D)&7Z
z$8W0IIV7{GcfrnO@3&my&*&<XPG&0je-1RsSU%Y6z|2B%_Z$C<UmpIEPAQ`+*_ScZ
z!(v&o;X=X+&m`HCEKZRU#d$uZw6T@}uFj&3HFuPmPcO!7w=CR$o;Yo%;O@0Z!43Fa
zpMLv}Jw%VOcgZyqyIW-77PTAiwp2^qwxZ!*=V#acYbm+*;x%r1cH-Wicj8_}z$wuz
za-O|>-{VxhbM%%kjqut_obSoJqwS0Bnm+*UkxwE|_i0sB1y-B?xfyDLN`AIP`&kCR
z``z#82IZSN-(FCE%XqXGtu(a?R9|DYsx80f7pJ6rH6kBNjo!d1)wn7rW|Wx8*FA`g
zIqlj*B5|2tY1E@{yyB+BK33#4Ac6(eN-$!1^`S8V8763dVNGoO^Ev<Pr@tKWzrqvc
zVV)-Z|6qoy_;zyAy}Z8do}XNto}IswIkKv9Uax!gv3sR|a%gF_wbAE>ce*`(*FC>h
z5;P_uk_iX+hjK8tR_w;Wazf@_tAxxF`#|!HAz_V?p*JPrc@#G$wlL{`tJKOB-1Eud
zyrt;o3J_*b=B7^gM>7s~efDJ&elziL&pYw41UH$4R}|KW6P;YtgV1~DGOmExyc`IW
zW_L?rOl+@za}<#&f?qA^6?tuM%15kxOy*<`-rqExrxghpkt?kOm9Rv^gXKRKoz15c
z&?$=aUE0=3TPkebQFcEaV=X&RjIm{;cEZu(LeWkd+74;R2_B_HnY}iNGJ770GF$3l
z+N8d$z>Yh?COqF_!*)WAUZ0!08@v6u0zfbmX7;>)6J|;fAOa`LZONC3v}vLATBgI)
z)zwUa)B`@elVW}u2^BnILg<SnL;cQFf{O_67h;sl9(Hia=L5BE>C3nfp?M$eknp3C
zywCP85(&^`s#R5cFL-)@O!kzP1u;bW=*%$9{4*QO`x0*kEBxFQ=7?u6)PZ1|BP``?
zM0xRl9gGq)(13i5Jg`Gd?S&qLbP6yormfIY(Qf*(noXPXWnBf974kslQdAWNC97_u
z5GHp=)ZYv5u|6?KXZ(n4z+J?_wCq<}>wK*YUJHAj%4yJ|CVWpfO*HC2-PENRb~2$E
z4ipN=033x1<Re&a76lO@YikN&J2fUa>3EBONQMpv)}|a-PK5Ja1XUTyvWFmEXhSR&
zw;%HL9R_@-GA8sEM@J!yXbyD{;t<liFwls$M~EkJmXHlrP3RW<XAp*mhlkY^>o9Z_
zi!jnk{3~@*<J7&Q_EhXl@L!<Vg0JwSix1OckUmM}ka%*_MA4C7tGEmq53I{a3qewU
z4D&VQ;c)D8QL36~G<ZZ^sEqr<a7{no8Ma{(<l7WXG*+<Z9jb|cuc7iCCCl{EUwDbp
zOX|mPZ`zbCq|}(@1C}kmCme<O1Nb7%J!Mhdsl_SFW$d+3chSRoPI{XAtE&1~a&Da&
z#h`2jzk&?pjH@d$UzgrS9`W8t&b#k_I_?0En^-Az%`uC75q)Nf&Y^I2e11%?(V2%Q
zP(m+b_xv0(&vXPgS7%j7E;Y6Q=9=$<kQ1@dZHQHA4SNeX=e{IFm%sX3glN47fqC*S
zh@1>m;%oZb34heh(s&unV~Az2`{@`L$fc^)q(`PncL~K>=SKb%#bTG>FX!QZLMN5J
z!^rsJ=Srq5k}yoGQ2#GAy8nX_(hnDxC*0(XniiiReoAKQQ72Y!W|S2!{Xhq9slV55
zj&9(=Yb`ECXOL)>JqJf<?Wnd(qT`X!27r@Jaf4ZOV8((a{@`Y1(y^Uuy?`(BNzJdx
zlrceTsN>-CkPa$=L|aP9aIvm`;0p48roJ+K^Ii9v{*d~T%ZpyQ<wi9$1?4!yhUDa>
z$oVbIUa~R?5799%d!Gxvzm97)t8>F8MTC*lDb0yFRw}P0&vRc`5VSRdAEsm8OrIuS
z^zmpUeXWE7Ie;wA=x0xsl(N&m^pLi^{-vL^^0GfzELs4yn?dDOY5B8%-nDEYR-Kw$
z#}SAUW9FA1wjp^`&ex)O)YO*f(OaVYCY8BtA+wn?uiCw5UAM!PMEZE#Fnb$Pm#oio
zES^k`2ZJ~Kv{}Sktw$%E@ve|cf_jHh!SA1U(}Exkaxz@XoYv0U9-sGCy$`TbY9RQs
zR<~!rE#A>R`7HvTqkArY``u^hbW&G71;Knxjxv1u`Osr*P!0Uyn%x7)Zi`n*QQN#s
zm6WD&){+Cym}wQY$%t$5<EpSP^b5_a@C+WKk8wK9M>7Z;z=#cs53~6eACs?F;x9cl
za4Pz-6ia3`S}$@IQ}eQ98TQ+fYt(S7l6SV=4FoF(JBJO?NRMxSgdE>~LUU{&d@^{a
z+w0?ZxBs(yb)h`5;Sw`ucqvc=<ojTD?~@Nh>E+Xllba9PMSK4sfSRKPWJKr7=~H-N
z>7DLJ{=)6~#r4_SvlBDYkI$1%7zNpuS9x*Sy(;ycWMmXA^}M_~JHJ-W<-A`$y;ERX
z9=3P$rgw66c3E0~MHWsI?bld(=jOb3b9s4jb=^I^eRp+nb17duY)91d5>?Or$U3Lz
zGB8FGcybe22QAN6Ld?ZQKbekiX{oXkQhD-+%y)FYZV`IVeANf4cP-1vJ$OdG;}bhR
zvEvgj&L>XN(TIs3$}OH(fWCTRu6=Pa9-&vW5-u@sjNMItVCkE{j;Qa5`i`h?5mC>p
zRK5KbpiJQNHBtCAUj*h2zPlgn?gu+ovSTGXR#IXmr|1f%|Mt8SfM*tj+-%G)aB91P
zEzUmbc*PVt$nnI(?#{5gGwcZcj?jNCg#L^#`<`Wz){93^avxLgjZu5Cx&;WnZa`83
zf7fvV@In25Drvj=YDa~t*~EP<*cq93JY&Z*zDk~9omo!}AaVszffyFDWIC>F%K6O)
zISz&l3*Jy(FnrrP{dFzbR9@m!?Uh=RWvxM@CD*h*_SC53!h!-{r!H&jIM+@sw&Q#|
z&bQ-y8{&Ky{el%TNVwAE%l}gSimdvz)|;BK#1*Q4=P26;L_#TE2oGy1lJhm_;@pXF
zOt@%>FcUlMm6MCFhr$n&P1I@Mv8^53+9~;bc*wN47{1}WNpTR_;LSg#MJFA0?ts5-
zgn!5duIn<jyC$vcnzW<yJ37Ck^P9PzRLHWvsu=Th@TXwTY#)!`>n!63s=h<{Ost~M
zyx%l``JALrNp<93&o4e1pPi(%gz|vr7o~~$>2`8fAms=uov(Y{>+9n;@2!=NIGA=c
zOjefszI)w0zP>h&4MKjS!8lGj{5#{M^3L(;hqH73t!FA>xi_P|ijsTfH-QhHmb47|
zYF*Kqxht-0CHFE=JdV;QNVx%ja)@Ku?k-k;w+P%N$0Z87RMS?;ya}+kj^tO+WdnJy
zb{u)fk#`)q_RI*)MRiGaW-?jwh=VR=O6K!&h=NSMl;lGUj7VNS@>bj@x7d%Lfeg7%
zzFGFOX0LCwhzZVQwCotvChS`6cwN3Uv)kzzcie8r?OtBb2sPP9Q!}bmxA<O!)C(Jb
z(KG7xts%~oe~TOk|HQGTNnGS~TYAoz_-mH!f{^OD5^k4+5kMD2@XUa=%1E%=^9TC-
z`~hap0shf2z>X#DSkjIqy)aA4t31i`c2r_X`NnwC+U`jHe9E{x5xX)Pc3f)%cd3_R
zfcerKaCa-)vA`V*e0dhwV{mXqs)D?KRD<W8j7~I{Z>^dAsnxld-}bPc9dX-o;^v7c
zmX~cC2itHICHGUlXC17yi3MTMr*h4xvZ#ZtXS|8oBEN7W^`>{eRJJ}{?7c&!E_zi`
zQ|}`4cVgR4Y}<NguG|RE(0*J%XQ4zwY50?0j<0%M!x!r_n?0r3puF^7yZ`uqba8d6
z`$<|-9`OC~`MaCrcZP4(I3BYPY!F94=*r`MIQ!7O{>P>1y9I=-?6Y<Jq15A3Ts%lZ
z71Z>GW$>;Ad*+|~Px;Gr_wU#L6wUSsRu^~~x=pj#c=_h)?4RWJ1wZuq4{U6{2nFv>
ze(8Sb{&W8@Kot7D+@s&unD9A&a&-O)wTS;oRftR9gx+Q4WtNT>Rw9QphKfcbQJdT9
zeyA|Ng%C5erI?|o7{iw_<`}(M`DOT$0t|ie0n`lMi80$J#z=xvF8(b%RO{*s(TUEV
z;}V#{u#*?F5febKYByE}<e)KsG!DtJsLLH?_s9V`lILN<7{3ba#HpQsIJKNO6}ZHy
zuqsXki-=R9Q=AGG5vM{QaVpq}Q#*00`b{v+lHycgi&J7zMD@)jO>>q@2?+WFs6>6>
z_?#7uCmch7;Xm<(0KO9@48vhGjz^eUBro_%qHJK$lQ6914a0OaN}s~G;9MdgE+MK;
zR|K$_6PJvSheTEJ6zMg8I*y*>@pLTeT=GRA#qFmV6#yF;;ocnR7Lz0&OQPiCR?Cu)
z+aOFnMz<gkhS6jvQ|@HSI+-$>v==FNg5*w++zFC9L2@TZ?gUAxWXL$p<iwXj)*&1$
zFZi4H;Up#O`e!ux=R%@oP!TP|m5Y|SEm`_`<26`X^Nom?FOl1SZ=S$OfA2E?eQ}xp
zHY2v~@(b={%bm@4XY<|3mS3~YS7M{-zGk;M1*?-Zd1P6EBtl{LA95oEPpq#&rV_$S
zb>_Xc(iSuv2<hf-Ivhg$wium1!e6Twb6`$~I%bYkK&zbpzR0jhU4e)Y6R#T!KG884
z??KlDW6<?7a3#=xU{*&;V?cPEOh-1XF2&gSl|+I#$hiQMIi~L}!z9p311u4}=-ZIb
z1xabe#Y0qtPw8|t00ex>Vtx@yFyD|Mx~QP$&|hRxJc5Vv=g}=H5JxEQSAD)XJ|G+?
zpvgTW9LhNRk26l+>GpIG{syQ&ia)b}#@&0|&l9@%$?<)EaGm365yeSvR_!RYIdT0I
zuwx8)kDeYFk{)w|VcT&y+{Uo!KPgqnY=9i3`PsphmhPb;>c9E+Q)-C@vVk?atDmqS
z(O6^gj^!wXhvTLA@*_+zy#53}1cdzdFGb9dBU}`YqoU7&m3|#Yqul&CN$K}h<GDoJ
z>Y6xwCN@id($L9b0$o}Yi19MBKV()>yND7S3_)PZziFhvluNu)t$|Q_F%+i|2of_C
z@2crr;i$om?WT=js76pzu<*pg<#_k{-NV<8j%KFp9U{&}M2&&++Hw$xdkIMYe8_0@
zUMa7v`vu(&NWw<}p6*vtUbjHjg>#dcI&y(>MvI4k{5zRhNVYoNp|y~?>cc@^lp}N9
zGvryH&<=5!OC9~seLmyrac+=1?4PGBFXDvm_4D<DV$Gfy4008GQq4f>bLS6L1!%l_
zk*bI#eNH4{kXn4Bo(X%ZtYQ1rWVSRtiJ2`+la7pTpQhS83_k(BlO{=RF+B!x4ShHO
zIs74iLZ243r?_8|zv?;p`%?SX;Xm=m`~k%BAWcRy5TysemLq=0NI|S8tyP-E_c2&L
z@^qT@nWffyiun~9<aqw>Fk^gNeq;fOphLyr2O2or6O_D4QF2d`qWbf-rDGI1%*E>y
zaB^mI^0s8e?!eKnOfJeVK-+EqPQIufae)4R-GQjYz?&f5|F#nw2d}Td)V5I?v4;NL
z{K*mG`Wy}KqW)*#r1ka!(Dc@he(Nq5aUw^@Di7ikym<jBpZ5FwsG0;MmSqszycPob
zZ<eL7x8pQp74!y5BS@66q7LfebS{kzy=iRFj>d*_Xl&4$#)c&t8(1{9!A8-)6W<7b
z3LDvkfLAtL<l!VsAL9Xo0CbkHEbfO-(F``0x(?$}p>k!y{KjdZx(AHocxto_OrIqx
zVhJ8=q+KCz*kfvZvY?Ik%|FMJFfOE(UCqJQ%6sy$9?~>NfEaLUAMg(>V!qAh(TOcL
zPO!+?Xz0hO@T7&ki4BgS&>iusnjhSMTnk^~TYhqL+0#|?^vXbD*U;XqAj1Fd<42aD
zG7Oi{F;2)|((X?u`7N#l*pd09W$c<yoy#M|l2*^SGHLg78NGGK_0dlA4C}Z-JOum0
z$_XVN23!pHax`-7JAg^u9|54G-jMLR26P0%3l$BR;zlvKzX*G;cn4f&IMq6TJ3c?|
z1R1;M<FZUw^aA3b?RfCE@UM}s)wpIDk6%t%0v~D+m`3_0CU;n2MK3J|qIQ}SV!m|)
zL@x5<=3kZ+rMYU3F&DH9J_L`{WK4qe-!avR@5}{=oKJBMmv6r58OtHve+-94XV!RH
z2cQhdq#7Hr5wY!UoDBBxorCay_v)1nyz={frA7cYBFJupMm5x%3o$|{*lA*EDkE-#
zcKXmJ2{`R3rvH~xLaEuXo_kT!Qx3M*>2*9N4T663HlHC`yn1^QzW&qy_dh}y;0WHA
z-oOA^@E9kxbTeoDG#NDM%Hd5ivFU~Fk*>|AbW>2nNO~t8#La-exCU8&Jt`d9G_@np
zm4E#(T`SqUIY0Y5ZM4wec^tifBlV|;juyK4d7R;8Ne%rar?v6eL|YA4YV+RK5HNmZ
ziA2dFo9(B0L&v>EwB1|ha@SI?HW0wR<e8HXnQ`FKsm$-Rl||P_1uHco=0vMMTw%))
zo(Fs?aB))4{dAfXU-H?1*Ssyh(PgF_uxF48hH;h`+C7BeNO}T&Cpd5CF3P$1SEp=%
z4Q%H`=?ktepl=vP@o1W@TxCmNo0FYVXdD_)h3=jtb&7)&`r0NDwDtfG!1X*spLH&-
z*oVpII4h)F7U)72Fj!JPD<zNK&1}?r$BGj;d&A#RHd*3YgLn;pUtE!`;ik<+#c?_y
zgJ+ae9&r$9!A*vd7rwFr9|TViasPqD(Oh_JJVsfJ7|J)JB4U@;gQN#Hi4RbJBI@wk
z+mE|^Hx1jdesq%4D=AtFldtWpFYYzkHr_yBP5Z4i|DO2^e3LE#1%s~9*6ViPKDKTt
zb>vO1aQ-;m&G=t`;50Hg&<`X&(iG;CFF<Jj2i_&^$EX>^@RLZWXqaA41605%n{zh+
zgV_p$(wJKf6)Hy41s2s{&h@~B@~9#@)Ols-YedC8FQ5S}xJgL#vp*$42Vbe|C0OAs
zqL}6wlHf@}^u&80Y|#K9R>2RehYg|rpL?FrMSRIx5A+&;e41MzI;_jUboJPV_N(J5
z9UPox6Ly=&Vokia{=&I_!8vO^CJ?NRjq^FGxABObjMAJ=N<F!CMbJxLWzmc_<nKBz
zJ8JmSO$T0;cNqGct}pQS>JJJ=bze}_H+>^^K{ytY^ZHXRZ*e|ppDfAdO59cFB$jpe
z8|xR~M;xGkigua{>zee;fbKdv^UxPG4ULw5To5?XSO=O|6nMvs-$Z5}09&i>+Cl8L
zKy3Mx4?w<17%V5sW(VrfbK}&5vH%$u-VoV+p70?*Mp>?)Qa3pvle*TxB}*RTEKM*3
zO<v;YI_4X)Vy~nHyvjHg^tdtkBzoA03HXoeiCS5I0=5_NvZ;odv~;j(%!ML$$S>$+
zFn38SN7^eH$N?)vy37z#(2yvAZPoZmGvp;$*RU;|2EeE!)FS^6h)~+GBB;lSn)kZr
zAO9D;`@f~<Nn-jV=)6s3R~CU;$l84I{~arA+d#R|NdtIiZ5e=N4-AD1+TJ|Hss-G5
z%ZqJ)M<%Luv#Ut~wvj@t;EL@T#s85sk<q=r_|}9W3(07`ez?a~pP!P~1i8?y7VC#G
z;JjANrhP6>q9ZLB;Va-SFja`0ffd)CD?C;~Af`BalTaX<3BYCW&J6`^<u@y;y|8uG
zDW4rY#rh)_m7-??xM8uwMd(HT`-X*hPz+OlG6!w1>C=!eK{hH@rpoemqOUPiWSrV+
zG3TBY`4Xq>1&QzvI<x#-ZS#i0p?E=1F)x@a>C#G5?;uRfq|ahKF;Uj>RkY|!0M`3B
zVPxtwK})x`CUGN(8x#gP?K9y5GojwEOuqv#nTkhm>pEeq-6?uO7{An-pv51(VM<tk
zB8F9ski1p2qFQ|FrNrhhQ$qeIEz8Newb*K=k_D+odOchx5PN`4Shuu1F#T99t9(pS
zCFktkppRLc^xyuj?+}7xFIy;SslsN2)^z?SWRYmrFZltwUY{psaEM1wq*8B?b&P;5
z{fuvkr^;KXUNm3R4fvjXTzkA1eU&4Bzb^JMPo-sqlh_5{`z*zmpdW>ZdO{6p>Go;b
z9G!!c*)e0_b?!NE`>?FK!PX+t8)R{{v?QIdq^h5`&~I<dPy4UJ=brxAH*hjAe}59c
zg9j6l6>1=$lWH@OQ&Uo!3S=D!Zy%{mQz0;uGF%#QN5ba@C`v1~eZhA?5ifXua8fVm
zG=IyS6w9>Tz;FxmYAGn&t#BgS$iau|>M(B<dBK1qP4Pe~1C6Qd-kd@3kf2-G2`$)#
zQ8D&Ihs8bVU*Ooj5!=)b^{@D6D%6Ju57!R_oYoEn@Lnq%FZC_b&nz*e2i<^g$wv`v
z4p-${%s82EBN>pZbtIdGUW#vj*9>EPr6VW?Pfe?+P?La3Bf~+Qad9(#Tyt91Ws%+s
zluy#ph>2fon?1psqm_JP)jC^yJv)tu3TjguZpKlq@WvPoa{FLKlCIk04MV-4zzX8z
zAUQ>g?A;9XClKPEMI4C3JtFY`SqVA+FUdBb=^=WQY~e%q!<+7v@SN9wSV#`?Lr}?7
zGT<shj9OePN{{r!!VGNjMG7QZt?;4D0C2hmd>(LS<>Y`*+v?^}(2lyvdZUYj`aC}$
zg`#1!uUBl7xGZe*v;kZun}g5?m^fhq5?enVi*g1W9iJY!u$xb!{vuv)S1d2mj9sRA
zTw*y^y9at<f5dE=H$0qwh__p))opCE*0AF<+ZS<_(GlhT=T4#fd<?j_1jaSR8)SQ&
z{Z!!9Y;*!EbheBKO9HAn`3_3A4@&dsvE*>PW(ciy#OSqh#OSe7a`C*45!`~#1wAb0
z=R|{bZRNET7v>(q^sd+{ERcytR*nQ7P9HS@b`TV^NeuUQ%=gKE#*<=Z-ausDEWC|-
z7X@j9O7B27a2?&7h$P#*(MT2USOSaWq^)qMRNZJ>{T9{Y<`45uZsWIxG#Y*?zAQCK
z)PP|G%eheXY(IpapC1B%d!r4R%2J?(A(ENj{UCo?KZK3sxPDRB1piFgA73U#_6tc~
ztjJpeWEl1+|3ILBtq;>IR$0u%tC%S;PGU$682?*{cho7zWZ3lgfgWL+%jAc$@gdC%
z9SCp`2vbLz6|$e!fbmNX`uLaDk+($XVF{y$t3YX8sIVPQ4_A%U2jSu2;WvxfRz2fN
zN(3<u-=Ow|jJ0Ct+t7~rkc~3Xf30-m6WFqAu9Ky9Cmq3m{^b&Xy69gUS-3Ry%I=hy
zc<M_qeR}1cG6lmLmxQ+F&)T%Rvi=>KL7lSkw?H~@pK}j57dbNRfE#jQGs1wRu?qYd
zAkk4d1c>~OtjHhoKGIiR^rR5p73#26;_9F#aW(yjXDa#`rZu=<h;m%S7DW6pEN?Ob
zD}b#w3Y5KnErT)WCexDqoRGc2rahw3m+*wbXt4~<5mPQKwumKct(el6Tk0)l$W3jG
z72e4kEr`Zk7!AYjBjb36kp?ne5Vsv_d`vhz#?MkIpoNP6CNNl)G)LJWP6m7$vx;~-
zgtV>Ty2%?EO9n?BxV$K8E?^cn5EGa4C7Z&J%zgZS#*oGvmJUL|1wa^$1Cj^JvXo2U
z!>|S+hTa&V?-T36jp1_0v9&zQ14As1Rm??~9oJd_0T%$>gFv8SxH42s2IXuOMvD^-
zp?7`MzE=|Kg%VU4>vJbWo|lrMm`&K$WjFTA5@(qJ>(HBjnuGuG9*v`{9Q!`V+81jp
z{8pQPS7Lr*2?EhT*DAWU$_rr_1Qb3NH6ZyQ4>8N4jDHEgS*p^%`VGiQBRnUm<VVf`
znhNsS%=srgKxGL^uM>?YBPni<p;Tn2pN@{`FYv*mU%avSoIMv+OtxD6u$jF1pNmZ+
zwYAh8V($>Ug4mu=De9{%hsU9b$H9j1_#G>M-f$_DMRZBjkDe)`?x?qPM@_Rfg$DF&
z3l>DSiwL|#HDpVFyJ+rz%FrZo61X${uN<S^Sch0&j%}5)X>C6J+LBI`PG05Gzh|Nn
zkiAFzr=XJbeh;gN$R3^Wl`lS&;%clGPpqg0Uicw~g9TYj*`dr!qD(o2r#@u<TSA(D
zsZjgtq7$B}P%0%Z{HoRHETd}i+fip|2@F_$;p_6=axnd_RkR`BT&RjBkM=b3&L#;Z
z$*xtcFkcebuI`#%)Q%j!BsnadbsaJM`f1=>&;r;O;!10q!Xl(qs3fLb`Bk{G$S=8$
z-qP9b>^=9$Q|bZ>%Psv~3zzhFmP>knO=>(BE!FA?d*&UZZ1z{5pCq>>=R8Xab}#Y|
z>PPQ`kE#EWE-dBCMMcs<J?D-+z9f76XmiEyzP<awxy<k?{`STJTdC%k6j98vBXf?N
z;>~&9g!VDba^Lf<*aFIpZ6qI5yKY4AX=MWVishbjd&gHG_FVJ}Rv1On>?Xf|J7f~3
z`jwiL2QD^9xfLsuuY?(@XDI$1jn?6nw4K~h7bl0Wo<H<^mfUk$H62<9Dbg;k51KEj
z?mcFdtIWF%to9Gz{b9BI^<u)Z$kbV@25(NA$~VHZ(*-TBsUn)Gq?@JHY$=J&*uSQX
zix8V2wHM|-FQSjTOf#iwg}>W>aMl4EMo_&MJ{sas1ll{V5irjlkkje`EsCOQa?j7c
zijsRJTHu4HA~J)%7ejFqDzOp&n-osDBGv(;{&70tkg&$uzFW&W^oP$M{RaB!oYxth
z`8re4r%#m$5k<fL3)&S?z_WqEFxlYEKqL|6WX%-P<}(ljzvP79uo!-SrMGYq&Tz%@
zbTl=^0NvtCEY%B(YMk_xt0b1Q4E$g00eO=g3jd@*rb%4n-xx)O-EoY|vI2aMj)sg4
zj8m>7&#-|G$_!mZ?%=wSR*o3Iq*?rLaHbj^^|LhRbK9TsjZo=cVc25v!J9gpQI2N0
zu=x@__LN8_9t^o2m+%dL)9cEnS_xf!PIH={;J%kzywBCDN^Y=SjvJFS$x(h`j}WWo
zV8o?D<<@Gp_S)9)jcYyhp0VSxCF6LXyQvlPREYU%zE`T^GKc@;h>OEh{*~VtZ<U|z
z&~%Aj1QvVsYV|>y`~fPGXKcOpCQTbM8M%{AC<<yc!(aYyd+*wR+_sV{ihj?pVBKA{
zS2AVAkGyA{+P7$lwiW9&q!cGJHCIJTZJUWiYLQeNom1z(-$r+nY*M0tmgTI+cvtON
z7DEDPG#U+{(ZH-kE@tEXZd)Ymjp{Ax7Ad%+9k*w{4O??*72r&d*)xn!=TE!#qBV4T
zxNVzgK9BlIp76PU|22}gt>-}qSK{RNnWEUmmsKR-cS?kBBhdcgZjT76wgc#H;#cjV
zVxj#W`F_aPjYOGw)AHm(Oql!=?{XH+7jSka)N6k3K@yxImsR5W54NbYO7DhNRo0S@
z(vHra&7w)UA)Uz~$J%T_i@AM<#(QO=h{IQ*ql^pc=Pt~Ds2qmu%oIh!bM%ZTdIW)v
z7HGpLbqX_)&7~gKNnAT%+DD`UCaeM&%25|Z%hrmF6xDtjVALlpEjoBSTYDwseopMq
z8kw<}y<60)@~3d^Tikx5el5)_PUe)w!FNt#*7K?8(8>jpSO8T>ne+h*!I!^xlYHe*
zK3w!Apsk93Tut5nWk1f={vYYsa}$5}xeUsXYu7;nc~4Rlm5I=hCPKMJpW;j-n3gO0
z)h!^sk{@9OC9=s`9DNU_B92+sxRsu2wW~IYcUrVDXH$@fs%H7(QzRTb`(>HlG~WLr
z#^bBiiY!&tE$BK)gOp>K9z28TkafsrE7C&lFSMY4NcMwzur06J3ma49OLMfLmd+4N
zX=#HQ+CTb+)owj*Dp=9%9htIE5_0i3dBV!mQ<=FfiJp{n6GhAO$M12C->)CCAL-Jc
zJ${4gvUK2+m-j-X_d%2;VTz*onWmNgv2`&V4j^6_mU?yVe!5WUp?H_3Vz%Xf<pv6W
zqlH3$_do4`cKftfc(H3?&_~acYi1oD<Vg}uY@k|IE;?tT*3%xuhumlolNq4sIfPYi
zroV%1+)N3QQJvR6zf83IxkR-450Zzy$UwXQT&Dge@uVsQL8LWSRX@bHc{|l>Zq<C_
zcEEP=+1xJvCx{py({?dw0cT|~>5XmA3EfkFvo@@GO_U9QGBzQZ0^BCg-n82N|91l*
zgBJCfm0I7`{ZG4yM1M53ip1aKR(gKkP;IsnEv%-Zf=%ALYFl!Af$q;7bKJ^WXu2i_
z1Amyed^2GseEiqtW4Tn2M=urRZ73B)EAo(43i9eI1#LJ|F+FvwIr^4c0so&z%Fum(
z;OWdC`p7(I+jiikx<h~EPB&Q~htK)iX*m~FE;m}~&CD>?lzP@XO;n;6Z7awP)DG5O
z%?}FnFY@C8?L%&xZTL8gwwAxnVy^k;x#f_&{9o6xb;y|`|1&Iwwbs}%_gB_6v*yuM
z*46hDnUo5b7NQ$y_>q?%RXuEKpc`j@CnUQj@R0&s-dbTP&#17Jx4E#Cu^O!{AoX~f
zbQ_+@lYZSnzfMT%b-m5}lZJiLuzzI@n^&sxh?T0mO_i#Qb!y9}l#kt$HZ?1d1w(sM
zu)ADtW&{me7Mv&j`lMg~+WNIr%Iaa=m1Sz2fs(B$UbR0(`%@Y)Kf2Piw<yeiKY8!w
zCx!MWS7>@eyG`mWyQWsup~>~d-$m(}XU}VM#$|1ERYJW;c6o7NO{0lu`(jl-ZuOg^
zuG1ST051-n$ty%*lyY(=@-)5jjq{0rFz)q-?Xz~%9=7|v{Ocm4p-N?c;JB4{7qKi*
zQh9UWwtGXzE#8Bqnrz8b!Fr>AQ?Kc^2Nfz}YZ)fX1r&GSb5;3f)bmDzLEjxZt+8ku
zn0-jy0rZM?9=)QS>P@T)+KKC0MNK<ndwX+DyT>!RMP7fHKH1U6c67!ygut~rhfh1t
z)6VnPHl_1|h#s*ZVrD{zS<4n9mARoF;{NpI<7e9a?m7}r^(&WFd{SV4PYP@&1xC{z
z)#8etS#d?LuDD`R_RT=I)K^w~>?o*A@`7xh{EbH|#`qTxclt>F)wYU?f2!J$Ps;Pj
z`up9jzjC=w&!k+Zx4m2^?eeCsy{V-+tGfFq-HUl>{mwty^_nOB^Ly$a+VadRta`)>
ztJ$K=%B$j~Rr8clRa+H*VoZ;)dKTEWp3@1_zDypNAX?OD^{6#kz4{uh#(}|2C0ZXh
zEI5OTp@LfZ`!Q>}{*^7zf{%#NC@QpG^Nm;D8eFRhyHknTE%2W7|C9as*Rwy%)qXvb
zYQNrkwO?wncwJLdi~UNqs*sI06<PV6)oMW+cCRYq*OPkrPg5^{g^a8#nI)HrYdGnK
zfx|U;&YUCqIxZD__KXTXdz%YBn_FFV1)qObO8Le*(4va5W|{rq|D^p~Wj~+nG^5h}
zIae`lmrGSvPPz&zpAh86G*bDwrW!T@GNmN;lYV|O|NeUBUr|Qfqm~iR%)W_!vl;kM
zsV$Cg7o?iuRTW=<d*fgH{fE=x>fSd7pj0ya53O`45~Y<g_l!!JdmBob>k)0ULgp1w
zqZKfh>A!jXbNR;~xvIG)XiKD7gI2HnX>0ork8GE7229cgvSQ*pItjl^et=9#;)Fk0
z`o@-i#x+d06hiT&T%PRazq;KF(tcA`pEpGPc@xERj+AqMq@+oWQ#lpZ-$j+mF&tPg
zU%q_OrY71{G7dS6g-anfjU-*on35JHDjNXu89?$;r_(^T{ILA^R@{I|U@eA>P1*EG
zS3l|MKdY{;AwjN~H42sqOETRHV*y3xPe3zq%{E{7X#k2Ts}KE5+|0V+;y4euC;$&q
zKb-pURAaG!Wo=wsH_>bs-CF@y_Q^B3%=oK7;F{_WxCq7^o{+PAQ379NLy{lCd^s<=
zNC+XEM6vV?r^V)xt`^L2^ZH)dy}tiG+t>Hsb^rSAk6{n8{KeBY_PcIl{(_u$>~C0e
zPutkjHukiQ{YPzMrT%W7L4P-It-qV`-c{4t?J;V9PzWmjq%|n84JscSWs7>ML-C~L
z_oC&q+~P_}1gN-hUesKWpK_(jS$++ij^<G+by_(`xmu3FwR`7I1<HXUCWgt%lqMJG
zjo{(hXccJB?iMgP)8U;fuH*A=qZ{7ua6;DUU_a6-@S*d0NEkMJs^i=QW+P6~L1s3q
zfS$5{0&>BeXVEfkL^s^><R9f4I)R0FCw7*oA)i(U-2Y^EMmdjOS~f=*alkR`kbJ(9
zXZHbrbPWlMUm4#prxmdnh@px$sd>ND{3@@SmJ-XMS4o8>V4EhTzN*i%L(Gj`e6Sup
z9ET`z9!4pw^+fnF>)^AtDLXXI^2%K^J$l!F%zPUyH(1;u2h^xZrfAZs{`_OM%LD?E
zcA1+xQ$80TzLbO7V;jy|xKBIiUwa4T(-%xD(jc3DDLui*eEjn0fd9|&fpr3Zoxoq9
zc~4%R(9{PcuIOjU#cyg4sJxa%*&%?b((__yt-Cb*&wt;<AwuSl_mi@IB%YAi&WpQ$
zHQI#czf7hRe5$%Bg?}@c&>a8s!X<hXX9)E|hW^hu-X1E}?MER>8n{jakaF!$*-ZdX
z_&)8PHLdqY$H!vDi}XFaXAAA<vRlric=htxAyH(C7I4`QQ-P6YU5&(SX$4p6x}G8b
zV>Ers=kk#SMv3J<Bqn3_F2X_*m0-?)hEZOhx%f$Fs~z&aOhwsJD7MR~N*JH$so2<o
zz>_!cKB(x_R`o)ynp~prIUoh~^9afZ5v1~HA61?>8ykX+P}BHO@L87Pz~}Z87##eo
zyaJNo=-N|srn4`kPZM!B8^V!hLAo`p&rKt7B1pUUnclH*>rb%Nxtl30#?6+0I(X9e
zL9!Pu6C}CaDpC5WD*9PB*_Jqn0)HX57NJpf9v^sVSsMnF6#HKw^V17}{2vLUefg}P
zyC}MiKUpr4j-RAX97l0xElEHd{z*63IbJv_5F6Xwa_)x>?sZIs+?4%g!=;vNUTX<`
zu|b4JYYuGc$FHOQGdIBc%df6~%54n@s7z){VRSKna`&vzvzFBfzEynT4VpgpR5$4R
zjehb&*3dI#4QY`D(sH_r1GQU;ztBY^-m2|nDhS(m8(e|%sSoZStX-p+mAnyd{%aos
zw3kM>IYm#MaDTQ`s8+b@?}tgme&itUhC5Btzg#!mX@WRWEtaG~=-23fAFLa$oSr{w
zJKXIj5`V^3w79=L6MnoG{BI^}B(FU}*VH)+p_m(V#vNRpbHjUf(~vJ*1Ka0p8u%hj
za9eyy2>%-H=Q6bPjjisZc$z00^55`RIoWW*7eer3y*#o!#kvos>76PfB@$%HFN$09
z`(G}K@a=MODPOX#mp3<mP~3k_vea;qFgGxmo1EV;Xp&D@QX#w}RHT?v0XtSkb#K(^
zWHz->qRTYma~4c?D&*{Cg0T_729RPV5j6s@05cY_&vPH^<jw1&^lnpG1St&E(y2JS
zto*_@r39~7jqDsPl>a?YzvuJpw;99#YUhl)gLSJkOhQvJndb$6A<Acxn^Ne<@UP>m
zc58U?qvQ0>hZkbH<SQ!cPQEE}?N$q@S20_unc>87zN<q|J`JkaOf;Lxzn;O|EE5(t
zpdrW%a%O;}gfGQZq+@VqMUWaHUx(qAr#?uc@`JBIQhBhbNK5Fe-)fu@EB|{mFaKV|
z6HUCb5lnIp*hQXy`MT`oawnKFxr?HNB^AU4*ql{UwqWw0K}D7X(>ENY783}$M^Ok!
zpcDyTaH3${#OK@jjHRH153-}yY-EjWTo5@|<H?8BzInDj96rShE_iGzlRXOTB84Tx
zoR%^%r@@?sNzGBP&`biq%E5%-ewNEB!uxm2a2hlImWU32%sHMwZYc*A`)wI~hceFT
zGwzriA08jU|4FsuTk?FJ^Y-{q>K+xl3&P2r5?r;zWxE?h?gXPjB&T`uO16}y+IYob
zwLhCIXEL+2G|e)mr$7~nsB7#zDB>%EDlYfW%NkCkRB2<*{yo!pFP;G*K<!J4;nL<5
z!R8@Mmh1<AYOKJEfj@(>`(SU3l}W)zww!Ry$Yf%Iu=PGh*Vd5D7r>Th*4qCSVLZg9
z$%xb93I%3CzWQ4l?$Wf`X4-#^GI!x`b3eWf!epGVM>sGcS{+<ogPg4!_C!wZb|}E;
zR54m(>&CR7e7M^|Zj248uPv@i7zBv1FyVj3?pn-$T~fCu#A%>%merz#EjL&B&$Ne)
zNi<u_uv3b(P=>nOZCOXvV}y_eFb&U2M+rBgZm0s4#~|Y(1yvrWLK>e4$=2q(YEq;q
zg}g|y9)d*Uhe(?|273H(r4PLE<HwJNgrfHTYAZDB-cQQ9zer82vPsu71%!iVnnF!C
z5Ozd=Qj=Xk#=WWzyY(k4p>4{KP?dQWKxU~hyfj1WdS$h}{vpicOu*UZ-IW!efRbrG
z^+Uxqs>GEt3?!cYtGSut!*(A)j4|IdA5}SY{d95%yHMtM$$fTz$$Kz@Y>ld$D3!*5
zYEJnSSFLN=`j7qaxxlh#x#imMUso-_&~He8Yfaf<CgM66v`VtdfA21+_B7&VHwUq2
z8RZa50=if{LcvrH6mi!1xc(w?$;VnRmVEz_6DhoK&3sMt44R?f=;_PjXUYpylOH9i
zCq`loR5!?0F*FN;_m+%3S)RnGT2iXC>1VHBzN+4ExGB!b1IU>V8`-t5168wEZD<vL
ziG<VXG>Qei&(b?MR%?i4a`9LsxWhijeT45^|HlDeLLrDT92tt>XqL^dZQ;U5m$3ML
z+7zy;N-<J50W_yraa+FiQul}dCG7lvS2y<BSIpM*)p>bMU!Cv1rr#VN9ltzY3kB?X
zfnS}M7x?`n<V13y$O6woaDRaXet)}vWr06VV5g!WfSXcy{w(X+WR2w>vHpM%!k4#9
zDg(=d2Elhuu^#)_*8&r6@y7W4{?{2faJ(&0^RN&y74qH}b}_O0OM8~9OK>$?XnE*O
z@+4pCj2!%etK3GxuZ?TC5LM+7{=t^=NygJONFl31t>fXBf#dNhfaB@mYLVxEm7SE9
zKV0AD`Yitn@_5GnBwDQ0;d12xy87)n_E%X24-3B2PF^=HbVY$`2>ASO6@)L;0eD^$
zq-Y%Y;@4+YZMJzh)9=Md;BR~o)9-#bVM4KJZn%sKY#)Ybgj`OU5=faw0F%e`IX%>I
z+{BEPrX_!1I4$s<$+Tp%lH=Qd$E@7>$z5qQ`2*r;;C<pKR1hi~M~-P9;{aMp<H#Qn
z$03S9#N6!-iKBsyEgMRXEE~#A5GVOSWcvB;!zzynA5e2N@GSANC=7v2iU<i>V+})M
z>F9{0Lhw4LRQ^B-J>{=4uJ&;%H!Wy^gy|TyB`ql+(mr8vI!^ph7ogIAGo0m63SW4b
z;K$yE!s1?D!-Z*kCYnd*IWXG?D$W3uSd~b4QF2?jw9cb&ETcE2TCEc4*q^29U!~N+
zDdyNj^d_@_uSH3N&X&q!oHODBxFkB|{|)?EvI{3FSYMD5I_1dIS#q$p7u2mQzB~g+
zce-5$$sL;t7ACv%kT3gxf^*^r<+_fnDU(OAx3g&>?GOdt(oj)}<TJBa#)~Ln1+Drs
z0?G4h;fsBK`R3?@Hr1AbAqwwQ=AbEV4L1w1(36<g{!ve3273*GRk=mH?HvvBc1ABl
zSlE1&>l`xRH2gz}&GG@t<2Ba8cYg`KZc^<zV_20_nu;&DXTbk|B^)u8CO|zgmGW<F
zH4?{FH#4ZS@s|{E#TqJmlZ8Lgc&mP*j1|O3vncl9gFRUK3NtGcqDzh<jXJPpT8s+*
z#${!h?#pcfgiJ%O4+Cf+jsb)sF1EbvCpwZ=5OZ@Pin-eYU(gN8$}kkdq>Mi)29r@l
z9#2xTOY-0Nh>CoFX2I~RZLzsklH<&*{@g$~SRX!rRcMMb#p;o)NdbRv{<8E<W~lJL
zUzl)fJ9?V#t5tULj!LVllZwaN6`aE-0^TYq$^7AtDoh`u38U7zO%<r!RtCqC=qO98
zA~9IwL3k4t)XQH+>tW(A{Oe#Aq$@E;s-Fx1f^#(L0LL1Ce&tIlV#ouDwPD0YYRb^#
z1@JkIF`dFNNv7lLIJ!?t!JxJ0IORRB;k7LJ2~i2@;h;5)x^J}p#zsPwMv=cVZ->L$
ztjfff6=kA7)0NpW2-8<5P-Eg|9E4N0F`Hk160=(vW%=PWn)^Zc!f0+7+<{!5n&L5a
zX2cgePfUS-FWV$?zUm`Xxld+8MCO1pxZ+|C|IWG&(z%~}Gt#j-RwL@UaT>4IC#ZN#
z9fSB{=LstC)hrzO!X_fsvJpRi=Bl|_&SrAuz>CLk`HOL^uNq0pZ<3Jwo!@56a19|t
z$0kS3Oq}^4bfv6eO00F{MuQN2DZg*f()vG8Wlep5v$M46IBVoBdu21RO6KAsD)n<E
zPJenAL5w?>uSFE6`GqcSx{cEx=^9m$;Ac)y_EV0EfAC_bx!uAmR7kTa-BnC8Y$ZX>
zN!Z1nsNbUrgPFipF~C9cIJb;T;Vlg-qs3@c+$s7VOg1b){U4|cP<_J(DvBqWxNhsK
zQ752(W;JH7Y^FTR@0UOKxFTQd#NjPOqLQ<TvBqm5Ls=4<oDQQgmB&IiXrNZd5A#)A
zqL@l4n`*H{`2(f1!+f|o<xFq)5$Y01nNEQgACeRi$FfXsU;|K~)GvHASpi=s<ka$U
z5%o=OM9w0p#jl|xk_%NHa%$xd+PNsaYw9F_3iwJwBrYPAU!y|jiN8@AKf=u#^B@8M
zPc%eY2tnW_(|fDYdrPACb`N3<xR{2Q>Ez$i$xk%XLjJ%9;Prb}C|bLc<w1Z}@*vSr
z2`nA|d?lX!<RtERQ2w=al=8KDj`G#$5asK=Uku>hr;>lgt}T0Z8^u9-H{V4<I4Y)p
zq1EXJD#+BQ8uh6O^~2~JGuaUVd?q9J^dKHoD9=fhKj>Px=}+!V1X;jWL`qylDrNR(
z*_0_gdw59soQb%xI7c}ERY0o0UCB}wMQnKeU$+OC%kRsa+B#@5!FH#RbBPBgyj(;T
zMv4b07X`(GD9JJgc2mDOLRO_fTV@4S)N%10f8j?lDESK?(K227GmHJ0%$A}6HxzrJ
zr9dbYmX41|YveD}QXX9K0HwHZ^H+&Ji0(csSERs1%W5e{Oa0lrk^nS`7HcupBwEIk
z-E)DqIPF_Glikbdi{HsEhK<6Nlu>KuO-2lLDDjjPhYRW#{fN2`AMC;4k%(D|3~j9`
zf4azH64_D3pyW?naK($#h2F=I1X@<6qBJN;7jaZ@Cv1Gj*R?iZrDu4FPF2GHMBXox
z-|ZrVI@)9dDVjKzC?t<GNua`yu766;(2@4oy_J2jyCy2(Eaw|SKbu7<nnzPmbC%vk
z(><%BMaha@5UuFk;8-ZF1m7KMC!S*0e>U0d7e<D2>?a)Sc+Mf_w3nWdw2&*l=r33Z
zeVle#r#eoyfevlOmdG<3W@Uu<;N-wy0WyECmCh#Fu?kC4BAZO{J(w5;#p)-a4nM5&
zL%1`-38$MW83L<>jz}y7)A-n`X}Q(Mgf2wz!2{EBt5_c~Ef;X?o`{<jX3>7oe@tuR
z+=t4D1g=C!tnC$&5aJM&@W9=Kd?cl3=zxae?OiScmGETe*nWKb!i@HBY*i&)Jfc!A
zihS}fXv<81w$_lDkz65{Ollxj)lGoe8yT@>La9WGUaDWC>%w)^p5T>JMJHBxd9(NZ
zk^f7@Nrp!cO6)D@V`~&^8;>>&f1DLU!}!x_oU0r81J{9E@j`2E{x(YzC}M`K3h|0H
zE|4rO4WR+4aG$kAu6$rhGJJKQTIvR>E?64nX^pZty}Dwpz7f?x{8Zec<nW_OAWDRZ
z#<zT~q9omN;l5VcmB*1(2PTzXWw1ncF?F(#v#WT3vP;xRPGdhzZun-Ge|@-%i&MtT
zs-&=DfCYK<0miG`!(Mwt8)WgtLq?Y&W$Sd5N0?Jb93$6+vuQp&^@}z#@v<y@VLm2_
ziIwnbBT<A92l0)ug+B{qzCrZ~Z7}dbLwvFGG!;168Wq~mG}4H}D<{gVJwgXqrqh+5
zj@)*(hm@b{;aVfhbB(afe;^?mgr)DR1AWX<%1BiLS$0D1h^}UtKH~WDn&$d1nuuz>
z1Cw9nFL~!)TKf$d#$nT!FJGDqucU;P=+cB%5o$2VWl|dDGBFwE5_-Q+cUgoA7b~N#
zjAThSUrLS=PJGc4!r&-d(k00w(-q8Fv`lrKpg$sR!19Y7mbs40f5f>oaS$bpc&Qm=
z>K7rG<2#e~6?`D9=!t%%%T%f)URI()lPN_OaY)NJ7*{MO{Si7iuDv*shf^k7CF8-d
zO(W7UvUMV~vFW5446vdC^hcxtCJbuOh=nA-+ii#yb)Y{g50S1GD9zTk*To$Sil{zK
zLzGb@Rs|)EXsv8Xf9WSmFn_zrUoIM9ZE71q&>SVKdDgwm3)^0WcSC;<YQH-YYo?`E
zBU9?Otg4Gg6H#8PAwJ8ioEjUE8fsP|gk?=na>{6<x&aPoGhX~A$*64I0$Ewb8I;jZ
zQO5bA(mpLq6f6Fg(*}R9C2X#DKc#U%zid)@V8{cL+a~(>fAxDNdt!h9N#(#sB=m99
z^^?lQD-aP0Od)+opQ7S{;S`AvcbK9A;ohc5fFw>)U8f>UC&MvEyMI_TLo!v%NnZCy
z!;I+V`qr|t3rc>^;CjV33L*!-melW8Gxhs5y55K8{aVtzU#pt;tC8l7@(nCn5XCrJ
zsQb?5q;niBf5%pk94*M?=6MSGFCzb=B3YrKu4=I9!{(yMSkQkJ10&}vz}t(Ga4pP)
zOC3q?L%<d#0b5iBY+)o|zb$<@8qY?R|1=p^Lw)tIVP&XUnUZ2)Ic>C&#VpB2CH^Fw
z_9oG6DLe($5y)@^fQA(q3(5t4BGn}!i_L^A%e&Zzf0V@~DT}L878^-fQtrTKHmYRB
z6~TNTV@gV6N~&W@%*IsHRB(H2G3y08&dMc}qH*RUDh;SQ9+TndeiFLJDD`~E1#ZDN
z8fK8qAqW%X5ecg^6t;W*S#0%v;~E+<aNT>$;zRh_pQPBCZIJ{7HkgJNr+8ZxT`YNN
z&NYu#f7g`E(@iye6CJxeoYSbu$5B(%)El~^=5XXfWm7NfD6+Y-sia|JDVj~CVD?jr
zMh(0K-TFVOp6q}B*YVq<U)TRveFUpQnE8<S@hkF;5CC`?e8qpAygmAN_Qn5Qt92~f
zi6oF$BK|OF1gogAwihH81@BAgDr<F(OQcf3f8piHk(u6D+T=miRLYYJAknGSYfbzu
z2%&E9gkf_l`?CX%8-F=VvDdY0&+429`@-a6bOq!-r7PnHA`Tr<GC6-aYwswl$**@#
z&H09aZ9_H!v~A0BGNIJ7{Bl!kSB<?0;GXCu2eJ7mOFmzNMuXH}|K4yJY`mPe(=9+<
zfA|F?RQBNn1+t4G=<UKiCUK<lEAb<!C?}+l@Qtd}!dE2iO{u4_ccI8`Fr~c3B?vB;
zt%ze=#1S;+66Xzs(E$cn;`BwmJ>VeiIvS_M=1Y4O&b=N(NtDG0SujI*1r{=wP|-9i
z|9VsZXkEsP0gIA{o4|q`T3AP1sd6CPe+vJ+w%KKyrtBeuG|5)MdDU2QlS-Uoqf-NG
zw>Gx;mC}umNxt^{xN&@R^kO5VlHi-NTz$Tg>B250bQcUl>sv63MCfi47~%5Z{RLG+
z?6vR3dO^p<-#LUq)yz7qBnxdt9?M+1WO+RgL^n~zst0TqTP{33_^y?{ePn<Qf2=2(
z4idiVV<;hEb0E9EYAGWJw_#dkFWl`wK4txK*P$5BCF$PKo~|(Ib6diJPH^tes)h@#
zfMy|Y=&!KW;K9<HI2Zz~sVHwXquGqGd2Xnqx>m&1$_lmaiL};|Z*)I?r84~Ds)#E7
z>*U|$@7i<!mMid6=$<M5`{Q4)fB(IwA+$rT)>7||vD6Ua#^Mpy$LQ7&PEA!6ORJo+
zr?GbZaOuy^7@Lw=-<6F<39}`%p%AVntkZwJeQojyTsEbAQV^!!1g9f{rZnbwu2^t;
zm+os80yt<E``4Zz_Sh{qD!(%l%zR|rWo$-^fEj!4_1AAL?TYQ5#@1h^e~V>$=1<sY
zL7Hayf$=;K_#Oh*8bQ*DlzVxuRkA0D!`NSW_dz<j+ZVv){2KSQO1D5ygESeiSS;9G
zJ{$x;*bMvdW)}H!Z$A}R!)M$C_a^>~t3xgcsVQbKygBMl5He#~uem;Nm9NN~ZqD_k
z<E?Uec%y+fx#J0UUI?qNfArl2Nxc=5lI_Q|jktuWEzchQb^MmLJHR)55BkPp;}tDF
z&2+xeS3)!L8A!+^X4(S`ate_JFAelg@sZ2?nGp+J7IG=&a|ZkmQ)525(S4I!U#aOw
zMz)6f#!K0PJTNbXQ2{TE$0S-MK8E8~@hcGbtNONd*@DnoM0_{je-tn%HHsqvm#<35
z&o}!q#l6SOo5^o-YznI=rvyQ--kL&7KIo77UAB2#hnDq^K)_|MZ61kod9;xz$7kzE
zqz{9|yTnU;AkU}Kk_$j138rlNqIN(PPX~dn<y!E0pGIlYSg^PO-61!?-slZsfil>2
zMXgJ?LIE)xIE3&ae}uxvBqi;@nz5Voz`BmoG@2h+F>DG4RvIlfu}$-vurm+s%{qQT
zSv@QQc3U&;$`8|~U3p_$r(Lg0iFH0L-rP(<=D}$sWPaRM8VY|5Awhewj)R4xhMsKQ
zbJ>EazJs!1bNSs?g;VzGFk17M;Y6M@t`=bC^N|3;%Lu@{e=ZmSUb%)?9mLG$pg@Fo
z5dx(fNdczb%=d!Z*q<kd^Z)N;6X?R9#6W9r){VR5OJd>2(z~?~Ge47jgsFCmG=lK^
zbUE1sRWIg*9B689ZeG8IN2{&i!mr)BhIRiGBSe3-j$38-l>~9S<Y@+`Md=+4N<lV1
zhN%!?*loH&fAey&vk>jgy3rRNE_R?%yjTlMIJX!a`BEK>s>e$f;cNbpxF9F{D#N$i
z!OI<bH}DJiwhsJe2O66z`K~k-;2g|fEM|eMwje}8rekf!sJYwp0l`Ps0tyT9&uSoR
zCF!swKg~1=xN+OS$tG-=uyLg!LBZR#;BxO9vnH7+e?30YKHz*^CUuZ6DEo$bDPObm
zY~_M*)UlxK$zv%};D3Tt2xYJ#D*x<xqU7dA3RxJXndB(z@)^y#tb_^(CzFjSyAkEi
zRCZ&YL%I=mIi!FZu-^{TC{!iX>LBJe0AYKV4GSis3iC#2c?7~>&jj@ZA{DXCntD^5
z0&^SGf9rLp#+3kunf&CybE)~;vvs+tla4F|Vj>zhihzbBV5@{|h?wBcE+;+Cz7v8N
zrgh*|Kn3#*qkE|pulcrI4~pPIh*z#zde2xWpe6O-AOeGJ5L^+$ATx-dwd)|3V>Bic
zCXJfy6D6${ie*DkjfMx_HRaCsP-jg)-j;yTe{*dR>3bOHfwJEUS6({yg~}y`*F<*o
zzm8Ad|NB5{7xlNiRiS=>A`^c;Mj(w-itWt&4e7zceBSY$2%6;HB{0|XU^WZpEM*%F
zfSho;zJ7i^^TTh#?DE6ap}$O{7rO}$rF_&MxGt6w&I-|}fNm(CwV{NWAn;dO_PSv~
zf3ClU>__?-f(m%hNUUJ{rX*iZ6t)jXDqT3T#M{}t2ceky-Gp%4^@x34&QSBDK{r=p
zsIt=Q_TJwfSbv+bTYs|Re=HW$$Cz&A9%Erc@e-e+lQ*xAxK7%XoVdWYZ7=0pwI4&W
zQgqF%!JtLBq)>B@#p#W@j%yFw{hkN2e<+gM)6ExIv`)e0Ee{R{n3nd$P;n`pL2RzO
zT};X(qpCz8bz-37&Dd^zvU^QueAezblDo+1h)|1h#8sq!Ba`yE4wbj`*H0>R3?KWa
zyCbNiO>TnU>-Ufm^cYmN^($yFxC8tA0h|FF3d7(z!`%@ijH=OUrBviNFg@V`f0xr!
z{u=Z33R8O(%QL&<Azbf7w*g!`x$$R7EsKZlhzN%3UiMH%LVc&jGG0W9)?i+LhO+hZ
z%Qr_Kv^r6i`t&iDe$#bYgONMvd(PPIbPy4o>9lNSwhpk_X*<2)*d7fpwgaBbAaV>{
zGDu+iExumb=e>6C9D&QXR4=#<e>cZ@*8n?RyWJTN-2TvMg3jL#oX!1UHi)B?O=@z9
z*AVoZ-hf6qylFtW=eVC7m%wRRqL0eyVY|y=5AE&%B^a&>@U3^gs8GD?5-N41Djt|G
z9{6r!Lwa#Fq*+vBE48Js{^R!EL2IwO@`CeLkZ#sav{Eg3@9TT`W#Eikf6kdb>L7be
zOI^vUiQ1JRI?a}6j|V4j-j2NsoBwA!Z1FmGv}BN+8)gmoWU}P)D19gnL_E6llRGN%
zSMOi%h@5}<P~>k;j(0@PzuXzQ%Tb>ky?#$Z&0m%%;0tk;{To{)LV}HvzB+n$VulpH
zcp%c(M<3prA%!n!NOx6De@ke@UeZnK2~jz5!bb3cUNUj-i+<#Bla;omSLvyr774WJ
zcEl!z?7eOWHZUAq%O2Wer`K!`E*!VZ4TkM-!E<)PNwBzM@qBZ*xQf7$u*dyg=L-Uy
zNx=PZwxR$QI(6K%NorN@Li}aXs)7!F*zpYD!`oB@?eq4~mXm2if4K&PIl*m^`ZJhS
z9|}6)2(novaGr%GoWFFwjO}yRad3Iz(rw?yjL~ET05=_XNDy!ixCv=mBq0a5bQ$NM
z%|x90y<^uIj9P6QH(bLgblGA#4TOF>6b0786k=3CT1B^$j+DvStemUO=sncr3G+_~
zd~hS%=DxSx>YqC9e>oDGaN$T6Bq=<wu0>Lej4<&JU)0W!M9^$I9shbec>a#XU&0}M
z{_;;85`PJU)J0ZgbLI1q!pTnvRRvdUHjD19=kh3?fBgbSaJd5pU@nvnED&8{m|D)K
zcGEe=lq7)b9azV;$tCMBPlzy2>hmVnfxaRFePsglH4*4*e-of@h(O<%0DVgY`ql*K
zJ0j3`CP3d4fxb5Z`hf`ag9%WZD*Hz!P*15)k4>O9sZfm;Rf`JMXjM5>s7A}`j0%;w
zuFktnu4(x;8)op}u>Ak|A9>o-at5x`w1-Yh9V#BeoBy+wg!5=Nt<}spHQrC5CJAQW
zWn$Y_a{8UtfBwngrgkvHP`8^+WK-gAG_L&wEDPGU#6LJ8gCs5>{>3XY%vWTXugNf9
zlVQFg!+b-A`IZdxEg9xJGR${mnD5Cj-;-f}AjAAXhH2A9{)i0pln(Tm475oHN?%GX
zI#Bvra_B(mi|LFGl(?D@d;e57>`|-!Qg|r)RNMmpe}OgG=-3dbnaqD4JqOkdlFu6Q
zALZZb6^zs!JXtv<{6oI0!spkktjOLA9GPu~?ZEP9i#z{;NUuzh-roi3gGTDLJD(hP
zzY^d{6NX|;csopMLWoUx2q!zsc@T=sgXg#YeC}H(FHbO-bdYj7&SQVYNzcF=Ov=?o
zd+6+Ue@?E1padb;RDL2&-WS;9eCam#OT-tY1ahqadVoO1<xe1ElOM2CoN$>ILBeH9
zh!E!2nSVxXa5N+&L~)9Ylc4}Ing~?~cuNu#z@;WYO*HV^;Ngi+b%bt9dIHF3!c!gK
zJtRAcvcTfBD;Gfh5h{mg@ZP4J0@-!1RXzGIe;#koBXBsu@Kz}oA%FO|nF1}x;{xBY
z&-wH~Mp_38sr0i(A+pjY==0ges*h{n`@J3{*kCCow%)~%Py9856LiiAKB6GGBjJ((
zm+g4Y9yX7Ex72e;HlB+8j6j&<x_uWJf2f*0MU%-gj!EO~_OVmE;T?kncK-kKD27_f
ze|a_SgaDtQUm|&qtU7|G1fZ_d?SI0=ZFpBA7Ebf6+bHBix%XEjBwoMs2^G33nmlnl
zlRwpHl`<Klo)UG!*f_H|iZIe-{=r%<Op<9;&FRnZQtLgh;kC4OPW-#a+i^KIuccUL
zw^~>_>=X)d#B3gYhdYcn;tCv>w_1x)e+S>}cRFnkJt>81EP=RfiY`G7IALi!v~{fk
zz36kXYF^kqY(Kt;l2le-pWON3Ee$%ZHoBlJCeeILLZS|^=M1m<?j?!h9!u||_?xcn
z4M?YJr2VX?I4-3omLF196xSe=D4xn2QjfftTvudL*#wdCYp>gEfXDw22_6l;f4{ZV
z4W5@Ym_6h?`YM=BCvdT2?x&MG5=_YCKvp=5)8HnUNM$c)h6cK4cQMP@52H}zmDgMb
zUWeMcXtuGFtc&KrYKnwut1WU#Zvqz6p!d8>2jQ}OhXf8<HzS!z@)eK8;`;t+Anv`B
zfTM(Zj4My5Wd4n<Xb?Yd2YAU=f0pw@Y9126PQQs=D^POPF7B?<7DEr=t0-eFbGb?I
z218^+YDIHD2<5)9kay=ufL+&XBNml-g$4{+tZuZV(uGo$i%){3vz6fv&M>%eo81~j
zvtY8a&SK6`vAKb>=rp>1FeBj^enxoF4@G+wVZ%dzOm*{{roXQ)5&61ee~=d%M)#qR
zvWiQy%jPM{dojIcGb40QFY1W>gouyRI(NpW{o%0RMb@>X%YtEm)ecb#d2u|uGQ2JL
zA<%T3v!OW>xRp*u;kM5&cEAy5MNvpdhW&v#3b>_SgJ37o3X2Bvl?S+pac#eZ+-FC9
z^C*JF{lFIYJjbW!$M26`e;pxa!yQzHVAlDmCEl*(e+JbVHMu#0I2@y<<puM_46KEz
zrEriye;nYTKl%%w4Diy$0bX*w=7%J3!z&!zFy>MSKe;hR9edmBzkmPc!x&59@cIpS
zuW?L=ctizxM2ATx(}2!bRG6>mFke$)zNW)`LxuT<4)ZM)=36q%e-k3e6EZ~V1kvY*
zIz9B+p-v8cZm3g3pP6?=i0{Y{-xDFeCqw)|g!lo4__6JcKOdc7%bUMu$=CdEzUAEo
z-1y+nQ1F-i_WLoS<M}&{_YIc@Yea!HLSc37=Gg6bZDgzL`V*IXL-^)1^2WB;Y`3?A
z8+n#^3kNqm!=#44e?kzLt9Gx|zw*Y%CvPxQW6*$?OduXpARe1QJfT25F@gAs0`Zjz
z#McyvuT3Dnp+J0N0`V;c;#(7l?<f%8nLvC`foLG%uihf^DD6n=V{})4wPp?M`*-+!
z^LNPbKD<I?JTspyrE-tnH;zAiI5I$hO#Zs*5AMautK*Z#e|rNouRoBued$@vH*b%Q
zVG#6%`vKEd8;p4CG`O|Sg6|LZA)x>|(^^w8LI>8{pAnS!*gq$vp>(6~(w9!CNhkmp
zO+wiWc1sEhK&7Uj%yZz|prL6Zn`zublE~N6InP((0nbOT-?PGK${wpK&PRD#;<`2x
zAh+Y#U)48|e<)xP>g;5deng!e3QRP7-@pC}DHGq=%6cwCmoK(MghtYcSS@EW3T?en
z_tbGQSfWfU0b2j`qthIc21|hE4P7)v!P9DdZij|fKFUitLBZxVh&wHtd%svT@HcJA
zT(N7*p4~!o+PnFqDAFr??081SI%J6wt%O7^w*_n{e<@-B8(z;~^S`&lesg?c0vig9
zWU%?C+hAYdJh|YWlLAd(#0AcX3P5D^7x?Ha0Ffb+QU?4?7`H)kJxXB`&$AnY%cghS
z_<lToL+7N6b8;JWgsm>l)@{%$Jl;iB$O4z;1f|lmof9$7naI);$-<{AI4#xl_}2e*
zds=4se|@OHT@MZZ^>Gt5yH2ZZtK^r{zT0x#j^iQcd1nD1ly6<<tqnvK(mLtTF_7v;
z3Gi^7GnqkcxK!3SO_qyA6hn>N>y<q0iMJjsm(Y#|9p^J?Py!c}apw{S9F+BrWWOni
za!byEj??*UHz@<<+a>$q^Zi^Tq6q1O(NQ_-e>!#xF^<|dI=?bTCRqVl7Q!k#;P$;@
zyI_GokHXtT=1l+hZ_6nCl{;h8mHbnF`f@KTb`e#Ut9U>w<6Z6|lswk*81%id-5EM=
z&mJPG{uh77c^vvF`(^9wl|YW&K4y&;a2t@pP5?d{_A!vlG{ON<j<A1`=hXyYU&aHz
ze+h6?67x5Hxn4CE{Ba}Yeg_V?>GXz}75>YF!2-a6wb~w%i}TAgNG3QSr}xR}^aq&C
zu<$#ZMGJz+T-fLKB@!b3<<7tLzXdq3j_pGIEqh=$+e2(RW`2Cj8WSJ-4y1$$!BY}`
zf&2p;P}goFA@*M&*@y;+veEz=aglZHf8NN(;X(5_0<d<gg+*q5nFrJ9j36k3i$1#k
z7k3dw0q`9LTUdN+AS^3F3dt`bUxWaPPa}4e{tL`u<CqHUhy?A32=0Ue?Su&I6$RKU
zBCyvKV6Tb5-cW$OAp(0#0rr*%>>UNzJ0h_66kzX(z&=obeZYZv?G~mjz-q+-f1z1d
zzogNE0EX}B=$eGxoU$e*up<(*BPuu=ab)UFNZ?MW;9ilyy`qA9O#=6t3hoUF+#4#m
zw<K_Hso>s`z`dh_drt!Qo(k>*3ET%FIFi^=rS62Z#7?M7j3mQU5hh76Re(wIOBG*|
z^iqYFB)e46B}pz-a7l7o7TaCIe*hwkl*a(nFM54X*=+JB9G;5k*!a}$wXhqQPz<Qs
z?OI>He6cPsFRhm^YcFa@pv{X>?-GRyB`}NsL4giBb`LY%fl>}gPz(PBis8Q-sNQXA
zMHAm*ZskvOa`m3UKV@b`Yl$Q5R!jIxYQ<3s9lfx8b_MeIJ(h;BjKdt5f5n-^O*U&9
z-G>O^lXpkh^_CKy5KNtXyAKkK;t!^9p^YMo8yn&8A~TE9N%?|!Qa(`8O?dqf!W7rR
z3@+q6R#o(Y+lGjfXp+I%))u8uwsS5cF=oFlgBUUlmYj=Ws_qNc%}a*qwB2i=R|KtV
zh~h?~FEtAA3I{ihtkeJYf9H!|uh8Ik2DaI;u>*vR6XM@cc-(11<E}s}=j!C!Yz4)|
zW+0-njX424cE4INLbiA%v!UPZ@~wi%i6SWPi@v3zp3x+l&ucn`R!|Mvjz=7WXzdQo
z8vS^B@7G^cD}aA;2>h8ukcC4NJfrR**|7!R2|{_b8wKC?1ku#>e+UIfAf5{&sJ|ti
zLnoXiDQ0tOi3dj+@G~1brSgApIcH0B+C*>{r&16GylovihxYNIebf-gKjI_?#nEqK
z(NDOvIxFUoxa7eM9d!+;A9Af71=GXR!{(v=>d-zh7)AGNK$H_W3QQ(`2z`{Se2*dM
zm|lMfZAZuwDQb75e^$cRC@zqLQLlMH;MFpm+z}V3>wKh?)X~U|8RR4ZU%p1y2@b#8
z$27Xj=26OwMaOH}y&k5pJeWjovqa%+g%sJz;dasPCnbsOu#}U1*kQN+?9hH~Adg-j
zEi=FoC49Fa&ZalC2OWYg;C9f0+ded)pKP~npLR@C3<Nf1e-E9>GD)L(4NrEl8Dl@;
z+#b)PX<<2*o{`*1SA5Z5u+W099>Z*OZBH%$8?T22GZHg@E^-25dGobyS`^$Xw~ei<
zD&YG#NQr>KrWv@7=Q)PNLq3IQdOS5kH@G@~C?2qM0F0bkF|7}kHPPl7v|KJ}+7ndH
zu0)e)czJW8f6+(&FO__tk3yq9W)jfVMZ0<Nv484~ZLan|ArdrTqVUGy9h*%L7jZP<
z9LF@jhJn&ViUtbAvE!hASCdP{jHPUPn3a_~^si+qQ5BD&JcuUO`i1ez15_HIqKTEp
zewf^F>C8TSlt2fdDy~V80!}SI^<i_L+%3az8x4^%f6%kG)4?1bPYRDEMt&1;5lT?F
z9jAAWwW7>uO_=Ck%`LU2>_pU%jiC21%kfI!(&ssUM4Rd2i$|Se_sanKHu0r)Wq<Lo
z)pqZ%l8iFzxu~)8V#}0dz}shh7yHM^@zC|>DA>V`2z{^wR^D^yEVf+S#{QI1(DfYD
z4V4!`f7D0_Ac6e0OQc>^ja0FlE%fgqTw)#Ma;1LJL`u9YD(yUmFo_k-H-)A%z#2+V
zCXCOqAg7M^I<zt7v$$tX>-~q<CzgcV;P2CcXR3ojb0aI(VF15l_s&On7jFqauL?qk
z??RnBj|AO?3R4LcwkHav4&8nSHsb!3==uine@h!{3)t+t-r*U8996)aBn?oo+@^2X
zP}RB7<c3$)jCN;gF1TInxDTY{f}6@L-kpf9GrZ`x9!Nx&rFYSEcOv?3`y5Mr!)WNo
z!7aCc%}H=Ri-ye)oDJs(^!9$hbad^{W4vN?E&i_mqhZsRorYL#Y!79C>dE{74rGK#
zf02AB9a1JqWT2{z$XAeM)ZCBmNwA8O7TCQNiwK*@(VJJ6T{>#XII{!VcJB<ytE`}c
zYJF5Ze9`}t&~g(nL~-!H<@qQ9cGGTNI5dtm{mC6O;g5vv4ejB`qk#5OKV6d6g6NzI
zp;P+|&FvNw{qEHV>$%<RIxj4!#M$UYe`&)Ow|GskojPY|{n}b|r|br5=uz;gy5)G)
z;Jl744eAh1aa(PVtME1s9!B!^<n7zsU1|l%BD+>$fRJW!Wk^g+t_%as=E}W31EVX)
zK=3omUZoNAe$ysRw}hWn`!vAd;?<Ee@WN^|f$cfXk=q`A84voMb`xv%>J2)te{zY+
zieolZ8Oz<VLRaEGU#55i=&cm+4G|7o8_*rvgc`U7O=Is6sxea_yM517w%*w3o;od&
zxI<v^)rCF0I=7l}#5a0r=rx@AHJfrv!-UaW2%vMDK#VcZb;9}sr}qH9K$v)Uu9T2J
zj3*^R9>fvoKQMBe&dxk>SrRSde+e_-O3U^L=GL26C$FsMSM0iFe|lkwZ%DAQbBh+F
zbdVr@!ijwS;rP8y<R=nj?wMa0!{$Ev9SyoSZ1-&1j$Or3beJGua)vgtO*=!Mv^8@-
zvF&1U3hoAqY$pOdZg^eUE}C8m9C&xat*^5vzV~BDu%G~Uv1^QHaWtnue}e7_gc|q+
zNbNJzxo+Rk;Bx1Ah=thNH{3@SmyT%=xq-)jw8mb$hxU-<pt*$yHKH0`0Le@=98gSw
zNO~^{nGyX2^N52bTSgqB$6cS+sN;<JilR_0jP19t_;fb?nVQaq$GxKIa>g2b(HV_r
z)H9rsQ8+iAlS{`La5o-3e-ylAY|*f1!FLkWjtxN#MLm*1<U`~_(M^Kg?jfB+JJ61g
z0*Pd?n^@``;^lbQzjTasJje2_F^s-35}q!WN7nU!1oNfRc2*Eh*$)(Ark*_%bVDg-
zlG5*s(-^xmzPh?9rPC5aJN<>M;@05bH?-gjNf0SvR<UYdzj<xZf8(iruSts`yglXv
zkS|lfesWwwipRS2^uMzhG9pMk8MyX&*Tz!6{M)%tgVz82#b90sar9$lJdbNwXtBCA
zWF`^20w*zUS70-W-bp-^2%AJekFX6!r`&r$U@ot@gFt~s*k8$;tLvOOE*kV>H!P+_
z_c%Oms9uo#Bo3C_f2(&iu!D~M1+11PWwpO~^CpWJa_4X6ufT|z5E(LbzmOuKER9$6
zuxD<<z)-%JnlHKS0>fDu;X|E}E!c?eiRZXz(ts!0-jJXT-F9;bH{*Jqhyi55DZ~}<
zhMomQ_9kg#2$?>@>CYR+5D;S;b4c1dhV8D?9}S5+$1s?)e`rbaVK_tD9gNL<<iU)_
zXTe~;`iUXsp~{{ziYbqJm%aWKqOM1w>{&yBH#m1~>^lBPW{Z&Ed2qGpobP1_$b=8v
zhHlCfsGn>X5!O$BOcKdYZNxtK6p)MqGm~!@1MhPly_I&RN7@2DH?l~sv@R1Gsx#N_
zI);cuQ>S_~f4ig;edE5E53X3AQlvehr4_*k4e`a}WvYQ|DLl(@|LhE{pa>LMk|K3k
zs%|zkxIJ|FXmB6OcGb%@XL|k{WqFYW3?I7kJHEGMiNNKjdU?S}$<1|;KHfyhX15OQ
z-j<?M=3q|MB`!r~-Hc@j&g{?l7Ny{y`9J#0G;1ive_hxlW&RX8L5XWAD5`(7dNf37
zWce1n{!sZy;Nom99qJctIf|Fn1pg|3Wi64xd}+vw)od!RZ0~*k!S!&m18Xb^MZTo2
zE*@C-zRbgiWcTZtAAYlDLCET6C&M(rj`!e=2jk!t9D1d;geXzT%Tqt~w}WpvkeH5~
zXvlXSe>4mUgD{XPGWt;H4T#}Z(&QUUx5GQfYOuo#4`K=jK;TFT4V@hq=+zzZ#)Ad`
zVL~M62yZ+X2iJzpPbP?BHetbc8lwaPd>YCK==0FMY+|`g@|6d130lb`NZ^eJ;~+4q
zjEK%Ck~x~a^q_$Z&~q{I#)EMX#I}scL~I2De|$E|2<WphaQlNZw30*q*28$Epiua=
zhR}#-86pDT))1NTZh)V%6|X&*djbrReHE0Z{FA6?46L9s;2>sQ!wV1N+K99~M?0=g
zQl6;<EN+9sy}yD%iHMAE$1rqlES4)@c@Uda0E(2@oyDQl<tb|}(zqXn_mks#=y}C{
ze-YzGje6%njJ>kkc;SL84Y0zt59e-~l)SrTV&dK{6Kk^nOXoRfpuM2DTjUry3Zghl
zvK03TZkDrcyax;&QI1|E$zho6nJ6jG#Y+|T&yFh*ET?vBe9q_k3acT0>QAj(?keB=
zD*{M$*8&HrmIDHkd%|a(b`y<e$fYH2f3D7M8ho~IX2GQ9ihKpWOiJzdNyT1dJkv^}
z$P%@@3E<m3tl^LIoyDv44%Slt@<7JYZX^D4b8)&70xl|e$*f|ZFq1@aQ@nIEJ8s&&
zCYS9N9#OZld*Y%(SAJGYK{>c=(;eoJ-9~BP3snS-7$(aYiaure{s=w-8auR@f4~&8
zWWkjOvu+^84K&o}A3uIP$5xv2dEhjMl6_}z%7ZX(c*iXEW5LOnhugQocNRhk20yeM
z@!Yx-ccE0?2}~&zx|uU<HA(D{g2@der-x;{p22C;)S9vd-}zZMSy6S%S>HWvw^~?!
z&RG;+2U8ANL<faT%1&`2Jd0o$f1$COXu@|HxX128m53#D2}!wxOoJOZ@aF%3qfrWy
zcI<a9m82$nRvOHiC?tpBLAxKR6V^LEmfI*~mXE7r@wYNjWbvfYfU={A&6FccU<9Iq
zQr0vELD=qjqqDPiQ&d3ohJ6>kXVMOn<;_hnfw(K*zoQuLnh=Fd-ZLTIe?PZjR)p%F
z$tx$3RwzQdk&fZymKB<62hlt7Hr(m=2Yf*exrV?2M+?3fQ!ZO{_|i0%7r@{eA%;ZV
zZdA3ie7IJKa;4k$T6_v%1hoCX8zfWCZ7~j-9ROjQ)_CB!UAxDn3(K*{*FLNlXlgmN
z7A)o)Ab&Q))=hWR8MX%<e`nmh=(n3#Vs>{qO9QC*1f4w-)qjXMC_qGV#&RUOjY}1Q
zo-@4ayO-6xF51HB$!dX>tDlyeS8yQGKxyx$Hn+Maie-31Wr^eEvwB>R<u!k>^eKR)
z#RFURCscuP?`Q6-!WK~3RvA06cYmiKBkW{+pUO9Rv5^tLwxOs`e;4}sAi&QUmnd#A
z0dVL@%;w?@jDUicd3?r~g)~o8_Av@MGs=+-F*jlhS2v8fHF%E(Ksc8EB`K17c<u}j
z;UwY^B9(`wkcF8kJ+NIU4?!E7xXk2R3qOWJ5JIyEY%<2friW0U2Sxa$E3Pw=mifS6
z34KZ22XjTt!AsSTe-*n@%9kUMnjg2!2OMm_*J_jP<^hKrg;RCuR@km4D2R;Gk;H~t
zaASTg6>s!oRn@|Lmv(6rCbCMU5y-K6XN0PQ;D!{HhGLO(nw8Y#=#!g(piav*AXIHD
zs<)lF^|JDVbtdXuSwrr7cfj|iay_Ggmb<5LQZ0Aa@th%Te^qC}1G$nDmL76hin;nl
zXU}t-ai0qfnuW=v{}gd4i6PAQ4FwFjofIdy9g5C*GnFeLJz@fMZa|GkJ^K@1zqrVG
zSsF@WEkpl1U%~_t^RC*%<^@zZ<I8K<Z}zboJi@<GMW?{?9Co}z&+8y)hEA6|PqzDo
zsPcwv&YdR6e*~nfJXjZw?PAs~tN`Z6GqOJpaJjzzk}U-fhtJjZDqH?!OOsEu3KpRO
zqA&{z@l{rM|925;G;6{HaR%-Np4(93#rDwS*-;@=aOu$!Wo5Yr^%F?`dM++RzB_q?
zkCF=-6qpe-ke2=^R23d&tXV1o6ix20t6rt}&H1v<f0nIDp_ac~QB*%(<>3-{rctqy
z_$oStif%+Jg4?xnE9hfK4PXI_m}`VabVr^e_gT!N;!1v*Ffg;k*1A0ewaZ~f8gm@^
zS%&(B9%XdccQ%6rJn?}%T;Z%#HNhU?Tw~~tJSZdw76O*XRS?2G>+c-;9he2R^DIHj
z`^^TRe<3B0iTln7<aY0q-Dw*_4npo=1_)%#Kd1ujUmlA2!YFo~o^xf)=4-~l*yO$q
z2A`CYUnPDiPbd#L{D;c?G7iR-LazEFRQh3|v+!`rAj0t&ZAS#JK=G)msAwTwC#Qzx
z$24_wpuvUP?LE8eP=P}y7}))w2BigBdW*H7f1&B3$wCDRe>StOm$Df(-y-4_0X`nL
zk^Ov%IpcN%l}Fqb!LCx286>DS;7(TG!vsgHN_v=}IcvUs|L!%OB`+>x!JGbc3Kh03
z89XAOfU7K~;>35ixK5mQUE7rddi@b;Z6|EuOW1iD$)l`p?L?aUnInjVc=(w#_bNr$
ze>eea;AR=hL!9Tr*LksRmNay<g%8;B<sO7!ZW!VjpbZWH2TZ-iC-fQ`OzeV&wuIz?
zzFIgt;ei{C6s9GUJGLv!;0p}FA$Qx-)h@tED-?#1uS?@WblaXs*K6HCR+L|xn0r5l
z<|`%`DbthTt4xsrHq7b*cv8Vlxy3~RfB4C9&(PwT0QPzbr^3SA2F+$C37d0u1OF5x
z!uLq#d;=xm%#y<>EX#7k2rM(y*ui2kp5}LD^k1l+{_o$GQTppt9icVEXY$#jT#jlF
z2IH1YJF`y-$J6=Q9-kN0fndX|Xi#Y>D>~RLa|MA*Yn)I5oHbF{4jIxj(DXYUf9^u2
zW+G5!)WQsK-k9QnvUn4OK>~JRlF6g~gea56Cyy+TXYF3wgP0=d_71AkImqV_FN09a
zi<(K$L86)Kr$IQS!5N?SheNC+*Qsb{7+Tj+nnrUX;Er=Pq=B8Wo0JIDZJ%Edp~k`O
z9ThCvd_4o2MhgPSe*cm$>~Yt=f5bxWXVFZ=FX#R@?xsi4w;3bQ-0a&}BY*`|g5awU
zvOVCo?kxCi8B8H<Wf9%OX~-n<)A}V}LWY)au%}bmdJu=^w9X-ayp7%;@X`P>A$$ng
zfm3Kf4?iRLB+)LRk@9V^>8&9qT-Hl?K;U;64?*}#Xv7NG0S~$wN?7=ke;{(~tlw!7
zmV=2Z1dx!((RW*T!S2Z<il<Op=titM(K~m+mjV}DI1-)l6%&Nuxp8wB5<%;3OK+l~
z)gM7L{~Rr!aF*c)zCjv*61v}(J~u_;M1*d0($Yv)@Pa4vU<#S{2k;}b#27>e(b<hQ
z0wTFi@4Ve}92ac!e-a7af6T1(UYWKz$Hb^0$53QA#|I)xA+l>ji-E|%iKX>VBBeip
zqeMzB?9Q1Ht9G6pz+^Zr87^@q7KJHbQ<Cz}dU+?(1M1CmA{6)c#eBY>4r!aI#u5<E
zyO^;;G>f7CY9-N}!7)7-*jW-;(v$M}FRLk57m>1o?b@A=(|Mq1e~5)7$T_f9kf|WA
z#+Yj&$TTwM)VlD9m9&Lj@Dy_MtqBw~Hes09#!SSiyq@<ZQ4dsmCArdc97VBx?4Lum
z6%V_E-@my@m^{OSj^Y5{WOMA;U8rU37@CUDlV}!9UqC7<ivxd#BO+yI=FS%mkI+na
zAR6fkZp>8a&%;Tye+<(XMDWTwB$#dz)iGZkvs@NwE=vg!!Ft<-iRi{iRIQQSA(_1r
z(}}>8nAyD=CMxeTJO*~JhK0<y42_B1tKmV--ZB=t-79hAY2ozwnP+L+J5N)NlsZ)v
zl*TibBP7pS1*7@o<tT|0SV3qykN+6iErU6Hz5C<|Ow@^cf4%FB2`uE<dcE^B2|UCp
zdcEV^aPX!I9Z;BPb3kFL$^nOw9v`}fn&Q>&Ql@ZG+4gEzIa7GZynD5?q$x~9S$kzH
zYo6U|b*ND+(ak-8?AIV7#K$OY;uX-c@gvIuyr5#Bn?DMhX82f>C=OX{ii#Az(s9X|
zH$+A@frb#ce-QW*li0S724`Lc2~E-HC<sie;2<g*9SOQpDkw-%aD{-TlGVg#%Gh+$
ziAq_+vXg8XsO6#b4|kR?vQ}P0WF%vBrM!m6OwOn}c?}Io);M%*KH^|*<U9jNS?L?9
z6t=NzoC1EdOc%@4@<rKi=JU;E5-nCnxLW-tCEKV5e_eLyZiMn<|I`%O*XY^^#lSw_
zk%0^UmOb$3_-iSR;j39110U&6$zb?skiqaVx)v9cRrZ24U5f1ax+^srcv>n$24AEN
zBe@J8jdB?>$ax-vb^)?B8vQXV`Pd;q4-)GRidsO-Yyl-`>jO?74U#1k=&TkJ=k_&|
z@G;I%f3qeOhRHIH#U*nh^&Z!#1EUE|xJF&D=>r#4w8$0|{Dm$iPO%j&6re{~K79YT
zn~*ov5eJ!0ujzh)Dodc;#`ch_qSMh3@8u3>05fm`ppJdKTJYIzaOO4aG>wDnWy+Gj
zTiRRlLhT}jkTlCa0Oe@;`3E)A2LyLSYa<Yme|8VFWR{la;k}xn@Ond(SY~nFMUWE*
zS;ASqo=6WC_fy1cFY76hYGK?Qxh~wvMK^?|&<TyElvUu+-!1t}M9h^8Z`maZoK##o
z4xb9yqk>Kf*s~cxPq?ixokPSrjm1s;7bw2&7dp!Bs)AJ{b^ekF)F>ue`ldpa2?v*r
ze-O%Z!vOtUMsT6<MyFnr8*hZBxe}qbyv`qL15C8XTab33<vlJGGw5kAWdi<`A|Z~f
z_z2?^Q=WiHRK6mh5;trWF7dZG#}-+>0t+IHIhqnDJu1=?JCmFQI9}&UXAW(yVdOe@
z6O<aIa7Z*LB~uJult@qo-(ONu?J)REf4gmAKr9)c6r3Rwh^t5vQ>>yA8=ea}ctKiD
zWvn|eBySeGnIr7GD1xN_o7w>A)OlaLq0`-gHgA=rY;H_hB0k$jm#84uYRO_DU$}m-
zJ&Yp$NyDB_WxK*vqY3ZuZF@SE0s{}>*cu+w5!04T1$Dl5s>qeZV(7J=ECfX*e~@d9
zS)|S?wQ9k3PQa=}0c?|w!LXGeKp)202BiTe%glP7X1Cg35P6_V>r>~w#lWq|=3M?F
zPPW2CAF;xfk2S|e8yVEcC-w3W$j({H5sE$@f4BG#VQ6KIJxmaOk|n8<1>eOKwjjKT
zxWD^f$8V2*Z8=cX1ZqOc-~a0nf8P8bDuJ*mB$7Zr=iGXNT`Ipf&IuMTSQJWCAcV>r
z75T_;XOR$5{Dy#TFlapzQ#j;|C_o~L@z4nJ9*?4Ja})<qypKeqTq_=Nj?_w7!>z<u
zBn}?JeRTlBu=Ps1yxo?UwF}?V5;vz{_bJ-_a4)vM_ymEStkqBPL~HYdf6yZu2+*{2
zH~Ox$GyJ8DSJC07C@x7`)1HwM@pL8PnJST%v#ZD2V*VDN)q{BavUJsq?z)<2?K*|c
z&G{ceA_6<OUE6BQx*ePsMEP$8qHITl`|a8i5To`*Svf!q)}-(|xroYST0uxcpoBJd
zMMOS$mwkm|c{$z^!|Rbce?7y|JK@H`gOm24(JMkogI6>Z=9oZiJoYmOvg3D)EuFD+
za<?U_)QaxIS>#W5h$Dd}-i;_w%Jn4uL)?}xQz2aJn5D}&t0-L13n`G>sl?+WK#`1$
zl(&fOaS;XEXxydIN_2r%jM2Y_#+!(}40wC}Vf#$gVk4mKMQL!Of9kKPQHI(h=_?^a
zr7gT|J1${;X^4#Ynkjf)lIoa?t~i|t;$EZEplvec@z?A#G(w89O56Y$nb6~9Mpi@E
z7K*IG^vVvGwozf=n*-{KM-KQ3laCZGsUkI!1|9vHNazIU@`2DIV-!YI$mqlxe(~6f
zuEkDRD7lv;0?frAe-DySq(DgKjueW<wYw}{(aE-M1!rNliNEl#gISOUoJ!GP(l3>j
ztf%b)^6pU+`68N4rF9H{DeIVUo|hr$Iah?8Mquf&d$rvNRGC3gkD%RxfDAPr)D~ru
z^gvJ-?s<w^1&W#1j4ckJP*HMs03o7jkU&dvKI%D?d%Kmse@Y+$p$u;KydjuowAf}_
z9tUW_&9=z_!N7)EX>?0);4hQSR<LIAS;1VColDtlWrRD+)u5hXty3f0wU<w|*6EYE
z3B|qk>WNo^QcV&aNnS2Dk`8>IDq+}-CHeBN;YKF8k`d(dK0y<K27oTHi9aDo%(<-U
zqi+M>@AfHSf6_r5&7&+hs(ut6xIEEGqA1+PW!E`x!zHV6e>8+vTQaJK6^6a#`!45b
zU*x!`SQ+?X^0`=Zf*9Nfb-B}Pdom@0sP0_u>-v0lFIY+KsmFyYl-~KNb<f193a2ny
zCbN~usKBW~S)b7$Sf61wQSYMqoxzEu3nlL=2a@7hf3cK^=aO8Z4sBP-?>>WaT=#-6
zobhC#WFB~eQ`7GewMmAhAC@8j@~kvpVTvV(N&s>E(h{Pfmd1~UmFDJiRHLrRF2mt3
z=bPgVz*J3f(_;;a2!enM+-ff2Z@PX|IH=PJc(mO?&Lg@#Kuw|6s3Xs##qNM4%uepu
zbUBkJf6-z?;K<aos?wDEfgg(E(OXDxdM#pb-(%ra3+%%onlIz$B38PUodQjM*xIs(
zHUU?D!rJmv|L@jlAtEv&NXj43Pg6a^c!XDtM<g;l3;e}=LT?8@-K+7_J<ZCe;LZ7K
zf;eY#6?0x^Ou0KWf5$U-3BAoOp|_h$=v|D4e=R83Mb}Z@-7=j<_hD5_smD~clw&6E
z13BW-Mo{1-*d9Xjj|L{A1?{w4Y*NX~1$nFrEq$m8Yk8#EhKCPx<UwL6-FWtv2~^Rl
z7|ik^eHRc%TBPItPjIf4pYmtFG?f7>If4uFVB*Z7w%&tEc#2fd7#eNmiJ$5hF_T)p
ze=dMF@*3lhoK@X-MK7_A-D`PG8>@c);mDe@+n6y(P+kh{IGIJ0Z}&k`YYa&QqzmwI
zlx}t3B`Am~xpsTFCvdI<9o(E<SU?+khJZ%*@%tRX17&eh%IaU3W%a8~?x$q-4`iZt
zyM<lrQ(6kLz=LV6uRAbHE7yQRAFg`$e`;WmPp$#oPd52)ORm4tRW_UXPm}3vsIMM*
zI{z`^Dth>3+;VN~YE~=eHnFA1s$qKu?xKB;TqV5-ZtsY|dVRNRcQ6eS&;8jZfIG||
zH{G(i6Mv%f21ej)DFXk?Fi0O^p15raZKlRe?EZA{gUz4<W^7F$$U0~B9#jUie~p(X
zDWC@7<nE#DE$O=0OxI;*^-ocDuE8~?%n>NAreqhI;E=hfO3F8k8G}#i%(V<Dtw~Uh
z7V5v|{ai$pT}Hos0xsG`s`U{TJ&ku7qKfa6@xoRj2gRlcXwo$(9k6OWC0YX9iSB~Z
zOJ1?`<pbqCDam_cChyXP`zg}ye^Iw~8~VojaO@fuM?Y$x7ore~p1dOJn#ZR^grjcO
zJTo((jsQb+B<q0td0I+e%rYC{!BSBY3ZhKp`F!J4rSgf!0qpT)Lh7O{6oEBrEN(Gq
zNj4#qU9GO+Fd!6t-bCNVy2%kJ@fa6e!c(4?T&jR4F-Bz4@;sUdw|6^0f7#rR+?gut
zUcMXk_+srvq5+AxO6qgLg;MH=8Saf0xOWuhWui+nsRss3q1MCqQKfj~?T~1zh})cH
z>wrvD6K#u!c&@D?OGuz7`#S37?RNiZlRJG*W)O;K2oY`g6XEPPvW9XpLQ&iQvz82T
zb!`{K6S%=<gsR;;>yLYmf799t9~@aVVDXqC?X<gXaQAIEL)ZcBESLvrBZgc3M8tVG
zS2iAXhJ<F#Wz@M!ZG=(UNLX6e!g(8V{)>{~Q-_)VlB-nGu%(CI8WFOA3ZWr-3HP->
zZPYgqUq>?XkS0p9WoHI`nXD*an-{i=7Pu_YJ-PE^K1Jqig5m=%e^^0$`4cv$GE%P3
zp_LM>`E3OhY7q+2%u>O2M7+a@duN??bBNk~6_nx4ESSI<djm}@F5|0QM}vXWT%gHv
zku=KrVU64gYE&B%=l^oO5;vmBv<)uX1UeSq0?7)FS!_GphPaK=KvcpP#{v^*WzP8&
z*7jT7jNh!~r65Lie~@kDO`sdlNj7gRyQK%_8VQvAlhPuV_ps;!pPkpjX5e@xiZE{j
zBb#IHfbtB2SwrK6og<cMrMn~Eb%9q2Fka+2Ap_g<uKMmy$QS&@`zW67Fn(y#-WE!3
zC&VmPhfX`7_MGO(Z4bZff><o#AYJW%7CQ5`d!|-Kj(Hghf45iMH6bJCQg+&IwHy;B
zbBVeRrc*}JPv_{_R0;NN6p{?2_Ia<*6`eQ-HpodY;R<d;?)gp|kc3LfMlTZpXTUuy
z%w1A@foeidpB>2Jplx&|L{K#fDV$V7lb5iCL_QOZQ^J}Rwk;$QQu@pl58wwyKLGoJ
zkXu+H0<h&5f4dr6vZ>cmYS-OObe+Jc-EyCrAfz-K--u229;c!bSH}$X3Shc{YhzTO
zMIhq7n(1(ExPL|-$)L}-1oMF`BEA<8$I<6IkF+s&T?zShUvuHla;e%-5y0jq_9xp6
zcXqZMB;3sMp`<=lCY7r<hDBhs_bG3$0V{xSd}$Ole?;#U6Qsh$-2tcYZ6(U6_Hem`
z(Q{ldS6zJtRNQRSHtrOMQi@A)cPJEhYmw4YT#6Q_6bTfU;<mU;p*V{>6pFiVaodGm
zibIiapXdF)|D69#PLjDNGf8I7M9wvL?zwT%kgnsXGb(|fjEl;46fn?Ae&AICJ8nVu
z200J@4%R}vZkfqysI;FKvHp4!VS4qU{VMDoOTF|{83hknlie%@%g`BDs^L04v7qPE
z)nLWA>7@kXPBGkZQH_I^sO5wYV&et`EWntwV!NC#mI5T)OPObcU$pSkQ}!>{1sL9C
z*XTog{%CrW8k(8rDb4mY##3}ksnksY#<kIvn<O$Ktg#?9{LE;4ro|zRmP0%KwOFi>
zuv!pCNLbJG9=>k<DuzYZ`2rsw!c{Qowt2ZO@|x@=8HpYC7Wsu}TpE51P_kYy2N-uF
ztda@>WWets-Zi_~O#))0;a|V5v9;j#9i`cgSD`G;26k^RMH+p6rX;i%!Os7hAMCq7
zv}PJCCBQu>_l%yfx5G(>>e+4c{F{O!l0Y_$fyOCb6&{yR+CI~mC$ak4N(Oq2DCnt}
z5xB)OEUi^rL26>`r-mJtHcqJf=74qxnR||R2uuLiX>Kro*O8vKVoIe%5Fh6Vk%AhM
z2*mwf-wnTW_NKDL=NC4n!8@@e{~&30!m!TzUQU>(r2L<r7MBwB?2>_>+e4*(K5gL@
zbBr*n-Ld#QO4{tBl;}my`5WG~KWT4n-XUI&wPv_qP2x6ZviC6}?&Yy-B7l;*;c&rp
z__kom-HcjI_!rE~!cw(8r%EuA-<&s(lAAVu5=%z2#eR-j&&7Yww}d?5n)XI|n~>(a
zn5Ujc%cRfZoO%l$;U~S@gGG}IeB}3Ps8rUeJ2{@if&b4;<y!h{I$ZOU3;cY7MMOC^
zMK8(TH~HmjGHgTgJ8_@CMITVH!0ZPFHr^K8^L4~?p>deBK{3x0`|vRs$c?C9sUe<*
zUF!@Tf5N`hp;YPn?9>CQ<vz}<#S}A~W&aI#ey$yYIH9*`rT<-Ww)`ml_YqZB1091L
z<)3NEx;KJ=6BW6jH4|{6Q_J8YIfm*L#~8QiydTl&0rxC^^6)EPyl-Gy;-ws68-9@X
z0_e+@?Q9M=?JJ%(ebO%J*JedJhKwOcjWOCrk^MlI*}nY!=OlE=ATRk!Lf$hpW?fB>
zf;K|BfUK7rLwnVtDFJ1)`T2$}A$|xgrQtuH$1ug5tDRL0mHq^OoV66@{9_fW>8fkm
zh<1d0^-ha3|CzU^&CZkxb->MahaO^na7#O|ZB$_KP&P-Q{ur0yt9DXFX#3bQvO_E_
zUfFSiF050tO1tt7V$5m7PV(}N$V>s7S|Vu%CbY>p7Zb)oaDaInha#h%{)y_3KB}N0
zP3=QRZ?<pkjDeuA0Qsa_1E(RZs%0|zRKwTo2SES*ioScnTD^URP~Xeyz!ja-52BP#
zuFk~O_Pc#gEz3i?&`ee@D1CV+=+f?dIcVh_$x3zG^MGf4O;&hcP_Zvjq~npLmRfAr
zi25$fv-o{CGL_~<GDBU~0Q9}AEK21=Qk_27QR0UE-S{pjY;#{pvjggqRZ$+AP}~nT
z2L>8X<%GNKkWi+%;?`+`jUR8NV(Q0Uo<(9hYfq!|AiYlo--hny{3Og-g7GtN8gLEg
zGUWK7{SHajHxT=zF$IbZTbvuR&c(Zq+OjjC=h3pW0`WDrV67a^BjBJ)z!%WM(dn(s
z-co?A&#&sEsn$@<cD4>#yT|%BNB|Tx6r6ve#IRqt>kLeRg0fYHf<lCh933Tj-8XzL
z7T&y{KYBVl<>Y+uSrbhPN1SneX<CdH{FMt~adeEUB2uA#KNJ1q^S*k7gJGq8gIYKP
zE0@P*H(!??CiwV!7b%Q&y=<A`*(+3*3n(J5d3*~O%fROt7SbK?*x!o=tQZ*0A8*4#
z>`mw&{7<g75vKR6%NK{Id1Cu9<1NmfP7mCTO$IeYqT5T4Up&w6?(Xi-bk=?Px2M+w
zZ+6p*CigPXeWq%rbcl9_+n|e=OZ33?W_MhhDeY6vl+*{I1uOKSG9R(QE!zXS2>15+
zvWCxQ;5W-1lJ4!@ekDHvs{3X~%Ex!YP0xs&{l&Y^Phf?|@2(MpkDZe4*a272;RgCP
zsM4eTXjzy<nc4Ve4be{*FW0;8LhDr(@n)$p<0!C2?7a=d@zwQJ8*M~&reP6pS;)2q
zd8Z_2w@W}a6fd(4^PYD7r?aEfOd8*<@>4L>^|dbT!trKH#k>VD|D%+ral7}=%#q33
zVNOij2kwiBLD2e*^Xd21%O;taq5j{gH8a=l!g(cP8?GW3(Apzd$o8zObqlFFU?`DE
zWO~3%b;*>oW>PpQJ!A9dA|8N;>+JRC!Q4FF20w#=g;^^`_d`~j_}eM%J}!!B_<m?E
zouNz9v4NxzwXp%Zr(vtz;<$hJuWNG86)K<<w$PY*c)0VS!vIYK4Kr1`{Z;cJMeJ?k
zdFsO!cJ>YP<s*T}ODC9HV^}d?NA+|BeS1X6HWM`FwVCY?zCZ+>qLF?u*IgTe2>aS&
zrmQ@s!xg%9x@YSKoBw1wWUvUXt+$i#28({5$NF9oyb09OtoinvJJ^c52zY~eDK}e`
z#99!j=-bWwuMS6w2g_<?dk}9^cpk7~-7mu|CUS@sd^3_MNG@tTG1c|Tkt1S<g=}ZF
zkOe~~J|&N;`K{EM-n{dcx74FuT4)QXWvyr@5;q}&EQqkk20j{7xp?91PR;GjbP}oX
zYF{McBZvNVR6S2@Ypfh>l{#JJ;cDbh8Q*kx1C9s#di8D1;l?`7_kTBq(Su!%NlQ<@
z+b>^Np@JdF54bgD-n%q8?_conejO-i+@*Zuv<z|?IX#*fXc%k~mQq@TZo#3RzP<ql
z2i}R<D@Fk5)-qRr9`s|B-Tdz7OfRC~`zY*pIxtD)T^rR#AFlE=n`bL>#MXv5(eLR9
z)$t!&`d=M`<?pLhlt@g;6SQgWg%pTs@bB!VdT?+yFmNrPbpcRJ(^)m<23$;dGk>o4
z8!0CFgwPcGr{+K13S&Kg_joIxBDZ=(oZD~Jlv|y+t~EIflU|b(Sj7os#-3G=btmar
z1F>A!*#falR%-+&iqy)90_TyR#kq!(+`n>~kK-Ac)Ek||9!Vzo?(^u8VzMk=F-DUq
zVu*O7E4@|fVOMv5!nV_@GwO}`?GO|w7P12xD0Ui=>uouLr%}oJ;ia{ZzYP$~d#@R=
zPROi}nhMi2o#n_kBjnIjUWCdOR#N5$1LUGbUxYkunxY9&6R*iVpbA$>Pfa(-cvqk0
ze2u#PO~iVc8F?%sq4`XYF<9fk%(L({NWgEo{1xMtX)(|<s-3ZLwFL=hIT-zWy(T0t
zN#^GzP?PmVgcC2SKGrtL6;BW^PYzIEw7u0z!aIAGFzPpRVDPuk6gNv$^6i%11W+Bl
zb)?9#BqQu9ATpjh5%Ju4pBL4jS#q+JP;+}7#9g|)SvH~EM{KjtD<E=-&?j@9=-D|K
zef+?rJ*Svm)i|)b6K(N9HaC3dZ%n)O+`6QQZ7O;N8YPdjvBcvfM*nD4LIS7Fah2{e
z9Y=CtF9R<77yShhowK|r)4Lrx>wp(nXQE_XEDG&4YJkK6*ii*P1wpD8QT7GXjfs(L
zw|JR?u`Rp#EPCwncrYiG={Mtx8OLlzi9_2jA03)Nvv*G<>Za^nsMt)p>yy>0v86s=
zvD4ReF1~D>c0dE4QI2p*YB9LV4Eg3h6@)<4M6EhCcI$beSi{5-swN}5Uck>twDg1<
zCAde!JN(b5q+IUdnF=XEg(}sbr8PvT_v7n9L6%hmC7P>3%}<o%b654z&l{o{*8>6r
z5<4U}q-I$@Mq>Q7#d9_wxN(^c|I~LbKx&Qg(zXbLClUt%rNrsQVfxDC-7C_qZ#(FR
zlB1mO7-S%$(Y&2U+OO!3m<JjIP&^q;#;(e2Un&YBl$0P;Ul9T5CsBq)`8ZE)Zzv6z
zsqpXK7$$czAp0jAVUoy^wCB^6PKYRyB82SaSnew&x~7b{TD4eC;wT8pmp*WxF7nhZ
z{uqX6G1tK|5N7hTEX~L`Y6mlR`%s<T(}#ai{E<u8>LLd5#e%sz09%VM3S+IItN6Rf
zo8%W;rJZ0_smk(Y<v>=RH!@zuoFMuU`vVyWpOB&*AAwm}lqq9{s^O>6Xyohnepf+b
zY+HW6#7S_azry3yl(g!4YHE#tWnU_Xi1B@7^&E-|h~x;%f&D#+zOBiTE*kayXyeZ|
zYJaAo>Ju4B4|VeZeEihRP08HI8BbtE4>wQv*n^o!vq-}=y^|3$&H<-~LC0%u2#xA`
z;|hrr)Kz;<AEm$qJqw}w8V2dBtk)I$E~+K;7^0hCr{q-(f4dHRKC&eYp<^<vTLJ6#
z@ng(sN3_JV9TMGSVhXzL=BpQFhk+5q0-YuB*5pMMf4*G6LRDb$(a$X)Y+vck*i{}N
z%A9dNTauX)(ydi}YHYv2py*$tbq2$_31PA-=EdS-QZ_-3#W@^LX2%r8E@spA7^BLh
zt|u$JGs33z^B1RTiXyp3I=jWwV4aq=37G#(arPaTg~3Q$dq8?f<3QO!6B>PFc5zqR
z+nq_6V~Qe>(ji_nQ0)IUiA^BX=?YoUCE6*eI{n4CRawLOxM)%>J7bQhO(!dB_Ne8%
zOWF$V(t>psia{1(<J?Niv`jbhtb%r{`vNb6xp-#@Z3W4)Wjaw0m1H?3(Zhh7Uz)5k
zsm#UnF1({3Z7EzuLNHUu)xRY`Z2v|>nmU$h(x}=2N8dU#9zO4dam$)Edj~D~gP?tX
zBXIo9_=Wzqhw4NOh79AkX?d2D73|KFuwMo;qpU67N<0M#>`W#0L@bdwH|eBtpJI1E
z7)|gAlHRa%oF-TX%TC-zL?Y&8zcqXbnqMO1iwZU%8C_GILP3>?($L$!;rCQvxYj)=
zHA;^JG?OIuZ}}oUG;>o&-Jj)t&VaeoIULvu#$N_L+Z1XAQFEawx8+ELqxrmRi!JE+
zmM)*r!))SZ)fvc98WG?2Qwl4QCB>%W4acDL<F{6oJWWrluwNNl+4+#2cFUw)^xU&c
z^a^o-owhfrZmTAF6}0x9f`g>8@9yQ%(u256fXEC}2m@+YFdi;xUsXxgFVako`*ly;
zaMTag>TeIVgUB`R(-$Q+Pv7<NH(5LcByrk6=JFWVpt+T#X+Nyb$Q0@`L}f)-gzRsV
z`=#A8S;q}{N2NVd_x9g#|Je>C<&qBfJ<3_z49DP=D<cqT+~y$IKFoT>$ds2N%Pl7&
z3Jk?ROinHKWd@NMRpU*M7zmiPa_(>$t++eGa}@`nR$y7~76!$nCGrl^*TaVLTbsuB
zJ%uTaMQLM~wIKVP(uAs6@&>O=`3`L>_g%i1(+z&~$x><k;@vz}Y-b-emM$%7cfgok
z;wE?`vz7Dp?nGW+WM3;1{AD1sc&pUM4<LMuo%#DYNR_`l5kR^Sa=KMU|L4tjRdcdH
zQ}2h(g<;jCP)ph8LRCG?OYnuoojJcfXtVL&2ZI-t6z5i-XJhTHeJV5!4NCGdu`Qys
zaElB`@z&rSiR-we@{gz0h8UaVGW~0!iqvwOLSuwvyI>bnQWkZl5vh;#Lxct5fSNL+
z*$_TcpO%>JR}#h0gy1n2ncdepjpd5Y>~49F5(T%k7`VOKIZl!$nW{U<nl}nr47`-r
z?eJvZblh(@4@}*KVF%H-FN}}B>46y7s_Y`065M=z(*zp(td^R|#Ty{jZDTQx+Fpr^
zT|X4Q2D$1fyx~xEMN21s|4xp}5y+)r$G+9QbjcZ2-~pF6<#y7VM+~!!=LxNIG}!mL
z3I=_k=s3V?PB^)^x9l>Wzg}BZ0No<^jv*19&r7GYkCzzPwl4jUu7;cLJ>C&v<C09m
z;8st5BOfv@B@8a7CYOr`W#jf^=k5DBTcya(xzCX_tZw9}IU!0qsTF9DBVx*fPG7aE
zZjgDdqp7n7#oPquz_&A1SVVWffxHG|8ESDaZ#F4;wBQSv9dmvI3C9ceXx1f3EF?C@
zpMv>gd)PK4azO)S{%|XLQU&m8@t#{ULQr<kT9{<j(R6Mqt$gik58EAjzN|g8EHn}?
zD_98K!q7Y%0T0NV2H;lUb=mL`=3t-q3p@|!<+ap<Z{sS?omft_qcdIv#^`GjHJ)Mw
zYhCwu&Pby9k6o6%vCC~T&Z#&~s_`hzI5aBDs<_8^kQz#WT{_F3ssyX>i)oDAHfru9
zx*VN_Sj6nR!6GbT5K*%rP!DU>$&zHaNppY)j&p^eo?>(bU>fZkcxKqX+%&4l_N%*-
zB^QshC3N|7VM6?iXn$!v)gdy><41hs$GjS{aS_p>8r*_QZnEWKe-_<g6*Np*T=M$F
zSE$R22|2(5Gu0MdYyL}jMp)v-rtOAJ9&xF_Y&YoVcfTiL2<B3sG38{Wli5<4+4Nk>
zfdLOqHbFHYfMN*CC2QY<i`*jSP%SExL8V{lVVE0A-@z=sEt1@&RpBRec2x>{#_l!9
zSTOZNuzl-Rr@a&xM%Bt>S1u76z-9-YD0Z%%l%0E8B}3k3U~89map9mT1QUwV0{w(t
z(EKg7U~|Q7-sAb)>x`cGhJ@?y>T2C^sH4v79Rd*`qIPnCNU7~DQDF~TLJWI*ApAf?
zq$UhrHuk`B#^qp_wpLCQnDP2bXz}fHA^ajT)i59y#I}_`TR@sT(>?HMlTkHMXzqC*
zmzfwg{4YiMkz*;X<IoezX>AfOmxahs>1H5_%LUJ*QBg>%r%tE^PcFNMDMQSwpe<1z
zygCWI*pA#E6my%&K&a5uDWuVKx)Z24@wLG@tlPbw<+m5gs;_Ikj?xkk8Y;%y-7;lq
zB4d^0IvZj=^w8=P_{4-C|L*uTYn7}z+D*|;`|+%$eb%vu7<y6Au_u`@JF!Fq<ADj~
zbQ<JEK0_tW)5~t0HP7!8+EE8ixgdK`Z|yMf;<)N!(6q_4{r3~d9N(ylCSGP}h@%5z
zWd;1i%hs&nUUYp$j}64To#Xx9XK3q*o^qjqfSRA~f)xLnyF+EivJzgF#e>^Owt_z8
zXw`i|tXP<d&w>eY*kr~X#a?$rAMNu7{qFILWnf5Q^i!$3@lN_*!|O_|8dN;*U)R!r
z%nS&;++~b8qQuKF*;+ABdQR+eH;lpC3+YJ(w|1peMj%bO>9e7L$Ze3R{?sPt?dQ8M
zc(s*1R}mm<T75!&-8Wj@O6yu=rX9KbQ0uBHpC&b?HKdis6}#KAEgoQ!y}-h_PRk~2
zKXz(%b+8p0bf{U8xQ;B4HJtnsDhyz^MWE^ScxOgHw%BHOA9V~?Y;V>cOHXN}v5$@M
zjVIrYeOZuSYoII#xH0anWS*tQDdMk`QPj))cop!D@nAOES4V%?uaF55g=ep$pPyS!
ze6ENIkHS;a(cgKg$9NnSZLFgo=~sw$r5INHg3}hsgGWW*Aun1YS3tV}n7U6{&T9#r
zA)@RHtj)hSXM|z@vV8H)I4~e>n3lO(%u9%ILjv|gyUlVtO+Ib)cd^NyP`QwoY}yLp
zwoPZ?jj+?7mv#8xNY-IedfnsKM2nM~2BH^c$m%Vifx?W{>a`dTy&m@!pU49pf9&{O
z=-_PyOX1pDHc4ol%>&UVpyILreWGj{Dy8Bh^Ou{+th23+C25|BhyL^C2f6crR_JZ|
z-}(Md0EZa21N$023grNei!L_Pp$xxJ3D#IjaZtd~+aMidB4SjOQ_T0SzLF!tDw@aC
z+{X+5W17k%<5lP;aT(=rH(0K@H`4}IC!lf7LD#<*KF|4z(UTbjSUp@x28+wR%Fw@2
zB{AI;)Hkap?ujtD5@xGhw!Iz8aZ&gl&1l_DQGq6qcD<-|Q_kL}L5laMA;+s7o;0uI
zgb2z;Uti=jfXFTZ2dX2yi%Qb`umlg2B&EiqBy+8So7ua(-Wy|9U!oP>lvtq_sZaa+
zVLnGnYu{EYZI7w|O2H)eM`xFZmw)0qBir2sDQ#RkbqkaikQNA61GfV20tU{jFIvRk
zedzHFJbJyk>I_DZ+|b>~%s2h|h+duS8BDKqzdp1tC^0U&D#k?L4RIL}rHIGRnD{}>
zVRuY3&GP)^NIo%_EAC#2?=Lu0X){+@Vys1S59`w3U&-qL(o|hJ=)M2I<%)%+V0*$L
zd_2Ly%50T_MA6D)tv$w-k@VXrV|S+Mc_sBxWk0<6Ln@A9vYQ~r>b(<PtEvmVAY`PA
z*FFt@M=-tgY;m9#byi}<XLAjS4^W^Y1!a0Q;_8xOlSo?N`&ykV2NO&pysDd!xoQvS
z$N~;IfRn9ttUL$mVF?1l#YmHSUR=L0<!4sc99fZWAw`w3{345bUgG<a^)|83ddh82
zlk~Ma#$wIbfRpE6)r}l-0i8R^r%p%PkPyk1j@p5ejC4VkpqPx`_T`9%wis4aRxSzd
zI<~inQGQf^gkflH4|BeRB<bmzL6w;Jmha*oU^1;zmT@?=?8L^88`zTz26auZC5FjL
z;7ZFw7@LVcPsA4w$VRJoz(Q(Z%emsj{UnpC$sWf_`wpfQ2Jw8o&lPgtivhj%Vjy1k
zu8;$Nia(s7^tY_q2n)KGKSXzlrDe={Sg&{N8b@&$iFp{wM_1ctcOgHFRoFc}+65nh
z%aGQ%jWQaFoB;hKU)iwz`xFK)BX%yM`YN^QDz)Rp_Hx?R7^MFw=vcW9m$Y}Sq*yC>
z@D?dqzw_)H`5-1g>7=DE8ntz0sEFP1kglbcK@aJs+DKFlwNPp@d*~_&YOPXHiz^8d
zY6OEmr=r?c5-_~CL1`O7`D%dms*(U;$lH&&k(NCY5F?b@E49hCU@!`aPFhy&X-IUk
zQ;jN=!uv`s|4Jy7A#)#Ha1#5gugt46|JtD{nxhOa^usEe9pq0NnXPDo9+>qYu6!XQ
zhD;7L!8aIwW8}SYASU8T?j9#w)Z*orJIgPJ8~iftt{6t(!PZv{6L5<(NC-c`7s1Vk
zt!Mg#g%8`<^ocN%4kuty!14_zI3u9mp%xqyvL?1Ee<i5Du@|vNKbkdE8A8uh=ufEH
zg>~dlXxWAJANoJ*dVj)?U08Sigs=a9ev&_-YZsfVHs1Ri5npclkZBh<onHGm*k6!(
zHQfB++0Q>dk3_l}sAzQP|1WKj4h}>YLPsLQ=|_R+!v7M?0J_}2gdKn`K=co29HeC{
zJu8QbBF=-GUIw7^{kwM=K&Jt06j1*cLbm$kZR5`C>SFhQC-^_a`QI!ADiUqRKtUn-
zH(P;%f^4D`2L}hE|F5#Eg_Wa)oel3NSKI$q|8KzhpCkN7{d)*H+kfNNx*C{R|485<
N=QX6*HxN3q^*=Runy3H(

delta 82504
zcmV({K+?bewhozr4h>LC0|XQR00000BCd6j4L1WKu62<|Bm*L@b&+n|10t?<lT863
z4<fF0RyQlIGHoaU0Ni;9lYIdie@2!t`kzmM(X5%4+@$1NGTlzB@6ZzEC@o7GUE*YV
zdg%iRP(+&q*Z?S*GpiryyvBL5voBSJDxd%qDav*d_gZO-K%uU?_Wknx|M@tZdUs)(
zMM?a6>)GzpEia5mNf5=iueTQYxc8^6|Fhru{$CEy4z7MVA9#~|Hih5#e~$;B#@Xww
zNuJMN?d{#)-|ybP*iF*gy=Q;^^Pl%VVw){&^lIv3Z(-cKzTEQkAJ}uR=UomCu8z-6
zUwP+ga+~_I8I11rdN@w#2k=iG<<oHg;QIX1X!6dF7yk77J$~K!eir7w7yGmD_11@Q
zd7q>~w&jhII1l6e^_KSKf0nmrHopzyF!l2!)!M@@gh4X$?q2NvN96;5kxz`)@1oJf
z52xORcX=O%dF2CK_QJmnwNJ!`lp2nb`7(`eC%M-0KtA*SzyH^J{`C2?9{k@6Z@Bc%
z=3#uEMsW_S+V%QVm;koRyo)dk)4MR(tqdSeTkHPC?o&K?Y?tNBe`)CD%Q-a6!;ksi
zD9g6?zyFuN9vt?s`hV>VlVIunZ^!e7{^-MPnk?erm3Kdh^6)!&I7+5T`pO$l;U)ea
z!w9{xKZ~ZzS6=4FSq~-^jn%6x`k(NX_w4yR|E}}Tj!zw%eZbRK(<uJX_54?NQ3m4#
zdaHkZ`gB}0dNoO4e{ovV;(<TPqr1@fbo6wDpW=$T-n{Egp22_5;lCH~-%I%K8~E>A
z`lMkUFmBkJgt+OjlHHfsWm`}8qWLhH2H3|O;G#E7L;piBinAzyJ@N07DB!+|?|8eO
zfAjR;@T-}h-bV2&?<qBV-rTI0Cv%+NH{pz$zo;~SYBV1ve|etFpmYABuA7(TZk~O!
zPB-6Fx_SQ18r^(b>E_uQvx#Q6yM$4wxBDo_C%Bv6&OhSYAiCQ{tQ4jMFxt;KwZ}`-
z^QX}*oXiMrSD4DL#C6N~BL+MCYn&v|iayo=VHl2+6ais+?=Lg#V|O(5Gx&Npj2AP+
zR&a^o*LV?+f5e|zo-Rf?{DJp32*>c(B8FFdVF4Y6soH}qnMQ&4eE!h`q`0L1gD@MV
z(L9%5=)3b&?v5HyZ=yDqF4Qy`efY-$7Nw0V2h1l?EJnmvAA8xv50d*=-V2xs{`U?1
zm);Kj?Pt&bqbvV=y8HZ_9UbPMg)<xscPv0!1y7#hfB7`urMZVVy$g3%{4w7Z|EBPN
ziz)rWx0O3TOX4J(`y;|~ljVF8#u+>%`h$<)N)JCod9U&c25lHaN22wMmODs$7r<5n
z4wPHC+WJ!g(}=How4PTuuiky?&+Bn5fpid#5{9`~UYx`sHisVK-6$R>mBlCuU^#vD
zP9S1Me?7E|`zOA)`~*qTD=*67R*k-^!=c8S;zX_p(5IRuB4y*(3**;Iue2V%FaZ9&
zX*kY%sUJj(tk`MoJ<;Y$gYh)+VTSb5I4gv6fldTK2*{8K0)AwRq5Ms=nMRq|iXPr>
zc?bp>P(#p!#dR!!oIy3TLA`ymg+PjY>GgKdf66v#@w_~3b3)I#yWAg6b>z?kNSONb
z3|1xo(l!{+l(vngoCg-H@=T#IZI=;~$fE!*Adg1=RAOdW9Cx;h6RRL@d??;C4sSs1
z(1uyFauadx&|>0(fc3k~c<{TLF{{hrK54A<Rh&<Hqe(Okw!^zH-f>1W;#_tS(%KJ4
zf6&Ee#5Ne8+LtTARXk4l_Tut+BjhI3qg~_L$4NS4)LS`k`r~<Z`_w(G0|spgCXmUw
z8$&%8BS{de!cXl;ljqD}APUl0jaCZ1_r$wg#<~B|o4{J8xE>UPp6oFu9woCGfQZiI
z27U_X9)__(*Fltq6<&D0Naxc6r2~I4e-tn;x$!i)FZxJ@Y*8L*wDgNcz>MJJv?enk
zO)z`0l0*0a4j3>K^5`j0sti~1|IET5^1W>!OJfjJdh~5C8%@Gl$fF2|mV!tP;nDc~
z5mAkQ!hgQ_!uHBa`iiFCemgdsx(ORa2ji#TatHtH{Oxc1-|rDF2Z?J>$hf#5f0THi
zdBo>|_=SM6RWJ2Uo<Z~Zeo65Bes4~XA0jexAHbW+so>mDST9&R8smH#`dR3G?|TzC
zE!G5NulDwCqkOU$B0TOTFxXrSwl`YLv%M(G79q%#;|Rc>e|W%6zNK%z-}Cq3mH<<d
z+yO**<1h^Hc(DaA4;ipOqXh!Ff0*N*F(V-F#@=~R@OlfzPLp6kJnPo}vGxnL@Hy`l
zZm}3LgK<Ld-?7W@aK8K(P`6>~r%Rk0@F5@QUuYLZV}Me;baOw2ElkE9b>_zbU`W7(
z$B44yF!$t+<5A`b0EM@Ge15*;(dGc4?|N5F<4UeO^L$|9{Lv`PGJsJyf6gc#O&5rk
zXhPp3Vc!4uDR)9UzB~E%+x)xl_vnqs!pg1!6PzvV>(IyUXqUsrN%Op5>iow}7dfxd
z1mu)ya-YHeM@0L#{rMc&HDVaE9o#O&P9TlIqmZ}8_XyllZyU$N8y+mCc!A`WbiFVi
z?b64$Fd3hCAlza&C72cWf8B*%V6*8P@9)VF9^mF@3DAo)pX_?SBnyB8m{c@gin)q$
zm+<D^htF)YTV%Ly-<u~i8F}Ez-2cY{W=oRRB9$ACkbjelJ?5k27r4JSKU`g%-y9B(
z`qw8{@*IFm%5ofh<O53_!g#R%_aHnN)6!v$j!JElI6>fHs~~^7e}Dy}Vgjz&TlF`9
z`wKer_c+RZ8qvvS$vD49nA%QY5Lo8~<|9tP3(^R+MLYO3$0;`7j#oUV1!@SV(LM}y
zm;mvlFFiod;_f1#LEj;uc--&6>z^NIU2&n|yVA#LI9(!SqM!o1HjZv#--7~5YCnW+
zf$@0mvbC2j=5qiHf8h1QQ8bQ5fMR?+$PDK+My?`f5Ne%IGy|H6>mfjd_2hmu&35(g
z_Gl}LTLyp&d;m-yjufP`#T3B}HV5W~KpOzVHU*3cKgVe@qrJ9|g10~|2|p!lDyGly
zcboWA92173y9v!a?NZ`%+zVKXFK!QG<QOj|KqipdK=jBre*$NNbM+$P?<Fb_-zJL`
zV0s>fuzUG^(nHac5K8~0M<iX`%iM?cc%cv15H+0wi_p7?e;3jyl3;k*GRr~I2Vojm
zhvHS3YWEe_LOZ}y1qcxePA>-Hp{Ut>|1tum(od&Lg<<GBz!_oyVxDxoMRyZnSM3Mf
zeL%)|M4|=ke_}F(BVoh|?eazDp$LhS!Aa15;%revLuzJ(Ie1Nj8=Y&jFh@X%Dh1>#
zhY0cb^GTA0CJ-R{Yr+fAaF+ED)AUfl1A5w%cXDh03SWBHh=yR!S4eCR#Y=@b`rh~9
zZ2z!8zu)h{Z-g>m?I~O%1_{`!g}8l4ujW7%3M>tbe+TtN6vq288EQSDm=Us$3Dya`
zH}*M807uE$W}@2^Hy|l!p|6t$fx?qH?;`<wB$4bWg=;T~CQL}qr&zL@4qc1wAI}GG
z;WEMjb-nY$BYG+cRJMp%q#et}Giw!7muK^0r^HFZY!bjsJ|dx9-DUU)sM!LEDdSmY
zh4H+0f2pT;_*>14pkV?mAE7Sjb;`REiG8N)r)JU5fgc|(@~~K0EcS*iJ|SHpeA>#h
zq#>MbmN$VKK>R$KqU1kk)-~(l<PiAa4?yHVJbL~-0{&LEluT|0zz53!NG!-6PzVKt
zSMniK9l$sS4JFL!$4l>^>mB^@k6qlHv*F)`f6#N_iTN;+oP}_W0z3gVVb8yX>r8TN
zs10$){{Ynjc7xz577PL1)B;)IMa1s`>G~3eak@O<I6+)Y%|pS^WfMTo_#d+&a|Aa)
z!G!qbY`tx4g^Pr*ckqG&jumJHj_)o?lb9}s!gi&>%-)cZVgT~*fSeHQ>P(d&<Un!v
ze~FEe2P}<Pz0ubG_bBDb7fPz!+W%K(NP$ZLCN#@~D3J^(et;$>hwm!PD}QT#EXB~R
z{b7<!MH`0w8(htHO>0z#%GOUt!<)d*fjZSRUc^kY<p<-be+wiI=SG9v<lYnfcc+8m
zUQH*_Sbn~ZZF{&Tf{}O>?vRv7vmTo>e`X1KYoBT4zh!&>mi>3kKSXz3Pj!d3J?*FJ
z{k!^Eh0`pQJ4<s|<k_~-A$(o`c^U%W6sv{Rv;sz14njJnx+9Db=W<swxPK03$2*P(
zF^Cs4Bud#fvD=4(%d4BClm6Swo71z?LFs5&xv{nX?CH~|Y8y|lPflvu6^&Y6e;0tq
z{jI%u<*sSpgxmlZGbK^?WeLq9i`M&yZFH1MjN8xn6wv2OLJY?-KL8k>B*;P_bvO<0
z5&a^T+}+(}5}{a7Y;Xivi5~-+S%9#BgbwJgclpEd(bXRh-W~q&6lB31X=@fD`BtC8
zY-WfQPe2IquIQ#>KOhf~xB*Dme;=Izir0A4IZuV`(7WCNJpUl3`B6}2?2t9HY}O{)
z#S9{S+NB5KN1yN>Uz%~0W_cmC)ORd4##i%TG?k=FM&cvOcZj@^rwH{~C~SNj>yP1B
zKp493ijD*&!T#PXqG{lrPe2;axL;Ik&3U;W=lG9o3fuX?djl977*aase-lZo_(MTo
z^i}?m-l&7;Z8$@*4-TDwF_%uqIEG2;+fk?&fGXlPzSs?x@TZh$rTD;Y_7+*XH%&(V
zbgyWm_TvcVJw;C3+yQEY*ME0Z?v=P5kST^fv+XE6&_j8~lC}wH8Nb{0ct5dyx`@4P
z1k(#rC}d$M2z*tgAo&{We-*nOjVc%H?ZJV%UPtoQj2P^DD0_D$YzS@=c4Z2z3a^)G
zbFpG(TbC$Mjs3d><aAhM5CQmgtE;Bf0yD?#C`ni#MG=_BwC3F41H`0sRwK&QBGg7j
zd6@&)hjn|sL^2ZpcmCm42;*L_HzJ})sQAVI_2ha=jQ|Q{lg{oQe>W;)HD+6Qz~bXV
zWx|s;G<9MbDHCSEq@|C|>4~mb-Yl3q+gED7>Km3P6{aEJ7F?eM8Jhy~K1n|)@X_IH
zYyUmJ;semcs!XXS4-HiptFPcT5dWK^1|>sr5pHS(Te5)pD1i`WNpr#F6%rLap92!k
zc61#=mt-l`Axl%mf0fj@9eEgq224(hxHmo&!pK5DfPX7pp=3+sOZi(O9|Yb&ifnsX
zm?LMMk&-bK>M4U$m2yxJj{U_nS7$?d3ONQ&onEVHNIWWKL;OATGmy-6(H%A~8AYU_
z5(*FyOZ36z3Kz2*(UZ`JVSoIm@q9<&zaIeYz|BTHurzQFe=9+TA>3YeA%ORY5K+ZY
zoQfaJq8Pd$mo+>`UrHbF6C^hTxvmG&p3p{5vqUPsK!jPsk-$=eC>x>0Vp+z25*?2g
zDXF$ahfU%h(h7ueB~Fw8{fOUteI;&`puG_7lr`aB4c2aJzW_z`P@xZhUunpRZe^(R
zVlBzWWE`uwf6+1d&((wo2UZxUxJ$byBfLe^F7ffj|LES%k&C)vW~ysGn)%rW>o;`Q
zK{U#}(Xe)Wn;f-cN9lqA!)41WlHQV{MJi$eb7+1|@@6XQLheaiH(LP39vb@f62o6+
zHi`-0cGi#2yy(Yhwg4%9mMmi84Dv|okU<1r05_o&e+|fBYEuTZJd38lP=r8300MiY
zC{2Yi(9kQ2o<4-(oXPi{KV1+p{|2NIyu?%Ft?wlf7Z-BIdPZO+0?XnU1j@@J`vq%(
zW17${U`AAC(1pNtb$J{>w$uu(-M#+_(}X7lZ(&iuv7o9_UoJ9Hc``>`RhAI8gt4+L
zLL<6&f2`~pd`u`0Ny-t8NsV68&KB!H*sS1Dgw)c~*c3L5ayYzcAXS2->L%=kJQmq)
zfH%skq(ifLp%vmbAx;2B+(XLg&;22AcsV>{o?rX&51FT_zR?A!m@ywDoG4DXK-iT<
za64vXXLCPgn?P>c1a5lIEIF=(l#54&c+({<e{>9#LY_})p-NdgNwT~!^XUu>h_7(F
z^-FbraeR6;xVSkvJLs#klk~NEQWD;9NtRv?k1r3-ei~d14((l8&bO>ElNPg*x)04Z
za$BkfD9cn1PWqRZVivEweo5VI5d?G_kfpz){?A%(V}F#Pp#hKJE*gbyedwEvz3|a!
ze=2oCzPqfJSEj>>&=WI+JoUEY1n)zJcbQq-C}Y4-Th)Ges6O_iv|xHd+j(9L-kn`Z
zOp6nAI&(F11U5D_G=qTC<{5Lr-Alt6dY^7*6TDbE)qQm8wle)!s7o)H3BeYv+54OK
zs@DS_-8#KD{|>kLyZ40w!Kt5vvy-!ne{xskbFyMbhu7yPgP+Si6{ft^db_;pLw81R
z!t|Fc^7$fnUffCl%IxMJi)i!#K$@J<@=zEZ-TFJfK0Wxs=xq*M<7CA-0ZbTu5Es2t
zA8(FN4~;H{sB2lJhs(2zD|2_zsLefi+rTJHhsnoKx=^@v`L2I*Vr~u@=KwFBe}Ets
zrh6yhtv}uCza%GJwobXt_TAv{`1+l_?<=@Wz)0@B**n<lzu4<PU%B^_{>9sYz4ODp
z!CwE_UjOOJo&MCnIPSkWsp%K3Z7ep9fE`U{b=^w`0F6r<)-#}fA;h4921OWRGD%3&
z1y5<`8<W%9`htvz6Oc^2gLP&5e~Bp{?5t#DDTx}D|E(lGwRKiC(R^nYPH>~i$xQ8j
z8jeC>+SwRAUrIqzo**rzLOZ94)a3YzE0rn&P4d}M+K0-C-uvQ6b!RZE(1aWiX$sKL
zDP~vYl)P=2#}2ax#1u60N17D%?(Cufe3%NloWXx=gV#ArU|w5Eg4Qomf9jt!dRk(v
ziJ`eggTH_8FIk(ZWG*D?chbIFr@HlgR{h}quo=R6Zi9;pjgSJR57QKtD<e{ah$8{f
zD?=57;H0>TU`OfXkl{yoQvP^`Hsi$4@&SIMYcteCU7I1~kebggg=Nsv3BR%_MzUJW
zWV--po|5vw*e6RN^Keq`e>0?Y$^WsnPc=k$hbUf1Cb;B2`hAwCaA)>U;lV3(h^1e;
zKv<m^38T~K1NvYMl_Gt%nC20w!$DZj)bV7fhSb2Li*A7tVa~-|%3Fn;h#E4oY2l>`
z7A&uaR*9gr5>rr-x_LC&XVS92$ktbFDF;XvbYQ`Ln)(&J-J=r%f7ba*%@<l<k?a9_
zMGYv<B>S#o!Mhl}=FOHj0&(8t-?<p_JMe`dGu!&d>zeF4jikZRde4>wV${7F<c9Wq
z_WU-w6VCZt`+Ixd1)(wn^Rd?oo+{a23!}VPESu!zHhZr-`ck+*1e@(Pe}G!5X&tAw
zHSNH*{tdO?*^xf-e@-q3E!)%&0+U82Ywr+x!>j%2uC&;erEc6mLR_g<_DJ8UGq2~J
za?nNzCuo-mPzWz{yHleZZXDwn#yA(EE;dIVN3a&gX;k#fD|U<D)b%T_toMZR%1+Cc
z99lMlBHVOzBL4DTd;i<!;elFA@1IR>9U7|mmrZ)6(D~Tmf0OrkyTq0k$g>HorPAI3
zXH^)YF5s*%)a@)LBNhkx@zwUrx1@ZfVKGP0J8zws<!*6P<)Q5|7|@A$g4n=8;+~0T
zn{mIfU33$nV|Nv%zKX5X6paO};3!nt3#)UG%|u7`P2DWl(`=nv`)|nnsofawxOi<C
z=vFj(f>ezAf0;=raj+=M=pQ!8`qFb1fNGd5@~RCOb~*?mNh6f~R~m(NE3c4+m_szp
zxn+GbQqWBJ7$b8;23Y(MttZJMGmlzLvMOWoK48WW+VUQ{&!U2rpR*K1s1FUf3-rCo
zr6ZJVYIqharw?rcujH|S^dybx{4Z_=F$1V`#hfVSf9oJYt5UbN6^tu-4sVkjt>NNW
zxBn8RaIQ(VV-c}T`v|UDU+iQt^Wz?xv7}X2<sGP^66F!iJ-l0bAnU;C3Zfx=xmu@?
z_1Fm=t<>m%F6SeZ;XsAOx}veo$v}PV#o@h(GZOMS3P<8w3Zc1=ve0EdteswQ9>b8_
zdFfMDe>QN~4qA~G?8)(vX`$T#hiW)2*`)obPW++w((!y|{)e!K?ot>LI&Byp8`4dt
zhV7FWurPLzq;m!w$!xqtOY3EbRzJr%Qs{+wUN0ICD+<s!$4y=~wp3T!N7(9Wxb&OG
z?@$t-D=TWt)O(`|NP=Mxg=Bq)uTPJEW-~V#e;Lcekeg)~7%m~ypW~>kGf@|=FHp5V
zWrwaFhNsOa;+A7uWa=g*#@8P%DO`IwP}yEM1E#Y_EJ}qQ<$x3sw(ooQej39zJ05sp
zB73EU^ywU~q+P<CTX7gNCf_>VB8_^&O~<4T*B8faoqs3o>RFg~E98Mxi_+l-&C(0f
ze}Z89Wk}yF$dd1ymPf0`NCsw@+Kjhh&VeqvHbXtMI_dx!1MUVcpa}b-O)OisONve4
z3U0$(`f8L>ff4`n0Cfl{P+OECaG6r2;N}^;_KZb0dGj~nJ<0pGDY)T(g}7g^V=H|p
zzNxCltvn=0ABI6a8+j;Nv~rSX=mqFkf3&~k`8LAPwzzA7GAYMnk2;{~&#kbgy9}T@
z%_piU*JHZ<*_cchU}ByYyF#^6r#!E14ifgB;J;mW^8^D0e$-?+0+5Zvk<J5~@xs!!
z4|q$s9kTbVuoN^$E9>?MoNBWVRY_+<F_VU$k1hi6c2#8nY2sq}Ck#lJjDcC`f9n|g
z^K6pjlKLy0X|Ve6CQ6HUT~yv<&Ml6#Wzm4e0rFQOCrJd8G^7Aw+M3iS@2O#!-y>ia
z;r>;bf;&z_mJ88q9*J$nST0MZgyhhVUhCNOG{0qc*MbD}#3+Oyc$BUEx7^CRREs{-
z=JJzJoCt69szc?$BpiJ}kW}9rfA^^J*5x*V)RQX@U7u1RM5D#jPi25%qW)6*Mcj)V
zWP`q#)fKeeyLy$Vai1wmRA)8A<;rw~cj?iGp%ZAvH$0Q(i%xFd;tq=QMWYX%fSdD{
zY%Rz?i`6O~T0noJ(emKz{CH4!a~;U|TAH5Hh_a7}5i}euMpnLA>-*^VfAskBhvU<?
zrni{Mvq~$Zbge8FN~7ta+hg?Ep5SiCpk-}JzKBj1$eW~qBDDwk&QN?XIjqoM9P~a7
zS`D!1ebKjX5l0x4^MXXUcraa!Oi=uF$-?}~D|dhM;^%L~5Z&s_mp^}7|MHuk|D*op
zpMHM!wEk`XMZ>$74euJ}f7)-D>frRJrs=@z!;|{gCxf^B#@AO@%CpGw{``lttFxPi
z4lb|H2N!R&Ju%(#xY1Sr&B@vEq3I*t1UNUBXV(`8gDU*olV3mqMJUED$Q+BtEFFZx
zh$ur%&o}++t24VNq0#JJ|MXhzpUcECVX+<TrM8VH{y@mbVe~b0e`}fmbPP_;)RgL)
zo%G)fPA=OT5v=?$=pVK;B%pC=bMyA(?DFy#r>5`vS66MzI6vthpEg4xHoLm$pI)B#
zF9xRvzc?N3>GiuegNvK%^ER9>b45@_Oda=6{So^>QxX!10fQD#-Ls41!Rb{W^HkeM
zM*ne{rKLK2F{-*Se+DRN-QS#_UBI>+U)k@3-twe>dU$!zKOZ=49l5r#!|2VsvqSrp
zR#8^Mmk`xhv2ZBeZs^Q#MBV99&bkclQP}*|yR*}?gC8!=-VKURQT}I)(fFx$<#t>a
z{-1z7j<0^PpPonn9)h&uPorEpRq-yo^6GlKIlSl}UD@t}f7$Hx?Bbn<{4EaCs_75M
zZ+~z)&&%UO8|xzvkyH#>3FbvMm0^-k2<VkrrV5hO{mt3wfc~-~8g6p+{*0THA-BBF
za`Q&;mFlKr-S>_d*D_NYWz{GXtMXtIqL1{9GOo&8>0^~pCIUYU`_h@z!wbDuQ=gL4
zmg17hX6r+lf1<UqVhp>hU2x@P<9aDC-1&K7=#m1t^mHqhuG!dp?>4#%WjL3Mm>13G
zH);%}N2$zpU7^mD>4GMqZnH9-P1<VHbc!2n?ygOW;H@@1-J&tNv2~?9Q3zFx&{kGw
zQCj5JUPY-@Q5mt*(N4XOm*yi;Be2)>+4UM_aQt6Me{K_rIM}<Z0$FM&3vVGitgSzv
z@`T8jKzR5>7|xGDhOcpIZ^Qfme{C1DV!sB;%F>`o)>cvIQw&9NQx2GMq5yR}f|)dW
zLVV{%l%0p?jlcf*N7wW<p7(D-C3_98`<O*%ZRPN0haDSS+{jkgAu^CC#97{@26YI?
z<2}w9f0o3(!q_hjtaDv0h6+z1%A0vBD|*UyV~2(UYI}LW9k1L8{2{NyhA%_I2{rC+
zaX!r#ho;_ucQyj*1ZzAhds_3bU7Qr-n(t~-^+@fmP(4@lxrag}UDe<U?|aPnm4%#S
z*3@5nJ;UKe*D9%KwL21YKY{m-RInE|fYP)oe^YWX2dK<9R{loposGK@udKWc$Cf*D
zIL4-LXFHF=;fVRJ$KN<}H;>QTT$Q}AL`u_jjm9DlgsY)=Ia+=>LwJaGL<+zwo1Wyr
zD<N5xNTi?{>bTcOvzyv(nB5JF0|kaI%*_?%$JIJ)u?AOw6o<wK7TO>|c1_AqWsy2A
ze`)mOPW%h|doqvL&W9XU4)~R4&8sK+cV$DG;s=U69W|s&Zm!_?)>}kS=RII@S#qqF
ze0Dnz<{F=EfNSiQS5>>1h$jpe5^s#X&p-Tk{D=0OdXi9+xwtn?{2;7aUoY^bw|zoy
zcWh=?4TF%63h5b@*;vcSBlyL_-$~f1e=!RPb>CHHY6FoKDR*c7lA{4Rnpw-U%#%R+
zEmD#S-=86AwuqaghR8x#g?JHfg(+81WmGeODUA+=`vk4S=!kL=h$10!w(7fGPs`A3
zE>7;$WDy5x7%&T@Z1KnzW`#N*ho^x!K+?l>Y8Z`$MlRk^OecdeUQD^k^Q~8%e=+h;
z(#j`LziBV<fi)pRK@{t`sU7q&1U)uxg<dpdHEQKij1@cve?l`{hdZ(HCSQP#rAUR#
zTW102wKk1<yQ!!cs$01h)m)2aR;FZ-&b5hGx!aZ17SzG7Q)N+J`(_mvabi%BRKRGP
z-a^nZc8(PkXN!}EOJ5;Hsm#(Re?^rML>=U~rGy{Al5xg4xwt|YhT))D2%~BjDdzM;
zN8CM3jUZF(p_!F37@(!C;;f}PA1HlD$vuoE{;D`AthI=jIeK6yEf}9P2G%PknKfM^
z9aqsb|7z!$p8rX-`rCJIozVeosxv;uP4$M``H;Re#6z{ly52O5Z}W-Ue<xf-t4o!*
zx?K9JE6Q(ahn6?${OF_%HHhJHdH((_<`@|F1O(zu(LkD<qfB@8*uR-lCY75%?SAv|
z*|R7%V{xJ^x$$4#Jb(7|<MTiN$809wVh$I*JP;mw^SpQ-Y_+vago-7aV-J;Ktuh|N
zMg4$EAQqncMJ{H4j&eDLf2xZL1?D`+bN`t+5l(wqn%uI7aY^LqFT;;0=D&xP%P2W9
zyxFPDT+4CQxKV_tEc=wPJs;4ZIiL9?$uZmTd=ib!H(|^rT+F91yEwxvZ}DiUZ*n#H
z9f5j9CC89o(#Y{rmL=?L*mIFH6+Cl3VHO!P6wX4*5WD?s@A)?`f1l=rnkhTrXtJYk
zA73JKDR`mGCv>^=?9nplV%{)eK|<tgi5Qbo5H<-*#h`rDH2DT58^|+qS48jLEKlK7
zOWLK<+fv$%#@;UBX4m(IZ>^a(K<-FBV9E*8<xclHm-VKKYA_{Kf+drRQ*PRu4SLg7
zcWXo5w81BFr{%&!f1OQa8`7zU_XPjlaZ6)i2b0gajaACp-jFfSBW|S|9qv}qWVa4a
z7I{K-#KXR>iMWxiiI#MFp^`cYr(R0(BfXZz4R`TbX7@Kv17OBkyz)>s<j9OEkhP4J
z8&$UwTYOgIIB(7_4hI(}11<9<4dsifqm*wJ$8ztolrT_qe@FABoTfRZf)%l9D`pYY
zhZ+3bKPc@FfEtMOBg`+61G!e|epZ_P#h`y!ID;LJjq+kDS+>B!h<35&5BYaf1v(=J
zRuNkgbVv+hrm4$S6cph3vjjxBT(iWHM5hR4UH-UZjBTUUay6g-303+xTbN|G7}2Oj
zMggN~k$6)Jf4NV%ViepABV{f2QJ>;fPxqw7>S&%$whU5wOH~lU-9#f<2U>Rpu+Yiv
z`ch;pbe9Qrl!X5{yRTR%<OAJTbZ>Ci*7}X?a&8a8tHLVMqGx!g?I`BG3O^QGXwl2K
zXinaUBF6u=`y6gSMT<gLmDx*g&#u8i)^zvjs^fYve{HNZ-ZU<i{NC)S7hILPX;d!8
zyWz!pS6HRJX;@6v<~Znvv{p^fL`p2G%_+SA+MRH)fGc{|kW5fyxYiQSumOP7@=Ot=
z(z{C7*=EShcHSa79LGWUv7Xzf*Y3gtDNE~mqnB3E;nA3Rn*Q2s=t}B*jgPF4ZQBGp
z&c8d>f8E`r$LLCPeW2&3bo*lS1algkH$H`d=Lr|q5JYi3QYZbY)L&A~Z{Nr&eRGI7
z7j6bFK9ltXj(E1mb@6h`16X&R9^fhJp?$@^;<gWUdM^`sxfB$9WhWV;@}H}b#Cwmz
zSThwOdCi^pxea_m(q0>_$2OZD`7yYg&&A(-e>M*1v+y{W$?cyOd@SqHHS+`(KSRsw
z);J33WLBv79*N37$eC~>#IL36W+jj?WKv3+=zq{B$CeP`M7?gxgkTyvv4~En>1Tzj
zwipRrZc1sV7%Vd>IHPCdA2O8=iN0e~XEiazt8x}+F^D=PBad_Wr3OshhK{Okl-0LJ
ze^*szRsVoCudX+Gsde@#Js>;QP1+1^w>juuMOXarEfDUXzq&LRkGd%Yq#J~bPZA{7
zee4V$)~rt1VmOP~=h5#GO~wp~Tl<&lIT}l;^u>?K(9Gbp1mRpcrf?E<{7CxmaUKh7
zqza(IlUn)vfEwZP{fHCLf;06OHu~!7f1`yK-9;v3M5EV-`?R^rz)xTcZlb`};iitC
zPS;5uZ}tqQ1@e1bVQscBqkbEX-DF28)oT`DQqA*uC_?CEx#o3}&)SVZl1Nu4A<7M=
zq+h~Jmtjx~t^FXVl3n%C2Bk{f{hliBEk@{II9^P<GUp5M6r|w7N~8hifrTwgf2(?X
znQW#`YtH~yueU!wKgSA9SJ#&}XMbr{;3KC%E~lLRneWe9DtyKO1OS{uRTMoz$6!8y
zm(OLU9?IocDEABfp-ijr0G>mGe%_~6MFFct^t;mjiT&mj$*IlG1mp;}LOq^?6CBkz
z>%V-yLaspLuCvadxX;$<=<^_@e?)gh3&q2Rq;vre;k9*H2-csPYv{5;Ki1Oy(7=Ko
zG(|{O(4mrm9Wp=4g?X=Ed&bq@aWXXUG6TFVuWT-{JbfezPUeHw@vdX8O`1rifd{Sx
z>2wS-RjPoqy<?+N#Ip!oi%5(I2$)3?tcyf31$k&<SuS%wC4pNWk4_9Ke=i%Px%XJ;
z{UZFw0-O7}Ar+S2wMcSD<TPA2sp{Lc4G+XJ87x(0#h*Ylt045pX4U~hC|CL;55tE0
zx>2;!J1y7WPKs8Xy<P+k-sLy)njpHY!a*5gOJK06EgCK`2&iT$Vux4-jMJ<L0M)Co
zK`FYKOBOKXo?ub#cej+ne>F*?Thv}+ai|bKFnpQ_gqjC=cl>Uk`@vSmE7B0!%gi-<
zI~`%>qpO=A&j)Xnw~cUjo&g%!`};h+m3X}=86$Udet1;sMJuemHxI@ubai%lb$M`c
ze16r`W0K`uoxr{0tHICZF7xnXzBixxQC#h&S|joy;>|ovdqwUsf38>QSW8`IHq-<K
zEu)eSRt5s7hpr-@QA8pGnKR+jA~~9nX8>(GixEtv$$$Ish=5+pnOW3P{5vj9karhS
zc659)0F*liR&<=q!?-ziN!&CI-UKhy@Krjj$!9TKf>>0`J?Z$4(Vac2;@fY&dGT!#
zSK-LQR_XQHCQJt|f7W&5?4_5SlZ%uikcsi7B?->=;OzA3`1E?vXzqpEG7Z&cZPO_s
zbfBthTM(Y+ack)u9(*DXLiDxM^~Up^9S`I1TSBv&DjSu~w?c<4$J<Cm<^O2;I~X!(
z-^ga>0ru>J5{;cL>=yD|2c6B6Cvt3+e%jrc<k08@8nDhLe+(?igB)w#IfeHdLyjp$
zeX{^mF9Q9u(;1U5@istLRUiD^rVkFur=$n$64ff=8kLv)lypG?pwPPZ++tnxy%Y&e
z|NNLls7(7(_NS6*sQmP@z!BB3DOeoJ8Zz@^K-07(&}@-Ml%i3i(@1MD3<!Fd`6*CA
z5f&tBT%cYWf45TU`Bdh0n?78o(uXa`lOD{nr)Jqp(w>;**8YKNCs%W+uSOJ_F=}U3
zv-I0GfYob)NEc4u2=+z~$gMG*X0Fws)aAkn^cmhIvu=WVY)|yg?;DS+tul$TAXyYm
zP?OrOGT<xviM7j&vn(7{@rQ#Ne}n}!r(GvO1xo;se?xeuMoN(l@TV?!U^PF_R>g0H
zy4x+1$f^Y$1W>@AmH@VvC<@6EqQ2!G3r`sRm0)b!Ua1*NC(6XH6c!cUMWb*}f@95B
zhl8Jv4~p;HYV{alC;%t*3&S$MQ~_LC#89s-P{X|+<w}`kq5xpNVNicK#WWqH-={z>
z7%GVae@uxX*m}Q61Io+mJ=5we(*RLSMe2awPnVYIGqg4zv>yai09nQZvXuctTv#JV
z8SOdAT^7=T`G8;J-v5MYA|^<M>v5#gVjGsC2^sh~B5YX!(3hRbIan4ZZ%##2(yvsb
zIY=&>@|sXMI+`Ew{`w<|1|f1PiY~(pC&@Gre*vxtIb7VCYG+AOCu}By+SyKHSedT9
zu6!|5vsg~GG&Y@%S-88V9Jg0cxFSQZt;qLor9!(J_C85JWJQ&2s@E<OVaKAngM|2X
z%U)NkW@pM~h6!TI<WMgbqeH4p6hIt+!Gqx5quUQZL|<A=L*s1ED$&L|a%i5Lc=Y0_
zf5&&6($6FhOCzQc8VU1%t?`D_Bt%`)r82t~l$VLE9gDV_o2;Y1cv>xNTTd6=$ek%k
z$=-Hk_mtkm%?pC_PofV*taHA==7|^bQVZr+@pUFhkuOArb;C9@fLl07ooz#fWUgyn
zD1OXL@FP?tVg!RV#7Px)iBi8>HX6kje-32#sy9;YA<K>#f<h71M)0>?n2OKNZw@X7
z{j0&vk7sX6dBDZ{w}UHAV?MaJ>0e!49KX4~8WdFwFxY*ERtTW~yf-9r#nh#+bJxUl
z!(vXu`wMv-YK6r^JL_tgoApJDD=6~&^cHdS53EO|=Hco~g8Zs64@?Ytli-VFf8JJI
zr<oArbW7(^WCvrK;yK&f8EoH%c~6KWy?#+rS9G_+n&mc979ef$jgU~c9SRT)ZwG&o
zCm6HHBA{Y5#7Qyxp!g}_gDH+v0Z|3kGgNhDDj?OoW~y##@dV3drZ9GeP-{&9sV`E0
z+LPNPLz4L@`2HK?P##GnPCEYqe-lG8q*A<#b1%zrYhDC%GlAF11ZxKS23+^%mTl}N
zW?@5Cm{iO#sJ>8rH`?J?&A3u5vplS%#O>ft{D3$C){1MQH`mw|S)4zmbE}xc4J>Vy
zT9PdP6dSUNPsoF+NY-W#MYPxt0-=Tyd)_7O+g1N9V2Qy66)-6tU0)oRe@1jDo>^J3
zp!(WAR`Jeonv6c+SB!+dhps_v+dqW|aMt3NL?Xvy?>;0!m3c@?iB*zPF|%Um2Sq7j
zJdG}WM>%UTGk_<Of3((nRRtc*PVEORDy9l!QfXlo+@TIcLmldw9doR3^CqFXdWu37
z$-F8jub3Vi{qs3MUgLo>e<~_i!H{}w_}es*`5eqK0km93Q&kCl?>dg|!Zh=z!0U<J
zX2%76+J+8ygiNT9r;D+6vYrZsq$iPww>^k&QS|S6N0=N4{{7JhNDk5OPVh_?Jq3^5
zRY|dp<GIm}$Ie^`aaIQ&1{VjssV6Q~tc8}1l2eRI`J288gKENjf7<mT^`dr+Mcjna
zq|jujBlxqOUKA>3J)r}YmM+G509vP{P@^`yzAEl_>PYQq!QE$n{hRl?YR0l7Os#^s
zMkHK6><I~G{SJ&$;L;}Y&l0`JoCwBW2EV*NyErV9sV4htEjTtCAzw5aA#F!e$L!kC
zac0BESv^AbHMGY#e?b&=nkA_URO+(ah%RnE)$2~f(1skvHo72483Kh@Qf7LSrEd$j
zX{Gro=7<*GY}e~!`Zv+XLevl^-BE!JD~NQbKyvz;r&F2tRuCSH<|>6~v9^wTv>lRJ
zbE<5@nqhumBR&lFo|FIusxp!gqx5Zagee{Qn<SZrerz7Oe|Tu*5}=dzhWths#_`nN
zoSmHv`lp35y9y5mYoNQUlqPfl$deUl=A4S>mT8UD%gW3KZ;wy0O54fcK%?^;nqpQr
z$L!H2Desj?!QDPv;lpjtR6MNCGNz0c<p~Z>uixnw4yh|CHA5l$ttuJ%pgk57%&gPS
zYUi!ZZ4-NUe>TcxT@`a8+6&uUlH&D4HsNfMpN-!D!YK_dA6tOT4`xx^Bf|^ez0&#g
z58oZ19uAI<PqpfXGWfUD)=UIO?WQ4+%wjo}4^9SG1Jtk--^2+=#g^Nip8eE6xgO{Z
z^B&0foN}?!`08?Sg>_=J4;Jx<IJvLfr0dhaoSwZue>G}1F5)6xS*7{q^*Ord4-RjP
z8DTd1UNY_tNku4^>~LfkSY+KiE_!4+suZ7}jgRZ$m0GwCnpsB8)*4n`6Kd&lO;9SC
zE~+@Ycy61AdTCv{db`s2S=|J(m1m%Kq3FY5DsB?3qzJ6pDnsSL5B&>(_yUL}ceCBZ
zD?z(ie>4jz{`d-2@1@r0R;yJY#!H9HPWiI+RprxCe3pEB(m#Ex_d%MslM>5Rd~kJr
z(Lce;ns2ZBZ?(bE1GU^*b5ykqj&IGuQ7^S!CtQompGN2eQ(Y)Dygc|}@NTdPYURo}
zo9C_$wsdlQGL^mMJ)>2ZmbMzHWB*=z<gM_ue?lK4!{#KNt)xn&Y;#hvw^ZXoxVe@U
zFe32QXS1{y<+VX9he=7RY&^8uWLw2>95Y)%9b0xZA!9tOP8Mfi^Xy7?3jRc>Qq^*{
z*|lG7k}?|B<Y`j+glY64^zdYQ%0Z7yfv^z`01f?HyVm_Zf;ZMZ)?QdeK2i8e*s&k7
ze|&AEx-D>1`bsZe+lIZtDlzK<S2dDpjg3Q5u%d~i{F!h!qrfosvo&=TMt2wk7UgE7
zZDBc-rrYhR*_N%Eh2sGOGU>t6Y935oM`(+oz2f>}7-CC~kCg8+$#R-yoU8j%sx(=5
zua!fnk;+3pw82}K>oxGben^n5>B+0cf81sVXTuYBaB*>Var35scylrM&+EbEmBlT4
zl*~AeZSRTN1a^$|p6n@2QWYNi<wPzV#w-ss5~Y}mqJ*tmX>uHvSL>!H_>y+g#Y_3Z
z_}E%St==iw#Un#lbWH-u7k6v_T)otYB)?Qtl1#wruA>eoHoYI@>BsH2oG3lUf1RKd
zWSWlk52{`lI|h*u^%C%cm%S{?0r}l(uzuxyEe;mSwySaj);e4iIHv5V)~XC6FRTXL
zJ)+Op#I<63TXbZY;8`&U8iQv%H?Ei}j5Ur@OqDodkAP7q+!&q3NgU!7SiZX9jd%7b
z#K>i@KLg;BstUs5p+4qqnCl9{f5InX#qq5AKjXP&R86(^fPuAqsM@2-aI~+ai^uIW
z;A@rf4t?W5#S_co0<;vZy{sbyLK_5C-dPvQFkJEe(l3(3B;KMe^vb_AhnG*S1C#mG
z%l+G`|Ke&JP}P4H53M6hyo7uQ>J-=BdcD*~@x%^KBCvMV5o)kQ`IUW4f5Z(BJz2Yk
z)O=BeX;VYG_6C=gZSs-j5|y-G>kr9<={P72D<4~TTGIF9Ly0(~v)GEeZB?`x&uvRD
z)Ld&X`;u6M1L)cuxOi?|xXxLuxnvt`)q$1aNwCf`DM?!ePsyj&C5k8mz*F0zLcuc5
z{g3?j&RUZQ)2wpB;-Pg4f4HM}{N8kQUuCNSgiz4bMio!=Aya;ok+*7iM}<b_Nfrqg
zp_K={^zZZ$@uyK_Td7-=Q>E)*GKjrRD^##bb)Ff-MHcz5qg1BRT&D^r{&0$g-salY
zUYXO}maFZq?_bgIKi%NBv$JX~Yh&2gP4S_yEDW&_BG`H>DV4r-f2tw9O7-lvKwNXR
z!XQ<S!u{tbKI~eb7>7eg1^WXJT@L^HzhzEu@kb*lD3tDUh$4t$=W}eX&0olIbA_>{
zyuUKly}gvJR)c*NV3hNG{Uz40^=yh63lK!cLEAHDNsqjMW4v_bOIghCvL?31=m6s%
zl6_mFM*P4<dsehoe?a9J<l`@39&s+B#<%wS#&4xKBK1d%xpSseM?4O&M7sGgdL1Q;
z+lh>G1g0<C_1<0|n{nwve~)HIAmT6|vMj1Fy4tj2VSX+eAG|SAis>&ltZLL^hdY(A
zI22p1K*c3*A`ZE_E#%@gRQ{wCTNzW{1!50KbxsFQHO4r}e*kBy)wvhU(#@hCZ*ygf
zud^^MZ7x14+ay>`FY7bno%!S`ul0@J-dwyvGMndJ&&YYzdBkdr`6LN8m;9^2YPGT8
zc;2G2KXs%DKcqt?gu!t=%3c>l*?j6R3!@N%qa_p=cil2TDOP-vWD35O)sz&=GGIkR
zPnf~gezDMSe}q3uC<o_23aW6bByIg!y_HV1x?BuxAIrz~s;Ht2BMWUoK$3<(^@1?>
zqbZ89Ky&!sk)qi|zW@qTOzmb131>)a_JXJIVQy$jamv-55lxYbg!{v^VIm`Odn~$r
zXbKy*jcE-Ow?&2Pl?)iLP;Kdpgut3&|DjX`S1xm<f7o)x%%a<r!)EcD9**0?4tvjc
zKT?&3&`+lkV%c}HrFTGrpt?5DlJ<JQEmck#+yiRx0vb%CVTy@e(r}ibkg8Sx3NRd&
zGc{v3$q*?qh?M>F<IFOQm=OIv^FN>;FJ+_vIzdwEguJlmWDp}oS&mhkcfG#Q?JTA_
zOSYA{e~H+RBu0(bFpBY6xe_Lv8*IZYqZed!^KX3&_9?o2u63zRm_4Dh1dCL2ObQX6
znZG2;=)vr9%3}Hy?N1{VVIyeG79Asczygx^UX(AFlE3Hx2g95e&=H@pimubUX~?2;
z8^$5V2#OB3_TTaY?_eTa<+Qvwg_b~krshEoe=fri=>N<Q)EsD|;DD>fq&K=j1P|n1
zIh!B+`Om_n#>p&2s)Oa+rZ*vhfZXVVXoN2AxFMWM((ILcWVu4`)9bPSy+0mvmH_FK
z-X+vSkqq3c2>Bv-jbe&)ibjj6Z!7QGC&L>Ybb&>S9ZJb9Bk;C;m|}<x;f!`<f{G$i
zf9Tc{-C0C@-i7HfGyDKN9Z>)!O*Iz=+zO)_j@hDcD?^Gfh)3yC&yH^PfK31sRa!Z_
zQ!$nu_568Mz}=;IO8KZv;HzY;6l6;}k<r{HBCmxd(~`oszG1x)NZN9IMF56YB1Cpp
zRAa?qmBCohfn=JbW)Wna)EJf5%T@2$e`Jd{OcJ7zDqqWqKdJYwL@e7;4Dv76vBf&a
zG77_fQ%Y+BY?+|hxmcI1*{C$)whKgwCI+VmXNSk9Z*SE80_}=EmXWb=yCbx%3PSSy
zoL%pjkOVz-kGA$N_>p%cAJw2Jg{3LMne`rWM~Vv57XoKiQPvrjl*S3F6h=i7e`fP;
z9bhZvWvpE;@m_e?Wwv|6V-eR==^lYv<o<YG@;=aBiF;{ja2VpB-@d#lzOGz+vw>x5
z=jVq^kSf!g&w~R@VOJU%AG0C4_QiACn|KW3xw_-ptHCVF?N9q-*w!;Flx=^16xg5t
zcyLntVi4DSWSCp@cNHHa?WNSUf7#z0OcJ1CHSZQ#p3ID*71kE#J}@r!2JigzL)bWo
zG>_Wf)(;N&v}N?PRNhK^d5rmqr{vcqPu<ce<Jni=lpW>tSEABT{TusY<y)Zr7o;<+
zZ$h(5H4C=Z2H%O=ZkhdU-Im}vG;Sz1sQdVA9@ad4ZhvgM7WAAltCruKfBUx~*L1YM
zyR>e&d~*_ET44Kos!(Y`P4M~>b-!FAJyyV5gPkVfbl!xWYcPvM&gX}<FP_)Fd0~IU
zT$a7d;{0thxd5mRQ?%lwKwXVlne>E=+;?GlRhGRuEF>`N-du&Vxpw519!?VsqAHxf
zIZ>yzvja*9SCoP3+TPjrf0N5t)O?8K#r{epp*2e-lupAe{Ahn^n-bA$%VjX$HGY^i
zzI<MDwCKcMT9HlGpa@#)A<(PS@cy}-6_KxB)OXHcXz!ih0fG#Efd9g@W)yBl8IH|%
z?mQsLO9c-|8Vh10ksD-TN^yfUI>w9C@r6wy8OU`)U+`2gfE0VTfB!wOhkgM6r1<B)
zhrFQTFB$p6;|{%p4ON}!@Alwh{D0~Rnhuj-DS8a{%co-c*yZ#=wN=F#j~enoH60Tr
zcInvCu(4ya&U!<~gK20~GimP{DZES1)pm{DYLH*wEi_uG%a2Yot+s3I_B;*mT)M5c
ztLwHRyj%NyYmxF>e>z5lc96_4^<CD|J2pMeWaBV!8$cA!RY<dL;%1)8wl1YwwXIj#
z&aGpNQG<_~`ot#4Tf22Axq>J^fB%-TX;bG#b6eZyL8^GYVThvfDnnRkLc<tZYqvoR
z6<6JX+8Wh&sHxu@XKYv0H+C+$uf~2$ELuyKhLP01{A!b?f6n^1VKY?{JzCn?x<!>k
zKM2x(ysYa~HaX5JjhcEK{A1xy+xxUMYwGpLpGDKwsUq#PG;HeF5T}|twl!?*7^PIS
zNw)7rP1B~{&yzHFm~^#SQ>P^_*7|O34eL67gGtv~x`jJyZ&uf7Nfl@9RJ3vHu%e%{
zb}3uA_G!55e^~m{Ymd0~Sy2;O`<1Pn`)pxI>dX!;9XHV5^;R!JQW*Ricfe@r+&SOz
zwvJc91g4f@L)&oPf>qY&ak1eJkt=E3M{MBQ)yUztt5$BEa+p9Pyi<!+0O%_9M;pHG
z^u_bmKHEDZUsG#rRjJR$IIO1b?cqJv-W!_Mblybnf4I*&O1H<tKK?=K1XM~~M!+NZ
z>2z6kz$eAV7pj}M@khygd4npHn?^=ZG(`79H}>+zM@Lkro~hv~J)?B&)H5|)q30R=
z)zW85vWvB4ZMWi^D5*}x-g1R0YYvLfTRJzKNS(XC4R0na(zSN4n!0q4K_duLO?x8S
zIL;WGe>ZP3x2Wx|daujgR~XoXI?SW%Q_5j?xwWs^t^IxBMpfuNrFK$%DJpJrNhs}y
z_?k4F@?-W962<PJU8$&r@XEo2u9OwAc%|~O7wHEurcIVU)P~(A|4+)*<2~VoJo=M}
zYK>xIWv%cn4wRJ(DT{JZye9F3eA%8*0jX?9e^lR`yp(gAqbV%RDgE8K`WyD(rNo8G
zzc->ZB=U3wW{fpl7+AOLP}?lgI@s4iXR<FB*xb>vXeA<8Q%hbEbe4#dm<l3cF*M6q
zYVVo{J5^EF`iWZlbLi`^rUwD(8lb-{{C3gpnmk5O9gjaeiVYMeV~0+pL~+f;&0`Ou
ze{8hKIQH*Q{axu?YsF4;s=|aHW33{s#Eefj10Ce(W4%Zkutkfo+lk<U#4-)PXv&#P
zdA=BeCq2T70^~%eJNk`FIPW-u!tVFO)Z4?%=Je0;xcJ0Os5HeSC`&K=7}2dMCtRZ2
z8)Y4p0B%5$zsm;JN#0VyuIKed_EVa%9GUAR8Gq%0xaLF$J&NW__R#cmy~!Ukxw_K4
zucbSX>9Gp?QK=TB9$GUdVQPQmamX`v9*|j5U?zPFGu<s4W;LCwU5`|qDL3><nZ$%F
zWS~<0g%euk?B=5Ahn~Yj)<zS4#DVbJLR{#KVfEQ;n;zVVE~RH1VoFh^+Yzsdx_qV9
zTz?B&Hs@cWJ(qKr75h}FKC=T}z?SJLho5taJWKuaau2fRx#&aw6vRN4E7&wSz|Ct$
zh6hFsI1MOkaH}(FwSAA9?M|H{_JyeFj83Y#GlDV?dKgW}C@Q`v_mq({M|(%2osEJe
z@?te^wTJ~ONJ8;hxl^YO&*q<+hN)?}VSgkMpnE3zvORTU@rnw70wr+<CGmq~8YkRi
z3~gca(A9%>=u5uT?L6M8$SIP{Yc9_npL<guKgr67wVgNv{^_Ow{#^Jt!|5lV0`_a*
z{sC+oUMC%DGnqdRt7S&yZHI*)XLDf8hD(Z?Le%wC@?RbHrq;GzxK}Hna%LAww|{cA
z>-ey1SbP8UCtvU3*L(QezlS(D+=#7x{g>-44B5>{T*IdOhhavZKE!tE4zXTPULo;|
zZ;;>hFk01n5^nwu`OSbvv$a5J%bii~SC0sk)v~sURuk4z$QE8>e#!;r)!D4{uj(LJ
zz`^t0W5l{F8Dci-WSkpc1cPDyWPefEP_*I_EB<^Q#uV_*v4NPvSwuXh3k==qa3aT%
zKUE*Xz(<^cUmHS*`f>^wk|w(rQYHN8h^}>TcDzL@8Mo!3)19K~(K3N{5KhsN8xeu1
z=d#8<lZAv<x^6ldggv7_Xf|KW1#DHZmA1|*O+p*DZqlLx_V4OWyMv=jynjyVB|25@
zm2~th<*T>6vgcSoTyQ24v-r~Y;cP!n0C3@7oN^fKO0A#BNg%@#MVz3Zl2K;S77Gny
zIGg87Rah=g^Z`3GhC~(;!@-EMDj{r9F$Alr{83nd4<VqKVz%!mu$lC_!@0MU+nC6{
zPpLO0=#_MXVv{7hP#g+y34c`aFq7Hf#z`UrBL6V-(?4)d+|eRMmI5u<s^$Me(|?Mz
zaorBJlJivq0hs!8BfmB#QOE#{Cf@c=@d0ed*#iFUh{^b(5Z4?(#!9GBO#0neyqn9E
z6f0obgK6le8j_{ot@xE%wc$@<G|Y}yL7kr;KQ`c`hoS`dJN(BY0)M0?=r;v-5?P-X
zgx4rKhH<pSu2Kdhm3m`4!hEC49gm8#QC=I0vBo6Tia!t;JwycQ3g98rDU}|y0>}~0
z5tlN9A=4$BGKS05Kt?2E`U*1)GkES<<EDC)p2ZFyod)>O!E6=aSj=_ESj=0&qM$r2
zfZ%@S`uM*YP+5=V(SLTA$8tSLbm-sOH-5I?@F+IqR*^cp?Q%acM)@kaKJduJ7;vQ*
zD9Bk1_wG<oWKXvQY_&iGG%RIQ*J+sVu29rR{heRu)5>11c9v|SDxD@jY&}mgNj>e|
z+84bT_IG}u3L$J(yyVGbt%t?jL8%3@1%Nt4rAfGS(Nxs;0)IZkB6c#Vs03*mRV=%<
z4~t03%IB6KOX#Fy?}WT;ZC#iFpg0Reht@tY@Y2?W5s>Nc@2+&;)atD3a>Spfy}Xev
zYrkq@#MLOPG|YT4q&05yR|~?AXyHwiY?NbuD=O6LJ$+oXtRK;XDXsu#3m`i}3@3+r
z2y&+Je&?w9$bZ;Hs{>@Dsj^9aN8Q#+XH8IRp0$WVcRcHez+ULoONiW^x1uqB=jVOg
zu#**J@_6LB=|Br8ygdG|!Ogq=&jlo+QaBAoYREDmSn0giK<7K3mCkz)rSqLnOXrW{
zEKKwAHO6P_-D7B%v%X!p--cvlTjN^emtXI->&||zYk%H6D|ptayY+b4l~`Q_Tvhs7
z4W9XuRIi64EYorx#IfRVzjLrX@eS_dF_;gGAKbDeb#YbfV41OpaG5yT?_Hsz?_q=F
z@F+N__5hh(Fkfe#uQ~xcuRw7i;!X$_t7DRC$NPx6kG3q?kR0!$D%|yuJBcIy&hO-T
zc^^OZy?<;xNWPopCSP@SpWuFCUZ6ui_su&hpRS@nFX|}BGJ-2zQaR-B{GwjVU35Ri
zilpW!rg5{?jGLyj;Oes2SL^1N?Zd~iRaOTS!Znv$ncle_Z0EUo=PGGXc;^no+bE_|
zH7q=K*hkk}+ecR$pko_gWgn2!@P4b5eX`AWjDNfvMa(Y?G?aK>d90{}r<?N)fqB_4
zBW6n2s%FzbcS(68gG!8wKk>7P@u_-1pH9ZgqB7yA(sBnX>BCkv`v{iD8CO41Swyy~
zX+?0l<IN+Eaa*|Q3`U5uB(9!aeGUP*7$%U~+=-h9R-~YYS*!FnX<5k+=y|!q8Wu4g
zIDZC!C&>pm4BL?Hk*G8(HuJXs{WkyZwHWNF7-`4S>!|fe=F3$Uf(adL@whF+92p*F
zs}HkrLeba!oi>+<fwK-&F%?G%VKt#D$|8=vGitgT(x+G!mqu=0WO^7$+^Am=(WfRo
zjKT=3RSAD=PC0O|=?1B+inW557+VxE+ke^ZTv?l`f?(*eocZGr{hUKDnMHZ73MVEx
z6&Q<BbYo9CMV{(u^g$Ic%G1$oE@46VKdTyLVwJ+ZoJrPhhYKKfFn)J$&l51vdxknN
zpDUIQyWUg&`T8~f!1c=axA<Nh0OH4O#^Q>>8Y;ZbrCWD*cZJ8fU#VU+RQ1t9oqv#K
zvQ$oB`lna+kt&|jVrZWyb~Gc-WMTsdj9LrDNsKg%Lx9*Zb2m&he8N5A4|&qUH?#so
z#i3IOf)tkAVMwcGnF;L9`4>c(cP9<WF+FC!h^I-Wd)@C}?GIOChb=&c1Pfl-Dq-DE
zqS2(Is?`CvG!0RO`r>(S80GXW)_=^KE-2tZLX@D%1yE@NQc<0!xCh(#l(w<wJ=^IB
z(k{R#tc9M?gau_}SPN1{c04Y2eq@6be~~AcV1bJYVh4LERy<TEn(?)*MqS8Y4W(R$
zj}e{-#4N%%x&4*|adQ4G3~Elmrn9C3+Bz#j8)0VErSNj6;`V`Qi;y6|hkvJmfHogq
zw%9epB10vNJAz01bdYcq#dw$^;hvr5I)em-4Zz~?qG(bF!Gx?VRR)BB9PoqEadw=K
z(}e(O2h$NO?I+vemBgHCK%yRJwYtzlX{1VFU>lWqWVqrdj6hs9l+eyHYK%}ULda?*
zg)cAg@Ns!j86!x@ZjwyPk$;5}kc1NmM-q1U8<RxL{Mg4*n1uE+DgVoZ!6<oA`V_e|
zx=J&^sU1HXg`7Mp!NO%Ch|LGol!ZN@@>!GvZtw~Yn1lM-!U#L-h7p<s4X)R8X)e1I
z^w%#c0%vCYA9qw&I=zVQFOfcq@h|kxXur39SQo9Shc#Qu8Lyy=;eSel8iL{n4!UY=
zrmMDy8(K-@$$fm)c>Z=Yo~kBt9azx4CZq$%D8?{UrShaaU8=~aDke%f3Ja%ImCZ|2
zP_7=Lco7oAXMjCDae(`hrASYxpnO{_w;3}9R_-xAtU8so*muNKfA@|N_vIsSKYu=q
z(lNB0Jl3+a9z1C%;eXtbK3NW4!CL9;6~wh2zlk()uD|o6|I7$)B|q7<ZR?#c!cVq_
zHF=P2y>L@Cm@M2_%$5rBCS444wFIdZ_V#uGPzvlHvuwz96}p>3Dh<ML?nVN*HY28*
z{4p7B?N=VPOJ>v>F8$w=Ap)0?dA8;jW18)ZN*xFvTw};bNPmKgx=@(kO%(jr^NR8+
zn|pvg_Kpu96)kZg3lxe*3?Io{)EeIm)?to_7i+33L<Fr$mpoj0MVV0nVWr!4A=F`f
zfsfD6Z!WL;SJ#&}XMd?8RTSwum6n5xi?fTH)3d9a{`J)lXBWr+H8?DUu)6j~XBTgd
z4-W^YRpjh=dw)S92aIx+TwfjiN!(ujQTy#p;yd)!n1;9hXjw@3jHeP0I_dqX&WB!e
zqBlm}W?cziJwtnvj^qRJ?acp}EQ(fUrFu{Px%o@me$B4@^cMCY6SY{XS)bBTa|f5n
zA{~YG9q`gylI{8*J!mvv@P?sIcDT$#o557>Rf`N(w14^(f!8$ILP^zorU81$HN2gm
zJRE(%t9!Ya&&lK^LB0IE9p3R1R{m&7y-`cUW(-OZBzx<4P5&D%%emUyc-HECzl40>
z`UU0vu;d>7nvQ#gblfUCX=}df2c<!6@!j|YqDC|>E{j#zpqQHt1nf%+{j4<PQ!l|t
zzWXS1C4ZP$QQYKqwI>dFyP&b)bxF005l~!A0+6aRx2p~LSup@3fZq>uyva-cg)rK{
zQ+f<s9)jD$uNoHoAfu*I;F0K#HYKd_fdDUS)Jr1=X98w69KW~;L<4@b+o|W)|4uv9
z!mWGl40@+v&>ay$5|4aQQ&b=V?MW*lxMZK65r2IX#%OCp529u>q|PsEgGqMT$}Nj;
z;3fX`2#oLwH|i0YVX?lJPLKsQs|QJ&*l;l(KeAntD{xXZAh8NJFbm$Ki64wql&JBj
z70}-MAFy7Ickf3z8`iK~P}Y|J&lsevA_X7|6hYu0!ukz=Zyv<3*H#+9M#bg>Y~N}G
z)_*iv78@-dv?tc%c4&u{a{-AUjc{m}y%yj9es&s*%op2?zZ}9sWIFk^w;8+m{p|63
zU*BW=<$x|CX@n_u*mSzhqgj|Na+mGK-d5V~3iCNz<l#rvT>Rqp^rPzq$pZIW%<79d
zFR7%#Nw(-{M3eHTVnr=lCT@g^oeYZ!2Y;EjZMw0eoEL|;K6!;mXYic|f);YzMTJT2
zK`Vfr&Cv(a8yQ@?n;xWD(kV@3do`J-T(k^jni=dU|Mi5G(871?3A(l-JEFKN`M?@%
zLW606BkDJYnkav0^pm?mKe^ALt!$Qi9O{E<Vpv^mFx*dPXr4t=SPO%+Ef9ka#DBT6
zig41TkAwgr$%dtKd7RDNUx-!~-m%n=J7=1<_Bk51oI}||)zXK8G}ka6;W758>~XCe
z|40$xVmu4_=?ZbOsEk=uE-zf*H4K&v{|<jqvUy1*g`bT&&$$mI6o!JWSLHu-j7RQ*
z89NwfoqGU&Z#Yfh7})}DAWRT_XMcVWvRksC5?=Um9>Hi`k?)2*|M}e5(z~=>0!m;N
z_t1l}E1mr;KF;ulX0y{t4M|$k80qbZ>8(@tBEk}vS%jDgmy2(3J53Z$dMv3IR1XYi
zzL=vfrFdWLg2mu1hDUEgR4j-&V)^o$!@=d%&CyB!E&ln_@xefkj>?rikbf|jia8M>
zIC;_$!+HU1@hHc$l|XYB!QsMS$ta?d5yUE05BE%J8M_oSQaw!BBNbcEFw$g!YiaA*
zQHGo^bz;rG987!jrIR(@P)l&<D^lMtulDmw6jKB*e0e3At8UxBs=CbYP<Nr%91hFn
z$(1{HX>3ASe_vptFAx2Rr+*<ukL-9ojvqxGrMypt+syzLLIsGQDD+Uo6&eVx(~jV<
zLyXg`lsQ%ptB9`9V=_tE&URM2;y~2K(`b}u=3Q5hozmNkWNQ)YBjdO-As7NhY_x1L
z4cudc=-iLeI=e<}A`LamFTtw$&{B!&Bcm{5cz<Ivk>Yc+MB@`2SbrVFid7o5@AU5I
zB=5pt#opv+Uro3xSa;T_BPl)l9#~KEptYL<3R|Y8>N?hR;$UjVK4df79*qjj<hV=X
z0}6ntU7};R2Tq;ocW1?-pj=sqKCO`t+dI7wtv*S4&}SmkAt$%>)pm=3Z`2)iF&4b!
zfAat$UswFIhypjCtAA)_-3=C4@+_PJrYN>a_}5TGD{$aq7zO&3Q4~OzV$QQL&t*gs
zg)&b3j97~f;O_VqLnW-vfGs=8Z*UOIAY349oDjv@ixk86z6k2ZqH1?xN?4V)9_^JA
zF0dv5DaGjYd1*eXpqp{sD$B3Dp_%1X$(tn1B|AEWQaZwjU4J(C0;0EHQ;i?M=(x*h
z7ES#WqibQU#SG=0s7$c@qHcaXJ(i&56bTU2)acki@C`!|xF)*xglI++ukNCiRZ*eP
z&!`~Wdh38mc3>J$sg-5Jk=aBlco&Lb<k*-hO1!ug!%(gySdD8u22y4+jK@R@9aAAH
ze;UU0+1|*X`+vh|8s!+*D2x2oFpI0GecM>K@(MQ2NB(A6pv{-Us^gS45;C%ao=KOu
z7|yGb7(;uFFxH`^@7f9yWSYDt=%M??GhIjIZ+FKLkcn6H7?ERq^%waK`-|v~PXf5~
zNA8Id9u$tF5BY_7C_Z8LF%#tTD4&KK6ZXHlKR$;0BY)Z@o@xSz#ZaD4!}gwH*!|5&
z>U1?8CZ+#q@8ZjM?{tZEN^Ng%F0bEQUfF_7GyhHsSnST(5yFHt(RwyJmhKJeMs*KQ
zFE0=KSr*Qq&!fe3dI}K1_u2Z&9aoOw3lB>_qcsTOj3f2g6bIWMkHY3y5cnT{hOGWA
zAc9mVxPO=PkR`$(nSq4W79V0=g`oC0MIJ&RJAA<Y3Wg?<niwdOCZRv!$vi^3OEJaf
zoAZV!FL8Uc?KRh0F3*j^*P7eg=W{8JT^@AZgm53*6g{Q0x1n&_`xYcD+x#xlWQ>y8
zFp4=(hH(Zm)z#pmk4gMIybQ81eD$7nMC%)1W`A~X^3hy1E$*M}ahiafu`3gP>1iY9
zDaNS+e=bYRBN%oJ%wW#y>5Jz$uU$3luF?4li0w_9++$QoQ7^pm*f|y(S4>~Pl7`d)
zWts%y-sbgJ8M9&uj<YPd;Z6&d&3MQ>75~~imf?O|aE!6$hxp2A`$1K8fsDyAFxFSj
zN`Dvlx_5bqco{!aehf~hWjzw}EHsUZb)LWZV|}<c6P?T2^(nPoS1G>DXRGDB6Y#P=
zd^ntKb&lKaphiEs-U2wi7tet|iN-fnwyVmGWHxrBDirDy)ZH)3&uMt|TY6){n@94+
z#PM4QxN)~_f|%Hwwj!-Cv#~!C_0PJ7Lw^(=)6MbGP5<;4rDs;aYBo7JJLoqg_ogFp
z<B??3^|>0Rp|y#wgK+FGrnW6p2ke9*Mh;$-0zy{nPkixsh{wcn_MO_C@vbRhw-w_k
zLRF+q7Ti&XfWy<BC?(s4&mt3;g~uVYN%UpeZBHf@?6Cij63-~7aSgNQk$;QP5`V`A
z7IWtJie#a9u{)@jTMT<V>vDhH8;a@e-Ynwi4$y-?RScbBRyw70iMXR^+bcGMGb^T{
zu&Wd~5mmzPp$S+j`**i+Y-;dn6lSr?ZD$wB{^6mKJsv07u}rdC*TL!8so`NM^V=35
zs+=a3Zz;2h2C2RP)>lTRT6LYbNq?}mkR-`!bg2O$_0s<&j_;Pcpe=(QL@)roR&+`G
zpCVD*K|zy>AxNICe+^;?$=CHQgs@Escs<OUe4ZwpMh3HG?v-|S#nigA?}s7o_0`W;
z8k3=(IRw68OSm=A81qagX~4<FKZHxe<lAbXFb5V{b5&f1Apalp6oWGGG=H9b3m?LR
zX&A5Q(F7lDp04xMTH+guJt`A|q8C_?b1ze}5!m}_?&L4#@qD6uE+5LHZdw;W*@!YJ
zA?ZLV^V?XaK>*t+?1CD+Fd9;M(J1kYq%5TEXvkO#($blsFEJi!2FIeb1X3GJ!d>4f
z+AO()ic{&C)F)T7*zT@^4u47-1V`P$p;Q=@BvV`xCIE=YS%R2=%t?#Tq(7*aAigk$
zeJy<fi`nDo_JCbgw8JRBa<3n&?%*T=yoz*bFAnqjB>m8;njX=J3!yEO{xew^#*SFM
zJnP@wp>7O8s>6}n{HP^qEyEJOM_^$ddq*BSCq7rjuQU3;2$inFCx3}<J-V%lEZ~Aw
zXMD@Jvm+}c<S7b8lrDtyo(2CK7a1xS^FZ{&8ghdN<ya|ynk62lTk{K1tK{HcVKjd@
zyS%zN_@RILR`IICh*{$(?zAw_$kkTP3US?DJ!gA5xO#tf@t4w=V|~ZDpB1n*+^ip9
z8YN4X_S6|cNcZCz(tpijX-ZyO!p6^P?z^szu}xxiH4yj3W*KF&f}fA%l(GSxj4~lL
zRUA{>T5E6;YjiVPO&a>!ygv$EPy<smRU6wZ+Jd{CRl!t<-E1?FGJFf{y4)&L<GQY{
zRlv&Tl<>6*RT7Y^O3vajbtHd2x{6Z{)RIb)oR~MJX)AU2=zof~GD7$Ssx;l$L&^;*
z#{n#Lx}?9@`xpQ0FeMUZ&X8QzB*g?edQeTKZSekuTwzE6W+Li5nFGOFdUGyEB2+RN
zPbgv~k90`Ry5zymlcBE)Rgjc<G_zL6ygDvd_CIkKDzc0AbS>j2?d?joPi;i|U8OEd
z7gapt>rOv5e}5^d+vY3upZaPaEX7c7R-<R>%|mUTE{C)Rwk^%_w|tr#MTHNvdD65^
z0xTb`Mupb~i`Fx(Ol;$3&ca(uX*$!CJ+T_5Twwr;$27S7`P;Q|)|oI1E9aU<PB-5)
z^tmIwBe9<#6i*kVax6?+LB%&q#sa1;4q~LqB)b$)V1EYi?aFE{F0Ot#AKZ}kURZX+
ze6(w;XDlJY1(R%yQ!91%=$x8?2)_V}sDYR)2GOd|7(xz$RayXmVE~oTDYO*o`l?Pz
zcIu1`@RSAT#6a7I^IW&$e7fTeLxg4K?t<OU1;^fmnao|n>uNJx{=+!^LiPP{v!!lz
zEZh-0wtow6H#J)9jPin1%#4B{2m)VgWNfuDHk%k*EsO=FP+btUDE=qthSq^G%_sjT
zrf2#3AJfoge3T%J;JA*>QN%P?_;us?DjYir5GoLMC63(~(@x1nw<YSTo-$>JpPQ$o
zX`5@!g}LGfbM2x(E8kvu_fXE=?YP$9-77PF*nhd=&qq01kr-f8=ldn`@nYg8Cto~V
zOQZGxcyT&v%RD#E+Pg<s)bRRp&J}K7e?c=U9(?8aSLXQLBR|#-_|V-VKaW>r0U>T!
zXk#)!rNc*;0!oPV3y=d;){d$OVDjP}-6OHPf{P@qIr^YG-gVlz^R(`uoBRqp4`R?)
z@P7rgFz5vYS6Fm~+!YP4_XTut25j>NbZ`eOv+MRYXuzsv$UP4ak6#P3Xeo|xF}uk>
z=Gr=>H<KCw{okrQz04i*5MRQ}5D7_ci>@rcYR_~aKCs4Dl8d1h@%72VE6dB+wyW)Q
zS}&u^;fDyg)X2VgNg5*UrQ`r)ItKdrIDf|P6;xYUGsSD~<=6<&YmB;dw}MA*ovsmp
z+1%MGX`P)rUX|##bhJW}i^fjBhzQb0A<db%(3us_h#Xs;Rf0AdIibI!b3AIN3L)#p
zqwcPPt!btGATaQ>eAtSip^X+UAs6e2M&&4W0ZVjRl5o^h7P!Pu=Lj+V84=lnz<&}^
z)$@QL30=vn{860B#R{Foh+l1J79NGG-_#o2<I%Pi3P^M144Ia4n`<sj*4!bjp7w=v
zr{;~$nbOvA+;8mUw;bs22SH{*H}w%^4Ab3?y#9RU5q%;^xJQtAmI$)W!z0K%J%X&W
zZUh;*@>IhFbR>Je7{Yjyid&EQ+J6={;Q3?n*U_k=-1e+f_yAKV(&}`lqWw3Xuc7^y
zbJU5clL^2W_~8WU%b^2nnE*sTRue$w-9t?PQrK*h-&_uL4MRa?J-_zTH}>h*V=XAo
zp`td>U%2NawPocg1Dy*@SzX)BNqq$wSCFa6m9!#|m?ov-;c6x&99ppotA8LAr-QXj
z?~yD?jdQHni1Zhw`eR=+UTn@ZbSfNdvRcus&EjIao0~JgH241Kwir45=eNPwD1jmq
zx4?PFibF9;iD7WTeC8~DjEV@h!n(pAV7hl?lsk2yy%n8|onI%-j4i~sQV>g7b>u45
z3B$fn66Ju_%Bl0c@D5{~H-ByD;hHf*WE?N1##VRhEI$WlCnv|3$7iRq8(C6Zrqk!R
zy9A2_l6A__h*a)oo+bd&GZfI~!2HXDk!NmU5LO^mO7N-`xmpO8Xjh0ftLWCm$G>fH
z=C`BXnDcRknJz6A>0l6Z6ey*$S<JC2U|)tgMgwx2hL;XDK4#Z%!+&HdzVWt!`U(x#
z4$@G+T{c|jdT7(!v<ezlbF)aJFHRjS=GFZ9TkR;QxX2&ivsZuct}l*%FIO>>!KOM`
zA|xt8$`?`J8*lsK=)n8tPyg|Brz1S8G5vLiTAcK+j<2o{2i=pi)3@~3U%UMie)hM&
zem6?9*9RAuC;c~r6My)*czu0(Fu1ttAD>?R^0z;*qOwz{H%AFv4a~AFVhUi|VTu)4
za`wI!Sx`ceh=($Ac*Ujal%-%IrBi<xPO(yDEJ~L$#lOGJ{`68PM&%S`4t&@$Rr;gE
zef*Lvycw3?8?k!QKy+!8P*L6u;4nwj6{VuosQ#;6T*OwG0DqsVekSR%RhKAwuHcg>
z)w0v4O3Ir*f~?h&F8)xi#jU1q>%L++Z?&!X!?gf-+orm0p*FDLh@pCagdLV$yKZ#Z
zSz_~wxbm6W<*G<j&{VBQ$zmFKqH<6ITj;FBkJ5|K57fEikJfX?Ml21Xwy>B5NE6OL
zKy9_U5d6~s1%Djow{!nC1{t(fcDT?)B2kWPmZYIOAlyf>4hs0w0T{5E3>*TvI?Yvu
z*A=iWck{bJw@H72#lP~%V7*IE+r2i5<{UE9<V!DWw3bJ4D(a$RWZ2nBQmVcptD}GZ
zx+%yC>3EZr2tQn1o!=Y|j{4UpSM|z3URaxB8T%Y_TYu@c^LB8>e{==2b$)hPesV1y
z?9@1K<My?CTB{QDkBV)c8XWsZi$s?A^9fO|VJMYYQ7kKgQDCeuPLU2!6d<`i?O$L0
zaCUM0Ujv!kw8Mo_x&=oHoh*j4hzmY0VcSZ#qxFIwMbl6mw!EF%qxKwn<kN~ZTcnpd
z>Ee8E41b-p(nu`B1jEul8coz^uwpHyYL8-G_Iq54VTWOn_xV-d?jr1}$?Q-Z*xJ_=
zr{l?{q%=irV2eZ-+uGu;3$1wR7%b47sp)ZpF8EfmNnz7sdK|EvuHP8SH<{=DXoA{p
zu?>cQP>10Gy}@(JoWtK}^bH?j3OdAOK5!!JDt{zLz&TKkPQ0Av{WBBjs0XV{tjY0N
z36H1;>tYew3)wKK&B)u1Pt;5v8=D~W5yd!f{ySOZ_~R==*(gHc9d<(}DGG5^+e)py
z_sqdjQk<OIAoppM(;tpw{1&j5vbm|it|*=_a=x_80`fTtU0j}Ysy>hF<Ft-})4Y{&
znt#3Gv@v5cx4}t7K^YTC?QR9n@sW>`d4!Q`)2R{>;aG|aYt$P%DwcP3hHJeI>*gn*
z@{uN3o|1qmF(*ltG|sM-CX^_`+Vo&;%>PO7{#W$A8T9^JK#OJ8t%Bw{4`AKAM`7It
zm}fqeiQmglS}!X%E}YJp9;kRn+#KL;(|>5V$lWAD)mq*`?Ll$3^*L@gU0wJSm@)kA
z-`?cjZJI3T@3tfd1Z<nX+AtI6yS68Bu+20o*U{WtU+x_*d@bKF-sHL%$~(S>4jl+9
zoc!Psvy+GS1<X15Y`Nc%ta?Q<*E>Q15{ReyGrl9n1<8c>5gk^WKG~Q<`yJR&&3|a?
zW%_dO$r{y?A6O~*toC!qJNp)!Atj*-Ag)*Cq4bOg%M@?|QL=)jK=TZt-hnii7kSZU
zi)kKVyl5WH#8;s|n(!A)>q6)7n}H~Ta!I&DyL;-HgXxCQ2Ib-g%<hly3aa8N95l<A
zN%$GmyYH}nrTR7m;0jlA#y6+FO@Fscb_e(Ak!X$sik1`m1lakYdI*^~$rS+NCmyx(
zXccg<9i%AxAkZ+LcP%(HLsK0@l#aZz0K+Zd5fZeuV6TSLc|@2fgP#*1EM|vTn@0kH
z_~}55`LKa!z4N0f?HDx3(LsqYpD<xmeAnBY_0$x$RS_`Gz(TsfS%!7M@PDr-BMJnp
zP~SNQRx08vesT74TO!^1<}*M0P>r*InHk{~@^>k!VgVA%BgIwFZnWW{;wH-G6$570
zTDA-*PqIK=tT&6$<2r;(6|jvDZ#D*7jH5Wpt$_}7I&A^i%*g?fW@QY2Bos4uej4F!
ztd-N_Tri28btB5HI{*jV+<(hEXhBPzJ9O6;+Hv3z#i78axvOhv_W0o%pVc+<P{$?c
zpdzVDC^gYB2_@*X;;}j;6H<Q#<#f_;6ao>-G!I9$(=vIkfJIa+kS?znU%k7ZM8JXR
zwT%2sC~Sqs!o(H_$$WW8n!7@gD4$t9vU&a*4+tcT&#qHF3@kvO#D6f!MQD&-C8-%_
zBT6?|!bOTuco_)~Tfl$f4Jn1kXBZZq+%qGHW_Y^3<7g_io;nfeP}L~&^k9+aaN0<w
zEEyMu2~Z8H?GzRS27ZYPD2|vpLLaDrrl~u>I6l1^T-+QUUml$OG`LU(e^md-%2Q&Z
zuuTTBlJo2o#0<D~u77uho^s1D*J9qeXw`IC+DskmPW<^igpQNgC|{FL$dtmlT(I0#
zA`jSGz)@mFt7*rWSrKlpT>#<9TLE-c=Bo+-<qEV(9=@{Q7T*48^dX#5u3x-4g*d`h
zxw0ar7U-8b<DM6h#*L*f6Hd@^IHfYC@zM(x^C`O{>EF9aG=FF`(wuwMPiOC51eqrP
z3dN78uFL*r__5*x_y>#l<45o~8@Fk)<#N90>`m=wIygHjP85EuCWr*RWZWYw4*U4H
zoGlFU^<?cQOHL$Xk1g@G(?$2u`zQ;YkM~G9jmlrG2aJt`E0h*nS(paUzs*r^AjjOc
z`74=vYwWe_5r3eBAH&gt_W4uSr(4bEXH2_U&4a}Le~nhKX%g>c;Vc^AUp<)`EvWbo
z%0gdiN18jX0@Z76H|a?2XyY}}2YkO5MCqDU_m0HwZK&wpxW2oM-$u&1h?_51max{f
z9~p>ovcQwyaM~s0@|a=9i6Eb=en?Fp*Xb<4Ww`7R1b=1T_W9Z6@z02b<G`nYJ`6V&
z00yt$1FT~AMFV7sfI&?~%?fnMoaS;+-g4p|rV+7_$K%2Y02p!+%|JWhQC{37oEiH{
zh>v&~UE4Nhf^VXp`<528=mbNgW_~^r!I~Y()RkS=UGU&^Ap?Zf&vs0Rtz_Lb^ojz(
z!-c}pcYj}L+$Z2(FrN@mh~i+y1E>5o$|z81L`l$XbOV--`r2S$Pg+yIT71b&#%86n
zP2#b6w(!95Y^PBi%JVb}Yd4&($-0OES2$mdVbQr2AY}3l8|Z~b73T;-<`)7L1(9wc
z&`gY)sQfgH-H3eF(wBn`NK<N7tU#g{vCl1gB7dk00S;%WeB3&}I1XtiYEAvct-&@c
zqedLTxIXy6@%kKGh$`FO$x#oscSeEG0q+iJZ)X0oQ(MO#!=$|-e3LFoZ`xkKUYp`Z
zF5IWTR2AplbuQPNP28$az%dto2g4<*rvO|DGyq_p+A;pdIOQP1)n$y_O;8a)l<5j!
z`F~7T027<*b54vr^`j{wp@R$ZayvO91uCk|&<QT+lG2$qXc|OIO(U*)mlS(~X^t|X
zJB}AqF{XBbFg@yhh;EO|WFaH07Fj6DLoiqD!Aak;FcO6PZAiRzT-|jwhgC2`wpH4i
z2jc`+f|~tGFZY*EF@J3Y>Nq<{W~7`BHGdVA{?t_$c|QqJF(#E(m~>0^;Ucf;V}51k
zEn-_V)^^k?xv^%%`Rq@U(TC#9@mK3vUxl-IlKN>hU7|VYgXeQq8;V19wJYFAD<L5I
zdWhqFVJK%xd$yV~5MzG)sK^P7eROMVmuOe^(&%;qi2vSS{>t?P%&im<cPiL>cYj+)
zDO3e`f-D(DME->1O`CyB*BtQpUvUld%*D1kA83&eNB(k6h|_jVu4kf;?O@-SLGPc-
zU?H=l*5HyEd+Rp(2E*3P+?{&YR3gcfY0Rr58^HDZ5ayaLnltNcLfDWl8o1(0sb^8G
zfS;!-Opq8QnNH%qcuYZ-T`vKSAAkSkh{0ti{1|2QgKd4>-Y-5QZw7LpfZ>eBxb~5r
zV3~Tr>dX9fR&<gu#LJyhu~#M6g!h=32HQ$!VmZ-mV>MI~r-+*rq6iCNbVAQG^1)C3
ztU~wLg-4kN*s%vd7a%9|j;6R8$zg~ja4Kle^A5B(AYI{ktAuEZn3-F+&3_xXLr~ka
zUd#4$)!1ADjjCZV*R5xq69WbTPVE)WMvSeF0t;ba7urjf6vdF__c8N7gdA~n_Yyya
zf4}V%lPNsUyWTATc#3{7D4YWKPgBD7+T=4c^=iil{F4+Z8y!*WQD7q1qhMw9s&e<0
zDCY*z?oqIfM0Ff|5>y*FXn%inO7>g8vzF9lUnqjD!Ju};m?QqIVe0^5hY?#C8PR=3
zpU$Y`JPbdW_Bi>ZJq0r~^u(c1=DKx_a&pA4%=M#K<;c%lGs^Mr*5iFoxh8y~oPLgg
z*BEYM2<<$?YI;MRAEzO^-tO-1mnFmV#2nn}$Gt3HPD8PImcSO#A%Co}C9F0GB7uMW
z^foghxPRpm{`sQh2_POgL#DzvP9V8h)$-34-_e%^fg{(TDoJO513+T96o?1zKw>x&
zG}t{V(6X{0K_$y>boXgO{T~8QYNjsfI=R^z7XP0fJ=pV$shT_S<6s)H@ezv~qJsiV
z)Sqk8C@pSxl}nHrH-8{=2LBak_F`2_-{XdlJ_M*UC*$6)0!2OmE>EHlY@`;W%ooa}
zuE4d6S&ifHo;(3iZ$eT;s3joQ;Ku<}i|p6(ms|Slc8MV?d7jwPS+8oDMvMHf%rIT=
zZGww&%{;-r2tq{vq+Tb|I$ceI>jGT&MsS2<N^Mz6MLHvs27h6mWRc8jMgG&_Z4}44
z#;_g~lkwO9L|dxu-=Xk&DpcFW-qr}QD;@e}7;1)R{N-@q;RkYYcRxh@WF>6EpTkPO
zEc^izYV*AmXA{N0T8PL4_&|dR`t52O))n4mlW;~oZAjnE)7r*l2UQq(pdNUYy^3OE
ztD<;AI~B#7+kdDi{`~utEOKL`;P-}hDp};4+bZbnGw;<^IGq+dg}+uxjbx+3PB<Dz
z`buWmY$Z3&`OvQ8so}xJzgrKEo2})!#h-pXuuq^RBWb@l+xINhI;jX&I#T*%Z6(21
z(aR9Me*Nm%IKVV5hvC>?Ocm`k9=e6Db50ccfK_AL*?&%{)G%9NH<;G7G|?3kHy4Sm
zj4W5Oo)TqnuGC(N$B9;biGGRp_`|#_yxz~B@L5YcVpATsCUib*{vH?Z+yPcRAbXm<
zvqYp3ZcmxHSLAGc{1S8mu3OT?7TNnZ;j5vdQaHyTg~F5)BzxDHt{jAW@;1!h0J0DL
zSQdfr=zs4HlIb)QNx4Lgc=Pol&aH0_eU&TP>=A3y-y%Y_d~`O-!(8Uww7kFY<6C>L
zSk-B|sGVo2PYfT@U(<nJ`LcmZHcA*fiZQ1~ZpT+E<{Opx2i2HM6L-?1FCTN#G{54_
zuXyt--u#L;KRMpKl>Trg?o^MzeEg}V`W1(M#ebn+ap+eZ`YCZ}lubzbO-7WmR3XvQ
za~CWMpBReWKzv*0`3rcFQx7WDZh6$tiV*Sd-#YHw2<qE7y1FE&KpmL`A&-jA3bgZ3
z<aA*qeg%vq3*espMd`m%+uNJV>o=EIRTY}!WrMvt3>o;%-|gkesF`<tanj?W8RYyw
zbAL_Gq6RX89r5GU>ajez^V3Jr)jH(xwk_Q1fS9(ZU;An5W4b$)F+KZ4PA}Sc8&0Vb
zaupTp9(4s3mZ?Bh5|WOZ4_84{dAqqbbRAF>saZ78C~~v-a(CIcQH)Rux=}RWO#hOG
zMZF^}15EMQmIa(Wmy}6y7S6DcJSDKESbw@@vglw&m;f`Ns{)d=J=*kKZ!ecWDsJx}
zcDlWy7L!)yW|fPqrD0J+Zflj55aw6A#*cH0<y>6NAJz-#e2;(nB-ghF@5~>i43h92
zP+&rLsSa4Wo#JBqoPl)Y>#;eND<`ZxaG$hbwVJ!55|*#x^a(v9vv3Sd!q$HINq;;4
z2#t+G0vfa7B|}U~76u%cT2~&&UQmGNQ!OgMvnp3EtSx<}FJ^m1srnH}<|8p~ZbzJ%
z=bO15ZW+jiOOXHzI1*&_s(I~O4<pkNA$E|hCJsCj8Vq<--0+~j?ivn1b3W<pp~w4U
zGSp5Nf4LoQ>0tk!44Y`0agaEOet(YeZS@%8p*ltSn-3A&KF%5botEx)graTv=-RvZ
zvGn0OCuS6hG}tAVbHjQerLz+R$mQr{CCCjGdVHLd{Is<gwUnloo>o0z)LiLa6~%9-
zynnimNR<Ljxp_h4OO=Bi3j`EXanREIItx}mnjTg=i^tW%>U^fGchd+Iz<+O2p)$@;
zk4;a`4+oc5*g_Ny0*3W2N|TuMGKCZ+(#&U}{$3X|Q!Wpbg*j(w5ho(2V(@-imibP9
z&ZTdND=uZ-G?5H}WM-ximCp<@74@yQFD)Nx-<f*YTXDazI95;YS!rJ>|7dQC>q%(j
zabO;3E^tL%M{X>*T7@xxM}ItlMu@;T1q#KIESj6&axJ%|&1k#13U)-*sz#wvKKKja
z?OM}y=}b3eAgaCL`YjAvbhNx7EyamNtNLMUN)>;x%<6-2ZM7(!eOoq*W&tl`E*GjI
z^LS_t>r}CtR(7<&PFnHN0<Yon)<TFC#OBK>c8YW}M&U9E!qV1*SbuOOB=s%~BLB_u
zI1a*(2Ex)`I3_oq;U^xWk{|-QlTkn`qWPJh-bP}+etnr``k!EgMud3Uyr3<!{SwUg
z5@&Y3az)ruSKLta#6P&B$0^VB8#ej3So;Y==v<`sefw!|=!3AeV@oX4Ua*!stSeR9
zUZhEz(5Eu!eb(xzMSspR+Ota1GL@!16Un)NLq+7wSOwWuEZ+N(3LYILX(#;X&*qr<
zac-36B!S}H;PAMAb9B;wdwKKb?BZ~6aWc5Pl&hkofs$`L%_rV4NrNy2?l>cRotE26
zD96@e{{%|H%%L{KdP+=;170n#YNnyp%)qOwVM!eNOY?D}ReyfPmY)n;(tf)jsIpVk
zstA&*k5OK~Up=OzrF=p>NoOSRq{yC1nN-i;ztyk;phIqRq@&d|xr@-6l_emC$TR5N
zE~0>>lWkQTmyShdj2tDiA<DfwuR0xE$@hyXOmiCT*WgxDXY-2cIWj+r)o0;yH=@%n
zi~)T&4NyVeVt))@!`U>5Ltls2=O=@o%l*&{G4mq;6(R((PCxHu5!(4^qOfrey$^ow
zACxwN@(%l>ocF&_^x<?7d$)IbG3X!uqB<36MWwPxY-=W9Aw$9dQ&oomY&I><pC$2a
zmTNgGG3UopKni`lD`v7s=Uoey>Mn~?hubhCKVI(Wihm+m|4?&LkcgV^3PAE=1Z~SX
zg-v%L{puO%cs+qqG;h6f83ol8^*jGRdvDs@IC3S5el~su!tcGX<SVL{Zujl!H|`rM
zNmZ?Jm821+F8fZ*lOZxGp^F4)0F*>e%>C^z&pEkbVJ5gqrGg{eB_x4d&z5HuuP?*8
zp<YNG>woSe#d;Ff4MRT%)(x5X9^xSsoP|HB*iOg3x5mD4?|rx?z6dyZH%o>Y8$wxB
z5URNd9LxQz7JI|v^yywyS!&sTCp>IQcp#$w84g|0cOW(NC!LjS&Pa2wsnWtj+z)(Z
zjIfh2IvJyrG5ll<43wyf7$Sbc*J7m10<a0WjeiP@m8}NHbNeq>X80Tg5nJNuWQZ0r
z#PT}M4f<yz2ya!{NH%ao)ks)`#VvtL4gl1_0RA58^R1?IH2gfZ3wVjk<n75w)i=fd
zp|z6=(sZ=dc#w$NtI9J<<I!D8o;^Y7r1|xjOf390y?54PGBK!^7^qCU_QGO5jR#m@
z>3^ypeq@C(_aA(}7v9VYyebs@PLYS-KmHI-?@|uoQabb}dY`%ce06bR(L2%RX{t8e
z0jhNfc|Ys(vk?<>xZBLK_=y~4;!Ivb_))d-TH#Z6g^Qi23yBzDYpy1naWNqbgiR8-
z7)w7s+D6>I(vs05uQHdtkQ9T2SvM@8f*5onv;x0JD73CGG$`M9d-OlV)9FutfF+ZW
zd>((TV#KE0(zf9W`wShtn!M6h#kGDBWmp6Zi897yz1e@eSE}+}2XJvR7|({N-x4Sz
zaG(b=1GUI<XX=-{2RSvTFk%lP1{z<>IlX2>@pGwvs6^O{l3@>uevRw9fLMFB;HMsE
z2+1w$0h_EJg<j+IBIm2E?}@WvHHOvz%3psu1?ed*0sR!HY!K*ttbz|L`XdhE`!E^~
zb3@lNiLx)e+v>zizo+9g%k4FZpYGz@yWW`HvvFSg>7t*~hebb6pf=Mjs~r_BGqqpA
z{^iXZ2z5kwtCYyR_wMcfTiQFy--^mWNW~%g&1LfYTCm0&=^#pi8}xPtp-u~k3yyzQ
zOh|GXsC=1Y!e3+%X^v9}^b}y2yXYQL@H22%AMlsQ6qn*1LR@ioG=kLX!-q#QHq8{x
za34U6+2~}x*j3yfft0aRAS;8}ILd17wr=)#oD8zLAbpi4Z$>HoHJSPpbPzy%a;M~p
zoKJtKn4#H(i?2*?t$C`Ct5aXkjYof8Vyb%sI&@|T6v#1;PY*Btc7Azsb{f=0L?FYU
zOUwUxwGUhJYA}u=9ST&U62*f7!#Q~1y#=_&D^?6%)xL|;oE1MIryJ)Y^$fCbJ*(@J
z_tzK4|9*AczdSw?uvx;R)3jheAu>0^1qypvH28wz6UZtB<Ff@MX3+ow>Op_w9$=M)
zX_nq{`DH)+1QwVc{e)6JwhJ7Gg34J;d{T{a&#%|812(etZMfGc*SDd+2Js*d4(c(u
zzyn!x%-L#l1t-LToC1GYQaE3vl*M-OPtPkL<~!H2=^}}=gnKeuj=($lXyV*^za(Pj
z4Ukjibe2KD1y$tzss&WJn8km?U5K|Doy?Xm7`%2d7uFrpQEw_D%pf0?OgPd$MPM7}
z(rtG%1DeHq$YL%7wZItOjm8;F!2JxchIhUK-dH6|MeXqpi++|{;l`znC%}7QNF<Wh
zo!R1`)#`^<pjpR{q^xchBy1|xTpp@M!}xpy!kzGVike6n2i_1gx7~l3^0VpYwJB%D
z`5WoaPA{)Not&;sk16`Id@2-j2oQt_S(J3yV+?jT>Fc0ibuUDd!hj2SqzuU5`cFB9
z`0VpiVRZhLEFaG=*WNg$Ghv7a?>iP~aaL45Vor=DbdL>bGX6+8HL7@uCe+EiHsuCd
zcHkG)qtSx>s^_no*?E7Z>1fJ0=cXss@ZUdU)(um|!XX;`dLH7OL4^B*0HHLi29ef<
zRLtE=s4*DQG$3$O#bBAn#y^K(;Hz^1m8b4ABA&zNUrr8x`M0xo{p$n64pINY;pNG%
z$LbyXJoRgbXP?eL9_xGUmK4pj>Q#y0fgnt3BL#U9w09IbwoZSE9B_UJDH*$svLRYS
zA!HZSw0nS^W9G5TsypmTxt~D!SM(0#mv__|g8Lmmk2^LV8vbdHgQ@SFPcfZN*>Dfk
ziUT%=zoHvd9pV_^vN&c%3yBE0_Rvaxpjy1>w#>RFSw{u$)?=4dlWKk2Xik*yRTJNr
zlTzU;v?|*dnV5ep2oo-dkb+FyOEAS?2>3s?mE=GKC?AWo3_x<~0_*yY8Zr^QtxHAl
zb`8l{biPj(11}A~B%F^*RF*kOhxVR6MEpv_0T^u%(gq@3OibhtYi;SK7`s>L-<D%R
zW;J|w>j1T+oaG}DV*qs2hWEuNM$;Hr=vhhl69|NrhM9jF3yT`u_Bp6=C#Xv&RF@q>
zIUFe8AbUhBWxTnMlNsN=8-|7&>87x(;fMTegfUKKKPmIyH{NWgbOUd9_4c@O*CgHQ
z?%Xf@&Rr$(PB1*@zdodyHb%$>Pvz=VysmGph_TuwNFZ{PPrv#eJn(L!!54pUmNT^g
znv0y1spWri>n9{}$h=F3^=jJn!!^y)kq!{w5mD4Nu((B0i#Erl(*4H_LYwH_aEB=4
zhvQ4zS>gPwUv9Y)4ZEwWlcy2J0B#QNG<K{iL0#p-kzaDU3MMG|YCp7tfGjxzrIP@W
zPKga7%*{Ygr}egZbcYo;5O&cuSaEAyCi)u958r>4thoAzrLDL@j^2-k$3<H+?gbY*
z743uv|9aowz3tt^eCKmE8>YRCf6FN-#aJ{DK@}EYjJH+?i3@WQn=*GSTzQz!Vj`e$
zM3Ag8%7Zi^7cIW=99BUkn&lzox*S0MNQ7jo8%i2^%Mu3QI((I5X`6u9Qa<NbjY-J6
z%F=)7-2bRqKIPm&+aP6wC#%fF>sTm(>KSE3G`%W=iF#nRRzOZ+X%pl(U~EJSo_rO-
z3YgGF*@QfndW{2LH_pkdle`)yDP;;Za*QgV!_X)T>cX5ZSde9<Om&l?;O92YRn2Dl
zdx+DJeF_RM!Y-oW5G%|_V^LCs<8x^!r~rQ|ck771V~$t;&ARK4;I?=xm`7xoMb(n`
z0<9Vcu2zx>-;Zbcog7Xzm}Bs5l<Gu#FSTCNn|SmQ$`$FLM_*n6gWsij0oS2dd{Z-0
z*IMF3+YHP!gSB!G>QdPB*XdR#NJO10UH|yv*M`Kx+Kn#ocB2d3ZgfG78y$JTrW}9D
zBy;J7LYX8I8NhFFgwnqi;}p|L#O0Da<+4=~fb6<Ru|an|k&z$@(E*_Mk6AP(6QP6;
zjMA7*SQZaBvfqCXL-Buq2n5{h)r^gDGbUzoiHYJQyd3*%kuYc@65=3@eti;`ENM_;
z)QbLmIPwy5ASc2ayWyb?Zkx)kKjeRuBFh_*VX(ELF?6^lB(4I`Om^M^hJq!o6?z<5
zyQvCCbY>P5(aEg>LpXAPBQFU?2e-_~u%KGn0F<OmC}uzpJ?z4+%Hs)J_~qIG%$ktb
z?)(zvcO)U0PtILAXBn10;)l;a(Fd9)MuFZ%)$k1W3OT5yaf-&bX~tn}A_aeJtaBl1
z<cW{rVa&|by7VnfNxcLQn+f1nQ*>0gldm<o<+;o4!R`Ru!&(|T;QO$+kB^j~31UeW
z_a>SbiT-fpH?z^m4&yYwcgJr-{xX=%U438cFJWnp#|caC4Z!M}?g~2kM!|&2u5?TF
zGNpu(sB(N6yX9cTGB8!~D|dfy$fg;inqd%zgA-NVm3^pwOK*Boxzy7!0_8BIJrM#2
zml66czmth1p~L<!2fa5^WypW(z5UY<_RnvjX)omRTa6SY%wc?{<>g|6_ne9s(&@so
z_4@!I;+va!A&MS~S`x5LMKER&$NC?>7r%4fAX1Fsm5bjy#5U?AH+p}w772W~ubfNX
zaPc&on>5OUQc|5@O)F*HU{_@y%ugVRC5fC7sBG@oBWJmTcmg7B8!n;;7gW=S1n!9+
z=|I%a{Bc7WF1#qoT1ZGuCyJ;n>VlG~HqtV&HGcERn>t%NF(Y`=)dkl>!GNAXt|&rR
zY2}R|sUx7`+whMHlEQ!g5xzlSiUt@esIb!ymHw@Nc6!7>13;*xpFJw?qT(P5;Tujj
zK_3s%d_)jpPICr#@tEJq5?8$}J!rXn;BUEMlcfhy-HiXeel&qz9sZ7Tt*ex-f==GY
zQm-zbeCmh~Mfq4&)4ZG}gT%crZ0_fj)wsXr#9AGSt%c<id9r^~N^gFHV({g|5}ojw
zIjr3DIlZ?z0)kUr(aa5f@XO30pqqv%+2ZY-J&H3tIQ|Wxb2`ETs#Li+GdFZi&?TqX
z62hcA$CH6p-Ila3e{raHT9&`aWr77x>j@TK3qaW2EE}sF{i?92vnZM^OC(U#lgi!k
z0p?g=2QP7f(guHBwvC-_bF_b9bL(LL0u<8oSUEKng3?|{Nkl!RY(3W3ajZfD-S}w=
zvH6}}++0;eeQ+WNA+8cy8_5L#RzRu0KVWotz!y|jRxO(NK^uXq1#qXrdf$$e;1)Tc
zZkWyx0Lo*1C1NQpbXyc;<1l9)oC$TtIyK<E-haIi?kv9(KhWcUN5x7^jGDYbZ;G$u
zOdOE6gyckXc_}xhmHpP#PB#%FvvRE0`S;_SvC=WwZT`fEJwob7{AfdPAg0s-f=~hJ
zy<Q(A7|KSg$r}!GgHJCf`Uo9kC;dEu^kbf$$%%}0wh)0V^|BuTUe2e?0zYW*20jSx
z#>>1`)p?R1_)>#^7d@%$AjVWW;$x43Tkd_pAJb^4lfRfP&Lf5w<++L*B>M8Khr7sW
z>})5Ei(gh0T<d5XsZlOcj;~c+VvAEPGY;Lh)X9QpShUzYwagJ)<|{hn4a7R--i+fJ
zAL=Q4(5J~CoX2>GIfUT?!X8?aU)SOB33yXpx{FlPVl=&fj}EBS*Bdzk{JDWZB5~nb
z7)V62zb3woVbD>S!Ra@sYjMS{m?d@}r?cD=>FdV>gZmUR1;{v41}2`$pu{M=SeIZb
z+u&bq@WIjt((@8nAyrB1!;Ch%!X=Tzq?owZ9RjpQ03p0D8uTwp`S|>xzpS5BP0Mfw
zt=L*08no1ZU@nOXLUY<7!N!ol*1A47G$;$Ys%Z%{FmBcBLxYy;la3)gXI!xLKF<ml
z`q4eJ@A9(6i3#wc<xW*#{`FL(cy*QfGRIoMWoL8OdrvLRB7l5u8iLwFR3cQ*uN0LZ
zM3u>_Zd(Pa7W=tc3TQpx*P-gG1)|N62f?nIB4O8m=Gbm3r*nQBdHty-;DMQv_qsS>
z5kHQ_TfzTa%(yOlkS^g0t%_5~L=9d*`!Pyx4~9akBoc+%ZBC%&uZqcQcYB>Jbj&-O
zMYm3hXb)=Xw`3PK?Gr<;A8O@rj=&J{R#SLNE_crnd|oi{_*Y*3`{FwpPJq1VD<+Dt
zO;&k-O`~C%ATkFymFOM3t>_&+XkpWs$yy`I6l73@lIJFAA7lCC=VKhHEuom-_@6EE
zJUaIWU5e{)@yXGS6B=A^6#>_dBTF7AMjM#IK)Kcbx+PAQ5*k`D44!uB^3XfJfB=6l
z4uC01q&Uc4xWB)@84&RVkA^(QKG7{_vtl}bE7la<k~%u0{c>H~;-nb$@?uVzXdo!6
zF%uWxct>ER&VwQ2&hn=SyK!R>)m}=676KWKt;;eq@nI#gBT<qjTmqbsp9<gQ(oELM
zKMrMpkeY9s9fKT%)^435dGswnX-YLMXp0!96<K*!^kH*M!$@A>b%14#(awL#<Q1ZS
zbYFW;(dfbCViQ&lLmd1m54kpZAkNBFBwN0;LGUP_(z<V*x2(u5Xt=t3-}|uy6V>}#
zpag8p6%4=0PlQjD>XGu!q*;6mDQnbg7{iQdS&S69zVNR-9E`iD(dg@mAty6{82?oI
z!MC}K8iTHY1yZrK#jERT0#dtTM>@-Ye_2;eUYpC^ip91!E5gg2f0egllIk>+)3ZB;
z2<G^XjEg`CrCmB`Glz&Ccjx`d$72q!(=Cegqp3%EI=-BTEQX|K>5}5}r^^1!a<(qX
z84?mCn9p%bfnb!^0k))o+$FxiHY*H*3QyjE24y(n!OBp^hirhcjY$e?fUh=x@<KC!
zJv(sdv*IYu*q}(Wxdscf)orRkVRI<ohZ8NLIDri?^-#GhpFnwFOWU-8BA$-S(P|zZ
zY9+6IMnR8Rn@mk!J6ye_V%~-#i;{ehiu7Wlns#p-C(LuZX$m_cX;gN5{~!OkflN=>
zuS)~2=kBYIaP50u9D^N4?zwn>Y@=-+L*@?1PD-^FL)>bp<Q?C0hMOkNWb%}Yt*HRv
zRG04ztvRk$k5HaJdL-k@GMP7Z+G0EHd#Tm9!q&?A^5xxaO3}~%C-Gt79#^lm){NJ>
z(IO9&wH{fj4?@b8+<0-%g5n>a*f18k<|@tpx*c^Dw1R`J8YR%-f~^mKQTOY+<>i?!
zQwgxK5*7SieLGG@seYZF#QX4I<h&b=quXj_5t3TO_w+!YZz$DM%k<QX%Rvnhv^<MY
z)qM|J<X^=K-UjKrzBAlkm)yjGB9t#yu8K|_JAE(S+lH!UooS;~W;KC~P)(Q19awy-
zQiI9ZYUKZ-1`*^S4q{k;5a;gkXyIqP{~>EpjLyVfvpi6>eT@WYA?XpNaF(DxqSnwe
zAV20TX*nHHX+cy}VI^n9BUqS(w~jh&lsf!MJ67AgE!seU@joc&cN)dn5>x^w{5*-o
zR-BbPy0L(6`1?B}7<J@lqvYq)j9;wa__I{#ugn&YY?$~S*ookOGndZ9?7M6W!VVNR
zizmWnd{{r4Vz&;#SiG{d4h1_nN#erTTzGWuEW8vWK(^Xk`0N|nS&p<{jGcu?55wl*
zORGJF55A#2y-LRRu2O?@U+J}0J4>H@8+&`27V&7_pJDhtt<7p`rTWvnY9^8-2=@cZ
zgquLe@j$AgP><$+40y0+)6!DEsHPd?Gb)~=g&rrixQk<WW%DjhV$&A|Rcx+oUlo{2
zE-h7<3M5R)7z<m-u|q6ws00(#>QW_SE5R0i(h7m-C400G2%eY29#Sf=3w2-~9o}pc
zZ=}5#&+)0S1_yt(D8oS{XQFmBfuY&r_FaINW$A30if2%NXKHk(DK-bTYwcvWt5+-E
zT)A>SJ%>AstUAK)s#93xb1GQQVRDvi%cmx_$6PP+age!ZS;246(`dkY{GJ<6V({C-
z0*YE=#nE#xNHZ)tBVw-456({nl_2HB!MoG<(pQrZbU!>yIl2vW1@=4;<*uRsKmS+s
z=l%Wt@CN^XJAnWGw<vIpMQO#YUX~>T+v=Fj!yBxHR^<HtUPPR=_OSS^E>316qjG^$
z^$q}}__V=|9gVpIJx5h!C-<ZTv*Nu7jKV+NxIZg|Ym%JO!fKQyeV??;3$>qoRC)Ap
z4oerfg~CFdbq~LRLbs|6dP98VXz1abC0o+X7KXup%5-$pn_|7R%ecY)%Y)0S{`KL-
z@xkTskwl*dQ67{aS1H^AT}yU6_s1BO)IdBu1FW$#9kj)p?PNXp`mm^#yY>r0qK#qC
z#b-;etR7n^m9Zdb_6prfF-rA|ORc0vDPP302l!mcj`ET4g`U=r1=Oz#Fw1LPMay*Y
zSu2}=>F;)$=4E!gPUrm1Y&R%}p-;Kx^4Xp2VepSxoYn6+-Xo#8IoizFe>vngeFmSQ
zGxHFzVf9mhXYW(MF~8YkFbxOt$wMy()%}(wJ@p2JZ)L|LDBpTGPIC$Py1|_h0p5aL
z$8SIl#iEIG!}S1_J;$H)o{LAZ=Ns5=XXG1yUk^x@q%rdn*OoK!kL>$Zr92_l+BJ7s
zDf<SnkzBOWb<$M~l&6S=-Bz5+E6uIl$}xSDRQHL=m(n4*9D*v7SaWI^Im^{WWQxuO
zCXhkV0(78HMDHp{(W-BdhwTD#X)i!d`UNR~c}%*souoDe#rGY4h>Ys|^M{an6sa<Q
zT(P<3;ma5e16<Pp3aza+ao6;B{YIzws#n$obD!9zkblhhI*Yk9iKs{HNIcm+#h3u9
z+)tXtyj6B1pRgBth^k&;dCYg+Zh{=tq;h&3PGkCOj(=Gn-Z55O-$a{WFL$oomkJtc
zgYPiB!R-R>cK(_;oyj32g*2m62z=~+4Jb8NPkt=|Ix1-_#USEv+l?VUa&%1~(yr%>
zC45gg`RdWvjv)-7@*T(cq$k2!*w8Tyf~fBR__CuzcS3fcFM<<bWtGOfIe;M!)lZh@
zd2a-kE(&`D)x^#n--v%g?BjSBvi7CpSpyi(odditbq!{Nc;M_<<L~0`FCl1u5D*0k
zFT5YZ9)Hzg_A3fO1YSsI1f)s3pvs7miyRn0XDG5)*g^#wSma?(v|5P07tp^ZChk?S
zNd5pWlvNDS0p~O^E_CT=bU>PaOK*ZpHkpnwW0*9u2$K+BLsX!kz<CT<VzeixKn^0p
z`~P~Ag|GOI(LZ{bfIH1Q6iM2D^Kjdv{(8f7fN%BS%U(X4PSdPJAOf5e(Ag{<=OU7I
z%;63VWw;MFalvKODHli6kvUs1(eq>I%Wea)%s3g0XG8W=5CDAq>uk)IGLA)nUNlT^
zSTDQ1x&DzFehPo=!3a~{;~<?(Ik@v>?Y#XST6e<(c>m(VJKh)Xqqd`eH$TXp-uzJ4
z)%QO-y1E&2G`xPJdcjVxG2HpfZo})P>APO9OtSfd!DRl$u{+<rr6nDH`rBXXzjtlQ
z58p57VaV>|0ed4S0Vrqv@TbMoJHoe48@rWrtLfJ<?WUgn;fZ>vg90B=lKbA=OMaV0
z^D->uA9!QKtEFi#dbKityM~wjcO$P|LK~!l9z+MP5YruG{xQ?kRMFUZwt&PM6i0Jl
zAe_ULzs08&aDsE!NHjHLUXFC)_dVl#K{hcpJHK{Iw;h9(kHi&=6UTGD6%C9X4JBC$
z6Ny#cey_{m*_0*bH4vVi7eIKatg{jBK~Y%`;g`2`q1wit-40oQ+$+~T@y&$yU+#z6
zurv5`1BpqNw|&d25oOC>bTfjG|DI`=yg2Az9$#Ev93M!t*<Q`hpD#`>k6piCAD(?W
zzc}vqkDXmza|yi03c7x89`+zWYu(mIr5VdBK&&)n<T+P{<={O>wn@rw+ITAi!6l2q
zV9Z|xh>=p@NXkWjB6KEv9q#1CFiv(k9;-fR=pde8mbEMeDVhJab8&LMD|;kC@0KMD
zRCA`d)Hv3g0LDsZ#cqj^eFmGVFeKPL>BQrWkQ2BdN5PG4JZ}IUM8t3qB>|r?m%)b|
zw1FjXvJ4ME&*7#gvaRydqb(S7D*5(Ly+6JFf5Lo1ZizR4;OH<M^0N%yynfyL?lu37
zJ+cAOb}r0wD$0-OPN$aeCX6R%Wzu+Zwi<B+S4yPr4lU;L<niRJK_x!8DSr<w*hQQU
zZuUY{um5pSJU%PZ3UhN?Gsu>qwzr1B@^yKnZhtIPx<lZr3;OE__H!iI75oB95)AC4
z?a1QtWD$^mt!g~btsW*G%;zcg*{~k?*$MPW?JR#4n&xX(*t*H^!i4V{!sF7w3-ZM;
z6~ZdB@$iRDC)d;`e;z-wabAWzYW0IW33vEO1IVeALUqHm1v}jt+GeIk%a|q44!Wk^
z(1lyroCkl*65jv=N_kkM=z6i$G>bIgs>})m`Wu#iqh15;RtY$`N&!B<OK0OD4#fc<
zweyoSW8uSH%FhyFSMq&B#{f|D4kmZbvXA^nQ&T{eaNtU&)s=ILP;v`UC5Qq<0b0=^
zG=|OynMXuw*`$8&+b{z3F{*L`quGg&`0fh4z!<Az2HzGlz@x8n1Ebj!`j+Ge#z5aT
zLwF~D>Bj^4Ij)5dRQlR-zTHjp0=ld|V`hL8^yCJ7+zXaZ(<Em{oVW;dEVX)G3$z6k
z=v0UmP;ri65Y0q?9to<;!~4al)YU}d;Cox#ebs>}J|&Xg5mYp$Qm1WregfS)CC2TA
zuYr{upS|A;dv7*Y`;q^RxJ968ll~8^kU%GY`CzG89a8kO+#ZSxJwJk@m4>1K^v)v8
z**NYG$CuaqP02U`g-gF4ogH3%IzE-aAk)+4djTL1K+`?*j+<eV^d9r5NtBk)9>@%@
zmQv9wa%DCGa=0V5_0U$lcC`*i%>N{cYlLwRaR<C}ykU~J4TNvIqq@xWXAR+Da)Azi
zpDXcJNF_aL6B5)$hU3zGvD`Svydhs)?!DlA<EqJ|VdAUO2Lw*i?i(Gyk|)KHno*q{
zN{B{oG0+Vhj4&ew98G5&Y9}lM_iJR<Qys*fkrk+}`~5Jy%CXau%>YvH!wHy_NVb_|
zNKrOmGEl7;MFPHG_V6fDWNj#inPb*}Z1JWZi42k_|8MmeWmz=$B^n}AY?W+0-#ia)
zLLo96HqZ#~6c2|Y?|QQ4R1aH3Wi>4iu<Wyh3x&uKfB$o-!J~Eq2+WBPMDd&TL{b}*
zXql?CnyN=ktSRLB<%qN@?Y_(NSiiVpxb`$c@pl=y_#?i9j0Y|?5DS#@YuQ78Y2_b}
zPd{A#a{cSU#mT|DkH_1v*oi=naIKNvz>aJ}ipmlJ<8(#TEUElkNkXQZa+J&~cf%bi
zEboP^80_x`l20ilSW!5?6^V?^t0y}1mKbgI0<3$lUW2Rhf8F8;KtxISKwW&pvxG|r
zpf?bUl-K>7@53vUA$Wg~_W|vHd*EhAbCF~OAHW<c(6D3)y%1sfu<W=B8(4K@FMPO*
z2Y1Tbq$Ur>+3DrU>6L`w09baY<Mv^)L*@P}NvSoD)3jheg;&Wq{!)geqZE9p6dBiB
zZT(>E^IoNcle5~-RkQVR^}LVL+Ry7gHdY81$J4V*kys0@))pl{Lg7$<cBvYS?)E*I
zTyZ!C7xY7x6^HL6qq7?Q3l-r<;Q+!GFh7y@uyBQFmWC`VNvY>+=-G5kDK`_BRK6)7
zf?flHte<(goJ<bOjs-Q$KuvFPSDZkS9$xw*Y%DCa!DAFD59ZUbiYe=(twF|1qi$6l
zJOF$bm}F`g8iAxhlvy-?xD&N~f*5GQG)r&!3GIiU_^@%0e&XMWcH#2|-U(SOD`LrE
zAS@Mgm8U_Tg6FQ$yDokT*IxAre_Loo{ZS}mL%vc@|8k8%y3HGb)Yj^6jp^Wg`~8ov
zE<g5z-~H})SPMzf=G<ijv*%RCFuWxx#1c=!VN8Fu0YoylX>qoHIzA=f1NIj$G&o6P
zQ5{S`Adee+0NkTs3GB&PfzC}Dc|t^<pb>fG7fayI5v}jYxMrDct#QZDdU!A$W27zU
z3OiNd^HUXi0BBz1zb`4oTtF!`V{l;Q6;+FFFV3}QQg9sJ>*D|HpmdA({g<qpUWP4g
z#Iyz4-@I(0L3!nW6~AG>0<e0ewbGcNEt@4ll!sZG7HE$8Kd<)p_iJ7PQ*#t1U=JU+
zP$YBwI8FxH+|VRjP2RkOsZThYWFyAK*a7q4CVHqcis~K}wwg_dcpLDBcTjUsj@GVq
zqnT$Ur#42G@&nY2$+hVZQU3V!@ZxXhmnUbZ0ZZ=VEKM+fgzi4dVwezKn<<o;gA+m>
zT?_X)_a0$L4#iZDIEaqPS`ugoEx)@To{Z4^!l$%n2^Mi47|IJhtLu~Z*B8hCes$c}
z`3RkNqMEgD_C{2d>0B406=b@zgIRHBXcNS<H~!)K;oJS!hJ!wz8i0cb7K+izH=H!$
z&8GH1H*|V`gLU!+R^*FLk&;AbaXQQKM8kvg6N1<PReh*Il%5FtVLPP+3i0Wf^=={#
zu)9HnlHyWLPfbnKAEv3}9Q56K4^*$?NhnN#gLEnc;GK9BM9F-2FU(BMKM|Zl`DLjS
z6AoEs%n;(A)cWBrz(brt@Jb>k86kJ)YyQHLeWW9Q+6;><Qz&9t3>l$t;CGB)60-n5
zSyZ3{Dsv@i2&e#wOd^r89Nf-0)~7d6(;YD1+P-&eo+jX<OmS*@Jene|E1%uuu&P8=
zJ<e5TVc0s@;=tTuK8pe03!Ervd#N+14F)=FQC$E*W*pySQ8uSc9O{r!y*&hsoPg^Z
zmnLX`I{;Khd_(UrqHb`96cD=RU9!h$LRIVeIR@-8&IQr?qV`o+Hn5rc2Ufu8$P{K;
zb#DDoXFPYZhZ1ahv4*9u`!&ik*L{B#Wf>s!Lz)c@{-B$@S;SO)vJ{8V<5jbV(Jv;S
zu-ZCSu|*ZLq~^QT;}&+M0AMq>Awr3d;%g^=wpC&2MQNw|c#&4fMvtxaYT`PMY!A2_
zB;N5rH5$#*tx-?wN0?kJY+-^;y^4+AaYO<T98EBN!GwhgHVQE(Ii-L@9nf8x7bIXr
zptWIHJP1zC@4pAO&Hw!YtiBmu@~JXzI^nFD6KW{bfl>#2ydVA|y2<gBL`S@XKzz=B
ze-KlkTQ}Z`$bd|YF2XEKi8^HIKEokTLUCXM2EOydcW?GWwtu@XRxTIw(~tZYYVs82
zg2e#mKxOffKf_e`8??Dg(acKh68jG7uTuEI(zshP&YF$hcr50yq;b|9vdlB7=ZbN*
z+}v@_XK9=@%t|kl{lO6_)PaZAtPfy+0qKwjqQC$aw}X$@58|`j#p$l{P4l^S5NT|p
z10>a(8@~7GaV$z6ECNLR&61FKaLboyfg`rGhDp>=z~?>uUPu?70E(Yfp!7Pr-AL(1
z-M1TJt<^Z~i)#hvzSMW#$t<yO#xOE~z(CnLX#Xju4l;#Aq&|?kiGYJxjtUKb@B~y3
zAi<<l$jSsS=kvT^6ZtDe*JXpdxL|`~mU)KK^@}J&gW!>HZ4_WtZg#^Kd;wA?dr&b&
zYw}hu&!wf$vfEHueH)TN>(}Xt-iN;_3HER4&2>Dq4g7rNRjWVcm0sQbUwwqeTu4@b
zEqD6qEv<(AuEF@}ZTqZsEEuJK{@w|TQ+d<5E$;2#(wp$)sBR&2z>c|yQ)w)?g|qYQ
zL%qC)vYHZHRt>s1a`$6_=i=U~*60{?x14duxvtA#^tHii)Z}z*ZWR}91thI%`lc%^
zfuFd~iv|9M;AW|c0sjwSXpBMR@VFn!WU~Z<b`Q`J2$i>-`YTK&c*B5ySy0f|P$lp~
zpt8I8bn@v~=BS1&=R#%))K2W=Oqf&OpIv-9xV(ORd?Z2_B}Kk#W}P-*vyv^<Y7ZhI
z;z{%U5Je)$O&XItWv)nS1}xx`s*yWka0uGLlMur4+06vv@l{Ui-*C%?d%9`0E%}-o
zt`mMN7ZPmCYNYhHyJ8K00s{CmaE?Ds!E8Z>=6VJT+)4Lt$!K7nj~`358)hSFvkD`c
zu{-N$FEkIoii07&?4M&^>hf@1o@3C<t;g`IooM7lSw4ADABvwqq<f`@jRd@vYx}63
z>Al&sSJ0pV+>warI^^XUN`gf$7<e6=CGkI?lCafHA}(RMVO=GE5UbECf{Jo(=Kx+X
zD&a_yp*p7{5_2f6fq%zk_=H@s15xP?hqUXh`A`v6p;bODMM=;ax`3RNWK?)lNvQOo
zlY+{LbVR2kIxUHg0>k?K=!nhA#HJmALCw`6IBJgtkuh4_ga%&=cfQ2q@h)ucossRW
zQMY6cQ8p1!4~p`C$VUon#E11$4C>cW5{FcL_I0tXkGNPk!lJd?*y2gnUEADZL(4O0
zI1E@zxdUobzADmI!vT5&N$~jqi%;h`DL68qVWo!t@kx1q9*UH{8zq7Ym`XnDm%l&;
z=j)TxUk^T>94(p0jygYLMKriGfs9(5Kz7N-V{*#tlO`O0{i}rjJO`g^RAR=-kWHa<
zSW=AVeh5z!_y!UFb0jNP>t}ZsLH-i*ABpb3;@M-o(3Rqk_8>28uUEu6@uH{@=YdIA
zm+!xOdztcoexw~U8r;M>O`s}U$Y1V#_ZAKh{`%1)$DA?Bj!-xoxi?BjIx9xsy;UbF
zo=8&9vw{47Nc2959-(@}+Rxan_`T#bm=(=6_4r&JA}aaJHg-TubL7pB9#w+#gmTGk
zH5cSIFV_TpAkzu}6lI|xo**3x*V(HihH2~?R;(yMFb#KpY<`;-k<7+o6+QB!#frd(
zwtdl!VLx7`haAXrRwx|PO|7u(N0|SZ-A02sUO1zF0p=fNg&)r8QERYHTxT0FO1%X*
zD7Wld?_P&-^%y5(kHj{)gf#Wmb3$1k07r^$f;Tp_2W~=TZ*ay@cKjKJKfreYjQ|a<
zz}sRWIMx%gkfm8daA>lZ7VOB6g;aAu)n|Y5OBr9ACwLRt*~%02OC)Td<~N#7*dr_W
zGWmpmH=h{Xna&FAmuG*0oij6IJw>`<E1#j6<kQG%Xr&vQX6Zfn%0-xO7&2Scc8e}P
z$^*&h*!-cfYh}tcj2H`O0|4&9V8Et@22jGOa;uXz&<Dcpi30va{wfXnGL$3;oByY?
zH~_9O)T5ABz8_7gp$X-+s2Y~&J#;hXy>CQ+{&dx){D=#bF$W`Ol}b6&rF=-3c@WA&
zK&`$$*8v3lJ;eEDk-iii+Tf<>1IfdoPRS&|*lcpcu*la>!5&n<D}<O#IBC@lvgpN$
za1pR7<1d#aN^&&PT~TQ?!O!4fBj!QxG*X9F8YRAfI!7_5+yD9Tryj~U9P9tO|EJe~
z|57QGVszy+)Y%z7UuyOcO!TQ@WXUvPB}r56;{$0C8I%ue-xsa2!*L3kJFQ3e)ePPO
z3?c$Y^FWs_n`UE=g#TvTuhDGsyELn1AJs02yq0^U)@o+QMJP<`ElZye0jAguJrMH3
z-{crO+JLSYdiUZhB0|kKt(1#f^_^^g>Sg7OTTt+u06JF?T}mk09;QWpgJ5i*T#K=M
zfgNn)hKL)mB%ftW#B*3dkdzlM!#wUo$|W=aG#Iv^8gc_FOLr@E;638BbD6+Ehg=H7
zKc)l24T%~=O31{U&I%DPAa1P#G^+cFlQ1R>V<9><7y_nV+D_Z=<uehCKf>OB)1Q-^
z4MZbNcr&B~esPl%ID%<f2mwePM4g5y#e%&~LQ<z&;wyHjx5RPs^Pj|HK6S=rqhZ}N
z2EsSP(=A98e8P`ZnJ3DKv{_Fdf*Lk7sWk@4v@mFE5S-3G;z5^NJP>X=N1;~CVnJn?
z<q?GD(i%hZY_Ngoc27m9xgi^WcQiEz^K$)i!^HcHF&idiixVc`MNgQ(yGeO~rAgsa
z5xN6&`=L+(U&ykK4RSL+u;P8hY1LdGfNFA{zy}efsN@0s3}~@FmIaRQl>u8xuumbm
ziWAr<q8(V9>5WKy6X{}U9pp!$Np%+0!O5Y_qHd?=$x6fD;=($Wfp^M(?hfDXv5H&2
zwxG5+SBpN11~24{R7P4Yo02<{%-FGJCMqUp`IPHSCwS#Vur66BS#}=}Hjofg4!!vJ
ze^C=WIk(cT$Y@|p85G~M(7ylFT~Y<o`jBx+Ewk|8{q@yp|NQu{PF|(Gap$>-jWo?h
zBA3kqbp^V_uC)R0b3R#r3%sGhoA;PGYxrB~AlBE=wp<7X?syR1JPi2pKS`MzuhQi0
zC1HqjXlRxRjTYuR5M-u2=n~9F2D#))g`ICif9-wBs2`=hsiO@Jsz4U|#*mV{g{nGl
z>T46;5_sei4y3DxCm5dO2Z<rf;-ee<?wFCTlrGp&GM51!3u%adrHIAhzAmW;K@8Tv
zWmRcBDsQyQ#^((I$B<^tgaK^uAVQNV201^ZnxpxhIu5YJxxcA;1iL?ayBTPC;|hh#
z_&l3MADo#>OaXORT_4+lHwLFv3uTxVw`c)kAJaiJ2JzAaGu7CV;DA+k%>SECG3!+;
zdZWhdsE#KT&~C$jmaU24NZUr)s^J?6R(2!_Z_-(!GAd|?6Uh-B`8Z9XmZq|VWf1y*
zV(_?$aT97t%@i*Pi&f`VCd-<x)}N4s&TbWFV|8k2`eimX01BU-07b7M(8!B#<w|5I
zb-bi$>T?BA+ODU}AD&*I9*ga)=IQZL6@*4CZ$l^E!P*UfU9I1TNzU6F2K(iUdEfJ5
z-e1SX+)~*0m$;cf3o5oW=~_vv&!yH0fAi|%L>!)OaC?}EcR5#@B{Ae4(xnb!bk5<N
zC?iM7xX2r<+5;{~rwN3_`>7XaSzPwDHk<HNODox_=|YC=7+uIFs<<QE)Fo-+FDS~y
z|K><rQcH4w0i~QF4ze3o^Tv@dAtA25!uAHr{j>_X2}k4Twhkou(jA!^FHV}t9c`Q+
zwOiN`?Y5&Me5WZ{n>-tL-pPgzNObp66=PEF6_LC~LAzA-@r^PLII?xs{<fXh`6$tp
zLADGGHyG-0Kjl9IgHwb$2A5!CK&d!|eTozZ5)n#&2|4z|@Nel%Iumo~pwwd8eLe}M
z<7hygWs!;+5xOq<9u+EM5D_uw-O22+(rq!IE%FO?DN(Ueg+h<EM4}BEEm*QhUkE%}
z_O~(WJ^K2{_h>KN-{0?uct^xr67i9v6G-<s>gC0J%)+dOq>Ju2@Hu5pNx)P_BB-ng
z^ok9CzfvZlQ$A_xB-1Dh7NCe9(cnNXUhoEW3`P<sKh_hJSx>kE>j}!NCv3-hf;!d{
zF3ozbPL4{f=L!;c__H3sAF8?*!l!&Dr$9F0lth&1#rwnX`!{djy44KE6lyBRG!bU)
zQa~uUS07W!AK|ZORexqp6vj;^&u)GLH)TnG?8q`-m!9~>wG!Erh`P+e*GmR}x{Q+I
zyq-<2JA`h_2Dt&^Ci2m}c}vmRLX4YZ1y9;>U3!n;E+FtXlq`E;#%UWD`X~g;^e7*r
z?`&!S1ON3EWD3QmfI1L)={QlO`lklT#R9zw&-v4kjbf4EPUCr{<{}*rlC4}M?~NdT
z${CXSe*c3A+y#ezew=;;4DBXFxem#C;ALpRm}Vvd4Kqx(7lo3z^96HBnBNXmB{6q>
zZZ!dqkng96=Pt!8ZrR9!!5A2O4;y_S#bYYnyRx<Aki$-Pn5JK15$t6&c!YcLcSWQr
zd_e4cC*O7HAdNv@!f|_S@%xyKhq<wT#nj-r#b!y@aD-oaZ7~h<Eo`w0R%{ihn3N0E
zx_7lEEbs;HC;4p{(WPQ@EA6dZK(Mkg7cwZ~*9cB^GKR{yEhDSnRH}_QK6tyC5Nj`w
zken5@yHpqS1XJ~L5%KACJKh4EU(7=;1`Y0-97phtVe0KbVnrP;6LBbVi!2g<QrtK%
z;{g}x!B&eEl%C$DUighUo2%kEl_sg`6Ah&#7+VWH^wS~<_e^mz8@S@Ni-5G;uxm@T
zHJZMca9rozflgfwWq7gcP~<3?*C&e;=j({4gz6@IVfuYB>Ke0;z%1prRuT9bY!{i{
zd&XGpgG9|-OZD-hd*SPF!Xm7Hv6B2jrKtIO!$?n6&K-l{`;f|V+KAsbWs~srwSw$F
z$UXtAXi84T?$3*BC%3cx{3tItrO5$haoLn6W+8ka{sYaEu2exK(SZf4R<eU?@)MO>
z!S1EciiTe7U(8;V!q`uZa>U@%AHFAal21-7dKcyVwcZflhr}s<Q5mv-f02?EbFB&t
zfQO3VE-pR)ktG|*Q{qe$*;fe<F|k}dgQxlXX)8s}$;RB3apF56s#Kb#lUm+7^yUW)
zl!T*@&XqJaJ5{+M9!WmLZ#BCc#cl$X;i8J58_T9gU=2h-?1z|yq3*nyle+VV?|&59
zQYcl-vS2dHfs4n0m~h&EqJA0zhhVhAop%yF#*^6u5kQ)fhSsWi&u2+M`&ZYIs6v`s
zpW0!&a^|XF2|sA@^$xkZ2bF!@rP>L(oTz{e_|t?BOvG}>_vD5#xo5+Q?$_McX#5b(
zm9Y)7Au?3`N>iIa3!yBg@YG~B4rKOGl*^=nZZBl_eB4;s{)Dc7nlFiema*H}n3D{(
zk%xFZc_0jNlubsLM6ibjWu;V4t4WR_V=br+BXU1sk5fvB0SCB8)rlXY$&{0u@4gc%
zZCXSBmxJEhKm7okbr(L|#e+K-;k&m=?;X&gE!@0(HibI`-|mzjuQ&)eSNe07Nt>Z3
z<wr*XMfv5EFXbnHiNT-p%l>O9e-q&sKgS9FikCmW$gi3Fe=1@8cGv)JpdVj~lZEr)
z+rP}6N&#r&O^V*wC_gz)Ov<`;7q(;xjzM&o?~5p_sQ?)XdzOyT=nrNQB2ig<8-r_r
z7-FaNefZ~^?cEJU%_~hM8ox8nZI{#P>0NZg3Yl8glc)fHI~Ej$IJ0N)HkS89W)56E
za;vswYzq$4+1`G}eF%{#@9=$0(p}HeD6kB)xBN;Y+RtqghTwA1%ER#iVt1*sGx^F8
zC&XXt9TEL=P+%wOjK!03F4S}1DLaX*9|qix7lKBY9Y5B7{<v(c<Milv<l|W`GQ{AY
z?j%d_7D;}8irYvHw7($=dwKbWC|o8cg*UeNGi4?B-)9gvAj^nW^?Q>=Jzz&0MVfiJ
zo175!-n0wFgG6B!-D9cIKTDZZD!KKI8g1;cmdnrlgxQx5YSz38esQtkfVbYqg~;$=
zG<eG#6R_K4Yyd8zk@#5fDJPzRzFy?HGKTJO4HI8~!a<`zhm3-6sHn%Vy3EZ)NmU_K
zh}!UQ80bAlMiZ&5s7}F8h=l_s1DA#^=^WlN4_;~|wCA^gDWg&q9w6o$<Y-T^1Ht-K
zrA>+YR{+QNC~(UqElhkYru5d-;mbBdd%tI=+RIhNVqxMB!xm#wF$v4|fGv*k0t8sB
zh*8piM_q`*%C&l7R5nuJJMU*O%QCDb8gc}a$Kj8Cv*OOoAZ0aq<Di&B81YZ}-T9w%
z8}ZavSwnU>_47f^Ca#B|*BuXl5IFu=3HU*_IZ9z7AV3TvQ{`0mTgkQ-RBUS|m|3PZ
z6WGjz<XFkT>g7XIFCQ9uA!QwJW%rCQTj}tBlsU07QM}ug=7?>U;ZKkXqcYL^ljDy^
z*9TXZznop1{O^Oyle1Hav3UO82>DKUIVf~|r`#Sqkx}|dyfU38FjR<nvP0!mXAIvV
zX1%N0!df|K_AxzI{9xb^DrqN$j6YPMP-^$gMmk6*6RJuF9~%*!F{BKh?}az4cwj7l
zSyX^23^l7lOUOb;ILp1QcIq88{VaB*cStd&BFrrd>Z?n@_EUsPF%M`D_t&jipXDsC
zhTM@PllN3KEN;>rm-Vs0-!Mco><tUhDl6-v!CjBv(?BoZ80&$dpxS3$)&Ua&5h?Cz
zDzw88GsrLXHw@`FTta3yIeeWIvX?x6+=1PqF7n-g|1AujY7+PYO(5TeU(;+zhIxq2
zrgSxQk3e+cOoK&}eSg%|aT4m$4^fl3jFCW%l-evg^ESx#Qo<%y#xcF0OIHx%8+ycf
zXGu!dO`c>}2X^u4uvd7ImXW8V-^C_VTJSh(J&hfqCn>g-PqlED<uEh_PmxJ~RoYs&
zmq+!ebhK>%3^vRHFKF-tE)6;on3}=OOU)+7w_}4h5YW5$1grbGX?>arv3_TFto)?a
z=^Y!c)-A8lhS&83ER0JjuzcM8D^u<G#m|TJhp=uzD-+rs^7yjPTMB!|k>h2!>iBw+
zi?d_ah1F=Tb5;dGXUNFSiz%mnhbX-K*yn(c(*@_L06opPM8$VD&hJ`il#bC?OQQll
zdZU3QdeXN-)|B^^)vHKbGwY!KXWEFLL^ct*&#MEyt;947IG>)K9@`2{iVsiH@|mkp
z<-kH3=?`cYe1`7!!eTy+2N-?ttQ+kO((i`~oZk<<LAg{Ev6_$3-^7f619y=6^ZU}4
zl6{%9EX?~fNyTSA`HJx9_+g1z;@<hH{Ur?t_9|ZQ?URFlKQkDRp>DLziz8cMcR72y
zWyKc!cl=$p_+iQHRSIl=QAKV%sloeyKRT^p?f}A+8#|xp1)KQ8kDP%Q2yN#^*cwn4
z<i}}qIiwK5`g}kBx5O=fTn`lx*jqqHzdFPH3@Jd!(-e+E_?+qpgUGOslL2v08u_jK
z)jCBRdhG`f5jmzxT^jIL=&#oBT4Q&$D>c_z?Mbt&Y@&L5kj~awTXjTd)$V#|kRqd|
zvt?qf->kUC=4x${g~v6R>!u}tVQhLZj_)-wQ7x@+i|}O+Kh*|*p3?2XOI-fK`-z|%
zMLvucQ)pIG?WB>P%bV{D0A|TR|8jxK-(`}{l0t@kLM`SfPLvkWP+j*Z(xuj{1Mr(g
zNzMsgkEt}5i?YU~qmkAQi9&-N2nZvNhy>fDo&by!W4>3)FhN6#&@91I=m!j*3NU!;
z?f>`Po3IzY@g`1x=aipI0jGHOhEAEQZX^P(FzO4EyAXHfJY*z1#F{mcMqx`mgAUlB
zNSC#@a!Y;B_JZH3wGSsgt#+=$8i#&=aHWN;3ewi?b+$N%?qn+`tJ1gmAFbd5#_@`l
zC5~A06qPLyop`yx7TvNYKLOYiU@THL8Qjg1FP>l^#_K?T;pYo`@7Lq_RaP7y!qJq~
z#-g!SX{_z;!+HfWsHX*d5FmhOB6SEbF^V7AuqQ)rJ%PFpLX`sOK8aW@1!PMqHgn|p
ztC5+dMJ~z1II9k9e^!cE*5-6)xpllVf3I($^EKVimpfgDk$|Sv9q`YFrrrC5XE(O4
zRW^94Tl3j}P0vud`ZyBH5jLP#txJSWf8*?wY7L*Bhk9)lJ*)_CTq6JVX+&Wu>iBAU
z5z5y^-5^Ld2gu89_S5Z=&VCCTzF&nK-}1gjzfz`sg*4*Xn=&E{$aMWO<p%O-ev$H{
zi{fjA3+maVjAC9LY5ZC2M4Q^(eE&4-%RTAg7z8eV;CSq@XcrS~(a5}o#Q=s>l#Rr<
z=SkOKqON?62~+ty;-ogSh*aY^GK(0Af3`qUaN<i-loOR7iB4HRJE2a$stF5bu^K@U
zjd6UFMcG_<gCm`(zZnkMD1wAR`293XALp14DN5$fB;a}mJJ6;;&#`2EzbV~poCy{%
zwZC?MifOpfxWXpXh#hgP51J7B=&lOAc2#Oqy5Z_kL#Zyf?xv$art1_JSem|P?kCGj
ztKy&479b777@s4P9k~HgjoE=@Lz!~9LC*;&?c>&wp5=pgz~DJ!qJ9Vb<%BwT2_#1y
zhTtn_<c3}kdTAkPlqv{4XIaCi;?6tmn9z`a<JD8vz$|7Z?fX`B(SvjvD;vZ5lD|T)
zhN8O^^Ku)5RjYIqdnmhMxiRVZp-QcZa3NX$BroFe*ytV3L3~VAeM(mzFhrQzP<U>3
z9e7{LNNt6Q!}MqQEE>y1(|ncF>3Hsksx%Qj1t)`uhAZMJbkX7I*N>+e!iy(}U67i8
zR709*@B_H0RBeVpudUC?V%@qisTR;#El>J9LG!6Ahi)X<yt1{lOgMkR24-~*_2>bN
zgN6znB3Zb|^lz4B3n>x5OJY`Cdja3J>SL?{^4z5oF6-+fe7%Jbs^T@~_#F)Rm9M@&
zS`v=9<S@&aC;aB=_@3E5!lgzJSjP8%OOBX^-BO?Gf<S%YR_W<QT$<zZQozRQeQrw(
zP}PaQni84f?1q-t?s6(Z(G}+u7U=S4Z>WvJqtkw`52Y$k+5sQ`z=|<N4z8<!!xFDe
zuC5v>6?h3`#jgr<)ie1X<E-<>uLd`j51|Ra9o+1RY9hP|M8)+3yHhC8d)!ce`daRm
zx6CU)a`ovC`U?dYaR7^Zk}#!TuJD~3XR)6mPG;n&eiIG8sC#E^XV>n^E$HX@SdcHh
z*gM(zcF-ITXx-{3>^rxxSMnT)9}kF2Q+@fLUcCa@Dju+2%+VFNcn=c^Ur)2NNC)Y7
z|GF4V_lGGsFumH}->0vw4BX;>Oe<Nq^C=s|Bh(0lH*rB$fAmD-Q=Czp1bxcIlEHWe
z7x|xp0CwbGXJfwHas0Cp?{{(BKl}LW@%7R1`-7{Gmx37ngn_iu93lGSeeiFaIsk8f
z^|i^ON3-#G-unl?=EJo49UNCpb$(%cFcl&gIl_~3$(0>L9sKp|>auo!u=mm986=CR
z?Kk_!LiXX#$@%#!{{Q~27~vJ}NuxWM5X5d|fJp5zDBK|z-tjnn$j$S>(!#1<gwnvM
z&p4!Uz_^bg6MSI|irA*aKd_dAcrI0;k;s1og1D7Hi>49RDNCsy9AP|G_NhvAP>Z-o
zr+khlpvhIU3_w>T7Cn@I>DtxC)CGg=Vj@3qh%`~@0n|;X4hm;e80}wP%QON3+8p&^
z>fto6bTH^XgCi<5hc+6VELy$`#iWxMO!@p01kg3hI4qq|)$154aU^`EagjHOmuL`4
zAgzwy^`5h#vV)b`q%Qi#T6Su>px6Yf3)zHSU@;U-XVoA@5cSf3k#G1&RWRsPj#lK&
zBlQNN!FY#iG)kozf56}Hu17^1wZH<qY6&aQu$g*eOr`-_C^Ik_-7$`C^QBY~i=d`1
z;tqG%AuZrL;SSv?;J;idW5r;9x3NS2Y%kPzv-U)suVdBvt)>pVXCyypo|9kY%ZB*~
zfb^Too%5#Cs(faDb7@Ek`)*+m-g*Vm@(t@Vu*h$X@`Eki!%&*wa7Tp9SL@ZUCSUEh
zO1|1(KKZJ0u;{nUy=qfgNm|Xe&0LMvp$G7xORyP|fb7&3a~)u{^|;t=DBI}Ke^bdf
zQRvjW+S{t~KbMFy67|yQTt$v9fF>CT0(%{pA<Q?w@xQo#aP_xzM(F^_{)TbF%cWQ?
zuoSpwhSg~nr$~w7JfBg{LCZi<XYs>=4ay9nCu6o-7C=v&w)404TjXyAe6G*kdc*Fb
z``Ei)kBQwa(znX0&(Bng*R~wipBJZQ{c~eY;kE@5`gYdGzIWC~MZhUbA#$FbeAnYt
zy%Rjzw3!BfdW!QsTy(Spv0aNhz&-NG0_Q%ha(R(*iC5oqGm6w!lKUjuNhkQ-?|w%&
zDBrxx_JmpnGdyXTl69c^21}hhfhEbm^bJ4tBT`NoVKb#hZ{U<_E|pL%O3ci?9z@0*
zcH{9hIL#LtGUFTUvMsTX6?qMaU^Si+j96YzsBA@lh6&m+m=l})e9Hg&>0e**zrsW1
zo|q>5KQKa7d^<cmKEJ#^K0Q1;IywCy6RcF_y#DdUug4cE0gG1a8Sh;2m#z;!9G_k)
z2^uq4$Y@o*P!8tSjNKSm&gR)~mCaLPA4r}tWIHg@JEkN&kK@LuXp{c8%F9{7J)Z=i
z&lKH%T+wCh!Q9j-Uo_)jH(*~k;Wx8p_Pw)aN^p}I97R_4IMJEuJP5saBFqYyEefEe
z9F5Nu#>DnIdl6yAP_>=%Qtm8HW~prO3(`*RZkx{2j0B9xnbv_ySfb&<>Wf8ZTq>t6
za=&O>5N)Zj1xDHJY=VW5JTb<Wk=hAI%L_$+oiy}3q#-AGl(MY#+hkemdt_N_sfTHk
zH?0CY?(A&ve2opy6KeGQ+}z#R?fW$Vf|+ft@11Q;f&dXXS*t~UOr%W<rI#|7nl8;_
z3Zx$J;hj<K>xjnn@R_F-ONRQ|RDz4}z$apqs~&c6&c_3_ZE0m(h|s)`c1ZXcNZx0E
z`(KFcIWkY5D%=!2+(8;-is?rTkv<G_%u)QvhKp9>&0vKeu)-Yi?1efIjPMHUfErOS
zd<Ub%bi^hf3=ixOLwljeFr5L6i(xCYRJ5DEerD6QeErseWraMDg%nkViO7<zD1^z~
z5yhLrTP$t~(iuM@8*rC#z$^RR)jFqtDudV3UU_mDw5SQ+yloSWI#4%tDTbX)XodrY
z0y02Bp#u3(m77I1ElBy7LRdqM2~IjDB9fuQfwd`nmXp<D7b;bQtn5LB7upc(4DE(|
ze)|F6sf-D|#j95#^k{aq7h)IE`zp|gwnK;~ah8w`W=-f8{8tc$`}_OV{JhYAbrg#*
zyGnc@y`=i7`$p}l*qPwJL9qp^@S}@&vtpP&Nac`ta??cdBEME~88RMPmyZ^Lr0C`)
z1aUj|xhR#~G8#O*(p9=<VYsHBZw%Wo3G!{KZ5cDz@eXCfzc)}ei88Hu=`Xy*=oR&2
zxHoNTUQu4P@&U^h-xH3){0@A7krtk^C=Jr$l;t#bTBy6|VKXN^%l%bV1FToH$#gW3
z^PFEnhH}L9RVc2@jUbPBXDr9vbscwr$4#u1Ud=HDaS?rCiH<QpIXFF_&*;p<L#V%$
zv0Hu)nP<56)x}8_l1q&(fVpN};F2#kx(%@^&0%K==iH}+=<=$+MTpjadl0lJA$>I+
zs;sH>w-f&8HA~}VFpm+|P#vTboFJE~){|S42JN!Zv`(z~If}(D!C%h9g_l%%10y4b
zpDUTNNJ2NQLZQFb=;u#H$TM7A9&nSlYFd1N_!61PM4ec@nNgNU^8+2YrT$*KIl6%d
zueCT89bw-py9oBs+EJ~4OETh-@B@I8PH~G_MqtE(CH~-MWg4-aYrTLk^2zJ0$&@ib
zYpCPkbC(V)fke-glHp`s!4>5HOz+C@whzab^oP`!oS*f}Emx|cDJaJoHY5ixMHWB9
z><(*_@DLsIviG^r`|G$rv$QK*Qbd?7ozjAsOr`Q#@jQ2h1wmVXBluxD#?AC;@<|_z
z$I{nID3Ak40g8V1WJxJI{YwvN%j;kINh>e=z2%|>P`epaK9!a~>s!kfVih^absT}H
zPh+lpzYWQwT96jaqo%e*kG>MM+o(ob3z^LvdEM?ko4OsYCDO;^hS}eex@2>nWASu)
zFdV+)r_CbXYCSrC;f%iuq4xB47!~~fc{3{r(jaF2TqZ<y-uC#o*XnzKl~M!2mo>W`
z`)l!yev{uK;5oYGvfpi%&Zc#__YurD<S4_3Ukp9Q2GzhH&e`38d~Nv@`)Zq4NwMG5
z&qi{D86&Nuunlo7eq0syg?^!V6`sLk^gd2!`FIXt0~oP?LGfWW-{O7p`AYnyrv^?%
zKbB(2tVZiY&SGjlmMp{mT5^pVZdLNm*1LgV<zVNqAsXrNi;&~nPiT$}gii*4>H6~E
z!}b3@zBp5!*l>xNFuW9~4)R?vyAQ~Rq4e?5+2PeE?V`QA7eK+f0@CU7=?o~mu=LIG
zul$4S)3eKellLcwW~3h<C!I11vMtZ@?ELtm^zJkxqiE^P^NW+yOXXb7-^*t=3QWu0
z_OIUc4=+y6OS8zrS)%<KOW$0b_OH&*&n_;HkFGyloL!yE5BJ*<^}IyYb3d}q>A4Jy
zkp!OHL^eUo^R*CjanVm^lWUr)d<m&M`9tO%ov)jJgx)h>^?`c3mSyA~JR|S;M8_vO
zKJnyy;xHYLWex0di{}+!pgve=UtEqy=-I4=ODyW6y9um(6X=L~N7Or_{)~uvUZv{o
zuK;BNpKpl5Z}=jxsPpcA(A^I@R?@MOj+K;H$q~AO>AyYi1mKwkAvasI3mn<5V9T?Q
zI$kk<gBN6f;-R}Uba#f1(07FXr4afPKJ8nUNm?%+J;{AcZ*Ps-i`gwf@O1-{68O80
z3xE&mi=^#p)s6~2^Qrq<&>5LKp3(7)7s)fMGwZ7kM6LiTpus|x%qEphIlcNM`@xW5
z!5hjGhP8drt82-o@)DnFuhfz(YXcfBIj7Bkv8P5I7ZwzFnYyfJ$GJMSSjYJ~&ew6i
zEpfiHLBR?cBwT6o<$tOEL{>%G=uOR-;u_U+l<fl|p%gEKhm91;c?r5WcOo1UE*c`t
z#14Dq<l^(8@WW&qb*wwK)v>Kk$>+mEX2sd)9p_DogUAMN{xK_h>8N)D{B0}zLr!pi
zQ<tgknzX5FQb*@II^WUx?OabPWLaNTjB$GSQ?OvPUk^U&EaQ8szC-y;tfIL5y;<@l
zNgtAG&wn{R`)n*bNofk@4o}ZY1M}1E<*Y!;5ma8j>>poV9=!W#&2-Gcw5MURGUboQ
zm&XT}m&UO{$Zs^9#7U2@Gfpbs92|XrIyvQQJy8kEy&3IAl-w%634HLhq-F4~))j4-
zyW-5&axVkL<2ZeQlpF9Thd7pXcd@!j;4V2XQSeGNZI#TM0DJ35eg&^=A@5bkkvopu
zapc-FBQzJ)CDob9WXWR=x|AuIkISG4yiD>TIz}WfA9*Y8lUwY^&p?LUC*LlA``NJ9
zH(JC5XEItk2DJ^lRy$sougvT^J!8l1I&Sy$dPb<pKAxFTrMkuUBBVapik?x=Zv%0r
zd@Zsc{1f|{C2^6{ZRs&%;;(tu1tHaQCEP9tBY;;B!7~HeDm}q&FYf5Ci#wP*JNR2e
z2OUf5SW?H5o|q-&Ri5N|J1Vh%q<m{UX=8UJe?Dd0orql-4IS6o!d>dA7+}6K2kdTT
z9SiJO;M23fK7)fRQWfN-8a(f0bfUTZYQyYL&CbRAo)7Ekh}$zKZk~u@dD*scunosi
zay#RD*27wxSP%w%DmRQO%R1P4#+#Tea)n!|H{JPC+4^*`_YRf1c&n0sn!1b3@5HuF
zY<u?3T)7dRq5S}NK#0G%fX+gRgi`m1zZ_ijj}2d}FKqshX2bH-|8o4d&u14$`aMZY
z${l_@IQ?*S@WJq{n#2?Ki4Efj2wl0~PbZ&_FaLIK`fdRsEBkC6d@8;1IWF!bp$cl=
zhH3Cu3--vD{CD}w<?&xH|1O&Ce;%w?;A41gmc_=$R~ILLC$}&7p+C4|6Z1nTcz5{A
z@u%az@9qbPLcf=L^!pkUK1Yt;-=P-q->C|5X-()|R-R_*XkjL@JEN;;JQlUNt=IPz
z=C=@HMz$0)@)TqEG$tIQw=2Jlo>G9J74JdK;7*KreqxLyDCOec!b7#Lf4&f%=;ATX
zfhml7c`+X|0raYNW2Hk58jE}5kQ|G;+);Lm9FQY<9wv<Ot3W4Cb>h@&;#A-gr^2c@
z6)Yo8g-&rQSVo)*eZ;At6Q??Hs=6i^W<_x-u*E4cDWdx3lx8{0r33`;1E@p;;P{*s
zO{N?}fZ;#zi2%M6CXB*Se>925m|7$+_)MZ~XwZ`|tmO@(bUaQU!nojEA|Ngys!mq~
zu$U8<jQ58`Rq+(*H9CnN<H>9y>Rj?kAjKV|85IB<8sXj?=$4Zt?@OZO{j-)O@1KJ(
zc^_SaKo~~TPNwW+$~u`cnzk1yJ3+D&Bs)Q}6C^u9vJ)hwk|E<Xf0Gkm23d!&v%KJ6
z-iFhZu<P&9^zTcFmO(|d4A(AN=C)+%=Z)83Y0bAHUOq)`zeNHk{oQ5$`|2|PZAWbF
z@(XsdWoPs4Y`&dr`I2qE5*tnTHM`9zSRJOxJ<AFt5emEikQ*U*Vtx%Wl@MO4Bk#18
zwxD58NH;gL(Fo$Ve?{;75&l}gm;+-v)G-UB0-ELG??r}1dKHKWG4Z;-V2O^-_#1Rh
zFgo2V16KkKW_6@A2874SY;42oN{pRfNhFAaoC`3SWBTqgOaiSmz!K4m)`om8NJ=v<
z?xG@mNN3|AAmBq5^NUb|`Gy41MFlm7{vwOwF+7x)N4Kaze;lE_Uk&)=c!zMDfF`$$
za46&KKh8LPr`ywB_#2@9IR3%{>UZaUH&5u|C;Ruob&jV+6eqb^wWHML#PuV<jtS&F
zdbndqddv-mZO86#8^fmmNvT3+1LPph&knA%bPo+t|IN3bQcE<D4Xn{!UBZ$?V}r#z
zR-+Iej+bKPf3GmX@a7Zv5D@a)zZ5Y;j&M;piHZRSR{C`mjdSzoB&FZijpq_=t8?P;
znb<5zLnn&~bZJf?#>>q9kXc3TB1&w~1%WAF(^!Eimw2UG1EKV6Bu*g^BxWSORl~Q!
zQG*@ZO<TcGji9Dr;faT<@$SvLhi@Dm%}m)HA}&Nke~p3i+OijjdkIMYyvu0(Q7Nyi
z`vu(&NWw<}p6*vtUbjHjg>%!nI&y(>MvI61JDpodwm#jVHIaqt!(m>OBXiv&<k^7G
z4sn=E9fL0eKH~auZkRjlpGPb&;)L$?i}iwH&Yl<yauqD8rX#i7#a&ea8n0fYDq_ii
z6G`Z#e-_{9&4fKv=J5R0WVSRtjhQV=la7pTpQhS83_k<DlO{=RF+B!x4Sm=HIs7g{
zpBA;JxL=aL>M{BEQv259Kk>)>4#e^xO~!K&rH8<lBYww7L98dORhq@OF<3tGbe0X6
zrPh0h`4t-Ec>e7uW4vE}WC4kwBgNo{8aUe%f0VpRQF2d`qTc6oOD8CDn3LBh;N;Ba
z;BCo>{Q^h7GPx*!0BzTU8~LGn#0~~Gd!iBpZ-R9H&z;yfczp$?o*ShRa~Rw#9vmTV
zz|rs~8himxT5m4^O>b@Q*Y0u=hq8C9@*pn3+ZT}X*<iqrs!2d%Sq8Dq8zG?oWLXM(
ze>+JtRzYu|G=fA4E9$TwP8ZVH(3{2v?PzScfW`)`X>3@cv4KTn8*CJV8?i=E*vKXX
zyt3gU52smr9}gJ>ptFQ!@gRJN=CHB!>L?x;Dpw|qZ=43Id%!r3r$*br^jV@Jmf*2Q
z+7<GK-KWMU3)=X*`ImSa#)Y)9t1<XofBBodue&tO5g>+~+6R1rMa;L^JUX%E#t9ZV
z8;|@r6`r)PH?iRX6uKjRRr7<JYvD(H%MY*4`?_kLo*78&8rqu`MEJkk_?{)G48tk(
zj1%&gv<I_kevLB$c4R(j8M|hw3wflN()t-!ChdMMqqlx>bF|Yu!#ZvdkHG%0e|AEN
zhXEJEog9r^yAEJd_eTIIsW&9Nt^pl^@IplcrnqrT?k~dLE4~4j8BVoM4o(kxLB?)*
zzbw-gy?{7qJ05&3{A;9ZHO?9O<CjyGz(NfI(@5XM;0`OScuR|csGa77m~Y(>k&FDe
z`O1=_G*-<q=7N^NLhwjU#w1Ape+^SF@trvXk@F$W;quKlJ!3hf`;Xz!=*${VYY&tG
znN(u~HX^pYkCWjJezO<;UVYMoPkz6v)Cj;v1lf(ysD^rTAw~!VI}I#NWyEdJP9NGN
z0f#-p^#4*yC^Z|_b1zDI#KHD5y^JTMLC}xh<})OV7w-?lw}1Md{}Mt6f3M(s=?x5!
z1&?u3OE+^iNRwfct{lE36Pupc4(Zx#N;d;FjHGwsLEH@ZhZ~U9qr#z0Q#%5$^3{*h
zjgq~q)04l_MhpF&$I%NoQh$2rXyG+Kk2Ab1sjk1~v^E}_Xsh8$ZQk1&0>+OmktkVa
zv;8!0=(x9xw)@$++_luJe+>n&uXyI<LuMSfbSm>ZZDrB*QNc=$h&j;u4_DYSgy#Vt
z3S6Aj^B|oi#n*iHHD8N0y3CYA_6SnJD9-XiyN3`QNl&2Hg7fxnqMVC=b;<_Vz;;fQ
zzTo-<`i4;yk7wE1RkpO+oa~fB<IsRAboV5wQyiqw*EWfuwFkHdf3D{l`mA$t#Xd|v
z#z`UNvOpKIfX<TgSt)t+W^SY22UZ-y*&F_jvdI$H8pLZ@aYeR<n>H5}C+Uz3o>5MD
z#6hG5HyK7=_{s{r7d+g>gF6yObK$XZA7wFODBp~Vh+Ucwk{;Y7-a-9|sKaY-KR)KW
zY1oeSqm!IoNYPrDe|&9ceQ~eRw($l6YuazE@psH$U`@IN6m+^lTd&)F`@p)T)R8wi
z!^Qm^Z^!=vhmpa7ejxEH4Pid{0)+N|;IE{E7&U_!ei8{44b$^!fC@NebL<9SFk7Kh
z>hoDcg^JO1fkic#b2D(EJgSHe_1+lz8c}i23ur(KZW0pxf9y|5(7{(KdkI!JizsF}
zh9r1W5Iyh?2wT(vh*j{z`e8$;{}-MoydqYz(F45%pXL^b4)ZcFT|Ks;{pxs12M1@_
zgx%(`SOf2DzHqKzaLz`L2?T3n<9v?leLQA|<20v}QcrGO5xga@vS>yd@oycM9o2p5
zrUReKI}H6zf7ciId;JFmy}B<bYE9pWT@a3i<h;R*%UhgJ+9yl0xe|BPIf-fA{Kf_a
z_z?%FqMhZ!x+Xm{;B_6Hx$g^_hDJ+2E(x4ytOHFf3cM4>Zz6LKfUQ+`brAbpAhvwU
zdmvvV45kxh^F4LwxpC@2S%8cSZ-_j8oboPzjj~)pf2D46LMFXh1D7nhkFzwv5Hxv-
zqwAP&$cjCa7Vs+LRM6wb<df)OBL?6<ZYFAF1=wE3%cdG;($c}EF&B#1A-|xP;le4c
z9ceFQAP3A4=`uq|K|`VdwsqqtjgXgMUBk9;8UUk`P>cNEAVO)!il81RYQ8%@{q;ZK
z+y9iFe<z9QkD&85m0ei`W+7|y#s3eiux$h7Mkfv6FKf#HOnYc3T+sIBDON4v##^3j
zJ2FwNn_W!`@Ej?`8m`!$QT)G>CNjF!7vGvNWFZ-C)(`if>hn|bnjjat^<w=f2AtQb
z*>u3gNpz$IBYXwi1*Qs-GqB>ibA`t$2*eaef3Fe>L^A=n4Bok+psoC7MYR{U&N}6z
zgQwVF%%W2COaM15w!aL$$ba835f6%CO6H*LHGLZL705=#%2b(NC;A#AMaHSE7jte|
zk*{#dUXTd?pfk(Q)i!S^9ElGE74w3*k}j<@bO&K#Bz+c}iHWj~ucAd?0kA&C2_sXd
ze+gQ;wKa(wL)@S+$Z4Mm7nlk4er5O$z+@^Oy{(&sv395E1!4SBYl0Sk^oA*6i5OKi
zLh@G8ifZwpR}!1QP6_!}X<1G-t;JR&l`Kd#((C>vf!G6V!n&#Df$7I;S><DrDmiEO
z27S!pr2qDJeTNVnd)h)tOBFUFw5Ibve<6!Rvwq1B(DnR0F@r-qdLotH23f}l*wWAV
zm3XRrh3ZA~Gu?pS$;XYyd(o;K`E~If^Hf?!IEh{Gz0Xp73Hnips3+8rmTsS>&C%I8
znH@6*Ugw@2w-3vz>ue(uy+Ib&OH0xzORD;53;lK`{IvfpeD3L=T>~cr^Y;hwe>-?E
z5m})I0y?QS6FD^{rKv#Hp78dO+B6jcGcCiV5qBhfZh)e+V%ukY2Ndyw2PgG{mlkiC
zlVX{+8|ZFnUM&S>yA@94Idbrkx;iZCMP4xANK-tJN=FkaySJbdJS2E6?1dKWLa!M6
zp~K=H^e=F1--vChL;VZBOojUJf8gQzfq>K6p#Z*Xh2y1ni}VXiOzA;4;8*fd1e?QE
z`5H4$=FgD~$k{rQ&B9xXZ`X8VtkMw_gQuodRH#Y7q><q;&bYW4-)}fA>#9ia1<Hr%
zc+AAFwauR3&CyDJv2LBMJ)chFp@Q1fhMRFzYrHW=!`wbtk)*5kc*9Une<-kmI5|kp
z&?0*?2mJ|zxMvXu;&6uu{C`zK&i`Ao4QRTH?j>9Jbo}Yv@rCf5*H}mn@*_~mR5IWy
zLyVeSD@u>_#KH`0@kI(GTCMP*%m8q>C43%mWaZ?5PtVoOp`aagll4Xy2emvuABCc!
zx0frnNn94TdD;LjlPy5#e?3f`Fa?QikWNH71CEXlcU;)br_o>;ueS@97iq@M(>yM*
z9IM>}z3_d+Y?(JaoQkhosMT$3v*yt8ndcXAmC+I9{^w4i`@9dhxCF*E#T#V%oc&bb
z)ogSEE4*wO4^{+JbMOvIpC6Rw(S6C`c*77{>xj{B<%rQ|rR3sye;XsX1)WQJSS-$o
z2J?EB*HWCAy9?91;#pyVOf<4~B=B(hr~$COpqNi%xW8k*Pd1qrbMpow^Jd{~+`A}9
z8&vuLx`E5+)<h)P=8Z<GaK{Q*BnNGUL#66Q&(&{HO>S{FALKTEYe=Kvr{c>}lSB;|
zMzER-Rp0hQ===F0e*m~Q+K{O%1zH#)nfcuh@>lgk*h-G;Cv{Em&y@Y^)1=6LBFT#t
zc}su{!#?F72(<NKmc=TInfMel1;$AXsR84E3h|C!$}t%>{k^AqnB_A0p=`WM^Fjv#
z>;=Nqk!FQ_Piw&VB?o={OY_KEBJ`+)(W7;sv@TTG4yQ-!e@5!PaDRXQo5gIao^d55
zg6M~DQ2Rp0TCwwOXvciWMj7Z|D&6=Dw(OegWU1XrNAUe}i9cQRuZ=8R8hUMaN=!WU
zHJCoV@=lq8VU0^dTk~ga+Fe=y4$YuW+4x%^9k|cA2b_x>nRdVpxv&{wK+;$R{tS@l
zs2l=Ben(d1e-C*d>8mb!QV8z~b=WF#bx@PIntsGH74I3QHMn1ha$Lj~MEo&KZ#o7m
zfUPzPl)Wv3KIkUXlKdQ!y}_nEqS2S|gu-aC3e6EiE-ki*DLh*-WgxfITg;G~+88U`
z$r~+*#zGhk!{d9#@eCskWV|45JJk4?a(Ij%rBXl(e-;0iz+hF<9A$$z8S-JwD&p-B
z(zb%@CU0ac860)s^0KJ8gjw7`Oq|ZwYzlv6?&CLxG~TeZ7XmH-!e|_jJXn^cTmc_O
zH3%{C#t40%*bHurRzr?w%d<Q%#Nt@RLUif4))EM~1nBMs0u{rxp<*&DXR9z;oM;Gd
z*GKJpe<iVADnW%YKX*dpMJXwY`IJ4o?8bgs;w%$j9eVSnIrtxcqp_E@W8WuP`(k5-
z-)i$pEKV#zAR6deMVD52Aq<0n!pEWpB=6)dW?7W+mGGOTD*da!fSfeKbCODa<P4yx
zAfL^gFX0X<OHg{9Xfhp3adQHtB71{${EGepe;+*h#T$!H*<(?~WUJK=o5`F1vDh|J
zTT|^2yF=^>VtYcRsIRgb9)~6#2V27953G2{rBD{pB~d?mri{9wx1~F3nzbo3phsJ>
zAhKOV;3=vhTl(8&bN^F@CXtiCo#}t=81>FN#QJh<>y%Av^Xb=?bfR?fDwqB(6P1AM
ze?8(q1(l@tJ6J_TzR?Tc_~Jt;uEuKd#ENR*g&$%#SdcZ94rQJaWy&Eu^&#`$64K0s
z+Fuu)@JxkLDRJRftwv`VRg-@nb%s{Jfb|!?F7GV|)7Pz{4f*CmRWy0DN0E0nNhnEn
zscMD!lE8L#*Yu=1a`=?wuyodS#PH?Qf57*k1+Xu~mDV<eMM$eqNldx+t8itKUvnM3
zm9yR1d+w2^)CCrnTl$9<F6kdEm-L#{crIG1)f4u}9iwdaS6`eYw<YI1NeXr=@(=1q
z?}Lx&{a3oMlrI+*NeA_q9eaFA_V}yK6<>dQ_k&ZJ;Z^+YjRUq)%`YjU7^5R|lbq)m
ze?{<VWdeA?a?h!~<7*Im&ISc5j3Q}vliwXO2~+(^P09lo8>HNdmBH7-4AnCf|Bl9+
z@Jf1~+))=NhgC1``XftjxvZLwtb-J37dHpZ=T!F|Gs;!QeGaVl53m2QUjBMEWm#nE
ztW|?Ir%mM-;mOgGme*7f%~aCO(rlh7e~Hc5KW2=J5ZfTNXXZXHqmMgJGo@;UzuR!u
zAsa<dy%!b@aVP@qo!1B$X9vh>^?;T|Q8l>dvM-|KR*4q);Hikr;N7#4xCxcmi2qFr
zhg=iufL{MNn{r6lU~S)L%R2PJ7x#Vz@9CV^8J+niQ_-gnl>re&U;YK{f+*n0e^6nV
zZ183vl8AD$W(sMG8Hj;ja=>p`48PD@xD02wV0k*8nPPx$@g<h(gJm^NddPJW%XtR=
zFLsB#Np^*QQYW({F7j`TqQdSt`ej)GzDKV{j17%bt|QN|fey+HuZY~ibv>;eF@8z2
z_@CfRHGVb7(wvWNFXJ1b(*44)f5qa1H+43n9L;iJizRw|QzDsoFywli!Z%E>E1PO1
zboDvSS$>H7UT*O|SF0+y!FD-rOw%Ms`Gws>teS%nmkO0zvw61HwuUus^w9gpj>nda
z<9+U?R?Jf&=BxQ$tBT9){*PlW4$t^1zcJn_m+jDWiMI$WcIwsY!!-E=e^eyT*k<ib
znl@xIawnZq6x4W*zl^Qvx@5d3W0Alc#aq5C5_iWix69|2rMZj@aBa=(a>UO5v}`Tf
zme(FG+vdidM?88T_$2x*rD*F(oIpq%eJ=^cGIv=q1$Rsd-feK$XBRz!vs&E2r@H-W
zG%9N9x8eAZ-)bk-?lw)9e+xV?`qN$IES*fjc826t**&}fNBgqUSl_TjEi=8hl&WM&
zI-hcM2jg)%unW?)F>+K+14_)TQ#F2SPs(%oLUkl}K|C(A86{)L(wictu;a85r5ga~
zbm}Y^C9E(5DlWCzOJc>qv<^)L99XGiNJp)cmQ|9B=xjed5bASQf9MJxLFJW%-*d8P
z+>^qhd{^hIiiQyOjnQwuUz2#nr#WO<e9xySYd+};tsEdd6QClL(H&3&K0Pl7`Qkpg
zI_OhJ3kkV6y7j|;CUO5cnLX?Fcb#Zp_uPmFIru#hC<+mwM<RlqqfhKiFCN+%{hAQS
z%;e{RK{*vU%hLOJe~5Zao8p#gsx@M5nk|L28Q-Qj$E;=w`NS0Vf<MfPQSZk;;Cdo~
ztqxQb)q-yFA};s{!@U5GgYuA#=U#|>HZ_zY^1;`zO`-NEW1_z_A2u=E8RDUz+n^lw
zxihSjqs_X4>0<AWBm0$l)_;2+n0-8@lUv~E>Emu9=CZT-e;U{B`1(usSj?jF<_lEY
z(BVEjRSVI-4kD$5(Mj<orKS6E_{-(xIp_-$t5(<Y)`e0H#k-=w)24rkfx_R;M4{_H
zb{KZ?v6uE@*~Fk5_mex66&}cv<Oep8txAE;d(8E;2JrDNH0XjEn9&ZXRYt=nfQ`}6
z12W3z`t`%af61AGh?BFG;9)H=aB{XouD^LUC<8&98iiHG1AeQ@sorp@<_nht7K2ZH
zx%e%B7+=$3Fgb#qrDW2zWzRjTr^+&{Dkn-!M{=7So&sDZmv4qAXaB3FqZTFVrIgxS
z)%~kQBCL-lun7P5E~OW#f@<SAmarOP1{+noYLRoie;)2@);TWRS}3}Pi-AAdmwaop
zmGJS)-A6lBP~SgQP`@TskYADqnJK8>lqsmjq|(;v)?oT3R>1$WArIXZtuxQsWUjVt
zapzXvp_g3gMk;dnnOCgk98@{n7^yd<U~CX|Svw6g(PP;P?*eLjl~<La!2Cj)3ycrB
zY*zEJf7G_xUrU{<`dmp4`ToD&WZ^5mIrPt^rPiu!$0VAEH!Pf_L&~ck<>ZtKK?~^!
z3Vx{cqoRgQL+`D<6Y^yp_`DQc{Yqk~eyhY%{rbdGt;uL(0;$bW(naG8I{LZ<eI0m_
z*J_#hj>2{n_9atTm8q)lnW?H@m#L~XO+AWyf6~XUiJG=ckOfQY2<$S!&CG+s+JMv1
z*N(ovZ2D@YvRbXWGP%aJAhHd~tJX(ow^D$4<3#gd0m1yrYd3cU?JFl}W<k3;awfyn
zbRHT-FMh(*Gr>-y&p72q7b(=Wv&-&YI7|mv_9ZNRd~|kr_38NZQgpDp7f=XMk`{bA
ze*?0nm%cgvm49%3dUkp8{^aoB^5pDPeXTtj%CkH>KfWlvJIyFTN$Jh=i<8sK;|u*B
zIMqm$DR<kyde=X^I5{uPA`53pKAS>v2YyziZ>~=JSLf$v7njFJ*H|`Ce(1{q%#3z@
z|BQB`HnB)(hv8Z}r(J7#yFRDg=0tAvf9p?*PL6IZN6TGvOt6yYu;V-(=Xu$pv`UEB
z_e_W=Md(D9Y-vR@Yw{tkk6v!x)9%S>q}$ccPOaDxu#SK&MZo;1M>)A-zg=?0ep7Nq
zo%XE-ZE4P|xM?jYIeCFMk9uQc$rxX_x-)Y4UoFb0_*LbG?1*P4{XMz#XQ%7zf4523
z*<YNl(=T|_q~5-%Im@(rOK~x)=I?xN;WZuoc}n`@hn_0KYTq-%szgeeUe%piRk@6c
z+^V2s+5q-UU2I*=6OMhBujnAEbF}t-bF}uGbF{Wr4A!M+-K<)03>ialw)DKooUSif
z0@eHI5E?N<>kVhT6g61M3A<E^f7u27b@acJKVP2wX=nTGx5@U~uV(x8O%`ubYTsnP
zL{`OM*L6u&o|vrask!2+<bHMJ<y#{!8b+!_X2xOS1}xpMa0r9voAcTqkFA8y{Z<K|
z`}GN*+e=+d37@y+QeK+}8nYN1lG!8w$#|U0$4*XbmAYT;s*BnwsFLZVf6HB|193!5
zJ2F2vWW)C8*(W7-N1r?K@8yYqI*oYWH;uRy`vzuYGweetx44^Kc;yT)llaDnfBgH|
z(Qpy>?drfv8UCz^jt@i`sm%MWQknN_Qkk0??RJUGOQ7bLz?|HFRsM7O<2h$FHvnzs
zDAr))EALp_H?G;XeFoaNe+$TD;!9o<p2R<ZT$1?2J4wH_q%U{PMO!pbbi}2Tn_s%z
z4A4HZ$>+$EevZ;?!UyF$Vo}o8uAE}jCn2S@hP`lqf4`%qZKx@2oWmFkK_R1FUd+c#
zK#KsCnhyC1IQ&tE!<b5bgi&^j5imL6V#3&v4Le%h(dw_2RyRz6e=w#pgIUgUNqb=}
zK**v2P$o{<Cex^hfiTJZ&;dqfjW{??Vh#$h2St<&qikqwaTwMj*C-v2(}ytT#6AxQ
z&G@S@!3yb*IS6LFKZG-dl&~*UkmNC*%qF^u1Onk8&FE%0)XbxpPgzUmbzkCM_fNyV
z?w^!@-AC8JgTiRqf3dMAWn<CQ+wVB4!MTo&b!@C-W8V}Tv+BF`Thw>!SL(a9=3Nby
z-8PYf0%!S^=AdvfD77{p7S-jU=&1Z!sJ!$oE~P|(j0+!h&IS6E6IH(DH?Y&`BrS-h
z**?nUbPN{<ryq_>z3hp}WN=uLXmWtA?H<BL%blJceA0dLe@%yXK64tcs*TpX|B+9m
zIuG_(lsmsX{_Ca3vf)#6%(`xB$HWRU<8i6$A=5qU%?Z+3(Mv~M^5h>W3Y`NY-XUj6
zd(>K9@Y$~iAFtFN?S}_^z?65K0f*%0l?M+oZ@K}8#oribn8OlSoa0ilOscAvszQ0i
zu~=IUwMt4`e*&^;Zq-!{q!F{WijS*C4<7?loF{1kxSr!ZrrNzMo3cdVtiD|}v+rLu
zQ?XIIz~T}<psk8zVv$bq=kqL=2@`ab%dD$Rxq~0>)1uZ`hO@EXj)T5z4$6-&9+sei
zihc<?!Pop||MedK&zrsQE&TNs{sPMTcK@v(`2fcif76z%pM7gUsazKJg#eDq^o#K;
z-DQlw^R$jb9-cq_EqVRWIEiODFMh2t4pcq0IZn7!H61DZ*5W|b_&fSaw2{k@^A>U$
zZNt2MDYkAs1d-;zX&Q7%xIbj07+N@=zIcBa{`mUM8^m~Y-#a)xK<aqGZuur<^ZnqJ
zC&=g$e{k}lEx?di*8njKO2JuG*X7{Pqv)GD%MAmJ0LyhijNI&HfW-?`;t9J<Reomu
z=uuWX;k-;}*$POu%V(7{e$Yc?>@dN%fBK*QBD7Nr$%}8+WNU^yFes3p4G<p(Ala+k
zC_M3P?BO;-PUBa&&y<S8eYU@Xz`?&#8IW*Ce=Dudla^o5ohIeiY*0tGQ_@vN-D#_d
zLnZCnPkPD3ty_@Q`85+I#(GH|Zqg5Nz7{GI=Sps+A)`Vh{cJky5DigqUr^E_6slJG
zf&DP7Sx~O|Urhe#x<me>$7=V3Gj&BVW&FWxntzP);yBCFOiD}CQO!@Lz|O}7Qvouz
zf4kWvN_za(F+{kr@5?PwEw9J5+#lIMLt_*NZhMcf4*fM3z<Tl6Rf^UCh00(&L!paB
zgS$Y}*)aSVe<|ICYbd?Csn*c@+I#XUI21T=$j~f!q0{Fq7TgN|av}}B)mX_CC${b~
zxHx222lttkYs6Dgg>co=Isj-bg>co3f4WMz+lC5J3RnES8bquI4pcSVVP3qrYPiGP
zafv!&c@Za31O0JT!=>YSuH|qSTO__lESf&tzQ=ofKmI499Lbd?Cr*7}2_$oa%DCsB
zKXAc&JnGR4H?Zv!HjE>56I`TULg25Ay+f*{FKqshW<%v{$e-aa+u3l+5g~r8f2Kz!
zE7n6iEbc@SDRhvrU&N^S^`ncJ_+q&D3%wNH%tj+f?q7i{v0R6m8#b7WoL^kM(LTAH
z3gI0jk$9xocP51D)2ojkrA&=PbXKJN%;LdPiJbcqFlq;==@L)UK}O&e*o-Ogd49)w
z`={?;7k71O5eOK3Q>VK7lj#>0e-R~kCG1H%T0;NsiRZ~gKDXQOmu6=)FIcyN!sLD=
zM&7(YMH$d;63}16uh*YXjxK+B{CIr&;qn(eE_y|H-O-!qYd4=lzKZc&oD82F-*;j3
z<i{YA&7|Wo{T0C3%yO3XpdiQ?d}d%uIY-3;-7)xPrQjMtufuZfqmT2{e{T3K&Pxr`
z60{_dcoyqSnf-e@v7e{ezyL3~f`QtB1MO#Cg*^p#xG96XG|gFF8d!I$wra?xj0_Dz
zvxJ*oV@lNr2);*Y0)s#*5{__~ux=1>c0OhW(BM63YLzSN$#sF|T&zbe>tqyEm&1>E
z$^nlJ$=O4XjxH>6<ihgAe;mdWmgEhlV5CeqzVN{W<-YV~MfLvOEE#5uzlGX?2_GjW
zma-SJf6U^0NaI`t{9^Lv)tlGwKO#F(NcMHUw{Kn%?Gd`WI2qgtz!e-$ayQW2;YI^U
z4wdtYM5UpzUNlxm<H2l9o~70?lTJ@`r5#Z#+qtLpD>y3-_d7O)e?yllW6kn+N%3|A
zm<Y^v-$!sc;WGl}fg+21a0)B%VjPWO?GeZu*FvP=E1L~CWn|=-fU@4dr8nUvn@nL_
zg0S*Gt;Tc6G;(r=UO|tH(-(h};7+2=BGLZ0R9+YUIEk{`ILWVbwgH2Qr_{mWHCEeN
z!xQ;*7xw}iU5Je~f3~&O?ME$lahJ8aLGg9SX$b=bu}e+(ZE#n8c6k#{pfyljmIcxR
z%T**lFdBP<bX@VU6NFR~L-X1lhOf(JgoMR#41r}z7-8N}(UsCcX4(an%&FkUhbq}d
ze^&#F#7x0267eC<jr~Bk$u}^cD4ClJ?>#;~_NW)Z`^%-!f5L|-w`sq2O)PJdNoRBq
zdx1evi<*hO_9By?U@(5G`p9mh!5pcL-Q*;h?_=;RMZwDuv~K3%N&oB>oZ}e#S#-Oz
z2_N<%DW7-{dX4hrEDr-3XZ>VuEcRjX9RSy;nC3=_!>6bi+yNJo7cb(o>vP_N6-XQv
zktn6YfZ|N~e-W3ZYbyQ69wQF0EKrhbFZ#YL0VYw8q%|RjwE@@j^CJsZ`SbFCdN546
z*v-3GGmP>cEdZTPH;^!ucj~yT^L4!txa4bX220L==pgYHZiuhB=|OXeJNj<_O(1T8
z;_%bF=;KPlb5RZQNG~k}<$XxHr?5{WijtJVZ94dVfB(C3gu_VN$z$-DPkJ)!Yft3t
z6%4Hekzk!J(hTPt6n9`&>!C9_Hlu?(@Hu`*xaaggi#ZA<0LEZ4MCGXT<~LY43hC4r
z=ck8wRTVBqA`-y36pP)axAx8Z@PDA3|DR>X-uOy8oc{d5#_7)=mdEKoy?Om+|4l^|
zux14RfBeBl@P`ffMDk7@2rgA{F95+GZWkc<W)wRm0s*^8!1J}>a~m8}H)6BFLxoRK
zCZ&Zbr9phpXKd;|)`ehrEw0tiuOH966~~JdHLIzReS2OzV(WulpW8EG7w)P=G^Ki@
zJyEF6yp>-N%H2x&Rg1$KRK<<(nW6Gqxu->3e}Gqmz~jrmoger45rBF6az0glWp6F?
zhwyDq&(v4o$8#MG(&=0nmrD&!>_5n|Xf88&gz%kVd96cqF#}N$aOaPu0e6J~T;&AO
zg#&m0-=Iv*>X$RT*DHa)-HRCBN6CO8VKJ`Zq!(Dc3@n6fyG-Gr%$NWpGrgLR?>a^q
ze`D6MsD_ru0^hYc7I`Xaymg$)U6kKht5FS}tAY1DS0R*8avf@<b*uyCVy#0pc&-DJ
zKxF*dn|Q7U7@J&*8cZ%_6lb|w2)Umxzbt!A?gbrQo%ch0852V|4h2<$;k7YB9-6~>
zP8F2bYNqtyoaj6L8slW&J<B?T#zB}lf1-iXGy~7M55_TvyXyhV3KNFP&F+oI4<I0N
z$p4L_ajraH7B3Gq{{ooGqwab+FA{7O<9x3|_nKgcgJKM>J-4$szhgs`xO3SPSUs=X
zfGU8v-Z^~m2~DB=DN0+rc$=ogb4B-|F_iBl^Jz3-dYa<VIZ=4~FdcL07Cu-5e=`yz
zGkYQi{K~2ME^JolRl(oxy`L59;;b+rGX^)80dw(O1K>=iAyqy)S8^0*Y`|qX&RO9L
zf0|cXh8Qrn$Ita*<cz%6lUw9OJ-b(=UG8whWo6Cw#6*oL8I!{6y>Q0m>06MPN8{+W
zN;mLRYwnV2@V|H4>_N2?-_<X7e~f&T+#J$6!n_4Q#>ptvv!|z4hc}3((M>##i#gsh
zM1Fqg2=tP^3%oYQ7ra?a#(N=|v5c%0PPLREpnEmP%zuVSo)52Yvh*RhgzHMXd*-M8
zUjHbhPdqWk6t62In*6u=M(soeqR^A%sJt)2yV~v$2TQ$)HcD7PI6C7}f9H2^A!c`U
z9VbIp>m6yfWb77JX*UkjNfal$t<Hu)OiA@<bhGct;1^3Dj2=%?G_|kh3WY7X-4Y#V
z;IlaG=*+(hZ{lJS<&HHfGF%<C)$IQ<W7)iVK)Ts?4fw^<2c*YqKpc9ZZju6R@L`)+
zGn$RZggNlyn;-a#S!QAle@*2df^Euo{xN1PamcZB*Wrkh$z(PZf1+%Rl!w*9TP*_X
zeBIYjY4ZnPSQFnY4Q=L_4e%yksh_NXxlG@DwhM7)>s<;u0|j4D16w)Bb1Cq;cq}Tj
zN^w8cgybWwihr=X)Y&fBD<_c3BV86u<!Bb5swpfZPc-vrkHrkYfAt>5@VXu?SeF>r
zT9%wkt5tCc{yrYmAfWk!F9M2h_(CxmMVos@6&uY7G+?8ArGDnpUy>fzh>^QX?eKz0
zIw7ZSV_V~b9P<Bf?hBjS#*sF^@2_CpTlFT{ipGhZILXe{R?!k=GnPaxDcSLC?Wt%9
zwwXwzhNR;7uI|4de;NQuP!iP*$)39Xuwyag(+!}}=mr|yHK8f_Fltl1Ep&qh?mquA
zpT#wfshqOeebwpm2g+xUg%FAE%<i9KUq%pRItSWjhUAFYmQ{WS3xI-Bzwp)+2@#!`
zbIaRB)HkIOIZq(Bu||@}F5H?exs^X?`^@mJsgo%1m4rxIe?%_7CzZ|<f1^Bpg-B)d
zO#}eXG(y@If}l(0_g>@op2Y9{Gl((JVj5khvwu%#KhsPL`2%l2;0>%;l*%K^gMe1@
zAjwb}gr^mU@)w=OJr5ov9af{N_poGx*aXN(TDCy`plgYCIDIhbXo0UfTGAqNDGt<^
zNwv;a4^VE!e>U?l$)c)8_8uZ#5@hQfXkA}%MQs<KWxuLM$zOPjR{1KNTkO|#z7k0y
z;X*R)=t7aObb3TylW>*S&T6X%D94`7UnSagx=W(WyNVL+G^)M>70wrH1qG+ca$}z=
zOIB%R^BJE%?Qn#4_Dm5w>WSakK8uB-mDNdWOGd#Af3+#;j8z-9>KFZt%7YJ{VG)sp
zS&a>Ct|`9AZ4#%NRiorjTyVvU(k*$8CJC~v&PA<Jk}qPbAZ~f`z~{9#UbSa<8Yz`#
z_E^S1%kTCPLY-{3g%wR4YaEhWnq_bcUDrRgXJ|_Y?9nQ|*k2RXXuhe3@}|jRS=%9@
zDX0a@e;<<BGpnOz%`#aMEt5hS!Rtrb;nA(Qf==H>UK*JoX_#@MlLbdCIj%h;=^kHv
z;VoGV6$bX1ojOgng%53>*4Q&^=2{E!#>s}kv}55yOX^6nxD=JF#x|MbM=&fZj@3^>
zhFF-}M-a`(8K)a31p%u@j>s%*OYpX>2hprQe<tL|hYt=6qFJZ<f<ZJuWB;(3;>xi0
z1MQ)sBTI&E$VhPWwL;LzbfVhoAekVtuLK7o=E_#oo}rByiMRI&Pp#1@P6NaA{*4*$
zKiJbc>*5iWbCG(Ae?gmK0@~UjX2$XwyJS`)F{ADx%)%&`tusnxQdIc*p4?W>qV@#O
zf9ECYgTc$<vO-;Q&sqMJ|BIgQP(9M}9GWjY6@P4lV{OsVnt^wP&@SO@mX@kU{=oGg
zSGrIzlE2Ne3{q=gvqHRLO)4TQOCxB&D%`TDu`3^#vJ79nRfXOnm8~LA%19=eGF4st
zQQwF=s$ni-`#F9xjYQ%KQI3s|Rg&d9f3ATwD!Y0+vh{{ZrMK2tVs|mMKU;QJ^#JWI
zk-0BV!#KO+3tjQyK2A-YGFxYbRSm4zqc<>pDt+pWN3=#(UmVi9f+*YMqu#=jJ7OET
zCY;a8=BZz_mWh|;bxiX%NlL6nS8Iu4gxH85j4i`?Bu{PEpU@fuAGE|5dk<4Zf0J!+
zp*2lojo7?;xWUFFw1IU#efjCwcZ)To{!~wwYh-n9Fjg2OL}Re_{dz-RvXydgDgzf&
z$Q{wmtn)`~UzurB|3wo~t)fl#yZj|@f=NriB{y!^Oq6vu6<)~+tMR1?tzy)mk*loM
z%2j64%oS85o$WIT6)jdLz1ETyf8BhkIY~J4Ria{p13}4`WRJ{Ov|!09*L8yah`0dD
zFZP(`IxQ2&(!@EG80ktg$kZ>wiTF<@?JM{|Skam@Z7x-kE~{~&$&_M?*rZh&P1Y<Y
z{Sn$YuDv*uM>8f1_(5!kd5biPY?BGCZ8~cP4O~+J`Xf>UGX^)K#YB?df9==AHFcmr
zsyC6Y7APe^c4up=m$s#7h&qYPS|dqgTDweJ`-w8l-){4ltMUxnk{J^;M~!M3yDXz?
zcISrMl69I|g@x2Lvswb|8Fg7!IWLo`NczwcpOv|{jEzW*G^;Vfid5VsXS7z`K@Vsn
zUi~J?s7xphu`Si9lhI01f2a9ot*A#4Zd3g&hYkMT2z%SC$wlh{J!F6Ffngt*#O&+s
z*Q52HsRINgwFkBmp|_i^pHxIsMTp2?p8R03K19_6!yytM?lD9a!DkyH0ZAO9ru_Ms
zPKF~6*E_0G^qZ>Xth|k`QAYG~bHOv2o4btGzJ1~g1+fRd*VONKe>3&_J-K}j&HKHk
zdB3k~-tR`5Hz^meWJwg`WT~z=nzPPnu##HEa<U||TSg}6zli;xRN)CN74XhxhmA!Q
zqoDt)8b*##fVY=5;aZvr*HWHFKZk%VYXY`h7qF#~fc?1&;Z(e6Rr%ATSuOR|Va+N?
zvpOeL!%E(0ElXKef3!;cNjT}vlKDz_3Mx;%VGDo^t0-2S3;IN^YeJTq30V<o@f=c?
z)}$<5m$KAI%CdT07_(MoPh1f!o}*1!txef_n=-RDHI%y9y|-9YD4P@&xNEy{<}Io<
zXuUlq&C&fNbd6E!`6yN8zzrff1Y?3dB4bU4!fwyM*jxSFf4YVAz+Cs<v-AkQ4yQSG
zW?KaSfeoh7#W~)U+YQOzu~=};qh;G7_vyCGa+ywD9?ogpl<jCpwH1u~aeFlOA>UR|
z<hkCSZ%gv9HT%T2><`bAeL^+7hHm{ImF4We|LgtfyWcneUws6#LYVn*?f-Y=8zBJj
zGWd%BK0bZ-f1l!u|GSZaPbRs}AV^#MVNjk-abxXHlPA)!))F3UWZSE;N`b?ZW+EfK
zH9^EdIVtLc3y|p0>NocP9>tK&ZpyH+l~qH5#$C9Y=h*Ao<xzFcgMDFgy>t!oIi;)U
z4@4Y#B9UMDa#3_h<~ZG~=T-I_0_#FF0u&P|!Z9C2e@Sona$CVMt$PvRfv9i-d-F*V
zZoYv=L-IDiH=G7ruQ=^>mr56YfrQGwst67_*XE3SOyWr8cj8AW3#AkizESxu_>82z
zDfJZgE~I{oW|X(M1aXHge<HSRnI=#!LYy}cS_c$hiqj|c?hOZN*U@@PEWWf?;oR#b
zltf*8e=I^Rc$mmsLPaTu^6PC?4Rska28NHf!h#%HSe-Vha$vg^{&{1uD;7<e*&Hd|
zs5a+Sxub0=afY={HO%d7Ej%Zs8*h_*?e+WC`*-i&Y(=UGzG;`M&$o8EuuBOwZ=%@x
z5zP~^b+-*hxIB2(8&#%p<9jh*(01{6j-XKuf1?gF$wCWcrZSc;Tiq@qQR7N=)d7pe
zjw?<F->%Y^j{?}hdZOtd;j6xc5)w8Cvg)fu=dy8IhE-N*+YNG6RB_uxF&s<MO`&JH
zw4{%1jRrcvr9Z3E0Cysqg}f!}??&2TOHVCq2-uM4)M_X5IbreKk~(oCZ=+S@W_%{r
ze>y9^(Ea+I+Tj=1)vn^dkN-pd&RvA}T!EiKO(*f+U;qB_pJ!@<8*{am2M>(phKO6Q
z;9FmldqbRt+!U6Uf8v?i+7IJZIPWqxBX@mYmcJs5me7VmxY{sJ|9$$w<P*4FO8KN>
zOuze0Cj_a|&FNgT=>8#pu2G2KpjoV6f6s(CVE5dp{K-g|Wy`qB*iM!aGxpq@FWg$%
zrP^m|o43lBtGpXd*?37BX8D2fI1l+60@fNq(utf0Wvo^9Oo*d2d<q_;eERTQfUCtV
z?rYU<fSyHpHe{)ou={*CjDE2>_Tk+;3FX>;CN6`|xd|Rj!#P)nToQ6q%3yeNf6~1u
zX2!DKaADr6Uy3(foSU;nTlI|4Mh$Iq#}n?n5N2QPy9<(fs|KZ5k7)~Wjg%|T9{&CQ
zl(ss+H+&8H!BXQHEj}%DzR_1gGx8D0$SfAx0}OHslT}|D=$+~#pM`UyF7#Q<rIe2u
z^naWi_oJUYwz>6{n|@?uYp8F6f1EAJ4GTn-Vdx9vHi-g0FX6bY`4x!!wf?qr*`nB5
zCVVyDwqZ~!UqS+xuS(?C+x?j8-ecj-ls7rHZL27!1R<~9nn9r$sM_^Y79ZL~D^kWI
zaK&reTcTVZttHCw+1V25!(jVe;w9dY*Ry2B1)!BhGd6qE*q}8}2SL|je=Yd9&yqZA
zEm_)vnnhc%w|Ya^Mj5QSB4ePas~+aEqB(4#@HR<FgL>e1ITVY|^JMYXN?}oWYvsvu
zTeoR`6L#jIz1h@Xkem$L0lRM)cIAg@!>+usox`qY_rvOORc~(Rpzz={779OZCl8fB
zhOnT$*wllSqlTVrJ#yKCf1!SW%<)B?>s<<`?$u$umM^Ok@Qr|l&qo4;ml41+6Bq%n
zo;9oqv9LKPi104LpmZZCVCv0sEx1p^MRv6KU&q^^D}NG$*4}Jtcg>f?wjXQnHX;^&
zCiw_ctrmF#+wZg0bQ`Lkz6m+d)ZW}ae=Cnxo57V|yK@ff{wc<YfBtGyZ`Ivb65?*j
z(+o_DQqd5Uf-K1gLm{?dcj*Sr%f-$@v^SetUwOFLfkyRWBbIP(F&z0)6UMs7OBP|s
zt0aqGi)w%H?QVFvLhlE^gm0VRw>!|-Sjl&#sQ~9-;c_{TWVQt%5;7cXJ4MairZ)&a
zvX+okh=10AtR<ntf2RDb&?Ml-?ShkamoQ=DN<%`y+l_Fg_l;STOeAogY9H`^U1d$k
z7nF5Fy;RQGMKN<hIGVbk?#W{zQs94rR0w6TWmo=huQMe#cT&jWBrhaKS(ksKS(j^D
z1%#8yR#moFd{)MgZpE%|DWC@IkE1+^Rra(d#L@;JEblVyfBRJAvfYYS?m!r<nV_CP
zq!PAWQ*Ya+z}yD)def=#+6IQ1{FLCO)cpN#n{v}69mN)iiD=v@23nGVof5KT#{_qF
zIqPZhoe;!0Z-Q4FDwt=OJW8#2%a`S5D1r+iUb$uYBZDfm94%{xgB=)bf#8Y|8d)HM
z)^0+q@6nhHf0#6Cb`O-aS}2wcK{Xm4csHawJ21zZezYw?(KBtWEVi`WDmPv_^_99M
zZLNvO=zqUI{`{Y}QnRSP<&6sU1C*Hf^CdRXIH%aE%-@jSt7#SPl5x7OetkO+;~&E0
z3gf4vaFr)-_7faR>Zt#Zb7CpsTw@v)&@HL6wxll;e+>Rki(EHM#`X7@{mNfLP=OA*
z3oE*PTYxWT3R{B{6)K!q;_YJGqgV|6enPnGYQ%G0%uwT`p_{8QR9Wd+dLQrKT7RFj
z`*8Zi|5z?(FEQN8HO96K#Y=pMWD)vpL(loc)>u`B-m+)OEwhHh4&j1A!yOi9Fz!3P
zJ#xK4e;~@^!f8Xk{Su2-7<9AJ`bMGiLo2OUgEB3+sxe3%7^oRCu{&4xpzTb$ZqJdu
zi=2!IwU{PcMTU1WAfM|{c|(8mltQQQ)jQjtz*@-UHvEA%Kw2<hkj*w+BZJ`%?ehbA
z2J9z{Lg0+{Cy+6!Mr)MPhU(ph^}?T3EW36ue?WS@m)u8i<>W4$XN_Gv^2bCNu6x;`
z9l4{F^x-wFpS6G6!O-TCXLr0a$3I6VrVpDD_bK;UxRETjgQb4uAHHeoctxP?I=%3A
zH#~pG;xFMy-){cEk@!m(QvU{lc?x+;!RLt~pT-lL&yz>%wcLc_U%$Z#T<$>uIv0{=
ze^i7nF-jfh%56LEcN3FvgSXcE#%<M2%wr<var2JhCg=$f^uz@80}=Ft3Ft>6=tmRK
zQzGc83Fs#x=qD4<&qUDACZJ!4pkGWtZK~|QGeJG0qP{mlZBtQ=CRK-uYBZ}HDyq@6
z>QYgO^Xk0c=9-o-vvGk3_nZI6Kc%nJe{qJs)3!%WN4eBT@a8{vvT&ZvXN{T}=O*||
zxXGgVPkE%XlO3<ud46`RyCj-pq}_HKS(Nx2t=ljI%YwEn@ehv4ki-eZzc?Xdo{%v=
zkTE}yF+Y+qKaw#|$(W~P%ui&@Ph`x`WX#WG%r9ijFJw%cF7oflpl5W@_hisEe;t%Q
zl{$1#`do78p!CVqrGpY@6Jqb5>4rUO)n5t^<vA6%p#RpIZgp%3+)NjL9Y1faIUK#T
z<Uh*4)higQdw8;PNce|*RfW%QpNjMnZ*XF^8MU`oIA1=52NJzDCHnXf<p;GiaC=vd
z|GW|qNE3!)OayxjYev|c2#}uaf2|f#EcV@A--nAuXdVA{jA7Ct<#3#*;S*=QfHxSF
z>kD_}JnxuX3qgruuBpOIn!InY!MW+TpO=Xnr36Z?0D6GH#pPeX#x_4-uYJN*Rrpf;
zjh`YFf&72P-r#sdI1b<(86O1zGI|Wq1ia%20C1_>|5FWq7aqRt-^A#ye=UDNMz{N$
zfS+Nje->xiY$9^?ml9ZehNs^e1g)T>rTFFFy__s^YC&hx?b+vWT++dgNoH_4BV~)^
zC&abgiLfZ%YmK^8hi`kmo*TH{02v%UD3ORjOs3OSnr=;WvH|Y+zUS`-c0^)t6VMAU
z7){z2_5hRAizLfsMy}~Ye;D7>(EFZ`!1j|=#AI#{quu}<IHPONza()yVEJQ`{?O}~
z7_d&z1xZn`;yLD1n%2tD*B?@5l$Ek6)Z!J9GcP=ue1CK^bS5@IWWvTUj4gQle~4Q(
z{CR4r$d2D=m;>ab<~o|srf}fD2=lF1zcw-3j*qEdmO^F5sk{Ioe@BJ}J+S-Oni0lH
zEY2Gn0z@}aI~Q#i+vB}x53Tkbu3uQLR#=jPJ_s%yq?hG8BseJN6Cjc$UV+lG5Yl}X
ziCAb7ILc_ixblSTR-y(d1@YT%z)SXIIlrXlAp!QhHg?>s<jSoQandHk0O?ne+DMk*
zBH;~3$b!^K7GV_2e|2LiW2#8Nz8|>fh{Fc2(7=$%>L)8IUnp0l_`sd#5OUViaEDzC
z7b2XkVKR@VPgXbO9V!+#h>dhw{V<x7=#0K0ec{C-<>msGWvH2;qJe4p`}z`*uWRlR
zSwG_BF&0u5O%D#25LZ5#p2vp~Dr!}COaB62$myIrlQVBLfAadsyq0`f&<uzw1^ZnF
z6c?eSyW9dnrss4==0qS`nM}fW&oB0%kro$aNJK{7(3}KBFE<d_OSH5?tZNT&5#!o^
z1p)7l`sPIhYtZ&O?%;fKcK-hJyOVc_+3*0j1(<byW{I~O`@cYS#%*qnAP&d4Z3WR{
zIR|TDW+@sZf9S769Qtdx49S3(J`Q-v^;#H{;6~Rt+$iNz2tT<oMs2$rc%MIi{4&7~
zHv_K)@3r335#LcE-_bG2Y#Q)+Ld86xV}77wexPH1q+))gW1dnmPsy0aM95<@B6Wc1
z<3k-D`sh#xhdwscp`nk=CnDk}GU8_<;%74A7b4;pe-!bn8%(~vJI1Crf6bDwg+D?o
zc!;?1!Jnb<m!A81g6MeuPU~~ar(umLSYs5cZ?`AD*SC?SvL8-;?hWCK&p4RaLECkA
z!;J$=yoJM!x|r1PR|o=g?G8HLbuf8<{1G!XhAnu>1o1ru@x2M+F$MA11o4D|cw&P1
zfr9wKe+2O(1@WT^;wc63)CBPp1@V&!;%5q?frOu&BJwEhNb76z&>VEW0sHwAKHmHt
zGTxUHM8*sA*-|R^-RIW(FJImn5I_ch)AR@T;`rqKaqF`InGat`y?q&2?T@GL-a{kk
z6ZZ?It+p8P)>(9Kb)%mL`;d?ni)rbK8KEl2fBj#vDe-K5V{m3c*KKUuwr$(ColI;e
zPdKq{V<t`}wr$&*m`^ZCzP#_P`s&uLd#cXqK4<rzu3D$N_v+qjFY{9q%sr<REM&}7
zjy46w5Y0M9Y`gHlS1t{%OTzZRBMORa&m6K76a?1gJ@``--TEVT1!IaQJz{q-K56Es
zzx2e}CvN`06XK-CtgeRv)<xr+9DHIzqHp&A9ebO8Amsp8?AkqEt+>fBu*HUKISbUi
z@nheu;}Za;QA?x{95<I$i$qCy@*?n3LaR}cY^(P|mr{dHLuuOYBvG?a2SSTdTUJI?
znq#6*AbA4%$+O*IN>}`Zt3<wA{x@+10F#77C11>$cC)C#+-}>yH;OXXwkBZu`z<8@
zLP3Oxd~lBFl$}W?n1J-{Wr`r3SqN7k*T!aa=gWXAb-QumR@d5W=e-to98>hC<<x#t
zOr#YT@T0ctWrm4zo<#OGSKl3!6kMz?iw6r?lq~r7tsaT4F>U1ifEV(Ce%}_rwZg{p
zoMR`sJ<o}$@2uV;%EIzd7-+vTqftL9B+^o=;Sf9k@-&HqWI_R)<ACB~GqfS@P;^EW
zEEBMKZZfi2CCQO94I9GNbvyUk>n}qC*XLz#Z|0(&&r$<Zp-?xJga#UoOy08j2{%&z
zln?hDANCv%<E0?VPZg4<(x((@LQG>q{QaagA&xSsz^GRzTcd_sqb6IkhFh~HTf>H1
z!zN&G=Fe;iI@;ht@nw0ZQ%;A#=_xO91E6WSP2{GU+{oD6R628<jBOF7?8X0brlx2^
zr`v)?+k&Rsl1AH-rrV;0y-tM#MnM3h;DA{Wz$`dmI0P^pMjDO(_Yz@B`5LQ7bdp6T
z-2eq_IUI{@;I9MuWTW4=$rc%O9Tekba7?m}7iOKaTtU@PL$=Mq2+4<I1jB%Sz~}E%
zF9Lw86*8ZWD`cDO<_)kWCkOxH{(j-@s&zz133j6g2boD#V~kk+gBXtQavgli9a@Pu
zaS!Vgo?sBr>fF6M7rk{;ZFGP@Y#_M&&zP;TmK{fN$27R^u4+pTUDXN;-bX$0M%bJh
zvx<YMpJ7LK%c99@+&mV97~mTLknCG|Il7@(Bu-HM>GE$F1H192@lP`*fH+Hcg=;Zm
zX!@}@ma!`kViTivp1{o0iJZpFD0;XlW@gUI^c41algS&{ejv1eO~jz1xL#026FwM;
zc{9zUtqq?&Qc>uBg2Z>`0Jd}OZADpJ4GQNSH#m)UaoIaKd=Ipv$s{@j@S8oruX)ZQ
zf$1qn0>tmy9>T7B!RorSD}+y!oyCn)wURYiU~bnm8J1Dm#Ch8By8;WCafkB9v?eW+
zPqLa(IKz+1_I@<#a8P6$k#oA|1+77;;zHbi{5-#8wU7T%*H=d%_N9Q%Q(ppWG<v>q
zxC0~qNq#Lj`3ZHl7JbYJV8Pfygjig9g*nDGF~-)L^DnBFAV&6^;a0PDbF|E(Z=7>?
zfN016JaC=SI;)RTG|H9l$9Z%(9pi1>C0@VLBcrY1NfQ0x?O>0Maosvq#Y&;%!y-Kz
z0DdiPU`IWFd3ISDU{OG@J_=QH<`p5q8~ix4&Jk<Qqfftz7ZQ&P@Gg;cHcg>qn>f<c
z6q0rcCWwc=f)_KcIXDM*33)>z&?&Bn#p|REJ(NGoxEXi&c?c9#D0#O}a;9{o;}hK^
zLSPBU>?3jAq>MUEG%@|SpU~RsiOVBdqG%j-oq1MG*p7H0e-8~7fFklGPePw~u@xnl
zHnBkVgD~v7Dx_=$1lSa6x7=)43!-C!<L744Bybp7`ZU^{r3BcIa!h$UDPxUSH<H-R
z$~cxW_uQs4wCq)7u;2&qC!+UBX$0?)O{!xt4Gq_87$yI}!wUDi>Rjv6gAP<E$%R4S
znx69t>0`C%p;-dwy+<5FteZtH15Zcl8!N&b^sTIpk^?OS9Lvcr<`=qpGX6#An+!Sh
zC2e*~2ONJDXQ-+t{2{YtCP`bxc6>jm^1@QEuYImVfyHBUkp`XxPg_e*a%73YQb|16
zVX$!8&Ynuppp52+z8R`$+s?Rh9e$E>SDpS#xJ|E8W}>`sM>rN;lAXIruMrd}17#A{
z_rV)kC(M`u91LQA&(ms}5|lp<f1#g{GF&f4X#O*=B2|OF>QF*<^9G|8NVj=49Fn9F
zck!Fq^LH0L<TNja0Bc?HCKmlDOs}TAMJUM?g4KKD$w;svHw?Hd7Qfs@C{h9~uw8vt
z44Q5ky``n+X)=nrcyaPXkOjT=e5HG?Yd|l2m{nZ^%;&AWnPgRF@&AQfvGpnV$u338
z?X1GBF%tVb9fc$~V3pdH*%sb<cxM{v6Nt*hiY(Wz)@wsXX@r$=Z!DHM6nhdQwux)T
z30tl{GOAO*xCG?efOydT=eYUy?|86*GD-hm0H1deAB{k3v|l&Wi=dyg&<MP!%)fgu
zR>Iu~Kq?O?>~@3&1}-Llkfs~UeK!%q(9TooG&RVj@rIy1`1nI;2~%iDkqGakUZF|5
z;%*};r(V@GB6E@*Mefb)G-PWG;g^UKQ`@hpg^#Q={u1~)Hxl%KbYY67kE~mNAOU>P
zp!e+pOtfEC)1E)RZ?M~$4Nq^n><AK0e9wmiAmsZrcIhrMpxOTI&mv4!_|+WJ?Xj(w
z2r@>jOp-t<GHnV4m&&r#rFNp_(v~ujtj@A5eD%)n7?_x`&IIaoLw;LYUn}Is>%y2J
z?b@V}At4Pu|AjBou|14rj<?<W+|;1$mQ8G=n$eB@$Kb5TgdrrUXBz^Q!cc)J?b3D-
zz_0e9m0#PE=3T=g0KQkV?v~Af(>O@kPQ6eHr}cw@1lVTwikR{aI|{FnYm#lG@O*BZ
zJ}UZrlX?XoX>r2-AC9AlZE#*L-ZtascjrIOnLLW^bq(rRNMxGY;K-<`v_*rh+|rB+
zg6B2WNM5o$>K0(O?KVsI(_bXbSis?g0QoWvLD*U)u%3H=Mtk@>vJkrSH%I8GAP0A3
zX;meOYSJgXn}s!dh>!$@6uU)lP>^0iU?OT5kz2kH+k)ZM|6F5wRMU?2U_(r-<nVm3
zSCE5w!x;Jpm?qTD)_7*$h8yAeGFrP#T5T<`oSzXQ%=zW?#kv$+#QKO^JB#%80l4ly
zyVb}8bqbbncq^s-sc%PwQpvZPl>MpXQSl$;Mv-7nRz_0}(J!7jJFnKXofz&AVe$D}
z&qQRPVb9^L?*}u01s+s&GGklpy(}XqLT})Rf;jEqIW1;&i(~gRRLs~jV^ZlqtTB?)
zt*)s%gj$sQw?$B|B>E12t~Otl08G>8zzgErpOzIDMp?o^;NjX546QHA$3sFOqS9f{
zU14P$SKX_(`SF;%@}<|Xa{NXEEN-!*BDeYuh51tY2n)k?csN>bN%AD<BS|u&q`=w0
zQFMtZSlJH>Oo&``8ZC!V!LQ%kM+B`0tTDpvOzjKuZ};sZ+&FV<g8U?#0L!_}FQx3Z
zv)(2=WQX3S0#q6C>_?6QzBJzBYmJt(B?S~q`G`4q(S8&mG+}x0!`!f&ge1pazAB3$
zArg&iiVPm{-n_Uz8SxGAry7BOq{fk@iWf%@#@_bpY#P)yW}**p-^0nU{_=_x>C3UE
zr1nrNnP2W4y}fl{Damhb0PfP+_T^&$y9->#G9fbSR+vrCgQLh;0m94h8-E1D7J*%$
z_m*&%X@}@y0$gRI@8fEbkt9#!bFH)QTv%_IJIrEu*}$t26N88!_ZQ>d1l*N#&wsfh
zvo6;(IilV@F*!@N`DG&-2dQA^yw-jmvR@05WLD{4lc>zWT+sWt0G{${4@+_aFXPMp
zYzxMZA}+%x7Yv!UcfW~*5<Xwz*XwPhu7BPgj+%`o@&g`jVPi9C8^onP5r0sp9-pHJ
zY&LP27SeK;pUD5{6miRsJu6ZgL$Z|sQaJl_*pQ&$-pksM?>Z#x{oEo!@dFt?!8m|}
zDCrCF7g+4#43Qz;2Rvr9AH#;R#_^KX5R$jvcpsv=9OFpBr&r4eA>5#}MtHD0`EXP`
zHJzCVy+`R!kYfs3{;3ckGC=CGlQ2v$&)Ufk;T8ZoT<U%5NW~=Hg0<<n&#baRupJ_{
z7E$0rK21EMns&pfC(9VMM+P`!CdGoYr#KOV-{`md(O*pk0scVv+hOvzFLX@Vly>xN
zdm+F^y&+FqJi}7I^#?Sd7&Nez%J_-F(}y7I9mHhBXn?P(d8eb-ZAxCSgG#3#$rz^F
z;vph>1t}3D0_Pl0rNr4*`MUqbdHP^NA`rjb^Y^r11ou5v=rPo%(X<C&#4~fL)UR)K
zy4nC+Fbde90P2`^3~Tmy4Iv_{pFf#Z;d=2u@3nkX{lYryb!P@}G2&2G)l}5J{vz0f
z-4DSrdVi?Aj_rXt&=UT|cHoQ7SO)oG0$6HgVnGJ#-G^}IL{)9h3VrVR@(c%aVug_z
zt7&8J>LnD#4n~*&H+^uv>Q7XsvZX2tIfmkadvT#Z0M778-D>*eslWD)bu%M6_xX_^
z%E_tm?(;&kNm*eKb*ZJC;JUR)x8$-vO<o<l+!ze$yPQ=joI%7Amd55f55c-S$ai?Y
z!_*Zc?fC}qp%?cy>H{prXe`ySK1w}ONrI5Y^FRU!-ZC5*(q(&GRhXXy?GN?4Tv!mr
zq?cjm0sPSx@mS1+ONpeuOjJ8OnNXtk7hwuRS}1+eB}zd;c;dVGp7RPw$NCXZX<|i>
zt5BjPLi8}-%w}k!?k?h;dduJDP(S59luoC((jQ;4YJZRn$SvnWGd&QQ30CaP7aj?2
zc==^r%F%STpu+tCn$VVJ*8be#NlxZ|?e}S+fDTy)ktDFrm;f3Np9#H4mg~VYBVHk+
z%{L#|L#a65)57@f7DEA-{${A^O2G)X)(P94Z8~<B8?7wPfKT~T%UKahGMCmdR#yxO
z*HnATYxJ#}lg>9Hn#VmeKU9hc)y7ljUmsC1t7<zVjPdlSbk?5Mt}~-=c$1WYSTogr
zfNMJ8pUMz29;;vx8jGO8NBPdJr!Di_2)xZh)61`hF$vGx0@+*!NydX2qQCN`<(|oa
z>@@<i3`vVQAU8<$8z3{v=|acIEE!#st**>hLi@t4)W51w_liR*rhc!$vddy{58FvM
zrL+jzxUFCB@&DCwQ8utRqnov*rHII20&JVcuLmSc7pX{+5`Uf3S?Wdkg%JhE66!0c
z$mzBmO@!)tp&UTr{oSlH?lm%JpMK?X-ymNPFyuKF<#T%MV|cb3U(blx1kNjCiNpP5
zX(71V@<s6~(%6DUprz>0WwGay{fiPZj!0o0B-!P;|L2F*^ctEi<LDywZ^v`rPe9hU
z19-=~P0<}^MWB0$1ecX6X*u-FAZ8kSy-cCrGtnpbjM6Ak-F6$nn~|vN4h_BYkJy<_
zPIMvuW2P*5$zpb*1QI>!h=tFFme^z9t#8w{U}y@?#e?Bfiz-?npMywE3!@>^)eQHK
zh=ocrHRN<VJcg(jN^GZLD<c~z6o7nI`X;N*rKO`Yro8@UV)ce1ypu|TH03+^3pne5
zgIUyZdOsmsOc_1rSZdDEZW;b_qyL)F2lv`%CsBC}brprjx$!84^|VoPG^4zs3j}Hv
zhL!BEXURk!=0LO9AMH2CxqWdE#=@Gf51O329jvRub<lc;#ViEEUMJ)>cYrA?*6~)v
zE7((=)k<=iKj_iy$y(QWf*-lpnj6&>{H%j{@cPHHKmy4jItFOyR49tCoIM5#8Lv4d
z>h?%kbYCB?q2K4RuK~8h0fI$KUvpJKy0Mir$$ii&oqY6g&95CbLZ?y&7lDA4Ao#|v
z6XbLuNF6<adJE$sxL7~o7=Q|8OAtcq#9DCkJ9RjYDdpjXM*CPycr3_;m|B6*(vxUk
zXRJI%YbFRmG<IV+4>);Zp(K&l>z~AvsAwUnB=`~nT@-op7FUnMF#XVkGbosf1H)ub
z*Myn8dDL79f_|lARfoxesZ^p3q0)%LW<>)lxEjk$F*2AUT?o$hQNW;;bYcNCrS~HC
zDz5CJKaLP=fUE(uyyVn=+27G*L)zm>SefYr{S$Gd3q(Gqbw?uCEsFeK@~s1&oTQ?c
zG<h<%m5{9?t7_*|z4<H6EXHL48$nT(YCj-ce~V@$dZ272(k-gcnJLAjX6O2QVxuno
z5QGk!aFBdzfp0ak3Ix=5kj<uX9`tx2`#agzVGGQe0WlPRA7AqavlmbQHG2@5If^}&
zHb_^i4V<5cC$K(nDH1JV$$Bh6W1^(BfA|myCT&SMfaq+fEacX1KwBWEDs%(4Wg}YC
z_WwK}!^SYB$!d-sEbxazmtbh~l)i!=a~`Q!9kcV(K_c4Utpt>+@A<_0_N$^iqOg%y
z%;r&V_LBbYLe+P!fF%Pxr$asoH-FFcfM*X1KhM2P0B2fV<sR06arUpREr>o>ZsB+p
zshTEp52az^3V&g!>iUX+;LPSU4GDm{hRWYeJQzlrJ6w06RChj~NBd#f4u!}L^XbdT
zBoWB>8QGc)j|ZU0L={LZ|K!oaB|0{0(tx1JS}@K?lZ4?uz2MWQ2*>38IF2oTyQ4$O
zXk&}3${MnsN40P#*F)W^O_L9fAmj{!WOz0}cbE1e;Bn0x7NDy=(#8d6muIN?R-k$2
zof=bDDiN4e>76TyC3+t}K?$N3N{pcIqSsWa$L3kZc?BGTpp6HI2MxPu#yZcwQA-0r
znhITVDgSis+JhjH`Y3F9NhNOgr)|3-CY5CJXQGD0zCvFV?i?rKFvptj;_|GHZ2M2*
z;N)zz_TS2qzFth#9l;)>jtXm>X#e2Ql|T9|ELKKL#TS!ch2Y6k-Ra}~g+_)PEo~_&
ziGI#U$qlF$DF1;6j)?8pihS844jB>6QvW83BnSWJ5y?)Jd{H_yoDOZ@-*LOvRWzCz
z^&B0Pc(*mlBj7jdp(l8ALK|a<VOgbD;@(D~SM)z3Dh{=@g~2d|)_}LyMQ8yzBZH9;
z?!k2gHhX>7he#2y+Q!UibmQ#>Dwho}$2!8fiv)m-8^8Iaidlv!1v6V`Gy0Ef>v&UY
zioV&>c5T|0IQDv|Ypn)>As<HnJnl{@S#s%|7m=FWYgL4kpQL%DdV3%?eRKN$B2Gnp
zLqZld>M}%URZ&gYgl+RO=YQ<q`kt@YUcktmhqhb({UCN;KnSNweOPEi4d8}3^Q|Es
zkG%)rgFoPutN0Ixky(1f`PzwFh#)p~fGE?o;kLHX1Zl_bN~TzYU0%T{g@?BzW>3$s
zwe0<c`lOu*yGdev0h24#g@{n?sE$M=ch4#siBF##ukNBR`4W421bns2-S1leg{h$w
zN|`k}a!utYP~u~|oDw1@P|mRS^Ec3d3}FP66c;UsX}PbFxkC1rVJcOEVoPFpl8bvo
z;RRM4GFjSCh0u91P6bU4U_ehC7-C4{u7&H8CcL2+D`*vT)eCrT2jlnUlbt;i{a)lf
zvRh*gtx4xb3@sEdPP(vG6)4$PnCY5_kstS<n!p`daY#NL4}sZo>mbLw%-uegP}v0t
z_L3Br&wqepVlfUF1)Yp1gPi+h_?s!eJyW(E?<k&_eYv83?m7A<|I1_tn{}8SfdgeA
zMTaN|K)C{K^*Eg`sIq}FrJp=PRT3|k&E!^o#bf0N2o=m3UkK&NUgV8<al!5uMma*2
z5DTlfgjOno<op+VD_d+xPJX;;*5n5emustDJqzl)nI{UlT^)<Wt%oLb=US?~r4_ww
zs9n84DG!aJgOGtay8VZgU+>4KxPW_v)q&omv@~aU|EmuYJ6__{e?)@S+i`0vTx70%
zb79l_%-eizT3C9K+8usl&ItvoFzk9(b4)Rb16{wB($0sB-Mc?Uk|T8Nz4aDA-Xei7
z0XhGgw*p4iIkUG#$P<s;@=7f6v(-!Mvr=KRaa5v;WJE=Rr^0ENDLk?^juDCsoH~7l
zSVHM5gox7B)fCtvW!MZn1ECx=rL~D-Z=je7&Q4Ah&OXi?L$2gr3|8s>GRT`<T|{+Y
zUG9JwdLXr|Mw|Y9-m9<MXyOb|n1%Grr%Zn=75kjDjaipGvbTBntUG-~!a!tAg5Y<m
zp^nr@)Ha{uM3un91um7}MrQpf>D;3oI?-2`v9Vt;HN#~`t$6bfWQyWbxmrGwTXew~
zeqQE}u%`$0gx>A!oXiv$42?bra%$vxz7#rQ^F&Y_Ue#qwuyP{7NGk)V@{GbJ6|>8q
z!jF<;ED}bGbrf@-&^?{bbLbAg;*)hXBEgpDP(0<&#{1C5aAcH8MVfRwlt{RnQ~a7)
zyH1)il0DZ^nV7mXibHF@f#ZYntdk1ga)HD}@6;{{&F=P~bMMq%pcx!EKWw5IXaN$H
zC)0RTuE^je=*T7t*xCUwrlIR7WC{8>L&^_d>Ke9LaR!m!k@E{B2-}d~<1-7zh-#4i
zkW&i935t>Z;t?abHP1u_ByzxE)isegVjo||xR)@f-{rH4C9hgi0*)2tNrBtrJIUoV
zsFqhlIxAqEi|49d4HBF{m}29SuzF!BTJ$=Ri;)Bc_}iay!H$4W8r$rBbHx-6t6#LV
z3(sjv^6_1ytc|c7A#w1c%<Su%E8}~4tx{p-HtuL)O8O<D8XSD6?&Z}<Bv&EyU>s@H
zP(3Om<)KO%6L@Le7Ly{338jFxR{x~tdni(J+!Fd@L_RB5spWBe3z^1|`Gz~0lJKMl
zghaMQZVOuX20K75n6U2gq^4sy*%deZ>j9f$y0X+CKBF8ohb56(9(QiC*JXZo%4flL
zPBPX%v%t$fOYd1E0lrToc=H!WtdTzbw+smuf6hpgm+Y<Rm~lGa{_GlwNB_k%Jj8sg
z36;H=dQ*z@{VG)k@nC}yRvT;*e6NyTELvheh)0?xA`-wa$jdB7Qb>n~pNra|Ca{o(
zM`8!v0h1I$E9^^^u#%=7a_TPQxnlu+oPXzRMA&OpGweP0O6Agr!$NxJ#)o)YlFPt+
zgU<(70iB30>Vhtb=Lj30h!(nF$6O842AFwq(%y_-Jm8t3=pa6qixrf_+gLYU>3OF=
z+&d?9pOFFbe)2|@h9~uu)6vKxyn3duqJy`fgMz9XFcL$ALFo(w_h4OG>=Z^$Q5cg9
zj8!nMCnR!hk*nzY{Re^3-dC+wN~L<4-_#MZm+L%a5u>|U6{97l?-_BrKb7ZH8p4eZ
zC0(|L9$#EyG=WM{6P%wA^keKMTodG_&grkVs4oCi*=lc5%B66PDyC>&9h)d#nFRc<
zMk(C>UL&fwucM8L&IAk-M*j<gjoV?I3Wqitf>!IXcujEDvp4iSQEJy{xET`XRhdFx
zff~h75~h=Bw)q4)P1KY&gxbN+nqtaNtkX5J32hb8um%eCi}4`2KP!2<<6s1JZe>kD
zY^#7d*KRNNRQxh$837tfbxxyF85P)FKuPjO$z8bT<~-=HOOUcX1pZ*27z*}fhTk58
zcBIfwGK;^IJQ9#-V}>1XP@mN)L>Imk8A05yLvl=x9)Wv|-V?4ZEGG=;1y=|17Ks<`
z7LAGcwZxYohmnAVMr(H6+S^~tKfPWW1#<wh!NC#E_J|4RVL#NZ;@o+?R-)*mhR5tU
zbz!3AP*&lZWb!oWmqTiDMKq(p)~EzSt>{IA_+lRz<-irv+n@ND9h-YepM&LUlnH@I
z;H||tZm%&sYtd-k!_ivnE6I2@mWjj#8k6EE{MNkGG=IJS4IT)G6=`BTvyggIs;dDk
z<$I!OZB_j<oB_bzor0eC?n4nZ^f6dkz}GCf_d|gOl&R_%MX3K&`x8W!hL2M&JA+X@
zP44eF6x-d(yo3<X26VFIU6e7zh&=4S81V)ykP;GXM0n!;lP-VkVi#bNfl1z}Zj>bP
zN!hgcf6`u}`})b->X1kfa_UMaH){c1)rPP6>217_Rmz&z5q=Fj_i$XE(Q3lW=rvQw
z0|_)FB8v+jM->Y*w;60klHoaY?Gz45&{A>~b7?Xrza{u)dWh^I!ukDIK%Nh^o2#tc
zSC=L1xM}SjXTGA@8X7`3n+df~uJ!^%Q@@lb7Cis7?ba%S&i_>@O#>e=QG^5Zro>bt
zlw-zPKq%QbXe*?~0oT1`(zO?AJiOUetxeW^sdqNKofnX7yUoIuyobdt<6#Fz9B%kf
z2zz&T)H042BM3X?^1c-hsQ2v?0x0H&-dQ2#+Ox_4QJeQ3Okpv3js9s^xZ(7Hq!6y$
z884qO&J<o!f8~d+15m>qmaYMMc9iWh@*_AqV*83iMo=B#PDh@aOk7~=qRG-;bYI!F
zmeqpEJ!lIW8$+AT2WTf5Qe&0I@Q`)#YU-!O>`K-lZ7XL2HZcm_ABYzSaY=MFXxt(r
zRR18tla|q1!p*AKx}yin3=MEzPDFgC$)SDI#-%rybg6AA5cysaljZ=pbI0KOlGmy@
zE~H-6TxT((TCVh319IaZQf7Sy2os8E(HJn}TPfnIZJq_=^mOZ7(|cw)4tPw1n>Iwp
zsHbWenFw}2D06%|gWCL-Bzj~{*nbcX8c*<1<(^_fK+SNPmZ54uU8*v2hiI6haG*Q$
z*OQ8GBfCmwQv{G#A_D;e!!=;bS*@{*yJE$~m-~$NsMEy=a>)-`%p}{J-H)1NuwkC{
z{4i1`+4Ij_hCT#^4vrmE&=BJIu4VI#{ibabE&Bc0!`71UNuEsB57guvlGRX82zDv>
zy0zVbznjMkVihZ|o9ha^EooLM=94bdT*+ViR)67ze{_`Qej)<8Rb^@~VeWkj_M-a0
z3*~JOl-DRux~uO?ZbE=>M3y=3nN%^QYXq9YbjSwzXBM((H-9a6dA;_Nmxu5Z3YXHi
zGzZZJcOE=4fR)r{21`b`FQ)hHnQkGtThLGKi+0d#6d{$@{?`{j{oR>$6t8}brqQPg
zhqXVA4gG>UWzhv#K2W2o2D^oN2K0xXy@fPJ`C_l%ASh7;$oRB+lF;UBsz-S<jbr{D
zdrtc&bXrcZ+Pw#l9nh%3h8z&$c8D0cQCfH~+)N1Kqop^)vP>y02jcR!fL5H8K9V4n
zc5>pTcGxpcH+ZKVbM=lm_bdCL{DzZ;3I>eHrm7*V_xuf@I$wxHJvXlf%^QDq55gPH
zcbG4bfK>&K#=;+9(zI-lFA)P7jIKVrl2&ejJfK67u+tyHeulyg1jm~F6BocE0e}42
zzDB>jo)@Cvv$oM7%@wTWGq3^sa7(=6P3vhfL`4e_5mrP*0FsA1eMBla&We4R37OVM
z6cBN|oCgD}j@8f7KkUTXE{{AWEc029ujl^d^=(liv~-5`2QryDvl4lbm|`1BLn2rC
zrwfc+=*bC||1L{r^C6^xUBwECX6k=N$p#2;{9v@HSa!{kGh!Tf(6l&L)YQ0OWW*Ba
z$~puA6F(nutDhi=S;_8aAYRZ0bt#qPyY3BftGNfH_P&(;LdYD4HAsX;w+3y0LXz93
z6%$ma`J)LH_}h3$#`d)X#37A$#F*#z#)BkdL%!e{gaiI$;OB83r#X<;9Hp=eZNr66
zxm=j2q<S7F8A1koZ;@j6yhom9P5s`%>ruh^J0xu@H=rYE<uL>#?gm&O5BBX#G-56H
za>M}sYR7CDqpb_425&e*cdk_Y!H@`+Zjv(gvcb}-4HhG;wF27OpeWY{3n_EF7SPxB
z-dC7$OcqcLuB#b$-#UNVO=&)!SuK1kT-a(+f6w`4Yqn?4VAlhJ(zVG(5<p~$`ruRG
z6;Zk9f+Wu_RNLr_%VG@<{~a}-qY1=}wi)0MfGPb7AB*0qSTwa%8n;~#|9xWIqEDfQ
z*1nNRrwLlqq{G`c8ICi$0y)CdNpZEzs-u>r>I=>C6yLy{jv)B2t(;2{EK*igb*X=U
zCi_e2xB-3SLNr901?iWa?yTfx<K*^DqDYKql5JDCrs83DcI7j0+})HmDb9=?A{*e2
zC<m=oRv{r91g&bQ;ybR)@O35PGi!UFpEcg;zW<5#1G!SZ6Vbz5oX0b+s)V?C23|E%
zQqid4Lho8RiZH%h6@F?ehzbf}JgFM|`t%2B04=?JSZG->6^29>&EYFmJKQmPIQZJ+
zc-WHUuoi??WkbhsA>{gyf>v`!_#hxiXUPZM13w2!I&lctwuhE~-*uz`$(O}Sn)2<e
zX|#2Be&?GPcD4Ln?E4zHb(rFj7zsvkK=)$|5?k#TG3K9EtGyldOzkYD=~6r#mM}fU
zUF@_2mwM^K8Z$?~)EaQM1|l1M!69=8Onosh$&J;!LWb7&2*uh*-n>CA33))I4Sg=0
zb+0ByY6?F_+><c=I*Rt{GpRs0zP(iGmgs5@0zpL+wjfWVZT}G~`G(s&Q`<XNF6pJH
zClO<DSK2^LAlbevzcv<;hg6u^w8ui3oWro}&V<g6#()pD%V!MQ{-Q+IS8|iaeSOK#
z9Vqn1Ah;qD-?(Q79y?BKlwAM?8&V>fT%(0`aL+_OP5l-8rZl?2%1gdb7%ef`gJZ}M
zxR8#h{~J111)pl|Y*8xO)T<#Z1|BTjJcC&OGewtl4D@#XCQ*^+F5dWyBaz~MY<D;m
z*6MkUp>*iaMT5d~+pOllccwK9u(mbW6ii>o&$3&QR1aKT?y&w000}@NJ&$F>r8EA4
z&^UP#tT6$+LQyL3O+{P7&R@?rD@tZa_TM4)RSaO;A##nDrt5^9EZjPULj_Az4P6nE
z*e?fNSXkiHEUICaxH!55Zpg`oYg2f*%9qLY2=v<pw>{|od7y`~Mr>?<LiaWvfMh*K
z%tBP>_6g78NuJs??cD&FCJjQqD^Wh@4f9>X?MrbTg##MEMks^Ei3fDKmXxdyCVZ>*
z7AGnCsha1BCttiQwOdq2oE5v&g7WFvx(4FAP?RiGvY*gxTQT}+9~A33r`~+Pl;Ex|
ze25C|{Fw*T9)fp}gWKwoQE7DIqBL|dj}5$G9EwGp7#j8RSSo<lo-}b*;&7=FE6RaB
zDlAdRZ5aGfbRN0ChhzwAB@@K<c(`^Y-sZ1j@`i^Ox*;`<ZR?gb6$I_@NUK^(^XRYA
zp=DO_Zm`try$zgYYt*o|I;)Lb{_BDyeYVG!WRsml%YjueGk$@ddl`JU-7FO&ASd=G
zS^C5`!^*|oPzSJQ-xywZO?6?X4@-U1$kM3YfuIVW->B&7#+m}@xjmL$Kx@`kh=jxT
zLe3s&O`}K|89c@t?z`(ZIId#68!BJvrgM*AZaLmZ3_lw?ccX0#K-X?n&=NIfmU7&^
z8=*2{&gG$^Pp&{}zJ7n+`<YGAxPv1k7Q+%qhaE8$Sqj*vQ&B5n0--DlaEMASZXhMK
zbwZ1FSQ&FcZ=$Sn%&x+L$>f#j6!nD?-~Op7RkOg-l1z+)5%69F)w%i!UU6a&T$w>j
zrARZe`KQKgk%&?gr#W9iXL$J*hd3K=c%T$gaTqe`;t+G|k=@3zKeS(BZ6>5&V$Wg{
zmZozv%ml#u#Kp{f<HD940UU0Kd_fmPN417Nz<3f;)cW2QE!!<x>ild^kd=CV9lCzp
z79BnB$jq@67ZY_v-;#83nQSuE0C}Ez@Qsi24!4$Nvo?(lN#Zi!L^hqc!fZnybR}4L
zv4I(}d~ctl=`t3^q$Aq57VA@hu5n%3ms&%uZU)#4%A9LxU}1vcR5I`=kd#r;T4F*|
zZ5PtW-$iFNfY0>jLQ$XaT_LTSquFnb&P}u@v}l}_=w(Afyi=F;n;aFC0KM8t0mfV5
zYoI@&?8L#0VoT&tp>~ftEtKnXB3zf6pij-;39>M{S$d573C$5|XQwyj5wQdioOBPK
zYXLHi@x=$n*U<YRP~ca?MS9Nqd7V;2T5ee-gnUSU1|`Ah`j_!278=Cn<&1G*IcOh@
zP0eIF^Qy@rSy&2?;j!XJrNN!3wmAOA(Q*q-wyD8U1WNbBdJksf#riK1Jiq+S*2mQ@
zx)Yor{>ZKh?8iJ!akf@BiWe)An&GatfdIUR*Cm03&Kd`?<@O$eT0ltiIT1__6!7Sz
z-5zcMN5m0Y<j#sDJxvXNtCLp3=D}@%5c86SW5bYOXyX=^dc~4`?!W9f)(h)o!yGn1
zS`V-_14h!fbf#0>TU%W?Vgd&MsmFnjiOeTo|2DtCRph}TFhKruk=1%=LEJ4wc#4C5
z-(ant;^3G<fd702a1qtNf`Wh`Lx6ywez#PX6jM=Wb~ZJ)Gqtv4a&opxOPP#cWWo3e
z41k-|Pv!X`Dw1jyW+hmh&4%w;8<3210N=7WNq&bXfE%CFMyNxg<)ZZY@FA43glx@Q
zNUlTuXXAj4nFVZ^1N-;p!F=mF^uM`kTk&<T4Nw4_?Qu&Ra7QC7SE<6ldGTb!)4~wr
zCW?zussv3~Y77GUSdzZakrh9V9c?$4tN)iSsfPS*s=9LBS#*;GcL^a`7CRXDn21~H
zlzfP_1IzoUCRM~<zwU83aiNd@`qli*-x)Pp@u;(?-$_WEveBu13@UXF4-`7erXsU8
z05HI<YKMPkbOl^u!$#0k2II+8Xj*M@QB;w4e2z!Mj>RyQeqAqy<<qmdX4ku33hk8@
zx5{!{(I8^wr6sYU8ckI7neR=uv;)&!WZ;JcsF76)IG@3sHMp&{q)q2v*T)|)tMRmF
zxCCqDw*tx5N(b3@EHJB~4g*KQc37INHfVs3yIaIer)xc&GI;@5rzYu;iaYLAYpkCI
z*sOQuolfP&Xky7on<1!+6VUVj@?mlHLQtb7#nZ3aYtb}|AzKZ^y%XmR=gFnI!?}na
z+-{D8k|3CDPME25RL!CKE0L>Y4^FvHW!aE5gK|iZlpjSOCI|9ozCgcXo__bxv;73P
zmUOHRRg$uHJ?_^&Zr~Q}#S^LYlWen6PIqKa0lb>t5dRN?z(8RBi=YvPpaAY~Kq+K@
z<K=&`;%Ms0<Za{bV4s(_>A5xH`t#-k1N|hsxHT_r4QaTWMlJQ6F$sY+HJP5tS!FOd
z4Ag`}#MV=5M-UKj{d+{`_W`D=@GStG122Gv!22JtZqw=xBJ_9X^Hcw>(T8_^kms_d
z$NS5h3Et{=p0a-*M-hhr-d-X7&)MnCVXG}JJ}v;(#>Vee=p2_z06(8^U|`_WzlSPE
zZ-KYXy53LU$7OrBJ+3#zxAS0oUG0wz$M?kq;m=Xk)hYnEczELiV8qvc@96TnTxSbm
z`%uNP)z=G)c*2t|=a9VhEyA4h`f;~b_uozNuVrtW!$FtTL8q7&yM1BoFE9TiuDAV{
zu_odU+lsG0$BP4(i%wP#tI+1Hd_26@Q%Rgp<1X!M2=##hCR~A*35UiPo&+7XdT|}O
zNJ>nq?*0Icz|A+FWlRna_&1#0VM{yyh4kLXI2QZm{nA3d>diqH^{T<&`ilBCqoFBf
zy6tU?^w=JqI)Bq*+<Ncdk2G7a?7FcNBD(2~%kGYC0_B<e_HF+zo35`yQ(K!(I#Z>7
z*0^#Acg^WDUCQ!xw@dW;lujOO3V&@O8c!t%uO0$U>cKcy9Dc~DWz15y+L~%H&dmS5
zNx$!KR4fx@D46J=C3aUVJc9pD<b$^|d$+rF9-+2OKea?{xsABFupG&4#VN(awD|XC
zksjyC@tpl5L)iJc)%(?{^4wHEp@fkl;J_nJ=--wgK`w@>aq1g~UBI0*kc6)U&R~Bv
z0Kfz2D@fUqG&~Ad$Ijs9j?u3R1Pau4w1lT^Pc}3)tJZL-d^=JR+k4OWQ0nZ1o-qwg
z9t|*?j2-=i&<L@1ra=p7vN2x9UqQwVH2VG!v98bIrq6jO;y#&qn5a*h9bjcN8c!WN
z1O4NQ22p*E$H4L9Qo$>oI)6rf%7#iLdpp3k&|31+HZ(zPgyRKXa)D96a=1RB7%xXN
zuLto!dJKE_@qqm~9$I%9)0OSrio@$iI;I}Z#EEk=?WXi*7oVxi3B*YIUsKJxr|=s6
z&M?|8TRkozyC4T(Df9l*Qmuc9+ePWHWFk*$%a&O*BmbhJZoXlbcS~EkRoR(=;TFI!
zkCC~q4sM$%+3@`&?U(Y&56!&Ij##h}&UCI%5KTiPV2}T&8Dvi7yQz0r|2kQGrM(su
zYI{V{){g}4cbOALsckbsy6D^DAorECNd!@QhT8&haB`9$bc(QFqtCyvy%nkBrl>I5
zcKf|o6t5y-MA6jBO@nYpqu3TUp;`d!$=H^qF}^CeqjGE$miqnLat+C;#U?mzvGW$W
zK+8ZGsU+6gJ-ZQ>=vWu_K6FbQ$&oqogZ(Z7`3czHL7emkF5^c1?2Q*PCwZ+BvKWa5
zyAd=>D5y(oh#01rpd~cpLYaxDLiC%M9Oc$;g9ypiXeo`f(2$3Xo%%-q4rl>72Wloy
z!~Yyvp8~jJRUkEL*?kl%f{5_cGGl9(LnX8s1;A<TrJk(LCTubB!N~4ttyUu(GjNRd
z(3v*zu0o<-c9bcfvm>uK-7-0fze8r{ZtAxs+3G&$J=E)@BuQ1%=ciIrLt+Q4=kPGi
z%6Apk8>8bWiH`sMrkPPr3%LS_e@ja&8l1DXmRuQ97XHotu&-_67|9+t%O*THLv=cX
z0@k9bn-hz1f}Rpg2{^y*$`3_lN2a8ux8)kJR$q)Zv3#qVX|nyj$-`@!2-X0NNpGpn
z{jv)&<))`7mDBa3*JzQND22wM0F?y(GkoCab&q5^y%Jnm=i|*FazX<@mV&*x&N-~+
zW6>B>79%M?!5vs|q92#8<C1pdwgO|PR=Okk=_R|wluA!|qFfiIALo{A*(+W#UCoLr
z)C^_*2AET(7$AEFov8|$`PKQ^lq^HopE9Oux@U{*`Ny}1;jnFQ|47H&u5i`G_5g1s
z1s6zZOP#!kMTKM{eTV^UIZYFa_QA4MkKx)Pse(llAs?ucEnDO!Sh9l->qN<CwVYlX
zLBskusw2)>Vv6^?Up-0Q{|&lPh-yKB?V85e_>FVFU5>aLhCzvD0U>Br0>Kywb8~?O
z(+@)yLgv}e+pBR>`xnF)FL(x2>y=?U9w3W=e%GzN_zXH1<;)7$Ey#XC8Slcz^e~2r
ze}~$GuaOc(Wtn0W(}*)*xK-9wd=7~fv2DbbfRMZl@y+C0MUm~AErm>a{MO7BE2uf*
zO6ud+VktE9Y8W$a9WrVq^Wu&hsx|Kcz$&I}Q62c*Z2UC1VLEviMtq9Y6U2AjW-9YU
zx^T5U*hg2DVtWEONb_nXt2Tz6DOfE&(rgmR`S)4%&K!9Ru9Wc!P>=Zc;uBEz#$<hh
z2Av$#lbO@NsrUnlx53$RB5x=UB`9uTI)te(Ifub|2dpUFHgeXTJkK0A^D&u8%V{qS
z0I+qHU+o#z?!3s`0eR!D8~-pCFv$)oe82OH8=+;cN)P}fVg9{UGVhv3P^n0msShNM
zGu<0@)F=xP*5~=<*Ntg%(Q`rzneZzf*N#Erey7plhuH7gO_dY$5~uqhsfTT~%-N#a
z<3CI>%Ic%a{G*I>Hkx?F)mmS&3PE;yPF_ewN+&RKQ+6G2DENeO*UclJXqNw#aPS6q
z%B4O9tk4B`M!p#FGuGlCAxFn1Wm{B7;(P@WlAh@tjiM`(MbU6u`cg&6kjbeEb2KQa
zD2|9~#>kLG`?w~s#P(5l-AvGNUh5>W-iONK6`(im3!(7JBDyt<6|C0NMA7)LN<=BM
z&SuQ9qha8Z@1~XB@!U*4vjQp;ZT*pOBS?dlWv&1wkq}1jLHtY!2FFcXg_Bl3=x|YF
zYIxD)q7q}sa%(?v<U7>nWu?dp!kSEJv0lun=p_7|ili5xK&l$>J)?p(Q75;yY=eSw
zhsrANu2|f~NnTXW%B?dZ6_VGj1(9POh-N1&c@dF+o_6F$To+GS5M2#&3~1k@U~56d
zKH>nh5g@Nql@f~j;uhUx_E2j(8jNnD&-a^Z@8U%%U@dWP@+&e=ds%0xl8@lEGGl3H
z)UU{PG5M8<Z*yA<WQL<iSMz?y>YuzRT*>f0V#xoaA&-Gz0@ZFqVeRe^1@l)YhD95w
zF3TB5%clL<^??0ZWKb)obAGK6UG_P7k?RcbVKmL$U=hy$9xJ$?v~4tITz`jI(y#lE
zCNh*ydm)Z1WPctfZpt)$8XPxHHJ#8}r<z3(15<SNS*I=nkAA^ZIKv+5s$bAv<02fc
z=ZKJ!6>x}H5*gDD{wT)FIh6i7J*%&$+8eUBC7me8diXA8%WWr{eTtzms}j~f69Ets
zkrWNIJp9^YjczUv)qy5SigG?ZV#%lUR^LVLDgB5m&S~qe6<b0}m;*5siKFgbjCkUA
z@AMeyfgzDVa>=23<ZASvniL2RwJ)}zxJpSZ3;c+*C$Bf@*ur07yWXN;Ik%II56lx1
zQppq;?}wSDkVO5Srai+-f@-yZzyix2KbH<YQQ@DhD~f~7%9f44>6*8Q!YH{YV?ktT
zoI5|H0;y$SKCT05U<PRYf3^!M;EL|EPsKI3>T`EOL?uVw6K#yTh|?$~tB&n^i%PVe
zL&>p(M50JNu}3MlYg91Osp89RIeq1-d?1B{nJl8_AZ1XYy;7)u&QV1IVjw?j-_3Sn
z%2{`fkF5Wo<f(p*BzJ@6!<r5F{?viT^~yNK6{i>Y8E`nCbw##lX%r&7C~5TGf&>dT
zAc?40hVmWREN1@$vZmUH>JLFs>^AVifXKE%vZfh7e9DU=!-oUNvDEvO6B-tI>Y*$K
z=@gl1l(8BYBak6DD>N<(FfZQ~WF^FgWGWyjW?iiF>tBDJkRX!f{;2TvzSl_T;gkj|
zDAZ?Ep#wFT0$z;cUZ+G3m3Oi7vQ5E&<(TY>*v`k5eslz7Y?R?NZu^43>HeaSmC#+$
zCqW>uhxL{cN_k1G3$V{K8}rPOH8wcvoEpxJr84uIuF7|anqY(h*bfMUye*ao%0*Vz
z<9big5;$cC7roPI{&~;50wUiZ$n0&Wd&B?)>FlLg)6MAw@uRv@$WEem$uJkeYXn41
z(1kjXnWcihvGnI+s++6*abu^@Z3ct=<F7q?vvD7>8$!F|E)@j;!#fQBeMdy+z-LP^
zyM72bwB<nM3`-9XScxWGb=buzzmlhlmT@^NFv}P2vLgVM*+a7m@FKnGjOn^zDh==w
zecupUSv|phY#%v!vFEkrXG>C?@Y@#Kxxo6f%4pH;2)b@M_AGqy0q1g~J-1Vr_!Q{t
z#y-|?^DvirzN=uqEEq8WL|x>!BIl;Kg-w}272Rijl>Clgw;)Sd(rzI3oD?XSWRIXM
zr&f%Hcp%Mfm9$c=x+dI@y3BeEklW7rH=R>!SGa^35hm6;aT$Ffe34CMQRF5$qv8hR
zr#$13Cp&3S0DvUb37~PWnwr_UxLD4-FJX^T%o@3P!hbgs`R;A&Ne*Yf19*};D*gM}
z6^z+HGc|zL^=G#Dn%_YLnPD}wstNj-Y-*lx>r;02su)n+3XuGY*~~8QxP&jP@asLx
zjv;>B`)oXW0NcDgipR#Qa;WsN(;I^*1cO(6nzZZQgI9I8PQ+4J;7rF)t3Hy8aIqZ$
z@q6z6!jm_^XtRm3$__GbDuWZv?IX*)u`TRK5(Bhso;tb=JsgZ~+DrjUh!aRB<AhK`
z$Xl@UfEeF^!Yk}7PAI#f`ZZLZ$-wwato?;7c_RkxD(&^Ke8o+1fOQuUwyxk(ow7QC
zGT5Kt)$#pJQP1jq%RHIJgx^pP5|YfC3nFilY@_iV48sBwbTCl+xm?|&MP9=CVd{d9
z9e{)NTH4**<E>h=TI(gw{WN)xni4{_zn85yX8U{7KW}~2zBkY5iZ(?d<8G#-#_!rb
zfrfnkcV;QJ%8DP$maA=5*SaKJj;T<Y;3-PlFdJ}vE|xpoz-z?-C44sXAMQyn<ONrJ
zlSc2<(>n5>#rvFZ-S2kSUD&#f$A!RpdBDi&on`Bvspn}r6((2N*W4UAdpTtBs47*A
zHV7b&lHSSNf`K4}eMJtlfz~`Bgi!F*TGW8$%cea|A`i8PRj*YFy+4%DU89>L^w!w~
zEbAt*<3dv6F;e?^+n8&31A!MoMQh9tMYQ{E(jr;&^sf$SYHA1t>ukJN%XH>=0l<2R
zQd5!NAACsr3LiuoCN{%QVeC@N^x2PAu--nmx%}qDr|RKqYsMi#yWqD`u{q(B64i5=
zKZOB$q!){DOBI+QLN%E{iSRCJy8Haf#AgY}zfo|a${Ks$FOL$EJLs4T`IVVZ65(ys
zbk52eGQP!TE9jU9`ITeJU6;9sfLIr}@au}H&!MN3z<QMDP{=E2cwJ!`N6&@K<5j<?
zE!G2Hb#8R9{HC41vfB1rYGbY!yT7I#RQUeo{bDx%^}(`Jy}B!eDDSU)DP}$dd{bIt
zX8%0hcY7I={!n&Sd{Qt|og!DdX7{2o;k{bLd}Qv47<FxK3Z(m9TX3I30E*1Bz83la
zemyE3C0GVQ&I1rRzChY|cvx=)ioSSXx&gS}#<d-RUcJ6;z&cmbU?AQ~fUY2AlkUme
z3OLB?F^w~9j+z4uDV#w_`?xraDhg_4-bKJ%XupjI=wf^04bE<z3C`WlDO<)$v!>Zv
z(1k`od&tof>8fDdxNUkCK<GhXH4#oQ%)XT@9LqeaAah;mK{zyJS<?O{C>MNpl}>Y8
zcnyFm5zn_ODZm1pIBBDZvAHPs*T9{yBbzBW5ni1F(v340UWt$Mg!+}c^%#2($3(un
zF#pE&s|t@T-TGqABBnOFBRdGpjg`bTVAe=DKQ-)gS2}z<Eht_FNGsgvC2SWjLn@q}
zGGX=@TD=n`-6Y+p8|K7v?eR?uD=KMWvv$YjV@X%RXU^2%8a^4?+9&r>W-3clcE)7x
z%={B~@(-X0mam^hqV7d*zb*<{ig}5=Y8H>N@FZQ_&Ujl`UrSh(fS6w+074=gL`odG
z%3NJYHapc5&$aIYJT=Ks6i3EU?14=_T|(^vWA60th{@|OtQqYbg4(hO_$+xPAHKug
zuU>yqML2Lz;V)fd(=1YB`#gl5{w_;#cl>e@g}VW@5(NCVj}r;*TVHat$c9w_d+{PC
zCx!J70d#`07Y~(IPs_uh?va-R;YEzIu`!B?X%(Od>!v9Hq?FRm9}^V&#hcP#H>Ht2
z2dn)i=1w<86Me_wluVYHD#uUXqc-AGfR<MSMWF>{1f>?+RS&{=k6*^eC|E+!JuAgg
zdzFrp^Uy=>bWd@C66<1ub$C`E#Y?c0p4FSw!z1G7@%J*_BVtQvk5@Pa?Tdl#t`@nc
z*4pnt1VI`g;H3QAjD1!0+9oe}9m4xlpw;m+Wbykyv;aWQf6^UjvN1Qv<?ak_`RX}L
zkb3*~$>DeU#JCiTq%tw3w|ZGmcIv0FGr7BU;#CCaus_3cOFlTsB@3(b0Lmen^uw)M
z<+$wB+*eACSiDsIPMGA_<g~m~t4q!K(-N*yOIrXm2KuR$EnVFm@3+s-?mj*NWfw6%
z3cI^Vr#qIF`PZP^<RG#?37mftSY-Vu%=&?1Q4VTZz7P4Tu$D5L>hiN+Nr9FoG8qAD
z4*_cv_vhC<A*84ltcn(_L^~--J87boH_7a65RE(-g*;dz1MD0FY-A&vNF&;9NHxUe
zxLgpx8w<WkmqErlIdPUkR466vRRK+cU6zDh7G;*glq&^dp8%zimn8BeNaQ4lBnKQU
z4?M(%3(A5E>V6$(%G#WyAg<q^3#xb>C2{>*nwjimS3Y}{E0mbNxE(aH9kl)w3gr}v
zBpV+j3qQ!l5yZj~q_G`zt{wFD6e{uL+aUCRS(4j9_u7N|cxmmASC1O}5u`fX0FNhF
zoA=`k_#v-$IMl-bgjM80!HB^Bm(b40%>ri!|K_kW7P7!O{#${~1{eKrMKK$k75P8(
zHaC4On*$9f$d(UGMqD;H^M9?q+2HtKU$hxp+2DjE|34D^Ka}}5Ck|2?jBk^Hn*&b#
b-&X%G{rNvbsB+Gl9x<C)k!^V$Gf)r!%C(l6

diff --git a/doc/cupspm.html b/doc/cupspm.html
index 24bf5c9ba..a221dcd15 100644
--- a/doc/cupspm.html
+++ b/doc/cupspm.html
@@ -314,10 +314,15 @@ <h2 class="title">Contents</h2>
 <li><a href="#cupsCondInit">cupsCondInit</a></li>
 <li><a href="#cupsCondWait">cupsCondWait</a></li>
 <li><a href="#cupsConnectDest">cupsConnectDest</a></li>
+<li><a href="#cupsCopyCredentials">cupsCopyCredentials</a></li>
+<li><a href="#cupsCopyCredentialsKey">cupsCopyCredentialsKey</a></li>
+<li><a href="#cupsCopyCredentialsRequest">cupsCopyCredentialsRequest</a></li>
 <li><a href="#cupsCopyDest">cupsCopyDest</a></li>
 <li><a href="#cupsCopyDestConflicts">cupsCopyDestConflicts</a></li>
 <li><a href="#cupsCopyDestInfo">cupsCopyDestInfo</a></li>
 <li><a href="#cupsCopyString">cupsCopyString</a></li>
+<li><a href="#cupsCreateCredentials">cupsCreateCredentials</a></li>
+<li><a href="#cupsCreateCredentialsRequest">cupsCreateCredentialsRequest</a></li>
 <li><a href="#cupsCreateDestJob">cupsCreateDestJob</a></li>
 <li><a href="#cupsDNSSDAssembleFullName">cupsDNSSDAssembleFullName</a></li>
 <li><a href="#cupsDNSSDBrowseDelete">cupsDNSSDBrowseDelete</a></li>
@@ -414,9 +419,12 @@ <h2 class="title">Contents</h2>
 <li><a href="#cupsGetServer">cupsGetServer</a></li>
 <li><a href="#cupsGetUser">cupsGetUser</a></li>
 <li><a href="#cupsGetUserAgent">cupsGetUserAgent</a></li>
+<li><a href="#cupsHMACData">cupsHMACData</a></li>
 <li><a href="#cupsHashData">cupsHashData</a></li>
 <li><a href="#cupsHashString">cupsHashString</a></li>
 <li><a href="#cupsJSONDelete">cupsJSONDelete</a></li>
+<li><a href="#cupsJSONExportFile">cupsJSONExportFile</a></li>
+<li><a href="#cupsJSONExportString">cupsJSONExportString</a></li>
 <li><a href="#cupsJSONFind">cupsJSONFind</a></li>
 <li><a href="#cupsJSONGetChild">cupsJSONGetChild</a></li>
 <li><a href="#cupsJSONGetCount">cupsJSONGetCount</a></li>
@@ -426,14 +434,30 @@ <h2 class="title">Contents</h2>
 <li><a href="#cupsJSONGetSibling">cupsJSONGetSibling</a></li>
 <li><a href="#cupsJSONGetString">cupsJSONGetString</a></li>
 <li><a href="#cupsJSONGetType">cupsJSONGetType</a></li>
-<li><a href="#cupsJSONLoadFile">cupsJSONLoadFile</a></li>
-<li><a href="#cupsJSONLoadString">cupsJSONLoadString</a></li>
+<li><a href="#cupsJSONImportFile">cupsJSONImportFile</a></li>
+<li><a href="#cupsJSONImportString">cupsJSONImportString</a></li>
+<li><a href="#cupsJSONImportURL">cupsJSONImportURL</a></li>
 <li><a href="#cupsJSONNew">cupsJSONNew</a></li>
 <li><a href="#cupsJSONNewKey">cupsJSONNewKey</a></li>
 <li><a href="#cupsJSONNewNumber">cupsJSONNewNumber</a></li>
 <li><a href="#cupsJSONNewString">cupsJSONNewString</a></li>
-<li><a href="#cupsJSONSaveFile">cupsJSONSaveFile</a></li>
-<li><a href="#cupsJSONSaveString">cupsJSONSaveString</a></li>
+<li><a href="#cupsJWTDelete">cupsJWTDelete</a></li>
+<li><a href="#cupsJWTExportString">cupsJWTExportString</a></li>
+<li><a href="#cupsJWTGetAlgorithm">cupsJWTGetAlgorithm</a></li>
+<li><a href="#cupsJWTGetClaimNumber">cupsJWTGetClaimNumber</a></li>
+<li><a href="#cupsJWTGetClaimString">cupsJWTGetClaimString</a></li>
+<li><a href="#cupsJWTGetClaimType">cupsJWTGetClaimType</a></li>
+<li><a href="#cupsJWTGetClaimValue">cupsJWTGetClaimValue</a></li>
+<li><a href="#cupsJWTGetClaims">cupsJWTGetClaims</a></li>
+<li><a href="#cupsJWTHasValidSignature">cupsJWTHasValidSignature</a></li>
+<li><a href="#cupsJWTImportString">cupsJWTImportString</a></li>
+<li><a href="#cupsJWTMakePrivateKey">cupsJWTMakePrivateKey</a></li>
+<li><a href="#cupsJWTMakePublicKey">cupsJWTMakePublicKey</a></li>
+<li><a href="#cupsJWTNew">cupsJWTNew</a></li>
+<li><a href="#cupsJWTSetClaimNumber">cupsJWTSetClaimNumber</a></li>
+<li><a href="#cupsJWTSetClaimString">cupsJWTSetClaimString</a></li>
+<li><a href="#cupsJWTSetClaimValue">cupsJWTSetClaimValue</a></li>
+<li><a href="#cupsJWTSign">cupsJWTSign</a></li>
 <li><a href="#cupsLangAddStrings">cupsLangAddStrings</a></li>
 <li><a href="#cupsLangDefault">cupsLangDefault</a></li>
 <li><a href="#cupsLangFind">cupsLangFind</a></li>
@@ -487,8 +511,10 @@ <h2 class="title">Contents</h2>
 <li><a href="#cupsSetPasswordCB">cupsSetPasswordCB</a></li>
 <li><a href="#cupsSetServer">cupsSetServer</a></li>
 <li><a href="#cupsSetServerCertCB">cupsSetServerCertCB</a></li>
+<li><a href="#cupsSetServerCredentials">cupsSetServerCredentials</a></li>
 <li><a href="#cupsSetUser">cupsSetUser</a></li>
 <li><a href="#cupsSetUserAgent">cupsSetUserAgent</a></li>
+<li><a href="#cupsSignCredentialsRequest">cupsSignCredentialsRequest</a></li>
 <li><a href="#cupsStartDestDocument">cupsStartDestDocument</a></li>
 <li><a href="#cupsTempFd">cupsTempFd</a></li>
 <li><a href="#cupsTempFile">cupsTempFile</a></li>
@@ -526,7 +552,12 @@ <h2 class="title">Contents</h2>
 <li><a href="#httpClose">httpClose</a></li>
 <li><a href="#httpCompareCredentials">httpCompareCredentials</a></li>
 <li><a href="#httpConnect">httpConnect</a></li>
+<li><a href="#httpCopyCredentials">httpCopyCredentials</a></li>
 <li><a href="#httpCreateCredentials">httpCreateCredentials</a></li>
+<li><a href="#httpCredentialsAreValidForName">httpCredentialsAreValidForName</a></li>
+<li><a href="#httpCredentialsGetExpiration">httpCredentialsGetExpiration</a></li>
+<li><a href="#httpCredentialsGetTrust">httpCredentialsGetTrust</a></li>
+<li><a href="#httpCredentialsString">httpCredentialsString</a></li>
 <li><a href="#httpDecode64">httpDecode64</a></li>
 <li><a href="#httpEncode64">httpEncode64</a></li>
 <li><a href="#httpError">httpError</a></li>
@@ -560,12 +591,14 @@ <h2 class="title">Contents</h2>
 <li><a href="#httpInitialize">httpInitialize</a></li>
 <li><a href="#httpIsChunked">httpIsChunked</a></li>
 <li><a href="#httpIsEncrypted">httpIsEncrypted</a></li>
+<li><a href="#httpLoadCredentials">httpLoadCredentials</a></li>
 <li><a href="#httpPeek">httpPeek</a></li>
 <li><a href="#httpRead">httpRead</a></li>
 <li><a href="#httpReadRequest">httpReadRequest</a></li>
 <li><a href="#httpReconnect">httpReconnect</a></li>
 <li><a href="#httpResolveHostname">httpResolveHostname</a></li>
 <li><a href="#httpResolveURI">httpResolveURI</a></li>
+<li><a href="#httpSaveCredentials">httpSaveCredentials</a></li>
 <li><a href="#httpSeparateURI">httpSeparateURI</a></li>
 <li><a href="#httpSetAuthString">httpSetAuthString</a></li>
 <li><a href="#httpSetBlocking">httpSetBlocking</a></li>
@@ -718,12 +751,17 @@ <h2 class="title">Contents</h2>
 <li><a href="#cups_array_cb_t">cups_array_cb_t</a></li>
 <li><a href="#cups_array_t">cups_array_t</a></li>
 <li><a href="#cups_bool_t">cups_bool_t</a></li>
+<li><a href="#cups_cert_san_cb_t">cups_cert_san_cb_t</a></li>
 <li><a href="#cups_client_cert_cb_t">cups_client_cert_cb_t</a></li>
 <li><a href="#cups_cond_t">cups_cond_t</a></li>
+<li><a href="#cups_credpurpose_t">cups_credpurpose_t</a></li>
+<li><a href="#cups_credtype_t">cups_credtype_t</a></li>
+<li><a href="#cups_credusage_t">cups_credusage_t</a></li>
 <li><a href="#cups_cspace_t">cups_cspace_t</a></li>
 <li><a href="#cups_cut_t">cups_cut_t</a></li>
 <li><a href="#cups_dentry_t">cups_dentry_t</a></li>
 <li><a href="#cups_dest_cb_t">cups_dest_cb_t</a></li>
+<li><a href="#cups_dest_flags_t">cups_dest_flags_t</a></li>
 <li><a href="#cups_dest_t">cups_dest_t</a></li>
 <li><a href="#cups_dinfo_t">cups_dinfo_t</a></li>
 <li><a href="#cups_dir_t">cups_dir_t</a></li>
@@ -745,7 +783,10 @@ <h2 class="title">Contents</h2>
 <li><a href="#cups_jog_t">cups_jog_t</a></li>
 <li><a href="#cups_json_t">cups_json_t</a></li>
 <li><a href="#cups_jtype_t">cups_jtype_t</a></li>
+<li><a href="#cups_jwa_t">cups_jwa_t</a></li>
+<li><a href="#cups_jwt_t">cups_jwt_t</a></li>
 <li><a href="#cups_lang_t">cups_lang_t</a></li>
+<li><a href="#cups_media_flags_t">cups_media_flags_t</a></li>
 <li><a href="#cups_mediapos_t">cups_mediapos_t</a></li>
 <li><a href="#cups_mutex_t">cups_mutex_t</a></li>
 <li><a href="#cups_oauth_cb_t">cups_oauth_cb_t</a></li>
@@ -813,14 +854,20 @@ <h2 class="title">Contents</h2>
 <li><a href="#ENUMERATIONS">Enumerations</a><ul class="subcontents">
 <li><a href="#cups_adv_e">cups_adv_e</a></li>
 <li><a href="#cups_bool_e">cups_bool_e</a></li>
+<li><a href="#cups_credpurpose_e">cups_credpurpose_e</a></li>
+<li><a href="#cups_credtype_e">cups_credtype_e</a></li>
+<li><a href="#cups_credusage_e">cups_credusage_e</a></li>
 <li><a href="#cups_cspace_e">cups_cspace_e</a></li>
 <li><a href="#cups_cut_e">cups_cut_e</a></li>
+<li><a href="#cups_dest_flags_e">cups_dest_flags_e</a></li>
 <li><a href="#cups_dnssd_flags_e">cups_dnssd_flags_e</a></li>
 <li><a href="#cups_dnssd_rrtype_e">cups_dnssd_rrtype_e</a></li>
 <li><a href="#cups_edge_e">cups_edge_e</a></li>
 <li><a href="#cups_encoding_e">cups_encoding_e</a></li>
 <li><a href="#cups_jog_e">cups_jog_e</a></li>
 <li><a href="#cups_jtype_e">cups_jtype_e</a></li>
+<li><a href="#cups_jwa_e">cups_jwa_e</a></li>
+<li><a href="#cups_media_flags_e">cups_media_flags_e</a></li>
 <li><a href="#cups_mediapos_e">cups_mediapos_e</a></li>
 <li><a href="#cups_order_e">cups_order_e</a></li>
 <li><a href="#cups_orient_e">cups_orient_e</a></li>
@@ -2470,6 +2517,45 @@ <h4 class="discussion">Discussion</h4>
 The caller can pass <code>CUPS_DEST_FLAGS_DEVICE</code> for the &quot;flags&quot; argument to
 connect directly to the device associated with the destination.  Otherwise,
 the connection is made to the CUPS scheduler associated with the destination.</p>
+<h3 class="function"><a id="cupsCopyCredentials">cupsCopyCredentials</a></h3>
+<p class="description"></p>
+<p class="code">
+char *cupsCopyCredentials(const char *path, const char *common_name);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>path</th>
+<td class="description">Directory path for certificate/key store or <code>NULL</code> for default</td></tr>
+<tr><th>common_name</th>
+<td class="description">Common name</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">Copy the X.509 certificate chain to a string.</p>
+<h3 class="function"><a id="cupsCopyCredentialsKey">cupsCopyCredentialsKey</a></h3>
+<p class="description"></p>
+<p class="code">
+char *cupsCopyCredentialsKey(const char *path, const char *common_name);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>path</th>
+<td class="description">Directory path for certificate/key store or <code>NULL</code> for default</td></tr>
+<tr><th>common_name</th>
+<td class="description">Common name</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">Copy the private key to a string.</p>
+<h3 class="function"><a id="cupsCopyCredentialsRequest">cupsCopyCredentialsRequest</a></h3>
+<p class="description"></p>
+<p class="code">
+char *cupsCopyCredentialsRequest(const char *path, const char *common_name);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>path</th>
+<td class="description">Directory path for certificate/key store or <code>NULL</code> for default</td></tr>
+<tr><th>common_name</th>
+<td class="description">Common name</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">Copy the X.509 certificate signing request to a string.</p>
 <h3 class="function"><a id="cupsCopyDest">cupsCopyDest</a></h3>
 <p class="description">Copy a destination.</p>
 <p class="code">
@@ -2568,6 +2654,238 @@ <h4 class="parameters">Parameters</h4>
 </tbody></table>
 <h4 class="returnvalue">Return Value</h4>
 <p class="description">Length of string</p>
+<h3 class="function"><a id="cupsCreateCredentials">cupsCreateCredentials</a></h3>
+<p class="description">Make an X.509 certificate and private key pair.</p>
+<p class="code">
+bool cupsCreateCredentials(const char *path, bool ca_cert, <a href="#cups_credpurpose_t">cups_credpurpose_t</a> purpose, <a href="#cups_credtype_t">cups_credtype_t</a> type, <a href="#cups_credusage_t">cups_credusage_t</a> usage, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name, size_t num_alt_names, const char *const *alt_names, const char *root_name, time_t expiration_date);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>path</th>
+<td class="description">Directory path for certificate/key store or <code>NULL</code> for default</td></tr>
+<tr><th>ca_cert</th>
+<td class="description"><code>true</code> to create a CA certificate, <code>false</code> for a client/server certificate</td></tr>
+<tr><th>purpose</th>
+<td class="description">Credential purposes</td></tr>
+<tr><th>type</th>
+<td class="description">Credential type</td></tr>
+<tr><th>usage</th>
+<td class="description">Credential usages</td></tr>
+<tr><th>organization</th>
+<td class="description">Organization or <code>NULL</code> to use common name</td></tr>
+<tr><th>org_unit</th>
+<td class="description">Organizational unit or <code>NULL</code> for none</td></tr>
+<tr><th>locality</th>
+<td class="description">City/town or <code>NULL</code> for &quot;Unknown&quot;</td></tr>
+<tr><th>state_province</th>
+<td class="description">State/province or <code>NULL</code> for &quot;Unknown&quot;</td></tr>
+<tr><th>country</th>
+<td class="description">Country or <code>NULL</code> for locale-based default</td></tr>
+<tr><th>common_name</th>
+<td class="description">Common name</td></tr>
+<tr><th>num_alt_names</th>
+<td class="description">Number of subject alternate names</td></tr>
+<tr><th>alt_names</th>
+<td class="description">Subject Alternate Names</td></tr>
+<tr><th>root_name</th>
+<td class="description">Root certificate/domain name or <code>NULL</code> for site/self-signed</td></tr>
+<tr><th>expiration_date</th>
+<td class="description">Expiration date</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description"><code>true</code> on success, <code>false</code> on failure</p>
+<h4 class="discussion">Discussion</h4>
+<p class="discussion">This function creates an X.509 certificate and private key pair.  The
+certificate and key are stored in the directory &quot;path&quot; or, if &quot;path&quot; is
+<code>NULL</code>, in a per-user or system-wide (when running as root) certificate/key
+store.  The generated certificate is signed by the named root certificate or,
+if &quot;root_name&quot; is <code>NULL</code>, a site-wide default root certificate.  When
+&quot;root_name&quot; is <code>NULL</code> and there is no site-wide default root certificate, a
+self-signed certificate is generated instead.<br>
+<br>
+The &quot;ca_cert&quot; argument specifies whether a CA certificate should be created.<br>
+<br>
+The &quot;purpose&quot; argument specifies the purpose(s) used for the credentials as a
+bitwise OR of the following constants:
+
+</p><ul>
+<li><code>CUPS_CREDPURPOSE_SERVER_AUTH</code> for validating TLS servers,
+</li>
+<li><code>CUPS_CREDPURPOSE_CLIENT_AUTH</code> for validating TLS clients,
+</li>
+<li><code>CUPS_CREDPURPOSE_CODE_SIGNING</code> for validating compiled code,
+</li>
+<li><code>CUPS_CREDPURPOSE_EMAIL_PROTECTION</code> for validating email messages,
+</li>
+<li><code>CUPS_CREDPURPOSE_TIME_STAMPING</code> for signing timestamps to objects, and/or
+</li>
+<li><code>CUPS_CREDPURPOSE_OCSP_SIGNING</code> for Online Certificate Status Protocol
+  message signing.</li>
+</ul>
+<p class="discussion">The &quot;type&quot; argument specifies the type of credentials using one of the
+following constants:
+
+</p><ul>
+<li><code>CUPS_CREDTYPE_DEFAULT</code>: default type (RSA-3072 or P-384),
+</li>
+<li><code>CUPS_CREDTYPE_RSA_2048_SHA256</code>: RSA with 2048-bit keys and SHA-256 hash,
+</li>
+<li><code>CUPS_CREDTYPE_RSA_3072_SHA256</code>: RSA with 3072-bit keys and SHA-256 hash,
+</li>
+<li><code>CUPS_CREDTYPE_RSA_4096_SHA256</code>: RSA with 4096-bit keys and SHA-256 hash,
+</li>
+<li><code>CUPS_CREDTYPE_ECDSA_P256_SHA256</code>: ECDSA using the P-256 curve with SHA-256 hash,
+</li>
+<li><code>CUPS_CREDTYPE_ECDSA_P384_SHA256</code>: ECDSA using the P-384 curve with SHA-256 hash, or
+</li>
+<li><code>CUPS_CREDTYPE_ECDSA_P521_SHA256</code>: ECDSA using the P-521 curve with SHA-256 hash.</li>
+</ul>
+<p class="discussion">The &quot;usage&quot; argument specifies the usage(s) for the credentials as a bitwise
+OR of the following constants:
+
+</p><ul>
+<li><code>CUPS_CREDUSAGE_DIGITAL_SIGNATURE</code>: digital signatures,
+</li>
+<li><code>CUPS_CREDUSAGE_NON_REPUDIATION</code>: non-repudiation/content commitment,
+</li>
+<li><code>CUPS_CREDUSAGE_KEY_ENCIPHERMENT</code>: key encipherment,
+</li>
+<li><code>CUPS_CREDUSAGE_DATA_ENCIPHERMENT</code>: data encipherment,
+</li>
+<li><code>CUPS_CREDUSAGE_KEY_AGREEMENT</code>: key agreement,
+</li>
+<li><code>CUPS_CREDUSAGE_KEY_CERT_SIGN</code>: key certicate signing,
+</li>
+<li><code>CUPS_CREDUSAGE_CRL_SIGN</code>: certificate revocation list signing,
+</li>
+<li><code>CUPS_CREDUSAGE_ENCIPHER_ONLY</code>: encipherment only,
+</li>
+<li><code>CUPS_CREDUSAGE_DECIPHER_ONLY</code>: decipherment only,
+</li>
+<li><code>CUPS_CREDUSAGE_DEFAULT_CA</code>: defaults for CA certificates,
+</li>
+<li><code>CUPS_CREDUSAGE_DEFAULT_TLS</code>: defaults for TLS certificates, and/or
+</li>
+<li><code>CUPS_CREDUSAGE_ALL</code>: all usages.</li>
+</ul>
+<p class="discussion">The &quot;organization&quot;, &quot;org_unit&quot;, &quot;locality&quot;, &quot;state_province&quot;, and &quot;country&quot;
+arguments specify information about the identity and geolocation of the
+issuer.<br>
+<br>
+The &quot;common_name&quot; argument specifies the common name and the &quot;num_alt_names&quot;
+and &quot;alt_names&quot; arguments specify a list of DNS hostnames for the
+certificate.<br>
+<br>
+The &quot;expiration_date&quot; argument specifies the expiration date and time as a
+Unix <code>time_t</code> value in seconds.</p>
+<h3 class="function"><a id="cupsCreateCredentialsRequest">cupsCreateCredentialsRequest</a></h3>
+<p class="description">Make an X.509 Certificate Signing Request.</p>
+<p class="code">
+bool cupsCreateCredentialsRequest(const char *path, <a href="#cups_credpurpose_t">cups_credpurpose_t</a> purpose, <a href="#cups_credtype_t">cups_credtype_t</a> type, <a href="#cups_credusage_t">cups_credusage_t</a> usage, const char *organization, const char *org_unit, const char *locality, const char *state_province, const char *country, const char *common_name, size_t num_alt_names, const char *const *alt_names);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>path</th>
+<td class="description">Directory path for certificate/key store or <code>NULL</code> for default</td></tr>
+<tr><th>purpose</th>
+<td class="description">Credential purposes</td></tr>
+<tr><th>type</th>
+<td class="description">Credential type</td></tr>
+<tr><th>usage</th>
+<td class="description">Credential usages</td></tr>
+<tr><th>organization</th>
+<td class="description">Organization or <code>NULL</code> to use common name</td></tr>
+<tr><th>org_unit</th>
+<td class="description">Organizational unit or <code>NULL</code> for none</td></tr>
+<tr><th>locality</th>
+<td class="description">City/town or <code>NULL</code> for &quot;Unknown&quot;</td></tr>
+<tr><th>state_province</th>
+<td class="description">State/province or <code>NULL</code> for &quot;Unknown&quot;</td></tr>
+<tr><th>country</th>
+<td class="description">Country or <code>NULL</code> for locale-based default</td></tr>
+<tr><th>common_name</th>
+<td class="description">Common name</td></tr>
+<tr><th>num_alt_names</th>
+<td class="description">Number of subject alternate names</td></tr>
+<tr><th>alt_names</th>
+<td class="description">Subject Alternate Names</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description"><code>true</code> on success, <code>false</code> on error</p>
+<h4 class="discussion">Discussion</h4>
+<p class="discussion">This function creates an X.509 certificate signing request (CSR) and
+associated private key.  The CSR and key are stored in the directory &quot;path&quot;
+or, if &quot;path&quot; is <code>NULL</code>, in a per-user or system-wide (when running as root)
+certificate/key store.<br>
+<br>
+The &quot;purpose&quot; argument specifies the purpose(s) used for the credentials as a
+bitwise OR of the following constants:
+
+</p><ul>
+<li><code>CUPS_CREDPURPOSE_SERVER_AUTH</code> for validating TLS servers,
+</li>
+<li><code>CUPS_CREDPURPOSE_CLIENT_AUTH</code> for validating TLS clients,
+</li>
+<li><code>CUPS_CREDPURPOSE_CODE_SIGNING</code> for validating compiled code,
+</li>
+<li><code>CUPS_CREDPURPOSE_EMAIL_PROTECTION</code> for validating email messages,
+</li>
+<li><code>CUPS_CREDPURPOSE_TIME_STAMPING</code> for signing timestamps to objects, and/or
+</li>
+<li><code>CUPS_CREDPURPOSE_OCSP_SIGNING</code> for Online Certificate Status Protocol
+  message signing.</li>
+</ul>
+<p class="discussion">The &quot;type&quot; argument specifies the type of credentials using one of the
+following constants:
+
+</p><ul>
+<li><code>CUPS_CREDTYPE_DEFAULT</code>: default type (RSA-3072 or P-384),
+</li>
+<li><code>CUPS_CREDTYPE_RSA_2048_SHA256</code>: RSA with 2048-bit keys and SHA-256 hash,
+</li>
+<li><code>CUPS_CREDTYPE_RSA_3072_SHA256</code>: RSA with 3072-bit keys and SHA-256 hash,
+</li>
+<li><code>CUPS_CREDTYPE_RSA_4096_SHA256</code>: RSA with 4096-bit keys and SHA-256 hash,
+</li>
+<li><code>CUPS_CREDTYPE_ECDSA_P256_SHA256</code>: ECDSA using the P-256 curve with SHA-256 hash,
+</li>
+<li><code>CUPS_CREDTYPE_ECDSA_P384_SHA256</code>: ECDSA using the P-384 curve with SHA-256 hash, or
+</li>
+<li><code>CUPS_CREDTYPE_ECDSA_P521_SHA256</code>: ECDSA using the P-521 curve with SHA-256 hash.</li>
+</ul>
+<p class="discussion">The &quot;usage&quot; argument specifies the usage(s) for the credentials as a bitwise
+OR of the following constants:
+
+</p><ul>
+<li><code>CUPS_CREDUSAGE_DIGITAL_SIGNATURE</code>: digital signatures,
+</li>
+<li><code>CUPS_CREDUSAGE_NON_REPUDIATION</code>: non-repudiation/content commitment,
+</li>
+<li><code>CUPS_CREDUSAGE_KEY_ENCIPHERMENT</code>: key encipherment,
+</li>
+<li><code>CUPS_CREDUSAGE_DATA_ENCIPHERMENT</code>: data encipherment,
+</li>
+<li><code>CUPS_CREDUSAGE_KEY_AGREEMENT</code>: key agreement,
+</li>
+<li><code>CUPS_CREDUSAGE_KEY_CERT_SIGN</code>: key certicate signing,
+</li>
+<li><code>CUPS_CREDUSAGE_CRL_SIGN</code>: certificate revocation list signing,
+</li>
+<li><code>CUPS_CREDUSAGE_ENCIPHER_ONLY</code>: encipherment only,
+</li>
+<li><code>CUPS_CREDUSAGE_DECIPHER_ONLY</code>: decipherment only,
+</li>
+<li><code>CUPS_CREDUSAGE_DEFAULT_CA</code>: defaults for CA certificates,
+</li>
+<li><code>CUPS_CREDUSAGE_DEFAULT_TLS</code>: defaults for TLS certificates, and/or
+</li>
+<li><code>CUPS_CREDUSAGE_ALL</code>: all usages.</li>
+</ul>
+<p class="discussion">The &quot;organization&quot;, &quot;org_unit&quot;, &quot;locality&quot;, &quot;state_province&quot;, and &quot;country&quot;
+arguments specify information about the identity and geolocation of the
+issuer.<br>
+<br>
+The &quot;common_name&quot; argument specifies the common name and the &quot;num_alt_names&quot;
+and &quot;alt_names&quot; arguments specify a list of DNS hostnames for the
+certificate.</p>
 <h3 class="function"><a id="cupsCreateDestJob">cupsCreateDestJob</a></h3>
 <p class="description">Create a job on a destination.</p>
 <p class="code">
@@ -3757,9 +4075,11 @@ <h4 class="discussion">Discussion</h4>
 <h3 class="function"><a id="cupsFormEncode">cupsFormEncode</a></h3>
 <p class="description">Encode options as URL-encoded form data.</p>
 <p class="code">
-char *cupsFormEncode(size_t num_vars, <a href="#cups_option_t">cups_option_t</a> *vars);</p>
+char *cupsFormEncode(const char *url, size_t num_vars, <a href="#cups_option_t">cups_option_t</a> *vars);</p>
 <h4 class="parameters">Parameters</h4>
 <table class="list"><tbody>
+<tr><th>url</th>
+<td class="description">URL or <code>NULL</code> for none</td></tr>
 <tr><th>num_vars</th>
 <td class="description">Number of variables</td></tr>
 <tr><th>vars</th>
@@ -3768,8 +4088,8 @@ <h4 class="parameters">Parameters</h4>
 <h4 class="returnvalue">Return Value</h4>
 <p class="description">URL-encoded form data</p>
 <h4 class="discussion">Discussion</h4>
-<p class="discussion">This function encodes a CUPS options array as URL-encoded form data,
-returning an allocated string.<br>
+<p class="discussion">This function encodes a CUPS options array as URL-encoded form data with an
+optional URL prefix, returning an allocated string.<br>
 <br>
 Use <code>free</code> to return the memory used for the string.</p>
 <h3 class="function"><a id="cupsFreeDestInfo">cupsFreeDestInfo</a></h3>
@@ -4282,6 +4602,39 @@ <h3 class="function"><a id="cupsGetUserAgent">cupsGetUserAgent</a></h3>
 const char *cupsGetUserAgent(void);</p>
 <h4 class="returnvalue">Return Value</h4>
 <p class="description">User-Agent string</p>
+<h3 class="function"><a id="cupsHMACData">cupsHMACData</a></h3>
+<p class="description">Perform a HMAC function on the given data.</p>
+<p class="code">
+ssize_t cupsHMACData(const char *algorithm, const unsigned char *key, size_t keylen, const void *data, size_t datalen, unsigned char *hmac, size_t hmacsize);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>algorithm</th>
+<td class="description">Hash algorithm</td></tr>
+<tr><th>key</th>
+<td class="description">Key</td></tr>
+<tr><th>keylen</th>
+<td class="description">Length of key</td></tr>
+<tr><th>data</th>
+<td class="description">Data to hash</td></tr>
+<tr><th>datalen</th>
+<td class="description">Length of data to hash</td></tr>
+<tr><th>hmac</th>
+<td class="description">HMAC buffer</td></tr>
+<tr><th>hmacsize</th>
+<td class="description">Size of HMAC buffer</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">The length of the HMAC or <code>-1</code> on error</p>
+<h4 class="discussion">Discussion</h4>
+<p class="discussion">This function performs a HMAC function on the given data with the given key.
+The &quot;algorithm&quot; argument can be any of the registered, non-deprecated IPP
+hash algorithms for the &quot;job-password-encryption&quot; attribute, including
+&quot;sha&quot; for SHA-1, &quot;sha2-256&quot; for SHA2-256, etc.<br>
+<br>
+The &quot;hmac&quot; argument points to a buffer of &quot;hmacsize&quot; bytes and should be at
+least 64 bytes in length for all of the supported algorithms.<br>
+<br>
+The returned HMAC is binary data.</p>
 <h3 class="function"><a id="cupsHashData">cupsHashData</a></h3>
 <p class="description">Perform a hash function on the given data.</p>
 <p class="code">
@@ -4302,9 +4655,10 @@ <h4 class="parameters">Parameters</h4>
 <h4 class="returnvalue">Return Value</h4>
 <p class="description">Size of hash or -1 on error</p>
 <h4 class="discussion">Discussion</h4>
-<p class="discussion">The &quot;algorithm&quot; argument can be any of the registered, non-deprecated IPP
-hash algorithms for the &quot;job-password-encryption&quot; attribute, including
-&quot;sha&quot; for SHA-1, &quot;sha-256&quot; for SHA2-256, etc.<br>
+<p class="discussion">This function performs a hash function on the given data. The &quot;algorithm&quot;
+argument can be any of the registered, non-deprecated IPP hash algorithms for
+the &quot;job-password-encryption&quot; attribute, including &quot;sha&quot; for SHA-1,
+&quot;sha2-256&quot; for SHA2-256, etc.<br>
 <br>
 The &quot;hash&quot; argument points to a buffer of &quot;hashsize&quot; bytes and should be at
 least 64 bytes in length for all of the supported algorithms.<br>
@@ -4338,6 +4692,33 @@ <h4 class="parameters">Parameters</h4>
 <tr><th>json</th>
 <td class="description">JSON node</td></tr>
 </tbody></table>
+<h3 class="function"><a id="cupsJSONExportFile">cupsJSONExportFile</a></h3>
+<p class="description">Save a JSON node tree to a file.</p>
+<p class="code">
+bool cupsJSONExportFile(<a href="#cups_json_t">cups_json_t</a> *json, const char *filename);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>json</th>
+<td class="description">JSON root node</td></tr>
+<tr><th>filename</th>
+<td class="description">JSON filename</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description"><code>true</code> on success, <code>false</code> on failure</p>
+<h3 class="function"><a id="cupsJSONExportString">cupsJSONExportString</a></h3>
+<p class="description">Save a JSON node tree to a string.</p>
+<p class="code">
+char *cupsJSONExportString(<a href="#cups_json_t">cups_json_t</a> *json);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>json</th>
+<td class="description">JSON root node</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">JSON string or <code>NULL</code> on error</p>
+<h4 class="discussion">Discussion</h4>
+<p class="discussion">This function saves a JSON node tree to an allocated string.  The resulting
+string must be freed using the <code>free</code> function.</p>
 <h3 class="function"><a id="cupsJSONFind">cupsJSONFind</a></h3>
 <p class="description">Find the value(s) associated with a given key.</p>
 <p class="code">
@@ -4450,10 +4831,10 @@ <h4 class="parameters">Parameters</h4>
 </tbody></table>
 <h4 class="returnvalue">Return Value</h4>
 <p class="description">JSON node type</p>
-<h3 class="function"><a id="cupsJSONLoadFile">cupsJSONLoadFile</a></h3>
+<h3 class="function"><a id="cupsJSONImportFile">cupsJSONImportFile</a></h3>
 <p class="description">Load a JSON object file.</p>
 <p class="code">
-<a href="#cups_json_t">cups_json_t</a> *cupsJSONLoadFile(const char *filename);</p>
+<a href="#cups_json_t">cups_json_t</a> *cupsJSONImportFile(const char *filename);</p>
 <h4 class="parameters">Parameters</h4>
 <table class="list"><tbody>
 <tr><th>filename</th>
@@ -4461,10 +4842,10 @@ <h4 class="parameters">Parameters</h4>
 </tbody></table>
 <h4 class="returnvalue">Return Value</h4>
 <p class="description">Root JSON object node</p>
-<h3 class="function"><a id="cupsJSONLoadString">cupsJSONLoadString</a></h3>
+<h3 class="function"><a id="cupsJSONImportString">cupsJSONImportString</a></h3>
 <p class="description">Load a JSON object from a string.</p>
 <p class="code">
-<a href="#cups_json_t">cups_json_t</a> *cupsJSONLoadString(const char *s);</p>
+<a href="#cups_json_t">cups_json_t</a> *cupsJSONImportString(const char *s);</p>
 <h4 class="parameters">Parameters</h4>
 <table class="list"><tbody>
 <tr><th>s</th>
@@ -4472,6 +4853,32 @@ <h4 class="parameters">Parameters</h4>
 </tbody></table>
 <h4 class="returnvalue">Return Value</h4>
 <p class="description">Root JSON object node</p>
+<h3 class="function"><a id="cupsJSONImportURL">cupsJSONImportURL</a></h3>
+<p class="description">Load a JSON object from a URL.</p>
+<p class="code">
+<a href="#cups_json_t">cups_json_t</a> *cupsJSONImportURL(const char *url, time_t *last_modified);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>url</th>
+<td class="description">URL</td></tr>
+<tr><th>last_modified</th>
+<td class="description">Last modified date/time or <code>NULL</code></td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">Root JSON object node</p>
+<h4 class="discussion">Discussion</h4>
+<p class="discussion">This function loads a JSON object from a URL.  The &quot;url&quot; can be a &quot;http:&quot; or
+&quot;https:&quot; URL.  The &quot;last_modified&quot; argument provides a pointer to a <code>time_t</code>
+variable with the last modified date and time from a previous load.  If
+<code>NULL</code> or the variable has a value of 0, the JSON is loaded unconditionally
+from the URL.<br>
+<br>
+On success, a pointer to the root JSON object node is returned and the
+&quot;last_modified&quot; variable, if not <code>NULL</code>, is updated to the Last-Modified
+date and time returned by the server.  Otherwise, <code>NULL</code> is returned with
+the <a href="#cupsLastError"><code>cupsLastError</code></a> value set to <code>IPP_STATUS_OK_EVENTS_COMPLETE</code> if
+the JSON data has not been updated since the &quot;last_modified&quot; date and time
+or a suitable <code>IPP_STATUS_ERROR_</code> value if an error occurred.</p>
 <h3 class="function"><a id="cupsJSONNew">cupsJSONNew</a></h3>
 <p class="description">Create a new JSON node.</p>
 <p class="code">
@@ -4532,33 +4939,219 @@ <h4 class="parameters">Parameters</h4>
 </tbody></table>
 <h4 class="returnvalue">Return Value</h4>
 <p class="description">JSON node</p>
-<h3 class="function"><a id="cupsJSONSaveFile">cupsJSONSaveFile</a></h3>
-<p class="description">Save a JSON node tree to a file.</p>
+<h3 class="function"><a id="cupsJWTDelete">cupsJWTDelete</a></h3>
+<p class="description">Free the memory used for a JSON Web Token.</p>
 <p class="code">
-bool cupsJSONSaveFile(<a href="#cups_json_t">cups_json_t</a> *json, const char *filename);</p>
+void cupsJWTDelete(<a href="#cups_jwt_t">cups_jwt_t</a> *jwt);</p>
 <h4 class="parameters">Parameters</h4>
 <table class="list"><tbody>
-<tr><th>json</th>
-<td class="description">JSON root node</td></tr>
-<tr><th>filename</th>
-<td class="description">JSON filename</td></tr>
+<tr><th>jwt</th>
+<td class="description">JWT object</td></tr>
+</tbody></table>
+<h3 class="function"><a id="cupsJWTExportString">cupsJWTExportString</a></h3>
+<p class="description">Export a JWT with the JWS Compact Serialization format.</p>
+<p class="code">
+char *cupsJWTExportString(<a href="#cups_jwt_t">cups_jwt_t</a> *jwt);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>jwt</th>
+<td class="description">JWT object</td></tr>
 </tbody></table>
 <h4 class="returnvalue">Return Value</h4>
-<p class="description"><code>true</code> on success, <code>false</code> on failure</p>
-<h3 class="function"><a id="cupsJSONSaveString">cupsJSONSaveString</a></h3>
-<p class="description">Save a JSON node tree to a string.</p>
+<p class="description">JWT/JWS Compact Serialization string</p>
+<h3 class="function"><a id="cupsJWTGetAlgorithm">cupsJWTGetAlgorithm</a></h3>
+<p class="description">Get the signature algorithm used by a JSON Web Token.</p>
 <p class="code">
-char *cupsJSONSaveString(<a href="#cups_json_t">cups_json_t</a> *json);</p>
+<a href="#cups_jwa_t">cups_jwa_t</a> cupsJWTGetAlgorithm(<a href="#cups_jwt_t">cups_jwt_t</a> *jwt);</p>
 <h4 class="parameters">Parameters</h4>
 <table class="list"><tbody>
-<tr><th>json</th>
-<td class="description">JSON root node</td></tr>
+<tr><th>jwt</th>
+<td class="description">JWT object</td></tr>
 </tbody></table>
 <h4 class="returnvalue">Return Value</h4>
-<p class="description">JSON string or <code>NULL</code> on error</p>
+<p class="description">Signature algorithm</p>
+<h3 class="function"><a id="cupsJWTGetClaimNumber">cupsJWTGetClaimNumber</a></h3>
+<p class="description">Get the number value of a claim.</p>
+<p class="code">
+double cupsJWTGetClaimNumber(<a href="#cups_jwt_t">cups_jwt_t</a> *jwt, const char *claim);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>jwt</th>
+<td class="description">JWT object</td></tr>
+<tr><th>claim</th>
+<td class="description">Claim name</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">Number value</p>
+<h3 class="function"><a id="cupsJWTGetClaimString">cupsJWTGetClaimString</a></h3>
+<p class="description">Get the string value of a claim.</p>
+<p class="code">
+const char *cupsJWTGetClaimString(<a href="#cups_jwt_t">cups_jwt_t</a> *jwt, const char *claim);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>jwt</th>
+<td class="description">JWT object</td></tr>
+<tr><th>claim</th>
+<td class="description">Claim name</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">String value</p>
+<h3 class="function"><a id="cupsJWTGetClaimType">cupsJWTGetClaimType</a></h3>
+<p class="description">Get the value type of a claim.</p>
+<p class="code">
+<a href="#cups_jtype_t">cups_jtype_t</a> cupsJWTGetClaimType(<a href="#cups_jwt_t">cups_jwt_t</a> *jwt, const char *claim);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>jwt</th>
+<td class="description">JWT object</td></tr>
+<tr><th>claim</th>
+<td class="description">Claim name</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">JSON value type</p>
+<h3 class="function"><a id="cupsJWTGetClaimValue">cupsJWTGetClaimValue</a></h3>
+<p class="description">Get the value node of a claim.</p>
+<p class="code">
+<a href="#cups_json_t">cups_json_t</a> *cupsJWTGetClaimValue(<a href="#cups_jwt_t">cups_jwt_t</a> *jwt, const char *claim);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>jwt</th>
+<td class="description">JWT object</td></tr>
+<tr><th>claim</th>
+<td class="description">Claim name</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">JSON value node</p>
+<h3 class="function"><a id="cupsJWTGetClaims">cupsJWTGetClaims</a></h3>
+<p class="description">Get the JWT claims as a JSON object.</p>
+<p class="code">
+<a href="#cups_json_t">cups_json_t</a> *cupsJWTGetClaims(<a href="#cups_jwt_t">cups_jwt_t</a> *jwt);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>jwt</th>
+<td class="description">JWT object</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">JSON object</p>
+<h3 class="function"><a id="cupsJWTHasValidSignature">cupsJWTHasValidSignature</a></h3>
+<p class="description">Determine whether the JWT has a valid signature.</p>
+<p class="code">
+bool cupsJWTHasValidSignature(<a href="#cups_jwt_t">cups_jwt_t</a> *jwt, <a href="#cups_json_t">cups_json_t</a> *jwk);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>jwt</th>
+<td class="description">JWT object</td></tr>
+<tr><th>jwk</th>
+<td class="description">JWK key set</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description"><code>true</code> if value, <code>false</code> otherwise</p>
+<h3 class="function"><a id="cupsJWTImportString">cupsJWTImportString</a></h3>
+<p class="description">Import a JSON Web Token or JSON Web Signature.</p>
+<p class="code">
+<a href="#cups_jwt_t">cups_jwt_t</a> *cupsJWTImportString(const char *token);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>token</th>
+<td class="description">JWS Compact Serialization string</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">JWT object</p>
+<h3 class="function"><a id="cupsJWTMakePrivateKey">cupsJWTMakePrivateKey</a></h3>
+<p class="description">Make a JSON Web Key for encryption and signing.</p>
+<p class="code">
+<a href="#cups_json_t">cups_json_t</a> *cupsJWTMakePrivateKey(<a href="#cups_jwa_t">cups_jwa_t</a> alg);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>alg</th>
+<td class="description">Signing/encryption algorithm</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">Private JSON Web Key or <code>NULL</code> on error</p>
 <h4 class="discussion">Discussion</h4>
-<p class="discussion">This function saves a JSON node tree to an allocated string.  The resulting
-string must be freed using the <code>free</code> function.</p>
+<p class="discussion">This function makes a JSON Web Key (JWK) for the specified JWS/JWE algorithm
+for use when signing or encrypting JSON Web Tokens.  The resulting JWK
+<em>must not</em> be provided to clients - instead, call <a href="#cupsJWTMakePublicKey"><code>cupsJWTMakePublicKey</code></a>
+to produce a public key subset suitable for verification and decryption.</p>
+<h3 class="function"><a id="cupsJWTMakePublicKey">cupsJWTMakePublicKey</a></h3>
+<p class="description">Make a JSON Web Key for decryption and verification.</p>
+<p class="code">
+<a href="#cups_json_t">cups_json_t</a> *cupsJWTMakePublicKey(<a href="#cups_json_t">cups_json_t</a> *jwk);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>jwk</th>
+<td class="description">Private JSON Web Key</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">Public JSON Web Key or <code>NULL</code> on error</p>
+<h4 class="discussion">Discussion</h4>
+<p class="discussion">This function makes a public JSON Web Key (JWK) from the specified private
+JWK suitable for use when decrypting or verifying a JWE/JWS message.</p>
+<h3 class="function"><a id="cupsJWTNew">cupsJWTNew</a></h3>
+<p class="description">Create a new, empty JSON Web Token.</p>
+<p class="code">
+<a href="#cups_jwt_t">cups_jwt_t</a> *cupsJWTNew(const char *type);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>type</th>
+<td class="description">JWT type or <code>NULL</code> for default (&quot;JWT&quot;)</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">JWT object</p>
+<h3 class="function"><a id="cupsJWTSetClaimNumber">cupsJWTSetClaimNumber</a></h3>
+<p class="description">Set a claim number.</p>
+<p class="code">
+void cupsJWTSetClaimNumber(<a href="#cups_jwt_t">cups_jwt_t</a> *jwt, const char *claim, double value);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>jwt</th>
+<td class="description">JWT object</td></tr>
+<tr><th>claim</th>
+<td class="description">Claim name</td></tr>
+<tr><th>value</th>
+<td class="description">Number value</td></tr>
+</tbody></table>
+<h3 class="function"><a id="cupsJWTSetClaimString">cupsJWTSetClaimString</a></h3>
+<p class="description">Set a claim string.</p>
+<p class="code">
+void cupsJWTSetClaimString(<a href="#cups_jwt_t">cups_jwt_t</a> *jwt, const char *claim, const char *value);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>jwt</th>
+<td class="description">JWT object</td></tr>
+<tr><th>claim</th>
+<td class="description">Claim name</td></tr>
+<tr><th>value</th>
+<td class="description">String value</td></tr>
+</tbody></table>
+<h3 class="function"><a id="cupsJWTSetClaimValue">cupsJWTSetClaimValue</a></h3>
+<p class="description">Set a claim value.</p>
+<p class="code">
+void cupsJWTSetClaimValue(<a href="#cups_jwt_t">cups_jwt_t</a> *jwt, const char *claim, <a href="#cups_json_t">cups_json_t</a> *value);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>jwt</th>
+<td class="description">JWT object</td></tr>
+<tr><th>claim</th>
+<td class="description">Claim name</td></tr>
+<tr><th>value</th>
+<td class="description">JSON value node</td></tr>
+</tbody></table>
+<h3 class="function"><a id="cupsJWTSign">cupsJWTSign</a></h3>
+<p class="description">Sign a JSON Web Token, creating a JSON Web Signature.</p>
+<p class="code">
+bool cupsJWTSign(<a href="#cups_jwt_t">cups_jwt_t</a> *jwt, <a href="#cups_jwa_t">cups_jwa_t</a> alg, <a href="#cups_json_t">cups_json_t</a> *jwk);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>jwt</th>
+<td class="description">JWT object</td></tr>
+<tr><th>alg</th>
+<td class="description">Signing algorithm</td></tr>
+<tr><th>jwk</th>
+<td class="description">JWK key set</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description"><code>true</code> on success, <code>false</code> on error</p>
 <h3 class="function"><a id="cupsLangAddStrings">cupsLangAddStrings</a></h3>
 <p class="description">Add strings for the specified language.</p>
 <p class="code">
@@ -5413,6 +6006,24 @@ <h4 class="discussion">Discussion</h4>
 Note: The current credentials callback is tracked separately for each thread
 in a program. Multi-threaded programs that override the callback need to do
 so in each thread for the same callback to be used.</p>
+<h3 class="function"><a id="cupsSetServerCredentials">cupsSetServerCredentials</a></h3>
+<p class="description">Set the default server credentials.</p>
+<p class="code">
+bool cupsSetServerCredentials(const char *path, const char *common_name, bool auto_create);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>path</th>
+<td class="description">Directory path for certificate/key store or <code>NULL</code> for default</td></tr>
+<tr><th>common_name</th>
+<td class="description">Default common name for server</td></tr>
+<tr><th>auto_create</th>
+<td class="description"><code>true</code> = automatically create self-signed certificates</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description"><code>true</code> on success, <code>false</code> on failure</p>
+<h4 class="discussion">Discussion</h4>
+<p class="discussion">Note: The server credentials are used by all threads in the running process.
+This function is threadsafe.</p>
 <h3 class="function"><a id="cupsSetUser">cupsSetUser</a></h3>
 <p class="description">Set the default user name.</p>
 <p class="code">
@@ -5440,6 +6051,101 @@ <h4 class="parameters">Parameters</h4>
 <h4 class="discussion">Discussion</h4>
 <p class="discussion">Setting the string to NULL forces the default value containing the CUPS
 version, IPP version, and operating system version and architecture.</p>
+<h3 class="function"><a id="cupsSignCredentialsRequest">cupsSignCredentialsRequest</a></h3>
+<p class="description">Sign an X.509 certificate signing request to produce an X.509 certificate chain.</p>
+<p class="code">
+bool cupsSignCredentialsRequest(const char *path, const char *common_name, const char *request, const char *root_name, <a href="#cups_credpurpose_t">cups_credpurpose_t</a> allowed_purpose, <a href="#cups_credusage_t">cups_credusage_t</a> allowed_usage, <a href="#cups_cert_san_cb_t">cups_cert_san_cb_t</a> cb, void *cb_data, time_t expiration_date);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>path</th>
+<td class="description">Directory path for certificate/key store or <code>NULL</code> for default</td></tr>
+<tr><th>common_name</th>
+<td class="description">Common name to use</td></tr>
+<tr><th>request</th>
+<td class="description">PEM-encoded CSR</td></tr>
+<tr><th>root_name</th>
+<td class="description">Root certificate</td></tr>
+<tr><th>allowed_purpose</th>
+<td class="description">Allowed credential purpose(s)</td></tr>
+<tr><th>allowed_usage</th>
+<td class="description">Allowed credential usage(s)</td></tr>
+<tr><th>cb</th>
+<td class="description">subjectAltName callback or <code>NULL</code> to allow just .local</td></tr>
+<tr><th>cb_data</th>
+<td class="description">Callback data</td></tr>
+<tr><th>expiration_date</th>
+<td class="description">Certificate expiration date</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description"><code>true</code> on success, <code>false</code> on failure</p>
+<h4 class="discussion">Discussion</h4>
+<p class="discussion">This function creates an X.509 certificate from a signing request.  The
+certificate is stored in the directory &quot;path&quot; or, if &quot;path&quot; is <code>NULL</code>, in a
+per-user or system-wide (when running as root) certificate/key store.  The
+generated certificate is signed by the named root certificate or, if
+&quot;root_name&quot; is <code>NULL</code>, a site-wide default root certificate.  When
+&quot;root_name&quot; is <code>NULL</code> and there is no site-wide default root certificate, a
+self-signed certificate is generated instead.<br>
+<br>
+The &quot;allowed_purpose&quot; argument specifies the allowed purpose(s) used for the
+credentials as a bitwise OR of the following constants:
+
+</p><ul>
+<li><code>CUPS_CREDPURPOSE_SERVER_AUTH</code> for validating TLS servers,
+</li>
+<li><code>CUPS_CREDPURPOSE_CLIENT_AUTH</code> for validating TLS clients,
+</li>
+<li><code>CUPS_CREDPURPOSE_CODE_SIGNING</code> for validating compiled code,
+</li>
+<li><code>CUPS_CREDPURPOSE_EMAIL_PROTECTION</code> for validating email messages,
+</li>
+<li><code>CUPS_CREDPURPOSE_TIME_STAMPING</code> for signing timestamps to objects, and/or
+</li>
+<li><code>CUPS_CREDPURPOSE_OCSP_SIGNING</code> for Online Certificate Status Protocol
+  message signing.</li>
+</ul>
+<p class="discussion">The &quot;allowed_usage&quot; argument specifies the allowed usage(s) for the
+credentials as a bitwise OR of the following constants:
+
+</p><ul>
+<li><code>CUPS_CREDUSAGE_DIGITAL_SIGNATURE</code>: digital signatures,
+</li>
+<li><code>CUPS_CREDUSAGE_NON_REPUDIATION</code>: non-repudiation/content commitment,
+</li>
+<li><code>CUPS_CREDUSAGE_KEY_ENCIPHERMENT</code>: key encipherment,
+</li>
+<li><code>CUPS_CREDUSAGE_DATA_ENCIPHERMENT</code>: data encipherment,
+</li>
+<li><code>CUPS_CREDUSAGE_KEY_AGREEMENT</code>: key agreement,
+</li>
+<li><code>CUPS_CREDUSAGE_KEY_CERT_SIGN</code>: key certicate signing,
+</li>
+<li><code>CUPS_CREDUSAGE_CRL_SIGN</code>: certificate revocation list signing,
+</li>
+<li><code>CUPS_CREDUSAGE_ENCIPHER_ONLY</code>: encipherment only,
+</li>
+<li><code>CUPS_CREDUSAGE_DECIPHER_ONLY</code>: decipherment only,
+</li>
+<li><code>CUPS_CREDUSAGE_DEFAULT_CA</code>: defaults for CA certificates,
+</li>
+<li><code>CUPS_CREDUSAGE_DEFAULT_TLS</code>: defaults for TLS certificates, and/or
+</li>
+<li><code>CUPS_CREDUSAGE_ALL</code>: all usages.</li>
+</ul>
+<p class="discussion">The &quot;cb&quot; and &quot;cb_data&quot; arguments specify a function and its data that are
+used to validate any subjectAltName values in the signing request:
+
+<pre>
+bool san_cb(const char *common_name, const char *alt_name, void *cb_data) {
+  ... return true if OK and false if not ...
+}
+</pre>
+
+If <code>NULL</code>, a default validation function is used that allows &quot;localhost&quot; and
+variations of the common name.<br>
+<br>
+The &quot;expiration_date&quot; argument specifies the expiration date and time as a
+Unix <code>time_t</code> value in seconds.</p>
 <h3 class="function"><a id="cupsStartDestDocument">cupsStartDestDocument</a></h3>
 <p class="description">Start a new document.</p>
 <p class="code">
@@ -6023,6 +6729,20 @@ <h4 class="parameters">Parameters</h4>
 </tbody></table>
 <h4 class="returnvalue">Return Value</h4>
 <p class="description">New HTTP connection</p>
+<h3 class="function"><a id="httpCopyCredentials">httpCopyCredentials</a></h3>
+<p class="description">Copy the credentials associated with the peer in
+                          an encrypted connection.</p>
+<p class="code">
+bool httpCopyCredentials(<a href="#http_t">http_t</a> *http, <a href="#cups_array_t">cups_array_t</a> **credentials);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>http</th>
+<td class="description">Connection to server</td></tr>
+<tr><th>credentials</th>
+<td class="description">Array of credentials</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">Status of call (<code>true</code> = success)</p>
 <h3 class="function"><a id="httpCreateCredentials">httpCreateCredentials</a></h3>
 <p class="description">Create a new array of HTTP credentials.</p>
 <p class="code">
@@ -6039,6 +6759,59 @@ <h4 class="returnvalue">Return Value</h4>
 <h4 class="discussion">Discussion</h4>
 <p class="discussion">This function creates a new array of HTTP credentials for use with the
 <a href="#httpAddCredentials"><code>httpAddCredentials</code></a> and <a href="#httpSetCredentials"><code>httpSetCredentials</code></a> functions.</p>
+<h3 class="function"><a id="httpCredentialsAreValidForName">httpCredentialsAreValidForName</a></h3>
+<p class="description">Return whether the credentials are valid
+                                     for the given name.</p>
+<p class="code">
+bool httpCredentialsAreValidForName(<a href="#cups_array_t">cups_array_t</a> *credentials, const char *common_name);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>credentials</th>
+<td class="description">Credentials</td></tr>
+<tr><th>common_name</th>
+<td class="description">Name to check</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description"><code>true</code> if valid, <code>false</code> otherwise</p>
+<h3 class="function"><a id="httpCredentialsGetExpiration">httpCredentialsGetExpiration</a></h3>
+<p class="description">Return the expiration date of the credentials.</p>
+<p class="code">
+time_t httpCredentialsGetExpiration(<a href="#cups_array_t">cups_array_t</a> *credentials);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>credentials</th>
+<td class="description">Credentials</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">Expiration date of credentials</p>
+<h3 class="function"><a id="httpCredentialsGetTrust">httpCredentialsGetTrust</a></h3>
+<p class="description">Return the trust of credentials.</p>
+<p class="code">
+<a href="#http_trust_t">http_trust_t</a> httpCredentialsGetTrust(<a href="#cups_array_t">cups_array_t</a> *credentials, const char *common_name);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>credentials</th>
+<td class="description">Credentials</td></tr>
+<tr><th>common_name</th>
+<td class="description">Common name for trust lookup</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">Level of trust</p>
+<h3 class="function"><a id="httpCredentialsString">httpCredentialsString</a></h3>
+<p class="description">Return a string representing the credentials.</p>
+<p class="code">
+size_t httpCredentialsString(<a href="#cups_array_t">cups_array_t</a> *credentials, char *buffer, size_t bufsize);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>credentials</th>
+<td class="description">Credentials</td></tr>
+<tr><th>buffer</th>
+<td class="description">Buffer</td></tr>
+<tr><th>bufsize</th>
+<td class="description">Size of buffer</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description">Total size of credentials string</p>
 <h3 class="function"><a id="httpDecode64">httpDecode64</a></h3>
 <p class="description">Base64-decode a string.</p>
 <p class="code">
@@ -6493,6 +7266,21 @@ <h4 class="returnvalue">Return Value</h4>
 <p class="description"><code>true</code> if encrypted, <code>false</code> if not</p>
 <h4 class="discussion">Discussion</h4>
 <p class="discussion">This function returns <code>true</code> if the connection is currently encrypted.</p>
+<h3 class="function"><a id="httpLoadCredentials">httpLoadCredentials</a></h3>
+<p class="description">Load X.509 credentials from a keychain file.</p>
+<p class="code">
+bool httpLoadCredentials(const char *path, <a href="#cups_array_t">cups_array_t</a> **credentials, const char *common_name);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>path</th>
+<td class="description">Keychain/PKCS#12 path</td></tr>
+<tr><th>credentials</th>
+<td class="description">Credentials</td></tr>
+<tr><th>common_name</th>
+<td class="description">Common name for credentials</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description"><code>true</code> on success, <code>false</code> on error</p>
 <h3 class="function"><a id="httpPeek">httpPeek</a></h3>
 <p class="description">Peek at data from a HTTP connection.</p>
 <p class="code">
@@ -6613,6 +7401,21 @@ <h4 class="discussion">Discussion</h4>
 <code>bool</code> value that is <code>true</code> to continue and <code>false</code> to stop.  If no callback
 is specified (&quot;cb&quot; is <code>NULL</code>), then this function will block up to 90 seconds
 to resolve the specified URI.</p>
+<h3 class="function"><a id="httpSaveCredentials">httpSaveCredentials</a></h3>
+<p class="description">Save X.509 credentials to a keychain file.</p>
+<p class="code">
+bool httpSaveCredentials(const char *path, <a href="#cups_array_t">cups_array_t</a> *credentials, const char *common_name);</p>
+<h4 class="parameters">Parameters</h4>
+<table class="list"><tbody>
+<tr><th>path</th>
+<td class="description">Keychain/PKCS#12 path</td></tr>
+<tr><th>credentials</th>
+<td class="description">Credentials</td></tr>
+<tr><th>common_name</th>
+<td class="description">Common name for credentials</td></tr>
+</tbody></table>
+<h4 class="returnvalue">Return Value</h4>
+<p class="description"><code>true</code> on success, <code>false</code> on error</p>
 <h3 class="function"><a id="httpSeparateURI">httpSeparateURI</a></h3>
 <p class="description">Separate a Universal Resource Identifier into its
                       components.</p>
@@ -9304,6 +10107,11 @@ <h3 class="typedef"><a id="cups_bool_t">cups_bool_t</a></h3>
 <p class="code">
 typedef enum <a href="#cups_bool_e">cups_bool_e</a> cups_bool_t;
 </p>
+<h3 class="typedef"><a id="cups_cert_san_cb_t">cups_cert_san_cb_t</a></h3>
+<p class="description">Certificate signing subjectAltName callback</p>
+<p class="code">
+typedef bool(*)(const char *common_name, const char *subject_alt_name, void *user_data)cups_cert_san_cb_t;
+</p>
 <h3 class="typedef"><a id="cups_client_cert_cb_t">cups_client_cert_cb_t</a></h3>
 <p class="description">Client credentials callback</p>
 <p class="code">
@@ -9314,6 +10122,21 @@ <h3 class="typedef"><a id="cups_cond_t">cups_cond_t</a></h3>
 <p class="code">
 typedef pthread_cond_t cups_cond_t;
 </p>
+<h3 class="typedef"><a id="cups_credpurpose_t">cups_credpurpose_t</a></h3>
+<p class="description">Combined X.509 credential purposes for <a href="#cupsCreateCredentials"><code>cupsCreateCredentials</code></a> and <a href="#cupsCreateCredentialsRequest"><code>cupsCreateCredentialsRequest</code></a></p>
+<p class="code">
+typedef unsigned cups_credpurpose_t;
+</p>
+<h3 class="typedef"><a id="cups_credtype_t">cups_credtype_t</a></h3>
+<p class="description">X.509 credential types for <a href="#cupsCreateCredentials"><code>cupsCreateCredentials</code></a> and <a href="#cupsCreateCredentialsRequest"><code>cupsCreateCredentialsRequest</code></a></p>
+<p class="code">
+typedef enum <a href="#cups_credtype_e">cups_credtype_e</a> cups_credtype_t;
+</p>
+<h3 class="typedef"><a id="cups_credusage_t">cups_credusage_t</a></h3>
+<p class="description">Combined X.509 keyUsage flags for <a href="#cupsCreateCredentials"><code>cupsCreateCredentials</code></a> and <a href="#cupsCreateCredentialsRequest"><code>cupsCreateCredentialsRequest</code></a></p>
+<p class="code">
+typedef unsigned cups_credusage_t;
+</p>
 <h3 class="typedef"><a id="cups_cspace_t">cups_cspace_t</a></h3>
 <p class="description">cupsColorSpace attribute values</p>
 <p class="code">
@@ -9332,7 +10155,12 @@ <h3 class="typedef"><a id="cups_dentry_t">cups_dentry_t</a></h3>
 <h3 class="typedef"><a id="cups_dest_cb_t">cups_dest_cb_t</a></h3>
 <p class="description">Destination enumeration callback</p>
 <p class="code">
-typedef bool(*)(void *user_data, unsigned flags, <a href="#cups_dest_t">cups_dest_t</a> *dest)cups_dest_cb_t;
+typedef bool(*)(void *user_data, <a href="#cups_dest_flags_t">cups_dest_flags_t</a> flags, <a href="#cups_dest_t">cups_dest_t</a> *dest)cups_dest_cb_t;
+</p>
+<h3 class="typedef"><a id="cups_dest_flags_t">cups_dest_flags_t</a></h3>
+<p class="description">Combined flags for <a href="#cupsConnectDest"><code>cupsConnectDest</code></a> and <a href="#cupsEnumDests"><code>cupsEnumDests</code></a></p>
+<p class="code">
+typedef unsigned cups_dest_flags_t;
 </p>
 <h3 class="typedef"><a id="cups_dest_t">cups_dest_t</a></h3>
 <p class="description">Destination</p>
@@ -9439,11 +10267,26 @@ <h3 class="typedef"><a id="cups_jtype_t">cups_jtype_t</a></h3>
 <p class="code">
 typedef enum <a href="#cups_jtype_e">cups_jtype_e</a> cups_jtype_t;
 </p>
+<h3 class="typedef"><a id="cups_jwa_t">cups_jwa_t</a></h3>
+<p class="description">JSON Web Algorithms</p>
+<p class="code">
+typedef enum <a href="#cups_jwa_e">cups_jwa_e</a> cups_jwa_t;
+</p>
+<h3 class="typedef"><a id="cups_jwt_t">cups_jwt_t</a></h3>
+<p class="description">JSON Web Token</p>
+<p class="code">
+typedef struct _cups_jwt_s cups_jwt_t;
+</p>
 <h3 class="typedef"><a id="cups_lang_t">cups_lang_t</a></h3>
 <p class="description">Language Cache</p>
 <p class="code">
 typedef struct _cups_lang_s cups_lang_t;
 </p>
+<h3 class="typedef"><a id="cups_media_flags_t">cups_media_flags_t</a></h3>
+<p class="description">Combined flags for <a href="#cupsGetDestMediaByName"><code>cupsGetDestMediaByName</code></a> and <a href="#cupsGetDestMediaBySize"><code>cupsGetDestMediaBySize</code></a></p>
+<p class="code">
+typedef unsigned cups_media_flags_t;
+</p>
 <h3 class="typedef"><a id="cups_mediapos_t">cups_mediapos_t</a></h3>
 <p class="description">MediaPosition values</p>
 <p class="code">
@@ -9485,7 +10328,7 @@ <h3 class="typedef"><a id="cups_password_cb_t">cups_password_cb_t</a></h3>
 typedef const char *(*)(const char *prompt, <a href="#http_t">http_t</a> *http, const char *method, const char *resource, void *user_data)cups_password_cb_t;
 </p>
 <h3 class="typedef"><a id="cups_ptype_t">cups_ptype_t</a></h3>
-<p class="description">Printer type/capability bits</p>
+<p class="description">Combined printer type/capability flags</p>
 <p class="code">
 typedef unsigned cups_ptype_t;
 </p>
@@ -9510,7 +10353,7 @@ <h3 class="typedef"><a id="cups_server_cert_cb_t">cups_server_cert_cb_t</a></h3>
 typedef bool(*)(http_t *http, void *tls, <a href="#cups_array_t">cups_array_t</a> *certs, void *user_data)cups_server_cert_cb_t;
 </p>
 <h3 class="typedef"><a id="cups_size_t">cups_size_t</a></h3>
-<p class="description">// Media Size</p>
+<p class="description">Media information</p>
 <p class="code">
 typedef struct <a href="#cups_size_s">cups_size_s</a> cups_size_t;
 </p>
@@ -9953,7 +10796,7 @@ <h4 class="members">Members</h4>
 <td class="description">Width of page image in pixels</td></tr>
 </tbody></table>
 <h3 class="struct"><a id="cups_size_s">cups_size_s</a></h3>
-<p class="description">// Media Size</p>
+<p class="description">Media information</p>
 <p class="code">struct cups_size_s {<br>
 &#160;&#160;&#160;&#160;int width, length, bottom, left, right, top;<br>
 &#160;&#160;&#160;&#160;char media[128], color[128], source[128], type[128];<br>
@@ -10009,6 +10852,47 @@ <h4 class="constants">Constants</h4>
 <tr><th>CUPS_FALSE </th><td class="description">Logical false</td></tr>
 <tr><th>CUPS_TRUE </th><td class="description">Logical true</td></tr>
 </tbody></table>
+<h3 class="enumeration"><a id="cups_credpurpose_e">cups_credpurpose_e</a></h3>
+<p class="description">X.509 credential purposes</p>
+<h4 class="constants">Constants</h4>
+<table class="list"><tbody>
+<tr><th>CUPS_CREDPURPOSE_ALL </th><td class="description">All purposes</td></tr>
+<tr><th>CUPS_CREDPURPOSE_CLIENT_AUTH </th><td class="description">clientAuth</td></tr>
+<tr><th>CUPS_CREDPURPOSE_CODE_SIGNING </th><td class="description">codeSigning</td></tr>
+<tr><th>CUPS_CREDPURPOSE_EMAIL_PROTECTION </th><td class="description">emailProtection</td></tr>
+<tr><th>CUPS_CREDPURPOSE_OCSP_SIGNING </th><td class="description">OCSPSigning</td></tr>
+<tr><th>CUPS_CREDPURPOSE_SERVER_AUTH </th><td class="description">serverAuth</td></tr>
+<tr><th>CUPS_CREDPURPOSE_TIME_STAMPING </th><td class="description">timeStamping</td></tr>
+</tbody></table>
+<h3 class="enumeration"><a id="cups_credtype_e">cups_credtype_e</a></h3>
+<p class="description">X.509 credential types for <a href="#cupsCreateCredentials"><code>cupsCreateCredentials</code></a> and <a href="#cupsCreateCredentialsRequest"><code>cupsCreateCredentialsRequest</code></a></p>
+<h4 class="constants">Constants</h4>
+<table class="list"><tbody>
+<tr><th>CUPS_CREDTYPE_DEFAULT </th><td class="description">Default type</td></tr>
+<tr><th>CUPS_CREDTYPE_ECDSA_P256_SHA256 </th><td class="description">ECDSA using the P-256 curve with SHA-256 hash</td></tr>
+<tr><th>CUPS_CREDTYPE_ECDSA_P384_SHA256 </th><td class="description">ECDSA using the P-384 curve with SHA-256 hash</td></tr>
+<tr><th>CUPS_CREDTYPE_ECDSA_P521_SHA256 </th><td class="description">ECDSA using the P-521 curve with SHA-256 hash</td></tr>
+<tr><th>CUPS_CREDTYPE_RSA_2048_SHA256 </th><td class="description">RSA with 2048-bit keys and SHA-256 hash</td></tr>
+<tr><th>CUPS_CREDTYPE_RSA_3072_SHA256 </th><td class="description">RSA with 3072-bit keys and SHA-256 hash</td></tr>
+<tr><th>CUPS_CREDTYPE_RSA_4096_SHA256 </th><td class="description">RSA with 4096-bit keys and SHA-256 hash</td></tr>
+</tbody></table>
+<h3 class="enumeration"><a id="cups_credusage_e">cups_credusage_e</a></h3>
+<p class="description">X.509 keyUsage flags</p>
+<h4 class="constants">Constants</h4>
+<table class="list"><tbody>
+<tr><th>CUPS_CREDUSAGE_ALL </th><td class="description">All keyUsage flags</td></tr>
+<tr><th>CUPS_CREDUSAGE_CRL_SIGN </th><td class="description">cRLSign</td></tr>
+<tr><th>CUPS_CREDUSAGE_DATA_ENCIPHERMENT </th><td class="description">dataEncipherment</td></tr>
+<tr><th>CUPS_CREDUSAGE_DECIPHER_ONLY </th><td class="description">decipherOnly</td></tr>
+<tr><th>CUPS_CREDUSAGE_DEFAULT_CA </th><td class="description">Defaults for CA certs</td></tr>
+<tr><th>CUPS_CREDUSAGE_DEFAULT_TLS </th><td class="description">Defaults for TLS certs</td></tr>
+<tr><th>CUPS_CREDUSAGE_DIGITAL_SIGNATURE </th><td class="description">digitalSignature</td></tr>
+<tr><th>CUPS_CREDUSAGE_ENCIPHER_ONLY </th><td class="description">encipherOnly</td></tr>
+<tr><th>CUPS_CREDUSAGE_KEY_AGREEMENT </th><td class="description">keyAgreement</td></tr>
+<tr><th>CUPS_CREDUSAGE_KEY_CERT_SIGN </th><td class="description">keyCertSign</td></tr>
+<tr><th>CUPS_CREDUSAGE_KEY_ENCIPHERMENT </th><td class="description">keyEncipherment</td></tr>
+<tr><th>CUPS_CREDUSAGE_NON_REPUDIATION </th><td class="description">nonRepudiation/contentCommitment</td></tr>
+</tbody></table>
 <h3 class="enumeration"><a id="cups_cspace_e">cups_cspace_e</a></h3>
 <p class="description">cupsColorSpace attribute values</p>
 <h4 class="constants">Constants</h4>
@@ -10075,6 +10959,20 @@ <h4 class="constants">Constants</h4>
 <tr><th>CUPS_CUT_PAGE </th><td class="description">Cut the roll after this page</td></tr>
 <tr><th>CUPS_CUT_SET </th><td class="description">Cut the roll after this set</td></tr>
 </tbody></table>
+<h3 class="enumeration"><a id="cups_dest_flags_e">cups_dest_flags_e</a></h3>
+<p class="description">Flags for <a href="#cupsConnectDest"><code>cupsConnectDest</code></a> and <a href="#cupsEnumDests"><code>cupsEnumDests</code></a></p>
+<h4 class="constants">Constants</h4>
+<table class="list"><tbody>
+<tr><th>CUPS_DEST_FLAGS_CANCELED </th><td class="description">Operation was canceled</td></tr>
+<tr><th>CUPS_DEST_FLAGS_CONNECTING </th><td class="description">A connection is being established</td></tr>
+<tr><th>CUPS_DEST_FLAGS_DEVICE </th><td class="description">For <a href="#cupsConnectDest"><code>cupsConnectDest</code></a>: Connect to device</td></tr>
+<tr><th>CUPS_DEST_FLAGS_ERROR </th><td class="description">An error occurred</td></tr>
+<tr><th>CUPS_DEST_FLAGS_MORE </th><td class="description">There are more destinations</td></tr>
+<tr><th>CUPS_DEST_FLAGS_NONE </th><td class="description">No flags are set</td></tr>
+<tr><th>CUPS_DEST_FLAGS_REMOVED </th><td class="description">The destination has gone away</td></tr>
+<tr><th>CUPS_DEST_FLAGS_RESOLVING </th><td class="description">The destination address is being resolved</td></tr>
+<tr><th>CUPS_DEST_FLAGS_UNCONNECTED </th><td class="description">There is no connection</td></tr>
+</tbody></table>
 <h3 class="enumeration"><a id="cups_dnssd_flags_e">cups_dnssd_flags_e</a></h3>
 <p class="description">DNS-SD callback flag values</p>
 <h4 class="constants">Constants</h4>
@@ -10188,6 +11086,31 @@ <h4 class="constants">Constants</h4>
 <tr><th>CUPS_JTYPE_STRING </th><td class="description">String value</td></tr>
 <tr><th>CUPS_JTYPE_TRUE </th><td class="description">Boolean true value</td></tr>
 </tbody></table>
+<h3 class="enumeration"><a id="cups_jwa_e">cups_jwa_e</a></h3>
+<p class="description">JSON Web Algorithms</p>
+<h4 class="constants">Constants</h4>
+<table class="list"><tbody>
+<tr><th>CUPS_JWA_ES256 </th><td class="description">ECDSA using P-256 and SHA-256</td></tr>
+<tr><th>CUPS_JWA_ES384 </th><td class="description">ECDSA using P-384 and SHA-384</td></tr>
+<tr><th>CUPS_JWA_ES512 </th><td class="description">ECDSA using P-521 and SHA-512</td></tr>
+<tr><th>CUPS_JWA_HS256 </th><td class="description">HMAC using SHA-256</td></tr>
+<tr><th>CUPS_JWA_HS384 </th><td class="description">HMAC using SHA-384</td></tr>
+<tr><th>CUPS_JWA_HS512 </th><td class="description">HMAC using SHA-512</td></tr>
+<tr><th>CUPS_JWA_NONE </th><td class="description">No algorithm</td></tr>
+<tr><th>CUPS_JWA_RS256 </th><td class="description">RSASSA-PKCS1-v1_5 using SHA-256</td></tr>
+<tr><th>CUPS_JWA_RS384 </th><td class="description">RSASSA-PKCS1-v1_5 using SHA-384</td></tr>
+<tr><th>CUPS_JWA_RS512 </th><td class="description">RSASSA-PKCS1-v1_5 using SHA-512</td></tr>
+</tbody></table>
+<h3 class="enumeration"><a id="cups_media_flags_e">cups_media_flags_e</a></h3>
+<p class="description">Flags for <a href="#cupsGetDestMediaByName"><code>cupsGetDestMediaByName</code></a> and <a href="#cupsGetDestMediaBySize"><code>cupsGetDestMediaBySize</code></a></p>
+<h4 class="constants">Constants</h4>
+<table class="list"><tbody>
+<tr><th>CUPS_MEDIA_FLAGS_BORDERLESS </th><td class="description">Find a borderless size</td></tr>
+<tr><th>CUPS_MEDIA_FLAGS_DEFAULT </th><td class="description">Find the closest size supported by the printer</td></tr>
+<tr><th>CUPS_MEDIA_FLAGS_DUPLEX </th><td class="description">Find a size compatible with 2-sided printing</td></tr>
+<tr><th>CUPS_MEDIA_FLAGS_EXACT </th><td class="description">Find an exact match for the size</td></tr>
+<tr><th>CUPS_MEDIA_FLAGS_READY </th><td class="description">If the printer supports media sensing, find the size amongst the &quot;ready&quot; media.</td></tr>
+</tbody></table>
 <h3 class="enumeration"><a id="cups_mediapos_e">cups_mediapos_e</a></h3>
 <p class="description">MediaPosition values</p>
 <h4 class="constants">Constants</h4>
@@ -10261,7 +11184,7 @@ <h4 class="constants">Constants</h4>
 <tr><th>CUPS_ORIENT_90 </th><td class="description">Rotate the page counter-clockwise</td></tr>
 </tbody></table>
 <h3 class="enumeration"><a id="cups_ptype_e">cups_ptype_e</a></h3>
-<p class="description">Printer type/capability bit constants</p>
+<p class="description">Printer type/capability flags</p>
 <h4 class="constants">Constants</h4>
 <table class="list"><tbody>
 <tr><th>CUPS_PRINTER_AUTHENTICATED </th><td class="description">Printer requires authentication</td></tr>

From 513839fc53840ff6f62548f0b3c255eec84e6f3e Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Thu, 1 Jun 2023 14:19:40 -0400
Subject: [PATCH 31/31] Fix usage output.

---
 cups/testcreds.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cups/testcreds.c b/cups/testcreds.c
index b7c868876..0e826987b 100644
--- a/cups/testcreds.c
+++ b/cups/testcreds.c
@@ -983,6 +983,7 @@ usage(FILE *fp)				// I - Output file (stdout or stderr)
   fputs("  -C COUNTRY                 Set country.\n", fp);
   fputs("  -L LOCALITY                Set locality name.\n", fp);
   fputs("  -O ORGANIZATION            Set organization name.\n", fp);
+  fputs("  -R CSR-FILENAME            Specify certificate signing request file.\n", fp);
   fputs("  -S STATE                   Set state.\n", fp);
   fputs("  -U ORGANIZATIONAL-UNIT     Set organizational unit name.\n", fp);
   fputs("  -a SUBJECT-ALT-NAME        Add a subjectAltName.\n", fp);