From 8580236323d0ff93294c7d1d5e1026cc04b3ccc5 Mon Sep 17 00:00:00 2001 From: okxlin <61420215+okxlin@users.noreply.github.com> Date: Fri, 21 Aug 2026 11:15:44 +0800 Subject: [PATCH] Update pocket-id app Rebuilt-from-PR: #6001 Source-PR: https://github.com/okxlin/appstore/pull/6001 Maintainer-workflow: appstore-pr-maintainer --- apps/pocket-id/2.12.0-distroless/data.yml | 68 ------------- .../2.12.0-distroless/docker-compose.yml | 27 ----- .../.env.sample | 2 +- apps/pocket-id/2.14.0-distroless/data.yml | 84 ++++++++++++++++ .../data/.gitkeep | 0 .../docker-compose.yml | 2 +- .../scripts/init.sh | 0 .../scripts/uninstall.sh | 0 .../scripts/upgrade.sh | 0 apps/pocket-id/data.yml | 25 ++--- apps/pocket-id/latest/.env.sample | 5 - apps/pocket-id/latest/data.yml | 68 ------------- apps/pocket-id/latest/data/.gitkeep | 1 - apps/pocket-id/latest/scripts/init.sh | 92 ------------------ apps/pocket-id/latest/scripts/uninstall.sh | 2 - apps/pocket-id/latest/scripts/upgrade.sh | 5 - apps/pocket-id/logo.png | Bin 6492 -> 2111 bytes 17 files changed, 99 insertions(+), 282 deletions(-) delete mode 100644 apps/pocket-id/2.12.0-distroless/data.yml delete mode 100644 apps/pocket-id/2.12.0-distroless/docker-compose.yml rename apps/pocket-id/{2.12.0-distroless => 2.14.0-distroless}/.env.sample (76%) create mode 100644 apps/pocket-id/2.14.0-distroless/data.yml rename apps/pocket-id/{2.12.0-distroless => 2.14.0-distroless}/data/.gitkeep (100%) rename apps/pocket-id/{latest => 2.14.0-distroless}/docker-compose.yml (92%) rename apps/pocket-id/{2.12.0-distroless => 2.14.0-distroless}/scripts/init.sh (100%) rename apps/pocket-id/{2.12.0-distroless => 2.14.0-distroless}/scripts/uninstall.sh (100%) rename apps/pocket-id/{2.12.0-distroless => 2.14.0-distroless}/scripts/upgrade.sh (100%) delete mode 100644 apps/pocket-id/latest/.env.sample delete mode 100644 apps/pocket-id/latest/data.yml delete mode 100644 apps/pocket-id/latest/data/.gitkeep delete mode 100755 apps/pocket-id/latest/scripts/init.sh delete mode 100755 apps/pocket-id/latest/scripts/uninstall.sh delete mode 100755 apps/pocket-id/latest/scripts/upgrade.sh diff --git a/apps/pocket-id/2.12.0-distroless/data.yml b/apps/pocket-id/2.12.0-distroless/data.yml deleted file mode 100644 index c19761ba0..000000000 --- a/apps/pocket-id/2.12.0-distroless/data.yml +++ /dev/null @@ -1,68 +0,0 @@ -additionalProperties: - formFields: - - default: 1411 - edit: true - envKey: PANEL_APP_PORT_HTTP - labelEn: HTTP Port - labelZh: HTTP 端口 - label: - en: HTTP Port - zh: HTTP 端口 - zh-Hant: HTTP 埠 - ja: HTTP ポート - ko: HTTP 포트 - ru: HTTP-порт - ms: Port HTTP - pt-br: Porta HTTP - required: true - rule: paramPort - type: number - - default: http://localhost:1411 - edit: true - envKey: POCKET_ID_APP_URL - labelEn: External App URL - labelZh: 外部访问地址 - label: - en: External App URL - zh: 外部访问地址 - zh-Hant: 外部存取網址 - ja: 外部アプリ URL - ko: 외부 앱 URL - ru: Внешний URL приложения - ms: URL aplikasi luaran - pt-br: URL externo do aplicativo - required: true - rule: paramExtUrl - type: text - - default: generate - edit: true - envKey: POCKET_ID_ENCRYPTION_KEY - labelEn: Encryption Key - labelZh: 加密密钥 - label: - en: Encryption Key - zh: 加密密钥 - zh-Hant: 加密金鑰 - ja: 暗号化キー - ko: 암호화 키 - ru: Ключ шифрования - ms: Kunci penyulitan - pt-br: Chave de criptografia - required: true - type: password - - default: "false" - edit: true - envKey: POCKET_ID_TRUST_PROXY - labelEn: Trusted Proxy Addresses - labelZh: 可信代理地址 - label: - en: Trusted Proxy Addresses - zh: 可信代理地址 - zh-Hant: 可信代理位址 - ja: 信頼するプロキシアドレス - ko: 신뢰할 프록시 주소 - ru: Адреса доверенных прокси - ms: Alamat proksi dipercayai - pt-br: Enderecos de proxy confiaveis - required: true - type: text diff --git a/apps/pocket-id/2.12.0-distroless/docker-compose.yml b/apps/pocket-id/2.12.0-distroless/docker-compose.yml deleted file mode 100644 index 3cddee51d..000000000 --- a/apps/pocket-id/2.12.0-distroless/docker-compose.yml +++ /dev/null @@ -1,27 +0,0 @@ -services: - pocket-id: - image: pocketid/pocket-id:v2.12.0-distroless - container_name: ${CONTAINER_NAME} - restart: always - networks: - - 1panel-network - ports: - - "${PANEL_APP_PORT_HTTP}:1411" - environment: - - APP_URL=${POCKET_ID_APP_URL} - - ENCRYPTION_KEY=${POCKET_ID_ENCRYPTION_KEY} - - TRUST_PROXY=${POCKET_ID_TRUST_PROXY} - volumes: - - "./data:/app/data" - healthcheck: - test: ["CMD", "/app/pocket-id", "healthcheck"] - interval: 90s - timeout: 5s - retries: 3 - start_period: 10s - labels: - createdBy: "Apps" - -networks: - 1panel-network: - external: true diff --git a/apps/pocket-id/2.12.0-distroless/.env.sample b/apps/pocket-id/2.14.0-distroless/.env.sample similarity index 76% rename from apps/pocket-id/2.12.0-distroless/.env.sample rename to apps/pocket-id/2.14.0-distroless/.env.sample index a5af0b82f..a764ae41d 100644 --- a/apps/pocket-id/2.12.0-distroless/.env.sample +++ b/apps/pocket-id/2.14.0-distroless/.env.sample @@ -1,5 +1,5 @@ +CONTAINER_NAME=pocket-id-compose-check PANEL_APP_PORT_HTTP=1411 POCKET_ID_APP_URL=http://localhost:1411 POCKET_ID_ENCRYPTION_KEY=generate POCKET_ID_TRUST_PROXY=false -CONTAINER_NAME=pocket-id diff --git a/apps/pocket-id/2.14.0-distroless/data.yml b/apps/pocket-id/2.14.0-distroless/data.yml new file mode 100644 index 000000000..a7180c76c --- /dev/null +++ b/apps/pocket-id/2.14.0-distroless/data.yml @@ -0,0 +1,84 @@ +additionalProperties: + formFields: + - default: 1411 + edit: true + envKey: PANEL_APP_PORT_HTTP + labelEn: HTTP Port + labelZh: HTTP 端口 + label: + en: HTTP Port + zh: HTTP 端口 + zh-Hant: HTTP 埠 + ja: HTTP ポート + ko: HTTP 포트 + ru: HTTP-порт + ms: Port HTTP + pt-br: Porta HTTP + required: true + rule: paramPort + type: number + - default: http://localhost:1411 + edit: true + envKey: POCKET_ID_APP_URL + labelEn: External App URL + labelZh: 外部访问地址 + label: + en: External App URL + zh: 外部访问地址 + zh-Hant: 外部存取網址 + ja: 外部アプリ URL + ko: 외부 앱 URL + ru: Внешний URL приложения + ms: URL aplikasi luaran + pt-br: URL externo do aplicativo + required: true + rule: paramExtUrl + type: text + - default: generate + edit: true + envKey: POCKET_ID_ENCRYPTION_KEY + labelEn: Encryption Key + labelZh: 加密密钥 + label: + en: Encryption Key + zh: 加密密钥 + zh-Hant: 加密金鑰 + ja: 暗号化キー + ko: 암호화 키 + ru: Ключ шифрования + ms: Kunci penyulitan + pt-br: Chave de criptografia + required: true + type: password + - default: 'false' + edit: true + envKey: POCKET_ID_TRUST_PROXY + labelEn: Trusted Proxy Addresses + labelZh: 可信代理地址 + label: + en: Trusted Proxy Addresses + zh: 可信代理地址 + zh-Hant: 可信代理位址 + ja: 信頼するプロキシアドレス + ko: 신뢰할 프록시 주소 + ru: Адреса доверенных прокси + ms: Alamat proksi dipercayai + pt-br: Enderecos de proxy confiaveis + required: true + type: text + - default: Asia/Shanghai + edit: true + envKey: TZ + labelEn: Timezone + labelZh: 时区 + label: + en: Timezone + zh: 时区 + zh-Hant: 時區 + ja: タイムゾーン + ko: 시간대 + ru: Часовой пояс + ms: Zon waktu + pt-br: Fuso horário + required: true + type: text diff --git a/apps/pocket-id/2.12.0-distroless/data/.gitkeep b/apps/pocket-id/2.14.0-distroless/data/.gitkeep similarity index 100% rename from apps/pocket-id/2.12.0-distroless/data/.gitkeep rename to apps/pocket-id/2.14.0-distroless/data/.gitkeep diff --git a/apps/pocket-id/latest/docker-compose.yml b/apps/pocket-id/2.14.0-distroless/docker-compose.yml similarity index 92% rename from apps/pocket-id/latest/docker-compose.yml rename to apps/pocket-id/2.14.0-distroless/docker-compose.yml index 39b1c5766..e369ca7f9 100644 --- a/apps/pocket-id/latest/docker-compose.yml +++ b/apps/pocket-id/2.14.0-distroless/docker-compose.yml @@ -1,6 +1,6 @@ services: pocket-id: - image: pocketid/pocket-id:latest-distroless + image: "pocketid/pocket-id:v2.14.0-distroless" container_name: ${CONTAINER_NAME} restart: always networks: diff --git a/apps/pocket-id/2.12.0-distroless/scripts/init.sh b/apps/pocket-id/2.14.0-distroless/scripts/init.sh similarity index 100% rename from apps/pocket-id/2.12.0-distroless/scripts/init.sh rename to apps/pocket-id/2.14.0-distroless/scripts/init.sh diff --git a/apps/pocket-id/2.12.0-distroless/scripts/uninstall.sh b/apps/pocket-id/2.14.0-distroless/scripts/uninstall.sh similarity index 100% rename from apps/pocket-id/2.12.0-distroless/scripts/uninstall.sh rename to apps/pocket-id/2.14.0-distroless/scripts/uninstall.sh diff --git a/apps/pocket-id/2.12.0-distroless/scripts/upgrade.sh b/apps/pocket-id/2.14.0-distroless/scripts/upgrade.sh similarity index 100% rename from apps/pocket-id/2.12.0-distroless/scripts/upgrade.sh rename to apps/pocket-id/2.14.0-distroless/scripts/upgrade.sh diff --git a/apps/pocket-id/data.yml b/apps/pocket-id/data.yml index dc5db61bc..76ab120a2 100644 --- a/apps/pocket-id/data.yml +++ b/apps/pocket-id/data.yml @@ -1,15 +1,24 @@ name: Pocket ID tags: - - Security +- Security title: 以通行密钥为核心的 OIDC 身份提供商 description: 以通行密钥为核心的 OIDC 身份提供商 additionalProperties: key: pocket-id name: Pocket ID tags: - - Security + - Security + type: website + website: https://pocket-id.org/ + document: https://pocket-id.org/docs/ + github: https://github.com/pocket-id/pocket-id shortDescZh: 以通行密钥为核心的 OIDC 身份提供商 shortDescEn: A passkey-first OIDC identity provider + crossVersionUpdate: true + limit: 1 + architectures: + - amd64 + - arm64 description: en: A passkey-first OIDC identity provider for self-hosted services zh: 面向自托管服务、以通行密钥为核心的 OIDC 身份提供商 @@ -18,13 +27,5 @@ additionalProperties: ko: 자체 호스팅 서비스를 위한 패스키 우선 OIDC ID 공급자 ru: OIDC-провайдер для самостоятельного размещения с приоритетом ключей доступа ms: Penyedia identiti OIDC berasaskan kunci laluan untuk perkhidmatan hos kendiri - pt-br: Provedor de identidade OIDC com foco em chaves de acesso para servicos auto-hospedados - type: website - crossVersionUpdate: true - limit: 1 - website: https://pocket-id.org/ - github: https://github.com/pocket-id/pocket-id - document: https://pocket-id.org/docs/ - architectures: - - amd64 - - arm64 + pt-br: Provedor de identidade OIDC com foco em chaves de acesso para servicos + auto-hospedados diff --git a/apps/pocket-id/latest/.env.sample b/apps/pocket-id/latest/.env.sample deleted file mode 100644 index a5af0b82f..000000000 --- a/apps/pocket-id/latest/.env.sample +++ /dev/null @@ -1,5 +0,0 @@ -PANEL_APP_PORT_HTTP=1411 -POCKET_ID_APP_URL=http://localhost:1411 -POCKET_ID_ENCRYPTION_KEY=generate -POCKET_ID_TRUST_PROXY=false -CONTAINER_NAME=pocket-id diff --git a/apps/pocket-id/latest/data.yml b/apps/pocket-id/latest/data.yml deleted file mode 100644 index c19761ba0..000000000 --- a/apps/pocket-id/latest/data.yml +++ /dev/null @@ -1,68 +0,0 @@ -additionalProperties: - formFields: - - default: 1411 - edit: true - envKey: PANEL_APP_PORT_HTTP - labelEn: HTTP Port - labelZh: HTTP 端口 - label: - en: HTTP Port - zh: HTTP 端口 - zh-Hant: HTTP 埠 - ja: HTTP ポート - ko: HTTP 포트 - ru: HTTP-порт - ms: Port HTTP - pt-br: Porta HTTP - required: true - rule: paramPort - type: number - - default: http://localhost:1411 - edit: true - envKey: POCKET_ID_APP_URL - labelEn: External App URL - labelZh: 外部访问地址 - label: - en: External App URL - zh: 外部访问地址 - zh-Hant: 外部存取網址 - ja: 外部アプリ URL - ko: 외부 앱 URL - ru: Внешний URL приложения - ms: URL aplikasi luaran - pt-br: URL externo do aplicativo - required: true - rule: paramExtUrl - type: text - - default: generate - edit: true - envKey: POCKET_ID_ENCRYPTION_KEY - labelEn: Encryption Key - labelZh: 加密密钥 - label: - en: Encryption Key - zh: 加密密钥 - zh-Hant: 加密金鑰 - ja: 暗号化キー - ko: 암호화 키 - ru: Ключ шифрования - ms: Kunci penyulitan - pt-br: Chave de criptografia - required: true - type: password - - default: "false" - edit: true - envKey: POCKET_ID_TRUST_PROXY - labelEn: Trusted Proxy Addresses - labelZh: 可信代理地址 - label: - en: Trusted Proxy Addresses - zh: 可信代理地址 - zh-Hant: 可信代理位址 - ja: 信頼するプロキシアドレス - ko: 신뢰할 프록시 주소 - ru: Адреса доверенных прокси - ms: Alamat proksi dipercayai - pt-br: Enderecos de proxy confiaveis - required: true - type: text diff --git a/apps/pocket-id/latest/data/.gitkeep b/apps/pocket-id/latest/data/.gitkeep deleted file mode 100644 index 8b1378917..000000000 --- a/apps/pocket-id/latest/data/.gitkeep +++ /dev/null @@ -1 +0,0 @@ - diff --git a/apps/pocket-id/latest/scripts/init.sh b/apps/pocket-id/latest/scripts/init.sh deleted file mode 100755 index 4c9d49aa2..000000000 --- a/apps/pocket-id/latest/scripts/init.sh +++ /dev/null @@ -1,92 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)" -ENV_FILE="${ENV_FILE:-${ROOT_DIR}/.env}" - -fail() { - printf '%s\n' "$1" >&2 - exit 1 -} - -read_env_value() { - local key="$1" - local value="" - value="$(grep -E "^${key}=" "$ENV_FILE" | tail -n 1 | cut -d '=' -f 2- || true)" - if [[ ${#value} -ge 2 && "${value:0:1}" == '"' && "${value: -1}" == '"' ]]; then - value="${value:1:${#value}-2}" - elif [[ ${#value} -ge 2 && "${value:0:1}" == "'" && "${value: -1}" == "'" ]]; then - value="${value:1:${#value}-2}" - fi - printf '%s\n' "$value" -} - -set_env_value() { - local key="$1" - local value="$2" - local temp_file - temp_file="$(mktemp "${ROOT_DIR}/.pocket-id-env.tmp.XXXXXX")" - awk -v key="$key" -v value="$value" ' - BEGIN { written = 0 } - $0 ~ "^" key "=" { - if (!written) { - print key "=" value - written = 1 - } - next - } - { print } - END { - if (!written) print key "=" value - } - ' "$ENV_FILE" > "$temp_file" - chmod 600 "$temp_file" - mv -f -- "$temp_file" "$ENV_FILE" -} - -generate_key() { - local value="" - if command -v openssl >/dev/null 2>&1; then - value="$(openssl rand -base64 32 | tr -d '\n')" - elif [[ -r /dev/urandom ]] && command -v base64 >/dev/null 2>&1; then - value="$(head -c 32 /dev/urandom | base64 | tr -d '\n')" - fi - [[ "$value" =~ ^[A-Za-z0-9+/]{43}=$ ]] || fail "Unable to generate a secure Pocket ID encryption key" - printf '%s\n' "$value" -} - -[[ -f "$ENV_FILE" ]] || fail "$ENV_FILE not found" -[[ ! -L "$ENV_FILE" ]] || fail "$ENV_FILE must not be a symbolic link" - -app_url="$(read_env_value POCKET_ID_APP_URL)" -[[ -n "$app_url" ]] || fail "POCKET_ID_APP_URL is required" -case "$app_url" in - *$'\n'* | *$'\r'* | *\\* | *'$'* | *'#'* | *'"'* | *"'") fail "POCKET_ID_APP_URL contains unsupported dotenv characters" ;; -esac - -trust_proxy="$(read_env_value POCKET_ID_TRUST_PROXY)" -[[ -n "$trust_proxy" ]] || trust_proxy=false -[[ "$trust_proxy" =~ ^(false|[0-9A-Fa-f:.,/[:space:]-]+)$ ]] || fail "POCKET_ID_TRUST_PROXY must be false or a comma-separated IP/CIDR list" - -requested_key="$(read_env_value POCKET_ID_ENCRYPTION_KEY)" -if [[ -z "$requested_key" || "$requested_key" == "generate" ]]; then - encryption_key="$(generate_key)" -else - [[ "$requested_key" =~ ^[A-Za-z0-9+/]{43}=$ ]] || fail "POCKET_ID_ENCRYPTION_KEY must be generate or a base64-encoded 32-byte key" - encryption_key="$requested_key" -fi - -data_dir="${ROOT_DIR}/data" -[[ ! -L "$data_dir" ]] || fail "Pocket ID data directory must not be a symbolic link" -mkdir -p -- "$data_dir" -if [[ "$(id -u)" -eq 0 ]]; then - chown 65532:65532 "$data_dir" - chmod 700 "$data_dir" -else - [[ "$(stat -c '%u:%g' "$data_dir")" == "65532:65532" ]] || fail "Pocket ID init must run as root to prepare the non-root data directory" - [[ "$(stat -c '%a' "$data_dir")" == "700" ]] || fail "Pocket ID data directory must have mode 700" -fi - -set_env_value POCKET_ID_APP_URL "$app_url" -set_env_value POCKET_ID_ENCRYPTION_KEY "$encryption_key" -set_env_value POCKET_ID_TRUST_PROXY "$trust_proxy" diff --git a/apps/pocket-id/latest/scripts/uninstall.sh b/apps/pocket-id/latest/scripts/uninstall.sh deleted file mode 100755 index ab8a8d674..000000000 --- a/apps/pocket-id/latest/scripts/uninstall.sh +++ /dev/null @@ -1,2 +0,0 @@ -#!/bin/bash -docker-compose down --volumes diff --git a/apps/pocket-id/latest/scripts/upgrade.sh b/apps/pocket-id/latest/scripts/upgrade.sh deleted file mode 100755 index e73ce2436..000000000 --- a/apps/pocket-id/latest/scripts/upgrade.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)" -exec "${SCRIPT_DIR}/init.sh" diff --git a/apps/pocket-id/logo.png b/apps/pocket-id/logo.png index 907776f67187ee21b9a0410349b85d07e3625967..4117c51800774bb40401215047d17abce929c900 100644 GIT binary patch literal 2111 zcmV-F2*CG=P)H z0EqQmICZiqqIn-0)6+o!P&R4Ovg=JJzHifq&#jFvtlJZ{DIq0)l-*0EQlq9We&o*R zl|-qxpi}nUQmL_X9<2>uO?e3#2c$`*M&0|+?XB0`gEleRFz4H*M&G|Uelg(|w4Gcr zmHv~3O|jA*zi8@(Ubo#i8Y~f}Ee25L)7XN_*6vyEwtA!t!c3WjZfY^%K|DupNSX#W z2bBHBIt8lUvbEd;>LJ=E_8T`yDtl&orCZQ>S*BSt`-5?{>))(&37QcfrGatKqg}JD z+&%T+B~AnDd$#fVg7mu7F=QHw-sc)`+~5W@+8PoR=?Z(u_u_IFpeawm8#Uy{l9>rK z4v?x}o$ii$5O36w9SsejEHrC#xm0Mh8Uu=~bnXNBGb>kn!z0pAy7``)ELA;laL3Y4 z2LHQBmqDx8~eb@rDKR4nR!+o`&yR?Es`EK?>iFFGDY4*=@ z6C{ATY0Yl9aVBztqni#ynd#ONKW+XrVK-M)H8&{TPgRiw1G*k=i-kT5^j%;^a zST50en4BWu(YFN^UH!w4M1~`$DtC{Us~%jL0Px&9U82VN2ghs{5KWkpl&2mhFCKaS zlGu7h-|Il(dO!exidr`k+blu-F{@LJUs)va004NG<{otHo2ccvZ#$7+e(bj?Ws-|E z%%1;GYl#I;n_NES;_Qh&$;BEbr9Bg}ZmQRldAOAMfvVdis|O>wf9;GwbH6y31Og~^ zL8mj^iFTVdTDT86r^2qrid&LyEyQ@(?rhHu%Rm-NeC}Bf`z-+jm7L@SOgKn+RaS5^ z#z9paM#dwu#m5TU8~s(|NSqL7Wno;=XpD zPpk_BfJBP1%JGyufh^a*K5d}4Ci|FHpaxpKB5Mm29t`J#(u zNLH?SX_CFO{wE@-!emwIqFc8t+5cmnqI}+lWj?YVGZMral9D9NT$wluf_bw~ZR^Z3 zZ+~hG5t_=6l<$mfe`}I-8Vw7J6}GQ7PcdT*84C@@sO4n0Xf<~*F}D!W%t{o+ z)3MJwB}22o>=T2*IFn{IN9}&$=OZ8)nw@d>#v2zNheBvwe(2m2kqM2$lq@SR+lTJuK*I)wn(@s=MXLmT1qTTh%HLl>IWhyX)7Pit;LGs4Tj`T3~rny_q* z*LNQ-FZH0DyS=a?j9nxri_;@48 ztEv`=8U=-c9R)HwsMDM%dyGyl)Ma=O9RGOvJ8%(NpknQPh6C3w@?8@9UpedK1q;Z; zjgR+0yD{a{8`)|q2KFA(!5wJpl2MzfiV?`S!N}o{{SHsz%yP5zHB4@rlKHRqw(J_O;Zr9Bba_sVK1n4|@q&}i);370D za!%?U=35bZ{PV_YdbZ1^|9+`&;{elwc*)xv4 z&+K57mmhyDC_3-lJJ_Yp!RFJ%c&p>@w>u4Os@!6z7d#G)X5$z3IJEHfC%^7(XrX`U zNP1m87$wP8`CFklpwodznmXF46$dn%lZ1m_m$cy7jc~;4(1J&yTcc1+>XAuX0E)0Bww!0*NAkCf>>L zw}`xLr*r;=zeQ9W&c$$x$fHSs{VgKTCIS4d!7K5iQIEU<8S!vw1az8OwW5Q@#E6GW zg_p%*k^h9pORfe-UeYB6{vSot$65G2I-l??w5yx?Cqfmpf>zK9T0tvl1+AbJw1QU9 p3R*!cXa%jH6|{m@&MJiFU zWS^95S+XYEbM*QCzQ5zXwFgB>*5qga8Bb3qI|OJ&YVM4yUzG15kR4Y10aeoTI!ishx1T{TgF@E1aHQ5G=K z)+MNVc-ax;B&8&!1Ww@y1cH*6t-Zn}wR8WPj+`kAI8rEN1tQVc*H_Y4TGGSIfq3lX z$&*B>Ls1qG*md;p z&p$jVPWJ!ble_o7!a@Qh?v4X_1B684T>x$y9L*^x zGZQc_>eFlqlC%RPgJW;f1J{K|5A>TW`7h=$z4V-BO;yq7HZHu+baEd!cj{cKk&L)v z_=1~9aiD+yA+DkI>+@QoY^-`^Mn`P#0jVyKjMY+O9bDPW{95;-!Djeoq_2hC*L`Yg zEtmOS0E`3j6Y0lVBTMQD;{E@H;cmWr6YO zjGd#$ceJv+P=Fn?JIr`(Gekg7m<5PI_;Bf?mZ8;f!Cf@qKr!&AaO@FRdQ^}G0b$f; z3{^k>)0dklpo!p2PmiWU<4pU3C?ko%p8h}{YmXK)NW>82y@!+bX&iL|nL>bHevO`w z`$A6z-9K}hW{kT+GP)T7{N0nfj|pdR!TB$&nqg#9a(s~y={}iTGoO@y|-b3q(+$5JIG~SWQI9 z0b4drUwmT%KpYJF>~LG4fD{|ln`~o752(=$em)0VD3SmO3R()!-suA*Ll7>TtZ!_D z28JkxUK6!-b|A_`BJZ3oM8VA<@PcKLi9tsQn@Cn=jeWFsnGGp|4IQ z`SV`@wo~sIBX|elhaR0>!GHoLl1ZPw>|bs}!$IOcE+A73G==9H$N-Wl2;XRoHsnEg zyyWXvxf3Asm-vXwBPlJQ%ZY?A#LWx=d=r6sxWxevV1`<-V|ep}a0I}|z^Mj^M^i8~ zaw@DAwQCF8sm}wtv4n_V-j;9j8X(#pztDS0j1f$)f}uu5K6OTjWH1`#rf|0lWQrps zMqg(!A$L|@_@GXX_-?!M|u5n&rYS~rw^uiXfzrrz1lW@5FfI?^d1 zf$qUjYdSfD!V1z31@TJuUlCOJ^EE`J-id$dzTOCcS+P`!og@vlO8b!(duO##^QnIE zies7cw(kJ-JY;!wr#Q_utK0t*egEW?cae2r|I*9#_uSaIQMIv?ygXo}yXB zqb_6}L?@!D{tKJ=j`jWTqPQ=Y>HM&^h&Tf)nyHlMGXg;j%rwusU*Bm3PEhl|nD*`R zR|?dtZ2-Y{P}E522a9gzKhoM(K6Ym4VoF*!8AQUJQMBgN)8iDy(XUSS8F^6xaNW$? z^AI%}kR9|Yhna@se=U2Th){sd6gv~L< zqHj)F1x2|fPfpIJ zO_`%InQ?z^>9#pyc^C{jANQI^*hP}}0yg)>o z*j%;s#T7#E;9#S`_{N~S!r4Cr>XvY~8z7|s6RD`_<8s!{vT5V*>1eKnb2bnu8dTSn zo-*p_X|Qh&y5Pk_ot@2BH^de~)Sbv@m7LGdd>$v#Yd_`#3@pHRwCE>sX3kyzV*QaC zCd>GZg1vwrTA066^`+3z@y7QaLa$%kJ0vtLJlG(janMGZ(#{$6K7&sD)-)YT7?jX> z3fnfqoHzn5Et-idZ9`HJ%E9pL~dN3t5o|u4n_ZrEMc1gDz`%z)MN6_W2p^>wuey!c3`w~vTNcCwzg#S z?#2~IxwKbV2B2g~ZHhQ3y+@yHAiId4IKK6Gp$-YY*W zSlx;fKcGo7&N)Q=q&>0RpF($y4m1((gdA0mDN5SVP8kmTJqk$jp!$UBpSo4H;ls#g zTotHNt_UK~uq+?TSDyu?8V_`auizg^^GM_guTzub3X0pXw4yCD-s0=3kmVYmp#ROJ zk&Tb>UM|1`YX=B90=m&p3kWNpa_09~ZCi`cVl!_ei-7;_SyHO~`{4te!y2BNTIhz# zx&z0Lif5BtgyxwXl_G*s{CiPB0zMal%9MiZM(^&Sh5TefmfzBZ=2o!bGjq}3n&ax}JxW{3;ob@^S ziMPQsZ|S7mboR?xGj9FLB+7&9Jt$g3=_5&-MD4uqa}0i={0n`08Jy2QI(=PhlNXoQ z%THY_jw_*)jCbTj?htoobE%;X0m_x5U46b0WE-_nPrYIO;*Lnxb~Dvh^3Hqv8%B{{ z4qA&;ArP_qoGJZUROKR@HWB6N(k*T9Iv8bz#t+qG?A_mydo1P`<*DHJDA^yh*4uZ0 z<(kFubeHS3&N7~LysfjPo0q2?QUF!`8fviPaX{AAs)~R4f!5&FYx8$Lx#D!0Vat)$ z&x0Hv4YO_J{KVr%8|xIZ(BViGl~Uyi@pgCEO6lc?1}Y}5ay|P+ru0P}r6WnrH!wK{ zmDxe9ehM?ZD#*}K%-jHJ9Q>_9aO=G{!qke?`dpXJIEU8FFX>63k1&v=2Ghb_;OS=I+j?ZT?D0F=AyPP==Db}j>G^7UI}$(SU*$()1Lu%h zYG^)mY){rSZ4m1vn?*cT`k7y%6IqkFp2Jf3zZ$A*Cbhnu@>?3pcvn-mcQQCD%+xcqVEb2B?o@+vbb4 zR6Nh{LDh8+FVO)tEWEy>$N-CHNUT_A-a3d1;T_HgfDqx+Lf|Dkw?BT6ahnSjaPdw^ z!ZA=$wr6Mk^!CnM_seYV9Btta*%By2dfM|t%M5Q7ln;7wI9_4xpP&K)X3b(hg*8vB zDykNb>}*}PO6lNapd{tUlAc?B<~dZek$v76g`z%^6NS6qu#B)YgsH+eHYNnX0 z%9CPock(CBJcCkI1jkNhj)Cfi^@=7Bj-t<-3x%Y)`lTlq^8n!t7zxm18Nl9mOyjkt zm%3NDAE+@@oZI~U>~qN6r>(l#bWldm9tQrlF}05om&XuH0byIG;T z%52qMDn4RqIz_0Q`Jq%h^Ax>f5q_*fD8Pz)Wkk@3rot zWOXlv)ogU||3b>yQv~Zv(p8j{Z`t%z;VccXf*J!_nx=;ObL2~ zB$vrk!f>Agcnwh#e_U-lTvt1Cmtri>G{@T!FANB>y)7SR-^&C{YMi{)6y9QRej4EE z!BD@S!9B$#7fNxW*zNVFZ+<@L0R%p<*^}ro*JqM5V;cwBhd0koYfJ(>6KJ;>`N=cu zq@Z(#qir@UcFYKf4Ws?mWa|VTb+3lld@&?cy-xhX0Xw5p27Vf+o?}ryH8eqMUN@~b z0(zK`;;C1r&N6}3hJ>~G?83)rk~vbEeb&%!ymz##=at(Ijdl8%4~S*~p&v5es0I^` zC=~jd7!p|c^5>9uwqGb}IM;*5f+J2JXI?#l{1=4m%73|r+6997$3HGQ9Mi0@y~bPgQH;mNQykUo!jm8Qc5j8AyFA6&zNmh1bBepFv5-rh zj;NQr?!%L{o@&cR|Ioz5*eMk zneXYI^}gTf>&X0-wikF}$aWXrROGM92f4%=61cXll@sPeQ6vWU+27N;Nc;UGIYt)D4R#ZAj}*? z%+RXL$wQNr0>RGOheljLBW}}u$yi;g?+>#Nb)i@a_y)vAEvE+ZcDZu2`Ir3K|BhWD zd&>|@HjMR^<#D?F?bnY&m5H@Sd1+6k0NxDrQrDk9>@v<<|DeRg)fA|bb8KA4DMS`U zUW>opnr9Z6BDOX9v9meVL3zcr&{iRTD+xmlPtrcfveNY3$!kY9icVV5WGDD$&o35G z@>DsXlJijO(8T7RuaOKmeuR}h4TEd0j6^hmo=flkE zKSvfbX8qHaKN+i&=W2>aPbU(uSuP!AL}~{8(sA$o?WH{*4(VZ!e^qqx7|rMsR_#M& zN(0P=%MUS=wRdt24;4Wt%ORH@1A*-HZXYn2$WMJR++q6ME^Q+$|7)CLQ$oxAeYuKN z>pd8n`RE@ZQr}a`goQG*L-M?P5E;^YsjnF7dvCD5?5uQo_Oq2F46X4DkG{GAmKtt%Ou3W=oGYOB%W2W(2U4{_zN(@^`XD$r zC{C@ZZqPtF6gV(6uszP15Cy?{^i;F*M|aND9c6;C@6Ar~;lQ~=u*g6l2L@!@GLYvS z{q-3@T%IW$%y<|jhA#Qj=|1Hr3b?O;>Z&4#gNISmkY&>%=dE2^bjZ6%b`J+1H1x=Z zEtA6PXmLXW9+&|WmTZ|)VD6=V+e4>{+A`$bEj-|^qmK_t=3$EvX$rY!{UdpJz%6_> zb1PU2>VAk#kJ3QeAk|A9cM?x$Bh=Q3x_tLQBuZu*)_}WIVP6%wNYN{pfxgPB-Ow1p zj9CgsbPqgemheW1WCyk{B(`*reNZK>-UhGMEXCFUi|Xcb5a%!>y1> z@l_9!?1@rob0-ilBE_g1z(CHkai|_BhvzFo>|{V3ALs=gyUiBgQSL_KKY3!CZW1C{ zf%tqUr2(^Xe%k#nJVmSGG`7FyOUn^6+(^TL?}cJQ)Fm#kbpH}c@f8Q%M=DRLGYe`& z`7avm5~PkfAQ?t->Z)*ecNW|j?v;WmV1i{IHnm#jqJFbL@W5Hx3Nqt3hzx5Kfxq}8hW1cLwy|0eI~}#5XJh)W zWo>biE)-e1*O`Vh`q)wf=c}sNiEP^P2-9<|lq1OZwECK}WjyDRej}J8p9=UVSc% zEprJt9=V%zOGLK9=MCy(<=mxP=_!soI+*{#_A#JY0OW6r|AkKU`L^{?X94KN$QaK$ Q(yRv>XLZzy&RB;32PK@csQ>@~