From 25c766af31a4f5399b4711a522c5825be1b9ffeb Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Tue, 16 Dec 2025 13:25:14 -0500 Subject: [PATCH 01/21] feat(orchestrator): initial work Signed-off-by: Matthew H. Irby --- .gitignore | 35 +++-- .../Cloudflare.TestConsole.csproj | 14 ++ Cloudflare.TestConsole/Program.cs | 7 + .../Cloudflare.UnitTests.csproj | 29 ++++ Cloudflare.UnitTests/InventoryTests.cs | 31 ++++ Cloudflare.sln | 9 ++ Cloudflare.sln.DotSettings | 2 - Cloudflare/Client/CloudflareClient.cs | 58 ++++++- Cloudflare/Cloudflare.csproj | 16 +- Cloudflare/Jobs/Inventory.cs | 141 +++++++++++++++--- Cloudflare/Jobs/Management.cs | 44 ------ .../GetCertificatePacksCertificateItem.cs | 37 +++++ .../Cloudflare/GetCertificatePacksResponse.cs | 53 +++++++ .../Models/Cloudflare/ResponseMetadata.cs | 16 ++ Cloudflare/Models/Cloudflare/ResultInfo.cs | 21 +++ Cloudflare/RequestManager.cs | 10 -- .../Service/CertificateRetrievalService.cs | 98 ++++++++++++ Cloudflare/manifest.json | 10 +- README.md.tpl | 96 ------------ integration-manifest.json | 45 +++++- 20 files changed, 569 insertions(+), 203 deletions(-) create mode 100644 Cloudflare.TestConsole/Cloudflare.TestConsole.csproj create mode 100644 Cloudflare.TestConsole/Program.cs create mode 100644 Cloudflare.UnitTests/Cloudflare.UnitTests.csproj create mode 100644 Cloudflare.UnitTests/InventoryTests.cs delete mode 100644 Cloudflare.sln.DotSettings delete mode 100644 Cloudflare/Jobs/Management.cs create mode 100644 Cloudflare/Models/Cloudflare/GetCertificatePacksCertificateItem.cs create mode 100644 Cloudflare/Models/Cloudflare/GetCertificatePacksResponse.cs create mode 100644 Cloudflare/Models/Cloudflare/ResponseMetadata.cs create mode 100644 Cloudflare/Models/Cloudflare/ResultInfo.cs delete mode 100644 Cloudflare/RequestManager.cs create mode 100644 Cloudflare/Service/CertificateRetrievalService.cs delete mode 100644 README.md.tpl diff --git a/.gitignore b/.gitignore index 4ce6fdd..feb8043 100644 --- a/.gitignore +++ b/.gitignore @@ -13,6 +13,9 @@ # User-specific files (MonoDevelop/Xamarin Studio) *.userprefs +# Mono auto generated files +mono_crash.* + # Build results [Dd]ebug/ [Dd]ebugPublic/ @@ -26,6 +29,7 @@ bld/ [Bb]in/ [Oo]bj/ [Ll]og/ +[Ll]ogs/ # Visual Studio 2015/2017 cache/options directory .vs/ @@ -39,9 +43,10 @@ Generated\ Files/ [Tt]est[Rr]esult*/ [Bb]uild[Ll]og.* -# NUNIT +# NUnit *.VisualState.xml TestResult.xml +nunit-*.xml # Build Results of an ATL Project [Dd]ebugPS/ @@ -122,9 +127,6 @@ _ReSharper*/ *.[Rr]e[Ss]harper *.DotSettings.user -# JustCode is a .NET coding add-in -.JustCode - # TeamCity is a build add-in _TeamCity* @@ -182,6 +184,8 @@ PublishScripts/ # NuGet Packages *.nupkg +# NuGet Symbol Packages +*.snupkg # The packages folder can be ignored because of Package Restore **/[Pp]ackages/* # except build/, which is used as an MSBuild target. @@ -206,6 +210,8 @@ BundleArtifacts/ Package.StoreAssociation.xml _pkginfo.txt *.appx +*.appxbundle +*.appxupload # Visual Studio cache files # files ending in .cache can be ignored @@ -255,7 +261,9 @@ ServiceFabricBackup/ *.bim.layout *.bim_*.settings *.rptproj.rsuser -*- Backup*.rdl +*- [Bb]ackup.rdl +*- [Bb]ackup ([0-9]).rdl +*- [Bb]ackup ([0-9][0-9]).rdl # Microsoft Fakes FakesAssemblies/ @@ -291,10 +299,6 @@ paket-files/ # FAKE - F# Make .fake/ -# JetBrains Rider -.idea/ -*.sln.iml - # CodeRush personal settings .cr/personal @@ -337,4 +341,15 @@ ASALocalRun/ .localhistory/ # BeatPulse healthcheck temp database -healthchecksdb \ No newline at end of file +healthchecksdb + +# Backup folder for Package Reference Convert tool in Visual Studio 2017 +MigrationBackup/ + +# Ionide (cross platform F# VS Code tools) working folder +.ionide/ + +# Ignore .env files +**/.env +**/.env.* +!**/.env.*.example \ No newline at end of file diff --git a/Cloudflare.TestConsole/Cloudflare.TestConsole.csproj b/Cloudflare.TestConsole/Cloudflare.TestConsole.csproj new file mode 100644 index 0000000..5346eac --- /dev/null +++ b/Cloudflare.TestConsole/Cloudflare.TestConsole.csproj @@ -0,0 +1,14 @@ + + + + Exe + net6.0 + enable + enable + + + + + + + diff --git a/Cloudflare.TestConsole/Program.cs b/Cloudflare.TestConsole/Program.cs new file mode 100644 index 0000000..a879481 --- /dev/null +++ b/Cloudflare.TestConsole/Program.cs @@ -0,0 +1,7 @@ +// See https://aka.ms/new-console-template for more information + +using Keyfactor.Extensions.Orchestrator.CloudflareEdge; +using Keyfactor.Orchestrators.Extensions; + +var inventory = new Inventory(); +inventory.ProcessJob(new InventoryJobConfiguration(), ); diff --git a/Cloudflare.UnitTests/Cloudflare.UnitTests.csproj b/Cloudflare.UnitTests/Cloudflare.UnitTests.csproj new file mode 100644 index 0000000..aa44125 --- /dev/null +++ b/Cloudflare.UnitTests/Cloudflare.UnitTests.csproj @@ -0,0 +1,29 @@ + + + + net6.0 + enable + enable + + false + + + + + + + + runtime; build; native; contentfiles; analyzers; buildtransitive + all + + + runtime; build; native; contentfiles; analyzers; buildtransitive + all + + + + + + + + diff --git a/Cloudflare.UnitTests/InventoryTests.cs b/Cloudflare.UnitTests/InventoryTests.cs new file mode 100644 index 0000000..5d742fb --- /dev/null +++ b/Cloudflare.UnitTests/InventoryTests.cs @@ -0,0 +1,31 @@ +using Keyfactor.Extensions.Orchestrator.CloudflareEdge.Jobs; +using Keyfactor.Orchestrators.Extensions; +using Moq; +using Xunit; + +namespace Cloudflare.UnitTests; + +public class InventoryTests +{ + private readonly Mock _mockSubmitInventoryUpdate = new (); + private readonly Inventory _sut; + + public InventoryTests() + { + _sut = new Inventory(); + } + + [Fact] + public void ProcessJob() + { + var config = new InventoryJobConfiguration() + { + CertificateStoreDetails = new CertificateStore() + { + StorePath = "", + }, + ServerPassword = "", + }; + _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + } +} diff --git a/Cloudflare.sln b/Cloudflare.sln index e98e272..5afec11 100644 --- a/Cloudflare.sln +++ b/Cloudflare.sln @@ -27,6 +27,10 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "images", "images", "{630203 Images\Image9.png = Images\Image9.png EndProjectSection EndProject +Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "tests", "tests", "{F135EC22-CF6C-4D43-95BC-2E58755E7DE4}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Cloudflare.UnitTests", "Cloudflare.UnitTests\Cloudflare.UnitTests.csproj", "{10FA1B6D-A9BE-443D-B166-F4363386A3E1}" +EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|Any CPU = Debug|Any CPU @@ -37,12 +41,17 @@ Global {33FBC5A1-3466-4F10-B9A6-7186F804A65A}.Debug|Any CPU.Build.0 = Debug|Any CPU {33FBC5A1-3466-4F10-B9A6-7186F804A65A}.Release|Any CPU.ActiveCfg = Release|Any CPU {33FBC5A1-3466-4F10-B9A6-7186F804A65A}.Release|Any CPU.Build.0 = Release|Any CPU + {10FA1B6D-A9BE-443D-B166-F4363386A3E1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {10FA1B6D-A9BE-443D-B166-F4363386A3E1}.Debug|Any CPU.Build.0 = Debug|Any CPU + {10FA1B6D-A9BE-443D-B166-F4363386A3E1}.Release|Any CPU.ActiveCfg = Release|Any CPU + {10FA1B6D-A9BE-443D-B166-F4363386A3E1}.Release|Any CPU.Build.0 = Release|Any CPU EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection GlobalSection(NestedProjects) = preSolution {6302034E-DF8C-4B65-AC36-CED24C068999} = {1A6C93E7-24FD-47FD-883D-EDABF5CEE4C6} + {10FA1B6D-A9BE-443D-B166-F4363386A3E1} = {F135EC22-CF6C-4D43-95BC-2E58755E7DE4} EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {E0FA12DA-6B82-4E64-928A-BB9965E636C1} diff --git a/Cloudflare.sln.DotSettings b/Cloudflare.sln.DotSettings deleted file mode 100644 index 0b77682..0000000 --- a/Cloudflare.sln.DotSettings +++ /dev/null @@ -1,2 +0,0 @@ - - True \ No newline at end of file diff --git a/Cloudflare/Client/CloudflareClient.cs b/Cloudflare/Client/CloudflareClient.cs index ef5674b..d9efae5 100644 --- a/Cloudflare/Client/CloudflareClient.cs +++ b/Cloudflare/Client/CloudflareClient.cs @@ -1,10 +1,62 @@ -using System; -using System.Collections.Generic; -using System.Text; +using System.Net.Http.Headers; +using Cloudflare.Models.Cloudflare; +using Keyfactor.Logging; +using Microsoft.Extensions.Logging; +using Newtonsoft.Json; namespace Keyfactor.Extensions.Orchestrator.Cloudflare.Client { public class CloudflareClient { + private readonly ILogger _logger; + private readonly HttpClient _httpClient; + + public CloudflareClient(ILogger logger, string apiKey) + { + _logger = logger; + + _logger.MethodEntry(); + + _httpClient = new HttpClient(); + _httpClient.BaseAddress = new Uri("https://api.cloudflare.com"); + _httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", apiKey); + + _logger.LogTrace($"Authorization header: Bearer {apiKey}"); + + _logger.LogDebug($"Cloudflare HTTP client initialized with base address {_httpClient.BaseAddress.AbsoluteUri}"); + + _logger.MethodExit(); + } + + public async Task GetCertificatePacks(string zoneId, int page) + { + _logger.MethodEntry(); + + string endpoint = $"client/v4/zones/{zoneId}/ssl/certificate_packs?page={page}"; + + _logger.LogDebug($"Getting certificate packs for zone {zoneId} from endpoint {endpoint}. Page: {page}"); + + var request = new HttpRequestMessage(HttpMethod.Get, endpoint); + var response = await _httpClient.SendAsync(request); + + _logger.LogTrace($"Endpoint {endpoint} returned status code {response.StatusCode}"); + + var content = await response.Content.ReadAsStringAsync(); + + if (!response.IsSuccessStatusCode) + { + throw new Exception($"Failed to get certificate packs. Endpoint {endpoint} returned status code {response.StatusCode}. Error content: {content}"); + } + + _logger.LogTrace($"Response content returned: {content}"); + + var result = JsonConvert.DeserializeObject(content); + + _logger.LogDebug($"Successfully returned certificate packs for zone {zoneId}"); + + _logger.MethodExit(); + + return result; + } } } diff --git a/Cloudflare/Cloudflare.csproj b/Cloudflare/Cloudflare.csproj index 812cbce..9cfc119 100644 --- a/Cloudflare/Cloudflare.csproj +++ b/Cloudflare/Cloudflare.csproj @@ -1,9 +1,10 @@ - netcoreapp3.1 - Keyfactor.Extensions.Orchestrator.Cloudflare + true + net6.0;net8.0 true + enable @@ -12,9 +13,9 @@ - - - + + + @@ -23,9 +24,4 @@ - - - - - diff --git a/Cloudflare/Jobs/Inventory.cs b/Cloudflare/Jobs/Inventory.cs index 4e96f0e..6d35961 100644 --- a/Cloudflare/Jobs/Inventory.cs +++ b/Cloudflare/Jobs/Inventory.cs @@ -1,33 +1,140 @@ -using System; -using System.Collections.Generic; -using System.Management.Automation; -using System.Management.Automation.Runspaces; -using System.Net; -using System.Security; +using System.Security.Cryptography; +using Cloudflare.Service; +using Keyfactor.Extensions.Orchestrator.Cloudflare.Client; using Keyfactor.Logging; using Keyfactor.Orchestrators.Common.Enums; using Keyfactor.Orchestrators.Extensions; using Microsoft.Extensions.Logging; using Newtonsoft.Json; -namespace Keyfactor.Extensions.Orchestrator.Cloudflare.Jobs +namespace Keyfactor.Extensions.Orchestrator.CloudflareEdge.Jobs; + +public class Inventory : IInventoryJobExtension { - public class Inventory : IInventoryJobExtension + private readonly ILogger _logger; + private readonly CertificateRetrievalService _service; + private CloudflareClient _cloudflareClient; + + private const string CloudflareHost = "www.cloudflare.com"; + + public Inventory() + { + _logger = LogHandler.GetClassLogger(); + _service = new CertificateRetrievalService(_logger); + } + + public string ExtensionName => "Keyfactor.Extensions.Orchestrator.CloudflareEdge.Inventory"; + + public JobResult ProcessJob(InventoryJobConfiguration jobConfiguration, SubmitInventoryUpdate submitInventoryUpdate) { - private readonly ILogger _logger; + ConfigureClient(jobConfiguration); + + InventoryCertificateAsync(jobConfiguration, submitInventoryUpdate) + .GetAwaiter() + .GetResult(); - public Inventory(ILogger logger) => - _logger = logger; + return new JobResult() + { + Result = OrchestratorJobStatusJobResult.Success, + FailureMessage = "Successfully inventoried certificates from Cloudflare Edge.", + JobHistoryId = jobConfiguration.JobHistoryId, + }; + } - private JobResult PerformInventory(InventoryJobConfiguration config, SubmitInventoryUpdate submitInventory) + private async Task InventoryCertificateAsync(InventoryJobConfiguration jobConfiguration, + SubmitInventoryUpdate submitInventoryUpdate) + { + var zoneId = jobConfiguration.CertificateStoreDetails.StorePath; + + _logger.LogInformation($"Inventorying certificates for zone id {zoneId}"); + + int page = 1; + HashSet domains = new(); + List inventory = new (); + + while (true) { - return new JobResult(); + var result = await _cloudflareClient.GetCertificatePacks(zoneId, page); + + // Break out of loop if no results found + if (result.ResultInfo.Count == 0) + { + _logger.LogDebug($"No more certificate packs found after page {page - 1}"); + break; + } + + _logger.LogDebug($"Found {result.Result.Count} certificate packs on page {page}"); + + foreach (var certificatePack in result.Result) + { + foreach (var host in certificatePack.Hosts) + { + domains.Add(host); + } + } + + // Break out of loop if we've processed all pages + if (result.ResultInfo.TotalPages <= page) + { + _logger.LogDebug("All pages processed"); + break; + } + + + page++; + _logger.LogTrace($"Continuing to next page: {page}"); + + break; } - public string ExtensionName => "Cloudflare"; - public JobResult ProcessJob(InventoryJobConfiguration jobConfiguration, SubmitInventoryUpdate submitInventoryUpdate) + var filteredHosts = FilterDomains(domains); + + // Retrieve certificates for each filtered domain + foreach (var domain in filteredHosts) { - return PerformInventory(jobConfiguration, submitInventoryUpdate); + _logger.LogDebug($"Retrieving certificate for domain: {domain}"); + + var cert = await _service.GetCertificateAsync(domain, CloudflareHost); + _logger.LogTrace($"Retrieved certificate: {cert.Subject}"); + + var certBytes = cert.RawData; + var pem = PemEncoding.Write("CERTIFICATE", certBytes); + + inventory.Add(new CurrentInventoryItem + { + ItemStatus = OrchestratorInventoryItemStatus.Unknown, + PrivateKeyEntry = false, + Alias = domain, + Certificates = new List() + { + new(pem), + }, + }); } + + submitInventoryUpdate.Invoke(inventory); + + _logger.LogInformation($"Successfully completed inventory for zone id {zoneId}"); + + _logger.MethodExit(); + } + + /// + /// Filters out unwanted domains from the list, including "sni.cloudflaressl.com" and wildcard domains. + /// + /// + /// + private List FilterDomains(ISet domains) + { + return domains + .Where(p => p != "sni.cloudflaressl.com" + && !p.StartsWith("*.")) + .ToList(); + } + + private void ConfigureClient(InventoryJobConfiguration jobConfiguration) + { + var apiKey = jobConfiguration.ServerPassword; + _cloudflareClient = new CloudflareClient(_logger, apiKey); } -} \ No newline at end of file +} diff --git a/Cloudflare/Jobs/Management.cs b/Cloudflare/Jobs/Management.cs deleted file mode 100644 index 7365b8f..0000000 --- a/Cloudflare/Jobs/Management.cs +++ /dev/null @@ -1,44 +0,0 @@ -using System; -using System.Linq; -using System.Management.Automation; -using System.Management.Automation.Runspaces; -using System.Net; -using System.Security.Cryptography.X509Certificates; -using Keyfactor.Logging; -using Keyfactor.Orchestrators.Common.Enums; -using Keyfactor.Orchestrators.Extensions; -using Microsoft.Extensions.Logging; -using Newtonsoft.Json; - -namespace Keyfactor.Extensions.Orchestrator.Cloudflare.Jobs -{ - public class Management : IManagementJobExtension - { - private readonly ILogger _logger; - - private string _thumbprint = string.Empty; - - public Management(ILogger logger) - { - _logger = logger; - } - - public string ExtensionName => "Cloudflare"; - - public JobResult ProcessJob(ManagementJobConfiguration jobConfiguration) - { - return new JobResult(); - } - - private JobResult PerformRemoval(ManagementJobConfiguration config) - { - return new JobResult(); - - } - - private JobResult PerformAddition(ManagementJobConfiguration config,string thumpPrint) - { - return new JobResult(); - } - } -} \ No newline at end of file diff --git a/Cloudflare/Models/Cloudflare/GetCertificatePacksCertificateItem.cs b/Cloudflare/Models/Cloudflare/GetCertificatePacksCertificateItem.cs new file mode 100644 index 0000000..d28f870 --- /dev/null +++ b/Cloudflare/Models/Cloudflare/GetCertificatePacksCertificateItem.cs @@ -0,0 +1,37 @@ +#nullable enable +using Newtonsoft.Json; + +namespace Cloudflare.Models.Cloudflare; + +public class GetCertificatePacksCertificateItem +{ + [JsonProperty("id")] + public Guid Id { get; set; } + + [JsonProperty("hosts")] + public List Hosts { get; set; } = new(); + + [JsonProperty("issuer")] + public string? Issuer { get; set; } + + [JsonProperty("signature")] + public string? Signature { get; set; } + + [JsonProperty("status")] + public string Status { get; set; } = string.Empty; + + [JsonProperty("bundle_method")] + public string? BundleMethod { get; set; } + + [JsonProperty("zone_id")] + public string? ZoneId { get; set; } + + [JsonProperty("uploaded_on")] + public DateTimeOffset? UploadedOn { get; set; } + + [JsonProperty("modified_on")] + public DateTimeOffset? ModifiedOn { get; set; } + + [JsonProperty("expires_on")] + public DateTimeOffset? ExpiresOn { get; set; } +} diff --git a/Cloudflare/Models/Cloudflare/GetCertificatePacksResponse.cs b/Cloudflare/Models/Cloudflare/GetCertificatePacksResponse.cs new file mode 100644 index 0000000..85722a9 --- /dev/null +++ b/Cloudflare/Models/Cloudflare/GetCertificatePacksResponse.cs @@ -0,0 +1,53 @@ +#nullable enable +using Newtonsoft.Json; + +namespace Cloudflare.Models.Cloudflare; + +public class GetCertificatePacksResponse +{ + [JsonProperty("result")] + public List Result { get; set; } = new(); + + [JsonProperty("result_info")] + public ResultInfo ResultInfo { get; set; } = new(); + + [JsonProperty("success")] + public bool Success { get; set; } + + [JsonProperty("errors")] + public List Errors { get; set; } = new(); + + [JsonProperty("messages")] + public List Messages { get; set; } = new(); +} + +public class GetCertificatePackResultItem +{ + [JsonProperty("id")] + public Guid Id { get; set; } + + [JsonProperty("type")] + public string Type { get; set; } = string.Empty; + + [JsonProperty("hosts")] + public List Hosts { get; set; } = new(); + + [JsonProperty("primary_certificate")] + public Guid PrimaryCertificate { get; set; } + + [JsonProperty("status")] + public string Status { get; set; } = string.Empty; + + [JsonProperty("certificates")] + public List Certificates { get; set; } = new(); + + [JsonProperty("created_on")] + public DateTimeOffset CreatedOn { get; set; } + + [JsonProperty("validity_days")] + public int ValidityDays { get; set; } + + [JsonProperty("certificate_authority")] + public string CertificateAuthority { get; set; } = string.Empty; + +} diff --git a/Cloudflare/Models/Cloudflare/ResponseMetadata.cs b/Cloudflare/Models/Cloudflare/ResponseMetadata.cs new file mode 100644 index 0000000..ad5f29d --- /dev/null +++ b/Cloudflare/Models/Cloudflare/ResponseMetadata.cs @@ -0,0 +1,16 @@ +#nullable enable +using Newtonsoft.Json; + +namespace Cloudflare.Models.Cloudflare; + +public class ResponseMetadata +{ + [JsonProperty("code")] + public int Code { get; set; } + + [JsonProperty("message")] + public string Message { get; set; } = string.Empty; + + [JsonProperty("documentation_url")] + public string? DocumentationUrl { get; set; } +} diff --git a/Cloudflare/Models/Cloudflare/ResultInfo.cs b/Cloudflare/Models/Cloudflare/ResultInfo.cs new file mode 100644 index 0000000..5694fe1 --- /dev/null +++ b/Cloudflare/Models/Cloudflare/ResultInfo.cs @@ -0,0 +1,21 @@ +using Newtonsoft.Json; + +namespace Cloudflare.Models.Cloudflare; + +public class ResultInfo +{ + [JsonProperty("page")] + public int Page { get; set; } + + [JsonProperty("per_page")] + public int PerPage { get; set; } + + [JsonProperty("total_pages")] + public int TotalPages { get; set; } + + [JsonProperty("count")] + public int Count { get; set; } + + [JsonProperty("total_count")] + public int TotalCount { get; set; } +} \ No newline at end of file diff --git a/Cloudflare/RequestManager.cs b/Cloudflare/RequestManager.cs deleted file mode 100644 index 799135c..0000000 --- a/Cloudflare/RequestManager.cs +++ /dev/null @@ -1,10 +0,0 @@ -using System; -using System.Collections.Generic; -using System.Text; - -namespace Keyfactor.Extensions.Orchestrator.Cloudflare -{ - public class RequestManager - { - } -} diff --git a/Cloudflare/Service/CertificateRetrievalService.cs b/Cloudflare/Service/CertificateRetrievalService.cs new file mode 100644 index 0000000..707d023 --- /dev/null +++ b/Cloudflare/Service/CertificateRetrievalService.cs @@ -0,0 +1,98 @@ +#nullable enable +using System.Net; +using System.Net.Security; +using System.Net.Sockets; +using System.Security.Cryptography.X509Certificates; +using Microsoft.Extensions.Logging; + +namespace Cloudflare.Service; + +public class CertificateRetrievalService +{ + private readonly ILogger _logger; + + public CertificateRetrievalService(ILogger logger) + { + _logger = logger; + } + + public async Task GetCertificateAsync( + string domain, + string cloudflareHost = "www.cloudflare.com") + { + // Resolve Cloudflare IP + var hostEntry = await Dns.GetHostEntryAsync(cloudflareHost); + var cloudflareIp = hostEntry.AddressList.FirstOrDefault() + ?? throw new Exception($"Could not resolve {cloudflareHost}"); + + _logger.LogDebug($"Connecting to {cloudflareIp} for domain {domain}"); + + X509Certificate2? certificate = null; + X509Chain? chain = null; + + using var tcpClient = new TcpClient(); + await tcpClient.ConnectAsync(cloudflareIp, 443); + + await using var sslStream = new SslStream( + tcpClient.GetStream(), + leaveInnerStreamOpen: false, + userCertificateValidationCallback: (sender, cert, certChain, errors) => + { + if (cert != null) + { + certificate = new X509Certificate2(cert); + chain = certChain; + } + return true; // Accept for inspection + }); + + await sslStream.AuthenticateAsClientAsync( + targetHost: domain, + clientCertificates: null, + checkCertificateRevocation: false); + + if (certificate == null) + { + throw new Exception("Failed to retrieve certificate"); + } + + return certificate; + } + + public async Task GetCertificateChainAsync( + string domain, + string cloudflareHost = "www.cloudflare.com") + { + var hostEntry = await Dns.GetHostEntryAsync(cloudflareHost); + var cloudflareIp = hostEntry.AddressList.FirstOrDefault() + ?? throw new Exception($"Could not resolve {cloudflareHost}"); + + X509Certificate2Collection? chainCollection = null; + + using var tcpClient = new TcpClient(); + await tcpClient.ConnectAsync(cloudflareIp, 443); + + using var sslStream = new SslStream( + tcpClient.GetStream(), + leaveInnerStreamOpen: false, + userCertificateValidationCallback: (sender, cert, chain, errors) => + { + if (chain != null) + { + chainCollection = new X509Certificate2Collection(); + foreach (var element in chain.ChainElements) + { + chainCollection.Add(element.Certificate); + } + } + return true; + }); + + await sslStream.AuthenticateAsClientAsync( + targetHost: domain, + clientCertificates: null, + checkCertificateRevocation: false); + + return chainCollection ?? new X509Certificate2Collection(); + } +} diff --git a/Cloudflare/manifest.json b/Cloudflare/manifest.json index 81d7653..f3cd757 100644 --- a/Cloudflare/manifest.json +++ b/Cloudflare/manifest.json @@ -1,13 +1,9 @@ { "extensions": { "Keyfactor.Orchestrators.Extensions.IOrchestratorJobExtension": { - "CertStores.IISBindings.Inventory": { - "assemblypath": "IISWithBindings.dll", - "TypeFullName": "Keyfactor.Extensions.Orchestrator.IISWithBinding.Jobs.Inventory" - }, - "CertStores.IISBindings.Management": { - "assemblypath": "IISWithBindings.dll", - "TypeFullName": "Keyfactor.Extensions.Orchestrator.IISWithBinding.Jobs.Management" + "CertStores.CloudflareEdge.Inventory": { + "assemblypath": "Cloudflare.dll", + "TypeFullName": "Keyfactor.Extensions.Orchestrator.CloudflareEdge.Jobs.Inventory" } } } diff --git a/README.md.tpl b/README.md.tpl deleted file mode 100644 index 383563f..0000000 --- a/README.md.tpl +++ /dev/null @@ -1,96 +0,0 @@ -# {{ name }} -## {{ integration_type | capitalize }} - -{{ description }} - - -*** -**Cloudflare Orchestrator Configuration** - -**Overview** - - - -This agent implements three job types – Inventory, Management Add, and Management Remove. Below are the steps necessary to configure this AnyAgent. - - -**1. Create the New Certificate Store Type for the Cloudflare Orchestrator** - -In Keyfactor Command create a new Certificate Store Type similar to the one below: - -#### STORE TYPE CONFIGURATION -CONFIG ELEMENT | DESCRIPTION -------------------|------------------ -Name |Descriptive name for the Store Type -Short Name |The short name that identifies the registered functionality of the orchestrator. Must be IISWBin -Custom Capability|Store type name orchestrator will register with. Must be "IISBindings". -Needs Server |Must be checked -Blueprint Allowed |Unchecked -Requires Store Password |Determines if a store password is required when configuring an individual store. This must be unchecked. -Supports Entry Password |Determined if an individual entry within a store can have a password. This must be unchecked. -Supports Custom Alias |Determines if an individual entry within a store can have a custom Alias. This must be Forbidden. -Uses PowerShell |Unchecked -Store Path Type |Determines what restrictions are applied to the store path field when configuring a new store. This must be Multiple Choice -Store Path Value|A comma separated list of options to select from for the Store Path. This, combined with the hostname, will determine the location used for the certificate store management and inventory. Must be My, WebHosting -Private Keys |This determines if Keyfactor can send the private key associated with a certificate to the store. This is required since IIS will need the private key material to establish TLS connections. -PFX Password Style |This determines how the platform generate passwords to protect a PFX enrollment job that is delivered to the store. This can be either Default (system generated) or Custom (user determined). -Job Types |Inventory, Add, and Remove are the supported job types. - - -**Advanced Settings:** - - -**Custom Fields:** - - - -Parameter Name|Parameter Type|Default Value|Required ----|---|---|--- -spnwithport|Boolean|false|No - - -**Entry Parameters:** -This section must be configured with binding fields. The parameters will be populated with the appropriate data when creating a new certificate store.
- -- **Site Name** – Required (Adding an entry, Removing an entry, Reenrolling an entry). The site name for the web site being bound to – i.e. "Default Web Site" -- **IP Address** – Required (Adding an entry, Removing an entry, Reenrolling an entry). The IP address for the web site being bound to. Default is "\*" for all IP Addresses. -- **Port** – Required (Adding an entry, Removing an entry, Reenrolling an entry). The port for the web site being bound to. Default is "443". -- **Host Name** – Optional. The host name for the web site being bound to. -- **Protocol** - Required (Adding an entry, Removing an entry, Reenrolling an entry) - - https - - http -- **Sni Flag** – Optional. Set the SNI flag associated with the binding being created. Default is "0". Acceptable values are: - - 0 - No SNI - - 1 - SNI Enabled - - 2 - Non SNI Binding - - 3 - SNI Binding - -Parameter Name|Parameter Type|Default Value|Required ----|---|---|--- -Port|String|443|Yes -IP Address|String|*|Yes -Host Name |String||No -Site Name |String|Default Web Site|Yes -Sni Flag |String|0 - No SNI|No -Protocol |Multiple Choice|https|Yes - -![](images/screen1-c.gif) - -**2. Register the Cloudflare Orchestrator with Keyfactor** -See Keyfactor InstallingKeyfactorOrchestrators.pdf Documentation. Get from your Keyfactor contact/representative. - -**3. Create an Cloudflare Certificate Store within Keyfactor Command** - -In Keyfactor Command create a new Certificate Store similar to the one below, selecting IIS With Binding as the Category and the parameters as described in "Create the New Certificate Store Type for the New IIS-With-Bindings AnyAgent". - -![](images/screen2.gif) - -#### STORE CONFIGURATION -CONFIG ELEMENT |DESCRIPTION -----------------|--------------- -Category |The type of certificate store to be configured. Select category based on the display name configured above. -Container |This is a logical grouping of like stores. This configuration is optional and does not impact the functionality of the store. -Client Machine |The hostname of the server to be managed. The Change Credentials option must be clicked to provide a username and password. This account will be used to manage the remote server via PowerShell. -Store Path |My or WebHosting -Orchestrator |This is the orchestrator server registered with the appropriate capabilities to manage this certificate store type. -Inventory Schedule |The interval that the system will use to report on what certificates are currently in the store. \ No newline at end of file diff --git a/integration-manifest.json b/integration-manifest.json index 4673202..0006dfd 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -1,7 +1,44 @@ { - "$schema": "https://keyfactor.github.io/integration-manifest-schema.json", + "$schema": "https://keyfactor.github.io/v2/integration-manifest-schema.json", "integration_type": "orchestrator", - "name": "Cloudflare Orchestrator", - "status": "Development", - "description": "" + "name": "Cloudflare Edge Orchestrator", + "status": "prototype", + "support_level": "kf-supported", + "update_catalog": true, + "link_github": false, + "release_project": "Cloudflare/Cloudflare.csproj", + "release_dir": "Cloudflare/bin/Release", + "description": "The Cloudflare Edge Orchestrator integration enables Keyfactor to inventory SSL/TLS certificates from Cloudflare's edge network.", + "about": { + "orchestrator": { + "UOFramework": "11.0", + "keyfactor_platform_version": "11.0", + "store_types": [ + { + "Name": "Cloudflare Edge", + "ShortName": "CloudflareEdge", + "LocalStore": false, + "SupportedOperations": { + "Add": false, + "Create": false, + "Discovery": false, + "Enrollment": false, + "Remove": false + }, + "EntryParameters": [], + "StorePathType": "", + "StorePathValue": "", + "PrivateKeyAllowed": "Forbidden", + "ClientMachineDescription": "The account identifier for the Cloudflare account to be used for connecting to the Cloudflare API.", + "StorePathDescription": "The zone identifier for the Cloudflare zone where the edge certificates are located.", + "JobProperties": [], + "ServerRequired": true, + "PowerShell": false, + "BlueprintAllowed": false, + "CustomAliasAllowed": "Forbidden", + "Properties": [] + } + ] + } + } } \ No newline at end of file From b49f459342a16c136942a64cc17d4246b7535621 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Tue, 16 Dec 2025 15:56:04 -0500 Subject: [PATCH 02/21] feat: add unit tests and cover exception cases Signed-off-by: Matthew H. Irby --- .../Cloudflare.UnitTests.csproj | 6 + Cloudflare.UnitTests/InventoryTests.cs | 402 +++++++++++++++++- .../example_responses/example_certificate.crt | 23 + Cloudflare/Client/CloudflareClient.cs | 26 +- Cloudflare/Client/ICloudflareClient.cs | 8 + Cloudflare/Cloudflare.csproj | 1 + .../CertificateRetrievalException.cs | 13 + .../Exceptions/CloudflareRequestException.cs | 13 + Cloudflare/Jobs/Inventory.cs | 189 ++++---- .../Service/CertificateRetrievalService.cs | 150 ++++--- .../Service/ICertificateRetrievalService.cs | 10 + 11 files changed, 688 insertions(+), 153 deletions(-) create mode 100644 Cloudflare.UnitTests/fixtures/example_responses/example_certificate.crt create mode 100644 Cloudflare/Client/ICloudflareClient.cs create mode 100644 Cloudflare/Exceptions/CertificateRetrievalException.cs create mode 100644 Cloudflare/Exceptions/CloudflareRequestException.cs create mode 100644 Cloudflare/Service/ICertificateRetrievalService.cs diff --git a/Cloudflare.UnitTests/Cloudflare.UnitTests.csproj b/Cloudflare.UnitTests/Cloudflare.UnitTests.csproj index aa44125..e07520f 100644 --- a/Cloudflare.UnitTests/Cloudflare.UnitTests.csproj +++ b/Cloudflare.UnitTests/Cloudflare.UnitTests.csproj @@ -26,4 +26,10 @@ + + + Always + + + diff --git a/Cloudflare.UnitTests/InventoryTests.cs b/Cloudflare.UnitTests/InventoryTests.cs index 5d742fb..72e4535 100644 --- a/Cloudflare.UnitTests/InventoryTests.cs +++ b/Cloudflare.UnitTests/InventoryTests.cs @@ -1,31 +1,417 @@ +using System.Security.Cryptography.X509Certificates; +using Cloudflare.Exceptions; +using Cloudflare.Models.Cloudflare; +using Cloudflare.Service; +using Keyfactor.Extensions.Orchestrator.Cloudflare.Client; using Keyfactor.Extensions.Orchestrator.CloudflareEdge.Jobs; +using Keyfactor.Orchestrators.Common.Enums; using Keyfactor.Orchestrators.Extensions; +using MartinCostello.Logging.XUnit; +using Microsoft.Extensions.Logging; using Moq; using Xunit; +using Xunit.Abstractions; +using Exception = System.Exception; namespace Cloudflare.UnitTests; public class InventoryTests { + private Mock _mockCertificateRetrievalService = new(); + private Mock _mockCloudflareClient = new(); + private readonly Mock _mockSubmitInventoryUpdate = new (); private readonly Inventory _sut; - public InventoryTests() + public InventoryTests(ITestOutputHelper output) + { + var loggerFactory = LoggerFactory.Create(builder => + builder.AddProvider(new XUnitLoggerProvider(output, new XUnitLoggerOptions())) + .SetMinimumLevel(LogLevel.Trace)); + var logger = loggerFactory.CreateLogger(); + + _sut = new Inventory(logger, _mockCloudflareClient.Object, _mockCertificateRetrievalService.Object); + } + + [Fact] + public async Task ProcessJob_SuccessfulRun_ReturnsJobSuccess() + { + // Arrange + var config = CreateTestConfiguration(); + + var certificatePack = new GetCertificatePacksResponse + { + ResultInfo = new ResultInfo + { + Count = 1, + TotalCount = 1, + PerPage = 1, + TotalPages = 1, + }, + Result = new List + { + new () + { + Hosts = new List { "test.example.com" }, + } + }, + }; + + var certificate = await LoadCertificateAsync("example_certificate.crt"); + + _mockCloudflareClient.Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ReturnsAsync(certificatePack); + + _mockCertificateRetrievalService.Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) + .ReturnsAsync(CreateX509Certificate(certificate)); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + AssertInventorySubmittedWith("test.example.com", certificate); + AssertJobSuccess(result, "Successfully inventoried certificates from Cloudflare Edge."); + } + + [Fact] + public async Task ProcessJob_NoCertificatePacks_ReturnsJobSuccess() + { + // Arrange + var config = CreateTestConfiguration(); + + var certificatePack = new GetCertificatePacksResponse + { + ResultInfo = new ResultInfo + { + Count = 0, + TotalCount = 0, + PerPage = 1, + TotalPages = 1, + }, + }; + _mockCloudflareClient.Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ReturnsAsync(certificatePack); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + AssertSubmittedInventoryCount(0); + AssertJobSuccess(result, "Successfully inventoried certificates from Cloudflare Edge."); + } + + [Fact] + public async Task ProcessJob_MultiPagedResponses_ReturnsAllCertificates() + { + // Arrange + var config = CreateTestConfiguration(); + + var certificatePack1 = new GetCertificatePacksResponse + { + ResultInfo = new ResultInfo + { + Count = 1, + TotalCount = 1, + PerPage = 1, + TotalPages = 2, + }, + Result = new List + { + new () + { + Hosts = new List { "test.example.com" }, + } + }, + }; + + var certificatePack2 = new GetCertificatePacksResponse + { + ResultInfo = new ResultInfo + { + Count = 1, + TotalCount = 1, + PerPage = 1, + TotalPages = 2, + }, + Result = new List + { + new () + { + Hosts = new List { "foo.example.com" }, + } + }, + }; + + var certificate = await LoadCertificateAsync("example_certificate.crt"); + + _mockCloudflareClient.SetupSequence(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ReturnsAsync(certificatePack1) + .ReturnsAsync(certificatePack2); + + _mockCertificateRetrievalService.Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) + .ReturnsAsync(CreateX509Certificate(certificate)); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + AssertSubmittedInventoryCount(2); + AssertInventorySubmittedWith("test.example.com", certificate); + AssertInventorySubmittedWith("foo.example.com", certificate); + AssertJobSuccess(result, "Successfully inventoried certificates from Cloudflare Edge."); + } + + [Theory] + [InlineData("*.example.com")] + [InlineData("sni.cloudflaressl.com")] + public async Task ProcessJob_HostsIncludesExcludedDomain_DoesNotInventoryExcludedDomain(string excludedDomains) + { + // Arrange + var config = CreateTestConfiguration(); + + var certificatePack = new GetCertificatePacksResponse + { + ResultInfo = new ResultInfo + { + Count = 1, + TotalCount = 1, + PerPage = 1, + TotalPages = 1, + }, + Result = new List + { + new () + { + Hosts = new List { "test.example.com", excludedDomains }, + } + }, + }; + + var certificate = await LoadCertificateAsync("example_certificate.crt"); + + _mockCloudflareClient.Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ReturnsAsync(certificatePack); + + _mockCertificateRetrievalService.Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) + .ReturnsAsync(CreateX509Certificate(certificate)); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + AssertSubmittedInventoryCount(1); + AssertInventorySubmittedWith("test.example.com", certificate); + // We should not find the excluded domain in the inventory + AssertJobSuccess(result, "Successfully inventoried certificates from Cloudflare Edge."); + } + + [Fact] + public async Task ProcessJob_CloudflareRequestExceptionThrown_ReturnsJobFailure() + { + // Arrange + var config = CreateTestConfiguration(); + + var exception = new CloudflareRequestException("Whoops!"); + + var certificate = await LoadCertificateAsync("example_certificate.crt"); + + _mockCloudflareClient.Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ThrowsAsync(exception); + + _mockCertificateRetrievalService.Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) + .ReturnsAsync(CreateX509Certificate(certificate)); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + AssertInventoryNotSubmitted(); + AssertJobFailure(result, exception.Message); + } + + [Fact] + public async Task ProcessJob_CertificateRetrievalExceptionThrown_ReturnsJobFailure() { - _sut = new Inventory(); + // Arrange + var config = CreateTestConfiguration(); + + var certificatePack = new GetCertificatePacksResponse + { + ResultInfo = new ResultInfo + { + Count = 1, + TotalCount = 1, + PerPage = 1, + TotalPages = 1, + }, + Result = new List + { + new () + { + Hosts = new List { "test.example.com" }, + } + }, + }; + + var exception = new CertificateRetrievalException("Whoops!"); + + _mockCloudflareClient.Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ReturnsAsync(certificatePack); + + _mockCertificateRetrievalService.Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) + .ThrowsAsync(exception); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + AssertInventoryNotSubmitted(); + AssertJobFailure(result, exception.Message); } [Fact] - public void ProcessJob() + public async Task ProcessJob_UnexpectedExceptionThrown_ReturnsJobFailure() { - var config = new InventoryJobConfiguration() + // Arrange + var config = CreateTestConfiguration(); + + var certificatePack = new GetCertificatePacksResponse { - CertificateStoreDetails = new CertificateStore() + ResultInfo = new ResultInfo + { + Count = 1, + TotalCount = 1, + PerPage = 1, + TotalPages = 1, + }, + Result = new List { - StorePath = "", + new () + { + Hosts = new List { "test.example.com" }, + } }, - ServerPassword = "", }; - _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + var exception = new Exception("Did not expected that to happen!"); + + _mockCloudflareClient.Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ReturnsAsync(certificatePack); + + _mockCertificateRetrievalService.Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) + .ThrowsAsync(exception); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + AssertInventoryNotSubmitted(); + AssertJobFailure(result, $"An unexpected error occurred while inventorying certificates from Cloudflare Edge: {exception.Message}"); } + + #region Assertions + + private void AssertJobSuccess(JobResult result, string expectedMessage) + { + Assert.NotNull(result); + + Assert.Equal(OrchestratorJobStatusJobResult.Success, result.Result); + Assert.Equal(expectedMessage, result.FailureMessage); + } + + private void AssertJobFailure(JobResult result, string expectedMessage) + { + Assert.NotNull(result); + + Assert.Equal(OrchestratorJobStatusJobResult.Failure, result.Result); + Assert.Equal(expectedMessage, result.FailureMessage); + } + + private void AssertInventoryNotSubmitted() + { + var invocations = _mockSubmitInventoryUpdate.Invocations; + + // Assert no calls were made to Command + Assert.Equal(0, invocations.Count); + } + + private void AssertSubmittedInventoryCount(int expectedCount) + { + var invocations = _mockSubmitInventoryUpdate.Invocations; + + // Assert only a single update call was made to Command + Assert.Equal(1, invocations.Count); + + var reportedInventory = invocations[0].Arguments[0] as List; + + Assert.NotNull(reportedInventory); + + Assert.True(expectedCount == reportedInventory!.Count, $"Expected inventory to be submitted with {expectedCount} certificate(s). Found: {reportedInventory!.Count} certificate(s)."); + } + + private void AssertInventorySubmittedWith(string expectedAlias, string expectedCertificate) + { + var invocations = _mockSubmitInventoryUpdate.Invocations; + + // Assert only a single update call was made to Command + Assert.Equal(1, invocations.Count); + + var reportedInventory = invocations[0].Arguments[0] as List; + + Assert.NotNull(reportedInventory); + Assert.NotEmpty(reportedInventory); + + var certificate = reportedInventory!.SingleOrDefault(p => p.Alias == expectedAlias); + + if (certificate == null) + { + Assert.True(false, $"Certificate alias {expectedAlias} not found in reported inventory. Found: {string.Join(", ", reportedInventory!.Select(p => p.Alias))}"); + } + + var match = certificate!.Certificates.SingleOrDefault(p => p == expectedCertificate); + + if (match == null) + { + Assert.True(false, $"Certificate data for alias {expectedAlias} does not match expected certificate. Expected {expectedCertificate}, Found: {string.Join("\n", certificate.Certificates)}"); + } + } + + #endregion + + + #region Test Data Helpers + private static async Task LoadCertificateAsync(string filename) + { + var path = Path.Combine( + Directory.GetCurrentDirectory(), + "fixtures", + "example_responses", + filename); + + return await File.ReadAllTextAsync(path); + } + + private static X509Certificate2 CreateX509Certificate(string pem) + { + var base64 = pem + .Replace("-----BEGIN CERTIFICATE-----", "") + .Replace("-----END CERTIFICATE-----", "") + .Replace("\r", "") + .Replace("\n", ""); + + return new X509Certificate2(Convert.FromBase64String(base64)); + } + + private static InventoryJobConfiguration CreateTestConfiguration() => + new() + { + CertificateStoreDetails = new CertificateStore + { + ClientMachine = "client-machine", + StorePath = "store-path" + }, + ServerPassword = "server-password" + }; + + #endregion } diff --git a/Cloudflare.UnitTests/fixtures/example_responses/example_certificate.crt b/Cloudflare.UnitTests/fixtures/example_responses/example_certificate.crt new file mode 100644 index 0000000..2bdf358 --- /dev/null +++ b/Cloudflare.UnitTests/fixtures/example_responses/example_certificate.crt @@ -0,0 +1,23 @@ +-----BEGIN CERTIFICATE----- +MIIDxjCCA22gAwIBAgIRAJgi/SMR6kXLEeLpfDQknT0wCgYIKoZIzj0EAwIwOzEL +MAkGA1UEBhMCVVMxHjAcBgNVBAoTFUdvb2dsZSBUcnVzdCBTZXJ2aWNlczEMMAoG +A1UEAxMDV0UxMB4XDTI1MTAzMDIxNTgyM1oXDTI2MDEyODIyNTgyMFowITEfMB0G +A1UEAxMWa2V5ZmFjdG9yLnNzbDRzYWFzLmNvbTBZMBMGByqGSM49AgEGCCqGSM49 +AwEHA0IABNLOaE112+Bzpbs7CJizgWKJ03UGF8Rf61osd0L9vQOzqCuUi1V22aGh +Vhjasw6PdaVaTt245zuZ6ZuGI0QJ0JKjggJqMIICZjAOBgNVHQ8BAf8EBAMCB4Aw +EwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUB9yN +3Mot1zBLn0pzyLtfg5gFZHEwHwYDVR0jBBgwFoAUkHeSNWfE/6jMqeZ72YB5e8yT ++TgwXgYIKwYBBQUHAQEEUjBQMCcGCCsGAQUFBzABhhtodHRwOi8vby5wa2kuZ29v +Zy9zL3dlMS9tQ0kwJQYIKwYBBQUHMAKGGWh0dHA6Ly9pLnBraS5nb29nL3dlMS5j +cnQwOwYDVR0RBDQwMoIWa2V5ZmFjdG9yLnNzbDRzYWFzLmNvbYIYKi5rZXlmYWN0 +b3Iuc3NsNHNhYXMuY29tMBMGA1UdIAQMMAowCAYGZ4EMAQIBMDYGA1UdHwQvMC0w +K6ApoCeGJWh0dHA6Ly9jLnBraS5nb29nL3dlMS8tWWo3T1lMNURuZy5jcmwwggEF +BgorBgEEAdZ5AgQCBIH2BIHzAPEAdgDRbqmlaAd+ZjWgPzel3bwDpTxBEhTUiBj1 +6TGzI8uVBAAAAZo3V/z7AAAEAwBHMEUCIBav1CofH/KQ5JtJFFMBHvqtxVoPtU/j +dPS0G6K6d+2+AiEA5dxXGJHnBt1OholEN+oAo3QpNOP6vhLXtwQyrLZXszEAdwAO +V5S8866pPjMbLJkHs/eQ35vCPXEyJd0hqSWsYcVOIQAAAZo3V/wYAAAEAwBIMEYC +IQDphq7DYbb2jU+IPg0ew0I3GBPYlfJ8JkBktyVSIX/R6wIhANXUsBauQYbEmJxZ +3pKF3Z9lYzP2UZyYQevD+LJJwanKMAoGCCqGSM49BAMCA0cAMEQCIFKLouxEBTEF +XBJDjB+YewHuGd12c3Kd5lxAm6XUk9ZyAiB4TlVYwbwx/ZuQYcU/P3Y0TmQDuXVq +ESKvqYI8cdAbxQ== +-----END CERTIFICATE----- \ No newline at end of file diff --git a/Cloudflare/Client/CloudflareClient.cs b/Cloudflare/Client/CloudflareClient.cs index d9efae5..519e12f 100644 --- a/Cloudflare/Client/CloudflareClient.cs +++ b/Cloudflare/Client/CloudflareClient.cs @@ -1,4 +1,5 @@ using System.Net.Http.Headers; +using Cloudflare.Exceptions; using Cloudflare.Models.Cloudflare; using Keyfactor.Logging; using Microsoft.Extensions.Logging; @@ -6,7 +7,7 @@ namespace Keyfactor.Extensions.Orchestrator.Cloudflare.Client { - public class CloudflareClient + public class CloudflareClient : ICloudflareClient { private readonly ILogger _logger; private readonly HttpClient _httpClient; @@ -36,16 +37,25 @@ public async Task GetCertificatePacks(string zoneId _logger.LogDebug($"Getting certificate packs for zone {zoneId} from endpoint {endpoint}. Page: {page}"); - var request = new HttpRequestMessage(HttpMethod.Get, endpoint); - var response = await _httpClient.SendAsync(request); + string content = null; - _logger.LogTrace($"Endpoint {endpoint} returned status code {response.StatusCode}"); - - var content = await response.Content.ReadAsStringAsync(); + try + { + var request = new HttpRequestMessage(HttpMethod.Get, endpoint); + var response = await _httpClient.SendAsync(request); + + content = await response.Content.ReadAsStringAsync(); - if (!response.IsSuccessStatusCode) + if (!response.IsSuccessStatusCode) + { + throw new CloudflareRequestException($"Failed to get certificate packs. Endpoint {endpoint} returned status code {response.StatusCode}. Error content: {content}"); + } + + _logger.LogTrace($"Endpoint {endpoint} returned status code {response.StatusCode}"); + } + catch (Exception ex) when (ex is not CloudflareRequestException) { - throw new Exception($"Failed to get certificate packs. Endpoint {endpoint} returned status code {response.StatusCode}. Error content: {content}"); + throw new CloudflareRequestException(ex); } _logger.LogTrace($"Response content returned: {content}"); diff --git a/Cloudflare/Client/ICloudflareClient.cs b/Cloudflare/Client/ICloudflareClient.cs new file mode 100644 index 0000000..eef4027 --- /dev/null +++ b/Cloudflare/Client/ICloudflareClient.cs @@ -0,0 +1,8 @@ +using Cloudflare.Models.Cloudflare; + +namespace Keyfactor.Extensions.Orchestrator.Cloudflare.Client; + +public interface ICloudflareClient +{ + Task GetCertificatePacks(string zoneId, int page); +} diff --git a/Cloudflare/Cloudflare.csproj b/Cloudflare/Cloudflare.csproj index 9cfc119..60aa3f7 100644 --- a/Cloudflare/Cloudflare.csproj +++ b/Cloudflare/Cloudflare.csproj @@ -15,6 +15,7 @@ + diff --git a/Cloudflare/Exceptions/CertificateRetrievalException.cs b/Cloudflare/Exceptions/CertificateRetrievalException.cs new file mode 100644 index 0000000..c0430a0 --- /dev/null +++ b/Cloudflare/Exceptions/CertificateRetrievalException.cs @@ -0,0 +1,13 @@ +namespace Cloudflare.Exceptions; + +public class CertificateRetrievalException : Exception +{ + public CertificateRetrievalException(string hostname) : base("Failed to retrieve the server certificate for host: " + hostname) + { + } + + public CertificateRetrievalException(string host, Exception innerException): base($"An error occurred while retrieving the server certificate for host {host}", innerException) + { + + } +} diff --git a/Cloudflare/Exceptions/CloudflareRequestException.cs b/Cloudflare/Exceptions/CloudflareRequestException.cs new file mode 100644 index 0000000..731daf2 --- /dev/null +++ b/Cloudflare/Exceptions/CloudflareRequestException.cs @@ -0,0 +1,13 @@ +namespace Cloudflare.Exceptions; + +public class CloudflareRequestException : Exception +{ + public CloudflareRequestException(string message) : base($"An error occurred sending request to Cloudflare: {message}") + { + } + + public CloudflareRequestException(Exception ex) : base("An error occurred sending request to Cloudflare", ex) + { + + } +} diff --git a/Cloudflare/Jobs/Inventory.cs b/Cloudflare/Jobs/Inventory.cs index 6d35961..1481372 100644 --- a/Cloudflare/Jobs/Inventory.cs +++ b/Cloudflare/Jobs/Inventory.cs @@ -1,26 +1,35 @@ using System.Security.Cryptography; +using Cloudflare.Exceptions; using Cloudflare.Service; using Keyfactor.Extensions.Orchestrator.Cloudflare.Client; using Keyfactor.Logging; using Keyfactor.Orchestrators.Common.Enums; using Keyfactor.Orchestrators.Extensions; using Microsoft.Extensions.Logging; -using Newtonsoft.Json; namespace Keyfactor.Extensions.Orchestrator.CloudflareEdge.Jobs; public class Inventory : IInventoryJobExtension { private readonly ILogger _logger; - private readonly CertificateRetrievalService _service; - private CloudflareClient _cloudflareClient; + private readonly ICertificateRetrievalService _certificateService; + private ICloudflareClient _cloudflareClient; private const string CloudflareHost = "www.cloudflare.com"; + // Default constructor used by Universal Orchestrator public Inventory() { _logger = LogHandler.GetClassLogger(); - _service = new CertificateRetrievalService(_logger); + _certificateService = new CertificateRetrievalService(_logger); + } + + // Constructor for dependency injection (used by unit tests) + public Inventory(ILogger logger, ICloudflareClient cloudflareClient, ICertificateRetrievalService certificateRetrievalService) + { + _logger = logger; + _cloudflareClient = cloudflareClient; + _certificateService = certificateRetrievalService; } public string ExtensionName => "Keyfactor.Extensions.Orchestrator.CloudflareEdge.Inventory"; @@ -29,94 +38,118 @@ public JobResult ProcessJob(InventoryJobConfiguration jobConfiguration, SubmitIn { ConfigureClient(jobConfiguration); - InventoryCertificateAsync(jobConfiguration, submitInventoryUpdate) + return InventoryCertificateAsync(jobConfiguration, submitInventoryUpdate) .GetAwaiter() .GetResult(); - - return new JobResult() - { - Result = OrchestratorJobStatusJobResult.Success, - FailureMessage = "Successfully inventoried certificates from Cloudflare Edge.", - JobHistoryId = jobConfiguration.JobHistoryId, - }; } - private async Task InventoryCertificateAsync(InventoryJobConfiguration jobConfiguration, + private async Task InventoryCertificateAsync(InventoryJobConfiguration jobConfiguration, SubmitInventoryUpdate submitInventoryUpdate) { - var zoneId = jobConfiguration.CertificateStoreDetails.StorePath; - - _logger.LogInformation($"Inventorying certificates for zone id {zoneId}"); - - int page = 1; - HashSet domains = new(); - List inventory = new (); - - while (true) + try { - var result = await _cloudflareClient.GetCertificatePacks(zoneId, page); + var zoneId = jobConfiguration.CertificateStoreDetails.StorePath; - // Break out of loop if no results found - if (result.ResultInfo.Count == 0) - { - _logger.LogDebug($"No more certificate packs found after page {page - 1}"); - break; - } - - _logger.LogDebug($"Found {result.Result.Count} certificate packs on page {page}"); + _logger.LogInformation($"Inventorying certificates for zone id {zoneId}"); + + int page = 1; + HashSet domains = new(); + List inventory = new(); - foreach (var certificatePack in result.Result) + while (true) { - foreach (var host in certificatePack.Hosts) + var result = await _cloudflareClient.GetCertificatePacks(zoneId, page); + + // Break out of loop if no results found + if (result.ResultInfo.Count == 0) { - domains.Add(host); + _logger.LogDebug($"No more certificate packs found after page {page - 1}"); + break; } + + _logger.LogDebug($"Found {result.Result.Count} certificate packs on page {page}"); + + foreach (var certificatePack in result.Result) + { + foreach (var host in certificatePack.Hosts) + { + domains.Add(host); + } + } + + // Break out of loop if we've processed all pages + if (result.ResultInfo.TotalPages <= page) + { + _logger.LogDebug("All pages processed"); + break; + } + + + page++; + _logger.LogTrace($"Continuing to next page: {page}"); } - - // Break out of loop if we've processed all pages - if (result.ResultInfo.TotalPages <= page) + + var filteredHosts = FilterDomains(domains); + + // Retrieve certificates for each filtered domain + foreach (var domain in filteredHosts) { - _logger.LogDebug("All pages processed"); - break; + _logger.LogDebug($"Retrieving certificate for domain: {domain}"); + + var cert = await _certificateService.GetHostCertificate(domain, CloudflareHost); + _logger.LogTrace($"Retrieved certificate: {cert.Subject}"); + + var certBytes = cert.RawData; + var pem = PemEncoding.Write("CERTIFICATE", certBytes); + + inventory.Add(new CurrentInventoryItem + { + ItemStatus = OrchestratorInventoryItemStatus.Unknown, + PrivateKeyEntry = false, + Alias = domain, + Certificates = new List() + { + new(pem), + }, + }); } - - - page++; - _logger.LogTrace($"Continuing to next page: {page}"); - - break; - } - var filteredHosts = FilterDomains(domains); + submitInventoryUpdate.Invoke(inventory); + + _logger.LogInformation($"Successfully completed inventory for zone id {zoneId}"); - // Retrieve certificates for each filtered domain - foreach (var domain in filteredHosts) + _logger.MethodExit(); + + return new JobResult + { + Result = OrchestratorJobStatusJobResult.Success, + FailureMessage = "Successfully inventoried certificates from Cloudflare Edge.", + JobHistoryId = jobConfiguration.JobHistoryId, + }; + } + catch (Exception ex) when (ex is CloudflareRequestException || ex is CertificateRetrievalException) { - _logger.LogDebug($"Retrieving certificate for domain: {domain}"); - - var cert = await _service.GetCertificateAsync(domain, CloudflareHost); - _logger.LogTrace($"Retrieved certificate: {cert.Subject}"); - - var certBytes = cert.RawData; - var pem = PemEncoding.Write("CERTIFICATE", certBytes); - - inventory.Add(new CurrentInventoryItem + _logger.LogError(ex, ex.Message); + + return new JobResult { - ItemStatus = OrchestratorInventoryItemStatus.Unknown, - PrivateKeyEntry = false, - Alias = domain, - Certificates = new List() - { - new(pem), - }, - }); + Result = OrchestratorJobStatusJobResult.Failure, + FailureMessage = ex.Message, + JobHistoryId = jobConfiguration.JobHistoryId, + }; } + catch (Exception ex) + { + _logger.LogError(ex, "An unexpected error occurred while inventorying certificates from Cloudflare Edge."); - submitInventoryUpdate.Invoke(inventory); - - _logger.LogInformation($"Successfully completed inventory for zone id {zoneId}"); + return new JobResult() + { + Result = OrchestratorJobStatusJobResult.Failure, + FailureMessage = $"An unexpected error occurred while inventorying certificates from Cloudflare Edge: {ex.Message}", + JobHistoryId = jobConfiguration.JobHistoryId, + }; + } - _logger.MethodExit(); } /// @@ -134,7 +167,19 @@ private List FilterDomains(ISet domains) private void ConfigureClient(InventoryJobConfiguration jobConfiguration) { - var apiKey = jobConfiguration.ServerPassword; - _cloudflareClient = new CloudflareClient(_logger, apiKey); + _logger.MethodEntry(); + + if (_cloudflareClient == null) + { + _logger.LogDebug($"Configuring Cloudflare client with provided API key."); + var apiKey = jobConfiguration.ServerPassword; + _cloudflareClient = new CloudflareClient(_logger, apiKey); + } + else + { + _logger.LogDebug($"Cloudflare client already configured."); + } + + _logger.MethodExit(); } } diff --git a/Cloudflare/Service/CertificateRetrievalService.cs b/Cloudflare/Service/CertificateRetrievalService.cs index 707d023..524754c 100644 --- a/Cloudflare/Service/CertificateRetrievalService.cs +++ b/Cloudflare/Service/CertificateRetrievalService.cs @@ -3,11 +3,13 @@ using System.Net.Security; using System.Net.Sockets; using System.Security.Cryptography.X509Certificates; +using Cloudflare.Exceptions; +using Keyfactor.Logging; using Microsoft.Extensions.Logging; namespace Cloudflare.Service; -public class CertificateRetrievalService +public class CertificateRetrievalService : ICertificateRetrievalService { private readonly ILogger _logger; @@ -16,83 +18,101 @@ public CertificateRetrievalService(ILogger logger) _logger = logger; } - public async Task GetCertificateAsync( + public async Task GetHostCertificate( string domain, string cloudflareHost = "www.cloudflare.com") { - // Resolve Cloudflare IP - var hostEntry = await Dns.GetHostEntryAsync(cloudflareHost); - var cloudflareIp = hostEntry.AddressList.FirstOrDefault() - ?? throw new Exception($"Could not resolve {cloudflareHost}"); - - _logger.LogDebug($"Connecting to {cloudflareIp} for domain {domain}"); - - X509Certificate2? certificate = null; - X509Chain? chain = null; - - using var tcpClient = new TcpClient(); - await tcpClient.ConnectAsync(cloudflareIp, 443); - - await using var sslStream = new SslStream( - tcpClient.GetStream(), - leaveInnerStreamOpen: false, - userCertificateValidationCallback: (sender, cert, certChain, errors) => - { - if (cert != null) - { - certificate = new X509Certificate2(cert); - chain = certChain; - } - return true; // Accept for inspection - }); - - await sslStream.AuthenticateAsClientAsync( - targetHost: domain, - clientCertificates: null, - checkCertificateRevocation: false); - - if (certificate == null) + try { - throw new Exception("Failed to retrieve certificate"); - } + _logger.MethodEntry(); + _logger.LogDebug($"Getting host certificate for domain {domain} via Cloudflare host {cloudflareHost}"); - return certificate; - } + // Resolve Cloudflare IP + var hostEntry = await Dns.GetHostEntryAsync(cloudflareHost); + var cloudflareIp = hostEntry.AddressList.FirstOrDefault() + ?? throw new Exception($"Could not resolve address list from host {cloudflareHost}"); - public async Task GetCertificateChainAsync( - string domain, - string cloudflareHost = "www.cloudflare.com") - { - var hostEntry = await Dns.GetHostEntryAsync(cloudflareHost); - var cloudflareIp = hostEntry.AddressList.FirstOrDefault() - ?? throw new Exception($"Could not resolve {cloudflareHost}"); + _logger.LogDebug($"Connecting to {cloudflareIp} for domain {domain}"); - X509Certificate2Collection? chainCollection = null; + X509Certificate2? certificate = null; + X509Chain? chain = null; - using var tcpClient = new TcpClient(); - await tcpClient.ConnectAsync(cloudflareIp, 443); + using var tcpClient = new TcpClient(); + await tcpClient.ConnectAsync(cloudflareIp, 443); - using var sslStream = new SslStream( - tcpClient.GetStream(), - leaveInnerStreamOpen: false, - userCertificateValidationCallback: (sender, cert, chain, errors) => - { - if (chain != null) + await using var sslStream = new SslStream( + tcpClient.GetStream(), + leaveInnerStreamOpen: false, + userCertificateValidationCallback: (sender, cert, certChain, errors) => { - chainCollection = new X509Certificate2Collection(); - foreach (var element in chain.ChainElements) + if (cert != null) { - chainCollection.Add(element.Certificate); + certificate = new X509Certificate2(cert); + chain = certChain; } - } - return true; - }); - await sslStream.AuthenticateAsClientAsync( - targetHost: domain, - clientCertificates: null, - checkCertificateRevocation: false); + return true; // Accept for inspection + }); + + await sslStream.AuthenticateAsClientAsync( + targetHost: domain, + clientCertificates: null, + checkCertificateRevocation: false); + + if (certificate == null) + { + throw new CertificateRetrievalException(domain); + } + + _logger.MethodExit(); - return chainCollection ?? new X509Certificate2Collection(); + return certificate; + } + catch (CertificateRetrievalException) + { + // Rethrow known exceptions + throw; + } + catch (Exception ex) + { + throw new CertificateRetrievalException(domain, ex); + } } + + // public async Task GetCertificateChainAsync( + // string domain, + // string cloudflareHost = "www.cloudflare.com") + // { + // var hostEntry = await Dns.GetHostEntryAsync(cloudflareHost); + // var cloudflareIp = hostEntry.AddressList.FirstOrDefault() + // ?? throw new Exception($"Could not resolve {cloudflareHost}"); + // + // X509Certificate2Collection? chainCollection = null; + // + // using var tcpClient = new TcpClient(); + // await tcpClient.ConnectAsync(cloudflareIp, 443); + // + // using var sslStream = new SslStream( + // tcpClient.GetStream(), + // leaveInnerStreamOpen: false, + // userCertificateValidationCallback: (sender, cert, chain, errors) => + // { + // if (chain != null) + // { + // chainCollection = new X509Certificate2Collection(); + // foreach (var element in chain.ChainElements) + // { + // chainCollection.Add(element.Certificate); + // } + // } + // return true; + // }); + // + // await sslStream.AuthenticateAsClientAsync( + // targetHost: domain, + // clientCertificates: null, + // checkCertificateRevocation: false); + // + // return chainCollection ?? new X509Certificate2Collection(); + // } } diff --git a/Cloudflare/Service/ICertificateRetrievalService.cs b/Cloudflare/Service/ICertificateRetrievalService.cs new file mode 100644 index 0000000..577e98e --- /dev/null +++ b/Cloudflare/Service/ICertificateRetrievalService.cs @@ -0,0 +1,10 @@ +using System.Security.Cryptography.X509Certificates; + +namespace Cloudflare.Service; + +public interface ICertificateRetrievalService +{ + Task GetHostCertificate( + string domain, + string cloudflareHost = "www.cloudflare.com"); +} From 1cc876828e93986a6c5fa23b65d91f67d3fa4ffe Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Tue, 16 Dec 2025 16:05:00 -0500 Subject: [PATCH 03/21] chore(tests): refactor unit tests Signed-off-by: Matthew H. Irby --- Cloudflare.UnitTests/InventoryTests.cs | 510 +++++++++++++------------ 1 file changed, 272 insertions(+), 238 deletions(-) diff --git a/Cloudflare.UnitTests/InventoryTests.cs b/Cloudflare.UnitTests/InventoryTests.cs index 72e4535..9d3b7da 100644 --- a/Cloudflare.UnitTests/InventoryTests.cs +++ b/Cloudflare.UnitTests/InventoryTests.cs @@ -17,11 +17,11 @@ namespace Cloudflare.UnitTests; public class InventoryTests { - private Mock _mockCertificateRetrievalService = new(); - private Mock _mockCloudflareClient = new(); - - private readonly Mock _mockSubmitInventoryUpdate = new (); + private readonly Mock _mockCertificateRetrievalService; + private readonly Mock _mockCloudflareClient; + private readonly Mock _mockSubmitInventoryUpdate; private readonly Inventory _sut; + private readonly string _testCertificatePem; public InventoryTests(ITestOutputHelper output) { @@ -30,357 +30,311 @@ public InventoryTests(ITestOutputHelper output) .SetMinimumLevel(LogLevel.Trace)); var logger = loggerFactory.CreateLogger(); + _mockCertificateRetrievalService = new Mock(); + _mockCloudflareClient = new Mock(); + _mockSubmitInventoryUpdate = new Mock(); + _sut = new Inventory(logger, _mockCloudflareClient.Object, _mockCertificateRetrievalService.Object); + + // Load test certificate once for all tests + _testCertificatePem = LoadCertificate("example_certificate.crt"); } [Fact] - public async Task ProcessJob_SuccessfulRun_ReturnsJobSuccess() + public void ProcessJob_SuccessfulRun_ReturnsJobSuccess() { // Arrange var config = CreateTestConfiguration(); - - var certificatePack = new GetCertificatePacksResponse - { - ResultInfo = new ResultInfo - { - Count = 1, - TotalCount = 1, - PerPage = 1, - TotalPages = 1, - }, - Result = new List - { - new () - { - Hosts = new List { "test.example.com" }, - } - }, - }; - - var certificate = await LoadCertificateAsync("example_certificate.crt"); - - _mockCloudflareClient.Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) - .ReturnsAsync(certificatePack); + SetupSuccessfulCertificatePackResponse("test.example.com"); + SetupSuccessfulCertificateRetrieval(); - _mockCertificateRetrievalService.Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) - .ReturnsAsync(CreateX509Certificate(certificate)); + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + result.ShouldBeSuccess("Successfully inventoried certificates from Cloudflare Edge."); + AssertInventoryContains("test.example.com", _testCertificatePem); + } + + [Fact] + public void ProcessJob_NoCertificatePacks_ReturnsJobSuccess() + { + // Arrange + var config = CreateTestConfiguration(); + SetupEmptyCertificatePackResponse(); // Act var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); // Assert - AssertInventorySubmittedWith("test.example.com", certificate); - AssertJobSuccess(result, "Successfully inventoried certificates from Cloudflare Edge."); + result.ShouldBeSuccess("Successfully inventoried certificates from Cloudflare Edge."); + AssertInventoryCount(0); } [Fact] - public async Task ProcessJob_NoCertificatePacks_ReturnsJobSuccess() + public void ProcessJob_MultiPagedResponses_ReturnsAllCertificates() { // Arrange var config = CreateTestConfiguration(); - - var certificatePack = new GetCertificatePacksResponse - { - ResultInfo = new ResultInfo - { - Count = 0, - TotalCount = 0, - PerPage = 1, - TotalPages = 1, - }, - }; - _mockCloudflareClient.Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) - .ReturnsAsync(certificatePack); + SetupPagedCertificatePackResponses( + new[] { "test.example.com" }, + new[] { "foo.example.com" } + ); + SetupSuccessfulCertificateRetrieval(); // Act var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); // Assert - AssertSubmittedInventoryCount(0); - AssertJobSuccess(result, "Successfully inventoried certificates from Cloudflare Edge."); + result.ShouldBeSuccess("Successfully inventoried certificates from Cloudflare Edge."); + AssertInventoryCount(2); + AssertInventoryContains("test.example.com", _testCertificatePem); + AssertInventoryContains("foo.example.com", _testCertificatePem); + } + + [Theory] + [InlineData("*.example.com")] + [InlineData("sni.cloudflaressl.com")] + public void ProcessJob_HostsIncludesExcludedDomain_DoesNotInventoryExcludedDomain(string excludedDomain) + { + // Arrange + var config = CreateTestConfiguration(); + SetupSuccessfulCertificatePackResponse("test.example.com", excludedDomain); + SetupSuccessfulCertificateRetrieval(); + + // Act + var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); + + // Assert + result.ShouldBeSuccess("Successfully inventoried certificates from Cloudflare Edge."); + AssertInventoryCount(1); + AssertInventoryContains("test.example.com", _testCertificatePem); + AssertInventoryDoesNotContain(excludedDomain); } [Fact] - public async Task ProcessJob_MultiPagedResponses_ReturnsAllCertificates() + public void ProcessJob_OnlyWildcardAndSniDomains_ReturnsEmptyInventory() { // Arrange var config = CreateTestConfiguration(); - - var certificatePack1 = new GetCertificatePacksResponse - { - ResultInfo = new ResultInfo - { - Count = 1, - TotalCount = 1, - PerPage = 1, - TotalPages = 2, - }, - Result = new List - { - new () - { - Hosts = new List { "test.example.com" }, - } - }, - }; - var certificatePack2 = new GetCertificatePacksResponse + var certificatePack = new GetCertificatePacksResponse { - ResultInfo = new ResultInfo - { - Count = 1, - TotalCount = 1, - PerPage = 1, - TotalPages = 2, - }, + ResultInfo = new ResultInfo { Count = 1, TotalCount = 1, PerPage = 1, TotalPages = 1 }, Result = new List { - new () - { - Hosts = new List { "foo.example.com" }, - } + new() { Hosts = new List { "*.example.com", "sni.cloudflaressl.com" } } }, }; - var certificate = await LoadCertificateAsync("example_certificate.crt"); - - _mockCloudflareClient.SetupSequence(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) - .ReturnsAsync(certificatePack1) - .ReturnsAsync(certificatePack2); - - _mockCertificateRetrievalService.Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) - .ReturnsAsync(CreateX509Certificate(certificate)); + _mockCloudflareClient + .Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ReturnsAsync(certificatePack); // Act var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); // Assert - AssertSubmittedInventoryCount(2); - AssertInventorySubmittedWith("test.example.com", certificate); - AssertInventorySubmittedWith("foo.example.com", certificate); - AssertJobSuccess(result, "Successfully inventoried certificates from Cloudflare Edge."); + Assert.Equal(OrchestratorJobStatusJobResult.Success, result.Result); + AssertInventoryCount(0); } - [Theory] - [InlineData("*.example.com")] - [InlineData("sni.cloudflaressl.com")] - public async Task ProcessJob_HostsIncludesExcludedDomain_DoesNotInventoryExcludedDomain(string excludedDomains) + [Fact] + public void ProcessJob_DuplicateHostsAcrossPages_InventoriesOnlyOnce() { // Arrange var config = CreateTestConfiguration(); - - var certificatePack = new GetCertificatePacksResponse + + var page1 = new GetCertificatePacksResponse { - ResultInfo = new ResultInfo + ResultInfo = new ResultInfo { Count = 1, TotalCount = 2, PerPage = 1, TotalPages = 2 }, + Result = new List { - Count = 1, - TotalCount = 1, - PerPage = 1, - TotalPages = 1, + new() { Hosts = new List { "test.example.com", "foo.example.com" } } }, + }; + + var page2 = new GetCertificatePacksResponse + { + ResultInfo = new ResultInfo { Count = 1, TotalCount = 2, PerPage = 1, TotalPages = 2 }, Result = new List { - new () - { - Hosts = new List { "test.example.com", excludedDomains }, - } + new() { Hosts = new List { "test.example.com", "bar.example.com" } } }, }; - var certificate = await LoadCertificateAsync("example_certificate.crt"); - - _mockCloudflareClient.Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) - .ReturnsAsync(certificatePack); + _mockCloudflareClient + .SetupSequence(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ReturnsAsync(page1) + .ReturnsAsync(page2); - _mockCertificateRetrievalService.Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) - .ReturnsAsync(CreateX509Certificate(certificate)); + SetupSuccessfulCertificateRetrieval(); // Act var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); // Assert - AssertSubmittedInventoryCount(1); - AssertInventorySubmittedWith("test.example.com", certificate); - // We should not find the excluded domain in the inventory - AssertJobSuccess(result, "Successfully inventoried certificates from Cloudflare Edge."); + Assert.Equal(OrchestratorJobStatusJobResult.Success, result.Result); + AssertInventoryCount(3); // test.example.com (once), foo.example.com, bar.example.com + + // Verify GetHostCertificate was only called 3 times (not 4) + _mockCertificateRetrievalService.Verify( + x => x.GetHostCertificate(It.IsAny(), It.IsAny()), + Times.Exactly(3)); } [Fact] - public async Task ProcessJob_CloudflareRequestExceptionThrown_ReturnsJobFailure() + public void ProcessJob_CloudflareRequestExceptionThrown_ReturnsJobFailure() { // Arrange var config = CreateTestConfiguration(); - var exception = new CloudflareRequestException("Whoops!"); - - var certificate = await LoadCertificateAsync("example_certificate.crt"); - - _mockCloudflareClient.Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) - .ThrowsAsync(exception); - _mockCertificateRetrievalService.Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) - .ReturnsAsync(CreateX509Certificate(certificate)); + _mockCloudflareClient + .Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ThrowsAsync(exception); // Act var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); // Assert + result.ShouldBeFailure(exception.Message); AssertInventoryNotSubmitted(); - AssertJobFailure(result, exception.Message); } [Fact] - public async Task ProcessJob_CertificateRetrievalExceptionThrown_ReturnsJobFailure() + public void ProcessJob_CertificateRetrievalExceptionThrown_ReturnsJobFailure() { // Arrange var config = CreateTestConfiguration(); - - var certificatePack = new GetCertificatePacksResponse - { - ResultInfo = new ResultInfo - { - Count = 1, - TotalCount = 1, - PerPage = 1, - TotalPages = 1, - }, - Result = new List - { - new () - { - Hosts = new List { "test.example.com" }, - } - }, - }; - var exception = new CertificateRetrievalException("Whoops!"); - - _mockCloudflareClient.Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) - .ReturnsAsync(certificatePack); - - _mockCertificateRetrievalService.Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) + + SetupSuccessfulCertificatePackResponse("test.example.com"); + _mockCertificateRetrievalService + .Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) .ThrowsAsync(exception); // Act var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); // Assert + result.ShouldBeFailure(exception.Message); AssertInventoryNotSubmitted(); - AssertJobFailure(result, exception.Message); } [Fact] - public async Task ProcessJob_UnexpectedExceptionThrown_ReturnsJobFailure() + public void ProcessJob_UnexpectedExceptionThrown_ReturnsJobFailure() { // Arrange var config = CreateTestConfiguration(); - - var certificatePack = new GetCertificatePacksResponse - { - ResultInfo = new ResultInfo - { - Count = 1, - TotalCount = 1, - PerPage = 1, - TotalPages = 1, - }, - Result = new List - { - new () - { - Hosts = new List { "test.example.com" }, - } - }, - }; - var exception = new Exception("Did not expected that to happen!"); - - _mockCloudflareClient.Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) - .ReturnsAsync(certificatePack); - - _mockCertificateRetrievalService.Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) + + SetupSuccessfulCertificatePackResponse("test.example.com"); + _mockCertificateRetrievalService + .Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) .ThrowsAsync(exception); // Act var result = _sut.ProcessJob(config, _mockSubmitInventoryUpdate.Object); // Assert + result.ShouldBeFailure($"An unexpected error occurred while inventorying certificates from Cloudflare Edge: {exception.Message}"); AssertInventoryNotSubmitted(); - AssertJobFailure(result, $"An unexpected error occurred while inventorying certificates from Cloudflare Edge: {exception.Message}"); } - #region Assertions - - private void AssertJobSuccess(JobResult result, string expectedMessage) + #region Mock Setup Helpers + + private void SetupSuccessfulCertificatePackResponse(params string[] hosts) { - Assert.NotNull(result); + var response = CertificatePackResponseBuilder.Create() + .WithHosts(hosts) + .Build(); + + _mockCloudflareClient + .Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ReturnsAsync(response); + } + + private void SetupEmptyCertificatePackResponse() + { + var response = CertificatePackResponseBuilder.CreateEmpty().Build(); - Assert.Equal(OrchestratorJobStatusJobResult.Success, result.Result); - Assert.Equal(expectedMessage, result.FailureMessage); + _mockCloudflareClient + .Setup(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())) + .ReturnsAsync(response); } - private void AssertJobFailure(JobResult result, string expectedMessage) + private void SetupPagedCertificatePackResponses(params string[][] hostsPerPage) { - Assert.NotNull(result); + var sequence = _mockCloudflareClient + .SetupSequence(p => p.GetCertificatePacks(It.IsAny(), It.IsAny())); - Assert.Equal(OrchestratorJobStatusJobResult.Failure, result.Result); - Assert.Equal(expectedMessage, result.FailureMessage); + foreach (var hosts in hostsPerPage) + { + var response = CertificatePackResponseBuilder.Create() + .WithPageInfo(totalPages: hostsPerPage.Length) + .WithHosts(hosts) + .Build(); + + sequence.ReturnsAsync(response); + } } + + private void SetupSuccessfulCertificateRetrieval() + { + _mockCertificateRetrievalService + .Setup(p => p.GetHostCertificate(It.IsAny(), It.IsAny())) + .ReturnsAsync(TestDataHelper.CreateX509Certificate(_testCertificatePem)); + } + + #endregion + + #region Assertions private void AssertInventoryNotSubmitted() { - var invocations = _mockSubmitInventoryUpdate.Invocations; - - // Assert no calls were made to Command - Assert.Equal(0, invocations.Count); + _mockSubmitInventoryUpdate.Verify( + x => x.Invoke(It.IsAny>()), + Times.Never); } - private void AssertSubmittedInventoryCount(int expectedCount) + private void AssertInventoryCount(int expectedCount) { - var invocations = _mockSubmitInventoryUpdate.Invocations; - - // Assert only a single update call was made to Command - Assert.Equal(1, invocations.Count); - - var reportedInventory = invocations[0].Arguments[0] as List; - - Assert.NotNull(reportedInventory); - - Assert.True(expectedCount == reportedInventory!.Count, $"Expected inventory to be submitted with {expectedCount} certificate(s). Found: {reportedInventory!.Count} certificate(s)."); + var inventory = GetSubmittedInventory(); + Assert.Equal(expectedCount, inventory.Count); } - private void AssertInventorySubmittedWith(string expectedAlias, string expectedCertificate) + private void AssertInventoryContains(string expectedAlias, string expectedCertificate) { - var invocations = _mockSubmitInventoryUpdate.Invocations; + var inventory = GetSubmittedInventory(); - // Assert only a single update call was made to Command - Assert.Equal(1, invocations.Count); + var certificate = inventory.SingleOrDefault(p => p.Alias == expectedAlias); + Assert.NotNull(certificate); - var reportedInventory = invocations[0].Arguments[0] as List; - - Assert.NotNull(reportedInventory); - Assert.NotEmpty(reportedInventory); + Assert.Contains(expectedCertificate, certificate!.Certificates); + } + + private void AssertInventoryDoesNotContain(string alias) + { + var inventory = GetSubmittedInventory(); + Assert.DoesNotContain(inventory, p => p.Alias == alias); + } + + private List GetSubmittedInventory() + { + _mockSubmitInventoryUpdate.Verify( + x => x.Invoke(It.IsAny>()), + Times.Once); - var certificate = reportedInventory!.SingleOrDefault(p => p.Alias == expectedAlias); - - if (certificate == null) - { - Assert.True(false, $"Certificate alias {expectedAlias} not found in reported inventory. Found: {string.Join(", ", reportedInventory!.Select(p => p.Alias))}"); - } - - var match = certificate!.Certificates.SingleOrDefault(p => p == expectedCertificate); - - if (match == null) - { - Assert.True(false, $"Certificate data for alias {expectedAlias} does not match expected certificate. Expected {expectedCertificate}, Found: {string.Join("\n", certificate.Certificates)}"); - } + var invocation = _mockSubmitInventoryUpdate.Invocations.Single(); + return (List)invocation.Arguments[0]; } #endregion - #region Test Data Helpers - private static async Task LoadCertificateAsync(string filename) + + private static string LoadCertificate(string filename) { var path = Path.Combine( Directory.GetCurrentDirectory(), @@ -388,18 +342,7 @@ private static async Task LoadCertificateAsync(string filename) "example_responses", filename); - return await File.ReadAllTextAsync(path); - } - - private static X509Certificate2 CreateX509Certificate(string pem) - { - var base64 = pem - .Replace("-----BEGIN CERTIFICATE-----", "") - .Replace("-----END CERTIFICATE-----", "") - .Replace("\r", "") - .Replace("\n", ""); - - return new X509Certificate2(Convert.FromBase64String(base64)); + return File.ReadAllText(path); } private static InventoryJobConfiguration CreateTestConfiguration() => @@ -415,3 +358,94 @@ private static InventoryJobConfiguration CreateTestConfiguration() => #endregion } + +#region Test Builders + +internal class CertificatePackResponseBuilder +{ + private int _count = 1; + private int _totalCount = 1; + private int _perPage = 1; + private int _totalPages = 1; + private List _hosts = new(); + + public static CertificatePackResponseBuilder Create() => new(); + + public static CertificatePackResponseBuilder CreateEmpty() + { + return new CertificatePackResponseBuilder + { + _count = 0, + _totalCount = 0, + _hosts = new List() + }; + } + + public CertificatePackResponseBuilder WithPageInfo(int count = 1, int totalCount = 1, int perPage = 1, int totalPages = 1) + { + _count = count; + _totalCount = totalCount; + _perPage = perPage; + _totalPages = totalPages; + return this; + } + + public CertificatePackResponseBuilder WithHosts(params string[] hosts) + { + _hosts = hosts.ToList(); + return this; + } + + public GetCertificatePacksResponse Build() + { + return new GetCertificatePacksResponse + { + ResultInfo = new ResultInfo + { + Count = _count, + TotalCount = _totalCount, + PerPage = _perPage, + TotalPages = _totalPages, + }, + Result = _hosts.Any() + ? new List + { + new() { Hosts = _hosts } + } + : null + }; + } +} + +internal static class TestDataHelper +{ + public static X509Certificate2 CreateX509Certificate(string pem) + { + var base64 = pem + .Replace("-----BEGIN CERTIFICATE-----", "") + .Replace("-----END CERTIFICATE-----", "") + .Replace("\r", "") + .Replace("\n", ""); + + return new X509Certificate2(Convert.FromBase64String(base64)); + } +} + +internal static class JobResultAssertions +{ + public static void ShouldBeSuccess(this JobResult result, string expectedMessage) + { + Assert.NotNull(result); + Assert.Equal(OrchestratorJobStatusJobResult.Success, result.Result); + Assert.Equal(expectedMessage, result.FailureMessage); + } + + public static void ShouldBeFailure(this JobResult result, string expectedMessage) + { + Assert.NotNull(result); + Assert.Equal(OrchestratorJobStatusJobResult.Failure, result.Result); + Assert.Equal(expectedMessage, result.FailureMessage); + } +} + +#endregion \ No newline at end of file From a530b19684c586fe2048ac4e266eddb361d0c75c Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Tue, 16 Dec 2025 16:41:28 -0500 Subject: [PATCH 04/21] feat(actions): add github actions Signed-off-by: Matthew H. Irby --- .github/actions/build-and-test.yaml | 30 +++++++++++++++++++ .../actions/keyfactor-starter-workflow.yaml | 27 +++++++++++++++++ docsource/content.md | 11 +++++++ 3 files changed, 68 insertions(+) create mode 100644 .github/actions/build-and-test.yaml create mode 100644 .github/actions/keyfactor-starter-workflow.yaml create mode 100644 docsource/content.md diff --git a/.github/actions/build-and-test.yaml b/.github/actions/build-and-test.yaml new file mode 100644 index 0000000..b379ccd --- /dev/null +++ b/.github/actions/build-and-test.yaml @@ -0,0 +1,30 @@ +run-name: Build and Test Solution - ${{ github.sha }} +name: Build and Test Solution + +on: + pull_request: + types: [opened, synchronize, reopened] + +jobs: + build-and-test-solution: + runs-on: ubuntu-latest + steps: + - name: Checkout Code + uses: actions/checkout@v4 + + - name: Setup .NET 8 + uses: actions/setup-dotnet@v4 + with: + dotnet-version: '8.0.x' + + - name: Add Keyfactor NuGet Source + run: dotnet nuget add source https://nuget.pkg.github.com/Keyfactor/index.json -n github -u ${{ github.actor }} -p ${{ secrets.V2BUILDTOKEN }} --store-password-in-clear-text + + - name: Restore Dependencies + run: dotnet restore + + - name: Build solution + run: dotnet build --no-restore --configuration Release + + - name: Run Unit Tests + run: dotnet test --configuration Release --no-build --logger "console;verbosity=detailed" \ No newline at end of file diff --git a/.github/actions/keyfactor-starter-workflow.yaml b/.github/actions/keyfactor-starter-workflow.yaml new file mode 100644 index 0000000..bd5f384 --- /dev/null +++ b/.github/actions/keyfactor-starter-workflow.yaml @@ -0,0 +1,27 @@ +name: Keyfactor Bootstrap Workflow + +on: + workflow_dispatch: + pull_request: + types: [opened, closed, synchronize, edited, reopened] + push: + create: + branches: + - 'release-*.*' + +jobs: + call-starter-workflow: + uses: keyfactor/actions/.github/workflows/starter.yml@v4 + with: + command_token_url: ${{ vars.COMMAND_TOKEN_URL }} + command_hostname: ${{ vars.COMMAND_HOSTNAME }} + command_base_api_path: ${{ vars.COMMAND_API_PATH }} + secrets: + token: ${{ secrets.V2BUILDTOKEN}} + gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }} + gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }} + scan_token: ${{ secrets.SAST_TOKEN }} + entra_username: ${{ secrets.DOCTOOL_ENTRA_USERNAME }} + entra_password: ${{ secrets.DOCTOOL_ENTRA_PASSWD }} + command_client_id: ${{ secrets.COMMAND_CLIENT_ID }} + command_client_secret: ${{ secrets.COMMAND_CLIENT_SECRET }} \ No newline at end of file diff --git a/docsource/content.md b/docsource/content.md new file mode 100644 index 0000000..2c1bbc9 --- /dev/null +++ b/docsource/content.md @@ -0,0 +1,11 @@ +## Overview + +The Cloudflare Edge Orchestrator Extension is an integration that can inventory [Cloudflare Edge certificates](https://developers.cloudflare.com/ssl/concepts/#edge-certificate). + +> IMPORTANT: In order for certificates to be inventoried, the Universal Orchestrator **must** be able to reach the server that hosts the certificate. Cloudflare's API does not return the certificate contents, so the Universal Orchestrator must pull the certificate from the server directly. + +### Authentication and Authorization + +When configuring the certificate store, the server password can be either an account API token or a user API token ([guide on how to create an API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/)). + +In order to read certificate pack information from the API, the API token must have at least `Account:SSL and Certificates:Read` privileges ([List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)). \ No newline at end of file From 7ee59025119be8c94bd87963300c7d6beb0333b5 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Thu, 18 Dec 2025 13:39:57 -0500 Subject: [PATCH 05/21] fix: update folder path for github actions Signed-off-by: Matthew H. Irby --- .../{actions/build-and-test.yaml => workflows/build-and-test.yml} | 0 .../keyfactor-starter-workflow.yml} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename .github/{actions/build-and-test.yaml => workflows/build-and-test.yml} (100%) rename .github/{actions/keyfactor-starter-workflow.yaml => workflows/keyfactor-starter-workflow.yml} (100%) diff --git a/.github/actions/build-and-test.yaml b/.github/workflows/build-and-test.yml similarity index 100% rename from .github/actions/build-and-test.yaml rename to .github/workflows/build-and-test.yml diff --git a/.github/actions/keyfactor-starter-workflow.yaml b/.github/workflows/keyfactor-starter-workflow.yml similarity index 100% rename from .github/actions/keyfactor-starter-workflow.yaml rename to .github/workflows/keyfactor-starter-workflow.yml From 03599ab3df9b63df1399949b0f903ed0a6ec8b2b Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Thu, 18 Dec 2025 13:43:33 -0500 Subject: [PATCH 06/21] fix(actions): add missing .net dependency Signed-off-by: Matthew H. Irby --- .github/workflows/build-and-test.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index b379ccd..eb2a365 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -12,6 +12,11 @@ jobs: - name: Checkout Code uses: actions/checkout@v4 + - name: Setup .NET 6 + uses: actions/setup-dotnet@v4 + with: + dotnet-version: '6.0.x' + - name: Setup .NET 8 uses: actions/setup-dotnet@v4 with: From 7a4b613abfe8452647c46cb053f3cb6e5e98b26a Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Fri, 2 Jan 2026 15:43:47 -0500 Subject: [PATCH 07/21] fix(ci): add missing integration manifest properties Signed-off-by: Matthew H. Irby --- .github/workflows/keyfactor-starter-workflow.yml | 10 +++++----- integration-manifest.json | 8 +++++++- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/.github/workflows/keyfactor-starter-workflow.yml b/.github/workflows/keyfactor-starter-workflow.yml index bd5f384..a02fe1e 100644 --- a/.github/workflows/keyfactor-starter-workflow.yml +++ b/.github/workflows/keyfactor-starter-workflow.yml @@ -13,9 +13,9 @@ jobs: call-starter-workflow: uses: keyfactor/actions/.github/workflows/starter.yml@v4 with: - command_token_url: ${{ vars.COMMAND_TOKEN_URL }} - command_hostname: ${{ vars.COMMAND_HOSTNAME }} - command_base_api_path: ${{ vars.COMMAND_API_PATH }} + command_token_url: ${{ vars.DOCTOOL_COMMAND_TOKEN_URL }} + command_hostname: ${{ vars.DOCTOOL_COMMAND_HOSTNAME }} + command_base_api_path: ${{ vars.DOCTOOL_COMMAND_BASE_API_PATH }} secrets: token: ${{ secrets.V2BUILDTOKEN}} gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }} @@ -23,5 +23,5 @@ jobs: scan_token: ${{ secrets.SAST_TOKEN }} entra_username: ${{ secrets.DOCTOOL_ENTRA_USERNAME }} entra_password: ${{ secrets.DOCTOOL_ENTRA_PASSWD }} - command_client_id: ${{ secrets.COMMAND_CLIENT_ID }} - command_client_secret: ${{ secrets.COMMAND_CLIENT_SECRET }} \ No newline at end of file + command_client_id: ${{ secrets.DOCTOOL_COMMAND_CLIENT_ID }} + command_client_secret: ${{ secrets.DOCTOOL_COMMAND_CLIENT_SECRET }} \ No newline at end of file diff --git a/integration-manifest.json b/integration-manifest.json index 0006dfd..2176791 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -17,6 +17,7 @@ { "Name": "Cloudflare Edge", "ShortName": "CloudflareEdge", + "Capability": "CloudflareEdge", "LocalStore": false, "SupportedOperations": { "Add": false, @@ -36,7 +37,12 @@ "PowerShell": false, "BlueprintAllowed": false, "CustomAliasAllowed": "Forbidden", - "Properties": [] + "Properties": [], + "PasswordOptions": { + "EntrySupported": false, + "StoreRequired": false, + "Style": "Default" + } } ] } From 96af0fd6c82b70b67ed035a7e3291365e19a1c98 Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Fri, 2 Jan 2026 20:45:50 +0000 Subject: [PATCH 08/21] Update generated docs --- README.md | 294 ++++++++++++++++++ docsource/cloudflareedge.md | 20 ++ ...udflareEdge-advanced-store-type-dialog.png | Bin 0 -> 37291 bytes ...CloudflareEdge-basic-store-type-dialog.png | Bin 0 -> 43996 bytes ...reEdge-custom-fields-store-type-dialog.png | Bin 0 -> 22554 bytes 5 files changed, 314 insertions(+) create mode 100644 README.md create mode 100644 docsource/cloudflareedge.md create mode 100644 docsource/images/CloudflareEdge-advanced-store-type-dialog.png create mode 100644 docsource/images/CloudflareEdge-basic-store-type-dialog.png create mode 100644 docsource/images/CloudflareEdge-custom-fields-store-type-dialog.png diff --git a/README.md b/README.md new file mode 100644 index 0000000..3e6aa0b --- /dev/null +++ b/README.md @@ -0,0 +1,294 @@ +

+ Cloudflare Edge Universal Orchestrator Extension +

+ +

+ +Integration Status: prototype +Release +Issues +GitHub Downloads (all assets, all releases) +

+ +

+ + + Support + + · + + Installation + + · + + License + + · + + Related Integrations + +

+ +## Overview + +The Cloudflare Edge Orchestrator Extension is an integration that can inventory [Cloudflare Edge certificates](https://developers.cloudflare.com/ssl/concepts/#edge-certificate). + +> IMPORTANT: In order for certificates to be inventoried, the Universal Orchestrator **must** be able to reach the server that hosts the certificate. Cloudflare's API does not return the certificate contents, so the Universal Orchestrator must pull the certificate from the server directly. + +### Authentication and Authorization + +When configuring the certificate store, the server password can be either an account API token or a user API token ([guide on how to create an API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/)). + +In order to read certificate pack information from the API, the API token must have at least `Account:SSL and Certificates:Read` privileges ([List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)). + + + +## Compatibility + +This integration is compatible with Keyfactor Universal Orchestrator version 11.0 and later. + +## Support +The Cloudflare Edge Universal Orchestrator extension is supported by Keyfactor. If you require support for any issues or have feature request, please open a support ticket by either contacting your Keyfactor representative or via the Keyfactor Support Portal at https://support.keyfactor.com. + +> If you want to contribute bug fixes or additional enhancements, use the **[Pull requests](../../pulls)** tab. + +## Requirements & Prerequisites + +Before installing the Cloudflare Edge Universal Orchestrator extension, we recommend that you install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command. + + + +## CloudflareEdge Certificate Store Type + +To use the Cloudflare Edge Universal Orchestrator extension, you **must** create the CloudflareEdge Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance. + + + +TODO Overview is a required section +TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + + + + + +#### Cloudflare Edge Requirements + +TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + + + +#### Supported Operations + +| Operation | Is Supported | +|--------------|------------------------------------------------------------------------------------------------------------------------| +| Add | 🔲 Unchecked | +| Remove | 🔲 Unchecked | +| Discovery | 🔲 Unchecked | +| Reenrollment | 🔲 Unchecked | +| Create | 🔲 Unchecked | + +#### Store Type Creation + +##### Using kfutil: +`kfutil` is a custom CLI for the Keyfactor Command API and can be used to create certificate store types. +For more information on [kfutil](https://github.com/Keyfactor/kfutil) check out the [docs](https://github.com/Keyfactor/kfutil?tab=readme-ov-file#quickstart) +
Click to expand CloudflareEdge kfutil details + + ##### Using online definition from GitHub: + This will reach out to GitHub and pull the latest store-type definition + ```shell + # Cloudflare Edge + kfutil store-types create CloudflareEdge + ``` + + ##### Offline creation using integration-manifest file: + If required, it is possible to create store types from the [integration-manifest.json](./integration-manifest.json) included in this repo. + You would first download the [integration-manifest.json](./integration-manifest.json) and then run the following command + in your offline environment. + ```shell + kfutil store-types create --from-file integration-manifest.json + ``` +
+ + +#### Manual Creation +Below are instructions on how to create the CloudflareEdge store type manually in +the Keyfactor Command Portal +
Click to expand manual CloudflareEdge details + + Create a store type called `CloudflareEdge` with the attributes in the tables below: + + ##### Basic Tab + | Attribute | Value | Description | + | --------- | ----- | ----- | + | Name | Cloudflare Edge | Display name for the store type (may be customized) | + | Short Name | CloudflareEdge | Short display name for the store type | + | Capability | CloudflareEdge | Store type name orchestrator will register with. Check the box to allow entry of value | + | Supports Add | 🔲 Unchecked | Indicates that the Store Type supports Management Add | + | Supports Remove | 🔲 Unchecked | Indicates that the Store Type supports Management Remove | + | Supports Discovery | 🔲 Unchecked | Indicates that the Store Type supports Discovery | + | Supports Reenrollment | 🔲 Unchecked | Indicates that the Store Type supports Reenrollment | + | Supports Create | 🔲 Unchecked | Indicates that the Store Type supports store creation | + | Needs Server | ✅ Checked | Determines if a target server name is required when creating store | + | Blueprint Allowed | 🔲 Unchecked | Determines if store type may be included in an Orchestrator blueprint | + | Uses PowerShell | 🔲 Unchecked | Determines if underlying implementation is PowerShell | + | Requires Store Password | 🔲 Unchecked | Enables users to optionally specify a store password when defining a Certificate Store. | + | Supports Entry Password | 🔲 Unchecked | Determines if an individual entry within a store can have a password. | + + The Basic tab should look like this: + + ![CloudflareEdge Basic Tab](docsource/images/CloudflareEdge-basic-store-type-dialog.png) + + ##### Advanced Tab + | Attribute | Value | Description | + | --------- | ----- | ----- | + | Supports Custom Alias | Forbidden | Determines if an individual entry within a store can have a custom Alias. | + | Private Key Handling | Forbidden | This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid. | + | PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) | + + The Advanced tab should look like this: + + ![CloudflareEdge Advanced Tab](docsource/images/CloudflareEdge-advanced-store-type-dialog.png) + + > For Keyfactor **Command versions 24.4 and later**, a Certificate Format dropdown is available with PFX and PEM options. Ensure that **PFX** is selected, as this determines the format of new and renewed certificates sent to the Orchestrator during a Management job. Currently, all Keyfactor-supported Orchestrator extensions support only PFX. + + ##### Custom Fields Tab + Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type: + + | Name | Display Name | Description | Type | Default Value/Options | Required | + | ---- | ------------ | ---- | --------------------- | -------- | ----------- | + + The Custom Fields tab should look like this: + + ![CloudflareEdge Custom Fields Tab](docsource/images/CloudflareEdge-custom-fields-store-type-dialog.png) + + + + +
+ +## Installation + +1. **Download the latest Cloudflare Edge Universal Orchestrator extension from GitHub.** + + Navigate to the [Cloudflare Edge Universal Orchestrator extension GitHub version page](https://github.com/Keyfactor/cloudflare-edge-orchestrator/releases/latest). Refer to the compatibility matrix below to determine the asset should be downloaded. Then, click the corresponding asset to download the zip archive. + + | Universal Orchestrator Version | Latest .NET version installed on the Universal Orchestrator server | `rollForward` condition in `Orchestrator.runtimeconfig.json` | `cloudflare-edge-orchestrator` .NET version to download | + | --------- | ----------- | ----------- | ----------- | + | Older than `11.0.0` | | | `net6.0` | + | Between `11.0.0` and `11.5.1` (inclusive) | `net6.0` | | `net6.0` | + | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `Disable` | `net6.0` || Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` | + | `11.6` _and_ newer | `net8.0` | | `net8.0` | + + Unzip the archive containing extension assemblies to a known location. + + > **Note** If you don't see an asset with a corresponding .NET version, you should always assume that it was compiled for `net6.0`. + +2. **Locate the Universal Orchestrator extensions directory.** + + * **Default on Windows** - `C:\Program Files\Keyfactor\Keyfactor Orchestrator\extensions` + * **Default on Linux** - `/opt/keyfactor/orchestrator/extensions` + +3. **Create a new directory for the Cloudflare Edge Universal Orchestrator extension inside the extensions directory.** + + Create a new directory called `cloudflare-edge-orchestrator`. + > The directory name does not need to match any names used elsewhere; it just has to be unique within the extensions directory. + +4. **Copy the contents of the downloaded and unzipped assemblies from __step 2__ to the `cloudflare-edge-orchestrator` directory.** + +5. **Restart the Universal Orchestrator service.** + + Refer to [Starting/Restarting the Universal Orchestrator service](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/StarttheService.htm). + + + +> The above installation steps can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions). + + + +## Defining Certificate Stores + + +TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + +TODO Certificate Store Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + + +### Store Creation + +#### Manually with the Command UI + +
Click to expand details + +1. **Navigate to the _Certificate Stores_ page in Keyfactor Command.** + + Log into Keyfactor Command, toggle the _Locations_ dropdown, and click _Certificate Stores_. + +2. **Add a Certificate Store.** + + Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form. + + | Attribute | Description | + | --------- |---------------------------------------------------------| + | Category | Select "Cloudflare Edge" or the customized certificate store name from the previous step. | + | Container | Optional container to associate certificate store with. | + | Client Machine | The account identifier for the Cloudflare account to be used for connecting to the Cloudflare API. | + | Store Path | The zone identifier for the Cloudflare zone where the edge certificates are located. | + | Orchestrator | Select an approved orchestrator capable of managing `CloudflareEdge` certificates. Specifically, one with the `CloudflareEdge` capability. | + +
+ + + +#### Using kfutil CLI + +
Click to expand details + +1. **Generate a CSV template for the CloudflareEdge certificate store** + + ```shell + kfutil stores import generate-template --store-type-name CloudflareEdge --outpath CloudflareEdge.csv + ``` +2. **Populate the generated CSV file** + + Open the CSV file, and reference the table below to populate parameters for each **Attribute**. + + | Attribute | Description | + | --------- | ----------- | + | Category | Select "Cloudflare Edge" or the customized certificate store name from the previous step. | + | Container | Optional container to associate certificate store with. | + | Client Machine | The account identifier for the Cloudflare account to be used for connecting to the Cloudflare API. | + | Store Path | The zone identifier for the Cloudflare zone where the edge certificates are located. | + | Orchestrator | Select an approved orchestrator capable of managing `CloudflareEdge` certificates. Specifically, one with the `CloudflareEdge` capability. | + +3. **Import the CSV file to create the certificate stores** + + ```shell + kfutil stores import csv --store-type-name CloudflareEdge --file CloudflareEdge.csv + ``` + +
+ + + +> The content in this section can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store). + + +## Discovering Certificate Stores with the Discovery Job + +### Cloudflare Edge Discovery Job +TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + + +TODO Discovery Job Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + + + + +## License + +Apache License 2.0, see [LICENSE](LICENSE). + +## Related Integrations + +See all [Keyfactor Universal Orchestrator extensions](https://github.com/orgs/Keyfactor/repositories?q=orchestrator). \ No newline at end of file diff --git a/docsource/cloudflareedge.md b/docsource/cloudflareedge.md new file mode 100644 index 0000000..d53d056 --- /dev/null +++ b/docsource/cloudflareedge.md @@ -0,0 +1,20 @@ +## Overview + +TODO Overview is a required section + +## Requirements + +TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + +## Discovery Job Configuration + +TODO Discovery Job Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + +## Certificate Store Configuration + +TODO Certificate Store Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + +## Global Store Type Section + +TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + diff --git a/docsource/images/CloudflareEdge-advanced-store-type-dialog.png b/docsource/images/CloudflareEdge-advanced-store-type-dialog.png new file mode 100644 index 0000000000000000000000000000000000000000..ce89bb7a175d021eb59b223ad188ed43b2528b62 GIT binary patch literal 37291 zcmc$_bx>SS*YC?OMt}ez5C|R|f=h6iAi*s-3=-T2cMC~?;LZdFC%8L<3JiRgeT9)-X@a@Rwtr(MrsC2tu z09}?v(vAmV`2xt8%9j+bv2VdjXVDg*9pIoQ_=13w+~mn zfQ!pZ)GB^pqsu1tKNuKa7Wz*%2X#ty2}nuhjaSSX7J7Sn5)~K*tDm4J0Aix(6{3i~ zJ!%8c(ykf7M`S)f#=uz2u>LUlGkVm|*Kwr#w`Emi!+IXKLOQp;2fFMCA7VHIF_cLFg zQ`aBx_;LEpE8AbQI#@N6*B5DHuX((`9IaX$%lnE8+te0!-8f-}Iz%SdUI& zp&W$^6J2?yhweay>x_}ifH>PwCT075%=e~4`iSo-N6SdOM{b_F3OWP0n zbjhIcJ7aj%-fJ=N!(&-D)u3I!%d_Gb;XVEmkQY|{*$u?ANPAg#G2_(OQRtsP9F_Ln zbYz=d#>nID3(iMXhxqorT>|dM4OF+~X8|sRplnCK!e%Jcj5he0KDqvqPYT;lKU|rm z?HI&BX_e|=S5=S^(|urXaL+*MS#j}wQ#Z?kb;b0An7_JHSAJ*IKtR)FR^QLQ_AZ*< zU`3UclAT}G4S4%>&%+|=^&HN6S<1eXmfK~k9aBzsJZXP zt%igj0Q>AyUv3|EMC^E-JB9jtHRjI4A+?6r)1e-yyxf$8Aj)i&A2FX~;%PiR_n+Q= z;j(GWW#nbL8S0Px8B7A2lBc_cU${8^a&iCVa#LHi`e3pW@m5c=g_dWi%}#Gfm{gBU zYAN|+#6h-V($jTWK3bzT`OKehaS%r^x8JtV&m_g0qRzi~SRRg>xNdyhvN|WYl|YXr zxci}c13~T0RS(fyJ=!bHJ6*NP+}RRAqy)$TwMQ708-7*y7M;MY{<-qof*BT^C$gyF zhy_Rf%6|5@u++WBFr-(f%;5ZrccEHYyY~%N zs(-?;?1g>4*g}aW`HN<3vZn2%$5LQBY}>oT`?uZ6#g~AqSzgB^5)yFR^+=mXz?_#H z^&!xBuC1vw(YiMSMGwtSfELPc{(m+P)ehL^o^X3gPoJ$2#Njjhh_un(f6C8 zF!d^AVW3qjQ+=V0C(<&(>+?oGb_8z)V$)~M6``~)jR!&Hh1K` z3W3>p^W(_wre<6QtbAI0xxIg<)qNd3=9OZT>9nYDo=g^KzQ8JgeG8!|&4M@q0_8gJp~UL-h5~gV#zw4w;9@Ga1?D z7||Mar1Z$sl_IiAbMdXV>(AC}AB;ieTnP99dAZuP@C++izLvv?f^Inaj)uUjwYO2R2IYgNpRRI+=`!Rr&^cYsxg5`RG)fR5SnZP8F$--=Xy@czQI5c57N$nmMpGD>;w01#L4D3L4H^H zk0FbGBF$~Nze(n$vsHhnsxeBZ*-^aN&*IJ?<}KqEaf7aHf}`u7O*G5~WFyCdXK-%D z?106&2+Q^Qp&q11PEF_9f%V~7@1oO_#jLh6ypI_F`!_GF$jP0(%iE?BC!m`D3or?rmm1%@Xs*}|wJ>O}LL6L9S^ zF!h>@rjq(?!v^ERJYO~EbK`OeWPj7o%DyXeV?~G?pMYw!NZ8i+xH<}~7we;_HyC<> zzXC{R*sq+c=wEx75r}@G&PVHv>c0fk29A00IrmM#eZPHu0R?j2g0U3ls^42~k(lca zU91VLum!xQ^G=_j4&06udNBM*Z%OHk>O}VjUD3H&c9mVOe3F{~J80_7zThWU8o5j@ zZ7r?yy)9)~RNKfU{`Eo%y>Qw1!)^g}X8%tivX{`^;Sp7UD3n21tupsW1aM!wonBU* zvV?Q?{58?l>08ObLgY7mfT&J#{ssHCz353un_U*_k(e+{KZMbo((d{T6@-4JzV~4G zJ&AQ3UBb$qTZW>}RYTE;Ey2a5cJ+`aok27}QQTAv0&i5Se3ccFSeI+9gv?osPjqu;#c>ftdhp(s|A?>Hx(5VT)846%SZV3#@T?{ zg#w~x#)8iyQt8t8TBz$sxqwQk^~n-_@jEqLFn7Co zW)paI7}`eJc+FIE58|j+h+aPrrnRo8Hp~lEOynB!Ok-o1#?;W*Uo8G7BGXcLY^pL4s-6lz$S5T<{nIa+$ zTF=$I%TY~Pmy)isZBB-3R0-W0Sn|-&8vgD+^Zocqf$PUU?c=K%bi^UTWFwfM?+Z73 zt7Rqr3oC(w!wuD~(5iLeeHq4IZ8?_(7e6Om&NhEBO|jZk9A`YzIL$*mcz0O@%Kiai z>Q{AIKp{ItBq}z}&iYx4B&on9S1Q{Z(&j%XrNT+PO~zhn8I=I~5TGjG;!P{^H+NH6 z&||-To(E^j9l;~&gcud2=*txsE+mbXm6jGIu?*%#a;rPDlRwX*KTPUsV`=a2lJ{I` zz-LuZlNEvLmkH6ph(icEbP4N=97tM{m;ec`hB+V*m+N!E z5mPy8*6#pFakG(ctMDTr&Q(#W-~<4j6y1MvoR(A72A z6G25*GXm&XJ=oc4Js;EFiN6C!jUdMmN0rZLfnW-1A%Eo6#s(5E?az*TKk{Mh!kB&O z=I{D-M7HAv#HLe3UUXle^x!KJm{HXUIp3tl@ByP;`{_b|wDl*b@#{Sc+ zfr#&%GBB=R191@jBRQC3DgD^&zIFX|%ujtJskLv*Srp+6D75C%5;R7PSBjcG4o+jz z-ZBsgY?lydxDmd^&ByKObaW6Cg&*yB2&OHSf%Qf7*!&0aFAgZ4wWm^h%n9L-NgSJR!RgIoj| zkNON7K#?-_N3JrHcksUa&D4W-EWD`L@tZ3uC<%6B)?bg^I2t(1BUY&+T5r+3x(d)! zO}|-LAC3mxHzCVz`-UIz;CH;fiTrtwRWDw6rj_hAdITIjC4&oR`^#-j9>0FFbmOVd zJp3fE6ko6jQ)V`JcyVfH>?IZsWSgVMZyb>K=XdsLS$Emb#S01&3MnwF5!}V??$gzn z_0y_}<;rpw<;LlVy|MY|wZrbMdy=xG*?VSM`@7|ZhgFvS7nhgD zlk9u@yXWs=HwAv(%A#w2{=WyhrpJ>mjEqD0+#LPg&)*wErIy}vl12;fFkAR&&&;?> zWD^9@7S)WTr&OJJG4$)uF)K*`(?>{OQ@eP2Hs1qUU**0fdG~m<`lDl!@OoQBsAc9B?r_88yM z&-oTyu&4jHYPdYMTHyR@#;>=ADez8dwb{|97{BNBo=B1+UsF}L9~l>@rrS^uZE3Fz$%DqP-vr#qhird+WHfRuQaCjV((v5K zC)ezAY1_gf06Uwz$qO~cMfuUe{Yf}?O_(@8!S~{`!Zr*+jGjF z@NL)!xU46rie7Xn=94c)ixOy_4Q$+5cm@WdBw@*& zruF&Pj?z>xr!HOBe&x2;DD;^tgMlS`v=85PKU)S`Z7e1)XaQR%$mdcscgaR}J!9HRFB8 zODcxv;n0!8kWP~58@oR+10AQ0G!!q(q7l{Z!T>u3dP|6~;pm99-3FRJ#4OdsXiv^9 zf84eN8Qu;t^{SxRy>SVa1w`7^x69vN5#G_yUcgR;oso&%44jyavzd~=S9GG@ko&&*J2W>f|uKb8g2UHb1%q~Cc zs-%Ut%?*dGTExONe_G#?#o>a`?r~rF<^-EjlrXz{H)o4N?c~xfZcNt#S-<`VO#Ca78 z+N}b#d9JhS-!cab9>h@=tNZ|+PyY!EQ*0mWDvkVb=y>@2ar@HR!w*LpQKuz27{IR_ zIxA2ylyQZunWtMIfn&icY*tiru!aFQhbV2Wra)ROE&5-S4t^_sf;M-T8NEHX&fk(2 z2BRq_ZUd`nnT3rqwWcRr*w|@!j-@AYZ?bKC>#mGf06KL5b{1|Ug2M$LHR)Pm8kUk$ zzXe2wL?MPXEBM5%Ko`z{eN z`3#X@CjG6Wm&bUHn;Rwj<(W(-CA`Z%sC%=}i8Exl&80t1@4Ne* zTC;Zs&ytk2zeHQeUa{7<4*0nQs^2BjNsro3JeX}I`09)@In%j^uGp|aN?)-zIc{&6 zk(Q98&6)3ggLk+~Pi$y}Og>?m9I#mUE`ua1adagKu5riKWWtt&& zcdh5+H?`7>C%70nK|>+UJ=TGq4Y_R%xvNp__`yuStmw07a52{YHgy-)%r|b1b=BZx zhuz{Auy+`1V`5wlES{~5K6_a*CKue{DP>$p%iTI)kQCJQ48!@im^GSAHi#^KLnFwy zjQ=aNe9S|R=A0D&UpVK#9(l6tdnEQ>MD%&-IQ{=C6#b9;{||=rzk6g+5u}qF-Q*Ah zKr_>qP=`nl2!Dk>^yGqNYHX8kwA27<>zZzsxVUr!xfF%bEWiU>uhH<7oN8tI05*UA z7ac3c&Of{*ZFmRzW&*B4Y-w-^`b@4CpVa>3I!Vd`KZj^Z2CZ9OTej`La2I&fAa>d~ z5co*I3R2qOrp2{a&krOy^~qUDy}uf;6GP)tqLeFzX-GwvZ2Uq(vkBN%2CCC@C_(lXV-VY%2~ zyh~35+o5@Td4Pxg(H=zjTW;&N-MgmAS8fB{qCc~dyWP;6A6a2o5=^MU0S8qjNpHqr}C-KE?Fjm$7$U3fi~ z$LlFWL|gt}zRTgu>u^yP?rS;Qr4V5~WmD%CiRKo0y_mSQ{0(?Y2PU;E`c-z19q7w^ z{7$niw|_d)qHH?(rxQIU3fm|*eE}QR9CH?PSvl|h{BlBamtH@E|C!hJ-1Y0Gl3IK> z9pdnGyB9)Piz~?_j#%hTG^3?RY~N_aZH`XESE6#yW(#R`F*OYDdx4D|6{e~y z&~2+XHzkhvwAy&>DUDyStB%@qQ}YzbPq9)mgGD>@57>wgyJ23XozVzd0Y3ZVtx^1zxTR`%{}+?v_>c7 z&uQ;My}NXIV|D$uzTpptu4CG|V2_M5=WsjM<_jRFd8q@g9z>wXXfm_SydvY-`ze{!+b-e=Nx6w}pEo*Ao&F;!VGXh%id}PC0OIQPc_c<`BMG@6QVf z!84ZOVSN>E6Je9J?$>a{8UxFUI(u$ndKs3MMyA-tb2yg$YYgEk%j@d5QXnBg|KmkN z@)iY@i%PDC_>#>ds^{`W#U;3|AC8)O!5xxZN_s!97D zz0=yO0{SG)M0s1eUAFODACZ=7V(2^=N?lL1-;)~ELl%gLJg?XHIk(s{ZVj|&6#}2C z@9M(2Pb>7pbwu99@U7elyl3wpOnGkx97Ln8Eadc)8v@=8h)0xwThWwPtyIdw)o)BI z7qcdEj09am>i}N%M(CeDp-UYiLWxd~LFn>EwM;e~xs>&B#_@~F=Ddm8UO2F~zZSTZxv2XOmiSj)? zdb?6CSrFm97n5Q#{v;f8z;aANV_n*iODA}kp6uyj7SaZr{Kp9hMEldA=v?yGvX33n z5%R#Y(uq62EF+b;t0kKzvHS{sLBadX!1Z`DFS{WpfCJ~Vk22psHMJh?T)bLcu<$dx zr^KD9`mR$GZ)X18oJi+meRS~CxQ`o-7MKi-J*=iZXWSB$ZlSI63pRj^u}|V3BzHgd zRFzf#c{rU90h9ZNRpcgYod)Aj)*j|WQ0$AZaDT{2h+n7ceP%Adt0#{HPV%#a(ur`i z_>GM3y;-KB6nw>9(c*4j;&N~jH!PoYfxzok?=Azc%EG( zxSrj-Wu|Gkddc3aJ%8K-R?!`GxBBQY>Bck;EFMX84F5HJ3l`Wi(4ES^n5)bM$kl%& z^+~WBc6rvn@%gau)GwFLbib-pS#r`vLmRYz4QAK2@=0}4OS~z=lFTgQF(M!!NUZJm zw8>J6jZ;)<8i(vFQ@ZQ2fh>IVQY%RKh3o=7?JRl4Qu-5c3>v3Olvr1qQUl&v*g*S- z%eI62&F&wcHBP8nzB#l~<#?DiukP#d8Ew6rgBEEJ?MAt^{CJ+3|C8MYt0R!`_rMd2 z*t!KVrNr5Q4!W5YnjP*LJG0h5uqv~h&%YbFW;h|6vj zKAvK+aKZ;#^V&|s~rZ*Uu%uXN&{;pxOTd_Afd@_?-20YPE{7F8>GDAhS-co z1btfR(^iwd(?)Hk@fZ<1i}THU)_*nKVM3*ueV#hB-g&OTHlj={Q)gZqdf2fgFyg*Z z9+AQ}tkx^E?{v4UQ(sPq-TGdjVLiSIS{JDCl}jUERWUq!QkGKDUl^mSu%_8Jj7LPX z$^x}ocIInkpLN@D?YbT1i}$out3_U>4azY^!Tr7gj(I0f*c$vm$0JV1YBD-LOwJw# zIfI<-udSQq`(Z`lHDX$m3kt{5#+4+HTm$}OBeu5iUL|H3lTcD9y*lImmAk%}w_K*c zKT_#sO`LPt6$QK`<`NG`O*GVYFo-&u5wKgZKz&g~EGcCf{Ky3%nzwrCYwzj{L{CBb81o|R2SR22JE zkMh2=_LPR1k9H!^HW>Ef?M+WZPQ}X_!>CByF+8)6BZ-fgC>(^KHh!{?L6;x)vzcCp zGLoouoy92onTKHB^h(m1KcvTUtt#n;9Yyz^nMZKDuJd9+;u8o7*9c7$O(KLZgk42N zl-`718qO(A>3dP~@$=U#OPs}iyirxElmruLcy~;s*Kzca%vW>`TCxESb5f|j{>pXS zy1}dorJNbaeZMV|7KD1VYhnADByONREDP1|ExQ#?V``U zH{IP`Y@aMKgIRQ#N(n(hH2ZG-z=UY~0BE%kyR#i?T*Gh=$Rn(K}`pcV*3l zdtv2ndL}?tcK3j*J4zdT6e0f+8$K^w#^Tu~7hJ<`f_V!>@E^D_T&GjBNGyKfrt@bA#tT%a0 zIc>M8Cu|p99%?^n?T6qJx6eSuK_UyJi{#uwD`2TvK(0VdiQSPzZsvP9uc)`dSK3#D zLy`@BQ%NBl%KjvLHO#-Ol|x7E2i%Q8bs2VE>kR9aumPoJp1w6?jMd5>@i)d8G`ryt zf>o~>$dW;wY%cmTTCDR!nbh;uWS-3+969<#_vGe`wOUw=Na4WCiF!ibnY?w*p0t70 zjkN@euv)u8?~ObMO7mq&8}N9Fouj~E<^{8i+F5eK)`=Y=6awp;$i%~Nz8T0Er6MPL zLq_E!7?PV%GvUU4CSu+v;k$Sj#|u9~P~%2xmMbm;15VQKx%oc&GIcQjH1fm574&&5 zfP-rY;(u>o)PiXn+BBM85J#C_$sjh!UZDXZi;T6|)5#EJb3Xs~Ge=H1vSx|Ig0?nEM7;+rl@qWWH{~= z*5#Ob{*M6aV-4zy%FTV8;oQA>WFjB42E$wtwmH z4P-mX1dXQv(?|`#JBq1Yi*C##v?X&YMGeY9|G zSnw|@Z`XAi;jXuiauTMMqZ42jKXgK_>iFYPk0@(nN{Y}1Xh<@X!kp-Pbw79-jB|@Z zEuExWUcxE2*(A+zDA(Q8zmM50DfSkQ3d~a2yiCRGTmtKJ;u~Bla`Moy3yE8o*6}eF zWW5#PEtr^C#nT!v=az>|NpuC|wCj$m=^R(n*hC<|n<>dnUA>)H(EY>tGF_TjPj_f$ zv34gqSDw7#^-r=9AgA8wEU9q-w1*(>B_WO9rVOEH=n*T}NG$z$<@bC3ebQgEZ+>^k zU4B4~{Zz^QQJ&#k~0839$>Xaj*sD zA~k%ys>TBs;j6$;jZ9`OtXq@oWVqbfQS&q$*>aEt-Ubgu2EGch1~hZPKe_(u*~_x( z8@FGqFZlI6uVj>vla>iPkF*9^^4%{MC2 zzeuP@!kym;kTd}RPBdpvFg0zCw{SG;`jPsG5=b@_eW0H<>*X4jpB^b+-^w9MJDSwY+`Jk@o zqwG-$^(I(0dNo|>Uva8+ii@jX<@%1cI_D%bgRnZZx3wu3GKrQPi;8UQDI-?Y zFJ?^OSaM8lt|w~hL&w3nLb7G_(1XPkQ#j-eMS`|L8ZkBZn9qYcI(tYeL(-2STfAt| zNJ+@sP0`$QI6Dn&?8CB+iz8o*#!~_b!H6xnd)80^TpfE}(HfJ}agYVA7>3&y!xX*+ zQX)L_uHbv}%prTKX!(j_1$^6)`KviI2#zojl&OTrG}-hEkG=a%l^K+P^69g>wJL|C z`gn@JC%dJZrit4K7X7;>)XE8?oQ%Q`ixW9mf5R5+T9DmQb!*GQN;t`6YuOnr5+ z^o@V8;WNR#%`mXaU34b5PGfWwUbqq1%@sgLSSmN7fS2?1Q>o^W5cR17 zamJi>I^XC_ z_YVg0&0)E(w~m?8biWRP1%_v6a&odGfXwywVObDkDE#6YOq?jZHrZBfeDUSx0LJX+u2z z&!WNqn2$XXZf=hIt4^e?Tn&5wZ|3svrHke!wzjsf2nlsYJ}^z_NgsI0-Xnf3o#SPo zE%*%+PmSakEyCgYhKBctj)AwSder`Bt20FTR__W~cN7q9e#pX^im-qAv z*^$$2m7SH^17kwb5&RYE+rF)GEhNSZhE66K9>iSN6;I;O2#xN}AS`MBuvRw#-i3*cJ0`ZoB5?k=lA(Y(gQ-A@m^GRq|)>7u%Q% z`va+7_b@jHLBpsxW`a4i(L%J*HuTJ_aP0xY5gbm3nj@3DYg$F~q(0EtAFuqA)$^)^ zNR#*37H$VdZ=QQI%qM%*-h8I8dY=SgGxVn$?0D^bb9O+uKv*GNXTtutr!CB_b~f11 zD%PK-+3WKH!?PIfKkdr!96w{T8kfv=%QH9&<$0$b7j7?Gi@Q3pn+d#5(j)B*Y9J?P zttQII&vA)};I|6KbJGFy+RE-CCBIFXjf_@MMh+KyZKntJPZBE1f0|T&A$H24C=X4V z-PRI-X*5Z#@+D~+omEeUOROhur}MKGh&Z(%4wswkL*W`xsQ6su40s9~a;iUg!s=@-626ixB9C?SZm{BT1Fdjv*Nljp z&y|WE1m{B!-jKD9bVM3tdVUUF)Vt_pS7mB#6lg2m%`vkSb@qrDrc+f`)nf(AB{oG; z@^zINQe_ZGLO`@13lintI5toJ-m5Fu3@p+O z6IEjmNveDS5ZpNzZu#ba_!P*YR1Ra)Zshw+;%-2VmPk8r^N8?Vmt~l{)L1iJ-z55< zp_U^opdXc$(|v?t6zw>2ebT0egb73DiNVYhimd8Mu9oCAN=O5hCJqJboEmkg0of19 zn7Wp}jqu@je!!CCnhZv>a_6QVLiBlLO9scYJ)bT`|a3L`~~kUP;S@ zXNKO?PKL(kUi?SZ+At&UabAXcdWE{gO<9?IB~xp1$mY%Bdh1w+BG0&Zx^B2i_WcMV zOvQX;f78ATW^+XGAveU8%x;@BGWnzs%Hf&M3yix{*+f|!H}|4-W$0w;!VrzMsCE0f8a&- z1~RMS`7`$1q{{wuI^f{Jsno>BuS3oyQS}NWis1?YpJ%BGnTJ@GWhX@gfzy4}%t;&t zf{K837LN8qs=)td0Wu(FHpV2a{6%&KdIN%jLBUvV6v9HLTya`IJiOk3nf4R>phGk& z@7FKuqy6A%5ytROP3df3Uc#MM)2V2{OpGDDdzy%1YS1p-U=E+iiO2KHd_sM|vZj`z z-QeWooF(VCW@1!F&oI91BC2%R$OS<34P7V^>)VS%$hqg3f`S57;2lyg0P_&>d!E(x zH2r2`jR<81H(1zjR($5ENwlAbKF~kI{`C^BCd^XXONCfX#u6I~i zqMXB1w15WBQjGOG-wI%0uq{d+k&hnJaHSvnIy4V9|C~EpE3MnvM31BUOItUTen-xC z*Sj;a{{Ze^F!B;zEC3ApUn&Ql3kF#dwS`e5l zJSP^tckR+twx#gJ+&J~#kj=S+`;YKn9X7~$QnS=!qYO}7yR2_};XmfZ{cU0xJSQh7 z4@zrYH;A1sZWf2#&Z|d&`u-2r#6~c`>p#E0t=ukO?jUnCb^vB(W~Zm83kwT}9=ElU zS}?&@A4nuI{;XcTujgi2;-oLKF5P#Z@(!1zB}MYth@?7fTEsyWlBqIK=ViIn(rdbC zL$rm=P_ZirEkN;4vTV(Rw}e@@^^BJ-%7&IwqyeuW@g9g_0X;)WtyYJMqeZ*wmBJa< z!MAv4)oZ$?x?b4TX1>*F(Q5zAQk0-&LbdC-TfO!d8ytoXMy!Lmc@(wx8-Qc_; zg%GyqN4qwc#rS;0d-Ud5{Q~g2 zf~M3(m0jw3R$}@iV&3D)1s{Jbg zp?8xjSnG=x@~)uZdSqll*wb+g4&eS2mPbnuQElgTA{5;9au^xl!1jC~cmyj3Eb#-H7Lx?!bbp`$Q`I|}kLDu2H;yXsyO!%FCD}6H` zYxH@25^2fRVczWwFP2JLusC;pam`GybOf zlxId^Coy7jv^rj3n>?83&9B;4BW-n?!&Qc=rpN=f^t5cn(L17lFn%n3z3FktjFr`n zHAZFliF+KD1`)VG!J=dm0q4!$_CH*O!eGZ{;fh<#s~Dq0J?1jw1L3Jz^Kv&T?VXs~ZT$olzuriA&8j_Ag+cl5;c7jm-%r}c z^OwTH{t#YF>#iG^&%IY4OP2Gat*mu7dNllzd`VN2&W{{{4pHo)xocO*iJ>_O@MRC> zdV{7Mzc%YByh#)`vcmxpQ6Tiq)y4TlK5_moMZB3yR>a~<+NoFG0!~Sc4#^%gKQ+HU zJ9^$$An3Bz(|c1m%8h50^cr3Dlc$EA;pq-d+I?-6s)(C*UOL>3lNqEpQXL4mfSpD!8Ve&@4)JPF%at2xKVZjxK_n7@6`<8rIB`iqB!cnyRmM@9k`C03f#bL@F_Li6- ze~e}UVX9N4dWp^nsNk}A43oOVnDw%5|BX!fr*Zq(zG?L^w>1V*(p5*IAA?}dOMHCe zQMCU&YC}B~o$oiRRa&@+-gdLBA4VF0L7&+eJ~Hq#G8i&h2!@u0&Wg%Hf;(EawM5Gb zXD6pSS>38?W7*20^FslCz8OYkl`y;j*caBX|7A}r3(ISKhw6KUnUutNev4MGZ{ z_#4Ws7bZUjc@Oe^Gm1XFaM!y3Ghd8+O+?1YNgmkgEBLD8S%_&$?8}f-7g7IFmHIzB z?7Cuek$W;dz!MpbF0(Tsp2g5(tHRYhWpMc1(?gha)^%NQk+X=Ea)x*YqhI}#`)QR2G39}Z-v?<{r?pR{5p&R4Df#7<+l zKFP#s{T>5{8|9X@ykANigXX-vcp$@9>-;D}1%Cbnx<d-)uX3{V=arB|uY)&l3LYsHLRpxaOXGsBFT)b}ClttBzjFeC_bjbYtSYt-bCXcG5;xwTK$j*`M z5x_|ou~AfzVG9Cfm<44%oE5B~9z^Z>MA+UFGj4t`F~a7a{Yfc$s2t5;Xqg?T-`G8% zDTDbpRS<8qJ$n438tFRmj^xCKOBi)}AAafIwx` zlkMGVw~1~WX9uG&1^$eLnrYC0Z7Dn}VNUt_qp|~sitfT)Q&ra*ZHuTuqT zV!;R&mU)MK!=09sV9D0_)pT>`F%CF8uzqTK+5wF;w$LO6J~gE&oFx#DQaM!T5r?500RyQ#>6jl&T7aVbbt;ON|ch?=M$S-6Y0iG#lu0AD;~N zgNmV9H952%tzD-hb3Wo!KvMgA?1{MxCJq)>%5A6y2s4M79$oUwbH}cti_w4ct#_6X z1LI2J|2N^9Ztc*+X(s9p*-MR&hv!0Zxd}FYg-#ior~NONdaLn8uRi}&FZw&(ep zp@)N-(Wd5RJ^sXG9#Ow;0T>b&P0O4bat`M>+gfgV0Y0cxz)DnDnD_o0W4 z1XUkjKvcMX+9NdU`LQJ6_x0;nDM>0PVL<-Us0%cWZBCN>pf>o><1!>fTn?RAd=9Cs zJVxEA&K?D#e5*g>4A{dj3Jlk3`TiC*mw$V<=@@VdLETiKXmM(?h8~uV0xsJhoBVCu zA|fM`kxF12`r1>2iHYgljE*7OahH6L1gx#&gZ0!zZcj&{w+NujUn?qn9HF5ACUhSj z7hq$fk0NO7@h8OEU}B6O=i7<|It;Qd=mE;QcQas;z5H$h`Te9_}}^dK3~1LrCz(WwwW#!w`-lt{V%^KI2Q;F{rI z_cMaLyae@rKDDTqtO{Qb`J1&3h4th~X21QrQZV#?(ah8|B;?uO27}(Q*vsaXdxY5K zqSW86l*P`*q+Fo(PRB8S*U~bJ;94i}TxaEOOQ8QNdq<5?E%S>`^oKSqEbq_r)fSga z=v-^%>KWQ}Bk=xuG!W)<{_ehaI}?AB_#)>Czh3Efjg3uCPL4P_Qj_>i?PNxV{^k!` zpPmO{&i(lDT2&Nz)zRF=B%nx)MY*8;F6pn;k|r}Y1u1^k~Y z=Kt^5+1%tWBfc|z_{a(M_bR)F82gnSdb~q#i$#WihoH^2!qb)v^d_f3p7=%#G@r2Z z6wKt5r&;t&sE!V6-K$dDo4Y%F;X`!=!!Sb*9B`3Y-RRL=mC?u$G-R4)8f#FAC0;tg z=*`ECzZm-XH4y!s-RMvFixf!bh|=Y(T2Dtrc&)rSV6a=+P3;&>aGd9#1rqT*B~j%z4m6KI=ZSL`qMDnO=Bu!${9Y9>1FZIriRA5~|RHwar1 zg(a0tpL}dhL$Cc$F!~S*yj@rsA)5>M7l~P}hZhrb@Ym#US+p>e@$R@M_1xW%mGFnM zj56;wDZm4dOBqg$@ubHOHhfc0?1mf=1Tt|y--xBpDPOzDZuXfmtE5#oQx1!Z zEz~uX@d#1bD_XhjBx9m61j0wfSdXqPMy2EE-F=k@Pu}6ZJFGY?qhaysv2^!op&*Bl zF_UjsYZ9lFau~sqFDSkCSZ`mv?taG7`ix6!8Yq(fO-Zv<#xqx29PJ$Hh=nu!YXre% zgXDSs5`eOOU^RdDOIeDU^0po9h)i&BuVvf)U^r1;tj)Ld87e)W?jq0SIhtLbBp`*T z!z0M)sU4TbxE}vRH`LPbQBbw?yco zCiiD=;DbhXdI1(O_OeKkC`W3!{{fJbin>Dyb35uV$wrgz8?RDnqt=)BBV>KEa&D%O zqDhmQAmV{7F0dwC*WctE*+DWFan9EqRvF!^uVI73O+@7gDi{Co4OTp`rZ-iN-b{__ z>^=VLXdI0|JXEo0e5Ex*OHqE;unpqlo$zs4opID)2Y;V4Sd63qG76aAr2cYAH(D}x z@e<6iX%N;mT*X_7ZQx_58BMmU5?1$kKHtZjp{OTf)~J^=DE_CcwAkN5ak`rMqd}>P zUM8ORu=bP*~v_0QW zdx~W#j`PhA!E8^Be4uY}zzTZFh3B`?`)KFXKCBlxgsx=S$Wt0TPGrfxDZX4$z{@}} zey`s-5bG}0WW*ZMtB(v>(dzIu%pmZbW$m|O0%OOWIZMkl(8MWNQrahX zzL`GwO`IdgStgf0qoLfK7aTZ}@;y=-HWT|1HR_(~a{7O@_nuKrZtc3TYq=B!(Ip^A z5kv%}1*ErtQY8?O-hy_fT#u6@S)?stFR z-usO4eP^6;egR=*=9zisGw=JpuIs*LH+({M&b%+MEsd?PEhsr{A4Z}58>zox*199> zFx+h;m4Ch0GIUWCrz-xr3AYSv_&!$A04S>Yfg=wxCW$&7M41A0I z-7dnz=z7XXXEz^zmj@^b#)+!RVQ=a%e&Dn>(Rn{erO|C_Gw5_s2nqk?un_Aa*69I$ zH@5|IHF#qz%B*0Ty|&My-JDH8A{S9kbPsVI`2LUbd6G-)MFyO$HHW6Bjseto-nl%H z&C#{NVK`d>I&#}ph35{jU_|_UaePy#+9%B&n{uWQK)Vnmvc7vrWrcGTt!OS$8Mfi* zC(T9Z}MCh(}78JsQf?*7=)K9cpUC~}v(c6bEZ{+CdKrX>=VX~NH<4>7=0(Y-n6EFtKhX~P~Hd#6^ zr@Gd<7517hU8_<1r>xVjH8h6OKxL^1(AyDSn=i})E;ZG(0NC6vA7LtgN_46BImx*x zbn>;90&9UnwJzjU)f2^d`^UZq)&}BA+NK@vu77nJwq&(j+da<-=GMRp zf)T3fHWwAFVtP5ln}Q!oVJj$&HQuOmb#c%BIDM}-kVspup6<`8D4t2i^3%$p56`-H zZ`!CubES2+^m8X!=DRQp5m*EVS`FOG%HNIw5Z%d84|ej-mN4pej_u34VwKw$S8L7mmHw!ght~2cT1W7Qknx0)80m@$v`~$Vs!K^Y9lAEp}MPn ztO&@bz8Jln5&VBNulX0B6zI{Ox#PlL7l(1&&B;xlMk6Y>_fPomDaDcFEivYYJ@A)G z$?Yp_<5)S)&2A)GP>|bhce<0<-o{iUnjc@}8cO#NNbp^V?5caprZ8+GcA2k%l+{&x zuxn{tVR7F#scS&ByE_+x<@1FyGMbG<D~(wtj#+Y@1fLAf=;Y~fe=8A@lc-rn}@hj>dqdxzVSJmxkX z?<_fbA(Z3jN!_M}ShGBB5;y&nIrerw9@d}{+_pm~E29Xrbhm*gN2Qq*{o)jDM0}en z_pZta#QgNg2*4;~WyBejDY;QA4&A^4P7Y?ZZ)%%V;Ks!M1S&%kOb{nZf7Y;~K*Kh6Q?~98PQyt(F4aOcvWc7icOK<& zBI#!21Co-p(>y;hN;Ow`(0~;4p+h{lB~W1eGu546MN+=u%4$A2Ax`RdSd*JRrU^$^ zpd1Sl6m&?6i-I(=WIw+j_>h=N#eDySQz5s=c6 zA+nE+lBXD@!lhUf!MYDm#Cw|Zc;o?m&7>e@pO4(Y;~xPxCXrT57b73I6fu;m_(=RC zbs=Zo{ywcEsM5s4V&6){r%InqmGUl`*;o4t?9$7rcLQr{!Pk3BZ7Nvw$7*wPr`Y<} zVxsT2znXUv-Y?9ar&+@4N8y^CB(oFkK~^HU)6YvO%!YTiQmj466mH))mC;{H+a{SI6w>g^kP2mQw7EI zEBkZ2Ql}DvYG~vQL4q3AS;7Y6+>jzzJ0^9yV6XhCMuUb}(d|w@_Ia8(rsSqh z`Qe;RQk`5R@9oi+D&aM+8+IVWA9;sOm9s2&uBNEOFHvPe1G z+irCKC&s|oHP1@trhZsFpd=Dy>hpzI9(f5BPdfN z7UClJk>Js_Zy@yOVHl5tzD8+y{kOW*r5zI0`*iA&&Z*L4FWz&9`pur2lW=~*X3djo z$I0M^?sLjYXfbhdJoTHcrBRwe@dyVpt{*;#&N)Fzi*&k`i}@aeDe)Ij)+qNh-=3AV z)w^M8X_%39;WRX@gOrL+N;FL1ZtLc$C#1-&mg$uDzS)BCo3%Vbj_BD`{i= zm}{ZFxbbC5lVv`)Hs(aelgNhbF00KvYJWdBj5ChMo@I5FWqoml8n_ed>}Dd#hfX@2 z;jRIdfG;czy0R{1sNwsbNrWXfw@H{wAI^`DV6+ z*)%_AZ3Jpkdf&_$nIJ1tg{h=D+14dsr1xqv<-Ixwk1YHrufp^O*9fNU@_LwN_a~zY^>6aV} zqJUOPG(02}W8?HjFPq04V`;@|L*QEfQCK}Xz4NwnbS_QbT!lRVpY;9g!dxg=Dt#EH zp>JOb6Bg!{fWUTfG3XO*huo91-QF1h z?okpuHaXr|)GXH1F1H*~RRTAc%@uDw(gqR-`(qg$og@H9kYCE3`ntt`9Qa$Aykw~G zj$eu&S0kA^*|E!S)w@ovt_|l06Sr^QrV3+v{#+RpCnakM=j85w#1zERPSvF_Uo zr``jwhB_0L{x8KC1#h1Z<_*#{r>{!YkCsmYkbX?_5xeM^{U#3<^H(Fdc%#P3q#m*_CWI_E}>*k9Yp^C1^OT!}t5j=l1!uw6rWO zFIQGpPT&qG(OoQ3e`5hwZX(IBi8`U6VQ1{pRLe-RaNXIy0KVM7+Ho5-vS`-buqmL< zqJ!>MRs5DiaaeC#!MS&B2I7T~J)cfR>hFZ8K~jMKEI|Wp}hloslti7T_A?+c=u&Jg;Bd(r)YmxyPTWav#q>*trL1zMfp; z5PPovdWF)d8@U|Jb_!U$v zj-zbR=q zMibYua{?M~GgZ$+2;F2{uRE&Q=0!%`Ij9n)iCpIf_{W|{B2HBTLPCh}8!M9lD%Jaj zOJT5}r(^vdnc2}!*fVEsg2v;?GvN?=MLYuhk4aG$Zc&{BJbiFBazu9louG!t5Uey4 zZ|fCuAWH{Y1nMTAo0w&PM(DW8zYn$-0mH(Tb4-@AKWk?Q+2y00`jbi=a0eTq`zqYx z0=jvtT6sDJ(IX>=Zf;3qX(2gLRMg;z!l<;ILBaMINBUSct#}?$3~xwLFUL;(HzLHe z;Z9x8OmnWoXY{wz-Qk9=fss|j)T%-UzxJYO5D2kCDr8i z>3>Y3Qrq~WM&btVt`SD03#+FVtv!!TwxDAm| zi~OJ<6=bAaO^O6i=4sZ{m7KWoO?jw7qa`!tm4af6x>-d(8&Fma%;_&hC8dqluBqmR z)AbQw$>Y4HM3+~hb1ATVyGCFrx^hZ$*}akplQhifUpmCs-B5XA#>PjCFV|gLz4cy= z#ZXXIRXJ8wveUhmm+z|zpuX&Pi%5hvMx;sqv_aZM>(!DmBeV=+W-X>1sk32jWJlh&;@9)z? zby}>?kx`dBjO+L0I}7JkwsJhBYGQR3F8?|c1PbyJGp*BOHL&7(7Bm5N8*1R|`N?#i zH?x+z&kQ)-1H-BnC3BxUbhl__tab@mgKL+BQuPvYJYdbP$2*A`P|YHhCwrrvnGeG; z%9(&bWm0_71I(sbTzh$O%DmQrg_fzfj0;|Cf-w3iQn+xcTP*PQTJ&ELq-m5dYI8f6 zBG)|gdiw}j5tUf^bw#!%1J$;U$d@$~&KmoP!D{2vW?6)>et7DX!@e!3Mu#T*axYBo zAhiKrdDb?_(D|$jdmDVouV~SC-0|_b`50|M6SW}44$JbK3{wv#KJDohZ9L5QgEroF zPsPy&X?!9(xSvbW^BiE}Oo4@Z$qNw{XP5~}@!G6xlxxj3adRj2TyoB-s+5xqF?6i=O_D(lUX&x5d$ORrqlZ!XlofiHnqtdx2G8#eU*|`O?}m zcQ(k0e)h>b(_h)JK2uyMq+a#T7(Bf@@-5(ywn|~(`CM5u!#qWHbi>3MA^a}#$fZ+Z zK}i2Y&o}sHdM-!%ham0&!hw$MJur_w{R`@xiyQtRCr6Bjlp94R{jN)N><-S+Q*^?( zySIqA{}v@g$-i~I;(?7v&9jn0?(WAFf)w+yG|2XpUzby1TW+T{`QBUBLq~V~bL{+F z0(nRY!f3?^ez{f^&2DIB=a%5f`y$O-%3Q%9x|=O7dZ>S48QjS2NLt^4=yiiR(8xA2 zZtxl4_D)4gu8DI?1adPkVaXD-G!qt+nGAz?KKL{S`!RNoKFgas?iwhpVwoD8=68tJ zDAM8M;^LC6?XLz5>9h@lo@mUKYduPFH)=>}8efcEdEm66xx#d7L5MR(g%& zSedq&cVm|Lao`aMSR?7Ak*jWK&WMk7wJh;;vF~vCn<=nVb_>R zoZDF9jvi`~H*aki8Qz>*vDiR6ApmcRw}IM?E-p{y!)+LS4A?}6V?RIEV79*uYNLHB zd;{?;=1iYMC=v3s(+>SWBQ+^rM?0+nHNB2Ap5qSj&%jwk{I(k^%Ab!i$!(W3SmpMg z$eOwkimD>>9n?Z|v5DSG1ZIWqk7bgBj(17jjEH@li{^79S-w7IvGTI zX;JYGY~pxnkKZb+$5b>mE4@w+5*@9qtW;H1SGTqnp33C+vYA?TLZ!t;aml}DBQD3=BcGvfrVg60+MSqjYezw#vb`^YMJwy;p%^9T*Pqfl?52{Q4*Ld`ANl-SblCPzovHtN?JYrdt5K=-WK|?P<$p}IiUIq zNBAO#wcNMThpto{w1y0r!(ox5@j|a_I)iirO9BV7jt)u6KpeZqlc-E9pd7o?LBb93z!Wk>$lMAi}agrYr=y?^hu3CAB zrf?P(O05*D%vYkfM>__brKSa2E@d|y*6)*Az$^li9#B;>83!%<4|qXjqw{(O<`-`l z@S2$AvVx(E}Ko=QtCg>|@U47lf+=tV>;##&-` zSES~uwY1etcgs|&73NZhC0|U8RjVtQSwIYe`bjd4CKV&%jbm8G5G;FwZX!^|MRJN> z2p?5Nu52u`-pQ3v*FI!iz?&oB0-ukcscn6pDfC)Dsiwm<^7oUG^+nJ4Zbm68e3`R7 zVQSK9A%`7RKZQnmK4{SK3X1wSt%d6sA&Kk}iokArTXFYCuTYi_ zE3jZl`@AolU1W9O+tkJfH2xaWt3w{HKL%K%{jGdlsfv!9jb(66rvxyW9NmSkr8+R5 zxMxMnp|Dg=26)n4sAbKe&a|!W3nAk?c&HCr}rN9kc7 zaP69b?+^6IGYq$ZBwnu3npjX?DX&y!atL>y-}FTJeo8$8+t6xce0W>}a63tu&BGS( z(q!tQ%W8|4zs~JyufCo`3a9X-%&C1*2IXv%oP4`V1AE}JkrVpkSLE8`Cl~ehXZoDL z;{SQJz<(pmG-*bTrS-O7y2tCC`H4PMxZs8Giz-}fTaX}@FVYT{0ZBg~dAX`X0aa>) z!(vCidO@1|8cW;*SAYEX7~3f@Ffc$ycte|89LE$;*)IO{gFcnfU?lUxQ@{H;pEKJk z8QM~FF&IG4Kco2SRi8O;P*9LVwI?7^X^o(Z2n`K=|GU-CvEE}>JppA>+<~3_!2f61 z)BhiM6KF$8mPbW$+y44-e*g6Rm1^HQ`JYw$jl2S3#~Q;Q^mS;M7r{8FdTfiHrlCd8 zxHjOCJYp+mqhA1Hi~o*79z!PoBhZQS8)v$=|Nf0@RjC|?W)yYu7c7Zq+l0q~sOWc4 z{c4E!p6X8J4E^PvYonm6_5g836Q(eBu^dO67EsE>$0Lb+ni^ZJ?nM~%DV1jdpC!LH z)^R{S<}N5#NY5i;%wgOvFph3+zL{6qt)^zX%|()@*Rm_cVjY1Jh>aN(c`x-O{<-LO z7|~mxO9tUZVY5({KUhoS8?_JfoN`Ojl)LGnM;qSeoQR;bS`L3CJei!5BHH?^(B&WdPK9bkL+$J99-^Y%*1giIa$#X3EV}+?53l`nh`cIes*{HXh3vy>4MChr0IjOLwz3V7 zPGoV%G0^{Z?VDnmpVxeaQX2zX8`4Kfj1J>6{N+~lq&#idi;*NzQYO+u8WF^x}b7C6@FM(ab@;~PiU zl9pz4y{>A)!*Py%r{ARVW4Nxe&5pbbQ!p%v%7{gv9FdzAVvT!0<=E7NXIa+Yd>$WD z**U-*ygj>D|Q(DlB6NZ z?f5$$Xr9Ht|L1Hp%cQwJyJ$w|TtV}(<7=I~PSU&YePV4zqe z-@}-%INI8^8LH*gwb=(XTH_Z+u{w2j7BzviNWI()?89m^ap7zY3biGa1B2CGbR{hd^sB?K&JWcx^qOBu_W{FdX zj$<6{8Az9>clSEDf%hyS z59NuiMR&#ksm}vShuFWh`SsW>shSUOBfoIJi(PH7O&9}cjblK)y7a0_N&I{-gtI>3 zbHQug9tLZdvKrCUFRwf?rc662pjYrMp2J>joJpG$rNs@4MYof*#H!yv602VRDM3+F zJq3PJOVs}XfoX>v9|(!1;Yyd5hXc(0?qugS&O1*8SAg}&v@8?NJ`kmZY(v6FOcdYk zDssBjdg-f+yH!|v21sB9Brr{hLB2Bg(tQE8PYwVs1w<9Zs2(ecKjF2O3@Sm9kCTP`WY7 z)H+6O+tbWKV=~6p(vG@X4rq>}diXGbVR~gUkS?vTMCv}k0EXcvPUR< zz~)5y+fE7vge8%&?;%T3NQ3fb!Q<+Ru}xWmo=$(zo@%pYoGb4lxpO3A!JwK7&P6gh z^5AQ$>1Y4DzcsgX&E*|tZWlAnRBy$KzXd%ziTJW|v+i{@?2!Ll@0H1T%$&q|Oe7+r z+0~v@Yow_gBk&8L?Tjn2JEKb{-{d>B>ugW%jXurQqwX7t^--d|^+a2oo}j_UH;l`{ zhJD?7+gStKuUw#6ukn1|RkT*01LyS1^pLG{DWUWc_oazOe$+M?NSTqR6Gn&9AEh$h z=na3F<7m`}OW+;ZSGkE?t8a6tsA^+5z^QwKs!DtU0==bQlzdLGfVB8jH9v>vb2aMt zm}wlUFp&`+l5=*3f;k5dkMzFqIN)fEHbAfNBc&LlkD?I}$K-=Ft87{}sFz{Fw55G1 zRjkuk*ZIzm?6VO6yUt3Lm^hvnGX{Y+J=>osuPyIco3jWM#ND$iJ*FMqsThhMszkK* z`olY_w<7LVO~Eo0iw|h=`@yV1LlAxP0=$B~i(_K@+AJe_e#Xkm)qaoHMW;p-=+CTb zVmA~KiDGQ6h-yGSpk0Tk{az4Vbtz?Xk0kX^Q8LIyaa@W5W7ML+IAMWew|o(M?~FEn z|KPcOVsm5P0b2G?gbXe9kaih%Ap_}@*l06gdr2dw7yQzaeLPN$MHP^#4A9OT++pdM z+@Z5B4vVrvmpaU{*z()T!XT#A_VA*<8z7~2`Rds8!%Xn6x)s)W1qBoJUZ-8v<>lph zd3jE5ZVn_2L(8$;<%>C)bZH0B_XDCnRfDcd0ygGl4mXTB#&zd0cA~mSlZT2qk8zA5 zu9&+v#MUn?+T;&oVmA1(;YP4y33~lt*Bw~nJZ&*M$RcU6*Njtu!TfFCwxDZ2=PtttL30d#M`1LVP2pLejmJTh)#C@ zvxN=kKjR~*cetygcBaVPwVO(lLa(ElB{JoM_$bcbI;zI#6{)jmU$6oQu|s*1@ByE35&cvmcsW{%ubx%Z5;b}LyZwdo?O{`f51BW zSW@bywFZkh*cH^v-uVl9EN;@J;)rT>$sZKRLwmVDYwwirXoboY6jy0+rlz!17nbuu zD->nvdfQ^`shWsH_RuM{1w~=1#hUVFw*KpdT}4lT64&0q(HT&g^O9GmcK_Y#dMG>& zi1Ru+vv(w}^9XsZH4Zq1mF9O)$*U#{cJZ0Dyf%NW7{SHFy8X8KuYHn6gm6*0dO0JL zwsa4U+_AP(1vW+-YyVM)4KAeQ;U%Z7Z0fdOFBpN_(~hdv;4r+B(@Ais&j>Oo7b{Io zV_}1<3wQFz;v);YU)l8*ace(d(TnwexKj+>V9~Njp=T)fvQv!+jEDw=CJN4RfSg+^ z8_0+G6eVg?p*dKM%6Je}wii8vX;DnFn6!Y3DQ_z|d2U-$T7-izZqIrjnWa^9K*7+zc|=mvBw zqdqJXvgNZucAa3!-LrKrkQo6!m7dMab&n|*SmVLIn_#0yiel#bSoiLK(t_a@{Jj3| z8vSaPzou+LB;xsUE@L7gZoE)0*KoqB13FxxNHFybAl%p)f+k9T>czmHMj$l9E)gYh zBi;z8V#VKBK!1CSrREgfXT{{athnLDqrCa%fXJLEcM(}&W@ad-#BR*^x(%#ahW_bu zJTC8e7Nrz15o2|5WUQ1q_$=Y2VrFpc%;QoaOtUqdjEbeHc*=E6q4Ztxmn(sl<85Mt zfY};vv+9+(hpQ)rDP&2PBML$K+3!tHYeZ82gB+_{&j6+V5-mCI|(IhsHc-Tyl#f}W3<=y_YW`y?=K#UPsY_+!0T5t;gBrl3yaotW908~+xS!f zDH7yt#U2(8id&fY!50cI`8vx`ca-D@SqS7+-{W0)Rpm_Of}~)D=?U_Zy3BmK6Z%w% z-R)lqfE9FL%%QkeEc4PIb!d zRVynyys_F%mZrW)bLLi}Zs(fw$ou1eq?32?HY1Ye>c?nW^|2&NG!zp;+59~eTj)=s z40Wi26ql&=+(F+8bT*W~fFnOJs5^&v{|i%G=@rUWG!U00xp)p>1gi>zxlr$=Cd7Ra8H;OZ?#{>E()`e2eGdOOLMWT&OEi_j(DnF*L-&UFoZ!dM++8_Im+OD0;fk`?t`k2ZX>u7&MacA-4f2`u}@V*eH?do zd&PYYr(CZJ>BY`?gK7uUp?q~E@IG1RT!h)LK>ML(JI`tElu57lj#B%=V)@fe`m5e) z^FKTfiGeOtgrc;q&(zcuyf+Q1s0hQj-~gM8J%E)bzH=ugF3xtWOgfuH@&?clr&x+k zgkHyNavz_++!^C46>dMiq>BWebCO{t>Q5;F1YBvAEuf4&I^#7`4TW+*0)NE zm6nz|J39kd3@;d?D+>b2NWt;oE4tIq+=q@KW}>PNll0~B=l7z8XU*HpW#>}(b?!m{5&8=iWQ zyx;p}Cp0KjFEzz`zoG4vF52hSGXy6LOv~aH>@5*dtazo|M}I}8+`d0DTAXu zn6SSWNUZO9e#u%oE^c0!cjlvb(YU>Acb2oAUcfqIdGzK*jy7h;8^~8(xpJ{`9*Fpo zRGU*j(Xv0!P7W7#OReClkziWrv6R@zIJ<2j4`KsmKik%3z5Hn z|NiJZ7Uclurywmz9)AE*UU#yB*MYwMlzC^?Wb$6=yhR-(Yha96IK@&S+}tZUA!cqq zS5e*io*lBVtZ!JL$+1}Mn5elmf?{1;w@&&=E&Jeh1qw%dHMMt)T^j_x{>eT6;Qi18 zcKT`2;c$?npi=*_M>_eTrG!%o~cYgiTam@WyA&kMV?x`Zu5bSb~ zv+%Kc^ND3%lpK=*cS^jZkMOlGQ*UnLU!Gz=zl}d~eF9HEEqXh!%|c0=Y(<1Nl>1IVGh;nz&^G0)$Kp*Sl_rR=u4cGd(Ywu|8;zF7yu| zPu4fR%>y_dG#cywdrV|~cbo$UL*%ojl*>Qpg~ype*Sl!(zb`%dp{-6-VQd1tmgGGJ zia2y-j$W)sQ+!CS{Aqi@oqT0`&`wxFSRP|l=Hx!lG#8Ib?pE}N@h~%Me+X(!{~Ov})m~?}!(YT#B9pwsSQ{$6Xqtv%OsL^NT}fwl8hv z0b2FhPa6g-58tABf##I6ahEjyFP|D$Z@hm^IE|ezxHT9~1bRS-x;-%#S-922@>9$5ds?r{CCirQ!TrV6Gt0qEX=b)ux9(JK1qtq&rXY?s~e5iRQ?e9)DiNCzqEA$-8G^PrjvbrZ@^Dedi%zy z>w#$;Iou>SMtyOUefdO?|9P%kk>A^^RuqRrE%vxDY6`1cZscZ|Et&&y#%Ngv;9*>O z$dBX7<*=q2?ez|vyx4H@08E-xR8&k%766ZwRp7rsBmn+Ps)PX2X7;?Fg*?Jc)#o9- z^rZ}NZ{EGL5e|T2z9KCQXL@90WPo#N>LSE1jxJ8|mvbSUD}skuC2??_KM);C{LT{3 z)z88{JfP1KO?>Tbh`MeeH)rjb zCm@XmFoQHl^{h^9E_Nx>a{ejIvA#ct1H}J|X6fv#!$pkVW0wM&+DOKdNP#@h^wq~` z^mNrpYMxKi4GQKeXyq`Ecs%n_^|CKbm9h7>Q{iP_$ z=W5g?bV6dchqbeYV!UQj`7p)nb=AB1>cb$#Hme@PjBY##sH@d2Vc{>^-8t*cM4@B~ zN~h_h>GiqI!%advaxM2_;smV6eJ6xeZIUOfdV3qnyr8aA4X5K{wVgWuV4Ae;!k@Ut zu1_2OLtqR5fVKJAtrKaNROyvUt>{FEr8RAh()SwPmbSEAsLON_3YHLB93SkulbVwJ zj9HH3RoUe(C5(P`y%Zy;5gqkpwG=%8uGNe8dhvO0aASuWLCj z{_=yuQ#ve7{ab~P`YC9|ooh$A2GmsSmOa_3Qv4LpeDI1BMVjq|zEYPTbejY0ls;@H=pLXWR;dWW_7c|A*Wst*Gqzpj-7dlgqi zkw*<6LZR4`U`C1Ny4TqmY3x&8>d9n8ZGnBy1{Wu6Qn;mabCThFH*HjdhW;wj?^M*z zMAmsuU>E1@B+-Fv>2`Sf(nKm2j@+vN*l9tnBa)p0YvfWnW$O`O0qNZ;idE6sIb$ z@EzdO*!zsa;XDpS^l^49?MU=En8wDrLY->YY62niGhhWCmPTy; z@9s5DegNwtEP3=+{axz}r2yr>lQ{!>5JuYVoR&?~+Afwpx8AtQncvX&PcWGG0a7c2Zk@ zqOBJ2pD}eO8=#+kR{!R*r+x}~(Y;^Mov*s9!Y1#K&O!NfwlvZI1m6aBxA5+tPE`q# z%HUhcVp2s!Khe$jfjC3tT^F*GA;B*Ew@+hMxSa*U4cf;;H|ops0ZoJ+T`SWP88WsD zUI>2uBHMd&$K>;}53tt*`jDT!xmTVUlf^&08hvL#KyCCd?Lk7~#(V%r6=3I|&&bH= z6~8=N8!7;T&o|q0>#;HdTDQmS>5n6y$t1+qUj!C9 zmj{&%+4}uxZFzF*3}Tln2b>}`)~oC8+G=BnIGYY+AN`X%879~Vvi}Y6gZ@HeZhZ;( zc^m_ybCz)tb!-4`Ag2+?8S%Xurw3!=CPOxzYR2i`gNFO-jl{oYlcIq@!`l}`o8pO zA9ALL!`17uEs_ku1>E2&eRU0ugZ+JIs>DqF@lvvhGKamH5@DQ`$^oU%W4y=V%(5jf zL8mHVxagF@+1f;dOL;^2Wp`=JryDa7S6@nHfpKg2Bf+=d>@E-Nz_bxQgkCRa>QB}R zfP}_m+tV}=?4vv*Kzsa``SH>+?8K)nZD3>n%B|+x!TzLUZ~NlTRhrOnd3ZU!ENReJ z36OT2ydr@ZlI56mG2_lwh}i)Jd?tmR_Airobe^faOV618*!&PkoFkA zPWRFX=-S6|u(GaEG#oWI-4j=E)WKg3Cw_U{yUJeX7AJ_3ooZ+cCidH@2ahQ*!Xu$bY09KCcD`_R^c=5AcF`%A$JMn319{m?Iu0`b_EYPa~ zjl1j;X4X>OYJew_vioe0ULx#I`0Fvt@Jsl;tGm5E`wz`_Kip5X`oQLQnzlrhfH_~; z0$F@F3o;Ym`f?p$c<6ywxtOWqd3oC#*+1Kfva?$|k@+wJsL!{XSI;K_o#zL@acF!D zxN{DeDd5gtTaucO3Shc2;yD1AoYN7X^N}lG@2f{euNAN=*sH^P;nO@e>4{K%GcQkb z?im4J)f)}ol24yLQ7q#9*}uE(0Qio9hlhxl{pI-~r$N2vY-I~Dh4&P_yTDat7>}am zQz}X**6(?8^z4qId6kuw6?1nZe9q|+1p4#fWrIjH|Tm;XIWjsL^$%O4_rKoJ?# z<^>=lq)7Z9Ye&$cL5{2E;g4JFTsT_-qK2LS+|w}&1Gc;u{w=wWz+*e_&Vhom+^5fB z$J|}Qsqd)vadVt8ov^sIf+kk(<=S4$y&3VOhtI2RKRm%L5a8oijibYFuPZHDE2#b! z$;iJZXi$PntWpQs(}2@0chiD*!~5G2QxB5o=kCaY?u9AY3)ra^O};@NL@2G;O&gC6 zeLHBNT(jk}oqlXBzkkFtQ3lnhEGg>myg{v@SZRrBe=h8P+{Qy))_WL@{PoJ$?DNMX zv}E;qfYL*Y`esT8#XE(a93JX)uW%n%oRgpED4}mMu90P!bXkB$9s!3hc|Sq>lGQw2 zEGf^}kMO%ALgms7mE&)YBkg%!79%s&Erf9ZNoT2-dmhc6s#9(^F*~?CqEcGOu(h)K zI=r{C={O}BT}~YKutI}hq2=f+aCCCwM7R?ha9rO-AYD@DfJskBR~OZc!^?W2cot0t zy7czfH=~gx->g?noqG&d$-r#e=LRNI)0fEyBpTODv9BE)N@x}_O*n{9b(+O;ehZ`xAB3yJKajd zos;C9Bcx-W>WYfaJ52QVOriy}a^$DU=813@;f_-o$t0Pvx05p;bw_7_sh&CJ zqFMuP%J@E!@HN9_Z{p2eq^uzyfCHxXnM~~**JJ$dhK(iF_h_p+=J{k6f%!#w$;l{% zJrJ!eDPf%A{HB5)x>I~bdyIjnKoI<5S9mC~*h#?}^j2g%uBkaNB!s}-Am6E#*+!>Q zr=pmdp(Ft~V3$+NTz*1WFRoUxe@$_~UszGAm7r+V&826Frt{iy@NfRoeTwI^v&tkw z3>8yF#1uLlVG(?0Co_RHx>N3BZfwGW-1K0uyQZn+;p~^Jk9{Q{OD|@}0%yGD$KV|T z(u&C^u{r$XfWN`xNz=FwXldlF{RZkybJ3ju)5qLm!cL~1J8QEwHu*2+Rm#T(=};{1 z4uY^UmE{JBF@;#zI6`ok391S7)A=CzchhQFTcqMWXG^A(-f6G|~< z*$|dLbbVx5wLweu2-jfUF{%D$m6-6v5`V9O_R8e2&)XjE`#jg|@x>P9tOe8QsT~us zy4lj8{mj1Xfr-*#Nt1&R*9Y*hO?eeVOxC<-YmCML-~1RFp&Lu~GEQZ5ZO^#%Zu4QB zEkdP8D{tB@OH=b~IKyvtcX^Uq|19RT{mHyDgdUx%Z{SxX-wU}#b<63!Z1Ke9a4Gwu zsqp}*rT<(h2jA184XsVfSz5GJD@wCCbYf^y+_)wq)1#eg@dqL(0HjJ)zU*g8d_K6G zi@&UOQpF5#@<4jDCnxn%O=KPqpK;*$S^9bO0k8jU*6^PRRqww%+WLCjNRRsE+U5(_ zFPt9~oCDRDR`H9{hK9>~K1WSJX$c5Yu1zYMy9yF-w6(pO>$L`A%eBh7OL5@G m=5UEh1o`>pq!Z=H44Io7h0-22`;+rIby{jTfU*B1L+UxShU zIz0^y4WpK(njsC%xg_du_2qNaD+bNA%rrDtX|&Xy7zgKUl9{cIK)K>)k+U$~nhmbc zrXL0Q_`ddwZMjY&#~BjEoeZc6R&j@kjX4M?%CQR6;_6 zxWguv?(y=aYN6qe`#RL(#TT8vIdk~4Jr&9x7K;^fgT%LAqM-?v9(`3Lp$F~4EmIyt zyIH2GwFUd_q^Z3T68S16quLh}guhKfo($Ktm zc(ayzTlZg?j5IVinG9H|<(JFERp1l8xIJ;;FnJSB_BZII+~9=irO^jcYdn4!ehj5V z?CPcy(3CEMcU#*@stdgKcclvj0mcpX+uAaJLZ8{sW%t12EPq4^L{^Gv$YU!MY>3<8=Y)V3yhQc z<%}07m*KZ)Xv~Y|C}Fs`tJB0K_({u9&glxsb}0A&eRgc9^PsvU+iW=ZbY(A+UuXMf zCJ(ksHu|gZ-*CXL9{m+tw$mxufNgqfJuqmWs%XsBzBlxqzJwz4RXT zT!P{1+{JxaWV|n_xBLB^g0jRDUg1#f?U&mZgcLF7{~{E&BsVs;?fxc>FhS-Efaw$U zhiLND`K=VIAW4*s*|5W;xgv1>} zS8cW%>REZRNLO2N4@q3NQsPQ9UO)kz1xy5dSE=79@OLJ!fEnkT95;$x1V=B>&TcRTV@>3t1t z?UhkRjXT4Cgfy;iFyohWH2jOtD_BC3IjcV0azLF`>LcGjaBD4AZnQ%*C;I(Phx@*M za((7-Y9N_&a!;ZZTC5kxoJh;3)@Q_;Dp96dmevdWloI1mj%IJ@#!B-lMvQZgg4)dwly5LNi-bB4-n7`u1E66O?SjlBa{BypVt3Tk zephyqOFXazJC(Hu9gpOl+&DJ0#l&kt2mZLT;NAIQr&8F?vdg;F7F5hiO3qh&gpd!XwZ@`Ql*m!ePR zHWF6gT$}2NYz^z01F1hU2Xby`CeF?L4r)yI3{MJbt`sj9F{jk|jgOA}^3ItpDq8qy zwK4x1+*=znhn`X-&vUx~FL20?25t*D`Mf|ah4j?EvkABpSuF98sMqLHR-L|u3*lqh z`pF^FF@%1o=fkY$C5303QmjCk@_q0$LkQZ3kH5VZup>GtI6I)1PKjIlSpm#i-$cD@ z89pyZ0;_WKW%?24XP6NupyFcSa0t?GHgwDG<#yLc&chasbFa_%s}w7A#jsZ*jQJbp zF{&JVaSJn}X0xSwKyOASv+j!uQ)O0Lp&tH(b%kXn2k(=9{(!%#MlLEAgg9-?2?&WZ z4nuKe#<)iWl<$Myo6ItGnkJ#Bj{cI6lI3C)tMaE}BxcSfD9M0%|1#fX2Go1EibF?? z5sVMaPmJ;I(l=Tt1RtW34N3knLnew$EXd>$n`J~Urz z6!_aN(W|<+toLdpnq_e*x7Mq2q^o$6#@|0;tt;4XSs7bpgNC}0DLqCKnq-$ekzPOx0UurjzLTpICR8lhMXCz ztSxSs%#|&sRUp2D)yjZ&Z`^!1tm(rX2w10Jt-nu0kPCSZI+rm6n$&CC-7SaQz12|i2ztgpJbR_I+2Oh+Z)9ycKYJqwEs6n*mgOOFtt`z23ioxKBQNWDaf6zHp!Z#eMvOf{h>J zz~Y}b6$3Hn{Q`4^@t%bHN-wha!mx$R4KaT${&?bWQolfnSUak!qMXE)peN~HlX-R@ zrnRLK&HBORGY#Ns-%vx#-}3xR>Gh=PLD{I?cSp;jinCdf$xgOz@;XC=5M zxM>5%pK|XyBy_vLpsGbIPbo{@d85TQkCAIH$c7HVmQ>>fKHWUOQhKzoc8HdPXQ#A1 zx%L6hQ1oV`^sCXHepu-KdNCi*6>oApg9fTrFRduKe$OO%0-&a;zQ4tREm>q?4 zpVmnmyClm%hg#Z>e)A2l4)QX-*8;;2KbG-%SxGh9YpC#?{{HxSd~UTC%7Nt-zDKwE zq%NPhxmso>Zj3ji#c(TvS76VP?LI;a3LPM>%w*8lWyuA(?6(8CKJ}BJF}(yWN;PO( zwL!8@HxLk0-Nrn=+QG0yuj+d{jE18qU1ikB$k5*@w+wq{bY~~O1Gl3eDr~Y4@e}N# zuN4<2S^ZAsH=4ZiaiG2=f8mhi%xd7^76n@6)&W?M&W8lXQut_Zo48x6QtBe;&uuG%Ce4Gg>mo zw(8g-;@Taw-l^t(FgiP1`ZhZ?zdwLY*ehR^)Nw#vPNr?GzWeL(k#O)VUj%3$#IFOF zQgC$3#N*xR64=!5cuz4P4M#_&XcK!X4;Z9W!K8i`u<(4E8&cv@HD47KyvoG>Vc8VNFT~H9gR~##S)q z!WSWwAy345=A~ZTp+#4PgTV6jPtLB2aeF+vwr-Xn-3ksyUJB72+?&%8eV4!Yh8yCg z)YTah3sTM1Ec6sp%t>b#PX}ra>oZ&=zK8ZgAK#DLud6cvTy7*Ubj{^4i%}MrY&tlg zvqJ}id$SpzH$hkOCvrLKc)~sWYe;UhBBw!GHgkn%OV7GjeTG*inTYW`mBP9Oe6a1L zECf`r5n5X@09~vs@+y~_5S)N&GmI}gye!J@4n~%w(ZXc`tW{{`=C|TAMOhn~24Gj+ z2tD`Em)PXD3h~AeGb^w;C(pF)zCCW`xIZ`&oH(+}8^CUKoBZ<;YGK;HA&6KsklZVN0Y)hPIRZHe8#=+1Pc$F;3xZj1n^suJ%oHj% zv~T~#lg^u?$YCgeI;Jr#F;q1n#*5hOrIxWy9?T{%n9M}u4D7m}LF;w=8@)pHOJ>~N zn`@p2B!(!6>oLABF4WE27zwJe-#z!1_e2RPG7l^3ZB;Vz5>kGlT#rlI;a26p@m5Jm zj#sfRm4wJ2@98KR;obUSpx&UYB(b(N!!|x%Ebnv2L-w0cw5mct191_|NyE!fd(NsR z3&I=6)N?=yZGyjLZ?Xr{@t|*O8tAMhJr9aA01QcK=G{PDZDDXd9pdRvl1P$bm5~$_ zOl~SloMv<2Pw8i4;bN13d?Jd6hTXWu@cw;{<#zYit%zLCykAEhB(HT6IFI*mOjt6! zCv{=eVFb_eS%^gV^t=*!U3k_`O@2 zFc^!fDE7D*mHCK=4>q?zP}&oySm1uZ%p3A8ew$+YhUVV#JwU9A#Qy8CVfoOtcQh;# z9xreA#m9~a`I_Y{z{-Sriqm|SH>sErQh$!{1@uM{t4Gh8HCU1aY4E*0fAM*febJR1L zTYPk$<}%0~21PXq(_=k~bA8ZeiUuk(b13yiTtd02P14fHj>9!1Ns%A(ljINR?@ zeMaL(1zsHLs`)$yEvgPu(lyH*ZLarUx*_aeP#=9;d=&bL!f_R36SsLWF|EVaOpEQqP+TK=L_}Y<+ zvfGhST)qmzuw#z3j7x^AN_-bCJ8SAt4nTQu%qN8@TT1lK_v{2iXUwV>`YH>TQnS{2 zD+9(Ep|mg9kK})unrsSrTZ=l%XoRD=Nx0Nt0bF@zYq}SrVb(uir2jm5a!!^9-%Qyp z5CVCA%P(E-!heLxC_a!4>smmoJY>~6DRW`3RmIyhl@->ibC&V$B*YD~X(WwGq)hG~ zRX-SqEa-ySqlE-rV%di#*XAZ!l8n4u5Dkgt?BQ4Fsxm$kCuBH=P+u07A>`=3+{LT! zI5c=@<^nLm{bY(>FU6W>4{Gq+H)_grFpsJl$_PRt0ObhXRG82Y%Q2nnL1{S=#& zABYIE9x>cO#m@v61IkgRWbgt}H{IiDy6DBHRu9=Vy1xq%s#-?JLoh|wOJ-VIXLx3< zI_+!MSHGSAm9AdIwA`iSWph{|VD=L@m&zH6Exq@kem-!4G@Y7K)cB4*Fs!;(sp-D_ z&Fd=lT4d0aS`5~WQUwb3q_bCIF+Vd%(*C;4_VnoqG5%23OTT@=dA3Dwy9cbq&(=jo zjR4-qA%&u&qj7iL)4_gH&gob-(3|Hqf)c)dM;Qsr=ozWk68Vi_R3rB`pf4O(hyboU z?9B%KyB5Iy_e$0}p?UYw1IdRW_`eWkVESd8SJHRGTxQsho!o<5+($%DsAtOZ{Aeuc z=$&5%6P?ylUR zu+~Z}E?*?A2Rgf{Y6f#eTa?@kLD*l->&G^Qv_^tRzkIuKogO(o0S#?kAVJ!FBAZzsWmY!t6k+!LxxnZ> zTz+ORR9G(+-}!9Bfr>;c#JxiA9XGGYt#5%I?LxkMbrHmywRUxN4LrJE^#R=`5^!rb z7{g*j77%CTKYVxSu8K^qlDI5Kk8Ym#oL^YwWq-M02*YV&9P8yGx|F!?CYKyvnlqRo z;i5;|&94D9jba2FK7Y=+A{KdMxXPU^3sXaH6&apb!=ZW#3AN)wDhZVZ*(tX3S|Hb} z3uSW+`e(1`^%nX!==pEo7OE;NT3AhwvQeewHw?nl+pNjF6v@x~o*hB-2HU*G8E@~s ze-0ehw`mGU(9$)aE3_Xj87mMqbKRzG#TP2P<@-Eq9^%%_;YbUd5bT7wxERnivZ{3t z`!_EIV@5|5wgHbU{8m)I>(QsD_g+ZfrTLRam_@$+2F#t<`cVc@%^GEHo^Y)^#6m7{ zBKchQec9ULh*Qs@KBjj;+gPR1z*|QtuB;}O2M7JCV}Zh;asPFU>}oDOXON!rCZyBT z}IBR*lNQp zv(C8cLK^GwTGyIa$Ipa-$<}(@qt)^Cbb7JNKhf7ogOw+z#mTN#~$h4*?}?{h^Zc_ z*?#3C>i|E`3KAs6r7=p8a6azXQMktt6G~GFb9NG&UMjjHy!O^i@(C9fOjY%6RN{Qz!#a} znBL*FgiSlw;tR~<9eHYOzf?krlxkT8=_EB_qaYrolal@IwGuQqH)Fjw^?Q&R`t35R4IuCDU6;`c8=~8YReT#t zYG}~hUmL6C5ju!@8S4$4Y-XdyT}e?{OHK~|ZS6I5Kqh$RwuXntYv280=5<$^Zy{B( zUddx6pXv1?mmZ$TuAwHv#t79`SwF%qFz#XcOELb+r^Io#LgC^@=oJEM{;X5Jl`p19ZfX3{i+V6=W$OpkVnO2O#)W&ZHLdl7B7Y;{hHXc^zdS0<)-Pri2Op8F%{Q+7_U=B&5Zvf zYW8_jMNQxTTRP}JRalNxD8m%Cf0WU4;;u&jop}1c`#t{~UHi{fa_=P8wWlU?(*a~{g4gYM}AJ5D4bbo z{6^!{zKW_S1C5>i(y(Xf`+3sfxD-{T@!go4#BcqeHP2Ar zsE}Xw7t+qy?Jxx6CxP6y6PNSs=R^M}VP?G8a=UUk46n^OEOd?>2x=^|oBQhGua@bp z?E5erfkdjNId1++GRw_Hn8Vup&ylapZZZdCt$T$?ZEX=y`s4jNU1)5GR+H7a_T|l` z{df^Z=$LU5+cGNmfWd|%At-R)*utZ6AU)VIex@2sxwI=o--H(>C*6zfMvbL5-V%*g zG{w@HZB4zEO|B80J53Ny9xeW@ zj|^?jhRj@f4t3{0D(F~}ga&3_K_OG1jpd?J=pqqJ>ggp}X*XQbd5joLkA7iSO@5=` z3UX%o6b@p8iILW2D}Rh!dsce@5rOF&8@E*$$ixqELRV?=)`uWQPdOSR$9 ztudc%#)i$XQFBAk3cjMMJh1=>n~iv8J|wb%a{;@c=lNB6^J?s)G0P5jq)vK-K!w#` zxla79FO&&bAywGINUlhthESMYK%+97XQ)sY;P0`hh_gyOllRfQ-W&b-14Fms4Judq z37c69YTUF24vOdVwXD@s3{2KY`^R`AE1>|A2f*TsiY6;t6`H)IP{KlP$W2<@YW5qe z+e_WgcMkieL_DMFtr0t^jfpGVGQL%xN0>eGr>x9&1s4o_v&^tD!6iTIQVx1u0b#Wy zL)VmZ#KMlLW1>`kVrIm(EjPMO!4+EgYNw#Cn9b1zBvABT$llMU#fW?FC66g#bd=lzmtG{&1r z9$g)n>bi$wpS!6yK zVR(_leX5MCQ%VW?w_i$R=>uT|B+ z8V(aKXOnP~WmAVBty%2^>kLhqJTbjkeZ^^sqkibH!E|Dqjh_=jfzPH0CfcV18+H-@CHihzXhXlPe*1>5JsFk zRt{}lQ8u>#BZbnj-dV9G^{9Rav-QL&v}X9>{A5{Pu9$8BGTXha!8d6}@1O7aDp8st?K$i_0_rvL94`D8yToH`UylF*MewO=2{eq8#I5@%+UJ z4I>vv7miH5$=wISv(Ce9*{ZhgEsOEG*)y!Sv1UgVS={$xhDXH>P2?Y$Joj<;dvDiD zNtWBGp0uogw99?^kcKyexdIrr(rGnp)3j$sRRkxO5X2@v&P3h*p^u3Yp6Ii%mFS(y z$^s>FU9?UtmH>Zp`?ry7aj^{@10-|HtQGnKxqZV&Q`Y&O}bqOyQX zFD-2OPF#3|gObZ!ugS^2$DOjTavKgP_aDsOrayI5HG1o2ZMd<5{UAI#Fuyi>2=*a5 z$Weh2j~7mLZ0ZeiyB!hv!J3sV{Aj*8RF+1kPTSSB`KK2Q%+ z$X#lahVKXgT`Ot~tWVjdqi!kbs+Ae*aC0%~j+iCM5XqI6&rA!mRkWD(@o=dwAA^tK zimMP1)|Blw`b@vU%R|p<*vGPUBtE-IN$==%s#~Z>?VuOPoGW^Fd6~cW1QAQ-^1Nw z5%7Wlx`H0DTz86V^Xcd-N(F|8W7JMN)JXZ-vVZ3`=*tdf*vydFjhK}(6PORC2N$jb#)!$leq5e|C? zTvqI9;McNOGf!?83yaTKk8b4%L`0$4zD|{ z{HuCrDPpPYMjmS`uO2J>gzOL13T6b=TW4v82|eSre$w&;rJ8tm4rhm(j+bC9h@*?w z(Ee)j3wzmq<7xiFj8u)yHC%(utyt+A+)6ArWM5-_w#Ax1UpN@iP;yPJ+_Ki){khcb zH@dpIpLV#r*pjI7Tz+GVu(GI9?!jH_-Gq7UeN9vLc}f2Ay?@sNW*XkB5&ASQK;%e6 ztr9!CnhJFMEm|x(5lN1EmO(9u&rn?I=Q<*B;&b=s;K{*q#<*Zy=Hst^lJBvo6b=0* zoCKh6voE6$NA`8WjF=hdURcAba`Kg=BiT^4daGkG?Q^IXaFU^!U3J=OyYE zisb$B4AqxZX31=F_KOdw($KhE%q|i8DC8cHZ=t0>Ez4O`%2QJ}&UW32<50pwQQ@|_ zOo++q4ZYuh0P%{;RYtoN^*rddZvF=;a$JDVjsP0@2G)Ms#hQBPV# z#z>{_oZ8EvikYjA{PMpoPT2V{X`P-WmhTz`ibCE38u7*@c;mw7A3OzZ`GG<GTSqc1DR-P@5^_5yOF`I&FN z{72*>+aTK+8)@YnaLp|bSwo*EaOU&y{zZOCKVPy8Q_BrHvbM}W)J`X>4uF9fJ&g6H zI_ra6T~n`BPOeKoLX>k$IX`zn<|?!bUyOvF;j=HdzZx-RF|fT&^^LPG zOg3m^nFZNAA7O1C2&blLbFDALmg(B<2|m-IYX*J6kn5$}Z%*baA9N z;Azi7osoBs>TQSLZutsN%Dn8|+ZU4IlTG6jYmCTOLG50^0-G{ggB-~23#z>E9#-gL ze)mD&^rAV|>w^0H+Y}ki2X$u6b9e}c7@fn6M2E}5vd7q75bj-BT+h4`nV&)3bR{d} z{SJ4XhV&8AJo2PJA8Yv#2z93ix%FExKh;Sare!?S|Gpl7c;N27>Q(|JOZG7gQEE+u;(5zXE)$WkW<$;P&3wo z*-vfg-BH}z9q(*%PeCa1ptPGv~~d!mA=$FPi+cK0t7Wc`Tjp#?`5jMupJ z);+)m6ckf>Hd9Ip8&F(POke1LaFF|%U2T&~m#ghH9^oC-v1Q`I9-UsBp&B1;I})Go zbf6ijv&!;B>ugA`u8%h#<{7)AV$M%|U_hL+^u!B^cx-ky9;(ADFzZ4Zje_txTtzbb zNudrT28Ucumzf3=!Rz0| z%DG_fB!KDz;>%|~m9~tUhO8%proknJEkDCCkJX@LSRytmw z+dc>IFI9Qdv)R|(+M8ptGdK42!~ll$`?&!dGj$U#A!NRPuQgw8yIiSa2m~cwJhw&N z*M@W!K4vvpkH(&b+N10n$;R>IOLSG7T?+3?mR-=Zb$C3#&>U979{4C3IzFLg97`-0 z@MElKy##ITEc}fcG7`-nnCcA`23<#&GB2E0oJY$%WO-U^gvAs-rSIZ*a7c>9#j@B; zc2pFB2{6)G-)DR*^OB(aBb)m+qe*ExsK<8Y6vvJ!hz8U-EqOH7ZHKMlS60wr^`W*7 zq9k{bJHyBJf!BgNy^SL;=O%7fdHde847Cf;>==#c-Zf3>SV^ziR(M;RkaI1d`Ey0w z7u#ar#%!j&kr!J=fi|!EVq=$fz^2vRQwsi2hL;AB*;f&FrN5yF+u z5fP1`qHBUlgEbe^h3G0{jCXk18p?z5eBylXU)y&>f&&k};Em(IoOxn29lzd!u6H)S z<$h`G76P4MS+r9L zs>Pnm4gKZZu5Z7z}rqvnnzIOhR2$>f1!Z{!Ye#Qr9YQ zl3wAfKlPeLSxCl(BO0oW{k!^M!!MToscHbxA6Tb>;rYgwLmggxEY-lFDQkM5QIxHs zczPOth|-MMDx4?zhEK*glb<#dlmz2tueOMwL$yjG?xERh(SF;N*R)o$(K5h9*Wqwn z^Gc)TZQ0^+rWHD>92GX*8vc7CyPxX8sq-`He}A?BV)SFx@9-FLrd%Hk`=TPu+XYd*RBdq-I^;^H#8wvqd3e-%0+Y)%Qg*qIkBw|B_32WA zpps)KzBKQr*<`c5#*6eW&~)2RQ>lhz1BG~kdoTH_S3^UimzmtD-`pz3+s6*cAZ*+qV4X2_l8-pHdaKGfcXOI~=;=Jb!MHj=QA5T;V-p&8-~em1Re zjQo)LLNZlMN}>0QGlwM`fe=XiVF`0bHJk6}K6Pr<)qWpCZ8MBPv~1`MTad_fU;7@%7G*zt{Kp1m`QGgpCNz|dm9bWzrJ2Mw$oce*-nQmX6B)1=3RNV#ibcUjLNPV zM*nF>K~$tR@(_wfa82JL-jnZAt#UEX6z(^-lXa<1$dcEnR>(fIE|+lfia1_PA8*)F zaSrs2I`VvHaZMkXw_04a1q|Ga@}G0p1veIrS^&_tPX7L#8*A&V80#sAcNPIXbrlxx zdM%+GilWr73$7CdDJtABPwn`!b|Th7?nc`fSua^O!FSEga^0>vSBCW++ zg*uh4miSo9@pAef9x@vYX0Wob@l{z0SZto-H02%GMco?eordIu8YDd7cX;3VDP;i) z|5`BI_(H+oIWYRTDL1JfJJK*%{nSN-my@`69amns8^MRyHB;~Zc3(%D%gIIZGF7t; ze#c+itB}~5o|2%<@=vOZ3 zzWU)sr&=Me{MlYSC>>!_tdcKH$4>9g2$Yj}JkV7j6{ z-Xt!+yym8sHnqiWEDPuGn$kf^1#jli_oN>`RQZ|@hxV89xA0IO-t@##N5|_El4<$& zDvQe)XiXd@EFz(rK3=)D-P+>IQVtWd#-B!T+z8LyJ>u-fFFg}jP28!Hdm7dJRxvSd zIX8`8!loRQcB<-Z3qFXZ6L_E@mBF~ykarb6FtxIXl~VSuoIX$}r9Vt-q&LeQ-{!*} zTrGL?6J|$s@R|;+b4MP`xTu_L)*gEwel-~7S_@s9vLg=zAf%+aYd>a{oStRoqm7dU zN0ot7hPG{u$Lws`Uk2{}lIwFF5)QcZ%!8~jm!oi2B*`z;Zy(|^SJg*}xMLjScvp!jKo@C9*PD=b|tA}l;r zWgAH#{1NEeSpx$CTDLnH21;wGKXB4|84P?lbcX-i(w;Ei%=VfZnXZZrz`PZO-cv`Z z{b@9H_u&6%T>k421K0S+)%Y&UP2;7xwF}7z=O8_S?{p4 zv2$ge#d?v#Jaq_ob(W}0%*1I^b6Zv>@FXO{-Ei!+6lPHUqKTfF)%d3hNBd9yZ93oR=xm;8+UUq1IINb; zK5+231h?(}cP&5?B=pHjRbEFXKyB7}HoLxYsGb`ir1)n4*Zt z#y*Ulmf!4)?G5Sx0u81;8}zbeS*U+Pu<^fU_Yt0Y6ye{uoL-&mq51!q?A0Fcza{+h zuKSi}Cb?JTY-ev+g^!#2WOqQE02bk(PWVR7t_Mj^h86b)Qw*Z<>=oON2P))om1gV8 zKc@xIl(R#eAZkCw`OkoHSwa&M6VWY!8*=btL}CQ7pg1@5L)24F$&-)bZJbIJu`w>%i|A6Al+mL?8UPKT+5 zsWSmrvV&sztEnAlf9!BVpqvpX#A21CRSQ$+$g^XNaOwwYwe~l;;RhDivm8UHH5?oq z?teu8MN31|#C$znTDpJt{>Jq>aro)30{WPV+R&?u&(zhaeNOq)$etn}3(FH~8+K2w zbls=)>TD~xQa}AyrxR{@s#q%vEN;|oY63)36nCQ38pIxn4va-8JuW^Oa;X^K+-TL} zHD8>iE%7iCMPkR!!O}!G?igq$BPaz<%^xBC$kt~E-7rUmp_8=*>KTVuRXV{^3O=w$ zB99PZQj=k4vsi5X-WpGhN1@f&?p*ktoO4L=#=}Z6Sm<62PQ(5Tsd*=v(u6@$PA7F$ zKT*f@70}XLY7Xfp=9QkB3zQw#2Jf%e_gn39&x+^C6;=pJ>5R4S2koV;1a3$Z;S)S- zc09aIp8A07DIXywS-+TF%-E10agD7y9ZiRpUFmx*vjn9jXn%ye@9 zp{|**E-D!~G*&)9&%P=L&OR)3f3u-AMDImCDAT?hB~=RqD4;`(QtF@8hW2z%Zj9A5 z+!?q75*&%Zmxp7JnF>|=fDNx{-|-r8_%TTlHW+{kFGL!0V{;&k7Oznr%JR#HjTtHr zU_^4dE+d|AGdQhT%A>38^kDKBQKNsL6qEaABZ3gN2`DDzSluQbWgp0B?#{itxYaZ>GSBhFIinC9BBsUv_C8w9Q?K#TG(YldTOf7QD1O5n|Hoxfw*G&eE)U))rh!z%2nA>x;4Im(Q zWK^X0T11cCSmpo9rzWt0zlR3X%G0!5z0ua&W96?1B)yu@ed8l-Y{4tS+We~bqO%XG zBnJRn#J%#_;l{TDL{~PMCFdekny)3}(id9SPQuYYK7W7CuCi|yPw^p>_Q6w%V8s&> ztt#?t-ioye$Dmmxs3SORhE>Z0${!aHDfI+WAX?A5nwo?M*oFoHFfkMU=F^U2s5`Q~ z-nq6pq~%ju-&CdGcn5DO!mLU#|H>6T#tY}<-o+$Oc7zlI!2Yin8LWXQ4RDDbMERDB z3Q(JJX56Oj?3uTz(q;6m-N!I;6NKfN1f;~BE4$-h#ugX)=;&S<=FB#tz2iW=D^awYqejeUKx8Q zOB&%G>$zarzmKw;(NXv@Y|F;0>3AKnzJbYp=h1|%xvpx2`TI*1W4YdBdFo}3EV_@( z^Vx*t`VxhyEwOc4? zlXIdA1OF^U4l|QnZ>6o15-zwD>PIp)8b5Q`o>y!5IrhAT6qcs`$=yBORa){hmFZRM z{wwh$(T@r6Bun9wFXPEAS=2x}@AW8O%l4#`K|G2K8sQa}6VEo1vAUlx zwl{#O(vo)DxJo@Pw*7qZuqWNAUa(AhBP+yqm-h9do>Q8gipn4G^=c5n8+%^{eoH2g z+Mc2(6`F%H5ot4oXeR zycb%YQ7_v)krs1vP5u-1RrUs@^1=_e{z(U;P2cjh(p)Su$tx)aXIKrDme76SKP4eV zBJp(9_H32SK=DbMOY@(^7w02UGHM?Cf?de`I|DvX8y;6}w8R1+!n^*@^~{yTpD-+;>3l#pXeL~>Lr zym6o7orTpnAmWkN24MV0kvE^gWlZS|w6QeXYAiX}whD#>9l~+A+H2ks$NLToX9{Jt z{{cGDe&T}gt5bt(EgSds3TEejNqKp>2-nsZR9w4eI((jNHQS0l_ALva^5FV6U}|Z3 zMvbCj3{myK9B!UfC;1BXTTYklQzV&qkUQmZOE%JPH6Su4BAe%Pq&qUKKG(kJ@$vRZ zEevcQW;4wn7(|SUG<}3WkYN*$T0C`FA20}bca`ffJhow3&hYp+&z{{5#N zx&~|E3l)JvULA!cam~k>*GnkBC5)u1J~J^kDc&eU^nGHQ&Jp9Q8o}`W(n%gmw=OUH z4mv8b{R0Vj?d>aS3w=XV;r)gVuxb46<(+$}T2DK)!7a4YJgJ!31Q*E!XG@h6=!URm z<`w_0OsPp|L5@s)gPk5CG8 zDXZw3WtW6>u7@5lgdRuFc8-hYkFNOI$ST>I{64VLCMnkDUOqnt zGu3%!^N7z1LM4pxmRzMxZz%)lA{aI_WuT4fM_Pc?vTTf1s0w$wR5^ zpjQg>6LY@_&z3Ni) z>Tns0=jNwodv1l#G;3e$YIdg=*|L(9D%UNY|Lmb$%~C)ONHtQ zB6Kr|ncwW!+GTsw{Ez(MvP;flS;PiqK#9qqm|ut_K?W1|tJ-R#aVGQ~z-I_^Af;{p zEWqBhI41YXJmzKK>@EG1E`=MNO>#RRITIOsMQZ5h^<5hDG=*WFw*^gD=A<4_(Kiqk zIaV+rhjClm^hpz3U2)k)P}gMR)_sDJ^OjZ%bg}UK@Q<+Gj`B{^L&co|_kVGP@nk^n ztS-3rfZZ}jxFErI3OU_&1gaTnD3$zB*;pR-uG>dTtJg!&?azRH=^!{qjmz7)AkYQSUw}Mdb=B zDfZB3B8r)00}9bVEPW$J<#g!~P9gX8^+6;2u27E;OGrsbJQ10;YV;#=n4-*eQwAa zEVnq1oI_Y8BP+&7D2AYnw}HWnHIG8PEW7qc!jRkz<$AJo@4Oc+pPKH@)^AAnmnhuN z_ahx*^iBpF&=iP(h?ngip-4Oj9#Zir@}sk;DBLNlE}YN0jmvVRWu^R7bi=f2!8bSe z;r#zZ8V*H=fq;h1k&#KEai+J?9&&`%zeu@L7aQGU`sE#4!_p}-7KtrhJb8w^%Ixm zU0j};emTra96BP4t}*M1hf@TMo}SPu4OBl#6+$2LT(`63$s5fy^b>-}4E&edY>Q-jN48o%geaNE|OaF7% zD01?M8Chk^Tyc!r*?f#?3+yZVZsAQT2tY< zOyv)aRZm{76X}vpLX1d<#lLMN9Zno6J6oP@Gr9F?gCEy+;`A7GD*>u<=}`^hb>zAn z=KJAG)U~1W_mszoW6AN!)IP87TrxWBSe~(I@u#!f$@NODA_m9)mO4?7Dj7Lzb}<3? z%-rb{q0w({raF!rQ`(h>mqd(ahr^VEVd-i`qvdT8Z5B5^w6|KRA zVB7t>Xx)&yB^y)yj>D;_`JLB~^aNMPZK7q_jjmBvE!>*!!i;Dd9`PZ$!i74lQ%(K< zi8gR#{I|5h+plYjXP7D8wMu`Wm_anyyTa4UFQQ7lsY(C63nIaAyk+1-x+6Z>ON-n# zV$jz9&%<4!%SJS~jSKERmY0|3J*r2uzTRN8GUOf`YQ!uDc~kLwpPy<<+X2V-CSs?^IBotcqwllrOp=D&0yky`j3gb+sE|DgWk0UCB`Wo2G2 zu78*S%zd(yny3EgY35hsb^awS{ZYiIyF2RCtN$~XI9^FnA&n+h0$_iXc{^SuC8fyY z^vL6GHiJ*A7F#fYfzrOQr|12b)UFMZq1^p~Ukk=Nk=Us*$pkXFXAO$B@!Dubso zE`4x#70$eD0DgqrZ3BR-#IH~iga|*7e>-~>StT_*@`&_>EY!}wBZ;5g_J~Y5sr=~! zGXWn?5&e|2?+rNaAu@UiEz|f8xCT`jvcHBJT(b`RSyVI{)w(|JGHi;uZpt)~`OAtU z8}NrkZ0s(l9?lHtnGAi8qk`vQUh#prWzSw+nFXDPAoDw>Mn0#(xzP}kRm%>BaWYdl zTD_ruMz)XoBwszCcR@cS_~+F5lfM3Hy;HJ%*b|pmw!9gBqYGSK^fIQyQ?{><=up&H zUpcc?Xz{COJ!pl~9Q>@n;gvr}%KX=Jj4l;5bxcPgox%Z`&5uGaf_5@WGR?GOE?M&? zOgcMi(t7HrCz@gRnDr_jy!Wq{ZFU3;Gjm?MLN;>mGwOBY$z8k>(ef*$L77kJejq4f zNSzC9W#YQ?>zZTV^4^YQxHk(#Gi;$VtfRi{4_C=rEDLF@535>`=<9Wt+WmNNN20Q{ z(^9Ze(!mc=Hzek1%5(RV>}1fDBgjty7A;UL zIF#Z94-SF0XwepmTPa0@hu}erLvRaLG`MT9GrZsXp1s#P-#Y8;eeJ^^E)p^`nPi^1 zpWB||E2DQBW zABvov<00MJ6v^I1`(`RC4%OvVbi#V2e6yQUnuJv~=6ocVnS%2v$XWTwyzNYj z)7S0F%V&7MQ%OPUdKz`t?J_u>P<-4;U-h9_2STfh3N+)fxa$F4wWJu`tF-UhZXWS! zGWRwz25w$`Y+)L)Hop(VDLh`9^w_2?SY5E1K1)`7*m8K$?Crahb{-;+(uoN)2tis)20Q++!eeIwJWiN%SC1;#)nYjq2le7@CC(nMaB zF2aa=#%=OiqDd?KXoMH>uGhuezXXZ4Kl8DQar-AS`<>;*Wc+xEik8FO9>vF((AfgT zV)J_&P+u>`0XaJTsE&I#KH@xUt9J@A&%BQz+Jijq{LLI5+%=w^Z85Y?A{+B9HMMkC z1&WG_+zU@JVSL7Bewv{#t_uWQ$y4O7f*<$5iP^WQvh-i19*S?*j$7qbiXtlm8bCHV zMm(`QJzcR6w=tfm&0JU^{22c(CJfClFgtvD-|()4(4SKsXBz%;qH$;MbXA2KC@=ID z?e&DiK=`apH%qTg#16?NG8ka(7yWF@g(s=tQwBouXijpGkzm)n%hYx&#JbqJ*V>g%_1IRAyH2~Y@6)khVB;JtgVlH9zxH?3^jD7Si_(4@y6=ODviDS zu}kkUp-Z_6$E}3!)*I>56c4kGx7y!@39e-o)y(gW+7tHbpzI_p@=HALE1la*ebMUD znKNQfjyUpAO(Q-z6AcK#NT}2XYq2K!Ih~PZMc-pLtR7K#_9Q84e?WQffs%{xxjI^+ zp)u{pHr)X&7F1pU%j;~VExUQ+y=U`TGLXN1#b8}N9D8-x-ki?1Sd&tA{*YKkI5U!m z*zz!M7`H~4c%9h(d)GM6xQ?+w$LWQy(Kjb~rkFjaQlHMIf{ZCeh>EYQmYqplAjSOn z@GVI6cXsS33kcb68#g*ENPTWyxZ|!l1-@%8LXq{*lDi|c``EJcmwFaAqoKB?HIy|q zjW0LTi{mWW$9Jw~_aP#Mp(d(Z*_(=2)T&5m4NJZbw%tBwLUTN7M=R@+NcH9O?cpC7 z9-@#p!!?WOQK1FMw5~2ngknxCLQmHv9FWj>B~0KGf_CWF)Y=9P$|fA0g(*(Su2rYD zj4_7VAdBD1M!+28J#gDL@|X)OxgsE+3fwoawLN6P7rg`2GO-i!p1s)9eNcH>?(?$R zGD_w8h8Tx&x)PGsQJ&ddSbXt~jBPRkxZ6Hw-`Vy8kY0%Y3GdnL<>qWY4Cd|aeRg&x zCo2ocmW_0bqM}$iDXf~bbhFI2k8e zC(UbyK$gE^tjO?e4OYzCQ|4PBL+R?~>U!AZj{}f(AB7X&GA5audH()3fkYw|v!buJ zHU#gJ1oRoLGV%EpitX*~sHi9=;PLr`1z>(%*>J(3OYLNK)X{O@ejS+U?fzt`IG=rr z3%Ram3bS6vTBfDhL4A{jUf$Xw8A@hozE*p6qDw|6S~eL@M}+2w%J#P|dgD7hS~z76 zKg0bOzk7$L2(210SPDbNL?1-_piJ=3bNRWU!qd|$T88Dbx=h`E(utw}XAfPG@`Y^fdtC&-pN z#q1WYu}RxT8Rm8ON}%~T#feh&uqGp0C){`38po_BzSV&kJ?C-1*cv+P#bsU8aKGIW zOGl`{i}x8l-+uzr{3=pL7-T9vIMAyoh!KCGAb1rOx5OEDhclU9wI|wk3x7&Xe-F*k zJ9f>Iz9poC2Xl=iM7l-9>=pr09oJu5@>}{@sZHP|S`C8H(dFO8wB00CGbynt7WIiX zl74nB2WZcIf(gVRhxO^E+zG`+VMt6&xwOf^9z?=s#(9hwY3JQ01>{kiwLk2 zTJi9n$ce9(D5Zx+L4t!?8hS){8zH~zh!AH&0WV6dIi~+>#SJ|A-zsj>85C8cUt{as zHbs@4*9eqyQ!Xz&ha`bnlb>a$;^f%5*d^+NgAo`t`%_n`+aZzBZWbrrA&8`$Q-sa0 zyJiIJo|3~vAjIYOHMWM6+0|HP8``~}9M2)f?{e5#-tuD(-7Dtsu|CJOsSs_#Yp0vj zNmyi?_W)q(90G%fgs9VBSYFza=GrQ!fFZfMFvSc9T$!E|3;C^27}PWsfg`! zQ3wVx14iPD+3OuG2^ptj82LoE>j%Mk_%0|^P{GS>0h-j^GyNW#1S9OFQg+Z0p__R3 zR3gH}*!OJhe1A-?xDwMXs-%=0Xyk%Bo!?zwPFQ3Jo+-n6$&3;}p0E3CBf#+#gGI3x zv7A$RzHqop`cgLc)sl)*Qt>g3J>DeQ56r#OO)#M47_Xl{Kh%RvO5I<_?J0Exu9m1z z!AFx>JXn94(Jj1-nOtZ6&EPC-$Yob0-kMAcx|^uVlkfSrP7v344rSG-?uY0S0U8r+yL}QLEBkERtG9QGJrMLepO>aab#SOm#u8@uf%Z68D1)qhHto(~%fT(%spkI8`R0rOUW zwS(afvS(bgCgqRUElCoYLfeyL&v{(20UZ~0EEi`QyPS!o(6TEJcfncPK0T%7H~SuK z+4mT=xiXTKq$i)Def3ZPwIh7<#>e)T!hHHa(e}Pf^|J?U71ecWXqu}cPi#k()E8BH5O>!(|=%?D+G_bP?#9CyXkNqJ;ygqL~7~D@ib=f#p5gz=62_lrQ zXK|hGO&+^?@#AzhSxTO$twQ72P8Vq&maUOF@XKC7+0Z);R16b1%`PuzM;6STfyc52 zO;!={7()oicQ5jM(RCTYJ5j?S_BJmo>+FbO?7YFEhfX(nr2o+mrQrmIa$m+IC`~~o zm_%AoIL(k7^64=ba&|H;Ha)#=X%jP=)X)Heo41oF7k}+|ay`R0ACim+=j8Ehj~m{u zRQmfvY5d!hx;SujFr<3T?k+k3gK`N2;>D(q_a$W|WZ}5&<_&6ScV}5-WF(N#p35*4 zBIw3|XX6Vd9@pK}UukRLR3dQe1VG6GZsNuLn5?9?V)8O^J8*8XBy+|v7FU7mPhZQU z9sZ(@9$cA_RGF|PMk9K?Rh;=;cxGm1aB%QnH)DK!{MO&Uzb-wNv$z7(J?vS-l{YYE zJXdMB*mUqaU!aM(ehSQ=Z+Xa3cG%$H%-FZ1`NL1=(`MOkFwf2#KIb|u=4Wq^vi=B z;Kuq=ysWIuDu66Pw#@cJ%@}yH!tP;9fnn{a8LtH3lyl+sJ01H2V4{HO{{DUkzcYQ& zAm!TM)`3)Ujf_8QrNks8E=IJC3yX^Et*n03nwpsf0DBexV5Ok&pc|9s9T{oD)u41v zuzQh>$ANh8;KB9%()3<~KR|B(ui4A~?&17z#KZqk-8rXFCVqH$n3tEQ+9%C4nA1@i zJZn^UcxY^J5QEcNy>?_jJ-fDieMJ5`pj2gzY8Y(&WOo732ne@5*8pTB26$$*jiIqI zF_7(U;l4LuQ+V&{(M%1J7nG;Sy)kb3HkxN~{r6eTrhTGs=7&?*;RGI>6>C2vw@2mY zEiQNXUTM(_d{n=`+h4HCHt!szZNXeWg9MOD)DJ)fmZO34TfWzDng4Vf=V)tMj13Mw z3T<|dpGTy~ywM}x6)x;`MYI~#*YIi_3M@a_E)^20jzCA?vFLK<2{!CW^fk7}iPCsF z7O*b#dyDD??o%3SW~wH~!{YfKn&<>Ry!H%s_iO<1U3bVmxBJjgl;gH0YHWROfp;JB zuxU^YU;tXJsr(JvaoXJuQ-P^R3fq~I(dW@yHA7-Eqtj{durE@lCkqH1w+e5 z``GN{h%39VU+e8u^aq^auhszXo<0}5#T(5OUsd}wH4gS*2m++ZFIso5Xdcb;iH_a| zCDbKPY?Jq0SjU1DjzNF?LsZwUi)a{^dnoWGq66Th zSFOfoiT388I5HVT#ZCnnw5UZ^L#QKrh>caDFeD^`^|G^e4c}*ao-zs2o|JbVDU2<} z#ipE7B0uBXsUu^L>~;#&Gx@e=Of|W#Z0`aLok}-VpAoNYe)N+{#K2Y>Ik^R~!abx# zhF+CVsLLyY z9AlGllm3ohp%IC-hkL|kJSV3@ADPtF!X=uI@?8=WZD!1Abbbri@t3=*S5D78o+$sb(i_?KpZwO*)s~iK3W??liFLEnb`BR+c@>M=2sWa!Uh~AzQ_xG& zpooan9@3!Lvh$BoL{GxMwRL61+!bZZ3@o3OT01`ZqREt;k{p|F7H(%1l4&lOYRH%x zt0^wTzeuwQ8$Y#aJ$Rip*;lx;Uq0r&cei{&uT8X*c4y!2V@f@Ko&j|dN1z8}znbXPo7sl<3-V?M0>xD%vh}h|BmJ_oC$? zSz^*&&4q3xJ<_OHIbFZtj8Gk;+a0K=MRI0XCuL=J68^BR#xlgg5>CX zhi~-EpW*s%X4F87sNm|CF=cBL<}R`mWSO(m>n>tfbH8bq0MHEdTKreBU^hXB6=qiYwWJb6lvJ^ zGTzwm6YRZ!uX6?!QK^~dngRQjhRP8YM(MMV($!!78Y@qv4QnfL?3naxC47x55i?sc z*4FXm;X&jWVHShMlhx2|ma zgSz{=0@$jsS7ml{B8=2o4-76uQma-LPIPvbJE;fhzQ1iBol! zV^pjB%;w#xsN_~E*~H?}*9)_SH|`&*wK7;Ts>T*kKOm6PD>08}Pp6+UYRKH;WeyX$H zIc!3wBey!F>;;z-2}|R!d&u6(gz-CuvTF6OgcLa;Ek(OizOE`{EoOEJOZb4o|8t)sU?JRVP_GI;e-t`?$JDn-MV3V2zMZmWv1-SX z7*Xbv1E(2ux*Y{A+XsYq=n*}x^|mwi9-A*Dd|RI0__K?cT5p4VzAw%%E!1M9L=*GX4&}}6_4HaF0vv3BJNaYr zD^e_gR)Iz#|NpWI{og>axVVWLSkHpXbrtyg5$DSFhW~A+`oG!G z|2Oa0eTc=rkl!|T6ES-=XME+d&F7cVZ$Dh{?RZ-k2yaa&}(wEYw05-Q4rXg#yho9uoIt{&BTARfZ!pBXJ zjlthpQz$kew^pv2;bn=@`DW3mid<}?>}mniv~u9m7FDcN`sw#R3*L!C3-~M9Ka)WB zcOh8(a;Fw(K3n#wfsPw}*d{a9v^cxYS3xUtE)7`5$d4Ac2H2Xt`)?%xc@9axx{I7u z=H-UEQwFJvu@0cqfs*pUQNmTL2JU+L)uR0)z?uKAbp$SjG|cvWG3|wJgsOkkgm`!= zLOdBee(qA|#H@rn$s9@2d}<&4eFD|*{XI`XLKo3}Ica<)yR%-gc7Dgf(9@Jl?gn*S zFa%%k{URS`_Ash2bhhL&SUu>tHWlUTw`0psyWGA`l&*_BX*@C(x3F1W_?3B^nnvy^ zcIu~uy1vQoOIhUK(P!XgQ=mGFP*<5O(zWqYe)Uh2i6IK zAn@9sdA*FbIexl?8~kkUUG{(B`)ji*F69@6ikq0}&3$}b5GL9`_v63=*D_TikkQTI zipD->(r=~V-2Gz97qc`=fTOCf?IUCa(<(I5qcHVAEtngLxzuH3^fXRLWgAZ7;;Q$x z-fY+@@cZ*K7!a!@!GWzTeMORxY*FnQ%RJZnSx@__gP%?;FW|R_J@El>Kpi^4E+mFx zuNzO0ciNS>@NH1_r}_`>-{IM#Bn9;%eb0Hm3!IOolM9$NZY3E6w=iX`H@eIG7OtFD zuv(AFb9HWLAv-Uz{-95e^g@^C6J7*7M&YtFWEQ!-O!PbN*)5||r;*^NMVP1w8y6RL zu9+-4$G!0N)(VWBFr08)_V|XFxcE{X18=mPFUOY z%|dQ{IQ7>^OgsMlVx5Ce1k_9b70WOnHGKY#++goFjpW&;Wk#c~I=1ByO(V-CaYBl| z_@$u`XwU4)-r^*lIml4r|19w3VJ#=YU|hi;EG2bfQ*H)CK|t2O$CR+bMK)su&s3@4 zErYpzg!53aF=~PIId0JVM@jN zuWp$A*-_={o$;osabc?07xnc9j;zN$DurRywMO%Da-Oo12pv$@o=l}jhQs$%pS$>* zcPdf{psWg&s@bY9&B79A%^?qkr7l-tahomecF|Dha|)BbGsCC0b`EiPbe`~9lIAXn;hJ0(^s{Jocm zc)L?i>ar{a_1sETxEl|SXqxFzqhujar#eTYB~lwo+aFwWGDtu6AY zc54~r^Ckfa-$V$fK!=%}) zK$W_f*o#Bo9xg^&tXYZkjl+V!42QV7!8W1p`KR?l)`H5~2-%>lbm)pqj@|PEt0l#t zV@O8OtEkKsvfwu+PlKjK^-mR&)s&OTBvLw_lo2LcC(I_c%pw~fe_0mjKFdy`u=Ai- z>>4EMd_%eNXZH!Jepl)Y&SYt%e`LwlaJ+!O?w9+{CPrXZ|I~6(^^^W5sc$<5oSd5I zx5nV18x*3&v5YHb)XCEf;quO$V6D_?A;68#)YOfdmrpN@N3{)^9%zfOU3gp6O9g`I;EKA^lW(ghw@2Hwn@(g>d;CJ=+kY z+;F_pZfn)D&ldfCgO|`{r|>CC)Vno*`|@t}WuJ@;+vPkeuQ8OgRfGNy4enPd=xHD2 z>4UozX~wLNc;l@r$|joP-X>R+GRMP8HW0f9l(8erlu5OXgC3VhYiSF7h0BOC5L;N}u0u1cr=rhq25)an(n-fepGx?+7vl=$z_Ei$ zU2q#8Y+7RBrysVnZMS?7)zc$i5_e?_1{X*dhG~?Z+liJHdMjIUNLG!IuxYG6(Hwli zJ3(=Kmf+hii?ee+a)`RxqG(prsj~Kq&6t7R)}>j^bQ_3BqIYaLPiT3GP)irjI0rdS zskSNdI_kxPNOAaD&(9umB_~kKtkiES=ia7_O&p2-rpmFuIY)Z&%af&T?^I-3sZ{Ub zVhrqQA6NifPxsSU>cM4pP*FioNOE2M&6^Hq15=-|X}conTI7-S#t1QA;+r~2A8T6= zDpm`?DDM)w;mQ0Np#?doxq%@d-Ef^@5P~;o3HP-o?RiPU_b^^80DL=H4&XgA0RjMa zf8Zqc7uKgAo%^V%Ze1(xxF?mufJ_3aptvT!GJ#IX|6iH701VO;UvW?S5y3W7qA&zd~(0AEeUYMOG7h*jkb}|Bu=SBbyn>&g=U!&Ny zp74AOPfr2XieO>+qBdgRK6aDDWMgpPb99ddqF&Jel*mYl= zy4f>f?_U(4>P5ABk-!E}wW3|J_~K{b#Bc#?KEJbTAcDSJELUUOsUW1j0M{QPxY2!BgshM?FyA&XqiLDTFQ!AenoMBth&a#oR|_ecL%Gu$>?JyxE&?GJ`;3K4yM zZL7zN%VZ<$se^#6WQa)4>zCl5LP6%Z*;rC9nY3N=H6&&_jlIjNdJWY+WyzT*(kL^Q-;W{L{3c>aNsph4 zpfQ;%fVYJF<#W2|DRRuyD^`uhwfnN~kyXnUbtO*P5K;Ni9N*Ha&;^G0+1Wa9G@&`U zII>KWGsH{U-U)hE+;3?~-x0Id&r=0Vvr1WAUjm{ zS@I8!6UvNMN6z*eL^;~KNBMYc@Y=Guo?Y71O4JAZLwsdHv~it%$imr%eMZWhgbGg1 zVEc=b2CDxFuw72{euVTn?L7WG)w>>+Pw}}OW-%B3mAh_M;%U4-wC-ig1P6(nt-XMq zi#geE(c{NqsO>qSL32v3kbRwG1BC+<*EF9-n@qXiA{7DkA1maR5i;!*FV@# zge(xQ1S%BDKPRx{9?T)<01TCTDj5^IX_8Di{Y=lxTEmYChp#q9;_t4C&03R>EXU$P z{ejcfxSo3UN9N4d#YU8d4k+e6leUZ2T5%;89guPyXjywGz1z%Oo;)Ao-slcK0`)(U zVo_=1R?pI7O!Z;b?({%6UqA%qWp!YRI{BK^-HucK5hBe(a|0U`mO6r=X%%=J)^4_Z z<$ip^u^3sXQG3&Yv9bhF>{?E+w9!gqxhS$J8>ud~pC$euv*rzggomMzJ?`xC7vr)a zA?nQ29*uAHk|jC&^5;i_QZ^(+rTfUW%X-3>RaW~9zQ{4Q4rv(=&&6GsFpo_<@INjey!oga z#P&T;TuKy1_HdRSLg^F0*C-aDc#{6!YjC+4FCvD7D^r|rt>2_^h{uzc~$hbZ3w+PlV{m*KoZtJ#7Om?!aL7z=5gl>y&h@bsw zsU|UE<}k97Ix-{f!SSZaV(U;B1V?hbxU{FZSqivAJ?=Vh6s;9D;W6yslF3!3WX=GG$fLC-evoX->r)EN!Jmdhr@ebWe!-r_N()b%sH zsr@BNX>XF$P@9(zdlOA)qr;-VNBzSEEG`nc zNLN;W?MP_>)&x|E8mvenPd=ORl@nFEJ zZE~(#s~o4j$-nizEl{MS1&?g7bmf*Nl#vI{P`!~=ySKT+Lu%H#bOtw5&r=7yl51=1 zgb(ZXzHM_#OK$4|}2w7y#+@QS~#K@L}*`MoZT&iO58P*&+)lnCp5`!~uAyO?|6 zyQ97RHsa@NhB}ZL>hYF*g19t~O$&kHbo)}^p|2Fxz$gZjtCL47HL0Oihj3dt3auLJ z;vFu~)cU>&%N++Voy*kO$mufg2lmH}jySg&Xq9j%`~xqGvy{Vgk0^h(k9*hf=^{8k zAw)DOi2A4Z4Pv3?QZ~0Ac)674W68Wwa z+)~@A-ZSzXQxmDo+5q|5qqb0Tvhq(ANq}7A^arm=mr(&sZ^Yv@JFV^HU2sf^{J#UC zk6+AfrQjWdm(xwdmyq!TYf zX43I@3SYBrAocw~3u6}BuioEojGmjFzjK1+&hJ^+OuTdB&!_(*b>#m?#K`k`fP6<0cQ*Y%YJX*}hrkM@9$jNSjPV9E06fk! zJTk7B>s%o>piW;5$k9*35$f{4t$XQwrL7T;-yk@_TCUATtrPM4JF_ty~PXu+~Lg=#~`@(SLe#|0f zg_wPA+VxBs>Lfa94PnE}?-fOj>de~Y#PWTK;M?fzORThAzVN>-nRofl$U?p3ca-6i@N|j zT6>FgJ3KygUpQ3~bcUXO@tgUfr)S%{&;j1csV<5=m}+`akJ3(MoOZuFk;QzlS0Sge z{nBnw5U+o6=iso?x^n|EzslleeY+2KgNxAo^`REA(9yka*SMm52YG<^I(d;gY+jh_ z^xFJ8Al;hl1`X?K8I6eE^d|ketNAb&) zr|%6#3LE~X!YZu))iD<$g62HnC=ro}LX+re-#+KIU{7 zpp+iZRIN>xSea`g%|P3@w0CugVgV#`Ue6RH;;6qNNin*M7 ziKWGu|H5P0cJZtVe}A(lpRap{Z>M~H+{k!HNTjYxms#r`W{cd(O*DNI5JmZ_1cPDpii+E%M{a4KZ4uvKSb zt*)|EE#d24*)lVrX`82x(T*o02C4-or1f@`>)n+L4rAhaVo7Wh@m%FGo(`j6 z+!Az4%(N2#lzo08B6L~AxwGqss=cUF=%p?(KSu&IoRMzmM_lRK9dh{Hd|N+nD*b8ZJQ-Ls?06Yl?4_?H1bO{Au(%x^%KwIZdLfJ08{aD*+yS3l4<9 zS!Ha@cojX=_nX=qQ^zfi=e*EQiN!EG_8Hx7xz3RqiD2h|$o1O2Xe~=KMiKUH+cRR_ z7qc!u3gm}0jm%liy5Y+@&ojA6sOBk>H5^umdir)j{M1vrsvi)= zWUi%!m7kOKzhjD}bgK}rNqvpUj`ar8=+C(y07B?LPJa0n_x|N`U1IWaVq)U;vEp<< z4}DMI>%Dtf6MNcDNIz!;WNE6D{)I703Pi=k#Li&F_2^pn?TuNL4B{hHs@UW42lEmj z4HFH`w9}79O|`b8Mn;nt`6O z(%=@yin5?t?W%Tx_d?h9^}W`kg2$`>rwkG|G4Qe~6ipUM1rHiDz5a z{l~O_tQ*${s;X?x5z~V{S0GOT`rw+)lvw#F%*;BgW|ErqqV*GVOr9n6&Q9t<2GN+k z$Y|y)S(u-ls%&)li=7oxpt%5Wv%X_-VZF=&)KsOfyaa9Q;zb_R z>$8+Y;G?>fD6WM{X&~vu)Moj5H=#BiG~|9+qj>?cN3xw9khcsF!nS5z{;naJ?-=u6 zFM{(&*g)9&$`Pq~J)@BoAWaaVdQkQ?^n2w|x zY&H}P?Y9QfoaPc&h6f2@Ze026>iL2;UlxA#zH>XCV30tK=p9@676RiHCng5kfT)3WjXMc~d_kygPXQB#BO@6g& z{8zY4yQ??_JN#nWWx|aR8vBo;`<7Avdo+aLcQz~XN=Z#KG1DTDcr=mKM~v04Xm_?Y zuxUv4r`f#}diWk{l~0_OG*2;8>3yp2)qz^80~cpGBPFk8e^u(P2gvmKR(A6Txq?u# zy;GkQ%~~d@zUP~%msLuF$Mx=!qZ6`4MI~;`Dk%JiSYg^B^Jh!BQwNSBf6TkPPk;Ul zUsab2u{EllWUkaY&+p5L@0~!<^IJTaev)PnP2myhd#R^PV()JL>dE@HWJSXixZu}_ z@UCu{vWoxdyASPvOj6sWway3q> z7SZA+eHk)jd{OEtlUww9g^Jmuofia{6sSaV+%O@1Kcipv+*jZ7yq^Oc%I|n*UU@xS z@`1{Pf2Scmc#u4|*Ilj}!MXO}R+K0R2{b69GeHp8J-VKWiP0hkS-6|GBrd!W zbw~|7!sqn)ksRD-Un=|oVm)Nf-2EJ+WXP2nZhFD#<<)hDQx_iYfpd}3*4oy}lQzK- z`agJ9I_*^=fRWE1nVDWc!o|e$TIYTl;%d6#z$`Z8#wb-$+{sE=kCA-eEKV(J(Qezp zhhezK^_z4xpQRA@uG{MmGhfgb6eK_~Zvm^R+~>-?yh$n7*K<>mH;vASyf_seP+fqX zq~AOLt8J%z)Z9!jGm@&L_Tuu>%?9b>SloSUA%^?yAA(H2^jT-&r@jb1SilIVD%|T4zDR z9G(pAApRT&Fuh6dF~4k0UzvZqtUz|EpTkp&?Pt!yMveTeV%1}LG*s6eK-tj)GsRZ^JW(ra^8Yf)&1q3paChs-QG-u4Q**KbsC z2marzZ|{@XHJT+K-{MRkO!rdE5XeeSB+?C1^eY(k=YvjMRurk0g>GVbUbUMaon0i5 z9+&N%j!zh1jIkVj0M1aJP*>ANwSz1iFEi@V>GgVI0x^G?19qiO)d8N4!E$q-G-Rl= z6`38kS2Uq7Uz=>@ZK3vF>O;UMWY;ZxrFDOM@1f36=j?(W?yC)PAvx1OOD-a68>w+^ z{nY_7C<7WHJ`oDs%k3!~#)j@?Qb*tOA#Dzgbw{so)>dS)w6~o0j4m2T729oxgXrvB ztD(Q*!vyG=gRu7`sNKG5Z-pe4a9v+k>=}jk+aD>bOuW$7fV5tc8)eMKAmzBIsQ#g& zA#Jj!3T@3eHGlGKR!+)!1z)AdJNz=0ynRhCoB8*S_mv*7e{B$633H8*wJuMx&*@&E zY~pW=m|}74lBog^;s4_@N?*c%FAUSKL#Hqv;LLz z8XT7tkdG3bw2@*TkvpLA%xpxiA3WhrzK;m=tsDUP4rZGM^d*>>ns<$D)i=kwduMei zS1;e@gfrO_S<@$IdfVKIf>;@3nJxufJoYcBo)99*Zbi|GrXdHaEWZ-K4^azQK-XM%Dm{H>O`ME>iaB2kmh@e$1F7P>B$D z=vL{}C(-?+?H&%3wxYIQ7=goJGXv+R(qoa+fn54PT98UoDwNHm+USM3dDzA0M!Ju2 ztn5^U8HQaNV-Z936iRU*&HGO!eXPA7xehu>o2uV~|H zH1(({+`t!t`o)f(9I!!#uadBs3e2BCORYlA$RkugDv=;q-^%H7E1MM^kCKm7WaN)- z@lK&?Ucxt9nJ;ZN9uM$+2FlRv9w%nA;D^j?+y2Z#IJ$mo+%B7x2sdB}Q||8+7xZ=v z354jv);8+B*XVRpjJ7HTM9vjc`(I}Vvx>c&(R{p?O_=@K+OCxY_NS-fYV6L!5<7j(3YgU0K3nq0`GWy5Uw1nxOTY8j2JEd7aE%xy5 z(J zCP};@6Clw5u6(>Y+DvAD;vi&L**a?%TrbdC9a@w|T%^_Wj#$sP2EhZ$7-3-cDIa5I z84~W-(YIYVmy}W%hcH{WJ*S4vK$z2q{R~oEd&Inw-N;sX_j+aVB@hB6OU}e`NWnBm zpm9%x9(nxWxhDG3Io|DfQFn<_|NdO5V%ifLr_Py~YDP)tBRCOVMH;TC+`$LGiVw0( zCf^Of9TMeoL^b8HcZSrt_^7(OY_!@}pJ{LaWk4*5#*4ETS(nwvl0G-xpIg&sC&$K-f zdN`sjA|m20(Nt}71oS%0i1`(Vs56rB!ubyI;zI6YDuhyP5yu1%r}avCL0O~ZZreQh zSr3qZezp`3GIb^-M(M_u=Dy|9;sy-beT`~a zB1=>(jJ~d*_;U$t{A$a+A(^j42H>;ql|8?v97`_iFF?V;O3`JPGucUAFv$CmXIlDGP5R*m;C>#+BDc^u z#za7*TEs25g!Lp)!sKvgWOzhgY2#HD;!zv8hEA-=6 z>)bA8WQyP1vC)4-WPUd@)BG3IDC4xW^{E{o;yEa3zkq!Y{e0YpvR`1LJf848+Wwvi zQlF~;$7`eQ!IQl&Fwg8t>hdmCwy}gJmRB!}xZ28al~J8PTpcpSAvhu_LP^%rdRTnb zpv_fXIUq+T^X1=_WON1xgqh-$v%At~M_;{p1{gvBe?-%PMrv2z;+B)r5GA9nqy77< z=qMfwXky#F=h0n>t*C1HN%6(m2=n#HJ6T#i)C$^T5WVooLQHd0TX~HaFTSl!DBIfe z0iYrkQxL0*+lY`<9PlK|0 zvv=C?{-!>kLLuUaiHqmrb~Ra#~cu`G}zCtDF>b#MZA{NkTL8Gke`f^d=h%M~N5tg63V1Gr(K&G- zxvlA}@@0!#>Ab2Xc=)|>l)|M)eea{JyGhySvXnT$+|wkrWrr0M4LNLA+)(>qtrO-b z|0w2`cP(9v*XA7bYYza}UzRDSxoB)u)-GnJ_B`iUL47tf-T-&m$V3l@&8kFs23Hx_ zxvvM7dJL8JIs9?Hh0!z7D5Jq4*FMLT!2%GhgZbyr(LBwmL2udx>HOXBs|IGE>7jeHGISRj=C6qv~H$Z z1vn@*Ji^+_T;x^d!`k5v&D?J3MxlbOsz;=Bk%AA*UWvR5n+NcV1V{8}LHZ=fkUK-;8Y6&!nt9Q$GM)x`=Ij|7mGgvU8L4S za)AVT*+8l* zht^YytJu=MS_C5wN&#dLjf(H*u25`bx=AS>@~8lSEWD2%V7*^7oGoSh)}j*4Br@50&0W9EWAs6XtU3E^eRv;c$hn z1_gLlp$1U$K9IUT1af6v$SPJKul)2z=*vZSww$Kuq#Bz$FX=`te*Scd-ioXLd_L-@ zqTz%pafL+IZ zGMDs#5KoeZu4tW<+*Qj0h~gssa}kKIr!$Y}<8_1hMRdul0KDj)V`@fj(jtzDb28s1 zFM}ZHU{=y4n;s4;`Iy$V9d+kQ1lg^xi|2Q~8~T@liSXet*Odt|!H0V>Q6LwB&64p( z)fLknoZSev3ZA+ee@yR05c}JdT$EtO=j{RzUzlf^neUlS!|oS82@!o*_2Bw7nFS}9 ztw1|_YV=?~8>Vmk?Y)j4$blh}s^v=yjGCG^A@_!QML_OD;#D94ww`1q)^VyPTtGTf zn{M>qt6J6Ebz>3hUrt&{yD()dBIJIGuz8C%p7*Q~KCr+_krCL3wneh4*ze^%dx4)c zWetzFL-$VIH%~6@`;#R zGwbE;?GJyc4cS(o0r+{lpg0$I6kn8iFT0)&rfqN)5C6=+J@8<<68E8HKBVsRTWqe& zY5jmkWaqmGb7&l+1`^1NH7Lhq2+z;MZNBdujp-x%#qZ}lkAB;kzI%*CfGB%EKhhSW9z#=G2|I&vT0V_;Gs-7b&rKq`rT&80`Qq(Y) zv$pH##YY}flgRFAp;Mp0Cdora;0Rv7y~vQL-1G>$8cF4@1G{vB*gZ=5=Ex-a>pnACJrs*=H*^GNnR;piMJD&Wutt{SNca}F1=<-PWN3xsJxPU-~HxNe_Ao}tzWXXZC?6ChBX=ypB%8c__da5)O(RQfzaxb zl$172fGm(O{pssFD_K>AciX$9xExNUhj36>^P5>gc~}F6wrCS-s|akFpC(>YKDK9p zi7zlXPUk}pY7JSfTSR5?Ie+LY$lnUY6CbB}wfMBWF^G4Vz8I#BP%J!QuS&U4;r#VM+2W!+^NlZoBCVpSrl%%6SF+=vO7*cKB$&_ zleOTAp=ODukv-TaO7gu^f?XN~MRlK)ZrVQWZT?_D{s^RO4ill1USPdUSHDp zkRF}vHM0MP5;GZ?U7-8(eC(ls2xUB>r{(C!m)=$3GbZIDMnSI&Qv(%IE$rFbv$XNc z*79?Pp)8@PUS4cZTx8@NzIB_r5zAAKht~~A@-2c0%1Au=Hl$tPup$wt)@p^cX9GgY zjiqCzpm>8$@$CeZ%GnX#vHE`9Fp1RBv+u8b+4vgX6*;&051)6P;ua^s(_fmsu_*I) z@pR(GeDUDWZj+^6qIG6>*qW`~D%Hio)+Ncc4C9Lsa1rCIBF@&r)yVdW94i@B;fcR6 zdVoNi^kkdvVTndSqgW51Dp{m=PUwua!*#?(by$}iP~I{%9e1gVmg4qtyK<;qi)RPj z$T+1EPYX}gSKVuDQzdd&>5b1^-M(fVoV9qwJH2J*#j*h1C5Gk0E0IDB+?tOUtpd6a zKOo{>LLiY#blCv+zZY@4$ob+zX^GUhuTfm2=hV7XtS&qQ||6VQ!O~E`yjlJ-*rRN4@voEat2w zh$-d`s01J?H|C=IYd*i!&mito)x{uAml3=YC3={qb=`N86BGd#3H`6jR$NlYzP7vk zGrI@Yodxvv&-0VB8TGTsYnvzzp9JR!t;JK*K`%nce5~VqM?OE{Br(1Hu^}06$12Og zJr>LQpbtJ1B&A+T@K)A0vEAs@eO(1D_X5Hc-#c?(hSkE^0R#MwH4rBFfvsna-P@6r zRNS~NDiOD&$yECsXAV+SnyU!(2UxODF=1gT1&I3V85ezf0yyj?8$CS(J#~^#EiKyp z4pTp#@-4U#bnT;UZ%<#D<_|jI(|Xi%&THhLb5-0r@Ac%`g z9@F>nv^k}M@w0Ca@adMpYP;kaD=ubf&-v~g!-`BtOhOXS>i18W5Ti7vNt}i z=*XjYcDh=_-)T3d`(jyyOsmnwSfZgZCZqyxF_H<&4cpt6k%bV5zkzN(lP^QKa3J9~ z?F)9UM|88Qb16*_Uw{HOUx3C22JE~h>aBzei$ugH#S&x|JW3%?kOU&j)5}9B3A72X z^oX@p3)(BbgZGy6K~!KlYUZ(y$G{~nV5YG2H1>}?>>iMq87KwD3;`=dXrnbCG~m$PxQYR9)L@+?PC5r^FbaF1fw;!yvkhXAuiiBo?8SIMt}xE z^nsyKe8yFW*~;Bwe{R&YiI|)W<@TOW=C;}DXx`pw8|968-jHSt&T`hy`}wCVS-+{d z^E|tVCuzk%!aJRRnpqiN_oMvxK!>-nL&x?j)&^EYTA56Y^5pKub_;3U0Rg^1#)OUl?U(@ zmr0)XVeo|+T_DV;0s;+xl#%u5h!x^X%6G5o{k-Tb#!!z7MUgXiXC1B;&WFYbViy?f@Z zOL!SkZ455LLgHaHZxs;v(dSTjCYNMAe&E{^DPP=^Q!>27k#c+kkP-B;K1Z36(T5Dk zB*HV~T~NY!ZTrQs^`jD;&jkIVCG+D#G)nL#ebcO!*32qNy5%F!Gi6q?7t0?C z1V?P2r-GAuV^;Gk{JHTVI(1vcW}#qe754qO3|hV_!Q?tmdOt)LIspdn=;6DjBY5u1|LlmEnlp6z9!|C1tb-qVq*3#v2j=y; zD;`Z!s1dKzG|DHtEsFa3ENq6{!9q_^9Wce`Ib@UVe4Bts-Ave{iK&qbq*33bwQ3~Z z`Pa3UHq)BSuT4Ifg~Rs8uCL==Pyt5HBW#gQ|3tuiq%6Hx^e)f7S6i`i+*+c9ELH zonq#XMSaU?gvRTEfQ@SMN*ey!!`4~Dx&{_V;6qMP(F(^HAzY_*+3zhhUPLzRpFTq6@4Ks#ALllf-UP++pq6`)L}_|LF(EHf(dSa z0sRteD8S0#&;f@2s|Hv!77oY6J$0(MqZ_(staip!VD0_*h%3;$nc zeOAD%-}wXrbewRsTg!MBI@)gb3SRqNZ$+3X3Z%m@8y-BT&Sc3r2aR*t63Mo?T=Zc4 zx0du9u}e#$Wg9mswdbwKDbJvWHFD}aQT%R7gq*x?Q?Z4$UM!{p>qKWBCaBkU$6gx# zZGna1W&0<*UL0Qt>(}oIN68mUUFMAjt;Gt@{SwZo>grwXozgL6&D-bVjcGX?BV64a zn+vXxM4jLnAVEf&Ero^pgHDwfqU>A?Bb3v_mP=Ld#!URs^@5a5g_o$MIp}D+bZ~W_(pH}~qkurVf$fJKOy(mu-F&6Ryf%76KJyWQ5>xSCCRZ*6j_+EC%U`JT!Zzv@*qy78E@U=%o&8?ipz8C=o9 zK2`S*PRjJHp6JX{1MsNB9h%$DxEZA1KC+7LL5Ry3gj8N`$oLC;&5e|DId+;UwEVwf z3##=NZ#H&+MUa7(1DX%yhQDwo?}9G=FXv|e^MVoof#S-)X`%g>>hlhfoRQ=k_i>!n z*xPAgvutYZL#Ma)6`HdPcQ?PY7Z)b%Tt3zqc&1}&#^w#})=l*~7<)kK$Gvw3!3PCdF$; zXBdx#hRCL*gOvQ7@?HFDC%y<3U~w@ovU-1KB5_oI0icy~c+NE)QBAho{t}^B(B-&d z$A*1A<}QiQf~kSl!1`xZaG+c(>GQ$ zykoq`74KVy?wh5?MK7_{7CqQ&8^!WUQ8@6YINt0EfxLB*mrC%C@720TH?P+l32Ar zzRI_x9ZgqKjDj(O3d>}0R<#m`z>g}avQXx!^plfJv}UHNRi zWV8m;$~3;Xd=r|sGOQ6(eXRm4D+p#IHOR6aa1&n*WxnbkDj!Rim;UVzIWY$8lueq) z7UT#a;c}lK5Htj$&w_^x<2cd1N@pd`VonXv1IxOsPmQZcT(?jE%E3-*f7i0gG^TaG zE9O zH!D;MxPd<4I$wz+MDBCT`-Sc$$ZjRt-{W!8{6YM*)DxaG4w8TwHrwa2he6bneP)Um zORwO>GgcUTl&NK-2$}Jf&Us!~MCRw;#NReY%}i1&rK*sf6NBPkU!gp+f7E)_Kb{1; zfJvVmMryIegTKavTyEOs*G;iW34+dw;H3~auw?4>Q>8m+H_qo5_I|^5-Rg`+&>L5? zwA3M=cBn^*K44k2A%-(MU3EhK8u5Mdgjtd2ob~9z$Gqq~G=je{;Oc_?*qp2~`9WsY z56;UM5Q8LZ8_+%TAFtw(n))-?I%|?_-VSN?y~wuSwOUz-TtAd7#^HTlh_9;uE@0nQ zH^}p7`Q?vk0k;Z7^oWCkf;V9}sOQqzGFNQuo!_MMLhh@_euAS!#0qgwB7E@2jf5Y* z9G_R064#x|*4lqOr7F};%!fkJiPS`pE>(7Rw75EVfFfy3HJM zSyS0zv5PA@J*3QdqkZ?2NFHyn>HzLTZ_Ub)>0sb$b>v5M8`EYi<0Uy6bVj8qDIo{S zpEL%Axa(r?dmEM0t^p-W8A(IcqvA5Ql?9cj$t-jK>WJRI0XvZ!JPM8fdBu`gw!OB$ zSH!jd#`W(~^m1C@*F5F;@6o}|7QlDEdS70DVhl`?0HLI}Y>HLI@*tXky%hLAp_=`F zzizq>072AFJvjsN|H=KSd8a)}VCg+??coHaa>AhzC>{8d`y(w-)O~YkXOsDK>(QyO zjLgwl`P><|_iQhbQL{omVO))kWxLjH2S6uj!mCe#W>K2c(|C++3h;*Z?2vq(Ce@T6 Vl%jv_jI2hZs;H%q_x!E@e*rjb)NlX* literal 0 HcmV?d00001 diff --git a/docsource/images/CloudflareEdge-custom-fields-store-type-dialog.png b/docsource/images/CloudflareEdge-custom-fields-store-type-dialog.png new file mode 100644 index 0000000000000000000000000000000000000000..ea975d3c48958edfd91fc649374bc05db14044ee GIT binary patch literal 22554 zcmbrlXH-+&+s29V2#+G7BA`?S5tZIMC`D8RL^>fLy>|$mSV6jg^d><%A@q{ad+#lT z1gU`lp(a3pWca@`@0VHcJ2Pv|hx6r}ea=4XK45%0A%=x?yzprWFpfAd=H z0~OWP_{*c>->a8rbQ-G}sHkpJy-|Cq@1MDiW-!)2{=7?>{3Dl`I`mOm{4xK>q&qx} zWw8(y-AB5)(pTK*e+C&;30l>Yk6))=#=dvf-v@`~g& zp27Pu)+}N^UscWSR|%?`roC~odpEzh8)O#-zVS42z-ST1rz1a$#_{1zK2=DA(5snh_yvj!P$y2lID2d;w>#Hz771awG z8!0L(uZPuFsD4tX(Nle5?{lG|T76+hP4$pgjE#y)_9v2xs&DDhe|jj^5t8I|Z#wG7 zs>x`CN-jj(DKusfo!TnW@Dj1T;{TP3s($m(LXy*v8lZ5#JUi1#t7CR<(^i^u zQBv8#HK#KAec&sfP)I>^2h^r+wuN8vw!!BU-{;2(v%W2M7VZ49rFtnt`zcPO%32e$IDr;N?89j{_QQ^kNVsOIsz8gT4b>uuJQ~#T~JwUK$#oZZfWMaIe(u{W9KY4z+Zt?7d*9B zbsYTt?#S1#E`s7hNJ40OA8#WQB&2K)K{M0yw95ICe_To>8oLUeqwTEs-qh!{R1Q;~ z3P4xe>TJG3?#B%DP$xNZ?@EyN`a~D?+=6`f7<)gJmVYG7FA*Jl9Zf)|@ymby)&my=1(ZT*jWi+}29&EhM*IR6@%JA{)=EJKbfKc7X5L>dw~;G&?kyko7;2 z+>e}0r)Vvc9pa$fE0qS*z6H%L@Uz?cLR z6P$HQq{F&0#)r5DnK(-fi>K2lV-Fh?$h7HuGMayMxlT4byn`FO>>GA!t(lSd9`v>5 zps9~G*R76KUL zPg9JHtw50`h1Xj?R;2pepjz-G&ygX^ZR6xQr4yd5PuFTJql}sr=GzS2a^20;Kw0Ux zSv864S`n7Z@x7)dvr=k>WgAwCsX2*o57Mtqx)fNbtwmO6p+lIt?KF|_0Ae3RD&sAd zy~ae$7`SqLI`L)VMUVw!S|fHUjZx!PlcCx9JVuo-)HAnAM0Tk4SFb4?)&f(V+Nzq} zMv>pfwz7pJo0jY_VbRpH57=Ml)WSQKik|fubHmM8+%PHi9&cA8A#LHl$+oYe@XOI5 zw{~k+kmczF?}8zq9&*znZ4_?n_y=sDJu9+;#0kxl2XOk7vHGVvVepjl%>cjC!WMg)@hz_ zHJpKtPD_BNvJc2hktXC=0+8vel)#9nShm48HuByddNvqmRf`10CUZ^VKa=qk<*C?hR#x}fWcIenS zb;G7l&sbsTpgc?`73V$1n{-uPA96TxIdF2-zuN}<1u=3JN#pg^z`7e?8~*ry&tw_B z%v^XC%AQd)+m&-F)i-Cc7Niv~nc9*iNJ#olm?7DqYXuEp)z86%umKFnDg#3a*8tkB%u>T4{nkS#)nVoA-U?p{XV`Knc zd^}?^0Wvt>B|GT|twkh8w*w!_oorEaJcT!uHF(4b8w+)>lnEIFXZ${y;s$SQIpgS# zcTJ>)_hta7%UIv%t}|*m?_Q!D&wxWk|04OUrrScz8hP_v?4$b1jfBftH3Jh&+-v@v z0p=s2B~D}8kK;Ae<*8Z3wS4UQ_vr*#w09QoyOp{&K8XU(aG<_Eb9%k-Arz-Fm^J`W z^MlqN(p>YDhhnJ*9hSwahh{Av64q0qj`4yRxR4^|-j7z?c~hIlgS*mrW#6Ta;sZhQ zgrA}NqAr_Dy3^O3RQU0IFnHp}QUCqzK5A7j%e6E*mJ-dXyo}AF zQOzrhZ-EOv7rmoDLK4?4>S6gMHRkt_siA*aT&El3Kl{FNS11p~d_MA^s5Lab$Sk7$ z4F_K+q3~bO*zh#aO=hiI&OYeTre?m-rBmeQFDz4^)uD>x)BNS1@1gp5)#p<9z^`*@+Ru0f?#At zwbazO>wm*&A)=io&aq&$VPb5q=>T}m5o*S(s zr{k{VqQM;c+|~82gJNuiS9$~Mt{E%k*M%>$PQ9>{=V9H#<3wF9PRcBRot1^|r%@Fz{fV3nc?k^4ztvY4(1~nUmMU+7Q=Tb>~TDb)7rS9b0rn z1Ic-y^qmwTfJfcexe8a_485*gBL+uLPf*1I!N3sv17VtJP5A81Er;;%h9e!em3b9r zsv-e7Y%oba+iQLv)~>so^RA`Wqx-{o3jkO3ZjrPnHe!N^E_xcYQc3JjZ_el_5Lq(< z*U>mmn!UD-X3evCY*0Fd@V9l|O|VWQ5s7K(lj7^8El}PP?0-Wp)d!$IjS*$pI6iZB zifBTL>*>p4qIII#n>ySOigU(Nd_CcWCwb!uR*mEOHaVk=E>+GFtZO|Aw=#J4!bHY@ z-3(2T8e+%hyj-uIMImSf7Xkc@;!S8N=f7WIqP-@hNNbGGQD>Zf>s*G_J$XM2yjdgm zh6b^mj`-N&$ddFir7Gy#61Auhnz@WFO(2B!g?l7j4Mctv5bj*=q-7EmYm~D3ruwVY=p@#OD6)Bv>PArsB6Q~l&j5I$9K zsabtCZH1bL-Bk*Jg@%J{KA8TVpPONu7Xko9suCvzd)lJ_6O%#m9yONxo5?R6Xq`0c zTf(m>+%BhcaqY9d_I8_I@?Kv36hT;MUY}3WR{Df>q#I zV7+RY8%89jl!?B_mA0xb0C)@0Ic`@kW$HR(3I@NfuN4rUTvC$Teiv-9dxfcYUc`g@ zQ_p?7si#>jZSnW-*?;w`9i2pkjSSR!^TW=l>@y|{7jRlPOyh?l;3U&H2VYg^O$6?B-k!=$zOH%pNd;9I;iKP$hb?!Z^Pqq=6t+VXrDYBA}<&3LsEvs2+0 zv_hDL4Qzq<1242fzm0NTP~Rw@MsFJ~M3Q~u-YP#wWdhFC}GBmO!3Lc<0J@kU^w_Uux;HddpNc#`y2kV@ZgpPToQxdoN7RQny zm{#lT#E*=6YWH)|$L@?LsH-%eGHdW*s;8vq_ik3u*1=8xxZX8*0bpuza?3rqk;ZJ9 zgs*=NmqWc+6%W?G{h0Qcib zLa64&-Gh$QZAmTc)S$9H=a`FXJSQN&9#?(0#mnAJeS@#v9Wc|iLF|+0+c`=#g=9k? zZrQohAH#uJw-C)x03WH8R?2R=?s$DWl7z+?`_@;Z#NV-R-t76fHNWzK1&11j*tf6I z30b}0a_Zc1iYY%{xIQSLOfpT-eE{fbIO?jv4QP)mn!D@FAkS6rjXzUWt1CpU?LTjx z#80(ejXTeJQ4bHlvOwX?IM@F%aq9V(;m#cO{6w4%pc1zxe2c4w#`>(1FFV*pzuq0a z?GK{F<*1XeS`0pRIv?i~lxwD)D|_y9G_{sY8ZP?jm6J*ze+8eZI*X)T&C9fU(O8K% z7QwOQ(+mUra+FhB&0TW?=W)*GTX(4;>lkk2nbMn^<56Ub z!a>Ez3SxjerSNqvO*OAbjj+_h41gV$_gtAruhuRcio#aOQwP1Y*RJ{}EUf!!$@Cq8 z9)gySg~e^BPJ!gVdzJTlcTwWz_46pj?e)N{X|`k`EkN}nVRzNgO-b>bX0&U2BP};BE%*D| zAIQ7fUQ;&!rJ!tK&j%JmTvdV1_EP>4u*EbBQ$8WkNKeS=wOVTKpoULVqk}>VcUjJV z;hLB<^}G-0>R47`7Flw9a;}$>qjy z2Ruab%uRx$QMgEL_|JON32HR6=}sIaR~q==XP?i@#|CTDUP=IMeo zdT6CW&dkY0GI`w{#!yF8$cp{=+aV~$x%63SZPb^Dwy}&vJqWdq;k|q8N3g}|2JhiW zCe7~k@~35NIKO)JUQf5cJrCok31&ePK~Pc7Txr^acCPn#irF%aipDp-co(bt1?0gs zyFRL!fj}SAjr?3c%Rp{*u`y5_%39Heav)iG+tM~6~7 z${!LqID%WDb!9$&jwZg%Q0aXh@niO<@2>j*oH{4#nCwYLC|7hd=rSoj8`nH6neMSj z_2)gKQJ#Ke+7q$) zwzS|ODAZ+m;h7#c){a?L;Jf-~wx!^i4yJg`8?5O03XBwD!tfc0urO`Ae0yU>nwi!~ zqNQ#?kW3gIKAKIFNRHvn2;cOQdgA)**-gw=K2i4v2ab>Ew5uI6v_Nzc@l`)lp7UGM zmA1r3ehEy0NZPy8m8&R1G`n*x-~|;@{wb&H%Q1&;N7g(&f1ursWVT|(x~irc^>{sQ z7O0?}b97i&$8tJF_@{sd;|;ckTUJ z+PCC6jqm4amTSrw*lyucW|OPB$mPJczB>co)p8|Alu|w`Hh$(~0@|2?bk~aWP!oaR zUF0k(u2izwtg2N+b}x}BT}1PsN3l0>GKKJp4Yh(| z9tp?^xmv$jOIv}_p9e^|`Umdk4s^WJG~Nq@(g_%aNSyFH@JvMNJnz?vzUlVqk;1kV zw#adKi^zp;6_tfk>ZE`^rj~2_7a3P89}fV$Y$(i?FZO!Pmc5R-kkvxYlckRBsM*eU zPK*Gq*2adX^5yjkmP?;+T>;0~>3}07!(MB8fh!TLWYG~16nZ6@osl}%e5F~g6`MIBMO0|{iU zyXwc_lktnKbu`F|pW1!OaO;lah2Mi)5K-IKCvV67CNlzkh$&4A7LABYEl*XC*Q~9r z3Y&sEly_$DE)P4OQ8X@nH;EVAn|8MwnaK?@0y4ZyK-nS`TVqg&)xH? z*WrBWTk2+lWj`|F-6_pOdNDSJo3KGQzXmy1CiySQ_c&7!La|{IQ~^Jc{_p)!B?sbk zXL#TkuNyL1k%m$wN3|fCM?S8;VzL<>A5Xp>0`KcuP}Ddscn-QiZ4vWb~5Y$#34R$Du1E1hKlTQ8g= zW*gY^GTi9Or~REhQbyy&TtvKYGxsetX9}aK#8?- z(av96SwlYfA;T99%(=^=v@9Pc>YhU?qYAi>+>$B7QA54JdTd4~sJm>)Y^XmO2T4BJcrr$suOb zm}ED&#p_)LS&b268(Q)6OU%chnP2!S`(EC(nt=_+j)}{GS(-i4?rt?6rm)sWPH}g% zwQjTJN9i&XO%D`S6rWQ)M942lmrJH6nuq%8RgGY`i6=RplK3EA>;BA5$b1ew)W{t$ zLfJl$oh%$RO-E!E7%KMUdT7DC<pbBS-P+Ye-^S>qwPjW$cT8@dI#Qo~zi#?6mw|Nbo}JSZMa5im>8 zea{qJ=%DO6YEmxLEW*>;!Rdew>Xw@+)rqv%o88@Vy+^MbExM{?p{xJos=S!@XmK(F zcz*=ZdQ!3GZ<#q_4K1oe042AkwbuxeoC*WN-d(*SdKTGl&Zd1Z`CSh70T7Kp1kR}DDeE1qll&pMKG!E&qp>>)KJXwr?Ji3SGpyRcILO+-Oyq`>Pve^X2s@e?TUO-C zNQmtn?%$`eceS<`(e9QUv)7Ij_YYf;FsO%?nD(Q=M_uw7^N>y!|IST()sg3qwVlowznZByuHGi#S5%_Gx4x;>prV!4)?;^8N8lPKddF)?M7WJ zVSW3e&~#oqdQNh=q<<9o-icxKIYzHa7Gu;Jq-yS%(UY0PRLBTpT^5tJ;|n`uXJQkZ z!I!)4rzK7%XtgBIPtePL=Vqv3h0f2^Br$Cl9dAlz*O4aZA3Tsnxhmz2OuF);TJp$- zJ=OmKYTM7XtZNo% zVZcQ!kAhtp_8pbJSP8_Juo}MegeX-A- zG_;=VvNdrl2lw%5Kl2Qo+4N$_gnQV5>vAjqCS|o}t!~vx!V@%Oxsc5EJ~19|XN^0} z1(iK<4wXpV8Y$RF74)F1Shex(H1R_QK=FoZWt`zjP|p%}+v@T0Zh(~WW2|c;otwnM7U~9A;~e!qq#C-v))Xs;7CCE*N5o!?^q7V} zvef|vH<(`^#ry&STLHR<0n5bs|XPT72YPW3|;&Qd5(X-6o#!6|4sOSVAV{#Kb)<(rN`20w&i}v?8r7 z)I;ha5&R1JE!x{3dfO$70cDa*GsAC~DWX%UUKacoEHibA*4=pKIHj%krv1_RktlpI6 zJ1v!SH@Okp=ltx|xRV)z8-|hYV18!pG-lM`!|yQ$w(0=FE+ZCzbx*a5*xQ5NR1F4$?QTs@Ns~avZW&=k-~&A&XZ5_%1E)+XjjJju!42I6Dpb-^I2gmBVj_ziGOr+yDm~_t%F>po(|+Z9P4hFJu2ur*+AzL0Lic1 zM2!w?Iol{RujoG`pcthxm{`f3MUF+n*N4kyH$v|mCD$D7vEG?S#?ydpSODe1 z#jxtYodq0uG#1rRD5E*7>t5gNbcT-%bgmeEW&P&xnsWWFKHKT98A3`8Y|fOhN{pOD z1oep{3y+e+ou-I{{#R`7yBaR6$H^&rf47AF$y`+mmucC1}Gc`c90f=^rCNq3UA*<(oJx zZ+u{^(LDY@|9rG;Le4vIFFvK@cF4^^{ zRqm*OUdvu$GejG~FLO9#;B+gyINQZ; zb__2;x;JX%;a~IXqiAXL+$X)tB3fMHN0ne!6-ASXA*V#$((#+;B9+SB)k-Oyo4Rh6 zQ9TTyIc=A%|!VWFE_k;h!mwU4Hz=edT0L_hzQ&qlgoPfO79 z{BoUL2I__8Wc78Q!09vuVsM)^28KXkLHbyGn^oFE#(HF#wq!F2VD?JWFkuAl?3aYz zbWt$=Y4Lt%FUFvH5@o38ID3g*3Xil_wB8N^?e~rO%g~nl5d|Y9S++6SDb3**usJE!*H*lLEc9?3zM0A7piMIaO1$wfL*{iBRx6ILdrk9*!Ny#ZC28?fK$lp zYZt-{2=(Kiri*(4W@w>fLVN+e=38lbem?-gvpzFTdy-^^UQ)hh3;>3J*D{8 z^F-r+aq3s(j@p3ZTJL*$`6AF^4FXX;aOWWPyvZ$J6vMi0nNXEEfYEQ7#pcgC$5C%h zJ!)oS?{o{$M!kK@whj!5p`@@wQp(YmlWTY+g4Y~Iud|TKAoTxBTv!@a|SeDk1;D1s2|W2oH%d9nO#>aBP}#!FDNMBYid4R=WtbVwWrH9 z=*Fba44Q4mrrZQzyc5OP{Z87kw%}I`GQu)_gjD5JI%xmynNkhdx~g3lXliOlFcza5 zJjP-gEe6I%QNcw`BE#Fo!UOyzdJ~!@argM>%OC!@Ffq$?74-o)vjPjYjjE^O3GsEW zA81}!#E>oI`(M+^F&gE)>>?+Bq4}S9!%S}(;9Q-N=vOZ`&N-|w3 zn5}yZ1jLIMxCkO0%0g_v2U;5cvKM#9B>TeL1ZjK1g{Nm`%8e^kt~}&8KHYJaniFS0 zBP`xr@kqG@JPJ+)0q10l%%}JU4g>Y?Oqf3l_pY+}zyFE+6g}xfQZKl21^tGf0(V%G0Mnis zVA&}4A*Wy(^Q_xqyiXnlq0_%F;hf787g0y)7l#-l$Z|^~Q71c#m@3A3PM*}<&33!6 z8S_po5Q@wY&CR2nhD#*29IQs0h^uhvofRwZx&<7kfKwYEZXY21gn!;Enu>!_zAH-0RD9`y*QV1K|a*MiskqB=-cc zap5$#8Q-T9MXtk6QxIP3CqH(=IRm%@JyM@Jom|V#VI*&G1?Pkwc=qNqV4UG{V9<$m z^Bsc6>#2m*r~7TkrF1izi2`(aK7OLjoPn!v20LKios=k9h1iu5sk26Yajd#Bq3_=e z@l{iaN4nn3?+^uldsd6zRyaY1qNAkV{ady)@za^+lB2kwD^J}iP%IqFRqKKwTzuQY zlFd)!XfmwK&yQ@@W`MpXgW#H7ENFK3$+uw1B>=b%gsgcpkVR~>C9WMWp7u4Yj%NE_ z_*2p}pXrRUS463+=wz~!hpHFTq->WNLW5U3I-0&yn`g2UeN>1Rp^~fap(j0Q-;7co z^j@&b#M?1AbDjFkFe zLUpS)7@Gr6J9PY70|<@EgRyk`_3#3Eroog&@K&L_Hl}HBv%fx=x0PhM6KC%HzGWY$ zTmU8voKnjZcLXxb&d~vWa<%!H(xGf{q0F7kguNQiNZX}9>u`oJw@$4a87%q19>j^Y zE%P*o;3swy`QlK;NVO;L0##r~K0!TeJKL;iE-g~0J1{4-{PLxO1YGQf#7DantRvEx z#VjXQH+7jQIpV6YIr8aQhI!y-hHz6239)##FP~+UG`LIN8;x8f7ZLhOg+q=%z5ZMZ z+)ch1Uf*r1ImlQX>OWf=KZZ3PSTySs?VY7|Lcx0;%SoDiaTa1vY+>naQUM1;wn&Qg zIuok@SeV~${_FHe%X|QNdu_8Hf|2x02*9txtGUeThS(r?r7S1DMHs=%8cS}TCU~tK zOqY`FPMeA0qe^bF2B?YS<3Emct(=4t-zY_irQC4x-YLtlwoTa1vVeejBvPXy$-PLrPJYuCLu!gs|G)w zlcNHZjaNwKszVH+Cs0R57-;5vM>#8dZ&;b4`(^(C2@cq4izDakhg0k=Dc3@+`WD>F zB)+lIT9}uc;hMx8N#f0l<&P$l*23&r(JxC(+^rb^6ffnYq~bWmvc4nD8Y&x)?lrjBxJ-!GUZmpq z-t_zKnKd}%KCPhdCK@bzzK$41x6+-vMzi)>`!c+@vuHdTLGn*p;4*%Sh)y+qJjkFQ zE^ib+OKuE2?WChmTB96r=~YFoM_vO`n>S7c*AYFCo0n5|;P^?-C+5AN9PEk(*nfOn z{FzfbBdhuYBfe#9>(=R9z$WCdx_{mN2%_}Tj{3fJjs=H8mu#10Md?znvH<1j6Z=8T zHQl8|GXv!l3}7Ipn4{9_AA+A1;q#4lEaZvEo9L3~esfygCys-YI*JDstqkXOQX0`_ z;le*MKxqFuxmV3kg`83W<>6-D+eW>k+E+Yi--+DkLIf^#4ni!UPqwD3-+8UFz=@j8M@A#9yCfg{YVXwNSq7zzv@zwT5Uhes z+Qpps;zci*{d}sc;)rYetr1sJQ=?a(^n;X(-&Sd2N{Z)mH7D*j1Kbp)h7OniiPaXl zc>*|`TIeeLg>Y2qn~dn!VIT}VmF5Elq>62a-^2_p&EEXmLNqq+;I`fYthslcZ_??2 z$)UDLgi(j#NQRiMr&eZ>S>raY(Iwa?!Sjn(E@2|6RG<+(^WQ9BDF^IxQ0SY&_rrXe z|Lgop$|A)CXz$QbeMs}<;E&@duU61jp{+*tsT=7R|IC53(oK_dKHYk6#PM*z7@lyI zO5y2~VY8$hO3d}$79v&_c}kmJcpleEQWn((^WG+za>RIkvd1u zrC*)4S9SuOg2%XLwAWQG~(WPgQ@MbHpmYhhL~oaU@+Bd$`ZOl~-f;JX>=^6Dw^ zqF$X!qz>V4#) z&>{a%ox^77XwUVnp;NVB7wPT6Uzg9wfnT9^?Mg zlgH?rG~{vz+@}A-ni6E%DJKvYmvq+mUzglvg=)pKFKZM2c{f>*@PEn7i!}{jYz7&4 z<+2PwL#;&YZJwL`XvT%)S~(-r_n?DDDyoG?^*2W{ATjYW5>}pyf=guAtWx|O-8cRFO0dUGsgNaUr!xX{T_jb76 zJu^-Y_udS|txRwJN7WYRAiH;e|KI|#ZJ!y-pAzH?j68O;77m-k9>L3Mj*q`nS-YCHxn{fLu3;;j`$?JCs9}P@LcbkFWPTj5n*6=RjG^X@glMU^ zMKrvcuW@vG$xuSHXUk7TXRDu)et4&xv);(8OjR|{Dn;4vYgWEjy&}r{6KZ zwxa9MHT9!dk7tVUbw2%d14<_AotH^B>a9`-$18%Ba{MQ!zS(M8skjRVH35gYxnPW} zl7MgNXI7=9yR1`_p_PNB-`>SUG)&fhsALIjnt#6{Daf}A)8U*8Iq}ich;x|OAej2v zX9ZRJ>~2x;E#o&3=_oYjZ?Z$7(Cst9=SQI<+h>*T3XgH8nL|$rMFgKrrN9##=fnOy zUGXaGUoS&eFy#!atlARwpwnOPt@ZUgy!q86hf$`D$L|xxf&$742$?cWzs6E+i$^Vt zW)JIfLJ&(X&fz4?kGbwq-e5s})MT*3@fH*Ufp4l)?ESL%FZwffNZpN#=Aa!^t!aMg zshYQo+jcE_8&mGhhjAnSRt>H?AwT}7Bn?t!7Wg+)dcAw7D3*~=n7F}{ED+>Yx4s-< zO|K=SrQdN_eEqY|hNHXxSuO868|Im)@M=#HWf67Yf0?nLLR(ec zdxP{+!1DGHfn!Zv>?lC!2peIUw1$@kc6SOd{$@7E2ox69~@{M%JZ4-(d%XGQl zMp8XPl5~`LK%k=f=G>*P&LuyWB|=t)tD%_U>%sy#xp$_A2CSh@mDJziPg`!f#T0!4 zNpL8hCr(JG2i36d(>uro3|V-&pH+6|^JO&URzec);9TWAPbw$@(brrzwjbnLxkm-2 zlM4MG#zq^~7^!r&?lMd{eTRY5?z!R(8+2ywkQ|_>20TS=&*ROD?UBf4>6D-pKcmt7cM33>tB0kP%N9pfSmf?LSwUW z=7~{9i@$Cs#KE#Q2yC?w9PCJpeN7zF zp4YwVqqZRT1;%a$7LG19a+Gk@6ukzCLdMp-5$b++f77;FZ0W4j7uy=Efp0g?zws_7 zm9MwdAJ??Z;tUIO%l1cCwj$mmhLvPyD;2m!ewEY5gosK%()Y~aN1xdt5P5@ar42wu zh|e9->bwG{JcwP7QlW!N4|CEC@WIkuA8Kju>vub+AZdah4wGB{nFS9vb%th~(+7HL#YX=7u4y*x z)kYFg$jB(pY8$LFc3=G(1dSz-rtS!MI=Z{c?A6oHj}@gN53Q$SC2TVrcg0c4!4QWF zJx&@Qb>~8%LFD~;4|roLp7B*woi9)(5%y&2?w?kOx$F2=pjd02wYj<|1g{beyn2<@bw3wI|EN0^O9ljHrT)u8;-VdkH#5TazmO|s6~%vaYP0(y5aN@Twg4Ccti2V@{OUc zL)!UIgYh~SXEYYZyD+w{+vX`s>)$0SU*+d5_4Utu7Cs}f(hn4USL;%91bi17&nVJf z(AC&?Te`c7Sl^AW??X?o8Dd8nFz;&ZxJ}R8>gT1Almv&fNX(O~z5;5w$j}E|^g#(%<~Hq;E;lKMd#a6Ai^$Ad8N)nUC{y1Siiu zEw)E;-Zl7jZ>{EPX?0l2NzK@UN^zcolF4@(1oe9sw`zYXLCv#P6$}(dYb7>&lEDLC z?nmo0q{*E~f82$m@of+CK&!>|1P8T@7ck=IAA0JF+_{0V-PG=X*ER}TD!7-sc^}!> zxkLwQjUBD!%_wtk5oku_>gW9pUTJcP2EF<*I~`1Hj)FKNmD@tRQyxNF7u@`Get!!Q zpLDm1YQo*mclhg6j?}Kym||7+?%ZryvUZ8X9i??CH~AGLOs-95^e(;^1k%~6q|T>@aBuDG=M2pk zed`ttX-*AoKV8y|%F#(JCiwcEj6SYi;q@R#%p8hZeCr9)RdiIbFDmq2MDjaD;F{b$ z%j_(d;b3+WmQDE|8vY6t0>A4w_C>>%MU3Hy@#F>w(4 z=>gvB563#4{9ZHpjTA)Iv;34AR==r8z^(3VIP6BI7h?kFrU{rzMw0PxxA%_f;_ZCh zYV@VnsZ4y^aei%93NR&)I2zW{f@})O^;{Gl4x4@H5;@f0X)K6MbkEkeJ4;{mB$&6l z1z$fP7R5Z&&1%MLJ`B9OF1_pSpd94COPibfh*g(k^PoP(uJB2bH=a6WajVr9_o`%T z7w6!A*5F4@xWbYDNc4Jj_l=A=j&YFMQ~b<22nH$vXU|s<*v3mMEt)+;kO%kkWd(($p}j?C&(%E?@XjdArSRRKShw=phzEdEXXemF6I`%G$yIW&!!k9h3V$H;F(6dM=+<6EEY>_hi-Z~C zeXSgHI?%1x{nw*2W4D3lG6I=XEg5s%unn@IJsth{zvD{JX!wmHO1{nyK7%W$v%njO z>+3g3`NfY~Y$FeB-hC;G^+%+S0Db7^UwOulnl#J2nw$(K)fCyYS?d|0|0bNQo+mxH zo{RBzPv(+&PauvX*Ni1fu7`g8$BS!->P zT-`(1tqj57@a!AS!(7=rXV*~+w(ai9%1&o(526^a=Xrrc2fHGUEP$<{QkLUdLg4e0 z{nJD2q5HS!tnAArRC;h=G>>=@nmwaalQ`K_5Z80FAWwaJL$hW?Ls&NQg0EQ{k&X0%;e1SKlSB8r+u zU|7VBCOQ&Y8Z-(6gs=ob_9X@gi$Kz}Ey&gmC?Xg_8^Nd;5P?K?5TQko7=Z-B5(rBO zOCX?02#`0A*=owF(fQCdHB;r+RFZo4f6u-5-2Xf0SGTCqum;j_nJ{?SdY7KO<|!gD@C-B^ z50In1ME#W-=E43!LEDg`-ZFtJPkwvt5Lve@!Fa2xs=d4WN*hLDzpK!t%y)%I$d8xw z!dE)s@xT%fj-R|`5?Sm~`;8Mp%x?xkC}wk~{Fr3Ti!n(};@A2mqXGe@Dnf_>K46+n zi=1fokTm5>=9jCjMjXv5Hf`Dj@QoCFxpS1LAC^nU;c&$H14MpUWuj|qcKxyst9V7u zsUPg=Ij9K6Vv#mBF3&C{M?ZM>%-&*~mX_gKM~kh*Kr{6cj=mPq1Yf@D&r5yq6t%d( zgy)mV1liohF>C9C?~=3$M?<*fe&B8*~GJq3e%tND2#6^twV29~K6+Z(X5+66)+&Y?ufDz> zirOb;`S|!yk@<@Eok+h95=`Ewv@#cuxH54s=_Tri=(*JxU#(6+onhq}4(e@$rAX7U zardjMT_f(Kg6X(3q~F{`W2bE&1G~e!A(U}qj>__%jy?2F3{LHCQ95OV{@Rj)0xOFx zUw^Gu%8_P9-;eg4?0V!}?50xt7MhB%s_?&_N)OiAgy?fl(+8FXZ~&aL9W2yr&@SbG zQQc(gxL-K#TSIWh^EBCdPLf-=f|pn2yUsLyxNv&w|ItKf=AqEs9Y z;hJT<_3CmFBZmS51LfcnHPkZls6lPU8o50`Z$UQo>p&9bZ#En)otT1-bn+8=gQ2vG zwI1*n)HJt!tWu-bL@^&BMww+OYg-<2@;AvzbnUK-UwWyO(GS{ni92ySZXmQ3gSD|r zQMZzRUVmYe3al8ibJHdBKeQ;MfP&{`adZw9amdftHzhPgCH5TEVYB$>Ict^nw%Z2V zGza+NsgimRH2NE|%D@mXrwnYJcmvHbQ147Ay=eT(K>cOHp&cPX89Yj?+xzy^-DC2gTL{I(z!w|mwR$X=DS=o++MaJbvp!dIo4Y35k+z+aB?{k_UU4mPgV7N zCW-oz8hlaUivs^e1(GiKNthZP2O*H5Vhwj+_}!;x!1tZfwechWtP%UDNAfpsbNrHB z|3?b!q?r~$AnR|gvI9R$)B6pR@_%9U{r~*yW$j!OpA_B78Q6IB9HXr9iBOms$A>4+e9*T7FICl}NTRnq!I_(sCr39t+h4?SUUVJl`$tK8$DI7KudWK`x5PuI}Gg zc8hG4ib273^uZ_<>Q?Q=$u^HH_LPUC=rothi0Q|Gu$> zWzdvjZ>+~zGf5pfs9Vpcuwdsj*zm!A%F4W3T*P%h{L8n+VJ=Zw$4BThuygr4Ld|md z7(+vN`2o%o=a$u&)`^}zoUYZz<{R_|wBlIn(o4!{v=eVF**P~e@e;J_T^jpAvaMi%`zOB;J89O;WBe9WcHaf8bGr~Xyn+1z8k zNrq^9H2cv;#W< z^FB(4af>%R9GqX>S7bb4c3NUz9qhQ}^!IMhoy?v%*yTC0*KDAf`i-?PvTmDK$+=w1 z8+}yc$wb2vCda8VQuM>{bocs_fI=Rw9dy2aCp$hBRYK#@9(J-!7;0F3Ly^d>tS`XE zHaUNX7SM)oY$j1++%fuSE}oqEUUsI))WAk?uxLuN96Hh)vn!@z;I%u2rC~*_`*p-I zjnfQ5zAj*CG?HuOo;gNG0DgaxluoH=dEVdulr*3w32CI79j|Q>%y0g7S)|RhoJXhN z-j+oju2`+;?sDm)cNtec!F|a4yF#LPc#I_yj zqT|^xgKuFmfuW>-v+Rb-hq9?tKk`7@cs;Fv2LK23|V|wzZAMJWh zny^9+-YWdlj1x7jC_SjQ)oZ@jDkyH~$--mz_3O==XJM;x;&12TnwolKznq#C5W#{8 zamT5&mC_g?bSw@yUvVbzu9uB8iB6-lcabyi7L+=ns%IT9747ZFaT%slNHy{4TNoT- z5qoku#T+3FeG-;fh?1|PBBap;W%S|@PetGx7mb@$Mc>m5fpt4ao;gHREFQb2Cddmd z;ou3pMADDkbLr!v4rT2vAdq0|3O__`F{W?;Y$WZf&Ox7>IU7DZ_~)p(&O0YBNu?37 zyDJ1&m3l2>-D#bk_Q8kgYiQF!EoF#>NM!D*%A4;O!lbiC(0gHas(?QBiz(BYdUk~ zuHaGl+hR>7`ESsHDuF{(?=0&6@;~ShU=oqh2T*foD-!@udJk!7gvYEKqa7tI%Rs{+ z=jytD2ZH_RkWqcEEIL{r4=$GeB+*rj&aMf|K9Z~TNA%c_e)LJu>^;!g0k6GqM+l_h z`97~J?+R@Aji-?o;-8v^b?9p#JCm$Vrrv>GG|(anK`SJ^ZA>m3xj~dx^T2zLr-jPE zu-(y&f>(*Pu>c$d`vL&n3kTk9AnR6-XC=t_@*~EC;mj@IClDLNIjiD7dj9wq DK2bHo literal 0 HcmV?d00001 From aaf95fec4c6eecaa30ac7c49e4d021613b235093 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Mon, 5 Jan 2026 16:35:40 -0500 Subject: [PATCH 09/21] chore: delete unnecessary files Signed-off-by: Matthew H. Irby --- .../Cloudflare.TestConsole.csproj | 14 -------------- Cloudflare.TestConsole/Program.cs | 7 ------- docsource/content.md | 11 ----------- 3 files changed, 32 deletions(-) delete mode 100644 Cloudflare.TestConsole/Cloudflare.TestConsole.csproj delete mode 100644 Cloudflare.TestConsole/Program.cs delete mode 100644 docsource/content.md diff --git a/Cloudflare.TestConsole/Cloudflare.TestConsole.csproj b/Cloudflare.TestConsole/Cloudflare.TestConsole.csproj deleted file mode 100644 index 5346eac..0000000 --- a/Cloudflare.TestConsole/Cloudflare.TestConsole.csproj +++ /dev/null @@ -1,14 +0,0 @@ - - - - Exe - net6.0 - enable - enable - - - - - - - diff --git a/Cloudflare.TestConsole/Program.cs b/Cloudflare.TestConsole/Program.cs deleted file mode 100644 index a879481..0000000 --- a/Cloudflare.TestConsole/Program.cs +++ /dev/null @@ -1,7 +0,0 @@ -// See https://aka.ms/new-console-template for more information - -using Keyfactor.Extensions.Orchestrator.CloudflareEdge; -using Keyfactor.Orchestrators.Extensions; - -var inventory = new Inventory(); -inventory.ProcessJob(new InventoryJobConfiguration(), ); diff --git a/docsource/content.md b/docsource/content.md deleted file mode 100644 index 2c1bbc9..0000000 --- a/docsource/content.md +++ /dev/null @@ -1,11 +0,0 @@ -## Overview - -The Cloudflare Edge Orchestrator Extension is an integration that can inventory [Cloudflare Edge certificates](https://developers.cloudflare.com/ssl/concepts/#edge-certificate). - -> IMPORTANT: In order for certificates to be inventoried, the Universal Orchestrator **must** be able to reach the server that hosts the certificate. Cloudflare's API does not return the certificate contents, so the Universal Orchestrator must pull the certificate from the server directly. - -### Authentication and Authorization - -When configuring the certificate store, the server password can be either an account API token or a user API token ([guide on how to create an API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/)). - -In order to read certificate pack information from the API, the API token must have at least `Account:SSL and Certificates:Read` privileges ([List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)). \ No newline at end of file From c4258e405d92b4c8f90fd01617ecf3ebbb696b19 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Mon, 5 Jan 2026 16:35:52 -0500 Subject: [PATCH 10/21] chore(docs): add docs for extension Signed-off-by: Matthew H. Irby --- docsource/cloudflareedge.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/docsource/cloudflareedge.md b/docsource/cloudflareedge.md index d53d056..2dbc74f 100644 --- a/docsource/cloudflareedge.md +++ b/docsource/cloudflareedge.md @@ -1,20 +1,20 @@ ## Overview -TODO Overview is a required section +The Cloudflare Edge Orchestrator Extension is an integration that can inventory [Cloudflare Edge certificates](https://developers.cloudflare.com/ssl/concepts/#edge-certificate). ## Requirements -TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info +To inventory certificates, the Universal Orchestrator instance **must** be able to reach the server hosting the certificate over the network. +Cloudflare's API does not provide the certificate contents, so the extension fetches the certificate directly from the server using a TLS handshake (via OpenSSL). -## Discovery Job Configuration +### Authentication and Authorization -TODO Discovery Job Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info +When configuring the certificate store, the server password will contain the API token used to access the Cloudflare API. This can be either an **Account API Token** or a **User API Token**. See the [guide on how to create an API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). -## Certificate Store Configuration +The API token must have the following permissions: -TODO Certificate Store Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info - -## Global Store Type Section - -TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info +|Permission|Required|Documentation| +|--|--|--| +|Account:SSL|Yes|[List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)| +|Certificates:Read|Yes|[List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)| From 584f436cad1055e8d8c51f44265c4600f84c81b1 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Mon, 5 Jan 2026 16:38:02 -0500 Subject: [PATCH 11/21] chore(license): add license header to files Signed-off-by: Matthew H. Irby --- Cloudflare.UnitTests/InventoryTests.cs | 14 ++++++++++++++ Cloudflare/Client/CloudflareClient.cs | 16 +++++++++++++++- Cloudflare/Client/ICloudflareClient.cs | 14 ++++++++++++++ .../Exceptions/CertificateRetrievalException.cs | 14 ++++++++++++++ .../Exceptions/CloudflareRequestException.cs | 14 ++++++++++++++ Cloudflare/Jobs/Inventory.cs | 14 ++++++++++++++ .../GetCertificatePacksCertificateItem.cs | 14 ++++++++++++++ .../Cloudflare/GetCertificatePacksResponse.cs | 14 ++++++++++++++ Cloudflare/Models/Cloudflare/ResponseMetadata.cs | 14 ++++++++++++++ Cloudflare/Models/Cloudflare/ResultInfo.cs | 14 ++++++++++++++ .../Service/CertificateRetrievalService.cs | 14 ++++++++++++++ .../Service/ICertificateRetrievalService.cs | 14 ++++++++++++++ 12 files changed, 169 insertions(+), 1 deletion(-) diff --git a/Cloudflare.UnitTests/InventoryTests.cs b/Cloudflare.UnitTests/InventoryTests.cs index 9d3b7da..11f7af9 100644 --- a/Cloudflare.UnitTests/InventoryTests.cs +++ b/Cloudflare.UnitTests/InventoryTests.cs @@ -1,3 +1,17 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + using System.Security.Cryptography.X509Certificates; using Cloudflare.Exceptions; using Cloudflare.Models.Cloudflare; diff --git a/Cloudflare/Client/CloudflareClient.cs b/Cloudflare/Client/CloudflareClient.cs index 519e12f..3f84810 100644 --- a/Cloudflare/Client/CloudflareClient.cs +++ b/Cloudflare/Client/CloudflareClient.cs @@ -1,4 +1,18 @@ -using System.Net.Http.Headers; +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System.Net.Http.Headers; using Cloudflare.Exceptions; using Cloudflare.Models.Cloudflare; using Keyfactor.Logging; diff --git a/Cloudflare/Client/ICloudflareClient.cs b/Cloudflare/Client/ICloudflareClient.cs index eef4027..2f6fb80 100644 --- a/Cloudflare/Client/ICloudflareClient.cs +++ b/Cloudflare/Client/ICloudflareClient.cs @@ -1,3 +1,17 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + using Cloudflare.Models.Cloudflare; namespace Keyfactor.Extensions.Orchestrator.Cloudflare.Client; diff --git a/Cloudflare/Exceptions/CertificateRetrievalException.cs b/Cloudflare/Exceptions/CertificateRetrievalException.cs index c0430a0..d9d6da0 100644 --- a/Cloudflare/Exceptions/CertificateRetrievalException.cs +++ b/Cloudflare/Exceptions/CertificateRetrievalException.cs @@ -1,3 +1,17 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + namespace Cloudflare.Exceptions; public class CertificateRetrievalException : Exception diff --git a/Cloudflare/Exceptions/CloudflareRequestException.cs b/Cloudflare/Exceptions/CloudflareRequestException.cs index 731daf2..3a3467e 100644 --- a/Cloudflare/Exceptions/CloudflareRequestException.cs +++ b/Cloudflare/Exceptions/CloudflareRequestException.cs @@ -1,3 +1,17 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + namespace Cloudflare.Exceptions; public class CloudflareRequestException : Exception diff --git a/Cloudflare/Jobs/Inventory.cs b/Cloudflare/Jobs/Inventory.cs index 1481372..44432ca 100644 --- a/Cloudflare/Jobs/Inventory.cs +++ b/Cloudflare/Jobs/Inventory.cs @@ -1,3 +1,17 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + using System.Security.Cryptography; using Cloudflare.Exceptions; using Cloudflare.Service; diff --git a/Cloudflare/Models/Cloudflare/GetCertificatePacksCertificateItem.cs b/Cloudflare/Models/Cloudflare/GetCertificatePacksCertificateItem.cs index d28f870..85ab4fb 100644 --- a/Cloudflare/Models/Cloudflare/GetCertificatePacksCertificateItem.cs +++ b/Cloudflare/Models/Cloudflare/GetCertificatePacksCertificateItem.cs @@ -1,3 +1,17 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + #nullable enable using Newtonsoft.Json; diff --git a/Cloudflare/Models/Cloudflare/GetCertificatePacksResponse.cs b/Cloudflare/Models/Cloudflare/GetCertificatePacksResponse.cs index 85722a9..75e3ae1 100644 --- a/Cloudflare/Models/Cloudflare/GetCertificatePacksResponse.cs +++ b/Cloudflare/Models/Cloudflare/GetCertificatePacksResponse.cs @@ -1,3 +1,17 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + #nullable enable using Newtonsoft.Json; diff --git a/Cloudflare/Models/Cloudflare/ResponseMetadata.cs b/Cloudflare/Models/Cloudflare/ResponseMetadata.cs index ad5f29d..57661e2 100644 --- a/Cloudflare/Models/Cloudflare/ResponseMetadata.cs +++ b/Cloudflare/Models/Cloudflare/ResponseMetadata.cs @@ -1,3 +1,17 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + #nullable enable using Newtonsoft.Json; diff --git a/Cloudflare/Models/Cloudflare/ResultInfo.cs b/Cloudflare/Models/Cloudflare/ResultInfo.cs index 5694fe1..1684754 100644 --- a/Cloudflare/Models/Cloudflare/ResultInfo.cs +++ b/Cloudflare/Models/Cloudflare/ResultInfo.cs @@ -1,3 +1,17 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + using Newtonsoft.Json; namespace Cloudflare.Models.Cloudflare; diff --git a/Cloudflare/Service/CertificateRetrievalService.cs b/Cloudflare/Service/CertificateRetrievalService.cs index 524754c..b717626 100644 --- a/Cloudflare/Service/CertificateRetrievalService.cs +++ b/Cloudflare/Service/CertificateRetrievalService.cs @@ -1,3 +1,17 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + #nullable enable using System.Net; using System.Net.Security; diff --git a/Cloudflare/Service/ICertificateRetrievalService.cs b/Cloudflare/Service/ICertificateRetrievalService.cs index 577e98e..f9ef782 100644 --- a/Cloudflare/Service/ICertificateRetrievalService.cs +++ b/Cloudflare/Service/ICertificateRetrievalService.cs @@ -1,3 +1,17 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + using System.Security.Cryptography.X509Certificates; namespace Cloudflare.Service; From 5ff15726e7f45b31bdf40a484772d69ddfcffc49 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Mon, 5 Jan 2026 16:39:30 -0500 Subject: [PATCH 12/21] chore(docs): mark integration as production ready Signed-off-by: Matthew H. Irby --- integration-manifest.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-manifest.json b/integration-manifest.json index 2176791..b96e7b9 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -2,7 +2,7 @@ "$schema": "https://keyfactor.github.io/v2/integration-manifest-schema.json", "integration_type": "orchestrator", "name": "Cloudflare Edge Orchestrator", - "status": "prototype", + "status": "production", "support_level": "kf-supported", "update_catalog": true, "link_github": false, From dc2613de3f422edd151d260b9d5d33a94fc0dd0d Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Mon, 5 Jan 2026 21:41:14 +0000 Subject: [PATCH 13/21] Update generated docs --- README.md | 44 +++++++++--------- docsource/content.md | 16 +++++++ ...CloudflareEdge-basic-store-type-dialog.png | Bin 43996 -> 43992 bytes 3 files changed, 38 insertions(+), 22 deletions(-) create mode 100644 docsource/content.md diff --git a/README.md b/README.md index 3e6aa0b..3adad84 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@

-Integration Status: prototype +Integration Status: production Release Issues GitHub Downloads (all assets, all releases) @@ -31,15 +31,7 @@ ## Overview -The Cloudflare Edge Orchestrator Extension is an integration that can inventory [Cloudflare Edge certificates](https://developers.cloudflare.com/ssl/concepts/#edge-certificate). - -> IMPORTANT: In order for certificates to be inventoried, the Universal Orchestrator **must** be able to reach the server that hosts the certificate. Cloudflare's API does not return the certificate contents, so the Universal Orchestrator must pull the certificate from the server directly. - -### Authentication and Authorization - -When configuring the certificate store, the server password can be either an account API token or a user API token ([guide on how to create an API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/)). - -In order to read certificate pack information from the API, the API token must have at least `Account:SSL and Certificates:Read` privileges ([List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)). +TODO Overview is a required section @@ -57,6 +49,8 @@ The Cloudflare Edge Universal Orchestrator extension is supported by Keyfactor. Before installing the Cloudflare Edge Universal Orchestrator extension, we recommend that you install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command. +TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + ## CloudflareEdge Certificate Store Type @@ -64,16 +58,26 @@ To use the Cloudflare Edge Universal Orchestrator extension, you **must** create -TODO Overview is a required section -TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info - +The Cloudflare Edge Orchestrator Extension is an integration that can inventory [Cloudflare Edge certificates](https://developers.cloudflare.com/ssl/concepts/#edge-certificate). #### Cloudflare Edge Requirements -TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info +To inventory certificates, the Universal Orchestrator instance **must** be able to reach the server hosting the certificate over the network. +Cloudflare's API does not provide the certificate contents, so the extension fetches the certificate directly from the server using a TLS handshake (via OpenSSL). + +#### Authentication and Authorization + +When configuring the certificate store, the server password will contain the API token used to access the Cloudflare API. This can be either an **Account API Token** or a **User API Token**. See the [guide on how to create an API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). + +The API token must have the following permissions: + +|Permission|Required|Documentation| +|--|--|--| +|Account:SSL|Yes|[List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)| +|Certificates:Read|Yes|[List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)| @@ -205,13 +209,13 @@ the Keyfactor Command Portal > The above installation steps can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions). +## Post Installation -## Defining Certificate Stores +TODO Post Installation is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info -TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info +## Defining Certificate Stores -TODO Certificate Store Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info ### Store Creation @@ -275,12 +279,8 @@ TODO Certificate Store Configuration is an optional section. If this section doe ## Discovering Certificate Stores with the Discovery Job +TODO Discovery is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info -### Cloudflare Edge Discovery Job -TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info - - -TODO Discovery Job Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info diff --git a/docsource/content.md b/docsource/content.md new file mode 100644 index 0000000..48b64fd --- /dev/null +++ b/docsource/content.md @@ -0,0 +1,16 @@ +## Overview + +TODO Overview is a required section + +## Requirements + +TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + +## Post Installation + +TODO Post Installation is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + +## Discovery + +TODO Discovery is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + diff --git a/docsource/images/CloudflareEdge-basic-store-type-dialog.png b/docsource/images/CloudflareEdge-basic-store-type-dialog.png index 342b7b741bbcb308f94befb612703dce896fe22e..d632a6bcf0df789ad014064d7ecfa0a539836160 100644 GIT binary patch delta 487 zcmca}o$1DPrVZk@^*7V!|NZxUzyEe4C8Z_?1_qmTYHDg3tktitt-b%}nYsP1i~aMe zUTF&PC7yVrzwbvhTid^%^Z(D(xxL9~c3YHp%pL%oN{(sEUAVHwMhzpy~+j%=r);Yh)s5&R7C-tNCU7+xH$H$Y})FS7l#x{R@ zIz7Jbx%GWTpzwwTCr+IB_^}XVNY1?Hh0)?b<7*9hHvf^=KlpwDnFptA`TE)&E?SxZ6n*kU zxI`-6M;b2LSO65&$hNrb`SSE0xM*(!Q1sbT=_kf}W7ok&XHEc$ew)a$)FI?>B?AMu rDA)~47l?8znVnQ(0(zYdB*M(lFS=K63P<50pa_GftDnm{r-UW|AR-~{NWe)7j?1< zCR&%_H+gev08sQvo`5(^^q+Zf%I3lZplJ7`Dg7|fCr^Y+HrEyaMTyuz^IG Z85Sq)HCz-W!~zsy@O1TaS?83{1OO1rl_>xK From f84dbde43f0a42606571ebfc35fdfd202e5e0161 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Mon, 5 Jan 2026 16:43:51 -0500 Subject: [PATCH 14/21] chore(docs): fix overview and requirements Signed-off-by: Matthew H. Irby --- docsource/cloudflareedge.md | 17 ----------------- docsource/content.md | 16 ++++++++++------ 2 files changed, 10 insertions(+), 23 deletions(-) diff --git a/docsource/cloudflareedge.md b/docsource/cloudflareedge.md index 2dbc74f..0685dfd 100644 --- a/docsource/cloudflareedge.md +++ b/docsource/cloudflareedge.md @@ -1,20 +1,3 @@ ## Overview -The Cloudflare Edge Orchestrator Extension is an integration that can inventory [Cloudflare Edge certificates](https://developers.cloudflare.com/ssl/concepts/#edge-certificate). - -## Requirements - -To inventory certificates, the Universal Orchestrator instance **must** be able to reach the server hosting the certificate over the network. -Cloudflare's API does not provide the certificate contents, so the extension fetches the certificate directly from the server using a TLS handshake (via OpenSSL). - -### Authentication and Authorization - -When configuring the certificate store, the server password will contain the API token used to access the Cloudflare API. This can be either an **Account API Token** or a **User API Token**. See the [guide on how to create an API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). - -The API token must have the following permissions: - -|Permission|Required|Documentation| -|--|--|--| -|Account:SSL|Yes|[List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)| -|Certificates:Read|Yes|[List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)| diff --git a/docsource/content.md b/docsource/content.md index 48b64fd..2dbc74f 100644 --- a/docsource/content.md +++ b/docsource/content.md @@ -1,16 +1,20 @@ ## Overview -TODO Overview is a required section +The Cloudflare Edge Orchestrator Extension is an integration that can inventory [Cloudflare Edge certificates](https://developers.cloudflare.com/ssl/concepts/#edge-certificate). ## Requirements -TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info +To inventory certificates, the Universal Orchestrator instance **must** be able to reach the server hosting the certificate over the network. +Cloudflare's API does not provide the certificate contents, so the extension fetches the certificate directly from the server using a TLS handshake (via OpenSSL). -## Post Installation +### Authentication and Authorization -TODO Post Installation is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info +When configuring the certificate store, the server password will contain the API token used to access the Cloudflare API. This can be either an **Account API Token** or a **User API Token**. See the [guide on how to create an API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). -## Discovery +The API token must have the following permissions: -TODO Discovery is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info +|Permission|Required|Documentation| +|--|--|--| +|Account:SSL|Yes|[List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)| +|Certificates:Read|Yes|[List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)| From 5c98d4dd6ef47ed76375830da2f99bb10c8e7330 Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Mon, 5 Jan 2026 21:45:53 +0000 Subject: [PATCH 15/21] Update generated docs --- README.md | 38 ++++++------------ ...CloudflareEdge-basic-store-type-dialog.png | Bin 43992 -> 43996 bytes 2 files changed, 12 insertions(+), 26 deletions(-) diff --git a/README.md b/README.md index 3adad84..a08655d 100644 --- a/README.md +++ b/README.md @@ -31,7 +31,7 @@ ## Overview -TODO Overview is a required section +The Cloudflare Edge Orchestrator Extension is an integration that can inventory [Cloudflare Edge certificates](https://developers.cloudflare.com/ssl/concepts/#edge-certificate). @@ -49,26 +49,10 @@ The Cloudflare Edge Universal Orchestrator extension is supported by Keyfactor. Before installing the Cloudflare Edge Universal Orchestrator extension, we recommend that you install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command. -TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info - - -## CloudflareEdge Certificate Store Type - -To use the Cloudflare Edge Universal Orchestrator extension, you **must** create the CloudflareEdge Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance. - - - -The Cloudflare Edge Orchestrator Extension is an integration that can inventory [Cloudflare Edge certificates](https://developers.cloudflare.com/ssl/concepts/#edge-certificate). - - - - -#### Cloudflare Edge Requirements - To inventory certificates, the Universal Orchestrator instance **must** be able to reach the server hosting the certificate over the network. Cloudflare's API does not provide the certificate contents, so the extension fetches the certificate directly from the server using a TLS handshake (via OpenSSL). -#### Authentication and Authorization +### Authentication and Authorization When configuring the certificate store, the server password will contain the API token used to access the Cloudflare API. This can be either an **Account API Token** or a **User API Token**. See the [guide on how to create an API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). @@ -80,6 +64,16 @@ The API token must have the following permissions: |Certificates:Read|Yes|[List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)| +## CloudflareEdge Certificate Store Type + +To use the Cloudflare Edge Universal Orchestrator extension, you **must** create the CloudflareEdge Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance. + + + + + + + #### Supported Operations @@ -209,10 +203,6 @@ the Keyfactor Command Portal > The above installation steps can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions). -## Post Installation - -TODO Post Installation is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info - ## Defining Certificate Stores @@ -278,10 +268,6 @@ TODO Post Installation is an optional section. If this section doesn't seem nece > The content in this section can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store). -## Discovering Certificate Stores with the Discovery Job -TODO Discovery is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info - - diff --git a/docsource/images/CloudflareEdge-basic-store-type-dialog.png b/docsource/images/CloudflareEdge-basic-store-type-dialog.png index d632a6bcf0df789ad014064d7ecfa0a539836160..342b7b741bbcb308f94befb612703dce896fe22e 100644 GIT binary patch delta 358 zcmca{o$1bXrVZk@uI=`J9)92d|L=(tCwA8r@h~tvFf=wabkx2Py*=;mGxPmFFZS1c zxf1L@v4F!lt^VUtab;!Y|3B^jr!z4yFtoU^)PCQ6f9YgB!*r&XY?G%OPV`i5Jgs(C zc(cmvYUc0frtK;7{#*)F`k|L2KaG8zdAjQInfc3RosXB6-CK5Vk8|1D67Q(G-Tf`W z4}LxUcJJ!a@ccNlzZy3GrA}_1ZMTk5z|(le3I+xN22U5qkoeiwn>R-~{NWe)7j?1< zCR&%_H+gev08sQvo`5(^^q+Zf%I3lZplJ7`Dg7|fCr^Y+HrEyaMTyuz^IG Z85Sq)HCz-W!~zsy@O1TaS?83{1OO1rl_>xK delta 487 zcmca}o$1DPrVZk@^*7V!|NZxUzyEe4C8Z_?1_qmTYHDg3tktitt-b%}nYsP1i~aMe zUTF&PC7yVrzwbvhTid^%^Z(D(xxL9~c3YHp%pL%oN{(sEUAVHwMhzpy~+j%=r);Yh)s5&R7C-tNCU7+xH$H$Y})FS7l#x{R@ zIz7Jbx%GWTpzwwTCr+IB_^}XVNY1?Hh0)?b<7*9hHvf^=KlpwDnFptA`TE)&E?SxZ6n*kU zxI`-6M;b2LSO65&$hNrb`SSE0xM*(!Q1sbT=_kf}W7ok&XHEc$ew)a$)FI?>B?AMu rDA)~47l?8znVnQ(0(zYdB*M(lFS=K63P<50pa_GftDnm{r-UW|A Date: Tue, 6 Jan 2026 14:46:03 -0500 Subject: [PATCH 16/21] feat(pam): add pam secret resolver Signed-off-by: Matthew H. Irby --- Cloudflare.UnitTests/InventoryTests.cs | 15 +++++++-------- Cloudflare/Jobs/Inventory.cs | 21 ++++++++++++++++++--- 2 files changed, 25 insertions(+), 11 deletions(-) diff --git a/Cloudflare.UnitTests/InventoryTests.cs b/Cloudflare.UnitTests/InventoryTests.cs index 11f7af9..5f62328 100644 --- a/Cloudflare.UnitTests/InventoryTests.cs +++ b/Cloudflare.UnitTests/InventoryTests.cs @@ -20,6 +20,7 @@ using Keyfactor.Extensions.Orchestrator.CloudflareEdge.Jobs; using Keyfactor.Orchestrators.Common.Enums; using Keyfactor.Orchestrators.Extensions; +using Keyfactor.Orchestrators.Extensions.Interfaces; using MartinCostello.Logging.XUnit; using Microsoft.Extensions.Logging; using Moq; @@ -31,9 +32,11 @@ namespace Cloudflare.UnitTests; public class InventoryTests { - private readonly Mock _mockCertificateRetrievalService; - private readonly Mock _mockCloudflareClient; - private readonly Mock _mockSubmitInventoryUpdate; + private readonly Mock _mockCertificateRetrievalService = new (); + private readonly Mock _mockCloudflareClient = new (); + private readonly Mock _mockSubmitInventoryUpdate = new (); + private readonly Mock _mockPamSecretResolver = new (); + private readonly Inventory _sut; private readonly string _testCertificatePem; @@ -44,11 +47,7 @@ public InventoryTests(ITestOutputHelper output) .SetMinimumLevel(LogLevel.Trace)); var logger = loggerFactory.CreateLogger(); - _mockCertificateRetrievalService = new Mock(); - _mockCloudflareClient = new Mock(); - _mockSubmitInventoryUpdate = new Mock(); - - _sut = new Inventory(logger, _mockCloudflareClient.Object, _mockCertificateRetrievalService.Object); + _sut = new Inventory(logger, _mockCloudflareClient.Object, _mockCertificateRetrievalService.Object, _mockPamSecretResolver.Object); // Load test certificate once for all tests _testCertificatePem = LoadCertificate("example_certificate.crt"); diff --git a/Cloudflare/Jobs/Inventory.cs b/Cloudflare/Jobs/Inventory.cs index 44432ca..393d6f0 100644 --- a/Cloudflare/Jobs/Inventory.cs +++ b/Cloudflare/Jobs/Inventory.cs @@ -19,6 +19,7 @@ using Keyfactor.Logging; using Keyfactor.Orchestrators.Common.Enums; using Keyfactor.Orchestrators.Extensions; +using Keyfactor.Orchestrators.Extensions.Interfaces; using Microsoft.Extensions.Logging; namespace Keyfactor.Extensions.Orchestrator.CloudflareEdge.Jobs; @@ -27,23 +28,27 @@ public class Inventory : IInventoryJobExtension { private readonly ILogger _logger; private readonly ICertificateRetrievalService _certificateService; + private readonly IPAMSecretResolver _pamSecretResolver; + private ICloudflareClient _cloudflareClient; private const string CloudflareHost = "www.cloudflare.com"; // Default constructor used by Universal Orchestrator - public Inventory() + public Inventory(IPAMSecretResolver resolver) { _logger = LogHandler.GetClassLogger(); _certificateService = new CertificateRetrievalService(_logger); + _pamSecretResolver = resolver; } // Constructor for dependency injection (used by unit tests) - public Inventory(ILogger logger, ICloudflareClient cloudflareClient, ICertificateRetrievalService certificateRetrievalService) + public Inventory(ILogger logger, ICloudflareClient cloudflareClient, ICertificateRetrievalService certificateRetrievalService, IPAMSecretResolver resolver) { _logger = logger; _cloudflareClient = cloudflareClient; _certificateService = certificateRetrievalService; + _pamSecretResolver = resolver; } public string ExtensionName => "Keyfactor.Extensions.Orchestrator.CloudflareEdge.Inventory"; @@ -186,7 +191,7 @@ private void ConfigureClient(InventoryJobConfiguration jobConfiguration) if (_cloudflareClient == null) { _logger.LogDebug($"Configuring Cloudflare client with provided API key."); - var apiKey = jobConfiguration.ServerPassword; + var apiKey = ResolvePamField(jobConfiguration.ServerPassword, "Server Password"); _cloudflareClient = new CloudflareClient(_logger, apiKey); } else @@ -196,4 +201,14 @@ private void ConfigureClient(InventoryJobConfiguration jobConfiguration) _logger.MethodExit(); } + + private string ResolvePamField(string key, string description) + { + _logger.MethodEntry(); + _logger.LogDebug($"Fetching {description} value from PAM"); + var value = _pamSecretResolver.Resolve(key); + _logger.LogDebug($"Successfully fetched {description} value from PAM"); + _logger.MethodExit(); + return value; + } } From 8a0665a155e9015dd72c666fdc968dfb3d19d95e Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Tue, 6 Jan 2026 19:47:57 +0000 Subject: [PATCH 17/21] Update generated docs --- ...CloudflareEdge-basic-store-type-dialog.png | Bin 43996 -> 43992 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/docsource/images/CloudflareEdge-basic-store-type-dialog.png b/docsource/images/CloudflareEdge-basic-store-type-dialog.png index 342b7b741bbcb308f94befb612703dce896fe22e..d632a6bcf0df789ad014064d7ecfa0a539836160 100644 GIT binary patch delta 487 zcmca}o$1DPrVZk@^*7V!|NZxUzyEe4C8Z_?1_qmTYHDg3tktitt-b%}nYsP1i~aMe zUTF&PC7yVrzwbvhTid^%^Z(D(xxL9~c3YHp%pL%oN{(sEUAVHwMhzpy~+j%=r);Yh)s5&R7C-tNCU7+xH$H$Y})FS7l#x{R@ zIz7Jbx%GWTpzwwTCr+IB_^}XVNY1?Hh0)?b<7*9hHvf^=KlpwDnFptA`TE)&E?SxZ6n*kU zxI`-6M;b2LSO65&$hNrb`SSE0xM*(!Q1sbT=_kf}W7ok&XHEc$ew)a$)FI?>B?AMu rDA)~47l?8znVnQ(0(zYdB*M(lFS=K63P<50pa_GftDnm{r-UW|AR-~{NWe)7j?1< zCR&%_H+gev08sQvo`5(^^q+Zf%I3lZplJ7`Dg7|fCr^Y+HrEyaMTyuz^IG Z85Sq)HCz-W!~zsy@O1TaS?83{1OO1rl_>xK From 19e8347d320d9fcebfffb36de2f9a7dd71079dc3 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Tue, 6 Jan 2026 16:18:50 -0500 Subject: [PATCH 18/21] chore(docs): add documentation on how to find account and zone id Signed-off-by: Matthew H. Irby --- docsource/cloudflare-account-id-zone-id.png | Bin 0 -> 51236 bytes docsource/content.md | 14 ++++++++++++++ 2 files changed, 14 insertions(+) create mode 100644 docsource/cloudflare-account-id-zone-id.png diff --git a/docsource/cloudflare-account-id-zone-id.png b/docsource/cloudflare-account-id-zone-id.png new file mode 100644 index 0000000000000000000000000000000000000000..f67b348105b16af43b00cfa7f1e7153856e8e3e5 GIT binary patch literal 51236 zcmeFZby!th_bvOmybg}=@8a>HpxhKR78aIyBP>iQV{K_*Y^INbBK9d#`36M3lQ>Z=EL6}aMFOi1 zi%RaA7*+~K=sR?>hgkUHpRr!H1=ByPwlDF-)gY2x_k_r__N9)WdHV;HG7_(M#S{Lp z(>$3usjoR|Fzh>D>Z!5W>OmEpe=PdAON0%zgJ3amUI=YPS6*%6@K^ey%m9Ny~`jLH~;XK&il;)H60?KTin<>~9 z#UalP1#jt)P&|2hO-I*X*tbUZi@2Nf2TEVu7wQj}Szq$=pz5Iclk8GA?TE+s&UIRe zYZ_^Mh-p(;?YC*QZeZ5DmBIDtE%ntJJ-=FKNDhes^<&|;UgNofp@bME+^v0K3CEZj zz01w?O2f%P5Yi`sv)FT-_0L&lnnH;5{DtQt4l|s>noe}$%h1=KQuBuT3j=CbISBR#q0)_H0Fk{s4tl>Uh~&C-c&o%vcah2 zp#raB1NR@;c)lbY2=L@qfi~Kd~y7{mp8->}&5YF_oV&$}GR1@I$$}L%J=&;_DJkUF@@Gg+bAH1Km># zA20RgH8E5I?R}N^Ujv&Io)h$-Q77M|N6Tw+F2*v$;Ax_Gk236|`;(9phtZ4f=k@9v z%F-N;sHcrQ+xK4L-w_fq@_(rF0rDu=pRQT(JXGuPolnAYp{$PyZd1wW(J()t6;`5L z`@$f`R{DU;J3)w%a-)MhonYnVyGKbfHx-5LWC(_@lY24C(2#o3Boq92Ym2SwPn;(4 zqr!*?N>(5&of7?n%;?7HwTi!lW4jSvWHRDiygjv2dBK%}lBgkcnOc8@I| zZLN)e?p4BvA*(0V-Ywg&5(1^04Ce!P4vwY1;aN5n{rc+o;4(;%`YyqJtQmB6ZTg4d z&m(1oo<1>qa-Sx_YgUfq7x@>l;YX8q_v0R0_0mw8|41)k>(H;L}pb$Oru9J3JfP7o0Dy5nJ3zp94c)LO=_@yHh7~uP+fjfZeGq(Zb646l)*>`z9WhE9xR*Ag&E4Yq z!Rliq9?$dj!WSm%TK5fkTO9MO@~j#@<-E!M)S>sa(>VN{Jl_z?klB!8=99NBJw^uZ z2G`0I4I~ZvSD>~ue9`q$GeTP|9PGDPqT?)ISh8H1X`6mAlGQ62oAaV>3)7C(uIVbB zDDCg+G5I|5Hjgx~c2v*wgI&}C>6*>xmbsaEm^tzIFpRg1tymvMJUKc(Q?6Sk7hDp&B2xG6H@%-$6n-kq z53l4e-Ct4vt-f_`?K|Q>e7jpTfo!L@ZJK&aKfb%}%jBaLQQ{!8`zMnlO_6J=znt9& z?G!q)xzb2q*IC=x&exjT)^14IJeaRu$Nx^L7%3{?C&ZmnrzAH}Tn z=I`3RJ&uXg-4s<3#Y$UEd&$bW*?$^rU3?srzVl|}%~rTinDS$X&*U%cN5>^-U(Jkem-ENv)MWy&ProNL;m(rI(62D_*wI(MFp$Vp^25q6*qNa z2izkJCeNyXv6iESqMri2+r5x4JM=>wHu?tAQ65T8N=2U35GKb+@~Ar6GdC&QzTgC} zsozs|PS2c-okV>no9}CP>kV}d(NqQA7okoKrk#;jl3pPY^{1_z$xIge zmA}?0cp+hqYuZM5X){4IHkxJYh$=djNW^mKNxvmMJ8h!c)Pck@6C3p^^<0=5jw`X5 zsy`DUy_p)T$pBPjR@^Crq+7kKtGk|lk+J@GtwVF{lDqh^?i-j~NCsK-?P#p%Y4yzp z*Cp%%B0oB)Qm~3jRX}~N?FeinTuJk(1Kn)-htk*3OkMNelOODq)}ji|O8HGMf&v-? z>LS}C1E0-W{xq+KzR=R$pb3}MkLNchHmk3rww2I`lvF%Xnj7^lkglXQ=Q$#quUg%B z4ePG-n0`1lP{LwiC{bZ(cfdHWAz}K1)L62AbEmdw9cyw(W=)}1zi4Kr)J-eNc6RT= z_{@^RpYw-ns8#V{=s`+XOLs|MB~WZNN+u`jH_9N2hLc&f=~$FMv(v9`Vz zZSiW_s3F#I@33H}irZq(LZCL>WocyEyEbX7w@$iR^Hgx}<%#h8M@5hEtCFggw0TEE z8N;=-W6>jMwFVP~1ck>6qq~rs+~x4P@d3-2;df^t=R)2GN8ir;mfMzQ!UQTV^IeUP zc7JH1dQ=<+ZLGOdyR&UO?~t`{@XSE#%r`?;JdPQ+rk9Q~9^4dIKkqnp+?3zV%1X*| zf9R%iHgah?U*&IkbYu7W^;h>_h`JLtY6-J2qd3-~p_pK!utJh#+i6z?YA6HZ6oVT* zngd8>8MlAS;q-5n)NR|^;CQ;hv`#Qi*xJ$Xg)u0baFWwr<5o1OO1@L>^2J>9?0um* zv^Ut)a9gDJM0iSI*6Z^K?z!s~Ne;}_>S6I+N{~_n=tJHZNJ^qS1D`Qb&{0WIFu*5N z@WYQv_MgwMQJW^=5gU|58 zOjMMAe8tw3j|w6wLn&-&txw6$_?+=M6+bp5B_*%5o&mSqtJi;B4*thSWn^pno|}ou z!NGyifrZi1+K}l57Z(@Pb7m%HW(M#L1{)^}TWv=M3!6uO-sJE5ywbPPwKjflYiwyj z3BRwlj-{O~9~Bk+LI3&pXFK&BjsJO)h0R~x0v%+6pJ95z_?+oK_Xd~p!jE#x7(42l zsk|~a2V(}F!O!vHIqx6e|KHC1^F)LzA^%*-^@0=eN`y22zEaUf-&)wx96ZvN|DWml z>te){e_hDS1n)V*Nc=g>e;ftl%#Y2>^q)E7#~wgICj!%W-}sfZ0{9Dz4E_&Q7yNqq z=U@0|$*;+Iuxu0*L6kSIUMe`Eu1{lqQj+od0Oj>#W z@A+YmLjtb1?)itR7>GOd%!Pn@|24b9WaxSyp~`r4nDnZD>zk&N6tN-tC%O(XgZv&9sWeR^8EZf!Y!74 z%H!&S-F|)i?Z?OK^4VtN#VKs2qdn8zUqmU4gUC3fIBA@yr`hoMkG05N=)BrZ$$y08 z{`6@Ci$4$4U!JZVhIpK($^2HctQ!gDI~*4}%7T4i+|S@CEH=lE%Sx~g(6DMF%2evG zm4KS!(+|BV!A10NU2>jU_lD}uce^(Pu1=&=`p!10l7jBBWd68Vu}{ZwTM4E!QR|Lk z*hqBQEMce|r&{=7J4Ok~d|rZzbQ=ieZj<#yslI*dZPD@5gEgECrL|wCMRiJgW5dS; z;6^)V61#3oUmYqxQaE>j0f~~KpJv01!g`gD=Rhr2<5>)YdlR^ZE>3=Ze2|}0h6&_+RZ32 zKK9MYCZ5$;uDP;V$@>GpB+Kq0%<@UXJD;1=R^Q1lE0f2zrCUk<6A|I}rt}ol^I2G* zC@U}>E5xz|rdysPpQRc^%4W7PSz*7N@^Nx?B#$82>G;=2^Dzwv$?+%)YNKUf%DyYA zI})%;bIC0aXNmvb*a@v1C)x*&KfTavf8SO-J6JOu%9NDgTpX5{t^g**uB`@*OitOF z3uLOiC2;=y*Rb;gR(Et*@|YMW7aj6Cq{W~jqaVWUv$;4Jds42$e|5gcuGQ#?K6xFN zw0b~gZ+G`j<&z?GEH~2Im2PK;l{#$!zC*y&YwSCzqmNMa6Tn*ZBe-;820=qcWu zuFd*Uce5RZIzSwE=W!qoGx8Irj61t)6NV6w)>P~KGUJk^1; zU*PKeSaQ<^O8drSBv&6eBX&39O0YJ$*{9DVY?k^eit10h4Ehp`yQ7(;UAitW&R}4T zBo;GGvl*5Amvv;_vzMNee%s|Z#_mg_{|Dl-b-877%6QD=nv)b z5)t#QA1OZ5PD@{DKW5ZkZ({cQgo`*;GVSo@R!vz;bg4(cEF0=16F5s`Rw?+L$D=jf zV~aIyG)(%so1<(~ii&kv%mvnqTg-kodMVY~Z$z{VYWQfyHn(0!G|{KJUSb#$y^<3p zx}s-mMGbc#Y858>bEP#qzBOvYhhrexW$amRfr3r89y&J8{NKGXHP3_Jrs-Mh!8ym(p zu35s-xezzDckudI*gk!hSNxvF80P}C6xa8{e`A+ zq)>tR80!@c{_ESpC!6SGPirBBhA8@XM~28DdXS z(ZkTG2F z0__kxCrGJ6d8bLPAm}TPLnR1oG`t?O^=<`*{fY3K@Luc>u{&=6j1XouF^gw6zf&14 zx=a^h`k0sSUn`l^OAKA2LVN~pK_OSoI84>D5P5sTQti$#YIx8|M;~VC=Vj3^pV-B8 zTd)cedOH3YX{8-s`+^xYUF%SFkHz5lRsj>wW_22fm%3Q6fU>YciGob*frKa!+ClB( zkFoeAfd8+RFN7}ifPSebR`)x(gL>DzrgbN^{btQlrWun-i%mbDA=(YRw_Ik!*|L>a zmuF|N?mx!k{Kgz|N+aVhxa_k~Z8dMUzdS%2qB+j`koE?RIi%7ob`7uA{o>S@PXlUO zf{J$i820Co{`Xtxj}>Z|AFfYeg=kJ%6wkaFo;;ax*>cL;WDyXUrIAiFV>20kzqWAu zv}>Le>sBW=QjiIKO}XF1+{;pig%l|SDFZO_mT+o{|cVe%2}2>p^rfo`S>}m{BUNzZH;=5`v?$`F4r-kOre8 z6{U$eFeU*T>8L;aXh20D3o;&4A*6&D+zyvVPEuvT(bpxTP6o)s`9FjFpSk**!XtjcyEy96T zdi9U`vrV2nxr~4c)3LtUhEAGz$TZZh;7vHqXtB0%)$D9162j@A_4;w6+uQpZ%w?+% zO}T5lM7O{kR{6(+)a@tq5BqqwjziK80E9SRV=?S22N(sW*}qQ>vN-!`J7u0^}PEv3q-a8|`G4F{{hRxx%KV?qrgYn-ND)wF#X$iDoeSTuiM)km;G zMzdvG_>X`3q?esvAKU<7TY88LGxXTC-G;d7+?1#_w8fx-bRotLp_ki2;qD1gWDON8RgP z)P~E`JaUiooy*0GquJTlL8SUc4VTcIHKX$g3hr!RHuj?`hBbR9euJ*EPwS3mT+9d4 z-(+reN*t_?zyS^%96)VowwO%n=)E%vx!g`|Yqy(mF1qsqcj=10&1F*WaO@)Grq3cl za8V*R8R0n?mWNO95nYz<_h5G0Wf>2?X%fF=0Lg2kDs9i^tIR7#lo&lNYBwr(;u*Lg zn_%8Dy-Y#o9gS~IfZe9FPhnK_t}cwD)~+J%*>Q%8<%=56P0@n#9UB>%2jLcV`JhF1 zASaAl?A(t6V?PCT*xD@EMKDs7Ymsk3D9;Nev#4&W2yn71J6Vi}wSFRCu_qd-_00Ne zABU6ij>|3AuT(KliScgREtGUOY)fuSkO5Y#M*Y^xIk`WAy;`9#TBJD}#iW_Yt`~gw zMKhez*izV(A5*{#yk#(%Vo|gDI&VYZVn3W`^ehBAGXwJd8IuzJZf3~pySc3_;g5KQ z2bBgY~k0du@eBBk;WNu;1fyC`fgUJT0m&uMpa$ zW|!prz^W(a#U*>)TF%mh``N~YxwD~s+LXyFB}-bVD$Om3Ta=FSz zWUO7Edob@7`$G3ae3vfpm=@vJapgJ~H|3(5S1az0p%-3&rD|13DG&~i(_%vp3mZ5Vn4(lqGNqdIdxw|4++ zTVUU^Y)~CL-Cvn6$aH;Y)5~_a7;kwBn^zMF_sQ54)|R#5q+!BtSxqGqIL(I!0Sc*+ zJnsCh^VlBX3Z(dh8r%VLk5M(R6WO!dEcs3`W76JVdNV4nQpAVAshb^UrrXbdmS5F{ zM93&Gdx>3_sPI2n9%%Vyk(^6Vmv?toJSrzqO5nm4_^+*V;W;(Riy$k__F!^Tux1+? zG5`<2uGfKIm3W{2KuXUQ6F!L<8nyOVTPp20y0u$AOz4L2MX9HcuaUNjO}`H;i_k9~ z-lu|+SauFmt&_JPHy}aqxA#IEo2j~I0-sA|Q6Xbm+@37j5uxG0w}`mG7PbA&v}S4T zZjk=y0v8|Oz*8S+!tS#Gm?pwyjaRtKX`4-LDqYMFlg6~HB=^Y%T)Qjs=USc(eMs>% zTOFQ(o6x%Mc0RdK{c+}^I`)&TO@mc+ttXb{qQ&yt&TF2XR)ULz-%KqZZ&mHge?N;4 z;aa>)#`!*3t>2*d8yJgep41t?ICgWBReQB55ubA-^wBwbeIojiY2_w9_tr^}*iYk% zDrs4@+?KzI_#Mknw~A*f&D>}N!beBy#?=VF5jEC{r2TT=Zn`mJl9JTfFO#Rl zAn%~rd#lU)p9l<`n>;0RlQqa5Elj?M1QMUHSpjz)cYTg_g;~29y>_jz_FM;MUiB58 z?}B*9<`I9SzcQFn$Yuj*&Ka7qjYCf~y!UGpH={J&4kF=^s6k5BXU53=EiSP_Tn6y? zix?wLfM?v84SPMTNTNxM*yZeR*S=sy0cxY>VoBg?$5d$RRq#EQ_FRRWIZL|DXg?g1 zNjMX{TDijD=cmy7>7Ib%hu81j=7TuSX@yGf(c3Y7f8g;go@}VLsNU^NwLg)sPVq_} zjl>wA3S$$nrnLgj-%9~nxqJ~@ug3y0AtkE&m@8{OFA3bDO+2TSPDz$vr)|T!Fk)yg zCGdY${FZ`OGy&UtH8F=WO#lM}<6b0>!)C&BqED~AgOaWZqbj~E03m5KQ<7{bA*`tG zFwWR_=$P7Rf5PlWH^6EW3{_KiJl=3nhHN%~VYN5|tdkk=;gZX7qyot@LcfHR#7XJx z;*O7G*z~*R+5)F3#mWqN#do5YmIu<{2+nT`H6Af{OfJQIMFpX-{qeHWdZ9~jF>Y@M zz_#uFls#IpzF3y;vx{!BPXjES_A2ut734!&L-^tNz?8ZHZB;{4J~m&oVP>v&!6a!@ znZbuat#TiaVYiI6sk9^f(#=!Vj*U5gaa|7?;V|KU(y9TjARX74IwuhXvQivk`sa3b zUtj3H{*uKFxTh(xVgT2qI4i+4XDY}Bu7U`f@V>y7PBMnX4Fg#TU>6Y9H4-u<)CrTWS+GeZ>OH0yB3L+2>1X8HJPg~hbkvum(8X;^qCbD z6vmGly^#Dp7dq8#`tCqgpC3K(9Q~|!@}XZXY8IlX;~tddZ_1GN}jXv0ao@a zwvk0#3WAip;1=7%)Y3@n6H~z-rKwbCyyhv=^YAIaEgV`!4zp4; zAUw+fX6^>wQr}dmsM2n24E6z+tXaMr*=F=KC_xUEt5{&dW-?k1aJ0%-Zo7OyWUDkt zF(y0*)en#wR@$z}sa2Y(Fb)$P`6JF#qRzqlk9ZhwzdS}Vt9uy3dsc4wRr8>v^EOE7be;j1l(o2*9oD0Udtvz7 zJL8$l%r__Z48X3zcK7x)Vs5&b?|CB5vW&qs>{w6|ERLj8hMH#oG6`g;^nbOcpYEM8 zlX7mpsSd+Gi^iyU3%u}HF7W>b0`yWy#MuA=q}INGL9>3ULT|Bcre>;Ch2;p(Ach)H zts`<=OJkZE*~5Vqt4BRZEys+A^lZ10osVkP-z%uZw(Hi{^IibnbsgGp=UMk^5ias_ z)k9@c&s8%EBxVS6_-Md)r)iKZTXb3zOw#?huKAaUMxMNjLl5$AyFlDMPyQ4DtFPsa ziZg&>&fM3ouB)S9o>%|)0ZN5y&P&zhl8qpTts&yK5@ zvGW|!j6&nDHC$cR*6sj1Sz1IRv>rq67Sj3`X|1OQC|2_UYt9D@Q45|u)JU^74&0`W zyka66R#apbV>JPycX|E@viP$IT?jwc27Z>+0)Zm+!Usien__D$aMpN=8No|GB&LKcYAxIWX9uhG5t=1L z54hTSu$G<+d{G*tqe6`zknoP!eJ!Eew-|9|etQ~+L7!})F??gRcQJkFme zJRopNJieR04swx=HWJNpP`-mvxU9>ju3e`+Yec&>KBnnmj&}WKF}K}n#4_|{*E^Su z3b>mYGJF#~7=r7u^rQoF9_z$o>7hRs7uGYVkp=NjlaNtF5$=On>@4?Y;)wpl@^ z8{I2IS+Ko+0ZU~KyGS5qXap>YuHjd^s56@;3=+u8mtHF#bAdg3>u0>$(6Sz79wwTaU>~b5lCy!gAnhCxUr4jlNU3m^Ir;s44YZPuq>De8eNq z2WW6J0n|RqL6Ti701W}`PVWaiauZOZk2MGU#HF22ga)9krXA;l;APcuJf8KReG?U? z$}m6(nu846;sU^)3XoCMnvMZVs=*@k&+bN5T3{%_yUs2)L1{;pZWggRdKLJeQZ!JZ z1nN`P2hgg|H0^>+u+n%aQw3D`0OE6pG@_%^~XA(!v3|w za(0HVsPAGmuP6>GSr6D8#$`ZnPQr7+wdvX_k7-K%B$rLDu{ur=;y{R5ypj!E2z@9# z#b&o5$v)8v>dtyMC>)dFUzAW2fI5mq;L26KM3`CGT(v8vJAap+C_{n$<7>7Nj$UP( z7*CcP*Gx6G2a#=5jJ;#2BY~5tAg8+cgLKnym>#K+d!|Qj)APa}SX2#h?{Pe~oDxGA zkTn!PNpc;uO`LX^ogOx+(#)^eorlnw0H#I*WymGb?>!dUqRLTq(Whh*?n|7jYXMG|rKq|cs3QcSymVk^iZ}P_2{3->&XQVC21xoqd zP9Xq4$`z{p7mHQ95EEBpH?fP~B?dT|v@eBogh6D6s`po*dGoP2CZyQQ_F z;WCn|$hZvZzyrglY5IT-wBJ&(0157lwy}UugkoNX_Y4rdEc9t)h!c$+C^BS{PSFhA zNnZy^mGRM(O^6$ivTWWVtDam0l*oi7i1gJhaxJ-Hdk-_BoS4w^0@Lk5dvn}dX zhn;hjR4V$OO&O?qN5EUEF{Zr5lm)$J8v3{bLR=96o_v~>=&YiRyq@{N3*FPX$9K*CmI(Ew*T*DUgm?t7fBJURLXv<}Zf zOP6yh*qyL|Ii;;)pUqxfj=?#6pbWAZ8!O8`kYk8)zLIB%>6C!`rU%o)|HZChzZ<0g zmN5x-f~Z2xk+*$kftCdNxDNvT(D+7$ur&X0L{CQwu1G#H{WbphVjyYoFVew|b|`kex;WYZf(d*1PfwQ} zhk_iN#HZ!iI)Y!Dj~IpRfPqO94XHd>8;j3m%~2`K6qxQP)^0JIbvvq9=#H-aqA(Jc zQ&_SiVcfl{!n#|KNw$;ueCP6sntX6J*(Q+MOp6u7x$6T{IbtG9&sTlSrWly{e8RkH zdW!4d?e1uqkrUtur)?i$$L?-N!NY{KNF)eTU3ukyhK#>ke{|&kcclOmsK{r%n%c%V=vhROk z4bOWZYJnxI(M8CyvLD ziU>MUu4&&MueM6-O%j*|#B#oVca*jh{n7n+!qzAmKG~_3^WDAvO6OiupsM_$SoDt1 z;+7`je4%*l68({6sg`$`jAm=ART;_FlQ7Na`Ef&5HPHY(Hvo)X1<+zLXa3&*%X0qA z*#&=HgC}=jNvZ)XpTbnfA?*C zwAER`qNI(uaEFfd7O_jH%ngYH?Mom{RChD4oG?(TFd2D1Lf(&*Bymv{yI(k~6>E9b z!T|d6v$z=pE*ps(Bd@gIm@Mq%5_NZ&qWK%*!CUDoCRnswpkBiqF|DO22@)_9lS?jk z{}AHqJ61Q(Zy<6YU9yd2<)YDMx54kCRX=kqw_*jqoK7c@E5nhVDX2P(uZAumvMFBT z^u_Og3BmCW96Ig?yt^9>#5alwz%@9l05&xb0Ia)fVTOp33omh+VtC44VG?PYpH ziS9s`@ay7gxHKWtK|94~Y&o@AtU*|d*}T`@W%uOCwZ&OhC_b%ibe;r+sI%6EM3be> z67+qJMM>OjDJT*oV*E>6tA$!8pObTIveO~D&f$|)|D-ew-hOKjI7!Gno z(%Kf6mRN{B4gC~AoLm`IR7u)Woi=Qa)4aZvm(Hw)`gd=vy)e-I=k9(KUN`BcUK?U4VJ%utH_L6EdL z^NePz4Alv%WJ!JPICOms$vo%%m$r*i<__>$Z^}7|5hoq6iy|PQ5^6@0#DU^%7~rQQ zQrk)p2L%`uE%0E3ci53zj~M~y)b20@BQsz4Vt~!c3@t{||Kk7cA+6{U?G(sF0|0*Y z^Zgs{{kg?e(%IP`!D>_z}xVKF=lvZy;y zg6T(V3`Q|*wl5{R^ud`iQ3|JYHW1gU+c@!%<}6zVE&~L#@+4e7I-;yu0bEo@<5-UT z_df15dI08z@_}v>>+HtOyIOE1InY1DKuG;{cmWin_I+GS)muPNP^t002?I-C9BMuI z=E+2}AI`?**;W;~!&FIn8$s|aaH?)V3~LeZ{XX)U;+?}XBv*u~CjqaDoa`=)Hh6f% zbJ=8;$p>lyxvs`qTJsbT0UFJET-Cv{h+9B?gt3WJqj(q%K?iB8$SlK)U3Srmfr}u|TXT5GKo4P5DQ#sp8`lCLOnQZXP2*KThVv~Jkg0*{ngJO3 zLwjmhVj_AHpf~`P52Z2#N%^YjX5xy*+_piS_7L7(f76oucXiN_0yU0|nBb9%m5V+g zif<-mGl{T%`-X$?D0aR-&p~OaH{Ouh9Auho#)GX#Ap%mfd=4YwW4+4y2bcMu*GBT9 zWnNuDlHF99MftPsA%H%y4n!eBa@Ujpp5tXsb)Xx<{+(=R^~^*U3*tS5<%R2hmqmymh{g37b;3d@%t^6WWn zOtzxb79>3wa9oiD=k#@>TBvmPg_Ya2*W!^}@Y zr1?);3rrQ%>mHo~cBtAbXgD_)pVY&{Lo@Y9$RKZ-)M1gwMfb(P(Fa`8@!*oC50@Yb zg1#>@Us>%fgM$4N=B@s>3lj+wMkYB;N9l=dj`&T6pN=)>9o%@}`h&v#SQ}iPeUG@_|%} zy-q$?X$W3@t(d&PL_J~_zT_k>dg`h!w**xhq0ROC;GMX!8~9CjL9bd z;e_D>l2#(uEXjBS!0*_uLB9h$a^mn)#kd6^8VhAjw+aEl0U-3+RHart`gq^kA8_d% zk)YUW`AW0mb*>__dn}JbA*{#)Gqe^uSBe;41Ye-*Y_0n_pPcXY;{Z*_PjATaQ~!#0 zQKu@pK3COyyl`pmlD}QN9ZXl=9reH{Cw@6?=npj;K|25?iMr zdS=o4w+-K356dQR$$$oqPJz*-RolrO(-K?#gZ0j%Z4h*!ZY4j|@X4q-7Hmsol<`d` zY`?d9>vvt+l6mvn&@X53n7_=YE2#|`S75|CQ#DRA{mWFJjk4VJ~H>ywK!yqpga zm|`PL&_$!nsQWBr1@*YQov*`CZ`^I1MnW|Ug40#Z_%Pk3YsrcDh51Z0#55B|5??e7 zYeiBJ5DHW7YiKuI9I6FY;6W?ZaC_$L-Y~q@wP=1wy@H*0wC8^O>joLOt&z}CuP;HS z$_~`Qe)&g}j&=v`ahl5(AgJTgSS-7SiR^!Oe90WJ91(#G<)*6*o3oCRF262z1I(qm z!?5jlCz$wN&(^oSU=5Fp0}I9hupIk&6uXu>pCp-;;G67d`0~-=_B<}K4TRze0E&hf z=gVbnhBX&Z;+ZXUMIORgSU5Qt;C?WoY|%(n_dS=H^kp=XMkL?~e0}6_5DJw?ur9X| z5OYAQ^5@Ksr=4Jk57)-}aVOJgA%MoL zF3%dF6m)iwO>&-P9yZN1Ig&^HsPBb;Q2k_T~PgIShc=%XQDSw6vtf!3YW2% z>k$(`Tt3~%H{%-Q?sZd>8ABq7K97rgUTrr_I)m#W+icb*kXjJhZ4C16fhBIvG2@tK z>`Z{s*i1bAano>pyaY~$I>Z=e?3Qdc8wZ*|?^eh?5y*P&HnLnaqn?4?ZqlX>Ds4h^ z29x2Xw-GUk97e!^2K&;j0T)MSX=$I8R@LV${L*F=uO0GdEI<3*yBZJsrppDCE)K!X z*VA{TC{iCGG;LoXz+B4OrC= z-8qMd#aLY%aj2>7=2Q*kC^M-C_f_q6ph*kX&v(i9Fa!0Oj&Fr#=R8p}FG?&LEi}!X zBfX^sE{5GgB$?(m7Lj&3iBsZ#BJKvIpm^11BiK0(tE>WPs&io^6}veu*^4s63I5!D zYT|=B_sAT-S16fqb3L4o2Fkx`t~+d^dgls{-_fa`*ZP)t=}p~_d-edQikNJL z^-{slJ;btP_@dPz<634c5jBRlSBC~aEWpX4M_e>M}jztQ>N@UidySWl(K=?4{0Q1Enc)Mkn2=F5@ z8D~eGO|IeSSpq#GM3(^?By@={tvAZy!5G9`9T4S`$a+LyngBIa;aSf0vjG%FXNMv{ z;ME(v@zytcEI&5FJbJn^^FYBdU#+T;M>(H*K&QZk-ELLEbfPrFxUb{w9waxEV?4OI zxcLVF18cL&nM}^F{fwtw%uK%c3fC+ibJ%qVwuHI|{n#nyp~7_Gwl}*urL>e z-<=9a0Kq$OE7O9oBYm#pT5qvIeJ(FUNLq)Tvy^x(cU1f4)b3R=EE8sB6<;nKH0@iCMUMJ1%e(vaCkE@hE z+6f_1BnhZ^F-<9)sA%Rcq5Q5LI|Ed6DnOK+`I-lWlA8}O2P>r3JmI^m0H9tDHlMAp z!@bY>!)*yUR|Rv9Au*6mWCbF6A%?t$T%AaP%~#z=!MTCi&HB4?gIYPeq>Z8lLD;4< zsi7n;hCd{|N)JZWT;iv*NTR}obM2ocCj#McAuL;U^ZG4{^(tGMgvS;l@+Qltq^_b2 zo`7F38|MwaR3I%mB7wsfb^yi&AbHi^U$0lm%FwOI4H_Qy6=~%R7_xZ=S3O-e$&H-1 z8ubD%f56p%zY8ElU09nHI~8K_El zJR+$wHux=3B*;~5_+&ifpX^ak0lqCTP4$&PKSKWHX2_M@7331E}^+n36Ss`Qqqde*V=wHoa23!Tp&te?pz9bugdknn3@Ac1g!as$+ z1bheTM~#2=MFfh#8j9O-$K>EITjO7tPfb{G*2%nYYNZb)Au z9}H^05hpkMk=#B8XaY27VH5cLUfqnfJ#bmWRa5y)n&>SLw?B8ZzxUu9iUw@UWYdiY zW^f5BU|sqMxe=9-{@#M=J_|q$3J4S{+5>g)js+K>d(F3)hSHvm%W$E$f4-*+Gzt5b ziy(JoQVi5)_sQ^JDPb}>xzBBzZ4UCBo%oaBf2L9JDFzieeF)DcC!q4ACIjkzeIQ#; z50?_J4GAJ*dJnd!!@y>h3o@sjHWC78@hMNhv7AzqTr}9e@?pinw&%rnLMxJW1hSv9 z3LZZUdt$V~e$pdTOTYqF-QquP)SLxdkv6<;P;8H#$km`fV}`)DtMY%C>DQ=!pK^91 zfL1=Udh4=poW$rSsL{ zoO#Q6L?T=Jj=x^90t)AD$D@l;>WXJM6>qlG;o4L8i+9c|8E_u)c&+VZ7fepf>$nS0 z3^fOW=S-Or04;!UWkV^|0j10?5g?g~v#o|L)nQ_K2z+x-PVJM5j`k4uxXlT`nilwa z4%fT6bocj5J7h~H@lV^jTgu{mO`KK(do65+F!N?oJr{#gPY=d4;}81*Jp>Ra58e6< zD>qzjK21B^#_GNT1Ql1j&P65FTkKKgbY_`aE7SdebkGM>sztL=3&}gjl$BdZeItbT zZM$|kHSqj&c>gwB_y8A$G`L@!Z(u($F@Dy^42s9KATiwlqL4~lGWK-B9F5w_ugOG8y*?VW9suINmJ!|H(d1b^8g@SYRyqi<-jFCHvV=H?aR>08C?ahFNsn8 zUbiqH`k;c{e9|$`6@eWtH*an?it5#1fUfrJm(x3QgeGz9H_fJ|S@q-3a^W+tp)&*=F*T=9KCcRFU-CxIOR z-TBaPnpsmY-Wxy%Z*@eZnN9Drkn)jYwMs!LPpOyiJyClY$-QTx#XJ3UBQ>p^bhjG*;7N@;M$wur-z$B!2*vUxC98wJpQfQ@Um!;4>3G6O!6XCXrV4m({jb@Ui2 zcwvC`!!91jB)7vCeu4}W+#yg6`^~8d5D zSEmHzL_xzlu&IdQvkA4NyP49f$jC5J!a!L6ko<6 z28&`WP@pSRuNka6sx;^&ZJ=Q5^@p~%Gl30DEJ5ol4Dj7fWUlRMNBnG@!86hOQEo@m z9NLY$v z18nHIL2erwbf0UmHqy60-m-q;o$HQ>hguT98=TSJ8#@3E)!*ewff`EMAj(w*$I+>X z=!sJ2vU0M)3u@M`=N&zqC#gs`_Eol&<#=0Ry{gf8Onu_^*6)E|au_2Rw;6%^;Eg68 zC-C$a*L~hn>@;j@!vSnEdK&{PqxZ?U_8z_mZ*%!dDO~Mzzy3E+ZN9uUtIO8Z z8F$Oxx}nrY=?IZTxHaI}U|`SI-5MAm`QRf&Rpj#oXy3{J<;3B*^5B8f@7wUbILu~i zlNEU&pu8w8fWJB?>FWH+E_asn?kX?P@fOzs`tr;FV(-nvp>F^8;rlLHP)Z?Gv`|@# zY*{Oz?Au@%l-)44?Awi`LP*FSvd@gMjAh1>gk;My_9fZ(B|F3KdUtPpKHuk`=Qy6@ z*?#|Ybj-nczpv$Wy~?6o()=Y}0|^o_#hI6w!p0ty+eQKx8L zgf)Qf!@EE&Tmjq(t}ox&8HId(05?xGe+rzNxGSOJ{L5Rwex?{;Jhzv(I`wSv0A^!{ zeljiEARpKxJP=9%NC{Mf$r#MkgNR@SNJv4}+n@o20VzUwm#CKmz|Fe9CEve7oLLo} zh(F^-27d)&VP44}?y4I?_Km zYnIOmtTqZFl<(YFc79364iQp%?I)z^-{*9Eas0X7;GpX#wbFXX+m@db(h8sHBf4Y5ufCAoFvr?Z_sO9{iLm}zyW zXD|@ncc69KAp@oFY3y{|xg|fSwgF;wxh~x!$n>cNpZbRv#gHER^NVZy|L!a3?^5%Y zd<5BEq-Oc*Y)|`ZkU@SC#S-W5Y=Z{km0Y6JjG1u1-ThG~9uyD#fe zS7YPx8{66ZN$##&v}*%mMA7PVA9W&GF8XAyr&d=1>>kDJ!St3xDYhGIXG;L^(F#4d zs12OC038)g0`gLbi$-OCE#A)0M=H1ZCs5(_#h52DZ7SmP0f&7l$lQ zb3-i>kDaBuE4%CpQH9_`@qFq^S!!DDbZgZ+5*M?HU9l?!rNDxsafb=vSNy|w29Z0jUm(@cAQLs3WCVdcF z7^H~$qfVfax+4iFFd^1`pnYqbc0%RV2Vs||IPvMsRO{hS0pT;}fSzv-v^k;G|0X(O zJ@|rHXIEZ@-f&x~;{;8_>42dT(S7Ge7F!rY)pD>vGw%2q4w-2MfmhFo!Loxd-17m2 zLuyz>L?pX!TGu>*zDI*cEtW^{I+b1Q*edWQDgZgahOQRra@O9b2gw+q>k3zLb4mn9 zfB)?ftCI6Tq~+cA?)3$+-nTb2JTqa%J)qSp=PU-aq;ud{3MuQ1n7s9_H$6t%Y0t`y zR9dk)&I0xBFcz&TOdPVkt-vV;b451z8~bL;VtW0nuhD!9byZf+`{Liq_@^~z^*H-q zzE8e+6P##JE{_vk)&cBK)>=n*iSWa2`&!x3m+0g-K>|aZoR5qBEXQLYdZRU>O(s-N zzrZYn_6-$7EBhU5$_1pEYDiZ?FV1N2cQQI|!TWa0B~{O72oz!Vov z-O_)mWaXP6?&jd?m_9+JL^Tu3cH_F(9UVy!#i2Bjf;D6Oc+0%|(#mDwD*mUg z{TW->Of3=NhWDQ(ZrSe3n^Zqir~{WX;C+*hdUIDzSO=dUc|(Jv`|SD>5Wg0Jj-FVx zZ6o094H+((Ko5SQ-jqn2NL?6gaEWH|f3e3$3+!$fzi`%i5f#05AIL$5Sh=U8R zrar4JRo@@@oP6KXM#a`R0oHi9yW-WSlkb6M;$0`MztB=+^nC1NSn?%(&`1A%?W@{k zhx(b;2NA0lO7);rklMn~e~t1d zxSj-vr^?Ei{y4uS$Q>Z|dj?3^d-eU2r1=9sMp^*9J;I}-G7J4Kr8a_nCdR6+pgA3$UZ z%uSlu7cSYt)&V$CCOj6r|HD6|;Q&u*&nA@W?h9@JeOmyqhnwwJrhTyl5K;;OgpjV~ zgs8z`o@IFgZ&APAKL~kDDF*jxt6dv?#w}zE7V6aJ{xi01JbWnwk!N zhZ`S&>O3@>52&e*eSjv10XpV7^K2%6zU)~>5B*Wj=?ww*@J_G0q~Ng)H`&XOq1&;S&rS7X%dLXXu(Fp2;ij9j0&ezVVV?{F--&0^yux)ym zCxV_+6GzAXXcouEaBUxw@|*9<8HfRg(aHN%Y{KAV%sbP8nW-~M&zI>1ln2e`Skd;t zM<>u)mF5QxtZ=Cmx08aHi_h}TkaCmSc%m)OaA&9_%@ctZ&ZR?&rTM@LZ9R0iM6|-NUvMr{H!@=iB6i$m%8!&U4d2N)OHd z5Q=8oBQ6^gX-{z-1b#s0T6+P%FFT{LKMsQ^vBU69{VH=xMjKjJfa?dx%EPobZB^IT)Y&7aLp=7QkiPdga3=M1QpuT}MICK{S(@s1bdCU)s3n*`r8M^ugMD#c z`hD1OKxgXBwT*c-@K^(Yd3F(NXvc{4o0ckWLNY#-p}|vn{6NEitqw$+ z^BVN=7mi0!0yW$Ltu2scF?_Q9y(<3{j5&J0wv7rzTk6L^sYd-c&AxtLB>sQ{IP)o> zll%Y9ugo`}{N-B-`~rGGMsEweVISS|t3SUDL_s|O?X!l+gLs=hq2v~&@owNh2SHz^ zkdg)nU3q_fsD~=8fntrjV&Ujox5>1*`Gq*e0S-rNey6y`yi$ywSD=H3HGyQ4vNzbx z`d4eB@mN&Aq8_fme+=Y=vjDO!2B$g+Tekf58AXKX8ejtyfU>R!)cfYZBT#wL5qt<$ zfXVj*djW;d3R<|oJ_NRsc@T6=%~uxo&D?6D|6-gXc@}LPk=1ANS}7eBAu3etq<5~8 zvA#ovzm8*v_VwYv7CUGIoU1&%d4W5SmKDY7x#$aN(O{(xrg4JED1cuz?YRK#7pj4k zd_LdM=?A(rCiw_aXW%di>OM0uFbEhBM%OC$$Sn|eYR?b|->ktNUIWMy9J0p+?ww7G zrKJ+EbqC-J*$Z(QL9tUJH341^3C0n>r_y!Hy!rf0dqyY%@H#p{$o(?G;W!JBXQ*bz zL6$S1iWzQk1N=HYpuL?1N|Lo)x!`k;bIX=r?ajVnSCEwyjsb6*l;C8Int>UWN(jXe zz*Lz`3&j|>XQ8g_h5ZxWA0GeqBZMWR(b(#vtFiB5H8?stQkaPii^iPxC z@D{~!ogM@4%`wo4l@)_HE#&EbfGfph^^HQ!ZT~^gu0jKt5*TttKY$+pC}>0z83Dtx z1CUzLUwo|cJR##I^XUSY9#ck$8tF9Mabvl({(M~DR%_rw@c!xj^}0{9`@TqBP5djg zN~?o?|6#+qxoYdaRvN@lbNC%PdViH9ypSZk2q3GyK+|Leu=EVuG|ew}wkA{O{HS>s zd18ly9*yhZ<$w7ogEbe|4BnPSBWIuji(eM*dIe8cWMchzyIF(hGaVCMK<0h)>*13kY&+q*Zv1t-n-fV;9;-nXvK{Pa;MJe3dzwvxVLkx# zw;1wb?gY{Y#iY2tzh?5+)~WBX;jbGnLanmb&*e?Qieq-~{$sFA$M9`PjB`s&DDo>W z_5l*fIiR{>uq>u?B&pna4$is)Rg6|-HGoEV?T9phBAJ3%;|b;k59geOlx4g94_=*J zLKu>sWY^pLh%|Y90U&e`RwD#_PWDd6mP`Og6^K=OOCv0#;(7nYoLtO3uuY|Gp>r?; z;5~`94^9-T%laf5TmxHuwV>di-IjCb>s;QihfmiV$bNnOuLv3@26DXle&=a5F|I!~ za)usrf>IS~$E@%gE~@w+HC*-Q_iN+?cU23j&4go=`RkNpZ`T*IWyj^dg7c9$b2@bc z`dry#i~%0vF|;bUQJ01N7<=_0PgGCj|G58i78FsTO2vex`60%Izj&q6orkK1fJn~F zM)Uh%4^x%;2sOzn^VXjtIiOIDTlhyL*XeK`Y+_8x-7rL@cljJJ396{Mw&96~Ws}s; ztjioNH+hW!=l#OkHUQx_=8KpoL~MF*`&0rEtl(cFIl@&(G+dTM?+pAsA?G^13eVC# z&w(KDI#05elB}wNdH-D8g0uhQ;-2(TDf=r$^8E}-hnI14D_5ZTE=b9CQZ0z$RJF`H z9YDB$QuMR?`utp%TgRwmtdoGan+hsa>o-+ZQa4b^HFezaSeyMaD#6T^!SrPHs0YAi zc4l#RYoLdFdzM)crD-hcQKE~&_XiR(yn!)aI_jf4ChEKrFQ8mAQnDh!1g(lf_@9($ zXl?Lx8Nnw2uGE=&Jm~DxAbPHGLzmg^TmNUaDTu<5B+LT@A+q{qsykHz)aXlVk zI_}4GJK-31xsDSqpyB164&$lJ2kdBBNe~zTR*?oTeD)BiRmq}GD$AYanGjjryYzH` zq8kNRS^or7gZ~Vu{yuWzf2Bau4j{~o?l^yK1<#*qt3IQZjaSD+Sq&(BxC-_Jbt1Gg zf_knw&fcm!KjIIxa%Xs;uiNU;t>e%r1{414oCINeC>g9G)0Fvc*sDMp#A=^89rW=#ZWl3Cwr%md6_E zw%;i(u!Cvk%hAkwlSMDm9{9OC?0*g~f`5jWTe}bQ{&p_N2T}~P!YMq6a?V6=LKCDD*C-$`Y z>rVv)(p8F`X1er1k%p0ZNtf*6de8!AH1{K@k*t?~)WEV$9wNWt9`AZ@oZKyZ3-B00 zBcKX_CEugu(kq%h`CqEJ&O^{`2LLA0sd+{3mHQRF&h5GI;VDit4LoqmBZ46X*vaY} zR)Jgx%D=a#bpUS+<08QcdVOOomFnZQ{UOk=v5o^ff$gnqptb;C${jiV`ajB?%b>H% zp$GcvmA$}CFRlOlO;BKHA@90$^P7I%;F!3#Tt33TuU3<03!u0yV+)4vM$ZWt>Fsir zx>8g7z*R|3#UCR~8?5`Wi_ui+o0h=GGC8hL?*6Je<^v#?L83X}{{<^^wFj{jo=v*6 zet;@Msbd6c9VidV(J#%nd||*DRd_5aTLdZ$0j$~v%TiC%L@Uhyz3+adrd01Bdlbks zzaml{6PX2X15Vw)s$L=Daj#?1SzAuy75gf->mrBlW^%(nyddQmO0g3^9_a;juT%9_ zno;v?k0kJWL3b8&tEI>oRs9DRQ}{=%rq$GaKvvB}YZPN``yXw6rre;gr03S6wJPoC zjdIs)wax>nw&@MJ+^W5Oe^Q#Q_z+y(1kgXc*R&JvN32*hebtOdU+cX-=V$ucDaFY% zWiZnjDZGhQdBf%TXv%|idRXK~2H{5K$Lc&0RwY!-xrIKQDjjDUuGsje-PBx~UPlX> z{+%@ZsST6PKLqA`B_bgGK9^}XC&u6Ow`4{+Ar@C7{}!X?IZg9Rdp&Dpr7JF6e%2H$t~{9IwzXbpWNDuowW?0kHIhX|NJ7 zMrJ`9sR&{vL8iQWgWxfY!KYXsK-+d9f}W4S`H0CN(66h9{ANMlB_0o+zqMLmw$ikL z0lGn8M~HIx@`G0noy z8y^*(=fyyKb7VxPN?oiBRACikKcQL}C`8RgI9eIqn7BbDVGgMSD=8?aKvdvx7oFWl zS_MNqD$i!)mqy5j(zS}Qd0@~|2xWm#ZABvw8JtJ}-gSCs1*B7H7XR7!Wm}iB;mb+4 z#b-t_M_C@=XJAwW5CVN2BcXqa6b;v&7ohxjYv;HdjvHmn1$S%*#Um`i^rJyU zKfSl;?S8Q&C(#d8aR)YHZVE=Yh9+>b?ofFKT`ulc#apq1rAfd#-@zvYQ=l5@h zqT|pZWu$&nEhoNKr2*v{$Ws{xa==V95rvuEa*`0O30caCL^$_r+-Wr22F>3oJ=fK(07e5G=*0D`^*gGx zujz~dE>1DvDaF<{9yudW(;I5De+w?=N`F17z;lD{>2WO)5NLKEESEL7Y2A8{p?Y{rIGRHHz8`71!gs$4wZW^K%Ho+6;K@z`LjC}LCseu13 z`GRZXBoqJV`SNvxJ$P3MpjSS?vf}y$xxJ0o*SgkPT#C0ac-!K_IC$uZT$nM>8SL_kRF98h?-|D@%@j(MTEsX65e2Z%V1zsYF8Yx zXnpQjf-3MP>h)g9Cj&F<Tl8qKsJLfZOH9O}5e&|TiP{6P? z!sGV6=bn85u}&yIRL{L8sRg6W+`}MlkBQlpC^oRfy_DO3@O|->{^}BtaPzTWY3JP` z=bV?ie!N+t7L83fh0BP?f|9n&qxGGj*FZBMED(RQHt4;_1O)f-(rh00c{&G7wqU{K zBet))=!<|&LV6FRmTSoV%sDMI4L?k#DN6F*%365MjI1=$L(RKQeoJ-+r{E@D2B2m= z-!)?{s)&xAb-dK^3GwVOml6=m={!IL0?^EwS4Orr>gyP=V#WczQuiOfA4UVU&+a!s z^V&Qfbo;edoy8Hv!R4X|TA*oBgQ~~W9^Re|IPS>Ijd)iKI?VklfBfu4=02$9eclpD z`pL!}Fx2(zPV7@z1(U1lKPVf(VK=DKo67!6D)%mfbXA&}m?;-h94tI|vv?hCs(N<* zEDims0#58$t9}k9>1`%ZxOf+T1d7tcGYK%BiC zc;r$C{@K>8yu9W*q5Wh2f+q~*=!2w3$a_}hDu^JC&HDKQN5>XO#tz+Xl|H6)_O}8~!bwC6#J2#gcj6Eau5AfR zv}?SN*AIqgr7ma`R9LNb8DZ2Zjqy)-K^N{mms#U~DCPL6N8b~zlZPIREZ$aDiI^&3 zXe?PD>3qDhZRMFtEfDT?hRJvnuyr>aO$09~jeby5@w4{_UT`Z5C8h#9=M)e`j=YB- zKC>84`K44!GU^wIj{yeM=z1wQc?$Zk?Z~3$doVYqq((ARU-wSKWverS#JfI=FV*T0 z=JUe6Qjfu`D>B7M|REC!pxrE!8u)>Kb=oealO;@xZyGxpkjdWodGK zsO_-ylEr_1@TW?yQ?(=ZMK9m=mxVfnmo5PEjVk!Y90EVXuMb?@7rNv-n8SzDSPg)n~-EW}t3{?Bu(qG`Wmc=(wkMv*$A$zAc{z zmT3d3^2cY~0TX4{E4=AQr3Aed!W1lx_h%Nb4G7Y54?OSQNKzTc|I@om^K<$jm{1Dty(s3rq;x*Hi>p?+JRtoSE;t zL1ebhypGTJndP$UCYK_sjz2};GXeH9ibykF;LPbliv@Wsj(R^=j4kZGZ{hK%Wsth^ zdAjxhV$g)zb+w=_kc5#<#CkJTdvdh-q_C|Eg=C+*r!-~~;7fjVh4BG;Osk1A<5TAP zq*8$IT2U2%q7M(UfsH&*s@PD;EsN)!pU}-|-y!kohB1)G4Tm&GA|N`mQkBxk6`(m6 zW=*+Go%0IF$k9?a<5PAGC01L*S>6o?sr;yGddfyl#~s_O(eQn>U3jx|O}vC~HK} zHx$l7-|3eUHc?Bn#jeVH+v1er@1|)fj*kA!1rJZ2D17i~-1+ncaMV8leDKJYJf&E&`Sod14D??W_@v!Bye3WBZMi zEjh!StN1g`fooi#CUrEyy_PDXs-j+!b1_rT3?#muIggd$ED_|!#U-nyjyqw5I-T{b zKeA>tgmrW?NjH1m#CgEDva$E;AaXRoKqJPi3x|!e*w87)^dCtWZGj3i?O%$xq%NGAm^38auXqDvhv>3H=+{1VR4&N1zd+wkFvq z*tO}jVG+dI?dyXFJjksl5^GBZ!)sXL0Jzy3NKnHzp9OO25mal40b(`(3pq; z@q(kn_3i!bb?Nh<;yr(U@Sp_f)E9`zQhwTF|Br%&^cfWOwN=AB`wt;d@y-Igy@w_5 z=)REwZ~wo)`u_m~!j|Sg1}+~dU^JpVFllT_l(E9Li7iPb#!|11N{zil4_wdle*}3< zafh|>L`~`E_5a6@8v@W{=gqj|eh3WM2LVxBxpv4LIGaimVZfD@^^g; zsiOcsgEyCYhvFmKrt|1Ch{+UM>olVzi7^+-Tu5ip%N>Lcv6-9cf z4&hz85~9gMPm)qx zda`muORU~0CE|OPB?^mHORd%u+<81j{t1}U)5pNctY2ytfmr%>j%BN^h=E-z70x-+ z#SO3_+a;dpxFYM2j`@d2yNUvH2M3&GM#l6En~EfJm6wtPX9JpHDX!sPCYG;?`tA|e zw6{IBvcEj!703Dl<5w*7z{mYe^DYy0YL;sRW{aMXWcwz)-yVBJqGF$IGVtibVk5=$ z-yDzHTuJ~cR%FmV+NK+Om{65NLnp?03v*?5y)xQ^*r~+TEr?+0yR@wtL{X>2D^j*M zpg*(SDJ9h9WT{!YGb-z>v7Wx`X0W?3refBMXi-_oh+ka0MA0DriHz*!+-`BI+$uo0 zKe_K=w)iw>o`Bu`@ySDt@!UuxXpOa&l#v%&Pck_V;Ov7!k_cbDnF>B%^crDpr#(gD zjKaAr*qWa}M!%ko1I@M21&S(ubuICKBgvOv`5m9eeRXF>yLPfRKssyH|HB{tzD~} zyynwz*w%K&Tjqsf;F6zd_uNSG&$-^Z+8A$i$>)GBJ^kXT_ouiIAHVo7z})r_0tu(_ zaTv1OeVe(hrp^*)rfu{>h3@mO@0YKYVBb!wXElc+)^Z-J43(KL!qVlU`K&uWj|n+7 zGwY2J`h>FdI&Ui%xQ{hPlm#c2eNsAA(0Z1e{+?!Hd79IQn*8edNVH;BN{r-{vf(Beae4!p$QQjH-xAj+)wfs~ zrK_>NDL1DrF)lh{(?1J8yxy0BuC|i4*HfD9i6wbjWz{?x zRqEG{uh}ecd~_qOONRd(=g=8n6H9*hN|wN|p*w%{lv5fk8s+8l!zrivVbGX}wt3Zt zaflK|m)()fYfw=otE4k5r8g9VV0nul=WS%wdesKq5GmBdjjZ+hzYKMqYoV4|kH+dM1srxWM^Q zAdT9n*ri>WoEz?nJumyatj{xApQS%a?*8ca*u^c#@vL=WJ-(GwJP>#{xIAjO=I^mL z)au_iNb0T<2bo=2-cEEo@Mo1ZyEzN@y^-mSZt?YW`q!AjUZ5o;A%ifv*? zEHdx5{SK3q#hp|>^Q=Y(@z~$XuP(7g38yU?H`XFH9^!u)TY5a|rT4X!)K3FgmQ}H# z#=KQ*5URvtc4CZIGs(xAyg2^lCjh1=su{YqXhT*JUV?5U$32@1rNRj^2tSXL?Yr})N ztmR(}OS+04RGw}xsb3fp{>Wq#`Z0F6z*_4imIE)7O-y}+UUD-|M;Er+vJC6p!>gn@ z)L?v(g6cC#@D|P66$=q^>mh{(gKH~86{fu6rNL1+)kQV8@$pWk+S$zzwY}|?2}*Ce z%Qi5DY`CT|J^tLhOI7GDyjd*0g7#IFckGwRj=k5o;{ruW4yjVpdW6m!ctWSN@i~ zp?}Ti-J!j3ZQ7qLtRo4x_=hq>%Zma`cQ5CE}g9U zz$OCRdyx4v8eRM#xuv2Ad4@Q?QtO@c-DlXSXPqE1yHznluH;!|yKZ33xK~ciA=kEE zx~GJBvKvR;T(^Jd>7b!sG?j`YJljoT(c9DvMH34-)CH%7-0y{gR#JmRT+}*`Ae9l7 zT!XeveyBc|Wy|kpJQa-4ElOs=X@obRo<>cV+18xnykKf0~2{MUQkDkZ9Sa8Mgb63MeAAI2Who z0+KAiX0WwGbvSg+&KMNt&<)HTlg?Ozi6K< z&tp9#RZz(qH0ct&WvJ|*Ry&mF`g5VewAdrs-FbnX=dyWkc$NBHm@n*subQ!AY7jh5 z5Ua`4lGZ<}DRp9Uv<`PG& z|GeoGIIum->M2~)ploF#(Y)o-^TxzKjYCJYmQpTq5Q|?3zA|H0^4yN`n}>e!mx6l( zmuU$r=5e=tFtn!^R#1$(DE8{({Xy3d4c*n)0L8JHYikARt3{ZechObL9ruxXNjc8z zN#Tuq%@qwH2&WMQiC%XY=$=8-e{!c94;1j{4aW{lh7mg__zVl zoNwq8W4y84k%o&Z!No2W2{WArJZ4fQ9_U#P+gDn$B~c9;yW2#coGx}Aj9#=)B@2*u zZ6}V@reU4;lzU5FzBeFxVFcWC5)J33>KEa*=Tu`P82N__bUIJEnV+Ebc2;!u=U|jjfz!-dhQ)e9>Pa9 z;+-JfN%uTw*Tq)@vxU_&8^wd0X4ut9sX?hO){WQ@ft-|E?UE8*&Pqb^lyhb#3wCsG1a&g^&(qB^pjRTX;6*2W2Xo&U8WOoW4LcyG7abyBl2A zk#Ua!wC~DV=}jxus_I&Ifr(qJG)-f?gtt3yTFmprbZjr7@01S)4xgx3U0<-n&F=cF z>Qhf%FCOA(fA%1EsKBK$$~Hl4V>aR>)+SUxVwLvyVHioJAO4=%Ka1{Uloc7q<%&*O zO1JeC?VBcDH@%-UAfznR>23Wl;Bs9D8nqe>>^@J^dzb`%zJ_!7J>v}74(GXiq3g|h zZBbNNuP!(Kbi6Tk=3-{baae^{zA>)H#aPP)7TJHKfpJf`y+uBUH}U>}iC}D@?1QS5 z0;HPOF*WIFm+Hy}>z(Y7WmA*^eOZwXl1kHi6tPs9j*|wwu>0L z%4njNIQEtpWBm6hF($o&Il4}UP68!^Q)UiYZgo!8))P_3U-AwcF_8^6@NgOudG*;j z9+DWad{)+r-@+v6OmH(ETPWQanlBzkQYR*L8<&u8Sq97vq@D67;FVZx^3x5hU+n zhiI1Qo#l)IPewD7tOCZ2@0nKql`viFn?@5f-#7bS)j?Zm1S zi`^4Qv@`(liz>CdF;&ZD)fSWP)UYvTmA@5#fu0-BfXopH+)yBFqRpJA9-gR$j$N=%~+&SCy(Hhg(h-jg2mKIy&Qnlr6ryfGc}sg1!F6 zM0`JS0RgExa<_bxgV0*ShZ)Q4QE^oFoBz-&eE!oXW7;9-g5W3~#O=QJsRDewoa*vr zooRil3OJwojIwu+t(4D}k$5}@1M^n@?rw#D%LUQLr3s!5MN2MT1NpRdtmiyDGuLR3 zzRKx0;prki)YEi0&yB#9_EVmZM0e&X7S*VqnR;q3b^fY)K73CATu-E1$Dh;Er>& z)b*od!4vtOa59J5zAS~ear$fjAimKmCI0<0|1tJ!LMu{tES?)VT|xEW;>#DzetS(H z8%J#Eq&)|JK3X{;M6JxYu69?SCzX?;p+vLnpX+eXx)n87seX%uko$;PZ@5Ou7XDBcZNagvSIgiR>f=M>g482^)GSX8QvZ~nwTwZoH zv7$D={l;YpnXW}&BeDynZ?}}pl_89aN;ZWD_9QRfk;*?}j7EK=l+ZcSFfQX_dt#o? zRa0J*(X44X8=E=(hWRZhhxHb!rQXUcu%37M&Mwv0NQuN4=X_mzuGe?F^&U=9Gno8$ z<>&i}9hzU`&m9+>{q*kLzqE9}xONbg+*z%om5zD_*H%H8gwAWWZw+lMuuf1%qi|$> zMoseXL)A`q%dI^aJ9H*mKk((j<$rSOOmE$`Z}Ll(J;^WP+RZ@(x}KvE$5N%zuB zZxIO;ac$CN!E3t~~T7{X) zQ7CNA3<|obtSmF^-cQ}lcu(5xXWjWA6o}6;YZ>a~sJ;jdfMQPX>oKlK_;$JuF1OZ zv{JgRu6I)9D*s zBfX(pD4qAk45-r#(>>!Lhv(V{=W+PQ2)Tqfm5yr{zc#WbR`EE|C7x#&FPPQFrsegl zrHOw^3U8mFt>EuTWD*}(vodJqyOgq&v;>dxd+76YchXeVuVu%kpI>a`b-1K>9eit; zs*7@6ql;2|;1NA@j^>x{@{NpE1++(tTGf=ZJZ`6+hp%mbM<9ici{^o(_{ykkSKCe^ z(jHcR(s3Zg9~;|iYJRj~w&KimZ}vmCl?$ke&N$Bor|Qnx!r>JAVmX9BBLji;c6Q0a zCN0X0WT!m`m`ioJPch%>hD7?)2@7cJ+xM+Y*d=!sCaxDhPdAGV*|koX7~l2j`F_b! zX|L!=e=i5!&ErvR|El1!xBvvBuC;-tHl!^%m7XG1N9%-vF&k&jry>yw4YniETWNQn zm)3k2MkRf@mh&;+lf)r5*EwYKqmd-3Kj1u%?X++CT0#F%A%5qkRo;N0QObg3=3>@y zO+Q_|)lDBo{m0h^#r0L@3ah8P@dy^8)Tf|QhU663?H~r3O2^2phtmzEdEEieL{VS6uLe*w88H>4V40t%Z8{KAR8w?qHsaabVd3t@|B%zUb8(E${U=Bmk1toyXz>n@XkkX+}Rn|Snu-Wo3`U@RL1UdvFitF*Nlts zx;w>~AC;A{*3*Jr*&7+#ryq=59kLt7+58NadSOD(?eys-_QBrgi+J;%pY4`T>rVs34#%OGSKgRM_#f*Y9@*u)o7_@Cb}Nl|3Wb*1e^^t# zZ|UW8jI!W6-vY8OVzo^D<6c}fxG_c8vTQVfjU07CgVW^ld7hcmZ?myusLkw<3cN;N z;p-1k>Bl-h(yVEe%s5ZTZ=24x8AbSLo>P@pDxAD?`&Q^H0@q2OsXxB_SjlTnTlAQh z@Yy(Zt}IuT1>K%$L&a!?u{mX&0IrwfIPSh3Ct5YkbW!m4*Bsl&YkkI@a2?#a%nF2F zGTW(KC!y*GrHsSa>eh%AK#-4VU-+DAyKAgca*FXR*)GpMB97FJH_6UqUy6y->l?n1 zO-YowI6|o~w-U}0=-!lSOx|T~*o5Vld#x{hryw6u!q*LMU2~lpYG0Q%cK1(VJ!eqi zm`j6vLdSjh!avZLZ^v1AAb+)rpYi+7g{_&J%bnu>;+hmx8vcyj!?0$Pjza(N!Ns<1LP6 zojGC?=V<&7c)UOiWjmy3{HCK9~4PhNiIW7p(-o1#Tw^ zQL-}4j%#}PcY=7JPsg_X-ZER8 zH+(Ae$KtN8MAtd|)I6q z73Fvuocdk(q+Y?b%^MAojtnRyrb|XO5+Q8;FZ)H>o$7-ZPBGG|@*9t6$}Q*NRc?*3 z!IA@=BTz9=H25K;LD;ll9We98tN}wxl zqZdL{cJ{kuANxixq-FJH`!91)Urk2&DWjO_$U5@DXQTu!ow}#2e31uTM5(|fkNKyx zFGlY(?E{^hvlQU(-_4}N9=vMgI&@RzJ$*O*{Z3fN*i=t}&M{>&L&=f9SL!cu&3ovU zN^1Kt`>BHydKZXS7@onuGyk2_{(5U)=!Qz}&yjU$`@|=pwM2OrYCl3+Mj&FKtcv-M z7buhF9DfT$5|9H2P>L_F9u(*qs2ek3!$-vd#+={0A_izT|1Nxb01hLbsIo=Xn z4w4V9wHWQH8=si~nDbkUQ@pF<$D*rJi_{JdSs9(`yAG2SPH;EH!ztA)55+j6tT?Uc zZop3KNmq(nd2_&W;MlCH?~|HWz~z^uj>=E8C@iFks%qjg!ou-i3%wi782O8j*e)LQ zsJMCw7bI4cNga{)C^8@10iNdho+c9np(DckaM)k1Kj~$#Hbzf~9whvSb%IX|vEHbQ z`$y)KJVXsByJUWFF}490*qBaIOVhy>P!E<-gzzZM!BqqYpSBaWO5F~uIW{-2aF?IQ zA6&QcNbo6KTT1vKsrxFhwKY7M|g=o4mw#bnL81B_yP{r{E)gmE0Q z1R_V~^3UTu1`9caCM-P~bcTCi#I-K_yho?k8C}zs0p>z_(^+;`mkWM%rt(XjqORo` zbM$hC=r*rAGaM^Ol2C> zry)FN33U<6v~`lMQvhaL#z{%;2ECAzkyOdOvbe@K!NPw{Dq8?$n~)BwyQJn$yl_WU z?%-(7`WLU9zJlVy=A!JtKbyUBMcbrI{WgM27E(L0SHvu+<#4WIk@-=T^$Dh*TX$ht z#XReln8}moLlR$~@8*5JQ;dC*J6Nur5?J69ORe9rt+MUDaXHs6a{Hp8k6FY$9=Zz@ zjt&Aqh%o6`?zS*k5yxG{e=U3VZ|zjpbwE5?{`r`CHvedy%yeN1^4893&0%yt(mq)G z6Y%<__Gf>^_;R+wvOP*(^@LC&*=KcjK1h#(?@A~|!!b&gC&v_HOM8_oZJzmLR3dr$ zeOfjU{KoN@`;>&&SZs%OE558*!>bJDdxY9|S-quNP}6(Sk(_Fu4IHHu3sJC3?UDhO z_eE&T=+8MiNDcqA@CkT?haJHr7Xrj1{BOjAjYI*4&S3eY#rASnfb-X6yv>&vHASF; zAa18HIIsCk*I-5fk$iDT$k{c}ifK(-yGQC81~(xUkE+}&@2_+jwm&gj^wYTs#|o^t zkMgBZa3~s@BCuqVt=DFAk@I&0t<*L7-865VR$6Wk!CZ?4sczo!<<*ukBk%6V(8-c{*U^Qy78`SjxKSv1PQmChUj~ zL56RBPhPXHr0$_?`2L-Q6xJ(FyyEqxL#Lq?OGL(~@9o+v<7hs(2D7WG`kA7UTN?m*o=ZoE?lW_`lJvasZu9p(mgC)GDB_}6)w zIUVv{ggeM8_z=F>yQ!`7@%kes!sd~#1k%W4J(u-Yv|zd;Da)YE8L1=LP;c@m$Vk-J)CFZb4hEvhL%pog!=`YJq_sV?E_l?d>|W=-3o|$Lfbe+#T}}47{K| zwu1-B!xB|69a$_IxPBs$mbJ1GmfJTw^T9rW-}|RwJFG{<ZR@V_)s51|*M3XQEUu|jkRHUMUUDhRy2buMXy@N>Eur{Y8%ny#i zdU5CVK(!#7AYw+t#q&0x&$N``w)ENt@i>UFk9}F9$x>p9;x3s_H?K;?052D@+?lyn zw0+Xhd{NwU-d`VyHcLc|l-<773HrzVE*ZhXubjwLqI6y~N2_JPn$ht>JIa2{$9i9>WTuSrY-0Rat6^(GxK%+BK zlebzgY3KG3*3%U|wASvJpnt0A{M(gr#9@x^hNR}@-|f4p6Ru3?%o2Et#a!ZYrr)b? zK5?$OZ){W5W+Sj;B^TmDGEt=ZKt+^DJjWXIf`BGeAD+G(i>pig(3w$HcXEFk>*z zjJ8~ey-e@u(sCysuh#PrJla2vpfK8;dVT z9ws-$cW9JtNquaR@fiC!$dR_67>YiGoBM$qof4Ys2XYNxFR_iACVe)6%m z*2e>@W&BJxL=gAUs#$YY%+a8?cVph=(e^*hIA6^(ph6Y(num*REGKzMtd%;rh^^v! zcOhIiPsPW;$SFHAKe=Vjb}Ll~_VB7sHlc?}qabqw}4L|DX44D6^h8hWXO6|jDKsww`8I7H|O zA}5vOo$eTcoNe(YdVnRmSQHy+pQtx3lcqoQWbMZV8}tAwatBG~JJ0#%L=>UIfKQp9 z1e-A%^Fj{MF<#Yzm%<8Yw+h#d>FJj{w(xqX%R;qy?2$`~!^`x-_DUODJ5}>Oa5~xb zVrLJd98GMApxvd17)%^#bmEay*PWgE)NM1XavHz1+OAz8R19E=q?z`cXVs`V6?T)s z-Rk5`|B6^+J}-U&4OMOGtgoi?fuSQOGpCYf2(QbBh2ws}MYK8&<(i^8#^6q8I)co^ zVbKdln=BVnS?NDX9if zzmv2u^+T47+}jnap|-l$$7>}{`fUEDp`)snsac}wMoug*hz}45H_Dn1%dko6(ZHB* z9hSOY4@|LU%NCbte6sgu4XcauvuBcDb=G<=4_L0Xe%q8RyzcoKjv9rU$3DeLUn%Q^ za9Fv{r5RVwQ<-|Rj;xKiTyMR}!)xur3o*mJPQjl>UJCEc>m8>*;vPTH(Q%JSaXF<& z*4EXt%+^~qx|G3%ijz0IFoH!b8R$poTt;=!8o(d;i(y0;PK~EY1A)+@YscAXa7>_jvI<7MJSK519kAKVz zG4zxlzP2_0ae8fgYrw;Na{0Vuai=aR^tW<8TT6Jl+=B=s1o?{&%WfC{-WCKUscnQY@+;{(IzolXoCz_M1p#&77(r@OwEW z974{ING*xNm_<2+wI$5?kV6Ma9tmYJ5iv6hGv=@yqFR!}jOLh(j5!~NeQ!Na^85wg z*X#TG?x*d#@6UZ-_jSMax$n>QzTWTaNX2EW&FhZVar0@6n#p8eWu8foNJQ4D3QrhF zyBJ>I8A;Mz2sgOr)T5&*E--u5H(@@uRqkM6~uGmC9WTuG`v>V1EZ-ju0#L zoe7C(`1Y`%$vZ+trF`5$VDd9&Pa5(%VtAMzqOH&(8_tqOhr1IB(CJ9u_25d6H(W@4 zlNo-hp-zHee7iL4_-Uv|MZY%cW;P{vb>h>iby-b`HFJ16sxlDX(n3M!vi+K)PNyob zegNJlFN^>g8*a2$&45_#%Y&Vc0gqw(P4c6g<+|+f?WUyjCdr-?iv#q?gHCdEX@)y@ zWwz2+RC_i3Q^Sb;h)6jZgvsO7N<%sa@L`eWV&J^elQD-%;%pzS2FFg*{T&kL;c$)w zjy4+MGE-I<7}8T2ws7v1h#R{qQdc#U-x~zpnagwBe3W#4bvgL8spRy8pX^mXcHhFE zOzYUPc3129eTX2HYL)iI;{3_z-UYH-O1kSQS?{x9){o{dH?N_ zW^G>W@XY0Ge2u9l6vuo`(cp6_Vp}gJW9nQ}Kr$srpJ$7G^Eko8{w$N?FjVBAdfemL zZhQ4K)N*=c(O$po=V$%&LmnW#`j4E3`cj6EU>*Fd&N%q2O> za+BE}??g5#cd7^xpFd`I#Hwcgb>BY3loU0S>+r?P@67#?xvnr6KSps|(*3fek3;Yn z7ktKZ3+)&BKppIEFVa)~wP#=8Wkl}-YI0}e3U8|0LOs0Yb)3s63IJ!N<~|Tsu{_Uv z-SaJn!(a|NRalunagzPxZ_g6w@a|ZrL}uD5vuDApgr3)5uUF1#`>-p*MJ4cei`qI# zQy>kJo<%yY&UVJ1ynWqL@JfSVXz^Xzsk*(%IUzOGmIVV6idmC*K~Ty|H3~qcNDF8% zCFAQYsa?i1r4_?Xn#&&@mg@k}JNHZTx3*g=9eR!XgPPtwhjD9$w3^YmD^4u}GJn(m z!nN>HbLZZJcnd>^x-{vYlD5>77~b8r_^DXaiuClJJ1&0LZXNB{$X+PVfuotvsCbk+ z0VJ4{5goS%=R1>Sp=p6`NVc~X3sw5nqKJ-rcUev+{^`{t;$WU{!eB4}ZDG|Kl$*cF z^MCED8t;FST&)tnWD_%6Mxb9YR?PO$vN|`Tov!p@4^2El7AC5KhY z7o`A4pEHM^Im;Jb<0d%rU8-CjT>KnrRyCmqT;kiDBwV`N!Omj@n7c4zY}{a;-)EYS z={hCUBdX5=m?kFX`3*V1pUmk@?T|DAW}{rW3+7^DC=_R%S_^pjyM?3zt6kBNDHcoEz-@NE|Eg+ zToDliXCj_4eq~1ts>Ol3F6G08MCn^k2=LROsz}z%GBAzZC?`ID=V-Q#XsH5;W@WMJc@ydZeqO8PF3E1H;?4IqpWl4c z^5b38Uw)(68#&1RJkK|Te?njQ1Z9AFN-`r|{Jk&5EO2Xr5-1>k6+xKT+v#r!oD(U zB^M|1Z9|x4gtyHuDFE2Y$&t3nQ$JW+L;*@#YkRAMl-+?IJZ-dz$^P;Fp^$mfZei89 zA-d4}luapxQ9s8%= zvul+OJta{_2#st`g%g{34b{0bb{eGO6`!k)c!41rCv3|_pEwO2+1szaH?E6JNey({ z#~zj6Ygdjc3K^(>SIMeBwW<|x*Zs*M#iPvtePrM6qXMM@qdU95gRPDy0jy7idA#B)Wv=J(k+MB0*4}z0APjyoiEXj2At1((Ot}Ae~s) z6lyyRyF%Lg5rEbQgJQA>=el2;m!p|0Rtm6BC~ZF*DxlKgr%~qO61s=f!I3`E?5YH1 z*S_Wypk^&kwSU$6N^VKH^+YdI9<^DH+^G!D97Ed25L~rU13io>%|Hj2 zr3%tqJjiCT1H*&vn2!t(HFzKa#s-8@bcaVwjS=TO@|(;sB_{3av68EWIGza!D2ED2 zW=aycV}hKZoIzCamByVKq=)!xxlJ*Cs7e{&i7NYB#^@4p?e5Hh)ad(z5X_c6(T|b^ z$#YSEIvWBdSjv~3_UikxPw-`x!WfpuhDL+bA+;iEHla||{_U4Kr2x)hju6FRqh0*Hzc0Gqr{9MAKo(uhd`)7ql$_IG=f68M5-%e{`Hc0| zzz|6*p>~zn7Qh#((|XktazCmzp(Iak zW~3FwO}bS18Fv9Frf5uGiVK-#)|krDtL#EE+41PnmYpD%5gh0Rq&hnpM)^*@O$(;s zO7dW=t%TX>jGfZJy5izI`y2=Fn9H{Cvmq_#!V0Pc4K4n*aiefESnb7ESs(7N6^!w3 zx!Z7q&palIG%T}y*B5}y@I(>1bgR^cx%8ZXUS$1`5@gi2bAz9ZR`ru zPePP4woijwKv`uSUUsqKxj-al;gJRUMefcwk)ENttnXc4Z=Kx=N!3=SVdgnVZW$V} z&T(DKa0U}E%s#Xte+qLg@U8Z&M5G=YgXM@<-XLANhy}p0GE}Nu*ViavVA4DN5|yf@ zg^eiv{IY>Uhfw5{KRRnUA@S3>XyOAz8_q)OO%~*OD&p+T*28~|T*pO+v<+IZ16?(& zH3|qu`UgM3Dn9$2w6?LQTlmCd?ZWa(chgzIAD1|V&D^@6d=72twqbXu_ho*=6?Q{} z9p~&`($l2d{e|fgq$i@Fay4^hNVsM7Z-DJp5diL_BCtVcWrer;o*`Z^GC@iG!n}UA zYJ6M04&?uYNB;;v1As@-58vqjN=y6$7a9C))hKfHzo^u7K zUS+-Iq4C$uXFF6C$5S!uVsQe607fj!5MkW=w?n0-|2k;8YtPz=d@#pP^r|Xt3D?;H zoF?sr*SZ9>Y||QA%_`e{XC+N2>%e6|?)hGVqI<{@2#U_zAnq*IGi5irh4F6|`fA>7KxyCDVQ1R!O zUxS4*oJ8_a=T2b%t(&E98C!3UKMIMEFnuVfk~u%#I}Ts}+%r!C2i~(}LZ+(Xvg< ze|zv!7}z0b>BxWVQCp&1wzWeyUS~0I7m^^%gpDCTu<4pqgnH6Olj7!@!oilg!y9}u zFg1YQbBx{Sra{ad;?1&R-R-}_C@Ur|mUIB>w9)kCpez`sgf!pi$N#(be=cgFn`f?p U$+xj7e*m9z#uv{J{&I}?AKzDH%>V!Z literal 0 HcmV?d00001 diff --git a/docsource/content.md b/docsource/content.md index 2dbc74f..2c756cf 100644 --- a/docsource/content.md +++ b/docsource/content.md @@ -18,3 +18,17 @@ The API token must have the following permissions: |Account:SSL|Yes|[List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)| |Certificates:Read|Yes|[List Certificate Packs](https://developers.cloudflare.com/api/resources/ssl/subresources/certificate_packs/methods/list/)| +## Configuring the Certificate Store + +When setting up your certificate store, you will be required to fill in the following properties on your certificate store: + +|Name|Value| +|--|--| +|Client Machine|Account ID| +|Store Path|Zone ID| +|Server Username|| +|Server Password|Either your Account API Token or User API Token| + +You can find your account ID and zone ID on the Cloudflare dashboard, located under your Account. Please refer to the [Cloudflare documentation](https://developers.cloudflare.com/fundamentals/account/find-account-and-zone-ids/) for more information. + +Account and Zone ID \ No newline at end of file From 4880c79716523ce44a88077449be556bf9c60a54 Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Tue, 6 Jan 2026 21:20:43 +0000 Subject: [PATCH 19/21] Update generated docs --- README.md | 15 +++++++++++++++ ...CloudflareEdge-basic-store-type-dialog.png | Bin 43992 -> 43996 bytes 2 files changed, 15 insertions(+) diff --git a/README.md b/README.md index a08655d..d13443a 100644 --- a/README.md +++ b/README.md @@ -270,6 +270,21 @@ the Keyfactor Command Portal +## Configuring the Certificate Store + +When setting up your certificate store, you will be required to fill in the following properties on your certificate store: + +|Name|Value| +|--|--| +|Client Machine|Account ID| +|Store Path|Zone ID| +|Server Username|| +|Server Password|Either your Account API Token or User API Token| + +You can find your account ID and zone ID on the Cloudflare dashboard, located under your Account. Please refer to the [Cloudflare documentation](https://developers.cloudflare.com/fundamentals/account/find-account-and-zone-ids/) for more information. + +Account and Zone ID + ## License diff --git a/docsource/images/CloudflareEdge-basic-store-type-dialog.png b/docsource/images/CloudflareEdge-basic-store-type-dialog.png index d632a6bcf0df789ad014064d7ecfa0a539836160..342b7b741bbcb308f94befb612703dce896fe22e 100644 GIT binary patch delta 358 zcmca{o$1bXrVZk@uI=`J9)92d|L=(tCwA8r@h~tvFf=wabkx2Py*=;mGxPmFFZS1c zxf1L@v4F!lt^VUtab;!Y|3B^jr!z4yFtoU^)PCQ6f9YgB!*r&XY?G%OPV`i5Jgs(C zc(cmvYUc0frtK;7{#*)F`k|L2KaG8zdAjQInfc3RosXB6-CK5Vk8|1D67Q(G-Tf`W z4}LxUcJJ!a@ccNlzZy3GrA}_1ZMTk5z|(le3I+xN22U5qkoeiwn>R-~{NWe)7j?1< zCR&%_H+gev08sQvo`5(^^q+Zf%I3lZplJ7`Dg7|fCr^Y+HrEyaMTyuz^IG Z85Sq)HCz-W!~zsy@O1TaS?83{1OO1rl_>xK delta 487 zcmca}o$1DPrVZk@^*7V!|NZxUzyEe4C8Z_?1_qmTYHDg3tktitt-b%}nYsP1i~aMe zUTF&PC7yVrzwbvhTid^%^Z(D(xxL9~c3YHp%pL%oN{(sEUAVHwMhzpy~+j%=r);Yh)s5&R7C-tNCU7+xH$H$Y})FS7l#x{R@ zIz7Jbx%GWTpzwwTCr+IB_^}XVNY1?Hh0)?b<7*9hHvf^=KlpwDnFptA`TE)&E?SxZ6n*kU zxI`-6M;b2LSO65&$hNrb`SSE0xM*(!Q1sbT=_kf}W7ok&XHEc$ew)a$)FI?>B?AMu rDA)~47l?8znVnQ(0(zYdB*M(lFS=K63P<50pa_GftDnm{r-UW|A Date: Wed, 7 Jan 2026 11:20:35 -0500 Subject: [PATCH 20/21] chore(docs): specify that ServerUsername can be set to No Value Signed-off-by: Matthew H. Irby --- docsource/content.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docsource/content.md b/docsource/content.md index 2c756cf..0ce59f6 100644 --- a/docsource/content.md +++ b/docsource/content.md @@ -26,7 +26,7 @@ When setting up your certificate store, you will be required to fill in the foll |--|--| |Client Machine|Account ID| |Store Path|Zone ID| -|Server Username|| +|Server Username|| |Server Password|Either your Account API Token or User API Token| You can find your account ID and zone ID on the Cloudflare dashboard, located under your Account. Please refer to the [Cloudflare documentation](https://developers.cloudflare.com/fundamentals/account/find-account-and-zone-ids/) for more information. From 369670a9fc67963a586e9a33724e57892a026b9b Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Wed, 7 Jan 2026 16:23:56 +0000 Subject: [PATCH 21/21] Update generated docs --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index d13443a..f5137bc 100644 --- a/README.md +++ b/README.md @@ -278,7 +278,7 @@ When setting up your certificate store, you will be required to fill in the foll |--|--| |Client Machine|Account ID| |Store Path|Zone ID| -|Server Username|| +|Server Username|| |Server Password|Either your Account API Token or User API Token| You can find your account ID and zone ID on the Cloudflare dashboard, located under your Account. Please refer to the [Cloudflare documentation](https://developers.cloudflare.com/fundamentals/account/find-account-and-zone-ids/) for more information.