From 32f00ffb1b198fae962ae378ca876e01f367043f Mon Sep 17 00:00:00 2001
From: Varun Sharma
[Explore](https://app.stepsecurity.io/github/cisagov/skeleton-generic/actions/runs/6199340224) | **Microsoft**
[Explore](https://app.stepsecurity.io/github/microsoft/ebpf-for-windows/actions/runs/5559160177) | **Google**
[Explore](https://app.stepsecurity.io/github/GoogleCloudPlatform/functions-framework-ruby/actions/runs/5546354505) | **DataDog**
[Explore](https://app.stepsecurity.io/github/DataDog/stratus-red-team/actions/runs/5387101451) | **Intel**
[Explore](https://app.stepsecurity.io/github/intel/cve-bin-tool/actions/runs/5579910614) | **Kubernetes**
[Explore](https://app.stepsecurity.io/github/kubernetes-sigs/cluster-api-provider-azure/actions/runs/5581511101) | **Node.js**
[Explore](https://app.stepsecurity.io/github/nodejs/node/actions/runs/5563468674) | **Mastercard**
[Explore](https://app.stepsecurity.io/github/Mastercard/flow/actions/runs/5542112873) |
+| **CISA**
[Explore](https://app.stepsecurity.io/github/cisagov/skeleton-generic/actions/runs/7588528684) | **Microsoft**
[Explore](https://app.stepsecurity.io/github/microsoft/ebpf-for-windows/actions/runs/7587031851) | **Google**
[Explore](https://app.stepsecurity.io/github/GoogleCloudPlatform/functions-framework-ruby/actions/runs/7576989995) | **DataDog**
[Explore](https://app.stepsecurity.io/github/DataDog/stratus-red-team/actions/runs/7446169664) | **Intel**
[Explore](https://app.stepsecurity.io/github/intel/cve-bin-tool/actions/runs/7590975903) | **Kubernetes**
[Explore](https://app.stepsecurity.io/github/kubernetes-sigs/cluster-api-provider-azure/actions/runs/7591172950) | **Node.js**
[Explore](https://app.stepsecurity.io/github/nodejs/node/actions/runs/7591405720) | **Mastercard**
[Explore](https://app.stepsecurity.io/github/Mastercard/flow/actions/runs/7539664931) |
## Hands-On Tutorials
@@ -47,8 +47,8 @@ Harden-Runner monitors process, file, and network activity to:
| | Countermeasure | Prevent Security Breach |
| --- | ----------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| 1. | Block egress traffic at the DNS (Layer 7) and network layers (Layers 3 and 4) to prevent exfiltration of code and CI/CD credentials | To prevent [Codecov breach](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md) scenario |
-| 2. | Detect if source code is being tampered during the build process to inject a backdoor | To detect [SolarWinds incident](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/TamperingDuringBuild.md) scenario |
+| 1. | Detect anomalous traffic and block egress traffic at the DNS (Layer 7) and network layers (Layers 3 and 4) to prevent exfiltration of code and CI/CD credentials | To prevent the [Codecov breach](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md) scenario |
+| 2. | Detect if source code is being tampered during the build process to inject a backdoor | To detect the [SolarWinds incident](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/TamperingDuringBuild.md) scenario |
| 3. | Detect poisoned workflows and compromised dependencies | To detect [Dependency confusion](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md#dependency-confusion-attacks) and [Malicious dependencies](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md#compromised-dependencies) |
Read this [case study](https://infosecwriteups.com/detecting-malware-packages-in-github-actions-7b93a9985635) on how Harden-Runner detected malicious packages in the NPM registry.
@@ -57,7 +57,7 @@ Read this [case study](https://infosecwriteups.com/detecting-malware-packages-in
### GitHub-Hosted Runners
-1. Add `step-security/harden-runner` GitHub Action to your GitHub Actions workflow file as the first step in each job.
+1. Add the `step-security/harden-runner` GitHub Action to your GitHub Actions workflow file as the first step in each job.
```yaml
steps:
@@ -72,45 +72,45 @@ Read this [case study](https://infosecwriteups.com/detecting-malware-packages-in
-
+
-
+
9G}7EUjS-q24@>A~t*cx~A}k KnIS5b38XT-$Ivf0(l$(ADn0328nRhT2vIoMqJO!BptJSq5R86tdEL3?hwKR|)sx zcs3$WSvUCL;MkSg&6LC{q`jw*=S*0?E>VtS*=H|-t}jiO)Fuoy;|MI0^#(sh-C9B` zab_D^K}D2T^;gnI018@0_bn4lrrD?7h?Er5{OvulS;tum=vH08({^gx?&>UUI`tlq zSwMw6X_fXk&)0dDQ%Ywn&wp<}6WH51*n|sp=&O)vhrPPCG~9fYu8^6D ZRn0Gs&(Hg0oJU}QZ1Rys= z-{#(oSFH$sP1E3$AvH0Ywy%^fYcJO&6Gy&xoWc(>7dhu}0V(Wr;o9%LW}G=&bLPRq zi8T*Y)RQdQv;prCrCYekk?G&W!Y;7B+tT}n*Fq*FqSG1OTRi7DgBS^0jNyadgK3=h z#tCs2jUnzm5@WbpX@Xt_oIWxEOJ9(G+*d39BBVOEBO>9e*BCErwW&xi`BFID-Y~{l z_cJD;S&7b2^J}P)JFkttMV?79i`gwv(`H|jc4qzk$d*XEhT-bS^j|7Kqzx1{77)*6 z7%++wm-MHw0`EqlyKD`iIg!$ztc6>2aJ90>{ow8(6_n7Wk_h2dw3qX%)C6+lqCat} zLc@6QTb0>nsNsFUb~Z?B&qR9UHgO_hgCT84>EA#2J9TpH7JT)1!~3!{>|$N T+t!id#SS|tqgJ^3E7KP$WHzjVJ?^eM|{3kS?SUEM*Ig}M6w{>cr?Q%R*3Z#ed zGW0!GcxuqQsA>}sW~u&D0@08_0Etd2MvEIrLp8|*$+EHCWgwNT!*%*z*$c>@P(3H^ zKrlRq=Y4(RT(j^4W@S$iY `bn>wOz+nDfXKQDU?n#^d*2va#`pi^t?MZ zG*BiwVJO(fY`hYkU~20WAkuZj^%GjcZbB{D>VAsfSwnAIP|F_}yw?eUEY`B?;;ps| z7Yw|g+w$~h*yqC5aXZ(kk9Wp6`~m4CV+d%$@yQ8#ZBtE|Y2*G@Xu|&Kl5K)|97xF? zF#LYFXt92dz8J?!6&I8Ou1raA^o9KQ+w$9}o$}<6$(0jCP0X!VJcYxrVuXGvqVDk1 zmdY1iVN0E665fBC9UBsLPIf!#_Ih1*%4i?({vAvI31FI<#}L-eM&;>y@=Rv~=vi#n zx{mg(Jh>Btu7NTSoSRf=I!W8AUcv^|+0y)oNhZ%Qdfu=z`x~GxFiRim`C0sBY1GwP zXblrcuuX7eCKaMwIoYNITTK*eMM4v=kQH>)H}o5yfvVF3>Cl7_3O*>OKTOaXJFk2- zj5}u(>(Uoh&qvK1G!z^wgGUn0Z|RGn4C?zL+-Y;P)C|4SZF{xspS!>f GQa95 zsgwg!4@HtQFOMzD``LD*@+#eVYcMffW*V>yf0IUmL^P9lwd&_zaD^k|i2b)CuoqfO zUK{<;e`D!)RpCvnM6`k$ymc{aC2!1;k<`aj1#CsGkdkNgS2 L0(e7%3zwH|zfqY|;Wyie3ec zEl6?!*n#RZ=oy$4O( xBePH;X1i&isH>65 z@FZd;a8NwxU^bKA)Z;}&Qxi~t#l||ow^PoMa|{scWXZ*d6wrbJzv4)C(E|N>MmV6q z-TIE3j?Exr&=!E^4HPI}=|S;8 GE-XZs zoB?|*3sZCH{QN&@K*t)3o@&BuePIvp^-t|s%Avp?C`-da@;JYAzWKCf`MYI3BL#}E z9zONol0M#?ZR-Jb<6tR=!d#eFYEW%!HZ>C@vv Y`icyf)|ss5ek=G9c|no^HP%l@-1lQZS{ng;*_X^+J(~aVo~)z`6^qSW zb*Fvx om~#QYht zR?q 3@RAa>8hmYPYEcL1tg$yHg{FZzf1UzfbVp3 z@UZ4ajTjEtH)3JGEJkoZYi85v>%xz`ziIEQXMl_a3sF~_;0Mk#8xJI%Wp0gTgnlS} z^%^RG`!C2t+sg279RPK|cv_2x#Y80eQxOZN0=wCtXuxgrGi-!#Jy%(G;TQy36Sx21 zQuF6g6v1dTFskEJ&Y!gIKhau0J2>*YX8e=O_6qq_Y{mSt=+C0?za-P^f&!R(Vc&TB z_rl{phmL@lKsu%H@}H1^zaN@d0Sn!q_lVK{#rl6{goOJ5pg5TRe?BFHeOfR-P*(S% z^WOaPDF2)N&{DebhB2mH*XLWNATj3O!_R-)T4;IQw<`M3I*8K$Fy-Hm{^H VE>w#sCCI zuC_M;fQ0yOsZ#d=ur (vv)h6G8E@ec+0dlG?q zK&bxjQYHQ`SO1om|5pVV9XBICpZe%eQ~i%5dZJ>@5K?ZR*`1MZM9uP>45i758{Gd7 zq1_S()QGi(4#P^S@iLm0ME(IwG_@h1R_DKsrdI<9QL62E=c{wk*VX*t)J2`--6y-X zt!3kNY3P%yUqr6Y_lQ*f#~cv?&tT5BzC*l_Jb{waG{&BMyl< >w6&7Uy`+z5SBY6`dvP=48_e-Ex32^b>9p)u!3|MM%(;}hc+ zL#GA>YmrqpcW`ia3%jER`RUH^&s-bxe#!sh Kib1_*O>QM z=wd}b*J=w2e}h<4J|#S_&Gc1yeCGc!zR5yqg+3{p6#dA9G6@*kE*6$?Oa>ltti~QD zXLCmZ+}(H@2*!<46PRSFy9bGQDK6PRbbHUWiGp~~Uz~yei+N2M;%T%#DgG((1PAhb zUvme|J|fV*bmkBxIV02N3E+8j`5*-bx9sJlRBLV!&bW2kV_~N74*&G8=ntDbZ9$;- zd3?BRTm~{>2!lMQGOBvM7%f-FtD}PnW<_d6HPen911a?p(-FkNEhT!bW$r})42zV( z^Wl!c=|Ctw&eh9R=xbAkobE!Mvlj}Rep^dC<*ptR0OvaDA`SQ19?kVHtX|+kB;>10 z+2c|E_jXpWdikPxYE;0Z=k~#=kd4MZo-R+`Xst 9 )q@*FNbv+pQY3hUZmW_!YwCTsqxU1PaVlDnfi$j0<6J(D)H|jnbqb!Roa$; zaMolBK<%_V(Nr>}9~>>cbMYMg6T4MG=~E3~4_Ln05q4iu00aS)8!CP9-reaSiej!D zlCVEAQtIv8X3!U!k=YufT1Q5%75g6UdDM+sqmr%u@ofi!fE(F(Ch{j#5s0Q&&FYdq zCAT!$gt?Fv?kdEh-?8*xN;)(Hqpq+exK>Mt=6uup!?}xWf%)$C5`DB~?>aOLLdiWe zuH(LMR~xiA=RU5q6-a_&7`8jUIddNXKoSO*0omwdvjk%3<-hO*%_V0e(*93)JD$6v z*5zW)d$Sq 5y$1B z+a~v4;3oi&q_p)q&G89PNAGbQyq)p{GYa+@QvB2`D@$|~+jvKg?tCP|yYnrx<)oLM z@aku_12SZ4Y4T{ygvejgc@r+s3&)E%+442_aUaPlWiqE938j%E_c8eGMu=yftL>Cs zzG3Uf-f+trl|i6jfWvnhKls5IfKz!UBTx6Rkx>W0PgOUZ7dA0O0eD81z64fkO#n2o z`~(cC&V{>^hr*Zmw421i4c-HyH-TML0o~9GUwSv H zj)v!SC2mGy8dc4)TDK>EZ4o5I8n-S^dBW$Y@qFgJn9B6;`U>j>I}9vvodJMJ|CLq$ zS@iRO%QuCGY?3<+qBZmhZ+s4FOM8qmkAAQGnkMbiiue`#KZv!VWf=80Sj^>S^&HMb zJf;gr8)^}CwVwJb0#WIg)caPK@{;xNs5vXSm!xlIZx1~mxut6Wtg7*DeIWxP=>VRR z1%&hp5kvlD5@#iIN8%Pxo0C}0I8z=_UKH011V9yelT8z$dC+x%q>9Bh`?7Hi=^Hhq z75okdv^iq+hUU4efr}@AoEoRN^wYWWIm#4nejKY*+P%hg&?HSI?IU0{9mx{IC_He} zb~|qOi^*NMt(--O{$Zw)1j+1l9(zpFA1u?)V?{l01%_Cip8_SaS*R gJVFs}ux z{V@>52Jyd+coQ z%>u<-+qoK>Wdp)nRq*WW!m9-Uv!gPWUUS@m+j_fj*}#%UTlx~T(s%rnhF 1 z6?llHZGgFrW_gZTjz(MB_G0_IYQbgq*#Xi_<%|4v^`J|HR_;vTH6tc(Vgj$@+b3fh zS1|i!ck}+x(=y18z5l>iUZnx{>{xGWAr_wdlr$nv_xi2*r~8J>u332(u*pD{{Es z+=X*>-kk0Uy5+SS^~Isd@!y}7TyG@$4`+(|V<@W<)1pAO)gCT+HE9n7SO{~*IiO`S zd(N2V`l0~%yltA0x#B);QPe90`nnQLw)rY_e*eue4FLOPe`A037t$G^Osm?y(v1_a zQlqXX0B&&rng4uDanv==m}JteBIB0*Am2zbq~fXMcb^E0GIc_83xNEvQ#@|AKbGw< zThLz40>GshEonvyWh=@RD}lO;hMV!?R}}58v1b0U0-B1_w3SLXefk`i;lLTx 8wrT$G;siQ9pr^? |q=5I?>Q$g7+<^4*V(egaaaC~qrA27!$30?VPx$?8;_ zG*$1ZV(N|3 2z!!p763DRAjJjeyZr>LX3-+CA8SiKrL@s5vunTEj19DoIqAhD+SZNc z^>feeaEQFKK8WUAr|Kkyt4mI%kN2qA1y15^93Y)kMXRGdQ9W&xSY({)UR8m$?W9VP zp*d~9$%p-7DjM-w!S;-_N0+fP Nl=o;1uMWvWw&_Y~cCSkjIaV7N2CZJ4eMC7+RC(7o;fJd%MfIqH-6Xq#?hy=L zgdOKFYoVfJRpg!sne>I|fH%`@7sqZLFBsp oGIuTG$uqOx*s|e+#4>#SjytOG>=bY+~OUtZ;J2 zq4yf5OWD?rI;wU&SMk7Ig40#z;Gm5EH5ujyu2p5t3A+xrJ1C>^7H042zU%$-wQx!l z0_HkmBer6T>Up+v?JIyC=r16N-AUu_n&j%KP6()vlj |KqZLuOXsL=iUqVeW{cF=4W6 zwB!LkF|Im RcTF?>4f%>r5?G`vh3dwvv1V+|6eT9xLBJO`;`Pb8cEtcHnMj zm7{@$Qv$HJ*%oM4)mjtR75>7jZFF8R8gyh?H8?{j2AF=Q90aUzsx3c&3snsFNxfU6 zG~8`v^}2*gihFhYnea|`2SY?-xT@}0maC2!4Q}*8f-6YPriSkrC(z377-D6gcJh^# z_Vj=Tc;?{o;qY;!`T b9L<*JDyn~7h;nAKxZi<#@$7#50JaIjbbi6xS zu`Ew|&F1PUB^q@r@O}yY(F z`J5FP^Y}9Q*4J^(3VvVd1GxJh2&Ckl$VohA2CnVL%z(E>5D|-8s^)Ba&$w+Ou!{OQ zpDJNZi Ve%<4IquJFY zU3`%FyZE4~3h%T-&w99H{p~kyjgdrH`b?C^qeU&r+)8R}*A$mCGXAw)ms9!HRs1M> zRhPPF(jG$& biAWwdog(X|oSk>mkeoT_a@4<3(A}xK0koY-}!>OBhNYyN9CpRC}6py9|i7-Hf;C z>d!_-%x~^e?03pn(M!`A+)oTRq`%%x?MFU8{H7|lp#2Iv$pB}eg93k(p!> E+0H#QPl^(D|S%t?gix`q@^X^D?92O;U>n z++lqj1@=ef1X&f51tV>8$-X2yo++u&Tl&X4;zqzD$YfCyT|CwdS(j|{YcW{4e{27^ zF`LnqN%<(#k?-F~nH|$75+4nTQk=n(-TBhps_j0eZmg^43rJ5iSF(CNHL=2dp+*dy zn4;I;HD(dVc{M=_rjVu|z?vj4CKtu>T^_kewPh1*ztCgor9|6t*)tZ_8JrT?8$8ji z?>ccqkIbbCoc%kIg)gdWeM0)3+`K2`8d?Q;&bj0Rqus&oE<$z1*yGon!QK@oG8H}H z9zWRUHpo(omdCF`*mc1lj$&ROqAjqk%tzXT^SCan0fil-&OIYqI1oRC+X2MnFvbT= z5V#d#nTf}^AyF;Tjj5l@aL(P4SpO6WZgV{X1>;lQkn2ra^M#CRft8Wu`be4+tbhfm zI@+~Rr^*gohmh(AFvH7f;N^q!2z&ieEk^fuKWt}@5SJ~u#B>#Sa=^RVAHfqzo)6d4 z8(GXTg_wm$&!gD4vO91;)Tw3Q1E7@e{_=Mz#n4uZ!67w-$4DGj;m2FwI=W(2v9Snv zvtP}|a*0=o?gxuM>zKXG5>`l%ZEaXRZg!9j`L56^955w|g?F@)H+ht{^04uv7x&Vh zNrYy$E%CaJbyvM7m9%Kp@I_$-(y>$^fs>>$ldNC0kSQ0KT*&4}<5*%Y+F+z=L(Q7A zuQ-Y}9oVVOjQW6HUBR;MlnTY~5_^(FTe(ubVgAU323{g0SB>vNRR{8{R=LJXDpfHs z0{hFdvf8`T%`n`r=}ps%RQfE-T1p?m(ksoAJAO`vBr93%Yn(yGZ#?Ctkc#7lkvYlc zL;NuZ=RX$yAM)P9tIcie9 )LCtHRs&Qm!v+q>!$$QREcVKR#}l+Wph$V zY)&k?Oi~`JB)t_~mC&m!_v@G_k7`{E;Dym|Smp$g;`7$#W6@(!4kHu9#BEd6GV!*w zeVxVq`PQU{2m9n-S*?Y@whlex=LpE;*T?woao3DxT)sYzP;86GB;ArJ0({@u=bea1 z%x^ir=MLIo33AlWC6lxR?9Wa59v?0` rh{aXvb zL`Q(|EG5&S+W_yjZCIyeolxlB-sd(GTr~0|wr5qC3v+N=Pr Pc<^=NBvFe60CxT>v27|XV;yOjx*7p1eh?okhh(WiHWQVqGB zy_cG%GXf}`@?rZM@rnx3n^!cCzi+41M~;}{zuejGrGBwL8jh5}gGI 7tx50-&BsZ@3pSZ=XGc{J9uVP~6x;<>P38=M#JoH>t(nG{t0+R}wiJ$~FwVKj&F zmM!bnv5a^0%IdR+ewE}gnEf(h?;vgUKK#iOaU;}B{SiRs!24jm!<2hSW>;yy3E^jc z<=BuHgI%0MW?pDeu8-dHg*TBd>srCbx3nuCa_`n%0yZaZ=s7wzXXQ>;DX3r`)m@Gp zWfz* l)o4tKq`g2UgMXyD`^nFKw5 !CkCj5S_#gWp>O;6@W7w9}TBpsgKuN*4EI&9Mb%e z2LXu{DmhDAZF#HPRv(>XDr0`{8T|P8v-bRt1{Aa4tDzpAnuTPp>957*rhIz*<8cN( z_OEpG5SYq&M=rFK%+Lb5wkoC(c}XCR$-?gNl@}oLN^Y~H&N9r%-Qz{#AWy6CLmhHC zHxiTgU_w}$y$i6+=r8yMA|M`AEBj0uixSu5B3DDv97Sj|Cggc1vTL9~q;rZn(VDUh zWqsk2)nIF7>1DtzYJm}%F#Xl|Kssj^`4fg7O27IdT5VWo5?{S!(AZ>pVq-vWH3oLL z?GE#S(s3?+G_H5agce;0la!d$lML=>HUiXN#L{l(z8|_}F2#VYqaUXlF~)%{2%fm{ zgjI+)0Mv<|^aekwA5RaVX7xJG!PsQ2eSU+Z8s@zLjUL91H`LULO+@Bnmwmco2ItEQ zA?c;?up(JXzYFmLZ<>bmOOaY9Aamr6Otluqlbr5bY6+g9jH0o+TaLpEa^LhO?EK1& z(O78F?Hu1LD0iG`Y%RZFa}}L(5ZPT$x0_jPG0~N4p7yma}lB^+e zAY+y%_ubSQ!A$ZawZq2#m77GQq%ykqr9cvU-Fu36Chzum2HlQME>R9Q?-^bgCx~h^ zkJ{*I(j9M4WDn?KyY)%fM>*;vkkDE<0Mt_{QmM+Q>}sUz!{HM@^@dhzGX1?*(~AwK zH-#u2SZ`)4=_nMh+t=~R`7)p1W_ FZJFtosG$iV!txd&+CE1C}{L> z42d%yM__%rRUUBlPKXPlcAD01sS+zFClU8#=AJt &*6-xm7Z{H0dyi3tF{F(s{Q%Z| z&iH`|69!C?-cenGRDx<2l~%gBA;nX%f&fMOqkbiG@4OwNpw0+yV0d_hM+%k=erMRk zM%}dgGC-eRo1O;CP@ mfF^`IW}1B?(gOTrak6%VQ$>aaN_O3JVIA7!QQQHP-`iv z@A}mdWmcM@0=eyp!l%GS74RY^H(6uh9JcxTwvLI(bf{qFXZN~R4_^e_T5=Cgxpn(( zkTm0pKZA>0LU$&Ysm iN1g(_(J#qs|$_M(t*hp#W-Q*gL5q(j_R`Mp$1A e_Nu*Qpi1@`h@C&YDv;Q_}f?IuRrR%ZkTCrNbN;c z9WvcVrz0$j>KyQjkt+$x%eS3-?K UAvq>{ne3{+ zh*Jpoj9Rb2X%dtGNJ+Ki74f(p$Tbt~YzK7bv?CkfwG)*y37&YudLrH`>d$`Czgb7@ z&2aa#nVsm~?%K!|9rM)Idyoy)cQvDFk 0xu4dHS)=6_xIh1BRkCnKo0Fqa4YR`8dL!HAxan#U-T`4!0-H^34bA; zwm&~%qdhD6dDdsQqVnA53kJTOcLZx}7qz#|u2|x?%hR%kTUd|_{tiA*1hV)qCPKRU zLRBYl&RA!3zLbt0=dWHZ`WL28*MmXkF)D)Ew}9{d-O+7`q)I_BpiSUi@a%^(qEGyq z7|4rE)L-h-f2& 9fRwvXsD6 )*)i*E6$D4;WE_HHYm`J =#mjkahF8sdLxnW3F^gw5=}(Z z=d%~zP9?~)v@srsfv+TzPdr5ulC`>jNB&u3SUq1Fy-LcG6{hql(4|0is?>#F3>A!` zpbguOmaib9^YgQw(!MWU`&*el@jZEAj|cl1R;ks8gj_>pO}dgZ+47Z;_O&EF+Evt; zza%wBt*!S~0dG6ay*^J_UQ5hY;FKrnmhfR8Z7uaBik|1VW3kiR3v<#tGU`!_NGLM7 zCC2zJLX>0Z=WlI*L@fH@*Q%9%d?XM%qN;7KjjDGW2BHwBaX?(U0lf98 Sur6ml2~?Z4W;))W zmJ1oLv;MkKod{hj1HNIZ%Q{?_x&mLu9gMk*iiCd8{7nrJ{Cq&VawWB-d%BXw`t)zG z1)IXRJk>}{b(tk| r6L< zrhLleiZP%EZ3;mXG2lPwMm Cpjn}f;Dt7D?TM_u2TfO$g2SJ)h+QBd(mTMkmDoJVRO1dHD{tgpF%jdQw*z1J=$ z=>6~}JyjSWRy|Q>=7NGK&CUzk30?eH;Kw7_gq@3DZg&b#)xlr6mKd;z3u{NX6bC4u zJp#VT;X{RvtgyIwb=8YwWQj*~tkvM0>P#ggP7&9J19rJ{@C``#6RcS!$XdF4m*5lf z-fSjG>$wQ%yB5}(lF7%>qeOy5&F{q_I`^RC>~gKhHOG>=+uh~faQ`bZI3fX?G@PcH zz%klou^vLOIXPqv_jpv^35nPvs7$du{~oWf%VxgXa@#<1zK>w%G*`84+%`+?hx&PA zXzFVd-QRZ;irq$r9DB-6b{{SIOr>IDAa?+M8WLYOCZDwDS>EaJ0G!Xh{&hUiMy*a5 ztFoavV{Pq%Y40jua{0eKv4#Em-YLLa!h0B5)UY>F|AyG=mABb-E+Sp)*;|vj-yh63 zFn)FHx*AB>QywS>f&GSLn}6v|`Bq*8Hfpp;hEoHFAo%`iNn4%itG|=~J0@UzB7gnQ z@F*&AhKdi=U#yim+l+o8BH$(}AK$hiG*4o;+I>L2tcxi+)KZGo6C*m_ud``hAlc+h1vm(00Aaw~ji-4iSy3)3gO+0n`SFGtunL zWQ42qx-TR>b8 2SgV9rCzkcPwC}OHYpS|i73W)S)ZoLFW^?vl zbAPjj$+x> ya67ToHcpQP)%fT*T7)Pnw89~7eoq_4b z$HX7bA~v6ie+7KuSB0n8=WX^sc$GqJ-lqA z#O=lc%6;X%Lw%?9C2XW-GRVjSRX7shdDZ@Y=y?RClhZZYQlFcPAJIwfR|OGq3%AL4 z1$$qfV)a2V96a#}nSZ<^2!)+}a>MQc&^)P}FbIWEj}wq{q!2|1QY%&BX}U8nt*>Ku z%u#b3NI1yjy8}4a8g_A>{6>K6qwqnv>W5ol9nZCn`LR2OeiKR?W>hXG+&2VxnouE3 za3VonY(( FjXgVt|)B5AYkRyWCeC#NKOlDn&6GcGW{z zUIsRM=iNmdHp}EIdfXV61Gq^gjwBKufBL*KbWXBHdw yw17LZpGv)Tm&bPII04kWrVjap?ldF3Sj0ve7m->yx_2 zqi>M>iAW<&wZ;J*ExYr5H*7v-{GQ=IrLYA83b)^+Dw57NpukCek6lAsn-HQ8(hLi$ zXq~o?^&}*01)qpQ3+$pnuPlhOs5dh!Z;o1h+?g* 4N0Q zv;zx}50BjrsODe{(Uf_34D# V=%HPv3mpNuUmyGD2mkH1g-~ zC{end>mm({!pR8S&S 8i3A =5)sSfmT8{r~Lh9ZxO zbnTi+T9aL3Zp4|_r*Z*uBi)csz!G57Ii6X@HG!TgM8+HbzEN+`C$e$n1S(|~en3%2 zI9y9`*-g)ZfrwBth4)E%g@U?kI&FQg9G;2TS>&IeM|7w2Vx8v;GjSYrRi(5(Uos6T za?5roT^-gM$V=Viv;Frev`q|vm>npn>l#D^kc<%Fa~UGFHTnB14ziY4bU3O~0nW*k z_(7Pv9u_;yqaU0d)}DD;4OZ@?>j+NVzB50IHVk?Mlft$4rThg77q?h@ty>7P>>o?{ zt$|`=vw-XS%$5cml5^~m!sj$Dgp}<|Ip?&sW*3rD>y&ylMf;@$kyX!=nK*(+eZEiW z=pwNC4egoaTZB`VpsLo#L5-eKc`B_;xctK3Xpf$5iNK &WRCLp zV`(#|){=}ReP)ik1Z+O?OX|Z8m&>lBK=~g6W#kjDceUTf6n>t`nV{AjcPvOyyBAq& zNQt&qOG`RJoK5jFau=+T6!OK%BkK*610ol%wNHRl3bL7O5WgiI;B%Z-oWPxJ3i~b` zEf+WOB$36c4CgYc{B>pDLbAvk5fNwzW>1W!gugo9J>-}M$+nAV@p C)kQ-tzBdh{0ZKfL#rE$eeWKFRg&xFysPQ4VkE0q*n=IH{j5$(K!3^6VG79s?u^( z)`PA=RIs5DsG$e`5l^2^NeUeEj!-x-{iDt4UvPR1I^Q?_(MdDmz+1uCP?fC!A7KP8 zjUS{iNz|--S2mXDWJpNIzr`qOW-|1Zgu;8b#%`tfx#=eh?Z?-BZYvvk3(~djDhtY6 z(xjq>R}z(s>^FV+Ys(lbYnYJVnf(#o4gfyHlNy<;>sfTTCu74}1ZhkR7KV5hfQjfW zg4S<)e6_le+&1}Tl8^Pdx7d0{fTm=|FB$2G#;&@!=8OowK_tV?1><~DuvJ(@6e^G9 zs`uy^U)Kxow)O4+Gu06$9sJOcQM{GgNr7CRP5_<>y1x(pmw`=!y561dMLd*cI=k{H zUq?JK&?zSC*5k0AbsBCvIlkW#S~<|n@=UdCPC5a>tPIR>I(O@_JerVCdtbRXt7OuG z*io@j1(%N8PTOC!=Q;6XLa>0(-SS%zki9-I#wo(ol2eDa(gTl}C?N!2@eJz7BlnV9 zg)t=8MS645N8AdhSzrk#W?gscX{MzsAeU3V0Bj$RdRO?(mpKw6=v10(O|RNX#3pg) z5z_q#?B |)=y$PRg_~WRhUOU>$SiVd}9f=G*lTWsHO%7J0>=)e#=OD?~^cTz9FrK587tp z)7~ihVaIT&`D8O7Gpe+LApZaO3co?TV{Z^~M)8j+k>R6`@g~8h48!Og&9C|7Q@KQk z(s)F9N667u>9V;BSuhlWo*)GGfcE_qc(1h$3{&p*t2ym$9>Rq8*mxK{-S@b5NHu_< zlg?Uvw}sUoH4*>zH2*<%@V#dod+}DW>*vG-?UO7M&D~*tX~h$2EHoQv7eNZQ@lJ&t zuH0q g3G0ZwPf aTXkLM8^qv$fDcKbofh#fKw^JaqA)(rV&F%cv5p_QdOFFfRl) zy6D$$@mfSZ5THcni(ki`@*nr3clz;tk&noN47t< $8{oz(!hIZ9#Ica+h? z9FvjvjQ^OI|9M15Fn{pH`fbDBVh>JW`;8zJeO2rc@Xu_NXv*5vyG|6^Z`@f1ok4ki zSZ{xG;c7RZWip*f9A(rGCHMd3X8rf-Qj$P$enMpXYr%7!WgprZ!vx{RvC@k8o+pFg z3Ovb-31b=iTju{%;2%T $ =Q^`0QNf7@aJhtYIz6wL&Kw+5c2W=HGySv^ 5IY0@rBO1^ U+Waj~D*)_-!6hZrb~~+dr}? z|Nk_ozS(z9nQ00L2J8|iX!nfM`g(}d17T`y@BPN6r`1&SDCqt)Rj$L^zP<797^C*@ z3|Z~$oa4&vz+LYNK;Z9Q-JSX4u72N4z(dMJ!_&u%FOatse5CkCR^+vR8*X?cCJSrT zXO(AJNqFvhslZpj%eAf{N7KqmqYs QQx&MJO1|y`1e5iHlhus^NEsYcfHGd zIhkJoU)`yiI2jDcOCr*6y_Y0Lgquz$zV{n+43>Z2l=!9P-rr5&8m2w`SHAkc+Eq>P zSRzZNyd?=ugoU+9RnumNo oVnDlUd61U0*Cq8&pJB3Cuto`9XYvuo}^|sg({@QO|pUkMuXd bV%Ax3t$BrN!k z>-vHkP!m%a$(yr*D1IoDhq1I5F&RjeDNp~`-$7K#`VEx@wKA!>L^g`sL7f!+)Tz`nvpG_7b9OfPwb^<3j#>I)yX)N?Fh%{($vIq*?PH*K+P}!<1GC|AU8t zV6-C)6OY(0;nF`ECSHVLlEQl>`iF6#;}k;}5M)$v!EeFf|C!s7zYUXF&ek7yeB_WX zZ$}^bURM9d8vRYH{cWJf5#^G+pSu0uLJ_(Ij}W^JF%>NH|HxPWSQfl#2!od!nwIs4 z3gHq_A$EnQNRY|DIU@h8v#-?e-G*2B^pBnV6tUZwerfa2{!>4UnIX!JWU%o5Q)51T zLF_gd05?UJ|5|E))tTh?ZZj@1toWy`69eFz{nQB(C3t`!4ZXO(*{1c~97^Sh8!f5! z&XtP9K>T3+mcQ2A8@3GYCe#P#?phoFq0h|N5cPXi+lvs~?)c~m!9l<_+c}RnlW&GL z8(Z&Qu{JF^7~Gxnp{Co^f_`flWc8-}V>JHnQB@pKSrToT1^6j6xap{oXUTn#t>{wW zRdDO=gxqRSav65rii?gLbVesQl5d_DgJOTX!Gb954 v{x7po79=pFk>tOlx@cUz*ha9Ik(LW*}mopjVzP@f!~$*tLUN zF deLk%Kcrhu9rY&2Uv z$9I|@rPKyRdDj;}*{>Oh+ax~jz=JVK@q;jmikSXo_`g{^DOd1jyFEH)?3|EeBc9Rp zn*I@e`DKLu3*+H$5+^zqxgan6Ch699av`jZrCb3kTJ%^|)1bk)6CngOr*2$V@t2A8 zr9yaakI(z#8G}zp@2nB-yY{o9VmWRE7sw7`JBoI5cv-~hewMO}h0vcj&C&t1IPO>5 z^_Nz~+nYa^Ov|xyU2t=|+PNfrUR i5?2IvV#1qh@4JhpI-gu|;m*@o#?_olfii zLWvM6=Lk5;g2h*prCWoQua- )u8$d-Pb~OPJbHu6HdZvS1*uBzwqEVAcW`(+ ztJgzUF7x1DVg9))Tos4%D4hP%lsEePI|-AMxSnox2ms%H#qy)1d>;j2!>bCr8Cwoi z+8}J~718SuPK&d`dx1*RzZ{$Dm%b;>7q3f|a>Io!XNK(hB?);YH$sh#Ys z4Wb7_jwV4hu9^7k4Fak3C4{lT+#heU1Pq!#G6ov?@C!R7&iY?hUEMjd*VARChGNaU zbXo1L>L?%intE%NIsa14V$ppltr>PLd(`?&*tUcemqTbFY;=%= (B9(1h8(=b;8SlL{lD=s4kW;am>9ay= zGMq^sghl>hM%OV?GJ8O6wvq)-OID5tP84kaeK=euy (lDq