From a8306f70c7c9507c05a838031fdf164c4a7d633c Mon Sep 17 00:00:00 2001 From: pete-lipeng Date: Mon, 28 Aug 2023 17:26:18 +0800 Subject: [PATCH 1/5] add opentrustee overview Signed-off-by: pete-lipeng --- .../figures/overview-of-opentrustee.png | Bin 25801 -> 26977 bytes .../overview-of-opentrustee.md | 16 ++++++++-------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/opentrustee-guidelines/figures/overview-of-opentrustee.png b/docs/opentrustee-guidelines/figures/overview-of-opentrustee.png index 9dcf53e012a0bd1cf098aa8119cb8b58bcf498a5..8b85d78fb858602ab53d2923eb02d2770fe27600 100644 GIT binary patch literal 26977 zcmdSB2UL^U+aS)!2#7Qlq$v?;(m|Sl54ZEi%Pfp4}N*;vb(Ps}IoCf}V=8=Md zD**w;2i)I3+MEg>5)fE#E6Pf1Lm?}TlQ5=XuboWr*Bu27Q|0yx1#|_PWX<XlrguCtKq0a+r0ThC;ivqDIBZKok_kfKZf!cJWy!1W zJibfWp{S0G-_Di4W!QX>n*4aA>;8sI?=9Eq%JMy*Tz+Wpa%%O+{pI~tk;n7q6aap} zAEMJJ9Hs;W0s?gW_#aOKTA+X6f022j#I~>C3aZzCTlXFjS7|zr>;Fhxx;HdjQ00{PO@7rPi_~*~ptOwJNu8m!> zSV*XtR7qQy^cfT#m-U(Laq3CRL@N5JjX4)69dKJ1TyQo{PfgTh;X9buCvCXuq1KHo z9BO(^App6@S`Sth9M&K7 zkKBZ^UxZE(&F_A$ljf!W#zh?LP9Ahx074_XqNT(CnhUpq@g;`~4deC~9{FTemami9 z!YyS-&*=P)0w#u}JNmJnOjU-2Lf8lv8j zaNo1l!#GlJpK%iD+Ud?3=<6M|ah;}vX)R+&zW#p0{7iM1_C#s7yVdw?O0p!D6KTRr zR7w^}I~4bk?$&*(>4l-8LHPZ4QRkGBazTR($$L#?i_mk)g0KnwfjhTy7s~7HUlZcw z4ST22Eqnf*Yd~{BfH;F`LO|hStxv0qC1Il8w%ZqUv`Kx^!!H{(8qtYlrG9l6MIn{u zvwpfuB21seCM_TIWhC1)-E^v%Z-v>H%v+R|OYVt-^^;*D61sjY`hs-)g>sF_7joPO zpRc*vE^$ieazbiFAafPIZdjkieI*N9=cuxp6zP{4L_hgs&(1{@`%r+3OH4u7@d8M) zR{grEaMWpM@k(hhlS-%JZLIfFdETP_oG;3}ZB#pNqB`*!sB%eSXwC*R&s75LnzhQ4 zL788SPs?A{JzpS$IioR2y-cr5ia2YlIP;9bj?sK465%lO`JAm!rk0j^#AR-S45q>& zKBaj@YuBiiCFv__>V&`bW+|ZV#usYq33jF{E^Q{3rsbD}<5z|P?C*Yki8ftI>wPgJ zz8>gzt~F~`!HP6sZ z5KD|c4T8g13Vct3Nc*GWiZ}AUd8c=1XnE8Phs(#nwS+IA-{p{%HpXl^+lAdVoqyVAF-0pkL^WW+y2!Dp<`v*Lb5EWFpod-63w7(2-!L zS4M6nJFY!UUU~{p4$ZemuCuFXQij?yl1;ruMI64FH3+-A4BO{|XvlAS%9&|YAus407=%Rwi>!b$-}s!-0{l!uNx&8uGM-e_@R9rQVMwMtp! zDA`JCV!cMM;2mBqH%G5DJyn^UvL}f+1gdsloG(lBz^k9?!NWO)u9*9Gyt54I)b{3h zhONB1Lap(qLStCU^rr>WvSH7W9cO$P_YRUI_NZzqe+oXkGhCZa`6Sr2*j(w&eWdA- znJJ_T+O4oG5L?R4RJrRKZkRs{opUx2zx#E<@O^HEc?cw5IJU1G+~k4S*m?>e5_jV> z*WDhG^j#?q@eGgh4qwY$_Upq%>FX-m_mi~eUcAgON?=rGC>P9eW}Mm7KE6fH4ygZt zF%mo=nPI(}OqMH4=%-V0y5tn<^zyS^DZ|jg_yGKs!lSa8*1|@tLo`owp*xGSIlD~g z;cHC+hyYROnt9NTTWt8-N}9MM+LVWsaKkoi$;gHu`QWB0-1HLFbQ{r@I4^!hi=pWi z1M-b#qpWgyO2paH+djnKDE_bBQ~%d4#Q*OA^~oPLt+zZ|{VoJ{F*)prcN}&1Y{0aE zof`lai^+T#ffc5JQQ zXxgvap=n2XrOr>yd*vvF&iZD;E7TFF-E#rPqV zk<(GfE$8`Q1B{ml!*ZrU)~DVl7X+{tLp8ev@0)9lTh@Z~Aq5tQ-QFGEa$5btx)MwUjb=uwqF z4AVdE)}-vcKlZamUw^;vJw54ipf@?k4JvdG3F)8f1idw)@E0jQ5|sAWk47Lth>yVM zO#Bb??J#koF*Vk}QNc6p19S6(9Ll7 z_ARkF^l!c=|Ap+cn`($Igg4t3|B3+7H_GMF7yBPRTQfG#1+%SN-s&dE+ESdlX0UUe zK2lE^iqdE%-HMXm4D@SFgI&*+s`@i8VpgAu#lNq2`bXrQ0g7e6mQ$DqHyQ5u)3G?9 zYJCcnA@ne|BWquz=e)trW?gceE>|GhHsDX9Dd?A?lN4!K8?pOAX``FBtB-(X~7A-Ejh4bNN31 z+eX4nq5AT~ln(v0HSC1%{Ql!(h)=|r%H+-Q6x~XlNrMSMFf7r3He)K4Z7*kUed~^B zcG&^{a2t>*3C0RYl~sZx6Kl|qkI>JCKQrx9XS+*Dtx0v4N4q*(6?c1wvgmq zglP+p>zKQ_EVoiSylteNIVy-ITy6Zard7=+3VqDK8%<-oFdV5@@8oUobtu3aQ9BtN z-!5^qFnd4jO=RT5`Yt1g@oK*Niq2>V9slVmXq8{oSDe(h?8q>tItmlROIZ>5Odqsn z=Xeb&el%V|Hdq%6!WA;z!}ka4_c<^RUS5UF*%*N;(vvpzifxEEtezJ~CDX<3T3kY- zpiO4+=be(rJ*82JV5dNI>e2UPW(Y(W;yzd2oIiV$7tcq^DX6ei84AZov<<0KQ{3AU zrfzr`gMcNsvxI2WR*S|!`1HzvIl$-`{v z^7wwtN>y$%hz(Kl3jLxUr;KyVqh+U0S3%0^!2^^C&SmGKUO%hGa%6>1I)h@BXU(Ma z7(2%Qfv;ffbC_frxs73S;m9y}kuvNX<*WQ-&76)FfOHm?lM6zaTqX_g-CiCpK48I^ zzN}zM-v917vRusDIa-ut-4>nUU>q9XeWP9He6QK5OPH58-^X=bS2!hUGS91iVa&}- zDx0@-+*YmX)k7%>55w(4??^qPcK1P0=_YXcj%Bmn zHG^nn-)+fd_u-_uW$p7yxB7cHYL#XdIgtHbPd#6r9pCUzwz@Hc>b)>N(G=`%YY^VS zF^Y^-5{%_@9Q?&1SpdvWRgz!UGiEe{-<++l&U!LZqO&8v-*Us^7T?y`TIr~cQ4(x$ zNp@WQ<~SQNcq>dv(azcOBiO_yy~bC%zpinsHP@eAF?WzYUP0+9r1qx(EOWq-88utX z<2H(5!{*f4W6hSndqBPl<#FtRyFbCp{_3%ASrcKGci5h#?=;k62q&i zy#3FUEq1)tUA@8G=f~|2-edD*#hd&OA1}Svt#5kEhpoHbU#{|gW5;@rsi(vSlY_T5 zeIS{vW95tO!--wm52Jn1QoL9>Z2&8&;V~(gY7{rgpXNX}rcJq4`qp4rN1N3n zc3yc#7j(L|alPcOb@VvwcqkD@NVC(_T<$}eTw7-J^UO>M+Ks5@;ciE~8u+i(UjcEe z9q7lyDX(_=ZA8;|%0E8~y2|~wD^TqrLkBN-P@vU4jVrvTaU03uiy%xJ8SsxcOTDGQKvKqZfxZfi2?U-qs-u$no zs&Mv^t{_y;3pw)4zJLvLr??T#MaP>GYb)d`lH3*URcR%3`E$q7OU~vpry2nWi+s7! zS<>`e*4Gw`XFL-G4#MoOg1_>CZC~rZH&#k=UHDYf&bED8|Y*VEsoEa;#M+k4YomT@L3(vyDL^@ zX0P0@dzET*EZv&Aap4$;fCu8OXDX&`DjwExeO2=x*|v#ZCN1zRU#QA}vt{bd!t z5ie&Qn}l_FBlWrnCyY`VOBGWi7V-RGJy4y4x61H@zqSMN*H_(trkzaBZ_w;{u&EO4 zkkfW<<1VM}hsfjtLZLzTtlgc5bz94VkO5I0Q~1q&6`yIwA2OAP^RuAXptC|@LR5RxNz{J zuR0#&V|Bkl%r*$iX_GxH<4>14G6q5@jqm!ljTm??8^Ma&j|Af6_d5Jbbgba(%hxZk zcb2I3**64}X?je|)Vp^c{)JdE5XfYf`Hcvc3+jNUF&kST?dEG=3NYDE*6F?$w$Q-6osP-E46h}dwrrh zp(~Hq4R%&i4em!K6Fc2xDA2_qSa6pXrdy8=_H}o5)qHh*j&i78rX+T#x#|O57P!>J ze2LQhmBV2Y{RC#`Ryq4oBe!>a7S>W`5*kLoUX$4jk%C-Ixgie zU^8#O?UXwzks)J`C#k-92l3HuTWJrg*K>nydBf87CPEo0gUqEkrX_O(jiY5(I9SZ& z0X)QFVc^|ti=Cdv9Qp^Jt9)@NZ(zok!qmQDF;GaCE4jfRyT2JWFDyU;EqcIAal3a&g{CZS4q&N+1aR6~jJWNauF!U7;+pBq&pR zOaY$7dXHRG1(Xzu>ffz;j*D6l1)OjoYN?i(rQBDa*iqf-7Mk{Sf*k5>UMta!wiZ;p z)r6i`+l)A0XLZNR83-Qff{~yR)#P2we%`cf*ik=smrt4D^+7g-9x{uZ4tDB1-R{ch z4c3*{<+oMAbkQSYl)7gScGaKw^_yH***uR3)#d%c*Z7@cz3)u2ZgFf~+v2Po%*Nyd zVf$b*Yn02fOR%%oH{7>YQGrL@v>mMOywS8ZDT_)iP);Ba074vGAOJ}H8*z!uOt~(x zvG5k1W30L7t<=M_Pq3yb7N}bI#DgQ>=sI7k4EJYzO$@$$dP3yZ&WgrN-W!SE64C41 z@AGMGtWDw6vwP-1^aS}8Jt;Xgy@yKE*gPI6ztRV?ACzzCAX^<=fVh}=erf}91Td+n+e4j4UjObf6&s0i`ZU8gnkt*w3SDCruKpI|5&kMjMO_jOL^dh(l{br z!9^txKBmFUfcR=_Q10W8A2zmkkWfQlDWL;ysWK3&_ZNT<g|4vhOBHnYfq zLellSZ&s{3ZDhbClr}856)Tt7jmM+5Yk*)pwa*WzJJIJ9Pg?idNP|f(*nseRTxRO5 zp?7dRyZ^y0d&M5uLq;pDKY#Fv9~Iw#XlmHfRirr2zAZm;5{Ji~hA{w-Cp9Z_4ag8b zD$xNx{E8cw_8qyAQuf~{Z>IqZXl_K*&^Xv#*q7c_NW;-$JuN_2oNj$2kPUuv`!Q~X zfbn?PcJ*n@JE8$5{1zUEWRrI{172r=Z<9J$0L;na8NXZghWs0`M@&thiZ*S3Im%LJ z1t6YqpK!NN4WQ+;g2~Dq$!Fx4cNYgJ@SC{7FEuRp7y1^nF4JbOp;~OS!MD%ZaJ)W? z;1<|-WJF4+d?VhD5yfwp@wLKwynm!78>~W!>;uI7gs#}wdhK-<=(FsS2`-;y6w;aF zAa67tf)%)BeFv!EoqF(1G`su56F*bhqQ`jl()~jKq)&9JiC3f?zY*8OdXM6;4*4gT z*bktor?T3Hc;pbxO0yv zz>i95fE`b;*!{Q3Ezf@A_biL-6y}OguBz~bVYw=&w~zP(DKQVc`$BNsqL8Nl^Mpju z@2BmaQeyrHSC9-a1~#s=HtMet%?1TUSA_wHg>GLKE3pObOVjm%-aYfEz}3|*I&dRL z*f#@z#ESOgXlp`QeG|>03_6YZL(`fY#~`cznj8lQK>vPYPjsjH!U~9elbFhy|KC?o z_}0=mfJ8Tmv$_HGBYi119$r&@<^&n~o5PT*2J&x|gCQQ3|BA=gH}+}$^EFvu6{XdKKK>VS$!S+De*9L3e+ohL??>@p zH2j~3`wI_Jx2jC_8}U~bha4blo8#+nZ}@rDnlJ!^5IOj-SR%7OCsnOfWrIII6RrMN zN^2Cx<2_CXU`-j3!~ebo3aC)CADzkq>xbYn{CfWt5BGAPAK8)zUC|S?&Fi`2?vs;_ zK*sDZI|YDU!3DmdGG^BKY#c8^Jlf}zi_?#v)4j+gZGYe?a>~n@C>tz^;W%& z2N+U)pzr1{!*pC@`!8Qbd0_^eCNjoBF7mMZn(^SEzJ0gNb++1tA9wnFN$HPkl>b#1 zd)*W@3)p-}ve62D;_tiki13BgSQaO~xb4D$94FDG1L$i8z(gFM-S#*6&u>CLsnE)x zk|zpWnq|oF>k0IA9`~)HLi|h_i#&lNs`1U??e}qFFuK7c5*s3`yiO&9il2bFOxy0b zCYCnwYLt_Ie~Kmz${r6Ar6k-BFwR{S0gfkgEvmu^1fMJLpDVwG4y~tP7KW^dqqoK| z2N&Fp6M33=W1T<$i&>&JGuqzTZdqhHw8I^vXJ;_)mhI*EVa} zt~24PiC289DOWCuZW0^ahV_#Ca-TKZBwAL$kVtsMug zqryR!aU8IX#5QMfTv1p-?u-+AI!G1r$&*Bx_)axv<479Ak+g_ZtAg=#@XWF zftvMaKYW{g@0A-HJ*Q%5-f!|}YYN(aPmZws7n`9$vce7XOR9~rX&<;AXE&O}5`=&; zubOx%+bY0Pt$ctUfKCF3@d%GG(E^T$N)o zAbjgFzxEmIo!E7Urua^m}9GzU=%M@QKA)ot6*rv@+6cQ^K*^!vR(aeMzjt;5!XPXK-g{lVZ zERiDM!n_pS4168qF@Q&TUh^)mw4v^u%cB{^QF^v2W_gv8?#mqmk$Ua+UPAZh=wZ;z zJ;AGk39Fe*y|V2b!Vx9IO`v zOGk616wCS<3)6E)>PeE*)5AX)G?+w9~Q#Iy8mPT8^d z>$4mz<>YY%lax6`nZCNIsx(BR{FV+QKPI-m-W@Aw#%m8h&vN0im~Y90Dpiki`y&cO z$vtf2ct!abRE|h>&r#3$GNJ@@f?eLSeklI-0*^r!;nVH>mtX8Hg?u!|nI96t`yGW_ z*%sAy8`AFLGS-I-OIUJF7#nddIif^<7A<30-Rv*VX;D=2s{7;N;m~DLdLO`mnm8e)H87Zl|NQ3rCp;PMJ4zrucPI z_r>1lQsB(cu|DqiRMgKEfSn(!k!={c2K7Cv-=316;DsH@8rPP}gobf4C(>LbM(JdA z*4BDtLO)J!3o$uJU;A}E%(Sm1G@oO~mwBmW$da$y`espLRtcjwzKO~Fp}4A7=Tz

K5{A$z zltBoNy}ZIrFfuZZ{j|Y0G?>x{>TD|KEo9kDq}9^)LfP+^l!&_eCyWB(L;2O zpMB;N8^|Yy{VdV4eaPi?$qmg?%!NX2LioP~De<1Yha%fuZ;U;Wi zE83T1U!eqkD2Juc=m?-_#aaX@O_v%i$02o zCb(Dk^7i zCM{kB0^G6-i?2h_Ui0~P4fL)XO_Av}(8J(k z1KXSoB{P7hGsou7{Uc?0O>y<1q{1)W4Th(YWV>?(y?Al{Cu6pOd}X6}gSFuq*=qCv zx!h#^(aCh#m$6PKwds0&qe+?wQ9=xGi*5kgO--K@HE@>i|&fU+Td5k?rI z?GpFs0y#Z`dk`R}m5yyR7l@Ncv;FdqsZlTwX+@J?7l7RQ$rw;eiO~Y+gPvDrm#_{! zY}3ji^CE&<@Lqot&GbUC_jqEOBYEc<9-5t-x*iW&23xnARYzC9yYAevv_$w<^+=aku4<5 z+66HPvIrF8LsPhS-|7Vu&)TNp-nJL#Dzff4!Dq@bA7CZ_v##U%4e;kob~G)*aV>9Zg@`yXhUA!Y_QeT_t(*@!}D3 zzv(2HY#bOGnqLeUC5W5e^*>DI{~=~#eLl{QFPgU8ET22^gm^-5;+f_CP5d8h{B&G1cJ-}D|PdJvyw`trTv8Je>4s1 zEB>uCv@+Lj82qL1&j5WlOqBU`(q%|abDU5Fs=$8D`bPr}_Kh)zhZPOzFCpWfuPs@6 zqSPKVQ<^+_EC$?a8<;AGi!ljzdPMjmuJQFwot^Rk%4o<(Ku^j`qa?*`#ZER09*8pg z5#6&|C*9uoX^vZ~ZoftN4|J^R1@#5b5UV$QSgP?Y>BtH_rQD;8D6!6}vJmRtPGd|? zA6!j+`GBjqyy?8nL8o)IXyRNkJ#~AX4{ErNspxAbr&J9ctShqm#>k)liDaud!5d2O z&i48)!*7*Bca+YrKj@`59wo@X4t~Wlde0)JW7N}>+ekNqemyrq(y?G&MOPyQU6fgO zKI{xnqWSVe`y_4GM6ka{d6%_i=fHJS_RrX#?&a~<9N zgBN2ebz5;f%IlYoOwtw=YB^!b7qB0xWtXcrI}mOK=#>WZ~_P!pS7NLSdA!Ye%! zm#(<5h>n{^QZWB%9vc6Pd!sSa`Pw^qz6F2TyniTMd_;>}rKYC6#Eh(j$d##WMKdPG zpc{)lm@>@==}tE`$Arb@`yb^V?9Xj>CVpy8%E^X5^2V;M^QgPlZMlbQy1M_!9Z$nL zBz%vjgKgdzdld{x&mWg-Q-X=Za3=#E0Fq4x8gm@qoZqLbW6cApc)2fkit(N%WC>SMK~G@! zG&v7!EzrH7%MJP?`fMm2J)kW}DY>2-Q~!cW zp#=-}f;ckzWBs}3Z8%Xh{GDAgK6+c|zn!ai zQ1h|WtwH80Q)}gSI)li_=*)}BqZmTv#2^v^f${@l%KhdU38`!-9t`&pyzlmrI&%JyH$?bpm*1pvN zgW7fAX;Y}}cGA+E`~1onbp8allF0u2Ko2{7SEwj?wEiAic9KENM5CN)a6t&k)~nx| z*Y}R04_cktvfg8Ylu~mXn7%sizi|!Rb`(8ob&wYg?Gi!D-xy*3JElQsnL_mwKy|Cp z9Vy9ssB`Yiq~RH5PTr+C9Z(vwjEeGyHE?=9OZW))-!?cWQ=<9%&bBtyVT9#b!T;t@ zxBV0Izg?qvq!XDg59Kn#KHZqJ95&kn(l{?D5q8@D&CN_S@&r*bTq7a`Nkp7MiFo`s zcP*iv0!l>dVW_AQ|J#`6_V6gJV03uWLT_asv4YX9`OuKK|Lh(JzXq~qljeT=5=V4R z9S0Bdi#nirV7r4V0Z5p0#P(cS2zT;-{`&tB=i+Y?BFX-8!fOQqo}RVNZ-??97vLSh zAuIdKKm9-CNvVuLSHRfU-mX`J5d3xiWy~iM9}W>zGQQkErh`;`HvtH&k+|~7Mx#lw z*fkkz_;G{B=yd!tg0=VrlF7Er>losRFVcLE=1x^Rq3pG>dNG6(JJ z;*u#YKRAU9Q0{Yql#|#4COxNnL48p7!S=QZr=zc#agt*v)1)I!B+Ns#xExAMpn6I> z1OHbnP~S<*I12EN2e`mdXEN7R9eN_QRxKz)vQ-wdjx3t}qGd6FP=0H>Bj^bfVYcqd zkwnS6WOiU|X-*Pj^^2H}mV!^SQKPsFBv8T8bkYXUssbuEt1zpb5*?scew<;@yjzwI z1S3wt38QM9#FNq+JD;IaXQ6n zGCKlxSFF^7g(YY|dBW-0lnC%H^k?v^l5!w|6K8i9XtmUY*9SOvhFCVA}i-<%Lm+sr+Lj z6?>^U=<|5uNrLxRL-72RE`y;~fT4_)AoVk6BDbx-}k+ z&v^#WAC8r4cX>x$5Y$>!(d~D`Y=Dm{50d@&l4lF(#^(8t*7;wp%&oQXT-QOd{Q%^1 z&x927`{U=A#N&WG+e7il2+wI>vFjS^*RrGOc)VIdUX;$52d`ht`Od=s_4TKOsN{Dz zu5@<1uLZTYI8?qwBgOOB>n+k7IbmGk6LPy4ASiiADziT&O%p(Nlpd) zl4ty4^NPipNZKb9)7C+_8Q|^#1ov8WYLwnssYv{4Jhu6;*4Sn0kc>`+kv`$UVQ8$9 zRnrpdxW1_IDa6?~;96{(TQHBDjm{?k?M%_svw1F)p!X06E!{?G@H zD9(Dl{4wb{-QE499TjZ$_Tju8DS&b+b4{Q-fbOCre3k`~wqT{(QP2VfP|WjP;!G_& zR2d~ZdLs+)`cEP&5@15;w$Mk9*SOKR^r++)Sru*Vk$S=`B4=Y_`^es0F2zq|o>h7Og)BP& zeabrIGsW?Q=xO!`k3#wY$qL`GCtg0DI*%8)aR+Fq`b|L#G(eH=C9^OvPToy5-Xei7 zqrYP%>!D(x<9}iqx?*}<#Wy|w4@&6x1hxe^1?Lua6`rX((;#yIhRdx?}UBmas|>i_ol|EpNUT)OoAJs|B|uB<;I z6Pu!FpUD0HP9p!0D$4&7TB^MWyS8-X4Uq$<%b>cAG^D7*wrY_C(QUH7tA5%!de~U% zMw+Af#-V)#k(9)ms8O2mi>v=QMoHHpk_DnUS3VbNHOZ|<>OIU#SkVeQGcKM7E4jC- zEntw#PZ0FyUk5!cFG_Ff+xNFxt@PZ2YVCK~UWrbNgSFU&Owtxg78-LlG9-fApDO+1 z{BGL89}<-ypsmy(d7i`4%jVC!k{r5JQ(iXrWVN{c!z2urpu@3u?JiPpNR^nv=c6ec z>o-7Qi(Fk#)IGwT!2jCru0Co(Y|k8$X&D({AN5geeIsa+FGLvg8Ol)fCxn9VPB4~ zh3`K8DrkX9I{9ydY(_xgJ_UX>*>5m1&8861z5jOBx;BE)RS(!V>!N4pX z_P=S-%8p}|Qh52V|ACV!$%XA8QcsyBLQJb`{*N5J2_cY!B} z$`)u5*mcIW2;4kFbL{`I((#i-aWcY2`7wx%%0PiF_LALqh0HnBCz9;!>b=$8NvrZ^ z4qyk4pk4Awpfz_6*ZGlQmn82sTe8Y}qs9WgjL|Z;MJW3{$l9{Ng-_?5WCHNu%s+{7 z&u$eRcxipkwfOpT8PM-w{4>bHJKgj$O#^%&ve~p73e@|f2L*rYj5sby{A@{}m$npT zZ67&Bky;~z@jeEo69O=5) zEyLH+3e+?I1g&!t$va#J`;ZRCm*&SzhUqt^kbud3x}j z3j3VLF|HwAH&4koA<9qF2MGsn{sT?lzoU6){prPXJKNCMn&T#|o{xO^Ld@qjTo;$# zml$}K+{eaSkY9abLT}FEYdqV6YIuBD`K`}6J4MslFygDSD=OcCw}ybEhi~K{uF;O7 z{j8zv#5hV0c^6-`lf2MCh0l0_P*u3j)(e*F>px32eQpDn@9h-z1;=k4e1GXNYLA<^ z))-N}ck=UR^bLK5tZ4t`;Ms*@XSs+YU>tkH`OdbHOJpb_d#rBW;#}+8*yEOQ$9zH~ z#?{o7WY^B(x#UVE7bb@^(E~O4-(B9W9eQdF z(=hLLD2;hzjeY)@pX&yTxonRBjgFp4SQTdOtzjCUFgvd~+;4@#X&V0CPsA};_!o1& za_|!}@+Vw4$=|PS<xb%=_5e2Hr+EcQ^; zzw0_K6Hvw?^SRF%niuqqE}G<}R6itBInYgHw|_6ga6nf8m>SZTKjLXEzNmx7e~5sr z*8@LK@lHcq3D>61E{aypO*zrNl2%prm=DzW`gtQjN4(rKGUgvdmqeU*&FYTnqHZlr zWN%YCTrmjjsh_okBbCa>gt#=ua*Y|5nCX){qR+59ESZ?Ez8%va(56i>P!{2~bAG&* zs(hDMOwAIN@Uj+ziV~$6_@zKWneZXXL$nj^27-(6cHAGZ*HTuIH&Hqnm*ZUv2#vpf z#`+~q?+jEx z$7xVDW-3>!uM>@}dyM8)6|p@!!)Z6!Odu+BBat7QU@*i>QjiSBpI;z#i@~7eBbHn?nxQCbs*rdr;k@&K#ba zyX=JtPwdcQlcW4r%oigL?b_3gM$$8mB(L+60YgDenvDkt?y|sdyHj-w#YN3$ zICI}bJ0pQsj(2CkUj0P5`WiW3$OY#9@X5FCQ@jua{n16P85|%fao0sf+)qNFfbhNs z+I#M8K=|XwaD{Pv_pJ584|6@@xtTnNnWt?1g{ z$-$;55k5+@*b89SY=O=Z3pv$YDzILf|2HYz6J#n{9)#wzZ94PB{ptPHd2`ELFa|D4x*bx2i!3H@y2 z+}M>%NAMW5Qf+Lq%Pi6S%$q@JV!iGU%w*N7oc|%`XCPdK zR-#Gg7_Uj#98GN4PNmLcXXR41bkm+&s@8X`n>V{P#4RRC!&y>Wcv*Rrc{zR~f3BxY zeLKFQ*gYn}S#n&A=@lH+L!I{VyP<&bo0E1TdHo$2vdK~78s}&DA z%xsnU8&Ic@f}092`ENmKe;31m7mJeX=y;2{JtrmPQUg+q7p79A$6nZA%_3gTUTQVZ zAC1>5k0Ld1pMWaTb4988-0JtJ@UKrdaWs$;(`@zD)2_GVeC%^e1C$Dj=)G(V48|1x z((e@e^`{bHC)L)bjgPILpCMG(X8L)QA>6n{K-Th#PMa=USa6~Vw<;+&(to_0?Vs|8hjEKe`vu(oE#3{dUTr%Va2RLFU$h_80hS8t}q zZ^(|$0`ea}*r`Bp8(*XsfURzNzexIvvo;+3)*64m3vD&c;Hl@)id;h8W*%m*G#=P% zUJ%aQGU$Tp^js}!i`nh~f%%M_jgD>@FzPY#`yS|Lpt2#hP?m7u*^5-z~^pc=!3Fo9Fj8H;-`Q=##kTAmI83lFM9O1P!R0!cTg8 zCMUhE>7m@$Nis1v1vExnTtAN_-0^NoKHs~Y{BZv>l8oZR03Z`(6N znm5y~wM*d|gs6Mn!swIz{y@o}D0%Gjp7hfqnT1UB)}(r-eN^ucVAr9{LdIW@Unu(7 zy85#~a_m&zjiu%M-n=FVOsiC`_OBK6JPq1 zUTH|IUN_ixm2C%TBdqVe?;kzxfB3b~p&$!i1*nr#Y*0Fw61TJ3Q=^4NQeOBg5}>dC z^9*jIU#+J=Lj6+j&5g+MYCFA6|0nl;OQ(~ctO~z0>0{cxD<^XOx32+#2|hf;O(3)4 zc8j|i&aWOEbn5R(eya08r~|}{?zK%@sj2v2M`9Dfz1lKF8Z`e1 zdN&mLyU@h0gb$qZwAOcevu_{Ahb@^aO0A`|LGN+l)u9zIvsn^$9^gNl*PxREfBMy9 z{2tAIiha4L1Y`veJ;1^%nYX^A1p;voE1IpUx8xWg`?(LN0nCIUPkp`}06pTi13+wL z%;qdNqip?i1uoPEstGG_*H&DBDdG$Sm*q&;UFMz9%H8t}$F&7T0SFa?mdMZYkRrZ3 zL}jQ3jJGy-#lAg%_2ep1$kQ$#+u6?{(-(@VWN@DE3wN}{Kzsc$>J@X;G@&@ztBI#lx+Wk{CZnVnud?anqab$K*@Dfj) zUrDT!&{GTiqiO+o%7EOfH*0ypsn?{q@gpGBN_d+fJ1b zLc(UK#FSGZNlqa{DpMkn!-z3>MuJ60P`D@M0Gxyx0uihIC-7_->KvOC?g0k zxBnxFc0&ZJmUd0u6?0QJenU&2*G=*ZGpf$hy)%z>qC(n|^xcm1$Z*MPq4YN%20YO8 zVK=_uXf7b|Kljc&GBFTgzjR+iH~lCt+I>G*>{kr_)(sHrN`BXlvf?4mT;YXY^1;Xl z*F6C+1ghKtLo8eu2(StW3V`8^l_f5c%I(nqCIPfGMTx*qL?$?rS)ZTk(~I&e)dCD3 z<~fJz3ZJBz;Mf_tSp(nj!Wm0Y58PL2Pd;#@a1{V>7>#KMXH&I2hlFVMXm(-%g=#_r zII*8Z(7dE>Z1fzX^gSy+V7O_0(b9*Mb|ysm14e{6J{rv3fz7z37LUO!UkSgV0M_;U z(NgLL^~}%pgSC&BR$H(C(W?IbzI!WXF5{WmwAuL0U86$j@)W@8FrXAl5*w6zc>u;D zRe_=h8x8uS`w)Pnz7Hqu zE@59VX;SxD#c0sS5b^Av72fD?RYE8>HQ6hm+kLMzX!gazM;L$Ort5$`{Pc*OGWij` zf{l`28_aOD9W1inpu5}-A2#!HP8rt|N z1x=g*bO+$9!S(c=KCxD3)sL#%f)h=Og#emb9(N@uF&8B6GgS4)Y^`~874 ziL`JDmRLGUhH1RmOO#8CTuhnM%0>EirwHT5Xt)oPe~J8C&k?|)f_hgQ!){F@(eld1 zlls}qo4fQy(SJq zrO@TyO85o=e`41Yk#wt1@QEvi`(}NnIVCIHm?k0e+mH6YsyX_;SFk}xMs35rY1c3n zT}m6Rf5-Is@$iDH7!Ig(8!izL1Rc+*!T_+d$va)uXfb2XB$u>Tirm66`E6a*u);$S47=HqXvlz*Z; zR6D-?t%BnlM8EPxY5#s|-n&2F4gNWzWS>2}I23T$UNb^th>2gCdtctg>Nkvd@J1Rd zT={#o09*|LfYQNFZ!p^rV%oG9FZlO-xYdlbjvX{MFm!Se{EPH32W#WL1$8BWPY3Po zusYdT6=jgIHAS`cP+lcQ$u|;I1xQV1)ese#wu?TV{^sBxIC$+5P|gA`cfX9yBQieh zNi*DmMUqG5=v%wT*^0^T3Q2jEF&9t0Yf7wpNEh7bf8113M47!Knnhtuc>Blyi;Zuk zdHcq9VHJjg>kEqYZLB({O)gg?Ng1_`u(Kvwv z@vyP08FO*W?HOgDL~X1o+AA{Tt3TpZ^J8k?$qutj(jrqczGn!l>bt74a0_Q3gZF#Q zT;d;-niaA(a_SuOa#L!zvPy|=9hLila5*G6vwYSqd3lX?sR!-tb5QNaB5VYpT9M-| zjDLGv7dU@#|K1l2VB!hV7N(q5LSr4W*xwpQTTjJUU;O0^cQC?2Ryn^*)eA2 zJiR9PJlELJ)#WEe*`rhs;z#4+xAq&E=ZFNIYoj@Hen(gu?|(O{zV7nW+*=)K{@IdH&Z=S9 zb3iItn@6lNLr5d>yOs^!Y)KADjR_ONA^D@wdL1CS!SdYXmPuLEK+y}Eew9TAxJdRB zU*g(dbtRNvcCbA^VzoQ5PV;a)Y|<)3wfk7N{iIl|*RM@UY)uq?vAMYUI<-$Xuy#Gv zvytOppd_^?^aFvwox|a@(0kWR-q*1V4Z9jzB`7UjWpfPr zEqe|d^s9er6VLxs8h7epuDc@nICSc_m9C?Yj(p9E!uG;KmN8aSQlw{$%9q|p1Zn{>Me5#sp)W_TM%c1Rzt|8{{8 zln}Dd8I-8>-qk{g2Tw$Wc1?A;U5bioDQ|B6LIcG}aStrSX_lAY+>*jj^D%JL!>$pM=UuAMT=vPh?4JbM-nTG96u+J_0c+Je*nGSwz2Q z`?6}(gC~NU^o+my#xp4XV~ajk?n`h9li7%|Nf6N+Wsxu%jR9@ z1niZ}4KIiqkq*p_E4C|+Fa`r$Cjm8))R|SBmG%^neyM0Dhc#^IX=(DN)&*tS79<@Q zLExshK)h$SgARcklaH*qf*Jf9-26tyWQ8AIT!Xz&VZAQ)=wj@g;=;bdz^qHjHsoHT zmS3Qk8^HFG<4snSMWANcvpV}_Y7>(SEhfHRjjPTPK7@w1a^ssPijF2hPPSlEww;Wy zX&P1o)dhv6I}P;>&5*p1H{VFe3BT`S^`#M^o`68rP{+`?@~IJ?N@pj+mZ`mhvfNpm zpoXfcT~_EG#Ej{bY)jrZgZLs}pK-U(O%!_dlOVN4QDwHOo^8H(xn;-^K^`Yb71UZE zVSXX*)HVUY{!0*%rqh0MLY!-Uoc=dJy?42Y77s^#P&`(-4J6kFYu@s6h6#QM#<&xq zEtG_*8vI-!J|ILo(UWfXlRFhrwp2%vFvGlz0`Z4eNV_kG8voN@KHD8(6Y$e-VpUN{ zLN9jutVFoa%;pLoq&MSfBf5+c`d&xPK=vGwg<|M=qz#m`(>uSCu9yw%q;#I0U}PV# zc{PeqG!kwioBzhuZA*3FETauZYemRR`GfGHRoV`QC0Zj)r5W z+gbHGrsV8Kx}4OHT20i^^Plr)?l%}e>~jA18(UiYsv83hC{{%=F917%XjYZ~_=Itk zs!a`xC4KLqt%7LgQKG1VgonUL_vE}#%m5OC8o4~%C50A0^hlf&p7B(s zBKxj2I0RB`T%9i(s*OY^uNvA_J^nh)XYpf&|CczmooY7(*^xGdd2_>IVk1@od5;^G zdO@k}+f35y`-u+nW|4FS@!U#W$H#8a;-m&vsd9?2&7#))O<%dC#g zRlFZMV9#17yQkm7#qQySB)S6C0&V#l0`<6hTjp$I*)#fV6aqPM9mqV6T);ArX;^uD zECiJu=7gM}_kXeWg~{kXvtvA5e!4_OE?aoX@j%|(ngpnhE*Euhg2-6@1%cOJ8!y8M zAJ7E$)8$Ht`%aR#OGq-#h$e)0grLP>PP_!|rkBnv_rUDs-TL6$$%HqKku+f_ScjW^ zf-FH`CLt4_2vDf9q_RuUuW~Q&0N@oYurg0TyK?P{+Mw;Uh8y+4*Ql)G%7@z`JY41A zb_B$UD&Z!0eh&AJ4Q@-XSO+x!EAi%$y?`(zQf!ALNII^Sd?jYIX_K#cB=<=_&>Y`? o^gJL?1;lyrg4l)AP}$wWWcS5N70f|sGx!rDgX8*nx=z>s0gnmIwg3PC literal 25801 zcmeFZcR1Dm|1hpeDU=FjBrAK99V%p%&9V15D6&_DL`K%JNmh2&vB?O>%I4TP=U6A? zggDmyI!E>Pet$ln?|uKi*YCc6*L7dNKe~#Zuh(Ngo{#woexxFI@%;7k1Ox;Z73A-! z5fGdL5fGf1Avz2ECi`Xc9Prl(XEiw)f}&pPCE$nCR?^DS1Oz1!#Cs-ZfS=Djk=J!5 zARuYM{W;O@_`#fjz}!&bp0tL$;YvN|3-yA_LakIY?M<_#sn?e}-^UZsSJ3cWc5Hq0 zjstUsK@W1~KL5~I2Rkv*+2)Rb%G2YQSQDlh9#Y-CE6^}|pV3f>ha#9Hl9O(>j-Kc3 z)zDM@omoy9U)0p|Nv2dKDwg|(ho>sE_I*DY&4Jn%G|;+-MXPy->?Z)s2ne3{H-V4- z1t#dehX2*4v!DL;SC4u|%x3lsF@7`qL^4F_oJ(DDbn0=W{qgNGMD*nn3M3>Ak9r`_ zga`=0q`|dmeg`|ZZ@oH2Fcz@ALJGY1(`o!W*C*)WISHPhdk#NIKrmM+#RD*soS+O~ zQmdn%F_eISnZS~mfZ+Aa0q(dG9wV~G{TIOTcmm)_f}6g(r-0);CvZ>R-P`49D>q`O4Yi<(6@L7>;Bl*@Q0}Ot-6c#{(B~PZAQ)== z;GwSTy=kquK{Z>X#Z1~mlgiewsPYKged1bxL|*u&?wi~fopx^X>-BD8_Axy@^sP%C z(l{Er?j*kGU`e&U+|4{59$fN8h!rl9@yRH$!Tr6BUIQ@?=(>lgV56rhz{zs8_^d?2 z%dgiI$H#4=y`S>KXLLYhISZ%ptVJxImEk4HP;T2PVJFw+trk={U7NUfiwAVke1C9= z>mw%*sP7?&dWF1p7i@N?fqP8TL&z4YR_b{vXMy184dn@iouhZLO6B#H=e}rrqcS(y zNjB}T8NIp9d^>@f--h43U1%pooK^kt+N+gU@r9V^i4kW-iI8&*1&H@bkKsS2-fZ2D zvvUbYN3l&8sMg0#Xz0d>9kNdtah?TV#1YU+DWOj`Ls4En_+J0BkVit&vJOWv^#{FI zP7NJhI+_+-ROvLG&cd2E_V5Dkx|8?f_Dff$u?PVwtLPBEoo7CY6miZXB4;ePS(3hQ zSJYgIHuxCkSzyX{v8$pK{xIV44#;NI8#ArCl@aXuIQuguuSxGpV@YvM+-9EJx|_?( zqESIHEfwrxP2T?wqtY7V8tD@Sgo(0j009v2$84Z99L{CSP&1WO;YKy%#-{ z`Ebg1C<3lQ>f!-!h;0jr(A_H(u=ee~lfIN!8O3pbg~i;SypkV$70(w^!4cQC)tFv; z%$SK_1GlwJ&TzOU2RG@^@HN2}#*JLFMpv@GP!TxQFHY4St#ofeXeaZL$bo3|Q^Y-8 zaE^*0Yrn{ka{>a%BI_b~Bh~p&az=w*IZb+> zEKJK6rGhHCp73Eo#CAhOPs~pQv=6bYz2Xy8%JV@})2U0yg=l3LtS*%%m8yuiR!bHU zf^l{|aLp=sO;N9NqCCPg{Fb3Gq*#aU3)S!zTD{$O-ctvYd_b*ij244-!(i*2T8lm3i%3j!FzG9AjLY4ejh-0|&YccT%Ti+~ZW|E{lCX ztZQ>)lbY2wq13rcy-F{N%>E4CEZ=`_j{;BCA$DIvT$jhKbi|rt3tb#Braem_44u({a#2CvSIof{VF+F?m`1a-3q) zb5EtV{Di`o(u>5fn(g@Y87A9=5XA6;DT=bcx`I&w;Duo}pGV(v+GvW1ccn4(UFzTM63lT6*EHv&!bL5gImjlb665a;v`-J>)qLg>{(O2`E&Fc(Gx3sWteB(*tIpfc^{>+v3>OG?TBYC_yv}MkX zsC*OI1b#vBdX1ok{{QIB^ndIM{C^Kn+v^!O$zAd4t??N~qr)F@(F`o9N-754l44xf zxol)@y4p#Ln2RUf#q1Cb_)y?^t3l75i7Qb}Pc@jCS*pk!gN! zzxiSEk?6ET{_D~Mkb!KL;)Y1*`Wsl~0Ce@#uebpE#+z-YW%Pi#dShWUYF9-(A-Qqe zsMJ-qg>i*tWjl?;P@$-JJ9q7hv3Mvu8etMAzkBiPcZ3*hN{*X3XL_&1_DbKjCyzb4 zHe3=?;d28Yz1)1N&95SR?}FokRO9ytm<@g@`2)pc|hg$0T-Q~Z7|n(5Z6UTSM`72I6sxvCX5UB@B3Vw;CB9yErw$*szC1u^K|NS|8V z)jky6dAyOk1~nE}Qmv&XRnKzVlXRMc4IAlryE9d5hxRmqVo?i4QZb1sK~aPx{`SH} zl~ITrl2%&9g;X&8-Npk8r!V`eSL#_forrFcwZkkmvJ&5DZ2?_jkA* z^6dj$GtzuFRAH5=J{61UE6wilsjecl*$-#7eU|5b*p|)|%oVAbmp@FAlpnPpj^7pl z-C9Z_>xR7ae%~7%;+oGYp8NXgN3WixV9of#^~jl17?&BFC4|x88uDj`s!!#aW84Dg zFk!hp|BGepxgmr-!50Z_cI^H-VI$zOziu11zonU=p2*u-mADVsW_jq zV!)g;EXH?KsW&~T&{m|y>FRm(<)jXf_O-*J8Tc|+WrKs@XP?*bkhgRTKPHlG9GWN^-T-gcJAXinI>t6P+)RQk5z9yN?fVn~N){x8}3?Ovpk9FYiCtxlv_p03pyd5YwbDyIXZ-raBz@1 zRfp-RcK$9|kKn8JPGJA8j`4oMvpp3jKsluy5J;+K{=?<{RJ9A#2apNdZZB zQ$ovpjc0L+^<~2vt0SU?+5er_=AY-ke4}X3F-vwM zsKCq5GpKd7=<-R)@kYze@y;pekvPuJD%>9&SY`y-7PlKti7HV8gw@_2sThDVJ^nm zzouoQb#j=NFzrSJV$|6g;z&Ui(OebVZY?1G#@-AuFbdAfOJ<*1@U(va9;>k&HJVXc zS29V1)_U|?Zp!w%IJwz$?vm#-uG((WzOQck9=|!Uq2=_^@)kU+1#J~o&p#S1Yhl2> zsZ_)yE$PfGF)F>^Bn7WQ2fb-5<2%#-O|LNzFJwht+HA!mA^TBZwX}N&kFTARYz3c@ zudlfK+%?}mLawbz042c{CbC*rscAIgsLlf0{JMz@1*;!O>Cv%#@u-h;lc*Uf&NB#8 zZIh*MYsp-ipe;>-EJiSNkBElsl9gS(xjAz3#CRc8f|iPKFy?2KzR~Ktw*}QTB*XGz%A7vmcJzoY07pm#8jc zE`L}`#XJh937EZ8S;T!{&=?&_=NH+nwG}p!YZ0ue{GmdOaHuaX| zizxgSM&;w<+hH!$EX_W)!Brm^s*8-$x)6aA0eFfH-&#f)@ZnfaaR@^y5!T8307-$GKKVBGHNOLtrn*cO(*{il^+;y+Q86i zdb5T`_0iurI&!3|_x#EmXdmUjsIlAE8Q*d@r`8z#;zA8h`orQpgCsqt6mF2=0${Y8 zG0bIMD;fKCu&2KJ0i#2O{!Tu1T!*#1)ecH^`J>kR*NgJ(_Ve%_lZTe0?_b4umQ_)| z_VVJ*C!*}=AO-^Y_oC>~>P%CtXvC#+GN3|!NT>b+}*Y%U$SYTbE zjA~JWajVV}O5hf>Km)D6U7fz6h}N^B&YF$wuyfBY5neCae_{aO{UsQaNt=qI&u2BIi-MzBzvFDCd66;F8YN zXY#9v-^R)#&w0Wz_vRC;6J;0XJZ>7E=C?55EFoDn-l)xZoN}|=XYToRoK|z-Wl2d` zYkVX~zU7M02ZKdzEC`dtTZWpyjMq`k)OWT1z+r*!@$h0t22!z1^EUs}rqWoYDMM6p zEZ=En(lSBm%xS%wl$kD3-^LqE256XO--BmRTlG;>)@io4(%2QJTbc?PzuKeQ2cYc? zi04l~61P#iO;6-;XBc)_3;fglA21KkfbY*gTovD}maTX@xqp5&DofPo(Y{yiGBmxZ z8LUi(GrY433VP@PKwT6_qDN&+q6`kNH`yw+dwE#2Bj1lfMy-4|fu`a%l zxAhLC;xu9)9?|Os+C=SrK70=)9WTr@ay4mg*f zQs-LnHMT~FczgBLxFk+iMeDYz-#jhg*ij~w-tgB@Q2BAXk{-qtHOuqDK+@-f7_7)| zpF<6SwZ(+NuPcQ5KSuuX&8uST<`@_YfWW2kFv)|>Llxh{gPaiBajwvyC7U>eN!~`- z4Bj*6)4C;^4u`7kPG#3nE&I8#32VoN6mvY(^)Kei{>A7EBkHMFf=*c^+!SVlqh`h> zC8ECF((T>SOciH@tzSu#AIijC4kr-C6ro3V!@*z^J4{Y$m!%@C&tc=MDoM1X-@@?w zASm%)q1w;fH(&CD510j!y^sPa-~ESq)=A&;UuinWd;_oVaC4EAzw914d@O0JS9I| z8e#L#D?}{KCslmEn{-G>rnW!L0PBmH@Y}Ea2YCp>(I`3Jtrv;k9Uou>>#>f-= zQv>cWj3px4p)!h9k5<^Q@{JhC$`50RX>}{YN7DZmWX1Wzoj~EJ!>#NC7u|9L1u1#I zZdr6kv3UjeZ0VT{jzJ}sEYxp}|k^Hk0�R&G#PX^ZLC!K4 z3~Dr*?tz=#Q9PD7zJ-s+Vt%q{nLvfw*Jyn>b~XmT3_)ckBL5{L6068b^-xgWmebxk zeRn_jWexoDsVm?{_bc8F9Ku@I_41#VoEIRT?RI*W=q5$(k<}4X=t+0A{*CfCELV9+ zvU5blOU{>7h#ZWzH!9QmZgAtk^y5-HbP($&_p$nH0ov>~w)I^Q_oO_n_m6hl0V&9M zBPJ)QZ~)1%s+GG-s4B{_rpCIqkQbk2>N9*-xgD%vB%ju5{O{oCk~khJLS}tDgT$^+ z#7s7knK7(LF;SA%_G`4a#OMh6&bVxpAe(b4hmmylssn@r6xaVX7H$UH)9x_tcgb;M zl2SMo#&sLmgoec^LxWaqmk}mx1=kx%r5d8Cy*5OK3Er(Nja4s1`6=xJ8R^we(IMG6 z2DrS1N22E|E^k?(m+JJxCakf{G-5|#s#4gTZ+3ZlV(*6;SGJ?mXf5f&I|S`eUkO8l zdODWf#{^~Peg;+gMKkSEtUd{{n}`zAGj+`(P5cDDFV8cpUW88!ni8J!(5yI7gUP!` zTq8*}eV-vxkf1LOiTkvVXg}RrdG$(RTy^~MxcaILX!l9LI!{qSM3BL)72(s>EiOO% z-`qI7NTK&|T(3cN?3rBt>9Q;UZP(&o>6WqyHJBI(b8lSepERqIqurhV8RB<>hgQ7I zVGlwmknB1C8HpSojV`0BPpdcA=09)kq5w+WU-E(@rck;5<1IV_JfQPOnJDOY0;Qr_ z&)fdnocr^e~&9rA*>(@g$ za9ZY{0P?UK$}9Lh%-R-Vd;^zjD% zRW?&nNycLV5;&|4h#NBns8)R=gQ1y>XDafs904R6@Gh%oW(3j#0|VOSNz zI;HZEe53ct1m5w!(Vnk-X3;T?hj#wl{sK@hW=O<_9VAnPo=TEGv~II`y=doEFk!V( z%?$tvZ1@2HIcMPWAg%XQ+Y5tCM*)Puy^S)?wqjtMA`CoCsJaIJu7kurPVG zMZS+FZhJwRDTRlzvH^ca$9opsn|R(1nsxn z`FH|xLS~T#fO3IP>#*+&)P#Cl1}lw&lBN>Z-mp_&;FrjV);9TuXafB8-Ovs4?UQ8| zp(VSo8ldM8pXde%6Q5qcg&pL|-=gtZxzX0L_l^|ktnsyGV*?MMXAqxQ1`hBi2L5@X zIeRxivhoDt6ZgOt{zU&jPke%6{e9DfLQl=e*V^HjD_dJI?zU0k2r$=Q5|E(X+;@a7 z871LCr0Xa^6s+VE^FPoac|m!)?S)UKDxNLH22~JxK(nM4WpR9!y?OS7S4|^O z=&;d7El&Sm`QlXbPX5+aA2j(f{z#0h@M9+_LW6c>W&qW+NY(@taTAcU6B{qQJCqy(dO^BsQz#52mAh; zD)#E>Hh;%O?SFp&QR3)ZyiGxXXyV8B0{&HE%ac3bejvx~{Gz@0zZj{6C%f~BxUBCK z6q3m#MeAER)l2w35%fT{O~741GsGB|UjXHs>RT8Oi9&eI()y zBiv|wIBF%+&mT2;{zWfE{#G$QM<-+LR`Y#n1qob}rRXaVe2@HJH8E+XKkA-}B8E(6 zFw*;GGffc_o<+>z;!owV84CH5k=8hGVNAU(H*NrU62|sKG0d>^sx`fU56p#alpT5W z;(wZV!OyQXsu%YL=)5I%m0v@~=mWA@str*!!$k|s9zLDvLl?aP!}zD$=-RJZRX;^{ z5Y(u+>V-YyLL*~cBf7QWHi-VYHteE|*^ZH&H^KS0l3d^PM*F5a--F8=0Zr{NH45Jx z`b2&>LmDmhkeu5d_aJt;OE_xRXfLv+s90Pa^|pEpa0OymMy9X_9!!G$9Sap(w2%Hn_(Ak%jnt1hemUxK}@G+5Dk~F)y zFO0A)?H(q)GG{9e(MHThq6Yyr4zCL&QEx@y|Hf16E{~P~(993TmYo9nHU#H4?KWA1 zy1Q`3XK5|f-`D^!`Yu)$V6=IbBdYzInUvt8B{m2>-R~S!=9IXWx`TU!aASoVJ1iV}YC^sd=R-I)O6uek zY1fLF;oK4 z>1n9I&q?mK?{FBJ+MHz&)~I2%25FDx&CgA41_9MGAj9sg>B&!ncP>9;=3Hn3VQbzs z==$)T$}g6y!4afR(zyO@7!Se*072b9k=so*>h{5)St(*;hjGveAy5E_5{V?P|Vf3&nX#`A7i@WjAqy)w2O>< z&y+4vC-7xt(iBgCEi8H1wLMaoJ-bKlj1O(HueY7=9>oPBnct+aPp5fE!1VjLK%}&9 zLG1x2tDbg}Xpxj45Pydv+1BRD3-cBEL4y8QCt-Or09ajW2L6Yr1Jru+54SYL#^&rc ze66^1zqVV;_uIf78@I2f{8t_Q;mbM7ZD-hZ*w{A!a$<0I{+tny6(ynT+p2sVEV7oY zP(8KsA|V%jKU*OXp8Ii@P`2F%M(z1j@gY=~1KayL2YkXq*yamcz@OW5za_EryQW`S z;W3jRWk$Tb$`N}N`vN}BgQ9q2wamv1*OHXQ?$ad3$?WjPB3x1#jEp1 zGTUW0K_DW#W?B{V_=XYMR=s^Q$0n)pTd&qLH)~duyTQWiwHVD+m5KyTU5YezO$|w$ zSdIaiJ>Jvv>}NnKU|t>IdU|1Al;QY3V`LyDm&H)q;1L~qmiY%2O_Rug1u>sTMMg7V zg&of+cwTJ2#&CcMw5|UyUR_Thbv$Gi*;;gl1&UP;6VuX1{PE1|q%FrJGp_Sn3pn@D zPWI?#Go&6Ie082l%wb2M8JvWwhU}8^fFAEe7{$3vS+et6bb3|Hxx^PfEr(SZpHZ|3 z^fiV)xF-pZ3sA4^yOijU^gp}$5dRO9g1J5G4) zRfxwb*M7Q`n1N(X7Qf~z2vpc{PO9|@Yle{P$Z#-4F^k^@2E8mA(D!U}xUnvB@^Bzx z$OYZ0W~fNA3d9c0d24N0HzUb7?@hwuT#7p~&O?X0{)dTswKEdMhTO`DyJB^j7jdzp zQ$a2RAjsYt&uzK`Ns+A$OGz3zB72pe`*31d3*A9I4z<_8Opwm=`#=VG!9#eYKgUSE zVT-r{`tnh(oTR5z^_o;c>i6Cq8pGq9I%T#`xW+>K9 zJt-Dn7~?V%_BrF#r98U=v?S4a@cWM#1QtPZ-bF86Sm1ZnhW(+ z`pts)diZt3l+J|wb+Xdzl49aD0Q%Md?(%&7bs{7Q6TGuFxtp{1ia7n8LXq6g@@)2+ zb!;gaxgyS0@Y788d2CbwqQ$UX#>B?{xNp6)%^sQ+sq1ClWMr?8d?;`6>%32{j0TG4w8GMesPnBa}lK!Ii08Uk#2!% zBmsT%jH3zqj_m_zmFbL%-1gc^g-#Q^v38GuVP56P_0{qF)p?oqeG;08x9s@6 z5?H%N;@S&<4i9HVE?Q>#>t>i$@ipyIx<4$gn`4%-j{753P?-y|H9DjIhMl2;Y#BU{ z67ty~4eAnEIwK=k0Qvv}qZV{2sVoe7jL*20VgbK+ox?tDOzHE4F?1x(`{!ZmZW`Nv zi9UMh^TIH((`x{Kfh5kUd*y|1%ERG#D>qWLS!JPXPP>Md?BhAMi%u5ITmldp%kDBE z4}*?P^hFzPTyz#lDOp?G^l}hcB@%Coeu=A zqu9n1mid;MYzsOLgIe0ay?~+2$W*~yUBoN=zh2WrMY~X0?GL{${o~(v&$j@#Ll(dq z_t3{`xWY(e;8ue6U0si=+VG-N+uV)ZCj`Dn(@dG zRlo+4zdrR%0$k9gjVvi|@ACEz2Bb8`eT$pMPsTv_)iESPsr)a=d{F-D#qTmy{e(S` zR*1TrRP>~xyU{Xkkp=+%M|5taavw@K$I?|o5(NT>*!2aCKz=v3y+H; zoY^a>AxRfeC^}V5TMqc$W9W_H&`bOaz1P^348KJE?F}gI33=RoIbOqy;(efyf_F#b zR^+%R1pb2Y{s8HBV2|-K^3uXl#E38|I%Pi*%*Zmaw1zAb^4^i&I&;U@dZezxP7 zMdL7&`GZ-7G)(p+kZA=X^SNi_dwn;2x87^piv@5fw5`L_8sa3T4N^s`mV!*IkK-DK z!}Zo*U<-l{zpmjjt;bt0M**$4B~p5r@@R^=57b^o^DNwhm%?a}`>%nBV{Zx``;={*Uf)2D}yV_)CN70m7k7e=s1EnMeM` z{vZIoamXK5$`B<)|E1J)raUs%p#LV&jEZMywNkh5TI)Y+VW+INqU!5)NSR2fAME-Z zXgPVWsX2L;q(OVmM>%y=U$eM`LW%gYk8uqz`PU<-(Q8@|PNv-$R1{yEi!PgZTQ!!!~d$;llg~EDpRgt!Gz0^B>{DoP}9LoPQ}>ON*?wg?Izhb z*VTcoIE1YaTbJgk+fmMdPs@;c7_I%-7t9M%JT-#Q;eVSY(t_9%a^nFJ(K{a#CVv-Y zGSkH7X@gajMK=>6R)uC^uigT~8$40NV!~=c%<3A&GfV!cQY_88yAP{>_~y-&gj5KK zt+;)-XS!#Lx>FT%gK_wg=9fnC(E)v~xLAu%;6K_GNXEw!!TWIeD9Mrh@un$|-nuF} zifIy5+rm_82j$aT1#fB^i(hj~gD~HpVbL`4TsAtvffXn)Lscmb4o+Q5XAQZi7Hx7q z&J6mOgSaNsk$lVyy1C9)`UY}nTGTUkMDZ*fj;>nAObm_2D)^e5F5MjWusC%0sCM)K zD-3j%o}RFnXON$55#tFwkvCJw8rJ_-lvOXj@MCJOxvoy?yYQV9R#rD%Rb8$_ht)WY zgI4q$A6KZ#cv^c)G5gsSruG7=%7X4C%>CV z&GZTQk!@$#gH-XjY=*H0`8H?uw=CnaGqm^7GSTTXg3->c%o&ry99B9-GA0J5A&?Nn;bF+w z8q#zwPNCUw$J6lkXCC`;aBRq`lf?t3hND3!RyJitEl7t>YhJmX{^}l;owROqKTa1G1q_aSXL0;DjtTXrO7i{ zM9Oy^o-}7lG`3u3Mhqj6ZVt$q5EH#FFsci3HhsHR+%OTzT^X_UCG=6fp=b5P2&w#i#+oU|&BBa;~(A<tPJX z4LY>x7Spx1>~y7}V#U4Nm2c+EuYn*(167DSH(GN)^H~@@M(Hm}j>?i>9nMjUtD}uY zg`rk;DDq9AA$%R)S{%iRgKAk+=i*=uJ-nh)DlR^#UPv-Gr=8$|;?A2N<}T;ANV^R3 zWp#xLlQmIiCHMj>_Fp#WCR?Tc(IY!9HkOjxv$o{0c_#8^%P$GTc4iMsd{#{=;TtGNzJ68X%x1p*%(K)js9n*Z`0;CAi`U(P zwS<&jKX9yy&Sgy=Q{*SRk;u3HrRUR}*W6Y9$JYZp7>8EdPFtFn6aZc*C+bOn zOK@1XkYP3)4tf91xBkoEl>h;$hO0W53 zFQwJO!J1nu7SOrU`8=vSBTY$PuKwrt5G2%GeRn&L zakIx#G4w9vdk)$x@Kt)LqdBD$P$XOS5bGY9Tl;un2QwC59$Q6n_ZQ_{Y~AwU%NRoLfO#h2J0@yrGm)&7u+gCQgsCopH_%WzHG2DmG^r0p z*3c3ATD_Ec_Ty;1!J+jh#wpaz6<~j1t6I@@@dWqag^}F6N|aL?bD8Er;mTmnN{nca z#NdEUl zQvaWXZ^wWF*u+Ji#BOET7ApeDBP*8fWwP+I_26@V7dw^N(%@BJ!z;b%^O zl=@geF<9criV)x1C^zEJihTK!91reO?FI$8$CL6{r&NB!7w`SpLskn`*B z(U0XofUs1gXDoVz;aD{bZ5BXw9R!rGs*$tKrX!Y$Rp>=CSfHw7J_U=6wP+Mtqe#2> zH~^r_b;N=g|1W{?q{5bnHO6*YAC>w$05Sa~&R>`g;|+@qfsX&5vX>MCE(M4g?PVoQ zBQ6sLHRFdcoNz-J#Ob*TtJW~WTTUsSz&ycG0dv712%i?zQt^U-Qu@^nnxfhWL!_`i zk+Qs#M5i{P#7sY1LK1uqf39Qv*SY&05o@XvKTMr)l@oZx^cOC*mAU(WuMSBUleYB5 z|I4GS9cEvR>ep2;KtaSJ?N!H$l?}PMoZHm?RTq)OBBW?EdL?+HCi;S|nPb3uLSajntrKVzh5R^{^@;!c(dt2=etKf@5py6WbkR`n( zbP&&t_|PU`kMFr`ktYkM>w#?Yt>YVe#-;&c8vjf z-Q~YLXm-LKSWb?Z@(z16#jN%<)hYUFQZ80jxO1gy@XX85GX#pjCeE|wTD>elHip1@ zmld_6R@v5MK;kS1~gy`OrQd0!xqr;O#_afq+yABVvV~@=s`2fMpW|?X%cci zfQx7PE|$>L0hF{qDP!WkHr<#op7WNZjLC?!U}aDR{4vk1T&=m78nY>T+gRqT9e`;K zJ=7n!o=6FXwr&sk^bCM4+)@YL#pjMaYB;EbP+a!crsXF)IB#mMPoQ)17y!LS_{n%S zr4Bq_gj-#|A1!%4Irn!&0DASC11^jJi`ma)!Gvr0&hW`N9(sSlW3&Mp%k+Qst3Ftw z-Buf7x)9ptYFWT2K+gMKsD#%V0DO?|SRUYVr+C{yB8bk|}uO$ArkDRBP0NX4K z{cx7f@<`SGD1{aqLl6+m|!RnPI=W!cI4%}Joy z!ECXsW?DzWjYePB5COK%ah~{?MVCO~d5K9aNGETrhuvx=k9(3iU5lnKMT_b03MZ{O zS}fFiQ<k7Xj6IAP9mx77Y;SY-&Zq^}IQsNLB9yQWoBM-ia}tc)nMpQ?vT0!Lw@efdor8 zEfqN)&BeN{aXVNfgIowTecT>r*NHmd^9k+lmUioXA(MAGSMO+ck5Isrcd$lVNrl@a z+PVV1zSGxUd%+jLH%A)&^wq0OFC9fk zxG=}ayFws_gD_sySrCLdSI+oAZyhOhZ*x_YuhUY*r4jak$A}&3ma!X7s)-w!oMU zW`)ARd`2BoywouUpO%Z>$i@lAGqWXfgChe37muXZDt z?*If|AYKJ}>0C!C2`8S)@VAv&U5b0|Ru?bp`n@@rJU-!2^((t#!V%ha&WTX=vK?o~ zJCCkq0OqUXa~AB!U#apIFB6+mJXOcCwe=7(8MCh6GXSTMCPbJUG@PGqGL~-R=s$L{ z{z3VjzfpciPDLC>{N^$D|Lhz_>lx?Ao0+hIeLbHsZ0^(O}J{~p8&HozxRlkMX8Pi4sK^s&v2r*aJlyy^P4y*UV^-I{$53U@0*}~RX;3HB6eF^vc z?OIktyQiCl$n9ISUA}g0(;N*s3wkm4W8xOJ3yo_va!9wLfYn}*?nuGMWaX$I))O0W zH_1|g-*~hIFabM3vxi?`Kzl_{Nir$s^nOn&fBxu$Fl3_3C$Kc(ZvrPNYc1(NQ+}5o zTh2=;yz|PoOD$`c^Fl=Hv~_AhUSa)to87Lb6_N(5BgJM=C@=STWL9;A$2e~EZte-f+L;HjD-h;8nYb;4U78&=fgS0Q5LJ%&7FHdx86nOg9@WE z8UtI|E_@O-*qg7sh-yHUSd`udYJ?O?F~It!{^tPoq<7cIfu4q-LawY1L```?k_eqX zB(WG>AgOl?8h<;fv#4STLwT!cW$Bhr1}+Wn`(pdesrZ)GgHgBKZ{stzG6k&_krn-< z&5UP-%Pq<>d+&o|s*+-ru~`{3A?`+p=Z*VwOla8K4cZoqpgPyf)ogSTEB>ODUwpc@ zxffOrhwrET5eK!P35+?=^L@QWYUqNr#G%_%Uktgbq^?GT)1^YSHziBDWYg+%k~TCgolto)VbxV&|wP+i|W1FY9ox#ON3lVR~3)4 zjUR1s>#~KH&Djr@Q1i5FWwDCm?4djTGvmCLw-ue~ew5<|n;(-y+%Fd>ynHI29)$K+ z_~2ULZ6K)-aL6?xNB*$ryLVQMPep0K!k2KGI6>_ma7Aowg$k-vM~|l2MY_6ttC+*i zwi2_wgY8`Jtf_$1*U}!>mfs`|3Qa<^5E+(M$ zG;q~2U%VG%=P#WEnXqVQL+i&1jheIdCKXC~A8Y>Tf}udy&+ca*IM)6xjnti=GMp>I z47!QGd_Z{O$7jlq;8>?yn#}#i&34#(+-a@2U2?5(gFKt}!C&%Yn3CjQA~=~L#xg2b zRTu414#nzEQxnTYk)2WT#+Wx$6Cl#voBa2iP zl~E3b>e1z*nFF1p)djgzFA>_zAkYld2jJ7tJy`gt_(<1rNoC(>4_Q7nH z(>FDSw)t=P0`wiB%A*3b3`~T*EyrhPX()b3Iaq#qa*|sa6;g5As_)wSx~Z4Wr%};n zal4$|T2Mco)H>BtAKTrA*rGwK3*1O|M?3Y0H|!7c*U2GZ(?V6X9Tu>OaWAl4%g2GQ zE5legc7BeLd-9|Q_{Fs=vLv9k`VZhpjp8`NRj7;d!17zV9K9eE2DSd9F%AXj9Tu4= zp_36MP#$X_;=p*^?!!vDDlm2eb-uFe(mJ4&E3mDs6AEA8c@JybP!Q4fmA;}*gAYnw zu3gv?EmB>hBXK?3$GTb=JW440{M8Dw7Nf{Fvz z^=>5_?`v*uTKu3ew>Lv(@_w2TX>pv>LgKxp5lKCe2A`r&;9(`Bo4UdXG5tTccbRW< z6ya0m4Ugji!VhdoSMBQ_B49}Hx1R%c9y|nrSVN(WSc&{t!8z=)#`&_qJ{_P?iys!X zNXC7bXG>})_PRdVdHm%2&&fj#UMFMQWA$MBWc+-`pJ#qo#07znYx$e%v|{RZZ-puH z)6nto@E<`E?qfe99-9~O&mg;sS){!8Q~oE<;65RQ`wEcl6Y1MS{&9v%zPrVTTA|eO z*Z*VSCNlfG7H<1oTAmRh+jdTg;y42|k4oWs_?#m7$!LFj6mi;QN^6gYs3P}iUp-k)poosvHd4h8{K$Yf3Fzsf4kUI5 zf0nk_cBvD3P`;8l)}#=E{Hp8Yi^@)+;@1v_Z>%xSxNqsB18hkX@JsUo1=*21Ggp}X%BVhkSAcp=0 z z!Tocq_`C_d?r#TUklMYg98M-<&5^PX^MaAjRBHigkL*##cdIU6^ZciiK(_Wr%kb$K zBWZZl3_s`vPzI0Zd?M?voqxrx5?`{%5TxPSEJvvr@?1THmikxr_;qjR$JGqYhmccB zDb)#_(uR*eiJiD4lN8lTVOK13l+@|pVkQQXLjlmsI`3WFD(t;;^Z~CP&V>MHjtJla zz7!@nZwvjSF}gr{m@ewNT8*R|+%~;<#0;i*&W~;SJ&^BsHR;Ez2~i#_}^*6ZO~=Z>9OwamZg+wJ>zolxVTaNOUmRn08fKU6r_ zpFZazkr>CwCGYKiD~udN%c&UQ<|w;-wgFc##MRr6jKTDd`@K0&R)XT+m1C-3RTb{S z1&d95`5$PM;3&hDzm+`X*sna7142KIU%x&o=0ES<`LV$M zARj0Kd_RldpL!Ck)cUu&7LK5Q6s`WRuT=kEPasf=2X_Cs(cplBhs@^oA~Nd3aS@W) zTy*bwBLe$k?t$f|nMCev%Lsx9M!pWJ5)k;2O`HIfniJRBAb2kIdW8U2Uc;5E2|m%a zx)R{(*ti}C!7Qn%7y(WVaV2nq?}Q~Z1h|4WphBkzw*ALQ2!JjKt`>fRU{4xMNC327 za9s}qf`gmTQ_q2R2(Bpp8(bbds#4p|vEo5Th`G!Ngdu>el-*Pe!v$+0nv>pM2ZR~lq3*D0>T9(tVY3ry5O!YV3bfIx-_W? zB@zg*0l}3ef?y*FMOGdHNGKl>up-~RiTbS1ZhoB~bIY8W%sKbG@4N#S4FwNi?LLXZ z=|wQ~C11vqmY>yu7tB7&%rVkfhkhx_7~1*q%bQs^N>@o1aaR7&mg3Yf&lnQsbsA|+ z_F>dLlZMNnNbX6^j<>A$B*eo2oE&t822ZfhsWRQ!%gt5|>DH#Srtfu+9t?hcT|5y( zv+|-;PE^||1HnpA3C1_RjfeE)Q0sz}p3OuVt|LC8nT}zQQH2a-`0^PB2dsHuysoHDa)8RrhXUd!st3!B z9JXQoq<0@(`=!S8aVI{}c%n0saq*j$pUQfa4YrcYSMeoiLu#g&(!4`#BY1m=wQPDo z)o@5FuYFnm(%jF9l{>d=$C@15sn|l>aE(!S#FToL+m>|nB*-CXWTf`qn3LsB3tc}? zJOS5|(+u*^rgke}Zml$w#T?hv#a*yCuTI{0d)9^UltCTmUoi{-ks-8_i`G zyfg{GSeDc4&9NMF<1o-5osu&`-Bnaeg*w7(BxCYk%VJ7NT)k;0^0uG>+%k#MrR;28crIfm8j-pw1XvCiB#cGTyl zsN{Zd-|)d*@ztkJ-~L!PY_Ev`D_Ni!GkP#?d)ht;<7DH6E9=Z+%oe11?=zzN`cDr!ZgV74CC= zal+LqlY3!)QA~3*GWb^MPCBV?EM_o7JaA;-mc;Cm568nJvZSggC|>`S@)*{pphMi% z8~pCvTgE_p&*Is1!(U-G$hOOUwa0$(^3I>EOqvS`hP>`c$&0DC3IljleABc~<7_ z&DI8)d`b)HlGs$EyMP$RGKWOaB+v0t6g>Vq(ab#h%(X|P)77WqSdyP~a}!=nf?|aE z&VaZ{rK&l}7-Mp-c&=m4NN@Z+v)SN*-doxbNIgDKqjk|qgxcDMA-87uWq;kkOR z@O}ai{ca+dlRLX)8yjt-k37lisndw`+Z()lEgRi$8K_C;V!HV@7dbTX8)_AW*Vs*6 zf)|HHsAf0@No_AXVE<^xWcr#dEp+9uVPQj5+^veMRr$M}$Y*$7e4f8wIMK{9f|aFq z!i*e|%@1)?vBUcBa_Fh6iY&RJ;5D|6SzeMCjhPVWy0Y{qL4_uJX!1Sn1z%1*9P&p9 z(CVp?fn2*=R#?!gEsn$E1(KUzfgGedEn3Usst0n8jMJLdMlZTKj|a65&J}0s2063Q zOmB+c=`Ul7^XpDP%ESjn$1i|2#$+D8I-x`M>Q2vma@tHqnWAuyX76Ma`Km(d@%oQz zs|%X*8>*tk!h)<0%xr@$1O<|PFP%FJIzxJc0fmE(7qmMt!Y46|QZX1Ukq!i9HamDj zZnJaG>G?zyC-h%v=Gtw?0|2E7{E$~Dg7~%@QSrCRtZLfcEx$Qc^1zsC(ipko8o#>( zgCZWL_jW5EEnunj*f5@WSL|k2;}XwsadeKGe|pQw#@dFjZhjuG9hA`|5QGM9DV?Vp z_aS@{%PARu`@Fc*WmU7`DVWB8!tTRtGmzD&@E*j{XVglODcU47g|kYct;@!=-isxU zjWW=mPANU38FHVT(cT2iEMbdN5{RWwcP0_S6uX>5QX-0$)1blvBv;tb~a)Od}5jt#w$Au$t2)U(m$?D6Ngz={Wx?U)jS zwiFK}akc5N(V@APhYpRBBT+ZYRa0U={*K$h5%JS4t`nxogw^z3mrtz+3aa}eC1WKF zW)Uv8>-|90&20T7`v`qkMdl&RE5G0xnZc#RJYpY^V0=|^}yeE z`WZ|oQ{^VAy5#I{oPho9*+7NmLp2Cg0SF4jmFWH0a)V({xf39kOa;JBF3Dy3sKssp z%2vvvDd2k&)@@yLdG#0_w+8?uG9*qDFy9G*w=$ir%W&xbM_31%tmSFn`6Vg(I5)iy zBBgL!D9z{=-EByBoX(E;Gi@p?fpgUQX5CKIo z-)bi6Zb@BUr0luzE`NT%@WRdt0Sgq|o*$hb zU&8WVb0yWK?aZEk6g`##;0n1*e%Jc1Z(2>W)l&2IBet*Zy0-q&;BvLKeo+%bp2NzH z$8ZPaSHmY{AOQKJVO#yY+y#(%e)-q2gY2fo8)aB8+=QSgF95){wSv4)u$=+O9R%C| zy8Ti1tZ+wT`l;>E@fr}E9p*sO(K(ls1s#C_|9l}(TV^!<$5|bthHVQ9F(`uwYUf&G OxD{%@r!xylxcGlZkqB}C diff --git a/docs/opentrustee-guidelines/overview-of-opentrustee.md b/docs/opentrustee-guidelines/overview-of-opentrustee.md index 3cd0763..59f2dab 100644 --- a/docs/opentrustee-guidelines/overview-of-opentrustee.md +++ b/docs/opentrustee-guidelines/overview-of-opentrustee.md @@ -2,7 +2,7 @@ ## 概述 -OpenTrustee是一个部署在可信执行环境（TEE）中的安全操作系统。ARM架构中的TrustZone技术通过CPU层面的硬件设计，支持创建安全的可信执行环境。基于ARM TrustZone技术，我们可以在设备上同时运行OpenHarmony和OpenTrustee两个系统，这两个系统彼此隔离。基于这种系统隔离带来的安全性，OpenTrustee可以为设备的机密数据提供保护。 +OpenTrustee提供了一个可信执行环境（TEE），运行在受硬件隔离的安全区域中，与常规操作系统如OpenHarmony同时运行但互相隔离，OpenTrustee比常规操作系统拥有更高的安全性，可以为设备上的机密数据提供保护。 ## **应用场景** @@ -37,28 +37,28 @@ OpenTrustee是一套完整的TEE解决方案，包含多个部件，系统架构 - 部署在REE侧内核中的驱动，支持REE和TEE进行通信。 -#### 操作系统框架 +#### OpenTrustee 操作系统框架 - 为TA提供符合GP TEE标准的TEE Internal API； - 提供TA运行管理、驱动运行管理等框架基础服务； - 提供安全存储、加解密等安全能力。 -#### 操作系统内核 +#### OpenTrustee 操作系统内核 - ChCore微内核，提供IPC/进程管理/内存管理/调度/中断管理/REE和TEE切换等基础内核功能。 -#### 开发套件 +#### OpenTrustee 开发套件 -- 包括TA开发套件和驱动开发套件两部分，提供API头文件、编译框架、签名脚本、demo样例等，支持高效开发TA和驱动。 +- 提供了TA开发套件，包含TA API头文件、编译框架、签名脚本、demo样例等，支持高效开发TA。 -#### Dispatcher +#### OpenTrustee Dispatcher -- 部署在ATF中，在REE和TEE之间交互时完成两个世界上下文的切换。 +- 在REE和TEE之间交互时完成两个世界上下文的切换。 ## 约束 - 支持的系统类型：支持OpenHarmony定义的标准系统，暂不支持轻量系统和小型系统； -- 对硬件的要求：CPU需要支持ARM TrustZone机制，安全内存至少需要28M； +- 对硬件的要求：目前只支持具备ARM TrustZone机制的CPU，安全内存至少需要28M； ## 编码规范 From 9c569e634513a4e547b56cb28186735acd380ef1 Mon Sep 17 00:00:00 2001 From: pete-lipeng Date: Mon, 28 Aug 2023 17:33:15 +0800 Subject: [PATCH 2/5] change TA demo dir Signed-off-by: pete-lipeng --- sdk/src/CA/{sample => }/aes_demo/aes_demo_ca.c | 0 sdk/src/CA/{sample/helloworld => helloworld_demo}/ca_demo.c | 0 sdk/src/CA/{sample => }/mac_demo/mac_demo_ca.c | 0 sdk/src/CA/{sample => }/rsa_demo/rsa_demo_ca.c | 0 sdk/src/CA/{sample => }/secstorage_demo/secstorage_demo_ca.c | 0 sdk/src/TA/{sample => }/aes_demo/CMakeLists.txt | 0 sdk/src/TA/{sample => }/aes_demo/Makefile | 0 sdk/src/TA/{sample => }/aes_demo/aes_demo_ta.c | 0 sdk/src/TA/{sample => }/aes_demo/build.sh | 0 sdk/src/TA/{sample => }/aes_demo/config.cmake | 0 sdk/src/TA/{sample => }/aes_demo/config.mk | 0 sdk/src/TA/{sample => }/aes_demo/config_ta_public.ini | 0 sdk/src/TA/{sample => }/aes_demo/configs.xml | 0 sdk/src/TA/{sample => }/aes_demo/defconfig | 0 sdk/src/TA/{sample/helloworld => helloworld_demo}/CMakeLists.txt | 0 sdk/src/TA/{sample/helloworld => helloworld_demo}/Makefile | 0 sdk/src/TA/{sample/helloworld => helloworld_demo}/build_ta.sh | 0 sdk/src/TA/{sample/helloworld => helloworld_demo}/configs.xml | 0 sdk/src/TA/{sample/helloworld => helloworld_demo}/ta_demo.c | 0 sdk/src/TA/{sample => }/mac_demo/CMakeLists.txt | 0 sdk/src/TA/{sample => }/mac_demo/Makefile | 0 sdk/src/TA/{sample => }/mac_demo/build.sh | 0 sdk/src/TA/{sample => }/mac_demo/config.cmake | 0 sdk/src/TA/{sample => }/mac_demo/config.mk | 0 sdk/src/TA/{sample => }/mac_demo/config_ta_public.ini | 0 sdk/src/TA/{sample => }/mac_demo/configs.xml | 0 sdk/src/TA/{sample => }/mac_demo/defconfig | 0 sdk/src/TA/{sample => }/mac_demo/mac_demo.c | 0 sdk/src/TA/{sample => }/rsa_demo/CMakeLists.txt | 0 sdk/src/TA/{sample => }/rsa_demo/Makefile | 0 sdk/src/TA/{sample => }/rsa_demo/build.sh | 0 sdk/src/TA/{sample => }/rsa_demo/config.cmake | 0 sdk/src/TA/{sample => }/rsa_demo/config.mk | 0 sdk/src/TA/{sample => }/rsa_demo/config_ta_public.ini | 0 sdk/src/TA/{sample => }/rsa_demo/configs.xml | 0 sdk/src/TA/{sample => }/rsa_demo/defconfig | 0 sdk/src/TA/{sample => }/rsa_demo/rsa_demo_ta.c | 0 sdk/src/TA/{sample => }/secstorage_demo/CMakeLists.txt | 0 sdk/src/TA/{sample => }/secstorage_demo/Makefile | 0 sdk/src/TA/{sample => }/secstorage_demo/build.sh | 0 sdk/src/TA/{sample => }/secstorage_demo/config.cmake | 0 sdk/src/TA/{sample => }/secstorage_demo/config.mk | 0 sdk/src/TA/{sample => }/secstorage_demo/config_ta_public.ini | 0 sdk/src/TA/{sample => }/secstorage_demo/configs.xml | 0 sdk/src/TA/{sample => }/secstorage_demo/defconfig | 0 sdk/src/TA/{sample => }/secstorage_demo/secstorage_demo.c | 0 46 files changed, 0 insertions(+), 0 deletions(-) rename sdk/src/CA/{sample => }/aes_demo/aes_demo_ca.c (100%) rename sdk/src/CA/{sample/helloworld => helloworld_demo}/ca_demo.c (100%) rename sdk/src/CA/{sample => }/mac_demo/mac_demo_ca.c (100%) rename sdk/src/CA/{sample => }/rsa_demo/rsa_demo_ca.c (100%) rename sdk/src/CA/{sample => }/secstorage_demo/secstorage_demo_ca.c (100%) rename sdk/src/TA/{sample => }/aes_demo/CMakeLists.txt (100%) rename sdk/src/TA/{sample => }/aes_demo/Makefile (100%) rename sdk/src/TA/{sample => }/aes_demo/aes_demo_ta.c (100%) rename sdk/src/TA/{sample => }/aes_demo/build.sh (100%) rename sdk/src/TA/{sample => }/aes_demo/config.cmake (100%) rename sdk/src/TA/{sample => }/aes_demo/config.mk (100%) rename sdk/src/TA/{sample => }/aes_demo/config_ta_public.ini (100%) rename sdk/src/TA/{sample => }/aes_demo/configs.xml (100%) rename sdk/src/TA/{sample => }/aes_demo/defconfig (100%) rename sdk/src/TA/{sample/helloworld => helloworld_demo}/CMakeLists.txt (100%) rename sdk/src/TA/{sample/helloworld => helloworld_demo}/Makefile (100%) rename sdk/src/TA/{sample/helloworld => helloworld_demo}/build_ta.sh (100%) rename sdk/src/TA/{sample/helloworld => helloworld_demo}/configs.xml (100%) rename sdk/src/TA/{sample/helloworld => helloworld_demo}/ta_demo.c (100%) rename sdk/src/TA/{sample => }/mac_demo/CMakeLists.txt (100%) rename sdk/src/TA/{sample => }/mac_demo/Makefile (100%) rename sdk/src/TA/{sample => }/mac_demo/build.sh (100%) rename sdk/src/TA/{sample => }/mac_demo/config.cmake (100%) rename sdk/src/TA/{sample => }/mac_demo/config.mk (100%) rename sdk/src/TA/{sample => }/mac_demo/config_ta_public.ini (100%) rename sdk/src/TA/{sample => }/mac_demo/configs.xml (100%) rename sdk/src/TA/{sample => }/mac_demo/defconfig (100%) rename sdk/src/TA/{sample => }/mac_demo/mac_demo.c (100%) rename sdk/src/TA/{sample => }/rsa_demo/CMakeLists.txt (100%) rename sdk/src/TA/{sample => }/rsa_demo/Makefile (100%) rename sdk/src/TA/{sample => }/rsa_demo/build.sh (100%) rename sdk/src/TA/{sample => }/rsa_demo/config.cmake (100%) rename sdk/src/TA/{sample => }/rsa_demo/config.mk (100%) rename sdk/src/TA/{sample => }/rsa_demo/config_ta_public.ini (100%) rename sdk/src/TA/{sample => }/rsa_demo/configs.xml (100%) rename sdk/src/TA/{sample => }/rsa_demo/defconfig (100%) rename sdk/src/TA/{sample => }/rsa_demo/rsa_demo_ta.c (100%) rename sdk/src/TA/{sample => }/secstorage_demo/CMakeLists.txt (100%) rename sdk/src/TA/{sample => }/secstorage_demo/Makefile (100%) rename sdk/src/TA/{sample => }/secstorage_demo/build.sh (100%) rename sdk/src/TA/{sample => }/secstorage_demo/config.cmake (100%) rename sdk/src/TA/{sample => }/secstorage_demo/config.mk (100%) rename sdk/src/TA/{sample => }/secstorage_demo/config_ta_public.ini (100%) rename sdk/src/TA/{sample => }/secstorage_demo/configs.xml (100%) rename sdk/src/TA/{sample => }/secstorage_demo/defconfig (100%) rename sdk/src/TA/{sample => }/secstorage_demo/secstorage_demo.c (100%) diff --git a/sdk/src/CA/sample/aes_demo/aes_demo_ca.c b/sdk/src/CA/aes_demo/aes_demo_ca.c similarity index 100% rename from sdk/src/CA/sample/aes_demo/aes_demo_ca.c rename to sdk/src/CA/aes_demo/aes_demo_ca.c diff --git a/sdk/src/CA/sample/helloworld/ca_demo.c b/sdk/src/CA/helloworld_demo/ca_demo.c similarity index 100% rename from sdk/src/CA/sample/helloworld/ca_demo.c rename to sdk/src/CA/helloworld_demo/ca_demo.c diff --git a/sdk/src/CA/sample/mac_demo/mac_demo_ca.c b/sdk/src/CA/mac_demo/mac_demo_ca.c similarity index 100% rename from sdk/src/CA/sample/mac_demo/mac_demo_ca.c rename to sdk/src/CA/mac_demo/mac_demo_ca.c diff --git a/sdk/src/CA/sample/rsa_demo/rsa_demo_ca.c b/sdk/src/CA/rsa_demo/rsa_demo_ca.c similarity index 100% rename from sdk/src/CA/sample/rsa_demo/rsa_demo_ca.c rename to sdk/src/CA/rsa_demo/rsa_demo_ca.c diff --git a/sdk/src/CA/sample/secstorage_demo/secstorage_demo_ca.c b/sdk/src/CA/secstorage_demo/secstorage_demo_ca.c similarity index 100% rename from sdk/src/CA/sample/secstorage_demo/secstorage_demo_ca.c rename to sdk/src/CA/secstorage_demo/secstorage_demo_ca.c diff --git a/sdk/src/TA/sample/aes_demo/CMakeLists.txt b/sdk/src/TA/aes_demo/CMakeLists.txt similarity index 100% rename from sdk/src/TA/sample/aes_demo/CMakeLists.txt rename to sdk/src/TA/aes_demo/CMakeLists.txt diff --git a/sdk/src/TA/sample/aes_demo/Makefile b/sdk/src/TA/aes_demo/Makefile similarity index 100% rename from sdk/src/TA/sample/aes_demo/Makefile rename to sdk/src/TA/aes_demo/Makefile diff --git a/sdk/src/TA/sample/aes_demo/aes_demo_ta.c b/sdk/src/TA/aes_demo/aes_demo_ta.c similarity index 100% rename from sdk/src/TA/sample/aes_demo/aes_demo_ta.c rename to sdk/src/TA/aes_demo/aes_demo_ta.c diff --git a/sdk/src/TA/sample/aes_demo/build.sh b/sdk/src/TA/aes_demo/build.sh similarity index 100% rename from sdk/src/TA/sample/aes_demo/build.sh rename to sdk/src/TA/aes_demo/build.sh diff --git a/sdk/src/TA/sample/aes_demo/config.cmake b/sdk/src/TA/aes_demo/config.cmake similarity index 100% rename from sdk/src/TA/sample/aes_demo/config.cmake rename to sdk/src/TA/aes_demo/config.cmake diff --git a/sdk/src/TA/sample/aes_demo/config.mk b/sdk/src/TA/aes_demo/config.mk similarity index 100% rename from sdk/src/TA/sample/aes_demo/config.mk rename to sdk/src/TA/aes_demo/config.mk diff --git a/sdk/src/TA/sample/aes_demo/config_ta_public.ini b/sdk/src/TA/aes_demo/config_ta_public.ini similarity index 100% rename from sdk/src/TA/sample/aes_demo/config_ta_public.ini rename to sdk/src/TA/aes_demo/config_ta_public.ini diff --git a/sdk/src/TA/sample/aes_demo/configs.xml b/sdk/src/TA/aes_demo/configs.xml similarity index 100% rename from sdk/src/TA/sample/aes_demo/configs.xml rename to sdk/src/TA/aes_demo/configs.xml diff --git a/sdk/src/TA/sample/aes_demo/defconfig b/sdk/src/TA/aes_demo/defconfig similarity index 100% rename from sdk/src/TA/sample/aes_demo/defconfig rename to sdk/src/TA/aes_demo/defconfig diff --git a/sdk/src/TA/sample/helloworld/CMakeLists.txt b/sdk/src/TA/helloworld_demo/CMakeLists.txt similarity index 100% rename from sdk/src/TA/sample/helloworld/CMakeLists.txt rename to sdk/src/TA/helloworld_demo/CMakeLists.txt diff --git a/sdk/src/TA/sample/helloworld/Makefile b/sdk/src/TA/helloworld_demo/Makefile similarity index 100% rename from sdk/src/TA/sample/helloworld/Makefile rename to sdk/src/TA/helloworld_demo/Makefile diff --git a/sdk/src/TA/sample/helloworld/build_ta.sh b/sdk/src/TA/helloworld_demo/build_ta.sh similarity index 100% rename from sdk/src/TA/sample/helloworld/build_ta.sh rename to sdk/src/TA/helloworld_demo/build_ta.sh diff --git a/sdk/src/TA/sample/helloworld/configs.xml b/sdk/src/TA/helloworld_demo/configs.xml similarity index 100% rename from sdk/src/TA/sample/helloworld/configs.xml rename to sdk/src/TA/helloworld_demo/configs.xml diff --git a/sdk/src/TA/sample/helloworld/ta_demo.c b/sdk/src/TA/helloworld_demo/ta_demo.c similarity index 100% rename from sdk/src/TA/sample/helloworld/ta_demo.c rename to sdk/src/TA/helloworld_demo/ta_demo.c diff --git a/sdk/src/TA/sample/mac_demo/CMakeLists.txt b/sdk/src/TA/mac_demo/CMakeLists.txt similarity index 100% rename from sdk/src/TA/sample/mac_demo/CMakeLists.txt rename to sdk/src/TA/mac_demo/CMakeLists.txt diff --git a/sdk/src/TA/sample/mac_demo/Makefile b/sdk/src/TA/mac_demo/Makefile similarity index 100% rename from sdk/src/TA/sample/mac_demo/Makefile rename to sdk/src/TA/mac_demo/Makefile diff --git a/sdk/src/TA/sample/mac_demo/build.sh b/sdk/src/TA/mac_demo/build.sh similarity index 100% rename from sdk/src/TA/sample/mac_demo/build.sh rename to sdk/src/TA/mac_demo/build.sh diff --git a/sdk/src/TA/sample/mac_demo/config.cmake b/sdk/src/TA/mac_demo/config.cmake similarity index 100% rename from sdk/src/TA/sample/mac_demo/config.cmake rename to sdk/src/TA/mac_demo/config.cmake diff --git a/sdk/src/TA/sample/mac_demo/config.mk b/sdk/src/TA/mac_demo/config.mk similarity index 100% rename from sdk/src/TA/sample/mac_demo/config.mk rename to sdk/src/TA/mac_demo/config.mk diff --git a/sdk/src/TA/sample/mac_demo/config_ta_public.ini b/sdk/src/TA/mac_demo/config_ta_public.ini similarity index 100% rename from sdk/src/TA/sample/mac_demo/config_ta_public.ini rename to sdk/src/TA/mac_demo/config_ta_public.ini diff --git a/sdk/src/TA/sample/mac_demo/configs.xml b/sdk/src/TA/mac_demo/configs.xml similarity index 100% rename from sdk/src/TA/sample/mac_demo/configs.xml rename to sdk/src/TA/mac_demo/configs.xml diff --git a/sdk/src/TA/sample/mac_demo/defconfig b/sdk/src/TA/mac_demo/defconfig similarity index 100% rename from sdk/src/TA/sample/mac_demo/defconfig rename to sdk/src/TA/mac_demo/defconfig diff --git a/sdk/src/TA/sample/mac_demo/mac_demo.c b/sdk/src/TA/mac_demo/mac_demo.c similarity index 100% rename from sdk/src/TA/sample/mac_demo/mac_demo.c rename to sdk/src/TA/mac_demo/mac_demo.c diff --git a/sdk/src/TA/sample/rsa_demo/CMakeLists.txt b/sdk/src/TA/rsa_demo/CMakeLists.txt similarity index 100% rename from sdk/src/TA/sample/rsa_demo/CMakeLists.txt rename to sdk/src/TA/rsa_demo/CMakeLists.txt diff --git a/sdk/src/TA/sample/rsa_demo/Makefile b/sdk/src/TA/rsa_demo/Makefile similarity index 100% rename from sdk/src/TA/sample/rsa_demo/Makefile rename to sdk/src/TA/rsa_demo/Makefile diff --git a/sdk/src/TA/sample/rsa_demo/build.sh b/sdk/src/TA/rsa_demo/build.sh similarity index 100% rename from sdk/src/TA/sample/rsa_demo/build.sh rename to sdk/src/TA/rsa_demo/build.sh diff --git a/sdk/src/TA/sample/rsa_demo/config.cmake b/sdk/src/TA/rsa_demo/config.cmake similarity index 100% rename from sdk/src/TA/sample/rsa_demo/config.cmake rename to sdk/src/TA/rsa_demo/config.cmake diff --git a/sdk/src/TA/sample/rsa_demo/config.mk b/sdk/src/TA/rsa_demo/config.mk similarity index 100% rename from sdk/src/TA/sample/rsa_demo/config.mk rename to sdk/src/TA/rsa_demo/config.mk diff --git a/sdk/src/TA/sample/rsa_demo/config_ta_public.ini b/sdk/src/TA/rsa_demo/config_ta_public.ini similarity index 100% rename from sdk/src/TA/sample/rsa_demo/config_ta_public.ini rename to sdk/src/TA/rsa_demo/config_ta_public.ini diff --git a/sdk/src/TA/sample/rsa_demo/configs.xml b/sdk/src/TA/rsa_demo/configs.xml similarity index 100% rename from sdk/src/TA/sample/rsa_demo/configs.xml rename to sdk/src/TA/rsa_demo/configs.xml diff --git a/sdk/src/TA/sample/rsa_demo/defconfig b/sdk/src/TA/rsa_demo/defconfig similarity index 100% rename from sdk/src/TA/sample/rsa_demo/defconfig rename to sdk/src/TA/rsa_demo/defconfig diff --git a/sdk/src/TA/sample/rsa_demo/rsa_demo_ta.c b/sdk/src/TA/rsa_demo/rsa_demo_ta.c similarity index 100% rename from sdk/src/TA/sample/rsa_demo/rsa_demo_ta.c rename to sdk/src/TA/rsa_demo/rsa_demo_ta.c diff --git a/sdk/src/TA/sample/secstorage_demo/CMakeLists.txt b/sdk/src/TA/secstorage_demo/CMakeLists.txt similarity index 100% rename from sdk/src/TA/sample/secstorage_demo/CMakeLists.txt rename to sdk/src/TA/secstorage_demo/CMakeLists.txt diff --git a/sdk/src/TA/sample/secstorage_demo/Makefile b/sdk/src/TA/secstorage_demo/Makefile similarity index 100% rename from sdk/src/TA/sample/secstorage_demo/Makefile rename to sdk/src/TA/secstorage_demo/Makefile diff --git a/sdk/src/TA/sample/secstorage_demo/build.sh b/sdk/src/TA/secstorage_demo/build.sh similarity index 100% rename from sdk/src/TA/sample/secstorage_demo/build.sh rename to sdk/src/TA/secstorage_demo/build.sh diff --git a/sdk/src/TA/sample/secstorage_demo/config.cmake b/sdk/src/TA/secstorage_demo/config.cmake similarity index 100% rename from sdk/src/TA/sample/secstorage_demo/config.cmake rename to sdk/src/TA/secstorage_demo/config.cmake diff --git a/sdk/src/TA/sample/secstorage_demo/config.mk b/sdk/src/TA/secstorage_demo/config.mk similarity index 100% rename from sdk/src/TA/sample/secstorage_demo/config.mk rename to sdk/src/TA/secstorage_demo/config.mk diff --git a/sdk/src/TA/sample/secstorage_demo/config_ta_public.ini b/sdk/src/TA/secstorage_demo/config_ta_public.ini similarity index 100% rename from sdk/src/TA/sample/secstorage_demo/config_ta_public.ini rename to sdk/src/TA/secstorage_demo/config_ta_public.ini diff --git a/sdk/src/TA/sample/secstorage_demo/configs.xml b/sdk/src/TA/secstorage_demo/configs.xml similarity index 100% rename from sdk/src/TA/sample/secstorage_demo/configs.xml rename to sdk/src/TA/secstorage_demo/configs.xml diff --git a/sdk/src/TA/sample/secstorage_demo/defconfig b/sdk/src/TA/secstorage_demo/defconfig similarity index 100% rename from sdk/src/TA/sample/secstorage_demo/defconfig rename to sdk/src/TA/secstorage_demo/defconfig diff --git a/sdk/src/TA/sample/secstorage_demo/secstorage_demo.c b/sdk/src/TA/secstorage_demo/secstorage_demo.c similarity index 100% rename from sdk/src/TA/sample/secstorage_demo/secstorage_demo.c rename to sdk/src/TA/secstorage_demo/secstorage_demo.c From 8bcf1020da690cae04818b38e0b3685ddb9158d0 Mon Sep 17 00:00:00 2001 From: pete-lipeng Date: Mon, 28 Aug 2023 17:45:34 +0800 Subject: [PATCH 3/5] modify docs name Signed-off-by: pete-lipeng --- docs/opentrustee-guidelines/README-CN.md | 10 +++++----- ...ines.md => opentrustee-ca-ta-develop-guidelines.md} | 2 ++ ...troduction.md => opentrustee-compatibility-test.md} | 2 +- ...-introduction.md => opentrustee-debug-mechanism.md} | 2 +- ... opentrustee-new-platform-adaptation-guidelines.md} | 4 ++-- 5 files changed, 11 insertions(+), 9 deletions(-) rename docs/opentrustee-guidelines/{opentrustee-app-develop-guidelines.md => opentrustee-ca-ta-develop-guidelines.md} (99%) rename docs/opentrustee-guidelines/{opentrustee-compatibility-test-suite-introduction.md => opentrustee-compatibility-test.md} (96%) rename docs/opentrustee-guidelines/{opentrustee-debug-mechanism-introduction.md => opentrustee-debug-mechanism.md} (99%) rename docs/opentrustee-guidelines/{opentrustee-enable-new-platform-adaptation-guidelines.md => opentrustee-new-platform-adaptation-guidelines.md} (99%) diff --git a/docs/opentrustee-guidelines/README-CN.md b/docs/opentrustee-guidelines/README-CN.md index 5976888..b7e40d1 100644 --- a/docs/opentrustee-guidelines/README-CN.md +++ b/docs/opentrustee-guidelines/README-CN.md @@ -1,7 +1,7 @@ # OpenTrustee指南 -- [OpenTrustee系统概述](overview-of-opentrustee.md) -- [OpenTrustee应用开发指导](opentrustee-app-develop-guidelines.md) -- [OpenTrustee调试机制介绍](opentrustee-debug-mechanism-introduction.md) -- [OpenTrustee兼容性测试套件介绍](opentrustee-compatibility-test-suite-introduction.md) -- [OpenTrustee使能新平台适配指导](opentrustee-enable-new-platform-adaptation-guidelines.md) \ No newline at end of file +- [OpenTrustee概述](overview-of-opentrustee.md) +- [OpenTrustee CA/TA开发指南](opentrustee-ca-ta-develop-guidelines.md) +- [OpenTrustee调试机制](opentrustee-debug-mechanism.md) +- [OpenTrustee兼容性测试](opentrustee-compatibility-test.md) +- [OpenTrustee新平台适配指南](opentrustee-new-platform-adaptation-guidelines.md) \ No newline at end of file diff --git a/docs/opentrustee-guidelines/opentrustee-app-develop-guidelines.md b/docs/opentrustee-guidelines/opentrustee-ca-ta-develop-guidelines.md similarity index 99% rename from docs/opentrustee-guidelines/opentrustee-app-develop-guidelines.md rename to docs/opentrustee-guidelines/opentrustee-ca-ta-develop-guidelines.md index 196c865..01afcb3 100644 --- a/docs/opentrustee-guidelines/opentrustee-app-develop-guidelines.md +++ b/docs/opentrustee-guidelines/opentrustee-ca-ta-develop-guidelines.md @@ -1,5 +1,7 @@ +# OpenTrustee CA/TA开发指南 + ## CA/TA访问机制 OpenTrustee应用分为CA（客户端应用）和TA（可信应用）。OpenTrustee支持CA访问TA，也支持TA访问TA。TA采用命令响应机制，交互流程如下： diff --git a/docs/opentrustee-guidelines/opentrustee-compatibility-test-suite-introduction.md b/docs/opentrustee-guidelines/opentrustee-compatibility-test.md similarity index 96% rename from docs/opentrustee-guidelines/opentrustee-compatibility-test-suite-introduction.md rename to docs/opentrustee-guidelines/opentrustee-compatibility-test.md index df95f88..1992529 100644 --- a/docs/opentrustee-guidelines/opentrustee-compatibility-test-suite-introduction.md +++ b/docs/opentrustee-guidelines/opentrustee-compatibility-test.md @@ -1,4 +1,4 @@ -## OpenTrustee的验证测试套件说明 +# OpenTrustee兼容性测试 OpenTrustee提供了acts兼容性测试套件，CA的具体目录在`test/xts/acts/tee`下，TA以签名后的二进制存放在`https://gitee.com/openharmony-sig/compatibility/tree/master/test_suite/resource/tee`资源目录下。 | 测试CA | 测试TA | 说明 | | ------------ | ------------------------------------------------------------ | --- | diff --git a/docs/opentrustee-guidelines/opentrustee-debug-mechanism-introduction.md b/docs/opentrustee-guidelines/opentrustee-debug-mechanism.md similarity index 99% rename from docs/opentrustee-guidelines/opentrustee-debug-mechanism-introduction.md rename to docs/opentrustee-guidelines/opentrustee-debug-mechanism.md index 7708ad4..943cc85 100644 --- a/docs/opentrustee-guidelines/opentrustee-debug-mechanism-introduction.md +++ b/docs/opentrustee-guidelines/opentrustee-debug-mechanism.md @@ -1,4 +1,4 @@ -# OpenTrustee调试机制介绍 +# OpenTrustee调试机制 ## TEE侧日志查看 diff --git a/docs/opentrustee-guidelines/opentrustee-enable-new-platform-adaptation-guidelines.md b/docs/opentrustee-guidelines/opentrustee-new-platform-adaptation-guidelines.md similarity index 99% rename from docs/opentrustee-guidelines/opentrustee-enable-new-platform-adaptation-guidelines.md rename to docs/opentrustee-guidelines/opentrustee-new-platform-adaptation-guidelines.md index bf4a2bc..9790e54 100644 --- a/docs/opentrustee-guidelines/opentrustee-enable-new-platform-adaptation-guidelines.md +++ b/docs/opentrustee-guidelines/opentrustee-new-platform-adaptation-guidelines.md @@ -1,4 +1,4 @@ -# OpenTrustee 使能新平台的指南 +# OpenTrustee 新平台适配指南 本章节介绍如何针对一款芯片适配OpenTrustee，包含TEE CLient、TEE Tzdriver、TEE Loader、TEE ATF的适配。 ## Tee Client的适配 @@ -120,7 +120,7 @@ tzdriver有一些特性或者选项，可以选择配置，控制这些选项的 CONFIG_TEELOG=y CONFIG_PAGES_MEM=y CONFIG_THIRDPARTY_COMPATIBLE=y - + ``` 各选项其含义如下表所示： From 2af62e375bcd2eab8f1542e8d87058792d2c47cd Mon Sep 17 00:00:00 2001 From: pete-lipeng Date: Mon, 28 Aug 2023 17:49:58 +0800 Subject: [PATCH 4/5] change TA dir Signed-off-by: pete-lipeng --- sdk/build/build_ta.sh | 2 +- sdk/src/TA/helloworld_demo/Makefile | 2 +- sdk/src/TA/helloworld_demo/build_ta.sh | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/sdk/build/build_ta.sh b/sdk/build/build_ta.sh index d74b574..f3a008d 100755 --- a/sdk/build/build_ta.sh +++ b/sdk/build/build_ta.sh @@ -15,7 +15,7 @@ set -e export SOURCE_PATH=$(dirname $0) export ABS_SOURCE_PATH=$(cd ${SOURCE_PATH};pwd) -export TEE_BUILD_PATH=${ABS_SOURCE_PATH}/../../../../ +export TEE_BUILD_PATH=${ABS_SOURCE_PATH}/../../../ SIGNTOOL_DIR=${TEE_BUILD_PATH}/build/tools CUR_DIR=$(pwd) diff --git a/sdk/src/TA/helloworld_demo/Makefile b/sdk/src/TA/helloworld_demo/Makefile index 9983845..219499a 100644 --- a/sdk/src/TA/helloworld_demo/Makefile +++ b/sdk/src/TA/helloworld_demo/Makefile @@ -17,7 +17,7 @@ TARGET_IS_ARM64 = y # If no API_LEVEL is specified, API of GP 1.1.1 will be taken CFLAGS += -DAPI_LEVEL=2 -include ../../../../build/mk/common.mk +include ../../../build/mk/common.mk SRC += $(wildcard ./*.c) diff --git a/sdk/src/TA/helloworld_demo/build_ta.sh b/sdk/src/TA/helloworld_demo/build_ta.sh index 4b3106e..30c45e5 120000 --- a/sdk/src/TA/helloworld_demo/build_ta.sh +++ b/sdk/src/TA/helloworld_demo/build_ta.sh @@ -1 +1 @@ -../../../../build/build_ta.sh \ No newline at end of file +../../../build/build_ta.sh \ No newline at end of file From e7ea08d9427170aaf978bcd34e0c0381d5123c2a Mon Sep 17 00:00:00 2001 From: pete-lipeng Date: Mon, 28 Aug 2023 21:14:10 +0800 Subject: [PATCH 5/5] add opentrustee guide Signed-off-by: pete-lipeng --- sdk/CHANGELOG => CHANGELOG.md | 2 +- VERSION | 1 + .../opentrustee-ca-ta-develop-guidelines.md | 62 ++++++++++++++----- .../overview-of-opentrustee.md | 8 +++ 4 files changed, 55 insertions(+), 18 deletions(-) rename sdk/CHANGELOG => CHANGELOG.md (66%) create mode 100644 VERSION diff --git a/sdk/CHANGELOG b/CHANGELOG.md similarity index 66% rename from sdk/CHANGELOG rename to CHANGELOG.md index 1ad0d9e..a21dfad 100644 --- a/sdk/CHANGELOG +++ b/CHANGELOG.md @@ -1,4 +1,4 @@ -VERSION 1.0.0 (Jan 28, 2022) +VERSION 1.0.0 (Aug 28, 2023) ====== Features: --------- diff --git a/VERSION b/VERSION new file mode 100644 index 0000000..3eefcb9 --- /dev/null +++ b/VERSION @@ -0,0 +1 @@ +1.0.0 diff --git a/docs/opentrustee-guidelines/opentrustee-ca-ta-develop-guidelines.md b/docs/opentrustee-guidelines/opentrustee-ca-ta-develop-guidelines.md index 01afcb3..fe49faf 100644 --- a/docs/opentrustee-guidelines/opentrustee-ca-ta-develop-guidelines.md +++ b/docs/opentrustee-guidelines/opentrustee-ca-ta-develop-guidelines.md @@ -92,10 +92,6 @@ TA安装包是以“.sec”为后缀名的包文件，文件格式如下：包 ![](figures/storage-format-of-ta.png) - - - - ### TA签名机制 TA签名：由于TA安装包放在非安全侧文件系统中，需要对TA安装包做签名，确保加载到OpenTrutee中的TA安装包没有被篡改。OpenTrustee提供的SDK开发套件中，包含了TA的签名工具，支持对TA安装包一键签名。需要在OpenTrustee SDK开发套件中预置TA签名的私钥。 @@ -119,8 +115,9 @@ OpenTrustee提供了SDK开发套件支持独立开发TA，该开发套件集成 ├── include │ └── TA # 给TA提供的TEE头文件 ├── src -│ └── TA # 放置TA源码 - └── sample # TA示例代码 +│ └── TA # 放置TA源码和示例 + └── helloworld_demo # TA helloworld示例 + └── secstorage_demo # 安全存储示例 ├── thirdparty │ └── open_source │ └── import_open_source_header.sh # 导入TA编译依赖的musl头文件和安全函数库头文件 @@ -130,8 +127,9 @@ OpenTrustee提供了SDK开发套件支持独立开发TA，该开发套件集成 ``` - 开发语言：C语言 -- 开发环境：linux操作系统 -- OpenTrustee SDK套件下载地址：https://gitee.com/openharmony-sig/tee_tee_dev_kit +- 代码编辑器：未提供特定编辑器，任意支持C语言开发的编辑器均可 +- SDK执行环境：linux操作系统 +- SDK套件下载地址：https://gitee.com/openharmony-sig/tee_tee_dev_kit #### 开发套件准备 @@ -184,29 +182,59 @@ OpenTrustee SDK中预置了对TA文件进行签名的私钥，该预置私钥只 如果开发者替换了OpenTrustee SDK中的签名私钥，需要对应替换OpenTrustee操作系统中的验签公钥，验签公钥的路径：tee_os_framework/lib/syslib/libelf_verify_key/src/common/ta_verify_key.c。 -##### 安装python工具 +##### 工具安装 -OpenTrustee SDK中用到了python脚本来完成TA的属性配置文件解析、对TA文件进行签名等操作，因此需要在开发环境上安装python工具。 +###### 安装python工具 -1、安装python3及以上版本 +OpenTrustee SDK中用到了python脚本来完成TA的属性配置文件解析、对TA文件进行签名等操作，因此需要在开发环境上安装python工具。以Ubuntu系统为例，安装命令如下： + +1、安装python3 + +``` +sudo apt-get update +sudo apt-get install python3 python3-pip +``` 2、安装python相关的库，如： ``` pip install pycryptodome - pip install defusedxml ``` 如果在编译过程中提示缺少其他python库，需要一并安装。 +###### 安装openssl工具 + +OpenTrustee SDK使用openssl工具的签名算法来对TA文件进行签名，需要在开发环境上安装openssl工具。 + +``` +sudo apt-get install openssl +``` + +###### 安装make工具 + +需要在开发环境上安装make工具来对TA源码进行编译。 + +``` +sudo apt-get install make +``` + ### TA开发步骤 +开发一个新的TA时，需要在tee_dev_kit/sdk/src/TA目录下创建新的TA源码目录，目录结构可以参考该目录下demo示例代码。以helloworld_demo为例，目录结构如下： + +``` +├── helloworld_demo + ├── ta_demo.c # TA源码文件 + ├── configs.xml # TA属性配置文件 + ├── Makefile # TA编译Makefile + ├── build_ta.sh # TA一键生成脚本 +``` + ##### TA代码编写 -开发一个新的TA时，需要在tee_dev_kit/sdk/src/TA目录下创建新的TA源码目录。 - -TA必须实现如下GP TEE标准规定的入口函数： +TA代码必须实现如下GP TEE标准规定的入口函数： | TA入口函数名称 | 函数描述 | | -------------------------- | ----------------------------------------------------- | @@ -227,7 +255,7 @@ TA需要自行编写Makefile文件，可参考SDK中示例代码。有如下要 ##### TA属性配置 -TA源码目录下需要包含configs.xml，定义TA的属性信息。 +每个TA源码目录下需要包含configs.xml，定义该TA的属性信息。 | 属性名 | 数据类型 | 属性描述 | 系统默认值 | | ------------------- | -------- | ------------------------------------------------------------ | ---------- | @@ -259,7 +287,7 @@ TA源码目录下需要包含configs.xml，定义TA的属性信息。 ##### TA编译和签名 -OpenTrustee SDK中提供了TA一键编译和签名脚本，将tee_dev_kit/sdk/build/build_ta.sh拷贝到TA源码目录执行，即完成TA编译、属性配置文件解析、签名等操作，在当前目录生成uuid.sec命名的TA安装包文件。 +OpenTrustee SDK中提供了TA一键生成脚本，将tee_dev_kit/sdk/build/build_ta.sh拷贝到TA源码目录执行，即完成TA编译、属性配置文件解析、签名等操作，在当前目录生成uuid.sec命名的TA安装包文件。 ##### TA规格约束 diff --git a/docs/opentrustee-guidelines/overview-of-opentrustee.md b/docs/opentrustee-guidelines/overview-of-opentrustee.md index 59f2dab..c16c024 100644 --- a/docs/opentrustee-guidelines/overview-of-opentrustee.md +++ b/docs/opentrustee-guidelines/overview-of-opentrustee.md @@ -73,3 +73,11 @@ OpenTrustee是一套完整的TEE解决方案，包含多个部件，系统架构 ## license 遵循Mulan PSL V2协议; + +## 版本号 + +OpenTrustee版本号管理规则遵循[Semantic Versioning 2.0.0](https://semver.org/) + +OpenTrustee当前版本号记录在VERSION文件中 + +OpenTrustee版本号变更记录在CHANGELOG.md文件中